Merge branch 'qemu-cvs'kvm-57rc1

Signed-off-by: Avi Kivity <avi@qumranet.com>

586 files changed, 75208 insertions, 24496 deletions

diff --git a/.cvsignore b/.cvsignore
index ffbf37d19..81d708236 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,18 +1,9 @@
-arm-user
-arm-softmmu
-armeb-user
 config-host.*
 dyngen
 i386
-i386-softmmu
-i386-user
-ppc-softmmu
-ppc64-softmmu
-ppcemb-softmmu
-ppc-darwin-user
-ppc-linux-user
-ppc64-linux-user
-ppcemb-linux-user
+*-softmmu
+*-darwin-user
+*-linux-user
 qemu-doc.html
 qemu-tech.html
 qemu-doc.info
@@ -21,30 +12,8 @@ qemu.1
 qemu.pod
 qemu-img.1
 qemu-img.pod
-sparc-user
 qemu-img
-sparc-softmmu
-x86_64-softmmu
-x86_64-linux-user
-sparc64-linux-user
-sparc64-softmmu
-mips-softmmu
-mipsel-softmmu
-mips-linux-user
-mipsel-linux-user
-mips64-softmmu
-mips64el-softmmu
-mipsn32-linux-user
-mipsn32el-linux-user
-mips64-linux-user
-mips64el-linux-user
-m68k-linux-user
-m68k-softmmu
 .gdbinit
-sh4-user
-sh4-softmmu
-alpha-linux-user
-alpha-softmmu
 *.aux
 *.cp
 *.dvi
@@ -55,3 +24,4 @@ alpha-softmmu
 *.toc
 *.tp
 *.vr
+*.d
diff --git a/Changelog b/Changelog
index f61a58061..17b97ecdd 100644
--- a/Changelog
+++ b/Changelog
@@ -3,15 +3,21 @@
   - Monitor multiplexing to several I/O channels (Jason Wessel)
   - ds1225y nvram support (Herve Poussineau)
   - CPU model selection support (J. Mayer, Paul Brook, Herve Poussineau)
-  - Several Sparc fixes (Aurelien Jarno, Blue Swirl)
+  - Several Sparc fixes (Aurelien Jarno, Blue Swirl, Robert Reif)
   - MIPS 64-bit FPU support (Thiemo Seufer)
-  - Xscale PDA emulation (Andrzei Zaborowski)
+  - Xscale PDA emulation (Andrzej Zaborowski)
   - ColdFire system emulation (Paul Brook)
   - Improved SH4 support (Magnus Damm)
   - MIPS64 support (Aurelien Jarno, Thiemo Seufer)
   - Preliminary Alpha guest support (J. Mayer)
   - Read-only support for Parallels disk images (Alex Beregszaszi)
   - SVM (x86 virtualization) support (Alexander Graf)
+  - CRIS emulation (Edgar E. Iglesias)
+  - SPARC32PLUS execution support (Blue Swirl)
+  - MIPS mipssim pseudo machine (Thiemo Seufer)
+  - Strace for Linux userland emulation (Stuart Anderson, Thayne Harbaugh)
+  - OMAP310 MPU emulation plus Palm T|E machine (Andrzej Zaborowski)
+  - ARM v6, v7, NEON SIMD and SMP emulation (Paul Brook/CodeSourcery)
 
 version 0.9.0:
 
diff --git a/Makefile b/Makefile
index 053c88cc3..bc91d29b2 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,9 @@
 include config-host.mak
 
 .PHONY: all clean distclean dvi info install install-doc tar tarbin \
-	speed test test2 html dvi info
+	speed test html dvi info
+
+VPATH=$(SRC_PATH):$(SRC_PATH)/hw
 
 BASE_CFLAGS=
 BASE_LDFLAGS=
@@ -11,7 +13,8 @@ BASE_LDFLAGS=
 BASE_CFLAGS += $(OS_CFLAGS) $(ARCH_CFLAGS)
 BASE_LDFLAGS += $(OS_LDFLAGS) $(ARCH_LDFLAGS)
 
-CPPFLAGS += -I. -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
+CPPFLAGS += -I. -I$(SRC_PATH) -MMD -MP
+CPPFLAGS += -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
 LIBS=
 ifdef CONFIG_STATIC
 BASE_LDFLAGS += -static
@@ -24,23 +27,125 @@ endif
 
 LIBS+=$(AIOLIBS)
 
-all: $(TOOLS) $(DOCS) recurse-all
+all: $(TOOLS) $(DOCS) recurse-all 
 
-subdir-%: dyngen$(EXESUF)
+subdir-%: dyngen$(EXESUF) libqemu_common.a
 	$(MAKE) -C $(subst subdir-,,$@) all
 
 recurse-all: $(patsubst %,subdir-%, $(TARGET_DIRS))
 
-qemu-img$(EXESUF): qemu-img.c cutils.c block.c block-raw.c block-cow.c block-qcow.c aes.c block-vmdk.c block-cloop.c block-dmg.c block-bochs.c block-vpc.c block-vvfat.c block-qcow2.c block-parallels.c
-	$(CC) -DQEMU_TOOL $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) $(LDFLAGS) $(BASE_LDFLAGS) -o $@ $^ -lz $(LIBS)
+#######################################################################
+# BLOCK_OBJS is code used by both qemu system emulation and qemu-img
+
+BLOCK_OBJS=cutils.o
+BLOCK_OBJS+=block-cow.o block-qcow.o aes.o block-vmdk.o block-cloop.o
+BLOCK_OBJS+=block-dmg.o block-bochs.o block-vpc.o block-vvfat.o
+BLOCK_OBJS+=block-qcow2.o block-parallels.o
+
+######################################################################
+# libqemu_common.a: Target indepedent part of system emulation. The
+# long term path is to suppress *all* target specific code in case of
+# system emulation, i.e. a single QEMU executable should support all
+# CPUs and machines.
+
+OBJS=$(BLOCK_OBJS)
+OBJS+=readline.o console.o
+OBJS+=block.o
+
+OBJS+=irq.o
+OBJS+=i2c.o smbus.o smbus_eeprom.o max7310.o max111x.o wm8750.o
+OBJS+=ssd0303.o ssd0323.o ads7846.o stellaris_input.o
+OBJS+=scsi-disk.o cdrom.o
+OBJS+=usb.o usb-hub.o usb-linux.o usb-hid.o usb-msd.o usb-wacom.o
+OBJS+=sd.o ssi-sd.o
+
+ifdef CONFIG_WIN32
+OBJS+=tap-win32.o
+endif
+
+AUDIO_OBJS = audio.o noaudio.o wavaudio.o mixeng.o
+ifdef CONFIG_SDL
+AUDIO_OBJS += sdlaudio.o
+endif
+ifdef CONFIG_OSS
+AUDIO_OBJS += ossaudio.o
+endif
+ifdef CONFIG_COREAUDIO
+AUDIO_OBJS += coreaudio.o
+endif
+ifdef CONFIG_ALSA
+AUDIO_OBJS += alsaaudio.o
+endif
+ifdef CONFIG_DSOUND
+AUDIO_OBJS += dsoundaudio.o
+endif
+ifdef CONFIG_FMOD
+AUDIO_OBJS += fmodaudio.o
+audio/audio.o audio/fmodaudio.o: CPPFLAGS := -I$(CONFIG_FMOD_INC) $(CPPFLAGS)
+endif
+AUDIO_OBJS+= wavcapture.o
+OBJS+=$(addprefix audio/, $(AUDIO_OBJS))
+
+ifdef CONFIG_SDL
+OBJS+=sdl.o x_keymap.o
+endif
+OBJS+=vnc.o d3des.o
+
+ifdef CONFIG_COCOA
+OBJS+=cocoa.o
+endif
+
+ifdef CONFIG_SLIRP
+CPPFLAGS+=-I$(SRC_PATH)/slirp
+SLIRP_OBJS=cksum.o if.o ip_icmp.o ip_input.o ip_output.o \
+slirp.o mbuf.o misc.o sbuf.o socket.o tcp_input.o tcp_output.o \
+tcp_subr.o tcp_timer.o udp.o bootp.o debug.o tftp.o
+OBJS+=$(addprefix slirp/, $(SLIRP_OBJS))
+endif
+
+cocoa.o: cocoa.m
+	$(CC) $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -c -o $@ $<
+
+sdl.o: sdl.c keymaps.c sdl_keysym.h
+	$(CC) $(CFLAGS) $(CPPFLAGS) $(SDL_CFLAGS) $(BASE_CFLAGS) -c -o $@ $<
 
+vnc.o: vnc.c keymaps.c sdl_keysym.h vnchextile.h d3des.c d3des.h
+	$(CC) $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) $(CONFIG_VNC_TLS_CFLAGS) -c -o $@ $<
+
+audio/sdlaudio.o: audio/sdlaudio.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) $(SDL_CFLAGS) $(BASE_CFLAGS) -c -o $@ $<
+
+libqemu_common.a: $(OBJS)
+	rm -f $@ 
+	$(AR) rcs $@ $(OBJS)
+
+QEMU_IMG_BLOCK_OBJS = $(BLOCK_OBJS)
+ifdef CONFIG_WIN32
+QEMU_IMG_BLOCK_OBJS += qemu-img-block-raw-win32.o
+else
+QEMU_IMG_BLOCK_OBJS += qemu-img-block-raw-posix.o
+endif
+
+######################################################################
+
+qemu-img$(EXESUF): qemu-img.o qemu-img-block.o $(QEMU_IMG_BLOCK_OBJS)
+	$(CC) $(LDFLAGS) $(BASE_LDFLAGS) -o $@ $^ -lz $(LIBS)
+
+qemu-img-%.o: %.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) -DQEMU_IMG $(BASE_CFLAGS) -c -o $@ $<
+
+%.o: %.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -c -o $@ $<
+
+# dyngen host tool
 dyngen$(EXESUF): dyngen.c
 	$(HOST_CC) $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -o $@ $^
 
 clean:
 # avoid old build problems by removing potentially incorrect old files
 	rm -f config.mak config.h op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
-	rm -f *.o *.a $(TOOLS) dyngen$(EXESUF) TAGS cscope.* *.pod *~ */*~
+	rm -f *.o *.d *.a $(TOOLS) dyngen$(EXESUF) TAGS cscope.* *.pod *~ */*~
+	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d
 	$(MAKE) -C tests clean
 	for d in $(TARGET_DIRS); do \
 	$(MAKE) -C $$d $@ || exit 1 ; \
@@ -67,7 +172,9 @@ endif
 
 install: all $(if $(BUILD_DOCS),install-doc)
 	mkdir -p "$(DESTDIR)$(bindir)"
-	$(INSTALL) -m 755 $(TOOLS) "$(DESTDIR)$(bindir)"
+ifneq ($(TOOLS),)
+	$(INSTALL) -m 755 -s $(TOOLS) "$(DESTDIR)$(bindir)"
+endif
 	mkdir -p "$(DESTDIR)$(datadir)"
 	for x in bios.bin vgabios.bin vgabios-cirrus.bin ppc_rom.bin \
 		video.x openbios-sparc32 pxe-ne2k_pci.bin \
@@ -85,7 +192,7 @@ endif
         done
 
 # various test targets
-test speed test2: all
+test speed: all
 	$(MAKE) -C tests $@
 
 TAGS:
@@ -146,6 +253,7 @@ tarbin:
 	$(bindir)/qemu-system-arm \
 	$(bindir)/qemu-system-m68k \
 	$(bindir)/qemu-system-sh4 \
+	$(bindir)/qemu-system-sh4eb \
 	$(bindir)/qemu-i386 \
         $(bindir)/qemu-arm \
         $(bindir)/qemu-armeb \
@@ -161,6 +269,7 @@ tarbin:
         $(bindir)/qemu-alpha \
         $(bindir)/qemu-m68k \
         $(bindir)/qemu-sh4 \
+        $(bindir)/qemu-sh4eb \
         $(bindir)/qemu-img \
 	$(datadir)/bios.bin \
 	$(datadir)/vgabios.bin \
@@ -178,3 +287,6 @@ tarbin:
 ifneq ($(wildcard .depend),)
 include .depend
 endif
+
+# Include automatically generated dependency files
+-include $(wildcard *.d audio/*.d slirp/*.d)
diff --git a/Makefile.target b/Makefile.target
index c97dbf814..12fb0434c 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -17,6 +17,9 @@ endif
 ifeq ($(TARGET_ARCH), ppc64)
 TARGET_BASE_ARCH:=ppc
 endif
+ifeq ($(TARGET_ARCH), ppc64h)
+TARGET_BASE_ARCH:=ppc
+endif
 ifeq ($(TARGET_ARCH), ppcemb)
 TARGET_BASE_ARCH:=ppc
 endif
@@ -27,15 +30,18 @@ ifeq ($(TARGET_ARCH), ia64)
 TARGET_BASE_ARCH:=ia64
 endif
 TARGET_PATH=$(SRC_PATH)/target-$(TARGET_BASE_ARCH)
-VPATH=$(SRC_PATH):$(TARGET_PATH):$(SRC_PATH)/hw:$(SRC_PATH)/audio
-CPPFLAGS=-I. -I.. -I$(TARGET_PATH) -I$(SRC_PATH)
+VPATH=$(SRC_PATH):$(TARGET_PATH):$(SRC_PATH)/hw
+CPPFLAGS=-I. -I.. -I$(TARGET_PATH) -I$(SRC_PATH) -MMD -MP -DNEED_CPU_H
 ifdef CONFIG_DARWIN_USER
 VPATH+=:$(SRC_PATH)/darwin-user
 CPPFLAGS+=-I$(SRC_PATH)/darwin-user -I$(SRC_PATH)/darwin-user/$(TARGET_ARCH)
 endif
 ifdef CONFIG_LINUX_USER
 VPATH+=:$(SRC_PATH)/linux-user
-CPPFLAGS+=-I$(SRC_PATH)/linux-user -I$(SRC_PATH)/linux-user/$(TARGET_ARCH)
+ifndef TARGET_ABI_DIR
+  TARGET_ABI_DIR=$(TARGET_ARCH)
+endif
+CPPFLAGS+=-I$(SRC_PATH)/linux-user -I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR)
 endif
 BASE_CFLAGS=
 BASE_LDFLAGS=
@@ -70,6 +76,11 @@ ifeq ($(TARGET_ARCH),mips64)
     TARGET_ARCH2=mips64el
   endif
 endif
+ifeq ($(TARGET_ARCH),sparc64)
+  ifeq ($(TARGET_ABI_DIR),sparc)
+    TARGET_ARCH2=sparc32plus
+  endif
+endif
 QEMU_USER=qemu-$(TARGET_ARCH2)
 # system emulator name
 ifdef CONFIG_SOFTMMU
@@ -136,15 +147,15 @@ endif
 endif
 
 ifeq ($(ARCH),x86_64)
-BASE_LDFLAGS+=-Wl,-T,$(SRC_PATH)/$(ARCH).ld
+  ifneq ($(CONFIG_SOLARIS),yes)
+    BASE_LDFLAGS+=-Wl,-T,$(SRC_PATH)/$(ARCH).ld
+  endif
 endif
 
 ifeq ($(ARCH),ppc)
 CPPFLAGS+= -D__powerpc__
-ifdef CONFIG_LINUX_USER
 BASE_LDFLAGS+=-Wl,-T,$(SRC_PATH)/$(ARCH).ld
 endif
-endif
 
 ifeq ($(ARCH),s390)
 BASE_LDFLAGS+=-Wl,-T,$(SRC_PATH)/$(ARCH).ld
@@ -157,7 +168,7 @@ ifeq ($(ARCH),sparc)
     OP_CFLAGS+=-fno-omit-frame-pointer
   else
     BASE_CFLAGS+=-ffixed-g1 -ffixed-g6
-    HELPER_CFLAGS=$(CFLAGS) -ffixed-i0 -mflat
+    HELPER_CFLAGS=$(CFLAGS) -ffixed-i0
     # -static is used to avoid g1/g3 usage by the dynamic linker
     BASE_LDFLAGS+=-Wl,-T,$(SRC_PATH)/$(ARCH).ld -static
   endif
@@ -255,12 +266,16 @@ main.o: BASE_CFLAGS+=-p
 endif
 
 ifdef CONFIG_LINUX_USER
-OBJS= main.o syscall.o mmap.o signal.o path.o osdep.o thunk.o \
-      elfload.o linuxload.o
+OBJS= main.o syscall.o strace.o mmap.o signal.o path.o osdep.o thunk.o \
+      elfload.o linuxload.o uaccess.o
 LIBS+= $(AIOLIBS)
 ifdef TARGET_HAS_BFLT
 OBJS+= flatload.o
 endif
+ifdef TARGET_HAS_ELFLOAD32
+OBJS+= elfload32.o
+elfload32.o: elfload.c
+endif
 
 ifeq ($(TARGET_ARCH), i386)
 OBJS+= vm86.o
@@ -295,9 +310,6 @@ CPPFLAGS+=-I$(SRC_PATH)/fpu
 ifeq ($(TARGET_ARCH), i386)
 LIBOBJS+=helper.o helper2.o
 LIBOBJS+=qemu-kvm-x86.o
-ifeq ($(ARCH), i386)
-LIBOBJS+=translate-copy.o
-endif
 endif
 
 ifeq ($(TARGET_ARCH), x86_64)
@@ -332,10 +344,22 @@ endif
 ifeq ($(TARGET_BASE_ARCH), alpha)
 LIBOBJS+= op_helper.o helper.o alpha_palcode.o
 endif
+
 ifeq ($(TARGET_BASE_ARCH), ia64)
 LIBOBJS+=op_helper.o firmware.o
 LIBOBJS+=qemu-kvm-ia64.o
 endif
+
+ifeq ($(TARGET_BASE_ARCH), cris)
+LIBOBJS+= op_helper.o helper.o
+LIBOBJS+= cris-dis.o
+
+ifndef CONFIG_USER_ONLY
+LIBOBJS+= mmu.o
+endif
+endif
+
+
 # NOTE: the disassembler code is only needed for debugging
 LIBOBJS+=disas.o
 ifeq ($(findstring i386, $(TARGET_ARCH) $(ARCH)),i386)
@@ -387,43 +411,29 @@ ifeq ($(ARCH),alpha)
 endif
 
 # must use static linking to avoid leaving stuff in virtual address space
-VL_OBJS=vl.o osdep.o readline.o monitor.o pci.o console.o loader.o isa_mmio.o
-VL_OBJS+=cutils.o migration.o
-VL_OBJS+=block.o block-raw.o
-VL_OBJS+=block-cow.o block-qcow.o aes.o block-vmdk.o block-cloop.o block-dmg.o block-bochs.o block-vpc.o block-vvfat.o block-qcow2.o block-parallels.o
-VL_OBJS+=irq.o
+VL_OBJS=vl.o osdep.o monitor.o pci.o loader.o isa_mmio.o migration.o
+# XXX: suppress QEMU_TOOL tests
 ifdef CONFIG_WIN32
-VL_OBJS+=tap-win32.o
+VL_OBJS+=block-raw-win32.o
+else
+VL_OBJS+=block-raw-posix.o
 endif
 
-SOUND_HW = sb16.o es1370.o
-AUDIODRV = audio.o noaudio.o wavaudio.o mixeng.o
-ifdef CONFIG_SDL
-AUDIODRV += sdlaudio.o
-endif
-ifdef CONFIG_OSS
-AUDIODRV += ossaudio.o
-endif
-ifdef CONFIG_COREAUDIO
-AUDIODRV += coreaudio.o
-endif
 ifdef CONFIG_ALSA
-AUDIODRV += alsaaudio.o
 LIBS += -lasound
 endif
 ifdef CONFIG_DSOUND
-AUDIODRV += dsoundaudio.o
 LIBS += -lole32 -ldxguid
 endif
 ifdef CONFIG_FMOD
-AUDIODRV += fmodaudio.o
-audio.o fmodaudio.o: CPPFLAGS := -I$(CONFIG_FMOD_INC) $(CPPFLAGS)
 LIBS += $(CONFIG_FMOD_LIB)
 endif
+
+SOUND_HW = sb16.o es1370.o
 ifdef CONFIG_ADLIB
 SOUND_HW += fmopl.o adlib.o
 endif
-AUDIODRV+= wavcapture.o
+
 ifdef CONFIG_KVM_KERNEL_INC
 CFLAGS += -I $(CONFIG_KVM_KERNEL_INC)
 LIBS += -lkvm
@@ -435,14 +445,11 @@ CPPFLAGS += $(CONFIG_VNC_TLS_CFLAGS)
 LIBS += $(CONFIG_VNC_TLS_LIBS)
 endif
 
-VL_OBJS += i2c.o smbus.o
-
 # SCSI layer
-VL_OBJS+= scsi-disk.o cdrom.o lsi53c895a.o
+VL_OBJS+= lsi53c895a.o
 
 # USB layer
-VL_OBJS+= usb.o usb-hub.o usb-linux.o usb-hid.o usb-ohci.o usb-msd.o
-VL_OBJS+= usb-wacom.o
+VL_OBJS+= usb-ohci.o
 
 # EEPROM emulation
 VL_OBJS += eeprom93xx.o
@@ -458,10 +465,10 @@ VL_OBJS+= hypercall.o
 
 ifeq ($(TARGET_BASE_ARCH), i386)
 # Hardware support
-VL_OBJS+= ide.o pckbd.o ps2.o vga.o $(SOUND_HW) dma.o $(AUDIODRV)
+VL_OBJS+= ide.o pckbd.o ps2.o vga.o $(SOUND_HW) dma.o
 VL_OBJS+= fdc.o mc146818rtc.o serial.o i8259.o i8254.o pcspk.o pc.o
 VL_OBJS+= cirrus_vga.o apic.o parallel.o acpi.o piix_pci.o
-VL_OBJS+= usb-uhci.o smbus_eeprom.o vmmouse.o vmport.o vmware_vga.o
+VL_OBJS+= usb-uhci.o vmmouse.o vmport.o vmware_vga.o
 CPPFLAGS += -DHAS_AUDIO -DHAS_AUDIO_CHOICE
 endif
 ifeq ($(TARGET_BASE_ARCH), ia64)
@@ -473,20 +480,36 @@ VL_OBJS+= usb-uhci.o smbus_eeprom.o
 CPPFLAGS += -DHAS_AUDIO -DHAS_AUDIO_CHOICE
 endif
 ifeq ($(TARGET_BASE_ARCH), ppc)
-VL_OBJS+= ppc.o ide.o pckbd.o ps2.o vga.o $(SOUND_HW) dma.o $(AUDIODRV)
-VL_OBJS+= mc146818rtc.o serial.o i8259.o i8254.o fdc.o m48t59.o pflash_cfi02.o
-VL_OBJS+= ppc_prep.o ppc_chrp.o cuda.o adb.o openpic.o heathrow_pic.o
-VL_OBJS+= grackle_pci.o prep_pci.o unin_pci.o ppc405_uc.o ppc405_boards.o
 CPPFLAGS += -DHAS_AUDIO -DHAS_AUDIO_CHOICE
+# shared objects
+VL_OBJS+= ppc.o ide.o vga.o $(SOUND_HW) dma.o openpic.o
+# PREP target
+VL_OBJS+= pckbd.o ps2.o serial.o i8259.o i8254.o fdc.o m48t59.o mc146818rtc.o
+VL_OBJS+= prep_pci.o ppc_prep.o
+# Mac shared devices
+VL_OBJS+= macio.o cuda.o adb.o mac_nvram.o mac_dbdma.o
+# OldWorld PowerMac
+VL_OBJS+= heathrow_pic.o grackle_pci.o ppc_oldworld.o
+# NewWorld PowerMac
+VL_OBJS+= unin_pci.o ppc_chrp.o
+# PowerPC 4xx boards
+VL_OBJS+= pflash_cfi02.o ppc4xx_devs.o ppc405_uc.o ppc405_boards.o
 endif
 ifeq ($(TARGET_BASE_ARCH), mips)
-VL_OBJS+= mips_r4k.o mips_malta.o mips_pica61.o
+VL_OBJS+= mips_r4k.o mips_malta.o mips_pica61.o mips_mipssim.o
 VL_OBJS+= mips_timer.o mips_int.o dma.o vga.o serial.o i8254.o i8259.o
 VL_OBJS+= jazz_led.o
 VL_OBJS+= ide.o gt64xxx.o pckbd.o ps2.o fdc.o mc146818rtc.o usb-uhci.o acpi.o ds1225y.o
-VL_OBJS+= piix_pci.o smbus_eeprom.o parallel.o mixeng.o cirrus_vga.o $(SOUND_HW) $(AUDIODRV)
+VL_OBJS+= piix_pci.o parallel.o cirrus_vga.o $(SOUND_HW)
+VL_OBJS+= mipsnet.o
 CPPFLAGS += -DHAS_AUDIO
 endif
+ifeq ($(TARGET_BASE_ARCH), cris)
+VL_OBJS+= etraxfs.o
+VL_OBJS+= ptimer.o
+VL_OBJS+= etraxfs_timer.o
+VL_OBJS+= etraxfs_ser.o
+endif
 ifeq ($(TARGET_BASE_ARCH), sparc)
 ifeq ($(TARGET_ARCH), sparc64)
 VL_OBJS+= sun4u.o ide.o pckbd.o ps2.o vga.o apb_pci.o
@@ -495,38 +518,38 @@ VL_OBJS+= cirrus_vga.o parallel.o ptimer.o
 else
 VL_OBJS+= sun4m.o tcx.o pcnet.o iommu.o m48t59.o slavio_intctl.o
 VL_OBJS+= slavio_timer.o slavio_serial.o slavio_misc.o fdc.o esp.o sparc32_dma.o
-VL_OBJS+= cs4231.o ptimer.o
+VL_OBJS+= cs4231.o ptimer.o eccmemctl.o
 endif
 endif
 ifeq ($(TARGET_BASE_ARCH), arm)
 VL_OBJS+= integratorcp.o versatilepb.o ps2.o smc91c111.o arm_pic.o arm_timer.o
 VL_OBJS+= arm_boot.o pl011.o pl031.o pl050.o pl080.o pl110.o pl181.o pl190.o
-VL_OBJS+= versatile_pci.o sd.o ptimer.o
-VL_OBJS+= arm_gic.o realview.o arm_sysctl.o
+VL_OBJS+= versatile_pci.o ptimer.o
+VL_OBJS+= realview_gic.o realview.o arm_sysctl.o mpcore.o
+VL_OBJS+= armv7m.o armv7m_nvic.o stellaris.o pl022.o stellaris_enet.o
+VL_OBJS+= pl061.o
 VL_OBJS+= arm-semi.o
 VL_OBJS+= pxa2xx.o pxa2xx_pic.o pxa2xx_gpio.o pxa2xx_timer.o pxa2xx_dma.o
-VL_OBJS+= pxa2xx_lcd.o pxa2xx_mmci.o pxa2xx_pcmcia.o max111x.o max7310.o
-VL_OBJS+= spitz.o ads7846.o ide.o serial.o nand.o $(AUDIODRV) wm8750.o
-VL_OBJS+= omap.o omap_lcdc.o omap1_clk.o omap_mmc.o palm.o ecc.o
+VL_OBJS+= pxa2xx_lcd.o pxa2xx_mmci.o pxa2xx_pcmcia.o pxa2xx_keypad.o
+VL_OBJS+= pflash_cfi01.o gumstix.o
+VL_OBJS+= spitz.o ide.o serial.o nand.o ecc.o
+VL_OBJS+= omap.o omap_lcdc.o omap1_clk.o omap_mmc.o omap_i2c.o
+VL_OBJS+= palm.o tsc210x.o
+VL_OBJS+= mst_fpga.o mainstone.o
 CPPFLAGS += -DHAS_AUDIO
 endif
 ifeq ($(TARGET_BASE_ARCH), sh4)
 VL_OBJS+= shix.o r2d.o sh7750.o sh7750_regnames.o tc58128.o
-VL_OBJS+= sh_timer.o ptimer.o sh_serial.o
+VL_OBJS+= sh_timer.o ptimer.o sh_serial.o sh_intc.o
 endif
 ifeq ($(TARGET_BASE_ARCH), m68k)
 VL_OBJS+= an5206.o mcf5206.o ptimer.o mcf_uart.o mcf_intc.o mcf5208.o mcf_fec.o
-VL_OBJS+= m68k-semi.o
+VL_OBJS+= m68k-semi.o dummy_m68k.o
 endif
 ifdef CONFIG_GDBSTUB
 VL_OBJS+=gdbstub.o
 endif
-ifdef CONFIG_SDL
-VL_OBJS+=sdl.o x_keymap.o
-endif
-VL_OBJS+=vnc.o d3des.o
 ifdef CONFIG_COCOA
-VL_OBJS+=cocoa.o
 COCOA_LIBS=-F/System/Library/Frameworks -framework Cocoa -framework IOKit
 ifdef CONFIG_COREAUDIO
 COCOA_LIBS+=-framework CoreAudio
@@ -534,10 +557,6 @@ endif
 endif
 ifdef CONFIG_SLIRP
 CPPFLAGS+=-I$(SRC_PATH)/slirp
-SLIRP_OBJS=cksum.o if.o ip_icmp.o ip_input.o ip_output.o \
-slirp.o mbuf.o misc.o sbuf.o socket.o tcp_input.o tcp_output.o \
-tcp_subr.o tcp_timer.o udp.o bootp.o debug.o tftp.o
-VL_OBJS+=$(addprefix slirp/, $(SLIRP_OBJS))
 endif
 
 VL_LDFLAGS=$(VL_OS_LDFLAGS)
@@ -572,25 +591,20 @@ ifeq ($(ARCH),sparc64)
   endif
 endif
 
+ifeq ($(ARCH),x86_64)
+  VL_LDFLAGS+=-m64
+  ifneq ($(CONFIG_SOLARIS),yes)
+    VL_LDFLAGS+=-Wl,-T,$(SRC_PATH)/$(ARCH).ld
+  endif
+endif
+
 ifdef CONFIG_WIN32
 SDL_LIBS := $(filter-out -mwindows, $(SDL_LIBS)) -mconsole
 endif
 
-$(QEMU_SYSTEM): $(VL_OBJS) libqemu.a $(DEPLIBS)
+$(QEMU_SYSTEM): $(VL_OBJS) ../libqemu_common.a libqemu.a $(DEPLIBS)
 	$(CC) $(VL_LDFLAGS) $(LDFLAGS) -o $@ $^ $(LIBS) $(SDL_LIBS) $(COCOA_LIBS) $(VL_LIBS)
 
-cocoa.o: cocoa.m
-	$(CC) $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -c -o $@ $<
-
-sdl.o: sdl.c keymaps.c sdl_keysym.h
-	$(CC) $(CFLAGS) $(CPPFLAGS) $(SDL_CFLAGS) $(BASE_CFLAGS) -c -o $@ $<
-
-vnc.o: vnc.c keymaps.c sdl_keysym.h vnchextile.h d3des.c d3des.h
-	$(CC) $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -c -o $@ $<
-
-sdlaudio.o: sdlaudio.c
-	$(CC) $(CFLAGS) $(CPPFLAGS) $(SDL_CFLAGS) $(BASE_CFLAGS) -c -o $@ $<
-
 depend: $(SRCS)
 	$(CC) -MM $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) $^ 1>.depend
 
@@ -654,58 +668,6 @@ endif
 signal.o: signal.c
 	$(CC) $(HELPER_CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -c -o $@ $<
 
-vga.o: pixel_ops.h
-
-tcx.o: pixel_ops.h
-
-ifeq ($(TARGET_BASE_ARCH), i386)
-op.o: op.c opreg_template.h ops_template.h ops_template_mem.h ops_mem.h ops_sse.h
-endif
-
-ifeq ($(TARGET_ARCH), arm)
-op.o: op.c op_template.h
-pl110.o: pl110_template.h
-endif
-
-ifeq ($(TARGET_BASE_ARCH), sparc)
-helper.o: cpu.h exec-all.h
-op.o: op.c op_template.h op_mem.h fop_template.h fbranch_template.h exec.h cpu.h
-op_helper.o: exec.h softmmu_template.h cpu.h
-translate.o: cpu.h exec-all.h disas.h
-endif
-
-ifeq ($(TARGET_BASE_ARCH), ppc)
-op.o: op.c op_template.h op_mem.h op_helper.h
-op_helper.o: op_helper.c mfrom_table.c op_helper_mem.h op_helper.h
-translate.o: translate.c translate_init.c
-endif
-
-ifeq ($(TARGET_BASE_ARCH), mips)
-helper.o: cpu.h exec-all.h
-op.o: op_template.c fop_template.c op_mem.c exec.h cpu.h
-op_helper.o: op_helper_mem.c exec.h softmmu_template.h cpu.h
-translate.o: translate_init.c exec-all.h disas.h
-endif
-
-loader.o: loader.c elf_ops.h
-
-ifeq ($(TARGET_ARCH), sh4)
-op.o: op.c op_mem.c cpu.h
-op_helper.o: op_helper.c exec.h cpu.h
-helper.o: helper.c exec.h cpu.h
-sh7750.o: sh7750.c sh7750_regs.h sh7750_regnames.h cpu.h
-shix.o: shix.c sh7750_regs.h sh7750_regnames.h
-sh7750_regnames.o: sh7750_regnames.c sh7750_regnames.h sh7750_regs.h
-tc58128.o: tc58128.c
-endif
-
-ifeq ($(TARGET_BASE_ARCH), alpha)
-op.o: op.c op_template.h op_mem.h
-op_helper.o: op_helper_mem.h
-endif
-
-$(OBJS) $(LIBOBJS) $(VL_OBJS): config.h ../config-host.h
-
 %.o: %.c
 	$(CC) $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -c -o $@ $<
 
@@ -713,7 +675,8 @@ $(OBJS) $(LIBOBJS) $(VL_OBJS): config.h ../config-host.h
 	$(CC) $(CPPFLAGS) -c -o $@ $<
 
 clean:
-	rm -f *.o  *.a *~ $(PROGS) gen-op.h opc.h op.h nwfpe/*.o slirp/*.o fpu/*.o
+	rm -f *.o *.a *~ $(PROGS) gen-op.h opc.h op.h nwfpe/*.o fpu/*.o
+	rm -f *.d */*.d
 
 install: all
 ifneq ($(PROGS),)
@@ -729,3 +692,6 @@ audio.o sdlaudio.o dsoundaudio.o ossaudio.o wavaudio.o noaudio.o \
 fmodaudio.o alsaaudio.o mixeng.o sb16.o es1370.o gus.o adlib.o: \
 CFLAGS := $(CFLAGS) -Wall -Werror -W -Wsign-compare
 endif
+
+# Include automatically generated dependency files
+-include $(wildcard *.d */*.d)
diff --git a/VERSION b/VERSION
index 899f24fc7..8a6125d3e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.9.0
\ No newline at end of file
+0.9.0-cvs
\ No newline at end of file
diff --git a/aes.c b/aes.c
index 40ed109d3..bb1e1043b 100644
--- a/aes.c
+++ b/aes.c
@@ -27,7 +27,7 @@
  * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
  * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "aes.h"
 
 #define NDEBUG
diff --git a/arm-dis.c b/arm-dis.c
index 11f580b2f..ee44292bd 100644
--- a/arm-dis.c
+++ b/arm-dis.c
@@ -1,550 +1,1496 @@
 /* Instruction printing code for the ARM
-   Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002
-   Free Software Foundation, Inc.
+   Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004
+   2007, Free Software Foundation, Inc.
    Contributed by Richard Earnshaw (rwe@pegasus.esprit.ec.org)
    Modification by James G. Smith (jsmith@cygnus.co.uk)
 
-This file is part of libopcodes.
+   This file is part of libopcodes.
 
-This program is free software; you can redistribute it and/or modify it under
-the terms of the GNU General Public License as published by the Free
-Software Foundation; either version 2 of the License, or (at your option)
-any later version.
+   This program is free software; you can redistribute it and/or modify it under
+   the terms of the GNU General Public License as published by the Free
+   Software Foundation; either version 2 of the License, or (at your option)
+   any later version.
 
-This program is distributed in the hope that it will be useful, but WITHOUT
-ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-more details.
+   This program is distributed in the hope that it will be useful, but WITHOUT
+   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+   more details.
 
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
-Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA.  */
+
+/* Start of qemu specific additions.  Mostly this is stub definitions
+   for things we don't care about.  */
 
 #include "dis-asm.h"
+#define FALSE 0
+#define TRUE (!FALSE)
+#define ATTRIBUTE_UNUSED __attribute__((unused))
+#define ISSPACE(x) ((x) == ' ' || (x) == '\t' || (x) == '\n')
+
+#define ARM_EXT_V1	 0
+#define ARM_EXT_V2	 0
+#define ARM_EXT_V2S	 0
+#define ARM_EXT_V3	 0
+#define ARM_EXT_V3M	 0
+#define ARM_EXT_V4	 0
+#define ARM_EXT_V4T	 0
+#define ARM_EXT_V5	 0
+#define ARM_EXT_V5T	 0
+#define ARM_EXT_V5ExP	 0
+#define ARM_EXT_V5E	 0
+#define ARM_EXT_V5J	 0
+#define ARM_EXT_V6       0
+#define ARM_EXT_V6K      0
+#define ARM_EXT_V6Z      0
+#define ARM_EXT_V6T2	 0
+#define ARM_EXT_V7	 0
+#define ARM_EXT_DIV	 0
+
+/* Co-processor space extensions.  */
+#define ARM_CEXT_XSCALE   0
+#define ARM_CEXT_MAVERICK 0
+#define ARM_CEXT_IWMMXT   0
+
+#define FPU_FPA_EXT_V1	 0
+#define FPU_FPA_EXT_V2	 0
+#define FPU_VFP_EXT_NONE 0
+#define FPU_VFP_EXT_V1xD 0
+#define FPU_VFP_EXT_V1	 0
+#define FPU_VFP_EXT_V2	 0
+#define FPU_MAVERICK	 0
+#define FPU_VFP_EXT_V3	 0
+#define FPU_NEON_EXT_V1	 0
+
+int floatformat_ieee_single_little;
+/* Assume host uses ieee float.  */
+static void floatformat_to_double (int *ignored, unsigned char *data,
+                                   double *dest)
+{
+    union {
+        uint32_t i;
+        float f;
+    } u;
+    u.i = data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24);
+    *dest = u.f;
+}
 
-struct arm_opcode {
-    unsigned long value, mask;	/* recognise instruction if (op&mask)==value */
-    char *assembler;		/* how to disassemble this instruction */
+/* End of qemu specific additions.  */
+
+/* FIXME: Belongs in global header.  */
+#ifndef strneq
+#define strneq(a,b,n)	(strncmp ((a), (b), (n)) == 0)
+#endif
+
+#ifndef NUM_ELEM
+#define NUM_ELEM(a)     (sizeof (a) / sizeof (a)[0])
+#endif
+
+struct opcode32
+{
+  unsigned long arch;		/* Architecture defining this insn.  */
+  unsigned long value, mask;	/* Recognise insn if (op&mask)==value.  */
+  const char *assembler;	/* How to disassemble this insn.  */
 };
 
-struct thumb_opcode
+struct opcode16
 {
-    unsigned short value, mask;	/* recognise instruction if (op&mask)==value */
-    char * assembler;		/* how to disassemble this instruction */
+  unsigned long arch;		/* Architecture defining this insn.  */
+  unsigned short value, mask;	/* Recognise insn if (op&mask)==value.  */
+  const char *assembler;	/* How to disassemble this insn.  */
 };
 
-/* format of the assembler string :
+/* print_insn_coprocessor recognizes the following format control codes:
 
    %%			%
+
+   %c			print condition code (always bits 28-31 in ARM mode)
+   %q			print shifter argument
+   %u			print condition code (unconditional in ARM mode)
+   %A			print address for ldc/stc/ldf/stf instruction
+   %B			print vstm/vldm register list
+   %C			print vstr/vldr address operand
+   %I                   print cirrus signed shift immediate: bits 0..3|4..6
+   %F			print the COUNT field of a LFM/SFM instruction.
+   %P			print floating point precision in arithmetic insn
+   %Q			print floating point precision in ldf/stf insn
+   %R			print floating point rounding mode
+
+   %<bitfield>r		print as an ARM register
    %<bitfield>d		print the bitfield in decimal
+   %<bitfield>k		print immediate for VFPv3 conversion instruction
    %<bitfield>x		print the bitfield in hex
    %<bitfield>X		print the bitfield as 1 hex digit without leading "0x"
-   %<bitfield>r		print as an ARM register
    %<bitfield>f		print a floating point constant if >7 else a
 			floating point register
-   %<code>y		print a single precision VFP reg.
+   %<bitfield>w         print as an iWMMXt width field - [bhwd]ss/us
+   %<bitfield>g         print as an iWMMXt 64-bit register
+   %<bitfield>G         print as an iWMMXt general purpose or control register
+   %<bitfield>D		print as a NEON D register
+   %<bitfield>Q		print as a NEON Q register
+
+   %y<code>		print a single precision VFP reg.
 			  Codes: 0=>Sm, 1=>Sd, 2=>Sn, 3=>multi-list, 4=>Sm pair
-   %<code>z		print a double precision VFP reg
+   %z<code>		print a double precision VFP reg
 			  Codes: 0=>Dm, 1=>Dd, 2=>Dn, 3=>multi-list
-   %c			print condition code (always bits 28-31)
-   %P			print floating point precision in arithmetic insn
-   %Q			print floating point precision in ldf/stf insn
-   %R			print floating point rounding mode
-   %<bitnum>'c		print specified char iff bit is one
-   %<bitnum>`c		print specified char iff bit is zero
-   %<bitnum>?ab		print a if bit is one else print b
-   %p			print 'p' iff bits 12-15 are 15
-   %t			print 't' iff bit 21 set and bit 24 clear
-   %o			print operand2 (immediate or register + shift)
+
+   %<bitfield>'c	print specified char iff bitfield is all ones
+   %<bitfield>`c	print specified char iff bitfield is all zeroes
+   %<bitfield>?ab...    select from array of values in big endian order
+
+   %L			print as an iWMMXt N/M width field.
+   %Z			print the Immediate of a WSHUFH instruction.
+   %l			like 'A' except use byte offsets for 'B' & 'H'
+			versions.
+   %i			print 5-bit immediate in bits 8,3..0
+			(print "32" when 0)
+   %r			print register offset address for wldt/wstr instruction
+*/
+
+/* Common coprocessor opcodes shared between Arm and Thumb-2.  */
+
+static const struct opcode32 coprocessor_opcodes[] =
+{
+  /* XScale instructions.  */
+  {ARM_CEXT_XSCALE, 0x0e200010, 0x0fff0ff0, "mia%c\tacc0, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e280010, 0x0fff0ff0, "miaph%c\tacc0, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e2c0010, 0x0ffc0ff0, "mia%17'T%17`B%16'T%16`B%c\tacc0, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0c400000, 0x0ff00fff, "mar%c\tacc0, %12-15r, %16-19r"},
+  {ARM_CEXT_XSCALE, 0x0c500000, 0x0ff00fff, "mra%c\t%12-15r, %16-19r, acc0"},
+
+  /* Intel Wireless MMX technology instructions.  */
+#define FIRST_IWMMXT_INSN 0x0e130130
+#define IWMMXT_INSN_COUNT 73
+  {ARM_CEXT_IWMMXT, 0x0e130130, 0x0f3f0fff, "tandc%22-23w%c\t%12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e400010, 0x0ff00f3f, "tbcst%6-7w%c\t%16-19g, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e130170, 0x0f3f0ff8, "textrc%22-23w%c\t%12-15r, #%0-2d"},
+  {ARM_CEXT_XSCALE, 0x0e100070, 0x0f300ff0, "textrm%3?su%22-23w%c\t%12-15r, %16-19g, #%0-2d"},
+  {ARM_CEXT_XSCALE, 0x0e600010, 0x0ff00f38, "tinsr%6-7w%c\t%16-19g, %12-15r, #%0-2d"},
+  {ARM_CEXT_XSCALE, 0x0e000110, 0x0ff00fff, "tmcr%c\t%16-19G, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0c400000, 0x0ff00ff0, "tmcrr%c\t%0-3g, %12-15r, %16-19r"},
+  {ARM_CEXT_XSCALE, 0x0e2c0010, 0x0ffc0e10, "tmia%17?tb%16?tb%c\t%5-8g, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e200010, 0x0fff0e10, "tmia%c\t%5-8g, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e280010, 0x0fff0e10, "tmiaph%c\t%5-8g, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e100030, 0x0f300fff, "tmovmsk%22-23w%c\t%12-15r, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e100110, 0x0ff00ff0, "tmrc%c\t%12-15r, %16-19G"},
+  {ARM_CEXT_XSCALE, 0x0c500000, 0x0ff00ff0, "tmrrc%c\t%12-15r, %16-19r, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e130150, 0x0f3f0fff, "torc%22-23w%c\t%12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e130190, 0x0f3f0fff, "torvsc%22-23w%c\t%12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e2001c0, 0x0f300fff, "wabs%22-23w%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e0001c0, 0x0f300fff, "wacc%22-23w%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e000180, 0x0f000ff0, "wadd%20-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e2001a0, 0x0f300ff0, "waddbhus%22?ml%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ea001a0, 0x0ff00ff0, "waddsubhx%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000020, 0x0f800ff0, "waligni%c\t%12-15g, %16-19g, %0-3g, #%20-22d"},
+  {ARM_CEXT_XSCALE, 0x0e800020, 0x0fc00ff0, "walignr%20-21d%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e200000, 0x0fe00ff0, "wand%20'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e800000, 0x0fa00ff0, "wavg2%22?hb%20'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e400000, 0x0fe00ff0, "wavg4%20'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000060, 0x0f300ff0, "wcmpeq%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100060, 0x0f100ff0, "wcmpgt%21?su%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0xfc500100, 0xfe500f00, "wldrd\t%12-15g, %r"},
+  {ARM_CEXT_XSCALE, 0xfc100100, 0xfe500f00, "wldrw\t%12-15G, %A"},
+  {ARM_CEXT_XSCALE, 0x0c100000, 0x0e100e00, "wldr%L%c\t%12-15g, %l"},
+  {ARM_CEXT_XSCALE, 0x0e400100, 0x0fc00ff0, "wmac%21?su%20'z%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e800100, 0x0fc00ff0, "wmadd%21?su%20'x%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ec00100, 0x0fd00ff0, "wmadd%21?sun%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000160, 0x0f100ff0, "wmax%21?su%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000080, 0x0f100fe0, "wmerge%c\t%12-15g, %16-19g, %0-3g, #%21-23d"},
+  {ARM_CEXT_XSCALE, 0x0e0000a0, 0x0f800ff0, "wmia%21?tb%20?tb%22'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e800120, 0x0f800ff0, "wmiaw%21?tb%20?tb%22'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100160, 0x0f100ff0, "wmin%21?su%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000100, 0x0fc00ff0, "wmul%21?su%20?ml%23'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ed00100, 0x0fd00ff0, "wmul%21?sumr%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ee000c0, 0x0fe00ff0, "wmulwsm%20`r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ec000c0, 0x0fe00ff0, "wmulwum%20`r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0eb000c0, 0x0ff00ff0, "wmulwl%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e8000a0, 0x0f800ff0, "wqmia%21?tb%20?tb%22'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100080, 0x0fd00ff0, "wqmulm%21'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ec000e0, 0x0fd00ff0, "wqmulwm%21'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000000, 0x0ff00ff0, "wor%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000080, 0x0f000ff0, "wpack%20-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0xfe300040, 0xff300ef0, "wror%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e300040, 0x0f300ff0, "wror%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e300140, 0x0f300ff0, "wror%22-23wg%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0x0e000120, 0x0fa00ff0, "wsad%22?hb%20'z%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e0001e0, 0x0f000ff0, "wshufh%c\t%12-15g, %16-19g, #%Z"},
+  {ARM_CEXT_XSCALE, 0xfe100040, 0xff300ef0, "wsll%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e100040, 0x0f300ff0, "wsll%22-23w%8'g%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100148, 0x0f300ffc, "wsll%22-23w%8'g%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0xfe000040, 0xff300ef0, "wsra%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e000040, 0x0f300ff0, "wsra%22-23w%8'g%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000148, 0x0f300ffc, "wsra%22-23w%8'g%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0xfe200040, 0xff300ef0, "wsrl%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e200040, 0x0f300ff0, "wsrl%22-23w%8'g%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e200148, 0x0f300ffc, "wsrl%22-23w%8'g%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0xfc400100, 0xfe500f00, "wstrd\t%12-15g, %r"},
+  {ARM_CEXT_XSCALE, 0xfc000100, 0xfe500f00, "wstrw\t%12-15G, %A"},
+  {ARM_CEXT_XSCALE, 0x0c000000, 0x0e100e00, "wstr%L%c\t%12-15g, %l"},
+  {ARM_CEXT_XSCALE, 0x0e0001a0, 0x0f000ff0, "wsub%20-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ed001c0, 0x0ff00ff0, "wsubaddhx%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e1001c0, 0x0f300ff0, "wabsdiff%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e0000c0, 0x0fd00fff, "wunpckeh%21?sub%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e4000c0, 0x0fd00fff, "wunpckeh%21?suh%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e8000c0, 0x0fd00fff, "wunpckeh%21?suw%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e0000e0, 0x0f100fff, "wunpckel%21?su%22-23w%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e1000c0, 0x0f300ff0, "wunpckih%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e1000e0, 0x0f300ff0, "wunpckil%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100000, 0x0ff00ff0, "wxor%c\t%12-15g, %16-19g, %0-3g"},
+
+  /* Floating point coprocessor (FPA) instructions */
+  {FPU_FPA_EXT_V1, 0x0e000100, 0x0ff08f10, "adf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e100100, 0x0ff08f10, "muf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e200100, 0x0ff08f10, "suf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e300100, 0x0ff08f10, "rsf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e400100, 0x0ff08f10, "dvf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e500100, 0x0ff08f10, "rdf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e600100, 0x0ff08f10, "pow%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e700100, 0x0ff08f10, "rpw%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e800100, 0x0ff08f10, "rmf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e900100, 0x0ff08f10, "fml%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ea00100, 0x0ff08f10, "fdv%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0eb00100, 0x0ff08f10, "frd%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ec00100, 0x0ff08f10, "pol%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e008100, 0x0ff08f10, "mvf%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e108100, 0x0ff08f10, "mnf%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e208100, 0x0ff08f10, "abs%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e308100, 0x0ff08f10, "rnd%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e408100, 0x0ff08f10, "sqt%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e508100, 0x0ff08f10, "log%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e608100, 0x0ff08f10, "lgn%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e708100, 0x0ff08f10, "exp%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e808100, 0x0ff08f10, "sin%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e908100, 0x0ff08f10, "cos%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ea08100, 0x0ff08f10, "tan%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0eb08100, 0x0ff08f10, "asn%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ec08100, 0x0ff08f10, "acs%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ed08100, 0x0ff08f10, "atn%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ee08100, 0x0ff08f10, "urd%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ef08100, 0x0ff08f10, "nrm%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e000110, 0x0ff00f1f, "flt%c%P%R\t%16-18f, %12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e100110, 0x0fff0f98, "fix%c%R\t%12-15r, %0-2f"},
+  {FPU_FPA_EXT_V1, 0x0e200110, 0x0fff0fff, "wfs%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e300110, 0x0fff0fff, "rfs%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e400110, 0x0fff0fff, "wfc%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e500110, 0x0fff0fff, "rfc%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e90f110, 0x0ff8fff0, "cmf%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0eb0f110, 0x0ff8fff0, "cnf%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ed0f110, 0x0ff8fff0, "cmfe%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ef0f110, 0x0ff8fff0, "cnfe%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0c000100, 0x0e100f00, "stf%c%Q\t%12-14f, %A"},
+  {FPU_FPA_EXT_V1, 0x0c100100, 0x0e100f00, "ldf%c%Q\t%12-14f, %A"},
+  {FPU_FPA_EXT_V2, 0x0c000200, 0x0e100f00, "sfm%c\t%12-14f, %F, %A"},
+  {FPU_FPA_EXT_V2, 0x0c100200, 0x0e100f00, "lfm%c\t%12-14f, %F, %A"},
+
+  /* Register load/store */
+  {FPU_NEON_EXT_V1, 0x0d200b00, 0x0fb00f01, "vstmdb%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0d300b00, 0x0fb00f01, "vldmdb%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0c800b00, 0x0f900f01, "vstmia%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0c900b00, 0x0f900f01, "vldmia%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0d000b00, 0x0f300f00, "vstr%c\t%12-15,22D, %C"},
+  {FPU_NEON_EXT_V1, 0x0d100b00, 0x0f300f00, "vldr%c\t%12-15,22D, %C"},
+
+  /* Data transfer between ARM and NEON registers */
+  {FPU_NEON_EXT_V1, 0x0e800b10, 0x0ff00f70, "vdup%c.32\t%16-19,7D, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e800b30, 0x0ff00f70, "vdup%c.16\t%16-19,7D, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ea00b10, 0x0ff00f70, "vdup%c.32\t%16-19,7Q, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ea00b30, 0x0ff00f70, "vdup%c.16\t%16-19,7Q, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ec00b10, 0x0ff00f70, "vdup%c.8\t%16-19,7D, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ee00b10, 0x0ff00f70, "vdup%c.8\t%16-19,7Q, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0c400b10, 0x0ff00fd0, "vmov%c\t%0-3,5D, %12-15r, %16-19r"},
+  {FPU_NEON_EXT_V1, 0x0c500b10, 0x0ff00fd0, "vmov%c\t%12-15r, %16-19r, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0x0e000b10, 0x0fd00f70, "vmov%c.32\t%16-19,7D[%21d], %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e100b10, 0x0f500f70, "vmov%c.32\t%12-15r, %16-19,7D[%21d]"},
+  {FPU_NEON_EXT_V1, 0x0e000b30, 0x0fd00f30, "vmov%c.16\t%16-19,7D[%6,21d], %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e100b30, 0x0f500f30, "vmov%c.%23?us16\t%12-15r, %16-19,7D[%6,21d]"},
+  {FPU_NEON_EXT_V1, 0x0e400b10, 0x0fd00f10, "vmov%c.8\t%16-19,7D[%5,6,21d], %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e500b10, 0x0f500f10, "vmov%c.%23?us8\t%12-15r, %16-19,7D[%5,6,21d]"},
+
+  /* Floating point coprocessor (VFP) instructions */
+  {FPU_VFP_EXT_V1xD, 0x0ef1fa10, 0x0fffffff, "fmstat%c"},
+  {FPU_VFP_EXT_V1xD, 0x0ee00a10, 0x0fff0fff, "fmxr%c\tfpsid, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee10a10, 0x0fff0fff, "fmxr%c\tfpscr, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee60a10, 0x0fff0fff, "fmxr%c\tmvfr1, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee70a10, 0x0fff0fff, "fmxr%c\tmvfr0, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee80a10, 0x0fff0fff, "fmxr%c\tfpexc, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee90a10, 0x0fff0fff, "fmxr%c\tfpinst, %12-15r\t@ Impl def"},
+  {FPU_VFP_EXT_V1xD, 0x0eea0a10, 0x0fff0fff, "fmxr%c\tfpinst2, %12-15r\t@ Impl def"},
+  {FPU_VFP_EXT_V1xD, 0x0ef00a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpsid"},
+  {FPU_VFP_EXT_V1xD, 0x0ef10a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpscr"},
+  {FPU_VFP_EXT_V1xD, 0x0ef60a10, 0x0fff0fff, "fmrx%c\t%12-15r, mvfr1"},
+  {FPU_VFP_EXT_V1xD, 0x0ef70a10, 0x0fff0fff, "fmrx%c\t%12-15r, mvfr0"},
+  {FPU_VFP_EXT_V1xD, 0x0ef80a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpexc"},
+  {FPU_VFP_EXT_V1xD, 0x0ef90a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst\t@ Impl def"},
+  {FPU_VFP_EXT_V1xD, 0x0efa0a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst2\t@ Impl def"},
+  {FPU_VFP_EXT_V1, 0x0e000b10, 0x0ff00fff, "fmdlr%c\t%z2, %12-15r"},
+  {FPU_VFP_EXT_V1, 0x0e100b10, 0x0ff00fff, "fmrdl%c\t%12-15r, %z2"},
+  {FPU_VFP_EXT_V1, 0x0e200b10, 0x0ff00fff, "fmdhr%c\t%z2, %12-15r"},
+  {FPU_VFP_EXT_V1, 0x0e300b10, 0x0ff00fff, "fmrdh%c\t%12-15r, %z2"},
+  {FPU_VFP_EXT_V1xD, 0x0ee00a10, 0x0ff00fff, "fmxr%c\t<impl def %16-19x>, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ef00a10, 0x0ff00fff, "fmrx%c\t%12-15r, <impl def %16-19x>"},
+  {FPU_VFP_EXT_V1xD, 0x0e000a10, 0x0ff00f7f, "fmsr%c\t%y2, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0e100a10, 0x0ff00f7f, "fmrs%c\t%12-15r, %y2"},
+  {FPU_VFP_EXT_V1xD, 0x0eb50a40, 0x0fbf0f70, "fcmp%7'ezs%c\t%y1"},
+  {FPU_VFP_EXT_V1, 0x0eb50b40, 0x0fbf0f70, "fcmp%7'ezd%c\t%z1"},
+  {FPU_VFP_EXT_V1xD, 0x0eb00a40, 0x0fbf0fd0, "fcpys%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb00ac0, 0x0fbf0fd0, "fabss%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb00b40, 0x0fbf0fd0, "fcpyd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1, 0x0eb00bc0, 0x0fbf0fd0, "fabsd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb10a40, 0x0fbf0fd0, "fnegs%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb10ac0, 0x0fbf0fd0, "fsqrts%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb10b40, 0x0fbf0fd0, "fnegd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1, 0x0eb10bc0, 0x0fbf0fd0, "fsqrtd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1, 0x0eb70ac0, 0x0fbf0fd0, "fcvtds%c\t%z1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb70bc0, 0x0fbf0fd0, "fcvtsd%c\t%y1, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb80a40, 0x0fbf0fd0, "fuitos%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb80ac0, 0x0fbf0fd0, "fsitos%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb80b40, 0x0fbf0fd0, "fuitod%c\t%z1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb80bc0, 0x0fbf0fd0, "fsitod%c\t%z1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb40a40, 0x0fbf0f50, "fcmp%7'es%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb40b40, 0x0fbf0f50, "fcmp%7'ed%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V3, 0x0eba0a40, 0x0fbe0f50, "f%16?us%7?lhtos%c\t%y1, #%5,0-3k"},
+  {FPU_VFP_EXT_V3, 0x0eba0b40, 0x0fbe0f50, "f%16?us%7?lhtod%c\t%z1, #%5,0-3k"},
+  {FPU_VFP_EXT_V1xD, 0x0ebc0a40, 0x0fbe0f50, "fto%16?sui%7'zs%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0ebc0b40, 0x0fbe0f50, "fto%16?sui%7'zd%c\t%y1, %z0"},
+  {FPU_VFP_EXT_V3, 0x0ebe0a40, 0x0fbe0f50, "fto%16?us%7?lhs%c\t%y1, #%5,0-3k"},
+  {FPU_VFP_EXT_V3, 0x0ebe0b40, 0x0fbe0f50, "fto%16?us%7?lhd%c\t%z1, #%5,0-3k"},
+  {FPU_VFP_EXT_V1, 0x0c500b10, 0x0fb00ff0, "fmrrd%c\t%12-15r, %16-19r, %z0"},
+  {FPU_VFP_EXT_V3, 0x0eb00a00, 0x0fb00ff0, "fconsts%c\t%y1, #%0-3,16-19d"},
+  {FPU_VFP_EXT_V3, 0x0eb00b00, 0x0fb00ff0, "fconstd%c\t%z1, #%0-3,16-19d"},
+  {FPU_VFP_EXT_V2, 0x0c400a10, 0x0ff00fd0, "fmsrr%c\t%y4, %12-15r, %16-19r"},
+  {FPU_VFP_EXT_V2, 0x0c400b10, 0x0ff00fd0, "fmdrr%c\t%z0, %12-15r, %16-19r"},
+  {FPU_VFP_EXT_V2, 0x0c500a10, 0x0ff00fd0, "fmrrs%c\t%12-15r, %16-19r, %y4"},
+  {FPU_VFP_EXT_V1xD, 0x0e000a00, 0x0fb00f50, "fmacs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e000a40, 0x0fb00f50, "fnmacs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e000b00, 0x0fb00f50, "fmacd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e000b40, 0x0fb00f50, "fnmacd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e100a00, 0x0fb00f50, "fmscs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e100a40, 0x0fb00f50, "fnmscs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e100b00, 0x0fb00f50, "fmscd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e100b40, 0x0fb00f50, "fnmscd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e200a00, 0x0fb00f50, "fmuls%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e200a40, 0x0fb00f50, "fnmuls%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e200b00, 0x0fb00f50, "fmuld%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e200b40, 0x0fb00f50, "fnmuld%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e300a00, 0x0fb00f50, "fadds%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e300a40, 0x0fb00f50, "fsubs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e300b00, 0x0fb00f50, "faddd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e300b40, 0x0fb00f50, "fsubd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e800a00, 0x0fb00f50, "fdivs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e800b00, 0x0fb00f50, "fdivd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0d200a00, 0x0fb00f00, "fstmdbs%c\t%16-19r!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0d200b00, 0x0fb00f00, "fstmdb%0?xd%c\t%16-19r!, %z3"},
+  {FPU_VFP_EXT_V1xD, 0x0d300a00, 0x0fb00f00, "fldmdbs%c\t%16-19r!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0d300b00, 0x0fb00f00, "fldmdb%0?xd%c\t%16-19r!, %z3"},
+  {FPU_VFP_EXT_V1xD, 0x0d000a00, 0x0f300f00, "fsts%c\t%y1, %A"},
+  {FPU_VFP_EXT_V1, 0x0d000b00, 0x0f300f00, "fstd%c\t%z1, %A"},
+  {FPU_VFP_EXT_V1xD, 0x0d100a00, 0x0f300f00, "flds%c\t%y1, %A"},
+  {FPU_VFP_EXT_V1, 0x0d100b00, 0x0f300f00, "fldd%c\t%z1, %A"},
+  {FPU_VFP_EXT_V1xD, 0x0c800a00, 0x0f900f00, "fstmias%c\t%16-19r%21'!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0c800b00, 0x0f900f00, "fstmia%0?xd%c\t%16-19r%21'!, %z3"},
+  {FPU_VFP_EXT_V1xD, 0x0c900a00, 0x0f900f00, "fldmias%c\t%16-19r%21'!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0c900b00, 0x0f900f00, "fldmia%0?xd%c\t%16-19r%21'!, %z3"},
+
+  /* Cirrus coprocessor instructions.  */
+  {ARM_CEXT_MAVERICK, 0x0d100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0e000450, 0x0ff00ff0, "cfmvsr%c\tmvf%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100450, 0x0ff00ff0, "cfmvrs%c\t%12-15r, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000410, 0x0ff00ff0, "cfmvdlr%c\tmvd%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100410, 0x0ff00ff0, "cfmvrdl%c\t%12-15r, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000430, 0x0ff00ff0, "cfmvdhr%c\tmvd%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100430, 0x0ff00fff, "cfmvrdh%c\t%12-15r, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000510, 0x0ff00fff, "cfmv64lr%c\tmvdx%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100510, 0x0ff00fff, "cfmvr64l%c\t%12-15r, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000530, 0x0ff00fff, "cfmv64hr%c\tmvdx%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100530, 0x0ff00fff, "cfmvr64h%c\t%12-15r, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e200440, 0x0ff00fff, "cfmval32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100440, 0x0ff00fff, "cfmv32al%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e200460, 0x0ff00fff, "cfmvam32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100460, 0x0ff00fff, "cfmv32am%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e200480, 0x0ff00fff, "cfmvah32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100480, 0x0ff00fff, "cfmv32ah%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e2004a0, 0x0ff00fff, "cfmva32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004a0, 0x0ff00fff, "cfmv32a%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e2004c0, 0x0ff00fff, "cfmva64%c\tmvax%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004c0, 0x0ff00fff, "cfmv64a%c\tmvdx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e2004e0, 0x0fff0fff, "cfmvsc32%c\tdspsc, mvdx%12-15d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004e0, 0x0fff0fff, "cfmv32sc%c\tmvdx%12-15d, dspsc"},
+  {ARM_CEXT_MAVERICK, 0x0e000400, 0x0ff00fff, "cfcpys%c\tmvf%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000420, 0x0ff00fff, "cfcpyd%c\tmvd%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000460, 0x0ff00fff, "cfcvtsd%c\tmvd%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000440, 0x0ff00fff, "cfcvtds%c\tmvf%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000480, 0x0ff00fff, "cfcvt32s%c\tmvf%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e0004a0, 0x0ff00fff, "cfcvt32d%c\tmvd%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e0004c0, 0x0ff00fff, "cfcvt64s%c\tmvf%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e0004e0, 0x0ff00fff, "cfcvt64d%c\tmvd%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100580, 0x0ff00fff, "cfcvts32%c\tmvfx%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005a0, 0x0ff00fff, "cfcvtd32%c\tmvfx%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005c0, 0x0ff00fff, "cftruncs32%c\tmvfx%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005e0, 0x0ff00fff, "cftruncd32%c\tmvfx%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000550, 0x0ff00ff0, "cfrshl32%c\tmvfx%16-19d, mvfx%0-3d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e000570, 0x0ff00ff0, "cfrshl64%c\tmvdx%16-19d, mvdx%0-3d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e000500, 0x0ff00f10, "cfsh32%c\tmvfx%12-15d, mvfx%16-19d, #%I"},
+  {ARM_CEXT_MAVERICK, 0x0e200500, 0x0ff00f10, "cfsh64%c\tmvdx%12-15d, mvdx%16-19d, #%I"},
+  {ARM_CEXT_MAVERICK, 0x0e100490, 0x0ff00ff0, "cfcmps%c\t%12-15r, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004b0, 0x0ff00ff0, "cfcmpd%c\t%12-15r, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100590, 0x0ff00ff0, "cfcmp32%c\t%12-15r, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005b0, 0x0ff00ff0, "cfcmp64%c\t%12-15r, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e300400, 0x0ff00fff, "cfabss%c\tmvf%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300420, 0x0ff00fff, "cfabsd%c\tmvd%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300440, 0x0ff00fff, "cfnegs%c\tmvf%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300460, 0x0ff00fff, "cfnegd%c\tmvd%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300480, 0x0ff00ff0, "cfadds%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3004a0, 0x0ff00ff0, "cfaddd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3004c0, 0x0ff00ff0, "cfsubs%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3004e0, 0x0ff00ff0, "cfsubd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100400, 0x0ff00ff0, "cfmuls%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100420, 0x0ff00ff0, "cfmuld%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e300500, 0x0ff00fff, "cfabs32%c\tmvfx%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300520, 0x0ff00fff, "cfabs64%c\tmvdx%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300540, 0x0ff00fff, "cfneg32%c\tmvfx%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300560, 0x0ff00fff, "cfneg64%c\tmvdx%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300580, 0x0ff00ff0, "cfadd32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3005a0, 0x0ff00ff0, "cfadd64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3005c0, 0x0ff00ff0, "cfsub32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3005e0, 0x0ff00ff0, "cfsub64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100500, 0x0ff00ff0, "cfmul32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100520, 0x0ff00ff0, "cfmul64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100540, 0x0ff00ff0, "cfmac32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100560, 0x0ff00ff0, "cfmsc32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e000600, 0x0ff00f10, "cfmadd32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100600, 0x0ff00f10, "cfmsub32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e200600, 0x0ff00f10, "cfmadda32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e300600, 0x0ff00f10, "cfmsuba32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
+
+  /* Generic coprocessor instructions */
+  {ARM_EXT_V2, 0x0c400000, 0x0ff00000, "mcrr%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+  {ARM_EXT_V2, 0x0c500000, 0x0ff00000, "mrrc%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+  {ARM_EXT_V2, 0x0e000000, 0x0f000010, "cdp%c\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V2, 0x0e100010, 0x0f100010, "mrc%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V2, 0x0e000010, 0x0f100010, "mcr%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V2, 0x0c000000, 0x0e100000, "stc%22'l%c\t%8-11d, cr%12-15d, %A"},
+  {ARM_EXT_V2, 0x0c100000, 0x0e100000, "ldc%22'l%c\t%8-11d, cr%12-15d, %A"},
+
+  /* V6 coprocessor instructions */
+  {ARM_EXT_V6, 0xfc500000, 0xfff00000, "mrrc2%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+  {ARM_EXT_V6, 0xfc400000, 0xfff00000, "mcrr2%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+
+  /* V5 coprocessor instructions */
+  {ARM_EXT_V5, 0xfc100000, 0xfe100000, "ldc2%22'l%c\t%8-11d, cr%12-15d, %A"},
+  {ARM_EXT_V5, 0xfc000000, 0xfe100000, "stc2%22'l%c\t%8-11d, cr%12-15d, %A"},
+  {ARM_EXT_V5, 0xfe000000, 0xff000010, "cdp2%c\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V5, 0xfe000010, 0xff100010, "mcr2%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V5, 0xfe100010, 0xff100010, "mrc2%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+
+  {0, 0, 0, 0}
+};
+
+/* Neon opcode table:  This does not encode the top byte -- that is
+   checked by the print_insn_neon routine, as it depends on whether we are
+   doing thumb32 or arm32 disassembly.  */
+
+/* print_insn_neon recognizes the following format control codes:
+
+   %%			%
+
+   %c			print condition code
+   %A			print v{st,ld}[1234] operands
+   %B			print v{st,ld}[1234] any one operands
+   %C			print v{st,ld}[1234] single->all operands
+   %D			print scalar
+   %E			print vmov, vmvn, vorr, vbic encoded constant
+   %F			print vtbl,vtbx register list
+
+   %<bitfield>r		print as an ARM register
+   %<bitfield>d		print the bitfield in decimal
+   %<bitfield>e         print the 2^N - bitfield in decimal
+   %<bitfield>D		print as a NEON D register
+   %<bitfield>Q		print as a NEON Q register
+   %<bitfield>R		print as a NEON D or Q register
+   %<bitfield>Sn	print byte scaled width limited by n
+   %<bitfield>Tn	print short scaled width limited by n
+   %<bitfield>Un	print long scaled width limited by n
+
+   %<bitfield>'c	print specified char iff bitfield is all ones
+   %<bitfield>`c	print specified char iff bitfield is all zeroes
+   %<bitfield>?ab...    select from array of values in big endian order  */
+
+static const struct opcode32 neon_opcodes[] =
+{
+  /* Extract */
+  {FPU_NEON_EXT_V1, 0xf2b00840, 0xffb00850, "vext%c.8\t%12-15,22R, %16-19,7R, %0-3,5R, #%8-11d"},
+  {FPU_NEON_EXT_V1, 0xf2b00000, 0xffb00810, "vext%c.8\t%12-15,22R, %16-19,7R, %0-3,5R, #%8-11d"},
+
+  /* Move data element to all lanes */
+  {FPU_NEON_EXT_V1, 0xf3b40c00, 0xffb70f90, "vdup%c.32\t%12-15,22R, %0-3,5D[%19d]"},
+  {FPU_NEON_EXT_V1, 0xf3b20c00, 0xffb30f90, "vdup%c.16\t%12-15,22R, %0-3,5D[%18-19d]"},
+  {FPU_NEON_EXT_V1, 0xf3b10c00, 0xffb10f90, "vdup%c.8\t%12-15,22R, %0-3,5D[%17-19d]"},
+
+  /* Table lookup */
+  {FPU_NEON_EXT_V1, 0xf3b00800, 0xffb00c50, "vtbl%c.8\t%12-15,22D, %F, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf3b00840, 0xffb00c50, "vtbx%c.8\t%12-15,22D, %F, %0-3,5D"},
+
+  /* Two registers, miscellaneous */
+  {FPU_NEON_EXT_V1, 0xf2880a10, 0xfebf0fd0, "vmovl%c.%24?us8\t%12-15,22Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2900a10, 0xfebf0fd0, "vmovl%c.%24?us16\t%12-15,22Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2a00a10, 0xfebf0fd0, "vmovl%c.%24?us32\t%12-15,22Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf3b00500, 0xffbf0f90, "vcnt%c.8\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00580, 0xffbf0f90, "vmvn%c\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20000, 0xffbf0f90, "vswp%c\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20200, 0xffb30fd0, "vmovn%c.i%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b20240, 0xffb30fd0, "vqmovun%c.s%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b20280, 0xffb30fd0, "vqmovn%c.s%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b202c0, 0xffb30fd0, "vqmovn%c.u%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b20300, 0xffb30fd0, "vshll%c.i%18-19S2\t%12-15,22Q, %0-3,5D, #%18-19S2"},
+  {FPU_NEON_EXT_V1, 0xf3bb0400, 0xffbf0e90, "vrecpe%c.%8?fu%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3bb0480, 0xffbf0e90, "vrsqrte%c.%8?fu%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00000, 0xffb30f90, "vrev64%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00080, 0xffb30f90, "vrev32%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00100, 0xffb30f90, "vrev16%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00400, 0xffb30f90, "vcls%c.s%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00480, 0xffb30f90, "vclz%c.i%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00700, 0xffb30f90, "vqabs%c.s%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00780, 0xffb30f90, "vqneg%c.s%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20080, 0xffb30f90, "vtrn%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20100, 0xffb30f90, "vuzp%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20180, 0xffb30f90, "vzip%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b10000, 0xffb30b90, "vcgt%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10080, 0xffb30b90, "vcge%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10100, 0xffb30b90, "vceq%c.%10?fi%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10180, 0xffb30b90, "vcle%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10200, 0xffb30b90, "vclt%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10300, 0xffb30b90, "vabs%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b10380, 0xffb30b90, "vneg%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00200, 0xffb30f10, "vpaddl%c.%7?us%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00600, 0xffb30f10, "vpadal%c.%7?us%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b30600, 0xffb30e10, "vcvt%c.%7-8?usff%18-19Sa.%7-8?ffus%18-19Sa\t%12-15,22R, %0-3,5R"},
+
+  /* Three registers of the same length */
+  {FPU_NEON_EXT_V1, 0xf2000110, 0xffb00f10, "vand%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2100110, 0xffb00f10, "vbic%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200110, 0xffb00f10, "vorr%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2300110, 0xffb00f10, "vorn%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000110, 0xffb00f10, "veor%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3100110, 0xffb00f10, "vbsl%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200110, 0xffb00f10, "vbit%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3300110, 0xffb00f10, "vbif%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000d00, 0xffa00f10, "vadd%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000d10, 0xffa00f10, "vmla%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000e00, 0xffa00f10, "vceq%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000f00, 0xffa00f10, "vmax%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000f10, 0xffa00f10, "vrecps%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200d00, 0xffa00f10, "vsub%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200d10, 0xffa00f10, "vmls%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200f00, 0xffa00f10, "vmin%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200f10, 0xffa00f10, "vrsqrts%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000d00, 0xffa00f10, "vpadd%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000d10, 0xffa00f10, "vmul%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000e00, 0xffa00f10, "vcge%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000e10, 0xffa00f10, "vacge%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000f00, 0xffa00f10, "vpmax%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200d00, 0xffa00f10, "vabd%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200e00, 0xffa00f10, "vcgt%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200e10, 0xffa00f10, "vacgt%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200f00, 0xffa00f10, "vpmin%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000800, 0xff800f10, "vadd%c.i%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000810, 0xff800f10, "vtst%c.%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000900, 0xff800f10, "vmla%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000b00, 0xff800f10, "vqdmulh%c.s%20-21S6\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000b10, 0xff800f10, "vpadd%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000800, 0xff800f10, "vsub%c.i%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000810, 0xff800f10, "vceq%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000900, 0xff800f10, "vmls%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000b00, 0xff800f10, "vqrdmulh%c.s%20-21S6\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000000, 0xfe800f10, "vhadd%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000010, 0xfe800f10, "vqadd%c.%24?us%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000100, 0xfe800f10, "vrhadd%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000200, 0xfe800f10, "vhsub%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000210, 0xfe800f10, "vqsub%c.%24?us%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000300, 0xfe800f10, "vcgt%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000310, 0xfe800f10, "vcge%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000400, 0xfe800f10, "vshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000410, 0xfe800f10, "vqshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000500, 0xfe800f10, "vrshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000510, 0xfe800f10, "vqrshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000600, 0xfe800f10, "vmax%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000610, 0xfe800f10, "vmin%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000700, 0xfe800f10, "vabd%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000710, 0xfe800f10, "vaba%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000910, 0xfe800f10, "vmul%c.%24?pi%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000a00, 0xfe800f10, "vpmax%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000a10, 0xfe800f10, "vpmin%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+
+  /* One register and an immediate value */
+  {FPU_NEON_EXT_V1, 0xf2800e10, 0xfeb80fb0, "vmov%c.i8\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800e30, 0xfeb80fb0, "vmov%c.i64\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800f10, 0xfeb80fb0, "vmov%c.f32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800810, 0xfeb80db0, "vmov%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800830, 0xfeb80db0, "vmvn%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800910, 0xfeb80db0, "vorr%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800930, 0xfeb80db0, "vbic%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800c10, 0xfeb80eb0, "vmov%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800c30, 0xfeb80eb0, "vmvn%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800110, 0xfeb809b0, "vorr%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800130, 0xfeb809b0, "vbic%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800010, 0xfeb808b0, "vmov%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800030, 0xfeb808b0, "vmvn%c.i32\t%12-15,22R, %E"},
+
+  /* Two registers and a shift amount */
+  {FPU_NEON_EXT_V1, 0xf2880810, 0xffb80fd0, "vshrn%c.i16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880850, 0xffb80fd0, "vrshrn%c.i16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880810, 0xfeb80fd0, "vqshrun%c.s16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880850, 0xfeb80fd0, "vqrshrun%c.s16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880910, 0xfeb80fd0, "vqshrn%c.%24?us16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880950, 0xfeb80fd0, "vqrshrn%c.%24?us16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880a10, 0xfeb80fd0, "vshll%c.%24?us8\t%12-15,22D, %0-3,5Q, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf2900810, 0xffb00fd0, "vshrn%c.i32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900850, 0xffb00fd0, "vrshrn%c.i32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2880510, 0xffb80f90, "vshl%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf3880410, 0xffb80f90, "vsri%c.8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf3880510, 0xffb80f90, "vsli%c.8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf3880610, 0xffb80f90, "vqshlu%c.s8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf2900810, 0xfeb00fd0, "vqshrun%c.s32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900850, 0xfeb00fd0, "vqrshrun%c.s32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900910, 0xfeb00fd0, "vqshrn%c.%24?us32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900950, 0xfeb00fd0, "vqrshrn%c.%24?us32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900a10, 0xfeb00fd0, "vshll%c.%24?us16\t%12-15,22D, %0-3,5Q, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf2880010, 0xfeb80f90, "vshr%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880110, 0xfeb80f90, "vsra%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880210, 0xfeb80f90, "vrshr%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880310, 0xfeb80f90, "vrsra%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880710, 0xfeb80f90, "vqshl%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf2a00810, 0xffa00fd0, "vshrn%c.i64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00850, 0xffa00fd0, "vrshrn%c.i64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2900510, 0xffb00f90, "vshl%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf3900410, 0xffb00f90, "vsri%c.16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf3900510, 0xffb00f90, "vsli%c.16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf3900610, 0xffb00f90, "vqshlu%c.s16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf2a00a10, 0xfea00fd0, "vshll%c.%24?us32\t%12-15,22D, %0-3,5Q, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf2900010, 0xfeb00f90, "vshr%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900110, 0xfeb00f90, "vsra%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900210, 0xfeb00f90, "vrshr%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900310, 0xfeb00f90, "vrsra%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900710, 0xfeb00f90, "vqshl%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf2800810, 0xfec00fd0, "vqshrun%c.s64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2800850, 0xfec00fd0, "vqrshrun%c.s64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2800910, 0xfec00fd0, "vqshrn%c.%24?us64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2800950, 0xfec00fd0, "vqrshrn%c.%24?us64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00510, 0xffa00f90, "vshl%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf3a00410, 0xffa00f90, "vsri%c.32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf3a00510, 0xffa00f90, "vsli%c.32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf3a00610, 0xffa00f90, "vqshlu%c.s32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf2a00010, 0xfea00f90, "vshr%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00110, 0xfea00f90, "vsra%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00210, 0xfea00f90, "vrshr%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00310, 0xfea00f90, "vrsra%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00710, 0xfea00f90, "vqshl%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf2800590, 0xff800f90, "vshl%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf3800490, 0xff800f90, "vsri%c.64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf3800590, 0xff800f90, "vsli%c.64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf3800690, 0xff800f90, "vqshlu%c.s64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf2800090, 0xfe800f90, "vshr%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800190, 0xfe800f90, "vsra%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800290, 0xfe800f90, "vrshr%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800390, 0xfe800f90, "vrsra%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800790, 0xfe800f90, "vqshl%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf2a00e10, 0xfea00e90, "vcvt%c.%24,8?usff32.%24,8?ffus32\t%12-15,22R, %0-3,5R, #%16-20e"},
+
+  /* Three registers of different lengths */
+  {FPU_NEON_EXT_V1, 0xf2800e00, 0xfea00f50, "vmull%c.p%20S0\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800400, 0xff800f50, "vaddhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf2800600, 0xff800f50, "vsubhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf2800900, 0xff800f50, "vqdmlal%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800b00, 0xff800f50, "vqdmlsl%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800d00, 0xff800f50, "vqdmull%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf3800400, 0xff800f50, "vraddhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3800600, 0xff800f50, "vrsubhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf2800000, 0xfe800f50, "vaddl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800100, 0xfe800f50, "vaddw%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800200, 0xfe800f50, "vsubl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800300, 0xfe800f50, "vsubw%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800500, 0xfe800f50, "vabal%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800700, 0xfe800f50, "vabdl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800800, 0xfe800f50, "vmlal%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800a00, 0xfe800f50, "vmlsl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800c00, 0xfe800f50, "vmull%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+
+  /* Two registers and a scalar */
+  {FPU_NEON_EXT_V1, 0xf2800040, 0xff800f50, "vmla%c.i%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800140, 0xff800f50, "vmla%c.f%20-21Sa\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800340, 0xff800f50, "vqdmlal%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800440, 0xff800f50, "vmls%c.i%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800540, 0xff800f50, "vmls%c.f%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800740, 0xff800f50, "vqdmlsl%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800840, 0xff800f50, "vmul%c.i%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800940, 0xff800f50, "vmul%c.f%20-21Sa\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800b40, 0xff800f50, "vqdmull%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800c40, 0xff800f50, "vqdmulh%c.s%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800d40, 0xff800f50, "vqrdmulh%c.s%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800040, 0xff800f50, "vmla%c.i%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800140, 0xff800f50, "vmla%c.f%20-21Sa\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800440, 0xff800f50, "vmls%c.i%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800540, 0xff800f50, "vmls%c.f%20-21Sa\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800840, 0xff800f50, "vmul%c.i%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800940, 0xff800f50, "vmul%c.f%20-21Sa\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800c40, 0xff800f50, "vqdmulh%c.s%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800d40, 0xff800f50, "vqrdmulh%c.s%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800240, 0xfe800f50, "vmlal%c.%24?us%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800640, 0xfe800f50, "vmlsl%c.%24?us%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800a40, 0xfe800f50, "vmull%c.%24?us%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+
+  /* Element and structure load/store */
+  {FPU_NEON_EXT_V1, 0xf4a00fc0, 0xffb00fc0, "vld4%c.32\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00c00, 0xffb00f00, "vld1%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00d00, 0xffb00f00, "vld2%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00e00, 0xffb00f00, "vld3%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00f00, 0xffb00f00, "vld4%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4000200, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000300, 0xff900f00, "v%21?ls%21?dt2%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000400, 0xff900f00, "v%21?ls%21?dt3%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000500, 0xff900f00, "v%21?ls%21?dt3%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000600, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000700, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000800, 0xff900f00, "v%21?ls%21?dt2%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000900, 0xff900f00, "v%21?ls%21?dt2%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000a00, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000000, 0xff900e00, "v%21?ls%21?dt4%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4800000, 0xff900300, "v%21?ls%21?dt1%c.%10-11S2\t%B"},
+  {FPU_NEON_EXT_V1, 0xf4800100, 0xff900300, "v%21?ls%21?dt2%c.%10-11S2\t%B"},
+  {FPU_NEON_EXT_V1, 0xf4800200, 0xff900300, "v%21?ls%21?dt3%c.%10-11S2\t%B"},
+  {FPU_NEON_EXT_V1, 0xf4800300, 0xff900300, "v%21?ls%21?dt4%c.%10-11S2\t%B"},
+
+  {0,0 ,0, 0}
+};
+
+/* Opcode tables: ARM, 16-bit Thumb, 32-bit Thumb.  All three are partially
+   ordered: they must be searched linearly from the top to obtain a correct
+   match.  */
+
+/* print_insn_arm recognizes the following format control codes:
+
+   %%			%
+
    %a			print address for ldr/str instruction
    %s                   print address for ldr/str halfword/signextend instruction
    %b			print branch destination
-   %B			print arm BLX(1) destination
-   %A			print address for ldc/stc/ldf/stf instruction
+   %c			print condition code (always bits 28-31)
    %m			print register mask for ldm/stm instruction
+   %o			print operand2 (immediate or register + shift)
+   %p			print 'p' iff bits 12-15 are 15
+   %t			print 't' iff bit 21 set and bit 24 clear
+   %B			print arm BLX(1) destination
    %C			print the PSR sub type.
-   %F			print the COUNT field of a LFM/SFM instruction.
-Thumb specific format options:
-   %D                   print Thumb register (bits 0..2 as high number if bit 7 set)
+   %U			print barrier type.
+   %P			print address for pli instruction.
+
+   %<bitfield>r		print as an ARM register
+   %<bitfield>d		print the bitfield in decimal
+   %<bitfield>W         print the bitfield plus one in decimal
+   %<bitfield>x		print the bitfield in hex
+   %<bitfield>X		print the bitfield as 1 hex digit without leading "0x"
+
+   %<bitfield>'c	print specified char iff bitfield is all ones
+   %<bitfield>`c	print specified char iff bitfield is all zeroes
+   %<bitfield>?ab...    select from array of values in big endian order
+
+   %e                   print arm SMI operand (bits 0..7,8..19).
+   %E			print the LSB and WIDTH fields of a BFI or BFC instruction.
+   %V                   print the 16-bit immediate field of a MOVT or MOVW instruction.  */
+
+static const struct opcode32 arm_opcodes[] =
+{
+  /* ARM instructions.  */
+  {ARM_EXT_V1, 0xe1a00000, 0xffffffff, "nop\t\t\t(mov r0,r0)"},
+  {ARM_EXT_V4T | ARM_EXT_V5, 0x012FFF10, 0x0ffffff0, "bx%c\t%0-3r"},
+  {ARM_EXT_V2, 0x00000090, 0x0fe000f0, "mul%20's%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V2, 0x00200090, 0x0fe000f0, "mla%20's%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V2S, 0x01000090, 0x0fb00ff0, "swp%22'b%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V3M, 0x00800090, 0x0fa000f0, "%22?sumull%20's%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V3M, 0x00a00090, 0x0fa000f0, "%22?sumlal%20's%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+
+  /* V7 instructions.  */
+  {ARM_EXT_V7, 0xf450f000, 0xfd70f000, "pli\t%P"},
+  {ARM_EXT_V7, 0x0320f0f0, 0x0ffffff0, "dbg%c\t#%0-3d"},
+  {ARM_EXT_V7, 0xf57ff050, 0xfffffff0, "dmb\t%U"},
+  {ARM_EXT_V7, 0xf57ff040, 0xfffffff0, "dsb\t%U"},
+  {ARM_EXT_V7, 0xf57ff060, 0xfffffff0, "isb\t%U"},
+
+  /* ARM V6T2 instructions.  */
+  {ARM_EXT_V6T2, 0x07c0001f, 0x0fe0007f, "bfc%c\t%12-15r, %E"},
+  {ARM_EXT_V6T2, 0x07c00010, 0x0fe00070, "bfi%c\t%12-15r, %0-3r, %E"},
+  {ARM_EXT_V6T2, 0x00600090, 0x0ff000f0, "mls%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6T2, 0x006000b0, 0x0f7000f0, "strht%c\t%12-15r, %s"},
+  {ARM_EXT_V6T2, 0x00300090, 0x0f300090, "ldr%6's%5?hbt%c\t%12-15r, %s"},
+  {ARM_EXT_V6T2, 0x03000000, 0x0ff00000, "movw%c\t%12-15r, %V"},
+  {ARM_EXT_V6T2, 0x03400000, 0x0ff00000, "movt%c\t%12-15r, %V"},
+  {ARM_EXT_V6T2, 0x06ff0f30, 0x0fff0ff0, "rbit%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6T2, 0x07a00050, 0x0fa00070, "%22?usbfx%c\t%12-15r, %0-3r, #%7-11d, #%16-20W"},
+
+  /* ARM V6Z instructions.  */
+  {ARM_EXT_V6Z, 0x01600070, 0x0ff000f0, "smc%c\t%e"},
+
+  /* ARM V6K instructions.  */
+  {ARM_EXT_V6K, 0xf57ff01f, 0xffffffff, "clrex"},
+  {ARM_EXT_V6K, 0x01d00f9f, 0x0ff00fff, "ldrexb%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01b00f9f, 0x0ff00fff, "ldrexd%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01f00f9f, 0x0ff00fff, "ldrexh%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01c00f90, 0x0ff00ff0, "strexb%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01a00f90, 0x0ff00ff0, "strexd%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01e00f90, 0x0ff00ff0, "strexh%c\t%12-15r, %0-3r, [%16-19r]"},
+
+  /* ARM V6K NOP hints.  */
+  {ARM_EXT_V6K, 0x0320f001, 0x0fffffff, "yield%c"},
+  {ARM_EXT_V6K, 0x0320f002, 0x0fffffff, "wfe%c"},
+  {ARM_EXT_V6K, 0x0320f003, 0x0fffffff, "wfi%c"},
+  {ARM_EXT_V6K, 0x0320f004, 0x0fffffff, "sev%c"},
+  {ARM_EXT_V6K, 0x0320f000, 0x0fffff00, "nop%c\t{%0-7d}"},
+
+  /* ARM V6 instructions. */
+  {ARM_EXT_V6, 0xf1080000, 0xfffffe3f, "cpsie\t%8'a%7'i%6'f"},
+  {ARM_EXT_V6, 0xf10a0000, 0xfffffe20, "cpsie\t%8'a%7'i%6'f,#%0-4d"},
+  {ARM_EXT_V6, 0xf10C0000, 0xfffffe3f, "cpsid\t%8'a%7'i%6'f"},
+  {ARM_EXT_V6, 0xf10e0000, 0xfffffe20, "cpsid\t%8'a%7'i%6'f,#%0-4d"},
+  {ARM_EXT_V6, 0xf1000000, 0xfff1fe20, "cps\t#%0-4d"},
+  {ARM_EXT_V6, 0x06800010, 0x0ff00ff0, "pkhbt%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06800010, 0x0ff00070, "pkhbt%c\t%12-15r, %16-19r, %0-3r, lsl #%7-11d"},
+  {ARM_EXT_V6, 0x06800050, 0x0ff00ff0, "pkhtb%c\t%12-15r, %16-19r, %0-3r, asr #32"},
+  {ARM_EXT_V6, 0x06800050, 0x0ff00070, "pkhtb%c\t%12-15r, %16-19r, %0-3r, asr #%7-11d"},
+  {ARM_EXT_V6, 0x01900f9f, 0x0ff00fff, "ldrex%c\tr%12-15d, [%16-19r]"},
+  {ARM_EXT_V6, 0x06200f10, 0x0ff00ff0, "qadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f90, 0x0ff00ff0, "qadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f30, 0x0ff00ff0, "qaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f70, 0x0ff00ff0, "qsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200ff0, 0x0ff00ff0, "qsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f50, 0x0ff00ff0, "qsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f10, 0x0ff00ff0, "sadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f90, 0x0ff00ff0, "sadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f30, 0x0ff00ff0, "saddaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f10, 0x0ff00ff0, "shadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f90, 0x0ff00ff0, "shadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f30, 0x0ff00ff0, "shaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f70, 0x0ff00ff0, "shsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300ff0, 0x0ff00ff0, "shsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f50, 0x0ff00ff0, "shsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f70, 0x0ff00ff0, "ssub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100ff0, 0x0ff00ff0, "ssub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f50, 0x0ff00ff0, "ssubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f10, 0x0ff00ff0, "uadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f90, 0x0ff00ff0, "uadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f30, 0x0ff00ff0, "uaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f10, 0x0ff00ff0, "uhadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f90, 0x0ff00ff0, "uhadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f30, 0x0ff00ff0, "uhaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f70, 0x0ff00ff0, "uhsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700ff0, 0x0ff00ff0, "uhsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f50, 0x0ff00ff0, "uhsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f10, 0x0ff00ff0, "uqadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f90, 0x0ff00ff0, "uqadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f30, 0x0ff00ff0, "uqaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f70, 0x0ff00ff0, "uqsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600ff0, 0x0ff00ff0, "uqsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f50, 0x0ff00ff0, "uqsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f70, 0x0ff00ff0, "usub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500ff0, 0x0ff00ff0, "usub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f50, 0x0ff00ff0, "usubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06bf0f30, 0x0fff0ff0, "rev%c\t\%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06bf0fb0, 0x0fff0ff0, "rev16%c\t\%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06ff0fb0, 0x0fff0ff0, "revsh%c\t\%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0xf8100a00, 0xfe50ffff, "rfe%23?id%24?ba\t\%16-19r%21'!"},
+  {ARM_EXT_V6, 0x06bf0070, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06bf0470, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06bf0870, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06bf0c70, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x068f0070, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x068f0470, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x068f0870, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x068f0c70, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06af0070, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06af0470, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06af0870, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06af0c70, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06ff0070, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06ff0470, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06ff0870, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06ff0c70, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06cf0070, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06cf0470, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06cf0870, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06cf0c70, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06ef0070, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06ef0470, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06ef0870, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06ef0c70, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06b00070, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06b00470, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06b00870, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06b00c70, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06800070, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06800470, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06800870, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06800c70, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06a00070, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06a00470, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06a00870, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06a00c70, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06f00070, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06f00470, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06f00870, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06f00c70, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06c00070, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06c00470, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06c00870, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06c00c70, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r, ROR #24"},
+  {ARM_EXT_V6, 0x06e00070, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06e00470, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06e00870, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06e00c70, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06800fb0, 0x0ff00ff0, "sel%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0xf1010000, 0xfffffc00, "setend\t%9?ble"},
+  {ARM_EXT_V6, 0x0700f010, 0x0ff0f0d0, "smuad%5'x%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x0700f050, 0x0ff0f0d0, "smusd%5'x%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07000010, 0x0ff000d0, "smlad%5'x%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x07400010, 0x0ff000d0, "smlald%5'x%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07000050, 0x0ff000d0, "smlsd%5'x%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x07400050, 0x0ff000d0, "smlsld%5'x%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x0750f010, 0x0ff0f0d0, "smmul%5'r%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07500010, 0x0ff000d0, "smmla%5'r%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x075000d0, 0x0ff000d0, "smmls%5'r%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0xf84d0500, 0xfe5fffe0, "srs%23?id%24?ba\t%16-19r%21'!, #%0-4d"},
+  {ARM_EXT_V6, 0x06a00010, 0x0fe00ff0, "ssat%c\t%12-15r, #%16-20W, %0-3r"},
+  {ARM_EXT_V6, 0x06a00010, 0x0fe00070, "ssat%c\t%12-15r, #%16-20W, %0-3r, lsl #%7-11d"},
+  {ARM_EXT_V6, 0x06a00050, 0x0fe00070, "ssat%c\t%12-15r, #%16-20W, %0-3r, asr #%7-11d"},
+  {ARM_EXT_V6, 0x06a00f30, 0x0ff00ff0, "ssat16%c\t%12-15r, #%16-19W, %0-3r"},
+  {ARM_EXT_V6, 0x01800f90, 0x0ff00ff0, "strex%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V6, 0x00400090, 0x0ff000f0, "umaal%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x0780f010, 0x0ff0f0f0, "usad8%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07800010, 0x0ff000f0, "usada8%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x06e00010, 0x0fe00ff0, "usat%c\t%12-15r, #%16-20d, %0-3r"},
+  {ARM_EXT_V6, 0x06e00010, 0x0fe00070, "usat%c\t%12-15r, #%16-20d, %0-3r, lsl #%7-11d"},
+  {ARM_EXT_V6, 0x06e00050, 0x0fe00070, "usat%c\t%12-15r, #%16-20d, %0-3r, asr #%7-11d"},
+  {ARM_EXT_V6, 0x06e00f30, 0x0ff00ff0, "usat16%c\t%12-15r, #%16-19d, %0-3r"},
+
+  /* V5J instruction.  */
+  {ARM_EXT_V5J, 0x012fff20, 0x0ffffff0, "bxj%c\t%0-3r"},
+
+  /* V5 Instructions.  */
+  {ARM_EXT_V5, 0xe1200070, 0xfff000f0, "bkpt\t0x%16-19X%12-15X%8-11X%0-3X"},
+  {ARM_EXT_V5, 0xfa000000, 0xfe000000, "blx\t%B"},
+  {ARM_EXT_V5, 0x012fff30, 0x0ffffff0, "blx%c\t%0-3r"},
+  {ARM_EXT_V5, 0x016f0f10, 0x0fff0ff0, "clz%c\t%12-15r, %0-3r"},
+
+  /* V5E "El Segundo" Instructions.  */
+  {ARM_EXT_V5E, 0x000000d0, 0x0e1000f0, "ldrd%c\t%12-15r, %s"},
+  {ARM_EXT_V5E, 0x000000f0, 0x0e1000f0, "strd%c\t%12-15r, %s"},
+  {ARM_EXT_V5E, 0xf450f000, 0xfc70f000, "pld\t%a"},
+  {ARM_EXT_V5ExP, 0x01000080, 0x0ff000f0, "smlabb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x010000a0, 0x0ff000f0, "smlatb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x010000c0, 0x0ff000f0, "smlabt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x010000e0, 0x0ff000f0, "smlatt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+
+  {ARM_EXT_V5ExP, 0x01200080, 0x0ff000f0, "smlawb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x012000c0, 0x0ff000f0, "smlawt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+
+  {ARM_EXT_V5ExP, 0x01400080, 0x0ff000f0, "smlalbb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x014000a0, 0x0ff000f0, "smlaltb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x014000c0, 0x0ff000f0, "smlalbt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x014000e0, 0x0ff000f0, "smlaltt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+
+  {ARM_EXT_V5ExP, 0x01600080, 0x0ff0f0f0, "smulbb%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x016000a0, 0x0ff0f0f0, "smultb%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x016000c0, 0x0ff0f0f0, "smulbt%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x016000e0, 0x0ff0f0f0, "smultt%c\t%16-19r, %0-3r, %8-11r"},
+
+  {ARM_EXT_V5ExP, 0x012000a0, 0x0ff0f0f0, "smulwb%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x012000e0, 0x0ff0f0f0, "smulwt%c\t%16-19r, %0-3r, %8-11r"},
+
+  {ARM_EXT_V5ExP, 0x01000050, 0x0ff00ff0,  "qadd%c\t%12-15r, %0-3r, %16-19r"},
+  {ARM_EXT_V5ExP, 0x01400050, 0x0ff00ff0, "qdadd%c\t%12-15r, %0-3r, %16-19r"},
+  {ARM_EXT_V5ExP, 0x01200050, 0x0ff00ff0,  "qsub%c\t%12-15r, %0-3r, %16-19r"},
+  {ARM_EXT_V5ExP, 0x01600050, 0x0ff00ff0, "qdsub%c\t%12-15r, %0-3r, %16-19r"},
+
+  /* ARM Instructions.  */
+  {ARM_EXT_V1, 0x00000090, 0x0e100090, "str%6's%5?hb%c\t%12-15r, %s"},
+  {ARM_EXT_V1, 0x00100090, 0x0e100090, "ldr%6's%5?hb%c\t%12-15r, %s"},
+  {ARM_EXT_V1, 0x00000000, 0x0de00000, "and%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00200000, 0x0de00000, "eor%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00400000, 0x0de00000, "sub%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00600000, 0x0de00000, "rsb%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00800000, 0x0de00000, "add%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00a00000, 0x0de00000, "adc%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00c00000, 0x0de00000, "sbc%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00e00000, 0x0de00000, "rsc%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V3, 0x0120f000, 0x0db0f000, "msr%c\t%22?SCPSR%C, %o"},
+  {ARM_EXT_V3, 0x010f0000, 0x0fbf0fff, "mrs%c\t%12-15r, %22?SCPSR"},
+  {ARM_EXT_V1, 0x01000000, 0x0de00000, "tst%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01200000, 0x0de00000, "teq%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01400000, 0x0de00000, "cmp%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01600000, 0x0de00000, "cmn%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01800000, 0x0de00000, "orr%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x03a00000, 0x0fef0000, "mov%20's%c\t%12-15r, %o"},
+  {ARM_EXT_V1, 0x01a00000, 0x0def0ff0, "mov%20's%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V1, 0x01a00000, 0x0def0060, "lsl%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01a00020, 0x0def0060, "lsr%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01a00040, 0x0def0060, "asr%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01a00060, 0x0def0ff0, "rrx%20's%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V1, 0x01a00060, 0x0def0060, "ror%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01c00000, 0x0de00000, "bic%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x01e00000, 0x0de00000, "mvn%20's%c\t%12-15r, %o"},
+  {ARM_EXT_V1, 0x052d0004, 0x0fff0fff, "push%c\t{%12-15r}\t\t; (str%c %12-15r, %a)"},
+  {ARM_EXT_V1, 0x04000000, 0x0e100000, "str%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x06000000, 0x0e100ff0, "str%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x04000000, 0x0c100010, "str%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x06000010, 0x0e000010, "undefined"},
+  {ARM_EXT_V1, 0x049d0004, 0x0fff0fff, "pop%c\t{%12-15r}\t\t; (ldr%c %12-15r, %a)"},
+  {ARM_EXT_V1, 0x04100000, 0x0c100000, "ldr%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x092d0000, 0x0fff0000, "push%c\t%m"},
+  {ARM_EXT_V1, 0x08800000, 0x0ff00000, "stm%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x08000000, 0x0e100000, "stm%23?id%24?ba%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x08bd0000, 0x0fff0000, "pop%c\t%m"},
+  {ARM_EXT_V1, 0x08900000, 0x0f900000, "ldm%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x08100000, 0x0e100000, "ldm%23?id%24?ba%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x0a000000, 0x0e000000, "b%24'l%c\t%b"},
+  {ARM_EXT_V1, 0x0f000000, 0x0f000000, "svc%c\t%0-23x"},
+
+  /* The rest.  */
+  {ARM_EXT_V1, 0x00000000, 0x00000000, "undefined instruction %0-31x"},
+  {0, 0x00000000, 0x00000000, 0}
+};
+
+/* print_insn_thumb16 recognizes the following format control codes:
+
    %S                   print Thumb register (bits 3..5 as high number if bit 6 set)
+   %D                   print Thumb register (bits 0..2 as high number if bit 7 set)
    %<bitfield>I         print bitfield as a signed decimal
    				(top bit of range being the sign bit)
-   %M                   print Thumb register mask
    %N                   print Thumb register mask (with LR)
    %O                   print Thumb register mask (with PC)
-   %T                   print Thumb condition code (always bits 8-11)
-   %I                   print cirrus signed shift immediate: bits 0..3|4..6
-   %<bitfield>B         print Thumb branch destination (signed displacement)
-   %<bitfield>W         print (bitfield * 4) as a decimal
+   %M                   print Thumb register mask
+   %b			print CZB's 6-bit unsigned branch destination
+   %s			print Thumb right-shift immediate (6..10; 0 == 32).
+   %c			print the condition code
+   %C			print the condition code, or "s" if not conditional
+   %x			print warning if conditional an not at end of IT block"
+   %X			print "\t; unpredictable <IT:code>" if conditional
+   %I			print IT instruction suffix and operands
+   %<bitfield>r		print bitfield as an ARM register
+   %<bitfield>d		print bitfield as a decimal
    %<bitfield>H         print (bitfield * 2) as a decimal
+   %<bitfield>W         print (bitfield * 4) as a decimal
    %<bitfield>a         print (bitfield * 4) as a pc-rel offset + decoded symbol
-*/
-
-/* Note: There is a partial ordering in this table - it must be searched from
-   the top to obtain a correct match. */
-
-static struct arm_opcode arm_opcodes[] =
-{
-    /* ARM instructions.  */
-    {0xe1a00000, 0xffffffff, "nop\t\t\t(mov r0,r0)"},
-    {0x012FFF10, 0x0ffffff0, "bx%c\t%0-3r"},
-    {0x00000090, 0x0fe000f0, "mul%c%20's\t%16-19r, %0-3r, %8-11r"},
-    {0x00200090, 0x0fe000f0, "mla%c%20's\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x01000090, 0x0fb00ff0, "swp%c%22'b\t%12-15r, %0-3r, [%16-19r]"},
-    {0x00800090, 0x0fa000f0, "%22?sumull%c%20's\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x00a00090, 0x0fa000f0, "%22?sumlal%c%20's\t%12-15r, %16-19r, %0-3r, %8-11r"},
-
-    /* V5J instruction.  */
-    {0x012fff20, 0x0ffffff0, "bxj%c\t%0-3r"},
-
-    /* XScale instructions.  */
-    {0x0e200010, 0x0fff0ff0, "mia%c\tacc0, %0-3r, %12-15r"},
-    {0x0e280010, 0x0fff0ff0, "miaph%c\tacc0, %0-3r, %12-15r"},
-    {0x0e2c0010, 0x0ffc0ff0, "mia%17'T%17`B%16'T%16`B%c\tacc0, %0-3r, %12-15r"},
-    {0x0c400000, 0x0ff00fff, "mar%c\tacc0, %12-15r, %16-19r"},
-    {0x0c500000, 0x0ff00fff, "mra%c\t%12-15r, %16-19r, acc0"},
-    {0xf450f000, 0xfc70f000, "pld\t%a"},
-
-    /* V5 Instructions.  */
-    {0xe1200070, 0xfff000f0, "bkpt\t0x%16-19X%12-15X%8-11X%0-3X"},
-    {0xfa000000, 0xfe000000, "blx\t%B"},
-    {0x012fff30, 0x0ffffff0, "blx%c\t%0-3r"},
-    {0x016f0f10, 0x0fff0ff0, "clz%c\t%12-15r, %0-3r"},
-    {0xfc100000, 0xfe100000, "ldc2%22'l\t%8-11d, cr%12-15d, %A"},
-    {0xfc000000, 0xfe100000, "stc2%22'l\t%8-11d, cr%12-15d, %A"},
-    {0xfe000000, 0xff000010, "cdp2\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0xfe000010, 0xff100010, "mcr2\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0xfe100010, 0xff100010, "mrc2\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-
-    /* V5E "El Segundo" Instructions.  */
-    {0x000000d0, 0x0e1000f0, "ldr%cd\t%12-15r, %s"},
-    {0x000000f0, 0x0e1000f0, "str%cd\t%12-15r, %s"},
-    {0x01000080, 0x0ff000f0, "smlabb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x010000a0, 0x0ff000f0, "smlatb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x010000c0, 0x0ff000f0, "smlabt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x010000e0, 0x0ff000f0, "smlatt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-
-    {0x01200080, 0x0ff000f0, "smlawb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x012000c0, 0x0ff000f0, "smlawt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-
-    {0x01400080, 0x0ff000f0, "smlalbb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x014000a0, 0x0ff000f0, "smlaltb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x014000c0, 0x0ff000f0, "smlalbt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x014000e0, 0x0ff000f0, "smlaltt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-
-    {0x01600080, 0x0ff0f0f0, "smulbb%c\t%16-19r, %0-3r, %8-11r"},
-    {0x016000a0, 0x0ff0f0f0, "smultb%c\t%16-19r, %0-3r, %8-11r"},
-    {0x016000c0, 0x0ff0f0f0, "smulbt%c\t%16-19r, %0-3r, %8-11r"},
-    {0x016000e0, 0x0ff0f0f0, "smultt%c\t%16-19r, %0-3r, %8-11r"},
-
-    {0x012000a0, 0x0ff0f0f0, "smulwb%c\t%16-19r, %0-3r, %8-11r"},
-    {0x012000e0, 0x0ff0f0f0, "smulwt%c\t%16-19r, %0-3r, %8-11r"},
-
-    {0x01000050, 0x0ff00ff0,  "qadd%c\t%12-15r, %0-3r, %16-19r"},
-    {0x01400050, 0x0ff00ff0, "qdadd%c\t%12-15r, %0-3r, %16-19r"},
-    {0x01200050, 0x0ff00ff0,  "qsub%c\t%12-15r, %0-3r, %16-19r"},
-    {0x01600050, 0x0ff00ff0, "qdsub%c\t%12-15r, %0-3r, %16-19r"},
-
-    {0x0c400000, 0x0ff00000, "mcrr%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
-    {0x0c500000, 0x0ff00000, "mrrc%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
-
-    /* ARM Instructions.  */
-    {0x00000090, 0x0e100090, "str%c%6's%5?hb\t%12-15r, %s"},
-    {0x00100090, 0x0e100090, "ldr%c%6's%5?hb\t%12-15r, %s"},
-    {0x00000000, 0x0de00000, "and%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00200000, 0x0de00000, "eor%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00400000, 0x0de00000, "sub%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00600000, 0x0de00000, "rsb%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00800000, 0x0de00000, "add%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00a00000, 0x0de00000, "adc%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00c00000, 0x0de00000, "sbc%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00e00000, 0x0de00000, "rsc%c%20's\t%12-15r, %16-19r, %o"},
-    {0x0120f000, 0x0db0f000, "msr%c\t%22?SCPSR%C, %o"},
-    {0x010f0000, 0x0fbf0fff, "mrs%c\t%12-15r, %22?SCPSR"},
-    {0x01000000, 0x0de00000, "tst%c%p\t%16-19r, %o"},
-    {0x01200000, 0x0de00000, "teq%c%p\t%16-19r, %o"},
-    {0x01400000, 0x0de00000, "cmp%c%p\t%16-19r, %o"},
-    {0x01600000, 0x0de00000, "cmn%c%p\t%16-19r, %o"},
-    {0x01800000, 0x0de00000, "orr%c%20's\t%12-15r, %16-19r, %o"},
-    {0x01a00000, 0x0de00000, "mov%c%20's\t%12-15r, %o"},
-    {0x01c00000, 0x0de00000, "bic%c%20's\t%12-15r, %16-19r, %o"},
-    {0x01e00000, 0x0de00000, "mvn%c%20's\t%12-15r, %o"},
-    {0x04000000, 0x0e100000, "str%c%22'b%t\t%12-15r, %a"},
-    {0x06000000, 0x0e100ff0, "str%c%22'b%t\t%12-15r, %a"},
-    {0x04000000, 0x0c100010, "str%c%22'b%t\t%12-15r, %a"},
-    {0x06000010, 0x0e000010, "undefined"},
-    {0x04100000, 0x0c100000, "ldr%c%22'b%t\t%12-15r, %a"},
-    {0x08000000, 0x0e100000, "stm%c%23?id%24?ba\t%16-19r%21'!, %m%22'^"},
-    {0x08100000, 0x0e100000, "ldm%c%23?id%24?ba\t%16-19r%21'!, %m%22'^"},
-    {0x0a000000, 0x0e000000, "b%24'l%c\t%b"},
-    {0x0f000000, 0x0f000000, "swi%c\t%0-23x"},
-
-    /* Floating point coprocessor (FPA) instructions */
-    {0x0e000100, 0x0ff08f10, "adf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e100100, 0x0ff08f10, "muf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e200100, 0x0ff08f10, "suf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e300100, 0x0ff08f10, "rsf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e400100, 0x0ff08f10, "dvf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e500100, 0x0ff08f10, "rdf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e600100, 0x0ff08f10, "pow%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e700100, 0x0ff08f10, "rpw%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e800100, 0x0ff08f10, "rmf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e900100, 0x0ff08f10, "fml%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0ea00100, 0x0ff08f10, "fdv%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0eb00100, 0x0ff08f10, "frd%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0ec00100, 0x0ff08f10, "pol%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e008100, 0x0ff08f10, "mvf%c%P%R\t%12-14f, %0-3f"},
-    {0x0e108100, 0x0ff08f10, "mnf%c%P%R\t%12-14f, %0-3f"},
-    {0x0e208100, 0x0ff08f10, "abs%c%P%R\t%12-14f, %0-3f"},
-    {0x0e308100, 0x0ff08f10, "rnd%c%P%R\t%12-14f, %0-3f"},
-    {0x0e408100, 0x0ff08f10, "sqt%c%P%R\t%12-14f, %0-3f"},
-    {0x0e508100, 0x0ff08f10, "log%c%P%R\t%12-14f, %0-3f"},
-    {0x0e608100, 0x0ff08f10, "lgn%c%P%R\t%12-14f, %0-3f"},
-    {0x0e708100, 0x0ff08f10, "exp%c%P%R\t%12-14f, %0-3f"},
-    {0x0e808100, 0x0ff08f10, "sin%c%P%R\t%12-14f, %0-3f"},
-    {0x0e908100, 0x0ff08f10, "cos%c%P%R\t%12-14f, %0-3f"},
-    {0x0ea08100, 0x0ff08f10, "tan%c%P%R\t%12-14f, %0-3f"},
-    {0x0eb08100, 0x0ff08f10, "asn%c%P%R\t%12-14f, %0-3f"},
-    {0x0ec08100, 0x0ff08f10, "acs%c%P%R\t%12-14f, %0-3f"},
-    {0x0ed08100, 0x0ff08f10, "atn%c%P%R\t%12-14f, %0-3f"},
-    {0x0ee08100, 0x0ff08f10, "urd%c%P%R\t%12-14f, %0-3f"},
-    {0x0ef08100, 0x0ff08f10, "nrm%c%P%R\t%12-14f, %0-3f"},
-    {0x0e000110, 0x0ff00f1f, "flt%c%P%R\t%16-18f, %12-15r"},
-    {0x0e100110, 0x0fff0f98, "fix%c%R\t%12-15r, %0-2f"},
-    {0x0e200110, 0x0fff0fff, "wfs%c\t%12-15r"},
-    {0x0e300110, 0x0fff0fff, "rfs%c\t%12-15r"},
-    {0x0e400110, 0x0fff0fff, "wfc%c\t%12-15r"},
-    {0x0e500110, 0x0fff0fff, "rfc%c\t%12-15r"},
-    {0x0e90f110, 0x0ff8fff0, "cmf%c\t%16-18f, %0-3f"},
-    {0x0eb0f110, 0x0ff8fff0, "cnf%c\t%16-18f, %0-3f"},
-    {0x0ed0f110, 0x0ff8fff0, "cmfe%c\t%16-18f, %0-3f"},
-    {0x0ef0f110, 0x0ff8fff0, "cnfe%c\t%16-18f, %0-3f"},
-    {0x0c000100, 0x0e100f00, "stf%c%Q\t%12-14f, %A"},
-    {0x0c100100, 0x0e100f00, "ldf%c%Q\t%12-14f, %A"},
-    {0x0c000200, 0x0e100f00, "sfm%c\t%12-14f, %F, %A"},
-    {0x0c100200, 0x0e100f00, "lfm%c\t%12-14f, %F, %A"},
-
-    /* Floating point coprocessor (VFP) instructions */
-    {0x0eb00bc0, 0x0fff0ff0, "fabsd%c\t%1z, %0z"},
-    {0x0eb00ac0, 0x0fbf0fd0, "fabss%c\t%1y, %0y"},
-    {0x0e300b00, 0x0ff00ff0, "faddd%c\t%1z, %2z, %0z"},
-    {0x0e300a00, 0x0fb00f50, "fadds%c\t%1y, %2y, %1y"},
-    {0x0eb40b40, 0x0fff0f70, "fcmp%7'ed%c\t%1z, %0z"},
-    {0x0eb40a40, 0x0fbf0f50, "fcmp%7'es%c\t%1y, %0y"},
-    {0x0eb50b40, 0x0fff0f70, "fcmp%7'ezd%c\t%1z"},
-    {0x0eb50a40, 0x0fbf0f70, "fcmp%7'ezs%c\t%1y"},
-    {0x0eb00b40, 0x0fff0ff0, "fcpyd%c\t%1z, %0z"},
-    {0x0eb00a40, 0x0fbf0fd0, "fcpys%c\t%1y, %0y"},
-    {0x0eb70ac0, 0x0fff0fd0, "fcvtds%c\t%1z, %0y"},
-    {0x0eb70bc0, 0x0fbf0ff0, "fcvtsd%c\t%1y, %0z"},
-    {0x0e800b00, 0x0ff00ff0, "fdivd%c\t%1z, %2z, %0z"},
-    {0x0e800a00, 0x0fb00f50, "fdivs%c\t%1y, %2y, %0y"},
-    {0x0d100b00, 0x0f700f00, "fldd%c\t%1z, %A"},
-    {0x0c900b00, 0x0fd00f00, "fldmia%0?xd%c\t%16-19r%21'!, %3z"},
-    {0x0d300b00, 0x0ff00f00, "fldmdb%0?xd%c\t%16-19r!, %3z"},
-    {0x0d100a00, 0x0f300f00, "flds%c\t%1y, %A"},
-    {0x0c900a00, 0x0f900f00, "fldmias%c\t%16-19r%21'!, %3y"},
-    {0x0d300a00, 0x0fb00f00, "fldmdbs%c\t%16-19r!, %3y"},
-    {0x0e000b00, 0x0ff00ff0, "fmacd%c\t%1z, %2z, %0z"},
-    {0x0e000a00, 0x0fb00f50, "fmacs%c\t%1y, %2y, %0y"},
-    {0x0e200b10, 0x0ff00fff, "fmdhr%c\t%2z, %12-15r"},
-    {0x0e000b10, 0x0ff00fff, "fmdlr%c\t%2z, %12-15r"},
-    {0x0c400b10, 0x0ff00ff0, "fmdrr%c\t%0z, %12-15r, %16-19r"},
-    {0x0e300b10, 0x0ff00fff, "fmrdh%c\t%12-15r, %2z"},
-    {0x0e100b10, 0x0ff00fff, "fmrdl%c\t%12-15r, %2z"},
-    {0x0c500b10, 0x0ff00ff0, "fmrrd%c\t%12-15r, %16-19r, %0z"},
-    {0x0c500a10, 0x0ff00fd0, "fmrrs%c\t%12-15r, %16-19r, %4y"},
-    {0x0e100a10, 0x0ff00f7f, "fmrs%c\t%12-15r, %2y"},
-    {0x0ef1fa10, 0x0fffffff, "fmstat%c"},
-    {0x0ef00a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpsid"},
-    {0x0ef10a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpscr"},
-    {0x0ef80a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpexc"},
-    {0x0ef90a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst\t@ Impl def"},
-    {0x0efa0a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst2\t@ Impl def"},
-    {0x0ef00a10, 0x0ff00fff, "fmrx%c\t%12-15r, <impl def 0x%16-19x>"},
-    {0x0e100b00, 0x0ff00ff0, "fmscd%c\t%1z, %2z, %0z"},
-    {0x0e100a00, 0x0fb00f50, "fmscs%c\t%1y, %2y, %0y"},
-    {0x0e000a10, 0x0ff00f7f, "fmsr%c\t%2y, %12-15r"},
-    {0x0c400a10, 0x0ff00fd0, "fmsrr%c\t%12-15r, %16-19r, %4y"},
-    {0x0e200b00, 0x0ff00ff0, "fmuld%c\t%1z, %2z, %0z"},
-    {0x0e200a00, 0x0fb00f50, "fmuls%c\t%1y, %2y, %0y"},
-    {0x0ee00a10, 0x0fff0fff, "fmxr%c\tfpsid, %12-15r"},
-    {0x0ee10a10, 0x0fff0fff, "fmxr%c\tfpscr, %12-15r"},
-    {0x0ee80a10, 0x0fff0fff, "fmxr%c\tfpexc, %12-15r"},
-    {0x0ee90a10, 0x0fff0fff, "fmxr%c\tfpinst, %12-15r\t@ Impl def"},
-    {0x0eea0a10, 0x0fff0fff, "fmxr%c\tfpinst2, %12-15r\t@ Impl def"},
-    {0x0ee00a10, 0x0ff00fff, "fmxr%c\t<impl def 0x%16-19x>, %12-15r"},
-    {0x0eb10b40, 0x0fff0ff0, "fnegd%c\t%1z, %0z"},
-    {0x0eb10a40, 0x0fbf0fd0, "fnegs%c\t%1y, %0y"},
-    {0x0e000b40, 0x0ff00ff0, "fnmacd%c\t%1z, %2z, %0z"},
-    {0x0e000a40, 0x0fb00f50, "fnmacs%c\t%1y, %2y, %0y"},
-    {0x0e100b40, 0x0ff00ff0, "fnmscd%c\t%1z, %2z, %0z"},
-    {0x0e100a40, 0x0fb00f50, "fnmscs%c\t%1y, %2y, %0y"},
-    {0x0e200b40, 0x0ff00ff0, "fnmuld%c\t%1z, %2z, %0z"},
-    {0x0e200a40, 0x0fb00f50, "fnmuls%c\t%1y, %2y, %0y"},
-    {0x0eb80bc0, 0x0fff0fd0, "fsitod%c\t%1z, %0y"},
-    {0x0eb80ac0, 0x0fbf0fd0, "fsitos%c\t%1y, %0y"},
-    {0x0eb10bc0, 0x0fff0ff0, "fsqrtd%c\t%1z, %0z"},
-    {0x0eb10ac0, 0x0fbf0fd0, "fsqrts%c\t%1y, %0y"},
-    {0x0d000b00, 0x0f700f00, "fstd%c\t%1z, %A"},
-    {0x0c800b00, 0x0fd00f00, "fstmia%0?xd%c\t%16-19r%21'!, %3z"},
-    {0x0d200b00, 0x0ff00f00, "fstmdb%0?xd%c\t%16-19r!, %3z"},
-    {0x0d000a00, 0x0f300f00, "fsts%c\t%1y, %A"},
-    {0x0c800a00, 0x0f900f00, "fstmias%c\t%16-19r%21'!, %3y"},
-    {0x0d200a00, 0x0fb00f00, "fstmdbs%c\t%16-19r!, %3y"},
-    {0x0e300b40, 0x0ff00ff0, "fsubd%c\t%1z, %2z, %0z"},
-    {0x0e300a40, 0x0fb00f50, "fsubs%c\t%1y, %2y, %0y"},
-    {0x0ebc0b40, 0x0fbe0f70, "fto%16?sui%7'zd%c\t%1y, %0z"},
-    {0x0ebc0a40, 0x0fbe0f50, "fto%16?sui%7'zs%c\t%1y, %0y"},
-    {0x0eb80b40, 0x0fff0fd0, "fuitod%c\t%1z, %0y"},
-    {0x0eb80a40, 0x0fbf0fd0, "fuitos%c\t%1y, %0y"},
-
-    /* Cirrus coprocessor instructions.  */
-    {0x0d100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
-    {0x0c100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
-    {0x0d500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
-    {0x0c500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
-    {0x0d100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
-    {0x0c100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
-    {0x0d500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
-    {0x0c500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
-    {0x0d000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
-    {0x0c000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
-    {0x0d400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
-    {0x0c400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
-    {0x0d000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
-    {0x0c000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
-    {0x0d400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
-    {0x0c400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
-    {0x0e000450, 0x0ff00ff0, "cfmvsr%c\tmvf%16-19d, %12-15r"},
-    {0x0e100450, 0x0ff00ff0, "cfmvrs%c\t%12-15r, mvf%16-19d"},
-    {0x0e000410, 0x0ff00ff0, "cfmvdlr%c\tmvd%16-19d, %12-15r"},
-    {0x0e100410, 0x0ff00ff0, "cfmvrdl%c\t%12-15r, mvd%16-19d"},
-    {0x0e000430, 0x0ff00ff0, "cfmvdhr%c\tmvd%16-19d, %12-15r"},
-    {0x0e100430, 0x0ff00fff, "cfmvrdh%c\t%12-15r, mvd%16-19d"},
-    {0x0e000510, 0x0ff00fff, "cfmv64lr%c\tmvdx%16-19d, %12-15r"},
-    {0x0e100510, 0x0ff00fff, "cfmvr64l%c\t%12-15r, mvdx%16-19d"},
-    {0x0e000530, 0x0ff00fff, "cfmv64hr%c\tmvdx%16-19d, %12-15r"},
-    {0x0e100530, 0x0ff00fff, "cfmvr64h%c\t%12-15r, mvdx%16-19d"},
-    {0x0e100610, 0x0ff0fff0, "cfmval32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000610, 0x0ff0fff0, "cfmv32al%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e100630, 0x0ff0fff0, "cfmvam32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000630, 0x0ff0fff0, "cfmv32am%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e100650, 0x0ff0fff0, "cfmvah32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000650, 0x0ff0fff0, "cfmv32ah%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e000670, 0x0ff0fff0, "cfmv32a%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e100670, 0x0ff0fff0, "cfmva32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000690, 0x0ff0fff0, "cfmv64a%c\tmvdx%0-3d, mvax%16-19d"},
-    {0x0e100690, 0x0ff0fff0, "cfmva64%c\tmvax%0-3d, mvdx%16-19d"},
-    {0x0e1006b0, 0x0ff0fff0, "cfmvsc32%c\tdspsc, mvfx%16-19d"},
-    {0x0e0006b0, 0x0ff0fff0, "cfmv32sc%c\tmvfx%0-3d, dspsc"},
-    {0x0e000400, 0x0ff00fff, "cfcpys%c\tmvf%12-15d, mvf%16-19d"},
-    {0x0e000420, 0x0ff00fff, "cfcpyd%c\tmvd%12-15d, mvd%16-19d"},
-    {0x0e000460, 0x0ff00fff, "cfcvtsd%c\tmvd%12-15d, mvf%16-19d"},
-    {0x0e000440, 0x0ff00fff, "cfcvtds%c\tmvf%12-15d, mvd%16-19d"},
-    {0x0e000480, 0x0ff00fff, "cfcvt32s%c\tmvf%12-15d, mvfx%16-19d"},
-    {0x0e0004a0, 0x0ff00fff, "cfcvt32d%c\tmvd%12-15d, mvfx%16-19d"},
-    {0x0e0004c0, 0x0ff00fff, "cfcvt64s%c\tmvf%12-15d, mvdx%16-19d"},
-    {0x0e0004e0, 0x0ff00fff, "cfcvt64d%c\tmvd%12-15d, mvdx%16-19d"},
-    {0x0e100580, 0x0ff00fff, "cfcvts32%c\tmvfx%12-15d, mvf%16-19d"},
-    {0x0e1005a0, 0x0ff00fff, "cfcvtd32%c\tmvfx%12-15d, mvd%16-19d"},
-    {0x0e1005c0, 0x0ff00fff, "cftruncs32%c\tmvfx%12-15d, mvf%16-19d"},
-    {0x0e1005e0, 0x0ff00fff, "cftruncd32%c\tmvfx%12-15d, mvd%16-19d"},
-    {0x0e000550, 0x0ff00ff0, "cfrshl32%c\tmvfx%16-19d, mvfx%0-3d, %12-15r"},
-    {0x0e000570, 0x0ff00ff0, "cfrshl64%c\tmvdx%16-19d, mvdx%0-3d, %12-15r"},
-    {0x0e000500, 0x0ff00f00, "cfsh32%c\tmvfx%12-15d, mvfx%16-19d, #%I"},
-    {0x0e200500, 0x0ff00f00, "cfsh64%c\tmvdx%12-15d, mvdx%16-19d, #%I"},
-    {0x0e100490, 0x0ff00ff0, "cfcmps%c\t%12-15r, mvf%16-19d, mvf%0-3d"},
-    {0x0e1004b0, 0x0ff00ff0, "cfcmpd%c\t%12-15r, mvd%16-19d, mvd%0-3d"},
-    {0x0e100590, 0x0ff00ff0, "cfcmp32%c\t%12-15r, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e1005b0, 0x0ff00ff0, "cfcmp64%c\t%12-15r, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e300400, 0x0ff00fff, "cfabss%c\tmvf%12-15d, mvf%16-19d"},
-    {0x0e300420, 0x0ff00fff, "cfabsd%c\tmvd%12-15d, mvd%16-19d"},
-    {0x0e300440, 0x0ff00fff, "cfnegs%c\tmvf%12-15d, mvf%16-19d"},
-    {0x0e300460, 0x0ff00fff, "cfnegd%c\tmvd%12-15d, mvd%16-19d"},
-    {0x0e300480, 0x0ff00ff0, "cfadds%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
-    {0x0e3004a0, 0x0ff00ff0, "cfaddd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
-    {0x0e3004c0, 0x0ff00ff0, "cfsubs%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
-    {0x0e3004e0, 0x0ff00ff0, "cfsubd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
-    {0x0e100400, 0x0ff00ff0, "cfmuls%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
-    {0x0e100420, 0x0ff00ff0, "cfmuld%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
-    {0x0e300500, 0x0ff00fff, "cfabs32%c\tmvfx%12-15d, mvfx%16-19d"},
-    {0x0e300520, 0x0ff00fff, "cfabs64%c\tmvdx%12-15d, mvdx%16-19d"},
-    {0x0e300540, 0x0ff00fff, "cfneg32%c\tmvfx%12-15d, mvfx%16-19d"},
-    {0x0e300560, 0x0ff00fff, "cfneg64%c\tmvdx%12-15d, mvdx%16-19d"},
-    {0x0e300580, 0x0ff00ff0, "cfadd32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e3005a0, 0x0ff00ff0, "cfadd64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e3005c0, 0x0ff00ff0, "cfsub32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e3005e0, 0x0ff00ff0, "cfsub64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e100500, 0x0ff00ff0, "cfmul32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e100520, 0x0ff00ff0, "cfmul64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e100540, 0x0ff00ff0, "cfmac32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e100560, 0x0ff00ff0, "cfmsc32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e000600, 0x0ff00f00, "cfmadd32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e100600, 0x0ff00f00, "cfmsub32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e200600, 0x0ff00f00, "cfmadda32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e300600, 0x0ff00f00, "cfmsuba32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
-
-    /* Generic coprocessor instructions */
-    {0x0e000000, 0x0f000010, "cdp%c\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0x0e100010, 0x0f100010, "mrc%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0x0e000010, 0x0f100010, "mcr%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0x0c000000, 0x0e100000, "stc%c%22'l\t%8-11d, cr%12-15d, %A"},
-    {0x0c100000, 0x0e100000, "ldc%c%22'l\t%8-11d, cr%12-15d, %A"},
-
-    /* The rest.  */
-    {0x00000000, 0x00000000, "undefined instruction %0-31x"},
-    {0x00000000, 0x00000000, 0}
-};
-
-#define BDISP(x) ((((x) & 0xffffff) ^ 0x800000) - 0x800000) /* 26 bit */
+   %<bitfield>B         print Thumb branch destination (signed displacement)
+   %<bitfield>c         print bitfield as a condition code
+   %<bitnum>'c		print specified char iff bit is one
+   %<bitnum>?ab		print a if bit is one else print b.  */
 
-static struct thumb_opcode thumb_opcodes[] =
+static const struct opcode16 thumb_opcodes[] =
 {
   /* Thumb instructions.  */
 
+  /* ARM V6K no-argument instructions.  */
+  {ARM_EXT_V6K, 0xbf00, 0xffff, "nop%c"},
+  {ARM_EXT_V6K, 0xbf10, 0xffff, "yield%c"},
+  {ARM_EXT_V6K, 0xbf20, 0xffff, "wfe%c"},
+  {ARM_EXT_V6K, 0xbf30, 0xffff, "wfi%c"},
+  {ARM_EXT_V6K, 0xbf40, 0xffff, "sev%c"},
+  {ARM_EXT_V6K, 0xbf00, 0xff0f, "nop%c\t{%4-7d}"},
+
+  /* ARM V6T2 instructions.  */
+  {ARM_EXT_V6T2, 0xb900, 0xfd00, "cbnz\t%0-2r, %b%X"},
+  {ARM_EXT_V6T2, 0xb100, 0xfd00, "cbz\t%0-2r, %b%X"},
+  {ARM_EXT_V6T2, 0xbf00, 0xff00, "it%I%X"},
+
+  /* ARM V6.  */
+  {ARM_EXT_V6, 0xb660, 0xfff8, "cpsie\t%2'a%1'i%0'f%X"},
+  {ARM_EXT_V6, 0xb670, 0xfff8, "cpsid\t%2'a%1'i%0'f%X"},
+  {ARM_EXT_V6, 0x4600, 0xffc0, "mov%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xba00, 0xffc0, "rev%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xba40, 0xffc0, "rev16%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xbac0, 0xffc0, "revsh%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb650, 0xfff7, "setend\t%3?ble%X"},
+  {ARM_EXT_V6, 0xb200, 0xffc0, "sxth%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb240, 0xffc0, "sxtb%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb280, 0xffc0, "uxth%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb2c0, 0xffc0, "uxtb%c\t%0-2r, %3-5r"},
+
   /* ARM V5 ISA extends Thumb.  */
-  {0xbe00, 0xff00, "bkpt\t%0-7x"},
-  {0x4780, 0xff87, "blx\t%3-6r"},	/* note: 4 bit register number.  */
-  /* Note: this is BLX(2).  BLX(1) is done in arm-dis.c/print_insn_thumb()
-     as an extension of the special processing there for Thumb BL.
-     BL and BLX(1) involve 2 successive 16-bit instructions, which must
-     always appear together in the correct order.  So, the empty
-     string is put in this table, and the string interpreter takes <empty>
-     to mean it has a pair of BL-ish instructions.  */
-  {0x46C0, 0xFFFF, "nop\t\t\t(mov r8, r8)"},
-  /* Format 5 instructions do not update the PSR.  */
-  {0x1C00, 0xFFC0, "mov\t%0-2r, %3-5r\t\t(add %0-2r, %3-5r, #%6-8d)"},
+  {ARM_EXT_V5T, 0xbe00, 0xff00, "bkpt\t%0-7x"}, /* Is always unconditional.  */
+  /* This is BLX(2).  BLX(1) is a 32-bit instruction.  */
+  {ARM_EXT_V5T, 0x4780, 0xff87, "blx%c\t%3-6r%x"},	/* note: 4 bit register number.  */
+  /* ARM V4T ISA (Thumb v1).  */
+  {ARM_EXT_V4T, 0x46C0, 0xFFFF, "nop%c\t\t\t(mov r8, r8)"},
   /* Format 4.  */
-  {0x4000, 0xFFC0, "and\t%0-2r, %3-5r"},
-  {0x4040, 0xFFC0, "eor\t%0-2r, %3-5r"},
-  {0x4080, 0xFFC0, "lsl\t%0-2r, %3-5r"},
-  {0x40C0, 0xFFC0, "lsr\t%0-2r, %3-5r"},
-  {0x4100, 0xFFC0, "asr\t%0-2r, %3-5r"},
-  {0x4140, 0xFFC0, "adc\t%0-2r, %3-5r"},
-  {0x4180, 0xFFC0, "sbc\t%0-2r, %3-5r"},
-  {0x41C0, 0xFFC0, "ror\t%0-2r, %3-5r"},
-  {0x4200, 0xFFC0, "tst\t%0-2r, %3-5r"},
-  {0x4240, 0xFFC0, "neg\t%0-2r, %3-5r"},
-  {0x4280, 0xFFC0, "cmp\t%0-2r, %3-5r"},
-  {0x42C0, 0xFFC0, "cmn\t%0-2r, %3-5r"},
-  {0x4300, 0xFFC0, "orr\t%0-2r, %3-5r"},
-  {0x4340, 0xFFC0, "mul\t%0-2r, %3-5r"},
-  {0x4380, 0xFFC0, "bic\t%0-2r, %3-5r"},
-  {0x43C0, 0xFFC0, "mvn\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4000, 0xFFC0, "and%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4040, 0xFFC0, "eor%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4080, 0xFFC0, "lsl%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x40C0, 0xFFC0, "lsr%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4100, 0xFFC0, "asr%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4140, 0xFFC0, "adc%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4180, 0xFFC0, "sbc%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x41C0, 0xFFC0, "ror%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4200, 0xFFC0, "tst%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4240, 0xFFC0, "neg%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4280, 0xFFC0, "cmp%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x42C0, 0xFFC0, "cmn%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4300, 0xFFC0, "orr%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4340, 0xFFC0, "mul%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4380, 0xFFC0, "bic%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x43C0, 0xFFC0, "mvn%C\t%0-2r, %3-5r"},
   /* format 13 */
-  {0xB000, 0xFF80, "add\tsp, #%0-6W"},
-  {0xB080, 0xFF80, "sub\tsp, #%0-6W"},
+  {ARM_EXT_V4T, 0xB000, 0xFF80, "add%c\tsp, #%0-6W"},
+  {ARM_EXT_V4T, 0xB080, 0xFF80, "sub%c\tsp, #%0-6W"},
   /* format 5 */
-  {0x4700, 0xFF80, "bx\t%S"},
-  {0x4400, 0xFF00, "add\t%D, %S"},
-  {0x4500, 0xFF00, "cmp\t%D, %S"},
-  {0x4600, 0xFF00, "mov\t%D, %S"},
+  {ARM_EXT_V4T, 0x4700, 0xFF80, "bx%c\t%S%x"},
+  {ARM_EXT_V4T, 0x4400, 0xFF00, "add%c\t%D, %S"},
+  {ARM_EXT_V4T, 0x4500, 0xFF00, "cmp%c\t%D, %S"},
+  {ARM_EXT_V4T, 0x4600, 0xFF00, "mov%c\t%D, %S"},
   /* format 14 */
-  {0xB400, 0xFE00, "push\t%N"},
-  {0xBC00, 0xFE00, "pop\t%O"},
+  {ARM_EXT_V4T, 0xB400, 0xFE00, "push%c\t%N"},
+  {ARM_EXT_V4T, 0xBC00, 0xFE00, "pop%c\t%O"},
   /* format 2 */
-  {0x1800, 0xFE00, "add\t%0-2r, %3-5r, %6-8r"},
-  {0x1A00, 0xFE00, "sub\t%0-2r, %3-5r, %6-8r"},
-  {0x1C00, 0xFE00, "add\t%0-2r, %3-5r, #%6-8d"},
-  {0x1E00, 0xFE00, "sub\t%0-2r, %3-5r, #%6-8d"},
+  {ARM_EXT_V4T, 0x1800, 0xFE00, "add%C\t%0-2r, %3-5r, %6-8r"},
+  {ARM_EXT_V4T, 0x1A00, 0xFE00, "sub%C\t%0-2r, %3-5r, %6-8r"},
+  {ARM_EXT_V4T, 0x1C00, 0xFE00, "add%C\t%0-2r, %3-5r, #%6-8d"},
+  {ARM_EXT_V4T, 0x1E00, 0xFE00, "sub%C\t%0-2r, %3-5r, #%6-8d"},
   /* format 8 */
-  {0x5200, 0xFE00, "strh\t%0-2r, [%3-5r, %6-8r]"},
-  {0x5A00, 0xFE00, "ldrh\t%0-2r, [%3-5r, %6-8r]"},
-  {0x5600, 0xF600, "ldrs%11?hb\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5200, 0xFE00, "strh%c\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5A00, 0xFE00, "ldrh%c\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5600, 0xF600, "ldrs%11?hb%c\t%0-2r, [%3-5r, %6-8r]"},
   /* format 7 */
-  {0x5000, 0xFA00, "str%10'b\t%0-2r, [%3-5r, %6-8r]"},
-  {0x5800, 0xFA00, "ldr%10'b\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5000, 0xFA00, "str%10'b%c\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5800, 0xFA00, "ldr%10'b%c\t%0-2r, [%3-5r, %6-8r]"},
   /* format 1 */
-  {0x0000, 0xF800, "lsl\t%0-2r, %3-5r, #%6-10d"},
-  {0x0800, 0xF800, "lsr\t%0-2r, %3-5r, #%6-10d"},
-  {0x1000, 0xF800, "asr\t%0-2r, %3-5r, #%6-10d"},
+  {ARM_EXT_V4T, 0x0000, 0xF800, "lsl%C\t%0-2r, %3-5r, #%6-10d"},
+  {ARM_EXT_V4T, 0x0800, 0xF800, "lsr%C\t%0-2r, %3-5r, %s"},
+  {ARM_EXT_V4T, 0x1000, 0xF800, "asr%C\t%0-2r, %3-5r, %s"},
   /* format 3 */
-  {0x2000, 0xF800, "mov\t%8-10r, #%0-7d"},
-  {0x2800, 0xF800, "cmp\t%8-10r, #%0-7d"},
-  {0x3000, 0xF800, "add\t%8-10r, #%0-7d"},
-  {0x3800, 0xF800, "sub\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x2000, 0xF800, "mov%C\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x2800, 0xF800, "cmp%c\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x3000, 0xF800, "add%C\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x3800, 0xF800, "sub%C\t%8-10r, #%0-7d"},
   /* format 6 */
-  {0x4800, 0xF800, "ldr\t%8-10r, [pc, #%0-7W]\t(%0-7a)"},  /* TODO: Disassemble PC relative "LDR rD,=<symbolic>" */
+  {ARM_EXT_V4T, 0x4800, 0xF800, "ldr%c\t%8-10r, [pc, #%0-7W]\t(%0-7a)"},  /* TODO: Disassemble PC relative "LDR rD,=<symbolic>" */
   /* format 9 */
-  {0x6000, 0xF800, "str\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x6800, 0xF800, "ldr\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x7000, 0xF800, "strb\t%0-2r, [%3-5r, #%6-10d]"},
-  {0x7800, 0xF800, "ldrb\t%0-2r, [%3-5r, #%6-10d]"},
+  {ARM_EXT_V4T, 0x6000, 0xF800, "str%c\t%0-2r, [%3-5r, #%6-10W]"},
+  {ARM_EXT_V4T, 0x6800, 0xF800, "ldr%c\t%0-2r, [%3-5r, #%6-10W]"},
+  {ARM_EXT_V4T, 0x7000, 0xF800, "strb%c\t%0-2r, [%3-5r, #%6-10d]"},
+  {ARM_EXT_V4T, 0x7800, 0xF800, "ldrb%c\t%0-2r, [%3-5r, #%6-10d]"},
   /* format 10 */
-  {0x8000, 0xF800, "strh\t%0-2r, [%3-5r, #%6-10H]"},
-  {0x8800, 0xF800, "ldrh\t%0-2r, [%3-5r, #%6-10H]"},
+  {ARM_EXT_V4T, 0x8000, 0xF800, "strh%c\t%0-2r, [%3-5r, #%6-10H]"},
+  {ARM_EXT_V4T, 0x8800, 0xF800, "ldrh%c\t%0-2r, [%3-5r, #%6-10H]"},
   /* format 11 */
-  {0x9000, 0xF800, "str\t%8-10r, [sp, #%0-7W]"},
-  {0x9800, 0xF800, "ldr\t%8-10r, [sp, #%0-7W]"},
+  {ARM_EXT_V4T, 0x9000, 0xF800, "str%c\t%8-10r, [sp, #%0-7W]"},
+  {ARM_EXT_V4T, 0x9800, 0xF800, "ldr%c\t%8-10r, [sp, #%0-7W]"},
   /* format 12 */
-  {0xA000, 0xF800, "add\t%8-10r, pc, #%0-7W\t(adr %8-10r,%0-7a)"},
-  {0xA800, 0xF800, "add\t%8-10r, sp, #%0-7W"},
+  {ARM_EXT_V4T, 0xA000, 0xF800, "add%c\t%8-10r, pc, #%0-7W\t(adr %8-10r, %0-7a)"},
+  {ARM_EXT_V4T, 0xA800, 0xF800, "add%c\t%8-10r, sp, #%0-7W"},
   /* format 15 */
-  {0xC000, 0xF800, "stmia\t%8-10r!,%M"},
-  {0xC800, 0xF800, "ldmia\t%8-10r!,%M"},
-  /* format 18 */
-  {0xE000, 0xF800, "b\t%0-10B"},
-  {0xE800, 0xF800, "undefined"},
-  /* format 19 */
-  {0xF000, 0xF800, ""}, /* special processing required in disassembler */
-  {0xF800, 0xF800, "second half of BL instruction %0-15x"},
-  /* format 16 */
-  {0xD000, 0xFF00, "beq\t%0-7B"},
-  {0xD100, 0xFF00, "bne\t%0-7B"},
-  {0xD200, 0xFF00, "bcs\t%0-7B"},
-  {0xD300, 0xFF00, "bcc\t%0-7B"},
-  {0xD400, 0xFF00, "bmi\t%0-7B"},
-  {0xD500, 0xFF00, "bpl\t%0-7B"},
-  {0xD600, 0xFF00, "bvs\t%0-7B"},
-  {0xD700, 0xFF00, "bvc\t%0-7B"},
-  {0xD800, 0xFF00, "bhi\t%0-7B"},
-  {0xD900, 0xFF00, "bls\t%0-7B"},
-  {0xDA00, 0xFF00, "bge\t%0-7B"},
-  {0xDB00, 0xFF00, "blt\t%0-7B"},
-  {0xDC00, 0xFF00, "bgt\t%0-7B"},
-  {0xDD00, 0xFF00, "ble\t%0-7B"},
+  {ARM_EXT_V4T, 0xC000, 0xF800, "stmia%c\t%8-10r!, %M"},
+  {ARM_EXT_V4T, 0xC800, 0xF800, "ldmia%c\t%8-10r!, %M"},
   /* format 17 */
-  {0xDE00, 0xFF00, "bal\t%0-7B"},
-  {0xDF00, 0xFF00, "swi\t%0-7d"},
-  /* format 9 */
-  {0x6000, 0xF800, "str\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x6800, 0xF800, "ldr\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x7000, 0xF800, "strb\t%0-2r, [%3-5r, #%6-10d]"},
-  {0x7800, 0xF800, "ldrb\t%0-2r, [%3-5r, #%6-10d]"},
-  /* the rest */
-  {0x0000, 0x0000, "undefined instruction %0-15x"},
-  {0x0000, 0x0000, 0}
+  {ARM_EXT_V4T, 0xDF00, 0xFF00, "svc%c\t%0-7d"},
+  /* format 16 */
+  {ARM_EXT_V4T, 0xDE00, 0xFE00, "undefined"},
+  {ARM_EXT_V4T, 0xD000, 0xF000, "b%8-11c.n\t%0-7B%X"},
+  /* format 18 */
+  {ARM_EXT_V4T, 0xE000, 0xF800, "b%c.n\t%0-10B%x"},
+
+  /* The E800 .. FFFF range is unconditionally redirected to the
+     32-bit table, because even in pre-V6T2 ISAs, BL and BLX(1) pairs
+     are processed via that table.  Thus, we can never encounter a
+     bare "second half of BL/BLX(1)" instruction here.  */
+  {ARM_EXT_V1,  0x0000, 0x0000, "undefined"},
+  {0, 0, 0, 0}
 };
 
-#define BDISP23(x) ((((((x) & 0x07ff) << 11) | (((x) & 0x07ff0000) >> 16)) \
-                     ^ 0x200000) - 0x200000) /* 23bit */
-
-#ifndef streq
-#define streq(a,b)	(strcmp ((a), (b)) == 0)
-#endif
+/* Thumb32 opcodes use the same table structure as the ARM opcodes.
+   We adopt the convention that hw1 is the high 16 bits of .value and
+   .mask, hw2 the low 16 bits.
+
+   print_insn_thumb32 recognizes the following format control codes:
+
+       %%		%
+
+       %I		print a 12-bit immediate from hw1[10],hw2[14:12,7:0]
+       %M		print a modified 12-bit immediate (same location)
+       %J		print a 16-bit immediate from hw1[3:0,10],hw2[14:12,7:0]
+       %K		print a 16-bit immediate from hw2[3:0],hw1[3:0],hw2[11:4]
+       %S		print a possibly-shifted Rm
+
+       %a		print the address of a plain load/store
+       %w		print the width and signedness of a core load/store
+       %m		print register mask for ldm/stm
+
+       %E		print the lsb and width fields of a bfc/bfi instruction
+       %F		print the lsb and width fields of a sbfx/ubfx instruction
+       %b		print a conditional branch offset
+       %B		print an unconditional branch offset
+       %s		print the shift field of an SSAT instruction
+       %R		print the rotation field of an SXT instruction
+       %U		print barrier type.
+       %P		print address for pli instruction.
+       %c		print the condition code
+       %x		print warning if conditional an not at end of IT block"
+       %X		print "\t; unpredictable <IT:code>" if conditional
+
+       %<bitfield>d	print bitfield in decimal
+       %<bitfield>W	print bitfield*4 in decimal
+       %<bitfield>r	print bitfield as an ARM register
+       %<bitfield>c	print bitfield as a condition code
+
+       %<bitfield>'c	print specified char iff bitfield is all ones
+       %<bitfield>`c	print specified char iff bitfield is all zeroes
+       %<bitfield>?ab... select from array of values in big endian order
+
+   With one exception at the bottom (done because BL and BLX(1) need
+   to come dead last), this table was machine-sorted first in
+   decreasing order of number of bits set in the mask, then in
+   increasing numeric order of mask, then in increasing numeric order
+   of opcode.  This order is not the clearest for a human reader, but
+   is guaranteed never to catch a special-case bit pattern with a more
+   general mask, which is important, because this instruction encoding
+   makes heavy use of special-case bit patterns.  */
+static const struct opcode32 thumb32_opcodes[] =
+{
+  /* V7 instructions.  */
+  {ARM_EXT_V7, 0xf910f000, 0xff70f000, "pli%c\t%a"},
+  {ARM_EXT_V7, 0xf3af80f0, 0xfffffff0, "dbg%c\t#%0-3d"},
+  {ARM_EXT_V7, 0xf3bf8f50, 0xfffffff0, "dmb%c\t%U"},
+  {ARM_EXT_V7, 0xf3bf8f40, 0xfffffff0, "dsb%c\t%U"},
+  {ARM_EXT_V7, 0xf3bf8f60, 0xfffffff0, "isb%c\t%U"},
+  {ARM_EXT_DIV, 0xfb90f0f0, 0xfff0f0f0, "sdiv%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_DIV, 0xfbb0f0f0, 0xfff0f0f0, "udiv%c\t%8-11r, %16-19r, %0-3r"},
+
+  /* Instructions defined in the basic V6T2 set.  */
+  {ARM_EXT_V6T2, 0xf3af8000, 0xffffffff, "nop%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8001, 0xffffffff, "yield%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8002, 0xffffffff, "wfe%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8003, 0xffffffff, "wfi%c.w"},
+  {ARM_EXT_V6T2, 0xf3af9004, 0xffffffff, "sev%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8000, 0xffffff00, "nop%c.w\t{%0-7d}"},
+
+  {ARM_EXT_V6T2, 0xf3bf8f2f, 0xffffffff, "clrex%c"},
+  {ARM_EXT_V6T2, 0xf3af8400, 0xffffff1f, "cpsie.w\t%7'a%6'i%5'f%X"},
+  {ARM_EXT_V6T2, 0xf3af8600, 0xffffff1f, "cpsid.w\t%7'a%6'i%5'f%X"},
+  {ARM_EXT_V6T2, 0xf3c08f00, 0xfff0ffff, "bxj%c\t%16-19r%x"},
+  {ARM_EXT_V6T2, 0xe810c000, 0xffd0ffff, "rfedb%c\t%16-19r%21'!"},
+  {ARM_EXT_V6T2, 0xe990c000, 0xffd0ffff, "rfeia%c\t%16-19r%21'!"},
+  {ARM_EXT_V6T2, 0xf3ef8000, 0xffeff000, "mrs%c\t%8-11r, %D"},
+  {ARM_EXT_V6T2, 0xf3af8100, 0xffffffe0, "cps\t#%0-4d%X"},
+  {ARM_EXT_V6T2, 0xe8d0f000, 0xfff0fff0, "tbb%c\t[%16-19r, %0-3r]%x"},
+  {ARM_EXT_V6T2, 0xe8d0f010, 0xfff0fff0, "tbh%c\t[%16-19r, %0-3r, lsl #1]%x"},
+  {ARM_EXT_V6T2, 0xf3af8500, 0xffffff00, "cpsie\t%7'a%6'i%5'f, #%0-4d%X"},
+  {ARM_EXT_V6T2, 0xf3af8700, 0xffffff00, "cpsid\t%7'a%6'i%5'f, #%0-4d%X"},
+  {ARM_EXT_V6T2, 0xf3de8f00, 0xffffff00, "subs%c\tpc, lr, #%0-7d"},
+  {ARM_EXT_V6T2, 0xf3808000, 0xffe0f000, "msr%c\t%C, %16-19r"},
+  {ARM_EXT_V6T2, 0xe8500f00, 0xfff00fff, "ldrex%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe8d00f4f, 0xfff00fef, "ldrex%4?hb%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe800c000, 0xffd0ffe0, "srsdb%c\t%16-19r%21'!, #%0-4d"},
+  {ARM_EXT_V6T2, 0xe980c000, 0xffd0ffe0, "srsia%c\t%16-19r%21'!, #%0-4d"},
+  {ARM_EXT_V6T2, 0xfa0ff080, 0xfffff0c0, "sxth%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa1ff080, 0xfffff0c0, "uxth%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa2ff080, 0xfffff0c0, "sxtb16%c\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa3ff080, 0xfffff0c0, "uxtb16%c\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa4ff080, 0xfffff0c0, "sxtb%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa5ff080, 0xfffff0c0, "uxtb%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xe8400000, 0xfff000ff, "strex%c\t%8-11r, %12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe8d0007f, 0xfff000ff, "ldrexd%c\t%12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xfa80f000, 0xfff0f0f0, "sadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f010, 0xfff0f0f0, "qadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f020, 0xfff0f0f0, "shadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f040, 0xfff0f0f0, "uadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f050, 0xfff0f0f0, "uqadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f060, 0xfff0f0f0, "uhadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f080, 0xfff0f0f0, "qadd%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa80f090, 0xfff0f0f0, "qdadd%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa80f0a0, 0xfff0f0f0, "qsub%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa80f0b0, 0xfff0f0f0, "qdsub%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f000, 0xfff0f0f0, "sadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f010, 0xfff0f0f0, "qadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f020, 0xfff0f0f0, "shadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f040, 0xfff0f0f0, "uadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f050, 0xfff0f0f0, "uqadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f060, 0xfff0f0f0, "uhadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f080, 0xfff0f0f0, "rev%c.w\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f090, 0xfff0f0f0, "rev16%c.w\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f0a0, 0xfff0f0f0, "rbit%c\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f0b0, 0xfff0f0f0, "revsh%c.w\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfaa0f000, 0xfff0f0f0, "saddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f010, 0xfff0f0f0, "qaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f020, 0xfff0f0f0, "shaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f040, 0xfff0f0f0, "uaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f050, 0xfff0f0f0, "uqaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f060, 0xfff0f0f0, "uhaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f080, 0xfff0f0f0, "sel%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfab0f080, 0xfff0f0f0, "clz%c\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfac0f000, 0xfff0f0f0, "ssub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f010, 0xfff0f0f0, "qsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f020, 0xfff0f0f0, "shsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f040, 0xfff0f0f0, "usub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f050, 0xfff0f0f0, "uqsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f060, 0xfff0f0f0, "uhsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f000, 0xfff0f0f0, "ssub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f010, 0xfff0f0f0, "qsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f020, 0xfff0f0f0, "shsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f040, 0xfff0f0f0, "usub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f050, 0xfff0f0f0, "uqsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f060, 0xfff0f0f0, "uhsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f000, 0xfff0f0f0, "ssubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f010, 0xfff0f0f0, "qsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f020, 0xfff0f0f0, "shsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f040, 0xfff0f0f0, "usubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f050, 0xfff0f0f0, "uqsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f060, 0xfff0f0f0, "uhsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb00f000, 0xfff0f0f0, "mul%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb70f000, 0xfff0f0f0, "usad8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa00f000, 0xffe0f0f0, "lsl%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa20f000, 0xffe0f0f0, "lsr%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa40f000, 0xffe0f0f0, "asr%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa60f000, 0xffe0f0f0, "ror%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xe8c00f40, 0xfff00fe0, "strex%4?hb%c\t%0-3r, %12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xf3200000, 0xfff0f0e0, "ssat16%c\t%8-11r, #%0-4d, %16-19r"},
+  {ARM_EXT_V6T2, 0xf3a00000, 0xfff0f0e0, "usat16%c\t%8-11r, #%0-4d, %16-19r"},
+  {ARM_EXT_V6T2, 0xfb20f000, 0xfff0f0e0, "smuad%4'x%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb30f000, 0xfff0f0e0, "smulw%4?tb%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb40f000, 0xfff0f0e0, "smusd%4'x%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb50f000, 0xfff0f0e0, "smmul%4'r%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa00f080, 0xfff0f0c0, "sxtah%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa10f080, 0xfff0f0c0, "uxtah%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa20f080, 0xfff0f0c0, "sxtab16%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa30f080, 0xfff0f0c0, "uxtab16%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa40f080, 0xfff0f0c0, "sxtab%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa50f080, 0xfff0f0c0, "uxtab%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfb10f000, 0xfff0f0c0, "smul%5?tb%4?tb%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xf36f0000, 0xffff8020, "bfc%c\t%8-11r, %E"},
+  {ARM_EXT_V6T2, 0xea100f00, 0xfff08f00, "tst%c.w\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea900f00, 0xfff08f00, "teq%c\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb100f00, 0xfff08f00, "cmn%c.w\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xebb00f00, 0xfff08f00, "cmp%c.w\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xf0100f00, 0xfbf08f00, "tst%c.w\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0900f00, 0xfbf08f00, "teq%c\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1100f00, 0xfbf08f00, "cmn%c.w\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1b00f00, 0xfbf08f00, "cmp%c.w\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xea4f0000, 0xffef8000, "mov%20's%c.w\t%8-11r, %S"},
+  {ARM_EXT_V6T2, 0xea6f0000, 0xffef8000, "mvn%20's%c.w\t%8-11r, %S"},
+  {ARM_EXT_V6T2, 0xe8c00070, 0xfff000f0, "strexd%c\t%0-3r, %12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xfb000000, 0xfff000f0, "mla%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb000010, 0xfff000f0, "mls%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb700000, 0xfff000f0, "usada8%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb800000, 0xfff000f0, "smull%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfba00000, 0xfff000f0, "umull%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbc00000, 0xfff000f0, "smlal%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbe00000, 0xfff000f0, "umlal%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbe00060, 0xfff000f0, "umaal%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xe8500f00, 0xfff00f00, "ldrex%c\t%12-15r, [%16-19r, #%0-7W]"},
+  {ARM_EXT_V6T2, 0xf7f08000, 0xfff0f000, "smc%c\t%K"},
+  {ARM_EXT_V6T2, 0xf04f0000, 0xfbef8000, "mov%20's%c.w\t%8-11r, %M"},
+  {ARM_EXT_V6T2, 0xf06f0000, 0xfbef8000, "mvn%20's%c.w\t%8-11r, %M"},
+  {ARM_EXT_V6T2, 0xf810f000, 0xff70f000, "pld%c\t%a"},
+  {ARM_EXT_V6T2, 0xfb200000, 0xfff000e0, "smlad%4'x%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb300000, 0xfff000e0, "smlaw%4?tb%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb400000, 0xfff000e0, "smlsd%4'x%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb500000, 0xfff000e0, "smmla%4'r%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb600000, 0xfff000e0, "smmls%4'r%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfbc000c0, 0xfff000e0, "smlald%4'x%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbd000c0, 0xfff000e0, "smlsld%4'x%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xeac00000, 0xfff08030, "pkhbt%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeac00020, 0xfff08030, "pkhtb%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xf3400000, 0xfff08020, "sbfx%c\t%8-11r, %16-19r, %F"},
+  {ARM_EXT_V6T2, 0xf3c00000, 0xfff08020, "ubfx%c\t%8-11r, %16-19r, %F"},
+  {ARM_EXT_V6T2, 0xf8000e00, 0xff900f00, "str%wt%c\t%12-15r, %a"},
+  {ARM_EXT_V6T2, 0xfb100000, 0xfff000c0, "smla%5?tb%4?tb%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfbc00080, 0xfff000c0, "smlal%5?tb%4?tb%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xf3600000, 0xfff08020, "bfi%c\t%8-11r, %16-19r, %E"},
+  {ARM_EXT_V6T2, 0xf8100e00, 0xfe900f00, "ldr%wt%c\t%12-15r, %a"},
+  {ARM_EXT_V6T2, 0xf3000000, 0xffd08020, "ssat%c\t%8-11r, #%0-4d, %16-19r%s"},
+  {ARM_EXT_V6T2, 0xf3800000, 0xffd08020, "usat%c\t%8-11r, #%0-4d, %16-19r%s"},
+  {ARM_EXT_V6T2, 0xf2000000, 0xfbf08000, "addw%c\t%8-11r, %16-19r, %I"},
+  {ARM_EXT_V6T2, 0xf2400000, 0xfbf08000, "movw%c\t%8-11r, %J"},
+  {ARM_EXT_V6T2, 0xf2a00000, 0xfbf08000, "subw%c\t%8-11r, %16-19r, %I"},
+  {ARM_EXT_V6T2, 0xf2c00000, 0xfbf08000, "movt%c\t%8-11r, %J"},
+  {ARM_EXT_V6T2, 0xea000000, 0xffe08000, "and%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea200000, 0xffe08000, "bic%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea400000, 0xffe08000, "orr%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea600000, 0xffe08000, "orn%20's%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea800000, 0xffe08000, "eor%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb000000, 0xffe08000, "add%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb400000, 0xffe08000, "adc%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb600000, 0xffe08000, "sbc%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeba00000, 0xffe08000, "sub%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xebc00000, 0xffe08000, "rsb%20's%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xe8400000, 0xfff00000, "strex%c\t%8-11r, %12-15r, [%16-19r, #%0-7W]"},
+  {ARM_EXT_V6T2, 0xf0000000, 0xfbe08000, "and%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0200000, 0xfbe08000, "bic%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0400000, 0xfbe08000, "orr%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0600000, 0xfbe08000, "orn%20's%c\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0800000, 0xfbe08000, "eor%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1000000, 0xfbe08000, "add%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1400000, 0xfbe08000, "adc%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1600000, 0xfbe08000, "sbc%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1a00000, 0xfbe08000, "sub%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1c00000, 0xfbe08000, "rsb%20's%c\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xe8800000, 0xffd00000, "stmia%c.w\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe8900000, 0xffd00000, "ldmia%c.w\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe9000000, 0xffd00000, "stmdb%c\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe9100000, 0xffd00000, "ldmdb%c\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe9c00000, 0xffd000ff, "strd%c\t%12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe9d00000, 0xffd000ff, "ldrd%c\t%12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe9400000, 0xff500000, "strd%c\t%12-15r, %8-11r, [%16-19r, #%23`-%0-7W]%21'!"},
+  {ARM_EXT_V6T2, 0xe9500000, 0xff500000, "ldrd%c\t%12-15r, %8-11r, [%16-19r, #%23`-%0-7W]%21'!"},
+  {ARM_EXT_V6T2, 0xe8600000, 0xff700000, "strd%c\t%12-15r, %8-11r, [%16-19r], #%23`-%0-7W"},
+  {ARM_EXT_V6T2, 0xe8700000, 0xff700000, "ldrd%c\t%12-15r, %8-11r, [%16-19r], #%23`-%0-7W"},
+  {ARM_EXT_V6T2, 0xf8000000, 0xff100000, "str%w%c.w\t%12-15r, %a"},
+  {ARM_EXT_V6T2, 0xf8100000, 0xfe100000, "ldr%w%c.w\t%12-15r, %a"},
+
+  /* Filter out Bcc with cond=E or F, which are used for other instructions.  */
+  {ARM_EXT_V6T2, 0xf3c08000, 0xfbc0d000, "undefined (bcc, cond=0xF)"},
+  {ARM_EXT_V6T2, 0xf3808000, 0xfbc0d000, "undefined (bcc, cond=0xE)"},
+  {ARM_EXT_V6T2, 0xf0008000, 0xf800d000, "b%22-25c.w\t%b%X"},
+  {ARM_EXT_V6T2, 0xf0009000, 0xf800d000, "b%c.w\t%B%x"},
+
+  /* These have been 32-bit since the invention of Thumb.  */
+  {ARM_EXT_V4T,  0xf000c000, 0xf800d000, "blx%c\t%B%x"},
+  {ARM_EXT_V4T,  0xf000d000, 0xf800d000, "bl%c\t%B%x"},
+
+  /* Fallback.  */
+  {ARM_EXT_V1,   0x00000000, 0x00000000, "undefined"},
+  {0, 0, 0, 0}
+};
 
-#ifndef strneq
-#define strneq(a,b,n)	(strncmp ((a), (b), (n)) == 0)
-#endif
+static const char *const arm_conditional[] =
+{"eq", "ne", "cs", "cc", "mi", "pl", "vs", "vc",
+ "hi", "ls", "ge", "lt", "gt", "le", "al", "<und>", ""};
 
-#ifndef NUM_ELEM
-#define NUM_ELEM(a)     (sizeof (a) / sizeof (a)[0])
-#endif
+static const char *const arm_fp_const[] =
+{"0.0", "1.0", "2.0", "3.0", "4.0", "5.0", "0.5", "10.0"};
 
-static char * arm_conditional[] =
-{"eq", "ne", "cs", "cc", "mi", "pl", "vs", "vc",
- "hi", "ls", "ge", "lt", "gt", "le", "", "nv"};
+static const char *const arm_shift[] =
+{"lsl", "lsr", "asr", "ror"};
 
 typedef struct
 {
-  const char * name;
-  const char * description;
-  const char * reg_names[16];
+  const char *name;
+  const char *description;
+  const char *reg_names[16];
 }
 arm_regname;
 
-static arm_regname regnames[] =
+static const arm_regname regnames[] =
 {
   { "raw" , "Select raw register names",
     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"}},
@@ -557,44 +1503,67 @@ static arm_regname regnames[] =
   { "atpcs", "Select register names used in the ATPCS",
     { "a1", "a2", "a3", "a4", "v1", "v2", "v3", "v4", "v5", "v6", "v7",  "v8",  "IP",  "SP",  "LR",  "PC" }},
   { "special-atpcs", "Select special register names used in the ATPCS",
-    { "a1", "a2", "a3", "a4", "v1", "v2", "v3", "WR", "v5", "SB", "SL",  "FP",  "IP",  "SP",  "LR",  "PC" }}
+    { "a1", "a2", "a3", "a4", "v1", "v2", "v3", "WR", "v5", "SB", "SL",  "FP",  "IP",  "SP",  "LR",  "PC" }},
 };
 
-/* Default to STD register name set.  */
-static unsigned int regname_selected = 2;
+static const char *const iwmmxt_wwnames[] =
+{"b", "h", "w", "d"};
+
+static const char *const iwmmxt_wwssnames[] =
+{"b", "bus", "bc", "bss",
+ "h", "hus", "hc", "hss",
+ "w", "wus", "wc", "wss",
+ "d", "dus", "dc", "dss"
+};
+
+static const char *const iwmmxt_regnames[] =
+{ "wr0", "wr1", "wr2", "wr3", "wr4", "wr5", "wr6", "wr7",
+  "wr8", "wr9", "wr10", "wr11", "wr12", "wr13", "wr14", "wr15"
+};
+
+static const char *const iwmmxt_cregnames[] =
+{ "wcid", "wcon", "wcssf", "wcasf", "reserved", "reserved", "reserved", "reserved",
+  "wcgr0", "wcgr1", "wcgr2", "wcgr3", "reserved", "reserved", "reserved", "reserved"
+};
+
+/* Default to GCC register name set.  */
+static unsigned int regname_selected = 1;
 
 #define NUM_ARM_REGNAMES  NUM_ELEM (regnames)
 #define arm_regnames      regnames[regname_selected].reg_names
 
-static boolean force_thumb = false;
+static bfd_boolean force_thumb = FALSE;
+
+/* Current IT instruction state.  This contains the same state as the IT
+   bits in the CPSR.  */
+static unsigned int ifthen_state;
+/* IT state for the next instruction.  */
+static unsigned int ifthen_next_state;
+/* The address of the insn for which the IT state is valid.  */
+static bfd_vma ifthen_address;
+#define IFTHEN_COND ((ifthen_state >> 4) & 0xf)
+
+/* Cached mapping symbol state.  */
+enum map_type {
+  MAP_ARM,
+  MAP_THUMB,
+  MAP_DATA
+};
 
-static char * arm_fp_const[] =
-{"0.0", "1.0", "2.0", "3.0", "4.0", "5.0", "0.5", "10.0"};
+enum map_type last_type;
+int last_mapping_sym = -1;
+bfd_vma last_mapping_addr = 0;
 
-static char * arm_shift[] =
-{"lsl", "lsr", "asr", "ror"};
-
-/* Forward declarations.  */
-static void arm_decode_shift PARAMS ((long, fprintf_ftype, void *));
-static int  print_insn_arm1 PARAMS ((bfd_vma, struct disassemble_info *, long));
-static int  print_insn_thumb PARAMS ((bfd_vma, struct disassemble_info *, long));
-static void parse_disassembler_options PARAMS ((char *));
-int get_arm_regname_num_options (void);
-int set_arm_regname_option (int option);
-int get_arm_regnames (int option, const char **setname,
-		      const char **setdescription,
-		      const char ***register_names);
 
 /* Functions.  */
 int
-get_arm_regname_num_options ()
+get_arm_regname_num_options (void)
 {
   return NUM_ARM_REGNAMES;
 }
 
 int
-set_arm_regname_option (option)
-     int option;
+set_arm_regname_option (int option)
 {
   int old = regname_selected;
   regname_selected = option;
@@ -602,11 +1571,8 @@ set_arm_regname_option (option)
 }
 
 int
-get_arm_regnames (option, setname, setdescription, register_names)
-     int option;
-     const char **setname;
-     const char **setdescription;
-     const char ***register_names;
+get_arm_regnames (int option, const char **setname, const char **setdescription,
+		  const char *const **register_names)
 {
   *setname = regnames[option].name;
   *setdescription = regnames[option].description;
@@ -614,11 +1580,46 @@ get_arm_regnames (option, setname, setdescription, register_names)
   return 16;
 }
 
+/* Decode a bitfield of the form matching regexp (N(-N)?,)*N(-N)?.
+   Returns pointer to following character of the format string and
+   fills in *VALUEP and *WIDTHP with the extracted value and number of
+   bits extracted.  WIDTHP can be NULL. */
+
+static const char *
+arm_decode_bitfield (const char *ptr, unsigned long insn,
+		     unsigned long *valuep, int *widthp)
+{
+  unsigned long value = 0;
+  int width = 0;
+
+  do
+    {
+      int start, end;
+      int bits;
+
+      for (start = 0; *ptr >= '0' && *ptr <= '9'; ptr++)
+	start = start * 10 + *ptr - '0';
+      if (*ptr == '-')
+	for (end = 0, ptr++; *ptr >= '0' && *ptr <= '9'; ptr++)
+	  end = end * 10 + *ptr - '0';
+      else
+	end = start;
+      bits = end - start;
+      if (bits < 0)
+	abort ();
+      value |= ((insn >> start) & ((2ul << bits) - 1)) << width;
+      width += bits + 1;
+    }
+  while (*ptr++ == ',');
+  *valuep = value;
+  if (widthp)
+    *widthp = width;
+  return ptr - 1;
+}
+
 static void
-arm_decode_shift (given, func, stream)
-     long given;
-     fprintf_ftype func;
-     void * stream;
+arm_decode_shift (long given, fprintf_ftype func, void *stream,
+		  int print_shift)
 {
   func (stream, "%s", arm_regnames[given & 0xf]);
 
@@ -640,32 +1641,75 @@ arm_decode_shift (given, func, stream)
 	      amount = 32;
 	    }
 
-	  func (stream, ", %s #%d", arm_shift[shift], amount);
+	  if (print_shift)
+	    func (stream, ", %s #%d", arm_shift[shift], amount);
+	  else
+	    func (stream, ", #%d", amount);
 	}
-      else
+      else if (print_shift)
 	func (stream, ", %s %s", arm_shift[(given & 0x60) >> 5],
 	      arm_regnames[(given & 0xf00) >> 8]);
+      else
+	func (stream, ", %s", arm_regnames[(given & 0xf00) >> 8]);
     }
 }
 
-/* Print one instruction from PC on INFO->STREAM.
-   Return the size of the instruction (always 4 on ARM). */
+/* Print one coprocessor instruction on INFO->STREAM.
+   Return TRUE if the instuction matched, FALSE if this is not a
+   recognised coprocessor instruction.  */
 
-static int
-print_insn_arm1 (pc, info, given)
-     bfd_vma                   pc;
-     struct disassemble_info * info;
-     long                      given;
+static bfd_boolean
+print_insn_coprocessor (bfd_vma pc, struct disassemble_info *info, long given,
+			bfd_boolean thumb)
 {
-  struct arm_opcode *  insn;
-  void *               stream = info->stream;
-  fprintf_ftype        func   = info->fprintf_func;
-
-  for (insn = arm_opcodes; insn->assembler; insn++)
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+  unsigned long mask;
+  unsigned long value;
+  int cond;
+
+  for (insn = coprocessor_opcodes; insn->assembler; insn++)
     {
-      if ((given & insn->mask) == insn->value)
+      if (insn->value == FIRST_IWMMXT_INSN
+	  && info->mach != bfd_mach_arm_XScale
+	  && info->mach != bfd_mach_arm_iWMMXt
+	  && info->mach != bfd_mach_arm_iWMMXt2)
+	insn = insn + IWMMXT_INSN_COUNT;
+
+      mask = insn->mask;
+      value = insn->value;
+      if (thumb)
 	{
-	  char * c;
+	  /* The high 4 bits are 0xe for Arm conditional instructions, and
+	     0xe for arm unconditional instructions.  The rest of the
+	     encoding is the same.  */
+	  mask |= 0xf0000000;
+	  value |= 0xe0000000;
+	  if (ifthen_state)
+	    cond = IFTHEN_COND;
+	  else
+	    cond = 16;
+	}
+      else
+	{
+	  /* Only match unconditional instuctions against unconditional
+	     patterns.  */
+	  if ((given & 0xf0000000) == 0xf0000000)
+	    {
+	      mask |= 0xf0000000;
+	      cond = 16;
+	    }
+	  else
+	    {
+	      cond = (given >> 28) & 0xf;
+	      if (cond == 0xe)
+		cond = 16;
+	    }
+	}
+      if ((given & mask) == value)
+	{
+	  const char *c;
 
 	  for (c = insn->assembler; *c; c++)
 	    {
@@ -677,89 +1721,1038 @@ print_insn_arm1 (pc, info, given)
 		      func (stream, "%%");
 		      break;
 
-		    case 'a':
-		      if (((given & 0x000f0000) == 0x000f0000)
-			  && ((given & 0x02000000) == 0))
+		    case 'A':
+		      func (stream, "[%s", arm_regnames [(given >> 16) & 0xf]);
+
+		      if ((given & (1 << 24)) != 0)
 			{
-			  int offset = given & 0xfff;
+			  int offset = given & 0xff;
+
+			  if (offset)
+			    func (stream, ", #%s%d]%s",
+				  ((given & 0x00800000) == 0 ? "-" : ""),
+				  offset * 4,
+				  ((given & 0x00200000) != 0 ? "!" : ""));
+			  else
+			    func (stream, "]");
+			}
+		      else
+			{
+			  int offset = given & 0xff;
 
-			  func (stream, "[pc");
+			  func (stream, "]");
 
-			  if (given & 0x01000000)
+			  if (given & (1 << 21))
 			    {
-			      if ((given & 0x00800000) == 0)
-				offset = - offset;
+			      if (offset)
+				func (stream, ", #%s%d",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * 4);
+			    }
+			  else
+			    func (stream, ", {%d}", offset);
+			}
+		      break;
 
-			      /* Pre-indexed.  */
-			      func (stream, ", #%d]", offset);
+		    case 'B':
+		      {
+			int regno = ((given >> 12) & 0xf) | ((given >> (22 - 4)) & 0x10);
+			int offset = (given >> 1) & 0x3f;
+
+			if (offset == 1)
+			  func (stream, "{d%d}", regno);
+			else if (regno + offset > 32)
+			  func (stream, "{d%d-<overflow reg d%d>}", regno, regno + offset - 1);
+			else
+			  func (stream, "{d%d-d%d}", regno, regno + offset - 1);
+		      }
+		      break;
 
-			      offset += pc + 8;
+		    case 'C':
+		      {
+			int rn = (given >> 16) & 0xf;
+			int offset = (given & 0xff) * 4;
+			int add = (given >> 23) & 1;
 
-			      /* Cope with the possibility of write-back
-				 being used.  Probably a very dangerous thing
-				 for the programmer to do, but who are we to
-				 argue ?  */
-			      if (given & 0x00200000)
-				func (stream, "!");
-			    }
-			  else
-			    {
-			      /* Post indexed.  */
-			      func (stream, "], #%d", offset);
+			func (stream, "[%s", arm_regnames[rn]);
 
-			      /* ie ignore the offset.  */
-			      offset = pc + 8;
-			    }
+			if (offset)
+			  {
+			    if (!add)
+			      offset = -offset;
+			    func (stream, ", #%d", offset);
+			  }
+			func (stream, "]");
+			if (rn == 15)
+			  {
+			    func (stream, "\t; ");
+                            /* FIXME: Unsure if info->bytes_per_chunk is the
+                               right thing to use here.  */
+			    info->print_address_func (offset + pc
+                              + info->bytes_per_chunk * 2, info);
+			  }
+		      }
+		      break;
+
+		    case 'c':
+		      func (stream, "%s", arm_conditional[cond]);
+		      break;
+
+		    case 'I':
+		      /* Print a Cirrus/DSP shift immediate.  */
+		      /* Immediates are 7bit signed ints with bits 0..3 in
+			 bits 0..3 of opcode and bits 4..6 in bits 5..7
+			 of opcode.  */
+		      {
+			int imm;
+
+			imm = (given & 0xf) | ((given & 0xe0) >> 1);
+
+			/* Is ``imm'' a negative number?  */
+			if (imm & 0x40)
+			  imm |= (-1 << 7);
 
-			  func (stream, "\t; ");
-			  info->print_address_func (offset, info);
+			func (stream, "%d", imm);
+		      }
+
+		      break;
+
+		    case 'F':
+		      switch (given & 0x00408000)
+			{
+			case 0:
+			  func (stream, "4");
+			  break;
+			case 0x8000:
+			  func (stream, "1");
+			  break;
+			case 0x00400000:
+			  func (stream, "2");
+			  break;
+			default:
+			  func (stream, "3");
 			}
-		      else
+		      break;
+
+		    case 'P':
+		      switch (given & 0x00080080)
 			{
-			  func (stream, "[%s",
-				arm_regnames[(given >> 16) & 0xf]);
-			  if ((given & 0x01000000) != 0)
+			case 0:
+			  func (stream, "s");
+			  break;
+			case 0x80:
+			  func (stream, "d");
+			  break;
+			case 0x00080000:
+			  func (stream, "e");
+			  break;
+			default:
+			  func (stream, _("<illegal precision>"));
+			  break;
+			}
+		      break;
+		    case 'Q':
+		      switch (given & 0x00408000)
+			{
+			case 0:
+			  func (stream, "s");
+			  break;
+			case 0x8000:
+			  func (stream, "d");
+			  break;
+			case 0x00400000:
+			  func (stream, "e");
+			  break;
+			default:
+			  func (stream, "p");
+			  break;
+			}
+		      break;
+		    case 'R':
+		      switch (given & 0x60)
+			{
+			case 0:
+			  break;
+			case 0x20:
+			  func (stream, "p");
+			  break;
+			case 0x40:
+			  func (stream, "m");
+			  break;
+			default:
+			  func (stream, "z");
+			  break;
+			}
+		      break;
+
+		    case '0': case '1': case '2': case '3': case '4':
+		    case '5': case '6': case '7': case '8': case '9':
+		      {
+			int width;
+			unsigned long value;
+
+			c = arm_decode_bitfield (c, given, &value, &width);
+
+			switch (*c)
+			  {
+			  case 'r':
+			    func (stream, "%s", arm_regnames[value]);
+			    break;
+			  case 'D':
+			    func (stream, "d%ld", value);
+			    break;
+			  case 'Q':
+			    if (value & 1)
+			      func (stream, "<illegal reg q%ld.5>", value >> 1);
+			    else
+			      func (stream, "q%ld", value >> 1);
+			    break;
+			  case 'd':
+			    func (stream, "%ld", value);
+			    break;
+                          case 'k':
+                            {
+                              int from = (given & (1 << 7)) ? 32 : 16;
+                              func (stream, "%ld", from - value);
+                            }
+                            break;
+
+			  case 'f':
+			    if (value > 7)
+			      func (stream, "#%s", arm_fp_const[value & 7]);
+			    else
+			      func (stream, "f%ld", value);
+			    break;
+
+			  case 'w':
+			    if (width == 2)
+			      func (stream, "%s", iwmmxt_wwnames[value]);
+			    else
+			      func (stream, "%s", iwmmxt_wwssnames[value]);
+			    break;
+
+			  case 'g':
+			    func (stream, "%s", iwmmxt_regnames[value]);
+			    break;
+			  case 'G':
+			    func (stream, "%s", iwmmxt_cregnames[value]);
+			    break;
+
+			  case 'x':
+			    func (stream, "0x%lx", value);
+			    break;
+
+			  case '`':
+			    c++;
+			    if (value == 0)
+			      func (stream, "%c", *c);
+			    break;
+			  case '\'':
+			    c++;
+			    if (value == ((1ul << width) - 1))
+			      func (stream, "%c", *c);
+			    break;
+			  case '?':
+			    func (stream, "%c", c[(1 << width) - (int)value]);
+			    c += 1 << width;
+			    break;
+			  default:
+			    abort ();
+			  }
+			break;
+
+		      case 'y':
+		      case 'z':
+			{
+			  int single = *c++ == 'y';
+			  int regno;
+
+			  switch (*c)
 			    {
-			      if ((given & 0x02000000) == 0)
+			    case '4': /* Sm pair */
+			      func (stream, "{");
+			      /* Fall through.  */
+			    case '0': /* Sm, Dm */
+			      regno = given & 0x0000000f;
+			      if (single)
 				{
-				  int offset = given & 0xfff;
-				  if (offset)
-				    func (stream, ", %s#%d",
-					  (((given & 0x00800000) == 0)
-					   ? "-" : ""), offset);
+				  regno <<= 1;
+				  regno += (given >> 5) & 1;
 				}
-			      else
+                              else
+                                regno += ((given >> 5) & 1) << 4;
+			      break;
+
+			    case '1': /* Sd, Dd */
+			      regno = (given >> 12) & 0x0000000f;
+			      if (single)
 				{
-				  func (stream, ", %s",
-					(((given & 0x00800000) == 0)
-					 ? "-" : ""));
-				  arm_decode_shift (given, func, stream);
+				  regno <<= 1;
+				  regno += (given >> 22) & 1;
+				}
+                              else
+                                regno += ((given >> 22) & 1) << 4;
+			      break;
+
+			    case '2': /* Sn, Dn */
+			      regno = (given >> 16) & 0x0000000f;
+			      if (single)
+				{
+				  regno <<= 1;
+				  regno += (given >> 7) & 1;
 				}
+                              else
+                                regno += ((given >> 7) & 1) << 4;
+			      break;
 
-			      func (stream, "]%s",
-				    ((given & 0x00200000) != 0) ? "!" : "");
+			    case '3': /* List */
+			      func (stream, "{");
+			      regno = (given >> 12) & 0x0000000f;
+			      if (single)
+				{
+				  regno <<= 1;
+				  regno += (given >> 22) & 1;
+				}
+                              else
+                                regno += ((given >> 22) & 1) << 4;
+			      break;
+
+			    default:
+			      abort ();
 			    }
-			  else
+
+			  func (stream, "%c%d", single ? 's' : 'd', regno);
+
+			  if (*c == '3')
 			    {
-			      if ((given & 0x02000000) == 0)
+			      int count = given & 0xff;
+
+			      if (single == 0)
+				count >>= 1;
+
+			      if (--count)
 				{
-				  int offset = given & 0xfff;
-				  if (offset)
-				    func (stream, "], %s#%d",
-					  (((given & 0x00800000) == 0)
-					   ? "-" : ""), offset);
-				  else
-				    func (stream, "]");
+				  func (stream, "-%c%d",
+					single ? 's' : 'd',
+					regno + count);
 				}
+
+			      func (stream, "}");
+			    }
+			  else if (*c == '4')
+			    func (stream, ", %c%d}", single ? 's' : 'd',
+				  regno + 1);
+			}
+			break;
+
+		      case 'L':
+			switch (given & 0x00400100)
+			  {
+			  case 0x00000000: func (stream, "b"); break;
+			  case 0x00400000: func (stream, "h"); break;
+			  case 0x00000100: func (stream, "w"); break;
+			  case 0x00400100: func (stream, "d"); break;
+			  default:
+			    break;
+			  }
+			break;
+
+		      case 'Z':
+			{
+			  int value;
+			  /* given (20, 23) | given (0, 3) */
+			  value = ((given >> 16) & 0xf0) | (given & 0xf);
+			  func (stream, "%d", value);
+			}
+			break;
+
+		      case 'l':
+			/* This is like the 'A' operator, except that if
+			   the width field "M" is zero, then the offset is
+			   *not* multiplied by four.  */
+			{
+			  int offset = given & 0xff;
+			  int multiplier = (given & 0x00000100) ? 4 : 1;
+
+			  func (stream, "[%s", arm_regnames [(given >> 16) & 0xf]);
+
+			  if (offset)
+			    {
+			      if ((given & 0x01000000) != 0)
+				func (stream, ", #%s%d]%s",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * multiplier,
+				      ((given & 0x00200000) != 0 ? "!" : ""));
 			      else
-				{
-				  func (stream, "], %s",
-					(((given & 0x00800000) == 0)
-					 ? "-" : ""));
-				  arm_decode_shift (given, func, stream);
-				}
+				func (stream, "], #%s%d",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * multiplier);
 			    }
+			  else
+			    func (stream, "]");
 			}
+			break;
+
+		      case 'r':
+			{
+			  int imm4 = (given >> 4) & 0xf;
+			  int puw_bits = ((given >> 22) & 6) | ((given >> 21) & 1);
+			  int ubit = (given >> 23) & 1;
+			  const char *rm = arm_regnames [given & 0xf];
+			  const char *rn = arm_regnames [(given >> 16) & 0xf];
+
+			  switch (puw_bits)
+			    {
+			    case 1:
+			      /* fall through */
+			    case 3:
+			      func (stream, "[%s], %c%s", rn, ubit ? '+' : '-', rm);
+			      if (imm4)
+				func (stream, ", lsl #%d", imm4);
+			      break;
+
+			    case 4:
+			      /* fall through */
+			    case 5:
+			      /* fall through */
+			    case 6:
+			      /* fall through */
+			    case 7:
+			      func (stream, "[%s, %c%s", rn, ubit ? '+' : '-', rm);
+			      if (imm4 > 0)
+				func (stream, ", lsl #%d", imm4);
+			      func (stream, "]");
+			      if (puw_bits == 5 || puw_bits == 7)
+				func (stream, "!");
+			      break;
+
+			    default:
+			      func (stream, "INVALID");
+			    }
+			}
+			break;
+
+		      case 'i':
+			{
+			  long imm5;
+			  imm5 = ((given & 0x100) >> 4) | (given & 0xf);
+			  func (stream, "%ld", (imm5 == 0) ? 32 : imm5);
+			}
+			break;
+
+		      default:
+			abort ();
+		      }
+		    }
+		}
+	      else
+		func (stream, "%c", *c);
+	    }
+	  return TRUE;
+	}
+    }
+  return FALSE;
+}
+
+static void
+print_arm_address (bfd_vma pc, struct disassemble_info *info, long given)
+{
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+
+  if (((given & 0x000f0000) == 0x000f0000)
+      && ((given & 0x02000000) == 0))
+    {
+      int offset = given & 0xfff;
+
+      func (stream, "[pc");
+
+      if (given & 0x01000000)
+	{
+	  if ((given & 0x00800000) == 0)
+	    offset = - offset;
+
+	  /* Pre-indexed.  */
+	  func (stream, ", #%d]", offset);
+
+	  offset += pc + 8;
+
+	  /* Cope with the possibility of write-back
+	     being used.  Probably a very dangerous thing
+	     for the programmer to do, but who are we to
+	     argue ?  */
+	  if (given & 0x00200000)
+	    func (stream, "!");
+	}
+      else
+	{
+	  /* Post indexed.  */
+	  func (stream, "], #%d", offset);
+
+	  /* ie ignore the offset.  */
+	  offset = pc + 8;
+	}
+
+      func (stream, "\t; ");
+      info->print_address_func (offset, info);
+    }
+  else
+    {
+      func (stream, "[%s",
+	    arm_regnames[(given >> 16) & 0xf]);
+      if ((given & 0x01000000) != 0)
+	{
+	  if ((given & 0x02000000) == 0)
+	    {
+	      int offset = given & 0xfff;
+	      if (offset)
+		func (stream, ", #%s%d",
+		      (((given & 0x00800000) == 0)
+		       ? "-" : ""), offset);
+	    }
+	  else
+	    {
+	      func (stream, ", %s",
+		    (((given & 0x00800000) == 0)
+		     ? "-" : ""));
+	      arm_decode_shift (given, func, stream, 1);
+	    }
+
+	  func (stream, "]%s",
+		((given & 0x00200000) != 0) ? "!" : "");
+	}
+      else
+	{
+	  if ((given & 0x02000000) == 0)
+	    {
+	      int offset = given & 0xfff;
+	      if (offset)
+		func (stream, "], #%s%d",
+		      (((given & 0x00800000) == 0)
+		       ? "-" : ""), offset);
+	      else
+		func (stream, "]");
+	    }
+	  else
+	    {
+	      func (stream, "], %s",
+		    (((given & 0x00800000) == 0)
+		     ? "-" : ""));
+	      arm_decode_shift (given, func, stream, 1);
+	    }
+	}
+    }
+}
+
+/* Print one neon instruction on INFO->STREAM.
+   Return TRUE if the instuction matched, FALSE if this is not a
+   recognised neon instruction.  */
+
+static bfd_boolean
+print_insn_neon (struct disassemble_info *info, long given, bfd_boolean thumb)
+{
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+
+  if (thumb)
+    {
+      if ((given & 0xef000000) == 0xef000000)
+	{
+	  /* move bit 28 to bit 24 to translate Thumb2 to ARM encoding.  */
+	  unsigned long bit28 = given & (1 << 28);
+
+	  given &= 0x00ffffff;
+	  if (bit28)
+            given |= 0xf3000000;
+          else
+	    given |= 0xf2000000;
+	}
+      else if ((given & 0xff000000) == 0xf9000000)
+	given ^= 0xf9000000 ^ 0xf4000000;
+      else
+	return FALSE;
+    }
+
+  for (insn = neon_opcodes; insn->assembler; insn++)
+    {
+      if ((given & insn->mask) == insn->value)
+	{
+	  const char *c;
+
+	  for (c = insn->assembler; *c; c++)
+	    {
+	      if (*c == '%')
+		{
+		  switch (*++c)
+		    {
+		    case '%':
+		      func (stream, "%%");
+		      break;
+
+		    case 'c':
+		      if (thumb && ifthen_state)
+			func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		      break;
+
+		    case 'A':
+		      {
+			static const unsigned char enc[16] =
+			{
+			  0x4, 0x14, /* st4 0,1 */
+			  0x4, /* st1 2 */
+			  0x4, /* st2 3 */
+			  0x3, /* st3 4 */
+			  0x13, /* st3 5 */
+			  0x3, /* st1 6 */
+			  0x1, /* st1 7 */
+			  0x2, /* st2 8 */
+			  0x12, /* st2 9 */
+			  0x2, /* st1 10 */
+			  0, 0, 0, 0, 0
+			};
+			int rd = ((given >> 12) & 0xf) | (((given >> 22) & 1) << 4);
+			int rn = ((given >> 16) & 0xf);
+			int rm = ((given >> 0) & 0xf);
+			int align = ((given >> 4) & 0x3);
+			int type = ((given >> 8) & 0xf);
+			int n = enc[type] & 0xf;
+			int stride = (enc[type] >> 4) + 1;
+			int ix;
+
+			func (stream, "{");
+			if (stride > 1)
+			  for (ix = 0; ix != n; ix++)
+			    func (stream, "%sd%d", ix ? "," : "", rd + ix * stride);
+			else if (n == 1)
+			  func (stream, "d%d", rd);
+			else
+			  func (stream, "d%d-d%d", rd, rd + n - 1);
+			func (stream, "}, [%s", arm_regnames[rn]);
+			if (align)
+			  func (stream, ", :%d", 32 << align);
+			func (stream, "]");
+			if (rm == 0xd)
+			  func (stream, "!");
+			else if (rm != 0xf)
+			  func (stream, ", %s", arm_regnames[rm]);
+		      }
+		      break;
+
+		    case 'B':
+		      {
+			int rd = ((given >> 12) & 0xf) | (((given >> 22) & 1) << 4);
+			int rn = ((given >> 16) & 0xf);
+			int rm = ((given >> 0) & 0xf);
+			int idx_align = ((given >> 4) & 0xf);
+                        int align = 0;
+			int size = ((given >> 10) & 0x3);
+			int idx = idx_align >> (size + 1);
+                        int length = ((given >> 8) & 3) + 1;
+                        int stride = 1;
+                        int i;
+
+                        if (length > 1 && size > 0)
+                          stride = (idx_align & (1 << size)) ? 2 : 1;
+
+                        switch (length)
+                          {
+                          case 1:
+                            {
+                              int amask = (1 << size) - 1;
+                              if ((idx_align & (1 << size)) != 0)
+                                return FALSE;
+                              if (size > 0)
+                                {
+                                  if ((idx_align & amask) == amask)
+                                    align = 8 << size;
+                                  else if ((idx_align & amask) != 0)
+                                    return FALSE;
+                                }
+                              }
+                            break;
+
+                          case 2:
+                            if (size == 2 && (idx_align & 2) != 0)
+                              return FALSE;
+                            align = (idx_align & 1) ? 16 << size : 0;
+                            break;
+
+                          case 3:
+                            if ((size == 2 && (idx_align & 3) != 0)
+                                || (idx_align & 1) != 0)
+                              return FALSE;
+                            break;
+
+                          case 4:
+                            if (size == 2)
+                              {
+                                if ((idx_align & 3) == 3)
+                                  return FALSE;
+                                align = (idx_align & 3) * 64;
+                              }
+                            else
+                              align = (idx_align & 1) ? 32 << size : 0;
+                            break;
+
+                          default:
+                            abort ();
+                          }
+
+			func (stream, "{");
+                        for (i = 0; i < length; i++)
+                          func (stream, "%sd%d[%d]", (i == 0) ? "" : ",",
+                            rd + i * stride, idx);
+                        func (stream, "}, [%s", arm_regnames[rn]);
+			if (align)
+			  func (stream, ", :%d", align);
+			func (stream, "]");
+			if (rm == 0xd)
+			  func (stream, "!");
+			else if (rm != 0xf)
+			  func (stream, ", %s", arm_regnames[rm]);
+		      }
+		      break;
+
+		    case 'C':
+		      {
+			int rd = ((given >> 12) & 0xf) | (((given >> 22) & 1) << 4);
+			int rn = ((given >> 16) & 0xf);
+			int rm = ((given >> 0) & 0xf);
+			int align = ((given >> 4) & 0x1);
+			int size = ((given >> 6) & 0x3);
+			int type = ((given >> 8) & 0x3);
+			int n = type + 1;
+			int stride = ((given >> 5) & 0x1);
+			int ix;
+
+			if (stride && (n == 1))
+			  n++;
+			else
+			  stride++;
+
+			func (stream, "{");
+			if (stride > 1)
+			  for (ix = 0; ix != n; ix++)
+			    func (stream, "%sd%d[]", ix ? "," : "", rd + ix * stride);
+			else if (n == 1)
+			  func (stream, "d%d[]", rd);
+			else
+			  func (stream, "d%d[]-d%d[]", rd, rd + n - 1);
+			func (stream, "}, [%s", arm_regnames[rn]);
+			if (align)
+			  {
+                            int align = (8 * (type + 1)) << size;
+                            if (type == 3)
+                              align = (size > 1) ? align >> 1 : align;
+			    if (type == 2 || (type == 0 && !size))
+			      func (stream, ", :<bad align %d>", align);
+			    else
+			      func (stream, ", :%d", align);
+			  }
+			func (stream, "]");
+			if (rm == 0xd)
+			  func (stream, "!");
+			else if (rm != 0xf)
+			  func (stream, ", %s", arm_regnames[rm]);
+		      }
+		      break;
+
+		    case 'D':
+		      {
+			int raw_reg = (given & 0xf) | ((given >> 1) & 0x10);
+			int size = (given >> 20) & 3;
+			int reg = raw_reg & ((4 << size) - 1);
+			int ix = raw_reg >> size >> 2;
+
+			func (stream, "d%d[%d]", reg, ix);
+		      }
+		      break;
+
+		    case 'E':
+		      /* Neon encoded constant for mov, mvn, vorr, vbic */
+		      {
+			int bits = 0;
+			int cmode = (given >> 8) & 0xf;
+			int op = (given >> 5) & 0x1;
+			unsigned long value = 0, hival = 0;
+			unsigned shift;
+                        int size = 0;
+                        int isfloat = 0;
+
+			bits |= ((given >> 24) & 1) << 7;
+			bits |= ((given >> 16) & 7) << 4;
+			bits |= ((given >> 0) & 15) << 0;
+
+			if (cmode < 8)
+			  {
+			    shift = (cmode >> 1) & 3;
+			    value = (unsigned long)bits << (8 * shift);
+                            size = 32;
+			  }
+			else if (cmode < 12)
+			  {
+			    shift = (cmode >> 1) & 1;
+			    value = (unsigned long)bits << (8 * shift);
+                            size = 16;
+			  }
+			else if (cmode < 14)
+			  {
+			    shift = (cmode & 1) + 1;
+			    value = (unsigned long)bits << (8 * shift);
+			    value |= (1ul << (8 * shift)) - 1;
+                            size = 32;
+			  }
+			else if (cmode == 14)
+			  {
+			    if (op)
+			      {
+				/* bit replication into bytes */
+				int ix;
+				unsigned long mask;
+
+				value = 0;
+                                hival = 0;
+				for (ix = 7; ix >= 0; ix--)
+				  {
+				    mask = ((bits >> ix) & 1) ? 0xff : 0;
+                                    if (ix <= 3)
+				      value = (value << 8) | mask;
+                                    else
+                                      hival = (hival << 8) | mask;
+				  }
+                                size = 64;
+			      }
+                            else
+                              {
+                                /* byte replication */
+                                value = (unsigned long)bits;
+                                size = 8;
+                              }
+			  }
+			else if (!op)
+			  {
+			    /* floating point encoding */
+			    int tmp;
+
+			    value = (unsigned long)(bits & 0x7f) << 19;
+			    value |= (unsigned long)(bits & 0x80) << 24;
+			    tmp = bits & 0x40 ? 0x3c : 0x40;
+			    value |= (unsigned long)tmp << 24;
+                            size = 32;
+                            isfloat = 1;
+			  }
+			else
+			  {
+			    func (stream, "<illegal constant %.8x:%x:%x>",
+                                  bits, cmode, op);
+                            size = 32;
+			    break;
+			  }
+                        switch (size)
+                          {
+                          case 8:
+			    func (stream, "#%ld\t; 0x%.2lx", value, value);
+                            break;
+
+                          case 16:
+                            func (stream, "#%ld\t; 0x%.4lx", value, value);
+                            break;
+
+                          case 32:
+                            if (isfloat)
+                              {
+                                unsigned char valbytes[4];
+                                double fvalue;
+
+                                /* Do this a byte at a time so we don't have to
+                                   worry about the host's endianness.  */
+                                valbytes[0] = value & 0xff;
+                                valbytes[1] = (value >> 8) & 0xff;
+                                valbytes[2] = (value >> 16) & 0xff;
+                                valbytes[3] = (value >> 24) & 0xff;
+
+                                floatformat_to_double
+                                  (&floatformat_ieee_single_little, valbytes,
+                                  &fvalue);
+
+                                func (stream, "#%.7g\t; 0x%.8lx", fvalue,
+                                      value);
+                              }
+                            else
+                              func (stream, "#%ld\t; 0x%.8lx",
+				(long) ((value & 0x80000000)
+					? value | ~0xffffffffl : value), value);
+                            break;
+
+                          case 64:
+                            func (stream, "#0x%.8lx%.8lx", hival, value);
+                            break;
+
+                          default:
+                            abort ();
+                          }
+		      }
+		      break;
+
+		    case 'F':
+		      {
+			int regno = ((given >> 16) & 0xf) | ((given >> (7 - 4)) & 0x10);
+			int num = (given >> 8) & 0x3;
+
+			if (!num)
+			  func (stream, "{d%d}", regno);
+			else if (num + regno >= 32)
+			  func (stream, "{d%d-<overflow reg d%d}", regno, regno + num);
+			else
+			  func (stream, "{d%d-d%d}", regno, regno + num);
+		      }
+		      break;
+
+
+		    case '0': case '1': case '2': case '3': case '4':
+		    case '5': case '6': case '7': case '8': case '9':
+		      {
+			int width;
+			unsigned long value;
+
+			c = arm_decode_bitfield (c, given, &value, &width);
+
+			switch (*c)
+			  {
+			  case 'r':
+			    func (stream, "%s", arm_regnames[value]);
+			    break;
+			  case 'd':
+			    func (stream, "%ld", value);
+			    break;
+			  case 'e':
+			    func (stream, "%ld", (1ul << width) - value);
+			    break;
+
+			  case 'S':
+			  case 'T':
+			  case 'U':
+			    /* various width encodings */
+			    {
+			      int base = 8 << (*c - 'S'); /* 8,16 or 32 */
+			      int limit;
+			      unsigned low, high;
+
+			      c++;
+			      if (*c >= '0' && *c <= '9')
+				limit = *c - '0';
+			      else if (*c >= 'a' && *c <= 'f')
+				limit = *c - 'a' + 10;
+			      else
+				abort ();
+			      low = limit >> 2;
+			      high = limit & 3;
+
+			      if (value < low || value > high)
+				func (stream, "<illegal width %d>", base << value);
+			      else
+				func (stream, "%d", base << value);
+			    }
+			    break;
+			  case 'R':
+			    if (given & (1 << 6))
+			      goto Q;
+			    /* FALLTHROUGH */
+			  case 'D':
+			    func (stream, "d%ld", value);
+			    break;
+			  case 'Q':
+			  Q:
+			    if (value & 1)
+			      func (stream, "<illegal reg q%ld.5>", value >> 1);
+			    else
+			      func (stream, "q%ld", value >> 1);
+			    break;
+
+			  case '`':
+			    c++;
+			    if (value == 0)
+			      func (stream, "%c", *c);
+			    break;
+			  case '\'':
+			    c++;
+			    if (value == ((1ul << width) - 1))
+			      func (stream, "%c", *c);
+			    break;
+			  case '?':
+			    func (stream, "%c", c[(1 << width) - (int)value]);
+			    c += 1 << width;
+			    break;
+			  default:
+			    abort ();
+			  }
+			break;
+
+		      default:
+			abort ();
+		      }
+		    }
+		}
+	      else
+		func (stream, "%c", *c);
+	    }
+	  return TRUE;
+	}
+    }
+  return FALSE;
+}
+
+/* Print one ARM instruction from PC on INFO->STREAM.  */
+
+static void
+print_insn_arm_internal (bfd_vma pc, struct disassemble_info *info, long given)
+{
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+
+  if (print_insn_coprocessor (pc, info, given, FALSE))
+    return;
+
+  if (print_insn_neon (info, given, FALSE))
+    return;
+
+  for (insn = arm_opcodes; insn->assembler; insn++)
+    {
+      if (insn->value == FIRST_IWMMXT_INSN
+	  && info->mach != bfd_mach_arm_XScale
+	  && info->mach != bfd_mach_arm_iWMMXt)
+	insn = insn + IWMMXT_INSN_COUNT;
+
+      if ((given & insn->mask) == insn->value
+	  /* Special case: an instruction with all bits set in the condition field
+	     (0xFnnn_nnnn) is only matched if all those bits are set in insn->mask,
+	     or by the catchall at the end of the table.  */
+	  && ((given & 0xF0000000) != 0xF0000000
+	      || (insn->mask & 0xF0000000) == 0xF0000000
+	      || (insn->mask == 0 && insn->value == 0)))
+	{
+	  const char *c;
+
+	  for (c = insn->assembler; *c; c++)
+	    {
+	      if (*c == '%')
+		{
+		  switch (*++c)
+		    {
+		    case '%':
+		      func (stream, "%%");
+		      break;
+
+		    case 'a':
+		      print_arm_address (pc, info, given);
+		      break;
+
+		    case 'P':
+		      /* Set P address bit and use normal address
+			 printing routine.  */
+		      print_arm_address (pc, info, given | (1 << 24));
 		      break;
 
 		    case 's':
@@ -772,9 +2765,7 @@ print_insn_arm1 (pc, info, given)
 			    offset = -offset;
 
 			  func (stream, "[pc, #%d]\t; ", offset);
-
-			  (*info->print_address_func)
-			    (offset + pc + 8, info);
+			  info->print_address_func (offset + pc + 8, info);
 			}
 		      else
 			{
@@ -788,7 +2779,7 @@ print_insn_arm1 (pc, info, given)
                                   /* Immediate.  */
                                   int offset = ((given & 0xf00) >> 4) | (given & 0xf);
 				  if (offset)
-				    func (stream, ", %s#%d",
+				    func (stream, ", #%s%d",
 					  (((given & 0x00800000) == 0)
 					   ? "-" : ""), offset);
 				}
@@ -812,7 +2803,7 @@ print_insn_arm1 (pc, info, given)
                                   /* Immediate.  */
                                   int offset = ((given & 0xf00) >> 4) | (given & 0xf);
 				  if (offset)
-				    func (stream, "], %s#%d",
+				    func (stream, "], #%s%d",
 					  (((given & 0x00800000) == 0)
 					   ? "-" : ""), offset);
 				  else
@@ -831,13 +2822,16 @@ print_insn_arm1 (pc, info, given)
 		      break;
 
 		    case 'b':
-		      (*info->print_address_func)
-			(BDISP (given) * 4 + pc + 8, info);
+		      {
+			int disp = (((given & 0xffffff) ^ 0x800000) - 0x800000);
+			info->print_address_func (disp*4 + pc + 8, info);
+		      }
 		      break;
 
 		    case 'c':
-		      func (stream, "%s",
-			    arm_conditional [(given >> 28) & 0xf]);
+		      if (((given >> 28) & 0xf) != 0xe)
+			func (stream, "%s",
+			      arm_conditional [(given >> 28) & 0xf]);
 		      break;
 
 		    case 'm':
@@ -858,6 +2852,10 @@ print_insn_arm1 (pc, info, given)
 		      }
 		      break;
 
+		    case 'q':
+		      arm_decode_shift (given, func, stream, 0);
+		      break;
+
 		    case 'o':
 		      if ((given & 0x02000000) != 0)
 			{
@@ -868,7 +2866,7 @@ print_insn_arm1 (pc, info, given)
 			  func (stream, "#%d\t; 0x%x", immed, immed);
 			}
 		      else
-			arm_decode_shift (given, func, stream);
+			arm_decode_shift (given, func, stream, 1);
 		      break;
 
 		    case 'p':
@@ -883,11 +2881,13 @@ print_insn_arm1 (pc, info, given)
 
 		    case 'A':
 		      func (stream, "[%s", arm_regnames [(given >> 16) & 0xf]);
-		      if ((given & 0x01000000) != 0)
+
+		      if ((given & (1 << 24)) != 0)
 			{
 			  int offset = given & 0xff;
+
 			  if (offset)
-			    func (stream, ", %s#%d]%s",
+			    func (stream, ", #%s%d]%s",
 				  ((given & 0x00800000) == 0 ? "-" : ""),
 				  offset * 4,
 				  ((given & 0x00200000) != 0 ? "!" : ""));
@@ -897,12 +2897,18 @@ print_insn_arm1 (pc, info, given)
 		      else
 			{
 			  int offset = given & 0xff;
-			  if (offset)
-			    func (stream, "], %s#%d",
-				  ((given & 0x00800000) == 0 ? "-" : ""),
-				  offset * 4);
+
+			  func (stream, "]");
+
+			  if (given & (1 << 21))
+			    {
+			      if (offset)
+				func (stream, ", #%s%d",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * 4);
+			    }
 			  else
-			    func (stream, "]");
+			    func (stream, ", {%d}", offset);
 			}
 		      break;
 
@@ -929,25 +2935,6 @@ print_insn_arm1 (pc, info, given)
 		      }
 		      break;
 
-		    case 'I':
-		      /* Print a Cirrus/DSP shift immediate.  */
-		      /* Immediates are 7bit signed ints with bits 0..3 in
-			 bits 0..3 of opcode and bits 4..6 in bits 5..7
-			 of opcode.  */
-		      {
-			int imm;
-
-			imm = (given & 0xf) | ((given & 0xe0) >> 1);
-
-			/* Is ``imm'' a negative number?  */
-			if (imm & 0x40)
-			  imm |= (-1 << 7);
-
-			func (stream, "%d", imm);
-		      }
-
-		      break;
-
 		    case 'C':
 		      func (stream, "_");
 		      if (given & 0x80000)
@@ -960,70 +2947,15 @@ print_insn_arm1 (pc, info, given)
 			func (stream, "c");
 		      break;
 
-		    case 'F':
-		      switch (given & 0x00408000)
+		    case 'U':
+		      switch (given & 0xf)
 			{
-			case 0:
-			  func (stream, "4");
-			  break;
-			case 0x8000:
-			  func (stream, "1");
-			  break;
-			case 0x00400000:
-			  func (stream, "2");
-			  break;
+			case 0xf: func(stream, "sy"); break;
+			case 0x7: func(stream, "un"); break;
+			case 0xe: func(stream, "st"); break;
+			case 0x6: func(stream, "unst"); break;
 			default:
-			  func (stream, "3");
-			}
-		      break;
-
-		    case 'P':
-		      switch (given & 0x00080080)
-			{
-			case 0:
-			  func (stream, "s");
-			  break;
-			case 0x80:
-			  func (stream, "d");
-			  break;
-			case 0x00080000:
-			  func (stream, "e");
-			  break;
-			default:
-			  func (stream, _("<illegal precision>"));
-			  break;
-			}
-		      break;
-		    case 'Q':
-		      switch (given & 0x00408000)
-			{
-			case 0:
-			  func (stream, "s");
-			  break;
-			case 0x8000:
-			  func (stream, "d");
-			  break;
-			case 0x00400000:
-			  func (stream, "e");
-			  break;
-			default:
-			  func (stream, "p");
-			  break;
-			}
-		      break;
-		    case 'R':
-		      switch (given & 0x60)
-			{
-			case 0:
-			  break;
-			case 0x20:
-			  func (stream, "p");
-			  break;
-			case 0x40:
-			  func (stream, "m");
-			  break;
-			default:
-			  func (stream, "z");
+			  func(stream, "#%d", (int)given & 0xf);
 			  break;
 			}
 		      break;
@@ -1031,521 +2963,953 @@ print_insn_arm1 (pc, info, given)
 		    case '0': case '1': case '2': case '3': case '4':
 		    case '5': case '6': case '7': case '8': case '9':
 		      {
-			int bitstart = *c++ - '0';
-			int bitend = 0;
-			while (*c >= '0' && *c <= '9')
-			  bitstart = (bitstart * 10) + *c++ - '0';
+			int width;
+			unsigned long value;
+
+			c = arm_decode_bitfield (c, given, &value, &width);
 
 			switch (*c)
 			  {
-			  case '-':
+			  case 'r':
+			    func (stream, "%s", arm_regnames[value]);
+			    break;
+			  case 'd':
+			    func (stream, "%ld", value);
+			    break;
+			  case 'b':
+			    func (stream, "%ld", value * 8);
+			    break;
+			  case 'W':
+			    func (stream, "%ld", value + 1);
+			    break;
+			  case 'x':
+			    func (stream, "0x%08lx", value);
+
+			    /* Some SWI instructions have special
+			       meanings.  */
+			    if ((given & 0x0fffffff) == 0x0FF00000)
+			      func (stream, "\t; IMB");
+			    else if ((given & 0x0fffffff) == 0x0FF00001)
+			      func (stream, "\t; IMBRange");
+			    break;
+			  case 'X':
+			    func (stream, "%01lx", value & 0xf);
+			    break;
+			  case '`':
+			    c++;
+			    if (value == 0)
+			      func (stream, "%c", *c);
+			    break;
+			  case '\'':
 			    c++;
+			    if (value == ((1ul << width) - 1))
+			      func (stream, "%c", *c);
+			    break;
+			  case '?':
+			    func (stream, "%c", c[(1 << width) - (int)value]);
+			    c += 1 << width;
+			    break;
+			  default:
+			    abort ();
+			  }
+			break;
 
-			    while (*c >= '0' && *c <= '9')
-			      bitend = (bitend * 10) + *c++ - '0';
+		      case 'e':
+			{
+			  int imm;
 
-			    if (!bitend)
-			      abort ();
+			  imm = (given & 0xf) | ((given & 0xfff00) >> 4);
+			  func (stream, "%d", imm);
+			}
+			break;
 
-			    switch (*c)
-			      {
-			      case 'r':
-				{
-				  long reg;
+		      case 'E':
+			/* LSB and WIDTH fields of BFI or BFC.  The machine-
+			   language instruction encodes LSB and MSB.  */
+			{
+			  long msb = (given & 0x001f0000) >> 16;
+			  long lsb = (given & 0x00000f80) >> 7;
 
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
+			  long width = msb - lsb + 1;
+			  if (width > 0)
+			    func (stream, "#%lu, #%lu", lsb, width);
+			  else
+			    func (stream, "(invalid: %lu:%lu)", lsb, msb);
+			}
+			break;
 
-				  func (stream, "%s", arm_regnames[reg]);
-				}
-				break;
-			      case 'd':
-				{
-				  long reg;
+		      case 'V':
+			/* 16-bit unsigned immediate from a MOVT or MOVW
+			   instruction, encoded in bits 0:11 and 15:19.  */
+			{
+			  long hi = (given & 0x000f0000) >> 4;
+			  long lo = (given & 0x00000fff);
+			  long imm16 = hi | lo;
+			  func (stream, "#%lu\t; 0x%lx", imm16, imm16);
+			}
+			break;
 
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
+		      default:
+			abort ();
+		      }
+		    }
+		}
+	      else
+		func (stream, "%c", *c);
+	    }
+	  return;
+	}
+    }
+  abort ();
+}
 
-				  func (stream, "%d", reg);
-				}
-				break;
-			      case 'x':
-				{
-				  long reg;
+/* Print one 16-bit Thumb instruction from PC on INFO->STREAM.  */
 
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
+static void
+print_insn_thumb16 (bfd_vma pc, struct disassemble_info *info, long given)
+{
+  const struct opcode16 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
 
-				  func (stream, "0x%08x", reg);
+  for (insn = thumb_opcodes; insn->assembler; insn++)
+    if ((given & insn->mask) == insn->value)
+      {
+	const char *c = insn->assembler;
+	for (; *c; c++)
+	  {
+	    int domaskpc = 0;
+	    int domasklr = 0;
 
-				  /* Some SWI instructions have special
-				     meanings.  */
-				  if ((given & 0x0fffffff) == 0x0FF00000)
-				    func (stream, "\t; IMB");
-				  else if ((given & 0x0fffffff) == 0x0FF00001)
-				    func (stream, "\t; IMBRange");
-				}
-				break;
-			      case 'X':
-				{
-				  long reg;
+	    if (*c != '%')
+	      {
+		func (stream, "%c", *c);
+		continue;
+	      }
+
+	    switch (*++c)
+	      {
+	      case '%':
+		func (stream, "%%");
+		break;
+
+	      case 'c':
+		if (ifthen_state)
+		  func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		break;
+
+	      case 'C':
+		if (ifthen_state)
+		  func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		else
+		  func (stream, "s");
+		break;
+
+	      case 'I':
+		{
+		  unsigned int tmp;
 
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
+		  ifthen_next_state = given & 0xff;
+		  for (tmp = given << 1; tmp & 0xf; tmp <<= 1)
+		    func (stream, ((given ^ tmp) & 0x10) ? "e" : "t");
+		  func (stream, "\t%s", arm_conditional[(given >> 4) & 0xf]);
+		}
+		break;
 
-				  func (stream, "%01x", reg & 0xf);
-				}
-				break;
-			      case 'f':
-				{
-				  long reg;
+	      case 'x':
+		if (ifthen_next_state)
+		  func (stream, "\t; unpredictable branch in IT block\n");
+		break;
 
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
+	      case 'X':
+		if (ifthen_state)
+		  func (stream, "\t; unpredictable <IT:%s>",
+			arm_conditional[IFTHEN_COND]);
+		break;
 
-				  if (reg > 7)
-				    func (stream, "#%s",
-					  arm_fp_const[reg & 7]);
-				  else
-				    func (stream, "f%d", reg);
-				}
-				break;
-			      default:
-				abort ();
-			      }
-			    break;
+	      case 'S':
+		{
+		  long reg;
 
-			  case 'y':
-			  case 'z':
-			    {
-			      int single = *c == 'y';
-			      int regno;
+		  reg = (given >> 3) & 0x7;
+		  if (given & (1 << 6))
+		    reg += 8;
 
-			      switch (bitstart)
-				{
-				case 4: /* Sm pair */
-				  func (stream, "{");
-				  /* Fall through.  */
-				case 0: /* Sm, Dm */
-				  regno = given & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 5) & 1;
-				    }
-				  break;
-
-				case 1: /* Sd, Dd */
-				  regno = (given >> 12) & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 22) & 1;
-				    }
-				  break;
-
-				case 2: /* Sn, Dn */
-				  regno = (given >> 16) & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 7) & 1;
-				    }
-				  break;
-
-				case 3: /* List */
-				  func (stream, "{");
-				  regno = (given >> 12) & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 22) & 1;
-				    }
-				  break;
-
-
-				default:
-				  abort ();
-				}
+		  func (stream, "%s", arm_regnames[reg]);
+		}
+		break;
 
-			      func (stream, "%c%d", single ? 's' : 'd', regno);
+	      case 'D':
+		{
+		  long reg;
 
-			      if (bitstart == 3)
-				{
-				  int count = given & 0xff;
+		  reg = given & 0x7;
+		  if (given & (1 << 7))
+		    reg += 8;
 
-				  if (single == 0)
-				    count >>= 1;
+		  func (stream, "%s", arm_regnames[reg]);
+		}
+		break;
+
+	      case 'N':
+		if (given & (1 << 8))
+		  domasklr = 1;
+		/* Fall through.  */
+	      case 'O':
+		if (*c == 'O' && (given & (1 << 8)))
+		  domaskpc = 1;
+		/* Fall through.  */
+	      case 'M':
+		{
+		  int started = 0;
+		  int reg;
 
-				  if (--count)
-				    {
-				      func (stream, "-%c%d",
-					    single ? 's' : 'd',
-					    regno + count);
-				    }
+		  func (stream, "{");
 
-				  func (stream, "}");
-				}
-			      else if (bitstart == 4)
-				func (stream, ", %c%d}", single ? 's' : 'd',
-				      regno + 1);
+		  /* It would be nice if we could spot
+		     ranges, and generate the rS-rE format: */
+		  for (reg = 0; (reg < 8); reg++)
+		    if ((given & (1 << reg)) != 0)
+		      {
+			if (started)
+			  func (stream, ", ");
+			started = 1;
+			func (stream, "%s", arm_regnames[reg]);
+		      }
 
-			      break;
-			    }
+		  if (domasklr)
+		    {
+		      if (started)
+			func (stream, ", ");
+		      started = 1;
+		      func (stream, arm_regnames[14] /* "lr" */);
+		    }
 
-			  case '`':
-			    c++;
-			    if ((given & (1 << bitstart)) == 0)
-			      func (stream, "%c", *c);
+		  if (domaskpc)
+		    {
+		      if (started)
+			func (stream, ", ");
+		      func (stream, arm_regnames[15] /* "pc" */);
+		    }
+
+		  func (stream, "}");
+		}
+		break;
+
+	      case 'b':
+		/* Print ARM V6T2 CZB address: pc+4+6 bits.  */
+		{
+		  bfd_vma address = (pc + 4
+				     + ((given & 0x00f8) >> 2)
+				     + ((given & 0x0200) >> 3));
+		  info->print_address_func (address, info);
+		}
+		break;
+
+	      case 's':
+		/* Right shift immediate -- bits 6..10; 1-31 print
+		   as themselves, 0 prints as 32.  */
+		{
+		  long imm = (given & 0x07c0) >> 6;
+		  if (imm == 0)
+		    imm = 32;
+		  func (stream, "#%ld", imm);
+		}
+		break;
+
+	      case '0': case '1': case '2': case '3': case '4':
+	      case '5': case '6': case '7': case '8': case '9':
+		{
+		  int bitstart = *c++ - '0';
+		  int bitend = 0;
+
+		  while (*c >= '0' && *c <= '9')
+		    bitstart = (bitstart * 10) + *c++ - '0';
+
+		  switch (*c)
+		    {
+		    case '-':
+		      {
+			long reg;
+
+			c++;
+			while (*c >= '0' && *c <= '9')
+			  bitend = (bitend * 10) + *c++ - '0';
+			if (!bitend)
+			  abort ();
+			reg = given >> bitstart;
+			reg &= (2 << (bitend - bitstart)) - 1;
+			switch (*c)
+			  {
+			  case 'r':
+			    func (stream, "%s", arm_regnames[reg]);
 			    break;
-			  case '\'':
-			    c++;
-			    if ((given & (1 << bitstart)) != 0)
-			      func (stream, "%c", *c);
+
+			  case 'd':
+			    func (stream, "%ld", reg);
 			    break;
-			  case '?':
-			    ++c;
-			    if ((given & (1 << bitstart)) != 0)
-			      func (stream, "%c", *c++);
-			    else
-			      func (stream, "%c", *++c);
+
+			  case 'H':
+			    func (stream, "%ld", reg << 1);
+			    break;
+
+			  case 'W':
+			    func (stream, "%ld", reg << 2);
+			    break;
+
+			  case 'a':
+			    /* PC-relative address -- the bottom two
+			       bits of the address are dropped
+			       before the calculation.  */
+			    info->print_address_func
+			      (((pc + 4) & ~3) + (reg << 2), info);
+			    break;
+
+			  case 'x':
+			    func (stream, "0x%04lx", reg);
+			    break;
+
+			  case 'B':
+			    reg = ((reg ^ (1 << bitend)) - (1 << bitend));
+			    info->print_address_func (reg * 2 + pc + 4, info);
+			    break;
+
+			  case 'c':
+			    func (stream, "%s", arm_conditional [reg]);
 			    break;
+
 			  default:
 			    abort ();
 			  }
-			break;
-
-		      default:
-			abort ();
 		      }
+		      break;
+
+		    case '\'':
+		      c++;
+		      if ((given & (1 << bitstart)) != 0)
+			func (stream, "%c", *c);
+		      break;
+
+		    case '?':
+		      ++c;
+		      if ((given & (1 << bitstart)) != 0)
+			func (stream, "%c", *c++);
+		      else
+			func (stream, "%c", *++c);
+		      break;
+
+		    default:
+		      abort ();
 		    }
 		}
-	      else
-		func (stream, "%c", *c);
-	    }
-	  return 4;
-	}
-    }
+		break;
+
+	      default:
+		abort ();
+	      }
+	  }
+	return;
+      }
+
+  /* No match.  */
   abort ();
 }
 
-/* Print one instruction from PC on INFO->STREAM.
-   Return the size of the instruction. */
+/* Return the name of an V7M special register.  */
+static const char *
+psr_name (int regno)
+{
+  switch (regno)
+    {
+    case 0: return "APSR";
+    case 1: return "IAPSR";
+    case 2: return "EAPSR";
+    case 3: return "PSR";
+    case 5: return "IPSR";
+    case 6: return "EPSR";
+    case 7: return "IEPSR";
+    case 8: return "MSP";
+    case 9: return "PSP";
+    case 16: return "PRIMASK";
+    case 17: return "BASEPRI";
+    case 18: return "BASEPRI_MASK";
+    case 19: return "FAULTMASK";
+    case 20: return "CONTROL";
+    default: return "<unknown>";
+    }
+}
+
+/* Print one 32-bit Thumb instruction from PC on INFO->STREAM.  */
 
-static int
-print_insn_thumb (pc, info, given)
-     bfd_vma                   pc;
-     struct disassemble_info * info;
-     long                      given;
+static void
+print_insn_thumb32 (bfd_vma pc, struct disassemble_info *info, long given)
 {
-  struct thumb_opcode * insn;
-  void *                stream = info->stream;
-  fprintf_ftype         func = info->fprintf_func;
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
 
-  for (insn = thumb_opcodes; insn->assembler; insn++)
-    {
-      if ((given & insn->mask) == insn->value)
-        {
-          char * c = insn->assembler;
+  if (print_insn_coprocessor (pc, info, given, TRUE))
+    return;
 
-          /* Special processing for Thumb 2 instruction BL sequence:  */
-          if (!*c) /* Check for empty (not NULL) assembler string.  */
-            {
-	      long offset;
+  if (print_insn_neon (info, given, TRUE))
+    return;
 
-	      info->bytes_per_chunk = 4;
-	      info->bytes_per_line  = 4;
+  for (insn = thumb32_opcodes; insn->assembler; insn++)
+    if ((given & insn->mask) == insn->value)
+      {
+	const char *c = insn->assembler;
+	for (; *c; c++)
+	  {
+	    if (*c != '%')
+	      {
+		func (stream, "%c", *c);
+		continue;
+	      }
+
+	    switch (*++c)
+	      {
+	      case '%':
+		func (stream, "%%");
+		break;
+
+	      case 'c':
+		if (ifthen_state)
+		  func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		break;
+
+	      case 'x':
+		if (ifthen_next_state)
+		  func (stream, "\t; unpredictable branch in IT block\n");
+		break;
+
+	      case 'X':
+		if (ifthen_state)
+		  func (stream, "\t; unpredictable <IT:%s>",
+			arm_conditional[IFTHEN_COND]);
+		break;
+
+	      case 'I':
+		{
+		  unsigned int imm12 = 0;
+		  imm12 |= (given & 0x000000ffu);
+		  imm12 |= (given & 0x00007000u) >> 4;
+		  imm12 |= (given & 0x04000000u) >> 15;
+		  func (stream, "#%u\t; 0x%x", imm12, imm12);
+		}
+		break;
 
-	      offset = BDISP23 (given);
-	      offset = offset * 2 + pc + 4;
+	      case 'M':
+		{
+		  unsigned int bits = 0, imm, imm8, mod;
+		  bits |= (given & 0x000000ffu);
+		  bits |= (given & 0x00007000u) >> 4;
+		  bits |= (given & 0x04000000u) >> 15;
+		  imm8 = (bits & 0x0ff);
+		  mod = (bits & 0xf00) >> 8;
+		  switch (mod)
+		    {
+		    case 0: imm = imm8; break;
+		    case 1: imm = ((imm8<<16) | imm8); break;
+		    case 2: imm = ((imm8<<24) | (imm8 << 8)); break;
+		    case 3: imm = ((imm8<<24) | (imm8 << 16) | (imm8 << 8) | imm8); break;
+		    default:
+		      mod  = (bits & 0xf80) >> 7;
+		      imm8 = (bits & 0x07f) | 0x80;
+		      imm  = (((imm8 << (32 - mod)) | (imm8 >> mod)) & 0xffffffff);
+		    }
+		  func (stream, "#%u\t; 0x%x", imm, imm);
+		}
+		break;
 
-	      if ((given & 0x10000000) == 0)
+	      case 'J':
 		{
-		  func (stream, "blx\t");
-		  offset &= 0xfffffffc;
+		  unsigned int imm = 0;
+		  imm |= (given & 0x000000ffu);
+		  imm |= (given & 0x00007000u) >> 4;
+		  imm |= (given & 0x04000000u) >> 15;
+		  imm |= (given & 0x000f0000u) >> 4;
+		  func (stream, "#%u\t; 0x%x", imm, imm);
 		}
-	      else
-		func (stream, "bl\t");
+		break;
 
-	      info->print_address_func (offset, info);
-              return 4;
-            }
-          else
-            {
-	      info->bytes_per_chunk = 2;
-	      info->bytes_per_line  = 4;
-
-              given &= 0xffff;
-
-              for (; *c; c++)
-                {
-                  if (*c == '%')
-                    {
-                      int domaskpc = 0;
-                      int domasklr = 0;
-
-                      switch (*++c)
-                        {
-                        case '%':
-                          func (stream, "%%");
-                          break;
-
-                        case 'S':
-                          {
-                            long reg;
+	      case 'K':
+		{
+		  unsigned int imm = 0;
+		  imm |= (given & 0x000f0000u) >> 16;
+		  imm |= (given & 0x00000ff0u) >> 0;
+		  imm |= (given & 0x0000000fu) << 12;
+		  func (stream, "#%u\t; 0x%x", imm, imm);
+		}
+		break;
 
-                            reg = (given >> 3) & 0x7;
-                            if (given & (1 << 6))
-                              reg += 8;
+	      case 'S':
+		{
+		  unsigned int reg = (given & 0x0000000fu);
+		  unsigned int stp = (given & 0x00000030u) >> 4;
+		  unsigned int imm = 0;
+		  imm |= (given & 0x000000c0u) >> 6;
+		  imm |= (given & 0x00007000u) >> 10;
+
+		  func (stream, "%s", arm_regnames[reg]);
+		  switch (stp)
+		    {
+		    case 0:
+		      if (imm > 0)
+			func (stream, ", lsl #%u", imm);
+		      break;
 
-                            func (stream, "%s", arm_regnames[reg]);
-                          }
-                          break;
+		    case 1:
+		      if (imm == 0)
+			imm = 32;
+		      func (stream, ", lsr #%u", imm);
+		      break;
 
-                        case 'D':
-                          {
-                            long reg;
+		    case 2:
+		      if (imm == 0)
+			imm = 32;
+		      func (stream, ", asr #%u", imm);
+		      break;
 
-                            reg = given & 0x7;
-                            if (given & (1 << 7))
-                             reg += 8;
+		    case 3:
+		      if (imm == 0)
+			func (stream, ", rrx");
+		      else
+			func (stream, ", ror #%u", imm);
+		    }
+		}
+		break;
 
-                            func (stream, "%s", arm_regnames[reg]);
-                          }
-                          break;
-
-                        case 'T':
-                          func (stream, "%s",
-                                arm_conditional [(given >> 8) & 0xf]);
-                          break;
-
-                        case 'N':
-                          if (given & (1 << 8))
-                            domasklr = 1;
-                          /* Fall through.  */
-                        case 'O':
-                          if (*c == 'O' && (given & (1 << 8)))
-                            domaskpc = 1;
-                          /* Fall through.  */
-                        case 'M':
-                          {
-                            int started = 0;
-                            int reg;
+	      case 'a':
+		{
+		  unsigned int Rn  = (given & 0x000f0000) >> 16;
+		  unsigned int U   = (given & 0x00800000) >> 23;
+		  unsigned int op  = (given & 0x00000f00) >> 8;
+		  unsigned int i12 = (given & 0x00000fff);
+		  unsigned int i8  = (given & 0x000000ff);
+		  bfd_boolean writeback = FALSE, postind = FALSE;
+		  int offset = 0;
+
+		  func (stream, "[%s", arm_regnames[Rn]);
+		  if (U) /* 12-bit positive immediate offset */
+		    offset = i12;
+		  else if (Rn == 15) /* 12-bit negative immediate offset */
+		    offset = -(int)i12;
+		  else if (op == 0x0) /* shifted register offset */
+		    {
+		      unsigned int Rm = (i8 & 0x0f);
+		      unsigned int sh = (i8 & 0x30) >> 4;
+		      func (stream, ", %s", arm_regnames[Rm]);
+		      if (sh)
+			func (stream, ", lsl #%u", sh);
+		      func (stream, "]");
+		      break;
+		    }
+		  else switch (op)
+		    {
+		    case 0xE:  /* 8-bit positive immediate offset */
+		      offset = i8;
+		      break;
 
-                            func (stream, "{");
+		    case 0xC:  /* 8-bit negative immediate offset */
+		      offset = -i8;
+		      break;
 
-                            /* It would be nice if we could spot
-                               ranges, and generate the rS-rE format: */
-                            for (reg = 0; (reg < 8); reg++)
-                              if ((given & (1 << reg)) != 0)
-                                {
-                                  if (started)
-                                    func (stream, ", ");
-                                  started = 1;
-                                  func (stream, "%s", arm_regnames[reg]);
-                                }
+		    case 0xF:  /* 8-bit + preindex with wb */
+		      offset = i8;
+		      writeback = TRUE;
+		      break;
 
-                            if (domasklr)
-                              {
-                                if (started)
-                                  func (stream, ", ");
-                                started = 1;
-                                func (stream, arm_regnames[14] /* "lr" */);
-                              }
+		    case 0xD:  /* 8-bit - preindex with wb */
+		      offset = -i8;
+		      writeback = TRUE;
+		      break;
 
-                            if (domaskpc)
-                              {
-                                if (started)
-                                  func (stream, ", ");
-                                func (stream, arm_regnames[15] /* "pc" */);
-                              }
+		    case 0xB:  /* 8-bit + postindex */
+		      offset = i8;
+		      postind = TRUE;
+		      break;
 
-                            func (stream, "}");
-                          }
-                          break;
+		    case 0x9:  /* 8-bit - postindex */
+		      offset = -i8;
+		      postind = TRUE;
+		      break;
 
+		    default:
+		      func (stream, ", <undefined>]");
+		      goto skip;
+		    }
 
-                        case '0': case '1': case '2': case '3': case '4':
-                        case '5': case '6': case '7': case '8': case '9':
-                          {
-                            int bitstart = *c++ - '0';
-                            int bitend = 0;
+		  if (postind)
+		    func (stream, "], #%d", offset);
+		  else
+		    {
+		      if (offset)
+			func (stream, ", #%d", offset);
+		      func (stream, writeback ? "]!" : "]");
+		    }
 
-                            while (*c >= '0' && *c <= '9')
-                              bitstart = (bitstart * 10) + *c++ - '0';
+		  if (Rn == 15)
+		    {
+		      func (stream, "\t; ");
+		      info->print_address_func (((pc + 4) & ~3) + offset, info);
+		    }
+		}
+	      skip:
+		break;
 
-                            switch (*c)
-                              {
-                              case '-':
-                                {
-                                  long reg;
-
-                                  c++;
-                                  while (*c >= '0' && *c <= '9')
-                                    bitend = (bitend * 10) + *c++ - '0';
-                                  if (!bitend)
-                                    abort ();
-                                  reg = given >> bitstart;
-                                  reg &= (2 << (bitend - bitstart)) - 1;
-                                  switch (*c)
-                                    {
-                                    case 'r':
-                                      func (stream, "%s", arm_regnames[reg]);
-                                      break;
-
-                                    case 'd':
-                                      func (stream, "%d", reg);
-                                      break;
-
-                                    case 'H':
-                                      func (stream, "%d", reg << 1);
-                                      break;
-
-                                    case 'W':
-                                      func (stream, "%d", reg << 2);
-                                      break;
-
-                                    case 'a':
-				      /* PC-relative address -- the bottom two
-					 bits of the address are dropped
-					 before the calculation.  */
-                                      info->print_address_func
-					(((pc + 4) & ~3) + (reg << 2), info);
-                                      break;
-
-                                    case 'x':
-                                      func (stream, "0x%04x", reg);
-                                      break;
-
-                                    case 'I':
-                                      reg = ((reg ^ (1 << bitend)) - (1 << bitend));
-                                      func (stream, "%d", reg);
-                                      break;
-
-                                    case 'B':
-                                      reg = ((reg ^ (1 << bitend)) - (1 << bitend));
-                                      (*info->print_address_func)
-                                        (reg * 2 + pc + 4, info);
-                                      break;
-
-                                    default:
-                                      abort ();
-                                    }
-                                }
-                                break;
-
-                              case '\'':
-                                c++;
-                                if ((given & (1 << bitstart)) != 0)
-                                  func (stream, "%c", *c);
-                                break;
-
-                              case '?':
-                                ++c;
-                                if ((given & (1 << bitstart)) != 0)
-                                  func (stream, "%c", *c++);
-                                else
-                                  func (stream, "%c", *++c);
-                                break;
-
-                              default:
-                                 abort ();
-                              }
-                          }
-                          break;
-
-                        default:
-                          abort ();
-                        }
-                    }
-                  else
-                    func (stream, "%c", *c);
-                }
-             }
-          return 2;
-       }
-    }
+	      case 'A':
+		{
+		  unsigned int P   = (given & 0x01000000) >> 24;
+		  unsigned int U   = (given & 0x00800000) >> 23;
+		  unsigned int W   = (given & 0x00400000) >> 21;
+		  unsigned int Rn  = (given & 0x000f0000) >> 16;
+		  unsigned int off = (given & 0x000000ff);
+
+		  func (stream, "[%s", arm_regnames[Rn]);
+		  if (P)
+		    {
+		      if (off || !U)
+			func (stream, ", #%c%u", U ? '+' : '-', off * 4);
+		      func (stream, "]");
+		      if (W)
+			func (stream, "!");
+		    }
+		  else
+		    {
+		      func (stream, "], ");
+		      if (W)
+			func (stream, "#%c%u", U ? '+' : '-', off * 4);
+		      else
+			func (stream, "{%u}", off);
+		    }
+		}
+		break;
 
-  /* No match.  */
-  abort ();
-}
+	      case 'w':
+		{
+		  unsigned int Sbit = (given & 0x01000000) >> 24;
+		  unsigned int type = (given & 0x00600000) >> 21;
+		  switch (type)
+		    {
+		    case 0: func (stream, Sbit ? "sb" : "b"); break;
+		    case 1: func (stream, Sbit ? "sh" : "h"); break;
+		    case 2:
+		      if (Sbit)
+			func (stream, "??");
+		      break;
+		    case 3:
+		      func (stream, "??");
+		      break;
+		    }
+		}
+		break;
 
-/* Parse an individual disassembler option.  */
+	      case 'm':
+		{
+		  int started = 0;
+		  int reg;
 
-void
-parse_arm_disassembler_option (option)
-     char * option;
-{
-  if (option == NULL)
-    return;
+		  func (stream, "{");
+		  for (reg = 0; reg < 16; reg++)
+		    if ((given & (1 << reg)) != 0)
+		      {
+			if (started)
+			  func (stream, ", ");
+			started = 1;
+			func (stream, "%s", arm_regnames[reg]);
+		      }
+		  func (stream, "}");
+		}
+		break;
 
-  if (strneq (option, "reg-names-", 10))
-    {
-      int i;
+	      case 'E':
+		{
+		  unsigned int msb = (given & 0x0000001f);
+		  unsigned int lsb = 0;
+		  lsb |= (given & 0x000000c0u) >> 6;
+		  lsb |= (given & 0x00007000u) >> 10;
+		  func (stream, "#%u, #%u", lsb, msb - lsb + 1);
+		}
+		break;
 
-      option += 10;
+	      case 'F':
+		{
+		  unsigned int width = (given & 0x0000001f) + 1;
+		  unsigned int lsb = 0;
+		  lsb |= (given & 0x000000c0u) >> 6;
+		  lsb |= (given & 0x00007000u) >> 10;
+		  func (stream, "#%u, #%u", lsb, width);
+		}
+		break;
 
-      for (i = NUM_ARM_REGNAMES; i--;)
-	if (streq (option, regnames[i].name))
-	  {
-	    regname_selected = i;
-	    break;
-	  }
+	      case 'b':
+		{
+		  unsigned int S = (given & 0x04000000u) >> 26;
+		  unsigned int J1 = (given & 0x00002000u) >> 13;
+		  unsigned int J2 = (given & 0x00000800u) >> 11;
+		  int offset = 0;
+
+		  offset |= !S << 20;
+		  offset |= J2 << 19;
+		  offset |= J1 << 18;
+		  offset |= (given & 0x003f0000) >> 4;
+		  offset |= (given & 0x000007ff) << 1;
+		  offset -= (1 << 20);
+
+		  info->print_address_func (pc + 4 + offset, info);
+		}
+		break;
 
-      if (i < 0)
-	fprintf (stderr, _("Unrecognised register name set: %s\n"), option);
-    }
-  else if (streq (option, "force-thumb"))
-    force_thumb = 1;
-  else if (streq (option, "no-force-thumb"))
-    force_thumb = 0;
-  else
-    fprintf (stderr, _("Unrecognised disassembler option: %s\n"), option);
+	      case 'B':
+		{
+		  unsigned int S = (given & 0x04000000u) >> 26;
+		  unsigned int I1 = (given & 0x00002000u) >> 13;
+		  unsigned int I2 = (given & 0x00000800u) >> 11;
+		  int offset = 0;
+
+		  offset |= !S << 24;
+		  offset |= !(I1 ^ S) << 23;
+		  offset |= !(I2 ^ S) << 22;
+		  offset |= (given & 0x03ff0000u) >> 4;
+		  offset |= (given & 0x000007ffu) << 1;
+		  offset -= (1 << 24);
+		  offset += pc + 4;
+
+		  /* BLX target addresses are always word aligned.  */
+		  if ((given & 0x00001000u) == 0)
+		      offset &= ~2u;
+
+		  info->print_address_func (offset, info);
+		}
+		break;
+
+	      case 's':
+		{
+		  unsigned int shift = 0;
+		  shift |= (given & 0x000000c0u) >> 6;
+		  shift |= (given & 0x00007000u) >> 10;
+		  if (given & 0x00200000u)
+		    func (stream, ", asr #%u", shift);
+		  else if (shift)
+		    func (stream, ", lsl #%u", shift);
+		  /* else print nothing - lsl #0 */
+		}
+		break;
 
-  return;
+	      case 'R':
+		{
+		  unsigned int rot = (given & 0x00000030) >> 4;
+		  if (rot)
+		    func (stream, ", ror #%u", rot * 8);
+		}
+		break;
+
+	      case 'U':
+		switch (given & 0xf)
+		  {
+		  case 0xf: func(stream, "sy"); break;
+		  case 0x7: func(stream, "un"); break;
+		  case 0xe: func(stream, "st"); break;
+		  case 0x6: func(stream, "unst"); break;
+		  default:
+		    func(stream, "#%d", (int)given & 0xf);
+		    break;
+		  }
+		break;
+
+	      case 'C':
+		if ((given & 0xff) == 0)
+		  {
+		    func (stream, "%cPSR_", (given & 0x100000) ? 'S' : 'C');
+		    if (given & 0x800)
+		      func (stream, "f");
+		    if (given & 0x400)
+		      func (stream, "s");
+		    if (given & 0x200)
+		      func (stream, "x");
+		    if (given & 0x100)
+		      func (stream, "c");
+		  }
+		else
+		  {
+		    func (stream, psr_name (given & 0xff));
+		  }
+		break;
+
+	      case 'D':
+		if ((given & 0xff) == 0)
+		  func (stream, "%cPSR", (given & 0x100000) ? 'S' : 'C');
+		else
+		  func (stream, psr_name (given & 0xff));
+		break;
+
+	      case '0': case '1': case '2': case '3': case '4':
+	      case '5': case '6': case '7': case '8': case '9':
+		{
+		  int width;
+		  unsigned long val;
+
+		  c = arm_decode_bitfield (c, given, &val, &width);
+
+		  switch (*c)
+		    {
+		    case 'd': func (stream, "%lu", val); break;
+		    case 'W': func (stream, "%lu", val * 4); break;
+		    case 'r': func (stream, "%s", arm_regnames[val]); break;
+
+		    case 'c':
+		      func (stream, "%s", arm_conditional[val]);
+		      break;
+
+		    case '\'':
+		      c++;
+		      if (val == ((1ul << width) - 1))
+			func (stream, "%c", *c);
+		      break;
+
+		    case '`':
+		      c++;
+		      if (val == 0)
+			func (stream, "%c", *c);
+		      break;
+
+		    case '?':
+		      func (stream, "%c", c[(1 << width) - (int)val]);
+		      c += 1 << width;
+		      break;
+
+		    default:
+		      abort ();
+		    }
+		}
+		break;
+
+	      default:
+		abort ();
+	      }
+	  }
+	return;
+      }
+
+  /* No match.  */
+  abort ();
 }
 
-/* Parse the string of disassembler options, spliting it at whitespaces.  */
+/* Print data bytes on INFO->STREAM.  */
 
 static void
-parse_disassembler_options (options)
-     char * options;
+print_insn_data (bfd_vma pc ATTRIBUTE_UNUSED, struct disassemble_info *info,
+		 long given)
 {
-  char * space;
-
-  if (options == NULL)
-    return;
+  switch (info->bytes_per_chunk)
+    {
+    case 1:
+      info->fprintf_func (info->stream, ".byte\t0x%02lx", given);
+      break;
+    case 2:
+      info->fprintf_func (info->stream, ".short\t0x%04lx", given);
+      break;
+    case 4:
+      info->fprintf_func (info->stream, ".word\t0x%08lx", given);
+      break;
+    default:
+      abort ();
+    }
+}
 
-  do
+/* Search back through the insn stream to determine if this instruction is
+   conditionally executed.  */
+static void
+find_ifthen_state (bfd_vma pc, struct disassemble_info *info,
+		   bfd_boolean little)
+{
+  unsigned char b[2];
+  unsigned int insn;
+  int status;
+  /* COUNT is twice the number of instructions seen.  It will be odd if we
+     just crossed an instruction boundary.  */
+  int count;
+  int it_count;
+  unsigned int seen_it;
+  bfd_vma addr;
+
+  ifthen_address = pc;
+  ifthen_state = 0;
+
+  addr = pc;
+  count = 1;
+  it_count = 0;
+  seen_it = 0;
+  /* Scan backwards looking for IT instructions, keeping track of where
+     instruction boundaries are.  We don't know if something is actually an
+     IT instruction until we find a definite instruction boundary.  */
+  for (;;)
     {
-      space = strchr (options, ' ');
+      if (addr == 0 || info->symbol_at_address_func(addr, info))
+	{
+	  /* A symbol must be on an instruction boundary, and will not
+	     be within an IT block.  */
+	  if (seen_it && (count & 1))
+	    break;
 
-      if (space)
+	  return;
+	}
+      addr -= 2;
+      status = info->read_memory_func (addr, (bfd_byte *)b, 2, info);
+      if (status)
+	return;
+
+      if (little)
+	insn = (b[0]) | (b[1] << 8);
+      else
+	insn = (b[1]) | (b[0] << 8);
+      if (seen_it)
 	{
-	  * space = '\0';
-	  parse_arm_disassembler_option (options);
-	  * space = ' ';
-	  options = space + 1;
+	  if ((insn & 0xf800) < 0xe800)
+	    {
+	      /* Addr + 2 is an instruction boundary.  See if this matches
+	         the expected boundary based on the position of the last
+		 IT candidate.  */
+	      if (count & 1)
+		break;
+	      seen_it = 0;
+	    }
 	}
+      if ((insn & 0xff00) == 0xbf00 && (insn & 0xf) != 0)
+	{
+	  /* This could be an IT instruction.  */
+	  seen_it = insn;
+	  it_count = count >> 1;
+	}
+      if ((insn & 0xf800) >= 0xe800)
+	count++;
       else
-	parse_arm_disassembler_option (options);
+	count = (count + 2) | 1;
+      /* IT blocks contain at most 4 instructions.  */
+      if (count >= 8 && !seen_it)
+	return;
     }
-  while (space);
+  /* We found an IT instruction.  */
+  ifthen_state = (seen_it & 0xe0) | ((seen_it << it_count) & 0x1f);
+  if ((ifthen_state & 0xf) == 0)
+    ifthen_state = 0;
 }
 
 /* NOTE: There are no checks in these routines that
    the relevant number of data bytes exist.  */
 
 int
-print_insn_arm (pc, info)
-     bfd_vma pc;
-     struct disassemble_info * info;
+print_insn_arm (bfd_vma pc, struct disassemble_info *info)
 {
-  unsigned char      b[4];
-  long               given;
-  int                status;
-  int                is_thumb;
-  int little;
+  unsigned char b[4];
+  long		given;
+  int           status;
+  int           is_thumb = FALSE;
+  int           is_data = FALSE;
+  unsigned int	size = 4;
+  void	 	(*printer) (bfd_vma, struct disassemble_info *, long);
+#if 0
+  bfd_boolean   found = FALSE;
 
   if (info->disassembler_options)
     {
@@ -1555,15 +3919,91 @@ print_insn_arm (pc, info)
       info->disassembler_options = NULL;
     }
 
-  is_thumb = force_thumb;
-  if (pc & 1)
+  /* First check the full symtab for a mapping symbol, even if there
+     are no usable non-mapping symbols for this address.  */
+  if (info->symtab != NULL
+      && bfd_asymbol_flavour (*info->symtab) == bfd_target_elf_flavour)
     {
-      is_thumb = 1;
-      pc &= ~(bfd_vma) 1;
+      bfd_vma addr;
+      int n;
+      int last_sym = -1;
+      enum map_type type = MAP_ARM;
+
+      if (pc <= last_mapping_addr)
+	last_mapping_sym = -1;
+      is_thumb = (last_type == MAP_THUMB);
+      found = FALSE;
+      /* Start scanning at the start of the function, or wherever
+	 we finished last time.  */
+      n = info->symtab_pos + 1;
+      if (n < last_mapping_sym)
+	n = last_mapping_sym;
+
+      /* Scan up to the location being disassembled.  */
+      for (; n < info->symtab_size; n++)
+	{
+	  addr = bfd_asymbol_value (info->symtab[n]);
+	  if (addr > pc)
+	    break;
+	  if ((info->section == NULL
+	       || info->section == info->symtab[n]->section)
+	      && get_sym_code_type (info, n, &type))
+	    {
+	      last_sym = n;
+	      found = TRUE;
+	    }
+	}
+
+      if (!found)
+	{
+	  n = info->symtab_pos;
+	  if (n < last_mapping_sym - 1)
+	    n = last_mapping_sym - 1;
+
+	  /* No mapping symbol found at this address.  Look backwards
+	     for a preceeding one.  */
+	  for (; n >= 0; n--)
+	    {
+	      if (get_sym_code_type (info, n, &type))
+		{
+		  last_sym = n;
+		  found = TRUE;
+		  break;
+		}
+	    }
+	}
+
+      last_mapping_sym = last_sym;
+      last_type = type;
+      is_thumb = (last_type == MAP_THUMB);
+      is_data = (last_type == MAP_DATA);
+
+      /* Look a little bit ahead to see if we should print out
+	 two or four bytes of data.  If there's a symbol,
+	 mapping or otherwise, after two bytes then don't
+	 print more.  */
+      if (is_data)
+	{
+	  size = 4 - (pc & 3);
+	  for (n = last_sym + 1; n < info->symtab_size; n++)
+	    {
+	      addr = bfd_asymbol_value (info->symtab[n]);
+	      if (addr > pc)
+		{
+		  if (addr - pc < size)
+		    size = addr - pc;
+		  break;
+		}
+	    }
+	  /* If the next symbol is after three bytes, we need to
+	     print only part of the data, so that we can use either
+	     .byte or .short.  */
+	  if (size == 3)
+	    size = (pc & 1) ? 1 : 2;
+	}
     }
 
-#if 0
-  if (!is_thumb && info->symbols != NULL)
+  if (info->symbols != NULL)
     {
       if (bfd_asymbol_flavour (*info->symbols) == bfd_target_coff_flavour)
 	{
@@ -1576,8 +4016,11 @@ print_insn_arm (pc, info)
 		      || cs->native->u.syment.n_sclass == C_THUMBEXTFUNC
 		      || cs->native->u.syment.n_sclass == C_THUMBSTATFUNC);
 	}
-      else if (bfd_asymbol_flavour (*info->symbols) == bfd_target_elf_flavour)
+      else if (bfd_asymbol_flavour (*info->symbols) == bfd_target_elf_flavour
+	       && !found)
 	{
+	  /* If no mapping symbol has been found then fall back to the type
+	     of the function symbol.  */
 	  elf_symbol_type *  es;
 	  unsigned int       type;
 
@@ -1587,64 +4030,103 @@ print_insn_arm (pc, info)
 	  is_thumb = (type == STT_ARM_TFUNC) || (type == STT_ARM_16BIT);
 	}
     }
-#endif
+#else
+  int little;
 
   little = (info->endian == BFD_ENDIAN_LITTLE);
-  info->bytes_per_chunk = 4;
-  info->display_endian  = little ? BFD_ENDIAN_LITTLE : BFD_ENDIAN_BIG;
+  is_thumb |= (pc & 1);
+  pc &= ~(bfd_vma)1;
+#endif
 
-  if (little)
-    {
-      status = info->read_memory_func (pc, (bfd_byte *) &b[0], 4, info);
-      if (status != 0 && is_thumb)
-	{
-	  info->bytes_per_chunk = 2;
+  if (force_thumb)
+    is_thumb = TRUE;
 
-	  status = info->read_memory_func (pc, (bfd_byte *) b, 2, info);
-	  b[3] = b[2] = 0;
-	}
+  info->bytes_per_line = 4;
 
-      if (status != 0)
-	{
-	  info->memory_error_func (status, pc, info);
-	  return -1;
-	}
+  if (is_data)
+    {
+      int i;
+
+      /* size was already set above.  */
+      info->bytes_per_chunk = size;
+      printer = print_insn_data;
 
-      given = (b[0]) | (b[1] << 8) | (b[2] << 16) | (b[3] << 24);
+      status = info->read_memory_func (pc, (bfd_byte *)b, size, info);
+      given = 0;
+      if (little)
+	for (i = size - 1; i >= 0; i--)
+	  given = b[i] | (given << 8);
+      else
+	for (i = 0; i < (int) size; i++)
+	  given = b[i] | (given << 8);
+    }
+  else if (!is_thumb)
+    {
+      /* In ARM mode endianness is a straightforward issue: the instruction
+	 is four bytes long and is either ordered 0123 or 3210.  */
+      printer = print_insn_arm_internal;
+      info->bytes_per_chunk = 4;
+      size = 4;
+
+      status = info->read_memory_func (pc, (bfd_byte *)b, 4, info);
+      if (little)
+	given = (b[0]) | (b[1] << 8) | (b[2] << 16) | (b[3] << 24);
+      else
+	given = (b[3]) | (b[2] << 8) | (b[1] << 16) | (b[0] << 24);
     }
   else
     {
-      status = info->read_memory_func
-	(pc & ~ 0x3, (bfd_byte *) &b[0], 4, info);
-      if (status != 0)
-	{
-	  info->memory_error_func (status, pc, info);
-	  return -1;
-	}
+      /* In Thumb mode we have the additional wrinkle of two
+	 instruction lengths.  Fortunately, the bits that determine
+	 the length of the current instruction are always to be found
+	 in the first two bytes.  */
+      printer = print_insn_thumb16;
+      info->bytes_per_chunk = 2;
+      size = 2;
+
+      status = info->read_memory_func (pc, (bfd_byte *)b, 2, info);
+      if (little)
+	given = (b[0]) | (b[1] << 8);
+      else
+	given = (b[1]) | (b[0] << 8);
 
-      if (is_thumb)
+      if (!status)
 	{
-	  if (pc & 0x2)
+	  /* These bit patterns signal a four-byte Thumb
+	     instruction.  */
+	  if ((given & 0xF800) == 0xF800
+	      || (given & 0xF800) == 0xF000
+	      || (given & 0xF800) == 0xE800)
 	    {
-	      given = (b[2] << 8) | b[3];
-
-	      status = info->read_memory_func
-		((pc + 4) & ~ 0x3, (bfd_byte *) b, 4, info);
-	      if (status != 0)
-		{
-		  info->memory_error_func (status, pc + 4, info);
-		  return -1;
-		}
+	      status = info->read_memory_func (pc + 2, (bfd_byte *)b, 2, info);
+	      if (little)
+		given = (b[0]) | (b[1] << 8) | (given << 16);
+	      else
+		given = (b[1]) | (b[0] << 8) | (given << 16);
 
-	      given |= (b[0] << 24) | (b[1] << 16);
+	      printer = print_insn_thumb32;
+	      size = 4;
 	    }
+	}
+
+      if (ifthen_address != pc)
+	find_ifthen_state(pc, info, little);
+
+      if (ifthen_state)
+	{
+	  if ((ifthen_state & 0xf) == 0x8)
+	    ifthen_next_state = 0;
 	  else
-	    given = (b[0] << 8) | b[1] | (b[2] << 24) | (b[3] << 16);
+	    ifthen_next_state = (ifthen_state & 0xe0)
+				| ((ifthen_state & 0xf) << 1);
 	}
-      else
-	given = (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | (b[3]);
     }
 
+  if (status)
+    {
+      info->memory_error_func (status, pc, info);
+      return -1;
+    }
   if (info->flags & INSN_HAS_RELOC)
     /* If the instruction has a reloc associated with it, then
        the offset field in the instruction will actually be the
@@ -1652,16 +4134,19 @@ print_insn_arm (pc, info)
        In such cases, we can ignore the pc when computing
        addresses, since the addend is not currently pc-relative.  */
     pc = 0;
-  if (is_thumb)
-    status = print_insn_thumb (pc, info, given);
-  else
-    status = print_insn_arm1 (pc, info, given);
 
-  return status;
+  printer (pc, info, given);
+
+  if (is_thumb)
+    {
+      ifthen_state = ifthen_next_state;
+      ifthen_address += size;
+    }
+  return size;
 }
 
 void
-print_arm_disassembler_options (FILE * stream)
+print_arm_disassembler_options (FILE *stream)
 {
   int i;
 
diff --git a/arm-semi.c b/arm-semi.c
index ff7a343bc..1cf220388 100644
--- a/arm-semi.c
+++ b/arm-semi.c
@@ -33,7 +33,9 @@
 
 #define ARM_ANGEL_HEAP_SIZE (128 * 1024 * 1024)
 #else
-#include "vl.h"
+#include "qemu-common.h"
+#include "sysemu.h"
+#include "gdbstub.h"
 #endif
 
 #define SYS_OPEN        0x01
@@ -165,8 +167,14 @@ static void arm_semi_flen_cb(CPUState *env, target_ulong ret, target_ulong err)
 #endif
 }
 
-#define ARG(n) tget32(args + (n) * 4)
-#define SET_ARG(n, val) tput32(args + (n) * 4,val)
+#define ARG(n)					\
+({						\
+    target_ulong __arg;				\
+    /* FIXME - handle get_user() failure */	\
+    get_user_ual(__arg, args + (n) * 4);	\
+    __arg;					\
+})
+#define SET_ARG(n, val) put_user_ual(val, args + (n) * 4)
 uint32_t do_arm_semihosting(CPUState *env)
 {
     target_ulong args;
@@ -184,9 +192,11 @@ uint32_t do_arm_semihosting(CPUState *env)
     args = env->regs[1];
     switch (nr) {
     case SYS_OPEN:
-        s = lock_user_string(ARG(0));
+        if (!(s = lock_user_string(ARG(0))))
+            /* FIXME - should this error code be -TARGET_EFAULT ? */
+            return (uint32_t)-1;
         if (ARG(1) >= 12)
-          return (uint32_t)-1;
+            return (uint32_t)-1;
         if (strcmp(s, ":tt") == 0) {
             if (ARG(1) < 4)
                 return STDIN_FILENO;
@@ -211,7 +221,11 @@ uint32_t do_arm_semihosting(CPUState *env)
         }
     case SYS_WRITEC:
         {
-          char c = tget8(args);
+          char c;
+
+          if (get_user_u8(c, args))
+              /* FIXME - should this error code be -TARGET_EFAULT ? */
+              return (uint32_t)-1;
           /* Write to debug console.  stderr is near enough.  */
           if (use_gdb_syscalls()) {
                 gdb_do_syscall(arm_semi_cb, "write,2,%x,1", args);
@@ -221,7 +235,9 @@ uint32_t do_arm_semihosting(CPUState *env)
           }
         }
     case SYS_WRITE0:
-        s = lock_user_string(args);
+        if (!(s = lock_user_string(args)))
+            /* FIXME - should this error code be -TARGET_EFAULT ? */
+            return (uint32_t)-1;
         len = strlen(s);
         if (use_gdb_syscalls()) {
             gdb_do_syscall(arm_semi_cb, "write,2,%x,%x\n", args, len);
@@ -238,7 +254,9 @@ uint32_t do_arm_semihosting(CPUState *env)
             gdb_do_syscall(arm_semi_cb, "write,%x,%x,%x", ARG(0), ARG(1), len);
             return env->regs[0];
         } else {
-            s = lock_user(ARG(1), len, 1);
+            if (!(s = lock_user(VERIFY_READ, ARG(1), len, 1)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             ret = set_swi_errno(ts, write(ARG(0), s, len));
             unlock_user(s, ARG(1), 0);
             if (ret == (uint32_t)-1)
@@ -252,7 +270,9 @@ uint32_t do_arm_semihosting(CPUState *env)
             gdb_do_syscall(arm_semi_cb, "read,%x,%x,%x", ARG(0), ARG(1), len);
             return env->regs[0];
         } else {
-            s = lock_user(ARG(1), len, 0);
+            if (!(s = lock_user(VERIFY_WRITE, ARG(1), len, 0)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             do
               ret = set_swi_errno(ts, read(ARG(0), s, len));
             while (ret == -1 && errno == EINTR);
@@ -301,7 +321,9 @@ uint32_t do_arm_semihosting(CPUState *env)
             gdb_do_syscall(arm_semi_cb, "unlink,%s", ARG(0), (int)ARG(1)+1);
             ret = env->regs[0];
         } else {
-            s = lock_user_string(ARG(0));
+            if (!(s = lock_user_string(ARG(0))))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             ret =  set_swi_errno(ts, remove(s));
             unlock_user(s, ARG(0), 0);
         }
@@ -315,9 +337,15 @@ uint32_t do_arm_semihosting(CPUState *env)
             char *s2;
             s = lock_user_string(ARG(0));
             s2 = lock_user_string(ARG(2));
-            ret = set_swi_errno(ts, rename(s, s2));
-            unlock_user(s2, ARG(2), 0);
-            unlock_user(s, ARG(0), 0);
+            if (!s || !s2)
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                ret = (uint32_t)-1;
+            else
+                ret = set_swi_errno(ts, rename(s, s2));
+            if (s2)
+                unlock_user(s2, ARG(2), 0);
+            if (s)
+                unlock_user(s, ARG(0), 0);
             return ret;
         }
     case SYS_CLOCK:
@@ -329,7 +357,9 @@ uint32_t do_arm_semihosting(CPUState *env)
             gdb_do_syscall(arm_semi_cb, "system,%s", ARG(0), (int)ARG(1)+1);
             return env->regs[0];
         } else {
-            s = lock_user_string(ARG(0));
+            if (!(s = lock_user_string(ARG(0))))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             ret = set_swi_errno(ts, system(s));
             unlock_user(s, ARG(0), 0);
         }
@@ -346,7 +376,11 @@ uint32_t do_arm_semihosting(CPUState *env)
             char **arg = ts->info->host_argv;
             int len = ARG(1);
             /* lock the buffer on the ARM side */
-            char *cmdline_buffer = (char*)lock_user(ARG(0), len, 0);
+            char *cmdline_buffer = (char*)lock_user(VERIFY_WRITE, ARG(0), len, 0);
+
+            if (!cmdline_buffer)
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
 
             s = cmdline_buffer;
             while (*arg && len > 2) {
@@ -402,7 +436,9 @@ uint32_t do_arm_semihosting(CPUState *env)
                 ts->heap_limit = limit;
             }
 
-            ptr = lock_user(ARG(0), 16, 0);
+            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             ptr[0] = tswap32(ts->heap_base);
             ptr[1] = tswap32(ts->heap_limit);
             ptr[2] = tswap32(ts->stack_base);
@@ -410,7 +446,9 @@ uint32_t do_arm_semihosting(CPUState *env)
             unlock_user(ptr, ARG(0), 16);
 #else
             limit = ram_size;
-            ptr = lock_user(ARG(0), 16, 0);
+            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             /* TODO: Make this use the limit of the loaded application.  */
             ptr[0] = tswap32(limit / 2);
             ptr[1] = tswap32(limit);
diff --git a/audio/.cvsignore b/audio/.cvsignore
new file mode 100644
index 000000000..a4383358e
--- /dev/null
+++ b/audio/.cvsignore
@@ -0,0 +1 @@
+*.d
diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index a573a380a..77a08a1c5 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -22,7 +22,8 @@
  * THE SOFTWARE.
  */
 #include <alsa/asoundlib.h>
-#include "vl.h"
+#include "qemu-common.h"
+#include "audio.h"
 
 #define AUDIO_CAP "alsa"
 #include "audio_int.h"
@@ -85,9 +86,9 @@ static struct {
 };
 
 struct alsa_params_req {
-    int freq;
+    unsigned int freq;
     audfmt_e fmt;
-    int nchannels;
+    unsigned int nchannels;
     unsigned int buffer_size;
     unsigned int period_size;
 };
@@ -284,7 +285,8 @@ static int alsa_open (int in, struct alsa_params_req *req,
 {
     snd_pcm_t *handle;
     snd_pcm_hw_params_t *hw_params;
-    int err, freq, nchannels;
+    int err;
+    unsigned int freq, nchannels;
     const char *pcm_name = in ? conf.pcm_name_in : conf.pcm_name_out;
     unsigned int period_size, buffer_size;
     snd_pcm_uframes_t obt_buffer_size;
diff --git a/audio/audio.c b/audio/audio.c
index 4248c1401..5e9d88bb1 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -21,7 +21,11 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw/hw.h"
+#include "audio.h"
+#include "console.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
 
 #define AUDIO_CAP "audio"
 #include "audio_int.h"
@@ -234,7 +238,7 @@ static char *audio_alloc_prefix (const char *s)
     return r;
 }
 
-const char *audio_audfmt_to_string (audfmt_e fmt)
+static const char *audio_audfmt_to_string (audfmt_e fmt)
 {
     switch (fmt) {
     case AUD_FMT_U8:
@@ -260,7 +264,8 @@ const char *audio_audfmt_to_string (audfmt_e fmt)
     return "S16";
 }
 
-audfmt_e audio_string_to_audfmt (const char *s, audfmt_e defval, int *defaultp)
+static audfmt_e audio_string_to_audfmt (const char *s, audfmt_e defval,
+                                        int *defaultp)
 {
     if (!strcasecmp (s, "u8")) {
         *defaultp = 0;
diff --git a/audio/audio.h b/audio/audio.h
index 287cc5c73..ec9eee46f 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -24,7 +24,7 @@
 #ifndef QEMU_AUDIO_H
 #define QEMU_AUDIO_H
 
-#include "config.h"
+#include "config-host.h"
 #include "sys-queue.h"
 
 typedef void (*audio_callback_fn_t) (void *opaque, int avail);
@@ -73,7 +73,6 @@ typedef struct CaptureState {
     LIST_ENTRY (CaptureState) entries;
 } CaptureState;
 
-typedef struct AudioState AudioState;
 typedef struct SWVoiceOut SWVoiceOut;
 typedef struct CaptureVoiceOut CaptureVoiceOut;
 typedef struct SWVoiceIn SWVoiceIn;
diff --git a/audio/coreaudio.c b/audio/coreaudio.c
index 74d432f91..516bb3fad 100644
--- a/audio/coreaudio.c
+++ b/audio/coreaudio.c
@@ -26,7 +26,8 @@
 #include <string.h>             /* strerror */
 #include <pthread.h>            /* pthread_X */
 
-#include "vl.h"
+#include "qemu-common.h"
+#include "audio.h"
 
 #define AUDIO_CAP "coreaudio"
 #include "audio_int.h"
diff --git a/audio/dsoundaudio.c b/audio/dsoundaudio.c
index 90a0333f1..a955cf4dc 100644
--- a/audio/dsoundaudio.c
+++ b/audio/dsoundaudio.c
@@ -26,7 +26,8 @@
  * SEAL 1.07 by Carlos 'pel' Hasan was used as documentation
  */
 
-#include "vl.h"
+#include "qemu-common.h"
+#include "audio.h"
 
 #define AUDIO_CAP "dsound"
 #include "audio_int.h"
diff --git a/audio/fmodaudio.c b/audio/fmodaudio.c
index 5875ba15e..04f4e40b3 100644
--- a/audio/fmodaudio.c
+++ b/audio/fmodaudio.c
@@ -23,7 +23,8 @@
  */
 #include <fmod.h>
 #include <fmod_errors.h>
-#include "vl.h"
+#include "qemu-common.h"
+#include "audio.h"
 
 #define AUDIO_CAP "fmod"
 #include "audio_int.h"
diff --git a/audio/mixeng.c b/audio/mixeng.c
index 34cc1aeee..b668c524e 100644
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -22,7 +22,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "audio.h"
 
 #define AUDIO_CAP "mixeng"
 #include "audio_int.h"
diff --git a/audio/noaudio.c b/audio/noaudio.c
index a3423e5eb..64695e6af 100644
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "audio.h"
+#include "qemu-timer.h"
 
 #define AUDIO_CAP "noaudio"
 #include "audio_int.h"
diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index cedcea45f..5a91556cc 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -30,7 +30,8 @@
 #else
 #include <sys/soundcard.h>
 #endif
-#include "vl.h"
+#include "qemu-common.h"
+#include "audio.h"
 
 #define AUDIO_CAP "oss"
 #include "audio_int.h"
diff --git a/audio/sdlaudio.c b/audio/sdlaudio.c
index 11edab08d..b6cfad18f 100644
--- a/audio/sdlaudio.c
+++ b/audio/sdlaudio.c
@@ -23,7 +23,8 @@
  */
 #include <SDL.h>
 #include <SDL_thread.h>
-#include "vl.h"
+#include "qemu-common.h"
+#include "audio.h"
 
 #ifndef _WIN32
 #ifdef __sun__
diff --git a/audio/wavaudio.c b/audio/wavaudio.c
index 0a800f1a2..2bdfdd41c 100644
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw/hw.h"
+#include "qemu-timer.h"
+#include "audio.h"
 
 #define AUDIO_CAP "wav"
 #include "audio_int.h"
diff --git a/audio/wavcapture.c b/audio/wavcapture.c
index 627ba8394..cb072a192 100644
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -1,4 +1,6 @@
-#include "vl.h"
+#include "hw/hw.h"
+#include "console.h"
+#include "audio.h"
 
 typedef struct {
     QEMUFile *f;
diff --git a/block-bochs.c b/block-bochs.c
index 9baea9b6f..b167e0bbf 100644
--- a/block-bochs.c
+++ b/block-bochs.c
@@ -22,7 +22,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 /**************************************************************/
diff --git a/block-cloop.c b/block-cloop.c
index 0c9ddb381..43d380127 100644
--- a/block-cloop.c
+++ b/block-cloop.c
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <zlib.h>
 
diff --git a/block-cow.c b/block-cow.c
index 47a91e5ac..9e7b64602 100644
--- a/block-cow.c
+++ b/block-cow.c
@@ -22,7 +22,7 @@
  * THE SOFTWARE.
  */
 #ifndef _WIN32
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <sys/mman.h>
 
diff --git a/block-dmg.c b/block-dmg.c
index 681f4dc71..62117c97a 100644
--- a/block-dmg.c
+++ b/block-dmg.c
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include "bswap.h"
 #include <zlib.h>
diff --git a/block-parallels.c b/block-parallels.c
index b0fb99cee..4654b07b1 100644
--- a/block-parallels.c
+++ b/block-parallels.c
@@ -23,7 +23,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 /**************************************************************/
diff --git a/block-qcow.c b/block-qcow.c
index 9a0bca0e7..730ae67ed 100644
--- a/block-qcow.c
+++ b/block-qcow.c
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <zlib.h>
 #include "aes.h"
diff --git a/block-qcow2.c b/block-qcow2.c
index b74fe348e..577210b21 100644
--- a/block-qcow2.c
+++ b/block-qcow2.c
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <zlib.h>
 #include "aes.h"
diff --git a/block-raw.c b/block-raw-posix.c
index 2f2e19f9b..089a1f4a9 100644
--- a/block-raw.c
+++ b/block-raw-posix.c
@@ -1,5 +1,5 @@
 /*
- * Block driver for RAW files
+ * Block driver for RAW files (posix)
  *
  * Copyright (c) 2006 Fabrice Bellard
  *
@@ -21,16 +21,15 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#ifndef QEMU_IMG
+#include "qemu-timer.h"
+#include "exec-all.h"
+#endif
 #include "block_int.h"
 #include <assert.h>
-#ifndef _WIN32
 #include <aio.h>
 
-#ifndef QEMU_TOOL
-#include "exec-all.h"
-#endif
-
 #ifdef CONFIG_COCOA
 #include <paths.h>
 #include <sys/param.h>
@@ -59,8 +58,8 @@
 
 //#define DEBUG_FLOPPY
 
-#define DEBUG_BLOCK
-#if defined(DEBUG_BLOCK) && !defined(QEMU_TOOL)
+//#define DEBUG_BLOCK
+#if defined(DEBUG_BLOCK) && !defined(QEMU_IMG)
 #define DEBUG_BLOCK_PRINT(formatCstr, args...) do { if (loglevel != 0)	\
     { fprintf(logfile, formatCstr, ##args); fflush(logfile); } } while (0)
 #else
@@ -242,7 +241,7 @@ static int aio_initialized = 0;
 
 static void aio_signal_handler(int signum)
 {
-#ifndef QEMU_TOOL
+#ifndef QEMU_IMG
     CPUState *env = cpu_single_env;
     if (env) {
         /* stop the currently executing cpu because a timer occured */
@@ -352,7 +351,7 @@ void qemu_aio_wait(void)
     sigset_t set;
     int nb_sigs;
 
-#ifndef QEMU_TOOL
+#ifndef QEMU_IMG
     if (qemu_bh_poll())
         return;
 #endif
@@ -693,7 +692,7 @@ static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
     return 0;
 }
 
-#if defined(__linux__) && !defined(QEMU_TOOL)
+#if defined(__linux__) && !defined(QEMU_IMG)
 
 /* Note: we do not have a reliable method to detect if the floppy is
    present. The current method is to try to open the floppy at every
@@ -900,523 +899,3 @@ BlockDriver bdrv_host_device = {
     .bdrv_eject = raw_eject,
     .bdrv_set_locked = raw_set_locked,
 };
-
-#else /* _WIN32 */
-
-/* XXX: use another file ? */
-#include <winioctl.h>
-
-#define FTYPE_FILE 0
-#define FTYPE_CD     1
-#define FTYPE_HARDDISK 2
-
-typedef struct BDRVRawState {
-    HANDLE hfile;
-    int type;
-    char drive_path[16]; /* format: "d:\" */
-} BDRVRawState;
-
-typedef struct RawAIOCB {
-    BlockDriverAIOCB common;
-    HANDLE hEvent;
-    OVERLAPPED ov;
-    int count;
-} RawAIOCB;
-
-int qemu_ftruncate64(int fd, int64_t length)
-{
-    LARGE_INTEGER li;
-    LONG high;
-    HANDLE h;
-    BOOL res;
-
-    if ((GetVersion() & 0x80000000UL) && (length >> 32) != 0)
-	return -1;
-
-    h = (HANDLE)_get_osfhandle(fd);
-
-    /* get current position, ftruncate do not change position */
-    li.HighPart = 0;
-    li.LowPart = SetFilePointer (h, 0, &li.HighPart, FILE_CURRENT);
-    if (li.LowPart == 0xffffffffUL && GetLastError() != NO_ERROR)
-	return -1;
-
-    high = length >> 32;
-    if (!SetFilePointer(h, (DWORD) length, &high, FILE_BEGIN))
-	return -1;
-    res = SetEndOfFile(h);
-
-    /* back to old position */
-    SetFilePointer(h, li.LowPart, &li.HighPart, FILE_BEGIN);
-    return res ? 0 : -1;
-}
-
-static int set_sparse(int fd)
-{
-    DWORD returned;
-    return (int) DeviceIoControl((HANDLE)_get_osfhandle(fd), FSCTL_SET_SPARSE,
-				 NULL, 0, NULL, 0, &returned, NULL);
-}
-
-static int raw_open(BlockDriverState *bs, const char *filename, int flags)
-{
-    BDRVRawState *s = bs->opaque;
-    int access_flags, create_flags;
-    DWORD overlapped;
-
-    s->type = FTYPE_FILE;
-
-    if ((flags & BDRV_O_ACCESS) == O_RDWR) {
-        access_flags = GENERIC_READ | GENERIC_WRITE;
-    } else {
-        access_flags = GENERIC_READ;
-    }
-    if (flags & BDRV_O_CREAT) {
-        create_flags = CREATE_ALWAYS;
-    } else {
-        create_flags = OPEN_EXISTING;
-    }
-#ifdef QEMU_TOOL
-    overlapped = FILE_ATTRIBUTE_NORMAL;
-#else
-    overlapped = FILE_FLAG_OVERLAPPED;
-#endif
-    s->hfile = CreateFile(filename, access_flags,
-                          FILE_SHARE_READ, NULL,
-                          create_flags, overlapped, NULL);
-    if (s->hfile == INVALID_HANDLE_VALUE) {
-        int err = GetLastError();
-
-        if (err == ERROR_ACCESS_DENIED)
-            return -EACCES;
-        return -1;
-    }
-    return 0;
-}
-
-static int raw_pread(BlockDriverState *bs, int64_t offset,
-                     uint8_t *buf, int count)
-{
-    BDRVRawState *s = bs->opaque;
-    OVERLAPPED ov;
-    DWORD ret_count;
-    int ret;
-
-    memset(&ov, 0, sizeof(ov));
-    ov.Offset = offset;
-    ov.OffsetHigh = offset >> 32;
-    ret = ReadFile(s->hfile, buf, count, &ret_count, &ov);
-    if (!ret) {
-        ret = GetOverlappedResult(s->hfile, &ov, &ret_count, TRUE);
-        if (!ret)
-            return -EIO;
-        else
-            return ret_count;
-    }
-    return ret_count;
-}
-
-static int raw_pwrite(BlockDriverState *bs, int64_t offset,
-                      const uint8_t *buf, int count)
-{
-    BDRVRawState *s = bs->opaque;
-    OVERLAPPED ov;
-    DWORD ret_count;
-    int ret;
-
-    memset(&ov, 0, sizeof(ov));
-    ov.Offset = offset;
-    ov.OffsetHigh = offset >> 32;
-    ret = WriteFile(s->hfile, buf, count, &ret_count, &ov);
-    if (!ret) {
-        ret = GetOverlappedResult(s->hfile, &ov, &ret_count, TRUE);
-        if (!ret)
-            return -EIO;
-        else
-            return ret_count;
-    }
-    return ret_count;
-}
-
-#if 0
-#ifndef QEMU_TOOL
-static void raw_aio_cb(void *opaque)
-{
-    RawAIOCB *acb = opaque;
-    BlockDriverState *bs = acb->common.bs;
-    BDRVRawState *s = bs->opaque;
-    DWORD ret_count;
-    int ret;
-
-    ret = GetOverlappedResult(s->hfile, &acb->ov, &ret_count, TRUE);
-    if (!ret || ret_count != acb->count) {
-        acb->common.cb(acb->common.opaque, -EIO);
-    } else {
-        acb->common.cb(acb->common.opaque, 0);
-    }
-}
-#endif
-
-static RawAIOCB *raw_aio_setup(BlockDriverState *bs,
-        int64_t sector_num, uint8_t *buf, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    RawAIOCB *acb;
-    int64_t offset;
-
-    acb = qemu_aio_get(bs, cb, opaque);
-    if (acb->hEvent) {
-        acb->hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
-        if (!acb->hEvent) {
-            qemu_aio_release(acb);
-            return NULL;
-        }
-    }
-    memset(&acb->ov, 0, sizeof(acb->ov));
-    offset = sector_num * 512;
-    acb->ov.Offset = offset;
-    acb->ov.OffsetHigh = offset >> 32;
-    acb->ov.hEvent = acb->hEvent;
-    acb->count = nb_sectors * 512;
-#ifndef QEMU_TOOL
-    qemu_add_wait_object(acb->ov.hEvent, raw_aio_cb, acb);
-#endif
-    return acb;
-}
-
-static BlockDriverAIOCB *raw_aio_read(BlockDriverState *bs,
-        int64_t sector_num, uint8_t *buf, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    BDRVRawState *s = bs->opaque;
-    RawAIOCB *acb;
-    int ret;
-
-    acb = raw_aio_setup(bs, sector_num, buf, nb_sectors, cb, opaque);
-    if (!acb)
-        return NULL;
-    ret = ReadFile(s->hfile, buf, acb->count, NULL, &acb->ov);
-    if (!ret) {
-        qemu_aio_release(acb);
-        return NULL;
-    }
-#ifdef QEMU_TOOL
-    qemu_aio_release(acb);
-#endif
-    return (BlockDriverAIOCB *)acb;
-}
-
-static BlockDriverAIOCB *raw_aio_write(BlockDriverState *bs,
-        int64_t sector_num, uint8_t *buf, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    BDRVRawState *s = bs->opaque;
-    RawAIOCB *acb;
-    int ret;
-
-    acb = raw_aio_setup(bs, sector_num, buf, nb_sectors, cb, opaque);
-    if (!acb)
-        return NULL;
-    ret = WriteFile(s->hfile, buf, acb->count, NULL, &acb->ov);
-    if (!ret) {
-        qemu_aio_release(acb);
-        return NULL;
-    }
-#ifdef QEMU_TOOL
-    qemu_aio_release(acb);
-#endif
-    return (BlockDriverAIOCB *)acb;
-}
-
-static void raw_aio_cancel(BlockDriverAIOCB *blockacb)
-{
-#ifndef QEMU_TOOL
-    RawAIOCB *acb = (RawAIOCB *)blockacb;
-    BlockDriverState *bs = acb->common.bs;
-    BDRVRawState *s = bs->opaque;
-
-    qemu_del_wait_object(acb->ov.hEvent, raw_aio_cb, acb);
-    /* XXX: if more than one async I/O it is not correct */
-    CancelIo(s->hfile);
-    qemu_aio_release(acb);
-#endif
-}
-#endif /* #if 0 */
-
-static void raw_flush(BlockDriverState *bs)
-{
-    BDRVRawState *s = bs->opaque;
-    FlushFileBuffers(s->hfile);
-}
-
-static void raw_close(BlockDriverState *bs)
-{
-    BDRVRawState *s = bs->opaque;
-    CloseHandle(s->hfile);
-}
-
-static int raw_truncate(BlockDriverState *bs, int64_t offset)
-{
-    BDRVRawState *s = bs->opaque;
-    DWORD low, high;
-
-    low = offset;
-    high = offset >> 32;
-    if (!SetFilePointer(s->hfile, low, &high, FILE_BEGIN))
-	return -EIO;
-    if (!SetEndOfFile(s->hfile))
-        return -EIO;
-    return 0;
-}
-
-static int64_t raw_getlength(BlockDriverState *bs)
-{
-    BDRVRawState *s = bs->opaque;
-    LARGE_INTEGER l;
-    ULARGE_INTEGER available, total, total_free;
-    DISK_GEOMETRY dg;
-    DWORD count;
-    BOOL status;
-
-    switch(s->type) {
-    case FTYPE_FILE:
-        l.LowPart = GetFileSize(s->hfile, &l.HighPart);
-        if (l.LowPart == 0xffffffffUL && GetLastError() != NO_ERROR)
-            return -EIO;
-        break;
-    case FTYPE_CD:
-        if (!GetDiskFreeSpaceEx(s->drive_path, &available, &total, &total_free))
-            return -EIO;
-        l.QuadPart = total.QuadPart;
-        break;
-    case FTYPE_HARDDISK:
-        status = DeviceIoControl(s->hfile, IOCTL_DISK_GET_DRIVE_GEOMETRY,
-                                 NULL, 0, &dg, sizeof(dg), &count, NULL);
-        if (status != FALSE) {
-            l.QuadPart = dg.Cylinders.QuadPart * dg.TracksPerCylinder
-                * dg.SectorsPerTrack * dg.BytesPerSector;
-        }
-        break;
-    default:
-        return -EIO;
-    }
-    return l.QuadPart;
-}
-
-static int raw_create(const char *filename, int64_t total_size,
-                      const char *backing_file, int flags)
-{
-    int fd;
-
-    if (flags || backing_file)
-        return -ENOTSUP;
-
-    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
-              0644);
-    if (fd < 0)
-        return -EIO;
-    set_sparse(fd);
-    ftruncate(fd, total_size * 512);
-    close(fd);
-    return 0;
-}
-
-void qemu_aio_init(void)
-{
-}
-
-void qemu_aio_poll(void)
-{
-}
-
-void qemu_aio_flush(void)
-{
-}
-
-void qemu_aio_wait_start(void)
-{
-}
-
-void qemu_aio_wait(void)
-{
-#ifndef QEMU_TOOL
-    qemu_bh_poll();
-#endif
-}
-
-void qemu_aio_wait_end(void)
-{
-}
-
-BlockDriver bdrv_raw = {
-    "raw",
-    sizeof(BDRVRawState),
-    NULL, /* no probe for protocols */
-    raw_open,
-    NULL,
-    NULL,
-    raw_close,
-    raw_create,
-    raw_flush,
-
-#if 0
-    .bdrv_aio_read = raw_aio_read,
-    .bdrv_aio_write = raw_aio_write,
-    .bdrv_aio_cancel = raw_aio_cancel,
-    .aiocb_size = sizeof(RawAIOCB);
-#endif
-    .protocol_name = "file",
-    .bdrv_pread = raw_pread,
-    .bdrv_pwrite = raw_pwrite,
-    .bdrv_truncate = raw_truncate,
-    .bdrv_getlength = raw_getlength,
-};
-
-/***********************************************/
-/* host device */
-
-static int find_cdrom(char *cdrom_name, int cdrom_name_size)
-{
-    char drives[256], *pdrv = drives;
-    UINT type;
-
-    memset(drives, 0, sizeof(drives));
-    GetLogicalDriveStrings(sizeof(drives), drives);
-    while(pdrv[0] != '\0') {
-        type = GetDriveType(pdrv);
-        switch(type) {
-        case DRIVE_CDROM:
-            snprintf(cdrom_name, cdrom_name_size, "\\\\.\\%c:", pdrv[0]);
-            return 0;
-            break;
-        }
-        pdrv += lstrlen(pdrv) + 1;
-    }
-    return -1;
-}
-
-static int find_device_type(BlockDriverState *bs, const char *filename)
-{
-    BDRVRawState *s = bs->opaque;
-    UINT type;
-    const char *p;
-
-    if (strstart(filename, "\\\\.\\", &p) ||
-        strstart(filename, "//./", &p)) {
-        if (stristart(p, "PhysicalDrive", NULL))
-            return FTYPE_HARDDISK;
-        snprintf(s->drive_path, sizeof(s->drive_path), "%c:\\", p[0]);
-        type = GetDriveType(s->drive_path);
-        if (type == DRIVE_CDROM)
-            return FTYPE_CD;
-        else
-            return FTYPE_FILE;
-    } else {
-        return FTYPE_FILE;
-    }
-}
-
-static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
-{
-    BDRVRawState *s = bs->opaque;
-    int access_flags, create_flags;
-    DWORD overlapped;
-    char device_name[64];
-
-    if (strstart(filename, "/dev/cdrom", NULL)) {
-        if (find_cdrom(device_name, sizeof(device_name)) < 0)
-            return -ENOENT;
-        filename = device_name;
-    } else {
-        /* transform drive letters into device name */
-        if (((filename[0] >= 'a' && filename[0] <= 'z') ||
-             (filename[0] >= 'A' && filename[0] <= 'Z')) &&
-            filename[1] == ':' && filename[2] == '\0') {
-            snprintf(device_name, sizeof(device_name), "\\\\.\\%c:", filename[0]);
-            filename = device_name;
-        }
-    }
-    s->type = find_device_type(bs, filename);
-
-    if ((flags & BDRV_O_ACCESS) == O_RDWR) {
-        access_flags = GENERIC_READ | GENERIC_WRITE;
-    } else {
-        access_flags = GENERIC_READ;
-    }
-    create_flags = OPEN_EXISTING;
-
-#ifdef QEMU_TOOL
-    overlapped = FILE_ATTRIBUTE_NORMAL;
-#else
-    overlapped = FILE_FLAG_OVERLAPPED;
-#endif
-    s->hfile = CreateFile(filename, access_flags,
-                          FILE_SHARE_READ, NULL,
-                          create_flags, overlapped, NULL);
-    if (s->hfile == INVALID_HANDLE_VALUE) {
-        int err = GetLastError();
-
-        if (err == ERROR_ACCESS_DENIED)
-            return -EACCES;
-        return -1;
-    }
-    return 0;
-}
-
-#if 0
-/***********************************************/
-/* removable device additional commands */
-
-static int raw_is_inserted(BlockDriverState *bs)
-{
-    return 1;
-}
-
-static int raw_media_changed(BlockDriverState *bs)
-{
-    return -ENOTSUP;
-}
-
-static int raw_eject(BlockDriverState *bs, int eject_flag)
-{
-    DWORD ret_count;
-
-    if (s->type == FTYPE_FILE)
-        return -ENOTSUP;
-    if (eject_flag) {
-        DeviceIoControl(s->hfile, IOCTL_STORAGE_EJECT_MEDIA,
-                        NULL, 0, NULL, 0, &lpBytesReturned, NULL);
-    } else {
-        DeviceIoControl(s->hfile, IOCTL_STORAGE_LOAD_MEDIA,
-                        NULL, 0, NULL, 0, &lpBytesReturned, NULL);
-    }
-}
-
-static int raw_set_locked(BlockDriverState *bs, int locked)
-{
-    return -ENOTSUP;
-}
-#endif
-
-BlockDriver bdrv_host_device = {
-    "host_device",
-    sizeof(BDRVRawState),
-    NULL, /* no probe for protocols */
-    hdev_open,
-    NULL,
-    NULL,
-    raw_close,
-    NULL,
-    raw_flush,
-
-#if 0
-    .bdrv_aio_read = raw_aio_read,
-    .bdrv_aio_write = raw_aio_write,
-    .bdrv_aio_cancel = raw_aio_cancel,
-    .aiocb_size = sizeof(RawAIOCB);
-#endif
-    .bdrv_pread = raw_pread,
-    .bdrv_pwrite = raw_pwrite,
-    .bdrv_getlength = raw_getlength,
-};
-#endif /* _WIN32 */
diff --git a/block-raw-win32.c b/block-raw-win32.c
new file mode 100644
index 000000000..db9995c04
--- /dev/null
+++ b/block-raw-win32.c
@@ -0,0 +1,544 @@
+/*
+ * Block driver for RAW files (win32)
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu-common.h"
+#ifndef QEMU_IMG
+#include "qemu-timer.h"
+#include "exec-all.h"
+#endif
+#include "block_int.h"
+#include <assert.h>
+#include <winioctl.h>
+
+#define FTYPE_FILE 0
+#define FTYPE_CD     1
+#define FTYPE_HARDDISK 2
+
+typedef struct BDRVRawState {
+    HANDLE hfile;
+    int type;
+    char drive_path[16]; /* format: "d:\" */
+} BDRVRawState;
+
+typedef struct RawAIOCB {
+    BlockDriverAIOCB common;
+    HANDLE hEvent;
+    OVERLAPPED ov;
+    int count;
+} RawAIOCB;
+
+int qemu_ftruncate64(int fd, int64_t length)
+{
+    LARGE_INTEGER li;
+    LONG high;
+    HANDLE h;
+    BOOL res;
+
+    if ((GetVersion() & 0x80000000UL) && (length >> 32) != 0)
+	return -1;
+
+    h = (HANDLE)_get_osfhandle(fd);
+
+    /* get current position, ftruncate do not change position */
+    li.HighPart = 0;
+    li.LowPart = SetFilePointer (h, 0, &li.HighPart, FILE_CURRENT);
+    if (li.LowPart == 0xffffffffUL && GetLastError() != NO_ERROR)
+	return -1;
+
+    high = length >> 32;
+    if (!SetFilePointer(h, (DWORD) length, &high, FILE_BEGIN))
+	return -1;
+    res = SetEndOfFile(h);
+
+    /* back to old position */
+    SetFilePointer(h, li.LowPart, &li.HighPart, FILE_BEGIN);
+    return res ? 0 : -1;
+}
+
+static int set_sparse(int fd)
+{
+    DWORD returned;
+    return (int) DeviceIoControl((HANDLE)_get_osfhandle(fd), FSCTL_SET_SPARSE,
+				 NULL, 0, NULL, 0, &returned, NULL);
+}
+
+static int raw_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVRawState *s = bs->opaque;
+    int access_flags, create_flags;
+    DWORD overlapped;
+
+    s->type = FTYPE_FILE;
+
+    if ((flags & BDRV_O_ACCESS) == O_RDWR) {
+        access_flags = GENERIC_READ | GENERIC_WRITE;
+    } else {
+        access_flags = GENERIC_READ;
+    }
+    if (flags & BDRV_O_CREAT) {
+        create_flags = CREATE_ALWAYS;
+    } else {
+        create_flags = OPEN_EXISTING;
+    }
+#ifdef QEMU_IMG
+    overlapped = FILE_ATTRIBUTE_NORMAL;
+#else
+    overlapped = FILE_FLAG_OVERLAPPED;
+#endif
+    s->hfile = CreateFile(filename, access_flags,
+                          FILE_SHARE_READ, NULL,
+                          create_flags, overlapped, NULL);
+    if (s->hfile == INVALID_HANDLE_VALUE) {
+        int err = GetLastError();
+
+        if (err == ERROR_ACCESS_DENIED)
+            return -EACCES;
+        return -1;
+    }
+    return 0;
+}
+
+static int raw_pread(BlockDriverState *bs, int64_t offset,
+                     uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    OVERLAPPED ov;
+    DWORD ret_count;
+    int ret;
+
+    memset(&ov, 0, sizeof(ov));
+    ov.Offset = offset;
+    ov.OffsetHigh = offset >> 32;
+    ret = ReadFile(s->hfile, buf, count, &ret_count, &ov);
+    if (!ret) {
+        ret = GetOverlappedResult(s->hfile, &ov, &ret_count, TRUE);
+        if (!ret)
+            return -EIO;
+        else
+            return ret_count;
+    }
+    return ret_count;
+}
+
+static int raw_pwrite(BlockDriverState *bs, int64_t offset,
+                      const uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    OVERLAPPED ov;
+    DWORD ret_count;
+    int ret;
+
+    memset(&ov, 0, sizeof(ov));
+    ov.Offset = offset;
+    ov.OffsetHigh = offset >> 32;
+    ret = WriteFile(s->hfile, buf, count, &ret_count, &ov);
+    if (!ret) {
+        ret = GetOverlappedResult(s->hfile, &ov, &ret_count, TRUE);
+        if (!ret)
+            return -EIO;
+        else
+            return ret_count;
+    }
+    return ret_count;
+}
+
+#if 0
+#ifndef QEMU_IMG
+static void raw_aio_cb(void *opaque)
+{
+    RawAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVRawState *s = bs->opaque;
+    DWORD ret_count;
+    int ret;
+
+    ret = GetOverlappedResult(s->hfile, &acb->ov, &ret_count, TRUE);
+    if (!ret || ret_count != acb->count) {
+        acb->common.cb(acb->common.opaque, -EIO);
+    } else {
+        acb->common.cb(acb->common.opaque, 0);
+    }
+}
+#endif
+
+static RawAIOCB *raw_aio_setup(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    RawAIOCB *acb;
+    int64_t offset;
+
+    acb = qemu_aio_get(bs, cb, opaque);
+    if (acb->hEvent) {
+        acb->hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
+        if (!acb->hEvent) {
+            qemu_aio_release(acb);
+            return NULL;
+        }
+    }
+    memset(&acb->ov, 0, sizeof(acb->ov));
+    offset = sector_num * 512;
+    acb->ov.Offset = offset;
+    acb->ov.OffsetHigh = offset >> 32;
+    acb->ov.hEvent = acb->hEvent;
+    acb->count = nb_sectors * 512;
+#ifndef QEMU_IMG
+    qemu_add_wait_object(acb->ov.hEvent, raw_aio_cb, acb);
+#endif
+    return acb;
+}
+
+static BlockDriverAIOCB *raw_aio_read(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BDRVRawState *s = bs->opaque;
+    RawAIOCB *acb;
+    int ret;
+
+    acb = raw_aio_setup(bs, sector_num, buf, nb_sectors, cb, opaque);
+    if (!acb)
+        return NULL;
+    ret = ReadFile(s->hfile, buf, acb->count, NULL, &acb->ov);
+    if (!ret) {
+        qemu_aio_release(acb);
+        return NULL;
+    }
+#ifdef QEMU_IMG
+    qemu_aio_release(acb);
+#endif
+    return (BlockDriverAIOCB *)acb;
+}
+
+static BlockDriverAIOCB *raw_aio_write(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BDRVRawState *s = bs->opaque;
+    RawAIOCB *acb;
+    int ret;
+
+    acb = raw_aio_setup(bs, sector_num, buf, nb_sectors, cb, opaque);
+    if (!acb)
+        return NULL;
+    ret = WriteFile(s->hfile, buf, acb->count, NULL, &acb->ov);
+    if (!ret) {
+        qemu_aio_release(acb);
+        return NULL;
+    }
+#ifdef QEMU_IMG
+    qemu_aio_release(acb);
+#endif
+    return (BlockDriverAIOCB *)acb;
+}
+
+static void raw_aio_cancel(BlockDriverAIOCB *blockacb)
+{
+#ifndef QEMU_IMG
+    RawAIOCB *acb = (RawAIOCB *)blockacb;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVRawState *s = bs->opaque;
+
+    qemu_del_wait_object(acb->ov.hEvent, raw_aio_cb, acb);
+    /* XXX: if more than one async I/O it is not correct */
+    CancelIo(s->hfile);
+    qemu_aio_release(acb);
+#endif
+}
+#endif /* #if 0 */
+
+static void raw_flush(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    FlushFileBuffers(s->hfile);
+}
+
+static void raw_close(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    CloseHandle(s->hfile);
+}
+
+static int raw_truncate(BlockDriverState *bs, int64_t offset)
+{
+    BDRVRawState *s = bs->opaque;
+    DWORD low, high;
+
+    low = offset;
+    high = offset >> 32;
+    if (!SetFilePointer(s->hfile, low, &high, FILE_BEGIN))
+	return -EIO;
+    if (!SetEndOfFile(s->hfile))
+        return -EIO;
+    return 0;
+}
+
+static int64_t raw_getlength(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    LARGE_INTEGER l;
+    ULARGE_INTEGER available, total, total_free;
+    DISK_GEOMETRY_EX dg;
+    DWORD count;
+    BOOL status;
+
+    switch(s->type) {
+    case FTYPE_FILE:
+        l.LowPart = GetFileSize(s->hfile, &l.HighPart);
+        if (l.LowPart == 0xffffffffUL && GetLastError() != NO_ERROR)
+            return -EIO;
+        break;
+    case FTYPE_CD:
+        if (!GetDiskFreeSpaceEx(s->drive_path, &available, &total, &total_free))
+            return -EIO;
+        l.QuadPart = total.QuadPart;
+        break;
+    case FTYPE_HARDDISK:
+        status = DeviceIoControl(s->hfile, IOCTL_DISK_GET_DRIVE_GEOMETRY_EX,
+                                 NULL, 0, &dg, sizeof(dg), &count, NULL);
+        if (status != 0) {
+            l = dg.DiskSize;
+        }
+        break;
+    default:
+        return -EIO;
+    }
+    return l.QuadPart;
+}
+
+static int raw_create(const char *filename, int64_t total_size,
+                      const char *backing_file, int flags)
+{
+    int fd;
+
+    if (flags || backing_file)
+        return -ENOTSUP;
+
+    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
+              0644);
+    if (fd < 0)
+        return -EIO;
+    set_sparse(fd);
+    ftruncate(fd, total_size * 512);
+    close(fd);
+    return 0;
+}
+
+void qemu_aio_init(void)
+{
+}
+
+void qemu_aio_poll(void)
+{
+}
+
+void qemu_aio_flush(void)
+{
+}
+
+void qemu_aio_wait_start(void)
+{
+}
+
+void qemu_aio_wait(void)
+{
+#ifndef QEMU_IMG
+    qemu_bh_poll();
+#endif
+}
+
+void qemu_aio_wait_end(void)
+{
+}
+
+BlockDriver bdrv_raw = {
+    "raw",
+    sizeof(BDRVRawState),
+    NULL, /* no probe for protocols */
+    raw_open,
+    NULL,
+    NULL,
+    raw_close,
+    raw_create,
+    raw_flush,
+
+#if 0
+    .bdrv_aio_read = raw_aio_read,
+    .bdrv_aio_write = raw_aio_write,
+    .bdrv_aio_cancel = raw_aio_cancel,
+    .aiocb_size = sizeof(RawAIOCB);
+#endif
+    .protocol_name = "file",
+    .bdrv_pread = raw_pread,
+    .bdrv_pwrite = raw_pwrite,
+    .bdrv_truncate = raw_truncate,
+    .bdrv_getlength = raw_getlength,
+};
+
+/***********************************************/
+/* host device */
+
+static int find_cdrom(char *cdrom_name, int cdrom_name_size)
+{
+    char drives[256], *pdrv = drives;
+    UINT type;
+
+    memset(drives, 0, sizeof(drives));
+    GetLogicalDriveStrings(sizeof(drives), drives);
+    while(pdrv[0] != '\0') {
+        type = GetDriveType(pdrv);
+        switch(type) {
+        case DRIVE_CDROM:
+            snprintf(cdrom_name, cdrom_name_size, "\\\\.\\%c:", pdrv[0]);
+            return 0;
+            break;
+        }
+        pdrv += lstrlen(pdrv) + 1;
+    }
+    return -1;
+}
+
+static int find_device_type(BlockDriverState *bs, const char *filename)
+{
+    BDRVRawState *s = bs->opaque;
+    UINT type;
+    const char *p;
+
+    if (strstart(filename, "\\\\.\\", &p) ||
+        strstart(filename, "//./", &p)) {
+        if (stristart(p, "PhysicalDrive", NULL))
+            return FTYPE_HARDDISK;
+        snprintf(s->drive_path, sizeof(s->drive_path), "%c:\\", p[0]);
+        type = GetDriveType(s->drive_path);
+        if (type == DRIVE_CDROM)
+            return FTYPE_CD;
+        else
+            return FTYPE_FILE;
+    } else {
+        return FTYPE_FILE;
+    }
+}
+
+static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVRawState *s = bs->opaque;
+    int access_flags, create_flags;
+    DWORD overlapped;
+    char device_name[64];
+
+    if (strstart(filename, "/dev/cdrom", NULL)) {
+        if (find_cdrom(device_name, sizeof(device_name)) < 0)
+            return -ENOENT;
+        filename = device_name;
+    } else {
+        /* transform drive letters into device name */
+        if (((filename[0] >= 'a' && filename[0] <= 'z') ||
+             (filename[0] >= 'A' && filename[0] <= 'Z')) &&
+            filename[1] == ':' && filename[2] == '\0') {
+            snprintf(device_name, sizeof(device_name), "\\\\.\\%c:", filename[0]);
+            filename = device_name;
+        }
+    }
+    s->type = find_device_type(bs, filename);
+
+    if ((flags & BDRV_O_ACCESS) == O_RDWR) {
+        access_flags = GENERIC_READ | GENERIC_WRITE;
+    } else {
+        access_flags = GENERIC_READ;
+    }
+    create_flags = OPEN_EXISTING;
+
+#ifdef QEMU_IMG
+    overlapped = FILE_ATTRIBUTE_NORMAL;
+#else
+    overlapped = FILE_FLAG_OVERLAPPED;
+#endif
+    s->hfile = CreateFile(filename, access_flags,
+                          FILE_SHARE_READ, NULL,
+                          create_flags, overlapped, NULL);
+    if (s->hfile == INVALID_HANDLE_VALUE) {
+        int err = GetLastError();
+
+        if (err == ERROR_ACCESS_DENIED)
+            return -EACCES;
+        return -1;
+    }
+    return 0;
+}
+
+#if 0
+/***********************************************/
+/* removable device additional commands */
+
+static int raw_is_inserted(BlockDriverState *bs)
+{
+    return 1;
+}
+
+static int raw_media_changed(BlockDriverState *bs)
+{
+    return -ENOTSUP;
+}
+
+static int raw_eject(BlockDriverState *bs, int eject_flag)
+{
+    DWORD ret_count;
+
+    if (s->type == FTYPE_FILE)
+        return -ENOTSUP;
+    if (eject_flag) {
+        DeviceIoControl(s->hfile, IOCTL_STORAGE_EJECT_MEDIA,
+                        NULL, 0, NULL, 0, &lpBytesReturned, NULL);
+    } else {
+        DeviceIoControl(s->hfile, IOCTL_STORAGE_LOAD_MEDIA,
+                        NULL, 0, NULL, 0, &lpBytesReturned, NULL);
+    }
+}
+
+static int raw_set_locked(BlockDriverState *bs, int locked)
+{
+    return -ENOTSUP;
+}
+#endif
+
+BlockDriver bdrv_host_device = {
+    "host_device",
+    sizeof(BDRVRawState),
+    NULL, /* no probe for protocols */
+    hdev_open,
+    NULL,
+    NULL,
+    raw_close,
+    NULL,
+    raw_flush,
+
+#if 0
+    .bdrv_aio_read = raw_aio_read,
+    .bdrv_aio_write = raw_aio_write,
+    .bdrv_aio_cancel = raw_aio_cancel,
+    .aiocb_size = sizeof(RawAIOCB);
+#endif
+    .bdrv_pread = raw_pread,
+    .bdrv_pwrite = raw_pwrite,
+    .bdrv_getlength = raw_getlength,
+};
diff --git a/block-vmdk.c b/block-vmdk.c
index 1f3709ced..b5a48aa6e 100644
--- a/block-vmdk.c
+++ b/block-vmdk.c
@@ -23,7 +23,7 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 #define VMDK3_MAGIC (('C' << 24) | ('O' << 16) | ('W' << 8) | 'D')
@@ -76,7 +76,6 @@ typedef struct BDRVVmdkState {
     unsigned int cluster_sectors;
     uint32_t parent_cid;
     int is_parent;
-    DiskIOStatistics io;
 } BDRVVmdkState;
 
 typedef struct VmdkMetaData {
@@ -94,13 +93,6 @@ typedef struct ActiveBDRVState{
 
 static ActiveBDRVState activeBDRV;
 
-DiskIOStatistics vmdk_io_statistics(BlockDriverState *bs)
-{
-    BDRVVmdkState *s = bs->opaque;
-    // return disk I/O counters
-    return s->io;
-}
-
 static int vmdk_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
     uint32_t magic;
@@ -651,7 +643,6 @@ static int vmdk_read(BlockDriverState *bs, int64_t sector_num,
         nb_sectors -= n;
         sector_num += n;
         buf += n * 512;
-        s->io.read_byte_counter += (uint64_t)(n*512);
     }
     return 0;
 }
@@ -692,7 +683,6 @@ static int vmdk_write(BlockDriverState *bs, int64_t sector_num,
         nb_sectors -= n;
         sector_num += n;
         buf += n * 512;
-        s->io.write_byte_counter += (uint64_t)(n*512);
 
         // update CID on the first write every time the virtual disk is opened
         if (!cid_update) {
diff --git a/block-vpc.c b/block-vpc.c
index be74c290d..f76c45112 100644
--- a/block-vpc.c
+++ b/block-vpc.c
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 /**************************************************************/
@@ -81,7 +81,7 @@ typedef struct BDRVVPCState {
 
 static int vpc_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
-    if (buf_size >= 8 && !strncmp(buf, "conectix", 8))
+    if (buf_size >= 8 && !strncmp((char *)buf, "conectix", 8))
 	return 100;
     return 0;
 }
diff --git a/block-vvfat.c b/block-vvfat.c
index 3237c266c..708f031fd 100644
--- a/block-vvfat.c
+++ b/block-vvfat.c
@@ -25,7 +25,7 @@
 #include <sys/stat.h>
 #include <dirent.h>
 #include <assert.h>
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 #ifndef S_IWGRP
@@ -175,7 +175,7 @@ static inline int array_roll(array_t* array,int index_to,int index_from,int coun
     return 0;
 }
 
-inline int array_remove_slice(array_t* array,int index, int count)
+static inline int array_remove_slice(array_t* array,int index, int count)
 {
     assert(index >=0);
     assert(count > 0);
@@ -186,13 +186,13 @@ inline int array_remove_slice(array_t* array,int index, int count)
     return 0;
 }
 
-int array_remove(array_t* array,int index)
+static int array_remove(array_t* array,int index)
 {
     return array_remove_slice(array, index, 1);
 }
 
 /* return the index for a given member */
-int array_index(array_t* array, void* pointer)
+static int array_index(array_t* array, void* pointer)
 {
     size_t offset = (char*)pointer - array->pointer;
     assert(offset >= 0);
@@ -412,7 +412,7 @@ static void init_mbr(BDRVVVFATState* s)
 /* direntry functions */
 
 /* dest is assumed to hold 258 bytes, and pads with 0xffff up to next multiple of 26 */
-static inline int short2long_name(unsigned char* dest,const char* src)
+static inline int short2long_name(char* dest,const char* src)
 {
     int i;
     for(i=0;i<129 && src[i];i++) {
@@ -565,7 +565,7 @@ static inline uint32_t fat_get(BDRVVVFATState* s,unsigned int cluster)
 	uint16_t* entry=array_get(&(s->fat),cluster);
 	return le16_to_cpu(*entry);
     } else {
-	const uint8_t* x=s->fat.pointer+cluster*3/2;
+	const uint8_t* x=(uint8_t*)(s->fat.pointer)+cluster*3/2;
 	return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
     }
 }
@@ -626,7 +626,7 @@ static inline direntry_t* create_short_and_long_name(BDRVVVFATState* s,
 
     entry=array_get_next(&(s->directory));
     memset(entry->name,0x20,11);
-    strncpy(entry->name,filename,i);
+    strncpy((char*)entry->name,filename,i);
 
     if(j > 0)
 	for (i = 0; i < 3 && filename[j+1+i]; i++)
@@ -868,7 +868,7 @@ static int init_directories(BDRVVVFATState* s,
     {
 	direntry_t* entry=array_get_next(&(s->directory));
 	entry->attributes=0x28; /* archive | volume label */
-	snprintf(entry->name,11,"QEMU VVFAT");
+	snprintf((char*)entry->name,11,"QEMU VVFAT");
     }
 
     /* Now build FAT, and write back information into directory */
@@ -1187,7 +1187,7 @@ static inline int read_cluster(BDRVVVFATState *s,int cluster_num)
 		s->current_mapping = mapping;
 read_cluster_directory:
 		offset = s->cluster_size*(cluster_num-s->current_mapping->begin);
-		s->cluster = s->directory.pointer+offset
+		s->cluster = (unsigned char*)s->directory.pointer+offset
 			+ 0x20*s->current_mapping->info.dir.first_dir_index;
 		assert(((s->cluster-(unsigned char*)s->directory.pointer)%s->cluster_size)==0);
 		assert((char*)s->cluster+s->cluster_size <= s->directory.pointer+s->directory.next*s->directory.item_size);
@@ -1457,7 +1457,7 @@ static int parse_long_name(long_file_name* lfn,
     }
 
     if (pointer[0] & 0x40)
-	lfn->len = offset + strlen(lfn->name + offset);
+	lfn->len = offset + strlen((char*)lfn->name + offset);
 
     return 0;
 }
@@ -1496,7 +1496,7 @@ static int parse_short_name(BDRVVVFATState* s,
     } else
 	lfn->name[i + j + 1] = '\0';
 
-    lfn->len = strlen(lfn->name);
+    lfn->len = strlen((char*)lfn->name);
 
     return 0;
 }
@@ -1792,8 +1792,8 @@ DLOG(fprintf(stderr, "check direntry %d: \n", i); print_direntry(direntries + i)
 		    fprintf(stderr, "Error in short name (%d)\n", subret);
 		    goto fail;
 		}
-		if (subret > 0 || !strcmp(lfn.name, ".")
-			|| !strcmp(lfn.name, ".."))
+		if (subret > 0 || !strcmp((char*)lfn.name, ".")
+			|| !strcmp((char*)lfn.name, ".."))
 		    continue;
 	    }
 	    lfn.checksum = 0x100; /* cannot use long name twice */
@@ -1802,7 +1802,7 @@ DLOG(fprintf(stderr, "check direntry %d: \n", i); print_direntry(direntries + i)
 		fprintf(stderr, "Name too long: %s/%s\n", path, lfn.name);
 		goto fail;
 	    }
-	    strcpy(path2 + path_len + 1, lfn.name);
+	    strcpy(path2 + path_len + 1, (char*)lfn.name);
 
 	    if (is_directory(direntries + i)) {
 		if (begin_of_direntry(direntries + i) == 0) {
@@ -2234,7 +2234,7 @@ static int commit_one_file(BDRVVVFATState* s,
 	assert(size >= 0);
 
 	ret = vvfat_read(s->bs, cluster2sector(s, c),
-	    cluster, (rest_size + 0x1ff) / 0x200);
+	    (uint8_t*)cluster, (rest_size + 0x1ff) / 0x200);
 
 	if (ret < 0)
 	    return ret;
diff --git a/block.c b/block.c
index 20d2e1ce0..24d78fc2e 100644
--- a/block.c
+++ b/block.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#ifndef QEMU_IMG
+#include "console.h"
+#endif
 #include "block_int.h"
 
 #ifdef _BSD
@@ -53,7 +56,7 @@ static int bdrv_read_em(BlockDriverState *bs, int64_t sector_num,
 static int bdrv_write_em(BlockDriverState *bs, int64_t sector_num,
                          const uint8_t *buf, int nb_sectors);
 
-static BlockDriverState *bdrv_first;
+BlockDriverState *bdrv_first;
 static BlockDriver *first_drv;
 
 int path_is_absolute(const char *path)
@@ -121,7 +124,7 @@ void path_combine(char *dest, int dest_size,
 }
 
 
-void bdrv_register(BlockDriver *bdrv)
+static void bdrv_register(BlockDriver *bdrv)
 {
     if (!bdrv->bdrv_aio_read) {
         /* add AIO emulation layer */
@@ -518,8 +521,11 @@ int bdrv_read(BlockDriverState *bs, int64_t sector_num,
             return ret;
         else if (ret != len)
             return -EINVAL;
-        else
+        else {
+	    bs->rd_bytes += (unsigned) len;
+	    bs->rd_ops ++;
             return 0;
+	}
     } else {
         return drv->bdrv_read(bs, sector_num, buf, nb_sectors);
     }
@@ -550,8 +556,11 @@ int bdrv_write(BlockDriverState *bs, int64_t sector_num,
             return ret;
         else if (ret != len)
             return -EIO;
-        else
+        else {
+	    bs->wr_bytes += (unsigned) len;
+	    bs->wr_ops ++;
             return 0;
+	}
     } else {
         return drv->bdrv_write(bs, sector_num, buf, nb_sectors);
     }
@@ -874,6 +883,7 @@ void bdrv_flush_all(void)
     bdrv_iterate_writeable(bdrv_flush);
 }
 
+#ifndef QEMU_IMG
 void bdrv_info(void)
 {
     BlockDriverState *bs;
@@ -914,6 +924,25 @@ void bdrv_info(void)
     }
 }
 
+/* The "info blockstats" command. */
+void bdrv_info_stats (void)
+{
+    BlockDriverState *bs;
+
+    for (bs = bdrv_first; bs != NULL; bs = bs->next) {
+	term_printf ("%s:"
+		     " rd_bytes=%" PRIu64
+		     " wr_bytes=%" PRIu64
+		     " rd_operations=%" PRIu64
+		     " wr_operations=%" PRIu64
+		     "\n",
+		     bs->device_name,
+		     bs->rd_bytes, bs->wr_bytes,
+		     bs->rd_ops, bs->wr_ops);
+    }
+}
+#endif
+
 void bdrv_get_backing_filename(BlockDriverState *bs,
                                char *filename, int filename_size)
 {
@@ -1074,6 +1103,7 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num,
                                 BlockDriverCompletionFunc *cb, void *opaque)
 {
     BlockDriver *drv = bs->drv;
+    BlockDriverAIOCB *ret;
 
     if (!drv)
         return NULL;
@@ -1086,7 +1116,15 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num,
         buf += 512;
     }
 
-    return drv->bdrv_aio_read(bs, sector_num, buf, nb_sectors, cb, opaque);
+    ret = drv->bdrv_aio_read(bs, sector_num, buf, nb_sectors, cb, opaque);
+
+    if (ret) {
+	/* Update stats even though technically transfer has not happened. */
+	bs->rd_bytes += (unsigned) nb_sectors * SECTOR_SIZE;
+	bs->rd_ops ++;
+    }
+
+    return ret;
 }
 
 BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,
@@ -1094,6 +1132,7 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,
                                  BlockDriverCompletionFunc *cb, void *opaque)
 {
     BlockDriver *drv = bs->drv;
+    BlockDriverAIOCB *ret;
 
     if (!drv)
         return NULL;
@@ -1103,7 +1142,15 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,
         memcpy(bs->boot_sector_data, buf, 512);
     }
 
-    return drv->bdrv_aio_write(bs, sector_num, buf, nb_sectors, cb, opaque);
+    ret = drv->bdrv_aio_write(bs, sector_num, buf, nb_sectors, cb, opaque);
+
+    if (ret) {
+	/* Update stats even though technically transfer has not happened. */
+	bs->wr_bytes += (unsigned) nb_sectors * SECTOR_SIZE;
+	bs->wr_ops ++;
+    }
+
+    return ret;
 }
 
 void bdrv_aio_cancel(BlockDriverAIOCB *acb)
@@ -1117,7 +1164,7 @@ void bdrv_aio_cancel(BlockDriverAIOCB *acb)
 /**************************************************************/
 /* async block device emulation */
 
-#ifdef QEMU_TOOL
+#ifdef QEMU_IMG
 static BlockDriverAIOCB *bdrv_aio_read_em(BlockDriverState *bs,
         int64_t sector_num, uint8_t *buf, int nb_sectors,
         BlockDriverCompletionFunc *cb, void *opaque)
@@ -1187,7 +1234,7 @@ static void bdrv_aio_cancel_em(BlockDriverAIOCB *blockacb)
     qemu_bh_cancel(acb->bh);
     qemu_aio_release(acb);
 }
-#endif /* !QEMU_TOOL */
+#endif /* !QEMU_IMG */
 
 /**************************************************************/
 /* sync block device emulation */
diff --git a/block.h b/block.h
new file mode 100644
index 000000000..f98639a89
--- /dev/null
+++ b/block.h
@@ -0,0 +1,157 @@
+#ifndef BLOCK_H
+#define BLOCK_H
+
+/* block.c */
+typedef struct BlockDriver BlockDriver;
+
+extern BlockDriver bdrv_raw;
+extern BlockDriver bdrv_host_device;
+extern BlockDriver bdrv_cow;
+extern BlockDriver bdrv_qcow;
+extern BlockDriver bdrv_vmdk;
+extern BlockDriver bdrv_cloop;
+extern BlockDriver bdrv_dmg;
+extern BlockDriver bdrv_bochs;
+extern BlockDriver bdrv_vpc;
+extern BlockDriver bdrv_vvfat;
+extern BlockDriver bdrv_qcow2;
+extern BlockDriver bdrv_parallels;
+
+typedef struct BlockDriverInfo {
+    /* in bytes, 0 if irrelevant */
+    int cluster_size;
+    /* offset at which the VM state can be saved (0 if not possible) */
+    int64_t vm_state_offset;
+} BlockDriverInfo;
+
+typedef struct QEMUSnapshotInfo {
+    char id_str[128]; /* unique snapshot id */
+    /* the following fields are informative. They are not needed for
+       the consistency of the snapshot */
+    char name[256]; /* user choosen name */
+    uint32_t vm_state_size; /* VM state info size */
+    uint32_t date_sec; /* UTC date of the snapshot */
+    uint32_t date_nsec;
+    uint64_t vm_clock_nsec; /* VM clock relative to boot */
+} QEMUSnapshotInfo;
+
+#define BDRV_O_RDONLY      0x0000
+#define BDRV_O_RDWR        0x0002
+#define BDRV_O_ACCESS      0x0003
+#define BDRV_O_CREAT       0x0004 /* create an empty file */
+#define BDRV_O_SNAPSHOT    0x0008 /* open the file read only and save writes in a snapshot */
+#define BDRV_O_FILE        0x0010 /* open as a raw file (do not try to
+                                     use a disk image format on top of
+                                     it (default for
+                                     bdrv_file_open()) */
+
+#ifndef QEMU_IMG
+void bdrv_info(void);
+void bdrv_info_stats(void);
+#endif
+
+void bdrv_init(void);
+BlockDriver *bdrv_find_format(const char *format_name);
+int bdrv_create(BlockDriver *drv,
+                const char *filename, int64_t size_in_sectors,
+                const char *backing_file, int flags);
+BlockDriverState *bdrv_new(const char *device_name);
+void bdrv_delete(BlockDriverState *bs);
+int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags);
+int bdrv_open(BlockDriverState *bs, const char *filename, int flags);
+int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
+               BlockDriver *drv);
+void bdrv_close(BlockDriverState *bs);
+int bdrv_read(BlockDriverState *bs, int64_t sector_num,
+              uint8_t *buf, int nb_sectors);
+int bdrv_write(BlockDriverState *bs, int64_t sector_num,
+               const uint8_t *buf, int nb_sectors);
+int bdrv_pread(BlockDriverState *bs, int64_t offset,
+               void *buf, int count);
+int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
+                const void *buf, int count);
+int bdrv_truncate(BlockDriverState *bs, int64_t offset);
+int64_t bdrv_getlength(BlockDriverState *bs);
+void bdrv_get_geometry(BlockDriverState *bs, int64_t *nb_sectors_ptr);
+int bdrv_commit(BlockDriverState *bs);
+void bdrv_set_boot_sector(BlockDriverState *bs, const uint8_t *data, int size);
+/* async block I/O */
+typedef struct BlockDriverAIOCB BlockDriverAIOCB;
+typedef void BlockDriverCompletionFunc(void *opaque, int ret);
+
+BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num,
+                                uint8_t *buf, int nb_sectors,
+                                BlockDriverCompletionFunc *cb, void *opaque);
+BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,
+                                 const uint8_t *buf, int nb_sectors,
+                                 BlockDriverCompletionFunc *cb, void *opaque);
+void bdrv_aio_cancel(BlockDriverAIOCB *acb);
+
+void qemu_aio_init(void);
+void qemu_aio_poll(void);
+void qemu_aio_flush(void);
+void qemu_aio_wait_start(void);
+void qemu_aio_wait(void);
+void qemu_aio_wait_end(void);
+
+int qemu_key_check(BlockDriverState *bs, const char *name);
+
+/* Ensure contents are flushed to disk.  */
+void bdrv_flush(BlockDriverState *bs);
+
+#define BDRV_TYPE_HD     0
+#define BDRV_TYPE_CDROM  1
+#define BDRV_TYPE_FLOPPY 2
+#define BIOS_ATA_TRANSLATION_AUTO   0
+#define BIOS_ATA_TRANSLATION_NONE   1
+#define BIOS_ATA_TRANSLATION_LBA    2
+#define BIOS_ATA_TRANSLATION_LARGE  3
+#define BIOS_ATA_TRANSLATION_RECHS  4
+
+void bdrv_set_geometry_hint(BlockDriverState *bs,
+                            int cyls, int heads, int secs);
+void bdrv_set_type_hint(BlockDriverState *bs, int type);
+void bdrv_set_translation_hint(BlockDriverState *bs, int translation);
+void bdrv_get_geometry_hint(BlockDriverState *bs,
+                            int *pcyls, int *pheads, int *psecs);
+int bdrv_get_type_hint(BlockDriverState *bs);
+int bdrv_get_translation_hint(BlockDriverState *bs);
+int bdrv_is_removable(BlockDriverState *bs);
+int bdrv_is_read_only(BlockDriverState *bs);
+int bdrv_is_inserted(BlockDriverState *bs);
+int bdrv_media_changed(BlockDriverState *bs);
+int bdrv_is_locked(BlockDriverState *bs);
+void bdrv_set_locked(BlockDriverState *bs, int locked);
+void bdrv_eject(BlockDriverState *bs, int eject_flag);
+void bdrv_set_change_cb(BlockDriverState *bs,
+                        void (*change_cb)(void *opaque), void *opaque);
+void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
+BlockDriverState *bdrv_find(const char *name);
+void bdrv_iterate(void (*it)(void *opaque, const char *name), void *opaque);
+int bdrv_is_encrypted(BlockDriverState *bs);
+int bdrv_set_key(BlockDriverState *bs, const char *key);
+void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
+                         void *opaque);
+const char *bdrv_get_device_name(BlockDriverState *bs);
+int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
+                          const uint8_t *buf, int nb_sectors);
+int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi);
+
+void bdrv_get_backing_filename(BlockDriverState *bs,
+                               char *filename, int filename_size);
+int bdrv_snapshot_create(BlockDriverState *bs,
+                         QEMUSnapshotInfo *sn_info);
+int bdrv_snapshot_goto(BlockDriverState *bs,
+                       const char *snapshot_id);
+int bdrv_snapshot_delete(BlockDriverState *bs, const char *snapshot_id);
+int bdrv_snapshot_list(BlockDriverState *bs,
+                       QEMUSnapshotInfo **psn_info);
+char *bdrv_snapshot_dump(char *buf, int buf_size, QEMUSnapshotInfo *sn);
+
+char *get_human_readable_size(char *buf, int buf_size, int64_t size);
+int path_is_absolute(const char *path);
+void path_combine(char *dest, int dest_size,
+                  const char *base_path,
+                  const char *filename);
+
+#endif
diff --git a/block_int.h b/block_int.h
index b034023e0..9463ea3aa 100644
--- a/block_int.h
+++ b/block_int.h
@@ -24,6 +24,8 @@
 #ifndef BLOCK_INT_H
 #define BLOCK_INT_H
 
+#include "block.h"
+
 #define BLOCK_FLAG_ENCRYPT	1
 #define BLOCK_FLAG_COMPRESS	2
 #define BLOCK_FLAG_COMPAT6	4
@@ -112,6 +114,12 @@ struct BlockDriverState {
 
     void *sync_aiocb;
 
+    /* I/O stats (display with "info blockstats"). */
+    uint64_t rd_bytes;
+    uint64_t wr_bytes;
+    uint64_t rd_ops;
+    uint64_t wr_ops;
+
     /* NOTE: the following infos are only hints for real hardware
        drivers. They are not used by the block driver */
     int cyls, heads, secs, translation;
@@ -133,4 +141,6 @@ void *qemu_aio_get(BlockDriverState *bs, BlockDriverCompletionFunc *cb,
                    void *opaque);
 void qemu_aio_release(void *p);
 
+BlockDriverState *bdrv_first;
+
 #endif /* BLOCK_INT_H */
diff --git a/check_ops.sh b/check_ops.sh
index b1f2f8500..1c9cf87e3 100755
--- a/check_ops.sh
+++ b/check_ops.sh
@@ -35,6 +35,9 @@ case $machine in
   mips*)
     ret='\tjr.*ra'
     ;;
+  s390*)
+    ret='\tbr.*'
+    ;;
   *)
     echo "Unknown machine `uname -m`"
     ;;
diff --git a/cocoa.m b/cocoa.m
index 84f943c5b..d26b45260 100644
--- a/cocoa.m
+++ b/cocoa.m
@@ -37,7 +37,9 @@
 
 #import <Cocoa/Cocoa.h>
 
-#include "vl.h"
+#include "qemu-common.h"
+#include "console.h"
+#include "sysemu.h"
 
 NSWindow *window = NULL;
 NSQuickDrawView *qd_view = NULL;
diff --git a/configure b/configure
index 893102148..c05dcc4a5 100755
--- a/configure
+++ b/configure
@@ -23,7 +23,7 @@ static="no"
 cross_prefix=""
 cc="gcc"
 gcc3_search="yes"
-gcc3_list="gcc-3.4 gcc34 gcc-3.3.6 gcc-3.3 gcc33 gcc-3.2 gcc32"
+gcc3_list="gcc-3.4.6 gcc-3.4 gcc34 gcc-3.3.6 gcc-3.3 gcc33 gcc-3.2 gcc32"
 host_cc="gcc"
 ar="ar"
 make="make"
@@ -53,6 +53,9 @@ case "$cpu" in
   mips64)
     cpu="mips64"
   ;;
+  cris)
+    cpu="cris"
+  ;;
   s390*)
     cpu="s390"
   ;;
@@ -219,6 +222,12 @@ else
     source_path_used="yes"
 fi
 
+werror="no"
+# generate compile errors on warnings for development builds
+#if grep cvs $source_path/VERSION > /dev/null 2>&1 ; then
+#werror="yes";
+#fi
+
 for opt do
   optarg=`expr "x$opt" : 'x[^=]*=\(.*\)'`
   case "$opt" in
@@ -316,18 +325,28 @@ for opt do
         *)     echo "undefined SPARC architecture. Exiting";exit 1;;
       esac
   ;;
+  --enable-werror) werror="yes"
+  ;;
+  --disable-werror) werror="no"
+  ;;
+  *) echo "ERROR: unknown option $opt"; show_help="yes"
+  ;;
   esac
 done
 
 if [ "$bsd" = "yes" -o "$darwin" = "yes" -o "$mingw32" = "yes" ] ; then
     AIOLIBS=
 else
-    AIOLIBS="-lrt"
+    # Some Linux architectures (e.g. s390) don't imply -lpthread automatically.
+    AIOLIBS="-lrt -lpthread"
 fi
 
 # default flags for all hosts
 CFLAGS="$CFLAGS -Wall -O2 -g -fno-strict-aliasing"
 LDFLAGS="$LDFLAGS -g"
+if test "$werror" = "yes" ; then
+CFLAGS="$CFLAGS -Werror"
+fi
 
 #
 # If cpu ~= sparc and  sparc_cpu hasn't been defined, plug in the right
@@ -350,11 +369,15 @@ case $cpu in
                ARCH_LDFLAGS="${SP_LDFLAGS}"
            fi
            ;;
+    s390)
+           ARCH_CFLAGS="-march=z900"
+           ;;
 esac
 
 if [ "$solaris" = "yes" -a  "$cpu" = "x86_64" ] ; then
     CFLAGS="${CFLAGS} -m64"
     OS_CFLAGS="${OS_CFLAGS} -m64"
+    OS_LDFLAGS="${OS_LDFLAGS} -m64"
 fi
 
 if [ "$solaris" = "yes" -a  "$cpu" = "i386" ] ; then
@@ -389,6 +412,8 @@ echo "  --host-cc=CC             use C compiler CC [$host_cc] for dyngen etc."
 echo "  --make=MAKE              use specified make [$make]"
 echo "  --install=INSTALL        use specified install [$install]"
 echo "  --static                 enable static build [$static]"
+echo "  --disable-werror         disable compilation abort on warning"
+echo "  --disable-sdl            disable SDL"
 echo "  --enable-cocoa           enable COCOA (Mac OS X only)"
 echo "  --enable-mingw32         enable Win32 cross compilation with mingw32"
 echo "  --enable-adlib           enable Adlib emulation"
@@ -512,11 +537,11 @@ fi
 if test -z "$target_list" ; then
 # these targets are portable
     if [ "$softmmu" = "yes" ] ; then
-        target_list="i386-softmmu ppc-softmmu sparc-softmmu x86_64-softmmu mips-softmmu mipsel-softmmu mips64-softmmu mips64el-softmmu arm-softmmu ppc64-softmmu ppcemb-softmmu m68k-softmmu sh4-softmmu"
+        target_list="i386-softmmu sparc-softmmu x86_64-softmmu mips-softmmu mipsel-softmmu mips64-softmmu mips64el-softmmu arm-softmmu ppc-softmmu ppcemb-softmmu ppc64-softmmu m68k-softmmu sh4-softmmu sh4eb-softmmu cris-softmmu"
     fi
 # the following are Linux specific
     if [ "$linux_user" = "yes" ] ; then
-        target_list="i386-linux-user arm-linux-user armeb-linux-user sparc-linux-user ppc-linux-user mips-linux-user mipsel-linux-user m68k-linux-user alpha-linux-user ppc64-linux-user sh4-linux-user $target_list"
+        target_list="i386-linux-user arm-linux-user armeb-linux-user sparc-linux-user sparc64-linux-user sparc32plus-linux-user mips-linux-user mipsel-linux-user m68k-linux-user alpha-linux-user sh4-linux-user sh4eb-linux-user ppc-linux-user ppc64-linux-user ppc64abi32-linux-user x86_64-linux-user cris-linux-user $target_list"
     fi
 # the following are Darwin specific
     if [ "$darwin_user" = "yes" ] ; then
@@ -590,7 +615,7 @@ cat > $TMPC << EOF
 #undef main /* We don't want SDL to override our main() */
 int main( void ) { return SDL_Init (SDL_INIT_VIDEO); }
 EOF
-        if $cc -o $TMPE `$sdl_config --cflags 2> /dev/null` $TMPC `$sdl_config --libs 2> /dev/null` 2> /tmp/qemu-$$-sdl-config.log ; then
+        if $cc -o $TMPE ${OS_CFLAGS} `$sdl_config --cflags 2> /dev/null` $TMPC `$sdl_config --libs 2> /dev/null` 2> /tmp/qemu-$$-sdl-config.log ; then
             _sdlversion=`$sdl_config --version | sed 's/[^0-9]//g'`
             if test "$_sdlversion" -lt 121 ; then
                 sdl_too_old=yes
@@ -609,7 +634,7 @@ EOF
                     sdl_static_libs="$sdl_static_libs `aalib-config --static-libs`"
                 fi
 
-                if $cc -o $TMPE `$sdl_config --cflags 2> /dev/null` $TMPC $sdl_static_libs 2> /dev/null; then
+                if $cc -o $TMPE ${OS_CFLAGS} `$sdl_config --cflags 2> /dev/null` $TMPC $sdl_static_libs 2> /dev/null; then
                     sdl_static=yes
                 fi
             fi # static link
@@ -694,6 +719,7 @@ echo "target list       $target_list"
 echo "gprof enabled     $gprof"
 echo "profiler          $profiler"
 echo "static build      $static"
+echo "-Werror enabled   $werror"
 if test "$darwin" = "yes" ; then
     echo "Cocoa support     $cocoa"
 fi
@@ -798,6 +824,9 @@ elif test "$cpu" = "mips" ; then
 elif test "$cpu" = "mips64" ; then
   echo "ARCH=mips64" >> $config_mak
   echo "#define HOST_MIPS64 1" >> $config_h
+elif test "$cpu" = "cris" ; then
+  echo "ARCH=cris" >> $config_mak
+  echo "#define HOST_CRIS 1" >> $config_h
 elif test "$cpu" = "s390" ; then
   echo "ARCH=s390" >> $config_mak
   echo "#define HOST_S390 1" >> $config_h
@@ -917,6 +946,29 @@ echo "TARGET_DIRS=$target_list" >> $config_mak
 if [ "$build_docs" = "yes" ] ; then
   echo "BUILD_DOCS=yes" >> $config_mak
 fi
+if test "$static" = "yes"; then
+  sdl1=$sdl_static
+else
+  sdl1=$sdl
+fi
+if test "$sdl1" = "yes" ; then
+  echo "#define CONFIG_SDL 1" >> $config_h
+  echo "CONFIG_SDL=yes" >> $config_mak
+  if test "$target_softmmu" = "no" -o "$static" = "yes"; then
+    echo "SDL_LIBS=$sdl_static_libs" >> $config_mak
+  else
+    echo "SDL_LIBS=`$sdl_config --libs`" >> $config_mak
+  fi
+  if [ "${aa}" = "yes" ] ; then
+    echo "SDL_CFLAGS=`$sdl_config --cflags` `aalib-config --cflags`" >> $config_mak
+  else
+    echo "SDL_CFLAGS=`$sdl_config --cflags`" >> $config_mak
+  fi
+fi
+if test "$cocoa" = "yes" ; then
+    echo "#define CONFIG_COCOA 1" >> $config_h
+    echo "CONFIG_COCOA=yes" >> $config_mak
+fi
 
 # XXX: suppress that
 if [ "$bsd" = "yes" ] ; then
@@ -944,9 +996,11 @@ target_bigendian="no"
 [ "$target_cpu" = "armeb" ] && target_bigendian=yes
 [ "$target_cpu" = "sparc" ] && target_bigendian=yes
 [ "$target_cpu" = "sparc64" ] && target_bigendian=yes
+[ "$target_cpu" = "sparc32plus" ] && target_bigendian=yes
 [ "$target_cpu" = "ppc" ] && target_bigendian=yes
-[ "$target_cpu" = "ppc64" ] && target_bigendian=yes
 [ "$target_cpu" = "ppcemb" ] && target_bigendian=yes
+[ "$target_cpu" = "ppc64" ] && target_bigendian=yes
+[ "$target_cpu" = "ppc64abi32" ] && target_bigendian=yes
 [ "$target_cpu" = "mips" ] && target_bigendian=yes
 [ "$target_cpu" = "mipsn32" ] && target_bigendian=yes
 [ "$target_cpu" = "mips64" ] && target_bigendian=yes
@@ -991,9 +1045,6 @@ mkdir -p $target_dir/fpu
 if test "$target" = "arm-linux-user" -o "$target" = "armeb-linux-user" ; then
   mkdir -p $target_dir/nwfpe
 fi
-if test "$target_user_only" = "no" ; then
-  mkdir -p $target_dir/slirp
-fi
 
 #
 # don't use ln -sf as not all "ln -sf" over write the file/link
@@ -1010,6 +1061,7 @@ echo "include ../config-host.mak" >> $config_mak
 echo "#include \"../config-host.h\"" >> $config_h
 
 bflt="no"
+elfload32="no"
 interp_prefix1=`echo "$interp_prefix" | sed "s/%M/$target_cpu/g"`
 echo "#define CONFIG_QEMU_PREFIX \"$interp_prefix1\"" >> $config_h
 
@@ -1048,20 +1100,37 @@ elif test "$target_cpu" = "sparc64" ; then
   echo "#define TARGET_ARCH \"sparc64\"" >> $config_h
   echo "#define TARGET_SPARC 1" >> $config_h
   echo "#define TARGET_SPARC64 1" >> $config_h
+  elfload32="yes"
+elif test "$target_cpu" = "sparc32plus" ; then
+  echo "TARGET_ARCH=sparc64" >> $config_mak
+  echo "TARGET_ABI_DIR=sparc" >> $config_mak
+  echo "#define TARGET_ARCH \"sparc64\"" >> $config_h
+  echo "#define TARGET_SPARC 1" >> $config_h
+  echo "#define TARGET_SPARC64 1" >> $config_h
+  echo "#define TARGET_ABI32 1" >> $config_h
 elif test "$target_cpu" = "ppc" ; then
   echo "TARGET_ARCH=ppc" >> $config_mak
   echo "#define TARGET_ARCH \"ppc\"" >> $config_h
   echo "#define TARGET_PPC 1" >> $config_h
+elif test "$target_cpu" = "ppcemb" ; then
+  echo "TARGET_ARCH=ppcemb" >> $config_mak
+  echo "TARGET_ABI_DIR=ppc" >> $config_mak
+  echo "#define TARGET_ARCH \"ppcemb\"" >> $config_h
+  echo "#define TARGET_PPC 1" >> $config_h
+  echo "#define TARGET_PPCEMB 1" >> $config_h
 elif test "$target_cpu" = "ppc64" ; then
   echo "TARGET_ARCH=ppc64" >> $config_mak
+  echo "TARGET_ABI_DIR=ppc" >> $config_mak
   echo "#define TARGET_ARCH \"ppc64\"" >> $config_h
   echo "#define TARGET_PPC 1" >> $config_h
   echo "#define TARGET_PPC64 1" >> $config_h
-elif test "$target_cpu" = "ppcemb" ; then
-  echo "TARGET_ARCH=ppcemb" >> $config_mak
-  echo "#define TARGET_ARCH \"ppcemb\"" >> $config_h
+elif test "$target_cpu" = "ppc64abi32" ; then
+  echo "TARGET_ARCH=ppc64" >> $config_mak
+  echo "TARGET_ABI_DIR=ppc" >> $config_mak
+  echo "#define TARGET_ARCH \"ppc64\"" >> $config_h
   echo "#define TARGET_PPC 1" >> $config_h
-  echo "#define TARGET_PPCEMB 1" >> $config_h
+  echo "#define TARGET_PPC64 1" >> $config_h
+  echo "#define TARGET_ABI32 1" >> $config_h
 elif test "$target_cpu" = "x86_64" ; then
   echo "TARGET_ARCH=x86_64" >> $config_mak
   echo "#define TARGET_ARCH \"x86_64\"" >> $config_h
@@ -1075,16 +1144,24 @@ elif test "$target_cpu" = "mips" -o "$target_cpu" = "mipsel" ; then
   echo "TARGET_ARCH=mips" >> $config_mak
   echo "#define TARGET_ARCH \"mips\"" >> $config_h
   echo "#define TARGET_MIPS 1" >> $config_h
+  echo "#define TARGET_ABI_MIPSO32 1" >> $config_h
 elif test "$target_cpu" = "mipsn32" -o "$target_cpu" = "mipsn32el" ; then
   echo "TARGET_ARCH=mipsn32" >> $config_mak
   echo "#define TARGET_ARCH \"mipsn32\"" >> $config_h
   echo "#define TARGET_MIPS 1" >> $config_h
-  echo "#define TARGET_MIPSN32 1" >> $config_h
+  echo "#define TARGET_ABI_MIPSN32 1" >> $config_h
 elif test "$target_cpu" = "mips64" -o "$target_cpu" = "mips64el" ; then
   echo "TARGET_ARCH=mips64" >> $config_mak
   echo "#define TARGET_ARCH \"mips64\"" >> $config_h
   echo "#define TARGET_MIPS 1" >> $config_h
   echo "#define TARGET_MIPS64 1" >> $config_h
+  echo "#define TARGET_ABI_MIPSN64 1" >> $config_h
+elif test "$target_cpu" = "cris" ; then
+  echo "TARGET_ARCH=cris" >> $config_mak
+  echo "#define TARGET_ARCH \"cris\"" >> $config_h
+  echo "#define TARGET_CRIS 1" >> $config_h
+  echo "CONFIG_SOFTFLOAT=yes" >> $config_mak
+  echo "#define CONFIG_SOFTFLOAT 1" >> $config_h
 elif test "$target_cpu" = "sh4" -o "$target_cpu" = "sh4eb" ; then
   echo "TARGET_ARCH=sh4" >> $config_mak
   echo "#define TARGET_ARCH \"sh4\"" >> $config_h
@@ -1124,7 +1201,7 @@ if test "$target_darwin_user" = "yes" ; then
   echo "#define CONFIG_DARWIN_USER 1" >> $config_h
 fi
 
-if test "$target_cpu" = "arm" -o "$target_cpu" = "armeb" -o "$target_cpu" = "sparc" -o "$target_cpu" = "sparc64" -o "$target_cpu" = "m68k" -o "$target_cpu" = "mips" -o "$target_cpu" = "mipsel" -o "$target_cpu" = "mipsn32" -o "$target_cpu" = "mipsn32el" -o "$target_cpu" = "mips64" -o "$target_cpu" = "mips64el"; then
+if test "$target_cpu" = "arm" -o "$target_cpu" = "armeb" -o "$target_cpu" = "sparc" -o "$target_cpu" = "sparc64"  -o "$target_cpu" = "sparc32plus" -o "$target_cpu" = "m68k" -o "$target_cpu" = "mips" -o "$target_cpu" = "mipsel" -o "$target_cpu" = "mipsn32" -o "$target_cpu" = "mipsn32el" -o "$target_cpu" = "mips64" -o "$target_cpu" = "mips64el"; then
   echo "CONFIG_SOFTFLOAT=yes" >> $config_mak
   echo "#define CONFIG_SOFTFLOAT 1" >> $config_h
 fi
@@ -1132,33 +1209,10 @@ if test "$target_user_only" = "yes" -a "$bflt" = "yes"; then
   echo "TARGET_HAS_BFLT=yes" >> $config_mak
   echo "#define TARGET_HAS_BFLT 1" >> $config_h
 fi
-# sdl defines
-
-if test "$target_user_only" = "no"; then
-    if test "$target_softmmu" = "no" -o "$static" = "yes"; then
-        sdl1=$sdl_static
-    else
-        sdl1=$sdl
-    fi
-    if test "$sdl1" = "yes" ; then
-        echo "#define CONFIG_SDL 1" >> $config_h
-        echo "CONFIG_SDL=yes" >> $config_mak
-        if test "$target_softmmu" = "no" -o "$static" = "yes"; then
-            echo "SDL_LIBS=$sdl_static_libs" >> $config_mak
-        else
-            echo "SDL_LIBS=`$sdl_config --libs`" >> $config_mak
-        fi
-        if [ "${aa}" = "yes" ] ; then
-            echo "SDL_CFLAGS=`$sdl_config --cflags` `aalib-config --cflags`" >> $config_mak
-        else
-            echo "SDL_CFLAGS=`$sdl_config --cflags`" >> $config_mak
-        fi
-    fi
-fi
-
-if test "$cocoa" = "yes" ; then
-    echo "#define CONFIG_COCOA 1" >> $config_h
-    echo "CONFIG_COCOA=yes" >> $config_mak
+# 32 bit ELF loader in addition to native 64 bit loader?
+if test "$target_user_only" = "yes" -a "$elfload32" = "yes"; then
+  echo "TARGET_HAS_ELFLOAD32=yes" >> $config_mak
+  echo "#define TARGET_HAS_ELFLOAD32 1" >> $config_h
 fi
 
 test -f ${config_h}~ && cmp -s $config_h ${config_h}~ && mv ${config_h}~ $config_h
@@ -1167,8 +1221,9 @@ done # for target in $targets
 
 # build tree in object directory if source path is different from current one
 if test "$source_path_used" = "yes" ; then
-    DIRS="tests"
+    DIRS="tests tests/cris slirp audio"
     FILES="Makefile tests/Makefile"
+    FILES="$FILES tests/cris/Makefile tests/cris/.gdbinit"
     for dir in $DIRS ; do
             mkdir -p $dir
     done
diff --git a/console.c b/console.c
index ff725c2e6..e7c00eccb 100644
--- a/console.c
+++ b/console.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "console.h"
+#include "qemu-timer.h"
 
 //#define DEBUG_CONSOLE
 #define DEFAULT_BACKSCROLL 512
@@ -59,7 +61,7 @@ typedef struct QEMUFIFO {
     int count, wptr, rptr;
 } QEMUFIFO;
 
-int qemu_fifo_write(QEMUFIFO *f, const uint8_t *buf, int len1)
+static int qemu_fifo_write(QEMUFIFO *f, const uint8_t *buf, int len1)
 {
     int l, len;
 
@@ -82,7 +84,7 @@ int qemu_fifo_write(QEMUFIFO *f, const uint8_t *buf, int len1)
     return len1;
 }
 
-int qemu_fifo_read(QEMUFIFO *f, uint8_t *buf, int len1)
+static int qemu_fifo_read(QEMUFIFO *f, uint8_t *buf, int len1)
 {
     int l, len;
 
@@ -509,7 +511,7 @@ static void text_console_resize(TextConsole *s)
             c++;
         }
     }
-    free(s->cells);
+    qemu_free(s->cells);
     s->cells = cells;
 }
 
@@ -1167,11 +1169,21 @@ int is_graphic_console(void)
     return active_console->console_type == GRAPHIC_CONSOLE;
 }
 
+void console_color_init(DisplayState *ds)
+{
+    int i, j;
+    for (j = 0; j < 2; j++) {
+        for (i = 0; i < 8; i++) {
+            color_table[j][i] = col_expand(ds, 
+                   vga_get_color(ds, color_table_rgb[j][i]));
+        }
+    }
+}
+
 CharDriverState *text_console_init(DisplayState *ds, const char *p)
 {
     CharDriverState *chr;
     TextConsole *s;
-    int i,j;
     unsigned width;
     unsigned height;
     static int color_inited;
@@ -1195,12 +1207,7 @@ CharDriverState *text_console_init(DisplayState *ds, const char *p)
 
     if (!color_inited) {
         color_inited = 1;
-        for(j = 0; j < 2; j++) {
-            for(i = 0; i < 8; i++) {
-                color_table[j][i] = col_expand(s->ds,
-                        vga_get_color(s->ds, color_table_rgb[j][i]));
-            }
-        }
+        console_color_init(s->ds);
     }
     s->y_displayed = 0;
     s->y_base = 0;
diff --git a/console.h b/console.h
new file mode 100644
index 000000000..1ac74fad3
--- /dev/null
+++ b/console.h
@@ -0,0 +1,154 @@
+#ifndef CONSOLE_H
+#define CONSOLE_H
+
+#include "qemu-char.h"
+
+/* keyboard/mouse support */
+
+#define MOUSE_EVENT_LBUTTON 0x01
+#define MOUSE_EVENT_RBUTTON 0x02
+#define MOUSE_EVENT_MBUTTON 0x04
+
+typedef void QEMUPutKBDEvent(void *opaque, int keycode);
+typedef void QEMUPutMouseEvent(void *opaque, int dx, int dy, int dz, int buttons_state);
+
+typedef struct QEMUPutMouseEntry {
+    QEMUPutMouseEvent *qemu_put_mouse_event;
+    void *qemu_put_mouse_event_opaque;
+    int qemu_put_mouse_event_absolute;
+    char *qemu_put_mouse_event_name;
+
+    /* used internally by qemu for handling mice */
+    struct QEMUPutMouseEntry *next;
+} QEMUPutMouseEntry;
+
+void qemu_add_kbd_event_handler(QEMUPutKBDEvent *func, void *opaque);
+QEMUPutMouseEntry *qemu_add_mouse_event_handler(QEMUPutMouseEvent *func,
+                                                void *opaque, int absolute,
+                                                const char *name);
+void qemu_remove_mouse_event_handler(QEMUPutMouseEntry *entry);
+
+void kbd_put_keycode(int keycode);
+void kbd_mouse_event(int dx, int dy, int dz, int buttons_state);
+int kbd_mouse_is_absolute(void);
+
+void do_info_mice(void);
+void do_mouse_set(int index);
+
+/* keysym is a unicode code except for special keys (see QEMU_KEY_xxx
+   constants) */
+#define QEMU_KEY_ESC1(c) ((c) | 0xe100)
+#define QEMU_KEY_BACKSPACE  0x007f
+#define QEMU_KEY_UP         QEMU_KEY_ESC1('A')
+#define QEMU_KEY_DOWN       QEMU_KEY_ESC1('B')
+#define QEMU_KEY_RIGHT      QEMU_KEY_ESC1('C')
+#define QEMU_KEY_LEFT       QEMU_KEY_ESC1('D')
+#define QEMU_KEY_HOME       QEMU_KEY_ESC1(1)
+#define QEMU_KEY_END        QEMU_KEY_ESC1(4)
+#define QEMU_KEY_PAGEUP     QEMU_KEY_ESC1(5)
+#define QEMU_KEY_PAGEDOWN   QEMU_KEY_ESC1(6)
+#define QEMU_KEY_DELETE     QEMU_KEY_ESC1(3)
+
+#define QEMU_KEY_CTRL_UP         0xe400
+#define QEMU_KEY_CTRL_DOWN       0xe401
+#define QEMU_KEY_CTRL_LEFT       0xe402
+#define QEMU_KEY_CTRL_RIGHT      0xe403
+#define QEMU_KEY_CTRL_HOME       0xe404
+#define QEMU_KEY_CTRL_END        0xe405
+#define QEMU_KEY_CTRL_PAGEUP     0xe406
+#define QEMU_KEY_CTRL_PAGEDOWN   0xe407
+
+void kbd_put_keysym(int keysym);
+
+/* consoles */
+
+struct DisplayState {
+    uint8_t *data;
+    int linesize;
+    int depth;
+    int bgr; /* BGR color order instead of RGB. Only valid for depth == 32 */
+    int width;
+    int height;
+    void *opaque;
+    struct QEMUTimer *gui_timer;
+
+    void (*dpy_update)(struct DisplayState *s, int x, int y, int w, int h);
+    void (*dpy_resize)(struct DisplayState *s, int w, int h);
+    void (*dpy_refresh)(struct DisplayState *s);
+    void (*dpy_copy)(struct DisplayState *s, int src_x, int src_y,
+                     int dst_x, int dst_y, int w, int h);
+    void (*dpy_fill)(struct DisplayState *s, int x, int y,
+                     int w, int h, uint32_t c);
+    void (*mouse_set)(int x, int y, int on);
+    void (*cursor_define)(int width, int height, int bpp, int hot_x, int hot_y,
+                          uint8_t *image, uint8_t *mask);
+};
+
+static inline void dpy_update(DisplayState *s, int x, int y, int w, int h)
+{
+    s->dpy_update(s, x, y, w, h);
+}
+
+static inline void dpy_resize(DisplayState *s, int w, int h)
+{
+    s->dpy_resize(s, w, h);
+}
+
+typedef void (*vga_hw_update_ptr)(void *);
+typedef void (*vga_hw_invalidate_ptr)(void *);
+typedef void (*vga_hw_screen_dump_ptr)(void *, const char *);
+
+TextConsole *graphic_console_init(DisplayState *ds, vga_hw_update_ptr update,
+                                  vga_hw_invalidate_ptr invalidate,
+                                  vga_hw_screen_dump_ptr screen_dump,
+                                  void *opaque);
+void vga_hw_update(void);
+void vga_hw_invalidate(void);
+void vga_hw_screen_dump(const char *filename);
+
+int is_graphic_console(void);
+CharDriverState *text_console_init(DisplayState *ds, const char *p);
+void console_select(unsigned int index);
+void console_color_init(DisplayState *ds);
+
+/* sdl.c */
+void sdl_display_init(DisplayState *ds, int full_screen, int no_frame);
+
+/* cocoa.m */
+void cocoa_display_init(DisplayState *ds, int full_screen);
+
+/* vnc.c */
+void vnc_display_init(DisplayState *ds);
+void vnc_display_close(DisplayState *ds);
+int vnc_display_open(DisplayState *ds, const char *display);
+int vnc_display_password(DisplayState *ds, const char *password);
+void do_info_vnc(void);
+
+/* x_keymap.c */
+extern uint8_t _translate_keycode(const int key);
+
+/* FIXME: term_printf et al should probably go elsewhere so everything
+   does not need to include console.h  */
+/* monitor.c */
+void monitor_init(CharDriverState *hd, int show_banner);
+void term_puts(const char *str);
+void term_vprintf(const char *fmt, va_list ap);
+void term_printf(const char *fmt, ...) __attribute__ ((__format__ (__printf__, 1, 2)));
+void term_print_filename(const char *filename);
+void term_flush(void);
+void term_print_help(void);
+void monitor_readline(const char *prompt, int is_password,
+                      char *buf, int buf_size);
+
+/* readline.c */
+typedef void ReadLineFunc(void *opaque, const char *str);
+
+extern int completion_index;
+void add_completion(const char *str);
+void readline_handle_byte(int ch);
+void readline_find_completion(const char *cmdline);
+const char *readline_get_history(unsigned int index);
+void readline_start(const char *prompt, int is_password,
+                    ReadLineFunc *readline_func, void *opaque);
+
+#endif
diff --git a/cpu-all.h b/cpu-all.h
index e9bc6327c..a742b57cc 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -135,6 +135,36 @@ typedef union {
     uint64_t ll;
 } CPU_DoubleU;
 
+#ifdef TARGET_SPARC
+typedef union {
+    float128 q;
+#if defined(WORDS_BIGENDIAN) \
+    || (defined(__arm__) && !defined(__VFP_FP__) && !defined(CONFIG_SOFTFLOAT))
+    struct {
+        uint32_t upmost;
+        uint32_t upper;
+        uint32_t lower;
+        uint32_t lowest;
+    } l;
+    struct {
+        uint64_t upper;
+        uint64_t lower;
+    } ll;
+#else
+    struct {
+        uint32_t lowest;
+        uint32_t lower;
+        uint32_t upper;
+        uint32_t upmost;
+    } l;
+    struct {
+        uint64_t lower;
+        uint64_t upper;
+    } ll;
+#endif
+} CPU_QuadU;
+#endif
+
 /* CPU memory access without any memory or io remapping */
 
 /*
@@ -686,11 +716,12 @@ extern unsigned long qemu_host_page_mask;
 /* original state of the write flag (used when tracking self-modifying
    code */
 #define PAGE_WRITE_ORG 0x0010
+#define PAGE_RESERVED  0x0020
 
 void page_dump(FILE *f);
 int page_get_flags(target_ulong address);
 void page_set_flags(target_ulong start, target_ulong end, int flags);
-void page_unprotect_range(target_ulong data, target_ulong data_size);
+int page_check_range(target_ulong start, target_ulong len, int flags);
 
 CPUState *cpu_copy(CPUState *env);
 
diff --git a/cpu-defs.h b/cpu-defs.h
index 915877617..5e0f04674 100644
--- a/cpu-defs.h
+++ b/cpu-defs.h
@@ -20,6 +20,10 @@
 #ifndef CPU_DEFS_H
 #define CPU_DEFS_H
 
+#ifndef NEED_CPU_H
+#error cpu.h included from common code
+#endif
+
 #include "config.h"
 #include <setjmp.h>
 #include <inttypes.h>
@@ -112,15 +116,6 @@ typedef struct CPUTLBEntry {
     target_phys_addr_t addend;
 } CPUTLBEntry;
 
-/* Alpha has 4 different running levels */
-#if defined(TARGET_ALPHA)
-#define NB_MMU_MODES 4
-#elif defined(TARGET_PPC64H) /* PowerPC 64 with hypervisor mode support */
-#define NB_MMU_MODES 3
-#else
-#define NB_MMU_MODES 2
-#endif
-
 #define CPU_COMMON                                                      \
     struct TranslationBlock *current_tb; /* currently executing TB  */  \
     /* soft mmu support */                                              \
@@ -131,7 +126,7 @@ typedef struct CPUTLBEntry {
                                    written */                           \
     target_ulong mem_write_vaddr; /* target virtual addr at which the   \
                                      memory was written */              \
-    /* 0 = kernel, 1 = user */                                          \
+    /* The meaning of the MMU modes is defined in the target code. */   \
     CPUTLBEntry tlb_table[NB_MMU_MODES][CPU_TLB_SIZE];                  \
     struct TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];           \
                                                                         \
@@ -151,6 +146,8 @@ typedef struct CPUTLBEntry {
     void *next_cpu; /* next CPU sharing TB cache */                     \
     int cpu_index; /* CPU index (informative) */                        \
     /* user data */                                                     \
-    void *opaque;
+    void *opaque;                                                       \
+                                                                        \
+    const char *cpu_model_str;
 
 #endif
diff --git a/cpu-exec.c b/cpu-exec.c
index 2cfefbfab..3fe73f018 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -45,6 +45,52 @@ int tb_invalidated_flag;
 //#define DEBUG_EXEC
 //#define DEBUG_SIGNAL
 
+#define SAVE_GLOBALS()
+#define RESTORE_GLOBALS()
+
+#if defined(__sparc__) && !defined(HOST_SOLARIS)
+#include <features.h>
+#if defined(__GLIBC__) && ((__GLIBC__ < 2) || \
+                           ((__GLIBC__ == 2) && (__GLIBC_MINOR__ <= 90)))
+// Work around ugly bugs in glibc that mangle global register contents
+
+static volatile void *saved_env;
+static volatile unsigned long saved_t0, saved_i7;
+#undef SAVE_GLOBALS
+#define SAVE_GLOBALS() do {                                     \
+        saved_env = env;                                        \
+        saved_t0 = T0;                                          \
+        asm volatile ("st %%i7, [%0]" : : "r" (&saved_i7));     \
+    } while(0)
+
+#undef RESTORE_GLOBALS
+#define RESTORE_GLOBALS() do {                                  \
+        env = (void *)saved_env;                                \
+        T0 = saved_t0;                                          \
+        asm volatile ("ld [%0], %%i7" : : "r" (&saved_i7));     \
+    } while(0)
+
+static int sparc_setjmp(jmp_buf buf)
+{
+    int ret;
+
+    SAVE_GLOBALS();
+    ret = setjmp(buf);
+    RESTORE_GLOBALS();
+    return ret;
+}
+#undef setjmp
+#define setjmp(jmp_buf) sparc_setjmp(jmp_buf)
+
+static void sparc_longjmp(jmp_buf buf, int val)
+{
+    SAVE_GLOBALS();
+    longjmp(buf, val);
+}
+#define longjmp(jmp_buf, val) sparc_longjmp(jmp_buf, val)
+#endif
+#endif
+
 void cpu_loop_exit(void)
 {
     /* NOTE: the register at this point must be saved by hand because
@@ -138,7 +184,9 @@ static TranslationBlock *tb_find_slow(target_ulong pc,
     tb->tc_ptr = tc_ptr;
     tb->cs_base = cs_base;
     tb->flags = flags;
-    cpu_gen_code(env, tb, CODE_GEN_MAX_SIZE, &code_gen_size);
+    SAVE_GLOBALS();
+    cpu_gen_code(env, tb, &code_gen_size);
+    RESTORE_GLOBALS();
     code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
 
     /* check next page if needed */
@@ -178,6 +226,7 @@ static inline TranslationBlock *tb_find_fast(void)
         flags |= (1 << 6);
     if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30))
         flags |= (1 << 7);
+    flags |= (env->condexec_bits << 8);
     cs_base = 0;
     pc = env->regs[15];
 #elif defined(TARGET_SPARC)
@@ -186,10 +235,8 @@ static inline TranslationBlock *tb_find_fast(void)
     flags = (((env->pstate & PS_PEF) >> 1) | ((env->fprs & FPRS_FEF) << 2))
         | (env->pstate & PS_PRIV) | ((env->lsu & (DMMU_E | IMMU_E)) >> 2);
 #else
-    // FPU enable . MMU Boot . MMU enabled . MMU no-fault . Supervisor
-    flags = (env->psref << 4) | (((env->mmuregs[0] & MMU_BM) >> 14) << 3)
-        | ((env->mmuregs[0] & (MMU_E | MMU_NF)) << 1)
-        | env->psrs;
+    // FPU enable . Supervisor
+    flags = (env->psref << 4) | env->psrs;
 #endif
     cs_base = env->npc;
     pc = env->pc;
@@ -208,13 +255,17 @@ static inline TranslationBlock *tb_find_fast(void)
     cs_base = 0;
     pc = env->pc;
 #elif defined(TARGET_SH4)
-    flags = env->sr & (SR_MD | SR_RB);
-    cs_base = 0;         /* XXXXX */
+    flags = env->flags;
+    cs_base = 0;
     pc = env->pc;
 #elif defined(TARGET_ALPHA)
     flags = env->ps;
     cs_base = 0;
     pc = env->pc;
+#elif defined(TARGET_CRIS)
+    flags = 0;
+    cs_base = 0;
+    pc = env->pc;
 #elif defined(TARGET_IA64)
     flags = 0;
     cs_base = 0;         /* XXXXX */
@@ -238,6 +289,7 @@ static inline TranslationBlock *tb_find_fast(void)
     return tb;
 }
 
+#define BREAK_CHAIN T0 = 0
 
 /* main execution loop */
 
@@ -250,10 +302,6 @@ int cpu_exec(CPUState *env1)
     uint32_t *saved_regwptr;
 #endif
 #endif
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-    int saved_i7;
-    target_ulong tmp_T0;
-#endif
     int ret, interrupt_request;
     void (*gen_func)(void);
     TranslationBlock *tb;
@@ -268,10 +316,7 @@ int cpu_exec(CPUState *env1)
 #define SAVE_HOST_REGS 1
 #include "hostregs_helper.h"
     env = env1;
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-    /* we also save i7 because longjmp may not restore it */
-    asm volatile ("mov %%i7, %0" : "=r" (saved_i7));
-#endif
+    SAVE_GLOBALS();
 
     env_to_regs();
 #if defined(TARGET_I386)
@@ -293,6 +338,7 @@ int cpu_exec(CPUState *env1)
 #elif defined(TARGET_PPC)
 #elif defined(TARGET_MIPS)
 #elif defined(TARGET_SH4)
+#elif defined(TARGET_CRIS)
 #elif defined(TARGET_IA64)
     /* XXXXX */
 #else
@@ -345,6 +391,8 @@ int cpu_exec(CPUState *env1)
 		    do_interrupt(env);
 #elif defined(TARGET_ALPHA)
                     do_interrupt(env);
+#elif defined(TARGET_CRIS)
+                    do_interrupt(env);
 #elif defined(TARGET_M68K)
                     do_interrupt(0);
 #elif defined(TARGET_IA64)
@@ -387,10 +435,7 @@ int cpu_exec(CPUState *env1)
 #endif
             T0 = 0; /* force lookup of first TB */
             for(;;) {
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                /* g1 can be modified by some libc? functions */
-                tmp_T0 = T0;
-#endif
+                SAVE_GLOBALS();
                 interrupt_request = env->interrupt_request;
                 if (__builtin_expect(interrupt_request, 0)
 #if defined(TARGET_I386)
@@ -403,7 +448,7 @@ int cpu_exec(CPUState *env1)
                         cpu_loop_exit();
                     }
 #if defined(TARGET_ARM) || defined(TARGET_SPARC) || defined(TARGET_MIPS) || \
-    defined(TARGET_PPC) || defined(TARGET_ALPHA)
+    defined(TARGET_PPC) || defined(TARGET_ALPHA) || defined(TARGET_CRIS)
                     if (interrupt_request & CPU_INTERRUPT_HALT) {
                         env->interrupt_request &= ~CPU_INTERRUPT_HALT;
                         env->halted = 1;
@@ -417,11 +462,7 @@ int cpu_exec(CPUState *env1)
                         svm_check_intercept(SVM_EXIT_SMI);
                         env->interrupt_request &= ~CPU_INTERRUPT_SMI;
                         do_smm_enter();
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                        tmp_T0 = 0;
-#else
-                        T0 = 0;
-#endif
+                        BREAK_CHAIN;
                     } else if ((interrupt_request & CPU_INTERRUPT_HARD) &&
                         (env->eflags & IF_MASK || env->hflags & HF_HIF_MASK) &&
                         !(env->hflags & HF_INHIBIT_IRQ_MASK)) {
@@ -435,11 +476,7 @@ int cpu_exec(CPUState *env1)
                         do_interrupt(intno, 0, 0, 0, 1);
                         /* ensure that no TB jump will be modified as
                            the program flow was changed */
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                        tmp_T0 = 0;
-#else
-                        T0 = 0;
-#endif
+                        BREAK_CHAIN;
 #if !defined(CONFIG_USER_ONLY)
                     } else if ((interrupt_request & CPU_INTERRUPT_VIRQ) &&
                         (env->eflags & IF_MASK) && !(env->hflags & HF_INHIBIT_IRQ_MASK)) {
@@ -453,11 +490,7 @@ int cpu_exec(CPUState *env1)
 	                 do_interrupt(intno, 0, 0, -1, 1);
                          stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl),
                                   ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl)) & ~V_IRQ_MASK);
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                         tmp_T0 = 0;
-#else
-                         T0 = 0;
-#endif
+                        BREAK_CHAIN;
 #endif
                     }
 #elif defined(TARGET_PPC)
@@ -470,11 +503,7 @@ int cpu_exec(CPUState *env1)
                         ppc_hw_interrupt(env);
                         if (env->pending_interrupts == 0)
                             env->interrupt_request &= ~CPU_INTERRUPT_HARD;
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                        tmp_T0 = 0;
-#else
-                        T0 = 0;
-#endif
+                        BREAK_CHAIN;
                     }
 #elif defined(TARGET_MIPS)
                     if ((interrupt_request & CPU_INTERRUPT_HARD) &&
@@ -487,11 +516,7 @@ int cpu_exec(CPUState *env1)
                         env->exception_index = EXCP_EXT_INTERRUPT;
                         env->error_code = 0;
                         do_interrupt(env);
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                        tmp_T0 = 0;
-#else
-                        T0 = 0;
-#endif
+                        BREAK_CHAIN;
                     }
 #elif defined(TARGET_SPARC)
                     if ((interrupt_request & CPU_INTERRUPT_HARD) &&
@@ -508,11 +533,7 @@ int cpu_exec(CPUState *env1)
 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
                             cpu_check_irqs(env);
 #endif
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                            tmp_T0 = 0;
-#else
-                            T0 = 0;
-#endif
+                        BREAK_CHAIN;
 			}
 		    } else if (interrupt_request & CPU_INTERRUPT_TIMER) {
 			//do_interrupt(0, 0, 0, 0, 0);
@@ -523,17 +544,39 @@ int cpu_exec(CPUState *env1)
                         && !(env->uncached_cpsr & CPSR_F)) {
                         env->exception_index = EXCP_FIQ;
                         do_interrupt(env);
+                        BREAK_CHAIN;
                     }
+                    /* ARMv7-M interrupt return works by loading a magic value
+                       into the PC.  On real hardware the load causes the
+                       return to occur.  The qemu implementation performs the
+                       jump normally, then does the exception return when the
+                       CPU tries to execute code at the magic address.
+                       This will cause the magic PC value to be pushed to
+                       the stack if an interrupt occured at the wrong time.
+                       We avoid this by disabling interrupts when
+                       pc contains a magic address.  */
                     if (interrupt_request & CPU_INTERRUPT_HARD
-                        && !(env->uncached_cpsr & CPSR_I)) {
+                        && ((IS_M(env) && env->regs[15] < 0xfffffff0)
+                            || !(env->uncached_cpsr & CPSR_I))) {
                         env->exception_index = EXCP_IRQ;
                         do_interrupt(env);
+                        BREAK_CHAIN;
                     }
 #elif defined(TARGET_SH4)
-		    /* XXXXX */
+                    if (interrupt_request & CPU_INTERRUPT_HARD) {
+                        do_interrupt(env);
+                        BREAK_CHAIN;
+                    }
 #elif defined(TARGET_ALPHA)
                     if (interrupt_request & CPU_INTERRUPT_HARD) {
                         do_interrupt(env);
+                        BREAK_CHAIN;
+                    }
+#elif defined(TARGET_CRIS)
+                    if (interrupt_request & CPU_INTERRUPT_HARD) {
+                        do_interrupt(env);
+			env->interrupt_request &= ~CPU_INTERRUPT_HARD;
+                        BREAK_CHAIN;
                     }
 #elif defined(TARGET_M68K)
                     if (interrupt_request & CPU_INTERRUPT_HARD
@@ -546,6 +589,7 @@ int cpu_exec(CPUState *env1)
                            first signalled.  */
                         env->exception_index = env->pending_vector;
                         do_interrupt(1);
+                        BREAK_CHAIN;
                     }
 #endif
                    /* Don't use the cached interupt_request value,
@@ -554,11 +598,7 @@ int cpu_exec(CPUState *env1)
                         env->interrupt_request &= ~CPU_INTERRUPT_EXITTB;
                         /* ensure that no TB jump will be modified as
                            the program flow was changed */
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                        tmp_T0 = 0;
-#else
-                        T0 = 0;
-#endif
+                        BREAK_CHAIN;
                     }
                     if (interrupt_request & CPU_INTERRUPT_EXIT) {
                         env->interrupt_request &= ~CPU_INTERRUPT_EXIT;
@@ -594,6 +634,8 @@ int cpu_exec(CPUState *env1)
 		    cpu_dump_state(env, logfile, fprintf, 0);
 #elif defined(TARGET_ALPHA)
                     cpu_dump_state(env, logfile, fprintf, 0);
+#elif defined(TARGET_CRIS)
+                    cpu_dump_state(env, logfile, fprintf, 0);
 #else
 #error unsupported target CPU
 #endif
@@ -607,9 +649,7 @@ int cpu_exec(CPUState *env1)
                             lookup_symbol(tb->pc));
                 }
 #endif
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                T0 = tmp_T0;
-#endif
+                RESTORE_GLOBALS();
                 /* see if we can patch the calling TB. When the TB
                    spans two pages, we cannot safely do a direct
                    jump. */
@@ -618,19 +658,9 @@ int cpu_exec(CPUState *env1)
 #if USE_KQEMU
                         (env->kqemu_enabled != 2) &&
 #endif
-                        tb->page_addr[1] == -1
-#if defined(TARGET_I386) && defined(USE_CODE_COPY)
-                    && (tb->cflags & CF_CODE_COPY) ==
-                    (((TranslationBlock *)(T0 & ~3))->cflags & CF_CODE_COPY)
-#endif
-                    ) {
+                        tb->page_addr[1] == -1) {
                     spin_lock(&tb_lock);
                     tb_add_jump((TranslationBlock *)(long)(T0 & ~3), T0 & 3, tb);
-#if defined(USE_CODE_COPY)
-                    /* propagates the FP use info */
-                    ((TranslationBlock *)(T0 & ~3))->cflags |=
-                        (tb->cflags & CF_FP_USED);
-#endif
                     spin_unlock(&tb_lock);
                 }
                 }
@@ -654,80 +684,6 @@ int cpu_exec(CPUState *env1)
                               : /* no outputs */
                               : "r" (gen_func)
                               : "r1", "r2", "r3", "r8", "r9", "r10", "r12", "r14");
-#elif defined(TARGET_I386) && defined(USE_CODE_COPY)
-{
-    if (!(tb->cflags & CF_CODE_COPY)) {
-        if ((tb->cflags & CF_FP_USED) && env->native_fp_regs) {
-            save_native_fp_state(env);
-        }
-        gen_func();
-    } else {
-        if ((tb->cflags & CF_FP_USED) && !env->native_fp_regs) {
-            restore_native_fp_state(env);
-        }
-        /* we work with native eflags */
-        CC_SRC = cc_table[CC_OP].compute_all();
-        CC_OP = CC_OP_EFLAGS;
-        asm(".globl exec_loop\n"
-            "\n"
-            "debug1:\n"
-            "    pushl %%ebp\n"
-            "    fs movl %10, %9\n"
-            "    fs movl %11, %%eax\n"
-            "    andl $0x400, %%eax\n"
-            "    fs orl %8, %%eax\n"
-            "    pushl %%eax\n"
-            "    popf\n"
-            "    fs movl %%esp, %12\n"
-            "    fs movl %0, %%eax\n"
-            "    fs movl %1, %%ecx\n"
-            "    fs movl %2, %%edx\n"
-            "    fs movl %3, %%ebx\n"
-            "    fs movl %4, %%esp\n"
-            "    fs movl %5, %%ebp\n"
-            "    fs movl %6, %%esi\n"
-            "    fs movl %7, %%edi\n"
-            "    fs jmp *%9\n"
-            "exec_loop:\n"
-            "    fs movl %%esp, %4\n"
-            "    fs movl %12, %%esp\n"
-            "    fs movl %%eax, %0\n"
-            "    fs movl %%ecx, %1\n"
-            "    fs movl %%edx, %2\n"
-            "    fs movl %%ebx, %3\n"
-            "    fs movl %%ebp, %5\n"
-            "    fs movl %%esi, %6\n"
-            "    fs movl %%edi, %7\n"
-            "    pushf\n"
-            "    popl %%eax\n"
-            "    movl %%eax, %%ecx\n"
-            "    andl $0x400, %%ecx\n"
-            "    shrl $9, %%ecx\n"
-            "    andl $0x8d5, %%eax\n"
-            "    fs movl %%eax, %8\n"
-            "    movl $1, %%eax\n"
-            "    subl %%ecx, %%eax\n"
-            "    fs movl %%eax, %11\n"
-            "    fs movl %9, %%ebx\n" /* get T0 value */
-            "    popl %%ebp\n"
-            :
-            : "m" (*(uint8_t *)offsetof(CPUState, regs[0])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[1])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[2])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[3])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[4])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[5])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[6])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[7])),
-            "m" (*(uint8_t *)offsetof(CPUState, cc_src)),
-            "m" (*(uint8_t *)offsetof(CPUState, tmp0)),
-            "a" (gen_func),
-            "m" (*(uint8_t *)offsetof(CPUState, df)),
-            "m" (*(uint8_t *)offsetof(CPUState, saved_esp))
-            : "%ecx", "%edx"
-            );
-    }
-}
 #elif defined(__ia64)
 		struct fptr {
 			void *ip;
@@ -765,11 +721,6 @@ int cpu_exec(CPUState *env1)
 
 
 #if defined(TARGET_I386)
-#if defined(USE_CODE_COPY)
-    if (env->native_fp_regs) {
-        save_native_fp_state(env);
-    }
-#endif
     /* restore flags in standard format */
     env->eflags = env->eflags | cc_table[CC_OP].compute_all() | (DF & DF_MASK);
 #elif defined(TARGET_ARM)
@@ -788,15 +739,14 @@ int cpu_exec(CPUState *env1)
 #elif defined(TARGET_SH4)
 #elif defined(TARGET_IA64)
 #elif defined(TARGET_ALPHA)
+#elif defined(TARGET_CRIS)
     /* XXXXX */
 #else
 #error unsupported target CPU
 #endif
 
     /* restore global registers */
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-    asm volatile ("mov %0, %%i7" : : "r" (saved_i7));
-#endif
+    RESTORE_GLOBALS();
 #include "hostregs_helper.h"
 
     /* fail safe : never use cpu_single_env outside cpu_exec() */
@@ -835,26 +785,26 @@ void cpu_x86_load_seg(CPUX86State *s, int seg_reg, int selector)
     env = saved_env;
 }
 
-void cpu_x86_fsave(CPUX86State *s, uint8_t *ptr, int data32)
+void cpu_x86_fsave(CPUX86State *s, target_ulong ptr, int data32)
 {
     CPUX86State *saved_env;
 
     saved_env = env;
     env = s;
 
-    helper_fsave((target_ulong)ptr, data32);
+    helper_fsave(ptr, data32);
 
     env = saved_env;
 }
 
-void cpu_x86_frstor(CPUX86State *s, uint8_t *ptr, int data32)
+void cpu_x86_frstor(CPUX86State *s, target_ulong ptr, int data32)
 {
     CPUX86State *saved_env;
 
     saved_env = env;
     env = s;
 
-    helper_frstor((target_ulong)ptr, data32);
+    helper_frstor(ptr, data32);
 
     env = saved_env;
 }
@@ -888,8 +838,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     }
 
     /* see if it is an MMU fault */
-    ret = cpu_x86_handle_mmu_fault(env, address, is_write,
-                                   ((env->hflags & HF_CPL_MASK) == 3), 0);
+    ret = cpu_x86_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -938,7 +887,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
         return 1;
     }
     /* see if it is an MMU fault */
-    ret = cpu_arm_handle_mmu_fault(env, address, is_write, 1, 0);
+    ret = cpu_arm_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -974,7 +923,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
         return 1;
     }
     /* see if it is an MMU fault */
-    ret = cpu_sparc_handle_mmu_fault(env, address, is_write, 1, 0);
+    ret = cpu_sparc_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1011,7 +960,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     }
 
     /* see if it is an MMU fault */
-    ret = cpu_ppc_handle_mmu_fault(env, address, is_write, msr_pr, 0);
+    ret = cpu_ppc_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1060,7 +1009,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
         return 1;
     }
     /* see if it is an MMU fault */
-    ret = cpu_m68k_handle_mmu_fault(env, address, is_write, 1, 0);
+    ret = cpu_m68k_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1100,7 +1049,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     }
 
     /* see if it is an MMU fault */
-    ret = cpu_mips_handle_mmu_fault(env, address, is_write, 1, 0);
+    ret = cpu_mips_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1150,7 +1099,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     }
 
     /* see if it is an MMU fault */
-    ret = cpu_sh4_handle_mmu_fault(env, address, is_write, 1, 0);
+    ret = cpu_sh4_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1195,7 +1144,51 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     }
 
     /* see if it is an MMU fault */
-    ret = cpu_alpha_handle_mmu_fault(env, address, is_write, 1, 0);
+    ret = cpu_alpha_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
+    if (ret < 0)
+        return 0; /* not an MMU fault */
+    if (ret == 0)
+        return 1; /* the MMU fault was handled without causing real CPU fault */
+
+    /* now we have a real cpu fault */
+    tb = tb_find_pc(pc);
+    if (tb) {
+        /* the PC is inside the translated code. It means that we have
+           a virtual CPU fault */
+        cpu_restore_state(tb, env, pc, puc);
+    }
+#if 0
+        printf("PF exception: NIP=0x%08x error=0x%x %p\n",
+               env->nip, env->error_code, tb);
+#endif
+    /* we restore the process signal mask as the sigreturn should
+       do it (XXX: use sigsetjmp) */
+    sigprocmask(SIG_SETMASK, old_set, NULL);
+    cpu_loop_exit();
+    /* never comes here */
+    return 1;
+}
+#elif defined (TARGET_CRIS)
+static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
+                                    int is_write, sigset_t *old_set,
+                                    void *puc)
+{
+    TranslationBlock *tb;
+    int ret;
+
+    if (cpu_single_env)
+        env = cpu_single_env; /* XXX: find a correct solution for multithread */
+#if defined(DEBUG_SIGNAL)
+    printf("qemu: SIGSEGV pc=0x%08lx address=%08lx w=%d oldset=0x%08lx\n",
+           pc, address, is_write, *(unsigned long *)old_set);
+#endif
+    /* XXX: locking issue */
+    if (is_write && page_unprotect(h2g(address), pc, puc)) {
+        return 1;
+    }
+
+    /* see if it is an MMU fault */
+    ret = cpu_cris_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1219,6 +1212,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     /* never comes here */
     return 1;
 }
+
 #else
 #error unsupported target CPU
 #endif
@@ -1237,26 +1231,6 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
 # define ERROR_sig(context)   ((context)->uc_mcontext.gregs[REG_ERR])
 #endif
 
-#if defined(USE_CODE_COPY)
-static void cpu_send_trap(unsigned long pc, int trap,
-                          struct ucontext *uc)
-{
-    TranslationBlock *tb;
-
-    if (cpu_single_env)
-        env = cpu_single_env; /* XXX: find a correct solution for multithread */
-    /* now we have a real cpu fault */
-    tb = tb_find_pc(pc);
-    if (tb) {
-        /* the PC is inside the translated code. It means that we have
-           a virtual CPU fault */
-        cpu_restore_state(tb, env, pc, uc);
-    }
-    sigprocmask(SIG_SETMASK, &uc->uc_sigmask, NULL);
-    raise_exception_err(trap, env->error_code);
-}
-#endif
-
 int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
@@ -1273,17 +1247,10 @@ int cpu_signal_handler(int host_signum, void *pinfo,
 #endif
     pc = EIP_sig(uc);
     trapno = TRAP_sig(uc);
-#if defined(TARGET_I386) && defined(USE_CODE_COPY)
-    if (trapno == 0x00 || trapno == 0x05) {
-        /* send division by zero or bound exception */
-        cpu_send_trap(pc, trapno, uc);
-        return 1;
-    } else
-#endif
-        return handle_cpu_signal(pc, (unsigned long)info->si_addr,
-                                 trapno == 0xe ?
-                                 (ERROR_sig(uc) >> 1) & 1 : 0,
-                                 &uc->uc_sigmask, puc);
+    return handle_cpu_signal(pc, (unsigned long)info->si_addr,
+                             trapno == 0xe ?
+                             (ERROR_sig(uc) >> 1) & 1 : 0,
+                             &uc->uc_sigmask, puc);
 }
 
 #elif defined(__x86_64__)
diff --git a/cris-dis.c b/cris-dis.c
new file mode 100644
index 000000000..3b09f2767
--- /dev/null
+++ b/cris-dis.c
@@ -0,0 +1,2907 @@
+/* Disassembler code for CRIS.
+   Copyright 2000, 2001, 2002, 2004, 2005, 2006 Free Software Foundation, Inc.
+   Contributed by Axis Communications AB, Lund, Sweden.
+   Written by Hans-Peter Nilsson.
+
+   This file is part of the GNU binutils and GDB, the GNU debugger.
+
+   This program is free software; you can redistribute it and/or modify it
+   under the terms of the GNU General Public License as published by the
+   Free Software Foundation; either version 2, or (at your option) any later
+   version.
+
+   This program is distributed in the hope that it will be useful, but WITHOUT
+   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+   more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston,
+   MA 02110-1301, USA.  */
+
+#include "dis-asm.h"
+//#include "sysdep.h"
+#include "target-cris/opcode-cris.h"
+//#include "libiberty.h"
+
+
+#define FALSE 0
+#define TRUE 1
+#define CONST_STRNEQ(STR1,STR2) (strncmp ((STR1), (STR2), sizeof (STR2) - 1) == 0)
+
+/* cris-opc.c -- Table of opcodes for the CRIS processor.
+   Copyright 2000, 2001, 2004 Free Software Foundation, Inc.
+   Contributed by Axis Communications AB, Lund, Sweden.
+   Originally written for GAS 1.38.1 by Mikael Asker.
+   Reorganized by Hans-Peter Nilsson.
+
+This file is part of GAS, GDB and the GNU binutils.
+
+GAS, GDB, and GNU binutils is free software; you can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation; either version 2, or (at your
+option) any later version.
+
+GAS, GDB, and GNU binutils are distributed in the hope that they will be
+useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA.  */
+
+#ifndef NULL
+#define NULL (0)
+#endif
+
+/* This table isn't used for CRISv32 and the size of immediate operands.  */
+const struct cris_spec_reg
+cris_spec_regs[] =
+{
+  {"bz",  0,  1, cris_ver_v32p,	   NULL},
+  {"p0",  0,  1, 0,		   NULL},
+  {"vr",  1,  1, 0,		   NULL},
+  {"p1",  1,  1, 0,		   NULL},
+  {"pid", 2,  1, cris_ver_v32p,    NULL},
+  {"p2",  2,  1, cris_ver_v32p,	   NULL},
+  {"p2",  2,  1, cris_ver_warning, NULL},
+  {"srs", 3,  1, cris_ver_v32p,    NULL},
+  {"p3",  3,  1, cris_ver_v32p,	   NULL},
+  {"p3",  3,  1, cris_ver_warning, NULL},
+  {"wz",  4,  2, cris_ver_v32p,	   NULL},
+  {"p4",  4,  2, 0,		   NULL},
+  {"ccr", 5,  2, cris_ver_v0_10,   NULL},
+  {"exs", 5,  4, cris_ver_v32p,	   NULL},
+  {"p5",  5,  2, cris_ver_v0_10,   NULL},
+  {"p5",  5,  4, cris_ver_v32p,	   NULL},
+  {"dcr0",6,  2, cris_ver_v0_3,	   NULL},
+  {"eda", 6,  4, cris_ver_v32p,	   NULL},
+  {"p6",  6,  2, cris_ver_v0_3,	   NULL},
+  {"p6",  6,  4, cris_ver_v32p,	   NULL},
+  {"dcr1/mof", 7, 4, cris_ver_v10p,
+   "Register `dcr1/mof' with ambiguous size specified.  Guessing 4 bytes"},
+  {"dcr1/mof", 7, 2, cris_ver_v0_3,
+   "Register `dcr1/mof' with ambiguous size specified.  Guessing 2 bytes"},
+  {"mof", 7,  4, cris_ver_v10p,	   NULL},
+  {"dcr1",7,  2, cris_ver_v0_3,	   NULL},
+  {"p7",  7,  4, cris_ver_v10p,	   NULL},
+  {"p7",  7,  2, cris_ver_v0_3,	   NULL},
+  {"dz",  8,  4, cris_ver_v32p,	   NULL},
+  {"p8",  8,  4, 0,		   NULL},
+  {"ibr", 9,  4, cris_ver_v0_10,   NULL},
+  {"ebp", 9,  4, cris_ver_v32p,	   NULL},
+  {"p9",  9,  4, 0,		   NULL},
+  {"irp", 10, 4, cris_ver_v0_10,   NULL},
+  {"erp", 10, 4, cris_ver_v32p,	   NULL},
+  {"p10", 10, 4, 0,		   NULL},
+  {"srp", 11, 4, 0,		   NULL},
+  {"p11", 11, 4, 0,		   NULL},
+  /* For disassembly use only.  Accept at assembly with a warning.  */
+  {"bar/dtp0", 12, 4, cris_ver_warning,
+   "Ambiguous register `bar/dtp0' specified"},
+  {"nrp", 12, 4, cris_ver_v32p,	   NULL},
+  {"bar", 12, 4, cris_ver_v8_10,   NULL},
+  {"dtp0",12, 4, cris_ver_v0_3,	   NULL},
+  {"p12", 12, 4, 0,		   NULL},
+  /* For disassembly use only.  Accept at assembly with a warning.  */
+  {"dccr/dtp1",13, 4, cris_ver_warning,
+   "Ambiguous register `dccr/dtp1' specified"},
+  {"ccs", 13, 4, cris_ver_v32p,	   NULL},
+  {"dccr",13, 4, cris_ver_v8_10,   NULL},
+  {"dtp1",13, 4, cris_ver_v0_3,	   NULL},
+  {"p13", 13, 4, 0,		   NULL},
+  {"brp", 14, 4, cris_ver_v3_10,   NULL},
+  {"usp", 14, 4, cris_ver_v32p,	   NULL},
+  {"p14", 14, 4, cris_ver_v3p,	   NULL},
+  {"usp", 15, 4, cris_ver_v10,	   NULL},
+  {"spc", 15, 4, cris_ver_v32p,	   NULL},
+  {"p15", 15, 4, cris_ver_v10p,	   NULL},
+  {NULL, 0, 0, cris_ver_version_all, NULL}
+};
+
+/* Add version specifiers to this table when necessary.
+   The (now) regular coding of register names suggests a simpler
+   implementation.  */
+const struct cris_support_reg cris_support_regs[] =
+{
+  {"s0", 0},
+  {"s1", 1},
+  {"s2", 2},
+  {"s3", 3},
+  {"s4", 4},
+  {"s5", 5},
+  {"s6", 6},
+  {"s7", 7},
+  {"s8", 8},
+  {"s9", 9},
+  {"s10", 10},
+  {"s11", 11},
+  {"s12", 12},
+  {"s13", 13},
+  {"s14", 14},
+  {"s15", 15},
+  {NULL, 0}
+};
+
+/* All CRIS opcodes are 16 bits.
+
+   - The match component is a mask saying which bits must match a
+     particular opcode in order for an instruction to be an instance
+     of that opcode.
+
+   - The args component is a string containing characters symbolically
+     matching the operands of an instruction.  Used for both assembly
+     and disassembly.
+
+     Operand-matching characters:
+     [ ] , space
+        Verbatim.
+     A	The string "ACR" (case-insensitive).
+     B	Not really an operand.  It causes a "BDAP -size,SP" prefix to be
+	output for the PUSH alias-instructions and recognizes a push-
+	prefix at disassembly.  This letter isn't recognized for v32.
+	Must be followed by a R or P letter.
+     !	Non-match pattern, will not match if there's a prefix insn.
+     b	Non-matching operand, used for branches with 16-bit
+	displacement. Only recognized by the disassembler.
+     c	5-bit unsigned immediate in bits <4:0>.
+     C	4-bit unsigned immediate in bits <3:0>.
+     d  At assembly, optionally (as in put other cases before this one)
+	".d" or ".D" at the start of the operands, followed by one space
+	character.  At disassembly, nothing.
+     D	General register in bits <15:12> and <3:0>.
+     f	List of flags in bits <15:12> and <3:0>.
+     i	6-bit signed immediate in bits <5:0>.
+     I	6-bit unsigned immediate in bits <5:0>.
+     M	Size modifier (B, W or D) for CLEAR instructions.
+     m	Size modifier (B, W or D) in bits <5:4>
+     N  A 32-bit dword, like in the difference between s and y.
+        This has no effect on bits in the opcode.  Can also be expressed
+	as "[pc+]" in input.
+     n  As N, but PC-relative (to the start of the instruction).
+     o	[-128..127] word offset in bits <7:1> and <0>.  Used by 8-bit
+	branch instructions.
+     O	[-128..127] offset in bits <7:0>.  Also matches a comma and a
+	general register after the expression, in bits <15:12>.  Used
+	only for the BDAP prefix insn (in v32 the ADDOQ insn; same opcode).
+     P	Special register in bits <15:12>.
+     p	Indicates that the insn is a prefix insn.  Must be first
+	character.
+     Q  As O, but don't relax; force an 8-bit offset.
+     R	General register in bits <15:12>.
+     r	General register in bits <3:0>.
+     S	Source operand in bit <10> and a prefix; a 3-operand prefix
+	without side-effect.
+     s	Source operand in bits <10> and <3:0>, optionally with a
+	side-effect prefix, except [pc] (the name, not R15 as in ACR)
+	isn't allowed for v32 and higher.
+     T  Support register in bits <15:12>.
+     u  4-bit (PC-relative) unsigned immediate word offset in bits <3:0>.
+     U  Relaxes to either u or n, instruction is assumed LAPCQ or LAPC.
+	Not recognized at disassembly.
+     x	Register-dot-modifier, for example "r5.w" in bits <15:12> and <5:4>.
+     y	Like 's' but do not allow an integer at assembly.
+     Y	The difference s-y; only an integer is allowed.
+     z	Size modifier (B or W) in bit <4>.  */
+
+
+/* Please note the order of the opcodes in this table is significant.
+   The assembler requires that all instances of the same mnemonic must
+   be consecutive.  If they aren't, the assembler might not recognize
+   them, or may indicate an internal error.
+
+   The disassembler should not normally care about the order of the
+   opcodes, but will prefer an earlier alternative if the "match-score"
+   (see cris-dis.c) is computed as equal.
+
+   It should not be significant for proper execution that this table is
+   in alphabetical order, but please follow that convention for an easy
+   overview.  */
+
+const struct cris_opcode
+cris_opcodes[] =
+{
+  {"abs",     0x06B0, 0x0940,		  "r,R",     0, SIZE_NONE,     0,
+   cris_abs_op},
+
+  {"add",     0x0600, 0x09c0,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"add",     0x0A00, 0x01c0,		  "m s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"add",     0x0A00, 0x01c0,		  "m S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"add",     0x0a00, 0x05c0,		  "m S,R,r", 0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_three_operand_add_sub_cmp_and_or_op},
+
+  {"add",     0x0A00, 0x01c0,		  "m s,R",   0, SIZE_FIELD,
+   cris_ver_v32p,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"addc",    0x0570, 0x0A80,		  "r,R",     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"addc",    0x09A0, 0x0250,		  "s,R",     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"addi",    0x0540, 0x0A80,		  "x,r,A",   0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_addi_op},
+
+  {"addi",    0x0500, 0x0Ac0,		  "x,r",     0, SIZE_NONE,     0,
+   cris_addi_op},
+
+  /* This collates after "addo", but we want to disassemble as "addoq",
+     not "addo".  */
+  {"addoq",   0x0100, 0x0E00,		  "Q,A",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"addo",    0x0940, 0x0280,		  "m s,R,A", 0, SIZE_FIELD_SIGNED,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  /* This must be located after the insn above, lest we misinterpret
+     "addo.b -1,r0,acr" as "addo .b-1,r0,acr".  FIXME: Sounds like a
+     parser bug.  */
+  {"addo",   0x0100, 0x0E00,		  "O,A",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"addq",    0x0200, 0x0Dc0,		  "I,R",     0, SIZE_NONE,     0,
+   cris_quick_mode_add_sub_op},
+
+  {"adds",    0x0420, 0x0Bc0,		  "z r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  /* FIXME: SIZE_FIELD_SIGNED and all necessary changes.  */
+  {"adds",    0x0820, 0x03c0,		  "z s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"adds",    0x0820, 0x03c0,		  "z S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"adds",    0x0820, 0x07c0,		  "z S,R,r", 0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_three_operand_add_sub_cmp_and_or_op},
+
+  {"addu",    0x0400, 0x0be0,		  "z r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  /* FIXME: SIZE_FIELD_UNSIGNED and all necessary changes.  */
+  {"addu",    0x0800, 0x03e0,		  "z s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"addu",    0x0800, 0x03e0,		  "z S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"addu",    0x0800, 0x07e0,		  "z S,R,r", 0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_three_operand_add_sub_cmp_and_or_op},
+
+  {"and",     0x0700, 0x08C0,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"and",     0x0B00, 0x00C0,		  "m s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"and",     0x0B00, 0x00C0,		  "m S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"and",     0x0B00, 0x04C0,		  "m S,R,r", 0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_three_operand_add_sub_cmp_and_or_op},
+
+  {"andq",    0x0300, 0x0CC0,		  "i,R",     0, SIZE_NONE,     0,
+   cris_quick_mode_and_cmp_move_or_op},
+
+  {"asr",     0x0780, 0x0840,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_asr_op},
+
+  {"asrq",    0x03a0, 0x0c40,		  "c,R",     0, SIZE_NONE,     0,
+   cris_asrq_op},
+
+  {"ax",      0x15B0, 0xEA4F,		  "",	     0, SIZE_NONE,     0,
+   cris_ax_ei_setf_op},
+
+  /* FIXME: Should use branch #defines.  */
+  {"b",	      0x0dff, 0x0200,		  "b",	     1, SIZE_NONE,     0,
+   cris_sixteen_bit_offset_branch_op},
+
+  {"ba",
+   BA_QUICK_OPCODE,
+   0x0F00+(0xF-CC_A)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  /* Needs to come after the usual "ba o", which might be relaxed to
+     this one.  */
+  {"ba",     BA_DWORD_OPCODE,
+   0xffff & (~BA_DWORD_OPCODE),		  "n",	     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_none_reg_mode_jump_op},
+
+  {"bas",     0x0EBF, 0x0140,		  "n,P",     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_none_reg_mode_jump_op},
+
+  {"basc",     0x0EFF, 0x0100,		  "n,P",     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_none_reg_mode_jump_op},
+
+  {"bcc",
+   BRANCH_QUICK_OPCODE+CC_CC*0x1000,
+   0x0f00+(0xF-CC_CC)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"bcs",
+   BRANCH_QUICK_OPCODE+CC_CS*0x1000,
+   0x0f00+(0xF-CC_CS)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"bdap",
+   BDAP_INDIR_OPCODE, BDAP_INDIR_Z_BITS,  "pm s,R",  0, SIZE_FIELD_SIGNED,
+   cris_ver_v0_10,
+   cris_bdap_prefix},
+
+  {"bdap",
+   BDAP_QUICK_OPCODE, BDAP_QUICK_Z_BITS,  "pO",	     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_quick_mode_bdap_prefix},
+
+  {"beq",
+   BRANCH_QUICK_OPCODE+CC_EQ*0x1000,
+   0x0f00+(0xF-CC_EQ)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  /* This is deliberately put before "bext" to trump it, even though not
+     in alphabetical order, since we don't do excluding version checks
+     for v0..v10.  */
+  {"bwf",
+   BRANCH_QUICK_OPCODE+CC_EXT*0x1000,
+   0x0f00+(0xF-CC_EXT)*0x1000,		  "o",	     1, SIZE_NONE,
+   cris_ver_v10,
+   cris_eight_bit_offset_branch_op},
+
+  {"bext",
+   BRANCH_QUICK_OPCODE+CC_EXT*0x1000,
+   0x0f00+(0xF-CC_EXT)*0x1000,		  "o",	     1, SIZE_NONE,
+   cris_ver_v0_3,
+   cris_eight_bit_offset_branch_op},
+
+  {"bge",
+   BRANCH_QUICK_OPCODE+CC_GE*0x1000,
+   0x0f00+(0xF-CC_GE)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"bgt",
+   BRANCH_QUICK_OPCODE+CC_GT*0x1000,
+   0x0f00+(0xF-CC_GT)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"bhi",
+   BRANCH_QUICK_OPCODE+CC_HI*0x1000,
+   0x0f00+(0xF-CC_HI)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"bhs",
+   BRANCH_QUICK_OPCODE+CC_HS*0x1000,
+   0x0f00+(0xF-CC_HS)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"biap", BIAP_OPCODE, BIAP_Z_BITS,	  "pm r,R",  0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_biap_prefix},
+
+  {"ble",
+   BRANCH_QUICK_OPCODE+CC_LE*0x1000,
+   0x0f00+(0xF-CC_LE)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"blo",
+   BRANCH_QUICK_OPCODE+CC_LO*0x1000,
+   0x0f00+(0xF-CC_LO)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"bls",
+   BRANCH_QUICK_OPCODE+CC_LS*0x1000,
+   0x0f00+(0xF-CC_LS)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"blt",
+   BRANCH_QUICK_OPCODE+CC_LT*0x1000,
+   0x0f00+(0xF-CC_LT)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"bmi",
+   BRANCH_QUICK_OPCODE+CC_MI*0x1000,
+   0x0f00+(0xF-CC_MI)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"bmod",    0x0ab0, 0x0140,		  "s,R",     0, SIZE_FIX_32,
+   cris_ver_sim_v0_10,
+   cris_not_implemented_op},
+
+  {"bmod",    0x0ab0, 0x0140,		  "S,D",     0, SIZE_NONE,
+   cris_ver_sim_v0_10,
+   cris_not_implemented_op},
+
+  {"bmod",    0x0ab0, 0x0540,		  "S,R,r",   0, SIZE_NONE,
+   cris_ver_sim_v0_10,
+   cris_not_implemented_op},
+
+  {"bne",
+   BRANCH_QUICK_OPCODE+CC_NE*0x1000,
+   0x0f00+(0xF-CC_NE)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"bound",   0x05c0, 0x0A00,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_two_operand_bound_op},
+  /* FIXME: SIZE_FIELD_UNSIGNED and all necessary changes.  */
+  {"bound",   0x09c0, 0x0200,		  "m s,R",   0, SIZE_FIELD,
+   cris_ver_v0_10,
+   cris_two_operand_bound_op},
+  /* FIXME: SIZE_FIELD_UNSIGNED and all necessary changes.  */
+  {"bound",   0x0dcf, 0x0200,		  "m Y,R",   0, SIZE_FIELD,    0,
+   cris_two_operand_bound_op},
+  {"bound",   0x09c0, 0x0200,		  "m S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_two_operand_bound_op},
+  {"bound",   0x09c0, 0x0600,		  "m S,R,r", 0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_three_operand_bound_op},
+
+  {"bpl",
+   BRANCH_QUICK_OPCODE+CC_PL*0x1000,
+   0x0f00+(0xF-CC_PL)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"break",   0xe930, 0x16c0,		  "C",	     0, SIZE_NONE,
+   cris_ver_v3p,
+   cris_break_op},
+
+  {"bsb",
+   BRANCH_QUICK_OPCODE+CC_EXT*0x1000,
+   0x0f00+(0xF-CC_EXT)*0x1000,		  "o",	     1, SIZE_NONE,
+   cris_ver_v32p,
+   cris_eight_bit_offset_branch_op},
+
+  {"bsr",     0xBEBF, 0x4140,		  "n",	     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_none_reg_mode_jump_op},
+
+  {"bsrc",     0xBEFF, 0x4100,		  "n",	     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_none_reg_mode_jump_op},
+
+  {"bstore",  0x0af0, 0x0100,		  "s,R",     0, SIZE_FIX_32,
+   cris_ver_warning,
+   cris_not_implemented_op},
+
+  {"bstore",  0x0af0, 0x0100,		  "S,D",     0, SIZE_NONE,
+   cris_ver_warning,
+   cris_not_implemented_op},
+
+  {"bstore",  0x0af0, 0x0500,		  "S,R,r",   0, SIZE_NONE,
+   cris_ver_warning,
+   cris_not_implemented_op},
+
+  {"btst",    0x04F0, 0x0B00,		  "r,R",     0, SIZE_NONE,     0,
+   cris_btst_nop_op},
+  {"btstq",   0x0380, 0x0C60,		  "c,R",     0, SIZE_NONE,     0,
+   cris_btst_nop_op},
+
+  {"bvc",
+   BRANCH_QUICK_OPCODE+CC_VC*0x1000,
+   0x0f00+(0xF-CC_VC)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"bvs",
+   BRANCH_QUICK_OPCODE+CC_VS*0x1000,
+   0x0f00+(0xF-CC_VS)*0x1000,		  "o",	     1, SIZE_NONE,     0,
+   cris_eight_bit_offset_branch_op},
+
+  {"clear",   0x0670, 0x3980,		  "M r",     0, SIZE_NONE,     0,
+   cris_reg_mode_clear_op},
+
+  {"clear",   0x0A70, 0x3180,		  "M y",     0, SIZE_NONE,     0,
+   cris_none_reg_mode_clear_test_op},
+
+  {"clear",   0x0A70, 0x3180,		  "M S",     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_clear_test_op},
+
+  {"clearf",  0x05F0, 0x0A00,		  "f",	     0, SIZE_NONE,     0,
+   cris_clearf_di_op},
+
+  {"cmp",     0x06C0, 0x0900,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"cmp",     0x0Ac0, 0x0100,		  "m s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"cmp",     0x0Ac0, 0x0100,		  "m S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"cmpq",    0x02C0, 0x0D00,		  "i,R",     0, SIZE_NONE,     0,
+   cris_quick_mode_and_cmp_move_or_op},
+
+  /* FIXME: SIZE_FIELD_SIGNED and all necessary changes.  */
+  {"cmps",    0x08e0, 0x0300,		  "z s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"cmps",    0x08e0, 0x0300,		  "z S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  /* FIXME: SIZE_FIELD_UNSIGNED and all necessary changes.  */
+  {"cmpu",    0x08c0, 0x0320,		  "z s,R" ,  0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"cmpu",    0x08c0, 0x0320,		  "z S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"di",      0x25F0, 0xDA0F,		  "",	     0, SIZE_NONE,     0,
+   cris_clearf_di_op},
+
+  {"dip",     DIP_OPCODE, DIP_Z_BITS,	  "ps",	     0, SIZE_FIX_32,
+   cris_ver_v0_10,
+   cris_dip_prefix},
+
+  {"div",     0x0980, 0x0640,		  "m R,r",   0, SIZE_FIELD,    0,
+   cris_not_implemented_op},
+
+  {"dstep",   0x06f0, 0x0900,		  "r,R",     0, SIZE_NONE,     0,
+   cris_dstep_logshift_mstep_neg_not_op},
+
+  {"ei",      0x25B0, 0xDA4F,		  "",	     0, SIZE_NONE,     0,
+   cris_ax_ei_setf_op},
+
+  {"fidxd",    0x0ab0, 0xf540,		  "[r]",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"fidxi",    0x0d30, 0xF2C0,		  "[r]",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"ftagd",    0x1AB0, 0xE540,		  "[r]",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"ftagi",    0x1D30, 0xE2C0,		  "[r]",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"halt",    0xF930, 0x06CF,		  "",	     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"jas",    0x09B0, 0x0640,		  "r,P",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_reg_mode_jump_op},
+
+  {"jas",    0x0DBF, 0x0240,		  "N,P",     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_reg_mode_jump_op},
+
+  {"jasc",    0x0B30, 0x04C0,		  "r,P",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_reg_mode_jump_op},
+
+  {"jasc",    0x0F3F, 0x00C0,		  "N,P",     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_reg_mode_jump_op},
+
+  {"jbrc",    0x69b0, 0x9640,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8_10,
+   cris_reg_mode_jump_op},
+
+  {"jbrc",    0x6930, 0x92c0,		  "s",	     0, SIZE_FIX_32,
+   cris_ver_v8_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jbrc",    0x6930, 0x92c0,		  "S",	     0, SIZE_NONE,
+   cris_ver_v8_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jir",     0xA9b0, 0x5640,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8_10,
+   cris_reg_mode_jump_op},
+
+  {"jir",     0xA930, 0x52c0,		  "s",	     0, SIZE_FIX_32,
+   cris_ver_v8_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jir",     0xA930, 0x52c0,		  "S",	     0, SIZE_NONE,
+   cris_ver_v8_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jirc",    0x29b0, 0xd640,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8_10,
+   cris_reg_mode_jump_op},
+
+  {"jirc",    0x2930, 0xd2c0,		  "s",	     0, SIZE_FIX_32,
+   cris_ver_v8_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jirc",    0x2930, 0xd2c0,		  "S",	     0, SIZE_NONE,
+   cris_ver_v8_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jsr",     0xB9b0, 0x4640,		  "r",	     0, SIZE_NONE,     0,
+   cris_reg_mode_jump_op},
+
+  {"jsr",     0xB930, 0x42c0,		  "s",	     0, SIZE_FIX_32,
+   cris_ver_v0_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jsr",     0xBDBF, 0x4240,		  "N",	     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_none_reg_mode_jump_op},
+
+  {"jsr",     0xB930, 0x42c0,		  "S",	     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jsrc",    0x39b0, 0xc640,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8_10,
+   cris_reg_mode_jump_op},
+
+  {"jsrc",    0x3930, 0xc2c0,		  "s",	     0, SIZE_FIX_32,
+   cris_ver_v8_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jsrc",    0x3930, 0xc2c0,		  "S",	     0, SIZE_NONE,
+   cris_ver_v8_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jsrc",    0xBB30, 0x44C0,		  "r",       0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_reg_mode_jump_op},
+
+  {"jsrc",    0xBF3F, 0x40C0,		  "N",	     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_reg_mode_jump_op},
+
+  {"jump",    0x09b0, 0xF640,		  "r",	     0, SIZE_NONE,     0,
+   cris_reg_mode_jump_op},
+
+  {"jump",
+   JUMP_INDIR_OPCODE, JUMP_INDIR_Z_BITS,  "s",	     0, SIZE_FIX_32,
+   cris_ver_v0_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jump",
+   JUMP_INDIR_OPCODE, JUMP_INDIR_Z_BITS,  "S",	     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_jump_op},
+
+  {"jump",    0x09F0, 0x060F,		  "P",	     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_none_reg_mode_jump_op},
+
+  {"jump",
+   JUMP_PC_INCR_OPCODE_V32,
+   (0xffff & ~JUMP_PC_INCR_OPCODE_V32),	  "N",	     0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_none_reg_mode_jump_op},
+
+  {"jmpu",    0x8930, 0x72c0,		  "s",	     0, SIZE_FIX_32,
+   cris_ver_v10,
+   cris_none_reg_mode_jump_op},
+
+  {"jmpu",    0x8930, 0x72c0,		   "S",	     0, SIZE_NONE,
+   cris_ver_v10,
+   cris_none_reg_mode_jump_op},
+
+  {"lapc",    0x0970, 0x0680,		  "U,R",    0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"lapc",    0x0D7F, 0x0280,		  "dn,R",    0, SIZE_FIX_32,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"lapcq",   0x0970, 0x0680,		  "u,R",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_addi_op},
+
+  {"lsl",     0x04C0, 0x0B00,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_dstep_logshift_mstep_neg_not_op},
+
+  {"lslq",    0x03c0, 0x0C20,		  "c,R",     0, SIZE_NONE,     0,
+   cris_dstep_logshift_mstep_neg_not_op},
+
+  {"lsr",     0x07C0, 0x0800,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_dstep_logshift_mstep_neg_not_op},
+
+  {"lsrq",    0x03e0, 0x0C00,		  "c,R",     0, SIZE_NONE,     0,
+   cris_dstep_logshift_mstep_neg_not_op},
+
+  {"lz",      0x0730, 0x08C0,		  "r,R",     0, SIZE_NONE,
+   cris_ver_v3p,
+   cris_not_implemented_op},
+
+  {"mcp",      0x07f0, 0x0800,		  "P,r",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"move",    0x0640, 0x0980,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"move",    0x0A40, 0x0180,		  "m s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"move",    0x0A40, 0x0180,		  "m S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"move",    0x0630, 0x09c0,		  "r,P",     0, SIZE_NONE,     0,
+   cris_move_to_preg_op},
+
+  {"move",    0x0670, 0x0980,		  "P,r",     0, SIZE_NONE,     0,
+   cris_reg_mode_move_from_preg_op},
+
+  {"move",    0x0BC0, 0x0000,		  "m R,y",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"move",    0x0BC0, 0x0000,		  "m D,S",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"move",
+   MOVE_M_TO_PREG_OPCODE, MOVE_M_TO_PREG_ZBITS,
+   "s,P",   0, SIZE_SPEC_REG, 0,
+   cris_move_to_preg_op},
+
+  {"move",    0x0A30, 0x01c0,		  "S,P",     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_move_to_preg_op},
+
+  {"move",    0x0A70, 0x0180,		  "P,y",     0, SIZE_SPEC_REG, 0,
+   cris_none_reg_mode_move_from_preg_op},
+
+  {"move",    0x0A70, 0x0180,		  "P,S",     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_move_from_preg_op},
+
+  {"move",    0x0B70, 0x0480,		  "r,T",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"move",    0x0F70, 0x0080,		  "T,r",     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"movem",   0x0BF0, 0x0000,		  "R,y",     0, SIZE_FIX_32,   0,
+   cris_move_reg_to_mem_movem_op},
+
+  {"movem",   0x0BF0, 0x0000,		  "D,S",     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_move_reg_to_mem_movem_op},
+
+  {"movem",   0x0BB0, 0x0040,		  "s,R",     0, SIZE_FIX_32,   0,
+   cris_move_mem_to_reg_movem_op},
+
+  {"movem",   0x0BB0, 0x0040,		  "S,D",     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_move_mem_to_reg_movem_op},
+
+  {"moveq",   0x0240, 0x0D80,		  "i,R",     0, SIZE_NONE,     0,
+   cris_quick_mode_and_cmp_move_or_op},
+
+  {"movs",    0x0460, 0x0B80,		  "z r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  /* FIXME: SIZE_FIELD_SIGNED and all necessary changes.  */
+  {"movs",    0x0860, 0x0380,		  "z s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"movs",    0x0860, 0x0380,		  "z S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"movu",    0x0440, 0x0Ba0,		  "z r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  /* FIXME: SIZE_FIELD_UNSIGNED and all necessary changes.  */
+  {"movu",    0x0840, 0x03a0,		  "z s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"movu",    0x0840, 0x03a0,		  "z S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"mstep",   0x07f0, 0x0800,		  "r,R",     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_dstep_logshift_mstep_neg_not_op},
+
+  {"muls",    0x0d00, 0x02c0,		  "m r,R",   0, SIZE_NONE,
+   cris_ver_v10p,
+   cris_muls_op},
+
+  {"mulu",    0x0900, 0x06c0,		  "m r,R",   0, SIZE_NONE,
+   cris_ver_v10p,
+   cris_mulu_op},
+
+  {"neg",     0x0580, 0x0A40,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_dstep_logshift_mstep_neg_not_op},
+
+  {"nop",     NOP_OPCODE, NOP_Z_BITS,	  "",	     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_btst_nop_op},
+
+  {"nop",     NOP_OPCODE_V32, NOP_Z_BITS_V32, "",    0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_btst_nop_op},
+
+  {"not",     0x8770, 0x7880,		  "r",	     0, SIZE_NONE,     0,
+   cris_dstep_logshift_mstep_neg_not_op},
+
+  {"or",      0x0740, 0x0880,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"or",      0x0B40, 0x0080,		  "m s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"or",      0x0B40, 0x0080,		  "m S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"or",      0x0B40, 0x0480,		  "m S,R,r", 0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_three_operand_add_sub_cmp_and_or_op},
+
+  {"orq",     0x0340, 0x0C80,		  "i,R",     0, SIZE_NONE,     0,
+   cris_quick_mode_and_cmp_move_or_op},
+
+  {"pop",     0x0E6E, 0x0191,		  "!R",	     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"pop",     0x0e3e, 0x01c1,		  "!P",	     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_move_from_preg_op},
+
+  {"push",    0x0FEE, 0x0011,		  "BR",	     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"push",    0x0E7E, 0x0181,		  "BP",	     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_move_to_preg_op},
+
+  {"rbf",     0x3b30, 0xc0c0,		  "y",	     0, SIZE_NONE,
+   cris_ver_v10,
+   cris_not_implemented_op},
+
+  {"rbf",     0x3b30, 0xc0c0,		  "S",	     0, SIZE_NONE,
+   cris_ver_v10,
+   cris_not_implemented_op},
+
+  {"rfe",     0x2930, 0xD6CF,		  "",	     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"rfg",     0x4930, 0xB6CF,		  "",	     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"rfn",     0x5930, 0xA6CF,		  "",	     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  {"ret",     0xB67F, 0x4980,		  "",	     1, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_reg_mode_move_from_preg_op},
+
+  {"ret",     0xB9F0, 0x460F,		  "",	     1, SIZE_NONE,
+   cris_ver_v32p,
+   cris_reg_mode_move_from_preg_op},
+
+  {"retb",    0xe67f, 0x1980,		  "",	     1, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_reg_mode_move_from_preg_op},
+
+  {"rete",     0xA9F0, 0x560F,		  "",	     1, SIZE_NONE,
+   cris_ver_v32p,
+   cris_reg_mode_move_from_preg_op},
+
+  {"reti",    0xA67F, 0x5980,		  "",	     1, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_reg_mode_move_from_preg_op},
+
+  {"retn",     0xC9F0, 0x360F,		  "",	     1, SIZE_NONE,
+   cris_ver_v32p,
+   cris_reg_mode_move_from_preg_op},
+
+  {"sbfs",    0x3b70, 0xc080,		  "y",	     0, SIZE_NONE,
+   cris_ver_v10,
+   cris_not_implemented_op},
+
+  {"sbfs",    0x3b70, 0xc080,		  "S",	     0, SIZE_NONE,
+   cris_ver_v10,
+   cris_not_implemented_op},
+
+  {"sa",
+   0x0530+CC_A*0x1000,
+   0x0AC0+(0xf-CC_A)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"ssb",
+   0x0530+CC_EXT*0x1000,
+   0x0AC0+(0xf-CC_EXT)*0x1000,		  "r",	     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_scc_op},
+
+  {"scc",
+   0x0530+CC_CC*0x1000,
+   0x0AC0+(0xf-CC_CC)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"scs",
+   0x0530+CC_CS*0x1000,
+   0x0AC0+(0xf-CC_CS)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"seq",
+   0x0530+CC_EQ*0x1000,
+   0x0AC0+(0xf-CC_EQ)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"setf",    0x05b0, 0x0A40,		  "f",	     0, SIZE_NONE,     0,
+   cris_ax_ei_setf_op},
+
+  {"sfe",    0x3930, 0xC6CF,		  "",	     0, SIZE_NONE,
+   cris_ver_v32p,
+   cris_not_implemented_op},
+
+  /* Need to have "swf" in front of "sext" so it is the one displayed in
+     disassembly.  */
+  {"swf",
+   0x0530+CC_EXT*0x1000,
+   0x0AC0+(0xf-CC_EXT)*0x1000,		  "r",	     0, SIZE_NONE,
+   cris_ver_v10,
+   cris_scc_op},
+
+  {"sext",
+   0x0530+CC_EXT*0x1000,
+   0x0AC0+(0xf-CC_EXT)*0x1000,		  "r",	     0, SIZE_NONE,
+   cris_ver_v0_3,
+   cris_scc_op},
+
+  {"sge",
+   0x0530+CC_GE*0x1000,
+   0x0AC0+(0xf-CC_GE)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"sgt",
+   0x0530+CC_GT*0x1000,
+   0x0AC0+(0xf-CC_GT)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"shi",
+   0x0530+CC_HI*0x1000,
+   0x0AC0+(0xf-CC_HI)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"shs",
+   0x0530+CC_HS*0x1000,
+   0x0AC0+(0xf-CC_HS)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"sle",
+   0x0530+CC_LE*0x1000,
+   0x0AC0+(0xf-CC_LE)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"slo",
+   0x0530+CC_LO*0x1000,
+   0x0AC0+(0xf-CC_LO)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"sls",
+   0x0530+CC_LS*0x1000,
+   0x0AC0+(0xf-CC_LS)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"slt",
+   0x0530+CC_LT*0x1000,
+   0x0AC0+(0xf-CC_LT)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"smi",
+   0x0530+CC_MI*0x1000,
+   0x0AC0+(0xf-CC_MI)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"sne",
+   0x0530+CC_NE*0x1000,
+   0x0AC0+(0xf-CC_NE)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"spl",
+   0x0530+CC_PL*0x1000,
+   0x0AC0+(0xf-CC_PL)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"sub",     0x0680, 0x0940,		  "m r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"sub",     0x0a80, 0x0140,		  "m s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"sub",     0x0a80, 0x0140,		  "m S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"sub",     0x0a80, 0x0540,		  "m S,R,r", 0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_three_operand_add_sub_cmp_and_or_op},
+
+  {"subq",    0x0280, 0x0d40,		  "I,R",     0, SIZE_NONE,     0,
+   cris_quick_mode_add_sub_op},
+
+  {"subs",    0x04a0, 0x0b40,		  "z r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  /* FIXME: SIZE_FIELD_SIGNED and all necessary changes.  */
+  {"subs",    0x08a0, 0x0340,		  "z s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"subs",    0x08a0, 0x0340,		  "z S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"subs",    0x08a0, 0x0740,		  "z S,R,r", 0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_three_operand_add_sub_cmp_and_or_op},
+
+  {"subu",    0x0480, 0x0b60,		  "z r,R",   0, SIZE_NONE,     0,
+   cris_reg_mode_add_sub_cmp_and_or_move_op},
+
+  /* FIXME: SIZE_FIELD_UNSIGNED and all necessary changes.  */
+  {"subu",    0x0880, 0x0360,		  "z s,R",   0, SIZE_FIELD,    0,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"subu",    0x0880, 0x0360,		  "z S,D",   0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_add_sub_cmp_and_or_move_op},
+
+  {"subu",    0x0880, 0x0760,		  "z S,R,r", 0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_three_operand_add_sub_cmp_and_or_op},
+
+  {"svc",
+   0x0530+CC_VC*0x1000,
+   0x0AC0+(0xf-CC_VC)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  {"svs",
+   0x0530+CC_VS*0x1000,
+   0x0AC0+(0xf-CC_VS)*0x1000,		  "r",	     0, SIZE_NONE,     0,
+   cris_scc_op},
+
+  /* The insn "swapn" is the same as "not" and will be disassembled as
+     such, but the swap* family of mnmonics are generally v8-and-higher
+     only, so count it in.  */
+  {"swapn",   0x8770, 0x7880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapw",   0x4770, 0xb880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapnw",  0xc770, 0x3880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapb",   0x2770, 0xd880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapnb",  0xA770, 0x5880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapwb",  0x6770, 0x9880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapnwb", 0xE770, 0x1880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapr",   0x1770, 0xe880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapnr",  0x9770, 0x6880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapwr",  0x5770, 0xa880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapnwr", 0xd770, 0x2880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapbr",  0x3770, 0xc880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapnbr", 0xb770, 0x4880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapwbr", 0x7770, 0x8880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"swapnwbr", 0xf770, 0x0880,		  "r",	     0, SIZE_NONE,
+   cris_ver_v8p,
+   cris_not_implemented_op},
+
+  {"test",    0x0640, 0x0980,		  "m D",     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_reg_mode_test_op},
+
+  {"test",    0x0b80, 0xf040,		  "m y",     0, SIZE_FIELD,    0,
+   cris_none_reg_mode_clear_test_op},
+
+  {"test",    0x0b80, 0xf040,		  "m S",     0, SIZE_NONE,
+   cris_ver_v0_10,
+   cris_none_reg_mode_clear_test_op},
+
+  {"xor",     0x07B0, 0x0840,		  "r,R",     0, SIZE_NONE,     0,
+   cris_xor_op},
+
+  {NULL, 0, 0, NULL, 0, 0, 0, cris_not_implemented_op}
+};
+
+/* Condition-names, indexed by the CC_* numbers as found in cris.h. */
+const char * const
+cris_cc_strings[] =
+{
+  "hs",
+  "lo",
+  "ne",
+  "eq",
+  "vc",
+  "vs",
+  "pl",
+  "mi",
+  "ls",
+  "hi",
+  "ge",
+  "lt",
+  "gt",
+  "le",
+  "a",
+  /* This is a placeholder.  In v0, this would be "ext".  In v32, this
+     is "sb".  See cris_conds15.  */
+  "wf"
+};
+
+/* Different names and semantics for condition 1111 (0xf).  */
+const struct cris_cond15 cris_cond15s[] =
+{
+  /* FIXME: In what version did condition "ext" disappear?  */
+  {"ext", cris_ver_v0_3},
+  {"wf", cris_ver_v10},
+  {"sb", cris_ver_v32p},
+  {NULL, 0}
+};
+
+
+/*
+ * Local variables:
+ * eval: (c-set-style "gnu")
+ * indent-tabs-mode: t
+ * End:
+ */
+
+
+/* No instruction will be disassembled longer than this.  In theory, and
+   in silicon, address prefixes can be cascaded.  In practice, cascading
+   is not used by GCC, and not supported by the assembler.  */
+#ifndef MAX_BYTES_PER_CRIS_INSN
+#define MAX_BYTES_PER_CRIS_INSN 8
+#endif
+
+/* Whether or not to decode prefixes, folding it into the following
+   instruction.  FIXME: Make this optional later.  */
+#ifndef PARSE_PREFIX
+#define PARSE_PREFIX 1
+#endif
+
+/* Sometimes we prefix all registers with this character.  */
+#define REGISTER_PREFIX_CHAR '$'
+
+/* Whether or not to trace the following sequence:
+   sub* X,r%d
+   bound* Y,r%d
+   adds.w [pc+r%d.w],pc
+
+   This is the assembly form of a switch-statement in C.
+   The "sub is optional.  If there is none, then X will be zero.
+   X is the value of the first case,
+   Y is the number of cases (including default).
+
+   This results in case offsets printed on the form:
+    case N: -> case_address
+   where N is an estimation on the corresponding 'case' operand in C,
+   and case_address is where execution of that case continues after the
+   sequence presented above.
+
+   The old style of output was to print the offsets as instructions,
+   which made it hard to follow "case"-constructs in the disassembly,
+   and caused a lot of annoying warnings about undefined instructions.
+
+   FIXME: Make this optional later.  */
+#ifndef TRACE_CASE
+#define TRACE_CASE (disdata->trace_case)
+#endif
+
+enum cris_disass_family
+ { cris_dis_v0_v10, cris_dis_common_v10_v32, cris_dis_v32 };
+
+/* Stored in the disasm_info->private_data member.  */
+struct cris_disasm_data
+{
+  /* Whether to print something less confusing if we find something
+     matching a switch-construct.  */
+  bfd_boolean trace_case;
+
+  /* Whether this code is flagged as crisv32.  FIXME: Should be an enum
+     that includes "compatible".  */
+  enum cris_disass_family distype;
+};
+
+/* Value of first element in switch.  */
+static long case_offset = 0;
+
+/* How many more case-offsets to print.  */
+static long case_offset_counter = 0;
+
+/* Number of case offsets.  */
+static long no_of_case_offsets = 0;
+
+/* Candidate for next case_offset.  */
+static long last_immediate = 0;
+
+static int cris_constraint
+  (const char *, unsigned, unsigned, struct cris_disasm_data *);
+
+/* Parse disassembler options and store state in info.  FIXME: For the
+   time being, we abuse static variables.  */
+
+static bfd_boolean
+cris_parse_disassembler_options (disassemble_info *info,
+				 enum cris_disass_family distype)
+{
+  struct cris_disasm_data *disdata;
+
+  info->private_data = calloc (1, sizeof (struct cris_disasm_data));
+  disdata = (struct cris_disasm_data *) info->private_data;
+  if (disdata == NULL)
+    return FALSE;
+
+  /* Default true.  */
+  disdata->trace_case
+    = (info->disassembler_options == NULL
+       || (strcmp (info->disassembler_options, "nocase") != 0));
+
+  disdata->distype = distype;
+  return TRUE;
+}
+
+static const struct cris_spec_reg *
+spec_reg_info (unsigned int sreg, enum cris_disass_family distype)
+{
+  int i;
+
+  for (i = 0; cris_spec_regs[i].name != NULL; i++)
+    {
+      if (cris_spec_regs[i].number == sreg)
+	{
+	  if (distype == cris_dis_v32)
+	    switch (cris_spec_regs[i].applicable_version)
+	      {
+	      case cris_ver_warning:
+	      case cris_ver_version_all:
+	      case cris_ver_v3p:
+	      case cris_ver_v8p:
+	      case cris_ver_v10p:
+	      case cris_ver_v32p:
+		/* No ambiguous sizes or register names with CRISv32.  */
+		if (cris_spec_regs[i].warning == NULL)
+		  return &cris_spec_regs[i];
+	      default:
+		;
+	      }
+	  else if (cris_spec_regs[i].applicable_version != cris_ver_v32p)
+	    return &cris_spec_regs[i];
+	}
+    }
+
+  return NULL;
+}
+
+/* Return the number of bits in the argument.  */
+
+static int
+number_of_bits (unsigned int val)
+{
+  int bits;
+
+  for (bits = 0; val != 0; val &= val - 1)
+    bits++;
+
+  return bits;
+}
+
+/* Get an entry in the opcode-table.  */
+
+static const struct cris_opcode *
+get_opcode_entry (unsigned int insn,
+		  unsigned int prefix_insn,
+		  struct cris_disasm_data *disdata)
+{
+  /* For non-prefixed insns, we keep a table of pointers, indexed by the
+     insn code.  Each entry is initialized when found to be NULL.  */
+  static const struct cris_opcode **opc_table = NULL;
+
+  const struct cris_opcode *max_matchedp = NULL;
+  const struct cris_opcode **prefix_opc_table = NULL;
+
+  /* We hold a table for each prefix that need to be handled differently.  */
+  static const struct cris_opcode **dip_prefixes = NULL;
+  static const struct cris_opcode **bdapq_m1_prefixes = NULL;
+  static const struct cris_opcode **bdapq_m2_prefixes = NULL;
+  static const struct cris_opcode **bdapq_m4_prefixes = NULL;
+  static const struct cris_opcode **rest_prefixes = NULL;
+
+  /* Allocate and clear the opcode-table.  */
+  if (opc_table == NULL)
+    {
+      opc_table = malloc (65536 * sizeof (opc_table[0]));
+      if (opc_table == NULL)
+	return NULL;
+
+      memset (opc_table, 0, 65536 * sizeof (const struct cris_opcode *));
+
+      dip_prefixes
+	= malloc (65536 * sizeof (const struct cris_opcode **));
+      if (dip_prefixes == NULL)
+	return NULL;
+
+      memset (dip_prefixes, 0, 65536 * sizeof (dip_prefixes[0]));
+
+      bdapq_m1_prefixes
+	= malloc (65536 * sizeof (const struct cris_opcode **));
+      if (bdapq_m1_prefixes == NULL)
+	return NULL;
+
+      memset (bdapq_m1_prefixes, 0, 65536 * sizeof (bdapq_m1_prefixes[0]));
+
+      bdapq_m2_prefixes
+	= malloc (65536 * sizeof (const struct cris_opcode **));
+      if (bdapq_m2_prefixes == NULL)
+	return NULL;
+
+      memset (bdapq_m2_prefixes, 0, 65536 * sizeof (bdapq_m2_prefixes[0]));
+
+      bdapq_m4_prefixes
+	= malloc (65536 * sizeof (const struct cris_opcode **));
+      if (bdapq_m4_prefixes == NULL)
+	return NULL;
+
+      memset (bdapq_m4_prefixes, 0, 65536 * sizeof (bdapq_m4_prefixes[0]));
+
+      rest_prefixes
+	= malloc (65536 * sizeof (const struct cris_opcode **));
+      if (rest_prefixes == NULL)
+	return NULL;
+
+      memset (rest_prefixes, 0, 65536 * sizeof (rest_prefixes[0]));
+    }
+
+  /* Get the right table if this is a prefix.
+     This code is connected to cris_constraints in that it knows what
+     prefixes play a role in recognition of patterns; the necessary
+     state is reflected by which table is used.  If constraints
+     involving match or non-match of prefix insns are changed, then this
+     probably needs changing too.  */
+  if (prefix_insn != NO_CRIS_PREFIX)
+    {
+      const struct cris_opcode *popcodep
+	= (opc_table[prefix_insn] != NULL
+	   ? opc_table[prefix_insn]
+	   : get_opcode_entry (prefix_insn, NO_CRIS_PREFIX, disdata));
+
+      if (popcodep == NULL)
+	return NULL;
+
+      if (popcodep->match == BDAP_QUICK_OPCODE)
+	{
+	  /* Since some offsets are recognized with "push" macros, we
+	     have to have different tables for them.  */
+	  int offset = (prefix_insn & 255);
+
+	  if (offset > 127)
+	    offset -= 256;
+
+	  switch (offset)
+	    {
+	    case -4:
+	      prefix_opc_table = bdapq_m4_prefixes;
+	      break;
+
+	    case -2:
+	      prefix_opc_table = bdapq_m2_prefixes;
+	      break;
+
+	    case -1:
+	      prefix_opc_table = bdapq_m1_prefixes;
+	      break;
+
+	    default:
+	      prefix_opc_table = rest_prefixes;
+	      break;
+	    }
+	}
+      else if (popcodep->match == DIP_OPCODE)
+	/* We don't allow postincrement when the prefix is DIP, so use a
+	   different table for DIP.  */
+	prefix_opc_table = dip_prefixes;
+      else
+	prefix_opc_table = rest_prefixes;
+    }
+
+  if (prefix_insn != NO_CRIS_PREFIX
+      && prefix_opc_table[insn] != NULL)
+    max_matchedp = prefix_opc_table[insn];
+  else if (prefix_insn == NO_CRIS_PREFIX && opc_table[insn] != NULL)
+    max_matchedp = opc_table[insn];
+  else
+    {
+      const struct cris_opcode *opcodep;
+      int max_level_of_match = -1;
+
+      for (opcodep = cris_opcodes;
+	   opcodep->name != NULL;
+	   opcodep++)
+	{
+	  int level_of_match;
+
+	  if (disdata->distype == cris_dis_v32)
+	    {
+	      switch (opcodep->applicable_version)
+		{
+		case cris_ver_version_all:
+		  break;
+
+		case cris_ver_v0_3:
+		case cris_ver_v0_10:
+		case cris_ver_v3_10:
+		case cris_ver_sim_v0_10:
+		case cris_ver_v8_10:
+		case cris_ver_v10:
+		case cris_ver_warning:
+		  continue;
+
+		case cris_ver_v3p:
+		case cris_ver_v8p:
+		case cris_ver_v10p:
+		case cris_ver_v32p:
+		  break;
+
+		case cris_ver_v8:
+		  abort ();
+		default:
+		  abort ();
+		}
+	    }
+	  else
+	    {
+	      switch (opcodep->applicable_version)
+		{
+		case cris_ver_version_all:
+		case cris_ver_v0_3:
+		case cris_ver_v3p:
+		case cris_ver_v0_10:
+		case cris_ver_v8p:
+		case cris_ver_v8_10:
+		case cris_ver_v10:
+		case cris_ver_sim_v0_10:
+		case cris_ver_v10p:
+		case cris_ver_warning:
+		  break;
+
+		case cris_ver_v32p:
+		  continue;
+
+		case cris_ver_v8:
+		  abort ();
+		default:
+		  abort ();
+		}
+	    }
+
+	  /* We give a double lead for bits matching the template in
+	     cris_opcodes.  Not even, because then "move p8,r10" would
+	     be given 2 bits lead over "clear.d r10".  When there's a
+	     tie, the first entry in the table wins.  This is
+	     deliberate, to avoid a more complicated recognition
+	     formula.  */
+	  if ((opcodep->match & insn) == opcodep->match
+	      && (opcodep->lose & insn) == 0
+	      && ((level_of_match
+		   = cris_constraint (opcodep->args,
+				      insn,
+				      prefix_insn,
+				      disdata))
+		  >= 0)
+	      && ((level_of_match
+		   += 2 * number_of_bits (opcodep->match
+					  | opcodep->lose))
+			  > max_level_of_match))
+		    {
+		      max_matchedp = opcodep;
+		      max_level_of_match = level_of_match;
+
+		      /* If there was a full match, never mind looking
+			 further.  */
+		      if (level_of_match >= 2 * 16)
+			break;
+		    }
+		}
+      /* Fill in the new entry.
+
+	 If there are changes to the opcode-table involving prefixes, and
+	 disassembly then does not work correctly, try removing the
+	 else-clause below that fills in the prefix-table.  If that
+	 helps, you need to change the prefix_opc_table setting above, or
+	 something related.  */
+      if (prefix_insn == NO_CRIS_PREFIX)
+	opc_table[insn] = max_matchedp;
+      else
+	prefix_opc_table[insn] = max_matchedp;
+    }
+
+  return max_matchedp;
+}
+
+/* Return -1 if the constraints of a bitwise-matched instruction say
+   that there is no match.  Otherwise return a nonnegative number
+   indicating the confidence in the match (higher is better).  */
+
+static int
+cris_constraint (const char *cs,
+		 unsigned int insn,
+		 unsigned int prefix_insn,
+		 struct cris_disasm_data *disdata)
+{
+  int retval = 0;
+  int tmp;
+  int prefix_ok = 0;
+  const char *s;
+
+  for (s = cs; *s; s++)
+    switch (*s)
+      {
+      case '!':
+	/* Do not recognize "pop" if there's a prefix and then only for
+           v0..v10.  */
+	if (prefix_insn != NO_CRIS_PREFIX
+	    || disdata->distype != cris_dis_v0_v10)
+	  return -1;
+	break;
+
+      case 'U':
+	/* Not recognized at disassembly.  */
+	return -1;
+
+      case 'M':
+	/* Size modifier for "clear", i.e. special register 0, 4 or 8.
+	   Check that it is one of them.  Only special register 12 could
+	   be mismatched, but checking for matches is more logical than
+	   checking for mismatches when there are only a few cases.  */
+	tmp = ((insn >> 12) & 0xf);
+	if (tmp != 0 && tmp != 4 && tmp != 8)
+	  return -1;
+	break;
+
+      case 'm':
+	if ((insn & 0x30) == 0x30)
+	  return -1;
+	break;
+
+      case 'S':
+	/* A prefix operand without side-effect.  */
+	if (prefix_insn != NO_CRIS_PREFIX && (insn & 0x400) == 0)
+	  {
+	    prefix_ok = 1;
+	    break;
+	  }
+	else
+	  return -1;
+
+      case 's':
+      case 'y':
+      case 'Y':
+	/* If this is a prefixed insn with postincrement (side-effect),
+	   the prefix must not be DIP.  */
+	if (prefix_insn != NO_CRIS_PREFIX)
+	  {
+	    if (insn & 0x400)
+	      {
+		const struct cris_opcode *prefix_opcodep
+		  = get_opcode_entry (prefix_insn, NO_CRIS_PREFIX, disdata);
+
+		if (prefix_opcodep->match == DIP_OPCODE)
+		  return -1;
+	      }
+
+	    prefix_ok = 1;
+	  }
+	break;
+
+      case 'B':
+	/* If we don't fall through, then the prefix is ok.  */
+	prefix_ok = 1;
+
+	/* A "push" prefix.  Check for valid "push" size.
+	   In case of special register, it may be != 4.  */
+	if (prefix_insn != NO_CRIS_PREFIX)
+	  {
+	    /* Match the prefix insn to BDAPQ.  */
+	    const struct cris_opcode *prefix_opcodep
+	      = get_opcode_entry (prefix_insn, NO_CRIS_PREFIX, disdata);
+
+	    if (prefix_opcodep->match == BDAP_QUICK_OPCODE)
+	      {
+		int pushsize = (prefix_insn & 255);
+
+		if (pushsize > 127)
+		  pushsize -= 256;
+
+		if (s[1] == 'P')
+		  {
+		    unsigned int spec_reg = (insn >> 12) & 15;
+		    const struct cris_spec_reg *sregp
+		      = spec_reg_info (spec_reg, disdata->distype);
+
+		    /* For a special-register, the "prefix size" must
+		       match the size of the register.  */
+		    if (sregp && sregp->reg_size == (unsigned int) -pushsize)
+		      break;
+		  }
+		else if (s[1] == 'R')
+		  {
+		    if ((insn & 0x30) == 0x20 && pushsize == -4)
+		      break;
+		  }
+		/* FIXME:  Should abort here; next constraint letter
+		   *must* be 'P' or 'R'.  */
+	      }
+	  }
+	return -1;
+
+      case 'D':
+	retval = (((insn >> 12) & 15) == (insn & 15));
+	if (!retval)
+	  return -1;
+	else
+	  retval += 4;
+	break;
+
+      case 'P':
+	{
+	  const struct cris_spec_reg *sregp
+	    = spec_reg_info ((insn >> 12) & 15, disdata->distype);
+
+	  /* Since we match four bits, we will give a value of 4-1 = 3
+	     in a match.  If there is a corresponding exact match of a
+	     special register in another pattern, it will get a value of
+	     4, which will be higher.  This should be correct in that an
+	     exact pattern would match better than a general pattern.
+
+	     Note that there is a reason for not returning zero; the
+	     pattern for "clear" is partly  matched in the bit-pattern
+	     (the two lower bits must be zero), while the bit-pattern
+	     for a move from a special register is matched in the
+	     register constraint.  */
+
+	  if (sregp != NULL)
+	    {
+	      retval += 3;
+	      break;
+	    }
+	  else
+	    return -1;
+	}
+      }
+
+  if (prefix_insn != NO_CRIS_PREFIX && ! prefix_ok)
+    return -1;
+
+  return retval;
+}
+
+/* Format number as hex with a leading "0x" into outbuffer.  */
+
+static char *
+format_hex (unsigned long number,
+	    char *outbuffer,
+	    struct cris_disasm_data *disdata)
+{
+  /* Truncate negative numbers on >32-bit hosts.  */
+  number &= 0xffffffff;
+
+  sprintf (outbuffer, "0x%lx", number);
+
+  /* Save this value for the "case" support.  */
+  if (TRACE_CASE)
+    last_immediate = number;
+
+  return outbuffer + strlen (outbuffer);
+}
+
+/* Format number as decimal into outbuffer.  Parameter signedp says
+   whether the number should be formatted as signed (!= 0) or
+   unsigned (== 0).  */
+
+static char *
+format_dec (long number, char *outbuffer, int signedp)
+{
+  last_immediate = number;
+  sprintf (outbuffer, signedp ? "%ld" : "%lu", number);
+
+  return outbuffer + strlen (outbuffer);
+}
+
+/* Format the name of the general register regno into outbuffer.  */
+
+static char *
+format_reg (struct cris_disasm_data *disdata,
+	    int regno,
+	    char *outbuffer_start,
+	    bfd_boolean with_reg_prefix)
+{
+  char *outbuffer = outbuffer_start;
+
+  if (with_reg_prefix)
+    *outbuffer++ = REGISTER_PREFIX_CHAR;
+
+  switch (regno)
+    {
+    case 15:
+      /* For v32, there is no context in which we output PC.  */
+      if (disdata->distype == cris_dis_v32)
+	strcpy (outbuffer, "acr");
+      else
+	strcpy (outbuffer, "pc");
+      break;
+
+    case 14:
+      strcpy (outbuffer, "sp");
+      break;
+
+    default:
+      sprintf (outbuffer, "r%d", regno);
+      break;
+    }
+
+  return outbuffer_start + strlen (outbuffer_start);
+}
+
+/* Format the name of a support register into outbuffer.  */
+
+static char *
+format_sup_reg (unsigned int regno,
+		char *outbuffer_start,
+		bfd_boolean with_reg_prefix)
+{
+  char *outbuffer = outbuffer_start;
+  int i;
+
+  if (with_reg_prefix)
+    *outbuffer++ = REGISTER_PREFIX_CHAR;
+
+  for (i = 0; cris_support_regs[i].name != NULL; i++)
+    if (cris_support_regs[i].number == regno)
+      {
+	sprintf (outbuffer, "%s", cris_support_regs[i].name);
+	return outbuffer_start + strlen (outbuffer_start);
+      }
+
+  /* There's supposed to be register names covering all numbers, though
+     some may be generic names.  */
+  sprintf (outbuffer, "format_sup_reg-BUG");
+  return outbuffer_start + strlen (outbuffer_start);
+}
+
+/* Return the length of an instruction.  */
+
+static unsigned
+bytes_to_skip (unsigned int insn,
+	       const struct cris_opcode *matchedp,
+	       enum cris_disass_family distype,
+	       const struct cris_opcode *prefix_matchedp)
+{
+  /* Each insn is a word plus "immediate" operands.  */
+  unsigned to_skip = 2;
+  const char *template = matchedp->args;
+  const char *s;
+
+  for (s = template; *s; s++)
+    if ((*s == 's' || *s == 'N' || *s == 'Y')
+	&& (insn & 0x400) && (insn & 15) == 15
+	&& prefix_matchedp == NULL)
+      {
+	/* Immediate via [pc+], so we have to check the size of the
+	   operand.  */
+	int mode_size = 1 << ((insn >> 4) & (*template == 'z' ? 1 : 3));
+
+	if (matchedp->imm_oprnd_size == SIZE_FIX_32)
+	  to_skip += 4;
+	else if (matchedp->imm_oprnd_size == SIZE_SPEC_REG)
+	  {
+	    const struct cris_spec_reg *sregp
+	      = spec_reg_info ((insn >> 12) & 15, distype);
+
+	    /* FIXME: Improve error handling; should have been caught
+	       earlier.  */
+	    if (sregp == NULL)
+	      return 2;
+
+	    /* PC is incremented by two, not one, for a byte.  Except on
+	       CRISv32, where constants are always DWORD-size for
+	       special registers.  */
+	    to_skip +=
+	      distype == cris_dis_v32 ? 4 : (sregp->reg_size + 1) & ~1;
+	  }
+	else
+	  to_skip += (mode_size + 1) & ~1;
+      }
+    else if (*s == 'n')
+      to_skip += 4;
+    else if (*s == 'b')
+      to_skip += 2;
+
+  return to_skip;
+}
+
+/* Print condition code flags.  */
+
+static char *
+print_flags (struct cris_disasm_data *disdata, unsigned int insn, char *cp)
+{
+  /* Use the v8 (Etrax 100) flag definitions for disassembly.
+     The differences with v0 (Etrax 1..4) vs. Svinto are:
+      v0 'd' <=> v8 'm'
+      v0 'e' <=> v8 'b'.
+     FIXME: Emit v0..v3 flag names somehow.  */
+  static const char v8_fnames[] = "cvznxibm";
+  static const char v32_fnames[] = "cvznxiup";
+  const char *fnames
+    = disdata->distype == cris_dis_v32 ? v32_fnames : v8_fnames;
+
+  unsigned char flagbits = (((insn >> 8) & 0xf0) | (insn & 15));
+  int i;
+
+  for (i = 0; i < 8; i++)
+    if (flagbits & (1 << i))
+      *cp++ = fnames[i];
+
+  return cp;
+}
+
+/* Print out an insn with its operands, and update the info->insn_type
+   fields.  The prefix_opcodep and the rest hold a prefix insn that is
+   supposed to be output as an address mode.  */
+
+static void
+print_with_operands (const struct cris_opcode *opcodep,
+		     unsigned int insn,
+		     unsigned char *buffer,
+		     bfd_vma addr,
+		     disassemble_info *info,
+		     /* If a prefix insn was before this insn (and is supposed
+			to be output as an address), here is a description of
+			it.  */
+		     const struct cris_opcode *prefix_opcodep,
+		     unsigned int prefix_insn,
+		     unsigned char *prefix_buffer,
+		     bfd_boolean with_reg_prefix)
+{
+  /* Get a buffer of somewhat reasonable size where we store
+     intermediate parts of the insn.  */
+  char temp[sizeof (".d [$r13=$r12-2147483648],$r10") * 2];
+  char *tp = temp;
+  static const char mode_char[] = "bwd?";
+  const char *s;
+  const char *cs;
+  struct cris_disasm_data *disdata
+    = (struct cris_disasm_data *) info->private_data;
+
+  /* Print out the name first thing we do.  */
+  (*info->fprintf_func) (info->stream, "%s", opcodep->name);
+
+  cs = opcodep->args;
+  s = cs;
+
+  /* Ignore any prefix indicator.  */
+  if (*s == 'p')
+    s++;
+
+  if (*s == 'm' || *s == 'M' || *s == 'z')
+    {
+      *tp++ = '.';
+
+      /* Get the size-letter.  */
+      *tp++ = *s == 'M'
+	? (insn & 0x8000 ? 'd'
+	   : insn & 0x4000 ? 'w' : 'b')
+	: mode_char[(insn >> 4) & (*s == 'z' ? 1 : 3)];
+
+      /* Ignore the size and the space character that follows.  */
+      s += 2;
+    }
+
+  /* Add a space if this isn't a long-branch, because for those will add
+     the condition part of the name later.  */
+  if (opcodep->match != (BRANCH_PC_LOW + BRANCH_INCR_HIGH * 256))
+    *tp++ = ' ';
+
+  /* Fill in the insn-type if deducible from the name (and there's no
+     better way).  */
+  if (opcodep->name[0] == 'j')
+    {
+      if (CONST_STRNEQ (opcodep->name, "jsr"))
+	/* It's "jsr" or "jsrc".  */
+	info->insn_type = dis_jsr;
+      else
+	/* Any other jump-type insn is considered a branch.  */
+	info->insn_type = dis_branch;
+    }
+
+  /* We might know some more fields right now.  */
+  info->branch_delay_insns = opcodep->delayed;
+
+  /* Handle operands.  */
+  for (; *s; s++)
+    {
+    switch (*s)
+      {
+      case 'T':
+	tp = format_sup_reg ((insn >> 12) & 15, tp, with_reg_prefix);
+	break;
+
+      case 'A':
+	if (with_reg_prefix)
+	  *tp++ = REGISTER_PREFIX_CHAR;
+	*tp++ = 'a';
+	*tp++ = 'c';
+	*tp++ = 'r';
+	break;
+
+      case '[':
+      case ']':
+      case ',':
+	*tp++ = *s;
+	break;
+
+      case '!':
+	/* Ignore at this point; used at earlier stages to avoid
+	   recognition if there's a prefix at something that in other
+	   ways looks like a "pop".  */
+	break;
+
+      case 'd':
+	/* Ignore.  This is an optional ".d " on the large one of
+	   relaxable insns.  */
+	break;
+
+      case 'B':
+	/* This was the prefix that made this a "push".  We've already
+	   handled it by recognizing it, so signal that the prefix is
+	   handled by setting it to NULL.  */
+	prefix_opcodep = NULL;
+	break;
+
+      case 'D':
+      case 'r':
+	tp = format_reg (disdata, insn & 15, tp, with_reg_prefix);
+	break;
+
+      case 'R':
+	tp = format_reg (disdata, (insn >> 12) & 15, tp, with_reg_prefix);
+	break;
+
+      case 'n':
+	{
+	  /* Like N but pc-relative to the start of the insn.  */
+	  unsigned long number
+	    = (buffer[2] + buffer[3] * 256 + buffer[4] * 65536
+	       + buffer[5] * 0x1000000 + addr);
+
+	  /* Finish off and output previous formatted bytes.  */
+	  *tp = 0;
+	  if (temp[0])
+	    (*info->fprintf_func) (info->stream, "%s", temp);
+	  tp = temp;
+
+	  (*info->print_address_func) ((bfd_vma) number, info);
+	}
+	break;
+
+      case 'u':
+	{
+	  /* Like n but the offset is bits <3:0> in the instruction.  */
+	  unsigned long number = (buffer[0] & 0xf) * 2 + addr;
+
+	  /* Finish off and output previous formatted bytes.  */
+	  *tp = 0;
+	  if (temp[0])
+	    (*info->fprintf_func) (info->stream, "%s", temp);
+	  tp = temp;
+
+	  (*info->print_address_func) ((bfd_vma) number, info);
+	}
+	break;
+
+      case 'N':
+      case 'y':
+      case 'Y':
+      case 'S':
+      case 's':
+	/* Any "normal" memory operand.  */
+	if ((insn & 0x400) && (insn & 15) == 15 && prefix_opcodep == NULL)
+	  {
+	    /* We're looking at [pc+], i.e. we need to output an immediate
+	       number, where the size can depend on different things.  */
+	    long number;
+	    int signedp
+	      = ((*cs == 'z' && (insn & 0x20))
+		 || opcodep->match == BDAP_QUICK_OPCODE);
+	    int nbytes;
+
+	    if (opcodep->imm_oprnd_size == SIZE_FIX_32)
+	      nbytes = 4;
+	    else if (opcodep->imm_oprnd_size == SIZE_SPEC_REG)
+	      {
+		const struct cris_spec_reg *sregp
+		  = spec_reg_info ((insn >> 12) & 15, disdata->distype);
+
+		/* A NULL return should have been as a non-match earlier,
+		   so catch it as an internal error in the error-case
+		   below.  */
+		if (sregp == NULL)
+		  /* Whatever non-valid size.  */
+		  nbytes = 42;
+		else
+		  /* PC is always incremented by a multiple of two.
+		     For CRISv32, immediates are always 4 bytes for
+		     special registers.  */
+		  nbytes = disdata->distype == cris_dis_v32
+		    ? 4 : (sregp->reg_size + 1) & ~1;
+	      }
+	    else
+	      {
+		int mode_size = 1 << ((insn >> 4) & (*cs == 'z' ? 1 : 3));
+
+		if (mode_size == 1)
+		  nbytes = 2;
+		else
+		  nbytes = mode_size;
+	      }
+
+	    switch (nbytes)
+	      {
+	      case 1:
+		number = buffer[2];
+		if (signedp && number > 127)
+		  number -= 256;
+		break;
+
+	      case 2:
+		number = buffer[2] + buffer[3] * 256;
+		if (signedp && number > 32767)
+		  number -= 65536;
+		break;
+
+	      case 4:
+		number
+		  = buffer[2] + buffer[3] * 256 + buffer[4] * 65536
+		  + buffer[5] * 0x1000000;
+		break;
+
+	      default:
+		strcpy (tp, "bug");
+		tp += 3;
+		number = 42;
+	      }
+
+	    if ((*cs == 'z' && (insn & 0x20))
+		|| (opcodep->match == BDAP_QUICK_OPCODE
+		    && (nbytes <= 2 || buffer[1 + nbytes] == 0)))
+	      tp = format_dec (number, tp, signedp);
+	    else
+	      {
+		unsigned int highbyte = (number >> 24) & 0xff;
+
+		/* Either output this as an address or as a number.  If it's
+		   a dword with the same high-byte as the address of the
+		   insn, assume it's an address, and also if it's a non-zero
+		   non-0xff high-byte.  If this is a jsr or a jump, then
+		   it's definitely an address.  */
+		if (nbytes == 4
+		    && (highbyte == ((addr >> 24) & 0xff)
+			|| (highbyte != 0 && highbyte != 0xff)
+			|| info->insn_type == dis_branch
+			|| info->insn_type == dis_jsr))
+		  {
+		    /* Finish off and output previous formatted bytes.  */
+		    *tp = 0;
+		    tp = temp;
+		    if (temp[0])
+		      (*info->fprintf_func) (info->stream, "%s", temp);
+
+		    (*info->print_address_func) ((bfd_vma) number, info);
+
+		    info->target = number;
+		  }
+		else
+		  tp = format_hex (number, tp, disdata);
+	      }
+	  }
+	else
+	  {
+	    /* Not an immediate number.  Then this is a (possibly
+	       prefixed) memory operand.  */
+	    if (info->insn_type != dis_nonbranch)
+	      {
+		int mode_size
+		  = 1 << ((insn >> 4)
+			  & (opcodep->args[0] == 'z' ? 1 : 3));
+		int size;
+		info->insn_type = dis_dref;
+		info->flags |= CRIS_DIS_FLAG_MEMREF;
+
+		if (opcodep->imm_oprnd_size == SIZE_FIX_32)
+		  size = 4;
+		else if (opcodep->imm_oprnd_size == SIZE_SPEC_REG)
+		  {
+		    const struct cris_spec_reg *sregp
+		      = spec_reg_info ((insn >> 12) & 15, disdata->distype);
+
+		    /* FIXME: Improve error handling; should have been caught
+		       earlier.  */
+		    if (sregp == NULL)
+		      size = 4;
+		    else
+		      size = sregp->reg_size;
+		  }
+		else
+		  size = mode_size;
+
+		info->data_size = size;
+	      }
+
+	    *tp++ = '[';
+
+	    if (prefix_opcodep
+		/* We don't match dip with a postincremented field
+		   as a side-effect address mode.  */
+		&& ((insn & 0x400) == 0
+		    || prefix_opcodep->match != DIP_OPCODE))
+	      {
+		if (insn & 0x400)
+		  {
+		    tp = format_reg (disdata, insn & 15, tp, with_reg_prefix);
+		    *tp++ = '=';
+		  }
+
+
+		/* We mainly ignore the prefix format string when the
+		   address-mode syntax is output.  */
+		switch (prefix_opcodep->match)
+		  {
+		  case DIP_OPCODE:
+		    /* It's [r], [r+] or [pc+].  */
+		    if ((prefix_insn & 0x400) && (prefix_insn & 15) == 15)
+		      {
+			/* It's [pc+].  This cannot possibly be anything
+			   but an address.  */
+			unsigned long number
+			  = prefix_buffer[2] + prefix_buffer[3] * 256
+			  + prefix_buffer[4] * 65536
+			  + prefix_buffer[5] * 0x1000000;
+
+			info->target = (bfd_vma) number;
+
+			/* Finish off and output previous formatted
+			   data.  */
+			*tp = 0;
+			tp = temp;
+			if (temp[0])
+			  (*info->fprintf_func) (info->stream, "%s", temp);
+
+			(*info->print_address_func) ((bfd_vma) number, info);
+		      }
+		    else
+		      {
+			/* For a memref in an address, we use target2.
+			   In this case, target is zero.  */
+			info->flags
+			  |= (CRIS_DIS_FLAG_MEM_TARGET2_IS_REG
+			      | CRIS_DIS_FLAG_MEM_TARGET2_MEM);
+
+			info->target2 = prefix_insn & 15;
+
+			*tp++ = '[';
+			tp = format_reg (disdata, prefix_insn & 15, tp,
+					 with_reg_prefix);
+			if (prefix_insn & 0x400)
+			  *tp++ = '+';
+			*tp++ = ']';
+		      }
+		    break;
+
+		  case BDAP_QUICK_OPCODE:
+		    {
+		      int number;
+
+		      number = prefix_buffer[0];
+		      if (number > 127)
+			number -= 256;
+
+		      /* Output "reg+num" or, if num < 0, "reg-num".  */
+		      tp = format_reg (disdata, (prefix_insn >> 12) & 15, tp,
+				       with_reg_prefix);
+		      if (number >= 0)
+			*tp++ = '+';
+		      tp = format_dec (number, tp, 1);
+
+		      info->flags |= CRIS_DIS_FLAG_MEM_TARGET_IS_REG;
+		      info->target = (prefix_insn >> 12) & 15;
+		      info->target2 = (bfd_vma) number;
+		      break;
+		    }
+
+		  case BIAP_OPCODE:
+		    /* Output "r+R.m".  */
+		    tp = format_reg (disdata, prefix_insn & 15, tp,
+				     with_reg_prefix);
+		    *tp++ = '+';
+		    tp = format_reg (disdata, (prefix_insn >> 12) & 15, tp,
+				     with_reg_prefix);
+		    *tp++ = '.';
+		    *tp++ = mode_char[(prefix_insn >> 4) & 3];
+
+		    info->flags
+		      |= (CRIS_DIS_FLAG_MEM_TARGET2_IS_REG
+			  | CRIS_DIS_FLAG_MEM_TARGET_IS_REG
+
+			  | ((prefix_insn & 0x8000)
+			     ? CRIS_DIS_FLAG_MEM_TARGET2_MULT4
+			     : ((prefix_insn & 0x8000)
+				? CRIS_DIS_FLAG_MEM_TARGET2_MULT2 : 0)));
+
+		    /* Is it the casejump?  It's a "adds.w [pc+r%d.w],pc".  */
+		    if (insn == 0xf83f && (prefix_insn & ~0xf000) == 0x55f)
+		      /* Then start interpreting data as offsets.  */
+		      case_offset_counter = no_of_case_offsets;
+		    break;
+
+		  case BDAP_INDIR_OPCODE:
+		    /* Output "r+s.m", or, if "s" is [pc+], "r+s" or
+		       "r-s".  */
+		    tp = format_reg (disdata, (prefix_insn >> 12) & 15, tp,
+				     with_reg_prefix);
+
+		    if ((prefix_insn & 0x400) && (prefix_insn & 15) == 15)
+		      {
+			long number;
+			unsigned int nbytes;
+
+			/* It's a value.  Get its size.  */
+			int mode_size = 1 << ((prefix_insn >> 4) & 3);
+
+			if (mode_size == 1)
+			  nbytes = 2;
+			else
+			  nbytes = mode_size;
+
+			switch (nbytes)
+			  {
+			  case 1:
+			    number = prefix_buffer[2];
+			    if (number > 127)
+			      number -= 256;
+			    break;
+
+			  case 2:
+			    number = prefix_buffer[2] + prefix_buffer[3] * 256;
+			    if (number > 32767)
+			      number -= 65536;
+			    break;
+
+			  case 4:
+			    number
+			      = prefix_buffer[2] + prefix_buffer[3] * 256
+			      + prefix_buffer[4] * 65536
+			      + prefix_buffer[5] * 0x1000000;
+			    break;
+
+			  default:
+			    strcpy (tp, "bug");
+			    tp += 3;
+			    number = 42;
+			  }
+
+			info->flags |= CRIS_DIS_FLAG_MEM_TARGET_IS_REG;
+			info->target2 = (bfd_vma) number;
+
+			/* If the size is dword, then assume it's an
+			   address.  */
+			if (nbytes == 4)
+			  {
+			    /* Finish off and output previous formatted
+			       bytes.  */
+			    *tp++ = '+';
+			    *tp = 0;
+			    tp = temp;
+			    (*info->fprintf_func) (info->stream, "%s", temp);
+
+			    (*info->print_address_func) ((bfd_vma) number, info);
+			  }
+			else
+			  {
+			    if (number >= 0)
+			      *tp++ = '+';
+			    tp = format_dec (number, tp, 1);
+			  }
+		      }
+		    else
+		      {
+			/* Output "r+[R].m" or "r+[R+].m".  */
+			*tp++ = '+';
+			*tp++ = '[';
+			tp = format_reg (disdata, prefix_insn & 15, tp,
+					 with_reg_prefix);
+			if (prefix_insn & 0x400)
+			  *tp++ = '+';
+			*tp++ = ']';
+			*tp++ = '.';
+			*tp++ = mode_char[(prefix_insn >> 4) & 3];
+
+			info->flags
+			  |= (CRIS_DIS_FLAG_MEM_TARGET2_IS_REG
+			      | CRIS_DIS_FLAG_MEM_TARGET2_MEM
+			      | CRIS_DIS_FLAG_MEM_TARGET_IS_REG
+
+			      | (((prefix_insn >> 4) == 2)
+				 ? 0
+				 : (((prefix_insn >> 4) & 3) == 1
+				    ? CRIS_DIS_FLAG_MEM_TARGET2_MEM_WORD
+				    : CRIS_DIS_FLAG_MEM_TARGET2_MEM_BYTE)));
+		      }
+		    break;
+
+		  default:
+		    (*info->fprintf_func) (info->stream, "?prefix-bug");
+		  }
+
+		/* To mark that the prefix is used, reset it.  */
+		prefix_opcodep = NULL;
+	      }
+	    else
+	      {
+		tp = format_reg (disdata, insn & 15, tp, with_reg_prefix);
+
+		info->flags |= CRIS_DIS_FLAG_MEM_TARGET_IS_REG;
+		info->target = insn & 15;
+
+		if (insn & 0x400)
+		  *tp++ = '+';
+	      }
+	    *tp++ = ']';
+	  }
+	break;
+
+      case 'x':
+	tp = format_reg (disdata, (insn >> 12) & 15, tp, with_reg_prefix);
+	*tp++ = '.';
+	*tp++ = mode_char[(insn >> 4) & 3];
+	break;
+
+      case 'I':
+	tp = format_dec (insn & 63, tp, 0);
+	break;
+
+      case 'b':
+	{
+	  int where = buffer[2] + buffer[3] * 256;
+
+	  if (where > 32767)
+	    where -= 65536;
+
+	  where += addr + ((disdata->distype == cris_dis_v32) ? 0 : 4);
+
+	  if (insn == BA_PC_INCR_OPCODE)
+	    info->insn_type = dis_branch;
+	  else
+	    info->insn_type = dis_condbranch;
+
+	  info->target = (bfd_vma) where;
+
+	  *tp = 0;
+	  tp = temp;
+	  (*info->fprintf_func) (info->stream, "%s%s ",
+				 temp, cris_cc_strings[insn >> 12]);
+
+	  (*info->print_address_func) ((bfd_vma) where, info);
+	}
+      break;
+
+    case 'c':
+      tp = format_dec (insn & 31, tp, 0);
+      break;
+
+    case 'C':
+      tp = format_dec (insn & 15, tp, 0);
+      break;
+
+    case 'o':
+      {
+	long offset = insn & 0xfe;
+	bfd_vma target;
+
+	if (insn & 1)
+	  offset |= ~0xff;
+
+	if (opcodep->match == BA_QUICK_OPCODE)
+	  info->insn_type = dis_branch;
+	else
+	  info->insn_type = dis_condbranch;
+
+	target = addr + ((disdata->distype == cris_dis_v32) ? 0 : 2) + offset;
+	info->target = target;
+	*tp = 0;
+	tp = temp;
+	(*info->fprintf_func) (info->stream, "%s", temp);
+	(*info->print_address_func) (target, info);
+      }
+      break;
+
+    case 'Q':
+    case 'O':
+      {
+	long number = buffer[0];
+
+	if (number > 127)
+	  number = number - 256;
+
+	tp = format_dec (number, tp, 1);
+	*tp++ = ',';
+	tp = format_reg (disdata, (insn >> 12) & 15, tp, with_reg_prefix);
+      }
+      break;
+
+    case 'f':
+      tp = print_flags (disdata, insn, tp);
+      break;
+
+    case 'i':
+      tp = format_dec ((insn & 32) ? (insn & 31) | ~31L : insn & 31, tp, 1);
+      break;
+
+    case 'P':
+      {
+	const struct cris_spec_reg *sregp
+	  = spec_reg_info ((insn >> 12) & 15, disdata->distype);
+
+	if (sregp->name == NULL)
+	  /* Should have been caught as a non-match eariler.  */
+	  *tp++ = '?';
+	else
+	  {
+	    if (with_reg_prefix)
+	      *tp++ = REGISTER_PREFIX_CHAR;
+	    strcpy (tp, sregp->name);
+	    tp += strlen (tp);
+	  }
+      }
+      break;
+
+    default:
+      strcpy (tp, "???");
+      tp += 3;
+    }
+  }
+
+  *tp = 0;
+
+  if (prefix_opcodep)
+    (*info->fprintf_func) (info->stream, " (OOPS unused prefix \"%s: %s\")",
+			   prefix_opcodep->name, prefix_opcodep->args);
+
+  (*info->fprintf_func) (info->stream, "%s", temp);
+
+  /* Get info for matching case-tables, if we don't have any active.
+     We assume that the last constant seen is used; either in the insn
+     itself or in a "move.d const,rN, sub.d rN,rM"-like sequence.  */
+  if (TRACE_CASE && case_offset_counter == 0)
+    {
+      if (CONST_STRNEQ (opcodep->name, "sub"))
+	case_offset = last_immediate;
+
+      /* It could also be an "add", if there are negative case-values.  */
+      else if (CONST_STRNEQ (opcodep->name, "add"))
+	/* The first case is the negated operand to the add.  */
+	case_offset = -last_immediate;
+
+      /* A bound insn will tell us the number of cases.  */
+      else if (CONST_STRNEQ (opcodep->name, "bound"))
+	no_of_case_offsets = last_immediate + 1;
+
+      /* A jump or jsr or branch breaks the chain of insns for a
+	 case-table, so assume default first-case again.  */
+      else if (info->insn_type == dis_jsr
+	       || info->insn_type == dis_branch
+	       || info->insn_type == dis_condbranch)
+	case_offset = 0;
+    }
+}
+
+
+/* Print the CRIS instruction at address memaddr on stream.  Returns
+   length of the instruction, in bytes.  Prefix register names with `$' if
+   WITH_REG_PREFIX.  */
+
+static int
+print_insn_cris_generic (bfd_vma memaddr,
+			 disassemble_info *info,
+			 bfd_boolean with_reg_prefix)
+{
+  int nbytes;
+  unsigned int insn;
+  const struct cris_opcode *matchedp;
+  int advance = 0;
+  struct cris_disasm_data *disdata
+    = (struct cris_disasm_data *) info->private_data;
+
+  /* No instruction will be disassembled as longer than this number of
+     bytes; stacked prefixes will not be expanded.  */
+  unsigned char buffer[MAX_BYTES_PER_CRIS_INSN];
+  unsigned char *bufp;
+  int status = 0;
+  bfd_vma addr;
+
+  /* There will be an "out of range" error after the last instruction.
+     Reading pairs of bytes in decreasing number, we hope that we will get
+     at least the amount that we will consume.
+
+     If we can't get any data, or we do not get enough data, we print
+     the error message.  */
+
+  for (nbytes = MAX_BYTES_PER_CRIS_INSN; nbytes > 0; nbytes -= 2)
+    {
+      status = (*info->read_memory_func) (memaddr, buffer, nbytes, info);
+      if (status == 0)
+	break;
+    }
+
+  /* If we did not get all we asked for, then clear the rest.
+     Hopefully this makes a reproducible result in case of errors.  */
+  if (nbytes != MAX_BYTES_PER_CRIS_INSN)
+    memset (buffer + nbytes, 0, MAX_BYTES_PER_CRIS_INSN - nbytes);
+
+  addr = memaddr;
+  bufp = buffer;
+
+  /* Set some defaults for the insn info.  */
+  info->insn_info_valid = 1;
+  info->branch_delay_insns = 0;
+  info->data_size = 0;
+  info->insn_type = dis_nonbranch;
+  info->flags = 0;
+  info->target = 0;
+  info->target2 = 0;
+
+  /* If we got any data, disassemble it.  */
+  if (nbytes != 0)
+    {
+      matchedp = NULL;
+
+      insn = bufp[0] + bufp[1] * 256;
+
+      /* If we're in a case-table, don't disassemble the offsets.  */
+      if (TRACE_CASE && case_offset_counter != 0)
+	{
+	  info->insn_type = dis_noninsn;
+	  advance += 2;
+
+	  /* If to print data as offsets, then shortcut here.  */
+	  (*info->fprintf_func) (info->stream, "case %ld%s: -> ",
+				 case_offset + no_of_case_offsets
+				 - case_offset_counter,
+				 case_offset_counter == 1 ? "/default" :
+				 "");
+
+	  (*info->print_address_func) ((bfd_vma)
+				       ((short) (insn)
+					+ (long) (addr
+						  - (no_of_case_offsets
+						     - case_offset_counter)
+						  * 2)), info);
+	  case_offset_counter--;
+
+	  /* The default case start (without a "sub" or "add") must be
+	     zero.  */
+	  if (case_offset_counter == 0)
+	    case_offset = 0;
+	}
+      else if (insn == 0)
+	{
+	  /* We're often called to disassemble zeroes.  While this is a
+	     valid "bcc .+2" insn, it is also useless enough and enough
+	     of a nuiscance that we will just output "bcc .+2" for it
+	     and signal it as a noninsn.  */
+	  (*info->fprintf_func) (info->stream,
+				 disdata->distype == cris_dis_v32
+				 ? "bcc ." : "bcc .+2");
+	  info->insn_type = dis_noninsn;
+	  advance += 2;
+	}
+      else
+	{
+	  const struct cris_opcode *prefix_opcodep = NULL;
+	  unsigned char *prefix_buffer = bufp;
+	  unsigned int prefix_insn = insn;
+	  int prefix_size = 0;
+
+	  matchedp = get_opcode_entry (insn, NO_CRIS_PREFIX, disdata);
+
+	  /* Check if we're supposed to write out prefixes as address
+	     modes and if this was a prefix.  */
+	  if (matchedp != NULL && PARSE_PREFIX && matchedp->args[0] == 'p')
+	    {
+	      /* If it's a prefix, put it into the prefix vars and get the
+		 main insn.  */
+	      prefix_size = bytes_to_skip (prefix_insn, matchedp,
+					   disdata->distype, NULL);
+	      prefix_opcodep = matchedp;
+
+	      insn = bufp[prefix_size] + bufp[prefix_size + 1] * 256;
+	      matchedp = get_opcode_entry (insn, prefix_insn, disdata);
+
+	      if (matchedp != NULL)
+		{
+		  addr += prefix_size;
+		  bufp += prefix_size;
+		  advance += prefix_size;
+		}
+	      else
+		{
+		  /* The "main" insn wasn't valid, at least not when
+		     prefixed.  Put back things enough to output the
+		     prefix insn only, as a normal insn.  */
+		  matchedp = prefix_opcodep;
+		  insn = prefix_insn;
+		  prefix_opcodep = NULL;
+		}
+	    }
+
+	  if (matchedp == NULL)
+	    {
+	      (*info->fprintf_func) (info->stream, "??0x%x", insn);
+	      advance += 2;
+
+	      info->insn_type = dis_noninsn;
+	    }
+	  else
+	    {
+	      advance
+		+= bytes_to_skip (insn, matchedp, disdata->distype,
+				  prefix_opcodep);
+
+	      /* The info_type and assorted fields will be set according
+		 to the operands.   */
+	      print_with_operands (matchedp, insn, bufp, addr, info,
+				   prefix_opcodep, prefix_insn,
+				   prefix_buffer, with_reg_prefix);
+	    }
+	}
+    }
+  else
+    info->insn_type = dis_noninsn;
+
+  /* If we read less than MAX_BYTES_PER_CRIS_INSN, i.e. we got an error
+     status when reading that much, and the insn decoding indicated a
+     length exceeding what we read, there is an error.  */
+  if (status != 0 && (nbytes == 0 || advance > nbytes))
+    {
+      (*info->memory_error_func) (status, memaddr, info);
+      return -1;
+    }
+
+  /* Max supported insn size with one folded prefix insn.  */
+  info->bytes_per_line = MAX_BYTES_PER_CRIS_INSN;
+
+  /* I would like to set this to a fixed value larger than the actual
+     number of bytes to print in order to avoid spaces between bytes,
+     but objdump.c (2.9.1) does not like that, so we print 16-bit
+     chunks, which is the next choice.  */
+  info->bytes_per_chunk = 2;
+
+  /* Printing bytes in order of increasing addresses makes sense,
+     especially on a little-endian target.
+     This is completely the opposite of what you think; setting this to
+     BFD_ENDIAN_LITTLE will print bytes in order N..0 rather than the 0..N
+     we want.  */
+  info->display_endian = BFD_ENDIAN_BIG;
+
+  return advance;
+}
+
+/* Disassemble, prefixing register names with `$'.  CRIS v0..v10.  */
+#if 0
+static int
+print_insn_cris_with_register_prefix (bfd_vma vma,
+				      disassemble_info *info)
+{
+  if (info->private_data == NULL
+      && !cris_parse_disassembler_options (info, cris_dis_v0_v10))
+    return -1;
+  return print_insn_cris_generic (vma, info, TRUE);
+}
+#endif
+/* Disassemble, prefixing register names with `$'.  CRIS v32.  */
+
+static int
+print_insn_crisv32_with_register_prefix (bfd_vma vma,
+					 disassemble_info *info)
+{
+  if (info->private_data == NULL
+      && !cris_parse_disassembler_options (info, cris_dis_v32))
+    return -1;
+  return print_insn_cris_generic (vma, info, TRUE);
+}
+
+#if 0
+/* Disassemble, prefixing register names with `$'.
+   Common v10 and v32 subset.  */
+
+static int
+print_insn_crisv10_v32_with_register_prefix (bfd_vma vma,
+					     disassemble_info *info)
+{
+  if (info->private_data == NULL
+      && !cris_parse_disassembler_options (info, cris_dis_common_v10_v32))
+    return -1;
+  return print_insn_cris_generic (vma, info, TRUE);
+}
+
+/* Disassemble, no prefixes on register names.  CRIS v0..v10.  */
+
+static int
+print_insn_cris_without_register_prefix (bfd_vma vma,
+					 disassemble_info *info)
+{
+  if (info->private_data == NULL
+      && !cris_parse_disassembler_options (info, cris_dis_v0_v10))
+    return -1;
+  return print_insn_cris_generic (vma, info, FALSE);
+}
+
+/* Disassemble, no prefixes on register names.  CRIS v32.  */
+
+static int
+print_insn_crisv32_without_register_prefix (bfd_vma vma,
+					    disassemble_info *info)
+{
+  if (info->private_data == NULL
+      && !cris_parse_disassembler_options (info, cris_dis_v32))
+    return -1;
+  return print_insn_cris_generic (vma, info, FALSE);
+}
+
+/* Disassemble, no prefixes on register names.
+   Common v10 and v32 subset.  */
+
+static int
+print_insn_crisv10_v32_without_register_prefix (bfd_vma vma,
+						disassemble_info *info)
+{
+  if (info->private_data == NULL
+      && !cris_parse_disassembler_options (info, cris_dis_common_v10_v32))
+    return -1;
+  return print_insn_cris_generic (vma, info, FALSE);
+}
+#endif
+
+int
+print_insn_crisv32 (bfd_vma vma,
+		    disassemble_info *info)
+{
+  return print_insn_crisv32_with_register_prefix(vma, info);
+}
+
+/* Return a disassembler-function that prints registers with a `$' prefix,
+   or one that prints registers without a prefix.
+   FIXME: We should improve the solution to avoid the multitude of
+   functions seen above.  */
+#if 0
+disassembler_ftype
+cris_get_disassembler (bfd *abfd)
+{
+  /* If there's no bfd in sight, we return what is valid as input in all
+     contexts if fed back to the assembler: disassembly *with* register
+     prefix.  Unfortunately this will be totally wrong for v32.  */
+  if (abfd == NULL)
+    return print_insn_cris_with_register_prefix;
+
+  if (bfd_get_symbol_leading_char (abfd) == 0)
+    {
+      if (bfd_get_mach (abfd) == bfd_mach_cris_v32)
+	return print_insn_crisv32_with_register_prefix;
+      if (bfd_get_mach (abfd) == bfd_mach_cris_v10_v32)
+	return print_insn_crisv10_v32_with_register_prefix;
+
+      /* We default to v10.  This may be specifically specified in the
+	 bfd mach, but is also the default setting.  */
+      return print_insn_cris_with_register_prefix;
+    }
+
+  if (bfd_get_mach (abfd) == bfd_mach_cris_v32)
+    return print_insn_crisv32_without_register_prefix;
+  if (bfd_get_mach (abfd) == bfd_mach_cris_v10_v32)
+    return print_insn_crisv10_v32_without_register_prefix;
+  return print_insn_cris_without_register_prefix;
+}
+#endif
+/* Local variables:
+   eval: (c-set-style "gnu")
+   indent-tabs-mode: t
+   End:  */
diff --git a/cutils.c b/cutils.c
index 1413f1b74..608c31a5f 100644
--- a/cutils.c
+++ b/cutils.c
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 
 void pstrcpy(char *buf, int buf_size, const char *str)
 {
@@ -82,6 +82,20 @@ int stristart(const char *str, const char *val, const char **ptr)
     return 1;
 }
 
+time_t mktimegm(struct tm *tm)
+{
+    time_t t;
+    int y = tm->tm_year + 1900, m = tm->tm_mon + 1, d = tm->tm_mday;
+    if (m < 3) {
+        m += 12;
+        y--;
+    }
+    t = 86400 * (d + (153 * m - 457) / 5 + 365 * y + y / 4 - y / 100 + 
+                 y / 400 - 719469);
+    t += 3600 * tm->tm_hour + 60 * tm->tm_min + tm->tm_sec;
+    return t;
+}
+
 int hex2bin(char ch)
 {
     if (ch >= '0' && ch <= '9')
diff --git a/darwin-user/main.c b/darwin-user/main.c
index d0de491e0..10b7fcb9a 100644
--- a/darwin-user/main.c
+++ b/darwin-user/main.c
@@ -224,11 +224,6 @@ void cpu_loop(CPUPPCState *env)
             case POWERPC_EXCP_FP:
                 EXCP_DUMP(env, "Floating point program exception\n");
                 /* Set FX */
-                env->fpscr[7] |= 0x8;
-                /* Finally, update FEX */
-                if ((((env->fpscr[7] & 0x3) << 3) | (env->fpscr[6] >> 1)) &
-                    ((env->fpscr[1] << 1) | (env->fpscr[0] >> 3)))
-                    env->fpscr[7] |= 0x4;
                 info.si_signo = SIGFPE;
                 info.si_errno = 0;
                 switch (env->error_code & 0xF) {
@@ -248,7 +243,7 @@ void cpu_loop(CPUPPCState *env)
                 case POWERPC_EXCP_FP_VXSOFT:
                     info.si_code = FPE_FLTINV;
                     break;
-                case POWERPC_EXCP_FP_VXNAN:
+                case POWERPC_EXCP_FP_VXSNAN:
                 case POWERPC_EXCP_FP_VXISI:
                 case POWERPC_EXCP_FP_VXIDI:
                 case POWERPC_EXCP_FP_VXIMZ:
@@ -362,7 +357,6 @@ void cpu_loop(CPUPPCState *env)
         case POWERPC_EXCP_DEBUG:    /* Debug interrupt                       */
             gdb_handlesig (env, SIGTRAP);
             break;
-#if defined(TARGET_PPCEMB)
         case POWERPC_EXCP_SPEU:     /* SPE/embedded floating-point unavail.  */
             EXCP_DUMP(env, "No SPE/floating-point instruction allowed\n");
             info.si_signo = SIGILL;
@@ -388,12 +382,10 @@ void cpu_loop(CPUPPCState *env)
             cpu_abort(env, "Doorbell critical interrupt while in user mode. "
                       "Aborting\n");
             break;
-#endif /* defined(TARGET_PPCEMB) */
         case POWERPC_EXCP_RESET:    /* System reset exception                */
             cpu_abort(env, "Reset interrupt while in user mode. "
                       "Aborting\n");
             break;
-#if defined(TARGET_PPC64) /* PowerPC 64 */
         case POWERPC_EXCP_DSEG:     /* Data segment exception                */
             cpu_abort(env, "Data segment exception while in user mode. "
                       "Aborting\n");
@@ -402,19 +394,15 @@ void cpu_loop(CPUPPCState *env)
             cpu_abort(env, "Instruction segment exception "
                       "while in user mode. Aborting\n");
             break;
-#endif /* defined(TARGET_PPC64) */
-#if defined(TARGET_PPC64H) /* PowerPC 64 with hypervisor mode support */
         case POWERPC_EXCP_HDECR:    /* Hypervisor decrementer exception      */
             cpu_abort(env, "Hypervisor decrementer interrupt "
                       "while in user mode. Aborting\n");
             break;
-#endif /* defined(TARGET_PPC64H) */
         case POWERPC_EXCP_TRACE:    /* Trace exception                       */
             /* Nothing to do:
              * we use this exception to emulate step-by-step execution mode.
              */
             break;
-#if defined(TARGET_PPC64H) /* PowerPC 64 with hypervisor mode support */
         case POWERPC_EXCP_HDSI:     /* Hypervisor data storage exception     */
             cpu_abort(env, "Hypervisor data storage exception "
                       "while in user mode. Aborting\n");
@@ -431,7 +419,6 @@ void cpu_loop(CPUPPCState *env)
             cpu_abort(env, "Hypervisor instruction segment exception "
                       "while in user mode. Aborting\n");
             break;
-#endif /* defined(TARGET_PPC64H) */
         case POWERPC_EXCP_VPU:      /* Vector unavailable exception          */
             EXCP_DUMP(env, "No Altivec instructions allowed\n");
             info.si_signo = SIGILL;
@@ -762,9 +749,6 @@ void usage(void)
            "-s size      set the stack size in bytes (default=%ld)\n"
            "\n"
            "debug options:\n"
-#ifdef USE_CODE_COPY
-           "-no-code-copy   disable code copy acceleration\n"
-#endif
            "-d options   activate log (logfile='%s')\n"
            "-g wait for gdb on port 1234\n"
            "-p pagesize  set the host page size to 'pagesize'\n",
@@ -793,6 +777,7 @@ int main(int argc, char **argv)
     int optind;
     short use_gdbstub = 0;
     const char *r;
+    const char *cpu_model;
 
     if (argc <= 1)
         usage();
@@ -849,12 +834,16 @@ int main(int argc, char **argv)
         } else
         if (!strcmp(r, "g")) {
             use_gdbstub = 1;
-        } else
-#ifdef USE_CODE_COPY
-        if (!strcmp(r, "no-code-copy")) {
-            code_copy_enabled = 0;
-        } else
+        } else if (!strcmp(r, "cpu")) {
+            cpu_model = argv[optind++];
+            if (strcmp(cpu_model, "?") == 0) {
+/* XXX: implement xxx_cpu_list for targets that still miss it */
+#if defined(cpu_list)
+                    cpu_list(stdout, &fprintf);
 #endif
+                _exit(1);
+            }
+        } else
         {
             usage();
         }
@@ -866,9 +855,27 @@ int main(int argc, char **argv)
     /* Zero out regs */
     memset(regs, 0, sizeof(struct target_pt_regs));
 
+    if (cpu_model == NULL) {
+#if defined(TARGET_I386)
+#ifdef TARGET_X86_64
+        cpu_model = "qemu64";
+#else
+        cpu_model = "qemu32";
+#endif
+#elif defined(TARGET_PPC)
+#ifdef TARGET_PPC64
+        cpu_model = "970";
+#else
+        cpu_model = "750";
+#endif
+#else
+#error unsupported CPU
+#endif
+    }
+    
     /* NOTE: we need to init the CPU at this stage to get
        qemu_host_page_size */
-    env = cpu_init();
+    env = cpu_init(cpu_model);
 
     printf("Starting %s with qemu\n----------------\n", filename);
 
@@ -1009,6 +1016,14 @@ int main(int argc, char **argv)
 #elif defined(TARGET_PPC)
     {
         int i;
+
+#if defined(TARGET_PPC64)
+#if defined(TARGET_ABI32)
+        env->msr &= ~((target_ulong)1 << MSR_SF);
+#else
+        env->msr |= (target_ulong)1 << MSR_SF;
+#endif
+#endif
         env->nip = regs->nip;
         for(i = 0; i < 32; i++) {
             env->gpr[i] = regs->gpr[i];
diff --git a/darwin-user/qemu.h b/darwin-user/qemu.h
index 4d7713b50..41b57f851 100644
--- a/darwin-user/qemu.h
+++ b/darwin-user/qemu.h
@@ -1,13 +1,13 @@
 #ifndef GEMU_H
 #define GEMU_H
 
-#include "thunk.h"
-
 #include <signal.h>
 #include <string.h>
 
 #include "cpu.h"
 
+#include "thunk.h"
+
 #include "gdbstub.h"
 
 typedef siginfo_t target_siginfo_t;
diff --git a/darwin-user/signal.c b/darwin-user/signal.c
index a0b9f89dc..8dbfa931e 100644
--- a/darwin-user/signal.c
+++ b/darwin-user/signal.c
@@ -198,11 +198,7 @@ static void host_signal_handler(int host_signum, siginfo_t *info,
 
     /* the CPU emulator uses some host signals to detect exceptions,
        we we forward to it some signals */
-    if (host_signum == SIGSEGV || host_signum == SIGBUS
-#if defined(TARGET_I386) && defined(USE_CODE_COPY)
-        || host_signum == SIGFPE
-#endif
-        ) {
+    if (host_signum == SIGSEGV || host_signum == SIGBUS) {
         if (cpu_signal_handler(host_signum, (void*)info, puc))
             return;
     }
diff --git a/dis-asm.h b/dis-asm.h
index bacd9c46b..2f333a90f 100644
--- a/dis-asm.h
+++ b/dis-asm.h
@@ -183,12 +183,20 @@ enum bfd_architecture
   bfd_arch_alpha,      /* Dec Alpha */
 #define bfd_mach_alpha 1
   bfd_arch_arm,        /* Advanced Risc Machines ARM */
-#define bfd_mach_arm_2         1
-#define bfd_mach_arm_2a                2
-#define bfd_mach_arm_3         3
-#define bfd_mach_arm_3M        4
-#define bfd_mach_arm_4                 5
-#define bfd_mach_arm_4T        6
+#define bfd_mach_arm_unknown	0
+#define bfd_mach_arm_2		1
+#define bfd_mach_arm_2a		2
+#define bfd_mach_arm_3		3
+#define bfd_mach_arm_3M 	4
+#define bfd_mach_arm_4 		5
+#define bfd_mach_arm_4T 	6
+#define bfd_mach_arm_5 		7
+#define bfd_mach_arm_5T		8
+#define bfd_mach_arm_5TE	9
+#define bfd_mach_arm_XScale	10
+#define bfd_mach_arm_ep9312	11
+#define bfd_mach_arm_iWMMXt	12
+#define bfd_mach_arm_iWMMXt2	13
   bfd_arch_ns32k,      /* National Semiconductors ns32000 */
   bfd_arch_w65,        /* WDC 65816 */
   bfd_arch_tic30,      /* Texas Instruments TMS320C30 */
@@ -200,6 +208,10 @@ enum bfd_architecture
 #define bfd_mach_m32r          0  /* backwards compatibility */
   bfd_arch_mn10200,    /* Matsushita MN10200 */
   bfd_arch_mn10300,    /* Matsushita MN10300 */
+  bfd_arch_cris,       /* Axis CRIS */
+#define bfd_mach_cris_v0_v10   255
+#define bfd_mach_cris_v32      32
+#define bfd_mach_cris_v10_v32  1032
   bfd_arch_last
   };
 #define bfd_mach_s390_31 31
@@ -382,6 +394,7 @@ extern int print_insn_tic30		PARAMS ((bfd_vma, disassemble_info*));
 extern int print_insn_ppc		PARAMS ((bfd_vma, disassemble_info*));
 extern int print_insn_alpha             PARAMS ((bfd_vma, disassemble_info*));
 extern int print_insn_s390		PARAMS ((bfd_vma, disassemble_info*));
+extern int print_insn_crisv32           PARAMS ((bfd_vma, disassemble_info*));
 
 #if 0
 /* Fetch the disassembler for a given BFD, if that support is available.  */
diff --git a/disas.c b/disas.c
index ae20d37bc..fe1fa9d5a 100644
--- a/disas.c
+++ b/disas.c
@@ -205,6 +205,9 @@ void target_disas(FILE *out, target_ulong code, target_ulong size, int flags)
 #elif defined(TARGET_ALPHA)
     disasm_info.mach = bfd_mach_alpha;
     print_insn = print_insn_alpha;
+#elif defined(TARGET_CRIS)
+    disasm_info.mach = bfd_mach_cris_v32;
+    print_insn = print_insn_crisv32;
 #else
     fprintf(out, "0x" TARGET_FMT_lx
 	    ": Asm output not supported on this arch\n", code);
diff --git a/dyngen-exec.h b/dyngen-exec.h
index 37c593e29..6f69beedc 100644
--- a/dyngen-exec.h
+++ b/dyngen-exec.h
@@ -38,7 +38,7 @@ typedef unsigned int uint32_t;
 // Linux/Sparc64 defines uint64_t
 #if !(defined (__sparc_v9__) && defined(__linux__))
 /* XXX may be done for all 64 bits targets ? */
-#if defined (__x86_64__) || defined(__ia64)
+#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__)
 typedef unsigned long uint64_t;
 #else
 typedef unsigned long long uint64_t;
@@ -55,7 +55,7 @@ typedef signed short int16_t;
 typedef signed int int32_t;
 // Linux/Sparc64 defines int64_t
 #if !(defined (__sparc_v9__) && defined(__linux__))
-#if defined (__x86_64__) || defined(__ia64)
+#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__)
 typedef signed long int64_t;
 #else
 typedef signed long long int64_t;
@@ -205,7 +205,7 @@ extern int printf(const char *, ...);
 #define stringify(s)	tostring(s)
 #define tostring(s)	#s
 
-#ifdef __alpha__
+#if defined(__alpha__) || defined(__s390__)
 /* the symbols are considered non exported so a br immediate is generated */
 #define __hidden __attribute__((visibility("hidden")))
 #else
@@ -224,6 +224,13 @@ extern int __op_param3 __hidden;
 #define PARAM1 ({ int _r; asm("" : "=r"(_r) : "0" (&__op_param1)); _r; })
 #define PARAM2 ({ int _r; asm("" : "=r"(_r) : "0" (&__op_param2)); _r; })
 #define PARAM3 ({ int _r; asm("" : "=r"(_r) : "0" (&__op_param3)); _r; })
+#elif defined(__s390__)
+extern int __op_param1 __hidden;
+extern int __op_param2 __hidden;
+extern int __op_param3 __hidden;
+#define PARAM1 ({ int _r; asm("bras %0,8; .long " ASM_NAME(__op_param1) "; l %0,0(%0)" : "=r"(_r) : ); _r; })
+#define PARAM2 ({ int _r; asm("bras %0,8; .long " ASM_NAME(__op_param2) "; l %0,0(%0)" : "=r"(_r) : ); _r; })
+#define PARAM3 ({ int _r; asm("bras %0,8; .long " ASM_NAME(__op_param3) "; l %0,0(%0)" : "=r"(_r) : ); _r; })
 #else
 #if defined(__APPLE__)
 static int __op_param1, __op_param2, __op_param3;
@@ -254,7 +261,7 @@ extern int __op_jmp0, __op_jmp1, __op_jmp2, __op_jmp3;
 #define GOTO_LABEL_PARAM(n) asm volatile ("b " ASM_NAME(__op_gen_label) #n)
 #elif defined(__s390__)
 #define EXIT_TB() asm volatile ("br %r14")
-#define GOTO_LABEL_PARAM(n) asm volatile ("bras %r7,8; .long " ASM_NAME(__op_gen_label) #n "; l %r7, 0(%r7); br %r7")
+#define GOTO_LABEL_PARAM(n) asm volatile ("larl %r7,12; l %r7,0(%r7); br %r7; .long " ASM_NAME(__op_gen_label) #n)
 #elif defined(__alpha__)
 #define EXIT_TB() asm volatile ("ret")
 #elif defined(__ia64__)
diff --git a/dyngen.c b/dyngen.c
index f136e02c2..d301c714f 100644
--- a/dyngen.c
+++ b/dyngen.c
@@ -232,7 +232,7 @@ enum {
 
 int do_swap;
 
-void __attribute__((noreturn)) __attribute__((format (printf, 1, 2))) error(const char *fmt, ...)
+static void __attribute__((noreturn)) __attribute__((format (printf, 1, 2))) error(const char *fmt, ...)
 {
     va_list ap;
     va_start(ap, fmt);
@@ -243,7 +243,7 @@ void __attribute__((noreturn)) __attribute__((format (printf, 1, 2))) error(cons
     exit(1);
 }
 
-void *load_data(int fd, long offset, unsigned int size)
+static void *load_data(int fd, long offset, unsigned int size)
 {
     char *data;
 
@@ -701,6 +701,8 @@ int load_object(const char *filename)
     uint32_t *n_strtab;
     EXE_SYM *sym;
     EXE_RELOC *rel;
+    const char *p;
+    int aux_size, j;
 
     fd = open(filename, O_RDONLY
 #ifdef _WIN32
@@ -727,7 +729,6 @@ int load_object(const char *filename)
     sdata = malloc(sizeof(void *) * fhdr.f_nscns);
     memset(sdata, 0, sizeof(void *) * fhdr.f_nscns);
 
-    const char *p;
     for(i = 0;i < fhdr.f_nscns; i++) {
         sec = &shdr[i];
         if (!strstart(sec->s_name,  ".bss", &p))
@@ -771,7 +772,6 @@ int load_object(const char *filename)
 	/* set coff symbol */
 	symtab = malloc(sizeof(struct coff_sym) * nb_syms);
 
-	int aux_size, j;
 	for (i = 0, ext_sym = coff_symtab, sym = symtab; i < nb_syms; i++, ext_sym++, sym++) {
 		memset(sym, 0, sizeof(*sym));
 		sym->st_syment = ext_sym;
@@ -1495,8 +1495,8 @@ void gen_code(const char *name, host_ulong offset, host_ulong size,
         p = (void *)(p_end - 2);
         if (p == p_start)
             error("empty code for %s", name);
-        if (get16((uint16_t *)p) != 0x07fe && get16((uint16_t *)p) != 0x07f4)
-            error("br %%r14 expected at the end of %s", name);
+        if ((get16((uint16_t *)p) & 0xfff0) != 0x07f0)
+            error("br expected at the end of %s", name);
         copy_size = p - p_start;
     }
 #elif defined(HOST_ALPHA)
@@ -2120,6 +2120,19 @@ void gen_code(const char *name, host_ulong offset, host_ulong size,
                             fprintf(outfile, "    *(uint8_t *)(gen_code_ptr + %d) = %s + %d;\n",
                                     reloc_offset, relname, addend);
                             break;
+                        case R_390_PC32DBL:
+                            if (ELF32_ST_TYPE(symtab[ELFW(R_SYM)(rel->r_info)].st_info) == STT_SECTION) {
+                                fprintf(outfile,
+                                        "    *(uint32_t *)(gen_code_ptr + %d) += "
+                                        "((long)&%s - (long)gen_code_ptr) >> 1;\n",
+                                        reloc_offset, name);
+                            }
+                            else
+                                fprintf(outfile,
+                                        "    *(uint32_t *)(gen_code_ptr + %d) = "
+                                        "(%s + %d - ((uint32_t)gen_code_ptr + %d)) >> 1;\n",
+                                        reloc_offset, relname, addend, reloc_offset);
+                            break;
                         default:
                             error("unsupported s390 relocation (%d)", type);
                         }
diff --git a/dyngen.h b/dyngen.h
index 266b9e972..4451d5435 100644
--- a/dyngen.h
+++ b/dyngen.h
@@ -45,7 +45,7 @@ static inline void flush_icache_range(unsigned long start, unsigned long stop)
 
 #define MIN_CACHE_LINE_SIZE 8 /* conservative value */
 
-static void inline flush_icache_range(unsigned long start, unsigned long stop)
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
 {
     unsigned long p;
 
@@ -68,7 +68,7 @@ static inline void flush_icache_range(unsigned long start, unsigned long stop)
     asm ("imb");
 }
 #elif defined(__sparc__)
-static void inline flush_icache_range(unsigned long start, unsigned long stop)
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
 {
 	unsigned long p;
 
diff --git a/elf.h b/elf.h
index 0c03f032a..1bba0228b 100644
--- a/elf.h
+++ b/elf.h
@@ -1130,6 +1130,7 @@ typedef struct elf64_note {
 #define elf_note	elf32_note
 #define elf_shdr	elf32_shdr
 #define elf_sym		elf32_sym
+#define elf_addr_t	Elf32_Off
 
 #ifdef ELF_USES_RELOCA
 # define ELF_RELOC      Elf32_Rela
@@ -1144,6 +1145,7 @@ typedef struct elf64_note {
 #define elf_note	elf64_note
 #define elf_shdr	elf64_shdr
 #define elf_sym		elf64_sym
+#define elf_addr_t	Elf64_Off
 
 #ifdef ELF_USES_RELOCA
 # define ELF_RELOC      Elf64_Rela
diff --git a/elf_ops.h b/elf_ops.h
index 173d12f05..61265650e 100644
--- a/elf_ops.h
+++ b/elf_ops.h
@@ -138,9 +138,9 @@ static int glue(load_symbols, SZ)(struct elfhdr *ehdr, int fd, int must_swab)
     return -1;
 }
 
-int glue(load_elf, SZ)(int fd, int64_t virt_to_phys_addend,
-                       int must_swab, uint64_t *pentry,
-                       uint64_t *lowaddr, uint64_t *highaddr)
+static int glue(load_elf, SZ)(int fd, int64_t virt_to_phys_addend,
+                              int must_swab, uint64_t *pentry,
+                              uint64_t *lowaddr, uint64_t *highaddr)
 {
     struct elfhdr ehdr;
     struct elf_phdr *phdr = NULL, *ph;
@@ -159,7 +159,7 @@ int glue(load_elf, SZ)(int fd, int64_t virt_to_phys_addend,
         goto fail;
 
     if (pentry)
-   	*pentry = (uint64_t)ehdr.e_entry;
+   	*pentry = (uint64_t)(elf_sword)ehdr.e_entry;
 
     glue(load_symbols, SZ)(&ehdr, fd, must_swab);
 
@@ -206,9 +206,9 @@ int glue(load_elf, SZ)(int fd, int64_t virt_to_phys_addend,
     }
     qemu_free(phdr);
     if (lowaddr)
-        *lowaddr = (uint64_t)low;
+        *lowaddr = (uint64_t)(elf_sword)low;
     if (highaddr)
-        *highaddr = (uint64_t)high;
+        *highaddr = (uint64_t)(elf_sword)high;
     return total_size;
  fail:
     qemu_free(data);
diff --git a/exec-all.h b/exec-all.h
index 27ff16afc..10281d329 100644
--- a/exec-all.h
+++ b/exec-all.h
@@ -21,36 +21,6 @@
 /* allow to see translation results - the slowdown should be negligible, so we leave it */
 #define DEBUG_DISAS
 
-#ifndef glue
-#define xglue(x, y) x ## y
-#define glue(x, y) xglue(x, y)
-#define stringify(s)	tostring(s)
-#define tostring(s)	#s
-#endif
-
-#ifndef likely
-#if __GNUC__ < 3
-#define __builtin_expect(x, n) (x)
-#endif
-
-#define likely(x)   __builtin_expect(!!(x), 1)
-#define unlikely(x)   __builtin_expect(!!(x), 0)
-#endif
-
-#ifndef always_inline
-#if (__GNUC__ < 3) || defined(__APPLE__)
-#define always_inline inline
-#else
-#define always_inline __attribute__ (( always_inline )) inline
-#endif
-#endif
-
-#ifdef __i386__
-#define REGPARM(n) __attribute((regparm(n)))
-#else
-#define REGPARM(n)
-#endif
-
 /* is_jmp field values */
 #define DISAS_NEXT    0 /* next instruction can be analyzed */
 #define DISAS_JUMP    1 /* only pc was modified dynamically */
@@ -91,14 +61,12 @@ void optimize_flags_init(void);
 extern FILE *logfile;
 extern int loglevel;
 
-void muls64(int64_t *phigh, int64_t *plow, int64_t a, int64_t b);
-void mulu64(uint64_t *phigh, uint64_t *plow, uint64_t a, uint64_t b);
-
 int gen_intermediate_code(CPUState *env, struct TranslationBlock *tb);
 int gen_intermediate_code_pc(CPUState *env, struct TranslationBlock *tb);
 void dump_ops(const uint16_t *opc_buf, const uint32_t *opparam_buf);
+unsigned long code_gen_max_block_size(void);
 int cpu_gen_code(CPUState *env, struct TranslationBlock *tb,
-                 int max_code_size, int *gen_code_size_ptr);
+                 int *gen_code_size_ptr);
 int cpu_restore_state(struct TranslationBlock *tb,
                       CPUState *env, unsigned long searched_pc,
                       void *puc);
@@ -117,17 +85,16 @@ void tlb_flush_page(CPUState *env, target_ulong addr);
 void tlb_flush(CPUState *env, int flush_global);
 int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
                       target_phys_addr_t paddr, int prot,
-                      int is_user, int is_softmmu);
+                      int mmu_idx, int is_softmmu);
 static inline int tlb_set_page(CPUState *env, target_ulong vaddr,
                                target_phys_addr_t paddr, int prot,
-                               int is_user, int is_softmmu)
+                               int mmu_idx, int is_softmmu)
 {
     if (prot & PAGE_READ)
         prot |= PAGE_EXEC;
-    return tlb_set_page_exec(env, vaddr, paddr, prot, is_user, is_softmmu);
+    return tlb_set_page_exec(env, vaddr, paddr, prot, mmu_idx, is_softmmu);
 }
 
-#define CODE_GEN_MAX_SIZE        65536
 #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
 
 #define CODE_GEN_PHYS_HASH_BITS     15
@@ -353,24 +320,6 @@ do {\
 		  "1:\n");\
 } while (0)
 
-#elif defined(__s390__)
-/* GCC spills R13, so we have to restore it before branching away */
-
-#define GOTO_TB(opname, tbparam, n)\
-do {\
-    static void __attribute__((used)) *dummy ## n = &&dummy_label ## n;\
-    static void __attribute__((used)) *__op_label ## n \
-        __asm__(ASM_OP_LABEL_NAME(n, opname)) = &&label ## n;\
-	__asm__ __volatile__ ( \
-		"l %%r13,52(%%r15)\n" \
-		"br %0\n" \
-	: : "r" (((TranslationBlock*)tbparam)->tb_next[n]));\
-	\
-	for(;*((int*)0);); /* just to keep GCC busy */ \
-label ## n: ;\
-dummy_label ## n: ;\
-} while(0)
-
 #else
 
 /* jump to next block operations (more portable code, does not need
@@ -561,10 +510,10 @@ extern int tb_invalidated_flag;
 
 #if !defined(CONFIG_USER_ONLY)
 
-void tlb_fill(target_ulong addr, int is_write, int is_user,
+void tlb_fill(target_ulong addr, int is_write, int mmu_idx,
               void *retaddr);
 
-#define ACCESS_TYPE 3
+#define ACCESS_TYPE (NB_MMU_MODES + 1)
 #define MEMSUFFIX _code
 #define env cpu_single_env
 
@@ -597,43 +546,23 @@ static inline target_ulong get_phys_addr_code(CPUState *env, target_ulong addr)
    is the offset relative to phys_ram_base */
 static inline target_ulong get_phys_addr_code(CPUState *env, target_ulong addr)
 {
-    int is_user, index, pd;
+    int mmu_idx, index, pd;
 
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-#if defined(TARGET_I386)
-    is_user = ((env->hflags & HF_CPL_MASK) == 3);
-#elif defined (TARGET_PPC)
-    is_user = msr_pr;
-#elif defined (TARGET_MIPS)
-    is_user = ((env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM);
-#elif defined (TARGET_SPARC)
-    is_user = (env->psrs == 0);
-#elif defined (TARGET_ARM)
-    is_user = ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR);
-#elif defined (TARGET_SH4)
-    is_user = ((env->sr & SR_MD) == 0);
-#elif defined (TARGET_ALPHA)
-    is_user = ((env->ps >> 3) & 3);
-#elif defined (TARGET_M68K)
-    is_user = ((env->sr & SR_S) == 0);
-#elif defined (TARGET_IA64)
-    is_user = 0;
-#else
-#error unimplemented CPU
-#endif
-    if (__builtin_expect(env->tlb_table[is_user][index].addr_code !=
+    mmu_idx = cpu_mmu_index(env);
+    if (__builtin_expect(env->tlb_table[mmu_idx][index].addr_code !=
                          (addr & TARGET_PAGE_MASK), 0)) {
         ldub_code(addr);
     }
-    pd = env->tlb_table[is_user][index].addr_code & ~TARGET_PAGE_MASK;
+    pd = env->tlb_table[mmu_idx][index].addr_code & ~TARGET_PAGE_MASK;
     if (pd > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
-#ifdef TARGET_SPARC
+#if defined(TARGET_SPARC) || defined(TARGET_MIPS)
         do_unassigned_access(addr, 0, 1, 0);
 #else
         cpu_abort(env, "Trying to execute code outside RAM or ROM at 0x" TARGET_FMT_lx "\n", addr);
 #endif
     }
-    return addr + env->tlb_table[is_user][index].addend - (unsigned long)phys_ram_base;
+    return addr + env->tlb_table[mmu_idx][index].addend - (unsigned long)phys_ram_base;
 }
 #endif
 
diff --git a/exec.c b/exec.c
index 8b6a2f6fa..d9e162554 100644
--- a/exec.c
+++ b/exec.c
@@ -59,7 +59,7 @@
 #endif
 
 /* threshold to flush the translated code buffer */
-#define CODE_GEN_BUFFER_MAX_SIZE (CODE_GEN_BUFFER_SIZE - CODE_GEN_MAX_SIZE)
+#define CODE_GEN_BUFFER_MAX_SIZE (CODE_GEN_BUFFER_SIZE - code_gen_max_block_size())
 
 #define SMC_BITMAP_USE_THRESHOLD 10
 
@@ -223,6 +223,27 @@ static void page_init(void)
     qemu_host_page_mask = ~(qemu_host_page_size - 1);
     l1_phys_map = qemu_vmalloc(L1_SIZE * sizeof(void *));
     memset(l1_phys_map, 0, L1_SIZE * sizeof(void *));
+
+#if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
+    {
+        long long startaddr, endaddr;
+        FILE *f;
+        int n;
+
+        f = fopen("/proc/self/maps", "r");
+        if (f) {
+            do {
+                n = fscanf (f, "%llx-%llx %*[^\n]\n", &startaddr, &endaddr);
+                if (n == 2) {
+                    page_set_flags(TARGET_PAGE_ALIGN(startaddr),
+                                   TARGET_PAGE_ALIGN(endaddr),
+                                   PAGE_RESERVED); 
+                }
+            } while (!feof(f));
+            fclose(f);
+        }
+    }
+#endif
 }
 
 static inline PageDesc *page_find_alloc(unsigned int index)
@@ -353,10 +374,10 @@ void tb_flush(CPUState *env1)
 {
     CPUState *env;
 #if defined(DEBUG_FLUSH)
-    printf("qemu: flush code_size=%d nb_tbs=%d avg_tb_size=%d\n",
-           code_gen_ptr - code_gen_buffer,
-           nb_tbs,
-           nb_tbs > 0 ? (code_gen_ptr - code_gen_buffer) / nb_tbs : 0);
+    printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
+           (unsigned long)(code_gen_ptr - code_gen_buffer),
+           nb_tbs, nb_tbs > 0 ?
+           ((unsigned long)(code_gen_ptr - code_gen_buffer)) / nb_tbs : 0);
 #endif
     nb_tbs = 0;
 
@@ -636,7 +657,7 @@ static void tb_gen_code(CPUState *env,
     tb->cs_base = cs_base;
     tb->flags = flags;
     tb->cflags = cflags;
-    cpu_gen_code(env, tb, CODE_GEN_MAX_SIZE, &code_gen_size);
+    cpu_gen_code(env, tb, &code_gen_size);
     code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
 
     /* check next page if needed */
@@ -903,7 +924,7 @@ static inline void tb_alloc_page(TranslationBlock *tb,
         mprotect(g2h(page_addr), qemu_host_page_size,
                  (prot & PAGE_BITS) & ~PAGE_WRITE);
 #ifdef DEBUG_TB_INVALIDATE
-        printf("protecting code page: 0x%08lx\n",
+        printf("protecting code page: 0x" TARGET_FMT_lx "\n",
                page_addr);
 #endif
     }
@@ -958,11 +979,6 @@ void tb_link_phys(TranslationBlock *tb,
     tb->jmp_first = (TranslationBlock *)((long)tb | 2);
     tb->jmp_next[0] = NULL;
     tb->jmp_next[1] = NULL;
-#ifdef USE_CODE_COPY
-    tb->cflags &= ~CF_FP_USED;
-    if (tb->cflags & CF_TB_FP_USED)
-        tb->cflags |= CF_FP_USED;
-#endif
 
     /* init original jump addresses */
     if (tb->tb_next_offset[0] != 0xffff)
@@ -1318,8 +1334,10 @@ int cpu_str_to_log_mask(const char *str)
 void cpu_abort(CPUState *env, const char *fmt, ...)
 {
     va_list ap;
+    va_list ap2;
 
     va_start(ap, fmt);
+    va_copy(ap2, ap);
     fprintf(stderr, "qemu: fatal: ");
     vfprintf(stderr, fmt, ap);
     fprintf(stderr, "\n");
@@ -1335,7 +1353,7 @@ void cpu_abort(CPUState *env, const char *fmt, ...)
 #endif
     if (logfile) {
         fprintf(logfile, "qemu: fatal: ");
-        vfprintf(logfile, fmt, ap);
+        vfprintf(logfile, fmt, ap2);
         fprintf(logfile, "\n");
 #ifdef TARGET_I386
         cpu_dump_state(env, logfile, fprintf, X86_DUMP_FPU | X86_DUMP_CCOP);
@@ -1345,13 +1363,14 @@ void cpu_abort(CPUState *env, const char *fmt, ...)
         fflush(logfile);
         fclose(logfile);
     }
+    va_end(ap2);
     va_end(ap);
     abort();
 }
 
 CPUState *cpu_copy(CPUState *env)
 {
-    CPUState *new_env = cpu_init();
+    CPUState *new_env = cpu_init(env->cpu_model_str);
     /* preserve chaining and index */
     CPUState *next_cpu = new_env->next_cpu;
     int cpu_index = new_env->cpu_index;
@@ -1656,7 +1675,7 @@ static inline void tlb_set_dirty(CPUState *env,
    conflicting with the host address space). */
 int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
                       target_phys_addr_t paddr, int prot,
-                      int is_user, int is_softmmu)
+                      int mmu_idx, int is_softmmu)
 {
     PhysPageDesc *p;
     unsigned long pd;
@@ -1674,8 +1693,8 @@ int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
         pd = p->phys_offset;
     }
 #if defined(DEBUG_TLB)
-    printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x%08x prot=%x u=%d smmu=%d pd=0x%08lx\n",
-           vaddr, (int)paddr, prot, is_user, is_softmmu, pd);
+    printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
+           vaddr, (int)paddr, prot, mmu_idx, is_softmmu, pd);
 #endif
 
     ret = 0;
@@ -1712,7 +1731,7 @@ int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
 
         index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
         addend -= vaddr;
-        te = &env->tlb_table[is_user][index];
+        te = &env->tlb_table[mmu_idx][index];
         te->addend = addend;
         if (prot & PAGE_READ) {
             te->addr_read = address;
@@ -1838,7 +1857,7 @@ void tlb_flush_page(CPUState *env, target_ulong addr)
 
 int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
                       target_phys_addr_t paddr, int prot,
-                      int is_user, int is_softmmu)
+                      int mmu_idx, int is_softmmu)
 {
     return 0;
 }
@@ -1923,6 +1942,42 @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
     spin_unlock(&tb_lock);
 }
 
+int page_check_range(target_ulong start, target_ulong len, int flags)
+{
+    PageDesc *p;
+    target_ulong end;
+    target_ulong addr;
+
+    end = TARGET_PAGE_ALIGN(start+len); /* must do before we loose bits in the next step */
+    start = start & TARGET_PAGE_MASK;
+
+    if( end < start )
+        /* we've wrapped around */
+        return -1;
+    for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
+        p = page_find(addr >> TARGET_PAGE_BITS);
+        if( !p )
+            return -1;
+        if( !(p->flags & PAGE_VALID) )
+            return -1;
+
+        if ((flags & PAGE_READ) && !(p->flags & PAGE_READ))
+            return -1;
+        if (flags & PAGE_WRITE) {
+            if (!(p->flags & PAGE_WRITE_ORG))
+                return -1;
+            /* unprotect the page if it was put read-only because it
+               contains translated code */
+            if (!(p->flags & PAGE_WRITE)) {
+                if (!page_unprotect(addr, 0, NULL))
+                    return -1;
+            }
+            return 0;
+        }
+    }
+    return 0;
+}
+
 /* called from signal handler: invalidate the code and unprotect the
    page. Return TRUE if the fault was succesfully handled. */
 int page_unprotect(target_ulong address, unsigned long pc, void *puc)
@@ -1963,21 +2018,6 @@ int page_unprotect(target_ulong address, unsigned long pc, void *puc)
     return 0;
 }
 
-/* call this function when system calls directly modify a memory area */
-/* ??? This should be redundant now we have lock_user.  */
-void page_unprotect_range(target_ulong data, target_ulong data_size)
-{
-    target_ulong start, end, addr;
-
-    start = data;
-    end = start + data_size;
-    start &= TARGET_PAGE_MASK;
-    end = TARGET_PAGE_ALIGN(end);
-    for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
-        page_unprotect(addr, 0, NULL);
-    }
-}
-
 static inline void tlb_set_dirty(CPUState *env,
                                  unsigned long addr, target_ulong vaddr)
 {
@@ -2110,10 +2150,12 @@ void qemu_ram_free(ram_addr_t addr)
 static uint32_t unassigned_mem_readb(void *opaque, target_phys_addr_t addr)
 {
 #ifdef DEBUG_UNASSIGNED
-    printf("Unassigned mem read " TARGET_FMT_lx "\n", addr);
+    printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
 #endif
 #ifdef TARGET_SPARC
     do_unassigned_access(addr, 0, 0, 0);
+#elif TARGET_CRIS
+    do_unassigned_access(addr, 0, 0, 0);
 #endif
     return 0;
 }
@@ -2121,10 +2163,12 @@ static uint32_t unassigned_mem_readb(void *opaque, target_phys_addr_t addr)
 static void unassigned_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
 #ifdef DEBUG_UNASSIGNED
-    printf("Unassigned mem write " TARGET_FMT_lx " = 0x%x\n", addr, val);
+    printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
 #endif
 #ifdef TARGET_SPARC
     do_unassigned_access(addr, 1, 0, 0);
+#elif TARGET_CRIS
+    do_unassigned_access(addr, 1, 0, 0);
 #endif
 }
 
@@ -2527,13 +2571,19 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
         if (is_write) {
             if (!(flags & PAGE_WRITE))
                 return;
-            p = lock_user(addr, len, 0);
+            /* XXX: this code should not depend on lock_user */
+            if (!(p = lock_user(VERIFY_WRITE, addr, len, 0)))
+                /* FIXME - should this return an error rather than just fail? */
+                return;
             memcpy(p, buf, len);
             unlock_user(p, addr, len);
         } else {
             if (!(flags & PAGE_READ))
                 return;
-            p = lock_user(addr, len, 1);
+            /* XXX: this code should not depend on lock_user */
+            if (!(p = lock_user(VERIFY_READ, addr, len, 1)))
+                /* FIXME - should this return an error rather than just fail? */
+                return;
             memcpy(buf, p, len);
             unlock_user(p, addr, 0);
         }
diff --git a/fpu/softfloat-native.h b/fpu/softfloat-native.h
index 29777178b..53bf68192 100644
--- a/fpu/softfloat-native.h
+++ b/fpu/softfloat-native.h
@@ -224,6 +224,11 @@ INLINE float32 float32_chs(float32 a)
     return -a;
 }
 
+INLINE float32 float32_scalbn(float32 a, int n)
+{
+    return scalbnf(a, n);
+}
+
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE double-precision conversion routines.
 *----------------------------------------------------------------------------*/
@@ -311,6 +316,11 @@ INLINE float64 float64_chs(float64 a)
     return -a;
 }
 
+INLINE float64 float64_scalbn(float64 a, int n)
+{
+    return scalbn(a, n);
+}
+
 #ifdef FLOATX80
 
 /*----------------------------------------------------------------------------
@@ -391,4 +401,10 @@ INLINE floatx80 floatx80_chs(floatx80 a)
 {
     return -a;
 }
+
+INLINE floatx80 floatx80_scalbn(floatx80 a, int n)
+{
+    return scalbnl(a, n);
+}
+
 #endif
diff --git a/fpu/softfloat-specialize.h b/fpu/softfloat-specialize.h
index 2802eaa8d..18c6dd52d 100644
--- a/fpu/softfloat-specialize.h
+++ b/fpu/softfloat-specialize.h
@@ -30,6 +30,12 @@ these four paragraphs for those parts of this code that are retained.
 
 =============================================================================*/
 
+#if defined(TARGET_MIPS) || defined(TARGET_HPPA)
+#define SNAN_BIT_IS_ONE		1
+#else
+#define SNAN_BIT_IS_ONE		0
+#endif
+
 /*----------------------------------------------------------------------------
 | Underflow tininess-detection mode, statically initialized to default value.
 | (The declaration in `softfloat.h' must match the `int8' type here.)
@@ -45,9 +51,7 @@ int8 float_detect_tininess = float_tininess_after_rounding;
 
 void float_raise( int8 flags STATUS_PARAM )
 {
-
     STATUS(float_exception_flags) |= flags;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -61,20 +65,21 @@ typedef struct {
 /*----------------------------------------------------------------------------
 | The pattern for a default generated single-precision NaN.
 *----------------------------------------------------------------------------*/
-#if defined(TARGET_MIPS) || defined(TARGET_HPPA)
-#define float32_default_nan 0xFF800000
+#if SNAN_BIT_IS_ONE
+#define float32_default_nan make_float32(0x7FBFFFFF)
 #else
-#define float32_default_nan 0xFFC00000
+#define float32_default_nan make_float32(0xFFC00000)
 #endif
 
 /*----------------------------------------------------------------------------
-| Returns 1 if the single-precision floating-point value `a' is a NaN;
-| otherwise returns 0.
+| Returns 1 if the single-precision floating-point value `a' is a quiet
+| NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-int float32_is_nan( float32 a )
+int float32_is_nan( float32 a_ )
 {
-#if defined(TARGET_MIPS) || defined(TARGET_HPPA)
+    uint32_t a = float32_val(a_);
+#if SNAN_BIT_IS_ONE
     return ( ( ( a>>22 ) & 0x1FF ) == 0x1FE ) && ( a & 0x003FFFFF );
 #else
     return ( 0xFF800000 <= (bits32) ( a<<1 ) );
@@ -86,9 +91,10 @@ int float32_is_nan( float32 a )
 | NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-int float32_is_signaling_nan( float32 a )
+int float32_is_signaling_nan( float32 a_ )
 {
-#if defined(TARGET_MIPS) || defined(TARGET_HPPA)
+    uint32_t a = float32_val(a_);
+#if SNAN_BIT_IS_ONE
     return ( 0xFF800000 <= (bits32) ( a<<1 ) );
 #else
     return ( ( ( a>>22 ) & 0x1FF ) == 0x1FE ) && ( a & 0x003FFFFF );
@@ -106,11 +112,10 @@ static commonNaNT float32ToCommonNaN( float32 a STATUS_PARAM )
     commonNaNT z;
 
     if ( float32_is_signaling_nan( a ) ) float_raise( float_flag_invalid STATUS_VAR );
-    z.sign = a>>31;
+    z.sign = float32_val(a)>>31;
     z.low = 0;
-    z.high = ( (bits64) a )<<41;
+    z.high = ( (bits64) float32_val(a) )<<41;
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -120,9 +125,8 @@ static commonNaNT float32ToCommonNaN( float32 a STATUS_PARAM )
 
 static float32 commonNaNToFloat32( commonNaNT a )
 {
-
-    return ( ( (bits32) a.sign )<<31 ) | 0x7FC00000 | ( a.high>>41 );
-
+    return make_float32(
+        ( ( (bits32) a.sign )<<31 ) | 0x7FC00000 | ( a.high>>41 ) );
 }
 
 /*----------------------------------------------------------------------------
@@ -134,53 +138,63 @@ static float32 commonNaNToFloat32( commonNaNT a )
 static float32 propagateFloat32NaN( float32 a, float32 b STATUS_PARAM)
 {
     flag aIsNaN, aIsSignalingNaN, bIsNaN, bIsSignalingNaN;
+    bits32 av, bv, res;
 
     aIsNaN = float32_is_nan( a );
     aIsSignalingNaN = float32_is_signaling_nan( a );
     bIsNaN = float32_is_nan( b );
     bIsSignalingNaN = float32_is_signaling_nan( b );
-#if defined(TARGET_MIPS) || defined(TARGET_HPPA)
-    a &= ~0x00400000;
-    b &= ~0x00400000;
+    av = float32_val(a);
+    bv = float32_val(b);
+#if SNAN_BIT_IS_ONE
+    av &= ~0x00400000;
+    bv &= ~0x00400000;
 #else
-    a |= 0x00400000;
-    b |= 0x00400000;
+    av |= 0x00400000;
+    bv |= 0x00400000;
 #endif
     if ( aIsSignalingNaN | bIsSignalingNaN ) float_raise( float_flag_invalid STATUS_VAR);
     if ( aIsSignalingNaN ) {
         if ( bIsSignalingNaN ) goto returnLargerSignificand;
-        return bIsNaN ? b : a;
+        res = bIsNaN ? bv : av;
     }
     else if ( aIsNaN ) {
-        if ( bIsSignalingNaN | ! bIsNaN ) return a;
+        if ( bIsSignalingNaN | ! bIsNaN )
+            res = av;
+        else {
  returnLargerSignificand:
-        if ( (bits32) ( a<<1 ) < (bits32) ( b<<1 ) ) return b;
-        if ( (bits32) ( b<<1 ) < (bits32) ( a<<1 ) ) return a;
-        return ( a < b ) ? a : b;
+            if ( (bits32) ( av<<1 ) < (bits32) ( bv<<1 ) )
+                res = bv;
+            else if ( (bits32) ( bv<<1 ) < (bits32) ( av<<1 ) )
+                res = av;
+            else
+                res = ( av < bv ) ? av : bv;
+        }
     }
     else {
-        return b;
+        res = bv;
     }
-
+    return make_float32(res);
 }
 
 /*----------------------------------------------------------------------------
 | The pattern for a default generated double-precision NaN.
 *----------------------------------------------------------------------------*/
-#if defined(TARGET_MIPS) || defined(TARGET_HPPA)
-#define float64_default_nan LIT64( 0xFFF0000000000000 )
+#if SNAN_BIT_IS_ONE
+#define float64_default_nan make_float64(LIT64( 0x7FF7FFFFFFFFFFFF ))
 #else
-#define float64_default_nan LIT64( 0xFFF8000000000000 )
+#define float64_default_nan make_float64(LIT64( 0xFFF8000000000000 ))
 #endif
 
 /*----------------------------------------------------------------------------
-| Returns 1 if the double-precision floating-point value `a' is a NaN;
-| otherwise returns 0.
+| Returns 1 if the double-precision floating-point value `a' is a quiet
+| NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-int float64_is_nan( float64 a )
+int float64_is_nan( float64 a_ )
 {
-#if defined(TARGET_MIPS) || defined(TARGET_HPPA)
+    bits64 a = float64_val(a_);
+#if SNAN_BIT_IS_ONE
     return
            ( ( ( a>>51 ) & 0xFFF ) == 0xFFE )
         && ( a & LIT64( 0x0007FFFFFFFFFFFF ) );
@@ -194,9 +208,10 @@ int float64_is_nan( float64 a )
 | NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-int float64_is_signaling_nan( float64 a )
+int float64_is_signaling_nan( float64 a_ )
 {
-#if defined(TARGET_MIPS) || defined(TARGET_HPPA)
+    bits64 a = float64_val(a_);
+#if SNAN_BIT_IS_ONE
     return ( LIT64( 0xFFF0000000000000 ) <= (bits64) ( a<<1 ) );
 #else
     return
@@ -216,11 +231,10 @@ static commonNaNT float64ToCommonNaN( float64 a STATUS_PARAM)
     commonNaNT z;
 
     if ( float64_is_signaling_nan( a ) ) float_raise( float_flag_invalid STATUS_VAR);
-    z.sign = a>>63;
+    z.sign = float64_val(a)>>63;
     z.low = 0;
-    z.high = a<<12;
+    z.high = float64_val(a)<<12;
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -230,12 +244,10 @@ static commonNaNT float64ToCommonNaN( float64 a STATUS_PARAM)
 
 static float64 commonNaNToFloat64( commonNaNT a )
 {
-
-    return
+    return make_float64(
           ( ( (bits64) a.sign )<<63 )
         | LIT64( 0x7FF8000000000000 )
-        | ( a.high>>12 );
-
+        | ( a.high>>12 ));
 }
 
 /*----------------------------------------------------------------------------
@@ -247,34 +259,43 @@ static float64 commonNaNToFloat64( commonNaNT a )
 static float64 propagateFloat64NaN( float64 a, float64 b STATUS_PARAM)
 {
     flag aIsNaN, aIsSignalingNaN, bIsNaN, bIsSignalingNaN;
+    bits64 av, bv, res;
 
     aIsNaN = float64_is_nan( a );
     aIsSignalingNaN = float64_is_signaling_nan( a );
     bIsNaN = float64_is_nan( b );
     bIsSignalingNaN = float64_is_signaling_nan( b );
-#if defined(TARGET_MIPS) || defined(TARGET_HPPA)
-    a &= ~LIT64( 0x0008000000000000 );
-    b &= ~LIT64( 0x0008000000000000 );
+    av = float64_val(a);
+    bv = float64_val(b);
+#if SNAN_BIT_IS_ONE
+    av &= ~LIT64( 0x0008000000000000 );
+    bv &= ~LIT64( 0x0008000000000000 );
 #else
-    a |= LIT64( 0x0008000000000000 );
-    b |= LIT64( 0x0008000000000000 );
+    av |= LIT64( 0x0008000000000000 );
+    bv |= LIT64( 0x0008000000000000 );
 #endif
     if ( aIsSignalingNaN | bIsSignalingNaN ) float_raise( float_flag_invalid STATUS_VAR);
     if ( aIsSignalingNaN ) {
         if ( bIsSignalingNaN ) goto returnLargerSignificand;
-        return bIsNaN ? b : a;
+        res = bIsNaN ? bv : av;
     }
     else if ( aIsNaN ) {
-        if ( bIsSignalingNaN | ! bIsNaN ) return a;
+        if ( bIsSignalingNaN | ! bIsNaN )
+            res = av;
+        else {
  returnLargerSignificand:
-        if ( (bits64) ( a<<1 ) < (bits64) ( b<<1 ) ) return b;
-        if ( (bits64) ( b<<1 ) < (bits64) ( a<<1 ) ) return a;
-        return ( a < b ) ? a : b;
+            if ( (bits64) ( av<<1 ) < (bits64) ( bv<<1 ) )
+                res = bv;
+            else if ( (bits64) ( bv<<1 ) < (bits64) ( av<<1 ) )
+                res = av;
+            else
+                res = ( av < bv ) ? av : bv;
+        }
     }
     else {
-        return b;
+        res = bv;
     }
-
+    return make_float64(res);
 }
 
 #ifdef FLOATX80
@@ -284,19 +305,32 @@ static float64 propagateFloat64NaN( float64 a, float64 b STATUS_PARAM)
 | `high' and `low' values hold the most- and least-significant bits,
 | respectively.
 *----------------------------------------------------------------------------*/
+#if SNAN_BIT_IS_ONE
+#define floatx80_default_nan_high 0x7FFF
+#define floatx80_default_nan_low  LIT64( 0xBFFFFFFFFFFFFFFF )
+#else
 #define floatx80_default_nan_high 0xFFFF
 #define floatx80_default_nan_low  LIT64( 0xC000000000000000 )
+#endif
 
 /*----------------------------------------------------------------------------
 | Returns 1 if the extended double-precision floating-point value `a' is a
-| NaN; otherwise returns 0.
+| quiet NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
 int floatx80_is_nan( floatx80 a )
 {
+#if SNAN_BIT_IS_ONE
+    bits64 aLow;
 
+    aLow = a.low & ~ LIT64( 0x4000000000000000 );
+    return
+           ( ( a.high & 0x7FFF ) == 0x7FFF )
+        && (bits64) ( aLow<<1 )
+        && ( a.low == aLow );
+#else
     return ( ( a.high & 0x7FFF ) == 0x7FFF ) && (bits64) ( a.low<<1 );
-
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -306,6 +340,9 @@ int floatx80_is_nan( floatx80 a )
 
 int floatx80_is_signaling_nan( floatx80 a )
 {
+#if SNAN_BIT_IS_ONE
+    return ( ( a.high & 0x7FFF ) == 0x7FFF ) && (bits64) ( a.low<<1 );
+#else
     bits64 aLow;
 
     aLow = a.low & ~ LIT64( 0x4000000000000000 );
@@ -313,7 +350,7 @@ int floatx80_is_signaling_nan( floatx80 a )
            ( ( a.high & 0x7FFF ) == 0x7FFF )
         && (bits64) ( aLow<<1 )
         && ( a.low == aLow );
-
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -331,7 +368,6 @@ static commonNaNT floatx80ToCommonNaN( floatx80 a STATUS_PARAM)
     z.low = 0;
     z.high = a.low<<1;
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -346,7 +382,6 @@ static floatx80 commonNaNToFloatx80( commonNaNT a )
     z.low = LIT64( 0xC000000000000000 ) | ( a.high>>1 );
     z.high = ( ( (bits16) a.sign )<<15 ) | 0x7FFF;
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -363,8 +398,13 @@ static floatx80 propagateFloatx80NaN( floatx80 a, floatx80 b STATUS_PARAM)
     aIsSignalingNaN = floatx80_is_signaling_nan( a );
     bIsNaN = floatx80_is_nan( b );
     bIsSignalingNaN = floatx80_is_signaling_nan( b );
+#if SNAN_BIT_IS_ONE
+    a.low &= ~LIT64( 0xC000000000000000 );
+    b.low &= ~LIT64( 0xC000000000000000 );
+#else
     a.low |= LIT64( 0xC000000000000000 );
     b.low |= LIT64( 0xC000000000000000 );
+#endif
     if ( aIsSignalingNaN | bIsSignalingNaN ) float_raise( float_flag_invalid STATUS_VAR);
     if ( aIsSignalingNaN ) {
         if ( bIsSignalingNaN ) goto returnLargerSignificand;
@@ -380,7 +420,6 @@ static floatx80 propagateFloatx80NaN( floatx80 a, floatx80 b STATUS_PARAM)
     else {
         return b;
     }
-
 }
 
 #endif
@@ -391,21 +430,30 @@ static floatx80 propagateFloatx80NaN( floatx80 a, floatx80 b STATUS_PARAM)
 | The pattern for a default generated quadruple-precision NaN.  The `high' and
 | `low' values hold the most- and least-significant bits, respectively.
 *----------------------------------------------------------------------------*/
+#if SNAN_BIT_IS_ONE
+#define float128_default_nan_high LIT64( 0x7FFF7FFFFFFFFFFF )
+#define float128_default_nan_low  LIT64( 0xFFFFFFFFFFFFFFFF )
+#else
 #define float128_default_nan_high LIT64( 0xFFFF800000000000 )
 #define float128_default_nan_low  LIT64( 0x0000000000000000 )
+#endif
 
 /*----------------------------------------------------------------------------
-| Returns 1 if the quadruple-precision floating-point value `a' is a NaN;
-| otherwise returns 0.
+| Returns 1 if the quadruple-precision floating-point value `a' is a quiet
+| NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
 int float128_is_nan( float128 a )
 {
-
+#if SNAN_BIT_IS_ONE
+    return
+           ( ( ( a.high>>47 ) & 0xFFFF ) == 0xFFFE )
+        && ( a.low || ( a.high & LIT64( 0x00007FFFFFFFFFFF ) ) );
+#else
     return
            ( LIT64( 0xFFFE000000000000 ) <= (bits64) ( a.high<<1 ) )
         && ( a.low || ( a.high & LIT64( 0x0000FFFFFFFFFFFF ) ) );
-
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -415,11 +463,15 @@ int float128_is_nan( float128 a )
 
 int float128_is_signaling_nan( float128 a )
 {
-
+#if SNAN_BIT_IS_ONE
+    return
+           ( LIT64( 0xFFFE000000000000 ) <= (bits64) ( a.high<<1 ) )
+        && ( a.low || ( a.high & LIT64( 0x0000FFFFFFFFFFFF ) ) );
+#else
     return
            ( ( ( a.high>>47 ) & 0xFFFF ) == 0xFFFE )
         && ( a.low || ( a.high & LIT64( 0x00007FFFFFFFFFFF ) ) );
-
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -436,7 +488,6 @@ static commonNaNT float128ToCommonNaN( float128 a STATUS_PARAM)
     z.sign = a.high>>63;
     shortShift128Left( a.high, a.low, 16, &z.high, &z.low );
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -451,7 +502,6 @@ static float128 commonNaNToFloat128( commonNaNT a )
     shift128Right( a.high, a.low, 16, &z.high, &z.low );
     z.high |= ( ( (bits64) a.sign )<<63 ) | LIT64( 0x7FFF800000000000 );
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -468,8 +518,13 @@ static float128 propagateFloat128NaN( float128 a, float128 b STATUS_PARAM)
     aIsSignalingNaN = float128_is_signaling_nan( a );
     bIsNaN = float128_is_nan( b );
     bIsSignalingNaN = float128_is_signaling_nan( b );
+#if SNAN_BIT_IS_ONE
+    a.high &= ~LIT64( 0x0000800000000000 );
+    b.high &= ~LIT64( 0x0000800000000000 );
+#else
     a.high |= LIT64( 0x0000800000000000 );
     b.high |= LIT64( 0x0000800000000000 );
+#endif
     if ( aIsSignalingNaN | bIsSignalingNaN ) float_raise( float_flag_invalid STATUS_VAR);
     if ( aIsSignalingNaN ) {
         if ( bIsSignalingNaN ) goto returnLargerSignificand;
@@ -485,8 +540,6 @@ static float128 propagateFloat128NaN( float128 a, float128 b STATUS_PARAM)
     else {
         return b;
     }
-
 }
 
 #endif
-
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index 6db6cf132..3ec1e0de1 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -175,7 +175,7 @@ static int64 roundAndPackInt64( flag zSign, bits64 absZ0, bits64 absZ1 STATUS_PA
 INLINE bits32 extractFloat32Frac( float32 a )
 {
 
-    return a & 0x007FFFFF;
+    return float32_val(a) & 0x007FFFFF;
 
 }
 
@@ -186,7 +186,7 @@ INLINE bits32 extractFloat32Frac( float32 a )
 INLINE int16 extractFloat32Exp( float32 a )
 {
 
-    return ( a>>23 ) & 0xFF;
+    return ( float32_val(a)>>23 ) & 0xFF;
 
 }
 
@@ -197,7 +197,7 @@ INLINE int16 extractFloat32Exp( float32 a )
 INLINE flag extractFloat32Sign( float32 a )
 {
 
-    return a>>31;
+    return float32_val(a)>>31;
 
 }
 
@@ -233,7 +233,8 @@ static void
 INLINE float32 packFloat32( flag zSign, int16 zExp, bits32 zSig )
 {
 
-    return ( ( (bits32) zSign )<<31 ) + ( ( (bits32) zExp )<<23 ) + zSig;
+    return make_float32(
+          ( ( (bits32) zSign )<<31 ) + ( ( (bits32) zExp )<<23 ) + zSig);
 
 }
 
@@ -290,7 +291,7 @@ static float32 roundAndPackFloat32( flag zSign, int16 zExp, bits32 zSig STATUS_P
                   && ( (sbits32) ( zSig + roundIncrement ) < 0 ) )
            ) {
             float_raise( float_flag_overflow | float_flag_inexact STATUS_VAR);
-            return packFloat32( zSign, 0xFF, 0 ) - ( roundIncrement == 0 );
+            return packFloat32( zSign, 0xFF, - ( roundIncrement == 0 ));
         }
         if ( zExp < 0 ) {
             isTiny =
@@ -337,7 +338,7 @@ static float32
 INLINE bits64 extractFloat64Frac( float64 a )
 {
 
-    return a & LIT64( 0x000FFFFFFFFFFFFF );
+    return float64_val(a) & LIT64( 0x000FFFFFFFFFFFFF );
 
 }
 
@@ -348,7 +349,7 @@ INLINE bits64 extractFloat64Frac( float64 a )
 INLINE int16 extractFloat64Exp( float64 a )
 {
 
-    return ( a>>52 ) & 0x7FF;
+    return ( float64_val(a)>>52 ) & 0x7FF;
 
 }
 
@@ -359,7 +360,7 @@ INLINE int16 extractFloat64Exp( float64 a )
 INLINE flag extractFloat64Sign( float64 a )
 {
 
-    return a>>63;
+    return float64_val(a)>>63;
 
 }
 
@@ -395,7 +396,8 @@ static void
 INLINE float64 packFloat64( flag zSign, int16 zExp, bits64 zSig )
 {
 
-    return ( ( (bits64) zSign )<<63 ) + ( ( (bits64) zExp )<<52 ) + zSig;
+    return make_float64(
+        ( ( (bits64) zSign )<<63 ) + ( ( (bits64) zExp )<<52 ) + zSig);
 
 }
 
@@ -452,7 +454,7 @@ static float64 roundAndPackFloat64( flag zSign, int16 zExp, bits64 zSig STATUS_P
                   && ( (sbits64) ( zSig + roundIncrement ) < 0 ) )
            ) {
             float_raise( float_flag_overflow | float_flag_inexact STATUS_VAR);
-            return packFloat64( zSign, 0x7FF, 0 ) - ( roundIncrement == 0 );
+            return packFloat64( zSign, 0x7FF, - ( roundIncrement == 0 ));
         }
         if ( zExp < 0 ) {
             isTiny =
@@ -1050,7 +1052,7 @@ float32 int32_to_float32( int32 a STATUS_PARAM )
 {
     flag zSign;
 
-    if ( a == 0 ) return 0;
+    if ( a == 0 ) return float32_zero;
     if ( a == (sbits32) 0x80000000 ) return packFloat32( 1, 0x9E, 0 );
     zSign = ( a < 0 );
     return normalizeRoundAndPackFloat32( zSign, 0x9C, zSign ? - a : a STATUS_VAR );
@@ -1070,7 +1072,7 @@ float64 int32_to_float64( int32 a STATUS_PARAM )
     int8 shiftCount;
     bits64 zSig;
 
-    if ( a == 0 ) return 0;
+    if ( a == 0 ) return float64_zero;
     zSign = ( a < 0 );
     absA = zSign ? - a : a;
     shiftCount = countLeadingZeros32( absA ) + 21;
@@ -1144,7 +1146,7 @@ float32 int64_to_float32( int64 a STATUS_PARAM )
     uint64 absA;
     int8 shiftCount;
 
-    if ( a == 0 ) return 0;
+    if ( a == 0 ) return float32_zero;
     zSign = ( a < 0 );
     absA = zSign ? - a : a;
     shiftCount = countLeadingZeros64( absA ) - 40;
@@ -1168,7 +1170,7 @@ float32 uint64_to_float32( uint64 a STATUS_PARAM )
 {
     int8 shiftCount;
 
-    if ( a == 0 ) return 0;
+    if ( a == 0 ) return float32_zero;
     shiftCount = countLeadingZeros64( a ) - 40;
     if ( 0 <= shiftCount ) {
         return packFloat32( 1 > 0, 0x95 - shiftCount, a<<shiftCount );
@@ -1195,7 +1197,7 @@ float64 int64_to_float64( int64 a STATUS_PARAM )
 {
     flag zSign;
 
-    if ( a == 0 ) return 0;
+    if ( a == 0 ) return float64_zero;
     if ( a == (sbits64) LIT64( 0x8000000000000000 ) ) {
         return packFloat64( 1, 0x43E, 0 );
     }
@@ -1206,7 +1208,7 @@ float64 int64_to_float64( int64 a STATUS_PARAM )
 
 float64 uint64_to_float64( uint64 a STATUS_PARAM )
 {
-    if ( a == 0 ) return 0;
+    if ( a == 0 ) return float64_zero;
     return normalizeRoundAndPackFloat64( 0, 0x43C, a STATUS_VAR );
 
 }
@@ -1325,7 +1327,7 @@ int32 float32_to_int32_round_to_zero( float32 a STATUS_PARAM )
     aSign = extractFloat32Sign( a );
     shiftCount = aExp - 0x9E;
     if ( 0 <= shiftCount ) {
-        if ( a != 0xCF000000 ) {
+        if ( float32_val(a) != 0xCF000000 ) {
             float_raise( float_flag_invalid STATUS_VAR);
             if ( ! aSign || ( ( aExp == 0xFF ) && aSig ) ) return 0x7FFFFFFF;
         }
@@ -1404,7 +1406,7 @@ int64 float32_to_int64_round_to_zero( float32 a STATUS_PARAM )
     aSign = extractFloat32Sign( a );
     shiftCount = aExp - 0xBE;
     if ( 0 <= shiftCount ) {
-        if ( a != 0xDF000000 ) {
+        if ( float32_val(a) != 0xDF000000 ) {
             float_raise( float_flag_invalid STATUS_VAR);
             if ( ! aSign || ( ( aExp == 0xFF ) && aSig ) ) {
                 return LIT64( 0x7FFFFFFFFFFFFFFF );
@@ -1535,7 +1537,7 @@ float32 float32_round_to_int( float32 a STATUS_PARAM)
     int16 aExp;
     bits32 lastBitMask, roundBitsMask;
     int8 roundingMode;
-    float32 z;
+    bits32 z;
 
     aExp = extractFloat32Exp( a );
     if ( 0x96 <= aExp ) {
@@ -1545,7 +1547,7 @@ float32 float32_round_to_int( float32 a STATUS_PARAM)
         return a;
     }
     if ( aExp <= 0x7E ) {
-        if ( (bits32) ( a<<1 ) == 0 ) return a;
+        if ( (bits32) ( float32_val(a)<<1 ) == 0 ) return a;
         STATUS(float_exception_flags) |= float_flag_inexact;
         aSign = extractFloat32Sign( a );
         switch ( STATUS(float_rounding_mode) ) {
@@ -1555,29 +1557,29 @@ float32 float32_round_to_int( float32 a STATUS_PARAM)
             }
             break;
          case float_round_down:
-            return aSign ? 0xBF800000 : 0;
+            return make_float32(aSign ? 0xBF800000 : 0);
          case float_round_up:
-            return aSign ? 0x80000000 : 0x3F800000;
+            return make_float32(aSign ? 0x80000000 : 0x3F800000);
         }
         return packFloat32( aSign, 0, 0 );
     }
     lastBitMask = 1;
     lastBitMask <<= 0x96 - aExp;
     roundBitsMask = lastBitMask - 1;
-    z = a;
+    z = float32_val(a);
     roundingMode = STATUS(float_rounding_mode);
     if ( roundingMode == float_round_nearest_even ) {
         z += lastBitMask>>1;
         if ( ( z & roundBitsMask ) == 0 ) z &= ~ lastBitMask;
     }
     else if ( roundingMode != float_round_to_zero ) {
-        if ( extractFloat32Sign( z ) ^ ( roundingMode == float_round_up ) ) {
+        if ( extractFloat32Sign( make_float32(z) ) ^ ( roundingMode == float_round_up ) ) {
             z += roundBitsMask;
         }
     }
     z &= ~ roundBitsMask;
-    if ( z != a ) STATUS(float_exception_flags) |= float_flag_inexact;
-    return z;
+    if ( z != float32_val(a) ) STATUS(float_exception_flags) |= float_flag_inexact;
+    return make_float32(z);
 
 }
 
@@ -2008,7 +2010,7 @@ float32 float32_sqrt( float32 a STATUS_PARAM )
     aExp = extractFloat32Exp( a );
     aSign = extractFloat32Sign( a );
     if ( aExp == 0xFF ) {
-        if ( aSig ) return propagateFloat32NaN( a, 0 STATUS_VAR );
+        if ( aSig ) return propagateFloat32NaN( a, float32_zero STATUS_VAR );
         if ( ! aSign ) return a;
         float_raise( float_flag_invalid STATUS_VAR);
         return float32_default_nan;
@@ -2019,7 +2021,7 @@ float32 float32_sqrt( float32 a STATUS_PARAM )
         return float32_default_nan;
     }
     if ( aExp == 0 ) {
-        if ( aSig == 0 ) return 0;
+        if ( aSig == 0 ) return float32_zero;
         normalizeFloat32Subnormal( aSig, &aExp, &aSig );
     }
     zExp = ( ( aExp - 0x7F )>>1 ) + 0x7E;
@@ -2062,7 +2064,8 @@ int float32_eq( float32 a, float32 b STATUS_PARAM )
         }
         return 0;
     }
-    return ( a == b ) || ( (bits32) ( ( a | b )<<1 ) == 0 );
+    return ( float32_val(a) == float32_val(b) ) ||
+            ( (bits32) ( ( float32_val(a) | float32_val(b) )<<1 ) == 0 );
 
 }
 
@@ -2076,6 +2079,7 @@ int float32_eq( float32 a, float32 b STATUS_PARAM )
 int float32_le( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits32 av, bv;
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
          || ( ( extractFloat32Exp( b ) == 0xFF ) && extractFloat32Frac( b ) )
@@ -2085,8 +2089,10 @@ int float32_le( float32 a, float32 b STATUS_PARAM )
     }
     aSign = extractFloat32Sign( a );
     bSign = extractFloat32Sign( b );
-    if ( aSign != bSign ) return aSign || ( (bits32) ( ( a | b )<<1 ) == 0 );
-    return ( a == b ) || ( aSign ^ ( a < b ) );
+    av = float32_val(a);
+    bv = float32_val(b);
+    if ( aSign != bSign ) return aSign || ( (bits32) ( ( av | bv )<<1 ) == 0 );
+    return ( av == bv ) || ( aSign ^ ( av < bv ) );
 
 }
 
@@ -2099,6 +2105,7 @@ int float32_le( float32 a, float32 b STATUS_PARAM )
 int float32_lt( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits32 av, bv;
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
          || ( ( extractFloat32Exp( b ) == 0xFF ) && extractFloat32Frac( b ) )
@@ -2108,8 +2115,10 @@ int float32_lt( float32 a, float32 b STATUS_PARAM )
     }
     aSign = extractFloat32Sign( a );
     bSign = extractFloat32Sign( b );
-    if ( aSign != bSign ) return aSign && ( (bits32) ( ( a | b )<<1 ) != 0 );
-    return ( a != b ) && ( aSign ^ ( a < b ) );
+    av = float32_val(a);
+    bv = float32_val(b);
+    if ( aSign != bSign ) return aSign && ( (bits32) ( ( av | bv )<<1 ) != 0 );
+    return ( av != bv ) && ( aSign ^ ( av < bv ) );
 
 }
 
@@ -2122,6 +2131,7 @@ int float32_lt( float32 a, float32 b STATUS_PARAM )
 
 int float32_eq_signaling( float32 a, float32 b STATUS_PARAM )
 {
+    bits32 av, bv;
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
          || ( ( extractFloat32Exp( b ) == 0xFF ) && extractFloat32Frac( b ) )
@@ -2129,7 +2139,9 @@ int float32_eq_signaling( float32 a, float32 b STATUS_PARAM )
         float_raise( float_flag_invalid STATUS_VAR);
         return 0;
     }
-    return ( a == b ) || ( (bits32) ( ( a | b )<<1 ) == 0 );
+    av = float32_val(a);
+    bv = float32_val(b);
+    return ( av == bv ) || ( (bits32) ( ( av | bv )<<1 ) == 0 );
 
 }
 
@@ -2143,6 +2155,7 @@ int float32_eq_signaling( float32 a, float32 b STATUS_PARAM )
 int float32_le_quiet( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits32 av, bv;
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
          || ( ( extractFloat32Exp( b ) == 0xFF ) && extractFloat32Frac( b ) )
@@ -2154,8 +2167,10 @@ int float32_le_quiet( float32 a, float32 b STATUS_PARAM )
     }
     aSign = extractFloat32Sign( a );
     bSign = extractFloat32Sign( b );
-    if ( aSign != bSign ) return aSign || ( (bits32) ( ( a | b )<<1 ) == 0 );
-    return ( a == b ) || ( aSign ^ ( a < b ) );
+    av = float32_val(a);
+    bv = float32_val(b);
+    if ( aSign != bSign ) return aSign || ( (bits32) ( ( av | bv )<<1 ) == 0 );
+    return ( av == bv ) || ( aSign ^ ( av < bv ) );
 
 }
 
@@ -2169,6 +2184,7 @@ int float32_le_quiet( float32 a, float32 b STATUS_PARAM )
 int float32_lt_quiet( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits32 av, bv;
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
          || ( ( extractFloat32Exp( b ) == 0xFF ) && extractFloat32Frac( b ) )
@@ -2180,8 +2196,10 @@ int float32_lt_quiet( float32 a, float32 b STATUS_PARAM )
     }
     aSign = extractFloat32Sign( a );
     bSign = extractFloat32Sign( b );
-    if ( aSign != bSign ) return aSign && ( (bits32) ( ( a | b )<<1 ) != 0 );
-    return ( a != b ) && ( aSign ^ ( a < b ) );
+    av = float32_val(a);
+    bv = float32_val(b);
+    if ( aSign != bSign ) return aSign && ( (bits32) ( ( av | bv )<<1 ) != 0 );
+    return ( av != bv ) && ( aSign ^ ( av < bv ) );
 
 }
 
@@ -2324,7 +2342,7 @@ int64 float64_to_int64_round_to_zero( float64 a STATUS_PARAM )
     shiftCount = aExp - 0x433;
     if ( 0 <= shiftCount ) {
         if ( 0x43E <= aExp ) {
-            if ( a != LIT64( 0xC3E0000000000000 ) ) {
+            if ( float64_val(a) != LIT64( 0xC3E0000000000000 ) ) {
                 float_raise( float_flag_invalid STATUS_VAR);
                 if (    ! aSign
                      || (    ( aExp == 0x7FF )
@@ -2464,7 +2482,7 @@ float64 float64_round_to_int( float64 a STATUS_PARAM )
     int16 aExp;
     bits64 lastBitMask, roundBitsMask;
     int8 roundingMode;
-    float64 z;
+    bits64 z;
 
     aExp = extractFloat64Exp( a );
     if ( 0x433 <= aExp ) {
@@ -2474,7 +2492,7 @@ float64 float64_round_to_int( float64 a STATUS_PARAM )
         return a;
     }
     if ( aExp < 0x3FF ) {
-        if ( (bits64) ( a<<1 ) == 0 ) return a;
+        if ( (bits64) ( float64_val(a)<<1 ) == 0 ) return a;
         STATUS(float_exception_flags) |= float_flag_inexact;
         aSign = extractFloat64Sign( a );
         switch ( STATUS(float_rounding_mode) ) {
@@ -2484,30 +2502,31 @@ float64 float64_round_to_int( float64 a STATUS_PARAM )
             }
             break;
          case float_round_down:
-            return aSign ? LIT64( 0xBFF0000000000000 ) : 0;
+            return make_float64(aSign ? LIT64( 0xBFF0000000000000 ) : 0);
          case float_round_up:
-            return
-            aSign ? LIT64( 0x8000000000000000 ) : LIT64( 0x3FF0000000000000 );
+            return make_float64(
+            aSign ? LIT64( 0x8000000000000000 ) : LIT64( 0x3FF0000000000000 ));
         }
         return packFloat64( aSign, 0, 0 );
     }
     lastBitMask = 1;
     lastBitMask <<= 0x433 - aExp;
     roundBitsMask = lastBitMask - 1;
-    z = a;
+    z = float64_val(a);
     roundingMode = STATUS(float_rounding_mode);
     if ( roundingMode == float_round_nearest_even ) {
         z += lastBitMask>>1;
         if ( ( z & roundBitsMask ) == 0 ) z &= ~ lastBitMask;
     }
     else if ( roundingMode != float_round_to_zero ) {
-        if ( extractFloat64Sign( z ) ^ ( roundingMode == float_round_up ) ) {
+        if ( extractFloat64Sign( make_float64(z) ) ^ ( roundingMode == float_round_up ) ) {
             z += roundBitsMask;
         }
     }
     z &= ~ roundBitsMask;
-    if ( z != a ) STATUS(float_exception_flags) |= float_flag_inexact;
-    return z;
+    if ( z != float64_val(a) )
+        STATUS(float_exception_flags) |= float_flag_inexact;
+    return make_float64(z);
 
 }
 
@@ -2951,7 +2970,7 @@ float64 float64_sqrt( float64 a STATUS_PARAM )
         return float64_default_nan;
     }
     if ( aExp == 0 ) {
-        if ( aSig == 0 ) return 0;
+        if ( aSig == 0 ) return float64_zero;
         normalizeFloat64Subnormal( aSig, &aExp, &aSig );
     }
     zExp = ( ( aExp - 0x3FF )>>1 ) + 0x3FE;
@@ -2982,6 +3001,7 @@ float64 float64_sqrt( float64 a STATUS_PARAM )
 
 int float64_eq( float64 a, float64 b STATUS_PARAM )
 {
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -2991,7 +3011,9 @@ int float64_eq( float64 a, float64 b STATUS_PARAM )
         }
         return 0;
     }
-    return ( a == b ) || ( (bits64) ( ( a | b )<<1 ) == 0 );
+    av = float64_val(a);
+    bv = float64_val(b);
+    return ( av == bv ) || ( (bits64) ( ( av | bv )<<1 ) == 0 );
 
 }
 
@@ -3005,6 +3027,7 @@ int float64_eq( float64 a, float64 b STATUS_PARAM )
 int float64_le( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -3014,8 +3037,10 @@ int float64_le( float64 a, float64 b STATUS_PARAM )
     }
     aSign = extractFloat64Sign( a );
     bSign = extractFloat64Sign( b );
-    if ( aSign != bSign ) return aSign || ( (bits64) ( ( a | b )<<1 ) == 0 );
-    return ( a == b ) || ( aSign ^ ( a < b ) );
+    av = float64_val(a);
+    bv = float64_val(b);
+    if ( aSign != bSign ) return aSign || ( (bits64) ( ( av | bv )<<1 ) == 0 );
+    return ( av == bv ) || ( aSign ^ ( av < bv ) );
 
 }
 
@@ -3028,6 +3053,7 @@ int float64_le( float64 a, float64 b STATUS_PARAM )
 int float64_lt( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -3037,8 +3063,10 @@ int float64_lt( float64 a, float64 b STATUS_PARAM )
     }
     aSign = extractFloat64Sign( a );
     bSign = extractFloat64Sign( b );
-    if ( aSign != bSign ) return aSign && ( (bits64) ( ( a | b )<<1 ) != 0 );
-    return ( a != b ) && ( aSign ^ ( a < b ) );
+    av = float64_val(a);
+    bv = float64_val(b);
+    if ( aSign != bSign ) return aSign && ( (bits64) ( ( av | bv )<<1 ) != 0 );
+    return ( av != bv ) && ( aSign ^ ( av < bv ) );
 
 }
 
@@ -3051,6 +3079,7 @@ int float64_lt( float64 a, float64 b STATUS_PARAM )
 
 int float64_eq_signaling( float64 a, float64 b STATUS_PARAM )
 {
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -3058,7 +3087,9 @@ int float64_eq_signaling( float64 a, float64 b STATUS_PARAM )
         float_raise( float_flag_invalid STATUS_VAR);
         return 0;
     }
-    return ( a == b ) || ( (bits64) ( ( a | b )<<1 ) == 0 );
+    av = float64_val(a);
+    bv = float64_val(b);
+    return ( av == bv ) || ( (bits64) ( ( av | bv )<<1 ) == 0 );
 
 }
 
@@ -3072,6 +3103,7 @@ int float64_eq_signaling( float64 a, float64 b STATUS_PARAM )
 int float64_le_quiet( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -3083,8 +3115,10 @@ int float64_le_quiet( float64 a, float64 b STATUS_PARAM )
     }
     aSign = extractFloat64Sign( a );
     bSign = extractFloat64Sign( b );
-    if ( aSign != bSign ) return aSign || ( (bits64) ( ( a | b )<<1 ) == 0 );
-    return ( a == b ) || ( aSign ^ ( a < b ) );
+    av = float64_val(a);
+    bv = float64_val(b);
+    if ( aSign != bSign ) return aSign || ( (bits64) ( ( av | bv )<<1 ) == 0 );
+    return ( av == bv ) || ( aSign ^ ( av < bv ) );
 
 }
 
@@ -3098,6 +3132,7 @@ int float64_le_quiet( float64 a, float64 b STATUS_PARAM )
 int float64_lt_quiet( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -3109,8 +3144,10 @@ int float64_lt_quiet( float64 a, float64 b STATUS_PARAM )
     }
     aSign = extractFloat64Sign( a );
     bSign = extractFloat64Sign( b );
-    if ( aSign != bSign ) return aSign && ( (bits64) ( ( a | b )<<1 ) != 0 );
-    return ( a != b ) && ( aSign ^ ( a < b ) );
+    av = float64_val(a);
+    bv = float64_val(b);
+    if ( aSign != bSign ) return aSign && ( (bits64) ( ( av | bv )<<1 ) != 0 );
+    return ( av != bv ) && ( aSign ^ ( av < bv ) );
 
 }
 
@@ -5310,12 +5347,14 @@ unsigned int float64_to_uint32_round_to_zero( float64 a STATUS_PARAM )
     return res;
 }
 
+/* FIXME: This looks broken.  */
 uint64_t float64_to_uint64 (float64 a STATUS_PARAM)
 {
     int64_t v;
 
-    v = int64_to_float64(INT64_MIN STATUS_VAR);
-    v = float64_to_int64((a + v) STATUS_VAR);
+    v = float64_val(int64_to_float64(INT64_MIN STATUS_VAR));
+    v += float64_val(a);
+    v = float64_to_int64(make_float64(v) STATUS_VAR);
 
     return v - INT64_MIN;
 }
@@ -5324,8 +5363,9 @@ uint64_t float64_to_uint64_round_to_zero (float64 a STATUS_PARAM)
 {
     int64_t v;
 
-    v = int64_to_float64(INT64_MIN STATUS_VAR);
-    v = float64_to_int64_round_to_zero((a + v) STATUS_VAR);
+    v = float64_val(int64_to_float64(INT64_MIN STATUS_VAR));
+    v += float64_val(a);
+    v = float64_to_int64_round_to_zero(make_float64(v) STATUS_VAR);
 
     return v - INT64_MIN;
 }
@@ -5335,6 +5375,7 @@ INLINE int float ## s ## _compare_internal( float ## s a, float ## s b,      \
                                       int is_quiet STATUS_PARAM )            \
 {                                                                            \
     flag aSign, bSign;                                                       \
+    bits ## s av, bv;                                                        \
                                                                              \
     if (( ( extractFloat ## s ## Exp( a ) == nan_exp ) &&                    \
          extractFloat ## s ## Frac( a ) ) ||                                 \
@@ -5349,18 +5390,20 @@ INLINE int float ## s ## _compare_internal( float ## s a, float ## s b,      \
     }                                                                        \
     aSign = extractFloat ## s ## Sign( a );                                  \
     bSign = extractFloat ## s ## Sign( b );                                  \
+    av = float ## s ## _val(a);                                              \
+    bv = float ## s ## _val(b);                                              \
     if ( aSign != bSign ) {                                                  \
-        if ( (bits ## s) ( ( a | b )<<1 ) == 0 ) {                           \
+        if ( (bits ## s) ( ( av | bv )<<1 ) == 0 ) {                         \
             /* zero case */                                                  \
             return float_relation_equal;                                     \
         } else {                                                             \
             return 1 - (2 * aSign);                                          \
         }                                                                    \
     } else {                                                                 \
-        if (a == b) {                                                        \
+        if (av == bv) {                                                      \
             return float_relation_equal;                                     \
         } else {                                                             \
-            return 1 - 2 * (aSign ^ ( a < b ));                              \
+            return 1 - 2 * (aSign ^ ( av < bv ));                            \
         }                                                                    \
     }                                                                        \
 }                                                                            \
@@ -5377,3 +5420,122 @@ int float ## s ## _compare_quiet( float ## s a, float ## s b STATUS_PARAM )  \
 
 COMPARE(32, 0xff)
 COMPARE(64, 0x7ff)
+
+INLINE int float128_compare_internal( float128 a, float128 b,
+                                      int is_quiet STATUS_PARAM )
+{
+    flag aSign, bSign;
+
+    if (( ( extractFloat128Exp( a ) == 0x7fff ) &&
+          ( extractFloat128Frac0( a ) | extractFloat128Frac1( a ) ) ) ||
+        ( ( extractFloat128Exp( b ) == 0x7fff ) &&
+          ( extractFloat128Frac0( b ) | extractFloat128Frac1( b ) ) )) {
+        if (!is_quiet ||
+            float128_is_signaling_nan( a ) ||
+            float128_is_signaling_nan( b ) ) {
+            float_raise( float_flag_invalid STATUS_VAR);
+        }
+        return float_relation_unordered;
+    }
+    aSign = extractFloat128Sign( a );
+    bSign = extractFloat128Sign( b );
+    if ( aSign != bSign ) {
+        if ( ( ( ( a.high | b.high )<<1 ) | a.low | b.low ) == 0 ) {
+            /* zero case */
+            return float_relation_equal;
+        } else {
+            return 1 - (2 * aSign);
+        }
+    } else {
+        if (a.low == b.low && a.high == b.high) {
+            return float_relation_equal;
+        } else {
+            return 1 - 2 * (aSign ^ ( lt128( a.high, a.low, b.high, b.low ) ));
+        }
+    }
+}
+
+int float128_compare( float128 a, float128 b STATUS_PARAM )
+{
+    return float128_compare_internal(a, b, 0 STATUS_VAR);
+}
+
+int float128_compare_quiet( float128 a, float128 b STATUS_PARAM )
+{
+    return float128_compare_internal(a, b, 1 STATUS_VAR);
+}
+
+/* Multiply A by 2 raised to the power N.  */
+float32 float32_scalbn( float32 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int16 aExp;
+    bits32 aSig;
+
+    aSig = extractFloat32Frac( a );
+    aExp = extractFloat32Exp( a );
+    aSign = extractFloat32Sign( a );
+
+    if ( aExp == 0xFF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloat32( aSign, aExp, aSig STATUS_VAR );
+}
+
+float64 float64_scalbn( float64 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int16 aExp;
+    bits64 aSig;
+
+    aSig = extractFloat64Frac( a );
+    aExp = extractFloat64Exp( a );
+    aSign = extractFloat64Sign( a );
+
+    if ( aExp == 0x7FF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloat64( aSign, aExp, aSig STATUS_VAR );
+}
+
+#ifdef FLOATX80
+floatx80 floatx80_scalbn( floatx80 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int16 aExp;
+    bits64 aSig;
+
+    aSig = extractFloatx80Frac( a );
+    aExp = extractFloatx80Exp( a );
+    aSign = extractFloatx80Sign( a );
+
+    if ( aExp == 0x7FF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloatx80( STATUS(floatx80_rounding_precision),
+                                 aSign, aExp, aSig, 0 STATUS_VAR );
+}
+#endif
+
+#ifdef FLOAT128
+float128 float128_scalbn( float128 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int32 aExp;
+    bits64 aSig0, aSig1;
+
+    aSig1 = extractFloat128Frac1( a );
+    aSig0 = extractFloat128Frac0( a );
+    aExp = extractFloat128Exp( a );
+    aSign = extractFloat128Sign( a );
+    if ( aExp == 0x7FFF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloat128( aSign, aExp, aSig0, aSig1, 0 STATUS_VAR );
+
+}
+#endif
diff --git a/fpu/softfloat.h b/fpu/softfloat.h
index f344d2ea5..5f95d061e 100644
--- a/fpu/softfloat.h
+++ b/fpu/softfloat.h
@@ -111,8 +111,31 @@ enum {
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE floating-point types.
 *----------------------------------------------------------------------------*/
+/* Use structures for soft-float types.  This prevents accidentally mixing
+   them with native int/float types.  A sufficiently clever compiler and
+   sane ABI should be able to see though these structs.  However
+   x86/gcc 3.x seems to struggle a bit, so leave them disabled by default.  */
+//#define USE_SOFTFLOAT_STRUCT_TYPES
+#ifdef USE_SOFTFLOAT_STRUCT_TYPES
+typedef struct {
+    uint32_t v;
+} float32;
+/* The cast ensures an error if the wrong type is passed.  */
+#define float32_val(x) (((float32)(x)).v)
+#define make_float32(x) __extension__ ({ float32 f32_val = {x}; f32_val; })
+typedef struct {
+    uint64_t v;
+} float64;
+#define float64_val(x) (((float64)(x)).v)
+#define make_float64(x) __extension__ ({ float64 f64_val = {x}; f64_val; })
+#else
 typedef uint32_t float32;
 typedef uint64_t float64;
+#define float32_val(x) (x)
+#define float64_val(x) (x)
+#define make_float32(x) (x)
+#define make_float64(x) (x)
+#endif
 #ifdef FLOATX80
 typedef struct {
     uint64_t low;
@@ -244,17 +267,20 @@ int float32_compare( float32, float32 STATUS_PARAM );
 int float32_compare_quiet( float32, float32 STATUS_PARAM );
 int float32_is_nan( float32 );
 int float32_is_signaling_nan( float32 );
+float32 float32_scalbn( float32, int STATUS_PARAM );
 
 INLINE float32 float32_abs(float32 a)
 {
-    return a & 0x7fffffff;
+    return make_float32(float32_val(a) & 0x7fffffff);
 }
 
 INLINE float32 float32_chs(float32 a)
 {
-    return a ^ 0x80000000;
+    return make_float32(float32_val(a) ^ 0x80000000);
 }
 
+#define float32_zero make_float32(0)
+
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE double-precision conversion routines.
 *----------------------------------------------------------------------------*/
@@ -295,17 +321,20 @@ int float64_compare( float64, float64 STATUS_PARAM );
 int float64_compare_quiet( float64, float64 STATUS_PARAM );
 int float64_is_nan( float64 a );
 int float64_is_signaling_nan( float64 );
+float64 float64_scalbn( float64, int STATUS_PARAM );
 
 INLINE float64 float64_abs(float64 a)
 {
-    return a & 0x7fffffffffffffffLL;
+    return make_float64(float64_val(a) & 0x7fffffffffffffffLL);
 }
 
 INLINE float64 float64_chs(float64 a)
 {
-    return a ^ 0x8000000000000000LL;
+    return make_float64(float64_val(a) ^ 0x8000000000000000LL);
 }
 
+#define float64_zero make_float64(0)
+
 #ifdef FLOATX80
 
 /*----------------------------------------------------------------------------
@@ -339,6 +368,7 @@ int floatx80_le_quiet( floatx80, floatx80 STATUS_PARAM );
 int floatx80_lt_quiet( floatx80, floatx80 STATUS_PARAM );
 int floatx80_is_nan( floatx80 );
 int floatx80_is_signaling_nan( floatx80 );
+floatx80 floatx80_scalbn( floatx80, int STATUS_PARAM );
 
 INLINE floatx80 floatx80_abs(floatx80 a)
 {
@@ -385,8 +415,11 @@ int float128_lt( float128, float128 STATUS_PARAM );
 int float128_eq_signaling( float128, float128 STATUS_PARAM );
 int float128_le_quiet( float128, float128 STATUS_PARAM );
 int float128_lt_quiet( float128, float128 STATUS_PARAM );
+int float128_compare( float128, float128 STATUS_PARAM );
+int float128_compare_quiet( float128, float128 STATUS_PARAM );
 int float128_is_nan( float128 );
 int float128_is_signaling_nan( float128 );
+float128 float128_scalbn( float128, int STATUS_PARAM );
 
 INLINE float128 float128_abs(float128 a)
 {
diff --git a/gdbstub.c b/gdbstub.c
index bdd2c0410..66a4d5681 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -29,7 +29,10 @@
 
 #include "qemu.h"
 #else
-#include "vl.h"
+#include "qemu-common.h"
+#include "qemu-char.h"
+#include "sysemu.h"
+#include "gdbstub.h"
 #include "qemu-kvm.h"
 #endif
 
@@ -61,7 +64,7 @@ typedef struct GDBState {
     char line_buf[4096];
     int line_buf_index;
     int line_csum;
-    char last_packet[4100];
+    uint8_t last_packet[4100];
     int last_packet_len;
 #ifdef CONFIG_USER_ONLY
     int fd;
@@ -186,7 +189,7 @@ static void hextomem(uint8_t *mem, const char *buf, int len)
 static int put_packet(GDBState *s, char *buf)
 {
     int len, csum, i;
-    char *p;
+    uint8_t *p;
 
 #ifdef DEBUG_GDB
     printf("reply='%s'\n", buf);
@@ -207,7 +210,7 @@ static int put_packet(GDBState *s, char *buf)
         *(p++) = tohex((csum) & 0xf);
 
         s->last_packet_len = p - s->last_packet;
-        put_buffer(s, s->last_packet, s->last_packet_len);
+        put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 
 #ifdef CONFIG_USER_ONLY
         i = get_char(s);
@@ -360,8 +363,56 @@ static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 
 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 {
-    uint32_t *registers = (uint32_t *)mem_buf;
     int i, fpus;
+    uint32_t *registers = (uint32_t *)mem_buf;
+
+#ifdef TARGET_X86_64
+    /* This corresponds with amd64_register_info[] in gdb/amd64-tdep.c */
+    uint64_t *registers64 = (uint64_t *)mem_buf;
+
+    if (env->hflags & HF_CS64_MASK) {
+        registers64[0] = tswap64(env->regs[R_EAX]);
+        registers64[1] = tswap64(env->regs[R_EBX]);
+        registers64[2] = tswap64(env->regs[R_ECX]);
+        registers64[3] = tswap64(env->regs[R_EDX]);
+        registers64[4] = tswap64(env->regs[R_ESI]);
+        registers64[5] = tswap64(env->regs[R_EDI]);
+        registers64[6] = tswap64(env->regs[R_EBP]);
+        registers64[7] = tswap64(env->regs[R_ESP]);
+        for(i = 8; i < 16; i++) {
+            registers64[i] = tswap64(env->regs[i]);
+        }
+        registers64[16] = tswap64(env->eip);
+
+        registers = (uint32_t *)&registers64[17];
+        registers[0] = tswap32(env->eflags);
+        registers[1] = tswap32(env->segs[R_CS].selector);
+        registers[2] = tswap32(env->segs[R_SS].selector);
+        registers[3] = tswap32(env->segs[R_DS].selector);
+        registers[4] = tswap32(env->segs[R_ES].selector);
+        registers[5] = tswap32(env->segs[R_FS].selector);
+        registers[6] = tswap32(env->segs[R_GS].selector);
+        /* XXX: convert floats */
+        for(i = 0; i < 8; i++) {
+            memcpy(mem_buf + 16 * 8 + 7 * 4 + i * 10, &env->fpregs[i], 10);
+        }
+        registers[27] = tswap32(env->fpuc); /* fctrl */
+        fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
+        registers[28] = tswap32(fpus); /* fstat */
+        registers[29] = 0; /* ftag */
+        registers[30] = 0; /* fiseg */
+        registers[31] = 0; /* fioff */
+        registers[32] = 0; /* foseg */
+        registers[33] = 0; /* fooff */
+        registers[34] = 0; /* fop */
+        for(i = 0; i < 16; i++) {
+            memcpy(mem_buf + 16 * 8 + 35 * 4 + i * 16, &env->xmm_regs[i], 16);
+        }
+        registers[99] = tswap32(env->mxcsr);
+
+        return 8 * 17 + 4 * 7 + 10 * 8 + 4 * 8 + 16 * 16 + 4;
+    }
+#endif
 
     for(i = 0; i < 8; i++) {
         registers[i] = env->regs[i];
@@ -435,7 +486,7 @@ static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
     }
     /* nip, msr, ccr, lnk, ctr, xer, mq */
     registers[96] = tswapl(env->nip);
-    registers[97] = tswapl(do_load_msr(env));
+    registers[97] = tswapl(env->msr);
     tmp = 0;
     for (i = 0; i < 8; i++)
         tmp |= env->crf[i] << (32 - ((i + 1) * 4));
@@ -464,7 +515,7 @@ static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
     }
     /* nip, msr, ccr, lnk, ctr, xer, mq */
     env->nip = tswapl(registers[96]);
-    do_store_msr(env, tswapl(registers[97]));
+    ppc_store_msr(env, tswapl(registers[97]));
     registers[98] = tswapl(registers[98]);
     for (i = 0; i < 8; i++)
         env->crf[i] = (registers[98] >> (32 - ((i + 1) * 4))) & 0xF;
@@ -698,7 +749,7 @@ static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
         ptr += sizeof(target_ulong);
       }
 
-    *(target_ulong *)ptr = tswapl(env->CP0_Status);
+    *(target_ulong *)ptr = (int32_t)tswap32(env->CP0_Status);
     ptr += sizeof(target_ulong);
 
     *(target_ulong *)ptr = tswapl(env->LO[0][env->current_tc]);
@@ -710,7 +761,7 @@ static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
     *(target_ulong *)ptr = tswapl(env->CP0_BadVAddr);
     ptr += sizeof(target_ulong);
 
-    *(target_ulong *)ptr = tswapl(env->CP0_Cause);
+    *(target_ulong *)ptr = (int32_t)tswap32(env->CP0_Cause);
     ptr += sizeof(target_ulong);
 
     *(target_ulong *)ptr = tswapl(env->PC[env->current_tc]);
@@ -720,19 +771,34 @@ static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
       {
         for (i = 0; i < 32; i++)
           {
-            *(target_ulong *)ptr = tswapl(env->fpu->fpr[i].fs[FP_ENDIAN_IDX]);
+            if (env->CP0_Status & (1 << CP0St_FR))
+              *(target_ulong *)ptr = tswapl(env->fpu->fpr[i].d);
+            else
+              *(target_ulong *)ptr = tswap32(env->fpu->fpr[i].w[FP_ENDIAN_IDX]);
             ptr += sizeof(target_ulong);
           }
 
-        *(target_ulong *)ptr = tswapl(env->fpu->fcr31);
+        *(target_ulong *)ptr = (int32_t)tswap32(env->fpu->fcr31);
         ptr += sizeof(target_ulong);
 
-        *(target_ulong *)ptr = tswapl(env->fpu->fcr0);
+        *(target_ulong *)ptr = (int32_t)tswap32(env->fpu->fcr0);
+        ptr += sizeof(target_ulong);
+      }
+
+    /* "fp", pseudo frame pointer. Not yet implemented in gdb. */
+    *(target_ulong *)ptr = 0;
+    ptr += sizeof(target_ulong);
+
+    /* Registers for embedded use, we just pad them. */
+    for (i = 0; i < 16; i++)
+      {
+        *(target_ulong *)ptr = 0;
         ptr += sizeof(target_ulong);
       }
 
-    /* 32 FP registers, fsr, fir, fp.  Not yet implemented.  */
-    /* what's 'fp' mean here?  */
+    /* Processor ID. */
+    *(target_ulong *)ptr = (int32_t)tswap32(env->CP0_PRid);
+    ptr += sizeof(target_ulong);
 
     return ptr - mem_buf;
 }
@@ -782,15 +848,17 @@ static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
       {
         for (i = 0; i < 32; i++)
           {
-            env->fpu->fpr[i].fs[FP_ENDIAN_IDX] = tswapl(*(target_ulong *)ptr);
+            if (env->CP0_Status & (1 << CP0St_FR))
+              env->fpu->fpr[i].d = tswapl(*(target_ulong *)ptr);
+            else
+              env->fpu->fpr[i].w[FP_ENDIAN_IDX] = tswapl(*(target_ulong *)ptr);
             ptr += sizeof(target_ulong);
           }
 
-        env->fpu->fcr31 = tswapl(*(target_ulong *)ptr) & 0x0183FFFF;
+        env->fpu->fcr31 = tswapl(*(target_ulong *)ptr) & 0xFF83FFFF;
         ptr += sizeof(target_ulong);
 
-        env->fpu->fcr0 = tswapl(*(target_ulong *)ptr);
-        ptr += sizeof(target_ulong);
+        /* The remaining registers are assumed to be read-only. */
 
         /* set rounding mode */
         RESTORE_ROUNDING_MODE;
@@ -863,6 +931,66 @@ static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
   for (i = 0; i < 8; i++) LOAD(env->gregs[i]);
   for (i = 0; i < 8; i++) LOAD(env->gregs[i + 16]);
 }
+#elif defined (TARGET_CRIS)
+
+static int cris_save_32 (unsigned char *d, uint32_t value)
+{
+	*d++ = (value);
+	*d++ = (value >>= 8);
+	*d++ = (value >>= 8);
+	*d++ = (value >>= 8);
+	return 4;
+}
+static int cris_save_16 (unsigned char *d, uint32_t value)
+{
+	*d++ = (value);
+	*d++ = (value >>= 8);
+	return 2;
+}
+static int cris_save_8 (unsigned char *d, uint32_t value)
+{
+	*d++ = (value);
+	return 1;
+}
+
+/* FIXME: this will bug on archs not supporting unaligned word accesses.  */
+static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
+{
+  uint8_t *ptr = mem_buf;
+  uint8_t srs;
+  int i;
+
+  for (i = 0; i < 16; i++)
+	  ptr += cris_save_32 (ptr, env->regs[i]);
+
+  srs = env->pregs[SR_SRS];
+
+  ptr += cris_save_8 (ptr, env->pregs[0]);
+  ptr += cris_save_8 (ptr, env->pregs[1]);
+  ptr += cris_save_32 (ptr, env->pregs[2]);
+  ptr += cris_save_8 (ptr, srs);
+  ptr += cris_save_16 (ptr, env->pregs[4]);
+
+  for (i = 5; i < 16; i++)
+	  ptr += cris_save_32 (ptr, env->pregs[i]);
+
+  ptr += cris_save_32 (ptr, env->pc);
+
+  for (i = 0; i < 16; i++)
+	  ptr += cris_save_32 (ptr, env->sregs[srs][i]);
+
+  return ((uint8_t *)ptr - mem_buf);
+}
+
+static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
+{
+  uint32_t *ptr = (uint32_t *)mem_buf;
+  int i;
+
+#define LOAD(x) (x)=*ptr++;
+  for (i = 0; i < 16; i++) LOAD(env->regs[i]);
+  LOAD (env->pc);
+}
 #else
 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 {
@@ -880,7 +1008,7 @@ static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
     const char *p;
     int ch, reg_size, type;
     char buf[4096];
-    uint8_t mem_buf[2000];
+    uint8_t mem_buf[4096];
     uint32_t *registers;
     target_ulong addr, len;
 
@@ -914,6 +1042,8 @@ static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
             env->pc = addr;
 #elif defined (TARGET_MIPS)
             env->PC[env->current_tc] = addr;
+#elif defined (TARGET_CRIS)
+            env->pc = addr;
 #endif
         }
 #ifdef CONFIG_USER_ONLY
@@ -941,6 +1071,8 @@ static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
             env->pc = addr;
 #elif defined (TARGET_MIPS)
             env->PC[env->current_tc] = addr;
+#elif defined (TARGET_CRIS)
+            env->pc = addr;
 #endif
         }
         cpu_single_step(env, 1);
@@ -1070,7 +1202,8 @@ static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
             TaskState *ts = env->opaque;
 
             sprintf(buf,
-                    "Text=" TARGET_FMT_lx ";Data=" TARGET_FMT_lx ";Bss=" TARGET_FMT_lx,
+                    "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
+                    ";Bss=" TARGET_ABI_FMT_lx,
                     ts->info->code_offset,
                     ts->info->data_offset,
                     ts->info->data_offset);
@@ -1193,7 +1326,7 @@ static void gdb_read_byte(GDBState *s, int ch)
 {
     CPUState *env = s->env;
     int i, csum;
-    char reply[1];
+    uint8_t reply;
 
 #ifndef CONFIG_USER_ONLY
     if (s->last_packet_len) {
@@ -1203,7 +1336,7 @@ static void gdb_read_byte(GDBState *s, int ch)
 #ifdef DEBUG_GDB
             printf("Got NACK, retransmitting\n");
 #endif
-            put_buffer(s, s->last_packet, s->last_packet_len);
+            put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
         }
 #ifdef DEBUG_GDB
         else if (ch == '+')
@@ -1251,12 +1384,12 @@ static void gdb_read_byte(GDBState *s, int ch)
                 csum += s->line_buf[i];
             }
             if (s->line_csum != (csum & 0xff)) {
-                reply[0] = '-';
-                put_buffer(s, reply, 1);
+                reply = '-';
+                put_buffer(s, &reply, 1);
                 s->state = RS_IDLE;
             } else {
-                reply[0] = '+';
-                put_buffer(s, reply, 1);
+                reply = '+';
+                put_buffer(s, &reply, 1);
                 s->state = gdb_handle_packet(s, env, s->line_buf);
             }
             break;
diff --git a/host-utils.c b/host-utils.c
index 10341063f..f92c3396c 100644
--- a/host-utils.c
+++ b/host-utils.c
@@ -1,6 +1,7 @@
 /*
  * Utility compute operations used by translated code.
  *
+ * Copyright (c) 2003 Fabrice Bellard
  * Copyright (c) 2007 Aurelien Jarno
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -22,54 +23,82 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "exec.h"
+#include "host-utils.h"
 
-/* Signed 64x64 -> 128 multiplication */
+//#define DEBUG_MULDIV
+
+/* Long integer helpers */
+#if !defined(__x86_64__)
+static void add128 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
+{
+    *plow += a;
+    /* carry test */
+    if (*plow < a)
+        (*phigh)++;
+    *phigh += b;
+}
 
-void muls64(int64_t *phigh, int64_t *plow, int64_t a, int64_t b)
+static void neg128 (uint64_t *plow, uint64_t *phigh)
 {
-#if defined(__x86_64__)
-    __asm__ ("imul %0\n\t"
-             : "=d" (*phigh), "=a" (*plow)
-             : "a" (a), "0" (b)
-             );
-#else
-    int64_t ph;
-    uint64_t pm1, pm2, pl;
+    *plow = ~*plow;
+    *phigh = ~*phigh;
+    add128(plow, phigh, 1, 0);
+}
+
+static void mul64 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
+{
+    uint32_t a0, a1, b0, b1;
+    uint64_t v;
 
-    pl = (uint64_t)((uint32_t)a) * (uint64_t)((uint32_t)b);
-    pm1 = (a >> 32) * (uint32_t)b;
-    pm2 = (uint32_t)a * (b >> 32);
-    ph = (a >> 32) * (b >> 32);
+    a0 = a;
+    a1 = a >> 32;
 
-    ph += (int64_t)pm1 >> 32;
-    pm1 = (uint64_t)((uint32_t)pm1) + pm2 + (pl >> 32);
+    b0 = b;
+    b1 = b >> 32;
 
-    *phigh = ph + ((int64_t)pm1 >> 32);
-    *plow = (pm1 << 32) + (uint32_t)pl;
-#endif
+    v = (uint64_t)a0 * (uint64_t)b0;
+    *plow = v;
+    *phigh = 0;
+
+    v = (uint64_t)a0 * (uint64_t)b1;
+    add128(plow, phigh, v << 32, v >> 32);
+
+    v = (uint64_t)a1 * (uint64_t)b0;
+    add128(plow, phigh, v << 32, v >> 32);
+
+    v = (uint64_t)a1 * (uint64_t)b1;
+    *phigh += v;
 }
 
 /* Unsigned 64x64 -> 128 multiplication */
-void mulu64(uint64_t *phigh, uint64_t *plow, uint64_t a, uint64_t b)
+void mulu64 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
 {
-#if defined(__x86_64__)
-    __asm__ ("mul %0\n\t"
-             : "=d" (*phigh), "=a" (*plow)
-             : "a" (a), "0" (b)
-            );
-#else
-    uint64_t ph, pm1, pm2, pl;
-
-    pl = (uint64_t)((uint32_t)a) * (uint64_t)((uint32_t)b);
-    pm1 = (a >> 32) * (uint32_t)b;
-    pm2 = (uint32_t)a * (b >> 32);
-    ph = (a >> 32) * (b >> 32);
+    mul64(plow, phigh, a, b);
+#if defined(DEBUG_MULDIV)
+    printf("mulu64: 0x%016llx * 0x%016llx = 0x%016llx%016llx\n",
+           a, b, *phigh, *plow);
+#endif
+}
 
-    ph += pm1 >> 32;
-    pm1 = (uint64_t)((uint32_t)pm1) + pm2 + (pl >> 32);
+/* Signed 64x64 -> 128 multiplication */
+void muls64 (uint64_t *plow, uint64_t *phigh, int64_t a, int64_t b)
+{
+    int sa, sb;
 
-    *phigh = ph + (pm1 >> 32);
-    *plow = (pm1 << 32) + (uint32_t)pl;
+    sa = (a < 0);
+    if (sa)
+        a = -a;
+    sb = (b < 0);
+    if (sb)
+        b = -b;
+    mul64(plow, phigh, a, b);
+    if (sa ^ sb) {
+        neg128(plow, phigh);
+    }
+#if defined(DEBUG_MULDIV)
+    printf("muls64: 0x%016llx * 0x%016llx = 0x%016llx%016llx\n",
+           a, b, *phigh, *plow);
 #endif
 }
+#endif /* !defined(__x86_64__) */
diff --git a/host-utils.h b/host-utils.h
new file mode 100644
index 000000000..dafd0329c
--- /dev/null
+++ b/host-utils.h
@@ -0,0 +1,202 @@
+/*
+ * Utility compute operations used by translated code.
+ *
+ * Copyright (c) 2007 Thiemo Seufer
+ * Copyright (c) 2007 Jocelyn Mayer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#if defined(__x86_64__)
+#define __HAVE_FAST_MULU64__
+static always_inline void mulu64 (uint64_t *plow, uint64_t *phigh,
+                                  uint64_t a, uint64_t b)
+{
+    __asm__ ("mul %0\n\t"
+             : "=d" (*phigh), "=a" (*plow)
+             : "a" (a), "0" (b));
+}
+#define __HAVE_FAST_MULS64__
+static always_inline void muls64 (uint64_t *plow, uint64_t *phigh,
+                                  int64_t a, int64_t b)
+{
+    __asm__ ("imul %0\n\t"
+             : "=d" (*phigh), "=a" (*plow)
+             : "a" (a), "0" (b));
+}
+#else
+void muls64(uint64_t *phigh, uint64_t *plow, int64_t a, int64_t b);
+void mulu64(uint64_t *phigh, uint64_t *plow, uint64_t a, uint64_t b);
+#endif
+
+/* Note that some of those functions may end up calling libgcc functions,
+   depending on the host machine. It is up to the target emulation to
+   cope with that. */
+
+/* Binary search for leading zeros.  */
+
+static always_inline int clz32(uint32_t val)
+{
+    int cnt = 0;
+
+    if (!(val & 0xFFFF0000U)) {
+        cnt += 16;
+        val <<= 16;
+    }
+    if (!(val & 0xFF000000U)) {
+        cnt += 8;
+        val <<= 8;
+    }
+    if (!(val & 0xF0000000U)) {
+        cnt += 4;
+        val <<= 4;
+    }
+    if (!(val & 0xC0000000U)) {
+        cnt += 2;
+        val <<= 2;
+    }
+    if (!(val & 0x80000000U)) {
+        cnt++;
+        val <<= 1;
+    }
+    if (!(val & 0x80000000U)) {
+        cnt++;
+    }
+    return cnt;
+}
+
+static always_inline int clo32(uint32_t val)
+{
+    return clz32(~val);
+}
+
+static always_inline int clz64(uint64_t val)
+{
+    int cnt = 0;
+
+    if (!(val >> 32)) {
+        cnt += 32;
+    } else {
+        val >>= 32;
+    }
+
+    return cnt + clz32(val);
+}
+
+static always_inline int clo64(uint64_t val)
+{
+    return clz64(~val);
+}
+
+static always_inline int ctz32 (uint32_t val)
+{
+    int cnt;
+
+    cnt = 0;
+    if (!(val & 0x0000FFFFUL)) {
+         cnt += 16;
+        val >>= 16;
+     }
+    if (!(val & 0x000000FFUL)) {
+         cnt += 8;
+        val >>= 8;
+     }
+    if (!(val & 0x0000000FUL)) {
+         cnt += 4;
+        val >>= 4;
+     }
+    if (!(val & 0x00000003UL)) {
+         cnt += 2;
+        val >>= 2;
+     }
+    if (!(val & 0x00000001UL)) {
+         cnt++;
+        val >>= 1;
+     }
+    if (!(val & 0x00000001UL)) {
+         cnt++;
+     }
+
+     return cnt;
+ }
+ 
+static always_inline int cto32 (uint32_t val)
+ {
+    return ctz32(~val);
+}
+
+static always_inline int ctz64 (uint64_t val)
+{
+    int cnt;
+
+    cnt = 0;
+    if (!((uint32_t)val)) {
+        cnt += 32;
+        val >>= 32;
+    }
+
+    return cnt + ctz32(val);
+}
+
+static always_inline int cto64 (uint64_t val)
+{
+    return ctz64(~val);
+}
+
+static always_inline int ctpop8 (uint8_t val)
+{
+    val = (val & 0x55) + ((val >> 1) & 0x55);
+    val = (val & 0x33) + ((val >> 2) & 0x33);
+    val = (val & 0x0f) + ((val >> 4) & 0x0f);
+
+    return val;
+}
+
+static always_inline int ctpop16 (uint16_t val)
+{
+    val = (val & 0x5555) + ((val >> 1) & 0x5555);
+    val = (val & 0x3333) + ((val >> 2) & 0x3333);
+    val = (val & 0x0f0f) + ((val >> 4) & 0x0f0f);
+    val = (val & 0x00ff) + ((val >> 8) & 0x00ff);
+
+    return val;
+}
+
+static always_inline int ctpop32 (uint32_t val)
+{
+    val = (val & 0x55555555) + ((val >>  1) & 0x55555555);
+    val = (val & 0x33333333) + ((val >>  2) & 0x33333333);
+    val = (val & 0x0f0f0f0f) + ((val >>  4) & 0x0f0f0f0f);
+    val = (val & 0x00ff00ff) + ((val >>  8) & 0x00ff00ff);
+    val = (val & 0x0000ffff) + ((val >> 16) & 0x0000ffff);
+
+    return val;
+}
+
+static always_inline int ctpop64 (uint64_t val)
+{
+    val = (val & 0x5555555555555555ULL) + ((val >>  1) & 0x5555555555555555ULL);
+    val = (val & 0x3333333333333333ULL) + ((val >>  2) & 0x3333333333333333ULL);
+    val = (val & 0x0f0f0f0f0f0f0f0fULL) + ((val >>  4) & 0x0f0f0f0f0f0f0f0fULL);
+    val = (val & 0x00ff00ff00ff00ffULL) + ((val >>  8) & 0x00ff00ff00ff00ffULL);
+    val = (val & 0x0000ffff0000ffffULL) + ((val >> 16) & 0x0000ffff0000ffffULL);
+    val = (val & 0x00000000ffffffffULL) + ((val >> 32) & 0x00000000ffffffffULL);
+
+    return val;
+ }
diff --git a/hw/acpi.c b/hw/acpi.c
index 37fadaab6..a2efd9c3c 100644
--- a/hw/acpi.c
+++ b/hw/acpi.c
@@ -16,7 +16,13 @@
  * License along with this library; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-#include "vl.h"
+#include "hw.h"
+#include "pc.h"
+#include "pci.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
+#include "i2c.h"
+#include "smbus.h"
 
 //#define DEBUG
 
@@ -400,7 +406,7 @@ static void pm_io_space_update(PIIX4PMState *s)
 
     if (s->dev.config[0x80] & 1) {
         pm_io_base = le32_to_cpu(*(uint32_t *)(s->dev.config + 0x40));
-        pm_io_base &= 0xfffe;
+        pm_io_base &= 0xffc0;
 
         /* XXX: need to improve memory and ioport allocation */
 #if defined(DEBUG)
@@ -433,7 +439,7 @@ static void pm_save(QEMUFile* f,void *opaque)
     qemu_put_8s(f, &s->apmc);
     qemu_put_8s(f, &s->apms);
     qemu_put_timer(f, s->tmr_timer);
-    qemu_put_be64s(f, &s->tmr_overflow_time);
+    qemu_put_be64(f, s->tmr_overflow_time);
 }
 
 static int pm_load(QEMUFile* f,void* opaque,int version_id)
@@ -454,7 +460,7 @@ static int pm_load(QEMUFile* f,void* opaque,int version_id)
     qemu_get_8s(f, &s->apmc);
     qemu_get_8s(f, &s->apms);
     qemu_get_timer(f, s->tmr_timer);
-    qemu_get_be64s(f, &s->tmr_overflow_time);
+    s->tmr_overflow_time=qemu_get_be64(f);
 
     pm_io_space_update(s);
 
@@ -474,6 +480,8 @@ i2c_bus *piix4_pm_init(PCIBus *bus, int devfn, uint32_t smb_io_base)
     pci_conf[0x01] = 0x80;
     pci_conf[0x02] = 0x13;
     pci_conf[0x03] = 0x71;
+    pci_conf[0x06] = 0x80;
+    pci_conf[0x07] = 0x02;
     pci_conf[0x08] = 0x00; // revision number
     pci_conf[0x09] = 0x00;
     pci_conf[0x0a] = 0x80; // other bridge device
diff --git a/hw/adb.c b/hw/adb.c
index 1e43792b5..5c0d6d5fd 100644
--- a/hw/adb.c
+++ b/hw/adb.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "ppc_mac.h"
+#include "console.h"
 
 /* ADB commands */
 #define ADB_BUSRESET		0x00
diff --git a/hw/adlib.c b/hw/adlib.c
index 805365e70..1376db919 100644
--- a/hw/adlib.c
+++ b/hw/adlib.c
@@ -21,11 +21,20 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
+
 #include <assert.h>
-#include "vl.h"
+#include "hw.h"
+#include "audiodev.h"
+#include "audio/audio.h"
+
+//#define DEBUG
 
 #define ADLIB_KILL_TIMERS 1
 
+#ifdef DEBUG
+#include "qemu-timer.h"
+#endif
+
 #define dolog(...) AUD_log ("adlib", __VA_ARGS__)
 #ifdef DEBUG
 #define ldebug(...) dolog (__VA_ARGS__)
diff --git a/hw/ads7846.c b/hw/ads7846.c
index 2f891b125..578bb5493 100644
--- a/hw/ads7846.c
+++ b/hw/ads7846.c
@@ -1,5 +1,5 @@
 /*
- * TI ADS7846 chip emulation.
+ * TI ADS7846 / TSC2046 chip emulation.
  *
  * Copyright (c) 2006 Openedhand Ltd.
  * Written by Andrzej Zaborowski <balrog@zabor.org>
@@ -7,7 +7,9 @@
  * This code is licensed under the GNU GPL v2.
  */
 
-#include <vl.h>
+#include "hw.h"
+#include "devices.h"
+#include "console.h"
 
 struct ads7846_state_s {
     qemu_irq interrupt;
diff --git a/hw/alpha_palcode.c b/hw/alpha_palcode.c
index da2d9ad06..3bd2c5434 100644
--- a/hw/alpha_palcode.c
+++ b/hw/alpha_palcode.c
@@ -811,12 +811,14 @@ static int get_page_bits (CPUState *env)
 
 static int get_pte (uint64_t *pfnp, int *zbitsp, int *protp,
                     uint64_t ptebase, int page_bits, uint64_t level,
-                    int is_user, int rw)
+                    int mmu_idx, int rw)
 {
     uint64_t pteaddr, pte, pfn;
     uint8_t gh;
-    int ure, uwe, kre, kwe, foE, foR, foW, v, ret, ar;
+    int ure, uwe, kre, kwe, foE, foR, foW, v, ret, ar, is_user;
 
+    /* XXX: TOFIX */
+    is_user = mmu_idx == MMU_USER_IDX;
     pteaddr = (ptebase << page_bits) + (8 * level);
     pte = ldq_raw(pteaddr);
     /* Decode all interresting PTE fields */
@@ -871,7 +873,7 @@ static int get_pte (uint64_t *pfnp, int *zbitsp, int *protp,
 
 static int paddr_from_pte (uint64_t *paddr, int *zbitsp, int *prot,
                            uint64_t ptebase, int page_bits,
-                           uint64_t vaddr, int is_user, int rw)
+                           uint64_t vaddr, int mmu_idx, int rw)
 {
     uint64_t pfn, page_mask, lvl_mask, level1, level2, level3;
     int lvl_bits, ret;
@@ -909,7 +911,7 @@ static int paddr_from_pte (uint64_t *paddr, int *zbitsp, int *prot,
         break;
     }
     /* Level 3 PTE */
-    ret = get_pte(&pfn, zbitsp, prot, pfn, page_bits, level3, is_user, rw);
+    ret = get_pte(&pfn, zbitsp, prot, pfn, page_bits, level3, mmu_idx, rw);
     if (ret & 0x1) {
         /* Translation not valid */
         ret = 1;
@@ -943,7 +945,7 @@ static int paddr_from_pte (uint64_t *paddr, int *zbitsp, int *prot,
 
 static int virtual_to_physical (CPUState *env, uint64_t *physp,
                                 int *zbitsp, int *protp,
-                                uint64_t virtual, int is_user, int rw)
+                                uint64_t virtual, int mmu_idx, int rw)
 {
     uint64_t sva, ptebase;
     int seg, page_bits, ret;
@@ -961,16 +963,16 @@ static int virtual_to_physical (CPUState *env, uint64_t *physp,
     case 0:
         /* seg1: 3 levels of PTE */
         ret = paddr_from_pte(physp, zbitsp, protp, ptebase, page_bits,
-                             virtual, is_user, rw);
+                             virtual, mmu_idx, rw);
         break;
     case 1:
         /* seg1: 2 levels of PTE */
         ret = paddr_from_pte(physp, zbitsp, protp, ptebase, page_bits,
-                             virtual, is_user, rw);
+                             virtual, mmu_idx, rw);
         break;
     case 2:
         /* kernel segment */
-        if (is_user) {
+        if (mmu_idx != 0) {
             ret = 2;
         } else {
             *physp = virtual;
@@ -979,7 +981,7 @@ static int virtual_to_physical (CPUState *env, uint64_t *physp,
     case 3:
         /* seg1: TB mapped */
         ret = paddr_from_pte(physp, zbitsp, protp, ptebase, page_bits,
-                             virtual, is_user, rw);
+                             virtual, mmu_idx, rw);
         break;
     default:
         ret = 1;
@@ -991,7 +993,7 @@ static int virtual_to_physical (CPUState *env, uint64_t *physp,
 
 /* XXX: code provision */
 int cpu_ppc_handle_mmu_fault (CPUState *env, uint32_t address, int rw,
-                              int is_user, int is_softmmu)
+                              int mmu_idx, int is_softmmu)
 {
     uint64_t physical, page_size, end;
     int prot, zbits, ret;
@@ -1000,7 +1002,7 @@ int cpu_ppc_handle_mmu_fault (CPUState *env, uint32_t address, int rw,
         ret = 2;
     } else {
         ret = virtual_to_physical(env, &physical, &zbits, &prot,
-                                  address, is_user, rw);
+                                  address, mmu_idx, rw);
     }
     switch (ret) {
     case 0:
@@ -1009,7 +1011,7 @@ int cpu_ppc_handle_mmu_fault (CPUState *env, uint32_t address, int rw,
         address &= ~(page_size - 1);
         for (end = physical + page_size; physical < end; physical += 0x1000) {
             ret = tlb_set_page(env, address, physical, prot,
-                               is_user, is_softmmu);
+                               mmu_idx, is_softmmu);
             address += 0x1000;
         }
         break;
diff --git a/hw/an5206.c b/hw/an5206.c
index 94ecccb3e..52be63b77 100644
--- a/hw/an5206.c
+++ b/hw/an5206.c
@@ -6,7 +6,10 @@
  * This code is licenced under the GPL
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "mcf.h"
+#include "sysemu.h"
+#include "boards.h"
 
 #define KERNEL_LOAD_ADDR 0x10000
 #define AN5206_MBAR_ADDR 0x10000000
@@ -27,8 +30,8 @@ void DMA_run (void)
 
 /* Board init.  */
 
-static void an5206_init(int ram_size, int vga_ram_size, int boot_device,
-                     DisplayState *ds, const char **fd_filename, int snapshot,
+static void an5206_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
                      const char *kernel_filename, const char *kernel_cmdline,
                      const char *initrd_filename, const char *cpu_model)
 {
@@ -37,10 +40,10 @@ static void an5206_init(int ram_size, int vga_ram_size, int boot_device,
     uint64_t elf_entry;
     target_ulong entry;
 
-    env = cpu_init();
     if (!cpu_model)
         cpu_model = "m5206";
-    if (cpu_m68k_set_model(env, cpu_model)) {
+    env = cpu_init(cpu_model);
+    if (!env) {
         cpu_abort(env, "Unable to find m68k CPU definition\n");
     }
 
diff --git a/hw/apb_pci.c b/hw/apb_pci.c
index 1de335384..73dcf5c13 100644
--- a/hw/apb_pci.c
+++ b/hw/apb_pci.c
@@ -26,7 +26,8 @@
    Ultrasparc PCI host is called the PCI Bus Module (PBM).  The APB is
    the secondary PCI bridge.  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pci.h"
 typedef target_phys_addr_t pci_addr_t;
 #include "pci_host.h"
 
@@ -70,7 +71,7 @@ static CPUReadMemoryFunc *pci_apb_config_read[] = {
 };
 
 static void apb_config_writel (void *opaque, target_phys_addr_t addr,
-			       uint32_t val)
+                               uint32_t val)
 {
     //PCIBus *s = opaque;
 
@@ -80,14 +81,14 @@ static void apb_config_writel (void *opaque, target_phys_addr_t addr,
     case 0x18: // AFAR
     case 0x20: // Diagnostic
     case 0x28: // Target address space
-	// XXX
+        // XXX
     default:
-	break;
+        break;
     }
 }
 
 static uint32_t apb_config_readl (void *opaque,
-				  target_phys_addr_t addr)
+                                  target_phys_addr_t addr)
 {
     //PCIBus *s = opaque;
     uint32_t val;
@@ -98,10 +99,10 @@ static uint32_t apb_config_readl (void *opaque,
     case 0x18: // AFAR
     case 0x20: // Diagnostic
     case 0x28: // Target address space
-	// XXX
+        // XXX
     default:
-	val = 0;
-	break;
+        val = 0;
+        break;
     }
     return val;
 }
@@ -222,7 +223,7 @@ PCIBus *pci_apb_init(target_phys_addr_t special_base,
     pci_mem_config = cpu_register_io_memory(0, pci_apb_config_read,
                                             pci_apb_config_write, s);
     apb_config = cpu_register_io_memory(0, apb_config_read,
-					apb_config_write, s);
+                                        apb_config_write, s);
     pci_mem_data = cpu_register_io_memory(0, pci_apb_read,
                                           pci_apb_write, s);
     pci_ioport = cpu_register_io_memory(0, pci_apb_ioread,
diff --git a/hw/apic.c b/hw/apic.c
index 55ec7f128..a47c36637 100644
--- a/hw/apic.c
+++ b/hw/apic.c
@@ -17,7 +17,9 @@
  * License along with this library; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-#include "vl.h"
+#include "hw.h"
+#include "pc.h"
+#include "qemu-timer.h"
 
 #ifdef USE_KVM
 #include "qemu-kvm.h"
@@ -864,10 +866,10 @@ static void apic_save(QEMUFile *f, void *opaque)
     qemu_put_be32s(f, &s->icr[0]);
     qemu_put_be32s(f, &s->icr[1]);
     qemu_put_be32s(f, &s->divide_conf);
-    qemu_put_be32s(f, &s->count_shift);
+    qemu_put_be32(f, s->count_shift);
     qemu_put_be32s(f, &s->initial_count);
-    qemu_put_be64s(f, &s->initial_count_load_time);
-    qemu_put_be64s(f, &s->next_time);
+    qemu_put_be64(f, s->initial_count_load_time);
+    qemu_put_be64(f, s->next_time);
 
     qemu_put_timer(f, s->timer);
 }
@@ -900,10 +902,10 @@ static int apic_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_be32s(f, &s->icr[0]);
     qemu_get_be32s(f, &s->icr[1]);
     qemu_get_be32s(f, &s->divide_conf);
-    qemu_get_be32s(f, &s->count_shift);
+    s->count_shift=qemu_get_be32(f);
     qemu_get_be32s(f, &s->initial_count);
-    qemu_get_be64s(f, &s->initial_count_load_time);
-    qemu_get_be64s(f, &s->next_time);
+    s->initial_count_load_time=qemu_get_be64(f);
+    s->next_time=qemu_get_be64(f);
 
     if (version_id >= 2)
         qemu_get_timer(f, s->timer);
diff --git a/hw/arm-misc.h b/hw/arm-misc.h
new file mode 100644
index 000000000..7914ff117
--- /dev/null
+++ b/hw/arm-misc.h
@@ -0,0 +1,37 @@
+/*
+ * Misc ARM declarations
+ *
+ * Copyright (c) 2006 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the LGPL.
+ *
+ */
+
+#ifndef ARM_MISC_H
+#define ARM_MISC_H 1
+
+/* The CPU is also modeled as an interrupt controller.  */
+#define ARM_PIC_CPU_IRQ 0
+#define ARM_PIC_CPU_FIQ 1
+qemu_irq *arm_pic_init_cpu(CPUState *env);
+
+/* armv7m.c */
+qemu_irq *armv7m_init(int flash_size, int sram_size,
+                      const char *kernel_filename, const char *cpu_model);
+
+/* arm_boot.c */
+
+void arm_load_kernel(CPUState *env, int ram_size, const char *kernel_filename,
+                     const char *kernel_cmdline, const char *initrd_filename,
+                     int board_id, target_phys_addr_t loader_start);
+
+/* armv7m_nvic.c */
+int system_clock_scale;
+qemu_irq *armv7m_nvic_init(CPUState *env);
+
+/* stellaris_enent.c */
+void stellaris_enet_init(NICInfo *nd, uint32_t base, qemu_irq irq);
+
+#endif /* !ARM_MISC_H */
+
diff --git a/hw/arm_boot.c b/hw/arm_boot.c
index 7a99b4175..8335e69a7 100644
--- a/hw/arm_boot.c
+++ b/hw/arm_boot.c
@@ -1,13 +1,15 @@
 /*
  * ARM kernel loader.
  *
- * Copyright (c) 2006 CodeSourcery.
+ * Copyright (c) 2006-2007 CodeSourcery.
  * Written by Paul Brook
  *
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "arm-misc.h"
+#include "sysemu.h"
 
 #define KERNEL_ARGS_ADDR 0x100
 #define KERNEL_LOAD_ADDR 0x00010000
@@ -24,6 +26,22 @@ static uint32_t bootloader[] = {
   0  /* Kernel entry point.  Set by integratorcp_init.  */
 };
 
+/* Entry point for secondary CPUs.  Enable interrupt controller and
+   Issue WFI until start address is written to system controller.  */
+static uint32_t smpboot[] = {
+  0xe3a00201, /* mov     r0, #0x10000000 */
+  0xe3800601, /* orr     r0, r0, #0x001000000 */
+  0xe3a01001, /* mov     r1, #1 */
+  0xe5801100, /* str     r1, [r0, #0x100] */
+  0xe3a00201, /* mov     r0, #0x10000000 */
+  0xe3800030, /* orr     r0, #0x30 */
+  0xe320f003, /* wfi */
+  0xe5901000, /* ldr     r1, [r0] */
+  0xe3110003, /* tst     r1, #3 */
+  0x1afffffb, /* bne     <wfi> */
+  0xe12fff11  /* bx      r1 */
+};
+
 static void main_cpu_reset(void *opaque)
 {
     CPUState *env = opaque;
@@ -33,6 +51,8 @@ static void main_cpu_reset(void *opaque)
         arm_load_kernel(env, env->ram_size, env->kernel_filename,
                         env->kernel_cmdline, env->initrd_filename,
                         env->board_id, env->loader_start);
+
+    /* TODO:  Reset secondary CPUs.  */
 }
 
 static void set_kernel_args(uint32_t ram_size, int initrd_size,
@@ -211,6 +231,8 @@ void arm_load_kernel(CPUState *env, int ram_size, const char *kernel_filename,
         bootloader[6] = entry;
         for (n = 0; n < sizeof(bootloader) / 4; n++)
             stl_raw(phys_ram_base + (n * 4), bootloader[n]);
+        for (n = 0; n < sizeof(smpboot) / 4; n++)
+            stl_raw(phys_ram_base + ram_size + (n * 4), smpboot[n]);
         if (old_param)
             set_kernel_args_old(ram_size, initrd_size,
                                 kernel_cmdline, loader_start);
diff --git a/hw/arm_gic.c b/hw/arm_gic.c
index 8cd7182cf..82577301b 100644
--- a/hw/arm_gic.c
+++ b/hw/arm_gic.c
@@ -1,17 +1,15 @@
 /*
- * ARM AMBA Generic/Distributed Interrupt Controller
+ * ARM Generic/Distributed Interrupt Controller
  *
- * Copyright (c) 2006 CodeSourcery.
+ * Copyright (c) 2006-2007 CodeSourcery.
  * Written by Paul Brook
  *
  * This code is licenced under the GPL.
  */
 
-/* TODO: Some variants of this controller can handle multiple CPUs.
-   Currently only single CPU operation is implemented.  */
-
-#include "vl.h"
-#include "arm_pic.h"
+/* This file contains implementation code for the RealView EB interrupt
+   controller, MPCore distributed interrupt controller and ARMv7-M
+   Nested Vectored Interrupt Controller.  */
 
 //#define DEBUG_GIC
 
@@ -22,58 +20,84 @@ do { printf("arm_gic: " fmt , ##args); } while (0)
 #define DPRINTF(fmt, args...) do {} while(0)
 #endif
 
-/* Distributed interrupt controller.  */
-
+#ifdef NVIC
+static const uint8_t gic_id[] =
+{ 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 };
+#define GIC_DIST_OFFSET 0
+/* The NVIC has 16 internal vectors.  However these are not exposed
+   through the normal GIC interface.  */
+#define GIC_BASE_IRQ    32
+#else
 static const uint8_t gic_id[] =
 { 0x90, 0x13, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
-
-#define GIC_NIRQ 96
+#define GIC_DIST_OFFSET 0x1000
+#define GIC_BASE_IRQ    0
+#endif
 
 typedef struct gic_irq_state
 {
+    /* ??? The documentation seems to imply the enable bits are global, even
+       for per-cpu interrupts.  This seems strange.  */
     unsigned enabled:1;
-    unsigned pending:1;
-    unsigned active:1;
+    unsigned pending:NCPU;
+    unsigned active:NCPU;
     unsigned level:1;
-    unsigned model:1; /* 0 = 1:N, 1 = N:N */
+    unsigned model:1; /* 0 = N:N, 1 = 1:N */
     unsigned trigger:1; /* nonzero = edge triggered.  */
 } gic_irq_state;
 
+#define ALL_CPU_MASK ((1 << NCPU) - 1)
+
 #define GIC_SET_ENABLED(irq) s->irq_state[irq].enabled = 1
 #define GIC_CLEAR_ENABLED(irq) s->irq_state[irq].enabled = 0
 #define GIC_TEST_ENABLED(irq) s->irq_state[irq].enabled
-#define GIC_SET_PENDING(irq) s->irq_state[irq].pending = 1
-#define GIC_CLEAR_PENDING(irq) s->irq_state[irq].pending = 0
-#define GIC_TEST_PENDING(irq) s->irq_state[irq].pending
-#define GIC_SET_ACTIVE(irq) s->irq_state[irq].active = 1
-#define GIC_CLEAR_ACTIVE(irq) s->irq_state[irq].active = 0
-#define GIC_TEST_ACTIVE(irq) s->irq_state[irq].active
+#define GIC_SET_PENDING(irq, cm) s->irq_state[irq].pending |= (cm)
+#define GIC_CLEAR_PENDING(irq, cm) s->irq_state[irq].pending &= ~(cm)
+#define GIC_TEST_PENDING(irq, cm) ((s->irq_state[irq].pending & (cm)) != 0)
+#define GIC_SET_ACTIVE(irq, cm) s->irq_state[irq].active |= (cm)
+#define GIC_CLEAR_ACTIVE(irq, cm) s->irq_state[irq].active &= ~(cm)
+#define GIC_TEST_ACTIVE(irq, cm) ((s->irq_state[irq].active & (cm)) != 0)
 #define GIC_SET_MODEL(irq) s->irq_state[irq].model = 1
 #define GIC_CLEAR_MODEL(irq) s->irq_state[irq].model = 0
 #define GIC_TEST_MODEL(irq) s->irq_state[irq].model
-#define GIC_SET_LEVEL(irq) s->irq_state[irq].level = 1
-#define GIC_CLEAR_LEVEL(irq) s->irq_state[irq].level = 0
-#define GIC_TEST_LEVEL(irq) s->irq_state[irq].level
+#define GIC_SET_LEVEL(irq, cm) s->irq_state[irq].level = (cm)
+#define GIC_CLEAR_LEVEL(irq, cm) s->irq_state[irq].level &= ~(cm)
+#define GIC_TEST_LEVEL(irq, cm) (s->irq_state[irq].level & (cm)) != 0
 #define GIC_SET_TRIGGER(irq) s->irq_state[irq].trigger = 1
 #define GIC_CLEAR_TRIGGER(irq) s->irq_state[irq].trigger = 0
 #define GIC_TEST_TRIGGER(irq) s->irq_state[irq].trigger
+#define GIC_GET_PRIORITY(irq, cpu) \
+  (((irq) < 32) ? s->priority1[irq][cpu] : s->priority2[(irq) - 32])
+#ifdef NVIC
+#define GIC_TARGET(irq) 1
+#else
+#define GIC_TARGET(irq) s->irq_target[irq]
+#endif
 
 typedef struct gic_state
 {
     uint32_t base;
-    qemu_irq parent_irq;
+    qemu_irq parent_irq[NCPU];
     int enabled;
-    int cpu_enabled;
+    int cpu_enabled[NCPU];
 
     gic_irq_state irq_state[GIC_NIRQ];
+#ifndef NVIC
     int irq_target[GIC_NIRQ];
-    int priority[GIC_NIRQ];
-    int last_active[GIC_NIRQ];
-
-    int priority_mask;
-    int running_irq;
-    int running_priority;
-    int current_pending;
+#endif
+    int priority1[32][NCPU];
+    int priority2[GIC_NIRQ - 32];
+    int last_active[GIC_NIRQ][NCPU];
+
+    int priority_mask[NCPU];
+    int running_irq[NCPU];
+    int running_priority[NCPU];
+    int current_pending[NCPU];
+
+    qemu_irq *in;
+#ifdef NVIC
+    void *nvic;
+#endif
 } gic_state;
 
 /* TODO: Many places that call this routine could be optimized.  */
@@ -83,112 +107,136 @@ static void gic_update(gic_state *s)
     int best_irq;
     int best_prio;
     int irq;
-
-    s->current_pending = 1023;
-    if (!s->enabled || !s->cpu_enabled) {
-        qemu_irq_lower(s->parent_irq);
-        return;
-    }
-    best_prio = 0x100;
-    best_irq = 1023;
-    for (irq = 0; irq < 96; irq++) {
-        if (GIC_TEST_ENABLED(irq) && GIC_TEST_PENDING(irq)) {
-            if (s->priority[irq] < best_prio) {
-                best_prio = s->priority[irq];
-                best_irq = irq;
+    int level;
+    int cpu;
+    int cm;
+
+    for (cpu = 0; cpu < NCPU; cpu++) {
+        cm = 1 << cpu;
+        s->current_pending[cpu] = 1023;
+        if (!s->enabled || !s->cpu_enabled[cpu]) {
+	    qemu_irq_lower(s->parent_irq[cpu]);
+            return;
+        }
+        best_prio = 0x100;
+        best_irq = 1023;
+        for (irq = 0; irq < GIC_NIRQ; irq++) {
+            if (GIC_TEST_ENABLED(irq) && GIC_TEST_PENDING(irq, cm)) {
+                if (GIC_GET_PRIORITY(irq, cpu) < best_prio) {
+                    best_prio = GIC_GET_PRIORITY(irq, cpu);
+                    best_irq = irq;
+                }
             }
         }
-    }
-    if (best_prio > s->priority_mask) {
-        qemu_irq_lower(s->parent_irq);
-    } else {
-        s->current_pending = best_irq;
-        if (best_prio < s->running_priority) {
-            DPRINTF("Raised pending IRQ %d\n", best_irq);
-            qemu_irq_raise(s->parent_irq);
+        level = 0;
+        if (best_prio <= s->priority_mask[cpu]) {
+            s->current_pending[cpu] = best_irq;
+            if (best_prio < s->running_priority[cpu]) {
+                DPRINTF("Raised pending IRQ %d\n", best_irq);
+                level = 1;
+            }
         }
+        qemu_set_irq(s->parent_irq[cpu], level);
     }
 }
 
+static void __attribute__((unused))
+gic_set_pending_private(gic_state *s, int cpu, int irq)
+{
+    int cm = 1 << cpu;
+
+    if (GIC_TEST_PENDING(irq, cm))
+        return;
+
+    DPRINTF("Set %d pending cpu %d\n", irq, cpu);
+    GIC_SET_PENDING(irq, cm);
+    gic_update(s);
+}
+
+/* Process a change in an external IRQ input.  */
 static void gic_set_irq(void *opaque, int irq, int level)
 {
     gic_state *s = (gic_state *)opaque;
     /* The first external input line is internal interrupt 32.  */
     irq += 32;
-    if (level == GIC_TEST_LEVEL(irq))
+    if (level == GIC_TEST_LEVEL(irq, ALL_CPU_MASK))
         return;
 
     if (level) {
-        GIC_SET_LEVEL(irq);
+        GIC_SET_LEVEL(irq, ALL_CPU_MASK);
         if (GIC_TEST_TRIGGER(irq) || GIC_TEST_ENABLED(irq)) {
-            DPRINTF("Set %d pending\n", irq);
-            GIC_SET_PENDING(irq);
+            DPRINTF("Set %d pending mask %x\n", irq, GIC_TARGET(irq));
+            GIC_SET_PENDING(irq, GIC_TARGET(irq));
         }
     } else {
-        GIC_CLEAR_LEVEL(irq);
+        GIC_CLEAR_LEVEL(irq, ALL_CPU_MASK);
     }
     gic_update(s);
 }
 
-static void gic_set_running_irq(gic_state *s, int irq)
+static void gic_set_running_irq(gic_state *s, int cpu, int irq)
 {
-    s->running_irq = irq;
-    if (irq == 1023)
-        s->running_priority = 0x100;
-    else
-        s->running_priority = s->priority[irq];
+    s->running_irq[cpu] = irq;
+    if (irq == 1023) {
+        s->running_priority[cpu] = 0x100;
+    } else {
+        s->running_priority[cpu] = GIC_GET_PRIORITY(irq, cpu);
+    }
     gic_update(s);
 }
 
-static uint32_t gic_acknowledge_irq(gic_state *s)
+static uint32_t gic_acknowledge_irq(gic_state *s, int cpu)
 {
     int new_irq;
-    new_irq = s->current_pending;
-    if (new_irq == 1023 || s->priority[new_irq] >= s->running_priority) {
+    int cm = 1 << cpu;
+    new_irq = s->current_pending[cpu];
+    if (new_irq == 1023
+            || GIC_GET_PRIORITY(new_irq, cpu) >= s->running_priority[cpu]) {
         DPRINTF("ACK no pending IRQ\n");
         return 1023;
     }
-    qemu_irq_lower(s->parent_irq);
-    s->last_active[new_irq] = s->running_irq;
-    /* For level triggered interrupts we clear the pending bit while
-       the interrupt is active.  */
-    GIC_CLEAR_PENDING(new_irq);
-    gic_set_running_irq(s, new_irq);
+    s->last_active[new_irq][cpu] = s->running_irq[cpu];
+    /* Clear pending flags for both level and edge triggered interrupts.
+       Level triggered IRQs will be reasserted once they become inactive.  */
+    GIC_CLEAR_PENDING(new_irq, GIC_TEST_MODEL(new_irq) ? ALL_CPU_MASK : cm);
+    gic_set_running_irq(s, cpu, new_irq);
     DPRINTF("ACK %d\n", new_irq);
     return new_irq;
 }
 
-static void gic_complete_irq(gic_state * s, int irq)
+static void gic_complete_irq(gic_state * s, int cpu, int irq)
 {
     int update = 0;
+    int cm = 1 << cpu;
     DPRINTF("EOI %d\n", irq);
-    if (s->running_irq == 1023)
+    if (s->running_irq[cpu] == 1023)
         return; /* No active IRQ.  */
     if (irq != 1023) {
         /* Mark level triggered interrupts as pending if they are still
            raised.  */
         if (!GIC_TEST_TRIGGER(irq) && GIC_TEST_ENABLED(irq)
-                && GIC_TEST_LEVEL(irq)) {
-            GIC_SET_PENDING(irq);
+                && GIC_TEST_LEVEL(irq, cm) && (GIC_TARGET(irq) & cm) != 0) {
+            DPRINTF("Set %d pending mask %x\n", irq, cm);
+            GIC_SET_PENDING(irq, cm);
             update = 1;
         }
     }
-    if (irq != s->running_irq) {
+    if (irq != s->running_irq[cpu]) {
         /* Complete an IRQ that is not currently running.  */
-        int tmp = s->running_irq;
-        while (s->last_active[tmp] != 1023) {
-            if (s->last_active[tmp] == irq) {
-                s->last_active[tmp] = s->last_active[irq];
+        int tmp = s->running_irq[cpu];
+        while (s->last_active[tmp][cpu] != 1023) {
+            if (s->last_active[tmp][cpu] == irq) {
+                s->last_active[tmp][cpu] = s->last_active[irq][cpu];
                 break;
             }
-            tmp = s->last_active[tmp];
+            tmp = s->last_active[tmp][cpu];
         }
         if (update) {
             gic_update(s);
         }
     } else {
         /* Complete the current running IRQ.  */
-        gic_set_running_irq(s, s->last_active[s->running_irq]);
+        gic_set_running_irq(s, cpu, s->last_active[s->running_irq[cpu]][cpu]);
     }
 }
 
@@ -198,15 +246,22 @@ static uint32_t gic_dist_readb(void *opaque, target_phys_addr_t offset)
     uint32_t res;
     int irq;
     int i;
+    int cpu;
+    int cm;
+    int mask;
 
-    offset -= s->base + 0x1000;
+    cpu = gic_get_current_cpu();
+    cm = 1 << cpu;
+    offset -= s->base + GIC_DIST_OFFSET;
     if (offset < 0x100) {
+#ifndef NVIC
         if (offset == 0)
             return s->enabled;
         if (offset == 4)
-            return (GIC_NIRQ / 32) - 1;
+            return ((GIC_NIRQ / 32) - 1) | ((NCPU - 1) << 5);
         if (offset < 0x08)
             return 0;
+#endif
         goto bad_reg;
     } else if (offset < 0x200) {
         /* Interrupt Set/Clear Enable.  */
@@ -214,6 +269,7 @@ static uint32_t gic_dist_readb(void *opaque, target_phys_addr_t offset)
             irq = (offset - 0x100) * 8;
         else
             irq = (offset - 0x180) * 8;
+        irq += GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
         res = 0;
@@ -228,40 +284,48 @@ static uint32_t gic_dist_readb(void *opaque, target_phys_addr_t offset)
             irq = (offset - 0x200) * 8;
         else
             irq = (offset - 0x280) * 8;
+        irq += GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
         res = 0;
+        mask = (irq < 32) ?  cm : ALL_CPU_MASK;
         for (i = 0; i < 8; i++) {
-            if (GIC_TEST_PENDING(irq + i)) {
+            if (GIC_TEST_PENDING(irq + i, mask)) {
                 res |= (1 << i);
             }
         }
     } else if (offset < 0x400) {
         /* Interrupt Active.  */
-        irq = (offset - 0x300) * 8;
+        irq = (offset - 0x300) * 8 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
         res = 0;
+        mask = (irq < 32) ?  cm : ALL_CPU_MASK;
         for (i = 0; i < 8; i++) {
-            if (GIC_TEST_ACTIVE(irq + i)) {
+            if (GIC_TEST_ACTIVE(irq + i, mask)) {
                 res |= (1 << i);
             }
         }
     } else if (offset < 0x800) {
         /* Interrupt Priority.  */
-        irq = offset - 0x400;
+        irq = (offset - 0x400) + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
-        res = s->priority[irq];
+        res = GIC_GET_PRIORITY(irq, cpu);
+#ifndef NVIC
     } else if (offset < 0xc00) {
         /* Interrupt CPU Target.  */
-        irq = offset - 0x800;
+        irq = (offset - 0x800) + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
-        res = s->irq_target[irq];
+        if (irq >= 29 && irq <= 31) {
+            res = cm;
+        } else {
+            res = GIC_TARGET(irq);
+        }
     } else if (offset < 0xf00) {
         /* Interrupt Configuration.  */
-        irq = (offset - 0xc00) * 2;
+        irq = (offset - 0xc00) * 2 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
         res = 0;
@@ -271,6 +335,7 @@ static uint32_t gic_dist_readb(void *opaque, target_phys_addr_t offset)
             if (GIC_TEST_TRIGGER(irq + i))
                 res |= (2 << (i * 2));
         }
+#endif
     } else if (offset < 0xfe0) {
         goto bad_reg;
     } else /* offset >= 0xfe0 */ {
@@ -282,7 +347,7 @@ static uint32_t gic_dist_readb(void *opaque, target_phys_addr_t offset)
     }
     return res;
 bad_reg:
-    cpu_abort (cpu_single_env, "gic_dist_readb: Bad offset %x\n", offset);
+    cpu_abort(cpu_single_env, "gic_dist_readb: Bad offset %x\n", (int)offset);
     return 0;
 }
 
@@ -297,6 +362,13 @@ static uint32_t gic_dist_readw(void *opaque, target_phys_addr_t offset)
 static uint32_t gic_dist_readl(void *opaque, target_phys_addr_t offset)
 {
     uint32_t val;
+#ifdef NVIC
+    gic_state *s = (gic_state *)opaque;
+    uint32_t addr;
+    addr = offset - s->base;
+    if (addr < 0x100 || addr > 0xd00)
+        return nvic_readl(s->nvic, addr);
+#endif
     val = gic_dist_readw(opaque, offset);
     val |= gic_dist_readw(opaque, offset + 2) << 16;
     return val;
@@ -308,9 +380,14 @@ static void gic_dist_writeb(void *opaque, target_phys_addr_t offset,
     gic_state *s = (gic_state *)opaque;
     int irq;
     int i;
+    int cpu;
 
-    offset -= s->base + 0x1000;
+    cpu = gic_get_current_cpu();
+    offset -= s->base + GIC_DIST_OFFSET;
     if (offset < 0x100) {
+#ifdef NVIC
+        goto bad_reg;
+#else
         if (offset == 0) {
             s->enabled = (value & 1);
             DPRINTF("Distribution %sabled\n", s->enabled ? "En" : "Dis");
@@ -319,27 +396,36 @@ static void gic_dist_writeb(void *opaque, target_phys_addr_t offset,
         } else {
             goto bad_reg;
         }
+#endif
     } else if (offset < 0x180) {
         /* Interrupt Set Enable.  */
-        irq = (offset - 0x100) * 8;
+        irq = (offset - 0x100) * 8 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
+        if (irq < 16)
+          value = 0xff;
         for (i = 0; i < 8; i++) {
             if (value & (1 << i)) {
+                int mask = (irq < 32) ? (1 << cpu) : GIC_TARGET(irq);
                 if (!GIC_TEST_ENABLED(irq + i))
                     DPRINTF("Enabled IRQ %d\n", irq + i);
                 GIC_SET_ENABLED(irq + i);
                 /* If a raised level triggered IRQ enabled then mark
                    is as pending.  */
-                if (GIC_TEST_LEVEL(irq + i) && !GIC_TEST_TRIGGER(irq + i))
-                    GIC_SET_PENDING(irq + i);
+                if (GIC_TEST_LEVEL(irq + i, mask)
+                        && !GIC_TEST_TRIGGER(irq + i)) {
+                    DPRINTF("Set %d pending mask %x\n", irq + i, mask);
+                    GIC_SET_PENDING(irq + i, mask);
+                }
             }
         }
     } else if (offset < 0x200) {
         /* Interrupt Clear Enable.  */
-        irq = (offset - 0x180) * 8;
+        irq = (offset - 0x180) * 8 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
+        if (irq < 16)
+          value = 0;
         for (i = 0; i < 8; i++) {
             if (value & (1 << i)) {
                 if (GIC_TEST_ENABLED(irq + i))
@@ -349,22 +435,28 @@ static void gic_dist_writeb(void *opaque, target_phys_addr_t offset,
         }
     } else if (offset < 0x280) {
         /* Interrupt Set Pending.  */
-        irq = (offset - 0x200) * 8;
+        irq = (offset - 0x200) * 8 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
+        if (irq < 16)
+          irq = 0;
+
         for (i = 0; i < 8; i++) {
             if (value & (1 << i)) {
-                GIC_SET_PENDING(irq + i);
+                GIC_SET_PENDING(irq + i, GIC_TARGET(irq));
             }
         }
     } else if (offset < 0x300) {
         /* Interrupt Clear Pending.  */
-        irq = (offset - 0x280) * 8;
+        irq = (offset - 0x280) * 8 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
         for (i = 0; i < 8; i++) {
+            /* ??? This currently clears the pending bit for all CPUs, even
+               for per-CPU interrupts.  It's unclear whether this is the
+               corect behavior.  */
             if (value & (1 << i)) {
-                GIC_CLEAR_PENDING(irq + i);
+                GIC_CLEAR_PENDING(irq + i, ALL_CPU_MASK);
             }
         }
     } else if (offset < 0x400) {
@@ -372,21 +464,32 @@ static void gic_dist_writeb(void *opaque, target_phys_addr_t offset,
         goto bad_reg;
     } else if (offset < 0x800) {
         /* Interrupt Priority.  */
-        irq = offset - 0x400;
+        irq = (offset - 0x400) + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
-        s->priority[irq] = value;
+        if (irq < 32) {
+            s->priority1[irq][cpu] = value;
+        } else {
+            s->priority2[irq - 32] = value;
+        }
+#ifndef NVIC
     } else if (offset < 0xc00) {
         /* Interrupt CPU Target.  */
-        irq = offset - 0x800;
+        irq = (offset - 0x800) + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
-        s->irq_target[irq] = value;
+        if (irq < 29)
+            value = 0;
+        else if (irq < 32)
+            value = ALL_CPU_MASK;
+        s->irq_target[irq] = value & ALL_CPU_MASK;
     } else if (offset < 0xf00) {
         /* Interrupt Configuration.  */
-        irq = (offset - 0xc00) * 4;
+        irq = (offset - 0xc00) * 4 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
+        if (irq < 32)
+            value |= 0xaa;
         for (i = 0; i < 4; i++) {
             if (value & (1 << (i * 2))) {
                 GIC_SET_MODEL(irq + i);
@@ -399,25 +502,20 @@ static void gic_dist_writeb(void *opaque, target_phys_addr_t offset,
                 GIC_CLEAR_TRIGGER(irq + i);
             }
         }
+#endif
     } else {
-        /* 0xf00 is only handled for word writes.  */
+        /* 0xf00 is only handled for 32-bit writes.  */
         goto bad_reg;
     }
     gic_update(s);
     return;
 bad_reg:
-    cpu_abort (cpu_single_env, "gic_dist_writeb: Bad offset %x\n", offset);
+    cpu_abort(cpu_single_env, "gic_dist_writeb: Bad offset %x\n", (int)offset);
 }
 
 static void gic_dist_writew(void *opaque, target_phys_addr_t offset,
                             uint32_t value)
 {
-    gic_state *s = (gic_state *)opaque;
-    if (offset - s->base == 0xf00) {
-        GIC_SET_PENDING(value & 0x3ff);
-        gic_update(s);
-        return;
-    }
     gic_dist_writeb(opaque, offset, value & 0xff);
     gic_dist_writeb(opaque, offset + 1, value >> 8);
 }
@@ -425,6 +523,41 @@ static void gic_dist_writew(void *opaque, target_phys_addr_t offset,
 static void gic_dist_writel(void *opaque, target_phys_addr_t offset,
                             uint32_t value)
 {
+    gic_state *s = (gic_state *)opaque;
+#ifdef NVIC
+    uint32_t addr;
+    addr = offset - s->base;
+    if (addr < 0x100 || (addr > 0xd00 && addr != 0xf00)) {
+        nvic_writel(s->nvic, addr, value);
+        return;
+    }
+#endif
+    if (offset - s->base == GIC_DIST_OFFSET + 0xf00) {
+        int cpu;
+        int irq;
+        int mask;
+
+        cpu = gic_get_current_cpu();
+        irq = value & 0x3ff;
+        switch ((value >> 24) & 3) {
+        case 0:
+            mask = (value >> 16) & ALL_CPU_MASK;
+            break;
+        case 1:
+            mask = 1 << cpu;
+            break;
+        case 2:
+            mask = ALL_CPU_MASK ^ (1 << cpu);
+            break;
+        default:
+            DPRINTF("Bad Soft Int target filter\n");
+            mask = ALL_CPU_MASK;
+            break;
+        }
+        GIC_SET_PENDING(irq, mask);
+        gic_update(s);
+        return;
+    }
     gic_dist_writew(opaque, offset, value & 0xffff);
     gic_dist_writew(opaque, offset + 2, value >> 16);
 }
@@ -441,105 +574,100 @@ static CPUWriteMemoryFunc *gic_dist_writefn[] = {
    gic_dist_writel
 };
 
-static uint32_t gic_cpu_read(void *opaque, target_phys_addr_t offset)
+#ifndef NVIC
+static uint32_t gic_cpu_read(gic_state *s, int cpu, int offset)
 {
-    gic_state *s = (gic_state *)opaque;
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* Control */
-        return s->cpu_enabled;
+        return s->cpu_enabled[cpu];
     case 0x04: /* Priority mask */
-        return s->priority_mask;
+        return s->priority_mask[cpu];
     case 0x08: /* Binary Point */
         /* ??? Not implemented.  */
         return 0;
     case 0x0c: /* Acknowledge */
-        return gic_acknowledge_irq(s);
+        return gic_acknowledge_irq(s, cpu);
     case 0x14: /* Runing Priority */
-        return s->running_priority;
+        return s->running_priority[cpu];
     case 0x18: /* Highest Pending Interrupt */
-        return s->current_pending;
+        return s->current_pending[cpu];
     default:
-        cpu_abort (cpu_single_env, "gic_cpu_read: Bad offset %x\n", offset);
+        cpu_abort(cpu_single_env, "gic_cpu_read: Bad offset %x\n",
+                  (int)offset);
         return 0;
     }
 }
 
-static void gic_cpu_write(void *opaque, target_phys_addr_t offset,
-                          uint32_t value)
+static void gic_cpu_write(gic_state *s, int cpu, int offset, uint32_t value)
 {
-    gic_state *s = (gic_state *)opaque;
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* Control */
-        s->cpu_enabled = (value & 1);
+        s->cpu_enabled[cpu] = (value & 1);
         DPRINTF("CPU %sabled\n", s->cpu_enabled ? "En" : "Dis");
         break;
     case 0x04: /* Priority mask */
-        s->priority_mask = (value & 0x3ff);
+        s->priority_mask[cpu] = (value & 0xff);
         break;
     case 0x08: /* Binary Point */
         /* ??? Not implemented.  */
         break;
     case 0x10: /* End Of Interrupt */
-        return gic_complete_irq(s, value & 0x3ff);
+        return gic_complete_irq(s, cpu, value & 0x3ff);
     default:
-        cpu_abort (cpu_single_env, "gic_cpu_write: Bad offset %x\n", offset);
+        cpu_abort(cpu_single_env, "gic_cpu_write: Bad offset %x\n",
+                  (int)offset);
         return;
     }
     gic_update(s);
 }
-
-static CPUReadMemoryFunc *gic_cpu_readfn[] = {
-   gic_cpu_read,
-   gic_cpu_read,
-   gic_cpu_read
-};
-
-static CPUWriteMemoryFunc *gic_cpu_writefn[] = {
-   gic_cpu_write,
-   gic_cpu_write,
-   gic_cpu_write
-};
+#endif
 
 static void gic_reset(gic_state *s)
 {
     int i;
     memset(s->irq_state, 0, GIC_NIRQ * sizeof(gic_irq_state));
-    s->priority_mask = 0xf0;
-    s->current_pending = 1023;
-    s->running_irq = 1023;
-    s->running_priority = 0x100;
-    for (i = 0; i < 15; i++) {
+    for (i = 0 ; i < NCPU; i++) {
+        s->priority_mask[i] = 0xf0;
+        s->current_pending[i] = 1023;
+        s->running_irq[i] = 1023;
+        s->running_priority[i] = 0x100;
+#ifdef NVIC
+        /* The NVIC doesn't have per-cpu interfaces, so enable by default.  */
+        s->cpu_enabled[i] = 1;
+#else
+        s->cpu_enabled[i] = 0;
+#endif
+    }
+    for (i = 0; i < 16; i++) {
         GIC_SET_ENABLED(i);
         GIC_SET_TRIGGER(i);
     }
+#ifdef NVIC
+    /* The NVIC is always enabled.  */
+    s->enabled = 1;
+#else
     s->enabled = 0;
-    s->cpu_enabled = 0;
+#endif
 }
 
-qemu_irq *arm_gic_init(uint32_t base, qemu_irq parent_irq)
+static gic_state *gic_init(uint32_t base, qemu_irq *parent_irq)
 {
     gic_state *s;
-    qemu_irq *qi;
     int iomemtype;
+    int i;
 
     s = (gic_state *)qemu_mallocz(sizeof(gic_state));
     if (!s)
         return NULL;
-    qi = qemu_allocate_irqs(gic_set_irq, s, GIC_NIRQ);
-    s->parent_irq = parent_irq;
-    if (base != 0xffffffff) {
-        iomemtype = cpu_register_io_memory(0, gic_cpu_readfn,
-                                           gic_cpu_writefn, s);
-        cpu_register_physical_memory(base, 0x00001000, iomemtype);
-        iomemtype = cpu_register_io_memory(0, gic_dist_readfn,
-                                           gic_dist_writefn, s);
-        cpu_register_physical_memory(base + 0x1000, 0x00001000, iomemtype);
-        s->base = base;
-    } else {
-        s->base = 0;
+    s->in = qemu_allocate_irqs(gic_set_irq, s, GIC_NIRQ);
+    for (i = 0; i < NCPU; i++) {
+        s->parent_irq[i] = parent_irq[i];
     }
+    iomemtype = cpu_register_io_memory(0, gic_dist_readfn,
+                                       gic_dist_writefn, s);
+    cpu_register_physical_memory(base + GIC_DIST_OFFSET, 0x00001000,
+                                 iomemtype);
+    s->base = base;
     gic_reset(s);
-    return qi;
+    return s;
 }
diff --git a/hw/arm_pic.c b/hw/arm_pic.c
index 7f4a694d9..1fe55b71b 100644
--- a/hw/arm_pic.c
+++ b/hw/arm_pic.c
@@ -7,8 +7,8 @@
  * This code is licenced under the LGPL
  */
 
-#include "vl.h"
-#include "arm_pic.h"
+#include "hw.h"
+#include "arm-misc.h"
 
 /* Stub functions for hardware that doesn't exist.  */
 void pic_info(void)
diff --git a/hw/arm_pic.h b/hw/arm_pic.h
deleted file mode 100644
index 1eba2baab..000000000
--- a/hw/arm_pic.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Generic ARM Programmable Interrupt Controller support.
- *
- * Copyright (c) 2006 CodeSourcery.
- * Written by Paul Brook
- *
- * This code is licenced under the LGPL.
- *
- * Arm hardware uses a wide variety of interrupt handling hardware.
- * This provides a generic framework for connecting interrupt sources and
- * inputs.
- */
-
-#ifndef ARM_INTERRUPT_H
-#define ARM_INTERRUPT_H 1
-
-/* The CPU is also modeled as an interrupt controller.  */
-#define ARM_PIC_CPU_IRQ 0
-#define ARM_PIC_CPU_FIQ 1
-qemu_irq *arm_pic_init_cpu(CPUState *env);
-
-#endif /* !ARM_INTERRUPT_H */
-
diff --git a/hw/arm_sysctl.c b/hw/arm_sysctl.c
index 468a494db..67ca154a3 100644
--- a/hw/arm_sysctl.c
+++ b/hw/arm_sysctl.c
@@ -1,14 +1,15 @@
 /*
  * Status and system control registers for ARM RealView/Versatile boards.
  *
- * Copyright (c) 2006 CodeSourcery.
+ * Copyright (c) 2006-2007 CodeSourcery.
  * Written by Paul Brook
  *
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
-#include "arm_pic.h"
+#include "hw.h"
+#include "primecell.h"
+#include "sysemu.h"
 
 #define LOCK_VALUE 0xa05f
 
@@ -200,6 +201,9 @@ void arm_sysctl_init(uint32_t base, uint32_t sys_id)
         return;
     s->base = base;
     s->sys_id = sys_id;
+    /* The MPcore bootloader uses these flags to start secondary CPUs.
+       We don't use a bootloader, so do this here.  */
+    s->flags = 3;
     iomemtype = cpu_register_io_memory(0, arm_sysctl_readfn,
                                        arm_sysctl_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
diff --git a/hw/arm_timer.c b/hw/arm_timer.c
index 3df386af4..540d3dea1 100644
--- a/hw/arm_timer.c
+++ b/hw/arm_timer.c
@@ -7,8 +7,9 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
-#include "arm_pic.h"
+#include "hw.h"
+#include "qemu-timer.h"
+#include "primecell.h"
 
 /* Common timer implementation.  */
 
@@ -42,7 +43,7 @@ static void arm_timer_update(arm_timer_state *s)
     }
 }
 
-uint32_t arm_timer_read(void *opaque, target_phys_addr_t offset)
+static uint32_t arm_timer_read(void *opaque, target_phys_addr_t offset)
 {
     arm_timer_state *s = (arm_timer_state *)opaque;
 
diff --git a/hw/armv7m.c b/hw/armv7m.c
new file mode 100644
index 000000000..b2bad3c2e
--- /dev/null
+++ b/hw/armv7m.c
@@ -0,0 +1,206 @@
+/*
+ * ARMV7M System emulation.
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "hw.h"
+#include "arm-misc.h"
+#include "sysemu.h"
+
+/* Bitbanded IO.  Each word corresponds to a single bit.  */
+
+/* Get the byte address of the real memory for a bitband acess.  */
+static inline uint32_t bitband_addr(uint32_t addr)
+{
+    uint32_t res;
+
+    res = addr & 0xe0000000;
+    res |= (addr & 0x1ffffff) >> 5;
+    return res;
+
+}
+
+static uint32_t bitband_readb(void *opaque, target_phys_addr_t offset)
+{
+    uint8_t v;
+    cpu_physical_memory_read(bitband_addr(offset), &v, 1);
+    return (v & (1 << ((offset >> 2) & 7))) != 0;
+}
+
+static void bitband_writeb(void *opaque, target_phys_addr_t offset,
+                           uint32_t value)
+{
+    uint32_t addr;
+    uint8_t mask;
+    uint8_t v;
+    addr = bitband_addr(offset);
+    mask = (1 << ((offset >> 2) & 7));
+    cpu_physical_memory_read(addr, &v, 1);
+    if (value & 1)
+        v |= mask;
+    else
+        v &= ~mask;
+    cpu_physical_memory_write(addr, &v, 1);
+}
+
+static uint32_t bitband_readw(void *opaque, target_phys_addr_t offset)
+{
+    uint32_t addr;
+    uint16_t mask;
+    uint16_t v;
+    addr = bitband_addr(offset) & ~1;
+    mask = (1 << ((offset >> 2) & 15));
+    mask = tswap16(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 2);
+    return (v & mask) != 0;
+}
+
+static void bitband_writew(void *opaque, target_phys_addr_t offset,
+                           uint32_t value)
+{
+    uint32_t addr;
+    uint16_t mask;
+    uint16_t v;
+    addr = bitband_addr(offset) & ~1;
+    mask = (1 << ((offset >> 2) & 15));
+    mask = tswap16(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 2);
+    if (value & 1)
+        v |= mask;
+    else
+        v &= ~mask;
+    cpu_physical_memory_write(addr, (uint8_t *)&v, 2);
+}
+
+static uint32_t bitband_readl(void *opaque, target_phys_addr_t offset)
+{
+    uint32_t addr;
+    uint32_t mask;
+    uint32_t v;
+    addr = bitband_addr(offset) & ~3;
+    mask = (1 << ((offset >> 2) & 31));
+    mask = tswap32(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 4);
+    return (v & mask) != 0;
+}
+
+static void bitband_writel(void *opaque, target_phys_addr_t offset,
+                           uint32_t value)
+{
+    uint32_t addr;
+    uint32_t mask;
+    uint32_t v;
+    addr = bitband_addr(offset) & ~3;
+    mask = (1 << ((offset >> 2) & 31));
+    mask = tswap32(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 4);
+    if (value & 1)
+        v |= mask;
+    else
+        v &= ~mask;
+    cpu_physical_memory_write(addr, (uint8_t *)&v, 4);
+}
+
+static CPUReadMemoryFunc *bitband_readfn[] = {
+   bitband_readb,
+   bitband_readw,
+   bitband_readl
+};
+
+static CPUWriteMemoryFunc *bitband_writefn[] = {
+   bitband_writeb,
+   bitband_writew,
+   bitband_writel
+};
+
+static void armv7m_bitband_init(void)
+{
+    int iomemtype;
+
+    iomemtype = cpu_register_io_memory(0, bitband_readfn, bitband_writefn,
+                                       NULL);
+    cpu_register_physical_memory(0x22000000, 0x02000000, iomemtype);
+    cpu_register_physical_memory(0x42000000, 0x02000000, iomemtype);
+}
+
+/* Board init.  */
+/* Init CPU and memory for a v7-M based board.
+   flash_size and sram_size are in kb.
+   Returns the NVIC array.  */
+
+qemu_irq *armv7m_init(int flash_size, int sram_size,
+                      const char *kernel_filename, const char *cpu_model)
+{
+    CPUState *env;
+    qemu_irq *pic;
+    uint32_t pc;
+    int image_size;
+    uint64_t entry;
+    uint64_t lowaddr;
+
+    flash_size *= 1024;
+    sram_size *= 1024;
+
+    if (!cpu_model)
+	cpu_model = "cortex-m3";
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
+
+#if 0
+    /* > 32Mb SRAM gets complicated because it overlaps the bitband area.
+       We don't have proper commandline options, so allocate half of memory
+       as SRAM, up to a maximum of 32Mb, and the rest as code.  */
+    if (ram_size > (512 + 32) * 1024 * 1024)
+        ram_size = (512 + 32) * 1024 * 1024;
+    sram_size = (ram_size / 2) & TARGET_PAGE_MASK;
+    if (sram_size > 32 * 1024 * 1024)
+        sram_size = 32 * 1024 * 1024;
+    code_size = ram_size - sram_size;
+#endif
+
+    /* Flash programming is done via the SCU, so pretend it is ROM.  */
+    cpu_register_physical_memory(0, flash_size, IO_MEM_ROM);
+    cpu_register_physical_memory(0x20000000, sram_size,
+                                 flash_size + IO_MEM_RAM);
+    armv7m_bitband_init();
+
+    pic = armv7m_nvic_init(env);
+
+    image_size = load_elf(kernel_filename, 0, &entry, &lowaddr, NULL);
+    if (image_size < 0) {
+        image_size = load_image(kernel_filename, phys_ram_base);
+	lowaddr = 0;
+    }
+    if (image_size < 0) {
+        fprintf(stderr, "qemu: could not load kernel '%s'\n",
+                kernel_filename);
+        exit(1);
+    }
+
+    /* If the image was loaded at address zero then assume it is a
+       regular ROM image and perform the normal CPU reset sequence.
+       Otherwise jump directly to the entry point.  */
+    if (lowaddr == 0) {
+	env->regs[13] = tswap32(*(uint32_t *)phys_ram_base);
+	pc = tswap32(*(uint32_t *)(phys_ram_base + 4));
+    } else {
+	pc = entry;
+    }
+    env->thumb = pc & 1;
+    env->regs[15] = pc & ~1;
+
+    /* Hack to map an additional page of ram at the top of the address
+       space.  This stops qemu complaining about executing code outside RAM
+       when returning from an exception.  */
+    cpu_register_physical_memory(0xfffff000, 0x1000, IO_MEM_RAM + ram_size);
+
+    return pic;
+}
+
diff --git a/hw/armv7m_nvic.c b/hw/armv7m_nvic.c
new file mode 100644
index 000000000..37596d0cc
--- /dev/null
+++ b/hw/armv7m_nvic.c
@@ -0,0 +1,385 @@
+/*
+ * ARM Nested Vectored Interrupt Controller
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ *
+ * The ARMv7M System controller is fairly tightly tied in with the
+ * NVIC.  Much of that is also implemented here.
+ */
+
+#include "hw.h"
+#include "qemu-timer.h"
+#include "arm-misc.h"
+
+/* 32 internal lines (16 used for system exceptions) plus 64 external
+   interrupt lines.  */
+#define GIC_NIRQ 96
+#define NCPU 1
+#define NVIC 1
+
+/* Only a single "CPU" interface is present.  */
+static inline int
+gic_get_current_cpu(void)
+{
+    return 0;
+}
+
+static uint32_t nvic_readl(void *opaque, uint32_t offset);
+static void nvic_writel(void *opaque, uint32_t offset, uint32_t value);
+
+#include "arm_gic.c"
+
+typedef struct {
+    struct {
+        uint32_t control;
+        uint32_t reload;
+        int64_t tick;
+        QEMUTimer *timer;
+    } systick;
+    gic_state *gic;
+} nvic_state;
+
+/* qemu timers run at 1GHz.   We want something closer to 1MHz.  */
+#define SYSTICK_SCALE 1000ULL
+
+#define SYSTICK_ENABLE    (1 << 0)
+#define SYSTICK_TICKINT   (1 << 1)
+#define SYSTICK_CLKSOURCE (1 << 2)
+#define SYSTICK_COUNTFLAG (1 << 16)
+
+/* Multiplication factor to convert from system clock ticks to qemu timer
+   ticks.  */
+int system_clock_scale;
+
+/* Conversion factor from qemu timer to SysTick frequencies.  */
+static inline int64_t systick_scale(nvic_state *s)
+{
+    if (s->systick.control & SYSTICK_CLKSOURCE)
+        return system_clock_scale;
+    else
+        return 1000;
+}
+
+static void systick_reload(nvic_state *s, int reset)
+{
+    if (reset)
+        s->systick.tick = qemu_get_clock(vm_clock);
+    s->systick.tick += (s->systick.reload + 1) * systick_scale(s);
+    qemu_mod_timer(s->systick.timer, s->systick.tick);
+}
+
+static void systick_timer_tick(void * opaque)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    s->systick.control |= SYSTICK_COUNTFLAG;
+    if (s->systick.control & SYSTICK_TICKINT) {
+        /* Trigger the interrupt.  */
+        armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK);
+    }
+    if (s->systick.reload == 0) {
+        s->systick.control &= ~SYSTICK_ENABLE;
+    } else {
+        systick_reload(s, 0);
+    }
+}
+
+/* The external routines use the hardware vector numbering, ie. the first
+   IRQ is #16.  The internal GIC routines use #32 as the first IRQ.  */
+void armv7m_nvic_set_pending(void *opaque, int irq)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    if (irq >= 16)
+        irq += 16;
+    gic_set_pending_private(s->gic, 0, irq);
+}
+
+/* Make pending IRQ active.  */
+int armv7m_nvic_acknowledge_irq(void *opaque)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    uint32_t irq;
+
+    irq = gic_acknowledge_irq(s->gic, 0);
+    if (irq == 1023)
+        cpu_abort(cpu_single_env, "Interrupt but no vector\n");
+    if (irq >= 32)
+        irq -= 16;
+    return irq;
+}
+
+void armv7m_nvic_complete_irq(void *opaque, int irq)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    if (irq >= 16)
+        irq += 16;
+    gic_complete_irq(s->gic, 0, irq);
+}
+
+static uint32_t nvic_readl(void *opaque, uint32_t offset)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    uint32_t val;
+    int irq;
+
+    switch (offset) {
+    case 4: /* Interrupt Control Type.  */
+        return (GIC_NIRQ / 32) - 1;
+    case 0x10: /* SysTick Control and Status.  */
+        val = s->systick.control;
+        s->systick.control &= ~SYSTICK_COUNTFLAG;
+        return val;
+    case 0x14: /* SysTick Reload Value.  */
+        return s->systick.reload;
+    case 0x18: /* SysTick Current Value.  */
+        {
+            int64_t t;
+            if ((s->systick.control & SYSTICK_ENABLE) == 0)
+                return 0;
+            t = qemu_get_clock(vm_clock);
+            if (t >= s->systick.tick)
+                return 0;
+            val = ((s->systick.tick - (t + 1)) / systick_scale(s)) + 1;
+            /* The interrupt in triggered when the timer reaches zero.
+               However the counter is not reloaded until the next clock
+               tick.  This is a hack to return zero during the first tick.  */
+            if (val > s->systick.reload)
+                val = 0;
+            return val;
+        }
+    case 0x1c: /* SysTick Calibration Value.  */
+        return 10000;
+    case 0xd00: /* CPUID Base.  */
+        return cpu_single_env->cp15.c0_cpuid;
+    case 0xd04: /* Interrypt Control State.  */
+        /* VECTACTIVE */
+        val = s->gic->running_irq[0];
+        if (val == 1023) {
+            val = 0;
+        } else if (val >= 32) {
+            val -= 16;
+        }
+        /* RETTOBASE */
+        if (s->gic->running_irq[0] == 1023
+                || s->gic->last_active[s->gic->running_irq[0]][0] == 1023) {
+            val |= (1 << 11);
+        }
+        /* VECTPENDING */
+        if (s->gic->current_pending[0] != 1023)
+            val |= (s->gic->current_pending[0] << 12);
+        /* ISRPENDING */
+        for (irq = 32; irq < GIC_NIRQ; irq++) {
+            if (s->gic->irq_state[irq].pending) {
+                val |= (1 << 22);
+                break;
+            }
+        }
+        /* PENDSTSET */
+        if (s->gic->irq_state[ARMV7M_EXCP_SYSTICK].pending)
+            val |= (1 << 26);
+        /* PENDSVSET */
+        if (s->gic->irq_state[ARMV7M_EXCP_PENDSV].pending)
+            val |= (1 << 28);
+        /* NMIPENDSET */
+        if (s->gic->irq_state[ARMV7M_EXCP_NMI].pending)
+            val |= (1 << 31);
+        return val;
+    case 0xd08: /* Vector Table Offset.  */
+        return cpu_single_env->v7m.vecbase;
+    case 0xd0c: /* Application Interrupt/Reset Control.  */
+        return 0xfa05000;
+    case 0xd10: /* System Control.  */
+        /* TODO: Implement SLEEPONEXIT.  */
+        return 0;
+    case 0xd14: /* Configuration Control.  */
+        /* TODO: Implement Configuration Control bits.  */
+        return 0;
+    case 0xd18: case 0xd1c: case 0xd20: /* System Handler Priority.  */
+        irq = offset - 0xd14;
+        val = 0;
+        val = s->gic->priority1[irq++][0];
+        val = s->gic->priority1[irq++][0] << 8;
+        val = s->gic->priority1[irq++][0] << 16;
+        val = s->gic->priority1[irq][0] << 24;
+        return val;
+    case 0xd24: /* System Handler Status.  */
+        val = 0;
+        if (s->gic->irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0);
+        if (s->gic->irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1);
+        if (s->gic->irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3);
+        if (s->gic->irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7);
+        if (s->gic->irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8);
+        if (s->gic->irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10);
+        if (s->gic->irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11);
+        if (s->gic->irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12);
+        if (s->gic->irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13);
+        if (s->gic->irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14);
+        if (s->gic->irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15);
+        if (s->gic->irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16);
+        if (s->gic->irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17);
+        if (s->gic->irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18);
+        return val;
+    case 0xd28: /* Configurable Fault Status.  */
+        /* TODO: Implement Fault Status.  */
+        cpu_abort(cpu_single_env,
+                  "Not implemented: Configurable Fault Status.");
+        return 0;
+    case 0xd2c: /* Hard Fault Status.  */
+    case 0xd30: /* Debug Fault Status.  */
+    case 0xd34: /* Mem Manage Address.  */
+    case 0xd38: /* Bus Fault Address.  */
+    case 0xd3c: /* Aux Fault Status.  */
+        /* TODO: Implement fault status registers.  */
+        goto bad_reg;
+    case 0xd40: /* PFR0.  */
+        return 0x00000030;
+    case 0xd44: /* PRF1.  */
+        return 0x00000200;
+    case 0xd48: /* DFR0.  */
+        return 0x00100000;
+    case 0xd4c: /* AFR0.  */
+        return 0x00000000;
+    case 0xd50: /* MMFR0.  */
+        return 0x00000030;
+    case 0xd54: /* MMFR1.  */
+        return 0x00000000;
+    case 0xd58: /* MMFR2.  */
+        return 0x00000000;
+    case 0xd5c: /* MMFR3.  */
+        return 0x00000000;
+    case 0xd60: /* ISAR0.  */
+        return 0x01141110;
+    case 0xd64: /* ISAR1.  */
+        return 0x02111000;
+    case 0xd68: /* ISAR2.  */
+        return 0x21112231;
+    case 0xd6c: /* ISAR3.  */
+        return 0x01111110;
+    case 0xd70: /* ISAR4.  */
+        return 0x01310102;
+    /* TODO: Implement debug registers.  */
+    default:
+    bad_reg:
+        cpu_abort(cpu_single_env, "NVIC: Bad read offset 0x%x\n", offset);
+    }
+}
+
+static void nvic_writel(void *opaque, uint32_t offset, uint32_t value)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    uint32_t oldval;
+    switch (offset) {
+    case 0x10: /* SysTick Control and Status.  */
+        oldval = s->systick.control;
+        s->systick.control &= 0xfffffff8;
+        s->systick.control |= value & 7;
+        if ((oldval ^ value) & SYSTICK_ENABLE) {
+            int64_t now = qemu_get_clock(vm_clock);
+            if (value & SYSTICK_ENABLE) {
+                if (s->systick.tick) {
+                    s->systick.tick += now;
+                    qemu_mod_timer(s->systick.timer, s->systick.tick);
+                } else {
+                    systick_reload(s, 1);
+                }
+            } else {
+                qemu_del_timer(s->systick.timer);
+                s->systick.tick -= now;
+                if (s->systick.tick < 0)
+                  s->systick.tick = 0;
+            }
+        } else if ((oldval ^ value) & SYSTICK_CLKSOURCE) {
+            /* This is a hack. Force the timer to be reloaded
+               when the reference clock is changed.  */
+            systick_reload(s, 1);
+        }
+        break;
+    case 0x14: /* SysTick Reload Value.  */
+        s->systick.reload = value;
+        break;
+    case 0x18: /* SysTick Current Value.  Writes reload the timer.  */
+        systick_reload(s, 1);
+        s->systick.control &= ~SYSTICK_COUNTFLAG;
+        break;
+    case 0xd04: /* Interrupt Control State.  */
+        if (value & (1 << 31)) {
+            armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI);
+        }
+        if (value & (1 << 28)) {
+            armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV);
+        } else if (value & (1 << 27)) {
+            s->gic->irq_state[ARMV7M_EXCP_PENDSV].pending = 0;
+            gic_update(s->gic);
+        }
+        if (value & (1 << 26)) {
+            armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK);
+        } else if (value & (1 << 25)) {
+            s->gic->irq_state[ARMV7M_EXCP_SYSTICK].pending = 0;
+            gic_update(s->gic);
+        }
+        break;
+    case 0xd08: /* Vector Table Offset.  */
+        cpu_single_env->v7m.vecbase = value & 0xffffff80;
+        break;
+    case 0xd0c: /* Application Interrupt/Reset Control.  */
+        if ((value >> 16) == 0x05fa) {
+            if (value & 2) {
+                cpu_abort(cpu_single_env, "VECTCLRACTIVE not implemented");
+            }
+            if (value & 5) {
+                cpu_abort(cpu_single_env, "System reset");
+            }
+        }
+        break;
+    case 0xd10: /* System Control.  */
+    case 0xd14: /* Configuration Control.  */
+        /* TODO: Implement control registers.  */
+        goto bad_reg;
+    case 0xd18: case 0xd1c: case 0xd20: /* System Handler Priority.  */
+        {
+            int irq;
+            irq = offset - 0xd14;
+            s->gic->priority1[irq++][0] = value & 0xff;
+            s->gic->priority1[irq++][0] = (value >> 8) & 0xff;
+            s->gic->priority1[irq++][0] = (value >> 16) & 0xff;
+            s->gic->priority1[irq][0] = (value >> 24) & 0xff;
+            gic_update(s->gic);
+        }
+        break;
+    case 0xd24: /* System Handler Control.  */
+        /* TODO: Real hardware allows you to set/clear the active bits
+           under some circumstances.  We don't implement this.  */
+        s->gic->irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
+        s->gic->irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
+        s->gic->irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
+        break;
+    case 0xd28: /* Configurable Fault Status.  */
+    case 0xd2c: /* Hard Fault Status.  */
+    case 0xd30: /* Debug Fault Status.  */
+    case 0xd34: /* Mem Manage Address.  */
+    case 0xd38: /* Bus Fault Address.  */
+    case 0xd3c: /* Aux Fault Status.  */
+        goto bad_reg;
+    default:
+    bad_reg:
+        cpu_abort(cpu_single_env, "NVIC: Bad write offset 0x%x\n", offset);
+    }
+}
+
+qemu_irq *armv7m_nvic_init(CPUState *env)
+{
+    nvic_state *s;
+    qemu_irq *parent;
+
+    parent = arm_pic_init_cpu(env);
+    s = (nvic_state *)qemu_mallocz(sizeof(nvic_state));
+    s->gic = gic_init(0xe000e000, &parent[ARM_PIC_CPU_IRQ]);
+    s->gic->nvic = s;
+    s->systick.timer = qemu_new_timer(vm_clock, systick_timer_tick, s);
+    if (env->v7m.nvic)
+        cpu_abort(env, "CPU can only have one NVIC\n");
+    env->v7m.nvic = s;
+    return s->gic->in;
+}
diff --git a/hw/audiodev.h b/hw/audiodev.h
new file mode 100644
index 000000000..18cdf6708
--- /dev/null
+++ b/hw/audiodev.h
@@ -0,0 +1,12 @@
+/* es1370.c */
+int es1370_init (PCIBus *bus, AudioState *s);
+
+/* sb16.c */
+int SB16_init (AudioState *s, qemu_irq *pic);
+
+/* adlib.c */
+int Adlib_init (AudioState *s, qemu_irq *pic);
+
+/* gus.c */
+int GUS_init (AudioState *s, qemu_irq *pic);
+
diff --git a/hw/boards.h b/hw/boards.h
new file mode 100644
index 000000000..079760d02
--- /dev/null
+++ b/hw/boards.h
@@ -0,0 +1,99 @@
+/* Declarations for use by board files for creating devices.  */
+
+#ifndef HW_BOARDS_H
+#define HW_BOARDS_H
+
+typedef void QEMUMachineInitFunc(ram_addr_t ram_size, int vga_ram_size,
+                                 const char *boot_device, DisplayState *ds,
+                                 const char *kernel_filename,
+                                 const char *kernel_cmdline,
+                                 const char *initrd_filename,
+                                 const char *cpu_model);
+
+typedef struct QEMUMachine {
+    const char *name;
+    const char *desc;
+    QEMUMachineInitFunc *init;
+    struct QEMUMachine *next;
+} QEMUMachine;
+
+int qemu_register_machine(QEMUMachine *m);
+
+/* Axis ETRAX.  */
+extern QEMUMachine bareetraxfs_machine;
+
+/* pc.c */
+extern QEMUMachine pc_machine;
+extern QEMUMachine isapc_machine;
+
+/* ppc.c */
+extern QEMUMachine prep_machine;
+extern QEMUMachine core99_machine;
+extern QEMUMachine heathrow_machine;
+extern QEMUMachine ref405ep_machine;
+extern QEMUMachine taihu_machine;
+
+/* mips_r4k.c */
+extern QEMUMachine mips_machine;
+
+/* mips_malta.c */
+extern QEMUMachine mips_malta_machine;
+
+/* mips_pica61.c */
+extern QEMUMachine mips_pica61_machine;
+
+/* mips_mipssim.c */
+extern QEMUMachine mips_mipssim_machine;
+
+/* shix.c */
+extern QEMUMachine shix_machine;
+
+/* r2d.c */
+extern QEMUMachine r2d_machine;
+
+/* sun4m.c */
+extern QEMUMachine ss5_machine, ss10_machine, ss600mp_machine, ss20_machine;
+
+/* sun4u.c */
+extern QEMUMachine sun4u_machine;
+
+/* integratorcp.c */
+extern QEMUMachine integratorcp_machine;
+
+/* versatilepb.c */
+extern QEMUMachine versatilepb_machine;
+extern QEMUMachine versatileab_machine;
+
+/* realview.c */
+extern QEMUMachine realview_machine;
+
+/* spitz.c */
+extern QEMUMachine akitapda_machine;
+extern QEMUMachine spitzpda_machine;
+extern QEMUMachine borzoipda_machine;
+extern QEMUMachine terrierpda_machine;
+
+/* palm.c */
+extern QEMUMachine palmte_machine;
+
+/* gumstix.c */
+extern QEMUMachine connex_machine;
+extern QEMUMachine verdex_machine;
+
+/* stellaris.c */
+extern QEMUMachine lm3s811evb_machine;
+extern QEMUMachine lm3s6965evb_machine;
+
+/* an5206.c */
+extern QEMUMachine an5206_machine;
+
+/* mcf5208.c */
+extern QEMUMachine mcf5208evb_machine;
+
+/* dummy_m68k.c */
+extern QEMUMachine dummy_m68k_machine;
+
+/* mainstone.c */
+extern QEMUMachine mainstone2_machine;
+
+#endif
diff --git a/hw/cdrom.c b/hw/cdrom.c
index 4f1fce18f..2aa4d3b25 100644
--- a/hw/cdrom.c
+++ b/hw/cdrom.c
@@ -25,7 +25,8 @@
 /* ??? Most of the ATAPI emulation is still in ide.c.  It should be moved
    here.  */
 
-#include <vl.h>
+#include "qemu-common.h"
+#include "scsi-disk.h"
 
 static void lba_to_msf(uint8_t *buf, int lba)
 {
diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
index 7438c18ab..ee7ec1c1e 100644
--- a/hw/cirrus_vga.c
+++ b/hw/cirrus_vga.c
@@ -26,7 +26,10 @@
  * Reference: Finn Thogersons' VGADOC4b
  *   available at http://home.worldonline.dk/~finth/
  */
-#include "vl.h"
+#include "hw.h"
+#include "pc.h"
+#include "pci.h"
+#include "console.h"
 #include "vga_int.h"
 #ifndef _WIN32
 #include <sys/mman.h>
@@ -3121,7 +3124,7 @@ static void cirrus_vga_save(QEMUFile *f, void *opaque)
     qemu_put_buffer(f, s->gr + 2, 254);
     qemu_put_8s(f, &s->ar_index);
     qemu_put_buffer(f, s->ar, 21);
-    qemu_put_be32s(f, &s->ar_flip_flop);
+    qemu_put_be32(f, s->ar_flip_flop);
     qemu_put_8s(f, &s->cr_index);
     qemu_put_buffer(f, s->cr, 256);
     qemu_put_8s(f, &s->msr);
@@ -3136,7 +3139,7 @@ static void cirrus_vga_save(QEMUFile *f, void *opaque)
     qemu_put_buffer(f, s->dac_cache, 3);
     qemu_put_buffer(f, s->palette, 768);
 
-    qemu_put_be32s(f, &s->bank_offset);
+    qemu_put_be32(f, s->bank_offset);
 
     qemu_put_8s(f, &s->cirrus_hidden_dac_lockindex);
     qemu_put_8s(f, &s->cirrus_hidden_dac_data);
@@ -3179,7 +3182,7 @@ static int cirrus_vga_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_buffer(f, s->gr + 2, 254);
     qemu_get_8s(f, &s->ar_index);
     qemu_get_buffer(f, s->ar, 21);
-    qemu_get_be32s(f, &s->ar_flip_flop);
+    s->ar_flip_flop=qemu_get_be32(f);
     qemu_get_8s(f, &s->cr_index);
     qemu_get_buffer(f, s->cr, 256);
     qemu_get_8s(f, &s->msr);
@@ -3194,7 +3197,7 @@ static int cirrus_vga_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_buffer(f, s->dac_cache, 3);
     qemu_get_buffer(f, s->palette, 768);
 
-    qemu_get_be32s(f, &s->bank_offset);
+    s->bank_offset=qemu_get_be32(f);
 
     qemu_get_8s(f, &s->cirrus_hidden_dac_lockindex);
     qemu_get_8s(f, &s->cirrus_hidden_dac_data);
diff --git a/hw/cs4231.c b/hw/cs4231.c
index 390ef746f..11a6add75 100644
--- a/hw/cs4231.c
+++ b/hw/cs4231.c
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "sun4m.h"
 
 /* debug CS4231 */
 //#define DEBUG_CS
@@ -79,11 +80,11 @@ static uint32_t cs_mem_readl(void *opaque, target_phys_addr_t addr)
             break;
         }
         DPRINTF("read dreg[%d]: 0x%8.8x\n", CS_RAP(s), ret);
-	break;
+        break;
     default:
         ret = s->regs[saddr];
         DPRINTF("read reg[%d]: 0x%8.8x\n", saddr, ret);
-	break;
+        break;
     }
     return ret;
 }
@@ -122,7 +123,7 @@ static void cs_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
         break;
     default:
         s->regs[saddr] = val;
-	break;
+        break;
     }
 }
 
diff --git a/hw/cuda.c b/hw/cuda.c
index 9a05aebb5..246c72d86 100644
--- a/hw/cuda.c
+++ b/hw/cuda.c
@@ -1,7 +1,8 @@
 /*
- * QEMU CUDA support
+ * QEMU PowerMac CUDA device support
  *
- * Copyright (c) 2004 Fabrice Bellard
+ * Copyright (c) 2004-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -21,7 +22,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "ppc_mac.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
 
 /* XXX: implement all timer modes */
 
@@ -634,10 +638,9 @@ static CPUReadMemoryFunc *cuda_read[] = {
     &cuda_readl,
 };
 
-int cuda_init(qemu_irq irq)
+void cuda_init (int *cuda_mem_index, qemu_irq irq)
 {
     CUDAState *s = &cuda_state;
-    int cuda_mem_index;
 
     s->irq = irq;
 
@@ -653,6 +656,5 @@ int cuda_init(qemu_irq irq)
     set_counter(s, &s->timers[1], 0xffff);
 
     s->adb_poll_timer = qemu_new_timer(vm_clock, cuda_adb_poll, s);
-    cuda_mem_index = cpu_register_io_memory(0, cuda_read, cuda_write, s);
-    return cuda_mem_index;
+    *cuda_mem_index = cpu_register_io_memory(0, cuda_read, cuda_write, s);
 }
diff --git a/hw/devices.h b/hw/devices.h
new file mode 100644
index 000000000..07c673b77
--- /dev/null
+++ b/hw/devices.h
@@ -0,0 +1,22 @@
+#ifndef QEMU_DEVICES_H
+#define QEMU_DEVICES_H
+
+/* Devices that have nowhere better to go.  */
+
+/* smc91c111.c */
+void smc91c111_init(NICInfo *, uint32_t, qemu_irq);
+
+/* ssd0323.c */
+int ssd0323_xfer_ssi(void *opaque, int data);
+void *ssd0323_init(DisplayState *ds, qemu_irq *cmd_p);
+
+/* ads7846.c */
+struct ads7846_state_s;
+uint32_t ads7846_read(void *opaque);
+void ads7846_write(void *opaque, uint32_t value);
+struct ads7846_state_s *ads7846_init(qemu_irq penirq);
+
+/* stellaris_input.c */
+void stellaris_gamepad_init(int n, qemu_irq *irq, const int *keycode);
+
+#endif
diff --git a/hw/dma.c b/hw/dma.c
index 2e8608cfc..1891b2278 100644
--- a/hw/dma.c
+++ b/hw/dma.c
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "isa.h"
 
 /* #define DEBUG_DMA */
 
@@ -481,12 +482,12 @@ static void dma_save (QEMUFile *f, void *opaque)
     qemu_put_8s (f, &d->command);
     qemu_put_8s (f, &d->mask);
     qemu_put_8s (f, &d->flip_flop);
-    qemu_put_be32s (f, &d->dshift);
+    qemu_put_be32 (f, d->dshift);
 
     for (i = 0; i < 4; ++i) {
         struct dma_regs *r = &d->regs[i];
-        qemu_put_be32s (f, &r->now[0]);
-        qemu_put_be32s (f, &r->now[1]);
+        qemu_put_be32 (f, r->now[0]);
+        qemu_put_be32 (f, r->now[1]);
         qemu_put_be16s (f, &r->base[0]);
         qemu_put_be16s (f, &r->base[1]);
         qemu_put_8s (f, &r->mode);
@@ -509,12 +510,12 @@ static int dma_load (QEMUFile *f, void *opaque, int version_id)
     qemu_get_8s (f, &d->command);
     qemu_get_8s (f, &d->mask);
     qemu_get_8s (f, &d->flip_flop);
-    qemu_get_be32s (f, &d->dshift);
+    d->dshift=qemu_get_be32 (f);
 
     for (i = 0; i < 4; ++i) {
         struct dma_regs *r = &d->regs[i];
-        qemu_get_be32s (f, &r->now[0]);
-        qemu_get_be32s (f, &r->now[1]);
+        r->now[0]=qemu_get_be32 (f);
+        r->now[1]=qemu_get_be32 (f);
         qemu_get_be16s (f, &r->base[0]);
         qemu_get_be16s (f, &r->base[1]);
         qemu_get_8s (f, &r->mode);
diff --git a/hw/ds1225y.c b/hw/ds1225y.c
index 7851096fa..8de20fb93 100644
--- a/hw/ds1225y.c
+++ b/hw/ds1225y.c
@@ -22,7 +22,9 @@
  * THE SOFTWARE.

  */

 

-#include "vl.h"

+#include "hw.h"

+#include "mips.h"

+#include "nvram.h"

 

 typedef enum

 {

diff --git a/hw/dummy_m68k.c b/hw/dummy_m68k.c
new file mode 100644
index 000000000..705d30425
--- /dev/null
+++ b/hw/dummy_m68k.c
@@ -0,0 +1,69 @@
+/*
+ * Dummy board with just RAM and CPU for use as an ISS.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ *
+ * This code is licenced under the GPL
+ */
+
+#include "hw.h"
+#include "sysemu.h"
+#include "boards.h"
+
+#define KERNEL_LOAD_ADDR 0x10000
+
+/* Board init.  */
+
+static void dummy_m68k_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
+                     const char *kernel_filename, const char *kernel_cmdline,
+                     const char *initrd_filename, const char *cpu_model)
+{
+    CPUState *env;
+    int kernel_size;
+    uint64_t elf_entry;
+    target_ulong entry;
+
+    if (!cpu_model)
+        cpu_model = "cfv4e";
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find m68k CPU definition\n");
+        exit(1);
+    }
+
+    /* Initialize CPU registers.  */
+    env->vbr = 0;
+
+    /* RAM at address zero */
+    cpu_register_physical_memory(0, ram_size,
+        qemu_ram_alloc(ram_size) | IO_MEM_RAM);
+
+    /* Load kernel.  */
+    if (kernel_filename) {
+        kernel_size = load_elf(kernel_filename, 0, &elf_entry, NULL, NULL);
+        entry = elf_entry;
+        if (kernel_size < 0) {
+            kernel_size = load_uboot(kernel_filename, &entry, NULL);
+        }
+        if (kernel_size < 0) {
+            kernel_size = load_image(kernel_filename,
+                                     phys_ram_base + KERNEL_LOAD_ADDR);
+            entry = KERNEL_LOAD_ADDR;
+        }
+        if (kernel_size < 0) {
+            fprintf(stderr, "qemu: could not load kernel '%s'\n",
+                    kernel_filename);
+            exit(1);
+        }
+    } else {
+        entry = 0;
+    }
+    env->pc = entry;
+}
+
+QEMUMachine dummy_m68k_machine = {
+    "dummy",
+    "Dummy board",
+    dummy_m68k_init,
+};
diff --git a/hw/ecc.c b/hw/ecc.c
index 970ede806..0e5f80c20 100644
--- a/hw/ecc.c
+++ b/hw/ecc.c
@@ -8,7 +8,8 @@
  * This code is licensed under the GNU GPL v2.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "flash.h"
 
 /*
  * Pre-calculated 256-way 1 byte column parity.  Table borrowed from Linux.
diff --git a/hw/eccmemctl.c b/hw/eccmemctl.c
new file mode 100755
index 000000000..0b44fabce
--- /dev/null
+++ b/hw/eccmemctl.c
@@ -0,0 +1,266 @@
+/*
+ * QEMU Sparc Sun4m ECC memory controller emulation
+ *
+ * Copyright (c) 2007 Robert Reif
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw.h"
+#include "sun4m.h"
+#include "sysemu.h"
+
+//#define DEBUG_ECC
+
+#ifdef DEBUG_ECC
+#define DPRINTF(fmt, args...)                           \
+    do { printf("ECC: " fmt , ##args); } while (0)
+#else
+#define DPRINTF(fmt, args...)
+#endif
+
+/* There are 3 versions of this chip used in SMP sun4m systems:
+ * MCC (version 0, implementation 0) SS-600MP
+ * EMC (version 0, implementation 1) SS-10
+ * SMC (version 0, implementation 2) SS-10SX and SS-20
+ */
+
+/* Register offsets */
+#define ECC_FCR_REG    0
+#define ECC_FSR_REG    8
+#define ECC_FAR0_REG   16
+#define ECC_FAR1_REG   20
+#define ECC_DIAG_REG   24
+
+/* ECC fault control register */
+#define ECC_FCR_EE     0x00000001      /* Enable ECC checking */
+#define ECC_FCR_EI     0x00000010      /* Enable Interrupts on correctable errors */
+#define ECC_FCR_VER    0x0f000000      /* Version */
+#define ECC_FCR_IMPL   0xf0000000      /* Implementation */
+
+/* ECC fault status register */
+#define ECC_FSR_CE     0x00000001      /* Correctable error */
+#define ECC_FSR_BS     0x00000002      /* C2 graphics bad slot access */
+#define ECC_FSR_TO     0x00000004      /* Timeout on write */
+#define ECC_FSR_UE     0x00000008      /* Uncorrectable error */
+#define ECC_FSR_DW     0x000000f0      /* Index of double word in block */
+#define ECC_FSR_SYND   0x0000ff00      /* Syndrome for correctable error */
+#define ECC_FSR_ME     0x00010000      /* Multiple errors */
+#define ECC_FSR_C2ERR  0x00020000      /* C2 graphics error */
+
+/* ECC fault address register 0 */
+#define ECC_FAR0_PADDR 0x0000000f      /* PA[32-35] */
+#define ECC_FAR0_TYPE  0x000000f0      /* Transaction type */
+#define ECC_FAR0_SIZE  0x00000700      /* Transaction size */
+#define ECC_FAR0_CACHE 0x00000800      /* Mapped cacheable */
+#define ECC_FAR0_LOCK  0x00001000      /* Error occurred in attomic cycle */
+#define ECC_FAR0_BMODE 0x00002000      /* Boot mode */
+#define ECC_FAR0_VADDR 0x003fc000      /* VA[12-19] (superset bits) */
+#define ECC_FAR0_S     0x08000000      /* Supervisor mode */
+#define ECC_FARO_MID   0xf0000000      /* Module ID */
+
+/* ECC diagnostic register */
+#define ECC_DIAG_CBX   0x00000001
+#define ECC_DIAG_CB0   0x00000002
+#define ECC_DIAG_CB1   0x00000004
+#define ECC_DIAG_CB2   0x00000008
+#define ECC_DIAG_CB4   0x00000010
+#define ECC_DIAG_CB8   0x00000020
+#define ECC_DIAG_CB16  0x00000040
+#define ECC_DIAG_CB32  0x00000080
+#define ECC_DIAG_DMODE 0x00000c00
+
+#define ECC_NREGS      8
+#define ECC_SIZE       (ECC_NREGS * sizeof(uint32_t))
+#define ECC_ADDR_MASK  (ECC_SIZE - 1)
+
+typedef struct ECCState {
+    uint32_t regs[ECC_NREGS];
+} ECCState;
+
+static void ecc_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
+{
+    printf("ECC: Unsupported write 0x" TARGET_FMT_plx " %02x\n",
+           addr, val & 0xff);
+}
+
+static uint32_t ecc_mem_readb(void *opaque, target_phys_addr_t addr)
+{
+    printf("ECC: Unsupported read 0x" TARGET_FMT_plx " 00\n", addr);
+    return 0;
+}
+
+static void ecc_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
+{
+    printf("ECC: Unsupported write 0x" TARGET_FMT_plx " %04x\n",
+           addr, val & 0xffff);
+}
+
+static uint32_t ecc_mem_readw(void *opaque, target_phys_addr_t addr)
+{
+    printf("ECC: Unsupported read 0x" TARGET_FMT_plx " 0000\n", addr);
+    return 0;
+}
+
+static void ecc_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
+{
+    ECCState *s = opaque;
+
+    switch (addr & ECC_ADDR_MASK) {
+    case ECC_FCR_REG:
+        s->regs[0] = (s->regs[0] & (ECC_FCR_VER | ECC_FCR_IMPL)) |
+                     (val & ~(ECC_FCR_VER | ECC_FCR_IMPL));
+        DPRINTF("Write fault control %08x\n", val);
+        break;
+    case 4:
+        s->regs[1] =  val;
+        DPRINTF("Write reg[1] %08x\n", val);
+        break;
+    case ECC_FSR_REG:
+        s->regs[2] =  val;
+        DPRINTF("Write fault status %08x\n", val);
+        break;
+    case 12:
+        s->regs[3] =  val;
+        DPRINTF("Write reg[3] %08x\n", val);
+        break;
+    case ECC_FAR0_REG:
+        s->regs[4] =  val;
+        DPRINTF("Write fault address 0 %08x\n", val);
+        break;
+    case ECC_FAR1_REG:
+        s->regs[5] =  val;
+        DPRINTF("Write fault address 1 %08x\n", val);
+        break;
+    case ECC_DIAG_REG:
+        s->regs[6] =  val;
+        DPRINTF("Write diag %08x\n", val);
+        break;
+    case 28:
+        s->regs[7] =  val;
+        DPRINTF("Write reg[7] %08x\n", val);
+        break;
+    }
+}
+
+static uint32_t ecc_mem_readl(void *opaque, target_phys_addr_t addr)
+{
+    ECCState *s = opaque;
+    uint32_t ret = 0;
+
+    switch (addr & ECC_ADDR_MASK) {
+    case ECC_FCR_REG:
+        ret = s->regs[0];
+        DPRINTF("Read enable %08x\n", ret);
+        break;
+    case 4:
+        ret = s->regs[1];
+        DPRINTF("Read register[1] %08x\n", ret);
+        break;
+    case ECC_FSR_REG:
+        ret = s->regs[2];
+        DPRINTF("Read fault status %08x\n", ret);
+        break;
+    case 12:
+        ret = s->regs[3];
+        DPRINTF("Read reg[3] %08x\n", ret);
+        break;
+    case ECC_FAR0_REG:
+        ret = s->regs[4];
+        DPRINTF("Read fault address 0 %08x\n", ret);
+        break;
+    case ECC_FAR1_REG:
+        ret = s->regs[5];
+        DPRINTF("Read fault address 1 %08x\n", ret);
+        break;
+    case ECC_DIAG_REG:
+        ret = s->regs[6];
+        DPRINTF("Read diag %08x\n", ret);
+        break;
+    case 28:
+        ret = s->regs[7];
+        DPRINTF("Read reg[7] %08x\n", ret);
+        break;
+    }
+    return ret;
+}
+
+static CPUReadMemoryFunc *ecc_mem_read[3] = {
+    ecc_mem_readb,
+    ecc_mem_readw,
+    ecc_mem_readl,
+};
+
+static CPUWriteMemoryFunc *ecc_mem_write[3] = {
+    ecc_mem_writeb,
+    ecc_mem_writew,
+    ecc_mem_writel,
+};
+
+static int ecc_load(QEMUFile *f, void *opaque, int version_id)
+{
+    ECCState *s = opaque;
+    int i;
+
+    if (version_id != 1)
+        return -EINVAL;
+
+    for (i = 0; i < ECC_NREGS; i++)
+        qemu_get_be32s(f, &s->regs[i]);
+
+    return 0;
+}
+
+static void ecc_save(QEMUFile *f, void *opaque)
+{
+    ECCState *s = opaque;
+    int i;
+
+    for (i = 0; i < ECC_NREGS; i++)
+        qemu_put_be32s(f, &s->regs[i]);
+}
+
+static void ecc_reset(void *opaque)
+{
+    ECCState *s = opaque;
+    int i;
+
+    s->regs[ECC_FCR_REG] &= (ECC_FCR_VER | ECC_FCR_IMPL);
+
+    for (i = 1; i < ECC_NREGS; i++)
+        s->regs[i] = 0;
+}
+
+void * ecc_init(target_phys_addr_t base, uint32_t version)
+{
+    int ecc_io_memory;
+    ECCState *s;
+
+    s = qemu_mallocz(sizeof(ECCState));
+    if (!s)
+        return NULL;
+
+    s->regs[0] = version;
+
+    ecc_io_memory = cpu_register_io_memory(0, ecc_mem_read, ecc_mem_write, s);
+    cpu_register_physical_memory(base, ECC_SIZE, ecc_io_memory);
+    register_savevm("ECC", base, 1, ecc_save, ecc_load, s);
+    qemu_register_reset(ecc_reset, s);
+    ecc_reset(s);
+    return s;
+}
diff --git a/hw/eepro100.c b/hw/eepro100.c
index 975aeb172..84d1e52ac 100644
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -40,7 +40,9 @@
 
 #include <assert.h>
 #include <stddef.h>             /* offsetof */
-#include "vl.h"
+#include "hw.h"
+#include "pci.h"
+#include "net.h"
 #include "eeprom93xx.h"
 
 /* Common declarations for all PCI devices. */
diff --git a/hw/eeprom93xx.c b/hw/eeprom93xx.c
index 14f018914..896cffd44 100644
--- a/hw/eeprom93xx.c
+++ b/hw/eeprom93xx.c
@@ -37,6 +37,7 @@
  */
 
 #include <assert.h>
+#include "hw.h"
 #include "eeprom93xx.h"
 
 /* Debug EEPROM emulation. */
diff --git a/hw/eeprom93xx.h b/hw/eeprom93xx.h
index fde4912e8..4e257f6e8 100644
--- a/hw/eeprom93xx.h
+++ b/hw/eeprom93xx.h
@@ -21,8 +21,6 @@
 #ifndef EEPROM93XX_H
 #define EEPROM93XX_H
 
-#include "vl.h"
-
 typedef struct _eeprom_t eeprom_t;
 
 /* Create a new EEPROM with (nwords * 2) bytes. */
diff --git a/hw/es1370.c b/hw/es1370.c
index d607a9485..754f621a1 100644
--- a/hw/es1370.c
+++ b/hw/es1370.c
@@ -26,7 +26,10 @@
 /* #define VERBOSE_ES1370 */
 #define SILENT_ES1370
 
-#include "vl.h"
+#include "hw.h"
+#include "audiodev.h"
+#include "audio/audio.h"
+#include "pci.h"
 
 /* Missing stuff:
    SCTRL_P[12](END|ST)INC
diff --git a/hw/esp.c b/hw/esp.c
index 943a159e0..df7a5e166 100644
--- a/hw/esp.c
+++ b/hw/esp.c
@@ -21,14 +21,19 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "block.h"
+#include "scsi-disk.h"
+#include "sun4m.h"
+/* FIXME: Only needed for MAX_DISKS, which is probably wrong.  */
+#include "sysemu.h"
 
 /* debug ESP card */
 //#define DEBUG_ESP
 
 /*
- * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O), also
- * produced as NCR89C100. See
+ * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
+ * also produced as NCR89C100. See
  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
  * and
  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
@@ -45,14 +50,11 @@ do { printf("ESP: " fmt , ##args); } while (0)
 #define ESP_REGS 16
 #define ESP_SIZE (ESP_REGS * 4)
 #define TI_BUFSZ 32
-/* The HBA is ID 7, so for simplicitly limit to 7 devices.  */
-#define ESP_MAX_DEVS      7
 
 typedef struct ESPState ESPState;
 
 struct ESPState {
     qemu_irq irq;
-    BlockDriverState **bd;
     uint8_t rregs[ESP_REGS];
     uint8_t wregs[ESP_REGS];
     int32_t ti_size;
@@ -60,7 +62,7 @@ struct ESPState {
     uint8_t ti_buf[TI_BUFSZ];
     int sense;
     int dma;
-    SCSIDevice *scsi_dev[MAX_DISKS];
+    SCSIDevice *scsi_dev[ESP_MAX_DEVS];
     SCSIDevice *current_dev;
     uint8_t cmdbuf[TI_BUFSZ];
     int cmdlen;
@@ -76,12 +78,51 @@ struct ESPState {
     void *dma_opaque;
 };
 
+#define ESP_TCLO   0x0
+#define ESP_TCMID  0x1
+#define ESP_FIFO   0x2
+#define ESP_CMD    0x3
+#define ESP_RSTAT  0x4
+#define ESP_WBUSID 0x4
+#define ESP_RINTR  0x5
+#define ESP_WSEL   0x5
+#define ESP_RSEQ   0x6
+#define ESP_WSYNTP 0x6
+#define ESP_RFLAGS 0x7
+#define ESP_WSYNO  0x7
+#define ESP_CFG1   0x8
+#define ESP_RRES1  0x9
+#define ESP_WCCF   0x9
+#define ESP_RRES2  0xa
+#define ESP_WTEST  0xa
+#define ESP_CFG2   0xb
+#define ESP_CFG3   0xc
+#define ESP_RES3   0xd
+#define ESP_TCHI   0xe
+#define ESP_RES4   0xf
+
+#define CMD_DMA 0x80
+#define CMD_CMD 0x7f
+
+#define CMD_NOP      0x00
+#define CMD_FLUSH    0x01
+#define CMD_RESET    0x02
+#define CMD_BUSRESET 0x03
+#define CMD_TI       0x10
+#define CMD_ICCS     0x11
+#define CMD_MSGACC   0x12
+#define CMD_SATN     0x1a
+#define CMD_SELATN   0x42
+#define CMD_SELATNS  0x43
+#define CMD_ENSEL    0x44
+
 #define STAT_DO 0x00
 #define STAT_DI 0x01
 #define STAT_CD 0x02
 #define STAT_ST 0x03
 #define STAT_MI 0x06
 #define STAT_MO 0x07
+#define STAT_PIO_MASK 0x06
 
 #define STAT_TC 0x10
 #define STAT_PE 0x20
@@ -96,20 +137,26 @@ struct ESPState {
 #define SEQ_0 0x0
 #define SEQ_CD 0x4
 
+#define CFG1_RESREPT 0x40
+
+#define CFG2_MASK 0x15
+
+#define TCHI_FAS100A 0x4
+
 static int get_cmd(ESPState *s, uint8_t *buf)
 {
     uint32_t dmalen;
     int target;
 
-    dmalen = s->rregs[0] | (s->rregs[1] << 8);
-    target = s->wregs[4] & 7;
+    dmalen = s->rregs[ESP_TCLO] | (s->rregs[ESP_TCMID] << 8);
+    target = s->wregs[ESP_WBUSID] & 7;
     DPRINTF("get_cmd: len %d target %d\n", dmalen, target);
     if (s->dma) {
         espdma_memory_read(s->dma_opaque, buf, dmalen);
     } else {
-	buf[0] = 0;
-	memcpy(&buf[1], s->ti_buf, dmalen);
-	dmalen++;
+        buf[0] = 0;
+        memcpy(&buf[1], s->ti_buf, dmalen);
+        dmalen++;
     }
 
     s->ti_size = 0;
@@ -118,17 +165,17 @@ static int get_cmd(ESPState *s, uint8_t *buf)
 
     if (s->current_dev) {
         /* Started a new command before the old one finished.  Cancel it.  */
-        scsi_cancel_io(s->current_dev, 0);
+        s->current_dev->cancel_io(s->current_dev, 0);
         s->async_len = 0;
     }
 
-    if (target >= MAX_DISKS || !s->scsi_dev[target]) {
+    if (target >= ESP_MAX_DEVS || !s->scsi_dev[target]) {
         // No such drive
-	s->rregs[4] = STAT_IN;
-	s->rregs[5] = INTR_DC;
-	s->rregs[6] = SEQ_0;
-	qemu_irq_raise(s->irq);
-	return 0;
+        s->rregs[ESP_RSTAT] = STAT_IN;
+        s->rregs[ESP_RINTR] = INTR_DC;
+        s->rregs[ESP_RSEQ] = SEQ_0;
+        qemu_irq_raise(s->irq);
+        return 0;
     }
     s->current_dev = s->scsi_dev[target];
     return dmalen;
@@ -141,22 +188,22 @@ static void do_cmd(ESPState *s, uint8_t *buf)
 
     DPRINTF("do_cmd: busid 0x%x\n", buf[0]);
     lun = buf[0] & 7;
-    datalen = scsi_send_command(s->current_dev, 0, &buf[1], lun);
+    datalen = s->current_dev->send_command(s->current_dev, 0, &buf[1], lun);
     s->ti_size = datalen;
     if (datalen != 0) {
-        s->rregs[4] = STAT_IN | STAT_TC;
+        s->rregs[ESP_RSTAT] = STAT_IN | STAT_TC;
         s->dma_left = 0;
         s->dma_counter = 0;
         if (datalen > 0) {
-            s->rregs[4] |= STAT_DI;
-            scsi_read_data(s->current_dev, 0);
+            s->rregs[ESP_RSTAT] |= STAT_DI;
+            s->current_dev->read_data(s->current_dev, 0);
         } else {
-            s->rregs[4] |= STAT_DO;
-            scsi_write_data(s->current_dev, 0);
+            s->rregs[ESP_RSTAT] |= STAT_DO;
+            s->current_dev->write_data(s->current_dev, 0);
         }
     }
-    s->rregs[5] = INTR_BS | INTR_FC;
-    s->rregs[6] = SEQ_CD;
+    s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
+    s->rregs[ESP_RSEQ] = SEQ_CD;
     qemu_irq_raise(s->irq);
 }
 
@@ -176,9 +223,9 @@ static void handle_satn_stop(ESPState *s)
     if (s->cmdlen) {
         DPRINTF("Set ATN & Stop: cmdlen %d\n", s->cmdlen);
         s->do_cmd = 1;
-        s->rregs[4] = STAT_IN | STAT_TC | STAT_CD;
-        s->rregs[5] = INTR_BS | INTR_FC;
-        s->rregs[6] = SEQ_CD;
+        s->rregs[ESP_RSTAT] = STAT_IN | STAT_TC | STAT_CD;
+        s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
+        s->rregs[ESP_RSEQ] = SEQ_CD;
         qemu_irq_raise(s->irq);
     }
 }
@@ -190,26 +237,26 @@ static void write_response(ESPState *s)
     s->ti_buf[1] = 0;
     if (s->dma) {
         espdma_memory_write(s->dma_opaque, s->ti_buf, 2);
-	s->rregs[4] = STAT_IN | STAT_TC | STAT_ST;
-	s->rregs[5] = INTR_BS | INTR_FC;
-	s->rregs[6] = SEQ_CD;
+        s->rregs[ESP_RSTAT] = STAT_IN | STAT_TC | STAT_ST;
+        s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
+        s->rregs[ESP_RSEQ] = SEQ_CD;
     } else {
-	s->ti_size = 2;
-	s->ti_rptr = 0;
-	s->ti_wptr = 0;
-	s->rregs[7] = 2;
+        s->ti_size = 2;
+        s->ti_rptr = 0;
+        s->ti_wptr = 0;
+        s->rregs[ESP_RFLAGS] = 2;
     }
     qemu_irq_raise(s->irq);
 }
 
 static void esp_dma_done(ESPState *s)
 {
-    s->rregs[4] |= STAT_IN | STAT_TC;
-    s->rregs[5] = INTR_BS;
-    s->rregs[6] = 0;
-    s->rregs[7] = 0;
-    s->rregs[0] = 0;
-    s->rregs[1] = 0;
+    s->rregs[ESP_RSTAT] |= STAT_IN | STAT_TC;
+    s->rregs[ESP_RINTR] = INTR_BS;
+    s->rregs[ESP_RSEQ] = 0;
+    s->rregs[ESP_RFLAGS] = 0;
+    s->rregs[ESP_TCLO] = 0;
+    s->rregs[ESP_TCMID] = 0;
     qemu_irq_raise(s->irq);
 }
 
@@ -251,9 +298,9 @@ static void esp_do_dma(ESPState *s)
     if (s->async_len == 0) {
         if (to_device) {
             // ti_size is negative
-            scsi_write_data(s->current_dev, 0);
+            s->current_dev->write_data(s->current_dev, 0);
         } else {
-            scsi_read_data(s->current_dev, 0);
+            s->current_dev->read_data(s->current_dev, 0);
             /* If there is still data to be read from the device then
                complete the DMA operation immeriately.  Otherwise defer
                until the scsi layer has completed.  */
@@ -282,13 +329,13 @@ static void esp_command_complete(void *opaque, int reason, uint32_t tag,
         if (arg)
             DPRINTF("Command failed\n");
         s->sense = arg;
-        s->rregs[4] = STAT_ST;
+        s->rregs[ESP_RSTAT] = STAT_ST;
         esp_dma_done(s);
         s->current_dev = NULL;
     } else {
         DPRINTF("transfer %d/%d\n", s->dma_left, s->ti_size);
         s->async_len = arg;
-        s->async_buf = scsi_get_buf(s->current_dev, 0);
+        s->async_buf = s->current_dev->get_buf(s->current_dev, 0);
         if (s->dma_left) {
             esp_do_dma(s);
         } else if (s->dma_counter != 0 && s->ti_size <= 0) {
@@ -303,7 +350,7 @@ static void handle_ti(ESPState *s)
 {
     uint32_t dmalen, minlen;
 
-    dmalen = s->rregs[0] | (s->rregs[1] << 8);
+    dmalen = s->rregs[ESP_TCLO] | (s->rregs[ESP_TCMID] << 8);
     if (dmalen==0) {
       dmalen=0x10000;
     }
@@ -318,7 +365,7 @@ static void handle_ti(ESPState *s)
     DPRINTF("Transfer Information len %d\n", minlen);
     if (s->dma) {
         s->dma_left = minlen;
-        s->rregs[4] &= ~STAT_TC;
+        s->rregs[ESP_RSTAT] &= ~STAT_TC;
         esp_do_dma(s);
     } else if (s->do_cmd) {
         DPRINTF("command len %d\n", s->cmdlen);
@@ -336,7 +383,7 @@ static void esp_reset(void *opaque)
 
     memset(s->rregs, 0, ESP_REGS);
     memset(s->wregs, 0, ESP_REGS);
-    s->rregs[0x0e] = 0x4; // Indicate fas100a
+    s->rregs[ESP_TCHI] = TCHI_FAS100A; // Indicate fas100a
     s->ti_size = 0;
     s->ti_rptr = 0;
     s->ti_wptr = 0;
@@ -358,32 +405,30 @@ static uint32_t esp_mem_readb(void *opaque, target_phys_addr_t addr)
     saddr = (addr & ESP_MASK) >> 2;
     DPRINTF("read reg[%d]: 0x%2.2x\n", saddr, s->rregs[saddr]);
     switch (saddr) {
-    case 2:
-	// FIFO
-	if (s->ti_size > 0) {
-	    s->ti_size--;
-            if ((s->rregs[4] & 6) == 0) {
+    case ESP_FIFO:
+        if (s->ti_size > 0) {
+            s->ti_size--;
+            if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
                 /* Data in/out.  */
                 fprintf(stderr, "esp: PIO data read not implemented\n");
-                s->rregs[2] = 0;
+                s->rregs[ESP_FIFO] = 0;
             } else {
-                s->rregs[2] = s->ti_buf[s->ti_rptr++];
+                s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
             }
             qemu_irq_raise(s->irq);
-	}
-	if (s->ti_size == 0) {
+        }
+        if (s->ti_size == 0) {
             s->ti_rptr = 0;
             s->ti_wptr = 0;
         }
-	break;
-    case 5:
-        // interrupt
+        break;
+    case ESP_RINTR:
         // Clear interrupt/error status bits
-        s->rregs[4] &= ~(STAT_IN | STAT_GE | STAT_PE);
-	qemu_irq_lower(s->irq);
+        s->rregs[ESP_RSTAT] &= ~(STAT_IN | STAT_GE | STAT_PE);
+        qemu_irq_lower(s->irq);
         break;
     default:
-	break;
+        break;
     }
     return s->rregs[saddr];
 }
@@ -394,17 +439,17 @@ static void esp_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
     uint32_t saddr;
 
     saddr = (addr & ESP_MASK) >> 2;
-    DPRINTF("write reg[%d]: 0x%2.2x -> 0x%2.2x\n", saddr, s->wregs[saddr], val);
+    DPRINTF("write reg[%d]: 0x%2.2x -> 0x%2.2x\n", saddr, s->wregs[saddr],
+            val);
     switch (saddr) {
-    case 0:
-    case 1:
-        s->rregs[4] &= ~STAT_TC;
+    case ESP_TCLO:
+    case ESP_TCMID:
+        s->rregs[ESP_RSTAT] &= ~STAT_TC;
         break;
-    case 2:
-	// FIFO
+    case ESP_FIFO:
         if (s->do_cmd) {
             s->cmdbuf[s->cmdlen++] = val & 0xff;
-        } else if ((s->rregs[4] & 6) == 0) {
+        } else if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
             uint8_t buf;
             buf = val & 0xff;
             s->ti_size--;
@@ -413,86 +458,85 @@ static void esp_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
             s->ti_size++;
             s->ti_buf[s->ti_wptr++] = val & 0xff;
         }
-	break;
-    case 3:
+        break;
+    case ESP_CMD:
         s->rregs[saddr] = val;
-	// Command
-	if (val & 0x80) {
-	    s->dma = 1;
+        if (val & CMD_DMA) {
+            s->dma = 1;
             /* Reload DMA counter.  */
-            s->rregs[0] = s->wregs[0];
-            s->rregs[1] = s->wregs[1];
-	} else {
-	    s->dma = 0;
-	}
-	switch(val & 0x7f) {
-	case 0:
-	    DPRINTF("NOP (%2.2x)\n", val);
-	    break;
-	case 1:
-	    DPRINTF("Flush FIFO (%2.2x)\n", val);
+            s->rregs[ESP_TCLO] = s->wregs[ESP_TCLO];
+            s->rregs[ESP_TCMID] = s->wregs[ESP_TCMID];
+        } else {
+            s->dma = 0;
+        }
+        switch(val & CMD_CMD) {
+        case CMD_NOP:
+            DPRINTF("NOP (%2.2x)\n", val);
+            break;
+        case CMD_FLUSH:
+            DPRINTF("Flush FIFO (%2.2x)\n", val);
             //s->ti_size = 0;
-	    s->rregs[5] = INTR_FC;
-	    s->rregs[6] = 0;
-	    break;
-	case 2:
-	    DPRINTF("Chip reset (%2.2x)\n", val);
-	    esp_reset(s);
-	    break;
-	case 3:
-	    DPRINTF("Bus reset (%2.2x)\n", val);
-	    s->rregs[5] = INTR_RST;
-            if (!(s->wregs[8] & 0x40)) {
+            s->rregs[ESP_RINTR] = INTR_FC;
+            s->rregs[ESP_RSEQ] = 0;
+            break;
+        case CMD_RESET:
+            DPRINTF("Chip reset (%2.2x)\n", val);
+            esp_reset(s);
+            break;
+        case CMD_BUSRESET:
+            DPRINTF("Bus reset (%2.2x)\n", val);
+            s->rregs[ESP_RINTR] = INTR_RST;
+            if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
                 qemu_irq_raise(s->irq);
             }
-	    break;
-	case 0x10:
-	    handle_ti(s);
-	    break;
-	case 0x11:
-	    DPRINTF("Initiator Command Complete Sequence (%2.2x)\n", val);
-	    write_response(s);
-	    break;
-	case 0x12:
-	    DPRINTF("Message Accepted (%2.2x)\n", val);
-	    write_response(s);
-	    s->rregs[5] = INTR_DC;
-	    s->rregs[6] = 0;
-	    break;
-	case 0x1a:
-	    DPRINTF("Set ATN (%2.2x)\n", val);
-	    break;
-	case 0x42:
-	    DPRINTF("Set ATN (%2.2x)\n", val);
-	    handle_satn(s);
-	    break;
-	case 0x43:
-	    DPRINTF("Set ATN & stop (%2.2x)\n", val);
-	    handle_satn_stop(s);
-	    break;
-        case 0x44:
+            break;
+        case CMD_TI:
+            handle_ti(s);
+            break;
+        case CMD_ICCS:
+            DPRINTF("Initiator Command Complete Sequence (%2.2x)\n", val);
+            write_response(s);
+            break;
+        case CMD_MSGACC:
+            DPRINTF("Message Accepted (%2.2x)\n", val);
+            write_response(s);
+            s->rregs[ESP_RINTR] = INTR_DC;
+            s->rregs[ESP_RSEQ] = 0;
+            break;
+        case CMD_SATN:
+            DPRINTF("Set ATN (%2.2x)\n", val);
+            break;
+        case CMD_SELATN:
+            DPRINTF("Set ATN (%2.2x)\n", val);
+            handle_satn(s);
+            break;
+        case CMD_SELATNS:
+            DPRINTF("Set ATN & stop (%2.2x)\n", val);
+            handle_satn_stop(s);
+            break;
+        case CMD_ENSEL:
             DPRINTF("Enable selection (%2.2x)\n", val);
             break;
-	default:
-	    DPRINTF("Unhandled ESP command (%2.2x)\n", val);
-	    break;
-	}
-	break;
-    case 4 ... 7:
-	break;
-    case 8:
+        default:
+            DPRINTF("Unhandled ESP command (%2.2x)\n", val);
+            break;
+        }
+        break;
+    case ESP_WBUSID ... ESP_WSYNO:
+        break;
+    case ESP_CFG1:
         s->rregs[saddr] = val;
         break;
-    case 9 ... 10:
+    case ESP_WCCF ... ESP_WTEST:
         break;
-    case 11:
-        s->rregs[saddr] = val & 0x15;
+    case ESP_CFG2:
+        s->rregs[saddr] = val & CFG2_MASK;
         break;
-    case 12 ... 15:
+    case ESP_CFG3 ... ESP_RES4:
         s->rregs[saddr] = val;
         break;
     default:
-	break;
+        break;
     }
     s->wregs[saddr] = val;
 }
@@ -567,14 +611,14 @@ void esp_scsi_attach(void *opaque, BlockDriverState *bd, int id)
     }
     if (s->scsi_dev[id]) {
         DPRINTF("Destroying device %d\n", id);
-        scsi_disk_destroy(s->scsi_dev[id]);
+        s->scsi_dev[id]->destroy(s->scsi_dev[id]);
     }
     DPRINTF("Attaching block device %d\n", id);
     /* Command queueing is not implemented.  */
     s->scsi_dev[id] = scsi_disk_init(bd, 0, esp_command_complete, s);
 }
 
-void *esp_init(BlockDriverState **bd, target_phys_addr_t espaddr,
+void *esp_init(target_phys_addr_t espaddr,
                void *dma_opaque, qemu_irq irq, qemu_irq *reset)
 {
     ESPState *s;
@@ -584,7 +628,6 @@ void *esp_init(BlockDriverState **bd, target_phys_addr_t espaddr,
     if (!s)
         return NULL;
 
-    s->bd = bd;
     s->irq = irq;
     s->dma_opaque = dma_opaque;
 
diff --git a/hw/etraxfs.c b/hw/etraxfs.c
new file mode 100644
index 000000000..dfef962d8
--- /dev/null
+++ b/hw/etraxfs.c
@@ -0,0 +1,180 @@
+/*
+ * QEMU ETRAX System Emulator
+ *
+ * Copyright (c) 2007 Edgar E. Iglesias, Axis Communications AB.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include <time.h>
+#include <sys/time.h>
+#include "hw.h"
+#include "sysemu.h"
+#include "boards.h"
+
+extern FILE *logfile;
+
+static void main_cpu_reset(void *opaque)
+{
+    CPUState *env = opaque;
+    cpu_reset(env);
+}
+
+static uint32_t fs_mmio_readb (void *opaque, target_phys_addr_t addr)
+{
+	CPUState *env = opaque;
+	uint32_t r = 0;
+	printf ("%s %x pc=%x\n", __func__, addr, env->pc);
+	return r;
+}
+static uint32_t fs_mmio_readw (void *opaque, target_phys_addr_t addr)
+{
+	CPUState *env = opaque;
+	uint32_t r = 0;
+	printf ("%s %x pc=%x\n", __func__, addr, env->pc);
+	return r;
+}
+
+static uint32_t fs_mmio_readl (void *opaque, target_phys_addr_t addr)
+{
+	CPUState *env = opaque;
+	uint32_t r = 0;
+	printf ("%s %x p=%x\n", __func__, addr, env->pc);
+	return r;
+}
+
+static void
+fs_mmio_writeb (void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+	CPUState *env = opaque;
+	printf ("%s %x %x pc=%x\n", __func__, addr, value, env->pc);
+}
+static void
+fs_mmio_writew (void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+	CPUState *env = opaque;
+	printf ("%s %x %x pc=%x\n", __func__, addr, value, env->pc);
+}
+static void
+fs_mmio_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+	CPUState *env = opaque;
+	printf ("%s %x %x pc=%x\n", __func__, addr, value, env->pc);
+}
+
+static CPUReadMemoryFunc *fs_mmio_read[] = {
+    &fs_mmio_readb,
+    &fs_mmio_readw,
+    &fs_mmio_readl,
+};
+
+static CPUWriteMemoryFunc *fs_mmio_write[] = {
+    &fs_mmio_writeb,
+    &fs_mmio_writew,
+    &fs_mmio_writel,
+};
+
+
+/* Init functions for different blocks.  */
+extern void etraxfs_timer_init(CPUState *env, qemu_irq *irqs);
+extern void etraxfs_ser_init(CPUState *env, qemu_irq *irqs);
+
+void etrax_ack_irq(CPUState *env, uint32_t mask)
+{
+	env->pending_interrupts &= ~mask;
+}
+
+static void dummy_cpu_set_irq(void *opaque, int irq, int level)
+{
+	CPUState *env = opaque;
+
+	/* Hmm, should this really be done here?  */
+	env->pending_interrupts |= 1 << irq;
+	cpu_interrupt(env, CPU_INTERRUPT_HARD);
+}
+
+static
+void bareetraxfs_init (int ram_size, int vga_ram_size,
+                       const char *boot_device, DisplayState *ds,
+                       const char *kernel_filename, const char *kernel_cmdline,
+                       const char *initrd_filename, const char *cpu_model)
+{
+    CPUState *env;
+    qemu_irq *irqs;
+    int kernel_size;
+    int internal_regs;
+
+    /* init CPUs */
+    if (cpu_model == NULL) {
+        cpu_model = "crisv32";
+    }
+    env = cpu_init(cpu_model);
+/*    register_savevm("cpu", 0, 3, cpu_save, cpu_load, env); */
+    qemu_register_reset(main_cpu_reset, env);
+    irqs = qemu_allocate_irqs(dummy_cpu_set_irq, env, 32);
+
+    internal_regs = cpu_register_io_memory(0,
+					   fs_mmio_read, fs_mmio_write, env);
+    /* 0xb0050000 is the last reg.  */
+    cpu_register_physical_memory (0xac000000, 0x4010000, internal_regs);
+    /* allocate RAM */
+    cpu_register_physical_memory(0x40000000, ram_size, IO_MEM_RAM);
+
+    etraxfs_timer_init(env, irqs);
+    etraxfs_ser_init(env, irqs);
+
+    kernel_size = load_image(kernel_filename, phys_ram_base + 0x4000);
+    /* magic for boot.  */
+    env->regs[8] = 0x56902387;
+    env->regs[9] = 0x40004000 + kernel_size;
+    env->pc = 0x40004000;
+
+    {
+       unsigned char *ptr = phys_ram_base + 0x4000;
+       int i;
+       for (i = 0; i < 8; i++)
+       {
+		printf ("%2.2x ", ptr[i]);
+       }
+	printf("\n");
+    }
+
+    printf ("pc =%x\n", env->pc);
+    printf ("ram size =%d\n", ram_size);
+    printf ("kernel name =%s\n", kernel_filename);
+    printf ("kernel size =%d\n", kernel_size);
+    printf ("cpu haltd =%d\n", env->halted);
+}
+
+void DMA_run(void)
+{
+}
+
+void pic_info()
+{
+}
+
+void irq_info()
+{
+}
+
+QEMUMachine bareetraxfs_machine = {
+    "bareetraxfs",
+    "Bare ETRAX FS board",
+    bareetraxfs_init,
+};
diff --git a/hw/etraxfs_ser.c b/hw/etraxfs_ser.c
new file mode 100644
index 000000000..bb2aeb76a
--- /dev/null
+++ b/hw/etraxfs_ser.c
@@ -0,0 +1,122 @@
+/*
+ * QEMU ETRAX System Emulator
+ *
+ * Copyright (c) 2007 Edgar E. Iglesias, Axis Communications AB.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include <stdio.h>
+#include <ctype.h>
+#include "hw.h"
+
+#define RW_TR_DMA_EN 0xb0026004
+#define RW_DOUT 0xb002601c
+#define RW_STAT_DIN 0xb0026020
+#define R_STAT_DIN 0xb0026024
+
+static uint32_t ser_readb (void *opaque, target_phys_addr_t addr)
+{
+	CPUState *env = opaque;
+	uint32_t r = 0;
+	printf ("%s %x pc=%x\n", __func__, addr, env->pc);
+	return r;
+}
+static uint32_t ser_readw (void *opaque, target_phys_addr_t addr)
+{
+	CPUState *env = opaque;
+	uint32_t r = 0;
+	printf ("%s %x pc=%x\n", __func__, addr, env->pc);
+	return r;
+}
+
+static uint32_t ser_readl (void *opaque, target_phys_addr_t addr)
+{
+	CPUState *env = opaque;
+	uint32_t r = 0;
+
+	switch (addr)
+	{
+		case RW_TR_DMA_EN:
+			break;
+		case R_STAT_DIN:
+			r |= 1 << 24; /* set tr_rdy.  */
+			r |= 1 << 22; /* set tr_idle.  */
+			break;
+
+		default:
+			printf ("%s %x p=%x\n", __func__, addr, env->pc);
+			break;
+	}
+	return r;
+}
+
+static void
+ser_writeb (void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+	CPUState *env = opaque;
+	printf ("%s %x %x pc=%x\n", __func__, addr, value, env->pc);
+}
+static void
+ser_writew (void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+	CPUState *env = opaque;
+	printf ("%s %x %x pc=%x\n", __func__, addr, value, env->pc);
+}
+static void
+ser_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+	CPUState *env = opaque;
+
+	switch (addr)
+	{
+		case RW_TR_DMA_EN:
+			break;
+		case RW_DOUT:
+			if (isprint(value) || isspace(value))
+				putchar(value);
+			else
+				putchar('.');
+			break;
+		default:
+			printf ("%s %x %x pc=%x\n",
+				__func__, addr, value, env->pc);
+			break;
+	}
+}
+
+static CPUReadMemoryFunc *ser_read[] = {
+    &ser_readb,
+    &ser_readw,
+    &ser_readl,
+};
+
+static CPUWriteMemoryFunc *ser_write[] = {
+    &ser_writeb,
+    &ser_writew,
+    &ser_writel,
+};
+
+void etraxfs_ser_init(CPUState *env, qemu_irq *irqs)
+{
+	int ser_regs;
+
+	ser_regs = cpu_register_io_memory(0, ser_read, ser_write, env);
+	cpu_register_physical_memory (0xb0026000, 0x3c, ser_regs);
+}
diff --git a/hw/etraxfs_timer.c b/hw/etraxfs_timer.c
new file mode 100644
index 000000000..efa6bf9b6
--- /dev/null
+++ b/hw/etraxfs_timer.c
@@ -0,0 +1,269 @@
+/*
+ * QEMU ETRAX System Emulator
+ *
+ * Copyright (c) 2007 Edgar E. Iglesias, Axis Communications AB.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include <stdio.h>
+#include <sys/time.h>
+#include "hw.h"
+#include "qemu-timer.h"
+
+void etrax_ack_irq(CPUState *env, uint32_t mask);
+
+#define R_TIME 0xb001e038
+#define RW_TMR0_DIV 0xb001e000
+#define R_TMR0_DATA 0xb001e004
+#define RW_TMR0_CTRL 0xb001e008
+#define RW_TMR1_DIV 0xb001e010
+#define R_TMR1_DATA 0xb001e014
+#define RW_TMR1_CTRL 0xb001e018
+
+#define RW_INTR_MASK 0xb001e048
+#define RW_ACK_INTR 0xb001e04c
+#define R_INTR 0xb001e050
+#define R_MASKED_INTR 0xb001e054
+
+
+uint32_t rw_intr_mask;
+uint32_t rw_ack_intr;
+uint32_t r_intr;
+
+struct fs_timer_t {
+	QEMUBH *bh;
+	unsigned int limit;
+	int scale;
+	ptimer_state *ptimer;
+	CPUState *env;
+	qemu_irq *irq;
+	uint32_t mask;
+};
+
+static struct fs_timer_t timer0;
+
+/* diff two timevals.  Return a single int in us. */
+int diff_timeval_us(struct timeval *a, struct timeval *b)
+{
+        int diff;
+
+        /* assume these values are signed.  */
+        diff = (a->tv_sec - b->tv_sec) * 1000 * 1000;
+        diff += (a->tv_usec - b->tv_usec);
+        return diff;
+}
+
+static uint32_t timer_readb (void *opaque, target_phys_addr_t addr)
+{
+	CPUState *env = opaque;
+	uint32_t r = 0;
+	printf ("%s %x pc=%x\n", __func__, addr, env->pc);
+	return r;
+}
+static uint32_t timer_readw (void *opaque, target_phys_addr_t addr)
+{
+	CPUState *env = opaque;
+	uint32_t r = 0;
+	printf ("%s %x pc=%x\n", __func__, addr, env->pc);
+	return r;
+}
+
+static uint32_t timer_readl (void *opaque, target_phys_addr_t addr)
+{
+	CPUState *env = opaque;
+	uint32_t r = 0;
+
+	switch (addr) {
+	case R_TMR0_DATA:
+		break;
+	case R_TMR1_DATA:
+		printf ("R_TMR1_DATA\n");
+		break;
+	case R_TIME:
+	{
+		static struct timeval last;
+		struct timeval now;
+		gettimeofday(&now, NULL);
+		if (!(last.tv_sec == 0 && last.tv_usec == 0)) {
+			r = diff_timeval_us(&now, &last);
+			r *= 1000; /* convert to ns.  */
+			r++; /* make sure we increase for each call.  */
+		}
+		last = now;
+		break;
+	}
+
+	case RW_INTR_MASK:
+		r = rw_intr_mask;
+		break;
+	case R_MASKED_INTR:
+		r = r_intr & rw_intr_mask;
+		break;
+	default:
+		printf ("%s %x p=%x\n", __func__, addr, env->pc);
+		break;
+	}
+	return r;
+}
+
+static void
+timer_writeb (void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+	CPUState *env = opaque;
+	printf ("%s %x %x pc=%x\n", __func__, addr, value, env->pc);
+}
+static void
+timer_writew (void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+	CPUState *env = opaque;
+	printf ("%s %x %x pc=%x\n", __func__, addr, value, env->pc);
+}
+
+static void write_ctrl(struct fs_timer_t *t, uint32_t v)
+{
+	int op;
+	int freq;
+	int freq_hz;
+
+	op = v & 3;
+	freq = v >> 2;
+	freq_hz = 32000000;
+
+	switch (freq)
+	{
+	case 0:
+	case 1:
+		printf ("extern or disabled timer clock?\n");
+		break;
+	case 4: freq_hz =  29493000; break;
+	case 5: freq_hz =  32000000; break;
+	case 6: freq_hz =  32768000; break;
+	case 7: freq_hz = 100000000; break;
+	default:
+		abort();
+		break;
+	}
+
+	printf ("freq_hz=%d limit=%d\n", freq_hz, t->limit);
+	t->scale = 0;
+	if (t->limit > 2048)
+	{
+		t->scale = 2048;
+		ptimer_set_period(timer0.ptimer, freq_hz / t->scale);
+	}
+
+	printf ("op=%d\n", op);
+	switch (op)
+	{
+		case 0:
+			printf ("limit=%d %d\n", t->limit, t->limit/t->scale);
+			ptimer_set_limit(t->ptimer, t->limit / t->scale, 1);
+			break;
+		case 1:
+			ptimer_stop(t->ptimer);
+			break;
+		case 2:
+			ptimer_run(t->ptimer, 0);
+			break;
+		default:
+			abort();
+			break;
+	}
+}
+
+static void timer_ack_irq(void)
+{
+	if (!(r_intr & timer0.mask & rw_intr_mask)) {
+		qemu_irq_lower(timer0.irq[0]);
+		etrax_ack_irq(timer0.env, 1 << 0x1b);
+	}
+}
+
+static void
+timer_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+	CPUState *env = opaque;
+	printf ("%s %x %x pc=%x\n",
+		__func__, addr, value, env->pc);
+	switch (addr)
+	{
+		case RW_TMR0_DIV:
+			printf ("RW_TMR0_DIV=%x\n", value);
+			timer0.limit = value;
+			break;
+		case RW_TMR0_CTRL:
+			printf ("RW_TMR0_CTRL=%x\n", value);
+			write_ctrl(&timer0, value);
+			break;
+		case RW_TMR1_DIV:
+			printf ("RW_TMR1_DIV=%x\n", value);
+			break;
+		case RW_TMR1_CTRL:
+			printf ("RW_TMR1_CTRL=%x\n", value);
+			break;
+		case RW_INTR_MASK:
+			printf ("RW_INTR_MASK=%x\n", value);
+			rw_intr_mask = value;
+			break;
+		case RW_ACK_INTR:
+			r_intr &= ~value;
+			timer_ack_irq();
+			break;
+		default:
+			printf ("%s %x %x pc=%x\n",
+				__func__, addr, value, env->pc);
+			break;
+	}
+}
+
+static CPUReadMemoryFunc *timer_read[] = {
+    &timer_readb,
+    &timer_readw,
+    &timer_readl,
+};
+
+static CPUWriteMemoryFunc *timer_write[] = {
+    &timer_writeb,
+    &timer_writew,
+    &timer_writel,
+};
+
+static void timer_irq(void *opaque)
+{
+	struct fs_timer_t *t = opaque;
+
+	r_intr |= t->mask;
+	if (t->mask & rw_intr_mask) {
+		qemu_irq_raise(t->irq[0]);
+	}
+}
+
+void etraxfs_timer_init(CPUState *env, qemu_irq *irqs)
+{
+	int timer_regs;
+
+	timer0.bh = qemu_bh_new(timer_irq, &timer0);
+	timer0.ptimer = ptimer_init(timer0.bh);
+	timer0.irq = irqs + 0x1b;
+	timer0.mask = 1;
+	timer0.env = env;
+
+	timer_regs = cpu_register_io_memory(0, timer_read, timer_write, env);
+	cpu_register_physical_memory (0xb001e000, 0x5c, timer_regs);
+}
diff --git a/hw/fdc.c b/hw/fdc.c
index dcd1d46b4..868ae076a 100644
--- a/hw/fdc.c
+++ b/hw/fdc.c
@@ -25,7 +25,11 @@
  * The controller is used in Sun4m systems in a slightly different
  * way. There are changes in DOR register and DMA is not available.
  */
-#include "vl.h"
+#include "hw.h"
+#include "fdc.h"
+#include "block.h"
+#include "qemu-timer.h"
+#include "isa.h"
 
 /********************************************************/
 /* debug Floppy devices */
@@ -106,7 +110,7 @@ static void fd_init (fdrive_t *drv, BlockDriverState *bs)
 }
 
 static int _fd_sector (uint8_t head, uint8_t track,
-                        uint8_t sect, uint8_t last_sect)
+                       uint8_t sect, uint8_t last_sect)
 {
     return (((track * 2) + head) * last_sect) + sect - 1;
 }
@@ -124,7 +128,7 @@ static int fd_seek (fdrive_t *drv, uint8_t head, uint8_t track, uint8_t sect,
     int ret;
 
     if (track > drv->max_track ||
-	(head != 0 && (drv->flags & FDISK_DBL_SIDES) == 0)) {
+        (head != 0 && (drv->flags & FDISK_DBL_SIDES) == 0)) {
         FLOPPY_DPRINTF("try to read %d %02x %02x (max=%d %d %02x %02x)\n",
                        head, track, sect, 1,
                        (drv->flags & FDISK_DBL_SIDES) == 0 ? 0 : 1,
@@ -149,8 +153,8 @@ static int fd_seek (fdrive_t *drv, uint8_t head, uint8_t track, uint8_t sect,
         }
 #endif
         drv->head = head;
-	if (drv->track != track)
-	    ret = 1;
+        if (drv->track != track)
+            ret = 1;
         drv->track = track;
         drv->sect = sect;
     }
@@ -176,10 +180,10 @@ typedef struct fd_format_t {
     uint8_t last_sect;
     uint8_t max_track;
     uint8_t max_head;
-    const unsigned char *str;
+    const char *str;
 } fd_format_t;
 
-static fd_format_t fd_formats[] = {
+static const fd_format_t fd_formats[] = {
     /* First entry is default format */
     /* 1.44 MB 3"1/2 floppy disks */
     { FDRIVE_DRV_144, FDRIVE_DISK_144, 18, 80, 1, "1.44 MB 3\"1/2", },
@@ -229,65 +233,65 @@ static fd_format_t fd_formats[] = {
 /* Revalidate a disk drive after a disk change */
 static void fd_revalidate (fdrive_t *drv)
 {
-    fd_format_t *parse;
+    const fd_format_t *parse;
     int64_t nb_sectors, size;
     int i, first_match, match;
     int nb_heads, max_track, last_sect, ro;
 
     FLOPPY_DPRINTF("revalidate\n");
     if (drv->bs != NULL && bdrv_is_inserted(drv->bs)) {
-	ro = bdrv_is_read_only(drv->bs);
-	bdrv_get_geometry_hint(drv->bs, &nb_heads, &max_track, &last_sect);
-	if (nb_heads != 0 && max_track != 0 && last_sect != 0) {
-	    FLOPPY_DPRINTF("User defined disk (%d %d %d)",
+        ro = bdrv_is_read_only(drv->bs);
+        bdrv_get_geometry_hint(drv->bs, &nb_heads, &max_track, &last_sect);
+        if (nb_heads != 0 && max_track != 0 && last_sect != 0) {
+            FLOPPY_DPRINTF("User defined disk (%d %d %d)",
                            nb_heads - 1, max_track, last_sect);
-	} else {
-	    bdrv_get_geometry(drv->bs, &nb_sectors);
-	    match = -1;
-	    first_match = -1;
-	    for (i = 0;; i++) {
-		parse = &fd_formats[i];
-		if (parse->drive == FDRIVE_DRV_NONE)
-		    break;
-		if (drv->drive == parse->drive ||
-		    drv->drive == FDRIVE_DRV_NONE) {
-		    size = (parse->max_head + 1) * parse->max_track *
-			parse->last_sect;
-		    if (nb_sectors == size) {
-			match = i;
-			break;
-		    }
-		    if (first_match == -1)
-			first_match = i;
-		}
-	    }
-	    if (match == -1) {
-		if (first_match == -1)
-		    match = 1;
-		else
-		    match = first_match;
-		parse = &fd_formats[match];
-	    }
-	    nb_heads = parse->max_head + 1;
-	    max_track = parse->max_track;
-	    last_sect = parse->last_sect;
-	    drv->drive = parse->drive;
-	    FLOPPY_DPRINTF("%s floppy disk (%d h %d t %d s) %s\n", parse->str,
+        } else {
+            bdrv_get_geometry(drv->bs, &nb_sectors);
+            match = -1;
+            first_match = -1;
+            for (i = 0;; i++) {
+                parse = &fd_formats[i];
+                if (parse->drive == FDRIVE_DRV_NONE)
+                    break;
+                if (drv->drive == parse->drive ||
+                    drv->drive == FDRIVE_DRV_NONE) {
+                    size = (parse->max_head + 1) * parse->max_track *
+                        parse->last_sect;
+                    if (nb_sectors == size) {
+                        match = i;
+                        break;
+                    }
+                    if (first_match == -1)
+                        first_match = i;
+                }
+            }
+            if (match == -1) {
+                if (first_match == -1)
+                    match = 1;
+                else
+                    match = first_match;
+                parse = &fd_formats[match];
+            }
+            nb_heads = parse->max_head + 1;
+            max_track = parse->max_track;
+            last_sect = parse->last_sect;
+            drv->drive = parse->drive;
+            FLOPPY_DPRINTF("%s floppy disk (%d h %d t %d s) %s\n", parse->str,
                            nb_heads, max_track, last_sect, ro ? "ro" : "rw");
-	}
-	    if (nb_heads == 1) {
-		drv->flags &= ~FDISK_DBL_SIDES;
-	    } else {
-		drv->flags |= FDISK_DBL_SIDES;
-	    }
-	    drv->max_track = max_track;
-	    drv->last_sect = last_sect;
-	drv->ro = ro;
+        }
+        if (nb_heads == 1) {
+            drv->flags &= ~FDISK_DBL_SIDES;
+        } else {
+            drv->flags |= FDISK_DBL_SIDES;
+        }
+        drv->max_track = max_track;
+        drv->last_sect = last_sect;
+        drv->ro = ro;
     } else {
-	FLOPPY_DPRINTF("No disk in drive\n");
+        FLOPPY_DPRINTF("No disk in drive\n");
         drv->last_sect = 0;
-	drv->max_track = 0;
-	drv->flags &= ~FDISK_DBL_SIDES;
+        drv->max_track = 0;
+        drv->flags &= ~FDISK_DBL_SIDES;
     }
 }
 
@@ -395,6 +399,8 @@ struct fdctrl_t {
     uint8_t lock;
     /* Power down config (also with status regB access mode */
     uint8_t pwrd;
+    /* Sun4m quirks? */
+    int sun4m;
     /* Floppy drives */
     fdrive_t drives[2];
 };
@@ -405,33 +411,35 @@ static uint32_t fdctrl_read (void *opaque, uint32_t reg)
     uint32_t retval;
 
     switch (reg & 0x07) {
-#ifdef TARGET_SPARC
     case 0x00:
-	// Identify to Linux as S82078B
-	retval = fdctrl_read_statusB(fdctrl);
-	break;
-#endif
+        if (fdctrl->sun4m) {
+            // Identify to Linux as S82078B
+            retval = fdctrl_read_statusB(fdctrl);
+        } else {
+            retval = (uint32_t)(-1);
+        }
+        break;
     case 0x01:
-	retval = fdctrl_read_statusB(fdctrl);
-	break;
+        retval = fdctrl_read_statusB(fdctrl);
+        break;
     case 0x02:
-	retval = fdctrl_read_dor(fdctrl);
-	break;
+        retval = fdctrl_read_dor(fdctrl);
+        break;
     case 0x03:
         retval = fdctrl_read_tape(fdctrl);
-	break;
+        break;
     case 0x04:
         retval = fdctrl_read_main_status(fdctrl);
-	break;
+        break;
     case 0x05:
         retval = fdctrl_read_data(fdctrl);
-	break;
+        break;
     case 0x07:
         retval = fdctrl_read_dir(fdctrl);
-	break;
+        break;
     default:
-	retval = (uint32_t)(-1);
-	break;
+        retval = (uint32_t)(-1);
+        break;
     }
     FLOPPY_DPRINTF("read reg%d: 0x%02x\n", reg & 7, retval);
 
@@ -446,19 +454,19 @@ static void fdctrl_write (void *opaque, uint32_t reg, uint32_t value)
 
     switch (reg & 0x07) {
     case 0x02:
-	fdctrl_write_dor(fdctrl, value);
-	break;
+        fdctrl_write_dor(fdctrl, value);
+        break;
     case 0x03:
         fdctrl_write_tape(fdctrl, value);
-	break;
+        break;
     case 0x04:
         fdctrl_write_rate(fdctrl, value);
-	break;
+        break;
     case 0x05:
         fdctrl_write_data(fdctrl, value);
-	break;
+        break;
     default:
-	break;
+        break;
     }
 }
 
@@ -598,6 +606,7 @@ fdctrl_t *fdctrl_init (qemu_irq irq, int dma_chann, int mem_mapped,
     fdctrl->dma_chann = dma_chann;
     fdctrl->io_base = io_base;
     fdctrl->config = 0x60; /* Implicit seek, polling & FIFO enabled */
+    fdctrl->sun4m = 0;
     if (fdctrl->dma_chann != -1) {
         fdctrl->dma_en = 1;
         DMA_register_channel(dma_chann, &fdctrl_transfer_handler, fdctrl);
@@ -610,7 +619,8 @@ fdctrl_t *fdctrl_init (qemu_irq irq, int dma_chann, int mem_mapped,
     fdctrl_reset(fdctrl, 0);
     fdctrl->state = FD_CTRL_ACTIVE;
     if (mem_mapped) {
-        io_mem = cpu_register_io_memory(0, fdctrl_mem_read, fdctrl_mem_write, fdctrl);
+        io_mem = cpu_register_io_memory(0, fdctrl_mem_read, fdctrl_mem_write,
+                                        fdctrl);
         cpu_register_physical_memory(io_base, 0x08, io_mem);
     } else {
         register_ioport_read((uint32_t)io_base + 0x01, 5, 1, &fdctrl_read,
@@ -631,6 +641,17 @@ fdctrl_t *fdctrl_init (qemu_irq irq, int dma_chann, int mem_mapped,
     return fdctrl;
 }
 
+fdctrl_t *sun4m_fdctrl_init (qemu_irq irq, target_phys_addr_t io_base,
+                             BlockDriverState **fds)
+{
+    fdctrl_t *fdctrl;
+
+    fdctrl = fdctrl_init(irq, 0, 1, io_base, fds);
+    fdctrl->sun4m = 1;
+
+    return fdctrl;
+}
+
 /* XXX: may change if moved to bdrv */
 int fdctrl_get_drive_type(fdctrl_t *fdctrl, int drive_num)
 {
@@ -647,14 +668,12 @@ static void fdctrl_reset_irq (fdctrl_t *fdctrl)
 
 static void fdctrl_raise_irq (fdctrl_t *fdctrl, uint8_t status)
 {
-#ifdef TARGET_SPARC
     // Sparc mutation
-    if (!fdctrl->dma_en) {
-	fdctrl->state &= ~FD_CTRL_BUSY;
-	fdctrl->int_status = status;
-	return;
+    if (fdctrl->sun4m && !fdctrl->dma_en) {
+        fdctrl->state &= ~FD_CTRL_BUSY;
+        fdctrl->int_status = status;
+        return;
     }
-#endif
     if (~(fdctrl->state & FD_CTRL_INTR)) {
         qemu_set_irq(fdctrl->irq, 1);
         fdctrl->state |= FD_CTRL_INTR;
@@ -713,9 +732,9 @@ static uint32_t fdctrl_read_dor (fdctrl_t *fdctrl)
 
     /* Drive motors state indicators */
     if (drv0(fdctrl)->drflags & FDRIVE_MOTOR_ON)
-	retval |= 1 << 5;
+        retval |= 1 << 5;
     if (drv1(fdctrl)->drflags & FDRIVE_MOTOR_ON)
-	retval |= 1 << 4;
+        retval |= 1 << 4;
     /* DMA enable */
     retval |= fdctrl->dma_en << 3;
     /* Reset indicator */
@@ -822,9 +841,9 @@ static void fdctrl_write_rate (fdctrl_t *fdctrl, uint32_t value)
 {
     /* Reset mode */
     if (fdctrl->state & FD_CTRL_RESET) {
-            FLOPPY_DPRINTF("Floppy controller in RESET state !\n");
-            return;
-        }
+        FLOPPY_DPRINTF("Floppy controller in RESET state !\n");
+        return;
+    }
     FLOPPY_DPRINTF("select rate register set to 0x%02x\n", value);
     /* Reset: autoclear */
     if (value & 0x80) {
@@ -842,6 +861,7 @@ static void fdctrl_write_rate (fdctrl_t *fdctrl, uint32_t value)
 static int fdctrl_media_changed(fdrive_t *drv)
 {
     int ret;
+
     if (!drv->bs)
         return 0;
     ret = bdrv_media_changed(drv->bs);
@@ -857,7 +877,7 @@ static uint32_t fdctrl_read_dir (fdctrl_t *fdctrl)
     uint32_t retval = 0;
 
     if (fdctrl_media_changed(drv0(fdctrl)) ||
-	fdctrl_media_changed(drv1(fdctrl)))
+        fdctrl_media_changed(drv1(fdctrl)))
         retval |= 0x80;
     if (retval != 0)
         FLOPPY_DPRINTF("Floppy digital input register: 0x%02x\n", retval);
@@ -904,7 +924,7 @@ static void fdctrl_unimplemented (fdctrl_t *fdctrl)
 
 /* Callback for transfer end (stop or abort) */
 static void fdctrl_stop_transfer (fdctrl_t *fdctrl, uint8_t status0,
-				  uint8_t status1, uint8_t status2)
+                                  uint8_t status1, uint8_t status2)
 {
     fdrive_t *cur_drv;
 
@@ -986,12 +1006,12 @@ static void fdctrl_start_transfer (fdctrl_t *fdctrl, int direction)
     if (fdctrl->fifo[5] == 00) {
         fdctrl->data_len = fdctrl->fifo[8];
     } else {
-	int tmp;
+        int tmp;
         fdctrl->data_len = 128 << (fdctrl->fifo[5] > 7 ? 7 : fdctrl->fifo[5]);
         tmp = (cur_drv->last_sect - ks + 1);
         if (fdctrl->fifo[0] & 0x80)
             tmp += cur_drv->last_sect;
-	fdctrl->data_len *= tmp;
+        fdctrl->data_len *= tmp;
     }
     fdctrl->eot = fdctrl->fifo[6];
     if (fdctrl->dma_en) {
@@ -1000,9 +1020,9 @@ static void fdctrl_start_transfer (fdctrl_t *fdctrl, int direction)
         dma_mode = DMA_get_channel_mode(fdctrl->dma_chann);
         dma_mode = (dma_mode >> 2) & 3;
         FLOPPY_DPRINTF("dma_mode=%d direction=%d (%d - %d)\n",
-		       dma_mode, direction,
+                       dma_mode, direction,
                        (128 << fdctrl->fifo[5]) *
-		       (cur_drv->last_sect - ks + 1), fdctrl->data_len);
+                       (cur_drv->last_sect - ks + 1), fdctrl->data_len);
         if (((direction == FD_DIR_SCANE || direction == FD_DIR_SCANL ||
               direction == FD_DIR_SCANH) && dma_mode == 0) ||
             (direction == FD_DIR_WRITE && dma_mode == 2) ||
@@ -1016,7 +1036,7 @@ static void fdctrl_start_transfer (fdctrl_t *fdctrl, int direction)
             DMA_schedule(fdctrl->dma_chann);
             return;
         } else {
-	    FLOPPY_ERROR("dma_mode=%d direction=%d\n", dma_mode, direction);
+            FLOPPY_ERROR("dma_mode=%d direction=%d\n", dma_mode, direction);
         }
     }
     FLOPPY_DPRINTF("start non-DMA transfer\n");
@@ -1056,11 +1076,11 @@ static int fdctrl_transfer_handler (void *opaque, int nchan,
     if (dma_len > fdctrl->data_len)
         dma_len = fdctrl->data_len;
     if (cur_drv->bs == NULL) {
-	if (fdctrl->data_dir == FD_DIR_WRITE)
-	    fdctrl_stop_transfer(fdctrl, 0x60, 0x00, 0x00);
-	else
-	    fdctrl_stop_transfer(fdctrl, 0x40, 0x00, 0x00);
-	len = 0;
+        if (fdctrl->data_dir == FD_DIR_WRITE)
+            fdctrl_stop_transfer(fdctrl, 0x60, 0x00, 0x00);
+        else
+            fdctrl_stop_transfer(fdctrl, 0x40, 0x00, 0x00);
+        len = 0;
         goto transfer_error;
     }
     rel_pos = fdctrl->data_pos % FD_SECTOR_LEN;
@@ -1074,45 +1094,39 @@ static int fdctrl_transfer_handler (void *opaque, int nchan,
                        cur_drv->track, cur_drv->sect, fd_sector(cur_drv),
                        fd_sector(cur_drv) * 512);
         if (fdctrl->data_dir != FD_DIR_WRITE ||
-	    len < FD_SECTOR_LEN || rel_pos != 0) {
+            len < FD_SECTOR_LEN || rel_pos != 0) {
             /* READ & SCAN commands and realign to a sector for WRITE */
             if (bdrv_read(cur_drv->bs, fd_sector(cur_drv),
-			  fdctrl->fifo, 1) < 0) {
+                          fdctrl->fifo, 1) < 0) {
                 FLOPPY_DPRINTF("Floppy: error getting sector %d\n",
                                fd_sector(cur_drv));
                 /* Sure, image size is too small... */
                 memset(fdctrl->fifo, 0, FD_SECTOR_LEN);
             }
         }
-	switch (fdctrl->data_dir) {
-	case FD_DIR_READ:
-	    /* READ commands */
+        switch (fdctrl->data_dir) {
+        case FD_DIR_READ:
+            /* READ commands */
             DMA_write_memory (nchan, fdctrl->fifo + rel_pos,
                               fdctrl->data_pos, len);
-/* 	    cpu_physical_memory_write(addr + fdctrl->data_pos, */
-/* 				      fdctrl->fifo + rel_pos, len); */
-	    break;
-	case FD_DIR_WRITE:
+            break;
+        case FD_DIR_WRITE:
             /* WRITE commands */
             DMA_read_memory (nchan, fdctrl->fifo + rel_pos,
                              fdctrl->data_pos, len);
-/*             cpu_physical_memory_read(addr + fdctrl->data_pos, */
-/* 				     fdctrl->fifo + rel_pos, len); */
             if (bdrv_write(cur_drv->bs, fd_sector(cur_drv),
-			   fdctrl->fifo, 1) < 0) {
+                           fdctrl->fifo, 1) < 0) {
                 FLOPPY_ERROR("writting sector %d\n", fd_sector(cur_drv));
                 fdctrl_stop_transfer(fdctrl, 0x60, 0x00, 0x00);
                 goto transfer_error;
             }
-	    break;
-	default:
-	    /* SCAN commands */
+            break;
+        default:
+            /* SCAN commands */
             {
-		uint8_t tmpbuf[FD_SECTOR_LEN];
+                uint8_t tmpbuf[FD_SECTOR_LEN];
                 int ret;
                 DMA_read_memory (nchan, tmpbuf, fdctrl->data_pos, len);
-/*                 cpu_physical_memory_read(addr + fdctrl->data_pos, */
-/*                                          tmpbuf, len); */
                 ret = memcmp(tmpbuf, fdctrl->fifo + rel_pos, len);
                 if (ret == 0) {
                     status2 = 0x08;
@@ -1124,47 +1138,47 @@ static int fdctrl_transfer_handler (void *opaque, int nchan,
                     goto end_transfer;
                 }
             }
-	    break;
+            break;
         }
-	fdctrl->data_pos += len;
-	rel_pos = fdctrl->data_pos % FD_SECTOR_LEN;
+        fdctrl->data_pos += len;
+        rel_pos = fdctrl->data_pos % FD_SECTOR_LEN;
         if (rel_pos == 0) {
             /* Seek to next sector */
-	    FLOPPY_DPRINTF("seek to next sector (%d %02x %02x => %d) (%d)\n",
-			   cur_drv->head, cur_drv->track, cur_drv->sect,
-			   fd_sector(cur_drv),
-			   fdctrl->data_pos - len);
+            FLOPPY_DPRINTF("seek to next sector (%d %02x %02x => %d) (%d)\n",
+                           cur_drv->head, cur_drv->track, cur_drv->sect,
+                           fd_sector(cur_drv),
+                           fdctrl->data_pos - len);
             /* XXX: cur_drv->sect >= cur_drv->last_sect should be an
                error in fact */
             if (cur_drv->sect >= cur_drv->last_sect ||
                 cur_drv->sect == fdctrl->eot) {
-		cur_drv->sect = 1;
-		if (FD_MULTI_TRACK(fdctrl->data_state)) {
-		    if (cur_drv->head == 0 &&
-			(cur_drv->flags & FDISK_DBL_SIDES) != 0) {
+                cur_drv->sect = 1;
+                if (FD_MULTI_TRACK(fdctrl->data_state)) {
+                    if (cur_drv->head == 0 &&
+                        (cur_drv->flags & FDISK_DBL_SIDES) != 0) {
                         cur_drv->head = 1;
                     } else {
                         cur_drv->head = 0;
-			cur_drv->track++;
-			if ((cur_drv->flags & FDISK_DBL_SIDES) == 0)
-			    break;
+                        cur_drv->track++;
+                        if ((cur_drv->flags & FDISK_DBL_SIDES) == 0)
+                            break;
                     }
                 } else {
                     cur_drv->track++;
                     break;
                 }
-		FLOPPY_DPRINTF("seek to next track (%d %02x %02x => %d)\n",
-			       cur_drv->head, cur_drv->track,
-			       cur_drv->sect, fd_sector(cur_drv));
+                FLOPPY_DPRINTF("seek to next track (%d %02x %02x => %d)\n",
+                               cur_drv->head, cur_drv->track,
+                               cur_drv->sect, fd_sector(cur_drv));
             } else {
                 cur_drv->sect++;
             }
         }
     }
-end_transfer:
+ end_transfer:
     len = fdctrl->data_pos - start_pos;
     FLOPPY_DPRINTF("end transfer %d %d %d\n",
-		   fdctrl->data_pos, len, fdctrl->data_len);
+                   fdctrl->data_pos, len, fdctrl->data_len);
     if (fdctrl->data_dir == FD_DIR_SCANE ||
         fdctrl->data_dir == FD_DIR_SCANL ||
         fdctrl->data_dir == FD_DIR_SCANH)
@@ -1174,7 +1188,7 @@ end_transfer:
     fdctrl->data_len -= len;
     //    if (fdctrl->data_len == 0)
     fdctrl_stop_transfer(fdctrl, status0, status1, status2);
-transfer_error:
+ transfer_error:
 
     return len;
 }
@@ -1199,8 +1213,7 @@ static uint32_t fdctrl_read_data (fdctrl_t *fdctrl)
             len = fdctrl->data_len - fdctrl->data_pos;
             if (len > FD_SECTOR_LEN)
                 len = FD_SECTOR_LEN;
-            bdrv_read(cur_drv->bs, fd_sector(cur_drv),
-                      fdctrl->fifo, len);
+            bdrv_read(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1);
         }
     }
     retval = fdctrl->fifo[pos];
@@ -1271,18 +1284,18 @@ static void fdctrl_format_sector (fdctrl_t *fdctrl)
         FLOPPY_ERROR("formatting sector %d\n", fd_sector(cur_drv));
         fdctrl_stop_transfer(fdctrl, 0x60, 0x00, 0x00);
     } else {
-	if (cur_drv->sect == cur_drv->last_sect) {
-	    fdctrl->data_state &= ~FD_STATE_FORMAT;
-	    /* Last sector done */
-	    if (FD_DID_SEEK(fdctrl->data_state))
-		fdctrl_stop_transfer(fdctrl, 0x20, 0x00, 0x00);
-	    else
-		fdctrl_stop_transfer(fdctrl, 0x00, 0x00, 0x00);
-	} else {
-	    /* More to do */
-	    fdctrl->data_pos = 0;
-	    fdctrl->data_len = 4;
-	}
+        if (cur_drv->sect == cur_drv->last_sect) {
+            fdctrl->data_state &= ~FD_STATE_FORMAT;
+            /* Last sector done */
+            if (FD_DID_SEEK(fdctrl->data_state))
+                fdctrl_stop_transfer(fdctrl, 0x20, 0x00, 0x00);
+            else
+                fdctrl_stop_transfer(fdctrl, 0x00, 0x00, 0x00);
+        } else {
+            /* More to do */
+            fdctrl->data_pos = 0;
+            fdctrl->data_len = 4;
+        }
     }
 }
 
@@ -1307,8 +1320,7 @@ static void fdctrl_write_data (fdctrl_t *fdctrl, uint32_t value)
         fdctrl->fifo[fdctrl->data_pos++] = value;
         if (fdctrl->data_pos % FD_SECTOR_LEN == (FD_SECTOR_LEN - 1) ||
             fdctrl->data_pos == fdctrl->data_len) {
-            bdrv_write(cur_drv->bs, fd_sector(cur_drv),
-                       fdctrl->fifo, FD_SECTOR_LEN);
+            bdrv_write(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1);
         }
         /* Switch from transfer mode to status mode
          * then from status mode to command mode
@@ -1411,8 +1423,8 @@ static void fdctrl_write_data (fdctrl_t *fdctrl, uint32_t value)
 #endif
             fdctrl->fifo[1] = cur_drv->track;
             fdctrl_set_fifo(fdctrl, 2, 0);
-	    fdctrl_reset_irq(fdctrl);
-	    fdctrl->int_status = 0xC0;
+            fdctrl_reset_irq(fdctrl);
+            fdctrl->int_status = 0xC0;
             return;
         case 0x0E:
             /* DUMPREG */
@@ -1427,7 +1439,7 @@ static void fdctrl_write_data (fdctrl_t *fdctrl, uint32_t value)
             fdctrl->fifo[5] = (fdctrl->timer1 << 1) | fdctrl->dma_en;
             fdctrl->fifo[6] = cur_drv->last_sect;
             fdctrl->fifo[7] = (fdctrl->lock << 7) |
-                    (cur_drv->perpendicular << 2);
+                (cur_drv->perpendicular << 2);
             fdctrl->fifo[8] = fdctrl->config;
             fdctrl->fifo[9] = fdctrl->precomp_trk;
             fdctrl_set_fifo(fdctrl, 10, 0);
@@ -1495,7 +1507,7 @@ static void fdctrl_write_data (fdctrl_t *fdctrl, uint32_t value)
             fdctrl->fifo[7] = fdctrl->timer1;
             fdctrl->fifo[8] = cur_drv->last_sect;
             fdctrl->fifo[9] = (fdctrl->lock << 7) |
-                    (cur_drv->perpendicular << 2);
+                (cur_drv->perpendicular << 2);
             fdctrl->fifo[10] = fdctrl->config;
             fdctrl->fifo[11] = fdctrl->precomp_trk;
             fdctrl->fifo[12] = fdctrl->pwrd;
@@ -1572,25 +1584,25 @@ static void fdctrl_write_data (fdctrl_t *fdctrl, uint32_t value)
             return;
         }
     }
-enqueue:
+ enqueue:
     FLOPPY_DPRINTF("%s: %02x\n", __func__, value);
     fdctrl->fifo[fdctrl->data_pos] = value;
     if (++fdctrl->data_pos == fdctrl->data_len) {
         /* We now have all parameters
          * and will be able to treat the command
          */
-	if (fdctrl->data_state & FD_STATE_FORMAT) {
-	    fdctrl_format_sector(fdctrl);
-	    return;
-	}
-        switch (fdctrl->fifo[0] & 0x1F) {
-        case 0x06:
-        {
-            /* READ variants */
-            FLOPPY_DPRINTF("treat READ command\n");
-            fdctrl_start_transfer(fdctrl, FD_DIR_READ);
+        if (fdctrl->data_state & FD_STATE_FORMAT) {
+            fdctrl_format_sector(fdctrl);
             return;
         }
+        switch (fdctrl->fifo[0] & 0x1F) {
+        case 0x06:
+            {
+                /* READ variants */
+                FLOPPY_DPRINTF("treat READ command\n");
+                fdctrl_start_transfer(fdctrl, FD_DIR_READ);
+                return;
+            }
         case 0x0C:
             /* READ_DELETED variants */
 //            FLOPPY_DPRINTF("treat READ_DELETED command\n");
@@ -1645,7 +1657,7 @@ enqueue:
             FLOPPY_DPRINTF("treat SPECIFY command\n");
             fdctrl->timer0 = (fdctrl->fifo[1] >> 4) & 0xF;
             fdctrl->timer1 = fdctrl->fifo[2] >> 1;
-	    fdctrl->dma_en = 1 - (fdctrl->fifo[2] & 1) ;
+            fdctrl->dma_en = 1 - (fdctrl->fifo[2] & 1) ;
             /* No result back */
             fdctrl_reset_fifo(fdctrl);
             break;
@@ -1653,7 +1665,7 @@ enqueue:
             /* SENSE_DRIVE_STATUS */
             FLOPPY_DPRINTF("treat SENSE_DRIVE_STATUS command\n");
             fdctrl->cur_drv = fdctrl->fifo[1] & 1;
-	    cur_drv = get_cur_drv(fdctrl);
+            cur_drv = get_cur_drv(fdctrl);
             cur_drv->head = (fdctrl->fifo[1] >> 2) & 1;
             /* 1 Byte status back */
             fdctrl->fifo[0] = (cur_drv->ro << 6) |
@@ -1667,23 +1679,23 @@ enqueue:
             /* RECALIBRATE */
             FLOPPY_DPRINTF("treat RECALIBRATE command\n");
             fdctrl->cur_drv = fdctrl->fifo[1] & 1;
-	    cur_drv = get_cur_drv(fdctrl);
+            cur_drv = get_cur_drv(fdctrl);
             fd_recalibrate(cur_drv);
-	    fdctrl_reset_fifo(fdctrl);
+            fdctrl_reset_fifo(fdctrl);
             /* Raise Interrupt */
-	    fdctrl_raise_irq(fdctrl, 0x20);
+            fdctrl_raise_irq(fdctrl, 0x20);
             break;
         case 0x0F:
             /* SEEK */
             FLOPPY_DPRINTF("treat SEEK command\n");
             fdctrl->cur_drv = fdctrl->fifo[1] & 1;
-	    cur_drv = get_cur_drv(fdctrl);
-	    fd_start(cur_drv);
+            cur_drv = get_cur_drv(fdctrl);
+            fd_start(cur_drv);
             if (fdctrl->fifo[2] <= cur_drv->track)
                 cur_drv->dir = 1;
             else
                 cur_drv->dir = 0;
-	    fdctrl_reset_fifo(fdctrl);
+            fdctrl_reset_fifo(fdctrl);
             if (fdctrl->fifo[2] > cur_drv->max_track) {
                 fdctrl_raise_irq(fdctrl, 0x60);
             } else {
@@ -1728,7 +1740,7 @@ enqueue:
             fdctrl_start_transfer(fdctrl, FD_DIR_READ);
             break;
         case 0x4A:
-                /* READ_ID */
+            /* READ_ID */
             FLOPPY_DPRINTF("treat READ_ID command\n");
             /* XXX: should set main status register to busy */
             cur_drv->head = (fdctrl->fifo[1] >> 2) & 1;
@@ -1754,30 +1766,30 @@ enqueue:
             break;
         case 0x4D:
             /* FORMAT_TRACK */
-	    FLOPPY_DPRINTF("treat FORMAT_TRACK command\n");
-	    fdctrl->cur_drv = fdctrl->fifo[1] & 1;
-	    cur_drv = get_cur_drv(fdctrl);
-	    fdctrl->data_state |= FD_STATE_FORMAT;
-	    if (fdctrl->fifo[0] & 0x80)
-		fdctrl->data_state |= FD_STATE_MULTI;
-	    else
-		fdctrl->data_state &= ~FD_STATE_MULTI;
-	    fdctrl->data_state &= ~FD_STATE_SEEK;
-	    cur_drv->bps =
-		fdctrl->fifo[2] > 7 ? 16384 : 128 << fdctrl->fifo[2];
+            FLOPPY_DPRINTF("treat FORMAT_TRACK command\n");
+            fdctrl->cur_drv = fdctrl->fifo[1] & 1;
+            cur_drv = get_cur_drv(fdctrl);
+            fdctrl->data_state |= FD_STATE_FORMAT;
+            if (fdctrl->fifo[0] & 0x80)
+                fdctrl->data_state |= FD_STATE_MULTI;
+            else
+                fdctrl->data_state &= ~FD_STATE_MULTI;
+            fdctrl->data_state &= ~FD_STATE_SEEK;
+            cur_drv->bps =
+                fdctrl->fifo[2] > 7 ? 16384 : 128 << fdctrl->fifo[2];
 #if 0
-	    cur_drv->last_sect =
-		cur_drv->flags & FDISK_DBL_SIDES ? fdctrl->fifo[3] :
-		fdctrl->fifo[3] / 2;
+            cur_drv->last_sect =
+                cur_drv->flags & FDISK_DBL_SIDES ? fdctrl->fifo[3] :
+                fdctrl->fifo[3] / 2;
 #else
-	    cur_drv->last_sect = fdctrl->fifo[3];
+            cur_drv->last_sect = fdctrl->fifo[3];
 #endif
-	    /* TODO: implement format using DMA expected by the Bochs BIOS
-	     * and Linux fdformat (read 3 bytes per sector via DMA and fill
-	     * the sector with the specified fill byte
-	     */
-	    fdctrl->data_state &= ~FD_STATE_FORMAT;
-	    fdctrl_stop_transfer(fdctrl, 0x00, 0x00, 0x00);
+            /* TODO: implement format using DMA expected by the Bochs BIOS
+             * and Linux fdformat (read 3 bytes per sector via DMA and fill
+             * the sector with the specified fill byte
+             */
+            fdctrl->data_state &= ~FD_STATE_FORMAT;
+            fdctrl_stop_transfer(fdctrl, 0x00, 0x00, 0x00);
             break;
         case 0x8E:
             /* DRIVE_SPECIFICATION_COMMAND */
@@ -1803,16 +1815,16 @@ enqueue:
             /* RELATIVE_SEEK_OUT */
             FLOPPY_DPRINTF("treat RELATIVE_SEEK_OUT command\n");
             fdctrl->cur_drv = fdctrl->fifo[1] & 1;
-	    cur_drv = get_cur_drv(fdctrl);
-	    fd_start(cur_drv);
-                cur_drv->dir = 0;
+            cur_drv = get_cur_drv(fdctrl);
+            fd_start(cur_drv);
+            cur_drv->dir = 0;
             if (fdctrl->fifo[2] + cur_drv->track >= cur_drv->max_track) {
-		cur_drv->track = cur_drv->max_track - 1;
+                cur_drv->track = cur_drv->max_track - 1;
             } else {
                 cur_drv->track += fdctrl->fifo[2];
             }
-	    fdctrl_reset_fifo(fdctrl);
-	    fdctrl_raise_irq(fdctrl, 0x20);
+            fdctrl_reset_fifo(fdctrl);
+            fdctrl_raise_irq(fdctrl, 0x20);
             break;
         case 0xCD:
             /* FORMAT_AND_WRITE */
@@ -1821,20 +1833,20 @@ enqueue:
             fdctrl_unimplemented(fdctrl);
             break;
         case 0xCF:
-                /* RELATIVE_SEEK_IN */
+            /* RELATIVE_SEEK_IN */
             FLOPPY_DPRINTF("treat RELATIVE_SEEK_IN command\n");
             fdctrl->cur_drv = fdctrl->fifo[1] & 1;
-	    cur_drv = get_cur_drv(fdctrl);
-	    fd_start(cur_drv);
-                cur_drv->dir = 1;
+            cur_drv = get_cur_drv(fdctrl);
+            fd_start(cur_drv);
+            cur_drv->dir = 1;
             if (fdctrl->fifo[2] > cur_drv->track) {
-		cur_drv->track = 0;
+                cur_drv->track = 0;
             } else {
                 cur_drv->track -= fdctrl->fifo[2];
             }
-	    fdctrl_reset_fifo(fdctrl);
-	    /* Raise Interrupt */
-	    fdctrl_raise_irq(fdctrl, 0x20);
+            fdctrl_reset_fifo(fdctrl);
+            /* Raise Interrupt */
+            fdctrl_raise_irq(fdctrl, 0x20);
             break;
         }
     }
@@ -1844,6 +1856,7 @@ static void fdctrl_result_timer(void *opaque)
 {
     fdctrl_t *fdctrl = opaque;
     fdrive_t *cur_drv = get_cur_drv(fdctrl);
+
     /* Pretend we are spinning.
      * This is needed for Coherent, which uses READ ID to check for
      * sector interleaving.
diff --git a/hw/fdc.h b/hw/fdc.h
new file mode 100644
index 000000000..50de25088
--- /dev/null
+++ b/hw/fdc.h
@@ -0,0 +1,12 @@
+/* fdc.c */
+#define MAX_FD 2
+extern BlockDriverState *fd_table[MAX_FD];
+
+typedef struct fdctrl_t fdctrl_t;
+
+fdctrl_t *fdctrl_init (qemu_irq irq, int dma_chann, int mem_mapped,
+                       target_phys_addr_t io_base,
+                       BlockDriverState **fds);
+fdctrl_t *sun4m_fdctrl_init (qemu_irq irq, target_phys_addr_t io_base,
+                             BlockDriverState **fds);
+int fdctrl_get_drive_type(fdctrl_t *fdctrl, int drive_num);
diff --git a/hw/firmware_abi.h b/hw/firmware_abi.h
new file mode 100755
index 000000000..499949363
--- /dev/null
+++ b/hw/firmware_abi.h
@@ -0,0 +1,198 @@
+#ifndef FIRMWARE_ABI_H
+#define FIRMWARE_ABI_H
+
+#ifndef __ASSEMBLY__
+/* Open Hack'Ware NVRAM configuration structure */
+
+/* Version 3 */
+typedef struct ohwcfg_v3_t ohwcfg_v3_t;
+struct ohwcfg_v3_t {
+    /* 0x00: structure identifier                    */
+    uint8_t  struct_ident[0x10];
+    /* 0x10: structure version and NVRAM description */
+    uint32_t struct_version;
+    uint16_t nvram_size;
+    uint16_t pad0;
+    uint16_t nvram_arch_ptr;
+    uint16_t nvram_arch_size;
+    uint16_t nvram_arch_crc;
+    uint8_t  pad1[0x02];
+    /* 0x20: host architecture                       */
+    uint8_t  arch[0x10];
+    /* 0x30: RAM/ROM description                     */
+    uint64_t RAM0_base;
+    uint64_t RAM0_size;
+    uint64_t RAM1_base;
+    uint64_t RAM1_size;
+    uint64_t RAM2_base;
+    uint64_t RAM2_size;
+    uint64_t RAM3_base;
+    uint64_t RAM3_size;
+    uint64_t ROM_base;
+    uint64_t ROM_size;
+    /* 0x80: Kernel description                      */
+    uint64_t kernel_image;
+    uint64_t kernel_size;
+    /* 0x90: Kernel command line                     */
+    uint64_t cmdline;
+    uint64_t cmdline_size;
+    /* 0xA0: Kernel boot image                       */
+    uint64_t initrd_image;
+    uint64_t initrd_size;
+    /* 0xB0: NVRAM image                             */
+    uint64_t NVRAM_image;
+    uint8_t  pad2[8];
+    /* 0xC0: graphic configuration                   */
+    uint16_t width;
+    uint16_t height;
+    uint16_t depth;
+    uint16_t graphic_flags;
+    /* 0xC8: CPUs description                        */
+    uint8_t  nb_cpus;
+    uint8_t  boot_cpu;
+    uint8_t  nboot_devices;
+    uint8_t  pad3[5];
+    /* 0xD0: boot devices                            */
+    uint8_t  boot_devices[0x10];
+    /* 0xE0                                          */
+    uint8_t  pad4[0x1C]; /* 28 */
+    /* 0xFC: checksum                                */
+    uint16_t crc;
+    uint8_t  pad5[0x02];
+} __attribute__ (( packed ));
+
+#define OHW_GF_NOGRAPHICS 0x0001
+
+static inline uint16_t
+OHW_crc_update (uint16_t prev, uint16_t value)
+{
+    uint16_t tmp;
+    uint16_t pd, pd1, pd2;
+
+    tmp = prev >> 8;
+    pd = prev ^ value;
+    pd1 = pd & 0x000F;
+    pd2 = ((pd >> 4) & 0x000F) ^ pd1;
+    tmp ^= (pd1 << 3) | (pd1 << 8);
+    tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);
+
+    return tmp;
+}
+
+static inline uint16_t
+OHW_compute_crc (ohwcfg_v3_t *header, uint32_t start, uint32_t count)
+{
+    uint32_t i;
+    uint16_t crc = 0xFFFF;
+    uint8_t *ptr = (uint8_t *)header;
+    int odd;
+
+    odd = count & 1;
+    count &= ~1;
+    for (i = 0; i != count; i++) {
+        crc = OHW_crc_update(crc, (ptr[start + i] << 8) | ptr[start + i + 1]);
+    }
+    if (odd) {
+        crc = OHW_crc_update(crc, ptr[start + i] << 8);
+    }
+
+    return crc;
+}
+
+/* Sparc32 runtime NVRAM structure for SMP CPU boot */
+struct sparc_arch_cfg {
+    uint32_t smp_ctx;
+    uint32_t smp_ctxtbl;
+    uint32_t smp_entry;
+    uint8_t valid;
+    uint8_t unused[51];
+};
+
+/* OpenBIOS NVRAM partition */
+struct OpenBIOS_nvpart_v1 {
+    uint8_t signature;
+    uint8_t checksum;
+    uint16_t len; // BE, length divided by 16
+    char name[12];
+};
+
+#define OPENBIOS_PART_SYSTEM 0x70
+#define OPENBIOS_PART_FREE 0x7f
+
+static inline void
+OpenBIOS_finish_partition(struct OpenBIOS_nvpart_v1 *header, uint32_t size)
+{
+    unsigned int i, sum;
+    uint8_t *tmpptr;
+
+    // Length divided by 16
+    header->len = cpu_to_be16(size >> 4);
+
+    // Checksum
+    tmpptr = (uint8_t *)header;
+    sum = *tmpptr;
+    for (i = 0; i < 14; i++) {
+        sum += tmpptr[2 + i];
+        sum = (sum + ((sum & 0xff00) >> 8)) & 0xff;
+    }
+    header->checksum = sum & 0xff;
+}
+
+static inline uint32_t
+OpenBIOS_set_var(uint8_t *nvram, uint32_t addr, const unsigned char *str)
+{
+    uint32_t len;
+
+    len = strlen(str) + 1;
+    memcpy(&nvram[addr], str, len);
+
+    return addr + len;
+}
+
+/* Sun IDPROM structure at the end of NVRAM */
+struct Sun_nvram {
+    uint8_t type;
+    uint8_t machine_id;
+    uint8_t macaddr[6];
+    uint8_t unused[7];
+    uint8_t checksum;
+};
+
+static inline void
+Sun_init_header(struct Sun_nvram *header, const uint8_t *macaddr, int machine_id)
+{
+    uint8_t tmp, *tmpptr;
+    unsigned int i;
+
+    header->type = 1;
+    header->machine_id = machine_id & 0xff;
+    memcpy(&header->macaddr, macaddr, 6);
+    /* Calculate checksum */
+    tmp = 0;
+    tmpptr = (uint8_t *)header;
+    for (i = 0; i < 15; i++)
+        tmp ^= tmpptr[i];
+
+    header->checksum = tmp;
+}
+
+#else /* __ASSEMBLY__ */
+
+/* Structure offsets for asm use */
+
+/* Open Hack'Ware NVRAM configuration structure */
+#define OHW_ARCH_PTR   0x18
+#define OHW_RAM_SIZE   0x38
+#define OHW_BOOT_CPU   0xC9
+
+/* Sparc32 runtime NVRAM structure for SMP CPU boot */
+#define SPARC_SMP_CTX    0x0
+#define SPARC_SMP_CTXTBL 0x4
+#define SPARC_SMP_ENTRY  0x8
+#define SPARC_SMP_VALID  0xc
+
+/* Sun IDPROM structure at the end of NVRAM */
+#define SPARC_MACHINE_ID 0x1fd9
+
+#endif /* __ASSEMBLY__ */
+#endif /* FIRMWARE_ABI_H */
diff --git a/hw/flash.h b/hw/flash.h
new file mode 100644
index 000000000..42d25fe4d
--- /dev/null
+++ b/hw/flash.h
@@ -0,0 +1,47 @@
+/* NOR flash devices */
+typedef struct pflash_t pflash_t;
+
+/* pflash_cfi01.c */
+pflash_t *pflash_cfi01_register(target_phys_addr_t base, ram_addr_t off,
+                                BlockDriverState *bs,
+                                uint32_t sector_len, int nb_blocs, int width,
+                                uint16_t id0, uint16_t id1,
+                                uint16_t id2, uint16_t id3);
+
+/* pflash_cfi02.c */
+pflash_t *pflash_cfi02_register(target_phys_addr_t base, ram_addr_t off,
+                                BlockDriverState *bs, uint32_t sector_len,
+                                int nb_blocs, int width,
+                                uint16_t id0, uint16_t id1,
+                                uint16_t id2, uint16_t id3);
+
+/* nand.c */
+struct nand_flash_s;
+struct nand_flash_s *nand_init(int manf_id, int chip_id);
+void nand_done(struct nand_flash_s *s);
+void nand_setpins(struct nand_flash_s *s,
+                int cle, int ale, int ce, int wp, int gnd);
+void nand_getpins(struct nand_flash_s *s, int *rb);
+void nand_setio(struct nand_flash_s *s, uint8_t value);
+uint8_t nand_getio(struct nand_flash_s *s);
+
+#define NAND_MFR_TOSHIBA	0x98
+#define NAND_MFR_SAMSUNG	0xec
+#define NAND_MFR_FUJITSU	0x04
+#define NAND_MFR_NATIONAL	0x8f
+#define NAND_MFR_RENESAS	0x07
+#define NAND_MFR_STMICRO	0x20
+#define NAND_MFR_HYNIX		0xad
+#define NAND_MFR_MICRON		0x2c
+
+/* ecc.c */
+struct ecc_state_s {
+    uint8_t cp;		/* Column parity */
+    uint16_t lp[2];	/* Line parity */
+    uint16_t count;
+};
+
+uint8_t ecc_digest(struct ecc_state_s *s, uint8_t sample);
+void ecc_reset(struct ecc_state_s *s);
+void ecc_put(QEMUFile *f, struct ecc_state_s *s);
+void ecc_get(QEMUFile *f, struct ecc_state_s *s);
diff --git a/hw/grackle_pci.c b/hw/grackle_pci.c
index fb4605166..91d426102 100644
--- a/hw/grackle_pci.c
+++ b/hw/grackle_pci.c
@@ -1,7 +1,8 @@
 /*
- * QEMU Grackle (heathrow PPC) PCI host
+ * QEMU Grackle PCI host (heathrow OldWorld PowerMac)
  *
- * Copyright (c) 2006 Fabrice Bellard
+ * Copyright (c) 2006-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -22,7 +23,10 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "ppc_mac.h"
+#include "pci.h"
+
 typedef target_phys_addr_t pci_addr_t;
 #include "pci_host.h"
 
@@ -82,7 +86,7 @@ static int pci_grackle_map_irq(PCIDevice *pci_dev, int irq_num)
 
 static void pci_grackle_set_irq(qemu_irq *pic, int irq_num, int level)
 {
-    qemu_set_irq(pic[irq_num + 8], level);
+    qemu_set_irq(pic[irq_num + 0x15], level);
 }
 
 PCIBus *pci_grackle_init(uint32_t base, qemu_irq *pic)
@@ -93,7 +97,7 @@ PCIBus *pci_grackle_init(uint32_t base, qemu_irq *pic)
 
     s = qemu_mallocz(sizeof(GrackleState));
     s->bus = pci_register_bus(pci_grackle_set_irq, pci_grackle_map_irq,
-                              pic, 0, 0);
+                              pic, 0, 4);
 
     pci_mem_config = cpu_register_io_memory(0, pci_grackle_config_read,
                                             pci_grackle_config_write, s);
@@ -113,22 +117,6 @@ PCIBus *pci_grackle_init(uint32_t base, qemu_irq *pic)
     d->config[0x0b] = 0x06; // class_base = PCI_bridge
     d->config[0x0e] = 0x00; // header_type
 
-    d->config[0x18] = 0x00;  // primary_bus
-    d->config[0x19] = 0x01;  // secondary_bus
-    d->config[0x1a] = 0x00;  // subordinate_bus
-    d->config[0x1c] = 0x00;
-    d->config[0x1d] = 0x00;
-
-    d->config[0x20] = 0x00; // memory_base
-    d->config[0x21] = 0x00;
-    d->config[0x22] = 0x01; // memory_limit
-    d->config[0x23] = 0x00;
-
-    d->config[0x24] = 0x00; // prefetchable_memory_base
-    d->config[0x25] = 0x00;
-    d->config[0x26] = 0x00; // prefetchable_memory_limit
-    d->config[0x27] = 0x00;
-
 #if 0
     /* PCI2PCI bridge same values as PearPC - check this */
     d->config[0x00] = 0x11; // vendor_id
diff --git a/hw/gt64xxx.c b/hw/gt64xxx.c
index fbebbbe6e..46d6a762d 100644
--- a/hw/gt64xxx.c
+++ b/hw/gt64xxx.c
@@ -22,7 +22,10 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "mips.h"
+#include "pci.h"
+#include "pc.h"
 
 typedef target_phys_addr_t pci_addr_t;
 #include "pci_host.h"
@@ -306,9 +309,8 @@ static void gt64120_writel (void *opaque, target_phys_addr_t addr,
     GT64120State *s = opaque;
     uint32_t saddr;
 
-#ifdef TARGET_WORDS_BIGENDIAN
-    val = bswap32(val);
-#endif
+    if (!(s->regs[GT_PCI0_CMD] & 1))
+        val = bswap32(val);
 
     saddr = (addr & 0xfff) >> 2;
     switch (saddr) {
@@ -528,8 +530,7 @@ static void gt64120_writel (void *opaque, target_phys_addr_t addr,
         s->pci->config_reg = val & 0x80fffffc;
         break;
     case GT_PCI0_CFGDATA:
-        if (s->pci->config_reg & (1u << 31))
-            pci_host_data_writel(s->pci, 0, val);
+        pci_host_data_writel(s->pci, 0, val);
         break;
 
     /* Interrupts */
@@ -585,9 +586,7 @@ static uint32_t gt64120_readl (void *opaque,
     uint32_t val;
     uint32_t saddr;
 
-    val = 0;
     saddr = (addr & 0xfff) >> 2;
-
     switch (saddr) {
 
     /* CPU Configuration */
@@ -768,10 +767,7 @@ static uint32_t gt64120_readl (void *opaque,
         val = s->pci->config_reg;
         break;
     case GT_PCI0_CFGDATA:
-        if (!(s->pci->config_reg & (1u << 31)))
-            val = 0xffffffff;
-        else
-            val = pci_host_data_readl(s->pci, 0);
+        val = pci_host_data_readl(s->pci, 0);
         break;
 
     case GT_PCI0_CMD:
@@ -844,9 +840,9 @@ static uint32_t gt64120_readl (void *opaque,
         break;
     }
 
-#ifdef TARGET_WORDS_BIGENDIAN
-    val = bswap32(val);
-#endif
+    if (!(s->regs[GT_PCI0_CMD] & 1))
+        val = bswap32(val);
+
     return val;
 }
 
@@ -912,7 +908,7 @@ static void pci_gt64120_set_irq(qemu_irq *pic, int irq_num, int level)
 }
 
 
-void gt64120_reset(void *opaque)
+static void gt64120_reset(void *opaque)
 {
     GT64120State *s = opaque;
 
@@ -1083,19 +1079,12 @@ void gt64120_reset(void *opaque)
 
 static uint32_t gt64120_read_config(PCIDevice *d, uint32_t address, int len)
 {
-    uint32_t val = pci_default_read_config(d, address, len);
-#ifdef TARGET_WORDS_BIGENDIAN
-    val = bswap32(val);
-#endif
-    return val;
+    return pci_default_read_config(d, address, len);
 }
 
 static void gt64120_write_config(PCIDevice *d, uint32_t address, uint32_t val,
                                  int len)
 {
-#ifdef TARGET_WORDS_BIGENDIAN
-    val = bswap32(val);
-#endif
     pci_default_write_config(d, address, val, len);
 }
 
@@ -1123,6 +1112,11 @@ PCIBus *pci_gt64120_init(qemu_irq *pic)
     GT64120State *s;
     PCIDevice *d;
 
+    (void)&pci_host_data_writeb; /* avoid warning */
+    (void)&pci_host_data_writew; /* avoid warning */
+    (void)&pci_host_data_readb; /* avoid warning */
+    (void)&pci_host_data_readw; /* avoid warning */
+
     s = qemu_mallocz(sizeof(GT64120State));
     s->pci = qemu_mallocz(sizeof(GT64120PCIState));
 
diff --git a/hw/gumstix.c b/hw/gumstix.c
new file mode 100644
index 000000000..2cf52f9c0
--- /dev/null
+++ b/hw/gumstix.c
@@ -0,0 +1,134 @@
+/*
+ * Gumstix Platforms
+ *
+ * Copyright (c) 2007 by Thorsten Zitterell <info@bitmux.org>
+ *
+ * Code based on spitz platform by Andrzej Zaborowski <balrog@zabor.org>
+ *
+ * This code is licensed under the GNU GPL v2.
+ */
+ 
+/* 
+ * Example usage:
+ * 
+ * connex:
+ * =======
+ * create image:
+ * # dd of=flash bs=1k count=16k if=/dev/zero
+ * # dd of=flash bs=1k conv=notrunc if=u-boot.bin
+ * # dd of=flash bs=1k conv=notrunc seek=256 if=rootfs.arm_nofpu.jffs2
+ * start it:
+ * # qemu-system-arm -M connex -pflash flash -monitor null -nographic
+ *
+ * verdex:
+ * =======
+ * create image:
+ * # dd of=flash bs=1k count=32k if=/dev/zero
+ * # dd of=flash bs=1k conv=notrunc if=u-boot.bin
+ * # dd of=flash bs=1k conv=notrunc seek=256 if=rootfs.arm_nofpu.jffs2
+ * # dd of=flash bs=1k conv=notrunc seek=31744 if=uImage
+ * start it:
+ * # qemu-system-arm -M verdex -pflash flash -monitor null -nographic -m 289
+ */
+
+#include "hw.h"
+#include "pxa.h"
+#include "net.h"
+#include "flash.h"
+#include "sysemu.h"
+#include "devices.h"
+#include "boards.h"
+
+static const int sector_len = 128 * 1024;
+
+static void connex_init(int ram_size, int vga_ram_size,
+                const char *boot_device, DisplayState *ds,
+                const char *kernel_filename, const char *kernel_cmdline,
+                const char *initrd_filename, const char *cpu_model)
+{
+    struct pxa2xx_state_s *cpu;
+    int index;
+
+    uint32_t connex_rom = 0x01000000;
+    uint32_t connex_ram = 0x04000000;
+
+    if (ram_size < (connex_ram + connex_rom + PXA2XX_INTERNAL_SIZE)) {
+        fprintf(stderr, "This platform requires %i bytes of memory\n",
+                connex_ram + connex_rom + PXA2XX_INTERNAL_SIZE);
+        exit(1);
+    }
+
+    cpu = pxa255_init(connex_ram, ds);
+
+    index = drive_get_index(IF_PFLASH, 0, 0);
+    if (index == -1) {
+        fprintf(stderr, "A flash image must be given with the "
+                "'pflash' parameter\n");
+        exit(1);
+    }
+
+    if (!pflash_cfi01_register(0x00000000, qemu_ram_alloc(connex_rom),
+            drives_table[index].bdrv, sector_len, connex_rom / sector_len,
+            2, 0, 0, 0, 0)) {
+        fprintf(stderr, "qemu: Error registering flash memory.\n");
+        exit(1);
+    }
+
+    cpu->env->regs[15] = 0x00000000;
+
+    /* Interrupt line of NIC is connected to GPIO line 36 */
+    smc91c111_init(&nd_table[0], 0x04000300,
+                    pxa2xx_gpio_in_get(cpu->gpio)[36]);
+}
+
+static void verdex_init(int ram_size, int vga_ram_size,
+                const char *boot_device, DisplayState *ds,
+                const char *kernel_filename, const char *kernel_cmdline,
+                const char *initrd_filename, const char *cpu_model)
+{
+    struct pxa2xx_state_s *cpu;
+    int index;
+
+    uint32_t verdex_rom = 0x02000000;
+    uint32_t verdex_ram = 0x10000000;
+
+    if (ram_size < (verdex_ram + verdex_rom + PXA2XX_INTERNAL_SIZE)) {
+        fprintf(stderr, "This platform requires %i bytes of memory\n",
+                verdex_ram + verdex_rom + PXA2XX_INTERNAL_SIZE);
+        exit(1);
+    }
+
+    cpu = pxa270_init(verdex_ram, ds, cpu_model ?: "pxa270-c0");
+
+    index = drive_get_index(IF_PFLASH, 0, 0);
+    if (index == -1) {
+        fprintf(stderr, "A flash image must be given with the "
+                "'pflash' parameter\n");
+        exit(1);
+    }
+
+    if (!pflash_cfi01_register(0x00000000, qemu_ram_alloc(verdex_rom),
+            drives_table[index].bdrv, sector_len, verdex_rom / sector_len,
+            2, 0, 0, 0, 0)) {
+        fprintf(stderr, "qemu: Error registering flash memory.\n");
+        exit(1);
+    }
+
+    cpu->env->regs[15] = 0x00000000;
+
+    /* Interrupt line of NIC is connected to GPIO line 99 */
+    smc91c111_init(&nd_table[0], 0x04000300,
+                    pxa2xx_gpio_in_get(cpu->gpio)[99]);
+}
+
+QEMUMachine connex_machine = {
+    "connex",
+    "Gumstix Connex (PXA255)",
+    connex_init,
+};
+
+QEMUMachine verdex_machine = {
+    "verdex",
+    "Gumstix Verdex (PXA270)",
+    verdex_init,
+};
diff --git a/hw/heathrow_pic.c b/hw/heathrow_pic.c
index 96eb6565f..dc2a30c85 100644
--- a/hw/heathrow_pic.c
+++ b/hw/heathrow_pic.c
@@ -1,7 +1,8 @@
 /*
- * Heathrow PIC support (standard PowerMac PIC)
+ * Heathrow PIC support (OldWorld PowerMac)
  *
- * Copyright (c) 2005 Fabrice Bellard
+ * Copyright (c) 2005-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -21,7 +22,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "ppc_mac.h"
 
 //#define DEBUG
 
@@ -34,6 +36,7 @@ typedef struct HeathrowPIC {
 
 typedef struct HeathrowPICS {
     HeathrowPIC pics[2];
+    qemu_irq *irqs;
 } HeathrowPICS;
 
 static inline int check_irq(HeathrowPIC *pic)
@@ -45,9 +48,9 @@ static inline int check_irq(HeathrowPIC *pic)
 static void heathrow_pic_update(HeathrowPICS *s)
 {
     if (check_irq(&s->pics[0]) || check_irq(&s->pics[1])) {
-        cpu_interrupt(first_cpu, CPU_INTERRUPT_HARD);
+        qemu_irq_raise(s->irqs[0]);
     } else {
-        cpu_reset_interrupt(first_cpu, CPU_INTERRUPT_HARD);
+        qemu_irq_lower(s->irqs[0]);
     }
 }
 
@@ -57,12 +60,13 @@ static void pic_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
     HeathrowPIC *pic;
     unsigned int n;
 
+#ifdef TARGET_WORDS_BIGENDIAN
     value = bswap32(value);
-#ifdef DEBUG
-    printf("pic_writel: %08x: %08x\n",
-           addr, value);
 #endif
     n = ((addr & 0xfff) - 0x10) >> 4;
+#ifdef DEBUG
+    printf("pic_writel: " PADDRX " %u: %08x\n", addr, n, value);
+#endif
     if (n >= 2)
         return;
     pic = &s->pics[n];
@@ -110,10 +114,11 @@ static uint32_t pic_readl (void *opaque, target_phys_addr_t addr)
         }
     }
 #ifdef DEBUG
-    printf("pic_readl: %08x: %08x\n",
-           addr, value);
+    printf("pic_readl: " PADDRX " %u: %08x\n", addr, n, value);
 #endif
+#ifdef TARGET_WORDS_BIGENDIAN
     value = bswap32(value);
+#endif
     return value;
 }
 
@@ -156,13 +161,17 @@ static void heathrow_pic_set_irq(void *opaque, int num, int level)
     heathrow_pic_update(s);
 }
 
-qemu_irq *heathrow_pic_init(int *pmem_index)
+qemu_irq *heathrow_pic_init(int *pmem_index,
+                            int nb_cpus, qemu_irq **irqs)
 {
     HeathrowPICS *s;
 
     s = qemu_mallocz(sizeof(HeathrowPICS));
     s->pics[0].level_triggered = 0;
     s->pics[1].level_triggered = 0x1ff00000;
+    /* only 1 CPU */
+    s->irqs = irqs[0];
     *pmem_index = cpu_register_io_memory(0, pic_read, pic_write, s);
+
     return qemu_allocate_irqs(heathrow_pic_set_irq, s, 64);
 }
diff --git a/hw/hw.h b/hw/hw.h
new file mode 100644
index 000000000..6ce233948
--- /dev/null
+++ b/hw/hw.h
@@ -0,0 +1,106 @@
+/* Declarations for use by hardware emulation.  */
+#ifndef QEMU_HW_H
+#define QEMU_HW_H
+
+#include "qemu-common.h"
+#include "irq.h"
+
+/* VM Load/Save */
+
+typedef void (QEMUFilePutBufferFunc)(void *opaque, const uint8_t *buf, int64_t pos, int size);
+typedef int (QEMUFileGetBufferFunc)(void *opaque, uint8_t *buf, int64_t pos, int size);
+typedef void (QEMUFileCloseFunc)(void *opaque);
+
+QEMUFile *qemu_fopen(void *opaque, QEMUFilePutBufferFunc *put_buffer,
+                     QEMUFileGetBufferFunc *get_buffer, QEMUFileCloseFunc *close);
+QEMUFile *qemu_fopen_file(const char *filename, const char *mode);
+QEMUFile *qemu_fopen_fd(int fd);
+void qemu_fflush(QEMUFile *f);
+void qemu_fclose(QEMUFile *f);
+void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, int size);
+void qemu_put_byte(QEMUFile *f, int v);
+void qemu_put_be16(QEMUFile *f, unsigned int v);
+void qemu_put_be32(QEMUFile *f, unsigned int v);
+void qemu_put_be64(QEMUFile *f, uint64_t v);
+int qemu_get_buffer(QEMUFile *f, uint8_t *buf, int size);
+int qemu_get_byte(QEMUFile *f);
+unsigned int qemu_get_be16(QEMUFile *f);
+unsigned int qemu_get_be32(QEMUFile *f);
+uint64_t qemu_get_be64(QEMUFile *f);
+
+static inline void qemu_put_be64s(QEMUFile *f, const uint64_t *pv)
+{
+    qemu_put_be64(f, *pv);
+}
+
+static inline void qemu_put_be32s(QEMUFile *f, const uint32_t *pv)
+{
+    qemu_put_be32(f, *pv);
+}
+
+static inline void qemu_put_be16s(QEMUFile *f, const uint16_t *pv)
+{
+    qemu_put_be16(f, *pv);
+}
+
+static inline void qemu_put_8s(QEMUFile *f, const uint8_t *pv)
+{
+    qemu_put_byte(f, *pv);
+}
+
+static inline void qemu_get_be64s(QEMUFile *f, uint64_t *pv)
+{
+    *pv = qemu_get_be64(f);
+}
+
+static inline void qemu_get_be32s(QEMUFile *f, uint32_t *pv)
+{
+    *pv = qemu_get_be32(f);
+}
+
+static inline void qemu_get_be16s(QEMUFile *f, uint16_t *pv)
+{
+    *pv = qemu_get_be16(f);
+}
+
+static inline void qemu_get_8s(QEMUFile *f, uint8_t *pv)
+{
+    *pv = qemu_get_byte(f);
+}
+
+#ifdef NEED_CPU_H
+#if TARGET_LONG_BITS == 64
+#define qemu_put_betl qemu_put_be64
+#define qemu_get_betl qemu_get_be64
+#define qemu_put_betls qemu_put_be64s
+#define qemu_get_betls qemu_get_be64s
+#else
+#define qemu_put_betl qemu_put_be32
+#define qemu_get_betl qemu_get_be32
+#define qemu_put_betls qemu_put_be32s
+#define qemu_get_betls qemu_get_be32s
+#endif
+#endif
+
+int64_t qemu_ftell(QEMUFile *f);
+int64_t qemu_fseek(QEMUFile *f, int64_t pos, int whence);
+
+typedef void SaveStateHandler(QEMUFile *f, void *opaque);
+typedef int LoadStateHandler(QEMUFile *f, void *opaque, int version_id);
+
+int register_savevm(const char *idstr,
+                    int instance_id,
+                    int version_id,
+                    SaveStateHandler *save_state,
+                    LoadStateHandler *load_state,
+                    void *opaque);
+
+typedef void QEMUResetHandler(void *opaque);
+
+void qemu_register_reset(QEMUResetHandler *func, void *opaque);
+
+/* These should really be in isa.h, but are here to make pc.h happy.  */
+typedef void (IOPortWriteFunc)(void *opaque, uint32_t address, uint32_t data);
+typedef uint32_t (IOPortReadFunc)(void *opaque, uint32_t address);
+
+#endif
diff --git a/hw/hypercall.c b/hw/hypercall.c
index 7210f3299..73f6bb159 100644
--- a/hw/hypercall.c
+++ b/hw/hypercall.c
@@ -22,7 +22,12 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw/hw.h"
+#include "sysemu.h"
+#include "qemu-char.h"
+#include "hw/isa.h"
+#include "hw/irq.h"
+#include "hw/pci.h"
 #include "hypercall.h"
 #include <stddef.h>
 
diff --git a/hw/i2c.c b/hw/i2c.c
index f0d117c14..e590801af 100644
--- a/hw/i2c.c
+++ b/hw/i2c.c
@@ -7,7 +7,8 @@
  * This code is licenced under the LGPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "i2c.h"
 
 struct i2c_bus
 {
@@ -30,7 +31,7 @@ i2c_slave *i2c_slave_init(i2c_bus *bus, int address, int size)
     i2c_slave *dev;
 
     if (size < sizeof(i2c_slave))
-        cpu_abort(cpu_single_env, "I2C struct too small");
+        hw_error("I2C struct too small");
 
     dev = (i2c_slave *)qemu_mallocz(size);
     dev->address = address;
@@ -51,8 +52,7 @@ int i2c_bus_busy(i2c_bus *bus)
     return bus->current_dev != NULL;
 }
 
-/* Returns nonzero if the bus is already busy, or is the address is not
-   valid.  */
+/* Returns non-zero if the address is not valid.  */
 /* TODO: Make this handle multiple masters.  */
 int i2c_start_transfer(i2c_bus *bus, int address, int recv)
 {
diff --git a/hw/i2c.h b/hw/i2c.h
index 9330ae852..2897036ed 100644
--- a/hw/i2c.h
+++ b/hw/i2c.h
@@ -13,8 +13,6 @@ enum i2c_event {
     I2C_NACK /* Masker NACKed a receive byte.  */
 };
 
-typedef struct i2c_slave i2c_slave;
-
 /* Master to slave.  */
 typedef int (*i2c_send_cb)(i2c_slave *s, uint8_t data);
 /* Slave to master.  */
@@ -34,8 +32,6 @@ struct i2c_slave
     void *next;
 };
 
-typedef struct i2c_bus i2c_bus;
-
 i2c_bus *i2c_init_bus(void);
 i2c_slave *i2c_slave_init(i2c_bus *bus, int address, int size);
 void i2c_set_slave_address(i2c_slave *dev, int address);
@@ -50,6 +46,14 @@ void i2c_bus_load(QEMUFile *f, i2c_bus *bus);
 void i2c_slave_save(QEMUFile *f, i2c_slave *dev);
 void i2c_slave_load(QEMUFile *f, i2c_slave *dev);
 
+/* max111x.c */
+struct max111x_s;
+uint32_t max111x_read(void *opaque);
+void max111x_write(void *opaque, uint32_t value);
+struct max111x_s *max1110_init(qemu_irq cb);
+struct max111x_s *max1111_init(qemu_irq cb);
+void max111x_set_input(struct max111x_s *s, int line, uint8_t value);
+
 /* max7310.c */
 i2c_slave *max7310_init(i2c_bus *bus);
 void max7310_reset(i2c_slave *i2c);
@@ -64,4 +68,7 @@ void wm8750_data_req_set(i2c_slave *i2c,
 void wm8750_dac_dat(void *opaque, uint32_t sample);
 uint32_t wm8750_adc_dat(void *opaque);
 
+/* ssd0303.c */
+void ssd0303_init(DisplayState *ds, i2c_bus *bus, int address);
+
 #endif
diff --git a/hw/i8254.c b/hw/i8254.c
index 8480a9a37..c2816802b 100644
--- a/hw/i8254.c
+++ b/hw/i8254.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "pc.h"
+#include "isa.h"
+#include "qemu-timer.h"
 
 //#define DEBUG_PIT
 
@@ -360,6 +363,8 @@ static uint32_t pit_ioport_read(void *opaque, uint32_t addr)
 /* global counters for time-drift fix */
 int64_t timer_acks=0, timer_interrupts=0, timer_ints_to_push=0;
 
+extern int time_drift_fix;
+
 static void pit_irq_timer_update(PITChannelState *s, int64_t current_time)
 {
     int64_t expire_time;
@@ -415,7 +420,7 @@ static void pit_save(QEMUFile *f, void *opaque)
 
     for(i = 0; i < 3; i++) {
         s = &pit->channels[i];
-        qemu_put_be32s(f, &s->count);
+        qemu_put_be32(f, s->count);
         qemu_put_be16s(f, &s->latched_count);
         qemu_put_8s(f, &s->count_latched);
         qemu_put_8s(f, &s->status_latched);
@@ -427,9 +432,9 @@ static void pit_save(QEMUFile *f, void *opaque)
         qemu_put_8s(f, &s->mode);
         qemu_put_8s(f, &s->bcd);
         qemu_put_8s(f, &s->gate);
-        qemu_put_be64s(f, &s->count_load_time);
+        qemu_put_be64(f, s->count_load_time);
         if (s->irq_timer) {
-            qemu_put_be64s(f, &s->next_transition_time);
+            qemu_put_be64(f, s->next_transition_time);
             qemu_put_timer(f, s->irq_timer);
         }
     }
@@ -446,7 +451,7 @@ static int pit_load(QEMUFile *f, void *opaque, int version_id)
 
     for(i = 0; i < 3; i++) {
         s = &pit->channels[i];
-        qemu_get_be32s(f, &s->count);
+        s->count=qemu_get_be32(f);
         qemu_get_be16s(f, &s->latched_count);
         qemu_get_8s(f, &s->count_latched);
         qemu_get_8s(f, &s->status_latched);
@@ -458,9 +463,9 @@ static int pit_load(QEMUFile *f, void *opaque, int version_id)
         qemu_get_8s(f, &s->mode);
         qemu_get_8s(f, &s->bcd);
         qemu_get_8s(f, &s->gate);
-        qemu_get_be64s(f, &s->count_load_time);
+        s->count_load_time=qemu_get_be64(f);
         if (s->irq_timer) {
-            qemu_get_be64s(f, &s->next_transition_time);
+            s->next_transition_time=qemu_get_be64(f);
             qemu_get_timer(f, s->irq_timer);
         }
     }
diff --git a/hw/i8259.c b/hw/i8259.c
index fac86d27a..071f9f193 100644
--- a/hw/i8259.c
+++ b/hw/i8259.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "pc.h"
+#include "isa.h"
+#include "console.h"
 
 #ifdef USE_KVM
 #include "qemu-kvm.h"
@@ -168,7 +171,7 @@ void pic_update_irq(PicState2 *s)
     }
 
 /* all targets should do this rather than acking the IRQ in the cpu */
-#if defined(TARGET_MIPS)
+#if defined(TARGET_MIPS) || defined(TARGET_PPC)
     else {
         qemu_irq_lower(s->parent_irq);
     }
@@ -179,7 +182,7 @@ void pic_update_irq(PicState2 *s)
 int64_t irq_time[16];
 #endif
 
-void i8259_set_irq(void *opaque, int irq, int level)
+static void i8259_set_irq(void *opaque, int irq, int level)
 {
     PicState2 *s = opaque;
 #ifdef USE_KVM
@@ -231,6 +234,8 @@ static inline void pic_intack(PicState *s, int irq)
 
 }
 
+extern int time_drift_fix;
+
 int pic_read_irq(PicState2 *s)
 {
     int irq, irq2, intno;
diff --git a/hw/ide.c b/hw/ide.c
index 329d053e1..18431e7a3 100644
--- a/hw/ide.c
+++ b/hw/ide.c
@@ -22,7 +22,15 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "pc.h"
+#include "pci.h"
+#include "scsi-disk.h"
+#include "pcmcia.h"
+#include "block.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
+#include "ppc_mac.h"
 
 /* debug IDE devices */
 //#define DEBUG_IDE
@@ -358,7 +366,7 @@ typedef struct IDEState {
     uint8_t *data_ptr;
     uint8_t *data_end;
     uint8_t io_buffer[MAX_MULT_SECTORS*512 + 4];
-    QEMUTimer *sector_write_timer; /* only used for win2k instal hack */
+    QEMUTimer *sector_write_timer; /* only used for win2k install hack */
     uint32_t irq_count; /* counts IRQs when using win2k install hack */
     /* CF-ATA extended error */
     uint8_t ext_error;
@@ -463,12 +471,12 @@ static void ide_identify(IDEState *s)
     put_le16(p + 5, 512); /* XXX: retired, remove ? */
     put_le16(p + 6, s->sectors);
     snprintf(buf, sizeof(buf), "QM%05d", s->drive_serial);
-    padstr((uint8_t *)(p + 10), buf, 20); /* serial number */
+    padstr((char *)(p + 10), buf, 20); /* serial number */
     put_le16(p + 20, 3); /* XXX: retired, remove ? */
     put_le16(p + 21, 512); /* cache size in sectors */
     put_le16(p + 22, 4); /* ecc bytes */
-    padstr((uint8_t *)(p + 23), QEMU_VERSION, 8); /* firmware version */
-    padstr((uint8_t *)(p + 27), "QEMU HARDDISK", 40); /* model */
+    padstr((char *)(p + 23), QEMU_VERSION, 8); /* firmware version */
+    padstr((char *)(p + 27), "QEMU HARDDISK", 40); /* model */
 #if MAX_MULT_SECTORS > 1
     put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
 #endif
@@ -528,12 +536,12 @@ static void ide_atapi_identify(IDEState *s)
     /* Removable CDROM, 50us response, 12 byte packets */
     put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
     snprintf(buf, sizeof(buf), "QM%05d", s->drive_serial);
-    padstr((uint8_t *)(p + 10), buf, 20); /* serial number */
+    padstr((char *)(p + 10), buf, 20); /* serial number */
     put_le16(p + 20, 3); /* buffer type */
     put_le16(p + 21, 512); /* cache size in sectors */
     put_le16(p + 22, 4); /* ecc bytes */
-    padstr((uint8_t *)(p + 23), QEMU_VERSION, 8); /* firmware version */
-    padstr((uint8_t *)(p + 27), "QEMU CD-ROM", 40); /* model */
+    padstr((char *)(p + 23), QEMU_VERSION, 8); /* firmware version */
+    padstr((char *)(p + 27), "QEMU CD-ROM", 40); /* model */
     put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
 #ifdef USE_DMA_CDROM
     put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
@@ -583,10 +591,10 @@ static void ide_cfata_identify(IDEState *s)
     put_le16(p + 7, s->nb_sectors >> 16);	/* Sectors per card */
     put_le16(p + 8, s->nb_sectors);		/* Sectors per card */
     snprintf(buf, sizeof(buf), "QM%05d", s->drive_serial);
-    padstr((uint8_t *)(p + 10), buf, 20);	/* Serial number in ASCII */
+    padstr((char *)(p + 10), buf, 20);	/* Serial number in ASCII */
     put_le16(p + 22, 0x0004);			/* ECC bytes */
-    padstr((uint8_t *) (p + 23), QEMU_VERSION, 8);	/* Firmware Revision */
-    padstr((uint8_t *) (p + 27), "QEMU MICRODRIVE", 40);/* Model number */
+    padstr((char *) (p + 23), QEMU_VERSION, 8);	/* Firmware Revision */
+    padstr((char *) (p + 27), "QEMU MICRODRIVE", 40);/* Model number */
 #if MAX_MULT_SECTORS > 1
     put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
 #else
@@ -865,44 +873,10 @@ static void ide_sector_write_timer_cb(void *opaque)
     ide_set_irq(s);
 }
 
-static void ide_sector_write_aio_cb(void *opaque, int ret)
-{
-    BMDMAState *bm = opaque;
-    IDEState *s = bm->ide_if;
-
-#ifdef TARGET_I386
-    if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
-	/* It seems there is a bug in the Windows 2000 installer HDD
-	   IDE driver which fills the disk with empty logs when the
-	   IDE write IRQ comes too early. This hack tries to correct
-	   that at the expense of slower write performances. Use this
-	   option _only_ to install Windows 2000. You must disable it
-	   for normal use. */
-	qemu_mod_timer(s->sector_write_timer,
-		       qemu_get_clock(vm_clock) + (ticks_per_sec / 1000));
-    } else
-#endif
-    {
-	ide_set_irq(s);
-    }
-    bm->aiocb = NULL;
-}
-
 static void ide_sector_write(IDEState *s)
 {
-    BMDMAState *bm;
     int64_t sector_num;
-    int n, n1;
-
-    s->io_buffer_index = 0;
-    s->io_buffer_size = 0;
-    bm = s->bmdma;
-    if(bm == NULL) {
-	bm = qemu_mallocz(sizeof(BMDMAState));
-	s->bmdma = bm;
-    }
-    bm->ide_if = s;
-    bm->dma_cb = ide_sector_write_aio_cb;
+    int ret, n, n1;
 
     s->status = READY_STAT | SEEK_STAT;
     sector_num = ide_get_sector(s);
@@ -912,6 +886,7 @@ static void ide_sector_write(IDEState *s)
     n = s->nsector;
     if (n > s->req_nb_sectors)
         n = s->req_nb_sectors;
+    ret = bdrv_write(s->bs, sector_num, s->io_buffer, n);
     s->nsector -= n;
     if (s->nsector == 0) {
         /* no more sectors to write */
@@ -924,8 +899,21 @@ static void ide_sector_write(IDEState *s)
     }
     ide_set_sector(s, sector_num + n);
 
-    bm->aiocb = bdrv_aio_write(s->bs, sector_num, s->io_buffer, n,
-			       ide_sector_write_aio_cb, bm);
+#ifdef TARGET_I386
+    if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
+        /* It seems there is a bug in the Windows 2000 installer HDD
+           IDE driver which fills the disk with empty logs when the
+           IDE write IRQ comes too early. This hack tries to correct
+           that at the expense of slower write performances. Use this
+           option _only_ to install Windows 2000. You must disable it
+           for normal use. */
+        qemu_mod_timer(s->sector_write_timer, 
+                       qemu_get_clock(vm_clock) + (ticks_per_sec / 1000));
+    } else 
+#endif
+    {
+        ide_set_irq(s);
+    }
 }
 
 /* XXX: handle errors */
@@ -1373,7 +1361,7 @@ static void ide_atapi_cmd(IDEState *s)
 
                     buf[8] = 0x2a;
                     buf[9] = 0x12;
-                    buf[10] = 0x08;
+                    buf[10] = 0x00;
                     buf[11] = 0x00;
 
                     buf[12] = 0x70;
@@ -2054,6 +2042,7 @@ static void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
             ide_set_signature(s);
             s->status = 0x00; /* NOTE: READY is _not_ set */
             s->error = 0x01;
+            ide_set_irq(s);
             break;
         case WIN_SRST:
             if (!s->is_cdrom)
@@ -2520,8 +2509,8 @@ static void ide_init_ioport(IDEState *ide_state, int iobase, int iobase2)
 /* save per IDE drive data */
 static void ide_save(QEMUFile* f, IDEState *s)
 {
-    qemu_put_be32s(f, &s->mult_sectors);
-    qemu_put_be32s(f, &s->identify_set);
+    qemu_put_be32(f, s->mult_sectors);
+    qemu_put_be32(f, s->identify_set);
     if (s->identify_set) {
         qemu_put_buffer(f, (const uint8_t *)s->identify_data, 512);
     }
@@ -2548,8 +2537,8 @@ static void ide_save(QEMUFile* f, IDEState *s)
 /* load per IDE drive data */
 static void ide_load(QEMUFile* f, IDEState *s)
 {
-    qemu_get_be32s(f, &s->mult_sectors);
-    qemu_get_be32s(f, &s->identify_set);
+    s->mult_sectors=qemu_get_be32(f);
+    s->identify_set=qemu_get_be32(f);
     if (s->identify_set) {
         qemu_get_buffer(f, (uint8_t *)s->identify_data, 512);
     }
diff --git a/hw/integratorcp.c b/hw/integratorcp.c
index 83c6208cf..549cc25df 100644
--- a/hw/integratorcp.c
+++ b/hw/integratorcp.c
@@ -7,8 +7,13 @@
  * This code is licenced under the GPL
  */
 
-#include "vl.h"
-#include "arm_pic.h"
+#include "hw.h"
+#include "primecell.h"
+#include "devices.h"
+#include "sysemu.h"
+#include "boards.h"
+#include "arm-misc.h"
+#include "net.h"
 
 void DMA_run (void)
 {
@@ -99,7 +104,7 @@ static uint32_t integratorcm_read(void *opaque, target_phys_addr_t offset)
         return 0;
     default:
         cpu_abort (cpu_single_env,
-            "integratorcm_read: Unimplemented offset 0x%x\n", offset);
+            "integratorcm_read: Unimplemented offset 0x%x\n", (int)offset);
         return 0;
     }
 }
@@ -207,7 +212,7 @@ static void integratorcm_write(void *opaque, target_phys_addr_t offset,
         break;
     default:
         cpu_abort (cpu_single_env,
-            "integratorcm_write: Unimplemented offset 0x%x\n", offset);
+            "integratorcm_write: Unimplemented offset 0x%x\n", (int)offset);
         break;
     }
 }
@@ -414,7 +419,8 @@ static uint32_t icp_control_read(void *opaque, target_phys_addr_t offset)
     case 3: /* CP_DECODE */
         return 0x11;
     default:
-        cpu_abort (cpu_single_env, "icp_control_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "icp_control_read: Bad offset %x\n",
+                   (int)offset);
         return 0;
     }
 }
@@ -431,7 +437,8 @@ static void icp_control_write(void *opaque, target_phys_addr_t offset,
         /* Nothing interesting implemented yet.  */
         break;
     default:
-        cpu_abort (cpu_single_env, "icp_control_write: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "icp_control_write: Bad offset %x\n",
+                   (int)offset);
     }
 }
 static CPUReadMemoryFunc *icp_control_readfn[] = {
@@ -462,8 +469,8 @@ static void icp_control_init(uint32_t base)
 
 /* Board init.  */
 
-static void integratorcp_init(int ram_size, int vga_ram_size, int boot_device,
-                     DisplayState *ds, const char **fd_filename, int snapshot,
+static void integratorcp_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
                      const char *kernel_filename, const char *kernel_cmdline,
                      const char *initrd_filename, const char *cpu_model)
 {
@@ -471,11 +478,15 @@ static void integratorcp_init(int ram_size, int vga_ram_size, int boot_device,
     uint32_t bios_offset;
     qemu_irq *pic;
     qemu_irq *cpu_pic;
+    int sd;
 
-    env = cpu_init();
     if (!cpu_model)
         cpu_model = "arm926";
-    cpu_arm_set_model(env, cpu_model);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     bios_offset = ram_size + vga_ram_size;
     /* ??? On a real system the first 1Mb is mapped as SSRAM or boot flash.  */
     /* ??? RAM shoud repeat to fill physical memory space.  */
@@ -491,12 +502,17 @@ static void integratorcp_init(int ram_size, int vga_ram_size, int boot_device,
     icp_pic_init(0xca000000, pic[26], NULL);
     icp_pit_init(0x13000000, pic, 5);
     pl031_init(0x15000000, pic[8]);
-    pl011_init(0x16000000, pic[1], serial_hds[0]);
-    pl011_init(0x17000000, pic[2], serial_hds[1]);
+    pl011_init(0x16000000, pic[1], serial_hds[0], PL011_ARM);
+    pl011_init(0x17000000, pic[2], serial_hds[1], PL011_ARM);
     icp_control_init(0xcb000000);
     pl050_init(0x18000000, pic[3], 0);
     pl050_init(0x19000000, pic[4], 1);
-    pl181_init(0x1c000000, sd_bdrv, pic[23], pic[24]);
+    sd = drive_get_index(IF_SD, 0, 0);
+    if (sd == -1) {
+        fprintf(stderr, "qemu: missing SecureDigital card\n");
+        exit(1);
+    }
+    pl181_init(0x1c000000, drives_table[sd].bdrv, pic[23], pic[24]);
     if (nd_table[0].vlan) {
         if (nd_table[0].model == NULL
             || strcmp(nd_table[0].model, "smc91c111") == 0) {
diff --git a/hw/iommu.c b/hw/iommu.c
index 0ee8c718e..271c4d473 100644
--- a/hw/iommu.c
+++ b/hw/iommu.c
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "sun4m.h"
 
 /* debug iommu */
 //#define DEBUG_IOMMU
@@ -37,7 +38,6 @@ do { printf("IOMMU: " fmt , ##args); } while (0)
 #define IOMMU_CTRL          (0x0000 >> 2)
 #define IOMMU_CTRL_IMPL     0xf0000000 /* Implementation */
 #define IOMMU_CTRL_VERS     0x0f000000 /* Version */
-#define IOMMU_VERSION       0x04000000
 #define IOMMU_CTRL_RNGE     0x0000001c /* Mapping RANGE */
 #define IOMMU_RNGE_16MB     0x00000000 /* 0xff000000 -> 0xffffffff */
 #define IOMMU_RNGE_32MB     0x00000004 /* 0xfe000000 -> 0xffffffff */
@@ -61,15 +61,20 @@ do { printf("IOMMU: " fmt , ##args); } while (0)
 
 #define IOMMU_AFSR          (0x1000 >> 2)
 #define IOMMU_AFSR_ERR      0x80000000 /* LE, TO, or BE asserted */
-#define IOMMU_AFSR_LE       0x40000000 /* SBUS reports error after transaction */
-#define IOMMU_AFSR_TO       0x20000000 /* Write access took more than 12.8 us. */
-#define IOMMU_AFSR_BE       0x10000000 /* Write access received error acknowledge */
+#define IOMMU_AFSR_LE       0x40000000 /* SBUS reports error after
+                                          transaction */
+#define IOMMU_AFSR_TO       0x20000000 /* Write access took more than
+                                          12.8 us. */
+#define IOMMU_AFSR_BE       0x10000000 /* Write access received error
+                                          acknowledge */
 #define IOMMU_AFSR_SIZE     0x0e000000 /* Size of transaction causing error */
 #define IOMMU_AFSR_S        0x01000000 /* Sparc was in supervisor mode */
-#define IOMMU_AFSR_RESV     0x00f00000 /* Reserved, forced to 0x8 by hardware */
+#define IOMMU_AFSR_RESV     0x00800000 /* Reserved, forced to 0x8 by
+                                          hardware */
 #define IOMMU_AFSR_ME       0x00080000 /* Multiple errors occurred */
 #define IOMMU_AFSR_RD       0x00040000 /* A read operation was in progress */
 #define IOMMU_AFSR_FAV      0x00020000 /* IOMMU afar has valid contents */
+#define IOMMU_AFSR_MASK     0xff0fffff
 
 #define IOMMU_AFAR          (0x1004 >> 2)
 
@@ -77,11 +82,12 @@ do { printf("IOMMU: " fmt , ##args); } while (0)
 #define IOMMU_SBCFG1        (0x1014 >> 2) /* SBUS configration per-slot */
 #define IOMMU_SBCFG2        (0x1018 >> 2) /* SBUS configration per-slot */
 #define IOMMU_SBCFG3        (0x101c >> 2) /* SBUS configration per-slot */
-#define IOMMU_SBCFG_SAB30   0x00010000 /* Phys-address bit 30 when bypass enabled */
+#define IOMMU_SBCFG_SAB30   0x00010000 /* Phys-address bit 30 when
+                                          bypass enabled */
 #define IOMMU_SBCFG_BA16    0x00000004 /* Slave supports 16 byte bursts */
 #define IOMMU_SBCFG_BA8     0x00000002 /* Slave supports 8 byte bursts */
 #define IOMMU_SBCFG_BYPASS  0x00000001 /* Bypass IOMMU, treat all addresses
-       	                                  produced by this device as pure
+                                          produced by this device as pure
                                           physical. */
 #define IOMMU_SBCFG_MASK    0x00010003
 
@@ -90,20 +96,22 @@ do { printf("IOMMU: " fmt , ##args); } while (0)
 #define IOMMU_MID           0x00000008
 
 /* The format of an iopte in the page tables */
-#define IOPTE_PAGE          0x07ffff00 /* Physical page number (PA[30:12]) */
-#define IOPTE_CACHE         0x00000080 /* Cached (in vme IOCACHE or Viking/MXCC) */
+#define IOPTE_PAGE          0xffffff00 /* Physical page number (PA[35:12]) */
+#define IOPTE_CACHE         0x00000080 /* Cached (in vme IOCACHE or
+                                          Viking/MXCC) */
 #define IOPTE_WRITE         0x00000004 /* Writeable */
 #define IOPTE_VALID         0x00000002 /* IOPTE is valid */
 #define IOPTE_WAZ           0x00000001 /* Write as zeros */
 
 #define PAGE_SHIFT      12
 #define PAGE_SIZE       (1 << PAGE_SHIFT)
-#define PAGE_MASK	(PAGE_SIZE - 1)
+#define PAGE_MASK       (PAGE_SIZE - 1)
 
 typedef struct IOMMUState {
     target_phys_addr_t addr;
     uint32_t regs[IOMMU_NREGS];
     target_phys_addr_t iostart;
+    uint32_t version;
 } IOMMUState;
 
 static uint32_t iommu_mem_readw(void *opaque, target_phys_addr_t addr)
@@ -114,14 +122,15 @@ static uint32_t iommu_mem_readw(void *opaque, target_phys_addr_t addr)
     saddr = (addr - s->addr) >> 2;
     switch (saddr) {
     default:
-	DPRINTF("read reg[%d] = %x\n", (int)saddr, s->regs[saddr]);
-	return s->regs[saddr];
-	break;
+        DPRINTF("read reg[%d] = %x\n", (int)saddr, s->regs[saddr]);
+        return s->regs[saddr];
+        break;
     }
     return 0;
 }
 
-static void iommu_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
+static void iommu_mem_writew(void *opaque, target_phys_addr_t addr,
+                             uint32_t val)
 {
     IOMMUState *s = opaque;
     target_phys_addr_t saddr;
@@ -130,61 +139,64 @@ static void iommu_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val
     DPRINTF("write reg[%d] = %x\n", (int)saddr, val);
     switch (saddr) {
     case IOMMU_CTRL:
-	switch (val & IOMMU_CTRL_RNGE) {
-	case IOMMU_RNGE_16MB:
-	    s->iostart = 0xffffffffff000000ULL;
-	    break;
-	case IOMMU_RNGE_32MB:
-	    s->iostart = 0xfffffffffe000000ULL;
-	    break;
-	case IOMMU_RNGE_64MB:
-	    s->iostart = 0xfffffffffc000000ULL;
-	    break;
-	case IOMMU_RNGE_128MB:
-	    s->iostart = 0xfffffffff8000000ULL;
-	    break;
-	case IOMMU_RNGE_256MB:
-	    s->iostart = 0xfffffffff0000000ULL;
-	    break;
-	case IOMMU_RNGE_512MB:
-	    s->iostart = 0xffffffffe0000000ULL;
-	    break;
-	case IOMMU_RNGE_1GB:
-	    s->iostart = 0xffffffffc0000000ULL;
-	    break;
-	default:
-	case IOMMU_RNGE_2GB:
-	    s->iostart = 0xffffffff80000000ULL;
-	    break;
-	}
-	DPRINTF("iostart = " TARGET_FMT_plx "\n", s->iostart);
-	s->regs[saddr] = ((val & IOMMU_CTRL_MASK) | IOMMU_VERSION);
-	break;
+        switch (val & IOMMU_CTRL_RNGE) {
+        case IOMMU_RNGE_16MB:
+            s->iostart = 0xffffffffff000000ULL;
+            break;
+        case IOMMU_RNGE_32MB:
+            s->iostart = 0xfffffffffe000000ULL;
+            break;
+        case IOMMU_RNGE_64MB:
+            s->iostart = 0xfffffffffc000000ULL;
+            break;
+        case IOMMU_RNGE_128MB:
+            s->iostart = 0xfffffffff8000000ULL;
+            break;
+        case IOMMU_RNGE_256MB:
+            s->iostart = 0xfffffffff0000000ULL;
+            break;
+        case IOMMU_RNGE_512MB:
+            s->iostart = 0xffffffffe0000000ULL;
+            break;
+        case IOMMU_RNGE_1GB:
+            s->iostart = 0xffffffffc0000000ULL;
+            break;
+        default:
+        case IOMMU_RNGE_2GB:
+            s->iostart = 0xffffffff80000000ULL;
+            break;
+        }
+        DPRINTF("iostart = " TARGET_FMT_plx "\n", s->iostart);
+        s->regs[saddr] = ((val & IOMMU_CTRL_MASK) | s->version);
+        break;
     case IOMMU_BASE:
-	s->regs[saddr] = val & IOMMU_BASE_MASK;
-	break;
+        s->regs[saddr] = val & IOMMU_BASE_MASK;
+        break;
     case IOMMU_TLBFLUSH:
-	DPRINTF("tlb flush %x\n", val);
-	s->regs[saddr] = val & IOMMU_TLBFLUSH_MASK;
-	break;
+        DPRINTF("tlb flush %x\n", val);
+        s->regs[saddr] = val & IOMMU_TLBFLUSH_MASK;
+        break;
     case IOMMU_PGFLUSH:
-	DPRINTF("page flush %x\n", val);
-	s->regs[saddr] = val & IOMMU_PGFLUSH_MASK;
-	break;
+        DPRINTF("page flush %x\n", val);
+        s->regs[saddr] = val & IOMMU_PGFLUSH_MASK;
+        break;
+    case IOMMU_AFSR:
+        s->regs[saddr] = (val & IOMMU_AFSR_MASK) | IOMMU_AFSR_RESV;
+        break;
     case IOMMU_SBCFG0:
     case IOMMU_SBCFG1:
     case IOMMU_SBCFG2:
     case IOMMU_SBCFG3:
-	s->regs[saddr] = val & IOMMU_SBCFG_MASK;
-	break;
+        s->regs[saddr] = val & IOMMU_SBCFG_MASK;
+        break;
     case IOMMU_ARBEN:
         // XXX implement SBus probing: fault when reading unmapped
         // addresses, fault cause and address stored to MMU/IOMMU
-	s->regs[saddr] = (val & IOMMU_ARBEN_MASK) | IOMMU_MID;
-	break;
+        s->regs[saddr] = (val & IOMMU_ARBEN_MASK) | IOMMU_MID;
+        break;
     default:
-	s->regs[saddr] = val;
-	break;
+        s->regs[saddr] = val;
+        break;
     }
 }
 
@@ -234,10 +246,11 @@ static target_phys_addr_t iommu_translate_pa(IOMMUState *s,
     return pa;
 }
 
-static void iommu_bad_addr(IOMMUState *s, target_phys_addr_t addr, int is_write)
+static void iommu_bad_addr(IOMMUState *s, target_phys_addr_t addr,
+                           int is_write)
 {
     DPRINTF("bad addr " TARGET_FMT_plx "\n", addr);
-    s->regs[IOMMU_AFSR] = IOMMU_AFSR_ERR | IOMMU_AFSR_LE | (8 << 20) |
+    s->regs[IOMMU_AFSR] = IOMMU_AFSR_ERR | IOMMU_AFSR_LE | IOMMU_AFSR_RESV |
         IOMMU_AFSR_FAV;
     if (!is_write)
         s->regs[IOMMU_AFSR] |= IOMMU_AFSR_RD;
@@ -283,7 +296,7 @@ static void iommu_save(QEMUFile *f, void *opaque)
     int i;
 
     for (i = 0; i < IOMMU_NREGS; i++)
-	qemu_put_be32s(f, &s->regs[i]);
+        qemu_put_be32s(f, &s->regs[i]);
     qemu_put_be64s(f, &s->iostart);
 }
 
@@ -308,10 +321,12 @@ static void iommu_reset(void *opaque)
 
     memset(s->regs, 0, IOMMU_NREGS * 4);
     s->iostart = 0;
-    s->regs[IOMMU_CTRL] = IOMMU_VERSION;
+    s->regs[IOMMU_CTRL] = s->version;
+    s->regs[IOMMU_ARBEN] = IOMMU_MID;
+    s->regs[IOMMU_AFSR] = IOMMU_AFSR_RESV;
 }
 
-void *iommu_init(target_phys_addr_t addr)
+void *iommu_init(target_phys_addr_t addr, uint32_t version)
 {
     IOMMUState *s;
     int iommu_io_memory;
@@ -321,12 +336,14 @@ void *iommu_init(target_phys_addr_t addr)
         return NULL;
 
     s->addr = addr;
+    s->version = version;
 
-    iommu_io_memory = cpu_register_io_memory(0, iommu_mem_read, iommu_mem_write, s);
+    iommu_io_memory = cpu_register_io_memory(0, iommu_mem_read,
+                                             iommu_mem_write, s);
     cpu_register_physical_memory(addr, IOMMU_NREGS * 4, iommu_io_memory);
 
     register_savevm("iommu", addr, 2, iommu_save, iommu_load, s);
     qemu_register_reset(iommu_reset, s);
+    iommu_reset(s);
     return s;
 }
-
diff --git a/hw/irq.c b/hw/irq.c
index e46ee603c..eca707dd0 100644
--- a/hw/irq.c
+++ b/hw/irq.c
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "irq.h"
 
 struct IRQState {
     qemu_irq_handler handler;
@@ -55,3 +56,16 @@ qemu_irq *qemu_allocate_irqs(qemu_irq_handler handler, void *opaque, int n)
     return s;
 }
 
+static void qemu_notirq(void *opaque, int line, int level)
+{
+    struct IRQState *irq = opaque;
+
+    irq->handler(irq->opaque, irq->n, !level);
+}
+
+qemu_irq qemu_irq_invert(qemu_irq irq)
+{
+    /* The default state for IRQs is low, so raise the output now.  */
+    qemu_irq_raise(irq);
+    return qemu_allocate_irqs(qemu_notirq, irq, 1)[0];
+}
diff --git a/hw/irq.h b/hw/irq.h
index 652fd6abe..0880ad21b 100644
--- a/hw/irq.h
+++ b/hw/irq.h
@@ -1,8 +1,11 @@
+#ifndef QEMU_IRQ_H
+#define QEMU_IRQ_H
+
 /* Generic IRQ/GPIO pin infrastructure.  */
 
+/* FIXME: Rmove one of these.  */
 typedef void (*qemu_irq_handler)(void *opaque, int n, int level);
-
-typedef struct IRQState *qemu_irq;
+typedef void SetIRQFunc(void *opaque, int irq_num, int level);
 
 void qemu_set_irq(qemu_irq irq, int level);
 
@@ -16,6 +19,16 @@ static inline void qemu_irq_lower(qemu_irq irq)
     qemu_set_irq(irq, 0);
 }
 
+static inline void qemu_irq_pulse(qemu_irq irq)
+{
+    qemu_set_irq(irq, 1);
+    qemu_set_irq(irq, 0);
+}
+
 /* Returns an array of N IRQs.  */
 qemu_irq *qemu_allocate_irqs(qemu_irq_handler handler, void *opaque, int n);
 
+/* Returns a new IRQ with opposite polarity.  */
+qemu_irq qemu_irq_invert(qemu_irq irq);
+
+#endif
diff --git a/hw/isa.h b/hw/isa.h
new file mode 100644
index 000000000..89b3004a5
--- /dev/null
+++ b/hw/isa.h
@@ -0,0 +1,24 @@
+/* ISA bus */
+
+extern target_phys_addr_t isa_mem_base;
+
+int register_ioport_read(int start, int length, int size,
+                         IOPortReadFunc *func, void *opaque);
+int register_ioport_write(int start, int length, int size,
+                          IOPortWriteFunc *func, void *opaque);
+void isa_unassign_ioport(int start, int length);
+
+void isa_mmio_init(target_phys_addr_t base, target_phys_addr_t size);
+
+/* dma.c */
+int DMA_get_channel_mode (int nchan);
+int DMA_read_memory (int nchan, void *buf, int pos, int size);
+int DMA_write_memory (int nchan, void *buf, int pos, int size);
+void DMA_hold_DREQ (int nchan);
+void DMA_release_DREQ (int nchan);
+void DMA_schedule(int nchan);
+void DMA_run (void);
+void DMA_init (int high_page_enable);
+void DMA_register_channel (int nchan,
+                           DMA_transfer_handler transfer_handler,
+                           void *opaque);
diff --git a/hw/isa_mmio.c b/hw/isa_mmio.c
index 4e7914e6b..351961120 100644
--- a/hw/isa_mmio.c
+++ b/hw/isa_mmio.c
@@ -22,7 +22,8 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "isa.h"
 
 static void isa_mmio_writeb (void *opaque, target_phys_addr_t addr,
                                   uint32_t val)
diff --git a/hw/jazz_led.c b/hw/jazz_led.c
index 1c7c176ed..a0eea26b5 100644
--- a/hw/jazz_led.c
+++ b/hw/jazz_led.c
@@ -22,7 +22,9 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "mips.h"
+#include "console.h"
 #include "pixel_ops.h"
 
 //#define DEBUG_LED
diff --git a/hw/lsi53c895a.c b/hw/lsi53c895a.c
index e9866baac..3a4ddf7f6 100644
--- a/hw/lsi53c895a.c
+++ b/hw/lsi53c895a.c
@@ -10,7 +10,9 @@
 /* ??? Need to check if the {read,write}[wl] routines work properly on
    big-endian targets.  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pci.h"
+#include "scsi-disk.h"
 
 //#define DEBUG_LSI
 //#define DEBUG_LSI_REG
@@ -149,9 +151,6 @@ do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)
 #define PHASE_MI          7
 #define PHASE_MASK        7
 
-/* The HBA is ID 7, so for simplicitly limit to 7 devices.  */
-#define LSI_MAX_DEVS      7
-
 /* Maximum length of MSG IN data.  */
 #define LSI_MAX_MSGIN_LEN 8
 
@@ -188,6 +187,7 @@ typedef struct {
     /* The tag is a combination of the device ID and the SCSI tag.  */
     uint32_t current_tag;
     uint32_t current_dma_len;
+    int command_complete;
     uint8_t *dma_buf;
     lsi_queue *queue;
     int queue_len;
@@ -466,7 +466,8 @@ static void lsi_do_dma(LSIState *s, int out)
     s->dbc -= count;
 
     if (s->dma_buf == NULL) {
-        s->dma_buf = scsi_get_buf(s->current_dev, s->current_tag);
+        s->dma_buf = s->current_dev->get_buf(s->current_dev,
+                                             s->current_tag);
     }
 
     /* ??? Set SFBR to first data byte.  */
@@ -480,10 +481,10 @@ static void lsi_do_dma(LSIState *s, int out)
         s->dma_buf = NULL;
         if (out) {
             /* Write the data.  */
-            scsi_write_data(s->current_dev, s->current_tag);
+            s->current_dev->write_data(s->current_dev, s->current_tag);
         } else {
             /* Request any remaining data.  */
-            scsi_read_data(s->current_dev, s->current_tag);
+            s->current_dev->read_data(s->current_dev, s->current_tag);
         }
     } else {
         s->dma_buf += count;
@@ -597,6 +598,7 @@ static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
     if (reason == SCSI_REASON_DONE) {
         DPRINTF("Command complete sense=%d\n", (int)arg);
         s->sense = arg;
+        s->command_complete = 2;
         if (s->waiting && s->dbc != 0) {
             /* Raise phase mismatch for short transfers.  */
             lsi_bad_phase(s, out, PHASE_ST);
@@ -613,6 +615,7 @@ static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
     }
     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
     s->current_dma_len = arg;
+    s->command_complete = 1;
     if (!s->waiting)
         return;
     if (s->waiting == 1 || s->dbc == 0) {
@@ -632,21 +635,30 @@ static void lsi_do_command(LSIState *s)
         s->dbc = 16;
     cpu_physical_memory_read(s->dnad, buf, s->dbc);
     s->sfbr = buf[0];
-    n = scsi_send_command(s->current_dev, s->current_tag, buf, s->current_lun);
+    s->command_complete = 0;
+    n = s->current_dev->send_command(s->current_dev, s->current_tag, buf,
+                                     s->current_lun);
     if (n > 0) {
         lsi_set_phase(s, PHASE_DI);
-        scsi_read_data(s->current_dev, s->current_tag);
+        s->current_dev->read_data(s->current_dev, s->current_tag);
     } else if (n < 0) {
         lsi_set_phase(s, PHASE_DO);
-        scsi_write_data(s->current_dev, s->current_tag);
+        s->current_dev->write_data(s->current_dev, s->current_tag);
     }
-    if (n && s->current_dma_len == 0) {
-        /* Command did not complete immediately so disconnect.  */
-        lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
-        lsi_add_msg_byte(s, 4); /* DISCONNECT */
-        lsi_set_phase(s, PHASE_MI);
-        s->msg_action = 1;
-        lsi_queue_command(s);
+
+    if (!s->command_complete) {
+        if (n) {
+            /* Command did not complete immediately so disconnect.  */
+            lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
+            lsi_add_msg_byte(s, 4); /* DISCONNECT */
+            /* wait data */
+            lsi_set_phase(s, PHASE_MI);
+            s->msg_action = 1;
+            lsi_queue_command(s);
+        } else {
+            /* wait command complete */
+            lsi_set_phase(s, PHASE_DI);
+        }
     }
 }
 
@@ -1823,7 +1835,7 @@ void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
     }
     if (s->scsi_dev[id]) {
         DPRINTF("Destroying device %d\n", id);
-        scsi_disk_destroy(s->scsi_dev[id]);
+        s->scsi_dev[id]->destroy(s->scsi_dev[id]);
     }
     DPRINTF("Attaching block device %d\n", id);
     s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
diff --git a/hw/m48t59.c b/hw/m48t59.c
index da61313f1..57291faa9 100644
--- a/hw/m48t59.c
+++ b/hw/m48t59.c
@@ -21,8 +21,11 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
-#include "m48t59.h"
+#include "hw.h"
+#include "nvram.h"
+#include "isa.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
 
 //#define DEBUG_NVRAM
 
@@ -199,8 +202,9 @@ static void set_up_watchdog (m48t59_t *NVRAM, uint8_t value)
 }
 
 /* Direct access to NVRAM */
-void m48t59_write (m48t59_t *NVRAM, uint32_t addr, uint32_t val)
+void m48t59_write (void *opaque, uint32_t addr, uint32_t val)
 {
+    m48t59_t *NVRAM = opaque;
     struct tm tm;
     int tmp;
 
@@ -357,8 +361,9 @@ void m48t59_write (m48t59_t *NVRAM, uint32_t addr, uint32_t val)
     }
 }
 
-uint32_t m48t59_read (m48t59_t *NVRAM, uint32_t addr)
+uint32_t m48t59_read (void *opaque, uint32_t addr)
 {
+    m48t59_t *NVRAM = opaque;
     struct tm tm;
     uint32_t retval = 0xFF;
 
@@ -451,13 +456,17 @@ uint32_t m48t59_read (m48t59_t *NVRAM, uint32_t addr)
     return retval;
 }
 
-void m48t59_set_addr (m48t59_t *NVRAM, uint32_t addr)
+void m48t59_set_addr (void *opaque, uint32_t addr)
 {
+    m48t59_t *NVRAM = opaque;
+
     NVRAM->addr = addr;
 }
 
-void m48t59_toggle_lock (m48t59_t *NVRAM, int lock)
+void m48t59_toggle_lock (void *opaque, int lock)
 {
+    m48t59_t *NVRAM = opaque;
+
     NVRAM->lock ^= 1 << lock;
 }
 
diff --git a/hw/m48t59.h b/hw/m48t59.h
deleted file mode 100644
index cfe9b2af5..000000000
--- a/hw/m48t59.h
+++ /dev/null
@@ -1,13 +0,0 @@
-#if !defined (__M48T59_H__)
-#define __M48T59_H__
-
-typedef struct m48t59_t m48t59_t;
-
-void m48t59_write (m48t59_t *NVRAM, uint32_t addr, uint32_t val);
-uint32_t m48t59_read (m48t59_t *NVRAM, uint32_t addr);
-void m48t59_toggle_lock (m48t59_t *NVRAM, int lock);
-m48t59_t *m48t59_init (qemu_irq IRQ, target_phys_addr_t mem_base,
-                       uint32_t io_base, uint16_t size,
-                       int type);
-
-#endif /* !defined (__M48T59_H__) */
diff --git a/hw/mac_dbdma.c b/hw/mac_dbdma.c
new file mode 100644
index 000000000..74003e60a
--- /dev/null
+++ b/hw/mac_dbdma.c
@@ -0,0 +1,79 @@
+/*
+ * PowerMac descriptor-based DMA emulation
+ *
+ * Copyright (c) 2005-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw.h"
+#include "ppc_mac.h"
+
+/* DBDMA: currently no op - should suffice right now */
+
+static void dbdma_writeb (void *opaque,
+                          target_phys_addr_t addr, uint32_t value)
+{
+    printf("%s: 0x" PADDRX " <= 0x%08x\n", __func__, addr, value);
+}
+
+static void dbdma_writew (void *opaque,
+                          target_phys_addr_t addr, uint32_t value)
+{
+}
+
+static void dbdma_writel (void *opaque,
+                          target_phys_addr_t addr, uint32_t value)
+{
+}
+
+static uint32_t dbdma_readb (void *opaque, target_phys_addr_t addr)
+{
+    printf("%s: 0x" PADDRX " => 0x00000000\n", __func__, addr);
+
+    return 0;
+}
+
+static uint32_t dbdma_readw (void *opaque, target_phys_addr_t addr)
+{
+    return 0;
+}
+
+static uint32_t dbdma_readl (void *opaque, target_phys_addr_t addr)
+{
+    return 0;
+}
+
+static CPUWriteMemoryFunc *dbdma_write[] = {
+    &dbdma_writeb,
+    &dbdma_writew,
+    &dbdma_writel,
+};
+
+static CPUReadMemoryFunc *dbdma_read[] = {
+    &dbdma_readb,
+    &dbdma_readw,
+    &dbdma_readl,
+};
+
+void dbdma_init (int *dbdma_mem_index)
+{
+    *dbdma_mem_index = cpu_register_io_memory(0, dbdma_read, dbdma_write, NULL);
+}
+
diff --git a/hw/mac_nvram.c b/hw/mac_nvram.c
new file mode 100644
index 000000000..7304ac27e
--- /dev/null
+++ b/hw/mac_nvram.c
@@ -0,0 +1,141 @@
+/*
+ * PowerMac NVRAM emulation
+ *
+ * Copyright (c) 2005-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw.h"
+#include "ppc_mac.h"
+
+struct MacIONVRAMState {
+    target_phys_addr_t mem_base;
+    target_phys_addr_t size;
+    int mem_index;
+    uint8_t data[0x2000];
+};
+
+/* Direct access to NVRAM */
+uint32_t macio_nvram_read (void *opaque, uint32_t addr)
+{
+    MacIONVRAMState *s = opaque;
+    uint32_t ret;
+
+    //    printf("%s: %p addr %04x\n", __func__, s, addr);
+    if (addr < 0x2000)
+        ret = s->data[addr];
+    else
+        ret = -1;
+
+    return ret;
+}
+
+void macio_nvram_write (void *opaque, uint32_t addr, uint32_t val)
+{
+    MacIONVRAMState *s = opaque;
+
+    //    printf("%s: %p addr %04x val %02x\n", __func__, s, addr, val);
+    if (addr < 0x2000)
+        s->data[addr] = val;
+}
+
+/* macio style NVRAM device */
+static void macio_nvram_writeb (void *opaque,
+                                target_phys_addr_t addr, uint32_t value)
+{
+    MacIONVRAMState *s = opaque;
+
+    addr -= s->mem_base;
+    addr = (addr >> 4) & 0x1fff;
+    s->data[addr] = value;
+    //    printf("macio_nvram_writeb %04x = %02x\n", addr, value);
+}
+
+static uint32_t macio_nvram_readb (void *opaque, target_phys_addr_t addr)
+{
+    MacIONVRAMState *s = opaque;
+    uint32_t value;
+
+    addr -= s->mem_base;
+    addr = (addr >> 4) & 0x1fff;
+    value = s->data[addr];
+    //    printf("macio_nvram_readb %04x = %02x\n", addr, value);
+
+    return value;
+}
+
+static CPUWriteMemoryFunc *nvram_write[] = {
+    &macio_nvram_writeb,
+    &macio_nvram_writeb,
+    &macio_nvram_writeb,
+};
+
+static CPUReadMemoryFunc *nvram_read[] = {
+    &macio_nvram_readb,
+    &macio_nvram_readb,
+    &macio_nvram_readb,
+};
+
+MacIONVRAMState *macio_nvram_init (int *mem_index, target_phys_addr_t size)
+{
+    MacIONVRAMState *s;
+
+    s = qemu_mallocz(sizeof(MacIONVRAMState));
+    if (!s)
+        return NULL;
+    s->size = size;
+    s->mem_index = cpu_register_io_memory(0, nvram_read, nvram_write, s);
+    *mem_index = s->mem_index;
+
+    return s;
+}
+
+void macio_nvram_map (void *opaque, target_phys_addr_t mem_base)
+{
+    MacIONVRAMState *s;
+
+    s = opaque;
+    s->mem_base = mem_base;
+    cpu_register_physical_memory(mem_base, s->size, s->mem_index);
+}
+
+static uint8_t nvram_chksum (const uint8_t *buf, int n)
+{
+    int sum, i;
+    sum = 0;
+    for(i = 0; i < n; i++)
+        sum += buf[i];
+    return (sum & 0xff) + (sum >> 8);
+}
+
+/* set a free Mac OS NVRAM partition */
+void pmac_format_nvram_partition (MacIONVRAMState *nvr, int len)
+{
+    uint8_t *buf;
+    char partition_name[12] = "wwwwwwwwwwww";
+
+    buf = nvr->data;
+    buf[0] = 0x7f; /* free partition magic */
+    buf[1] = 0; /* checksum */
+    buf[2] = len >> 8;
+    buf[3] = len;
+    memcpy(buf + 4, partition_name, 12);
+    buf[1] = nvram_chksum(buf, 16);
+}
diff --git a/hw/macio.c b/hw/macio.c
new file mode 100644
index 000000000..7f0d9f791
--- /dev/null
+++ b/hw/macio.c
@@ -0,0 +1,115 @@
+/*
+ * PowerMac MacIO device emulation
+ *
+ * Copyright (c) 2005-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw.h"
+#include "ppc_mac.h"
+#include "pci.h"
+
+typedef struct macio_state_t macio_state_t;
+struct macio_state_t {
+    int is_oldworld;
+    int pic_mem_index;
+    int dbdma_mem_index;
+    int cuda_mem_index;
+    void *nvram;
+    int nb_ide;
+    int ide_mem_index[4];
+};
+
+static void macio_map (PCIDevice *pci_dev, int region_num,
+                       uint32_t addr, uint32_t size, int type)
+{
+    macio_state_t *macio_state;
+    int i;
+
+    macio_state = (macio_state_t *)(pci_dev + 1);
+    if (macio_state->pic_mem_index >= 0) {
+        if (macio_state->is_oldworld) {
+            /* Heathrow PIC */
+            cpu_register_physical_memory(addr + 0x00000, 0x1000,
+                                         macio_state->pic_mem_index);
+        } else {
+            /* OpenPIC */
+            cpu_register_physical_memory(addr + 0x40000, 0x40000,
+                                         macio_state->pic_mem_index);
+        }
+    }
+    if (macio_state->dbdma_mem_index >= 0) {
+        cpu_register_physical_memory(addr + 0x08000, 0x1000,
+                                     macio_state->dbdma_mem_index);
+    }
+    if (macio_state->cuda_mem_index >= 0) {
+        cpu_register_physical_memory(addr + 0x16000, 0x2000,
+                                     macio_state->cuda_mem_index);
+    }
+    for (i = 0; i < macio_state->nb_ide; i++) {
+        if (macio_state->ide_mem_index[i] >= 0) {
+            cpu_register_physical_memory(addr + 0x1f000 + (i * 0x1000), 0x1000,
+                                         macio_state->ide_mem_index[i]);
+        }
+    }
+    if (macio_state->nvram != NULL)
+        macio_nvram_map(macio_state->nvram, addr + 0x60000);
+}
+
+void macio_init (PCIBus *bus, int device_id, int is_oldworld, int pic_mem_index,
+                 int dbdma_mem_index, int cuda_mem_index, void *nvram,
+                 int nb_ide, int *ide_mem_index)
+{
+    PCIDevice *d;
+    macio_state_t *macio_state;
+    int i;
+
+    d = pci_register_device(bus, "macio",
+                            sizeof(PCIDevice) + sizeof(macio_state_t),
+                            -1, NULL, NULL);
+    macio_state = (macio_state_t *)(d + 1);
+    macio_state->is_oldworld = is_oldworld;
+    macio_state->pic_mem_index = pic_mem_index;
+    macio_state->dbdma_mem_index = dbdma_mem_index;
+    macio_state->cuda_mem_index = cuda_mem_index;
+    macio_state->nvram = nvram;
+    if (nb_ide > 4)
+        nb_ide = 4;
+    macio_state->nb_ide = nb_ide;
+    for (i = 0; i < nb_ide; i++)
+        macio_state->ide_mem_index[i] = ide_mem_index[i];
+    for (; i < 4; i++)
+        macio_state->ide_mem_index[i] = -1;
+    /* Note: this code is strongly inspirated from the corresponding code
+       in PearPC */
+    d->config[0x00] = 0x6b; // vendor_id
+    d->config[0x01] = 0x10;
+    d->config[0x02] = device_id;
+    d->config[0x03] = device_id >> 8;
+
+    d->config[0x0a] = 0x00; // class_sub = pci2pci
+    d->config[0x0b] = 0xff; // class_base = bridge
+    d->config[0x0e] = 0x00; // header_type
+
+    d->config[0x3d] = 0x01; // interrupt on pin 1
+
+    pci_register_io_region(d, 0, 0x80000,
+                           PCI_ADDRESS_SPACE_MEM, macio_map);
+}
diff --git a/hw/mainstone.c b/hw/mainstone.c
new file mode 100644
index 000000000..63f17840d
--- /dev/null
+++ b/hw/mainstone.c
@@ -0,0 +1,147 @@
+/*
+ * PXA270-based Intel Mainstone platforms.
+ *
+ * Copyright (c) 2007 by Armin Kuster <akuster@kama-aina.net> or
+ *                                    <akuster@mvista.com>
+ *
+ * Code based on spitz platform by Andrzej Zaborowski <balrog@zabor.org>
+ *
+ * This code is licensed under the GNU GPL v2.
+ */
+#include "hw.h"
+#include "pxa.h"
+#include "arm-misc.h"
+#include "net.h"
+#include "devices.h"
+#include "boards.h"
+#include "mainstone.h"
+#include "sysemu.h"
+#include "flash.h"
+
+static struct keymap map[0xE0] = {
+    [0 ... 0xDF] = { -1, -1 },
+    [0x1e] = {0,0}, /* a */
+    [0x30] = {0,1}, /* b */
+    [0x2e] = {0,2}, /* c */
+    [0x20] = {0,3}, /* d */
+    [0x12] = {0,4}, /* e */
+    [0x21] = {0,5}, /* f */
+    [0x22] = {1,0}, /* g */
+    [0x23] = {1,1}, /* h */
+    [0x17] = {1,2}, /* i */
+    [0x24] = {1,3}, /* j */
+    [0x25] = {1,4}, /* k */
+    [0x26] = {1,5}, /* l */
+    [0x32] = {2,0}, /* m */
+    [0x31] = {2,1}, /* n */
+    [0x18] = {2,2}, /* o */
+    [0x19] = {2,3}, /* p */
+    [0x10] = {2,4}, /* q */
+    [0x13] = {2,5}, /* r */
+    [0x1f] = {3,0}, /* s */
+    [0x14] = {3,1}, /* t */
+    [0x16] = {3,2}, /* u */
+    [0x2f] = {3,3}, /* v */
+    [0x11] = {3,4}, /* w */
+    [0x2d] = {3,5}, /* x */
+    [0x15] = {4,2}, /* y */
+    [0x2c] = {4,3}, /* z */
+    [0xc7] = {5,0}, /* Home */
+    [0x2a] = {5,1}, /* shift */
+    [0x39] = {5,2}, /* space */
+    [0x39] = {5,3}, /* space */
+    [0x1c] = {5,5}, /*  enter */
+    [0xc8] = {6,0}, /* up */
+    [0xd0] = {6,1}, /* down */
+    [0xcb] = {6,2}, /* left */
+    [0xcd] = {6,3}, /* right */
+};
+
+enum mainstone_model_e { mainstone };
+
+static void mainstone_common_init(int ram_size, int vga_ram_size,
+                DisplayState *ds, const char *kernel_filename,
+                const char *kernel_cmdline, const char *initrd_filename,
+                const char *cpu_model, enum mainstone_model_e model, int arm_id)
+{
+    uint32_t mainstone_ram = 0x04000000;
+    uint32_t mainstone_rom = 0x00800000;
+    struct pxa2xx_state_s *cpu;
+    qemu_irq *mst_irq;
+    int index;
+
+    if (!cpu_model)
+        cpu_model = "pxa270-c5";
+
+    /* Setup CPU & memory */
+    if (ram_size < mainstone_ram + mainstone_rom + PXA2XX_INTERNAL_SIZE) {
+        fprintf(stderr, "This platform requires %i bytes of memory\n",
+                        mainstone_ram + mainstone_rom + PXA2XX_INTERNAL_SIZE);
+        exit(1);
+    }
+
+    cpu = pxa270_init(mainstone_ram, ds, cpu_model);
+    cpu_register_physical_memory(0, mainstone_rom,
+                    qemu_ram_alloc(mainstone_rom) | IO_MEM_ROM);
+
+    /* Setup initial (reset) machine state */
+    cpu->env->regs[15] = PXA2XX_SDRAM_BASE;
+
+    /* There are two 32MiB flash devices on the board */
+    index = drive_get_index(IF_PFLASH, 0, 0);
+    if (index == -1) {
+        fprintf(stderr, "Two flash images must be given with the "
+                "'pflash' parameter\n");
+        exit(1);
+    }
+    if (!pflash_cfi01_register(MST_FLASH_0,
+                         mainstone_ram + PXA2XX_INTERNAL_SIZE,
+                         drives_table[index].bdrv,
+                         256 * 1024, 128, 4, 0, 0, 0, 0)) {
+        fprintf(stderr, "qemu: Error registering flash memory.\n");
+        exit(1);
+    }
+
+    index = drive_get_index(IF_PFLASH, 0, 1);
+    if (index == -1) {
+        fprintf(stderr, "Two flash images must be given with the "
+                "'pflash' parameter\n");
+        exit(1);
+    }
+    if (!pflash_cfi01_register(MST_FLASH_1,
+                         mainstone_ram + PXA2XX_INTERNAL_SIZE,
+                         drives_table[index].bdrv,
+                         256 * 1024, 128, 4, 0, 0, 0, 0)) {
+        fprintf(stderr, "qemu: Error registering flash memory.\n");
+        exit(1);
+    }
+
+    mst_irq = mst_irq_init(cpu, MST_FPGA_PHYS, PXA2XX_PIC_GPIO_0);
+
+    /* setup keypad */
+    printf("map addr %p\n", &map);
+    pxa27x_register_keypad(cpu->kp, map, 0xe0);
+
+    /* MMC/SD host */
+    pxa2xx_mmci_handlers(cpu->mmc, NULL, mst_irq[MMC_IRQ]);
+
+    smc91c111_init(&nd_table[0], MST_ETH_PHYS, mst_irq[ETHERNET_IRQ]);
+
+    arm_load_kernel(cpu->env, mainstone_ram, kernel_filename, kernel_cmdline,
+                    initrd_filename, arm_id, PXA2XX_SDRAM_BASE);
+}
+
+static void mainstone_init(int ram_size, int vga_ram_size,
+                const char *boot_device, DisplayState *ds,
+                const char *kernel_filename, const char *kernel_cmdline,
+                const char *initrd_filename, const char *cpu_model)
+{
+    mainstone_common_init(ram_size, vga_ram_size, ds, kernel_filename,
+                kernel_cmdline, initrd_filename, cpu_model, mainstone, 0x196);
+}
+
+QEMUMachine mainstone2_machine = {
+    "mainstone",
+    "Mainstone II (PXA27x)",
+    mainstone_init,
+};
diff --git a/hw/mainstone.h b/hw/mainstone.h
new file mode 100644
index 000000000..f970b9f27
--- /dev/null
+++ b/hw/mainstone.h
@@ -0,0 +1,38 @@
+/*
+ * PXA270-based Intel Mainstone platforms.
+ *
+ * Copyright (c) 2007 by Armin Kuster <akuster@kama-aina.net> or
+ *                                    <akuster@mvista.com>
+ *
+ * This code is licensed under the GNU GPL v2.
+ */
+
+#ifndef __MAINSTONE_H__
+#define __MAINSTONE_H__
+
+/* Device addresses */
+#define MST_FPGA_PHYS	0x08000000
+#define MST_ETH_PHYS	0x10000300
+#define MST_FLASH_0		0x00000000
+#define MST_FLASH_1		0x04000000
+
+/* IRQ definitions */
+#define MMC_IRQ       0
+#define USIM_IRQ      1
+#define USBC_IRQ      2
+#define ETHERNET_IRQ  3
+#define AC97_IRQ      4
+#define PEN_IRQ       5
+#define MSINS_IRQ     6
+#define EXBRD_IRQ     7
+#define S0_CD_IRQ     9
+#define S0_STSCHG_IRQ 10
+#define S0_IRQ        11
+#define S1_CD_IRQ     13
+#define S1_STSCHG_IRQ 14
+#define S1_IRQ        15
+
+extern qemu_irq
+*mst_irq_init(struct pxa2xx_state_s *cpu, uint32_t base, int irq);
+
+#endif /* __MAINSTONE_H__ */
diff --git a/hw/max111x.c b/hw/max111x.c
index 8425bee57..cc3ded1df 100644
--- a/hw/max111x.c
+++ b/hw/max111x.c
@@ -7,7 +7,8 @@
  * This code is licensed under the GNU GPLv2.
  */
 
-#include <vl.h>
+#include "hw.h"
+#include "i2c.h"
 
 struct max111x_s {
     qemu_irq interrupt;
diff --git a/hw/max7310.c b/hw/max7310.c
index 6b180d9b6..75e56c719 100644
--- a/hw/max7310.c
+++ b/hw/max7310.c
@@ -7,7 +7,8 @@
  * This file is licensed under GNU GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "i2c.h"
 
 struct max7310_s {
     i2c_slave i2c;
@@ -182,7 +183,7 @@ static void max7310_gpio_set(void *opaque, int line, int level)
 {
     struct max7310_s *s = (struct max7310_s *) opaque;
     if (line >= sizeof(s->handler) / sizeof(*s->handler) || line  < 0)
-        cpu_abort(cpu_single_env, "bad GPIO line");
+        hw_error("bad GPIO line");
 
     if (level)
         s->level |= s->direction & (1 << line);
@@ -220,7 +221,7 @@ void max7310_gpio_out_set(i2c_slave *i2c, int line, qemu_irq handler)
 {
     struct max7310_s *s = (struct max7310_s *) i2c;
     if (line >= sizeof(s->handler) / sizeof(*s->handler) || line  < 0)
-        cpu_abort(cpu_single_env, "bad GPIO line");
+        hw_error("bad GPIO line");
 
     s->handler[line] = handler;
 }
diff --git a/hw/mc146818rtc.c b/hw/mc146818rtc.c
index 789ebd3f6..e1e642768 100644
--- a/hw/mc146818rtc.c
+++ b/hw/mc146818rtc.c
@@ -21,7 +21,11 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
+#include "pc.h"
+#include "isa.h"
 
 //#define DEBUG_CMOS
 
@@ -386,18 +390,23 @@ void rtc_set_date(RTCState *s, const struct tm *tm)
 #define REG_IBM_CENTURY_BYTE        0x32
 #define REG_IBM_PS2_CENTURY_BYTE    0x37
 
-void rtc_set_date_from_host(RTCState *s)
+static void rtc_set_date_from_host(RTCState *s)
 {
     time_t ti;
     struct tm *tm;
     int val;
 
     /* set the CMOS date */
-    time(&ti);
-    if (rtc_utc)
+    if (rtc_start_date == -1) {
+        time(&ti);
+        if (rtc_utc)
+            tm = gmtime(&ti);
+        else
+            tm = localtime(&ti);
+    } else {
+        ti = rtc_start_date;
         tm = gmtime(&ti);
-    else
-        tm = localtime(&ti);
+    }
     rtc_set_date(s, tm);
 
     val = to_bcd(s, (tm->tm_year / 100) + 19);
@@ -412,18 +421,18 @@ static void rtc_save(QEMUFile *f, void *opaque)
     qemu_put_buffer(f, s->cmos_data, 128);
     qemu_put_8s(f, &s->cmos_index);
 
-    qemu_put_be32s(f, &s->current_tm.tm_sec);
-    qemu_put_be32s(f, &s->current_tm.tm_min);
-    qemu_put_be32s(f, &s->current_tm.tm_hour);
-    qemu_put_be32s(f, &s->current_tm.tm_wday);
-    qemu_put_be32s(f, &s->current_tm.tm_mday);
-    qemu_put_be32s(f, &s->current_tm.tm_mon);
-    qemu_put_be32s(f, &s->current_tm.tm_year);
+    qemu_put_be32(f, s->current_tm.tm_sec);
+    qemu_put_be32(f, s->current_tm.tm_min);
+    qemu_put_be32(f, s->current_tm.tm_hour);
+    qemu_put_be32(f, s->current_tm.tm_wday);
+    qemu_put_be32(f, s->current_tm.tm_mday);
+    qemu_put_be32(f, s->current_tm.tm_mon);
+    qemu_put_be32(f, s->current_tm.tm_year);
 
     qemu_put_timer(f, s->periodic_timer);
-    qemu_put_be64s(f, &s->next_periodic_time);
+    qemu_put_be64(f, s->next_periodic_time);
 
-    qemu_put_be64s(f, &s->next_second_time);
+    qemu_put_be64(f, s->next_second_time);
     qemu_put_timer(f, s->second_timer);
     qemu_put_timer(f, s->second_timer2);
 }
@@ -438,18 +447,18 @@ static int rtc_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_buffer(f, s->cmos_data, 128);
     qemu_get_8s(f, &s->cmos_index);
 
-    qemu_get_be32s(f, &s->current_tm.tm_sec);
-    qemu_get_be32s(f, &s->current_tm.tm_min);
-    qemu_get_be32s(f, &s->current_tm.tm_hour);
-    qemu_get_be32s(f, &s->current_tm.tm_wday);
-    qemu_get_be32s(f, &s->current_tm.tm_mday);
-    qemu_get_be32s(f, &s->current_tm.tm_mon);
-    qemu_get_be32s(f, &s->current_tm.tm_year);
+    s->current_tm.tm_sec=qemu_get_be32(f);
+    s->current_tm.tm_min=qemu_get_be32(f);
+    s->current_tm.tm_hour=qemu_get_be32(f);
+    s->current_tm.tm_wday=qemu_get_be32(f);
+    s->current_tm.tm_mday=qemu_get_be32(f);
+    s->current_tm.tm_mon=qemu_get_be32(f);
+    s->current_tm.tm_year=qemu_get_be32(f);
 
     qemu_get_timer(f, s->periodic_timer);
-    qemu_get_be64s(f, &s->next_periodic_time);
+    s->next_periodic_time=qemu_get_be64(f);
 
-    qemu_get_be64s(f, &s->next_second_time);
+    s->next_second_time=qemu_get_be64(f);
     qemu_get_timer(f, s->second_timer);
     qemu_get_timer(f, s->second_timer2);
     return 0;
@@ -489,22 +498,22 @@ RTCState *rtc_init(int base, qemu_irq irq)
 }
 
 /* Memory mapped interface */
-uint32_t cmos_mm_readb (void *opaque, target_phys_addr_t addr)
+static uint32_t cmos_mm_readb (void *opaque, target_phys_addr_t addr)
 {
     RTCState *s = opaque;
 
     return cmos_ioport_read(s, (addr - s->base) >> s->it_shift) & 0xFF;
 }
 
-void cmos_mm_writeb (void *opaque,
-                     target_phys_addr_t addr, uint32_t value)
+static void cmos_mm_writeb (void *opaque,
+                            target_phys_addr_t addr, uint32_t value)
 {
     RTCState *s = opaque;
 
     cmos_ioport_write(s, (addr - s->base) >> s->it_shift, value & 0xFF);
 }
 
-uint32_t cmos_mm_readw (void *opaque, target_phys_addr_t addr)
+static uint32_t cmos_mm_readw (void *opaque, target_phys_addr_t addr)
 {
     RTCState *s = opaque;
     uint32_t val;
@@ -516,8 +525,8 @@ uint32_t cmos_mm_readw (void *opaque, target_phys_addr_t addr)
     return val;
 }
 
-void cmos_mm_writew (void *opaque,
-                     target_phys_addr_t addr, uint32_t value)
+static void cmos_mm_writew (void *opaque,
+                            target_phys_addr_t addr, uint32_t value)
 {
     RTCState *s = opaque;
 #ifdef TARGET_WORDS_BIGENDIAN
@@ -526,7 +535,7 @@ void cmos_mm_writew (void *opaque,
     cmos_ioport_write(s, (addr - s->base) >> s->it_shift, value & 0xFFFF);
 }
 
-uint32_t cmos_mm_readl (void *opaque, target_phys_addr_t addr)
+static uint32_t cmos_mm_readl (void *opaque, target_phys_addr_t addr)
 {
     RTCState *s = opaque;
     uint32_t val;
@@ -538,8 +547,8 @@ uint32_t cmos_mm_readl (void *opaque, target_phys_addr_t addr)
     return val;
 }
 
-void cmos_mm_writel (void *opaque,
-                     target_phys_addr_t addr, uint32_t value)
+static void cmos_mm_writel (void *opaque,
+                            target_phys_addr_t addr, uint32_t value)
 {
     RTCState *s = opaque;
 #ifdef TARGET_WORDS_BIGENDIAN
diff --git a/hw/mcf.h b/hw/mcf.h
new file mode 100644
index 000000000..91f2821f1
--- /dev/null
+++ b/hw/mcf.h
@@ -0,0 +1,21 @@
+#ifndef HW_MCF_H
+#define HW_MCF_H
+/* Motorola ColdFire device prototypes.  */
+
+/* mcf_uart.c */
+uint32_t mcf_uart_read(void *opaque, target_phys_addr_t addr);
+void mcf_uart_write(void *opaque, target_phys_addr_t addr, uint32_t val);
+void *mcf_uart_init(qemu_irq irq, CharDriverState *chr);
+void mcf_uart_mm_init(target_phys_addr_t base, qemu_irq irq,
+                      CharDriverState *chr);
+
+/* mcf_intc.c */
+qemu_irq *mcf_intc_init(target_phys_addr_t base, CPUState *env);
+
+/* mcf_fec.c */
+void mcf_fec_init(NICInfo *nd, target_phys_addr_t base, qemu_irq *irq);
+
+/* mcf5206.c */
+qemu_irq *mcf5206_init(uint32_t base, CPUState *env);
+
+#endif
diff --git a/hw/mcf5206.c b/hw/mcf5206.c
index 32117ae52..449ca12f5 100644
--- a/hw/mcf5206.c
+++ b/hw/mcf5206.c
@@ -5,7 +5,10 @@
  *
  * This code is licenced under the GPL
  */
-#include "vl.h"
+#include "hw.h"
+#include "mcf.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
 
 /* General purpose timer module.  */
 typedef struct {
diff --git a/hw/mcf5208.c b/hw/mcf5208.c
index 993a68694..d7e7dcf5d 100644
--- a/hw/mcf5208.c
+++ b/hw/mcf5208.c
@@ -5,7 +5,12 @@
  *
  * This code is licenced under the GPL
  */
-#include "vl.h"
+#include "hw.h"
+#include "mcf.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
+#include "net.h"
+#include "boards.h"
 
 #define SYS_FREQ 66000000
 
@@ -197,8 +202,8 @@ static void mcf5208_sys_init(qemu_irq *pic)
     }
 }
 
-static void mcf5208evb_init(int ram_size, int vga_ram_size, int boot_device,
-                     DisplayState *ds, const char **fd_filename, int snapshot,
+static void mcf5208evb_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
                      const char *kernel_filename, const char *kernel_cmdline,
                      const char *initrd_filename, const char *cpu_model)
 {
@@ -208,11 +213,12 @@ static void mcf5208evb_init(int ram_size, int vga_ram_size, int boot_device,
     target_ulong entry;
     qemu_irq *pic;
 
-    env = cpu_init();
     if (!cpu_model)
         cpu_model = "m5208";
-    if (cpu_m68k_set_model(env, cpu_model)) {
-        cpu_abort(env, "Unable to find m68k CPU definition\n");
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find m68k CPU definition\n");
+        exit(1);
     }
 
     /* Initialize CPU registers.  */
diff --git a/hw/mcf_fec.c b/hw/mcf_fec.c
index a21810806..0049860da 100644
--- a/hw/mcf_fec.c
+++ b/hw/mcf_fec.c
@@ -5,7 +5,9 @@
  *
  * This code is licenced under the GPL
  */
-#include "vl.h"
+#include "hw.h"
+#include "net.h"
+#include "mcf.h"
 /* For crc32 */
 #include <zlib.h>
 
@@ -249,7 +251,7 @@ static uint32_t mcf_fec_read(void *opaque, target_phys_addr_t addr)
     }
 }
 
-void mcf_fec_write(void *opaque, target_phys_addr_t addr, uint32_t value)
+static void mcf_fec_write(void *opaque, target_phys_addr_t addr, uint32_t value)
 {
     mcf_fec_state *s = (mcf_fec_state *)opaque;
     switch (addr & 0x3ff) {
diff --git a/hw/mcf_intc.c b/hw/mcf_intc.c
index e469c3119..4e99aeb4f 100644
--- a/hw/mcf_intc.c
+++ b/hw/mcf_intc.c
@@ -5,7 +5,8 @@
  *
  * This code is licenced under the GPL
  */
-#include "vl.h"
+#include "hw.h"
+#include "mcf.h"
 
 typedef struct {
     uint64_t ipr;
diff --git a/hw/mcf_uart.c b/hw/mcf_uart.c
index ab0f54f4d..a65cc772c 100644
--- a/hw/mcf_uart.c
+++ b/hw/mcf_uart.c
@@ -5,7 +5,9 @@
  *
  * This code is licenced under the GPL
  */
-#include "vl.h"
+#include "hw.h"
+#include "mcf.h"
+#include "qemu-char.h"
 
 typedef struct {
     uint8_t mr[2];
@@ -86,6 +88,7 @@ uint32_t mcf_uart_read(void *opaque, target_phys_addr_t addr)
             if (s->fifo_len == 0)
                 s->sr &= ~MCF_UART_RxRDY;
             mcf_uart_update(s);
+            qemu_chr_accept_input(s->chr);
             return val;
         }
     case 0x10:
diff --git a/hw/mips.h b/hw/mips.h
new file mode 100644
index 000000000..0196b6ced
--- /dev/null
+++ b/hw/mips.h
@@ -0,0 +1,25 @@
+#ifndef HW_MIPS_H
+#define HW_MIPS_H
+/* Definitions for mips board emulation.  */
+
+/* gt64xxx.c */
+PCIBus *pci_gt64120_init(qemu_irq *pic);
+
+/* ds1225y.c */
+typedef struct ds1225y_t ds1225y_t;
+ds1225y_t *ds1225y_init(target_phys_addr_t mem_base, const char *filename);
+
+/* mipsnet.c */
+void mipsnet_init(int base, qemu_irq irq, NICInfo *nd);
+
+/* jazz_led.c */
+extern void jazz_led_init(DisplayState *ds, target_phys_addr_t base);
+
+/* mips_int.c */
+extern void cpu_mips_irq_init_cpu(CPUState *env);
+
+/* mips_timer.c */
+extern void cpu_mips_clock_init(CPUState *);
+extern void cpu_mips_irqctrl_init (void);
+
+#endif
diff --git a/hw/mips_int.c b/hw/mips_int.c
index f4e22dcf8..ad48b4f70 100644
--- a/hw/mips_int.c
+++ b/hw/mips_int.c
@@ -1,4 +1,5 @@
-#include "vl.h"
+#include "hw.h"
+#include "mips.h"
 #include "cpu.h"
 
 /* Raise IRQ to CPU if necessary. It must be called every time the active
diff --git a/hw/mips_malta.c b/hw/mips_malta.c
index 3b37596d1..6af5e52dc 100644
--- a/hw/mips_malta.c
+++ b/hw/mips_malta.c
@@ -22,7 +22,18 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pc.h"
+#include "fdc.h"
+#include "net.h"
+#include "boards.h"
+#include "smbus.h"
+#include "mips.h"
+#include "pci.h"
+#include "qemu-char.h"
+#include "sysemu.h"
+#include "audio/audio.h"
+#include "boards.h"
 
 #ifdef TARGET_WORDS_BIGENDIAN
 #define BIOS_FILENAME "mips_bios.bin"
@@ -42,6 +53,8 @@
 #define ENVP_NB_ENTRIES	 	16
 #define ENVP_ENTRY_SIZE	 	256
 
+#define MAX_IDE_BUS 2
+
 extern FILE *logfile;
 
 typedef struct {
@@ -59,6 +72,13 @@ typedef struct {
 
 static PITState *pit;
 
+static struct _loaderparams {
+    int ram_size;
+    const char *kernel_filename;
+    const char *kernel_cmdline;
+    const char *initrd_filename;
+} loaderparams;
+
 /* Malta FPGA */
 static void malta_fpga_update_display(void *opaque)
 {
@@ -381,7 +401,7 @@ static CPUWriteMemoryFunc *malta_fpga_write[] = {
    malta_fpga_writel
 };
 
-void malta_fpga_reset(void *opaque)
+static void malta_fpga_reset(void *opaque)
 {
     MaltaFPGAState *s = opaque;
 
@@ -398,7 +418,7 @@ void malta_fpga_reset(void *opaque)
     malta_fpga_update_display(s);
 }
 
-MaltaFPGAState *malta_fpga_init(target_phys_addr_t base, CPUState *env)
+static MaltaFPGAState *malta_fpga_init(target_phys_addr_t base, CPUState *env)
 {
     MaltaFPGAState *s;
     CharDriverState *uart_chr;
@@ -534,8 +554,8 @@ static void write_bootloader (CPUState *env, unsigned long bios_offset, int64_t
     stl_raw(p++, 0x34a50000 | (ENVP_ADDR & 0xffff));               /* ori a1, a1, low(ENVP_ADDR) */
     stl_raw(p++, 0x3c060000 | (((ENVP_ADDR + 8) >> 16) & 0xffff)); /* lui a2, high(ENVP_ADDR + 8) */
     stl_raw(p++, 0x34c60000 | ((ENVP_ADDR + 8) & 0xffff));         /* ori a2, a2, low(ENVP_ADDR + 8) */
-    stl_raw(p++, 0x3c070000 | (env->ram_size >> 16));              /* lui a3, high(env->ram_size) */
-    stl_raw(p++, 0x34e70000 | (env->ram_size & 0xffff));           /* ori a3, a3, low(env->ram_size) */
+    stl_raw(p++, 0x3c070000 | (loaderparams.ram_size >> 16));     /* lui a3, high(ram_size) */
+    stl_raw(p++, 0x34e70000 | (loaderparams.ram_size & 0xffff));  /* ori a3, a3, low(ram_size) */
 
     /* Load BAR registers as done by YAMON */
     stl_raw(p++, 0x3c09b400);                                      /* lui t1, 0xb400 */
@@ -675,48 +695,48 @@ static int64_t load_kernel (CPUState *env)
     long initrd_size;
     ram_addr_t initrd_offset;
 
-    if (load_elf(env->kernel_filename, VIRT_TO_PHYS_ADDEND,
+    if (load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,
                  &kernel_entry, &kernel_low, &kernel_high) < 0) {
         fprintf(stderr, "qemu: could not load kernel '%s'\n",
-                env->kernel_filename);
+                loaderparams.kernel_filename);
         exit(1);
     }
 
     /* load initrd */
     initrd_size = 0;
     initrd_offset = 0;
-    if (env->initrd_filename) {
-        initrd_size = get_image_size (env->initrd_filename);
+    if (loaderparams.initrd_filename) {
+        initrd_size = get_image_size (loaderparams.initrd_filename);
         if (initrd_size > 0) {
             initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
-            if (initrd_offset + initrd_size > env->ram_size) {
+            if (initrd_offset + initrd_size > ram_size) {
                 fprintf(stderr,
                         "qemu: memory too small for initial ram disk '%s'\n",
-                        env->initrd_filename);
+                        loaderparams.initrd_filename);
                 exit(1);
             }
-            initrd_size = load_image(env->initrd_filename,
+            initrd_size = load_image(loaderparams.initrd_filename,
                                      phys_ram_base + initrd_offset);
         }
         if (initrd_size == (target_ulong) -1) {
             fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
-                    env->initrd_filename);
+                    loaderparams.initrd_filename);
             exit(1);
         }
     }
 
     /* Store command line.  */
-    prom_set(index++, env->kernel_filename);
+    prom_set(index++, loaderparams.kernel_filename);
     if (initrd_size > 0)
         prom_set(index++, "rd_start=0x" TARGET_FMT_lx " rd_size=%li %s",
                  PHYS_TO_VIRT(initrd_offset), initrd_size,
-                 env->kernel_cmdline);
+                 loaderparams.kernel_cmdline);
     else
-        prom_set(index++, env->kernel_cmdline);
+        prom_set(index++, loaderparams.kernel_cmdline);
 
     /* Setup minimum environment variables */
     prom_set(index++, "memsize");
-    prom_set(index++, "%i", env->ram_size);
+    prom_set(index++, "%i", loaderparams.ram_size);
     prom_set(index++, "modetty0");
     prom_set(index++, "38400n8r");
     prom_set(index++, NULL);
@@ -728,20 +748,19 @@ static void main_cpu_reset(void *opaque)
 {
     CPUState *env = opaque;
     cpu_reset(env);
-    cpu_mips_register(env, NULL);
 
     /* The bootload does not need to be rewritten as it is located in a
        read only location. The kernel location and the arguments table
        location does not change. */
-    if (env->kernel_filename) {
+    if (loaderparams.kernel_filename) {
         env->CP0_Status &= ~((1 << CP0St_BEV) | (1 << CP0St_ERL));
         load_kernel (env);
     }
 }
 
 static
-void mips_malta_init (int ram_size, int vga_ram_size, int boot_device,
-                      DisplayState *ds, const char **fd_filename, int snapshot,
+void mips_malta_init (int ram_size, int vga_ram_size,
+                      const char *boot_device, DisplayState *ds,
                       const char *kernel_filename, const char *kernel_cmdline,
                       const char *initrd_filename, const char *cpu_model)
 {
@@ -751,15 +770,17 @@ void mips_malta_init (int ram_size, int vga_ram_size, int boot_device,
     PCIBus *pci_bus;
     CPUState *env;
     RTCState *rtc_state;
-    /* fdctrl_t *floppy_controller; */
+    fdctrl_t *floppy_controller;
     MaltaFPGAState *malta_fpga;
     int ret;
-    mips_def_t *def;
     qemu_irq *i8259;
     int piix4_devfn;
     uint8_t *eeprom_buf;
     i2c_bus *smbus;
     int i;
+    int index;
+    BlockDriverState *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
+    BlockDriverState *fd[MAX_FD];
 
     /* init CPUs */
     if (cpu_model == NULL) {
@@ -769,10 +790,11 @@ void mips_malta_init (int ram_size, int vga_ram_size, int boot_device,
         cpu_model = "24Kf";
 #endif
     }
-    if (mips_find_by_name(cpu_model, &def) != 0)
-        def = NULL;
-    env = cpu_init();
-    cpu_mips_register(env, def);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
     qemu_register_reset(main_cpu_reset, env);
 
@@ -791,7 +813,9 @@ void mips_malta_init (int ram_size, int vga_ram_size, int boot_device,
 
     /* Load a BIOS image unless a kernel image has been specified. */
     if (!kernel_filename) {
-        snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME);
+        if (bios_name == NULL)
+            bios_name = BIOS_FILENAME;
+        snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
         ret = load_image(buf, phys_ram_base + bios_offset);
         if (ret < 0 || ret > BIOS_SIZE) {
             fprintf(stderr,
@@ -816,10 +840,10 @@ void mips_malta_init (int ram_size, int vga_ram_size, int boot_device,
     /* If a kernel image has been specified, write a small bootloader
        to the flash location. */
     if (kernel_filename) {
-        env->ram_size = ram_size;
-        env->kernel_filename = kernel_filename;
-        env->kernel_cmdline = kernel_cmdline;
-        env->initrd_filename = initrd_filename;
+        loaderparams.ram_size = ram_size;
+        loaderparams.kernel_filename = kernel_filename;
+        loaderparams.kernel_cmdline = kernel_cmdline;
+        loaderparams.initrd_filename = initrd_filename;
         kernel_entry = load_kernel(env);
         env->CP0_Status &= ~((1 << CP0St_BEV) | (1 << CP0St_ERL));
         write_bootloader(env, bios_offset, kernel_entry);
@@ -843,8 +867,22 @@ void mips_malta_init (int ram_size, int vga_ram_size, int boot_device,
     pci_bus = pci_gt64120_init(i8259);
 
     /* Southbridge */
+
+    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {
+        fprintf(stderr, "qemu: too many IDE bus\n");
+        exit(1);
+    }
+
+    for(i = 0; i < MAX_IDE_BUS * MAX_IDE_DEVS; i++) {
+        index = drive_get_index(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
+        if (index != -1)
+            hd[i] = drives_table[index].bdrv;
+        else
+            hd[i] = NULL;
+    }
+
     piix4_devfn = piix4_init(pci_bus, 80);
-    pci_piix4_ide_init(pci_bus, bs_table, piix4_devfn + 1, i8259);
+    pci_piix4_ide_init(pci_bus, hd, piix4_devfn + 1, i8259);
     usb_uhci_piix4_init(pci_bus, piix4_devfn + 2);
     smbus = piix4_pm_init(pci_bus, piix4_devfn + 3, 0x1100);
     eeprom_buf = qemu_mallocz(8 * 256); /* XXX: make this persistent */
@@ -864,9 +902,14 @@ void mips_malta_init (int ram_size, int vga_ram_size, int boot_device,
         serial_init(0x2f8, i8259[3], serial_hds[1]);
     if (parallel_hds[0])
         parallel_init(0x378, i8259[7], parallel_hds[0]);
-    /* XXX: The floppy controller does not work correctly, something is
-       probably wrong.
-    floppy_controller = fdctrl_init(i8259[6], 2, 0, 0x3f0, fd_table); */
+    for(i = 0; i < MAX_FD; i++) {
+        index = drive_get_index(IF_FLOPPY, 0, i);
+       if (index != -1)
+           fd[i] = drives_table[index].bdrv;
+       else
+           fd[i] = NULL;
+    }
+    floppy_controller = fdctrl_init(i8259[6], 2, 0, 0x3f0, fd);
 
     /* Sound card */
 #ifdef HAS_AUDIO
diff --git a/hw/mips_mipssim.c b/hw/mips_mipssim.c
new file mode 100644
index 000000000..fe753146e
--- /dev/null
+++ b/hw/mips_mipssim.c
@@ -0,0 +1,198 @@
+/*
+ * QEMU/mipssim emulation
+ *
+ * Emulates a very simple machine model similiar to the one use by the
+ * proprietary MIPS emulator.
+ * 
+ * Copyright (c) 2007 Thiemo Seufer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw.h"
+#include "mips.h"
+#include "pc.h"
+#include "isa.h"
+#include "net.h"
+#include "sysemu.h"
+#include "boards.h"
+
+#ifdef TARGET_WORDS_BIGENDIAN
+#define BIOS_FILENAME "mips_bios.bin"
+#else
+#define BIOS_FILENAME "mipsel_bios.bin"
+#endif
+
+#ifdef TARGET_MIPS64
+#define PHYS_TO_VIRT(x) ((x) | ~0x7fffffffULL)
+#else
+#define PHYS_TO_VIRT(x) ((x) | ~0x7fffffffU)
+#endif
+
+#define VIRT_TO_PHYS_ADDEND (-((int64_t)(int32_t)0x80000000))
+
+static struct _loaderparams {
+    int ram_size;
+    const char *kernel_filename;
+    const char *kernel_cmdline;
+    const char *initrd_filename;
+} loaderparams;
+
+static void load_kernel (CPUState *env)
+{
+    int64_t entry, kernel_low, kernel_high;
+    long kernel_size;
+    long initrd_size;
+    ram_addr_t initrd_offset;
+
+    kernel_size = load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,
+                           &entry, &kernel_low, &kernel_high);
+    if (kernel_size >= 0) {
+        if ((entry & ~0x7fffffffULL) == 0x80000000)
+            entry = (int32_t)entry;
+        env->PC[env->current_tc] = entry;
+    } else {
+        fprintf(stderr, "qemu: could not load kernel '%s'\n",
+                loaderparams.kernel_filename);
+        exit(1);
+    }
+
+    /* load initrd */
+    initrd_size = 0;
+    initrd_offset = 0;
+    if (loaderparams.initrd_filename) {
+        initrd_size = get_image_size (loaderparams.initrd_filename);
+        if (initrd_size > 0) {
+            initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
+            if (initrd_offset + initrd_size > loaderparams.ram_size) {
+                fprintf(stderr,
+                        "qemu: memory too small for initial ram disk '%s'\n",
+                        loaderparams.initrd_filename);
+                exit(1);
+            }
+            initrd_size = load_image(loaderparams.initrd_filename,
+                                     phys_ram_base + initrd_offset);
+        }
+        if (initrd_size == (target_ulong) -1) {
+            fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
+                    loaderparams.initrd_filename);
+            exit(1);
+        }
+    }
+}
+
+static void main_cpu_reset(void *opaque)
+{
+    CPUState *env = opaque;
+    cpu_reset(env);
+
+    if (loaderparams.kernel_filename)
+        load_kernel (env);
+}
+
+static void
+mips_mipssim_init (int ram_size, int vga_ram_size,
+                   const char *boot_device, DisplayState *ds,
+                   const char *kernel_filename, const char *kernel_cmdline,
+                   const char *initrd_filename, const char *cpu_model)
+{
+    char buf[1024];
+    unsigned long bios_offset;
+    CPUState *env;
+    int bios_size;
+
+    /* Init CPUs. */
+    if (cpu_model == NULL) {
+#ifdef TARGET_MIPS64
+        cpu_model = "5Kf";
+#else
+        cpu_model = "24Kf";
+#endif
+    }
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
+    register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
+    qemu_register_reset(main_cpu_reset, env);
+
+    /* Allocate RAM. */
+    cpu_register_physical_memory(0, ram_size, IO_MEM_RAM);
+
+    /* Load a BIOS / boot exception handler image. */
+    bios_offset = ram_size + vga_ram_size;
+    if (bios_name == NULL)
+        bios_name = BIOS_FILENAME;
+    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
+    bios_size = load_image(buf, phys_ram_base + bios_offset);
+    if ((bios_size < 0 || bios_size > BIOS_SIZE) && !kernel_filename) {
+        /* Bail out if we have neither a kernel image nor boot vector code. */
+        fprintf(stderr,
+                "qemu: Could not load MIPS bios '%s', and no -kernel argument was specified\n",
+                buf);
+        exit(1);
+    } else {
+        /* Map the BIOS / boot exception handler. */
+        cpu_register_physical_memory(0x1fc00000LL,
+                                     bios_size, bios_offset | IO_MEM_ROM);
+        /* We have a boot vector start address. */
+        env->PC[env->current_tc] = (target_long)(int32_t)0xbfc00000;
+    }
+
+    if (kernel_filename) {
+        loaderparams.ram_size = ram_size;
+        loaderparams.kernel_filename = kernel_filename;
+        loaderparams.kernel_cmdline = kernel_cmdline;
+        loaderparams.initrd_filename = initrd_filename;
+        load_kernel(env);
+    }
+
+    /* Init CPU internal devices. */
+    cpu_mips_irq_init_cpu(env);
+    cpu_mips_clock_init(env);
+    cpu_mips_irqctrl_init();
+
+    /* Register 64 KB of ISA IO space at 0x1fd00000. */
+    isa_mmio_init(0x1fd00000, 0x00010000);
+
+    /* A single 16450 sits at offset 0x3f8. It is attached to
+       MIPS CPU INT2, which is interrupt 4. */
+    if (serial_hds[0])
+        serial_init(0x3f8, env->irq[4], serial_hds[0]);
+
+    if (nd_table[0].vlan) {
+        if (nd_table[0].model == NULL
+            || strcmp(nd_table[0].model, "mipsnet") == 0) {
+            /* MIPSnet uses the MIPS CPU INT0, which is interrupt 2. */
+            mipsnet_init(0x4200, env->irq[2], &nd_table[0]);
+        } else if (strcmp(nd_table[0].model, "?") == 0) {
+            fprintf(stderr, "qemu: Supported NICs: mipsnet\n");
+            exit (1);
+        } else {
+            fprintf(stderr, "qemu: Unsupported NIC: %s\n", nd_table[0].model);
+            exit (1);
+        }
+    }
+}
+
+QEMUMachine mips_mipssim_machine = {
+    "mipssim",
+    "MIPS MIPSsim platform",
+    mips_mipssim_init,
+};
diff --git a/hw/mips_pica61.c b/hw/mips_pica61.c
index 2c4415017..dfbc2f0d4 100644
--- a/hw/mips_pica61.c
+++ b/hw/mips_pica61.c
@@ -22,7 +22,13 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "mips.h"
+#include "isa.h"
+#include "pc.h"
+#include "fdc.h"
+#include "sysemu.h"
+#include "boards.h"
 
 #ifdef TARGET_WORDS_BIGENDIAN
 #define BIOS_FILENAME "mips_bios.bin"
@@ -38,6 +44,9 @@
 
 #define VIRT_TO_PHYS_ADDEND (-((int64_t)(int32_t)0x80000000))
 
+#define MAX_IDE_BUS 2
+#define MAX_FD 2
+
 static const int ide_iobase[2] = { 0x1f0, 0x170 };
 static const int ide_iobase2[2] = { 0x3f6, 0x376 };
 static const int ide_irq[2] = { 14, 15 };
@@ -51,12 +60,11 @@ static void main_cpu_reset(void *opaque)
 {
     CPUState *env = opaque;
     cpu_reset(env);
-    cpu_mips_register(env, NULL);
 }
 
 static
-void mips_pica61_init (int ram_size, int vga_ram_size, int boot_device,
-                    DisplayState *ds, const char **fd_filename, int snapshot,
+void mips_pica61_init (int ram_size, int vga_ram_size,
+                       const char *boot_device, DisplayState *ds,
                     const char *kernel_filename, const char *kernel_cmdline,
                     const char *initrd_filename, const char *cpu_model)
 {
@@ -65,9 +73,10 @@ void mips_pica61_init (int ram_size, int vga_ram_size, int boot_device,
     int bios_size;
     CPUState *env;
     int i;
-    mips_def_t *def;
     int available_ram;
     qemu_irq *i8259;
+    int index;
+    BlockDriverState *fd[MAX_FD];
 
     /* init CPUs */
     if (cpu_model == NULL) {
@@ -78,10 +87,11 @@ void mips_pica61_init (int ram_size, int vga_ram_size, int boot_device,
         cpu_model = "24Kf";
 #endif
     }
-    if (mips_find_by_name(cpu_model, &def) != 0)
-        def = NULL;
-    env = cpu_init();
-    cpu_mips_register(env, def);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
     qemu_register_reset(main_cpu_reset, env);
 
@@ -94,7 +104,9 @@ void mips_pica61_init (int ram_size, int vga_ram_size, int boot_device,
 
     /* load a BIOS image */
     bios_offset = ram_size + vga_ram_size;
-    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME);
+    if (bios_name == NULL)
+        bios_name = BIOS_FILENAME;
+    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
     bios_size = load_image(buf, phys_ram_base + bios_offset);
     if ((bios_size <= 0) || (bios_size > BIOS_SIZE)) {
         /* fatal */
@@ -134,9 +146,20 @@ void mips_pica61_init (int ram_size, int vga_ram_size, int boot_device,
     i8042_mm_init(i8259[6], i8259[7], 0x80005060, 0);
 
     /* IDE controller */
-    for(i = 0; i < 2; i++)
+
+    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {
+        fprintf(stderr, "qemu: too many IDE bus\n");
+        exit(1);
+    }
+
+    for(i = 0; i < MAX_IDE_BUS; i++) {
+        int hd0, hd1;
+        hd0 = drive_get_index(IF_IDE, i, 0);
+        hd1 = drive_get_index(IF_IDE, i, 1);
         isa_ide_init(ide_iobase[i], ide_iobase2[i], i8259[ide_irq[i]],
-                     bs_table[2 * i], bs_table[2 * i + 1]);
+                     hd0 == -1 ? NULL : drives_table[hd0].bdrv,
+                     hd1 == -1 ? NULL : drives_table[hd1].bdrv);
+    }
 
     /* Network controller */
     /* FIXME: missing NS SONIC DP83932 */
@@ -145,7 +168,15 @@ void mips_pica61_init (int ram_size, int vga_ram_size, int boot_device,
     /* FIXME: missing NCR 53C94 */
 
     /* ISA devices (floppy, serial, parallel) */
-    fdctrl_init(i8259[1], 1, 1, 0x80003000, fd_table);
+
+    for (i = 0; i < MAX_FD; i++) {
+        index = drive_get_index(IF_FLOPPY, 0, i);
+        if (index == -1)
+            fd[i] = NULL;
+        else
+            fd[i] = drives_table[index].bdrv;
+    }
+    fdctrl_init(i8259[1], 1, 1, 0x80003000, fd);
     for(i = 0; i < MAX_SERIAL_PORTS; i++) {
         if (serial_hds[i]) {
             serial_mm_init(serial_base[i], 0, i8259[serial_irq[i]], serial_hds[i], 1);
diff --git a/hw/mips_r4k.c b/hw/mips_r4k.c
index 5769ade96..63bd15824 100644
--- a/hw/mips_r4k.c
+++ b/hw/mips_r4k.c
@@ -7,7 +7,13 @@
  * All peripherial devices are attached to this "bus" with
  * the standard PC ISA addresses.
 */
-#include "vl.h"
+#include "hw.h"
+#include "mips.h"
+#include "pc.h"
+#include "isa.h"
+#include "net.h"
+#include "sysemu.h"
+#include "boards.h"
 
 #ifdef TARGET_WORDS_BIGENDIAN
 #define BIOS_FILENAME "mips_bios.bin"
@@ -15,14 +21,12 @@
 #define BIOS_FILENAME "mipsel_bios.bin"
 #endif
 
-#ifdef TARGET_MIPS64
-#define PHYS_TO_VIRT(x) ((x) | ~0x7fffffffULL)
-#else
-#define PHYS_TO_VIRT(x) ((x) | ~0x7fffffffU)
-#endif
+#define PHYS_TO_VIRT(x) ((x) | ~(target_ulong)0x7fffffff)
 
 #define VIRT_TO_PHYS_ADDEND (-((int64_t)(int32_t)0x80000000))
 
+#define MAX_IDE_BUS 2
+
 static const int ide_iobase[2] = { 0x1f0, 0x170 };
 static const int ide_iobase2[2] = { 0x3f6, 0x376 };
 static const int ide_irq[2] = { 14, 15 };
@@ -34,7 +38,14 @@ extern FILE *logfile;
 
 static PITState *pit; /* PIT i8254 */
 
-/*i8254 PIT is attached to the IRQ0 at PIC i8259 */
+/* i8254 PIT is attached to the IRQ0 at PIC i8259 */
+
+static struct _loaderparams {
+    int ram_size;
+    const char *kernel_filename;
+    const char *kernel_cmdline;
+    const char *initrd_filename;
+} loaderparams;
 
 static void mips_qemu_writel (void *opaque, target_phys_addr_t addr,
 			      uint32_t val)
@@ -64,15 +75,13 @@ static CPUReadMemoryFunc *mips_qemu_read[] = {
 
 static int mips_qemu_iomemtype = 0;
 
-void load_kernel (CPUState *env, int ram_size, const char *kernel_filename,
-		  const char *kernel_cmdline,
-		  const char *initrd_filename)
+static void load_kernel (CPUState *env)
 {
     int64_t entry, kernel_low, kernel_high;
     long kernel_size, initrd_size;
     ram_addr_t initrd_offset;
 
-    kernel_size = load_elf(kernel_filename, VIRT_TO_PHYS_ADDEND,
+    kernel_size = load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,
                            &entry, &kernel_low, &kernel_high);
     if (kernel_size >= 0) {
         if ((entry & ~0x7fffffffULL) == 0x80000000)
@@ -80,29 +89,29 @@ void load_kernel (CPUState *env, int ram_size, const char *kernel_filename,
         env->PC[env->current_tc] = entry;
     } else {
         fprintf(stderr, "qemu: could not load kernel '%s'\n",
-                kernel_filename);
+                loaderparams.kernel_filename);
         exit(1);
     }
 
     /* load initrd */
     initrd_size = 0;
     initrd_offset = 0;
-    if (initrd_filename) {
-        initrd_size = get_image_size (initrd_filename);
+    if (loaderparams.initrd_filename) {
+        initrd_size = get_image_size (loaderparams.initrd_filename);
         if (initrd_size > 0) {
             initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
             if (initrd_offset + initrd_size > ram_size) {
                 fprintf(stderr,
                         "qemu: memory too small for initial ram disk '%s'\n",
-                        initrd_filename);
+                        loaderparams.initrd_filename);
                 exit(1);
             }
-            initrd_size = load_image(initrd_filename,
+            initrd_size = load_image(loaderparams.initrd_filename,
                                      phys_ram_base + initrd_offset);
         }
         if (initrd_size == (target_ulong) -1) {
             fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
-                    initrd_filename);
+                    loaderparams.initrd_filename);
             exit(1);
         }
     }
@@ -114,10 +123,12 @@ void load_kernel (CPUState *env, int ram_size, const char *kernel_filename,
                       "rd_start=0x" TARGET_FMT_lx " rd_size=%li ",
                       PHYS_TO_VIRT((uint32_t)initrd_offset),
                       initrd_size);
-        strcpy (phys_ram_base + (16 << 20) - 256 + ret, kernel_cmdline);
+        strcpy (phys_ram_base + (16 << 20) - 256 + ret,
+                loaderparams.kernel_cmdline);
     }
     else {
-        strcpy (phys_ram_base + (16 << 20) - 256, kernel_cmdline);
+        strcpy (phys_ram_base + (16 << 20) - 256,
+                loaderparams.kernel_cmdline);
     }
 
     *(int32_t *)(phys_ram_base + (16 << 20) - 260) = tswap32 (0x12345678);
@@ -128,16 +139,14 @@ static void main_cpu_reset(void *opaque)
 {
     CPUState *env = opaque;
     cpu_reset(env);
-    cpu_mips_register(env, NULL);
 
-    if (env->kernel_filename)
-        load_kernel (env, env->ram_size, env->kernel_filename,
-                     env->kernel_cmdline, env->initrd_filename);
+    if (loaderparams.kernel_filename)
+        load_kernel (env);
 }
 
 static
-void mips_r4k_init (int ram_size, int vga_ram_size, int boot_device,
-                    DisplayState *ds, const char **fd_filename, int snapshot,
+void mips_r4k_init (int ram_size, int vga_ram_size,
+                    const char *boot_device, DisplayState *ds,
                     const char *kernel_filename, const char *kernel_cmdline,
                     const char *initrd_filename, const char *cpu_model)
 {
@@ -147,8 +156,9 @@ void mips_r4k_init (int ram_size, int vga_ram_size, int boot_device,
     CPUState *env;
     RTCState *rtc_state;
     int i;
-    mips_def_t *def;
     qemu_irq *i8259;
+    int index;
+    BlockDriverState *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
 
     /* init CPUs */
     if (cpu_model == NULL) {
@@ -158,10 +168,11 @@ void mips_r4k_init (int ram_size, int vga_ram_size, int boot_device,
         cpu_model = "24Kf";
 #endif
     }
-    if (mips_find_by_name(cpu_model, &def) != 0)
-        def = NULL;
-    env = cpu_init();
-    cpu_mips_register(env, def);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
     qemu_register_reset(main_cpu_reset, env);
 
@@ -179,7 +190,9 @@ void mips_r4k_init (int ram_size, int vga_ram_size, int boot_device,
        preloaded we also initialize the hardware, since the BIOS wasn't
        run. */
     bios_offset = ram_size + vga_ram_size;
-    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME);
+    if (bios_name == NULL)
+        bios_name = BIOS_FILENAME;
+    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
     bios_size = load_image(buf, phys_ram_base + bios_offset);
     if ((bios_size > 0) && (bios_size <= BIOS_SIZE)) {
 	cpu_register_physical_memory(0x1fc00000,
@@ -191,12 +204,11 @@ void mips_r4k_init (int ram_size, int vga_ram_size, int boot_device,
     }
 
     if (kernel_filename) {
-        load_kernel (env, ram_size, kernel_filename, kernel_cmdline,
-		     initrd_filename);
-	env->ram_size = ram_size;
-	env->kernel_filename = kernel_filename;
-	env->kernel_cmdline = kernel_cmdline;
-	env->initrd_filename = initrd_filename;
+        loaderparams.ram_size = ram_size;
+        loaderparams.kernel_filename = kernel_filename;
+        loaderparams.kernel_cmdline = kernel_cmdline;
+        loaderparams.initrd_filename = initrd_filename;
+        load_kernel (env);
     }
 
     /* Init CPU internal devices */
@@ -237,12 +249,25 @@ void mips_r4k_init (int ram_size, int vga_ram_size, int boot_device,
         }
     }
 
-    for(i = 0; i < 2; i++)
+    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {
+        fprintf(stderr, "qemu: too many IDE bus\n");
+        exit(1);
+    }
+
+    for(i = 0; i < MAX_IDE_BUS * MAX_IDE_DEVS; i++) {
+        index = drive_get_index(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
+        if (index != -1)
+            hd[i] = drives_table[index].bdrv;
+        else
+            hd[i] = NULL;
+    }
+
+    for(i = 0; i < MAX_IDE_BUS; i++)
         isa_ide_init(ide_iobase[i], ide_iobase2[i], i8259[ide_irq[i]],
-                     bs_table[2 * i], bs_table[2 * i + 1]);
+                     hd[MAX_IDE_DEVS * i],
+		     hd[MAX_IDE_DEVS * i + 1]);
 
     i8042_init(i8259[1], i8259[12], 0x60);
-    ds1225y_init(0x9000, "nvram");
 }
 
 QEMUMachine mips_machine = {
diff --git a/hw/mips_timer.c b/hw/mips_timer.c
index b295bdbfe..3e7d5e3ee 100644
--- a/hw/mips_timer.c
+++ b/hw/mips_timer.c
@@ -1,4 +1,6 @@
-#include "vl.h"
+#include "hw.h"
+#include "mips.h"
+#include "qemu-timer.h"
 
 void cpu_mips_irqctrl_init (void)
 {
diff --git a/hw/mipsnet.c b/hw/mipsnet.c
new file mode 100644
index 000000000..5a74ad962
--- /dev/null
+++ b/hw/mipsnet.c
@@ -0,0 +1,272 @@
+#include "hw.h"
+#include "mips.h"
+#include "net.h"
+#include "isa.h"
+
+//#define DEBUG_MIPSNET_SEND
+//#define DEBUG_MIPSNET_RECEIVE
+//#define DEBUG_MIPSNET_DATA
+//#define DEBUG_MIPSNET_IRQ
+
+/* MIPSnet register offsets */
+
+#define MIPSNET_DEV_ID		0x00
+# define MIPSNET_DEV_ID_STRING	"MIPSNET0"
+#define MIPSNET_BUSY		0x08
+#define MIPSNET_RX_DATA_COUNT	0x0c
+#define MIPSNET_TX_DATA_COUNT	0x10
+#define MIPSNET_INT_CTL		0x14
+# define MIPSNET_INTCTL_TXDONE		0x00000001
+# define MIPSNET_INTCTL_RXDONE		0x00000002
+# define MIPSNET_INTCTL_TESTBIT		0x80000000
+#define MIPSNET_INTERRUPT_INFO	0x18
+#define MIPSNET_RX_DATA_BUFFER	0x1c
+#define MIPSNET_TX_DATA_BUFFER	0x20
+
+#define MAX_ETH_FRAME_SIZE	1514
+
+typedef struct MIPSnetState {
+    uint32_t busy;
+    uint32_t rx_count;
+    uint32_t rx_read;
+    uint32_t tx_count;
+    uint32_t tx_written;
+    uint32_t intctl;
+    uint8_t rx_buffer[MAX_ETH_FRAME_SIZE];
+    uint8_t tx_buffer[MAX_ETH_FRAME_SIZE];
+    qemu_irq irq;
+    VLANClientState *vc;
+    NICInfo *nd;
+} MIPSnetState;
+
+static void mipsnet_reset(MIPSnetState *s)
+{
+    s->busy = 1;
+    s->rx_count = 0;
+    s->rx_read = 0;
+    s->tx_count = 0;
+    s->tx_written = 0;
+    s->intctl = 0;
+    memset(s->rx_buffer, 0, MAX_ETH_FRAME_SIZE);
+    memset(s->tx_buffer, 0, MAX_ETH_FRAME_SIZE);
+}
+
+static void mipsnet_update_irq(MIPSnetState *s)
+{
+    int isr = !!s->intctl;
+#ifdef DEBUG_MIPSNET_IRQ
+    printf("mipsnet: Set IRQ to %d (%02x)\n", isr, s->intctl);
+#endif
+    qemu_set_irq(s->irq, isr);
+}
+
+static int mipsnet_buffer_full(MIPSnetState *s)
+{
+    if (s->rx_count >= MAX_ETH_FRAME_SIZE)
+        return 1;
+    return 0;
+}
+
+static int mipsnet_can_receive(void *opaque)
+{
+    MIPSnetState *s = opaque;
+
+    if (s->busy)
+        return 0;
+    return !mipsnet_buffer_full(s);
+}
+
+static void mipsnet_receive(void *opaque, const uint8_t *buf, int size)
+{
+    MIPSnetState *s = opaque;
+
+#ifdef DEBUG_MIPSNET_RECEIVE
+    printf("mipsnet: receiving len=%d\n", size);
+#endif
+    if (!mipsnet_can_receive(opaque))
+        return;
+
+    s->busy = 1;
+
+    /* Just accept everything. */
+
+    /* Write packet data. */
+    memcpy(s->rx_buffer, buf, size);
+
+    s->rx_count = size;
+    s->rx_read = 0;
+
+    /* Now we can signal we have received something. */
+    s->intctl |= MIPSNET_INTCTL_RXDONE;
+    mipsnet_update_irq(s);
+}
+
+static uint32_t mipsnet_ioport_read(void *opaque, uint32_t addr)
+{
+    MIPSnetState *s = opaque;
+    int ret = 0;
+    const char *devid = MIPSNET_DEV_ID_STRING;
+
+    addr &= 0x3f;
+    switch (addr) {
+    case MIPSNET_DEV_ID:
+	ret = *((uint32_t *)&devid);
+        break;
+    case MIPSNET_DEV_ID + 4:
+	ret = *((uint32_t *)(&devid + 4));
+        break;
+    case MIPSNET_BUSY:
+	ret = s->busy;
+        break;
+    case MIPSNET_RX_DATA_COUNT:
+	ret = s->rx_count;
+        break;
+    case MIPSNET_TX_DATA_COUNT:
+	ret = s->tx_count;
+        break;
+    case MIPSNET_INT_CTL:
+	ret = s->intctl;
+        s->intctl &= ~MIPSNET_INTCTL_TESTBIT;
+        break;
+    case MIPSNET_INTERRUPT_INFO:
+        /* XXX: This seems to be a per-VPE interrupt number. */
+	ret = 0;
+        break;
+    case MIPSNET_RX_DATA_BUFFER:
+        if (s->rx_count) {
+            s->rx_count--;
+            ret = s->rx_buffer[s->rx_read++];
+        }
+        break;
+    /* Reads as zero. */
+    case MIPSNET_TX_DATA_BUFFER:
+    default:
+        break;
+    }
+#ifdef DEBUG_MIPSNET_DATA
+    printf("mipsnet: read addr=0x%02x val=0x%02x\n", addr, ret);
+#endif
+    return ret;
+}
+
+static void mipsnet_ioport_write(void *opaque, uint32_t addr, uint32_t val)
+{
+    MIPSnetState *s = opaque;
+
+    addr &= 0x3f;
+#ifdef DEBUG_MIPSNET_DATA
+    printf("mipsnet: write addr=0x%02x val=0x%02x\n", addr, val);
+#endif
+    switch (addr) {
+    case MIPSNET_TX_DATA_COUNT:
+	s->tx_count = (val <= MAX_ETH_FRAME_SIZE) ? val : 0;
+        s->tx_written = 0;
+        break;
+    case MIPSNET_INT_CTL:
+        if (val & MIPSNET_INTCTL_TXDONE) {
+            s->intctl &= ~MIPSNET_INTCTL_TXDONE;
+        } else if (val & MIPSNET_INTCTL_RXDONE) {
+            s->intctl &= ~MIPSNET_INTCTL_RXDONE;
+        } else if (val & MIPSNET_INTCTL_TESTBIT) {
+            mipsnet_reset(s);
+            s->intctl |= MIPSNET_INTCTL_TESTBIT;
+        } else if (!val) {
+            /* ACK testbit interrupt, flag was cleared on read. */
+        }
+        s->busy = !!s->intctl;
+        mipsnet_update_irq(s);
+        break;
+    case MIPSNET_TX_DATA_BUFFER:
+        s->tx_buffer[s->tx_written++] = val;
+        if (s->tx_written == s->tx_count) {
+            /* Send buffer. */
+#ifdef DEBUG_MIPSNET_SEND
+            printf("mipsnet: sending len=%d\n", s->tx_count);
+#endif
+            qemu_send_packet(s->vc, s->tx_buffer, s->tx_count);
+            s->tx_count = s->tx_written = 0;
+            s->intctl |= MIPSNET_INTCTL_TXDONE;
+            s->busy = 1;
+            mipsnet_update_irq(s);
+        }
+        break;
+    /* Read-only registers */
+    case MIPSNET_DEV_ID:
+    case MIPSNET_BUSY:
+    case MIPSNET_RX_DATA_COUNT:
+    case MIPSNET_INTERRUPT_INFO:
+    case MIPSNET_RX_DATA_BUFFER:
+    default:
+        break;
+    }
+}
+
+static void mipsnet_save(QEMUFile *f, void *opaque)
+{
+    MIPSnetState *s = opaque;
+
+    qemu_put_be32s(f, &s->busy);
+    qemu_put_be32s(f, &s->rx_count);
+    qemu_put_be32s(f, &s->rx_read);
+    qemu_put_be32s(f, &s->tx_count);
+    qemu_put_be32s(f, &s->tx_written);
+    qemu_put_be32s(f, &s->intctl);
+    qemu_put_buffer(f, s->rx_buffer, MAX_ETH_FRAME_SIZE);
+    qemu_put_buffer(f, s->tx_buffer, MAX_ETH_FRAME_SIZE);
+}
+
+static int mipsnet_load(QEMUFile *f, void *opaque, int version_id)
+{
+    MIPSnetState *s = opaque;
+
+    if (version_id > 0)
+        return -EINVAL;
+
+    qemu_get_be32s(f, &s->busy);
+    qemu_get_be32s(f, &s->rx_count);
+    qemu_get_be32s(f, &s->rx_read);
+    qemu_get_be32s(f, &s->tx_count);
+    qemu_get_be32s(f, &s->tx_written);
+    qemu_get_be32s(f, &s->intctl);
+    qemu_get_buffer(f, s->rx_buffer, MAX_ETH_FRAME_SIZE);
+    qemu_get_buffer(f, s->tx_buffer, MAX_ETH_FRAME_SIZE);
+
+    return 0;
+}
+
+void mipsnet_init (int base, qemu_irq irq, NICInfo *nd)
+{
+    MIPSnetState *s;
+
+    s = qemu_mallocz(sizeof(MIPSnetState));
+    if (!s)
+        return;
+
+    register_ioport_write(base, 36, 1, mipsnet_ioport_write, s);
+    register_ioport_read(base, 36, 1, mipsnet_ioport_read, s);
+    register_ioport_write(base, 36, 2, mipsnet_ioport_write, s);
+    register_ioport_read(base, 36, 2, mipsnet_ioport_read, s);
+    register_ioport_write(base, 36, 4, mipsnet_ioport_write, s);
+    register_ioport_read(base, 36, 4, mipsnet_ioport_read, s);
+
+    s->irq = irq;
+    s->nd = nd;
+    if (nd && nd->vlan) {
+        s->vc = qemu_new_vlan_client(nd->vlan, mipsnet_receive,
+                                     mipsnet_can_receive, s);
+    } else {
+        s->vc = NULL;
+    }
+
+    snprintf(s->vc->info_str, sizeof(s->vc->info_str),
+             "mipsnet macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
+              s->nd->macaddr[0],
+              s->nd->macaddr[1],
+              s->nd->macaddr[2],
+              s->nd->macaddr[3],
+              s->nd->macaddr[4],
+              s->nd->macaddr[5]);
+
+    mipsnet_reset(s);
+    register_savevm("mipsnet", 0, 0, mipsnet_save, mipsnet_load, s);
+}
diff --git a/hw/mpcore.c b/hw/mpcore.c
new file mode 100644
index 000000000..d5b28fe4b
--- /dev/null
+++ b/hw/mpcore.c
@@ -0,0 +1,325 @@
+/*
+ * ARM MPCore internal peripheral emulation.
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "hw.h"
+#include "qemu-timer.h"
+#include "primecell.h"
+
+#define MPCORE_PRIV_BASE  0x10100000
+#define NCPU 4
+/* ??? The MPCore TRM says the on-chip controller has 224 external IRQ lines
+   (+ 32 internal).  However my test chip only exposes/reports 32.
+   More importantly Linux falls over if more than 32 are present!  */
+#define GIC_NIRQ 64
+
+static inline int
+gic_get_current_cpu(void)
+{
+  return cpu_single_env->cpu_index;
+}
+
+#include "arm_gic.c"
+
+/* MPCore private memory region.  */
+
+typedef struct {
+    uint32_t count;
+    uint32_t load;
+    uint32_t control;
+    uint32_t status;
+    uint32_t old_status;
+    int64_t tick;
+    QEMUTimer *timer;
+    struct mpcore_priv_state *mpcore;
+    int id; /* Encodes both timer/watchdog and CPU.  */
+} mpcore_timer_state;
+
+typedef struct mpcore_priv_state {
+    gic_state *gic;
+    uint32_t scu_control;
+    mpcore_timer_state timer[8];
+} mpcore_priv_state;
+
+/* Per-CPU Timers.  */
+
+static inline void mpcore_timer_update_irq(mpcore_timer_state *s)
+{
+    if (s->status & ~s->old_status) {
+        gic_set_pending_private(s->mpcore->gic, s->id >> 1, 29 + (s->id & 1));
+    }
+    s->old_status = s->status;
+}
+
+/* Return conversion factor from mpcore timer ticks to qemu timer ticks.  */
+static inline uint32_t mpcore_timer_scale(mpcore_timer_state *s)
+{
+    return (((s->control >> 8) & 0xff) + 1) * 10;
+}
+
+static void mpcore_timer_reload(mpcore_timer_state *s, int restart)
+{
+    if (s->count == 0)
+        return;
+    if (restart)
+        s->tick = qemu_get_clock(vm_clock);
+    s->tick += (int64_t)s->count * mpcore_timer_scale(s);
+    qemu_mod_timer(s->timer, s->tick);
+}
+
+static void mpcore_timer_tick(void *opaque)
+{
+    mpcore_timer_state *s = (mpcore_timer_state *)opaque;
+    s->status = 1;
+    if (s->control & 2) {
+        s->count = s->load;
+        mpcore_timer_reload(s, 0);
+    } else {
+        s->count = 0;
+    }
+    mpcore_timer_update_irq(s);
+}
+
+static uint32_t mpcore_timer_read(mpcore_timer_state *s, int offset)
+{
+    int64_t val;
+    switch (offset) {
+    case 0: /* Load */
+        return s->load;
+        /* Fall through.  */
+    case 4: /* Counter.  */
+        if (((s->control & 1) == 0) || (s->count == 0))
+            return 0;
+        /* Slow and ugly, but hopefully won't happen too often.  */
+        val = s->tick - qemu_get_clock(vm_clock);
+        val /= mpcore_timer_scale(s);
+        if (val < 0)
+            val = 0;
+        return val;
+    case 8: /* Control.  */
+        return s->control;
+    case 12: /* Interrupt status.  */
+        return s->status;
+    }
+}
+
+static void mpcore_timer_write(mpcore_timer_state *s, int offset,
+                               uint32_t value)
+{
+    int64_t old;
+    switch (offset) {
+    case 0: /* Load */
+        s->load = value;
+        /* Fall through.  */
+    case 4: /* Counter.  */
+        if ((s->control & 1) && s->count) {
+            /* Cancel the previous timer.  */
+            qemu_del_timer(s->timer);
+        }
+        s->count = value;
+        if (s->control & 1) {
+            mpcore_timer_reload(s, 1);
+        }
+        break;
+    case 8: /* Control.  */
+        old = s->control;
+        s->control = value;
+        if (((old & 1) == 0) && (value & 1)) {
+            if (s->count == 0 && (s->control & 2))
+                s->count = s->load;
+            mpcore_timer_reload(s, 1);
+        }
+        break;
+    case 12: /* Interrupt status.  */
+        s->status &= ~value;
+        mpcore_timer_update_irq(s);
+        break;
+    }
+}
+
+static void mpcore_timer_init(mpcore_priv_state *mpcore,
+                              mpcore_timer_state *s, int id)
+{
+    s->id = id;
+    s->mpcore = mpcore;
+    s->timer = qemu_new_timer(vm_clock, mpcore_timer_tick, s);
+}
+
+
+/* Per-CPU private memory mapped IO.  */
+
+static uint32_t mpcore_priv_read(void *opaque, target_phys_addr_t offset)
+{
+    mpcore_priv_state *s = (mpcore_priv_state *)opaque;
+    int id;
+    offset &= 0xfff;
+    if (offset < 0x100) {
+        /* SCU */
+        switch (offset) {
+        case 0x00: /* Control.  */
+            return s->scu_control;
+        case 0x04: /* Configuration.  */
+            return 0xf3;
+        case 0x08: /* CPU status.  */
+            return 0;
+        case 0x0c: /* Invalidate all.  */
+            return 0;
+        default:
+            goto bad_reg;
+        }
+    } else if (offset < 0x600) {
+        /* Interrupt controller.  */
+        if (offset < 0x200) {
+            id = gic_get_current_cpu();
+        } else {
+            id = (offset - 0x200) >> 8;
+        }
+        return gic_cpu_read(s->gic, id, offset & 0xff);
+    } else if (offset < 0xb00) {
+        /* Timers.  */
+        if (offset < 0x700) {
+            id = gic_get_current_cpu();
+        } else {
+            id = (offset - 0x700) >> 8;
+        }
+        id <<= 1;
+        if (offset & 0x20)
+          id++;
+        return mpcore_timer_read(&s->timer[id], offset & 0xf);
+    }
+bad_reg:
+    cpu_abort(cpu_single_env, "mpcore_priv_read: Bad offset %x\n",
+              (int)offset);
+    return 0;
+}
+
+static void mpcore_priv_write(void *opaque, target_phys_addr_t offset,
+                          uint32_t value)
+{
+    mpcore_priv_state *s = (mpcore_priv_state *)opaque;
+    int id;
+    offset &= 0xfff;
+    if (offset < 0x100) {
+        /* SCU */
+        switch (offset) {
+        case 0: /* Control register.  */
+            s->scu_control = value & 1;
+            break;
+        case 0x0c: /* Invalidate all.  */
+            /* This is a no-op as cache is not emulated.  */
+            break;
+        default:
+            goto bad_reg;
+        }
+    } else if (offset < 0x600) {
+        /* Interrupt controller.  */
+        if (offset < 0x200) {
+            id = gic_get_current_cpu();
+        } else {
+            id = (offset - 0x200) >> 8;
+        }
+        gic_cpu_write(s->gic, id, offset & 0xff, value);
+    } else if (offset < 0xb00) {
+        /* Timers.  */
+        if (offset < 0x700) {
+            id = gic_get_current_cpu();
+        } else {
+            id = (offset - 0x700) >> 8;
+        }
+        id <<= 1;
+        if (offset & 0x20)
+          id++;
+        mpcore_timer_write(&s->timer[id], offset & 0xf, value);
+        return;
+    }
+    return;
+bad_reg:
+    cpu_abort(cpu_single_env, "mpcore_priv_read: Bad offset %x\n",
+              (int)offset);
+}
+
+static CPUReadMemoryFunc *mpcore_priv_readfn[] = {
+   mpcore_priv_read,
+   mpcore_priv_read,
+   mpcore_priv_read
+};
+
+static CPUWriteMemoryFunc *mpcore_priv_writefn[] = {
+   mpcore_priv_write,
+   mpcore_priv_write,
+   mpcore_priv_write
+};
+
+
+static qemu_irq *mpcore_priv_init(uint32_t base, qemu_irq *pic_irq)
+{
+    mpcore_priv_state *s;
+    int iomemtype;
+    int i;
+
+    s = (mpcore_priv_state *)qemu_mallocz(sizeof(mpcore_priv_state));
+    if (!s)
+        return NULL;
+    s->gic = gic_init(base, pic_irq);
+    if (!s->gic)
+        return NULL;
+    iomemtype = cpu_register_io_memory(0, mpcore_priv_readfn,
+                                       mpcore_priv_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    for (i = 0; i < 8; i++) {
+        mpcore_timer_init(s, &s->timer[i], i);
+    }
+    return s->gic->in;
+}
+
+/* Dummy PIC to route IRQ lines.  The baseboard has 4 independent IRQ
+   controllers.  The output of these, plus some of the raw input lines
+   are fed into a single SMP-aware interrupt controller on the CPU.  */
+typedef struct {
+    qemu_irq *cpuic;
+    qemu_irq *rvic[4];
+} mpcore_rirq_state;
+
+/* Map baseboard IRQs onto CPU IRQ lines.  */
+static const int mpcore_irq_map[32] = {
+    -1, -1, -1, -1,  1,  2, -1, -1,
+    -1, -1,  6, -1,  4,  5, -1, -1,
+    -1, 14, 15,  0,  7,  8, -1, -1,
+    -1, -1, -1, -1,  9,  3, -1, -1,
+};
+
+static void mpcore_rirq_set_irq(void *opaque, int irq, int level)
+{
+    mpcore_rirq_state *s = (mpcore_rirq_state *)opaque;
+    int i;
+
+    for (i = 0; i < 4; i++) {
+        qemu_set_irq(s->rvic[i][irq], level);
+    }
+    if (irq < 32) {
+        irq = mpcore_irq_map[irq];
+        if (irq >= 0) {
+            qemu_set_irq(s->cpuic[irq], level);
+        }
+    }
+}
+
+qemu_irq *mpcore_irq_init(qemu_irq *cpu_irq)
+{
+    mpcore_rirq_state *s;
+    int n;
+
+    /* ??? IRQ routing is hardcoded to "normal" mode.  */
+    s = qemu_mallocz(sizeof(mpcore_rirq_state));
+    s->cpuic = mpcore_priv_init(MPCORE_PRIV_BASE, cpu_irq);
+    for (n = 0; n < 4; n++) {
+        s->rvic[n] = realview_gic_init(0x10040000 + n * 0x10000,
+                                       s->cpuic[10 + n]);
+    }
+    return qemu_allocate_irqs(mpcore_rirq_set_irq, s, 64);
+}
diff --git a/hw/mst_fpga.c b/hw/mst_fpga.c
new file mode 100644
index 000000000..e2f0a9a59
--- /dev/null
+++ b/hw/mst_fpga.c
@@ -0,0 +1,246 @@
+/*
+ * PXA270-based Intel Mainstone platforms.
+ * FPGA driver
+ *
+ * Copyright (c) 2007 by Armin Kuster <akuster@kama-aina.net> or
+ *                                    <akuster@mvista.com>
+ *
+ * This code is licensed under the GNU GPL v2.
+ */
+#include "hw.h"
+#include "pxa.h"
+#include "mainstone.h"
+
+/* Mainstone FPGA for extern irqs */
+#define FPGA_GPIO_PIN	0
+#define MST_NUM_IRQS	16
+#define MST_BASE		MST_FPGA_PHYS
+#define MST_LEDDAT1		0x10
+#define MST_LEDDAT2		0x14
+#define MST_LEDCTRL		0x40
+#define MST_GPSWR		0x60
+#define MST_MSCWR1		0x80
+#define MST_MSCWR2		0x84
+#define MST_MSCWR3		0x88
+#define MST_MSCRD		0x90
+#define MST_INTMSKENA	0xc0
+#define MST_INTSETCLR	0xd0
+#define MST_PCMCIA0		0xe0
+#define MST_PCMCIA1		0xe4
+
+typedef struct mst_irq_state{
+	target_phys_addr_t target_base;
+	qemu_irq *parent;
+	qemu_irq *pins;
+
+	uint32_t prev_level;
+	uint32_t leddat1;
+	uint32_t leddat2;
+	uint32_t ledctrl;
+	uint32_t gpswr;
+	uint32_t mscwr1;
+	uint32_t mscwr2;
+	uint32_t mscwr3;
+	uint32_t mscrd;
+	uint32_t intmskena;
+	uint32_t intsetclr;
+	uint32_t pcmcia0;
+	uint32_t pcmcia1;
+}mst_irq_state;
+
+static void
+mst_fpga_update_gpio(mst_irq_state *s)
+{
+	uint32_t level, diff;
+	int bit;
+	level = s->prev_level ^ s->intsetclr;
+
+	for (diff = s->prev_level ^ level; diff; diff ^= 1 << bit) {
+		bit = ffs(diff) - 1;
+		qemu_set_irq(s->pins[bit], (level >> bit) & 1 );
+	}
+	s->prev_level = level;
+}
+
+static void
+mst_fpga_set_irq(void *opaque, int irq, int level)
+{
+	mst_irq_state *s = (mst_irq_state *)opaque;
+
+	if (level)
+		s->prev_level |= 1u << irq;
+	else
+		s->prev_level &= ~(1u << irq);
+
+	if(s->intmskena & (1u << irq)) {
+		s->intsetclr = 1u << irq;
+		qemu_set_irq(s->parent[0], level);
+	}
+}
+
+
+static uint32_t
+mst_fpga_readb(void *opaque, target_phys_addr_t addr)
+{
+	mst_irq_state *s = (mst_irq_state *) opaque;
+	addr -= s->target_base;
+
+	switch (addr) {
+	case MST_LEDDAT1:
+		return s->leddat1;
+	case MST_LEDDAT2:
+		return s->leddat2;
+	case MST_LEDCTRL:
+		return s->ledctrl;
+	case MST_GPSWR:
+		return s->gpswr;
+	case MST_MSCWR1:
+		return s->mscwr1;
+	case MST_MSCWR2:
+		return s->mscwr2;
+	case MST_MSCWR3:
+		return s->mscwr3;
+	case MST_MSCRD:
+		return s->mscrd;
+	case MST_INTMSKENA:
+		return s->intmskena;
+	case MST_INTSETCLR:
+		return s->intsetclr;
+	case MST_PCMCIA0:
+		return s->pcmcia0;
+	case MST_PCMCIA1:
+		return s->pcmcia1;
+	default:
+		printf("Mainstone - mst_fpga_readb: Bad register offset "
+			REG_FMT " \n", addr);
+	}
+	return 0;
+}
+
+static void
+mst_fpga_writeb(void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+	mst_irq_state *s = (mst_irq_state *) opaque;
+	addr -= s->target_base;
+	value &= 0xffffffff;
+
+	switch (addr) {
+	case MST_LEDDAT1:
+		s->leddat1 = value;
+		break;
+	case MST_LEDDAT2:
+		s->leddat2 = value;
+		break;
+	case MST_LEDCTRL:
+		s->ledctrl = value;
+		break;
+	case MST_GPSWR:
+		s->gpswr = value;
+		break;
+	case MST_MSCWR1:
+		s->mscwr1 = value;
+		break;
+	case MST_MSCWR2:
+		s->mscwr2 = value;
+		break;
+	case MST_MSCWR3:
+		s->mscwr3 = value;
+		break;
+	case MST_MSCRD:
+		s->mscrd =  value;
+		break;
+	case MST_INTMSKENA:	/* Mask interupt */
+		s->intmskena = (value & 0xFEEFF);
+		mst_fpga_update_gpio(s);
+		break;
+	case MST_INTSETCLR:	/* clear or set interrupt */
+		s->intsetclr = (value & 0xFEEFF);
+		break;
+	case MST_PCMCIA0:
+		s->pcmcia0 = value;
+		break;
+	case MST_PCMCIA1:
+		s->pcmcia1 = value;
+		break;
+	default:
+		printf("Mainstone - mst_fpga_writeb: Bad register offset "
+			REG_FMT " \n", addr);
+	}
+}
+
+CPUReadMemoryFunc *mst_fpga_readfn[] = {
+	mst_fpga_readb,
+	mst_fpga_readb,
+	mst_fpga_readb,
+};
+CPUWriteMemoryFunc *mst_fpga_writefn[] = {
+	mst_fpga_writeb,
+	mst_fpga_writeb,
+	mst_fpga_writeb,
+};
+
+static void
+mst_fpga_save(QEMUFile *f, void *opaque)
+{
+	struct mst_irq_state *s = (mst_irq_state *) opaque;
+
+	qemu_put_be32s(f, &s->prev_level);
+	qemu_put_be32s(f, &s->leddat1);
+	qemu_put_be32s(f, &s->leddat2);
+	qemu_put_be32s(f, &s->ledctrl);
+	qemu_put_be32s(f, &s->gpswr);
+	qemu_put_be32s(f, &s->mscwr1);
+	qemu_put_be32s(f, &s->mscwr2);
+	qemu_put_be32s(f, &s->mscwr3);
+	qemu_put_be32s(f, &s->mscrd);
+	qemu_put_be32s(f, &s->intmskena);
+	qemu_put_be32s(f, &s->intsetclr);
+	qemu_put_be32s(f, &s->pcmcia0);
+	qemu_put_be32s(f, &s->pcmcia1);
+}
+
+static int
+mst_fpga_load(QEMUFile *f, void *opaque, int version_id)
+{
+	mst_irq_state *s = (mst_irq_state *) opaque;
+
+	qemu_get_be32s(f, &s->prev_level);
+	qemu_get_be32s(f, &s->leddat1);
+	qemu_get_be32s(f, &s->leddat2);
+	qemu_get_be32s(f, &s->ledctrl);
+	qemu_get_be32s(f, &s->gpswr);
+	qemu_get_be32s(f, &s->mscwr1);
+	qemu_get_be32s(f, &s->mscwr2);
+	qemu_get_be32s(f, &s->mscwr3);
+	qemu_get_be32s(f, &s->mscrd);
+	qemu_get_be32s(f, &s->intmskena);
+	qemu_get_be32s(f, &s->intsetclr);
+	qemu_get_be32s(f, &s->pcmcia0);
+	qemu_get_be32s(f, &s->pcmcia1);
+	return 0;
+}
+
+qemu_irq *mst_irq_init(struct pxa2xx_state_s *cpu, uint32_t base, int irq)
+{
+	mst_irq_state *s;
+	int iomemtype;
+	qemu_irq *qi;
+
+	s = (mst_irq_state  *)
+		qemu_mallocz(sizeof(mst_irq_state));
+
+	if (!s)
+		return NULL;
+	s->target_base = base;
+	s->parent = &cpu->pic[irq];
+
+	/* alloc the external 16 irqs */
+	qi  = qemu_allocate_irqs(mst_fpga_set_irq, s, MST_NUM_IRQS);
+	s->pins = qi;
+
+	iomemtype = cpu_register_io_memory(0, mst_fpga_readfn,
+		mst_fpga_writefn, s);
+	cpu_register_physical_memory(MST_BASE, 0x00100000, iomemtype);
+	register_savevm("mainstone_fpga", 0, 0, mst_fpga_save, mst_fpga_load, s);
+	return qi;
+}
diff --git a/hw/nand.c b/hw/nand.c
index 118d04ea3..ea353ed95 100644
--- a/hw/nand.c
+++ b/hw/nand.c
@@ -11,7 +11,11 @@
 
 #ifndef NAND_IO
 
-# include "vl.h"
+# include "hw.h"
+# include "flash.h"
+# include "block.h"
+/* FIXME: Pass block device as an argument.  */
+# include "sysemu.h"
 
 # define NAND_CMD_READ0		0x00
 # define NAND_CMD_READ1		0x01
@@ -440,14 +444,20 @@ struct nand_flash_s *nand_init(int manf_id, int chip_id)
 {
     int pagesize;
     struct nand_flash_s *s;
+    int index;
 
     if (nand_flash_ids[chip_id].size == 0) {
         cpu_abort(cpu_single_env, "%s: Unsupported NAND chip ID.\n",
                         __FUNCTION__);
     }
+    index = drive_get_index(IF_MTD, 0, 0);
+    if (index == -1) {
+        cpu_abort(cpu_single_env, "%s: missing MTD device\n",
+                        __FUNCTION__);
+    }
 
     s = (struct nand_flash_s *) qemu_mallocz(sizeof(struct nand_flash_s));
-    s->bdrv = mtd_bdrv;
+    s->bdrv = drives_table[index].bdrv;
     s->manf_id = manf_id;
     s->chip_id = chip_id;
     s->size = nand_flash_ids[s->chip_id].size << 20;
diff --git a/hw/ne2000.c b/hw/ne2000.c
index 1a2b91e39..63bb3e2f1 100644
--- a/hw/ne2000.c
+++ b/hw/ne2000.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "pci.h"
+#include "pc.h"
+#include "net.h"
 
 /* debug NE2000 card */
 //#define DEBUG_NE2000
@@ -646,7 +649,7 @@ static uint32_t ne2000_reset_ioport_read(void *opaque, uint32_t addr)
 static void ne2000_save(QEMUFile* f,void* opaque)
 {
 	NE2000State* s=(NE2000State*)opaque;
-        int tmp;
+        uint32_t tmp;
 
         if (s->pci_dev)
             pci_device_save(s->pci_dev, f);
@@ -678,7 +681,7 @@ static int ne2000_load(QEMUFile* f,void* opaque,int version_id)
 {
 	NE2000State* s=(NE2000State*)opaque;
         int ret;
-        int tmp;
+        uint32_t tmp;
 
         if (version_id > 3)
             return -EINVAL;
diff --git a/hw/nvram.h b/hw/nvram.h
new file mode 100644
index 000000000..3ec548302
--- /dev/null
+++ b/hw/nvram.h
@@ -0,0 +1,42 @@
+#ifndef NVRAM_H
+#define NVRAM_H
+
+/* NVRAM helpers */
+typedef uint32_t (*nvram_read_t)(void *private, uint32_t addr);
+typedef void (*nvram_write_t)(void *private, uint32_t addr, uint32_t val);
+typedef struct nvram_t {
+    void *opaque;
+    nvram_read_t read_fn;
+    nvram_write_t write_fn;
+} nvram_t;
+
+void NVRAM_set_byte (nvram_t *nvram, uint32_t addr, uint8_t value);
+uint8_t NVRAM_get_byte (nvram_t *nvram, uint32_t addr);
+void NVRAM_set_word (nvram_t *nvram, uint32_t addr, uint16_t value);
+uint16_t NVRAM_get_word (nvram_t *nvram, uint32_t addr);
+void NVRAM_set_lword (nvram_t *nvram, uint32_t addr, uint32_t value);
+uint32_t NVRAM_get_lword (nvram_t *nvram, uint32_t addr);
+void NVRAM_set_string (nvram_t *nvram, uint32_t addr,
+                       const unsigned char *str, uint32_t max);
+int NVRAM_get_string (nvram_t *nvram, uint8_t *dst, uint16_t addr, int max);
+void NVRAM_set_crc (nvram_t *nvram, uint32_t addr,
+                    uint32_t start, uint32_t count);
+int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
+                          const unsigned char *arch,
+                          uint32_t RAM_size, int boot_device,
+                          uint32_t kernel_image, uint32_t kernel_size,
+                          const char *cmdline,
+                          uint32_t initrd_image, uint32_t initrd_size,
+                          uint32_t NVRAM_image,
+                          int width, int height, int depth);
+typedef struct m48t59_t m48t59_t;
+
+void m48t59_write (void *private, uint32_t addr, uint32_t val);
+uint32_t m48t59_read (void *private, uint32_t addr);
+void m48t59_toggle_lock (void *private, int lock);
+m48t59_t *m48t59_init (qemu_irq IRQ, target_phys_addr_t mem_base,
+                       uint32_t io_base, uint16_t size,
+                       int type);
+void m48t59_set_addr (void *opaque, uint32_t addr);
+
+#endif /* !NVRAM_H */
diff --git a/hw/omap.c b/hw/omap.c
index ccd8f4ef7..ce63597f1 100644
--- a/hw/omap.c
+++ b/hw/omap.c
@@ -18,100 +18,130 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
  * MA 02111-1307 USA
  */
-#include "vl.h"
-#include "arm_pic.h"
+#include "hw.h"
+#include "arm-misc.h"
+#include "omap.h"
+#include "sysemu.h"
+#include "qemu-timer.h"
+/* We use pc-style serial ports.  */
+#include "pc.h"
 
 /* Should signal the TCMI */
+uint32_t omap_badwidth_read8(void *opaque, target_phys_addr_t addr)
+{
+    uint8_t ret;
+
+    OMAP_8B_REG(addr);
+    cpu_physical_memory_read(addr, (void *) &ret, 1);
+    return ret;
+}
+
+void omap_badwidth_write8(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    uint8_t val8 = value;
+
+    OMAP_8B_REG(addr);
+    cpu_physical_memory_write(addr, (void *) &val8, 1);
+}
+
 uint32_t omap_badwidth_read16(void *opaque, target_phys_addr_t addr)
 {
+    uint16_t ret;
+
     OMAP_16B_REG(addr);
-    return 0;
+    cpu_physical_memory_read(addr, (void *) &ret, 2);
+    return ret;
 }
 
 void omap_badwidth_write16(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
+    uint16_t val16 = value;
+
     OMAP_16B_REG(addr);
+    cpu_physical_memory_write(addr, (void *) &val16, 2);
 }
 
 uint32_t omap_badwidth_read32(void *opaque, target_phys_addr_t addr)
 {
+    uint32_t ret;
+
     OMAP_32B_REG(addr);
-    return 0;
+    cpu_physical_memory_read(addr, (void *) &ret, 4);
+    return ret;
 }
 
 void omap_badwidth_write32(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     OMAP_32B_REG(addr);
+    cpu_physical_memory_write(addr, (void *) &value, 4);
 }
 
 /* Interrupt Handlers */
+struct omap_intr_handler_bank_s {
+    uint32_t irqs;
+    uint32_t inputs;
+    uint32_t mask;
+    uint32_t fiq;
+    uint32_t sens_edge;
+    unsigned char priority[32];
+};
+
 struct omap_intr_handler_s {
     qemu_irq *pins;
-    qemu_irq *parent_pic;
+    qemu_irq parent_intr[2];
     target_phys_addr_t base;
+    unsigned char nbanks;
 
     /* state */
-    uint32_t irqs;
-    uint32_t mask;
-    uint32_t sens_edge;
-    uint32_t fiq;
-    int priority[32];
-    uint32_t new_irq_agr;
-    uint32_t new_fiq_agr;
-    int sir_irq;
-    int sir_fiq;
-    int stats[32];
+    uint32_t new_agr[2];
+    int sir_intr[2];
+    struct omap_intr_handler_bank_s banks[];
 };
 
-static void omap_inth_update(struct omap_intr_handler_s *s)
+static void omap_inth_sir_update(struct omap_intr_handler_s *s, int is_fiq)
 {
-    uint32_t irq = s->irqs & ~s->mask & ~s->fiq;
-    uint32_t fiq = s->irqs & ~s->mask & s->fiq;
-
-    if (s->new_irq_agr || !irq) {
-       qemu_set_irq(s->parent_pic[ARM_PIC_CPU_IRQ], irq);
-       if (irq)
-           s->new_irq_agr = 0;
-    }
-
-    if (s->new_fiq_agr || !irq) {
-        qemu_set_irq(s->parent_pic[ARM_PIC_CPU_FIQ], fiq);
-        if (fiq)
-            s->new_fiq_agr = 0;
+    int i, j, sir_intr, p_intr, p, f;
+    uint32_t level;
+    sir_intr = 0;
+    p_intr = 255;
+
+    /* Find the interrupt line with the highest dynamic priority.
+     * Note: 0 denotes the hightest priority.
+     * If all interrupts have the same priority, the default order is IRQ_N,
+     * IRQ_N-1,...,IRQ_0. */
+    for (j = 0; j < s->nbanks; ++j) {
+        level = s->banks[j].irqs & ~s->banks[j].mask &
+                (is_fiq ? s->banks[j].fiq : ~s->banks[j].fiq);
+        for (f = ffs(level), i = f - 1, level >>= f - 1; f; i += f,
+                        level >>= f) {
+            p = s->banks[j].priority[i];
+            if (p <= p_intr) {
+                p_intr = p;
+                sir_intr = 32 * j + i;
+            }
+            f = ffs(level >> 1);
+        }
     }
+    s->sir_intr[is_fiq] = sir_intr;
 }
 
-static void omap_inth_sir_update(struct omap_intr_handler_s *s)
+static inline void omap_inth_update(struct omap_intr_handler_s *s, int is_fiq)
 {
-    int i, intr_irq, intr_fiq, p_irq, p_fiq, p, f;
-    uint32_t level = s->irqs & ~s->mask;
+    int i;
+    uint32_t has_intr = 0;
 
-    intr_irq = 0;
-    intr_fiq = 0;
-    p_irq = -1;
-    p_fiq = -1;
-    /* Find the interrupt line with the highest dynamic priority */
-    for (f = ffs(level), i = f - 1, level >>= f - 1; f; i += f, level >>= f) {
-        p = s->priority[i];
-        if (s->fiq & (1 << i)) {
-            if (p > p_fiq) {
-                p_fiq = p;
-                intr_fiq = i;
-            }
-        } else {
-            if (p > p_irq) {
-                p_irq = p;
-                intr_irq = i;
-            }
-        }
+    for (i = 0; i < s->nbanks; ++i)
+        has_intr |= s->banks[i].irqs & ~s->banks[i].mask &
+                (is_fiq ? s->banks[i].fiq : ~s->banks[i].fiq);
 
-        f = ffs(level >> 1);
+    if (s->new_agr[is_fiq] && has_intr) {
+        s->new_agr[is_fiq] = 0;
+        omap_inth_sir_update(s, is_fiq);
+        qemu_set_irq(s->parent_intr[is_fiq], 1);
     }
-
-    s->sir_irq = intr_irq;
-    s->sir_fiq = intr_fiq;
 }
 
 #define INT_FALLING_EDGE	0
@@ -122,19 +152,24 @@ static void omap_set_intr(void *opaque, int irq, int req)
     struct omap_intr_handler_s *ih = (struct omap_intr_handler_s *) opaque;
     uint32_t rise;
 
+    struct omap_intr_handler_bank_s *bank = &ih->banks[irq >> 5];
+    int n = irq & 31;
+
     if (req) {
-        rise = ~ih->irqs & (1 << irq);
-        ih->irqs |= rise;
-        ih->stats[irq] += !!rise;
+        rise = ~bank->irqs & (1 << n);
+        if (~bank->sens_edge & (1 << n))
+            rise &= ~bank->inputs & (1 << n);
+
+        bank->inputs |= (1 << n);
+        if (rise) {
+            bank->irqs |= rise;
+            omap_inth_update(ih, 0);
+            omap_inth_update(ih, 1);
+        }
     } else {
-        rise = ih->sens_edge & ih->irqs & (1 << irq);
-        ih->irqs &= ~rise;
-    }
-
-    if (rise & ~ih->mask) {
-        omap_inth_sir_update(ih);
-
-        omap_inth_update(ih);
+        rise = bank->sens_edge & bank->irqs & (1 << n);
+        bank->irqs &= ~rise;
+        bank->inputs &= ~(1 << n);
     }
 }
 
@@ -142,33 +177,32 @@ static uint32_t omap_inth_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *) opaque;
     int i, offset = addr - s->base;
+    int bank_no = offset >> 8;
+    int line_no;
+    struct omap_intr_handler_bank_s *bank = &s->banks[bank_no];
+    offset &= 0xff;
 
     switch (offset) {
     case 0x00:	/* ITR */
-        return s->irqs;
+        return bank->irqs;
 
     case 0x04:	/* MIR */
-        return s->mask;
+        return bank->mask;
 
     case 0x10:	/* SIR_IRQ_CODE */
-        i = s->sir_irq;
-        if (((s->sens_edge >> i) & 1) == INT_FALLING_EDGE && i) {
-            s->irqs &= ~(1 << i);
-            omap_inth_sir_update(s);
-            omap_inth_update(s);
-        }
-        return i;
-
-    case 0x14:	/* SIR_FIQ_CODE */
-        i = s->sir_fiq;
-        if (((s->sens_edge >> i) & 1) == INT_FALLING_EDGE && i) {
-            s->irqs &= ~(1 << i);
-            omap_inth_sir_update(s);
-            omap_inth_update(s);
-        }
-        return i;
+    case 0x14:  /* SIR_FIQ_CODE */
+        if (bank_no != 0)
+            break;
+        line_no = s->sir_intr[(offset - 0x10) >> 2];
+        bank = &s->banks[line_no >> 5];
+        i = line_no & 31;
+        if (((bank->sens_edge >> i) & 1) == INT_FALLING_EDGE)
+            bank->irqs &= ~(1 << i);
+        return line_no;
 
     case 0x18:	/* CONTROL_REG */
+        if (bank_no != 0)
+            break;
         return 0;
 
     case 0x1c:	/* ILR0 */
@@ -204,17 +238,15 @@ static uint32_t omap_inth_read(void *opaque, target_phys_addr_t addr)
     case 0x94:	/* ILR30 */
     case 0x98:	/* ILR31 */
         i = (offset - 0x1c) >> 2;
-        return (s->priority[i] << 2) |
-                (((s->sens_edge >> i) & 1) << 1) |
-                ((s->fiq >> i) & 1);
+        return (bank->priority[i] << 2) |
+                (((bank->sens_edge >> i) & 1) << 1) |
+                ((bank->fiq >> i) & 1);
 
     case 0x9c:	/* ISR */
         return 0x00000000;
 
-    default:
-        OMAP_BAD_REG(addr);
-        break;
     }
+    OMAP_BAD_REG(addr);
     return 0;
 }
 
@@ -223,18 +255,21 @@ static void omap_inth_write(void *opaque, target_phys_addr_t addr,
 {
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *) opaque;
     int i, offset = addr - s->base;
+    int bank_no = offset >> 8;
+    struct omap_intr_handler_bank_s *bank = &s->banks[bank_no];
+    offset &= 0xff;
 
     switch (offset) {
     case 0x00:	/* ITR */
-        s->irqs &= value;
-        omap_inth_sir_update(s);
-        omap_inth_update(s);
+        /* Important: ignore the clearing if the IRQ is level-triggered and
+           the input bit is 1 */
+        bank->irqs &= value | (bank->inputs & bank->sens_edge);
         return;
 
     case 0x04:	/* MIR */
-        s->mask = value;
-        omap_inth_sir_update(s);
-        omap_inth_update(s);
+        bank->mask = value;
+        omap_inth_update(s, 0);
+        omap_inth_update(s, 1);
         return;
 
     case 0x10:	/* SIR_IRQ_CODE */
@@ -243,11 +278,18 @@ static void omap_inth_write(void *opaque, target_phys_addr_t addr,
         break;
 
     case 0x18:	/* CONTROL_REG */
-        if (value & 2)
-            s->new_fiq_agr = ~0;
-        if (value & 1)
-            s->new_irq_agr = ~0;
-        omap_inth_update(s);
+        if (bank_no != 0)
+            break;
+        if (value & 2) {
+            qemu_set_irq(s->parent_intr[1], 0);
+            s->new_agr[1] = ~0;
+            omap_inth_update(s, 1);
+        }
+        if (value & 1) {
+            qemu_set_irq(s->parent_intr[0], 0);
+            s->new_agr[0] = ~0;
+            omap_inth_update(s, 0);
+        }
         return;
 
     case 0x1c:	/* ILR0 */
@@ -283,24 +325,22 @@ static void omap_inth_write(void *opaque, target_phys_addr_t addr,
     case 0x94:	/* ILR30 */
     case 0x98:	/* ILR31 */
         i = (offset - 0x1c) >> 2;
-        s->priority[i] = (value >> 2) & 0x1f;
-        s->sens_edge &= ~(1 << i);
-        s->sens_edge |= ((value >> 1) & 1) << i;
-        s->fiq &= ~(1 << i);
-        s->fiq |= (value & 1) << i;
+        bank->priority[i] = (value >> 2) & 0x1f;
+        bank->sens_edge &= ~(1 << i);
+        bank->sens_edge |= ((value >> 1) & 1) << i;
+        bank->fiq &= ~(1 << i);
+        bank->fiq |= (value & 1) << i;
         return;
 
     case 0x9c:	/* ISR */
         for (i = 0; i < 32; i ++)
             if (value & (1 << i)) {
-                omap_set_intr(s, i, 1);
+                omap_set_intr(s, 32 * bank_no + i, 1);
                 return;
             }
         return;
-
-    default:
-        OMAP_BAD_REG(addr);
     }
+    OMAP_BAD_REG(addr);
 }
 
 static CPUReadMemoryFunc *omap_inth_readfn[] = {
@@ -315,31 +355,43 @@ static CPUWriteMemoryFunc *omap_inth_writefn[] = {
     omap_inth_write,
 };
 
-static void omap_inth_reset(struct omap_intr_handler_s *s)
+void omap_inth_reset(struct omap_intr_handler_s *s)
 {
-    s->irqs = 0x00000000;
-    s->mask = 0xffffffff;
-    s->sens_edge = 0x00000000;
-    s->fiq = 0x00000000;
-    memset(s->priority, 0, sizeof(s->priority));
-    s->new_irq_agr = ~0;
-    s->new_fiq_agr = ~0;
-    s->sir_irq = 0;
-    s->sir_fiq = 0;
+    int i;
+
+    for (i = 0; i < s->nbanks; ++i){
+        s->banks[i].irqs = 0x00000000;
+        s->banks[i].mask = 0xffffffff;
+        s->banks[i].sens_edge = 0x00000000;
+        s->banks[i].fiq = 0x00000000;
+        s->banks[i].inputs = 0x00000000;
+        memset(s->banks[i].priority, 0, sizeof(s->banks[i].priority));
+    }
+
+    s->new_agr[0] = ~0;
+    s->new_agr[1] = ~0;
+    s->sir_intr[0] = 0;
+    s->sir_intr[1] = 0;
 
-    omap_inth_update(s);
+    qemu_set_irq(s->parent_intr[0], 0);
+    qemu_set_irq(s->parent_intr[1], 0);
 }
 
 struct omap_intr_handler_s *omap_inth_init(target_phys_addr_t base,
-                unsigned long size, qemu_irq parent[2], omap_clk clk)
+                unsigned long size, unsigned char nbanks,
+                qemu_irq parent_irq, qemu_irq parent_fiq, omap_clk clk)
 {
     int iomemtype;
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *)
-            qemu_mallocz(sizeof(struct omap_intr_handler_s));
+            qemu_mallocz(sizeof(struct omap_intr_handler_s) +
+                            sizeof(struct omap_intr_handler_bank_s) * nbanks);
 
-    s->parent_pic = parent;
+    s->parent_intr[0] = parent_irq;
+    s->parent_intr[1] = parent_fiq;
     s->base = base;
-    s->pins = qemu_allocate_irqs(omap_set_intr, s, 32);
+    s->nbanks = nbanks;
+    s->pins = qemu_allocate_irqs(omap_set_intr, s, nbanks * 32);
+
     omap_inth_reset(s);
 
     iomemtype = cpu_register_io_memory(0, omap_inth_readfn,
@@ -350,38 +402,53 @@ struct omap_intr_handler_s *omap_inth_init(target_phys_addr_t base,
 }
 
 /* OMAP1 DMA module */
-typedef enum {
-    constant = 0,
-    post_incremented,
-    single_index,
-    double_index,
-} omap_dma_addressing_t;
-
 struct omap_dma_channel_s {
+    /* transfer data */
     int burst[2];
     int pack[2];
     enum omap_dma_port port[2];
     target_phys_addr_t addr[2];
     omap_dma_addressing_t mode[2];
+    uint16_t elements;
+    uint16_t frames;
+    int16_t frame_index[2];
+    int16_t element_index[2];
     int data_type;
+
+    /* transfer type */
+    int transparent_copy;
+    int constant_fill;
+    uint32_t color;
+
+    /* auto init and linked channel data */
     int end_prog;
     int repeat;
     int auto_init;
-    int priority;
-    int fs;
-    int sync;
-    int running;
+    int link_enabled;
+    int link_next_ch;
+
+    /* interruption data */
     int interrupts;
     int status;
-    int signalled;
-    int post_sync;
-    int transfer;
-    uint16_t elements;
-    uint16_t frames;
-    uint16_t frame_index;
-    uint16_t element_index;
+
+    /* state data */
+    int active;
+    int enable;
+    int sync;
+    int pending_request;
+    int waiting_end_prog;
     uint16_t cpc;
 
+    /* sync type */
+    int fs;
+    int bs;
+
+    /* compatibility */
+    int omap_3_1_compatible_disable;
+
+    qemu_irq irq;
+    struct omap_dma_channel_s *sibling;
+
     struct omap_dma_reg_set_s {
         target_phys_addr_t src, dest;
         int frame;
@@ -391,16 +458,22 @@ struct omap_dma_channel_s {
         int frames;
         int elements;
     } active_set;
+
+    /* unused parameters */
+    int priority;
+    int interleave_disabled;
+    int type;
 };
 
 struct omap_dma_s {
-    qemu_irq *ih;
     QEMUTimer *tm;
     struct omap_mpu_state_s *mpu;
     target_phys_addr_t base;
     omap_clk clk;
     int64_t delay;
     uint32_t drq;
+    enum omap_dma_model model;
+    int omap_3_1_mapping_disabled;
 
     uint16_t gcr;
     int run_count;
@@ -410,223 +483,302 @@ struct omap_dma_s {
     struct omap_dma_lcd_channel_s lcd_ch;
 };
 
+/* Interrupts */
+#define TIMEOUT_INTR    (1 << 0)
+#define EVENT_DROP_INTR (1 << 1)
+#define HALF_FRAME_INTR (1 << 2)
+#define END_FRAME_INTR  (1 << 3)
+#define LAST_FRAME_INTR (1 << 4)
+#define END_BLOCK_INTR  (1 << 5)
+#define SYNC            (1 << 6)
+
 static void omap_dma_interrupts_update(struct omap_dma_s *s)
 {
-    /* First three interrupts are shared between two channels each.  */
-    qemu_set_irq(s->ih[OMAP_INT_DMA_CH0_6],
-                    (s->ch[0].status | s->ch[6].status) & 0x3f);
-    qemu_set_irq(s->ih[OMAP_INT_DMA_CH1_7],
-                    (s->ch[1].status | s->ch[7].status) & 0x3f);
-    qemu_set_irq(s->ih[OMAP_INT_DMA_CH2_8],
-                    (s->ch[2].status | s->ch[8].status) & 0x3f);
-    qemu_set_irq(s->ih[OMAP_INT_DMA_CH3],
-                    (s->ch[3].status) & 0x3f);
-    qemu_set_irq(s->ih[OMAP_INT_DMA_CH4],
-                    (s->ch[4].status) & 0x3f);
-    qemu_set_irq(s->ih[OMAP_INT_DMA_CH5],
-                    (s->ch[5].status) & 0x3f);
+    struct omap_dma_channel_s *ch = s->ch;
+    int i;
+
+    if (s->omap_3_1_mapping_disabled) {
+        for (i = 0; i < s->chans; i ++, ch ++)
+            if (ch->status)
+                qemu_irq_raise(ch->irq);
+    } else {
+        /* First three interrupts are shared between two channels each. */
+        for (i = 0; i < 6; i ++, ch ++) {
+            if (ch->status || (ch->sibling && ch->sibling->status))
+                qemu_irq_raise(ch->irq);
+        }
+    }
 }
 
-static void omap_dma_channel_load(struct omap_dma_s *s, int ch)
+static void omap_dma_channel_load(struct omap_dma_s *s,
+                struct omap_dma_channel_s *ch)
 {
-    struct omap_dma_reg_set_s *a = &s->ch[ch].active_set;
+    struct omap_dma_reg_set_s *a = &ch->active_set;
     int i;
+    int omap_3_1 = !ch->omap_3_1_compatible_disable;
 
     /*
      * TODO: verify address ranges and alignment
      * TODO: port endianness
      */
 
-    a->src = s->ch[ch].addr[0];
-    a->dest = s->ch[ch].addr[1];
-    a->frames = s->ch[ch].frames;
-    a->elements = s->ch[ch].elements;
+    a->src = ch->addr[0];
+    a->dest = ch->addr[1];
+    a->frames = ch->frames;
+    a->elements = ch->elements;
     a->frame = 0;
     a->element = 0;
 
-    if (unlikely(!s->ch[ch].elements || !s->ch[ch].frames)) {
+    if (unlikely(!ch->elements || !ch->frames)) {
         printf("%s: bad DMA request\n", __FUNCTION__);
         return;
     }
 
     for (i = 0; i < 2; i ++)
-        switch (s->ch[ch].mode[i]) {
+        switch (ch->mode[i]) {
         case constant:
             a->elem_delta[i] = 0;
             a->frame_delta[i] = 0;
             break;
         case post_incremented:
-            a->elem_delta[i] = s->ch[ch].data_type;
+            a->elem_delta[i] = ch->data_type;
             a->frame_delta[i] = 0;
             break;
         case single_index:
-            a->elem_delta[i] = s->ch[ch].data_type +
-                s->ch[ch].element_index - 1;
-            if (s->ch[ch].element_index > 0x7fff)
-                a->elem_delta[i] -= 0x10000;
+            a->elem_delta[i] = ch->data_type +
+                    ch->element_index[omap_3_1 ? 0 : i] - 1;
             a->frame_delta[i] = 0;
             break;
         case double_index:
-            a->elem_delta[i] = s->ch[ch].data_type +
-                s->ch[ch].element_index - 1;
-            if (s->ch[ch].element_index > 0x7fff)
-                a->elem_delta[i] -= 0x10000;
-            a->frame_delta[i] = s->ch[ch].frame_index -
-                s->ch[ch].element_index;
-            if (s->ch[ch].frame_index > 0x7fff)
-                a->frame_delta[i] -= 0x10000;
+            a->elem_delta[i] = ch->data_type +
+                    ch->element_index[omap_3_1 ? 0 : i] - 1;
+            a->frame_delta[i] = ch->frame_index[omap_3_1 ? 0 : i] -
+                    ch->element_index[omap_3_1 ? 0 : i];
             break;
         default:
             break;
         }
 }
 
-static inline void omap_dma_request_run(struct omap_dma_s *s,
-                int channel, int request)
+static void omap_dma_activate_channel(struct omap_dma_s *s,
+                struct omap_dma_channel_s *ch)
 {
-next_channel:
-    if (request > 0)
-        for (; channel < 9; channel ++)
-            if (s->ch[channel].sync == request && s->ch[channel].running)
-                break;
-    if (channel >= 9)
+    if (!ch->active) {
+        ch->active = 1;
+        if (ch->sync)
+            ch->status |= SYNC;
+        s->run_count ++;
+    }
+
+    if (s->delay && !qemu_timer_pending(s->tm))
+        qemu_mod_timer(s->tm, qemu_get_clock(vm_clock) + s->delay);
+}
+
+static void omap_dma_deactivate_channel(struct omap_dma_s *s,
+                struct omap_dma_channel_s *ch)
+{
+    /* Update cpc */
+    ch->cpc = ch->active_set.dest & 0xffff;
+
+    if (ch->pending_request && !ch->waiting_end_prog) {
+        /* Don't deactivate the channel */
+        ch->pending_request = 0;
         return;
+    }
 
-    if (s->ch[channel].transfer) {
-        if (request > 0) {
-            s->ch[channel ++].post_sync = request;
-            goto next_channel;
-        }
-        s->ch[channel].status |= 0x02;	/* Synchronisation drop */
-        omap_dma_interrupts_update(s);
+    /* Don't deactive the channel if it is synchronized and the DMA request is
+       active */
+    if (ch->sync && (s->drq & (1 << ch->sync)))
         return;
+
+    if (ch->active) {
+        ch->active = 0;
+        ch->status &= ~SYNC;
+        s->run_count --;
     }
 
-    if (!s->ch[channel].signalled)
-        s->run_count ++;
-    s->ch[channel].signalled = 1;
+    if (!s->run_count)
+        qemu_del_timer(s->tm);
+}
 
-    if (request > 0)
-        s->ch[channel].status |= 0x40;	/* External request */
+static void omap_dma_enable_channel(struct omap_dma_s *s,
+                struct omap_dma_channel_s *ch)
+{
+    if (!ch->enable) {
+        ch->enable = 1;
+        ch->waiting_end_prog = 0;
+        omap_dma_channel_load(s, ch);
+        if ((!ch->sync) || (s->drq & (1 << ch->sync)))
+            omap_dma_activate_channel(s, ch);
+    }
+}
 
-    if (s->delay && !qemu_timer_pending(s->tm))
-        qemu_mod_timer(s->tm, qemu_get_clock(vm_clock) + s->delay);
+static void omap_dma_disable_channel(struct omap_dma_s *s,
+                struct omap_dma_channel_s *ch)
+{
+    if (ch->enable) {
+        ch->enable = 0;
+        /* Discard any pending request */
+        ch->pending_request = 0;
+        omap_dma_deactivate_channel(s, ch);
+    }
+}
 
-    if (request > 0) {
-        channel ++;
-        goto next_channel;
+static void omap_dma_channel_end_prog(struct omap_dma_s *s,
+                struct omap_dma_channel_s *ch)
+{
+    if (ch->waiting_end_prog) {
+        ch->waiting_end_prog = 0;
+        if (!ch->sync || ch->pending_request) {
+            ch->pending_request = 0;
+            omap_dma_activate_channel(s, ch);
+        }
     }
 }
 
-static inline void omap_dma_request_stop(struct omap_dma_s *s, int channel)
+static void omap_dma_enable_3_1_mapping(struct omap_dma_s *s)
 {
-    if (s->ch[channel].signalled)
-        s->run_count --;
-    s->ch[channel].signalled = 0;
+    s->omap_3_1_mapping_disabled = 0;
+    s->chans = 9;
+}
 
-    if (!s->run_count)
-        qemu_del_timer(s->tm);
+static void omap_dma_disable_3_1_mapping(struct omap_dma_s *s)
+{
+    s->omap_3_1_mapping_disabled = 1;
+    s->chans = 16;
+}
+
+static void omap_dma_process_request(struct omap_dma_s *s, int request)
+{
+    int channel;
+    int drop_event = 0;
+    struct omap_dma_channel_s *ch = s->ch;
+
+    for (channel = 0; channel < s->chans; channel ++, ch ++) {
+        if (ch->enable && ch->sync == request) {
+            if (!ch->active)
+                omap_dma_activate_channel(s, ch);
+            else if (!ch->pending_request)
+                ch->pending_request = 1;
+            else {
+                /* Request collision */
+                /* Second request received while processing other request */
+                ch->status |= EVENT_DROP_INTR;
+                drop_event = 1;
+            }
+        }
+    }
+
+    if (drop_event)
+        omap_dma_interrupts_update(s);
 }
 
 static void omap_dma_channel_run(struct omap_dma_s *s)
 {
-    int ch;
+    int n = s->chans;
     uint16_t status;
     uint8_t value[4];
     struct omap_dma_port_if_s *src_p, *dest_p;
     struct omap_dma_reg_set_s *a;
+    struct omap_dma_channel_s *ch;
 
-    for (ch = 0; ch < 9; ch ++) {
-        a = &s->ch[ch].active_set;
+    for (ch = s->ch; n; n --, ch ++) {
+        if (!ch->active)
+            continue;
 
-        src_p = &s->mpu->port[s->ch[ch].port[0]];
-        dest_p = &s->mpu->port[s->ch[ch].port[1]];
-        if (s->ch[ch].signalled && (!src_p->addr_valid(s->mpu, a->src) ||
-                    !dest_p->addr_valid(s->mpu, a->dest))) {
+        a = &ch->active_set;
+
+        src_p = &s->mpu->port[ch->port[0]];
+        dest_p = &s->mpu->port[ch->port[1]];
+        if ((!ch->constant_fill && !src_p->addr_valid(s->mpu, a->src)) ||
+                        (!dest_p->addr_valid(s->mpu, a->dest))) {
 #if 0
             /* Bus time-out */
-            if (s->ch[ch].interrupts & 0x01)
-                s->ch[ch].status |= 0x01;
-            omap_dma_request_stop(s, ch);
+            if (ch->interrupts & TIMEOUT_INTR)
+                ch->status |= TIMEOUT_INTR;
+            omap_dma_deactivate_channel(s, ch);
             continue;
 #endif
-            printf("%s: Bus time-out in DMA%i operation\n", __FUNCTION__, ch);
+            printf("%s: Bus time-out in DMA%i operation\n",
+                            __FUNCTION__, s->chans - n);
         }
 
-        status = s->ch[ch].status;
-        while (status == s->ch[ch].status && s->ch[ch].signalled) {
+        status = ch->status;
+        while (status == ch->status && ch->active) {
             /* Transfer a single element */
-            s->ch[ch].transfer = 1;
-            cpu_physical_memory_read(a->src, value, s->ch[ch].data_type);
-            cpu_physical_memory_write(a->dest, value, s->ch[ch].data_type);
-            s->ch[ch].transfer = 0;
+            /* FIXME: check the endianness */
+            if (!ch->constant_fill)
+                cpu_physical_memory_read(a->src, value, ch->data_type);
+            else
+                *(uint32_t *) value = ch->color;
+
+            if (!ch->transparent_copy ||
+                    *(uint32_t *) value != ch->color)
+                cpu_physical_memory_write(a->dest, value, ch->data_type);
 
             a->src += a->elem_delta[0];
             a->dest += a->elem_delta[1];
             a->element ++;
 
-            /* Check interrupt conditions */
+            /* If the channel is element synchronized, deactivate it */
+            if (ch->sync && !ch->fs && !ch->bs)
+                omap_dma_deactivate_channel(s, ch);
+
+            /* If it is the last frame, set the LAST_FRAME interrupt */
+            if (a->element == 1 && a->frame == a->frames - 1)
+                if (ch->interrupts & LAST_FRAME_INTR)
+                    ch->status |= LAST_FRAME_INTR;
+
+            /* If the half of the frame was reached, set the HALF_FRAME
+               interrupt */
+            if (a->element == (a->elements >> 1))
+                if (ch->interrupts & HALF_FRAME_INTR)
+                    ch->status |= HALF_FRAME_INTR;
+
             if (a->element == a->elements) {
+                /* End of Frame */
                 a->element = 0;
                 a->src += a->frame_delta[0];
                 a->dest += a->frame_delta[1];
                 a->frame ++;
 
-                if (a->frame == a->frames) {
-                    if (!s->ch[ch].repeat || !s->ch[ch].auto_init)
-                        s->ch[ch].running = 0;
-
-                    if (s->ch[ch].auto_init &&
-                            (s->ch[ch].repeat ||
-                             s->ch[ch].end_prog))
-                        omap_dma_channel_load(s, ch);
+                /* If the channel is frame synchronized, deactivate it */
+                if (ch->sync && ch->fs)
+                    omap_dma_deactivate_channel(s, ch);
 
-                    if (s->ch[ch].interrupts & 0x20)
-                        s->ch[ch].status |= 0x20;
+                /* If the channel is async, update cpc */
+                if (!ch->sync)
+                    ch->cpc = a->dest & 0xffff;
 
-                    if (!s->ch[ch].sync)
-                        omap_dma_request_stop(s, ch);
-                }
+                /* Set the END_FRAME interrupt */
+                if (ch->interrupts & END_FRAME_INTR)
+                    ch->status |= END_FRAME_INTR;
 
-                if (s->ch[ch].interrupts & 0x08)
-                    s->ch[ch].status |= 0x08;
-
-                if (s->ch[ch].sync && s->ch[ch].fs &&
-                                !(s->drq & (1 << s->ch[ch].sync))) {
-                    s->ch[ch].status &= ~0x40;
-                    omap_dma_request_stop(s, ch);
+                if (a->frame == a->frames) {
+                    /* End of Block */
+                    /* Disable the channel */
+
+                    if (ch->omap_3_1_compatible_disable) {
+                        omap_dma_disable_channel(s, ch);
+                        if (ch->link_enabled)
+                            omap_dma_enable_channel(s,
+                                            &s->ch[ch->link_next_ch]);
+                    } else {
+                        if (!ch->auto_init)
+                            omap_dma_disable_channel(s, ch);
+                        else if (ch->repeat || ch->end_prog)
+                            omap_dma_channel_load(s, ch);
+                        else {
+                            ch->waiting_end_prog = 1;
+                            omap_dma_deactivate_channel(s, ch);
+                        }
+                    }
+
+                    if (ch->interrupts & END_BLOCK_INTR)
+                        ch->status |= END_BLOCK_INTR;
                 }
             }
-
-            if (a->element == 1 && a->frame == a->frames - 1)
-                if (s->ch[ch].interrupts & 0x10)
-                    s->ch[ch].status |= 0x10;
-
-            if (a->element == (a->elements >> 1))
-                if (s->ch[ch].interrupts & 0x04)
-                    s->ch[ch].status |= 0x04;
-
-            if (s->ch[ch].sync && !s->ch[ch].fs &&
-                            !(s->drq & (1 << s->ch[ch].sync))) {
-                s->ch[ch].status &= ~0x40;
-                omap_dma_request_stop(s, ch);
-            }
-
-            /*
-             * Process requests made while the element was
-             * being transferred.
-             */
-            if (s->ch[ch].post_sync) {
-                omap_dma_request_run(s, 0, s->ch[ch].post_sync);
-                s->ch[ch].post_sync = 0;
-            }
-
-#if 0
-            break;
-#endif
         }
-
-        s->ch[ch].cpc = a->dest & 0x0000ffff;
     }
 
     omap_dma_interrupts_update(s);
@@ -634,75 +786,174 @@ static void omap_dma_channel_run(struct omap_dma_s *s)
         qemu_mod_timer(s->tm, qemu_get_clock(vm_clock) + s->delay);
 }
 
+static void omap_dma_reset(struct omap_dma_s *s)
+{
+    int i;
+
+    qemu_del_timer(s->tm);
+    s->gcr = 0x0004;
+    s->drq = 0x00000000;
+    s->run_count = 0;
+    s->lcd_ch.src = emiff;
+    s->lcd_ch.condition = 0;
+    s->lcd_ch.interrupts = 0;
+    s->lcd_ch.dual = 0;
+    omap_dma_enable_3_1_mapping(s);
+    for (i = 0; i < s->chans; i ++) {
+        memset(&s->ch[i].burst, 0, sizeof(s->ch[i].burst));
+        memset(&s->ch[i].port, 0, sizeof(s->ch[i].port));
+        memset(&s->ch[i].mode, 0, sizeof(s->ch[i].mode));
+        memset(&s->ch[i].elements, 0, sizeof(s->ch[i].elements));
+        memset(&s->ch[i].frames, 0, sizeof(s->ch[i].frames));
+        memset(&s->ch[i].frame_index, 0, sizeof(s->ch[i].frame_index));
+        memset(&s->ch[i].element_index, 0, sizeof(s->ch[i].element_index));
+        memset(&s->ch[i].data_type, 0, sizeof(s->ch[i].data_type));
+        memset(&s->ch[i].transparent_copy, 0,
+                        sizeof(s->ch[i].transparent_copy));
+        memset(&s->ch[i].constant_fill, 0, sizeof(s->ch[i].constant_fill));
+        memset(&s->ch[i].color, 0, sizeof(s->ch[i].color));
+        memset(&s->ch[i].end_prog, 0, sizeof(s->ch[i].end_prog));
+        memset(&s->ch[i].repeat, 0, sizeof(s->ch[i].repeat));
+        memset(&s->ch[i].auto_init, 0, sizeof(s->ch[i].auto_init));
+        memset(&s->ch[i].link_enabled, 0, sizeof(s->ch[i].link_enabled));
+        memset(&s->ch[i].link_next_ch, 0, sizeof(s->ch[i].link_next_ch));
+        s->ch[i].interrupts = 0x0003;
+        memset(&s->ch[i].status, 0, sizeof(s->ch[i].status));
+        memset(&s->ch[i].active, 0, sizeof(s->ch[i].active));
+        memset(&s->ch[i].enable, 0, sizeof(s->ch[i].enable));
+        memset(&s->ch[i].sync, 0, sizeof(s->ch[i].sync));
+        memset(&s->ch[i].pending_request, 0, sizeof(s->ch[i].pending_request));
+        memset(&s->ch[i].waiting_end_prog, 0,
+                        sizeof(s->ch[i].waiting_end_prog));
+        memset(&s->ch[i].cpc, 0, sizeof(s->ch[i].cpc));
+        memset(&s->ch[i].fs, 0, sizeof(s->ch[i].fs));
+        memset(&s->ch[i].bs, 0, sizeof(s->ch[i].bs));
+        memset(&s->ch[i].omap_3_1_compatible_disable, 0,
+                        sizeof(s->ch[i].omap_3_1_compatible_disable));
+        memset(&s->ch[i].active_set, 0, sizeof(s->ch[i].active_set));
+        memset(&s->ch[i].priority, 0, sizeof(s->ch[i].priority));
+        memset(&s->ch[i].interleave_disabled, 0,
+                        sizeof(s->ch[i].interleave_disabled));
+        memset(&s->ch[i].type, 0, sizeof(s->ch[i].type));
+    }
+}
+
 static int omap_dma_ch_reg_read(struct omap_dma_s *s,
-                int ch, int reg, uint16_t *value) {
+                struct omap_dma_channel_s *ch, int reg, uint16_t *value)
+{
     switch (reg) {
     case 0x00:	/* SYS_DMA_CSDP_CH0 */
-        *value = (s->ch[ch].burst[1] << 14) |
-                (s->ch[ch].pack[1] << 13) |
-                (s->ch[ch].port[1] << 9) |
-                (s->ch[ch].burst[0] << 7) |
-                (s->ch[ch].pack[0] << 6) |
-                (s->ch[ch].port[0] << 2) |
-                (s->ch[ch].data_type >> 1);
+        *value = (ch->burst[1] << 14) |
+                (ch->pack[1] << 13) |
+                (ch->port[1] << 9) |
+                (ch->burst[0] << 7) |
+                (ch->pack[0] << 6) |
+                (ch->port[0] << 2) |
+                (ch->data_type >> 1);
         break;
 
     case 0x02:	/* SYS_DMA_CCR_CH0 */
-        *value = (s->ch[ch].mode[1] << 14) |
-                (s->ch[ch].mode[0] << 12) |
-                (s->ch[ch].end_prog << 11) |
-                (s->ch[ch].repeat << 9) |
-                (s->ch[ch].auto_init << 8) |
-                (s->ch[ch].running << 7) |
-                (s->ch[ch].priority << 6) |
-                (s->ch[ch].fs << 5) | s->ch[ch].sync;
+        if (s->model == omap_dma_3_1)
+            *value = 0 << 10;			/* FIFO_FLUSH reads as 0 */
+        else
+            *value = ch->omap_3_1_compatible_disable << 10;
+        *value |= (ch->mode[1] << 14) |
+                (ch->mode[0] << 12) |
+                (ch->end_prog << 11) |
+                (ch->repeat << 9) |
+                (ch->auto_init << 8) |
+                (ch->enable << 7) |
+                (ch->priority << 6) |
+                (ch->fs << 5) | ch->sync;
         break;
 
     case 0x04:	/* SYS_DMA_CICR_CH0 */
-        *value = s->ch[ch].interrupts;
+        *value = ch->interrupts;
         break;
 
     case 0x06:	/* SYS_DMA_CSR_CH0 */
-        /* FIXME: shared CSR for channels sharing the interrupts */
-        *value = s->ch[ch].status;
-        s->ch[ch].status &= 0x40;
-        omap_dma_interrupts_update(s);
+        *value = ch->status;
+        ch->status &= SYNC;
+        if (!ch->omap_3_1_compatible_disable && ch->sibling) {
+            *value |= (ch->sibling->status & 0x3f) << 6;
+            ch->sibling->status &= SYNC;
+        }
+        qemu_irq_lower(ch->irq);
         break;
 
     case 0x08:	/* SYS_DMA_CSSA_L_CH0 */
-        *value = s->ch[ch].addr[0] & 0x0000ffff;
+        *value = ch->addr[0] & 0x0000ffff;
         break;
 
     case 0x0a:	/* SYS_DMA_CSSA_U_CH0 */
-        *value = s->ch[ch].addr[0] >> 16;
+        *value = ch->addr[0] >> 16;
         break;
 
     case 0x0c:	/* SYS_DMA_CDSA_L_CH0 */
-        *value = s->ch[ch].addr[1] & 0x0000ffff;
+        *value = ch->addr[1] & 0x0000ffff;
         break;
 
     case 0x0e:	/* SYS_DMA_CDSA_U_CH0 */
-        *value = s->ch[ch].addr[1] >> 16;
+        *value = ch->addr[1] >> 16;
         break;
 
     case 0x10:	/* SYS_DMA_CEN_CH0 */
-        *value = s->ch[ch].elements;
+        *value = ch->elements;
         break;
 
     case 0x12:	/* SYS_DMA_CFN_CH0 */
-        *value = s->ch[ch].frames;
+        *value = ch->frames;
         break;
 
     case 0x14:	/* SYS_DMA_CFI_CH0 */
-        *value = s->ch[ch].frame_index;
+        *value = ch->frame_index[0];
         break;
 
     case 0x16:	/* SYS_DMA_CEI_CH0 */
-        *value = s->ch[ch].element_index;
+        *value = ch->element_index[0];
+        break;
+
+    case 0x18:	/* SYS_DMA_CPC_CH0 or DMA_CSAC */
+        if (ch->omap_3_1_compatible_disable)
+            *value = ch->active_set.src & 0xffff;	/* CSAC */
+        else
+            *value = ch->cpc;
+        break;
+
+    case 0x1a:	/* DMA_CDAC */
+        *value = ch->active_set.dest & 0xffff;	/* CDAC */
+        break;
+
+    case 0x1c:	/* DMA_CDEI */
+        *value = ch->element_index[1];
+        break;
+
+    case 0x1e:	/* DMA_CDFI */
+        *value = ch->frame_index[1];
+        break;
+
+    case 0x20:	/* DMA_COLOR_L */
+        *value = ch->color & 0xffff;
+        break;
+
+    case 0x22:	/* DMA_COLOR_U */
+        *value = ch->color >> 16;
         break;
 
-    case 0x18:	/* SYS_DMA_CPC_CH0 */
-        *value = s->ch[ch].cpc;
+    case 0x24:	/* DMA_CCR2 */
+        *value = (ch->bs << 2) |
+                (ch->transparent_copy << 1) |
+                ch->constant_fill;
+        break;
+
+    case 0x28:	/* DMA_CLNK_CTRL */
+        *value = (ch->link_enabled << 15) |
+                (ch->link_next_ch & 0xf);
+        break;
+
+    case 0x2a:	/* DMA_LCH_CTRL */
+        *value = (ch->interleave_disabled << 15) |
+                ch->type;
         break;
 
     default:
@@ -712,226 +963,688 @@ static int omap_dma_ch_reg_read(struct omap_dma_s *s,
 }
 
 static int omap_dma_ch_reg_write(struct omap_dma_s *s,
-                int ch, int reg, uint16_t value) {
+                struct omap_dma_channel_s *ch, int reg, uint16_t value)
+{
     switch (reg) {
     case 0x00:	/* SYS_DMA_CSDP_CH0 */
-        s->ch[ch].burst[1] = (value & 0xc000) >> 14;
-        s->ch[ch].pack[1] = (value & 0x2000) >> 13;
-        s->ch[ch].port[1] = (enum omap_dma_port) ((value & 0x1e00) >> 9);
-        s->ch[ch].burst[0] = (value & 0x0180) >> 7;
-        s->ch[ch].pack[0] = (value & 0x0040) >> 6;
-        s->ch[ch].port[0] = (enum omap_dma_port) ((value & 0x003c) >> 2);
-        s->ch[ch].data_type = (1 << (value & 3));
-        if (s->ch[ch].port[0] >= omap_dma_port_last)
+        ch->burst[1] = (value & 0xc000) >> 14;
+        ch->pack[1] = (value & 0x2000) >> 13;
+        ch->port[1] = (enum omap_dma_port) ((value & 0x1e00) >> 9);
+        ch->burst[0] = (value & 0x0180) >> 7;
+        ch->pack[0] = (value & 0x0040) >> 6;
+        ch->port[0] = (enum omap_dma_port) ((value & 0x003c) >> 2);
+        ch->data_type = (1 << (value & 3));
+        if (ch->port[0] >= omap_dma_port_last)
             printf("%s: invalid DMA port %i\n", __FUNCTION__,
-                            s->ch[ch].port[0]);
-        if (s->ch[ch].port[1] >= omap_dma_port_last)
+                            ch->port[0]);
+        if (ch->port[1] >= omap_dma_port_last)
             printf("%s: invalid DMA port %i\n", __FUNCTION__,
-                            s->ch[ch].port[1]);
+                            ch->port[1]);
         if ((value & 3) == 3)
-            printf("%s: bad data_type for DMA channel %i\n", __FUNCTION__, ch);
+            printf("%s: bad data_type for DMA channel\n", __FUNCTION__);
         break;
 
     case 0x02:	/* SYS_DMA_CCR_CH0 */
-        s->ch[ch].mode[1] = (omap_dma_addressing_t) ((value & 0xc000) >> 14);
-        s->ch[ch].mode[0] = (omap_dma_addressing_t) ((value & 0x3000) >> 12);
-        s->ch[ch].end_prog = (value & 0x0800) >> 11;
-        s->ch[ch].repeat = (value & 0x0200) >> 9;
-        s->ch[ch].auto_init = (value & 0x0100) >> 8;
-        s->ch[ch].priority = (value & 0x0040) >> 6;
-        s->ch[ch].fs = (value & 0x0020) >> 5;
-        s->ch[ch].sync = value & 0x001f;
-        if (value & 0x0080) {
-            if (s->ch[ch].running) {
-                if (!s->ch[ch].signalled &&
-                                s->ch[ch].auto_init && s->ch[ch].end_prog)
-                    omap_dma_channel_load(s, ch);
-            } else {
-                s->ch[ch].running = 1;
-                omap_dma_channel_load(s, ch);
-            }
-            if (!s->ch[ch].sync || (s->drq & (1 << s->ch[ch].sync)))
-                omap_dma_request_run(s, ch, 0);
-        } else {
-            s->ch[ch].running = 0;
-            omap_dma_request_stop(s, ch);
-        }
+        ch->mode[1] = (omap_dma_addressing_t) ((value & 0xc000) >> 14);
+        ch->mode[0] = (omap_dma_addressing_t) ((value & 0x3000) >> 12);
+        ch->end_prog = (value & 0x0800) >> 11;
+        if (s->model > omap_dma_3_1)
+            ch->omap_3_1_compatible_disable  = (value >> 10) & 0x1;
+        ch->repeat = (value & 0x0200) >> 9;
+        ch->auto_init = (value & 0x0100) >> 8;
+        ch->priority = (value & 0x0040) >> 6;
+        ch->fs = (value & 0x0020) >> 5;
+        ch->sync = value & 0x001f;
+
+        if (value & 0x0080)
+            omap_dma_enable_channel(s, ch);
+        else
+            omap_dma_disable_channel(s, ch);
+
+        if (ch->end_prog)
+            omap_dma_channel_end_prog(s, ch);
+
         break;
 
     case 0x04:	/* SYS_DMA_CICR_CH0 */
-        s->ch[ch].interrupts = value & 0x003f;
+        ch->interrupts = value;
         break;
 
     case 0x06:	/* SYS_DMA_CSR_CH0 */
-        return 1;
+        OMAP_RO_REG((target_phys_addr_t) reg);
+        break;
 
     case 0x08:	/* SYS_DMA_CSSA_L_CH0 */
-        s->ch[ch].addr[0] &= 0xffff0000;
-        s->ch[ch].addr[0] |= value;
+        ch->addr[0] &= 0xffff0000;
+        ch->addr[0] |= value;
         break;
 
     case 0x0a:	/* SYS_DMA_CSSA_U_CH0 */
-        s->ch[ch].addr[0] &= 0x0000ffff;
-        s->ch[ch].addr[0] |= value << 16;
+        ch->addr[0] &= 0x0000ffff;
+        ch->addr[0] |= (uint32_t) value << 16;
         break;
 
     case 0x0c:	/* SYS_DMA_CDSA_L_CH0 */
-        s->ch[ch].addr[1] &= 0xffff0000;
-        s->ch[ch].addr[1] |= value;
+        ch->addr[1] &= 0xffff0000;
+        ch->addr[1] |= value;
         break;
 
     case 0x0e:	/* SYS_DMA_CDSA_U_CH0 */
-        s->ch[ch].addr[1] &= 0x0000ffff;
-        s->ch[ch].addr[1] |= value << 16;
+        ch->addr[1] &= 0x0000ffff;
+        ch->addr[1] |= (uint32_t) value << 16;
         break;
 
     case 0x10:	/* SYS_DMA_CEN_CH0 */
-        s->ch[ch].elements = value & 0xffff;
+        ch->elements = value;
         break;
 
     case 0x12:	/* SYS_DMA_CFN_CH0 */
-        s->ch[ch].frames = value & 0xffff;
+        ch->frames = value;
         break;
 
     case 0x14:	/* SYS_DMA_CFI_CH0 */
-        s->ch[ch].frame_index = value & 0xffff;
+        ch->frame_index[0] = (int16_t) value;
         break;
 
     case 0x16:	/* SYS_DMA_CEI_CH0 */
-        s->ch[ch].element_index = value & 0xffff;
+        ch->element_index[0] = (int16_t) value;
         break;
 
-    case 0x18:	/* SYS_DMA_CPC_CH0 */
-        return 1;
+    case 0x18:	/* SYS_DMA_CPC_CH0 or DMA_CSAC */
+        OMAP_RO_REG((target_phys_addr_t) reg);
+        break;
+
+    case 0x1c:	/* DMA_CDEI */
+        ch->element_index[1] = (int16_t) value;
+        break;
+
+    case 0x1e:	/* DMA_CDFI */
+        ch->frame_index[1] = (int16_t) value;
+        break;
+
+    case 0x20:	/* DMA_COLOR_L */
+        ch->color &= 0xffff0000;
+        ch->color |= value;
+        break;
+
+    case 0x22:	/* DMA_COLOR_U */
+        ch->color &= 0xffff;
+        ch->color |= value << 16;
+        break;
+
+    case 0x24:	/* DMA_CCR2 */
+        ch->bs  = (value >> 2) & 0x1;
+        ch->transparent_copy = (value >> 1) & 0x1;
+        ch->constant_fill = value & 0x1;
+        break;
+
+    case 0x28:	/* DMA_CLNK_CTRL */
+        ch->link_enabled = (value >> 15) & 0x1;
+        if (value & (1 << 14)) {			/* Stop_Lnk */
+            ch->link_enabled = 0;
+            omap_dma_disable_channel(s, ch);
+        }
+        ch->link_next_ch = value & 0x1f;
+        break;
+
+    case 0x2a:	/* DMA_LCH_CTRL */
+        ch->interleave_disabled = (value >> 15) & 0x1;
+        ch->type = value & 0xf;
+        break;
 
     default:
-        OMAP_BAD_REG((unsigned long) reg);
+        return 1;
     }
     return 0;
 }
 
-static uint32_t omap_dma_read(void *opaque, target_phys_addr_t addr)
+static int omap_dma_3_2_lcd_write(struct omap_dma_lcd_channel_s *s, int offset,
+                uint16_t value)
 {
-    struct omap_dma_s *s = (struct omap_dma_s *) opaque;
-    int i, reg, ch, offset = addr - s->base;
-    uint16_t ret;
+    switch (offset) {
+    case 0xbc0:	/* DMA_LCD_CSDP */
+        s->brust_f2 = (value >> 14) & 0x3;
+        s->pack_f2 = (value >> 13) & 0x1;
+        s->data_type_f2 = (1 << ((value >> 11) & 0x3));
+        s->brust_f1 = (value >> 7) & 0x3;
+        s->pack_f1 = (value >> 6) & 0x1;
+        s->data_type_f1 = (1 << ((value >> 0) & 0x3));
+        break;
+
+    case 0xbc2:	/* DMA_LCD_CCR */
+        s->mode_f2 = (value >> 14) & 0x3;
+        s->mode_f1 = (value >> 12) & 0x3;
+        s->end_prog = (value >> 11) & 0x1;
+        s->omap_3_1_compatible_disable = (value >> 10) & 0x1;
+        s->repeat = (value >> 9) & 0x1;
+        s->auto_init = (value >> 8) & 0x1;
+        s->running = (value >> 7) & 0x1;
+        s->priority = (value >> 6) & 0x1;
+        s->bs = (value >> 4) & 0x1;
+        break;
+
+    case 0xbc4:	/* DMA_LCD_CTRL */
+        s->dst = (value >> 8) & 0x1;
+        s->src = ((value >> 6) & 0x3) << 1;
+        s->condition = 0;
+        /* Assume no bus errors and thus no BUS_ERROR irq bits.  */
+        s->interrupts = (value >> 1) & 1;
+        s->dual = value & 1;
+        break;
+
+    case 0xbc8:	/* TOP_B1_L */
+        s->src_f1_top &= 0xffff0000;
+        s->src_f1_top |= 0x0000ffff & value;
+        break;
+
+    case 0xbca:	/* TOP_B1_U */
+        s->src_f1_top &= 0x0000ffff;
+        s->src_f1_top |= value << 16;
+        break;
 
+    case 0xbcc:	/* BOT_B1_L */
+        s->src_f1_bottom &= 0xffff0000;
+        s->src_f1_bottom |= 0x0000ffff & value;
+        break;
+
+    case 0xbce:	/* BOT_B1_U */
+        s->src_f1_bottom &= 0x0000ffff;
+        s->src_f1_bottom |= (uint32_t) value << 16;
+        break;
+
+    case 0xbd0:	/* TOP_B2_L */
+        s->src_f2_top &= 0xffff0000;
+        s->src_f2_top |= 0x0000ffff & value;
+        break;
+
+    case 0xbd2:	/* TOP_B2_U */
+        s->src_f2_top &= 0x0000ffff;
+        s->src_f2_top |= (uint32_t) value << 16;
+        break;
+
+    case 0xbd4:	/* BOT_B2_L */
+        s->src_f2_bottom &= 0xffff0000;
+        s->src_f2_bottom |= 0x0000ffff & value;
+        break;
+
+    case 0xbd6:	/* BOT_B2_U */
+        s->src_f2_bottom &= 0x0000ffff;
+        s->src_f2_bottom |= (uint32_t) value << 16;
+        break;
+
+    case 0xbd8:	/* DMA_LCD_SRC_EI_B1 */
+        s->element_index_f1 = value;
+        break;
+
+    case 0xbda:	/* DMA_LCD_SRC_FI_B1_L */
+        s->frame_index_f1 &= 0xffff0000;
+        s->frame_index_f1 |= 0x0000ffff & value;
+        break;
+
+    case 0xbf4:	/* DMA_LCD_SRC_FI_B1_U */
+        s->frame_index_f1 &= 0x0000ffff;
+        s->frame_index_f1 |= (uint32_t) value << 16;
+        break;
+
+    case 0xbdc:	/* DMA_LCD_SRC_EI_B2 */
+        s->element_index_f2 = value;
+        break;
+
+    case 0xbde:	/* DMA_LCD_SRC_FI_B2_L */
+        s->frame_index_f2 &= 0xffff0000;
+        s->frame_index_f2 |= 0x0000ffff & value;
+        break;
+
+    case 0xbf6:	/* DMA_LCD_SRC_FI_B2_U */
+        s->frame_index_f2 &= 0x0000ffff;
+        s->frame_index_f2 |= (uint32_t) value << 16;
+        break;
+
+    case 0xbe0:	/* DMA_LCD_SRC_EN_B1 */
+        s->elements_f1 = value;
+        break;
+
+    case 0xbe4:	/* DMA_LCD_SRC_FN_B1 */
+        s->frames_f1 = value;
+        break;
+
+    case 0xbe2:	/* DMA_LCD_SRC_EN_B2 */
+        s->elements_f2 = value;
+        break;
+
+    case 0xbe6:	/* DMA_LCD_SRC_FN_B2 */
+        s->frames_f2 = value;
+        break;
+
+    case 0xbea:	/* DMA_LCD_LCH_CTRL */
+        s->lch_type = value & 0xf;
+        break;
+
+    default:
+        return 1;
+    }
+    return 0;
+}
+
+static int omap_dma_3_2_lcd_read(struct omap_dma_lcd_channel_s *s, int offset,
+                uint16_t *ret)
+{
     switch (offset) {
-    case 0x000 ... 0x2fe:
-        reg = offset & 0x3f;
-        ch = (offset >> 6) & 0x0f;
-        if (omap_dma_ch_reg_read(s, ch, reg, &ret))
-            break;
-        return ret;
+    case 0xbc0:	/* DMA_LCD_CSDP */
+        *ret = (s->brust_f2 << 14) |
+            (s->pack_f2 << 13) |
+            ((s->data_type_f2 >> 1) << 11) |
+            (s->brust_f1 << 7) |
+            (s->pack_f1 << 6) |
+            ((s->data_type_f1 >> 1) << 0);
+        break;
+
+    case 0xbc2:	/* DMA_LCD_CCR */
+        *ret = (s->mode_f2 << 14) |
+            (s->mode_f1 << 12) |
+            (s->end_prog << 11) |
+            (s->omap_3_1_compatible_disable << 10) |
+            (s->repeat << 9) |
+            (s->auto_init << 8) |
+            (s->running << 7) |
+            (s->priority << 6) |
+            (s->bs << 4);
+        break;
+
+    case 0xbc4:	/* DMA_LCD_CTRL */
+        qemu_irq_lower(s->irq);
+        *ret = (s->dst << 8) |
+            ((s->src & 0x6) << 5) |
+            (s->condition << 3) |
+            (s->interrupts << 1) |
+            s->dual;
+        break;
+
+    case 0xbc8:	/* TOP_B1_L */
+        *ret = s->src_f1_top & 0xffff;
+        break;
+
+    case 0xbca:	/* TOP_B1_U */
+        *ret = s->src_f1_top >> 16;
+        break;
+
+    case 0xbcc:	/* BOT_B1_L */
+        *ret = s->src_f1_bottom & 0xffff;
+        break;
+
+    case 0xbce:	/* BOT_B1_U */
+        *ret = s->src_f1_bottom >> 16;
+        break;
+
+    case 0xbd0:	/* TOP_B2_L */
+        *ret = s->src_f2_top & 0xffff;
+        break;
+
+    case 0xbd2:	/* TOP_B2_U */
+        *ret = s->src_f2_top >> 16;
+        break;
+
+    case 0xbd4:	/* BOT_B2_L */
+        *ret = s->src_f2_bottom & 0xffff;
+        break;
+
+    case 0xbd6:	/* BOT_B2_U */
+        *ret = s->src_f2_bottom >> 16;
+        break;
+
+    case 0xbd8:	/* DMA_LCD_SRC_EI_B1 */
+        *ret = s->element_index_f1;
+        break;
+
+    case 0xbda:	/* DMA_LCD_SRC_FI_B1_L */
+        *ret = s->frame_index_f1 & 0xffff;
+        break;
+
+    case 0xbf4:	/* DMA_LCD_SRC_FI_B1_U */
+        *ret = s->frame_index_f1 >> 16;
+        break;
+
+    case 0xbdc:	/* DMA_LCD_SRC_EI_B2 */
+        *ret = s->element_index_f2;
+        break;
+
+    case 0xbde:	/* DMA_LCD_SRC_FI_B2_L */
+        *ret = s->frame_index_f2 & 0xffff;
+        break;
+
+    case 0xbf6:	/* DMA_LCD_SRC_FI_B2_U */
+        *ret = s->frame_index_f2 >> 16;
+        break;
+
+    case 0xbe0:	/* DMA_LCD_SRC_EN_B1 */
+        *ret = s->elements_f1;
+        break;
 
+    case 0xbe4:	/* DMA_LCD_SRC_FN_B1 */
+        *ret = s->frames_f1;
+        break;
+
+    case 0xbe2:	/* DMA_LCD_SRC_EN_B2 */
+        *ret = s->elements_f2;
+        break;
+
+    case 0xbe6:	/* DMA_LCD_SRC_FN_B2 */
+        *ret = s->frames_f2;
+        break;
+
+    case 0xbea:	/* DMA_LCD_LCH_CTRL */
+        *ret = s->lch_type;
+        break;
+
+    default:
+        return 1;
+    }
+    return 0;
+}
+
+static int omap_dma_3_1_lcd_write(struct omap_dma_lcd_channel_s *s, int offset,
+                uint16_t value)
+{
+    switch (offset) {
     case 0x300:	/* SYS_DMA_LCD_CTRL */
-        i = s->lcd_ch.condition;
-        s->lcd_ch.condition = 0;
-        qemu_irq_lower(s->lcd_ch.irq);
-        return ((s->lcd_ch.src == imif) << 6) | (i << 3) |
-                (s->lcd_ch.interrupts << 1) | s->lcd_ch.dual;
+        s->src = (value & 0x40) ? imif : emiff;
+        s->condition = 0;
+        /* Assume no bus errors and thus no BUS_ERROR irq bits.  */
+        s->interrupts = (value >> 1) & 1;
+        s->dual = value & 1;
+        break;
 
     case 0x302:	/* SYS_DMA_LCD_TOP_F1_L */
-        return s->lcd_ch.src_f1_top & 0xffff;
+        s->src_f1_top &= 0xffff0000;
+        s->src_f1_top |= 0x0000ffff & value;
+        break;
 
     case 0x304:	/* SYS_DMA_LCD_TOP_F1_U */
-        return s->lcd_ch.src_f1_top >> 16;
+        s->src_f1_top &= 0x0000ffff;
+        s->src_f1_top |= value << 16;
+        break;
 
     case 0x306:	/* SYS_DMA_LCD_BOT_F1_L */
-        return s->lcd_ch.src_f1_bottom & 0xffff;
+        s->src_f1_bottom &= 0xffff0000;
+        s->src_f1_bottom |= 0x0000ffff & value;
+        break;
 
     case 0x308:	/* SYS_DMA_LCD_BOT_F1_U */
-        return s->lcd_ch.src_f1_bottom >> 16;
+        s->src_f1_bottom &= 0x0000ffff;
+        s->src_f1_bottom |= value << 16;
+        break;
 
     case 0x30a:	/* SYS_DMA_LCD_TOP_F2_L */
-        return s->lcd_ch.src_f2_top & 0xffff;
+        s->src_f2_top &= 0xffff0000;
+        s->src_f2_top |= 0x0000ffff & value;
+        break;
 
     case 0x30c:	/* SYS_DMA_LCD_TOP_F2_U */
-        return s->lcd_ch.src_f2_top >> 16;
+        s->src_f2_top &= 0x0000ffff;
+        s->src_f2_top |= value << 16;
+        break;
 
     case 0x30e:	/* SYS_DMA_LCD_BOT_F2_L */
-        return s->lcd_ch.src_f2_bottom & 0xffff;
+        s->src_f2_bottom &= 0xffff0000;
+        s->src_f2_bottom |= 0x0000ffff & value;
+        break;
 
     case 0x310:	/* SYS_DMA_LCD_BOT_F2_U */
-        return s->lcd_ch.src_f2_bottom >> 16;
+        s->src_f2_bottom &= 0x0000ffff;
+        s->src_f2_bottom |= value << 16;
+        break;
 
-    case 0x400:	/* SYS_DMA_GCR */
-        return s->gcr;
+    default:
+        return 1;
     }
-
-    OMAP_BAD_REG(addr);
     return 0;
 }
 
-static void omap_dma_write(void *opaque, target_phys_addr_t addr,
-                uint32_t value)
+static int omap_dma_3_1_lcd_read(struct omap_dma_lcd_channel_s *s, int offset,
+                uint16_t *ret)
 {
-    struct omap_dma_s *s = (struct omap_dma_s *) opaque;
-    int reg, ch, offset = addr - s->base;
+    int i;
 
     switch (offset) {
-    case 0x000 ... 0x2fe:
-        reg = offset & 0x3f;
-        ch = (offset >> 6) & 0x0f;
-        if (omap_dma_ch_reg_write(s, ch, reg, value))
-            OMAP_RO_REG(addr);
-        break;
-
     case 0x300:	/* SYS_DMA_LCD_CTRL */
-        s->lcd_ch.src = (value & 0x40) ? imif : emiff;
-        s->lcd_ch.condition = 0;
-        /* Assume no bus errors and thus no BUS_ERROR irq bits.  */
-        s->lcd_ch.interrupts = (value >> 1) & 1;
-        s->lcd_ch.dual = value & 1;
+        i = s->condition;
+        s->condition = 0;
+        qemu_irq_lower(s->irq);
+        *ret = ((s->src == imif) << 6) | (i << 3) |
+                (s->interrupts << 1) | s->dual;
         break;
 
     case 0x302:	/* SYS_DMA_LCD_TOP_F1_L */
-        s->lcd_ch.src_f1_top &= 0xffff0000;
-        s->lcd_ch.src_f1_top |= 0x0000ffff & value;
+        *ret = s->src_f1_top & 0xffff;
         break;
 
     case 0x304:	/* SYS_DMA_LCD_TOP_F1_U */
-        s->lcd_ch.src_f1_top &= 0x0000ffff;
-        s->lcd_ch.src_f1_top |= value << 16;
+        *ret = s->src_f1_top >> 16;
         break;
 
     case 0x306:	/* SYS_DMA_LCD_BOT_F1_L */
-        s->lcd_ch.src_f1_bottom &= 0xffff0000;
-        s->lcd_ch.src_f1_bottom |= 0x0000ffff & value;
+        *ret = s->src_f1_bottom & 0xffff;
         break;
 
     case 0x308:	/* SYS_DMA_LCD_BOT_F1_U */
-        s->lcd_ch.src_f1_bottom &= 0x0000ffff;
-        s->lcd_ch.src_f1_bottom |= value << 16;
+        *ret = s->src_f1_bottom >> 16;
         break;
 
     case 0x30a:	/* SYS_DMA_LCD_TOP_F2_L */
-        s->lcd_ch.src_f2_top &= 0xffff0000;
-        s->lcd_ch.src_f2_top |= 0x0000ffff & value;
+        *ret = s->src_f2_top & 0xffff;
         break;
 
     case 0x30c:	/* SYS_DMA_LCD_TOP_F2_U */
-        s->lcd_ch.src_f2_top &= 0x0000ffff;
-        s->lcd_ch.src_f2_top |= value << 16;
+        *ret = s->src_f2_top >> 16;
         break;
 
     case 0x30e:	/* SYS_DMA_LCD_BOT_F2_L */
-        s->lcd_ch.src_f2_bottom &= 0xffff0000;
-        s->lcd_ch.src_f2_bottom |= 0x0000ffff & value;
+        *ret = s->src_f2_bottom & 0xffff;
         break;
 
     case 0x310:	/* SYS_DMA_LCD_BOT_F2_U */
-        s->lcd_ch.src_f2_bottom &= 0x0000ffff;
-        s->lcd_ch.src_f2_bottom |= value << 16;
+        *ret = s->src_f2_bottom >> 16;
         break;
 
+    default:
+        return 1;
+    }
+    return 0;
+}
+
+static int omap_dma_sys_write(struct omap_dma_s *s, int offset, uint16_t value)
+{
+    switch (offset) {
     case 0x400:	/* SYS_DMA_GCR */
-        s->gcr = value & 0x000c;
+        s->gcr = value;
+        break;
+
+    case 0x404:	/* DMA_GSCR */
+        if (value & 0x8)
+            omap_dma_disable_3_1_mapping(s);
+        else
+            omap_dma_enable_3_1_mapping(s);
+        break;
+
+    case 0x408:	/* DMA_GRST */
+        if (value & 0x1)
+            omap_dma_reset(s);
         break;
 
     default:
-        OMAP_BAD_REG(addr);
+        return 1;
     }
+    return 0;
+}
+
+static int omap_dma_sys_read(struct omap_dma_s *s, int offset,
+                uint16_t *ret)
+{
+    switch (offset) {
+    case 0x400:	/* SYS_DMA_GCR */
+        *ret = s->gcr;
+        break;
+
+    case 0x404:	/* DMA_GSCR */
+        *ret = s->omap_3_1_mapping_disabled << 3;
+        break;
+
+    case 0x408:	/* DMA_GRST */
+        *ret = 0;
+        break;
+
+    case 0x442:	/* DMA_HW_ID */
+    case 0x444:	/* DMA_PCh2_ID */
+    case 0x446:	/* DMA_PCh0_ID */
+    case 0x448:	/* DMA_PCh1_ID */
+    case 0x44a:	/* DMA_PChG_ID */
+    case 0x44c:	/* DMA_PChD_ID */
+        *ret = 1;
+        break;
+
+    case 0x44e:	/* DMA_CAPS_0_U */
+        *ret = (1 << 3) | /* Constant Fill Capacity */
+            (1 << 2);     /* Transparent BLT Capacity */
+        break;
+
+    case 0x450:	/* DMA_CAPS_0_L */
+    case 0x452:	/* DMA_CAPS_1_U */
+        *ret = 0;
+        break;
+
+    case 0x454:	/* DMA_CAPS_1_L */
+        *ret = (1 << 1); /* 1-bit palletized capability */
+        break;
+
+    case 0x456:	/* DMA_CAPS_2 */
+        *ret = (1 << 8) | /* SSDIC */
+            (1 << 7) |    /* DDIAC */
+            (1 << 6) |    /* DSIAC */
+            (1 << 5) |    /* DPIAC */
+            (1 << 4) |    /* DCAC  */
+            (1 << 3) |    /* SDIAC */
+            (1 << 2) |    /* SSIAC */
+            (1 << 1) |    /* SPIAC */
+            1;            /* SCAC  */
+        break;
+
+    case 0x458:	/* DMA_CAPS_3 */
+        *ret = (1 << 5) | /* CCC */
+            (1 << 4) |    /* IC  */
+            (1 << 3) |    /* ARC */
+            (1 << 2) |    /* AEC */
+            (1 << 1) |    /* FSC */
+            1;            /* ESC */
+        break;
+
+    case 0x45a:	/* DMA_CAPS_4 */
+        *ret = (1 << 6) | /* SSC  */
+            (1 << 5) |    /* BIC  */
+            (1 << 4) |    /* LFIC */
+            (1 << 3) |    /* FIC  */
+            (1 << 2) |    /* HFIC */
+            (1 << 1) |    /* EDIC */
+            1;            /* TOIC */
+        break;
+
+    case 0x460:	/* DMA_PCh2_SR */
+    case 0x480:	/* DMA_PCh0_SR */
+    case 0x482:	/* DMA_PCh1_SR */
+    case 0x4c0:	/* DMA_PChD_SR_0 */
+        printf("%s: Physical Channel Status Registers not implemented.\n",
+               __FUNCTION__);
+        *ret = 0xff;
+        break;
+
+    default:
+        return 1;
+    }
+    return 0;
+}
+
+static uint32_t omap_dma_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_dma_s *s = (struct omap_dma_s *) opaque;
+    int reg, ch, offset = addr - s->base;
+    uint16_t ret;
+
+    switch (offset) {
+    case 0x300 ... 0x3fe:
+        if (s->model == omap_dma_3_1 || !s->omap_3_1_mapping_disabled) {
+            if (omap_dma_3_1_lcd_read(&s->lcd_ch, offset, &ret))
+                break;
+            return ret;
+        }
+        /* Fall through. */
+    case 0x000 ... 0x2fe:
+        reg = offset & 0x3f;
+        ch = (offset >> 6) & 0x0f;
+        if (omap_dma_ch_reg_read(s, &s->ch[ch], reg, &ret))
+            break;
+        return ret;
+
+    case 0x404 ... 0x4fe:
+        if (s->model == omap_dma_3_1)
+            break;
+        /* Fall through. */
+    case 0x400:
+        if (omap_dma_sys_read(s, offset, &ret))
+            break;
+        return ret;
+
+    case 0xb00 ... 0xbfe:
+        if (s->model == omap_dma_3_2 && s->omap_3_1_mapping_disabled) {
+            if (omap_dma_3_2_lcd_read(&s->lcd_ch, offset, &ret))
+                break;
+            return ret;
+        }
+        break;
+    }
+
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_dma_write(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_dma_s *s = (struct omap_dma_s *) opaque;
+    int reg, ch, offset = addr - s->base;
+
+    switch (offset) {
+    case 0x300 ... 0x3fe:
+        if (s->model == omap_dma_3_1 || !s->omap_3_1_mapping_disabled) {
+            if (omap_dma_3_1_lcd_write(&s->lcd_ch, offset, value))
+                break;
+            return;
+        }
+        /* Fall through.  */
+    case 0x000 ... 0x2fe:
+        reg = offset & 0x3f;
+        ch = (offset >> 6) & 0x0f;
+        if (omap_dma_ch_reg_write(s, &s->ch[ch], reg, value))
+            break;
+        return;
+
+    case 0x404 ... 0x4fe:
+        if (s->model == omap_dma_3_1)
+            break;
+    case 0x400:
+        /* Fall through. */
+        if (omap_dma_sys_write(s, offset, value))
+            break;
+        return;
+
+    case 0xb00 ... 0xbfe:
+        if (s->model == omap_dma_3_2 && s->omap_3_1_mapping_disabled) {
+            if (omap_dma_3_2_lcd_write(&s->lcd_ch, offset, value))
+                break;
+            return;
+        }
+        break;
+    }
+
+    OMAP_BAD_REG(addr);
 }
 
 static CPUReadMemoryFunc *omap_dma_readfn[] = {
@@ -953,7 +1666,7 @@ static void omap_dma_request(void *opaque, int drq, int req)
     if (req) {
         if (~s->drq & (1 << drq)) {
             s->drq |= 1 << drq;
-            omap_dma_request_run(s, 0, drq);
+            omap_dma_process_request(s, drq);
         }
     } else
         s->drq &= ~(1 << drq);
@@ -964,7 +1677,8 @@ static void omap_dma_clk_update(void *opaque, int line, int on)
     struct omap_dma_s *s = (struct omap_dma_s *) opaque;
 
     if (on) {
-        s->delay = ticks_per_sec >> 5;
+        /* TODO: make a clever calculation */
+        s->delay = ticks_per_sec >> 8;
         if (s->run_count)
             qemu_mod_timer(s->tm, qemu_get_clock(vm_clock) + s->delay);
     } else {
@@ -973,37 +1687,33 @@ static void omap_dma_clk_update(void *opaque, int line, int on)
     }
 }
 
-static void omap_dma_reset(struct omap_dma_s *s)
-{
-    int i;
-
-    qemu_del_timer(s->tm);
-    s->gcr = 0x0004;
-    s->drq = 0x00000000;
-    s->run_count = 0;
-    s->lcd_ch.src = emiff;
-    s->lcd_ch.condition = 0;
-    s->lcd_ch.interrupts = 0;
-    s->lcd_ch.dual = 0;
-    memset(s->ch, 0, sizeof(s->ch));
-    for (i = 0; i < s->chans; i ++)
-        s->ch[i].interrupts = 0x0003;
-}
-
-struct omap_dma_s *omap_dma_init(target_phys_addr_t base,
-                qemu_irq pic[], struct omap_mpu_state_s *mpu, omap_clk clk)
+struct omap_dma_s *omap_dma_init(target_phys_addr_t base, qemu_irq *irqs,
+                qemu_irq lcd_irq, struct omap_mpu_state_s *mpu, omap_clk clk,
+                enum omap_dma_model model)
 {
-    int iomemtype;
+    int iomemtype, num_irqs, memsize, i;
     struct omap_dma_s *s = (struct omap_dma_s *)
             qemu_mallocz(sizeof(struct omap_dma_s));
 
-    s->ih = pic;
+    if (model == omap_dma_3_1) {
+        num_irqs = 6;
+        memsize = 0x800;
+    } else {
+        num_irqs = 16;
+        memsize = 0xc00;
+    }
     s->base = base;
-    s->chans = 9;
+    s->model = model;
     s->mpu = mpu;
     s->clk = clk;
-    s->lcd_ch.irq = pic[OMAP_INT_DMA_LCD];
+    s->lcd_ch.irq = lcd_irq;
     s->lcd_ch.mpu = mpu;
+    while (num_irqs --)
+        s->ch[num_irqs].irq = irqs[num_irqs];
+    for (i = 0; i < 3; i ++) {
+        s->ch[i].sibling = &s->ch[i + 6];
+        s->ch[i + 6].sibling = &s->ch[i];
+    }
     s->tm = qemu_new_timer(vm_clock, (QEMUTimerCB *) omap_dma_channel_run, s);
     omap_clk_adduser(s->clk, qemu_allocate_irqs(omap_dma_clk_update, s, 1)[0]);
     mpu->drq = qemu_allocate_irqs(omap_dma_request, s, 32);
@@ -1012,43 +1722,43 @@ struct omap_dma_s *omap_dma_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, omap_dma_readfn,
                     omap_dma_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    cpu_register_physical_memory(s->base, memsize, iomemtype);
 
     return s;
 }
 
 /* DMA ports */
-int omap_validate_emiff_addr(struct omap_mpu_state_s *s,
+static int omap_validate_emiff_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
     return addr >= OMAP_EMIFF_BASE && addr < OMAP_EMIFF_BASE + s->sdram_size;
 }
 
-int omap_validate_emifs_addr(struct omap_mpu_state_s *s,
+static int omap_validate_emifs_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
     return addr >= OMAP_EMIFS_BASE && addr < OMAP_EMIFF_BASE;
 }
 
-int omap_validate_imif_addr(struct omap_mpu_state_s *s,
+static int omap_validate_imif_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
     return addr >= OMAP_IMIF_BASE && addr < OMAP_IMIF_BASE + s->sram_size;
 }
 
-int omap_validate_tipb_addr(struct omap_mpu_state_s *s,
+static int omap_validate_tipb_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
     return addr >= 0xfffb0000 && addr < 0xffff0000;
 }
 
-int omap_validate_local_addr(struct omap_mpu_state_s *s,
+static int omap_validate_local_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
     return addr >= OMAP_LOCALBUS_BASE && addr < OMAP_LOCALBUS_BASE + 0x1000000;
 }
 
-int omap_validate_tipb_mpui_addr(struct omap_mpu_state_s *s,
+static int omap_validate_tipb_mpui_addr(struct omap_mpu_state_s *s,
                 target_phys_addr_t addr)
 {
     return addr >= 0xe1010000 && addr < 0xe1020004;
@@ -1095,9 +1805,24 @@ static inline void omap_timer_update(struct omap_mpu_timer_s *timer)
 
     if (timer->enable && timer->st && timer->rate) {
         timer->val = timer->reset_val;	/* Should skip this on clk enable */
-        expires = timer->time + muldiv64(timer->val << (timer->ptv + 1),
+        expires = muldiv64(timer->val << (timer->ptv + 1),
                         ticks_per_sec, timer->rate);
-        qemu_mod_timer(timer->timer, expires);
+
+        /* If timer expiry would be sooner than in about 1 ms and
+         * auto-reload isn't set, then fire immediately.  This is a hack
+         * to make systems like PalmOS run in acceptable time.  PalmOS
+         * sets the interval to a very low value and polls the status bit
+         * in a busy loop when it wants to sleep just a couple of CPU
+         * ticks.  */
+        if (expires > (ticks_per_sec >> 10) || timer->ar)
+            qemu_mod_timer(timer->timer, timer->time + expires);
+        else {
+            timer->val = 0;
+            timer->st = 0;
+            if (timer->it_ena)
+                /* Edge-triggered irq */
+                qemu_irq_pulse(timer->irq);
+        }
     } else
         qemu_del_timer(timer->timer);
 }
@@ -1113,7 +1838,8 @@ static void omap_timer_tick(void *opaque)
     }
 
     if (timer->it_ena)
-        qemu_irq_raise(timer->irq);
+        /* Edge-triggered irq */
+        qemu_irq_pulse(timer->irq);
     omap_timer_update(timer);
 }
 
@@ -1283,8 +2009,10 @@ static void omap_wd_timer_write(void *opaque, target_phys_addr_t addr,
         s->mode |= (value >> 15) & 1;
         if (s->last_wr == 0xf5) {
             if ((value & 0xff) == 0xa0) {
-                s->mode = 0;
-                omap_clk_put(s->timer.clk);
+                if (s->mode) {
+                    s->mode = 0;
+                    omap_clk_put(s->timer.clk);
+                }
             } else {
                 /* XXX: on T|E hardware somehow this has no effect,
                  * on Zire 71 it works as specified.  */
@@ -1359,7 +2087,7 @@ struct omap_32khz_timer_s {
 static uint32_t omap_os_timer_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_32khz_timer_s *s = (struct omap_32khz_timer_s *) opaque;
-    int offset = addr - s->timer.base;
+    int offset = addr & OMAP_MPUI_REG_MASK;
 
     switch (offset) {
     case 0x00:	/* TVR */
@@ -1382,7 +2110,7 @@ static void omap_os_timer_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_32khz_timer_s *s = (struct omap_32khz_timer_s *) opaque;
-    int offset = addr - s->timer.base;
+    int offset = addr & OMAP_MPUI_REG_MASK;
 
     switch (offset) {
     case 0x00:	/* TVR */
@@ -2175,23 +2903,23 @@ static uint32_t omap_tcmi_read(void *opaque, target_phys_addr_t addr)
     uint32_t ret;
 
     switch (offset) {
-    case 0xfffecc00:	/* IMIF_PRIO */
-    case 0xfffecc04:	/* EMIFS_PRIO */
-    case 0xfffecc08:	/* EMIFF_PRIO */
-    case 0xfffecc0c:	/* EMIFS_CONFIG */
-    case 0xfffecc10:	/* EMIFS_CS0_CONFIG */
-    case 0xfffecc14:	/* EMIFS_CS1_CONFIG */
-    case 0xfffecc18:	/* EMIFS_CS2_CONFIG */
-    case 0xfffecc1c:	/* EMIFS_CS3_CONFIG */
-    case 0xfffecc24:	/* EMIFF_MRS */
-    case 0xfffecc28:	/* TIMEOUT1 */
-    case 0xfffecc2c:	/* TIMEOUT2 */
-    case 0xfffecc30:	/* TIMEOUT3 */
-    case 0xfffecc3c:	/* EMIFF_SDRAM_CONFIG_2 */
-    case 0xfffecc40:	/* EMIFS_CFG_DYN_WAIT */
+    case 0x00:	/* IMIF_PRIO */
+    case 0x04:	/* EMIFS_PRIO */
+    case 0x08:	/* EMIFF_PRIO */
+    case 0x0c:	/* EMIFS_CONFIG */
+    case 0x10:	/* EMIFS_CS0_CONFIG */
+    case 0x14:	/* EMIFS_CS1_CONFIG */
+    case 0x18:	/* EMIFS_CS2_CONFIG */
+    case 0x1c:	/* EMIFS_CS3_CONFIG */
+    case 0x24:	/* EMIFF_MRS */
+    case 0x28:	/* TIMEOUT1 */
+    case 0x2c:	/* TIMEOUT2 */
+    case 0x30:	/* TIMEOUT3 */
+    case 0x3c:	/* EMIFF_SDRAM_CONFIG_2 */
+    case 0x40:	/* EMIFS_CFG_DYN_WAIT */
         return s->tcmi_regs[offset >> 2];
 
-    case 0xfffecc20:	/* EMIFF_SDRAM_CONFIG */
+    case 0x20:	/* EMIFF_SDRAM_CONFIG */
         ret = s->tcmi_regs[offset >> 2];
         s->tcmi_regs[offset >> 2] &= ~1; /* XXX: Clear SLRF on SDRAM access */
         /* XXX: We can try using the VGA_DIRTY flag for this */
@@ -2209,23 +2937,23 @@ static void omap_tcmi_write(void *opaque, target_phys_addr_t addr,
     int offset = addr - s->tcmi_base;
 
     switch (offset) {
-    case 0xfffecc00:	/* IMIF_PRIO */
-    case 0xfffecc04:	/* EMIFS_PRIO */
-    case 0xfffecc08:	/* EMIFF_PRIO */
-    case 0xfffecc10:	/* EMIFS_CS0_CONFIG */
-    case 0xfffecc14:	/* EMIFS_CS1_CONFIG */
-    case 0xfffecc18:	/* EMIFS_CS2_CONFIG */
-    case 0xfffecc1c:	/* EMIFS_CS3_CONFIG */
-    case 0xfffecc20:	/* EMIFF_SDRAM_CONFIG */
-    case 0xfffecc24:	/* EMIFF_MRS */
-    case 0xfffecc28:	/* TIMEOUT1 */
-    case 0xfffecc2c:	/* TIMEOUT2 */
-    case 0xfffecc30:	/* TIMEOUT3 */
-    case 0xfffecc3c:	/* EMIFF_SDRAM_CONFIG_2 */
-    case 0xfffecc40:	/* EMIFS_CFG_DYN_WAIT */
+    case 0x00:	/* IMIF_PRIO */
+    case 0x04:	/* EMIFS_PRIO */
+    case 0x08:	/* EMIFF_PRIO */
+    case 0x10:	/* EMIFS_CS0_CONFIG */
+    case 0x14:	/* EMIFS_CS1_CONFIG */
+    case 0x18:	/* EMIFS_CS2_CONFIG */
+    case 0x1c:	/* EMIFS_CS3_CONFIG */
+    case 0x20:	/* EMIFF_SDRAM_CONFIG */
+    case 0x24:	/* EMIFF_MRS */
+    case 0x28:	/* TIMEOUT1 */
+    case 0x2c:	/* TIMEOUT2 */
+    case 0x30:	/* TIMEOUT3 */
+    case 0x3c:	/* EMIFF_SDRAM_CONFIG_2 */
+    case 0x40:	/* EMIFS_CFG_DYN_WAIT */
         s->tcmi_regs[offset >> 2] = value;
         break;
-    case 0xfffecc0c:	/* EMIFS_CONFIG */
+    case 0x0c:	/* EMIFS_CONFIG */
         s->tcmi_regs[offset >> 2] = (value & 0xf) | (1 << 4);
         break;
 
@@ -2399,7 +3127,7 @@ static uint32_t omap_clkm_read(void *opaque, target_phys_addr_t addr)
         return s->clkm.arm_rstct2;
 
     case 0x18:	/* ARM_SYSST */
-        return (s->clkm.clocking_scheme < 11) | s->clkm.cold_start;
+        return (s->clkm.clocking_scheme << 11) | s->clkm.cold_start;
 
     case 0x1c:	/* ARM_CKOUT1 */
         return s->clkm.arm_ckout1;
@@ -2678,7 +3406,7 @@ static uint32_t omap_clkdsp_read(void *opaque, target_phys_addr_t addr)
         return s->clkm.dsp_rstct2;
 
     case 0x18:	/* DSP_SYSST */
-        return (s->clkm.clocking_scheme < 11) | s->clkm.cold_start |
+        return (s->clkm.clocking_scheme << 11) | s->clkm.cold_start |
                 (s->env->halted << 6);	/* Quite useless... */
     }
 
@@ -2754,9 +3482,9 @@ static void omap_clkm_reset(struct omap_mpu_state_s *s)
     s->clkm.clocking_scheme = 0;
     omap_clkm_ckctl_update(s, ~0, 0x3000);
     s->clkm.arm_ckctl = 0x3000;
-    omap_clkm_idlect1_update(s, s->clkm.arm_idlect1 & 0x0400, 0x0400);
+    omap_clkm_idlect1_update(s, s->clkm.arm_idlect1 ^ 0x0400, 0x0400);
     s->clkm.arm_idlect1 = 0x0400;
-    omap_clkm_idlect2_update(s, s->clkm.arm_idlect2 & 0x0100, 0x0100);
+    omap_clkm_idlect2_update(s, s->clkm.arm_idlect2 ^ 0x0100, 0x0100);
     s->clkm.arm_idlect2 = 0x0100;
     s->clkm.arm_ewupct = 0x003f;
     s->clkm.arm_rstct1 = 0x0000;
@@ -2780,19 +3508,1988 @@ static void omap_clkm_init(target_phys_addr_t mpu_base,
 
     s->clkm.mpu_base = mpu_base;
     s->clkm.dsp_base = dsp_base;
-    s->clkm.cold_start = 0x3a;
+    s->clkm.arm_idlect1 = 0x03ff;
+    s->clkm.arm_idlect2 = 0x0100;
+    s->clkm.dsp_idlect1 = 0x0002;
     omap_clkm_reset(s);
+    s->clkm.cold_start = 0x3a;
 
     cpu_register_physical_memory(s->clkm.mpu_base, 0x100, iomemtype[0]);
     cpu_register_physical_memory(s->clkm.dsp_base, 0x1000, iomemtype[1]);
 }
 
+/* MPU I/O */
+struct omap_mpuio_s {
+    target_phys_addr_t base;
+    qemu_irq irq;
+    qemu_irq kbd_irq;
+    qemu_irq *in;
+    qemu_irq handler[16];
+    qemu_irq wakeup;
+
+    uint16_t inputs;
+    uint16_t outputs;
+    uint16_t dir;
+    uint16_t edge;
+    uint16_t mask;
+    uint16_t ints;
+
+    uint16_t debounce;
+    uint16_t latch;
+    uint8_t event;
+
+    uint8_t buttons[5];
+    uint8_t row_latch;
+    uint8_t cols;
+    int kbd_mask;
+    int clk;
+};
+
+static void omap_mpuio_set(void *opaque, int line, int level)
+{
+    struct omap_mpuio_s *s = (struct omap_mpuio_s *) opaque;
+    uint16_t prev = s->inputs;
+
+    if (level)
+        s->inputs |= 1 << line;
+    else
+        s->inputs &= ~(1 << line);
+
+    if (((1 << line) & s->dir & ~s->mask) && s->clk) {
+        if ((s->edge & s->inputs & ~prev) | (~s->edge & ~s->inputs & prev)) {
+            s->ints |= 1 << line;
+            qemu_irq_raise(s->irq);
+            /* TODO: wakeup */
+        }
+        if ((s->event & (1 << 0)) &&		/* SET_GPIO_EVENT_MODE */
+                (s->event >> 1) == line)	/* PIN_SELECT */
+            s->latch = s->inputs;
+    }
+}
+
+static void omap_mpuio_kbd_update(struct omap_mpuio_s *s)
+{
+    int i;
+    uint8_t *row, rows = 0, cols = ~s->cols;
+
+    for (row = s->buttons + 4, i = 1 << 4; i; row --, i >>= 1)
+        if (*row & cols)
+            rows |= i;
+
+    qemu_set_irq(s->kbd_irq, rows && !s->kbd_mask && s->clk);
+    s->row_latch = ~rows;
+}
+
+static uint32_t omap_mpuio_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_mpuio_s *s = (struct omap_mpuio_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+    uint16_t ret;
+
+    switch (offset) {
+    case 0x00:	/* INPUT_LATCH */
+        return s->inputs;
+
+    case 0x04:	/* OUTPUT_REG */
+        return s->outputs;
+
+    case 0x08:	/* IO_CNTL */
+        return s->dir;
+
+    case 0x10:	/* KBR_LATCH */
+        return s->row_latch;
+
+    case 0x14:	/* KBC_REG */
+        return s->cols;
+
+    case 0x18:	/* GPIO_EVENT_MODE_REG */
+        return s->event;
+
+    case 0x1c:	/* GPIO_INT_EDGE_REG */
+        return s->edge;
+
+    case 0x20:	/* KBD_INT */
+        return (~s->row_latch & 0x1f) && !s->kbd_mask;
+
+    case 0x24:	/* GPIO_INT */
+        ret = s->ints;
+        s->ints &= s->mask;
+        if (ret)
+            qemu_irq_lower(s->irq);
+        return ret;
+
+    case 0x28:	/* KBD_MASKIT */
+        return s->kbd_mask;
+
+    case 0x2c:	/* GPIO_MASKIT */
+        return s->mask;
+
+    case 0x30:	/* GPIO_DEBOUNCING_REG */
+        return s->debounce;
+
+    case 0x34:	/* GPIO_LATCH_REG */
+        return s->latch;
+    }
+
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_mpuio_write(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_mpuio_s *s = (struct omap_mpuio_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+    uint16_t diff;
+    int ln;
+
+    switch (offset) {
+    case 0x04:	/* OUTPUT_REG */
+        diff = (s->outputs ^ value) & ~s->dir;
+        s->outputs = value;
+        while ((ln = ffs(diff))) {
+            ln --;
+            if (s->handler[ln])
+                qemu_set_irq(s->handler[ln], (value >> ln) & 1);
+            diff &= ~(1 << ln);
+        }
+        break;
+
+    case 0x08:	/* IO_CNTL */
+        diff = s->outputs & (s->dir ^ value);
+        s->dir = value;
+
+        value = s->outputs & ~s->dir;
+        while ((ln = ffs(diff))) {
+            ln --;
+            if (s->handler[ln])
+                qemu_set_irq(s->handler[ln], (value >> ln) & 1);
+            diff &= ~(1 << ln);
+        }
+        break;
+
+    case 0x14:	/* KBC_REG */
+        s->cols = value;
+        omap_mpuio_kbd_update(s);
+        break;
+
+    case 0x18:	/* GPIO_EVENT_MODE_REG */
+        s->event = value & 0x1f;
+        break;
+
+    case 0x1c:	/* GPIO_INT_EDGE_REG */
+        s->edge = value;
+        break;
+
+    case 0x28:	/* KBD_MASKIT */
+        s->kbd_mask = value & 1;
+        omap_mpuio_kbd_update(s);
+        break;
+
+    case 0x2c:	/* GPIO_MASKIT */
+        s->mask = value;
+        break;
+
+    case 0x30:	/* GPIO_DEBOUNCING_REG */
+        s->debounce = value & 0x1ff;
+        break;
+
+    case 0x00:	/* INPUT_LATCH */
+    case 0x10:	/* KBR_LATCH */
+    case 0x20:	/* KBD_INT */
+    case 0x24:	/* GPIO_INT */
+    case 0x34:	/* GPIO_LATCH_REG */
+        OMAP_RO_REG(addr);
+        return;
+
+    default:
+        OMAP_BAD_REG(addr);
+        return;
+    }
+}
+
+static CPUReadMemoryFunc *omap_mpuio_readfn[] = {
+    omap_badwidth_read16,
+    omap_mpuio_read,
+    omap_badwidth_read16,
+};
+
+static CPUWriteMemoryFunc *omap_mpuio_writefn[] = {
+    omap_badwidth_write16,
+    omap_mpuio_write,
+    omap_badwidth_write16,
+};
+
+static void omap_mpuio_reset(struct omap_mpuio_s *s)
+{
+    s->inputs = 0;
+    s->outputs = 0;
+    s->dir = ~0;
+    s->event = 0;
+    s->edge = 0;
+    s->kbd_mask = 0;
+    s->mask = 0;
+    s->debounce = 0;
+    s->latch = 0;
+    s->ints = 0;
+    s->row_latch = 0x1f;
+    s->clk = 1;
+}
+
+static void omap_mpuio_onoff(void *opaque, int line, int on)
+{
+    struct omap_mpuio_s *s = (struct omap_mpuio_s *) opaque;
+
+    s->clk = on;
+    if (on)
+        omap_mpuio_kbd_update(s);
+}
+
+struct omap_mpuio_s *omap_mpuio_init(target_phys_addr_t base,
+                qemu_irq kbd_int, qemu_irq gpio_int, qemu_irq wakeup,
+                omap_clk clk)
+{
+    int iomemtype;
+    struct omap_mpuio_s *s = (struct omap_mpuio_s *)
+            qemu_mallocz(sizeof(struct omap_mpuio_s));
+
+    s->base = base;
+    s->irq = gpio_int;
+    s->kbd_irq = kbd_int;
+    s->wakeup = wakeup;
+    s->in = qemu_allocate_irqs(omap_mpuio_set, s, 16);
+    omap_mpuio_reset(s);
+
+    iomemtype = cpu_register_io_memory(0, omap_mpuio_readfn,
+                    omap_mpuio_writefn, s);
+    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+
+    omap_clk_adduser(clk, qemu_allocate_irqs(omap_mpuio_onoff, s, 1)[0]);
+
+    return s;
+}
+
+qemu_irq *omap_mpuio_in_get(struct omap_mpuio_s *s)
+{
+    return s->in;
+}
+
+void omap_mpuio_out_set(struct omap_mpuio_s *s, int line, qemu_irq handler)
+{
+    if (line >= 16 || line < 0)
+        cpu_abort(cpu_single_env, "%s: No GPIO line %i\n", __FUNCTION__, line);
+    s->handler[line] = handler;
+}
+
+void omap_mpuio_key(struct omap_mpuio_s *s, int row, int col, int down)
+{
+    if (row >= 5 || row < 0)
+        cpu_abort(cpu_single_env, "%s: No key %i-%i\n",
+                        __FUNCTION__, col, row);
+
+    if (down)
+        s->buttons[row] |= 1 << col;
+    else
+        s->buttons[row] &= ~(1 << col);
+
+    omap_mpuio_kbd_update(s);
+}
+
+/* General-Purpose I/O */
+struct omap_gpio_s {
+    target_phys_addr_t base;
+    qemu_irq irq;
+    qemu_irq *in;
+    qemu_irq handler[16];
+
+    uint16_t inputs;
+    uint16_t outputs;
+    uint16_t dir;
+    uint16_t edge;
+    uint16_t mask;
+    uint16_t ints;
+    uint16_t pins;
+};
+
+static void omap_gpio_set(void *opaque, int line, int level)
+{
+    struct omap_gpio_s *s = (struct omap_gpio_s *) opaque;
+    uint16_t prev = s->inputs;
+
+    if (level)
+        s->inputs |= 1 << line;
+    else
+        s->inputs &= ~(1 << line);
+
+    if (((s->edge & s->inputs & ~prev) | (~s->edge & ~s->inputs & prev)) &
+                    (1 << line) & s->dir & ~s->mask) {
+        s->ints |= 1 << line;
+        qemu_irq_raise(s->irq);
+    }
+}
+
+static uint32_t omap_gpio_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_gpio_s *s = (struct omap_gpio_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    switch (offset) {
+    case 0x00:	/* DATA_INPUT */
+        return s->inputs & s->pins;
+
+    case 0x04:	/* DATA_OUTPUT */
+        return s->outputs;
+
+    case 0x08:	/* DIRECTION_CONTROL */
+        return s->dir;
+
+    case 0x0c:	/* INTERRUPT_CONTROL */
+        return s->edge;
+
+    case 0x10:	/* INTERRUPT_MASK */
+        return s->mask;
+
+    case 0x14:	/* INTERRUPT_STATUS */
+        return s->ints;
+
+    case 0x18:	/* PIN_CONTROL (not in OMAP310) */
+        OMAP_BAD_REG(addr);
+        return s->pins;
+    }
+
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_gpio_write(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_gpio_s *s = (struct omap_gpio_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+    uint16_t diff;
+    int ln;
+
+    switch (offset) {
+    case 0x00:	/* DATA_INPUT */
+        OMAP_RO_REG(addr);
+        return;
+
+    case 0x04:	/* DATA_OUTPUT */
+        diff = (s->outputs ^ value) & ~s->dir;
+        s->outputs = value;
+        while ((ln = ffs(diff))) {
+            ln --;
+            if (s->handler[ln])
+                qemu_set_irq(s->handler[ln], (value >> ln) & 1);
+            diff &= ~(1 << ln);
+        }
+        break;
+
+    case 0x08:	/* DIRECTION_CONTROL */
+        diff = s->outputs & (s->dir ^ value);
+        s->dir = value;
+
+        value = s->outputs & ~s->dir;
+        while ((ln = ffs(diff))) {
+            ln --;
+            if (s->handler[ln])
+                qemu_set_irq(s->handler[ln], (value >> ln) & 1);
+            diff &= ~(1 << ln);
+        }
+        break;
+
+    case 0x0c:	/* INTERRUPT_CONTROL */
+        s->edge = value;
+        break;
+
+    case 0x10:	/* INTERRUPT_MASK */
+        s->mask = value;
+        break;
+
+    case 0x14:	/* INTERRUPT_STATUS */
+        s->ints &= ~value;
+        if (!s->ints)
+            qemu_irq_lower(s->irq);
+        break;
+
+    case 0x18:	/* PIN_CONTROL (not in OMAP310 TRM) */
+        OMAP_BAD_REG(addr);
+        s->pins = value;
+        break;
+
+    default:
+        OMAP_BAD_REG(addr);
+        return;
+    }
+}
+
+/* *Some* sources say the memory region is 32-bit.  */
+static CPUReadMemoryFunc *omap_gpio_readfn[] = {
+    omap_badwidth_read16,
+    omap_gpio_read,
+    omap_badwidth_read16,
+};
+
+static CPUWriteMemoryFunc *omap_gpio_writefn[] = {
+    omap_badwidth_write16,
+    omap_gpio_write,
+    omap_badwidth_write16,
+};
+
+static void omap_gpio_reset(struct omap_gpio_s *s)
+{
+    s->inputs = 0;
+    s->outputs = ~0;
+    s->dir = ~0;
+    s->edge = ~0;
+    s->mask = ~0;
+    s->ints = 0;
+    s->pins = ~0;
+}
+
+struct omap_gpio_s *omap_gpio_init(target_phys_addr_t base,
+                qemu_irq irq, omap_clk clk)
+{
+    int iomemtype;
+    struct omap_gpio_s *s = (struct omap_gpio_s *)
+            qemu_mallocz(sizeof(struct omap_gpio_s));
+
+    s->base = base;
+    s->irq = irq;
+    s->in = qemu_allocate_irqs(omap_gpio_set, s, 16);
+    omap_gpio_reset(s);
+
+    iomemtype = cpu_register_io_memory(0, omap_gpio_readfn,
+                    omap_gpio_writefn, s);
+    cpu_register_physical_memory(s->base, 0x1000, iomemtype);
+
+    return s;
+}
+
+qemu_irq *omap_gpio_in_get(struct omap_gpio_s *s)
+{
+    return s->in;
+}
+
+void omap_gpio_out_set(struct omap_gpio_s *s, int line, qemu_irq handler)
+{
+    if (line >= 16 || line < 0)
+        cpu_abort(cpu_single_env, "%s: No GPIO line %i\n", __FUNCTION__, line);
+    s->handler[line] = handler;
+}
+
+/* MicroWire Interface */
+struct omap_uwire_s {
+    target_phys_addr_t base;
+    qemu_irq txirq;
+    qemu_irq rxirq;
+    qemu_irq txdrq;
+
+    uint16_t txbuf;
+    uint16_t rxbuf;
+    uint16_t control;
+    uint16_t setup[5];
+
+    struct uwire_slave_s *chip[4];
+};
+
+static void omap_uwire_transfer_start(struct omap_uwire_s *s)
+{
+    int chipselect = (s->control >> 10) & 3;		/* INDEX */
+    struct uwire_slave_s *slave = s->chip[chipselect];
+
+    if ((s->control >> 5) & 0x1f) {			/* NB_BITS_WR */
+        if (s->control & (1 << 12))			/* CS_CMD */
+            if (slave && slave->send)
+                slave->send(slave->opaque,
+                                s->txbuf >> (16 - ((s->control >> 5) & 0x1f)));
+        s->control &= ~(1 << 14);			/* CSRB */
+        /* TODO: depending on s->setup[4] bits [1:0] assert an IRQ or
+         * a DRQ.  When is the level IRQ supposed to be reset?  */
+    }
+
+    if ((s->control >> 0) & 0x1f) {			/* NB_BITS_RD */
+        if (s->control & (1 << 12))			/* CS_CMD */
+            if (slave && slave->receive)
+                s->rxbuf = slave->receive(slave->opaque);
+        s->control |= 1 << 15;				/* RDRB */
+        /* TODO: depending on s->setup[4] bits [1:0] assert an IRQ or
+         * a DRQ.  When is the level IRQ supposed to be reset?  */
+    }
+}
+
+static uint32_t omap_uwire_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_uwire_s *s = (struct omap_uwire_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    switch (offset) {
+    case 0x00:	/* RDR */
+        s->control &= ~(1 << 15);			/* RDRB */
+        return s->rxbuf;
+
+    case 0x04:	/* CSR */
+        return s->control;
+
+    case 0x08:	/* SR1 */
+        return s->setup[0];
+    case 0x0c:	/* SR2 */
+        return s->setup[1];
+    case 0x10:	/* SR3 */
+        return s->setup[2];
+    case 0x14:	/* SR4 */
+        return s->setup[3];
+    case 0x18:	/* SR5 */
+        return s->setup[4];
+    }
+
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_uwire_write(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_uwire_s *s = (struct omap_uwire_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    switch (offset) {
+    case 0x00:	/* TDR */
+        s->txbuf = value;				/* TD */
+        if ((s->setup[4] & (1 << 2)) &&			/* AUTO_TX_EN */
+                        ((s->setup[4] & (1 << 3)) ||	/* CS_TOGGLE_TX_EN */
+                         (s->control & (1 << 12)))) {	/* CS_CMD */
+            s->control |= 1 << 14;			/* CSRB */
+            omap_uwire_transfer_start(s);
+        }
+        break;
+
+    case 0x04:	/* CSR */
+        s->control = value & 0x1fff;
+        if (value & (1 << 13))				/* START */
+            omap_uwire_transfer_start(s);
+        break;
+
+    case 0x08:	/* SR1 */
+        s->setup[0] = value & 0x003f;
+        break;
+
+    case 0x0c:	/* SR2 */
+        s->setup[1] = value & 0x0fc0;
+        break;
+
+    case 0x10:	/* SR3 */
+        s->setup[2] = value & 0x0003;
+        break;
+
+    case 0x14:	/* SR4 */
+        s->setup[3] = value & 0x0001;
+        break;
+
+    case 0x18:	/* SR5 */
+        s->setup[4] = value & 0x000f;
+        break;
+
+    default:
+        OMAP_BAD_REG(addr);
+        return;
+    }
+}
+
+static CPUReadMemoryFunc *omap_uwire_readfn[] = {
+    omap_badwidth_read16,
+    omap_uwire_read,
+    omap_badwidth_read16,
+};
+
+static CPUWriteMemoryFunc *omap_uwire_writefn[] = {
+    omap_badwidth_write16,
+    omap_uwire_write,
+    omap_badwidth_write16,
+};
+
+static void omap_uwire_reset(struct omap_uwire_s *s)
+{
+    s->control = 0;
+    s->setup[0] = 0;
+    s->setup[1] = 0;
+    s->setup[2] = 0;
+    s->setup[3] = 0;
+    s->setup[4] = 0;
+}
+
+struct omap_uwire_s *omap_uwire_init(target_phys_addr_t base,
+                qemu_irq *irq, qemu_irq dma, omap_clk clk)
+{
+    int iomemtype;
+    struct omap_uwire_s *s = (struct omap_uwire_s *)
+            qemu_mallocz(sizeof(struct omap_uwire_s));
+
+    s->base = base;
+    s->txirq = irq[0];
+    s->rxirq = irq[1];
+    s->txdrq = dma;
+    omap_uwire_reset(s);
+
+    iomemtype = cpu_register_io_memory(0, omap_uwire_readfn,
+                    omap_uwire_writefn, s);
+    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+
+    return s;
+}
+
+void omap_uwire_attach(struct omap_uwire_s *s,
+                struct uwire_slave_s *slave, int chipselect)
+{
+    if (chipselect < 0 || chipselect > 3)
+        cpu_abort(cpu_single_env, "%s: Bad chipselect %i\n", __FUNCTION__,
+                        chipselect);
+
+    s->chip[chipselect] = slave;
+}
+
+/* Pseudonoise Pulse-Width Light Modulator */
+static void omap_pwl_update(struct omap_mpu_state_s *s)
+{
+    int output = (s->pwl.clk && s->pwl.enable) ? s->pwl.level : 0;
+
+    if (output != s->pwl.output) {
+        s->pwl.output = output;
+        printf("%s: Backlight now at %i/256\n", __FUNCTION__, output);
+    }
+}
+
+static uint32_t omap_pwl_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    switch (offset) {
+    case 0x00:	/* PWL_LEVEL */
+        return s->pwl.level;
+    case 0x04:	/* PWL_CTRL */
+        return s->pwl.enable;
+    }
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_pwl_write(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    switch (offset) {
+    case 0x00:	/* PWL_LEVEL */
+        s->pwl.level = value;
+        omap_pwl_update(s);
+        break;
+    case 0x04:	/* PWL_CTRL */
+        s->pwl.enable = value & 1;
+        omap_pwl_update(s);
+        break;
+    default:
+        OMAP_BAD_REG(addr);
+        return;
+    }
+}
+
+static CPUReadMemoryFunc *omap_pwl_readfn[] = {
+    omap_pwl_read,
+    omap_badwidth_read8,
+    omap_badwidth_read8,
+};
+
+static CPUWriteMemoryFunc *omap_pwl_writefn[] = {
+    omap_pwl_write,
+    omap_badwidth_write8,
+    omap_badwidth_write8,
+};
+
+static void omap_pwl_reset(struct omap_mpu_state_s *s)
+{
+    s->pwl.output = 0;
+    s->pwl.level = 0;
+    s->pwl.enable = 0;
+    s->pwl.clk = 1;
+    omap_pwl_update(s);
+}
+
+static void omap_pwl_clk_update(void *opaque, int line, int on)
+{
+    struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
+
+    s->pwl.clk = on;
+    omap_pwl_update(s);
+}
+
+static void omap_pwl_init(target_phys_addr_t base, struct omap_mpu_state_s *s,
+                omap_clk clk)
+{
+    int iomemtype;
+
+    omap_pwl_reset(s);
+
+    iomemtype = cpu_register_io_memory(0, omap_pwl_readfn,
+                    omap_pwl_writefn, s);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
+
+    omap_clk_adduser(clk, qemu_allocate_irqs(omap_pwl_clk_update, s, 1)[0]);
+}
+
+/* Pulse-Width Tone module */
+static uint32_t omap_pwt_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    switch (offset) {
+    case 0x00:	/* FRC */
+        return s->pwt.frc;
+    case 0x04:	/* VCR */
+        return s->pwt.vrc;
+    case 0x08:	/* GCR */
+        return s->pwt.gcr;
+    }
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_pwt_write(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    switch (offset) {
+    case 0x00:	/* FRC */
+        s->pwt.frc = value & 0x3f;
+        break;
+    case 0x04:	/* VRC */
+        if ((value ^ s->pwt.vrc) & 1) {
+            if (value & 1)
+                printf("%s: %iHz buzz on\n", __FUNCTION__, (int)
+                                /* 1.5 MHz from a 12-MHz or 13-MHz PWT_CLK */
+                                ((omap_clk_getrate(s->pwt.clk) >> 3) /
+                                 /* Pre-multiplexer divider */
+                                 ((s->pwt.gcr & 2) ? 1 : 154) /
+                                 /* Octave multiplexer */
+                                 (2 << (value & 3)) *
+                                 /* 101/107 divider */
+                                 ((value & (1 << 2)) ? 101 : 107) *
+                                 /*  49/55 divider */
+                                 ((value & (1 << 3)) ?  49 : 55) *
+                                 /*  50/63 divider */
+                                 ((value & (1 << 4)) ?  50 : 63) *
+                                 /*  80/127 divider */
+                                 ((value & (1 << 5)) ?  80 : 127) /
+                                 (107 * 55 * 63 * 127)));
+            else
+                printf("%s: silence!\n", __FUNCTION__);
+        }
+        s->pwt.vrc = value & 0x7f;
+        break;
+    case 0x08:	/* GCR */
+        s->pwt.gcr = value & 3;
+        break;
+    default:
+        OMAP_BAD_REG(addr);
+        return;
+    }
+}
+
+static CPUReadMemoryFunc *omap_pwt_readfn[] = {
+    omap_pwt_read,
+    omap_badwidth_read8,
+    omap_badwidth_read8,
+};
+
+static CPUWriteMemoryFunc *omap_pwt_writefn[] = {
+    omap_pwt_write,
+    omap_badwidth_write8,
+    omap_badwidth_write8,
+};
+
+static void omap_pwt_reset(struct omap_mpu_state_s *s)
+{
+    s->pwt.frc = 0;
+    s->pwt.vrc = 0;
+    s->pwt.gcr = 0;
+}
+
+static void omap_pwt_init(target_phys_addr_t base, struct omap_mpu_state_s *s,
+                omap_clk clk)
+{
+    int iomemtype;
+
+    s->pwt.clk = clk;
+    omap_pwt_reset(s);
+
+    iomemtype = cpu_register_io_memory(0, omap_pwt_readfn,
+                    omap_pwt_writefn, s);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
+}
+
+/* Real-time Clock module */
+struct omap_rtc_s {
+    target_phys_addr_t base;
+    qemu_irq irq;
+    qemu_irq alarm;
+    QEMUTimer *clk;
+
+    uint8_t interrupts;
+    uint8_t status;
+    int16_t comp_reg;
+    int running;
+    int pm_am;
+    int auto_comp;
+    int round;
+    struct tm *(*convert)(const time_t *timep, struct tm *result);
+    struct tm alarm_tm;
+    time_t alarm_ti;
+
+    struct tm current_tm;
+    time_t ti;
+    uint64_t tick;
+};
+
+static void omap_rtc_interrupts_update(struct omap_rtc_s *s)
+{
+    /* s->alarm is level-triggered */
+    qemu_set_irq(s->alarm, (s->status >> 6) & 1);
+}
+
+static void omap_rtc_alarm_update(struct omap_rtc_s *s)
+{
+    s->alarm_ti = mktime(&s->alarm_tm);
+    if (s->alarm_ti == -1)
+        printf("%s: conversion failed\n", __FUNCTION__);
+}
+
+static inline uint8_t omap_rtc_bcd(int num)
+{
+    return ((num / 10) << 4) | (num % 10);
+}
+
+static inline int omap_rtc_bin(uint8_t num)
+{
+    return (num & 15) + 10 * (num >> 4);
+}
+
+static uint32_t omap_rtc_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_rtc_s *s = (struct omap_rtc_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+    uint8_t i;
+
+    switch (offset) {
+    case 0x00:	/* SECONDS_REG */
+        return omap_rtc_bcd(s->current_tm.tm_sec);
+
+    case 0x04:	/* MINUTES_REG */
+        return omap_rtc_bcd(s->current_tm.tm_min);
+
+    case 0x08:	/* HOURS_REG */
+        if (s->pm_am)
+            return ((s->current_tm.tm_hour > 11) << 7) |
+                    omap_rtc_bcd(((s->current_tm.tm_hour - 1) % 12) + 1);
+        else
+            return omap_rtc_bcd(s->current_tm.tm_hour);
+
+    case 0x0c:	/* DAYS_REG */
+        return omap_rtc_bcd(s->current_tm.tm_mday);
+
+    case 0x10:	/* MONTHS_REG */
+        return omap_rtc_bcd(s->current_tm.tm_mon + 1);
+
+    case 0x14:	/* YEARS_REG */
+        return omap_rtc_bcd(s->current_tm.tm_year % 100);
+
+    case 0x18:	/* WEEK_REG */
+        return s->current_tm.tm_wday;
+
+    case 0x20:	/* ALARM_SECONDS_REG */
+        return omap_rtc_bcd(s->alarm_tm.tm_sec);
+
+    case 0x24:	/* ALARM_MINUTES_REG */
+        return omap_rtc_bcd(s->alarm_tm.tm_min);
+
+    case 0x28:	/* ALARM_HOURS_REG */
+        if (s->pm_am)
+            return ((s->alarm_tm.tm_hour > 11) << 7) |
+                    omap_rtc_bcd(((s->alarm_tm.tm_hour - 1) % 12) + 1);
+        else
+            return omap_rtc_bcd(s->alarm_tm.tm_hour);
+
+    case 0x2c:	/* ALARM_DAYS_REG */
+        return omap_rtc_bcd(s->alarm_tm.tm_mday);
+
+    case 0x30:	/* ALARM_MONTHS_REG */
+        return omap_rtc_bcd(s->alarm_tm.tm_mon + 1);
+
+    case 0x34:	/* ALARM_YEARS_REG */
+        return omap_rtc_bcd(s->alarm_tm.tm_year % 100);
+
+    case 0x40:	/* RTC_CTRL_REG */
+        return (s->pm_am << 3) | (s->auto_comp << 2) |
+                (s->round << 1) | s->running;
+
+    case 0x44:	/* RTC_STATUS_REG */
+        i = s->status;
+        s->status &= ~0x3d;
+        return i;
+
+    case 0x48:	/* RTC_INTERRUPTS_REG */
+        return s->interrupts;
+
+    case 0x4c:	/* RTC_COMP_LSB_REG */
+        return ((uint16_t) s->comp_reg) & 0xff;
+
+    case 0x50:	/* RTC_COMP_MSB_REG */
+        return ((uint16_t) s->comp_reg) >> 8;
+    }
+
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_rtc_write(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_rtc_s *s = (struct omap_rtc_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+    struct tm new_tm;
+    time_t ti[2];
+
+    switch (offset) {
+    case 0x00:	/* SECONDS_REG */
+#if ALMDEBUG
+        printf("RTC SEC_REG <-- %02x\n", value);
+#endif
+        s->ti -= s->current_tm.tm_sec;
+        s->ti += omap_rtc_bin(value);
+        return;
+
+    case 0x04:	/* MINUTES_REG */
+#if ALMDEBUG
+        printf("RTC MIN_REG <-- %02x\n", value);
+#endif
+        s->ti -= s->current_tm.tm_min * 60;
+        s->ti += omap_rtc_bin(value) * 60;
+        return;
+
+    case 0x08:	/* HOURS_REG */
+#if ALMDEBUG
+        printf("RTC HRS_REG <-- %02x\n", value);
+#endif
+        s->ti -= s->current_tm.tm_hour * 3600;
+        if (s->pm_am) {
+            s->ti += (omap_rtc_bin(value & 0x3f) & 12) * 3600;
+            s->ti += ((value >> 7) & 1) * 43200;
+        } else
+            s->ti += omap_rtc_bin(value & 0x3f) * 3600;
+        return;
+
+    case 0x0c:	/* DAYS_REG */
+#if ALMDEBUG
+        printf("RTC DAY_REG <-- %02x\n", value);
+#endif
+        s->ti -= s->current_tm.tm_mday * 86400;
+        s->ti += omap_rtc_bin(value) * 86400;
+        return;
+
+    case 0x10:	/* MONTHS_REG */
+#if ALMDEBUG
+        printf("RTC MTH_REG <-- %02x\n", value);
+#endif
+        memcpy(&new_tm, &s->current_tm, sizeof(new_tm));
+        new_tm.tm_mon = omap_rtc_bin(value);
+        ti[0] = mktime(&s->current_tm);
+        ti[1] = mktime(&new_tm);
+
+        if (ti[0] != -1 && ti[1] != -1) {
+            s->ti -= ti[0];
+            s->ti += ti[1];
+        } else {
+            /* A less accurate version */
+            s->ti -= s->current_tm.tm_mon * 2592000;
+            s->ti += omap_rtc_bin(value) * 2592000;
+        }
+        return;
+
+    case 0x14:	/* YEARS_REG */
+#if ALMDEBUG
+        printf("RTC YRS_REG <-- %02x\n", value);
+#endif
+        memcpy(&new_tm, &s->current_tm, sizeof(new_tm));
+        new_tm.tm_year += omap_rtc_bin(value) - (new_tm.tm_year % 100);
+        ti[0] = mktime(&s->current_tm);
+        ti[1] = mktime(&new_tm);
+
+        if (ti[0] != -1 && ti[1] != -1) {
+            s->ti -= ti[0];
+            s->ti += ti[1];
+        } else {
+            /* A less accurate version */
+            s->ti -= (s->current_tm.tm_year % 100) * 31536000;
+            s->ti += omap_rtc_bin(value) * 31536000;
+        }
+        return;
+
+    case 0x18:	/* WEEK_REG */
+        return;	/* Ignored */
+
+    case 0x20:	/* ALARM_SECONDS_REG */
+#if ALMDEBUG
+        printf("ALM SEC_REG <-- %02x\n", value);
+#endif
+        s->alarm_tm.tm_sec = omap_rtc_bin(value);
+        omap_rtc_alarm_update(s);
+        return;
+
+    case 0x24:	/* ALARM_MINUTES_REG */
+#if ALMDEBUG
+        printf("ALM MIN_REG <-- %02x\n", value);
+#endif
+        s->alarm_tm.tm_min = omap_rtc_bin(value);
+        omap_rtc_alarm_update(s);
+        return;
+
+    case 0x28:	/* ALARM_HOURS_REG */
+#if ALMDEBUG
+        printf("ALM HRS_REG <-- %02x\n", value);
+#endif
+        if (s->pm_am)
+            s->alarm_tm.tm_hour =
+                    ((omap_rtc_bin(value & 0x3f)) % 12) +
+                    ((value >> 7) & 1) * 12;
+        else
+            s->alarm_tm.tm_hour = omap_rtc_bin(value);
+        omap_rtc_alarm_update(s);
+        return;
+
+    case 0x2c:	/* ALARM_DAYS_REG */
+#if ALMDEBUG
+        printf("ALM DAY_REG <-- %02x\n", value);
+#endif
+        s->alarm_tm.tm_mday = omap_rtc_bin(value);
+        omap_rtc_alarm_update(s);
+        return;
+
+    case 0x30:	/* ALARM_MONTHS_REG */
+#if ALMDEBUG
+        printf("ALM MON_REG <-- %02x\n", value);
+#endif
+        s->alarm_tm.tm_mon = omap_rtc_bin(value);
+        omap_rtc_alarm_update(s);
+        return;
+
+    case 0x34:	/* ALARM_YEARS_REG */
+#if ALMDEBUG
+        printf("ALM YRS_REG <-- %02x\n", value);
+#endif
+        s->alarm_tm.tm_year = omap_rtc_bin(value);
+        omap_rtc_alarm_update(s);
+        return;
+
+    case 0x40:	/* RTC_CTRL_REG */
+#if ALMDEBUG
+        printf("RTC CONTROL <-- %02x\n", value);
+#endif
+        s->pm_am = (value >> 3) & 1;
+        s->auto_comp = (value >> 2) & 1;
+        s->round = (value >> 1) & 1;
+        s->running = value & 1;
+        s->status &= 0xfd;
+        s->status |= s->running << 1;
+        return;
+
+    case 0x44:	/* RTC_STATUS_REG */
+#if ALMDEBUG
+        printf("RTC STATUSL <-- %02x\n", value);
+#endif
+        s->status &= ~((value & 0xc0) ^ 0x80);
+        omap_rtc_interrupts_update(s);
+        return;
+
+    case 0x48:	/* RTC_INTERRUPTS_REG */
+#if ALMDEBUG
+        printf("RTC INTRS <-- %02x\n", value);
+#endif
+        s->interrupts = value;
+        return;
+
+    case 0x4c:	/* RTC_COMP_LSB_REG */
+#if ALMDEBUG
+        printf("RTC COMPLSB <-- %02x\n", value);
+#endif
+        s->comp_reg &= 0xff00;
+        s->comp_reg |= 0x00ff & value;
+        return;
+
+    case 0x50:	/* RTC_COMP_MSB_REG */
+#if ALMDEBUG
+        printf("RTC COMPMSB <-- %02x\n", value);
+#endif
+        s->comp_reg &= 0x00ff;
+        s->comp_reg |= 0xff00 & (value << 8);
+        return;
+
+    default:
+        OMAP_BAD_REG(addr);
+        return;
+    }
+}
+
+static CPUReadMemoryFunc *omap_rtc_readfn[] = {
+    omap_rtc_read,
+    omap_badwidth_read8,
+    omap_badwidth_read8,
+};
+
+static CPUWriteMemoryFunc *omap_rtc_writefn[] = {
+    omap_rtc_write,
+    omap_badwidth_write8,
+    omap_badwidth_write8,
+};
+
+static void omap_rtc_tick(void *opaque)
+{
+    struct omap_rtc_s *s = opaque;
+
+    if (s->round) {
+        /* Round to nearest full minute.  */
+        if (s->current_tm.tm_sec < 30)
+            s->ti -= s->current_tm.tm_sec;
+        else
+            s->ti += 60 - s->current_tm.tm_sec;
+
+        s->round = 0;
+    }
+
+    localtime_r(&s->ti, &s->current_tm);
+
+    if ((s->interrupts & 0x08) && s->ti == s->alarm_ti) {
+        s->status |= 0x40;
+        omap_rtc_interrupts_update(s);
+    }
+
+    if (s->interrupts & 0x04)
+        switch (s->interrupts & 3) {
+        case 0:
+            s->status |= 0x04;
+            qemu_irq_pulse(s->irq);
+            break;
+        case 1:
+            if (s->current_tm.tm_sec)
+                break;
+            s->status |= 0x08;
+            qemu_irq_pulse(s->irq);
+            break;
+        case 2:
+            if (s->current_tm.tm_sec || s->current_tm.tm_min)
+                break;
+            s->status |= 0x10;
+            qemu_irq_pulse(s->irq);
+            break;
+        case 3:
+            if (s->current_tm.tm_sec ||
+                            s->current_tm.tm_min || s->current_tm.tm_hour)
+                break;
+            s->status |= 0x20;
+            qemu_irq_pulse(s->irq);
+            break;
+        }
+
+    /* Move on */
+    if (s->running)
+        s->ti ++;
+    s->tick += 1000;
+
+    /*
+     * Every full hour add a rough approximation of the compensation
+     * register to the 32kHz Timer (which drives the RTC) value. 
+     */
+    if (s->auto_comp && !s->current_tm.tm_sec && !s->current_tm.tm_min)
+        s->tick += s->comp_reg * 1000 / 32768;
+
+    qemu_mod_timer(s->clk, s->tick);
+}
+
+static void omap_rtc_reset(struct omap_rtc_s *s)
+{
+    s->interrupts = 0;
+    s->comp_reg = 0;
+    s->running = 0;
+    s->pm_am = 0;
+    s->auto_comp = 0;
+    s->round = 0;
+    s->tick = qemu_get_clock(rt_clock);
+    memset(&s->alarm_tm, 0, sizeof(s->alarm_tm));
+    s->alarm_tm.tm_mday = 0x01;
+    s->status = 1 << 7;
+    time(&s->ti);
+    s->ti = mktime(s->convert(&s->ti, &s->current_tm));
+
+    omap_rtc_alarm_update(s);
+    omap_rtc_tick(s);
+}
+
+struct omap_rtc_s *omap_rtc_init(target_phys_addr_t base,
+                qemu_irq *irq, omap_clk clk)
+{
+    int iomemtype;
+    struct omap_rtc_s *s = (struct omap_rtc_s *)
+            qemu_mallocz(sizeof(struct omap_rtc_s));
+
+    s->base = base;
+    s->irq = irq[0];
+    s->alarm = irq[1];
+    s->clk = qemu_new_timer(rt_clock, omap_rtc_tick, s);
+    s->convert = rtc_utc ? gmtime_r : localtime_r;
+
+    omap_rtc_reset(s);
+
+    iomemtype = cpu_register_io_memory(0, omap_rtc_readfn,
+                    omap_rtc_writefn, s);
+    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+
+    return s;
+}
+
+/* Multi-channel Buffered Serial Port interfaces */
+struct omap_mcbsp_s {
+    target_phys_addr_t base;
+    qemu_irq txirq;
+    qemu_irq rxirq;
+    qemu_irq txdrq;
+    qemu_irq rxdrq;
+
+    uint16_t spcr[2];
+    uint16_t rcr[2];
+    uint16_t xcr[2];
+    uint16_t srgr[2];
+    uint16_t mcr[2];
+    uint16_t pcr;
+    uint16_t rcer[8];
+    uint16_t xcer[8];
+    int tx_rate;
+    int rx_rate;
+    int tx_req;
+    int rx_req;
+
+    struct i2s_codec_s *codec;
+    QEMUTimer *source_timer;
+    QEMUTimer *sink_timer;
+};
+
+static void omap_mcbsp_intr_update(struct omap_mcbsp_s *s)
+{
+    int irq;
+
+    switch ((s->spcr[0] >> 4) & 3) {			/* RINTM */
+    case 0:
+        irq = (s->spcr[0] >> 1) & 1;			/* RRDY */
+        break;
+    case 3:
+        irq = (s->spcr[0] >> 3) & 1;			/* RSYNCERR */
+        break;
+    default:
+        irq = 0;
+        break;
+    }
+
+    if (irq)
+        qemu_irq_pulse(s->rxirq);
+
+    switch ((s->spcr[1] >> 4) & 3) {			/* XINTM */
+    case 0:
+        irq = (s->spcr[1] >> 1) & 1;			/* XRDY */
+        break;
+    case 3:
+        irq = (s->spcr[1] >> 3) & 1;			/* XSYNCERR */
+        break;
+    default:
+        irq = 0;
+        break;
+    }
+
+    if (irq)
+        qemu_irq_pulse(s->txirq);
+}
+
+static void omap_mcbsp_rx_newdata(struct omap_mcbsp_s *s)
+{
+    if ((s->spcr[0] >> 1) & 1)				/* RRDY */
+        s->spcr[0] |= 1 << 2;				/* RFULL */
+    s->spcr[0] |= 1 << 1;				/* RRDY */
+    qemu_irq_raise(s->rxdrq);
+    omap_mcbsp_intr_update(s);
+}
+
+static void omap_mcbsp_source_tick(void *opaque)
+{
+    struct omap_mcbsp_s *s = (struct omap_mcbsp_s *) opaque;
+    static const int bps[8] = { 0, 1, 1, 2, 2, 2, -255, -255 };
+
+    if (!s->rx_rate)
+        return;
+    if (s->rx_req)
+        printf("%s: Rx FIFO overrun\n", __FUNCTION__);
+
+    s->rx_req = s->rx_rate << bps[(s->rcr[0] >> 5) & 7];
+
+    omap_mcbsp_rx_newdata(s);
+    qemu_mod_timer(s->source_timer, qemu_get_clock(vm_clock) + ticks_per_sec);
+}
+
+static void omap_mcbsp_rx_start(struct omap_mcbsp_s *s)
+{
+    if (!s->codec || !s->codec->rts)
+        omap_mcbsp_source_tick(s);
+    else if (s->codec->in.len) {
+        s->rx_req = s->codec->in.len;
+        omap_mcbsp_rx_newdata(s);
+    }
+}
+
+static void omap_mcbsp_rx_stop(struct omap_mcbsp_s *s)
+{
+    qemu_del_timer(s->source_timer);
+}
+
+static void omap_mcbsp_rx_done(struct omap_mcbsp_s *s)
+{
+    s->spcr[0] &= ~(1 << 1);				/* RRDY */
+    qemu_irq_lower(s->rxdrq);
+    omap_mcbsp_intr_update(s);
+}
+
+static void omap_mcbsp_tx_newdata(struct omap_mcbsp_s *s)
+{
+    s->spcr[1] |= 1 << 1;				/* XRDY */
+    qemu_irq_raise(s->txdrq);
+    omap_mcbsp_intr_update(s);
+}
+
+static void omap_mcbsp_sink_tick(void *opaque)
+{
+    struct omap_mcbsp_s *s = (struct omap_mcbsp_s *) opaque;
+    static const int bps[8] = { 0, 1, 1, 2, 2, 2, -255, -255 };
+
+    if (!s->tx_rate)
+        return;
+    if (s->tx_req)
+        printf("%s: Tx FIFO underrun\n", __FUNCTION__);
+
+    s->tx_req = s->tx_rate << bps[(s->xcr[0] >> 5) & 7];
+
+    omap_mcbsp_tx_newdata(s);
+    qemu_mod_timer(s->sink_timer, qemu_get_clock(vm_clock) + ticks_per_sec);
+}
+
+static void omap_mcbsp_tx_start(struct omap_mcbsp_s *s)
+{
+    if (!s->codec || !s->codec->cts)
+        omap_mcbsp_sink_tick(s);
+    else if (s->codec->out.size) {
+        s->tx_req = s->codec->out.size;
+        omap_mcbsp_tx_newdata(s);
+    }
+}
+
+static void omap_mcbsp_tx_done(struct omap_mcbsp_s *s)
+{
+    s->spcr[1] &= ~(1 << 1);				/* XRDY */
+    qemu_irq_lower(s->txdrq);
+    omap_mcbsp_intr_update(s);
+    if (s->codec && s->codec->cts)
+        s->codec->tx_swallow(s->codec->opaque);
+}
+
+static void omap_mcbsp_tx_stop(struct omap_mcbsp_s *s)
+{
+    s->tx_req = 0;
+    omap_mcbsp_tx_done(s);
+    qemu_del_timer(s->sink_timer);
+}
+
+static void omap_mcbsp_req_update(struct omap_mcbsp_s *s)
+{
+    int prev_rx_rate, prev_tx_rate;
+    int rx_rate = 0, tx_rate = 0;
+    int cpu_rate = 1500000;	/* XXX */
+
+    /* TODO: check CLKSTP bit */
+    if (s->spcr[1] & (1 << 6)) {			/* GRST */
+        if (s->spcr[0] & (1 << 0)) {			/* RRST */
+            if ((s->srgr[1] & (1 << 13)) &&		/* CLKSM */
+                            (s->pcr & (1 << 8))) {	/* CLKRM */
+                if (~s->pcr & (1 << 7))			/* SCLKME */
+                    rx_rate = cpu_rate /
+                            ((s->srgr[0] & 0xff) + 1);	/* CLKGDV */
+            } else
+                if (s->codec)
+                    rx_rate = s->codec->rx_rate;
+        }
+
+        if (s->spcr[1] & (1 << 0)) {			/* XRST */
+            if ((s->srgr[1] & (1 << 13)) &&		/* CLKSM */
+                            (s->pcr & (1 << 9))) {	/* CLKXM */
+                if (~s->pcr & (1 << 7))			/* SCLKME */
+                    tx_rate = cpu_rate /
+                            ((s->srgr[0] & 0xff) + 1);	/* CLKGDV */
+            } else
+                if (s->codec)
+                    tx_rate = s->codec->tx_rate;
+        }
+    }
+    prev_tx_rate = s->tx_rate;
+    prev_rx_rate = s->rx_rate;
+    s->tx_rate = tx_rate;
+    s->rx_rate = rx_rate;
+
+    if (s->codec)
+        s->codec->set_rate(s->codec->opaque, rx_rate, tx_rate);
+
+    if (!prev_tx_rate && tx_rate)
+        omap_mcbsp_tx_start(s);
+    else if (s->tx_rate && !tx_rate)
+        omap_mcbsp_tx_stop(s);
+
+    if (!prev_rx_rate && rx_rate)
+        omap_mcbsp_rx_start(s);
+    else if (prev_tx_rate && !tx_rate)
+        omap_mcbsp_rx_stop(s);
+}
+
+static uint32_t omap_mcbsp_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_mcbsp_s *s = (struct omap_mcbsp_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+    uint16_t ret;
+
+    switch (offset) {
+    case 0x00:	/* DRR2 */
+        if (((s->rcr[0] >> 5) & 7) < 3)			/* RWDLEN1 */
+            return 0x0000;
+        /* Fall through.  */
+    case 0x02:	/* DRR1 */
+        if (s->rx_req < 2) {
+            printf("%s: Rx FIFO underrun\n", __FUNCTION__);
+            omap_mcbsp_rx_done(s);
+        } else {
+            s->tx_req -= 2;
+            if (s->codec && s->codec->in.len >= 2) {
+                ret = s->codec->in.fifo[s->codec->in.start ++] << 8;
+                ret |= s->codec->in.fifo[s->codec->in.start ++];
+                s->codec->in.len -= 2;
+            } else
+                ret = 0x0000;
+            if (!s->tx_req)
+                omap_mcbsp_rx_done(s);
+            return ret;
+        }
+        return 0x0000;
+
+    case 0x04:	/* DXR2 */
+    case 0x06:	/* DXR1 */
+        return 0x0000;
+
+    case 0x08:	/* SPCR2 */
+        return s->spcr[1];
+    case 0x0a:	/* SPCR1 */
+        return s->spcr[0];
+    case 0x0c:	/* RCR2 */
+        return s->rcr[1];
+    case 0x0e:	/* RCR1 */
+        return s->rcr[0];
+    case 0x10:	/* XCR2 */
+        return s->xcr[1];
+    case 0x12:	/* XCR1 */
+        return s->xcr[0];
+    case 0x14:	/* SRGR2 */
+        return s->srgr[1];
+    case 0x16:	/* SRGR1 */
+        return s->srgr[0];
+    case 0x18:	/* MCR2 */
+        return s->mcr[1];
+    case 0x1a:	/* MCR1 */
+        return s->mcr[0];
+    case 0x1c:	/* RCERA */
+        return s->rcer[0];
+    case 0x1e:	/* RCERB */
+        return s->rcer[1];
+    case 0x20:	/* XCERA */
+        return s->xcer[0];
+    case 0x22:	/* XCERB */
+        return s->xcer[1];
+    case 0x24:	/* PCR0 */
+        return s->pcr;
+    case 0x26:	/* RCERC */
+        return s->rcer[2];
+    case 0x28:	/* RCERD */
+        return s->rcer[3];
+    case 0x2a:	/* XCERC */
+        return s->xcer[2];
+    case 0x2c:	/* XCERD */
+        return s->xcer[3];
+    case 0x2e:	/* RCERE */
+        return s->rcer[4];
+    case 0x30:	/* RCERF */
+        return s->rcer[5];
+    case 0x32:	/* XCERE */
+        return s->xcer[4];
+    case 0x34:	/* XCERF */
+        return s->xcer[5];
+    case 0x36:	/* RCERG */
+        return s->rcer[6];
+    case 0x38:	/* RCERH */
+        return s->rcer[7];
+    case 0x3a:	/* XCERG */
+        return s->xcer[6];
+    case 0x3c:	/* XCERH */
+        return s->xcer[7];
+    }
+
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_mcbsp_writeh(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_mcbsp_s *s = (struct omap_mcbsp_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    switch (offset) {
+    case 0x00:	/* DRR2 */
+    case 0x02:	/* DRR1 */
+        OMAP_RO_REG(addr);
+        return;
+
+    case 0x04:	/* DXR2 */
+        if (((s->xcr[0] >> 5) & 7) < 3)			/* XWDLEN1 */
+            return;
+        /* Fall through.  */
+    case 0x06:	/* DXR1 */
+        if (s->tx_req > 1) {
+            s->tx_req -= 2;
+            if (s->codec && s->codec->cts) {
+                s->codec->out.fifo[s->codec->out.len ++] = (value >> 8) & 0xff;
+                s->codec->out.fifo[s->codec->out.len ++] = (value >> 0) & 0xff;
+            }
+            if (s->tx_req < 2)
+                omap_mcbsp_tx_done(s);
+        } else
+            printf("%s: Tx FIFO overrun\n", __FUNCTION__);
+        return;
+
+    case 0x08:	/* SPCR2 */
+        s->spcr[1] &= 0x0002;
+        s->spcr[1] |= 0x03f9 & value;
+        s->spcr[1] |= 0x0004 & (value << 2);		/* XEMPTY := XRST */
+        if (~value & 1)					/* XRST */
+            s->spcr[1] &= ~6;
+        omap_mcbsp_req_update(s);
+        return;
+    case 0x0a:	/* SPCR1 */
+        s->spcr[0] &= 0x0006;
+        s->spcr[0] |= 0xf8f9 & value;
+        if (value & (1 << 15))				/* DLB */
+            printf("%s: Digital Loopback mode enable attempt\n", __FUNCTION__);
+        if (~value & 1) {				/* RRST */
+            s->spcr[0] &= ~6;
+            s->rx_req = 0;
+            omap_mcbsp_rx_done(s);
+        }
+        omap_mcbsp_req_update(s);
+        return;
+
+    case 0x0c:	/* RCR2 */
+        s->rcr[1] = value & 0xffff;
+        return;
+    case 0x0e:	/* RCR1 */
+        s->rcr[0] = value & 0x7fe0;
+        return;
+    case 0x10:	/* XCR2 */
+        s->xcr[1] = value & 0xffff;
+        return;
+    case 0x12:	/* XCR1 */
+        s->xcr[0] = value & 0x7fe0;
+        return;
+    case 0x14:	/* SRGR2 */
+        s->srgr[1] = value & 0xffff;
+        omap_mcbsp_req_update(s);
+        return;
+    case 0x16:	/* SRGR1 */
+        s->srgr[0] = value & 0xffff;
+        omap_mcbsp_req_update(s);
+        return;
+    case 0x18:	/* MCR2 */
+        s->mcr[1] = value & 0x03e3;
+        if (value & 3)					/* XMCM */
+            printf("%s: Tx channel selection mode enable attempt\n",
+                            __FUNCTION__);
+        return;
+    case 0x1a:	/* MCR1 */
+        s->mcr[0] = value & 0x03e1;
+        if (value & 1)					/* RMCM */
+            printf("%s: Rx channel selection mode enable attempt\n",
+                            __FUNCTION__);
+        return;
+    case 0x1c:	/* RCERA */
+        s->rcer[0] = value & 0xffff;
+        return;
+    case 0x1e:	/* RCERB */
+        s->rcer[1] = value & 0xffff;
+        return;
+    case 0x20:	/* XCERA */
+        s->xcer[0] = value & 0xffff;
+        return;
+    case 0x22:	/* XCERB */
+        s->xcer[1] = value & 0xffff;
+        return;
+    case 0x24:	/* PCR0 */
+        s->pcr = value & 0x7faf;
+        return;
+    case 0x26:	/* RCERC */
+        s->rcer[2] = value & 0xffff;
+        return;
+    case 0x28:	/* RCERD */
+        s->rcer[3] = value & 0xffff;
+        return;
+    case 0x2a:	/* XCERC */
+        s->xcer[2] = value & 0xffff;
+        return;
+    case 0x2c:	/* XCERD */
+        s->xcer[3] = value & 0xffff;
+        return;
+    case 0x2e:	/* RCERE */
+        s->rcer[4] = value & 0xffff;
+        return;
+    case 0x30:	/* RCERF */
+        s->rcer[5] = value & 0xffff;
+        return;
+    case 0x32:	/* XCERE */
+        s->xcer[4] = value & 0xffff;
+        return;
+    case 0x34:	/* XCERF */
+        s->xcer[5] = value & 0xffff;
+        return;
+    case 0x36:	/* RCERG */
+        s->rcer[6] = value & 0xffff;
+        return;
+    case 0x38:	/* RCERH */
+        s->rcer[7] = value & 0xffff;
+        return;
+    case 0x3a:	/* XCERG */
+        s->xcer[6] = value & 0xffff;
+        return;
+    case 0x3c:	/* XCERH */
+        s->xcer[7] = value & 0xffff;
+        return;
+    }
+
+    OMAP_BAD_REG(addr);
+}
+
+static void omap_mcbsp_writew(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_mcbsp_s *s = (struct omap_mcbsp_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    if (offset == 0x04) {				/* DXR */
+        if (((s->xcr[0] >> 5) & 7) < 3)			/* XWDLEN1 */
+            return;
+        if (s->tx_req > 3) {
+            s->tx_req -= 4;
+            if (s->codec && s->codec->cts) {
+                s->codec->out.fifo[s->codec->out.len ++] =
+                        (value >> 24) & 0xff;
+                s->codec->out.fifo[s->codec->out.len ++] =
+                        (value >> 16) & 0xff;
+                s->codec->out.fifo[s->codec->out.len ++] =
+                        (value >> 8) & 0xff;
+                s->codec->out.fifo[s->codec->out.len ++] =
+                        (value >> 0) & 0xff;
+            }
+            if (s->tx_req < 4)
+                omap_mcbsp_tx_done(s);
+        } else
+            printf("%s: Tx FIFO overrun\n", __FUNCTION__);
+        return;
+    }
+
+    omap_badwidth_write16(opaque, addr, value);
+}
+
+static CPUReadMemoryFunc *omap_mcbsp_readfn[] = {
+    omap_badwidth_read16,
+    omap_mcbsp_read,
+    omap_badwidth_read16,
+};
+
+static CPUWriteMemoryFunc *omap_mcbsp_writefn[] = {
+    omap_badwidth_write16,
+    omap_mcbsp_writeh,
+    omap_mcbsp_writew,
+};
+
+static void omap_mcbsp_reset(struct omap_mcbsp_s *s)
+{
+    memset(&s->spcr, 0, sizeof(s->spcr));
+    memset(&s->rcr, 0, sizeof(s->rcr));
+    memset(&s->xcr, 0, sizeof(s->xcr));
+    s->srgr[0] = 0x0001;
+    s->srgr[1] = 0x2000;
+    memset(&s->mcr, 0, sizeof(s->mcr));
+    memset(&s->pcr, 0, sizeof(s->pcr));
+    memset(&s->rcer, 0, sizeof(s->rcer));
+    memset(&s->xcer, 0, sizeof(s->xcer));
+    s->tx_req = 0;
+    s->rx_req = 0;
+    s->tx_rate = 0;
+    s->rx_rate = 0;
+    qemu_del_timer(s->source_timer);
+    qemu_del_timer(s->sink_timer);
+}
+
+struct omap_mcbsp_s *omap_mcbsp_init(target_phys_addr_t base,
+                qemu_irq *irq, qemu_irq *dma, omap_clk clk)
+{
+    int iomemtype;
+    struct omap_mcbsp_s *s = (struct omap_mcbsp_s *)
+            qemu_mallocz(sizeof(struct omap_mcbsp_s));
+
+    s->base = base;
+    s->txirq = irq[0];
+    s->rxirq = irq[1];
+    s->txdrq = dma[0];
+    s->rxdrq = dma[1];
+    s->sink_timer = qemu_new_timer(vm_clock, omap_mcbsp_sink_tick, s);
+    s->source_timer = qemu_new_timer(vm_clock, omap_mcbsp_source_tick, s);
+    omap_mcbsp_reset(s);
+
+    iomemtype = cpu_register_io_memory(0, omap_mcbsp_readfn,
+                    omap_mcbsp_writefn, s);
+    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+
+    return s;
+}
+
+static void omap_mcbsp_i2s_swallow(void *opaque, int line, int level)
+{
+    struct omap_mcbsp_s *s = (struct omap_mcbsp_s *) opaque;
+
+    if (s->rx_rate) {
+        s->rx_req = s->codec->in.len;
+        omap_mcbsp_rx_newdata(s);
+    }
+}
+
+static void omap_mcbsp_i2s_start(void *opaque, int line, int level)
+{
+    struct omap_mcbsp_s *s = (struct omap_mcbsp_s *) opaque;
+
+    if (s->tx_rate) {
+        s->tx_req = s->codec->out.size;
+        omap_mcbsp_tx_newdata(s);
+    }
+}
+
+void omap_mcbsp_i2s_attach(struct omap_mcbsp_s *s, struct i2s_codec_s *slave)
+{
+    s->codec = slave;
+    slave->rx_swallow = qemu_allocate_irqs(omap_mcbsp_i2s_swallow, s, 1)[0];
+    slave->tx_start = qemu_allocate_irqs(omap_mcbsp_i2s_start, s, 1)[0];
+}
+
+/* LED Pulse Generators */
+struct omap_lpg_s {
+    target_phys_addr_t base;
+    QEMUTimer *tm;
+
+    uint8_t control;
+    uint8_t power;
+    int64_t on;
+    int64_t period;
+    int clk;
+    int cycle;
+};
+
+static void omap_lpg_tick(void *opaque)
+{
+    struct omap_lpg_s *s = opaque;
+
+    if (s->cycle)
+        qemu_mod_timer(s->tm, qemu_get_clock(rt_clock) + s->period - s->on);
+    else
+        qemu_mod_timer(s->tm, qemu_get_clock(rt_clock) + s->on);
+
+    s->cycle = !s->cycle;
+    printf("%s: LED is %s\n", __FUNCTION__, s->cycle ? "on" : "off");
+}
+
+static void omap_lpg_update(struct omap_lpg_s *s)
+{
+    int64_t on, period = 1, ticks = 1000;
+    static const int per[8] = { 1, 2, 4, 8, 12, 16, 20, 24 };
+
+    if (~s->control & (1 << 6))					/* LPGRES */
+        on = 0;
+    else if (s->control & (1 << 7))				/* PERM_ON */
+        on = period;
+    else {
+        period = muldiv64(ticks, per[s->control & 7],		/* PERCTRL */
+                        256 / 32);
+        on = (s->clk && s->power) ? muldiv64(ticks,
+                        per[(s->control >> 3) & 7], 256) : 0;	/* ONCTRL */
+    }
+
+    qemu_del_timer(s->tm);
+    if (on == period && s->on < s->period)
+        printf("%s: LED is on\n", __FUNCTION__);
+    else if (on == 0 && s->on)
+        printf("%s: LED is off\n", __FUNCTION__);
+    else if (on && (on != s->on || period != s->period)) {
+        s->cycle = 0;
+        s->on = on;
+        s->period = period;
+        omap_lpg_tick(s);
+        return;
+    }
+
+    s->on = on;
+    s->period = period;
+}
+
+static void omap_lpg_reset(struct omap_lpg_s *s)
+{
+    s->control = 0x00;
+    s->power = 0x00;
+    s->clk = 1;
+    omap_lpg_update(s);
+}
+
+static uint32_t omap_lpg_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_lpg_s *s = (struct omap_lpg_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    switch (offset) {
+    case 0x00:	/* LCR */
+        return s->control;
+
+    case 0x04:	/* PMR */
+        return s->power;
+    }
+
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_lpg_write(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_lpg_s *s = (struct omap_lpg_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+
+    switch (offset) {
+    case 0x00:	/* LCR */
+        if (~value & (1 << 6))					/* LPGRES */
+            omap_lpg_reset(s);
+        s->control = value & 0xff;
+        omap_lpg_update(s);
+        return;
+
+    case 0x04:	/* PMR */
+        s->power = value & 0x01;
+        omap_lpg_update(s);
+        return;
+
+    default:
+        OMAP_BAD_REG(addr);
+        return;
+    }
+}
+
+static CPUReadMemoryFunc *omap_lpg_readfn[] = {
+    omap_lpg_read,
+    omap_badwidth_read8,
+    omap_badwidth_read8,
+};
+
+static CPUWriteMemoryFunc *omap_lpg_writefn[] = {
+    omap_lpg_write,
+    omap_badwidth_write8,
+    omap_badwidth_write8,
+};
+
+static void omap_lpg_clk_update(void *opaque, int line, int on)
+{
+    struct omap_lpg_s *s = (struct omap_lpg_s *) opaque;
+
+    s->clk = on;
+    omap_lpg_update(s);
+}
+
+struct omap_lpg_s *omap_lpg_init(target_phys_addr_t base, omap_clk clk)
+{
+    int iomemtype;
+    struct omap_lpg_s *s = (struct omap_lpg_s *)
+            qemu_mallocz(sizeof(struct omap_lpg_s));
+
+    s->base = base;
+    s->tm = qemu_new_timer(rt_clock, omap_lpg_tick, s);
+
+    omap_lpg_reset(s);
+
+    iomemtype = cpu_register_io_memory(0, omap_lpg_readfn,
+                    omap_lpg_writefn, s);
+    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+
+    omap_clk_adduser(clk, qemu_allocate_irqs(omap_lpg_clk_update, s, 1)[0]);
+
+    return s;
+}
+
+/* MPUI Peripheral Bridge configuration */
+static uint32_t omap_mpui_io_read(void *opaque, target_phys_addr_t addr)
+{
+    if (addr == OMAP_MPUI_BASE)	/* CMR */
+        return 0xfe4d;
+
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static CPUReadMemoryFunc *omap_mpui_io_readfn[] = {
+    omap_badwidth_read16,
+    omap_mpui_io_read,
+    omap_badwidth_read16,
+};
+
+static CPUWriteMemoryFunc *omap_mpui_io_writefn[] = {
+    omap_badwidth_write16,
+    omap_badwidth_write16,
+    omap_badwidth_write16,
+};
+
+static void omap_setup_mpui_io(struct omap_mpu_state_s *mpu)
+{
+    int iomemtype = cpu_register_io_memory(0, omap_mpui_io_readfn,
+                    omap_mpui_io_writefn, mpu);
+    cpu_register_physical_memory(OMAP_MPUI_BASE, 0x7fff, iomemtype);
+}
+
 /* General chip reset */
 static void omap_mpu_reset(void *opaque)
 {
     struct omap_mpu_state_s *mpu = (struct omap_mpu_state_s *) opaque;
 
-    omap_clkm_reset(mpu);
     omap_inth_reset(mpu->ih[0]);
     omap_inth_reset(mpu->ih[1]);
     omap_dma_reset(mpu->dma);
@@ -2810,34 +5507,124 @@ static void omap_mpu_reset(void *opaque)
     omap_dpll_reset(&mpu->dpll[0]);
     omap_dpll_reset(&mpu->dpll[1]);
     omap_dpll_reset(&mpu->dpll[2]);
-    omap_uart_reset(mpu->uart1);
-    omap_uart_reset(mpu->uart2);
-    omap_uart_reset(mpu->uart3);
+    omap_uart_reset(mpu->uart[0]);
+    omap_uart_reset(mpu->uart[1]);
+    omap_uart_reset(mpu->uart[2]);
     omap_mmc_reset(mpu->mmc);
+    omap_mpuio_reset(mpu->mpuio);
+    omap_gpio_reset(mpu->gpio);
+    omap_uwire_reset(mpu->microwire);
+    omap_pwl_reset(mpu);
+    omap_pwt_reset(mpu);
+    omap_i2c_reset(mpu->i2c);
+    omap_rtc_reset(mpu->rtc);
+    omap_mcbsp_reset(mpu->mcbsp1);
+    omap_mcbsp_reset(mpu->mcbsp2);
+    omap_mcbsp_reset(mpu->mcbsp3);
+    omap_lpg_reset(mpu->led[0]);
+    omap_lpg_reset(mpu->led[1]);
+    omap_clkm_reset(mpu);
     cpu_reset(mpu->env);
 }
 
+static const struct omap_map_s {
+    target_phys_addr_t phys_dsp;
+    target_phys_addr_t phys_mpu;
+    uint32_t size;
+    const char *name;
+} omap15xx_dsp_mm[] = {
+    /* Strobe 0 */
+    { 0xe1010000, 0xfffb0000, 0x800, "UART1 BT" },		/* CS0 */
+    { 0xe1010800, 0xfffb0800, 0x800, "UART2 COM" },		/* CS1 */
+    { 0xe1011800, 0xfffb1800, 0x800, "McBSP1 audio" },		/* CS3 */
+    { 0xe1012000, 0xfffb2000, 0x800, "MCSI2 communication" },	/* CS4 */
+    { 0xe1012800, 0xfffb2800, 0x800, "MCSI1 BT u-Law" },	/* CS5 */
+    { 0xe1013000, 0xfffb3000, 0x800, "uWire" },			/* CS6 */
+    { 0xe1013800, 0xfffb3800, 0x800, "I^2C" },			/* CS7 */
+    { 0xe1014000, 0xfffb4000, 0x800, "USB W2FC" },		/* CS8 */
+    { 0xe1014800, 0xfffb4800, 0x800, "RTC" },			/* CS9 */
+    { 0xe1015000, 0xfffb5000, 0x800, "MPUIO" },			/* CS10 */
+    { 0xe1015800, 0xfffb5800, 0x800, "PWL" },			/* CS11 */
+    { 0xe1016000, 0xfffb6000, 0x800, "PWT" },			/* CS12 */
+    { 0xe1017000, 0xfffb7000, 0x800, "McBSP3" },		/* CS14 */
+    { 0xe1017800, 0xfffb7800, 0x800, "MMC" },			/* CS15 */
+    { 0xe1019000, 0xfffb9000, 0x800, "32-kHz timer" },		/* CS18 */
+    { 0xe1019800, 0xfffb9800, 0x800, "UART3" },			/* CS19 */
+    { 0xe101c800, 0xfffbc800, 0x800, "TIPB switches" },		/* CS25 */
+    /* Strobe 1 */
+    { 0xe101e000, 0xfffce000, 0x800, "GPIOs" },			/* CS28 */
+
+    { 0 }
+};
+
+static void omap_setup_dsp_mapping(const struct omap_map_s *map)
+{
+    int io;
+
+    for (; map->phys_dsp; map ++) {
+        io = cpu_get_physical_page_desc(map->phys_mpu);
+
+        cpu_register_physical_memory(map->phys_dsp, map->size, io);
+    }
+}
+
 static void omap_mpu_wakeup(void *opaque, int irq, int req)
 {
     struct omap_mpu_state_s *mpu = (struct omap_mpu_state_s *) opaque;
 
-    cpu_interrupt(mpu->env, CPU_INTERRUPT_EXITTB);
+    if (mpu->env->halted)
+        cpu_interrupt(mpu->env, CPU_INTERRUPT_EXITTB);
 }
 
+struct dma_irq_map {
+    int ih;
+    int intr;
+};
+
+static const struct dma_irq_map omap_dma_irq_map[] = {
+    { 0, OMAP_INT_DMA_CH0_6 },
+    { 0, OMAP_INT_DMA_CH1_7 },
+    { 0, OMAP_INT_DMA_CH2_8 },
+    { 0, OMAP_INT_DMA_CH3 },
+    { 0, OMAP_INT_DMA_CH4 },
+    { 0, OMAP_INT_DMA_CH5 },
+    { 1, OMAP_INT_1610_DMA_CH6 },
+    { 1, OMAP_INT_1610_DMA_CH7 },
+    { 1, OMAP_INT_1610_DMA_CH8 },
+    { 1, OMAP_INT_1610_DMA_CH9 },
+    { 1, OMAP_INT_1610_DMA_CH10 },
+    { 1, OMAP_INT_1610_DMA_CH11 },
+    { 1, OMAP_INT_1610_DMA_CH12 },
+    { 1, OMAP_INT_1610_DMA_CH13 },
+    { 1, OMAP_INT_1610_DMA_CH14 },
+    { 1, OMAP_INT_1610_DMA_CH15 }
+};
+
 struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
                 DisplayState *ds, const char *core)
 {
+    int i;
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *)
             qemu_mallocz(sizeof(struct omap_mpu_state_s));
     ram_addr_t imif_base, emiff_base;
+    qemu_irq *cpu_irq;
+    qemu_irq dma_irqs[6];
+    int sdindex;
+
+    if (!core)
+        core = "ti925t";
 
     /* Core */
     s->mpu_model = omap310;
-    s->env = cpu_init();
+    s->env = cpu_init(core);
+    if (!s->env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     s->sdram_size = sdram_size;
     s->sram_size = OMAP15XX_SRAM_SIZE;
 
-    cpu_arm_set_model(s->env, core ?: "ti925t");
+    s->wakeup = qemu_allocate_irqs(omap_mpu_wakeup, s, 1)[0];
 
     /* Clocks */
     omap_clk_init(s);
@@ -2850,17 +5637,21 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
 
     omap_clkm_init(0xfffece00, 0xe1008000, s);
 
-    s->ih[0] = omap_inth_init(0xfffecb00, 0x100,
-                    arm_pic_init_cpu(s->env),
+    cpu_irq = arm_pic_init_cpu(s->env);
+    s->ih[0] = omap_inth_init(0xfffecb00, 0x100, 1,
+                    cpu_irq[ARM_PIC_CPU_IRQ], cpu_irq[ARM_PIC_CPU_FIQ],
                     omap_findclk(s, "arminth_ck"));
-    s->ih[1] = omap_inth_init(0xfffe0000, 0x800,
-                    &s->ih[0]->pins[OMAP_INT_15XX_IH2_IRQ],
+    s->ih[1] = omap_inth_init(0xfffe0000, 0x800, 1,
+                    s->ih[0]->pins[OMAP_INT_15XX_IH2_IRQ], NULL,
                     omap_findclk(s, "arminth_ck"));
     s->irq[0] = s->ih[0]->pins;
     s->irq[1] = s->ih[1]->pins;
 
-    s->dma = omap_dma_init(0xfffed800, s->irq[0], s,
-                    omap_findclk(s, "dma_ck"));
+    for (i = 0; i < 6; i ++)
+        dma_irqs[i] = s->irq[omap_dma_irq_map[i].ih][omap_dma_irq_map[i].intr];
+    s->dma = omap_dma_init(0xfffed800, dma_irqs, s->irq[0][OMAP_INT_DMA_LCD],
+                           s, omap_findclk(s, "dma_ck"), omap_dma_3_1);
+
     s->port[emiff    ].addr_valid = omap_validate_emiff_addr;
     s->port[emifs    ].addr_valid = omap_validate_emifs_addr;
     s->port[imif     ].addr_valid = omap_validate_imif_addr;
@@ -2905,13 +5696,13 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
 
     omap_tcmi_init(0xfffecc00, s);
 
-    s->uart1 = omap_uart_init(0xfffb0000, s->irq[1][OMAP_INT_UART1],
+    s->uart[0] = omap_uart_init(0xfffb0000, s->irq[1][OMAP_INT_UART1],
                     omap_findclk(s, "uart1_ck"),
                     serial_hds[0]);
-    s->uart2 = omap_uart_init(0xfffb0800, s->irq[1][OMAP_INT_UART2],
+    s->uart[1] = omap_uart_init(0xfffb0800, s->irq[1][OMAP_INT_UART2],
                     omap_findclk(s, "uart2_ck"),
                     serial_hds[0] ? serial_hds[1] : 0);
-    s->uart3 = omap_uart_init(0xe1019800, s->irq[0][OMAP_INT_UART3],
+    s->uart[2] = omap_uart_init(0xe1019800, s->irq[0][OMAP_INT_UART3],
                     omap_findclk(s, "uart3_ck"),
                     serial_hds[0] && serial_hds[1] ? serial_hds[2] : 0);
 
@@ -2919,11 +5710,63 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
     omap_dpll_init(&s->dpll[1], 0xfffed000, omap_findclk(s, "dpll2"));
     omap_dpll_init(&s->dpll[2], 0xfffed100, omap_findclk(s, "dpll3"));
 
-    s->mmc = omap_mmc_init(0xfffb7800, s->irq[1][OMAP_INT_OQN],
-                    &s->drq[OMAP_DMA_MMC_TX], omap_findclk(s, "mmc_ck"));
+    sdindex = drive_get_index(IF_SD, 0, 0);
+    if (sdindex == -1) {
+        fprintf(stderr, "qemu: missing SecureDigital device\n");
+        exit(1);
+    }
+    s->mmc = omap_mmc_init(0xfffb7800, drives_table[sdindex].bdrv,
+                    s->irq[1][OMAP_INT_OQN], &s->drq[OMAP_DMA_MMC_TX],
+                    omap_findclk(s, "mmc_ck"));
+
+    s->mpuio = omap_mpuio_init(0xfffb5000,
+                    s->irq[1][OMAP_INT_KEYBOARD], s->irq[1][OMAP_INT_MPUIO],
+                    s->wakeup, omap_findclk(s, "clk32-kHz"));
+
+    s->gpio = omap_gpio_init(0xfffce000, s->irq[0][OMAP_INT_GPIO_BANK1],
+                    omap_findclk(s, "arm_gpio_ck"));
+
+    s->microwire = omap_uwire_init(0xfffb3000, &s->irq[1][OMAP_INT_uWireTX],
+                    s->drq[OMAP_DMA_UWIRE_TX], omap_findclk(s, "mpuper_ck"));
+
+    omap_pwl_init(0xfffb5800, s, omap_findclk(s, "armxor_ck"));
+    omap_pwt_init(0xfffb6000, s, omap_findclk(s, "armxor_ck"));
+
+    s->i2c = omap_i2c_init(0xfffb3800, s->irq[1][OMAP_INT_I2C],
+                    &s->drq[OMAP_DMA_I2C_RX], omap_findclk(s, "mpuper_ck"));
+
+    s->rtc = omap_rtc_init(0xfffb4800, &s->irq[1][OMAP_INT_RTC_TIMER],
+                    omap_findclk(s, "clk32-kHz"));
+
+    s->mcbsp1 = omap_mcbsp_init(0xfffb1800, &s->irq[1][OMAP_INT_McBSP1TX],
+                    &s->drq[OMAP_DMA_MCBSP1_TX], omap_findclk(s, "dspxor_ck"));
+    s->mcbsp2 = omap_mcbsp_init(0xfffb1000, &s->irq[0][OMAP_INT_310_McBSP2_TX],
+                    &s->drq[OMAP_DMA_MCBSP2_TX], omap_findclk(s, "mpuper_ck"));
+    s->mcbsp3 = omap_mcbsp_init(0xfffb7000, &s->irq[1][OMAP_INT_McBSP3TX],
+                    &s->drq[OMAP_DMA_MCBSP3_TX], omap_findclk(s, "dspxor_ck"));
+
+    s->led[0] = omap_lpg_init(0xfffbd000, omap_findclk(s, "clk32-kHz"));
+    s->led[1] = omap_lpg_init(0xfffbd800, omap_findclk(s, "clk32-kHz"));
+
+    /* Register mappings not currenlty implemented:
+     * MCSI2 Comm	fffb2000 - fffb27ff (not mapped on OMAP310)
+     * MCSI1 Bluetooth	fffb2800 - fffb2fff (not mapped on OMAP310)
+     * USB W2FC		fffb4000 - fffb47ff
+     * Camera Interface	fffb6800 - fffb6fff
+     * USB Host		fffba000 - fffba7ff
+     * FAC		fffba800 - fffbafff
+     * HDQ/1-Wire	fffbc000 - fffbc7ff
+     * TIPB switches	fffbc800 - fffbcfff
+     * Mailbox		fffcf000 - fffcf7ff
+     * Local bus IF	fffec100 - fffec1ff
+     * Local bus MMU	fffec200 - fffec2ff
+     * DSP MMU		fffed200 - fffed2ff
+     */
+
+    omap_setup_dsp_mapping(omap15xx_dsp_mm);
+    omap_setup_mpui_io(s);
 
     qemu_register_reset(omap_mpu_reset, s);
-    s->wakeup = qemu_allocate_irqs(omap_mpu_wakeup, s, 1)[0];
 
     return s;
 }
diff --git a/hw/omap.h b/hw/omap.h
index 96cd3affd..18145ed80 100644
--- a/hw/omap.h
+++ b/hw/omap.h
@@ -57,7 +57,8 @@ void omap_clk_reparent(omap_clk clk, omap_clk parent);
 /* omap.c */
 struct omap_intr_handler_s;
 struct omap_intr_handler_s *omap_inth_init(target_phys_addr_t base,
-                unsigned long size, qemu_irq parent[2], omap_clk clk);
+                unsigned long size, unsigned char nbanks,
+                qemu_irq parent_irq, qemu_irq parent_fiq, omap_clk clk);
 
 /*
  * Common IRQ numbers for level 1 interrupt handler
@@ -335,26 +336,68 @@ struct omap_intr_handler_s *omap_inth_init(target_phys_addr_t base,
 # define OMAP_INT_243X_HS_USB_DMA	93
 # define OMAP_INT_243X_CARKIT		94
 
+enum omap_dma_model {
+    omap_dma_3_1 = 0,
+    omap_dma_3_2
+};
+
 struct omap_dma_s;
-struct omap_dma_s *omap_dma_init(target_phys_addr_t base,
-                qemu_irq pic[], struct omap_mpu_state_s *mpu, omap_clk clk);
+struct omap_dma_s *omap_dma_init(target_phys_addr_t base, qemu_irq *irqs,
+                qemu_irq lcd_irq, struct omap_mpu_state_s *mpu, omap_clk clk,
+                enum omap_dma_model model);
 
 enum omap_dma_port {
     emiff = 0,
     emifs,
-    imif,
+    imif,	/* omap16xx: ocp_t1 */
     tipb,
-    local,
+    local,	/* omap16xx: ocp_t2 */
     tipb_mpui,
     omap_dma_port_last,
 };
 
+typedef enum {
+    constant = 0,
+    post_incremented,
+    single_index,
+    double_index,
+} omap_dma_addressing_t;
+
 struct omap_dma_lcd_channel_s {
     enum omap_dma_port src;
     target_phys_addr_t src_f1_top;
     target_phys_addr_t src_f1_bottom;
     target_phys_addr_t src_f2_top;
     target_phys_addr_t src_f2_bottom;
+
+    /* Used in OMAP DMA 3.2 gigacell */
+    unsigned char brust_f1;
+    unsigned char pack_f1;
+    unsigned char data_type_f1;
+    unsigned char brust_f2;
+    unsigned char pack_f2;
+    unsigned char data_type_f2;
+    unsigned char end_prog;
+    unsigned char repeat;
+    unsigned char auto_init;
+    unsigned char priority;
+    unsigned char fs;
+    unsigned char running;
+    unsigned char bs;
+    unsigned char omap_3_1_compatible_disable;
+    unsigned char dst;
+    unsigned char lch_type;
+    int16_t element_index_f1;
+    int16_t element_index_f2;
+    int32_t frame_index_f1;
+    int32_t frame_index_f2;
+    uint16_t elements_f1;
+    uint16_t frames_f1;
+    uint16_t elements_f2;
+    uint16_t frames_f2;
+    omap_dma_addressing_t mode_f1;
+    omap_dma_addressing_t mode_f2;
+
     /* Destination port is fixed.  */
     int interrupts;
     int condition;
@@ -450,6 +493,67 @@ struct omap_uart_s;
 struct omap_uart_s *omap_uart_init(target_phys_addr_t base,
                 qemu_irq irq, omap_clk clk, CharDriverState *chr);
 
+struct omap_mpuio_s;
+struct omap_mpuio_s *omap_mpuio_init(target_phys_addr_t base,
+                qemu_irq kbd_int, qemu_irq gpio_int, qemu_irq wakeup,
+                omap_clk clk);
+qemu_irq *omap_mpuio_in_get(struct omap_mpuio_s *s);
+void omap_mpuio_out_set(struct omap_mpuio_s *s, int line, qemu_irq handler);
+void omap_mpuio_key(struct omap_mpuio_s *s, int row, int col, int down);
+
+struct omap_gpio_s;
+struct omap_gpio_s *omap_gpio_init(target_phys_addr_t base,
+                qemu_irq irq, omap_clk clk);
+qemu_irq *omap_gpio_in_get(struct omap_gpio_s *s);
+void omap_gpio_out_set(struct omap_gpio_s *s, int line, qemu_irq handler);
+
+struct uwire_slave_s {
+    uint16_t (*receive)(void *opaque);
+    void (*send)(void *opaque, uint16_t data);
+    void *opaque;
+};
+struct omap_uwire_s;
+struct omap_uwire_s *omap_uwire_init(target_phys_addr_t base,
+                qemu_irq *irq, qemu_irq dma, omap_clk clk);
+void omap_uwire_attach(struct omap_uwire_s *s,
+                struct uwire_slave_s *slave, int chipselect);
+
+struct omap_rtc_s;
+struct omap_rtc_s *omap_rtc_init(target_phys_addr_t base,
+                qemu_irq *irq, omap_clk clk);
+
+struct i2s_codec_s {
+    void *opaque;
+
+    /* The CPU can call this if it is generating the clock signal on the
+     * i2s port.  The CODEC can ignore it if it is set up as a clock
+     * master and generates its own clock.  */
+    void (*set_rate)(void *opaque, int in, int out);
+
+    void (*tx_swallow)(void *opaque);
+    qemu_irq rx_swallow;
+    qemu_irq tx_start;
+
+    int tx_rate;
+    int cts;
+    int rx_rate;
+    int rts;
+
+    struct i2s_fifo_s {
+        uint8_t *fifo;
+        int len;
+        int start;
+        int size;
+    } in, out;
+};
+struct omap_mcbsp_s;
+struct omap_mcbsp_s *omap_mcbsp_init(target_phys_addr_t base,
+                qemu_irq *irq, qemu_irq *dma, omap_clk clk);
+void omap_mcbsp_i2s_attach(struct omap_mcbsp_s *s, struct i2s_codec_s *slave);
+
+struct omap_lpg_s;
+struct omap_lpg_s *omap_lpg_init(target_phys_addr_t base, omap_clk clk);
+
 /* omap_lcdc.c */
 struct omap_lcd_panel_s;
 void omap_lcdc_reset(struct omap_lcd_panel_s *s);
@@ -460,8 +564,17 @@ struct omap_lcd_panel_s *omap_lcdc_init(target_phys_addr_t base, qemu_irq irq,
 /* omap_mmc.c */
 struct omap_mmc_s;
 struct omap_mmc_s *omap_mmc_init(target_phys_addr_t base,
+                BlockDriverState *bd,
                 qemu_irq irq, qemu_irq dma[], omap_clk clk);
 void omap_mmc_reset(struct omap_mmc_s *s);
+void omap_mmc_handlers(struct omap_mmc_s *s, qemu_irq ro, qemu_irq cover);
+
+/* omap_i2c.c */
+struct omap_i2c_s;
+struct omap_i2c_s *omap_i2c_init(target_phys_addr_t base,
+                qemu_irq irq, qemu_irq *dma, omap_clk clk);
+void omap_i2c_reset(struct omap_i2c_s *s);
+i2c_bus *omap_i2c_bus(struct omap_i2c_s *s);
 
 # define cpu_is_omap310(cpu)		(cpu->mpu_model == omap310)
 # define cpu_is_omap1510(cpu)		(cpu->mpu_model == omap1510)
@@ -495,16 +608,44 @@ struct omap_mpu_state_s {
     unsigned long sram_size;
 
     /* MPUI-TIPB peripherals */
-    struct omap_uart_s *uart3;
+    struct omap_uart_s *uart[3];
+
+    struct omap_gpio_s *gpio;
+
+    struct omap_mcbsp_s *mcbsp1;
+    struct omap_mcbsp_s *mcbsp3;
 
     /* MPU public TIPB peripherals */
     struct omap_32khz_timer_s *os_timer;
 
-    struct omap_uart_s *uart1;
-    struct omap_uart_s *uart2;
-
     struct omap_mmc_s *mmc;
 
+    struct omap_mpuio_s *mpuio;
+
+    struct omap_uwire_s *microwire;
+
+    struct {
+        uint8_t output;
+        uint8_t level;
+        uint8_t enable;
+        int clk;
+    } pwl;
+
+    struct {
+        uint8_t frc;
+        uint8_t vrc;
+        uint8_t gcr;
+        omap_clk clk;
+    } pwt;
+
+    struct omap_i2c_s *i2c;
+
+    struct omap_rtc_s *rtc;
+
+    struct omap_mcbsp_s *mcbsp2;
+
+    struct omap_lpg_s *led[2];
+
     /* MPU private TIPB peripherals */
     struct omap_intr_handler_s *ih[2];
 
@@ -574,6 +715,9 @@ struct omap_mpu_state_s {
 #  error TARGET_PHYS_ADDR_BITS undefined
 # endif
 
+uint32_t omap_badwidth_read8(void *opaque, target_phys_addr_t addr);
+void omap_badwidth_write8(void *opaque, target_phys_addr_t addr,
+                uint32_t value);
 uint32_t omap_badwidth_read16(void *opaque, target_phys_addr_t addr);
 void omap_badwidth_write16(void *opaque, target_phys_addr_t addr,
                 uint32_t value);
@@ -586,11 +730,125 @@ void omap_badwidth_write32(void *opaque, target_phys_addr_t addr,
 # define OMAP_RO_REG(paddr)		\
         printf("%s: Read-only register " OMAP_FMT_plx "\n",	\
                         __FUNCTION__, paddr)
-# define OMAP_16B_REG(paddr)		\
+
+# define TCMI_VERBOSE			1
+//# define MEM_VERBOSE			1
+
+# ifdef TCMI_VERBOSE
+#  define OMAP_8B_REG(paddr)		\
+        printf("%s: 8-bit register " OMAP_FMT_plx "\n",	\
+                        __FUNCTION__, paddr)
+#  define OMAP_16B_REG(paddr)		\
         printf("%s: 16-bit register " OMAP_FMT_plx "\n",	\
                         __FUNCTION__, paddr)
-# define OMAP_32B_REG(paddr)		\
+#  define OMAP_32B_REG(paddr)		\
         printf("%s: 32-bit register " OMAP_FMT_plx "\n",	\
                         __FUNCTION__, paddr)
+# else
+#  define OMAP_8B_REG(paddr)
+#  define OMAP_16B_REG(paddr)
+#  define OMAP_32B_REG(paddr)
+# endif
+
+# define OMAP_MPUI_REG_MASK		0x000007ff
+
+# ifdef MEM_VERBOSE
+struct io_fn {
+    CPUReadMemoryFunc **mem_read;
+    CPUWriteMemoryFunc **mem_write;
+    void *opaque;
+    int in;
+};
+
+static uint32_t io_readb(void *opaque, target_phys_addr_t addr)
+{
+    struct io_fn *s = opaque;
+    uint32_t ret;
+
+    s->in ++;
+    ret = s->mem_read[0](s->opaque, addr);
+    s->in --;
+    if (!s->in)
+        fprintf(stderr, "%08x ---> %02x\n", (uint32_t) addr, ret);
+    return ret;
+}
+static uint32_t io_readh(void *opaque, target_phys_addr_t addr)
+{
+    struct io_fn *s = opaque;
+    uint32_t ret;
+
+    s->in ++;
+    ret = s->mem_read[1](s->opaque, addr);
+    s->in --;
+    if (!s->in)
+        fprintf(stderr, "%08x ---> %04x\n", (uint32_t) addr, ret);
+    return ret;
+}
+static uint32_t io_readw(void *opaque, target_phys_addr_t addr)
+{
+    struct io_fn *s = opaque;
+    uint32_t ret;
+
+    s->in ++;
+    ret = s->mem_read[2](s->opaque, addr);
+    s->in --;
+    if (!s->in)
+        fprintf(stderr, "%08x ---> %08x\n", (uint32_t) addr, ret);
+    return ret;
+}
+static void io_writeb(void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+    struct io_fn *s = opaque;
+
+    if (!s->in)
+        fprintf(stderr, "%08x <--- %02x\n", (uint32_t) addr, value);
+    s->in ++;
+    s->mem_write[0](s->opaque, addr, value);
+    s->in --;
+}
+static void io_writeh(void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+    struct io_fn *s = opaque;
+
+    if (!s->in)
+        fprintf(stderr, "%08x <--- %04x\n", (uint32_t) addr, value);
+    s->in ++;
+    s->mem_write[1](s->opaque, addr, value);
+    s->in --;
+}
+static void io_writew(void *opaque, target_phys_addr_t addr, uint32_t value)
+{
+    struct io_fn *s = opaque;
+
+    if (!s->in)
+        fprintf(stderr, "%08x <--- %08x\n", (uint32_t) addr, value);
+    s->in ++;
+    s->mem_write[2](s->opaque, addr, value);
+    s->in --;
+}
+
+static CPUReadMemoryFunc *io_readfn[] = { io_readb, io_readh, io_readw, };
+static CPUWriteMemoryFunc *io_writefn[] = { io_writeb, io_writeh, io_writew, };
+
+inline static int debug_register_io_memory(int io_index,
+                CPUReadMemoryFunc **mem_read, CPUWriteMemoryFunc **mem_write,
+                void *opaque)
+{
+    struct io_fn *s = qemu_malloc(sizeof(struct io_fn));
+
+    s->mem_read = mem_read;
+    s->mem_write = mem_write;
+    s->opaque = opaque;
+    s->in = 0;
+    return cpu_register_io_memory(io_index, io_readfn, io_writefn, s);
+}
+#  define cpu_register_io_memory	debug_register_io_memory
+# endif
+
+/* Not really omap specific, but is the only thing that uses the
+   uwire interface.  */
+/* tsc210x.c */
+struct uwire_slave_s *tsc2102_init(qemu_irq pint, AudioState *audio);
+struct i2s_codec_s *tsc210x_codec(struct uwire_slave_s *chip);
 
 #endif /* hw_omap_h */
diff --git a/hw/omap1_clk.c b/hw/omap1_clk.c
index 7888e4155..37daec266 100644
--- a/hw/omap1_clk.c
+++ b/hw/omap1_clk.c
@@ -20,7 +20,8 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
  * MA 02111-1307 USA
  */
-#include "vl.h"
+#include "hw.h"
+#include "omap.h"
 
 struct clk {
     const char *name;
@@ -307,6 +308,12 @@ static struct clk lbfree_ck = {
     .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
 };
 
+static struct clk hsab_ck = {
+    .name	= "hsab_ck",
+    .parent	= &tc_ck,
+    .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
+};
+
 static struct clk rhea1_ck = {
     .name	= "rhea1_ck",
     .parent	= &tc_ck,
@@ -359,7 +366,7 @@ static struct clk uart2_ck = {
 static struct clk uart3_1510 = {
     .name	= "uart3_ck",
     /* Direct from ULPD, no real parent */
-    .parent	= &armper_ck,/* either armper_ck or dpll4 */
+    .parent	= &armper_ck,	/* either armper_ck or dpll4 */
     .rate	= 12000000,
     .flags	= CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
 };
@@ -395,11 +402,12 @@ static struct clk usb_hhc_ck16xx = {
     .flags	= CLOCK_IN_OMAP16XX,
 };
 
-static struct clk usb_dc_ck = {
-    .name	= "usb_dc_ck",
-    /* Direct from ULPD, no parent */
+static struct clk usb_w2fc_mclk = {
+    .name	= "usb_w2fc_mclk",
+    .alias	= "usb_w2fc_ck",
+    .parent	= &ck_48m,
     .rate	= 48000000,
-    .flags	= CLOCK_IN_OMAP16XX,
+    .flags	= CLOCK_IN_OMAP310 | CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX,
 };
 
 static struct clk mclk_1510 = {
@@ -539,6 +547,7 @@ static struct clk *onchip_clks[] = {
     &api_ck,
     &lb_ck,
     &lbfree_ck,
+    &hsab_ck,
     &rhea1_ck,
     &rhea2_ck,
     &lcd_ck_16xx,
@@ -551,7 +560,6 @@ static struct clk *onchip_clks[] = {
     &uart3_16xx,
     &usb_clk0,
     &usb_hhc_ck1510, &usb_hhc_ck16xx,
-    &usb_dc_ck,
     &mclk_1510,  &mclk_16xx, &mclk_310,
     &bclk_1510,  &bclk_16xx, &bclk_310,
     &mmc1_ck,
@@ -560,6 +568,7 @@ static struct clk *onchip_clks[] = {
     &cam_exclk,
     &cam_lclk,
     &clk32k,
+    &usb_w2fc_mclk,
     /* Virtual clocks */
     &i2c_fck,
     &i2c_ick,
@@ -742,4 +751,8 @@ void omap_clk_init(struct omap_mpu_state_s *mpu)
             j->multiplier = j->multiplier ?: 1;
             j ++;
         }
+    for (j = mpu->clks; count --; j ++) {
+        omap_clk_update(j);
+        omap_clk_rate_update(j);
+    }
 }
diff --git a/hw/omap_i2c.c b/hw/omap_i2c.c
new file mode 100644
index 000000000..fd37974cc
--- /dev/null
+++ b/hw/omap_i2c.c
@@ -0,0 +1,437 @@
+/*
+ * TI OMAP on-chip I2C controller.  Only "new I2C" mode supported.
+ *
+ * Copyright (C) 2007 Andrzej Zaborowski  <balrog@zabor.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+#include "hw.h"
+#include "i2c.h"
+#include "omap.h"
+
+struct omap_i2c_s {
+    target_phys_addr_t base;
+    qemu_irq irq;
+    qemu_irq drq[2];
+    i2c_slave slave;
+    i2c_bus *bus;
+
+    uint8_t mask;
+    uint16_t stat;
+    uint16_t dma;
+    uint16_t count;
+    int count_cur;
+    uint32_t fifo;
+    int rxlen;
+    int txlen;
+    uint16_t control;
+    uint16_t addr[2];
+    uint8_t divider;
+    uint8_t times[2];
+    uint16_t test;
+};
+
+static void omap_i2c_interrupts_update(struct omap_i2c_s *s)
+{
+    qemu_set_irq(s->irq, s->stat & s->mask);
+    if ((s->dma >> 15) & 1)					/* RDMA_EN */
+        qemu_set_irq(s->drq[0], (s->stat >> 3) & 1);		/* RRDY */
+    if ((s->dma >> 7) & 1)					/* XDMA_EN */
+        qemu_set_irq(s->drq[1], (s->stat >> 4) & 1);		/* XRDY */
+}
+
+/* These are only stubs now.  */
+static void omap_i2c_event(i2c_slave *i2c, enum i2c_event event)
+{
+    struct omap_i2c_s *s = (struct omap_i2c_s *) i2c;
+
+    if ((~s->control >> 15) & 1)				/* I2C_EN */
+        return;
+
+    switch (event) {
+    case I2C_START_SEND:
+    case I2C_START_RECV:
+        s->stat |= 1 << 9;					/* AAS */
+        break;
+    case I2C_FINISH:
+        s->stat |= 1 << 2;					/* ARDY */
+        break;
+    case I2C_NACK:
+        s->stat |= 1 << 1;					/* NACK */
+        break;
+    }
+
+    omap_i2c_interrupts_update(s);
+}
+
+static int omap_i2c_rx(i2c_slave *i2c)
+{
+    struct omap_i2c_s *s = (struct omap_i2c_s *) i2c;
+    uint8_t ret = 0;
+
+    if ((~s->control >> 15) & 1)				/* I2C_EN */
+        return -1;
+
+    if (s->txlen)
+        ret = s->fifo >> ((-- s->txlen) << 3) & 0xff;
+    else
+        s->stat |= 1 << 10;					/* XUDF */
+    s->stat |= 1 << 4;						/* XRDY */
+
+    omap_i2c_interrupts_update(s);
+    return ret;
+}
+
+static int omap_i2c_tx(i2c_slave *i2c, uint8_t data)
+{
+    struct omap_i2c_s *s = (struct omap_i2c_s *) i2c;
+
+    if ((~s->control >> 15) & 1)				/* I2C_EN */
+        return 1;
+
+    if (s->rxlen < 4)
+        s->fifo |= data << ((s->rxlen ++) << 3);
+    else
+        s->stat |= 1 << 11;					/* ROVR */
+    s->stat |= 1 << 3;						/* RRDY */
+
+    omap_i2c_interrupts_update(s);
+    return 1;
+}
+
+static void omap_i2c_fifo_run(struct omap_i2c_s *s)
+{
+    int ack = 1;
+
+    if (!i2c_bus_busy(s->bus))
+        return;
+
+    if ((s->control >> 2) & 1) {				/* RM */
+        if ((s->control >> 1) & 1) {				/* STP */
+            i2c_end_transfer(s->bus);
+            s->control &= ~(1 << 1);				/* STP */
+            s->count_cur = s->count;
+        } else if ((s->control >> 9) & 1) {			/* TRX */
+            while (ack && s->txlen)
+                ack = (i2c_send(s->bus,
+                                        (s->fifo >> ((-- s->txlen) << 3)) &
+                                        0xff) >= 0);
+            s->stat |= 1 << 4;					/* XRDY */
+        } else {
+            while (s->rxlen < 4)
+                s->fifo |= i2c_recv(s->bus) << ((s->rxlen ++) << 3);
+            s->stat |= 1 << 3;					/* RRDY */
+        }
+    } else {
+        if ((s->control >> 9) & 1) {				/* TRX */
+            while (ack && s->count_cur && s->txlen) {
+                ack = (i2c_send(s->bus,
+                                        (s->fifo >> ((-- s->txlen) << 3)) &
+                                        0xff) >= 0);
+                s->count_cur --;
+            }
+            if (ack && s->count_cur)
+                s->stat |= 1 << 4;				/* XRDY */
+            if (!s->count_cur) {
+                s->stat |= 1 << 2;				/* ARDY */
+                s->control &= ~(1 << 10);			/* MST */
+            }
+        } else {
+            while (s->count_cur && s->rxlen < 4) {
+                s->fifo |= i2c_recv(s->bus) << ((s->rxlen ++) << 3);
+                s->count_cur --;
+            }
+            if (s->rxlen)
+                s->stat |= 1 << 3;				/* RRDY */
+        }
+        if (!s->count_cur) {
+            if ((s->control >> 1) & 1) {			/* STP */
+                i2c_end_transfer(s->bus);
+                s->control &= ~(1 << 1);			/* STP */
+                s->count_cur = s->count;
+            } else {
+                s->stat |= 1 << 2;				/* ARDY */
+                s->control &= ~(1 << 10);			/* MST */
+            }
+        }
+    }
+
+    s->stat |= (!ack) << 1;					/* NACK */
+    if (!ack)
+        s->control &= ~(1 << 1);				/* STP */
+}
+
+void omap_i2c_reset(struct omap_i2c_s *s)
+{
+    s->mask = 0;
+    s->stat = 0;
+    s->dma = 0;
+    s->count = 0;
+    s->count_cur = 0;
+    s->fifo = 0;
+    s->rxlen = 0;
+    s->txlen = 0;
+    s->control = 0;
+    s->addr[0] = 0;
+    s->addr[1] = 0;
+    s->divider = 0;
+    s->times[0] = 0;
+    s->times[1] = 0;
+    s->test = 0;
+}
+
+static uint32_t omap_i2c_read(void *opaque, target_phys_addr_t addr)
+{
+    struct omap_i2c_s *s = (struct omap_i2c_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+    uint16_t ret;
+
+    switch (offset) {
+    case 0x00:	/* I2C_REV */
+        /* TODO: set a value greater or equal to real hardware */
+        return 0x11;						/* REV */
+
+    case 0x04:	/* I2C_IE */
+        return s->mask;
+
+    case 0x08:	/* I2C_STAT */
+        return s->stat | (i2c_bus_busy(s->bus) << 12);
+
+    case 0x0c:	/* I2C_IV */
+        ret = ffs(s->stat & s->mask);
+        if (ret)
+            s->stat ^= 1 << (ret - 1);
+        omap_i2c_interrupts_update(s);
+        return ret;
+
+    case 0x14:	/* I2C_BUF */
+        return s->dma;
+
+    case 0x18:	/* I2C_CNT */
+        return s->count_cur;					/* DCOUNT */
+
+    case 0x1c:	/* I2C_DATA */
+        ret = 0;
+        if (s->control & (1 << 14)) {				/* BE */
+            ret |= ((s->fifo >> 0) & 0xff) << 8;
+            ret |= ((s->fifo >> 8) & 0xff) << 0;
+        } else {
+            ret |= ((s->fifo >> 8) & 0xff) << 8;
+            ret |= ((s->fifo >> 0) & 0xff) << 0;
+        }
+        if (s->rxlen == 1) {
+            s->stat |= 1 << 15;					/* SBD */
+            s->rxlen = 0;
+        } else if (s->rxlen > 1) {
+            if (s->rxlen > 2)
+                s->fifo >>= 16;
+            s->rxlen -= 2;
+        } else
+            /* XXX: remote access (qualifier) error - what's that?  */;
+        if (!s->rxlen) {
+            s->stat |= ~(1 << 3);				/* RRDY */
+            if (((s->control >> 10) & 1) &&			/* MST */
+                            ((~s->control >> 9) & 1)) {		/* TRX */
+                s->stat |= 1 << 2;				/* ARDY */
+                s->control &= ~(1 << 10);			/* MST */
+            }
+        }
+        s->stat &= ~(1 << 11);					/* ROVR */
+        omap_i2c_fifo_run(s);
+        omap_i2c_interrupts_update(s);
+        return ret;
+
+    case 0x24:	/* I2C_CON */
+        return s->control;
+
+    case 0x28:	/* I2C_OA */
+        return s->addr[0];
+
+    case 0x2c:	/* I2C_SA */
+        return s->addr[1];
+
+    case 0x30:	/* I2C_PSC */
+        return s->divider;
+
+    case 0x34:	/* I2C_SCLL */
+        return s->times[0];
+
+    case 0x38:	/* I2C_SCLH */
+        return s->times[1];
+
+    case 0x3c:	/* I2C_SYSTEST */
+        if (s->test & (1 << 15)) {				/* ST_EN */
+            s->test ^= 0xa;
+            return s->test;
+        } else
+            return s->test & ~0x300f;
+    }
+
+    OMAP_BAD_REG(addr);
+    return 0;
+}
+
+static void omap_i2c_write(void *opaque, target_phys_addr_t addr,
+                uint32_t value)
+{
+    struct omap_i2c_s *s = (struct omap_i2c_s *) opaque;
+    int offset = addr & OMAP_MPUI_REG_MASK;
+    int nack;
+
+    switch (offset) {
+    case 0x00:	/* I2C_REV */
+    case 0x08:	/* I2C_STAT */
+    case 0x0c:	/* I2C_IV */
+        OMAP_BAD_REG(addr);
+        return;
+
+    case 0x04:	/* I2C_IE */
+        s->mask = value & 0x1f;
+        break;
+
+    case 0x14:	/* I2C_BUF */
+        s->dma = value & 0x8080;
+        if (value & (1 << 15))					/* RDMA_EN */
+            s->mask &= ~(1 << 3);				/* RRDY_IE */
+        if (value & (1 << 7))					/* XDMA_EN */
+            s->mask &= ~(1 << 4);				/* XRDY_IE */
+        break;
+
+    case 0x18:	/* I2C_CNT */
+        s->count = value;					/* DCOUNT */
+        break;
+
+    case 0x1c:	/* I2C_DATA */
+        if (s->txlen > 2) {
+            /* XXX: remote access (qualifier) error - what's that?  */
+            break;
+        }
+        s->fifo <<= 16;
+        s->txlen += 2;
+        if (s->control & (1 << 14)) {				/* BE */
+            s->fifo |= ((value >> 8) & 0xff) << 8;
+            s->fifo |= ((value >> 0) & 0xff) << 0;
+        } else {
+            s->fifo |= ((value >> 0) & 0xff) << 8;
+            s->fifo |= ((value >> 8) & 0xff) << 0;
+        }
+        s->stat &= ~(1 << 10);					/* XUDF */
+        if (s->txlen > 2)
+            s->stat &= ~(1 << 4);				/* XRDY */
+        omap_i2c_fifo_run(s);
+        omap_i2c_interrupts_update(s);
+        break;
+
+    case 0x24:	/* I2C_CON */
+        s->control = value & 0xcf07;
+        if (~value & (1 << 15)) {				/* I2C_EN */
+            omap_i2c_reset(s);
+            break;
+        }
+        if (~value & (1 << 10)) {				/* MST */
+            printf("%s: I^2C slave mode not supported\n", __FUNCTION__);
+            break;
+        }
+        if (value & (1 << 9)) {					/* XA */
+            printf("%s: 10-bit addressing mode not supported\n", __FUNCTION__);
+            break;
+        }
+        if (value & (1 << 0)) {					/* STT */
+            nack = !!i2c_start_transfer(s->bus, s->addr[1],	/* SA */
+                            (~value >> 9) & 1);			/* TRX */
+            s->stat |= nack << 1;				/* NACK */
+            s->control &= ~(1 << 0);				/* STT */
+            if (nack)
+                s->control &= ~(1 << 1);			/* STP */
+            else
+                omap_i2c_fifo_run(s);
+            omap_i2c_interrupts_update(s);
+        }
+        break;
+
+    case 0x28:	/* I2C_OA */
+        s->addr[0] = value & 0x3ff;
+        i2c_set_slave_address(&s->slave, value & 0x7f);
+        break;
+
+    case 0x2c:	/* I2C_SA */
+        s->addr[1] = value & 0x3ff;
+        break;
+
+    case 0x30:	/* I2C_PSC */
+        s->divider = value;
+        break;
+
+    case 0x34:	/* I2C_SCLL */
+        s->times[0] = value;
+        break;
+
+    case 0x38:	/* I2C_SCLH */
+        s->times[1] = value;
+        break;
+
+    case 0x3c:	/* I2C_SYSTEST */
+        s->test = value & 0xf00f;
+        if (value & (1 << 15))					/* ST_EN */
+            printf("%s: System Test not supported\n", __FUNCTION__);
+        break;
+
+    default:
+        OMAP_BAD_REG(addr);
+        return;
+    }
+}
+
+static CPUReadMemoryFunc *omap_i2c_readfn[] = {
+    omap_badwidth_read16,
+    omap_i2c_read,
+    omap_badwidth_read16,
+};
+
+static CPUWriteMemoryFunc *omap_i2c_writefn[] = {
+    omap_badwidth_write16,
+    omap_i2c_write,
+    omap_i2c_write,	/* TODO: Only the last fifo write can be 8 bit.  */
+};
+
+struct omap_i2c_s *omap_i2c_init(target_phys_addr_t base,
+                qemu_irq irq, qemu_irq *dma, omap_clk clk)
+{
+    int iomemtype;
+    struct omap_i2c_s *s = (struct omap_i2c_s *)
+            qemu_mallocz(sizeof(struct omap_i2c_s));
+
+    s->base = base;
+    s->irq = irq;
+    s->drq[0] = dma[0];
+    s->drq[1] = dma[1];
+    s->slave.event = omap_i2c_event;
+    s->slave.recv = omap_i2c_rx;
+    s->slave.send = omap_i2c_tx;
+    s->bus = i2c_init_bus();
+    omap_i2c_reset(s);
+
+    iomemtype = cpu_register_io_memory(0, omap_i2c_readfn,
+                    omap_i2c_writefn, s);
+    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+
+    return s;
+}
+
+i2c_bus *omap_i2c_bus(struct omap_i2c_s *s)
+{
+    return s->bus;
+}
diff --git a/hw/omap_lcdc.c b/hw/omap_lcdc.c
index 543d1f2bd..c79d244c1 100644
--- a/hw/omap_lcdc.c
+++ b/hw/omap_lcdc.c
@@ -18,7 +18,9 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
  * MA 02111-1307 USA
  */
-#include "vl.h"
+#include "hw.h"
+#include "console.h"
+#include "omap.h"
 
 struct omap_lcd_panel_s {
     target_phys_addr_t base;
@@ -112,7 +114,7 @@ static draw_line_func *draw_line_table2[33] = {
     [32]	= draw_line16_32,
 };
 
-void omap_update_display(void *opaque)
+static void omap_update_display(void *opaque)
 {
     struct omap_lcd_panel_s *omap_lcd = (struct omap_lcd_panel_s *) opaque;
     draw_line_func *draw_line;
@@ -287,7 +289,7 @@ static int ppm_save(const char *filename, uint8_t *data,
     return 0;
 }
 
-void omap_screen_dump(void *opaque, const char *filename) {
+static void omap_screen_dump(void *opaque, const char *filename) {
     struct omap_lcd_panel_s *omap_lcd = opaque;
     omap_update_display(opaque);
     if (omap_lcd && omap_lcd->state->data)
@@ -296,12 +298,12 @@ void omap_screen_dump(void *opaque, const char *filename) {
                 omap_lcd->state->linesize);
 }
 
-void omap_invalidate_display(void *opaque) {
+static void omap_invalidate_display(void *opaque) {
     struct omap_lcd_panel_s *omap_lcd = opaque;
     omap_lcd->invalidate = 1;
 }
 
-void omap_lcd_update(struct omap_lcd_panel_s *s) {
+static void omap_lcd_update(struct omap_lcd_panel_s *s) {
     if (!s->enable) {
         s->dma->current_frame = -1;
         s->sync_error = 0;
diff --git a/hw/omap_mmc.c b/hw/omap_mmc.c
index aa77660f2..6fbbb8491 100644
--- a/hw/omap_mmc.c
+++ b/hw/omap_mmc.c
@@ -18,7 +18,8 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
  * MA 02111-1307 USA
  */
-#include "vl.h"
+#include "hw.h"
+#include "omap.h"
 #include "sd.h"
 
 struct omap_mmc_s {
@@ -268,7 +269,7 @@ static uint32_t omap_mmc_read(void *opaque, target_phys_addr_t offset)
 {
     uint16_t i;
     struct omap_mmc_s *s = (struct omap_mmc_s *) opaque;
-    offset -= s->base;
+    offset &= OMAP_MPUI_REG_MASK;
 
     switch (offset) {
     case 0x00:	/* MMC_CMD */
@@ -350,7 +351,7 @@ static void omap_mmc_write(void *opaque, target_phys_addr_t offset,
 {
     int i;
     struct omap_mmc_s *s = (struct omap_mmc_s *) opaque;
-    offset -= s->base;
+    offset &= OMAP_MPUI_REG_MASK;
 
     switch (offset) {
     case 0x00:	/* MMC_CMD */
@@ -507,6 +508,7 @@ void omap_mmc_reset(struct omap_mmc_s *host)
 }
 
 struct omap_mmc_s *omap_mmc_init(target_phys_addr_t base,
+                BlockDriverState *bd,
                 qemu_irq irq, qemu_irq dma[], omap_clk clk)
 {
     int iomemtype;
@@ -523,9 +525,12 @@ struct omap_mmc_s *omap_mmc_init(target_phys_addr_t base,
     cpu_register_physical_memory(s->base, 0x800, iomemtype);
 
     /* Instantiate the storage */
-    s->card = sd_init(sd_bdrv);
+    s->card = sd_init(bd, 0);
 
     return s;
 }
 
-/* TODO: insertion and read-only handlers */
+void omap_mmc_handlers(struct omap_mmc_s *s, qemu_irq ro, qemu_irq cover)
+{
+    sd_set_cb(s->card, ro, cover);
+}
diff --git a/hw/openpic.c b/hw/openpic.c
index 54830c31b..32cf54e48 100644
--- a/hw/openpic.c
+++ b/hw/openpic.c
@@ -32,7 +32,9 @@
  * Serial interrupts, as implemented in Raven chipset are not supported yet.
  *
  */
-#include "vl.h"
+#include "hw.h"
+#include "ppc_mac.h"
+#include "pci.h"
 
 //#define DEBUG_OPENPIC
 
diff --git a/hw/palm.c b/hw/palm.c
index 623fcd648..9400ea78c 100644
--- a/hw/palm.c
+++ b/hw/palm.c
@@ -18,7 +18,13 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
  * MA 02111-1307 USA
  */
-#include "vl.h"
+#include "hw.h"
+#include "audio/audio.h"
+#include "sysemu.h"
+#include "console.h"
+#include "omap.h"
+#include "boards.h"
+#include "arm-misc.h"
 
 static uint32_t static_readb(void *opaque, target_phys_addr_t offset)
 {
@@ -37,7 +43,8 @@ static uint32_t static_readw(void *opaque, target_phys_addr_t offset) {
 }
 
 static void static_write(void *opaque, target_phys_addr_t offset,
-                uint32_t value) {
+                uint32_t value)
+{
 #ifdef SPY
     printf("%s: value %08lx written at " PA_FMT "\n",
                     __FUNCTION__, value, offset);
@@ -57,12 +64,127 @@ static CPUWriteMemoryFunc *static_writefn[] = {
 };
 
 /* Palm Tunsgten|E support */
+
+/* Shared GPIOs */
+#define PALMTE_USBDETECT_GPIO	0
+#define PALMTE_USB_OR_DC_GPIO	1
+#define PALMTE_TSC_GPIO		4
+#define PALMTE_PINTDAV_GPIO	6
+#define PALMTE_MMC_WP_GPIO	8
+#define PALMTE_MMC_POWER_GPIO	9
+#define PALMTE_HDQ_GPIO		11
+#define PALMTE_HEADPHONES_GPIO	14
+#define PALMTE_SPEAKER_GPIO	15
+/* MPU private GPIOs */
+#define PALMTE_DC_GPIO		2
+#define PALMTE_MMC_SWITCH_GPIO	4
+#define PALMTE_MMC1_GPIO	6
+#define PALMTE_MMC2_GPIO	7
+#define PALMTE_MMC3_GPIO	11
+
 static void palmte_microwire_setup(struct omap_mpu_state_s *cpu)
 {
+    struct uwire_slave_s *tsc;
+    AudioState *audio = 0;
+
+#ifdef HAS_AUDIO
+    audio = AUD_init();
+#endif
+
+    tsc = tsc2102_init(omap_gpio_in_get(cpu->gpio)[PALMTE_PINTDAV_GPIO],
+                    audio);
+
+    omap_uwire_attach(cpu->microwire, tsc, 0);
+    omap_mcbsp_i2s_attach(cpu->mcbsp1, tsc210x_codec(tsc));
+}
+
+static struct {
+    int row;
+    int column;
+} palmte_keymap[0x80] = {
+    [0 ... 0x7f] = { -1, -1 },
+    [0x3b] = { 0, 0 },	/* F1	-> Calendar */
+    [0x3c] = { 1, 0 },	/* F2	-> Contacts */
+    [0x3d] = { 2, 0 },	/* F3	-> Tasks List */
+    [0x3e] = { 3, 0 },	/* F4	-> Note Pad */
+    [0x01] = { 4, 0 },	/* Esc	-> Power */
+    [0x4b] = { 0, 1 },	/* 	   Left */
+    [0x50] = { 1, 1 },	/* 	   Down */
+    [0x48] = { 2, 1 },	/*	   Up */
+    [0x4d] = { 3, 1 },	/*	   Right */
+    [0x4c] = { 4, 1 },	/* 	   Centre */
+    [0x39] = { 4, 1 },	/* Spc	-> Centre */
+};
+
+static void palmte_button_event(void *opaque, int keycode)
+{
+    struct omap_mpu_state_s *cpu = (struct omap_mpu_state_s *) opaque;
+
+    if (palmte_keymap[keycode & 0x7f].row != -1)
+        omap_mpuio_key(cpu->mpuio,
+                        palmte_keymap[keycode & 0x7f].row,
+                        palmte_keymap[keycode & 0x7f].column,
+                        !(keycode & 0x80));
+}
+
+static void palmte_onoff_gpios(void *opaque, int line, int level)
+{
+    switch (line) {
+    case 0:
+        printf("%s: current to MMC/SD card %sabled.\n",
+                        __FUNCTION__, level ? "dis" : "en");
+        break;
+    case 1:
+        printf("%s: internal speaker amplifier %s.\n",
+                        __FUNCTION__, level ? "down" : "on");
+        break;
+
+    /* These LCD & Audio output signals have not been identified yet.  */
+    case 2:
+    case 3:
+    case 4:
+        printf("%s: LCD GPIO%i %s.\n",
+                        __FUNCTION__, line - 1, level ? "high" : "low");
+        break;
+    case 5:
+    case 6:
+        printf("%s: Audio GPIO%i %s.\n",
+                        __FUNCTION__, line - 4, level ? "high" : "low");
+        break;
+    }
 }
 
-static void palmte_init(int ram_size, int vga_ram_size, int boot_device,
-                DisplayState *ds, const char **fd_filename, int snapshot,
+static void palmte_gpio_setup(struct omap_mpu_state_s *cpu)
+{
+    qemu_irq *misc_gpio;
+
+    omap_mmc_handlers(cpu->mmc,
+                    omap_gpio_in_get(cpu->gpio)[PALMTE_MMC_WP_GPIO],
+                    qemu_irq_invert(omap_mpuio_in_get(cpu->mpuio)
+                            [PALMTE_MMC_SWITCH_GPIO]));
+
+    misc_gpio = qemu_allocate_irqs(palmte_onoff_gpios, cpu, 7);
+    omap_gpio_out_set(cpu->gpio, PALMTE_MMC_POWER_GPIO,	misc_gpio[0]);
+    omap_gpio_out_set(cpu->gpio, PALMTE_SPEAKER_GPIO,	misc_gpio[1]);
+    omap_gpio_out_set(cpu->gpio, 11,			misc_gpio[2]);
+    omap_gpio_out_set(cpu->gpio, 12,			misc_gpio[3]);
+    omap_gpio_out_set(cpu->gpio, 13,			misc_gpio[4]);
+    omap_mpuio_out_set(cpu->mpuio, 1,			misc_gpio[5]);
+    omap_mpuio_out_set(cpu->mpuio, 3,			misc_gpio[6]);
+
+    /* Reset some inputs to initial state.  */
+    qemu_irq_lower(omap_gpio_in_get(cpu->gpio)[PALMTE_USBDETECT_GPIO]);
+    qemu_irq_lower(omap_gpio_in_get(cpu->gpio)[PALMTE_USB_OR_DC_GPIO]);
+    qemu_irq_lower(omap_gpio_in_get(cpu->gpio)[4]);
+    qemu_irq_lower(omap_gpio_in_get(cpu->gpio)[PALMTE_HEADPHONES_GPIO]);
+    qemu_irq_lower(omap_mpuio_in_get(cpu->mpuio)[PALMTE_DC_GPIO]);
+    qemu_irq_raise(omap_mpuio_in_get(cpu->mpuio)[6]);
+    qemu_irq_raise(omap_mpuio_in_get(cpu->mpuio)[7]);
+    qemu_irq_raise(omap_mpuio_in_get(cpu->mpuio)[11]);
+}
+
+static void palmte_init(int ram_size, int vga_ram_size,
+                const char *boot_device, DisplayState *ds,
                 const char *kernel_filename, const char *kernel_cmdline,
                 const char *initrd_filename, const char *cpu_model)
 {
@@ -101,6 +223,10 @@ static void palmte_init(int ram_size, int vga_ram_size, int boot_device,
 
     palmte_microwire_setup(cpu);
 
+    qemu_add_kbd_event_handler(palmte_button_event, cpu);
+
+    palmte_gpio_setup(cpu);
+
     /* Setup initial (reset) machine state */
     if (nb_option_roms) {
         rom_size = get_image_size(option_rom[0]);
diff --git a/hw/parallel.c b/hw/parallel.c
index bda3f3a20..5d99e7655 100644
--- a/hw/parallel.c
+++ b/hw/parallel.c
@@ -22,7 +22,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "qemu-char.h"
+#include "isa.h"
+#include "pc.h"
 
 //#define DEBUG_PARALLEL
 
@@ -455,45 +458,45 @@ ParallelState *parallel_init(int base, qemu_irq irq, CharDriverState *chr)
 }
 
 /* Memory mapped interface */
-uint32_t parallel_mm_readb (void *opaque, target_phys_addr_t addr)
+static uint32_t parallel_mm_readb (void *opaque, target_phys_addr_t addr)
 {
     ParallelState *s = opaque;
 
     return parallel_ioport_read_sw(s, (addr - s->base) >> s->it_shift) & 0xFF;
 }
 
-void parallel_mm_writeb (void *opaque,
-                       target_phys_addr_t addr, uint32_t value)
+static void parallel_mm_writeb (void *opaque,
+                                target_phys_addr_t addr, uint32_t value)
 {
     ParallelState *s = opaque;
 
     parallel_ioport_write_sw(s, (addr - s->base) >> s->it_shift, value & 0xFF);
 }
 
-uint32_t parallel_mm_readw (void *opaque, target_phys_addr_t addr)
+static uint32_t parallel_mm_readw (void *opaque, target_phys_addr_t addr)
 {
     ParallelState *s = opaque;
 
     return parallel_ioport_read_sw(s, (addr - s->base) >> s->it_shift) & 0xFFFF;
 }
 
-void parallel_mm_writew (void *opaque,
-                       target_phys_addr_t addr, uint32_t value)
+static void parallel_mm_writew (void *opaque,
+                                target_phys_addr_t addr, uint32_t value)
 {
     ParallelState *s = opaque;
 
     parallel_ioport_write_sw(s, (addr - s->base) >> s->it_shift, value & 0xFFFF);
 }
 
-uint32_t parallel_mm_readl (void *opaque, target_phys_addr_t addr)
+static uint32_t parallel_mm_readl (void *opaque, target_phys_addr_t addr)
 {
     ParallelState *s = opaque;
 
     return parallel_ioport_read_sw(s, (addr - s->base) >> s->it_shift);
 }
 
-void parallel_mm_writel (void *opaque,
-                       target_phys_addr_t addr, uint32_t value)
+static void parallel_mm_writel (void *opaque,
+                                target_phys_addr_t addr, uint32_t value)
 {
     ParallelState *s = opaque;
 
diff --git a/hw/pc.c b/hw/pc.c
index 830cfb894..dde40c369 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -21,7 +21,17 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "pc.h"
+#include "fdc.h"
+#include "pci.h"
+#include "block.h"
+#include "sysemu.h"
+#include "audio/audio.h"
+#include "net.h"
+#include "smbus.h"
+#include "boards.h"
+
 #ifdef USE_KVM
 #include "qemu-kvm.h"
 extern int kvm_allowed;
@@ -37,6 +47,8 @@ extern int kvm_allowed;
 /* Leave a chunk of memory at the top of RAM for the BIOS ACPI tables.  */
 #define ACPI_DATA_SIZE       0x10000
 
+#define MAX_IDE_BUS 2
+
 static fdctrl_t *floppy_controller;
 static RTCState *rtc_state;
 static PITState *pit;
@@ -156,10 +168,30 @@ static void cmos_init_hd(int type_ofs, int info_ofs, BlockDriverState *hd)
     rtc_set_memory(s, info_ofs + 8, sectors);
 }
 
+/* convert boot_device letter to something recognizable by the bios */
+static int boot_device2nibble(char boot_device)
+{
+    switch(boot_device) {
+    case 'a':
+    case 'b':
+        return 0x01; /* floppy boot */
+    case 'c':
+        return 0x02; /* hard drive boot */
+    case 'd':
+        return 0x03; /* CD-ROM boot */
+    case 'n':
+        return 0x04; /* Network boot */
+    }
+    return 0;
+}
+
 /* hd_table must contain 4 block drivers */
-static void cmos_init(ram_addr_t ram_size, ram_addr_t above_4g_mem_size, int boot_device, BlockDriverState **hd_table, int smp_cpus)
+static void cmos_init(ram_addr_t ram_size, ram_addr_t above_4g_mem_size,
+                      const char *boot_device, BlockDriverState **hd_table,
+                      int smp_cpus)
 {
     RTCState *s = rtc_state;
+    int nbds, bds[3] = { 0, };
     int val;
     int fd0, fd1, nb;
     int i;
@@ -195,24 +227,23 @@ static void cmos_init(ram_addr_t ram_size, ram_addr_t above_4g_mem_size, int boo
     rtc_set_memory(s, 0x34, val);
     rtc_set_memory(s, 0x35, val >> 8);
 
-    switch(boot_device) {
-    case 'a':
-    case 'b':
-        rtc_set_memory(s, 0x3d, 0x01); /* floppy boot */
-        if (!fd_bootchk)
-            rtc_set_memory(s, 0x38, 0x01); /* disable signature check */
-        break;
-    default:
-    case 'c':
-        rtc_set_memory(s, 0x3d, 0x02); /* hard drive boot */
-        break;
-    case 'd':
-        rtc_set_memory(s, 0x3d, 0x03); /* CD-ROM boot */
-        break;
-    case 'n':
-        rtc_set_memory(s, 0x3d, 0x04); /* Network boot */
-        break;
+    /* set boot devices, and disable floppy signature check if requested */
+#define PC_MAX_BOOT_DEVICES 3
+    nbds = strlen(boot_device);
+    if (nbds > PC_MAX_BOOT_DEVICES) {
+        fprintf(stderr, "Too many boot devices for PC\n");
+        exit(1);
     }
+    for (i = 0; i < nbds; i++) {
+        bds[i] = boot_device2nibble(boot_device[i]);
+        if (bds[i] == 0) {
+            fprintf(stderr, "Invalid boot device for PC: '%c'\n",
+                    boot_device[i]);
+            exit(1);
+        }
+    }
+    rtc_set_memory(s, 0x3d, (bds[1] << 4) | bds[0]);
+    rtc_set_memory(s, 0x38, (bds[2] << 4) | (fd_bootchk ?  0x0 : 0x1));
 
     /* floppy type */
 
@@ -302,7 +333,7 @@ static uint32_t ioport92_read(void *opaque, uint32_t addr)
 /***********************************************************/
 /* Bochs BIOS debug ports */
 
-void bochs_bios_write(void *opaque, uint32_t addr, uint32_t val)
+static void bochs_bios_write(void *opaque, uint32_t addr, uint32_t val)
 {
     static const char shutdown_str[8] = "Shutdown";
     static int shutdown_index = 0;
@@ -346,7 +377,7 @@ void bochs_bios_write(void *opaque, uint32_t addr, uint32_t val)
     }
 }
 
-void bochs_bios_init(void)
+static void bochs_bios_init(void)
 {
     register_ioport_write(0x400, 1, 2, bochs_bios_write, NULL);
     register_ioport_write(0x401, 1, 2, bochs_bios_write, NULL);
@@ -366,8 +397,10 @@ static void generate_bootsect(uint32_t gpr[8], uint16_t segs[6], uint16_t ip)
 {
     uint8_t bootsect[512], *p;
     int i;
+    int hda;
 
-    if (bs_table[0] == NULL) {
+    hda = drive_get_index(IF_IDE, 0, 0);
+    if (hda == -1) {
 	fprintf(stderr, "A disk image must be given for 'hda' when booting "
 		"a Linux kernel\n");
 	exit(1);
@@ -376,7 +409,7 @@ static void generate_bootsect(uint32_t gpr[8], uint16_t segs[6], uint16_t ip)
     memset(bootsect, 0, sizeof(bootsect));
 
     /* Copy the MSDOS partition table if possible */
-    bdrv_read(bs_table[0], 0, bootsect, 1);
+    bdrv_read(drives_table[hda].bdrv, 0, bootsect, 1);
 
     /* Make sure we have a partition signature */
     bootsect[510] = 0x55;
@@ -413,11 +446,11 @@ static void generate_bootsect(uint32_t gpr[8], uint16_t segs[6], uint16_t ip)
     *p++ = segs[1];		/* CS */
     *p++ = segs[1] >> 8;
 
-    bdrv_set_boot_sector(bs_table[0], bootsect, sizeof(bootsect));
+    bdrv_set_boot_sector(drives_table[hda].bdrv, bootsect, sizeof(bootsect));
 }
 
-int load_kernel(const char *filename, uint8_t *addr,
-                uint8_t *real_addr)
+static int load_kernel(const char *filename, uint8_t *addr,
+                       uint8_t *real_addr)
 {
     int fd, size;
     int setup_sects;
@@ -488,7 +521,9 @@ static void load_linux(const char *kernel_filename,
     }
 
     /* kernel protocol version */
+#if 0
     fprintf(stderr, "header magic: %#x\n", ldl_p(header+0x202));
+#endif
     if (ldl_p(header+0x202) == 0x53726448)
 	protocol = lduw_p(header+0x206);
     else
@@ -511,6 +546,7 @@ static void load_linux(const char *kernel_filename,
 	prot_addr    = phys_ram_base + 0x100000;
     }
 
+#if 0
     fprintf(stderr,
 	    "qemu: real_addr     = %#zx\n"
 	    "qemu: cmdline_addr  = %#zx\n"
@@ -518,6 +554,7 @@ static void load_linux(const char *kernel_filename,
 	    real_addr-phys_ram_base,
 	    cmdline_addr-phys_ram_base,
 	    prot_addr-phys_ram_base);
+#endif
 
     /* highest address for loading the initrd */
     if (protocol >= 0x203)
@@ -529,7 +566,7 @@ static void load_linux(const char *kernel_filename,
 	initrd_max = ram_size-ACPI_DATA_SIZE-1;
 
     /* kernel command line */
-    pstrcpy(cmdline_addr, 4096, kernel_cmdline);
+    pstrcpy((char*)cmdline_addr, 4096, kernel_cmdline);
 
     if (protocol >= 0x202) {
 	stl_p(header+0x228, cmdline_addr-phys_ram_base);
@@ -679,11 +716,11 @@ extern int kvm_allowed;
 #endif
 
 /* PC hardware initialisation */
-static void pc_init1(ram_addr_t ram_size, int vga_ram_size, int boot_device,
-                     DisplayState *ds, const char **fd_filename, int snapshot,
+static void pc_init1(ram_addr_t ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
                      const char *kernel_filename, const char *kernel_cmdline,
                      const char *initrd_filename,
-                     int pci_enabled)
+                     int pci_enabled, const char *cpu_model)
 {
     char buf[1024];
     int ret, linux_boot, i;
@@ -696,6 +733,9 @@ static void pc_init1(ram_addr_t ram_size, int vga_ram_size, int boot_device,
     NICInfo *nd;
     qemu_irq *cpu_irq;
     qemu_irq *i8259;
+    int index;
+    BlockDriverState *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
+    BlockDriverState *fd[MAX_FD];
 
     if (ram_size >= 0xe0000000 ) {
         above_4g_mem_size = ram_size - 0xe0000000;
@@ -705,8 +745,20 @@ static void pc_init1(ram_addr_t ram_size, int vga_ram_size, int boot_device,
     linux_boot = (kernel_filename != NULL);
 
     /* init CPUs */
+    if (cpu_model == NULL) {
+#ifdef TARGET_X86_64
+        cpu_model = "qemu64";
+#else
+        cpu_model = "qemu32";
+#endif
+    }
+    
     for(i = 0; i < smp_cpus; i++) {
-        env = cpu_init();
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find x86 CPU definition\n");
+            exit(1);
+        }
         if (i != 0)
             env->hflags |= HF_HALTED_MASK;
         if (smp_cpus > 1) {
@@ -745,7 +797,9 @@ static void pc_init1(ram_addr_t ram_size, int vga_ram_size, int boot_device,
     vga_ram_addr = qemu_ram_alloc(vga_ram_size);
 
     /* BIOS load */
-    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME);
+    if (bios_name == NULL)
+        bios_name = BIOS_FILENAME;
+    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
     bios_size = get_image_size(buf);
     if (bios_size <= 0 ||
         (bios_size % 65536) != 0) {
@@ -973,12 +1027,26 @@ static void pc_init1(ram_addr_t ram_size, int vga_ram_size, int boot_device,
 #ifdef USE_HYPERCALL
     pci_hypercall_init(pci_bus);
 #endif
+
+    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {
+        fprintf(stderr, "qemu: too many IDE bus\n");
+        exit(1);
+    }
+
+    for(i = 0; i < MAX_IDE_BUS * MAX_IDE_DEVS; i++) {
+        index = drive_get_index(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
+	if (index != -1)
+	    hd[i] = drives_table[index].bdrv;
+	else
+	    hd[i] = NULL;
+    }
+
     if (pci_enabled) {
-        pci_piix3_ide_init(pci_bus, bs_table, piix3_devfn + 1, i8259);
+        pci_piix3_ide_init(pci_bus, hd, piix3_devfn + 1, i8259);
     } else {
-        for(i = 0; i < 2; i++) {
+        for(i = 0; i < MAX_IDE_BUS; i++) {
             isa_ide_init(ide_iobase[i], ide_iobase2[i], i8259[ide_irq[i]],
-                         bs_table[2 * i], bs_table[2 * i + 1]);
+	                 hd[MAX_IDE_DEVS * i], hd[MAX_IDE_DEVS * i + 1]);
         }
     }
 
@@ -988,9 +1056,16 @@ static void pc_init1(ram_addr_t ram_size, int vga_ram_size, int boot_device,
     audio_init(pci_enabled ? pci_bus : NULL, i8259);
 #endif
 
-    floppy_controller = fdctrl_init(i8259[6], 2, 0, 0x3f0, fd_table);
+    for(i = 0; i < MAX_FD; i++) {
+        index = drive_get_index(IF_FLOPPY, 0, i);
+	if (index != -1)
+	    fd[i] = drives_table[index].bdrv;
+	else
+	    fd[i] = NULL;
+    }
+    floppy_controller = fdctrl_init(i8259[6], 2, 0, 0x3f0, fd);
 
-    cmos_init(ram_size, above_4g_mem_size, boot_device, bs_table, smp_cpus);
+    cmos_init(ram_size, above_4g_mem_size, boot_device, hd, smp_cpus);
 
     if (pci_enabled && usb_enabled) {
         usb_uhci_piix3_init(pci_bus, piix3_devfn + 2);
@@ -1010,51 +1085,48 @@ static void pc_init1(ram_addr_t ram_size, int vga_ram_size, int boot_device,
     if (i440fx_state) {
         i440fx_init_memory_mappings(i440fx_state);
     }
-#if 0
-    /* ??? Need to figure out some way for the user to
-       specify SCSI devices.  */
+
     if (pci_enabled) {
+	int max_bus;
+        int bus, unit;
         void *scsi;
-        BlockDriverState *bdrv;
-
-        scsi = lsi_scsi_init(pci_bus, -1);
-        bdrv = bdrv_new("scsidisk");
-        bdrv_open(bdrv, "scsi_disk.img", 0);
-        lsi_scsi_attach(scsi, bdrv, -1);
-        bdrv = bdrv_new("scsicd");
-        bdrv_open(bdrv, "scsi_cd.iso", 0);
-        bdrv_set_type_hint(bdrv, BDRV_TYPE_CDROM);
-        lsi_scsi_attach(scsi, bdrv, -1);
+
+        max_bus = drive_get_max_bus(IF_SCSI);
+
+	for (bus = 0; bus <= max_bus; bus++) {
+            scsi = lsi_scsi_init(pci_bus, -1);
+            for (unit = 0; unit < LSI_MAX_DEVS; unit++) {
+	        index = drive_get_index(IF_SCSI, bus, unit);
+		if (index == -1)
+		    continue;
+		lsi_scsi_attach(scsi, drives_table[index].bdrv, unit);
+	    }
+        }
     }
-#endif
 }
 
-static void pc_init_pci(ram_addr_t ram_size, int vga_ram_size, int boot_device,
-                        DisplayState *ds, const char **fd_filename,
-                        int snapshot,
+static void pc_init_pci(ram_addr_t ram_size, int vga_ram_size,
+                        const char *boot_device, DisplayState *ds,
                         const char *kernel_filename,
                         const char *kernel_cmdline,
                         const char *initrd_filename,
                         const char *cpu_model)
 {
-    pc_init1(ram_size, vga_ram_size, boot_device,
-             ds, fd_filename, snapshot,
+    pc_init1(ram_size, vga_ram_size, boot_device, ds,
              kernel_filename, kernel_cmdline,
-             initrd_filename, 1);
+             initrd_filename, 1, cpu_model);
 }
 
-static void pc_init_isa(ram_addr_t ram_size, int vga_ram_size, int boot_device,
-                        DisplayState *ds, const char **fd_filename,
-                        int snapshot,
+static void pc_init_isa(ram_addr_t ram_size, int vga_ram_size,
+                        const char *boot_device, DisplayState *ds,
                         const char *kernel_filename,
                         const char *kernel_cmdline,
                         const char *initrd_filename,
                         const char *cpu_model)
 {
-    pc_init1(ram_size, vga_ram_size, boot_device,
-             ds, fd_filename, snapshot,
+    pc_init1(ram_size, vga_ram_size, boot_device, ds,
              kernel_filename, kernel_cmdline,
-             initrd_filename, 0);
+             initrd_filename, 0, cpu_model);
 }
 
 QEMUMachine pc_machine = {
diff --git a/hw/pc.h b/hw/pc.h
new file mode 100644
index 000000000..beb711c0c
--- /dev/null
+++ b/hw/pc.h
@@ -0,0 +1,145 @@
+#ifndef HW_PC_H
+#define HW_PC_H
+/* PC-style peripherals (also used by other machines).  */
+
+/* serial.c */
+
+SerialState *serial_init(int base, qemu_irq irq, CharDriverState *chr);
+SerialState *serial_mm_init (target_phys_addr_t base, int it_shift,
+                             qemu_irq irq, CharDriverState *chr,
+                             int ioregister);
+uint32_t serial_mm_readb (void *opaque, target_phys_addr_t addr);
+void serial_mm_writeb (void *opaque, target_phys_addr_t addr, uint32_t value);
+uint32_t serial_mm_readw (void *opaque, target_phys_addr_t addr);
+void serial_mm_writew (void *opaque, target_phys_addr_t addr, uint32_t value);
+uint32_t serial_mm_readl (void *opaque, target_phys_addr_t addr);
+void serial_mm_writel (void *opaque, target_phys_addr_t addr, uint32_t value);
+
+/* parallel.c */
+
+typedef struct ParallelState ParallelState;
+ParallelState *parallel_init(int base, qemu_irq irq, CharDriverState *chr);
+ParallelState *parallel_mm_init(target_phys_addr_t base, int it_shift, qemu_irq irq, CharDriverState *chr);
+
+/* i8259.c */
+
+typedef struct PicState2 PicState2;
+extern PicState2 *isa_pic;
+void pic_set_irq(int irq, int level);
+void pic_set_irq_new(void *opaque, int irq, int level);
+qemu_irq *i8259_init(qemu_irq parent_irq);
+void pic_set_alt_irq_func(PicState2 *s, SetIRQFunc *alt_irq_func,
+                          void *alt_irq_opaque);
+int pic_read_irq(PicState2 *s);
+void pic_update_irq(PicState2 *s);
+uint32_t pic_intack_read(PicState2 *s);
+void pic_info(void);
+void irq_info(void);
+
+/* APIC */
+typedef struct IOAPICState IOAPICState;
+
+int apic_init(CPUState *env);
+int apic_accept_pic_intr(CPUState *env);
+int apic_get_interrupt(CPUState *env);
+IOAPICState *ioapic_init(void);
+void ioapic_set_irq(void *opaque, int vector, int level);
+
+/* i8254.c */
+
+#define PIT_FREQ 1193182
+
+typedef struct PITState PITState;
+
+PITState *pit_init(int base, qemu_irq irq);
+void pit_set_gate(PITState *pit, int channel, int val);
+int pit_get_gate(PITState *pit, int channel);
+int pit_get_initial_count(PITState *pit, int channel);
+int pit_get_mode(PITState *pit, int channel);
+int pit_get_out(PITState *pit, int channel, int64_t current_time);
+
+/* vmport.c */
+void vmport_init(CPUState *env);
+void vmport_register(unsigned char command, IOPortReadFunc *func, void *opaque);
+
+/* vmmouse.c */
+void *vmmouse_init(void *m);
+
+/* pckbd.c */
+
+void i8042_init(qemu_irq kbd_irq, qemu_irq mouse_irq, uint32_t io_base);
+void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq,
+                   target_phys_addr_t base, int it_shift);
+
+/* mc146818rtc.c */
+
+typedef struct RTCState RTCState;
+
+RTCState *rtc_init(int base, qemu_irq irq);
+RTCState *rtc_mm_init(target_phys_addr_t base, int it_shift, qemu_irq irq);
+void rtc_set_memory(RTCState *s, int addr, int val);
+void rtc_set_date(RTCState *s, const struct tm *tm);
+
+/* pc.c */
+extern int fd_bootchk;
+
+void ioport_set_a20(int enable);
+int ioport_get_a20(void);
+
+/* acpi.c */
+extern int acpi_enabled;
+i2c_bus *piix4_pm_init(PCIBus *bus, int devfn, uint32_t smb_io_base);
+void piix4_smbus_register_device(SMBusDevice *dev, uint8_t addr);
+void acpi_bios_init(void);
+
+/* pcspk.c */
+void pcspk_init(PITState *);
+int pcspk_audio_init(AudioState *, qemu_irq *pic);
+
+/* piix_pci.c */
+PCIBus *i440fx_init(PCIDevice **pi440fx_state, qemu_irq *pic);
+void i440fx_set_smm(PCIDevice *d, int val);
+int piix3_init(PCIBus *bus, int devfn);
+void i440fx_init_memory_mappings(PCIDevice *d);
+
+int piix4_init(PCIBus *bus, int devfn);
+
+/* vga.c */
+
+#ifndef TARGET_SPARC
+#define VGA_RAM_SIZE (8192 * 1024)
+#else
+#define VGA_RAM_SIZE (9 * 1024 * 1024)
+#endif
+
+int isa_vga_init(DisplayState *ds, uint8_t *vga_ram_base,
+                 unsigned long vga_ram_offset, int vga_ram_size);
+int pci_vga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
+                 unsigned long vga_ram_offset, int vga_ram_size,
+                 unsigned long vga_bios_offset, int vga_bios_size);
+int isa_vga_mm_init(DisplayState *ds, uint8_t *vga_ram_base,
+                    unsigned long vga_ram_offset, int vga_ram_size,
+                    target_phys_addr_t vram_base, target_phys_addr_t ctrl_base,
+                    int it_shift);
+
+/* cirrus_vga.c */
+void pci_cirrus_vga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
+                         unsigned long vga_ram_offset, int vga_ram_size);
+void isa_cirrus_vga_init(DisplayState *ds, uint8_t *vga_ram_base,
+                         unsigned long vga_ram_offset, int vga_ram_size);
+
+/* ide.c */
+void isa_ide_init(int iobase, int iobase2, qemu_irq irq,
+                  BlockDriverState *hd0, BlockDriverState *hd1);
+void pci_cmd646_ide_init(PCIBus *bus, BlockDriverState **hd_table,
+                         int secondary_ide_enabled);
+void pci_piix3_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
+                        qemu_irq *pic);
+void pci_piix4_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
+                        qemu_irq *pic);
+
+/* ne2000.c */
+
+void isa_ne2000_init(int base, qemu_irq irq, NICInfo *nd);
+
+#endif
diff --git a/hw/pci.c b/hw/pci.c
index 825b17b62..f8cbf1a32 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "pci.h"
+#include "console.h"
+#include "net.h"
 
 //#define DEBUG_PCI
 
@@ -55,9 +58,9 @@ static void pcibus_save(QEMUFile *f, void *opaque)
     PCIBus *bus = (PCIBus *)opaque;
     int i;
 
-    qemu_put_be32s(f, &bus->nirq);
-    for (i=0; i<bus->nirq; i++)
-        qemu_put_be32s(f, &bus->irq_count[i]);
+    qemu_put_be32(f, bus->nirq);
+    for (i = 0; i < bus->nirq; i++)
+        qemu_put_be32(f, bus->irq_count[i]);
 }
 
 static int  pcibus_load(QEMUFile *f, void *opaque, int version_id)
@@ -68,15 +71,15 @@ static int  pcibus_load(QEMUFile *f, void *opaque, int version_id)
     if (version_id != 1)
         return -EINVAL;
 
-    qemu_get_be32s(f, &nirq);
+    nirq = qemu_get_be32(f);
     if (bus->nirq != nirq) {
         fprintf(stderr, "pcibus_load: nirq mismatch: src=%d dst=%d\n",
                 nirq, bus->nirq);
         return -EINVAL;
     }
 
-    for (i=0; i<nirq; i++)
-        qemu_get_be32s(f, &bus->irq_count[i]);
+    for (i = 0; i < nirq; i++)
+        bus->irq_count[i] = qemu_get_be32(f);
 
     return 0;
 }
@@ -98,7 +101,7 @@ PCIBus *pci_register_bus(pci_set_irq_fn set_irq, pci_map_irq_fn map_irq,
     return bus;
 }
 
-PCIBus *pci_register_secondary_bus(PCIDevice *dev, pci_map_irq_fn map_irq)
+static PCIBus *pci_register_secondary_bus(PCIDevice *dev, pci_map_irq_fn map_irq)
 {
     PCIBus *bus;
     bus = qemu_mallocz(sizeof(PCIBus));
@@ -120,8 +123,8 @@ void pci_device_save(PCIDevice *s, QEMUFile *f)
 
     qemu_put_be32(f, 2); /* PCI device version */
     qemu_put_buffer(f, s->config, 256);
-    for (i=0; i<4; i++)
-        qemu_put_be32s(f, &s->irq_state[i]);
+    for (i = 0; i < 4; i++)
+        qemu_put_be32(f, s->irq_state[i]);
 }
 
 int pci_device_load(PCIDevice *s, QEMUFile *f)
@@ -136,8 +139,8 @@ int pci_device_load(PCIDevice *s, QEMUFile *f)
     pci_update_mappings(s);
 
     if (version_id >= 2)
-        for (i=0; i<4; i++)
-            qemu_get_be32s(f, &s->irq_state[i]);
+        for (i = 0; i < 4; i ++)
+            s->irq_state[i] = qemu_get_be32(f);
 
     return 0;
 }
@@ -203,7 +206,7 @@ void pci_register_io_region(PCIDevice *pci_dev, int region_num,
     *(uint32_t *)(pci_dev->config + addr) = cpu_to_le32(type);
 }
 
-target_phys_addr_t pci_to_cpu_addr(target_phys_addr_t addr)
+static target_phys_addr_t pci_to_cpu_addr(target_phys_addr_t addr)
 {
     return addr + pci_mem_base;
 }
@@ -650,7 +653,7 @@ typedef struct {
     PCIBus *bus;
 } PCIBridge;
 
-void pci_bridge_write_config(PCIDevice *d,
+static void pci_bridge_write_config(PCIDevice *d,
                              uint32_t address, uint32_t val, int len)
 {
     PCIBridge *s = (PCIBridge *)d;
diff --git a/hw/pci.h b/hw/pci.h
new file mode 100644
index 000000000..96bb2136d
--- /dev/null
+++ b/hw/pci.h
@@ -0,0 +1,139 @@
+#ifndef QEMU_PCI_H
+#define QEMU_PCI_H
+
+/* PCI includes legacy ISA access.  */
+#include "isa.h"
+
+/* PCI bus */
+
+extern target_phys_addr_t pci_mem_base;
+
+typedef void PCIConfigWriteFunc(PCIDevice *pci_dev,
+                                uint32_t address, uint32_t data, int len);
+typedef uint32_t PCIConfigReadFunc(PCIDevice *pci_dev,
+                                   uint32_t address, int len);
+typedef void PCIMapIORegionFunc(PCIDevice *pci_dev, int region_num,
+                                uint32_t addr, uint32_t size, int type);
+
+#define PCI_ADDRESS_SPACE_MEM		0x00
+#define PCI_ADDRESS_SPACE_IO		0x01
+#define PCI_ADDRESS_SPACE_MEM_PREFETCH	0x08
+
+typedef struct PCIIORegion {
+    uint32_t addr; /* current PCI mapping address. -1 means not mapped */
+    uint32_t size;
+    uint8_t type;
+    PCIMapIORegionFunc *map_func;
+} PCIIORegion;
+
+#define PCI_ROM_SLOT 6
+#define PCI_NUM_REGIONS 7
+
+#define PCI_DEVICES_MAX 64
+
+#define PCI_VENDOR_ID		0x00	/* 16 bits */
+#define PCI_DEVICE_ID		0x02	/* 16 bits */
+#define PCI_COMMAND		0x04	/* 16 bits */
+#define  PCI_COMMAND_IO		0x1	/* Enable response in I/O space */
+#define  PCI_COMMAND_MEMORY	0x2	/* Enable response in Memory space */
+#define PCI_CLASS_DEVICE        0x0a    /* Device class */
+#define PCI_INTERRUPT_LINE	0x3c	/* 8 bits */
+#define PCI_INTERRUPT_PIN	0x3d	/* 8 bits */
+#define PCI_MIN_GNT		0x3e	/* 8 bits */
+#define PCI_MAX_LAT		0x3f	/* 8 bits */
+
+struct PCIDevice {
+    /* PCI config space */
+    uint8_t config[256];
+
+    /* the following fields are read only */
+    PCIBus *bus;
+    int devfn;
+    char name[64];
+    PCIIORegion io_regions[PCI_NUM_REGIONS];
+
+    /* do not access the following fields */
+    PCIConfigReadFunc *config_read;
+    PCIConfigWriteFunc *config_write;
+    /* ??? This is a PC-specific hack, and should be removed.  */
+    int irq_index;
+
+    /* IRQ objects for the INTA-INTD pins.  */
+    qemu_irq *irq;
+
+    /* Current IRQ levels.  Used internally by the generic PCI code.  */
+    int irq_state[4];
+};
+
+PCIDevice *pci_register_device(PCIBus *bus, const char *name,
+                               int instance_size, int devfn,
+                               PCIConfigReadFunc *config_read,
+                               PCIConfigWriteFunc *config_write);
+
+void pci_register_io_region(PCIDevice *pci_dev, int region_num,
+                            uint32_t size, int type,
+                            PCIMapIORegionFunc *map_func);
+
+uint32_t pci_default_read_config(PCIDevice *d,
+                                 uint32_t address, int len);
+void pci_default_write_config(PCIDevice *d,
+                              uint32_t address, uint32_t val, int len);
+void pci_device_save(PCIDevice *s, QEMUFile *f);
+int pci_device_load(PCIDevice *s, QEMUFile *f);
+
+typedef void (*pci_set_irq_fn)(qemu_irq *pic, int irq_num, int level);
+typedef int (*pci_map_irq_fn)(PCIDevice *pci_dev, int irq_num);
+PCIBus *pci_register_bus(pci_set_irq_fn set_irq, pci_map_irq_fn map_irq,
+                         qemu_irq *pic, int devfn_min, int nirq);
+
+void pci_nic_init(PCIBus *bus, NICInfo *nd, int devfn);
+void pci_data_write(void *opaque, uint32_t addr, uint32_t val, int len);
+uint32_t pci_data_read(void *opaque, uint32_t addr, int len);
+int pci_bus_num(PCIBus *s);
+void pci_for_each_device(int bus_num, void (*fn)(PCIDevice *d));
+
+void pci_info(void);
+PCIBus *pci_bridge_init(PCIBus *bus, int devfn, uint32_t id,
+                        pci_map_irq_fn map_irq, const char *name);
+
+/* lsi53c895a.c */
+#define LSI_MAX_DEVS 7
+void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id);
+void *lsi_scsi_init(PCIBus *bus, int devfn);
+
+/* vmware_vga.c */
+void pci_vmsvga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
+                     unsigned long vga_ram_offset, int vga_ram_size);
+
+/* usb-uhci.c */
+void usb_uhci_piix3_init(PCIBus *bus, int devfn);
+void usb_uhci_piix4_init(PCIBus *bus, int devfn);
+
+/* usb-ohci.c */
+void usb_ohci_init_pci(struct PCIBus *bus, int num_ports, int devfn);
+
+/* eepro100.c */
+
+void pci_i82551_init(PCIBus *bus, NICInfo *nd, int devfn);
+void pci_i82557b_init(PCIBus *bus, NICInfo *nd, int devfn);
+void pci_i82559er_init(PCIBus *bus, NICInfo *nd, int devfn);
+
+/* ne2000.c */
+
+void pci_ne2000_init(PCIBus *bus, NICInfo *nd, int devfn);
+
+/* rtl8139.c */
+
+void pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn);
+
+/* pcnet.c */
+void pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn);
+
+/* prep_pci.c */
+PCIBus *pci_prep_init(qemu_irq *pic);
+
+/* apb_pci.c */
+PCIBus *pci_apb_init(target_phys_addr_t special_base, target_phys_addr_t mem_base,
+                     qemu_irq *pic);
+
+#endif
diff --git a/hw/pckbd.c b/hw/pckbd.c
index ff4916d21..266c7f9b1 100644
--- a/hw/pckbd.c
+++ b/hw/pckbd.c
@@ -21,7 +21,11 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "isa.h"
+#include "pc.h"
+#include "ps2.h"
+#include "sysemu.h"
 
 /* debug PC keyboard */
 //#define DEBUG_KBD
@@ -207,7 +211,7 @@ static void kbd_write_command(void *opaque, uint32_t addr, uint32_t val)
 #endif
     switch(val) {
     case KBD_CCMD_READ_MODE:
-        kbd_queue(s, s->mode, 0);
+        kbd_queue(s, s->mode, 1);
         break;
     case KBD_CCMD_WRITE_MODE:
     case KBD_CCMD_WRITE_OBUF:
@@ -286,7 +290,7 @@ static uint32_t kbd_read_data(void *opaque, uint32_t addr)
     return ps2_read_data(s->kbd);
 }
 
-void kbd_write_data(void *opaque, uint32_t addr, uint32_t val)
+static void kbd_write_data(void *opaque, uint32_t addr, uint32_t val)
 {
     KBDState *s = opaque;
 
@@ -381,7 +385,7 @@ void i8042_init(qemu_irq kbd_irq, qemu_irq mouse_irq, uint32_t io_base)
 }
 
 /* Memory mapped interface */
-uint32_t kbd_mm_readb (void *opaque, target_phys_addr_t addr)
+static uint32_t kbd_mm_readb (void *opaque, target_phys_addr_t addr)
 {
     KBDState *s = opaque;
 
@@ -395,7 +399,7 @@ uint32_t kbd_mm_readb (void *opaque, target_phys_addr_t addr)
     }
 }
 
-void kbd_mm_writeb (void *opaque, target_phys_addr_t addr, uint32_t value)
+static void kbd_mm_writeb (void *opaque, target_phys_addr_t addr, uint32_t value)
 {
     KBDState *s = opaque;
 
diff --git a/hw/pcmcia.h b/hw/pcmcia.h
new file mode 100644
index 000000000..bfa23babe
--- /dev/null
+++ b/hw/pcmcia.h
@@ -0,0 +1,50 @@
+/* PCMCIA/Cardbus */
+
+struct pcmcia_socket_s {
+    qemu_irq irq;
+    int attached;
+    const char *slot_string;
+    const char *card_string;
+};
+
+void pcmcia_socket_register(struct pcmcia_socket_s *socket);
+void pcmcia_socket_unregister(struct pcmcia_socket_s *socket);
+void pcmcia_info(void);
+
+struct pcmcia_card_s {
+    void *state;
+    struct pcmcia_socket_s *slot;
+    int (*attach)(void *state);
+    int (*detach)(void *state);
+    const uint8_t *cis;
+    int cis_len;
+
+    /* Only valid if attached */
+    uint8_t (*attr_read)(void *state, uint32_t address);
+    void (*attr_write)(void *state, uint32_t address, uint8_t value);
+    uint16_t (*common_read)(void *state, uint32_t address);
+    void (*common_write)(void *state, uint32_t address, uint16_t value);
+    uint16_t (*io_read)(void *state, uint32_t address);
+    void (*io_write)(void *state, uint32_t address, uint16_t value);
+};
+
+#define CISTPL_DEVICE		0x01	/* 5V Device Information Tuple */
+#define CISTPL_NO_LINK		0x14	/* No Link Tuple */
+#define CISTPL_VERS_1		0x15	/* Level 1 Version Tuple */
+#define CISTPL_JEDEC_C		0x18	/* JEDEC ID Tuple */
+#define CISTPL_JEDEC_A		0x19	/* JEDEC ID Tuple */
+#define CISTPL_CONFIG		0x1a	/* Configuration Tuple */
+#define CISTPL_CFTABLE_ENTRY	0x1b	/* 16-bit PCCard Configuration */
+#define CISTPL_DEVICE_OC	0x1c	/* Additional Device Information */
+#define CISTPL_DEVICE_OA	0x1d	/* Additional Device Information */
+#define CISTPL_DEVICE_GEO	0x1e	/* Additional Device Information */
+#define CISTPL_DEVICE_GEO_A	0x1f	/* Additional Device Information */
+#define CISTPL_MANFID		0x20	/* Manufacture ID Tuple */
+#define CISTPL_FUNCID		0x21	/* Function ID Tuple */
+#define CISTPL_FUNCE		0x22	/* Function Extension Tuple */
+#define CISTPL_END		0xff	/* Tuple End */
+#define CISTPL_ENDMARK		0xff
+
+/* dscm1xxxx.c */
+struct pcmcia_card_s *dscm1xxxx_init(BlockDriverState *bdrv);
+
diff --git a/hw/pcnet.c b/hw/pcnet.c
index 71a05da8d..3466082dc 100644
--- a/hw/pcnet.c
+++ b/hw/pcnet.c
@@ -35,7 +35,10 @@
  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR92C990.txt
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pci.h"
+#include "net.h"
+#include "qemu-timer.h"
 
 //#define PCNET_DEBUG
 //#define PCNET_DEBUG_IO
@@ -1840,9 +1843,9 @@ static void pcnet_save(QEMUFile *f, void *opaque)
     if (s->pci_dev)
         pci_device_save(s->pci_dev, f);
 
-    qemu_put_be32s(f, &s->rap);
-    qemu_put_be32s(f, &s->isr);
-    qemu_put_be32s(f, &s->lnkst);
+    qemu_put_be32(f, s->rap);
+    qemu_put_be32(f, s->isr);
+    qemu_put_be32(f, s->lnkst);
     qemu_put_be32s(f, &s->rdra);
     qemu_put_be32s(f, &s->tdra);
     qemu_put_buffer(f, s->prom, 16);
@@ -1851,10 +1854,10 @@ static void pcnet_save(QEMUFile *f, void *opaque)
     for (i = 0; i < 32; i++)
         qemu_put_be16s(f, &s->bcr[i]);
     qemu_put_be64s(f, &s->timer);
-    qemu_put_be32s(f, &s->xmit_pos);
-    qemu_put_be32s(f, &s->recv_pos);
+    qemu_put_be32(f, s->xmit_pos);
+    qemu_put_be32(f, s->recv_pos);
     qemu_put_buffer(f, s->buffer, 4096);
-    qemu_put_be32s(f, &s->tx_busy);
+    qemu_put_be32(f, s->tx_busy);
     qemu_put_timer(f, s->poll_timer);
 }
 
@@ -1872,9 +1875,9 @@ static int pcnet_load(QEMUFile *f, void *opaque, int version_id)
             return ret;
     }
 
-    qemu_get_be32s(f, &s->rap);
-    qemu_get_be32s(f, &s->isr);
-    qemu_get_be32s(f, &s->lnkst);
+    qemu_get_be32s(f, (uint32_t*)&s->rap);
+    qemu_get_be32s(f, (uint32_t*)&s->isr);
+    qemu_get_be32s(f, (uint32_t*)&s->lnkst);
     qemu_get_be32s(f, &s->rdra);
     qemu_get_be32s(f, &s->tdra);
     qemu_get_buffer(f, s->prom, 16);
@@ -1883,10 +1886,10 @@ static int pcnet_load(QEMUFile *f, void *opaque, int version_id)
     for (i = 0; i < 32; i++)
         qemu_get_be16s(f, &s->bcr[i]);
     qemu_get_be64s(f, &s->timer);
-    qemu_get_be32s(f, &s->xmit_pos);
-    qemu_get_be32s(f, &s->recv_pos);
+    qemu_get_be32s(f, (uint32_t*)&s->xmit_pos);
+    qemu_get_be32s(f, (uint32_t*)&s->recv_pos);
     qemu_get_buffer(f, s->buffer, 4096);
-    qemu_get_be32s(f, &s->tx_busy);
+    qemu_get_be32s(f, (uint32_t*)&s->tx_busy);
     qemu_get_timer(f, s->poll_timer);
 
     return 0;
@@ -2008,6 +2011,7 @@ void pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn)
 /* SPARC32 interface */
 
 #if defined (TARGET_SPARC) && !defined(TARGET_SPARC64) // Avoid compile failure
+#include "sun4m.h"
 
 static void parent_lance_reset(void *opaque, int irq, int level)
 {
diff --git a/hw/pcspk.c b/hw/pcspk.c
index 2cbeff377..9bb248b80 100644
--- a/hw/pcspk.c
+++ b/hw/pcspk.c
@@ -22,7 +22,11 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pc.h"
+#include "isa.h"
+#include "audio/audio.h"
+#include "qemu-timer.h"
 
 #define PCSPK_BUF_LEN 1792
 #define PCSPK_SAMPLE_RATE 32000
diff --git a/hw/pflash_cfi01.c b/hw/pflash_cfi01.c
new file mode 100644
index 000000000..745f5e57c
--- /dev/null
+++ b/hw/pflash_cfi01.c
@@ -0,0 +1,614 @@
+/*
+ *  CFI parallel flash with Intel command set emulation
+ *
+ *  Copyright (c) 2006 Thorsten Zitterell
+ *  Copyright (c) 2005 Jocelyn Mayer
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/*
+ * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
+ * Supported commands/modes are:
+ * - flash read
+ * - flash write
+ * - flash ID read
+ * - sector erase
+ * - CFI queries
+ *
+ * It does not support timings
+ * It does not support flash interleaving
+ * It does not implement software data protection as found in many real chips
+ * It does not implement erase suspend/resume commands
+ * It does not implement multiple sectors erase
+ *
+ * It does not implement much more ...
+ */
+
+#include "hw.h"
+#include "flash.h"
+#include "block.h"
+#include "qemu-timer.h"
+
+#define PFLASH_BUG(fmt, args...) \
+do { \
+    printf("PFLASH: Possible BUG - " fmt, ##args); \
+    exit(1); \
+} while(0)
+
+/* #define PFLASH_DEBUG */
+#ifdef PFLASH_DEBUG
+#define DPRINTF(fmt, args...)                      \
+do {                                               \
+        printf("PFLASH: " fmt , ##args);           \
+} while (0)
+#else
+#define DPRINTF(fmt, args...) do { } while (0)
+#endif
+
+struct pflash_t {
+    BlockDriverState *bs;
+    target_ulong base;
+    target_ulong sector_len;
+    target_ulong total_len;
+    int width;
+    int wcycle; /* if 0, the flash is read normally */
+    int bypass;
+    int ro;
+    uint8_t cmd;
+    uint8_t status;
+    uint16_t ident[4];
+    uint8_t cfi_len;
+    uint8_t cfi_table[0x52];
+    target_ulong counter;
+    QEMUTimer *timer;
+    ram_addr_t off;
+    int fl_mem;
+    void *storage;
+};
+
+static void pflash_timer (void *opaque)
+{
+    pflash_t *pfl = opaque;
+
+    DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
+    /* Reset flash */
+    pfl->status ^= 0x80;
+    if (pfl->bypass) {
+        pfl->wcycle = 2;
+    } else {
+        cpu_register_physical_memory(pfl->base, pfl->total_len,
+                        pfl->off | IO_MEM_ROMD | pfl->fl_mem);
+        pfl->wcycle = 0;
+    }
+    pfl->cmd = 0;
+}
+
+static uint32_t pflash_read (pflash_t *pfl, target_ulong offset, int width)
+{
+    target_ulong boff;
+    uint32_t ret;
+    uint8_t *p;
+
+    ret = -1;
+    offset -= pfl->base;
+    boff = offset & 0xFF; /* why this here ?? */
+
+    if (pfl->width == 2)
+        boff = boff >> 1;
+    else if (pfl->width == 4)
+        boff = boff >> 2;
+
+    DPRINTF("%s: reading offset %08x under cmd %02x\n",
+                    __func__, boff, pfl->cmd);
+
+    switch (pfl->cmd) {
+    case 0x00:
+        /* Flash area read */
+        p = pfl->storage;
+        switch (width) {
+        case 1:
+            ret = p[offset];
+            DPRINTF("%s: data offset %08x %02x\n", __func__, offset, ret);
+            break;
+        case 2:
+#if defined(TARGET_WORDS_BIGENDIAN)
+            ret = p[offset] << 8;
+            ret |= p[offset + 1];
+#else
+            ret = p[offset];
+            ret |= p[offset + 1] << 8;
+#endif
+            DPRINTF("%s: data offset %08x %04x\n", __func__, offset, ret);
+            break;
+        case 4:
+#if defined(TARGET_WORDS_BIGENDIAN)
+            ret = p[offset] << 24;
+            ret |= p[offset + 1] << 16;
+            ret |= p[offset + 2] << 8;
+            ret |= p[offset + 3];
+#else
+            ret = p[offset];
+            ret |= p[offset + 1] << 8;
+            ret |= p[offset + 1] << 8;
+            ret |= p[offset + 2] << 16;
+            ret |= p[offset + 3] << 24;
+#endif
+            DPRINTF("%s: data offset %08x %08x\n", __func__, offset, ret);
+            break;
+        default:
+            DPRINTF("BUG in %s\n", __func__);
+        }
+
+        break;
+    case 0x20: /* Block erase */
+    case 0x50: /* Clear status register */
+    case 0x60: /* Block /un)lock */
+    case 0x70: /* Status Register */
+    case 0xe8: /* Write block */
+        /* Status register read */
+        ret = pfl->status;
+        DPRINTF("%s: status %x\n", __func__, ret);
+        break;
+    case 0x98: /* Query mode */
+        if (boff > pfl->cfi_len)
+            ret = 0;
+        else
+            ret = pfl->cfi_table[boff];
+        break;
+    default:
+        /* This should never happen : reset state & treat it as a read */
+        DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
+        pfl->wcycle = 0;
+        pfl->cmd = 0;
+    }
+    return ret;
+}
+
+/* update flash content on disk */
+static void pflash_update(pflash_t *pfl, int offset,
+                          int size)
+{
+    int offset_end;
+    if (pfl->bs) {
+        offset_end = offset + size;
+        /* round to sectors */
+        offset = offset >> 9;
+        offset_end = (offset_end + 511) >> 9;
+        bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
+                   offset_end - offset);
+    }
+}
+
+static void pflash_write (pflash_t *pfl, target_ulong offset, uint32_t value,
+                          int width)
+{
+    target_ulong boff;
+    uint8_t *p;
+    uint8_t cmd;
+
+    /* WARNING: when the memory area is in ROMD mode, the offset is a
+       ram offset, not a physical address */
+    cmd = value;
+
+    if (pfl->wcycle == 0)
+        offset -= (target_ulong)(long)pfl->storage;
+    else
+        offset -= pfl->base;
+
+    DPRINTF("%s: offset %08x %08x %d wcycle 0x%x\n",
+                    __func__, offset, value, width, pfl->wcycle);
+
+    /* Set the device in I/O access mode */
+    cpu_register_physical_memory(pfl->base, pfl->total_len, pfl->fl_mem);
+    boff = offset & (pfl->sector_len - 1);
+
+    if (pfl->width == 2)
+        boff = boff >> 1;
+    else if (pfl->width == 4)
+        boff = boff >> 2;
+
+    switch (pfl->wcycle) {
+    case 0:
+        /* read mode */
+        switch (cmd) {
+        case 0x00: /* ??? */
+            goto reset_flash;
+        case 0x20: /* Block erase */
+            p = pfl->storage;
+            offset &= ~(pfl->sector_len - 1);
+
+            DPRINTF("%s: block erase at 0x%x bytes 0x%x\n", __func__,
+                            offset, pfl->sector_len);
+
+            memset(p + offset, 0xff, pfl->sector_len);
+            pflash_update(pfl, offset, pfl->sector_len);
+            pfl->status |= 0x80; /* Ready! */
+            break;
+        case 0x50: /* Clear status bits */
+            DPRINTF("%s: Clear status bits\n", __func__);
+            pfl->status = 0x0;
+            goto reset_flash;
+        case 0x60: /* Block (un)lock */
+            DPRINTF("%s: Block unlock\n", __func__);
+            break;
+        case 0x70: /* Status Register */
+            DPRINTF("%s: Read status register\n", __func__);
+            pfl->cmd = cmd;
+            return;
+        case 0x98: /* CFI query */
+            DPRINTF("%s: CFI query\n", __func__);
+            break;
+        case 0xe8: /* Write to buffer */
+            DPRINTF("%s: Write to buffer\n", __func__);
+            pfl->status |= 0x80; /* Ready! */
+            break;
+        case 0xff: /* Read array mode */
+            DPRINTF("%s: Read array mode\n", __func__);
+            goto reset_flash;
+        default:
+            goto error_flash;
+        }
+        pfl->wcycle++;
+        pfl->cmd = cmd;
+        return;
+    case 1:
+        switch (pfl->cmd) {
+        case 0x20: /* Block erase */
+        case 0x28:
+            if (cmd == 0xd0) { /* confirm */
+                pfl->wcycle = 1;
+                pfl->status |= 0x80;
+            } if (cmd == 0xff) { /* read array mode */
+                goto reset_flash;
+            } else
+                goto error_flash;
+
+            break;
+        case 0xe8:
+            DPRINTF("%s: block write of 0x%x bytes\n", __func__, cmd);
+            pfl->counter = cmd;
+            pfl->wcycle++;
+            break;
+        case 0x60:
+            if (cmd == 0xd0) {
+                pfl->wcycle = 0;
+                pfl->status |= 0x80;
+            } else if (cmd == 0x01) {
+                pfl->wcycle = 0;
+                pfl->status |= 0x80;
+            } else if (cmd == 0xff) {
+                goto reset_flash;
+            } else {
+                DPRINTF("%s: Unknown (un)locking command\n", __func__);
+                goto reset_flash;
+            }
+            break;
+        case 0x98:
+            if (cmd == 0xff) {
+                goto reset_flash;
+            } else {
+                DPRINTF("%s: leaving query mode\n", __func__);
+            }
+            break;
+        default:
+            goto error_flash;
+        }
+        return;
+    case 2:
+        switch (pfl->cmd) {
+        case 0xe8: /* Block write */
+            p = pfl->storage;
+            DPRINTF("%s: block write offset 0x%x value 0x%x counter 0x%x\n",
+                            __func__, offset, value, pfl->counter);
+            switch (width) {
+            case 1:
+                p[offset] = value;
+                pflash_update(pfl, offset, 1);
+                break;
+            case 2:
+#if defined(TARGET_WORDS_BIGENDIAN)
+                p[offset] = value >> 8;
+                p[offset + 1] = value;
+#else
+                p[offset] = value;
+                p[offset + 1] = value >> 8;
+#endif
+                pflash_update(pfl, offset, 2);
+                break;
+            case 4:
+#if defined(TARGET_WORDS_BIGENDIAN)
+                p[offset] = value >> 24;
+                p[offset + 1] = value >> 16;
+                p[offset + 2] = value >> 8;
+                p[offset + 3] = value;
+#else
+                p[offset] = value;
+                p[offset + 1] = value >> 8;
+                p[offset + 2] = value >> 16;
+                p[offset + 3] = value >> 24;
+#endif
+                pflash_update(pfl, offset, 4);
+                break;
+            }
+
+            pfl->status |= 0x80;
+
+            if (!pfl->counter) {
+                DPRINTF("%s: block write finished\n", __func__);
+                pfl->wcycle++;
+            }
+
+            pfl->counter--;
+            break;
+        default:
+            goto error_flash;
+        }
+        return;
+    case 3: /* Confirm mode */
+        switch (pfl->cmd) {
+        case 0xe8: /* Block write */
+            if (cmd == 0xd0) {
+                pfl->wcycle = 0;
+                pfl->status |= 0x80;
+            } else {
+                DPRINTF("%s: unknown command for \"write block\"\n", __func__);
+                PFLASH_BUG("Write block confirm");
+                goto reset_flash;
+            }
+            break;
+        default:
+            goto error_flash;
+        }
+        return;
+    default:
+        /* Should never happen */
+        DPRINTF("%s: invalid write state\n",  __func__);
+        goto reset_flash;
+    }
+    return;
+
+ error_flash:
+    printf("%s: Unimplemented flash cmd sequence "
+                    "(offset 0x%x, wcycle 0x%x cmd 0x%x value 0x%x\n",
+                    __func__, offset, pfl->wcycle, pfl->cmd, value);
+
+ reset_flash:
+    cpu_register_physical_memory(pfl->base, pfl->total_len,
+                    pfl->off | IO_MEM_ROMD | pfl->fl_mem);
+
+    pfl->bypass = 0;
+    pfl->wcycle = 0;
+    pfl->cmd = 0;
+    return;
+}
+
+
+static uint32_t pflash_readb (void *opaque, target_phys_addr_t addr)
+{
+    return pflash_read(opaque, addr, 1);
+}
+
+static uint32_t pflash_readw (void *opaque, target_phys_addr_t addr)
+{
+    pflash_t *pfl = opaque;
+
+    return pflash_read(pfl, addr, 2);
+}
+
+static uint32_t pflash_readl (void *opaque, target_phys_addr_t addr)
+{
+    pflash_t *pfl = opaque;
+
+    return pflash_read(pfl, addr, 4);
+}
+
+static void pflash_writeb (void *opaque, target_phys_addr_t addr,
+                           uint32_t value)
+{
+    pflash_write(opaque, addr, value, 1);
+}
+
+static void pflash_writew (void *opaque, target_phys_addr_t addr,
+                           uint32_t value)
+{
+    pflash_t *pfl = opaque;
+
+    pflash_write(pfl, addr, value, 2);
+}
+
+static void pflash_writel (void *opaque, target_phys_addr_t addr,
+                           uint32_t value)
+{
+    pflash_t *pfl = opaque;
+
+    pflash_write(pfl, addr, value, 4);
+}
+
+static CPUWriteMemoryFunc *pflash_write_ops[] = {
+    &pflash_writeb,
+    &pflash_writew,
+    &pflash_writel,
+};
+
+static CPUReadMemoryFunc *pflash_read_ops[] = {
+    &pflash_readb,
+    &pflash_readw,
+    &pflash_readl,
+};
+
+/* Count trailing zeroes of a 32 bits quantity */
+static int ctz32 (uint32_t n)
+{
+    int ret;
+
+    ret = 0;
+    if (!(n & 0xFFFF)) {
+        ret += 16;
+        n = n >> 16;
+    }
+    if (!(n & 0xFF)) {
+        ret += 8;
+        n = n >> 8;
+    }
+    if (!(n & 0xF)) {
+        ret += 4;
+        n = n >> 4;
+    }
+    if (!(n & 0x3)) {
+        ret += 2;
+        n = n >> 2;
+    }
+    if (!(n & 0x1)) {
+        ret++;
+        n = n >> 1;
+    }
+#if 0 /* This is not necessary as n is never 0 */
+    if (!n)
+        ret++;
+#endif
+
+    return ret;
+}
+
+pflash_t *pflash_cfi01_register(target_phys_addr_t base, ram_addr_t off,
+                                BlockDriverState *bs, target_ulong sector_len,
+                                int nb_blocs, int width,
+                                uint16_t id0, uint16_t id1,
+                                uint16_t id2, uint16_t id3)
+{
+    pflash_t *pfl;
+    target_long total_len;
+
+    total_len = sector_len * nb_blocs;
+
+    /* XXX: to be fixed */
+    if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
+        total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
+        return NULL;
+
+    pfl = qemu_mallocz(sizeof(pflash_t));
+
+    if (pfl == NULL)
+        return NULL;
+    pfl->storage = phys_ram_base + off;
+    pfl->fl_mem = cpu_register_io_memory(0,
+                    pflash_read_ops, pflash_write_ops, pfl);
+    pfl->off = off;
+    cpu_register_physical_memory(base, total_len,
+                    off | pfl->fl_mem | IO_MEM_ROMD);
+
+    pfl->bs = bs;
+    if (pfl->bs) {
+        /* read the initial flash content */
+        bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
+    }
+#if 0 /* XXX: there should be a bit to set up read-only,
+       *      the same way the hardware does (with WP pin).
+       */
+    pfl->ro = 1;
+#else
+    pfl->ro = 0;
+#endif
+    pfl->timer = qemu_new_timer(vm_clock, pflash_timer, pfl);
+    pfl->base = base;
+    pfl->sector_len = sector_len;
+    pfl->total_len = total_len;
+    pfl->width = width;
+    pfl->wcycle = 0;
+    pfl->cmd = 0;
+    pfl->status = 0;
+    pfl->ident[0] = id0;
+    pfl->ident[1] = id1;
+    pfl->ident[2] = id2;
+    pfl->ident[3] = id3;
+    /* Hardcoded CFI table */
+    pfl->cfi_len = 0x52;
+    /* Standard "QRY" string */
+    pfl->cfi_table[0x10] = 'Q';
+    pfl->cfi_table[0x11] = 'R';
+    pfl->cfi_table[0x12] = 'Y';
+    /* Command set (Intel) */
+    pfl->cfi_table[0x13] = 0x01;
+    pfl->cfi_table[0x14] = 0x00;
+    /* Primary extended table address (none) */
+    pfl->cfi_table[0x15] = 0x31;
+    pfl->cfi_table[0x16] = 0x00;
+    /* Alternate command set (none) */
+    pfl->cfi_table[0x17] = 0x00;
+    pfl->cfi_table[0x18] = 0x00;
+    /* Alternate extended table (none) */
+    pfl->cfi_table[0x19] = 0x00;
+    pfl->cfi_table[0x1A] = 0x00;
+    /* Vcc min */
+    pfl->cfi_table[0x1B] = 0x45;
+    /* Vcc max */
+    pfl->cfi_table[0x1C] = 0x55;
+    /* Vpp min (no Vpp pin) */
+    pfl->cfi_table[0x1D] = 0x00;
+    /* Vpp max (no Vpp pin) */
+    pfl->cfi_table[0x1E] = 0x00;
+    /* Reserved */
+    pfl->cfi_table[0x1F] = 0x07;
+    /* Timeout for min size buffer write */
+    pfl->cfi_table[0x20] = 0x07;
+    /* Typical timeout for block erase */
+    pfl->cfi_table[0x21] = 0x0a;
+    /* Typical timeout for full chip erase (4096 ms) */
+    pfl->cfi_table[0x22] = 0x00;
+    /* Reserved */
+    pfl->cfi_table[0x23] = 0x04;
+    /* Max timeout for buffer write */
+    pfl->cfi_table[0x24] = 0x04;
+    /* Max timeout for block erase */
+    pfl->cfi_table[0x25] = 0x04;
+    /* Max timeout for chip erase */
+    pfl->cfi_table[0x26] = 0x00;
+    /* Device size */
+    pfl->cfi_table[0x27] = ctz32(total_len); // + 1;
+    /* Flash device interface (8 & 16 bits) */
+    pfl->cfi_table[0x28] = 0x02;
+    pfl->cfi_table[0x29] = 0x00;
+    /* Max number of bytes in multi-bytes write */
+    pfl->cfi_table[0x2A] = 0x04;
+    pfl->cfi_table[0x2B] = 0x00;
+    /* Number of erase block regions (uniform) */
+    pfl->cfi_table[0x2C] = 0x01;
+    /* Erase block region 1 */
+    pfl->cfi_table[0x2D] = nb_blocs - 1;
+    pfl->cfi_table[0x2E] = (nb_blocs - 1) >> 8;
+    pfl->cfi_table[0x2F] = sector_len >> 8;
+    pfl->cfi_table[0x30] = sector_len >> 16;
+
+    /* Extended */
+    pfl->cfi_table[0x31] = 'P';
+    pfl->cfi_table[0x32] = 'R';
+    pfl->cfi_table[0x33] = 'I';
+
+    pfl->cfi_table[0x34] = '1';
+    pfl->cfi_table[0x35] = '1';
+
+    pfl->cfi_table[0x36] = 0x00;
+    pfl->cfi_table[0x37] = 0x00;
+    pfl->cfi_table[0x38] = 0x00;
+    pfl->cfi_table[0x39] = 0x00;
+
+    pfl->cfi_table[0x3a] = 0x00;
+
+    pfl->cfi_table[0x3b] = 0x00;
+    pfl->cfi_table[0x3c] = 0x00;
+
+    return pfl;
+}
diff --git a/hw/pflash_cfi02.c b/hw/pflash_cfi02.c
index 08f88900f..bc90d248d 100644
--- a/hw/pflash_cfi02.c
+++ b/hw/pflash_cfi02.c
@@ -36,7 +36,10 @@
  * It does not implement multiple sectors erase
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "flash.h"
+#include "qemu-timer.h"
+#include "block.h"
 
 //#define PFLASH_DEBUG
 #ifdef PFLASH_DEBUG
@@ -521,11 +524,11 @@ static int ctz32 (uint32_t n)
     return ret;
 }
 
-pflash_t *pflash_register (target_phys_addr_t base, ram_addr_t off,
-                           BlockDriverState *bs,
-                           uint32_t sector_len, int nb_blocs, int width,
-                           uint16_t id0, uint16_t id1,
-                           uint16_t id2, uint16_t id3)
+pflash_t *pflash_cfi02_register(target_phys_addr_t base, ram_addr_t off,
+                                BlockDriverState *bs, uint32_t sector_len,
+                                int nb_blocs, int width,
+                                uint16_t id0, uint16_t id1,
+                                uint16_t id2, uint16_t id3)
 {
     pflash_t *pfl;
     int32_t total_len;
diff --git a/hw/piix_pci.c b/hw/piix_pci.c
index 8c00f0d13..d5c7e1e5c 100644
--- a/hw/piix_pci.c
+++ b/hw/piix_pci.c
@@ -22,7 +22,10 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pc.h"
+#include "pci.h"
+
 typedef uint32_t pci_addr_t;
 #include "pci_host.h"
 
@@ -54,6 +57,7 @@ static int pci_slot_get_pirq(PCIDevice *pci_dev, int irq_num)
 
 static uint32_t isa_page_descs[384 / 4];
 static uint8_t smm_enabled;
+static int pci_irq_levels[4];
 
 static void update_pam(PCIDevice *d, uint32_t start, uint32_t end, int r)
 {
@@ -136,22 +140,32 @@ static void i440fx_write_config(PCIDevice *d,
 static void i440fx_save(QEMUFile* f, void *opaque)
 {
     PCIDevice *d = opaque;
+    int i;
+
     pci_device_save(d, f);
     qemu_put_8s(f, &smm_enabled);
+
+    for (i = 0; i < 4; i++)
+        qemu_put_be32(f, pci_irq_levels[i]);
 }
 
 static int i440fx_load(QEMUFile* f, void *opaque, int version_id)
 {
     PCIDevice *d = opaque;
-    int ret;
+    int ret, i;
 
-    if (version_id != 1)
+    if (version_id > 2)
         return -EINVAL;
     ret = pci_device_load(d, f);
     if (ret < 0)
         return ret;
     i440fx_update_memory_mappings(d);
     qemu_get_8s(f, &smm_enabled);
+
+    if (version_id >= 2)
+        for (i = 0; i < 4; i++)
+            pci_irq_levels[i] = qemu_get_be32(f);
+
     return 0;
 }
 
@@ -189,7 +203,7 @@ PCIBus *i440fx_init(PCIDevice **pi440fx_state, qemu_irq *pic)
 
     d->config[0x72] = 0x02; /* SMRAM */
 
-    register_savevm("I440FX", 0, 1, i440fx_save, i440fx_load, d);
+    register_savevm("I440FX", 0, 2, i440fx_save, i440fx_load, d);
     *pi440fx_state = d;
     return b;
 }
@@ -202,12 +216,11 @@ PCIDevice *piix4_dev;
 /* just used for simpler irq handling. */
 #define PCI_IRQ_WORDS   ((PCI_DEVICES_MAX + 31) / 32)
 
-static int pci_irq_levels[4];
-
 static void piix3_set_irq(qemu_irq *pic, int irq_num, int level)
 {
     int i, pic_irq, pic_level;
 
+    piix3_dev->config[0x60 + irq_num] &= ~0x80;   // enable bit
     pci_irq_levels[irq_num] = level;
 
     /* now we change the pic irq level according to the piix irq mappings */
@@ -310,31 +323,6 @@ static int piix_load(QEMUFile* f, void *opaque, int version_id)
     return pci_device_load(d, f);
 }
 
-int piix_init(PCIBus *bus, int devfn)
-{
-    PCIDevice *d;
-    uint8_t *pci_conf;
-
-    d = pci_register_device(bus, "PIIX", sizeof(PCIDevice),
-                                    devfn, NULL, NULL);
-    register_savevm("PIIX", 0, 2, piix_save, piix_load, d);
-
-    piix3_dev = d;
-    pci_conf = d->config;
-
-    pci_conf[0x00] = 0x86; // Intel
-    pci_conf[0x01] = 0x80;
-    pci_conf[0x02] = 0x2E; // 82371FB PIIX PCI-to-ISA bridge
-    pci_conf[0x03] = 0x12;
-    pci_conf[0x08] = 0x02; // Step A1
-    pci_conf[0x0a] = 0x01; // class_sub = PCI_ISA
-    pci_conf[0x0b] = 0x06; // class_base = PCI_bridge
-    pci_conf[0x0e] = 0x80; // header_type = PCI_multifunction, generic
-
-    piix3_reset(d);
-    return d->devfn;
-}
-
 int piix3_init(PCIBus *bus, int devfn)
 {
     PCIDevice *d;
diff --git a/hw/pl011.c b/hw/pl011.c
index 94ed6994d..9d8c6a3f5 100644
--- a/hw/pl011.c
+++ b/hw/pl011.c
@@ -7,7 +7,9 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "qemu-char.h"
+#include "primecell.h"
 
 typedef struct {
     uint32_t base;
@@ -28,6 +30,7 @@ typedef struct {
     int read_trigger;
     CharDriverState *chr;
     qemu_irq irq;
+    enum pl011_type type;
 } pl011_state;
 
 #define PL011_INT_TX 0x20
@@ -38,8 +41,10 @@ typedef struct {
 #define PL011_FLAG_TXFF 0x20
 #define PL011_FLAG_RXFE 0x10
 
-static const unsigned char pl011_id[] =
-{ 0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
+static const unsigned char pl011_id[2][8] = {
+  { 0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1 }, /* PL011_ARM */
+  { 0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 }, /* PL011_LUMINARY */
+};
 
 static void pl011_update(pl011_state *s)
 {
@@ -56,7 +61,7 @@ static uint32_t pl011_read(void *opaque, target_phys_addr_t offset)
 
     offset -= s->base;
     if (offset >= 0xfe0 && offset < 0x1000) {
-        return pl011_id[(offset - 0xfe0) >> 2];
+        return pl011_id[s->type][(offset - 0xfe0) >> 2];
     }
     switch (offset >> 2) {
     case 0: /* UARTDR */
@@ -73,6 +78,7 @@ static uint32_t pl011_read(void *opaque, target_phys_addr_t offset)
         if (s->read_count == s->read_trigger - 1)
             s->int_level &= ~ PL011_INT_RX;
         pl011_update(s);
+        qemu_chr_accept_input(s->chr);
         return c;
     case 1: /* UARTCR */
         return 0;
@@ -99,7 +105,7 @@ static uint32_t pl011_read(void *opaque, target_phys_addr_t offset)
     case 18: /* UARTDMACR */
         return s->dmacr;
     default:
-        cpu_abort (cpu_single_env, "pl011_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl011_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -137,6 +143,9 @@ static void pl011_write(void *opaque, target_phys_addr_t offset,
     case 1: /* UARTCR */
         s->cr = value;
         break;
+    case 6: /* UARTFR */
+        /* Writes to Flag register are ignored.  */
+        break;
     case 8: /* UARTUARTILPR */
         s->ilpr = value;
         break;
@@ -172,7 +181,7 @@ static void pl011_write(void *opaque, target_phys_addr_t offset,
             cpu_abort(cpu_single_env, "PL011: DMA not implemented\n");
         break;
     default:
-        cpu_abort (cpu_single_env, "pl011_write: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl011_write: Bad offset %x\n", (int)offset);
     }
 }
 
@@ -224,7 +233,7 @@ static CPUWriteMemoryFunc *pl011_writefn[] = {
 };
 
 void pl011_init(uint32_t base, qemu_irq irq,
-                CharDriverState *chr)
+                CharDriverState *chr, enum pl011_type type)
 {
     int iomemtype;
     pl011_state *s;
@@ -235,6 +244,7 @@ void pl011_init(uint32_t base, qemu_irq irq,
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
     s->base = base;
     s->irq = irq;
+    s->type = type;
     s->chr = chr;
     s->read_trigger = 1;
     s->ifl = 0x12;
diff --git a/hw/pl022.c b/hw/pl022.c
new file mode 100644
index 000000000..54a581b88
--- /dev/null
+++ b/hw/pl022.c
@@ -0,0 +1,265 @@
+/*
+ * Arm PrimeCell PL022 Synchronous Serial Port
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "hw.h"
+#include "primecell.h"
+
+//#define DEBUG_PL022 1
+
+#ifdef DEBUG_PL022
+#define DPRINTF(fmt, args...) \
+do { printf("pl022: " fmt , ##args); } while (0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "pl022: error: " fmt , ##args); exit(1);} while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "pl022: error: " fmt , ##args);} while (0)
+#endif
+
+#define PL022_CR1_LBM 0x01
+#define PL022_CR1_SSE 0x02
+#define PL022_CR1_MS  0x04
+#define PL022_CR1_SDO 0x08
+
+#define PL022_SR_TFE  0x01
+#define PL022_SR_TNF  0x02
+#define PL022_SR_RNE  0x04
+#define PL022_SR_RFF  0x08
+#define PL022_SR_BSY  0x10
+
+#define PL022_INT_ROR 0x01
+#define PL022_INT_RT  0x04
+#define PL022_INT_RX  0x04
+#define PL022_INT_TX  0x08
+
+typedef struct {
+    uint32_t base;
+    uint32_t cr0;
+    uint32_t cr1;
+    uint32_t bitmask;
+    uint32_t sr;
+    uint32_t cpsr;
+    uint32_t is;
+    uint32_t im;
+    /* The FIFO head points to the next empty entry.  */
+    int tx_fifo_head;
+    int rx_fifo_head;
+    int tx_fifo_len;
+    int rx_fifo_len;
+    uint16_t tx_fifo[8];
+    uint16_t rx_fifo[8];
+    qemu_irq irq;
+    int (*xfer_cb)(void *, int);
+    void *opaque;
+} pl022_state;
+
+static const unsigned char pl022_id[8] =
+  { 0x22, 0x10, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
+
+static void pl022_update(pl022_state *s)
+{
+    s->sr = 0;
+    if (s->tx_fifo_len == 0)
+        s->sr |= PL022_SR_TFE;
+    if (s->tx_fifo_len != 8)
+        s->sr |= PL022_SR_TNF;
+    if (s->rx_fifo_len != 0)
+        s->sr |= PL022_SR_RNE;
+    if (s->rx_fifo_len == 8)
+        s->sr |= PL022_SR_RFF;
+    if (s->tx_fifo_len)
+        s->sr |= PL022_SR_BSY;
+    s->is = 0;
+    if (s->rx_fifo_len >= 4)
+        s->is |= PL022_INT_RX;
+    if (s->tx_fifo_len <= 4)
+        s->is |= PL022_INT_TX;
+
+    qemu_set_irq(s->irq, (s->is & s->im) != 0);
+}
+
+static void pl022_xfer(pl022_state *s)
+{
+    int i;
+    int o;
+    int val;
+
+    if ((s->cr1 & PL022_CR1_SSE) == 0) {
+        pl022_update(s);
+        DPRINTF("Disabled\n");
+        return;
+    }
+
+    DPRINTF("Maybe xfer %d/%d\n", s->tx_fifo_len, s->rx_fifo_len);
+    i = (s->tx_fifo_head - s->tx_fifo_len) & 7;
+    o = s->rx_fifo_head;
+    /* ??? We do not emulate the line speed.
+       This may break some applications.  The are two problematic cases:
+        (a) A driver feeds data into the TX FIFO until it is full,
+         and only then drains the RX FIFO.  On real hardware the CPU can
+         feed data fast enough that the RX fifo never gets chance to overflow.
+        (b) A driver transmits data, deliberately allowing the RX FIFO to
+         overflow because it ignores the RX data anyway.
+
+       We choose to support (a) by stalling the transmit engine if it would
+       cause the RX FIFO to overflow.  In practice much transmit-only code
+       falls into (a) because it flushes the RX FIFO to determine when
+       the transfer has completed.  */
+    while (s->tx_fifo_len && s->rx_fifo_len < 8) {
+        DPRINTF("xfer\n");
+        val = s->tx_fifo[i];
+        if (s->cr1 & PL022_CR1_LBM) {
+            /* Loopback mode.  */
+        } else if (s->xfer_cb) {
+            val = s->xfer_cb(s->opaque, val);
+        } else {
+            val = 0;
+        }
+        s->rx_fifo[o] = val & s->bitmask;
+        i = (i + 1) & 7;
+        o = (o + 1) & 7;
+        s->tx_fifo_len--;
+        s->rx_fifo_len++;
+    }
+    s->rx_fifo_head = o;
+    pl022_update(s);
+}
+
+static uint32_t pl022_read(void *opaque, target_phys_addr_t offset)
+{
+    pl022_state *s = (pl022_state *)opaque;
+    int val;
+
+    offset -= s->base;
+    if (offset >= 0xfe0 && offset < 0x1000) {
+        return pl022_id[(offset - 0xfe0) >> 2];
+    }
+    switch (offset) {
+    case 0x00: /* CR0 */
+      return s->cr0;
+    case 0x04: /* CR1 */
+      return s->cr1;
+    case 0x08: /* DR */
+        if (s->rx_fifo_len) {
+            val = s->rx_fifo[(s->rx_fifo_head - s->rx_fifo_len) & 7];
+            DPRINTF("RX %02x\n", val);
+            s->rx_fifo_len--;
+            pl022_xfer(s);
+        } else {
+            val = 0;
+        }
+        return val;
+    case 0x0c: /* SR */
+        return s->sr;
+    case 0x10: /* CPSR */
+        return s->cpsr;
+    case 0x14: /* IMSC */
+        return s->im;
+    case 0x18: /* RIS */
+        return s->is;
+    case 0x1c: /* MIS */
+        return s->im & s->is;
+    case 0x20: /* DMACR */
+        /* Not implemented.  */
+        return 0;
+    default:
+        cpu_abort (cpu_single_env, "pl022_read: Bad offset %x\n",
+                   (int)offset);
+        return 0;
+    }
+}
+
+static void pl022_write(void *opaque, target_phys_addr_t offset,
+                        uint32_t value)
+{
+    pl022_state *s = (pl022_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x00: /* CR0 */
+        s->cr0 = value;
+        /* Clock rate and format are ignored.  */
+        s->bitmask = (1 << ((value & 15) + 1)) - 1;
+        break;
+    case 0x04: /* CR1 */
+        s->cr1 = value;
+        if ((s->cr1 & (PL022_CR1_MS | PL022_CR1_SSE))
+                   == (PL022_CR1_MS | PL022_CR1_SSE)) {
+            BADF("SPI slave mode not implemented\n");
+        }
+        pl022_xfer(s);
+        break;
+    case 0x08: /* DR */
+        if (s->tx_fifo_len < 8) {
+            DPRINTF("TX %02x\n", value);
+            s->tx_fifo[s->tx_fifo_head] = value & s->bitmask;
+            s->tx_fifo_head = (s->tx_fifo_head + 1) & 7;
+            s->tx_fifo_len++;
+            pl022_xfer(s);
+        }
+        break;
+    case 0x10: /* CPSR */
+        /* Prescaler.  Ignored.  */
+        s->cpsr = value & 0xff;
+        break;
+    case 0x14: /* IMSC */
+        s->im = value;
+        pl022_update(s);
+        break;
+    case 0x20: /* DMACR */
+        if (value)
+            cpu_abort (cpu_single_env, "pl022: DMA not implemented\n");
+        break;
+    default:
+        cpu_abort (cpu_single_env, "pl022_write: Bad offset %x\n",
+                   (int)offset);
+    }
+}
+
+static void pl022_reset(pl022_state *s)
+{
+    s->rx_fifo_len = 0;
+    s->tx_fifo_len = 0;
+    s->im = 0;
+    s->is = PL022_INT_TX;
+    s->sr = PL022_SR_TFE | PL022_SR_TNF;
+}
+
+static CPUReadMemoryFunc *pl022_readfn[] = {
+   pl022_read,
+   pl022_read,
+   pl022_read
+};
+
+static CPUWriteMemoryFunc *pl022_writefn[] = {
+   pl022_write,
+   pl022_write,
+   pl022_write
+};
+
+void pl022_init(uint32_t base, qemu_irq irq, int (*xfer_cb)(void *, int),
+                void * opaque)
+{
+    int iomemtype;
+    pl022_state *s;
+
+    s = (pl022_state *)qemu_mallocz(sizeof(pl022_state));
+    iomemtype = cpu_register_io_memory(0, pl022_readfn,
+                                       pl022_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    s->base = base;
+    s->irq = irq;
+    s->xfer_cb = xfer_cb;
+    s->opaque = opaque;
+    pl022_reset(s);
+    /* ??? Save/restore.  */
+}
+
+
diff --git a/hw/pl031.c b/hw/pl031.c
index 7e8098ba5..68e9005c0 100644
--- a/hw/pl031.c
+++ b/hw/pl031.c
@@ -9,7 +9,10 @@
  *
  */
 
-#include"vl.h"
+#include "hw.h"
+#include "primecell.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
 
 //#define DEBUG_PL031
 
diff --git a/hw/pl050.c b/hw/pl050.c
index b3a27976c..7b890e9c9 100644
--- a/hw/pl050.c
+++ b/hw/pl050.c
@@ -7,7 +7,9 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "primecell.h"
+#include "ps2.h"
 
 typedef struct {
     void *dev;
@@ -79,7 +81,7 @@ static uint32_t pl050_read(void *opaque, target_phys_addr_t offset)
     case 4: /* KMIIR */
         return s->pending | 2;
     default:
-        cpu_abort (cpu_single_env, "pl050_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl050_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -108,7 +110,7 @@ static void pl050_write(void *opaque, target_phys_addr_t offset,
         s->clk = value;
         return;
     default:
-        cpu_abort (cpu_single_env, "pl050_write: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl050_write: Bad offset %x\n", (int)offset);
     }
 }
 static CPUReadMemoryFunc *pl050_readfn[] = {
diff --git a/hw/pl061.c b/hw/pl061.c
new file mode 100644
index 000000000..3ac0a4c10
--- /dev/null
+++ b/hw/pl061.c
@@ -0,0 +1,262 @@
+/*
+ * Arm PrimeCell PL061 General Purpose IO with additional
+ * Luminary Micro Stellaris bits.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "hw.h"
+#include "primecell.h"
+
+//#define DEBUG_PL061 1
+
+#ifdef DEBUG_PL061
+#define DPRINTF(fmt, args...) \
+do { printf("pl061: " fmt , ##args); } while (0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "pl061: error: " fmt , ##args); exit(1);} while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "pl061: error: " fmt , ##args);} while (0)
+#endif
+
+static const uint8_t pl061_id[12] =
+  { 0x00, 0x00, 0x00, 0x00, 0x61, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
+
+typedef struct {
+    uint32_t base;
+    int locked;
+    uint8_t data;
+    uint8_t old_data;
+    uint8_t dir;
+    uint8_t isense;
+    uint8_t ibe;
+    uint8_t iev;
+    uint8_t im;
+    uint8_t istate;
+    uint8_t afsel;
+    uint8_t dr2r;
+    uint8_t dr4r;
+    uint8_t dr8r;
+    uint8_t odr;
+    uint8_t pur;
+    uint8_t pdr;
+    uint8_t slr;
+    uint8_t den;
+    uint8_t cr;
+    uint8_t float_high;
+    qemu_irq irq;
+    qemu_irq out[8];
+} pl061_state;
+
+static void pl061_update(pl061_state *s)
+{
+    uint8_t changed;
+    uint8_t mask;
+    uint8_t out;
+    int i;
+
+    /* Outputs float high.  */
+    /* FIXME: This is board dependent.  */
+    out = (s->data & s->dir) | ~s->dir;
+    changed = s->old_data ^ out;
+    if (!changed)
+        return;
+
+    s->old_data = out;
+    for (i = 0; i < 8; i++) {
+        mask = 1 << i;
+        if ((changed & mask) && s->out) {
+            DPRINTF("Set output %d = %d\n", i, (out & mask) != 0);
+            qemu_set_irq(s->out[i], (out & mask) != 0);
+        }
+    }
+
+    /* FIXME: Implement input interrupts.  */
+}
+
+static uint32_t pl061_read(void *opaque, target_phys_addr_t offset)
+{
+    pl061_state *s = (pl061_state *)opaque;
+
+    offset -= s->base;
+    if (offset >= 0xfd0 && offset < 0x1000) {
+        return pl061_id[(offset - 0xfd0) >> 2];
+    }
+    if (offset < 0x400) {
+        return s->data & (offset >> 2);
+    }
+    switch (offset) {
+    case 0x400: /* Direction */
+        return s->dir;
+    case 0x404: /* Interrupt sense */
+        return s->isense;
+    case 0x408: /* Interrupt both edges */
+        return s->ibe;
+    case 0x40c: /* Interupt event */
+        return s->iev;
+    case 0x410: /* Interrupt mask */
+        return s->im;
+    case 0x414: /* Raw interrupt status */
+        return s->istate;
+    case 0x418: /* Masked interrupt status */
+        return s->istate | s->im;
+    case 0x420: /* Alternate function select */
+        return s->afsel;
+    case 0x500: /* 2mA drive */
+        return s->dr2r;
+    case 0x504: /* 4mA drive */
+        return s->dr4r;
+    case 0x508: /* 8mA drive */
+        return s->dr8r;
+    case 0x50c: /* Open drain */
+        return s->odr;
+    case 0x510: /* Pull-up */
+        return s->pur;
+    case 0x514: /* Pull-down */
+        return s->pdr;
+    case 0x518: /* Slew rate control */
+        return s->slr;
+    case 0x51c: /* Digital enable */
+        return s->den;
+    case 0x520: /* Lock */
+        return s->locked;
+    case 0x524: /* Commit */
+        return s->cr;
+    default:
+        cpu_abort (cpu_single_env, "pl061_read: Bad offset %x\n",
+                   (int)offset);
+        return 0;
+    }
+}
+
+static void pl061_write(void *opaque, target_phys_addr_t offset,
+                        uint32_t value)
+{
+    pl061_state *s = (pl061_state *)opaque;
+    uint8_t mask;
+
+    offset -= s->base;
+    if (offset < 0x400) {
+        mask = (offset >> 2) & s->dir;
+        s->data = (s->data & ~mask) | (value & mask);
+        pl061_update(s);
+        return;
+    }
+    switch (offset) {
+    case 0x400: /* Direction */
+        s->dir = value;
+        break;
+    case 0x404: /* Interrupt sense */
+        s->isense = value;
+        break;
+    case 0x408: /* Interrupt both edges */
+        s->ibe = value;
+        break;
+    case 0x40c: /* Interupt event */
+        s->iev = value;
+        break;
+    case 0x410: /* Interrupt mask */
+        s->im = value;
+        break;
+    case 0x41c: /* Interrupt clear */
+        s->istate &= ~value;
+        break;
+    case 0x420: /* Alternate function select */
+        mask = s->cr;
+        s->afsel = (s->afsel & ~mask) | (value & mask);
+        break;
+    case 0x500: /* 2mA drive */
+        s->dr2r = value;
+        break;
+    case 0x504: /* 4mA drive */
+        s->dr4r = value;
+        break;
+    case 0x508: /* 8mA drive */
+        s->dr8r = value;
+        break;
+    case 0x50c: /* Open drain */
+        s->odr = value;
+        break;
+    case 0x510: /* Pull-up */
+        s->pur = value;
+        break;
+    case 0x514: /* Pull-down */
+        s->pdr = value;
+        break;
+    case 0x518: /* Slew rate control */
+        s->slr = value;
+        break;
+    case 0x51c: /* Digital enable */
+        s->den = value;
+        break;
+    case 0x520: /* Lock */
+        s->locked = (value != 0xacce551);
+        break;
+    case 0x524: /* Commit */
+        if (!s->locked)
+            s->cr = value;
+        break;
+    default:
+        cpu_abort (cpu_single_env, "pl061_write: Bad offset %x\n",
+                   (int)offset);
+    }
+    pl061_update(s);
+}
+
+static void pl061_reset(pl061_state *s)
+{
+  s->locked = 1;
+  s->cr = 0xff;
+}
+
+static void pl061_set_irq(void * opaque, int irq, int level)
+{
+    pl061_state *s = (pl061_state *)opaque;
+    uint8_t mask;
+
+    mask = 1 << irq;
+    if ((s->dir & mask) == 0) {
+        s->data &= ~mask;
+        if (level)
+            s->data |= mask;
+        pl061_update(s);
+    }
+}
+
+static CPUReadMemoryFunc *pl061_readfn[] = {
+   pl061_read,
+   pl061_read,
+   pl061_read
+};
+
+static CPUWriteMemoryFunc *pl061_writefn[] = {
+   pl061_write,
+   pl061_write,
+   pl061_write
+};
+
+/* Returns an array of inputs.  */
+qemu_irq *pl061_init(uint32_t base, qemu_irq irq, qemu_irq **out)
+{
+    int iomemtype;
+    pl061_state *s;
+
+    s = (pl061_state *)qemu_mallocz(sizeof(pl061_state));
+    iomemtype = cpu_register_io_memory(0, pl061_readfn,
+                                       pl061_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    s->base = base;
+    s->irq = irq;
+    pl061_reset(s);
+    if (out)
+        *out = s->out;
+
+    /* ??? Save/restore.  */
+    return qemu_allocate_irqs(pl061_set_irq, s, 8);
+}
+
diff --git a/hw/pl080.c b/hw/pl080.c
index b24cfbaf0..059e66702 100644
--- a/hw/pl080.c
+++ b/hw/pl080.c
@@ -7,7 +7,8 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "primecell.h"
 
 #define PL080_MAX_CHANNELS 8
 #define PL080_CONF_E    0x1
@@ -243,7 +244,7 @@ static uint32_t pl080_read(void *opaque, target_phys_addr_t offset)
         return s->sync;
     default:
     bad_offset:
-        cpu_abort(cpu_single_env, "pl080_read: Bad offset %x\n", offset);
+        cpu_abort(cpu_single_env, "pl080_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -305,7 +306,7 @@ static void pl080_write(void *opaque, target_phys_addr_t offset,
         break;
     default:
     bad_offset:
-        cpu_abort(cpu_single_env, "pl080_write: Bad offset %x\n", offset);
+        cpu_abort(cpu_single_env, "pl080_write: Bad offset %x\n", (int)offset);
     }
     pl080_update(s);
 }
diff --git a/hw/pl110.c b/hw/pl110.c
index 061ec7aba..e5b2b2363 100644
--- a/hw/pl110.c
+++ b/hw/pl110.c
@@ -7,9 +7,12 @@
  * This code is licenced under the GNU LGPL
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "primecell.h"
+#include "console.h"
 
 #define PL110_CR_EN   0x001
+#define PL110_CR_BGR  0x100
 #define PL110_CR_BEBO 0x200
 #define PL110_CR_BEPO 0x400
 #define PL110_CR_PWR  0x800
@@ -114,6 +117,7 @@ static void pl110_update_display(void *opaque)
     int first, last = 0;
     int dirty, new_dirty;
     int i;
+    int bpp_offset;
 
     if (!pl110_enabled(s))
         return;
@@ -145,12 +149,17 @@ static void pl110_update_display(void *opaque)
         fprintf(stderr, "pl110: Bad color depth\n");
         exit(1);
     }
+    if (s->cr & PL110_CR_BGR)
+        bpp_offset = 0;
+    else
+        bpp_offset = 18;
+
     if (s->cr & PL110_CR_BEBO)
-      fn = fntable[s->bpp + 6];
+        fn = fntable[s->bpp + 6 + bpp_offset];
     else if (s->cr & PL110_CR_BEPO)
-      fn = fntable[s->bpp + 12];
+        fn = fntable[s->bpp + 12 + bpp_offset];
     else
-      fn = fntable[s->bpp];
+        fn = fntable[s->bpp + bpp_offset];
 
     src_width = s->cols;
     switch (s->bpp) {
@@ -319,7 +328,7 @@ static uint32_t pl110_read(void *opaque, target_phys_addr_t offset)
     case 12: /* LCDLPCURR */
         return s->lpbase;
     default:
-        cpu_abort (cpu_single_env, "pl110_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl110_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -386,7 +395,7 @@ static void pl110_write(void *opaque, target_phys_addr_t offset,
         pl110_update(s);
         break;
     default:
-        cpu_abort (cpu_single_env, "pl110_write: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl110_write: Bad offset %x\n", (int)offset);
     }
 }
 
diff --git a/hw/pl110_template.h b/hw/pl110_template.h
index f7cb1f495..33483c027 100644
--- a/hw/pl110_template.h
+++ b/hw/pl110_template.h
@@ -24,35 +24,68 @@
 #error unknown bit depth
 #endif
 
+#undef RGB
+#define BORDER bgr
 #define ORDER 0
 #include "pl110_template.h"
 #define ORDER 1
 #include "pl110_template.h"
 #define ORDER 2
 #include "pl110_template.h"
+#undef BORDER
+#define RGB
+#define BORDER rgb
+#define ORDER 0
+#include "pl110_template.h"
+#define ORDER 1
+#include "pl110_template.h"
+#define ORDER 2
+#include "pl110_template.h"
+#undef BORDER
 
-static drawfn glue(pl110_draw_fn_,BITS)[18] =
+static drawfn glue(pl110_draw_fn_,BITS)[36] =
 {
-    glue(pl110_draw_line1_lblp,BITS),
-    glue(pl110_draw_line2_lblp,BITS),
-    glue(pl110_draw_line4_lblp,BITS),
-    glue(pl110_draw_line8_lblp,BITS),
-    glue(pl110_draw_line16_lblp,BITS),
-    glue(pl110_draw_line32_lblp,BITS),
-
-    glue(pl110_draw_line1_bbbp,BITS),
-    glue(pl110_draw_line2_bbbp,BITS),
-    glue(pl110_draw_line4_bbbp,BITS),
-    glue(pl110_draw_line8_bbbp,BITS),
-    glue(pl110_draw_line16_bbbp,BITS),
-    glue(pl110_draw_line32_bbbp,BITS),
-
-    glue(pl110_draw_line1_lbbp,BITS),
-    glue(pl110_draw_line2_lbbp,BITS),
-    glue(pl110_draw_line4_lbbp,BITS),
-    glue(pl110_draw_line8_lbbp,BITS),
-    glue(pl110_draw_line16_lbbp,BITS),
-    glue(pl110_draw_line32_lbbp,BITS)
+    glue(pl110_draw_line1_lblp_bgr,BITS),
+    glue(pl110_draw_line2_lblp_bgr,BITS),
+    glue(pl110_draw_line4_lblp_bgr,BITS),
+    glue(pl110_draw_line8_lblp_bgr,BITS),
+    glue(pl110_draw_line16_lblp_bgr,BITS),
+    glue(pl110_draw_line32_lblp_bgr,BITS),
+
+    glue(pl110_draw_line1_bbbp_bgr,BITS),
+    glue(pl110_draw_line2_bbbp_bgr,BITS),
+    glue(pl110_draw_line4_bbbp_bgr,BITS),
+    glue(pl110_draw_line8_bbbp_bgr,BITS),
+    glue(pl110_draw_line16_bbbp_bgr,BITS),
+    glue(pl110_draw_line32_bbbp_bgr,BITS),
+
+    glue(pl110_draw_line1_lbbp_bgr,BITS),
+    glue(pl110_draw_line2_lbbp_bgr,BITS),
+    glue(pl110_draw_line4_lbbp_bgr,BITS),
+    glue(pl110_draw_line8_lbbp_bgr,BITS),
+    glue(pl110_draw_line16_lbbp_bgr,BITS),
+    glue(pl110_draw_line32_lbbp_bgr,BITS),
+
+    glue(pl110_draw_line1_lblp_rgb,BITS),
+    glue(pl110_draw_line2_lblp_rgb,BITS),
+    glue(pl110_draw_line4_lblp_rgb,BITS),
+    glue(pl110_draw_line8_lblp_rgb,BITS),
+    glue(pl110_draw_line16_lblp_rgb,BITS),
+    glue(pl110_draw_line32_lblp_rgb,BITS),
+
+    glue(pl110_draw_line1_bbbp_rgb,BITS),
+    glue(pl110_draw_line2_bbbp_rgb,BITS),
+    glue(pl110_draw_line4_bbbp_rgb,BITS),
+    glue(pl110_draw_line8_bbbp_rgb,BITS),
+    glue(pl110_draw_line16_bbbp_rgb,BITS),
+    glue(pl110_draw_line32_bbbp_rgb,BITS),
+
+    glue(pl110_draw_line1_lbbp_rgb,BITS),
+    glue(pl110_draw_line2_lbbp_rgb,BITS),
+    glue(pl110_draw_line4_lbbp_rgb,BITS),
+    glue(pl110_draw_line8_lbbp_rgb,BITS),
+    glue(pl110_draw_line16_lbbp_rgb,BITS),
+    glue(pl110_draw_line32_lbbp_rgb,BITS),
 };
 
 #undef BITS
@@ -61,18 +94,18 @@ static drawfn glue(pl110_draw_fn_,BITS)[18] =
 #else
 
 #if ORDER == 0
-#define NAME glue(lblp, BITS)
+#define NAME glue(glue(lblp_, BORDER), BITS)
 #ifdef WORDS_BIGENDIAN
 #define SWAP_WORDS 1
 #endif
 #elif ORDER == 1
-#define NAME glue(bbbp, BITS)
+#define NAME glue(glue(bbbp_, BORDER), BITS)
 #ifndef WORDS_BIGENDIAN
 #define SWAP_WORDS 1
 #endif
 #else
 #define SWAP_PIXELS 1
-#define NAME glue(lbbp, BITS)
+#define NAME glue(glue(lbbp_, BORDER), BITS)
 #ifdef WORDS_BIGENDIAN
 #define SWAP_WORDS 1
 #endif
@@ -195,29 +228,38 @@ static void glue(pl110_draw_line16_,NAME)(uint32_t *pallette, uint8_t *d, const
 #ifdef SWAP_WORDS
         data = bswap32(data);
 #endif
+#ifdef RGB
+#define LSB r
+#define MSB b
+#else
+#define LSB b
+#define MSB r
+#endif
 #if 0
-        r = data & 0x1f;
+        LSB = data & 0x1f;
         data >>= 5;
         g = data & 0x3f;
         data >>= 6;
-        b = data & 0x1f;
+        MSB = data & 0x1f;
         data >>= 5;
 #else
-        r = (data & 0x1f) << 3;
+        LSB = (data & 0x1f) << 3;
         data >>= 5;
         g = (data & 0x3f) << 2;
         data >>= 6;
-        b = (data & 0x1f) << 3;
+        MSB = (data & 0x1f) << 3;
         data >>= 5;
 #endif
         COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
-        r = (data & 0x1f) << 3;
+        LSB = (data & 0x1f) << 3;
         data >>= 5;
         g = (data & 0x3f) << 2;
         data >>= 6;
-        b = (data & 0x1f) << 3;
+        MSB = (data & 0x1f) << 3;
         data >>= 5;
         COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+#undef MSB
+#undef LSB
         width -= 2;
         src += 4;
     }
@@ -229,16 +271,25 @@ static void glue(pl110_draw_line32_,NAME)(uint32_t *pallette, uint8_t *d, const
     unsigned int r, g, b;
     while (width > 0) {
         data = *(uint32_t *)src;
+#ifdef RGB
+#define LSB r
+#define MSB b
+#else
+#define LSB b
+#define MSB r
+#endif
 #ifdef SWAP_WORDS
-        r = data & 0xff;
+        LSB = data & 0xff;
         g = (data >> 8) & 0xff;
-        b = (data >> 16) & 0xff;
+        MSB = (data >> 16) & 0xff;
 #else
-        r = (data >> 24) & 0xff;
+        LSB = (data >> 24) & 0xff;
         g = (data >> 16) & 0xff;
-        b = (data >> 8) & 0xff;
+        MSB = (data >> 8) & 0xff;
 #endif
         COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+#undef MSB
+#undef LSB
         width--;
         src += 4;
     }
diff --git a/hw/pl181.c b/hw/pl181.c
index a905cbb21..75c3143e2 100644
--- a/hw/pl181.c
+++ b/hw/pl181.c
@@ -7,7 +7,8 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "primecell.h"
 #include "sd.h"
 
 //#define DEBUG_PL181 1
@@ -333,7 +334,7 @@ static uint32_t pl181_read(void *opaque, target_phys_addr_t offset)
             return value;
         }
     default:
-        cpu_abort (cpu_single_env, "pl181_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl181_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -405,7 +406,7 @@ static void pl181_write(void *opaque, target_phys_addr_t offset,
         }
         break;
     default:
-        cpu_abort (cpu_single_env, "pl181_write: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl181_write: Bad offset %x\n", (int)offset);
     }
     pl181_update(s);
 }
@@ -457,7 +458,7 @@ void pl181_init(uint32_t base, BlockDriverState *bd,
                                        pl181_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
     s->base = base;
-    s->card = sd_init(bd);
+    s->card = sd_init(bd, 0);
     s->irq[0] = irq0;
     s->irq[1] = irq1;
     qemu_register_reset(pl181_reset, s);
diff --git a/hw/pl190.c b/hw/pl190.c
index 23494d8e1..fc3d08984 100644
--- a/hw/pl190.c
+++ b/hw/pl190.c
@@ -7,8 +7,9 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
-#include "arm_pic.h"
+#include "hw.h"
+#include "primecell.h"
+#include "arm-misc.h"
 
 /* The number of virtual priority levels.  16 user vectors plus the
    unvectored IRQ.  Chained interrupts would require an additional level
@@ -139,7 +140,7 @@ static uint32_t pl190_read(void *opaque, target_phys_addr_t offset)
     case 13: /* DEFVECTADDR */
         return s->vect_addr[16];
     default:
-        cpu_abort (cpu_single_env, "pl190_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl190_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -197,7 +198,7 @@ static void pl190_write(void *opaque, target_phys_addr_t offset, uint32_t val)
             cpu_abort(cpu_single_env, "pl190: Test mode not implemented\n");
         break;
     default:
-        cpu_abort(cpu_single_env, "pl190_write: Bad offset %x\n", offset);
+        cpu_abort(cpu_single_env, "pl190_write: Bad offset %x\n", (int)offset);
         return;
     }
     pl190_update(s);
@@ -215,7 +216,7 @@ static CPUWriteMemoryFunc *pl190_writefn[] = {
    pl190_write
 };
 
-void pl190_reset(pl190_state *s)
+static void pl190_reset(pl190_state *s)
 {
   int i;
 
diff --git a/hw/ppc.c b/hw/ppc.c
index 8e7912e3c..fc92ab267 100644
--- a/hw/ppc.c
+++ b/hw/ppc.c
@@ -21,8 +21,11 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
-#include "m48t59.h"
+#include "hw.h"
+#include "ppc.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
+#include "nvram.h"
 
 //#define PPC_DEBUG_IRQ
 //#define PPC_DEBUG_TB
@@ -30,7 +33,10 @@
 extern FILE *logfile;
 extern int loglevel;
 
-void ppc_set_irq (CPUState *env, int n_IRQ, int level)
+static void cpu_ppc_tb_stop (CPUState *env);
+static void cpu_ppc_tb_start (CPUState *env);
+
+static void ppc_set_irq (CPUState *env, int n_IRQ, int level)
 {
     if (level) {
         env->pending_interrupts |= 1 << n_IRQ;
@@ -42,8 +48,8 @@ void ppc_set_irq (CPUState *env, int n_IRQ, int level)
     }
 #if defined(PPC_DEBUG_IRQ)
     if (loglevel & CPU_LOG_INT) {
-        fprintf(logfile, "%s: %p n_IRQ %d level %d => pending %08x req %08x\n",
-                __func__, env, n_IRQ, level,
+        fprintf(logfile, "%s: %p n_IRQ %d level %d => pending %08" PRIx32
+                "req %08x\n", __func__, env, n_IRQ, level,
                 env->pending_interrupts, env->interrupt_request);
     }
 #endif
@@ -65,6 +71,19 @@ static void ppc6xx_set_irq (void *opaque, int pin, int level)
     /* Don't generate spurious events */
     if ((cur_level == 1 && level == 0) || (cur_level == 0 && level != 0)) {
         switch (pin) {
+        case PPC6xx_INPUT_TBEN:
+            /* Level sensitive - active high */
+#if defined(PPC_DEBUG_IRQ)
+            if (loglevel & CPU_LOG_INT) {
+                fprintf(logfile, "%s: %s the time base\n",
+                        __func__, level ? "start" : "stop");
+            }
+#endif
+            if (level) {
+                cpu_ppc_tb_start(env);
+            } else {
+                cpu_ppc_tb_stop(env);
+            }
         case PPC6xx_INPUT_INT:
             /* Level sensitive - active high */
 #if defined(PPC_DEBUG_IRQ)
@@ -103,6 +122,7 @@ static void ppc6xx_set_irq (void *opaque, int pin, int level)
         case PPC6xx_INPUT_CKSTP_IN:
             /* Level sensitive - active low */
             /* XXX: TODO: relay the signal to CKSTP_OUT pin */
+            /* XXX: Note that the only way to restart the CPU is to reset it */
             if (level) {
 #if defined(PPC_DEBUG_IRQ)
                 if (loglevel & CPU_LOG_INT) {
@@ -110,25 +130,22 @@ static void ppc6xx_set_irq (void *opaque, int pin, int level)
                 }
 #endif
                 env->halted = 1;
-            } else {
-#if defined(PPC_DEBUG_IRQ)
-                if (loglevel & CPU_LOG_INT) {
-                    fprintf(logfile, "%s: restart the CPU\n", __func__);
-                }
-#endif
-                env->halted = 0;
             }
             break;
         case PPC6xx_INPUT_HRESET:
             /* Level sensitive - active low */
             if (level) {
-#if 0 // XXX: TOFIX
 #if defined(PPC_DEBUG_IRQ)
                 if (loglevel & CPU_LOG_INT) {
                     fprintf(logfile, "%s: reset the CPU\n", __func__);
                 }
 #endif
-                cpu_reset(env);
+                env->interrupt_request |= CPU_INTERRUPT_EXITTB;
+                /* XXX: TOFIX */
+#if 0
+                cpu_ppc_reset(env);
+#else
+                qemu_system_reset_request();
 #endif
             }
             break;
@@ -159,9 +176,11 @@ static void ppc6xx_set_irq (void *opaque, int pin, int level)
 
 void ppc6xx_irq_init (CPUState *env)
 {
-    env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, env, 6);
+    env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, env,
+                                                  PPC6xx_INPUT_NB);
 }
 
+#if defined(TARGET_PPC64)
 /* PowerPC 970 internal IRQ controller */
 static void ppc970_set_irq (void *opaque, int pin, int level)
 {
@@ -281,8 +300,10 @@ static void ppc970_set_irq (void *opaque, int pin, int level)
 
 void ppc970_irq_init (CPUState *env)
 {
-    env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, env, 7);
+    env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, env,
+                                                  PPC970_INPUT_NB);
 }
+#endif /* defined(TARGET_PPC64) */
 
 /* PowerPC 40x internal IRQ controller */
 static void ppc40x_set_irq (void *opaque, int pin, int level)
@@ -406,27 +427,26 @@ void ppc40x_irq_init (CPUState *env)
 /* PowerPC time base and decrementer emulation */
 struct ppc_tb_t {
     /* Time base management */
-    int64_t  tb_offset;    /* Compensation               */
-    int64_t  atb_offset;   /* Compensation               */
-    uint32_t tb_freq;      /* TB frequency               */
+    int64_t  tb_offset;    /* Compensation                    */
+    int64_t  atb_offset;   /* Compensation                    */
+    uint32_t tb_freq;      /* TB frequency                    */
     /* Decrementer management */
-    uint64_t decr_next;    /* Tick for next decr interrupt  */
+    uint64_t decr_next;    /* Tick for next decr interrupt    */
+    uint32_t decr_freq;    /* decrementer frequency           */
     struct QEMUTimer *decr_timer;
-#if defined(TARGET_PPC64H)
     /* Hypervisor decrementer management */
     uint64_t hdecr_next;    /* Tick for next hdecr interrupt  */
     struct QEMUTimer *hdecr_timer;
     uint64_t purr_load;
     uint64_t purr_start;
-#endif
     void *opaque;
 };
 
-static inline uint64_t cpu_ppc_get_tb (ppc_tb_t *tb_env, int64_t tb_offset)
+static always_inline uint64_t cpu_ppc_get_tb (ppc_tb_t *tb_env, uint64_t vmclk,
+                                              int64_t tb_offset)
 {
     /* TB time in tb periods */
-    return muldiv64(qemu_get_clock(vm_clock) + tb_env->tb_offset,
-                    tb_env->tb_freq, ticks_per_sec);
+    return muldiv64(vmclk, tb_env->tb_freq, ticks_per_sec) + tb_offset;
 }
 
 uint32_t cpu_ppc_load_tbl (CPUState *env)
@@ -434,25 +454,25 @@ uint32_t cpu_ppc_load_tbl (CPUState *env)
     ppc_tb_t *tb_env = env->tb_env;
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, tb_env->tb_offset);
+    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
 #if defined(PPC_DEBUG_TB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: tb=0x%016lx\n", __func__, tb);
+        fprintf(logfile, "%s: tb %016" PRIx64 "\n", __func__, tb);
     }
 #endif
 
     return tb & 0xFFFFFFFF;
 }
 
-static inline uint32_t _cpu_ppc_load_tbu (CPUState *env)
+static always_inline uint32_t _cpu_ppc_load_tbu (CPUState *env)
 {
     ppc_tb_t *tb_env = env->tb_env;
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, tb_env->tb_offset);
+    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
 #if defined(PPC_DEBUG_TB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: tb=0x%016lx\n", __func__, tb);
+        fprintf(logfile, "%s: tb %016" PRIx64 "\n", __func__, tb);
     }
 #endif
 
@@ -464,15 +484,15 @@ uint32_t cpu_ppc_load_tbu (CPUState *env)
     return _cpu_ppc_load_tbu(env);
 }
 
-static inline void cpu_ppc_store_tb (ppc_tb_t *tb_env, int64_t *tb_offsetp,
-                                     uint64_t value)
+static always_inline void cpu_ppc_store_tb (ppc_tb_t *tb_env, uint64_t vmclk,
+                                            int64_t *tb_offsetp,
+                                            uint64_t value)
 {
-    *tb_offsetp = muldiv64(value, ticks_per_sec, tb_env->tb_freq)
-        - qemu_get_clock(vm_clock);
+    *tb_offsetp = value - muldiv64(vmclk, tb_env->tb_freq, ticks_per_sec);
 #ifdef PPC_DEBUG_TB
     if (loglevel != 0) {
-        fprintf(logfile, "%s: tb=0x%016lx offset=%08lx\n", __func__, value,
-                *tb_offsetp);
+        fprintf(logfile, "%s: tb %016" PRIx64 " offset %08" PRIx64 "\n",
+                __func__, value, *tb_offsetp);
     }
 #endif
 }
@@ -482,20 +502,21 @@ void cpu_ppc_store_tbl (CPUState *env, uint32_t value)
     ppc_tb_t *tb_env = env->tb_env;
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, tb_env->tb_offset);
+    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
     tb &= 0xFFFFFFFF00000000ULL;
-    cpu_ppc_store_tb(tb_env, &tb_env->tb_offset, tb | (uint64_t)value);
+    cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
+                     &tb_env->tb_offset, tb | (uint64_t)value);
 }
 
-static inline void _cpu_ppc_store_tbu (CPUState *env, uint32_t value)
+static always_inline void _cpu_ppc_store_tbu (CPUState *env, uint32_t value)
 {
     ppc_tb_t *tb_env = env->tb_env;
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, tb_env->tb_offset);
+    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->tb_offset);
     tb &= 0x00000000FFFFFFFFULL;
-    cpu_ppc_store_tb(tb_env, &tb_env->tb_offset,
-                     ((uint64_t)value << 32) | tb);
+    cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
+                     &tb_env->tb_offset, ((uint64_t)value << 32) | tb);
 }
 
 void cpu_ppc_store_tbu (CPUState *env, uint32_t value)
@@ -508,10 +529,10 @@ uint32_t cpu_ppc_load_atbl (CPUState *env)
     ppc_tb_t *tb_env = env->tb_env;
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, tb_env->atb_offset);
+    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
 #if defined(PPC_DEBUG_TB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: tb=0x%016lx\n", __func__, tb);
+        fprintf(logfile, "%s: tb %016" PRIx64 "\n", __func__, tb);
     }
 #endif
 
@@ -523,10 +544,10 @@ uint32_t cpu_ppc_load_atbu (CPUState *env)
     ppc_tb_t *tb_env = env->tb_env;
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, tb_env->atb_offset);
+    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
 #if defined(PPC_DEBUG_TB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: tb=0x%016lx\n", __func__, tb);
+        fprintf(logfile, "%s: tb %016" PRIx64 "\n", __func__, tb);
     }
 #endif
 
@@ -538,9 +559,10 @@ void cpu_ppc_store_atbl (CPUState *env, uint32_t value)
     ppc_tb_t *tb_env = env->tb_env;
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, tb_env->atb_offset);
+    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
     tb &= 0xFFFFFFFF00000000ULL;
-    cpu_ppc_store_tb(tb_env, &tb_env->atb_offset, tb | (uint64_t)value);
+    cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
+                     &tb_env->atb_offset, tb | (uint64_t)value);
 }
 
 void cpu_ppc_store_atbu (CPUState *env, uint32_t value)
@@ -548,13 +570,57 @@ void cpu_ppc_store_atbu (CPUState *env, uint32_t value)
     ppc_tb_t *tb_env = env->tb_env;
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, tb_env->atb_offset);
+    tb = cpu_ppc_get_tb(tb_env, qemu_get_clock(vm_clock), tb_env->atb_offset);
     tb &= 0x00000000FFFFFFFFULL;
-    cpu_ppc_store_tb(tb_env, &tb_env->atb_offset,
-                     ((uint64_t)value << 32) | tb);
+    cpu_ppc_store_tb(tb_env, qemu_get_clock(vm_clock),
+                     &tb_env->atb_offset, ((uint64_t)value << 32) | tb);
+}
+
+static void cpu_ppc_tb_stop (CPUState *env)
+{
+    ppc_tb_t *tb_env = env->tb_env;
+    uint64_t tb, atb, vmclk;
+
+    /* If the time base is already frozen, do nothing */
+    if (tb_env->tb_freq != 0) {
+        vmclk = qemu_get_clock(vm_clock);
+        /* Get the time base */
+        tb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->tb_offset);
+        /* Get the alternate time base */
+        atb = cpu_ppc_get_tb(tb_env, vmclk, tb_env->atb_offset);
+        /* Store the time base value (ie compute the current offset) */
+        cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
+        /* Store the alternate time base value (compute the current offset) */
+        cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
+        /* Set the time base frequency to zero */
+        tb_env->tb_freq = 0;
+        /* Now, the time bases are frozen to tb_offset / atb_offset value */
+    }
 }
 
-static inline uint32_t _cpu_ppc_load_decr (CPUState *env, uint64_t *next)
+static void cpu_ppc_tb_start (CPUState *env)
+{
+    ppc_tb_t *tb_env = env->tb_env;
+    uint64_t tb, atb, vmclk;
+
+    /* If the time base is not frozen, do nothing */
+    if (tb_env->tb_freq == 0) {
+        vmclk = qemu_get_clock(vm_clock);
+        /* Get the time base from tb_offset */
+        tb = tb_env->tb_offset;
+        /* Get the alternate time base from atb_offset */
+        atb = tb_env->atb_offset;
+        /* Restore the tb frequency from the decrementer frequency */
+        tb_env->tb_freq = tb_env->decr_freq;
+        /* Store the time base value */
+        cpu_ppc_store_tb(tb_env, vmclk, &tb_env->tb_offset, tb);
+        /* Store the alternate time base value */
+        cpu_ppc_store_tb(tb_env, vmclk, &tb_env->atb_offset, atb);
+    }
+}
+
+static always_inline uint32_t _cpu_ppc_load_decr (CPUState *env,
+                                                  uint64_t *next)
 {
     ppc_tb_t *tb_env = env->tb_env;
     uint32_t decr;
@@ -562,12 +628,12 @@ static inline uint32_t _cpu_ppc_load_decr (CPUState *env, uint64_t *next)
 
     diff = tb_env->decr_next - qemu_get_clock(vm_clock);
     if (diff >= 0)
-        decr = muldiv64(diff, tb_env->tb_freq, ticks_per_sec);
+        decr = muldiv64(diff, tb_env->decr_freq, ticks_per_sec);
     else
-        decr = -muldiv64(-diff, tb_env->tb_freq, ticks_per_sec);
+        decr = -muldiv64(-diff, tb_env->decr_freq, ticks_per_sec);
 #if defined(PPC_DEBUG_TB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: 0x%08x\n", __func__, decr);
+        fprintf(logfile, "%s: %08" PRIx32 "\n", __func__, decr);
     }
 #endif
 
@@ -581,7 +647,6 @@ uint32_t cpu_ppc_load_decr (CPUState *env)
     return _cpu_ppc_load_decr(env, &tb_env->decr_next);
 }
 
-#if defined(TARGET_PPC64H)
 uint32_t cpu_ppc_load_hdecr (CPUState *env)
 {
     ppc_tb_t *tb_env = env->tb_env;
@@ -595,15 +660,14 @@ uint64_t cpu_ppc_load_purr (CPUState *env)
     uint64_t diff;
 
     diff = qemu_get_clock(vm_clock) - tb_env->purr_start;
-    
+
     return tb_env->purr_load + muldiv64(diff, tb_env->tb_freq, ticks_per_sec);
 }
-#endif /* defined(TARGET_PPC64H) */
 
 /* When decrementer expires,
  * all we need to do is generate or queue a CPU exception
  */
-static inline void cpu_ppc_decr_excp (CPUState *env)
+static always_inline void cpu_ppc_decr_excp (CPUState *env)
 {
     /* Raise it */
 #ifdef PPC_DEBUG_TB
@@ -614,7 +678,7 @@ static inline void cpu_ppc_decr_excp (CPUState *env)
     ppc_set_irq(env, PPC_INTERRUPT_DECR, 1);
 }
 
-static inline void cpu_ppc_hdecr_excp (CPUState *env)
+static always_inline void cpu_ppc_hdecr_excp (CPUState *env)
 {
     /* Raise it */
 #ifdef PPC_DEBUG_TB
@@ -626,21 +690,22 @@ static inline void cpu_ppc_hdecr_excp (CPUState *env)
 }
 
 static void __cpu_ppc_store_decr (CPUState *env, uint64_t *nextp,
-                                 struct QEMUTimer *timer,
-                                 void (*raise_excp)(CPUState *),
-                                 uint32_t decr, uint32_t value,
-                                 int is_excp)
+                                  struct QEMUTimer *timer,
+                                  void (*raise_excp)(CPUState *),
+                                  uint32_t decr, uint32_t value,
+                                  int is_excp)
 {
     ppc_tb_t *tb_env = env->tb_env;
     uint64_t now, next;
 
 #ifdef PPC_DEBUG_TB
     if (loglevel != 0) {
-        fprintf(logfile, "%s: 0x%08x => 0x%08x\n", __func__, decr, value);
+        fprintf(logfile, "%s: %08" PRIx32 " => %08" PRIx32 "\n", __func__,
+                decr, value);
     }
 #endif
     now = qemu_get_clock(vm_clock);
-    next = now + muldiv64(value, ticks_per_sec, tb_env->tb_freq);
+    next = now + muldiv64(value, ticks_per_sec, tb_env->decr_freq);
     if (is_excp)
         next += *nextp - now;
     if (next == now)
@@ -655,9 +720,8 @@ static void __cpu_ppc_store_decr (CPUState *env, uint64_t *nextp,
         (*raise_excp)(env);
 }
 
-
-static inline void _cpu_ppc_store_decr (CPUState *env, uint32_t decr,
-                                        uint32_t value, int is_excp)
+static always_inline void _cpu_ppc_store_decr (CPUState *env, uint32_t decr,
+                                               uint32_t value, int is_excp)
 {
     ppc_tb_t *tb_env = env->tb_env;
 
@@ -675,14 +739,15 @@ static void cpu_ppc_decr_cb (void *opaque)
     _cpu_ppc_store_decr(opaque, 0x00000000, 0xFFFFFFFF, 1);
 }
 
-#if defined(TARGET_PPC64H)
-static inline void _cpu_ppc_store_hdecr (CPUState *env, uint32_t hdecr,
-                                        uint32_t value, int is_excp)
+static always_inline void _cpu_ppc_store_hdecr (CPUState *env, uint32_t hdecr,
+                                                uint32_t value, int is_excp)
 {
     ppc_tb_t *tb_env = env->tb_env;
 
-    __cpu_ppc_store_decr(env, &tb_env->hdecr_next, tb_env->hdecr_timer,
-                         &cpu_ppc_hdecr_excp, hdecr, value, is_excp);
+    if (tb_env->hdecr_timer != NULL) {
+        __cpu_ppc_store_decr(env, &tb_env->hdecr_next, tb_env->hdecr_timer,
+                             &cpu_ppc_hdecr_excp, hdecr, value, is_excp);
+    }
 }
 
 void cpu_ppc_store_hdecr (CPUState *env, uint32_t value)
@@ -702,7 +767,6 @@ void cpu_ppc_store_purr (CPUState *env, uint64_t value)
     tb_env->purr_load = value;
     tb_env->purr_start = qemu_get_clock(vm_clock);
 }
-#endif /* defined(TARGET_PPC64H) */
 
 static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
 {
@@ -710,15 +774,14 @@ static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)
     ppc_tb_t *tb_env = env->tb_env;
 
     tb_env->tb_freq = freq;
+    tb_env->decr_freq = freq;
     /* There is a bug in Linux 2.4 kernels:
      * if a decrementer exception is pending when it enables msr_ee at startup,
      * it's not ready to handle it...
      */
     _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
-#if defined(TARGET_PPC64H)
     _cpu_ppc_store_hdecr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);
     cpu_ppc_store_purr(env, 0x0000000000000000ULL);
-#endif /* defined(TARGET_PPC64H) */
 }
 
 /* Set up (once) timebase frequency (in Hz) */
@@ -732,9 +795,13 @@ clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq)
     env->tb_env = tb_env;
     /* Create new timer */
     tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_ppc_decr_cb, env);
-#if defined(TARGET_PPC64H)
-    tb_env->hdecr_timer = qemu_new_timer(vm_clock, &cpu_ppc_hdecr_cb, env);
-#endif /* defined(TARGET_PPC64H) */
+    if (0) {
+        /* XXX: find a suitable condition to enable the hypervisor decrementer
+         */
+        tb_env->hdecr_timer = qemu_new_timer(vm_clock, &cpu_ppc_hdecr_cb, env);
+    } else {
+        tb_env->hdecr_timer = NULL;
+    }
     cpu_ppc_set_tb_clk(env, freq);
 
     return &cpu_ppc_set_tb_clk;
@@ -844,13 +911,13 @@ static void start_stop_pit (CPUState *env, ppc_tb_t *tb_env, int is_excp)
     } else {
 #ifdef PPC_DEBUG_TB
         if (loglevel != 0) {
-            fprintf(logfile, "%s: start PIT 0x" REGX "\n",
+            fprintf(logfile, "%s: start PIT %016" PRIx64 "\n",
                     __func__, ppcemb_timer->pit_reload);
         }
 #endif
         now = qemu_get_clock(vm_clock);
         next = now + muldiv64(ppcemb_timer->pit_reload,
-                              ticks_per_sec, tb_env->tb_freq);
+                              ticks_per_sec, tb_env->decr_freq);
         if (is_excp)
             next += tb_env->decr_next - now;
         if (next == now)
@@ -914,7 +981,7 @@ static void cpu_4xx_wdt_cb (void *opaque)
         /* Cannot occur, but makes gcc happy */
         return;
     }
-    next = now + muldiv64(next, ticks_per_sec, tb_env->tb_freq);
+    next = now + muldiv64(next, ticks_per_sec, tb_env->decr_freq);
     if (next == now)
         next++;
 #ifdef PPC_DEBUG_TB
@@ -966,7 +1033,7 @@ void store_40x_pit (CPUState *env, target_ulong val)
     ppcemb_timer = tb_env->opaque;
 #ifdef PPC_DEBUG_TB
     if (loglevel != 0) {
-        fprintf(logfile, "%s %p %p\n", __func__, tb_env, ppcemb_timer);
+        fprintf(logfile, "%s val" ADDRX "\n", __func__, val);
     }
 #endif
     ppcemb_timer->pit_reload = val;
@@ -982,7 +1049,7 @@ void store_booke_tsr (CPUState *env, target_ulong val)
 {
 #ifdef PPC_DEBUG_TB
     if (loglevel != 0) {
-        fprintf(logfile, "%s: val=" ADDRX "\n", __func__, val);
+        fprintf(logfile, "%s: val " ADDRX "\n", __func__, val);
     }
 #endif
     env->spr[SPR_40x_TSR] &= ~(val & 0xFC000000);
@@ -997,7 +1064,7 @@ void store_booke_tcr (CPUState *env, target_ulong val)
     tb_env = env->tb_env;
 #ifdef PPC_DEBUG_TB
     if (loglevel != 0) {
-        fprintf(logfile, "%s: val=" ADDRX "\n", __func__, val);
+        fprintf(logfile, "%s: val " ADDRX "\n", __func__, val);
     }
 #endif
     env->spr[SPR_40x_TCR] = val & 0xFFC00000;
@@ -1012,10 +1079,12 @@ static void ppc_emb_set_tb_clk (void *opaque, uint32_t freq)
 
 #ifdef PPC_DEBUG_TB
     if (loglevel != 0) {
-        fprintf(logfile, "%s set new frequency to %u\n", __func__, freq);
+        fprintf(logfile, "%s set new frequency to %" PRIu32 "\n", __func__,
+                freq);
     }
 #endif
     tb_env->tb_freq = freq;
+    tb_env->decr_freq = freq;
     /* XXX: we should also update all timers */
 }
 
@@ -1031,11 +1100,11 @@ clk_setup_cb ppc_emb_timers_init (CPUState *env, uint32_t freq)
     env->tb_env = tb_env;
     ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));
     tb_env->tb_freq = freq;
+    tb_env->decr_freq = freq;
     tb_env->opaque = ppcemb_timer;
 #ifdef PPC_DEBUG_TB
     if (loglevel != 0) {
-        fprintf(logfile, "%s %p %p %p\n", __func__, tb_env, ppcemb_timer,
-                &ppc_emb_set_tb_clk);
+        fprintf(logfile, "%s freq %" PRIu32 "\n", __func__, freq);
     }
 #endif
     if (ppcemb_timer != NULL) {
@@ -1147,7 +1216,6 @@ int ppc_dcr_init (CPUState *env, int (*read_error)(int dcrn),
     return 0;
 }
 
-
 #if 0
 /*****************************************************************************/
 /* Handle system reset (for now, just stop emulation) */
@@ -1172,7 +1240,7 @@ void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
         fflush(stdout);
         break;
     case 2:
-        printf("Set loglevel to %04x\n", val);
+        printf("Set loglevel to %04" PRIx32 "\n", val);
         cpu_set_log(val | 0x100);
         break;
     }
@@ -1180,63 +1248,75 @@ void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
 
 /*****************************************************************************/
 /* NVRAM helpers */
-void NVRAM_set_byte (m48t59_t *nvram, uint32_t addr, uint8_t value)
+static inline uint32_t nvram_read (nvram_t *nvram, uint32_t addr)
 {
-    m48t59_write(nvram, addr, value);
+    return (*nvram->read_fn)(nvram->opaque, addr);;
 }
 
-uint8_t NVRAM_get_byte (m48t59_t *nvram, uint32_t addr)
+static inline void nvram_write (nvram_t *nvram, uint32_t addr, uint32_t val)
 {
-    return m48t59_read(nvram, addr);
+    (*nvram->write_fn)(nvram->opaque, addr, val);
 }
 
-void NVRAM_set_word (m48t59_t *nvram, uint32_t addr, uint16_t value)
+void NVRAM_set_byte (nvram_t *nvram, uint32_t addr, uint8_t value)
 {
-    m48t59_write(nvram, addr, value >> 8);
-    m48t59_write(nvram, addr + 1, value & 0xFF);
+    nvram_write(nvram, addr, value);
 }
 
-uint16_t NVRAM_get_word (m48t59_t *nvram, uint32_t addr)
+uint8_t NVRAM_get_byte (nvram_t *nvram, uint32_t addr)
+{
+    return nvram_read(nvram, addr);
+}
+
+void NVRAM_set_word (nvram_t *nvram, uint32_t addr, uint16_t value)
+{
+    nvram_write(nvram, addr, value >> 8);
+    nvram_write(nvram, addr + 1, value & 0xFF);
+}
+
+uint16_t NVRAM_get_word (nvram_t *nvram, uint32_t addr)
 {
     uint16_t tmp;
 
-    tmp = m48t59_read(nvram, addr) << 8;
-    tmp |= m48t59_read(nvram, addr + 1);
+    tmp = nvram_read(nvram, addr) << 8;
+    tmp |= nvram_read(nvram, addr + 1);
+
     return tmp;
 }
 
-void NVRAM_set_lword (m48t59_t *nvram, uint32_t addr, uint32_t value)
+void NVRAM_set_lword (nvram_t *nvram, uint32_t addr, uint32_t value)
 {
-    m48t59_write(nvram, addr, value >> 24);
-    m48t59_write(nvram, addr + 1, (value >> 16) & 0xFF);
-    m48t59_write(nvram, addr + 2, (value >> 8) & 0xFF);
-    m48t59_write(nvram, addr + 3, value & 0xFF);
+    nvram_write(nvram, addr, value >> 24);
+    nvram_write(nvram, addr + 1, (value >> 16) & 0xFF);
+    nvram_write(nvram, addr + 2, (value >> 8) & 0xFF);
+    nvram_write(nvram, addr + 3, value & 0xFF);
 }
 
-uint32_t NVRAM_get_lword (m48t59_t *nvram, uint32_t addr)
+uint32_t NVRAM_get_lword (nvram_t *nvram, uint32_t addr)
 {
     uint32_t tmp;
 
-    tmp = m48t59_read(nvram, addr) << 24;
-    tmp |= m48t59_read(nvram, addr + 1) << 16;
-    tmp |= m48t59_read(nvram, addr + 2) << 8;
-    tmp |= m48t59_read(nvram, addr + 3);
+    tmp = nvram_read(nvram, addr) << 24;
+    tmp |= nvram_read(nvram, addr + 1) << 16;
+    tmp |= nvram_read(nvram, addr + 2) << 8;
+    tmp |= nvram_read(nvram, addr + 3);
 
     return tmp;
 }
 
-void NVRAM_set_string (m48t59_t *nvram, uint32_t addr,
+void NVRAM_set_string (nvram_t *nvram, uint32_t addr,
                        const unsigned char *str, uint32_t max)
 {
     int i;
 
     for (i = 0; i < max && str[i] != '\0'; i++) {
-        m48t59_write(nvram, addr + i, str[i]);
+        nvram_write(nvram, addr + i, str[i]);
     }
-    m48t59_write(nvram, addr + max - 1, '\0');
+    nvram_write(nvram, addr + i, str[i]);
+    nvram_write(nvram, addr + max - 1, '\0');
 }
 
-int NVRAM_get_string (m48t59_t *nvram, uint8_t *dst, uint16_t addr, int max)
+int NVRAM_get_string (nvram_t *nvram, uint8_t *dst, uint16_t addr, int max)
 {
     int i;
 
@@ -1265,7 +1345,7 @@ static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
     return tmp;
 }
 
-uint16_t NVRAM_compute_crc (m48t59_t *nvram, uint32_t start, uint32_t count)
+uint16_t NVRAM_compute_crc (nvram_t *nvram, uint32_t start, uint32_t count)
 {
     uint32_t i;
     uint16_t crc = 0xFFFF;
@@ -1285,7 +1365,7 @@ uint16_t NVRAM_compute_crc (m48t59_t *nvram, uint32_t start, uint32_t count)
 
 #define CMDLINE_ADDR 0x017ff000
 
-int PPC_NVRAM_set_params (m48t59_t *nvram, uint16_t NVRAM_size,
+int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
                           const unsigned char *arch,
                           uint32_t RAM_size, int boot_device,
                           uint32_t kernel_image, uint32_t kernel_size,
@@ -1322,7 +1402,7 @@ int PPC_NVRAM_set_params (m48t59_t *nvram, uint16_t NVRAM_size,
     NVRAM_set_word(nvram,   0x56, height);
     NVRAM_set_word(nvram,   0x58, depth);
     crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
-    NVRAM_set_word(nvram,  0xFC, crc);
+    NVRAM_set_word(nvram,   0xFC, crc);
 
     return 0;
 }
diff --git a/hw/ppc.h b/hw/ppc.h
new file mode 100644
index 000000000..0a3d4ff06
--- /dev/null
+++ b/hw/ppc.h
@@ -0,0 +1,31 @@
+/* PowerPC hardware exceptions management helpers */
+typedef void (*clk_setup_cb)(void *opaque, uint32_t freq);
+typedef struct clk_setup_t clk_setup_t;
+struct clk_setup_t {
+    clk_setup_cb cb;
+    void *opaque;
+};
+static inline void clk_setup (clk_setup_t *clk, uint32_t freq)
+{
+    if (clk->cb != NULL)
+        (*clk->cb)(clk->opaque, freq);
+}
+
+clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq);
+/* Embedded PowerPC DCR management */
+typedef target_ulong (*dcr_read_cb)(void *opaque, int dcrn);
+typedef void (*dcr_write_cb)(void *opaque, int dcrn, target_ulong val);
+int ppc_dcr_init (CPUState *env, int (*dcr_read_error)(int dcrn),
+                  int (*dcr_write_error)(int dcrn));
+int ppc_dcr_register (CPUState *env, int dcrn, void *opaque,
+                      dcr_read_cb drc_read, dcr_write_cb dcr_write);
+clk_setup_cb ppc_emb_timers_init (CPUState *env, uint32_t freq);
+/* Embedded PowerPC reset */
+void ppc40x_core_reset (CPUState *env);
+void ppc40x_chip_reset (CPUState *env);
+void ppc40x_system_reset (CPUState *env);
+void PREP_debug_write (void *opaque, uint32_t addr, uint32_t val);
+
+extern CPUWriteMemoryFunc *PPC_io_write[];
+extern CPUReadMemoryFunc *PPC_io_read[];
+void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val);
diff --git a/hw/ppc405.h b/hw/ppc405.h
index eacbefedd..e03217016 100644
--- a/hw/ppc405.h
+++ b/hw/ppc405.h
@@ -25,6 +25,8 @@
 #if !defined(PPC_405_H)
 #define PPC_405_H
 
+#include "ppc4xx.h"
+
 /* Bootinfo as set-up by u-boot */
 typedef struct ppc4xx_bd_info_t ppc4xx_bd_info_t;
 struct ppc4xx_bd_info_t {
@@ -54,19 +56,9 @@ struct ppc4xx_bd_info_t {
 };
 
 /* PowerPC 405 core */
-CPUState *ppc405_init (const unsigned char *cpu_model,
-                       clk_setup_t *cpu_clk, clk_setup_t *tb_clk,
-                       uint32_t sysclk);
 ram_addr_t ppc405_set_bootinfo (CPUState *env, ppc4xx_bd_info_t *bd,
                                 uint32_t flags);
 
-/* */
-typedef struct ppc4xx_mmio_t ppc4xx_mmio_t;
-int ppc4xx_mmio_register (CPUState *env, ppc4xx_mmio_t *mmio,
-                          target_phys_addr_t offset, uint32_t len,
-                          CPUReadMemoryFunc **mem_read,
-                          CPUWriteMemoryFunc **mem_write, void *opaque);
-ppc4xx_mmio_t *ppc4xx_mmio_init (CPUState *env, target_phys_addr_t base);
 /* PowerPC 4xx peripheral local bus arbitrer */
 void ppc4xx_plb_init (CPUState *env);
 /* PLB to OPB bridge */
@@ -74,14 +66,6 @@ void ppc4xx_pob_init (CPUState *env);
 /* OPB arbitrer */
 void ppc4xx_opba_init (CPUState *env, ppc4xx_mmio_t *mmio,
                        target_phys_addr_t offset);
-/* PowerPC 4xx universal interrupt controller */
-enum {
-    PPCUIC_OUTPUT_INT = 0,
-    PPCUIC_OUTPUT_CINT = 1,
-    PPCUIC_OUTPUT_NB,
-};
-qemu_irq *ppcuic_init (CPUState *env, qemu_irq *irqs,
-                       uint32_t dcr_base, int has_ssr, int has_vr);
 /* SDRAM controller */
 void ppc405_sdram_init (CPUState *env, qemu_irq irq, int nbanks,
                         target_phys_addr_t *ram_bases,
diff --git a/hw/ppc405_boards.c b/hw/ppc405_boards.c
index 8f82ea9e1..b96a18849 100644
--- a/hw/ppc405_boards.c
+++ b/hw/ppc405_boards.c
@@ -21,8 +21,14 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "ppc.h"
 #include "ppc405.h"
+#include "nvram.h"
+#include "flash.h"
+#include "sysemu.h"
+#include "block.h"
+#include "boards.h"
 
 extern int loglevel;
 extern FILE *logfile;
@@ -171,9 +177,8 @@ static void ref405ep_fpga_init (uint32_t base)
     }
 }
 
-static void ref405ep_init (int ram_size, int vga_ram_size, int boot_device,
-                           DisplayState *ds, const char **fd_filename,
-                           int snapshot,
+static void ref405ep_init (int ram_size, int vga_ram_size,
+                           const char *boot_device, DisplayState *ds,
                            const char *kernel_filename,
                            const char *kernel_cmdline,
                            const char *initrd_filename,
@@ -191,6 +196,8 @@ static void ref405ep_init (int ram_size, int vga_ram_size, int boot_device,
     target_ulong kernel_base, kernel_size, initrd_base, initrd_size;
     int linux_boot;
     int fl_idx, fl_sectors, len;
+    int ppc_boot_device = boot_device[0];
+    int index;
 
     /* XXX: fix this */
     ram_bases[0] = 0x00000000;
@@ -217,18 +224,19 @@ static void ref405ep_init (int ram_size, int vga_ram_size, int boot_device,
     bios_offset = sram_offset + sram_size;
     fl_idx = 0;
 #ifdef USE_FLASH_BIOS
-    if (pflash_table[fl_idx] != NULL) {
-        bios_size = bdrv_getlength(pflash_table[fl_idx]);
+    index = drive_get_index(IF_PFLASH, 0, fl_idx);
+    if (index != -1) {
+        bios_size = bdrv_getlength(drives_table[index].bdrv);
         fl_sectors = (bios_size + 65535) >> 16;
 #ifdef DEBUG_BOARD_INIT
         printf("Register parallel flash %d size " ADDRX " at offset %08lx "
                " addr " ADDRX " '%s' %d\n",
                fl_idx, bios_size, bios_offset, -bios_size,
-               bdrv_get_device_name(pflash_table[fl_idx]), fl_sectors);
+               bdrv_get_device_name(drives_table[index].bdrv), fl_sectors);
 #endif
-        pflash_register(-(bios_size), bios_offset, pflash_table[fl_idx],
-                        65536, fl_sectors, 2,
-                        0x0001, 0x22DA, 0x0000, 0x0000);
+        pflash_cfi02_register((uint32_t)(-bios_size), bios_offset,
+                              drives_table[index].bdrv, 65536, fl_sectors, 2,
+                              0x0001, 0x22DA, 0x0000, 0x0000);
         fl_idx++;
     } else
 #endif
@@ -236,7 +244,9 @@ static void ref405ep_init (int ram_size, int vga_ram_size, int boot_device,
 #ifdef DEBUG_BOARD_INIT
         printf("Load BIOS from file\n");
 #endif
-        snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME);
+        if (bios_name == NULL)
+            bios_name = BIOS_FILENAME;
+        snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
         bios_size = load_image(buf, phys_ram_base + bios_offset);
         if (bios_size < 0 || bios_size > BIOS_SIZE) {
             fprintf(stderr, "qemu: could not load PowerPC bios '%s'\n", buf);
@@ -266,7 +276,7 @@ static void ref405ep_init (int ram_size, int vga_ram_size, int boot_device,
         memset(&bd, 0, sizeof(bd));
         bd.bi_memstart = 0x00000000;
         bd.bi_memsize = ram_size;
-        bd.bi_flashstart = -(bios_size);
+        bd.bi_flashstart = -bios_size;
         bd.bi_flashsize = -bios_size;
         bd.bi_flashoffset = 0;
         bd.bi_sramstart = 0xFFF00000;
@@ -320,7 +330,7 @@ static void ref405ep_init (int ram_size, int vga_ram_size, int boot_device,
         }
         env->gpr[4] = initrd_base;
         env->gpr[5] = initrd_size;
-        boot_device = 'm';
+        ppc_boot_device = 'm';
         if (kernel_cmdline != NULL) {
             len = strlen(kernel_cmdline);
             bdloc -= ((len + 255) & ~255);
@@ -494,9 +504,8 @@ static void taihu_cpld_init (uint32_t base)
     }
 }
 
-static void taihu_405ep_init(int ram_size, int vga_ram_size, int boot_device,
-                             DisplayState *ds, const char **fd_filename,
-                             int snapshot,
+static void taihu_405ep_init(int ram_size, int vga_ram_size,
+                             const char *boot_device, DisplayState *ds,
                              const char *kernel_filename,
                              const char *kernel_cmdline,
                              const char *initrd_filename,
@@ -511,6 +520,8 @@ static void taihu_405ep_init(int ram_size, int vga_ram_size, int boot_device,
     target_ulong kernel_base, kernel_size, initrd_base, initrd_size;
     int linux_boot;
     int fl_idx, fl_sectors;
+    int ppc_boot_device = boot_device[0];
+    int index;
 
     /* RAM is soldered to the board so the size cannot be changed */
     ram_bases[0] = 0x00000000;
@@ -528,8 +539,9 @@ static void taihu_405ep_init(int ram_size, int vga_ram_size, int boot_device,
 #endif
     fl_idx = 0;
 #if defined(USE_FLASH_BIOS)
-    if (pflash_table[fl_idx] != NULL) {
-        bios_size = bdrv_getlength(pflash_table[fl_idx]);
+    index = drive_get_index(IF_PFLASH, 0, fl_idx);
+    if (index != -1) {
+        bios_size = bdrv_getlength(drives_table[index].bdrv);
         /* XXX: should check that size is 2MB */
         //        bios_size = 2 * 1024 * 1024;
         fl_sectors = (bios_size + 65535) >> 16;
@@ -537,11 +549,11 @@ static void taihu_405ep_init(int ram_size, int vga_ram_size, int boot_device,
         printf("Register parallel flash %d size " ADDRX " at offset %08lx "
                " addr " ADDRX " '%s' %d\n",
                fl_idx, bios_size, bios_offset, -bios_size,
-               bdrv_get_device_name(pflash_table[fl_idx]), fl_sectors);
+               bdrv_get_device_name(drives_table[index].bdrv), fl_sectors);
 #endif
-        pflash_register(-(bios_size), bios_offset, pflash_table[fl_idx],
-                        65536, fl_sectors, 4,
-                        0x0001, 0x22DA, 0x0000, 0x0000);
+        pflash_cfi02_register((uint32_t)(-bios_size), bios_offset,
+                              drives_table[index].bdrv, 65536, fl_sectors, 4,
+                              0x0001, 0x22DA, 0x0000, 0x0000);
         fl_idx++;
     } else
 #endif
@@ -549,7 +561,9 @@ static void taihu_405ep_init(int ram_size, int vga_ram_size, int boot_device,
 #ifdef DEBUG_BOARD_INIT
         printf("Load BIOS from file\n");
 #endif
-        snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME);
+        if (bios_name == NULL)
+            bios_name = BIOS_FILENAME;
+        snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
         bios_size = load_image(buf, phys_ram_base + bios_offset);
         if (bios_size < 0 || bios_size > BIOS_SIZE) {
             fprintf(stderr, "qemu: could not load PowerPC bios '%s'\n", buf);
@@ -561,8 +575,9 @@ static void taihu_405ep_init(int ram_size, int vga_ram_size, int boot_device,
     }
     bios_offset += bios_size;
     /* Register Linux flash */
-    if (pflash_table[fl_idx] != NULL) {
-        bios_size = bdrv_getlength(pflash_table[fl_idx]);
+    index = drive_get_index(IF_PFLASH, 0, fl_idx);
+    if (index != -1) {
+        bios_size = bdrv_getlength(drives_table[index].bdrv);
         /* XXX: should check that size is 32MB */
         bios_size = 32 * 1024 * 1024;
         fl_sectors = (bios_size + 65535) >> 16;
@@ -570,11 +585,11 @@ static void taihu_405ep_init(int ram_size, int vga_ram_size, int boot_device,
         printf("Register parallel flash %d size " ADDRX " at offset %08lx "
                " addr " ADDRX " '%s'\n",
                fl_idx, bios_size, bios_offset, (target_ulong)0xfc000000,
-               bdrv_get_device_name(pflash_table[fl_idx]));
+               bdrv_get_device_name(drives_table[index].bdrv));
 #endif
-        pflash_register(0xfc000000, bios_offset, pflash_table[fl_idx],
-                        65536, fl_sectors, 4,
-                        0x0001, 0x22DA, 0x0000, 0x0000);
+        pflash_cfi02_register(0xfc000000, bios_offset,
+                              drives_table[index].bdrv, 65536, fl_sectors, 4,
+                              0x0001, 0x22DA, 0x0000, 0x0000);
         fl_idx++;
     }
     /* Register CLPD & LCD display */
@@ -611,7 +626,7 @@ static void taihu_405ep_init(int ram_size, int vga_ram_size, int boot_device,
             initrd_base = 0;
             initrd_size = 0;
         }
-        boot_device = 'm';
+        ppc_boot_device = 'm';
     } else {
         kernel_base = 0;
         kernel_size = 0;
diff --git a/hw/ppc405_uc.c b/hw/ppc405_uc.c
index b6fc491ae..329330a61 100644
--- a/hw/ppc405_uc.c
+++ b/hw/ppc405_uc.c
@@ -21,13 +21,16 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "ppc.h"
 #include "ppc405.h"
+#include "pc.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
 
 extern int loglevel;
 extern FILE *logfile;
 
-//#define DEBUG_MMIO
 #define DEBUG_OPBA
 #define DEBUG_SDRAM
 #define DEBUG_GPIO
@@ -36,38 +39,8 @@ extern FILE *logfile;
 //#define DEBUG_I2C
 #define DEBUG_GPT
 #define DEBUG_MAL
-#define DEBUG_UIC
 #define DEBUG_CLOCKS
-//#define DEBUG_UNASSIGNED
-
-/*****************************************************************************/
-/* Generic PowerPC 405 processor instanciation */
-CPUState *ppc405_init (const unsigned char *cpu_model,
-                       clk_setup_t *cpu_clk, clk_setup_t *tb_clk,
-                       uint32_t sysclk)
-{
-    CPUState *env;
-    ppc_def_t *def;
-
-    /* init CPUs */
-    env = cpu_init();
-    qemu_register_reset(&cpu_ppc_reset, env);
-    register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
-    ppc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
-        cpu_abort(env, "Unable to find PowerPC %s CPU definition\n",
-                  cpu_model);
-    }
-    cpu_ppc_register(env, def);
-    cpu_clk->cb = NULL; /* We don't care about CPU clock frequency changes */
-    cpu_clk->opaque = env;
-    /* Set time-base frequency to sysclk */
-    tb_clk->cb = ppc_emb_timers_init(env, sysclk);
-    tb_clk->opaque = env;
-    ppc_dcr_init(env, NULL, NULL);
-
-    return env;
-}
+//#define DEBUG_CLOCKS_LL
 
 ram_addr_t ppc405_set_bootinfo (CPUState *env, ppc4xx_bd_info_t *bd,
                                 uint32_t flags)
@@ -122,203 +95,6 @@ ram_addr_t ppc405_set_bootinfo (CPUState *env, ppc4xx_bd_info_t *bd,
 /* Shared peripherals */
 
 /*****************************************************************************/
-/* Fake device used to map multiple devices in a single memory page */
-#define MMIO_AREA_BITS 8
-#define MMIO_AREA_LEN (1 << MMIO_AREA_BITS)
-#define MMIO_AREA_NB (1 << (TARGET_PAGE_BITS - MMIO_AREA_BITS))
-#define MMIO_IDX(addr) (((addr) >> MMIO_AREA_BITS) & (MMIO_AREA_NB - 1))
-struct ppc4xx_mmio_t {
-    target_phys_addr_t base;
-    CPUReadMemoryFunc **mem_read[MMIO_AREA_NB];
-    CPUWriteMemoryFunc **mem_write[MMIO_AREA_NB];
-    void *opaque[MMIO_AREA_NB];
-};
-
-static uint32_t unassigned_mmio_readb (void *opaque, target_phys_addr_t addr)
-{
-#ifdef DEBUG_UNASSIGNED
-    ppc4xx_mmio_t *mmio;
-
-    mmio = opaque;
-    printf("Unassigned mmio read 0x" PADDRX " base " PADDRX "\n",
-           addr, mmio->base);
-#endif
-
-    return 0;
-}
-
-static void unassigned_mmio_writeb (void *opaque,
-                                   target_phys_addr_t addr, uint32_t val)
-{
-#ifdef DEBUG_UNASSIGNED
-    ppc4xx_mmio_t *mmio;
-
-    mmio = opaque;
-    printf("Unassigned mmio write 0x" PADDRX " = 0x%x base " PADDRX "\n",
-           addr, val, mmio->base);
-#endif
-}
-
-static CPUReadMemoryFunc *unassigned_mmio_read[3] = {
-    unassigned_mmio_readb,
-    unassigned_mmio_readb,
-    unassigned_mmio_readb,
-};
-
-static CPUWriteMemoryFunc *unassigned_mmio_write[3] = {
-    unassigned_mmio_writeb,
-    unassigned_mmio_writeb,
-    unassigned_mmio_writeb,
-};
-
-static uint32_t mmio_readlen (ppc4xx_mmio_t *mmio,
-                              target_phys_addr_t addr, int len)
-{
-    CPUReadMemoryFunc **mem_read;
-    uint32_t ret;
-    int idx;
-
-    idx = MMIO_IDX(addr - mmio->base);
-#if defined(DEBUG_MMIO)
-    printf("%s: mmio %p len %d addr " PADDRX " idx %d\n", __func__,
-           mmio, len, addr, idx);
-#endif
-    mem_read = mmio->mem_read[idx];
-    ret = (*mem_read[len])(mmio->opaque[idx], addr - mmio->base);
-
-    return ret;
-}
-
-static void mmio_writelen (ppc4xx_mmio_t *mmio,
-                           target_phys_addr_t addr, uint32_t value, int len)
-{
-    CPUWriteMemoryFunc **mem_write;
-    int idx;
-
-    idx = MMIO_IDX(addr - mmio->base);
-#if defined(DEBUG_MMIO)
-    printf("%s: mmio %p len %d addr " PADDRX " idx %d value %08x\n", __func__,
-           mmio, len, addr, idx, value);
-#endif
-    mem_write = mmio->mem_write[idx];
-    (*mem_write[len])(mmio->opaque[idx], addr - mmio->base, value);
-}
-
-static uint32_t mmio_readb (void *opaque, target_phys_addr_t addr)
-{
-#if defined(DEBUG_MMIO)
-    printf("%s: addr " PADDRX "\n", __func__, addr);
-#endif
-
-    return mmio_readlen(opaque, addr, 0);
-}
-
-static void mmio_writeb (void *opaque,
-                         target_phys_addr_t addr, uint32_t value)
-{
-#if defined(DEBUG_MMIO)
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
-#endif
-    mmio_writelen(opaque, addr, value, 0);
-}
-
-static uint32_t mmio_readw (void *opaque, target_phys_addr_t addr)
-{
-#if defined(DEBUG_MMIO)
-    printf("%s: addr " PADDRX "\n", __func__, addr);
-#endif
-
-    return mmio_readlen(opaque, addr, 1);
-}
-
-static void mmio_writew (void *opaque,
-                         target_phys_addr_t addr, uint32_t value)
-{
-#if defined(DEBUG_MMIO)
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
-#endif
-    mmio_writelen(opaque, addr, value, 1);
-}
-
-static uint32_t mmio_readl (void *opaque, target_phys_addr_t addr)
-{
-#if defined(DEBUG_MMIO)
-    printf("%s: addr " PADDRX "\n", __func__, addr);
-#endif
-
-    return mmio_readlen(opaque, addr, 2);
-}
-
-static void mmio_writel (void *opaque,
-                         target_phys_addr_t addr, uint32_t value)
-{
-#if defined(DEBUG_MMIO)
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
-#endif
-    mmio_writelen(opaque, addr, value, 2);
-}
-
-static CPUReadMemoryFunc *mmio_read[] = {
-    &mmio_readb,
-    &mmio_readw,
-    &mmio_readl,
-};
-
-static CPUWriteMemoryFunc *mmio_write[] = {
-    &mmio_writeb,
-    &mmio_writew,
-    &mmio_writel,
-};
-
-int ppc4xx_mmio_register (CPUState *env, ppc4xx_mmio_t *mmio,
-                          target_phys_addr_t offset, uint32_t len,
-                          CPUReadMemoryFunc **mem_read,
-                          CPUWriteMemoryFunc **mem_write, void *opaque)
-{
-    uint32_t end;
-    int idx, eidx;
-
-    if ((offset + len) > TARGET_PAGE_SIZE)
-        return -1;
-    idx = MMIO_IDX(offset);
-    end = offset + len - 1;
-    eidx = MMIO_IDX(end);
-#if defined(DEBUG_MMIO)
-    printf("%s: offset %08x len %08x %08x %d %d\n", __func__, offset, len,
-           end, idx, eidx);
-#endif
-    for (; idx <= eidx; idx++) {
-        mmio->mem_read[idx] = mem_read;
-        mmio->mem_write[idx] = mem_write;
-        mmio->opaque[idx] = opaque;
-    }
-
-    return 0;
-}
-
-ppc4xx_mmio_t *ppc4xx_mmio_init (CPUState *env, target_phys_addr_t base)
-{
-    ppc4xx_mmio_t *mmio;
-    int mmio_memory;
-
-    mmio = qemu_mallocz(sizeof(ppc4xx_mmio_t));
-    if (mmio != NULL) {
-        mmio->base = base;
-        mmio_memory = cpu_register_io_memory(0, mmio_read, mmio_write, mmio);
-#if defined(DEBUG_MMIO)
-        printf("%s: %p base %08x len %08x %d\n", __func__,
-               mmio, base, TARGET_PAGE_SIZE, mmio_memory);
-#endif
-        cpu_register_physical_memory(base, TARGET_PAGE_SIZE, mmio_memory);
-        ppc4xx_mmio_register(env, mmio, 0, TARGET_PAGE_SIZE,
-                             unassigned_mmio_read, unassigned_mmio_write,
-                             mmio);
-    }
-
-    return mmio;
-}
-
-/*****************************************************************************/
 /* Peripheral local bus arbitrer */
 enum {
     PLB0_BESR = 0x084,
@@ -522,7 +298,7 @@ static void opba_writeb (void *opaque,
     ppc4xx_opba_t *opba;
 
 #ifdef DEBUG_OPBA
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
     opba = opaque;
     switch (addr - opba->base) {
@@ -554,7 +330,7 @@ static void opba_writew (void *opaque,
                          target_phys_addr_t addr, uint32_t value)
 {
 #ifdef DEBUG_OPBA
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
     opba_writeb(opaque, addr, value >> 8);
     opba_writeb(opaque, addr + 1, value);
@@ -577,7 +353,7 @@ static void opba_writel (void *opaque,
                          target_phys_addr_t addr, uint32_t value)
 {
 #ifdef DEBUG_OPBA
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
     opba_writeb(opaque, addr, value >> 24);
     opba_writeb(opaque, addr + 1, value >> 16);
@@ -613,7 +389,7 @@ void ppc4xx_opba_init (CPUState *env, ppc4xx_mmio_t *mmio,
     if (opba != NULL) {
         opba->base = offset;
 #ifdef DEBUG_OPBA
-        printf("%s: offset=" PADDRX "\n", __func__, offset);
+        printf("%s: offset " PADDRX "\n", __func__, offset);
 #endif
         ppc4xx_mmio_register(env, mmio, offset, 0x002,
                              opba_read, opba_write, opba);
@@ -623,281 +399,6 @@ void ppc4xx_opba_init (CPUState *env, ppc4xx_mmio_t *mmio,
 }
 
 /*****************************************************************************/
-/* "Universal" Interrupt controller */
-enum {
-    DCR_UICSR  = 0x000,
-    DCR_UICSRS = 0x001,
-    DCR_UICER  = 0x002,
-    DCR_UICCR  = 0x003,
-    DCR_UICPR  = 0x004,
-    DCR_UICTR  = 0x005,
-    DCR_UICMSR = 0x006,
-    DCR_UICVR  = 0x007,
-    DCR_UICVCR = 0x008,
-    DCR_UICMAX = 0x009,
-};
-
-#define UIC_MAX_IRQ 32
-typedef struct ppcuic_t ppcuic_t;
-struct ppcuic_t {
-    uint32_t dcr_base;
-    int use_vectors;
-    uint32_t uicsr;  /* Status register */
-    uint32_t uicer;  /* Enable register */
-    uint32_t uiccr;  /* Critical register */
-    uint32_t uicpr;  /* Polarity register */
-    uint32_t uictr;  /* Triggering register */
-    uint32_t uicvcr; /* Vector configuration register */
-    uint32_t uicvr;
-    qemu_irq *irqs;
-};
-
-static void ppcuic_trigger_irq (ppcuic_t *uic)
-{
-    uint32_t ir, cr;
-    int start, end, inc, i;
-
-    /* Trigger interrupt if any is pending */
-    ir = uic->uicsr & uic->uicer & (~uic->uiccr);
-    cr = uic->uicsr & uic->uicer & uic->uiccr;
-#ifdef DEBUG_UIC
-    if (loglevel & CPU_LOG_INT) {
-        fprintf(logfile, "%s: uicsr %08x uicer %08x uiccr %08x\n"
-                "   %08x ir %08x cr %08x\n", __func__,
-                uic->uicsr, uic->uicer, uic->uiccr,
-                uic->uicsr & uic->uicer, ir, cr);
-    }
-#endif
-    if (ir != 0x0000000) {
-#ifdef DEBUG_UIC
-        if (loglevel & CPU_LOG_INT) {
-            fprintf(logfile, "Raise UIC interrupt\n");
-        }
-#endif
-        qemu_irq_raise(uic->irqs[PPCUIC_OUTPUT_INT]);
-    } else {
-#ifdef DEBUG_UIC
-        if (loglevel & CPU_LOG_INT) {
-            fprintf(logfile, "Lower UIC interrupt\n");
-        }
-#endif
-        qemu_irq_lower(uic->irqs[PPCUIC_OUTPUT_INT]);
-    }
-    /* Trigger critical interrupt if any is pending and update vector */
-    if (cr != 0x0000000) {
-        qemu_irq_raise(uic->irqs[PPCUIC_OUTPUT_CINT]);
-        if (uic->use_vectors) {
-            /* Compute critical IRQ vector */
-            if (uic->uicvcr & 1) {
-                start = 31;
-                end = 0;
-                inc = -1;
-            } else {
-                start = 0;
-                end = 31;
-                inc = 1;
-            }
-            uic->uicvr = uic->uicvcr & 0xFFFFFFFC;
-            for (i = start; i <= end; i += inc) {
-                if (cr & (1 << i)) {
-                    uic->uicvr += (i - start) * 512 * inc;
-                    break;
-                }
-            }
-        }
-#ifdef DEBUG_UIC
-        if (loglevel & CPU_LOG_INT) {
-            fprintf(logfile, "Raise UIC critical interrupt - vector %08x\n",
-                    uic->uicvr);
-        }
-#endif
-    } else {
-#ifdef DEBUG_UIC
-        if (loglevel & CPU_LOG_INT) {
-            fprintf(logfile, "Lower UIC critical interrupt\n");
-        }
-#endif
-        qemu_irq_lower(uic->irqs[PPCUIC_OUTPUT_CINT]);
-        uic->uicvr = 0x00000000;
-    }
-}
-
-static void ppcuic_set_irq (void *opaque, int irq_num, int level)
-{
-    ppcuic_t *uic;
-    uint32_t mask, sr;
-
-    uic = opaque;
-    mask = 1 << irq_num;
-#ifdef DEBUG_UIC
-    if (loglevel & CPU_LOG_INT) {
-        fprintf(logfile, "%s: irq %d level %d uicsr %08x mask %08x => %08x "
-                "%08x\n", __func__, irq_num, level,
-                uic->uicsr, mask, uic->uicsr & mask, level << irq_num);
-    }
-#endif
-    if (irq_num < 0 || irq_num > 31)
-        return;
-    sr = uic->uicsr;
-    if (!(uic->uicpr & mask)) {
-        /* Negatively asserted IRQ */
-        level = level == 0 ? 1 : 0;
-    }
-    /* Update status register */
-    if (uic->uictr & mask) {
-        /* Edge sensitive interrupt */
-        if (level == 1)
-            uic->uicsr |= mask;
-    } else {
-        /* Level sensitive interrupt */
-        if (level == 1)
-            uic->uicsr |= mask;
-        else
-            uic->uicsr &= ~mask;
-    }
-#ifdef DEBUG_UIC
-    if (loglevel & CPU_LOG_INT) {
-        fprintf(logfile, "%s: irq %d level %d sr %08x => %08x\n", __func__,
-                irq_num, level, uic->uicsr, sr);
-    }
-#endif
-    if (sr != uic->uicsr)
-        ppcuic_trigger_irq(uic);
-}
-
-static target_ulong dcr_read_uic (void *opaque, int dcrn)
-{
-    ppcuic_t *uic;
-    target_ulong ret;
-
-    uic = opaque;
-    dcrn -= uic->dcr_base;
-    switch (dcrn) {
-    case DCR_UICSR:
-    case DCR_UICSRS:
-        ret = uic->uicsr;
-        break;
-    case DCR_UICER:
-        ret = uic->uicer;
-        break;
-    case DCR_UICCR:
-        ret = uic->uiccr;
-        break;
-    case DCR_UICPR:
-        ret = uic->uicpr;
-        break;
-    case DCR_UICTR:
-        ret = uic->uictr;
-        break;
-    case DCR_UICMSR:
-        ret = uic->uicsr & uic->uicer;
-        break;
-    case DCR_UICVR:
-        if (!uic->use_vectors)
-            goto no_read;
-        ret = uic->uicvr;
-        break;
-    case DCR_UICVCR:
-        if (!uic->use_vectors)
-            goto no_read;
-        ret = uic->uicvcr;
-        break;
-    default:
-    no_read:
-        ret = 0x00000000;
-        break;
-    }
-
-    return ret;
-}
-
-static void dcr_write_uic (void *opaque, int dcrn, target_ulong val)
-{
-    ppcuic_t *uic;
-
-    uic = opaque;
-    dcrn -= uic->dcr_base;
-#ifdef DEBUG_UIC
-    if (loglevel & CPU_LOG_INT) {
-        fprintf(logfile, "%s: dcr %d val " ADDRX "\n", __func__, dcrn, val);
-    }
-#endif
-    switch (dcrn) {
-    case DCR_UICSR:
-        uic->uicsr &= ~val;
-        ppcuic_trigger_irq(uic);
-        break;
-    case DCR_UICSRS:
-        uic->uicsr |= val;
-        ppcuic_trigger_irq(uic);
-        break;
-    case DCR_UICER:
-        uic->uicer = val;
-        ppcuic_trigger_irq(uic);
-        break;
-    case DCR_UICCR:
-        uic->uiccr = val;
-        ppcuic_trigger_irq(uic);
-        break;
-    case DCR_UICPR:
-        uic->uicpr = val;
-        ppcuic_trigger_irq(uic);
-        break;
-    case DCR_UICTR:
-        uic->uictr = val;
-        ppcuic_trigger_irq(uic);
-        break;
-    case DCR_UICMSR:
-        break;
-    case DCR_UICVR:
-        break;
-    case DCR_UICVCR:
-        uic->uicvcr = val & 0xFFFFFFFD;
-        ppcuic_trigger_irq(uic);
-        break;
-    }
-}
-
-static void ppcuic_reset (void *opaque)
-{
-    ppcuic_t *uic;
-
-    uic = opaque;
-    uic->uiccr = 0x00000000;
-    uic->uicer = 0x00000000;
-    uic->uicpr = 0x00000000;
-    uic->uicsr = 0x00000000;
-    uic->uictr = 0x00000000;
-    if (uic->use_vectors) {
-        uic->uicvcr = 0x00000000;
-        uic->uicvr = 0x0000000;
-    }
-}
-
-qemu_irq *ppcuic_init (CPUState *env, qemu_irq *irqs,
-                       uint32_t dcr_base, int has_ssr, int has_vr)
-{
-    ppcuic_t *uic;
-    int i;
-
-    uic = qemu_mallocz(sizeof(ppcuic_t));
-    if (uic != NULL) {
-        uic->dcr_base = dcr_base;
-        uic->irqs = irqs;
-        if (has_vr)
-            uic->use_vectors = 1;
-        for (i = 0; i < DCR_UICMAX; i++) {
-            ppc_dcr_register(env, dcr_base + i, uic,
-                             &dcr_read_uic, &dcr_write_uic);
-        }
-        qemu_register_reset(ppcuic_reset, uic);
-        ppcuic_reset(uic);
-    }
-
-    return qemu_allocate_irqs(&ppcuic_set_irq, uic, UIC_MAX_IRQ);
-}
-
-/*****************************************************************************/
 /* Code decompression controller */
 /* XXX: TODO */
 
@@ -928,6 +429,10 @@ enum {
     SDRAM0_CFGDATA = 0x011,
 };
 
+/* XXX: TOFIX: some patches have made this code become inconsistent:
+ *      there are type inconsistencies, mixing target_phys_addr_t, target_ulong
+ *      and uint32_t
+ */
 static uint32_t sdram_bcr (target_phys_addr_t ram_base,
                            target_phys_addr_t ram_size)
 {
@@ -956,8 +461,7 @@ static uint32_t sdram_bcr (target_phys_addr_t ram_base,
         bcr = 0x000C0000;
         break;
     default:
-        printf("%s: invalid RAM size " TARGET_FMT_plx "\n",
-               __func__, ram_size);
+        printf("%s: invalid RAM size " PADDRX "\n", __func__, ram_size);
         return 0x00000000;
     }
     bcr |= ram_base & 0xFF800000;
@@ -966,7 +470,7 @@ static uint32_t sdram_bcr (target_phys_addr_t ram_base,
     return bcr;
 }
 
-static inline target_phys_addr_t sdram_base (uint32_t bcr)
+static always_inline target_phys_addr_t sdram_base (uint32_t bcr)
 {
     return bcr & 0xFF800000;
 }
@@ -990,7 +494,7 @@ static void sdram_set_bcr (uint32_t *bcrp, uint32_t bcr, int enabled)
     if (*bcrp & 0x00000001) {
         /* Unmap RAM */
 #ifdef DEBUG_SDRAM
-        printf("%s: unmap RAM area " TARGET_FMT_plx " " TARGET_FMT_lx "\n",
+        printf("%s: unmap RAM area " PADDRX " " ADDRX "\n",
                __func__, sdram_base(*bcrp), sdram_size(*bcrp));
 #endif
         cpu_register_physical_memory(sdram_base(*bcrp), sdram_size(*bcrp),
@@ -999,7 +503,7 @@ static void sdram_set_bcr (uint32_t *bcrp, uint32_t bcr, int enabled)
     *bcrp = bcr & 0xFFDEE001;
     if (enabled && (bcr & 0x00000001)) {
 #ifdef DEBUG_SDRAM
-        printf("%s: Map RAM area " TARGET_FMT_plx " " TARGET_FMT_lx "\n",
+        printf("%s: Map RAM area " PADDRX " " ADDRX "\n",
                __func__, sdram_base(bcr), sdram_size(bcr));
 #endif
         cpu_register_physical_memory(sdram_base(bcr), sdram_size(bcr),
@@ -1028,7 +532,7 @@ static void sdram_unmap_bcr (ppc4xx_sdram_t *sdram)
 
     for (i = 0; i < sdram->nbanks; i++) {
 #ifdef DEBUG_SDRAM
-        printf("%s: Unmap RAM area " TARGET_FMT_plx " " TARGET_FMT_lx "\n",
+        printf("%s: Unmap RAM area " PADDRX " " ADDRX "\n",
                __func__, sdram_base(sdram->bcr[i]), sdram_size(sdram->bcr[i]));
 #endif
         cpu_register_physical_memory(sdram_base(sdram->bcr[i]),
@@ -1609,7 +1113,7 @@ static void ppc405_gpio_writeb (void *opaque,
 
     gpio = opaque;
 #ifdef DEBUG_GPIO
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
 }
 
@@ -1632,7 +1136,7 @@ static void ppc405_gpio_writew (void *opaque,
 
     gpio = opaque;
 #ifdef DEBUG_GPIO
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
 }
 
@@ -1655,7 +1159,7 @@ static void ppc405_gpio_writel (void *opaque,
 
     gpio = opaque;
 #ifdef DEBUG_GPIO
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
 }
 
@@ -1689,7 +1193,7 @@ void ppc405_gpio_init (CPUState *env, ppc4xx_mmio_t *mmio,
         ppc405_gpio_reset(gpio);
         qemu_register_reset(&ppc405_gpio_reset, gpio);
 #ifdef DEBUG_GPIO
-        printf("%s: offset=" PADDRX "\n", __func__, offset);
+        printf("%s: offset " PADDRX "\n", __func__, offset);
 #endif
         ppc4xx_mmio_register(env, mmio, offset, 0x038,
                              ppc405_gpio_read, ppc405_gpio_write, gpio);
@@ -1717,7 +1221,7 @@ void ppc405_serial_init (CPUState *env, ppc4xx_mmio_t *mmio,
     void *serial;
 
 #ifdef DEBUG_SERIAL
-    printf("%s: offset=" PADDRX "\n", __func__, offset);
+    printf("%s: offset " PADDRX "\n", __func__, offset);
 #endif
     serial = serial_mm_init(offset, 0, irq, chr, 0);
     ppc4xx_mmio_register(env, mmio, offset, 0x008,
@@ -1747,7 +1251,9 @@ static void ocm_update_mappings (ppc405_ocm_t *ocm,
                                  uint32_t dsarc, uint32_t dsacntl)
 {
 #ifdef DEBUG_OCM
-    printf("OCM update ISA %08x %08x (%08x %08x) DSA %08x %08x (%08x %08x)\n",
+    printf("OCM update ISA %08" PRIx32 " %08" PRIx32 " (%08" PRIx32
+           " %08" PRIx32 ") DSA %08" PRIx32 " %08" PRIx32
+           " (%08" PRIx32 " %08" PRIx32 ")\n",
            isarc, isacntl, dsarc, dsacntl,
            ocm->isarc, ocm->isacntl, ocm->dsarc, ocm->dsacntl);
 #endif
@@ -1755,14 +1261,14 @@ static void ocm_update_mappings (ppc405_ocm_t *ocm,
         (ocm->isacntl & 0x80000000) != (isacntl & 0x80000000)) {
         if (ocm->isacntl & 0x80000000) {
             /* Unmap previously assigned memory region */
-            printf("OCM unmap ISA %08x\n", ocm->isarc);
+            printf("OCM unmap ISA %08" PRIx32 "\n", ocm->isarc);
             cpu_register_physical_memory(ocm->isarc, 0x04000000,
                                          IO_MEM_UNASSIGNED);
         }
         if (isacntl & 0x80000000) {
             /* Map new instruction memory region */
 #ifdef DEBUG_OCM
-            printf("OCM map ISA %08x\n", isarc);
+            printf("OCM map ISA %08" PRIx32 "\n", isarc);
 #endif
             cpu_register_physical_memory(isarc, 0x04000000,
                                          ocm->offset | IO_MEM_RAM);
@@ -1775,7 +1281,7 @@ static void ocm_update_mappings (ppc405_ocm_t *ocm,
             if (!(isacntl & 0x80000000) || ocm->dsarc != isarc) {
                 /* Unmap previously assigned memory region */
 #ifdef DEBUG_OCM
-                printf("OCM unmap DSA %08x\n", ocm->dsarc);
+                printf("OCM unmap DSA %08" PRIx32 "\n", ocm->dsarc);
 #endif
                 cpu_register_physical_memory(ocm->dsarc, 0x04000000,
                                              IO_MEM_UNASSIGNED);
@@ -1786,7 +1292,7 @@ static void ocm_update_mappings (ppc405_ocm_t *ocm,
             if (!(isacntl & 0x80000000) || dsarc != isarc) {
                 /* Map new data memory region */
 #ifdef DEBUG_OCM
-                printf("OCM map DSA %08x\n", dsarc);
+                printf("OCM map DSA %08" PRIx32 "\n", dsarc);
 #endif
                 cpu_register_physical_memory(dsarc, 0x04000000,
                                              ocm->offset | IO_MEM_RAM);
@@ -1974,7 +1480,7 @@ static uint32_t ppc4xx_i2c_readb (void *opaque, target_phys_addr_t addr)
         break;
     }
 #ifdef DEBUG_I2C
-    printf("%s: addr " PADDRX " %02x\n", __func__, addr, ret);
+    printf("%s: addr " PADDRX " %02" PRIx32 "\n", __func__, addr, ret);
 #endif
 
     return ret;
@@ -1986,7 +1492,7 @@ static void ppc4xx_i2c_writeb (void *opaque,
     ppc4xx_i2c_t *i2c;
 
 #ifdef DEBUG_I2C
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
     i2c = opaque;
     switch (addr - i2c->base) {
@@ -2056,7 +1562,7 @@ static void ppc4xx_i2c_writew (void *opaque,
                                target_phys_addr_t addr, uint32_t value)
 {
 #ifdef DEBUG_I2C
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
     ppc4xx_i2c_writeb(opaque, addr, value >> 8);
     ppc4xx_i2c_writeb(opaque, addr + 1, value);
@@ -2081,7 +1587,7 @@ static void ppc4xx_i2c_writel (void *opaque,
                                target_phys_addr_t addr, uint32_t value)
 {
 #ifdef DEBUG_I2C
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
     ppc4xx_i2c_writeb(opaque, addr, value >> 24);
     ppc4xx_i2c_writeb(opaque, addr + 1, value >> 16);
@@ -2128,7 +1634,7 @@ void ppc405_i2c_init (CPUState *env, ppc4xx_mmio_t *mmio,
         i2c->irq = irq;
         ppc4xx_i2c_reset(i2c);
 #ifdef DEBUG_I2C
-        printf("%s: offset=" PADDRX "\n", __func__, offset);
+        printf("%s: offset " PADDRX "\n", __func__, offset);
 #endif
         ppc4xx_mmio_register(env, mmio, offset, 0x011,
                              i2c_read, i2c_write, i2c);
@@ -2167,7 +1673,7 @@ static void ppc4xx_gpt_writeb (void *opaque,
                                target_phys_addr_t addr, uint32_t value)
 {
 #ifdef DEBUG_I2C
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
     /* XXX: generate a bus fault */
 }
@@ -2185,7 +1691,7 @@ static void ppc4xx_gpt_writew (void *opaque,
                                target_phys_addr_t addr, uint32_t value)
 {
 #ifdef DEBUG_I2C
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
     /* XXX: generate a bus fault */
 }
@@ -2304,7 +1810,7 @@ static void ppc4xx_gpt_writel (void *opaque,
     int idx;
 
 #ifdef DEBUG_I2C
-    printf("%s: addr " PADDRX " val %08x\n", __func__, addr, value);
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
 #endif
     gpt = opaque;
     switch (addr - gpt->base) {
@@ -2412,7 +1918,7 @@ void ppc4xx_gpt_init (CPUState *env, ppc4xx_mmio_t *mmio,
         gpt->timer = qemu_new_timer(vm_clock, &ppc4xx_gpt_cb, gpt);
         ppc4xx_gpt_reset(gpt);
 #ifdef DEBUG_GPT
-        printf("%s: offset=" PADDRX "\n", __func__, offset);
+        printf("%s: offset " PADDRX "\n", __func__, offset);
 #endif
         ppc4xx_mmio_register(env, mmio, offset, 0x0D4,
                              gpt_read, gpt_write, gpt);
@@ -2692,12 +2198,17 @@ void ppc40x_core_reset (CPUState *env)
     target_ulong dbsr;
 
     printf("Reset PowerPC core\n");
+    env->interrupt_request |= CPU_INTERRUPT_EXITTB;
+    /* XXX: TOFIX */
+#if 0
     cpu_ppc_reset(env);
+#else
+    qemu_system_reset_request();
+#endif
     dbsr = env->spr[SPR_40x_DBSR];
     dbsr &= ~0x00000300;
     dbsr |= 0x00000100;
     env->spr[SPR_40x_DBSR] = dbsr;
-    cpu_loop_exit();
 }
 
 void ppc40x_chip_reset (CPUState *env)
@@ -2705,13 +2216,18 @@ void ppc40x_chip_reset (CPUState *env)
     target_ulong dbsr;
 
     printf("Reset PowerPC chip\n");
+    env->interrupt_request |= CPU_INTERRUPT_EXITTB;
+    /* XXX: TOFIX */
+#if 0
     cpu_ppc_reset(env);
+#else
+    qemu_system_reset_request();
+#endif
     /* XXX: TODO reset all internal peripherals */
     dbsr = env->spr[SPR_40x_DBSR];
     dbsr &= ~0x00000300;
     dbsr |= 0x00000200;
     env->spr[SPR_40x_DBSR] = dbsr;
-    cpu_loop_exit();
 }
 
 void ppc40x_system_reset (CPUState *env)
@@ -3038,7 +2554,7 @@ CPUState *ppc405cr_init (target_phys_addr_t ram_bases[4],
     int i;
 
     memset(clk_setup, 0, sizeof(clk_setup));
-    env = ppc405_init("405cr", &clk_setup[PPC405CR_CPU_CLK],
+    env = ppc4xx_init("405cr", &clk_setup[PPC405CR_CPU_CLK],
                       &clk_setup[PPC405CR_TMR_CLK], sysclk);
     /* Memory mapped devices registers */
     mmio = ppc4xx_mmio_init(env, 0xEF600000);
@@ -3145,9 +2661,13 @@ static void ppc405ep_compute_clocks (ppc405ep_cpc_t *cpc)
     VCO_out = 0;
     if ((cpc->pllmr[1] & 0x80000000) && !(cpc->pllmr[1] & 0x40000000)) {
         M = (((cpc->pllmr[1] >> 20) - 1) & 0xF) + 1; /* FBMUL */
-        //        printf("FBMUL %01x %d\n", (cpc->pllmr[1] >> 20) & 0xF, M);
+#ifdef DEBUG_CLOCKS_LL
+        printf("FBMUL %01" PRIx32 " %d\n", (cpc->pllmr[1] >> 20) & 0xF, M);
+#endif
         D = 8 - ((cpc->pllmr[1] >> 16) & 0x7); /* FWDA */
-        //        printf("FWDA %01x %d\n", (cpc->pllmr[1] >> 16) & 0x7, D);
+#ifdef DEBUG_CLOCKS_LL
+        printf("FWDA %01" PRIx32 " %d\n", (cpc->pllmr[1] >> 16) & 0x7, D);
+#endif
         VCO_out = cpc->sysclk * M * D;
         if (VCO_out < 500000000UL || VCO_out > 1000000000UL) {
             /* Error - unlock the PLL */
@@ -3172,53 +2692,53 @@ static void ppc405ep_compute_clocks (ppc405ep_cpc_t *cpc)
     }
     /* Now, compute all other clocks */
     D = ((cpc->pllmr[0] >> 20) & 0x3) + 1; /* CCDV */
-#ifdef DEBUG_CLOCKS
-    //    printf("CCDV %01x %d\n", (cpc->pllmr[0] >> 20) & 0x3, D);
+#ifdef DEBUG_CLOCKS_LL
+    printf("CCDV %01" PRIx32 " %d\n", (cpc->pllmr[0] >> 20) & 0x3, D);
 #endif
     CPU_clk = PLL_out / D;
     D = ((cpc->pllmr[0] >> 16) & 0x3) + 1; /* CBDV */
-#ifdef DEBUG_CLOCKS
-    //    printf("CBDV %01x %d\n", (cpc->pllmr[0] >> 16) & 0x3, D);
+#ifdef DEBUG_CLOCKS_LL
+    printf("CBDV %01" PRIx32 " %d\n", (cpc->pllmr[0] >> 16) & 0x3, D);
 #endif
     PLB_clk = CPU_clk / D;
     D = ((cpc->pllmr[0] >> 12) & 0x3) + 1; /* OPDV */
-#ifdef DEBUG_CLOCKS
-    //    printf("OPDV %01x %d\n", (cpc->pllmr[0] >> 12) & 0x3, D);
+#ifdef DEBUG_CLOCKS_LL
+    printf("OPDV %01" PRIx32 " %d\n", (cpc->pllmr[0] >> 12) & 0x3, D);
 #endif
     OPB_clk = PLB_clk / D;
     D = ((cpc->pllmr[0] >> 8) & 0x3) + 2; /* EPDV */
-#ifdef DEBUG_CLOCKS
-    //    printf("EPDV %01x %d\n", (cpc->pllmr[0] >> 8) & 0x3, D);
+#ifdef DEBUG_CLOCKS_LL
+    printf("EPDV %01" PRIx32 " %d\n", (cpc->pllmr[0] >> 8) & 0x3, D);
 #endif
     EBC_clk = PLB_clk / D;
     D = ((cpc->pllmr[0] >> 4) & 0x3) + 1; /* MPDV */
-#ifdef DEBUG_CLOCKS
-    //    printf("MPDV %01x %d\n", (cpc->pllmr[0] >> 4) & 0x3, D);
+#ifdef DEBUG_CLOCKS_LL
+    printf("MPDV %01" PRIx32 " %d\n", (cpc->pllmr[0] >> 4) & 0x3, D);
 #endif
     MAL_clk = PLB_clk / D;
     D = (cpc->pllmr[0] & 0x3) + 1; /* PPDV */
-#ifdef DEBUG_CLOCKS
-    //    printf("PPDV %01x %d\n", cpc->pllmr[0] & 0x3, D);
+#ifdef DEBUG_CLOCKS_LL
+    printf("PPDV %01" PRIx32 " %d\n", cpc->pllmr[0] & 0x3, D);
 #endif
     PCI_clk = PLB_clk / D;
     D = ((cpc->ucr - 1) & 0x7F) + 1; /* U0DIV */
-#ifdef DEBUG_CLOCKS
-    //    printf("U0DIV %01x %d\n", cpc->ucr & 0x7F, D);
+#ifdef DEBUG_CLOCKS_LL
+    printf("U0DIV %01" PRIx32 " %d\n", cpc->ucr & 0x7F, D);
 #endif
     UART0_clk = PLL_out / D;
     D = (((cpc->ucr >> 8) - 1) & 0x7F) + 1; /* U1DIV */
-#ifdef DEBUG_CLOCKS
-    //    printf("U1DIV %01x %d\n", (cpc->ucr >> 8) & 0x7F, D);
+#ifdef DEBUG_CLOCKS_LL
+    printf("U1DIV %01" PRIx32 " %d\n", (cpc->ucr >> 8) & 0x7F, D);
 #endif
     UART1_clk = PLL_out / D;
 #ifdef DEBUG_CLOCKS
-    printf("Setup PPC405EP clocks - sysclk %d VCO %" PRIu64
+    printf("Setup PPC405EP clocks - sysclk %" PRIu32 " VCO %" PRIu64
            " PLL out %" PRIu64 " Hz\n", cpc->sysclk, VCO_out, PLL_out);
-    printf("CPU %d PLB %d OPB %d EBC %d MAL %d PCI %d UART0 %d UART1 %d\n",
+    printf("CPU %" PRIu32 " PLB %" PRIu32 " OPB %" PRIu32 " EBC %" PRIu32
+           " MAL %" PRIu32 " PCI %" PRIu32 " UART0 %" PRIu32
+           " UART1 %" PRIu32 "\n",
            CPU_clk, PLB_clk, OPB_clk, EBC_clk, MAL_clk, PCI_clk,
            UART0_clk, UART1_clk);
-    printf("CB %p opaque %p\n", cpc->clk_setup[PPC405EP_CPU_CLK].cb,
-           cpc->clk_setup[PPC405EP_CPU_CLK].opaque);
 #endif
     /* Setup CPU clocks */
     clk_setup(&cpc->clk_setup[PPC405EP_CPU_CLK], CPU_clk);
@@ -3388,7 +2908,7 @@ CPUState *ppc405ep_init (target_phys_addr_t ram_bases[2],
 
     memset(clk_setup, 0, sizeof(clk_setup));
     /* init CPUs */
-    env = ppc405_init("405ep", &clk_setup[PPC405EP_CPU_CLK],
+    env = ppc4xx_init("405ep", &clk_setup[PPC405EP_CPU_CLK],
                       &tlb_clk_setup, sysclk);
     clk_setup[PPC405EP_CPU_CLK].cb = tlb_clk_setup.cb;
     clk_setup[PPC405EP_CPU_CLK].opaque = tlb_clk_setup.opaque;
diff --git a/hw/ppc4xx.h b/hw/ppc4xx.h
new file mode 100644
index 000000000..8d7863c14
--- /dev/null
+++ b/hw/ppc4xx.h
@@ -0,0 +1,49 @@
+/*
+ * QEMU PowerPC 4xx emulation shared definitions
+ *
+ * Copyright (c) 2007 Jocelyn Mayer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#if !defined(PPC_4XX_H)
+#define PPC_4XX_H
+
+/* PowerPC 4xx core initialization */
+CPUState *ppc4xx_init (const unsigned char *cpu_model,
+                       clk_setup_t *cpu_clk, clk_setup_t *tb_clk,
+                       uint32_t sysclk);
+
+typedef struct ppc4xx_mmio_t ppc4xx_mmio_t;
+int ppc4xx_mmio_register (CPUState *env, ppc4xx_mmio_t *mmio,
+                          target_phys_addr_t offset, uint32_t len,
+                          CPUReadMemoryFunc **mem_read,
+                          CPUWriteMemoryFunc **mem_write, void *opaque);
+ppc4xx_mmio_t *ppc4xx_mmio_init (CPUState *env, target_phys_addr_t base);
+
+/* PowerPC 4xx universal interrupt controller */
+enum {
+    PPCUIC_OUTPUT_INT = 0,
+    PPCUIC_OUTPUT_CINT = 1,
+    PPCUIC_OUTPUT_NB,
+};
+qemu_irq *ppcuic_init (CPUState *env, qemu_irq *irqs,
+                       uint32_t dcr_base, int has_ssr, int has_vr);
+
+#endif /* !defined(PPC_4XX_H) */
diff --git a/hw/ppc4xx_devs.c b/hw/ppc4xx_devs.c
new file mode 100644
index 000000000..c4da27f4a
--- /dev/null
+++ b/hw/ppc4xx_devs.c
@@ -0,0 +1,536 @@
+/*
+ * QEMU PowerPC 4xx embedded processors shared devices emulation
+ *
+ * Copyright (c) 2007 Jocelyn Mayer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw.h"
+#include "ppc.h"
+#include "ppc4xx.h"
+#include "sysemu.h"
+
+extern int loglevel;
+extern FILE *logfile;
+
+//#define DEBUG_MMIO
+//#define DEBUG_UNASSIGNED
+#define DEBUG_UIC
+
+/*****************************************************************************/
+/* Generic PowerPC 4xx processor instanciation */
+CPUState *ppc4xx_init (const unsigned char *cpu_model,
+                       clk_setup_t *cpu_clk, clk_setup_t *tb_clk,
+                       uint32_t sysclk)
+{
+    CPUState *env;
+
+    /* init CPUs */
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find PowerPC %s CPU definition\n",
+                cpu_model);
+        exit(1);
+    }
+    cpu_clk->cb = NULL; /* We don't care about CPU clock frequency changes */
+    cpu_clk->opaque = env;
+    /* Set time-base frequency to sysclk */
+    tb_clk->cb = ppc_emb_timers_init(env, sysclk);
+    tb_clk->opaque = env;
+    ppc_dcr_init(env, NULL, NULL);
+    /* Register qemu callbacks */
+    qemu_register_reset(&cpu_ppc_reset, env);
+    register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
+
+    return env;
+}
+
+/*****************************************************************************/
+/* Fake device used to map multiple devices in a single memory page */
+#define MMIO_AREA_BITS 8
+#define MMIO_AREA_LEN (1 << MMIO_AREA_BITS)
+#define MMIO_AREA_NB (1 << (TARGET_PAGE_BITS - MMIO_AREA_BITS))
+#define MMIO_IDX(addr) (((addr) >> MMIO_AREA_BITS) & (MMIO_AREA_NB - 1))
+struct ppc4xx_mmio_t {
+    target_phys_addr_t base;
+    CPUReadMemoryFunc **mem_read[MMIO_AREA_NB];
+    CPUWriteMemoryFunc **mem_write[MMIO_AREA_NB];
+    void *opaque[MMIO_AREA_NB];
+};
+
+static uint32_t unassigned_mmio_readb (void *opaque, target_phys_addr_t addr)
+{
+#ifdef DEBUG_UNASSIGNED
+    ppc4xx_mmio_t *mmio;
+
+    mmio = opaque;
+    printf("Unassigned mmio read 0x" PADDRX " base " PADDRX "\n",
+           addr, mmio->base);
+#endif
+
+    return 0;
+}
+
+static void unassigned_mmio_writeb (void *opaque,
+                                    target_phys_addr_t addr, uint32_t val)
+{
+#ifdef DEBUG_UNASSIGNED
+    ppc4xx_mmio_t *mmio;
+
+    mmio = opaque;
+    printf("Unassigned mmio write 0x" PADDRX " = 0x%x base " PADDRX "\n",
+           addr, val, mmio->base);
+#endif
+}
+
+static CPUReadMemoryFunc *unassigned_mmio_read[3] = {
+    unassigned_mmio_readb,
+    unassigned_mmio_readb,
+    unassigned_mmio_readb,
+};
+
+static CPUWriteMemoryFunc *unassigned_mmio_write[3] = {
+    unassigned_mmio_writeb,
+    unassigned_mmio_writeb,
+    unassigned_mmio_writeb,
+};
+
+static uint32_t mmio_readlen (ppc4xx_mmio_t *mmio,
+                              target_phys_addr_t addr, int len)
+{
+    CPUReadMemoryFunc **mem_read;
+    uint32_t ret;
+    int idx;
+
+    idx = MMIO_IDX(addr - mmio->base);
+#if defined(DEBUG_MMIO)
+    printf("%s: mmio %p len %d addr " PADDRX " idx %d\n", __func__,
+           mmio, len, addr, idx);
+#endif
+    mem_read = mmio->mem_read[idx];
+    ret = (*mem_read[len])(mmio->opaque[idx], addr - mmio->base);
+
+    return ret;
+}
+
+static void mmio_writelen (ppc4xx_mmio_t *mmio,
+                           target_phys_addr_t addr, uint32_t value, int len)
+{
+    CPUWriteMemoryFunc **mem_write;
+    int idx;
+
+    idx = MMIO_IDX(addr - mmio->base);
+#if defined(DEBUG_MMIO)
+    printf("%s: mmio %p len %d addr " PADDRX " idx %d value %08" PRIx32 "\n",
+           __func__, mmio, len, addr, idx, value);
+#endif
+    mem_write = mmio->mem_write[idx];
+    (*mem_write[len])(mmio->opaque[idx], addr - mmio->base, value);
+}
+
+static uint32_t mmio_readb (void *opaque, target_phys_addr_t addr)
+{
+#if defined(DEBUG_MMIO)
+    printf("%s: addr " PADDRX "\n", __func__, addr);
+#endif
+
+    return mmio_readlen(opaque, addr, 0);
+}
+
+static void mmio_writeb (void *opaque,
+                         target_phys_addr_t addr, uint32_t value)
+{
+#if defined(DEBUG_MMIO)
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
+#endif
+    mmio_writelen(opaque, addr, value, 0);
+}
+
+static uint32_t mmio_readw (void *opaque, target_phys_addr_t addr)
+{
+#if defined(DEBUG_MMIO)
+    printf("%s: addr " PADDRX "\n", __func__, addr);
+#endif
+
+    return mmio_readlen(opaque, addr, 1);
+}
+
+static void mmio_writew (void *opaque,
+                         target_phys_addr_t addr, uint32_t value)
+{
+#if defined(DEBUG_MMIO)
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
+#endif
+    mmio_writelen(opaque, addr, value, 1);
+}
+
+static uint32_t mmio_readl (void *opaque, target_phys_addr_t addr)
+{
+#if defined(DEBUG_MMIO)
+    printf("%s: addr " PADDRX "\n", __func__, addr);
+#endif
+
+    return mmio_readlen(opaque, addr, 2);
+}
+
+static void mmio_writel (void *opaque,
+                         target_phys_addr_t addr, uint32_t value)
+{
+#if defined(DEBUG_MMIO)
+    printf("%s: addr " PADDRX " val %08" PRIx32 "\n", __func__, addr, value);
+#endif
+    mmio_writelen(opaque, addr, value, 2);
+}
+
+static CPUReadMemoryFunc *mmio_read[] = {
+    &mmio_readb,
+    &mmio_readw,
+    &mmio_readl,
+};
+
+static CPUWriteMemoryFunc *mmio_write[] = {
+    &mmio_writeb,
+    &mmio_writew,
+    &mmio_writel,
+};
+
+int ppc4xx_mmio_register (CPUState *env, ppc4xx_mmio_t *mmio,
+                          target_phys_addr_t offset, uint32_t len,
+                          CPUReadMemoryFunc **mem_read,
+                          CPUWriteMemoryFunc **mem_write, void *opaque)
+{
+    target_phys_addr_t end;
+    int idx, eidx;
+
+    if ((offset + len) > TARGET_PAGE_SIZE)
+        return -1;
+    idx = MMIO_IDX(offset);
+    end = offset + len - 1;
+    eidx = MMIO_IDX(end);
+#if defined(DEBUG_MMIO)
+    printf("%s: offset " PADDRX " len %08" PRIx32 " " PADDRX " %d %d\n",
+           __func__, offset, len, end, idx, eidx);
+#endif
+    for (; idx <= eidx; idx++) {
+        mmio->mem_read[idx] = mem_read;
+        mmio->mem_write[idx] = mem_write;
+        mmio->opaque[idx] = opaque;
+    }
+
+    return 0;
+}
+
+ppc4xx_mmio_t *ppc4xx_mmio_init (CPUState *env, target_phys_addr_t base)
+{
+    ppc4xx_mmio_t *mmio;
+    int mmio_memory;
+
+    mmio = qemu_mallocz(sizeof(ppc4xx_mmio_t));
+    if (mmio != NULL) {
+        mmio->base = base;
+        mmio_memory = cpu_register_io_memory(0, mmio_read, mmio_write, mmio);
+#if defined(DEBUG_MMIO)
+        printf("%s: base " PADDRX " len %08x %d\n", __func__,
+               base, TARGET_PAGE_SIZE, mmio_memory);
+#endif
+        cpu_register_physical_memory(base, TARGET_PAGE_SIZE, mmio_memory);
+        ppc4xx_mmio_register(env, mmio, 0, TARGET_PAGE_SIZE,
+                             unassigned_mmio_read, unassigned_mmio_write,
+                             mmio);
+    }
+
+    return mmio;
+}
+
+/*****************************************************************************/
+/* "Universal" Interrupt controller */
+enum {
+    DCR_UICSR  = 0x000,
+    DCR_UICSRS = 0x001,
+    DCR_UICER  = 0x002,
+    DCR_UICCR  = 0x003,
+    DCR_UICPR  = 0x004,
+    DCR_UICTR  = 0x005,
+    DCR_UICMSR = 0x006,
+    DCR_UICVR  = 0x007,
+    DCR_UICVCR = 0x008,
+    DCR_UICMAX = 0x009,
+};
+
+#define UIC_MAX_IRQ 32
+typedef struct ppcuic_t ppcuic_t;
+struct ppcuic_t {
+    uint32_t dcr_base;
+    int use_vectors;
+    uint32_t uicsr;  /* Status register */
+    uint32_t uicer;  /* Enable register */
+    uint32_t uiccr;  /* Critical register */
+    uint32_t uicpr;  /* Polarity register */
+    uint32_t uictr;  /* Triggering register */
+    uint32_t uicvcr; /* Vector configuration register */
+    uint32_t uicvr;
+    qemu_irq *irqs;
+};
+
+static void ppcuic_trigger_irq (ppcuic_t *uic)
+{
+    uint32_t ir, cr;
+    int start, end, inc, i;
+
+    /* Trigger interrupt if any is pending */
+    ir = uic->uicsr & uic->uicer & (~uic->uiccr);
+    cr = uic->uicsr & uic->uicer & uic->uiccr;
+#ifdef DEBUG_UIC
+    if (loglevel & CPU_LOG_INT) {
+        fprintf(logfile, "%s: uicsr %08" PRIx32 " uicer %08" PRIx32
+                " uiccr %08" PRIx32 "\n"
+                "   %08" PRIx32 " ir %08" PRIx32 " cr %08" PRIx32 "\n",
+                __func__, uic->uicsr, uic->uicer, uic->uiccr,
+                uic->uicsr & uic->uicer, ir, cr);
+    }
+#endif
+    if (ir != 0x0000000) {
+#ifdef DEBUG_UIC
+        if (loglevel & CPU_LOG_INT) {
+            fprintf(logfile, "Raise UIC interrupt\n");
+        }
+#endif
+        qemu_irq_raise(uic->irqs[PPCUIC_OUTPUT_INT]);
+    } else {
+#ifdef DEBUG_UIC
+        if (loglevel & CPU_LOG_INT) {
+            fprintf(logfile, "Lower UIC interrupt\n");
+        }
+#endif
+        qemu_irq_lower(uic->irqs[PPCUIC_OUTPUT_INT]);
+    }
+    /* Trigger critical interrupt if any is pending and update vector */
+    if (cr != 0x0000000) {
+        qemu_irq_raise(uic->irqs[PPCUIC_OUTPUT_CINT]);
+        if (uic->use_vectors) {
+            /* Compute critical IRQ vector */
+            if (uic->uicvcr & 1) {
+                start = 31;
+                end = 0;
+                inc = -1;
+            } else {
+                start = 0;
+                end = 31;
+                inc = 1;
+            }
+            uic->uicvr = uic->uicvcr & 0xFFFFFFFC;
+            for (i = start; i <= end; i += inc) {
+                if (cr & (1 << i)) {
+                    uic->uicvr += (i - start) * 512 * inc;
+                    break;
+                }
+            }
+        }
+#ifdef DEBUG_UIC
+        if (loglevel & CPU_LOG_INT) {
+            fprintf(logfile, "Raise UIC critical interrupt - "
+                    "vector %08" PRIx32 "\n", uic->uicvr);
+        }
+#endif
+    } else {
+#ifdef DEBUG_UIC
+        if (loglevel & CPU_LOG_INT) {
+            fprintf(logfile, "Lower UIC critical interrupt\n");
+        }
+#endif
+        qemu_irq_lower(uic->irqs[PPCUIC_OUTPUT_CINT]);
+        uic->uicvr = 0x00000000;
+    }
+}
+
+static void ppcuic_set_irq (void *opaque, int irq_num, int level)
+{
+    ppcuic_t *uic;
+    uint32_t mask, sr;
+
+    uic = opaque;
+    mask = 1 << irq_num;
+#ifdef DEBUG_UIC
+    if (loglevel & CPU_LOG_INT) {
+        fprintf(logfile, "%s: irq %d level %d uicsr %08" PRIx32
+                " mask %08" PRIx32 " => %08" PRIx32 " %08" PRIx32 "\n",
+                __func__, irq_num, level,
+                uic->uicsr, mask, uic->uicsr & mask, level << irq_num);
+    }
+#endif
+    if (irq_num < 0 || irq_num > 31)
+        return;
+    sr = uic->uicsr;
+    if (!(uic->uicpr & mask)) {
+        /* Negatively asserted IRQ */
+        level = level == 0 ? 1 : 0;
+    }
+    /* Update status register */
+    if (uic->uictr & mask) {
+        /* Edge sensitive interrupt */
+        if (level == 1)
+            uic->uicsr |= mask;
+    } else {
+        /* Level sensitive interrupt */
+        if (level == 1)
+            uic->uicsr |= mask;
+        else
+            uic->uicsr &= ~mask;
+    }
+#ifdef DEBUG_UIC
+    if (loglevel & CPU_LOG_INT) {
+        fprintf(logfile, "%s: irq %d level %d sr %" PRIx32 " => "
+                "%08" PRIx32 "\n", __func__, irq_num, level, uic->uicsr, sr);
+    }
+#endif
+    if (sr != uic->uicsr)
+        ppcuic_trigger_irq(uic);
+}
+
+static target_ulong dcr_read_uic (void *opaque, int dcrn)
+{
+    ppcuic_t *uic;
+    target_ulong ret;
+
+    uic = opaque;
+    dcrn -= uic->dcr_base;
+    switch (dcrn) {
+    case DCR_UICSR:
+    case DCR_UICSRS:
+        ret = uic->uicsr;
+        break;
+    case DCR_UICER:
+        ret = uic->uicer;
+        break;
+    case DCR_UICCR:
+        ret = uic->uiccr;
+        break;
+    case DCR_UICPR:
+        ret = uic->uicpr;
+        break;
+    case DCR_UICTR:
+        ret = uic->uictr;
+        break;
+    case DCR_UICMSR:
+        ret = uic->uicsr & uic->uicer;
+        break;
+    case DCR_UICVR:
+        if (!uic->use_vectors)
+            goto no_read;
+        ret = uic->uicvr;
+        break;
+    case DCR_UICVCR:
+        if (!uic->use_vectors)
+            goto no_read;
+        ret = uic->uicvcr;
+        break;
+    default:
+    no_read:
+        ret = 0x00000000;
+        break;
+    }
+
+    return ret;
+}
+
+static void dcr_write_uic (void *opaque, int dcrn, target_ulong val)
+{
+    ppcuic_t *uic;
+
+    uic = opaque;
+    dcrn -= uic->dcr_base;
+#ifdef DEBUG_UIC
+    if (loglevel & CPU_LOG_INT) {
+        fprintf(logfile, "%s: dcr %d val " ADDRX "\n", __func__, dcrn, val);
+    }
+#endif
+    switch (dcrn) {
+    case DCR_UICSR:
+        uic->uicsr &= ~val;
+        ppcuic_trigger_irq(uic);
+        break;
+    case DCR_UICSRS:
+        uic->uicsr |= val;
+        ppcuic_trigger_irq(uic);
+        break;
+    case DCR_UICER:
+        uic->uicer = val;
+        ppcuic_trigger_irq(uic);
+        break;
+    case DCR_UICCR:
+        uic->uiccr = val;
+        ppcuic_trigger_irq(uic);
+        break;
+    case DCR_UICPR:
+        uic->uicpr = val;
+        ppcuic_trigger_irq(uic);
+        break;
+    case DCR_UICTR:
+        uic->uictr = val;
+        ppcuic_trigger_irq(uic);
+        break;
+    case DCR_UICMSR:
+        break;
+    case DCR_UICVR:
+        break;
+    case DCR_UICVCR:
+        uic->uicvcr = val & 0xFFFFFFFD;
+        ppcuic_trigger_irq(uic);
+        break;
+    }
+}
+
+static void ppcuic_reset (void *opaque)
+{
+    ppcuic_t *uic;
+
+    uic = opaque;
+    uic->uiccr = 0x00000000;
+    uic->uicer = 0x00000000;
+    uic->uicpr = 0x00000000;
+    uic->uicsr = 0x00000000;
+    uic->uictr = 0x00000000;
+    if (uic->use_vectors) {
+        uic->uicvcr = 0x00000000;
+        uic->uicvr = 0x0000000;
+    }
+}
+
+qemu_irq *ppcuic_init (CPUState *env, qemu_irq *irqs,
+                       uint32_t dcr_base, int has_ssr, int has_vr)
+{
+    ppcuic_t *uic;
+    int i;
+
+    uic = qemu_mallocz(sizeof(ppcuic_t));
+    if (uic != NULL) {
+        uic->dcr_base = dcr_base;
+        uic->irqs = irqs;
+        if (has_vr)
+            uic->use_vectors = 1;
+        for (i = 0; i < DCR_UICMAX; i++) {
+            ppc_dcr_register(env, dcr_base + i, uic,
+                             &dcr_read_uic, &dcr_write_uic);
+        }
+        qemu_register_reset(ppcuic_reset, uic);
+        ppcuic_reset(uic);
+    }
+
+    return qemu_allocate_irqs(&ppcuic_set_irq, uic, UIC_MAX_IRQ);
+}
diff --git a/hw/ppc_chrp.c b/hw/ppc_chrp.c
index 64746159b..4437a1038 100644
--- a/hw/ppc_chrp.c
+++ b/hw/ppc_chrp.c
@@ -1,7 +1,8 @@
 /*
- * QEMU PPC CHRP/PMAC hardware System Emulator
+ * QEMU PowerPC CHRP (currently NewWorld PowerMac) hardware System Emulator
  *
  * Copyright (c) 2004-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -21,172 +22,17 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
-
-/* SMP is not enabled, for now */
-#define MAX_CPUS 1
-
-#define BIOS_FILENAME "ppc_rom.bin"
-#define VGABIOS_FILENAME "video.x"
-#define NVRAM_SIZE        0x2000
-
-#define KERNEL_LOAD_ADDR 0x01000000
-#define INITRD_LOAD_ADDR 0x01800000
-
-/* MacIO devices (mapped inside the MacIO address space): CUDA, DBDMA,
-   NVRAM */
-
-static int dbdma_mem_index;
-static int cuda_mem_index;
-static int ide0_mem_index = -1;
-static int ide1_mem_index = -1;
-static int openpic_mem_index = -1;
-static int heathrow_pic_mem_index = -1;
-static int macio_nvram_mem_index = -1;
-
-/* DBDMA: currently no op - should suffice right now */
-
-static void dbdma_writeb (void *opaque,
-                          target_phys_addr_t addr, uint32_t value)
-{
-    printf("%s: 0x" PADDRX " <= 0x%08x\n", __func__, addr, value);
-}
-
-static void dbdma_writew (void *opaque,
-                          target_phys_addr_t addr, uint32_t value)
-{
-}
-
-static void dbdma_writel (void *opaque,
-                          target_phys_addr_t addr, uint32_t value)
-{
-}
-
-static uint32_t dbdma_readb (void *opaque, target_phys_addr_t addr)
-{
-    printf("%s: 0x" PADDRX " => 0x00000000\n", __func__, addr);
-
-    return 0;
-}
-
-static uint32_t dbdma_readw (void *opaque, target_phys_addr_t addr)
-{
-    return 0;
-}
-
-static uint32_t dbdma_readl (void *opaque, target_phys_addr_t addr)
-{
-    return 0;
-}
-
-static CPUWriteMemoryFunc *dbdma_write[] = {
-    &dbdma_writeb,
-    &dbdma_writew,
-    &dbdma_writel,
-};
-
-static CPUReadMemoryFunc *dbdma_read[] = {
-    &dbdma_readb,
-    &dbdma_readw,
-    &dbdma_readl,
-};
-
-/* macio style NVRAM device */
-typedef struct MacIONVRAMState {
-    uint8_t data[0x2000];
-} MacIONVRAMState;
-
-static void macio_nvram_writeb (void *opaque,
-                                target_phys_addr_t addr, uint32_t value)
-{
-    MacIONVRAMState *s = opaque;
-    addr = (addr >> 4) & 0x1fff;
-    s->data[addr] = value;
-    //    printf("macio_nvram_writeb %04x = %02x\n", addr, value);
-}
-
-static uint32_t macio_nvram_readb (void *opaque, target_phys_addr_t addr)
-{
-    MacIONVRAMState *s = opaque;
-    uint32_t value;
-
-    addr = (addr >> 4) & 0x1fff;
-    value = s->data[addr];
-    //    printf("macio_nvram_readb %04x = %02x\n", addr, value);
-
-    return value;
-}
-
-static CPUWriteMemoryFunc *macio_nvram_write[] = {
-    &macio_nvram_writeb,
-    &macio_nvram_writeb,
-    &macio_nvram_writeb,
-};
-
-static CPUReadMemoryFunc *macio_nvram_read[] = {
-    &macio_nvram_readb,
-    &macio_nvram_readb,
-    &macio_nvram_readb,
-};
-
-static MacIONVRAMState *macio_nvram_init (void)
-{
-    MacIONVRAMState *s;
-    s = qemu_mallocz(sizeof(MacIONVRAMState));
-    if (!s)
-        return NULL;
-    macio_nvram_mem_index = cpu_register_io_memory(0, macio_nvram_read,
-                                                   macio_nvram_write, s);
-
-    return s;
-}
-
-static void macio_map (PCIDevice *pci_dev, int region_num,
-                       uint32_t addr, uint32_t size, int type)
-{
-    if (heathrow_pic_mem_index >= 0) {
-        cpu_register_physical_memory(addr + 0x00000, 0x1000,
-                                     heathrow_pic_mem_index);
-    }
-    cpu_register_physical_memory(addr + 0x08000, 0x1000, dbdma_mem_index);
-    cpu_register_physical_memory(addr + 0x16000, 0x2000, cuda_mem_index);
-    if (ide0_mem_index >= 0)
-        cpu_register_physical_memory(addr + 0x1f000, 0x1000, ide0_mem_index);
-    if (ide1_mem_index >= 0)
-        cpu_register_physical_memory(addr + 0x20000, 0x1000, ide1_mem_index);
-    if (openpic_mem_index >= 0) {
-        cpu_register_physical_memory(addr + 0x40000, 0x40000,
-                                     openpic_mem_index);
-    }
-    if (macio_nvram_mem_index >= 0)
-        cpu_register_physical_memory(addr + 0x60000, 0x20000,
-                                     macio_nvram_mem_index);
-}
-
-static void macio_init (PCIBus *bus, int device_id)
-{
-    PCIDevice *d;
-
-    d = pci_register_device(bus, "macio", sizeof(PCIDevice),
-                            -1, NULL, NULL);
-    /* Note: this code is strongly inspirated from the corresponding code
-       in PearPC */
-    d->config[0x00] = 0x6b; // vendor_id
-    d->config[0x01] = 0x10;
-    d->config[0x02] = device_id;
-    d->config[0x03] = device_id >> 8;
-
-    d->config[0x0a] = 0x00; // class_sub = pci2pci
-    d->config[0x0b] = 0xff; // class_base = bridge
-    d->config[0x0e] = 0x00; // header_type
-
-    d->config[0x3d] = 0x01; // interrupt on pin 1
-
-    dbdma_mem_index = cpu_register_io_memory(0, dbdma_read, dbdma_write, NULL);
-
-    pci_register_io_region(d, 0, 0x80000,
-                           PCI_ADDRESS_SPACE_MEM, macio_map);
-}
+#include "hw.h"
+#include "ppc.h"
+#include "ppc_mac.h"
+#include "nvram.h"
+#include "pc.h"
+#include "pci.h"
+#include "net.h"
+#include "sysemu.h"
+#include "boards.h"
+
+#define MAX_IDE_BUS 2
 
 /* UniN device */
 static void unin_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
@@ -210,152 +56,82 @@ static CPUReadMemoryFunc *unin_read[] = {
     &unin_readl,
 };
 
-/* temporary frame buffer OSI calls for the video.x driver. The right
-   solution is to modify the driver to use VGA PCI I/Os */
-/* XXX: to be removed. This is no way related to emulation */
-static int vga_osi_call (CPUState *env)
-{
-    static int vga_vbl_enabled;
-    int linesize;
-
-    //    printf("osi_call R5=%d\n", env->gpr[5]);
-
-    /* same handler as PearPC, coming from the original MOL video
-       driver. */
-    switch(env->gpr[5]) {
-    case 4:
-        break;
-    case 28: /* set_vmode */
-        if (env->gpr[6] != 1 || env->gpr[7] != 0)
-            env->gpr[3] = 1;
-        else
-            env->gpr[3] = 0;
-        break;
-    case 29: /* get_vmode_info */
-        if (env->gpr[6] != 0) {
-            if (env->gpr[6] != 1 || env->gpr[7] != 0) {
-                env->gpr[3] = 1;
-                break;
-            }
-        }
-        env->gpr[3] = 0;
-        env->gpr[4] = (1 << 16) | 1; /* num_vmodes, cur_vmode */
-        env->gpr[5] = (1 << 16) | 0; /* num_depths, cur_depth_mode */
-        env->gpr[6] = (graphic_width << 16) | graphic_height; /* w, h */
-        env->gpr[7] = 85 << 16; /* refresh rate */
-        env->gpr[8] = (graphic_depth + 7) & ~7; /* depth (round to byte) */
-        linesize = ((graphic_depth + 7) >> 3) * graphic_width;
-        linesize = (linesize + 3) & ~3;
-        env->gpr[9] = (linesize << 16) | 0; /* row_bytes, offset */
-        break;
-    case 31: /* set_video power */
-        env->gpr[3] = 0;
-        break;
-    case 39: /* video_ctrl */
-        if (env->gpr[6] == 0 || env->gpr[6] == 1)
-            vga_vbl_enabled = env->gpr[6];
-        env->gpr[3] = 0;
-        break;
-    case 47:
-        break;
-    case 59: /* set_color */
-        /* R6 = index, R7 = RGB */
-        env->gpr[3] = 0;
-        break;
-    case 64: /* get color */
-        /* R6 = index */
-        env->gpr[3] = 0;
-        break;
-    case 116: /* set hwcursor */
-        /* R6 = x, R7 = y, R8 = visible, R9 = data */
-        break;
-    default:
-        fprintf(stderr, "unsupported OSI call R5=" REGX "\n", env->gpr[5]);
-        break;
-    }
-
-    return 1; /* osi_call handled */
-}
-
-static uint8_t nvram_chksum (const uint8_t *buf, int n)
-{
-    int sum, i;
-    sum = 0;
-    for(i = 0; i < n; i++)
-        sum += buf[i];
-    return (sum & 0xff) + (sum >> 8);
-}
-
-/* set a free Mac OS NVRAM partition */
-void pmac_format_nvram_partition (uint8_t *buf, int len)
-{
-    char partition_name[12] = "wwwwwwwwwwww";
-
-    buf[0] = 0x7f; /* free partition magic */
-    buf[1] = 0; /* checksum */
-    buf[2] = len >> 8;
-    buf[3] = len;
-    memcpy(buf + 4, partition_name, 12);
-    buf[1] = nvram_chksum(buf, 16);
-}
-
-/* PowerPC CHRP hardware initialisation */
-static void ppc_chrp_init (int ram_size, int vga_ram_size, int boot_device,
-                           DisplayState *ds, const char **fd_filename,
-                           int snapshot,
-                           const char *kernel_filename,
-                           const char *kernel_cmdline,
-                           const char *initrd_filename,
-                           const char *cpu_model,
-                           int is_heathrow)
+/* PowerPC Mac99 hardware initialisation */
+static void ppc_core99_init (int ram_size, int vga_ram_size,
+                             const char *boot_device, DisplayState *ds,
+                             const char *kernel_filename,
+                             const char *kernel_cmdline,
+                             const char *initrd_filename,
+                             const char *cpu_model)
 {
-    CPUState *env, *envs[MAX_CPUS];
+    CPUState *env = NULL, *envs[MAX_CPUS];
     char buf[1024];
     qemu_irq *pic, **openpic_irqs;
-    m48t59_t *nvram;
     int unin_memory;
     int linux_boot, i;
     unsigned long bios_offset, vga_bios_offset;
     uint32_t kernel_base, kernel_size, initrd_base, initrd_size;
-    ppc_def_t *def;
     PCIBus *pci_bus;
-    const char *arch_name;
+    nvram_t nvram;
+#if 0
+    MacIONVRAMState *nvr;
+    int nvram_mem_index;
+#endif
+    m48t59_t *m48t59;
     int vga_bios_size, bios_size;
     qemu_irq *dummy_irq;
+    int pic_mem_index, dbdma_mem_index, cuda_mem_index;
+    int ide_mem_index[2];
+    int ppc_boot_device;
+    int index;
+    BlockDriverState *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
 
     linux_boot = (kernel_filename != NULL);
 
     /* init CPUs */
-    env = cpu_init();
-    qemu_register_reset(&cpu_ppc_reset, env);
-    register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
-
     if (cpu_model == NULL)
         cpu_model = "default";
-    ppc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
-        cpu_abort(env, "Unable to find PowerPC CPU definition\n");
-    }
     for (i = 0; i < smp_cpus; i++) {
-        cpu_ppc_register(env, def);
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find PowerPC CPU definition\n");
+            exit(1);
+        }
         /* Set time-base frequency to 100 Mhz */
         cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL);
+#if 0
         env->osi_call = vga_osi_call;
+#endif
+        qemu_register_reset(&cpu_ppc_reset, env);
+        register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
         envs[i] = env;
     }
+    if (env->nip < 0xFFF80000) {
+        /* Special test for PowerPC 601:
+         * the boot vector is at 0xFFF00100, then we need a 1MB BIOS.
+         * But the NVRAM is located at 0xFFF04000...
+         */
+        cpu_abort(env, "Mac99 hardware can not handle 1 MB BIOS\n");
+    }
 
     /* allocate RAM */
     cpu_register_physical_memory(0, ram_size, IO_MEM_RAM);
 
     /* allocate and load BIOS */
     bios_offset = ram_size + vga_ram_size;
-    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME);
+    if (bios_name == NULL)
+        bios_name = BIOS_FILENAME;
+    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
     bios_size = load_image(buf, phys_ram_base + bios_offset);
     if (bios_size < 0 || bios_size > BIOS_SIZE) {
         cpu_abort(env, "qemu: could not load PowerPC bios '%s'\n", buf);
         exit(1);
     }
     bios_size = (bios_size + 0xfff) & ~0xfff;
+    if (bios_size > 0x00080000) {
+        /* As the NVRAM is located at 0xFFF04000, we cannot use 1 MB BIOSes */
+        cpu_abort(env, "Mac99 hardware can not handle 1 MB BIOS\n");
+    }
     cpu_register_physical_memory((uint32_t)(-bios_size),
                                  bios_size, bios_offset | IO_MEM_ROM);
 
@@ -403,149 +179,124 @@ static void ppc_chrp_init (int ram_size, int vga_ram_size, int boot_device,
             initrd_base = 0;
             initrd_size = 0;
         }
-        boot_device = 'm';
+        ppc_boot_device = 'm';
     } else {
         kernel_base = 0;
         kernel_size = 0;
         initrd_base = 0;
         initrd_size = 0;
-    }
-
-    if (is_heathrow) {
-        isa_mem_base = 0x80000000;
-
-        /* Register 2 MB of ISA IO space */
-        isa_mmio_init(0xfe000000, 0x00200000);
-
-        /* init basic PC hardware */
-        if (PPC_INPUT(env) != PPC_FLAGS_INPUT_6xx) {
-            cpu_abort(env, "Only 6xx bus is supported on heathrow machine\n");
-            exit(1);
-        }
-        pic = heathrow_pic_init(&heathrow_pic_mem_index);
-        pci_bus = pci_grackle_init(0xfec00000, pic);
-        pci_vga_init(pci_bus, ds, phys_ram_base + ram_size,
-                     ram_size, vga_ram_size,
-                     vga_bios_offset, vga_bios_size);
-
-        /* XXX: suppress that */
-        dummy_irq = i8259_init(NULL);
-
-        /* XXX: use Mac Serial port */
-        serial_init(0x3f8, dummy_irq[4], serial_hds[0]);
-
-        for(i = 0; i < nb_nics; i++) {
-            if (!nd_table[i].model)
-                nd_table[i].model = "ne2k_pci";
-            pci_nic_init(pci_bus, &nd_table[i], -1);
+        ppc_boot_device = '\0';
+        /* We consider that NewWorld PowerMac never have any floppy drive
+         * For now, OHW cannot boot from the network.
+         */
+        for (i = 0; boot_device[i] != '\0'; i++) {
+            if (boot_device[i] >= 'c' && boot_device[i] <= 'f') {
+                ppc_boot_device = boot_device[i];
+                break;
+            }
         }
-
-        pci_cmd646_ide_init(pci_bus, &bs_table[0], 0);
-
-        /* cuda also initialize ADB */
-        cuda_mem_index = cuda_init(pic[0x12]);
-
-        adb_kbd_init(&adb_bus);
-        adb_mouse_init(&adb_bus);
-
-        {
-            MacIONVRAMState *nvr;
-            nvr = macio_nvram_init();
-            pmac_format_nvram_partition(nvr->data, 0x2000);
+        if (ppc_boot_device == '\0') {
+            fprintf(stderr, "No valid boot device for Mac99 machine\n");
+            exit(1);
         }
+    }
 
-        macio_init(pci_bus, 0x0017);
-
-        nvram = m48t59_init(dummy_irq[8], 0xFFF04000, 0x0074, NVRAM_SIZE, 59);
-
-        arch_name = "HEATHROW";
-    } else {
-        isa_mem_base = 0x80000000;
-
-        /* Register 8 MB of ISA IO space */
-        isa_mmio_init(0xf2000000, 0x00800000);
-
-        /* UniN init */
-        unin_memory = cpu_register_io_memory(0, unin_read, unin_write, NULL);
-        cpu_register_physical_memory(0xf8000000, 0x00001000, unin_memory);
+    isa_mem_base = 0x80000000;
 
-        openpic_irqs = qemu_mallocz(smp_cpus * sizeof(qemu_irq *));
-        openpic_irqs[0] =
-            qemu_mallocz(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
-        for (i = 0; i < smp_cpus; i++) {
-            /* Mac99 IRQ connection between OpenPIC outputs pins
-             * and PowerPC input pins
-             */
-            switch (PPC_INPUT(env)) {
-            case PPC_FLAGS_INPUT_6xx:
-                openpic_irqs[i] = openpic_irqs[0] + (i * OPENPIC_OUTPUT_NB);
-                openpic_irqs[i][OPENPIC_OUTPUT_INT] =
-                    ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_INT];
-                openpic_irqs[i][OPENPIC_OUTPUT_CINT] =
-                    ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_INT];
-                openpic_irqs[i][OPENPIC_OUTPUT_MCK] =
-                    ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_MCP];
-                /* Not connected ? */
-                openpic_irqs[i][OPENPIC_OUTPUT_DEBUG] = NULL;
-                /* Check this */
-                openpic_irqs[i][OPENPIC_OUTPUT_RESET] =
-                    ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_HRESET];
-                break;
-            case PPC_FLAGS_INPUT_970:
-                openpic_irqs[i] = openpic_irqs[0] + (i * OPENPIC_OUTPUT_NB);
-                openpic_irqs[i][OPENPIC_OUTPUT_INT] =
-                    ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_INT];
-                openpic_irqs[i][OPENPIC_OUTPUT_CINT] =
-                    ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_INT];
-                openpic_irqs[i][OPENPIC_OUTPUT_MCK] =
-                    ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_MCP];
-                /* Not connected ? */
-                openpic_irqs[i][OPENPIC_OUTPUT_DEBUG] = NULL;
-                /* Check this */
-                openpic_irqs[i][OPENPIC_OUTPUT_RESET] =
-                    ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_HRESET];
-                break;
-            default:
-                cpu_abort(env, "Bus model not supported on mac99 machine\n");
-                exit(1);
-            }
-        }
-        pic = openpic_init(NULL, &openpic_mem_index, smp_cpus,
-                           openpic_irqs, NULL);
-        pci_bus = pci_pmac_init(pic);
-        /* init basic PC hardware */
-        pci_vga_init(pci_bus, ds, phys_ram_base + ram_size,
-                     ram_size, vga_ram_size,
-                     vga_bios_offset, vga_bios_size);
+    /* Register 8 MB of ISA IO space */
+    isa_mmio_init(0xf2000000, 0x00800000);
 
-        /* XXX: suppress that */
-        dummy_irq = i8259_init(NULL);
+    /* UniN init */
+    unin_memory = cpu_register_io_memory(0, unin_read, unin_write, NULL);
+    cpu_register_physical_memory(0xf8000000, 0x00001000, unin_memory);
 
-        /* XXX: use Mac Serial port */
-        serial_init(0x3f8, dummy_irq[4], serial_hds[0]);
-        for(i = 0; i < nb_nics; i++) {
-            if (!nd_table[i].model)
-                nd_table[i].model = "ne2k_pci";
-            pci_nic_init(pci_bus, &nd_table[i], -1);
+    openpic_irqs = qemu_mallocz(smp_cpus * sizeof(qemu_irq *));
+    openpic_irqs[0] =
+        qemu_mallocz(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
+    for (i = 0; i < smp_cpus; i++) {
+        /* Mac99 IRQ connection between OpenPIC outputs pins
+         * and PowerPC input pins
+         */
+        switch (PPC_INPUT(env)) {
+        case PPC_FLAGS_INPUT_6xx:
+            openpic_irqs[i] = openpic_irqs[0] + (i * OPENPIC_OUTPUT_NB);
+            openpic_irqs[i][OPENPIC_OUTPUT_INT] =
+                ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_INT];
+            openpic_irqs[i][OPENPIC_OUTPUT_CINT] =
+                ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_INT];
+            openpic_irqs[i][OPENPIC_OUTPUT_MCK] =
+                ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_MCP];
+            /* Not connected ? */
+            openpic_irqs[i][OPENPIC_OUTPUT_DEBUG] = NULL;
+            /* Check this */
+            openpic_irqs[i][OPENPIC_OUTPUT_RESET] =
+                ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_HRESET];
+            break;
+#if defined(TARGET_PPC64)
+        case PPC_FLAGS_INPUT_970:
+            openpic_irqs[i] = openpic_irqs[0] + (i * OPENPIC_OUTPUT_NB);
+            openpic_irqs[i][OPENPIC_OUTPUT_INT] =
+                ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_INT];
+            openpic_irqs[i][OPENPIC_OUTPUT_CINT] =
+                ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_INT];
+            openpic_irqs[i][OPENPIC_OUTPUT_MCK] =
+                ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_MCP];
+            /* Not connected ? */
+            openpic_irqs[i][OPENPIC_OUTPUT_DEBUG] = NULL;
+            /* Check this */
+            openpic_irqs[i][OPENPIC_OUTPUT_RESET] =
+                ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_HRESET];
+            break;
+#endif /* defined(TARGET_PPC64) */
+        default:
+            cpu_abort(env, "Bus model not supported on mac99 machine\n");
+            exit(1);
         }
+    }
+    pic = openpic_init(NULL, &pic_mem_index, smp_cpus, openpic_irqs, NULL);
+    pci_bus = pci_pmac_init(pic);
+    /* init basic PC hardware */
+    pci_vga_init(pci_bus, ds, phys_ram_base + ram_size,
+                 ram_size, vga_ram_size,
+                 vga_bios_offset, vga_bios_size);
+
+    /* XXX: suppress that */
+    dummy_irq = i8259_init(NULL);
+
+    /* XXX: use Mac Serial port */
+    serial_init(0x3f8, dummy_irq[4], serial_hds[0]);
+    for(i = 0; i < nb_nics; i++) {
+        if (!nd_table[i].model)
+            nd_table[i].model = "ne2k_pci";
+        pci_nic_init(pci_bus, &nd_table[i], -1);
+    }
+    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {
+        fprintf(stderr, "qemu: too many IDE bus\n");
+        exit(1);
+    }
+    for(i = 0; i < MAX_IDE_BUS * MAX_IDE_DEVS; i++) {
+        index = drive_get_index(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
+        if (index != -1)
+            hd[i] = drives_table[index].bdrv;
+        else
+            hd[i] = NULL;
+    }
 #if 1
-        ide0_mem_index = pmac_ide_init(&bs_table[0], pic[0x13]);
-        ide1_mem_index = pmac_ide_init(&bs_table[2], pic[0x14]);
+    ide_mem_index[0] = pmac_ide_init(&hd[0], pic[0x13]);
+    ide_mem_index[1] = pmac_ide_init(&hd[2], pic[0x14]);
 #else
-        pci_cmd646_ide_init(pci_bus, &bs_table[0], 0);
+    pci_cmd646_ide_init(pci_bus, &hd[0], 0);
 #endif
-        /* cuda also initialize ADB */
-        cuda_mem_index = cuda_init(pic[0x19]);
-
-        adb_kbd_init(&adb_bus);
-        adb_mouse_init(&adb_bus);
+    /* cuda also initialize ADB */
+    cuda_init(&cuda_mem_index, pic[0x19]);
 
-        macio_init(pci_bus, 0x0022);
+    adb_kbd_init(&adb_bus);
+    adb_mouse_init(&adb_bus);
 
-        nvram = m48t59_init(dummy_irq[8], 0xFFF04000, 0x0074, NVRAM_SIZE, 59);
+    dbdma_init(&dbdma_mem_index);
 
-        arch_name = "MAC99";
-    }
+    macio_init(pci_bus, 0x0022, 0, pic_mem_index, dbdma_mem_index,
+               cuda_mem_index, NULL, 2, ide_mem_index);
 
     if (usb_enabled) {
         usb_ohci_init_pci(pci_bus, 3, -1);
@@ -553,9 +304,22 @@ static void ppc_chrp_init (int ram_size, int vga_ram_size, int boot_device,
 
     if (graphic_depth != 15 && graphic_depth != 32 && graphic_depth != 8)
         graphic_depth = 15;
-
-    PPC_NVRAM_set_params(nvram, NVRAM_SIZE, arch_name, ram_size, boot_device,
-                         kernel_base, kernel_size,
+#if 0 /* XXX: this is ugly but needed for now, or OHW won't boot */
+    /* The NewWorld NVRAM is not located in the MacIO device */
+    nvr = macio_nvram_init(&nvram_mem_index, 0x2000);
+    pmac_format_nvram_partition(nvr, 0x2000);
+    macio_nvram_map(nvr, 0xFFF04000);
+    nvram.opaque = nvr;
+    nvram.read_fn = &macio_nvram_read;
+    nvram.write_fn = &macio_nvram_write;
+#else
+    m48t59 = m48t59_init(dummy_irq[8], 0xFFF04000, 0x0074, NVRAM_SIZE, 59);
+    nvram.opaque = m48t59;
+    nvram.read_fn = &m48t59_read;
+    nvram.write_fn = &m48t59_write;
+#endif
+    PPC_NVRAM_set_params(&nvram, NVRAM_SIZE, "MAC99", ram_size,
+                         ppc_boot_device, kernel_base, kernel_size,
                          kernel_cmdline,
                          initrd_base, initrd_size,
                          /* XXX: need an option to load a NVRAM image */
@@ -567,42 +331,8 @@ static void ppc_chrp_init (int ram_size, int vga_ram_size, int boot_device,
     register_ioport_write(0x0F00, 4, 1, &PPC_debug_write, NULL);
 }
 
-static void ppc_core99_init (int ram_size, int vga_ram_size, int boot_device,
-                             DisplayState *ds, const char **fd_filename,
-                             int snapshot,
-                             const char *kernel_filename,
-                             const char *kernel_cmdline,
-                             const char *initrd_filename,
-                             const char *cpu_model)
-{
-    ppc_chrp_init(ram_size, vga_ram_size, boot_device,
-                  ds, fd_filename, snapshot,
-                  kernel_filename, kernel_cmdline,
-                  initrd_filename, cpu_model, 0);
-}
-
-static void ppc_heathrow_init (int ram_size, int vga_ram_size, int boot_device,
-                               DisplayState *ds, const char **fd_filename,
-                               int snapshot,
-                               const char *kernel_filename,
-                               const char *kernel_cmdline,
-                               const char *initrd_filename,
-                               const char *cpu_model)
-{
-    ppc_chrp_init(ram_size, vga_ram_size, boot_device,
-                  ds, fd_filename, snapshot,
-                  kernel_filename, kernel_cmdline,
-                  initrd_filename, cpu_model, 1);
-}
-
 QEMUMachine core99_machine = {
     "mac99",
     "Mac99 based PowerMAC",
     ppc_core99_init,
 };
-
-QEMUMachine heathrow_machine = {
-    "g3bw",
-    "Heathrow based PowerMAC",
-    ppc_heathrow_init,
-};
diff --git a/hw/ppc_mac.h b/hw/ppc_mac.h
new file mode 100644
index 000000000..3a26cdef9
--- /dev/null
+++ b/hw/ppc_mac.h
@@ -0,0 +1,125 @@
+/*
+ * QEMU PowerMac emulation shared definitions and prototypes
+ *
+ * Copyright (c) 2004-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#if !defined(__PPC_MAC_H__)
+#define __PPC_MAC_H__
+
+/* SMP is not enabled, for now */
+#define MAX_CPUS 1
+
+#define BIOS_FILENAME "ppc_rom.bin"
+#define VGABIOS_FILENAME "video.x"
+#define NVRAM_SIZE        0x2000
+
+#define KERNEL_LOAD_ADDR 0x01000000
+#define INITRD_LOAD_ADDR 0x01800000
+
+/* DBDMA */
+void dbdma_init (int *dbdma_mem_index);
+
+/* Cuda */
+void cuda_init (int *cuda_mem_index, qemu_irq irq);
+
+/* MacIO */
+void macio_init (PCIBus *bus, int device_id, int is_oldworld, int pic_mem_index,
+                 int dbdma_mem_index, int cuda_mem_index, void *nvram,
+                 int nb_ide, int *ide_mem_index);
+
+/* NewWorld PowerMac IDE */
+int pmac_ide_init (BlockDriverState **hd_table, qemu_irq irq);
+
+/* Heathrow PIC */
+qemu_irq *heathrow_pic_init(int *pmem_index,
+                            int nb_cpus, qemu_irq **irqs);
+
+/* Grackle PCI */
+PCIBus *pci_grackle_init(uint32_t base, qemu_irq *pic);
+
+/* UniNorth PCI */
+PCIBus *pci_pmac_init(qemu_irq *pic);
+
+/* Mac NVRAM */
+typedef struct MacIONVRAMState MacIONVRAMState;
+
+MacIONVRAMState *macio_nvram_init (int *mem_index, target_phys_addr_t size);
+void macio_nvram_map (void *opaque, target_phys_addr_t mem_base);
+void pmac_format_nvram_partition (MacIONVRAMState *nvr, int len);
+uint32_t macio_nvram_read (void *opaque, uint32_t addr);
+void macio_nvram_write (void *opaque, uint32_t addr, uint32_t val);
+
+/* adb.c */
+
+#define MAX_ADB_DEVICES 16
+
+#define ADB_MAX_OUT_LEN 16
+
+typedef struct ADBDevice ADBDevice;
+
+/* buf = NULL means polling */
+typedef int ADBDeviceRequest(ADBDevice *d, uint8_t *buf_out,
+                              const uint8_t *buf, int len);
+typedef int ADBDeviceReset(ADBDevice *d);
+
+struct ADBDevice {
+    struct ADBBusState *bus;
+    int devaddr;
+    int handler;
+    ADBDeviceRequest *devreq;
+    ADBDeviceReset *devreset;
+    void *opaque;
+};
+
+typedef struct ADBBusState {
+    ADBDevice devices[MAX_ADB_DEVICES];
+    int nb_devices;
+    int poll_index;
+} ADBBusState;
+
+int adb_request(ADBBusState *s, uint8_t *buf_out,
+                const uint8_t *buf, int len);
+int adb_poll(ADBBusState *s, uint8_t *buf_out);
+
+ADBDevice *adb_register_device(ADBBusState *s, int devaddr,
+                               ADBDeviceRequest *devreq,
+                               ADBDeviceReset *devreset,
+                               void *opaque);
+void adb_kbd_init(ADBBusState *bus);
+void adb_mouse_init(ADBBusState *bus);
+
+extern ADBBusState adb_bus;
+
+/* openpic.c */
+/* OpenPIC have 5 outputs per CPU connected and one IRQ out single output */
+enum {
+    OPENPIC_OUTPUT_INT = 0, /* IRQ                       */
+    OPENPIC_OUTPUT_CINT,    /* critical IRQ              */
+    OPENPIC_OUTPUT_MCK,     /* Machine check event       */
+    OPENPIC_OUTPUT_DEBUG,   /* Inconditional debug event */
+    OPENPIC_OUTPUT_RESET,   /* Core reset event          */
+    OPENPIC_OUTPUT_NB,
+};
+qemu_irq *openpic_init (PCIBus *bus, int *pmem_index, int nb_cpus,
+                        qemu_irq **irqs, qemu_irq irq_out);
+
+#endif /* !defined(__PPC_MAC_H__) */
diff --git a/hw/ppc_oldworld.c b/hw/ppc_oldworld.c
new file mode 100644
index 000000000..6b4f202d0
--- /dev/null
+++ b/hw/ppc_oldworld.c
@@ -0,0 +1,373 @@
+/*
+ * QEMU OldWorld PowerMac (currently ~G3 B&W) hardware System Emulator
+ *
+ * Copyright (c) 2004-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw.h"
+#include "ppc.h"
+#include "ppc_mac.h"
+#include "nvram.h"
+#include "pc.h"
+#include "sysemu.h"
+#include "net.h"
+#include "isa.h"
+#include "pci.h"
+#include "boards.h"
+
+#define MAX_IDE_BUS 2
+
+/* temporary frame buffer OSI calls for the video.x driver. The right
+   solution is to modify the driver to use VGA PCI I/Os */
+/* XXX: to be removed. This is no way related to emulation */
+static int vga_osi_call (CPUState *env)
+{
+    static int vga_vbl_enabled;
+    int linesize;
+
+    //    printf("osi_call R5=" REGX "\n", ppc_dump_gpr(env, 5));
+
+    /* same handler as PearPC, coming from the original MOL video
+       driver. */
+    switch(env->gpr[5]) {
+    case 4:
+        break;
+    case 28: /* set_vmode */
+        if (env->gpr[6] != 1 || env->gpr[7] != 0)
+            env->gpr[3] = 1;
+        else
+            env->gpr[3] = 0;
+        break;
+    case 29: /* get_vmode_info */
+        if (env->gpr[6] != 0) {
+            if (env->gpr[6] != 1 || env->gpr[7] != 0) {
+                env->gpr[3] = 1;
+                break;
+            }
+        }
+        env->gpr[3] = 0;
+        env->gpr[4] = (1 << 16) | 1; /* num_vmodes, cur_vmode */
+        env->gpr[5] = (1 << 16) | 0; /* num_depths, cur_depth_mode */
+        env->gpr[6] = (graphic_width << 16) | graphic_height; /* w, h */
+        env->gpr[7] = 85 << 16; /* refresh rate */
+        env->gpr[8] = (graphic_depth + 7) & ~7; /* depth (round to byte) */
+        linesize = ((graphic_depth + 7) >> 3) * graphic_width;
+        linesize = (linesize + 3) & ~3;
+        env->gpr[9] = (linesize << 16) | 0; /* row_bytes, offset */
+        break;
+    case 31: /* set_video power */
+        env->gpr[3] = 0;
+        break;
+    case 39: /* video_ctrl */
+        if (env->gpr[6] == 0 || env->gpr[6] == 1)
+            vga_vbl_enabled = env->gpr[6];
+        env->gpr[3] = 0;
+        break;
+    case 47:
+        break;
+    case 59: /* set_color */
+        /* R6 = index, R7 = RGB */
+        env->gpr[3] = 0;
+        break;
+    case 64: /* get color */
+        /* R6 = index */
+        env->gpr[3] = 0;
+        break;
+    case 116: /* set hwcursor */
+        /* R6 = x, R7 = y, R8 = visible, R9 = data */
+        break;
+    default:
+        fprintf(stderr, "unsupported OSI call R5=" REGX "\n",
+                ppc_dump_gpr(env, 5));
+        break;
+    }
+
+    return 1; /* osi_call handled */
+}
+
+static void ppc_heathrow_init (int ram_size, int vga_ram_size,
+                               const char *boot_device, DisplayState *ds,
+                               const char *kernel_filename,
+                               const char *kernel_cmdline,
+                               const char *initrd_filename,
+                               const char *cpu_model)
+{
+    CPUState *env = NULL, *envs[MAX_CPUS];
+    char buf[1024];
+    qemu_irq *pic, **heathrow_irqs;
+    nvram_t nvram;
+    m48t59_t *m48t59;
+    int linux_boot, i;
+    unsigned long bios_offset, vga_bios_offset;
+    uint32_t kernel_base, kernel_size, initrd_base, initrd_size;
+    PCIBus *pci_bus;
+    MacIONVRAMState *nvr;
+    int vga_bios_size, bios_size;
+    qemu_irq *dummy_irq;
+    int pic_mem_index, nvram_mem_index, dbdma_mem_index, cuda_mem_index;
+    int ide_mem_index[2];
+    int ppc_boot_device;
+    BlockDriverState *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
+    int index;
+
+    linux_boot = (kernel_filename != NULL);
+
+    /* init CPUs */
+    if (cpu_model == NULL)
+        cpu_model = "default";
+    for (i = 0; i < smp_cpus; i++) {
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find PowerPC CPU definition\n");
+            exit(1);
+        }
+        /* Set time-base frequency to 100 Mhz */
+        cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL);
+        env->osi_call = vga_osi_call;
+        qemu_register_reset(&cpu_ppc_reset, env);
+        register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
+        envs[i] = env;
+    }
+    if (env->nip < 0xFFF80000) {
+        /* Special test for PowerPC 601:
+         * the boot vector is at 0xFFF00100, then we need a 1MB BIOS.
+         * But the NVRAM is located at 0xFFF04000...
+         */
+        cpu_abort(env, "G3BW Mac hardware can not handle 1 MB BIOS\n");
+    }
+
+    /* allocate RAM */
+    cpu_register_physical_memory(0, ram_size, IO_MEM_RAM);
+
+    /* allocate and load BIOS */
+    bios_offset = ram_size + vga_ram_size;
+    if (bios_name == NULL)
+        bios_name = BIOS_FILENAME;
+    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
+    bios_size = load_image(buf, phys_ram_base + bios_offset);
+    if (bios_size < 0 || bios_size > BIOS_SIZE) {
+        cpu_abort(env, "qemu: could not load PowerPC bios '%s'\n", buf);
+        exit(1);
+    }
+    bios_size = (bios_size + 0xfff) & ~0xfff;
+    if (bios_size > 0x00080000) {
+        /* As the NVRAM is located at 0xFFF04000, we cannot use 1 MB BIOSes */
+        cpu_abort(env, "G3BW Mac hardware can not handle 1 MB BIOS\n");
+    }
+    cpu_register_physical_memory((uint32_t)(-bios_size),
+                                 bios_size, bios_offset | IO_MEM_ROM);
+
+    /* allocate and load VGA BIOS */
+    vga_bios_offset = bios_offset + bios_size;
+    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, VGABIOS_FILENAME);
+    vga_bios_size = load_image(buf, phys_ram_base + vga_bios_offset + 8);
+    if (vga_bios_size < 0) {
+        /* if no bios is present, we can still work */
+        fprintf(stderr, "qemu: warning: could not load VGA bios '%s'\n", buf);
+        vga_bios_size = 0;
+    } else {
+        /* set a specific header (XXX: find real Apple format for NDRV
+           drivers) */
+        phys_ram_base[vga_bios_offset] = 'N';
+        phys_ram_base[vga_bios_offset + 1] = 'D';
+        phys_ram_base[vga_bios_offset + 2] = 'R';
+        phys_ram_base[vga_bios_offset + 3] = 'V';
+        cpu_to_be32w((uint32_t *)(phys_ram_base + vga_bios_offset + 4),
+                     vga_bios_size);
+        vga_bios_size += 8;
+    }
+    vga_bios_size = (vga_bios_size + 0xfff) & ~0xfff;
+
+    if (linux_boot) {
+        kernel_base = KERNEL_LOAD_ADDR;
+        /* now we can load the kernel */
+        kernel_size = load_image(kernel_filename, phys_ram_base + kernel_base);
+        if (kernel_size < 0) {
+            cpu_abort(env, "qemu: could not load kernel '%s'\n",
+                      kernel_filename);
+            exit(1);
+        }
+        /* load initrd */
+        if (initrd_filename) {
+            initrd_base = INITRD_LOAD_ADDR;
+            initrd_size = load_image(initrd_filename,
+                                     phys_ram_base + initrd_base);
+            if (initrd_size < 0) {
+                cpu_abort(env, "qemu: could not load initial ram disk '%s'\n",
+                          initrd_filename);
+                exit(1);
+            }
+        } else {
+            initrd_base = 0;
+            initrd_size = 0;
+        }
+        ppc_boot_device = 'm';
+    } else {
+        kernel_base = 0;
+        kernel_size = 0;
+        initrd_base = 0;
+        initrd_size = 0;
+        ppc_boot_device = '\0';
+        for (i = 0; boot_device[i] != '\0'; i++) {
+            /* TOFIX: for now, the second IDE channel is not properly
+             *        used by OHW. The Mac floppy disk are not emulated.
+             *        For now, OHW cannot boot from the network.
+             */
+#if 0
+            if (boot_device[i] >= 'a' && boot_device[i] <= 'f') {
+                ppc_boot_device = boot_device[i];
+                break;
+            }
+#else
+            if (boot_device[i] >= 'c' && boot_device[i] <= 'd') {
+                ppc_boot_device = boot_device[i];
+                break;
+            }
+#endif
+        }
+        if (ppc_boot_device == '\0') {
+            fprintf(stderr, "No valid boot device for Mac99 machine\n");
+            exit(1);
+        }
+    }
+
+    isa_mem_base = 0x80000000;
+
+    /* Register 2 MB of ISA IO space */
+    isa_mmio_init(0xfe000000, 0x00200000);
+
+    /* XXX: we register only 1 output pin for heathrow PIC */
+    heathrow_irqs = qemu_mallocz(smp_cpus * sizeof(qemu_irq *));
+    heathrow_irqs[0] =
+        qemu_mallocz(smp_cpus * sizeof(qemu_irq) * 1);
+    /* Connect the heathrow PIC outputs to the 6xx bus */
+    for (i = 0; i < smp_cpus; i++) {
+        switch (PPC_INPUT(env)) {
+        case PPC_FLAGS_INPUT_6xx:
+            heathrow_irqs[i] = heathrow_irqs[0] + (i * 1);
+            heathrow_irqs[i][0] =
+                ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_INT];
+            break;
+        default:
+            cpu_abort(env, "Bus model not supported on OldWorld Mac machine\n");
+            exit(1);
+        }
+    }
+
+    /* init basic PC hardware */
+    if (PPC_INPUT(env) != PPC_FLAGS_INPUT_6xx) {
+        cpu_abort(env, "Only 6xx bus is supported on heathrow machine\n");
+        exit(1);
+    }
+    pic = heathrow_pic_init(&pic_mem_index, 1, heathrow_irqs);
+    pci_bus = pci_grackle_init(0xfec00000, pic);
+    pci_vga_init(pci_bus, ds, phys_ram_base + ram_size,
+                 ram_size, vga_ram_size,
+                 vga_bios_offset, vga_bios_size);
+
+    /* XXX: suppress that */
+    dummy_irq = i8259_init(NULL);
+
+    /* XXX: use Mac Serial port */
+    serial_init(0x3f8, dummy_irq[4], serial_hds[0]);
+
+    for(i = 0; i < nb_nics; i++) {
+        if (!nd_table[i].model)
+            nd_table[i].model = "ne2k_pci";
+        pci_nic_init(pci_bus, &nd_table[i], -1);
+    }
+
+    /* First IDE channel is a CMD646 on the PCI bus */
+
+    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {
+        fprintf(stderr, "qemu: too many IDE bus\n");
+        exit(1);
+    }
+    index = drive_get_index(IF_IDE, 0, 0);
+    if (index == -1)
+        hd[0] = NULL;
+    else
+        hd[0] =  drives_table[index].bdrv;
+    index = drive_get_index(IF_IDE, 0, 1);
+    if (index == -1)
+        hd[1] = NULL;
+    else
+        hd[1] =  drives_table[index].bdrv;
+    hd[3] = hd[2] = NULL;
+    pci_cmd646_ide_init(pci_bus, hd, 0);
+
+    /* Second IDE channel is a MAC IDE on the MacIO bus */
+    index = drive_get_index(IF_IDE, 1, 0);
+    if (index == -1)
+        hd[0] = NULL;
+    else
+        hd[0] =  drives_table[index].bdrv;
+    index = drive_get_index(IF_IDE, 1, 1);
+    if (index == -1)
+        hd[1] = NULL;
+    else
+        hd[1] =  drives_table[index].bdrv;
+    ide_mem_index[0] = -1;
+    ide_mem_index[1] = pmac_ide_init(hd, pic[0x0D]);
+
+    /* cuda also initialize ADB */
+    cuda_init(&cuda_mem_index, pic[0x12]);
+
+    adb_kbd_init(&adb_bus);
+    adb_mouse_init(&adb_bus);
+
+    nvr = macio_nvram_init(&nvram_mem_index, 0x2000);
+    pmac_format_nvram_partition(nvr, 0x2000);
+
+    dbdma_init(&dbdma_mem_index);
+
+    macio_init(pci_bus, 0x0017, 1, pic_mem_index, dbdma_mem_index,
+               cuda_mem_index, nvr, 2, ide_mem_index);
+
+    if (usb_enabled) {
+        usb_ohci_init_pci(pci_bus, 3, -1);
+    }
+
+    if (graphic_depth != 15 && graphic_depth != 32 && graphic_depth != 8)
+        graphic_depth = 15;
+
+    m48t59 = m48t59_init(dummy_irq[8], 0xFFF04000, 0x0074, NVRAM_SIZE, 59);
+    nvram.opaque = m48t59;
+    nvram.read_fn = &m48t59_read;
+    nvram.write_fn = &m48t59_write;
+    PPC_NVRAM_set_params(&nvram, NVRAM_SIZE, "HEATHROW", ram_size,
+                         ppc_boot_device, kernel_base, kernel_size,
+                         kernel_cmdline,
+                         initrd_base, initrd_size,
+                         /* XXX: need an option to load a NVRAM image */
+                         0,
+                         graphic_width, graphic_height, graphic_depth);
+    /* No PCI init: the BIOS will do it */
+
+    /* Special port to get debug messages from Open-Firmware */
+    register_ioport_write(0x0F00, 4, 1, &PPC_debug_write, NULL);
+}
+
+QEMUMachine heathrow_machine = {
+    "g3bw",
+    "Heathrow based PowerMAC",
+    ppc_heathrow_init,
+};
diff --git a/hw/ppc_prep.c b/hw/ppc_prep.c
index 504ca33a9..c42688e42 100644
--- a/hw/ppc_prep.c
+++ b/hw/ppc_prep.c
@@ -21,11 +21,25 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "nvram.h"
+#include "pc.h"
+#include "fdc.h"
+#include "net.h"
+#include "sysemu.h"
+#include "isa.h"
+#include "pci.h"
+#include "ppc.h"
+#include "boards.h"
 
 //#define HARD_DEBUG_PPC_IO
 //#define DEBUG_PPC_IO
 
+/* SMP is not enabled, for now */
+#define MAX_CPUS 1
+
+#define MAX_IDE_BUS 2
+
 #define BIOS_FILENAME "ppc_rom.bin"
 #define KERNEL_LOAD_ADDR 0x01000000
 #define INITRD_LOAD_ADDR 0x01800000
@@ -101,16 +115,16 @@ static uint32_t speaker_ioport_read (void *opaque, uint32_t addr)
 static void _PPC_intack_write (void *opaque,
                                target_phys_addr_t addr, uint32_t value)
 {
-    //    printf("%s: 0x%08x => 0x%08x\n", __func__, addr, value);
+//    printf("%s: 0x" PADDRX " => 0x%08" PRIx32 "\n", __func__, addr, value);
 }
 
-static inline uint32_t _PPC_intack_read (target_phys_addr_t addr)
+static always_inline uint32_t _PPC_intack_read (target_phys_addr_t addr)
 {
     uint32_t retval = 0;
 
     if (addr == 0xBFFFFFF0)
         retval = pic_intack_read(isa_pic);
-    //   printf("%s: 0x%08x <= %d\n", __func__, addr, retval);
+//   printf("%s: 0x" PADDRX " <= %08" PRIx32 "\n", __func__, addr, retval);
 
     return retval;
 }
@@ -180,7 +194,7 @@ static struct {
 static void PPC_XCSR_writeb (void *opaque,
                              target_phys_addr_t addr, uint32_t value)
 {
-    printf("%s: 0x%08lx => 0x%08x\n", __func__, (long)addr, value);
+    printf("%s: 0x" PADDRX " => 0x%08" PRIx32 "\n", __func__, addr, value);
 }
 
 static void PPC_XCSR_writew (void *opaque,
@@ -189,7 +203,7 @@ static void PPC_XCSR_writew (void *opaque,
 #ifdef TARGET_WORDS_BIGENDIAN
     value = bswap16(value);
 #endif
-    printf("%s: 0x%08lx => 0x%08x\n", __func__, (long)addr, value);
+    printf("%s: 0x" PADDRX " => 0x%08" PRIx32 "\n", __func__, addr, value);
 }
 
 static void PPC_XCSR_writel (void *opaque,
@@ -198,14 +212,14 @@ static void PPC_XCSR_writel (void *opaque,
 #ifdef TARGET_WORDS_BIGENDIAN
     value = bswap32(value);
 #endif
-    printf("%s: 0x%08lx => 0x%08x\n", __func__, (long)addr, value);
+    printf("%s: 0x" PADDRX " => 0x%08" PRIx32 "\n", __func__, addr, value);
 }
 
 static uint32_t PPC_XCSR_readb (void *opaque, target_phys_addr_t addr)
 {
     uint32_t retval = 0;
 
-    printf("%s: 0x%08lx <= %d\n", __func__, (long)addr, retval);
+    printf("%s: 0x" PADDRX " <= %08" PRIx32 "\n", __func__, addr, retval);
 
     return retval;
 }
@@ -214,7 +228,7 @@ static uint32_t PPC_XCSR_readw (void *opaque, target_phys_addr_t addr)
 {
     uint32_t retval = 0;
 
-    printf("%s: 0x%08lx <= %d\n", __func__, (long)addr, retval);
+    printf("%s: 0x" PADDRX " <= %08" PRIx32 "\n", __func__, addr, retval);
 #ifdef TARGET_WORDS_BIGENDIAN
     retval = bswap16(retval);
 #endif
@@ -226,7 +240,7 @@ static uint32_t PPC_XCSR_readl (void *opaque, target_phys_addr_t addr)
 {
     uint32_t retval = 0;
 
-    printf("%s: 0x%08lx <= %d\n", __func__, (long)addr, retval);
+    printf("%s: 0x" PADDRX " <= %08" PRIx32 "\n", __func__, addr, retval);
 #ifdef TARGET_WORDS_BIGENDIAN
     retval = bswap32(retval);
 #endif
@@ -249,6 +263,7 @@ static CPUReadMemoryFunc *PPC_XCSR_read[] = {
 
 /* Fake super-io ports for PREP platform (Intel 82378ZB) */
 typedef struct sysctrl_t {
+    qemu_irq reset_irq;
     m48t59_t *nvram;
     uint8_t state;
     uint8_t syscontrol;
@@ -267,7 +282,8 @@ static void PREP_io_write (void *opaque, uint32_t addr, uint32_t val)
 {
     sysctrl_t *sysctrl = opaque;
 
-    PPC_IO_DPRINTF("0x%08lx => 0x%08x\n", (long)addr - PPC_IO_BASE, val);
+    PPC_IO_DPRINTF("0x%08" PRIx32 " => 0x%02" PRIx32 "\n", addr - PPC_IO_BASE,
+                   val);
     sysctrl->fake_io[addr - 0x0398] = val;
 }
 
@@ -275,7 +291,7 @@ static uint32_t PREP_io_read (void *opaque, uint32_t addr)
 {
     sysctrl_t *sysctrl = opaque;
 
-    PPC_IO_DPRINTF("0x%08lx <= 0x%08x\n", (long)addr - PPC_IO_BASE,
+    PPC_IO_DPRINTF("0x%08" PRIx32 " <= 0x%02" PRIx32 "\n", addr - PPC_IO_BASE,
                    sysctrl->fake_io[addr - 0x0398]);
     return sysctrl->fake_io[addr - 0x0398];
 }
@@ -284,13 +300,16 @@ static void PREP_io_800_writeb (void *opaque, uint32_t addr, uint32_t val)
 {
     sysctrl_t *sysctrl = opaque;
 
-    PPC_IO_DPRINTF("0x%08lx => 0x%08x\n", (long)addr - PPC_IO_BASE, val);
+    PPC_IO_DPRINTF("0x%08" PRIx32 " => 0x%02" PRIx32 "\n",
+                   addr - PPC_IO_BASE, val);
     switch (addr) {
     case 0x0092:
         /* Special port 92 */
         /* Check soft reset asked */
         if (val & 0x01) {
-            //            cpu_interrupt(first_cpu, PPC_INTERRUPT_RESET);
+            qemu_irq_raise(sysctrl->reset_irq);
+        } else {
+            qemu_irq_lower(sysctrl->reset_irq);
         }
         /* Check LE mode */
         if (val & 0x02) {
@@ -338,8 +357,8 @@ static void PREP_io_800_writeb (void *opaque, uint32_t addr, uint32_t val)
         sysctrl->contiguous_map = val & 0x01;
         break;
     default:
-        printf("ERROR: unaffected IO port write: %04lx => %02x\n",
-               (long)addr, val);
+        printf("ERROR: unaffected IO port write: %04" PRIx32
+               " => %02" PRIx32"\n", addr, val);
         break;
     }
 }
@@ -401,16 +420,18 @@ static uint32_t PREP_io_800_readb (void *opaque, uint32_t addr)
         retval = sysctrl->contiguous_map;
         break;
     default:
-        printf("ERROR: unaffected IO port: %04lx read\n", (long)addr);
+        printf("ERROR: unaffected IO port: %04" PRIx32 " read\n", addr);
         break;
     }
-    PPC_IO_DPRINTF("0x%08lx <= 0x%08x\n", (long)addr - PPC_IO_BASE, retval);
+    PPC_IO_DPRINTF("0x%08" PRIx32 " <= 0x%02" PRIx32 "\n",
+                   addr - PPC_IO_BASE, retval);
 
     return retval;
 }
 
-static inline target_phys_addr_t prep_IO_address (sysctrl_t *sysctrl,
-                                                  target_phys_addr_t addr)
+static always_inline target_phys_addr_t prep_IO_address (sysctrl_t *sysctrl,
+                                                         target_phys_addr_t
+                                                         addr)
 {
     if (sysctrl->contiguous_map == 0) {
         /* 64 KB contiguous space for IOs */
@@ -452,7 +473,7 @@ static void PPC_prep_io_writew (void *opaque, target_phys_addr_t addr,
 #ifdef TARGET_WORDS_BIGENDIAN
     value = bswap16(value);
 #endif
-    PPC_IO_DPRINTF("0x%08lx => 0x%08x\n", (long)addr, value);
+    PPC_IO_DPRINTF("0x" PADDRX " => 0x%08" PRIx32 "\n", addr, value);
     cpu_outw(NULL, addr, value);
 }
 
@@ -466,7 +487,7 @@ static uint32_t PPC_prep_io_readw (void *opaque, target_phys_addr_t addr)
 #ifdef TARGET_WORDS_BIGENDIAN
     ret = bswap16(ret);
 #endif
-    PPC_IO_DPRINTF("0x%08lx <= 0x%08x\n", (long)addr, ret);
+    PPC_IO_DPRINTF("0x" PADDRX " <= 0x%08" PRIx32 "\n", addr, ret);
 
     return ret;
 }
@@ -480,7 +501,7 @@ static void PPC_prep_io_writel (void *opaque, target_phys_addr_t addr,
 #ifdef TARGET_WORDS_BIGENDIAN
     value = bswap32(value);
 #endif
-    PPC_IO_DPRINTF("0x%08lx => 0x%08x\n", (long)addr, value);
+    PPC_IO_DPRINTF("0x" PADDRX " => 0x%08" PRIx32 "\n", addr, value);
     cpu_outl(NULL, addr, value);
 }
 
@@ -494,7 +515,7 @@ static uint32_t PPC_prep_io_readl (void *opaque, target_phys_addr_t addr)
 #ifdef TARGET_WORDS_BIGENDIAN
     ret = bswap32(ret);
 #endif
-    PPC_IO_DPRINTF("0x%08lx <= 0x%08x\n", (long)addr, ret);
+    PPC_IO_DPRINTF("0x" PADDRX " <= 0x%08" PRIx32 "\n", addr, ret);
 
     return ret;
 }
@@ -514,23 +535,27 @@ CPUReadMemoryFunc *PPC_prep_io_read[] = {
 #define NVRAM_SIZE        0x2000
 
 /* PowerPC PREP hardware initialisation */
-static void ppc_prep_init (int ram_size, int vga_ram_size, int boot_device,
-                           DisplayState *ds, const char **fd_filename,
-                           int snapshot, const char *kernel_filename,
+static void ppc_prep_init (int ram_size, int vga_ram_size,
+                           const char *boot_device, DisplayState *ds,
+                           const char *kernel_filename,
                            const char *kernel_cmdline,
                            const char *initrd_filename,
                            const char *cpu_model)
 {
-    CPUState *env;
+    CPUState *env = NULL, *envs[MAX_CPUS];
     char buf[1024];
-    m48t59_t *nvram;
+    nvram_t nvram;
+    m48t59_t *m48t59;
     int PPC_io_memory;
     int linux_boot, i, nb_nics1, bios_size;
     unsigned long bios_offset;
     uint32_t kernel_base, kernel_size, initrd_base, initrd_size;
-    ppc_def_t *def;
     PCIBus *pci_bus;
     qemu_irq *i8259;
+    int ppc_boot_device;
+    int index;
+    BlockDriverState *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
+    BlockDriverState *fd[MAX_FD];
 
     sysctrl = qemu_mallocz(sizeof(sysctrl_t));
     if (sysctrl == NULL)
@@ -539,32 +564,42 @@ static void ppc_prep_init (int ram_size, int vga_ram_size, int boot_device,
     linux_boot = (kernel_filename != NULL);
 
     /* init CPUs */
-
-    env = cpu_init();
-    qemu_register_reset(&cpu_ppc_reset, env);
-    register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
-
     if (cpu_model == NULL)
         cpu_model = "default";
-    ppc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
-        cpu_abort(env, "Unable to find PowerPC CPU definition\n");
+    for (i = 0; i < smp_cpus; i++) {
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find PowerPC CPU definition\n");
+            exit(1);
+        }
+        if (env->flags & POWERPC_FLAG_RTC_CLK) {
+            /* POWER / PowerPC 601 RTC clock frequency is 7.8125 MHz */
+            cpu_ppc_tb_init(env, 7812500UL);
+        } else {
+            /* Set time-base frequency to 100 Mhz */
+            cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL);
+        }
+        qemu_register_reset(&cpu_ppc_reset, env);
+        register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
+        envs[i] = env;
     }
-    cpu_ppc_register(env, def);
-    /* Set time-base frequency to 100 Mhz */
-    cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL);
 
     /* allocate RAM */
     cpu_register_physical_memory(0, ram_size, IO_MEM_RAM);
 
     /* allocate and load BIOS */
     bios_offset = ram_size + vga_ram_size;
-    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME);
+    if (bios_name == NULL)
+        bios_name = BIOS_FILENAME;
+    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
     bios_size = load_image(buf, phys_ram_base + bios_offset);
     if (bios_size < 0 || bios_size > BIOS_SIZE) {
         cpu_abort(env, "qemu: could not load PPC PREP bios '%s'\n", buf);
         exit(1);
     }
+    if (env->nip < 0xFFF80000 && bios_size < 0x00100000) {
+        cpu_abort(env, "PowerPC 601 / 620 / 970 need a 1MB BIOS\n");
+    }
     bios_size = (bios_size + 0xfff) & ~0xfff;
     cpu_register_physical_memory((uint32_t)(-bios_size),
                                  bios_size, bios_offset | IO_MEM_ROM);
@@ -592,12 +627,24 @@ static void ppc_prep_init (int ram_size, int vga_ram_size, int boot_device,
             initrd_base = 0;
             initrd_size = 0;
         }
-        boot_device = 'm';
+        ppc_boot_device = 'm';
     } else {
         kernel_base = 0;
         kernel_size = 0;
         initrd_base = 0;
         initrd_size = 0;
+        ppc_boot_device = '\0';
+        /* For now, OHW cannot boot from the network. */
+        for (i = 0; boot_device[i] != '\0'; i++) {
+            if (boot_device[i] >= 'a' && boot_device[i] <= 'f') {
+                ppc_boot_device = boot_device[i];
+                break;
+            }
+        }
+        if (ppc_boot_device == '\0') {
+            fprintf(stderr, "No valid boot device for Mac99 machine\n");
+            exit(1);
+        }
     }
 
     isa_mem_base = 0xc0000000;
@@ -625,34 +672,51 @@ static void ppc_prep_init (int ram_size, int vga_ram_size, int boot_device,
     if (nb_nics1 > NE2000_NB_MAX)
         nb_nics1 = NE2000_NB_MAX;
     for(i = 0; i < nb_nics1; i++) {
-        if (nd_table[0].model == NULL
-            || strcmp(nd_table[0].model, "ne2k_isa") == 0) {
+        if (nd_table[i].model == NULL
+            || strcmp(nd_table[i].model, "ne2k_isa") == 0) {
             isa_ne2000_init(ne2000_io[i], i8259[ne2000_irq[i]], &nd_table[i]);
-        } else if (strcmp(nd_table[0].model, "?") == 0) {
-            fprintf(stderr, "qemu: Supported NICs: ne2k_isa\n");
-            exit (1);
         } else {
-            /* Why ? */
-            cpu_abort(env, "qemu: Unsupported NIC: %s\n", nd_table[0].model);
-            exit (1);
+            pci_nic_init(pci_bus, &nd_table[i], -1);
         }
     }
 
-    for(i = 0; i < 2; i++) {
+    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {
+        fprintf(stderr, "qemu: too many IDE bus\n");
+        exit(1);
+    }
+
+    for(i = 0; i < MAX_IDE_BUS * MAX_IDE_DEVS; i++) {
+        index = drive_get_index(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
+        if (index != -1)
+            hd[i] = drives_table[index].bdrv;
+        else
+            hd[i] = NULL;
+    }
+
+    for(i = 0; i < MAX_IDE_BUS; i++) {
         isa_ide_init(ide_iobase[i], ide_iobase2[i], i8259[ide_irq[i]],
-                     bs_table[2 * i], bs_table[2 * i + 1]);
+                     hd[2 * i],
+		     hd[2 * i + 1]);
     }
     i8042_init(i8259[1], i8259[12], 0x60);
     DMA_init(1);
     //    AUD_init();
     //    SB16_init();
 
-    fdctrl_init(i8259[6], 2, 0, 0x3f0, fd_table);
+    for(i = 0; i < MAX_FD; i++) {
+        index = drive_get_index(IF_FLOPPY, 0, i);
+        if (index != -1)
+            fd[i] = drives_table[index].bdrv;
+        else
+            fd[i] = NULL;
+    }
+    fdctrl_init(i8259[6], 2, 0, 0x3f0, fd);
 
     /* Register speaker port */
     register_ioport_read(0x61, 1, 1, speaker_ioport_read, NULL);
     register_ioport_write(0x61, 1, 1, speaker_ioport_write, NULL);
     /* Register fake IO ports for PREP */
+    sysctrl->reset_irq = first_cpu->irq_inputs[PPC6xx_INPUT_HRESET];
     register_ioport_read(0x398, 2, 1, &PREP_io_read, sysctrl);
     register_ioport_write(0x398, 2, 1, &PREP_io_write, sysctrl);
     /* System control ports */
@@ -675,13 +739,16 @@ static void ppc_prep_init (int ram_size, int vga_ram_size, int boot_device,
         usb_ohci_init_pci(pci_bus, 3, -1);
     }
 
-    nvram = m48t59_init(i8259[8], 0, 0x0074, NVRAM_SIZE, 59);
-    if (nvram == NULL)
+    m48t59 = m48t59_init(i8259[8], 0, 0x0074, NVRAM_SIZE, 59);
+    if (m48t59 == NULL)
         return;
-    sysctrl->nvram = nvram;
+    sysctrl->nvram = m48t59;
 
     /* Initialise NVRAM */
-    PPC_NVRAM_set_params(nvram, NVRAM_SIZE, "PREP", ram_size, boot_device,
+    nvram.opaque = m48t59;
+    nvram.read_fn = &m48t59_read;
+    nvram.write_fn = &m48t59_write;
+    PPC_NVRAM_set_params(&nvram, NVRAM_SIZE, "PREP", ram_size, ppc_boot_device,
                          kernel_base, kernel_size,
                          kernel_cmdline,
                          initrd_base, initrd_size,
diff --git a/hw/prep_pci.c b/hw/prep_pci.c
index f384e4215..815db5308 100644
--- a/hw/prep_pci.c
+++ b/hw/prep_pci.c
@@ -22,7 +22,9 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pci.h"
+
 typedef uint32_t pci_addr_t;
 #include "pci_host.h"
 
@@ -117,7 +119,6 @@ static CPUReadMemoryFunc *PPC_PCIIO_read[] = {
     &PPC_PCIIO_readl,
 };
 
-/* Don't know if this matches real hardware, but it agrees with OHW.  */
 static int prep_map_irq(PCIDevice *pci_dev, int irq_num)
 {
     return (irq_num + (pci_dev->devfn >> 3)) & 1;
@@ -125,7 +126,7 @@ static int prep_map_irq(PCIDevice *pci_dev, int irq_num)
 
 static void prep_set_irq(qemu_irq *pic, int irq_num, int level)
 {
-    qemu_set_irq(pic[irq_num ? 11 : 9], level);
+    qemu_set_irq(pic[(irq_num & 1) ? 11 : 9] , level);
 }
 
 PCIBus *pci_prep_init(qemu_irq *pic)
@@ -135,7 +136,7 @@ PCIBus *pci_prep_init(qemu_irq *pic)
     int PPC_io_memory;
 
     s = qemu_mallocz(sizeof(PREPPCIState));
-    s->bus = pci_register_bus(prep_set_irq, prep_map_irq, pic, 0, 2);
+    s->bus = pci_register_bus(prep_set_irq, prep_map_irq, pic, 0, 4);
 
     register_ioport_write(0xcf8, 4, 4, pci_prep_addr_writel, s);
     register_ioport_read(0xcf8, 4, 4, pci_prep_addr_readl, s);
diff --git a/hw/primecell.h b/hw/primecell.h
new file mode 100644
index 000000000..aa35adc02
--- /dev/null
+++ b/hw/primecell.h
@@ -0,0 +1,61 @@
+#ifndef PRIMECELL_H
+#define PRIMECELL_H
+
+/* Declarations for ARM PrimeCell based periperals.  */
+/* Also includes some devices that are currently only used by the
+   ARM boards.  */
+
+/* pl031.c */
+void pl031_init(uint32_t base, qemu_irq irq);
+
+/* pl110.c */
+void *pl110_init(DisplayState *ds, uint32_t base, qemu_irq irq, int);
+
+/* pl011.c */
+enum pl011_type {
+    PL011_ARM,
+    PL011_LUMINARY
+};
+
+void pl011_init(uint32_t base, qemu_irq irq, CharDriverState *chr,
+                enum pl011_type type);
+
+/* pl022.c */
+typedef int (*ssi_xfer_cb)(void *, int);
+void pl022_init(uint32_t base, qemu_irq irq, ssi_xfer_cb xfer_cb,
+                void *opaque);
+
+/* pl050.c */
+void pl050_init(uint32_t base, qemu_irq irq, int is_mouse);
+
+/* pl061.c */
+void pl061_float_high(void *opaque, uint8_t mask);
+qemu_irq *pl061_init(uint32_t base, qemu_irq irq, qemu_irq **out);
+
+/* pl080.c */
+void *pl080_init(uint32_t base, qemu_irq irq, int nchannels);
+
+/* pl181.c */
+void pl181_init(uint32_t base, BlockDriverState *bd,
+                qemu_irq irq0, qemu_irq irq1);
+
+/* pl190.c */
+qemu_irq *pl190_init(uint32_t base, qemu_irq irq, qemu_irq fiq);
+
+/* realview_gic.c */
+qemu_irq *realview_gic_init(uint32_t base, qemu_irq parent_irq);
+
+/* mpcore.c */
+extern qemu_irq *mpcore_irq_init(qemu_irq *cpu_irq);
+
+/* arm-timer.c */
+void sp804_init(uint32_t base, qemu_irq irq);
+void icp_pit_init(uint32_t base, qemu_irq *pic, int irq);
+
+/* arm_sysctl.c */
+void arm_sysctl_init(uint32_t base, uint32_t sys_id);
+
+/* versatile_pci.c */
+PCIBus *pci_vpb_init(qemu_irq *pic, int irq, int realview);
+
+#endif
diff --git a/hw/ps2.c b/hw/ps2.c
index 5367df10c..130e89478 100644
--- a/hw/ps2.c
+++ b/hw/ps2.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "ps2.h"
+#include "console.h"
 
 /* debug PC keyboard */
 //#define DEBUG_KBD
@@ -468,19 +470,19 @@ static void ps2_reset(void *opaque)
 
 static void ps2_common_save (QEMUFile *f, PS2State *s)
 {
-    qemu_put_be32s (f, &s->write_cmd);
-    qemu_put_be32s (f, &s->queue.rptr);
-    qemu_put_be32s (f, &s->queue.wptr);
-    qemu_put_be32s (f, &s->queue.count);
+    qemu_put_be32 (f, s->write_cmd);
+    qemu_put_be32 (f, s->queue.rptr);
+    qemu_put_be32 (f, s->queue.wptr);
+    qemu_put_be32 (f, s->queue.count);
     qemu_put_buffer (f, s->queue.data, sizeof (s->queue.data));
 }
 
 static void ps2_common_load (QEMUFile *f, PS2State *s)
 {
-    qemu_get_be32s (f, &s->write_cmd);
-    qemu_get_be32s (f, &s->queue.rptr);
-    qemu_get_be32s (f, &s->queue.wptr);
-    qemu_get_be32s (f, &s->queue.count);
+    s->write_cmd=qemu_get_be32 (f);
+    s->queue.rptr=qemu_get_be32 (f);
+    s->queue.wptr=qemu_get_be32 (f);
+    s->queue.count=qemu_get_be32 (f);
     qemu_get_buffer (f, s->queue.data, sizeof (s->queue.data));
 }
 
@@ -489,8 +491,8 @@ static void ps2_kbd_save(QEMUFile* f, void* opaque)
     PS2KbdState *s = (PS2KbdState*)opaque;
 
     ps2_common_save (f, &s->common);
-    qemu_put_be32s(f, &s->scan_enabled);
-    qemu_put_be32s(f, &s->translate);
+    qemu_put_be32(f, s->scan_enabled);
+    qemu_put_be32(f, s->translate);
 }
 
 static void ps2_mouse_save(QEMUFile* f, void* opaque)
@@ -504,9 +506,9 @@ static void ps2_mouse_save(QEMUFile* f, void* opaque)
     qemu_put_8s(f, &s->mouse_wrap);
     qemu_put_8s(f, &s->mouse_type);
     qemu_put_8s(f, &s->mouse_detect_state);
-    qemu_put_be32s(f, &s->mouse_dx);
-    qemu_put_be32s(f, &s->mouse_dy);
-    qemu_put_be32s(f, &s->mouse_dz);
+    qemu_put_be32(f, s->mouse_dx);
+    qemu_put_be32(f, s->mouse_dy);
+    qemu_put_be32(f, s->mouse_dz);
     qemu_put_8s(f, &s->mouse_buttons);
 }
 
@@ -518,8 +520,8 @@ static int ps2_kbd_load(QEMUFile* f, void* opaque, int version_id)
         return -EINVAL;
 
     ps2_common_load (f, &s->common);
-    qemu_get_be32s(f, &s->scan_enabled);
-    qemu_get_be32s(f, &s->translate);
+    s->scan_enabled=qemu_get_be32(f);
+    s->translate=qemu_get_be32(f);
     return 0;
 }
 
@@ -537,9 +539,9 @@ static int ps2_mouse_load(QEMUFile* f, void* opaque, int version_id)
     qemu_get_8s(f, &s->mouse_wrap);
     qemu_get_8s(f, &s->mouse_type);
     qemu_get_8s(f, &s->mouse_detect_state);
-    qemu_get_be32s(f, &s->mouse_dx);
-    qemu_get_be32s(f, &s->mouse_dy);
-    qemu_get_be32s(f, &s->mouse_dz);
+    s->mouse_dx=qemu_get_be32(f);
+    s->mouse_dy=qemu_get_be32(f);
+    s->mouse_dz=qemu_get_be32(f);
     qemu_get_8s(f, &s->mouse_buttons);
     return 0;
 }
diff --git a/hw/ps2.h b/hw/ps2.h
new file mode 100644
index 000000000..f2c091edd
--- /dev/null
+++ b/hw/ps2.h
@@ -0,0 +1,10 @@
+/* ps2.c */
+void *ps2_kbd_init(void (*update_irq)(void *, int), void *update_arg);
+void *ps2_mouse_init(void (*update_irq)(void *, int), void *update_arg);
+void ps2_write_mouse(void *, int val);
+void ps2_write_keyboard(void *, int val);
+uint32_t ps2_read_data(void *);
+void ps2_queue(void *, int b);
+void ps2_keyboard_set_translation(void *opaque, int mode);
+void ps2_mouse_fake_event(void *opaque);
+
diff --git a/hw/ptimer.c b/hw/ptimer.c
index d81503adc..7dd6d3110 100644
--- a/hw/ptimer.c
+++ b/hw/ptimer.c
@@ -5,7 +5,8 @@
  *
  * This code is licenced under the GNU LGPL.
  */
-#include "vl.h"
+#include "hw.h"
+#include "qemu-timer.h"
 
 
 struct ptimer_state
diff --git a/hw/pxa.h b/hw/pxa.h
index 90ffd6076..16a68d936 100644
--- a/hw/pxa.h
+++ b/hw/pxa.h
@@ -4,7 +4,7 @@
  * Copyright (c) 2006 Openedhand Ltd.
  * Written by Andrzej Zaborowski <balrog@zabor.org>
  *
- * This code is licenced under the GPL.
+ * This code is licenced under the GNU GPL v2.
  */
 #ifndef PXA_H
 # define PXA_H			"pxa.h"
@@ -13,6 +13,7 @@
 # define PXA2XX_PIC_SSP3	0
 # define PXA2XX_PIC_USBH2	2
 # define PXA2XX_PIC_USBH1	3
+# define PXA2XX_PIC_KEYPAD	4
 # define PXA2XX_PIC_PWRI2C	6
 # define PXA25X_PIC_HWUART	7
 # define PXA27X_PIC_OST_4_11	7
@@ -72,11 +73,10 @@ void pxa27x_timer_init(target_phys_addr_t base, qemu_irq *irqs, qemu_irq irq4);
 struct pxa2xx_gpio_info_s;
 struct pxa2xx_gpio_info_s *pxa2xx_gpio_init(target_phys_addr_t base,
                 CPUState *env, qemu_irq *pic, int lines);
-void pxa2xx_gpio_set(struct pxa2xx_gpio_info_s *s, int line, int level);
-void pxa2xx_gpio_handler_set(struct pxa2xx_gpio_info_s *s, int line,
-                gpio_handler_t handler, void *opaque);
-void pxa2xx_gpio_read_notifier(struct pxa2xx_gpio_info_s *s,
-                void (*handler)(void *opaque), void *opaque);
+qemu_irq *pxa2xx_gpio_in_get(struct pxa2xx_gpio_info_s *s);
+void pxa2xx_gpio_out_set(struct pxa2xx_gpio_info_s *s,
+                int line, qemu_irq handler);
+void pxa2xx_gpio_read_notifier(struct pxa2xx_gpio_info_s *s, qemu_irq handler);
 
 /* pxa2xx_dma.c */
 struct pxa2xx_dma_state_s;
@@ -90,17 +90,15 @@ void pxa2xx_dma_request(struct pxa2xx_dma_state_s *s, int req_num, int on);
 struct pxa2xx_lcdc_s;
 struct pxa2xx_lcdc_s *pxa2xx_lcdc_init(target_phys_addr_t base,
                 qemu_irq irq, DisplayState *ds);
-void pxa2xx_lcd_vsync_cb(struct pxa2xx_lcdc_s *s,
-                void (*cb)(void *opaque), void *opaque);
+void pxa2xx_lcd_vsync_notifier(struct pxa2xx_lcdc_s *s, qemu_irq handler);
 void pxa2xx_lcdc_oritentation(void *opaque, int angle);
 
 /* pxa2xx_mmci.c */
 struct pxa2xx_mmci_s;
 struct pxa2xx_mmci_s *pxa2xx_mmci_init(target_phys_addr_t base,
-                qemu_irq irq, void *dma);
-void pxa2xx_mmci_handlers(struct pxa2xx_mmci_s *s, void *opaque,
-                void (*readonly_cb)(void *, int),
-                void (*coverswitch_cb)(void *, int));
+                BlockDriverState *bd, qemu_irq irq, void *dma);
+void pxa2xx_mmci_handlers(struct pxa2xx_mmci_s *s, qemu_irq readonly,
+                qemu_irq coverswitch);
 
 /* pxa2xx_pcmcia.c */
 struct pxa2xx_pcmcia_s;
@@ -109,6 +107,17 @@ int pxa2xx_pcmcia_attach(void *opaque, struct pcmcia_card_s *card);
 int pxa2xx_pcmcia_dettach(void *opaque);
 void pxa2xx_pcmcia_set_irq_cb(void *opaque, qemu_irq irq, qemu_irq cd_irq);
 
+/* pxa2xx_keypad.c */
+struct  keymap {
+    int column;
+    int row;
+};
+struct pxa2xx_keypad_s;
+struct pxa2xx_keypad_s *pxa27x_keypad_init(target_phys_addr_t base,
+                qemu_irq irq);
+void pxa27x_register_keypad(struct pxa2xx_keypad_s *kp, struct keymap *map,
+                int size);
+
 /* pxa2xx.c */
 struct pxa2xx_ssp_s;
 void pxa2xx_ssp_attach(struct pxa2xx_ssp_s *port,
@@ -126,6 +135,7 @@ struct pxa2xx_fir_s;
 struct pxa2xx_state_s {
     CPUState *env;
     qemu_irq *pic;
+    qemu_irq reset;
     struct pxa2xx_dma_state_s *dma;
     struct pxa2xx_gpio_info_s *gpio;
     struct pxa2xx_lcdc_s *lcd;
@@ -135,6 +145,7 @@ struct pxa2xx_state_s {
     struct pxa2xx_pcmcia_s *pcmcia[2];
     struct pxa2xx_i2s_s *i2s;
     struct pxa2xx_fir_s *fir;
+    struct pxa2xx_keypad_s *kp;
 
     /* Power management */
     target_phys_addr_t pm_base;
@@ -203,12 +214,14 @@ struct pxa2xx_i2s_s {
 };
 
 # define PA_FMT			"0x%08lx"
-# define REG_FMT		"0x%lx"
+# define REG_FMT		"0x" TARGET_FMT_plx
 
 struct pxa2xx_state_s *pxa270_init(unsigned int sdram_size, DisplayState *ds,
                 const char *revision);
 struct pxa2xx_state_s *pxa255_init(unsigned int sdram_size, DisplayState *ds);
 
-void pxa2xx_reset(int line, int level, void *opaque);
+/* usb-ohci.c */
+void usb_ohci_init_pxa(target_phys_addr_t base, int num_ports, int devfn,
+                       qemu_irq irq);
 
 #endif	/* PXA_H */
diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
index 6109fc13e..14e3b9573 100644
--- a/hw/pxa2xx.c
+++ b/hw/pxa2xx.c
@@ -7,7 +7,13 @@
  * This code is licenced under the GPL.
  */
 
-# include "vl.h"
+#include "hw.h"
+#include "pxa.h"
+#include "sysemu.h"
+#include "pc.h"
+#include "i2c.h"
+#include "qemu-timer.h"
+#include "qemu-char.h"
 
 static struct {
     target_phys_addr_t io_base;
@@ -25,22 +31,34 @@ static struct {
     { 0, 0 }
 };
 
-static struct {
+typedef struct PXASSPDef {
     target_phys_addr_t io_base;
     int irqn;
-} pxa250_ssp[] = {
+} PXASSPDef;
+
+#if 0
+static PXASSPDef pxa250_ssp[] = {
     { 0x41000000, PXA2XX_PIC_SSP },
     { 0, 0 }
-}, pxa255_ssp[] = {
+};
+#endif
+
+static PXASSPDef pxa255_ssp[] = {
     { 0x41000000, PXA2XX_PIC_SSP },
     { 0x41400000, PXA25X_PIC_NSSP },
     { 0, 0 }
-}, pxa26x_ssp[] = {
+};
+
+#if 0
+static PXASSPDef pxa26x_ssp[] = {
     { 0x41000000, PXA2XX_PIC_SSP },
     { 0x41400000, PXA25X_PIC_NSSP },
     { 0x41500000, PXA26X_PIC_ASSP },
     { 0, 0 }
-}, pxa27x_ssp[] = {
+};
+#endif
+
+static PXASSPDef pxa27x_ssp[] = {
     { 0x41000000, PXA2XX_PIC_SSP },
     { 0x41700000, PXA27X_PIC_SSP2 },
     { 0x41900000, PXA2XX_PIC_SSP3 },
@@ -297,7 +315,7 @@ static void pxa2xx_clkpwr_write(void *opaque, int op2, int reg, int crm,
                     ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
             s->env->cp15.c1_sys = 0;
             s->env->cp15.c1_coproc = 0;
-            s->env->cp15.c2_base = 0;
+            s->env->cp15.c2_base0 = 0;
             s->env->cp15.c3 = 0;
             s->pm_regs[PSSR >> 2] |= 0x8;	/* Set STS */
             s->pm_regs[RCSR >> 2] |= 0x8;	/* Set GPR */
@@ -2001,9 +2019,10 @@ static struct pxa2xx_fir_s *pxa2xx_fir_init(target_phys_addr_t base,
     return s;
 }
 
-void pxa2xx_reset(int line, int level, void *opaque)
+static void pxa2xx_reset(void *opaque, int line, int level)
 {
     struct pxa2xx_state_s *s = (struct pxa2xx_state_s *) opaque;
+
     if (level && (s->pm_regs[PCFR >> 2] & 0x10)) {	/* GPR_EN */
         cpu_reset(s->env);
         /* TODO: reset peripherals */
@@ -2017,16 +2036,25 @@ struct pxa2xx_state_s *pxa270_init(unsigned int sdram_size,
     struct pxa2xx_state_s *s;
     struct pxa2xx_ssp_s *ssp;
     int iomemtype, i;
+    int index;
     s = (struct pxa2xx_state_s *) qemu_mallocz(sizeof(struct pxa2xx_state_s));
 
     if (revision && strncmp(revision, "pxa27", 5)) {
         fprintf(stderr, "Machine requires a PXA27x processor.\n");
         exit(1);
     }
+    if (!revision)
+        revision = "pxa270";
+    
+    s->env = cpu_init(revision);
+    if (!s->env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
+    register_savevm("cpu", 0, ARM_CPU_SAVE_VERSION, cpu_save, cpu_load,
+                    s->env);
 
-    s->env = cpu_init();
-    cpu_arm_set_model(s->env, revision ?: "pxa270");
-    register_savevm("cpu", 0, 0, cpu_save, cpu_load, s->env);
+    s->reset = qemu_allocate_irqs(pxa2xx_reset, s, 1)[0];
 
     /* SDRAM & Internal Memory Storage */
     cpu_register_physical_memory(PXA2XX_SDRAM_BASE,
@@ -2043,7 +2071,13 @@ struct pxa2xx_state_s *pxa270_init(unsigned int sdram_size,
 
     s->gpio = pxa2xx_gpio_init(0x40e00000, s->env, s->pic, 121);
 
-    s->mmc = pxa2xx_mmci_init(0x41100000, s->pic[PXA2XX_PIC_MMC], s->dma);
+    index = drive_get_index(IF_SD, 0, 0);
+    if (index == -1) {
+        fprintf(stderr, "qemu: missing SecureDigital device\n");
+        exit(1);
+    }
+    s->mmc = pxa2xx_mmci_init(0x41100000, drives_table[index].bdrv,
+                              s->pic[PXA2XX_PIC_MMC], s->dma);
 
     for (i = 0; pxa270_serial[i].io_base; i ++)
         if (serial_hds[i])
@@ -2119,9 +2153,11 @@ struct pxa2xx_state_s *pxa270_init(unsigned int sdram_size,
 
     s->i2s = pxa2xx_i2s_init(0x40400000, s->pic[PXA2XX_PIC_I2S], s->dma);
 
+    s->kp = pxa27x_keypad_init(0x41500000, s->pic[PXA2XX_PIC_KEYPAD]);
+
     /* GPIO1 resets the processor */
     /* The handler can be overridden by board-specific code */
-    pxa2xx_gpio_handler_set(s->gpio, 1, pxa2xx_reset, s);
+    pxa2xx_gpio_out_set(s->gpio, 1, s->reset);
     return s;
 }
 
@@ -2132,11 +2168,19 @@ struct pxa2xx_state_s *pxa255_init(unsigned int sdram_size,
     struct pxa2xx_state_s *s;
     struct pxa2xx_ssp_s *ssp;
     int iomemtype, i;
+    int index;
+
     s = (struct pxa2xx_state_s *) qemu_mallocz(sizeof(struct pxa2xx_state_s));
 
-    s->env = cpu_init();
-    cpu_arm_set_model(s->env, "pxa255");
-    register_savevm("cpu", 0, 0, cpu_save, cpu_load, s->env);
+    s->env = cpu_init("pxa255");
+    if (!s->env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
+    register_savevm("cpu", 0, ARM_CPU_SAVE_VERSION, cpu_save, cpu_load,
+                    s->env);
+
+    s->reset = qemu_allocate_irqs(pxa2xx_reset, s, 1)[0];
 
     /* SDRAM & Internal Memory Storage */
     cpu_register_physical_memory(PXA2XX_SDRAM_BASE, sdram_size,
@@ -2152,7 +2196,13 @@ struct pxa2xx_state_s *pxa255_init(unsigned int sdram_size,
 
     s->gpio = pxa2xx_gpio_init(0x40e00000, s->env, s->pic, 85);
 
-    s->mmc = pxa2xx_mmci_init(0x41100000, s->pic[PXA2XX_PIC_MMC], s->dma);
+    index = drive_get_index(IF_SD, 0, 0);
+    if (index == -1) {
+        fprintf(stderr, "qemu: missing SecureDigital device\n");
+        exit(1);
+    }
+    s->mmc = pxa2xx_mmci_init(0x41100000, drives_table[index].bdrv,
+                              s->pic[PXA2XX_PIC_MMC], s->dma);
 
     for (i = 0; pxa255_serial[i].io_base; i ++)
         if (serial_hds[i])
@@ -2230,6 +2280,6 @@ struct pxa2xx_state_s *pxa255_init(unsigned int sdram_size,
 
     /* GPIO1 resets the processor */
     /* The handler can be overridden by board-specific code */
-    pxa2xx_gpio_handler_set(s->gpio, 1, pxa2xx_reset, s);
+    pxa2xx_gpio_out_set(s->gpio, 1, s->reset);
     return s;
 }
diff --git a/hw/pxa2xx_dma.c b/hw/pxa2xx_dma.c
index 53bce2e46..4e33c5317 100644
--- a/hw/pxa2xx_dma.c
+++ b/hw/pxa2xx_dma.c
@@ -8,7 +8,8 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pxa.h"
 
 struct pxa2xx_dma_channel_s {
     target_phys_addr_t descr;
@@ -303,7 +304,7 @@ static uint32_t pxa2xx_dma_read(void *opaque, target_phys_addr_t offset)
     }
 
     cpu_abort(cpu_single_env,
-                    "%s: Bad offset 0x%04lx\n", __FUNCTION__, offset);
+                    "%s: Bad offset 0x" TARGET_FMT_plx "\n", __FUNCTION__, offset);
     return 7;
 }
 
@@ -347,8 +348,10 @@ static void pxa2xx_dma_write(void *opaque,
 
         if (value & DCSR_NODESCFETCH) {
             /* No-descriptor-fetch mode */
-            if (value & DCSR_RUN)
+            if (value & DCSR_RUN) {
+                s->chan[channel].state &= ~DCSR_STOPINTR;
                 pxa2xx_dma_run(s);
+            }
         } else {
             /* Descriptor-fetch mode */
             if (value & DCSR_RUN) {
@@ -401,7 +404,7 @@ static void pxa2xx_dma_write(void *opaque,
             break;
         }
     fail:
-        cpu_abort(cpu_single_env, "%s: Bad offset 0x%04lx\n",
+        cpu_abort(cpu_single_env, "%s: Bad offset " TARGET_FMT_plx "\n",
                 __FUNCTION__, offset);
     }
 }
diff --git a/hw/pxa2xx_gpio.c b/hw/pxa2xx_gpio.c
index 85aeb50cc..e3a30bc45 100644
--- a/hw/pxa2xx_gpio.c
+++ b/hw/pxa2xx_gpio.c
@@ -7,7 +7,8 @@
  * This code is licensed under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pxa.h"
 
 #define PXA2XX_GPIO_BANKS	4
 
@@ -16,6 +17,7 @@ struct pxa2xx_gpio_info_s {
     qemu_irq *pic;
     int lines;
     CPUState *cpu_env;
+    qemu_irq *in;
 
     /* XXX: GNU C vectors are more suitable */
     uint32_t ilevel[PXA2XX_GPIO_BANKS];
@@ -24,16 +26,12 @@ struct pxa2xx_gpio_info_s {
     uint32_t rising[PXA2XX_GPIO_BANKS];
     uint32_t falling[PXA2XX_GPIO_BANKS];
     uint32_t status[PXA2XX_GPIO_BANKS];
+    uint32_t gpsr[PXA2XX_GPIO_BANKS];
     uint32_t gafr[PXA2XX_GPIO_BANKS * 2];
 
     uint32_t prev_level[PXA2XX_GPIO_BANKS];
-    struct {
-        gpio_handler_t fn;
-        void *opaque;
-    } handler[PXA2XX_GPIO_BANKS * 32];
-
-    void (*read_notify)(void *opaque);
-    void *opaque;
+    qemu_irq handler[PXA2XX_GPIO_BANKS * 32];
+    qemu_irq read_notify;
 };
 
 static struct {
@@ -85,12 +83,13 @@ static void pxa2xx_gpio_irq_update(struct pxa2xx_gpio_info_s *s)
 }
 
 /* Bitmap of pins used as standby and sleep wake-up sources.  */
-const int pxa2xx_gpio_wake[PXA2XX_GPIO_BANKS] = {
+static const int pxa2xx_gpio_wake[PXA2XX_GPIO_BANKS] = {
     0x8003fe1b, 0x002001fc, 0xec080000, 0x0012007f,
 };
 
-void pxa2xx_gpio_set(struct pxa2xx_gpio_info_s *s, int line, int level)
+static void pxa2xx_gpio_set(void *opaque, int line, int level)
 {
+    struct pxa2xx_gpio_info_s *s = (struct pxa2xx_gpio_info_s *) opaque;
     int bank;
     uint32_t mask;
 
@@ -129,9 +128,7 @@ static void pxa2xx_gpio_handler_update(struct pxa2xx_gpio_info_s *s) {
         for (diff = s->prev_level[i] ^ level; diff; diff ^= 1 << bit) {
             bit = ffs(diff) - 1;
             line = bit + 32 * i;
-            if (s->handler[line].fn)
-                s->handler[line].fn(line, (level >> bit) & 1,
-                                s->handler[line].opaque);
+            qemu_set_irq(s->handler[line], (level >> bit) & 1);
         }
 
         s->prev_level[i] = level;
@@ -152,6 +149,16 @@ static uint32_t pxa2xx_gpio_read(void *opaque, target_phys_addr_t offset)
     case GPDR:		/* GPIO Pin-Direction registers */
         return s->dir[bank];
 
+    case GPSR:		/* GPIO Pin-Output Set registers */
+        printf("%s: Read from a write-only register " REG_FMT "\n",
+                        __FUNCTION__, offset);
+        return s->gpsr[bank];	/* Return last written value.  */
+
+    case GPCR:		/* GPIO Pin-Output Clear registers */
+        printf("%s: Read from a write-only register " REG_FMT "\n",
+                        __FUNCTION__, offset);
+        return 31337;		/* Specified as unpredictable in the docs.  */
+
     case GRER:		/* GPIO Rising-Edge Detect Enable registers */
         return s->rising[bank];
 
@@ -167,8 +174,7 @@ static uint32_t pxa2xx_gpio_read(void *opaque, target_phys_addr_t offset)
     case GPLR:		/* GPIO Pin-Level registers */
         ret = (s->olevel[bank] & s->dir[bank]) |
                 (s->ilevel[bank] & ~s->dir[bank]);
-        if (s->read_notify)
-            s->read_notify(s->opaque);
+        qemu_irq_raise(s->read_notify);
         return ret;
 
     case GEDR:		/* GPIO Edge Detect Status registers */
@@ -201,6 +207,7 @@ static void pxa2xx_gpio_write(void *opaque,
     case GPSR:		/* GPIO Pin-Output Set registers */
         s->olevel[bank] |= value;
         pxa2xx_gpio_handler_update(s);
+        s->gpsr[bank] = value;
         break;
 
     case GPCR:		/* GPIO Pin-Output Clear registers */
@@ -305,6 +312,7 @@ struct pxa2xx_gpio_info_s *pxa2xx_gpio_init(target_phys_addr_t base,
     s->pic = pic;
     s->lines = lines;
     s->cpu_env = env;
+    s->in = qemu_allocate_irqs(pxa2xx_gpio_set, s, lines);
 
     iomemtype = cpu_register_io_memory(0, pxa2xx_gpio_readfn,
                     pxa2xx_gpio_writefn, s);
@@ -316,23 +324,27 @@ struct pxa2xx_gpio_info_s *pxa2xx_gpio_init(target_phys_addr_t base,
     return s;
 }
 
-void pxa2xx_gpio_handler_set(struct pxa2xx_gpio_info_s *s, int line,
-                gpio_handler_t handler, void *opaque) {
+qemu_irq *pxa2xx_gpio_in_get(struct pxa2xx_gpio_info_s *s)
+{
+    return s->in;
+}
+
+void pxa2xx_gpio_out_set(struct pxa2xx_gpio_info_s *s,
+                int line, qemu_irq handler)
+{
     if (line >= s->lines) {
         printf("%s: No GPIO pin %i\n", __FUNCTION__, line);
         return;
     }
 
-    s->handler[line].fn = handler;
-    s->handler[line].opaque = opaque;
+    s->handler[line] = handler;
 }
 
 /*
  * Registers a callback to notify on GPLR reads.  This normally
  * shouldn't be needed but it is used for the hack on Spitz machines.
  */
-void pxa2xx_gpio_read_notifier(struct pxa2xx_gpio_info_s *s,
-                void (*handler)(void *opaque), void *opaque) {
+void pxa2xx_gpio_read_notifier(struct pxa2xx_gpio_info_s *s, qemu_irq handler)
+{
     s->read_notify = handler;
-    s->opaque = opaque;
 }
diff --git a/hw/pxa2xx_keypad.c b/hw/pxa2xx_keypad.c
new file mode 100644
index 000000000..c6c7528b6
--- /dev/null
+++ b/hw/pxa2xx_keypad.c
@@ -0,0 +1,342 @@
+/*
+ * Intel PXA27X Keypad Controller emulation.
+ *
+ * Copyright (c) 2007 MontaVista Software, Inc
+ * Written by Armin Kuster <akuster@kama-aina.net>
+ *              or  <Akuster@mvista.com>
+ *
+ * This code is licensed under the GPLv2.
+ */
+
+#include "hw.h"
+#include "pxa.h"
+#include "console.h"
+
+/*
+ * Keypad
+ */
+#define KPC         0x00    /* Keypad Interface Control register */
+#define KPDK        0x08    /* Keypad Interface Direct Key register */
+#define KPREC       0x10    /* Keypad Interface Rotary Encoder register */
+#define KPMK        0x18    /* Keypad Interface Matrix Key register */
+#define KPAS        0x20    /* Keypad Interface Automatic Scan register */
+#define KPASMKP0    0x28    /* Keypad Interface Automatic Scan Multiple
+                                Key Presser register 0 */
+#define KPASMKP1    0x30    /* Keypad Interface Automatic Scan Multiple
+                                Key Presser register 1 */
+#define KPASMKP2    0x38    /* Keypad Interface Automatic Scan Multiple
+                                Key Presser register 2 */
+#define KPASMKP3    0x40    /* Keypad Interface Automatic Scan Multiple
+                                Key Presser register 3 */
+#define KPKDI       0x48    /* Keypad Interface Key Debounce Interval
+                                register */
+
+/* Keypad defines */
+#define KPC_AS          (0x1 << 30)  /* Automatic Scan bit */
+#define KPC_ASACT       (0x1 << 29)  /* Automatic Scan on Activity */
+#define KPC_MI          (0x1 << 22)  /* Matrix interrupt bit */
+#define KPC_IMKP        (0x1 << 21)  /* Ignore Multiple Key Press */
+#define KPC_MS7         (0x1 << 20)  /* Matrix scan line 7 */
+#define KPC_MS6         (0x1 << 19)  /* Matrix scan line 6 */
+#define KPC_MS5         (0x1 << 18)  /* Matrix scan line 5 */
+#define KPC_MS4         (0x1 << 17)  /* Matrix scan line 4 */
+#define KPC_MS3         (0x1 << 16)  /* Matrix scan line 3 */
+#define KPC_MS2         (0x1 << 15)  /* Matrix scan line 2 */
+#define KPC_MS1         (0x1 << 14)  /* Matrix scan line 1 */
+#define KPC_MS0         (0x1 << 13)  /* Matrix scan line 0 */
+#define KPC_ME          (0x1 << 12)  /* Matrix Keypad Enable */
+#define KPC_MIE         (0x1 << 11)  /* Matrix Interrupt Enable */
+#define KPC_DK_DEB_SEL  (0x1 <<  9)  /* Direct Keypad Debounce Select */
+#define KPC_DI          (0x1 <<  5)  /* Direct key interrupt bit */
+#define KPC_RE_ZERO_DEB (0x1 <<  4)  /* Rotary Encoder Zero Debounce */
+#define KPC_REE1        (0x1 <<  3)  /* Rotary Encoder1 Enable */
+#define KPC_REE0        (0x1 <<  2)  /* Rotary Encoder0 Enable */
+#define KPC_DE          (0x1 <<  1)  /* Direct Keypad Enable */
+#define KPC_DIE         (0x1 <<  0)  /* Direct Keypad interrupt Enable */
+
+#define KPDK_DKP        (0x1 << 31)
+#define KPDK_DK7        (0x1 <<  7)
+#define KPDK_DK6        (0x1 <<  6)
+#define KPDK_DK5        (0x1 <<  5)
+#define KPDK_DK4        (0x1 <<  4)
+#define KPDK_DK3        (0x1 <<  3)
+#define KPDK_DK2        (0x1 <<  2)
+#define KPDK_DK1        (0x1 <<  1)
+#define KPDK_DK0        (0x1 <<  0)
+
+#define KPREC_OF1       (0x1 << 31)
+#define KPREC_UF1       (0x1 << 30)
+#define KPREC_OF0       (0x1 << 15)
+#define KPREC_UF0       (0x1 << 14)
+
+#define KPMK_MKP        (0x1 << 31)
+#define KPAS_SO         (0x1 << 31)
+#define KPASMKPx_SO     (0x1 << 31)
+
+
+#define KPASMKPx_MKC(row, col)  (1 << (row + 16 * (col % 2)))
+
+#define PXAKBD_MAXROW   8
+#define PXAKBD_MAXCOL   8
+
+struct pxa2xx_keypad_s{
+    target_phys_addr_t base;
+    qemu_irq    irq;
+    struct  keymap *map;
+
+    uint32_t    kpc;
+    uint32_t    kpdk;
+    uint32_t    kprec;
+    uint32_t    kpmk;
+    uint32_t    kpas;
+    uint32_t    kpasmkp0;
+    uint32_t    kpasmkp1;
+    uint32_t    kpasmkp2;
+    uint32_t    kpasmkp3;
+    uint32_t    kpkdi;
+};
+
+static void pxa27x_keyboard_event (struct  pxa2xx_keypad_s *kp, int keycode)
+{
+    int row, col,rel;
+
+    if(!(kp->kpc & KPC_ME)) /* skip if not enabled */
+        return;
+
+    if(kp->kpc & KPC_AS || kp->kpc & KPC_ASACT) {
+        if(kp->kpc & KPC_AS)
+            kp->kpc &= ~(KPC_AS);
+
+        rel = (keycode & 0x80) ? 1 : 0; /* key release from qemu */
+        keycode &= ~(0x80); /* strip qemu key release bit */
+        row = kp->map[keycode].row;
+        col = kp->map[keycode].column;
+        if(row == -1 || col == -1)
+            return;
+        switch (col) {
+        case 0:
+        case 1:
+            if(rel)
+                kp->kpasmkp0 = ~(0xffffffff);
+            else
+                kp->kpasmkp0 |= KPASMKPx_MKC(row,col);
+            break;
+        case 2:
+        case 3:
+            if(rel)
+                kp->kpasmkp1 = ~(0xffffffff);
+            else
+                kp->kpasmkp1 |= KPASMKPx_MKC(row,col);
+            break;
+        case 4:
+        case 5:
+            if(rel)
+                kp->kpasmkp2 = ~(0xffffffff);
+            else
+                kp->kpasmkp2 |= KPASMKPx_MKC(row,col);
+            break;
+        case 6:
+        case 7:
+            if(rel)
+                kp->kpasmkp3 = ~(0xffffffff);
+            else
+                kp->kpasmkp3 |= KPASMKPx_MKC(row,col);
+            break;
+        } /* switch */
+        goto out;
+    }
+    return;
+
+out:
+    if(kp->kpc & KPC_MIE) {
+        kp->kpc |= KPC_MI;
+        qemu_irq_raise(kp->irq);
+    }
+    return;
+}
+
+static uint32_t pxa2xx_keypad_read(void *opaque, target_phys_addr_t offset)
+{
+    struct pxa2xx_keypad_s *s = (struct pxa2xx_keypad_s *) opaque;
+    uint32_t tmp;
+    offset -= s->base;
+
+    switch (offset) {
+    case KPC:
+        tmp = s->kpc;
+        if(tmp & KPC_MI)
+            s->kpc &= ~(KPC_MI);
+        if(tmp & KPC_DI)
+            s->kpc &= ~(KPC_DI);
+        qemu_irq_lower(s->irq);
+        return tmp;
+        break;
+    case KPDK:
+        return s->kpdk;
+        break;
+    case KPREC:
+        tmp = s->kprec;
+        if(tmp & KPREC_OF1)
+            s->kprec &= ~(KPREC_OF1);
+        if(tmp & KPREC_UF1)
+            s->kprec &= ~(KPREC_UF1);
+        if(tmp & KPREC_OF0)
+            s->kprec &= ~(KPREC_OF0);
+        if(tmp & KPREC_UF0)
+            s->kprec &= ~(KPREC_UF0);
+        return tmp;
+        break;
+    case KPMK:
+        tmp = s->kpmk;
+        if(tmp & KPMK_MKP)
+            s->kpmk &= ~(KPMK_MKP);
+        return tmp;
+        break;
+    case KPAS:
+        return s->kpas;
+        break;
+    case KPASMKP0:
+        return s->kpasmkp0;
+        break;
+    case KPASMKP1:
+        return s->kpasmkp1;
+        break;
+    case KPASMKP2:
+        return s->kpasmkp2;
+        break;
+    case KPASMKP3:
+        return s->kpasmkp3;
+        break;
+    case KPKDI:
+        return s->kpkdi;
+        break;
+    default:
+        cpu_abort(cpu_single_env, "%s: Bad offset " REG_FMT "\n",
+                        __FUNCTION__, offset);
+    }
+
+    return 0;
+}
+
+static void pxa2xx_keypad_write(void *opaque,
+                target_phys_addr_t offset, uint32_t value)
+{
+    struct pxa2xx_keypad_s *s = (struct pxa2xx_keypad_s *) opaque;
+    offset -= s->base;
+
+    switch (offset) {
+    case KPC:
+        s->kpc = value;
+        break;
+    case KPDK:
+        s->kpdk = value;
+        break;
+    case KPREC:
+        s->kprec = value;
+        break;
+    case KPMK:
+        s->kpmk = value;
+        break;
+    case KPAS:
+        s->kpas = value;
+        break;
+    case KPASMKP0:
+        s->kpasmkp0 = value;
+        break;
+    case KPASMKP1:
+        s->kpasmkp1 = value;
+        break;
+    case KPASMKP2:
+        s->kpasmkp2 = value;
+        break;
+    case KPASMKP3:
+        s->kpasmkp3 = value;
+        break;
+    case KPKDI:
+        s->kpkdi = value;
+        break;
+
+    default:
+        cpu_abort(cpu_single_env, "%s: Bad offset " REG_FMT "\n",
+                        __FUNCTION__, offset);
+    }
+}
+
+static CPUReadMemoryFunc *pxa2xx_keypad_readfn[] = {
+    pxa2xx_keypad_read,
+    pxa2xx_keypad_read,
+    pxa2xx_keypad_read
+};
+
+static CPUWriteMemoryFunc *pxa2xx_keypad_writefn[] = {
+    pxa2xx_keypad_write,
+    pxa2xx_keypad_write,
+    pxa2xx_keypad_write
+};
+
+static void pxa2xx_keypad_save(QEMUFile *f, void *opaque)
+{
+    struct pxa2xx_keypad_s *s = (struct pxa2xx_keypad_s *) opaque;
+
+    qemu_put_be32s(f, &s->kpc);
+    qemu_put_be32s(f, &s->kpdk);
+    qemu_put_be32s(f, &s->kprec);
+    qemu_put_be32s(f, &s->kpmk);
+    qemu_put_be32s(f, &s->kpas);
+    qemu_put_be32s(f, &s->kpasmkp0);
+    qemu_put_be32s(f, &s->kpasmkp1);
+    qemu_put_be32s(f, &s->kpasmkp2);
+    qemu_put_be32s(f, &s->kpasmkp3);
+    qemu_put_be32s(f, &s->kpkdi);
+
+}
+
+static int pxa2xx_keypad_load(QEMUFile *f, void *opaque, int version_id)
+{
+    struct pxa2xx_keypad_s *s = (struct pxa2xx_keypad_s *) opaque;
+
+    qemu_get_be32s(f, &s->kpc);
+    qemu_get_be32s(f, &s->kpdk);
+    qemu_get_be32s(f, &s->kprec);
+    qemu_get_be32s(f, &s->kpmk);
+    qemu_get_be32s(f, &s->kpas);
+    qemu_get_be32s(f, &s->kpasmkp0);
+    qemu_get_be32s(f, &s->kpasmkp1);
+    qemu_get_be32s(f, &s->kpasmkp2);
+    qemu_get_be32s(f, &s->kpasmkp3);
+    qemu_get_be32s(f, &s->kpkdi);
+
+    return 0;
+}
+
+struct pxa2xx_keypad_s *pxa27x_keypad_init(target_phys_addr_t base,
+        qemu_irq irq)
+{
+    int iomemtype;
+    struct pxa2xx_keypad_s *s;
+
+    s = (struct pxa2xx_keypad_s *) qemu_mallocz(sizeof(struct pxa2xx_keypad_s));
+    s->base = base;
+    s->irq = irq;
+
+    iomemtype = cpu_register_io_memory(0, pxa2xx_keypad_readfn,
+                    pxa2xx_keypad_writefn, s);
+    cpu_register_physical_memory(base, 0x00100000, iomemtype);
+
+    register_savevm("pxa2xx_keypad", 0, 0,
+                    pxa2xx_keypad_save, pxa2xx_keypad_load, s);
+
+    return s;
+}
+
+void pxa27x_register_keypad(struct pxa2xx_keypad_s *kp, struct keymap *map,
+        int size)
+{
+    if(!map || size < 0x80) {
+        fprintf(stderr, "%s - No PXA keypad map defined\n", __FUNCTION__);
+        exit(-1);
+    }
+
+    kp->map = map;
+    qemu_add_kbd_event_handler((QEMUPutKBDEvent *) pxa27x_keyboard_event, kp);
+}
diff --git a/hw/pxa2xx_lcd.c b/hw/pxa2xx_lcd.c
index 2c1096389..585543530 100644
--- a/hw/pxa2xx_lcd.c
+++ b/hw/pxa2xx_lcd.c
@@ -7,8 +7,12 @@
  * This code is licensed under the GPLv2.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "console.h"
+#include "pxa.h"
 #include "pixel_ops.h"
+/* FIXME: For graphic_rotate. Should probably be done in common code.  */
+#include "sysemu.h"
 
 typedef void (*drawfn)(uint32_t *, uint8_t *, const uint8_t *, int, int);
 
@@ -62,8 +66,7 @@ struct pxa2xx_lcdc_s {
         uint32_t command;
     } dma_ch[7];
 
-    void (*vsync_cb)(void *opaque);
-    void *opaque;
+    qemu_irq vsync_cb;
     int orientation;
 };
 
@@ -865,8 +868,7 @@ static void pxa2xx_update_display(void *opaque)
         dpy_update(s->ds, 0, miny, s->xres, maxy);
     pxa2xx_lcdc_int_update(s);
 
-    if (s->vsync_cb)
-        s->vsync_cb(s->opaque);
+    qemu_irq_raise(s->vsync_cb);
 }
 
 static void pxa2xx_invalidate_display(void *opaque)
@@ -880,7 +882,7 @@ static void pxa2xx_screen_dump(void *opaque, const char *filename)
     /* TODO */
 }
 
-void pxa2xx_lcdc_orientation(void *opaque, int angle)
+static void pxa2xx_lcdc_orientation(void *opaque, int angle)
 {
     struct pxa2xx_lcdc_s *s = (struct pxa2xx_lcdc_s *) opaque;
 
@@ -1042,8 +1044,7 @@ struct pxa2xx_lcdc_s *pxa2xx_lcdc_init(target_phys_addr_t base, qemu_irq irq,
     return s;
 }
 
-void pxa2xx_lcd_vsync_cb(struct pxa2xx_lcdc_s *s,
-                void (*cb)(void *opaque), void *opaque) {
-    s->vsync_cb = cb;
-    s->opaque = opaque;
+void pxa2xx_lcd_vsync_notifier(struct pxa2xx_lcdc_s *s, qemu_irq handler)
+{
+    s->vsync_cb = handler;
 }
diff --git a/hw/pxa2xx_mmci.c b/hw/pxa2xx_mmci.c
index ed548dbad..60e7ba4ef 100644
--- a/hw/pxa2xx_mmci.c
+++ b/hw/pxa2xx_mmci.c
@@ -7,7 +7,8 @@
  * This code is licensed under the GPLv2.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pxa.h"
 #include "sd.h"
 
 struct pxa2xx_mmci_s {
@@ -522,7 +523,7 @@ static int pxa2xx_mmci_load(QEMUFile *f, void *opaque, int version_id)
 }
 
 struct pxa2xx_mmci_s *pxa2xx_mmci_init(target_phys_addr_t base,
-                qemu_irq irq, void *dma)
+                BlockDriverState *bd, qemu_irq irq, void *dma)
 {
     int iomemtype;
     struct pxa2xx_mmci_s *s;
@@ -537,7 +538,7 @@ struct pxa2xx_mmci_s *pxa2xx_mmci_init(target_phys_addr_t base,
     cpu_register_physical_memory(base, 0x00100000, iomemtype);
 
     /* Instantiate the actual storage */
-    s->card = sd_init(sd_bdrv);
+    s->card = sd_init(bd, 0);
 
     register_savevm("pxa2xx_mmci", 0, 0,
                     pxa2xx_mmci_save, pxa2xx_mmci_load, s);
@@ -545,9 +546,8 @@ struct pxa2xx_mmci_s *pxa2xx_mmci_init(target_phys_addr_t base,
     return s;
 }
 
-void pxa2xx_mmci_handlers(struct pxa2xx_mmci_s *s, void *opaque,
-                void (*readonly_cb)(void *, int),
-                void (*coverswitch_cb)(void *, int))
+void pxa2xx_mmci_handlers(struct pxa2xx_mmci_s *s, qemu_irq readonly,
+                qemu_irq coverswitch)
 {
-    sd_set_cb(s->card, opaque, readonly_cb, coverswitch_cb);
+    sd_set_cb(s->card, readonly, coverswitch);
 }
diff --git a/hw/pxa2xx_pcmcia.c b/hw/pxa2xx_pcmcia.c
index f1399f467..1e96ee44b 100644
--- a/hw/pxa2xx_pcmcia.c
+++ b/hw/pxa2xx_pcmcia.c
@@ -7,7 +7,9 @@
  * This code is licensed under the GPLv2.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pcmcia.h"
+#include "pxa.h"
 
 struct pxa2xx_pcmcia_s {
     struct pcmcia_socket_s slot;
diff --git a/hw/pxa2xx_pic.c b/hw/pxa2xx_pic.c
index c9012e8db..a3611b88b 100644
--- a/hw/pxa2xx_pic.c
+++ b/hw/pxa2xx_pic.c
@@ -8,7 +8,8 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pxa.h"
 
 #define ICIP	0x00	/* Interrupt Controller IRQ Pending register */
 #define ICMR	0x04	/* Interrupt Controller Mask register */
diff --git a/hw/pxa2xx_timer.c b/hw/pxa2xx_timer.c
index 982420502..90777f822 100644
--- a/hw/pxa2xx_timer.c
+++ b/hw/pxa2xx_timer.c
@@ -7,7 +7,10 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
+#include "pxa.h"
 
 #define OSMR0	0x00
 #define OSMR1	0x04
diff --git a/hw/r2d.c b/hw/r2d.c
index 33d03cbbf..b6cc31c54 100644
--- a/hw/r2d.c
+++ b/hw/r2d.c
@@ -22,20 +22,30 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "sh.h"
+#include "sysemu.h"
+#include "boards.h"
 
 #define SDRAM_BASE 0x0c000000 /* Physical location of SDRAM: Area 3 */
 #define SDRAM_SIZE 0x04000000
 
-void r2d_init(int ram_size, int vga_ram_size, int boot_device,
-	      DisplayState * ds, const char **fd_filename, int snapshot,
+static void r2d_init(int ram_size, int vga_ram_size,
+              const char *boot_device, DisplayState * ds,
 	      const char *kernel_filename, const char *kernel_cmdline,
 	      const char *initrd_filename, const char *cpu_model)
 {
     CPUState *env;
     struct SH7750State *s;
 
-    env = cpu_init();
+    if (!cpu_model)
+        cpu_model = "any";
+
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
 
     /* Allocate memory space */
     cpu_register_physical_memory(SDRAM_BASE, SDRAM_SIZE, 0);
diff --git a/hw/realview.c b/hw/realview.c
index 375f78acd..29579d87b 100644
--- a/hw/realview.c
+++ b/hw/realview.c
@@ -7,13 +7,19 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
-#include "arm_pic.h"
+#include "hw.h"
+#include "arm-misc.h"
+#include "primecell.h"
+#include "devices.h"
+#include "pci.h"
+#include "net.h"
+#include "sysemu.h"
+#include "boards.h"
 
 /* Board init.  */
 
-static void realview_init(int ram_size, int vga_ram_size, int boot_device,
-                     DisplayState *ds, const char **fd_filename, int snapshot,
+static void realview_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
                      const char *kernel_filename, const char *kernel_cmdline,
                      const char *initrd_filename, const char *cpu_model)
 {
@@ -24,28 +30,57 @@ static void realview_init(int ram_size, int vga_ram_size, int boot_device,
     NICInfo *nd;
     int n;
     int done_smc = 0;
+    qemu_irq cpu_irq[4];
+    int ncpu;
+    int index;
 
-    env = cpu_init();
     if (!cpu_model)
         cpu_model = "arm926";
-    cpu_arm_set_model(env, cpu_model);
+    /* FIXME: obey smp_cpus.  */
+    if (strcmp(cpu_model, "arm11mpcore") == 0) {
+        ncpu = 4;
+    } else {
+        ncpu = 1;
+    }
+
+    for (n = 0; n < ncpu; n++) {
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find CPU definition\n");
+            exit(1);
+        }
+        pic = arm_pic_init_cpu(env);
+        cpu_irq[n] = pic[ARM_PIC_CPU_IRQ];
+        if (n > 0) {
+            /* Set entry point for secondary CPUs.  This assumes we're using
+               the init code from arm_boot.c.  Real hardware resets all CPUs
+               the same.  */
+            env->regs[15] = 0x80000000;
+        }
+    }
+
     /* ??? RAM shoud repeat to fill physical memory space.  */
     /* SDRAM at address zero.  */
     cpu_register_physical_memory(0, ram_size, IO_MEM_RAM);
 
     arm_sysctl_init(0x10000000, 0xc1400400);
-    pic = arm_pic_init_cpu(env);
-    /* ??? The documentation says GIC1 is nFIQ and either GIC2 or GIC3
-       is nIRQ (there are inconsistencies).  However Linux 2.6.17 expects
-       GIC1 to be nIRQ and ignores all the others, so do that for now.  */
-    pic = arm_gic_init(0x10040000, pic[ARM_PIC_CPU_IRQ]);
+
+    if (ncpu == 1) {
+        /* ??? The documentation says GIC1 is nFIQ and either GIC2 or GIC3
+           is nIRQ (there are inconsistencies).  However Linux 2.6.17 expects
+           GIC1 to be nIRQ and ignores all the others, so do that for now.  */
+        pic = realview_gic_init(0x10040000, cpu_irq[0]);
+    } else {
+        pic = mpcore_irq_init(cpu_irq);
+    }
+
     pl050_init(0x10006000, pic[20], 0);
     pl050_init(0x10007000, pic[21], 1);
 
-    pl011_init(0x10009000, pic[12], serial_hds[0]);
-    pl011_init(0x1000a000, pic[13], serial_hds[1]);
-    pl011_init(0x1000b000, pic[14], serial_hds[2]);
-    pl011_init(0x1000c000, pic[15], serial_hds[3]);
+    pl011_init(0x10009000, pic[12], serial_hds[0], PL011_ARM);
+    pl011_init(0x1000a000, pic[13], serial_hds[1], PL011_ARM);
+    pl011_init(0x1000b000, pic[14], serial_hds[2], PL011_ARM);
+    pl011_init(0x1000c000, pic[15], serial_hds[3], PL011_ARM);
 
     /* DMA controller is optional, apparently.  */
     pl080_init(0x10030000, pic[24], 2);
@@ -55,7 +90,12 @@ static void realview_init(int ram_size, int vga_ram_size, int boot_device,
 
     pl110_init(ds, 0x10020000, pic[23], 1);
 
-    pl181_init(0x10005000, sd_bdrv, pic[17], pic[18]);
+    index = drive_get_index(IF_SD, 0, 0);
+    if (index == -1) {
+        fprintf(stderr, "qemu: missing SecureDigital card\n");
+        exit(1);
+    }
+    pl181_init(0x10005000, drives_table[index].bdrv, pic[17], pic[18]);
 
     pl031_init(0x10017000, pic[10]);
 
@@ -63,11 +103,16 @@ static void realview_init(int ram_size, int vga_ram_size, int boot_device,
     if (usb_enabled) {
         usb_ohci_init_pci(pci_bus, 3, -1);
     }
+    if (drive_get_max_bus(IF_SCSI) > 0) {
+        fprintf(stderr, "qemu: too many SCSI bus\n");
+        exit(1);
+    }
     scsi_hba = lsi_scsi_init(pci_bus, -1);
-    for (n = 0; n < MAX_DISKS; n++) {
-        if (bs_table[n]) {
-            lsi_scsi_attach(scsi_hba, bs_table[n], n);
-        }
+    for (n = 0; n < LSI_MAX_DEVS; n++) {
+        index = drive_get_index(IF_SCSI, 0, n);
+        if (index == -1)
+            continue;
+        lsi_scsi_attach(scsi_hba, drives_table[index].bdrv, n);
     }
     for(n = 0; n < nb_nics; n++) {
         nd = &nd_table[n];
@@ -109,10 +154,10 @@ static void realview_init(int ram_size, int vga_ram_size, int boot_device,
     /*  0x10019000 PCI controller config.  */
     /*  0x10020000 CLCD.  */
     /* 0x10030000 DMA Controller.  */
-    /* 0x10040000 GIC1 (FIQ1).  */
-    /* 0x10050000 GIC2 (IRQ1).  */
-    /*  0x10060000 GIC3 (FIQ2).  */
-    /*  0x10070000 GIC4 (IRQ2).  */
+    /* 0x10040000 GIC1.  */
+    /* 0x10050000 GIC2.  */
+    /* 0x10060000 GIC3.  */
+    /* 0x10070000 GIC4.  */
     /*  0x10080000 SMC.  */
     /*  0x40000000 NOR flash.  */
     /*  0x44000000 DoC flash.  */
@@ -132,8 +177,14 @@ static void realview_init(int ram_size, int vga_ram_size, int boot_device,
     /* 0x68000000 PCI mem 1.  */
     /* 0x6c000000 PCI mem 2.  */
 
-    arm_load_kernel(env, ram_size, kernel_filename, kernel_cmdline,
+    arm_load_kernel(first_cpu, ram_size, kernel_filename, kernel_cmdline,
                     initrd_filename, 0x33b, 0x0);
+
+    /* ??? Hack to map an additional page of ram for the secondary CPU
+       startup code.  I guess this works on real hardware because the
+       BootROM happens to be in ROM/flash or in memory that isn't clobbered
+       until after Linux boots the secondary CPUs.  */
+    cpu_register_physical_memory(0x80000000, 0x1000, IO_MEM_RAM + ram_size);
 }
 
 QEMUMachine realview_machine = {
diff --git a/hw/realview_gic.c b/hw/realview_gic.c
new file mode 100644
index 000000000..b4ef2ccf3
--- /dev/null
+++ b/hw/realview_gic.c
@@ -0,0 +1,64 @@
+/*
+ * ARM RealView Emulation Baseboard Interrupt Controller
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "hw.h"
+#include "primecell.h"
+
+#define GIC_NIRQ 96
+#define NCPU 1
+
+/* Only a single "CPU" interface is present.  */
+static inline int
+gic_get_current_cpu(void)
+{
+  return 0;
+}
+
+#include "arm_gic.c"
+
+static uint32_t realview_gic_cpu_read(void *opaque, target_phys_addr_t offset)
+{
+    gic_state *s = (gic_state *)opaque;
+    offset -= s->base;
+    return gic_cpu_read(s, gic_get_current_cpu(), offset);
+}
+
+static void realview_gic_cpu_write(void *opaque, target_phys_addr_t offset,
+                          uint32_t value)
+{
+    gic_state *s = (gic_state *)opaque;
+    offset -= s->base;
+    gic_cpu_write(s, gic_get_current_cpu(), offset, value);
+}
+
+static CPUReadMemoryFunc *realview_gic_cpu_readfn[] = {
+   realview_gic_cpu_read,
+   realview_gic_cpu_read,
+   realview_gic_cpu_read
+};
+
+static CPUWriteMemoryFunc *realview_gic_cpu_writefn[] = {
+   realview_gic_cpu_write,
+   realview_gic_cpu_write,
+   realview_gic_cpu_write
+};
+
+qemu_irq *realview_gic_init(uint32_t base, qemu_irq parent_irq)
+{
+    gic_state *s;
+    int iomemtype;
+
+    s = gic_init(base, &parent_irq);
+    if (!s)
+        return NULL;
+    iomemtype = cpu_register_io_memory(0, realview_gic_cpu_readfn,
+                                       realview_gic_cpu_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    return s->in;
+}
diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index 56d25afd0..9430a8ca0 100644
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -43,7 +43,10 @@
  *                                  Added rx/tx buffer reset when enabling rx/tx operation
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pci.h"
+#include "qemu-timer.h"
+#include "net.h"
 
 /* debug RTL8139 card */
 //#define DEBUG_RTL8139 1
@@ -494,7 +497,7 @@ typedef struct RTL8139State {
 
 } RTL8139State;
 
-void prom9346_decode_command(EEprom9346 *eeprom, uint8_t command)
+static void prom9346_decode_command(EEprom9346 *eeprom, uint8_t command)
 {
     DEBUG_PRINT(("RTL8139: eeprom command 0x%02x\n", command));
 
@@ -540,7 +543,7 @@ void prom9346_decode_command(EEprom9346 *eeprom, uint8_t command)
     }
 }
 
-void prom9346_shift_clock(EEprom9346 *eeprom)
+static void prom9346_shift_clock(EEprom9346 *eeprom)
 {
     int bit = eeprom->eedi?1:0;
 
@@ -632,7 +635,7 @@ void prom9346_shift_clock(EEprom9346 *eeprom)
     }
 }
 
-int prom9346_get_wire(RTL8139State *s)
+static int prom9346_get_wire(RTL8139State *s)
 {
     EEprom9346 *eeprom = &s->eeprom;
     if (!eeprom->eecs)
@@ -641,7 +644,8 @@ int prom9346_get_wire(RTL8139State *s)
     return eeprom->eedo;
 }
 
-void prom9346_set_wire(RTL8139State *s, int eecs, int eesk, int eedi)
+/* FIXME: This should be merged into/replaced by eeprom93xx.c.  */
+static void prom9346_set_wire(RTL8139State *s, int eecs, int eesk, int eedi)
 {
     EEprom9346 *eeprom = &s->eeprom;
     uint8_t old_eecs = eeprom->eecs;
@@ -1445,7 +1449,7 @@ static uint32_t rtl8139_IntrMitigate_read(RTL8139State *s)
     return ret;
 }
 
-int rtl8139_config_writeable(RTL8139State *s)
+static int rtl8139_config_writeable(RTL8139State *s)
 {
     if (s->Cfg9346 & Cfg9346_Unlock)
     {
@@ -1464,7 +1468,7 @@ static void rtl8139_BasicModeCtrl_write(RTL8139State *s, uint32_t val)
     DEBUG_PRINT(("RTL8139: BasicModeCtrl register write(w) val=0x%04x\n", val));
 
     /* mask unwriteable bits */
-    uint32 mask = 0x4cff;
+    uint32_t mask = 0x4cff;
 
     if (1 || !rtl8139_config_writeable(s))
     {
@@ -3115,7 +3119,7 @@ static uint32_t rtl8139_mmio_readl(void *opaque, target_phys_addr_t addr)
 static void rtl8139_save(QEMUFile* f,void* opaque)
 {
     RTL8139State* s=(RTL8139State*)opaque;
-    int i;
+    unsigned int i;
 
     pci_device_save(s->pci_dev, f);
 
@@ -3168,7 +3172,7 @@ static void rtl8139_save(QEMUFile* f,void* opaque)
     i = 0;
     qemu_put_be32s(f, &i); /* unused.  */
     qemu_put_buffer(f, s->macaddr, 6);
-    qemu_put_be32s(f, &s->rtl8139_mmio_io_addr);
+    qemu_put_be32(f, s->rtl8139_mmio_io_addr);
 
     qemu_put_be32s(f, &s->currTxDesc);
     qemu_put_be32s(f, &s->currCPlusRxDesc);
@@ -3180,7 +3184,7 @@ static void rtl8139_save(QEMUFile* f,void* opaque)
     {
         qemu_put_be16s(f, &s->eeprom.contents[i]);
     }
-    qemu_put_be32s(f, &s->eeprom.mode);
+    qemu_put_be32(f, s->eeprom.mode);
     qemu_put_be32s(f, &s->eeprom.tick);
     qemu_put_8s(f, &s->eeprom.address);
     qemu_put_be16s(f, &s->eeprom.input);
@@ -3193,7 +3197,7 @@ static void rtl8139_save(QEMUFile* f,void* opaque)
 
     qemu_put_be32s(f, &s->TCTR);
     qemu_put_be32s(f, &s->TimerInt);
-    qemu_put_be64s(f, &s->TCTR_base);
+    qemu_put_be64(f, s->TCTR_base);
 
     RTL8139TallyCounters_save(f, &s->tally_counters);
 }
@@ -3201,7 +3205,8 @@ static void rtl8139_save(QEMUFile* f,void* opaque)
 static int rtl8139_load(QEMUFile* f,void* opaque,int version_id)
 {
     RTL8139State* s=(RTL8139State*)opaque;
-    int i, ret;
+    unsigned int i;
+    int ret;
 
     /* just 2 versions for now */
     if (version_id > 3)
@@ -3262,7 +3267,7 @@ static int rtl8139_load(QEMUFile* f,void* opaque,int version_id)
 
     qemu_get_be32s(f, &i); /* unused.  */
     qemu_get_buffer(f, s->macaddr, 6);
-    qemu_get_be32s(f, &s->rtl8139_mmio_io_addr);
+    s->rtl8139_mmio_io_addr=qemu_get_be32(f);
 
     qemu_get_be32s(f, &s->currTxDesc);
     qemu_get_be32s(f, &s->currCPlusRxDesc);
@@ -3274,7 +3279,7 @@ static int rtl8139_load(QEMUFile* f,void* opaque,int version_id)
     {
         qemu_get_be16s(f, &s->eeprom.contents[i]);
     }
-    qemu_get_be32s(f, &s->eeprom.mode);
+    s->eeprom.mode=qemu_get_be32(f);
     qemu_get_be32s(f, &s->eeprom.tick);
     qemu_get_8s(f, &s->eeprom.address);
     qemu_get_be16s(f, &s->eeprom.input);
@@ -3290,7 +3295,7 @@ static int rtl8139_load(QEMUFile* f,void* opaque,int version_id)
     {
         qemu_get_be32s(f, &s->TCTR);
         qemu_get_be32s(f, &s->TimerInt);
-        qemu_get_be64s(f, &s->TCTR_base);
+        s->TCTR_base=qemu_get_be64(f);
 
         RTL8139TallyCounters_load(f, &s->tally_counters);
     }
diff --git a/hw/sb16.c b/hw/sb16.c
index 1610b3288..effbfbcf8 100644
--- a/hw/sb16.c
+++ b/hw/sb16.c
@@ -21,7 +21,11 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "audiodev.h"
+#include "audio/audio.h"
+#include "isa.h"
+#include "qemu-timer.h"
 
 #define LENOFA(a) ((int) (sizeof(a)/sizeof(a[0])))
 
@@ -1253,29 +1257,29 @@ static void SB_save (QEMUFile *f, void *opaque)
 {
     SB16State *s = opaque;
 
-    qemu_put_be32s (f, &s->irq);
-    qemu_put_be32s (f, &s->dma);
-    qemu_put_be32s (f, &s->hdma);
-    qemu_put_be32s (f, &s->port);
-    qemu_put_be32s (f, &s->ver);
-    qemu_put_be32s (f, &s->in_index);
-    qemu_put_be32s (f, &s->out_data_len);
-    qemu_put_be32s (f, &s->fmt_stereo);
-    qemu_put_be32s (f, &s->fmt_signed);
-    qemu_put_be32s (f, &s->fmt_bits);
+    qemu_put_be32 (f, s->irq);
+    qemu_put_be32 (f, s->dma);
+    qemu_put_be32 (f, s->hdma);
+    qemu_put_be32 (f, s->port);
+    qemu_put_be32 (f, s->ver);
+    qemu_put_be32 (f, s->in_index);
+    qemu_put_be32 (f, s->out_data_len);
+    qemu_put_be32 (f, s->fmt_stereo);
+    qemu_put_be32 (f, s->fmt_signed);
+    qemu_put_be32 (f, s->fmt_bits);
     qemu_put_be32s (f, &s->fmt);
-    qemu_put_be32s (f, &s->dma_auto);
-    qemu_put_be32s (f, &s->block_size);
-    qemu_put_be32s (f, &s->fifo);
-    qemu_put_be32s (f, &s->freq);
-    qemu_put_be32s (f, &s->time_const);
-    qemu_put_be32s (f, &s->speaker);
-    qemu_put_be32s (f, &s->needed_bytes);
-    qemu_put_be32s (f, &s->cmd);
-    qemu_put_be32s (f, &s->use_hdma);
-    qemu_put_be32s (f, &s->highspeed);
-    qemu_put_be32s (f, &s->can_write);
-    qemu_put_be32s (f, &s->v2x6);
+    qemu_put_be32 (f, s->dma_auto);
+    qemu_put_be32 (f, s->block_size);
+    qemu_put_be32 (f, s->fifo);
+    qemu_put_be32 (f, s->freq);
+    qemu_put_be32 (f, s->time_const);
+    qemu_put_be32 (f, s->speaker);
+    qemu_put_be32 (f, s->needed_bytes);
+    qemu_put_be32 (f, s->cmd);
+    qemu_put_be32 (f, s->use_hdma);
+    qemu_put_be32 (f, s->highspeed);
+    qemu_put_be32 (f, s->can_write);
+    qemu_put_be32 (f, s->v2x6);
 
     qemu_put_8s (f, &s->csp_param);
     qemu_put_8s (f, &s->csp_value);
@@ -1284,21 +1288,21 @@ static void SB_save (QEMUFile *f, void *opaque)
     qemu_put_buffer (f, s->csp_regs, 256);
     qemu_put_8s (f, &s->csp_index);
     qemu_put_buffer (f, s->csp_reg83, 4);
-    qemu_put_be32s (f, &s->csp_reg83r);
-    qemu_put_be32s (f, &s->csp_reg83w);
+    qemu_put_be32 (f, s->csp_reg83r);
+    qemu_put_be32 (f, s->csp_reg83w);
 
     qemu_put_buffer (f, s->in2_data, sizeof (s->in2_data));
     qemu_put_buffer (f, s->out_data, sizeof (s->out_data));
     qemu_put_8s (f, &s->test_reg);
     qemu_put_8s (f, &s->last_read_byte);
 
-    qemu_put_be32s (f, &s->nzero);
-    qemu_put_be32s (f, &s->left_till_irq);
-    qemu_put_be32s (f, &s->dma_running);
-    qemu_put_be32s (f, &s->bytes_per_second);
-    qemu_put_be32s (f, &s->align);
+    qemu_put_be32 (f, s->nzero);
+    qemu_put_be32 (f, s->left_till_irq);
+    qemu_put_be32 (f, s->dma_running);
+    qemu_put_be32 (f, s->bytes_per_second);
+    qemu_put_be32 (f, s->align);
 
-    qemu_put_be32s (f, &s->mixer_nreg);
+    qemu_put_be32 (f, s->mixer_nreg);
     qemu_put_buffer (f, s->mixer_regs, 256);
 }
 
@@ -1310,29 +1314,29 @@ static int SB_load (QEMUFile *f, void *opaque, int version_id)
         return -EINVAL;
     }
 
-    qemu_get_be32s (f, &s->irq);
-    qemu_get_be32s (f, &s->dma);
-    qemu_get_be32s (f, &s->hdma);
-    qemu_get_be32s (f, &s->port);
-    qemu_get_be32s (f, &s->ver);
-    qemu_get_be32s (f, &s->in_index);
-    qemu_get_be32s (f, &s->out_data_len);
-    qemu_get_be32s (f, &s->fmt_stereo);
-    qemu_get_be32s (f, &s->fmt_signed);
-    qemu_get_be32s (f, &s->fmt_bits);
+    s->irq=qemu_get_be32 (f);
+    s->dma=qemu_get_be32 (f);
+    s->hdma=qemu_get_be32 (f);
+    s->port=qemu_get_be32 (f);
+    s->ver=qemu_get_be32 (f);
+    s->in_index=qemu_get_be32 (f);
+    s->out_data_len=qemu_get_be32 (f);
+    s->fmt_stereo=qemu_get_be32 (f);
+    s->fmt_signed=qemu_get_be32 (f);
+    s->fmt_bits=qemu_get_be32 (f);
     qemu_get_be32s (f, &s->fmt);
-    qemu_get_be32s (f, &s->dma_auto);
-    qemu_get_be32s (f, &s->block_size);
-    qemu_get_be32s (f, &s->fifo);
-    qemu_get_be32s (f, &s->freq);
-    qemu_get_be32s (f, &s->time_const);
-    qemu_get_be32s (f, &s->speaker);
-    qemu_get_be32s (f, &s->needed_bytes);
-    qemu_get_be32s (f, &s->cmd);
-    qemu_get_be32s (f, &s->use_hdma);
-    qemu_get_be32s (f, &s->highspeed);
-    qemu_get_be32s (f, &s->can_write);
-    qemu_get_be32s (f, &s->v2x6);
+    s->dma_auto=qemu_get_be32 (f);
+    s->block_size=qemu_get_be32 (f);
+    s->fifo=qemu_get_be32 (f);
+    s->freq=qemu_get_be32 (f);
+    s->time_const=qemu_get_be32 (f);
+    s->speaker=qemu_get_be32 (f);
+    s->needed_bytes=qemu_get_be32 (f);
+    s->cmd=qemu_get_be32 (f);
+    s->use_hdma=qemu_get_be32 (f);
+    s->highspeed=qemu_get_be32 (f);
+    s->can_write=qemu_get_be32 (f);
+    s->v2x6=qemu_get_be32 (f);
 
     qemu_get_8s (f, &s->csp_param);
     qemu_get_8s (f, &s->csp_value);
@@ -1341,21 +1345,21 @@ static int SB_load (QEMUFile *f, void *opaque, int version_id)
     qemu_get_buffer (f, s->csp_regs, 256);
     qemu_get_8s (f, &s->csp_index);
     qemu_get_buffer (f, s->csp_reg83, 4);
-    qemu_get_be32s (f, &s->csp_reg83r);
-    qemu_get_be32s (f, &s->csp_reg83w);
+    s->csp_reg83r=qemu_get_be32 (f);
+    s->csp_reg83w=qemu_get_be32 (f);
 
     qemu_get_buffer (f, s->in2_data, sizeof (s->in2_data));
     qemu_get_buffer (f, s->out_data, sizeof (s->out_data));
     qemu_get_8s (f, &s->test_reg);
     qemu_get_8s (f, &s->last_read_byte);
 
-    qemu_get_be32s (f, &s->nzero);
-    qemu_get_be32s (f, &s->left_till_irq);
-    qemu_get_be32s (f, &s->dma_running);
-    qemu_get_be32s (f, &s->bytes_per_second);
-    qemu_get_be32s (f, &s->align);
+    s->nzero=qemu_get_be32 (f);
+    s->left_till_irq=qemu_get_be32 (f);
+    s->dma_running=qemu_get_be32 (f);
+    s->bytes_per_second=qemu_get_be32 (f);
+    s->align=qemu_get_be32 (f);
 
-    qemu_get_be32s (f, &s->mixer_nreg);
+    s->mixer_nreg=qemu_get_be32 (f);
     qemu_get_buffer (f, s->mixer_regs, 256);
 
     if (s->voice) {
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index 384c098a0..d281b8cbb 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -25,7 +25,9 @@ do { printf("scsi-disk: " fmt , ##args); } while (0)
 #define BADF(fmt, args...) \
 do { fprintf(stderr, "scsi-disk: " fmt , ##args); } while (0)
 
-#include "vl.h"
+#include "qemu-common.h"
+#include "block.h"
+#include "scsi-disk.h"
 
 #define SENSE_NO_SENSE        0
 #define SENSE_NOT_READY       2
@@ -35,7 +37,7 @@ do { fprintf(stderr, "scsi-disk: " fmt , ##args); } while (0)
 #define SCSI_DMA_BUF_SIZE    65536
 
 typedef struct SCSIRequest {
-    SCSIDevice *dev;
+    SCSIDeviceState *dev;
     uint32_t tag;
     /* ??? We should probably keep track of whether the data trasfer is
        a read or a write.  Currently we rely on the host getting it right.  */
@@ -49,7 +51,7 @@ typedef struct SCSIRequest {
     struct SCSIRequest *next;
 } SCSIRequest;
 
-struct SCSIDevice
+struct SCSIDeviceState
 {
     BlockDriverState *bdrv;
     SCSIRequest *requests;
@@ -67,7 +69,7 @@ struct SCSIDevice
 /* Global pool of SCSIRequest structures.  */
 static SCSIRequest *free_requests = NULL;
 
-static SCSIRequest *scsi_new_request(SCSIDevice *s, uint32_t tag)
+static SCSIRequest *scsi_new_request(SCSIDeviceState *s, uint32_t tag)
 {
     SCSIRequest *r;
 
@@ -91,7 +93,7 @@ static SCSIRequest *scsi_new_request(SCSIDevice *s, uint32_t tag)
 static void scsi_remove_request(SCSIRequest *r)
 {
     SCSIRequest *last;
-    SCSIDevice *s = r->dev;
+    SCSIDeviceState *s = r->dev;
 
     if (s->requests == r) {
         s->requests = r->next;
@@ -109,7 +111,7 @@ static void scsi_remove_request(SCSIRequest *r)
     free_requests = r;
 }
 
-static SCSIRequest *scsi_find_request(SCSIDevice *s, uint32_t tag)
+static SCSIRequest *scsi_find_request(SCSIDeviceState *s, uint32_t tag)
 {
     SCSIRequest *r;
 
@@ -123,7 +125,7 @@ static SCSIRequest *scsi_find_request(SCSIDevice *s, uint32_t tag)
 /* Helper function for command completion.  */
 static void scsi_command_complete(SCSIRequest *r, int sense)
 {
-    SCSIDevice *s = r->dev;
+    SCSIDeviceState *s = r->dev;
     uint32_t tag;
     DPRINTF("Command complete tag=0x%x sense=%d\n", r->tag, sense);
     s->sense = sense;
@@ -133,8 +135,9 @@ static void scsi_command_complete(SCSIRequest *r, int sense)
 }
 
 /* Cancel a pending data transfer.  */
-void scsi_cancel_io(SCSIDevice *s, uint32_t tag)
+static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)
 {
+    SCSIDeviceState *s = d->state;
     SCSIRequest *r;
     DPRINTF("Cancel tag=0x%x\n", tag);
     r = scsi_find_request(s, tag);
@@ -149,7 +152,7 @@ void scsi_cancel_io(SCSIDevice *s, uint32_t tag)
 static void scsi_read_complete(void * opaque, int ret)
 {
     SCSIRequest *r = (SCSIRequest *)opaque;
-    SCSIDevice *s = r->dev;
+    SCSIDeviceState *s = r->dev;
 
     if (ret) {
         DPRINTF("IO error\n");
@@ -162,8 +165,9 @@ static void scsi_read_complete(void * opaque, int ret)
 }
 
 /* Read more data from scsi device into buffer.  */
-void scsi_read_data(SCSIDevice *s, uint32_t tag)
+static void scsi_read_data(SCSIDevice *d, uint32_t tag)
 {
+    SCSIDeviceState *s = d->state;
     SCSIRequest *r;
     uint32_t n;
 
@@ -202,7 +206,7 @@ void scsi_read_data(SCSIDevice *s, uint32_t tag)
 static void scsi_write_complete(void * opaque, int ret)
 {
     SCSIRequest *r = (SCSIRequest *)opaque;
-    SCSIDevice *s = r->dev;
+    SCSIDeviceState *s = r->dev;
     uint32_t len;
 
     if (ret) {
@@ -226,8 +230,9 @@ static void scsi_write_complete(void * opaque, int ret)
 
 /* Write data to a scsi device.  Returns nonzero on failure.
    The transfer may complete asynchronously.  */
-int scsi_write_data(SCSIDevice *s, uint32_t tag)
+static int scsi_write_data(SCSIDevice *d, uint32_t tag)
 {
+    SCSIDeviceState *s = d->state;
     SCSIRequest *r;
     uint32_t n;
 
@@ -257,8 +262,9 @@ int scsi_write_data(SCSIDevice *s, uint32_t tag)
 }
 
 /* Return a pointer to the data buffer.  */
-uint8_t *scsi_get_buf(SCSIDevice *s, uint32_t tag)
+static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag)
 {
+    SCSIDeviceState *s = d->state;
     SCSIRequest *r;
 
     r = scsi_find_request(s, tag);
@@ -274,8 +280,10 @@ uint8_t *scsi_get_buf(SCSIDevice *s, uint32_t tag)
    (eg. disk reads), negative for transfers to the device (eg. disk writes),
    and zero if the command does not transfer any data.  */
 
-int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
+static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
+                                 uint8_t *buf, int lun)
 {
+    SCSIDeviceState *s = d->state;
     int64_t nb_sectors;
     uint32_t lba;
     uint32_t len;
@@ -289,7 +297,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
     r = scsi_find_request(s, tag);
     if (r) {
         BADF("Tag 0x%x already in use\n", tag);
-        scsi_cancel_io(s, tag);
+        scsi_cancel_io(d, tag);
     }
     /* ??? Tags are not unique for different luns.  We only implement a
        single lun, so this should not matter.  */
@@ -574,19 +582,19 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
     }
 }
 
-void scsi_disk_destroy(SCSIDevice *s)
+static void scsi_destroy(SCSIDevice *d)
 {
-    qemu_free(s);
+    qemu_free(d->state);
+    qemu_free(d);
 }
 
-SCSIDevice *scsi_disk_init(BlockDriverState *bdrv,
-                           int tcq,
-                           scsi_completionfn completion,
-                           void *opaque)
+SCSIDevice *scsi_disk_init(BlockDriverState *bdrv, int tcq,
+                           scsi_completionfn completion, void *opaque)
 {
-    SCSIDevice *s;
+    SCSIDevice *d;
+    SCSIDeviceState *s;
 
-    s = (SCSIDevice *)qemu_mallocz(sizeof(SCSIDevice));
+    s = (SCSIDeviceState *)qemu_mallocz(sizeof(SCSIDeviceState));
     s->bdrv = bdrv;
     s->tcq = tcq;
     s->completion = completion;
@@ -597,6 +605,14 @@ SCSIDevice *scsi_disk_init(BlockDriverState *bdrv,
         s->cluster_size = 1;
     }
 
-    return s;
-}
+    d = (SCSIDevice *)qemu_mallocz(sizeof(SCSIDevice));
+    d->state = s;
+    d->destroy = scsi_destroy;
+    d->send_command = scsi_send_command;
+    d->read_data = scsi_read_data;
+    d->write_data = scsi_write_data;
+    d->cancel_io = scsi_cancel_io;
+    d->get_buf = scsi_get_buf;
 
+    return d;
+}
diff --git a/hw/scsi-disk.h b/hw/scsi-disk.h
new file mode 100644
index 000000000..ffe894b76
--- /dev/null
+++ b/hw/scsi-disk.h
@@ -0,0 +1,34 @@
+#ifndef SCSI_DISK_H
+#define SCSI_DISK_H
+
+/* scsi-disk.c */
+enum scsi_reason {
+    SCSI_REASON_DONE, /* Command complete.  */
+    SCSI_REASON_DATA  /* Transfer complete, more data required.  */
+};
+
+typedef struct SCSIDeviceState SCSIDeviceState;
+typedef struct SCSIDevice SCSIDevice;
+typedef void (*scsi_completionfn)(void *opaque, int reason, uint32_t tag,
+                                  uint32_t arg);
+
+struct SCSIDevice
+{
+    SCSIDeviceState *state;
+    void (*destroy)(SCSIDevice *s);
+    int32_t (*send_command)(SCSIDevice *s, uint32_t tag, uint8_t *buf,
+                            int lun);
+    void (*read_data)(SCSIDevice *s, uint32_t tag);
+    int (*write_data)(SCSIDevice *s, uint32_t tag);
+    void (*cancel_io)(SCSIDevice *s, uint32_t tag);
+    uint8_t *(*get_buf)(SCSIDevice *s, uint32_t tag);
+};
+
+SCSIDevice *scsi_disk_init(BlockDriverState *bdrv, int tcq,
+                           scsi_completionfn completion, void *opaque);
+
+/* cdrom.c */
+int cdrom_read_toc(int nb_sectors, uint8_t *buf, int msf, int start_track);
+int cdrom_read_toc_raw(int nb_sectors, uint8_t *buf, int msf, int session_num);
+
+#endif
diff --git a/hw/sd.c b/hw/sd.c
index d59c4bf56..130072fd7 100644
--- a/hw/sd.c
+++ b/hw/sd.c
@@ -29,6 +29,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include "hw.h"
+#include "block.h"
 #include "sd.h"
 
 //#define DEBUG_SD 1
@@ -85,14 +87,14 @@ struct SDState {
     int pwd_len;
     int function_group[6];
 
+    int spi;
     int current_cmd;
     int blk_written;
     uint32_t data_start;
     uint32_t data_offset;
     uint8_t data[512];
-    void (*readonly_cb)(void *, int);
-    void (*inserted_cb)(void *, int);
-    void *opaque;
+    qemu_irq readonly_cb;
+    qemu_irq inserted_cb;
     BlockDriverState *bdrv;
 };
 
@@ -187,7 +189,7 @@ static uint16_t sd_crc16(void *message, size_t width)
 
 static void sd_set_ocr(SDState *sd)
 {
-    sd->ocr = 0x80fffff0;
+    sd->ocr = 0x80ffff80;
 }
 
 static void sd_set_scr(SDState *sd)
@@ -307,8 +309,8 @@ static int sd_req_crc_validate(struct sd_request_s *req)
     return sd_crc7(buffer, 5) != req->crc;	/* TODO */
 }
 
-void sd_response_r1_make(SDState *sd,
-                         uint8_t *response, uint32_t last_status)
+static void sd_response_r1_make(SDState *sd,
+                                uint8_t *response, uint32_t last_status)
 {
     uint32_t mask = CARD_STATUS_B ^ ILLEGAL_COMMAND;
     uint32_t status;
@@ -322,7 +324,7 @@ void sd_response_r1_make(SDState *sd,
     response[3] = (status >> 0) & 0xff;
 }
 
-void sd_response_r3_make(SDState *sd, uint8_t *response)
+static void sd_response_r3_make(SDState *sd, uint8_t *response)
 {
     response[0] = (sd->ocr >> 24) & 0xff;
     response[1] = (sd->ocr >> 16) & 0xff;
@@ -330,7 +332,7 @@ void sd_response_r3_make(SDState *sd, uint8_t *response)
     response[3] = (sd->ocr >> 0) & 0xff;
 }
 
-void sd_response_r6_make(SDState *sd, uint8_t *response)
+static void sd_response_r6_make(SDState *sd, uint8_t *response)
 {
     uint16_t arg;
     uint16_t status;
@@ -372,9 +374,10 @@ static void sd_reset(SDState *sd, BlockDriverState *bdrv)
 
     sd->bdrv = bdrv;
 
+    if (sd->wp_groups)
+        qemu_free(sd->wp_groups);
     sd->wp_switch = bdrv_is_read_only(bdrv);
     sd->wp_groups = (int *) qemu_mallocz(sizeof(int) * sect);
-    memset(sd->wp_groups, 0, sizeof(int) * sect);
     memset(sd->function_group, 0, sizeof(int) * 6);
     sd->erase_start = 0;
     sd->erase_end = 0;
@@ -386,36 +389,34 @@ static void sd_reset(SDState *sd, BlockDriverState *bdrv)
 static void sd_cardchange(void *opaque)
 {
     SDState *sd = opaque;
-    if (sd->inserted_cb)
-        sd->inserted_cb(sd->opaque, bdrv_is_inserted(sd->bdrv));
+    qemu_set_irq(sd->inserted_cb, bdrv_is_inserted(sd->bdrv));
     if (bdrv_is_inserted(sd->bdrv)) {
         sd_reset(sd, sd->bdrv);
-        if (sd->readonly_cb)
-            sd->readonly_cb(sd->opaque, sd->wp_switch);
+        qemu_set_irq(sd->readonly_cb, sd->wp_switch);
     }
 }
 
-SDState *sd_init(BlockDriverState *bs)
+/* We do not model the chip select pin, so allow the board to select
+   whether card should be in SSI or MMC/SD mode.  It is also up to the
+   board to ensure that ssi transfers only occur when the chip select
+   is asserted.  */
+SDState *sd_init(BlockDriverState *bs, int is_spi)
 {
     SDState *sd;
 
     sd = (SDState *) qemu_mallocz(sizeof(SDState));
+    sd->spi = is_spi;
     sd_reset(sd, bs);
+    bdrv_set_change_cb(sd->bdrv, sd_cardchange, sd);
     return sd;
 }
 
-void sd_set_cb(SDState *sd, void *opaque,
-                void (*readonly_cb)(void *, int),
-                void (*inserted_cb)(void *, int))
+void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
 {
-    sd->opaque = opaque;
-    sd->readonly_cb = readonly_cb;
-    sd->inserted_cb = inserted_cb;
-    if (sd->readonly_cb)
-        sd->readonly_cb(sd->opaque, bdrv_is_read_only(sd->bdrv));
-    if (sd->inserted_cb)
-        sd->inserted_cb(sd->opaque, bdrv_is_inserted(sd->bdrv));
-    bdrv_set_change_cb(sd->bdrv, sd_cardchange, sd);
+    sd->readonly_cb = readonly;
+    sd->inserted_cb = insert;
+    qemu_set_irq(readonly, bdrv_is_read_only(sd->bdrv));
+    qemu_set_irq(insert, bdrv_is_inserted(sd->bdrv));
 }
 
 static void sd_erase(SDState *sd)
@@ -572,16 +573,25 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
     case 0:	/* CMD0:   GO_IDLE_STATE */
         switch (sd->state) {
         case sd_inactive_state:
-            return sd_r0;
+            return sd->spi ? sd_r1 : sd_r0;
 
         default:
             sd->state = sd_idle_state;
             sd_reset(sd, sd->bdrv);
-            return sd_r0;
+            return sd->spi ? sd_r1 : sd_r0;
         }
         break;
 
+    case 1:	/* CMD1:   SEND_OP_CMD */
+        if (!sd->spi)
+            goto bad_cmd;
+
+        sd->state = sd_transfer_state;
+        return sd_r1;
+
     case 2:	/* CMD2:   ALL_SEND_CID */
+        if (sd->spi)
+            goto bad_cmd;
         switch (sd->state) {
         case sd_ready_state:
             sd->state = sd_identification_state;
@@ -593,6 +603,8 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     case 3:	/* CMD3:   SEND_RELATIVE_ADDR */
+        if (sd->spi)
+            goto bad_cmd;
         switch (sd->state) {
         case sd_identification_state:
         case sd_standby_state:
@@ -606,6 +618,8 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     case 4:	/* CMD4:   SEND_DSR */
+        if (sd->spi)
+            goto bad_cmd;
         switch (sd->state) {
         case sd_standby_state:
             break;
@@ -616,6 +630,8 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     case 6:	/* CMD6:   SWITCH_FUNCTION */
+        if (sd->spi)
+            goto bad_cmd;
         switch (sd->mode) {
         case sd_data_transfer_mode:
             sd_function_switch(sd, req.arg);
@@ -630,6 +646,8 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     case 7:	/* CMD7:   SELECT/DESELECT_CARD */
+        if (sd->spi)
+            goto bad_cmd;
         switch (sd->state) {
         case sd_standby_state:
             if (sd->rca != rca)
@@ -673,6 +691,15 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
 
             return sd_r2_s;
 
+        case sd_transfer_state:
+            if (!sd->spi)
+                break;
+            sd->state = sd_sendingdata_state;
+            memcpy(sd->data, sd->csd, 16);
+            sd->data_start = req.arg;
+            sd->data_offset = 0;
+            return sd_r1;
+
         default:
             break;
         }
@@ -686,12 +713,23 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
 
             return sd_r2_i;
 
+        case sd_transfer_state:
+            if (!sd->spi)
+                break;
+            sd->state = sd_sendingdata_state;
+            memcpy(sd->data, sd->cid, 16);
+            sd->data_start = req.arg;
+            sd->data_offset = 0;
+            return sd_r1;
+
         default:
             break;
         }
         break;
 
     case 11:	/* CMD11:  READ_DAT_UNTIL_STOP */
+        if (sd->spi)
+            goto bad_cmd;
         switch (sd->state) {
         case sd_transfer_state:
             sd->state = sd_sendingdata_state;
@@ -738,6 +776,8 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     case 15:	/* CMD15:  GO_INACTIVE_STATE */
+        if (sd->spi)
+            goto bad_cmd;
         switch (sd->mode) {
         case sd_data_transfer_mode:
             if (sd->rca != rca)
@@ -801,8 +841,13 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
 
     /* Block write commands (Class 4) */
     case 24:	/* CMD24:  WRITE_SINGLE_BLOCK */
+        if (sd->spi)
+            goto unimplemented_cmd;
         switch (sd->state) {
         case sd_transfer_state:
+            /* Writing in SPI mode not implemented.  */
+            if (sd->spi)
+                break;
             sd->state = sd_receivingdata_state;
             sd->data_start = req.arg;
             sd->data_offset = 0;
@@ -822,8 +867,13 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     case 25:	/* CMD25:  WRITE_MULTIPLE_BLOCK */
+        if (sd->spi)
+            goto unimplemented_cmd;
         switch (sd->state) {
         case sd_transfer_state:
+            /* Writing in SPI mode not implemented.  */
+            if (sd->spi)
+                break;
             sd->state = sd_receivingdata_state;
             sd->data_start = req.arg;
             sd->data_offset = 0;
@@ -843,6 +893,8 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     case 26:	/* CMD26:  PROGRAM_CID */
+        if (sd->spi)
+            goto bad_cmd;
         switch (sd->state) {
         case sd_transfer_state:
             sd->state = sd_receivingdata_state;
@@ -856,6 +908,8 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     case 27:	/* CMD27:  PROGRAM_CSD */
+        if (sd->spi)
+            goto unimplemented_cmd;
         switch (sd->state) {
         case sd_transfer_state:
             sd->state = sd_receivingdata_state;
@@ -967,6 +1021,8 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
 
     /* Lock card commands (Class 7) */
     case 42:	/* CMD42:  LOCK_UNLOCK */
+        if (sd->spi)
+            goto unimplemented_cmd;
         switch (sd->state) {
         case sd_transfer_state:
             sd->state = sd_receivingdata_state;
@@ -1005,10 +1061,17 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     default:
+    bad_cmd:
         sd->card_status |= ILLEGAL_COMMAND;
 
         printf("SD: Unknown CMD%i\n", req.cmd);
         return sd_r0;
+
+    unimplemented_cmd:
+        /* Commands that are recognised but not yet implemented in SPI mode.  */
+        sd->card_status |= ILLEGAL_COMMAND;
+        printf ("SD: CMD%i not implemented in SPI mode\n", req.cmd);
+        return sd_r0;
     }
 
     sd->card_status |= ILLEGAL_COMMAND;
@@ -1074,6 +1137,11 @@ static sd_rsp_type_t sd_app_command(SDState *sd,
         break;
 
     case 41:	/* ACMD41: SD_APP_OP_COND */
+        if (sd->spi) {
+            /* SEND_OP_CMD */
+            sd->state = sd_transfer_state;
+            return sd_r1;
+        }
         switch (sd->state) {
         case sd_idle_state:
             /* We accept any voltage.  10000 V is nothing.  */
@@ -1419,6 +1487,14 @@ uint8_t sd_read_data(SDState *sd)
             sd->state = sd_transfer_state;
         break;
 
+    case 9:	/* CMD9:   SEND_CSD */
+    case 10:	/* CMD10:  SEND_CID */
+        ret = sd->data[sd->data_offset ++];
+
+        if (sd->data_offset >= 16)
+            sd->state = sd_transfer_state;
+        break;
+
     case 11:	/* CMD11:  READ_DAT_UNTIL_STOP */
         if (sd->data_offset == 0)
             BLK_READ_BLOCK(sd->data_start, sd->blk_len);
diff --git a/hw/sd.h b/hw/sd.h
index ab20064fe..85f110f3c 100644
--- a/hw/sd.h
+++ b/hw/sd.h
@@ -29,8 +29,6 @@
 #ifndef __hw_sd_h
 #define __hw_sd_h		1
 
-#include <vl.h>
-
 #define OUT_OF_RANGE		(1 << 31)
 #define ADDRESS_ERROR		(1 << 30)
 #define BLOCK_LEN_ERROR		(1 << 29)
@@ -69,14 +67,16 @@ struct sd_request_s {
 
 typedef struct SDState SDState;
 
-SDState *sd_init(BlockDriverState *bs);
+SDState *sd_init(BlockDriverState *bs, int is_spi);
 int sd_do_command(SDState *sd, struct sd_request_s *req,
                   uint8_t *response);
 void sd_write_data(SDState *sd, uint8_t value);
 uint8_t sd_read_data(SDState *sd);
-void sd_set_cb(SDState *sd, void *opaque,
-               void (*readonly_cb)(void *, int),
-               void (*inserted_cb)(void *, int));
+void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert);
 int sd_data_ready(SDState *sd);
 
+/* ssi-sd.c */
+int ssi_sd_xfer(void *opaque, int val);
+void *ssi_sd_init(BlockDriverState *bs);
+
 #endif	/* __hw_sd_h */
diff --git a/hw/serial.c b/hw/serial.c
index 36a7cc4e3..b1bd0ff36 100644
--- a/hw/serial.c
+++ b/hw/serial.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "qemu-char.h"
+#include "isa.h"
+#include "pc.h"
 
 //#define DEBUG_SERIAL
 
@@ -220,6 +223,7 @@ static uint32_t serial_ioport_read(void *opaque, uint32_t addr)
             ret = s->rbr;
             s->lsr &= ~(UART_LSR_DR | UART_LSR_BI);
             serial_update_irq(s);
+            qemu_chr_accept_input(s->chr);
         }
         break;
     case 1:
diff --git a/hw/sh.h b/hw/sh.h
new file mode 100644
index 000000000..7df31640e
--- /dev/null
+++ b/hw/sh.h
@@ -0,0 +1,43 @@
+#ifndef QEMU_SH_H
+#define QEMU_SH_H
+/* Definitions for SH board emulation.  */
+
+#include "sh_intc.h"
+
+/* sh7750.c */
+struct SH7750State;
+
+struct SH7750State *sh7750_init(CPUState * cpu);
+
+typedef struct {
+    /* The callback will be triggered if any of the designated lines change */
+    uint16_t portamask_trigger;
+    uint16_t portbmask_trigger;
+    /* Return 0 if no action was taken */
+    int (*port_change_cb) (uint16_t porta, uint16_t portb,
+			   uint16_t * periph_pdtra,
+			   uint16_t * periph_portdira,
+			   uint16_t * periph_pdtrb,
+			   uint16_t * periph_portdirb);
+} sh7750_io_device;
+
+int sh7750_register_io_device(struct SH7750State *s,
+			      sh7750_io_device * device);
+/* sh_timer.c */
+#define TMU012_FEAT_TOCR   (1 << 0)
+#define TMU012_FEAT_3CHAN  (1 << 1)
+#define TMU012_FEAT_EXTCLK (1 << 2)
+void tmu012_init(target_phys_addr_t base, int feat, uint32_t freq,
+		 struct intc_source *ch0_irq, struct intc_source *ch1_irq,
+		 struct intc_source *ch2_irq0, struct intc_source *ch2_irq1);
+
+
+/* sh_serial.c */
+#define SH_SERIAL_FEAT_SCIF (1 << 0)
+void sh_serial_init (target_phys_addr_t base, int feat,
+		     uint32_t freq, CharDriverState *chr);
+
+/* tc58128.c */
+int tc58128_init(struct SH7750State *s, char *zone1, char *zone2);
+
+#endif
diff --git a/hw/sh7750.c b/hw/sh7750.c
index bd3d31e36..45a5c7f09 100644
--- a/hw/sh7750.c
+++ b/hw/sh7750.c
@@ -1,6 +1,7 @@
 /*
  * SH7750 device
  *
+ * Copyright (c) 2007 Magnus Damm
  * Copyright (c) 2005 Samuel Tardieu
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -23,9 +24,12 @@
  */
 #include <stdio.h>
 #include <assert.h>
-#include "vl.h"
+#include "hw.h"
+#include "sh.h"
+#include "sysemu.h"
 #include "sh7750_regs.h"
 #include "sh7750_regnames.h"
+#include "sh_intc.h"
 
 #define NB_DEVICES 4
 
@@ -53,15 +57,10 @@ typedef struct SH7750State {
     sh7750_io_device *devices[NB_DEVICES];	/* External peripherals */
 
     uint16_t icr;
-    uint16_t ipra;
-    uint16_t iprb;
-    uint16_t iprc;
-    uint16_t iprd;
-    uint32_t intpri00;
-    uint32_t intmsk00;
     /* Cache */
     uint32_t ccr;
 
+    struct intc_desc intc;
 } SH7750State;
 
 
@@ -219,14 +218,6 @@ static uint32_t sh7750_mem_readw(void *opaque, target_phys_addr_t addr)
 	return portb_lines(s);
     case 0x1fd00000:
         return s->icr;
-    case 0x1fd00004:
-        return s->ipra;
-    case 0x1fd00008:
-        return s->iprb;
-    case 0x1fd0000c:
-        return s->iprc;
-    case 0x1fd00010:
-        return s->iprd;
     default:
 	error_access("word read", addr);
 	assert(0);
@@ -262,14 +253,6 @@ static uint32_t sh7750_mem_readl(void *opaque, target_phys_addr_t addr)
 	return 0x00110000;	/* Minimum caches */
     case 0x1f000044:		/* Processor version PRR */
 	return 0x00000100;	/* SH7750R */
-    case 0x1e080000:
-        return s->intpri00;
-    case 0x1e080020:
-        return 0;
-    case 0x1e080040:
-        return s->intmsk00;
-    case 0x1e080060:
-        return 0;
     default:
 	error_access("long read", addr);
 	assert(0);
@@ -331,18 +314,6 @@ static void sh7750_mem_writew(void *opaque, target_phys_addr_t addr,
     case 0x1fd00000:
         s->icr = mem_value;
 	return;
-    case 0x1fd00004:
-        s->ipra = mem_value;
-	return;
-    case 0x1fd00008:
-        s->iprb = mem_value;
-	return;
-    case 0x1fd0000c:
-        s->iprc = mem_value;
-	return;
-    case 0x1fd00010:
-        s->iprd = mem_value;
-	return;
     default:
 	error_access("word write", addr);
 	assert(0);
@@ -407,16 +378,6 @@ static void sh7750_mem_writel(void *opaque, target_phys_addr_t addr,
     case SH7750_CCR_A7:
 	s->ccr = mem_value;
 	return;
-    case 0x1e080000:
-        s->intpri00 = mem_value;
-	return;
-    case 0x1e080020:
-        return;
-    case 0x1e080040:
-        s->intmsk00 = mem_value;
-	return;
-    case 0x1e080060:
-        return;
     default:
 	error_access("long write", addr);
 	assert(0);
@@ -435,10 +396,144 @@ static CPUWriteMemoryFunc *sh7750_mem_write[] = {
     sh7750_mem_writel
 };
 
+/* sh775x interrupt controller tables for sh_intc.c
+ * stolen from linux/arch/sh/kernel/cpu/sh4/setup-sh7750.c
+ */
+
+enum {
+	UNUSED = 0,
+
+	/* interrupt sources */
+	IRL0, IRL1, IRL2, IRL3, /* only IRLM mode supported */
+	HUDI, GPIOI,
+	DMAC_DMTE0, DMAC_DMTE1, DMAC_DMTE2, DMAC_DMTE3,
+	DMAC_DMTE4, DMAC_DMTE5, DMAC_DMTE6, DMAC_DMTE7,
+	DMAC_DMAE,
+	PCIC0_PCISERR, PCIC1_PCIERR, PCIC1_PCIPWDWN, PCIC1_PCIPWON,
+	PCIC1_PCIDMA0, PCIC1_PCIDMA1, PCIC1_PCIDMA2, PCIC1_PCIDMA3,
+	TMU3, TMU4, TMU0, TMU1, TMU2_TUNI, TMU2_TICPI,
+	RTC_ATI, RTC_PRI, RTC_CUI,
+	SCI1_ERI, SCI1_RXI, SCI1_TXI, SCI1_TEI,
+	SCIF_ERI, SCIF_RXI, SCIF_BRI, SCIF_TXI,
+	WDT,
+	REF_RCMI, REF_ROVI,
+
+	/* interrupt groups */
+	DMAC, PCIC1, TMU2, RTC, SCI1, SCIF, REF,
+
+	NR_SOURCES,
+};
+
+static struct intc_vect vectors[] = {
+	INTC_VECT(HUDI, 0x600), INTC_VECT(GPIOI, 0x620),
+	INTC_VECT(TMU0, 0x400), INTC_VECT(TMU1, 0x420),
+	INTC_VECT(TMU2_TUNI, 0x440), INTC_VECT(TMU2_TICPI, 0x460),
+	INTC_VECT(RTC_ATI, 0x480), INTC_VECT(RTC_PRI, 0x4a0),
+	INTC_VECT(RTC_CUI, 0x4c0),
+	INTC_VECT(SCI1_ERI, 0x4e0), INTC_VECT(SCI1_RXI, 0x500),
+	INTC_VECT(SCI1_TXI, 0x520), INTC_VECT(SCI1_TEI, 0x540),
+	INTC_VECT(SCIF_ERI, 0x700), INTC_VECT(SCIF_RXI, 0x720),
+	INTC_VECT(SCIF_BRI, 0x740), INTC_VECT(SCIF_TXI, 0x760),
+	INTC_VECT(WDT, 0x560),
+	INTC_VECT(REF_RCMI, 0x580), INTC_VECT(REF_ROVI, 0x5a0),
+};
+
+static struct intc_group groups[] = {
+	INTC_GROUP(TMU2, TMU2_TUNI, TMU2_TICPI),
+	INTC_GROUP(RTC, RTC_ATI, RTC_PRI, RTC_CUI),
+	INTC_GROUP(SCI1, SCI1_ERI, SCI1_RXI, SCI1_TXI, SCI1_TEI),
+	INTC_GROUP(SCIF, SCIF_ERI, SCIF_RXI, SCIF_BRI, SCIF_TXI),
+	INTC_GROUP(REF, REF_RCMI, REF_ROVI),
+};
+
+static struct intc_prio_reg prio_registers[] = {
+	{ 0xffd00004, 0, 16, 4, /* IPRA */ { TMU0, TMU1, TMU2, RTC } },
+	{ 0xffd00008, 0, 16, 4, /* IPRB */ { WDT, REF, SCI1, 0 } },
+	{ 0xffd0000c, 0, 16, 4, /* IPRC */ { GPIOI, DMAC, SCIF, HUDI } },
+	{ 0xffd00010, 0, 16, 4, /* IPRD */ { IRL0, IRL1, IRL2, IRL3 } },
+	{ 0xfe080000, 0, 32, 4, /* INTPRI00 */ { 0, 0, 0, 0,
+						 TMU4, TMU3,
+						 PCIC1, PCIC0_PCISERR } },
+};
+
+/* SH7750, SH7750S, SH7751 and SH7091 all have 4-channel DMA controllers */
+
+static struct intc_vect vectors_dma4[] = {
+	INTC_VECT(DMAC_DMTE0, 0x640), INTC_VECT(DMAC_DMTE1, 0x660),
+	INTC_VECT(DMAC_DMTE2, 0x680), INTC_VECT(DMAC_DMTE3, 0x6a0),
+	INTC_VECT(DMAC_DMAE, 0x6c0),
+};
+
+static struct intc_group groups_dma4[] = {
+	INTC_GROUP(DMAC, DMAC_DMTE0, DMAC_DMTE1, DMAC_DMTE2,
+		   DMAC_DMTE3, DMAC_DMAE),
+};
+
+/* SH7750R and SH7751R both have 8-channel DMA controllers */
+
+static struct intc_vect vectors_dma8[] = {
+	INTC_VECT(DMAC_DMTE0, 0x640), INTC_VECT(DMAC_DMTE1, 0x660),
+	INTC_VECT(DMAC_DMTE2, 0x680), INTC_VECT(DMAC_DMTE3, 0x6a0),
+	INTC_VECT(DMAC_DMTE4, 0x780), INTC_VECT(DMAC_DMTE5, 0x7a0),
+	INTC_VECT(DMAC_DMTE6, 0x7c0), INTC_VECT(DMAC_DMTE7, 0x7e0),
+	INTC_VECT(DMAC_DMAE, 0x6c0),
+};
+
+static struct intc_group groups_dma8[] = {
+	INTC_GROUP(DMAC, DMAC_DMTE0, DMAC_DMTE1, DMAC_DMTE2,
+		   DMAC_DMTE3, DMAC_DMTE4, DMAC_DMTE5,
+		   DMAC_DMTE6, DMAC_DMTE7, DMAC_DMAE),
+};
+
+/* SH7750R, SH7751 and SH7751R all have two extra timer channels */
+
+static struct intc_vect vectors_tmu34[] = {
+	INTC_VECT(TMU3, 0xb00), INTC_VECT(TMU4, 0xb80),
+};
+
+static struct intc_mask_reg mask_registers[] = {
+	{ 0xfe080040, 0xfe080060, 32, /* INTMSK00 / INTMSKCLR00 */
+	  { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	    0, 0, 0, 0, 0, 0, TMU4, TMU3,
+	    PCIC1_PCIERR, PCIC1_PCIPWDWN, PCIC1_PCIPWON,
+	    PCIC1_PCIDMA0, PCIC1_PCIDMA1, PCIC1_PCIDMA2,
+	    PCIC1_PCIDMA3, PCIC0_PCISERR } },
+};
+
+/* SH7750S, SH7750R, SH7751 and SH7751R all have IRLM priority registers */
+
+static struct intc_vect vectors_irlm[] = {
+	INTC_VECT(IRL0, 0x240), INTC_VECT(IRL1, 0x2a0),
+	INTC_VECT(IRL2, 0x300), INTC_VECT(IRL3, 0x360),
+};
+
+/* SH7751 and SH7751R both have PCI */
+
+static struct intc_vect vectors_pci[] = {
+	INTC_VECT(PCIC0_PCISERR, 0xa00), INTC_VECT(PCIC1_PCIERR, 0xae0),
+	INTC_VECT(PCIC1_PCIPWDWN, 0xac0), INTC_VECT(PCIC1_PCIPWON, 0xaa0),
+	INTC_VECT(PCIC1_PCIDMA0, 0xa80), INTC_VECT(PCIC1_PCIDMA1, 0xa60),
+	INTC_VECT(PCIC1_PCIDMA2, 0xa40), INTC_VECT(PCIC1_PCIDMA3, 0xa20),
+};
+
+static struct intc_group groups_pci[] = {
+	INTC_GROUP(PCIC1, PCIC1_PCIERR, PCIC1_PCIPWDWN, PCIC1_PCIPWON,
+		   PCIC1_PCIDMA0, PCIC1_PCIDMA1, PCIC1_PCIDMA2, PCIC1_PCIDMA3),
+};
+
+#define SH_CPU_SH7750  (1 << 0)
+#define SH_CPU_SH7750S (1 << 1)
+#define SH_CPU_SH7750R (1 << 2)
+#define SH_CPU_SH7751  (1 << 3)
+#define SH_CPU_SH7751R (1 << 4)
+#define SH_CPU_SH7750_ALL (SH_CPU_SH7750 | SH_CPU_SH7750S | SH_CPU_SH7750R)
+#define SH_CPU_SH7751_ALL (SH_CPU_SH7751 | SH_CPU_SH7751R)
+
 SH7750State *sh7750_init(CPUSH4State * cpu)
 {
     SH7750State *s;
     int sh7750_io_memory;
+    int cpu_model = SH_CPU_SH7751R; /* for now */
 
     s = qemu_mallocz(sizeof(SH7750State));
     s->cpu = cpu;
@@ -448,13 +543,61 @@ SH7750State *sh7750_init(CPUSH4State * cpu)
 					      sh7750_mem_write, s);
     cpu_register_physical_memory(0x1c000000, 0x04000000, sh7750_io_memory);
 
+    sh_intc_init(&s->intc, NR_SOURCES,
+		 _INTC_ARRAY(mask_registers),
+		 _INTC_ARRAY(prio_registers));
+
+    sh_intc_register_sources(&s->intc, 
+			     _INTC_ARRAY(vectors),
+			     _INTC_ARRAY(groups));
+
+    cpu->intc_handle = &s->intc;
+
     sh_serial_init(0x1fe00000, 0, s->periph_freq, serial_hds[0]);
     sh_serial_init(0x1fe80000, SH_SERIAL_FEAT_SCIF,
 		   s->periph_freq, serial_hds[1]);
 
     tmu012_init(0x1fd80000,
 		TMU012_FEAT_TOCR | TMU012_FEAT_3CHAN | TMU012_FEAT_EXTCLK,
-		s->periph_freq);
-    tmu012_init(0x1e100000, 0, s->periph_freq);
+		s->periph_freq,
+		sh_intc_source(&s->intc, TMU0),
+		sh_intc_source(&s->intc, TMU1),
+		sh_intc_source(&s->intc, TMU2_TUNI),
+		sh_intc_source(&s->intc, TMU2_TICPI));
+
+    if (cpu_model & (SH_CPU_SH7750 | SH_CPU_SH7750S | SH_CPU_SH7751)) {
+        sh_intc_register_sources(&s->intc, 
+				 _INTC_ARRAY(vectors_dma4),
+				 _INTC_ARRAY(groups_dma4));
+    }
+
+    if (cpu_model & (SH_CPU_SH7750R | SH_CPU_SH7751R)) {
+        sh_intc_register_sources(&s->intc, 
+				 _INTC_ARRAY(vectors_dma8),
+				 _INTC_ARRAY(groups_dma8));
+    }
+
+    if (cpu_model & (SH_CPU_SH7750R | SH_CPU_SH7751 | SH_CPU_SH7751R)) {
+        sh_intc_register_sources(&s->intc, 
+				 _INTC_ARRAY(vectors_tmu34),
+				 NULL, 0);
+        tmu012_init(0x1e100000, 0, s->periph_freq,
+		    sh_intc_source(&s->intc, TMU3),
+		    sh_intc_source(&s->intc, TMU4),
+		    NULL, NULL);
+    }
+
+    if (cpu_model & (SH_CPU_SH7751_ALL)) {
+        sh_intc_register_sources(&s->intc, 
+				 _INTC_ARRAY(vectors_pci),
+				 _INTC_ARRAY(groups_pci));
+    }
+
+    if (cpu_model & (SH_CPU_SH7750S | SH_CPU_SH7750R | SH_CPU_SH7751_ALL)) {
+        sh_intc_register_sources(&s->intc, 
+				 _INTC_ARRAY(vectors_irlm),
+				 NULL, 0);
+    }
+
     return s;
 }
diff --git a/hw/sh7750_regnames.c b/hw/sh7750_regnames.c
index 84d5c1a2e..51283c9db 100644
--- a/hw/sh7750_regnames.c
+++ b/hw/sh7750_regnames.c
@@ -1,4 +1,5 @@
-#include "vl.h"
+#include "hw.h"
+#include "sh.h"
 #include "sh7750_regs.h"
 
 #define REGNAME(r) {r, #r},
@@ -76,9 +77,6 @@ static regname_t regnames[] = {
 	REGNAME(SH7750_PDTRB_A7)
 	REGNAME(SH7750_GPIOIC_A7)
 	REGNAME(SH7750_ICR_A7)
-	REGNAME(SH7750_IPRA_A7)
-	REGNAME(SH7750_IPRB_A7)
-	REGNAME(SH7750_IPRC_A7)
 	REGNAME(SH7750_BCR3_A7)
 	REGNAME(SH7750_BCR4_A7)
 	REGNAME(SH7750_PRECHARGE0_A7)
diff --git a/hw/sh7750_regs.h b/hw/sh7750_regs.h
index 15b27690d..c8fb32810 100644
--- a/hw/sh7750_regs.h
+++ b/hw/sh7750_regs.h
@@ -1241,48 +1241,6 @@
 #define SH7750_ICR_IRLM_RAW   0x0080	/*   IRL\ pins used as a four independent
 					   interrupt requests */
 
-/* Interrupt Priority Register A - IPRA (half) */
-#define SH7750_IPRA_REGOFS    0xD00004	/* offset */
-#define SH7750_IPRA           SH7750_P4_REG32(SH7750_IPRA_REGOFS)
-#define SH7750_IPRA_A7        SH7750_A7_REG32(SH7750_IPRA_REGOFS)
-
-#define SH7750_IPRA_TMU0      0xF000	/* TMU0 interrupt priority */
-#define SH7750_IPRA_TMU0_S    12
-#define SH7750_IPRA_TMU1      0x0F00	/* TMU1 interrupt priority */
-#define SH7750_IPRA_TMU1_S    8
-#define SH7750_IPRA_TMU2      0x00F0	/* TMU2 interrupt priority */
-#define SH7750_IPRA_TMU2_S    4
-#define SH7750_IPRA_RTC       0x000F	/* RTC interrupt priority */
-#define SH7750_IPRA_RTC_S     0
-
-/* Interrupt Priority Register B - IPRB (half) */
-#define SH7750_IPRB_REGOFS    0xD00008	/* offset */
-#define SH7750_IPRB           SH7750_P4_REG32(SH7750_IPRB_REGOFS)
-#define SH7750_IPRB_A7        SH7750_A7_REG32(SH7750_IPRB_REGOFS)
-
-#define SH7750_IPRB_WDT       0xF000	/* WDT interrupt priority */
-#define SH7750_IPRB_WDT_S     12
-#define SH7750_IPRB_REF       0x0F00	/* Memory Refresh unit interrupt
-					   priority */
-#define SH7750_IPRB_REF_S     8
-#define SH7750_IPRB_SCI1      0x00F0	/* SCI1 interrupt priority */
-#define SH7750_IPRB_SCI1_S    4
-
-/* Interrupt Priority Register ó - IPRó (half) */
-#define SH7750_IPRC_REGOFS    0xD00004	/* offset */
-#define SH7750_IPRC           SH7750_P4_REG32(SH7750_IPRC_REGOFS)
-#define SH7750_IPRC_A7        SH7750_A7_REG32(SH7750_IPRC_REGOFS)
-
-#define SH7750_IPRC_GPIO      0xF000	/* GPIO interrupt priority */
-#define SH7750_IPRC_GPIO_S    12
-#define SH7750_IPRC_DMAC      0x0F00	/* DMAC interrupt priority */
-#define SH7750_IPRC_DMAC_S    8
-#define SH7750_IPRC_SCIF      0x00F0	/* SCIF interrupt priority */
-#define SH7750_IPRC_SCIF_S    4
-#define SH7750_IPRC_HUDI      0x000F	/* H-UDI interrupt priority */
-#define SH7750_IPRC_HUDI_S    0
-
-
 /*
  * User Break Controller registers
  */
diff --git a/hw/sh_intc.c b/hw/sh_intc.c
new file mode 100644
index 000000000..8d1674ae3
--- /dev/null
+++ b/hw/sh_intc.c
@@ -0,0 +1,453 @@
+/*
+ * SuperH interrupt controller module
+ *
+ * Copyright (c) 2007 Magnus Damm
+ * Based on sh_timer.c and arm_timer.c by Paul Brook
+ * Copyright (c) 2005-2006 CodeSourcery.
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include <assert.h>
+#include "sh_intc.h"
+#include "hw.h"
+#include "sh.h"
+
+//#define DEBUG_INTC
+//#define DEBUG_INTC_SOURCES
+
+#define INTC_A7(x) ((x) & 0x1fffffff)
+#define INTC_ARRAY(x) (sizeof(x) / sizeof(x[0]))
+
+void sh_intc_toggle_source(struct intc_source *source,
+			   int enable_adj, int assert_adj)
+{
+    int enable_changed = 0;
+    int pending_changed = 0;
+    int old_pending;
+
+    if ((source->enable_count == source->enable_max) && (enable_adj == -1))
+        enable_changed = -1;
+
+    source->enable_count += enable_adj;
+
+    if (source->enable_count == source->enable_max)
+        enable_changed = 1;
+
+    source->asserted += assert_adj;
+
+    old_pending = source->pending;
+    source->pending = source->asserted &&
+      (source->enable_count == source->enable_max);
+
+    if (old_pending != source->pending)
+        pending_changed = 1;
+
+    if (pending_changed) {
+        if (source->pending) {
+            source->parent->pending++;
+	    if (source->parent->pending == 1)
+                cpu_interrupt(first_cpu, CPU_INTERRUPT_HARD);
+	}
+	else {
+            source->parent->pending--;
+	    if (source->parent->pending == 0)
+                cpu_reset_interrupt(first_cpu, CPU_INTERRUPT_HARD);
+	}
+    }
+
+  if (enable_changed || assert_adj || pending_changed) {
+#ifdef DEBUG_INTC_SOURCES
+            printf("sh_intc: (%d/%d/%d/%d) interrupt source 0x%x %s%s%s\n",
+		   source->parent->pending,
+		   source->asserted,
+		   source->enable_count,
+		   source->enable_max,
+		   source->vect,
+		   source->asserted ? "asserted " :
+		   assert_adj ? "deasserted" : "",
+		   enable_changed == 1 ? "enabled " :
+		   enable_changed == -1 ? "disabled " : "",
+		   source->pending ? "pending" : "");
+#endif
+  }
+}
+
+int sh_intc_get_pending_vector(struct intc_desc *desc, int imask)
+{
+    unsigned int i;
+
+    /* slow: use a linked lists of pending sources instead */
+    /* wrong: take interrupt priority into account (one list per priority) */
+
+    if (imask == 0x0f) {
+        return -1; /* FIXME, update code to include priority per source */
+    }
+
+    for (i = 0; i < desc->nr_sources; i++) {
+        struct intc_source *source = desc->sources + i;
+
+	if (source->pending) {
+#ifdef DEBUG_INTC_SOURCES
+            printf("sh_intc: (%d) returning interrupt source 0x%x\n",
+		   desc->pending, source->vect);
+#endif
+            return source->vect;
+	}
+    }
+
+    assert(0);
+}
+
+#define INTC_MODE_NONE       0
+#define INTC_MODE_DUAL_SET   1
+#define INTC_MODE_DUAL_CLR   2
+#define INTC_MODE_ENABLE_REG 3
+#define INTC_MODE_MASK_REG   4
+#define INTC_MODE_IS_PRIO    8
+
+static unsigned int sh_intc_mode(unsigned long address,
+				 unsigned long set_reg, unsigned long clr_reg)
+{
+    if ((address != INTC_A7(set_reg)) &&
+	(address != INTC_A7(clr_reg)))
+        return INTC_MODE_NONE;
+
+    if (set_reg && clr_reg) {
+        if (address == INTC_A7(set_reg))
+            return INTC_MODE_DUAL_SET;
+	else
+            return INTC_MODE_DUAL_CLR;
+    }
+
+    if (set_reg)
+        return INTC_MODE_ENABLE_REG;
+    else
+        return INTC_MODE_MASK_REG;
+}
+
+static void sh_intc_locate(struct intc_desc *desc,
+			   unsigned long address,
+			   unsigned long **datap,
+			   intc_enum **enums,
+			   unsigned int *first,
+			   unsigned int *width,
+			   unsigned int *modep)
+{
+    unsigned int i, mode;
+
+    /* this is slow but works for now */
+
+    if (desc->mask_regs) {
+        for (i = 0; i < desc->nr_mask_regs; i++) {
+	    struct intc_mask_reg *mr = desc->mask_regs + i;
+
+	    mode = sh_intc_mode(address, mr->set_reg, mr->clr_reg);
+	    if (mode == INTC_MODE_NONE)
+                continue;
+
+	    *modep = mode;
+	    *datap = &mr->value;
+	    *enums = mr->enum_ids;
+	    *first = mr->reg_width - 1;
+	    *width = 1;
+	    return;
+	}
+    }
+
+    if (desc->prio_regs) {
+        for (i = 0; i < desc->nr_prio_regs; i++) {
+	    struct intc_prio_reg *pr = desc->prio_regs + i;
+
+	    mode = sh_intc_mode(address, pr->set_reg, pr->clr_reg);
+	    if (mode == INTC_MODE_NONE)
+                continue;
+
+	    *modep = mode | INTC_MODE_IS_PRIO;
+	    *datap = &pr->value;
+	    *enums = pr->enum_ids;
+	    *first = (pr->reg_width / pr->field_width) - 1;
+	    *width = pr->field_width;
+	    return;
+	}
+    }
+
+    assert(0);
+}
+
+static void sh_intc_toggle_mask(struct intc_desc *desc, intc_enum id,
+				int enable, int is_group)
+{
+    struct intc_source *source = desc->sources + id;
+
+    if (!id)
+	return;
+
+    if (!source->next_enum_id && (!source->enable_max || !source->vect)) {
+#ifdef DEBUG_INTC_SOURCES
+        printf("sh_intc: reserved interrupt source %d modified\n", id);
+#endif
+	return;
+    }
+
+    if (source->vect)
+        sh_intc_toggle_source(source, enable ? 1 : -1, 0);
+
+#ifdef DEBUG_INTC
+    else {
+        printf("setting interrupt group %d to %d\n", id, !!enable);
+    }
+#endif
+
+    if ((is_group || !source->vect) && source->next_enum_id) {
+        sh_intc_toggle_mask(desc, source->next_enum_id, enable, 1);
+    }
+
+#ifdef DEBUG_INTC
+    if (!source->vect) {
+        printf("setting interrupt group %d to %d - done\n", id, !!enable);
+    }
+#endif
+}
+
+static uint32_t sh_intc_read(void *opaque, target_phys_addr_t offset)
+{
+    struct intc_desc *desc = opaque;
+    intc_enum *enum_ids = NULL;
+    unsigned int first = 0;
+    unsigned int width = 0;
+    unsigned int mode = 0;
+    unsigned long *valuep;
+
+#ifdef DEBUG_INTC
+    printf("sh_intc_read 0x%lx\n", (unsigned long) offset);
+#endif
+
+    sh_intc_locate(desc, (unsigned long)offset, &valuep, 
+		   &enum_ids, &first, &width, &mode);
+    return *valuep;
+}
+
+static void sh_intc_write(void *opaque, target_phys_addr_t offset,
+			  uint32_t value)
+{
+    struct intc_desc *desc = opaque;
+    intc_enum *enum_ids = NULL;
+    unsigned int first = 0;
+    unsigned int width = 0;
+    unsigned int mode = 0;
+    unsigned int k;
+    unsigned long *valuep;
+    unsigned long mask;
+
+#ifdef DEBUG_INTC
+    printf("sh_intc_write 0x%lx 0x%08x\n", (unsigned long) offset, value);
+#endif
+
+    sh_intc_locate(desc, (unsigned long)offset, &valuep, 
+		   &enum_ids, &first, &width, &mode);
+
+    switch (mode) {
+    case INTC_MODE_ENABLE_REG | INTC_MODE_IS_PRIO: break;
+    case INTC_MODE_DUAL_SET: value |= *valuep; break;
+    case INTC_MODE_DUAL_CLR: value = *valuep & ~value; break;
+    default: assert(0);
+    }
+
+    for (k = 0; k <= first; k++) {
+        mask = ((1 << width) - 1) << ((first - k) * width);
+
+	if ((*valuep & mask) == (value & mask))
+            continue;
+#if 0
+	printf("k = %d, first = %d, enum = %d, mask = 0x%08x\n", 
+	       k, first, enum_ids[k], (unsigned int)mask);
+#endif
+        sh_intc_toggle_mask(desc, enum_ids[k], value & mask, 0);
+    }
+
+    *valuep = value;
+
+#ifdef DEBUG_INTC
+    printf("sh_intc_write 0x%lx -> 0x%08x\n", (unsigned long) offset, value);
+#endif
+}
+
+static CPUReadMemoryFunc *sh_intc_readfn[] = {
+    sh_intc_read,
+    sh_intc_read,
+    sh_intc_read
+};
+
+static CPUWriteMemoryFunc *sh_intc_writefn[] = {
+    sh_intc_write,
+    sh_intc_write,
+    sh_intc_write
+};
+
+struct intc_source *sh_intc_source(struct intc_desc *desc, intc_enum id)
+{
+    if (id)
+        return desc->sources + id;
+
+    return NULL;
+}
+
+static void sh_intc_register(struct intc_desc *desc, 
+			     unsigned long address)
+{
+    if (address)
+        cpu_register_physical_memory(INTC_A7(address), 4, desc->iomemtype);
+}
+
+static void sh_intc_register_source(struct intc_desc *desc,
+				    intc_enum source,
+				    struct intc_group *groups,
+				    int nr_groups)
+{
+    unsigned int i, k;
+    struct intc_source *s;
+
+    if (desc->mask_regs) {
+        for (i = 0; i < desc->nr_mask_regs; i++) {
+	    struct intc_mask_reg *mr = desc->mask_regs + i;
+
+	    for (k = 0; k < INTC_ARRAY(mr->enum_ids); k++) {
+                if (mr->enum_ids[k] != source)
+                    continue;
+
+		s = sh_intc_source(desc, mr->enum_ids[k]);
+		if (s)
+                    s->enable_max++;
+	    }
+	}
+    }
+
+    if (desc->prio_regs) {
+        for (i = 0; i < desc->nr_prio_regs; i++) {
+	    struct intc_prio_reg *pr = desc->prio_regs + i;
+
+	    for (k = 0; k < INTC_ARRAY(pr->enum_ids); k++) {
+                if (pr->enum_ids[k] != source)
+                    continue;
+
+		s = sh_intc_source(desc, pr->enum_ids[k]);
+		if (s)
+                    s->enable_max++;
+	    }
+	}
+    }
+
+    if (groups) {
+        for (i = 0; i < nr_groups; i++) {
+	    struct intc_group *gr = groups + i;
+
+	    for (k = 0; k < INTC_ARRAY(gr->enum_ids); k++) {
+                if (gr->enum_ids[k] != source)
+                    continue;
+
+		s = sh_intc_source(desc, gr->enum_ids[k]);
+		if (s)
+                    s->enable_max++;
+	    }
+	}
+    }
+
+}
+
+void sh_intc_register_sources(struct intc_desc *desc,
+			      struct intc_vect *vectors,
+			      int nr_vectors,
+			      struct intc_group *groups,
+			      int nr_groups)
+{
+    unsigned int i, k;
+    struct intc_source *s;
+
+    for (i = 0; i < nr_vectors; i++) {
+	struct intc_vect *vect = vectors + i;
+
+	sh_intc_register_source(desc, vect->enum_id, groups, nr_groups);
+	s = sh_intc_source(desc, vect->enum_id);
+	if (s)
+	    s->vect = vect->vect;
+
+#ifdef DEBUG_INTC_SOURCES
+	printf("sh_intc: registered source %d -> 0x%04x (%d/%d)\n",
+	       vect->enum_id, s->vect, s->enable_count, s->enable_max);
+#endif
+    }
+
+    if (groups) {
+        for (i = 0; i < nr_groups; i++) {
+	    struct intc_group *gr = groups + i;
+
+	    s = sh_intc_source(desc, gr->enum_id);
+	    s->next_enum_id = gr->enum_ids[0];
+
+	    for (k = 1; k < INTC_ARRAY(gr->enum_ids); k++) {
+                if (!gr->enum_ids[k])
+                    continue;
+
+		s = sh_intc_source(desc, gr->enum_ids[k - 1]);
+		s->next_enum_id = gr->enum_ids[k];
+	    }
+
+#ifdef DEBUG_INTC_SOURCES
+	    printf("sh_intc: registered group %d (%d/%d)\n",
+		   gr->enum_id, s->enable_count, s->enable_max);
+#endif
+	}
+    }
+}
+
+int sh_intc_init(struct intc_desc *desc,
+		 int nr_sources,
+		 struct intc_mask_reg *mask_regs,
+		 int nr_mask_regs,
+		 struct intc_prio_reg *prio_regs,
+		 int nr_prio_regs)
+{
+    unsigned int i;
+
+    desc->pending = 0;
+    desc->nr_sources = nr_sources;
+    desc->mask_regs = mask_regs;
+    desc->nr_mask_regs = nr_mask_regs;
+    desc->prio_regs = prio_regs;
+    desc->nr_prio_regs = nr_prio_regs;
+
+    i = sizeof(struct intc_source) * nr_sources;
+    desc->sources = malloc(i);
+    if (!desc->sources)
+        return -1;
+
+    memset(desc->sources, 0, i);
+    for (i = 0; i < desc->nr_sources; i++) {
+        struct intc_source *source = desc->sources + i;
+
+        source->parent = desc;
+    }
+ 
+    desc->iomemtype = cpu_register_io_memory(0, sh_intc_readfn,
+					     sh_intc_writefn, desc);
+    if (desc->mask_regs) {
+        for (i = 0; i < desc->nr_mask_regs; i++) {
+	    struct intc_mask_reg *mr = desc->mask_regs + i;
+
+	    sh_intc_register(desc, mr->set_reg);
+	    sh_intc_register(desc, mr->clr_reg);
+	}
+    }
+
+    if (desc->prio_regs) {
+        for (i = 0; i < desc->nr_prio_regs; i++) {
+	    struct intc_prio_reg *pr = desc->prio_regs + i;
+
+	    sh_intc_register(desc, pr->set_reg);
+	    sh_intc_register(desc, pr->clr_reg);
+	}
+    }
+
+    return 0;
+}
diff --git a/hw/sh_intc.h b/hw/sh_intc.h
new file mode 100644
index 000000000..d22a4a2a4
--- /dev/null
+++ b/hw/sh_intc.h
@@ -0,0 +1,75 @@
+#ifndef __SH_INTC_H__
+#define __SH_INTC_H__
+
+typedef unsigned char intc_enum;
+
+struct intc_vect {
+    intc_enum enum_id;
+    unsigned short vect;
+};
+
+#define INTC_VECT(enum_id, vect) { enum_id, vect }
+
+struct intc_group {
+    intc_enum enum_id;
+    intc_enum enum_ids[32];
+};
+
+#define INTC_GROUP(enum_id, ids...) { enum_id, { ids } }
+
+struct intc_mask_reg {
+    unsigned long set_reg, clr_reg, reg_width;
+    intc_enum enum_ids[32];
+    unsigned long value;
+};
+
+struct intc_prio_reg {
+    unsigned long set_reg, clr_reg, reg_width, field_width;
+    intc_enum enum_ids[16];
+    unsigned long value;
+};
+
+#define _INTC_ARRAY(a) a, sizeof(a)/sizeof(*a)
+
+struct intc_source {
+    unsigned short vect;
+    intc_enum next_enum_id;
+
+    int asserted; /* emulates the interrupt signal line from device to intc */
+    int enable_count;
+    int enable_max;
+    int pending; /* emulates the result of signal and masking */
+    struct intc_desc *parent;
+};
+
+struct intc_desc {
+    struct intc_source *sources;
+    int nr_sources;
+    struct intc_mask_reg *mask_regs;
+    int nr_mask_regs;
+    struct intc_prio_reg *prio_regs;
+    int nr_prio_regs;
+
+    int iomemtype;
+    int pending; /* number of interrupt sources that has pending set */
+};
+
+int sh_intc_get_pending_vector(struct intc_desc *desc, int imask);
+struct intc_source *sh_intc_source(struct intc_desc *desc, intc_enum id);
+void sh_intc_toggle_source(struct intc_source *source,
+			   int enable_adj, int assert_adj);
+
+void sh_intc_register_sources(struct intc_desc *desc,
+			      struct intc_vect *vectors,
+			      int nr_vectors,
+			      struct intc_group *groups,
+			      int nr_groups);
+
+int sh_intc_init(struct intc_desc *desc,
+		 int nr_sources,
+		 struct intc_mask_reg *mask_regs,
+		 int nr_mask_regs,
+		 struct intc_prio_reg *prio_regs,
+		 int nr_prio_regs);
+
+#endif /* __SH_INTC_H__ */
diff --git a/hw/sh_serial.c b/hw/sh_serial.c
index 03a096c1b..fe409c49d 100644
--- a/hw/sh_serial.c
+++ b/hw/sh_serial.c
@@ -24,7 +24,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "sh.h"
+#include "qemu-char.h"
 #include <assert.h>
 
 //#define DEBUG_SERIAL
@@ -250,14 +252,14 @@ static void sh_serial_event(void *opaque, int event)
         sh_serial_receive_break(s);
 }
 
-uint32_t sh_serial_read (void *opaque, target_phys_addr_t addr)
+static uint32_t sh_serial_read (void *opaque, target_phys_addr_t addr)
 {
     sh_serial_state *s = opaque;
     return sh_serial_ioport_read(s, addr - s->base);
 }
 
-void sh_serial_write (void *opaque,
-		      target_phys_addr_t addr, uint32_t value)
+static void sh_serial_write (void *opaque,
+                             target_phys_addr_t addr, uint32_t value)
 {
     sh_serial_state *s = opaque;
     sh_serial_ioport_write(s, addr - s->base, value);
@@ -291,7 +293,7 @@ void sh_serial_init (target_phys_addr_t base, int feat,
 
     s->smr = 0;
     s->brr = 0xff;
-    s->scr = 0;
+    s->scr = 1 << 5; /* pretend that TX is enabled so early printk works */
     s->sptr = 0;
 
     if (feat & SH_SERIAL_FEAT_SCIF) {
diff --git a/hw/sh_timer.c b/hw/sh_timer.c
index 40f3930cf..df265d2d2 100644
--- a/hw/sh_timer.c
+++ b/hw/sh_timer.c
@@ -8,7 +8,9 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "sh.h"
+#include "qemu-timer.h"
 
 //#define DEBUG_TIMER
 
@@ -31,26 +33,26 @@ typedef struct {
     uint32_t tcpr;
     int freq;
     int int_level;
+    int old_level;
     int feat;
     int enabled;
-    qemu_irq irq;
+    struct intc_source *irq;
 } sh_timer_state;
 
 /* Check all active timers, and schedule the next timer interrupt. */
 
 static void sh_timer_update(sh_timer_state *s)
 {
-#if 0 /* not yet */
-    /* Update interrupts.  */
-    if (s->int_level && (s->tcr & TIMER_TCR_UNIE)) {
-        qemu_irq_raise(s->irq);
-    } else {
-        qemu_irq_lower(s->irq);
-    }
-#endif
+    int new_level = s->int_level && (s->tcr & TIMER_TCR_UNIE);
+
+    if (new_level != s->old_level)
+      sh_intc_toggle_source(s->irq, 0, new_level ? 1 : -1);
+
+    s->old_level = s->int_level;
+    s->int_level = new_level;
 }
 
-uint32_t sh_timer_read(void *opaque, target_phys_addr_t offset)
+static uint32_t sh_timer_read(void *opaque, target_phys_addr_t offset)
 {
     sh_timer_state *s = (sh_timer_state *)opaque;
 
@@ -183,7 +185,7 @@ static void sh_timer_tick(void *opaque)
     sh_timer_update(s);
 }
 
-static void *sh_timer_init(uint32_t freq, int feat)
+static void *sh_timer_init(uint32_t freq, int feat, struct intc_source *irq)
 {
     sh_timer_state *s;
     QEMUBH *bh;
@@ -196,6 +198,7 @@ static void *sh_timer_init(uint32_t freq, int feat)
     s->tcpr = 0xdeadbeef;
     s->tcor = 0;
     s->enabled = 0;
+    s->irq = irq;
 
     bh = qemu_bh_new(sh_timer_tick, s);
     s->timer = ptimer_init(bh);
@@ -303,7 +306,9 @@ static CPUWriteMemoryFunc *tmu012_writefn[] = {
     tmu012_write
 };
 
-void tmu012_init(uint32_t base, int feat, uint32_t freq)
+void tmu012_init(target_phys_addr_t base, int feat, uint32_t freq,
+		 struct intc_source *ch0_irq, struct intc_source *ch1_irq,
+		 struct intc_source *ch2_irq0, struct intc_source *ch2_irq1)
 {
     int iomemtype;
     tmu012_state *s;
@@ -312,10 +317,11 @@ void tmu012_init(uint32_t base, int feat, uint32_t freq)
     s = (tmu012_state *)qemu_mallocz(sizeof(tmu012_state));
     s->base = base;
     s->feat = feat;
-    s->timer[0] = sh_timer_init(freq, timer_feat);
-    s->timer[1] = sh_timer_init(freq, timer_feat);
+    s->timer[0] = sh_timer_init(freq, timer_feat, ch0_irq);
+    s->timer[1] = sh_timer_init(freq, timer_feat, ch1_irq);
     if (feat & TMU012_FEAT_3CHAN)
-        s->timer[2] = sh_timer_init(freq, timer_feat | TIMER_FEAT_CAPT);
+        s->timer[2] = sh_timer_init(freq, timer_feat | TIMER_FEAT_CAPT,
+				    ch2_irq0); /* ch2_irq1 not supported */
     iomemtype = cpu_register_io_memory(0, tmu012_readfn,
                                        tmu012_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
diff --git a/hw/shix.c b/hw/shix.c
index e668426c8..533b15935 100644
--- a/hw/shix.c
+++ b/hw/shix.c
@@ -27,7 +27,10 @@
 
    More information in target-sh4/README.sh4
 */
-#include "vl.h"
+#include "hw.h"
+#include "sh.h"
+#include "sysemu.h"
+#include "boards.h"
 
 #define BIOS_FILENAME "shix_bios.bin"
 #define BIOS_ADDRESS 0xA0000000
@@ -62,17 +65,20 @@ void vga_screen_dump(const char *filename)
     /* XXXXX */
 }
 
-void shix_init(int ram_size, int vga_ram_size, int boot_device,
-	       DisplayState * ds, const char **fd_filename, int snapshot,
+static void shix_init(int ram_size, int vga_ram_size,
+               const char *boot_device, DisplayState * ds,
 	       const char *kernel_filename, const char *kernel_cmdline,
 	       const char *initrd_filename, const char *cpu_model)
 {
     int ret;
     CPUState *env;
     struct SH7750State *s;
+    
+    if (!cpu_model)
+        cpu_model = "any";
 
     printf("Initializing CPU\n");
-    env = cpu_init();
+    env = cpu_init(cpu_model);
 
     /* Allocate memory space */
     printf("Allocating ROM\n");
@@ -83,12 +89,14 @@ void shix_init(int ram_size, int vga_ram_size, int boot_device,
     cpu_register_physical_memory(0x0c000000, 0x01000000, 0x01004000);
 
     /* Load BIOS in 0 (and access it through P2, 0xA0000000) */
-    printf("%s: load BIOS '%s'\n", __func__, BIOS_FILENAME);
-    ret = load_image(BIOS_FILENAME, phys_ram_base);
+    if (bios_name == NULL)
+        bios_name = BIOS_FILENAME;
+    printf("%s: load BIOS '%s'\n", __func__, bios_name);
+    ret = load_image(bios_name, phys_ram_base);
     if (ret < 0) {		/* Check bios size */
 	fprintf(stderr, "ret=%d\n", ret);
 	fprintf(stderr, "qemu: could not load SHIX bios '%s'\n",
-		BIOS_FILENAME);
+		bios_name);
 	exit(1);
     }
 
diff --git a/hw/slavio_intctl.c b/hw/slavio_intctl.c
index f604702f8..a0aa53c21 100644
--- a/hw/slavio_intctl.c
+++ b/hw/slavio_intctl.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "sun4m.h"
+#include "console.h"
+
 //#define DEBUG_IRQ_COUNT
 //#define DEBUG_IRQ
 
@@ -65,6 +68,12 @@ typedef struct SLAVIO_INTCTLState {
 #define INTCTLM_MAXADDR 0x13
 #define INTCTLM_SIZE (INTCTLM_MAXADDR + 1)
 #define INTCTLM_MASK 0x1f
+#define MASTER_IRQ_MASK ~0x4fb2007f
+#define MASTER_DISABLE 0x80000000
+#define CPU_IRQ_MASK 0xfffe0000
+#define CPU_IRQ_INT15_IN 0x0004000
+#define CPU_IRQ_INT15_MASK 0x80000000
+
 static void slavio_check_interrupts(void *opaque);
 
 // per-cpu interrupt controller
@@ -100,21 +109,21 @@ static void slavio_intctl_mem_writel(void *opaque, target_phys_addr_t addr, uint
     DPRINTF("write cpu %d reg 0x" TARGET_FMT_plx " = %x\n", cpu, addr, val);
     switch (saddr) {
     case 1: // clear pending softints
-	if (val & 0x4000)
-	    val |= 80000000;
-	val &= 0xfffe0000;
-	s->intreg_pending[cpu] &= ~val;
+        if (val & CPU_IRQ_INT15_IN)
+            val |= CPU_IRQ_INT15_MASK;
+        val &= CPU_IRQ_MASK;
+        s->intreg_pending[cpu] &= ~val;
         slavio_check_interrupts(s);
-	DPRINTF("Cleared cpu %d irq mask %x, curmask %x\n", cpu, val, s->intreg_pending[cpu]);
-	break;
+        DPRINTF("Cleared cpu %d irq mask %x, curmask %x\n", cpu, val, s->intreg_pending[cpu]);
+        break;
     case 2: // set softint
-	val &= 0xfffe0000;
-	s->intreg_pending[cpu] |= val;
+        val &= CPU_IRQ_MASK;
+        s->intreg_pending[cpu] |= val;
         slavio_check_interrupts(s);
-	DPRINTF("Set cpu %d irq mask %x, curmask %x\n", cpu, val, s->intreg_pending[cpu]);
-	break;
+        DPRINTF("Set cpu %d irq mask %x, curmask %x\n", cpu, val, s->intreg_pending[cpu]);
+        break;
     default:
-	break;
+        break;
     }
 }
 
@@ -139,7 +148,7 @@ static uint32_t slavio_intctlm_mem_readl(void *opaque, target_phys_addr_t addr)
     saddr = (addr & INTCTLM_MAXADDR) >> 2;
     switch (saddr) {
     case 0:
-        ret = s->intregm_pending & 0x7fffffff;
+        ret = s->intregm_pending & ~MASTER_DISABLE;
         break;
     case 1:
         ret = s->intregm_disabled;
@@ -165,27 +174,27 @@ static void slavio_intctlm_mem_writel(void *opaque, target_phys_addr_t addr, uin
     DPRINTF("write system reg 0x" TARGET_FMT_plx " = %x\n", addr, val);
     switch (saddr) {
     case 2: // clear (enable)
-	// Force clear unused bits
-	val &= ~0x4fb2007f;
-	s->intregm_disabled &= ~val;
-	DPRINTF("Enabled master irq mask %x, curmask %x\n", val, s->intregm_disabled);
-	slavio_check_interrupts(s);
-	break;
+        // Force clear unused bits
+        val &= MASTER_IRQ_MASK;
+        s->intregm_disabled &= ~val;
+        DPRINTF("Enabled master irq mask %x, curmask %x\n", val, s->intregm_disabled);
+        slavio_check_interrupts(s);
+        break;
     case 3: // set (disable, clear pending)
-	// Force clear unused bits
-	val &= ~0x4fb2007f;
-	s->intregm_disabled |= val;
-	s->intregm_pending &= ~val;
+        // Force clear unused bits
+        val &= MASTER_IRQ_MASK;
+        s->intregm_disabled |= val;
+        s->intregm_pending &= ~val;
         slavio_check_interrupts(s);
-	DPRINTF("Disabled master irq mask %x, curmask %x\n", val, s->intregm_disabled);
-	break;
+        DPRINTF("Disabled master irq mask %x, curmask %x\n", val, s->intregm_disabled);
+        break;
     case 4:
-	s->target_cpu = val & (MAX_CPUS - 1);
+        s->target_cpu = val & (MAX_CPUS - 1);
         slavio_check_interrupts(s);
-	DPRINTF("Set master irq cpu %d\n", s->target_cpu);
-	break;
+        DPRINTF("Set master irq cpu %d\n", s->target_cpu);
+        break;
     default:
-	break;
+        break;
     }
 }
 
@@ -207,7 +216,7 @@ void slavio_pic_info(void *opaque)
     int i;
 
     for (i = 0; i < MAX_CPUS; i++) {
-	term_printf("per-cpu %d: pending 0x%08x\n", i, s->intreg_pending[i]);
+        term_printf("per-cpu %d: pending 0x%08x\n", i, s->intreg_pending[i]);
     }
     term_printf("master: pending 0x%08x, disabled 0x%08x\n", s->intregm_pending, s->intregm_disabled);
 }
@@ -241,14 +250,14 @@ static void slavio_check_interrupts(void *opaque)
     DPRINTF("pending %x disabled %x\n", pending, s->intregm_disabled);
     for (i = 0; i < MAX_CPUS; i++) {
         pil_pending = 0;
-        if (pending && !(s->intregm_disabled & 0x80000000) &&
+        if (pending && !(s->intregm_disabled & MASTER_DISABLE) &&
             (i == s->target_cpu)) {
             for (j = 0; j < 32; j++) {
                 if (pending & (1 << j))
                     pil_pending |= 1 << s->intbit_to_level[j];
             }
         }
-        pil_pending |= (s->intreg_pending[i] >> 16) & 0xfffe;
+        pil_pending |= (s->intreg_pending[i] & CPU_IRQ_MASK) >> 16;
 
         for (j = 0; j < MAX_PILS; j++) {
             if (pil_pending & (1 << j)) {
@@ -310,7 +319,7 @@ static void slavio_intctl_save(QEMUFile *f, void *opaque)
     int i;
 
     for (i = 0; i < MAX_CPUS; i++) {
-	qemu_put_be32s(f, &s->intreg_pending[i]);
+        qemu_put_be32s(f, &s->intreg_pending[i]);
     }
     qemu_put_be32s(f, &s->intregm_pending);
     qemu_put_be32s(f, &s->intregm_disabled);
@@ -326,7 +335,7 @@ static int slavio_intctl_load(QEMUFile *f, void *opaque, int version_id)
         return -EINVAL;
 
     for (i = 0; i < MAX_CPUS; i++) {
-	qemu_get_be32s(f, &s->intreg_pending[i]);
+        qemu_get_be32s(f, &s->intreg_pending[i]);
     }
     qemu_get_be32s(f, &s->intregm_pending);
     qemu_get_be32s(f, &s->intregm_disabled);
@@ -341,9 +350,9 @@ static void slavio_intctl_reset(void *opaque)
     int i;
 
     for (i = 0; i < MAX_CPUS; i++) {
-	s->intreg_pending[i] = 0;
+        s->intreg_pending[i] = 0;
     }
-    s->intregm_disabled = ~0xffb2007f;
+    s->intregm_disabled = ~MASTER_IRQ_MASK;
     s->intregm_pending = 0;
     s->target_cpu = 0;
     slavio_check_interrupts(s);
@@ -363,8 +372,8 @@ void *slavio_intctl_init(target_phys_addr_t addr, target_phys_addr_t addrg,
 
     s->intbit_to_level = intbit_to_level;
     for (i = 0; i < MAX_CPUS; i++) {
-	slavio_intctl_io_memory = cpu_register_io_memory(0, slavio_intctl_mem_read, slavio_intctl_mem_write, s);
-	cpu_register_physical_memory(addr + i * TARGET_PAGE_SIZE, INTCTL_SIZE,
+        slavio_intctl_io_memory = cpu_register_io_memory(0, slavio_intctl_mem_read, slavio_intctl_mem_write, s);
+        cpu_register_physical_memory(addr + i * TARGET_PAGE_SIZE, INTCTL_SIZE,
                                      slavio_intctl_io_memory);
         s->cpu_irqs[i] = parent_irq[i];
     }
diff --git a/hw/slavio_misc.c b/hw/slavio_misc.c
index 34072c623..9728bcad9 100644
--- a/hw/slavio_misc.c
+++ b/hw/slavio_misc.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "sun4m.h"
+#include "sysemu.h"
+
 /* debug misc */
 //#define DEBUG_MISC
 
@@ -44,16 +47,41 @@ typedef struct MiscState {
     qemu_irq irq;
     uint8_t config;
     uint8_t aux1, aux2;
-    uint8_t diag, mctrl, sysctrl;
+    uint8_t diag, mctrl;
+    uint32_t sysctrl;
+    uint16_t leds;
+    target_phys_addr_t power_base;
 } MiscState;
 
 #define MISC_SIZE 1
+#define SYSCTRL_MAXADDR 3
+#define SYSCTRL_SIZE (SYSCTRL_MAXADDR + 1)
+#define LED_MAXADDR 1
+#define LED_SIZE (LED_MAXADDR + 1)
+
+#define MISC_MASK 0x0fff0000
+#define MISC_LEDS 0x01600000
+#define MISC_CFG  0x01800000
+#define MISC_AUX1 0x01900000
+#define MISC_AUX2 0x01910000
+#define MISC_DIAG 0x01a00000
+#define MISC_MDM  0x01b00000
+#define MISC_SYS  0x01f00000
+
+#define AUX2_PWROFF    0x01
+#define AUX2_PWRINTCLR 0x02
+#define AUX2_PWRFAIL   0x20
+
+#define CFG_PWRINTEN   0x08
+
+#define SYS_RESET      0x01
+#define SYS_RESETSTAT  0x02
 
 static void slavio_misc_update_irq(void *opaque)
 {
     MiscState *s = opaque;
 
-    if ((s->aux2 & 0x4) && (s->config & 0x8)) {
+    if ((s->aux2 & AUX2_PWRFAIL) && (s->config & CFG_PWRINTEN)) {
         MISC_DPRINTF("Raise IRQ\n");
         qemu_irq_raise(s->irq);
     } else {
@@ -75,58 +103,54 @@ void slavio_set_power_fail(void *opaque, int power_failing)
     MiscState *s = opaque;
 
     MISC_DPRINTF("Power fail: %d, config: %d\n", power_failing, s->config);
-    if (power_failing && (s->config & 0x8)) {
-	s->aux2 |= 0x4;
+    if (power_failing && (s->config & CFG_PWRINTEN)) {
+        s->aux2 |= AUX2_PWRFAIL;
     } else {
-	s->aux2 &= ~0x4;
+        s->aux2 &= ~AUX2_PWRFAIL;
     }
     slavio_misc_update_irq(s);
 }
 
-static void slavio_misc_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
+static void slavio_misc_mem_writeb(void *opaque, target_phys_addr_t addr,
+                                   uint32_t val)
 {
     MiscState *s = opaque;
 
-    switch (addr & 0xfff0000) {
-    case 0x1800000:
-	MISC_DPRINTF("Write config %2.2x\n", val & 0xff);
-	s->config = val & 0xff;
-	slavio_misc_update_irq(s);
-	break;
-    case 0x1900000:
-	MISC_DPRINTF("Write aux1 %2.2x\n", val & 0xff);
-	s->aux1 = val & 0xff;
-	break;
-    case 0x1910000:
-	val &= 0x3;
-	MISC_DPRINTF("Write aux2 %2.2x\n", val);
-	val |= s->aux2 & 0x4;
-	if (val & 0x2) // Clear Power Fail int
-	    val &= 0x1;
-	s->aux2 = val;
-	if (val & 1)
-	    qemu_system_shutdown_request();
-	slavio_misc_update_irq(s);
-	break;
-    case 0x1a00000:
-	MISC_DPRINTF("Write diag %2.2x\n", val & 0xff);
-	s->diag = val & 0xff;
-	break;
-    case 0x1b00000:
-	MISC_DPRINTF("Write modem control %2.2x\n", val & 0xff);
-	s->mctrl = val & 0xff;
-	break;
-    case 0x1f00000:
-	MISC_DPRINTF("Write system control %2.2x\n", val & 0xff);
-	if (val & 1) {
-	    s->sysctrl = 0x2;
-	    qemu_system_reset_request();
-	}
-	break;
-    case 0xa000000:
-	MISC_DPRINTF("Write power management %2.2x\n", val & 0xff);
-        cpu_interrupt(cpu_single_env, CPU_INTERRUPT_HALT);
-	break;
+    switch (addr & MISC_MASK) {
+    case MISC_CFG:
+        MISC_DPRINTF("Write config %2.2x\n", val & 0xff);
+        s->config = val & 0xff;
+        slavio_misc_update_irq(s);
+        break;
+    case MISC_AUX1:
+        MISC_DPRINTF("Write aux1 %2.2x\n", val & 0xff);
+        s->aux1 = val & 0xff;
+        break;
+    case MISC_AUX2:
+        val &= AUX2_PWRINTCLR | AUX2_PWROFF;
+        MISC_DPRINTF("Write aux2 %2.2x\n", val);
+        val |= s->aux2 & AUX2_PWRFAIL;
+        if (val & AUX2_PWRINTCLR) // Clear Power Fail int
+            val &= AUX2_PWROFF;
+        s->aux2 = val;
+        if (val & AUX2_PWROFF)
+            qemu_system_shutdown_request();
+        slavio_misc_update_irq(s);
+        break;
+    case MISC_DIAG:
+        MISC_DPRINTF("Write diag %2.2x\n", val & 0xff);
+        s->diag = val & 0xff;
+        break;
+    case MISC_MDM:
+        MISC_DPRINTF("Write modem control %2.2x\n", val & 0xff);
+        s->mctrl = val & 0xff;
+        break;
+    default:
+        if (addr == s->power_base) {
+            MISC_DPRINTF("Write power management %2.2x\n", val & 0xff);
+            cpu_interrupt(cpu_single_env, CPU_INTERRUPT_HALT);
+        }
+        break;
     }
 }
 
@@ -135,34 +159,32 @@ static uint32_t slavio_misc_mem_readb(void *opaque, target_phys_addr_t addr)
     MiscState *s = opaque;
     uint32_t ret = 0;
 
-    switch (addr & 0xfff0000) {
-    case 0x1800000:
-	ret = s->config;
-	MISC_DPRINTF("Read config %2.2x\n", ret);
-	break;
-    case 0x1900000:
-	ret = s->aux1;
-	MISC_DPRINTF("Read aux1 %2.2x\n", ret);
-	break;
-    case 0x1910000:
-	ret = s->aux2;
-	MISC_DPRINTF("Read aux2 %2.2x\n", ret);
-	break;
-    case 0x1a00000:
-	ret = s->diag;
-	MISC_DPRINTF("Read diag %2.2x\n", ret);
-	break;
-    case 0x1b00000:
-	ret = s->mctrl;
-	MISC_DPRINTF("Read modem control %2.2x\n", ret);
-	break;
-    case 0x1f00000:
-	MISC_DPRINTF("Read system control %2.2x\n", ret);
-	ret = s->sysctrl;
-	break;
-    case 0xa000000:
-	MISC_DPRINTF("Read power management %2.2x\n", ret);
-	break;
+    switch (addr & MISC_MASK) {
+    case MISC_CFG:
+        ret = s->config;
+        MISC_DPRINTF("Read config %2.2x\n", ret);
+        break;
+    case MISC_AUX1:
+        ret = s->aux1;
+        MISC_DPRINTF("Read aux1 %2.2x\n", ret);
+        break;
+    case MISC_AUX2:
+        ret = s->aux2;
+        MISC_DPRINTF("Read aux2 %2.2x\n", ret);
+        break;
+    case MISC_DIAG:
+        ret = s->diag;
+        MISC_DPRINTF("Read diag %2.2x\n", ret);
+        break;
+    case MISC_MDM:
+        ret = s->mctrl;
+        MISC_DPRINTF("Read modem control %2.2x\n", ret);
+        break;
+    default:
+        if (addr == s->power_base) {
+            MISC_DPRINTF("Read power management %2.2x\n", ret);
+        }
+        break;
     }
     return ret;
 }
@@ -179,10 +201,110 @@ static CPUWriteMemoryFunc *slavio_misc_mem_write[3] = {
     slavio_misc_mem_writeb,
 };
 
+static uint32_t slavio_sysctrl_mem_readl(void *opaque, target_phys_addr_t addr)
+{
+    MiscState *s = opaque;
+    uint32_t ret = 0, saddr;
+
+    saddr = addr & SYSCTRL_MAXADDR;
+    switch (saddr) {
+    case 0:
+        ret = s->sysctrl;
+        break;
+    default:
+        break;
+    }
+    MISC_DPRINTF("Read system control reg 0x" TARGET_FMT_plx " = %x\n", addr,
+                 ret);
+    return ret;
+}
+
+static void slavio_sysctrl_mem_writel(void *opaque, target_phys_addr_t addr,
+                                      uint32_t val)
+{
+    MiscState *s = opaque;
+    uint32_t saddr;
+
+    saddr = addr & SYSCTRL_MAXADDR;
+    MISC_DPRINTF("Write system control reg 0x" TARGET_FMT_plx " =  %x\n", addr,
+                 val);
+    switch (saddr) {
+    case 0:
+        if (val & SYS_RESET) {
+            s->sysctrl = SYS_RESETSTAT;
+            qemu_system_reset_request();
+        }
+        break;
+    default:
+        break;
+    }
+}
+
+static CPUReadMemoryFunc *slavio_sysctrl_mem_read[3] = {
+    slavio_sysctrl_mem_readl,
+    slavio_sysctrl_mem_readl,
+    slavio_sysctrl_mem_readl,
+};
+
+static CPUWriteMemoryFunc *slavio_sysctrl_mem_write[3] = {
+    slavio_sysctrl_mem_writel,
+    slavio_sysctrl_mem_writel,
+    slavio_sysctrl_mem_writel,
+};
+
+static uint32_t slavio_led_mem_reads(void *opaque, target_phys_addr_t addr)
+{
+    MiscState *s = opaque;
+    uint32_t ret = 0, saddr;
+
+    saddr = addr & LED_MAXADDR;
+    switch (saddr) {
+    case 0:
+        ret = s->leds;
+        break;
+    default:
+        break;
+    }
+    MISC_DPRINTF("Read diagnostic LED reg 0x" TARGET_FMT_plx " = %x\n", addr,
+                 ret);
+    return ret;
+}
+
+static void slavio_led_mem_writes(void *opaque, target_phys_addr_t addr,
+                                  uint32_t val)
+{
+    MiscState *s = opaque;
+    uint32_t saddr;
+
+    saddr = addr & LED_MAXADDR;
+    MISC_DPRINTF("Write diagnostic LED reg 0x" TARGET_FMT_plx " =  %x\n", addr,
+                 val);
+    switch (saddr) {
+    case 0:
+        s->leds = val;
+        break;
+    default:
+        break;
+    }
+}
+
+static CPUReadMemoryFunc *slavio_led_mem_read[3] = {
+    slavio_led_mem_reads,
+    slavio_led_mem_reads,
+    slavio_led_mem_reads,
+};
+
+static CPUWriteMemoryFunc *slavio_led_mem_write[3] = {
+    slavio_led_mem_writes,
+    slavio_led_mem_writes,
+    slavio_led_mem_writes,
+};
+
 static void slavio_misc_save(QEMUFile *f, void *opaque)
 {
     MiscState *s = opaque;
     int tmp;
+    uint8_t tmp8;
 
     tmp = 0;
     qemu_put_be32s(f, &tmp); /* ignored, was IRQ.  */
@@ -191,13 +313,15 @@ static void slavio_misc_save(QEMUFile *f, void *opaque)
     qemu_put_8s(f, &s->aux2);
     qemu_put_8s(f, &s->diag);
     qemu_put_8s(f, &s->mctrl);
-    qemu_put_8s(f, &s->sysctrl);
+    tmp8 = s->sysctrl & 0xff;
+    qemu_put_8s(f, &tmp8);
 }
 
 static int slavio_misc_load(QEMUFile *f, void *opaque, int version_id)
 {
     MiscState *s = opaque;
     int tmp;
+    uint8_t tmp8;
 
     if (version_id != 1)
         return -EINVAL;
@@ -208,7 +332,8 @@ static int slavio_misc_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_8s(f, &s->aux2);
     qemu_get_8s(f, &s->diag);
     qemu_get_8s(f, &s->mctrl);
-    qemu_get_8s(f, &s->sysctrl);
+    qemu_get_8s(f, &tmp8);
+    s->sysctrl = (uint32_t)tmp8;
     return 0;
 }
 
@@ -222,31 +347,47 @@ void *slavio_misc_init(target_phys_addr_t base, target_phys_addr_t power_base,
     if (!s)
         return NULL;
 
-    slavio_misc_io_memory = cpu_register_io_memory(0, slavio_misc_mem_read, slavio_misc_mem_write, s);
+    /* 8 bit registers */
+    slavio_misc_io_memory = cpu_register_io_memory(0, slavio_misc_mem_read,
+                                                   slavio_misc_mem_write, s);
     // Slavio control
-    cpu_register_physical_memory(base + 0x1800000, MISC_SIZE,
+    cpu_register_physical_memory(base + MISC_CFG, MISC_SIZE,
                                  slavio_misc_io_memory);
     // AUX 1
-    cpu_register_physical_memory(base + 0x1900000, MISC_SIZE,
+    cpu_register_physical_memory(base + MISC_AUX1, MISC_SIZE,
                                  slavio_misc_io_memory);
     // AUX 2
-    cpu_register_physical_memory(base + 0x1910000, MISC_SIZE,
+    cpu_register_physical_memory(base + MISC_AUX2, MISC_SIZE,
                                  slavio_misc_io_memory);
     // Diagnostics
-    cpu_register_physical_memory(base + 0x1a00000, MISC_SIZE,
+    cpu_register_physical_memory(base + MISC_DIAG, MISC_SIZE,
                                  slavio_misc_io_memory);
     // Modem control
-    cpu_register_physical_memory(base + 0x1b00000, MISC_SIZE,
-                                 slavio_misc_io_memory);
-    // System control
-    cpu_register_physical_memory(base + 0x1f00000, MISC_SIZE,
+    cpu_register_physical_memory(base + MISC_MDM, MISC_SIZE,
                                  slavio_misc_io_memory);
     // Power management
     cpu_register_physical_memory(power_base, MISC_SIZE, slavio_misc_io_memory);
+    s->power_base = power_base;
+
+    /* 16 bit registers */
+    slavio_misc_io_memory = cpu_register_io_memory(0, slavio_led_mem_read,
+                                                   slavio_led_mem_write, s);
+    /* ss600mp diag LEDs */
+    cpu_register_physical_memory(base + MISC_LEDS, MISC_SIZE,
+                                 slavio_misc_io_memory);
+
+    /* 32 bit registers */
+    slavio_misc_io_memory = cpu_register_io_memory(0, slavio_sysctrl_mem_read,
+                                                   slavio_sysctrl_mem_write,
+                                                   s);
+    // System control
+    cpu_register_physical_memory(base + MISC_SYS, SYSCTRL_SIZE,
+                                 slavio_misc_io_memory);
 
     s->irq = irq;
 
-    register_savevm("slavio_misc", base, 1, slavio_misc_save, slavio_misc_load, s);
+    register_savevm("slavio_misc", base, 1, slavio_misc_save, slavio_misc_load,
+                    s);
     qemu_register_reset(slavio_misc_reset, s);
     slavio_misc_reset(s);
     return s;
diff --git a/hw/slavio_serial.c b/hw/slavio_serial.c
index 1aa5e7a17..baec120ef 100644
--- a/hw/slavio_serial.c
+++ b/hw/slavio_serial.c
@@ -21,7 +21,11 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "sun4m.h"
+#include "qemu-char.h"
+#include "console.h"
+
 /* debug serial */
 //#define DEBUG_SERIAL
 
@@ -85,6 +89,7 @@ typedef struct {
     int rptr, wptr, count;
 } SERIOQueue;
 
+#define SERIAL_REGS 16
 typedef struct ChannelState {
     qemu_irq irq;
     int reg;
@@ -92,10 +97,11 @@ typedef struct ChannelState {
     chn_id_t chn; // this channel, A (base+4) or B (base+0)
     chn_type_t type;
     struct ChannelState *otherchn;
-    uint8_t rx, tx, wregs[16], rregs[16];
+    uint8_t rx, tx, wregs[SERIAL_REGS], rregs[SERIAL_REGS];
     SERIOQueue queue;
     CharDriverState *chr;
     int e0_mode, led_mode, caps_lock_mode, num_lock_mode;
+    int disabled;
 } ChannelState;
 
 struct SerialState {
@@ -104,6 +110,107 @@ struct SerialState {
 
 #define SERIAL_MAXADDR 7
 #define SERIAL_SIZE (SERIAL_MAXADDR + 1)
+#define SERIAL_CTRL 0
+#define SERIAL_DATA 1
+
+#define W_CMD     0
+#define CMD_PTR_MASK   0x07
+#define CMD_CMD_MASK   0x38
+#define CMD_HI         0x08
+#define CMD_CLR_TXINT  0x28
+#define CMD_CLR_IUS    0x38
+#define W_INTR    1
+#define INTR_INTALL    0x01
+#define INTR_TXINT     0x02
+#define INTR_RXMODEMSK 0x18
+#define INTR_RXINT1ST  0x08
+#define INTR_RXINTALL  0x10
+#define W_IVEC    2
+#define W_RXCTRL  3
+#define RXCTRL_RXEN    0x01
+#define W_TXCTRL1 4
+#define TXCTRL1_PAREN  0x01
+#define TXCTRL1_PAREV  0x02
+#define TXCTRL1_1STOP  0x04
+#define TXCTRL1_1HSTOP 0x08
+#define TXCTRL1_2STOP  0x0c
+#define TXCTRL1_STPMSK 0x0c
+#define TXCTRL1_CLK1X  0x00
+#define TXCTRL1_CLK16X 0x40
+#define TXCTRL1_CLK32X 0x80
+#define TXCTRL1_CLK64X 0xc0
+#define TXCTRL1_CLKMSK 0xc0
+#define W_TXCTRL2 5
+#define TXCTRL2_TXEN   0x08
+#define TXCTRL2_BITMSK 0x60
+#define TXCTRL2_5BITS  0x00
+#define TXCTRL2_7BITS  0x20
+#define TXCTRL2_6BITS  0x40
+#define TXCTRL2_8BITS  0x60
+#define W_SYNC1   6
+#define W_SYNC2   7
+#define W_TXBUF   8
+#define W_MINTR   9
+#define MINTR_STATUSHI 0x10
+#define MINTR_RST_MASK 0xc0
+#define MINTR_RST_B    0x40
+#define MINTR_RST_A    0x80
+#define MINTR_RST_ALL  0xc0
+#define W_MISC1  10
+#define W_CLOCK  11
+#define CLOCK_TRXC     0x08
+#define W_BRGLO  12
+#define W_BRGHI  13
+#define W_MISC2  14
+#define MISC2_PLLDIS   0x30
+#define W_EXTINT 15
+#define EXTINT_DCD     0x08
+#define EXTINT_SYNCINT 0x10
+#define EXTINT_CTSINT  0x20
+#define EXTINT_TXUNDRN 0x40
+#define EXTINT_BRKINT  0x80
+
+#define R_STATUS  0
+#define STATUS_RXAV    0x01
+#define STATUS_ZERO    0x02
+#define STATUS_TXEMPTY 0x04
+#define STATUS_DCD     0x08
+#define STATUS_SYNC    0x10
+#define STATUS_CTS     0x20
+#define STATUS_TXUNDRN 0x40
+#define STATUS_BRK     0x80
+#define R_SPEC    1
+#define SPEC_ALLSENT   0x01
+#define SPEC_BITS8     0x06
+#define R_IVEC    2
+#define IVEC_TXINTB    0x00
+#define IVEC_LONOINT   0x06
+#define IVEC_LORXINTA  0x0c
+#define IVEC_LORXINTB  0x04
+#define IVEC_LOTXINTA  0x08
+#define IVEC_HINOINT   0x60
+#define IVEC_HIRXINTA  0x30
+#define IVEC_HIRXINTB  0x20
+#define IVEC_HITXINTA  0x10
+#define R_INTR    3
+#define INTR_EXTINTB   0x01
+#define INTR_TXINTB    0x02
+#define INTR_RXINTB    0x04
+#define INTR_EXTINTA   0x08
+#define INTR_TXINTA    0x10
+#define INTR_RXINTA    0x20
+#define R_IPEN    4
+#define R_TXCTRL1 5
+#define R_TXCTRL2 6
+#define R_BC      7
+#define R_RXBUF   8
+#define R_RXCTRL  9
+#define R_MISC   10
+#define R_MISC1  11
+#define R_BRGLO  12
+#define R_BRGHI  13
+#define R_MISC1I 14
+#define R_EXTINT 15
 
 static void handle_kbd_command(ChannelState *s, int val);
 static int serial_can_receive(void *opaque);
@@ -139,7 +246,7 @@ static uint32_t get_queue(void *opaque)
     int val;
 
     if (q->count == 0) {
-	return 0;
+        return 0;
     } else {
         val = q->data[q->rptr];
         if (++q->rptr == SERIO_QUEUE_SIZE)
@@ -148,17 +255,20 @@ static uint32_t get_queue(void *opaque)
     }
     SER_DPRINTF("channel %c get 0x%02x\n", CHN_C(s), val);
     if (q->count > 0)
-	serial_receive_byte(s, 0);
+        serial_receive_byte(s, 0);
     return val;
 }
 
 static int slavio_serial_update_irq_chn(ChannelState *s)
 {
-    if ((s->wregs[1] & 1) && // interrupts enabled
-	(((s->wregs[1] & 2) && s->txint == 1) || // tx ints enabled, pending
-	 ((((s->wregs[1] & 0x18) == 8) || ((s->wregs[1] & 0x18) == 0x10)) &&
-	  s->rxint == 1) || // rx ints enabled, pending
-	 ((s->wregs[15] & 0x80) && (s->rregs[0] & 0x80)))) { // break int e&p
+    if ((s->wregs[W_INTR] & INTR_INTALL) && // interrupts enabled
+        (((s->wregs[W_INTR] & INTR_TXINT) && s->txint == 1) ||
+         // tx ints enabled, pending
+         ((((s->wregs[W_INTR] & INTR_RXMODEMSK) == INTR_RXINT1ST) ||
+           ((s->wregs[W_INTR] & INTR_RXMODEMSK) == INTR_RXINTALL)) &&
+          s->rxint == 1) || // rx ints enabled, pending
+         ((s->wregs[W_EXTINT] & EXTINT_BRKINT) &&
+          (s->rregs[R_STATUS] & STATUS_BRK)))) { // break int e&p
         return 1;
     }
     return 0;
@@ -181,16 +291,21 @@ static void slavio_serial_reset_chn(ChannelState *s)
 
     s->reg = 0;
     for (i = 0; i < SERIAL_SIZE; i++) {
-	s->rregs[i] = 0;
-	s->wregs[i] = 0;
+        s->rregs[i] = 0;
+        s->wregs[i] = 0;
     }
-    s->wregs[4] = 4;
-    s->wregs[9] = 0xc0;
-    s->wregs[11] = 8;
-    s->wregs[14] = 0x30;
-    s->wregs[15] = 0xf8;
-    s->rregs[0] = 0x44;
-    s->rregs[1] = 6;
+    s->wregs[W_TXCTRL1] = TXCTRL1_1STOP; // 1X divisor, 1 stop bit, no parity
+    s->wregs[W_MINTR] = MINTR_RST_ALL;
+    s->wregs[W_CLOCK] = CLOCK_TRXC; // Synch mode tx clock = TRxC
+    s->wregs[W_MISC2] = MISC2_PLLDIS; // PLL disabled
+    s->wregs[W_EXTINT] = EXTINT_DCD | EXTINT_SYNCINT | EXTINT_CTSINT |
+        EXTINT_TXUNDRN | EXTINT_BRKINT; // Enable most interrupts
+    if (s->disabled)
+        s->rregs[R_STATUS] = STATUS_TXEMPTY | STATUS_DCD | STATUS_SYNC |
+            STATUS_CTS | STATUS_TXUNDRN;
+    else
+        s->rregs[R_STATUS] = STATUS_TXEMPTY | STATUS_TXUNDRN;
+    s->rregs[R_SPEC] = SPEC_BITS8;
 
     s->rx = s->tx = 0;
     s->rxint = s->txint = 0;
@@ -211,17 +326,17 @@ static inline void clr_rxint(ChannelState *s)
     s->rxint = 0;
     s->rxint_under_svc = 0;
     if (s->chn == chn_a) {
-        if (s->wregs[9] & 0x10)
-            s->otherchn->rregs[2] = 0x60;
+        if (s->wregs[W_MINTR] & MINTR_STATUSHI)
+            s->otherchn->rregs[R_IVEC] = IVEC_HINOINT;
         else
-            s->otherchn->rregs[2] = 0x06;
-        s->rregs[3] &= ~0x20;
+            s->otherchn->rregs[R_IVEC] = IVEC_LONOINT;
+        s->rregs[R_INTR] &= ~INTR_RXINTA;
     } else {
-        if (s->wregs[9] & 0x10)
-            s->rregs[2] = 0x60;
+        if (s->wregs[W_MINTR] & MINTR_STATUSHI)
+            s->rregs[R_IVEC] = IVEC_HINOINT;
         else
-            s->rregs[2] = 0x06;
-        s->otherchn->rregs[3] &= ~4;
+            s->rregs[R_IVEC] = IVEC_LONOINT;
+        s->otherchn->rregs[R_INTR] &= ~INTR_RXINTB;
     }
     if (s->txint)
         set_txint(s);
@@ -234,21 +349,21 @@ static inline void set_rxint(ChannelState *s)
     if (!s->txint_under_svc) {
         s->rxint_under_svc = 1;
         if (s->chn == chn_a) {
-            if (s->wregs[9] & 0x10)
-                s->otherchn->rregs[2] = 0x30;
+            if (s->wregs[W_MINTR] & MINTR_STATUSHI)
+                s->otherchn->rregs[R_IVEC] = IVEC_HIRXINTA;
             else
-                s->otherchn->rregs[2] = 0x0c;
+                s->otherchn->rregs[R_IVEC] = IVEC_LORXINTA;
         } else {
-            if (s->wregs[9] & 0x10)
-                s->rregs[2] = 0x20;
+            if (s->wregs[W_MINTR] & MINTR_STATUSHI)
+                s->rregs[R_IVEC] = IVEC_HIRXINTB;
             else
-                s->rregs[2] = 0x04;
+                s->rregs[R_IVEC] = IVEC_LORXINTB;
         }
     }
     if (s->chn == chn_a)
-        s->rregs[3] |= 0x20;
+        s->rregs[R_INTR] |= INTR_RXINTA;
     else
-        s->otherchn->rregs[3] |= 4;
+        s->otherchn->rregs[R_INTR] |= INTR_RXINTB;
     slavio_serial_update_irq(s);
 }
 
@@ -257,17 +372,17 @@ static inline void clr_txint(ChannelState *s)
     s->txint = 0;
     s->txint_under_svc = 0;
     if (s->chn == chn_a) {
-        if (s->wregs[9] & 0x10)
-            s->otherchn->rregs[2] = 0x60;
+        if (s->wregs[W_MINTR] & MINTR_STATUSHI)
+            s->otherchn->rregs[R_IVEC] = IVEC_HINOINT;
         else
-            s->otherchn->rregs[2] = 0x06;
-        s->rregs[3] &= ~0x10;
+            s->otherchn->rregs[R_IVEC] = IVEC_LONOINT;
+        s->rregs[R_INTR] &= ~INTR_TXINTA;
     } else {
-        if (s->wregs[9] & 0x10)
-            s->rregs[2] = 0x60;
+        if (s->wregs[W_MINTR] & MINTR_STATUSHI)
+            s->rregs[R_IVEC] = IVEC_HINOINT;
         else
-            s->rregs[2] = 0x06;
-        s->otherchn->rregs[3] &= ~2;
+            s->rregs[R_IVEC] = IVEC_LONOINT;
+        s->otherchn->rregs[R_INTR] &= ~INTR_TXINTB;
     }
     if (s->rxint)
         set_rxint(s);
@@ -280,18 +395,18 @@ static inline void set_txint(ChannelState *s)
     if (!s->rxint_under_svc) {
         s->txint_under_svc = 1;
         if (s->chn == chn_a) {
-            if (s->wregs[9] & 0x10)
-                s->otherchn->rregs[2] = 0x10;
+            if (s->wregs[W_MINTR] & MINTR_STATUSHI)
+                s->otherchn->rregs[R_IVEC] = IVEC_HITXINTA;
             else
-                s->otherchn->rregs[2] = 0x08;
+                s->otherchn->rregs[R_IVEC] = IVEC_LOTXINTA;
         } else {
-            s->rregs[2] = 0;
+            s->rregs[R_IVEC] = IVEC_TXINTB;
         }
     }
     if (s->chn == chn_a)
-        s->rregs[3] |= 0x10;
+        s->rregs[R_INTR] |= INTR_TXINTA;
     else
-        s->otherchn->rregs[3] |= 2;
+        s->otherchn->rregs[R_INTR] |= INTR_TXINTB;
     slavio_serial_update_irq(s);
 }
 
@@ -303,45 +418,45 @@ static void slavio_serial_update_parameters(ChannelState *s)
     if (!s->chr || s->type != ser)
         return;
 
-    if (s->wregs[4] & 1) {
-        if (s->wregs[4] & 2)
+    if (s->wregs[W_TXCTRL1] & TXCTRL1_PAREN) {
+        if (s->wregs[W_TXCTRL1] & TXCTRL1_PAREV)
             parity = 'E';
         else
             parity = 'O';
     } else {
         parity = 'N';
     }
-    if ((s->wregs[4] & 0x0c) == 0x0c)
+    if ((s->wregs[W_TXCTRL1] & TXCTRL1_STPMSK) == TXCTRL1_2STOP)
         stop_bits = 2;
     else
         stop_bits = 1;
-    switch (s->wregs[5] & 0x60) {
-    case 0x00:
+    switch (s->wregs[W_TXCTRL2] & TXCTRL2_BITMSK) {
+    case TXCTRL2_5BITS:
         data_bits = 5;
         break;
-    case 0x20:
+    case TXCTRL2_7BITS:
         data_bits = 7;
         break;
-    case 0x40:
+    case TXCTRL2_6BITS:
         data_bits = 6;
         break;
     default:
-    case 0x60:
+    case TXCTRL2_8BITS:
         data_bits = 8;
         break;
     }
-    speed = 2457600 / ((s->wregs[12] | (s->wregs[13] << 8)) + 2);
-    switch (s->wregs[4] & 0xc0) {
-    case 0x00:
+    speed = 2457600 / ((s->wregs[W_BRGLO] | (s->wregs[W_BRGHI] << 8)) + 2);
+    switch (s->wregs[W_TXCTRL1] & TXCTRL1_CLKMSK) {
+    case TXCTRL1_CLK1X:
         break;
-    case 0x40:
+    case TXCTRL1_CLK16X:
         speed /= 16;
         break;
-    case 0x80:
+    case TXCTRL1_CLK32X:
         speed /= 32;
         break;
     default:
-    case 0xc0:
+    case TXCTRL1_CLK64X:
         speed /= 64;
         break;
     }
@@ -354,7 +469,8 @@ static void slavio_serial_update_parameters(ChannelState *s)
     qemu_chr_ioctl(s->chr, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
 }
 
-static void slavio_serial_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
+static void slavio_serial_mem_writeb(void *opaque, target_phys_addr_t addr,
+                                     uint32_t val)
 {
     SerialState *serial = opaque;
     ChannelState *s;
@@ -366,83 +482,84 @@ static void slavio_serial_mem_writeb(void *opaque, target_phys_addr_t addr, uint
     channel = (addr & SERIAL_MAXADDR) >> 2;
     s = &serial->chn[channel];
     switch (saddr) {
-    case 0:
-	SER_DPRINTF("Write channel %c, reg[%d] = %2.2x\n", CHN_C(s), s->reg, val & 0xff);
-	newreg = 0;
-	switch (s->reg) {
-	case 0:
-	    newreg = val & 7;
-	    val &= 0x38;
-	    switch (val) {
-	    case 8:
-		newreg |= 0x8;
-		break;
-	    case 0x28:
+    case SERIAL_CTRL:
+        SER_DPRINTF("Write channel %c, reg[%d] = %2.2x\n", CHN_C(s), s->reg,
+                    val & 0xff);
+        newreg = 0;
+        switch (s->reg) {
+        case W_CMD:
+            newreg = val & CMD_PTR_MASK;
+            val &= CMD_CMD_MASK;
+            switch (val) {
+            case CMD_HI:
+                newreg |= CMD_HI;
+                break;
+            case CMD_CLR_TXINT:
                 clr_txint(s);
-		break;
-	    case 0x38:
+                break;
+            case CMD_CLR_IUS:
                 if (s->rxint_under_svc)
                     clr_rxint(s);
                 else if (s->txint_under_svc)
                     clr_txint(s);
-		break;
-	    default:
-		break;
-	    }
-	    break;
-        case 1 ... 3:
-        case 6 ... 8:
-        case 10 ... 11:
-        case 14 ... 15:
-	    s->wregs[s->reg] = val;
-	    break;
-        case 4:
-        case 5:
-        case 12:
-        case 13:
-	    s->wregs[s->reg] = val;
+                break;
+            default:
+                break;
+            }
+            break;
+        case W_INTR ... W_RXCTRL:
+        case W_SYNC1 ... W_TXBUF:
+        case W_MISC1 ... W_CLOCK:
+        case W_MISC2 ... W_EXTINT:
+            s->wregs[s->reg] = val;
+            break;
+        case W_TXCTRL1:
+        case W_TXCTRL2:
+        case W_BRGLO:
+        case W_BRGHI:
+            s->wregs[s->reg] = val;
             slavio_serial_update_parameters(s);
-	    break;
-	case 9:
-	    switch (val & 0xc0) {
-	    case 0:
-	    default:
-		break;
-	    case 0x40:
-		slavio_serial_reset_chn(&serial->chn[1]);
-		return;
-	    case 0x80:
-		slavio_serial_reset_chn(&serial->chn[0]);
-		return;
-	    case 0xc0:
-		slavio_serial_reset(serial);
-		return;
-	    }
-	    break;
-	default:
-	    break;
-	}
-	if (s->reg == 0)
-	    s->reg = newreg;
-	else
-	    s->reg = 0;
-	break;
-    case 1:
-	SER_DPRINTF("Write channel %c, ch %d\n", CHN_C(s), val);
+            break;
+        case W_MINTR:
+            switch (val & MINTR_RST_MASK) {
+            case 0:
+            default:
+                break;
+            case MINTR_RST_B:
+                slavio_serial_reset_chn(&serial->chn[1]);
+                return;
+            case MINTR_RST_A:
+                slavio_serial_reset_chn(&serial->chn[0]);
+                return;
+            case MINTR_RST_ALL:
+                slavio_serial_reset(serial);
+                return;
+            }
+            break;
+        default:
+            break;
+        }
+        if (s->reg == 0)
+            s->reg = newreg;
+        else
+            s->reg = 0;
+        break;
+    case SERIAL_DATA:
+        SER_DPRINTF("Write channel %c, ch %d\n", CHN_C(s), val);
         s->tx = val;
-	if (s->wregs[5] & 8) { // tx enabled
-	    if (s->chr)
-		qemu_chr_write(s->chr, &s->tx, 1);
-	    else if (s->type == kbd) {
-		handle_kbd_command(s, val);
-	    }
-	}
-        s->rregs[0] |= 4; // Tx buffer empty
-        s->rregs[1] |= 1; // All sent
+        if (s->wregs[W_TXCTRL2] & TXCTRL2_TXEN) { // tx enabled
+            if (s->chr)
+                qemu_chr_write(s->chr, &s->tx, 1);
+            else if (s->type == kbd && !s->disabled) {
+                handle_kbd_command(s, val);
+            }
+        }
+        s->rregs[R_STATUS] |= STATUS_TXEMPTY; // Tx buffer empty
+        s->rregs[R_SPEC] |= SPEC_ALLSENT; // All sent
         set_txint(s);
-	break;
+        break;
     default:
-	break;
+        break;
     }
 }
 
@@ -458,22 +575,25 @@ static uint32_t slavio_serial_mem_readb(void *opaque, target_phys_addr_t addr)
     channel = (addr & SERIAL_MAXADDR) >> 2;
     s = &serial->chn[channel];
     switch (saddr) {
-    case 0:
-	SER_DPRINTF("Read channel %c, reg[%d] = %2.2x\n", CHN_C(s), s->reg, s->rregs[s->reg]);
-	ret = s->rregs[s->reg];
-	s->reg = 0;
-	return ret;
-    case 1:
-	s->rregs[0] &= ~1;
+    case SERIAL_CTRL:
+        SER_DPRINTF("Read channel %c, reg[%d] = %2.2x\n", CHN_C(s), s->reg,
+                    s->rregs[s->reg]);
+        ret = s->rregs[s->reg];
+        s->reg = 0;
+        return ret;
+    case SERIAL_DATA:
+        s->rregs[R_STATUS] &= ~STATUS_RXAV;
         clr_rxint(s);
-	if (s->type == kbd || s->type == mouse)
-	    ret = get_queue(s);
-	else
-	    ret = s->rx;
-	SER_DPRINTF("Read channel %c, ch %d\n", CHN_C(s), ret);
-	return ret;
+        if (s->type == kbd || s->type == mouse)
+            ret = get_queue(s);
+        else
+            ret = s->rx;
+        SER_DPRINTF("Read channel %c, ch %d\n", CHN_C(s), ret);
+        if (s->chr)
+            qemu_chr_accept_input(s->chr);
+        return ret;
     default:
-	break;
+        break;
     }
     return 0;
 }
@@ -483,26 +603,26 @@ static int serial_can_receive(void *opaque)
     ChannelState *s = opaque;
     int ret;
 
-    if (((s->wregs[3] & 1) == 0) // Rx not enabled
-	|| ((s->rregs[0] & 1) == 1)) // char already available
-	ret = 0;
+    if (((s->wregs[W_RXCTRL] & RXCTRL_RXEN) == 0) // Rx not enabled
+        || ((s->rregs[R_STATUS] & STATUS_RXAV) == STATUS_RXAV))
+        // char already available
+        ret = 0;
     else
-	ret = 1;
-    //SER_DPRINTF("channel %c can receive %d\n", CHN_C(s), ret);
+        ret = 1;
     return ret;
 }
 
 static void serial_receive_byte(ChannelState *s, int ch)
 {
     SER_DPRINTF("channel %c put ch %d\n", CHN_C(s), ch);
-    s->rregs[0] |= 1;
+    s->rregs[R_STATUS] |= STATUS_RXAV;
     s->rx = ch;
     set_rxint(s);
 }
 
 static void serial_receive_break(ChannelState *s)
 {
-    s->rregs[0] |= 0x80;
+    s->rregs[R_STATUS] |= STATUS_BRK;
     slavio_serial_update_irq(s);
 }
 
@@ -543,8 +663,8 @@ static void slavio_serial_save_chn(QEMUFile *f, ChannelState *s)
     qemu_put_be32s(f, &s->txint_under_svc);
     qemu_put_8s(f, &s->rx);
     qemu_put_8s(f, &s->tx);
-    qemu_put_buffer(f, s->wregs, 16);
-    qemu_put_buffer(f, s->rregs, 16);
+    qemu_put_buffer(f, s->wregs, SERIAL_REGS);
+    qemu_put_buffer(f, s->rregs, SERIAL_REGS);
 }
 
 static void slavio_serial_save(QEMUFile *f, void *opaque)
@@ -572,8 +692,8 @@ static int slavio_serial_load_chn(QEMUFile *f, ChannelState *s, int version_id)
     }
     qemu_get_8s(f, &s->rx);
     qemu_get_8s(f, &s->tx);
-    qemu_get_buffer(f, s->wregs, 16);
-    qemu_get_buffer(f, s->rregs, 16);
+    qemu_get_buffer(f, s->wregs, SERIAL_REGS);
+    qemu_get_buffer(f, s->rregs, SERIAL_REGS);
     return 0;
 }
 
@@ -584,7 +704,7 @@ static int slavio_serial_load(QEMUFile *f, void *opaque, int version_id)
 
     ret = slavio_serial_load_chn(f, &s->chn[0], version_id);
     if (ret != 0)
-	return ret;
+        return ret;
     ret = slavio_serial_load_chn(f, &s->chn[1], version_id);
     return ret;
 
@@ -600,24 +720,29 @@ SerialState *slavio_serial_init(target_phys_addr_t base, qemu_irq irq,
     if (!s)
         return NULL;
 
-    slavio_serial_io_memory = cpu_register_io_memory(0, slavio_serial_mem_read, slavio_serial_mem_write, s);
+    slavio_serial_io_memory = cpu_register_io_memory(0, slavio_serial_mem_read,
+                                                     slavio_serial_mem_write,
+                                                     s);
     cpu_register_physical_memory(base, SERIAL_SIZE, slavio_serial_io_memory);
 
     s->chn[0].chr = chr1;
     s->chn[1].chr = chr2;
+    s->chn[0].disabled = 0;
+    s->chn[1].disabled = 0;
 
     for (i = 0; i < 2; i++) {
-	s->chn[i].irq = irq;
-	s->chn[i].chn = 1 - i;
-	s->chn[i].type = ser;
-	if (s->chn[i].chr) {
-	    qemu_chr_add_handlers(s->chn[i].chr, serial_can_receive,
+        s->chn[i].irq = irq;
+        s->chn[i].chn = 1 - i;
+        s->chn[i].type = ser;
+        if (s->chn[i].chr) {
+            qemu_chr_add_handlers(s->chn[i].chr, serial_can_receive,
                                   serial_receive1, serial_event, &s->chn[i]);
-	}
+        }
     }
     s->chn[0].otherchn = &s->chn[1];
     s->chn[1].otherchn = &s->chn[0];
-    register_savevm("slavio_serial", base, 2, slavio_serial_save, slavio_serial_load, s);
+    register_savevm("slavio_serial", base, 2, slavio_serial_save,
+                    slavio_serial_load, s);
     qemu_register_reset(slavio_serial_reset, s);
     slavio_serial_reset(s);
     return s;
@@ -650,7 +775,8 @@ static void sunkbd_event(void *opaque, int ch)
     ChannelState *s = opaque;
     int release = ch & 0x80;
 
-    KBD_DPRINTF("Untranslated keycode %2.2x (%s)\n", ch, release? "release" : "press");
+    KBD_DPRINTF("Untranslated keycode %2.2x (%s)\n", ch, release? "release" :
+                "press");
     switch (ch) {
     case 58: // Caps lock press
         s->caps_lock_mode ^= 1;
@@ -698,21 +824,21 @@ static void handle_kbd_command(ChannelState *s, int val)
     switch (val) {
     case 1: // Reset, return type code
         clear_queue(s);
-	put_queue(s, 0xff);
-	put_queue(s, 4); // Type 4
-	put_queue(s, 0x7f);
-	break;
+        put_queue(s, 0xff);
+        put_queue(s, 4); // Type 4
+        put_queue(s, 0x7f);
+        break;
     case 0xe: // Set leds
         s->led_mode = 1;
         break;
     case 7: // Query layout
     case 0xf:
         clear_queue(s);
-	put_queue(s, 0xfe);
-	put_queue(s, 0); // XXX, layout?
-	break;
+        put_queue(s, 0xfe);
+        put_queue(s, 0); // XXX, layout?
+        break;
     default:
-	break;
+        break;
     }
 }
 
@@ -759,7 +885,8 @@ static void sunmouse_event(void *opaque,
     put_queue(s, 0);
 }
 
-void slavio_serial_ms_kbd_init(target_phys_addr_t base, qemu_irq irq)
+void slavio_serial_ms_kbd_init(target_phys_addr_t base, qemu_irq irq,
+                               int disabled)
 {
     int slavio_serial_io_memory, i;
     SerialState *s;
@@ -768,21 +895,27 @@ void slavio_serial_ms_kbd_init(target_phys_addr_t base, qemu_irq irq)
     if (!s)
         return;
     for (i = 0; i < 2; i++) {
-	s->chn[i].irq = irq;
-	s->chn[i].chn = 1 - i;
-	s->chn[i].chr = NULL;
+        s->chn[i].irq = irq;
+        s->chn[i].chn = 1 - i;
+        s->chn[i].chr = NULL;
     }
     s->chn[0].otherchn = &s->chn[1];
     s->chn[1].otherchn = &s->chn[0];
     s->chn[0].type = mouse;
     s->chn[1].type = kbd;
+    s->chn[0].disabled = disabled;
+    s->chn[1].disabled = disabled;
 
-    slavio_serial_io_memory = cpu_register_io_memory(0, slavio_serial_mem_read, slavio_serial_mem_write, s);
+    slavio_serial_io_memory = cpu_register_io_memory(0, slavio_serial_mem_read,
+                                                     slavio_serial_mem_write,
+                                                     s);
     cpu_register_physical_memory(base, SERIAL_SIZE, slavio_serial_io_memory);
 
-    qemu_add_mouse_event_handler(sunmouse_event, &s->chn[0], 0, "QEMU Sun Mouse");
+    qemu_add_mouse_event_handler(sunmouse_event, &s->chn[0], 0,
+                                 "QEMU Sun Mouse");
     qemu_add_kbd_event_handler(sunkbd_event, &s->chn[1]);
-    register_savevm("slavio_serial_mouse", base, 2, slavio_serial_save, slavio_serial_load, s);
+    register_savevm("slavio_serial_mouse", base, 2, slavio_serial_save,
+                    slavio_serial_load, s);
     qemu_register_reset(slavio_serial_reset, s);
     slavio_serial_reset(s);
 }
diff --git a/hw/slavio_timer.c b/hw/slavio_timer.c
index d3c75bf3a..7d9ee4b2a 100644
--- a/hw/slavio_timer.c
+++ b/hw/slavio_timer.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "sun4m.h"
+#include "qemu-timer.h"
 
 //#define DEBUG_TIMER
 
@@ -47,17 +49,48 @@ do { printf("TIMER: " fmt , ##args); } while (0)
  *
  */
 
+#define MAX_CPUS 16
+
 typedef struct SLAVIO_TIMERState {
     qemu_irq irq;
     ptimer_state *timer;
     uint32_t count, counthigh, reached;
     uint64_t limit;
-    int stopped;
-    int mode; // 0 = processor, 1 = user, 2 = system
+    // processor only
+    int running;
+    struct SLAVIO_TIMERState *master;
+    int slave_index;
+    // system only
+    struct SLAVIO_TIMERState *slave[MAX_CPUS];
+    uint32_t slave_mode;
 } SLAVIO_TIMERState;
 
 #define TIMER_MAXADDR 0x1f
-#define TIMER_SIZE (TIMER_MAXADDR + 1)
+#define SYS_TIMER_SIZE 0x14
+#define CPU_TIMER_SIZE 0x10
+
+#define SYS_TIMER_OFFSET      0x10000ULL
+#define CPU_TIMER_OFFSET(cpu) (0x1000ULL * cpu)
+
+#define TIMER_LIMIT         0
+#define TIMER_COUNTER       1
+#define TIMER_COUNTER_NORST 2
+#define TIMER_STATUS        3
+#define TIMER_MODE          4
+
+#define TIMER_COUNT_MASK32 0xfffffe00
+#define TIMER_LIMIT_MASK32 0x7fffffff
+#define TIMER_MAX_COUNT64  0x7ffffffffffffe00ULL
+#define TIMER_MAX_COUNT32  0x7ffffe00ULL
+#define TIMER_REACHED      0x80000000
+#define TIMER_PERIOD       500ULL // 500ns
+#define LIMIT_TO_PERIODS(l) ((l) >> 9)
+#define PERIODS_TO_LIMIT(l) ((l) << 9)
+
+static int slavio_timer_is_user(SLAVIO_TIMERState *s)
+{
+    return s->master && (s->master->slave_mode & (1 << s->slave_index));
+}
 
 // Update count, set irq, update expire_time
 // Convert from ptimer countdown units
@@ -65,10 +98,10 @@ static void slavio_timer_get_out(SLAVIO_TIMERState *s)
 {
     uint64_t count;
 
-    count = s->limit - (ptimer_get_count(s->timer) << 9);
-    DPRINTF("get_out: limit %" PRIx64 " count %x%08x\n", s->limit, s->counthigh,
-            s->count);
-    s->count = count & 0xfffffe00;
+    count = s->limit - PERIODS_TO_LIMIT(ptimer_get_count(s->timer));
+    DPRINTF("get_out: limit %" PRIx64 " count %x%08x\n", s->limit,
+            s->counthigh, s->count);
+    s->count = count & TIMER_COUNT_MASK32;
     s->counthigh = count >> 32;
 }
 
@@ -79,9 +112,10 @@ static void slavio_timer_irq(void *opaque)
 
     slavio_timer_get_out(s);
     DPRINTF("callback: count %x%08x\n", s->counthigh, s->count);
-    s->reached = 0x80000000;
-    if (s->mode != 1)
-	qemu_irq_raise(s->irq);
+    if (!slavio_timer_is_user(s)) {
+        s->reached = TIMER_REACHED;
+        qemu_irq_raise(s->irq);
+    }
 }
 
 static uint32_t slavio_timer_mem_readl(void *opaque, target_phys_addr_t addr)
@@ -91,38 +125,42 @@ static uint32_t slavio_timer_mem_readl(void *opaque, target_phys_addr_t addr)
 
     saddr = (addr & TIMER_MAXADDR) >> 2;
     switch (saddr) {
-    case 0:
-	// read limit (system counter mode) or read most signifying
-	// part of counter (user mode)
-	if (s->mode != 1) {
-	    // clear irq
+    case TIMER_LIMIT:
+        // read limit (system counter mode) or read most signifying
+        // part of counter (user mode)
+        if (slavio_timer_is_user(s)) {
+            // read user timer MSW
+            slavio_timer_get_out(s);
+            ret = s->counthigh;
+        } else {
+            // read limit
+            // clear irq
             qemu_irq_lower(s->irq);
-	    s->reached = 0;
-            ret = s->limit & 0x7fffffff;
-	}
-	else {
-	    slavio_timer_get_out(s);
-            ret = s->counthigh & 0x7fffffff;
-	}
+            s->reached = 0;
+            ret = s->limit & TIMER_LIMIT_MASK32;
+        }
         break;
-    case 1:
-	// read counter and reached bit (system mode) or read lsbits
-	// of counter (user mode)
-	slavio_timer_get_out(s);
-	if (s->mode != 1)
-            ret = (s->count & 0x7fffffff) | s->reached;
-	else
-            ret = s->count;
+    case TIMER_COUNTER:
+        // read counter and reached bit (system mode) or read lsbits
+        // of counter (user mode)
+        slavio_timer_get_out(s);
+        if (slavio_timer_is_user(s)) // read user timer LSW
+            ret = s->count & TIMER_COUNT_MASK32;
+        else // read limit
+            ret = (s->count & TIMER_MAX_COUNT32) | s->reached;
         break;
-    case 3:
-	// read start/stop status
-        ret = s->stopped;
+    case TIMER_STATUS:
+        // only available in processor counter/timer
+        // read start/stop status
+        ret = s->running;
         break;
-    case 4:
-	// read user/system mode
-        ret = s->mode & 1;
+    case TIMER_MODE:
+        // only available in system counter
+        // read user/system mode
+        ret = s->slave_mode;
         break;
     default:
+        DPRINTF("invalid read address " TARGET_FMT_plx "\n", addr);
         ret = 0;
         break;
     }
@@ -131,7 +169,8 @@ static uint32_t slavio_timer_mem_readl(void *opaque, target_phys_addr_t addr)
     return ret;
 }
 
-static void slavio_timer_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
+static void slavio_timer_mem_writel(void *opaque, target_phys_addr_t addr,
+                                    uint32_t val)
 {
     SLAVIO_TIMERState *s = opaque;
     uint32_t saddr;
@@ -140,43 +179,78 @@ static void slavio_timer_mem_writel(void *opaque, target_phys_addr_t addr, uint3
     DPRINTF("write " TARGET_FMT_plx " %08x\n", addr, val);
     saddr = (addr & TIMER_MAXADDR) >> 2;
     switch (saddr) {
-    case 0:
-	// set limit, reset counter
-        reload = 1;
-	qemu_irq_lower(s->irq);
-	// fall through
-    case 2:
-	// set limit without resetting counter
-        s->limit = val & 0x7ffffe00ULL;
+    case TIMER_LIMIT:
+        if (slavio_timer_is_user(s)) {
+            // set user counter MSW, reset counter
+            qemu_irq_lower(s->irq);
+            s->limit = TIMER_MAX_COUNT64;
+            DPRINTF("processor %d user timer reset\n", s->slave_index);
+            ptimer_set_limit(s->timer, LIMIT_TO_PERIODS(s->limit), 1);
+        } else {
+            // set limit, reset counter
+            qemu_irq_lower(s->irq);
+            s->limit = val & TIMER_MAX_COUNT32;
+            if (!s->limit)
+                s->limit = TIMER_MAX_COUNT32;
+            ptimer_set_limit(s->timer, s->limit >> 9, 1);
+        }
+        break;
+    case TIMER_COUNTER:
+        if (slavio_timer_is_user(s)) {
+            // set user counter LSW, reset counter
+            qemu_irq_lower(s->irq);
+            s->limit = TIMER_MAX_COUNT64;
+            DPRINTF("processor %d user timer reset\n", s->slave_index);
+            ptimer_set_limit(s->timer, LIMIT_TO_PERIODS(s->limit), 1);
+        } else
+            DPRINTF("not user timer\n");
+        break;
+    case TIMER_COUNTER_NORST:
+        // set limit without resetting counter
+        s->limit = val & TIMER_MAX_COUNT32;
         if (!s->limit)
-            s->limit = 0x7ffffe00ULL;
-        ptimer_set_limit(s->timer, s->limit >> 9, reload);
-	break;
-    case 3:
-	// start/stop user counter
-	if (s->mode == 1) {
-	    if (val & 1) {
-                ptimer_stop(s->timer);
-		s->stopped = 1;
-	    }
-	    else {
+            s->limit = TIMER_MAX_COUNT32;
+        ptimer_set_limit(s->timer, LIMIT_TO_PERIODS(s->limit), reload);
+        break;
+    case TIMER_STATUS:
+        if (slavio_timer_is_user(s)) {
+            // start/stop user counter
+            if ((val & 1) && !s->running) {
+                DPRINTF("processor %d user timer started\n", s->slave_index);
                 ptimer_run(s->timer, 0);
-		s->stopped = 0;
-	    }
-	}
-	break;
-    case 4:
-	// bit 0: user (1) or system (0) counter mode
-	if (s->mode == 0 || s->mode == 1)
-	    s->mode = val & 1;
-        if (s->mode == 1) {
-            qemu_irq_lower(s->irq);
-            s->limit = -1ULL;
+                s->running = 1;
+            } else if (!(val & 1) && s->running) {
+                DPRINTF("processor %d user timer stopped\n", s->slave_index);
+                ptimer_stop(s->timer);
+                s->running = 0;
+            }
         }
-        ptimer_set_limit(s->timer, s->limit >> 9, 1);
-	break;
+        break;
+    case TIMER_MODE:
+        if (s->master == NULL) {
+            unsigned int i;
+
+            for (i = 0; i < MAX_CPUS; i++) {
+                if (val & (1 << i)) {
+                    qemu_irq_lower(s->slave[i]->irq);
+                    s->slave[i]->limit = -1ULL;
+                }
+                if ((val & (1 << i)) != (s->slave_mode & (1 << i))) {
+                    ptimer_stop(s->slave[i]->timer);
+                    ptimer_set_limit(s->slave[i]->timer,
+                                     LIMIT_TO_PERIODS(s->slave[i]->limit), 1);
+                    DPRINTF("processor %d timer changed\n",
+                            s->slave[i]->slave_index);
+                    ptimer_run(s->slave[i]->timer, 0);
+                }
+            }
+            s->slave_mode = val & ((1 << MAX_CPUS) - 1);
+        } else
+            DPRINTF("not system timer\n");
+        break;
     default:
-	break;
+        DPRINTF("invalid write address " TARGET_FMT_plx "\n", addr);
+        break;
     }
 }
 
@@ -201,8 +275,8 @@ static void slavio_timer_save(QEMUFile *f, void *opaque)
     qemu_put_be32s(f, &s->counthigh);
     qemu_put_be32(f, 0); // Was irq
     qemu_put_be32s(f, &s->reached);
-    qemu_put_be32s(f, &s->stopped);
-    qemu_put_be32s(f, &s->mode);
+    qemu_put_be32s(f, &s->running);
+    qemu_put_be32s(f, 0); // Was mode
     qemu_put_ptimer(f, s->timer);
 }
 
@@ -219,8 +293,8 @@ static int slavio_timer_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_be32s(f, &s->counthigh);
     qemu_get_be32s(f, &tmp); // Was irq
     qemu_get_be32s(f, &s->reached);
-    qemu_get_be32s(f, &s->stopped);
-    qemu_get_be32s(f, &s->mode);
+    qemu_get_be32s(f, &s->running);
+    qemu_get_be32s(f, &tmp); // Was mode
     qemu_get_ptimer(f, s->timer);
 
     return 0;
@@ -230,17 +304,22 @@ static void slavio_timer_reset(void *opaque)
 {
     SLAVIO_TIMERState *s = opaque;
 
-    s->limit = 0x7ffffe00ULL;
+    if (slavio_timer_is_user(s))
+        s->limit = TIMER_MAX_COUNT64;
+    else
+        s->limit = TIMER_MAX_COUNT32;
     s->count = 0;
     s->reached = 0;
-    s->mode &= 2;
-    ptimer_set_limit(s->timer, s->limit >> 9, 1);
+    ptimer_set_limit(s->timer, LIMIT_TO_PERIODS(s->limit), 1);
     ptimer_run(s->timer, 0);
-    s->stopped = 1;
+    s->running = 1;
     qemu_irq_lower(s->irq);
 }
 
-void slavio_timer_init(target_phys_addr_t addr, qemu_irq irq, int mode)
+static SLAVIO_TIMERState *slavio_timer_init(target_phys_addr_t addr,
+                                            qemu_irq irq,
+                                            SLAVIO_TIMERState *master,
+                                            int slave_index)
 {
     int slavio_timer_io_memory;
     SLAVIO_TIMERState *s;
@@ -248,17 +327,41 @@ void slavio_timer_init(target_phys_addr_t addr, qemu_irq irq, int mode)
 
     s = qemu_mallocz(sizeof(SLAVIO_TIMERState));
     if (!s)
-        return;
+        return s;
     s->irq = irq;
-    s->mode = mode;
+    s->master = master;
+    s->slave_index = slave_index;
     bh = qemu_bh_new(slavio_timer_irq, s);
     s->timer = ptimer_init(bh);
-    ptimer_set_period(s->timer, 500ULL);
+    ptimer_set_period(s->timer, TIMER_PERIOD);
 
     slavio_timer_io_memory = cpu_register_io_memory(0, slavio_timer_mem_read,
-						    slavio_timer_mem_write, s);
-    cpu_register_physical_memory(addr, TIMER_SIZE, slavio_timer_io_memory);
-    register_savevm("slavio_timer", addr, 2, slavio_timer_save, slavio_timer_load, s);
+                                                    slavio_timer_mem_write, s);
+    if (master)
+        cpu_register_physical_memory(addr, CPU_TIMER_SIZE,
+                                     slavio_timer_io_memory);
+    else
+        cpu_register_physical_memory(addr, SYS_TIMER_SIZE,
+                                     slavio_timer_io_memory);
+    register_savevm("slavio_timer", addr, 2, slavio_timer_save,
+                    slavio_timer_load, s);
     qemu_register_reset(slavio_timer_reset, s);
     slavio_timer_reset(s);
+
+    return s;
+}
+
+void slavio_timer_init_all(target_phys_addr_t base, qemu_irq master_irq,
+                           qemu_irq *cpu_irqs)
+{
+    SLAVIO_TIMERState *master;
+    unsigned int i;
+
+    master = slavio_timer_init(base + SYS_TIMER_OFFSET, master_irq, NULL, 0);
+
+    for (i = 0; i < MAX_CPUS; i++) {
+        master->slave[i] = slavio_timer_init(base + (target_phys_addr_t)
+                                             CPU_TIMER_OFFSET(i),
+                                             cpu_irqs[i], master, i);
+    }
 }
diff --git a/hw/smbus.c b/hw/smbus.c
index 103e9177b..6eb841240 100644
--- a/hw/smbus.c
+++ b/hw/smbus.c
@@ -9,7 +9,9 @@
 
 /* TODO: Implement PEC.  */
 
-#include "vl.h"
+#include "hw.h"
+#include "i2c.h"
+#include "smbus.h"
 
 //#define DEBUG_SMBUS 1
 
@@ -59,7 +61,7 @@ static void smbus_do_write(SMBusDevice *dev)
     }
 }
 
-void smbus_i2c_event(i2c_slave *s, enum i2c_event event)
+static void smbus_i2c_event(i2c_slave *s, enum i2c_event event)
 {
     SMBusDevice *dev = (SMBusDevice *)s;
     switch (event) {
@@ -194,7 +196,7 @@ SMBusDevice *smbus_device_init(i2c_bus *bus, int address, int size)
     SMBusDevice *dev;
 
     if (size < sizeof(SMBusDevice))
-        cpu_abort(cpu_single_env, "SMBus struct too small");
+        hw_error("SMBus struct too small");
 
     dev = (SMBusDevice *)i2c_slave_init(bus, address, size);
     dev->i2c.event = smbus_i2c_event;
diff --git a/hw/smbus.h b/hw/smbus.h
index 0d35bb68a..b6b066240 100644
--- a/hw/smbus.h
+++ b/hw/smbus.h
@@ -22,7 +22,7 @@
  * THE SOFTWARE.
  */
 
-typedef struct SMBusDevice SMBusDevice;
+#include "i2c.h"
 
 struct SMBusDevice {
     /* The SMBus protocol is implemented on top of I2C.  */
diff --git a/hw/smbus_eeprom.c b/hw/smbus_eeprom.c
index cf54c34c3..39cf1ce41 100644
--- a/hw/smbus_eeprom.c
+++ b/hw/smbus_eeprom.c
@@ -22,7 +22,9 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "i2c.h"
+#include "smbus.h"
 
 //#define DEBUG
 
diff --git a/hw/smc91c111.c b/hw/smc91c111.c
index b8d0cba5f..410051d3c 100644
--- a/hw/smc91c111.c
+++ b/hw/smc91c111.c
@@ -7,7 +7,9 @@
  * This code is licenced under the GPL
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "net.h"
+#include "devices.h"
 /* For crc32 */
 #include <zlib.h>
 
@@ -413,7 +415,7 @@ static void smc91c111_writeb(void *opaque, target_phys_addr_t offset,
         break;
     }
     cpu_abort (cpu_single_env, "smc91c111_write: Bad reg %d:%x\n",
-               s->bank, offset);
+               s->bank, (int)offset);
 }
 
 static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
@@ -555,7 +557,7 @@ static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
         break;
     }
     cpu_abort (cpu_single_env, "smc91c111_read: Bad reg %d:%x\n",
-               s->bank, offset);
+               s->bank, (int)offset);
     return 0;
 }
 
diff --git a/hw/sparc32_dma.c b/hw/sparc32_dma.c
index 3c80fd67f..742f2d871 100644
--- a/hw/sparc32_dma.c
+++ b/hw/sparc32_dma.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "sparc32_dma.h"
+#include "sun4m.h"
 
 /* debug DMA */
 //#define DEBUG_DMA
diff --git a/hw/sparc32_dma.h b/hw/sparc32_dma.h
new file mode 100644
index 000000000..00b892164
--- /dev/null
+++ b/hw/sparc32_dma.h
@@ -0,0 +1,14 @@
+#ifndef SPARC32_DMA_H
+#define SPARC32_DMA_H
+
+/* sparc32_dma.c */
+void *sparc32_dma_init(target_phys_addr_t daddr, qemu_irq parent_irq,
+                       void *iommu, qemu_irq **dev_irq, qemu_irq **reset);
+void ledma_memory_read(void *opaque, target_phys_addr_t addr,
+                       uint8_t *buf, int len, int do_bswap);
+void ledma_memory_write(void *opaque, target_phys_addr_t addr,
+                        uint8_t *buf, int len, int do_bswap);
+void espdma_memory_read(void *opaque, uint8_t *buf, int len);
+void espdma_memory_write(void *opaque, uint8_t *buf, int len);
+
+#endif
diff --git a/hw/spitz.c b/hw/spitz.c
index 540e1b206..159c63378 100644
--- a/hw/spitz.c
+++ b/hw/spitz.c
@@ -7,12 +7,28 @@
  * This code is licensed under the GNU GPL v2.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pxa.h"
+#include "arm-misc.h"
+#include "sysemu.h"
+#include "pcmcia.h"
+#include "i2c.h"
+#include "flash.h"
+#include "qemu-timer.h"
+#include "devices.h"
+#include "console.h"
+#include "block.h"
+#include "audio/audio.h"
+#include "boards.h"
 
 #define spitz_printf(format, ...)	\
     fprintf(stderr, "%s: " format, __FUNCTION__, ##__VA_ARGS__)
 #undef REG_FMT
+#if TARGET_PHYS_ADDR_BITS == 32
+#define REG_FMT			"0x%02x"
+#else
 #define REG_FMT			"0x%02lx"
+#endif
 
 /* Spitz Flash */
 #define FLASH_BASE		0x0c000000
@@ -194,8 +210,8 @@ static int spitz_keymap[SPITZ_KEY_SENSE_NUM + 1][SPITZ_KEY_STROBE_NUM] = {
     { 0x0f, 0x10, 0x12, 0x14, 0x22, 0x16, 0x24, 0x25,  -1 ,  -1 ,  -1  },
     { 0x3c, 0x11, 0x1f, 0x21, 0x2f, 0x23, 0x32, 0x26,  -1 , 0x36,  -1  },
     { 0x3b, 0x1e, 0x20, 0x2e, 0x30, 0x31, 0x34,  -1 , 0x1c, 0x2a,  -1  },
-    { 0x44, 0x2c, 0x2d, 0x0c, 0x39, 0x33,  -1 , 0x48,  -1 ,  -1 , 0x3d },
-    { 0x37, 0x38,  -1 , 0x45, 0x57, 0x58, 0x4b, 0x50, 0x4d,  -1 ,  -1  },
+    { 0x44, 0x2c, 0x2d, 0x0c, 0x39, 0x33,  -1 , 0x48,  -1 ,  -1 , 0x38 },
+    { 0x37, 0x3d,  -1 , 0x45, 0x57, 0x58, 0x4b, 0x50, 0x4d,  -1 ,  -1  },
     { 0x52, 0x43, 0x01, 0x47, 0x49,  -1 ,  -1 ,  -1 ,  -1 ,  -1 ,  -1  },
 };
 
@@ -213,7 +229,9 @@ static const int spitz_gpiomap[5] = {
 static int spitz_gpio_invert[5] = { 0, 0, 0, 0, 0, };
 
 struct spitz_keyboard_s {
-    struct pxa2xx_state_s *cpu;
+    qemu_irq sense[SPITZ_KEY_SENSE_NUM];
+    qemu_irq *strobe;
+    qemu_irq gpiomap[5];
     int keymap[0x80];
     uint16_t keyrow[SPITZ_KEY_SENSE_NUM];
     uint16_t strobe_state;
@@ -236,28 +254,23 @@ static void spitz_keyboard_sense_update(struct spitz_keyboard_s *s)
         if (strobe) {
             sense |= 1 << i;
             if (!(s->sense_state & (1 << i)))
-                pxa2xx_gpio_set(s->cpu->gpio, spitz_gpio_key_sense[i], 1);
+                qemu_irq_raise(s->sense[i]);
         } else if (s->sense_state & (1 << i))
-            pxa2xx_gpio_set(s->cpu->gpio, spitz_gpio_key_sense[i], 0);
+            qemu_irq_lower(s->sense[i]);
     }
 
     s->sense_state = sense;
 }
 
-static void spitz_keyboard_strobe(int line, int level,
-                struct spitz_keyboard_s *s)
+static void spitz_keyboard_strobe(void *opaque, int line, int level)
 {
-    int i;
-    for (i = 0; i < SPITZ_KEY_STROBE_NUM; i ++)
-        if (spitz_gpio_key_strobe[i] == line) {
-            if (level)
-                s->strobe_state |= 1 << i;
-            else
-                s->strobe_state &= ~(1 << i);
-
-            spitz_keyboard_sense_update(s);
-            break;
-        }
+    struct spitz_keyboard_s *s = (struct spitz_keyboard_s *) opaque;
+
+    if (level)
+        s->strobe_state |= 1 << line;
+    else
+        s->strobe_state &= ~(1 << line);
+    spitz_keyboard_sense_update(s);
 }
 
 static void spitz_keyboard_keydown(struct spitz_keyboard_s *s, int keycode)
@@ -268,8 +281,7 @@ static void spitz_keyboard_keydown(struct spitz_keyboard_s *s, int keycode)
 
     /* Handle the additional keys */
     if ((spitz_keycode >> 4) == SPITZ_KEY_SENSE_NUM) {
-        pxa2xx_gpio_set(s->cpu->gpio, spitz_gpiomap[spitz_keycode & 0xf],
-                        (keycode < 0x80) ^
+        qemu_set_irq(s->gpiomap[spitz_keycode & 0xf], (keycode < 0x80) ^
                         spitz_gpio_invert[spitz_keycode & 0xf]);
         return;
     }
@@ -415,13 +427,17 @@ static void spitz_keyboard_pre_map(struct spitz_keyboard_s *s)
     s->pre_map[0x0d | SHIFT	] = 0x13 | FN;		/* plus */
     s->pre_map[0x1a		] = 0x14 | FN;		/* bracketleft */
     s->pre_map[0x1b		] = 0x15 | FN;		/* bracketright */
+    s->pre_map[0x1a | SHIFT	] = 0x16 | FN;		/* braceleft */
+    s->pre_map[0x1b | SHIFT	] = 0x17 | FN;		/* braceright */
     s->pre_map[0x27		] = 0x22 | FN;		/* semicolon */
     s->pre_map[0x27 | SHIFT	] = 0x23 | FN;		/* colon */
     s->pre_map[0x09 | SHIFT	] = 0x24 | FN;		/* asterisk */
     s->pre_map[0x2b		] = 0x25 | FN;		/* backslash */
     s->pre_map[0x2b | SHIFT	] = 0x26 | FN;		/* bar */
     s->pre_map[0x0c | SHIFT	] = 0x30 | FN;		/* underscore */
+    s->pre_map[0x33 | SHIFT	] = 0x33 | FN;		/* less */
     s->pre_map[0x35		] = 0x33 | SHIFT;	/* slash */
+    s->pre_map[0x34 | SHIFT	] = 0x34 | FN;		/* greater */
     s->pre_map[0x35 | SHIFT	] = 0x34 | SHIFT;	/* question */
     s->pre_map[0x49		] = 0x48 | FN;		/* Page_Up */
     s->pre_map[0x51		] = 0x50 | FN;		/* Page_Down */
@@ -478,7 +494,6 @@ static void spitz_keyboard_register(struct pxa2xx_state_s *cpu)
     s = (struct spitz_keyboard_s *)
             qemu_mallocz(sizeof(struct spitz_keyboard_s));
     memset(s, 0, sizeof(struct spitz_keyboard_s));
-    s->cpu = cpu;
 
     for (i = 0; i < 0x80; i ++)
         s->keymap[i] = -1;
@@ -487,9 +502,16 @@ static void spitz_keyboard_register(struct pxa2xx_state_s *cpu)
             if (spitz_keymap[i][j] != -1)
                 s->keymap[spitz_keymap[i][j]] = (i << 4) | j;
 
+    for (i = 0; i < SPITZ_KEY_SENSE_NUM; i ++)
+        s->sense[i] = pxa2xx_gpio_in_get(cpu->gpio)[spitz_gpio_key_sense[i]];
+
+    for (i = 0; i < 5; i ++)
+        s->gpiomap[i] = pxa2xx_gpio_in_get(cpu->gpio)[spitz_gpiomap[i]];
+
+    s->strobe = qemu_allocate_irqs(spitz_keyboard_strobe, s,
+                    SPITZ_KEY_STROBE_NUM);
     for (i = 0; i < SPITZ_KEY_STROBE_NUM; i ++)
-        pxa2xx_gpio_handler_set(cpu->gpio, spitz_gpio_key_strobe[i],
-                        (gpio_handler_t) spitz_keyboard_strobe, s);
+        pxa2xx_gpio_out_set(cpu->gpio, spitz_gpio_key_strobe[i], s->strobe[i]);
 
     spitz_keyboard_pre_map(s);
     qemu_add_kbd_event_handler((QEMUPutKBDEvent *) spitz_keyboard_handler, s);
@@ -502,15 +524,13 @@ static void spitz_keyboard_register(struct pxa2xx_state_s *cpu)
 
 struct scoop_info_s {
     target_phys_addr_t target_base;
+    qemu_irq handler[16];
+    qemu_irq *in;
     uint16_t status;
     uint16_t power;
     uint32_t gpio_level;
     uint32_t gpio_dir;
     uint32_t prev_level;
-    struct {
-        gpio_handler_t fn;
-        void *opaque;
-    } handler[16];
 
     uint16_t mcr;
     uint16_t cdr;
@@ -540,9 +560,7 @@ static inline void scoop_gpio_handler_update(struct scoop_info_s *s) {
 
     for (diff = s->prev_level ^ level; diff; diff ^= 1 << bit) {
         bit = ffs(diff) - 1;
-        if (s->handler[bit].fn)
-            s->handler[bit].fn(bit, (level >> bit) & 1,
-                            s->handler[bit].opaque);
+        qemu_set_irq(s->handler[bit], (level >> bit) & 1);
     }
 
     s->prev_level = level;
@@ -640,12 +658,9 @@ CPUWriteMemoryFunc *scoop_writefn[] = {
     scoop_writeb,
 };
 
-static inline void scoop_gpio_set(struct scoop_info_s *s, int line, int level)
+static void scoop_gpio_set(void *opaque, int line, int level)
 {
-    if (line >= 16) {
-        spitz_printf("No GPIO pin %i\n", line);
-        return;
-    }
+    struct scoop_info_s *s = (struct scoop_info_s *) s;
 
     if (level)
         s->gpio_level |= (1 << line);
@@ -653,15 +668,19 @@ static inline void scoop_gpio_set(struct scoop_info_s *s, int line, int level)
         s->gpio_level &= ~(1 << line);
 }
 
-static inline void scoop_gpio_handler_set(struct scoop_info_s *s, int line,
-                gpio_handler_t handler, void *opaque) {
+static inline qemu_irq *scoop_gpio_in_get(struct scoop_info_s *s)
+{
+    return s->in;
+}
+
+static inline void scoop_gpio_out_set(struct scoop_info_s *s, int line,
+                qemu_irq handler) {
     if (line >= 16) {
         spitz_printf("No GPIO pin %i\n", line);
         return;
     }
 
-    s->handler[line].fn = handler;
-    s->handler[line].opaque = opaque;
+    s->handler[line] = handler;
 }
 
 static void scoop_save(QEMUFile *f, void *opaque)
@@ -715,6 +734,7 @@ static struct scoop_info_s *spitz_scoop_init(struct pxa2xx_state_s *cpu,
     s[0].status = 0x02;
     s[1].status = 0x02;
 
+    s[0].in = qemu_allocate_irqs(scoop_gpio_set, &s[0], 16);
     iomemtype = cpu_register_io_memory(0, scoop_readfn,
                     scoop_writefn, &s[0]);
     cpu_register_physical_memory(s[0].target_base, 0x1000, iomemtype);
@@ -723,6 +743,7 @@ static struct scoop_info_s *spitz_scoop_init(struct pxa2xx_state_s *cpu,
     if (count < 2)
         return s;
 
+    s[1].in = qemu_allocate_irqs(scoop_gpio_set, &s[1], 16);
     iomemtype = cpu_register_io_memory(0, scoop_readfn,
                     scoop_writefn, &s[1]);
     cpu_register_physical_memory(s[1].target_base, 0x1000, iomemtype);
@@ -752,7 +773,7 @@ static void spitz_bl_update(struct pxa2xx_state_s *s)
         spitz_printf("LCD Backlight now off\n");
 }
 
-static void spitz_bl_bit5(int line, int level, void *opaque)
+static inline void spitz_bl_bit5(void *opaque, int line, int level)
 {
     int prev = bl_intensity;
 
@@ -765,7 +786,7 @@ static void spitz_bl_bit5(int line, int level, void *opaque)
         spitz_bl_update((struct pxa2xx_state_s *) opaque);
 }
 
-static void spitz_bl_power(int line, int level, void *opaque)
+static inline void spitz_bl_power(void *opaque, int line, int level)
 {
     bl_power = !!level;
     spitz_bl_update((struct pxa2xx_state_s *) opaque);
@@ -833,14 +854,19 @@ static void corgi_ssp_write(void *opaque, uint32_t value)
         max111x_write(max1111, value);
 }
 
-static void corgi_ssp_gpio_cs(int line, int level, struct pxa2xx_state_s *s)
+static void corgi_ssp_gpio_cs(void *opaque, int line, int level)
 {
-    if (line == SPITZ_GPIO_LCDCON_CS)
+    switch (line) {
+    case 0:
         lcd_en = !level;
-    else if (line == SPITZ_GPIO_ADS7846_CS)
+        break;
+    case 1:
         ads_en = !level;
-    else if (line == SPITZ_GPIO_MAX1111_CS)
+        break;
+    case 2:
         max_en = !level;
+        break;
+    }
 }
 
 #define MAX1111_BATT_VOLT	1
@@ -851,7 +877,7 @@ static void corgi_ssp_gpio_cs(int line, int level, struct pxa2xx_state_s *s)
 #define SPITZ_BATTERY_VOLT	0xd0	/* About 4.0V */
 #define SPITZ_CHARGEON_ACIN	0x80	/* About 5.0V */
 
-static void spitz_adc_temp_on(int line, int level, void *opaque)
+static void spitz_adc_temp_on(void *opaque, int line, int level)
 {
     if (!max1111)
         return;
@@ -862,12 +888,6 @@ static void spitz_adc_temp_on(int line, int level, void *opaque)
         max111x_set_input(max1111, MAX1111_BATT_TEMP, 0);
 }
 
-static void spitz_pendown_set(void *opaque, int line, int level)
-{
-    struct pxa2xx_state_s *cpu = (struct pxa2xx_state_s *) opaque;
-    pxa2xx_gpio_set(cpu->gpio, SPITZ_GPIO_TP_INT, level);
-}
-
 static void spitz_ssp_save(QEMUFile *f, void *opaque)
 {
     qemu_put_be32(f, lcd_en);
@@ -890,9 +910,11 @@ static int spitz_ssp_load(QEMUFile *f, void *opaque, int version_id)
 
 static void spitz_ssp_attach(struct pxa2xx_state_s *cpu)
 {
+    qemu_irq *chipselects;
+
     lcd_en = ads_en = max_en = 0;
 
-    ads7846 = ads7846_init(qemu_allocate_irqs(spitz_pendown_set, cpu, 1)[0]);
+    ads7846 = ads7846_init(pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_TP_INT]);
 
     max1111 = max1111_init(0);
     max111x_set_input(max1111, MAX1111_BATT_VOLT, SPITZ_BATTERY_VOLT);
@@ -902,12 +924,10 @@ static void spitz_ssp_attach(struct pxa2xx_state_s *cpu)
     pxa2xx_ssp_attach(cpu->ssp[CORGI_SSP_PORT - 1], corgi_ssp_read,
                     corgi_ssp_write, cpu);
 
-    pxa2xx_gpio_handler_set(cpu->gpio, SPITZ_GPIO_LCDCON_CS,
-                    (gpio_handler_t) corgi_ssp_gpio_cs, cpu);
-    pxa2xx_gpio_handler_set(cpu->gpio, SPITZ_GPIO_ADS7846_CS,
-                    (gpio_handler_t) corgi_ssp_gpio_cs, cpu);
-    pxa2xx_gpio_handler_set(cpu->gpio, SPITZ_GPIO_MAX1111_CS,
-                    (gpio_handler_t) corgi_ssp_gpio_cs, cpu);
+    chipselects = qemu_allocate_irqs(corgi_ssp_gpio_cs, cpu, 3);
+    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_LCDCON_CS,  chipselects[0]);
+    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_ADS7846_CS, chipselects[1]);
+    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_MAX1111_CS, chipselects[2]);
 
     bl_intensity = 0x20;
     bl_power = 0;
@@ -920,9 +940,14 @@ static void spitz_ssp_attach(struct pxa2xx_state_s *cpu)
 static void spitz_microdrive_attach(struct pxa2xx_state_s *cpu)
 {
     struct pcmcia_card_s *md;
-    BlockDriverState *bs = bs_table[0];
+    int index;
+    BlockDriverState *bs;
 
-    if (bs && bdrv_is_inserted(bs) && !bdrv_is_removable(bs)) {
+    index = drive_get_index(IF_IDE, 0, 0);
+    if (index == -1)
+        return;
+    bs = drives_table[index].bdrv;
+    if (bdrv_is_inserted(bs) && !bdrv_is_removable(bs)) {
         md = dscm1xxxx_init(bs);
         pxa2xx_pcmcia_attach(cpu->pcmcia[1], md);
     }
@@ -937,7 +962,7 @@ static void spitz_microdrive_attach(struct pxa2xx_state_s *cpu)
 #define SPITZ_GPIO_WM	5
 
 #ifdef HAS_AUDIO
-static void spitz_wm8750_addr(int line, int level, void *opaque)
+static void spitz_wm8750_addr(void *opaque, int line, int level)
 {
     i2c_slave *wm = (i2c_slave *) opaque;
     if (level)
@@ -962,8 +987,9 @@ static void spitz_i2c_setup(struct pxa2xx_state_s *cpu)
     /* Attach a WM8750 to the bus */
     wm = wm8750_init(bus, audio);
 
-    spitz_wm8750_addr(0, 0, wm);
-    pxa2xx_gpio_handler_set(cpu->gpio, SPITZ_GPIO_WM, spitz_wm8750_addr, wm);
+    spitz_wm8750_addr(wm, 0, 0);
+    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_WM,
+                    qemu_allocate_irqs(spitz_wm8750_addr, wm, 1)[0]);
     /* .. and to the sound interface.  */
     cpu->i2s->opaque = wm;
     cpu->i2s->codec_out = wm8750_dac_dat;
@@ -981,24 +1007,31 @@ static void spitz_akita_i2c_setup(struct pxa2xx_state_s *cpu)
 
 /* Other peripherals */
 
-static void spitz_charge_switch(int line, int level, void *opaque)
+static void spitz_out_switch(void *opaque, int line, int level)
 {
-    spitz_printf("Charging %s.\n", level ? "off" : "on");
-}
-
-static void spitz_discharge_switch(int line, int level, void *opaque)
-{
-    spitz_printf("Discharging %s.\n", level ? "on" : "off");
-}
-
-static void spitz_greenled_switch(int line, int level, void *opaque)
-{
-    spitz_printf("Green LED %s.\n", level ? "on" : "off");
-}
-
-static void spitz_orangeled_switch(int line, int level, void *opaque)
-{
-    spitz_printf("Orange LED %s.\n", level ? "on" : "off");
+    switch (line) {
+    case 0:
+        spitz_printf("Charging %s.\n", level ? "off" : "on");
+        break;
+    case 1:
+        spitz_printf("Discharging %s.\n", level ? "on" : "off");
+        break;
+    case 2:
+        spitz_printf("Green LED %s.\n", level ? "on" : "off");
+        break;
+    case 3:
+        spitz_printf("Orange LED %s.\n", level ? "on" : "off");
+        break;
+    case 4:
+        spitz_bl_bit5(opaque, line, level);
+        break;
+    case 5:
+        spitz_bl_power(opaque, line, level);
+        break;
+    case 6:
+        spitz_adc_temp_on(opaque, line, level);
+        break;
+    }
 }
 
 #define SPITZ_SCP_LED_GREEN		1
@@ -1019,24 +1052,19 @@ static void spitz_orangeled_switch(int line, int level, void *opaque)
 static void spitz_scoop_gpio_setup(struct pxa2xx_state_s *cpu,
                 struct scoop_info_s *scp, int num)
 {
-    scoop_gpio_handler_set(&scp[0], SPITZ_SCP_CHRG_ON,
-                    spitz_charge_switch, cpu);
-    scoop_gpio_handler_set(&scp[0], SPITZ_SCP_JK_B,
-                    spitz_discharge_switch, cpu);
-    scoop_gpio_handler_set(&scp[0], SPITZ_SCP_LED_GREEN,
-                    spitz_greenled_switch, cpu);
-    scoop_gpio_handler_set(&scp[0], SPITZ_SCP_LED_ORANGE,
-                    spitz_orangeled_switch, cpu);
+    qemu_irq *outsignals = qemu_allocate_irqs(spitz_out_switch, cpu, 8);
+
+    scoop_gpio_out_set(&scp[0], SPITZ_SCP_CHRG_ON, outsignals[0]);
+    scoop_gpio_out_set(&scp[0], SPITZ_SCP_JK_B, outsignals[1]);
+    scoop_gpio_out_set(&scp[0], SPITZ_SCP_LED_GREEN, outsignals[2]);
+    scoop_gpio_out_set(&scp[0], SPITZ_SCP_LED_ORANGE, outsignals[3]);
 
     if (num >= 2) {
-        scoop_gpio_handler_set(&scp[1], SPITZ_SCP2_BACKLIGHT_CONT,
-                        spitz_bl_bit5, cpu);
-        scoop_gpio_handler_set(&scp[1], SPITZ_SCP2_BACKLIGHT_ON,
-                        spitz_bl_power, cpu);
+        scoop_gpio_out_set(&scp[1], SPITZ_SCP2_BACKLIGHT_CONT, outsignals[4]);
+        scoop_gpio_out_set(&scp[1], SPITZ_SCP2_BACKLIGHT_ON, outsignals[5]);
     }
 
-    scoop_gpio_handler_set(&scp[0], SPITZ_SCP_ADC_TEMP_ON,
-                    spitz_adc_temp_on, cpu);
+    scoop_gpio_out_set(&scp[0], SPITZ_SCP_ADC_TEMP_ON, outsignals[6]);
 }
 
 #define SPITZ_GPIO_HSYNC		22
@@ -1049,40 +1077,18 @@ static void spitz_scoop_gpio_setup(struct pxa2xx_state_s *cpu,
 #define SPITZ_GPIO_CF2_IRQ		106
 #define SPITZ_GPIO_CF2_CD		93
 
-int spitz_hsync;
+static int spitz_hsync;
 
-static void spitz_lcd_hsync_handler(void *opaque)
+static void spitz_lcd_hsync_handler(void *opaque, int line, int level)
 {
     struct pxa2xx_state_s *cpu = (struct pxa2xx_state_s *) opaque;
-    pxa2xx_gpio_set(cpu->gpio, SPITZ_GPIO_HSYNC, spitz_hsync);
+    qemu_set_irq(pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_HSYNC], spitz_hsync);
     spitz_hsync ^= 1;
 }
 
-static void spitz_mmc_coverswitch_change(void *opaque, int in)
-{
-    struct pxa2xx_state_s *cpu = (struct pxa2xx_state_s *) opaque;
-    pxa2xx_gpio_set(cpu->gpio, SPITZ_GPIO_SD_DETECT, in);
-}
-
-static void spitz_mmc_writeprotect_change(void *opaque, int wp)
-{
-    struct pxa2xx_state_s *cpu = (struct pxa2xx_state_s *) opaque;
-    pxa2xx_gpio_set(cpu->gpio, SPITZ_GPIO_SD_WP, wp);
-}
-
-static void spitz_pcmcia_cb(void *opaque, int line, int level)
-{
-    struct pxa2xx_state_s *cpu = (struct pxa2xx_state_s *) opaque;
-    static const int gpio_map[] = {
-        SPITZ_GPIO_CF1_IRQ, SPITZ_GPIO_CF1_CD,
-        SPITZ_GPIO_CF2_IRQ, SPITZ_GPIO_CF2_CD,
-    };
-    pxa2xx_gpio_set(cpu->gpio, gpio_map[line], level);
-}
-
 static void spitz_gpio_setup(struct pxa2xx_state_s *cpu, int slots)
 {
-    qemu_irq *pcmcia_cb;
+    qemu_irq lcd_hsync;
     /*
      * Bad hack: We toggle the LCD hsync GPIO on every GPIO status
      * read to satisfy broken guests that poll-wait for hsync.
@@ -1090,25 +1096,30 @@ static void spitz_gpio_setup(struct pxa2xx_state_s *cpu, int slots)
      * wouldn't guarantee that a guest ever exits the loop.
      */
     spitz_hsync = 0;
-    pxa2xx_gpio_read_notifier(cpu->gpio, spitz_lcd_hsync_handler, cpu);
-    pxa2xx_lcd_vsync_cb(cpu->lcd, spitz_lcd_hsync_handler, cpu);
+    lcd_hsync = qemu_allocate_irqs(spitz_lcd_hsync_handler, cpu, 1)[0];
+    pxa2xx_gpio_read_notifier(cpu->gpio, lcd_hsync);
+    pxa2xx_lcd_vsync_notifier(cpu->lcd, lcd_hsync);
 
     /* MMC/SD host */
-    pxa2xx_mmci_handlers(cpu->mmc, cpu, spitz_mmc_writeprotect_change,
-                    spitz_mmc_coverswitch_change);
+    pxa2xx_mmci_handlers(cpu->mmc,
+                    pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_SD_WP],
+                    pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_SD_DETECT]);
 
     /* Battery lock always closed */
-    pxa2xx_gpio_set(cpu->gpio, SPITZ_GPIO_BAT_COVER, 1);
+    qemu_irq_raise(pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_BAT_COVER]);
 
     /* Handle reset */
-    pxa2xx_gpio_handler_set(cpu->gpio, SPITZ_GPIO_ON_RESET, pxa2xx_reset, cpu);
+    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_ON_RESET, cpu->reset);
 
     /* PCMCIA signals: card's IRQ and Card-Detect */
-    pcmcia_cb = qemu_allocate_irqs(spitz_pcmcia_cb, cpu, slots * 2);
     if (slots >= 1)
-        pxa2xx_pcmcia_set_irq_cb(cpu->pcmcia[0], pcmcia_cb[0], pcmcia_cb[1]);
+        pxa2xx_pcmcia_set_irq_cb(cpu->pcmcia[0],
+                        pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_CF1_IRQ],
+                        pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_CF1_CD]);
     if (slots >= 2)
-        pxa2xx_pcmcia_set_irq_cb(cpu->pcmcia[1], pcmcia_cb[2], pcmcia_cb[3]);
+        pxa2xx_pcmcia_set_irq_cb(cpu->pcmcia[1],
+                        pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_CF2_IRQ],
+                        pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_CF2_CD]);
 
     /* Initialise the screen rotation related signals */
     spitz_gpio_invert[3] = 0;	/* Always open */
@@ -1117,8 +1128,10 @@ static void spitz_gpio_setup(struct pxa2xx_state_s *cpu, int slots)
     } else {			/* Portrait mode */
         spitz_gpio_invert[4] = 1;
     }
-    pxa2xx_gpio_set(cpu->gpio, SPITZ_GPIO_SWA, spitz_gpio_invert[3]);
-    pxa2xx_gpio_set(cpu->gpio, SPITZ_GPIO_SWB, spitz_gpio_invert[4]);
+    qemu_set_irq(pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_SWA],
+                    spitz_gpio_invert[3]);
+    qemu_set_irq(pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_SWB],
+                    spitz_gpio_invert[4]);
 }
 
 /* Write the bootloader parameters memory area.  */
@@ -1224,8 +1237,8 @@ static void spitz_common_init(int ram_size, int vga_ram_size,
     sl_bootparam_write(SL_PXA_PARAM_BASE - PXA2XX_SDRAM_BASE);
 }
 
-static void spitz_init(int ram_size, int vga_ram_size, int boot_device,
-                DisplayState *ds, const char **fd_filename, int snapshot,
+static void spitz_init(int ram_size, int vga_ram_size,
+                const char *boot_device, DisplayState *ds,
                 const char *kernel_filename, const char *kernel_cmdline,
                 const char *initrd_filename, const char *cpu_model)
 {
@@ -1233,8 +1246,8 @@ static void spitz_init(int ram_size, int vga_ram_size, int boot_device,
                 kernel_cmdline, initrd_filename, cpu_model, spitz, 0x2c9);
 }
 
-static void borzoi_init(int ram_size, int vga_ram_size, int boot_device,
-                DisplayState *ds, const char **fd_filename, int snapshot,
+static void borzoi_init(int ram_size, int vga_ram_size,
+                const char *boot_device, DisplayState *ds,
                 const char *kernel_filename, const char *kernel_cmdline,
                 const char *initrd_filename, const char *cpu_model)
 {
@@ -1242,8 +1255,8 @@ static void borzoi_init(int ram_size, int vga_ram_size, int boot_device,
                 kernel_cmdline, initrd_filename, cpu_model, borzoi, 0x33f);
 }
 
-static void akita_init(int ram_size, int vga_ram_size, int boot_device,
-                DisplayState *ds, const char **fd_filename, int snapshot,
+static void akita_init(int ram_size, int vga_ram_size,
+                const char *boot_device, DisplayState *ds,
                 const char *kernel_filename, const char *kernel_cmdline,
                 const char *initrd_filename, const char *cpu_model)
 {
@@ -1251,8 +1264,8 @@ static void akita_init(int ram_size, int vga_ram_size, int boot_device,
                 kernel_cmdline, initrd_filename, cpu_model, akita, 0x2e8);
 }
 
-static void terrier_init(int ram_size, int vga_ram_size, int boot_device,
-                DisplayState *ds, const char **fd_filename, int snapshot,
+static void terrier_init(int ram_size, int vga_ram_size,
+                const char *boot_device, DisplayState *ds,
                 const char *kernel_filename, const char *kernel_cmdline,
                 const char *initrd_filename, const char *cpu_model)
 {
diff --git a/hw/ssd0303.c b/hw/ssd0303.c
new file mode 100644
index 000000000..383a6232b
--- /dev/null
+++ b/hw/ssd0303.c
@@ -0,0 +1,275 @@
+/*
+ * SSD0303 OLED controller with OSRAM Pictiva 96x16 display.
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+/* The controller can support a variety of different displays, but we only
+   implement one.  Most of the commends relating to brightness and geometry
+   setup are ignored. */
+#include "hw.h"
+#include "i2c.h"
+#include "console.h"
+
+//#define DEBUG_SSD0303 1
+
+#ifdef DEBUG_SSD0303
+#define DPRINTF(fmt, args...) \
+do { printf("ssd0303: " fmt , ##args); } while (0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "ssd0303: error: " fmt , ##args); exit(1);} while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "ssd0303: error: " fmt , ##args);} while (0)
+#endif
+
+/* Scaling factor for pixels.  */
+#define MAGNIFY 4
+
+enum ssd0303_mode
+{
+    SSD0303_IDLE,
+    SSD0303_DATA,
+    SSD0303_CMD
+};
+
+enum ssd0303_cmd {
+    SSD0303_CMD_NONE,
+    SSD0303_CMD_SKIP1
+};
+
+typedef struct {
+    i2c_slave i2c;
+    DisplayState *ds;
+    int row;
+    int col;
+    int start_line;
+    int mirror;
+    int flash;
+    int enabled;
+    int inverse;
+    int redraw;
+    enum ssd0303_mode mode;
+    enum ssd0303_cmd cmd_state;
+    uint8_t framebuffer[132*8];
+} ssd0303_state;
+
+static int ssd0303_recv(i2c_slave *i2c)
+{
+    BADF("Reads not implemented\n");
+    return -1;
+}
+
+static int ssd0303_send(i2c_slave *i2c, uint8_t data)
+{
+    ssd0303_state *s = (ssd0303_state *)i2c;
+    enum ssd0303_cmd old_cmd_state;
+    switch (s->mode) {
+    case SSD0303_IDLE:
+        DPRINTF("byte 0x%02x\n", data);
+        if (data == 0x80)
+            s->mode = SSD0303_CMD;
+        else if (data == 0x40)
+            s->mode = SSD0303_DATA;
+        else
+            BADF("Unexpected byte 0x%x\n", data);
+        break;
+    case SSD0303_DATA:
+        DPRINTF("data 0x%02x\n", data);
+        if (s->col < 132) {
+            s->framebuffer[s->col + s->row * 132] = data;
+            s->col++;
+            s->redraw = 1;
+        }
+        break;
+    case SSD0303_CMD:
+        old_cmd_state = s->cmd_state;
+        s->cmd_state = SSD0303_CMD_NONE;
+        switch (old_cmd_state) {
+        case SSD0303_CMD_NONE:
+            DPRINTF("cmd 0x%02x\n", data);
+            s->mode = SSD0303_IDLE;
+            switch (data) {
+            case 0x00 ... 0x0f: /* Set lower colum address.  */
+                s->col = (s->col & 0xf0) | (data & 0xf);
+                break;
+            case 0x10 ... 0x20: /* Set higher column address.  */
+                s->col = (s->col & 0x0f) | ((data & 0xf) << 4);
+                break;
+            case 0x40 ... 0x7f: /* Set start line.  */
+                s->start_line = 0;
+                break;
+            case 0x81: /* Set contrast (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xa0: /* Mirror off.  */
+                s->mirror = 0;
+                break;
+            case 0xa1: /* Mirror off.  */
+                s->mirror = 1;
+                break;
+            case 0xa4: /* Entire display off.  */
+                s->flash = 0;
+                break;
+            case 0xa5: /* Entire display on.  */
+                s->flash = 1;
+                break;
+            case 0xa6: /* Inverse off.  */
+                s->inverse = 0;
+                break;
+            case 0xa7: /* Inverse on.  */
+                s->inverse = 1;
+                break;
+            case 0xa8: /* Set multipled ratio (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xad: /* DC-DC power control.  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xae: /* Display off.  */
+                s->enabled = 0;
+                break;
+            case 0xaf: /* Display on.  */
+                s->enabled = 1;
+                break;
+            case 0xb0 ... 0xbf: /* Set Page address.  */
+                s->row = data & 7;
+                break;
+            case 0xc0 ... 0xc8: /* Set COM output direction (Ignored).  */
+                break;
+            case 0xd3: /* Set display offset (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xd5: /* Set display clock (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xd8: /* Set color and power mode (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xd9: /* Set pre-charge period (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xda: /* Set COM pin configuration (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xdb: /* Set VCOM dselect level (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xe3: /* no-op.  */
+                break;
+            default:
+                BADF("Unknown command: 0x%x\n", data);
+            }
+            break;
+        case SSD0303_CMD_SKIP1:
+            DPRINTF("skip 0x%02x\n", data);
+            break;
+        }
+        break;
+    }
+    return 0;
+}
+
+static void ssd0303_event(i2c_slave *i2c, enum i2c_event event)
+{
+    ssd0303_state *s = (ssd0303_state *)i2c;
+    switch (event) {
+    case I2C_FINISH:
+        s->mode = SSD0303_IDLE;
+        break;
+    case I2C_START_RECV:
+    case I2C_START_SEND:
+    case I2C_NACK:
+        /* Nothing to do.  */
+        break;
+    }
+}
+
+static void ssd0303_update_display(void *opaque)
+{
+    ssd0303_state *s = (ssd0303_state *)opaque;
+    uint8_t *dest;
+    uint8_t *src;
+    int x;
+    int y;
+    int line;
+    char *colors[2];
+    char colortab[MAGNIFY * 8];
+    int dest_width;
+    uint8_t mask;
+
+    if (s->redraw) {
+        switch (s->ds->depth) {
+        case 0:
+            return;
+        case 15:
+            dest_width = 2;
+            break;
+        case 16:
+            dest_width = 2;
+            break;
+        case 24:
+            dest_width = 3;
+            break;
+        case 32:
+            dest_width = 4;
+            break;
+        default:
+            BADF("Bad color depth\n");
+            return;
+        }
+        dest_width *= MAGNIFY;
+        memset(colortab, 0xff, dest_width);
+        memset(colortab + dest_width, 0, dest_width);
+        if (s->flash) {
+            colors[0] = colortab;
+            colors[1] = colortab;
+        } else if (s->inverse) {
+            colors[0] = colortab;
+            colors[1] = colortab + dest_width;
+        } else {
+            colors[0] = colortab + dest_width;
+            colors[1] = colortab;
+        }
+        dest = s->ds->data;
+        for (y = 0; y < 16; y++) {
+            line = (y + s->start_line) & 63;
+            src = s->framebuffer + 132 * (line >> 3) + 36;
+            mask = 1 << (line & 7);
+            for (x = 0; x < 96; x++) {
+                memcpy(dest, colors[(*src & mask) != 0], dest_width);
+                dest += dest_width;
+                src++;
+            }
+            for (x = 1; x < MAGNIFY; x++) {
+                memcpy(dest, dest - dest_width * 96, dest_width * 96);
+                dest += dest_width * 96;
+            }
+        }
+    }
+    dpy_update(s->ds, 0, 0, 96 * MAGNIFY, 16 * MAGNIFY);
+}
+
+static void ssd0303_invalidate_display(void * opaque)
+{
+    ssd0303_state *s = (ssd0303_state *)opaque;
+    s->redraw = 1;
+}
+
+void ssd0303_init(DisplayState *ds, i2c_bus *bus, int address)
+{
+    ssd0303_state *s;
+
+    s = (ssd0303_state *)i2c_slave_init(bus, address, sizeof(ssd0303_state));
+    s->ds = ds;
+    s->i2c.event = ssd0303_event;
+    s->i2c.recv = ssd0303_recv;
+    s->i2c.send = ssd0303_send;
+    graphic_console_init(ds, ssd0303_update_display, ssd0303_invalidate_display,
+                         NULL, s);
+    dpy_resize(s->ds, 96 * MAGNIFY, 16 * MAGNIFY);
+}
diff --git a/hw/ssd0323.c b/hw/ssd0323.c
new file mode 100644
index 000000000..4706b05f4
--- /dev/null
+++ b/hw/ssd0323.c
@@ -0,0 +1,292 @@
+/*
+ * SSD0323 OLED controller with OSRAM Pictiva 128x64 display.
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+/* The controller can support a variety of different displays, but we only
+   implement one.  Most of the commends relating to brightness and geometry
+   setup are ignored. */
+#include "hw.h"
+#include "devices.h"
+#include "console.h"
+
+//#define DEBUG_SSD0323 1
+
+#ifdef DEBUG_SSD0323
+#define DPRINTF(fmt, args...) \
+do { printf("ssd0323: " fmt , ##args); } while (0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "ssd0323: error: " fmt , ##args); exit(1);} while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "ssd0323: error: " fmt , ##args);} while (0)
+#endif
+
+/* Scaling factor for pixels.  */
+#define MAGNIFY 4
+
+#define REMAP_SWAP_COLUMN 0x01
+#define REMAP_SWAP_NYBBLE 0x02
+#define REMAP_VERTICAL    0x04
+#define REMAP_SWAP_COM    0x10
+#define REMAP_SPLIT_COM   0x40
+
+enum ssd0323_mode
+{
+    SSD0323_CMD,
+    SSD0323_DATA
+};
+
+typedef struct {
+    DisplayState *ds;
+
+    int cmd_len;
+    int cmd;
+    int cmd_data[8];
+    int row;
+    int row_start;
+    int row_end;
+    int col;
+    int col_start;
+    int col_end;
+    int redraw;
+    int remap;
+    enum ssd0323_mode mode;
+    uint8_t framebuffer[128 * 80 / 2];
+} ssd0323_state;
+
+int ssd0323_xfer_ssi(void *opaque, int data)
+{
+    ssd0323_state *s = (ssd0323_state *)opaque;
+    switch (s->mode) {
+    case SSD0323_DATA:
+        DPRINTF("data 0x%02x\n", data);
+        s->framebuffer[s->col + s->row * 64] = data;
+        if (s->remap & REMAP_VERTICAL) {
+            s->row++;
+            if (s->row > s->row_end) {
+                s->row = s->row_start;
+                s->col++;
+            }
+            if (s->col > s->col_end) {
+                s->col = s->col_start;
+            }
+        } else {
+            s->col++;
+            if (s->col > s->col_end) {
+                s->row++;
+                s->col = s->col_start;
+            }
+            if (s->row > s->row_end) {
+                s->row = s->row_start;
+            }
+        }
+        s->redraw = 1;
+        break;
+    case SSD0323_CMD:
+        DPRINTF("cmd 0x%02x\n", data);
+        if (s->cmd_len == 0) {
+            s->cmd = data;
+        } else {
+            s->cmd_data[s->cmd_len - 1] = data;
+        }
+        s->cmd_len++;
+        switch (s->cmd) {
+#define DATA(x) if (s->cmd_len <= (x)) return 0
+        case 0x15: /* Set column.  */
+            DATA(2);
+            s->col = s->col_start = s->cmd_data[0] % 64;
+            s->col_end = s->cmd_data[1] % 64;
+            break;
+        case 0x75: /* Set row.  */
+            DATA(2);
+            s->row = s->row_start = s->cmd_data[0] % 80;
+            s->row_end = s->cmd_data[1] % 80;
+            break;
+        case 0x81: /* Set contrast */
+            DATA(1);
+            break;
+        case 0x84: case 0x85: case 0x86: /* Max current.  */
+            DATA(0);
+            break;
+        case 0xa0: /* Set remapping.  */
+            /* FIXME: Implement this.  */
+            DATA(1);
+            s->remap = s->cmd_data[0];
+            break;
+        case 0xa1: /* Set display start line.  */
+        case 0xa2: /* Set display offset.  */
+            /* FIXME: Implement these.  */
+            DATA(1);
+            break;
+        case 0xa4: /* Normal mode.  */
+        case 0xa5: /* All on.  */
+        case 0xa6: /* All off.  */
+        case 0xa7: /* Inverse.  */
+            /* FIXME: Implement these.  */
+            DATA(0);
+            break;
+        case 0xa8: /* Set multiplex ratio.  */
+        case 0xad: /* Set DC-DC converter.  */
+            DATA(1);
+            /* Ignored.  Don't care.  */
+            break;
+        case 0xae: /* Display off.  */
+        case 0xaf: /* Display on.  */
+            DATA(0);
+            /* TODO: Implement power control.  */
+            break;
+        case 0xb1: /* Set phase length.  */
+        case 0xb2: /* Set row period.  */
+        case 0xb3: /* Set clock rate.  */
+        case 0xbc: /* Set precharge.  */
+        case 0xbe: /* Set VCOMH.  */
+        case 0xbf: /* Set segment low.  */
+            DATA(1);
+            /* Ignored.  Don't care.  */
+            break;
+        case 0xb8: /* Set grey scale table.  */
+            /* FIXME: Implement this.  */
+            DATA(8);
+            break;
+        case 0xe3: /* NOP.  */
+            DATA(0);
+            break;
+        case 0xff: /* Nasty hack because we don't handle chip selects
+                      properly.  */
+            break;
+        default:
+            BADF("Unknown command: 0x%x\n", data);
+        }
+        s->cmd_len = 0;
+        return 0;
+    }
+    return 0;
+}
+
+static void ssd0323_update_display(void *opaque)
+{
+    ssd0323_state *s = (ssd0323_state *)opaque;
+    uint8_t *dest;
+    uint8_t *src;
+    int x;
+    int y;
+    int i;
+    int line;
+    char *colors[16];
+    char colortab[MAGNIFY * 64];
+    char *p;
+    int dest_width;
+
+    if (s->redraw) {
+        switch (s->ds->depth) {
+        case 0:
+            return;
+        case 15:
+            dest_width = 2;
+            break;
+        case 16:
+            dest_width = 2;
+            break;
+        case 24:
+            dest_width = 3;
+            break;
+        case 32:
+            dest_width = 4;
+            break;
+        default:
+            BADF("Bad color depth\n");
+            return;
+        }
+        p = colortab;
+        for (i = 0; i < 16; i++) {
+            int n;
+            colors[i] = p;
+            switch (s->ds->depth) {
+            case 15:
+                n = i * 2 + (i >> 3);
+                p[0] = n | (n << 5);
+                p[1] = (n << 2) | (n >> 3);
+                break;
+            case 16:
+                n = i * 2 + (i >> 3);
+                p[0] = n | (n << 6) | ((n << 1) & 0x20);
+                p[1] = (n << 3) | (n >> 2);
+                break;
+            case 24:
+            case 32:
+                n = (i << 4) | i;
+                p[0] = p[1] = p[2] = n;
+                break;
+            default:
+                BADF("Bad color depth\n");
+                return;
+            }
+            p += dest_width;
+        }
+        /* TODO: Implement row/column remapping.  */
+        dest = s->ds->data;
+        for (y = 0; y < 64; y++) {
+            line = y;
+            src = s->framebuffer + 64 * line;
+            for (x = 0; x < 64; x++) {
+                int val;
+                val = *src >> 4;
+                for (i = 0; i < MAGNIFY; i++) {
+                    memcpy(dest, colors[val], dest_width);
+                    dest += dest_width;
+                }
+                val = *src & 0xf;
+                for (i = 0; i < MAGNIFY; i++) {
+                    memcpy(dest, colors[val], dest_width);
+                    dest += dest_width;
+                }
+                src++;
+            }
+            for (i = 1; i < MAGNIFY; i++) {
+                memcpy(dest, dest - dest_width * MAGNIFY * 128,
+                       dest_width * 128 * MAGNIFY);
+                dest += dest_width * 128 * MAGNIFY;
+            }
+        }
+    }
+    dpy_update(s->ds, 0, 0, 128 * MAGNIFY, 64 * MAGNIFY);
+}
+
+static void ssd0323_invalidate_display(void * opaque)
+{
+    ssd0323_state *s = (ssd0323_state *)opaque;
+    s->redraw = 1;
+}
+
+/* Command/data input.  */
+static void ssd0323_cd(void *opaque, int n, int level)
+{
+    ssd0323_state *s = (ssd0323_state *)opaque;
+    DPRINTF("%s mode\n", level ? "Data" : "Command");
+    s->mode = level ? SSD0323_DATA : SSD0323_CMD;
+}
+
+void *ssd0323_init(DisplayState *ds, qemu_irq *cmd_p)
+{
+    ssd0323_state *s;
+    qemu_irq *cmd;
+
+    s = (ssd0323_state *)qemu_mallocz(sizeof(ssd0323_state));
+    s->ds = ds;
+    graphic_console_init(ds, ssd0323_update_display, ssd0323_invalidate_display,
+                         NULL, s);
+    dpy_resize(s->ds, 128 * MAGNIFY, 64 * MAGNIFY);
+    s->col_end = 63;
+    s->row_end = 79;
+
+    cmd = qemu_allocate_irqs(ssd0323_cd, s, 1);
+    *cmd_p = *cmd;
+
+    return s;
+}
diff --git a/hw/ssi-sd.c b/hw/ssi-sd.c
new file mode 100644
index 000000000..8b45fc4d1
--- /dev/null
+++ b/hw/ssi-sd.c
@@ -0,0 +1,202 @@
+/*
+ * SSI to SD card adapter.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "hw.h"
+#include "sd.h"
+
+//#define DEBUG_SSI_SD 1
+
+#ifdef DEBUG_SSI_SD
+#define DPRINTF(fmt, args...) \
+do { printf("ssi_sd: " fmt , ##args); } while (0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "ssi_sd: error: " fmt , ##args); exit(1);} while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "ssi_sd: error: " fmt , ##args);} while (0)
+#endif
+
+typedef enum {
+    SSI_SD_CMD,
+    SSI_SD_CMDARG,
+    SSI_SD_RESPONSE,
+    SSI_SD_DATA_START,
+    SSI_SD_DATA_READ,
+} ssi_sd_mode;
+
+typedef struct {
+    ssi_sd_mode mode;
+    int cmd;
+    uint8_t cmdarg[4];
+    uint8_t response[5];
+    int arglen;
+    int response_pos;
+    int stopping;
+    SDState *sd;
+} ssi_sd_state;
+
+/* State word bits.  */
+#define SSI_SDR_LOCKED          0x0001
+#define SSI_SDR_WP_ERASE        0x0002
+#define SSI_SDR_ERROR           0x0004
+#define SSI_SDR_CC_ERROR        0x0008
+#define SSI_SDR_ECC_FAILED      0x0010
+#define SSI_SDR_WP_VIOLATION    0x0020
+#define SSI_SDR_ERASE_PARAM     0x0040
+#define SSI_SDR_OUT_OF_RANGE    0x0080
+#define SSI_SDR_IDLE            0x0100
+#define SSI_SDR_ERASE_RESET     0x0200
+#define SSI_SDR_ILLEGAL_COMMAND 0x0400
+#define SSI_SDR_COM_CRC_ERROR   0x0800
+#define SSI_SDR_ERASE_SEQ_ERROR 0x1000
+#define SSI_SDR_ADDRESS_ERROR   0x2000
+#define SSI_SDR_PARAMETER_ERROR 0x4000
+
+int ssi_sd_xfer(void *opaque, int val)
+{
+    ssi_sd_state *s = (ssi_sd_state *)opaque;
+
+    /* Special case: allow CMD12 (STOP TRANSMISSION) while reading data.  */
+    if (s->mode == SSI_SD_DATA_READ && val == 0x4d) {
+        s->mode = SSI_SD_CMD;
+        /* There must be at least one byte delay before the card responds.  */
+        s->stopping = 1;
+    }
+
+    switch (s->mode) {
+    case SSI_SD_CMD:
+        if (val == 0xff) {
+            DPRINTF("NULL command\n");
+            return 0xff;
+        }
+        s->cmd = val & 0x3f;
+        s->mode = SSI_SD_CMDARG;
+        s->arglen = 0;
+        return 0xff;
+    case SSI_SD_CMDARG:
+        if (s->arglen == 4) {
+            struct sd_request_s request;
+            uint8_t longresp[16];
+            /* FIXME: Check CRC.  */
+            request.cmd = s->cmd;
+            request.arg = (s->cmdarg[0] << 24) | (s->cmdarg[1] << 16)
+                           | (s->cmdarg[2] << 8) | s->cmdarg[3];
+            DPRINTF("CMD%d arg 0x%08x\n", s->cmd, request.arg);
+            s->arglen = sd_do_command(s->sd, &request, longresp);
+            if (s->arglen <= 0) {
+                s->arglen = 1;
+                s->response[0] = 4;
+                DPRINTF("SD command failed\n");
+            } else if (s->cmd == 58) {
+                /* CMD58 returns R3 response (OCR)  */
+                DPRINTF("Returned OCR\n");
+                s->arglen = 5;
+                s->response[0] = 1;
+                memcpy(&s->response[1], longresp, 4);
+            } else if (s->arglen != 4) {
+                BADF("Unexpected response to cmd %d\n", s->cmd);
+                /* Illegal command is about as near as we can get.  */
+                s->arglen = 1;
+                s->response[0] = 4;
+            } else {
+                /* All other commands return status.  */
+                uint32_t cardstatus;
+                uint16_t status;
+                /* CMD13 returns a 2-byte statuse work. Other commands
+                   only return the first byte.  */
+                s->arglen = (s->cmd == 13) ? 2 : 1;
+                cardstatus = (longresp[0] << 24) | (longresp[1] << 16)
+                             | (longresp[2] << 8) | longresp[3];
+                status = 0;
+                if (((cardstatus >> 9) & 0xf) < 4)
+                    status |= SSI_SDR_IDLE;
+                if (cardstatus & ERASE_RESET)
+                    status |= SSI_SDR_ERASE_RESET;
+                if (cardstatus & ILLEGAL_COMMAND)
+                    status |= SSI_SDR_ILLEGAL_COMMAND;
+                if (cardstatus & COM_CRC_ERROR)
+                    status |= SSI_SDR_COM_CRC_ERROR;
+                if (cardstatus & ERASE_SEQ_ERROR)
+                    status |= SSI_SDR_ERASE_SEQ_ERROR;
+                if (cardstatus & ADDRESS_ERROR)
+                    status |= SSI_SDR_ADDRESS_ERROR;
+                if (cardstatus & CARD_IS_LOCKED)
+                    status |= SSI_SDR_LOCKED;
+                if (cardstatus & (LOCK_UNLOCK_FAILED | WP_ERASE_SKIP))
+                    status |= SSI_SDR_WP_ERASE;
+                if (cardstatus & SD_ERROR)
+                    status |= SSI_SDR_ERROR;
+                if (cardstatus & CC_ERROR)
+                    status |= SSI_SDR_CC_ERROR;
+                if (cardstatus & CARD_ECC_FAILED)
+                    status |= SSI_SDR_ECC_FAILED;
+                if (cardstatus & WP_VIOLATION)
+                    status |= SSI_SDR_WP_VIOLATION;
+                if (cardstatus & ERASE_PARAM)
+                    status |= SSI_SDR_ERASE_PARAM;
+                if (cardstatus & (OUT_OF_RANGE | CID_CSD_OVERWRITE))
+                    status |= SSI_SDR_OUT_OF_RANGE;
+                /* ??? Don't know what Parameter Error really means, so
+                   assume it's set if the second byte is nonzero.  */
+                if (status & 0xff)
+                    status |= SSI_SDR_PARAMETER_ERROR;
+                s->response[0] = status >> 8;
+                s->response[1] = status;
+                DPRINTF("Card status 0x%02x\n", status);
+            }
+            s->mode = SSI_SD_RESPONSE;
+            s->response_pos = 0;
+        } else {
+            s->cmdarg[s->arglen++] = val;
+        }
+        return 0xff;
+    case SSI_SD_RESPONSE:
+        if (s->stopping) {
+            s->stopping = 0;
+            return 0xff;
+        }
+        if (s->response_pos < s->arglen) {
+            DPRINTF("Response 0x%02x\n", s->response[s->response_pos]);
+            return s->response[s->response_pos++];
+        }
+        if (sd_data_ready(s->sd)) {
+            DPRINTF("Data read\n");
+            s->mode = SSI_SD_DATA_START;
+        } else {
+            DPRINTF("End of command\n");
+            s->mode = SSI_SD_CMD;
+        }
+        return 0xff;
+    case SSI_SD_DATA_START:
+        DPRINTF("Start read block\n");
+        s->mode = SSI_SD_DATA_READ;
+        return 0xfe;
+    case SSI_SD_DATA_READ:
+        val = sd_read_data(s->sd);
+        if (!sd_data_ready(s->sd)) {
+            DPRINTF("Data read end\n");
+            s->mode = SSI_SD_CMD;
+        }
+        return val;
+    }
+    /* Should never happen.  */
+    return 0xff;
+}
+
+void *ssi_sd_init(BlockDriverState *bs)
+{
+    ssi_sd_state *s;
+
+    s = (ssi_sd_state *)qemu_mallocz(sizeof(ssi_sd_state));
+    s->mode = SSI_SD_CMD;
+    s->sd = sd_init(bs, 1);
+    return s;
+}
+
diff --git a/hw/stellaris.c b/hw/stellaris.c
new file mode 100644
index 000000000..2fb927b61
--- /dev/null
+++ b/hw/stellaris.c
@@ -0,0 +1,1198 @@
+/*
+ * Luminary Micro Stellaris preipherals
+ *
+ * Copyright (c) 2006 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "hw.h"
+#include "arm-misc.h"
+#include "primecell.h"
+#include "devices.h"
+#include "qemu-timer.h"
+#include "i2c.h"
+#include "net.h"
+#include "sd.h"
+#include "sysemu.h"
+#include "boards.h"
+
+#define GPIO_A 0
+#define GPIO_B 1
+#define GPIO_C 2
+#define GPIO_D 3
+#define GPIO_E 4
+#define GPIO_F 5
+#define GPIO_G 6
+
+#define BP_OLED_I2C  0x01
+#define BP_OLED_SSI  0x02
+#define BP_GAMEPAD   0x04
+
+typedef const struct {
+    const char *name;
+    uint32_t did0;
+    uint32_t did1;
+    uint32_t dc0;
+    uint32_t dc1;
+    uint32_t dc2;
+    uint32_t dc3;
+    uint32_t dc4;
+    uint32_t peripherals;
+} stellaris_board_info;
+
+/* General purpose timer module.  */
+
+typedef struct gptm_state {
+    uint32_t config;
+    uint32_t mode[2];
+    uint32_t control;
+    uint32_t state;
+    uint32_t mask;
+    uint32_t load[2];
+    uint32_t match[2];
+    uint32_t prescale[2];
+    uint32_t match_prescale[2];
+    uint32_t rtc;
+    int64_t tick[2];
+    struct gptm_state *opaque[2];
+    uint32_t base;
+    QEMUTimer *timer[2];
+    /* The timers have an alternate output used to trigger the ADC.  */
+    qemu_irq trigger;
+    qemu_irq irq;
+} gptm_state;
+
+static void gptm_update_irq(gptm_state *s)
+{
+    int level;
+    level = (s->state & s->mask) != 0;
+    qemu_set_irq(s->irq, level);
+}
+
+static void gptm_stop(gptm_state *s, int n)
+{
+    qemu_del_timer(s->timer[n]);
+}
+
+static void gptm_reload(gptm_state *s, int n, int reset)
+{
+    int64_t tick;
+    if (reset)
+        tick = qemu_get_clock(vm_clock);
+    else
+        tick = s->tick[n];
+
+    if (s->config == 0) {
+        /* 32-bit CountDown.  */
+        uint32_t count;
+        count = s->load[0] | (s->load[1] << 16);
+        tick += (int64_t)count * system_clock_scale;
+    } else if (s->config == 1) {
+        /* 32-bit RTC.  1Hz tick.  */
+        tick += ticks_per_sec;
+    } else if (s->mode[n] == 0xa) {
+        /* PWM mode.  Not implemented.  */
+    } else {
+        cpu_abort(cpu_single_env, "TODO: 16-bit timer mode 0x%x\n",
+                  s->mode[n]);
+    }
+    s->tick[n] = tick;
+    qemu_mod_timer(s->timer[n], tick);
+}
+
+static void gptm_tick(void *opaque)
+{
+    gptm_state **p = (gptm_state **)opaque;
+    gptm_state *s;
+    int n;
+
+    s = *p;
+    n = p - s->opaque;
+    if (s->config == 0) {
+        s->state |= 1;
+        if ((s->control & 0x20)) {
+            /* Output trigger.  */
+	    qemu_irq_raise(s->trigger);
+	    qemu_irq_lower(s->trigger);
+        }
+        if (s->mode[0] & 1) {
+            /* One-shot.  */
+            s->control &= ~1;
+        } else {
+            /* Periodic.  */
+            gptm_reload(s, 0, 0);
+        }
+    } else if (s->config == 1) {
+        /* RTC.  */
+        uint32_t match;
+        s->rtc++;
+        match = s->match[0] | (s->match[1] << 16);
+        if (s->rtc > match)
+            s->rtc = 0;
+        if (s->rtc == 0) {
+            s->state |= 8;
+        }
+        gptm_reload(s, 0, 0);
+    } else if (s->mode[n] == 0xa) {
+        /* PWM mode.  Not implemented.  */
+    } else {
+        cpu_abort(cpu_single_env, "TODO: 16-bit timer mode 0x%x\n",
+                  s->mode[n]);
+    }
+    gptm_update_irq(s);
+}
+
+static uint32_t gptm_read(void *opaque, target_phys_addr_t offset)
+{
+    gptm_state *s = (gptm_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x00: /* CFG */
+        return s->config;
+    case 0x04: /* TAMR */
+        return s->mode[0];
+    case 0x08: /* TBMR */
+        return s->mode[1];
+    case 0x0c: /* CTL */
+        return s->control;
+    case 0x18: /* IMR */
+        return s->mask;
+    case 0x1c: /* RIS */
+        return s->state;
+    case 0x20: /* MIS */
+        return s->state & s->mask;
+    case 0x24: /* CR */
+        return 0;
+    case 0x28: /* TAILR */
+        return s->load[0] | ((s->config < 4) ? (s->load[1] << 16) : 0);
+    case 0x2c: /* TBILR */
+        return s->load[1];
+    case 0x30: /* TAMARCHR */
+        return s->match[0] | ((s->config < 4) ? (s->match[1] << 16) : 0);
+    case 0x34: /* TBMATCHR */
+        return s->match[1];
+    case 0x38: /* TAPR */
+        return s->prescale[0];
+    case 0x3c: /* TBPR */
+        return s->prescale[1];
+    case 0x40: /* TAPMR */
+        return s->match_prescale[0];
+    case 0x44: /* TBPMR */
+        return s->match_prescale[1];
+    case 0x48: /* TAR */
+        if (s->control == 1)
+            return s->rtc;
+    case 0x4c: /* TBR */
+        cpu_abort(cpu_single_env, "TODO: Timer value read\n");
+    default:
+        cpu_abort(cpu_single_env, "gptm_read: Bad offset 0x%x\n", (int)offset);
+        return 0;
+    }
+}
+
+static void gptm_write(void *opaque, target_phys_addr_t offset, uint32_t value)
+{
+    gptm_state *s = (gptm_state *)opaque;
+    uint32_t oldval;
+
+    offset -= s->base;
+    /* The timers should be disabled before changing the configuration.
+       We take advantage of this and defer everything until the timer
+       is enabled.  */
+    switch (offset) {
+    case 0x00: /* CFG */
+        s->config = value;
+        break;
+    case 0x04: /* TAMR */
+        s->mode[0] = value;
+        break;
+    case 0x08: /* TBMR */
+        s->mode[1] = value;
+        break;
+    case 0x0c: /* CTL */
+        oldval = s->control;
+        s->control = value;
+        /* TODO: Implement pause.  */
+        if ((oldval ^ value) & 1) {
+            if (value & 1) {
+                gptm_reload(s, 0, 1);
+            } else {
+                gptm_stop(s, 0);
+            }
+        }
+        if (((oldval ^ value) & 0x100) && s->config >= 4) {
+            if (value & 0x100) {
+                gptm_reload(s, 1, 1);
+            } else {
+                gptm_stop(s, 1);
+            }
+        }
+        break;
+    case 0x18: /* IMR */
+        s->mask = value & 0x77;
+        gptm_update_irq(s);
+        break;
+    case 0x24: /* CR */
+        s->state &= ~value;
+        break;
+    case 0x28: /* TAILR */
+        s->load[0] = value & 0xffff;
+        if (s->config < 4) {
+            s->load[1] = value >> 16;
+        }
+        break;
+    case 0x2c: /* TBILR */
+        s->load[1] = value & 0xffff;
+        break;
+    case 0x30: /* TAMARCHR */
+        s->match[0] = value & 0xffff;
+        if (s->config < 4) {
+            s->match[1] = value >> 16;
+        }
+        break;
+    case 0x34: /* TBMATCHR */
+        s->match[1] = value >> 16;
+        break;
+    case 0x38: /* TAPR */
+        s->prescale[0] = value;
+        break;
+    case 0x3c: /* TBPR */
+        s->prescale[1] = value;
+        break;
+    case 0x40: /* TAPMR */
+        s->match_prescale[0] = value;
+        break;
+    case 0x44: /* TBPMR */
+        s->match_prescale[0] = value;
+        break;
+    default:
+        cpu_abort(cpu_single_env, "gptm_write: Bad offset 0x%x\n", (int)offset);
+    }
+    gptm_update_irq(s);
+}
+
+static CPUReadMemoryFunc *gptm_readfn[] = {
+   gptm_read,
+   gptm_read,
+   gptm_read
+};
+
+static CPUWriteMemoryFunc *gptm_writefn[] = {
+   gptm_write,
+   gptm_write,
+   gptm_write
+};
+
+static void stellaris_gptm_init(uint32_t base, qemu_irq irq, qemu_irq trigger)
+{
+    int iomemtype;
+    gptm_state *s;
+
+    s = (gptm_state *)qemu_mallocz(sizeof(gptm_state));
+    s->base = base;
+    s->irq = irq;
+    s->trigger = trigger;
+    s->opaque[0] = s->opaque[1] = s;
+
+    iomemtype = cpu_register_io_memory(0, gptm_readfn,
+                                       gptm_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    s->timer[0] = qemu_new_timer(vm_clock, gptm_tick, &s->opaque[0]);
+    s->timer[1] = qemu_new_timer(vm_clock, gptm_tick, &s->opaque[1]);
+    /* ??? Save/restore.  */
+}
+
+
+/* System controller.  */
+
+typedef struct {
+    uint32_t base;
+    uint32_t pborctl;
+    uint32_t ldopctl;
+    uint32_t int_status;
+    uint32_t int_mask;
+    uint32_t resc;
+    uint32_t rcc;
+    uint32_t rcgc[3];
+    uint32_t scgc[3];
+    uint32_t dcgc[3];
+    uint32_t clkvclr;
+    uint32_t ldoarst;
+    uint32_t user0;
+    uint32_t user1;
+    qemu_irq irq;
+    stellaris_board_info *board;
+} ssys_state;
+
+static void ssys_update(ssys_state *s)
+{
+  qemu_set_irq(s->irq, (s->int_status & s->int_mask) != 0);
+}
+
+static uint32_t pllcfg_sandstorm[16] = {
+    0x31c0, /* 1 Mhz */
+    0x1ae0, /* 1.8432 Mhz */
+    0x18c0, /* 2 Mhz */
+    0xd573, /* 2.4576 Mhz */
+    0x37a6, /* 3.57954 Mhz */
+    0x1ae2, /* 3.6864 Mhz */
+    0x0c40, /* 4 Mhz */
+    0x98bc, /* 4.906 Mhz */
+    0x935b, /* 4.9152 Mhz */
+    0x09c0, /* 5 Mhz */
+    0x4dee, /* 5.12 Mhz */
+    0x0c41, /* 6 Mhz */
+    0x75db, /* 6.144 Mhz */
+    0x1ae6, /* 7.3728 Mhz */
+    0x0600, /* 8 Mhz */
+    0x585b /* 8.192 Mhz */
+};
+
+static uint32_t pllcfg_fury[16] = {
+    0x3200, /* 1 Mhz */
+    0x1b20, /* 1.8432 Mhz */
+    0x1900, /* 2 Mhz */
+    0xf42b, /* 2.4576 Mhz */
+    0x37e3, /* 3.57954 Mhz */
+    0x1b21, /* 3.6864 Mhz */
+    0x0c80, /* 4 Mhz */
+    0x98ee, /* 4.906 Mhz */
+    0xd5b4, /* 4.9152 Mhz */
+    0x0a00, /* 5 Mhz */
+    0x4e27, /* 5.12 Mhz */
+    0x1902, /* 6 Mhz */
+    0xec1c, /* 6.144 Mhz */
+    0x1b23, /* 7.3728 Mhz */
+    0x0640, /* 8 Mhz */
+    0xb11c /* 8.192 Mhz */
+};
+
+static uint32_t ssys_read(void *opaque, target_phys_addr_t offset)
+{
+    ssys_state *s = (ssys_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x000: /* DID0 */
+        return s->board->did0;
+    case 0x004: /* DID1 */
+        return s->board->did1;
+    case 0x008: /* DC0 */
+        return s->board->dc0;
+    case 0x010: /* DC1 */
+        return s->board->dc1;
+    case 0x014: /* DC2 */
+        return s->board->dc2;
+    case 0x018: /* DC3 */
+        return s->board->dc3;
+    case 0x01c: /* DC4 */
+        return s->board->dc4;
+    case 0x030: /* PBORCTL */
+        return s->pborctl;
+    case 0x034: /* LDOPCTL */
+        return s->ldopctl;
+    case 0x040: /* SRCR0 */
+        return 0;
+    case 0x044: /* SRCR1 */
+        return 0;
+    case 0x048: /* SRCR2 */
+        return 0;
+    case 0x050: /* RIS */
+        return s->int_status;
+    case 0x054: /* IMC */
+        return s->int_mask;
+    case 0x058: /* MISC */
+        return s->int_status & s->int_mask;
+    case 0x05c: /* RESC */
+        return s->resc;
+    case 0x060: /* RCC */
+        return s->rcc;
+    case 0x064: /* PLLCFG */
+        {
+            int xtal;
+            xtal = (s->rcc >> 6) & 0xf;
+            if (s->board->did0 & (1 << 16)) {
+                return pllcfg_fury[xtal];
+            } else {
+                return pllcfg_sandstorm[xtal];
+            }
+        }
+    case 0x100: /* RCGC0 */
+        return s->rcgc[0];
+    case 0x104: /* RCGC1 */
+        return s->rcgc[1];
+    case 0x108: /* RCGC2 */
+        return s->rcgc[2];
+    case 0x110: /* SCGC0 */
+        return s->scgc[0];
+    case 0x114: /* SCGC1 */
+        return s->scgc[1];
+    case 0x118: /* SCGC2 */
+        return s->scgc[2];
+    case 0x120: /* DCGC0 */
+        return s->dcgc[0];
+    case 0x124: /* DCGC1 */
+        return s->dcgc[1];
+    case 0x128: /* DCGC2 */
+        return s->dcgc[2];
+    case 0x150: /* CLKVCLR */
+        return s->clkvclr;
+    case 0x160: /* LDOARST */
+        return s->ldoarst;
+    case 0x1e0: /* USER0 */
+        return s->user0;
+    case 0x1e4: /* USER1 */
+        return s->user1;
+    default:
+        cpu_abort(cpu_single_env, "ssys_read: Bad offset 0x%x\n", (int)offset);
+        return 0;
+    }
+}
+
+static void ssys_write(void *opaque, target_phys_addr_t offset, uint32_t value)
+{
+    ssys_state *s = (ssys_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x030: /* PBORCTL */
+        s->pborctl = value & 0xffff;
+        break;
+    case 0x034: /* LDOPCTL */
+        s->ldopctl = value & 0x1f;
+        break;
+    case 0x040: /* SRCR0 */
+    case 0x044: /* SRCR1 */
+    case 0x048: /* SRCR2 */
+        fprintf(stderr, "Peripheral reset not implemented\n");
+        break;
+    case 0x054: /* IMC */
+        s->int_mask = value & 0x7f;
+        break;
+    case 0x058: /* MISC */
+        s->int_status &= ~value;
+        break;
+    case 0x05c: /* RESC */
+        s->resc = value & 0x3f;
+        break;
+    case 0x060: /* RCC */
+        if ((s->rcc & (1 << 13)) != 0 && (value & (1 << 13)) == 0) {
+            /* PLL enable.  */
+            s->int_status |= (1 << 6);
+        }
+        s->rcc = value;
+        system_clock_scale = 5 * (((s->rcc >> 23) & 0xf) + 1);
+        break;
+    case 0x100: /* RCGC0 */
+        s->rcgc[0] = value;
+        break;
+    case 0x104: /* RCGC1 */
+        s->rcgc[1] = value;
+        break;
+    case 0x108: /* RCGC2 */
+        s->rcgc[2] = value;
+        break;
+    case 0x110: /* SCGC0 */
+        s->scgc[0] = value;
+        break;
+    case 0x114: /* SCGC1 */
+        s->scgc[1] = value;
+        break;
+    case 0x118: /* SCGC2 */
+        s->scgc[2] = value;
+        break;
+    case 0x120: /* DCGC0 */
+        s->dcgc[0] = value;
+        break;
+    case 0x124: /* DCGC1 */
+        s->dcgc[1] = value;
+        break;
+    case 0x128: /* DCGC2 */
+        s->dcgc[2] = value;
+        break;
+    case 0x150: /* CLKVCLR */
+        s->clkvclr = value;
+        break;
+    case 0x160: /* LDOARST */
+        s->ldoarst = value;
+        break;
+    default:
+        cpu_abort(cpu_single_env, "ssys_write: Bad offset 0x%x\n", (int)offset);
+    }
+    ssys_update(s);
+}
+
+static CPUReadMemoryFunc *ssys_readfn[] = {
+   ssys_read,
+   ssys_read,
+   ssys_read
+};
+
+static CPUWriteMemoryFunc *ssys_writefn[] = {
+   ssys_write,
+   ssys_write,
+   ssys_write
+};
+
+static void ssys_reset(void *opaque)
+{
+    ssys_state *s = (ssys_state *)opaque;
+
+    s->pborctl = 0x7ffd;
+    s->rcc = 0x078e3ac0;
+    s->rcgc[0] = 1;
+    s->scgc[0] = 1;
+    s->dcgc[0] = 1;
+}
+
+static void stellaris_sys_init(uint32_t base, qemu_irq irq,
+                               stellaris_board_info * board,
+                               uint8_t *macaddr)
+{
+    int iomemtype;
+    ssys_state *s;
+
+    s = (ssys_state *)qemu_mallocz(sizeof(ssys_state));
+    s->base = base;
+    s->irq = irq;
+    s->board = board;
+    /* Most devices come preprogrammed with a MAC address in the user data. */
+    s->user0 = macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16);
+    s->user1 = macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16);
+
+    iomemtype = cpu_register_io_memory(0, ssys_readfn,
+                                       ssys_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    ssys_reset(s);
+    /* ??? Save/restore.  */
+}
+
+
+/* I2C controller.  */
+
+typedef struct {
+    i2c_bus *bus;
+    qemu_irq irq;
+    uint32_t base;
+    uint32_t msa;
+    uint32_t mcs;
+    uint32_t mdr;
+    uint32_t mtpr;
+    uint32_t mimr;
+    uint32_t mris;
+    uint32_t mcr;
+} stellaris_i2c_state;
+
+#define STELLARIS_I2C_MCS_BUSY    0x01
+#define STELLARIS_I2C_MCS_ERROR   0x02
+#define STELLARIS_I2C_MCS_ADRACK  0x04
+#define STELLARIS_I2C_MCS_DATACK  0x08
+#define STELLARIS_I2C_MCS_ARBLST  0x10
+#define STELLARIS_I2C_MCS_IDLE    0x20
+#define STELLARIS_I2C_MCS_BUSBSY  0x40
+
+static uint32_t stellaris_i2c_read(void *opaque, target_phys_addr_t offset)
+{
+    stellaris_i2c_state *s = (stellaris_i2c_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x00: /* MSA */
+        return s->msa;
+    case 0x04: /* MCS */
+        /* We don't emulate timing, so the controller is never busy.  */
+        return s->mcs | STELLARIS_I2C_MCS_IDLE;
+    case 0x08: /* MDR */
+        return s->mdr;
+    case 0x0c: /* MTPR */
+        return s->mtpr;
+    case 0x10: /* MIMR */
+        return s->mimr;
+    case 0x14: /* MRIS */
+        return s->mris;
+    case 0x18: /* MMIS */
+        return s->mris & s->mimr;
+    case 0x20: /* MCR */
+        return s->mcr;
+    default:
+        cpu_abort(cpu_single_env, "strllaris_i2c_read: Bad offset 0x%x\n",
+                  (int)offset);
+        return 0;
+    }
+}
+
+static void stellaris_i2c_update(stellaris_i2c_state *s)
+{
+    int level;
+
+    level = (s->mris & s->mimr) != 0;
+    qemu_set_irq(s->irq, level);
+}
+
+static void stellaris_i2c_write(void *opaque, target_phys_addr_t offset,
+                                uint32_t value)
+{
+    stellaris_i2c_state *s = (stellaris_i2c_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x00: /* MSA */
+        s->msa = value & 0xff;
+        break;
+    case 0x04: /* MCS */
+        if ((s->mcr & 0x10) == 0) {
+            /* Disabled.  Do nothing.  */
+            break;
+        }
+        /* Grab the bus if this is starting a transfer.  */
+        if ((value & 2) && (s->mcs & STELLARIS_I2C_MCS_BUSBSY) == 0) {
+            if (i2c_start_transfer(s->bus, s->msa >> 1, s->msa & 1)) {
+                s->mcs |= STELLARIS_I2C_MCS_ARBLST;
+            } else {
+                s->mcs &= ~STELLARIS_I2C_MCS_ARBLST;
+                s->mcs |= STELLARIS_I2C_MCS_BUSBSY;
+            }
+        }
+        /* If we don't have the bus then indicate an error.  */
+        if (!i2c_bus_busy(s->bus)
+                || (s->mcs & STELLARIS_I2C_MCS_BUSBSY) == 0) {
+            s->mcs |= STELLARIS_I2C_MCS_ERROR;
+            break;
+        }
+        s->mcs &= ~STELLARIS_I2C_MCS_ERROR;
+        if (value & 1) {
+            /* Transfer a byte.  */
+            /* TODO: Handle errors.  */
+            if (s->msa & 1) {
+                /* Recv */
+                s->mdr = i2c_recv(s->bus) & 0xff;
+            } else {
+                /* Send */
+                i2c_send(s->bus, s->mdr);
+            }
+            /* Raise an interrupt.  */
+            s->mris |= 1;
+        }
+        if (value & 4) {
+            /* Finish transfer.  */
+            i2c_end_transfer(s->bus);
+            s->mcs &= ~STELLARIS_I2C_MCS_BUSBSY;
+        }
+        break;
+    case 0x08: /* MDR */
+        s->mdr = value & 0xff;
+        break;
+    case 0x0c: /* MTPR */
+        s->mtpr = value & 0xff;
+        break;
+    case 0x10: /* MIMR */
+        s->mimr = 1;
+        break;
+    case 0x1c: /* MICR */
+        s->mris &= ~value;
+        break;
+    case 0x20: /* MCR */
+        if (value & 1)
+            cpu_abort(cpu_single_env,
+                      "stellaris_i2c_write: Loopback not implemented\n");
+        if (value & 0x20)
+            cpu_abort(cpu_single_env,
+                      "stellaris_i2c_write: Slave mode not implemented\n");
+        s->mcr = value & 0x31;
+        break;
+    default:
+        cpu_abort(cpu_single_env, "stellaris_i2c_write: Bad offset 0x%x\n",
+                  (int)offset);
+    }
+    stellaris_i2c_update(s);
+}
+
+static void stellaris_i2c_reset(stellaris_i2c_state *s)
+{
+    if (s->mcs & STELLARIS_I2C_MCS_BUSBSY)
+        i2c_end_transfer(s->bus);
+
+    s->msa = 0;
+    s->mcs = 0;
+    s->mdr = 0;
+    s->mtpr = 1;
+    s->mimr = 0;
+    s->mris = 0;
+    s->mcr = 0;
+    stellaris_i2c_update(s);
+}
+
+static CPUReadMemoryFunc *stellaris_i2c_readfn[] = {
+   stellaris_i2c_read,
+   stellaris_i2c_read,
+   stellaris_i2c_read
+};
+
+static CPUWriteMemoryFunc *stellaris_i2c_writefn[] = {
+   stellaris_i2c_write,
+   stellaris_i2c_write,
+   stellaris_i2c_write
+};
+
+static void stellaris_i2c_init(uint32_t base, qemu_irq irq, i2c_bus *bus)
+{
+    stellaris_i2c_state *s;
+    int iomemtype;
+
+    s = (stellaris_i2c_state *)qemu_mallocz(sizeof(stellaris_i2c_state));
+    s->base = base;
+    s->irq = irq;
+    s->bus = bus;
+
+    iomemtype = cpu_register_io_memory(0, stellaris_i2c_readfn,
+                                       stellaris_i2c_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    /* ??? For now we only implement the master interface.  */
+    stellaris_i2c_reset(s);
+}
+
+/* Analogue to Digital Converter.  This is only partially implemented,
+   enough for applications that use a combined ADC and timer tick.  */
+
+#define STELLARIS_ADC_EM_CONTROLLER 0
+#define STELLARIS_ADC_EM_COMP       1
+#define STELLARIS_ADC_EM_EXTERNAL   4
+#define STELLARIS_ADC_EM_TIMER      5
+#define STELLARIS_ADC_EM_PWM0       6
+#define STELLARIS_ADC_EM_PWM1       7
+#define STELLARIS_ADC_EM_PWM2       8
+
+#define STELLARIS_ADC_FIFO_EMPTY    0x0100
+#define STELLARIS_ADC_FIFO_FULL     0x1000
+
+typedef struct
+{
+    uint32_t base;
+    uint32_t actss;
+    uint32_t ris;
+    uint32_t im;
+    uint32_t emux;
+    uint32_t ostat;
+    uint32_t ustat;
+    uint32_t sspri;
+    uint32_t sac;
+    struct {
+        uint32_t state;
+        uint32_t data[16];
+    } fifo[4];
+    uint32_t ssmux[4];
+    uint32_t ssctl[4];
+    qemu_irq irq;
+} stellaris_adc_state;
+
+static uint32_t stellaris_adc_fifo_read(stellaris_adc_state *s, int n)
+{
+    int tail;
+
+    tail = s->fifo[n].state & 0xf;
+    if (s->fifo[n].state & STELLARIS_ADC_FIFO_EMPTY) {
+        s->ustat |= 1 << n;
+    } else {
+        s->fifo[n].state = (s->fifo[n].state & ~0xf) | ((tail + 1) & 0xf);
+        s->fifo[n].state &= ~STELLARIS_ADC_FIFO_FULL;
+        if (tail + 1 == ((s->fifo[n].state >> 4) & 0xf))
+            s->fifo[n].state |= STELLARIS_ADC_FIFO_EMPTY;
+    }
+    return s->fifo[n].data[tail];
+}
+
+static void stellaris_adc_fifo_write(stellaris_adc_state *s, int n,
+                                     uint32_t value)
+{
+    int head;
+
+    head = (s->fifo[n].state >> 4) & 0xf;
+    if (s->fifo[n].state & STELLARIS_ADC_FIFO_FULL) {
+        s->ostat |= 1 << n;
+        return;
+    }
+    s->fifo[n].data[head] = value;
+    head = (head + 1) & 0xf;
+    s->fifo[n].state &= ~STELLARIS_ADC_FIFO_EMPTY;
+    s->fifo[n].state = (s->fifo[n].state & ~0xf0) | (head << 4);
+    if ((s->fifo[n].state & 0xf) == head)
+        s->fifo[n].state |= STELLARIS_ADC_FIFO_FULL;
+}
+
+static void stellaris_adc_update(stellaris_adc_state *s)
+{
+    int level;
+
+    level = (s->ris & s->im) != 0;
+    qemu_set_irq(s->irq, level);
+}
+
+static void stellaris_adc_trigger(void *opaque, int irq, int level)
+{
+    stellaris_adc_state *s = (stellaris_adc_state *)opaque;
+    /* Some applications use the ADC as a random number source, so introduce
+       some variation into the signal.  */
+    static uint32_t noise = 0;
+
+    if ((s->actss & 1) == 0) {
+        return;
+    }
+
+    noise = noise * 314159 + 1;
+    /* ??? actual inputs not implemented.  Return an arbitrary value.  */
+    stellaris_adc_fifo_write(s, 0, 0x200 + ((noise >> 16) & 7));
+    s->ris |= 1;
+    stellaris_adc_update(s);
+}
+
+static void stellaris_adc_reset(stellaris_adc_state *s)
+{
+    int n;
+
+    for (n = 0; n < 4; n++) {
+        s->ssmux[n] = 0;
+        s->ssctl[n] = 0;
+        s->fifo[n].state = STELLARIS_ADC_FIFO_EMPTY;
+    }
+}
+
+static uint32_t stellaris_adc_read(void *opaque, target_phys_addr_t offset)
+{
+    stellaris_adc_state *s = (stellaris_adc_state *)opaque;
+
+    /* TODO: Implement this.  */
+    offset -= s->base;
+    if (offset >= 0x40 && offset < 0xc0) {
+        int n;
+        n = (offset - 0x40) >> 5;
+        switch (offset & 0x1f) {
+        case 0x00: /* SSMUX */
+            return s->ssmux[n];
+        case 0x04: /* SSCTL */
+            return s->ssctl[n];
+        case 0x08: /* SSFIFO */
+            return stellaris_adc_fifo_read(s, n);
+        case 0x0c: /* SSFSTAT */
+            return s->fifo[n].state;
+        default:
+            break;
+        }
+    }
+    switch (offset) {
+    case 0x00: /* ACTSS */
+        return s->actss;
+    case 0x04: /* RIS */
+        return s->ris;
+    case 0x08: /* IM */
+        return s->im;
+    case 0x0c: /* ISC */
+        return s->ris & s->im;
+    case 0x10: /* OSTAT */
+        return s->ostat;
+    case 0x14: /* EMUX */
+        return s->emux;
+    case 0x18: /* USTAT */
+        return s->ustat;
+    case 0x20: /* SSPRI */
+        return s->sspri;
+    case 0x30: /* SAC */
+        return s->sac;
+    default:
+        cpu_abort(cpu_single_env, "strllaris_adc_read: Bad offset 0x%x\n",
+                  (int)offset);
+        return 0;
+    }
+}
+
+static void stellaris_adc_write(void *opaque, target_phys_addr_t offset,
+                                uint32_t value)
+{
+    stellaris_adc_state *s = (stellaris_adc_state *)opaque;
+
+    /* TODO: Implement this.  */
+    offset -= s->base;
+    if (offset >= 0x40 && offset < 0xc0) {
+        int n;
+        n = (offset - 0x40) >> 5;
+        switch (offset & 0x1f) {
+        case 0x00: /* SSMUX */
+            s->ssmux[n] = value & 0x33333333;
+            return;
+        case 0x04: /* SSCTL */
+            if (value != 6) {
+                cpu_abort(cpu_single_env, "ADC: Unimplemented sequence %x\n",
+                          value);
+            }
+            s->ssctl[n] = value;
+            return;
+        default:
+            break;
+        }
+    }
+    switch (offset) {
+    case 0x00: /* ACTSS */
+        s->actss = value & 0xf;
+        if (value & 0xe) {
+            cpu_abort(cpu_single_env,
+                      "Not implemented:  ADC sequencers 1-3\n");
+        }
+        break;
+    case 0x08: /* IM */
+        s->im = value;
+        break;
+    case 0x0c: /* ISC */
+        s->ris &= ~value;
+        break;
+    case 0x10: /* OSTAT */
+        s->ostat &= ~value;
+        break;
+    case 0x14: /* EMUX */
+        s->emux = value;
+        break;
+    case 0x18: /* USTAT */
+        s->ustat &= ~value;
+        break;
+    case 0x20: /* SSPRI */
+        s->sspri = value;
+        break;
+    case 0x28: /* PSSI */
+        cpu_abort(cpu_single_env, "Not implemented:  ADC sample initiate\n");
+        break;
+    case 0x30: /* SAC */
+        s->sac = value;
+        break;
+    default:
+        cpu_abort(cpu_single_env, "stellaris_adc_write: Bad offset 0x%x\n",
+                  (int)offset);
+    }
+    stellaris_adc_update(s);
+}
+
+static CPUReadMemoryFunc *stellaris_adc_readfn[] = {
+   stellaris_adc_read,
+   stellaris_adc_read,
+   stellaris_adc_read
+};
+
+static CPUWriteMemoryFunc *stellaris_adc_writefn[] = {
+   stellaris_adc_write,
+   stellaris_adc_write,
+   stellaris_adc_write
+};
+
+static qemu_irq stellaris_adc_init(uint32_t base, qemu_irq irq)
+{
+    stellaris_adc_state *s;
+    int iomemtype;
+    qemu_irq *qi;
+
+    s = (stellaris_adc_state *)qemu_mallocz(sizeof(stellaris_adc_state));
+    s->base = base;
+    s->irq = irq;
+
+    iomemtype = cpu_register_io_memory(0, stellaris_adc_readfn,
+                                       stellaris_adc_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    stellaris_adc_reset(s);
+    qi = qemu_allocate_irqs(stellaris_adc_trigger, s, 1);
+    return qi[0];
+}
+
+/* Some boards have both an OLED controller and SD card connected to
+   the same SSI port, with the SD card chip select connected to a
+   GPIO pin.  Technically the OLED chip select is connected to the SSI
+   Fss pin.  We do not bother emulating that as both devices should
+   never be selected simultaneously, and our OLED controller ignores stray
+   0xff commands that occur when deselecting the SD card.  */
+
+typedef struct {
+    ssi_xfer_cb xfer_cb[2];
+    void *opaque[2];
+    qemu_irq irq;
+    int current_dev;
+} stellaris_ssi_bus_state;
+
+static void stellaris_ssi_bus_select(void *opaque, int irq, int level)
+{
+    stellaris_ssi_bus_state *s = (stellaris_ssi_bus_state *)opaque;
+
+    s->current_dev = level;
+}
+
+static int stellaris_ssi_bus_xfer(void *opaque, int val)
+{
+    stellaris_ssi_bus_state *s = (stellaris_ssi_bus_state *)opaque;
+
+    return s->xfer_cb[s->current_dev](s->opaque[s->current_dev], val);
+}
+
+static void *stellaris_ssi_bus_init(qemu_irq *irqp,
+                                    ssi_xfer_cb cb0, void *opaque0,
+                                    ssi_xfer_cb cb1, void *opaque1)
+{
+    qemu_irq *qi;
+    stellaris_ssi_bus_state *s;
+
+    s = (stellaris_ssi_bus_state *)qemu_mallocz(sizeof(stellaris_ssi_bus_state));
+    s->xfer_cb[0] = cb0;
+    s->opaque[0] = opaque0;
+    s->xfer_cb[1] = cb1;
+    s->opaque[1] = opaque1;
+    qi = qemu_allocate_irqs(stellaris_ssi_bus_select, s, 1);
+    *irqp = *qi;
+    return s;
+}
+
+/* Board init.  */
+static stellaris_board_info stellaris_boards[] = {
+  { "LM3S811EVB",
+    0,
+    0x0032000e,
+    0x001f001f, /* dc0 */
+    0x001132bf,
+    0x01071013,
+    0x3f0f01ff,
+    0x0000001f,
+    BP_OLED_I2C
+  },
+  { "LM3S6965EVB",
+    0x10010002,
+    0x1073402e,
+    0x00ff007f, /* dc0 */
+    0x001133ff,
+    0x030f5317,
+    0x0f0f87ff,
+    0x5000007f,
+    BP_OLED_SSI | BP_GAMEPAD
+  }
+};
+
+static void stellaris_init(const char *kernel_filename, const char *cpu_model,
+                           DisplayState *ds, stellaris_board_info *board)
+{
+    static const int uart_irq[] = {5, 6, 33, 34};
+    static const int timer_irq[] = {19, 21, 23, 35};
+    static const uint32_t gpio_addr[7] =
+      { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
+        0x40024000, 0x40025000, 0x40026000};
+    static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
+
+    qemu_irq *pic;
+    qemu_irq *gpio_in[5];
+    qemu_irq *gpio_out[5];
+    qemu_irq adc;
+    int sram_size;
+    int flash_size;
+    i2c_bus *i2c;
+    int i;
+
+    flash_size = ((board->dc0 & 0xffff) + 1) << 1;
+    sram_size = (board->dc0 >> 18) + 1;
+    pic = armv7m_init(flash_size, sram_size, kernel_filename, cpu_model);
+
+    if (board->dc1 & (1 << 16)) {
+        adc = stellaris_adc_init(0x40038000, pic[14]);
+    } else {
+        adc = NULL;
+    }
+    for (i = 0; i < 4; i++) {
+        if (board->dc2 & (0x10000 << i)) {
+            stellaris_gptm_init(0x40030000 + i * 0x1000,
+                                pic[timer_irq[i]], adc);
+        }
+    }
+
+    stellaris_sys_init(0x400fe000, pic[28], board, nd_table[0].macaddr);
+
+    for (i = 0; i < 7; i++) {
+        if (board->dc4 & (1 << i)) {
+            gpio_in[i] = pl061_init(gpio_addr[i], pic[gpio_irq[i]],
+                                    &gpio_out[i]);
+        }
+    }
+
+    if (board->dc2 & (1 << 12)) {
+        i2c = i2c_init_bus();
+        stellaris_i2c_init(0x40020000, pic[8], i2c);
+        if (board->peripherals & BP_OLED_I2C) {
+            ssd0303_init(ds, i2c, 0x3d);
+        }
+    }
+
+    for (i = 0; i < 4; i++) {
+        if (board->dc2 & (1 << i)) {
+            pl011_init(0x4000c000 + i * 0x1000, pic[uart_irq[i]],
+                       serial_hds[i], PL011_LUMINARY);
+        }
+    }
+    if (board->dc2 & (1 << 4)) {
+        if (board->peripherals & BP_OLED_SSI) {
+            void * oled;
+            void * sd;
+            void *ssi_bus;
+            int index;
+
+            oled = ssd0323_init(ds, &gpio_out[GPIO_C][7]);
+            index = drive_get_index(IF_SD, 0, 0);
+            sd = ssi_sd_init(drives_table[index].bdrv);
+
+            ssi_bus = stellaris_ssi_bus_init(&gpio_out[GPIO_D][0],
+                                             ssi_sd_xfer, sd,
+                                             ssd0323_xfer_ssi, oled);
+
+            pl022_init(0x40008000, pic[7], stellaris_ssi_bus_xfer, ssi_bus);
+            /* Make sure the select pin is high.  */
+            qemu_irq_raise(gpio_out[GPIO_D][0]);
+        } else {
+            pl022_init(0x40008000, pic[7], NULL, NULL);
+        }
+    }
+    if (board->dc4 & (1 << 28)) {
+        /* FIXME: Obey network model.  */
+        stellaris_enet_init(&nd_table[0], 0x40048000, pic[42]);
+    }
+    if (board->peripherals & BP_GAMEPAD) {
+        qemu_irq gpad_irq[5];
+        static const int gpad_keycode[5] = { 0xc8, 0xd0, 0xcb, 0xcd, 0x1d };
+
+        gpad_irq[0] = qemu_irq_invert(gpio_in[GPIO_E][0]); /* up */
+        gpad_irq[1] = qemu_irq_invert(gpio_in[GPIO_E][1]); /* down */
+        gpad_irq[2] = qemu_irq_invert(gpio_in[GPIO_E][2]); /* left */
+        gpad_irq[3] = qemu_irq_invert(gpio_in[GPIO_E][3]); /* right */
+        gpad_irq[4] = qemu_irq_invert(gpio_in[GPIO_F][1]); /* select */
+
+        stellaris_gamepad_init(5, gpad_irq, gpad_keycode);
+    }
+}
+
+/* FIXME: Figure out how to generate these from stellaris_boards.  */
+static void lm3s811evb_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
+                     const char *kernel_filename, const char *kernel_cmdline,
+                     const char *initrd_filename, const char *cpu_model)
+{
+    stellaris_init(kernel_filename, cpu_model, ds, &stellaris_boards[0]);
+}
+
+static void lm3s6965evb_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
+                     const char *kernel_filename, const char *kernel_cmdline,
+                     const char *initrd_filename, const char *cpu_model)
+{
+    stellaris_init(kernel_filename, cpu_model, ds, &stellaris_boards[1]);
+}
+
+QEMUMachine lm3s811evb_machine = {
+    "lm3s811evb",
+    "Stellaris LM3S811EVB",
+    lm3s811evb_init,
+};
+
+QEMUMachine lm3s6965evb_machine = {
+    "lm3s6965evb",
+    "Stellaris LM3S6965EVB",
+    lm3s6965evb_init,
+};
diff --git a/hw/stellaris_enet.c b/hw/stellaris_enet.c
new file mode 100644
index 000000000..31711b9d6
--- /dev/null
+++ b/hw/stellaris_enet.c
@@ -0,0 +1,347 @@
+/*
+ * Luminary Micro Stellaris Ethernet Controller
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+#include "hw.h"
+#include "arm-misc.h"
+#include "net.h"
+#include <zlib.h>
+
+//#define DEBUG_STELLARIS_ENET 1
+
+#ifdef DEBUG_STELLARIS_ENET
+#define DPRINTF(fmt, args...) \
+do { printf("stellaris_enet: " fmt , ##args); } while (0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "stellaris_enet: error: " fmt , ##args); exit(1);} while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "stellaris_enet: error: " fmt , ##args);} while (0)
+#endif
+
+#define SE_INT_RX       0x01
+#define SE_INT_TXER     0x02
+#define SE_INT_TXEMP    0x04
+#define SE_INT_FOV      0x08
+#define SE_INT_RXER     0x10
+#define SE_INT_MD       0x20
+#define SE_INT_PHY      0x40
+
+#define SE_RCTL_RXEN    0x01
+#define SE_RCTL_AMUL    0x02
+#define SE_RCTL_PRMS    0x04
+#define SE_RCTL_BADCRC  0x08
+#define SE_RCTL_RSTFIFO 0x10
+
+#define SE_TCTL_TXEN    0x01
+#define SE_TCTL_PADEN   0x02
+#define SE_TCTL_CRC     0x04
+#define SE_TCTL_DUPLEX  0x08
+
+typedef struct {
+    uint32_t base;
+    uint32_t ris;
+    uint32_t im;
+    uint32_t rctl;
+    uint32_t tctl;
+    uint32_t thr;
+    uint32_t mctl;
+    uint32_t mdv;
+    uint32_t mtxd;
+    uint32_t mrxd;
+    uint32_t np;
+    int tx_frame_len;
+    int tx_fifo_len;
+    uint8_t tx_fifo[2048];
+    /* Real hardware has a 2k fifo, which works out to be at most 31 packets.
+       We implement a full 31 packet fifo.  */
+    struct {
+        uint8_t data[2048];
+        int len;
+    } rx[31];
+    uint8_t *rx_fifo;
+    int rx_fifo_len;
+    int next_packet;
+    VLANClientState *vc;
+    qemu_irq irq;
+    uint8_t macaddr[6];
+} stellaris_enet_state;
+
+static void stellaris_enet_update(stellaris_enet_state *s)
+{
+    qemu_set_irq(s->irq, (s->ris & s->im) != 0);
+}
+
+/* TODO: Implement MAC address filtering.  */
+static void stellaris_enet_receive(void *opaque, const uint8_t *buf, int size)
+{
+    stellaris_enet_state *s = (stellaris_enet_state *)opaque;
+    int n;
+    uint8_t *p;
+    uint32_t crc;
+
+    if ((s->rctl & SE_RCTL_RXEN) == 0)
+        return;
+    if (s->np >= 31) {
+        DPRINTF("Packet dropped\n");
+        return;
+    }
+
+    DPRINTF("Received packet len=%d\n", size);
+    n = s->next_packet + s->np;
+    if (n >= 31)
+        n -= 31;
+    s->np++;
+
+    s->rx[n].len = size + 6;
+    p = s->rx[n].data;
+    *(p++) = (size + 6);
+    *(p++) = (size + 6) >> 8;
+    memcpy (p, buf, size);
+    p += size;
+    crc = crc32(~0, buf, size);
+    *(p++) = crc;
+    *(p++) = crc >> 8;
+    *(p++) = crc >> 16;
+    *(p++) = crc >> 24;
+    /* Clear the remaining bytes in the last word.  */
+    if ((size & 3) != 2) {
+        memset(p, 0, (6 - size) & 3);
+    }
+
+    s->ris |= SE_INT_RX;
+    stellaris_enet_update(s);
+}
+
+static int stellaris_enet_can_receive(void *opaque)
+{
+    stellaris_enet_state *s = (stellaris_enet_state *)opaque;
+
+    if ((s->rctl & SE_RCTL_RXEN) == 0)
+        return 1;
+
+    return (s->np < 31);
+}
+
+static uint32_t stellaris_enet_read(void *opaque, target_phys_addr_t offset)
+{
+    stellaris_enet_state *s = (stellaris_enet_state *)opaque;
+    uint32_t val;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x00: /* RIS */
+        DPRINTF("IRQ status %02x\n", s->ris);
+        return s->ris;
+    case 0x04: /* IM */
+        return s->im;
+    case 0x08: /* RCTL */
+        return s->rctl;
+    case 0x0c: /* TCTL */
+        return s->tctl;
+    case 0x10: /* DATA */
+        if (s->rx_fifo_len == 0) {
+            if (s->np == 0) {
+                BADF("RX underflow\n");
+                return 0;
+            }
+            s->rx_fifo_len = s->rx[s->next_packet].len;
+            s->rx_fifo = s->rx[s->next_packet].data;
+            DPRINTF("RX FIFO start packet len=%d\n", s->rx_fifo_len);
+        }
+        val = s->rx_fifo[0] | (s->rx_fifo[1] << 8) | (s->rx_fifo[2] << 16)
+              | (s->rx_fifo[3] << 24);
+        s->rx_fifo += 4;
+        s->rx_fifo_len -= 4;
+        if (s->rx_fifo_len <= 0) {
+            s->rx_fifo_len = 0;
+            s->next_packet++;
+            if (s->next_packet >= 31)
+                s->next_packet = 0;
+            s->np--;
+            DPRINTF("RX done np=%d\n", s->np);
+        }
+        return val;
+    case 0x14: /* IA0 */
+        return s->macaddr[0] | (s->macaddr[1] << 8)
+               | (s->macaddr[2] << 16) | (s->macaddr[3] << 24);
+    case 0x18: /* IA1 */
+        return s->macaddr[4] | (s->macaddr[5] << 8);
+    case 0x1c: /* THR */
+        return s->thr;
+    case 0x20: /* MCTL */
+        return s->mctl;
+    case 0x24: /* MDV */
+        return s->mdv;
+    case 0x28: /* MADD */
+        return 0;
+    case 0x2c: /* MTXD */
+        return s->mtxd;
+    case 0x30: /* MRXD */
+        return s->mrxd;
+    case 0x34: /* NP */
+        return s->np;
+    case 0x38: /* TR */
+        return 0;
+    case 0x3c: /* Undocuented: Timestamp? */
+        return 0;
+    default:
+        cpu_abort (cpu_single_env, "stellaris_enet_read: Bad offset %x\n",
+                   (int)offset);
+        return 0;
+    }
+}
+
+static void stellaris_enet_write(void *opaque, target_phys_addr_t offset,
+                        uint32_t value)
+{
+    stellaris_enet_state *s = (stellaris_enet_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x00: /* IACK */
+        s->ris &= ~value;
+        DPRINTF("IRQ ack %02x/%02x\n", value, s->ris);
+        stellaris_enet_update(s);
+        /* Clearing TXER also resets the TX fifo.  */
+        if (value & SE_INT_TXER)
+            s->tx_frame_len = -1;
+        break;
+    case 0x04: /* IM */
+        DPRINTF("IRQ mask %02x/%02x\n", value, s->ris);
+        s->im = value;
+        stellaris_enet_update(s);
+        break;
+    case 0x08: /* RCTL */
+        s->rctl = value;
+        if (value & SE_RCTL_RSTFIFO) {
+            s->rx_fifo_len = 0;
+            s->np = 0;
+            stellaris_enet_update(s);
+        }
+        break;
+    case 0x0c: /* TCTL */
+        s->tctl = value;
+        break;
+    case 0x10: /* DATA */
+        if (s->tx_frame_len == -1) {
+            s->tx_frame_len = value & 0xffff;
+            if (s->tx_frame_len > 2032) {
+                DPRINTF("TX frame too long (%d)\n", s->tx_frame_len);
+                s->tx_frame_len = 0;
+                s->ris |= SE_INT_TXER;
+                stellaris_enet_update(s);
+            } else {
+                DPRINTF("Start TX frame len=%d\n", s->tx_frame_len);
+                /* The value written does not include the ethernet header.  */
+                s->tx_frame_len += 14;
+                if ((s->tctl & SE_TCTL_CRC) == 0)
+                    s->tx_frame_len += 4;
+                s->tx_fifo_len = 0;
+                s->tx_fifo[s->tx_fifo_len++] = value >> 16;
+                s->tx_fifo[s->tx_fifo_len++] = value >> 24;
+            }
+        } else {
+            s->tx_fifo[s->tx_fifo_len++] = value;
+            s->tx_fifo[s->tx_fifo_len++] = value >> 8;
+            s->tx_fifo[s->tx_fifo_len++] = value >> 16;
+            s->tx_fifo[s->tx_fifo_len++] = value >> 24;
+            if (s->tx_fifo_len >= s->tx_frame_len) {
+                /* We don't implement explicit CRC, so just chop it off.  */
+                if ((s->tctl & SE_TCTL_CRC) == 0)
+                    s->tx_frame_len -= 4;
+                if ((s->tctl & SE_TCTL_PADEN) && s->tx_frame_len < 60) {
+                    memset(&s->tx_fifo[s->tx_frame_len], 0, 60 - s->tx_frame_len);
+                    s->tx_fifo_len = 60;
+                }
+                qemu_send_packet(s->vc, s->tx_fifo, s->tx_frame_len);
+                s->tx_frame_len = -1;
+                s->ris |= SE_INT_TXEMP;
+                stellaris_enet_update(s);
+                DPRINTF("Done TX\n");
+            }
+        }
+        break;
+    case 0x14: /* IA0 */
+        s->macaddr[0] = value;
+        s->macaddr[1] = value >> 8;
+        s->macaddr[2] = value >> 16;
+        s->macaddr[3] = value >> 24;
+        break;
+    case 0x18: /* IA1 */
+        s->macaddr[4] = value;
+        s->macaddr[5] = value >> 8;
+        break;
+    case 0x1c: /* THR */
+        s->thr = value;
+        break;
+    case 0x20: /* MCTL */
+        s->mctl = value;
+        break;
+    case 0x24: /* MDV */
+        s->mdv = value;
+        break;
+    case 0x28: /* MADD */
+        /* ignored.  */
+        break;
+    case 0x2c: /* MTXD */
+        s->mtxd = value & 0xff;
+        break;
+    case 0x30: /* MRXD */
+    case 0x34: /* NP */
+    case 0x38: /* TR */
+        /* Ignored.  */
+    case 0x3c: /* Undocuented: Timestamp? */
+        /* Ignored.  */
+        break;
+    default:
+        cpu_abort (cpu_single_env, "stellaris_enet_write: Bad offset %x\n",
+                   (int)offset);
+    }
+}
+
+static CPUReadMemoryFunc *stellaris_enet_readfn[] = {
+   stellaris_enet_read,
+   stellaris_enet_read,
+   stellaris_enet_read
+};
+
+static CPUWriteMemoryFunc *stellaris_enet_writefn[] = {
+   stellaris_enet_write,
+   stellaris_enet_write,
+   stellaris_enet_write
+};
+static void stellaris_enet_reset(stellaris_enet_state *s)
+{
+    s->mdv = 0x80;
+    s->rctl = SE_RCTL_BADCRC;
+    s->im = SE_INT_PHY | SE_INT_MD | SE_INT_RXER | SE_INT_FOV | SE_INT_TXEMP
+            | SE_INT_TXER | SE_INT_RX;
+    s->thr = 0x3f;
+    s->tx_frame_len = -1;
+}
+
+void stellaris_enet_init(NICInfo *nd, uint32_t base, qemu_irq irq)
+{
+    stellaris_enet_state *s;
+    int iomemtype;
+
+    s = (stellaris_enet_state *)qemu_mallocz(sizeof(stellaris_enet_state));
+    iomemtype = cpu_register_io_memory(0, stellaris_enet_readfn,
+                                       stellaris_enet_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    s->base = base;
+    s->irq = irq;
+    memcpy(s->macaddr, nd->macaddr, 6);
+
+    if (nd->vlan)
+        s->vc = qemu_new_vlan_client(nd->vlan, stellaris_enet_receive,
+                                     stellaris_enet_can_receive, s);
+
+    stellaris_enet_reset(s);
+}
diff --git a/hw/stellaris_input.c b/hw/stellaris_input.c
new file mode 100644
index 000000000..461868b2e
--- /dev/null
+++ b/hw/stellaris_input.c
@@ -0,0 +1,66 @@
+/*
+ * Gamepad style buttons connected to IRQ/GPIO lines
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+#include "hw.h"
+#include "devices.h"
+#include "console.h"
+
+typedef struct {
+    qemu_irq irq;
+    int keycode;
+    int pressed;
+} gamepad_button;
+
+typedef struct {
+    gamepad_button *buttons;
+    int num_buttons;
+    int extension;
+} gamepad_state;
+
+static void stellaris_gamepad_put_key(void * opaque, int keycode)
+{
+    gamepad_state *s = (gamepad_state *)opaque;
+    int i;
+    int down;
+
+    if (keycode == 0xe0 && !s->extension) {
+        s->extension = 0x80;
+        return;
+    }
+
+    down = (keycode & 0x80) == 0;
+    keycode = (keycode & 0x7f) | s->extension;
+
+    for (i = 0; i < s->num_buttons; i++) {
+        if (s->buttons[i].keycode == keycode
+                && s->buttons[i].pressed != down) {
+            s->buttons[i].pressed = down;
+            qemu_set_irq(s->buttons[i].irq, down);
+        }
+    }
+
+    s->extension = 0;
+}
+
+/* Returns an array 5 ouput slots.  */
+void stellaris_gamepad_init(int n, qemu_irq *irq, const int *keycode)
+{
+    gamepad_state *s;
+    int i;
+
+    s = (gamepad_state *)qemu_mallocz(sizeof (gamepad_state));
+    s->buttons = (gamepad_button *)qemu_mallocz(n * sizeof (gamepad_button));
+    for (i = 0; i < n; i++) {
+        s->buttons[i].irq = irq[i];
+        s->buttons[i].keycode = keycode[i];
+    }
+    s->num_buttons = n;
+    qemu_add_kbd_event_handler(stellaris_gamepad_put_key, s);
+}
+
+
diff --git a/hw/sun4m.c b/hw/sun4m.c
index a76c53b28..693fa696a 100644
--- a/hw/sun4m.c
+++ b/hw/sun4m.c
@@ -21,7 +21,17 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "qemu-timer.h"
+#include "sun4m.h"
+#include "nvram.h"
+#include "sparc32_dma.h"
+#include "fdc.h"
+#include "sysemu.h"
+#include "net.h"
+#include "boards.h"
+#include "firmware_abi.h"
+
 //#define DEBUG_IRQ
 
 /*
@@ -49,10 +59,9 @@
 #define KERNEL_LOAD_ADDR     0x00004000
 #define CMDLINE_ADDR         0x007ff000
 #define INITRD_LOAD_ADDR     0x00800000
-#define PROM_SIZE_MAX        (256 * 1024)
-#define PROM_PADDR           0xff0000000ULL
+#define PROM_SIZE_MAX        (512 * 1024)
 #define PROM_VADDR           0xffd00000
-#define PROM_FILENAME	     "openbios-sparc32"
+#define PROM_FILENAME        "openbios-sparc32"
 
 #define MAX_CPUS 16
 #define MAX_PILS 16
@@ -63,13 +72,18 @@ struct hwdef {
     target_phys_addr_t serial_base, fd_base;
     target_phys_addr_t dma_base, esp_base, le_base;
     target_phys_addr_t tcx_base, cs_base, power_base;
+    target_phys_addr_t ecc_base;
+    uint32_t ecc_version;
     long vram_size, nvram_size;
     // IRQ numbers are not PIL ones, but master interrupt controller register
     // bit numbers
     int intctl_g_intr, esp_irq, le_irq, clock_irq, clock1_irq;
     int ser_irq, ms_kb_irq, fd_irq, me_irq, cs_irq;
     int machine_id; // For NVRAM
+    uint32_t iommu_version;
     uint32_t intbit_to_level[32];
+    uint64_t max_mem;
+    const char * const default_cpu_model;
 };
 
 /* TSC handling */
@@ -102,131 +116,87 @@ void DMA_register_channel (int nchan,
 {
 }
 
-static void nvram_set_word (m48t59_t *nvram, uint32_t addr, uint16_t value)
-{
-    m48t59_write(nvram, addr++, (value >> 8) & 0xff);
-    m48t59_write(nvram, addr++, value & 0xff);
-}
-
-static void nvram_set_lword (m48t59_t *nvram, uint32_t addr, uint32_t value)
-{
-    m48t59_write(nvram, addr++, value >> 24);
-    m48t59_write(nvram, addr++, (value >> 16) & 0xff);
-    m48t59_write(nvram, addr++, (value >> 8) & 0xff);
-    m48t59_write(nvram, addr++, value & 0xff);
-}
-
-static void nvram_set_string (m48t59_t *nvram, uint32_t addr,
-                       const unsigned char *str, uint32_t max)
-{
-    unsigned int i;
-
-    for (i = 0; i < max && str[i] != '\0'; i++) {
-        m48t59_write(nvram, addr + i, str[i]);
-    }
-    m48t59_write(nvram, addr + max - 1, '\0');
-}
-
-static uint32_t nvram_set_var (m48t59_t *nvram, uint32_t addr,
-                                const unsigned char *str)
-{
-    uint32_t len;
-
-    len = strlen(str) + 1;
-    nvram_set_string(nvram, addr, str, len);
-
-    return addr + len;
-}
-
-static void nvram_finish_partition (m48t59_t *nvram, uint32_t start,
-                                    uint32_t end)
-{
-    unsigned int i, sum;
-
-    // Length divided by 16
-    m48t59_write(nvram, start + 2, ((end - start) >> 12) & 0xff);
-    m48t59_write(nvram, start + 3, ((end - start) >> 4) & 0xff);
-    // Checksum
-    sum = m48t59_read(nvram, start);
-    for (i = 0; i < 14; i++) {
-        sum += m48t59_read(nvram, start + 2 + i);
-        sum = (sum + ((sum & 0xff00) >> 8)) & 0xff;
-    }
-    m48t59_write(nvram, start + 1, sum & 0xff);
-}
-
 extern int nographic;
 
 static void nvram_init(m48t59_t *nvram, uint8_t *macaddr, const char *cmdline,
-		       int boot_device, uint32_t RAM_size,
-		       uint32_t kernel_size,
-		       int width, int height, int depth,
+                       const char *boot_devices, uint32_t RAM_size,
+                       uint32_t kernel_size,
+                       int width, int height, int depth,
                        int machine_id)
 {
-    unsigned char tmp = 0;
-    unsigned int i, j;
+    unsigned int i;
     uint32_t start, end;
+    uint8_t image[0x1ff0];
+    ohwcfg_v3_t *header = (ohwcfg_v3_t *)&image;
+    struct sparc_arch_cfg *sparc_header;
+    struct OpenBIOS_nvpart_v1 *part_header;
+
+    memset(image, '\0', sizeof(image));
 
     // Try to match PPC NVRAM
-    nvram_set_string(nvram, 0x00, "QEMU_BIOS", 16);
-    nvram_set_lword(nvram,  0x10, 0x00000001); /* structure v1 */
-    // NVRAM_size, arch not applicable
-    m48t59_write(nvram, 0x2D, smp_cpus & 0xff);
-    m48t59_write(nvram, 0x2E, 0);
-    m48t59_write(nvram, 0x2F, nographic & 0xff);
-    nvram_set_lword(nvram,  0x30, RAM_size);
-    m48t59_write(nvram, 0x34, boot_device & 0xff);
-    nvram_set_lword(nvram,  0x38, KERNEL_LOAD_ADDR);
-    nvram_set_lword(nvram,  0x3C, kernel_size);
+    strcpy(header->struct_ident, "QEMU_BIOS");
+    header->struct_version = cpu_to_be32(3); /* structure v3 */
+
+    header->nvram_size = cpu_to_be16(0x2000);
+    header->nvram_arch_ptr = cpu_to_be16(sizeof(ohwcfg_v3_t));
+    header->nvram_arch_size = cpu_to_be16(sizeof(struct sparc_arch_cfg));
+    strcpy(header->arch, "sun4m");
+    header->nb_cpus = smp_cpus & 0xff;
+    header->RAM0_base = 0;
+    header->RAM0_size = cpu_to_be64((uint64_t)RAM_size);
+    strcpy(header->boot_devices, boot_devices);
+    header->nboot_devices = strlen(boot_devices) & 0xff;
+    header->kernel_image = cpu_to_be64((uint64_t)KERNEL_LOAD_ADDR);
+    header->kernel_size = cpu_to_be64((uint64_t)kernel_size);
     if (cmdline) {
-	strcpy(phys_ram_base + CMDLINE_ADDR, cmdline);
-	nvram_set_lword(nvram,  0x40, CMDLINE_ADDR);
-        nvram_set_lword(nvram,  0x44, strlen(cmdline));
+        strcpy(phys_ram_base + CMDLINE_ADDR, cmdline);
+        header->cmdline = cpu_to_be64((uint64_t)CMDLINE_ADDR);
+        header->cmdline_size = cpu_to_be64((uint64_t)strlen(cmdline));
     }
-    // initrd_image, initrd_size passed differently
-    nvram_set_word(nvram,   0x54, width);
-    nvram_set_word(nvram,   0x56, height);
-    nvram_set_word(nvram,   0x58, depth);
+    // XXX add initrd_image, initrd_size
+    header->width = cpu_to_be16(width);
+    header->height = cpu_to_be16(height);
+    header->depth = cpu_to_be16(depth);
+    if (nographic)
+        header->graphic_flags = cpu_to_be16(OHW_GF_NOGRAPHICS);
+
+    header->crc = cpu_to_be16(OHW_compute_crc(header, 0x00, 0xF8));
+
+    // Architecture specific header
+    start = sizeof(ohwcfg_v3_t);
+    sparc_header = (struct sparc_arch_cfg *)&image[start];
+    sparc_header->valid = 0;
+    start += sizeof(struct sparc_arch_cfg);
 
     // OpenBIOS nvram variables
     // Variable partition
-    start = 252;
-    m48t59_write(nvram, start, 0x70);
-    nvram_set_string(nvram, start + 4, "system", 12);
+    part_header = (struct OpenBIOS_nvpart_v1 *)&image[start];
+    part_header->signature = OPENBIOS_PART_SYSTEM;
+    strcpy(part_header->name, "system");
 
-    end = start + 16;
+    end = start + sizeof(struct OpenBIOS_nvpart_v1);
     for (i = 0; i < nb_prom_envs; i++)
-        end = nvram_set_var(nvram, end, prom_envs[i]);
+        end = OpenBIOS_set_var(image, end, prom_envs[i]);
+
+    // End marker
+    image[end++] = '\0';
 
-    m48t59_write(nvram, end++ , 0);
     end = start + ((end - start + 15) & ~15);
-    nvram_finish_partition(nvram, start, end);
+    OpenBIOS_finish_partition(part_header, end - start);
 
     // free partition
     start = end;
-    m48t59_write(nvram, start, 0x7f);
-    nvram_set_string(nvram, start + 4, "free", 12);
+    part_header = (struct OpenBIOS_nvpart_v1 *)&image[start];
+    part_header->signature = OPENBIOS_PART_FREE;
+    strcpy(part_header->name, "free");
 
     end = 0x1fd0;
-    nvram_finish_partition(nvram, start, end);
-
-    // Sun4m specific use
-    start = i = 0x1fd8;
-    m48t59_write(nvram, i++, 0x01);
-    m48t59_write(nvram, i++, machine_id);
-    j = 0;
-    m48t59_write(nvram, i++, macaddr[j++]);
-    m48t59_write(nvram, i++, macaddr[j++]);
-    m48t59_write(nvram, i++, macaddr[j++]);
-    m48t59_write(nvram, i++, macaddr[j++]);
-    m48t59_write(nvram, i++, macaddr[j++]);
-    m48t59_write(nvram, i, macaddr[j]);
-
-    /* Calculate checksum */
-    for (i = start; i < start + 15; i++) {
-        tmp ^= m48t59_read(nvram, i);
-    }
-    m48t59_write(nvram, start + 15, tmp);
+    OpenBIOS_finish_partition(part_header, end - start);
+
+    Sun_init_header((struct Sun_nvram *)&image[0x1fd8], macaddr, machine_id);
+
+    for (i = 0; i < sizeof(image); i++)
+        m48t59_write(nvram, i, image[i]);
 }
 
 static void *slavio_intctl;
@@ -306,28 +276,84 @@ static void secondary_cpu_reset(void *opaque)
     env->halted = 1;
 }
 
-static void *sun4m_hw_init(const struct hwdef *hwdef, int RAM_size,
-                           DisplayState *ds, const char *cpu_model)
+static unsigned long sun4m_load_kernel(const char *kernel_filename,
+                                       const char *kernel_cmdline,
+                                       const char *initrd_filename)
+{
+    int linux_boot;
+    unsigned int i;
+    long initrd_size, kernel_size;
+
+    linux_boot = (kernel_filename != NULL);
+
+    kernel_size = 0;
+    if (linux_boot) {
+        kernel_size = load_elf(kernel_filename, -0xf0000000ULL, NULL, NULL,
+                               NULL);
+        if (kernel_size < 0)
+            kernel_size = load_aout(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR);
+        if (kernel_size < 0)
+            kernel_size = load_image(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR);
+        if (kernel_size < 0) {
+            fprintf(stderr, "qemu: could not load kernel '%s'\n",
+                    kernel_filename);
+            exit(1);
+        }
+
+        /* load initrd */
+        initrd_size = 0;
+        if (initrd_filename) {
+            initrd_size = load_image(initrd_filename, phys_ram_base + INITRD_LOAD_ADDR);
+            if (initrd_size < 0) {
+                fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
+                        initrd_filename);
+                exit(1);
+            }
+        }
+        if (initrd_size > 0) {
+            for (i = 0; i < 64 * TARGET_PAGE_SIZE; i += TARGET_PAGE_SIZE) {
+                if (ldl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i)
+                    == 0x48647253) { // HdrS
+                    stl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i + 16, INITRD_LOAD_ADDR);
+                    stl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i + 20, initrd_size);
+                    break;
+                }
+            }
+        }
+    }
+    return kernel_size;
+}
+
+static void sun4m_hw_init(const struct hwdef *hwdef, int RAM_size,
+                          const char *boot_device,
+                          DisplayState *ds, const char *kernel_filename,
+                          const char *kernel_cmdline,
+                          const char *initrd_filename, const char *cpu_model)
 
 {
     CPUState *env, *envs[MAX_CPUS];
     unsigned int i;
     void *iommu, *espdma, *ledma, *main_esp, *nvram;
-    const sparc_def_t *def;
     qemu_irq *cpu_irqs[MAX_CPUS], *slavio_irq, *slavio_cpu_irq,
         *espdma_irq, *ledma_irq;
     qemu_irq *esp_reset, *le_reset;
+    unsigned long prom_offset, kernel_size;
+    int ret;
+    char buf[1024];
+    BlockDriverState *fd[MAX_FD];
+    int index;
 
     /* init CPUs */
-    sparc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
-        fprintf(stderr, "Unable to find Sparc CPU definition\n");
-        exit(1);
-    }
+    if (!cpu_model)
+        cpu_model = hwdef->default_cpu_model;
 
     for(i = 0; i < smp_cpus; i++) {
-        env = cpu_init();
-        cpu_sparc_register(env, def);
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find Sparc CPU definition\n");
+            exit(1);
+        }
+        cpu_sparc_set_id(env, i);
         envs[i] = env;
         if (i == 0) {
             qemu_register_reset(main_cpu_reset, env);
@@ -337,15 +363,43 @@ static void *sun4m_hw_init(const struct hwdef *hwdef, int RAM_size,
         }
         register_savevm("cpu", i, 3, cpu_save, cpu_load, env);
         cpu_irqs[i] = qemu_allocate_irqs(cpu_set_irq, envs[i], MAX_PILS);
+        env->prom_addr = hwdef->slavio_base;
     }
 
     for (i = smp_cpus; i < MAX_CPUS; i++)
         cpu_irqs[i] = qemu_allocate_irqs(dummy_cpu_set_irq, NULL, MAX_PILS);
 
+
     /* allocate RAM */
+    if ((uint64_t)RAM_size > hwdef->max_mem) {
+        fprintf(stderr, "qemu: Too much memory for this machine: %d, maximum %d\n",
+                (unsigned int)RAM_size / (1024 * 1024),
+                (unsigned int)(hwdef->max_mem / (1024 * 1024)));
+        exit(1);
+    }
     cpu_register_physical_memory(0, RAM_size, 0);
 
-    iommu = iommu_init(hwdef->iommu_base);
+    /* load boot prom */
+    prom_offset = RAM_size + hwdef->vram_size;
+    cpu_register_physical_memory(hwdef->slavio_base,
+                                 (PROM_SIZE_MAX + TARGET_PAGE_SIZE - 1) &
+                                 TARGET_PAGE_MASK,
+                                 prom_offset | IO_MEM_ROM);
+
+    if (bios_name == NULL)
+        bios_name = PROM_FILENAME;
+    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
+    ret = load_elf(buf, hwdef->slavio_base - PROM_VADDR, NULL, NULL, NULL);
+    if (ret < 0 || ret > PROM_SIZE_MAX)
+        ret = load_image(buf, phys_ram_base + prom_offset);
+    if (ret < 0 || ret > PROM_SIZE_MAX) {
+        fprintf(stderr, "qemu: could not load prom '%s'\n",
+                buf);
+        exit(1);
+    }
+
+    /* set up devices */
+    iommu = iommu_init(hwdef->iommu_base, hwdef->iommu_version);
     slavio_intctl = slavio_intctl_init(hwdef->intctl_base,
                                        hwdef->intctl_base + 0x10000ULL,
                                        &hwdef->intbit_to_level[0],
@@ -380,27 +434,40 @@ static void *sun4m_hw_init(const struct hwdef *hwdef, int RAM_size,
 
     nvram = m48t59_init(slavio_irq[0], hwdef->nvram_base, 0,
                         hwdef->nvram_size, 8);
-    for (i = 0; i < MAX_CPUS; i++) {
-        slavio_timer_init(hwdef->counter_base +
-                          (target_phys_addr_t)(i * TARGET_PAGE_SIZE),
-                           slavio_cpu_irq[i], 0);
-    }
-    slavio_timer_init(hwdef->counter_base + 0x10000ULL,
-                      slavio_irq[hwdef->clock1_irq], 2);
-    slavio_serial_ms_kbd_init(hwdef->ms_kb_base, slavio_irq[hwdef->ms_kb_irq]);
+
+    slavio_timer_init_all(hwdef->counter_base, slavio_irq[hwdef->clock1_irq],
+                          slavio_cpu_irq);
+
+    slavio_serial_ms_kbd_init(hwdef->ms_kb_base, slavio_irq[hwdef->ms_kb_irq],
+                              nographic);
     // Slavio TTYA (base+4, Linux ttyS0) is the first Qemu serial device
     // Slavio TTYB (base+0, Linux ttyS1) is the second Qemu serial device
     slavio_serial_init(hwdef->serial_base, slavio_irq[hwdef->ser_irq],
                        serial_hds[1], serial_hds[0]);
-    fdctrl_init(slavio_irq[hwdef->fd_irq], 0, 1, hwdef->fd_base, fd_table);
 
-    main_esp = esp_init(bs_table, hwdef->esp_base, espdma, *espdma_irq,
+    if (hwdef->fd_base != (target_phys_addr_t)-1) {
+        /* there is zero or one floppy drive */
+        fd[1] = fd[0] = NULL;
+        index = drive_get_index(IF_FLOPPY, 0, 0);
+        if (index != -1)
+            fd[0] = drives_table[index].bdrv;
+
+        sun4m_fdctrl_init(slavio_irq[hwdef->fd_irq], hwdef->fd_base, fd);
+    }
+
+    if (drive_get_max_bus(IF_SCSI) > 0) {
+        fprintf(stderr, "qemu: too many SCSI bus\n");
+        exit(1);
+    }
+
+    main_esp = esp_init(hwdef->esp_base, espdma, *espdma_irq,
                         esp_reset);
 
-    for (i = 0; i < MAX_DISKS; i++) {
-        if (bs_table[i]) {
-            esp_scsi_attach(main_esp, bs_table[i], i);
-        }
+    for (i = 0; i < ESP_MAX_DEVS; i++) {
+        index = drive_get_index(IF_SCSI, 0, i);
+        if (index == -1)
+            continue;
+        esp_scsi_attach(main_esp, drives_table[index].bdrv, i);
     }
 
     slavio_misc = slavio_misc_init(hwdef->slavio_base, hwdef->power_base,
@@ -408,73 +475,15 @@ static void *sun4m_hw_init(const struct hwdef *hwdef, int RAM_size,
     if (hwdef->cs_base != (target_phys_addr_t)-1)
         cs_init(hwdef->cs_base, hwdef->cs_irq, slavio_intctl);
 
-    return nvram;
-}
-
-static void sun4m_load_kernel(long vram_size, int RAM_size, int boot_device,
-                              const char *kernel_filename,
-                              const char *kernel_cmdline,
-                              const char *initrd_filename,
-                              int machine_id,
-                              void *nvram)
-{
-    int ret, linux_boot;
-    char buf[1024];
-    unsigned int i;
-    long prom_offset, initrd_size, kernel_size;
-
-    linux_boot = (kernel_filename != NULL);
-
-    prom_offset = RAM_size + vram_size;
-    cpu_register_physical_memory(PROM_PADDR,
-                                 (PROM_SIZE_MAX + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK,
-                                 prom_offset | IO_MEM_ROM);
-
-    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, PROM_FILENAME);
-    ret = load_elf(buf, PROM_PADDR - PROM_VADDR, NULL, NULL, NULL);
-    if (ret < 0) {
-	fprintf(stderr, "qemu: could not load prom '%s'\n",
-		buf);
-	exit(1);
-    }
-
-    kernel_size = 0;
-    if (linux_boot) {
-        kernel_size = load_elf(kernel_filename, -0xf0000000, NULL, NULL, NULL);
-        if (kernel_size < 0)
-	    kernel_size = load_aout(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR);
-	if (kernel_size < 0)
-	    kernel_size = load_image(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR);
-        if (kernel_size < 0) {
-            fprintf(stderr, "qemu: could not load kernel '%s'\n",
-                    kernel_filename);
-	    exit(1);
-        }
+    kernel_size = sun4m_load_kernel(kernel_filename, kernel_cmdline,
+                                    initrd_filename);
 
-        /* load initrd */
-        initrd_size = 0;
-        if (initrd_filename) {
-            initrd_size = load_image(initrd_filename, phys_ram_base + INITRD_LOAD_ADDR);
-            if (initrd_size < 0) {
-                fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
-                        initrd_filename);
-                exit(1);
-            }
-        }
-        if (initrd_size > 0) {
-	    for (i = 0; i < 64 * TARGET_PAGE_SIZE; i += TARGET_PAGE_SIZE) {
-		if (ldl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i)
-		    == 0x48647253) { // HdrS
-		    stl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i + 16, INITRD_LOAD_ADDR);
-		    stl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i + 20, initrd_size);
-		    break;
-		}
-	    }
-        }
-    }
     nvram_init(nvram, (uint8_t *)&nd_table[0].macaddr, kernel_cmdline,
                boot_device, RAM_size, kernel_size, graphic_width,
-               graphic_height, graphic_depth, machine_id);
+               graphic_height, graphic_depth, hwdef->machine_id);
+
+    if (hwdef->ecc_base != (target_phys_addr_t)-1)
+        ecc_init(hwdef->ecc_base, hwdef->ecc_version);
 }
 
 static const struct hwdef hwdefs[] = {
@@ -494,6 +503,7 @@ static const struct hwdef hwdefs[] = {
         .esp_base     = 0x78800000,
         .le_base      = 0x78c00000,
         .power_base   = 0x7a000000,
+        .ecc_base     = -1,
         .vram_size    = 0x00100000,
         .nvram_size   = 0x2000,
         .esp_irq = 18,
@@ -506,10 +516,13 @@ static const struct hwdef hwdefs[] = {
         .me_irq = 30,
         .cs_irq = 5,
         .machine_id = 0x80,
+        .iommu_version = 0x04000000,
         .intbit_to_level = {
-            2, 3, 5, 7, 9, 11, 0, 14,	3, 5, 7, 9, 11, 13, 12, 12,
-            6, 0, 4, 10, 8, 0, 11, 0,	0, 0, 0, 0, 15, 0, 15, 0,
+            2, 3, 5, 7, 9, 11, 0, 14,   3, 5, 7, 9, 11, 13, 12, 12,
+            6, 0, 4, 10, 8, 0, 11, 0,   0, 0, 0, 0, 15, 0, 15, 0,
         },
+        .max_mem = 0x10000000,
+        .default_cpu_model = "Fujitsu MB86904",
     },
     /* SS-10 */
     {
@@ -527,6 +540,84 @@ static const struct hwdef hwdefs[] = {
         .esp_base     = 0xef0800000ULL,
         .le_base      = 0xef0c00000ULL,
         .power_base   = 0xefa000000ULL,
+        .ecc_base     = 0xf00000000ULL,
+        .ecc_version  = 0x10000000, // version 0, implementation 1
+        .vram_size    = 0x00100000,
+        .nvram_size   = 0x2000,
+        .esp_irq = 18,
+        .le_irq = 16,
+        .clock_irq = 7,
+        .clock1_irq = 19,
+        .ms_kb_irq = 14,
+        .ser_irq = 15,
+        .fd_irq = 22,
+        .me_irq = 30,
+        .cs_irq = -1,
+        .machine_id = 0x72,
+        .iommu_version = 0x03000000,
+        .intbit_to_level = {
+            2, 3, 5, 7, 9, 11, 0, 14,   3, 5, 7, 9, 11, 13, 12, 12,
+            6, 0, 4, 10, 8, 0, 11, 0,   0, 0, 0, 0, 15, 0, 15, 0,
+        },
+        .max_mem = 0xffffffff, // XXX actually first 62GB ok
+        .default_cpu_model = "TI SuperSparc II",
+    },
+    /* SS-600MP */
+    {
+        .iommu_base   = 0xfe0000000ULL,
+        .tcx_base     = 0xe20000000ULL,
+        .cs_base      = -1,
+        .slavio_base  = 0xff0000000ULL,
+        .ms_kb_base   = 0xff1000000ULL,
+        .serial_base  = 0xff1100000ULL,
+        .nvram_base   = 0xff1200000ULL,
+        .fd_base      = -1,
+        .counter_base = 0xff1300000ULL,
+        .intctl_base  = 0xff1400000ULL,
+        .dma_base     = 0xef0081000ULL,
+        .esp_base     = 0xef0080000ULL,
+        .le_base      = 0xef0060000ULL,
+        .power_base   = 0xefa000000ULL,
+        .ecc_base     = 0xf00000000ULL,
+        .ecc_version  = 0x00000000, // version 0, implementation 0
+        .vram_size    = 0x00100000,
+        .nvram_size   = 0x2000,
+        .esp_irq = 18,
+        .le_irq = 16,
+        .clock_irq = 7,
+        .clock1_irq = 19,
+        .ms_kb_irq = 14,
+        .ser_irq = 15,
+        .fd_irq = 22,
+        .me_irq = 30,
+        .cs_irq = -1,
+        .machine_id = 0x71,
+        .iommu_version = 0x01000000,
+        .intbit_to_level = {
+            2, 3, 5, 7, 9, 11, 0, 14,   3, 5, 7, 9, 11, 13, 12, 12,
+            6, 0, 4, 10, 8, 0, 11, 0,   0, 0, 0, 0, 15, 0, 15, 0,
+        },
+        .max_mem = 0xffffffff, // XXX actually first 62GB ok
+        .default_cpu_model = "TI SuperSparc II",
+    },
+    /* SS-20 */
+    {
+        .iommu_base   = 0xfe0000000ULL,
+        .tcx_base     = 0xe20000000ULL,
+        .cs_base      = -1,
+        .slavio_base  = 0xff0000000ULL,
+        .ms_kb_base   = 0xff1000000ULL,
+        .serial_base  = 0xff1100000ULL,
+        .nvram_base   = 0xff1200000ULL,
+        .fd_base      = 0xff1700000ULL,
+        .counter_base = 0xff1300000ULL,
+        .intctl_base  = 0xff1400000ULL,
+        .dma_base     = 0xef0400000ULL,
+        .esp_base     = 0xef0800000ULL,
+        .le_base      = 0xef0c00000ULL,
+        .power_base   = 0xefa000000ULL,
+        .ecc_base     = 0xf00000000ULL,
+        .ecc_version  = 0x20000000, // version 0, implementation 2
         .vram_size    = 0x00100000,
         .nvram_size   = 0x2000,
         .esp_irq = 18,
@@ -539,57 +630,54 @@ static const struct hwdef hwdefs[] = {
         .me_irq = 30,
         .cs_irq = -1,
         .machine_id = 0x72,
+        .iommu_version = 0x13000000,
         .intbit_to_level = {
-            2, 3, 5, 7, 9, 11, 0, 14,	3, 5, 7, 9, 11, 13, 12, 12,
-            6, 0, 4, 10, 8, 0, 11, 0,	0, 0, 0, 0, 15, 0, 15, 0,
+            2, 3, 5, 7, 9, 11, 0, 14,   3, 5, 7, 9, 11, 13, 12, 12,
+            6, 0, 4, 10, 8, 0, 11, 0,   0, 0, 0, 0, 15, 0, 15, 0,
         },
+        .max_mem = 0xffffffff, // XXX actually first 62GB ok
+        .default_cpu_model = "TI SuperSparc II",
     },
 };
 
-static void sun4m_common_init(int RAM_size, int boot_device, DisplayState *ds,
-                              const char *kernel_filename, const char *kernel_cmdline,
-                              const char *initrd_filename, const char *cpu_model,
-                              unsigned int machine, int max_ram)
+/* SPARCstation 5 hardware initialisation */
+static void ss5_init(int RAM_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
+                     const char *kernel_filename, const char *kernel_cmdline,
+                     const char *initrd_filename, const char *cpu_model)
 {
-    void *nvram;
-
-    if ((unsigned int)RAM_size > (unsigned int)max_ram) {
-        fprintf(stderr, "qemu: Too much memory for this machine: %d, maximum %d\n",
-                (unsigned int)RAM_size / (1024 * 1024),
-                (unsigned int)max_ram / (1024 * 1024));
-        exit(1);
-    }
-    nvram = sun4m_hw_init(&hwdefs[machine], RAM_size, ds, cpu_model);
+    sun4m_hw_init(&hwdefs[0], RAM_size, boot_device, ds, kernel_filename,
+                  kernel_cmdline, initrd_filename, cpu_model);
+}
 
-    sun4m_load_kernel(hwdefs[machine].vram_size, RAM_size, boot_device,
-                      kernel_filename, kernel_cmdline, initrd_filename,
-                      hwdefs[machine].machine_id, nvram);
+/* SPARCstation 10 hardware initialisation */
+static void ss10_init(int RAM_size, int vga_ram_size,
+                      const char *boot_device, DisplayState *ds,
+                      const char *kernel_filename, const char *kernel_cmdline,
+                      const char *initrd_filename, const char *cpu_model)
+{
+    sun4m_hw_init(&hwdefs[1], RAM_size, boot_device, ds, kernel_filename,
+                  kernel_cmdline, initrd_filename, cpu_model);
 }
 
-/* SPARCstation 5 hardware initialisation */
-static void ss5_init(int RAM_size, int vga_ram_size, int boot_device,
-                       DisplayState *ds, const char **fd_filename, int snapshot,
-                       const char *kernel_filename, const char *kernel_cmdline,
-                       const char *initrd_filename, const char *cpu_model)
+/* SPARCserver 600MP hardware initialisation */
+static void ss600mp_init(int RAM_size, int vga_ram_size,
+                         const char *boot_device, DisplayState *ds,
+                         const char *kernel_filename, const char *kernel_cmdline,
+                         const char *initrd_filename, const char *cpu_model)
 {
-    if (cpu_model == NULL)
-        cpu_model = "Fujitsu MB86904";
-    sun4m_common_init(RAM_size, boot_device, ds, kernel_filename,
-                      kernel_cmdline, initrd_filename, cpu_model,
-                      0, 0x10000000);
+    sun4m_hw_init(&hwdefs[2], RAM_size, boot_device, ds, kernel_filename,
+                  kernel_cmdline, initrd_filename, cpu_model);
 }
 
-/* SPARCstation 10 hardware initialisation */
-static void ss10_init(int RAM_size, int vga_ram_size, int boot_device,
-                            DisplayState *ds, const char **fd_filename, int snapshot,
-                            const char *kernel_filename, const char *kernel_cmdline,
-                            const char *initrd_filename, const char *cpu_model)
+/* SPARCstation 20 hardware initialisation */
+static void ss20_init(int RAM_size, int vga_ram_size,
+                      const char *boot_device, DisplayState *ds,
+                      const char *kernel_filename, const char *kernel_cmdline,
+                      const char *initrd_filename, const char *cpu_model)
 {
-    if (cpu_model == NULL)
-        cpu_model = "TI SuperSparc II";
-    sun4m_common_init(RAM_size, boot_device, ds, kernel_filename,
-                      kernel_cmdline, initrd_filename, cpu_model,
-                      1, 0xffffffff); // XXX actually first 62GB ok
+    sun4m_hw_init(&hwdefs[3], RAM_size, boot_device, ds, kernel_filename,
+                  kernel_cmdline, initrd_filename, cpu_model);
 }
 
 QEMUMachine ss5_machine = {
@@ -603,3 +691,16 @@ QEMUMachine ss10_machine = {
     "Sun4m platform, SPARCstation 10",
     ss10_init,
 };
+
+QEMUMachine ss600mp_machine = {
+    "SS-600MP",
+    "Sun4m platform, SPARCserver 600MP",
+    ss600mp_init,
+};
+
+QEMUMachine ss20_machine = {
+    "SS-20",
+    "Sun4m platform, SPARCstation 20",
+    ss20_init,
+};
+
diff --git a/hw/sun4m.h b/hw/sun4m.h
new file mode 100644
index 000000000..0a38897bb
--- /dev/null
+++ b/hw/sun4m.h
@@ -0,0 +1,78 @@
+#ifndef SUN4M_H
+#define SUN4M_H
+
+/* Devices used by sparc32 system.  */
+
+/* iommu.c */
+void *iommu_init(target_phys_addr_t addr, uint32_t version);
+void sparc_iommu_memory_rw(void *opaque, target_phys_addr_t addr,
+                                 uint8_t *buf, int len, int is_write);
+static inline void sparc_iommu_memory_read(void *opaque,
+                                           target_phys_addr_t addr,
+                                           uint8_t *buf, int len)
+{
+    sparc_iommu_memory_rw(opaque, addr, buf, len, 0);
+}
+
+static inline void sparc_iommu_memory_write(void *opaque,
+                                            target_phys_addr_t addr,
+                                            uint8_t *buf, int len)
+{
+    sparc_iommu_memory_rw(opaque, addr, buf, len, 1);
+}
+
+/* tcx.c */
+void tcx_init(DisplayState *ds, target_phys_addr_t addr, uint8_t *vram_base,
+              unsigned long vram_offset, int vram_size, int width, int height,
+              int depth);
+
+/* slavio_intctl.c */
+void *slavio_intctl_init(target_phys_addr_t addr, target_phys_addr_t addrg,
+                         const uint32_t *intbit_to_level,
+                         qemu_irq **irq, qemu_irq **cpu_irq,
+                         qemu_irq **parent_irq, unsigned int cputimer);
+void slavio_pic_info(void *opaque);
+void slavio_irq_info(void *opaque);
+
+/* slavio_timer.c */
+void slavio_timer_init_all(target_phys_addr_t base, qemu_irq master_irq,
+                           qemu_irq *cpu_irqs);
+
+/* slavio_serial.c */
+SerialState *slavio_serial_init(target_phys_addr_t base, qemu_irq irq,
+                                CharDriverState *chr1, CharDriverState *chr2);
+void slavio_serial_ms_kbd_init(target_phys_addr_t base, qemu_irq irq,
+                               int disabled);
+
+/* slavio_misc.c */
+void *slavio_misc_init(target_phys_addr_t base, target_phys_addr_t power_base,
+                       qemu_irq irq);
+void slavio_set_power_fail(void *opaque, int power_failing);
+
+/* esp.c */
+#define ESP_MAX_DEVS 7
+void esp_scsi_attach(void *opaque, BlockDriverState *bd, int id);
+void *esp_init(target_phys_addr_t espaddr,
+               void *dma_opaque, qemu_irq irq, qemu_irq *reset);
+
+/* cs4231.c */
+void cs_init(target_phys_addr_t base, int irq, void *intctl);
+
+/* sparc32_dma.c */
+void *sparc32_dma_init(target_phys_addr_t daddr, qemu_irq parent_irq,
+                       void *iommu, qemu_irq **dev_irq, qemu_irq **reset);
+void ledma_memory_read(void *opaque, target_phys_addr_t addr,
+                       uint8_t *buf, int len, int do_bswap);
+void ledma_memory_write(void *opaque, target_phys_addr_t addr,
+                        uint8_t *buf, int len, int do_bswap);
+void espdma_memory_read(void *opaque, uint8_t *buf, int len);
+void espdma_memory_write(void *opaque, uint8_t *buf, int len);
+
+/* pcnet.c */
+void lance_init(NICInfo *nd, target_phys_addr_t leaddr, void *dma_opaque,
+                qemu_irq irq, qemu_irq *reset);
+
+/* eccmemctl.c */
+void *ecc_init(target_phys_addr_t base, uint32_t version);
+
+#endif
diff --git a/hw/sun4u.c b/hw/sun4u.c
index 0e9e72e35..183f64a5a 100644
--- a/hw/sun4u.c
+++ b/hw/sun4u.c
@@ -21,20 +21,29 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
-#include "m48t59.h"
+#include "hw.h"
+#include "pci.h"
+#include "pc.h"
+#include "nvram.h"
+#include "fdc.h"
+#include "net.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
+#include "boards.h"
+#include "firmware_abi.h"
 
 #define KERNEL_LOAD_ADDR     0x00404000
 #define CMDLINE_ADDR         0x003ff000
 #define INITRD_LOAD_ADDR     0x00300000
 #define PROM_SIZE_MAX        (512 * 1024)
-#define PROM_ADDR	     0x1fff0000000ULL
-#define PROM_VADDR	     0x000ffd00000ULL
+#define PROM_ADDR            0x1fff0000000ULL
+#define PROM_VADDR           0x000ffd00000ULL
 #define APB_SPECIAL_BASE     0x1fe00000000ULL
-#define APB_MEM_BASE	     0x1ff00000000ULL
-#define VGA_BASE	     (APB_MEM_BASE + 0x400000ULL)
-#define PROM_FILENAME	     "openbios-sparc64"
+#define APB_MEM_BASE         0x1ff00000000ULL
+#define VGA_BASE             (APB_MEM_BASE + 0x400000ULL)
+#define PROM_FILENAME        "openbios-sparc64"
 #define NVRAM_SIZE           0x2000
+#define MAX_IDE_BUS          2
 
 /* TSC handling */
 
@@ -66,204 +75,91 @@ void DMA_register_channel (int nchan,
 {
 }
 
-/* NVRAM helpers */
-void NVRAM_set_byte (m48t59_t *nvram, uint32_t addr, uint8_t value)
-{
-    m48t59_write(nvram, addr, value);
-}
-
-uint8_t NVRAM_get_byte (m48t59_t *nvram, uint32_t addr)
-{
-    return m48t59_read(nvram, addr);
-}
-
-void NVRAM_set_word (m48t59_t *nvram, uint32_t addr, uint16_t value)
-{
-    m48t59_write(nvram, addr, value >> 8);
-    m48t59_write(nvram, addr + 1, value & 0xFF);
-}
-
-uint16_t NVRAM_get_word (m48t59_t *nvram, uint32_t addr)
-{
-    uint16_t tmp;
-
-    tmp = m48t59_read(nvram, addr) << 8;
-    tmp |= m48t59_read(nvram, addr + 1);
-
-    return tmp;
-}
-
-void NVRAM_set_lword (m48t59_t *nvram, uint32_t addr, uint32_t value)
-{
-    m48t59_write(nvram, addr, value >> 24);
-    m48t59_write(nvram, addr + 1, (value >> 16) & 0xFF);
-    m48t59_write(nvram, addr + 2, (value >> 8) & 0xFF);
-    m48t59_write(nvram, addr + 3, value & 0xFF);
-}
-
-uint32_t NVRAM_get_lword (m48t59_t *nvram, uint32_t addr)
-{
-    uint32_t tmp;
-
-    tmp = m48t59_read(nvram, addr) << 24;
-    tmp |= m48t59_read(nvram, addr + 1) << 16;
-    tmp |= m48t59_read(nvram, addr + 2) << 8;
-    tmp |= m48t59_read(nvram, addr + 3);
-
-    return tmp;
-}
-
-void NVRAM_set_string (m48t59_t *nvram, uint32_t addr,
-                       const unsigned char *str, uint32_t max)
-{
-    int i;
-
-    for (i = 0; i < max && str[i] != '\0'; i++) {
-        m48t59_write(nvram, addr + i, str[i]);
-    }
-    m48t59_write(nvram, addr + max - 1, '\0');
-}
-
-int NVRAM_get_string (m48t59_t *nvram, uint8_t *dst, uint16_t addr, int max)
-{
-    int i;
-
-    memset(dst, 0, max);
-    for (i = 0; i < max; i++) {
-        dst[i] = NVRAM_get_byte(nvram, addr + i);
-        if (dst[i] == '\0')
-            break;
-    }
-
-    return i;
-}
-
-static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
-{
-    uint16_t tmp;
-    uint16_t pd, pd1, pd2;
-
-    tmp = prev >> 8;
-    pd = prev ^ value;
-    pd1 = pd & 0x000F;
-    pd2 = ((pd >> 4) & 0x000F) ^ pd1;
-    tmp ^= (pd1 << 3) | (pd1 << 8);
-    tmp ^= pd2 | (pd2 << 7) | (pd2 << 12);
-
-    return tmp;
-}
-
-uint16_t NVRAM_compute_crc (m48t59_t *nvram, uint32_t start, uint32_t count)
-{
-    uint32_t i;
-    uint16_t crc = 0xFFFF;
-    int odd;
-
-    odd = count & 1;
-    count &= ~1;
-    for (i = 0; i != count; i++) {
-	crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
-    }
-    if (odd) {
-	crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
-    }
-
-    return crc;
-}
-
-static uint32_t nvram_set_var (m48t59_t *nvram, uint32_t addr,
-                                const unsigned char *str)
-{
-    uint32_t len;
-
-    len = strlen(str) + 1;
-    NVRAM_set_string(nvram, addr, str, len);
-
-    return addr + len;
-}
-
-static void nvram_finish_partition (m48t59_t *nvram, uint32_t start,
-                                    uint32_t end)
-{
-    unsigned int i, sum;
-
-    // Length divided by 16
-    m48t59_write(nvram, start + 2, ((end - start) >> 12) & 0xff);
-    m48t59_write(nvram, start + 3, ((end - start) >> 4) & 0xff);
-    // Checksum
-    sum = m48t59_read(nvram, start);
-    for (i = 0; i < 14; i++) {
-        sum += m48t59_read(nvram, start + 2 + i);
-        sum = (sum + ((sum & 0xff00) >> 8)) & 0xff;
-    }
-    m48t59_write(nvram, start + 1, sum & 0xff);
-}
-
 extern int nographic;
 
-int sun4u_NVRAM_set_params (m48t59_t *nvram, uint16_t NVRAM_size,
-                          const unsigned char *arch,
-                          uint32_t RAM_size, int boot_device,
-                          uint32_t kernel_image, uint32_t kernel_size,
-                          const char *cmdline,
-                          uint32_t initrd_image, uint32_t initrd_size,
-                          uint32_t NVRAM_image,
-                          int width, int height, int depth)
+static int sun4u_NVRAM_set_params (m48t59_t *nvram, uint16_t NVRAM_size,
+                                   const unsigned char *arch,
+                                   uint32_t RAM_size, const char *boot_devices,
+                                   uint32_t kernel_image, uint32_t kernel_size,
+                                   const char *cmdline,
+                                   uint32_t initrd_image, uint32_t initrd_size,
+                                   uint32_t NVRAM_image,
+                                   int width, int height, int depth)
 {
-    uint16_t crc;
     unsigned int i;
     uint32_t start, end;
-
-    /* Set parameters for Open Hack'Ware BIOS */
-    NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
-    NVRAM_set_lword(nvram,  0x10, 0x00000002); /* structure v2 */
-    NVRAM_set_word(nvram,   0x14, NVRAM_size);
-    NVRAM_set_string(nvram, 0x20, arch, 16);
-    NVRAM_set_byte(nvram,   0x2f, nographic & 0xff);
-    NVRAM_set_lword(nvram,  0x30, RAM_size);
-    NVRAM_set_byte(nvram,   0x34, boot_device);
-    NVRAM_set_lword(nvram,  0x38, kernel_image);
-    NVRAM_set_lword(nvram,  0x3C, kernel_size);
+    uint8_t image[0x1ff0];
+    ohwcfg_v3_t *header = (ohwcfg_v3_t *)&image;
+    struct sparc_arch_cfg *sparc_header;
+    struct OpenBIOS_nvpart_v1 *part_header;
+
+    memset(image, '\0', sizeof(image));
+
+    // Try to match PPC NVRAM
+    strcpy(header->struct_ident, "QEMU_BIOS");
+    header->struct_version = cpu_to_be32(3); /* structure v3 */
+
+    header->nvram_size = cpu_to_be16(NVRAM_size);
+    header->nvram_arch_ptr = cpu_to_be16(sizeof(ohwcfg_v3_t));
+    header->nvram_arch_size = cpu_to_be16(sizeof(struct sparc_arch_cfg));
+    strcpy(header->arch, arch);
+    header->nb_cpus = smp_cpus & 0xff;
+    header->RAM0_base = 0;
+    header->RAM0_size = cpu_to_be64((uint64_t)RAM_size);
+    strcpy(header->boot_devices, boot_devices);
+    header->nboot_devices = strlen(boot_devices) & 0xff;
+    header->kernel_image = cpu_to_be64((uint64_t)kernel_image);
+    header->kernel_size = cpu_to_be64((uint64_t)kernel_size);
     if (cmdline) {
-        /* XXX: put the cmdline in NVRAM too ? */
         strcpy(phys_ram_base + CMDLINE_ADDR, cmdline);
-        NVRAM_set_lword(nvram,  0x40, CMDLINE_ADDR);
-        NVRAM_set_lword(nvram,  0x44, strlen(cmdline));
-    } else {
-        NVRAM_set_lword(nvram,  0x40, 0);
-        NVRAM_set_lword(nvram,  0x44, 0);
+        header->cmdline = cpu_to_be64((uint64_t)CMDLINE_ADDR);
+        header->cmdline_size = cpu_to_be64((uint64_t)strlen(cmdline));
     }
-    NVRAM_set_lword(nvram,  0x48, initrd_image);
-    NVRAM_set_lword(nvram,  0x4C, initrd_size);
-    NVRAM_set_lword(nvram,  0x50, NVRAM_image);
+    header->initrd_image = cpu_to_be64((uint64_t)initrd_image);
+    header->initrd_size = cpu_to_be64((uint64_t)initrd_size);
+    header->NVRAM_image = cpu_to_be64((uint64_t)NVRAM_image);
 
-    NVRAM_set_word(nvram,   0x54, width);
-    NVRAM_set_word(nvram,   0x56, height);
-    NVRAM_set_word(nvram,   0x58, depth);
-    crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
-    NVRAM_set_word(nvram,  0xFC, crc);
+    header->width = cpu_to_be16(width);
+    header->height = cpu_to_be16(height);
+    header->depth = cpu_to_be16(depth);
+    if (nographic)
+        header->graphic_flags = cpu_to_be16(OHW_GF_NOGRAPHICS);
+
+    header->crc = cpu_to_be16(OHW_compute_crc(header, 0x00, 0xF8));
+
+    // Architecture specific header
+    start = sizeof(ohwcfg_v3_t);
+    sparc_header = (struct sparc_arch_cfg *)&image[start];
+    sparc_header->valid = 0;
+    start += sizeof(struct sparc_arch_cfg);
 
     // OpenBIOS nvram variables
     // Variable partition
-    start = 256;
-    m48t59_write(nvram, start, 0x70);
-    NVRAM_set_string(nvram, start + 4, "system", 12);
+    part_header = (struct OpenBIOS_nvpart_v1 *)&image[start];
+    part_header->signature = OPENBIOS_PART_SYSTEM;
+    strcpy(part_header->name, "system");
 
-    end = start + 16;
+    end = start + sizeof(struct OpenBIOS_nvpart_v1);
     for (i = 0; i < nb_prom_envs; i++)
-        end = nvram_set_var(nvram, end, prom_envs[i]);
+        end = OpenBIOS_set_var(image, end, prom_envs[i]);
+
+    // End marker
+    image[end++] = '\0';
 
-    m48t59_write(nvram, end++ , 0);
     end = start + ((end - start + 15) & ~15);
-    nvram_finish_partition(nvram, start, end);
+    OpenBIOS_finish_partition(part_header, end - start);
 
     // free partition
     start = end;
-    m48t59_write(nvram, start, 0x7f);
-    NVRAM_set_string(nvram, start + 4, "free", 12);
+    part_header = (struct OpenBIOS_nvpart_v1 *)&image[start];
+    part_header->signature = OPENBIOS_PART_FREE;
+    strcpy(part_header->name, "free");
 
     end = 0x1fd0;
-    nvram_finish_partition(nvram, start, end);
+    OpenBIOS_finish_partition(part_header, end - start);
+
+    for (i = 0; i < sizeof(image); i++)
+        m48t59_write(nvram, i, image[i]);
 
     return 0;
 }
@@ -331,10 +227,10 @@ static const int parallel_irq[MAX_PARALLEL_PORTS] = { 7, 7, 7 };
 static fdctrl_t *floppy_controller;
 
 /* Sun4u hardware initialisation */
-static void sun4u_init(int ram_size, int vga_ram_size, int boot_device,
-             DisplayState *ds, const char **fd_filename, int snapshot,
-             const char *kernel_filename, const char *kernel_cmdline,
-             const char *initrd_filename, const char *cpu_model)
+static void sun4u_init(int ram_size, int vga_ram_size,
+                       const char *boot_devices, DisplayState *ds,
+                       const char *kernel_filename, const char *kernel_cmdline,
+                       const char *initrd_filename, const char *cpu_model)
 {
     CPUState *env;
     char buf[1024];
@@ -343,22 +239,22 @@ static void sun4u_init(int ram_size, int vga_ram_size, int boot_device,
     unsigned int i;
     long prom_offset, initrd_size, kernel_size;
     PCIBus *pci_bus;
-    const sparc_def_t *def;
     QEMUBH *bh;
     qemu_irq *irq;
+    int index;
+    BlockDriverState *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
+    BlockDriverState *fd[MAX_FD];
 
     linux_boot = (kernel_filename != NULL);
 
     /* init CPUs */
     if (cpu_model == NULL)
         cpu_model = "TI UltraSparc II";
-    sparc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
+    env = cpu_init(cpu_model);
+    if (!env) {
         fprintf(stderr, "Unable to find Sparc CPU definition\n");
         exit(1);
     }
-    env = cpu_init();
-    cpu_sparc_register(env, def);
     bh = qemu_bh_new(tick_irq, env);
     env->tick = ptimer_init(bh);
     ptimer_set_period(env->tick, 1ULL);
@@ -382,12 +278,14 @@ static void sun4u_init(int ram_size, int vga_ram_size, int boot_device,
                                  (PROM_SIZE_MAX + TARGET_PAGE_SIZE) & TARGET_PAGE_MASK,
                                  prom_offset | IO_MEM_ROM);
 
-    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, PROM_FILENAME);
+    if (bios_name == NULL)
+        bios_name = PROM_FILENAME;
+    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);
     ret = load_elf(buf, PROM_ADDR - PROM_VADDR, NULL, NULL, NULL);
     if (ret < 0) {
-	fprintf(stderr, "qemu: could not load prom '%s'\n",
-		buf);
-	exit(1);
+        fprintf(stderr, "qemu: could not load prom '%s'\n",
+                buf);
+        exit(1);
     }
 
     kernel_size = 0;
@@ -396,13 +294,13 @@ static void sun4u_init(int ram_size, int vga_ram_size, int boot_device,
         /* XXX: put correct offset */
         kernel_size = load_elf(kernel_filename, 0, NULL, NULL, NULL);
         if (kernel_size < 0)
-	    kernel_size = load_aout(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR);
-	if (kernel_size < 0)
-	    kernel_size = load_image(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR);
+            kernel_size = load_aout(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR);
+        if (kernel_size < 0)
+            kernel_size = load_image(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR);
         if (kernel_size < 0) {
             fprintf(stderr, "qemu: could not load kernel '%s'\n",
                     kernel_filename);
-	    exit(1);
+            exit(1);
         }
 
         /* load initrd */
@@ -415,14 +313,14 @@ static void sun4u_init(int ram_size, int vga_ram_size, int boot_device,
             }
         }
         if (initrd_size > 0) {
-	    for (i = 0; i < 64 * TARGET_PAGE_SIZE; i += TARGET_PAGE_SIZE) {
-		if (ldl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i)
-		    == 0x48647253) { // HdrS
-		    stl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i + 16, INITRD_LOAD_ADDR);
-		    stl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i + 20, initrd_size);
-		    break;
-		}
-	    }
+            for (i = 0; i < 64 * TARGET_PAGE_SIZE; i += TARGET_PAGE_SIZE) {
+                if (ldl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i)
+                    == 0x48647253) { // HdrS
+                    stl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i + 16, INITRD_LOAD_ADDR);
+                    stl_raw(phys_ram_base + KERNEL_LOAD_ADDR + i + 20, initrd_size);
+                    break;
+                }
+            }
         }
     }
     pci_bus = pci_apb_init(APB_SPECIAL_BASE, APB_MEM_BASE, NULL);
@@ -444,17 +342,36 @@ static void sun4u_init(int ram_size, int vga_ram_size, int boot_device,
     for(i = 0; i < nb_nics; i++) {
         if (!nd_table[i].model)
             nd_table[i].model = "ne2k_pci";
-	pci_nic_init(pci_bus, &nd_table[i], -1);
+        pci_nic_init(pci_bus, &nd_table[i], -1);
     }
 
     irq = qemu_allocate_irqs(dummy_cpu_set_irq, NULL, 32);
-    // XXX pci_cmd646_ide_init(pci_bus, bs_table, 1);
-    pci_piix3_ide_init(pci_bus, bs_table, -1, irq);
+    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {
+        fprintf(stderr, "qemu: too many IDE bus\n");
+        exit(1);
+    }
+    for(i = 0; i < MAX_IDE_BUS * MAX_IDE_DEVS; i++) {
+        index = drive_get_index(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
+       if (index != -1)
+           hd[i] = drives_table[index].bdrv;
+       else
+           hd[i] = NULL;
+    }
+
+    // XXX pci_cmd646_ide_init(pci_bus, hd, 1);
+    pci_piix3_ide_init(pci_bus, hd, -1, irq);
     /* FIXME: wire up interrupts.  */
     i8042_init(NULL/*1*/, NULL/*12*/, 0x60);
-    floppy_controller = fdctrl_init(NULL/*6*/, 2, 0, 0x3f0, fd_table);
+    for(i = 0; i < MAX_FD; i++) {
+        index = drive_get_index(IF_FLOPPY, 0, i);
+       if (index != -1)
+           fd[i] = drives_table[index].bdrv;
+       else
+           fd[i] = NULL;
+    }
+    floppy_controller = fdctrl_init(NULL/*6*/, 2, 0, 0x3f0, fd);
     nvram = m48t59_init(NULL/*8*/, 0, 0x0074, NVRAM_SIZE, 59);
-    sun4u_NVRAM_set_params(nvram, NVRAM_SIZE, "Sun4u", ram_size, boot_device,
+    sun4u_NVRAM_set_params(nvram, NVRAM_SIZE, "Sun4u", ram_size, boot_devices,
                          KERNEL_LOAD_ADDR, kernel_size,
                          kernel_cmdline,
                          INITRD_LOAD_ADDR, initrd_size,
diff --git a/hw/tc58128.c b/hw/tc58128.c
index a8b26f7e8..2cd176b94 100644
--- a/hw/tc58128.c
+++ b/hw/tc58128.c
@@ -1,5 +1,7 @@
 #include <assert.h>
-#include "vl.h"
+#include "hw.h"
+#include "sh.h"
+#include "sysemu.h"
 
 #define CE1  0x0100
 #define CE2  0x0200
diff --git a/hw/tcx.c b/hw/tcx.c
index 9a72d6a6b..22bde4a26 100644
--- a/hw/tcx.c
+++ b/hw/tcx.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "sun4m.h"
+#include "console.h"
 #include "pixel_ops.h"
 
 #define MAXX 1024
@@ -84,39 +86,39 @@ static void update_palette_entries(TCXState *s, int start, int end)
 }
 
 static void tcx_draw_line32(TCXState *s1, uint8_t *d,
-			    const uint8_t *s, int width)
+                            const uint8_t *s, int width)
 {
     int x;
     uint8_t val;
     uint32_t *p = (uint32_t *)d;
 
     for(x = 0; x < width; x++) {
-	val = *s++;
+        val = *s++;
         *p++ = s1->palette[val];
     }
 }
 
 static void tcx_draw_line16(TCXState *s1, uint8_t *d,
-			    const uint8_t *s, int width)
+                            const uint8_t *s, int width)
 {
     int x;
     uint8_t val;
     uint16_t *p = (uint16_t *)d;
 
     for(x = 0; x < width; x++) {
-	val = *s++;
+        val = *s++;
         *p++ = s1->palette[val];
     }
 }
 
 static void tcx_draw_line8(TCXState *s1, uint8_t *d,
-			   const uint8_t *s, int width)
+                           const uint8_t *s, int width)
 {
     int x;
     uint8_t val;
 
     for(x = 0; x < width; x++) {
-	val = *s++;
+        val = *s++;
         *d++ = s1->palette[val];
     }
 }
@@ -183,7 +185,7 @@ static void tcx_update_display(void *opaque)
     void (*f)(TCXState *s1, uint8_t *dst, const uint8_t *src, int width);
 
     if (ts->ds->depth == 0)
-	return;
+        return;
     page = ts->vram_offset;
     y_start = -1;
     page_min = 0xffffffff;
@@ -195,55 +197,55 @@ static void tcx_update_display(void *opaque)
 
     switch (ts->ds->depth) {
     case 32:
-	f = tcx_draw_line32;
-	break;
+        f = tcx_draw_line32;
+        break;
     case 15:
     case 16:
-	f = tcx_draw_line16;
-	break;
+        f = tcx_draw_line16;
+        break;
     default:
     case 8:
-	f = tcx_draw_line8;
-	break;
+        f = tcx_draw_line8;
+        break;
     case 0:
-	return;
+        return;
     }
 
     for(y = 0; y < ts->height; y += 4, page += TARGET_PAGE_SIZE) {
-	if (cpu_physical_memory_get_dirty(page, VGA_DIRTY_FLAG)) {
-	    if (y_start < 0)
+        if (cpu_physical_memory_get_dirty(page, VGA_DIRTY_FLAG)) {
+            if (y_start < 0)
                 y_start = y;
             if (page < page_min)
                 page_min = page;
             if (page > page_max)
                 page_max = page;
-	    f(ts, d, s, ts->width);
-	    d += dd;
-	    s += ds;
-	    f(ts, d, s, ts->width);
-	    d += dd;
-	    s += ds;
-	    f(ts, d, s, ts->width);
-	    d += dd;
-	    s += ds;
-	    f(ts, d, s, ts->width);
-	    d += dd;
-	    s += ds;
-	} else {
+            f(ts, d, s, ts->width);
+            d += dd;
+            s += ds;
+            f(ts, d, s, ts->width);
+            d += dd;
+            s += ds;
+            f(ts, d, s, ts->width);
+            d += dd;
+            s += ds;
+            f(ts, d, s, ts->width);
+            d += dd;
+            s += ds;
+        } else {
             if (y_start >= 0) {
                 /* flush to display */
                 dpy_update(ts->ds, 0, y_start,
                            ts->width, y - y_start);
                 y_start = -1;
             }
-	    d += dd * 4;
-	    s += ds * 4;
-	}
+            d += dd * 4;
+            s += ds * 4;
+        }
     }
     if (y_start >= 0) {
-	/* flush to display */
-	dpy_update(ts->ds, 0, y_start,
-		   ts->width, y - y_start);
+        /* flush to display */
+        dpy_update(ts->ds, 0, y_start,
+                   ts->width, y - y_start);
     }
     /* reset modified pages */
     if (page_min <= page_max) {
@@ -334,7 +336,7 @@ static void tcx_invalidate_display(void *opaque)
     int i;
 
     for (i = 0; i < MAXX*MAXY; i += TARGET_PAGE_SIZE) {
-	cpu_physical_memory_set_dirty(s->vram_offset + i);
+        cpu_physical_memory_set_dirty(s->vram_offset + i);
     }
 }
 
@@ -424,32 +426,32 @@ static void tcx_dac_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
     saddr = (addr & (TCX_DAC_NREGS - 1)) >> 2;
     switch (saddr) {
     case 0:
-	s->dac_index = val >> 24;
-	s->dac_state = 0;
-	break;
+        s->dac_index = val >> 24;
+        s->dac_state = 0;
+        break;
     case 1:
-	switch (s->dac_state) {
-	case 0:
-	    s->r[s->dac_index] = val >> 24;
+        switch (s->dac_state) {
+        case 0:
+            s->r[s->dac_index] = val >> 24;
             update_palette_entries(s, s->dac_index, s->dac_index + 1);
-	    s->dac_state++;
-	    break;
-	case 1:
-	    s->g[s->dac_index] = val >> 24;
+            s->dac_state++;
+            break;
+        case 1:
+            s->g[s->dac_index] = val >> 24;
             update_palette_entries(s, s->dac_index, s->dac_index + 1);
-	    s->dac_state++;
-	    break;
-	case 2:
-	    s->b[s->dac_index] = val >> 24;
+            s->dac_state++;
+            break;
+        case 2:
+            s->b[s->dac_index] = val >> 24;
             update_palette_entries(s, s->dac_index, s->dac_index + 1);
             s->dac_index = (s->dac_index + 1) & 255; // Index autoincrement
-	default:
-	    s->dac_state = 0;
-	    break;
-	}
-	break;
+        default:
+            s->dac_state = 0;
+            break;
+        }
+        break;
     default:
-	break;
+        break;
     }
     return;
 }
diff --git a/hw/tsc210x.c b/hw/tsc210x.c
new file mode 100644
index 000000000..96956a47d
--- /dev/null
+++ b/hw/tsc210x.c
@@ -0,0 +1,1056 @@
+/*
+ * TI TSC2102 (touchscreen/sensors/audio controller) emulator.
+ *
+ * Copyright (c) 2006 Andrzej Zaborowski  <balrog@zabor.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+
+#include "hw.h"
+#include "audio/audio.h"
+#include "qemu-timer.h"
+#include "console.h"
+#include "omap.h"
+
+#define TSC_DATA_REGISTERS_PAGE		0x0
+#define TSC_CONTROL_REGISTERS_PAGE	0x1
+#define TSC_AUDIO_REGISTERS_PAGE	0x2
+
+#define TSC_VERBOSE
+
+#define TSC_CUT_RESOLUTION(value, p)	((value) >> (16 - resolution[p]))
+
+struct tsc210x_state_s {
+    qemu_irq pint;
+    QEMUTimer *timer;
+    QEMUSoundCard card;
+    struct uwire_slave_s chip;
+    struct i2s_codec_s codec;
+    uint8_t in_fifo[16384];
+    uint8_t out_fifo[16384];
+
+    int x, y;
+    int pressure;
+
+    int state, page, offset, irq;
+    uint16_t command, dav;
+
+    int busy;
+    int enabled;
+    int host_mode;
+    int function;
+    int nextfunction;
+    int precision;
+    int nextprecision;
+    int filter;
+    int pin_func;
+    int ref;
+    int timing;
+    int noise;
+
+    uint16_t audio_ctrl1;
+    uint16_t audio_ctrl2;
+    uint16_t audio_ctrl3;
+    uint16_t pll[2];
+    uint16_t volume;
+    int64_t volume_change;
+    int softstep;
+    uint16_t dac_power;
+    int64_t powerdown;
+    uint16_t filter_data[0x14];
+
+    const char *name;
+    SWVoiceIn *adc_voice[1];
+    SWVoiceOut *dac_voice[1];
+    int i2s_rx_rate;
+    int i2s_tx_rate;
+    AudioState *audio;
+};
+
+static const int resolution[4] = { 12, 8, 10, 12 };
+
+#define TSC_MODE_NO_SCAN	0x0
+#define TSC_MODE_XY_SCAN	0x1
+#define TSC_MODE_XYZ_SCAN	0x2
+#define TSC_MODE_X		0x3
+#define TSC_MODE_Y		0x4
+#define TSC_MODE_Z		0x5
+#define TSC_MODE_BAT1		0x6
+#define TSC_MODE_BAT2		0x7
+#define TSC_MODE_AUX		0x8
+#define TSC_MODE_AUX_SCAN	0x9
+#define TSC_MODE_TEMP1		0xa
+#define TSC_MODE_PORT_SCAN	0xb
+#define TSC_MODE_TEMP2		0xc
+#define TSC_MODE_XX_DRV		0xd
+#define TSC_MODE_YY_DRV		0xe
+#define TSC_MODE_YX_DRV		0xf
+
+static const uint16_t mode_regs[16] = {
+    0x0000,	/* No scan */
+    0x0600,	/* X, Y scan */
+    0x0780,	/* X, Y, Z scan */
+    0x0400,	/* X */
+    0x0200,	/* Y */
+    0x0180,	/* Z */
+    0x0040,	/* BAT1 */
+    0x0030,	/* BAT2 */
+    0x0010,	/* AUX */
+    0x0010,	/* AUX scan */
+    0x0004,	/* TEMP1 */
+    0x0070,	/* Port scan */
+    0x0002,	/* TEMP2 */
+    0x0000,	/* X+, X- drivers */
+    0x0000,	/* Y+, Y- drivers */
+    0x0000,	/* Y+, X- drivers */
+};
+
+/*
+ * Convert screen coordinates to arbitrary values that the
+ * touchscreen in my Palm Tungsten E device returns.
+ * This shouldn't really matter (because the guest system
+ * should calibrate the touchscreen anyway), but let's
+ * imitate some real hardware.
+ */
+#define X_TRANSFORM(value)		\
+    ((3850 - ((int) (value) * (3850 - 250) / 32768)) << 4)
+#define Y_TRANSFORM(value)		\
+    ((150 + ((int) (value) * (3037 - 150) / 32768)) << 4)
+#define Z1_TRANSFORM(s)			\
+    ((400 - ((s)->x >> 7) + ((s)->pressure << 10)) << 4)
+#define Z2_TRANSFORM(s)			\
+    ((4000 + ((s)->y >> 7) - ((s)->pressure << 10)) << 4)
+
+#define BAT1_VAL			0x8660
+#define BAT2_VAL			0x0000
+#define AUX1_VAL			0x35c0
+#define AUX2_VAL			0xffff
+#define TEMP1_VAL			0x8c70
+#define TEMP2_VAL			0xa5b0
+
+#define TSC_POWEROFF_DELAY		50
+#define TSC_SOFTSTEP_DELAY		50
+
+static void tsc210x_reset(struct tsc210x_state_s *s)
+{
+    s->state = 0;
+    s->pin_func = 2;
+    s->enabled = 0;
+    s->busy = 0;
+    s->nextfunction = 0;
+    s->ref = 0;
+    s->timing = 0;
+    s->irq = 0;
+    s->dav = 0;
+
+    s->audio_ctrl1 = 0x0000;
+    s->audio_ctrl2 = 0x4410;
+    s->audio_ctrl3 = 0x0000;
+    s->pll[0] = 0x1004;
+    s->pll[1] = 0x0000;
+    s->volume = 0xffff;
+    s->dac_power = 0x8540;
+    s->softstep = 1;
+    s->volume_change = 0;
+    s->powerdown = 0;
+    s->filter_data[0x00] = 0x6be3;
+    s->filter_data[0x01] = 0x9666;
+    s->filter_data[0x02] = 0x675d;
+    s->filter_data[0x03] = 0x6be3;
+    s->filter_data[0x04] = 0x9666;
+    s->filter_data[0x05] = 0x675d;
+    s->filter_data[0x06] = 0x7d83;
+    s->filter_data[0x07] = 0x84ee;
+    s->filter_data[0x08] = 0x7d83;
+    s->filter_data[0x09] = 0x84ee;
+    s->filter_data[0x0a] = 0x6be3;
+    s->filter_data[0x0b] = 0x9666;
+    s->filter_data[0x0c] = 0x675d;
+    s->filter_data[0x0d] = 0x6be3;
+    s->filter_data[0x0e] = 0x9666;
+    s->filter_data[0x0f] = 0x675d;
+    s->filter_data[0x10] = 0x7d83;
+    s->filter_data[0x11] = 0x84ee;
+    s->filter_data[0x12] = 0x7d83;
+    s->filter_data[0x13] = 0x84ee;
+
+    s->i2s_tx_rate = 0;
+    s->i2s_rx_rate = 0;
+
+    qemu_set_irq(s->pint, !s->irq);
+}
+
+struct tsc210x_rate_info_s {
+    int rate;
+    int dsor;
+    int fsref;
+};
+
+/*  { rate,  dsor,  fsref } */
+static const struct tsc210x_rate_info_s tsc2101_rates[] = {
+    /* Fsref / 6.0 */
+    { 7350,	7,	1 },
+    { 8000,	7,	0 },
+    /* Fsref / 5.5 */
+    { 8018,	6,	1 },
+    { 8727,	6,	0 },
+    /* Fsref / 5.0 */
+    { 8820,	5,	1 },
+    { 9600,	5,	0 },
+    /* Fsref / 4.0 */
+    { 11025,	4,	1 },
+    { 12000,	4,	0 },
+    /* Fsref / 3.0 */
+    { 14700,	3,	1 },
+    { 16000,	3,	0 },
+    /* Fsref / 2.0 */
+    { 22050,	2,	1 },
+    { 24000,	2,	0 },
+    /* Fsref / 1.5 */
+    { 29400,	1,	1 },
+    { 32000,	1,	0 },
+    /* Fsref */
+    { 44100,	0,	1 },
+    { 48000,	0,	0 },
+
+    { 0,	0, 	0 },
+};
+
+/*  { rate,   dsor, fsref }	*/
+static const struct tsc210x_rate_info_s tsc2102_rates[] = {
+    /* Fsref / 6.0 */
+    { 7350,	63,	1 },
+    { 8000,	63,	0 },
+    /* Fsref / 6.0 */
+    { 7350,	54,	1 },
+    { 8000,	54,	0 },
+    /* Fsref / 5.0 */
+    { 8820,	45,	1 },
+    { 9600,	45,	0 },
+    /* Fsref / 4.0 */
+    { 11025,	36,	1 },
+    { 12000,	36,	0 },
+    /* Fsref / 3.0 */
+    { 14700,	27,	1 },
+    { 16000,	27,	0 },
+    /* Fsref / 2.0 */
+    { 22050,	18,	1 },
+    { 24000,	18,	0 },
+    /* Fsref / 1.5 */
+    { 29400,	9,	1 },
+    { 32000,	9,	0 },
+    /* Fsref */
+    { 44100,	0,	1 },
+    { 48000,	0,	0 },
+
+    { 0,	0, 	0 },
+};
+
+static inline void tsc210x_out_flush(struct tsc210x_state_s *s, int len)
+{
+    uint8_t *data = s->codec.out.fifo + s->codec.out.start;
+    uint8_t *end = data + len;
+
+    while (data < end)
+        data += AUD_write(s->dac_voice[0], data, end - data) ?: (end - data);
+
+    s->codec.out.len -= len;
+    if (s->codec.out.len)
+        memmove(s->codec.out.fifo, end, s->codec.out.len);
+    s->codec.out.start = 0;
+}
+
+static void tsc210x_audio_out_cb(struct tsc210x_state_s *s, int free_b)
+{
+    if (s->codec.out.len >= free_b) {
+        tsc210x_out_flush(s, free_b);
+        return;
+    }
+
+    s->codec.out.size = MIN(free_b, 16384);
+    qemu_irq_raise(s->codec.tx_start);
+}
+
+static void tsc2102_audio_rate_update(struct tsc210x_state_s *s)
+{
+    const struct tsc210x_rate_info_s *rate;
+
+    s->codec.tx_rate = 0;
+    s->codec.rx_rate = 0;
+    if (s->dac_power & (1 << 15))				/* PWDNC */
+        return;
+
+    for (rate = tsc2102_rates; rate->rate; rate ++)
+        if (rate->dsor == (s->audio_ctrl1 & 0x3f) &&		/* DACFS */
+                        rate->fsref == ((s->audio_ctrl3 >> 13) & 1))/* REFFS */
+            break;
+    if (!rate->rate) {
+        printf("%s: unknown sampling rate configured\n", __FUNCTION__);
+        return;
+    }
+
+    s->codec.tx_rate = rate->rate;
+}
+
+static void tsc2102_audio_output_update(struct tsc210x_state_s *s)
+{
+    int enable;
+    audsettings_t fmt;
+
+    if (s->dac_voice[0]) {
+        tsc210x_out_flush(s, s->codec.out.len);
+        s->codec.out.size = 0;
+        AUD_set_active_out(s->dac_voice[0], 0);
+        AUD_close_out(&s->card, s->dac_voice[0]);
+        s->dac_voice[0] = 0;
+    }
+    s->codec.cts = 0;
+
+    enable =
+            (~s->dac_power & (1 << 15)) &&			/* PWDNC */
+            (~s->dac_power & (1 << 10));			/* DAPWDN */
+    if (!enable || !s->codec.tx_rate)
+        return;
+
+    /* Force our own sampling rate even in slave DAC mode */
+    fmt.endianness = 0;
+    fmt.nchannels = 2;
+    fmt.freq = s->codec.tx_rate;
+    fmt.fmt = AUD_FMT_S16;
+
+    s->dac_voice[0] = AUD_open_out(&s->card, s->dac_voice[0],
+                    "tsc2102.sink", s, (void *) tsc210x_audio_out_cb, &fmt);
+    if (s->dac_voice[0]) {
+        s->codec.cts = 1;
+        AUD_set_active_out(s->dac_voice[0], 1);
+    }
+}
+
+static uint16_t tsc2102_data_register_read(struct tsc210x_state_s *s, int reg)
+{
+    switch (reg) {
+    case 0x00:	/* X */
+        s->dav &= 0xfbff;
+        return TSC_CUT_RESOLUTION(X_TRANSFORM(s->x), s->precision) +
+                (s->noise & 3);
+
+    case 0x01:	/* Y */
+        s->noise ++;
+        s->dav &= 0xfdff;
+        return TSC_CUT_RESOLUTION(Y_TRANSFORM(s->y), s->precision) ^
+                (s->noise & 3);
+
+    case 0x02:	/* Z1 */
+        s->dav &= 0xfeff;
+        return TSC_CUT_RESOLUTION(Z1_TRANSFORM(s), s->precision) -
+                (s->noise & 3);
+
+    case 0x03:	/* Z2 */
+        s->dav &= 0xff7f;
+        return TSC_CUT_RESOLUTION(Z2_TRANSFORM(s), s->precision) |
+                (s->noise & 3);
+
+    case 0x04:	/* KPData */
+        return 0xffff;
+
+    case 0x05:	/* BAT1 */
+        s->dav &= 0xffbf;
+        return TSC_CUT_RESOLUTION(BAT1_VAL, s->precision) +
+                (s->noise & 6);
+
+    case 0x06:	/* BAT2 */
+        s->dav &= 0xffdf;
+        return TSC_CUT_RESOLUTION(BAT2_VAL, s->precision);
+
+    case 0x07:	/* AUX1 */
+        s->dav &= 0xffef;
+        return TSC_CUT_RESOLUTION(AUX1_VAL, s->precision);
+
+    case 0x08:	/* AUX2 */
+        s->dav &= 0xfff7;
+        return 0xffff;
+
+    case 0x09:	/* TEMP1 */
+        s->dav &= 0xfffb;
+        return TSC_CUT_RESOLUTION(TEMP1_VAL, s->precision) -
+                (s->noise & 5);
+
+    case 0x0a:	/* TEMP2 */
+        s->dav &= 0xfffd;
+        return TSC_CUT_RESOLUTION(TEMP2_VAL, s->precision) ^
+                (s->noise & 3);
+
+    case 0x0b:	/* DAC */
+        s->dav &= 0xfffe;
+        return 0xffff;
+
+    default:
+#ifdef TSC_VERBOSE
+        fprintf(stderr, "tsc2102_data_register_read: "
+                        "no such register: 0x%02x\n", reg);
+#endif
+        return 0xffff;
+    }
+}
+
+static uint16_t tsc2102_control_register_read(
+                struct tsc210x_state_s *s, int reg)
+{
+    switch (reg) {
+    case 0x00:	/* TSC ADC */
+        return (s->pressure << 15) | ((!s->busy) << 14) |
+                (s->nextfunction << 10) | (s->nextprecision << 8) | s->filter; 
+
+    case 0x01:	/* Status */
+        return (s->pin_func << 14) | ((!s->enabled) << 13) |
+                (s->host_mode << 12) | ((!!s->dav) << 11) | s->dav;
+
+    case 0x03:	/* Reference */
+        return s->ref;
+
+    case 0x04:	/* Reset */
+        return 0xffff;
+
+    case 0x05:	/* Configuration */
+        return s->timing;
+
+    default:
+#ifdef TSC_VERBOSE
+        fprintf(stderr, "tsc2102_control_register_read: "
+                        "no such register: 0x%02x\n", reg);
+#endif
+        return 0xffff;
+    }
+}
+
+static uint16_t tsc2102_audio_register_read(struct tsc210x_state_s *s, int reg)
+{
+    int l_ch, r_ch;
+    uint16_t val;
+
+    switch (reg) {
+    case 0x00:	/* Audio Control 1 */
+        return s->audio_ctrl1;
+
+    case 0x01:
+        return 0xff00;
+
+    case 0x02:	/* DAC Volume Control */
+        return s->volume;
+
+    case 0x03:
+        return 0x8b00;
+
+    case 0x04:	/* Audio Control 2 */
+        l_ch = 1;
+        r_ch = 1;
+        if (s->softstep && !(s->dac_power & (1 << 10))) {
+            l_ch = (qemu_get_clock(vm_clock) >
+                            s->volume_change + TSC_SOFTSTEP_DELAY);
+            r_ch = (qemu_get_clock(vm_clock) >
+                            s->volume_change + TSC_SOFTSTEP_DELAY);
+        }
+
+        return s->audio_ctrl2 | (l_ch << 3) | (r_ch << 2);
+
+    case 0x05:	/* Stereo DAC Power Control */
+        return 0x2aa0 | s->dac_power |
+                (((s->dac_power & (1 << 10)) &&
+                  (qemu_get_clock(vm_clock) >
+                   s->powerdown + TSC_POWEROFF_DELAY)) << 6);
+
+    case 0x06:	/* Audio Control 3 */
+        val = s->audio_ctrl3 | 0x0001;
+        s->audio_ctrl3 &= 0xff3f;
+        return val;
+
+    case 0x07:	/* LCH_BASS_BOOST_N0 */
+    case 0x08:	/* LCH_BASS_BOOST_N1 */
+    case 0x09:	/* LCH_BASS_BOOST_N2 */
+    case 0x0a:	/* LCH_BASS_BOOST_N3 */
+    case 0x0b:	/* LCH_BASS_BOOST_N4 */
+    case 0x0c:	/* LCH_BASS_BOOST_N5 */
+    case 0x0d:	/* LCH_BASS_BOOST_D1 */
+    case 0x0e:	/* LCH_BASS_BOOST_D2 */
+    case 0x0f:	/* LCH_BASS_BOOST_D4 */
+    case 0x10:	/* LCH_BASS_BOOST_D5 */
+    case 0x11:	/* RCH_BASS_BOOST_N0 */
+    case 0x12:	/* RCH_BASS_BOOST_N1 */
+    case 0x13:	/* RCH_BASS_BOOST_N2 */
+    case 0x14:	/* RCH_BASS_BOOST_N3 */
+    case 0x15:	/* RCH_BASS_BOOST_N4 */
+    case 0x16:	/* RCH_BASS_BOOST_N5 */
+    case 0x17:	/* RCH_BASS_BOOST_D1 */
+    case 0x18:	/* RCH_BASS_BOOST_D2 */
+    case 0x19:	/* RCH_BASS_BOOST_D4 */
+    case 0x1a:	/* RCH_BASS_BOOST_D5 */
+        return s->filter_data[reg - 0x07];
+
+    case 0x1b:	/* PLL Programmability 1 */
+        return s->pll[0];
+
+    case 0x1c:	/* PLL Programmability 2 */
+        return s->pll[1];
+
+    case 0x1d:	/* Audio Control 4 */
+        return (!s->softstep) << 14;
+
+    default:
+#ifdef TSC_VERBOSE
+        fprintf(stderr, "tsc2102_audio_register_read: "
+                        "no such register: 0x%02x\n", reg);
+#endif
+        return 0xffff;
+    }
+}
+
+static void tsc2102_data_register_write(
+                struct tsc210x_state_s *s, int reg, uint16_t value)
+{
+    switch (reg) {
+    case 0x00:	/* X */
+    case 0x01:	/* Y */
+    case 0x02:	/* Z1 */
+    case 0x03:	/* Z2 */
+    case 0x05:	/* BAT1 */
+    case 0x06:	/* BAT2 */
+    case 0x07:	/* AUX1 */
+    case 0x08:	/* AUX2 */
+    case 0x09:	/* TEMP1 */
+    case 0x0a:	/* TEMP2 */
+        return;
+
+    default:
+#ifdef TSC_VERBOSE
+        fprintf(stderr, "tsc2102_data_register_write: "
+                        "no such register: 0x%02x\n", reg);
+#endif
+    }
+}
+
+static void tsc2102_control_register_write(
+                struct tsc210x_state_s *s, int reg, uint16_t value)
+{
+    switch (reg) {
+    case 0x00:	/* TSC ADC */
+        s->host_mode = value >> 15;
+        s->enabled = !(value & 0x4000);
+        if (s->busy && !s->enabled)
+            qemu_del_timer(s->timer);
+        s->busy &= s->enabled;
+        s->nextfunction = (value >> 10) & 0xf;
+        s->nextprecision = (value >> 8) & 3;
+        s->filter = value & 0xff;
+        return;
+
+    case 0x01:	/* Status */
+        s->pin_func = value >> 14;
+        return;
+
+    case 0x03:	/* Reference */
+        s->ref = value & 0x1f;
+        return;
+
+    case 0x04:	/* Reset */
+        if (value == 0xbb00) {
+            if (s->busy)
+                qemu_del_timer(s->timer);
+            tsc210x_reset(s);
+#ifdef TSC_VERBOSE
+        } else {
+            fprintf(stderr, "tsc2102_control_register_write: "
+                            "wrong value written into RESET\n");
+#endif
+        }
+        return;
+
+    case 0x05:	/* Configuration */
+        s->timing = value & 0x3f;
+#ifdef TSC_VERBOSE
+        if (value & ~0x3f)
+            fprintf(stderr, "tsc2102_control_register_write: "
+                            "wrong value written into CONFIG\n");
+#endif
+        return;
+
+    default:
+#ifdef TSC_VERBOSE
+        fprintf(stderr, "tsc2102_control_register_write: "
+                        "no such register: 0x%02x\n", reg);
+#endif
+    }
+}
+
+static void tsc2102_audio_register_write(
+                struct tsc210x_state_s *s, int reg, uint16_t value)
+{
+    switch (reg) {
+    case 0x00:	/* Audio Control 1 */
+        s->audio_ctrl1 = value & 0x0f3f;
+#ifdef TSC_VERBOSE
+        if ((value & ~0x0f3f) || ((value & 7) != ((value >> 3) & 7)))
+            fprintf(stderr, "tsc2102_audio_register_write: "
+                            "wrong value written into Audio 1\n");
+#endif
+        tsc2102_audio_rate_update(s);
+        if (s->audio)
+            tsc2102_audio_output_update(s);
+        return;
+
+    case 0x01:
+#ifdef TSC_VERBOSE
+        if (value != 0xff00)
+            fprintf(stderr, "tsc2102_audio_register_write: "
+                            "wrong value written into reg 0x01\n");
+#endif
+        return;
+
+    case 0x02:	/* DAC Volume Control */
+        s->volume = value;
+        s->volume_change = qemu_get_clock(vm_clock);
+        return;
+
+    case 0x03:
+#ifdef TSC_VERBOSE
+        if (value != 0x8b00)
+            fprintf(stderr, "tsc2102_audio_register_write: "
+                            "wrong value written into reg 0x03\n");
+#endif
+        return;
+
+    case 0x04:	/* Audio Control 2 */
+        s->audio_ctrl2 = value & 0xf7f2;
+#ifdef TSC_VERBOSE
+        if (value & ~0xf7fd)
+            fprintf(stderr, "tsc2102_audio_register_write: "
+                            "wrong value written into Audio 2\n");
+#endif
+        return;
+
+    case 0x05:	/* Stereo DAC Power Control */
+        if ((value & ~s->dac_power) & (1 << 10))
+            s->powerdown = qemu_get_clock(vm_clock);
+
+        s->dac_power = value & 0x9543;
+#ifdef TSC_VERBOSE
+        if ((value & ~0x9543) != 0x2aa0)
+            fprintf(stderr, "tsc2102_audio_register_write: "
+                            "wrong value written into Power\n");
+#endif
+        tsc2102_audio_rate_update(s);
+        if (s->audio)
+            tsc2102_audio_output_update(s);
+        return;
+
+    case 0x06:	/* Audio Control 3 */
+        s->audio_ctrl3 &= 0x00c0;
+        s->audio_ctrl3 |= value & 0xf800;
+#ifdef TSC_VERBOSE
+        if (value & ~0xf8c7)
+            fprintf(stderr, "tsc2102_audio_register_write: "
+                            "wrong value written into Audio 3\n");
+#endif
+        if (s->audio)
+            tsc2102_audio_output_update(s);
+        return;
+
+    case 0x07:	/* LCH_BASS_BOOST_N0 */
+    case 0x08:	/* LCH_BASS_BOOST_N1 */
+    case 0x09:	/* LCH_BASS_BOOST_N2 */
+    case 0x0a:	/* LCH_BASS_BOOST_N3 */
+    case 0x0b:	/* LCH_BASS_BOOST_N4 */
+    case 0x0c:	/* LCH_BASS_BOOST_N5 */
+    case 0x0d:	/* LCH_BASS_BOOST_D1 */
+    case 0x0e:	/* LCH_BASS_BOOST_D2 */
+    case 0x0f:	/* LCH_BASS_BOOST_D4 */
+    case 0x10:	/* LCH_BASS_BOOST_D5 */
+    case 0x11:	/* RCH_BASS_BOOST_N0 */
+    case 0x12:	/* RCH_BASS_BOOST_N1 */
+    case 0x13:	/* RCH_BASS_BOOST_N2 */
+    case 0x14:	/* RCH_BASS_BOOST_N3 */
+    case 0x15:	/* RCH_BASS_BOOST_N4 */
+    case 0x16:	/* RCH_BASS_BOOST_N5 */
+    case 0x17:	/* RCH_BASS_BOOST_D1 */
+    case 0x18:	/* RCH_BASS_BOOST_D2 */
+    case 0x19:	/* RCH_BASS_BOOST_D4 */
+    case 0x1a:	/* RCH_BASS_BOOST_D5 */
+        s->filter_data[reg - 0x07] = value;
+        return;
+
+    case 0x1b:	/* PLL Programmability 1 */
+        s->pll[0] = value & 0xfffc;
+#ifdef TSC_VERBOSE
+        if (value & ~0xfffc)
+            fprintf(stderr, "tsc2102_audio_register_write: "
+                            "wrong value written into PLL 1\n");
+#endif
+        return;
+
+    case 0x1c:	/* PLL Programmability 2 */
+        s->pll[1] = value & 0xfffc;
+#ifdef TSC_VERBOSE
+        if (value & ~0xfffc)
+            fprintf(stderr, "tsc2102_audio_register_write: "
+                            "wrong value written into PLL 2\n");
+#endif
+        return;
+
+    case 0x1d:	/* Audio Control 4 */
+        s->softstep = !(value & 0x4000);
+#ifdef TSC_VERBOSE
+        if (value & ~0x4000)
+            fprintf(stderr, "tsc2102_audio_register_write: "
+                            "wrong value written into Audio 4\n");
+#endif
+        return;
+
+    default:
+#ifdef TSC_VERBOSE
+        fprintf(stderr, "tsc2102_audio_register_write: "
+                        "no such register: 0x%02x\n", reg);
+#endif
+    }
+}
+
+/* This handles most of the chip logic.  */
+static void tsc210x_pin_update(struct tsc210x_state_s *s)
+{
+    int64_t expires;
+    int pin_state;
+
+    switch (s->pin_func) {
+    case 0:
+        pin_state = s->pressure;
+        break;
+    case 1:
+        pin_state = !!s->dav;
+        break;
+    case 2:
+    default:
+        pin_state = s->pressure && !s->dav;
+    }
+
+    if (!s->enabled)
+        pin_state = 0;
+
+    if (pin_state != s->irq) {
+        s->irq = pin_state;
+        qemu_set_irq(s->pint, !s->irq);
+    }
+
+    switch (s->nextfunction) {
+    case TSC_MODE_XY_SCAN:
+    case TSC_MODE_XYZ_SCAN:
+        if (!s->pressure)
+            return;
+        break;
+
+    case TSC_MODE_X:
+    case TSC_MODE_Y:
+    case TSC_MODE_Z:
+        if (!s->pressure)
+            return;
+        /* Fall through */
+    case TSC_MODE_BAT1:
+    case TSC_MODE_BAT2:
+    case TSC_MODE_AUX:
+    case TSC_MODE_TEMP1:
+    case TSC_MODE_TEMP2:
+        if (s->dav)
+            s->enabled = 0;
+        break;
+
+    case TSC_MODE_AUX_SCAN:
+    case TSC_MODE_PORT_SCAN:
+        break;
+
+    case TSC_MODE_NO_SCAN:
+    case TSC_MODE_XX_DRV:
+    case TSC_MODE_YY_DRV:
+    case TSC_MODE_YX_DRV:
+    default:
+        return;
+    }
+
+    if (!s->enabled || s->busy)
+        return;
+
+    s->busy = 1;
+    s->precision = s->nextprecision;
+    s->function = s->nextfunction;
+    expires = qemu_get_clock(vm_clock) + (ticks_per_sec >> 10);
+    qemu_mod_timer(s->timer, expires);
+}
+
+static uint16_t tsc210x_read(struct tsc210x_state_s *s)
+{
+    uint16_t ret = 0x0000;
+
+    if (!s->command)
+        fprintf(stderr, "tsc210x_read: SPI underrun!\n");
+
+    switch (s->page) {
+    case TSC_DATA_REGISTERS_PAGE:
+        ret = tsc2102_data_register_read(s, s->offset);
+        break;
+    case TSC_CONTROL_REGISTERS_PAGE:
+        ret = tsc2102_control_register_read(s, s->offset);
+        break;
+    case TSC_AUDIO_REGISTERS_PAGE:
+        ret = tsc2102_audio_register_read(s, s->offset);
+        break;
+    default:
+        cpu_abort(cpu_single_env, "tsc210x_read: wrong memory page\n");
+    }
+
+    tsc210x_pin_update(s);
+
+    /* Allow sequential reads.  */
+    s->offset ++;
+    s->state = 0;
+    return ret;
+}
+
+static void tsc210x_write(struct tsc210x_state_s *s, uint16_t value)
+{
+    /*
+     * This is a two-state state machine for reading
+     * command and data every second time.
+     */
+    if (!s->state) {
+        s->command = value >> 15;
+        s->page = (value >> 11) & 0x0f;
+        s->offset = (value >> 5) & 0x3f;
+        s->state = 1;
+    } else {
+        if (s->command)
+            fprintf(stderr, "tsc210x_write: SPI overrun!\n");
+        else
+            switch (s->page) {
+            case TSC_DATA_REGISTERS_PAGE:
+                tsc2102_data_register_write(s, s->offset, value);
+                break;
+            case TSC_CONTROL_REGISTERS_PAGE:
+                tsc2102_control_register_write(s, s->offset, value);
+                break;
+            case TSC_AUDIO_REGISTERS_PAGE:
+                tsc2102_audio_register_write(s, s->offset, value);
+                break;
+            default:
+                cpu_abort(cpu_single_env,
+                                "tsc210x_write: wrong memory page\n");
+            }
+
+        tsc210x_pin_update(s);
+        s->state = 0;
+    }
+}
+
+static void tsc210x_timer_tick(void *opaque)
+{
+    struct tsc210x_state_s *s = opaque;
+
+    /* Timer ticked -- a set of conversions has been finished.  */
+
+    if (!s->busy)
+        return;
+
+    s->busy = 0;
+    s->dav |= mode_regs[s->function];
+    tsc210x_pin_update(s);
+}
+
+static void tsc210x_touchscreen_event(void *opaque,
+                int x, int y, int z, int buttons_state)
+{
+    struct tsc210x_state_s *s = opaque;
+    int p = s->pressure;
+
+    if (buttons_state) {
+        s->x = x;
+        s->y = y;
+    }
+    s->pressure = !!buttons_state;
+
+    /*
+     * Note: We would get better responsiveness in the guest by
+     * signaling TS events immediately, but for now we simulate
+     * the first conversion delay for sake of correctness.
+     */
+    if (p != s->pressure)
+        tsc210x_pin_update(s);
+}
+
+static void tsc210x_i2s_swallow(struct tsc210x_state_s *s)
+{
+    if (s->dac_voice[0])
+        tsc210x_out_flush(s, s->codec.out.len);
+    else
+        s->codec.out.len = 0;
+}
+
+static void tsc210x_i2s_set_rate(struct tsc210x_state_s *s, int in, int out)
+{
+    s->i2s_tx_rate = out;
+    s->i2s_rx_rate = in;
+}
+
+static void tsc210x_save(QEMUFile *f, void *opaque)
+{
+    struct tsc210x_state_s *s = (struct tsc210x_state_s *) opaque;
+    int64_t now = qemu_get_clock(vm_clock);
+    int i;
+
+    qemu_put_be16(f, s->x);
+    qemu_put_be16(f, s->y);
+    qemu_put_byte(f, s->pressure);
+
+    qemu_put_byte(f, s->state);
+    qemu_put_byte(f, s->page);
+    qemu_put_byte(f, s->offset);
+    qemu_put_byte(f, s->command);
+
+    qemu_put_byte(f, s->irq);
+    qemu_put_be16s(f, &s->dav);
+
+    qemu_put_timer(f, s->timer);
+    qemu_put_byte(f, s->enabled);
+    qemu_put_byte(f, s->host_mode);
+    qemu_put_byte(f, s->function);
+    qemu_put_byte(f, s->nextfunction);
+    qemu_put_byte(f, s->precision);
+    qemu_put_byte(f, s->nextprecision);
+    qemu_put_byte(f, s->filter);
+    qemu_put_byte(f, s->pin_func);
+    qemu_put_byte(f, s->ref);
+    qemu_put_byte(f, s->timing);
+    qemu_put_be32(f, s->noise);
+
+    qemu_put_be16s(f, &s->audio_ctrl1);
+    qemu_put_be16s(f, &s->audio_ctrl2);
+    qemu_put_be16s(f, &s->audio_ctrl3);
+    qemu_put_be16s(f, &s->pll[0]);
+    qemu_put_be16s(f, &s->pll[1]);
+    qemu_put_be16s(f, &s->volume);
+    qemu_put_be64(f, (uint64_t) (s->volume_change - now));
+    qemu_put_be64(f, (uint64_t) (s->powerdown - now));
+    qemu_put_byte(f, s->softstep);
+    qemu_put_be16s(f, &s->dac_power);
+
+    for (i = 0; i < 0x14; i ++)
+        qemu_put_be16s(f, &s->filter_data[i]);
+}
+
+static int tsc210x_load(QEMUFile *f, void *opaque, int version_id)
+{
+    struct tsc210x_state_s *s = (struct tsc210x_state_s *) opaque;
+    int64_t now = qemu_get_clock(vm_clock);
+    int i;
+
+    s->x = qemu_get_be16(f);
+    s->y = qemu_get_be16(f);
+    s->pressure = qemu_get_byte(f);
+
+    s->state = qemu_get_byte(f);
+    s->page = qemu_get_byte(f);
+    s->offset = qemu_get_byte(f);
+    s->command = qemu_get_byte(f);
+
+    s->irq = qemu_get_byte(f);
+    qemu_get_be16s(f, &s->dav);
+
+    qemu_get_timer(f, s->timer);
+    s->enabled = qemu_get_byte(f);
+    s->host_mode = qemu_get_byte(f);
+    s->function = qemu_get_byte(f);
+    s->nextfunction = qemu_get_byte(f);
+    s->precision = qemu_get_byte(f);
+    s->nextprecision = qemu_get_byte(f);
+    s->filter = qemu_get_byte(f);
+    s->pin_func = qemu_get_byte(f);
+    s->ref = qemu_get_byte(f);
+    s->timing = qemu_get_byte(f);
+    s->noise = qemu_get_be32(f);
+
+    qemu_get_be16s(f, &s->audio_ctrl1);
+    qemu_get_be16s(f, &s->audio_ctrl2);
+    qemu_get_be16s(f, &s->audio_ctrl3);
+    qemu_get_be16s(f, &s->pll[0]);
+    qemu_get_be16s(f, &s->pll[1]);
+    qemu_get_be16s(f, &s->volume);
+    s->volume_change = (int64_t) qemu_get_be64(f) + now;
+    s->powerdown = (int64_t) qemu_get_be64(f) + now;
+    s->softstep = qemu_get_byte(f);
+    qemu_get_be16s(f, &s->dac_power);
+
+    for (i = 0; i < 0x14; i ++)
+        qemu_get_be16s(f, &s->filter_data[i]);
+
+    s->busy = qemu_timer_pending(s->timer);
+    qemu_set_irq(s->pint, !s->irq);
+
+    return 0;
+}
+
+static int tsc2102_iid = 0;
+
+struct uwire_slave_s *tsc2102_init(qemu_irq pint, AudioState *audio)
+{
+    struct tsc210x_state_s *s;
+
+    s = (struct tsc210x_state_s *)
+            qemu_mallocz(sizeof(struct tsc210x_state_s));
+    memset(s, 0, sizeof(struct tsc210x_state_s));
+    s->x = 160;
+    s->y = 160;
+    s->pressure = 0;
+    s->precision = s->nextprecision = 0;
+    s->timer = qemu_new_timer(vm_clock, tsc210x_timer_tick, s);
+    s->pint = pint;
+    s->name = "tsc2102";
+    s->audio = audio;
+
+    s->chip.opaque = s;
+    s->chip.send = (void *) tsc210x_write;
+    s->chip.receive = (void *) tsc210x_read;
+
+    s->codec.opaque = s;
+    s->codec.tx_swallow = (void *) tsc210x_i2s_swallow;
+    s->codec.set_rate = (void *) tsc210x_i2s_set_rate;
+    s->codec.in.fifo = s->in_fifo;
+    s->codec.out.fifo = s->out_fifo;
+
+    tsc210x_reset(s);
+
+    qemu_add_mouse_event_handler(tsc210x_touchscreen_event, s, 1,
+                    "QEMU TSC2102-driven Touchscreen");
+
+    if (s->audio)
+        AUD_register_card(s->audio, s->name, &s->card);
+
+    qemu_register_reset((void *) tsc210x_reset, s);
+    register_savevm(s->name, tsc2102_iid ++, 0,
+                    tsc210x_save, tsc210x_load, s);
+
+    return &s->chip;
+}
+
+struct i2s_codec_s *tsc210x_codec(struct uwire_slave_s *chip)
+{
+    struct tsc210x_state_s *s = (struct tsc210x_state_s *) chip->opaque;
+
+    return &s->codec;
+}
diff --git a/hw/unin_pci.c b/hw/unin_pci.c
index 8728f119c..60fdea890 100644
--- a/hw/unin_pci.c
+++ b/hw/unin_pci.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "ppc_mac.h"
+#include "pci.h"
+
 typedef target_phys_addr_t pci_addr_t;
 #include "pci_host.h"
 
diff --git a/hw/usb-hid.c b/hw/usb-hid.c
index aebcf032c..6ea6c4da5 100644
--- a/hw/usb-hid.c
+++ b/hw/usb-hid.c
@@ -22,7 +22,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "console.h"
+#include "usb.h"
 
 /* HID interface requests */
 #define GET_REPORT   0xa101
diff --git a/hw/usb-hub.c b/hw/usb-hub.c
index 1dcac3ca6..97c3d0522 100644
--- a/hw/usb-hub.c
+++ b/hw/usb-hub.c
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "usb.h"
 
 //#define DEBUG
 
diff --git a/hw/usb-msd.c b/hw/usb-msd.c
index b1ad9ec09..01d492d42 100644
--- a/hw/usb-msd.c
+++ b/hw/usb-msd.c
@@ -7,7 +7,10 @@
  * This code is licenced under the LGPL.
  */
 
-#include "vl.h"
+#include "qemu-common.h"
+#include "usb.h"
+#include "block.h"
+#include "scsi-disk.h"
 
 //#define DEBUG_MSD
 
@@ -146,9 +149,9 @@ static void usb_msd_copy_data(MSDState *s)
     s->data_len -= len;
     if (s->scsi_len == 0) {
         if (s->mode == USB_MSDM_DATAIN) {
-            scsi_read_data(s->scsi_dev, s->tag);
+            s->scsi_dev->read_data(s->scsi_dev, s->tag);
         } else if (s->mode == USB_MSDM_DATAOUT) {
-            scsi_write_data(s->scsi_dev, s->tag);
+            s->scsi_dev->write_data(s->scsi_dev, s->tag);
         }
     }
 }
@@ -201,7 +204,7 @@ static void usb_msd_command_complete(void *opaque, int reason, uint32_t tag,
         return;
     }
     s->scsi_len = arg;
-    s->scsi_buf = scsi_get_buf(s->scsi_dev, tag);
+    s->scsi_buf = s->scsi_dev->get_buf(s->scsi_dev, tag);
     if (p) {
         usb_msd_copy_data(s);
         if (s->usb_len == 0) {
@@ -339,7 +342,7 @@ static int usb_msd_handle_control(USBDevice *dev, int request, int value,
 static void usb_msd_cancel_io(USBPacket *p, void *opaque)
 {
     MSDState *s = opaque;
-    scsi_cancel_io(s->scsi_dev, s->tag);
+    s->scsi_dev->cancel_io(s->scsi_dev, s->tag);
     s->packet = NULL;
     s->scsi_len = 0;
 }
@@ -387,14 +390,14 @@ static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
                     s->tag, cbw.flags, cbw.cmd_len, s->data_len);
             s->residue = 0;
-            scsi_send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
+            s->scsi_dev->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
             /* ??? Should check that USB and SCSI data transfer
                directions match.  */
             if (s->residue == 0) {
                 if (s->mode == USB_MSDM_DATAIN) {
-                    scsi_read_data(s->scsi_dev, s->tag);
+                    s->scsi_dev->read_data(s->scsi_dev, s->tag);
                 } else if (s->mode == USB_MSDM_DATAOUT) {
-                    scsi_write_data(s->scsi_dev, s->tag);
+                    s->scsi_dev->write_data(s->scsi_dev, s->tag);
                 }
             }
             ret = len;
@@ -505,7 +508,7 @@ static void usb_msd_handle_destroy(USBDevice *dev)
 {
     MSDState *s = (MSDState *)dev;
 
-    scsi_disk_destroy(s->scsi_dev);
+    s->scsi_dev->destroy(s->scsi_dev);
     bdrv_delete(s->bs);
     qemu_free(s);
 }
diff --git a/hw/usb-ohci.c b/hw/usb-ohci.c
index 2d5af7da0..68995b070 100644
--- a/hw/usb-ohci.c
+++ b/hw/usb-ohci.c
@@ -27,11 +27,16 @@
  *  o BIOS work to boot from USB storage
 */
 
-#include "vl.h"
+#include "hw.h"
+#include "qemu-timer.h"
+#include "usb.h"
+#include "pci.h"
+#include "pxa.h"
 
 //#define DEBUG_OHCI
 /* Dump packet contents.  */
 //#define DEBUG_PACKET
+//#define DEBUG_ISOCH
 /* This causes frames to occur 1000x slower */
 //#define OHCI_TIME_WARP 1
 
@@ -132,8 +137,8 @@ static void ohci_bus_stop(OHCIState *ohci);
 #define OHCI_ED_S         (1<<13)
 #define OHCI_ED_K         (1<<14)
 #define OHCI_ED_F         (1<<15)
-#define OHCI_ED_MPS_SHIFT 7
-#define OHCI_ED_MPS_MASK  (0xf<<OHCI_ED_FA_SHIFT)
+#define OHCI_ED_MPS_SHIFT 16
+#define OHCI_ED_MPS_MASK  (0x7ff<<OHCI_ED_MPS_SHIFT)
 
 /* Flags in the head field of an Endpoint Desciptor.  */
 #define OHCI_ED_H         1
@@ -152,6 +157,22 @@ static void ohci_bus_stop(OHCIState *ohci);
 #define OHCI_TD_CC_SHIFT  28
 #define OHCI_TD_CC_MASK   (0xf<<OHCI_TD_CC_SHIFT)
 
+/* Bitfields for the first word of an Isochronous Transfer Desciptor.  */
+/* CC & DI - same as in the General Transfer Desciptor */
+#define OHCI_TD_SF_SHIFT  0
+#define OHCI_TD_SF_MASK   (0xffff<<OHCI_TD_SF_SHIFT)
+#define OHCI_TD_FC_SHIFT  24
+#define OHCI_TD_FC_MASK   (7<<OHCI_TD_FC_SHIFT)
+
+/* Isochronous Transfer Desciptor - Offset / PacketStatusWord */
+#define OHCI_TD_PSW_CC_SHIFT 12
+#define OHCI_TD_PSW_CC_MASK  (0xf<<OHCI_TD_PSW_CC_SHIFT)
+#define OHCI_TD_PSW_SIZE_SHIFT 0
+#define OHCI_TD_PSW_SIZE_MASK  (0xfff<<OHCI_TD_PSW_SIZE_SHIFT)
+
+#define OHCI_PAGE_MASK    0xfffff000
+#define OHCI_OFFSET_MASK  0xfff
+
 #define OHCI_DPTR_MASK    0xfffffff0
 
 #define OHCI_BM(val, field) \
@@ -178,6 +199,15 @@ struct ohci_td {
     uint32_t be;
 };
 
+/* Isochronous transfer descriptor */
+struct ohci_iso_td {
+    uint32_t flags;
+    uint32_t bp;
+    uint32_t next;
+    uint32_t be;
+    uint16_t offset[8];
+};
+
 #define USB_HZ                      12000000
 
 /* OHCI Local stuff */
@@ -421,6 +451,32 @@ static inline int put_dwords(uint32_t addr, uint32_t *buf, int num)
     return 1;
 }
 
+/* Get an array of words from main memory */
+static inline int get_words(uint32_t addr, uint16_t *buf, int num)
+{
+    int i;
+
+    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
+        cpu_physical_memory_rw(addr, (uint8_t *)buf, sizeof(*buf), 0);
+        *buf = le16_to_cpu(*buf);
+    }
+
+    return 1;
+}
+
+/* Put an array of words in to main memory */
+static inline int put_words(uint32_t addr, uint16_t *buf, int num)
+{
+    int i;
+
+    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
+        uint16_t tmp = cpu_to_le16(*buf);
+        cpu_physical_memory_rw(addr, (uint8_t *)&tmp, sizeof(tmp), 1);
+    }
+
+    return 1;
+}
+
 static inline int ohci_read_ed(uint32_t addr, struct ohci_ed *ed)
 {
     return get_dwords(addr, (uint32_t *)ed, sizeof(*ed) >> 2);
@@ -431,6 +487,12 @@ static inline int ohci_read_td(uint32_t addr, struct ohci_td *td)
     return get_dwords(addr, (uint32_t *)td, sizeof(*td) >> 2);
 }
 
+static inline int ohci_read_iso_td(uint32_t addr, struct ohci_iso_td *td)
+{
+    return (get_dwords(addr, (uint32_t *)td, 4) &&
+            get_words(addr + 16, td->offset, 8));
+}
+
 static inline int ohci_put_ed(uint32_t addr, struct ohci_ed *ed)
 {
     return put_dwords(addr, (uint32_t *)ed, sizeof(*ed) >> 2);
@@ -441,6 +503,12 @@ static inline int ohci_put_td(uint32_t addr, struct ohci_td *td)
     return put_dwords(addr, (uint32_t *)td, sizeof(*td) >> 2);
 }
 
+static inline int ohci_put_iso_td(uint32_t addr, struct ohci_iso_td *td)
+{
+    return (put_dwords(addr, (uint32_t *)td, 4) &&
+            put_words(addr + 16, td->offset, 8));
+}
+
 /* Read/Write the contents of a TD from/to main memory.  */
 static void ohci_copy_td(struct ohci_td *td, uint8_t *buf, int len, int write)
 {
@@ -459,16 +527,270 @@ static void ohci_copy_td(struct ohci_td *td, uint8_t *buf, int len, int write)
     cpu_physical_memory_rw(ptr, buf, len - n, write);
 }
 
-static void ohci_process_lists(OHCIState *ohci);
+/* Read/Write the contents of an ISO TD from/to main memory.  */
+static void ohci_copy_iso_td(uint32_t start_addr, uint32_t end_addr,
+                             uint8_t *buf, int len, int write)
+{
+    uint32_t ptr;
+    uint32_t n;
 
-static void ohci_async_complete_packet(USBPacket * packet, void *opaque)
+    ptr = start_addr;
+    n = 0x1000 - (ptr & 0xfff);
+    if (n > len)
+        n = len;
+    cpu_physical_memory_rw(ptr, buf, n, write);
+    if (n == len)
+        return;
+    ptr = end_addr & ~0xfffu;
+    buf += n;
+    cpu_physical_memory_rw(ptr, buf, len - n, write);
+}
+
+static void ohci_process_lists(OHCIState *ohci, int completion);
+
+static void ohci_async_complete_packet(USBPacket *packet, void *opaque)
 {
     OHCIState *ohci = opaque;
 #ifdef DEBUG_PACKET
     dprintf("Async packet complete\n");
 #endif
     ohci->async_complete = 1;
-    ohci_process_lists(ohci);
+    ohci_process_lists(ohci, 1);
+}
+
+#define USUB(a, b) ((int16_t)((uint16_t)(a) - (uint16_t)(b)))
+
+static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
+                               int completion)
+{
+    int dir;
+    size_t len = 0;
+    char *str = NULL;
+    int pid;
+    int ret;
+    int i;
+    USBDevice *dev;
+    struct ohci_iso_td iso_td;
+    uint32_t addr;
+    uint16_t starting_frame;
+    int16_t relative_frame_number;
+    int frame_count;
+    uint32_t start_offset, next_offset, end_offset = 0;
+    uint32_t start_addr, end_addr;
+
+    addr = ed->head & OHCI_DPTR_MASK;
+
+    if (!ohci_read_iso_td(addr, &iso_td)) {
+        printf("usb-ohci: ISO_TD read error at %x\n", addr);
+        return 0;
+    }
+
+    starting_frame = OHCI_BM(iso_td.flags, TD_SF);
+    frame_count = OHCI_BM(iso_td.flags, TD_FC);
+    relative_frame_number = USUB(ohci->frame_number, starting_frame); 
+
+#ifdef DEBUG_ISOCH
+    printf("--- ISO_TD ED head 0x%.8x tailp 0x%.8x\n"
+           "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
+           "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
+           "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
+           "frame_number 0x%.8x starting_frame 0x%.8x\n"
+           "frame_count  0x%.8x relative %d\n"
+           "di 0x%.8x cc 0x%.8x\n",
+           ed->head & OHCI_DPTR_MASK, ed->tail & OHCI_DPTR_MASK,
+           iso_td.flags, iso_td.bp, iso_td.next, iso_td.be,
+           iso_td.offset[0], iso_td.offset[1], iso_td.offset[2], iso_td.offset[3],
+           iso_td.offset[4], iso_td.offset[5], iso_td.offset[6], iso_td.offset[7],
+           ohci->frame_number, starting_frame, 
+           frame_count, relative_frame_number,         
+           OHCI_BM(iso_td.flags, TD_DI), OHCI_BM(iso_td.flags, TD_CC));
+#endif
+
+    if (relative_frame_number < 0) {
+        dprintf("usb-ohci: ISO_TD R=%d < 0\n", relative_frame_number);
+        return 1;
+    } else if (relative_frame_number > frame_count) {
+        /* ISO TD expired - retire the TD to the Done Queue and continue with
+           the next ISO TD of the same ED */
+        dprintf("usb-ohci: ISO_TD R=%d > FC=%d\n", relative_frame_number, 
+               frame_count);
+        OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_DATAOVERRUN);
+        ed->head &= ~OHCI_DPTR_MASK;
+        ed->head |= (iso_td.next & OHCI_DPTR_MASK);
+        iso_td.next = ohci->done;
+        ohci->done = addr;
+        i = OHCI_BM(iso_td.flags, TD_DI);
+        if (i < ohci->done_count)
+            ohci->done_count = i;
+        ohci_put_iso_td(addr, &iso_td);        
+        return 0;
+    }
+
+    dir = OHCI_BM(ed->flags, ED_D);
+    switch (dir) {
+    case OHCI_TD_DIR_IN:
+        str = "in";
+        pid = USB_TOKEN_IN;
+        break;
+    case OHCI_TD_DIR_OUT:
+        str = "out";
+        pid = USB_TOKEN_OUT;
+        break;
+    case OHCI_TD_DIR_SETUP:
+        str = "setup";
+        pid = USB_TOKEN_SETUP;
+        break;
+    default:
+        printf("usb-ohci: Bad direction %d\n", dir);
+        return 1;
+    }
+
+    if (!iso_td.bp || !iso_td.be) {
+        printf("usb-ohci: ISO_TD bp 0x%.8x be 0x%.8x\n", iso_td.bp, iso_td.be);
+        return 1;
+    }
+
+    start_offset = iso_td.offset[relative_frame_number];
+    next_offset = iso_td.offset[relative_frame_number + 1];
+
+    if (!(OHCI_BM(start_offset, TD_PSW_CC) & 0xe) || 
+        ((relative_frame_number < frame_count) && 
+         !(OHCI_BM(next_offset, TD_PSW_CC) & 0xe))) {
+        printf("usb-ohci: ISO_TD cc != not accessed 0x%.8x 0x%.8x\n",
+               start_offset, next_offset);
+        return 1;
+    }
+
+    if ((relative_frame_number < frame_count) && (start_offset > next_offset)) {
+        printf("usb-ohci: ISO_TD start_offset=0x%.8x > next_offset=0x%.8x\n",
+                start_offset, next_offset);
+        return 1;
+    }
+
+    if ((start_offset & 0x1000) == 0) {
+        start_addr = (iso_td.bp & OHCI_PAGE_MASK) |
+            (start_offset & OHCI_OFFSET_MASK);
+    } else {
+        start_addr = (iso_td.be & OHCI_PAGE_MASK) |
+            (start_offset & OHCI_OFFSET_MASK);
+    }
+
+    if (relative_frame_number < frame_count) {
+        end_offset = next_offset - 1;
+        if ((end_offset & 0x1000) == 0) {
+            end_addr = (iso_td.bp & OHCI_PAGE_MASK) |
+                (end_offset & OHCI_OFFSET_MASK);
+        } else {
+            end_addr = (iso_td.be & OHCI_PAGE_MASK) |
+                (end_offset & OHCI_OFFSET_MASK);
+        }
+    } else {
+        /* Last packet in the ISO TD */
+        end_addr = iso_td.be;
+    }
+
+    if ((start_addr & OHCI_PAGE_MASK) != (end_addr & OHCI_PAGE_MASK)) {
+        len = (end_addr & OHCI_OFFSET_MASK) + 0x1001
+            - (start_addr & OHCI_OFFSET_MASK);
+    } else {
+        len = end_addr - start_addr + 1;
+    }
+
+    if (len && dir != OHCI_TD_DIR_IN) {
+        ohci_copy_iso_td(start_addr, end_addr, ohci->usb_buf, len, 0);
+    }
+
+    if (completion) {
+        ret = ohci->usb_packet.len;
+    } else {
+        ret = USB_RET_NODEV;
+        for (i = 0; i < ohci->num_ports; i++) {
+            dev = ohci->rhport[i].port.dev;
+            if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0)
+                continue;
+            ohci->usb_packet.pid = pid;
+            ohci->usb_packet.devaddr = OHCI_BM(ed->flags, ED_FA);
+            ohci->usb_packet.devep = OHCI_BM(ed->flags, ED_EN);
+            ohci->usb_packet.data = ohci->usb_buf;
+            ohci->usb_packet.len = len;
+            ohci->usb_packet.complete_cb = ohci_async_complete_packet;
+            ohci->usb_packet.complete_opaque = ohci;
+            ret = dev->handle_packet(dev, &ohci->usb_packet);
+            if (ret != USB_RET_NODEV)
+                break;
+        }
+    
+        if (ret == USB_RET_ASYNC) {
+            return 1;
+        }
+    }
+
+#ifdef DEBUG_ISOCH
+    printf("so 0x%.8x eo 0x%.8x\nsa 0x%.8x ea 0x%.8x\ndir %s len %zu ret %d\n",
+           start_offset, end_offset, start_addr, end_addr, str, len, ret);
+#endif
+
+    /* Writeback */
+    if (dir == OHCI_TD_DIR_IN && ret >= 0 && ret <= len) {
+        /* IN transfer succeeded */
+        ohci_copy_iso_td(start_addr, end_addr, ohci->usb_buf, ret, 1);
+        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                    OHCI_CC_NOERROR);
+        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, ret);
+    } else if (dir == OHCI_TD_DIR_OUT && ret == len) {
+        /* OUT transfer succeeded */
+        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                    OHCI_CC_NOERROR);
+        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, 0);
+    } else {
+        if (ret > (ssize_t) len) {
+            printf("usb-ohci: DataOverrun %d > %zu\n", ret, len);
+            OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                        OHCI_CC_DATAOVERRUN);
+            OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
+                        len);
+        } else if (ret >= 0) {
+            printf("usb-ohci: DataUnderrun %d\n", ret);
+            OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                        OHCI_CC_DATAUNDERRUN);
+        } else {
+            switch (ret) {
+            case USB_RET_NODEV:
+                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                            OHCI_CC_DEVICENOTRESPONDING);
+                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
+                            0);
+                break;
+            case USB_RET_NAK:
+            case USB_RET_STALL:
+                printf("usb-ohci: got NAK/STALL %d\n", ret);
+                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                            OHCI_CC_STALL);
+                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
+                            0);
+                break;
+            default:
+                printf("usb-ohci: Bad device response %d\n", ret);
+                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                            OHCI_CC_UNDEXPETEDPID);
+                break;
+            }
+        }
+    }
+
+    if (relative_frame_number == frame_count) {
+        /* Last data packet of ISO TD - retire the TD to the Done Queue */
+        OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_NOERROR);
+        ed->head &= ~OHCI_DPTR_MASK;
+        ed->head |= (iso_td.next & OHCI_DPTR_MASK);
+        iso_td.next = ohci->done;
+        ohci->done = addr;
+        i = OHCI_BM(iso_td.flags, TD_DI);
+        if (i < ohci->done_count)
+            ohci->done_count = i;
+    }
+    ohci_put_iso_td(addr, &iso_td);
+    return 1;
 }
 
 /* Service a transport descriptor.
@@ -547,7 +869,7 @@ static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
     dprintf(" TD @ 0x%.8x %u bytes %s r=%d cbp=0x%.8x be=0x%.8x\n",
             addr, len, str, flag_r, td.cbp, td.be);
 
-    if (len >= 0 && dir != OHCI_TD_DIR_IN) {
+    if (len > 0 && dir != OHCI_TD_DIR_IN) {
         dprintf("  data:");
         for (i = 0; i < len; i++)
             printf(" %.2x", ohci->usb_buf[i]);
@@ -671,7 +993,7 @@ static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
 }
 
 /* Service an endpoint list.  Returns nonzero if active TD were found.  */
-static int ohci_service_ed_list(OHCIState *ohci, uint32_t head)
+static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion)
 {
     struct ohci_ed ed;
     uint32_t next_ed;
@@ -702,10 +1024,6 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head)
             continue;
         }
 
-        /* Skip isochronous endpoints.  */
-        if (ed.flags & OHCI_ED_F)
-          continue;
-
         while ((ed.head & OHCI_DPTR_MASK) != ed.tail) {
 #ifdef DEBUG_PACKET
             dprintf("ED @ 0x%.8x fa=%u en=%u d=%u s=%u k=%u f=%u mps=%u "
@@ -719,8 +1037,14 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head)
 #endif
             active = 1;
 
-            if (ohci_service_td(ohci, &ed))
-                break;
+            if ((ed.flags & OHCI_ED_F) == 0) {
+                if (ohci_service_td(ohci, &ed))
+                    break;
+            } else {
+                /* Handle isochronous endpoints */
+                if (ohci_service_iso_td(ohci, &ed, completion))
+                    break;
+            }
         }
 
         ohci_put_ed(cur, &ed);
@@ -738,19 +1062,20 @@ static void ohci_sof(OHCIState *ohci)
 }
 
 /* Process Control and Bulk lists.  */
-static void ohci_process_lists(OHCIState *ohci)
+static void ohci_process_lists(OHCIState *ohci, int completion)
 {
     if ((ohci->ctl & OHCI_CTL_CLE) && (ohci->status & OHCI_STATUS_CLF)) {
         if (ohci->ctrl_cur && ohci->ctrl_cur != ohci->ctrl_head)
-          dprintf("usb-ohci: head %x, cur %x\n", ohci->ctrl_head, ohci->ctrl_cur);
-        if (!ohci_service_ed_list(ohci, ohci->ctrl_head)) {
+          dprintf("usb-ohci: head %x, cur %x\n",
+                          ohci->ctrl_head, ohci->ctrl_cur);
+        if (!ohci_service_ed_list(ohci, ohci->ctrl_head, completion)) {
             ohci->ctrl_cur = 0;
             ohci->status &= ~OHCI_STATUS_CLF;
         }
     }
 
     if ((ohci->ctl & OHCI_CTL_BLE) && (ohci->status & OHCI_STATUS_BLF)) {
-        if (!ohci_service_ed_list(ohci, ohci->bulk_head)) {
+        if (!ohci_service_ed_list(ohci, ohci->bulk_head, completion)) {
             ohci->bulk_cur = 0;
             ohci->status &= ~OHCI_STATUS_BLF;
         }
@@ -770,7 +1095,7 @@ static void ohci_frame_boundary(void *opaque)
         int n;
 
         n = ohci->frame_number & 0x1f;
-        ohci_service_ed_list(ohci, le32_to_cpu(hcca.intr[n]));
+        ohci_service_ed_list(ohci, le32_to_cpu(hcca.intr[n]), 0);
     }
 
     /* Cancel all pending packets if either of the lists has been disabled.  */
@@ -780,7 +1105,7 @@ static void ohci_frame_boundary(void *opaque)
         ohci->async_td = 0;
     }
     ohci->old_ctl = ohci->ctl;
-    ohci_process_lists(ohci);
+    ohci_process_lists(ohci, 0);
 
     /* Frame boundary, so do EOF stuf here */
     ohci->frt = ohci->fit;
@@ -1206,6 +1531,9 @@ static void ohci_mem_write(void *ptr, target_phys_addr_t addr, uint32_t val)
         ohci_set_frame_interval(ohci, val);
         break;
 
+    case 15: /* HcFmNumber */
+        break;
+
     case 16: /* HcPeriodicStart */
         ohci->pstart = val & 0xffff;
         break;
diff --git a/hw/usb-uhci.c b/hw/usb-uhci.c
index 8c3cb0198..12afadeea 100644
--- a/hw/usb-uhci.c
+++ b/hw/usb-uhci.c
@@ -21,10 +21,14 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "usb.h"
+#include "pci.h"
+#include "qemu-timer.h"
 
 //#define DEBUG
 //#define DEBUG_PACKET
+//#define DEBUG_ISOCH
 
 #define UHCI_CMD_FGR      (1 << 4)
 #define UHCI_CMD_EGSM     (1 << 3)
@@ -88,6 +92,7 @@ typedef struct UHCIState {
        other queues will not be processed until the next frame.  The solution
        is to allow multiple pending requests.  */
     uint32_t async_qh;
+    uint32_t async_frame_addr;
     USBPacket usb_packet;
     uint8_t usb_buf[2048];
 } UHCIState;
@@ -146,12 +151,13 @@ static void uhci_reset(UHCIState *s)
     }
 }
 
+#if 1
 static void uhci_save(QEMUFile *f, void *opaque)
 {
     UHCIState *s = opaque;
     uint8_t num_ports = NB_PORTS;
     int i;
-    
+
     pci_device_save(&s->dev, f);
 
     qemu_put_8s(f, &num_ports);
@@ -167,7 +173,7 @@ static void uhci_save(QEMUFile *f, void *opaque)
     qemu_put_timer(f, s->frame_timer);
 }
 
-static int uhci_load(QEMUFile* f,void* opaque,int version_id)
+static int uhci_load(QEMUFile *f, void *opaque, int version_id)
 {
     UHCIState *s = opaque;
     uint8_t num_ports;
@@ -183,7 +189,7 @@ static int uhci_load(QEMUFile* f,void* opaque,int version_id)
     qemu_get_8s(f, &num_ports);
     if (num_ports != NB_PORTS)
         return -EINVAL;
-    
+
     for (i = 0; i < num_ports; ++i)
         qemu_get_be16s(f, &s->ports[i].ctrl);
     qemu_get_be16s(f, &s->cmd);
@@ -194,9 +200,10 @@ static int uhci_load(QEMUFile* f,void* opaque,int version_id)
     qemu_get_8s(f, &s->sof_timing);
     qemu_get_8s(f, &s->status2);
     qemu_get_timer(f, s->frame_timer);
-    
+
     return 0;
 }
+#endif
 
 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
 {
@@ -501,10 +508,11 @@ static void uhci_async_complete_packet(USBPacket * packet, void *opaque);
           0 if TD successful
           1 if TD unsuccessful or inactive
 */
-static int uhci_handle_td(UHCIState *s, UHCI_TD *td, int *int_mask)
+static int uhci_handle_td(UHCIState *s, UHCI_TD *td, uint32_t *int_mask,
+                          int completion)
 {
     uint8_t pid;
-    int len, max_len, err, ret;
+    int len = 0, max_len, err, ret = 0;
 
     /* ??? This is wrong for async completion.  */
     if (td->ctrl & TD_CTRL_IOC) {
@@ -517,7 +525,8 @@ static int uhci_handle_td(UHCIState *s, UHCI_TD *td, int *int_mask)
     /* TD is active */
     max_len = ((td->token >> 21) + 1) & 0x7ff;
     pid = td->token & 0xff;
-    if (s->async_qh) {
+
+    if (completion && (s->async_qh || s->async_frame_addr)) {
         ret = s->usb_packet.len;
         if (ret >= 0) {
             len = ret;
@@ -533,7 +542,8 @@ static int uhci_handle_td(UHCIState *s, UHCI_TD *td, int *int_mask)
             len = 0;
         }
         s->async_qh = 0;
-    } else {
+        s->async_frame_addr = 0;
+    } else if (!completion) {
         s->usb_packet.pid = pid;
         s->usb_packet.devaddr = (td->token >> 8) & 0x7f;
         s->usb_packet.devep = (td->token >> 15) & 0xf;
@@ -571,6 +581,7 @@ static int uhci_handle_td(UHCIState *s, UHCI_TD *td, int *int_mask)
             return -1;
         }
     }
+
     if (ret == USB_RET_ASYNC) {
         return 2;
     }
@@ -636,8 +647,42 @@ static void uhci_async_complete_packet(USBPacket * packet, void *opaque)
     uint32_t link;
     uint32_t old_td_ctrl;
     uint32_t val;
+    uint32_t frame_addr;
     int ret;
 
+    /* Handle async isochronous packet completion */
+    frame_addr = s->async_frame_addr;
+    if (frame_addr) {
+        cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
+        le32_to_cpus(&link);
+
+        cpu_physical_memory_read(link & ~0xf, (uint8_t *)&td, sizeof(td));
+        le32_to_cpus(&td.link);
+        le32_to_cpus(&td.ctrl);
+        le32_to_cpus(&td.token);
+        le32_to_cpus(&td.buffer);
+        old_td_ctrl = td.ctrl;
+        ret = uhci_handle_td(s, &td, &s->pending_int_mask, 1);
+
+        /* update the status bits of the TD */
+        if (old_td_ctrl != td.ctrl) {
+            val = cpu_to_le32(td.ctrl);
+            cpu_physical_memory_write((link & ~0xf) + 4,
+                                      (const uint8_t *)&val,
+                                      sizeof(val));
+        }
+        if (ret == 2) {
+            s->async_frame_addr = frame_addr;
+        } else if (ret == 0) {
+            /* update qh element link */
+            val = cpu_to_le32(td.link);
+            cpu_physical_memory_write(frame_addr,
+                                      (const uint8_t *)&val,
+                                      sizeof(val));
+        }
+        return;
+    }
+
     link = s->async_qh;
     if (!link) {
         /* This should never happen. It means a TD somehow got removed
@@ -656,7 +701,8 @@ static void uhci_async_complete_packet(USBPacket * packet, void *opaque)
         le32_to_cpus(&td.token);
         le32_to_cpus(&td.buffer);
         old_td_ctrl = td.ctrl;
-        ret = uhci_handle_td(s, &td, &s->pending_int_mask);
+        ret = uhci_handle_td(s, &td, &s->pending_int_mask, 1);
+
         /* update the status bits of the TD */
         if (old_td_ctrl != td.ctrl) {
             val = cpu_to_le32(td.ctrl);
@@ -687,8 +733,8 @@ static void uhci_frame_timer(void *opaque)
 {
     UHCIState *s = opaque;
     int64_t expire_time;
-    uint32_t frame_addr, link, old_td_ctrl, val;
-    int int_mask, cnt, ret;
+    uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
+    int cnt, ret;
     UHCI_TD td;
     UHCI_QH qh;
     uint32_t old_async_qh;
@@ -749,7 +795,8 @@ static void uhci_frame_timer(void *opaque)
                 le32_to_cpus(&td.token);
                 le32_to_cpus(&td.buffer);
                 old_td_ctrl = td.ctrl;
-                ret = uhci_handle_td(s, &td, &int_mask);
+                ret = uhci_handle_td(s, &td, &int_mask, 0);
+
                 /* update the status bits of the TD */
                 if (old_td_ctrl != td.ctrl) {
                     val = cpu_to_le32(td.ctrl);
@@ -783,27 +830,23 @@ static void uhci_frame_timer(void *opaque)
             le32_to_cpus(&td.ctrl);
             le32_to_cpus(&td.token);
             le32_to_cpus(&td.buffer);
-            /* Ignore isochonous transfers while there is an async packet
-               pending.  This is wrong, but we don't implement isochronous
-               transfers anyway.  */
-            if (s->async_qh == 0) {
-                old_td_ctrl = td.ctrl;
-                ret = uhci_handle_td(s, &td, &int_mask);
-                /* update the status bits of the TD */
-                if (old_td_ctrl != td.ctrl) {
-                    val = cpu_to_le32(td.ctrl);
-                    cpu_physical_memory_write((link & ~0xf) + 4,
-                                              (const uint8_t *)&val,
-                                              sizeof(val));
-                }
-                if (ret < 0)
-                    break; /* interrupted frame */
-                if (ret == 2) {
-                    /* We can't handle async isochronous transfers.
-                       Cancel The packet.  */
-                    fprintf(stderr, "usb-uhci: Unimplemented async packet\n");
-                    usb_cancel_packet(&s->usb_packet);
-                }
+
+            /* Handle isochonous transfer.  */
+            /* FIXME: might be more than one isoc in frame */
+            old_td_ctrl = td.ctrl;
+            ret = uhci_handle_td(s, &td, &int_mask, 0);
+
+            /* update the status bits of the TD */
+            if (old_td_ctrl != td.ctrl) {
+                val = cpu_to_le32(td.ctrl);
+                cpu_physical_memory_write((link & ~0xf) + 4,
+                                          (const uint8_t *)&val,
+                                          sizeof(val));
+            }
+            if (ret < 0)
+                break; /* interrupted frame */
+            if (ret == 2) {
+                s->async_frame_addr = frame_addr;
             }
             link = td.link;
         }
@@ -819,6 +862,7 @@ static void uhci_frame_timer(void *opaque)
         usb_cancel_packet(&s->usb_packet);
         s->async_qh = 0;
     }
+
     /* prepare the timer for the next frame */
     expire_time = qemu_get_clock(vm_clock) +
         (ticks_per_sec / FRAME_TIMER_FREQ);
@@ -909,4 +953,3 @@ void usb_uhci_piix4_init(PCIBus *bus, int devfn)
 
     register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);
 }
-
diff --git a/hw/usb-wacom.c b/hw/usb-wacom.c
index 99b8f9eb7..cc3579c58 100644
--- a/hw/usb-wacom.c
+++ b/hw/usb-wacom.c
@@ -25,7 +25,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "console.h"
+#include "usb.h"
 
 /* Interface requests */
 #define WACOM_GET_REPORT	0x2101
diff --git a/hw/usb.c b/hw/usb.c
index 75e5a808d..be4d66d1f 100644
--- a/hw/usb.c
+++ b/hw/usb.c
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "usb.h"
 
 void usb_attach(USBPort *port, USBDevice *dev)
 {
diff --git a/hw/usb.h b/hw/usb.h
index c5d24f158..e6fd3c066 100644
--- a/hw/usb.h
+++ b/hw/usb.h
@@ -202,15 +202,6 @@ void usb_packet_complete(USBPacket *p);
 /* usb hub */
 USBDevice *usb_hub_init(int nb_ports);
 
-/* usb-uhci.c */
-void usb_uhci_piix3_init(PCIBus *bus, int devfn);
-void usb_uhci_piix4_init(PCIBus *bus, int devfn);
-
-/* usb-ohci.c */
-void usb_ohci_init_pci(struct PCIBus *bus, int num_ports, int devfn);
-void usb_ohci_init_pxa(target_phys_addr_t base, int num_ports, int devfn,
-                       qemu_irq irq);
-
 /* usb-linux.c */
 USBDevice *usb_host_device_open(const char *devname);
 void usb_host_info(void);
@@ -225,3 +216,11 @@ USBDevice *usb_msd_init(const char *filename);
 
 /* usb-wacom.c */
 USBDevice *usb_wacom_init(void);
+
+/* usb ports of the VM */
+
+void qemu_register_usb_port(USBPort *port, void *opaque, int index,
+                            usb_attachfn attach);
+
+#define VM_USB_HUB_SIZE 8
+
diff --git a/hw/versatile_pci.c b/hw/versatile_pci.c
index 68f18ef3f..67cee88e8 100644
--- a/hw/versatile_pci.c
+++ b/hw/versatile_pci.c
@@ -7,7 +7,9 @@
  * This code is licenced under the LGPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "pci.h"
+#include "primecell.h"
 
 static inline uint32_t vpb_pci_config_addr(target_phys_addr_t addr)
 {
diff --git a/hw/versatilepb.c b/hw/versatilepb.c
index 2e3dedd81..da6e4ec33 100644
--- a/hw/versatilepb.c
+++ b/hw/versatilepb.c
@@ -7,8 +7,14 @@
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
-#include "arm_pic.h"
+#include "hw.h"
+#include "arm-misc.h"
+#include "primecell.h"
+#include "devices.h"
+#include "net.h"
+#include "sysemu.h"
+#include "pci.h"
+#include "boards.h"
 
 /* Primary interrupt controller.  */
 
@@ -151,8 +157,8 @@ static qemu_irq *vpb_sic_init(uint32_t base, qemu_irq *parent, int irq)
    peripherans and expansion busses.  For now we emulate a subset of the
    PB peripherals and just change the board ID.  */
 
-static void versatile_init(int ram_size, int vga_ram_size, int boot_device,
-                     DisplayState *ds, const char **fd_filename, int snapshot,
+static void versatile_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
                      const char *kernel_filename, const char *kernel_cmdline,
                      const char *initrd_filename, const char *cpu_model,
                      int board_id)
@@ -165,11 +171,15 @@ static void versatile_init(int ram_size, int vga_ram_size, int boot_device,
     NICInfo *nd;
     int n;
     int done_smc = 0;
+    int index;
 
-    env = cpu_init();
     if (!cpu_model)
         cpu_model = "arm926";
-    cpu_arm_set_model(env, cpu_model);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     /* ??? RAM shoud repeat to fill physical memory space.  */
     /* SDRAM at address zero.  */
     cpu_register_physical_memory(0, ram_size, IO_MEM_RAM);
@@ -197,17 +207,22 @@ static void versatile_init(int ram_size, int vga_ram_size, int boot_device,
     if (usb_enabled) {
         usb_ohci_init_pci(pci_bus, 3, -1);
     }
+    if (drive_get_max_bus(IF_SCSI) > 0) {
+        fprintf(stderr, "qemu: too many SCSI bus\n");
+        exit(1);
+    }
     scsi_hba = lsi_scsi_init(pci_bus, -1);
-    for (n = 0; n < MAX_DISKS; n++) {
-        if (bs_table[n]) {
-            lsi_scsi_attach(scsi_hba, bs_table[n], n);
-        }
+    for (n = 0; n < LSI_MAX_DEVS; n++) {
+        index = drive_get_index(IF_SCSI, 0, n);
+        if (index == -1)
+            continue;
+        lsi_scsi_attach(scsi_hba, drives_table[index].bdrv, n);
     }
 
-    pl011_init(0x101f1000, pic[12], serial_hds[0]);
-    pl011_init(0x101f2000, pic[13], serial_hds[1]);
-    pl011_init(0x101f3000, pic[14], serial_hds[2]);
-    pl011_init(0x10009000, sic[6], serial_hds[3]);
+    pl011_init(0x101f1000, pic[12], serial_hds[0], PL011_ARM);
+    pl011_init(0x101f2000, pic[13], serial_hds[1], PL011_ARM);
+    pl011_init(0x101f3000, pic[14], serial_hds[2], PL011_ARM);
+    pl011_init(0x10009000, sic[6], serial_hds[3], PL011_ARM);
 
     pl080_init(0x10130000, pic[17], 8);
     sp804_init(0x101e2000, pic[4]);
@@ -217,7 +232,13 @@ static void versatile_init(int ram_size, int vga_ram_size, int boot_device,
        that includes hardware cursor support from the PL111.  */
     pl110_init(ds, 0x10120000, pic[16], 1);
 
-    pl181_init(0x10005000, sd_bdrv, sic[22], sic[1]);
+    index = drive_get_index(IF_SD, 0, 0);
+    if (index == -1) {
+        fprintf(stderr, "qemu: missing SecureDigital card\n");
+        exit(1);
+    }
+
+    pl181_init(0x10005000, drives_table[index].bdrv, sic[22], sic[1]);
 #if 0
     /* Disabled because there's no way of specifying a block device.  */
     pl181_init(0x1000b000, NULL, sic, 23, 2);
@@ -266,24 +287,24 @@ static void versatile_init(int ram_size, int vga_ram_size, int boot_device,
                     initrd_filename, board_id, 0x0);
 }
 
-static void vpb_init(int ram_size, int vga_ram_size, int boot_device,
-                     DisplayState *ds, const char **fd_filename, int snapshot,
+static void vpb_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
                      const char *kernel_filename, const char *kernel_cmdline,
                      const char *initrd_filename, const char *cpu_model)
 {
-    versatile_init(ram_size, vga_ram_size, boot_device,
-                   ds, fd_filename, snapshot,
+    versatile_init(ram_size, vga_ram_size,
+                   boot_device, ds,
                    kernel_filename, kernel_cmdline,
                    initrd_filename, cpu_model, 0x183);
 }
 
-static void vab_init(int ram_size, int vga_ram_size, int boot_device,
-                     DisplayState *ds, const char **fd_filename, int snapshot,
+static void vab_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
                      const char *kernel_filename, const char *kernel_cmdline,
                      const char *initrd_filename, const char *cpu_model)
 {
-    versatile_init(ram_size, vga_ram_size, boot_device,
-                   ds, fd_filename, snapshot,
+    versatile_init(ram_size, vga_ram_size,
+                   boot_device, ds,
                    kernel_filename, kernel_cmdline,
                    initrd_filename, cpu_model, 0x25e);
 }
diff --git a/hw/vga.c b/hw/vga.c
index f82bbb55c..593f4c6bb 100644
--- a/hw/vga.c
+++ b/hw/vga.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "console.h"
+#include "pc.h"
+#include "pci.h"
 #include "vga_int.h"
 #include "pixel_ops.h"
 
@@ -1735,12 +1738,12 @@ static void vga_save(QEMUFile *f, void *opaque)
     qemu_put_buffer(f, s->gr, 16);
     qemu_put_8s(f, &s->ar_index);
     qemu_put_buffer(f, s->ar, 21);
-    qemu_put_be32s(f, &s->ar_flip_flop);
+    qemu_put_be32(f, s->ar_flip_flop);
     qemu_put_8s(f, &s->cr_index);
     qemu_put_buffer(f, s->cr, 256);
     qemu_put_8s(f, &s->msr);
     qemu_put_8s(f, &s->fcr);
-    qemu_put_8s(f, &s->st00);
+    qemu_put_byte(f, s->st00);
     qemu_put_8s(f, &s->st01);
 
     qemu_put_8s(f, &s->dac_state);
@@ -1750,7 +1753,7 @@ static void vga_save(QEMUFile *f, void *opaque)
     qemu_put_buffer(f, s->dac_cache, 3);
     qemu_put_buffer(f, s->palette, 768);
 
-    qemu_put_be32s(f, &s->bank_offset);
+    qemu_put_be32(f, s->bank_offset);
 #ifdef CONFIG_BOCHS_VBE
     qemu_put_byte(f, 1);
     qemu_put_be16s(f, &s->vbe_index);
@@ -1785,7 +1788,7 @@ static int vga_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_buffer(f, s->gr, 16);
     qemu_get_8s(f, &s->ar_index);
     qemu_get_buffer(f, s->ar, 21);
-    qemu_get_be32s(f, &s->ar_flip_flop);
+    s->ar_flip_flop=qemu_get_be32(f);
     qemu_get_8s(f, &s->cr_index);
     qemu_get_buffer(f, s->cr, 256);
     qemu_get_8s(f, &s->msr);
@@ -1800,7 +1803,7 @@ static int vga_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_buffer(f, s->dac_cache, 3);
     qemu_get_buffer(f, s->palette, 768);
 
-    qemu_get_be32s(f, &s->bank_offset);
+    s->bank_offset=qemu_get_be32(f);
     is_vbe = qemu_get_byte(f);
 #ifdef CONFIG_BOCHS_VBE
     if (!is_vbe)
diff --git a/hw/vmmouse.c b/hw/vmmouse.c
index 3c4f6671b..0a93b15e6 100644
--- a/hw/vmmouse.c
+++ b/hw/vmmouse.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "console.h"
+#include "ps2.h"
+#include "pc.h"
 
 /* debug only vmmouse */
 //#define DEBUG_VMMOUSE
diff --git a/hw/vmport.c b/hw/vmport.c
index 95f95f4e4..c2253080a 100644
--- a/hw/vmport.c
+++ b/hw/vmport.c
@@ -21,9 +21,13 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
-#include "cpu-all.h"
+
+#include "hw.h"
+#include "isa.h"
+#include "pc.h"
+#include "sysemu.h"
 #include "libkvm.h"
+#include "qemu-kvm.h"
 
 #define VMPORT_CMD_GETVERSION 0x0a
 #define VMPORT_CMD_GETRAMSIZE 0x14
diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
index e850952da..6cae25ce1 100644
--- a/hw/vmware_vga.c
+++ b/hw/vmware_vga.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "console.h"
+#include "pci.h"
 
 #define VERBOSE
 #define EMBED_STDVGA
@@ -1026,41 +1028,41 @@ static CPUWriteMemoryFunc *vmsvga_vram_write[] = {
 
 static void vmsvga_save(struct vmsvga_state_s *s, QEMUFile *f)
 {
-    qemu_put_be32s(f, &s->depth);
-    qemu_put_be32s(f, &s->enable);
-    qemu_put_be32s(f, &s->config);
-    qemu_put_be32s(f, &s->cursor.id);
-    qemu_put_be32s(f, &s->cursor.x);
-    qemu_put_be32s(f, &s->cursor.y);
-    qemu_put_be32s(f, &s->cursor.on);
-    qemu_put_be32s(f, &s->index);
+    qemu_put_be32(f, s->depth);
+    qemu_put_be32(f, s->enable);
+    qemu_put_be32(f, s->config);
+    qemu_put_be32(f, s->cursor.id);
+    qemu_put_be32(f, s->cursor.x);
+    qemu_put_be32(f, s->cursor.y);
+    qemu_put_be32(f, s->cursor.on);
+    qemu_put_be32(f, s->index);
     qemu_put_buffer(f, (uint8_t *) s->scratch, s->scratch_size * 4);
-    qemu_put_be32s(f, &s->new_width);
-    qemu_put_be32s(f, &s->new_height);
+    qemu_put_be32(f, s->new_width);
+    qemu_put_be32(f, s->new_height);
     qemu_put_be32s(f, &s->guest);
     qemu_put_be32s(f, &s->svgaid);
-    qemu_put_be32s(f, &s->syncing);
-    qemu_put_be32s(f, &s->fb_size);
+    qemu_put_be32(f, s->syncing);
+    qemu_put_be32(f, s->fb_size);
 }
 
 static int vmsvga_load(struct vmsvga_state_s *s, QEMUFile *f)
 {
     int depth;
-    qemu_get_be32s(f, &depth);
-    qemu_get_be32s(f, &s->enable);
-    qemu_get_be32s(f, &s->config);
-    qemu_get_be32s(f, &s->cursor.id);
-    qemu_get_be32s(f, &s->cursor.x);
-    qemu_get_be32s(f, &s->cursor.y);
-    qemu_get_be32s(f, &s->cursor.on);
-    qemu_get_be32s(f, &s->index);
+    depth=qemu_get_be32(f);
+    s->enable=qemu_get_be32(f);
+    s->config=qemu_get_be32(f);
+    s->cursor.id=qemu_get_be32(f);
+    s->cursor.x=qemu_get_be32(f);
+    s->cursor.y=qemu_get_be32(f);
+    s->cursor.on=qemu_get_be32(f);
+    s->index=qemu_get_be32(f);
     qemu_get_buffer(f, (uint8_t *) s->scratch, s->scratch_size * 4);
-    qemu_get_be32s(f, &s->new_width);
-    qemu_get_be32s(f, &s->new_height);
+    s->new_width=qemu_get_be32(f);
+    s->new_height=qemu_get_be32(f);
     qemu_get_be32s(f, &s->guest);
     qemu_get_be32s(f, &s->svgaid);
-    qemu_get_be32s(f, &s->syncing);
-    qemu_get_be32s(f, &s->fb_size);
+    s->syncing=qemu_get_be32(f);
+    s->fb_size=qemu_get_be32(f);
 
     if (s->enable && depth != s->depth) {
         printf("%s: need colour depth of %i bits to resume operation.\n",
diff --git a/hw/wm8750.c b/hw/wm8750.c
index b999890ef..8243ca54b 100644
--- a/hw/wm8750.c
+++ b/hw/wm8750.c
@@ -7,7 +7,9 @@
  * This file is licensed under GNU GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "i2c.h"
+#include "audio/audio.h"
 
 #define IN_PORT_N	3
 #define OUT_PORT_N	3
@@ -122,7 +124,7 @@ static const struct wm_rate_s wm_rate_table[] = {
     {  192, 88200,  128, 88200 },	/* SR: 11111 */
 };
 
-void wm8750_set_format(struct wm8750_s *s)
+static void wm8750_set_format(struct wm8750_s *s)
 {
     int i;
     audsettings_t in_fmt;
@@ -192,7 +194,7 @@ void wm8750_set_format(struct wm8750_s *s)
         AUD_set_active_out(*s->out[0], 1);
 }
 
-void inline wm8750_mask_update(struct wm8750_s *s)
+static void inline wm8750_mask_update(struct wm8750_s *s)
 {
 #define R_ONLY	0x0000ffff
 #define L_ONLY	0xffff0000
@@ -594,7 +596,7 @@ i2c_slave *wm8750_init(i2c_bus *bus, AudioState *audio)
     return &s->i2c;
 }
 
-void wm8750_fini(i2c_slave *i2c)
+static void wm8750_fini(i2c_slave *i2c)
 {
     struct wm8750_s *s = (struct wm8750_s *) i2c;
     wm8750_reset(&s->i2c);
diff --git a/i386-dis.c b/i386-dis.c
index 0496e141d..145e14e71 100644
--- a/i386-dis.c
+++ b/i386-dis.c
@@ -1838,29 +1838,6 @@ static char close_char;
 static char separator_char;
 static char scale_char;
 
-/* Here for backwards compatibility.  When gdb stops using
-   print_insn_i386_att and print_insn_i386_intel these functions can
-   disappear, and print_insn_i386 be merged into print_insn.  */
-int
-print_insn_i386_att (pc, info)
-     bfd_vma pc;
-     disassemble_info *info;
-{
-  intel_syntax = 0;
-
-  return print_insn (pc, info);
-}
-
-int
-print_insn_i386_intel (pc, info)
-     bfd_vma pc;
-     disassemble_info *info;
-{
-  intel_syntax = 1;
-
-  return print_insn (pc, info);
-}
-
 int
 print_insn_i386 (pc, info)
      bfd_vma pc;
diff --git a/keymaps.c b/keymaps.c
index f0f8c103d..15c40fadc 100644
--- a/keymaps.c
+++ b/keymaps.c
@@ -32,6 +32,12 @@ static int get_keysym(const char *name)
     return 0;
 }
 
+struct key_range {
+    int start;
+    int end;
+    struct key_range *next;
+};
+
 #define MAX_NORMAL_KEYCODE 512
 #define MAX_EXTRA_COUNT 256
 typedef struct {
@@ -41,8 +47,34 @@ typedef struct {
 	uint16_t keycode;
     } keysym2keycode_extra[MAX_EXTRA_COUNT];
     int extra_count;
+    struct key_range *keypad_range;
+    struct key_range *numlock_range;
 } kbd_layout_t;
 
+static void add_to_key_range(struct key_range **krp, int code) {
+    struct key_range *kr;
+    for (kr = *krp; kr; kr = kr->next) {
+	if (code >= kr->start && code <= kr->end)
+	    break;
+	if (code == kr->start - 1) {
+	    kr->start--;
+	    break;
+	}
+	if (code == kr->end + 1) {
+	    kr->end++;
+	    break;
+	}
+    }
+    if (kr == NULL) {
+	kr = qemu_mallocz(sizeof(*kr));
+	if (kr) {
+	    kr->start = kr->end = code;
+	    kr->next = *krp;
+	    *krp = kr;
+	}
+    }
+}
+
 static kbd_layout_t *parse_keyboard_layout(const char *language,
 					   kbd_layout_t * k)
 {
@@ -87,7 +119,15 @@ static kbd_layout_t *parse_keyboard_layout(const char *language,
                     //		    fprintf(stderr, "Warning: unknown keysym %s\n", line);
 		} else {
 		    const char *rest = end_of_keysym + 1;
-		    int keycode = strtol(rest, NULL, 0);
+		    char *rest2;
+		    int keycode = strtol(rest, &rest2, 0);
+
+		    if (rest && strstr(rest, "numlock")) {
+			add_to_key_range(&k->keypad_range, keycode);
+			add_to_key_range(&k->numlock_range, keysym);
+			//fprintf(stderr, "keypad keysym %04x keycode %d\n", keysym, keycode);
+		    }
+
 		    /* if(keycode&0x80)
 		       keycode=(keycode<<8)^0x80e0; */
 		    if (keysym < MAX_NORMAL_KEYCODE) {
@@ -143,3 +183,25 @@ static int keysym2scancode(void *kbd_layout, int keysym)
     }
     return 0;
 }
+
+static inline int keycode_is_keypad(void *kbd_layout, int keycode)
+{
+    kbd_layout_t *k = kbd_layout;
+    struct key_range *kr;
+
+    for (kr = k->keypad_range; kr; kr = kr->next)
+        if (keycode >= kr->start && keycode <= kr->end)
+            return 1;
+    return 0;
+}
+
+static inline int keysym_is_numlock(void *kbd_layout, int keysym)
+{
+    kbd_layout_t *k = kbd_layout;
+    struct key_range *kr;
+
+    for (kr = k->numlock_range; kr; kr = kr->next)
+        if (keysym >= kr->start && keysym <= kr->end)
+            return 1;
+    return 0;
+}
diff --git a/linux-user/alpha/syscall.h b/linux-user/alpha/syscall.h
index 643581788..394afec56 100644
--- a/linux-user/alpha/syscall.h
+++ b/linux-user/alpha/syscall.h
@@ -2,40 +2,40 @@
 #define __USER_DS	(1)
 
 struct target_pt_regs {
-	target_ulong r0;
-	target_ulong r1;
-	target_ulong r2;
-	target_ulong r3;
-	target_ulong r4;
-	target_ulong r5;
-	target_ulong r6;
-	target_ulong r7;
-	target_ulong r8;
-	target_ulong r19;
-	target_ulong r20;
-	target_ulong r21;
-	target_ulong r22;
-	target_ulong r23;
-	target_ulong r24;
-	target_ulong r25;
-	target_ulong r26;
-	target_ulong r27;
-	target_ulong r28;
-	target_ulong hae;
+	abi_ulong r0;
+	abi_ulong r1;
+	abi_ulong r2;
+	abi_ulong r3;
+	abi_ulong r4;
+	abi_ulong r5;
+	abi_ulong r6;
+	abi_ulong r7;
+	abi_ulong r8;
+	abi_ulong r19;
+	abi_ulong r20;
+	abi_ulong r21;
+	abi_ulong r22;
+	abi_ulong r23;
+	abi_ulong r24;
+	abi_ulong r25;
+	abi_ulong r26;
+	abi_ulong r27;
+	abi_ulong r28;
+	abi_ulong hae;
 /* JRP - These are the values provided to a0-a2 by PALcode */
-	target_ulong trap_a0;
-	target_ulong trap_a1;
-	target_ulong trap_a2;
+	abi_ulong trap_a0;
+	abi_ulong trap_a1;
+	abi_ulong trap_a2;
 /* These are saved by PAL-code: */
-	target_ulong ps;
-	target_ulong pc;
-	target_ulong gp;
-	target_ulong r16;
-	target_ulong r17;
-	target_ulong r18;
+	abi_ulong ps;
+	abi_ulong pc;
+	abi_ulong gp;
+	abi_ulong r16;
+	abi_ulong r17;
+	abi_ulong r18;
 /* Those is needed by qemu to temporary store the user stack pointer */
-        target_ulong usp;
-        target_ulong unique;
+        abi_ulong usp;
+        abi_ulong unique;
 };
 
 #define UNAME_MACHINE "alpha"
diff --git a/linux-user/alpha/target_signal.h b/linux-user/alpha/target_signal.h
index 7618c3e83..2382ffdb6 100644
--- a/linux-user/alpha/target_signal.h
+++ b/linux-user/alpha/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_ulong ss_sp;
-	target_long ss_flags;
-	target_ulong ss_size;
+	abi_ulong ss_sp;
+	abi_long ss_flags;
+	abi_ulong ss_size;
 } target_stack_t;
 
 
@@ -21,7 +21,7 @@ typedef struct target_sigaltstack {
 #define TARGET_MINSIGSTKSZ	4096
 #define TARGET_SIGSTKSZ		16384
 
-static inline target_ulong get_sp_from_cpustate(CPUAlphaState *state)
+static inline abi_ulong get_sp_from_cpustate(CPUAlphaState *state)
 {
     return state->ir[IR_SP];
 }
diff --git a/linux-user/arm/syscall.h b/linux-user/arm/syscall.h
index 1d508f0a3..e7f2e8deb 100644
--- a/linux-user/arm/syscall.h
+++ b/linux-user/arm/syscall.h
@@ -3,7 +3,7 @@
    stack during a system call. */
 
 struct target_pt_regs {
-    target_long uregs[18];
+    abi_long uregs[18];
 };
 
 #define ARM_cpsr	uregs[16]
diff --git a/linux-user/arm/target_signal.h b/linux-user/arm/target_signal.h
index d51816514..2b3281312 100644
--- a/linux-user/arm/target_signal.h
+++ b/linux-user/arm/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_ulong ss_sp;
-	target_long ss_flags;
-	target_ulong ss_size;
+	abi_ulong ss_sp;
+	abi_long ss_flags;
+	abi_ulong ss_size;
 } target_stack_t;
 
 
@@ -21,7 +21,7 @@ typedef struct target_sigaltstack {
 #define TARGET_MINSIGSTKSZ	2048
 #define TARGET_SIGSTKSZ		8192
 
-static inline target_ulong get_sp_from_cpustate(CPUARMState *state)
+static inline abi_ulong get_sp_from_cpustate(CPUARMState *state)
 {
    return state->regs[13];
 }
diff --git a/linux-user/cris/syscall.h b/linux-user/cris/syscall.h
new file mode 100644
index 000000000..8fa7474ff
--- /dev/null
+++ b/linux-user/cris/syscall.h
@@ -0,0 +1,37 @@
+
+#define UNAME_MACHINE "cris"
+
+/* pt_regs not only specifices the format in the user-struct during
+ * ptrace but is also the frame format used in the kernel prologue/epilogues
+ * themselves
+ */
+
+struct target_pt_regs {
+        unsigned long orig_r10;
+        /* pushed by movem r13, [sp] in SAVE_ALL. */
+        unsigned long r0;
+        unsigned long r1;
+        unsigned long r2;
+        unsigned long r3;
+        unsigned long r4;
+        unsigned long r5;
+        unsigned long r6;
+        unsigned long r7;
+        unsigned long r8;
+        unsigned long r9;
+        unsigned long r10;
+        unsigned long r11;
+        unsigned long r12;
+        unsigned long r13;
+        unsigned long acr;
+        unsigned long srs;
+        unsigned long mof;
+        unsigned long spc;
+        unsigned long ccs;
+        unsigned long srp;
+        unsigned long erp; /* This is actually the debugged process' PC */
+        /* For debugging purposes; saved only when needed. */
+        unsigned long exs;
+        unsigned long eda;
+};
+
diff --git a/linux-user/cris/syscall_nr.h b/linux-user/cris/syscall_nr.h
new file mode 100644
index 000000000..108a2ed21
--- /dev/null
+++ b/linux-user/cris/syscall_nr.h
@@ -0,0 +1,291 @@
+/*
+ * This file contains the system call numbers, and stub macros for libc.
+ */
+
+#define TARGET_NR_restart_syscall      0
+#define TARGET_NR_exit		  1
+#define TARGET_NR_fork		  2
+#define TARGET_NR_read		  3
+#define TARGET_NR_write		  4
+#define TARGET_NR_open		  5
+#define TARGET_NR_close		  6
+#define TARGET_NR_waitpid		  7
+#define TARGET_NR_creat		  8
+#define TARGET_NR_link		  9
+#define TARGET_NR_unlink		 10
+#define TARGET_NR_execve		 11
+#define TARGET_NR_chdir		 12
+#define TARGET_NR_time		 13
+#define TARGET_NR_mknod		 14
+#define TARGET_NR_chmod		 15
+#define TARGET_NR_lchown		 16
+#define TARGET_NR_break		 17
+#define TARGET_NR_oldstat		 18
+#define TARGET_NR_lseek		 19
+#define TARGET_NR_getpid		 20
+#define TARGET_NR_mount		 21
+#define TARGET_NR_umount		 22
+#define TARGET_NR_setuid		 23
+#define TARGET_NR_getuid		 24
+#define TARGET_NR_stime		 25
+#define TARGET_NR_ptrace		 26
+#define TARGET_NR_alarm		 27
+#define TARGET_NR_oldfstat		 28
+#define TARGET_NR_pause		 29
+#define TARGET_NR_utime		 30
+#define TARGET_NR_stty		 31
+#define TARGET_NR_gtty		 32
+#define TARGET_NR_access		 33
+#define TARGET_NR_nice		 34
+#define TARGET_NR_ftime		 35
+#define TARGET_NR_sync		 36
+#define TARGET_NR_kill		 37
+#define TARGET_NR_rename		 38
+#define TARGET_NR_mkdir		 39
+#define TARGET_NR_rmdir		 40
+#define TARGET_NR_dup		 41
+#define TARGET_NR_pipe		 42
+#define TARGET_NR_times		 43
+#define TARGET_NR_prof		 44
+#define TARGET_NR_brk		 45
+#define TARGET_NR_setgid		 46
+#define TARGET_NR_getgid		 47
+#define TARGET_NR_signal		 48
+#define TARGET_NR_geteuid		 49
+#define TARGET_NR_getegid		 50
+#define TARGET_NR_acct		 51
+#define TARGET_NR_umount2		 52
+#define TARGET_NR_lock		 53
+#define TARGET_NR_ioctl		 54
+#define TARGET_NR_fcntl		 55
+#define TARGET_NR_mpx		 56
+#define TARGET_NR_setpgid		 57
+#define TARGET_NR_ulimit		 58
+#define TARGET_NR_oldolduname	 59
+#define TARGET_NR_umask		 60
+#define TARGET_NR_chroot		 61
+#define TARGET_NR_ustat		 62
+#define TARGET_NR_dup2		 63
+#define TARGET_NR_getppid		 64
+#define TARGET_NR_getpgrp		 65
+#define TARGET_NR_setsid		 66
+#define TARGET_NR_sigaction		 67
+#define TARGET_NR_sgetmask		 68
+#define TARGET_NR_ssetmask		 69
+#define TARGET_NR_setreuid		 70
+#define TARGET_NR_setregid		 71
+#define TARGET_NR_sigsuspend		 72
+#define TARGET_NR_sigpending		 73
+#define TARGET_NR_sethostname	 74
+#define TARGET_NR_setrlimit		 75
+#define TARGET_NR_getrlimit		 76
+#define TARGET_NR_getrusage		 77
+#define TARGET_NR_gettimeofday	 78
+#define TARGET_NR_settimeofday	 79
+#define TARGET_NR_getgroups		 80
+#define TARGET_NR_setgroups		 81
+#define TARGET_NR_select		 82
+#define TARGET_NR_symlink		 83
+#define TARGET_NR_oldlstat		 84
+#define TARGET_NR_readlink		 85
+#define TARGET_NR_uselib		 86
+#define TARGET_NR_swapon		 87
+#define TARGET_NR_reboot		 88
+#define TARGET_NR_readdir		 89
+#define TARGET_NR_mmap		 90
+#define TARGET_NR_munmap		 91
+#define TARGET_NR_truncate		 92
+#define TARGET_NR_ftruncate		 93
+#define TARGET_NR_fchmod		 94
+#define TARGET_NR_fchown		 95
+#define TARGET_NR_getpriority	 96
+#define TARGET_NR_setpriority	 97
+#define TARGET_NR_profil		 98
+#define TARGET_NR_statfs		 99
+#define TARGET_NR_fstatfs		100
+#define TARGET_NR_ioperm		101
+#define TARGET_NR_socketcall		102
+#define TARGET_NR_syslog		103
+#define TARGET_NR_setitimer		104
+#define TARGET_NR_getitimer		105
+#define TARGET_NR_stat		106
+#define TARGET_NR_lstat		107
+#define TARGET_NR_fstat		108
+#define TARGET_NR_olduname		109
+#define TARGET_NR_iopl		110
+#define TARGET_NR_vhangup		111
+#define TARGET_NR_idle		112
+#define TARGET_NR_vm86		113
+#define TARGET_NR_wait4		114
+#define TARGET_NR_swapoff		115
+#define TARGET_NR_sysinfo		116
+#define TARGET_NR_ipc		117
+#define TARGET_NR_fsync		118
+#define TARGET_NR_sigreturn		119
+#define TARGET_NR_clone		120
+#define TARGET_NR_setdomainname	121
+#define TARGET_NR_uname		122
+#define TARGET_NR_modify_ldt		123
+#define TARGET_NR_adjtimex		124
+#define TARGET_NR_mprotect		125
+#define TARGET_NR_sigprocmask	126
+#define TARGET_NR_create_module	127
+#define TARGET_NR_init_module	128
+#define TARGET_NR_delete_module	129
+#define TARGET_NR_get_kernel_syms	130
+#define TARGET_NR_quotactl		131
+#define TARGET_NR_getpgid		132
+#define TARGET_NR_fchdir		133
+#define TARGET_NR_bdflush		134
+#define TARGET_NR_sysfs		135
+#define TARGET_NR_personality	136
+#define TARGET_NR_afs_syscall	137 /* Syscall for Andrew File System */
+#define TARGET_NR_setfsuid		138
+#define TARGET_NR_setfsgid		139
+#define TARGET_NR__llseek		140
+#define TARGET_NR_getdents		141
+#define TARGET_NR__newselect		142
+#define TARGET_NR_flock		143
+#define TARGET_NR_msync		144
+#define TARGET_NR_readv		145
+#define TARGET_NR_writev		146
+#define TARGET_NR_getsid		147
+#define TARGET_NR_fdatasync		148
+#define TARGET_NR__sysctl		149
+#define TARGET_NR_mlock		150
+#define TARGET_NR_munlock		151
+#define TARGET_NR_mlockall		152
+#define TARGET_NR_munlockall		153
+#define TARGET_NR_sched_setparam		154
+#define TARGET_NR_sched_getparam		155
+#define TARGET_NR_sched_setscheduler		156
+#define TARGET_NR_sched_getscheduler		157
+#define TARGET_NR_sched_yield		158
+#define TARGET_NR_sched_get_priority_max	159
+#define TARGET_NR_sched_get_priority_min	160
+#define TARGET_NR_sched_rr_get_interval	161
+#define TARGET_NR_nanosleep		162
+#define TARGET_NR_mremap		163
+#define TARGET_NR_setresuid		164
+#define TARGET_NR_getresuid		165
+
+#define TARGET_NR_query_module	167
+#define TARGET_NR_poll		168
+#define TARGET_NR_nfsservctl		169
+#define TARGET_NR_setresgid		170
+#define TARGET_NR_getresgid		171
+#define TARGET_NR_prctl              172
+#define TARGET_NR_rt_sigreturn	173
+#define TARGET_NR_rt_sigaction	174
+#define TARGET_NR_rt_sigprocmask	175
+#define TARGET_NR_rt_sigpending	176
+#define TARGET_NR_rt_sigtimedwait	177
+#define TARGET_NR_rt_sigqueueinfo	178
+#define TARGET_NR_rt_sigsuspend	179
+#define TARGET_NR_pread64		180
+#define TARGET_NR_pwrite64		181
+#define TARGET_NR_chown		182
+#define TARGET_NR_getcwd		183
+#define TARGET_NR_capget		184
+#define TARGET_NR_capset		185
+#define TARGET_NR_sigaltstack	186
+#define TARGET_NR_sendfile		187
+#define TARGET_NR_getpmsg		188	/* some people actually want streams */
+#define TARGET_NR_putpmsg		189	/* some people actually want streams */
+#define TARGET_NR_vfork		190
+#define TARGET_NR_ugetrlimit		191	/* SuS compliant getrlimit */
+#define TARGET_NR_mmap2		192
+#define TARGET_NR_truncate64		193
+#define TARGET_NR_ftruncate64	194
+#define TARGET_NR_stat64		195
+#define TARGET_NR_lstat64		196
+#define TARGET_NR_fstat64		197
+#define TARGET_NR_lchown32		198
+#define TARGET_NR_getuid32		199
+#define TARGET_NR_getgid32		200
+#define TARGET_NR_geteuid32		201
+#define TARGET_NR_getegid32		202
+#define TARGET_NR_setreuid32		203
+#define TARGET_NR_setregid32		204
+#define TARGET_NR_getgroups32	205
+#define TARGET_NR_setgroups32	206
+#define TARGET_NR_fchown32		207
+#define TARGET_NR_setresuid32	208
+#define TARGET_NR_getresuid32	209
+#define TARGET_NR_setresgid32	210
+#define TARGET_NR_getresgid32	211
+#define TARGET_NR_chown32		212
+#define TARGET_NR_setuid32		213
+#define TARGET_NR_setgid32		214
+#define TARGET_NR_setfsuid32		215
+#define TARGET_NR_setfsgid32		216
+#define TARGET_NR_pivot_root		217
+#define TARGET_NR_mincore		218
+#define TARGET_NR_madvise		219
+#define TARGET_NR_getdents64		220
+#define TARGET_NR_fcntl64		221
+/* 223 is unused */
+#define TARGET_NR_gettid             224
+#define TARGET_NR_readahead          225
+#define TARGET_NR_setxattr		226
+#define TARGET_NR_lsetxattr		227
+#define TARGET_NR_fsetxattr		228
+#define TARGET_NR_getxattr		229
+#define TARGET_NR_lgetxattr		230
+#define TARGET_NR_fgetxattr		231
+#define TARGET_NR_listxattr		232
+#define TARGET_NR_llistxattr		233
+#define TARGET_NR_flistxattr		234
+#define TARGET_NR_removexattr	235
+#define TARGET_NR_lremovexattr	236
+#define TARGET_NR_fremovexattr	237
+#define TARGET_NR_tkill		238
+#define TARGET_NR_sendfile64		239
+#define TARGET_NR_futex		240
+#define TARGET_NR_sched_setaffinity	241
+#define TARGET_NR_sched_getaffinity	242
+#define TARGET_NR_set_thread_area	243
+#define TARGET_NR_get_thread_area	244
+#define TARGET_NR_io_setup		245
+#define TARGET_NR_io_destroy		246
+#define TARGET_NR_io_getevents	247
+#define TARGET_NR_io_submit		248
+#define TARGET_NR_io_cancel		249
+#define TARGET_NR_fadvise64		250
+#define TARGET_NR_exit_group		252
+#define TARGET_NR_lookup_dcookie	253
+#define TARGET_NR_epoll_create	254
+#define TARGET_NR_epoll_ctl		255
+#define TARGET_NR_epoll_wait		256
+#define TARGET_NR_remap_file_pages	257
+#define TARGET_NR_set_tid_address	258
+#define TARGET_NR_timer_create	259
+#define TARGET_NR_timer_settime	(TARGET_NR_timer_create+1)
+#define TARGET_NR_timer_gettime	(TARGET_NR_timer_create+2)
+#define TARGET_NR_timer_getoverrun	(TARGET_NR_timer_create+3)
+#define TARGET_NR_timer_delete	(TARGET_NR_timer_create+4)
+#define TARGET_NR_clock_settime	(TARGET_NR_timer_create+5)
+#define TARGET_NR_clock_gettime	(TARGET_NR_timer_create+6)
+#define TARGET_NR_clock_getres	(TARGET_NR_timer_create+7)
+#define TARGET_NR_clock_nanosleep	(TARGET_NR_timer_create+8)
+#define TARGET_NR_statfs64		268
+#define TARGET_NR_fstatfs64		269
+#define TARGET_NR_tgkill		270
+#define TARGET_NR_utimes		271
+#define TARGET_NR_fadvise64_64	272
+#define TARGET_NR_vserver		273
+#define TARGET_NR_mbind		274
+#define TARGET_NR_get_mempolicy	275
+#define TARGET_NR_set_mempolicy	276
+#define TARGET_NR_mq_open 		277
+#define TARGET_NR_mq_unlink		(TARGET_NR_mq_open+1)
+#define TARGET_NR_mq_timedsend	(TARGET_NR_mq_open+2)
+#define TARGET_NR_mq_timedreceive	(TARGET_NR_mq_open+3)
+#define TARGET_NR_mq_notify		(TARGET_NR_mq_open+4)
+#define TARGET_NR_mq_getsetattr	(TARGET_NR_mq_open+5)
+#define TARGET_NR_kexec_load		283
+#define TARGET_NR_waitid		284
+/* #define TARGET_NR_sys_setaltroot	285 */
+#define TARGET_NR_add_key		286
+#define TARGET_NR_request_key	287
+#define TARGET_NR_keyctl		288
diff --git a/linux-user/ppc64/target_signal.h b/linux-user/cris/target_signal.h
index 80ad21187..5611840f8 100644
--- a/linux-user/ppc64/target_signal.h
+++ b/linux-user/cris/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_ulong ss_sp;
-	target_long ss_flags;
-	target_ulong ss_size;
+	abi_ulong ss_sp;
+	abi_ulong ss_size;
+	abi_long ss_flags;
 } target_stack_t;
 
 
@@ -21,9 +21,9 @@ typedef struct target_sigaltstack {
 #define TARGET_MINSIGSTKSZ    2048
 #define TARGET_SIGSTKSZ       8192
 
-static inline target_ulong get_sp_from_cpustate(CPUPPCState *state)
+static inline abi_ulong get_sp_from_cpustate(CPUCRISState *state)
 {
-    return state->gpr[1];
+    return state->regs[14];
 }
 
 #endif /* TARGET_SIGNAL_H */
diff --git a/linux-user/cris/termbits.h b/linux-user/cris/termbits.h
new file mode 100644
index 000000000..adff80243
--- /dev/null
+++ b/linux-user/cris/termbits.h
@@ -0,0 +1,214 @@
+/* from asm/termbits.h */
+
+#define TARGET_NCCS 19
+
+struct target_termios {
+    unsigned int c_iflag;               /* input mode flags */
+    unsigned int c_oflag;               /* output mode flags */
+    unsigned int c_cflag;               /* control mode flags */
+    unsigned int c_lflag;               /* local mode flags */
+    unsigned char c_line;                    /* line discipline */
+    unsigned char c_cc[TARGET_NCCS];                /* control characters */
+};
+
+/* c_iflag bits */
+#define TARGET_IGNBRK  0000001
+#define TARGET_BRKINT  0000002
+#define TARGET_IGNPAR  0000004
+#define TARGET_PARMRK  0000010
+#define TARGET_INPCK   0000020
+#define TARGET_ISTRIP  0000040
+#define TARGET_INLCR   0000100
+#define TARGET_IGNCR   0000200
+#define TARGET_ICRNL   0000400
+#define TARGET_IUCLC   0001000
+#define TARGET_IXON    0002000
+#define TARGET_IXANY   0004000
+#define TARGET_IXOFF   0010000
+#define TARGET_IMAXBEL 0020000
+
+/* c_oflag bits */
+#define TARGET_OPOST   0000001
+#define TARGET_OLCUC   0000002
+#define TARGET_ONLCR   0000004
+#define TARGET_OCRNL   0000010
+#define TARGET_ONOCR   0000020
+#define TARGET_ONLRET  0000040
+#define TARGET_OFILL   0000100
+#define TARGET_OFDEL   0000200
+#define TARGET_NLDLY   0000400
+#define   TARGET_NL0   0000000
+#define   TARGET_NL1   0000400
+#define TARGET_CRDLY   0003000
+#define   TARGET_CR0   0000000
+#define   TARGET_CR1   0001000
+#define   TARGET_CR2   0002000
+#define   TARGET_CR3   0003000
+#define TARGET_TABDLY  0014000
+#define   TARGET_TAB0  0000000
+#define   TARGET_TAB1  0004000
+#define   TARGET_TAB2  0010000
+#define   TARGET_TAB3  0014000
+#define   TARGET_XTABS 0014000
+#define TARGET_BSDLY   0020000
+#define   TARGET_BS0   0000000
+#define   TARGET_BS1   0020000
+#define TARGET_VTDLY   0040000
+#define   TARGET_VT0   0000000
+#define   TARGET_VT1   0040000
+#define TARGET_FFDLY   0100000
+#define   TARGET_FF0   0000000
+#define   TARGET_FF1   0100000
+
+/* c_cflag bit meaning */
+#define TARGET_CBAUD   0010017
+#define  TARGET_B0     0000000         /* hang up */
+#define  TARGET_B50    0000001
+#define  TARGET_B75    0000002
+#define  TARGET_B110   0000003
+#define  TARGET_B134   0000004
+#define  TARGET_B150   0000005
+#define  TARGET_B200   0000006
+#define  TARGET_B300   0000007
+#define  TARGET_B600   0000010
+#define  TARGET_B1200  0000011
+#define  TARGET_B1800  0000012
+#define  TARGET_B2400  0000013
+#define  TARGET_B4800  0000014
+#define  TARGET_B9600  0000015
+#define  TARGET_B19200 0000016
+#define  TARGET_B38400 0000017
+#define TARGET_EXTA B19200
+#define TARGET_EXTB B38400
+#define TARGET_CSIZE   0000060
+#define   TARGET_CS5   0000000
+#define   TARGET_CS6   0000020
+#define   TARGET_CS7   0000040
+#define   TARGET_CS8   0000060
+#define TARGET_CSTOPB  0000100
+#define TARGET_CREAD   0000200
+#define TARGET_PARENB  0000400
+#define TARGET_PARODD  0001000
+#define TARGET_HUPCL   0002000
+#define TARGET_CLOCAL  0004000
+#define TARGET_CBAUDEX 0010000
+#define  TARGET_B57600  0010001
+#define  TARGET_B115200 0010002
+#define  TARGET_B230400 0010003
+#define  TARGET_B460800 0010004
+#define TARGET_CIBAUD    002003600000  /* input baud rate (not used) */
+#define TARGET_CRTSCTS   020000000000          /* flow control */
+
+/* c_lflag bits */
+#define TARGET_ISIG    0000001
+#define TARGET_ICANON  0000002
+#define TARGET_XCASE   0000004
+#define TARGET_ECHO    0000010
+#define TARGET_ECHOE   0000020
+#define TARGET_ECHOK   0000040
+#define TARGET_ECHONL  0000100
+#define TARGET_NOFLSH  0000200
+#define TARGET_TOSTOP  0000400
+#define TARGET_ECHOCTL 0001000
+#define TARGET_ECHOPRT 0002000
+#define TARGET_ECHOKE  0004000
+#define TARGET_FLUSHO  0010000
+#define TARGET_PENDIN  0040000
+#define TARGET_IEXTEN  0100000
+
+/* c_cc character offsets */
+#define TARGET_VINTR	0
+#define TARGET_VQUIT	1
+#define TARGET_VERASE	2
+#define TARGET_VKILL	3
+#define TARGET_VEOF	4
+#define TARGET_VTIME	5
+#define TARGET_VMIN	6
+#define TARGET_VSWTC	7
+#define TARGET_VSTART	8
+#define TARGET_VSTOP	9
+#define TARGET_VSUSP	10
+#define TARGET_VEOL	11
+#define TARGET_VREPRINT	12
+#define TARGET_VDISCARD	13
+#define TARGET_VWERASE	14
+#define TARGET_VLNEXT	15
+#define TARGET_VEOL2	16
+
+/* ioctls */
+
+#define TARGET_TCGETS		0x5401
+#define TARGET_TCSETS		0x5402
+#define TARGET_TCSETSW		0x5403
+#define TARGET_TCSETSF		0x5404
+#define TARGET_TCGETA		0x5405
+#define TARGET_TCSETA		0x5406
+#define TARGET_TCSETAW		0x5407
+#define TARGET_TCSETAF		0x5408
+#define TARGET_TCSBRK		0x5409
+#define TARGET_TCXONC		0x540A
+#define TARGET_TCFLSH		0x540B
+
+#define TARGET_TIOCEXCL	0x540C
+#define TARGET_TIOCNXCL	0x540D
+#define TARGET_TIOCSCTTY	0x540E
+#define TARGET_TIOCGPGRP	0x540F
+#define TARGET_TIOCSPGRP	0x5410
+#define TARGET_TIOCOUTQ	0x5411
+#define TARGET_TIOCSTI		0x5412
+#define TARGET_TIOCGWINSZ	0x5413
+#define TARGET_TIOCSWINSZ	0x5414
+#define TARGET_TIOCMGET	0x5415
+#define TARGET_TIOCMBIS	0x5416
+#define TARGET_TIOCMBIC	0x5417
+#define TARGET_TIOCMSET	0x5418
+#define TARGET_TIOCGSOFTCAR	0x5419
+#define TARGET_TIOCSSOFTCAR	0x541A
+#define TARGET_FIONREAD	0x541B
+#define TARGET_TIOCINQ		TARGET_FIONREAD
+#define TARGET_TIOCLINUX	0x541C
+#define TARGET_TIOCCONS	0x541D
+#define TARGET_TIOCGSERIAL	0x541E
+#define TARGET_TIOCSSERIAL	0x541F
+#define TARGET_TIOCPKT		0x5420
+#define TARGET_FIONBIO		0x5421
+#define TARGET_TIOCNOTTY	0x5422
+#define TARGET_TIOCSETD	0x5423
+#define TARGET_TIOCGETD	0x5424
+#define TARGET_TCSBRKP		0x5425	/* Needed for POSIX tcsendbreak() */
+#define TARGET_TIOCTTYGSTRUCT	0x5426  /* For debugging only */
+#define TARGET_TIOCSBRK	0x5427  /* BSD compatibility */
+#define TARGET_TIOCCBRK	0x5428  /* BSD compatibility */
+#define TARGET_TIOCGSID	0x5429  /* Return the session ID of FD */
+#define TARGET_TIOCGPTN	TARGET_IOR('T',0x30, unsigned int) /* Get Pty Number (of pty-mux device) */
+#define TARGET_TIOCSPTLCK	TARGET_IOW('T',0x31, int)  /* Lock/unlock Pty */
+
+#define TARGET_FIONCLEX	0x5450  /* these numbers need to be adjusted. */
+#define TARGET_FIOCLEX		0x5451
+#define TARGET_FIOASYNC	0x5452
+#define TARGET_TIOCSERCONFIG	0x5453
+#define TARGET_TIOCSERGWILD	0x5454
+#define TARGET_TIOCSERSWILD	0x5455
+#define TARGET_TIOCGLCKTRMIOS	0x5456
+#define TARGET_TIOCSLCKTRMIOS	0x5457
+#define TARGET_TIOCSERGSTRUCT	0x5458 /* For debugging only */
+#define TARGET_TIOCSERGETLSR   0x5459 /* Get line status register */
+#define TARGET_TIOCSERGETMULTI 0x545A /* Get multiport config  */
+#define TARGET_TIOCSERSETMULTI 0x545B /* Set multiport config */
+
+#define TARGET_TIOCMIWAIT	0x545C	/* wait for a change on serial input line(s) */
+#define TARGET_TIOCGICOUNT	0x545D	/* read serial port inline interrupt counts */
+#define TARGET_TIOCGHAYESESP   0x545E  /* Get Hayes ESP configuration */
+#define TARGET_TIOCSHAYESESP   0x545F  /* Set Hayes ESP configuration */
+
+/* Used for packet mode */
+#define TARGET_TIOCPKT_DATA		 0
+#define TARGET_TIOCPKT_FLUSHREAD	 1
+#define TARGET_TIOCPKT_FLUSHWRITE	 2
+#define TARGET_TIOCPKT_STOP		 4
+#define TARGET_TIOCPKT_START		 8
+#define TARGET_TIOCPKT_NOSTOP		16
+#define TARGET_TIOCPKT_DOSTOP		32
+
+#define TARGET_TIOCSER_TEMT    0x01	/* Transmitter physically empty */
+
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 22e3283ae..cde3c49a7 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -12,6 +12,66 @@
 #include "qemu.h"
 #include "disas.h"
 
+/* from personality.h */
+
+/*
+ * Flags for bug emulation.
+ *
+ * These occupy the top three bytes.
+ */
+enum {
+	ADDR_NO_RANDOMIZE = 	0x0040000,	/* disable randomization of VA space */
+	FDPIC_FUNCPTRS =	0x0080000,	/* userspace function ptrs point to descriptors
+						 * (signal handling)
+						 */
+	MMAP_PAGE_ZERO =	0x0100000,
+	ADDR_COMPAT_LAYOUT =	0x0200000,
+	READ_IMPLIES_EXEC =	0x0400000,
+	ADDR_LIMIT_32BIT =	0x0800000,
+	SHORT_INODE =		0x1000000,
+	WHOLE_SECONDS =		0x2000000,
+	STICKY_TIMEOUTS	=	0x4000000,
+	ADDR_LIMIT_3GB = 	0x8000000,
+};
+
+/*
+ * Personality types.
+ *
+ * These go in the low byte.  Avoid using the top bit, it will
+ * conflict with error returns.
+ */
+enum {
+	PER_LINUX =		0x0000,
+	PER_LINUX_32BIT =	0x0000 | ADDR_LIMIT_32BIT,
+	PER_LINUX_FDPIC =	0x0000 | FDPIC_FUNCPTRS,
+	PER_SVR4 =		0x0001 | STICKY_TIMEOUTS | MMAP_PAGE_ZERO,
+	PER_SVR3 =		0x0002 | STICKY_TIMEOUTS | SHORT_INODE,
+	PER_SCOSVR3 =		0x0003 | STICKY_TIMEOUTS |
+					 WHOLE_SECONDS | SHORT_INODE,
+	PER_OSR5 =		0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS,
+	PER_WYSEV386 =		0x0004 | STICKY_TIMEOUTS | SHORT_INODE,
+	PER_ISCR4 =		0x0005 | STICKY_TIMEOUTS,
+	PER_BSD =		0x0006,
+	PER_SUNOS =		0x0006 | STICKY_TIMEOUTS,
+	PER_XENIX =		0x0007 | STICKY_TIMEOUTS | SHORT_INODE,
+	PER_LINUX32 =		0x0008,
+	PER_LINUX32_3GB =	0x0008 | ADDR_LIMIT_3GB,
+	PER_IRIX32 =		0x0009 | STICKY_TIMEOUTS,/* IRIX5 32-bit */
+	PER_IRIXN32 =		0x000a | STICKY_TIMEOUTS,/* IRIX6 new 32-bit */
+	PER_IRIX64 =		0x000b | STICKY_TIMEOUTS,/* IRIX6 64-bit */
+	PER_RISCOS =		0x000c,
+	PER_SOLARIS =		0x000d | STICKY_TIMEOUTS,
+	PER_UW7 =		0x000e | STICKY_TIMEOUTS | MMAP_PAGE_ZERO,
+	PER_OSF4 =		0x000f,			 /* OSF/1 v4 */
+	PER_HPUX =		0x0010,
+	PER_MASK =		0x00ff,
+};
+
+/*
+ * Return the base personality without flags.
+ */
+#define personality(pers)	(pers & PER_MASK)
+
 /* this flag is uneffective under linux too, should be deleted */
 #ifndef MAP_DENYWRITE
 #define MAP_DENYWRITE 0
@@ -112,18 +172,20 @@ static inline void init_thread(struct target_pt_regs *regs, struct image_info *i
 
 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
 {
-    target_long stack = infop->start_stack;
+    abi_long stack = infop->start_stack;
     memset(regs, 0, sizeof(*regs));
     regs->ARM_cpsr = 0x10;
     if (infop->entry & 1)
       regs->ARM_cpsr |= CPSR_T;
     regs->ARM_pc = infop->entry & 0xfffffffe;
     regs->ARM_sp = infop->start_stack;
-    regs->ARM_r2 = tgetl(stack + 8); /* envp */
-    regs->ARM_r1 = tgetl(stack + 4); /* envp */
+    /* FIXME - what to for failure of get_user()? */
+    get_user_ual(regs->ARM_r2, stack + 8); /* envp */
+    get_user_ual(regs->ARM_r1, stack + 4); /* envp */
     /* XXX: it seems that r0 is zeroed after ! */
     regs->ARM_r0 = 0;
     /* For uClinux PIC binaries.  */
+    /* XXX: Linux does this only on ARM with no MMU (do we care ?) */
     regs->ARM_r10 = infop->start_data;
 }
 
@@ -153,7 +215,11 @@ enum
 
 #define ELF_START_MMAP 0x80000000
 
-#define elf_check_arch(x) ( (x) == EM_SPARCV9 )
+#ifndef TARGET_ABI32
+#define elf_check_arch(x) ( (x) == EM_SPARCV9 || (x) == EM_SPARC32PLUS )
+#else
+#define elf_check_arch(x) ( (x) == EM_SPARC32PLUS || (x) == EM_SPARC )
+#endif
 
 #define ELF_CLASS   ELFCLASS64
 #define ELF_DATA    ELFDATA2MSB
@@ -163,11 +229,20 @@ enum
 
 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
 {
+#ifndef TARGET_ABI32
     regs->tstate = 0;
+#endif
     regs->pc = infop->entry;
     regs->npc = regs->pc + 4;
     regs->y = 0;
-    regs->u_regs[14] = infop->start_stack - 16 * 8 - STACK_BIAS;
+#ifdef TARGET_ABI32
+    regs->u_regs[14] = infop->start_stack - 16 * 4;
+#else
+    if (personality(infop->personality) == PER_LINUX32)
+        regs->u_regs[14] = infop->start_stack - 16 * 4;
+    else
+        regs->u_regs[14] = infop->start_stack - 16 * 8 - STACK_BIAS;
+#endif
 }
 
 #else
@@ -195,7 +270,7 @@ static inline void init_thread(struct target_pt_regs *regs, struct image_info *i
 
 #define ELF_START_MMAP 0x80000000
 
-#ifdef TARGET_PPC64
+#if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
 
 #define elf_check_arch(x) ( (x) == EM_PPC64 )
 
@@ -249,15 +324,14 @@ do {                                                                    \
 
 static inline void init_thread(struct target_pt_regs *_regs, struct image_info *infop)
 {
-    target_ulong pos = infop->start_stack;
-    target_ulong tmp;
-#ifdef TARGET_PPC64
-    target_ulong entry, toc;
+    abi_ulong pos = infop->start_stack;
+    abi_ulong tmp;
+#if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
+    abi_ulong entry, toc;
 #endif
 
-    _regs->msr = 1 << MSR_PR; /* Set user mode */
     _regs->gpr[1] = infop->start_stack;
-#ifdef TARGET_PPC64
+#if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
     entry = ldq_raw(infop->entry) + infop->load_addr;
     toc = ldq_raw(infop->entry + 8) + infop->load_addr;
     _regs->gpr[2] = toc;
@@ -268,10 +342,11 @@ static inline void init_thread(struct target_pt_regs *_regs, struct image_info *
      * but this is what the ABI wants and is needed to allow
      * execution of PPC BSD programs.
      */
-    _regs->gpr[3] = tgetl(pos);
-    pos += sizeof(target_ulong);
+    /* FIXME - what to for failure of get_user()? */
+    get_user_ual(_regs->gpr[3], pos);
+    pos += sizeof(abi_ulong);
     _regs->gpr[4] = pos;
-    for (tmp = 1; tmp != 0; pos += sizeof(target_ulong))
+    for (tmp = 1; tmp != 0; pos += sizeof(abi_ulong))
         tmp = ldl(pos);
     _regs->gpr[5] = pos;
 }
@@ -301,7 +376,7 @@ static inline void init_thread(struct target_pt_regs *_regs, struct image_info *
 
 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
 {
-    regs->cp0_status = CP0St_UM;
+    regs->cp0_status = 2 << CP0St_KSU;
     regs->cp0_epc = infop->entry;
     regs->regs[29] = infop->start_stack;
 }
@@ -333,6 +408,26 @@ static inline void init_thread(struct target_pt_regs *regs, struct image_info *i
 
 #endif
 
+#ifdef TARGET_CRIS
+
+#define ELF_START_MMAP 0x80000000
+
+#define elf_check_arch(x) ( (x) == EM_CRIS )
+
+#define ELF_CLASS ELFCLASS32
+#define ELF_DATA  ELFDATA2LSB
+#define ELF_ARCH  EM_CRIS
+
+static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
+{
+  regs->erp = infop->entry;
+}
+
+#define USE_ELF_CORE_DUMP
+#define ELF_EXEC_PAGESIZE        8192
+
+#endif
+
 #ifdef TARGET_M68K
 
 #define ELF_START_MMAP 0x80000000
@@ -391,6 +486,13 @@ static inline void init_thread(struct target_pt_regs *regs, struct image_info *i
 #define ELF_HWCAP 0
 #endif
 
+#ifdef TARGET_ABI32
+#undef ELF_CLASS
+#define ELF_CLASS ELFCLASS32
+#undef bswaptls
+#define bswaptls(ptr) bswap32s(ptr)
+#endif
+
 #include "elf.h"
 
 struct exec
@@ -418,25 +520,6 @@ struct exec
 /* max code+data+bss+brk space allocated to ET_DYN executables */
 #define ET_DYN_MAP_SIZE (128 * 1024 * 1024)
 
-/* from personality.h */
-
-/* Flags for bug emulation. These occupy the top three bytes. */
-#define STICKY_TIMEOUTS		0x4000000
-#define WHOLE_SECONDS		0x2000000
-
-/* Personality types. These go in the low byte. Avoid using the top bit,
- * it will conflict with error returns.
- */
-#define PER_MASK		(0x00ff)
-#define PER_LINUX		(0x0000)
-#define PER_SVR4		(0x0001 | STICKY_TIMEOUTS)
-#define PER_SVR3		(0x0002 | STICKY_TIMEOUTS)
-#define PER_SCOSVR3		(0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS)
-#define PER_WYSEV386		(0x0004 | STICKY_TIMEOUTS)
-#define PER_ISCR4		(0x0005 | STICKY_TIMEOUTS)
-#define PER_BSD			(0x0006)
-#define PER_XENIX		(0x0007 | STICKY_TIMEOUTS)
-
 /* Necessary parameters */
 #define TARGET_ELF_EXEC_PAGESIZE TARGET_PAGE_SIZE
 #define TARGET_ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(TARGET_ELF_EXEC_PAGESIZE-1))
@@ -516,8 +599,8 @@ static void bswap_sym(struct elf_sym *sym)
  * to be put directly into the top of new user memory.
  *
  */
-static unsigned long copy_elf_strings(int argc,char ** argv, void **page,
-                                      target_ulong p)
+static abi_ulong copy_elf_strings(int argc,char ** argv, void **page,
+                                  abi_ulong p)
 {
     char *tmp, *tmp1, *pag = NULL;
     int len, offset = 0;
@@ -566,10 +649,10 @@ static unsigned long copy_elf_strings(int argc,char ** argv, void **page,
     return p;
 }
 
-unsigned long setup_arg_pages(target_ulong p, struct linux_binprm * bprm,
-					      struct image_info * info)
+static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm,
+                                 struct image_info *info)
 {
-    target_ulong stack_base, size, error;
+    abi_ulong stack_base, size, error;
     int i;
 
     /* Create enough stack to hold everything.  If we don't use
@@ -596,7 +679,7 @@ unsigned long setup_arg_pages(target_ulong p, struct linux_binprm * bprm,
     for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
 	if (bprm->page[i]) {
 	    info->rss++;
-
+            /* FIXME - check return value of memcpy_to_target() for failure */
 	    memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE);
 	    free(bprm->page[i]);
 	}
@@ -605,7 +688,7 @@ unsigned long setup_arg_pages(target_ulong p, struct linux_binprm * bprm,
     return p;
 }
 
-static void set_brk(unsigned long start, unsigned long end)
+static void set_brk(abi_ulong start, abi_ulong end)
 {
 	/* page-align the start and end addresses... */
         start = HOST_PAGE_ALIGN(start);
@@ -624,9 +707,9 @@ static void set_brk(unsigned long start, unsigned long end)
 /* We need to explicitly zero any fractional pages after the data
    section (i.e. bss).  This would contain the junk from the file that
    should not be in memory. */
-static void padzero(unsigned long elf_bss, unsigned long last_bss)
+static void padzero(abi_ulong elf_bss, abi_ulong last_bss)
 {
-        unsigned long nbyte;
+        abi_ulong nbyte;
 
 	if (elf_bss >= last_bss)
 		return;
@@ -637,12 +720,12 @@ static void padzero(unsigned long elf_bss, unsigned long last_bss)
            patch target_mmap(), but it is more complicated as the file
            size must be known */
         if (qemu_real_host_page_size < qemu_host_page_size) {
-            unsigned long end_addr, end_addr1;
+            abi_ulong end_addr, end_addr1;
             end_addr1 = (elf_bss + qemu_real_host_page_size - 1) &
                 ~(qemu_real_host_page_size - 1);
             end_addr = HOST_PAGE_ALIGN(elf_bss);
             if (end_addr1 < end_addr) {
-                mmap((void *)end_addr1, end_addr - end_addr1,
+                mmap((void *)g2h(end_addr1), end_addr - end_addr1,
                      PROT_READ|PROT_WRITE|PROT_EXEC,
                      MAP_FIXED|MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
             }
@@ -652,25 +735,26 @@ static void padzero(unsigned long elf_bss, unsigned long last_bss)
         if (nbyte) {
 	    nbyte = qemu_host_page_size - nbyte;
 	    do {
-		tput8(elf_bss, 0);
+                /* FIXME - what to do if put_user() fails? */
+		put_user_u8(0, elf_bss);
                 elf_bss++;
 	    } while (--nbyte);
         }
 }
 
 
-static unsigned long create_elf_tables(target_ulong p, int argc, int envc,
-                                       struct elfhdr * exec,
-                                       unsigned long load_addr,
-                                       unsigned long load_bias,
-                                       unsigned long interp_load_addr, int ibcs,
-                                       struct image_info *info)
+static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
+                                   struct elfhdr * exec,
+                                   abi_ulong load_addr,
+                                   abi_ulong load_bias,
+                                   abi_ulong interp_load_addr, int ibcs,
+                                   struct image_info *info)
 {
-        target_ulong sp;
+        abi_ulong sp;
         int size;
-        target_ulong u_platform;
+        abi_ulong u_platform;
         const char *k_platform;
-        const int n = sizeof(target_ulong);
+        const int n = sizeof(elf_addr_t);
 
         sp = p;
         u_platform = 0;
@@ -679,12 +763,13 @@ static unsigned long create_elf_tables(target_ulong p, int argc, int envc,
             size_t len = strlen(k_platform) + 1;
             sp -= (len + n - 1) & ~(n - 1);
             u_platform = sp;
+            /* FIXME - check return value of memcpy_to_target() for failure */
             memcpy_to_target(sp, k_platform, len);
         }
 	/*
 	 * Force 16 byte _final_ alignment here for generality.
 	 */
-        sp = sp &~ (target_ulong)15;
+        sp = sp &~ (abi_ulong)15;
         size = (DLINFO_ITEMS + 1) * 2;
         if (k_platform)
           size += 2;
@@ -697,25 +782,29 @@ static unsigned long create_elf_tables(target_ulong p, int argc, int envc,
         if (size & 15)
             sp -= 16 - (size & 15);
 
-#define NEW_AUX_ENT(id, val) do { \
-            sp -= n; tputl(sp, val); \
-            sp -= n; tputl(sp, id); \
+        /* This is correct because Linux defines
+         * elf_addr_t as Elf32_Off / Elf64_Off
+         */
+#define NEW_AUX_ENT(id, val) do {		\
+            sp -= n; put_user_ual(val, sp);	\
+            sp -= n; put_user_ual(id, sp);	\
           } while(0)
+
         NEW_AUX_ENT (AT_NULL, 0);
 
         /* There must be exactly DLINFO_ITEMS entries here.  */
-        NEW_AUX_ENT(AT_PHDR, (target_ulong)(load_addr + exec->e_phoff));
-        NEW_AUX_ENT(AT_PHENT, (target_ulong)(sizeof (struct elf_phdr)));
-        NEW_AUX_ENT(AT_PHNUM, (target_ulong)(exec->e_phnum));
-        NEW_AUX_ENT(AT_PAGESZ, (target_ulong)(TARGET_PAGE_SIZE));
-        NEW_AUX_ENT(AT_BASE, (target_ulong)(interp_load_addr));
-        NEW_AUX_ENT(AT_FLAGS, (target_ulong)0);
+        NEW_AUX_ENT(AT_PHDR, (abi_ulong)(load_addr + exec->e_phoff));
+        NEW_AUX_ENT(AT_PHENT, (abi_ulong)(sizeof (struct elf_phdr)));
+        NEW_AUX_ENT(AT_PHNUM, (abi_ulong)(exec->e_phnum));
+        NEW_AUX_ENT(AT_PAGESZ, (abi_ulong)(TARGET_PAGE_SIZE));
+        NEW_AUX_ENT(AT_BASE, (abi_ulong)(interp_load_addr));
+        NEW_AUX_ENT(AT_FLAGS, (abi_ulong)0);
         NEW_AUX_ENT(AT_ENTRY, load_bias + exec->e_entry);
-        NEW_AUX_ENT(AT_UID, (target_ulong) getuid());
-        NEW_AUX_ENT(AT_EUID, (target_ulong) geteuid());
-        NEW_AUX_ENT(AT_GID, (target_ulong) getgid());
-        NEW_AUX_ENT(AT_EGID, (target_ulong) getegid());
-        NEW_AUX_ENT(AT_HWCAP, (target_ulong) ELF_HWCAP);
+        NEW_AUX_ENT(AT_UID, (abi_ulong) getuid());
+        NEW_AUX_ENT(AT_EUID, (abi_ulong) geteuid());
+        NEW_AUX_ENT(AT_GID, (abi_ulong) getgid());
+        NEW_AUX_ENT(AT_EGID, (abi_ulong) getegid());
+        NEW_AUX_ENT(AT_HWCAP, (abi_ulong) ELF_HWCAP);
         if (k_platform)
             NEW_AUX_ENT(AT_PLATFORM, u_platform);
 #ifdef ARCH_DLINFO
@@ -732,17 +821,17 @@ static unsigned long create_elf_tables(target_ulong p, int argc, int envc,
 }
 
 
-static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex,
-				     int interpreter_fd,
-				     unsigned long *interp_load_addr)
+static abi_ulong load_elf_interp(struct elfhdr * interp_elf_ex,
+                                 int interpreter_fd,
+                                 abi_ulong *interp_load_addr)
 {
 	struct elf_phdr *elf_phdata  =  NULL;
 	struct elf_phdr *eppnt;
-	unsigned long load_addr = 0;
+	abi_ulong load_addr = 0;
 	int load_addr_set = 0;
 	int retval;
-	unsigned long last_bss, elf_bss;
-	unsigned long error;
+	abi_ulong last_bss, elf_bss;
+	abi_ulong error;
 	int i;
 
 	elf_bss = 0;
@@ -756,20 +845,20 @@ static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex,
 	if ((interp_elf_ex->e_type != ET_EXEC &&
              interp_elf_ex->e_type != ET_DYN) ||
 	   !elf_check_arch(interp_elf_ex->e_machine)) {
-		return ~0UL;
+		return ~((abi_ulong)0UL);
 	}
 
 
 	/* Now read in all of the header information */
 
 	if (sizeof(struct elf_phdr) * interp_elf_ex->e_phnum > TARGET_PAGE_SIZE)
-	    return ~0UL;
+	    return ~(abi_ulong)0UL;
 
 	elf_phdata =  (struct elf_phdr *)
 		malloc(sizeof(struct elf_phdr) * interp_elf_ex->e_phnum);
 
 	if (!elf_phdata)
-	  return ~0UL;
+	  return ~((abi_ulong)0UL);
 
 	/*
 	 * If the size of this structure has changed, then punt, since
@@ -777,7 +866,7 @@ static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex,
 	 */
 	if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr)) {
 	    free(elf_phdata);
-	    return ~0UL;
+	    return ~((abi_ulong)0UL);
         }
 
 	retval = lseek(interpreter_fd, interp_elf_ex->e_phoff, SEEK_SET);
@@ -818,8 +907,8 @@ static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex,
 	  if (eppnt->p_type == PT_LOAD) {
 	    int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 	    int elf_prot = 0;
-	    unsigned long vaddr = 0;
-	    unsigned long k;
+	    abi_ulong vaddr = 0;
+	    abi_ulong k;
 
 	    if (eppnt->p_flags & PF_R) elf_prot =  PROT_READ;
 	    if (eppnt->p_flags & PF_W) elf_prot |= PROT_WRITE;
@@ -839,7 +928,7 @@ static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex,
 	      /* Real error */
 	      close(interpreter_fd);
 	      free(elf_phdata);
-	      return ~0UL;
+	      return ~((abi_ulong)0UL);
 	    }
 
 	    if (!load_addr_set && interp_elf_ex->e_type == ET_DYN) {
@@ -884,7 +973,7 @@ static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex,
 	free(elf_phdata);
 
 	*interp_load_addr = load_addr;
-	return ((unsigned long) interp_elf_ex->e_entry) + load_addr;
+	return ((abi_ulong) interp_elf_ex->e_entry) + load_addr;
 }
 
 /* Best attempt to load symbols from this ELF object. */
@@ -972,22 +1061,22 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
     struct elfhdr interp_elf_ex;
     struct exec interp_ex;
     int interpreter_fd = -1; /* avoid warning */
-    unsigned long load_addr, load_bias;
+    abi_ulong load_addr, load_bias;
     int load_addr_set = 0;
     unsigned int interpreter_type = INTERPRETER_NONE;
     unsigned char ibcs2_interpreter;
     int i;
-    unsigned long mapped_addr;
+    abi_ulong mapped_addr;
     struct elf_phdr * elf_ppnt;
     struct elf_phdr *elf_phdata;
-    unsigned long elf_bss, k, elf_brk;
+    abi_ulong elf_bss, k, elf_brk;
     int retval;
     char * elf_interpreter;
-    unsigned long elf_entry, interp_load_addr = 0;
+    abi_ulong elf_entry, interp_load_addr = 0;
     int status;
-    unsigned long start_code, end_code, end_data;
-    unsigned long reloc_func_desc = 0;
-    unsigned long elf_stack;
+    abi_ulong start_code, end_code, start_data, end_data;
+    abi_ulong reloc_func_desc = 0;
+    abi_ulong elf_stack;
     char passed_fileno[6];
 
     ibcs2_interpreter = 0;
@@ -1043,10 +1132,11 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
     elf_brk = 0;
 
 
-    elf_stack = ~0UL;
+    elf_stack = ~((abi_ulong)0UL);
     elf_interpreter = NULL;
-    start_code = ~0UL;
+    start_code = ~((abi_ulong)0UL);
     end_code = 0;
+    start_data = 0;
     end_data = 0;
 
     for(i=0;i < elf_ex.e_phnum; i++) {
@@ -1180,9 +1270,9 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
     /* OK, This is the point of no return */
     info->end_data = 0;
     info->end_code = 0;
-    info->start_mmap = (unsigned long)ELF_START_MMAP;
+    info->start_mmap = (abi_ulong)ELF_START_MMAP;
     info->mmap = 0;
-    elf_entry = (unsigned long) elf_ex.e_entry;
+    elf_entry = (abi_ulong) elf_ex.e_entry;
 
     /* Do this so that we can load the interpreter, if need be.  We will
        change some of these later */
@@ -1199,7 +1289,7 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
     for(i = 0, elf_ppnt = elf_phdata; i < elf_ex.e_phnum; i++, elf_ppnt++) {
         int elf_prot = 0;
         int elf_flags = 0;
-        unsigned long error;
+        abi_ulong error;
 
 	if (elf_ppnt->p_type != PT_LOAD)
             continue;
@@ -1257,6 +1347,8 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
         k = elf_ppnt->p_vaddr;
         if (k < start_code)
             start_code = k;
+        if (start_data < k)
+            start_data = k;
         k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
         if (k > elf_bss)
             elf_bss = k;
@@ -1273,7 +1365,7 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
     elf_brk += load_bias;
     start_code += load_bias;
     end_code += load_bias;
-    //    start_data += load_bias;
+    start_data += load_bias;
     end_data += load_bias;
 
     if (elf_interpreter) {
@@ -1289,7 +1381,7 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
 	close(interpreter_fd);
 	free(elf_interpreter);
 
-	if (elf_entry == ~0UL) {
+	if (elf_entry == ~((abi_ulong)0UL)) {
 	    printf("Unable to load interpreter\n");
 	    free(elf_phdata);
 	    exit(-1);
@@ -1320,7 +1412,7 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
     info->start_brk = info->brk = elf_brk;
     info->end_code = end_code;
     info->start_code = start_code;
-    info->start_data = end_code;
+    info->start_data = start_data;
     info->end_data = end_data;
     info->start_stack = bprm->p;
 
diff --git a/linux-user/elfload32.c b/linux-user/elfload32.c
new file mode 100755
index 000000000..4b4648c75
--- /dev/null
+++ b/linux-user/elfload32.c
@@ -0,0 +1,30 @@
+#define TARGET_ABI32
+#define load_elf_binary load_elf_binary32
+#define do_init_thread do_init_thread32
+
+#include "elfload.c"
+
+#undef load_elf_binary
+#undef do_init_thread
+
+int load_elf_binary(struct linux_binprm *bprm, struct target_pt_regs *regs,
+                    struct image_info *info);
+
+int load_elf_binary_multi(struct linux_binprm *bprm,
+                          struct target_pt_regs *regs,
+                          struct image_info *info)
+{
+    struct elfhdr *elf_ex;
+    int retval;
+
+    elf_ex = (struct elfhdr *) bprm->buf;          /* exec-header */
+    if (elf_ex->e_ident[EI_CLASS] == ELFCLASS64) {
+        retval = load_elf_binary(bprm, regs, info);
+    } else {
+        retval = load_elf_binary32(bprm, regs, info);
+        if (personality(info->personality) == PER_LINUX)
+            info->personality = PER_LINUX32;
+    }
+
+    return retval;
+}
diff --git a/linux-user/flat.h b/linux-user/flat.h
index 9b84c7292..6f2d0c4b2 100644
--- a/linux-user/flat.h
+++ b/linux-user/flat.h
@@ -22,25 +22,25 @@
 
 struct flat_hdr {
 	char magic[4];
-	target_ulong rev;          /* version (as above) */
-	target_ulong entry;        /* Offset of first executable instruction
-	                               with text segment from beginning of file */
-	target_ulong data_start;   /* Offset of data segment from beginning of
-	                               file */
-	target_ulong data_end;     /* Offset of end of data segment
-	                               from beginning of file */
-	target_ulong bss_end;      /* Offset of end of bss segment from beginning
-	                               of file */
+	abi_ulong rev;          /* version (as above) */
+	abi_ulong entry;        /* Offset of first executable instruction
+                                   with text segment from beginning of file */
+	abi_ulong data_start;   /* Offset of data segment from beginning of
+                                   file */
+	abi_ulong data_end;     /* Offset of end of data segment
+                                   from beginning of file */
+	abi_ulong bss_end;      /* Offset of end of bss segment from beginning
+                                   of file */
 
 	/* (It is assumed that data_end through bss_end forms the bss segment.) */
 
-	target_ulong stack_size;   /* Size of stack, in bytes */
-	target_ulong reloc_start;  /* Offset of relocation records from
-	                               beginning of file */
-	target_ulong reloc_count;  /* Number of relocation records */
-	target_ulong flags;
-	target_ulong build_date;   /* When the program/library was built */
-	target_ulong filler[5];    /* Reservered, set to zero */
+	abi_ulong stack_size;   /* Size of stack, in bytes */
+	abi_ulong reloc_start;  /* Offset of relocation records from
+                                   beginning of file */
+	abi_ulong reloc_count;  /* Number of relocation records */
+	abi_ulong flags;
+	abi_ulong build_date;   /* When the program/library was built */
+	abi_ulong filler[5];    /* Reservered, set to zero */
 };
 
 #define FLAT_FLAG_RAM    0x0001 /* load program entirely into RAM */
diff --git a/linux-user/flatload.c b/linux-user/flatload.c
index db88e4b1c..95d386468 100644
--- a/linux-user/flatload.c
+++ b/linux-user/flatload.c
@@ -63,13 +63,13 @@
 #define UNLOADED_LIB 0x7ff000ff		/* Placeholder for unused library */
 
 struct lib_info {
-    target_ulong start_code;	/* Start of text segment */
-    target_ulong start_data;	/* Start of data segment */
-    target_ulong end_data;      /* Start of bss section */
-    target_ulong start_brk;	/* End of data segment */
-    target_ulong text_len;	/* Length of text segment */
-    target_ulong entry;		/* Start address for this module */
-    target_ulong build_date;	/* When this one was compiled */
+    abi_ulong start_code;       /* Start of text segment */
+    abi_ulong start_data;       /* Start of data segment */
+    abi_ulong end_data;         /* Start of bss section */
+    abi_ulong start_brk;        /* End of data segment */
+    abi_ulong text_len;	        /* Length of text segment */
+    abi_ulong entry;	        /* Start address for this module */
+    abi_ulong build_date;       /* When this one was compiled */
     short loaded;		/* Has this library been loaded? */
 };
 
@@ -89,7 +89,7 @@ struct linux_binprm;
  */
 
 /* Push a block of strings onto the guest stack.  */
-static target_ulong copy_strings(target_ulong p, int n, char **s)
+static abi_ulong copy_strings(abi_ulong p, int n, char **s)
 {
     int len;
 
@@ -102,13 +102,13 @@ static target_ulong copy_strings(target_ulong p, int n, char **s)
     return p;
 }
 
-int target_pread(int fd, target_ulong ptr, target_ulong len,
-                 target_ulong offset)
+int target_pread(int fd, abi_ulong ptr, abi_ulong len,
+                 abi_ulong offset)
 {
     void *buf;
     int ret;
 
-    buf = lock_user(ptr, len, 0);
+    buf = lock_user(VERIFY_WRITE, ptr, len, 0);
     ret = pread(fd, buf, len, offset);
     unlock_user(buf, ptr, len);
     return ret;
@@ -262,15 +262,15 @@ out:
 
 /****************************************************************************/
 
-static target_ulong
-calc_reloc(target_ulong r, struct lib_info *p, int curid, int internalp)
+static abi_ulong
+calc_reloc(abi_ulong r, struct lib_info *p, int curid, int internalp)
 {
-    target_ulong addr;
+    abi_ulong addr;
     int id;
-    target_ulong start_brk;
-    target_ulong start_data;
-    target_ulong text_len;
-    target_ulong start_code;
+    abi_ulong start_brk;
+    abi_ulong start_data;
+    abi_ulong text_len;
+    abi_ulong start_code;
 
 #ifdef CONFIG_BINFMT_SHARED_FLAT
 #error needs checking
@@ -381,19 +381,19 @@ void old_reloc(struct lib_info *libinfo, uint32_t rl)
 /****************************************************************************/
 
 static int load_flat_file(struct linux_binprm * bprm,
-		struct lib_info *libinfo, int id, target_ulong *extra_stack)
+		struct lib_info *libinfo, int id, abi_ulong *extra_stack)
 {
     struct flat_hdr * hdr;
-    target_ulong textpos = 0, datapos = 0, result;
-    target_ulong realdatastart = 0;
-    target_ulong text_len, data_len, bss_len, stack_len, flags;
-    target_ulong memp = 0; /* for finding the brk area */
-    target_ulong extra;
-    target_ulong reloc = 0, rp;
+    abi_ulong textpos = 0, datapos = 0, result;
+    abi_ulong realdatastart = 0;
+    abi_ulong text_len, data_len, bss_len, stack_len, flags;
+    abi_ulong memp = 0; /* for finding the brk area */
+    abi_ulong extra;
+    abi_ulong reloc = 0, rp;
     int i, rev, relocs = 0;
-    target_ulong fpos;
-    target_ulong start_code, end_code;
-    target_ulong indx_len;
+    abi_ulong fpos;
+    abi_ulong start_code, end_code;
+    abi_ulong indx_len;
 
     hdr = ((struct flat_hdr *) bprm->buf);		/* exec-header */
 
@@ -440,14 +440,14 @@ static int load_flat_file(struct linux_binprm * bprm,
     /*
      * calculate the extra space we need to map in
      */
-    extra = relocs * sizeof(target_ulong);
+    extra = relocs * sizeof(abi_ulong);
     if (extra < bss_len + stack_len)
         extra = bss_len + stack_len;
 
     /* Add space for library base pointers.  Make sure this does not
        misalign the  doesn't misalign the data segment.  */
-    indx_len = MAX_SHARED_LIBS * sizeof(target_ulong);
-    indx_len = (indx_len + 15) & ~(target_ulong)15;
+    indx_len = MAX_SHARED_LIBS * sizeof(abi_ulong);
+    indx_len = (indx_len + 15) & ~(abi_ulong)15;
 
     /*
      * there are a couple of cases here,  the separate code/data
@@ -485,12 +485,12 @@ static int load_flat_file(struct linux_binprm * bprm,
 #ifdef CONFIG_BINFMT_ZFLAT
         if (flags & FLAT_FLAG_GZDATA) {
             result = decompress_exec(bprm, fpos, (char *) datapos,
-                                     data_len + (relocs * sizeof(target_ulong)))
+                                     data_len + (relocs * sizeof(abi_ulong)))
         } else
 #endif
         {
             result = target_pread(bprm->fd, datapos,
-                                  data_len + (relocs * sizeof(target_ulong)),
+                                  data_len + (relocs * sizeof(abi_ulong)),
                                   fpos);
         }
         if (result < 0) {
@@ -544,7 +544,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                                   text_len, 0);
             if (result >= 0) {
                 result = target_pread(bprm->fd, datapos,
-                    data_len + (relocs * sizeof(target_ulong)),
+                    data_len + (relocs * sizeof(abi_ulong)),
                     ntohl(hdr->data_start));
             }
         }
@@ -597,17 +597,19 @@ static int load_flat_file(struct linux_binprm * bprm,
     if (flags & FLAT_FLAG_GOTPIC) {
         rp = datapos;
         while (1) {
-            target_ulong addr;
-            addr = tgetl(rp);
+            abi_ulong addr;
+            if (get_user_ual(addr, rp))
+                return -EFAULT;
             if (addr == -1)
                 break;
             if (addr) {
                 addr = calc_reloc(addr, libinfo, id, 0);
                 if (addr == RELOC_FAILED)
                     return -ENOEXEC;
-                tputl(rp, addr);
+                if (put_user_ual(addr, rp))
+                    return -EFAULT;
             }
-            rp += sizeof(target_ulong);
+            rp += sizeof(abi_ulong);
         }
     }
 
@@ -624,19 +626,21 @@ static int load_flat_file(struct linux_binprm * bprm,
      */
     if (rev > OLD_FLAT_VERSION) {
         for (i = 0; i < relocs; i++) {
-            target_ulong addr, relval;
+            abi_ulong addr, relval;
 
             /* Get the address of the pointer to be
                relocated (of course, the address has to be
                relocated first).  */
-            relval = tgetl(reloc + i * sizeof (target_ulong));
+            if (get_user_ual(relval, reloc + i * sizeof(abi_ulong)))
+                return -EFAULT;
             addr = flat_get_relocate_addr(relval);
             rp = calc_reloc(addr, libinfo, id, 1);
             if (rp == RELOC_FAILED)
                 return -ENOEXEC;
 
             /* Get the pointer's value.  */
-            addr = tgetl(rp);
+            if (get_user_ual(addr, rp))
+                return -EFAULT;
             if (addr != 0) {
                 /*
                  * Do the relocation.  PIC relocs in the data section are
@@ -652,13 +656,15 @@ static int load_flat_file(struct linux_binprm * bprm,
                     return -ENOEXEC;
 
                 /* Write back the relocated pointer.  */
-                tputl(rp, addr);
+                if (put_user_ual(addr, rp))
+                    return -EFAULT;
             }
         }
     } else {
         for (i = 0; i < relocs; i++) {
-            target_ulong relval;
-            relval = tgetl(reloc + i * sizeof (target_ulong));
+            abi_ulong relval;
+            if (get_user_ual(relval, reloc + i * sizeof(abi_ulong)))
+                return -EFAULT;
             old_reloc(&libinfo[0], relval);
         }
     }
@@ -712,10 +718,10 @@ int load_flt_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
                     struct image_info * info)
 {
     struct lib_info libinfo[MAX_SHARED_LIBS];
-    target_ulong p = bprm->p;
-    target_ulong stack_len;
-    target_ulong start_addr;
-    target_ulong sp;
+    abi_ulong p = bprm->p;
+    abi_ulong stack_len;
+    abi_ulong start_addr;
+    abi_ulong sp;
     int res;
     int i, j;
 
@@ -740,13 +746,16 @@ int load_flt_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
     /* Update data segment pointers for all libraries */
     for (i=0; i<MAX_SHARED_LIBS; i++) {
         if (libinfo[i].loaded) {
-            target_ulong p;
+            abi_ulong p;
             p = libinfo[i].start_data;
             for (j=0; j<MAX_SHARED_LIBS; j++) {
                 p -= 4;
-                tput32(p, libinfo[j].loaded
-                          ? libinfo[j].start_data
-                          : UNLOADED_LIB);
+                /* FIXME - handle put_user() failures */
+                if (put_user_ual(libinfo[j].loaded
+                                 ? libinfo[j].start_data
+                                 : UNLOADED_LIB,
+                                 p))
+                    return -EFAULT;
             }
         }
     }
@@ -758,12 +767,12 @@ int load_flt_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
     p = copy_strings(p, bprm->envc, bprm->envp);
     p = copy_strings(p, bprm->argc, bprm->argv);
     /* Align stack.  */
-    sp = p & ~(target_ulong)(sizeof(target_ulong) - 1);
+    sp = p & ~(abi_ulong)(sizeof(abi_ulong) - 1);
     /* Enforce final stack alignment of 16 bytes.  This is sufficient
        for all current targets, and excess alignment is harmless.  */
     stack_len = bprm->envc + bprm->argc + 2;
     stack_len += 3;	/* argc, arvg, argp */
-    stack_len *= sizeof(target_ulong);
+    stack_len *= sizeof(abi_ulong);
     if ((sp + stack_len) & 15)
         sp -= 16 - ((sp + stack_len) & 15);
     sp = loader_build_argptr(bprm->envc, bprm->argc, sp, p, 1);
@@ -779,7 +788,9 @@ int load_flt_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
     for (i = MAX_SHARED_LIBS-1; i>0; i--) {
             if (libinfo[i].loaded) {
                     /* Push previos first to call address */
-                    --sp;	put_user(start_addr, sp);
+                    --sp;
+                    if (put_user_ual(start_addr, sp))
+                        return -EFAULT;
                     start_addr = libinfo[i].entry;
             }
     }
diff --git a/linux-user/i386/syscall.h b/linux-user/i386/syscall.h
index 6e288b804..266e2c4c8 100644
--- a/linux-user/i386/syscall.h
+++ b/linux-user/i386/syscall.h
@@ -25,13 +25,14 @@ struct target_pt_regs {
 #define TARGET_LDT_ENTRIES      8192
 #define TARGET_LDT_ENTRY_SIZE	8
 
+#define TARGET_GDT_ENTRIES             9
 #define TARGET_GDT_ENTRY_TLS_ENTRIES   3
 #define TARGET_GDT_ENTRY_TLS_MIN       6
 #define TARGET_GDT_ENTRY_TLS_MAX       (TARGET_GDT_ENTRY_TLS_MIN + TARGET_GDT_ENTRY_TLS_ENTRIES - 1)
 
 struct target_modify_ldt_ldt_s {
     unsigned int  entry_number;
-    target_ulong base_addr;
+    abi_ulong base_addr;
     unsigned int limit;
     unsigned int flags;
 };
@@ -79,22 +80,22 @@ struct target_vm86_regs {
 /*
  * normal regs, with special meaning for the segment descriptors..
  */
-	target_long ebx;
-	target_long ecx;
-	target_long edx;
-	target_long esi;
-	target_long edi;
-	target_long ebp;
-	target_long eax;
-	target_long __null_ds;
-	target_long __null_es;
-	target_long __null_fs;
-	target_long __null_gs;
-	target_long orig_eax;
-	target_long eip;
+	abi_long ebx;
+	abi_long ecx;
+	abi_long edx;
+	abi_long esi;
+	abi_long edi;
+	abi_long ebp;
+	abi_long eax;
+	abi_long __null_ds;
+	abi_long __null_es;
+	abi_long __null_fs;
+	abi_long __null_gs;
+	abi_long orig_eax;
+	abi_long eip;
 	unsigned short cs, __csh;
-	target_long eflags;
-	target_long esp;
+	abi_long eflags;
+	abi_long esp;
 	unsigned short ss, __ssh;
 /*
  * these are specific to v86 mode:
@@ -106,14 +107,14 @@ struct target_vm86_regs {
 };
 
 struct target_revectored_struct {
-	target_ulong __map[8];			/* 256 bits */
+	abi_ulong __map[8];			/* 256 bits */
 };
 
 struct target_vm86_struct {
 	struct target_vm86_regs regs;
-	target_ulong flags;
-	target_ulong screen_bitmap;
-	target_ulong cpu_type;
+	abi_ulong flags;
+	abi_ulong screen_bitmap;
+	abi_ulong cpu_type;
 	struct target_revectored_struct int_revectored;
 	struct target_revectored_struct int21_revectored;
 };
@@ -124,7 +125,7 @@ struct target_vm86_struct {
 #define TARGET_VM86_SCREEN_BITMAP	0x0001
 
 struct target_vm86plus_info_struct {
-        target_ulong flags;
+        abi_ulong flags;
 #define TARGET_force_return_for_pic (1 << 0)
 #define TARGET_vm86dbg_active       (1 << 1)  /* for debugger */
 #define TARGET_vm86dbg_TFpendig     (1 << 2)  /* for debugger */
@@ -134,9 +135,9 @@ struct target_vm86plus_info_struct {
 
 struct target_vm86plus_struct {
 	struct target_vm86_regs regs;
-	target_ulong flags;
-	target_ulong screen_bitmap;
-	target_ulong cpu_type;
+	abi_ulong flags;
+	abi_ulong screen_bitmap;
+	abi_ulong cpu_type;
 	struct target_revectored_struct int_revectored;
 	struct target_revectored_struct int21_revectored;
 	struct target_vm86plus_info_struct vm86plus;
diff --git a/linux-user/i386/target_signal.h b/linux-user/i386/target_signal.h
index f93a8d62b..9baf7fbeb 100644
--- a/linux-user/i386/target_signal.h
+++ b/linux-user/i386/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_ulong ss_sp;
-	target_long ss_flags;
-	target_ulong ss_size;
+	abi_ulong ss_sp;
+	abi_long ss_flags;
+	abi_ulong ss_size;
 } target_stack_t;
 
 
@@ -21,7 +21,7 @@ typedef struct target_sigaltstack {
 #define TARGET_MINSIGSTKSZ	2048
 #define TARGET_SIGSTKSZ		8192
 
-static inline target_ulong get_sp_from_cpustate(CPUX86State *state)
+static inline abi_ulong get_sp_from_cpustate(CPUX86State *state)
 {
     return state->regs[R_ESP];
 }
diff --git a/linux-user/linuxload.c b/linux-user/linuxload.c
index 0efbb76ce..ada7c697d 100644
--- a/linux-user/linuxload.c
+++ b/linux-user/linuxload.c
@@ -13,14 +13,17 @@
 #define NGROUPS 32
 
 /* ??? This should really be somewhere else.  */
-void memcpy_to_target(target_ulong dest, const void *src,
-                      unsigned long len)
+abi_long memcpy_to_target(abi_ulong dest, const void *src,
+                          unsigned long len)
 {
     void *host_ptr;
 
-    host_ptr = lock_user(dest, len, 0);
+    host_ptr = lock_user(VERIFY_WRITE, dest, len, 0);
+    if (!host_ptr)
+        return -TARGET_EFAULT;
     memcpy(host_ptr, src, len);
     unlock_user(host_ptr, dest, 1);
+    return 0;
 }
 
 static int in_group_p(gid_t g)
@@ -109,33 +112,44 @@ static int prepare_binprm(struct linux_binprm *bprm)
 }
 
 /* Construct the envp and argv tables on the target stack.  */
-target_ulong loader_build_argptr(int envc, int argc, target_ulong sp,
-                                 target_ulong stringp, int push_ptr)
+abi_ulong loader_build_argptr(int envc, int argc, abi_ulong sp,
+                              abi_ulong stringp, int push_ptr)
 {
-    int n = sizeof(target_ulong);
-    target_ulong envp;
-    target_ulong argv;
+    int n = sizeof(abi_ulong);
+    abi_ulong envp;
+    abi_ulong argv;
 
     sp -= (envc + 1) * n;
     envp = sp;
     sp -= (argc + 1) * n;
     argv = sp;
     if (push_ptr) {
-        sp -= n; tputl(sp, envp);
-        sp -= n; tputl(sp, argv);
+        /* FIXME - handle put_user() failures */
+        sp -= n;
+        put_user_ual(envp, sp);
+        sp -= n;
+        put_user_ual(argv, sp);
     }
-    sp -= n; tputl(sp, argc);
+    sp -= n;
+    /* FIXME - handle put_user() failures */
+    put_user_ual(argc, sp);
 
     while (argc-- > 0) {
-        tputl(argv, stringp); argv += n;
+        /* FIXME - handle put_user() failures */
+        put_user_ual(stringp, argv);
+        argv += n;
         stringp += target_strlen(stringp) + 1;
     }
-    tputl(argv, 0);
+    /* FIXME - handle put_user() failures */
+    put_user_ual(0, argv);
     while (envc-- > 0) {
-        tputl(envp, stringp); envp += n;
+        /* FIXME - handle put_user() failures */
+        put_user_ual(stringp, envp);
+        envp += n;
         stringp += target_strlen(stringp) + 1;
     }
-    tputl(envp, 0);
+    /* FIXME - handle put_user() failures */
+    put_user_ual(0, envp);
 
     return sp;
 }
@@ -169,7 +183,11 @@ int loader_exec(const char * filename, char ** argv, char ** envp,
                 && bprm.buf[1] == 'E'
                 && bprm.buf[2] == 'L'
                 && bprm.buf[3] == 'F') {
+#ifndef TARGET_HAS_ELFLOAD32
             retval = load_elf_binary(&bprm,regs,infop);
+#else
+            retval = load_elf_binary_multi(&bprm, regs, infop);
+#endif
 #if defined(TARGET_HAS_BFLT)
         } else if (bprm.buf[0] == 'b'
                 && bprm.buf[1] == 'F'
diff --git a/linux-user/m68k-sim.c b/linux-user/m68k-sim.c
index aab82dd7e..61c246875 100644
--- a/linux-user/m68k-sim.c
+++ b/linux-user/m68k-sim.c
@@ -129,7 +129,7 @@ void do_m68k_simcall(CPUM68KState *env, int nr)
         {
             int32_t ret;
 
-            ret = do_brk((void *)ARG(0));
+            ret = do_brk((abi_ulong)ARG(0));
             if (ret == -ENOMEM)
                 ret = -1;
             check_err(env, ret);
diff --git a/linux-user/m68k/syscall.h b/linux-user/m68k/syscall.h
index c225567d2..47cc66b14 100644
--- a/linux-user/m68k/syscall.h
+++ b/linux-user/m68k/syscall.h
@@ -3,14 +3,14 @@
    stack during a system call. */
 
 struct target_pt_regs {
-    target_long d1, d2, d3, d4, d5, d6, d7;
-    target_long a0, a1, a2, a3, a4, a5, a6;
-    target_ulong d0;
-    target_ulong usp;
-    target_ulong orig_d0;
+    abi_long d1, d2, d3, d4, d5, d6, d7;
+    abi_long a0, a1, a2, a3, a4, a5, a6;
+    abi_ulong d0;
+    abi_ulong usp;
+    abi_ulong orig_d0;
     int16_t stkadj;
     uint16_t sr;
-    target_ulong pc;
+    abi_ulong pc;
     uint16_t fntvex;
     uint16_t __fill;
 };
diff --git a/linux-user/m68k/target_signal.h b/linux-user/m68k/target_signal.h
index b48119507..47852d546 100644
--- a/linux-user/m68k/target_signal.h
+++ b/linux-user/m68k/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_ulong ss_sp;
-	target_long ss_flags;
-	target_ulong ss_size;
+	abi_ulong ss_sp;
+	abi_long ss_flags;
+	abi_ulong ss_size;
 } target_stack_t;
 
 
diff --git a/linux-user/main.c b/linux-user/main.c
index af99d0455..baa90731d 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -28,11 +28,6 @@
 
 #define DEBUG_LOGFILE "/tmp/qemu.log"
 
-#ifdef __APPLE__
-#include <crt_externs.h>
-# define environ  (*_NSGetEnviron())
-#endif
-
 static const char *interp_prefix = CONFIG_QEMU_PREFIX;
 const char *qemu_uname_release = CONFIG_UNAME_RELEASE;
 
@@ -45,12 +40,20 @@ const char interp[] __attribute__((section(".interp"))) = "/lib/ld-linux.so.2";
 /* for recent libc, we add these dummy symbols which are not declared
    when generating a linked object (bug in ld ?) */
 #if (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 3)) && !defined(CONFIG_STATIC)
-long __preinit_array_start[0];
-long __preinit_array_end[0];
-long __init_array_start[0];
-long __init_array_end[0];
-long __fini_array_start[0];
-long __fini_array_end[0];
+asm(".globl __preinit_array_start\n"
+    ".globl __preinit_array_end\n"
+    ".globl __init_array_start\n"
+    ".globl __init_array_end\n"
+    ".globl __fini_array_start\n"
+    ".globl __fini_array_end\n"
+    ".section \".rodata\"\n"
+    "__preinit_array_start:\n"
+    "__preinit_array_end:\n"
+    "__init_array_start:\n"
+    "__init_array_end:\n"
+    "__fini_array_start:\n"
+    "__fini_array_end:\n"
+    ".long 0\n");
 #endif
 
 /* XXX: on x86 MAP_GROWSDOWN only works if ESP <= address + 32, so
@@ -144,38 +147,58 @@ static void write_dt(void *ptr, unsigned long addr, unsigned long limit,
     p[1] = tswapl(e2);
 }
 
-static void set_gate(void *ptr, unsigned int type, unsigned int dpl,
-                     unsigned long addr, unsigned int sel)
+#if TARGET_X86_64
+uint64_t idt_table[512];
+
+static void set_gate64(void *ptr, unsigned int type, unsigned int dpl,
+                       uint64_t addr, unsigned int sel)
 {
-    unsigned int e1, e2;
-    uint32_t *p;
+    uint32_t *p, e1, e2;
     e1 = (addr & 0xffff) | (sel << 16);
     e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);
     p = ptr;
-    p[0] = tswapl(e1);
-    p[1] = tswapl(e2);
+    p[0] = tswap32(e1);
+    p[1] = tswap32(e2);
+    p[2] = tswap32(addr >> 32);
+    p[3] = 0;
 }
-
-uint64_t gdt_table[6];
+/* only dpl matters as we do only user space emulation */
+static void set_idt(int n, unsigned int dpl)
+{
+    set_gate64(idt_table + n * 2, 0, dpl, 0, 0);
+}
+#else
 uint64_t idt_table[256];
 
+static void set_gate(void *ptr, unsigned int type, unsigned int dpl,
+                     uint32_t addr, unsigned int sel)
+{
+    uint32_t *p, e1, e2;
+    e1 = (addr & 0xffff) | (sel << 16);
+    e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);
+    p = ptr;
+    p[0] = tswap32(e1);
+    p[1] = tswap32(e2);
+}
+
 /* only dpl matters as we do only user space emulation */
 static void set_idt(int n, unsigned int dpl)
 {
     set_gate(idt_table + n, 0, dpl, 0, 0);
 }
+#endif
 
 void cpu_loop(CPUX86State *env)
 {
     int trapnr;
-    target_ulong pc;
+    abi_ulong pc;
     target_siginfo_t info;
 
     for(;;) {
         trapnr = cpu_x86_exec(env);
         switch(trapnr) {
         case 0x80:
-            /* linux syscall */
+            /* linux syscall from int $0x80 */
             env->regs[R_EAX] = do_syscall(env,
                                           env->regs[R_EAX],
                                           env->regs[R_EBX],
@@ -185,6 +208,20 @@ void cpu_loop(CPUX86State *env)
                                           env->regs[R_EDI],
                                           env->regs[R_EBP]);
             break;
+#ifndef TARGET_ABI32
+        case EXCP_SYSCALL:
+            /* linux syscall from syscall intruction */
+            env->regs[R_EAX] = do_syscall(env,
+                                          env->regs[R_EAX],
+                                          env->regs[R_EDI],
+                                          env->regs[R_ESI],
+                                          env->regs[R_EDX],
+                                          env->regs[10],
+                                          env->regs[8],
+                                          env->regs[9]);
+            env->eip = env->exception_next_eip;
+            break;
+#endif
         case EXCP0B_NOSEG:
         case EXCP0C_STACK:
             info.si_signo = SIGBUS;
@@ -194,6 +231,7 @@ void cpu_loop(CPUX86State *env)
             queue_signal(info.si_signo, &info);
             break;
         case EXCP0D_GPF:
+            /* XXX: potential problem if ABI32 */
 #ifndef TARGET_X86_64
             if (env->eflags & VM_MASK) {
                 handle_vm86_fault(env);
@@ -305,11 +343,11 @@ void cpu_loop(CPUX86State *env)
 #ifdef TARGET_ARM
 
 /* XXX: find a better solution */
-extern void tb_invalidate_page_range(target_ulong start, target_ulong end);
+extern void tb_invalidate_page_range(abi_ulong start, abi_ulong end);
 
-static void arm_cache_flush(target_ulong start, target_ulong last)
+static void arm_cache_flush(abi_ulong start, abi_ulong last)
 {
-    target_ulong addr, last1;
+    abi_ulong addr, last1;
 
     if (last < start)
         return;
@@ -342,7 +380,8 @@ void cpu_loop(CPUARMState *env)
 
                 /* we handle the FPU emulation here, as Linux */
                 /* we get the opcode */
-                opcode = tget32(env->regs[15]);
+                /* FIXME - what to do if get_user() fails? */
+                get_user_u32(opcode, env->regs[15]);
 
                 if (EmulateAll(opcode, &ts->fpa, env) == 0) {
                     info.si_signo = SIGILL;
@@ -363,20 +402,24 @@ void cpu_loop(CPUARMState *env)
                 /* system call */
                 if (trapnr == EXCP_BKPT) {
                     if (env->thumb) {
-                        insn = tget16(env->regs[15]);
+                        /* FIXME - what to do if get_user() fails? */
+                        get_user_u16(insn, env->regs[15]);
                         n = insn & 0xff;
                         env->regs[15] += 2;
                     } else {
-                        insn = tget32(env->regs[15]);
+                        /* FIXME - what to do if get_user() fails? */
+                        get_user_u32(insn, env->regs[15]);
                         n = (insn & 0xf) | ((insn >> 4) & 0xff0);
                         env->regs[15] += 4;
                     }
                 } else {
                     if (env->thumb) {
-                        insn = tget16(env->regs[15] - 2);
+                        /* FIXME - what to do if get_user() fails? */
+                        get_user_u16(insn, env->regs[15] - 2);
                         n = insn & 0xff;
                     } else {
-                        insn = tget32(env->regs[15] - 4);
+                        /* FIXME - what to do if get_user() fails? */
+                        get_user_u32(insn, env->regs[15] - 4);
                         n = insn & 0xffffff;
                     }
                 }
@@ -474,7 +517,7 @@ static inline int get_reg_index(CPUSPARCState *env, int cwp, int index)
 static inline void save_window_offset(CPUSPARCState *env, int cwp1)
 {
     unsigned int i;
-    target_ulong sp_ptr;
+    abi_ulong sp_ptr;
 
     sp_ptr = env->regbase[get_reg_index(env, cwp1, 6)];
 #if defined(DEBUG_WIN)
@@ -482,8 +525,9 @@ static inline void save_window_offset(CPUSPARCState *env, int cwp1)
            (int)sp_ptr, cwp1);
 #endif
     for(i = 0; i < 16; i++) {
-        tputl(sp_ptr, env->regbase[get_reg_index(env, cwp1, 8 + i)]);
-        sp_ptr += sizeof(target_ulong);
+        /* FIXME - what to do if put_user() fails? */
+        put_user_ual(env->regbase[get_reg_index(env, cwp1, 8 + i)], sp_ptr);
+        sp_ptr += sizeof(abi_ulong);
     }
 }
 
@@ -505,7 +549,7 @@ static void save_window(CPUSPARCState *env)
 static void restore_window(CPUSPARCState *env)
 {
     unsigned int new_wim, i, cwp1;
-    target_ulong sp_ptr;
+    abi_ulong sp_ptr;
 
     new_wim = ((env->wim << 1) | (env->wim >> (NWINDOWS - 1))) &
         ((1LL << NWINDOWS) - 1);
@@ -518,8 +562,9 @@ static void restore_window(CPUSPARCState *env)
            (int)sp_ptr, cwp1);
 #endif
     for(i = 0; i < 16; i++) {
-        env->regbase[get_reg_index(env, cwp1, 8 + i)] = tgetl(sp_ptr);
-        sp_ptr += sizeof(target_ulong);
+        /* FIXME - what to do if get_user() fails? */
+        get_user_ual(env->regbase[get_reg_index(env, cwp1, 8 + i)], sp_ptr);
+        sp_ptr += sizeof(abi_ulong);
     }
     env->wim = new_wim;
 #ifdef TARGET_SPARC64
@@ -564,6 +609,7 @@ void cpu_loop (CPUSPARCState *env)
         case 0x88:
         case 0x90:
 #else
+        case 0x110:
         case 0x16d:
 #endif
             ret = do_syscall (env, env->gregs[1],
@@ -571,14 +617,14 @@ void cpu_loop (CPUSPARCState *env)
                               env->regwptr[2], env->regwptr[3],
                               env->regwptr[4], env->regwptr[5]);
             if ((unsigned int)ret >= (unsigned int)(-515)) {
-#ifdef TARGET_SPARC64
+#if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
                 env->xcc |= PSR_CARRY;
 #else
                 env->psr |= PSR_CARRY;
 #endif
                 ret = -ret;
             } else {
-#ifdef TARGET_SPARC64
+#if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
                 env->xcc &= ~PSR_CARRY;
 #else
                 env->psr &= ~PSR_CARRY;
@@ -590,6 +636,9 @@ void cpu_loop (CPUSPARCState *env)
             env->npc = env->npc + 4;
             break;
         case 0x83: /* flush windows */
+#ifdef TARGET_ABI32
+        case 0x103:
+#endif
             flush_windows(env);
             /* next instruction */
             env->pc = env->npc;
@@ -634,6 +683,16 @@ void cpu_loop (CPUSPARCState *env)
                 queue_signal(info.si_signo, &info);
             }
             break;
+#ifndef TARGET_ABI32
+        case 0x16e:
+            flush_windows(env);
+            sparc64_get_context(env);
+            break;
+        case 0x16f:
+            flush_windows(env);
+            sparc64_set_context(env);
+            break;
+#endif
 #endif
         case EXCP_INTERRUPT:
             /* just indicate that signals should be handled asap */
@@ -773,7 +832,7 @@ void cpu_loop(CPUPPCState *env)
             break;
         case POWERPC_EXCP_ISI:      /* Instruction storage exception         */
             EXCP_DUMP(env, "Invalid instruction fetch: 0x\n" ADDRX "\n",
-                      env->spr[SPR_DAR]);
+                      env->spr[SPR_SRR0]);
             /* XXX: check this */
             switch (env->error_code & 0xFF000000) {
             case 0x40000000:
@@ -817,12 +876,6 @@ void cpu_loop(CPUPPCState *env)
             switch (env->error_code & ~0xF) {
             case POWERPC_EXCP_FP:
                 EXCP_DUMP(env, "Floating point program exception\n");
-                /* Set FX */
-                env->fpscr[7] |= 0x8;
-                /* Finally, update FEX */
-                if ((((env->fpscr[7] & 0x3) << 3) | (env->fpscr[6] >> 1)) &
-                    ((env->fpscr[1] << 1) | (env->fpscr[0] >> 3)))
-                    env->fpscr[7] |= 0x4;
                 info.si_signo = TARGET_SIGFPE;
                 info.si_errno = 0;
                 switch (env->error_code & 0xF) {
@@ -842,7 +895,7 @@ void cpu_loop(CPUPPCState *env)
                 case POWERPC_EXCP_FP_VXSOFT:
                     info.si_code = TARGET_FPE_FLTINV;
                     break;
-                case POWERPC_EXCP_FP_VXNAN:
+                case POWERPC_EXCP_FP_VXSNAN:
                 case POWERPC_EXCP_FP_VXISI:
                 case POWERPC_EXCP_FP_VXIDI:
                 case POWERPC_EXCP_FP_VXIMZ:
@@ -965,7 +1018,6 @@ void cpu_loop(CPUPPCState *env)
                   }
             }
             break;
-#if defined(TARGET_PPCEMB)
         case POWERPC_EXCP_SPEU:     /* SPE/embedded floating-point unavail.  */
             EXCP_DUMP(env, "No SPE/floating-point instruction allowed\n");
             info.si_signo = TARGET_SIGILL;
@@ -995,8 +1047,6 @@ void cpu_loop(CPUPPCState *env)
             cpu_abort(env, "Reset interrupt while in user mode. "
                       "Aborting\n");
             break;
-#endif /* defined(TARGET_PPCEMB) */
-#if defined(TARGET_PPC64) /* PowerPC 64 */
         case POWERPC_EXCP_DSEG:     /* Data segment exception                */
             cpu_abort(env, "Data segment exception while in user mode. "
                       "Aborting\n");
@@ -1005,19 +1055,17 @@ void cpu_loop(CPUPPCState *env)
             cpu_abort(env, "Instruction segment exception "
                       "while in user mode. Aborting\n");
             break;
-#endif /* defined(TARGET_PPC64) */
-#if defined(TARGET_PPC64H) /* PowerPC 64 with hypervisor mode support */
+        /* PowerPC 64 with hypervisor mode support */
         case POWERPC_EXCP_HDECR:    /* Hypervisor decrementer exception      */
             cpu_abort(env, "Hypervisor decrementer interrupt "
                       "while in user mode. Aborting\n");
             break;
-#endif /* defined(TARGET_PPC64H) */
         case POWERPC_EXCP_TRACE:    /* Trace exception                       */
             /* Nothing to do:
              * we use this exception to emulate step-by-step execution mode.
              */
             break;
-#if defined(TARGET_PPC64H) /* PowerPC 64 with hypervisor mode support */
+        /* PowerPC 64 with hypervisor mode support */
         case POWERPC_EXCP_HDSI:     /* Hypervisor data storage exception     */
             cpu_abort(env, "Hypervisor data storage exception "
                       "while in user mode. Aborting\n");
@@ -1034,7 +1082,6 @@ void cpu_loop(CPUPPCState *env)
             cpu_abort(env, "Hypervisor instruction segment exception "
                       "while in user mode. Aborting\n");
             break;
-#endif /* defined(TARGET_PPC64H) */
         case POWERPC_EXCP_VPU:      /* Vector unavailable exception          */
             EXCP_DUMP(env, "No Altivec instructions allowed\n");
             info.si_signo = TARGET_SIGILL;
@@ -1480,17 +1527,18 @@ void cpu_loop(CPUMIPSState *env)
                 ret = -ENOSYS;
             } else {
                 int nb_args;
-                target_ulong sp_reg;
-                target_ulong arg5 = 0, arg6 = 0, arg7 = 0, arg8 = 0;
+                abi_ulong sp_reg;
+                abi_ulong arg5 = 0, arg6 = 0, arg7 = 0, arg8 = 0;
 
                 nb_args = mips_syscall_args[syscall_num];
                 sp_reg = env->gpr[29][env->current_tc];
                 switch (nb_args) {
                 /* these arguments are taken from the stack */
-                case 8: arg8 = tgetl(sp_reg + 28);
-                case 7: arg7 = tgetl(sp_reg + 24);
-                case 6: arg6 = tgetl(sp_reg + 20);
-                case 5: arg5 = tgetl(sp_reg + 16);
+                /* FIXME - what to do if get_user() fails? */
+                case 8: get_user_ual(arg8, sp_reg + 28);
+                case 7: get_user_ual(arg7, sp_reg + 24);
+                case 6: get_user_ual(arg6, sp_reg + 20);
+                case 5: get_user_ual(arg5, sp_reg + 16);
                 default:
                     break;
                 }
@@ -1565,10 +1613,77 @@ void cpu_loop (CPUState *env)
                              env->gregs[6],
                              env->gregs[7],
                              env->gregs[0],
-                             0);
+                             env->gregs[1]);
             env->gregs[0] = ret;
             env->pc += 2;
             break;
+        case EXCP_INTERRUPT:
+            /* just indicate that signals should be handled asap */
+            break;
+        case EXCP_DEBUG:
+            {
+                int sig;
+
+                sig = gdb_handlesig (env, TARGET_SIGTRAP);
+                if (sig)
+                  {
+                    info.si_signo = sig;
+                    info.si_errno = 0;
+                    info.si_code = TARGET_TRAP_BRKPT;
+                    queue_signal(info.si_signo, &info);
+                  }
+            }
+            break;
+	case 0xa0:
+	case 0xc0:
+            info.si_signo = SIGSEGV;
+            info.si_errno = 0;
+            info.si_code = TARGET_SEGV_MAPERR;
+            info._sifields._sigfault._addr = env->tea;
+            queue_signal(info.si_signo, &info);
+	    break;
+
+        default:
+            printf ("Unhandled trap: 0x%x\n", trapnr);
+            cpu_dump_state(env, stderr, fprintf, 0);
+            exit (1);
+        }
+        process_pending_signals (env);
+    }
+}
+#endif
+
+#ifdef TARGET_CRIS
+void cpu_loop (CPUState *env)
+{
+    int trapnr, ret;
+    target_siginfo_t info;
+    
+    while (1) {
+        trapnr = cpu_cris_exec (env);
+        switch (trapnr) {
+        case 0xaa:
+            {
+                info.si_signo = SIGSEGV;
+                info.si_errno = 0;
+                /* XXX: check env->error_code */
+                info.si_code = TARGET_SEGV_MAPERR;
+                info._sifields._sigfault._addr = env->debug1;
+                queue_signal(info.si_signo, &info);
+            }
+            break;
+        case EXCP_BREAK:
+            ret = do_syscall(env, 
+                             env->regs[9], 
+                             env->regs[10], 
+                             env->regs[11], 
+                             env->regs[12], 
+                             env->regs[13], 
+                             env->pregs[7], 
+                             env->pregs[11]);
+            env->regs[10] = ret;
+            env->pc += 2;
+            break;
         case EXCP_DEBUG:
             {
                 int sig;
@@ -1789,11 +1904,14 @@ void usage(void)
            "-drop-ld-preload  drop LD_PRELOAD for target process\n"
            "\n"
            "debug options:\n"
-#ifdef USE_CODE_COPY
-           "-no-code-copy   disable code copy acceleration\n"
-#endif
            "-d options   activate log (logfile=%s)\n"
-           "-p pagesize  set the host page size to 'pagesize'\n",
+           "-p pagesize  set the host page size to 'pagesize'\n"
+           "-strace      log system calls\n"
+           "\n"
+           "environment variables:\n"
+           "QEMU_STRACE       Print system calls and arguments similar to the\n"
+           "                  'strace' program.  Enable by setting to any value.\n"
+           ,
            TARGET_ARCH,
            interp_prefix,
            x86_stack_size,
@@ -1881,25 +1999,17 @@ int main(int argc, char **argv)
         } else if (!strcmp(r, "cpu")) {
             cpu_model = argv[optind++];
             if (strcmp(cpu_model, "?") == 0) {
-#if defined(TARGET_PPC)
-                ppc_cpu_list(stdout, &fprintf);
-#elif defined(TARGET_ARM)
-                arm_cpu_list();
-#elif defined(TARGET_MIPS)
-                mips_cpu_list(stdout, &fprintf);
-#elif defined(TARGET_SPARC)
-                sparc_cpu_list(stdout, &fprintf);
+/* XXX: implement xxx_cpu_list for targets that still miss it */
+#if defined(cpu_list)
+                    cpu_list(stdout, &fprintf);
 #endif
                 _exit(1);
             }
         } else if (!strcmp(r, "drop-ld-preload")) {
             drop_ld_preload = 1;
+        } else if (!strcmp(r, "strace")) {
+            do_strace = 1;
         } else
-#ifdef USE_CODE_COPY
-        if (!strcmp(r, "no-code-copy")) {
-            code_copy_enabled = 0;
-        } else
-#endif
         {
             usage();
         }
@@ -1917,11 +2027,52 @@ int main(int argc, char **argv)
     /* Scan interp_prefix dir for replacement files. */
     init_paths(interp_prefix);
 
+    if (cpu_model == NULL) {
+#if defined(TARGET_I386)
+#ifdef TARGET_X86_64
+        cpu_model = "qemu64";
+#else
+        cpu_model = "qemu32";
+#endif
+#elif defined(TARGET_ARM)
+        cpu_model = "arm926";
+#elif defined(TARGET_M68K)
+        cpu_model = "any";
+#elif defined(TARGET_SPARC)
+#ifdef TARGET_SPARC64
+        cpu_model = "TI UltraSparc II";
+#else
+        cpu_model = "Fujitsu MB86904";
+#endif
+#elif defined(TARGET_MIPS)
+#if defined(TARGET_ABI_MIPSN32) || defined(TARGET_ABI_MIPSN64)
+        cpu_model = "20Kc";
+#else
+        cpu_model = "24Kf";
+#endif
+#elif defined(TARGET_PPC)
+#ifdef TARGET_PPC64
+        cpu_model = "970";
+#else
+        cpu_model = "750";
+#endif
+#else
+        cpu_model = "any";
+#endif
+    }
     /* NOTE: we need to init the CPU at this stage to get
        qemu_host_page_size */
-    env = cpu_init();
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     global_env = env;
 
+    if (getenv("QEMU_STRACE")) {
+        do_strace = 1;
+    }
+
     wrk = environ;
     while (*(wrk++))
         environ_count++;
@@ -1950,14 +2101,17 @@ int main(int argc, char **argv)
     if (loglevel) {
         page_dump(logfile);
 
-        fprintf(logfile, "start_brk   0x%08lx\n" , info->start_brk);
-        fprintf(logfile, "end_code    0x%08lx\n" , info->end_code);
-        fprintf(logfile, "start_code  0x%08lx\n" , info->start_code);
-        fprintf(logfile, "start_data  0x%08lx\n" , info->start_data);
-        fprintf(logfile, "end_data    0x%08lx\n" , info->end_data);
-        fprintf(logfile, "start_stack 0x%08lx\n" , info->start_stack);
-        fprintf(logfile, "brk         0x%08lx\n" , info->brk);
-        fprintf(logfile, "entry       0x%08lx\n" , info->entry);
+        fprintf(logfile, "start_brk   0x" TARGET_ABI_FMT_lx "\n", info->start_brk);
+        fprintf(logfile, "end_code    0x" TARGET_ABI_FMT_lx "\n", info->end_code);
+        fprintf(logfile, "start_code  0x" TARGET_ABI_FMT_lx "\n",
+                info->start_code);
+        fprintf(logfile, "start_data  0x" TARGET_ABI_FMT_lx "\n",
+                info->start_data);
+        fprintf(logfile, "end_data    0x" TARGET_ABI_FMT_lx "\n", info->end_data);
+        fprintf(logfile, "start_stack 0x" TARGET_ABI_FMT_lx "\n",
+                info->start_stack);
+        fprintf(logfile, "brk         0x" TARGET_ABI_FMT_lx "\n", info->brk);
+        fprintf(logfile, "entry       0x" TARGET_ABI_FMT_lx "\n", info->entry);
     }
 
     target_set_brk(info->brk);
@@ -1980,12 +2134,22 @@ int main(int argc, char **argv)
         env->cr[4] |= CR4_OSFXSR_MASK;
         env->hflags |= HF_OSFXSR_MASK;
     }
+#ifndef TARGET_ABI32
+    /* enable 64 bit mode if possible */
+    if (!(env->cpuid_ext2_features & CPUID_EXT2_LM)) {
+        fprintf(stderr, "The selected x86 CPU does not support 64 bit mode\n");
+        exit(1);
+    }
+    env->cr[4] |= CR4_PAE_MASK;
+    env->efer |= MSR_EFER_LMA | MSR_EFER_LME;
+    env->hflags |= HF_LMA_MASK;
+#endif
 
     /* flags setup : we activate the IRQs by default as in user mode */
     env->eflags |= IF_MASK;
 
     /* linux register setup */
-#if defined(TARGET_X86_64)
+#ifndef TARGET_ABI32
     env->regs[R_EAX] = regs->rax;
     env->regs[R_EBX] = regs->rbx;
     env->regs[R_ECX] = regs->rcx;
@@ -2033,29 +2197,44 @@ int main(int argc, char **argv)
     set_idt(0x80, 3);
 
     /* linux segment setup */
-    env->gdt.base = h2g(gdt_table);
-    env->gdt.limit = sizeof(gdt_table) - 1;
-    write_dt(&gdt_table[__USER_CS >> 3], 0, 0xfffff,
-             DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
-             (3 << DESC_DPL_SHIFT) | (0xa << DESC_TYPE_SHIFT));
-    write_dt(&gdt_table[__USER_DS >> 3], 0, 0xfffff,
-             DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
-             (3 << DESC_DPL_SHIFT) | (0x2 << DESC_TYPE_SHIFT));
+    {
+        uint64_t *gdt_table;
+        gdt_table = qemu_mallocz(sizeof(uint64_t) * TARGET_GDT_ENTRIES);
+        env->gdt.base = h2g((unsigned long)gdt_table);
+        env->gdt.limit = sizeof(uint64_t) * TARGET_GDT_ENTRIES - 1;
+#ifdef TARGET_ABI32
+        write_dt(&gdt_table[__USER_CS >> 3], 0, 0xfffff,
+                 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
+                 (3 << DESC_DPL_SHIFT) | (0xa << DESC_TYPE_SHIFT));
+#else
+        /* 64 bit code segment */
+        write_dt(&gdt_table[__USER_CS >> 3], 0, 0xfffff,
+                 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
+                 DESC_L_MASK |
+                 (3 << DESC_DPL_SHIFT) | (0xa << DESC_TYPE_SHIFT));
+#endif
+        write_dt(&gdt_table[__USER_DS >> 3], 0, 0xfffff,
+                 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
+                 (3 << DESC_DPL_SHIFT) | (0x2 << DESC_TYPE_SHIFT));
+    }
     cpu_x86_load_seg(env, R_CS, __USER_CS);
+    cpu_x86_load_seg(env, R_SS, __USER_DS);
+#ifdef TARGET_ABI32
     cpu_x86_load_seg(env, R_DS, __USER_DS);
     cpu_x86_load_seg(env, R_ES, __USER_DS);
-    cpu_x86_load_seg(env, R_SS, __USER_DS);
     cpu_x86_load_seg(env, R_FS, __USER_DS);
     cpu_x86_load_seg(env, R_GS, __USER_DS);
-
     /* This hack makes Wine work... */
     env->segs[R_FS].selector = 0;
+#else
+    cpu_x86_load_seg(env, R_DS, 0);
+    cpu_x86_load_seg(env, R_ES, 0);
+    cpu_x86_load_seg(env, R_FS, 0);
+    cpu_x86_load_seg(env, R_GS, 0);
+#endif
 #elif defined(TARGET_ARM)
     {
         int i;
-        if (cpu_model == NULL)
-            cpu_model = "arm926";
-        cpu_arm_set_model(env, cpu_model);
         cpsr_write(env, regs->uregs[16], 0xffffffff);
         for(i = 0; i < 16; i++) {
             env->regs[i] = regs->uregs[i];
@@ -2064,20 +2243,6 @@ int main(int argc, char **argv)
 #elif defined(TARGET_SPARC)
     {
         int i;
-        const sparc_def_t *def;
-#ifdef TARGET_SPARC64
-        if (cpu_model == NULL)
-            cpu_model = "TI UltraSparc II";
-#else
-        if (cpu_model == NULL)
-            cpu_model = "Fujitsu MB86904";
-#endif
-        sparc_find_by_name(cpu_model, &def);
-        if (def == NULL) {
-            fprintf(stderr, "Unable to find Sparc CPU definition\n");
-            exit(1);
-        }
-        cpu_sparc_register(env, def);
 	env->pc = regs->pc;
 	env->npc = regs->npc;
         env->y = regs->y;
@@ -2088,25 +2253,14 @@ int main(int argc, char **argv)
     }
 #elif defined(TARGET_PPC)
     {
-        ppc_def_t *def;
         int i;
 
-        /* Choose and initialise CPU */
-        if (cpu_model == NULL)
-            cpu_model = "750";
-        ppc_find_by_name(cpu_model, &def);
-        if (def == NULL) {
-            cpu_abort(env,
-                      "Unable to find PowerPC CPU definition\n");
-        }
-        cpu_ppc_register(env, def);
-
-        for (i = 0; i < 32; i++) {
-            if (i != 12 && i != 6 && i != 13)
-                env->msr[i] = (regs->msr >> i) & 1;
-        }
 #if defined(TARGET_PPC64)
-        msr_sf = 1;
+#if defined(TARGET_ABI32)
+        env->msr &= ~((target_ulong)1 << MSR_SF);
+#else
+        env->msr |= (target_ulong)1 << MSR_SF;
+#endif
 #endif
         env->nip = regs->nip;
         for(i = 0; i < 32; i++) {
@@ -2115,12 +2269,6 @@ int main(int argc, char **argv)
     }
 #elif defined(TARGET_M68K)
     {
-        if (cpu_model == NULL)
-            cpu_model = "any";
-        if (cpu_m68k_set_model(env, cpu_model)) {
-            cpu_abort(cpu_single_env,
-                      "Unable to find m68k CPU definition\n");
-        }
         env->pc = regs->pc;
         env->dregs[0] = regs->d0;
         env->dregs[1] = regs->d1;
@@ -2143,21 +2291,8 @@ int main(int argc, char **argv)
     }
 #elif defined(TARGET_MIPS)
     {
-        mips_def_t *def;
         int i;
 
-        /* Choose and initialise CPU */
-        if (cpu_model == NULL)
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
-            cpu_model = "20Kc";
-#else
-            cpu_model = "24Kf";
-#endif
-        mips_find_by_name(cpu_model, &def);
-        if (def == NULL)
-            cpu_abort(env, "Unable to find MIPS CPU definition\n");
-        cpu_mips_register(env, def);
-
         for(i = 0; i < 32; i++) {
             env->gpr[i][env->current_tc] = regs->regs[i];
         }
@@ -2177,13 +2312,33 @@ int main(int argc, char **argv)
         int i;
 
         for(i = 0; i < 28; i++) {
-            env->ir[i] = ((target_ulong *)regs)[i];
+            env->ir[i] = ((abi_ulong *)regs)[i];
         }
         env->ipr[IPR_USP] = regs->usp;
         env->ir[30] = regs->usp;
         env->pc = regs->pc;
         env->unique = regs->unique;
     }
+#elif defined(TARGET_CRIS)
+    {
+	    env->regs[0] = regs->r0;
+	    env->regs[1] = regs->r1;
+	    env->regs[2] = regs->r2;
+	    env->regs[3] = regs->r3;
+	    env->regs[4] = regs->r4;
+	    env->regs[5] = regs->r5;
+	    env->regs[6] = regs->r6;
+	    env->regs[7] = regs->r7;
+	    env->regs[8] = regs->r8;
+	    env->regs[9] = regs->r9;
+	    env->regs[10] = regs->r10;
+	    env->regs[11] = regs->r11;
+	    env->regs[12] = regs->r12;
+	    env->regs[13] = regs->r13;
+	    env->regs[14] = info->start_stack;
+	    env->regs[15] = regs->acr;	    
+	    env->pc = regs->erp;
+    }
 #else
 #error unsupported target CPU
 #endif
diff --git a/linux-user/mips/syscall.h b/linux-user/mips/syscall.h
index a789348db..9dfcc1f20 100644
--- a/linux-user/mips/syscall.h
+++ b/linux-user/mips/syscall.h
@@ -4,18 +4,18 @@
 
 struct target_pt_regs {
 	/* Pad bytes for argument save space on the stack. */
-	target_ulong pad0[6];
+	abi_ulong pad0[6];
 
 	/* Saved main processor registers. */
-	target_ulong regs[32];
+	abi_ulong regs[32];
 
 	/* Saved special registers. */
-	target_ulong cp0_status;
-	target_ulong lo;
-	target_ulong hi;
-	target_ulong cp0_badvaddr;
-	target_ulong cp0_cause;
-	target_ulong cp0_epc;
+	abi_ulong cp0_status;
+	abi_ulong lo;
+	abi_ulong hi;
+	abi_ulong cp0_badvaddr;
+	abi_ulong cp0_cause;
+	abi_ulong cp0_epc;
 };
 
 /* Target errno definitions taken from asm-mips/errno.h */
diff --git a/linux-user/mips/target_signal.h b/linux-user/mips/target_signal.h
index 514195c03..3b06e9824 100644
--- a/linux-user/mips/target_signal.h
+++ b/linux-user/mips/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_long ss_sp;
-	target_ulong ss_size;
-	target_long ss_flags;
+	abi_long ss_sp;
+	abi_ulong ss_size;
+	abi_long ss_flags;
 } target_stack_t;
 
 
@@ -21,7 +21,7 @@ typedef struct target_sigaltstack {
 #define TARGET_MINSIGSTKSZ    2048
 #define TARGET_SIGSTKSZ       8192
 
-static inline target_ulong get_sp_from_cpustate(CPUMIPSState *state)
+static inline abi_ulong get_sp_from_cpustate(CPUMIPSState *state)
 {
     return state->gpr[29][state->current_tc];
 }
diff --git a/linux-user/mips64/syscall.h b/linux-user/mips64/syscall.h
index 4ec506cb0..668a2b95d 100644
--- a/linux-user/mips64/syscall.h
+++ b/linux-user/mips64/syscall.h
@@ -4,15 +4,15 @@
 
 struct target_pt_regs {
 	/* Saved main processor registers. */
-	target_ulong regs[32];
+	abi_ulong regs[32];
 
 	/* Saved special registers. */
-	target_ulong cp0_status;
-	target_ulong lo;
-	target_ulong hi;
-	target_ulong cp0_badvaddr;
-	target_ulong cp0_cause;
-	target_ulong cp0_epc;
+	abi_ulong cp0_status;
+	abi_ulong lo;
+	abi_ulong hi;
+	abi_ulong cp0_badvaddr;
+	abi_ulong cp0_cause;
+	abi_ulong cp0_epc;
 };
 
 /* Target errno definitions taken from asm-mips/errno.h */
diff --git a/linux-user/mips64/target_signal.h b/linux-user/mips64/target_signal.h
index 514195c03..3b06e9824 100644
--- a/linux-user/mips64/target_signal.h
+++ b/linux-user/mips64/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_long ss_sp;
-	target_ulong ss_size;
-	target_long ss_flags;
+	abi_long ss_sp;
+	abi_ulong ss_size;
+	abi_long ss_flags;
 } target_stack_t;
 
 
@@ -21,7 +21,7 @@ typedef struct target_sigaltstack {
 #define TARGET_MINSIGSTKSZ    2048
 #define TARGET_SIGSTKSZ       8192
 
-static inline target_ulong get_sp_from_cpustate(CPUMIPSState *state)
+static inline abi_ulong get_sp_from_cpustate(CPUMIPSState *state)
 {
     return state->gpr[29][state->current_tc];
 }
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index ea916b80a..6292826b4 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -30,14 +30,14 @@
 //#define DEBUG_MMAP
 
 /* NOTE: all the constants are the HOST ones, but addresses are target. */
-int target_mprotect(target_ulong start, target_ulong len, int prot)
+int target_mprotect(abi_ulong start, abi_ulong len, int prot)
 {
-    target_ulong end, host_start, host_end, addr;
+    abi_ulong end, host_start, host_end, addr;
     int prot1, ret;
 
 #ifdef DEBUG_MMAP
     printf("mprotect: start=0x" TARGET_FMT_lx
-	   "len=0x" TARGET_FMT_lx " prot=%c%c%c\n", start, len,
+           "len=0x" TARGET_FMT_lx " prot=%c%c%c\n", start, len,
            prot & PROT_READ ? 'r' : '-',
            prot & PROT_WRITE ? 'w' : '-',
            prot & PROT_EXEC ? 'x' : '-');
@@ -96,11 +96,11 @@ int target_mprotect(target_ulong start, target_ulong len, int prot)
 }
 
 /* map an incomplete host page */
-static int mmap_frag(target_ulong real_start,
-                     target_ulong start, target_ulong end,
-                     int prot, int flags, int fd, target_ulong offset)
+static int mmap_frag(abi_ulong real_start,
+                     abi_ulong start, abi_ulong end,
+                     int prot, int flags, int fd, abi_ulong offset)
 {
-    target_ulong real_end, ret, addr;
+    abi_ulong real_end, addr;
     void *host_start;
     int prot1, prot_new;
 
@@ -116,10 +116,10 @@ static int mmap_frag(target_ulong real_start,
 
     if (prot1 == 0) {
         /* no page was there, so we allocate one */
-        ret = (long)mmap(host_start, qemu_host_page_size, prot,
-                         flags | MAP_ANONYMOUS, -1, 0);
-        if (ret == -1)
-            return ret;
+        void *p = mmap(host_start, qemu_host_page_size, prot,
+                       flags | MAP_ANONYMOUS, -1, 0);
+        if (p == MAP_FAILED)
+            return -1;
         prot1 = prot;
     }
     prot1 &= PAGE_BITS;
@@ -151,24 +151,58 @@ static int mmap_frag(target_ulong real_start,
     return 0;
 }
 
+#if defined(__CYGWIN__)
+/* Cygwin doesn't have a whole lot of address space.  */
+static abi_ulong mmap_next_start = 0x18000000;
+#else
+static abi_ulong mmap_next_start = 0x40000000;
+#endif
+
+/* find a free memory area of size 'size'. The search starts at
+   'start'. If 'start' == 0, then a default start address is used.
+   Return -1 if error.
+*/
+/* page_init() marks pages used by the host as reserved to be sure not
+   to use them. */
+static abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size)
+{
+    abi_ulong addr, addr1, addr_start;
+    int prot;
+
+    size = HOST_PAGE_ALIGN(size);
+    start = start & qemu_host_page_mask;
+    addr = start;
+    if (addr == 0)
+        addr = mmap_next_start;
+    addr_start = addr;
+    for(;;) {
+        prot = 0;
+        for(addr1 = addr; addr1 < (addr + size); addr1 += TARGET_PAGE_SIZE) {
+            prot |= page_get_flags(addr1);
+        }
+        if (prot == 0)
+            break;
+        addr += qemu_host_page_size;
+        /* we found nothing */
+        if (addr == addr_start)
+            return (abi_ulong)-1;
+    }
+    if (start == 0)
+        mmap_next_start = addr + size;
+    return addr;
+}
+
 /* NOTE: all the constants are the HOST ones */
-target_long target_mmap(target_ulong start, target_ulong len, int prot,
-                 int flags, int fd, target_ulong offset)
+abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
+                     int flags, int fd, abi_ulong offset)
 {
-    target_ulong ret, end, real_start, real_end, retaddr, host_offset, host_len;
+    abi_ulong ret, end, real_start, real_end, retaddr, host_offset, host_len;
     unsigned long host_start;
-#if defined(__alpha__) || defined(__sparc__) || defined(__x86_64__) || \
-        defined(__ia64) || defined(__mips__)
-    static target_ulong last_start = 0x40000000;
-#elif defined(__CYGWIN__)
-    /* Cygwin doesn't have a whole lot of address space.  */
-    static target_ulong last_start = 0x18000000;
-#endif
 
 #ifdef DEBUG_MMAP
     {
         printf("mmap: start=0x" TARGET_FMT_lx
-	       " len=0x" TARGET_FMT_lx " prot=%c%c%c flags=",
+               " len=0x" TARGET_FMT_lx " prot=%c%c%c flags=",
                start, len,
                prot & PROT_READ ? 'r' : '-',
                prot & PROT_WRITE ? 'w' : '-',
@@ -203,145 +237,101 @@ target_long target_mmap(target_ulong start, target_ulong len, int prot,
     real_start = start & qemu_host_page_mask;
 
     if (!(flags & MAP_FIXED)) {
-#if defined(__alpha__) || defined(__sparc__) || defined(__x86_64__) || \
-    defined(__ia64) || defined(__mips__) || defined(__CYGWIN__)
-        /* tell the kernel to search at the same place as i386 */
-        if (real_start == 0) {
-            real_start = last_start;
-            last_start += HOST_PAGE_ALIGN(len);
-        }
-#endif
-            host_offset = offset & qemu_host_page_mask;
-            host_len = len + offset - host_offset;
-
-        if (qemu_host_page_size > qemu_real_host_page_size) {
-            /*
-             * The guest expects to see mmapped areas aligned to it's pagesize.
-             * If the host's real page size is smaller than the guest's, we need
-             * to fixup the maps. It is done by allocating a larger area,
-             * displacing the map (if needed) and finally chopping off the spare
-             * room at the edges.
-             */
-
-            /*
-             * We assume qemu_host_page_size is always the same as
-             * TARGET_PAGE_SIZE, see exec.c. qemu_real_host_page_size is the
-             * hosts real page size.
-             */
-            target_ulong host_end;
-            unsigned long host_aligned_start;
-
-            host_len = HOST_PAGE_ALIGN(host_len + qemu_host_page_size
-                                       - qemu_real_host_page_size);
-            host_start = (unsigned long) mmap(real_start ?
-					      g2h(real_start) : NULL,
-					      host_len, prot, flags,
-					      fd, host_offset);
-            if (host_start == -1)
-                return -1;
-
-            host_end = host_start + host_len;
-
-            /* Find start and end, aligned to the targets pagesize with-in the
-               large mmaped area.  */
-            host_aligned_start = TARGET_PAGE_ALIGN(host_start);
-            if (!(flags & MAP_ANONYMOUS))
-                host_aligned_start += offset - host_offset;
-
-            start = h2g(host_aligned_start);
-            end = start + TARGET_PAGE_ALIGN(len);
-
-            /* Chop off the leftovers, if any.  */
-            if (host_aligned_start > host_start)
-                munmap((void *)host_start, host_aligned_start - host_start);
-            if (end < host_end)
-                munmap((void *)g2h(end), host_end - end);
-
-            goto the_end1;
-        } else {
-            /* if not fixed, no need to do anything */
-            host_start = (long)mmap(real_start ? g2h(real_start) : NULL,
-                                    host_len, prot, flags, fd, host_offset);
-            if (host_start == -1)
-                return -1;
-            /* update start so that it points to the file position at 'offset' */
-            if (!(flags & MAP_ANONYMOUS))
-                host_start += offset - host_offset;
-            start = h2g(host_start);
-            goto the_end1;
+        abi_ulong mmap_start;
+        void *p;
+        host_offset = offset & qemu_host_page_mask;
+        host_len = len + offset - host_offset;
+        host_len = HOST_PAGE_ALIGN(host_len);
+        mmap_start = mmap_find_vma(real_start, host_len);
+        if (mmap_start == (abi_ulong)-1) {
+            errno = ENOMEM;
+            return -1;
         }
-    }
-
-    if (start & ~TARGET_PAGE_MASK) {
-        errno = EINVAL;
-        return -1;
-    }
-    end = start + len;
-    real_end = HOST_PAGE_ALIGN(end);
-
-    /* worst case: we cannot map the file because the offset is not
-       aligned, so we read it */
-    if (!(flags & MAP_ANONYMOUS) &&
-        (offset & ~qemu_host_page_mask) != (start & ~qemu_host_page_mask)) {
-        /* msync() won't work here, so we return an error if write is
-           possible while it is a shared mapping */
-        if ((flags & MAP_TYPE) == MAP_SHARED &&
-            (prot & PROT_WRITE)) {
+        /* Note: we prefer to control the mapping address. It is
+           especially important if qemu_host_page_size >
+           qemu_real_host_page_size */
+        p = mmap(g2h(mmap_start),
+                 host_len, prot, flags | MAP_FIXED, fd, host_offset);
+        if (p == MAP_FAILED)
+            return -1;
+        /* update start so that it points to the file position at 'offset' */
+        host_start = (unsigned long)p;
+        if (!(flags & MAP_ANONYMOUS))
+            host_start += offset - host_offset;
+        start = h2g(host_start);
+    } else {
+        if (start & ~TARGET_PAGE_MASK) {
             errno = EINVAL;
             return -1;
         }
-        retaddr = target_mmap(start, len, prot | PROT_WRITE,
-                              MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS,
-                              -1, 0);
-        if (retaddr == -1)
-            return -1;
-        pread(fd, g2h(start), len, offset);
-        if (!(prot & PROT_WRITE)) {
-            ret = target_mprotect(start, len, prot);
-            if (ret != 0)
-                return ret;
+        end = start + len;
+        real_end = HOST_PAGE_ALIGN(end);
+        
+        /* worst case: we cannot map the file because the offset is not
+           aligned, so we read it */
+        if (!(flags & MAP_ANONYMOUS) &&
+            (offset & ~qemu_host_page_mask) != (start & ~qemu_host_page_mask)) {
+            /* msync() won't work here, so we return an error if write is
+               possible while it is a shared mapping */
+            if ((flags & MAP_TYPE) == MAP_SHARED &&
+                (prot & PROT_WRITE)) {
+                errno = EINVAL;
+                return -1;
+            }
+            retaddr = target_mmap(start, len, prot | PROT_WRITE,
+                                  MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS,
+                                  -1, 0);
+            if (retaddr == -1)
+                return -1;
+            pread(fd, g2h(start), len, offset);
+            if (!(prot & PROT_WRITE)) {
+                ret = target_mprotect(start, len, prot);
+                if (ret != 0)
+                    return ret;
+            }
+            goto the_end;
         }
-        goto the_end;
-    }
-
-    /* handle the start of the mapping */
-    if (start > real_start) {
-        if (real_end == real_start + qemu_host_page_size) {
-            /* one single host page */
-            ret = mmap_frag(real_start, start, end,
+        
+        /* handle the start of the mapping */
+        if (start > real_start) {
+            if (real_end == real_start + qemu_host_page_size) {
+                /* one single host page */
+                ret = mmap_frag(real_start, start, end,
+                                prot, flags, fd, offset);
+                if (ret == -1)
+                    return ret;
+                goto the_end1;
+            }
+            ret = mmap_frag(real_start, start, real_start + qemu_host_page_size,
                             prot, flags, fd, offset);
             if (ret == -1)
                 return ret;
-            goto the_end1;
+            real_start += qemu_host_page_size;
+        }
+        /* handle the end of the mapping */
+        if (end < real_end) {
+            ret = mmap_frag(real_end - qemu_host_page_size,
+                            real_end - qemu_host_page_size, real_end,
+                            prot, flags, fd,
+                            offset + real_end - qemu_host_page_size - start);
+            if (ret == -1)
+                return -1;
+            real_end -= qemu_host_page_size;
         }
-        ret = mmap_frag(real_start, start, real_start + qemu_host_page_size,
-                        prot, flags, fd, offset);
-        if (ret == -1)
-            return ret;
-        real_start += qemu_host_page_size;
-    }
-    /* handle the end of the mapping */
-    if (end < real_end) {
-        ret = mmap_frag(real_end - qemu_host_page_size,
-                        real_end - qemu_host_page_size, real_end,
-                        prot, flags, fd,
-                        offset + real_end - qemu_host_page_size - start);
-        if (ret == -1)
-            return -1;
-        real_end -= qemu_host_page_size;
-    }
 
-    /* map the middle (easier) */
-    if (real_start < real_end) {
-        unsigned long offset1;
-	if (flags & MAP_ANONYMOUS)
-	  offset1 = 0;
-	else
-	  offset1 = offset + real_start - start;
-        ret = (long)mmap(g2h(real_start), real_end - real_start,
-                         prot, flags, fd, offset1);
-        if (ret == -1)
-            return -1;
+        /* map the middle (easier) */
+        if (real_start < real_end) {
+            void *p;
+            unsigned long offset1;
+            if (flags & MAP_ANONYMOUS)
+                offset1 = 0;
+            else
+                offset1 = offset + real_start - start;
+            p = mmap(g2h(real_start), real_end - real_start,
+                     prot, flags, fd, offset1);
+            if (p == MAP_FAILED)
+                return -1;
+        }
     }
  the_end1:
     page_set_flags(start, start + len, prot | PAGE_VALID);
@@ -354,9 +344,9 @@ target_long target_mmap(target_ulong start, target_ulong len, int prot,
     return start;
 }
 
-int target_munmap(target_ulong start, target_ulong len)
+int target_munmap(abi_ulong start, abi_ulong len)
 {
-    target_ulong end, real_start, real_end, addr;
+    abi_ulong end, real_start, real_end, addr;
     int prot, ret;
 
 #ifdef DEBUG_MMAP
@@ -408,9 +398,9 @@ int target_munmap(target_ulong start, target_ulong len)
 
 /* XXX: currently, we only handle MAP_ANONYMOUS and not MAP_FIXED
    blocks which have been allocated starting on a host page */
-target_long target_mremap(target_ulong old_addr, target_ulong old_size,
-                   target_ulong new_size, unsigned long flags,
-                   target_ulong new_addr)
+abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
+                       abi_ulong new_size, unsigned long flags,
+                       abi_ulong new_addr)
 {
     int prot;
     unsigned long host_addr;
@@ -426,9 +416,9 @@ target_long target_mremap(target_ulong old_addr, target_ulong old_size,
     return new_addr;
 }
 
-int target_msync(target_ulong start, target_ulong len, int flags)
+int target_msync(abi_ulong start, abi_ulong len, int flags)
 {
-    target_ulong end;
+    abi_ulong end;
 
     if (start & ~TARGET_PAGE_MASK)
         return -EINVAL;
diff --git a/linux-user/ppc/syscall.h b/linux-user/ppc/syscall.h
index bf6b21b2f..2035dfbfd 100644
--- a/linux-user/ppc/syscall.h
+++ b/linux-user/ppc/syscall.h
@@ -26,29 +26,37 @@
 #define __USER_DS	(1)
 
 struct target_pt_regs {
-	unsigned long gpr[32];
-	unsigned long nip;
-	unsigned long msr;
-	unsigned long orig_gpr3;	/* Used for restarting system calls */
-	unsigned long ctr;
-	unsigned long link;
-	unsigned long xer;
-	unsigned long ccr;
-	unsigned long mq;		/* 601 only (not used at present) */
+	abi_ulong gpr[32];
+	abi_ulong nip;
+	abi_ulong msr;
+	abi_ulong orig_gpr3;	/* Used for restarting system calls */
+	abi_ulong ctr;
+	abi_ulong link;
+	abi_ulong xer;
+	abi_ulong ccr;
+#if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
+        abi_ulong softe;
+#else
+	abi_ulong mq;		/* 601 only (not used at present) */
+#endif
 					/* Used on APUS to hold IPL value. */
-	unsigned long trap;		/* Reason for being here */
-	unsigned long dar;		/* Fault registers */
-	unsigned long dsisr;
-	unsigned long result; 		/* Result of a system call */
+	abi_ulong trap;		/* Reason for being here */
+	abi_ulong dar;		/* Fault registers */
+	abi_ulong dsisr;
+	abi_ulong result; 		/* Result of a system call */
 };
 
 /* ioctls */
 struct target_revectored_struct {
-	target_ulong __map[8];			/* 256 bits */
+	abi_ulong __map[8];			/* 256 bits */
 };
 
 /*
  * flags masks
  */
 
+#if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
+#define UNAME_MACHINE "ppc64"
+#else
 #define UNAME_MACHINE "ppc"
+#endif
diff --git a/linux-user/ppc/syscall_nr.h b/linux-user/ppc/syscall_nr.h
index 1e5ced713..8fa5bef3b 100644
--- a/linux-user/ppc/syscall_nr.h
+++ b/linux-user/ppc/syscall_nr.h
@@ -193,19 +193,23 @@
 #define TARGET_NR_vfork                  189
 #define TARGET_NR_ugetrlimit             190     /* SuS compliant getrlimit */
 #define TARGET_NR_readahead              191
+#if !defined(TARGET_PPC64) || defined(TARGET_ABI32)
 #define TARGET_NR_mmap2                  192
 #define TARGET_NR_truncate64             193
 #define TARGET_NR_ftruncate64            194
 #define TARGET_NR_stat64                 195
 #define TARGET_NR_lstat64                196
 #define TARGET_NR_fstat64                197
+#endif
 #define TARGET_NR_pciconfig_read         198
 #define TARGET_NR_pciconfig_write        199
 #define TARGET_NR_pciconfig_iobase       200
 #define TARGET_NR_multiplexer            201
 #define TARGET_NR_getdents64             202
 #define TARGET_NR_pivot_root             203
+#if !defined(TARGET_PPC64) || defined(TARGET_ABI32)
 #define TARGET_NR_fcntl64                204
+#endif
 #define TARGET_NR_madvise                205
 #define TARGET_NR_mincore                206
 #define TARGET_NR_gettid                 207
@@ -227,7 +231,9 @@
 #define TARGET_NR_sched_getaffinity      223
 /* 224 currently unused */
 #define TARGET_NR_tuxcall                225
+#if !defined(TARGET_PPC64) || defined(TARGET_ABI32)
 #define TARGET_NR_sendfile64             226
+#endif
 #define TARGET_NR_io_setup               227
 #define TARGET_NR_io_destroy             228
 #define TARGET_NR_io_getevents           229
@@ -255,7 +261,9 @@
 #define TARGET_NR_utimes                 251
 #define TARGET_NR_statfs64               252
 #define TARGET_NR_fstatfs64              253
+#if !defined(TARGET_PPC64) || defined(TARGET_ABI32)
 #define TARGET_NR_fadvise64_64           254
+#endif
 #define TARGET_NR_rtas		255
 #define TARGET_NR_sys_debug_setcontext 256
 /* Number 257 is reserved for vserver */
@@ -292,7 +300,11 @@
 #define TARGET_NR_mknodat		288
 #define TARGET_NR_fchownat		289
 #define TARGET_NR_futimesat		290
+#if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
+#define TARGET_NR_newfstatat		291
+#else
 #define TARGET_NR_fstatat64		291
+#endif
 #define TARGET_NR_unlinkat		292
 #define TARGET_NR_renameat		293
 #define TARGET_NR_linkat		294
diff --git a/linux-user/ppc/target_signal.h b/linux-user/ppc/target_signal.h
index 80ad21187..a93b5cf1d 100644
--- a/linux-user/ppc/target_signal.h
+++ b/linux-user/ppc/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_ulong ss_sp;
-	target_long ss_flags;
-	target_ulong ss_size;
+	abi_ulong ss_sp;
+	int ss_flags;
+	abi_ulong ss_size;
 } target_stack_t;
 
 
@@ -21,7 +21,7 @@ typedef struct target_sigaltstack {
 #define TARGET_MINSIGSTKSZ    2048
 #define TARGET_SIGSTKSZ       8192
 
-static inline target_ulong get_sp_from_cpustate(CPUPPCState *state)
+static inline abi_ulong get_sp_from_cpustate(CPUPPCState *state)
 {
     return state->gpr[1];
 }
diff --git a/linux-user/ppc64/syscall.h b/linux-user/ppc64/syscall.h
deleted file mode 100644
index c47e58a95..000000000
--- a/linux-user/ppc64/syscall.h
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- *  PPC emulation for qemu: syscall definitions.
- *
- *  Copyright (c) 2003 Jocelyn Mayer
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-
-/* XXX: ABSOLUTELY BUGGY:
- * for now, this is quite just a cut-and-paste from i386 target...
- */
-
-/* default linux values for the selectors */
-#define __USER_DS	(1)
-
-struct target_pt_regs {
-	unsigned long gpr[32];
-	unsigned long nip;
-	unsigned long msr;
-	unsigned long orig_gpr3;	/* Used for restarting system calls */
-	unsigned long ctr;
-	unsigned long link;
-	unsigned long xer;
-	unsigned long ccr;
-	unsigned long mq;		/* 601 only (not used at present) */
-					/* Used on APUS to hold IPL value. */
-	unsigned long trap;		/* Reason for being here */
-	unsigned long dar;		/* Fault registers */
-	unsigned long dsisr;
-	unsigned long result; 		/* Result of a system call */
-};
-
-/* ioctls */
-struct target_revectored_struct {
-	target_ulong __map[8];			/* 256 bits */
-};
-
-/*
- * flags masks
- */
-
-/* ipcs */
-
-#define TARGET_SEMOP           1
-#define TARGET_SEMGET          2
-#define TARGET_SEMCTL          3
-#define TARGET_MSGSND          11
-#define TARGET_MSGRCV          12
-#define TARGET_MSGGET          13
-#define TARGET_MSGCTL          14
-#define TARGET_SHMAT           21
-#define TARGET_SHMDT           22
-#define TARGET_SHMGET          23
-#define TARGET_SHMCTL          24
-
-#if 0 // To make it compile, even if the definition in syscall.c is bugged
-struct target_msgbuf {
-	int mtype;
-	char mtext[1];
-};
-#endif
-
-struct target_ipc_kludge {
-	unsigned int	msgp;	/* Really (struct msgbuf *) */
-	int msgtyp;
-};
-
-#if 0 // To make it compile, even if the definition in syscall.c is bugged
-struct target_ipc_perm {
-	int	__key;
-	unsigned short	uid;
-	unsigned short	gid;
-	unsigned short	cuid;
-	unsigned short	cgid;
-	unsigned short	mode;
-	unsigned short	seq;
-};
-#endif
-
-#if 0 // To make it compile, even if the definition in syscall.c is bugged
-struct target_msqid_ds {
-	struct target_ipc_perm	msg_perm;
-	unsigned int		msg_first;	/* really struct target_msg* */
-	unsigned int		msg_last;	/* really struct target_msg* */
-	unsigned int		msg_stime;	/* really target_time_t */
-	unsigned int		msg_rtime;	/* really target_time_t */
-	unsigned int		msg_ctime;	/* really target_time_t */
-	unsigned int		wwait;		/* really struct wait_queue* */
-	unsigned int		rwait;		/* really struct wait_queue* */
-	unsigned short		msg_cbytes;
-	unsigned short		msg_qnum;
-	unsigned short		msg_qbytes;
-	unsigned short		msg_lspid;
-	unsigned short		msg_lrpid;
-};
-#endif
-
-#if 0 // To make it compile, even if the definition in syscall.c is bugged
-struct target_shmid_ds {
-	struct target_ipc_perm	shm_perm;
-	int			shm_segsz;
-	unsigned int		shm_atime;	/* really target_time_t */
-	unsigned int		shm_dtime;	/* really target_time_t */
-	unsigned int		shm_ctime;	/* really target_time_t */
-	unsigned short		shm_cpid;
-	unsigned short		shm_lpid;
-	short			shm_nattch;
-	unsigned short		shm_npages;
-	unsigned long		*shm_pages;
-	void 			*attaches;	/* really struct shm_desc * */
-};
-#endif
-
-#define TARGET_IPC_RMID	0
-#define TARGET_IPC_SET	1
-#define TARGET_IPC_STAT	2
-
-#define UNAME_MACHINE "ppc64"
diff --git a/linux-user/ppc64/syscall_nr.h b/linux-user/ppc64/syscall_nr.h
deleted file mode 100644
index d78ce5394..000000000
--- a/linux-user/ppc64/syscall_nr.h
+++ /dev/null
@@ -1,313 +0,0 @@
-/*
- * This file contains the system call numbers.
- */
-#define TARGET_NR_restart_syscall          0
-#define TARGET_NR_exit                     1
-#define TARGET_NR_fork                     2
-#define TARGET_NR_read                     3
-#define TARGET_NR_write                    4
-#define TARGET_NR_open                     5
-#define TARGET_NR_close                    6
-#define TARGET_NR_waitpid                  7
-#define TARGET_NR_creat                    8
-#define TARGET_NR_link                     9
-#define TARGET_NR_unlink                  10
-#define TARGET_NR_execve                  11
-#define TARGET_NR_chdir                   12
-#define TARGET_NR_time                    13
-#define TARGET_NR_mknod                   14
-#define TARGET_NR_chmod                   15
-#define TARGET_NR_lchown32                16
-#define TARGET_NR_break                   17
-#define TARGET_NR_oldstat                 18
-#define TARGET_NR_lseek                   19
-#define TARGET_NR_getpid                  20
-#define TARGET_NR_mount                   21
-#define TARGET_NR_umount                  22
-#define TARGET_NR_setuid32                23
-#define TARGET_NR_getuid32                24
-#define TARGET_NR_stime                   25
-#define TARGET_NR_ptrace                  26
-#define TARGET_NR_alarm                   27
-#define TARGET_NR_oldfstat                28
-#define TARGET_NR_pause                   29
-#define TARGET_NR_utime                   30
-#define TARGET_NR_stty                    31
-#define TARGET_NR_gtty                    32
-#define TARGET_NR_access                  33
-#define TARGET_NR_nice                    34
-#define TARGET_NR_ftime                   35
-#define TARGET_NR_sync                    36
-#define TARGET_NR_kill                    37
-#define TARGET_NR_rename                  38
-#define TARGET_NR_mkdir                   39
-#define TARGET_NR_rmdir                   40
-#define TARGET_NR_dup                     41
-#define TARGET_NR_pipe                    42
-#define TARGET_NR_times                   43
-#define TARGET_NR_prof                    44
-#define TARGET_NR_brk                     45
-#define TARGET_NR_setgid32                46
-#define TARGET_NR_getgid32                47
-#define TARGET_NR_signal                  48
-#define TARGET_NR_geteuid32               49
-#define TARGET_NR_getegid32               50
-#define TARGET_NR_acct                    51
-#define TARGET_NR_umount2                 52
-#define TARGET_NR_lock                    53
-#define TARGET_NR_ioctl                   54
-#define TARGET_NR_fcntl                   55
-#define TARGET_NR_mpx                     56
-#define TARGET_NR_setpgid                 57
-#define TARGET_NR_ulimit                  58
-#define TARGET_NR_oldolduname             59
-#define TARGET_NR_umask                   60
-#define TARGET_NR_chroot                  61
-#define TARGET_NR_ustat                   62
-#define TARGET_NR_dup2                    63
-#define TARGET_NR_getppid                 64
-#define TARGET_NR_getpgrp                 65
-#define TARGET_NR_setsid                  66
-#define TARGET_NR_sigaction               67
-#define TARGET_NR_sgetmask                68
-#define TARGET_NR_ssetmask                69
-#define TARGET_NR_setreuid32              70
-#define TARGET_NR_setregid32              71
-#define TARGET_NR_sigsuspend              72
-#define TARGET_NR_sigpending              73
-#define TARGET_NR_sethostname             74
-#define TARGET_NR_setrlimit               75
-#define TARGET_NR_getrlimit               76
-#define TARGET_NR_getrusage               77
-#define TARGET_NR_gettimeofday            78
-#define TARGET_NR_settimeofday            79
-#define TARGET_NR_getgroups32             80
-#define TARGET_NR_setgroups32             81
-#define TARGET_NR_select                  82
-#define TARGET_NR_symlink                 83
-#define TARGET_NR_oldlstat                84
-#define TARGET_NR_readlink                85
-#define TARGET_NR_uselib                  86
-#define TARGET_NR_swapon                  87
-#define TARGET_NR_reboot                  88
-#define TARGET_NR_readdir                 89
-#define TARGET_NR_mmap                    90
-#define TARGET_NR_munmap                  91
-#define TARGET_NR_truncate                92
-#define TARGET_NR_ftruncate               93
-#define TARGET_NR_fchmod                  94
-#define TARGET_NR_fchown32                95
-#define TARGET_NR_getpriority             96
-#define TARGET_NR_setpriority             97
-#define TARGET_NR_profil                  98
-#define TARGET_NR_statfs                  99
-#define TARGET_NR_fstatfs                100
-#define TARGET_NR_ioperm                 101
-#define TARGET_NR_socketcall             102
-#define TARGET_NR_syslog                 103
-#define TARGET_NR_setitimer              104
-#define TARGET_NR_getitimer              105
-#define TARGET_NR_stat                   106
-#define TARGET_NR_lstat                  107
-#define TARGET_NR_fstat                  108
-#define TARGET_NR_olduname               109
-#define TARGET_NR_iopl                   110
-#define TARGET_NR_vhangup                111
-#define TARGET_NR_idle                   112
-#define TARGET_NR_vm86                   113
-#define TARGET_NR_wait4                  114
-#define TARGET_NR_swapoff                115
-#define TARGET_NR_sysinfo                116
-#define TARGET_NR_ipc                    117
-#define TARGET_NR_fsync                  118
-#define TARGET_NR_sigreturn              119
-#define TARGET_NR_clone                  120
-#define TARGET_NR_setdomainname          121
-#define TARGET_NR_uname                  122
-#define TARGET_NR_modify_ldt             123
-#define TARGET_NR_adjtimex               124
-#define TARGET_NR_mprotect               125
-#define TARGET_NR_sigprocmask            126
-#define TARGET_NR_create_module          127
-#define TARGET_NR_init_module            128
-#define TARGET_NR_delete_module          129
-#define TARGET_NR_get_kernel_syms        130
-#define TARGET_NR_quotactl               131
-#define TARGET_NR_getpgid                132
-#define TARGET_NR_fchdir                 133
-#define TARGET_NR_bdflush                134
-#define TARGET_NR_sysfs                  135
-#define TARGET_NR_personality            136
-#define TARGET_NR_afs_syscall            137 /* Syscall for Andrew File System */
-#define TARGET_NR_setfsuid32             138
-#define TARGET_NR_setfsgid32             139
-#define TARGET_NR__llseek                140
-#define TARGET_NR_getdents               141
-#define TARGET_NR__newselect             142
-#define TARGET_NR_flock                  143
-#define TARGET_NR_msync                  144
-#define TARGET_NR_readv                  145
-#define TARGET_NR_writev                 146
-#define TARGET_NR_getsid                 147
-#define TARGET_NR_fdatasync              148
-#define TARGET_NR__sysctl                149
-#define TARGET_NR_mlock                  150
-#define TARGET_NR_munlock                151
-#define TARGET_NR_mlockall               152
-#define TARGET_NR_munlockall             153
-#define TARGET_NR_sched_setparam         154
-#define TARGET_NR_sched_getparam         155
-#define TARGET_NR_sched_setscheduler     156
-#define TARGET_NR_sched_getscheduler     157
-#define TARGET_NR_sched_yield            158
-#define TARGET_NR_sched_get_priority_max 159
-#define TARGET_NR_sched_get_priority_min 160
-#define TARGET_NR_sched_rr_get_interval  161
-#define TARGET_NR_nanosleep              162
-#define TARGET_NR_mremap                 163
-#define TARGET_NR_setresuid32            164
-#define TARGET_NR_getresuid32            165
-#define TARGET_NR_query_module           166
-#define TARGET_NR_poll                   167
-#define TARGET_NR_nfsservctl             168
-#define TARGET_NR_setresgid32            169
-#define TARGET_NR_getresgid32            170
-#define TARGET_NR_prctl                  171
-#define TARGET_NR_rt_sigreturn           172
-#define TARGET_NR_rt_sigaction           173
-#define TARGET_NR_rt_sigprocmask         174
-#define TARGET_NR_rt_sigpending          175
-#define TARGET_NR_rt_sigtimedwait        176
-#define TARGET_NR_rt_sigqueueinfo        177
-#define TARGET_NR_rt_sigsuspend          178
-#define TARGET_NR_pread64                179
-#define TARGET_NR_pwrite64               180
-#define TARGET_NR_chown32                181
-#define TARGET_NR_getcwd                 182
-#define TARGET_NR_capget                 183
-#define TARGET_NR_capset                 184
-#define TARGET_NR_sigaltstack            185
-#define TARGET_NR_sendfile               186
-#define TARGET_NR_getpmsg                187     /* some people actually want streams */
-#define TARGET_NR_putpmsg                188     /* some people actually want streams */
-#define TARGET_NR_vfork                  189
-#define TARGET_NR_ugetrlimit             190     /* SuS compliant getrlimit */
-#define TARGET_NR_readahead              191
-#define TARGET_NR_mmap2                  192
-#define TARGET_NR_truncate64             193
-#define TARGET_NR_ftruncate64            194
-#define TARGET_NR_stat64                 195
-#define TARGET_NR_lstat64                196
-#define TARGET_NR_fstat64                197
-#define TARGET_NR_pciconfig_read         198
-#define TARGET_NR_pciconfig_write        199
-#define TARGET_NR_pciconfig_iobase       200
-#define TARGET_NR_multiplexer            201
-#define TARGET_NR_getdents64             202
-#define TARGET_NR_pivot_root             203
-#define TARGET_NR_fcntl64                204
-#define TARGET_NR_madvise                205
-#define TARGET_NR_mincore                206
-#define TARGET_NR_gettid                 207
-#define TARGET_NR_tkill                  208
-#define TARGET_NR_setxattr               209
-#define TARGET_NR_lsetxattr              210
-#define TARGET_NR_fsetxattr              211
-#define TARGET_NR_getxattr               212
-#define TARGET_NR_lgetxattr              213
-#define TARGET_NR_fgetxattr              214
-#define TARGET_NR_listxattr              215
-#define TARGET_NR_llistxattr             216
-#define TARGET_NR_flistxattr             217
-#define TARGET_NR_removexattr            218
-#define TARGET_NR_lremovexattr           219
-#define TARGET_NR_fremovexattr           220
-#define TARGET_NR_futex                  221
-#define TARGET_NR_sched_setaffinity      222
-#define TARGET_NR_sched_getaffinity      223
-/* 224 currently unused */
-#define TARGET_NR_tuxcall                225
-#define TARGET_NR_sendfile64             226
-#define TARGET_NR_io_setup               227
-#define TARGET_NR_io_destroy             228
-#define TARGET_NR_io_getevents           229
-#define TARGET_NR_io_submit              230
-#define TARGET_NR_io_cancel              231
-#define TARGET_NR_set_tid_address        232
-#define TARGET_NR_fadvise64              233
-#define TARGET_NR_exit_group             234
-#define TARGET_NR_lookup_dcookie         235
-#define TARGET_NR_epoll_create           236
-#define TARGET_NR_epoll_ctl              237
-#define TARGET_NR_epoll_wait             238
-#define TARGET_NR_remap_file_pages       239
-#define TARGET_NR_timer_create           240
-#define TARGET_NR_timer_settime          241
-#define TARGET_NR_timer_gettime          242
-#define TARGET_NR_timer_getoverrun       243
-#define TARGET_NR_timer_delete           244
-#define TARGET_NR_clock_settime          245
-#define TARGET_NR_clock_gettime          246
-#define TARGET_NR_clock_getres           247
-#define TARGET_NR_clock_nanosleep        248
-#define TARGET_NR_swapcontext            249
-#define TARGET_NR_tgkill                 250
-#define TARGET_NR_utimes                 251
-#define TARGET_NR_statfs64               252
-#define TARGET_NR_fstatfs64              253
-#define TARGET_NR_fadvise64_64           254
-#define TARGET_NR_rtas		255
-#define TARGET_NR_sys_debug_setcontext 256
-/* Number 257 is reserved for vserver */
-#define TARGET_NR_migrate_pages	258
-#define TARGET_NR_mbind		259
-#define TARGET_NR_get_mempolicy	260
-#define TARGET_NR_set_mempolicy	261
-#define TARGET_NR_mq_open		262
-#define TARGET_NR_mq_unlink		263
-#define TARGET_NR_mq_timedsend	264
-#define TARGET_NR_mq_timedreceive	265
-#define TARGET_NR_mq_notify		266
-#define TARGET_NR_mq_getsetattr	267
-#define TARGET_NR_kexec_load		268
-#define TARGET_NR_add_key		269
-#define TARGET_NR_request_key	270
-#define TARGET_NR_keyctl		271
-#define TARGET_NR_waitid		272
-#define TARGET_NR_ioprio_set		273
-#define TARGET_NR_ioprio_get		274
-#define TARGET_NR_inotify_init	275
-#define TARGET_NR_inotify_add_watch	276
-#define TARGET_NR_inotify_rm_watch	277
-#define TARGET_NR_spu_run		278
-#define TARGET_NR_spu_create		279
-#define TARGET_NR_pselect6		280
-#define TARGET_NR_ppoll		281
-#define TARGET_NR_unshare		282
-#define TARGET_NR_splice		283
-#define TARGET_NR_tee		284
-#define TARGET_NR_vmsplice		285
-#define TARGET_NR_openat		286
-#define TARGET_NR_mkdirat		287
-#define TARGET_NR_mknodat		288
-#define TARGET_NR_fchownat		289
-#define TARGET_NR_futimesat		290
-#define TARGET_NR_newfstatat		291
-#define TARGET_NR_unlinkat		292
-#define TARGET_NR_renameat		293
-#define TARGET_NR_linkat		294
-#define TARGET_NR_symlinkat		295
-#define TARGET_NR_readlinkat		296
-#define TARGET_NR_fchmodat		297
-#define TARGET_NR_faccessat		298
-#define TARGET_NR_get_robust_list	299
-#define TARGET_NR_set_robust_list	300
-#define TARGET_NR_move_pages		301
-#define TARGET_NR_getcpu		302
-#define TARGET_NR_epoll_pwait	303
-#define TARGET_NR_utimensat		304
-#define TARGET_NR_signalfd		305
-#define TARGET_NR_timerfd		306
-#define TARGET_NR_eventfd		307
-#define TARGET_NR_sync_file_range2	308
-#define TARGET_NR_fallocate		309
diff --git a/linux-user/ppc64/termbits.h b/linux-user/ppc64/termbits.h
deleted file mode 100644
index 41537ed39..000000000
--- a/linux-user/ppc64/termbits.h
+++ /dev/null
@@ -1,237 +0,0 @@
-/* from asm/termbits.h */
-
-#define TARGET_NCCS 19
-
-struct target_termios {
-    unsigned int c_iflag;               /* input mode flags */
-    unsigned int c_oflag;               /* output mode flags */
-    unsigned int c_cflag;               /* control mode flags */
-    unsigned int c_lflag;               /* local mode flags */
-    unsigned char c_cc[TARGET_NCCS];                /* control characters */
-    unsigned char c_line;                    /* line discipline */
-    unsigned int c_ispeed;		/* input speed */
-    unsigned int c_ospeed;		/* output speed */
-};
-
-/* c_cc character offsets */
-#define TARGET_VINTR 	0
-#define TARGET_VQUIT 	1
-#define TARGET_VERASE 	2
-#define TARGET_VKILL	3
-#define TARGET_VEOF	4
-#define TARGET_VMIN	5
-#define TARGET_VEOL	6
-#define TARGET_VTIME	7
-#define TARGET_VEOL2	8
-#define TARGET_VSWTC	9
-
-#define TARGET_VWERASE 	10
-#define TARGET_VREPRINT	11
-#define TARGET_VSUSP    12
-#define TARGET_VSTART   13
-#define TARGET_VSTOP    14
-#define TARGET_VLNEXT   15
-#define TARGET_VDISCARD	16
-
-#define TARGET_IGNBRK	0000001
-#define TARGET_BRKINT	0000002
-#define TARGET_IGNPAR	0000004
-#define TARGET_PARMRK	0000010
-#define TARGET_INPCK	0000020
-#define TARGET_ISTRIP	0000040
-#define TARGET_INLCR	0000100
-#define TARGET_IGNCR	0000200
-#define TARGET_ICRNL	0000400
-#define TARGET_IXON	0001000
-#define TARGET_IXOFF	0002000
-#define TARGET_IXANY	0004000
-#define TARGET_IUCLC	0010000
-#define TARGET_IMAXBEL	0020000
-#define	TARGET_IUTF8	0040000
-
-/* c_oflag bits */
-#define TARGET_OPOST	0000001
-#define TARGET_ONLCR	0000002
-#define TARGET_OLCUC	0000004
-
-#define TARGET_OCRNL	0000010
-#define TARGET_ONOCR	0000020
-#define TARGET_ONLRET	0000040
-
-#define TARGET_OFILL	00000100
-#define TARGET_OFDEL	00000200
-#define TARGET_NLDLY	00001400
-#define   TARGET_NL0	00000000
-#define   TARGET_NL1	00000400
-#define   TARGET_NL2	00001000
-#define   TARGET_NL3	00001400
-#define TARGET_TABDLY	00006000
-#define   TARGET_TAB0	00000000
-#define   TARGET_TAB1	00002000
-#define   TARGET_TAB2	00004000
-#define   TARGET_TAB3	00006000
-#define   TARGET_XTABS	00006000	/* required by POSIX to == TAB3 */
-#define TARGET_CRDLY	00030000
-#define   TARGET_CR0	00000000
-#define   TARGET_CR1	00010000
-#define   TARGET_CR2	00020000
-#define   TARGET_CR3	00030000
-#define TARGET_FFDLY	00040000
-#define   TARGET_FF0	00000000
-#define   TARGET_FF1	00040000
-#define TARGET_BSDLY	00100000
-#define   TARGET_BS0	00000000
-#define   TARGET_BS1	00100000
-#define TARGET_VTDLY	00200000
-#define   TARGET_VT0	00000000
-#define   TARGET_VT1	00200000
-
-/* c_cflag bit meaning */
-#define TARGET_CBAUD	0000377
-#define  TARGET_B0	0000000		/* hang up */
-#define  TARGET_B50	0000001
-#define  TARGET_B75	0000002
-#define  TARGET_B110	0000003
-#define  TARGET_B134	0000004
-#define  TARGET_B150	0000005
-#define  TARGET_B200	0000006
-#define  TARGET_B300	0000007
-#define  TARGET_B600	0000010
-#define  TARGET_B1200	0000011
-#define  TARGET_B1800	0000012
-#define  TARGET_B2400	0000013
-#define  TARGET_B4800	0000014
-#define  TARGET_B9600	0000015
-#define  TARGET_B19200	0000016
-#define  TARGET_B38400	0000017
-#define TARGET_EXTA B19200
-#define TARGET_EXTB B38400
-#define TARGET_CBAUDEX 0000000
-#define  TARGET_B57600   00020
-#define  TARGET_B115200  00021
-#define  TARGET_B230400  00022
-#define  TARGET_B460800  00023
-#define  TARGET_B500000  00024
-#define  TARGET_B576000  00025
-#define  TARGET_B921600  00026
-#define TARGET_B1000000  00027
-#define TARGET_B1152000  00030
-#define TARGET_B1500000  00031
-#define TARGET_B2000000  00032
-#define TARGET_B2500000  00033
-#define TARGET_B3000000  00034
-#define TARGET_B3500000  00035
-#define TARGET_B4000000  00036
-
-#define TARGET_CSIZE	00001400
-#define   TARGET_CS5	00000000
-#define   TARGET_CS6	00000400
-#define   TARGET_CS7	00001000
-#define   TARGET_CS8	00001400
-
-#define TARGET_CSTOPB	00002000
-#define TARGET_CREAD	00004000
-#define TARGET_PARENB	00010000
-#define TARGET_PARODD	00020000
-#define TARGET_HUPCL	00040000
-
-#define TARGET_CLOCAL	00100000
-#define TARGET_CMSPAR	010000000000		/* mark or space (stick) parity */
-#define TARGET_CRTSCTS	020000000000		/* flow control */
-
-/* c_lflag bits */
-#define TARGET_ISIG	0x00000080
-#define TARGET_ICANON	0x00000100
-#define TARGET_XCASE	0x00004000
-#define TARGET_ECHO	0x00000008
-#define TARGET_ECHOE	0x00000002
-#define TARGET_ECHOK	0x00000004
-#define TARGET_ECHONL	0x00000010
-#define TARGET_NOFLSH	0x80000000
-#define TARGET_TOSTOP	0x00400000
-#define TARGET_ECHOCTL	0x00000040
-#define TARGET_ECHOPRT	0x00000020
-#define TARGET_ECHOKE	0x00000001
-#define TARGET_FLUSHO	0x00800000
-#define TARGET_PENDIN	0x20000000
-#define TARGET_IEXTEN	0x00000400
-
-/* ioctls */
-
-#define TARGET_FIOCLEX		TARGET_IO('f', 1)
-#define TARGET_FIONCLEX	        TARGET_IO('f', 2)
-#define TARGET_FIOASYNC	        TARGET_IOW('f', 125, int)
-#define TARGET_FIONBIO		TARGET_IOW('f', 126, int)
-#define TARGET_FIONREAD	        TARGET_IOR('f', 127, int)
-#define TARGET_TIOCINQ		TARGET_FIONREAD
-//#define TARGET_FIOQSIZE	        TARGET_IOR('f', 128, loff_t)
-
-#define TARGET_TCGETS		TARGET_IOR('t', 19, struct target_termios)
-#define TARGET_TCSETS		TARGET_IOW('t', 20, struct target_termios)
-#define TARGET_TCSETSW		TARGET_IOW('t', 21, struct target_termios)
-#define TARGET_TCSETSF		TARGET_IOW('t', 22, struct target_termios)
-
-#define TARGET_TCGETA		TARGET_IOR('t', 23, struct target_termio)
-#define TARGET_TCSETA		TARGET_IOW('t', 24, struct target_termio)
-#define TARGET_TCSETAW		TARGET_IOW('t', 25, struct target_termio)
-#define TARGET_TCSETAF		TARGET_IOW('t', 28, struct target_termio)
-
-#define TARGET_TCSBRK		TARGET_IO('t', 29)
-#define TARGET_TCXONC		TARGET_IO('t', 30)
-#define TARGET_TCFLSH		TARGET_IO('t', 31)
-
-#define TARGET_TIOCSWINSZ	TARGET_IOW('t', 103, struct target_winsize)
-#define TARGET_TIOCGWINSZ	TARGET_IOR('t', 104, struct target_winsize)
-#define	TARGET_TIOCSTART	TARGET_IO('t', 110)		/* start output, like ^Q */
-#define	TARGET_TIOCSTOP	TARGET_IO('t', 111)		/* stop output, like ^S */
-#define TARGET_TIOCOUTQ        TARGET_IOR('t', 115, int)     /* output queue size */
-
-#define TARGET_TIOCGLTC	TARGET_IOR('t', 116, struct target_ltchars)
-#define TARGET_TIOCSLTC	TARGET_IOW('t', 117, struct target_ltchars)
-#define TARGET_TIOCSPGRP	TARGET_IOW('t', 118, int)
-#define TARGET_TIOCGPGRP	TARGET_IOR('t', 119, int)
-
-#define TARGET_TIOCEXCL	0x540C
-#define TARGET_TIOCNXCL	0x540D
-#define TARGET_TIOCSCTTY	0x540E
-
-#define TARGET_TIOCSTI		0x5412
-#define TARGET_TIOCMGET	0x5415
-#define TARGET_TIOCMBIS	0x5416
-#define TARGET_TIOCMBIC	0x5417
-#define TARGET_TIOCMSET	0x5418
-
-#define TARGET_TIOCGSOFTCAR	0x5419
-#define TARGET_TIOCSSOFTCAR	0x541A
-#define TARGET_TIOCLINUX	0x541C
-#define TARGET_TIOCCONS	0x541D
-#define TARGET_TIOCGSERIAL	0x541E
-#define TARGET_TIOCSSERIAL	0x541F
-#define TARGET_TIOCPKT		0x5420
-
-#define TARGET_TIOCNOTTY	0x5422
-#define TARGET_TIOCSETD	0x5423
-#define TARGET_TIOCGETD	0x5424
-#define TARGET_TCSBRKP		0x5425	/* Needed for POSIX tcsendbreak() */
-#define TARGET_TIOCTTYGSTRUCT	0x5426  /* For debugging only */
-#define TARGET_TIOCSBRK	0x5427  /* BSD compatibility */
-#define TARGET_TIOCCBRK	0x5428  /* BSD compatibility */
-#define TARGET_TIOCGSID	0x5429  /* Return the session ID of FD */
-#define TARGET_TIOCGPTN	TARGET_IOR('T',0x30, unsigned int) /* Get Pty Number (of pty-mux device) */
-#define TARGET_TIOCSPTLCK	TARGET_IOW('T',0x31, int)  /* Lock/unlock Pty */
-
-#define TARGET_TIOCSERCONFIG	0x5453
-#define TARGET_TIOCSERGWILD	0x5454
-#define TARGET_TIOCSERSWILD	0x5455
-#define TARGET_TIOCGLCKTRMIOS	0x5456
-#define TARGET_TIOCSLCKTRMIOS	0x5457
-#define TARGET_TIOCSERGSTRUCT	0x5458 /* For debugging only */
-#define TARGET_TIOCSERGETLSR   0x5459 /* Get line status register */
-  /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
-# define TARGET_TIOCSER_TEMT    0x01	/* Transmitter physically empty */
-#define TARGET_TIOCSERGETMULTI 0x545A /* Get multiport config  */
-#define TARGET_TIOCSERSETMULTI 0x545B /* Set multiport config */
-
-#define TARGET_TIOCMIWAIT	0x545C	/* wait for a change on serial input line(s) */
-#define TARGET_TIOCGICOUNT	0x545D	/* read serial port inline interrupt counts */
-
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index e07ac7b4d..c0780084b 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -1,13 +1,33 @@
 #ifndef QEMU_H
 #define QEMU_H
 
-#include "thunk.h"
-
 #include <signal.h>
 #include <string.h>
-#include "syscall_defs.h"
 
 #include "cpu.h"
+
+#ifdef TARGET_ABI32
+typedef uint32_t abi_ulong;
+typedef int32_t abi_long;
+#define TARGET_ABI_FMT_lx "%08x"
+#define TARGET_ABI_FMT_ld "%d"
+#define TARGET_ABI_FMT_lu "%u"
+#define TARGET_ABI_BITS 32
+#else
+typedef target_ulong abi_ulong;
+typedef target_long abi_long;
+#define TARGET_ABI_FMT_lx TARGET_FMT_lx
+#define TARGET_ABI_FMT_ld TARGET_FMT_ld
+#define TARGET_ABI_FMT_lu TARGET_FMT_lu
+#define TARGET_ABI_BITS TARGET_LONG_BITS
+/* for consistency, define ABI32 too */
+#if TARGET_ABI_BITS == 32
+#define TARGET_ABI32 1
+#endif
+#endif
+
+#include "thunk.h"
+#include "syscall_defs.h"
 #include "syscall.h"
 #include "target_signal.h"
 #include "gdbstub.h"
@@ -17,20 +37,20 @@
  * task_struct fields in the kernel
  */
 struct image_info {
-        target_ulong    load_addr;
-	unsigned long	start_code;
-	unsigned long	end_code;
-        unsigned long   start_data;
-	unsigned long	end_data;
-	unsigned long	start_brk;
-	unsigned long	brk;
-	unsigned long	start_mmap;
-	unsigned long	mmap;
-	unsigned long	rss;
-	unsigned long	start_stack;
-	unsigned long	entry;
-        target_ulong    code_offset;
-        target_ulong    data_offset;
+        abi_ulong       load_addr;
+        abi_ulong       start_code;
+        abi_ulong       end_code;
+        abi_ulong       start_data;
+        abi_ulong       end_data;
+        abi_ulong       start_brk;
+        abi_ulong       brk;
+        abi_ulong       start_mmap;
+        abi_ulong       mmap;
+        abi_ulong       rss;
+        abi_ulong       start_stack;
+        abi_ulong       entry;
+        abi_ulong       code_offset;
+        abi_ulong       data_offset;
         char            **host_argv;
 	int		personality;
 };
@@ -67,7 +87,7 @@ typedef struct TaskState {
     int swi_errno;
 #endif
 #if defined(TARGET_I386) && !defined(TARGET_X86_64)
-    target_ulong target_v86;
+    abi_ulong target_v86;
     struct vm86_saved_state vm86_saved_regs;
     struct target_vm86plus_struct vm86plus;
     uint32_t v86flags;
@@ -105,7 +125,7 @@ extern const char *qemu_uname_release;
 struct linux_binprm {
         char buf[128];
         void *page[MAX_ARG_PAGES];
-        unsigned long p;
+        abi_ulong p;
 	int fd;
         int e_uid, e_gid;
         int argc, envc;
@@ -115,8 +135,8 @@ struct linux_binprm {
 };
 
 void do_init_thread(struct target_pt_regs *regs, struct image_info *infop);
-target_ulong loader_build_argptr(int envc, int argc, target_ulong sp,
-                                 target_ulong stringp, int push_ptr);
+abi_ulong loader_build_argptr(int envc, int argc, abi_ulong sp,
+                              abi_ulong stringp, int push_ptr);
 int loader_exec(const char * filename, char ** argv, char ** envp,
              struct target_pt_regs * regs, struct image_info *infop);
 
@@ -124,24 +144,37 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
                     struct image_info * info);
 int load_flt_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
                     struct image_info * info);
+#ifdef TARGET_HAS_ELFLOAD32
+int load_elf_binary_multi(struct linux_binprm *bprm,
+                          struct target_pt_regs *regs,
+                          struct image_info *info);
+#endif
 
-void memcpy_to_target(target_ulong dest, const void *src,
-                      unsigned long len);
-void target_set_brk(target_ulong new_brk);
-target_long do_brk(target_ulong new_brk);
+abi_long memcpy_to_target(abi_ulong dest, const void *src,
+                          unsigned long len);
+void target_set_brk(abi_ulong new_brk);
+abi_long do_brk(abi_ulong new_brk);
 void syscall_init(void);
-target_long do_syscall(void *cpu_env, int num, target_long arg1,
-                       target_long arg2, target_long arg3, target_long arg4,
-                       target_long arg5, target_long arg6);
+abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
+                    abi_long arg2, abi_long arg3, abi_long arg4,
+                    abi_long arg5, abi_long arg6);
 void gemu_log(const char *fmt, ...) __attribute__((format(printf,1,2)));
 extern CPUState *global_env;
 void cpu_loop(CPUState *env);
 void init_paths(const char *prefix);
 const char *path(const char *pathname);
+char *target_strerror(int err);
 
 extern int loglevel;
 extern FILE *logfile;
 
+/* strace.c */
+void print_syscall(int num,
+                   abi_long arg1, abi_long arg2, abi_long arg3,
+                   abi_long arg4, abi_long arg5, abi_long arg6);
+void print_syscall_ret(int num, abi_long arg1);
+extern int do_strace;
+
 /* signal.c */
 void process_pending_signals(void *cpu_env);
 void signal_init(void);
@@ -150,51 +183,59 @@ void host_to_target_siginfo(target_siginfo_t *tinfo, const siginfo_t *info);
 void target_to_host_siginfo(siginfo_t *info, const target_siginfo_t *tinfo);
 long do_sigreturn(CPUState *env);
 long do_rt_sigreturn(CPUState *env);
-int do_sigaltstack(const struct target_sigaltstack *uss,
-                   struct target_sigaltstack *uoss,
-                   target_ulong sp);
+abi_long do_sigaltstack(abi_ulong uss_addr, abi_ulong uoss_addr, abi_ulong sp);
 
 #ifdef TARGET_I386
 /* vm86.c */
 void save_v86_state(CPUX86State *env);
 void handle_vm86_trap(CPUX86State *env, int trapno);
 void handle_vm86_fault(CPUX86State *env);
-int do_vm86(CPUX86State *env, long subfunction, target_ulong v86_addr);
+int do_vm86(CPUX86State *env, long subfunction, abi_ulong v86_addr);
+#elif defined(TARGET_SPARC64)
+void sparc64_set_context(CPUSPARCState *env);
+void sparc64_get_context(CPUSPARCState *env);
 #endif
 
 /* mmap.c */
-int target_mprotect(target_ulong start, target_ulong len, int prot);
-target_long target_mmap(target_ulong start, target_ulong len, int prot,
-                 int flags, int fd, target_ulong offset);
-int target_munmap(target_ulong start, target_ulong len);
-target_long target_mremap(target_ulong old_addr, target_ulong old_size,
-                   target_ulong new_size, unsigned long flags,
-                   target_ulong new_addr);
-int target_msync(target_ulong start, target_ulong len, int flags);
+int target_mprotect(abi_ulong start, abi_ulong len, int prot);
+abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
+                     int flags, int fd, abi_ulong offset);
+int target_munmap(abi_ulong start, abi_ulong len);
+abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
+                       abi_ulong new_size, unsigned long flags,
+                       abi_ulong new_addr);
+int target_msync(abi_ulong start, abi_ulong len, int flags);
 
 /* user access */
 
 #define VERIFY_READ 0
-#define VERIFY_WRITE 1
+#define VERIFY_WRITE 1 /* implies read access */
 
-#define access_ok(type,addr,size) (1)
+static inline int access_ok(int type, abi_ulong addr, abi_ulong size)
+{
+    return page_check_range((target_ulong)addr, size,
+                            (type == VERIFY_READ) ? PAGE_READ : (PAGE_READ | PAGE_WRITE)) == 0;
+}
 
-/* NOTE get_user and put_user use host addresses.  */
-#define __put_user(x,ptr)\
+/* NOTE __get_user and __put_user use host pointers and don't check access. */
+/* These are usually used to access struct data members once the
+ * struct has been locked - usually with lock_user_struct().
+ */
+#define __put_user(x, hptr)\
 ({\
-    int size = sizeof(*ptr);\
+    int size = sizeof(*hptr);\
     switch(size) {\
     case 1:\
-        *(uint8_t *)(ptr) = (typeof(*ptr))(x);\
+        *(uint8_t *)(hptr) = (uint8_t)(typeof(*hptr))(x);\
         break;\
     case 2:\
-        *(uint16_t *)(ptr) = tswap16((typeof(*ptr))(x));\
+        *(uint16_t *)(hptr) = tswap16((typeof(*hptr))(x));\
         break;\
     case 4:\
-        *(uint32_t *)(ptr) = tswap32((typeof(*ptr))(x));\
+        *(uint32_t *)(hptr) = tswap32((typeof(*hptr))(x));\
         break;\
     case 8:\
-        *(uint64_t *)(ptr) = tswap64((typeof(*ptr))(x));\
+        *(uint64_t *)(hptr) = tswap64((typeof(*hptr))(x));\
         break;\
     default:\
         abort();\
@@ -202,48 +243,93 @@ int target_msync(target_ulong start, target_ulong len, int flags);
     0;\
 })
 
-#define __get_user(x, ptr) \
+#define __get_user(x, hptr) \
 ({\
-    int size = sizeof(*ptr);\
+    int size = sizeof(*hptr);\
     switch(size) {\
     case 1:\
-        x = (typeof(*ptr))*(uint8_t *)(ptr);\
+        x = (typeof(*hptr))*(uint8_t *)(hptr);\
         break;\
     case 2:\
-        x = (typeof(*ptr))tswap16(*(uint16_t *)(ptr));\
+        x = (typeof(*hptr))tswap16(*(uint16_t *)(hptr));\
         break;\
     case 4:\
-        x = (typeof(*ptr))tswap32(*(uint32_t *)(ptr));\
+        x = (typeof(*hptr))tswap32(*(uint32_t *)(hptr));\
         break;\
     case 8:\
-        x = (typeof(*ptr))tswap64(*(uint64_t *)(ptr));\
+        x = (typeof(*hptr))tswap64(*(uint64_t *)(hptr));\
         break;\
     default:\
+        /* avoid warning */\
+        x = 0;\
         abort();\
     }\
     0;\
 })
 
-#define put_user(x,ptr)\
-({\
-    int __ret;\
-    if (access_ok(VERIFY_WRITE, ptr, sizeof(*ptr)))\
-        __ret = __put_user(x, ptr);\
-    else\
-        __ret = -EFAULT;\
-    __ret;\
+/* put_user()/get_user() take a guest address and check access */
+/* These are usually used to access an atomic data type, such as an int,
+ * that has been passed by address.  These internally perform locking
+ * and unlocking on the data type.
+ */
+#define put_user(x, gaddr, target_type)					\
+({									\
+    abi_ulong __gaddr = (gaddr);					\
+    target_type *__hptr;						\
+    abi_long __ret;							\
+    if ((__hptr = lock_user(VERIFY_WRITE, __gaddr, sizeof(target_type), 0))) { \
+        __ret = __put_user((x), __hptr);				\
+        unlock_user(__hptr, __gaddr, sizeof(target_type));		\
+    } else								\
+        __ret = -TARGET_EFAULT;						\
+    __ret;								\
 })
 
-#define get_user(x,ptr)\
-({\
-    int __ret;\
-    if (access_ok(VERIFY_READ, ptr, sizeof(*ptr)))\
-        __ret = __get_user(x, ptr);\
-    else\
-        __ret = -EFAULT;\
-    __ret;\
+#define get_user(x, gaddr, target_type)					\
+({									\
+    abi_ulong __gaddr = (gaddr);					\
+    target_type *__hptr;						\
+    abi_long __ret;							\
+    if ((__hptr = lock_user(VERIFY_READ, __gaddr, sizeof(target_type), 1))) { \
+        __ret = __get_user((x), __hptr);				\
+        unlock_user(__hptr, __gaddr, 0);				\
+    } else {								\
+        /* avoid warning */						\
+        (x) = 0;							\
+        __ret = -TARGET_EFAULT;						\
+    }									\
+    __ret;								\
 })
 
+#define put_user_ual(x, gaddr) put_user((x), (gaddr), abi_ulong)
+#define put_user_sal(x, gaddr) put_user((x), (gaddr), abi_long)
+#define put_user_u64(x, gaddr) put_user((x), (gaddr), uint64_t)
+#define put_user_s64(x, gaddr) put_user((x), (gaddr), int64_t)
+#define put_user_u32(x, gaddr) put_user((x), (gaddr), uint32_t)
+#define put_user_s32(x, gaddr) put_user((x), (gaddr), int32_t)
+#define put_user_u16(x, gaddr) put_user((x), (gaddr), uint16_t)
+#define put_user_s16(x, gaddr) put_user((x), (gaddr), int16_t)
+#define put_user_u8(x, gaddr)  put_user((x), (gaddr), uint8_t)
+#define put_user_s8(x, gaddr)  put_user((x), (gaddr), int8_t)
+
+#define get_user_ual(x, gaddr) get_user((x), (gaddr), abi_ulong)
+#define get_user_sal(x, gaddr) get_user((x), (gaddr), abi_long)
+#define get_user_u64(x, gaddr) get_user((x), (gaddr), uint64_t)
+#define get_user_s64(x, gaddr) get_user((x), (gaddr), int64_t)
+#define get_user_u32(x, gaddr) get_user((x), (gaddr), uint32_t)
+#define get_user_s32(x, gaddr) get_user((x), (gaddr), int32_t)
+#define get_user_u16(x, gaddr) get_user((x), (gaddr), uint16_t)
+#define get_user_s16(x, gaddr) get_user((x), (gaddr), int16_t)
+#define get_user_u8(x, gaddr)  get_user((x), (gaddr), uint8_t)
+#define get_user_s8(x, gaddr)  get_user((x), (gaddr), int8_t)
+
+/* copy_from_user() and copy_to_user() are usually used to copy data
+ * buffers between the target and host.  These internally perform
+ * locking/unlocking of the memory.
+ */
+abi_long copy_from_user(void *hptr, abi_ulong gaddr, size_t len);
+abi_long copy_to_user(abi_ulong gaddr, void *hptr, size_t len);
+
 /* Functions for accessing guest memory.  The tget and tput functions
    read/write single values, byteswapping as neccessary.  The lock_user
    gets a pointer to a contiguous area of guest memory, but does not perform
@@ -252,69 +338,61 @@ int target_msync(target_ulong start, target_ulong len, int flags);
 
 /* Lock an area of guest memory into the host.  If copy is true then the
    host area will have the same contents as the guest.  */
-static inline void *lock_user(target_ulong guest_addr, long len, int copy)
+static inline void *lock_user(int type, abi_ulong guest_addr, long len, int copy)
 {
+    if (!access_ok(type, guest_addr, len))
+        return NULL;
 #ifdef DEBUG_REMAP
-    void *addr;
-    addr = malloc(len);
-    if (copy)
-        memcpy(addr, g2h(guest_addr), len);
-    else
-        memset(addr, 0, len);
-    return addr;
+    {
+        void *addr;
+        addr = malloc(len);
+        if (copy)
+            memcpy(addr, g2h(guest_addr), len);
+        else
+            memset(addr, 0, len);
+        return addr;
+    }
 #else
     return g2h(guest_addr);
 #endif
 }
 
-/* Unlock an area of guest memory.  The first LEN bytes must be flushed back
-   to guest memory.  */
-static inline void unlock_user(void *host_addr, target_ulong guest_addr,
-                                long len)
+/* Unlock an area of guest memory.  The first LEN bytes must be
+   flushed back to guest memory. host_ptr = NULL is explicitely
+   allowed and does nothing. */
+static inline void unlock_user(void *host_ptr, abi_ulong guest_addr,
+                               long len)
 {
+
 #ifdef DEBUG_REMAP
-    if (host_addr == g2h(guest_addr))
+    if (!host_ptr)
+        return;
+    if (host_ptr == g2h(guest_addr))
         return;
     if (len > 0)
-        memcpy(g2h(guest_addr), host_addr, len);
-    free(host_addr);
+        memcpy(g2h(guest_ptr), host_ptr, len);
+    free(host_ptr);
 #endif
 }
 
-/* Return the length of a string in target memory.  */
-static inline int target_strlen(target_ulong ptr)
-{
-  return strlen(g2h(ptr));
-}
+/* Return the length of a string in target memory or -TARGET_EFAULT if
+   access error. */
+abi_long target_strlen(abi_ulong gaddr);
 
 /* Like lock_user but for null terminated strings.  */
-static inline void *lock_user_string(target_ulong guest_addr)
+static inline void *lock_user_string(abi_ulong guest_addr)
 {
-    long len;
-    len = target_strlen(guest_addr) + 1;
-    return lock_user(guest_addr, len, 1);
+    abi_long len;
+    len = target_strlen(guest_addr);
+    if (len < 0)
+        return NULL;
+    return lock_user(VERIFY_READ, guest_addr, (long)(len + 1), 1);
 }
 
 /* Helper macros for locking/ulocking a target struct.  */
-#define lock_user_struct(host_ptr, guest_addr, copy) \
-    host_ptr = lock_user(guest_addr, sizeof(*host_ptr), copy)
-#define unlock_user_struct(host_ptr, guest_addr, copy) \
+#define lock_user_struct(type, host_ptr, guest_addr, copy)	\
+    (host_ptr = lock_user(type, guest_addr, sizeof(*host_ptr), copy))
+#define unlock_user_struct(host_ptr, guest_addr, copy)		\
     unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0)
 
-#define tget8(addr) ldub(addr)
-#define tput8(addr, val) stb(addr, val)
-#define tget16(addr) lduw(addr)
-#define tput16(addr, val) stw(addr, val)
-#define tget32(addr) ldl(addr)
-#define tput32(addr, val) stl(addr, val)
-#define tget64(addr) ldq(addr)
-#define tput64(addr, val) stq(addr, val)
-#if TARGET_LONG_BITS == 64
-#define tgetl(addr) ldq(addr)
-#define tputl(addr, val) stq(addr, val)
-#else
-#define tgetl(addr) ldl(addr)
-#define tputl(addr, val) stl(addr, val)
-#endif
-
 #endif /* QEMU_H */
diff --git a/linux-user/sh4/target_signal.h b/linux-user/sh4/target_signal.h
index e210e7a31..e148da092 100644
--- a/linux-user/sh4/target_signal.h
+++ b/linux-user/sh4/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_ulong ss_sp;
-	target_long ss_flags;
-	target_ulong ss_size;
+	abi_ulong ss_sp;
+	abi_long ss_flags;
+	abi_ulong ss_size;
 } target_stack_t;
 
 
@@ -21,4 +21,9 @@ typedef struct target_sigaltstack {
 #define TARGET_MINSIGSTKSZ    2048
 #define TARGET_SIGSTKSZ       8192
 
+static inline abi_ulong get_sp_from_cpustate(CPUSH4State *state)
+{
+    return state->gregs[15];
+}
+
 #endif /* TARGET_SIGNAL_H */
diff --git a/linux-user/signal.c b/linux-user/signal.c
index d17c506d2..312e41941 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -26,8 +26,8 @@
 #include <errno.h>
 #include <sys/ucontext.h>
 
-#include "target_signal.h"
 #include "qemu.h"
+#include "target_signal.h"
 
 //#define DEBUG_SIGNAL
 
@@ -134,16 +134,16 @@ static void host_to_target_sigset_internal(target_sigset_t *d,
         if (sigmask & (1 << i))
             target_sigmask |= 1 << (host_to_target_signal(i + 1) - 1);
     }
-#if TARGET_LONG_BITS == 32 && HOST_LONG_BITS == 32
+#if TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 32
     d->sig[0] = target_sigmask;
     for(i = 1;i < TARGET_NSIG_WORDS; i++) {
         d->sig[i] = ((unsigned long *)s)[i];
     }
-#elif TARGET_LONG_BITS == 32 && HOST_LONG_BITS == 64 && TARGET_NSIG_WORDS == 2
+#elif TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64 && TARGET_NSIG_WORDS == 2
     d->sig[0] = target_sigmask;
     d->sig[1] = sigmask >> 32;
 #else
-#warning host_to_target_sigset
+    /* XXX: do it */
 #endif
 }
 
@@ -161,7 +161,7 @@ void target_to_host_sigset_internal(sigset_t *d, const target_sigset_t *s)
 {
     int i;
     unsigned long sigmask;
-    target_ulong target_sigmask;
+    abi_ulong target_sigmask;
 
     target_sigmask = s->sig[0];
     sigmask = 0;
@@ -169,16 +169,16 @@ void target_to_host_sigset_internal(sigset_t *d, const target_sigset_t *s)
         if (target_sigmask & (1 << i))
             sigmask |= 1 << (target_to_host_signal(i + 1) - 1);
     }
-#if TARGET_LONG_BITS == 32 && HOST_LONG_BITS == 32
+#if TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 32
     ((unsigned long *)d)[0] = sigmask;
     for(i = 1;i < TARGET_NSIG_WORDS; i++) {
         ((unsigned long *)d)[i] = s->sig[i];
     }
-#elif TARGET_LONG_BITS == 32 && HOST_LONG_BITS == 64 && TARGET_NSIG_WORDS == 2
+#elif TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64 && TARGET_NSIG_WORDS == 2
     ((unsigned long *)d)[0] = sigmask | ((unsigned long)(s->sig[1]) << 32);
 #else
-#warning target_to_host_sigset
-#endif /* TARGET_LONG_BITS */
+    /* XXX: do it */
+#endif /* TARGET_ABI_BITS */
 }
 
 void target_to_host_sigset(sigset_t *d, const target_sigset_t *s)
@@ -191,7 +191,7 @@ void target_to_host_sigset(sigset_t *d, const target_sigset_t *s)
     target_to_host_sigset_internal(d, &s1);
 }
 
-void host_to_target_old_sigset(target_ulong *old_sigset,
+void host_to_target_old_sigset(abi_ulong *old_sigset,
                                const sigset_t *sigset)
 {
     target_sigset_t d;
@@ -200,7 +200,7 @@ void host_to_target_old_sigset(target_ulong *old_sigset,
 }
 
 void target_to_host_old_sigset(sigset_t *sigset,
-                               const target_ulong *old_sigset)
+                               const abi_ulong *old_sigset)
 {
     target_sigset_t d;
     int i;
@@ -233,7 +233,7 @@ static inline void host_to_target_siginfo_noswap(target_siginfo_t *tinfo,
         tinfo->_sifields._rt._uid = info->si_uid;
         /* XXX: potential problem if 64 bit */
         tinfo->_sifields._rt._sigval.sival_ptr =
-            (target_ulong)info->si_value.sival_ptr;
+            (abi_ulong)(unsigned long)info->si_value.sival_ptr;
     }
 }
 
@@ -276,7 +276,7 @@ void target_to_host_siginfo(siginfo_t *info, const target_siginfo_t *tinfo)
     info->si_pid = tswap32(tinfo->_sifields._rt._pid);
     info->si_uid = tswap32(tinfo->_sifields._rt._uid);
     info->si_value.sival_ptr =
-        (void *)tswapl(tinfo->_sifields._rt._sigval.sival_ptr);
+            (void *)(long)tswapl(tinfo->_sifields._rt._sigval.sival_ptr);
 }
 
 void signal_init(void)
@@ -355,7 +355,7 @@ int queue_signal(int sig, target_siginfo_t *info)
 {
     struct emulated_sigaction *k;
     struct sigqueue *q, **pq;
-    target_ulong handler;
+    abi_ulong handler;
 
 #if defined(DEBUG_SIGNAL)
     fprintf(stderr, "queue_signal: sig=%d\n",
@@ -415,11 +415,7 @@ static void host_signal_handler(int host_signum, siginfo_t *info,
 
     /* the CPU emulator uses some host signals to detect exceptions,
        we we forward to it some signals */
-    if (host_signum == SIGSEGV || host_signum == SIGBUS
-#if defined(TARGET_I386) && defined(USE_CODE_COPY)
-        || host_signum == SIGFPE
-#endif
-        ) {
+    if (host_signum == SIGSEGV || host_signum == SIGBUS) {
         if (cpu_signal_handler(host_signum, info, puc))
             return;
     }
@@ -438,37 +434,39 @@ static void host_signal_handler(int host_signum, siginfo_t *info,
     }
 }
 
-int do_sigaltstack(const struct target_sigaltstack *uss,
-                   struct target_sigaltstack *uoss,
-                   target_ulong sp)
+/* do_sigaltstack() returns target values and errnos. */
+/* compare linux/kernel/signal.c:do_sigaltstack() */
+abi_long do_sigaltstack(abi_ulong uss_addr, abi_ulong uoss_addr, abi_ulong sp)
 {
     int ret;
     struct target_sigaltstack oss;
 
     /* XXX: test errors */
-    if(uoss)
+    if(uoss_addr)
     {
         __put_user(target_sigaltstack_used.ss_sp, &oss.ss_sp);
         __put_user(target_sigaltstack_used.ss_size, &oss.ss_size);
         __put_user(sas_ss_flags(sp), &oss.ss_flags);
     }
 
-    if(uss)
+    if(uss_addr)
     {
-	struct target_sigaltstack ss;
+        struct target_sigaltstack *uss;
+        struct target_sigaltstack ss;
 
-	ret = -EFAULT;
-	if (!access_ok(VERIFY_READ, uss, sizeof(*uss))
+	ret = -TARGET_EFAULT;
+        if (!lock_user_struct(VERIFY_READ, uss, uss_addr, 1)
 	    || __get_user(ss.ss_sp, &uss->ss_sp)
 	    || __get_user(ss.ss_size, &uss->ss_size)
 	    || __get_user(ss.ss_flags, &uss->ss_flags))
             goto out;
+        unlock_user_struct(uss, uss_addr, 0);
 
-	ret = -EPERM;
+	ret = -TARGET_EPERM;
 	if (on_sig_stack(sp))
             goto out;
 
-	ret = -EINVAL;
+	ret = -TARGET_EINVAL;
 	if (ss.ss_flags != TARGET_SS_DISABLE
             && ss.ss_flags != TARGET_SS_ONSTACK
             && ss.ss_flags != 0)
@@ -478,7 +476,7 @@ int do_sigaltstack(const struct target_sigaltstack *uss,
             ss.ss_size = 0;
             ss.ss_sp = 0;
 	} else {
-            ret = -ENOMEM;
+            ret = -TARGET_ENOMEM;
             if (ss.ss_size < MINSIGSTKSZ)
                 goto out;
 	}
@@ -487,11 +485,10 @@ int do_sigaltstack(const struct target_sigaltstack *uss,
         target_sigaltstack_used.ss_size = ss.ss_size;
     }
 
-    if (uoss) {
-        ret = -EFAULT;
-        if (!access_ok(VERIFY_WRITE, uoss, sizeof(oss)))
+    if (uoss_addr) {
+        ret = -TARGET_EFAULT;
+        if (copy_to_user(uoss_addr, &oss, sizeof(oss)))
             goto out;
-        memcpy(uoss, &oss, sizeof(oss));
     }
 
     ret = 0;
@@ -499,12 +496,14 @@ out:
     return ret;
 }
 
+/* do_sigaction() return host values and errnos */
 int do_sigaction(int sig, const struct target_sigaction *act,
                  struct target_sigaction *oact)
 {
     struct emulated_sigaction *k;
     struct sigaction act1;
     int host_sig;
+    int ret = 0;
 
     if (sig < 1 || sig > TARGET_NSIG || sig == SIGKILL || sig == SIGSTOP)
         return -EINVAL;
@@ -546,10 +545,10 @@ int do_sigaction(int sig, const struct target_sigaction *act,
             } else {
                 act1.sa_sigaction = host_signal_handler;
             }
-            sigaction(host_sig, &act1, NULL);
+            ret = sigaction(host_sig, &act1, NULL);
         }
     }
-    return 0;
+    return ret;
 }
 
 #ifndef offsetof
@@ -563,7 +562,13 @@ static inline int copy_siginfo_to_user(target_siginfo_t *tinfo,
     return 0;
 }
 
-#ifdef TARGET_I386
+static inline int current_exec_domain_sig(int sig)
+{
+    return /* current->exec_domain && current->exec_domain->signal_invmap
+	      && sig < 32 ? current->exec_domain->signal_invmap[sig] : */ sig;
+}
+
+#if defined(TARGET_I386) && TARGET_ABI_BITS == 32
 
 /* from the Linux kernel */
 
@@ -579,29 +584,29 @@ struct target_fpxreg {
 };
 
 struct target_xmmreg {
-	target_ulong element[4];
+	abi_ulong element[4];
 };
 
 struct target_fpstate {
 	/* Regular FPU environment */
-	target_ulong 	cw;
-	target_ulong	sw;
-	target_ulong	tag;
-	target_ulong	ipoff;
-	target_ulong	cssel;
-	target_ulong	dataoff;
-	target_ulong	datasel;
+        abi_ulong       cw;
+        abi_ulong       sw;
+        abi_ulong       tag;
+        abi_ulong       ipoff;
+        abi_ulong       cssel;
+        abi_ulong       dataoff;
+        abi_ulong       datasel;
 	struct target_fpreg	_st[8];
 	uint16_t	status;
 	uint16_t	magic;		/* 0xffff = regular FPU data only */
 
 	/* FXSR FPU environment */
-	target_ulong	_fxsr_env[6];	/* FXSR FPU env is ignored */
-	target_ulong	mxcsr;
-	target_ulong	reserved;
+        abi_ulong       _fxsr_env[6];   /* FXSR FPU env is ignored */
+        abi_ulong       mxcsr;
+        abi_ulong       reserved;
 	struct target_fpxreg	_fxsr_st[8];	/* FXSR FPU reg data is ignored */
 	struct target_xmmreg	_xmm[8];
-	target_ulong	padding[56];
+        abi_ulong       padding[56];
 };
 
 #define X86_FXSR_MAGIC		0x0000
@@ -611,29 +616,29 @@ struct target_sigcontext {
 	uint16_t fs, __fsh;
 	uint16_t es, __esh;
 	uint16_t ds, __dsh;
-	target_ulong edi;
-	target_ulong esi;
-	target_ulong ebp;
-	target_ulong esp;
-	target_ulong ebx;
-	target_ulong edx;
-	target_ulong ecx;
-	target_ulong eax;
-	target_ulong trapno;
-	target_ulong err;
-	target_ulong eip;
+        abi_ulong edi;
+        abi_ulong esi;
+        abi_ulong ebp;
+        abi_ulong esp;
+        abi_ulong ebx;
+        abi_ulong edx;
+        abi_ulong ecx;
+        abi_ulong eax;
+        abi_ulong trapno;
+        abi_ulong err;
+        abi_ulong eip;
 	uint16_t cs, __csh;
-	target_ulong eflags;
-	target_ulong esp_at_signal;
+        abi_ulong eflags;
+        abi_ulong esp_at_signal;
 	uint16_t ss, __ssh;
-        target_ulong fpstate; /* pointer */
-	target_ulong oldmask;
-	target_ulong cr2;
+        abi_ulong fpstate; /* pointer */
+        abi_ulong oldmask;
+        abi_ulong cr2;
 };
 
 struct target_ucontext {
-        target_ulong	  tuc_flags;
-	target_ulong      tuc_link;
+        abi_ulong         tuc_flags;
+        abi_ulong         tuc_link;
 	target_stack_t	  tuc_stack;
 	struct target_sigcontext tuc_mcontext;
 	target_sigset_t	  tuc_sigmask;	/* mask last for extensibility */
@@ -641,20 +646,20 @@ struct target_ucontext {
 
 struct sigframe
 {
-    target_ulong pretcode;
+    abi_ulong pretcode;
     int sig;
     struct target_sigcontext sc;
     struct target_fpstate fpstate;
-    target_ulong extramask[TARGET_NSIG_WORDS-1];
+    abi_ulong extramask[TARGET_NSIG_WORDS-1];
     char retcode[8];
 };
 
 struct rt_sigframe
 {
-    target_ulong pretcode;
+    abi_ulong pretcode;
     int sig;
-    target_ulong pinfo;
-    target_ulong puc;
+    abi_ulong pinfo;
+    abi_ulong puc;
     struct target_siginfo info;
     struct target_ucontext uc;
     struct target_fpstate fpstate;
@@ -668,10 +673,12 @@ struct rt_sigframe
 /* XXX: save x87 state */
 static int
 setup_sigcontext(struct target_sigcontext *sc, struct target_fpstate *fpstate,
-		 CPUX86State *env, unsigned long mask)
+		 CPUX86State *env, abi_ulong mask, abi_ulong fpstate_addr)
 {
 	int err = 0;
+        uint16_t magic;
 
+	/* already locked in setup_frame() */
 	err |= __put_user(env->segs[R_GS].selector, (unsigned int *)&sc->gs);
 	err |= __put_user(env->segs[R_FS].selector, (unsigned int *)&sc->fs);
 	err |= __put_user(env->segs[R_ES].selector, (unsigned int *)&sc->es);
@@ -692,10 +699,11 @@ setup_sigcontext(struct target_sigcontext *sc, struct target_fpstate *fpstate,
 	err |= __put_user(env->regs[R_ESP], &sc->esp_at_signal);
 	err |= __put_user(env->segs[R_SS].selector, (unsigned int *)&sc->ss);
 
-        cpu_x86_fsave(env, (void *)fpstate, 1);
+        cpu_x86_fsave(env, fpstate_addr, 1);
         fpstate->status = fpstate->sw;
-        err |= __put_user(0xffff, &fpstate->magic);
-        err |= __put_user(fpstate, &sc->fpstate);
+        magic = 0xffff;
+        err |= __put_user(magic, &fpstate->magic);
+        err |= __put_user(fpstate_addr, &sc->fpstate);
 
 	/* non-iBCS2 extensions.. */
 	err |= __put_user(mask, &sc->oldmask);
@@ -707,7 +715,7 @@ setup_sigcontext(struct target_sigcontext *sc, struct target_fpstate *fpstate,
  * Determine which stack to use..
  */
 
-static inline void *
+static inline abi_ulong
 get_sigframe(struct emulated_sigaction *ka, CPUX86State *env, size_t frame_size)
 {
 	unsigned long esp;
@@ -727,29 +735,29 @@ get_sigframe(struct emulated_sigaction *ka, CPUX86State *env, size_t frame_size)
             ka->sa.sa_restorer) {
             esp = (unsigned long) ka->sa.sa_restorer;
 	}
-        return g2h((esp - frame_size) & -8ul);
+        return (esp - frame_size) & -8ul;
 }
 
+/* compare linux/arch/i386/kernel/signal.c:setup_frame() */
 static void setup_frame(int sig, struct emulated_sigaction *ka,
 			target_sigset_t *set, CPUX86State *env)
 {
+	abi_ulong frame_addr;
 	struct sigframe *frame;
 	int i, err = 0;
 
-	frame = get_sigframe(ka, env, sizeof(*frame));
+	frame_addr = get_sigframe(ka, env, sizeof(*frame));
 
-	if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
+	if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
 		goto give_sigsegv;
-	err |= __put_user((/*current->exec_domain
-		           && current->exec_domain->signal_invmap
-		           && sig < 32
-		           ? current->exec_domain->signal_invmap[sig]
-		           : */ sig),
+
+	err |= __put_user(current_exec_domain_sig(sig),
 		          &frame->sig);
 	if (err)
 		goto give_sigsegv;
 
-	setup_sigcontext(&frame->sc, &frame->fpstate, env, set->sig[0]);
+	setup_sigcontext(&frame->sc, &frame->fpstate, env, set->sig[0],
+                         frame_addr + offsetof(struct sigframe, fpstate));
 	if (err)
 		goto give_sigsegv;
 
@@ -763,23 +771,24 @@ static void setup_frame(int sig, struct emulated_sigaction *ka,
 	if (ka->sa.sa_flags & TARGET_SA_RESTORER) {
 		err |= __put_user(ka->sa.sa_restorer, &frame->pretcode);
 	} else {
-		err |= __put_user(frame->retcode, &frame->pretcode);
+                uint16_t val16;
+                abi_ulong retcode_addr;
+                retcode_addr = frame_addr + offsetof(struct sigframe, retcode);
+		err |= __put_user(retcode_addr, &frame->pretcode);
 		/* This is popl %eax ; movl $,%eax ; int $0x80 */
-		err |= __put_user(0xb858, (short *)(frame->retcode+0));
-#if defined(TARGET_X86_64)
-#warning "Fix this !"
-#else
+                val16 = 0xb858;
+		err |= __put_user(val16, (uint16_t *)(frame->retcode+0));
 		err |= __put_user(TARGET_NR_sigreturn, (int *)(frame->retcode+2));
-#endif
-		err |= __put_user(0x80cd, (short *)(frame->retcode+6));
+                val16 = 0x80cd;
+		err |= __put_user(val16, (uint16_t *)(frame->retcode+6));
 	}
 
 	if (err)
 		goto give_sigsegv;
 
 	/* Set up registers for signal handler */
-	env->regs[R_ESP] = h2g(frame);
-	env->eip = (unsigned long) ka->sa._sa_handler;
+	env->regs[R_ESP] = frame_addr;
+	env->eip = ka->sa._sa_handler;
 
         cpu_x86_load_seg(env, R_DS, __USER_DS);
         cpu_x86_load_seg(env, R_ES, __USER_DS);
@@ -787,34 +796,37 @@ static void setup_frame(int sig, struct emulated_sigaction *ka,
         cpu_x86_load_seg(env, R_CS, __USER_CS);
 	env->eflags &= ~TF_MASK;
 
+	unlock_user_struct(frame, frame_addr, 1);
+
 	return;
 
 give_sigsegv:
+	unlock_user_struct(frame, frame_addr, 1);
 	if (sig == TARGET_SIGSEGV)
 		ka->sa._sa_handler = TARGET_SIG_DFL;
 	force_sig(TARGET_SIGSEGV /* , current */);
 }
 
+/* compare linux/arch/i386/kernel/signal.c:setup_rt_frame() */
 static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
                            target_siginfo_t *info,
 			   target_sigset_t *set, CPUX86State *env)
 {
+        abi_ulong frame_addr, addr;
 	struct rt_sigframe *frame;
 	int i, err = 0;
 
-	frame = get_sigframe(ka, env, sizeof(*frame));
+	frame_addr = get_sigframe(ka, env, sizeof(*frame));
 
-	if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
+	if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
 		goto give_sigsegv;
 
-	err |= __put_user((/*current->exec_domain
-		    	   && current->exec_domain->signal_invmap
-		    	   && sig < 32
-		    	   ? current->exec_domain->signal_invmap[sig]
-			   : */sig),
+	err |= __put_user(current_exec_domain_sig(sig),
 			  &frame->sig);
-	err |= __put_user((target_ulong)&frame->info, &frame->pinfo);
-	err |= __put_user((target_ulong)&frame->uc, &frame->puc);
+        addr = frame_addr + offsetof(struct rt_sigframe, info);
+	err |= __put_user(addr, &frame->pinfo);
+        addr = frame_addr + offsetof(struct rt_sigframe, uc);
+	err |= __put_user(addr, &frame->puc);
 	err |= copy_siginfo_to_user(&frame->info, info);
 	if (err)
 		goto give_sigsegv;
@@ -829,7 +841,8 @@ static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
 	err |= __put_user(target_sigaltstack_used.ss_size,
 			  &frame->uc.tuc_stack.ss_size);
 	err |= setup_sigcontext(&frame->uc.tuc_mcontext, &frame->fpstate,
-			        env, set->sig[0]);
+			        env, set->sig[0], 
+                                frame_addr + offsetof(struct rt_sigframe, fpstate));
         for(i = 0; i < TARGET_NSIG_WORDS; i++) {
             if (__put_user(set->sig[i], &frame->uc.tuc_sigmask.sig[i]))
                 goto give_sigsegv;
@@ -840,19 +853,22 @@ static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
 	if (ka->sa.sa_flags & TARGET_SA_RESTORER) {
 		err |= __put_user(ka->sa.sa_restorer, &frame->pretcode);
 	} else {
-		err |= __put_user(frame->retcode, &frame->pretcode);
+                uint16_t val16;
+                addr = frame_addr + offsetof(struct rt_sigframe, retcode);
+		err |= __put_user(addr, &frame->pretcode);
 		/* This is movl $,%eax ; int $0x80 */
-		err |= __put_user(0xb8, (char *)(frame->retcode+0));
+                err |= __put_user(0xb8, (char *)(frame->retcode+0));
 		err |= __put_user(TARGET_NR_rt_sigreturn, (int *)(frame->retcode+1));
-		err |= __put_user(0x80cd, (short *)(frame->retcode+5));
+                val16 = 0x80cd;
+                err |= __put_user(val16, (uint16_t *)(frame->retcode+5));
 	}
 
 	if (err)
 		goto give_sigsegv;
 
 	/* Set up registers for signal handler */
-	env->regs[R_ESP] = (unsigned long) frame;
-	env->eip = (unsigned long) ka->sa._sa_handler;
+	env->regs[R_ESP] = frame_addr;
+	env->eip = ka->sa._sa_handler;
 
         cpu_x86_load_seg(env, R_DS, __USER_DS);
         cpu_x86_load_seg(env, R_ES, __USER_DS);
@@ -860,9 +876,12 @@ static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
         cpu_x86_load_seg(env, R_CS, __USER_CS);
 	env->eflags &= ~TF_MASK;
 
+	unlock_user_struct(frame, frame_addr, 1);
+
 	return;
 
 give_sigsegv:
+	unlock_user_struct(frame, frame_addr, 1);
 	if (sig == TARGET_SIGSEGV)
 		ka->sa._sa_handler = TARGET_SIG_DFL;
 	force_sig(TARGET_SIGSEGV /* , current */);
@@ -872,54 +891,48 @@ static int
 restore_sigcontext(CPUX86State *env, struct target_sigcontext *sc, int *peax)
 {
 	unsigned int err = 0;
-
-        cpu_x86_load_seg(env, R_GS, lduw(&sc->gs));
-        cpu_x86_load_seg(env, R_FS, lduw(&sc->fs));
-        cpu_x86_load_seg(env, R_ES, lduw(&sc->es));
-        cpu_x86_load_seg(env, R_DS, lduw(&sc->ds));
-
-        env->regs[R_EDI] = ldl(&sc->edi);
-        env->regs[R_ESI] = ldl(&sc->esi);
-        env->regs[R_EBP] = ldl(&sc->ebp);
-        env->regs[R_ESP] = ldl(&sc->esp);
-        env->regs[R_EBX] = ldl(&sc->ebx);
-        env->regs[R_EDX] = ldl(&sc->edx);
-        env->regs[R_ECX] = ldl(&sc->ecx);
-        env->eip = ldl(&sc->eip);
+        abi_ulong fpstate_addr;
+        unsigned int tmpflags;
+
+        cpu_x86_load_seg(env, R_GS, tswap16(sc->gs));
+        cpu_x86_load_seg(env, R_FS, tswap16(sc->fs));
+        cpu_x86_load_seg(env, R_ES, tswap16(sc->es));
+        cpu_x86_load_seg(env, R_DS, tswap16(sc->ds));
+
+        env->regs[R_EDI] = tswapl(sc->edi);
+        env->regs[R_ESI] = tswapl(sc->esi);
+        env->regs[R_EBP] = tswapl(sc->ebp);
+        env->regs[R_ESP] = tswapl(sc->esp);
+        env->regs[R_EBX] = tswapl(sc->ebx);
+        env->regs[R_EDX] = tswapl(sc->edx);
+        env->regs[R_ECX] = tswapl(sc->ecx);
+        env->eip = tswapl(sc->eip);
 
         cpu_x86_load_seg(env, R_CS, lduw(&sc->cs) | 3);
         cpu_x86_load_seg(env, R_SS, lduw(&sc->ss) | 3);
 
-	{
-		unsigned int tmpflags;
-                tmpflags = ldl(&sc->eflags);
-		env->eflags = (env->eflags & ~0x40DD5) | (tmpflags & 0x40DD5);
-                //		regs->orig_eax = -1;		/* disable syscall checks */
-	}
+        tmpflags = tswapl(sc->eflags);
+        env->eflags = (env->eflags & ~0x40DD5) | (tmpflags & 0x40DD5);
+        //		regs->orig_eax = -1;		/* disable syscall checks */
 
-	{
-		struct _fpstate * buf;
-                buf = (void *)ldl(&sc->fpstate);
-		if (buf) {
-#if 0
-			if (verify_area(VERIFY_READ, buf, sizeof(*buf)))
-				goto badframe;
-#endif
-                        cpu_x86_frstor(env, (void *)buf, 1);
-		}
+        fpstate_addr = tswapl(sc->fpstate);
+	if (fpstate_addr != 0) {
+                if (!access_ok(VERIFY_READ, fpstate_addr, 
+                               sizeof(struct target_fpstate)))
+                        goto badframe;
+                cpu_x86_frstor(env, fpstate_addr, 1);
 	}
 
-        *peax = ldl(&sc->eax);
+        *peax = tswapl(sc->eax);
 	return err;
-#if 0
 badframe:
 	return 1;
-#endif
 }
 
 long do_sigreturn(CPUX86State *env)
 {
-    struct sigframe *frame = (struct sigframe *)g2h(env->regs[R_ESP] - 8);
+    struct sigframe *frame;
+    abi_ulong frame_addr = env->regs[R_ESP] - 8;
     target_sigset_t target_set;
     sigset_t set;
     int eax, i;
@@ -927,6 +940,8 @@ long do_sigreturn(CPUX86State *env)
 #if defined(DEBUG_SIGNAL)
     fprintf(stderr, "do_sigreturn\n");
 #endif
+    if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
+        goto badframe;
     /* set blocked signals */
     if (__get_user(target_set.sig[0], &frame->sc.oldmask))
         goto badframe;
@@ -941,68 +956,73 @@ long do_sigreturn(CPUX86State *env)
     /* restore registers */
     if (restore_sigcontext(env, &frame->sc, &eax))
         goto badframe;
+    unlock_user_struct(frame, frame_addr, 0);
     return eax;
 
 badframe:
+    unlock_user_struct(frame, frame_addr, 0);
     force_sig(TARGET_SIGSEGV);
     return 0;
 }
 
 long do_rt_sigreturn(CPUX86State *env)
 {
-	struct rt_sigframe *frame = (struct rt_sigframe *)g2h(env->regs[R_ESP] - 4);
+        abi_ulong frame_addr;
+	struct rt_sigframe *frame;
         sigset_t set;
 	int eax;
 
-#if 0
-	if (verify_area(VERIFY_READ, frame, sizeof(*frame)))
-		goto badframe;
-#endif
+        frame_addr = env->regs[R_ESP] - 4;
+        if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
+                goto badframe;
         target_to_host_sigset(&set, &frame->uc.tuc_sigmask);
         sigprocmask(SIG_SETMASK, &set, NULL);
 
 	if (restore_sigcontext(env, &frame->uc.tuc_mcontext, &eax))
 		goto badframe;
 
-	if (do_sigaltstack(&frame->uc.tuc_stack, NULL, get_sp_from_cpustate(env)) == -EFAULT)
+	if (do_sigaltstack(frame_addr + offsetof(struct rt_sigframe, uc.tuc_stack), 0, 
+                           get_sp_from_cpustate(env)) == -EFAULT)
 		goto badframe;
 
+        unlock_user_struct(frame, frame_addr, 0);
 	return eax;
 
 badframe:
-	force_sig(TARGET_SIGSEGV);
+        unlock_user_struct(frame, frame_addr, 0);
+        force_sig(TARGET_SIGSEGV);
 	return 0;
 }
 
 #elif defined(TARGET_ARM)
 
 struct target_sigcontext {
-	target_ulong trap_no;
-	target_ulong error_code;
-	target_ulong oldmask;
-	target_ulong arm_r0;
-	target_ulong arm_r1;
-	target_ulong arm_r2;
-	target_ulong arm_r3;
-	target_ulong arm_r4;
-	target_ulong arm_r5;
-	target_ulong arm_r6;
-	target_ulong arm_r7;
-	target_ulong arm_r8;
-	target_ulong arm_r9;
-	target_ulong arm_r10;
-	target_ulong arm_fp;
-	target_ulong arm_ip;
-	target_ulong arm_sp;
-	target_ulong arm_lr;
-	target_ulong arm_pc;
-	target_ulong arm_cpsr;
-	target_ulong fault_address;
+	abi_ulong trap_no;
+	abi_ulong error_code;
+	abi_ulong oldmask;
+	abi_ulong arm_r0;
+	abi_ulong arm_r1;
+	abi_ulong arm_r2;
+	abi_ulong arm_r3;
+	abi_ulong arm_r4;
+	abi_ulong arm_r5;
+	abi_ulong arm_r6;
+	abi_ulong arm_r7;
+	abi_ulong arm_r8;
+	abi_ulong arm_r9;
+	abi_ulong arm_r10;
+	abi_ulong arm_fp;
+	abi_ulong arm_ip;
+	abi_ulong arm_sp;
+	abi_ulong arm_lr;
+	abi_ulong arm_pc;
+	abi_ulong arm_cpsr;
+	abi_ulong fault_address;
 };
 
 struct target_ucontext {
-    target_ulong tuc_flags;
-    target_ulong tuc_link;
+    abi_ulong tuc_flags;
+    abi_ulong tuc_link;
     target_stack_t tuc_stack;
     struct target_sigcontext tuc_mcontext;
     target_sigset_t  tuc_sigmask;	/* mask last for extensibility */
@@ -1011,17 +1031,17 @@ struct target_ucontext {
 struct sigframe
 {
     struct target_sigcontext sc;
-    target_ulong extramask[TARGET_NSIG_WORDS-1];
-    target_ulong retcode;
+    abi_ulong extramask[TARGET_NSIG_WORDS-1];
+    abi_ulong retcode;
 };
 
 struct rt_sigframe
 {
-    struct target_siginfo *pinfo;
-    void *puc;
+    abi_ulong pinfo;
+    abi_ulong puc;
     struct target_siginfo info;
     struct target_ucontext uc;
-    target_ulong retcode;
+    abi_ulong retcode;
 };
 
 #define TARGET_CONFIG_CPU_32 1
@@ -1039,7 +1059,7 @@ struct rt_sigframe
 #define SWI_THUMB_SIGRETURN	(0xdf00 << 16 | 0x2700 | (TARGET_NR_sigreturn))
 #define SWI_THUMB_RT_SIGRETURN	(0xdf00 << 16 | 0x2700 | (TARGET_NR_rt_sigreturn))
 
-static const target_ulong retcodes[4] = {
+static const abi_ulong retcodes[4] = {
 	SWI_SYS_SIGRETURN,	SWI_THUMB_SIGRETURN,
 	SWI_SYS_RT_SIGRETURN,	SWI_THUMB_RT_SIGRETURN
 };
@@ -1055,7 +1075,7 @@ static inline int valid_user_regs(CPUState *regs)
 
 static int
 setup_sigcontext(struct target_sigcontext *sc, /*struct _fpstate *fpstate,*/
-		 CPUState *env, unsigned long mask)
+		 CPUState *env, abi_ulong mask)
 {
 	int err = 0;
 
@@ -1087,7 +1107,7 @@ setup_sigcontext(struct target_sigcontext *sc, /*struct _fpstate *fpstate,*/
 	return err;
 }
 
-static inline void *
+static inline abi_ulong
 get_sigframe(struct emulated_sigaction *ka, CPUState *regs, int framesize)
 {
 	unsigned long sp = regs->regs[13];
@@ -1100,19 +1120,19 @@ get_sigframe(struct emulated_sigaction *ka, CPUState *regs, int framesize)
 	/*
 	 * ATPCS B01 mandates 8-byte alignment
 	 */
-	return g2h((sp - framesize) & ~7);
+	return (sp - framesize) & ~7;
 }
 
 static int
 setup_return(CPUState *env, struct emulated_sigaction *ka,
-	     target_ulong *rc, void *frame, int usig)
+	     abi_ulong *rc, abi_ulong frame_addr, int usig, abi_ulong rc_addr)
 {
-	target_ulong handler = (target_ulong)ka->sa._sa_handler;
-	target_ulong retcode;
+	abi_ulong handler = ka->sa._sa_handler;
+	abi_ulong retcode;
 	int thumb = 0;
 #if defined(TARGET_CONFIG_CPU_32)
 #if 0
-	target_ulong cpsr = env->cpsr;
+	abi_ulong cpsr = env->cpsr;
 
 	/*
 	 * Maybe we need to deliver a 32-bit signal to a 26-bit task.
@@ -1138,7 +1158,7 @@ setup_return(CPUState *env, struct emulated_sigaction *ka,
 #endif /* TARGET_CONFIG_CPU_32 */
 
 	if (ka->sa.sa_flags & TARGET_SA_RESTORER) {
-		retcode = (target_ulong)ka->sa.sa_restorer;
+		retcode = ka->sa.sa_restorer;
 	} else {
 		unsigned int idx = thumb;
 
@@ -1148,14 +1168,14 @@ setup_return(CPUState *env, struct emulated_sigaction *ka,
 		if (__put_user(retcodes[idx], rc))
 			return 1;
 #if 0
-		flush_icache_range((target_ulong)rc,
-				   (target_ulong)(rc + 1));
+		flush_icache_range((abi_ulong)rc,
+				   (abi_ulong)(rc + 1));
 #endif
-		retcode = ((target_ulong)rc) + thumb;
+		retcode = rc_addr + thumb;
 	}
 
 	env->regs[0] = usig;
-	env->regs[13] = h2g(frame);
+	env->regs[13] = frame_addr;
 	env->regs[14] = retcode;
 	env->regs[15] = handler & (thumb ? ~1 : ~3);
 
@@ -1168,37 +1188,51 @@ setup_return(CPUState *env, struct emulated_sigaction *ka,
 	return 0;
 }
 
+/* compare linux/arch/arm/kernel/signal.c:setup_frame() */
 static void setup_frame(int usig, struct emulated_sigaction *ka,
 			target_sigset_t *set, CPUState *regs)
 {
-	struct sigframe *frame = get_sigframe(ka, regs, sizeof(*frame));
+	struct sigframe *frame;
+	abi_ulong frame_addr = get_sigframe(ka, regs, sizeof(*frame));
 	int i, err = 0;
 
+	if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
+		return;
+
 	err |= setup_sigcontext(&frame->sc, /*&frame->fpstate,*/ regs, set->sig[0]);
 
         for(i = 1; i < TARGET_NSIG_WORDS; i++) {
             if (__put_user(set->sig[i], &frame->extramask[i - 1]))
-                return;
+                goto end;
 	}
 
 	if (err == 0)
-            err = setup_return(regs, ka, &frame->retcode, frame, usig);
+                err = setup_return(regs, ka, &frame->retcode, frame_addr, usig,
+                                   frame_addr + offsetof(struct sigframe, retcode));
+
+end:
+	unlock_user_struct(frame, frame_addr, 1);
         //	return err;
 }
 
+/* compare linux/arch/arm/kernel/signal.c:setup_rt_frame() */
 static void setup_rt_frame(int usig, struct emulated_sigaction *ka,
                            target_siginfo_t *info,
 			   target_sigset_t *set, CPUState *env)
 {
-	struct rt_sigframe *frame = get_sigframe(ka, env, sizeof(*frame));
+	struct rt_sigframe *frame;
+	abi_ulong frame_addr = get_sigframe(ka, env, sizeof(*frame));
 	struct target_sigaltstack stack;
 	int i, err = 0;
+        abi_ulong info_addr, uc_addr;
 
-	if (!access_ok(VERIFY_WRITE, frame, sizeof (*frame)))
+	if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
             return /* 1 */;
 
-	__put_user_error(&frame->info, (target_ulong *)&frame->pinfo, err);
-	__put_user_error(&frame->uc, (target_ulong *)&frame->puc, err);
+        info_addr = frame_addr + offsetof(struct rt_sigframe, info);
+	__put_user_error(info_addr, &frame->pinfo, err);
+        uc_addr = frame_addr + offsetof(struct rt_sigframe, uc);
+	__put_user_error(uc_addr, &frame->puc, err);
 	err |= copy_siginfo_to_user(&frame->info, info);
 
 	/* Clear all the bits of the ucontext we don't use.  */
@@ -1208,20 +1242,18 @@ static void setup_rt_frame(int usig, struct emulated_sigaction *ka,
         __put_user(target_sigaltstack_used.ss_sp, &stack.ss_sp);
         __put_user(target_sigaltstack_used.ss_size, &stack.ss_size);
         __put_user(sas_ss_flags(get_sp_from_cpustate(env)), &stack.ss_flags);
-        if (!access_ok(VERIFY_WRITE, &frame->uc.tuc_stack, sizeof(stack)))
-            err = 1;
-        else
-            memcpy(&frame->uc.tuc_stack, &stack, sizeof(stack));
+        memcpy(&frame->uc.tuc_stack, &stack, sizeof(stack));
 
 	err |= setup_sigcontext(&frame->uc.tuc_mcontext, /*&frame->fpstate,*/
 				env, set->sig[0]);
         for(i = 0; i < TARGET_NSIG_WORDS; i++) {
             if (__put_user(set->sig[i], &frame->uc.tuc_sigmask.sig[i]))
-                return;
+                goto end;
         }
 
 	if (err == 0)
-		err = setup_return(env, ka, &frame->retcode, frame, usig);
+		err = setup_return(env, ka, &frame->retcode, frame_addr, usig,
+                                   frame_addr + offsetof(struct rt_sigframe, retcode));
 
 	if (err == 0) {
 		/*
@@ -1229,10 +1261,13 @@ static void setup_rt_frame(int usig, struct emulated_sigaction *ka,
 		 * arguments for the signal handler.
 		 *   -- Peter Maydell <pmaydell@chiark.greenend.org.uk> 2000-12-06
 		 */
-            env->regs[1] = (target_ulong)frame->pinfo;
-            env->regs[2] = (target_ulong)frame->puc;
+            env->regs[1] = info_addr;
+            env->regs[2] = uc_addr;
 	}
 
+end:
+	unlock_user_struct(frame, frame_addr, 1);
+
         //	return err;
 }
 
@@ -1270,6 +1305,7 @@ restore_sigcontext(CPUState *env, struct target_sigcontext *sc)
 
 long do_sigreturn(CPUState *env)
 {
+        abi_ulong frame_addr;
 	struct sigframe *frame;
 	target_sigset_t set;
         sigset_t host_set;
@@ -1283,12 +1319,10 @@ long do_sigreturn(CPUState *env)
 	if (env->regs[13] & 7)
 		goto badframe;
 
-	frame = (struct sigframe *)g2h(env->regs[13]);
+        frame_addr = env->regs[13];
+	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
+                goto badframe;
 
-#if 0
-	if (verify_area(VERIFY_READ, frame, sizeof (*frame)))
-		goto badframe;
-#endif
 	if (__get_user(set.sig[0], &frame->sc.oldmask))
             goto badframe;
         for(i = 1; i < TARGET_NSIG_WORDS; i++) {
@@ -1307,15 +1341,18 @@ long do_sigreturn(CPUState *env)
 	if (ptrace_cancel_bpt(current))
 		send_sig(SIGTRAP, current, 1);
 #endif
-	return env->regs[0];
+	unlock_user_struct(frame, frame_addr, 0);
+        return env->regs[0];
 
 badframe:
+	unlock_user_struct(frame, frame_addr, 0);
         force_sig(SIGSEGV /* , current */);
 	return 0;
 }
 
 long do_rt_sigreturn(CPUState *env)
 {
+        abi_ulong frame_addr;
 	struct rt_sigframe *frame;
         sigset_t host_set;
 
@@ -1327,19 +1364,17 @@ long do_rt_sigreturn(CPUState *env)
 	if (env->regs[13] & 7)
 		goto badframe;
 
-	frame = (struct rt_sigframe *)env->regs[13];
+        frame_addr = env->regs[13];
+	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
+                goto badframe;
 
-#if 0
-	if (verify_area(VERIFY_READ, frame, sizeof (*frame)))
-		goto badframe;
-#endif
         target_to_host_sigset(&host_set, &frame->uc.tuc_sigmask);
         sigprocmask(SIG_SETMASK, &host_set, NULL);
 
 	if (restore_sigcontext(env, &frame->uc.tuc_mcontext))
 		goto badframe;
 
-	if (do_sigaltstack(&frame->uc.tuc_stack, NULL, get_sp_from_cpustate(env)) == -EFAULT)
+	if (do_sigaltstack(frame_addr + offsetof(struct rt_sigframe, uc.tuc_stack), 0, get_sp_from_cpustate(env)) == -EFAULT)
 		goto badframe;
 
 #if 0
@@ -1347,9 +1382,11 @@ long do_rt_sigreturn(CPUState *env)
 	if (ptrace_cancel_bpt(current))
 		send_sig(SIGTRAP, current, 1);
 #endif
+	unlock_user_struct(frame, frame_addr, 0);
 	return env->regs[0];
 
 badframe:
+	unlock_user_struct(frame, frame_addr, 0);
         force_sig(SIGSEGV /* , current */);
 	return 0;
 }
@@ -1360,48 +1397,48 @@ badframe:
 
 /* This is what SunOS does, so shall I. */
 struct target_sigcontext {
-        target_ulong sigc_onstack;      /* state to restore */
+        abi_ulong sigc_onstack;      /* state to restore */
 
-        target_ulong sigc_mask;         /* sigmask to restore */
-        target_ulong sigc_sp;           /* stack pointer */
-        target_ulong sigc_pc;           /* program counter */
-        target_ulong sigc_npc;          /* next program counter */
-        target_ulong sigc_psr;          /* for condition codes etc */
-        target_ulong sigc_g1;           /* User uses these two registers */
-        target_ulong sigc_o0;           /* within the trampoline code. */
+        abi_ulong sigc_mask;         /* sigmask to restore */
+        abi_ulong sigc_sp;           /* stack pointer */
+        abi_ulong sigc_pc;           /* program counter */
+        abi_ulong sigc_npc;          /* next program counter */
+        abi_ulong sigc_psr;          /* for condition codes etc */
+        abi_ulong sigc_g1;           /* User uses these two registers */
+        abi_ulong sigc_o0;           /* within the trampoline code. */
 
         /* Now comes information regarding the users window set
          * at the time of the signal.
          */
-        target_ulong sigc_oswins;       /* outstanding windows */
+        abi_ulong sigc_oswins;       /* outstanding windows */
 
         /* stack ptrs for each regwin buf */
         char *sigc_spbuf[__SUNOS_MAXWIN];
 
         /* Windows to restore after signal */
         struct {
-                target_ulong locals[8];
-                target_ulong ins[8];
+                abi_ulong locals[8];
+                abi_ulong ins[8];
         } sigc_wbuf[__SUNOS_MAXWIN];
 };
 /* A Sparc stack frame */
 struct sparc_stackf {
-        target_ulong locals[8];
-        target_ulong ins[6];
+        abi_ulong locals[8];
+        abi_ulong ins[6];
         struct sparc_stackf *fp;
-        target_ulong callers_pc;
+        abi_ulong callers_pc;
         char *structptr;
-        target_ulong xargs[6];
-        target_ulong xxargs[1];
+        abi_ulong xargs[6];
+        abi_ulong xxargs[1];
 };
 
 typedef struct {
         struct {
-                target_ulong psr;
-                target_ulong pc;
-                target_ulong npc;
-                target_ulong y;
-                target_ulong u_regs[16]; /* globals and ins */
+                abi_ulong psr;
+                abi_ulong pc;
+                abi_ulong npc;
+                abi_ulong y;
+                abi_ulong u_regs[16]; /* globals and ins */
         }               si_regs;
         int             si_mask;
 } __siginfo_t;
@@ -1420,18 +1457,18 @@ typedef struct {
 struct target_signal_frame {
 	struct sparc_stackf	ss;
 	__siginfo_t		info;
-	qemu_siginfo_fpu_t 	*fpu_save;
-	target_ulong		insns[2] __attribute__ ((aligned (8)));
-	target_ulong		extramask[TARGET_NSIG_WORDS - 1];
-	target_ulong		extra_size; /* Should be 0 */
+	abi_ulong               fpu_save;
+	abi_ulong		insns[2] __attribute__ ((aligned (8)));
+	abi_ulong		extramask[TARGET_NSIG_WORDS - 1];
+	abi_ulong		extra_size; /* Should be 0 */
 	qemu_siginfo_fpu_t	fpu_state;
 };
 struct target_rt_signal_frame {
 	struct sparc_stackf	ss;
 	siginfo_t		info;
-	target_ulong		regs[20];
+	abi_ulong		regs[20];
 	sigset_t		mask;
-	qemu_siginfo_fpu_t 	*fpu_save;
+	abi_ulong               fpu_save;
 	unsigned int		insns[2];
 	stack_t			stack;
 	unsigned int		extra_size; /* Should be 0 */
@@ -1443,15 +1480,19 @@ struct target_rt_signal_frame {
 #define UREG_I0        0
 #define UREG_I1        1
 #define UREG_I2        2
+#define UREG_I3        3
+#define UREG_I4        4
+#define UREG_I5        5
 #define UREG_I6        6
 #define UREG_I7        7
 #define UREG_L0	       8
 #define UREG_FP        UREG_I6
 #define UREG_SP        UREG_O6
 
-static inline void *get_sigframe(struct emulated_sigaction *sa, CPUState *env, unsigned long framesize)
+static inline abi_ulong get_sigframe(struct emulated_sigaction *sa, 
+                                     CPUState *env, unsigned long framesize)
 {
-	unsigned long sp;
+	abi_ulong sp;
 
 	sp = env->regwptr[UREG_FP];
 
@@ -1461,11 +1502,11 @@ static inline void *get_sigframe(struct emulated_sigaction *sa, CPUState *env, u
                 && !((target_sigaltstack_used.ss_sp + target_sigaltstack_used.ss_size) & 7))
                 sp = target_sigaltstack_used.ss_sp + target_sigaltstack_used.ss_size;
 	}
-	return g2h(sp - framesize);
+	return sp - framesize;
 }
 
 static int
-setup___siginfo(__siginfo_t *si, CPUState *env, target_ulong mask)
+setup___siginfo(__siginfo_t *si, CPUState *env, abi_ulong mask)
 {
 	int err = 0, i;
 
@@ -1506,6 +1547,7 @@ setup_sigcontext(struct target_sigcontext *sc, /*struct _fpstate *fpstate,*/
 static void setup_frame(int sig, struct emulated_sigaction *ka,
 			target_sigset_t *set, CPUState *env)
 {
+        abi_ulong sf_addr;
 	struct target_signal_frame *sf;
 	int sigframe_size, err, i;
 
@@ -1513,10 +1555,13 @@ static void setup_frame(int sig, struct emulated_sigaction *ka,
 	//synchronize_user_stack();
 
         sigframe_size = NF_ALIGNEDSZ;
+	sf_addr = get_sigframe(ka, env, sigframe_size);
 
-	sf = (struct target_signal_frame *)
-		get_sigframe(ka, env, sigframe_size);
-
+        sf = lock_user(VERIFY_WRITE, sf_addr, 
+                       sizeof(struct target_signal_frame), 0);
+        if (!sf)
+		goto sigsegv;
+                
 	//fprintf(stderr, "sf: %x pc %x fp %x sp %x\n", sf, env->pc, env->regwptr[UREG_FP], env->regwptr[UREG_SP]);
 #if 0
 	if (invalid_frame_pointer(sf, sigframe_size))
@@ -1544,25 +1589,32 @@ static void setup_frame(int sig, struct emulated_sigaction *ka,
 		goto sigsegv;
 
 	/* 3. signal handler back-trampoline and parameters */
-	env->regwptr[UREG_FP] = h2g(sf);
+	env->regwptr[UREG_FP] = sf_addr;
 	env->regwptr[UREG_I0] = sig;
-	env->regwptr[UREG_I1] = h2g(&sf->info);
-	env->regwptr[UREG_I2] = h2g(&sf->info);
+	env->regwptr[UREG_I1] = sf_addr + 
+                offsetof(struct target_signal_frame, info);
+	env->regwptr[UREG_I2] = sf_addr + 
+                offsetof(struct target_signal_frame, info);
 
 	/* 4. signal handler */
-	env->pc = (unsigned long) ka->sa._sa_handler;
+	env->pc = ka->sa._sa_handler;
 	env->npc = (env->pc + 4);
 	/* 5. return to kernel instructions */
 	if (ka->sa.sa_restorer)
-		env->regwptr[UREG_I7] = (unsigned long)ka->sa.sa_restorer;
+		env->regwptr[UREG_I7] = ka->sa.sa_restorer;
 	else {
-		env->regwptr[UREG_I7] = h2g(&(sf->insns[0]) - 2);
+                uint32_t val32;
+
+		env->regwptr[UREG_I7] = sf_addr + 
+                        offsetof(struct target_signal_frame, insns) - 2 * 4;
 
 		/* mov __NR_sigreturn, %g1 */
-		err |= __put_user(0x821020d8, &sf->insns[0]);
+                val32 = 0x821020d8;
+		err |= __put_user(val32, &sf->insns[0]);
 
 		/* t 0x10 */
-		err |= __put_user(0x91d02010, &sf->insns[1]);
+                val32 = 0x91d02010;
+		err |= __put_user(val32, &sf->insns[1]);
 		if (err)
 			goto sigsegv;
 
@@ -1570,12 +1622,15 @@ static void setup_frame(int sig, struct emulated_sigaction *ka,
 		//flush_sig_insns(current->mm, (unsigned long) &(sf->insns[0]));
                 //		tb_flush(env);
 	}
+        unlock_user(sf, sf_addr, sizeof(struct target_signal_frame));
 	return;
-
-        //sigill_and_return:
+#if 0
+sigill_and_return:
 	force_sig(TARGET_SIGILL);
+#endif
 sigsegv:
 	//fprintf(stderr, "force_sig\n");
+        unlock_user(sf, sf_addr, sizeof(struct target_signal_frame));
 	force_sig(TARGET_SIGSEGV);
 }
 static inline int
@@ -1627,14 +1682,17 @@ static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
 
 long do_sigreturn(CPUState *env)
 {
+        abi_ulong sf_addr;
         struct target_signal_frame *sf;
         uint32_t up_psr, pc, npc;
         target_sigset_t set;
         sigset_t host_set;
-        target_ulong fpu_save;
+        abi_ulong fpu_save_addr;
         int err, i;
 
-        sf = (struct target_signal_frame *)g2h(env->regwptr[UREG_FP]);
+        sf_addr = env->regwptr[UREG_FP];
+        if (!lock_user_struct(VERIFY_READ, sf, sf_addr, 1))
+                goto segv_and_exit;
 #if 0
 	fprintf(stderr, "sigreturn\n");
 	fprintf(stderr, "sf: %x pc %x fp %x sp %x\n", sf, env->pc, env->regwptr[UREG_FP], env->regwptr[UREG_SP]);
@@ -1642,12 +1700,8 @@ long do_sigreturn(CPUState *env)
 	//cpu_dump_state(env, stderr, fprintf, 0);
 
         /* 1. Make sure we are not getting garbage from the user */
-#if 0
-        if (verify_area (VERIFY_READ, sf, sizeof (*sf)))
-                goto segv_and_exit;
-#endif
 
-        if (((uint) sf) & 3)
+        if (sf_addr & 3)
                 goto segv_and_exit;
 
         err = __get_user(pc,  &sf->info.si_regs.pc);
@@ -1673,7 +1727,7 @@ long do_sigreturn(CPUState *env)
 		err |= __get_user(env->regwptr[i + UREG_I0], &sf->info.si_regs.u_regs[i+8]);
 	}
 
-        err |= __get_user(fpu_save, (target_ulong *)&sf->fpu_save);
+        err |= __get_user(fpu_save_addr, &sf->fpu_save);
 
         //if (fpu_save)
         //        err |= restore_fpu_state(env, fpu_save);
@@ -1691,20 +1745,279 @@ long do_sigreturn(CPUState *env)
 
         if (err)
                 goto segv_and_exit;
-
+        unlock_user_struct(sf, sf_addr, 0);
         return env->regwptr[0];
 
 segv_and_exit:
+        unlock_user_struct(sf, sf_addr, 0);
 	force_sig(TARGET_SIGSEGV);
 }
 
 long do_rt_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
+}
+
+#if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
+#define MC_TSTATE 0
+#define MC_PC 1
+#define MC_NPC 2
+#define MC_Y 3
+#define MC_G1 4
+#define MC_G2 5
+#define MC_G3 6
+#define MC_G4 7
+#define MC_G5 8
+#define MC_G6 9
+#define MC_G7 10
+#define MC_O0 11
+#define MC_O1 12
+#define MC_O2 13
+#define MC_O3 14
+#define MC_O4 15
+#define MC_O5 16
+#define MC_O6 17
+#define MC_O7 18
+#define MC_NGREG 19
+
+typedef abi_ulong target_mc_greg_t;
+typedef target_mc_greg_t target_mc_gregset_t[MC_NGREG];
+
+struct target_mc_fq {
+    abi_ulong *mcfq_addr;
+    uint32_t mcfq_insn;
+};
+
+struct target_mc_fpu {
+    union {
+        uint32_t sregs[32];
+        uint64_t dregs[32];
+        //uint128_t qregs[16];
+    } mcfpu_fregs;
+    abi_ulong mcfpu_fsr;
+    abi_ulong mcfpu_fprs;
+    abi_ulong mcfpu_gsr;
+    struct target_mc_fq *mcfpu_fq;
+    unsigned char mcfpu_qcnt;
+    unsigned char mcfpu_qentsz;
+    unsigned char mcfpu_enab;
+};
+typedef struct target_mc_fpu target_mc_fpu_t;
+
+typedef struct {
+    target_mc_gregset_t mc_gregs;
+    target_mc_greg_t mc_fp;
+    target_mc_greg_t mc_i7;
+    target_mc_fpu_t mc_fpregs;
+} target_mcontext_t;
+
+struct target_ucontext {
+    struct target_ucontext *uc_link;
+    abi_ulong uc_flags;
+    target_sigset_t uc_sigmask;
+    target_mcontext_t uc_mcontext;
+};
+
+/* A V9 register window */
+struct target_reg_window {
+    abi_ulong locals[8];
+    abi_ulong ins[8];
+};
+
+#define TARGET_STACK_BIAS 2047
+
+/* {set, get}context() needed for 64-bit SparcLinux userland. */
+void sparc64_set_context(CPUSPARCState *env)
+{
+    abi_ulong ucp_addr;
+    struct target_ucontext *ucp;
+    target_mc_gregset_t *grp;
+    abi_ulong pc, npc, tstate;
+    abi_ulong fp, i7, w_addr;
+    unsigned char fenab;
+    int err;
+    unsigned int i;
+
+    ucp_addr = env->regwptr[UREG_I0];
+    if (!lock_user_struct(VERIFY_READ, ucp, ucp_addr, 1))
+        goto do_sigsegv;
+    grp  = &ucp->uc_mcontext.mc_gregs;
+    err  = __get_user(pc, &((*grp)[MC_PC]));
+    err |= __get_user(npc, &((*grp)[MC_NPC]));
+    if (err || ((pc | npc) & 3))
+        goto do_sigsegv;
+    if (env->regwptr[UREG_I1]) {
+        target_sigset_t target_set;
+        sigset_t set;
+
+        if (TARGET_NSIG_WORDS == 1) {
+            if (__get_user(target_set.sig[0], &ucp->uc_sigmask.sig[0]))
+                goto do_sigsegv;
+        } else {
+            abi_ulong *src, *dst;
+            src = ucp->uc_sigmask.sig;
+            dst = target_set.sig;
+            for (i = 0; i < sizeof(target_sigset_t) / sizeof(abi_ulong);
+                 i++, dst++, src++)
+                err |= __get_user(*dst, src);
+            if (err)
+                goto do_sigsegv;
+        }
+        target_to_host_sigset_internal(&set, &target_set);
+        sigprocmask(SIG_SETMASK, &set, NULL);
+    }
+    env->pc = pc;
+    env->npc = npc;
+    err |= __get_user(env->y, &((*grp)[MC_Y]));
+    err |= __get_user(tstate, &((*grp)[MC_TSTATE]));
+    env->asi = (tstate >> 24) & 0xff;
+    PUT_CCR(env, tstate >> 32);
+    PUT_CWP64(env, tstate & 0x1f);
+    err |= __get_user(env->gregs[1], (&(*grp)[MC_G1]));
+    err |= __get_user(env->gregs[2], (&(*grp)[MC_G2]));
+    err |= __get_user(env->gregs[3], (&(*grp)[MC_G3]));
+    err |= __get_user(env->gregs[4], (&(*grp)[MC_G4]));
+    err |= __get_user(env->gregs[5], (&(*grp)[MC_G5]));
+    err |= __get_user(env->gregs[6], (&(*grp)[MC_G6]));
+    err |= __get_user(env->gregs[7], (&(*grp)[MC_G7]));
+    err |= __get_user(env->regwptr[UREG_I0], (&(*grp)[MC_O0]));
+    err |= __get_user(env->regwptr[UREG_I1], (&(*grp)[MC_O1]));
+    err |= __get_user(env->regwptr[UREG_I2], (&(*grp)[MC_O2]));
+    err |= __get_user(env->regwptr[UREG_I3], (&(*grp)[MC_O3]));
+    err |= __get_user(env->regwptr[UREG_I4], (&(*grp)[MC_O4]));
+    err |= __get_user(env->regwptr[UREG_I5], (&(*grp)[MC_O5]));
+    err |= __get_user(env->regwptr[UREG_I6], (&(*grp)[MC_O6]));
+    err |= __get_user(env->regwptr[UREG_I7], (&(*grp)[MC_O7]));
+
+    err |= __get_user(fp, &(ucp->uc_mcontext.mc_fp));
+    err |= __get_user(i7, &(ucp->uc_mcontext.mc_i7));
+
+    w_addr = TARGET_STACK_BIAS+env->regwptr[UREG_I6];
+    if (put_user(fp, w_addr + offsetof(struct target_reg_window, ins[6]), 
+                 abi_ulong) != 0)
+        goto do_sigsegv;
+    if (put_user(i7, w_addr + offsetof(struct target_reg_window, ins[7]), 
+                 abi_ulong) != 0)
+        goto do_sigsegv;
+    err |= __get_user(fenab, &(ucp->uc_mcontext.mc_fpregs.mcfpu_enab));
+    err |= __get_user(env->fprs, &(ucp->uc_mcontext.mc_fpregs.mcfpu_fprs));
+    {
+        uint32_t *src, *dst;
+        src = ucp->uc_mcontext.mc_fpregs.mcfpu_fregs.sregs;
+        dst = env->fpr;
+        /* XXX: check that the CPU storage is the same as user context */
+        for (i = 0; i < 64; i++, dst++, src++)
+            err |= __get_user(*dst, src);
+    }
+    err |= __get_user(env->fsr,
+                      &(ucp->uc_mcontext.mc_fpregs.mcfpu_fsr));
+    err |= __get_user(env->gsr,
+                      &(ucp->uc_mcontext.mc_fpregs.mcfpu_gsr));
+    if (err)
+        goto do_sigsegv;
+    unlock_user_struct(ucp, ucp_addr, 0);
+    return;
+ do_sigsegv:
+    unlock_user_struct(ucp, ucp_addr, 0);
+    force_sig(SIGSEGV);
 }
 
-#elif defined(TARGET_MIPS64)
+void sparc64_get_context(CPUSPARCState *env)
+{
+    abi_ulong ucp_addr;
+    struct target_ucontext *ucp;
+    target_mc_gregset_t *grp;
+    target_mcontext_t *mcp;
+    abi_ulong fp, i7, w_addr;
+    int err;
+    unsigned int i;
+    target_sigset_t target_set;
+    sigset_t set;
+
+    ucp_addr = env->regwptr[UREG_I0];
+    if (!lock_user_struct(VERIFY_WRITE, ucp, ucp_addr, 0))
+        goto do_sigsegv;
+    
+    mcp = &ucp->uc_mcontext;
+    grp = &mcp->mc_gregs;
+
+    /* Skip over the trap instruction, first. */
+    env->pc = env->npc;
+    env->npc += 4;
+
+    err = 0;
+
+    sigprocmask(0, NULL, &set);
+    host_to_target_sigset_internal(&target_set, &set);
+    if (TARGET_NSIG_WORDS == 1) {
+        err |= __put_user(target_set.sig[0],
+                          (abi_ulong *)&ucp->uc_sigmask);
+    } else {
+        abi_ulong *src, *dst;
+        src = target_set.sig;
+        dst = ucp->uc_sigmask.sig;
+        for (i = 0; i < sizeof(target_sigset_t) / sizeof(abi_ulong);
+             i++, dst++, src++)
+            err |= __put_user(*src, dst);
+        if (err)
+            goto do_sigsegv;
+    }
+
+    /* XXX: tstate must be saved properly */
+    //    err |= __put_user(env->tstate, &((*grp)[MC_TSTATE]));
+    err |= __put_user(env->pc, &((*grp)[MC_PC]));
+    err |= __put_user(env->npc, &((*grp)[MC_NPC]));
+    err |= __put_user(env->y, &((*grp)[MC_Y]));
+    err |= __put_user(env->gregs[1], &((*grp)[MC_G1]));
+    err |= __put_user(env->gregs[2], &((*grp)[MC_G2]));
+    err |= __put_user(env->gregs[3], &((*grp)[MC_G3]));
+    err |= __put_user(env->gregs[4], &((*grp)[MC_G4]));
+    err |= __put_user(env->gregs[5], &((*grp)[MC_G5]));
+    err |= __put_user(env->gregs[6], &((*grp)[MC_G6]));
+    err |= __put_user(env->gregs[7], &((*grp)[MC_G7]));
+    err |= __put_user(env->regwptr[UREG_I0], &((*grp)[MC_O0]));
+    err |= __put_user(env->regwptr[UREG_I1], &((*grp)[MC_O1]));
+    err |= __put_user(env->regwptr[UREG_I2], &((*grp)[MC_O2]));
+    err |= __put_user(env->regwptr[UREG_I3], &((*grp)[MC_O3]));
+    err |= __put_user(env->regwptr[UREG_I4], &((*grp)[MC_O4]));
+    err |= __put_user(env->regwptr[UREG_I5], &((*grp)[MC_O5]));
+    err |= __put_user(env->regwptr[UREG_I6], &((*grp)[MC_O6]));
+    err |= __put_user(env->regwptr[UREG_I7], &((*grp)[MC_O7]));
+
+    w_addr = TARGET_STACK_BIAS+env->regwptr[UREG_I6];
+    fp = i7 = 0;
+    if (get_user(fp, w_addr + offsetof(struct target_reg_window, ins[6]), 
+                 abi_ulong) != 0)
+        goto do_sigsegv;
+    if (get_user(i7, w_addr + offsetof(struct target_reg_window, ins[7]), 
+                 abi_ulong) != 0)
+        goto do_sigsegv;
+    err |= __put_user(fp, &(mcp->mc_fp));
+    err |= __put_user(i7, &(mcp->mc_i7));
+
+    {
+        uint32_t *src, *dst;
+        src = env->fpr;
+        dst = ucp->uc_mcontext.mc_fpregs.mcfpu_fregs.sregs;
+        /* XXX: check that the CPU storage is the same as user context */
+        for (i = 0; i < 64; i++, dst++, src++)
+            err |= __put_user(*src, dst);
+    }
+    err |= __put_user(env->fsr, &(mcp->mc_fpregs.mcfpu_fsr));
+    err |= __put_user(env->gsr, &(mcp->mc_fpregs.mcfpu_gsr));
+    err |= __put_user(env->fprs, &(mcp->mc_fpregs.mcfpu_fprs));
+
+    if (err)
+        goto do_sigsegv;
+    unlock_user_struct(ucp, ucp_addr, 1);
+    return;
+ do_sigsegv:
+    unlock_user_struct(ucp, ucp_addr, 1);
+    force_sig(SIGSEGV);
+}
+#endif
+#elif defined(TARGET_ABI_MIPSN64)
 
 # warning signal handling not implemented
 
@@ -1724,16 +2037,16 @@ static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
 long do_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 long do_rt_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
-#elif defined(TARGET_MIPSN32)
+#elif defined(TARGET_ABI_MIPSN32)
 
 # warning signal handling not implemented
 
@@ -1753,16 +2066,16 @@ static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
 long do_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 long do_rt_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
-#elif defined(TARGET_MIPS)
+#elif defined(TARGET_ABI_MIPSO32)
 
 struct target_sigcontext {
     uint32_t   sc_regmask;     /* Unused */
@@ -1956,7 +2269,7 @@ restore_sigcontext(CPUState *regs, struct target_sigcontext *sc)
 /*
  * Determine which stack to use..
  */
-static inline void *
+static inline abi_ulong
 get_sigframe(struct emulated_sigaction *ka, CPUState *regs, size_t frame_size)
 {
     unsigned long sp;
@@ -1976,17 +2289,19 @@ get_sigframe(struct emulated_sigaction *ka, CPUState *regs, size_t frame_size)
         sp = target_sigaltstack_used.ss_sp + target_sigaltstack_used.ss_size;
     }
 
-    return g2h((sp - frame_size) & ~7);
+    return (sp - frame_size) & ~7;
 }
 
+/* compare linux/arch/mips/kernel/signal.c:setup_frame() */
 static void setup_frame(int sig, struct emulated_sigaction * ka,
-   		target_sigset_t *set, CPUState *regs)
+                        target_sigset_t *set, CPUState *regs)
 {
     struct sigframe *frame;
+    abi_ulong frame_addr;
     int i;
 
-    frame = get_sigframe(ka, regs, sizeof(*frame));
-    if (!access_ok(VERIFY_WRITE, frame, sizeof (*frame)))
+    frame_addr = get_sigframe(ka, regs, sizeof(*frame));
+    if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
 	goto give_sigsegv;
 
     install_sigtramp(frame->sf_code, TARGET_NR_sigreturn);
@@ -2011,16 +2326,18 @@ static void setup_frame(int sig, struct emulated_sigaction * ka,
     */
     regs->gpr[ 4][regs->current_tc] = sig;
     regs->gpr[ 5][regs->current_tc] = 0;
-    regs->gpr[ 6][regs->current_tc] = h2g(&frame->sf_sc);
-    regs->gpr[29][regs->current_tc] = h2g(frame);
-    regs->gpr[31][regs->current_tc] = h2g(frame->sf_code);
+    regs->gpr[ 6][regs->current_tc] = frame_addr + offsetof(struct sigframe, sf_sc);
+    regs->gpr[29][regs->current_tc] = frame_addr;
+    regs->gpr[31][regs->current_tc] = frame_addr + offsetof(struct sigframe, sf_code);
     /* The original kernel code sets CP0_EPC to the handler
     * since it returns to userland using eret
     * we cannot do this here, and we must set PC directly */
     regs->PC[regs->current_tc] = regs->gpr[25][regs->current_tc] = ka->sa._sa_handler;
+    unlock_user_struct(frame, frame_addr, 1);
     return;
 
 give_sigsegv:
+    unlock_user_struct(frame, frame_addr, 1);
     force_sig(TARGET_SIGSEGV/*, current*/);
     return;
 }
@@ -2028,6 +2345,7 @@ give_sigsegv:
 long do_sigreturn(CPUState *regs)
 {
     struct sigframe *frame;
+    abi_ulong frame_addr;
     sigset_t blocked;
     target_sigset_t target_set;
     int i;
@@ -2035,8 +2353,8 @@ long do_sigreturn(CPUState *regs)
 #if defined(DEBUG_SIGNAL)
     fprintf(stderr, "do_sigreturn\n");
 #endif
-    frame = (struct sigframe *) regs->gpr[29][regs->current_tc];
-    if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
+    frame_addr = regs->gpr[29][regs->current_tc];
+    if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
    	goto badframe;
 
     for(i = 0; i < TARGET_NSIG_WORDS; i++) {
@@ -2083,7 +2401,310 @@ static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
 long do_rt_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
+}
+
+#elif defined(TARGET_SH4)
+
+/*
+ * code and data structures from linux kernel:
+ * include/asm-sh/sigcontext.h
+ * arch/sh/kernel/signal.c
+ */
+
+struct target_sigcontext {
+    target_ulong  oldmask;
+
+    /* CPU registers */
+    target_ulong  sc_gregs[16];
+    target_ulong  sc_pc;
+    target_ulong  sc_pr;
+    target_ulong  sc_sr;
+    target_ulong  sc_gbr;
+    target_ulong  sc_mach;
+    target_ulong  sc_macl;
+
+    /* FPU registers */
+    target_ulong  sc_fpregs[16];
+    target_ulong  sc_xfpregs[16];
+    unsigned int sc_fpscr;
+    unsigned int sc_fpul;
+    unsigned int sc_ownedfp;
+};
+
+struct target_sigframe
+{
+    struct target_sigcontext sc;
+    target_ulong extramask[TARGET_NSIG_WORDS-1];
+    uint16_t retcode[3];
+};
+
+
+struct target_ucontext {
+    target_ulong uc_flags;
+    struct target_ucontext *uc_link;
+    target_stack_t uc_stack;
+    struct target_sigcontext uc_mcontext;
+    target_sigset_t uc_sigmask;	/* mask last for extensibility */
+};
+
+struct target_rt_sigframe
+{
+    struct target_siginfo info;
+    struct target_ucontext uc;
+    uint16_t retcode[3];
+};
+
+
+#define MOVW(n)  (0x9300|((n)-2)) /* Move mem word at PC+n to R3 */
+#define TRAP_NOARG 0xc310         /* Syscall w/no args (NR in R3) SH3/4 */
+
+static abi_ulong get_sigframe(struct emulated_sigaction *ka,
+                         unsigned long sp, size_t frame_size)
+{
+    if ((ka->sa.sa_flags & TARGET_SA_ONSTACK) && (sas_ss_flags(sp) == 0)) {
+        sp = target_sigaltstack_used.ss_sp + target_sigaltstack_used.ss_size;
+    }
+
+    return (sp - frame_size) & -8ul;
+}
+
+static int setup_sigcontext(struct target_sigcontext *sc,
+			    CPUState *regs, unsigned long mask)
+{
+    int err = 0;
+
+#define COPY(x)         err |= __put_user(regs->x, &sc->sc_##x)
+    COPY(gregs[0]); COPY(gregs[1]);
+    COPY(gregs[2]); COPY(gregs[3]);
+    COPY(gregs[4]); COPY(gregs[5]);
+    COPY(gregs[6]); COPY(gregs[7]);
+    COPY(gregs[8]); COPY(gregs[9]);
+    COPY(gregs[10]); COPY(gregs[11]);
+    COPY(gregs[12]); COPY(gregs[13]);
+    COPY(gregs[14]); COPY(gregs[15]);
+    COPY(gbr); COPY(mach);
+    COPY(macl); COPY(pr);
+    COPY(sr); COPY(pc);
+#undef COPY
+
+    /* todo: save FPU registers here */
+
+    /* non-iBCS2 extensions.. */
+    err |= __put_user(mask, &sc->oldmask);
+
+    return err;
+}
+
+static int restore_sigcontext(struct CPUState *regs,
+			      struct target_sigcontext *sc)
+{
+    unsigned int err = 0;
+
+#define COPY(x)         err |= __get_user(regs->x, &sc->sc_##x)
+    COPY(gregs[1]);
+    COPY(gregs[2]); COPY(gregs[3]);
+    COPY(gregs[4]); COPY(gregs[5]);
+    COPY(gregs[6]); COPY(gregs[7]);
+    COPY(gregs[8]); COPY(gregs[9]);
+    COPY(gregs[10]); COPY(gregs[11]);
+    COPY(gregs[12]); COPY(gregs[13]);
+    COPY(gregs[14]); COPY(gregs[15]);
+    COPY(gbr); COPY(mach);
+    COPY(macl); COPY(pr);
+    COPY(sr); COPY(pc);
+#undef COPY
+
+    /* todo: restore FPU registers here */
+
+    regs->tra = -1;         /* disable syscall checks */
+    return err;
+}
+
+static void setup_frame(int sig, struct emulated_sigaction *ka,
+			target_sigset_t *set, CPUState *regs)
+{
+    struct target_sigframe *frame;
+    abi_ulong frame_addr;
+    int i;
+    int err = 0;
+    int signal;
+
+    frame_addr = get_sigframe(ka, regs->gregs[15], sizeof(*frame));
+    if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
+	goto give_sigsegv;
+
+    signal = current_exec_domain_sig(sig);
+
+    err |= setup_sigcontext(&frame->sc, regs, set->sig[0]);
+
+    for (i = 0; i < TARGET_NSIG_WORDS - 1; i++) {
+        err |= __put_user(set->sig[i + 1], &frame->extramask[i]);
+    }
+
+    /* Set up to return from userspace.  If provided, use a stub
+       already in userspace.  */
+    if (ka->sa.sa_flags & TARGET_SA_RESTORER) {
+        regs->pr = (unsigned long) ka->sa.sa_restorer;
+    } else {
+        /* Generate return code (system call to sigreturn) */
+        err |= __put_user(MOVW(2), &frame->retcode[0]);
+        err |= __put_user(TRAP_NOARG, &frame->retcode[1]);
+        err |= __put_user((TARGET_NR_sigreturn), &frame->retcode[2]);
+        regs->pr = (unsigned long) frame->retcode;
+    }
+
+    if (err)
+        goto give_sigsegv;
+
+    /* Set up registers for signal handler */
+    regs->gregs[15] = (unsigned long) frame;
+    regs->gregs[4] = signal; /* Arg for signal handler */
+    regs->gregs[5] = 0;
+    regs->gregs[6] = (unsigned long) &frame->sc;
+    regs->pc = (unsigned long) ka->sa._sa_handler;
+
+    unlock_user_struct(frame, frame_addr, 1);
+    return;
+
+give_sigsegv:
+    unlock_user_struct(frame, frame_addr, 1);
+    force_sig(SIGSEGV);
+}
+
+static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
+                           target_siginfo_t *info,
+			   target_sigset_t *set, CPUState *regs)
+{
+    struct target_rt_sigframe *frame;
+    abi_ulong frame_addr;
+    int i;
+    int err = 0;
+    int signal;
+
+    frame_addr = get_sigframe(ka, regs->gregs[15], sizeof(*frame));
+    if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
+	goto give_sigsegv;
+
+    signal = current_exec_domain_sig(sig);
+
+    err |= copy_siginfo_to_user(&frame->info, info);
+
+    /* Create the ucontext.  */
+    err |= __put_user(0, &frame->uc.uc_flags);
+    err |= __put_user(0, (unsigned long *)&frame->uc.uc_link);
+    err |= __put_user((void *)target_sigaltstack_used.ss_sp,
+		      &frame->uc.uc_stack.ss_sp);
+    err |= __put_user(sas_ss_flags(regs->gregs[15]),
+		      &frame->uc.uc_stack.ss_flags);
+    err |= __put_user(target_sigaltstack_used.ss_size,
+		      &frame->uc.uc_stack.ss_size);
+    err |= setup_sigcontext(&frame->uc.uc_mcontext,
+			    regs, set->sig[0]);
+    for(i = 0; i < TARGET_NSIG_WORDS; i++) {
+        err |= __put_user(set->sig[i], &frame->uc.uc_sigmask.sig[i]);
+    }
+
+    /* Set up to return from userspace.  If provided, use a stub
+       already in userspace.  */
+    if (ka->sa.sa_flags & TARGET_SA_RESTORER) {
+        regs->pr = (unsigned long) ka->sa.sa_restorer;
+    } else {
+        /* Generate return code (system call to sigreturn) */
+        err |= __put_user(MOVW(2), &frame->retcode[0]);
+        err |= __put_user(TRAP_NOARG, &frame->retcode[1]);
+        err |= __put_user((TARGET_NR_rt_sigreturn), &frame->retcode[2]);
+        regs->pr = (unsigned long) frame->retcode;
+    }
+
+    if (err)
+        goto give_sigsegv;
+
+    /* Set up registers for signal handler */
+    regs->gregs[15] = (unsigned long) frame;
+    regs->gregs[4] = signal; /* Arg for signal handler */
+    regs->gregs[5] = (unsigned long) &frame->info;
+    regs->gregs[6] = (unsigned long) &frame->uc;
+    regs->pc = (unsigned long) ka->sa._sa_handler;
+
+    unlock_user_struct(frame, frame_addr, 1);
+    return;
+
+give_sigsegv:
+    unlock_user_struct(frame, frame_addr, 1);
+    force_sig(SIGSEGV);
+}
+
+long do_sigreturn(CPUState *regs)
+{
+    struct target_sigframe *frame;
+    abi_ulong frame_addr;
+    sigset_t blocked;
+    target_sigset_t target_set;
+    int i;
+    int err = 0;
+
+#if defined(DEBUG_SIGNAL)
+    fprintf(stderr, "do_sigreturn\n");
+#endif
+    frame_addr = regs->gregs[15];
+    if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
+   	goto badframe;
+
+    err |= __get_user(target_set.sig[0], &frame->sc.oldmask);
+    for(i = 1; i < TARGET_NSIG_WORDS; i++) {
+        err |= (__get_user(target_set.sig[i], &frame->extramask[i - 1]));
+    }
+
+    if (err)
+        goto badframe;
+
+    target_to_host_sigset_internal(&blocked, &target_set);
+    sigprocmask(SIG_SETMASK, &blocked, NULL);
+
+    if (restore_sigcontext(regs, &frame->sc))
+        goto badframe;
+
+    unlock_user_struct(frame, frame_addr, 0);
+    return regs->gregs[0];
+
+badframe:
+    unlock_user_struct(frame, frame_addr, 0);
+    force_sig(TARGET_SIGSEGV);
+    return 0;
+}
+
+long do_rt_sigreturn(CPUState *regs)
+{
+    struct target_rt_sigframe *frame;
+    abi_ulong frame_addr;
+    sigset_t blocked;
+
+#if defined(DEBUG_SIGNAL)
+    fprintf(stderr, "do_rt_sigreturn\n");
+#endif
+    frame_addr = regs->gregs[15];
+    if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
+   	goto badframe;
+
+    target_to_host_sigset(&blocked, &frame->uc.uc_sigmask);
+    sigprocmask(SIG_SETMASK, &blocked, NULL);
+
+    if (restore_sigcontext(regs, &frame->uc.uc_mcontext))
+        goto badframe;
+
+    if (do_sigaltstack(frame_addr +
+		       offsetof(struct target_rt_sigframe, uc.uc_stack),
+		       0, get_sp_from_cpustate(regs)) == -EFAULT)
+        goto badframe;
+
+    unlock_user_struct(frame, frame_addr, 0);
+    return regs->gregs[0];
+
+badframe:
+    unlock_user_struct(frame, frame_addr, 0);
+    force_sig(TARGET_SIGSEGV);
+    return 0;
 }
 
 #else
@@ -2104,13 +2725,13 @@ static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
 long do_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 long do_rt_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 #endif
@@ -2118,7 +2739,7 @@ long do_rt_sigreturn(CPUState *env)
 void process_pending_signals(void *cpu_env)
 {
     int sig;
-    target_ulong handler;
+    abi_ulong handler;
     sigset_t set, old_set;
     target_sigset_t target_old_set;
     struct emulated_sigaction *k;
diff --git a/linux-user/socket.h b/linux-user/socket.h
index f13ca45e3..93d47823d 100644
--- a/linux-user/socket.h
+++ b/linux-user/socket.h
@@ -109,12 +109,21 @@
 	#define TARGET_SO_LINGER       13
 	#define TARGET_SO_BSDCOMPAT    14
 	/* To add :#define TARGET_SO_REUSEPORT 15 */
+#if defined(TARGET_PPC)
+	#define TARGET_SO_RCVLOWAT     16
+	#define TARGET_SO_SNDLOWAT     17
+	#define TARGET_SO_RCVTIMEO     18
+	#define TARGET_SO_SNDTIMEO     19
+	#define TARGET_SO_PASSCRED     20
+	#define TARGET_SO_PEERCRED     21
+#else
 	#define TARGET_SO_PASSCRED     16
 	#define TARGET_SO_PEERCRED     17
 	#define TARGET_SO_RCVLOWAT     18
 	#define TARGET_SO_SNDLOWAT     19
 	#define TARGET_SO_RCVTIMEO     20
 	#define TARGET_SO_SNDTIMEO     21
+#endif
 
 	/* Security levels - as per NRL IPv6 - don't actually do anything */
 	#define TARGET_SO_SECURITY_AUTHENTICATION              22
diff --git a/linux-user/sparc/syscall.h b/linux-user/sparc/syscall.h
index 5be90fa7f..5a9bb7e54 100644
--- a/linux-user/sparc/syscall.h
+++ b/linux-user/sparc/syscall.h
@@ -1,9 +1,9 @@
 struct target_pt_regs {
-	target_ulong psr;
-	target_ulong pc;
-	target_ulong npc;
-	target_ulong y;
-	target_ulong u_regs[16];
+	abi_ulong psr;
+	abi_ulong pc;
+	abi_ulong npc;
+	abi_ulong y;
+	abi_ulong u_regs[16];
 };
 
 #define UNAME_MACHINE "sun4"
diff --git a/linux-user/sparc/target_signal.h b/linux-user/sparc/target_signal.h
index dfca12916..c7de300cd 100644
--- a/linux-user/sparc/target_signal.h
+++ b/linux-user/sparc/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_ulong ss_sp;
-	target_long ss_flags;
-	target_ulong ss_size;
+	abi_ulong ss_sp;
+	abi_long ss_flags;
+	abi_ulong ss_size;
 } target_stack_t;
 
 
@@ -28,7 +28,7 @@ typedef struct target_sigaltstack {
 #define UREG_FP        UREG_I6
 #endif
 
-static inline target_ulong get_sp_from_cpustate(CPUSPARCState *state)
+static inline abi_ulong get_sp_from_cpustate(CPUSPARCState *state)
 {
     return state->regwptr[UREG_FP];
 }
diff --git a/linux-user/sparc64/syscall.h b/linux-user/sparc64/syscall.h
index c361558b6..81a816de9 100644
--- a/linux-user/sparc64/syscall.h
+++ b/linux-user/sparc64/syscall.h
@@ -1,10 +1,10 @@
 struct target_pt_regs {
-	target_ulong u_regs[16];
-	target_ulong tstate;
-	target_ulong pc;
-	target_ulong npc;
-	target_ulong y;
-	target_ulong fprs;
+	abi_ulong u_regs[16];
+	abi_ulong tstate;
+	abi_ulong pc;
+	abi_ulong npc;
+	abi_ulong y;
+	abi_ulong fprs;
 };
 
 #define UNAME_MACHINE "sun4u"
diff --git a/linux-user/sparc64/syscall_nr.h b/linux-user/sparc64/syscall_nr.h
index 53102945a..70bee8080 100644
--- a/linux-user/sparc64/syscall_nr.h
+++ b/linux-user/sparc64/syscall_nr.h
@@ -29,11 +29,11 @@
 #define TARGET_NR_sigaltstack	 28 /* Common					   */
 #define TARGET_NR_pause               29 /* Is sigblock(0)->sigpause() in SunOS         */
 #define TARGET_NR_utime               30 /* Implemented via utimes() under SunOS        */
-/* #define TARGET_NR_lchown32         31    Linux sparc32 specific                      */
-/* #define TARGET_NR_fchown32         32    Linux sparc32 specific                      */
+#define TARGET_NR_lchown32            31 /* Linux sparc32 specific                      */
+#define TARGET_NR_fchown32            32 /* Linux sparc32 specific                      */
 #define TARGET_NR_access              33 /* Common                                      */
 #define TARGET_NR_nice                34 /* Implemented via get/setpriority() in SunOS  */
-/* #define TARGET_NR_chown32          35    Linux sparc32 specific                      */
+#define TARGET_NR_chown32             35 /*  Linux sparc32 specific                     */
 #define TARGET_NR_sync                36 /* Common                                      */
 #define TARGET_NR_kill                37 /* Common                                      */
 #define TARGET_NR_stat                38 /* Common                                      */
@@ -42,7 +42,7 @@
 #define TARGET_NR_dup                 41 /* Common                                      */
 #define TARGET_NR_pipe                42 /* Common                                      */
 #define TARGET_NR_times               43 /* Implemented via getrusage() in SunOS        */
-/* #define TARGET_NR_getuid32         44    Linux sparc32 specific                      */
+#define TARGET_NR_getuid32            44 /* Linux sparc32 specific                      */
 #define TARGET_NR_umount2             45 /* Linux Specific                              */
 #define TARGET_NR_setgid              46 /* Implemented via setregid() in SunOS         */
 #define TARGET_NR_getgid              47 /* Common                                      */
@@ -51,48 +51,48 @@
 #define TARGET_NR_getegid             50 /* SunOS calls getgid()                        */
 #define TARGET_NR_acct                51 /* Common                                      */
 #define TARGET_NR_memory_ordering	 52 /* Linux Specific				   */
-/* #define TARGET_NR_getgid32         53    Linux sparc32 specific                      */
+#define TARGET_NR_getgid32            53 /* Linux sparc32 specific                      */
 #define TARGET_NR_ioctl               54 /* Common                                      */
 #define TARGET_NR_reboot              55 /* Common                                      */
-/* #define TARGET_NR_mmap2		 56    Linux sparc32 Specific                      */
+#define TARGET_NR_mmap2		      56 /* Linux sparc32 Specific                      */
 #define TARGET_NR_symlink             57 /* Common                                      */
 #define TARGET_NR_readlink            58 /* Common                                      */
 #define TARGET_NR_execve              59 /* Common                                      */
 #define TARGET_NR_umask               60 /* Common                                      */
 #define TARGET_NR_chroot              61 /* Common                                      */
 #define TARGET_NR_fstat               62 /* Common                                      */
-/* #define TARGET_NR_fstat64          63    Linux sparc32 Specific                      */
+#define TARGET_NR_fstat64             63 /* Linux sparc32 Specific                      */
 #define TARGET_NR_getpagesize         64 /* Common                                      */
 #define TARGET_NR_msync               65 /* Common in newer 1.3.x revs...               */
 #define TARGET_NR_vfork               66 /* Common                                      */
 #define TARGET_NR_pread64             67 /* Linux Specific                              */
 #define TARGET_NR_pwrite64            68 /* Linux Specific                              */
-/* #define TARGET_NR_geteuid32        69    Linux sparc32, sbrk under SunOS             */
-/* #define TARGET_NR_getegid32        70    Linux sparc32, sstk under SunOS             */
+#define TARGET_NR_geteuid32           69 /* Linux sparc32, sbrk under SunOS             */
+#define TARGET_NR_getegid32           70 /* Linux sparc32, sstk under SunOS             */
 #define TARGET_NR_mmap                71 /* Common                                      */
-/* #define TARGET_NR_setreuid32       72    Linux sparc32, vadvise under SunOS          */
+#define TARGET_NR_setreuid32          72 /* Linux sparc32, vadvise under SunOS          */
 #define TARGET_NR_munmap              73 /* Common                                      */
 #define TARGET_NR_mprotect            74 /* Common                                      */
 #define TARGET_NR_madvise             75 /* Common                                      */
 #define TARGET_NR_vhangup             76 /* Common                                      */
-/* #define TARGET_NR_truncate64       77    Linux sparc32 Specific			   */
+#define TARGET_NR_truncate64          77 /* Linux sparc32 Specific			*/
 #define TARGET_NR_mincore             78 /* Common                                      */
 #define TARGET_NR_getgroups           79 /* Common                                      */
 #define TARGET_NR_setgroups           80 /* Common                                      */
 #define TARGET_NR_getpgrp             81 /* Common                                      */
-/* #define TARGET_NR_setgroups32      82    Linux sparc32, setpgrp under SunOS          */
+#define TARGET_NR_setgroups32         82 /* Linux sparc32, setpgrp under SunOS          */
 #define TARGET_NR_setitimer           83 /* Common                                      */
-/* #define TARGET_NR_ftruncate64      84    Linux sparc32 Specific			   */
+#define TARGET_NR_ftruncate64         84 /* Linux sparc32 Specific                      */
 #define TARGET_NR_swapon              85 /* Common                                      */
 #define TARGET_NR_getitimer           86 /* Common                                      */
-/* #define TARGET_NR_setuid32         87    Linux sparc32, gethostname under SunOS      */
+#define TARGET_NR_setuid32            87 /* Linux sparc32, gethostname under SunOS      */
 #define TARGET_NR_sethostname         88 /* Common                                      */
-/* #define TARGET_NR_setgid32         89    Linux sparc32, getdtablesize under SunOS    */
+#define TARGET_NR_setgid32            89 /* Linux sparc32, getdtablesize under SunOS    */
 #define TARGET_NR_dup2                90 /* Common                                      */
-/* #define TARGET_NR_setfsuid32       91    Linux sparc32, getdopt under SunOS          */
+#define TARGET_NR_setfsuid32          91 /* Linux sparc32, getdopt under SunOS          */
 #define TARGET_NR_fcntl               92 /* Common                                      */
 #define TARGET_NR_select              93 /* Common                                      */
-/* #define TARGET_NR_setfsgid32       94    Linux sparc32, setdopt under SunOS          */
+#define TARGET_NR_setfsgid32          94 /* Linux sparc32, setdopt under SunOS          */
 #define TARGET_NR_fsync               95 /* Common                                      */
 #define TARGET_NR_setpriority         96 /* Common                                      */
 #define TARGET_NR_socket              97 /* Common                                      */
@@ -110,10 +110,10 @@
 #define TARGET_NR_getresuid          109 /* Linux Specific, sigblock under SunOS	   */
 #define TARGET_NR_setresgid          110 /* Linux Specific, sigsetmask under SunOS	   */
 #define TARGET_NR_getresgid          111 /* Linux Specific, sigpause under SunOS	   */
-/* #define TARGET_NR_setregid32       75    Linux sparc32, sigstack under SunOS         */
+/* #define TARGET_NR_setregid32          75  Linux sparc32, sigstack under SunOS         */
 #define TARGET_NR_recvmsg            113 /* Common                                      */
 #define TARGET_NR_sendmsg            114 /* Common                                      */
-/* #define TARGET_NR_getgroups32     115    Linux sparc32, vtrace under SunOS           */
+#define TARGET_NR_getgroups32        115 /* Linux sparc32, vtrace under SunOS           */
 #define TARGET_NR_gettimeofday       116 /* Common                                      */
 #define TARGET_NR_getrusage          117 /* Common                                      */
 #define TARGET_NR_getsockopt         118 /* Common                                      */
@@ -130,14 +130,14 @@
 #define TARGET_NR_truncate           129 /* Common                                      */
 #define TARGET_NR_ftruncate          130 /* Common                                      */
 #define TARGET_NR_flock              131 /* Common                                      */
-/* #define TARGET_NR_lstat64		132    Linux sparc32 Specific                      */
+#define TARGET_NR_lstat64	     132 /* Linux sparc32 Specific                      */
 #define TARGET_NR_sendto             133 /* Common                                      */
 #define TARGET_NR_shutdown           134 /* Common                                      */
 #define TARGET_NR_socketpair         135 /* Common                                      */
 #define TARGET_NR_mkdir              136 /* Common                                      */
 #define TARGET_NR_rmdir              137 /* Common                                      */
 #define TARGET_NR_utimes             138 /* SunOS Specific                              */
-/* #define TARGET_NR_stat64		139    Linux sparc32 Specific			   */
+#define TARGET_NR_stat64	     139 /* Linux sparc32 Specific			   */
 #define TARGET_NR_sendfile64         140 /* adjtime under SunOS                         */
 #define TARGET_NR_getpeername        141 /* Common                                      */
 #define TARGET_NR_futex              142 /* gethostid under SunOS                       */
@@ -153,7 +153,7 @@
 /* #define TARGET_NR_putmsg          152    SunOS Specific                              */
 #define TARGET_NR_poll               153 /* Common                                      */
 #define TARGET_NR_getdents64		154 /* Linux specific				   */
-/* #define TARGET_NR_fcntl64         155    Linux sparc32 Specific                      */
+#define TARGET_NR_fcntl64            155 /* Linux sparc32 Specific                      */
 /* #define TARGET_NR_getdirentries   156    SunOS Specific                              */
 #define TARGET_NR_statfs             157 /* Common                                      */
 #define TARGET_NR_fstatfs            158 /* Common                                      */
@@ -229,9 +229,7 @@
 #define TARGET_NR_setfsuid           228 /* Linux Specific                              */
 #define TARGET_NR_setfsgid           229 /* Linux Specific                              */
 #define TARGET_NR__newselect         230 /* Linux Specific                              */
-#ifdef __KERNEL__
-#define TARGET_NR_time		231 /* Linux sparc32                               */
-#endif
+#define TARGET_NR_time               231 /* Linux sparc32                               */
 /* #define TARGET_NR_oldstat         232    Linux Specific                              */
 #define TARGET_NR_stime              233 /* Linux Specific                              */
 #define TARGET_NR_statfs64           234 /* Linux Specific                              */
diff --git a/linux-user/sparc64/target_signal.h b/linux-user/sparc64/target_signal.h
index dfca12916..c7de300cd 100644
--- a/linux-user/sparc64/target_signal.h
+++ b/linux-user/sparc64/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_ulong ss_sp;
-	target_long ss_flags;
-	target_ulong ss_size;
+	abi_ulong ss_sp;
+	abi_long ss_flags;
+	abi_ulong ss_size;
 } target_stack_t;
 
 
@@ -28,7 +28,7 @@ typedef struct target_sigaltstack {
 #define UREG_FP        UREG_I6
 #endif
 
-static inline target_ulong get_sp_from_cpustate(CPUSPARCState *state)
+static inline abi_ulong get_sp_from_cpustate(CPUSPARCState *state)
 {
     return state->regwptr[UREG_FP];
 }
diff --git a/linux-user/strace.c b/linux-user/strace.c
new file mode 100644
index 000000000..d7c18c63c
--- /dev/null
+++ b/linux-user/strace.c
@@ -0,0 +1,313 @@
+#include <stdio.h>
+#include <errno.h>
+#include <sys/ipc.h>
+#include <sys/msg.h>
+#include <sys/sem.h>
+#include <sys/shm.h>
+#include <sys/select.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include "qemu.h"
+
+int do_strace=0;
+
+struct syscallname {
+    int nr;
+    char *name;
+    char *format;
+    void (*call)(struct syscallname *,
+                 abi_long, abi_long, abi_long,
+                 abi_long, abi_long, abi_long);
+    void (*result)(struct syscallname *, abi_long);
+};
+
+/*
+ * Utility functions
+ */
+static void
+print_ipc_cmd(int cmd)
+{
+#define output_cmd(val) \
+if( cmd == val ) { \
+    gemu_log(#val); \
+    return; \
+}
+
+    cmd &= 0xff;
+
+    /* General IPC commands */
+    output_cmd( IPC_RMID );
+    output_cmd( IPC_SET );
+    output_cmd( IPC_STAT );
+    output_cmd( IPC_INFO );
+    /* msgctl() commands */
+    #ifdef __USER_MISC
+    output_cmd( MSG_STAT );
+    output_cmd( MSG_INFO );
+    #endif
+    /* shmctl() commands */
+    output_cmd( SHM_LOCK );
+    output_cmd( SHM_UNLOCK );
+    output_cmd( SHM_STAT );
+    output_cmd( SHM_INFO );
+    /* semctl() commands */
+    output_cmd( GETPID );
+    output_cmd( GETVAL );
+    output_cmd( GETALL );
+    output_cmd( GETNCNT );
+    output_cmd( GETZCNT );
+    output_cmd( SETVAL );
+    output_cmd( SETALL );
+    output_cmd( SEM_STAT );
+    output_cmd( SEM_INFO );
+    output_cmd( IPC_RMID );
+    output_cmd( IPC_RMID );
+    output_cmd( IPC_RMID );
+    output_cmd( IPC_RMID );
+    output_cmd( IPC_RMID );
+    output_cmd( IPC_RMID );
+    output_cmd( IPC_RMID );
+    output_cmd( IPC_RMID );
+    output_cmd( IPC_RMID );
+
+    /* Some value we don't recognize */
+    gemu_log("%d",cmd);
+}
+
+#ifdef TARGET_NR__newselect
+static void
+print_fdset(int n, abi_ulong target_fds_addr)
+{
+    int i;
+
+    gemu_log("[");
+    if( target_fds_addr ) {
+        abi_long *target_fds;
+
+        target_fds = lock_user(VERIFY_READ,
+                               target_fds_addr,
+                               sizeof(*target_fds)*(n / TARGET_ABI_BITS + 1),
+                               1);
+
+        if (!target_fds)
+            return;
+
+        for (i=n; i>=0; i--) {
+            if ((tswapl(target_fds[i / TARGET_ABI_BITS]) >> (i & (TARGET_ABI_BITS - 1))) & 1)
+                gemu_log("%d,", i );
+            }
+        unlock_user(target_fds, target_fds_addr, 0);
+    }
+    gemu_log("]");
+}
+
+static void
+print_timeval(abi_ulong tv_addr)
+{
+    if( tv_addr ) {
+        struct target_timeval *tv;
+
+        tv = lock_user(VERIFY_READ, tv_addr, sizeof(*tv), 1);
+        if (!tv)
+            return;
+        gemu_log("{" TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "}",
+        	 tv->tv_sec, tv->tv_usec);
+        unlock_user(tv, tv_addr, 0);
+    } else
+        gemu_log("NULL");
+}
+#endif
+
+/*
+ * Sysycall specific output functions
+ */
+
+/* select */
+#ifdef TARGET_NR__newselect
+static long newselect_arg1 = 0;
+static long newselect_arg2 = 0;
+static long newselect_arg3 = 0;
+static long newselect_arg4 = 0;
+static long newselect_arg5 = 0;
+
+static void
+print_newselect(struct syscallname *name,
+                abi_long arg1, abi_long arg2, abi_long arg3,
+                abi_long arg4, abi_long arg5, abi_long arg6)
+{
+    gemu_log("%s(" TARGET_ABI_FMT_ld ",", name->name, arg1);
+    print_fdset(arg1, arg2);
+    gemu_log(",");
+    print_fdset(arg1, arg3);
+    gemu_log(",");
+    print_fdset(arg1, arg4);
+    gemu_log(",");
+    print_timeval(arg5);
+    gemu_log(")");
+
+    /* save for use in the return output function below */
+    newselect_arg1=arg1;
+    newselect_arg2=arg2;
+    newselect_arg3=arg3;
+    newselect_arg4=arg4;
+    newselect_arg5=arg5;
+}
+#endif
+
+static void
+print_semctl(struct syscallname *name,
+             abi_long arg1, abi_long arg2, abi_long arg3,
+             abi_long arg4, abi_long arg5, abi_long arg6)
+{
+    gemu_log("%s(" TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld ",", name->name, arg1, arg2);
+    print_ipc_cmd(arg3);
+    gemu_log(",0x" TARGET_ABI_FMT_lx ")", arg4);
+}
+
+static void
+print_execve(struct syscallname *name,
+             abi_long arg1, abi_long arg2, abi_long arg3,
+             abi_long arg4, abi_long arg5, abi_long arg6)
+{
+    abi_ulong arg_ptr_addr;
+    char *s;
+
+    if (!(s = lock_user_string(arg1)))
+        return;
+    gemu_log("%s(\"%s\",{", name->name, s);
+    unlock_user(s, arg1, 0);
+
+    for (arg_ptr_addr = arg2; ; arg_ptr_addr += sizeof(abi_ulong)) {
+        abi_ulong *arg_ptr, arg_addr, s_addr;
+
+	arg_ptr = lock_user(VERIFY_READ, arg_ptr_addr, sizeof(abi_ulong), 1);
+        if (!arg_ptr)
+            return;
+	arg_addr = tswapl(*arg_ptr);
+	unlock_user(arg_ptr, arg_ptr_addr, 0);
+        if (!arg_addr)
+            break;
+        if ((s = lock_user_string(arg_addr))) {
+            gemu_log("\"%s\",", s);
+            unlock_user(s, s_addr, 0);
+        }
+    }
+
+    gemu_log("NULL})");
+}
+
+#ifdef TARGET_NR_ipc
+static void
+print_ipc(struct syscallname *name,
+          abi_long arg1, abi_long arg2, abi_long arg3,
+          abi_long arg4, abi_long arg5, abi_long arg6)
+{
+    switch(arg1) {
+    case IPCOP_semctl:
+        name->name = "semctl";
+        print_semctl(name,arg2,arg3,arg4,arg5,arg6,0);
+        break;
+    default:
+        gemu_log("%s(" TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld ")",
+                 name->name, arg1, arg2, arg3, arg4);
+    }
+}
+#endif
+
+/*
+ * Variants for the return value output function
+ */
+
+static void
+print_syscall_ret_addr(struct syscallname *name, abi_long ret)
+{
+if( ret == -1 ) {
+        gemu_log(" = -1 errno=%d (%s)\n", errno, target_strerror(errno));
+    } else {
+        gemu_log(" = 0x" TARGET_ABI_FMT_lx "\n", ret);
+    }
+}
+
+#if 0 /* currently unused */
+static void
+print_syscall_ret_raw(struct syscallname *name, abi_long ret)
+{
+        gemu_log(" = 0x" TARGET_ABI_FMT_lx "\n", ret);
+}
+#endif
+
+#ifdef TARGET_NR__newselect
+static void
+print_syscall_ret_newselect(struct syscallname *name, abi_long ret)
+{
+    gemu_log(" = 0x" TARGET_ABI_FMT_lx " (", ret);
+    print_fdset(newselect_arg1,newselect_arg2);
+    gemu_log(",");
+    print_fdset(newselect_arg1,newselect_arg3);
+    gemu_log(",");
+    print_fdset(newselect_arg1,newselect_arg4);
+    gemu_log(",");
+    print_timeval(newselect_arg5);
+    gemu_log(")\n");
+}
+#endif
+
+/*
+ * An array of all of the syscalls we know about
+ */
+
+static struct syscallname scnames[] = {
+#include "strace.list"
+};
+
+static int nsyscalls = sizeof(scnames)/sizeof(struct syscallname);
+
+/*
+ * The public interface to this module.
+ */
+void
+print_syscall(int num,
+              abi_long arg1, abi_long arg2, abi_long arg3,
+              abi_long arg4, abi_long arg5, abi_long arg6)
+{
+    int i;
+    char *format="%s(" TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld ")";
+
+    gemu_log("%d ", getpid() );
+
+    for(i=0;i<nsyscalls;i++)
+        if( scnames[i].nr == num ) {
+            if( scnames[i].call != NULL ) {
+                scnames[i].call(&scnames[i],arg1,arg2,arg3,arg4,arg5,arg6);
+            } else {
+                /* XXX: this format system is broken because it uses
+                   host types and host pointers for strings */
+                if( scnames[i].format != NULL )
+                    format = scnames[i].format;
+                gemu_log(format,scnames[i].name, arg1,arg2,arg3,arg4,arg5,arg6);
+            }
+            break;
+        }
+}
+
+
+void
+print_syscall_ret(int num, abi_long ret)
+{
+    int i;
+
+    for(i=0;i<nsyscalls;i++)
+        if( scnames[i].nr == num ) {
+            if( scnames[i].result != NULL ) {
+                scnames[i].result(&scnames[i],ret);
+            } else {
+                if( ret < 0 ) {
+                    gemu_log(" = -1 errno=" TARGET_ABI_FMT_ld " (%s)\n", -ret, target_strerror(-ret));
+                } else {
+                    gemu_log(" = " TARGET_ABI_FMT_ld "\n", ret);
+                }
+            }
+            break;
+        }
+}
+
diff --git a/linux-user/strace.list b/linux-user/strace.list
new file mode 100644
index 000000000..868a72583
--- /dev/null
+++ b/linux-user/strace.list
@@ -0,0 +1,1515 @@
+#ifdef TARGET_NR_accept
+{ TARGET_NR_accept, "accept" , "%s(%d,%#x,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_access
+{ TARGET_NR_access, "access" , "%s(\"%s\",%#o)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_acct
+{ TARGET_NR_acct, "acct" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_add_key
+{ TARGET_NR_add_key, "add_key" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_adjtimex
+{ TARGET_NR_adjtimex, "adjtimex" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_afs_syscall
+{ TARGET_NR_afs_syscall, "afs_syscall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_alarm
+{ TARGET_NR_alarm, "alarm" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_aplib
+{ TARGET_NR_aplib, "aplib" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_arch_prctl
+{ TARGET_NR_arch_prctl, "arch_prctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_arm_fadvise64_64
+{ TARGET_NR_arm_fadvise64_64, "arm_fadvise64_64" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_bdflush
+{ TARGET_NR_bdflush, "bdflush" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_bind
+{ TARGET_NR_bind, "bind" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_break
+{ TARGET_NR_break, "break" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_brk
+{ TARGET_NR_brk, "brk" , NULL, NULL, print_syscall_ret_addr },
+#endif
+#ifdef TARGET_NR_cachectl
+{ TARGET_NR_cachectl, "cachectl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_cacheflush
+{ TARGET_NR_cacheflush, "cacheflush" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_capget
+{ TARGET_NR_capget, "capget" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_capset
+{ TARGET_NR_capset, "capset" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_chdir
+{ TARGET_NR_chdir, "chdir" , "%s(\"%s\")", NULL, NULL },
+#endif
+#ifdef TARGET_NR_chmod
+{ TARGET_NR_chmod, "chmod" , "%s(\"%s\",%#o)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_chown
+{ TARGET_NR_chown, "chown" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_chown32
+{ TARGET_NR_chown32, "chown32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_chroot
+{ TARGET_NR_chroot, "chroot" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_clock_getres
+{ TARGET_NR_clock_getres, "clock_getres" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_clock_gettime
+{ TARGET_NR_clock_gettime, "clock_gettime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_clock_nanosleep
+{ TARGET_NR_clock_nanosleep, "clock_nanosleep" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_clock_settime
+{ TARGET_NR_clock_settime, "clock_settime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_clone
+{ TARGET_NR_clone, "clone" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_close
+{ TARGET_NR_close, "close" , "%s(%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_connect
+{ TARGET_NR_connect, "connect" , "%s(%d,%#x,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_creat
+{ TARGET_NR_creat, "creat" , "%s(\"%s\",%#o)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_create_module
+{ TARGET_NR_create_module, "create_module" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_delete_module
+{ TARGET_NR_delete_module, "delete_module" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_dipc
+{ TARGET_NR_dipc, "dipc" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_dup
+{ TARGET_NR_dup, "dup" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_dup2
+{ TARGET_NR_dup2, "dup2" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_epoll_create
+{ TARGET_NR_epoll_create, "epoll_create" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_epoll_ctl
+{ TARGET_NR_epoll_ctl, "epoll_ctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_epoll_ctl_old
+{ TARGET_NR_epoll_ctl_old, "epoll_ctl_old" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_epoll_wait
+{ TARGET_NR_epoll_wait, "epoll_wait" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_epoll_wait_old
+{ TARGET_NR_epoll_wait_old, "epoll_wait_old" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_execv
+{ TARGET_NR_execv, "execv" , "%s(\"%s\",%ld,%ld,%ld,%ld,%ld)\n", NULL, NULL },
+#endif
+#ifdef TARGET_NR_execve
+{ TARGET_NR_execve, "execve" , NULL, print_execve, NULL },
+#endif
+#ifdef TARGET_NR_exec_with_loader
+{ TARGET_NR_exec_with_loader, "exec_with_loader" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_exit
+{ TARGET_NR_exit, "exit" , "%s(%d)\n", NULL, NULL },
+#endif
+#ifdef TARGET_NR__exit
+{ TARGET_NR__exit, "_exit" , "%s(%d)\n", NULL, NULL },
+#endif
+#ifdef TARGET_NR_exit_group
+{ TARGET_NR_exit_group, "exit_group" , "%s(%d)\n", NULL, NULL },
+#endif
+#ifdef TARGET_NR_faccessat
+{ TARGET_NR_faccessat, "faccessat" , "%s(%d,\"%s\",%#o,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fadvise64
+{ TARGET_NR_fadvise64, "fadvise64" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fadvise64_64
+{ TARGET_NR_fadvise64_64, "fadvise64_64" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fchdir
+{ TARGET_NR_fchdir, "fchdir" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fchmod
+{ TARGET_NR_fchmod, "fchmod" , "%s(%d,%#o)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fchmodat
+{ TARGET_NR_fchmodat, "fchmodat" , "%s(%d,\"%s\",%#o,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fchown
+{ TARGET_NR_fchown, "fchown" , "%s(\"%s\",%d,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fchown32
+{ TARGET_NR_fchown32, "fchown32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fchownat
+{ TARGET_NR_fchownat, "fchownat" , "%s(%d,\"%s\",%d,%d,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fcntl
+{ TARGET_NR_fcntl, "fcntl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fcntl64
+{ TARGET_NR_fcntl64, "fcntl64" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fdatasync
+{ TARGET_NR_fdatasync, "fdatasync" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fgetxattr
+{ TARGET_NR_fgetxattr, "fgetxattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_flistxattr
+{ TARGET_NR_flistxattr, "flistxattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_flock
+{ TARGET_NR_flock, "flock" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fork
+{ TARGET_NR_fork, "fork" , "%s()", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fremovexattr
+{ TARGET_NR_fremovexattr, "fremovexattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fsetxattr
+{ TARGET_NR_fsetxattr, "fsetxattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fstat
+{ TARGET_NR_fstat, "fstat" , "%s(%d,%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fstat64
+{ TARGET_NR_fstat64, "fstat64" , "%s(%d,%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fstatfs
+{ TARGET_NR_fstatfs, "fstatfs" , "%s(%d,%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fstatfs64
+{ TARGET_NR_fstatfs64, "fstatfs64" , "%s(%d,%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fsync
+{ TARGET_NR_fsync, "fsync" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ftime
+{ TARGET_NR_ftime, "ftime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ftruncate
+{ TARGET_NR_ftruncate, "ftruncate" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ftruncate64
+{ TARGET_NR_ftruncate64, "ftruncate64" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_futex
+{ TARGET_NR_futex, "futex" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_futimesat
+{ TARGET_NR_futimesat, "futimesat" , "%s(%d,\"%s\",%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_getcwd
+{ TARGET_NR_getcwd, "getcwd" , "%s(%p,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_getdents
+{ TARGET_NR_getdents, "getdents" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getdents64
+{ TARGET_NR_getdents64, "getdents64" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getdomainname
+{ TARGET_NR_getdomainname, "getdomainname" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getdtablesize
+{ TARGET_NR_getdtablesize, "getdtablesize" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getegid
+{ TARGET_NR_getegid, "getegid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getegid32
+{ TARGET_NR_getegid32, "getegid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_geteuid
+{ TARGET_NR_geteuid, "geteuid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_geteuid32
+{ TARGET_NR_geteuid32, "geteuid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getgid
+{ TARGET_NR_getgid, "getgid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getgid32
+{ TARGET_NR_getgid32, "getgid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getgroups
+{ TARGET_NR_getgroups, "getgroups" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getgroups32
+{ TARGET_NR_getgroups32, "getgroups32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_gethostname
+{ TARGET_NR_gethostname, "gethostname" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getitimer
+{ TARGET_NR_getitimer, "getitimer" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_get_kernel_syms
+{ TARGET_NR_get_kernel_syms, "get_kernel_syms" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_get_mempolicy
+{ TARGET_NR_get_mempolicy, "get_mempolicy" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getpagesize
+{ TARGET_NR_getpagesize, "getpagesize" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getpeername
+{ TARGET_NR_getpeername, "getpeername" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getpgid
+{ TARGET_NR_getpgid, "getpgid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getpgrp
+{ TARGET_NR_getpgrp, "getpgrp" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getpid
+{ TARGET_NR_getpid, "getpid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getpmsg
+{ TARGET_NR_getpmsg, "getpmsg" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getppid
+{ TARGET_NR_getppid, "getppid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getpriority
+{ TARGET_NR_getpriority, "getpriority", "%s(%#x,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_getresgid
+{ TARGET_NR_getresgid, "getresgid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getresgid32
+{ TARGET_NR_getresgid32, "getresgid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getresuid
+{ TARGET_NR_getresuid, "getresuid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getresuid32
+{ TARGET_NR_getresuid32, "getresuid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getrlimit
+{ TARGET_NR_getrlimit, "getrlimit" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_get_robust_list
+{ TARGET_NR_get_robust_list, "get_robust_list" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getrusage
+{ TARGET_NR_getrusage, "getrusage" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getsid
+{ TARGET_NR_getsid, "getsid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getsockname
+{ TARGET_NR_getsockname, "getsockname" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getsockopt
+{ TARGET_NR_getsockopt, "getsockopt" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_get_thread_area
+{ TARGET_NR_get_thread_area, "get_thread_area" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_gettid
+{ TARGET_NR_gettid, "gettid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_gettimeofday
+{ TARGET_NR_gettimeofday, "gettimeofday" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getuid
+{ TARGET_NR_getuid, "getuid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getuid32
+{ TARGET_NR_getuid32, "getuid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getxattr
+{ TARGET_NR_getxattr, "getxattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getxgid
+{ TARGET_NR_getxgid, "getxgid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getxpid
+{ TARGET_NR_getxpid, "getxpid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_getxuid
+{ TARGET_NR_getxuid, "getxuid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_gtty
+{ TARGET_NR_gtty, "gtty" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_idle
+{ TARGET_NR_idle, "idle" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_init_module
+{ TARGET_NR_init_module, "init_module" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_inotify_add_watch
+{ TARGET_NR_inotify_add_watch, "inotify_add_watch" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_inotify_init
+{ TARGET_NR_inotify_init, "inotify_init" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_inotify_rm_watch
+{ TARGET_NR_inotify_rm_watch, "inotify_rm_watch" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_io_cancel
+{ TARGET_NR_io_cancel, "io_cancel" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ioctl
+{ TARGET_NR_ioctl, "ioctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_io_destroy
+{ TARGET_NR_io_destroy, "io_destroy" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_io_getevents
+{ TARGET_NR_io_getevents, "io_getevents" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ioperm
+{ TARGET_NR_ioperm, "ioperm" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_iopl
+{ TARGET_NR_iopl, "iopl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ioprio_get
+{ TARGET_NR_ioprio_get, "ioprio_get" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ioprio_set
+{ TARGET_NR_ioprio_set, "ioprio_set" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_io_setup
+{ TARGET_NR_io_setup, "io_setup" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_io_submit
+{ TARGET_NR_io_submit, "io_submit" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ipc
+{ TARGET_NR_ipc, "ipc" , NULL, print_ipc, NULL },
+#endif
+#ifdef TARGET_NR_kexec_load
+{ TARGET_NR_kexec_load, "kexec_load" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_keyctl
+{ TARGET_NR_keyctl, "keyctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_kill
+{ TARGET_NR_kill, "kill" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_lchown
+{ TARGET_NR_lchown, "lchown" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_lchown32
+{ TARGET_NR_lchown32, "lchown32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_lgetxattr
+{ TARGET_NR_lgetxattr, "lgetxattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_link
+{ TARGET_NR_link, "link" , "%s(\"%s\",\"%s\")", NULL, NULL },
+#endif
+#ifdef TARGET_NR_linkat
+{ TARGET_NR_linkat, "linkat" , "%s(%d,\"%s\",%d,\"%s\",%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_Linux
+{ TARGET_NR_Linux, "Linux" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_listen
+{ TARGET_NR_listen, "listen" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_listxattr
+{ TARGET_NR_listxattr, "listxattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_llistxattr
+{ TARGET_NR_llistxattr, "llistxattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR__llseek
+{ TARGET_NR__llseek, "_llseek" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_lock
+{ TARGET_NR_lock, "lock" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_lookup_dcookie
+{ TARGET_NR_lookup_dcookie, "lookup_dcookie" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_lremovexattr
+{ TARGET_NR_lremovexattr, "lremovexattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_lseek
+{ TARGET_NR_lseek, "lseek" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_lsetxattr
+{ TARGET_NR_lsetxattr, "lsetxattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_lstat
+{ TARGET_NR_lstat, "lstat" , "%s(\"%s\",%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_lstat64
+{ TARGET_NR_lstat64, "lstat64" , "%s(\"%s\",%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_madvise
+{ TARGET_NR_madvise, "madvise" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_madvise1
+{ TARGET_NR_madvise1, "madvise1" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mbind
+{ TARGET_NR_mbind, "mbind" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_memory_ordering
+{ TARGET_NR_memory_ordering, "memory_ordering" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_migrate_pages
+{ TARGET_NR_migrate_pages, "migrate_pages" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mincore
+{ TARGET_NR_mincore, "mincore" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mkdir
+{ TARGET_NR_mkdir, "mkdir" , "%s(\"%s\",%#o)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_mkdirat
+{ TARGET_NR_mkdirat, "mkdirat" , "%s(%d,\"%s\",%#o)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_mknod
+{ TARGET_NR_mknod, "mknod" , "%s(\"%s\",%#o,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_mknodat
+{ TARGET_NR_mknodat, "mknodat" , "%s(%d,\"%s\",%#o,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_mlock
+{ TARGET_NR_mlock, "mlock" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mlockall
+{ TARGET_NR_mlockall, "mlockall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mmap
+{ TARGET_NR_mmap, "mmap" , NULL, NULL, print_syscall_ret_addr },
+#endif
+#ifdef TARGET_NR_mmap2
+{ TARGET_NR_mmap2, "mmap2" , NULL, NULL, print_syscall_ret_addr },
+#endif
+#ifdef TARGET_NR_modify_ldt
+{ TARGET_NR_modify_ldt, "modify_ldt" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mount
+{ TARGET_NR_mount, "mount" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_move_pages
+{ TARGET_NR_move_pages, "move_pages" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mprotect
+{ TARGET_NR_mprotect, "mprotect" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mpx
+{ TARGET_NR_mpx, "mpx" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mq_getsetattr
+{ TARGET_NR_mq_getsetattr, "mq_getsetattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mq_notify
+{ TARGET_NR_mq_notify, "mq_notify" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mq_open
+{ TARGET_NR_mq_open, "mq_open" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mq_timedreceive
+{ TARGET_NR_mq_timedreceive, "mq_timedreceive" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mq_timedsend
+{ TARGET_NR_mq_timedsend, "mq_timedsend" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mq_unlink
+{ TARGET_NR_mq_unlink, "mq_unlink" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_mremap
+{ TARGET_NR_mremap, "mremap" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_msgctl
+{ TARGET_NR_msgctl, "msgctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_msgget
+{ TARGET_NR_msgget, "msgget" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_msgrcv
+{ TARGET_NR_msgrcv, "msgrcv" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_msgsnd
+{ TARGET_NR_msgsnd, "msgsnd" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_msync
+{ TARGET_NR_msync, "msync" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_multiplexer
+{ TARGET_NR_multiplexer, "multiplexer" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_munlock
+{ TARGET_NR_munlock, "munlock" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_munlockall
+{ TARGET_NR_munlockall, "munlockall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_munmap
+{ TARGET_NR_munmap, "munmap" , "%s(%p,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_nanosleep
+{ TARGET_NR_nanosleep, "nanosleep" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_fstatat64
+{ TARGET_NR_fstatat64, "fstatat64" , "%s(%d,\"%s\",%p,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_newfstatat
+{ TARGET_NR_newfstatat, "newfstatat" , "%s(%d,\"%s\",%p,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR__newselect
+{ TARGET_NR__newselect, "_newselect" , NULL, print_newselect, print_syscall_ret_newselect },
+#endif
+#ifdef TARGET_NR_nfsservctl
+{ TARGET_NR_nfsservctl, "nfsservctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_nice
+{ TARGET_NR_nice, "nice" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_old_adjtimex
+{ TARGET_NR_old_adjtimex, "old_adjtimex" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_oldfstat
+{ TARGET_NR_oldfstat, "oldfstat" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_oldlstat
+{ TARGET_NR_oldlstat, "oldlstat" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_oldolduname
+{ TARGET_NR_oldolduname, "oldolduname" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_oldstat
+{ TARGET_NR_oldstat, "oldstat" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_oldumount
+{ TARGET_NR_oldumount, "oldumount" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_olduname
+{ TARGET_NR_olduname, "olduname" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_open
+{ TARGET_NR_open, "open" , "%s(\"%s\",%#x,%#o)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_openat
+{ TARGET_NR_openat, "openat" , "%s(%d,\"%s\",%#x,%#o)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_adjtime
+{ TARGET_NR_osf_adjtime, "osf_adjtime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_afs_syscall
+{ TARGET_NR_osf_afs_syscall, "osf_afs_syscall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_alt_plock
+{ TARGET_NR_osf_alt_plock, "osf_alt_plock" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_alt_setsid
+{ TARGET_NR_osf_alt_setsid, "osf_alt_setsid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_alt_sigpending
+{ TARGET_NR_osf_alt_sigpending, "osf_alt_sigpending" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_asynch_daemon
+{ TARGET_NR_osf_asynch_daemon, "osf_asynch_daemon" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_audcntl
+{ TARGET_NR_osf_audcntl, "osf_audcntl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_audgen
+{ TARGET_NR_osf_audgen, "osf_audgen" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_chflags
+{ TARGET_NR_osf_chflags, "osf_chflags" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_execve
+{ TARGET_NR_osf_execve, "osf_execve" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_exportfs
+{ TARGET_NR_osf_exportfs, "osf_exportfs" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_fchflags
+{ TARGET_NR_osf_fchflags, "osf_fchflags" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_fdatasync
+{ TARGET_NR_osf_fdatasync, "osf_fdatasync" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_fpathconf
+{ TARGET_NR_osf_fpathconf, "osf_fpathconf" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_fstatfs
+{ TARGET_NR_osf_fstatfs, "osf_fstatfs" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_fuser
+{ TARGET_NR_osf_fuser, "osf_fuser" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_getaddressconf
+{ TARGET_NR_osf_getaddressconf, "osf_getaddressconf" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_getdirentries
+{ TARGET_NR_osf_getdirentries, "osf_getdirentries" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_getdomainname
+{ TARGET_NR_osf_getdomainname, "osf_getdomainname" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_getfh
+{ TARGET_NR_osf_getfh, "osf_getfh" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_getfsstat
+{ TARGET_NR_osf_getfsstat, "osf_getfsstat" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_gethostid
+{ TARGET_NR_osf_gethostid, "osf_gethostid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_getitimer
+{ TARGET_NR_osf_getitimer, "osf_getitimer" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_getlogin
+{ TARGET_NR_osf_getlogin, "osf_getlogin" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_getmnt
+{ TARGET_NR_osf_getmnt, "osf_getmnt" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_getrusage
+{ TARGET_NR_osf_getrusage, "osf_getrusage" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_getsysinfo
+{ TARGET_NR_osf_getsysinfo, "osf_getsysinfo" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_gettimeofday
+{ TARGET_NR_osf_gettimeofday, "osf_gettimeofday" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_kloadcall
+{ TARGET_NR_osf_kloadcall, "osf_kloadcall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_kmodcall
+{ TARGET_NR_osf_kmodcall, "osf_kmodcall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_memcntl
+{ TARGET_NR_osf_memcntl, "osf_memcntl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_mincore
+{ TARGET_NR_osf_mincore, "osf_mincore" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_mount
+{ TARGET_NR_osf_mount, "osf_mount" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_mremap
+{ TARGET_NR_osf_mremap, "osf_mremap" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_msfs_syscall
+{ TARGET_NR_osf_msfs_syscall, "osf_msfs_syscall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_msleep
+{ TARGET_NR_osf_msleep, "osf_msleep" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_mvalid
+{ TARGET_NR_osf_mvalid, "osf_mvalid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_mwakeup
+{ TARGET_NR_osf_mwakeup, "osf_mwakeup" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_naccept
+{ TARGET_NR_osf_naccept, "osf_naccept" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_nfssvc
+{ TARGET_NR_osf_nfssvc, "osf_nfssvc" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_ngetpeername
+{ TARGET_NR_osf_ngetpeername, "osf_ngetpeername" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_ngetsockname
+{ TARGET_NR_osf_ngetsockname, "osf_ngetsockname" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_nrecvfrom
+{ TARGET_NR_osf_nrecvfrom, "osf_nrecvfrom" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_nrecvmsg
+{ TARGET_NR_osf_nrecvmsg, "osf_nrecvmsg" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_nsendmsg
+{ TARGET_NR_osf_nsendmsg, "osf_nsendmsg" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_ntp_adjtime
+{ TARGET_NR_osf_ntp_adjtime, "osf_ntp_adjtime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_ntp_gettime
+{ TARGET_NR_osf_ntp_gettime, "osf_ntp_gettime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_creat
+{ TARGET_NR_osf_old_creat, "osf_old_creat" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_fstat
+{ TARGET_NR_osf_old_fstat, "osf_old_fstat" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_getpgrp
+{ TARGET_NR_osf_old_getpgrp, "osf_old_getpgrp" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_killpg
+{ TARGET_NR_osf_old_killpg, "osf_old_killpg" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_lstat
+{ TARGET_NR_osf_old_lstat, "osf_old_lstat" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_open
+{ TARGET_NR_osf_old_open, "osf_old_open" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_oldquota
+{ TARGET_NR_osf_oldquota, "osf_oldquota" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_sigaction
+{ TARGET_NR_osf_old_sigaction, "osf_old_sigaction" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_sigblock
+{ TARGET_NR_osf_old_sigblock, "osf_old_sigblock" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_sigreturn
+{ TARGET_NR_osf_old_sigreturn, "osf_old_sigreturn" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_sigsetmask
+{ TARGET_NR_osf_old_sigsetmask, "osf_old_sigsetmask" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_sigvec
+{ TARGET_NR_osf_old_sigvec, "osf_old_sigvec" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_stat
+{ TARGET_NR_osf_old_stat, "osf_old_stat" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_vadvise
+{ TARGET_NR_osf_old_vadvise, "osf_old_vadvise" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_vtrace
+{ TARGET_NR_osf_old_vtrace, "osf_old_vtrace" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_old_wait
+{ TARGET_NR_osf_old_wait, "osf_old_wait" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_pathconf
+{ TARGET_NR_osf_pathconf, "osf_pathconf" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_pid_block
+{ TARGET_NR_osf_pid_block, "osf_pid_block" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_pid_unblock
+{ TARGET_NR_osf_pid_unblock, "osf_pid_unblock" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_plock
+{ TARGET_NR_osf_plock, "osf_plock" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_priocntlset
+{ TARGET_NR_osf_priocntlset, "osf_priocntlset" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_profil
+{ TARGET_NR_osf_profil, "osf_profil" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_proplist_syscall
+{ TARGET_NR_osf_proplist_syscall, "osf_proplist_syscall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_reboot
+{ TARGET_NR_osf_reboot, "osf_reboot" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_revoke
+{ TARGET_NR_osf_revoke, "osf_revoke" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_sbrk
+{ TARGET_NR_osf_sbrk, "osf_sbrk" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_security
+{ TARGET_NR_osf_security, "osf_security" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_select
+{ TARGET_NR_osf_select, "osf_select" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_sethostid
+{ TARGET_NR_osf_sethostid, "osf_sethostid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_setitimer
+{ TARGET_NR_osf_setitimer, "osf_setitimer" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_setlogin
+{ TARGET_NR_osf_setlogin, "osf_setlogin" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_set_program_attributes
+{ TARGET_NR_osf_set_program_attributes, "osf_set_program_attributes" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_set_speculative
+{ TARGET_NR_osf_set_speculative, "osf_set_speculative" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_setsysinfo
+{ TARGET_NR_osf_setsysinfo, "osf_setsysinfo" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_settimeofday
+{ TARGET_NR_osf_settimeofday, "osf_settimeofday" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_shmat
+{ TARGET_NR_osf_shmat, "osf_shmat" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_signal
+{ TARGET_NR_osf_signal, "osf_signal" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_sigprocmask
+{ TARGET_NR_osf_sigprocmask, "osf_sigprocmask" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_sigsendset
+{ TARGET_NR_osf_sigsendset, "osf_sigsendset" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_sigstack
+{ TARGET_NR_osf_sigstack, "osf_sigstack" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_sigwaitprim
+{ TARGET_NR_osf_sigwaitprim, "osf_sigwaitprim" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_sstk
+{ TARGET_NR_osf_sstk, "osf_sstk" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_statfs
+{ TARGET_NR_osf_statfs, "osf_statfs" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_subsys_info
+{ TARGET_NR_osf_subsys_info, "osf_subsys_info" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_swapctl
+{ TARGET_NR_osf_swapctl, "osf_swapctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_swapon
+{ TARGET_NR_osf_swapon, "osf_swapon" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_syscall
+{ TARGET_NR_osf_syscall, "osf_syscall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_sysinfo
+{ TARGET_NR_osf_sysinfo, "osf_sysinfo" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_table
+{ TARGET_NR_osf_table, "osf_table" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_uadmin
+{ TARGET_NR_osf_uadmin, "osf_uadmin" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_usleep_thread
+{ TARGET_NR_osf_usleep_thread, "osf_usleep_thread" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_uswitch
+{ TARGET_NR_osf_uswitch, "osf_uswitch" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_utc_adjtime
+{ TARGET_NR_osf_utc_adjtime, "osf_utc_adjtime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_utc_gettime
+{ TARGET_NR_osf_utc_gettime, "osf_utc_gettime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_utimes
+{ TARGET_NR_osf_utimes, "osf_utimes" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_utsname
+{ TARGET_NR_osf_utsname, "osf_utsname" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_wait4
+{ TARGET_NR_osf_wait4, "osf_wait4" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_osf_waitid
+{ TARGET_NR_osf_waitid, "osf_waitid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pause
+{ TARGET_NR_pause, "pause" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pciconfig_iobase
+{ TARGET_NR_pciconfig_iobase, "pciconfig_iobase" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pciconfig_read
+{ TARGET_NR_pciconfig_read, "pciconfig_read" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pciconfig_write
+{ TARGET_NR_pciconfig_write, "pciconfig_write" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_perfctr
+{ TARGET_NR_perfctr, "perfctr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_personality
+{ TARGET_NR_personality, "personality" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pipe
+{ TARGET_NR_pipe, "pipe" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pivot_root
+{ TARGET_NR_pivot_root, "pivot_root" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_poll
+{ TARGET_NR_poll, "poll" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ppoll
+{ TARGET_NR_ppoll, "ppoll" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_prctl
+{ TARGET_NR_prctl, "prctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pread
+{ TARGET_NR_pread, "pread" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pread64
+{ TARGET_NR_pread64, "pread64" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_prof
+{ TARGET_NR_prof, "prof" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_profil
+{ TARGET_NR_profil, "profil" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pselect6
+{ TARGET_NR_pselect6, "pselect6" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ptrace
+{ TARGET_NR_ptrace, "ptrace" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_putpmsg
+{ TARGET_NR_putpmsg, "putpmsg" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pwrite
+{ TARGET_NR_pwrite, "pwrite" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_pwrite64
+{ TARGET_NR_pwrite64, "pwrite64" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_query_module
+{ TARGET_NR_query_module, "query_module" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_quotactl
+{ TARGET_NR_quotactl, "quotactl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_read
+{ TARGET_NR_read, "read" , "%s(%d,%#x,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_readahead
+{ TARGET_NR_readahead, "readahead" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_readdir
+{ TARGET_NR_readdir, "readdir" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_readlink
+{ TARGET_NR_readlink, "readlink" , "%s(\"%s\",%p,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_readlinkat
+{ TARGET_NR_readlinkat, "readlinkat" , "%s(%d,\"%s\",%p,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_readv
+{ TARGET_NR_readv, "readv" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_reboot
+{ TARGET_NR_reboot, "reboot" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_recv
+{ TARGET_NR_recv, "recv" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_recvfrom
+{ TARGET_NR_recvfrom, "recvfrom" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_recvmsg
+{ TARGET_NR_recvmsg, "recvmsg" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_remap_file_pages
+{ TARGET_NR_remap_file_pages, "remap_file_pages" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_removexattr
+{ TARGET_NR_removexattr, "removexattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_rename
+{ TARGET_NR_rename, "rename" , "%s(\"%s\",\"%s\")", NULL, NULL },
+#endif
+#ifdef TARGET_NR_renameat
+{ TARGET_NR_renameat, "renameat" , "%s(%d,\"%s\",%d,\"%s\")", NULL, NULL },
+#endif
+#ifdef TARGET_NR_request_key
+{ TARGET_NR_request_key, "request_key" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_reserved221
+{ TARGET_NR_reserved221, "reserved221" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_reserved82
+{ TARGET_NR_reserved82, "reserved82" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_restart_syscall
+{ TARGET_NR_restart_syscall, "restart_syscall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_rmdir
+{ TARGET_NR_rmdir, "rmdir" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_rt_sigaction
+{ TARGET_NR_rt_sigaction, "rt_sigaction" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_rt_sigpending
+{ TARGET_NR_rt_sigpending, "rt_sigpending" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_rt_sigprocmask
+{ TARGET_NR_rt_sigprocmask, "rt_sigprocmask" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_rt_sigqueueinfo
+{ TARGET_NR_rt_sigqueueinfo, "rt_sigqueueinfo" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_rt_sigreturn
+{ TARGET_NR_rt_sigreturn, "rt_sigreturn" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_rt_sigsuspend
+{ TARGET_NR_rt_sigsuspend, "rt_sigsuspend" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_rt_sigtimedwait
+{ TARGET_NR_rt_sigtimedwait, "rt_sigtimedwait" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_getaffinity
+{ TARGET_NR_sched_getaffinity, "sched_getaffinity" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_get_affinity
+{ TARGET_NR_sched_get_affinity, "sched_get_affinity" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_getparam
+{ TARGET_NR_sched_getparam, "sched_getparam" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_get_priority_max
+{ TARGET_NR_sched_get_priority_max, "sched_get_priority_max" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_get_priority_min
+{ TARGET_NR_sched_get_priority_min, "sched_get_priority_min" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_getscheduler
+{ TARGET_NR_sched_getscheduler, "sched_getscheduler" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_rr_get_interval
+{ TARGET_NR_sched_rr_get_interval, "sched_rr_get_interval" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_setaffinity
+{ TARGET_NR_sched_setaffinity, "sched_setaffinity" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_set_affinity
+{ TARGET_NR_sched_set_affinity, "sched_set_affinity" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_setparam
+{ TARGET_NR_sched_setparam, "sched_setparam" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_setscheduler
+{ TARGET_NR_sched_setscheduler, "sched_setscheduler" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sched_yield
+{ TARGET_NR_sched_yield, "sched_yield" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_security
+{ TARGET_NR_security, "security" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_select
+{ TARGET_NR_select, "select" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_semctl
+{ TARGET_NR_semctl, "semctl" , NULL, print_semctl, NULL },
+#endif
+#ifdef TARGET_NR_semget
+{ TARGET_NR_semget, "semget" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_semop
+{ TARGET_NR_semop, "semop" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_semtimedop
+{ TARGET_NR_semtimedop, "semtimedop" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_send
+{ TARGET_NR_send, "send" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sendfile
+{ TARGET_NR_sendfile, "sendfile" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sendfile64
+{ TARGET_NR_sendfile64, "sendfile64" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sendmsg
+{ TARGET_NR_sendmsg, "sendmsg" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sendto
+{ TARGET_NR_sendto, "sendto" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setdomainname
+{ TARGET_NR_setdomainname, "setdomainname" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setfsgid
+{ TARGET_NR_setfsgid, "setfsgid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setfsgid32
+{ TARGET_NR_setfsgid32, "setfsgid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setfsuid
+{ TARGET_NR_setfsuid, "setfsuid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setfsuid32
+{ TARGET_NR_setfsuid32, "setfsuid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setgid
+{ TARGET_NR_setgid, "setgid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setgid32
+{ TARGET_NR_setgid32, "setgid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setgroups
+{ TARGET_NR_setgroups, "setgroups" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setgroups32
+{ TARGET_NR_setgroups32, "setgroups32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sethae
+{ TARGET_NR_sethae, "sethae" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sethostname
+{ TARGET_NR_sethostname, "sethostname" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setitimer
+{ TARGET_NR_setitimer, "setitimer" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_set_mempolicy
+{ TARGET_NR_set_mempolicy, "set_mempolicy" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setpgid
+{ TARGET_NR_setpgid, "setpgid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setpgrp
+{ TARGET_NR_setpgrp, "setpgrp" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setpriority
+{ TARGET_NR_setpriority, "setpriority" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setregid
+{ TARGET_NR_setregid, "setregid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setregid32
+{ TARGET_NR_setregid32, "setregid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setresgid
+{ TARGET_NR_setresgid, "setresgid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setresgid32
+{ TARGET_NR_setresgid32, "setresgid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setresuid
+{ TARGET_NR_setresuid, "setresuid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setresuid32
+{ TARGET_NR_setresuid32, "setresuid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setreuid
+{ TARGET_NR_setreuid, "setreuid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setreuid32
+{ TARGET_NR_setreuid32, "setreuid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setrlimit
+{ TARGET_NR_setrlimit, "setrlimit" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_set_robust_list
+{ TARGET_NR_set_robust_list, "set_robust_list" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setsid
+{ TARGET_NR_setsid, "setsid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setsockopt
+{ TARGET_NR_setsockopt, "setsockopt" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_set_thread_area
+{ TARGET_NR_set_thread_area, "set_thread_area" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_set_tid_address
+{ TARGET_NR_set_tid_address, "set_tid_address" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_settimeofday
+{ TARGET_NR_settimeofday, "settimeofday" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setuid
+{ TARGET_NR_setuid, "setuid" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setuid32
+{ TARGET_NR_setuid32, "setuid32" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_setxattr
+{ TARGET_NR_setxattr, "setxattr" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sgetmask
+{ TARGET_NR_sgetmask, "sgetmask" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_shmat
+{ TARGET_NR_shmat, "shmat" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_shmctl
+{ TARGET_NR_shmctl, "shmctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_shmdt
+{ TARGET_NR_shmdt, "shmdt" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_shmget
+{ TARGET_NR_shmget, "shmget" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_shutdown
+{ TARGET_NR_shutdown, "shutdown" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sigaction
+{ TARGET_NR_sigaction, "sigaction" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sigaltstack
+{ TARGET_NR_sigaltstack, "sigaltstack" , "%s(%p,%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_signal
+{ TARGET_NR_signal, "signal" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sigpending
+{ TARGET_NR_sigpending, "sigpending" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sigprocmask
+{ TARGET_NR_sigprocmask, "sigprocmask" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sigreturn
+{ TARGET_NR_sigreturn, "sigreturn" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sigsuspend
+{ TARGET_NR_sigsuspend, "sigsuspend" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_socket
+{ TARGET_NR_socket, "socket" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_socketcall
+{ TARGET_NR_socketcall, "socketcall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_socketpair
+{ TARGET_NR_socketpair, "socketpair" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_splice
+{ TARGET_NR_splice, "splice" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ssetmask
+{ TARGET_NR_ssetmask, "ssetmask" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_stat
+{ TARGET_NR_stat, "stat" , "%s(\"%s\",%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_stat64
+{ TARGET_NR_stat64, "stat64" , "%s(\"%s\",%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_statfs
+{ TARGET_NR_statfs, "statfs" , "%s(\"%s\",%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_statfs64
+{ TARGET_NR_statfs64, "statfs64" , "%s(\"%s\",%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_stime
+{ TARGET_NR_stime, "stime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_streams1
+{ TARGET_NR_streams1, "streams1" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_streams2
+{ TARGET_NR_streams2, "streams2" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_stty
+{ TARGET_NR_stty, "stty" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_swapcontext
+{ TARGET_NR_swapcontext, "swapcontext" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_swapoff
+{ TARGET_NR_swapoff, "swapoff" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_swapon
+{ TARGET_NR_swapon, "swapon" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_symlink
+{ TARGET_NR_symlink, "symlink" , "%s(\"%s\",\"%s\")", NULL, NULL },
+#endif
+#ifdef TARGET_NR_symlinkat
+{ TARGET_NR_symlinkat, "symlinkat" , "%s(\"%s\",%d,\"%s\")", NULL, NULL },
+#endif
+#ifdef TARGET_NR_sync
+{ TARGET_NR_sync, "sync" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sync_file_range
+{ TARGET_NR_sync_file_range, "sync_file_range" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_syscall
+{ TARGET_NR_syscall, "syscall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR__sysctl
+{ TARGET_NR__sysctl, "_sysctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sys_epoll_create
+{ TARGET_NR_sys_epoll_create, "sys_epoll_create" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sys_epoll_ctl
+{ TARGET_NR_sys_epoll_ctl, "sys_epoll_ctl" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sys_epoll_wait
+{ TARGET_NR_sys_epoll_wait, "sys_epoll_wait" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sysfs
+{ TARGET_NR_sysfs, "sysfs" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sysinfo
+{ TARGET_NR_sysinfo, "sysinfo" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sys_kexec_load
+{ TARGET_NR_sys_kexec_load, "sys_kexec_load" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_syslog
+{ TARGET_NR_syslog, "syslog" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sysmips
+{ TARGET_NR_sysmips, "sysmips" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_sys_setaltroot
+{ TARGET_NR_sys_setaltroot, "sys_setaltroot" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_tee
+{ TARGET_NR_tee, "tee" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_tgkill
+{ TARGET_NR_tgkill, "tgkill" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_time
+{ TARGET_NR_time, "time" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_timer_create
+{ TARGET_NR_timer_create, "timer_create" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_timer_delete
+{ TARGET_NR_timer_delete, "timer_delete" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_timer_getoverrun
+{ TARGET_NR_timer_getoverrun, "timer_getoverrun" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_timer_gettime
+{ TARGET_NR_timer_gettime, "timer_gettime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_timer_settime
+{ TARGET_NR_timer_settime, "timer_settime" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_times
+{ TARGET_NR_times, "times" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_tkill
+{ TARGET_NR_tkill, "tkill" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_truncate
+{ TARGET_NR_truncate, "truncate" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_truncate64
+{ TARGET_NR_truncate64, "truncate64" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_tuxcall
+{ TARGET_NR_tuxcall, "tuxcall" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ugetrlimit
+{ TARGET_NR_ugetrlimit, "ugetrlimit" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ulimit
+{ TARGET_NR_ulimit, "ulimit" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_umask
+{ TARGET_NR_umask, "umask" , "%s(%#o)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_umount
+{ TARGET_NR_umount, "umount" , "%s(\"%s\",\"%s\",\"%s\",%#x,%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_umount2
+{ TARGET_NR_umount2, "umount2" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_uname
+{ TARGET_NR_uname, "uname" , "%s(%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_unlink
+{ TARGET_NR_unlink, "unlink" , "%s(\"%s\")", NULL, NULL },
+#endif
+#ifdef TARGET_NR_unlinkat
+{ TARGET_NR_unlinkat, "unlinkat" , "%s(%d,\"%s\",%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_unshare
+{ TARGET_NR_unshare, "unshare" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_unused109
+{ TARGET_NR_unused109, "unused109" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_unused150
+{ TARGET_NR_unused150, "unused150" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_unused18
+{ TARGET_NR_unused18, "unused18" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_unused28
+{ TARGET_NR_unused28, "unused28" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_unused59
+{ TARGET_NR_unused59, "unused59" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_unused84
+{ TARGET_NR_unused84, "unused84" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_uselib
+{ TARGET_NR_uselib, "uselib" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_ustat
+{ TARGET_NR_ustat, "ustat" , "%s(%#x,%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_utime
+{ TARGET_NR_utime, "utime" , "%s(\"%s\",%p)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_utimes
+{ TARGET_NR_utimes, "utimes" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_utrap_install
+{ TARGET_NR_utrap_install, "utrap_install" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_vfork
+{ TARGET_NR_vfork, "vfork" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_vhangup
+{ TARGET_NR_vhangup, "vhangup" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_vm86
+{ TARGET_NR_vm86, "vm86" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_vm86old
+{ TARGET_NR_vm86old, "vm86old" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_vmsplice
+{ TARGET_NR_vmsplice, "vmsplice" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_vserver
+{ TARGET_NR_vserver, "vserver" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_wait4
+{ TARGET_NR_wait4, "wait4" , NULL, NULL, NULL },
+#endif
+#ifdef TARGET_NR_waitid
+{ TARGET_NR_waitid, "waitid" , "%s(%#x,%d,%p,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_waitpid
+{ TARGET_NR_waitpid, "waitpid" , "%s(%d,%p,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_write
+{ TARGET_NR_write, "write" , "%s(%d,%#x,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_writev
+{ TARGET_NR_writev, "writev" , "%s(%d,%p,%#x)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_utimensat
+{ TARGET_NR_utimensat, "utimensat", "%s(%d,\"%s\",%p,%#x)", NULL, NULL },
+#endif
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index af5b9d922..4ebc8bbdb 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -74,7 +74,7 @@
 //#define DEBUG
 
 #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SPARC) \
-    || defined(TARGET_M68K) || defined(TARGET_SH4)
+    || defined(TARGET_M68K) || defined(TARGET_SH4) || defined(TARGET_CRIS)
 /* 16 bit uid wrappers emulation */
 #define USE_UID16
 #endif
@@ -145,6 +145,7 @@ type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5,type6 arg6)	\
 #define __NR_sys_getcwd1 __NR_getcwd
 #define __NR_sys_getdents __NR_getdents
 #define __NR_sys_getdents64 __NR_getdents64
+#define __NR_sys_getpriority __NR_getpriority
 #define __NR_sys_linkat __NR_linkat
 #define __NR_sys_mkdirat __NR_mkdirat
 #define __NR_sys_mknodat __NR_mknodat
@@ -166,6 +167,8 @@ type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5,type6 arg6)	\
 #ifdef __NR_gettid
 _syscall0(int, gettid)
 #else
+/* This is a replacement for the host gettid() and must return a host
+   errno. */
 static int gettid(void) {
     return -ENOSYS;
 }
@@ -187,6 +190,7 @@ _syscall3(int, sys_getdents, uint, fd, struct dirent *, dirp, uint, count);
 #if defined(TARGET_NR_getdents64) && defined(__NR_getdents64)
 _syscall3(int, sys_getdents64, uint, fd, struct dirent64 *, dirp, uint, count);
 #endif
+_syscall2(int, sys_getpriority, int, which, int, who);
 _syscall5(int, _llseek,  uint,  fd, ulong, hi, ulong, lo,
           loff_t *, res, uint, wh);
 #if defined(TARGET_NR_linkat) && defined(__NR_linkat)
@@ -247,11 +251,18 @@ extern int setresgid(gid_t, gid_t, gid_t);
 extern int getresgid(gid_t *, gid_t *, gid_t *);
 extern int setgroups(int, gid_t *);
 
+#define ERRNO_TABLE_SIZE 1200
+
+/* target_to_host_errno_table[] is initialized from
+ * host_to_target_errno_table[] in syscall_init(). */
+static uint16_t target_to_host_errno_table[ERRNO_TABLE_SIZE] = {
+};
+
 /*
  * This list is the union of errno values overridden in asm-<arch>/errno.h
  * minus the errnos that are not actually generic to all archs.
  */
-static uint16_t host_to_target_errno_table[1200] = {
+static uint16_t host_to_target_errno_table[ERRNO_TABLE_SIZE] = {
     [EIDRM]		= TARGET_EIDRM,
     [ECHRNG]		= TARGET_ECHRNG,
     [EL2NSYNC]		= TARGET_EL2NSYNC,
@@ -357,7 +368,7 @@ static uint16_t host_to_target_errno_table[1200] = {
 #ifdef ENOTRECOVERABLE
     [ENOTRECOVERABLE]	= TARGET_ENOTRECOVERABLE,
 #endif
-	};
+};
 
 static inline int host_to_target_errno(int err)
 {
@@ -366,7 +377,14 @@ static inline int host_to_target_errno(int err)
     return err;
 }
 
-static inline target_long get_errno(target_long ret)
+static inline int target_to_host_errno(int err)
+{
+    if (target_to_host_errno_table[err])
+        return target_to_host_errno_table[err];
+    return err;
+}
+
+static inline abi_long get_errno(abi_long ret)
 {
     if (ret == -1)
         return -host_to_target_errno(errno);
@@ -374,29 +392,35 @@ static inline target_long get_errno(target_long ret)
         return ret;
 }
 
-static inline int is_error(target_long ret)
+static inline int is_error(abi_long ret)
+{
+    return (abi_ulong)ret >= (abi_ulong)(-4096);
+}
+
+char *target_strerror(int err)
 {
-    return (target_ulong)ret >= (target_ulong)(-4096);
+    return strerror(target_to_host_errno(err));
 }
 
-static target_ulong target_brk;
-static target_ulong target_original_brk;
+static abi_ulong target_brk;
+static abi_ulong target_original_brk;
 
-void target_set_brk(target_ulong new_brk)
+void target_set_brk(abi_ulong new_brk)
 {
     target_original_brk = target_brk = HOST_PAGE_ALIGN(new_brk);
 }
 
-target_long do_brk(target_ulong new_brk)
+/* do_brk() must return target values and target errnos. */
+abi_long do_brk(abi_ulong new_brk)
 {
-    target_ulong brk_page;
-    target_long mapped_addr;
+    abi_ulong brk_page;
+    abi_long mapped_addr;
     int	new_alloc_size;
 
     if (!new_brk)
         return target_brk;
     if (new_brk < target_original_brk)
-        return -ENOMEM;
+        return -TARGET_ENOMEM;
 
     brk_page = HOST_PAGE_ALIGN(target_brk);
 
@@ -419,50 +443,66 @@ target_long do_brk(target_ulong new_brk)
     }
 }
 
-static inline fd_set *target_to_host_fds(fd_set *fds,
-                                         target_long *target_fds, int n)
+static inline abi_long copy_from_user_fdset(fd_set *fds,
+                                            abi_ulong target_fds_addr,
+                                            int n)
 {
-#if !defined(BSWAP_NEEDED) && !defined(WORDS_BIGENDIAN)
-    return (fd_set *)target_fds;
-#else
-    int i, b;
-    if (target_fds) {
-        FD_ZERO(fds);
-        for(i = 0;i < n; i++) {
-            b = (tswapl(target_fds[i / TARGET_LONG_BITS]) >>
-                 (i & (TARGET_LONG_BITS - 1))) & 1;
-            if (b)
-                FD_SET(i, fds);
+    int i, nw, j, k;
+    abi_ulong b, *target_fds;
+
+    nw = (n + TARGET_ABI_BITS - 1) / TARGET_ABI_BITS;
+    if (!(target_fds = lock_user(VERIFY_READ,
+                                 target_fds_addr,
+                                 sizeof(abi_ulong) * nw,
+                                 1)))
+        return -TARGET_EFAULT;
+
+    FD_ZERO(fds);
+    k = 0;
+    for (i = 0; i < nw; i++) {
+        /* grab the abi_ulong */
+        __get_user(b, &target_fds[i]);
+        for (j = 0; j < TARGET_ABI_BITS; j++) {
+            /* check the bit inside the abi_ulong */
+            if ((b >> j) & 1)
+                FD_SET(k, fds);
+            k++;
         }
-        return fds;
-    } else {
-        return NULL;
     }
-#endif
+
+    unlock_user(target_fds, target_fds_addr, 0);
+
+    return 0;
 }
 
-static inline void host_to_target_fds(target_long *target_fds,
-                                      fd_set *fds, int n)
+static inline abi_long copy_to_user_fdset(abi_ulong target_fds_addr,
+                                          const fd_set *fds,
+                                          int n)
 {
-#if !defined(BSWAP_NEEDED) && !defined(WORDS_BIGENDIAN)
-    /* nothing to do */
-#else
     int i, nw, j, k;
-    target_long v;
-
-    if (target_fds) {
-        nw = (n + TARGET_LONG_BITS - 1) / TARGET_LONG_BITS;
-        k = 0;
-        for(i = 0;i < nw; i++) {
-            v = 0;
-            for(j = 0; j < TARGET_LONG_BITS; j++) {
-                v |= ((FD_ISSET(k, fds) != 0) << j);
-                k++;
-            }
-            target_fds[i] = tswapl(v);
+    abi_long v;
+    abi_ulong *target_fds;
+
+    nw = (n + TARGET_ABI_BITS - 1) / TARGET_ABI_BITS;
+    if (!(target_fds = lock_user(VERIFY_WRITE,
+                                 target_fds_addr,
+                                 sizeof(abi_ulong) * nw,
+                                 0)))
+        return -TARGET_EFAULT;
+
+    k = 0;
+    for (i = 0; i < nw; i++) {
+        v = 0;
+        for (j = 0; j < TARGET_ABI_BITS; j++) {
+            v |= ((FD_ISSET(k, fds) != 0) << j);
+            k++;
         }
+        __put_user(v, &target_fds[i]);
     }
-#endif
+
+    unlock_user(target_fds, target_fds_addr, sizeof(abi_ulong) * nw);
+
+    return 0;
 }
 
 #if defined(__alpha__)
@@ -471,7 +511,7 @@ static inline void host_to_target_fds(target_long *target_fds,
 #define HOST_HZ 100
 #endif
 
-static inline target_long host_to_target_clock_t(long ticks)
+static inline abi_long host_to_target_clock_t(long ticks)
 {
 #if HOST_HZ == TARGET_HZ
     return ticks;
@@ -480,12 +520,13 @@ static inline target_long host_to_target_clock_t(long ticks)
 #endif
 }
 
-static inline void host_to_target_rusage(target_ulong target_addr,
-                                         const struct rusage *rusage)
+static inline abi_long host_to_target_rusage(abi_ulong target_addr,
+                                             const struct rusage *rusage)
 {
     struct target_rusage *target_rusage;
 
-    lock_user_struct(target_rusage, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_rusage, target_addr, 0))
+        return -TARGET_EFAULT;
     target_rusage->ru_utime.tv_sec = tswapl(rusage->ru_utime.tv_sec);
     target_rusage->ru_utime.tv_usec = tswapl(rusage->ru_utime.tv_usec);
     target_rusage->ru_stime.tv_sec = tswapl(rusage->ru_stime.tv_sec);
@@ -505,123 +546,149 @@ static inline void host_to_target_rusage(target_ulong target_addr,
     target_rusage->ru_nvcsw = tswapl(rusage->ru_nvcsw);
     target_rusage->ru_nivcsw = tswapl(rusage->ru_nivcsw);
     unlock_user_struct(target_rusage, target_addr, 1);
+
+    return 0;
 }
 
-static inline void target_to_host_timeval(struct timeval *tv,
-                                          target_ulong target_addr)
+static inline abi_long copy_from_user_timeval(struct timeval *tv,
+                                              abi_ulong target_tv_addr)
 {
     struct target_timeval *target_tv;
 
-    lock_user_struct(target_tv, target_addr, 1);
-    tv->tv_sec = tswapl(target_tv->tv_sec);
-    tv->tv_usec = tswapl(target_tv->tv_usec);
-    unlock_user_struct(target_tv, target_addr, 0);
+    if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1))
+        return -TARGET_EFAULT;
+
+    __get_user(tv->tv_sec, &target_tv->tv_sec);
+    __get_user(tv->tv_usec, &target_tv->tv_usec);
+
+    unlock_user_struct(target_tv, target_tv_addr, 0);
+
+    return 0;
 }
 
-static inline void host_to_target_timeval(target_ulong target_addr,
-                                          const struct timeval *tv)
+static inline abi_long copy_to_user_timeval(abi_ulong target_tv_addr,
+                                            const struct timeval *tv)
 {
     struct target_timeval *target_tv;
 
-    lock_user_struct(target_tv, target_addr, 0);
-    target_tv->tv_sec = tswapl(tv->tv_sec);
-    target_tv->tv_usec = tswapl(tv->tv_usec);
-    unlock_user_struct(target_tv, target_addr, 1);
+    if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0))
+        return -TARGET_EFAULT;
+
+    __put_user(tv->tv_sec, &target_tv->tv_sec);
+    __put_user(tv->tv_usec, &target_tv->tv_usec);
+
+    unlock_user_struct(target_tv, target_tv_addr, 1);
+
+    return 0;
 }
 
 
-static target_long do_select(int n,
-                             target_ulong rfd_p, target_ulong wfd_p,
-                             target_ulong efd_p, target_ulong target_tv)
+/* do_select() must return target values and target errnos. */
+static abi_long do_select(int n,
+                          abi_ulong rfd_addr, abi_ulong wfd_addr,
+                          abi_ulong efd_addr, abi_ulong target_tv_addr)
 {
     fd_set rfds, wfds, efds;
     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
-    target_long *target_rfds, *target_wfds, *target_efds;
     struct timeval tv, *tv_ptr;
-    target_long ret;
-    int ok;
+    abi_long ret;
 
-    if (rfd_p) {
-        target_rfds = lock_user(rfd_p, sizeof(target_long) * n, 1);
-        rfds_ptr = target_to_host_fds(&rfds, target_rfds, n);
+    if (rfd_addr) {
+        if (copy_from_user_fdset(&rfds, rfd_addr, n))
+            return -TARGET_EFAULT;
+        rfds_ptr = &rfds;
     } else {
-        target_rfds = NULL;
         rfds_ptr = NULL;
     }
-    if (wfd_p) {
-        target_wfds = lock_user(wfd_p, sizeof(target_long) * n, 1);
-        wfds_ptr = target_to_host_fds(&wfds, target_wfds, n);
+    if (wfd_addr) {
+        if (copy_from_user_fdset(&wfds, wfd_addr, n))
+            return -TARGET_EFAULT;
+        wfds_ptr = &wfds;
     } else {
-        target_wfds = NULL;
         wfds_ptr = NULL;
     }
-    if (efd_p) {
-        target_efds = lock_user(efd_p, sizeof(target_long) * n, 1);
-        efds_ptr = target_to_host_fds(&efds, target_efds, n);
+    if (efd_addr) {
+        if (copy_from_user_fdset(&efds, efd_addr, n))
+            return -TARGET_EFAULT;
+        efds_ptr = &efds;
     } else {
-        target_efds = NULL;
         efds_ptr = NULL;
     }
 
-    if (target_tv) {
-        target_to_host_timeval(&tv, target_tv);
+    if (target_tv_addr) {
+        if (copy_from_user_timeval(&tv, target_tv_addr))
+            return -TARGET_EFAULT;
         tv_ptr = &tv;
     } else {
         tv_ptr = NULL;
     }
-    ret = get_errno(select(n, rfds_ptr, wfds_ptr, efds_ptr, tv_ptr));
-    ok = !is_error(ret);
 
-    if (ok) {
-        host_to_target_fds(target_rfds, rfds_ptr, n);
-        host_to_target_fds(target_wfds, wfds_ptr, n);
-        host_to_target_fds(target_efds, efds_ptr, n);
+    ret = get_errno(select(n, rfds_ptr, wfds_ptr, efds_ptr, tv_ptr));
 
-        if (target_tv) {
-            host_to_target_timeval(target_tv, &tv);
-        }
+    if (!is_error(ret)) {
+        if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
+            return -TARGET_EFAULT;
+        if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
+            return -TARGET_EFAULT;
+        if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
+            return -TARGET_EFAULT;
+
+        if (target_tv_addr && copy_to_user_timeval(target_tv_addr, &tv))
+            return -TARGET_EFAULT;
     }
-    if (target_rfds)
-        unlock_user(target_rfds, rfd_p, ok ? sizeof(target_long) * n : 0);
-    if (target_wfds)
-        unlock_user(target_wfds, wfd_p, ok ? sizeof(target_long) * n : 0);
-    if (target_efds)
-        unlock_user(target_efds, efd_p, ok ? sizeof(target_long) * n : 0);
 
     return ret;
 }
 
-static inline void target_to_host_sockaddr(struct sockaddr *addr,
-                                           target_ulong target_addr,
-                                           socklen_t len)
+static inline abi_long target_to_host_sockaddr(struct sockaddr *addr,
+                                               abi_ulong target_addr,
+                                               socklen_t len)
 {
     struct target_sockaddr *target_saddr;
 
-    target_saddr = lock_user(target_addr, len, 1);
+    target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
+    if (!target_saddr)
+        return -TARGET_EFAULT;
     memcpy(addr, target_saddr, len);
     addr->sa_family = tswap16(target_saddr->sa_family);
     unlock_user(target_saddr, target_addr, 0);
+
+    return 0;
 }
 
-static inline void host_to_target_sockaddr(target_ulong target_addr,
-                                           struct sockaddr *addr,
-                                           socklen_t len)
+static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,
+                                               struct sockaddr *addr,
+                                               socklen_t len)
 {
     struct target_sockaddr *target_saddr;
 
-    target_saddr = lock_user(target_addr, len, 0);
+    target_saddr = lock_user(VERIFY_WRITE, target_addr, len, 0);
+    if (!target_saddr)
+        return -TARGET_EFAULT;
     memcpy(target_saddr, addr, len);
     target_saddr->sa_family = tswap16(addr->sa_family);
     unlock_user(target_saddr, target_addr, len);
+
+    return 0;
 }
 
 /* ??? Should this also swap msgh->name?  */
-static inline void target_to_host_cmsg(struct msghdr *msgh,
-                                       struct target_msghdr *target_msgh)
+static inline abi_long target_to_host_cmsg(struct msghdr *msgh,
+                                           struct target_msghdr *target_msgh)
 {
     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
-    struct target_cmsghdr *target_cmsg = TARGET_CMSG_FIRSTHDR(target_msgh);
+    abi_long msg_controllen;
+    abi_ulong target_cmsg_addr;
+    struct target_cmsghdr *target_cmsg;
     socklen_t space = 0;
+    
+    msg_controllen = tswapl(target_msgh->msg_controllen);
+    if (msg_controllen < sizeof (struct target_cmsghdr)) 
+        goto the_end;
+    target_cmsg_addr = tswapl(target_msgh->msg_control);
+    target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);
+    if (!target_cmsg)
+        return -TARGET_EFAULT;
 
     while (cmsg && target_cmsg) {
         void *data = CMSG_DATA(cmsg);
@@ -656,18 +723,30 @@ static inline void target_to_host_cmsg(struct msghdr *msgh,
         cmsg = CMSG_NXTHDR(msgh, cmsg);
         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg);
     }
-
+    unlock_user(target_cmsg, target_cmsg_addr, 0);
+ the_end:
     msgh->msg_controllen = space;
+    return 0;
 }
 
 /* ??? Should this also swap msgh->name?  */
-static inline void host_to_target_cmsg(struct target_msghdr *target_msgh,
-                                       struct msghdr *msgh)
+static inline abi_long host_to_target_cmsg(struct target_msghdr *target_msgh,
+                                           struct msghdr *msgh)
 {
     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
-    struct target_cmsghdr *target_cmsg = TARGET_CMSG_FIRSTHDR(target_msgh);
+    abi_long msg_controllen;
+    abi_ulong target_cmsg_addr;
+    struct target_cmsghdr *target_cmsg;
     socklen_t space = 0;
 
+    msg_controllen = tswapl(target_msgh->msg_controllen);
+    if (msg_controllen < sizeof (struct target_cmsghdr)) 
+        goto the_end;
+    target_cmsg_addr = tswapl(target_msgh->msg_control);
+    target_cmsg = lock_user(VERIFY_WRITE, target_cmsg_addr, msg_controllen, 0);
+    if (!target_cmsg)
+        return -TARGET_EFAULT;
+
     while (cmsg && target_cmsg) {
         void *data = CMSG_DATA(cmsg);
         void *target_data = TARGET_CMSG_DATA(target_cmsg);
@@ -675,7 +754,7 @@ static inline void host_to_target_cmsg(struct target_msghdr *target_msgh,
         int len = cmsg->cmsg_len - CMSG_ALIGN(sizeof (struct cmsghdr));
 
         space += TARGET_CMSG_SPACE(len);
-        if (space > tswapl(target_msgh->msg_controllen)) {
+        if (space > msg_controllen) {
             space -= TARGET_CMSG_SPACE(len);
             gemu_log("Target cmsg overflow\n");
             break;
@@ -700,23 +779,27 @@ static inline void host_to_target_cmsg(struct target_msghdr *target_msgh,
         cmsg = CMSG_NXTHDR(msgh, cmsg);
         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg);
     }
-
-    msgh->msg_controllen = tswapl(space);
+    unlock_user(target_cmsg, target_cmsg_addr, space);
+ the_end:
+    target_msgh->msg_controllen = tswapl(space);
+    return 0;
 }
 
-static target_long do_setsockopt(int sockfd, int level, int optname,
-                                 target_ulong optval, socklen_t optlen)
+/* do_setsockopt() Must return target values and target errnos. */
+static abi_long do_setsockopt(int sockfd, int level, int optname,
+                              abi_ulong optval_addr, socklen_t optlen)
 {
-    target_long ret;
+    abi_long ret;
     int val;
 
     switch(level) {
     case SOL_TCP:
         /* TCP options all take an 'int' value.  */
         if (optlen < sizeof(uint32_t))
-            return -EINVAL;
+            return -TARGET_EINVAL;
 
-        val = tget32(optval);
+        if (get_user_u32(val, optval_addr))
+            return -TARGET_EFAULT;
         ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
         break;
     case SOL_IP:
@@ -738,9 +821,11 @@ static target_long do_setsockopt(int sockfd, int level, int optname,
         case IP_MULTICAST_LOOP:
             val = 0;
             if (optlen >= sizeof(uint32_t)) {
-                val = tget32(optval);
+                if (get_user_u32(val, optval_addr))
+                    return -TARGET_EFAULT;
             } else if (optlen >= 1) {
-                val = tget8(optval);
+                if (get_user_u8(val, optval_addr))
+                    return -TARGET_EFAULT;
             }
             ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
             break;
@@ -812,23 +897,25 @@ static target_long do_setsockopt(int sockfd, int level, int optname,
             goto unimplemented;
         }
 	if (optlen < sizeof(uint32_t))
-	return -EINVAL;
+            return -TARGET_EINVAL;
 
-	val = tget32(optval);
+	if (get_user_u32(val, optval_addr))
+            return -TARGET_EFAULT;
 	ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname, &val, sizeof(val)));
         break;
     default:
     unimplemented:
         gemu_log("Unsupported setsockopt level=%d optname=%d \n", level, optname);
-        ret = -ENOSYS;
+        ret = -TARGET_ENOSYS;
     }
     return ret;
 }
 
-static target_long do_getsockopt(int sockfd, int level, int optname,
-                                 target_ulong optval, target_ulong optlen)
+/* do_getsockopt() Must return target values and target errnos. */
+static abi_long do_getsockopt(int sockfd, int level, int optname,
+                              abi_ulong optval_addr, abi_ulong optlen)
 {
-    target_long ret;
+    abi_long ret;
     int len, lv, val;
 
     switch(level) {
@@ -849,9 +936,10 @@ static target_long do_getsockopt(int sockfd, int level, int optname,
     case SOL_TCP:
         /* TCP options all take an 'int' value.  */
     int_case:
-        len = tget32(optlen);
+        if (get_user_u32(len, optlen))
+            return -TARGET_EFAULT;
         if (len < 0)
-            return -EINVAL;
+            return -TARGET_EINVAL;
         lv = sizeof(int);
         ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
         if (ret < 0)
@@ -859,11 +947,15 @@ static target_long do_getsockopt(int sockfd, int level, int optname,
         val = tswap32(val);
         if (len > lv)
             len = lv;
-        if (len == 4)
-            tput32(optval, val);
-        else
-            tput8(optval, val);
-        tput32(optlen, len);
+        if (len == 4) {
+            if (put_user_u32(val, optval_addr))
+                return -TARGET_EFAULT;
+        } else {
+            if (put_user_u8(val, optval_addr))
+                return -TARGET_EFAULT;
+	}
+        if (put_user_u32(len, optlen))
+            return -TARGET_EFAULT;
         break;
     case SOL_IP:
         switch(optname) {
@@ -882,22 +974,25 @@ static target_long do_getsockopt(int sockfd, int level, int optname,
 #endif
         case IP_MULTICAST_TTL:
         case IP_MULTICAST_LOOP:
-            len = tget32(optlen);
+            if (get_user_u32(len, optlen))
+                return -TARGET_EFAULT;
             if (len < 0)
-                return -EINVAL;
+                return -TARGET_EINVAL;
             lv = sizeof(int);
             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
             if (ret < 0)
                 return ret;
             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
                 len = 1;
-                tput32(optlen, len);
-                tput8(optval, val);
+                if (put_user_u32(len, optlen)
+                    || put_user_u8(val, optval_addr))
+                    return -TARGET_EFAULT;
             } else {
                 if (len > sizeof(int))
                     len = sizeof(int);
-                tput32(optlen, len);
-                tput32(optval, val);
+                if (put_user_u32(len, optlen)
+                    || put_user_u32(val, optval_addr))
+                    return -TARGET_EFAULT;
             }
             break;
         default:
@@ -908,44 +1003,66 @@ static target_long do_getsockopt(int sockfd, int level, int optname,
     unimplemented:
         gemu_log("getsockopt level=%d optname=%d not yet supported\n",
                  level, optname);
-        ret = -ENOSYS;
+        ret = -TARGET_ENOSYS;
         break;
     }
     return ret;
 }
 
-static void lock_iovec(struct iovec *vec, target_ulong target_addr,
-                       int count, int copy)
+/* FIXME
+ * lock_iovec()/unlock_iovec() have a return code of 0 for success where
+ * other lock functions have a return code of 0 for failure.
+ */
+static abi_long lock_iovec(int type, struct iovec *vec, abi_ulong target_addr,
+                           int count, int copy)
 {
     struct target_iovec *target_vec;
-    target_ulong base;
-    int i;
+    abi_ulong base;
+    int i, j;
 
-    target_vec = lock_user(target_addr, count * sizeof(struct target_iovec), 1);
+    target_vec = lock_user(VERIFY_READ, target_addr, count * sizeof(struct target_iovec), 1);
+    if (!target_vec)
+        return -TARGET_EFAULT;
     for(i = 0;i < count; i++) {
         base = tswapl(target_vec[i].iov_base);
         vec[i].iov_len = tswapl(target_vec[i].iov_len);
-        vec[i].iov_base = lock_user(base, vec[i].iov_len, copy);
+        vec[i].iov_base = lock_user(type, base, vec[i].iov_len, copy);
+	if (!vec[i].iov_base) 
+            goto fail;
+    }
+    unlock_user (target_vec, target_addr, 0);
+    return 0;
+ fail:
+    /* failure - unwind locks */
+    for (j = 0; j < i; j++) {
+        base = tswapl(target_vec[j].iov_base);
+        unlock_user(vec[j].iov_base, base, 0);
     }
     unlock_user (target_vec, target_addr, 0);
+    return -TARGET_EFAULT;
 }
 
-static void unlock_iovec(struct iovec *vec, target_ulong target_addr,
-                         int count, int copy)
+static abi_long unlock_iovec(struct iovec *vec, abi_ulong target_addr,
+                             int count, int copy)
 {
     struct target_iovec *target_vec;
-    target_ulong base;
+    abi_ulong base;
     int i;
 
-    target_vec = lock_user(target_addr, count * sizeof(struct target_iovec), 1);
+    target_vec = lock_user(VERIFY_READ, target_addr, count * sizeof(struct target_iovec), 1);
+    if (!target_vec)
+        return -TARGET_EFAULT;
     for(i = 0;i < count; i++) {
         base = tswapl(target_vec[i].iov_base);
         unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);
     }
     unlock_user (target_vec, target_addr, 0);
+
+    return 0;
 }
 
-static target_long do_socket(int domain, int type, int protocol)
+/* do_socket() Must return target values and target errnos. */
+static abi_long do_socket(int domain, int type, int protocol)
 {
 #if defined(TARGET_MIPS)
     switch(type) {
@@ -969,11 +1086,14 @@ static target_long do_socket(int domain, int type, int protocol)
         break;
     }
 #endif
+    if (domain == PF_NETLINK)
+        return -EAFNOSUPPORT; /* do not NETLINK socket connections possible */
     return get_errno(socket(domain, type, protocol));
 }
 
-static target_long do_bind(int sockfd, target_ulong target_addr,
-                           socklen_t addrlen)
+/* do_bind() Must return target values and target errnos. */
+static abi_long do_bind(int sockfd, abi_ulong target_addr,
+                        socklen_t addrlen)
 {
     void *addr = alloca(addrlen);
 
@@ -981,8 +1101,9 @@ static target_long do_bind(int sockfd, target_ulong target_addr,
     return get_errno(bind(sockfd, addr, addrlen));
 }
 
-static target_long do_connect(int sockfd, target_ulong target_addr,
-                              socklen_t addrlen)
+/* do_connect() Must return target values and target errnos. */
+static abi_long do_connect(int sockfd, abi_ulong target_addr,
+                           socklen_t addrlen)
 {
     void *addr = alloca(addrlen);
 
@@ -990,17 +1111,23 @@ static target_long do_connect(int sockfd, target_ulong target_addr,
     return get_errno(connect(sockfd, addr, addrlen));
 }
 
-static target_long do_sendrecvmsg(int fd, target_ulong target_msg,
-                                  int flags, int send)
+/* do_sendrecvmsg() Must return target values and target errnos. */
+static abi_long do_sendrecvmsg(int fd, abi_ulong target_msg,
+                               int flags, int send)
 {
-    target_long ret;
+    abi_long ret;
     struct target_msghdr *msgp;
     struct msghdr msg;
     int count;
     struct iovec *vec;
-    target_ulong target_vec;
-
-    lock_user_struct(msgp, target_msg, 1);
+    abi_ulong target_vec;
+
+    /* FIXME */
+    if (!lock_user_struct(send ? VERIFY_READ : VERIFY_WRITE,
+                          msgp,
+                          target_msg,
+                          send ? 1 : 0))
+        return -TARGET_EFAULT;
     if (msgp->msg_name) {
         msg.msg_namelen = tswap32(msgp->msg_namelen);
         msg.msg_name = alloca(msg.msg_namelen);
@@ -1017,89 +1144,117 @@ static target_long do_sendrecvmsg(int fd, target_ulong target_msg,
     count = tswapl(msgp->msg_iovlen);
     vec = alloca(count * sizeof(struct iovec));
     target_vec = tswapl(msgp->msg_iov);
-    lock_iovec(vec, target_vec, count, send);
+    lock_iovec(send ? VERIFY_READ : VERIFY_WRITE, vec, target_vec, count, send);
     msg.msg_iovlen = count;
     msg.msg_iov = vec;
 
     if (send) {
-        target_to_host_cmsg(&msg, msgp);
-        ret = get_errno(sendmsg(fd, &msg, flags));
+        ret = target_to_host_cmsg(&msg, msgp);
+        if (ret == 0)
+            ret = get_errno(sendmsg(fd, &msg, flags));
     } else {
         ret = get_errno(recvmsg(fd, &msg, flags));
         if (!is_error(ret))
-            host_to_target_cmsg(msgp, &msg);
+            ret = host_to_target_cmsg(msgp, &msg);
     }
     unlock_iovec(vec, target_vec, count, !send);
+    unlock_user_struct(msgp, target_msg, send ? 0 : 1);
     return ret;
 }
 
-static target_long do_accept(int fd, target_ulong target_addr,
-                             target_ulong target_addrlen)
+/* do_accept() Must return target values and target errnos. */
+static abi_long do_accept(int fd, abi_ulong target_addr,
+                          abi_ulong target_addrlen_addr)
 {
-    socklen_t addrlen = tget32(target_addrlen);
-    void *addr = alloca(addrlen);
-    target_long ret;
+    socklen_t addrlen;
+    void *addr;
+    abi_long ret;
+
+    if (get_user_u32(addrlen, target_addrlen_addr))
+        return -TARGET_EFAULT;
+
+    addr = alloca(addrlen);
 
     ret = get_errno(accept(fd, addr, &addrlen));
     if (!is_error(ret)) {
         host_to_target_sockaddr(target_addr, addr, addrlen);
-        tput32(target_addrlen, addrlen);
+        if (put_user_u32(addrlen, target_addrlen_addr))
+            ret = -TARGET_EFAULT;
     }
     return ret;
 }
 
-static target_long do_getpeername(int fd, target_ulong target_addr,
-                                  target_ulong target_addrlen)
+/* do_getpeername() Must return target values and target errnos. */
+static abi_long do_getpeername(int fd, abi_ulong target_addr,
+                               abi_ulong target_addrlen_addr)
 {
-    socklen_t addrlen = tget32(target_addrlen);
-    void *addr = alloca(addrlen);
-    target_long ret;
+    socklen_t addrlen;
+    void *addr;
+    abi_long ret;
+
+    if (get_user_u32(addrlen, target_addrlen_addr))
+        return -TARGET_EFAULT;
+
+    addr = alloca(addrlen);
 
     ret = get_errno(getpeername(fd, addr, &addrlen));
     if (!is_error(ret)) {
         host_to_target_sockaddr(target_addr, addr, addrlen);
-        tput32(target_addrlen, addrlen);
+        if (put_user_u32(addrlen, target_addrlen_addr))
+            ret = -TARGET_EFAULT;
     }
     return ret;
 }
 
-static target_long do_getsockname(int fd, target_ulong target_addr,
-                                  target_ulong target_addrlen)
+/* do_getsockname() Must return target values and target errnos. */
+static abi_long do_getsockname(int fd, abi_ulong target_addr,
+                               abi_ulong target_addrlen_addr)
 {
-    socklen_t addrlen = tget32(target_addrlen);
-    void *addr = alloca(addrlen);
-    target_long ret;
+    socklen_t addrlen;
+    void *addr;
+    abi_long ret;
+
+    if (get_user_u32(addrlen, target_addrlen_addr))
+        return -TARGET_EFAULT;
+
+    addr = alloca(addrlen);
 
     ret = get_errno(getsockname(fd, addr, &addrlen));
     if (!is_error(ret)) {
         host_to_target_sockaddr(target_addr, addr, addrlen);
-        tput32(target_addrlen, addrlen);
+        if (put_user_u32(addrlen, target_addrlen_addr))
+            ret = -TARGET_EFAULT;
     }
     return ret;
 }
 
-static target_long do_socketpair(int domain, int type, int protocol,
-                                 target_ulong target_tab)
+/* do_socketpair() Must return target values and target errnos. */
+static abi_long do_socketpair(int domain, int type, int protocol,
+                              abi_ulong target_tab_addr)
 {
     int tab[2];
-    target_long ret;
+    abi_long ret;
 
     ret = get_errno(socketpair(domain, type, protocol, tab));
     if (!is_error(ret)) {
-        tput32(target_tab, tab[0]);
-        tput32(target_tab + 4, tab[1]);
+        if (put_user_s32(tab[0], target_tab_addr)
+            || put_user_s32(tab[1], target_tab_addr + sizeof(tab[0])))
+            ret = -TARGET_EFAULT;
     }
     return ret;
 }
 
-static target_long do_sendto(int fd, target_ulong msg, size_t len, int flags,
-                             target_ulong target_addr, socklen_t addrlen)
+/* do_sendto() Must return target values and target errnos. */
+static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
+                          abi_ulong target_addr, socklen_t addrlen)
 {
     void *addr;
     void *host_msg;
-    target_long ret;
+    abi_long ret;
 
-    host_msg = lock_user(msg, len, 1);
+    host_msg = lock_user(VERIFY_READ, msg, len, 1);
+    if (!host_msg)
+        return -TARGET_EFAULT;
     if (target_addr) {
         addr = alloca(addrlen);
         target_to_host_sockaddr(addr, target_addr, addrlen);
@@ -1111,18 +1266,24 @@ static target_long do_sendto(int fd, target_ulong msg, size_t len, int flags,
     return ret;
 }
 
-static target_long do_recvfrom(int fd, target_ulong msg, size_t len, int flags,
-                               target_ulong target_addr,
-                               target_ulong target_addrlen)
+/* do_recvfrom() Must return target values and target errnos. */
+static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
+                            abi_ulong target_addr,
+                            abi_ulong target_addrlen)
 {
     socklen_t addrlen;
     void *addr;
     void *host_msg;
-    target_long ret;
+    abi_long ret;
 
-    host_msg = lock_user(msg, len, 0);
+    host_msg = lock_user(VERIFY_WRITE, msg, len, 0);
+    if (!host_msg)
+        return -TARGET_EFAULT;
     if (target_addr) {
-        addrlen = tget32(target_addrlen);
+        if (get_user_u32(addrlen, target_addrlen)) {
+            ret = -TARGET_EFAULT;
+            goto fail;
+        }
         addr = alloca(addrlen);
         ret = get_errno(recvfrom(fd, host_msg, len, flags, addr, &addrlen));
     } else {
@@ -1132,130 +1293,210 @@ static target_long do_recvfrom(int fd, target_ulong msg, size_t len, int flags,
     if (!is_error(ret)) {
         if (target_addr) {
             host_to_target_sockaddr(target_addr, addr, addrlen);
-            tput32(target_addrlen, addrlen);
+            if (put_user_u32(addrlen, target_addrlen)) {
+                ret = -TARGET_EFAULT;
+                goto fail;
+            }
         }
         unlock_user(host_msg, msg, len);
     } else {
+fail:
         unlock_user(host_msg, msg, 0);
     }
     return ret;
 }
 
 #ifdef TARGET_NR_socketcall
-static target_long do_socketcall(int num, target_ulong vptr)
+/* do_socketcall() Must return target values and target errnos. */
+static abi_long do_socketcall(int num, abi_ulong vptr)
 {
-    target_long ret;
-    const int n = sizeof(target_ulong);
+    abi_long ret;
+    const int n = sizeof(abi_ulong);
 
     switch(num) {
     case SOCKOP_socket:
 	{
-            int domain = tgetl(vptr);
-            int type = tgetl(vptr + n);
-            int protocol = tgetl(vptr + 2 * n);
+            int domain, type, protocol;
+
+            if (get_user_s32(domain, vptr)
+                || get_user_s32(type, vptr + n)
+                || get_user_s32(protocol, vptr + 2 * n))
+                return -TARGET_EFAULT;
+
             ret = do_socket(domain, type, protocol);
 	}
         break;
     case SOCKOP_bind:
 	{
-            int sockfd = tgetl(vptr);
-            target_ulong target_addr = tgetl(vptr + n);
-            socklen_t addrlen = tgetl(vptr + 2 * n);
+            int sockfd;
+            abi_ulong target_addr;
+            socklen_t addrlen;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_ual(target_addr, vptr + n)
+                || get_user_u32(addrlen, vptr + 2 * n))
+                return -TARGET_EFAULT;
+
             ret = do_bind(sockfd, target_addr, addrlen);
         }
         break;
     case SOCKOP_connect:
         {
-            int sockfd = tgetl(vptr);
-            target_ulong target_addr = tgetl(vptr + n);
-            socklen_t addrlen = tgetl(vptr + 2 * n);
+            int sockfd;
+            abi_ulong target_addr;
+            socklen_t addrlen;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_ual(target_addr, vptr + n)
+                || get_user_u32(addrlen, vptr + 2 * n))
+                return -TARGET_EFAULT;
+
             ret = do_connect(sockfd, target_addr, addrlen);
         }
         break;
     case SOCKOP_listen:
         {
-            int sockfd = tgetl(vptr);
-            int backlog = tgetl(vptr + n);
+            int sockfd, backlog;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_s32(backlog, vptr + n))
+                return -TARGET_EFAULT;
+
             ret = get_errno(listen(sockfd, backlog));
         }
         break;
     case SOCKOP_accept:
         {
-            int sockfd = tgetl(vptr);
-            target_ulong target_addr = tgetl(vptr + n);
-            target_ulong target_addrlen = tgetl(vptr + 2 * n);
+            int sockfd;
+            abi_ulong target_addr, target_addrlen;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_ual(target_addr, vptr + n)
+                || get_user_u32(target_addrlen, vptr + 2 * n))
+                return -TARGET_EFAULT;
+
             ret = do_accept(sockfd, target_addr, target_addrlen);
         }
         break;
     case SOCKOP_getsockname:
         {
-            int sockfd = tgetl(vptr);
-            target_ulong target_addr = tgetl(vptr + n);
-            target_ulong target_addrlen = tgetl(vptr + 2 * n);
+            int sockfd;
+            abi_ulong target_addr, target_addrlen;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_ual(target_addr, vptr + n)
+                || get_user_u32(target_addrlen, vptr + 2 * n))
+                return -TARGET_EFAULT;
+
             ret = do_getsockname(sockfd, target_addr, target_addrlen);
         }
         break;
     case SOCKOP_getpeername:
         {
-            int sockfd = tgetl(vptr);
-            target_ulong target_addr = tgetl(vptr + n);
-            target_ulong target_addrlen = tgetl(vptr + 2 * n);
+            int sockfd;
+            abi_ulong target_addr, target_addrlen;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_ual(target_addr, vptr + n)
+                || get_user_u32(target_addrlen, vptr + 2 * n))
+                return -TARGET_EFAULT;
+
             ret = do_getpeername(sockfd, target_addr, target_addrlen);
         }
         break;
     case SOCKOP_socketpair:
         {
-            int domain = tgetl(vptr);
-            int type = tgetl(vptr + n);
-            int protocol = tgetl(vptr + 2 * n);
-            target_ulong tab = tgetl(vptr + 3 * n);
+            int domain, type, protocol;
+            abi_ulong tab;
+
+            if (get_user_s32(domain, vptr)
+                || get_user_s32(type, vptr + n)
+                || get_user_s32(protocol, vptr + 2 * n)
+                || get_user_ual(tab, vptr + 3 * n))
+                return -TARGET_EFAULT;
+
             ret = do_socketpair(domain, type, protocol, tab);
         }
         break;
     case SOCKOP_send:
         {
-            int sockfd = tgetl(vptr);
-            target_ulong msg = tgetl(vptr + n);
-            size_t len = tgetl(vptr + 2 * n);
-            int flags = tgetl(vptr + 3 * n);
+            int sockfd;
+            abi_ulong msg;
+            size_t len;
+            int flags;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_ual(msg, vptr + n)
+                || get_user_ual(len, vptr + 2 * n)
+                || get_user_s32(flags, vptr + 3 * n))
+                return -TARGET_EFAULT;
+
             ret = do_sendto(sockfd, msg, len, flags, 0, 0);
         }
         break;
     case SOCKOP_recv:
         {
-            int sockfd = tgetl(vptr);
-            target_ulong msg = tgetl(vptr + n);
-            size_t len = tgetl(vptr + 2 * n);
-            int flags = tgetl(vptr + 3 * n);
+            int sockfd;
+            abi_ulong msg;
+            size_t len;
+            int flags;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_ual(msg, vptr + n)
+                || get_user_ual(len, vptr + 2 * n)
+                || get_user_s32(flags, vptr + 3 * n))
+                return -TARGET_EFAULT;
+
             ret = do_recvfrom(sockfd, msg, len, flags, 0, 0);
         }
         break;
     case SOCKOP_sendto:
         {
-            int sockfd = tgetl(vptr);
-            target_ulong msg = tgetl(vptr + n);
-            size_t len = tgetl(vptr + 2 * n);
-            int flags = tgetl(vptr + 3 * n);
-            target_ulong addr = tgetl(vptr + 4 * n);
-            socklen_t addrlen = tgetl(vptr + 5 * n);
+            int sockfd;
+            abi_ulong msg;
+            size_t len;
+            int flags;
+            abi_ulong addr;
+            socklen_t addrlen;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_ual(msg, vptr + n)
+                || get_user_ual(len, vptr + 2 * n)
+                || get_user_s32(flags, vptr + 3 * n)
+                || get_user_ual(addr, vptr + 4 * n)
+                || get_user_u32(addrlen, vptr + 5 * n))
+                return -TARGET_EFAULT;
+
             ret = do_sendto(sockfd, msg, len, flags, addr, addrlen);
         }
         break;
     case SOCKOP_recvfrom:
         {
-            int sockfd = tgetl(vptr);
-            target_ulong msg = tgetl(vptr + n);
-            size_t len = tgetl(vptr + 2 * n);
-            int flags = tgetl(vptr + 3 * n);
-            target_ulong addr = tgetl(vptr + 4 * n);
-            target_ulong addrlen = tgetl(vptr + 5 * n);
+            int sockfd;
+            abi_ulong msg;
+            size_t len;
+            int flags;
+            abi_ulong addr;
+            socklen_t addrlen;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_ual(msg, vptr + n)
+                || get_user_ual(len, vptr + 2 * n)
+                || get_user_s32(flags, vptr + 3 * n)
+                || get_user_ual(addr, vptr + 4 * n)
+                || get_user_u32(addrlen, vptr + 5 * n))
+                return -TARGET_EFAULT;
+
             ret = do_recvfrom(sockfd, msg, len, flags, addr, addrlen);
         }
         break;
     case SOCKOP_shutdown:
         {
-            int sockfd = tgetl(vptr);
-            int how = tgetl(vptr + n);
+            int sockfd, how;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_s32(how, vptr + n))
+                return -TARGET_EFAULT;
 
             ret = get_errno(shutdown(sockfd, how));
         }
@@ -1264,12 +1505,13 @@ static target_long do_socketcall(int num, target_ulong vptr)
     case SOCKOP_recvmsg:
         {
             int fd;
-            target_ulong target_msg;
+            abi_ulong target_msg;
             int flags;
 
-            fd = tgetl(vptr);
-            target_msg = tgetl(vptr + n);
-            flags = tgetl(vptr + 2 * n);
+            if (get_user_s32(fd, vptr)
+                || get_user_ual(target_msg, vptr + n)
+                || get_user_s32(flags, vptr + 2 * n))
+                return -TARGET_EFAULT;
 
             ret = do_sendrecvmsg(fd, target_msg, flags,
                                  (num == SOCKOP_sendmsg));
@@ -1277,29 +1519,43 @@ static target_long do_socketcall(int num, target_ulong vptr)
         break;
     case SOCKOP_setsockopt:
         {
-            int sockfd = tgetl(vptr);
-            int level = tgetl(vptr + n);
-            int optname = tgetl(vptr + 2 * n);
-            target_ulong optval = tgetl(vptr + 3 * n);
-            socklen_t optlen = tgetl(vptr + 4 * n);
+            int sockfd;
+            int level;
+            int optname;
+            abi_ulong optval;
+            socklen_t optlen;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_s32(level, vptr + n)
+                || get_user_s32(optname, vptr + 2 * n)
+                || get_user_ual(optval, vptr + 3 * n)
+                || get_user_u32(optlen, vptr + 4 * n))
+                return -TARGET_EFAULT;
 
             ret = do_setsockopt(sockfd, level, optname, optval, optlen);
         }
         break;
     case SOCKOP_getsockopt:
         {
-            int sockfd = tgetl(vptr);
-            int level = tgetl(vptr + n);
-            int optname = tgetl(vptr + 2 * n);
-            target_ulong optval = tgetl(vptr + 3 * n);
-            target_ulong poptlen = tgetl(vptr + 4 * n);
-
-            ret = do_getsockopt(sockfd, level, optname, optval, poptlen);
+            int sockfd;
+            int level;
+            int optname;
+            abi_ulong optval;
+            socklen_t optlen;
+
+            if (get_user_s32(sockfd, vptr)
+                || get_user_s32(level, vptr + n)
+                || get_user_s32(optname, vptr + 2 * n)
+                || get_user_ual(optval, vptr + 3 * n)
+                || get_user_u32(optlen, vptr + 4 * n))
+                return -TARGET_EFAULT;
+
+            ret = do_getsockopt(sockfd, level, optname, optval, optlen);
         }
         break;
     default:
         gemu_log("Unsupported socketcall: %d\n", num);
-        ret = -ENOSYS;
+        ret = -TARGET_ENOSYS;
         break;
     }
     return ret;
@@ -1310,44 +1566,45 @@ static target_long do_socketcall(int num, target_ulong vptr)
 #define N_SHM_REGIONS	32
 
 static struct shm_region {
-    uint32_t	start;
-    uint32_t	size;
+    abi_ulong	start;
+    abi_ulong	size;
 } shm_regions[N_SHM_REGIONS];
 
 struct target_ipc_perm
 {
-    target_long __key;
-    target_ulong uid;
-    target_ulong gid;
-    target_ulong cuid;
-    target_ulong cgid;
+    abi_long __key;
+    abi_ulong uid;
+    abi_ulong gid;
+    abi_ulong cuid;
+    abi_ulong cgid;
     unsigned short int mode;
     unsigned short int __pad1;
     unsigned short int __seq;
     unsigned short int __pad2;
-    target_ulong __unused1;
-    target_ulong __unused2;
+    abi_ulong __unused1;
+    abi_ulong __unused2;
 };
 
 struct target_semid_ds
 {
   struct target_ipc_perm sem_perm;
-  target_ulong sem_otime;
-  target_ulong __unused1;
-  target_ulong sem_ctime;
-  target_ulong __unused2;
-  target_ulong sem_nsems;
-  target_ulong __unused3;
-  target_ulong __unused4;
+  abi_ulong sem_otime;
+  abi_ulong __unused1;
+  abi_ulong sem_ctime;
+  abi_ulong __unused2;
+  abi_ulong sem_nsems;
+  abi_ulong __unused3;
+  abi_ulong __unused4;
 };
 
-static inline void target_to_host_ipc_perm(struct ipc_perm *host_ip,
-                                           target_ulong target_addr)
+static inline abi_long target_to_host_ipc_perm(struct ipc_perm *host_ip,
+                                               abi_ulong target_addr)
 {
     struct target_ipc_perm *target_ip;
     struct target_semid_ds *target_sd;
 
-    lock_user_struct(target_sd, target_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
+        return -TARGET_EFAULT;
     target_ip=&(target_sd->sem_perm);
     host_ip->__key = tswapl(target_ip->__key);
     host_ip->uid = tswapl(target_ip->uid);
@@ -1356,15 +1613,17 @@ static inline void target_to_host_ipc_perm(struct ipc_perm *host_ip,
     host_ip->cgid = tswapl(target_ip->cgid);
     host_ip->mode = tswapl(target_ip->mode);
     unlock_user_struct(target_sd, target_addr, 0);
+    return 0;
 }
 
-static inline void host_to_target_ipc_perm(target_ulong target_addr,
-                                           struct ipc_perm *host_ip)
+static inline abi_long host_to_target_ipc_perm(abi_ulong target_addr,
+                                               struct ipc_perm *host_ip)
 {
     struct target_ipc_perm *target_ip;
     struct target_semid_ds *target_sd;
 
-    lock_user_struct(target_sd, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
+        return -TARGET_EFAULT;
     target_ip = &(target_sd->sem_perm);
     target_ip->__key = tswapl(host_ip->__key);
     target_ip->uid = tswapl(host_ip->uid);
@@ -1373,32 +1632,37 @@ static inline void host_to_target_ipc_perm(target_ulong target_addr,
     target_ip->cgid = tswapl(host_ip->cgid);
     target_ip->mode = tswapl(host_ip->mode);
     unlock_user_struct(target_sd, target_addr, 1);
+    return 0;
 }
 
-static inline void target_to_host_semid_ds(struct semid_ds *host_sd,
-                                          target_ulong target_addr)
+static inline abi_long target_to_host_semid_ds(struct semid_ds *host_sd,
+                                               abi_ulong target_addr)
 {
     struct target_semid_ds *target_sd;
 
-    lock_user_struct(target_sd, target_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
+        return -TARGET_EFAULT;
     target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr);
     host_sd->sem_nsems = tswapl(target_sd->sem_nsems);
     host_sd->sem_otime = tswapl(target_sd->sem_otime);
     host_sd->sem_ctime = tswapl(target_sd->sem_ctime);
     unlock_user_struct(target_sd, target_addr, 0);
+    return 0;
 }
 
-static inline void host_to_target_semid_ds(target_ulong target_addr,
-                                           struct semid_ds *host_sd)
+static inline abi_long host_to_target_semid_ds(abi_ulong target_addr,
+                                               struct semid_ds *host_sd)
 {
     struct target_semid_ds *target_sd;
 
-    lock_user_struct(target_sd, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
+        return -TARGET_EFAULT;
     host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm));
     target_sd->sem_nsems = tswapl(host_sd->sem_nsems);
     target_sd->sem_otime = tswapl(host_sd->sem_otime);
     target_sd->sem_ctime = tswapl(host_sd->sem_ctime);
     unlock_user_struct(target_sd, target_addr, 1);
+    return 0;
 }
 
 union semun {
@@ -1409,80 +1673,88 @@ union semun {
 
 union target_semun {
 	int val;
-	target_long buf;
+	abi_long buf;
 	unsigned short int *array;
 };
 
-static inline void target_to_host_semun(int cmd,
-                                        union semun *host_su,
-                                        target_ulong target_addr,
-                                        struct semid_ds *ds)
+static inline abi_long target_to_host_semun(int cmd,
+                                            union semun *host_su,
+                                            abi_ulong target_addr,
+                                            struct semid_ds *ds)
 {
     union target_semun *target_su;
 
     switch( cmd ) {
 	case IPC_STAT:
 	case IPC_SET:
-           lock_user_struct(target_su, target_addr, 1);
+           if (!lock_user_struct(VERIFY_READ, target_su, target_addr, 1))
+               return -TARGET_EFAULT;
 	   target_to_host_semid_ds(ds,target_su->buf);
 	   host_su->buf = ds;
            unlock_user_struct(target_su, target_addr, 0);
 	   break;
 	case GETVAL:
 	case SETVAL:
-           lock_user_struct(target_su, target_addr, 1);
+           if (!lock_user_struct(VERIFY_READ, target_su, target_addr, 1))
+               return -TARGET_EFAULT;
 	   host_su->val = tswapl(target_su->val);
            unlock_user_struct(target_su, target_addr, 0);
 	   break;
 	case GETALL:
 	case SETALL:
-           lock_user_struct(target_su, target_addr, 1);
+           if (!lock_user_struct(VERIFY_READ, target_su, target_addr, 1))
+               return -TARGET_EFAULT;
 	   *host_su->array = tswap16(*target_su->array);
            unlock_user_struct(target_su, target_addr, 0);
 	   break;
 	default:
            gemu_log("semun operation not fully supported: %d\n", (int)cmd);
     }
+    return 0;
 }
 
-static inline void host_to_target_semun(int cmd,
-                                        target_ulong target_addr,
-                                        union semun *host_su,
-                                        struct semid_ds *ds)
+static inline abi_long host_to_target_semun(int cmd,
+                                            abi_ulong target_addr,
+                                            union semun *host_su,
+                                            struct semid_ds *ds)
 {
     union target_semun *target_su;
 
     switch( cmd ) {
 	case IPC_STAT:
 	case IPC_SET:
-           lock_user_struct(target_su, target_addr, 0);
+           if (lock_user_struct(VERIFY_WRITE, target_su, target_addr, 0))
+               return -TARGET_EFAULT;
 	   host_to_target_semid_ds(target_su->buf,ds);
            unlock_user_struct(target_su, target_addr, 1);
 	   break;
 	case GETVAL:
 	case SETVAL:
-           lock_user_struct(target_su, target_addr, 0);
+           if (lock_user_struct(VERIFY_WRITE, target_su, target_addr, 0))
+               return -TARGET_EFAULT;
 	   target_su->val = tswapl(host_su->val);
            unlock_user_struct(target_su, target_addr, 1);
 	   break;
 	case GETALL:
 	case SETALL:
-           lock_user_struct(target_su, target_addr, 0);
+           if (lock_user_struct(VERIFY_WRITE, target_su, target_addr, 0))
+               return -TARGET_EFAULT;
 	   *target_su->array = tswap16(*host_su->array);
            unlock_user_struct(target_su, target_addr, 1);
 	   break;
         default:
            gemu_log("semun operation not fully supported: %d\n", (int)cmd);
     }
+    return 0;
 }
 
-static inline target_long do_semctl(int first, int second, int third,
-                                    target_long ptr)
+static inline abi_long do_semctl(int first, int second, int third,
+                                 abi_long ptr)
 {
     union semun arg;
     struct semid_ds dsarg;
     int cmd = third&0xff;
-    target_long ret = 0;
+    abi_long ret = 0;
 
     switch( cmd ) {
 	case GETVAL:
@@ -1525,27 +1797,28 @@ static inline target_long do_semctl(int first, int second, int third,
 struct target_msqid_ds
 {
   struct target_ipc_perm msg_perm;
-  target_ulong msg_stime;
-  target_ulong __unused1;
-  target_ulong msg_rtime;
-  target_ulong __unused2;
-  target_ulong msg_ctime;
-  target_ulong __unused3;
-  target_ulong __msg_cbytes;
-  target_ulong msg_qnum;
-  target_ulong msg_qbytes;
-  target_ulong msg_lspid;
-  target_ulong msg_lrpid;
-  target_ulong __unused4;
-  target_ulong __unused5;
+  abi_ulong msg_stime;
+  abi_ulong __unused1;
+  abi_ulong msg_rtime;
+  abi_ulong __unused2;
+  abi_ulong msg_ctime;
+  abi_ulong __unused3;
+  abi_ulong __msg_cbytes;
+  abi_ulong msg_qnum;
+  abi_ulong msg_qbytes;
+  abi_ulong msg_lspid;
+  abi_ulong msg_lrpid;
+  abi_ulong __unused4;
+  abi_ulong __unused5;
 };
 
-static inline void target_to_host_msqid_ds(struct msqid_ds *host_md,
-                                           target_ulong target_addr)
+static inline abi_long target_to_host_msqid_ds(struct msqid_ds *host_md,
+                                               abi_ulong target_addr)
 {
     struct target_msqid_ds *target_md;
 
-    lock_user_struct(target_md, target_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_md, target_addr, 1))
+        return -TARGET_EFAULT;
     target_to_host_ipc_perm(&(host_md->msg_perm),target_addr);
     host_md->msg_stime = tswapl(target_md->msg_stime);
     host_md->msg_rtime = tswapl(target_md->msg_rtime);
@@ -1556,14 +1829,16 @@ static inline void target_to_host_msqid_ds(struct msqid_ds *host_md,
     host_md->msg_lspid = tswapl(target_md->msg_lspid);
     host_md->msg_lrpid = tswapl(target_md->msg_lrpid);
     unlock_user_struct(target_md, target_addr, 0);
+    return 0;
 }
 
-static inline void host_to_target_msqid_ds(target_ulong target_addr,
-                                           struct msqid_ds *host_md)
+static inline abi_long host_to_target_msqid_ds(abi_ulong target_addr,
+                                               struct msqid_ds *host_md)
 {
     struct target_msqid_ds *target_md;
 
-    lock_user_struct(target_md, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_md, target_addr, 0))
+        return -TARGET_EFAULT;
     host_to_target_ipc_perm(target_addr,&(host_md->msg_perm));
     target_md->msg_stime = tswapl(host_md->msg_stime);
     target_md->msg_rtime = tswapl(host_md->msg_rtime);
@@ -1574,13 +1849,14 @@ static inline void host_to_target_msqid_ds(target_ulong target_addr,
     target_md->msg_lspid = tswapl(host_md->msg_lspid);
     target_md->msg_lrpid = tswapl(host_md->msg_lrpid);
     unlock_user_struct(target_md, target_addr, 1);
+    return 0;
 }
 
-static inline target_long do_msgctl(int first, int second, target_long ptr)
+static inline abi_long do_msgctl(int first, int second, abi_long ptr)
 {
     struct msqid_ds dsarg;
     int cmd = second&0xff;
-    target_long ret = 0;
+    abi_long ret = 0;
     switch( cmd ) {
     case IPC_STAT:
     case IPC_SET:
@@ -1594,18 +1870,19 @@ static inline target_long do_msgctl(int first, int second, target_long ptr)
 }
 
 struct target_msgbuf {
-	target_ulong mtype;
+	abi_ulong mtype;
 	char	mtext[1];
 };
 
-static inline target_long do_msgsnd(int msqid, target_long msgp,
-                                    unsigned int msgsz, int msgflg)
+static inline abi_long do_msgsnd(int msqid, abi_long msgp,
+                                 unsigned int msgsz, int msgflg)
 {
     struct target_msgbuf *target_mb;
     struct msgbuf *host_mb;
-    target_long ret = 0;
+    abi_long ret = 0;
 
-    lock_user_struct(target_mb,msgp,0);
+    if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
+        return -TARGET_EFAULT;
     host_mb = malloc(msgsz+sizeof(long));
     host_mb->mtype = tswapl(target_mb->mtype);
     memcpy(host_mb->mtext,target_mb->mtext,msgsz);
@@ -1616,34 +1893,46 @@ static inline target_long do_msgsnd(int msqid, target_long msgp,
     return ret;
 }
 
-static inline target_long do_msgrcv(int msqid, target_long msgp,
-                                    unsigned int msgsz, int msgtype,
-                                    int msgflg)
+static inline abi_long do_msgrcv(int msqid, abi_long msgp,
+                                 unsigned int msgsz, int msgtype,
+                                 int msgflg)
 {
     struct target_msgbuf *target_mb;
+    char *target_mtext;
     struct msgbuf *host_mb;
-    target_long ret = 0;
+    abi_long ret = 0;
 
-    lock_user_struct(target_mb, msgp, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
+        return -TARGET_EFAULT;
     host_mb = malloc(msgsz+sizeof(long));
     ret = get_errno(msgrcv(msqid, host_mb, msgsz, 1, msgflg));
-    if (ret > 0)
+    if (ret > 0) {
+        abi_ulong target_mtext_addr = msgp + sizeof(abi_ulong);
+        target_mtext = lock_user(VERIFY_WRITE, target_mtext_addr, ret, 0);
+        if (!target_mtext) {
+            ret = -TARGET_EFAULT;
+            goto end;
+        }
     	memcpy(target_mb->mtext, host_mb->mtext, ret);
+        unlock_user(target_mtext, target_mtext_addr, ret);
+    }
     target_mb->mtype = tswapl(host_mb->mtype);
     free(host_mb);
-    unlock_user_struct(target_mb, msgp, 0);
 
+end:
+    if (target_mb)
+        unlock_user_struct(target_mb, msgp, 1);
     return ret;
 }
 
 /* ??? This only works with linear mappings.  */
-static target_long do_ipc(unsigned int call, int first,
-                          int second, int third,
-                          target_long ptr, target_long fifth)
+/* do_ipc() must return target values and target errnos. */
+static abi_long do_ipc(unsigned int call, int first,
+                       int second, int third,
+                       abi_long ptr, abi_long fifth)
 {
     int version;
-    target_long ret = 0;
-    unsigned long raddr;
+    abi_long ret = 0;
     struct shmid_ds shm_info;
     int i;
 
@@ -1652,7 +1941,7 @@ static target_long do_ipc(unsigned int call, int first,
 
     switch (call) {
     case IPCOP_semop:
-        ret = get_errno(semop(first,(struct sembuf *) ptr, second));
+        ret = get_errno(semop(first,(struct sembuf *)g2h(ptr), second));
         break;
 
     case IPCOP_semget:
@@ -1665,7 +1954,7 @@ static target_long do_ipc(unsigned int call, int first,
 
     case IPCOP_semtimedop:
         gemu_log("Unsupported ipc call: %d (version %d)\n", call, version);
-        ret = -ENOSYS;
+        ret = -TARGET_ENOSYS;
         break;
 
 	case IPCOP_msgget:
@@ -1682,13 +1971,14 @@ static target_long do_ipc(unsigned int call, int first,
 
 	case IPCOP_msgrcv:
                 {
+                      /* XXX: this code is not correct */
                       struct ipc_kludge
                       {
                               void *__unbounded msgp;
                               long int msgtyp;
                       };
 
-                      struct ipc_kludge *foo = (struct ipc_kludge *) ptr;
+                      struct ipc_kludge *foo = (struct ipc_kludge *)g2h(ptr);
                       struct msgbuf *msgp = (struct msgbuf *) foo->msgp;
 
                       ret = do_msgrcv(first, (long)msgp, second, 0, third);
@@ -1697,32 +1987,38 @@ static target_long do_ipc(unsigned int call, int first,
 		break;
 
     case IPCOP_shmat:
-	/* SHM_* flags are the same on all linux platforms */
-	ret = get_errno((long) shmat(first, (void *) ptr, second));
-        if (is_error(ret))
-            break;
-        raddr = ret;
-	/* find out the length of the shared memory segment */
-
-        ret = get_errno(shmctl(first, IPC_STAT, &shm_info));
-        if (is_error(ret)) {
-            /* can't get length, bail out */
-            shmdt((void *) raddr);
-	    break;
-	}
-	page_set_flags(raddr, raddr + shm_info.shm_segsz,
-		       PAGE_VALID | PAGE_READ |
-		       ((second & SHM_RDONLY)? 0: PAGE_WRITE));
-	for (i = 0; i < N_SHM_REGIONS; ++i) {
-	    if (shm_regions[i].start == 0) {
-		shm_regions[i].start = raddr;
-		shm_regions[i].size = shm_info.shm_segsz;
+        {
+            abi_ulong raddr;
+            void *host_addr;
+            /* SHM_* flags are the same on all linux platforms */
+            host_addr = shmat(first, (void *)g2h(ptr), second);
+            if (host_addr == (void *)-1) {
+                ret = get_errno((long)host_addr);
                 break;
-	    }
-	}
-	if (put_user(raddr, (target_ulong *)third))
-            return -EFAULT;
-        ret = 0;
+            }
+            raddr = h2g((unsigned long)host_addr);
+            /* find out the length of the shared memory segment */
+            
+            ret = get_errno(shmctl(first, IPC_STAT, &shm_info));
+            if (is_error(ret)) {
+                /* can't get length, bail out */
+                shmdt(host_addr);
+                break;
+            }
+            page_set_flags(raddr, raddr + shm_info.shm_segsz,
+                           PAGE_VALID | PAGE_READ |
+                           ((second & SHM_RDONLY)? 0: PAGE_WRITE));
+            for (i = 0; i < N_SHM_REGIONS; ++i) {
+                if (shm_regions[i].start == 0) {
+                    shm_regions[i].start = raddr;
+                    shm_regions[i].size = shm_info.shm_segsz;
+                    break;
+                }
+            }
+            if (put_user_ual(raddr, third))
+                return -TARGET_EFAULT;
+            ret = 0;
+        }
 	break;
     case IPCOP_shmdt:
 	for (i = 0; i < N_SHM_REGIONS; ++i) {
@@ -1732,7 +2028,7 @@ static target_long do_ipc(unsigned int call, int first,
 		break;
 	    }
 	}
-	ret = get_errno(shmdt((void *) ptr));
+	ret = get_errno(shmdt((void *)g2h(ptr)));
 	break;
 
     case IPCOP_shmget:
@@ -1755,7 +2051,7 @@ static target_long do_ipc(unsigned int call, int first,
     default:
     unimplemented:
 	gemu_log("Unsupported ipc call: %d (version %d)\n", call, version);
-	ret = -ENOSYS;
+	ret = -TARGET_ENOSYS;
 	break;
     }
     return ret;
@@ -1801,11 +2097,12 @@ IOCTLEntry ioctl_entries[] = {
 };
 
 /* ??? Implement proper locking for ioctls.  */
-static target_long do_ioctl(int fd, target_long cmd, target_long arg)
+/* do_ioctl() Must return target values and target errnos. */
+static abi_long do_ioctl(int fd, abi_long cmd, abi_long arg)
 {
     const IOCTLEntry *ie;
     const argtype *arg_type;
-    target_long ret;
+    abi_long ret;
     uint8_t buf_temp[MAX_STRUCT_SIZE];
     int target_size;
     void *argptr;
@@ -1814,7 +2111,7 @@ static target_long do_ioctl(int fd, target_long cmd, target_long arg)
     for(;;) {
         if (ie->target_cmd == 0) {
             gemu_log("Unsupported ioctl: cmd=0x%04lx\n", (long)cmd);
-            return -ENOSYS;
+            return -TARGET_ENOSYS;
         }
         if (ie->target_cmd == cmd)
             break;
@@ -1841,25 +2138,33 @@ static target_long do_ioctl(int fd, target_long cmd, target_long arg)
         case IOC_R:
             ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
             if (!is_error(ret)) {
-                argptr = lock_user(arg, target_size, 0);
+                argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
+                if (!argptr)
+                    return -TARGET_EFAULT;
                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
                 unlock_user(argptr, arg, target_size);
             }
             break;
         case IOC_W:
-            argptr = lock_user(arg, target_size, 1);
+            argptr = lock_user(VERIFY_READ, arg, target_size, 1);
+            if (!argptr)
+                return -TARGET_EFAULT;
             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
             unlock_user(argptr, arg, 0);
             ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
             break;
         default:
         case IOC_RW:
-            argptr = lock_user(arg, target_size, 1);
+            argptr = lock_user(VERIFY_READ, arg, target_size, 1);
+            if (!argptr)
+                return -TARGET_EFAULT;
             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
             unlock_user(argptr, arg, 0);
             ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
             if (!is_error(ret)) {
-                argptr = lock_user(arg, target_size, 0);
+                argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
+                if (!argptr)
+                    return -TARGET_EFAULT;
                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
                 unlock_user(argptr, arg, target_size);
             }
@@ -1869,7 +2174,7 @@ static target_long do_ioctl(int fd, target_long cmd, target_long arg)
     default:
         gemu_log("Unsupported ioctl type: cmd=0x%04lx type=%d\n",
                  (long)cmd, arg_type[0]);
-        ret = -ENOSYS;
+        ret = -TARGET_ENOSYS;
         break;
     }
     return ret;
@@ -2086,7 +2391,7 @@ static bitmask_transtbl fcntl_flags_tbl[] = {
 /* NOTE: there is really one LDT for all the threads */
 uint8_t *ldt_table;
 
-static int read_ldt(target_ulong ptr, unsigned long bytecount)
+static abi_long read_ldt(abi_ulong ptr, unsigned long bytecount)
 {
     int size;
     void *p;
@@ -2096,26 +2401,29 @@ static int read_ldt(target_ulong ptr, unsigned long bytecount)
     size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE;
     if (size > bytecount)
         size = bytecount;
-    p = lock_user(ptr, size, 0);
-    /* ??? Shoudl this by byteswapped?  */
+    p = lock_user(VERIFY_WRITE, ptr, size, 0);
+    if (!p)
+        return -TARGET_EFAULT;
+    /* ??? Should this by byteswapped?  */
     memcpy(p, ldt_table, size);
     unlock_user(p, ptr, size);
     return size;
 }
 
 /* XXX: add locking support */
-static int write_ldt(CPUX86State *env,
-                     target_ulong ptr, unsigned long bytecount, int oldmode)
+static abi_long write_ldt(CPUX86State *env,
+                          abi_ulong ptr, unsigned long bytecount, int oldmode)
 {
     struct target_modify_ldt_ldt_s ldt_info;
     struct target_modify_ldt_ldt_s *target_ldt_info;
     int seg_32bit, contents, read_exec_only, limit_in_pages;
-    int seg_not_present, useable;
+    int seg_not_present, useable, lm;
     uint32_t *lp, entry_1, entry_2;
 
     if (bytecount != sizeof(ldt_info))
-        return -EINVAL;
-    lock_user_struct(target_ldt_info, ptr, 1);
+        return -TARGET_EINVAL;
+    if (!lock_user_struct(VERIFY_READ, target_ldt_info, ptr, 1))
+        return -TARGET_EFAULT;
     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
     ldt_info.base_addr = tswapl(target_ldt_info->base_addr);
     ldt_info.limit = tswap32(target_ldt_info->limit);
@@ -2123,27 +2431,31 @@ static int write_ldt(CPUX86State *env,
     unlock_user_struct(target_ldt_info, ptr, 0);
 
     if (ldt_info.entry_number >= TARGET_LDT_ENTRIES)
-        return -EINVAL;
+        return -TARGET_EINVAL;
     seg_32bit = ldt_info.flags & 1;
     contents = (ldt_info.flags >> 1) & 3;
     read_exec_only = (ldt_info.flags >> 3) & 1;
     limit_in_pages = (ldt_info.flags >> 4) & 1;
     seg_not_present = (ldt_info.flags >> 5) & 1;
     useable = (ldt_info.flags >> 6) & 1;
-
+#ifdef TARGET_ABI32
+    lm = 0;
+#else
+    lm = (ldt_info.flags >> 7) & 1;
+#endif
     if (contents == 3) {
         if (oldmode)
-            return -EINVAL;
+            return -TARGET_EINVAL;
         if (seg_not_present == 0)
-            return -EINVAL;
+            return -TARGET_EINVAL;
     }
     /* allocate the LDT */
     if (!ldt_table) {
         ldt_table = malloc(TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
         if (!ldt_table)
-            return -ENOMEM;
+            return -TARGET_ENOMEM;
         memset(ldt_table, 0, TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
-        env->ldt.base = h2g(ldt_table);
+        env->ldt.base = h2g((unsigned long)ldt_table);
         env->ldt.limit = 0xffff;
     }
 
@@ -2173,6 +2485,7 @@ static int write_ldt(CPUX86State *env,
         ((seg_not_present ^ 1) << 15) |
         (seg_32bit << 22) |
         (limit_in_pages << 23) |
+        (lm << 21) |
         0x7000;
     if (!oldmode)
         entry_2 |= (useable << 20);
@@ -2186,9 +2499,10 @@ install:
 }
 
 /* specific and weird i386 syscalls */
-int do_modify_ldt(CPUX86State *env, int func, target_ulong ptr, unsigned long bytecount)
+abi_long do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr, 
+                       unsigned long bytecount)
 {
-    int ret = -ENOSYS;
+    abi_long ret;
 
     switch (func) {
     case 0:
@@ -2200,10 +2514,180 @@ int do_modify_ldt(CPUX86State *env, int func, target_ulong ptr, unsigned long by
     case 0x11:
         ret = write_ldt(env, ptr, bytecount, 0);
         break;
+    default:
+        ret = -TARGET_ENOSYS;
+        break;
     }
     return ret;
 }
 
+abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr)
+{
+    uint64_t *gdt_table = g2h(env->gdt.base);
+    struct target_modify_ldt_ldt_s ldt_info;
+    struct target_modify_ldt_ldt_s *target_ldt_info;
+    int seg_32bit, contents, read_exec_only, limit_in_pages;
+    int seg_not_present, useable, lm;
+    uint32_t *lp, entry_1, entry_2;
+    int i;
+
+    lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
+    if (!target_ldt_info)
+        return -TARGET_EFAULT;
+    ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
+    ldt_info.base_addr = tswapl(target_ldt_info->base_addr);
+    ldt_info.limit = tswap32(target_ldt_info->limit);
+    ldt_info.flags = tswap32(target_ldt_info->flags);
+    if (ldt_info.entry_number == -1) {
+        for (i=TARGET_GDT_ENTRY_TLS_MIN; i<=TARGET_GDT_ENTRY_TLS_MAX; i++) {
+            if (gdt_table[i] == 0) {
+                ldt_info.entry_number = i;
+                target_ldt_info->entry_number = tswap32(i);
+                break;
+            }
+        }
+    }
+    unlock_user_struct(target_ldt_info, ptr, 1);
+
+    if (ldt_info.entry_number < TARGET_GDT_ENTRY_TLS_MIN || 
+        ldt_info.entry_number > TARGET_GDT_ENTRY_TLS_MAX)
+           return -TARGET_EINVAL;
+    seg_32bit = ldt_info.flags & 1;
+    contents = (ldt_info.flags >> 1) & 3;
+    read_exec_only = (ldt_info.flags >> 3) & 1;
+    limit_in_pages = (ldt_info.flags >> 4) & 1;
+    seg_not_present = (ldt_info.flags >> 5) & 1;
+    useable = (ldt_info.flags >> 6) & 1;
+#ifdef TARGET_ABI32
+    lm = 0;
+#else
+    lm = (ldt_info.flags >> 7) & 1;
+#endif
+
+    if (contents == 3) {
+        if (seg_not_present == 0)
+            return -TARGET_EINVAL;
+    }
+
+    /* NOTE: same code as Linux kernel */
+    /* Allow LDTs to be cleared by the user. */
+    if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
+        if ((contents == 0             &&
+             read_exec_only == 1       &&
+             seg_32bit == 0            &&
+             limit_in_pages == 0       &&
+             seg_not_present == 1      &&
+             useable == 0 )) {
+            entry_1 = 0;
+            entry_2 = 0;
+            goto install;
+        }
+    }
+
+    entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
+        (ldt_info.limit & 0x0ffff);
+    entry_2 = (ldt_info.base_addr & 0xff000000) |
+        ((ldt_info.base_addr & 0x00ff0000) >> 16) |
+        (ldt_info.limit & 0xf0000) |
+        ((read_exec_only ^ 1) << 9) |
+        (contents << 10) |
+        ((seg_not_present ^ 1) << 15) |
+        (seg_32bit << 22) |
+        (limit_in_pages << 23) |
+        (useable << 20) |
+        (lm << 21) |
+        0x7000;
+
+    /* Install the new entry ...  */
+install:
+    lp = (uint32_t *)(gdt_table + ldt_info.entry_number);
+    lp[0] = tswap32(entry_1);
+    lp[1] = tswap32(entry_2);
+    return 0;
+}
+
+abi_long do_get_thread_area(CPUX86State *env, abi_ulong ptr)
+{
+    struct target_modify_ldt_ldt_s *target_ldt_info;
+    uint64_t *gdt_table = g2h(env->gdt.base);
+    uint32_t base_addr, limit, flags;
+    int seg_32bit, contents, read_exec_only, limit_in_pages, idx;
+    int seg_not_present, useable, lm;
+    uint32_t *lp, entry_1, entry_2;
+
+    lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
+    if (!target_ldt_info)
+        return -TARGET_EFAULT;
+    idx = tswap32(target_ldt_info->entry_number);
+    if (idx < TARGET_GDT_ENTRY_TLS_MIN ||
+        idx > TARGET_GDT_ENTRY_TLS_MAX) {
+        unlock_user_struct(target_ldt_info, ptr, 1);
+        return -TARGET_EINVAL;
+    }
+    lp = (uint32_t *)(gdt_table + idx);
+    entry_1 = tswap32(lp[0]);
+    entry_2 = tswap32(lp[1]);
+    
+    read_exec_only = ((entry_2 >> 9) & 1) ^ 1;
+    contents = (entry_2 >> 10) & 3;
+    seg_not_present = ((entry_2 >> 15) & 1) ^ 1;
+    seg_32bit = (entry_2 >> 22) & 1;
+    limit_in_pages = (entry_2 >> 23) & 1;
+    useable = (entry_2 >> 20) & 1;
+#ifdef TARGET_ABI32
+    lm = 0;
+#else
+    lm = (entry_2 >> 21) & 1;
+#endif
+    flags = (seg_32bit << 0) | (contents << 1) |
+        (read_exec_only << 3) | (limit_in_pages << 4) |
+        (seg_not_present << 5) | (useable << 6) | (lm << 7);
+    limit = (entry_1 & 0xffff) | (entry_2  & 0xf0000);
+    base_addr = (entry_1 >> 16) | 
+        (entry_2 & 0xff000000) | 
+        ((entry_2 & 0xff) << 16);
+    target_ldt_info->base_addr = tswapl(base_addr);
+    target_ldt_info->limit = tswap32(limit);
+    target_ldt_info->flags = tswap32(flags);
+    unlock_user_struct(target_ldt_info, ptr, 1);
+    return 0;
+}
+
+#ifndef TARGET_ABI32
+abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
+{
+    abi_long ret;
+    abi_ulong val;
+    int idx;
+    
+    switch(code) {
+    case TARGET_ARCH_SET_GS:
+    case TARGET_ARCH_SET_FS:
+        if (code == TARGET_ARCH_SET_GS)
+            idx = R_GS;
+        else
+            idx = R_FS;
+        cpu_x86_load_seg(env, idx, 0);
+        env->segs[idx].base = addr;
+        break;
+    case TARGET_ARCH_GET_GS:
+    case TARGET_ARCH_GET_FS:
+        if (code == TARGET_ARCH_GET_GS)
+            idx = R_GS;
+        else
+            idx = R_FS;
+        val = env->segs[idx].base;
+        if (put_user(val, addr, abi_ulong))
+            return -TARGET_EFAULT;
+        break;
+    default:
+        ret = -TARGET_EINVAL;
+        break;
+    }
+    return 0;
+}
+#endif
+
 #endif /* defined(TARGET_I386) */
 
 /* this stack is the equivalent of the kernel stack associated with a
@@ -2218,7 +2702,9 @@ static int clone_func(void *arg)
     return 0;
 }
 
-int do_fork(CPUState *env, unsigned int flags, target_ulong newsp)
+/* do_fork() Must return host values and target errnos (unlike most
+   do_*() functions). */
+int do_fork(CPUState *env, unsigned int flags, abi_ulong newsp)
 {
     int ret;
     TaskState *ts;
@@ -2286,6 +2772,10 @@ int do_fork(CPUState *env, unsigned int flags, target_ulong newsp)
             for (i = 7; i < 30; i++)
                 new_env->ir[i] = 0;
         }
+#elif defined(TARGET_CRIS)
+	if (!newsp)
+	  newsp = env->regs[14];
+	new_env->regs[14] = newsp;
 #else
 #error unsupported target CPU
 #endif
@@ -2304,26 +2794,28 @@ int do_fork(CPUState *env, unsigned int flags, target_ulong newsp)
     return ret;
 }
 
-static target_long do_fcntl(int fd, int cmd, target_ulong arg)
+static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
 {
     struct flock fl;
     struct target_flock *target_fl;
     struct flock64 fl64;
     struct target_flock64 *target_fl64;
-    target_long ret;
+    abi_long ret;
 
     switch(cmd) {
     case TARGET_F_GETLK:
-        lock_user_struct(target_fl, arg, 1);
+        if (!lock_user_struct(VERIFY_READ, target_fl, arg, 1))
+            return -TARGET_EFAULT;
         fl.l_type = tswap16(target_fl->l_type);
         fl.l_whence = tswap16(target_fl->l_whence);
         fl.l_start = tswapl(target_fl->l_start);
         fl.l_len = tswapl(target_fl->l_len);
         fl.l_pid = tswapl(target_fl->l_pid);
         unlock_user_struct(target_fl, arg, 0);
-        ret = fcntl(fd, cmd, &fl);
+        ret = get_errno(fcntl(fd, cmd, &fl));
         if (ret == 0) {
-            lock_user_struct(target_fl, arg, 0);
+            if (!lock_user_struct(VERIFY_WRITE, target_fl, arg, 0))
+                return -TARGET_EFAULT;
             target_fl->l_type = tswap16(fl.l_type);
             target_fl->l_whence = tswap16(fl.l_whence);
             target_fl->l_start = tswapl(fl.l_start);
@@ -2335,27 +2827,30 @@ static target_long do_fcntl(int fd, int cmd, target_ulong arg)
 
     case TARGET_F_SETLK:
     case TARGET_F_SETLKW:
-        lock_user_struct(target_fl, arg, 1);
+        if (!lock_user_struct(VERIFY_READ, target_fl, arg, 1))
+            return -TARGET_EFAULT;
         fl.l_type = tswap16(target_fl->l_type);
         fl.l_whence = tswap16(target_fl->l_whence);
         fl.l_start = tswapl(target_fl->l_start);
         fl.l_len = tswapl(target_fl->l_len);
         fl.l_pid = tswapl(target_fl->l_pid);
         unlock_user_struct(target_fl, arg, 0);
-        ret = fcntl(fd, cmd, &fl);
+        ret = get_errno(fcntl(fd, cmd, &fl));
         break;
 
     case TARGET_F_GETLK64:
-        lock_user_struct(target_fl64, arg, 1);
+        if (!lock_user_struct(VERIFY_READ, target_fl64, arg, 1))
+            return -TARGET_EFAULT;
         fl64.l_type = tswap16(target_fl64->l_type) >> 1;
         fl64.l_whence = tswap16(target_fl64->l_whence);
         fl64.l_start = tswapl(target_fl64->l_start);
         fl64.l_len = tswapl(target_fl64->l_len);
         fl64.l_pid = tswap16(target_fl64->l_pid);
         unlock_user_struct(target_fl64, arg, 0);
-        ret = fcntl(fd, cmd >> 1, &fl64);
+        ret = get_errno(fcntl(fd, cmd >> 1, &fl64));
         if (ret == 0) {
-            lock_user_struct(target_fl64, arg, 0);
+            if (!lock_user_struct(VERIFY_WRITE, target_fl64, arg, 0))
+                return -TARGET_EFAULT;
             target_fl64->l_type = tswap16(fl64.l_type) >> 1;
             target_fl64->l_whence = tswap16(fl64.l_whence);
             target_fl64->l_start = tswapl(fl64.l_start);
@@ -2363,30 +2858,33 @@ static target_long do_fcntl(int fd, int cmd, target_ulong arg)
             target_fl64->l_pid = tswapl(fl64.l_pid);
             unlock_user_struct(target_fl64, arg, 1);
         }
-		break;
+        break;
     case TARGET_F_SETLK64:
     case TARGET_F_SETLKW64:
-        lock_user_struct(target_fl64, arg, 1);
+        if (!lock_user_struct(VERIFY_READ, target_fl64, arg, 1))
+            return -TARGET_EFAULT;
         fl64.l_type = tswap16(target_fl64->l_type) >> 1;
         fl64.l_whence = tswap16(target_fl64->l_whence);
         fl64.l_start = tswapl(target_fl64->l_start);
         fl64.l_len = tswapl(target_fl64->l_len);
         fl64.l_pid = tswap16(target_fl64->l_pid);
         unlock_user_struct(target_fl64, arg, 0);
-		ret = fcntl(fd, cmd >> 1, &fl64);
+        ret = get_errno(fcntl(fd, cmd >> 1, &fl64));
         break;
 
     case F_GETFL:
-        ret = fcntl(fd, cmd, arg);
-        ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
+        ret = get_errno(fcntl(fd, cmd, arg));
+        if (ret >= 0) {
+            ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
+        }
         break;
 
     case F_SETFL:
-        ret = fcntl(fd, cmd, target_to_host_bitmask(arg, fcntl_flags_tbl));
+        ret = get_errno(fcntl(fd, cmd, target_to_host_bitmask(arg, fcntl_flags_tbl)));
         break;
 
     default:
-        ret = fcntl(fd, cmd, arg);
+        ret = get_errno(fcntl(fd, cmd, arg));
         break;
     }
     return ret;
@@ -2433,6 +2931,7 @@ void syscall_init(void)
     IOCTLEntry *ie;
     const argtype *arg_type;
     int size;
+    int i;
 
 #define STRUCT(name, list...) thunk_register_struct(STRUCT_ ## name, #name, struct_ ## name ## _def);
 #define STRUCT_SPECIAL(name) thunk_register_struct_direct(STRUCT_ ## name, #name, &struct_ ## name ## _def);
@@ -2458,8 +2957,14 @@ void syscall_init(void)
                               ~(TARGET_IOC_SIZEMASK << TARGET_IOC_SIZESHIFT)) |
                 (size << TARGET_IOC_SIZESHIFT);
         }
+
+        /* Build target_to_host_errno_table[] table from
+         * host_to_target_errno_table[]. */
+        for (i=0; i < ERRNO_TABLE_SIZE; i++)
+                target_to_host_errno_table[host_to_target_errno_table[i]] = i;
+
         /* automatic consistency check if same arch */
-#if defined(__i386__) && defined(TARGET_I386)
+#if defined(__i386__) && defined(TARGET_I386) && defined(TARGET_ABI32)
         if (ie->target_cmd != ie->host_cmd) {
             fprintf(stderr, "ERROR: ioctl: target=0x%x host=0x%x\n",
                     ie->target_cmd, ie->host_cmd);
@@ -2469,7 +2974,7 @@ void syscall_init(void)
     }
 }
 
-#if TARGET_LONG_BITS == 32
+#if TARGET_ABI_BITS == 32
 static inline uint64_t target_offset64(uint32_t word0, uint32_t word1)
 {
 #ifdef TARGET_WORDS_BIG_ENDIAN
@@ -2478,18 +2983,18 @@ static inline uint64_t target_offset64(uint32_t word0, uint32_t word1)
     return ((uint64_t)word1 << 32) | word0;
 #endif
 }
-#else /* TARGET_LONG_BITS == 32 */
+#else /* TARGET_ABI_BITS == 32 */
 static inline uint64_t target_offset64(uint64_t word0, uint64_t word1)
 {
     return word0;
 }
-#endif /* TARGET_LONG_BITS != 32 */
+#endif /* TARGET_ABI_BITS != 32 */
 
 #ifdef TARGET_NR_truncate64
-static inline target_long target_truncate64(void *cpu_env, const char *arg1,
-                                            target_long arg2,
-                                            target_long arg3,
-                                            target_long arg4)
+static inline abi_long target_truncate64(void *cpu_env, const char *arg1,
+                                         abi_long arg2,
+                                         abi_long arg3,
+                                         abi_long arg4)
 {
 #ifdef TARGET_ARM
     if (((CPUARMState *)cpu_env)->eabi)
@@ -2503,10 +3008,10 @@ static inline target_long target_truncate64(void *cpu_env, const char *arg1,
 #endif
 
 #ifdef TARGET_NR_ftruncate64
-static inline target_long target_ftruncate64(void *cpu_env, target_long arg1,
-                                             target_long arg2,
-                                             target_long arg3,
-                                             target_long arg4)
+static inline abi_long target_ftruncate64(void *cpu_env, abi_long arg1,
+                                          abi_long arg2,
+                                          abi_long arg3,
+                                          abi_long arg4)
 {
 #ifdef TARGET_ARM
     if (((CPUARMState *)cpu_env)->eabi)
@@ -2519,33 +3024,38 @@ static inline target_long target_ftruncate64(void *cpu_env, target_long arg1,
 }
 #endif
 
-static inline void target_to_host_timespec(struct timespec *host_ts,
-                                           target_ulong target_addr)
+static inline abi_long target_to_host_timespec(struct timespec *host_ts,
+                                               abi_ulong target_addr)
 {
     struct target_timespec *target_ts;
 
-    lock_user_struct(target_ts, target_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1))
+        return -TARGET_EFAULT;
     host_ts->tv_sec = tswapl(target_ts->tv_sec);
     host_ts->tv_nsec = tswapl(target_ts->tv_nsec);
     unlock_user_struct(target_ts, target_addr, 0);
 }
 
-static inline void host_to_target_timespec(target_ulong target_addr,
-                                           struct timespec *host_ts)
+static inline abi_long host_to_target_timespec(abi_ulong target_addr,
+                                               struct timespec *host_ts)
 {
     struct target_timespec *target_ts;
 
-    lock_user_struct(target_ts, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0))
+        return -TARGET_EFAULT;
     target_ts->tv_sec = tswapl(host_ts->tv_sec);
     target_ts->tv_nsec = tswapl(host_ts->tv_nsec);
     unlock_user_struct(target_ts, target_addr, 1);
 }
 
-target_long do_syscall(void *cpu_env, int num, target_long arg1,
-                       target_long arg2, target_long arg3, target_long arg4,
-                       target_long arg5, target_long arg6)
+/* do_syscall() should always have a single exit point at the end so
+   that actions, such as logging of syscall results, can be performed.
+   All errnos that do_syscall() returns must be -TARGET_<errcode>. */
+abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
+                    abi_long arg2, abi_long arg3, abi_long arg4,
+                    abi_long arg5, abi_long arg6)
 {
-    target_long ret;
+    abi_long ret;
     struct stat st;
     struct statfs stfs;
     void *p;
@@ -2553,6 +3063,9 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 #ifdef DEBUG
     gemu_log("syscall %d", num);
 #endif
+    if(do_strace)
+        print_syscall(num, arg1, arg2, arg3, arg4, arg5, arg6);
+
     switch(num) {
     case TARGET_NR_exit:
 #ifdef HAVE_GPROF
@@ -2564,18 +3077,20 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         ret = 0; /* avoid warning */
         break;
     case TARGET_NR_read:
-        page_unprotect_range(arg2, arg3);
-        p = lock_user(arg2, arg3, 0);
+        if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
+            goto efault;
         ret = get_errno(read(arg1, p, arg3));
         unlock_user(p, arg2, ret);
         break;
     case TARGET_NR_write:
-        p = lock_user(arg2, arg3, 1);
+        if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
+            goto efault;
         ret = get_errno(write(arg1, p, arg3));
         unlock_user(p, arg2, 0);
         break;
     case TARGET_NR_open:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(open(path(p),
                              target_to_host_bitmask(arg2, fcntl_flags_tbl),
                              arg3));
@@ -2583,20 +3098,13 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         break;
 #if defined(TARGET_NR_openat) && defined(__NR_openat)
     case TARGET_NR_openat:
-        if (!arg2) {
-            ret = -EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            ret = -EFAULT;
-        else
-            ret = get_errno(sys_openat(arg1,
-                                       path(p),
-                                       target_to_host_bitmask(arg3, fcntl_flags_tbl),
-                                       arg4));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_openat(arg1,
+                                   path(p),
+                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
+                                   arg4));
+        unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_close:
@@ -2613,14 +3121,16 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         {
             int status;
             ret = get_errno(waitpid(arg1, &status, arg3));
-            if (!is_error(ret) && arg2)
-                tput32(arg2, status);
+            if (!is_error(ret) && arg2
+                && put_user_s32(status, arg2))
+                goto efault;
         }
         break;
 #endif
 #ifdef TARGET_NR_creat /* not on alpha */
     case TARGET_NR_creat:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(creat(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -2630,111 +3140,129 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             void * p2;
             p = lock_user_string(arg1);
             p2 = lock_user_string(arg2);
-            ret = get_errno(link(p, p2));
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
+            else
+                ret = get_errno(link(p, p2));
             unlock_user(p2, arg2, 0);
             unlock_user(p, arg1, 0);
         }
         break;
 #if defined(TARGET_NR_linkat) && defined(__NR_linkat)
     case TARGET_NR_linkat:
-        if (!arg2 || !arg4) {
-            ret = -EFAULT;
-            goto fail;
-	}
         {
             void * p2 = NULL;
+            if (!arg2 || !arg4)
+                goto efault;
             p  = lock_user_string(arg2);
             p2 = lock_user_string(arg4);
-            if (!access_ok(VERIFY_READ, p, 1)
-                || !access_ok(VERIFY_READ, p2, 1))
-                ret = -EFAULT;
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
             else
                 ret = get_errno(sys_linkat(arg1, p, arg3, p2, arg5));
-            if (p2)
-                unlock_user(p, arg2, 0);
-            if (p)
-                unlock_user(p2, arg4, 0);
+            unlock_user(p, arg2, 0);
+            unlock_user(p2, arg4, 0);
         }
         break;
 #endif
     case TARGET_NR_unlink:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(unlink(p));
         unlock_user(p, arg1, 0);
         break;
 #if defined(TARGET_NR_unlinkat) && defined(__NR_unlinkat)
     case TARGET_NR_unlinkat:
-        if (!arg2) {
-            ret = -EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            ret = -EFAULT;
-        else
-            ret = get_errno(sys_unlinkat(arg1, p, arg3));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_unlinkat(arg1, p, arg3));
+        unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_execve:
         {
             char **argp, **envp;
             int argc, envc;
-            target_ulong gp;
-            target_ulong guest_argp;
-            target_ulong guest_envp;
-            target_ulong addr;
+            abi_ulong gp;
+            abi_ulong guest_argp;
+            abi_ulong guest_envp;
+            abi_ulong addr;
             char **q;
 
             argc = 0;
             guest_argp = arg2;
-            for (gp = guest_argp; tgetl(gp); gp++)
+            for (gp = guest_argp; ; gp += sizeof(abi_ulong)) {
+                if (get_user_ual(addr, gp))
+                    goto efault;
+                if (!addr)
+                    break;
                 argc++;
+            }
             envc = 0;
             guest_envp = arg3;
-            for (gp = guest_envp; tgetl(gp); gp++)
+            for (gp = guest_envp; ; gp += sizeof(abi_ulong)) {
+                if (get_user_ual(addr, gp))
+                    goto efault;
+                if (!addr)
+                    break;
                 envc++;
+            }
 
             argp = alloca((argc + 1) * sizeof(void *));
             envp = alloca((envc + 1) * sizeof(void *));
 
             for (gp = guest_argp, q = argp; ;
-                  gp += sizeof(target_ulong), q++) {
-                addr = tgetl(gp);
+                  gp += sizeof(abi_ulong), q++) {
+                if (get_user_ual(addr, gp))
+                    goto execve_efault;
                 if (!addr)
                     break;
-                *q = lock_user_string(addr);
+                if (!(*q = lock_user_string(addr)))
+                    goto execve_efault;
             }
             *q = NULL;
 
             for (gp = guest_envp, q = envp; ;
-                  gp += sizeof(target_ulong), q++) {
-                addr = tgetl(gp);
+                  gp += sizeof(abi_ulong), q++) {
+                if (get_user_ual(addr, gp))
+                    goto execve_efault;
                 if (!addr)
                     break;
-                *q = lock_user_string(addr);
+                if (!(*q = lock_user_string(addr)))
+                    goto execve_efault;
             }
             *q = NULL;
 
-            p = lock_user_string(arg1);
+            if (!(p = lock_user_string(arg1)))
+                goto execve_efault;
             ret = get_errno(execve(p, argp, envp));
             unlock_user(p, arg1, 0);
 
+            goto execve_end;
+
+        execve_efault:
+            ret = -TARGET_EFAULT;
+
+        execve_end:
             for (gp = guest_argp, q = argp; *q;
-                  gp += sizeof(target_ulong), q++) {
-                addr = tgetl(gp);
+                  gp += sizeof(abi_ulong), q++) {
+                if (get_user_ual(addr, gp)
+                    || !addr)
+                    break;
                 unlock_user(*q, addr, 0);
             }
             for (gp = guest_envp, q = envp; *q;
-                  gp += sizeof(target_ulong), q++) {
-                addr = tgetl(gp);
+                  gp += sizeof(abi_ulong), q++) {
+                if (get_user_ual(addr, gp)
+                    || !addr)
+                    break;
                 unlock_user(*q, addr, 0);
             }
         }
         break;
     case TARGET_NR_chdir:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(chdir(p));
         unlock_user(p, arg1, 0);
         break;
@@ -2743,33 +3271,30 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         {
             time_t host_time;
             ret = get_errno(time(&host_time));
-            if (!is_error(ret) && arg1)
-                tputl(arg1, host_time);
+            if (!is_error(ret)
+                && arg1
+                && put_user_sal(host_time, arg1))
+                goto efault;
         }
         break;
 #endif
     case TARGET_NR_mknod:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(mknod(p, arg2, arg3));
         unlock_user(p, arg1, 0);
         break;
 #if defined(TARGET_NR_mknodat) && defined(__NR_mknodat)
     case TARGET_NR_mknodat:
-        if (!arg2) {
-            ret = -EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            ret = -EFAULT;
-        else
-            ret = get_errno(sys_mknodat(arg1, p, arg3, arg4));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_mknodat(arg1, p, arg3, arg4));
+        unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_chmod:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(chmod(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -2798,15 +3323,23 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 			p = lock_user_string(arg1);
 			p2 = lock_user_string(arg2);
 			p3 = lock_user_string(arg3);
-			ret = get_errno(mount(p, p2, p3, (unsigned long)arg4, (const void *)arg5));
-			unlock_user(p, arg1, 0);
-			unlock_user(p2, arg2, 0);
-			unlock_user(p3, arg3, 0);
+                        if (!p || !p2 || !p3)
+                            ret = -TARGET_EFAULT;
+                        else
+                            /* FIXME - arg5 should be locked, but it isn't clear how to
+                             * do that since it's not guaranteed to be a NULL-terminated
+                             * string.
+                             */
+                            ret = get_errno(mount(p, p2, p3, (unsigned long)arg4, g2h(arg5)));
+                        unlock_user(p, arg1, 0);
+                        unlock_user(p2, arg2, 0);
+                        unlock_user(p3, arg3, 0);
 			break;
 		}
 #ifdef TARGET_NR_umount
     case TARGET_NR_umount:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(umount(p));
         unlock_user(p, arg1, 0);
         break;
@@ -2815,7 +3348,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
     case TARGET_NR_stime:
         {
             time_t host_time;
-            host_time = tgetl(arg1);
+            if (get_user_sal(host_time, arg1))
+                goto efault;
             ret = get_errno(stime(&host_time));
         }
         break;
@@ -2842,7 +3376,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             struct utimbuf tbuf, *host_tbuf;
             struct target_utimbuf *target_tbuf;
             if (arg2) {
-                lock_user_struct(target_tbuf, arg2, 1);
+                if (!lock_user_struct(VERIFY_READ, target_tbuf, arg2, 1))
+                    goto efault;
                 tbuf.actime = tswapl(target_tbuf->actime);
                 tbuf.modtime = tswapl(target_tbuf->modtime);
                 unlock_user_struct(target_tbuf, arg2, 0);
@@ -2850,7 +3385,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             } else {
                 host_tbuf = NULL;
             }
-            p = lock_user_string(arg1);
+            if (!(p = lock_user_string(arg1)))
+                goto efault;
             ret = get_errno(utime(p, host_tbuf));
             unlock_user(p, arg1, 0);
         }
@@ -2860,14 +3396,16 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         {
             struct timeval *tvp, tv[2];
             if (arg2) {
-                target_to_host_timeval(&tv[0], arg2);
-                target_to_host_timeval(&tv[1],
-                    arg2 + sizeof (struct target_timeval));
+                if (copy_from_user_timeval(&tv[0], arg2)
+                    || copy_from_user_timeval(&tv[1],
+                                              arg2 + sizeof(struct target_timeval)))
+                    goto efault;
                 tvp = tv;
             } else {
                 tvp = NULL;
             }
-            p = lock_user_string(arg1);
+            if (!(p = lock_user_string(arg1)))
+                goto efault;
             ret = get_errno(utimes(p, tvp));
             unlock_user(p, arg1, 0);
         }
@@ -2881,23 +3419,17 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         goto unimplemented;
 #endif
     case TARGET_NR_access:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(access(p, arg2));
         unlock_user(p, arg1, 0);
         break;
 #if defined(TARGET_NR_faccessat) && defined(__NR_faccessat)
     case TARGET_NR_faccessat:
-        if (!arg2) {
-            ret = -EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-    	    ret = -EFAULT;
-        else
-            ret = get_errno(sys_faccessat(arg1, p, arg3, arg4));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_faccessat(arg1, p, arg3, arg4));
+        unlock_user(p, arg2, 0);
         break;
 #endif
 #ifdef TARGET_NR_nice /* not on alpha */
@@ -2921,55 +3453,46 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             void *p2;
             p = lock_user_string(arg1);
             p2 = lock_user_string(arg2);
-            ret = get_errno(rename(p, p2));
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
+            else
+                ret = get_errno(rename(p, p2));
             unlock_user(p2, arg2, 0);
             unlock_user(p, arg1, 0);
         }
         break;
 #if defined(TARGET_NR_renameat) && defined(__NR_renameat)
     case TARGET_NR_renameat:
-        if (!arg2 || !arg4) {
-            ret = -EFAULT;
-	    goto fail;
-        }
         {
-            void *p2 = NULL;
+            void *p2;
             p  = lock_user_string(arg2);
             p2 = lock_user_string(arg4);
-            if (!access_ok(VERIFY_READ, p, 1)
-                || !access_ok(VERIFY_READ, p2, 1))
-                ret = -EFAULT;
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
             else
                 ret = get_errno(sys_renameat(arg1, p, arg3, p2));
-            if (p2)
-                unlock_user(p2, arg4, 0);
-            if (p)
-                unlock_user(p, arg2, 0);
+            unlock_user(p2, arg4, 0);
+            unlock_user(p, arg2, 0);
         }
         break;
 #endif
     case TARGET_NR_mkdir:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(mkdir(p, arg2));
         unlock_user(p, arg1, 0);
         break;
 #if defined(TARGET_NR_mkdirat) && defined(__NR_mkdirat)
     case TARGET_NR_mkdirat:
-        if (!arg2) {
-            ret = -EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            ret = -EFAULT;
-        else
-            ret = get_errno(sys_mkdirat(arg1, p, arg3));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_mkdirat(arg1, p, arg3));
+        unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_rmdir:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(rmdir(p));
         unlock_user(p, arg1, 0);
         break;
@@ -2986,8 +3509,9 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 		env->gpr[3][env->current_tc] = host_pipe[1];
 		ret = host_pipe[0];
 #else
-                tput32(arg1, host_pipe[0]);
-                tput32(arg1 + 4, host_pipe[1]);
+                if (put_user_s32(host_pipe[0], arg1)
+                    || put_user_s32(host_pipe[1], arg1 + sizeof(host_pipe[0])))
+                    goto efault;
 #endif
             }
         }
@@ -2998,7 +3522,9 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             struct tms tms;
             ret = get_errno(times(&tms));
             if (arg1) {
-                tmsp = lock_user(arg1, sizeof(struct target_tms), 0);
+                tmsp = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_tms), 0);
+                if (!tmsp)
+                    goto efault;
                 tmsp->tms_utime = tswapl(host_to_target_clock_t(tms.tms_utime));
                 tmsp->tms_stime = tswapl(host_to_target_clock_t(tms.tms_stime));
                 tmsp->tms_cutime = tswapl(host_to_target_clock_t(tms.tms_cutime));
@@ -3017,13 +3543,15 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         goto unimplemented;
 #endif
     case TARGET_NR_acct:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(acct(path(p)));
         unlock_user(p, arg1, 0);
         break;
 #ifdef TARGET_NR_umount2 /* not on alpha */
     case TARGET_NR_umount2:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(umount2(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -3036,7 +3564,7 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         ret = do_ioctl(arg1, arg2, arg3);
         break;
     case TARGET_NR_fcntl:
-        ret = get_errno(do_fcntl(arg1, arg2, arg3));
+        ret = do_fcntl(arg1, arg2, arg3);
         break;
 #ifdef TARGET_NR_mpx
     case TARGET_NR_mpx:
@@ -3057,7 +3585,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         ret = get_errno(umask(arg1));
         break;
     case TARGET_NR_chroot:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(chroot(p));
         unlock_user(p, arg1, 0);
         break;
@@ -3084,7 +3613,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             struct target_old_sigaction *old_act;
             struct target_sigaction act, oact, *pact;
             if (arg2) {
-                lock_user_struct(old_act, arg2, 1);
+                if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
+                    goto efault;
                 act._sa_handler = old_act->_sa_handler;
                 target_siginitset(&act.sa_mask, old_act->sa_mask);
                 act.sa_flags = old_act->sa_flags;
@@ -3096,7 +3626,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             }
             ret = get_errno(do_sigaction(arg1, pact, &oact));
             if (!is_error(ret) && arg3) {
-                lock_user_struct(old_act, arg3, 0);
+                if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
+                    goto efault;
                 old_act->_sa_handler = oact._sa_handler;
                 old_act->sa_mask = oact.sa_mask.sig[0];
                 old_act->sa_flags = oact.sa_flags;
@@ -3107,7 +3638,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 	    struct target_sigaction act, oact, *pact, *old_act;
 
 	    if (arg2) {
-		lock_user_struct(old_act, arg2, 1);
+                if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
+                    goto efault;
 		act._sa_handler = old_act->_sa_handler;
 		target_siginitset(&act.sa_mask, old_act->sa_mask.sig[0]);
 		act.sa_flags = old_act->sa_flags;
@@ -3120,7 +3652,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 	    ret = get_errno(do_sigaction(arg1, pact, &oact));
 
 	    if (!is_error(ret) && arg3) {
-		lock_user_struct(old_act, arg3, 0);
+                if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
+                    goto efault;
 		old_act->_sa_handler = oact._sa_handler;
 		old_act->sa_flags = oact.sa_flags;
 		old_act->sa_mask.sig[0] = oact.sa_mask.sig[0];
@@ -3138,18 +3671,23 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             struct target_sigaction *act;
             struct target_sigaction *oact;
 
-            if (arg2)
-                lock_user_struct(act, arg2, 1);
-            else
+            if (arg2) {
+                if (!lock_user_struct(VERIFY_READ, act, arg2, 1))
+                    goto efault;
+            } else
                 act = NULL;
-            if (arg3)
-                lock_user_struct(oact, arg3, 0);
-            else
+            if (arg3) {
+                if (!lock_user_struct(VERIFY_WRITE, oact, arg3, 0)) {
+                    ret = -TARGET_EFAULT;
+                    goto rt_sigaction_fail;
+                }
+            } else
                 oact = NULL;
             ret = get_errno(do_sigaction(arg1, act, oact));
-            if (arg2)
+	rt_sigaction_fail:
+            if (act)
                 unlock_user_struct(act, arg2, 0);
-            if (arg3)
+            if (oact)
                 unlock_user_struct(oact, arg3, 1);
         }
         break;
@@ -3157,7 +3695,7 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
     case TARGET_NR_sgetmask:
         {
             sigset_t cur_set;
-            target_ulong target_set;
+            abi_ulong target_set;
             sigprocmask(0, NULL, &cur_set);
             host_to_target_old_sigset(&target_set, &cur_set);
             ret = target_set;
@@ -3168,7 +3706,7 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
     case TARGET_NR_ssetmask:
         {
             sigset_t set, oset, cur_set;
-            target_ulong target_set = arg1;
+            abi_ulong target_set = arg1;
             sigprocmask(0, NULL, &cur_set);
             target_to_host_old_sigset(&set, &target_set);
             sigorset(&set, &set, &cur_set);
@@ -3196,10 +3734,11 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
                     how = SIG_SETMASK;
                     break;
                 default:
-                    ret = -EINVAL;
+                    ret = -TARGET_EINVAL;
                     goto fail;
                 }
-                p = lock_user(arg2, sizeof(target_sigset_t), 1);
+                if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
+                    goto efault;
                 target_to_host_old_sigset(&set, p);
                 unlock_user(p, arg2, 0);
                 set_ptr = &set;
@@ -3209,7 +3748,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             }
             ret = get_errno(sigprocmask(arg1, set_ptr, &oldset));
             if (!is_error(ret) && arg3) {
-                p = lock_user(arg3, sizeof(target_sigset_t), 0);
+                if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
+                    goto efault;
                 host_to_target_old_sigset(p, &oldset);
                 unlock_user(p, arg3, sizeof(target_sigset_t));
             }
@@ -3233,10 +3773,11 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
                     how = SIG_SETMASK;
                     break;
                 default:
-                    ret = -EINVAL;
+                    ret = -TARGET_EINVAL;
                     goto fail;
                 }
-                p = lock_user(arg2, sizeof(target_sigset_t), 1);
+                if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
+                    goto efault;
                 target_to_host_sigset(&set, p);
                 unlock_user(p, arg2, 0);
                 set_ptr = &set;
@@ -3246,7 +3787,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             }
             ret = get_errno(sigprocmask(how, set_ptr, &oldset));
             if (!is_error(ret) && arg3) {
-                p = lock_user(arg3, sizeof(target_sigset_t), 0);
+                if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
+                    goto efault;
                 host_to_target_sigset(p, &oldset);
                 unlock_user(p, arg3, sizeof(target_sigset_t));
             }
@@ -3258,7 +3800,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             sigset_t set;
             ret = get_errno(sigpending(&set));
             if (!is_error(ret)) {
-                p = lock_user(arg1, sizeof(target_sigset_t), 0);
+                if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
+                    goto efault;
                 host_to_target_old_sigset(p, &set);
                 unlock_user(p, arg1, sizeof(target_sigset_t));
             }
@@ -3270,7 +3813,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             sigset_t set;
             ret = get_errno(sigpending(&set));
             if (!is_error(ret)) {
-                p = lock_user(arg1, sizeof(target_sigset_t), 0);
+                if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
+                    goto efault;
                 host_to_target_sigset(p, &set);
                 unlock_user(p, arg1, sizeof(target_sigset_t));
             }
@@ -3280,7 +3824,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
     case TARGET_NR_sigsuspend:
         {
             sigset_t set;
-            p = lock_user(arg1, sizeof(target_sigset_t), 1);
+            if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
+                goto efault;
             target_to_host_old_sigset(&set, p);
             unlock_user(p, arg1, 0);
             ret = get_errno(sigsuspend(&set));
@@ -3290,7 +3835,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
     case TARGET_NR_rt_sigsuspend:
         {
             sigset_t set;
-            p = lock_user(arg1, sizeof(target_sigset_t), 1);
+            if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
+                goto efault;
             target_to_host_sigset(&set, p);
             unlock_user(p, arg1, 0);
             ret = get_errno(sigsuspend(&set));
@@ -3302,7 +3848,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             struct timespec uts, *puts;
             siginfo_t uinfo;
 
-            p = lock_user(arg1, sizeof(target_sigset_t), 1);
+            if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
+                goto efault;
             target_to_host_sigset(&set, p);
             unlock_user(p, arg1, 0);
             if (arg3) {
@@ -3313,7 +3860,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             }
             ret = get_errno(sigtimedwait(&set, &uinfo, puts));
             if (!is_error(ret) && arg2) {
-                p = lock_user(arg2, sizeof(target_sigset_t), 0);
+                if (!(p = lock_user(VERIFY_WRITE, arg2, sizeof(target_sigset_t), 0)))
+                    goto efault;
                 host_to_target_siginfo(p, &uinfo);
                 unlock_user(p, arg2, sizeof(target_sigset_t));
             }
@@ -3322,7 +3870,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
     case TARGET_NR_rt_sigqueueinfo:
         {
             siginfo_t uinfo;
-            p = lock_user(arg3, sizeof(target_sigset_t), 1);
+            if (!(p = lock_user(VERIFY_READ, arg3, sizeof(target_sigset_t), 1)))
+                goto efault;
             target_to_host_siginfo(&uinfo, p);
             unlock_user(p, arg1, 0);
             ret = get_errno(sys_rt_sigqueueinfo(arg1, arg2, &uinfo));
@@ -3339,7 +3888,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         ret = do_rt_sigreturn(cpu_env);
         break;
     case TARGET_NR_sethostname:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(sethostname(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -3349,7 +3899,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             int resource = arg1;
             struct target_rlimit *target_rlim;
             struct rlimit rlim;
-            lock_user_struct(target_rlim, arg2, 1);
+            if (!lock_user_struct(VERIFY_READ, target_rlim, arg2, 1))
+                goto efault;
             rlim.rlim_cur = tswapl(target_rlim->rlim_cur);
             rlim.rlim_max = tswapl(target_rlim->rlim_max);
             unlock_user_struct(target_rlim, arg2, 0);
@@ -3365,7 +3916,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 
             ret = get_errno(getrlimit(resource, &rlim));
             if (!is_error(ret)) {
-                lock_user_struct(target_rlim, arg2, 0);
+                if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
+                    goto efault;
                 rlim.rlim_cur = tswapl(target_rlim->rlim_cur);
                 rlim.rlim_max = tswapl(target_rlim->rlim_max);
                 unlock_user_struct(target_rlim, arg2, 1);
@@ -3386,14 +3938,16 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             struct timeval tv;
             ret = get_errno(gettimeofday(&tv, NULL));
             if (!is_error(ret)) {
-                host_to_target_timeval(arg1, &tv);
+                if (copy_to_user_timeval(arg1, &tv))
+                    goto efault;
             }
         }
         break;
     case TARGET_NR_settimeofday:
         {
             struct timeval tv;
-            target_to_host_timeval(&tv, arg1);
+            if (copy_from_user_timeval(&tv, arg1))
+                goto efault;
             ret = get_errno(settimeofday(&tv, NULL));
         }
         break;
@@ -3401,10 +3955,11 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
     case TARGET_NR_select:
         {
             struct target_sel_arg_struct *sel;
-            target_ulong inp, outp, exp, tvp;
+            abi_ulong inp, outp, exp, tvp;
             long nsel;
 
-            lock_user_struct(sel, arg1, 1);
+            if (!lock_user_struct(VERIFY_READ, sel, arg1, 1))
+                goto efault;
             nsel = tswapl(sel->n);
             inp = tswapl(sel->inp);
             outp = tswapl(sel->outp);
@@ -3420,30 +3975,26 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             void *p2;
             p = lock_user_string(arg1);
             p2 = lock_user_string(arg2);
-            ret = get_errno(symlink(p, p2));
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
+            else
+                ret = get_errno(symlink(p, p2));
             unlock_user(p2, arg2, 0);
             unlock_user(p, arg1, 0);
         }
         break;
 #if defined(TARGET_NR_symlinkat) && defined(__NR_symlinkat)
     case TARGET_NR_symlinkat:
-        if (!arg1 || !arg3) {
-            ret = -EFAULT;
-	    goto fail;
-	}
         {
-            void *p2 = NULL;
+            void *p2;
             p  = lock_user_string(arg1);
             p2 = lock_user_string(arg3);
-            if (!access_ok(VERIFY_READ, p, 1)
-                || !access_ok(VERIFY_READ, p2, 1))
-                ret = -EFAULT;
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
             else
                 ret = get_errno(sys_symlinkat(p, arg2, p2));
-            if (p2)
-                unlock_user(p2, arg3, 0);
-            if (p)
-                unlock_user(p, arg1, 0);
+            unlock_user(p2, arg3, 0);
+            unlock_user(p, arg1, 0);
         }
         break;
 #endif
@@ -3455,31 +4006,27 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         {
             void *p2;
             p = lock_user_string(arg1);
-            p2 = lock_user(arg2, arg3, 0);
-            ret = get_errno(readlink(path(p), p2, arg3));
+            p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
+            else
+                ret = get_errno(readlink(path(p), p2, arg3));
             unlock_user(p2, arg2, ret);
             unlock_user(p, arg1, 0);
         }
         break;
 #if defined(TARGET_NR_readlinkat) && defined(__NR_readlinkat)
     case TARGET_NR_readlinkat:
-        if (!arg2 || !arg3) {
-            ret = -EFAULT;
-            goto fail;
-	}
         {
-            void *p2 = NULL;
+            void *p2;
             p  = lock_user_string(arg2);
-            p2 = lock_user(arg3, arg4, 0);
-            if (!access_ok(VERIFY_READ, p, 1)
-                || !access_ok(VERIFY_READ, p2, 1))
-        	ret = -EFAULT;
+            p2 = lock_user(VERIFY_WRITE, arg3, arg4, 0);
+            if (!p || !p2)
+        	ret = -TARGET_EFAULT;
             else
                 ret = get_errno(sys_readlinkat(arg1, path(p), p2, arg4));
-            if (p2)
-                unlock_user(p2, arg3, ret);
-            if (p)
-                unlock_user(p, arg2, 0);
+            unlock_user(p2, arg3, ret);
+            unlock_user(p, arg2, 0);
         }
         break;
 #endif
@@ -3489,7 +4036,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 #endif
 #ifdef TARGET_NR_swapon
     case TARGET_NR_swapon:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(swapon(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -3502,11 +4050,12 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 #endif
 #ifdef TARGET_NR_mmap
     case TARGET_NR_mmap:
-#if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_M68K)
+#if (defined(TARGET_I386) && defined(TARGET_ABI32)) || defined(TARGET_ARM) || defined(TARGET_M68K) || defined(TARGET_CRIS)
         {
-            target_ulong *v;
-            target_ulong v1, v2, v3, v4, v5, v6;
-            v = lock_user(arg1, 6 * sizeof(target_ulong), 1);
+            abi_ulong *v;
+            abi_ulong v1, v2, v3, v4, v5, v6;
+            if (!(v = lock_user(VERIFY_READ, arg1, 6 * sizeof(abi_ulong), 1)))
+                goto efault;
             v1 = tswapl(v[0]);
             v2 = tswapl(v[1]);
             v3 = tswapl(v[2]);
@@ -3577,7 +4126,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         break;
 #endif
     case TARGET_NR_truncate:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(truncate(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -3589,21 +4139,17 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         break;
 #if defined(TARGET_NR_fchmodat) && defined(__NR_fchmodat)
     case TARGET_NR_fchmodat:
-        if (!arg2) {
-            ret = -EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            ret = -EFAULT;
-        else
-            ret = get_errno(sys_fchmodat(arg1, p, arg3, arg4));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_fchmodat(arg1, p, arg3, arg4));
+        unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_getpriority:
-        ret = get_errno(getpriority(arg1, arg2));
+        /* libc does special remapping of the return value of
+         * sys_getpriority() so it's just easiest to call
+         * sys_getpriority() directly rather than through libc. */
+        ret = sys_getpriority(arg1, arg2);
         break;
     case TARGET_NR_setpriority:
         ret = get_errno(setpriority(arg1, arg2, arg3));
@@ -3613,25 +4159,26 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         goto unimplemented;
 #endif
     case TARGET_NR_statfs:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(statfs(path(p), &stfs));
         unlock_user(p, arg1, 0);
     convert_statfs:
         if (!is_error(ret)) {
             struct target_statfs *target_stfs;
 
-            lock_user_struct(target_stfs, arg2, 0);
-            /* ??? put_user is probably wrong.  */
-            put_user(stfs.f_type, &target_stfs->f_type);
-            put_user(stfs.f_bsize, &target_stfs->f_bsize);
-            put_user(stfs.f_blocks, &target_stfs->f_blocks);
-            put_user(stfs.f_bfree, &target_stfs->f_bfree);
-            put_user(stfs.f_bavail, &target_stfs->f_bavail);
-            put_user(stfs.f_files, &target_stfs->f_files);
-            put_user(stfs.f_ffree, &target_stfs->f_ffree);
-            put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
-            put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
-            put_user(stfs.f_namelen, &target_stfs->f_namelen);
+            if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg2, 0))
+                goto efault;
+            __put_user(stfs.f_type, &target_stfs->f_type);
+            __put_user(stfs.f_bsize, &target_stfs->f_bsize);
+            __put_user(stfs.f_blocks, &target_stfs->f_blocks);
+            __put_user(stfs.f_bfree, &target_stfs->f_bfree);
+            __put_user(stfs.f_bavail, &target_stfs->f_bavail);
+            __put_user(stfs.f_files, &target_stfs->f_files);
+            __put_user(stfs.f_ffree, &target_stfs->f_ffree);
+            __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
+            __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
+            __put_user(stfs.f_namelen, &target_stfs->f_namelen);
             unlock_user_struct(target_stfs, arg2, 1);
         }
         break;
@@ -3640,26 +4187,27 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         goto convert_statfs;
 #ifdef TARGET_NR_statfs64
     case TARGET_NR_statfs64:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(statfs(path(p), &stfs));
         unlock_user(p, arg1, 0);
     convert_statfs64:
         if (!is_error(ret)) {
             struct target_statfs64 *target_stfs;
 
-            lock_user_struct(target_stfs, arg3, 0);
-            /* ??? put_user is probably wrong.  */
-            put_user(stfs.f_type, &target_stfs->f_type);
-            put_user(stfs.f_bsize, &target_stfs->f_bsize);
-            put_user(stfs.f_blocks, &target_stfs->f_blocks);
-            put_user(stfs.f_bfree, &target_stfs->f_bfree);
-            put_user(stfs.f_bavail, &target_stfs->f_bavail);
-            put_user(stfs.f_files, &target_stfs->f_files);
-            put_user(stfs.f_ffree, &target_stfs->f_ffree);
-            put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
-            put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
-            put_user(stfs.f_namelen, &target_stfs->f_namelen);
-            unlock_user_struct(target_stfs, arg3, 0);
+            if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg3, 0))
+                goto efault;
+            __put_user(stfs.f_type, &target_stfs->f_type);
+            __put_user(stfs.f_bsize, &target_stfs->f_bsize);
+            __put_user(stfs.f_blocks, &target_stfs->f_blocks);
+            __put_user(stfs.f_bfree, &target_stfs->f_bfree);
+            __put_user(stfs.f_bavail, &target_stfs->f_bavail);
+            __put_user(stfs.f_files, &target_stfs->f_files);
+            __put_user(stfs.f_ffree, &target_stfs->f_ffree);
+            __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
+            __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
+            __put_user(stfs.f_namelen, &target_stfs->f_namelen);
+            unlock_user_struct(target_stfs, arg3, 1);
         }
         break;
     case TARGET_NR_fstatfs64:
@@ -3762,7 +4310,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 #endif
 
     case TARGET_NR_syslog:
-        p = lock_user_string(arg2);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
         ret = get_errno(sys_syslog((int)arg1, p, (int)arg3));
         unlock_user(p, arg2, 0);
         break;
@@ -3773,19 +4322,20 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 
             if (arg2) {
                 pvalue = &value;
-                target_to_host_timeval(&pvalue->it_interval,
-                                       arg2);
-                target_to_host_timeval(&pvalue->it_value,
-                                       arg2 + sizeof(struct target_timeval));
+                if (copy_from_user_timeval(&pvalue->it_interval, arg2)
+                    || copy_from_user_timeval(&pvalue->it_value,
+                                              arg2 + sizeof(struct target_timeval)))
+                    goto efault;
             } else {
                 pvalue = NULL;
             }
             ret = get_errno(setitimer(arg1, pvalue, &ovalue));
             if (!is_error(ret) && arg3) {
-                host_to_target_timeval(arg3,
-                                       &ovalue.it_interval);
-                host_to_target_timeval(arg3 + sizeof(struct target_timeval),
-                                       &ovalue.it_value);
+                if (copy_to_user_timeval(arg3,
+                                         &ovalue.it_interval)
+                    || copy_to_user_timeval(arg3 + sizeof(struct target_timeval),
+                                            &ovalue.it_value))
+                    goto efault;
             }
         }
         break;
@@ -3795,20 +4345,23 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 
             ret = get_errno(getitimer(arg1, &value));
             if (!is_error(ret) && arg2) {
-                host_to_target_timeval(arg2,
-                                       &value.it_interval);
-                host_to_target_timeval(arg2 + sizeof(struct target_timeval),
-                                       &value.it_value);
+                if (copy_to_user_timeval(arg2,
+                                         &value.it_interval)
+                    || copy_to_user_timeval(arg2 + sizeof(struct target_timeval),
+                                            &value.it_value))
+                    goto efault;
             }
         }
         break;
     case TARGET_NR_stat:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(stat(path(p), &st));
         unlock_user(p, arg1, 0);
         goto do_stat;
     case TARGET_NR_lstat:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(lstat(path(p), &st));
         unlock_user(p, arg1, 0);
         goto do_stat;
@@ -3819,43 +4372,21 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             if (!is_error(ret)) {
                 struct target_stat *target_st;
 
-                lock_user_struct(target_st, arg2, 0);
-#if defined(TARGET_MIPS) || defined(TARGET_SPARC64)
-                target_st->st_dev = tswap32(st.st_dev);
-#else
-                target_st->st_dev = tswap16(st.st_dev);
-#endif
-                target_st->st_ino = tswapl(st.st_ino);
-#if defined(TARGET_PPC) || defined(TARGET_MIPS)
-                target_st->st_mode = tswapl(st.st_mode); /* XXX: check this */
-                target_st->st_uid = tswap32(st.st_uid);
-                target_st->st_gid = tswap32(st.st_gid);
-#elif defined(TARGET_SPARC64)
-                target_st->st_mode = tswap32(st.st_mode);
-                target_st->st_uid = tswap32(st.st_uid);
-                target_st->st_gid = tswap32(st.st_gid);
-#else
-                target_st->st_mode = tswap16(st.st_mode);
-                target_st->st_uid = tswap16(st.st_uid);
-                target_st->st_gid = tswap16(st.st_gid);
-#endif
-#if defined(TARGET_MIPS)
-		/* If this is the same on PPC, then just merge w/ the above ifdef */
-                target_st->st_nlink = tswapl(st.st_nlink);
-                target_st->st_rdev = tswapl(st.st_rdev);
-#elif defined(TARGET_SPARC64)
-                target_st->st_nlink = tswap32(st.st_nlink);
-                target_st->st_rdev = tswap32(st.st_rdev);
-#else
-                target_st->st_nlink = tswap16(st.st_nlink);
-                target_st->st_rdev = tswap16(st.st_rdev);
-#endif
-                target_st->st_size = tswapl(st.st_size);
-                target_st->st_blksize = tswapl(st.st_blksize);
-                target_st->st_blocks = tswapl(st.st_blocks);
-                target_st->target_st_atime = tswapl(st.st_atime);
-                target_st->target_st_mtime = tswapl(st.st_mtime);
-                target_st->target_st_ctime = tswapl(st.st_ctime);
+                if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
+                    goto efault;
+                __put_user(st.st_dev, &target_st->st_dev);
+                __put_user(st.st_ino, &target_st->st_ino);
+                __put_user(st.st_mode, &target_st->st_mode);
+                __put_user(st.st_uid, &target_st->st_uid);
+                __put_user(st.st_gid, &target_st->st_gid);
+                __put_user(st.st_nlink, &target_st->st_nlink);
+                __put_user(st.st_rdev, &target_st->st_rdev);
+                __put_user(st.st_size, &target_st->st_size);
+                __put_user(st.st_blksize, &target_st->st_blksize);
+                __put_user(st.st_blocks, &target_st->st_blocks);
+                __put_user(st.st_atime, &target_st->target_st_atime);
+                __put_user(st.st_mtime, &target_st->target_st_mtime);
+                __put_user(st.st_ctime, &target_st->target_st_ctime);
                 unlock_user_struct(target_st, arg2, 1);
             }
         }
@@ -3883,26 +4414,28 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
     case TARGET_NR_wait4:
         {
             int status;
-            target_long status_ptr = arg2;
+            abi_long status_ptr = arg2;
             struct rusage rusage, *rusage_ptr;
-            target_ulong target_rusage = arg4;
+            abi_ulong target_rusage = arg4;
             if (target_rusage)
                 rusage_ptr = &rusage;
             else
                 rusage_ptr = NULL;
             ret = get_errno(wait4(arg1, &status, arg3, rusage_ptr));
             if (!is_error(ret)) {
-                if (status_ptr)
-                    tputl(status_ptr, status);
-                if (target_rusage) {
-                    host_to_target_rusage(target_rusage, &rusage);
+                if (status_ptr) {
+                    if (put_user_s32(status, status_ptr))
+                        goto efault;
                 }
+                if (target_rusage)
+                    host_to_target_rusage(target_rusage, &rusage);
             }
         }
         break;
 #ifdef TARGET_NR_swapoff
     case TARGET_NR_swapoff:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(swapoff(p));
         unlock_user(p, arg1, 0);
         break;
@@ -3914,8 +4447,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             ret = get_errno(sysinfo(&value));
             if (!is_error(ret) && arg1)
             {
-                /* ??? __put_user is probably wrong.  */
-                lock_user_struct(target_value, arg1, 0);
+                if (!lock_user_struct(VERIFY_WRITE, target_value, arg1, 0))
+                    goto efault;
                 __put_user(value.uptime, &target_value->uptime);
                 __put_user(value.loads[0], &target_value->loads[0]);
                 __put_user(value.loads[1], &target_value->loads[1]);
@@ -3953,7 +4486,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         break;
 #endif
     case TARGET_NR_setdomainname:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(setdomainname(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -3962,7 +4496,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         {
             struct new_utsname * buf;
 
-            lock_user_struct(buf, arg1, 0);
+            if (!lock_user_struct(VERIFY_WRITE, buf, arg1, 0))
+                goto efault;
             ret = get_errno(sys_uname(buf));
             if (!is_error(ret)) {
                 /* Overrite the native machine name with whatever is being
@@ -3977,7 +4512,7 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         break;
 #ifdef TARGET_I386
     case TARGET_NR_modify_ldt:
-        ret = get_errno(do_modify_ldt(cpu_env, arg1, arg2, arg3));
+        ret = do_modify_ldt(cpu_env, arg1, arg2, arg3);
         break;
 #if !defined(TARGET_X86_64)
     case TARGET_NR_vm86old:
@@ -4026,28 +4561,31 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         {
 #if defined (__x86_64__)
             ret = get_errno(lseek(arg1, ((uint64_t )arg2 << 32) | arg3, arg5));
-            tput64(arg4, ret);
+            if (put_user_s64(ret, arg4))
+                goto efault;
 #else
             int64_t res;
             ret = get_errno(_llseek(arg1, arg2, arg3, &res, arg5));
-            tput64(arg4, res);
+            if (put_user_s64(res, arg4))
+                goto efault;
 #endif
         }
         break;
 #endif
     case TARGET_NR_getdents:
-#if TARGET_LONG_SIZE != 4
+#if TARGET_ABI_BITS != 32
         goto unimplemented;
-#warning not supported
-#elif TARGET_LONG_SIZE == 4 && HOST_LONG_SIZE == 8
+#elif TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64
         {
             struct target_dirent *target_dirp;
             struct dirent *dirp;
-            target_long count = arg3;
+            abi_long count = arg3;
 
 	    dirp = malloc(count);
-	    if (!dirp)
-                return -ENOMEM;
+	    if (!dirp) {
+                ret = -TARGET_ENOMEM;
+                goto fail;
+            }
 
             ret = get_errno(sys_getdents(arg1, dirp, count));
             if (!is_error(ret)) {
@@ -4059,15 +4597,16 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 
 		count1 = 0;
                 de = dirp;
-                target_dirp = lock_user(arg2, count, 0);
+                if (!(target_dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
+                    goto efault;
 		tde = target_dirp;
                 while (len > 0) {
                     reclen = de->d_reclen;
-		    treclen = reclen - (2 * (sizeof(long) - sizeof(target_long)));
+		    treclen = reclen - (2 * (sizeof(long) - sizeof(abi_long)));
                     tde->d_reclen = tswap16(treclen);
                     tde->d_ino = tswapl(de->d_ino);
                     tde->d_off = tswapl(de->d_off);
-		    tnamelen = treclen - (2 * sizeof(target_long) + 2);
+		    tnamelen = treclen - (2 * sizeof(abi_long) + 2);
 		    if (tnamelen > 256)
                         tnamelen = 256;
                     /* XXX: may not be correct */
@@ -4078,16 +4617,17 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 		    count1 += treclen;
                 }
 		ret = count1;
+                unlock_user(target_dirp, arg2, ret);
             }
-            unlock_user(target_dirp, arg2, ret);
 	    free(dirp);
         }
 #else
         {
             struct dirent *dirp;
-            target_long count = arg3;
+            abi_long count = arg3;
 
-            dirp = lock_user(arg2, count, 0);
+            if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
+                goto efault;
             ret = get_errno(sys_getdents(arg1, dirp, count));
             if (!is_error(ret)) {
                 struct dirent *de;
@@ -4113,8 +4653,9 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
     case TARGET_NR_getdents64:
         {
             struct dirent64 *dirp;
-            target_long count = arg3;
-            dirp = lock_user(arg2, count, 0);
+            abi_long count = arg3;
+            if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
+                goto efault;
             ret = get_errno(sys_getdents64(arg1, dirp, count));
             if (!is_error(ret)) {
                 struct dirent64 *de;
@@ -4126,8 +4667,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
                     if (reclen > len)
                         break;
                     de->d_reclen = tswap16(reclen);
-                    tswap64s(&de->d_ino);
-                    tswap64s(&de->d_off);
+                    tswap64s((uint64_t *)&de->d_ino);
+                    tswap64s((uint64_t *)&de->d_off);
                     de = (struct dirent64 *)((char *)de + reclen);
                     len -= reclen;
                 }
@@ -4150,7 +4691,9 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             struct pollfd *pfd;
             unsigned int i;
 
-            target_pfd = lock_user(arg1, sizeof(struct target_pollfd) * nfds, 1);
+            target_pfd = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_pollfd) * nfds, 1);
+            if (!target_pfd)
+                goto efault;
             pfd = alloca(sizeof(struct pollfd) * nfds);
             for(i = 0; i < nfds; i++) {
                 pfd[i].fd = tswap32(target_pfd[i].fd);
@@ -4179,7 +4722,7 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             struct iovec *vec;
 
             vec = alloca(count * sizeof(struct iovec));
-            lock_iovec(vec, arg2, count, 0);
+            lock_iovec(VERIFY_WRITE, vec, arg2, count, 0);
             ret = get_errno(readv(arg1, vec, count));
             unlock_iovec(vec, arg2, count, 1);
         }
@@ -4190,7 +4733,7 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             struct iovec *vec;
 
             vec = alloca(count * sizeof(struct iovec));
-            lock_iovec(vec, arg2, count, 1);
+            lock_iovec(VERIFY_READ, vec, arg2, count, 1);
             ret = get_errno(writev(arg1, vec, count));
             unlock_iovec(vec, arg2, count, 0);
         }
@@ -4204,15 +4747,17 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         break;
 #endif
     case TARGET_NR__sysctl:
-        /* We don't implement this, but ENODIR is always a safe
+        /* We don't implement this, but ENOTDIR is always a safe
            return value. */
-        return -ENOTDIR;
+        ret = -TARGET_ENOTDIR;
+        break;
     case TARGET_NR_sched_setparam:
         {
             struct sched_param *target_schp;
             struct sched_param schp;
 
-            lock_user_struct(target_schp, arg2, 1);
+            if (!lock_user_struct(VERIFY_READ, target_schp, arg2, 1))
+                goto efault;
             schp.sched_priority = tswap32(target_schp->sched_priority);
             unlock_user_struct(target_schp, arg2, 0);
             ret = get_errno(sched_setparam(arg1, &schp));
@@ -4224,7 +4769,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             struct sched_param schp;
             ret = get_errno(sched_getparam(arg1, &schp));
             if (!is_error(ret)) {
-                lock_user_struct(target_schp, arg2, 0);
+                if (!lock_user_struct(VERIFY_WRITE, target_schp, arg2, 0))
+                    goto efault;
                 target_schp->sched_priority = tswap32(schp.sched_priority);
                 unlock_user_struct(target_schp, arg2, 1);
             }
@@ -4234,7 +4780,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         {
             struct sched_param *target_schp;
             struct sched_param schp;
-            lock_user_struct(target_schp, arg3, 1);
+            if (!lock_user_struct(VERIFY_READ, target_schp, arg3, 1))
+                goto efault;
             schp.sched_priority = tswap32(target_schp->sched_priority);
             unlock_user_struct(target_schp, arg3, 0);
             ret = get_errno(sched_setscheduler(arg1, arg2, &schp));
@@ -4286,8 +4833,9 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
                 {
                     int deathsig;
                     ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
-                    if (!is_error(ret) && arg2)
-                        tput32(arg2, deathsig);
+                    if (!is_error(ret) && arg2
+                        && put_user_ual(deathsig, arg2))
+                        goto efault;
                 }
                 break;
             default:
@@ -4295,21 +4843,32 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
                 break;
             }
         break;
+#ifdef TARGET_NR_arch_prctl
+    case TARGET_NR_arch_prctl:
+#if defined(TARGET_I386) && !defined(TARGET_ABI32)
+        ret = do_arch_prctl(cpu_env, arg1, arg2);
+        break;
+#else
+        goto unimplemented;
+#endif
+#endif
 #ifdef TARGET_NR_pread
     case TARGET_NR_pread:
-        page_unprotect_range(arg2, arg3);
-        p = lock_user(arg2, arg3, 0);
+        if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
+            goto efault;
         ret = get_errno(pread(arg1, p, arg3, arg4));
         unlock_user(p, arg2, ret);
         break;
     case TARGET_NR_pwrite:
-        p = lock_user(arg2, arg3, 1);
+        if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
+            goto efault;
         ret = get_errno(pwrite(arg1, p, arg3, arg4));
         unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_getcwd:
-        p = lock_user(arg1, arg2, 0);
+        if (!(p = lock_user(VERIFY_WRITE, arg1, arg2, 0)))
+            goto efault;
         ret = get_errno(sys_getcwd1(p, arg2));
         unlock_user(p, arg1, ret);
         break;
@@ -4320,9 +4879,7 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
     case TARGET_NR_sigaltstack:
 #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_MIPS) || \
     defined(TARGET_SPARC) || defined(TARGET_PPC) || defined(TARGET_ALPHA)
-        ret = do_sigaltstack((struct target_sigaltstack *)arg1,
-                             (struct target_sigaltstack *)arg2,
-                             get_sp_from_cpustate((CPUState *)cpu_env));
+        ret = do_sigaltstack(arg1, arg2, get_sp_from_cpustate((CPUState *)cpu_env));
         break;
 #else
         goto unimplemented;
@@ -4349,7 +4906,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 	ret = get_errno(getrlimit(arg1, &rlim));
 	if (!is_error(ret)) {
 	    struct target_rlimit *target_rlim;
-            lock_user_struct(target_rlim, arg2, 0);
+            if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
+                goto efault;
 	    target_rlim->rlim_cur = tswapl(rlim.rlim_cur);
 	    target_rlim->rlim_max = tswapl(rlim.rlim_max);
             unlock_user_struct(target_rlim, arg2, 1);
@@ -4359,7 +4917,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 #endif
 #ifdef TARGET_NR_truncate64
     case TARGET_NR_truncate64:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
 	ret = target_truncate64(cpu_env, p, arg2, arg3, arg4);
         unlock_user(p, arg1, 0);
 	break;
@@ -4371,14 +4930,16 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 #endif
 #ifdef TARGET_NR_stat64
     case TARGET_NR_stat64:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(stat(path(p), &st));
         unlock_user(p, arg1, 0);
         goto do_stat64;
 #endif
 #ifdef TARGET_NR_lstat64
     case TARGET_NR_lstat64:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(lstat(path(p), &st));
         unlock_user(p, arg1, 0);
         goto do_stat64;
@@ -4392,52 +4953,53 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 #ifdef TARGET_ARM
                 if (((CPUARMState *)cpu_env)->eabi) {
                     struct target_eabi_stat64 *target_st;
-                    lock_user_struct(target_st, arg2, 1);
+
+                    if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
+                        goto efault;
                     memset(target_st, 0, sizeof(struct target_eabi_stat64));
-                    /* put_user is probably wrong.  */
-                    put_user(st.st_dev, &target_st->st_dev);
-                    put_user(st.st_ino, &target_st->st_ino);
+                    __put_user(st.st_dev, &target_st->st_dev);
+                    __put_user(st.st_ino, &target_st->st_ino);
 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
-                    put_user(st.st_ino, &target_st->__st_ino);
-#endif
-                    put_user(st.st_mode, &target_st->st_mode);
-                    put_user(st.st_nlink, &target_st->st_nlink);
-                    put_user(st.st_uid, &target_st->st_uid);
-                    put_user(st.st_gid, &target_st->st_gid);
-                    put_user(st.st_rdev, &target_st->st_rdev);
-                    /* XXX: better use of kernel struct */
-                    put_user(st.st_size, &target_st->st_size);
-                    put_user(st.st_blksize, &target_st->st_blksize);
-                    put_user(st.st_blocks, &target_st->st_blocks);
-                    put_user(st.st_atime, &target_st->target_st_atime);
-                    put_user(st.st_mtime, &target_st->target_st_mtime);
-                    put_user(st.st_ctime, &target_st->target_st_ctime);
-                    unlock_user_struct(target_st, arg2, 0);
+                    __put_user(st.st_ino, &target_st->__st_ino);
+#endif
+                    __put_user(st.st_mode, &target_st->st_mode);
+                    __put_user(st.st_nlink, &target_st->st_nlink);
+                    __put_user(st.st_uid, &target_st->st_uid);
+                    __put_user(st.st_gid, &target_st->st_gid);
+                    __put_user(st.st_rdev, &target_st->st_rdev);
+                    __put_user(st.st_size, &target_st->st_size);
+                    __put_user(st.st_blksize, &target_st->st_blksize);
+                    __put_user(st.st_blocks, &target_st->st_blocks);
+                    __put_user(st.st_atime, &target_st->target_st_atime);
+                    __put_user(st.st_mtime, &target_st->target_st_mtime);
+                    __put_user(st.st_ctime, &target_st->target_st_ctime);
+                    unlock_user_struct(target_st, arg2, 1);
                 } else
 #endif
                 {
                     struct target_stat64 *target_st;
-                    lock_user_struct(target_st, arg2, 1);
+
+                    if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
+                        goto efault;
                     memset(target_st, 0, sizeof(struct target_stat64));
-                    /* ??? put_user is probably wrong.  */
-                    put_user(st.st_dev, &target_st->st_dev);
-                    put_user(st.st_ino, &target_st->st_ino);
+                    __put_user(st.st_dev, &target_st->st_dev);
+                    __put_user(st.st_ino, &target_st->st_ino);
 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
-                    put_user(st.st_ino, &target_st->__st_ino);
+                    __put_user(st.st_ino, &target_st->__st_ino);
 #endif
-                    put_user(st.st_mode, &target_st->st_mode);
-                    put_user(st.st_nlink, &target_st->st_nlink);
-                    put_user(st.st_uid, &target_st->st_uid);
-                    put_user(st.st_gid, &target_st->st_gid);
-                    put_user(st.st_rdev, &target_st->st_rdev);
+                    __put_user(st.st_mode, &target_st->st_mode);
+                    __put_user(st.st_nlink, &target_st->st_nlink);
+                    __put_user(st.st_uid, &target_st->st_uid);
+                    __put_user(st.st_gid, &target_st->st_gid);
+                    __put_user(st.st_rdev, &target_st->st_rdev);
                     /* XXX: better use of kernel struct */
-                    put_user(st.st_size, &target_st->st_size);
-                    put_user(st.st_blksize, &target_st->st_blksize);
-                    put_user(st.st_blocks, &target_st->st_blocks);
-                    put_user(st.st_atime, &target_st->target_st_atime);
-                    put_user(st.st_mtime, &target_st->target_st_mtime);
-                    put_user(st.st_ctime, &target_st->target_st_ctime);
-                    unlock_user_struct(target_st, arg2, 0);
+                    __put_user(st.st_size, &target_st->st_size);
+                    __put_user(st.st_blksize, &target_st->st_blksize);
+                    __put_user(st.st_blocks, &target_st->st_blocks);
+                    __put_user(st.st_atime, &target_st->target_st_atime);
+                    __put_user(st.st_mtime, &target_st->target_st_mtime);
+                    __put_user(st.st_ctime, &target_st->target_st_ctime);
+                    unlock_user_struct(target_st, arg2, 1);
                 }
             }
         }
@@ -4445,7 +5007,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 #endif
 #ifdef USE_UID16
     case TARGET_NR_lchown:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3)));
         unlock_user(p, arg1, 0);
         break;
@@ -4477,7 +5040,9 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             grouplist = alloca(gidsetsize * sizeof(gid_t));
             ret = get_errno(getgroups(gidsetsize, grouplist));
             if (!is_error(ret)) {
-                target_grouplist = lock_user(arg2, gidsetsize * 2, 0);
+                target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 2, 0);
+                if (!target_grouplist)
+                    goto efault;
                 for(i = 0;i < gidsetsize; i++)
                     target_grouplist[i] = tswap16(grouplist[i]);
                 unlock_user(target_grouplist, arg2, gidsetsize * 2);
@@ -4492,7 +5057,11 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             int i;
 
             grouplist = alloca(gidsetsize * sizeof(gid_t));
-            target_grouplist = lock_user(arg2, gidsetsize * 2, 1);
+            target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 2, 1);
+            if (!target_grouplist) {
+                ret = -TARGET_EFAULT;
+                goto fail;
+            }
             for(i = 0;i < gidsetsize; i++)
                 grouplist[i] = tswap16(target_grouplist[i]);
             unlock_user(target_grouplist, arg2, 0);
@@ -4504,17 +5073,10 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         break;
 #if defined(TARGET_NR_fchownat) && defined(__NR_fchownat)
     case TARGET_NR_fchownat:
-        if (!arg2) {
-            ret = -EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            ret = -EFAULT;
-	else
-            ret = get_errno(sys_fchownat(arg1, p, low2highuid(arg3), low2highgid(arg4), arg5));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2))) 
+            goto efault;
+        ret = get_errno(sys_fchownat(arg1, p, low2highuid(arg3), low2highgid(arg4), arg5));
+        unlock_user(p, arg2, 0);
         break;
 #endif
 #ifdef TARGET_NR_setresuid
@@ -4530,9 +5092,10 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             uid_t ruid, euid, suid;
             ret = get_errno(getresuid(&ruid, &euid, &suid));
             if (!is_error(ret)) {
-                tput16(arg1, tswap16(high2lowuid(ruid)));
-                tput16(arg2, tswap16(high2lowuid(euid)));
-                tput16(arg3, tswap16(high2lowuid(suid)));
+                if (put_user_u16(high2lowuid(ruid), arg1)
+                    || put_user_u16(high2lowuid(euid), arg2)
+                    || put_user_u16(high2lowuid(suid), arg3))
+                    goto efault;
             }
         }
         break;
@@ -4550,15 +5113,17 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             gid_t rgid, egid, sgid;
             ret = get_errno(getresgid(&rgid, &egid, &sgid));
             if (!is_error(ret)) {
-                tput16(arg1, tswap16(high2lowgid(rgid)));
-                tput16(arg2, tswap16(high2lowgid(egid)));
-                tput16(arg3, tswap16(high2lowgid(sgid)));
+                if (put_user_u16(high2lowgid(rgid), arg1)
+                    || put_user_u16(high2lowgid(egid), arg2)
+                    || put_user_u16(high2lowgid(sgid), arg3))
+                    goto efault;
             }
         }
         break;
 #endif
     case TARGET_NR_chown:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3)));
         unlock_user(p, arg1, 0);
         break;
@@ -4578,7 +5143,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 
 #ifdef TARGET_NR_lchown32
     case TARGET_NR_lchown32:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(lchown(p, arg2, arg3));
         unlock_user(p, arg1, 0);
         break;
@@ -4624,7 +5190,11 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             grouplist = alloca(gidsetsize * sizeof(gid_t));
             ret = get_errno(getgroups(gidsetsize, grouplist));
             if (!is_error(ret)) {
-                target_grouplist = lock_user(arg2, gidsetsize * 4, 0);
+                target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 4, 0);
+                if (!target_grouplist) {
+                    ret = -TARGET_EFAULT;
+                    goto fail;
+                }
                 for(i = 0;i < gidsetsize; i++)
                     target_grouplist[i] = tswap32(grouplist[i]);
                 unlock_user(target_grouplist, arg2, gidsetsize * 4);
@@ -4641,7 +5211,11 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             int i;
 
             grouplist = alloca(gidsetsize * sizeof(gid_t));
-            target_grouplist = lock_user(arg2, gidsetsize * 4, 1);
+            target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 4, 1);
+            if (!target_grouplist) {
+                ret = -TARGET_EFAULT;
+                goto fail;
+            }
             for(i = 0;i < gidsetsize; i++)
                 grouplist[i] = tswap32(target_grouplist[i]);
             unlock_user(target_grouplist, arg2, 0);
@@ -4665,9 +5239,10 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             uid_t ruid, euid, suid;
             ret = get_errno(getresuid(&ruid, &euid, &suid));
             if (!is_error(ret)) {
-                tput32(arg1, tswap32(ruid));
-                tput32(arg2, tswap32(euid));
-                tput32(arg3, tswap32(suid));
+                if (put_user_u32(ruid, arg1)
+                    || put_user_u32(euid, arg2)
+                    || put_user_u32(suid, arg3))
+                    goto efault;
             }
         }
         break;
@@ -4683,16 +5258,18 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             gid_t rgid, egid, sgid;
             ret = get_errno(getresgid(&rgid, &egid, &sgid));
             if (!is_error(ret)) {
-                tput32(arg1, tswap32(rgid));
-                tput32(arg2, tswap32(egid));
-                tput32(arg3, tswap32(sgid));
+                if (put_user_u32(rgid, arg1)
+                    || put_user_u32(egid, arg2)
+                    || put_user_u32(sgid, arg3))
+                    goto efault;
             }
         }
         break;
 #endif
 #ifdef TARGET_NR_chown32
     case TARGET_NR_chown32:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(chown(p, arg2, arg3));
         unlock_user(p, arg1, 0);
         break;
@@ -4733,7 +5310,7 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         ret = get_errno(0);
         break;
 #endif
-#if TARGET_LONG_BITS == 32
+#if TARGET_ABI_BITS == 32
     case TARGET_NR_fcntl64:
     {
 	int cmd;
@@ -4762,7 +5339,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         case TARGET_F_GETLK64:
 #ifdef TARGET_ARM
             if (((CPUARMState *)cpu_env)->eabi) {
-                lock_user_struct(target_efl, arg3, 1);
+                if (!lock_user_struct(VERIFY_READ, target_efl, arg3, 1)) 
+                    goto efault;
                 fl.l_type = tswap16(target_efl->l_type);
                 fl.l_whence = tswap16(target_efl->l_whence);
                 fl.l_start = tswap64(target_efl->l_start);
@@ -4772,7 +5350,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             } else
 #endif
             {
-                lock_user_struct(target_fl, arg3, 1);
+                if (!lock_user_struct(VERIFY_READ, target_fl, arg3, 1)) 
+                    goto efault;
                 fl.l_type = tswap16(target_fl->l_type);
                 fl.l_whence = tswap16(target_fl->l_whence);
                 fl.l_start = tswap64(target_fl->l_start);
@@ -4784,7 +5363,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 	    if (ret == 0) {
 #ifdef TARGET_ARM
                 if (((CPUARMState *)cpu_env)->eabi) {
-                    lock_user_struct(target_efl, arg3, 0);
+                    if (!lock_user_struct(VERIFY_WRITE, target_efl, arg3, 0)) 
+                        goto efault;
                     target_efl->l_type = tswap16(fl.l_type);
                     target_efl->l_whence = tswap16(fl.l_whence);
                     target_efl->l_start = tswap64(fl.l_start);
@@ -4794,7 +5374,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
                 } else
 #endif
                 {
-                    lock_user_struct(target_fl, arg3, 0);
+                    if (!lock_user_struct(VERIFY_WRITE, target_fl, arg3, 0)) 
+                        goto efault;
                     target_fl->l_type = tswap16(fl.l_type);
                     target_fl->l_whence = tswap16(fl.l_whence);
                     target_fl->l_start = tswap64(fl.l_start);
@@ -4809,7 +5390,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
         case TARGET_F_SETLKW64:
 #ifdef TARGET_ARM
             if (((CPUARMState *)cpu_env)->eabi) {
-                lock_user_struct(target_efl, arg3, 1);
+                if (!lock_user_struct(VERIFY_READ, target_efl, arg3, 1)) 
+                    goto efault;
                 fl.l_type = tswap16(target_efl->l_type);
                 fl.l_whence = tswap16(target_efl->l_whence);
                 fl.l_start = tswap64(target_efl->l_start);
@@ -4819,7 +5401,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             } else
 #endif
             {
-                lock_user_struct(target_fl, arg3, 1);
+                if (!lock_user_struct(VERIFY_READ, target_fl, arg3, 1)) 
+                    goto efault;
                 fl.l_type = tswap16(target_fl->l_type);
                 fl.l_whence = tswap16(target_fl->l_whence);
                 fl.l_start = tswap64(target_fl->l_start);
@@ -4830,7 +5413,7 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             ret = get_errno(fcntl(arg1, cmd, &fl));
 	    break;
         default:
-            ret = get_errno(do_fcntl(arg1, cmd, arg3));
+            ret = do_fcntl(arg1, cmd, arg3);
             break;
         }
 	break;
@@ -4875,18 +5458,25 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 #endif
 #ifdef TARGET_NR_set_thread_area
     case TARGET_NR_set_thread_area:
-#ifdef TARGET_MIPS
+#if defined(TARGET_MIPS)
       ((CPUMIPSState *) cpu_env)->tls_value = arg1;
       ret = 0;
       break;
+#elif defined(TARGET_I386) && defined(TARGET_ABI32)
+      ret = do_set_thread_area(cpu_env, arg1);
+      break;
 #else
       goto unimplemented_nowarn;
 #endif
 #endif
 #ifdef TARGET_NR_get_thread_area
     case TARGET_NR_get_thread_area:
+#if defined(TARGET_I386) && defined(TARGET_ABI32)
+        ret = do_get_thread_area(cpu_env, arg1);
+#else
         goto unimplemented_nowarn;
 #endif
+#endif
 #ifdef TARGET_NR_getdomainname
     case TARGET_NR_getdomainname:
         goto unimplemented_nowarn;
@@ -4917,8 +5507,8 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 
 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
     case TARGET_NR_set_tid_address:
-      ret = get_errno(set_tid_address((int *) arg1));
-      break;
+        ret = get_errno(set_tid_address((int *)g2h(arg1)));
+        break;
 #endif
 
 #if defined(TARGET_NR_tkill) && defined(__NR_tkill)
@@ -4947,13 +5537,12 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
             if (!arg2)
                 ret = get_errno(sys_utimensat(arg1, NULL, ts, arg4));
             else {
-                p = lock_user_string(arg2);
-                if (!access_ok(VERIFY_READ, p, 1))
-                    ret = -EFAULT;
-                else
-                    ret = get_errno(sys_utimensat(arg1, path(p), ts, arg4));
-                if (p)
-                    unlock_user(p, arg2, 0);
+                if (!(p = lock_user_string(arg2))) {
+                    ret = -TARGET_EFAULT;
+                    goto fail;
+                }
+                ret = get_errno(sys_utimensat(arg1, path(p), ts, arg4));
+                unlock_user(p, arg2, 0);
             }
         }
 	break;
@@ -4965,12 +5554,17 @@ target_long do_syscall(void *cpu_env, int num, target_long arg1,
 #if defined(TARGET_NR_setxattr) || defined(TARGET_NR_get_thread_area) || defined(TARGET_NR_getdomainname) || defined(TARGET_NR_set_robust_list)
     unimplemented_nowarn:
 #endif
-        ret = -ENOSYS;
+        ret = -TARGET_ENOSYS;
         break;
     }
- fail:
+fail:
 #ifdef DEBUG
     gemu_log(" = %ld\n", ret);
 #endif
+    if(do_strace)
+        print_syscall_ret(num, ret);
     return ret;
+efault:
+    ret = -TARGET_EFAULT;
+    goto fail;
 }
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 90bea9b70..de4691223 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -49,7 +49,7 @@
 #define TARGET_IOC_TYPEBITS	8
 
 #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SH4) \
-    || defined(TARGET_M68K) || defined(TARGET_ALPHA)
+    || defined(TARGET_M68K) || defined(TARGET_ALPHA) || defined(TARGET_CRIS)
 
 #define TARGET_IOC_SIZEBITS	14
 #define TARGET_IOC_DIRBITS	2
@@ -105,13 +105,13 @@ struct target_sockaddr {
 };
 
 struct target_timeval {
-    target_long tv_sec;
-    target_long tv_usec;
+    abi_long tv_sec;
+    abi_long tv_usec;
 };
 
 struct target_timespec {
-    target_long tv_sec;
-    target_long tv_nsec;
+    abi_long tv_sec;
+    abi_long tv_nsec;
 };
 
 struct target_itimerval {
@@ -119,7 +119,7 @@ struct target_itimerval {
     struct target_timeval it_value;
 };
 
-typedef target_long target_clock_t;
+typedef abi_long target_clock_t;
 
 #define TARGET_HZ 100
 
@@ -131,44 +131,41 @@ struct target_tms {
 };
 
 struct target_utimbuf {
-    target_long actime;
-    target_long modtime;
+    abi_long actime;
+    abi_long modtime;
 };
 
 struct target_sel_arg_struct {
-    target_long n;
-    target_long inp, outp, exp;
-    target_long tvp;
+    abi_long n;
+    abi_long inp, outp, exp;
+    abi_long tvp;
 };
 
 struct target_iovec {
-    target_long iov_base;   /* Starting address */
-    target_long iov_len;   /* Number of bytes */
+    abi_long iov_base;   /* Starting address */
+    abi_long iov_len;   /* Number of bytes */
 };
 
 struct target_msghdr {
-    target_long	 msg_name;	/* Socket name			*/
-    int		 msg_namelen;	/* Length of name		*/
-    target_long	 msg_iov;	/* Data blocks			*/
-    target_long	 msg_iovlen;	/* Number of blocks		*/
-    target_long  msg_control;	/* Per protocol magic (eg BSD file descriptor passing) */
-    target_long	 msg_controllen;	/* Length of cmsg list */
+    abi_long	 msg_name;	 /* Socket name			*/
+    int		 msg_namelen;	 /* Length of name		*/
+    abi_long	 msg_iov;	 /* Data blocks			*/
+    abi_long	 msg_iovlen;	 /* Number of blocks		*/
+    abi_long     msg_control;	 /* Per protocol magic (eg BSD file descriptor passing) */
+    abi_long	 msg_controllen; /* Length of cmsg list */
     unsigned int msg_flags;
 };
 
 struct target_cmsghdr {
-    target_long  cmsg_len;
+    abi_long     cmsg_len;
     int          cmsg_level;
     int          cmsg_type;
 };
 
 #define TARGET_CMSG_DATA(cmsg) ((unsigned char *) ((struct target_cmsghdr *) (cmsg) + 1))
 #define TARGET_CMSG_NXTHDR(mhdr, cmsg) __target_cmsg_nxthdr (mhdr, cmsg)
-#define TARGET_CMSG_FIRSTHDR(mhdr) \
-  ((size_t) tswapl((mhdr)->msg_controllen) >= sizeof (struct target_cmsghdr) \
-   ? (struct target_cmsghdr *) tswapl((mhdr)->msg_control) : (struct target_cmsghdr *) NULL)
-#define TARGET_CMSG_ALIGN(len) (((len) + sizeof (target_long) - 1) \
-                               & (size_t) ~(sizeof (target_long) - 1))
+#define TARGET_CMSG_ALIGN(len) (((len) + sizeof (abi_long) - 1) \
+                               & (size_t) ~(sizeof (abi_long) - 1))
 #define TARGET_CMSG_SPACE(len) (TARGET_CMSG_ALIGN (len) \
                                + TARGET_CMSG_ALIGN (sizeof (struct target_cmsghdr)))
 #define TARGET_CMSG_LEN(len)   (TARGET_CMSG_ALIGN (sizeof (struct target_cmsghdr)) + (len))
@@ -191,20 +188,20 @@ __target_cmsg_nxthdr (struct target_msghdr *__mhdr, struct target_cmsghdr *__cms
 struct  target_rusage {
         struct target_timeval ru_utime;        /* user time used */
         struct target_timeval ru_stime;        /* system time used */
-        target_long    ru_maxrss;              /* maximum resident set size */
-        target_long    ru_ixrss;               /* integral shared memory size */
-        target_long    ru_idrss;               /* integral unshared data size */
-        target_long    ru_isrss;               /* integral unshared stack size */
-        target_long    ru_minflt;              /* page reclaims */
-        target_long    ru_majflt;              /* page faults */
-        target_long    ru_nswap;               /* swaps */
-        target_long    ru_inblock;             /* block input operations */
-        target_long    ru_oublock;             /* block output operations */
-        target_long    ru_msgsnd;              /* messages sent */
-        target_long    ru_msgrcv;              /* messages received */
-        target_long    ru_nsignals;            /* signals received */
-        target_long    ru_nvcsw;               /* voluntary context switches */
-        target_long    ru_nivcsw;              /* involuntary " */
+        abi_long    ru_maxrss;                 /* maximum resident set size */
+        abi_long    ru_ixrss;                  /* integral shared memory size */
+        abi_long    ru_idrss;                  /* integral unshared data size */
+        abi_long    ru_isrss;                  /* integral unshared stack size */
+        abi_long    ru_minflt;                 /* page reclaims */
+        abi_long    ru_majflt;                 /* page faults */
+        abi_long    ru_nswap;                  /* swaps */
+        abi_long    ru_inblock;                /* block input operations */
+        abi_long    ru_oublock;                /* block output operations */
+        abi_long    ru_msgsnd;                 /* messages sent */
+        abi_long    ru_msgrcv;                 /* messages received */
+        abi_long    ru_nsignals;               /* signals received */
+        abi_long    ru_nvcsw;                  /* voluntary context switches */
+        abi_long    ru_nivcsw;                 /* involuntary " */
 };
 
 typedef struct {
@@ -225,8 +222,8 @@ struct kernel_statfs {
 };
 
 struct target_dirent {
-	target_long	d_ino;
-	target_long	d_off;
+	abi_long	d_ino;
+	abi_long	d_off;
 	unsigned short	d_reclen;
 	char		d_name[256]; /* We must not include limits.h! */
 };
@@ -241,20 +238,20 @@ struct target_dirent64 {
 
 
 /* mostly generic signal stuff */
-#define TARGET_SIG_DFL	((target_long)0)	/* default signal handling */
-#define TARGET_SIG_IGN	((target_long)1)	/* ignore signal */
-#define TARGET_SIG_ERR	((target_long)-1)	/* error return from signal */
+#define TARGET_SIG_DFL	((abi_long)0)	/* default signal handling */
+#define TARGET_SIG_IGN	((abi_long)1)	/* ignore signal */
+#define TARGET_SIG_ERR	((abi_long)-1)	/* error return from signal */
 
 #ifdef TARGET_MIPS
 #define TARGET_NSIG	   128
 #else
 #define TARGET_NSIG	   64
 #endif
-#define TARGET_NSIG_BPW	   TARGET_LONG_BITS
+#define TARGET_NSIG_BPW	   TARGET_ABI_BITS
 #define TARGET_NSIG_WORDS  (TARGET_NSIG / TARGET_NSIG_BPW)
 
 typedef struct {
-    target_ulong sig[TARGET_NSIG_WORDS];
+    abi_ulong sig[TARGET_NSIG_WORDS];
 } target_sigset_t;
 
 #ifdef BSWAP_NEEDED
@@ -271,7 +268,7 @@ static inline void tswap_sigset(target_sigset_t *d, const target_sigset_t *s)
 }
 #endif
 
-static inline void target_siginitset(target_sigset_t *d, target_ulong set)
+static inline void target_siginitset(target_sigset_t *d, abi_ulong set)
 {
     int i;
     d->sig[0] = set;
@@ -281,15 +278,15 @@ static inline void target_siginitset(target_sigset_t *d, target_ulong set)
 
 void host_to_target_sigset(target_sigset_t *d, const sigset_t *s);
 void target_to_host_sigset(sigset_t *d, const target_sigset_t *s);
-void host_to_target_old_sigset(target_ulong *old_sigset,
+void host_to_target_old_sigset(abi_ulong *old_sigset,
                                const sigset_t *sigset);
 void target_to_host_old_sigset(sigset_t *sigset,
-                               const target_ulong *old_sigset);
+                               const abi_ulong *old_sigset);
 struct target_sigaction;
 int do_sigaction(int sig, const struct target_sigaction *act,
                  struct target_sigaction *oact);
 
-#if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SPARC) || defined(TARGET_PPC) || defined(TARGET_MIPS) || defined (TARGET_SH4) || defined(TARGET_M68K) || defined(TARGET_ALPHA)
+#if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SPARC) || defined(TARGET_PPC) || defined(TARGET_MIPS) || defined (TARGET_SH4) || defined(TARGET_M68K) || defined(TARGET_ALPHA) || defined(TARGET_CRIS)
 
 #if defined(TARGET_SPARC)
 #define TARGET_SA_NOCLDSTOP    8u
@@ -307,8 +304,8 @@ int do_sigaction(int sig, const struct target_sigaction *act,
 #define TARGET_SA_NODEFER	0x40000000
 #define TARGET_SA_RESTART	0x10000000
 #define TARGET_SA_RESETHAND	0x80000000
-#if !defined(TARGET_MIPSN32) && !defined(TARGET_MIPS64)
-#define TARGET_SA_RESTORER	0x04000000	/* Only for o32 */
+#if !defined(TARGET_ABI_MIPSN32) && !defined(TARGET_ABI_MIPSN64)
+#define TARGET_SA_RESTORER	0x04000000	/* Only for O32 */
 #endif
 #else
 #define TARGET_SA_NOCLDSTOP	0x00000001
@@ -450,43 +447,43 @@ int do_sigaction(int sig, const struct target_sigaction *act,
 
 struct target_sigaction {
 	uint32_t	sa_flags;
-#if defined(TARGET_MIPSN32)
+#if defined(TARGET_ABI_MIPSN32)
 	uint32_t	_sa_handler;
 #else
-	target_ulong	_sa_handler;
+	abi_ulong	_sa_handler;
 #endif
 	target_sigset_t	sa_mask;
 };
 
 #else
 struct target_old_sigaction {
-        target_ulong _sa_handler;
-        target_ulong sa_mask;
-        target_ulong sa_flags;
-        target_ulong sa_restorer;
+        abi_ulong _sa_handler;
+        abi_ulong sa_mask;
+        abi_ulong sa_flags;
+        abi_ulong sa_restorer;
 };
 
 struct target_sigaction {
-        target_ulong _sa_handler;
-        target_ulong sa_flags;
-        target_ulong sa_restorer;
+        abi_ulong _sa_handler;
+        abi_ulong sa_flags;
+        abi_ulong sa_restorer;
         target_sigset_t sa_mask;
 };
 #endif
 
 typedef union target_sigval {
 	int sival_int;
-        target_ulong sival_ptr;
+        abi_ulong sival_ptr;
 } target_sigval_t;
 #if 0
 #if defined (TARGET_SPARC)
 typedef struct {
 	struct {
-		target_ulong psr;
-		target_ulong pc;
-		target_ulong npc;
-		target_ulong y;
-		target_ulong u_regs[16]; /* globals and ins */
+		abi_ulong psr;
+		abi_ulong pc;
+		abi_ulong npc;
+		abi_ulong y;
+		abi_ulong u_regs[16]; /* globals and ins */
 	}		si_regs;
 	int		si_mask;
 } __siginfo_t;
@@ -544,7 +541,7 @@ typedef struct target_siginfo {
 
 		/* SIGILL, SIGFPE, SIGSEGV, SIGBUS */
 		struct {
-			target_ulong _addr; /* faulting insn/memory ref. */
+			abi_ulong _addr; /* faulting insn/memory ref. */
 		} _sigfault;
 
 		/* SIGPOLL */
@@ -614,8 +611,8 @@ typedef struct target_siginfo {
 #endif /* defined(TARGET_I386) || defined(TARGET_ARM) */
 
 struct target_rlimit {
-        target_ulong   rlim_cur;
-        target_ulong   rlim_max;
+        abi_ulong   rlim_cur;
+        abi_ulong   rlim_max;
 };
 
 struct target_pollfd {
@@ -884,28 +881,28 @@ struct target_winsize {
 #define TARGET_MAP_NONBLOCK	0x10000		/* do not block on IO */
 #endif
 
-#if defined(TARGET_I386) || defined(TARGET_ARM)
+#if (defined(TARGET_I386) && defined(TARGET_ABI32)) || defined(TARGET_ARM) || defined(TARGET_CRIS)
 struct target_stat {
 	unsigned short st_dev;
 	unsigned short __pad1;
-	target_ulong st_ino;
+	abi_ulong st_ino;
 	unsigned short st_mode;
 	unsigned short st_nlink;
 	unsigned short st_uid;
 	unsigned short st_gid;
 	unsigned short st_rdev;
 	unsigned short __pad2;
-	target_ulong  st_size;
-	target_ulong  st_blksize;
-	target_ulong  st_blocks;
-	target_ulong  target_st_atime;
-	target_ulong  __unused1;
-	target_ulong  target_st_mtime;
-	target_ulong  __unused2;
-	target_ulong  target_st_ctime;
-	target_ulong  __unused3;
-	target_ulong  __unused4;
-	target_ulong  __unused5;
+	abi_ulong  st_size;
+	abi_ulong  st_blksize;
+	abi_ulong  st_blocks;
+	abi_ulong  target_st_atime;
+	abi_ulong  __unused1;
+	abi_ulong  target_st_mtime;
+	abi_ulong  __unused2;
+	abi_ulong  target_st_ctime;
+	abi_ulong  __unused3;
+	abi_ulong  __unused4;
+	abi_ulong  __unused5;
 };
 
 /* This matches struct stat64 in glibc2.1, hence the absolutely
@@ -916,31 +913,31 @@ struct target_stat64 {
 	unsigned char	__pad0[10];
 
 #define TARGET_STAT64_HAS_BROKEN_ST_INO	1
-	target_ulong	__st_ino;
+	abi_ulong	__st_ino;
 
 	unsigned int	st_mode;
 	unsigned int	st_nlink;
 
-	target_ulong	st_uid;
-	target_ulong	st_gid;
+	abi_ulong	st_uid;
+	abi_ulong	st_gid;
 
 	unsigned short	st_rdev;
 	unsigned char	__pad3[10];
 
 	long long	st_size;
-	target_ulong	st_blksize;
+	abi_ulong	st_blksize;
 
-	target_ulong	st_blocks;	/* Number 512-byte blocks allocated. */
-	target_ulong	__pad4;		/* future possible st_blocks high bits */
+	abi_ulong	st_blocks;	/* Number 512-byte blocks allocated. */
+	abi_ulong	__pad4;		/* future possible st_blocks high bits */
 
-	target_ulong	target_st_atime;
-	target_ulong	__pad5;
+	abi_ulong	target_st_atime;
+	abi_ulong	__pad5;
 
-	target_ulong	target_st_mtime;
-	target_ulong	__pad6;
+	abi_ulong	target_st_mtime;
+	abi_ulong	__pad6;
 
-	target_ulong	target_st_ctime;
-	target_ulong	__pad7;		/* will be high 32 bits of ctime someday */
+	abi_ulong	target_st_ctime;
+	abi_ulong	__pad7;		/* will be high 32 bits of ctime someday */
 
 	unsigned long long	st_ino;
 } __attribute__((packed));
@@ -949,50 +946,50 @@ struct target_stat64 {
 struct target_eabi_stat64 {
         unsigned long long st_dev;
         unsigned int    __pad1;
-        target_ulong    __st_ino;
+        abi_ulong    __st_ino;
         unsigned int    st_mode;
         unsigned int    st_nlink;
 
-        target_ulong    st_uid;
-        target_ulong    st_gid;
+        abi_ulong    st_uid;
+        abi_ulong    st_gid;
 
         unsigned long long st_rdev;
         unsigned int    __pad2[2];
 
         long long       st_size;
-        target_ulong    st_blksize;
+        abi_ulong    st_blksize;
         unsigned int    __pad3;
         unsigned long long st_blocks;
 
-        target_ulong    target_st_atime;
-        target_ulong    target_st_atime_nsec;
+        abi_ulong    target_st_atime;
+        abi_ulong    target_st_atime_nsec;
 
-        target_ulong    target_st_mtime;
-        target_ulong    target_st_mtime_nsec;
+        abi_ulong    target_st_mtime;
+        abi_ulong    target_st_mtime_nsec;
 
-        target_ulong    target_st_ctime;
-        target_ulong    target_st_ctime_nsec;
+        abi_ulong    target_st_ctime;
+        abi_ulong    target_st_ctime_nsec;
 
         unsigned long long st_ino;
 } __attribute__ ((packed));
 #endif
 
-#elif defined(TARGET_SPARC64)
+#elif defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 struct target_stat {
 	unsigned int	st_dev;
-	target_ulong	st_ino;
+	abi_ulong	st_ino;
 	unsigned int	st_mode;
 	unsigned int	st_nlink;
 	unsigned int	st_uid;
 	unsigned int	st_gid;
 	unsigned int	st_rdev;
-	target_long	st_size;
-	target_long	target_st_atime;
-	target_long	target_st_mtime;
-	target_long	target_st_ctime;
-	target_long	st_blksize;
-	target_long	st_blocks;
-	target_ulong	__unused4[2];
+	abi_long	st_size;
+	abi_long	target_st_atime;
+	abi_long	target_st_mtime;
+	abi_long	target_st_ctime;
+	abi_long	st_blksize;
+	abi_long	st_blocks;
+	abi_ulong	__unused4[2];
 };
 
 struct target_stat64 {
@@ -1016,38 +1013,38 @@ struct target_stat64 {
 	unsigned char	__pad4[4];
 	unsigned int	st_blocks;
 
-	target_ulong	target_st_atime;
-	target_ulong	__unused1;
+	abi_ulong	target_st_atime;
+	abi_ulong	__unused1;
 
-	target_ulong	target_st_mtime;
-	target_ulong	__unused2;
+	abi_ulong	target_st_mtime;
+	abi_ulong	__unused2;
 
-	target_ulong	target_st_ctime;
-	target_ulong	__unused3;
+	abi_ulong	target_st_ctime;
+	abi_ulong	__unused3;
 
-	target_ulong	__unused4[3];
+	abi_ulong	__unused4[3];
 };
 
 #elif defined(TARGET_SPARC)
 
 struct target_stat {
 	unsigned short	st_dev;
-	target_ulong	st_ino;
+	abi_ulong	st_ino;
 	unsigned short	st_mode;
 	short		st_nlink;
 	unsigned short	st_uid;
 	unsigned short	st_gid;
 	unsigned short	st_rdev;
-	target_long	st_size;
-	target_long	target_st_atime;
-	target_ulong	__unused1;
-	target_long	target_st_mtime;
-	target_ulong	__unused2;
-	target_long	target_st_ctime;
-	target_ulong	__unused3;
-	target_long	st_blksize;
-	target_long	st_blocks;
-	target_ulong	__unused4[2];
+	abi_long	st_size;
+	abi_long	target_st_atime;
+	abi_ulong	__unused1;
+	abi_long	target_st_mtime;
+	abi_ulong	__unused2;
+	abi_long	target_st_ctime;
+	abi_ulong	__unused3;
+	abi_long	st_blksize;
+	abi_long	st_blocks;
+	abi_ulong	__unused4[2];
 };
 
 struct target_stat64 {
@@ -1089,24 +1086,32 @@ struct target_stat64 {
 #elif defined(TARGET_PPC)
 
 struct target_stat {
-	unsigned short st_dev;
-	target_ulong st_ino;
+	abi_ulong st_dev;
+	abi_ulong st_ino;
+#if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
+	abi_ulong st_nlink;
+	unsigned int st_mode;
+#else
 	unsigned int st_mode;
 	unsigned short st_nlink;
+#endif
 	unsigned int st_uid;
 	unsigned int st_gid;
-	unsigned short st_rdev;
-	target_ulong  st_size;
-	target_ulong  st_blksize;
-	target_ulong  st_blocks;
-	target_ulong  target_st_atime;
-	target_ulong  __unused1;
-	target_ulong  target_st_mtime;
-	target_ulong  __unused2;
-	target_ulong  target_st_ctime;
-	target_ulong  __unused3;
-	target_ulong  __unused4;
-	target_ulong  __unused5;
+	abi_ulong  st_rdev;
+	abi_ulong  st_size;
+	abi_ulong  st_blksize;
+	abi_ulong  st_blocks;
+	abi_ulong  target_st_atime;
+	abi_ulong  target_st_atime_nsec;
+	abi_ulong  target_st_mtime;
+	abi_ulong  target_st_mtime_nsec;
+	abi_ulong  target_st_ctime;
+	abi_ulong  target_st_ctime_nsec;
+	abi_ulong  __unused4;
+	abi_ulong  __unused5;
+#if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
+	abi_ulong  __unused6;
+#endif
 };
 
 struct target_stat64 {
@@ -1117,19 +1122,18 @@ struct target_stat64 {
 	unsigned int st_uid;
 	unsigned int st_gid;
 	unsigned long long st_rdev;
-	long long pad0;
-	long long st_size;
-	target_ulong	st_blksize;
-	target_ulong	pad1;
-	long long	st_blocks;	/* Number 512-byte blocks allocated. */
-	target_ulong	target_st_atime;
-        target_ulong    target_st_atime_nsec;
-	target_ulong	target_st_mtime;
-        target_ulong    target_st_mtime_nsec;
-	target_ulong	target_st_ctime;
-        target_ulong    target_st_ctime_nsec;
-        target_ulong    __unused4;
-        target_ulong    __unused5;
+	unsigned short pad0;
+	long long      st_size;
+	int	       st_blksize;
+	long long      st_blocks;	/* Number 512-byte blocks allocated. */
+	int	       target_st_atime;
+        unsigned int   target_st_atime_nsec;
+	int	       target_st_mtime;
+        unsigned int   target_st_mtime_nsec;
+	int            target_st_ctime;
+        unsigned int   target_st_ctime_nsec;
+        unsigned int   __unused4;
+        unsigned int   __unused5;
 };
 
 #elif defined(TARGET_M68K)
@@ -1137,24 +1141,24 @@ struct target_stat64 {
 struct target_stat {
 	unsigned short st_dev;
 	unsigned short __pad1;
-	target_ulong st_ino;
+	abi_ulong st_ino;
 	unsigned short st_mode;
 	unsigned short st_nlink;
 	unsigned short st_uid;
 	unsigned short st_gid;
 	unsigned short st_rdev;
 	unsigned short __pad2;
-	target_ulong  st_size;
-	target_ulong  st_blksize;
-	target_ulong  st_blocks;
-	target_ulong  target_st_atime;
-	target_ulong  __unused1;
-	target_ulong  target_st_mtime;
-	target_ulong  __unused2;
-	target_ulong  target_st_ctime;
-	target_ulong  __unused3;
-	target_ulong  __unused4;
-	target_ulong  __unused5;
+	abi_ulong  st_size;
+	abi_ulong  st_blksize;
+	abi_ulong  st_blocks;
+	abi_ulong  target_st_atime;
+	abi_ulong  __unused1;
+	abi_ulong  target_st_mtime;
+	abi_ulong  __unused2;
+	abi_ulong  target_st_ctime;
+	abi_ulong  __unused3;
+	abi_ulong  __unused4;
+	abi_ulong  __unused5;
 };
 
 /* This matches struct stat64 in glibc2.1, hence the absolutely
@@ -1165,43 +1169,43 @@ struct target_stat64 {
 	unsigned char	__pad1[2];
 
 #define TARGET_STAT64_HAS_BROKEN_ST_INO	1
-	target_ulong	__st_ino;
+	abi_ulong	__st_ino;
 
 	unsigned int	st_mode;
 	unsigned int	st_nlink;
 
-	target_ulong	st_uid;
-	target_ulong	st_gid;
+	abi_ulong	st_uid;
+	abi_ulong	st_gid;
 
 	unsigned long long	st_rdev;
 	unsigned char	__pad3[2];
 
 	long long	st_size;
-	target_ulong	st_blksize;
+	abi_ulong	st_blksize;
 
-	target_ulong	__pad4;		/* future possible st_blocks high bits */
-	target_ulong	st_blocks;	/* Number 512-byte blocks allocated. */
+	abi_ulong	__pad4;		/* future possible st_blocks high bits */
+	abi_ulong	st_blocks;	/* Number 512-byte blocks allocated. */
 
-	target_ulong	target_st_atime;
-	target_ulong	target_st_atime_nsec;
+	abi_ulong	target_st_atime;
+	abi_ulong	target_st_atime_nsec;
 
-	target_ulong	target_st_mtime;
-	target_ulong	target_st_mtime_nsec;
+	abi_ulong	target_st_mtime;
+	abi_ulong	target_st_mtime_nsec;
 
-	target_ulong	target_st_ctime;
-	target_ulong	target_st_ctime_nsec;
+	abi_ulong	target_st_ctime;
+	abi_ulong	target_st_ctime_nsec;
 
 	unsigned long long	st_ino;
 } __attribute__((packed));
 
-#elif defined(TARGET_MIPS64)
+#elif defined(TARGET_ABI_MIPSN64)
 
 /* The memory layout is the same as of struct stat64 of the 32-bit kernel.  */
 struct target_stat {
 	unsigned int		st_dev;
 	unsigned int		st_pad0[3]; /* Reserved for st_dev expansion */
 
-	target_ulong		st_ino;
+	abi_ulong		st_ino;
 
 	unsigned int		st_mode;
 	unsigned int		st_nlink;
@@ -1212,7 +1216,7 @@ struct target_stat {
 	unsigned int		st_rdev;
 	unsigned int		st_pad1[3]; /* Reserved for st_rdev expansion */
 
-	target_ulong		st_size;
+	abi_ulong		st_size;
 
 	/*
 	 * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
@@ -1230,10 +1234,10 @@ struct target_stat {
 	unsigned int		st_blksize;
 	unsigned int		st_pad2;
 
-	target_ulong		st_blocks;
+	abi_ulong		st_blocks;
 };
 
-#elif defined(TARGET_MIPSN32)
+#elif defined(TARGET_ABI_MIPSN32)
 
 struct target_stat {
 	unsigned	st_dev;
@@ -1304,33 +1308,33 @@ struct target_stat64 {
 	int		st_blocks;
 };
 
-#elif defined(TARGET_MIPS)
+#elif defined(TARGET_ABI_MIPSO32)
 
 struct target_stat {
 	unsigned	st_dev;
-	target_long	st_pad1[3];		/* Reserved for network id */
-	target_ulong	st_ino;
+	abi_long	st_pad1[3];		/* Reserved for network id */
+	abi_ulong	st_ino;
 	unsigned int	st_mode;
 	unsigned int	st_nlink;
 	int		st_uid;
 	int		st_gid;
 	unsigned 	st_rdev;
-	target_long	st_pad2[2];
-	target_long	st_size;
-	target_long	st_pad3;
+	abi_long	st_pad2[2];
+	abi_long	st_size;
+	abi_long	st_pad3;
 	/*
 	 * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
 	 * but we don't have it under Linux.
 	 */
-	target_long		target_st_atime;
-	target_long		target_st_atime_nsec;
-	target_long		target_st_mtime;
-	target_long		target_st_mtime_nsec;
-	target_long		target_st_ctime;
-	target_long		target_st_ctime_nsec;
-	target_long		st_blksize;
-	target_long		st_blocks;
-	target_long		st_pad4[14];
+	abi_long		target_st_atime;
+	abi_long		target_st_atime_nsec;
+	abi_long		target_st_mtime;
+	abi_long		target_st_mtime_nsec;
+	abi_long		target_st_ctime;
+	abi_long		target_st_ctime_nsec;
+	abi_long		st_blksize;
+	abi_long		st_blocks;
+	abi_long		st_pad4[14];
 };
 
 /*
@@ -1340,8 +1344,8 @@ struct target_stat {
  */
 
 struct target_stat64 {
-	target_ulong	st_dev;
-	target_ulong	st_pad0[3];	/* Reserved for st_dev expansion  */
+	abi_ulong	st_dev;
+	abi_ulong	st_pad0[3];	/* Reserved for st_dev expansion  */
 
 	uint64_t	st_ino;
 
@@ -1351,8 +1355,8 @@ struct target_stat64 {
 	int		st_uid;
 	int		st_gid;
 
-	target_ulong	st_rdev;
-	target_ulong	st_pad1[3];	/* Reserved for st_rdev expansion  */
+	abi_ulong	st_rdev;
+	abi_ulong	st_pad1[3];	/* Reserved for st_rdev expansion  */
 
 	int64_t 	st_size;
 
@@ -1360,17 +1364,17 @@ struct target_stat64 {
 	 * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
 	 * but we don't have it under Linux.
 	 */
-	target_long	target_st_atime;
-	target_ulong	target_st_atime_nsec;	/* Reserved for st_atime expansion  */
+	abi_long	target_st_atime;
+	abi_ulong	target_st_atime_nsec;	/* Reserved for st_atime expansion  */
 
-	target_long	target_st_mtime;
-	target_ulong	target_st_mtime_nsec;	/* Reserved for st_mtime expansion  */
+	abi_long	target_st_mtime;
+	abi_ulong	target_st_mtime_nsec;	/* Reserved for st_mtime expansion  */
 
-	target_long	target_st_ctime;
-	target_ulong	target_st_ctime_nsec;	/* Reserved for st_ctime expansion  */
+	abi_long	target_st_ctime;
+	abi_ulong	target_st_ctime_nsec;	/* Reserved for st_ctime expansion  */
 
-	target_ulong	st_blksize;
-	target_ulong	st_pad2;
+	abi_ulong	st_blksize;
+	abi_ulong	st_pad2;
 
 	int64_t  	st_blocks;
 };
@@ -1385,10 +1389,10 @@ struct target_stat {
        unsigned int    st_uid;
        unsigned int    st_gid;
        unsigned int    st_rdev;
-       target_long     st_size;
-       target_ulong    target_st_atime;
-       target_ulong    target_st_mtime;
-       target_ulong    target_st_ctime;
+       abi_long     st_size;
+       abi_ulong    target_st_atime;
+       abi_ulong    target_st_mtime;
+       abi_ulong    target_st_ctime;
        unsigned int    st_blksize;
        unsigned int    st_blocks;
        unsigned int    st_flags;
@@ -1396,11 +1400,11 @@ struct target_stat {
 };
 
 struct target_stat64 {
-       target_ulong    st_dev;
-       target_ulong    st_ino;
-       target_ulong    st_rdev;
-       target_long     st_size;
-       target_ulong    st_blocks;
+       abi_ulong    st_dev;
+       abi_ulong    st_ino;
+       abi_ulong    st_rdev;
+       abi_long     st_size;
+       abi_ulong    st_blocks;
 
        unsigned int    st_mode;
        unsigned int    st_uid;
@@ -1409,36 +1413,36 @@ struct target_stat64 {
        unsigned int    st_nlink;
        unsigned int    __pad0;
 
-       target_ulong    target_st_atime;
-       target_ulong    target_st_atime_nsec;
-       target_ulong    target_st_mtime;
-       target_ulong    target_st_mtime_nsec;
-       target_ulong    target_st_ctime;
-       target_ulong    target_st_ctime_nsec;
-       target_long     __unused[3];
+       abi_ulong    target_st_atime;
+       abi_ulong    target_st_atime_nsec;
+       abi_ulong    target_st_mtime;
+       abi_ulong    target_st_mtime_nsec;
+       abi_ulong    target_st_ctime;
+       abi_ulong    target_st_ctime_nsec;
+       abi_long     __unused[3];
 };
 
 #elif defined(TARGET_SH4)
 
 struct target_stat {
-	target_ulong  st_dev;
-	target_ulong  st_ino;
+	abi_ulong  st_dev;
+	abi_ulong  st_ino;
 	unsigned short st_mode;
 	unsigned short st_nlink;
 	unsigned short st_uid;
 	unsigned short st_gid;
-	target_ulong  st_rdev;
-	target_ulong  st_size;
-	target_ulong  st_blksize;
-	target_ulong  st_blocks;
-	target_ulong  target_st_atime;
-	target_ulong  target_st_atime_nsec;
-	target_ulong  target_st_mtime;
-	target_ulong  target_st_mtime_nsec;
-	target_ulong  target_st_ctime;
-	target_ulong  target_st_ctime_nsec;
-	target_ulong  __unused4;
-	target_ulong  __unused5;
+	abi_ulong  st_rdev;
+	abi_ulong  st_size;
+	abi_ulong  st_blksize;
+	abi_ulong  st_blocks;
+	abi_ulong  target_st_atime;
+	abi_ulong  target_st_atime_nsec;
+	abi_ulong  target_st_mtime;
+	abi_ulong  target_st_mtime_nsec;
+	abi_ulong  target_st_ctime;
+	abi_ulong  target_st_ctime_nsec;
+	abi_ulong  __unused4;
+	abi_ulong  __unused5;
 };
 
 /* This matches struct stat64 in glibc2.1, hence the absolutely
@@ -1449,34 +1453,58 @@ struct target_stat64 {
 	unsigned char	__pad0[4];
 
 #define TARGET_STAT64_HAS_BROKEN_ST_INO	1
-	target_ulong	__st_ino;
+	abi_ulong	__st_ino;
 
 	unsigned int	st_mode;
 	unsigned int	st_nlink;
 
-	target_ulong	st_uid;
-	target_ulong	st_gid;
+	abi_ulong	st_uid;
+	abi_ulong	st_gid;
 
 	unsigned long long	st_rdev;
 	unsigned char	__pad3[4];
 
 	long long	st_size;
-	target_ulong	st_blksize;
+	abi_ulong	st_blksize;
 
 	unsigned long long	st_blocks;	/* Number 512-byte blocks allocated. */
 
-	target_ulong	target_st_atime;
-	target_ulong	target_st_atime_nsec;
+	abi_ulong	target_st_atime;
+	abi_ulong	target_st_atime_nsec;
 
-	target_ulong	target_st_mtime;
-	target_ulong	target_st_mtime_nsec;
+	abi_ulong	target_st_mtime;
+	abi_ulong	target_st_mtime_nsec;
 
-	target_ulong	target_st_ctime;
-	target_ulong	target_st_ctime_nsec;
+	abi_ulong	target_st_ctime;
+	abi_ulong	target_st_ctime_nsec;
 
 	unsigned long long	st_ino;
 };
 
+#elif defined(TARGET_I386) && !defined(TARGET_ABI32)
+struct target_stat {
+	abi_ulong	st_dev;
+	abi_ulong	st_ino;
+	abi_ulong	st_nlink;
+
+	unsigned int	st_mode;
+	unsigned int	st_uid;
+	unsigned int	st_gid;
+	unsigned int	__pad0;
+	abi_ulong	st_rdev;
+	abi_long	st_size;
+	abi_long	st_blksize;
+    	abi_long	st_blocks;	/* Number 512-byte blocks allocated. */
+
+	abi_ulong	target_st_atime;
+	abi_ulong 	target_st_atime_nsec; 
+	abi_ulong	target_st_mtime;
+	abi_ulong	target_st_mtime_nsec;
+	abi_ulong	target_st_ctime;
+	abi_ulong       target_st_ctime_nsec;
+
+  	abi_long	__unused[3];
+};
 #else
 #error unsupported CPU
 #endif
@@ -1486,7 +1514,7 @@ typedef struct {
 } target_fsid_t;
 
 #ifdef TARGET_MIPS
-#ifdef TARGET_MIPSN32
+#ifdef TARGET_ABI_MIPSN32
 struct target_statfs {
 	int32_t			f_type;
 	int32_t			f_bsize;
@@ -1504,19 +1532,19 @@ struct target_statfs {
 };
 #else
 struct target_statfs {
-	target_long		f_type;
-	target_long		f_bsize;
-	target_long		f_frsize;	/* Fragment size - unsupported */
-	target_long		f_blocks;
-	target_long		f_bfree;
-	target_long		f_files;
-	target_long		f_ffree;
-	target_long		f_bavail;
+	abi_long		f_type;
+	abi_long		f_bsize;
+	abi_long		f_frsize;	/* Fragment size - unsupported */
+	abi_long		f_blocks;
+	abi_long		f_bfree;
+	abi_long		f_files;
+	abi_long		f_ffree;
+	abi_long		f_bavail;
 
 	/* Linux specials */
 	target_fsid_t		f_fsid;
-	target_long		f_namelen;
-	target_long		f_spare[6];
+	abi_long		f_namelen;
+	abi_long		f_spare[6];
 };
 #endif
 
@@ -1534,6 +1562,34 @@ struct target_statfs64 {
 	uint32_t	f_namelen;
 	uint32_t	f_spare[6];
 };
+#elif defined(TARGET_PPC64) && !defined(TARGET_ABI32)
+struct target_statfs {
+	abi_long f_type;
+	abi_long f_bsize;
+	abi_long f_blocks;
+	abi_long f_bfree;
+	abi_long f_bavail;
+	abi_long f_files;
+	abi_long f_ffree;
+	target_fsid_t f_fsid;
+	abi_long f_namelen;
+	abi_long f_frsize;
+	abi_long f_spare[5];
+};
+
+struct target_statfs64 {
+	abi_long f_type;
+	abi_long f_bsize;
+	abi_long f_blocks;
+	abi_long f_bfree;
+	abi_long f_bavail;
+	abi_long f_files;
+	abi_long f_ffree;
+	target_fsid_t f_fsid;
+	abi_long f_namelen;
+	abi_long f_frsize;
+	abi_long f_spare[5];
+};
 #else
 struct target_statfs {
 	uint32_t f_type;
@@ -1688,8 +1744,8 @@ struct target_statfs64 {
 struct target_flock {
 	short l_type;
 	short l_whence;
-	target_ulong l_start;
-	target_ulong l_len;
+	abi_ulong l_start;
+	abi_ulong l_len;
 	int l_pid;
 };
 
@@ -1856,20 +1912,20 @@ struct target_eabi_flock64 {
 #define TARGET_VFAT_IOCTL_READDIR_SHORT   TARGET_IORU('r', 2)
 
 struct target_sysinfo {
-    target_long uptime;             /* Seconds since boot */
-    target_ulong loads[3];          /* 1, 5, and 15 minute load averages */
-    target_ulong totalram;          /* Total usable main memory size */
-    target_ulong freeram;           /* Available memory size */
-    target_ulong sharedram;         /* Amount of shared memory */
-    target_ulong bufferram;         /* Memory used by buffers */
-    target_ulong totalswap;         /* Total swap space size */
-    target_ulong freeswap;          /* swap space still available */
+    abi_long uptime;                /* Seconds since boot */
+    abi_ulong loads[3];             /* 1, 5, and 15 minute load averages */
+    abi_ulong totalram;             /* Total usable main memory size */
+    abi_ulong freeram;              /* Available memory size */
+    abi_ulong sharedram;            /* Amount of shared memory */
+    abi_ulong bufferram;            /* Memory used by buffers */
+    abi_ulong totalswap;            /* Total swap space size */
+    abi_ulong freeswap;             /* swap space still available */
     unsigned short procs;           /* Number of current processes */
     unsigned short pad;             /* explicit padding for m68k */
-    target_ulong totalhigh;         /* Total high memory size */
-    target_ulong freehigh;          /* Available high memory size */
+    abi_ulong totalhigh;            /* Total high memory size */
+    abi_ulong freehigh;             /* Available high memory size */
     unsigned int mem_unit;          /* Memory unit size in bytes */
-    char _f[20-2*sizeof(target_long)-sizeof(int)]; /* Padding: libc5 uses this.. */
+    char _f[20-2*sizeof(abi_long)-sizeof(int)]; /* Padding: libc5 uses this.. */
 };
 
 #include "socket.h"
diff --git a/linux-user/uaccess.c b/linux-user/uaccess.c
new file mode 100644
index 000000000..ed5043756
--- /dev/null
+++ b/linux-user/uaccess.c
@@ -0,0 +1,76 @@
+/* User memory access */
+#include <stdio.h>
+#include <string.h>
+
+#include "qemu.h"
+
+/* copy_from_user() and copy_to_user() are usually used to copy data
+ * buffers between the target and host.  These internally perform
+ * locking/unlocking of the memory.
+ */
+abi_long copy_from_user(void *hptr, abi_ulong gaddr, size_t len)
+{
+    abi_long ret = 0;
+    void *ghptr;
+
+    if ((ghptr = lock_user(VERIFY_READ, gaddr, len, 1))) {
+        memcpy(hptr, ghptr, len);
+        unlock_user(ghptr, gaddr, 0);
+    } else
+        ret = -TARGET_EFAULT;
+
+    return ret;
+}
+
+
+abi_long copy_to_user(abi_ulong gaddr, void *hptr, size_t len)
+{
+    abi_long ret = 0;
+    void *ghptr;
+
+    if ((ghptr = lock_user(VERIFY_WRITE, gaddr, len, 0))) {
+        memcpy(ghptr, hptr, len);
+	unlock_user(ghptr, gaddr, len);
+    } else
+        ret = -TARGET_EFAULT;
+
+    return ret;
+}
+
+/* XXX: use host strnlen if available ? */
+static int qemu_strnlen(const char *s, int max_len)
+{
+    int i;
+    for(i = 0; i < max_len; i++) {
+        if (s[i] == '\0')
+            break;
+    }
+    return i;
+}
+
+/* Return the length of a string in target memory or -TARGET_EFAULT if
+   access error  */
+abi_long target_strlen(abi_ulong guest_addr1)
+{
+    uint8_t *ptr;
+    abi_ulong guest_addr;
+    int max_len, len;
+
+    guest_addr = guest_addr1;
+    for(;;) {
+        max_len = TARGET_PAGE_SIZE - (guest_addr & ~TARGET_PAGE_MASK);
+        ptr = lock_user(VERIFY_READ, guest_addr, max_len, 1);
+        if (!ptr)
+            return -TARGET_EFAULT;
+        len = qemu_strnlen(ptr, max_len);
+        unlock_user(ptr, guest_addr, 0);
+        guest_addr += len;
+        /* we don't allow wrapping or integer overflow */
+        if (guest_addr == 0 || 
+            (guest_addr - guest_addr1) > 0x7fffffff)
+            return -TARGET_EFAULT;
+        if (len != max_len)
+            break;
+    }
+    return guest_addr - guest_addr1;
+}
diff --git a/linux-user/vm86.c b/linux-user/vm86.c
index 9639114fc..d87174b56 100644
--- a/linux-user/vm86.c
+++ b/linux-user/vm86.c
@@ -39,22 +39,27 @@ static inline int is_revectored(int nr, struct target_revectored_struct *bitmap)
     return (((uint8_t *)bitmap)[nr >> 3] >> (nr & 7)) & 1;
 }
 
-static inline void vm_putw(uint8_t *segptr, unsigned int reg16, unsigned int val)
+static inline void vm_putw(uint32_t segptr, unsigned int reg16, unsigned int val)
 {
     stw(segptr + (reg16 & 0xffff), val);
 }
 
-static inline void vm_putl(uint8_t *segptr, unsigned int reg16, unsigned int val)
+static inline void vm_putl(uint32_t segptr, unsigned int reg16, unsigned int val)
 {
     stl(segptr + (reg16 & 0xffff), val);
 }
 
-static inline unsigned int vm_getw(uint8_t *segptr, unsigned int reg16)
+static inline unsigned int vm_getb(uint32_t segptr, unsigned int reg16)
+{
+    return ldub(segptr + (reg16 & 0xffff));
+}
+
+static inline unsigned int vm_getw(uint32_t segptr, unsigned int reg16)
 {
     return lduw(segptr + (reg16 & 0xffff));
 }
 
-static inline unsigned int vm_getl(uint8_t *segptr, unsigned int reg16)
+static inline unsigned int vm_getl(uint32_t segptr, unsigned int reg16)
 {
     return ldl(segptr + (reg16 & 0xffff));
 }
@@ -64,7 +69,9 @@ void save_v86_state(CPUX86State *env)
     TaskState *ts = env->opaque;
     struct target_vm86plus_struct * target_v86;
 
-    lock_user_struct(target_v86, ts->target_v86, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_v86, ts->target_v86, 0))
+        /* FIXME - should return an error */
+        return;
     /* put the VM86 registers in the userspace register structure */
     target_v86->regs.eax = tswap32(env->regs[R_EAX]);
     target_v86->regs.ebx = tswap32(env->regs[R_EBX]);
@@ -194,8 +201,7 @@ static inline unsigned int get_vflags(CPUX86State *env)
 static void do_int(CPUX86State *env, int intno)
 {
     TaskState *ts = env->opaque;
-    uint32_t *int_ptr, segoffs;
-    uint8_t *ssp;
+    uint32_t int_addr, segoffs, ssp;
     unsigned int sp;
 
     if (env->segs[R_CS].selector == TARGET_BIOSSEG)
@@ -205,8 +211,8 @@ static void do_int(CPUX86State *env, int intno)
     if (intno == 0x21 && is_revectored((env->regs[R_EAX] >> 8) & 0xff,
                                        &ts->vm86plus.int21_revectored))
         goto cannot_handle;
-    int_ptr = (uint32_t *)(intno << 2);
-    segoffs = tswap32(*int_ptr);
+    int_addr = (intno << 2);
+    segoffs = ldl(int_addr);
     if ((segoffs >> 16) == TARGET_BIOSSEG)
         goto cannot_handle;
 #if defined(DEBUG_VM86)
@@ -214,7 +220,7 @@ static void do_int(CPUX86State *env, int intno)
             intno, segoffs >> 16, segoffs & 0xffff);
 #endif
     /* save old state */
-    ssp = (uint8_t *)(env->segs[R_SS].selector << 4);
+    ssp = env->segs[R_SS].selector << 4;
     sp = env->regs[R_ESP] & 0xffff;
     vm_putw(ssp, sp - 2, get_vflags(env));
     vm_putw(ssp, sp - 4, env->segs[R_CS].selector);
@@ -257,26 +263,25 @@ void handle_vm86_trap(CPUX86State *env, int trapno)
 void handle_vm86_fault(CPUX86State *env)
 {
     TaskState *ts = env->opaque;
-    uint8_t *csp, *pc, *ssp;
+    uint32_t csp, ssp;
     unsigned int ip, sp, newflags, newip, newcs, opcode, intno;
     int data32, pref_done;
 
-    csp = (uint8_t *)(env->segs[R_CS].selector << 4);
+    csp = env->segs[R_CS].selector << 4;
     ip = env->eip & 0xffff;
-    pc = csp + ip;
 
-    ssp = (uint8_t *)(env->segs[R_SS].selector << 4);
+    ssp = env->segs[R_SS].selector << 4;
     sp = env->regs[R_ESP] & 0xffff;
 
 #if defined(DEBUG_VM86)
-    fprintf(logfile, "VM86 exception %04x:%08x %02x %02x\n",
-            env->segs[R_CS].selector, env->eip, pc[0], pc[1]);
+    fprintf(logfile, "VM86 exception %04x:%08x\n",
+            env->segs[R_CS].selector, env->eip);
 #endif
 
     data32 = 0;
     pref_done = 0;
     do {
-        opcode = csp[ip];
+        opcode = vm_getb(csp, ip);
         ADD16(ip, 1);
         switch (opcode) {
         case 0x66:      /* 32-bit data */     data32=1; break;
@@ -326,7 +331,7 @@ void handle_vm86_fault(CPUX86State *env)
         VM86_FAULT_RETURN;
 
     case 0xcd: /* int */
-        intno = csp[ip];
+        intno = vm_getb(csp, ip);
         ADD16(ip, 1);
         env->eip = ip;
         if (ts->vm86plus.vm86plus.flags & TARGET_vm86dbg_active) {
@@ -381,7 +386,7 @@ void handle_vm86_fault(CPUX86State *env)
     }
 }
 
-int do_vm86(CPUX86State *env, long subfunction, target_ulong vm86_addr)
+int do_vm86(CPUX86State *env, long subfunction, abi_ulong vm86_addr)
 {
     TaskState *ts = env->opaque;
     struct target_vm86plus_struct * target_v86;
@@ -393,7 +398,7 @@ int do_vm86(CPUX86State *env, long subfunction, target_ulong vm86_addr)
     case TARGET_VM86_GET_IRQ_BITS:
     case TARGET_VM86_GET_AND_RESET_IRQ:
         gemu_log("qemu: unsupported vm86 subfunction (%ld)\n", subfunction);
-        ret = -EINVAL;
+        ret = -TARGET_EINVAL;
         goto out;
     case TARGET_VM86_PLUS_INSTALL_CHECK:
         /* NOTE: on old vm86 stuff this will return the error
@@ -424,7 +429,8 @@ int do_vm86(CPUX86State *env, long subfunction, target_ulong vm86_addr)
     ts->vm86_saved_regs.gs = env->segs[R_GS].selector;
 
     ts->target_v86 = vm86_addr;
-    lock_user_struct(target_v86, vm86_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_v86, vm86_addr, 1))
+        return -TARGET_EFAULT;
     /* build vm86 CPU state */
     ts->v86flags = tswap32(target_v86->regs.eflags);
     env->eflags = (env->eflags & ~SAFE_MASK) |
diff --git a/linux-user/x86_64/syscall.h b/linux-user/x86_64/syscall.h
index 2f87dc964..2a8d696bf 100644
--- a/linux-user/x86_64/syscall.h
+++ b/linux-user/x86_64/syscall.h
@@ -2,30 +2,30 @@
 #define __USER_DS	(0x2B)
 
 struct target_pt_regs {
-	target_ulong r15;
-	target_ulong r14;
-	target_ulong r13;
-	target_ulong r12;
-	target_ulong rbp;
-	target_ulong rbx;
+	abi_ulong r15;
+	abi_ulong r14;
+	abi_ulong r13;
+	abi_ulong r12;
+	abi_ulong rbp;
+	abi_ulong rbx;
 /* arguments: non interrupts/non tracing syscalls only save upto here*/
- 	target_ulong r11;
-	target_ulong r10;
-	target_ulong r9;
-	target_ulong r8;
-	target_ulong rax;
-	target_ulong rcx;
-	target_ulong rdx;
-	target_ulong rsi;
-	target_ulong rdi;
-	target_ulong orig_rax;
+ 	abi_ulong r11;
+	abi_ulong r10;
+	abi_ulong r9;
+	abi_ulong r8;
+	abi_ulong rax;
+	abi_ulong rcx;
+	abi_ulong rdx;
+	abi_ulong rsi;
+	abi_ulong rdi;
+	abi_ulong orig_rax;
 /* end of arguments */
 /* cpu exception frame or undefined */
-	target_ulong rip;
-	target_ulong cs;
-	target_ulong eflags;
-	target_ulong rsp;
-	target_ulong ss;
+	abi_ulong rip;
+	abi_ulong cs;
+	abi_ulong eflags;
+	abi_ulong rsp;
+	abi_ulong ss;
 /* top of stack page */
 };
 
@@ -34,6 +34,7 @@ struct target_pt_regs {
 /* The size of each LDT entry. */
 #define TARGET_LDT_ENTRY_SIZE	8
 
+#define TARGET_GDT_ENTRIES 16
 #define TARGET_GDT_ENTRY_TLS_ENTRIES 3
 #define TARGET_GDT_ENTRY_TLS_MIN 12
 #define TARGET_GDT_ENTRY_TLS_MAX 14
@@ -41,7 +42,7 @@ struct target_pt_regs {
 #if 0 // Redefine this
 struct target_modify_ldt_ldt_s {
 	unsigned int  entry_number;
-	target_ulong  base_addr;
+        abi_ulong     base_addr;
 	unsigned int  limit;
 	unsigned int  seg_32bit:1;
 	unsigned int  contents:2;
@@ -54,7 +55,7 @@ struct target_modify_ldt_ldt_s {
 #else
 struct target_modify_ldt_ldt_s {
 	unsigned int  entry_number;
-	target_ulong  base_addr;
+        abi_ulong     base_addr;
 	unsigned int  limit;
         unsigned int flags;
 };
@@ -71,8 +72,8 @@ struct target_ipc64_perm
 	unsigned short		__pad1;
 	unsigned short		seq;
 	unsigned short		__pad2;
-	target_ulong		__unused1;
-	target_ulong		__unused2;
+	abi_ulong		__unused1;
+	abi_ulong		__unused2;
 };
 
 struct target_msqid64_ds {
@@ -80,13 +81,18 @@ struct target_msqid64_ds {
 	unsigned int msg_stime;	/* last msgsnd time */
 	unsigned int msg_rtime;	/* last msgrcv time */
 	unsigned int msg_ctime;	/* last change time */
-	target_ulong  msg_cbytes;	/* current number of bytes on queue */
-	target_ulong  msg_qnum;	/* number of messages in queue */
-	target_ulong  msg_qbytes;	/* max number of bytes on queue */
+	abi_ulong  msg_cbytes;	/* current number of bytes on queue */
+	abi_ulong  msg_qnum;	/* number of messages in queue */
+	abi_ulong  msg_qbytes;	/* max number of bytes on queue */
 	unsigned int msg_lspid;	/* pid of last msgsnd */
 	unsigned int msg_lrpid;	/* last receive pid */
-	target_ulong  __unused4;
-	target_ulong  __unused5;
+	abi_ulong  __unused4;
+	abi_ulong  __unused5;
 };
 
 #define UNAME_MACHINE "x86_64"
+
+#define TARGET_ARCH_SET_GS 0x1001
+#define TARGET_ARCH_SET_FS 0x1002
+#define TARGET_ARCH_GET_FS 0x1003
+#define TARGET_ARCH_GET_GS 0x1004
diff --git a/linux-user/x86_64/target_signal.h b/linux-user/x86_64/target_signal.h
index f93a8d62b..9baf7fbeb 100644
--- a/linux-user/x86_64/target_signal.h
+++ b/linux-user/x86_64/target_signal.h
@@ -6,9 +6,9 @@
 /* this struct defines a stack used during syscall handling */
 
 typedef struct target_sigaltstack {
-	target_ulong ss_sp;
-	target_long ss_flags;
-	target_ulong ss_size;
+	abi_ulong ss_sp;
+	abi_long ss_flags;
+	abi_ulong ss_size;
 } target_stack_t;
 
 
@@ -21,7 +21,7 @@ typedef struct target_sigaltstack {
 #define TARGET_MINSIGSTKSZ	2048
 #define TARGET_SIGSTKSZ		8192
 
-static inline target_ulong get_sp_from_cpustate(CPUX86State *state)
+static inline abi_ulong get_sp_from_cpustate(CPUX86State *state)
 {
     return state->regs[R_ESP];
 }
diff --git a/loader.c b/loader.c
index 40bcaf620..062dee401 100644
--- a/loader.c
+++ b/loader.c
@@ -21,8 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "disas.h"
+#include "sysemu.h"
 #include "uboot_image.h"
 
 /* return the size or -1 if error */
@@ -173,6 +174,7 @@ static void *load_at(int fd, int offset, int size)
 
 #define SZ		32
 #define elf_word        uint32_t
+#define elf_sword        int32_t
 #define bswapSZs	bswap32s
 #include "elf_ops.h"
 
@@ -182,6 +184,7 @@ static void *load_at(int fd, int offset, int size)
 #undef elf_sym
 #undef elf_note
 #undef elf_word
+#undef elf_sword
 #undef bswapSZs
 #undef SZ
 #define elfhdr		elf64_hdr
@@ -190,6 +193,7 @@ static void *load_at(int fd, int offset, int size)
 #define elf_shdr	elf64_shdr
 #define elf_sym		elf64_sym
 #define elf_word        uint64_t
+#define elf_sword        int64_t
 #define bswapSZs	bswap64s
 #define SZ		64
 #include "elf_ops.h"
diff --git a/m68k-semi.c b/m68k-semi.c
index fc033a163..b083b4828 100644
--- a/m68k-semi.c
+++ b/m68k-semi.c
@@ -33,7 +33,9 @@
 #include "qemu.h"
 #define SEMIHOSTING_HEAP_SIZE (128 * 1024 * 1024)
 #else
-#include "vl.h"
+#include "qemu-common.h"
+#include "sysemu.h"
+#include "gdbstub.h"
 #include "softmmu-semi.h"
 #endif
 
@@ -107,7 +109,9 @@ static void translate_stat(CPUState *env, target_ulong addr, struct stat *s)
 {
     struct m68k_gdb_stat *p;
 
-    p = lock_user(addr, sizeof(struct m68k_gdb_stat), 0);
+    if (!(p = lock_user(VERIFY_WRITE, addr, sizeof(struct m68k_gdb_stat), 0)))
+        /* FIXME - should this return an error code? */
+        return;
     p->gdb_st_dev = cpu_to_be32(s->st_dev);
     p->gdb_st_ino = cpu_to_be32(s->st_ino);
     p->gdb_st_mode = cpu_to_be32(s->st_mode);
@@ -140,15 +144,23 @@ static void m68k_semi_cb(CPUState *env, target_ulong ret, target_ulong err)
     if (m68k_semi_is_fseek) {
         /* FIXME: We've already lost the high bits of the fseek
            return value.  */
-        tput32(args, 0);
+        /* FIXME - handle put_user() failure */
+        put_user_u32(0, args);
         args += 4;
         m68k_semi_is_fseek = 0;
     }
-    tput32(args, ret);
-    tput32(args + 4, errno);
+    /* FIXME - handle put_user() failure */
+    put_user_u32(ret, args);
+    put_user_u32(errno, args + 4);
 }
 
-#define ARG(x) tget32(args + (x) * 4)
+#define ARG(n)					\
+({						\
+    target_ulong __arg;				\
+    /* FIXME - handle get_user() failure */	\
+    get_user_ual(__arg, args + (n) * 4);	\
+    __arg;					\
+})
 #define PARG(x) ((unsigned long)ARG(x))
 void do_m68k_semihosting(CPUM68KState *env, int nr)
 {
@@ -168,9 +180,13 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
                            ARG(2), ARG(3));
             return;
         } else {
-            p = lock_user_string(ARG(0));
-            result = open(p, translate_openflags(ARG(2)), ARG(3));
-            unlock_user(p, ARG(0), 0);
+            if (!(p = lock_user_string(ARG(0)))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = open(p, translate_openflags(ARG(2)), ARG(3));
+                unlock_user(p, ARG(0), 0);
+            }
         }
         break;
     case HOSTED_CLOSE:
@@ -196,9 +212,13 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
                            ARG(0), ARG(1), len);
             return;
         } else {
-            p = lock_user(ARG(1), len, 0);
-            result = read(ARG(0), p, len);
-            unlock_user(p, ARG(1), len);
+            if (!(p = lock_user(VERIFY_WRITE, ARG(1), len, 0))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = read(ARG(0), p, len);
+                unlock_user(p, ARG(1), len);
+            }
         }
         break;
     case HOSTED_WRITE:
@@ -208,9 +228,13 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
                            ARG(0), ARG(1), len);
             return;
         } else {
-            p = lock_user(ARG(1), len, 1);
-            result = write(ARG(0), p, len);
-            unlock_user(p, ARG(0), 0);
+            if (!(p = lock_user(VERIFY_READ, ARG(1), len, 1))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = write(ARG(0), p, len);
+                unlock_user(p, ARG(0), 0);
+            }
         }
         break;
     case HOSTED_LSEEK:
@@ -223,9 +247,10 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
                                ARG(0), off, ARG(3));
             } else {
                 off = lseek(ARG(0), off, ARG(3));
-                tput32(args, off >> 32);
-                tput32(args + 4, off);
-                tput32(args + 8, errno);
+                /* FIXME - handle put_user() failure */
+                put_user_u32(off >> 32, args);
+                put_user_u32(off, args + 4);
+                put_user_u32(errno, args + 8);
             }
             return;
         }
@@ -237,7 +262,12 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
         } else {
             p = lock_user_string(ARG(0));
             q = lock_user_string(ARG(2));
-            result = rename(p, q);
+            if (!p || !q) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = rename(p, q);
+            }
             unlock_user(p, ARG(0), 0);
             unlock_user(q, ARG(2), 0);
         }
@@ -248,9 +278,13 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
                            ARG(0), (int)ARG(1));
             return;
         } else {
-            p = lock_user_string(ARG(0));
-            result = unlink(p);
-            unlock_user(p, ARG(0), 0);
+            if (!(p = lock_user_string(ARG(0)))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = unlink(p);
+                unlock_user(p, ARG(0), 0);
+            }
         }
         break;
     case HOSTED_STAT:
@@ -260,9 +294,13 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
             return;
         } else {
             struct stat s;
-            p = lock_user_string(ARG(0));
-            result = stat(p, &s);
-            unlock_user(p, ARG(0), 0);
+            if (!(p = lock_user_string(ARG(0)))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = stat(p, &s);
+                unlock_user(p, ARG(0), 0);
+            }
             if (result == 0) {
                 translate_stat(env, ARG(2), &s);
             }
@@ -291,10 +329,15 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
             struct gdb_timeval *p;
             result = qemu_gettimeofday(&tv);
             if (result != 0) {
-                p = lock_user(ARG(0), sizeof(struct gdb_timeval), 0);
-                p->tv_sec = cpu_to_be32(tv.tv_sec);
-                p->tv_usec = cpu_to_be64(tv.tv_usec);
-                unlock_user(p, ARG(0), sizeof(struct gdb_timeval));
+                if (!(p = lock_user(VERIFY_WRITE,
+                                    ARG(0), sizeof(struct gdb_timeval), 0))) {
+                    /* FIXME - check error code? */
+                    result = -1;
+                } else {
+                    p->tv_sec = cpu_to_be32(tv.tv_sec);
+                    p->tv_usec = cpu_to_be64(tv.tv_usec);
+                    unlock_user(p, ARG(0), sizeof(struct gdb_timeval));
+                }
             }
         }
         break;
@@ -312,9 +355,13 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
                            ARG(0), (int)ARG(1));
             return;
         } else {
-            p = lock_user_string(ARG(0));
-            result = system(p);
-            unlock_user(p, ARG(0), 0);
+            if (!(p = lock_user_string(ARG(0)))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = system(p);
+                unlock_user(p, ARG(0), 0);
+            }
         }
         break;
     case HOSTED_INIT_SIM:
@@ -354,6 +401,7 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
         cpu_abort(env, "Unsupported semihosting syscall %d\n", nr);
         result = 0;
     }
-    tput32(args, result);
-    tput32(args + 4, errno);
+    /* FIXME - handle put_user() failure */
+    put_user_u32(result, args);
+    put_user_u32(errno, args + 4);
 }
diff --git a/migration.c b/migration.c
index f6e2754c4..17ad77ced 100644
--- a/migration.c
+++ b/migration.c
@@ -22,7 +22,12 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "hw/hw.h"
+#include "sysemu.h"
+#include "block.h"
+#include "console.h"
+#include "qemu-timer.h"
+#include "migration.h"
 #include "qemu_socket.h"
 #ifdef USE_KVM
 #include "qemu-kvm.h"
diff --git a/migration.h b/migration.h
new file mode 100644
index 000000000..06a2e4134
--- /dev/null
+++ b/migration.h
@@ -0,0 +1,10 @@
+#ifndef MIGRATION_H
+#define MIGRATION_H
+
+void do_info_migration(void);
+void do_migrate(int detach, const char *uri);
+void do_migrate_cancel(void);
+void do_migrate_set_speed(const char *value);
+int migrate_incoming(const char *device);
+
+#endif
diff --git a/monitor.c b/monitor.c
index 10e0af954..417d2546a 100644
--- a/monitor.c
+++ b/monitor.c
@@ -21,11 +21,26 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw/hw.h"
+#include "hw/usb.h"
+#include "hw/pcmcia.h"
+#include "hw/pc.h"
+#include "hw/pci.h"
+#include "gdbstub.h"
+#include "net.h"
+#include "qemu-char.h"
+#include "sysemu.h"
+#include "console.h"
+#include "block.h"
+#include "audio/audio.h"
 #include "disas.h"
+#include "migration.h"
 #include <dirent.h>
 
 #include "qemu-kvm.h"
+#ifdef CONFIG_PROFILER
+#include "qemu-timer.h" /* for ticks_per_sec */
+#endif
 
 //#define DEBUG
 //#define DEBUG_COMPLETION
@@ -63,7 +78,7 @@ static int hide_banner;
 static term_cmd_t term_cmds[];
 static term_cmd_t info_cmds[];
 
-static char term_outbuf[1024];
+static uint8_t term_outbuf[1024];
 static int term_outbuf_index;
 
 static void monitor_start_input(void);
@@ -84,7 +99,7 @@ void term_flush(void)
 /* flush at every end of line or if the buffer is full */
 void term_puts(const char *str)
 {
-    int c;
+    char c;
     for(;;) {
         c = *str++;
         if (c == '\0')
@@ -206,16 +221,11 @@ static void do_commit(const char *device)
     int i, all_devices;
 
     all_devices = !strcmp(device, "all");
-    for (i = 0; i < MAX_DISKS; i++) {
-        if (bs_table[i]) {
+    for (i = 0; i < nb_drives; i++) {
             if (all_devices ||
-                !strcmp(bdrv_get_device_name(bs_table[i]), device))
-                bdrv_commit(bs_table[i]);
-        }
+                !strcmp(bdrv_get_device_name(drives_table[i].bdrv), device))
+                bdrv_commit(drives_table[i].bdrv);
     }
-    if (mtd_bdrv)
-        if (all_devices || !strcmp(bdrv_get_device_name(mtd_bdrv), device))
-            bdrv_commit(mtd_bdrv);
 }
 
 static void do_info(const char *item)
@@ -251,8 +261,13 @@ static void do_info_block(void)
     bdrv_info();
 }
 
+static void do_info_blockstats(void)
+{
+    bdrv_info_stats();
+}
+
 /* get the current CPU defined by the user */
-int mon_set_cpu(int cpu_index)
+static int mon_set_cpu(int cpu_index)
 {
     CPUState *env;
 
@@ -265,7 +280,7 @@ int mon_set_cpu(int cpu_index)
     return -1;
 }
 
-CPUState *mon_get_cpu(void)
+static CPUState *mon_get_cpu(void)
 {
     if (!mon_cpu) {
         mon_set_cpu(0);
@@ -397,59 +412,6 @@ static void do_eject(int force, const char *filename)
     eject_device(bs, force);
 }
 
-#define USAGE_STR "Usage: read_disk_io hd[a/b/c/d]\n"
-DiskIOStatistics vmdk_io_statistics(BlockDriverState *bs);
-
-static void do_io_statistics(const char *hdx)
-{
-    DiskIOStatistics io[4];
-
-    if ((strcmp(hdx,"hda") != 0) && (strcmp(hdx,"hdb") != 0) &&
-        (strcmp(hdx,"hdc") != 0) && (strcmp(hdx,"hdd") != 0)) {
-        term_printf(USAGE_STR);
-        return;
-    }
-
-    switch (hdx[2]) {
-    case 'a':
-        term_printf("---------- hda io statistics ----------\n");
-        io[0] = vmdk_io_statistics(bs_table[0]);
-        term_printf("read: %" PRIu64 " \nwrite: %" PRIu64 " \n",
-		    io[0].read_byte_counter, io[0].write_byte_counter);
-        break;
-    case 'b':
-        term_printf("---------- hdb io statistics ----------\n");
-        if (bs_table[1]) {
-            io[1] = vmdk_io_statistics(bs_table[1]);
-            term_printf("read: %" PRIu64 " \nwrite: %" PRIu64 " \n",
-			io[1].read_byte_counter, io[1].write_byte_counter);
-        }else {
-            term_printf("hdb not exist\n");
-        }
-        break;
-    case 'c':
-        term_printf("---------- hdc io statistics ----------\n");
-        if (bs_table[2]) {
-            io[2] = vmdk_io_statistics(bs_table[2]);
-            term_printf("read: %" PRIu64 " \nwrite: %" PRIu64 " \n",
-			io[2].read_byte_counter, io[2].write_byte_counter);
-        }else {
-            term_printf("hdc not exist\n");
-        }
-        break;
-    case 'd':
-        term_printf("---------- hdd io statistics ----------\n");
-        if (bs_table[3]) {
-            io[3] = vmdk_io_statistics(bs_table[3]);
-            term_printf("read: %" PRIu64 " \nwrite: %" PRIu64 " \n",
-			io[3].read_byte_counter, io[3].write_byte_counter);
-        }else {
-            term_printf("hdd not exist\n");
-        }
-        break;
-    }
-}
-
 static void do_change_block(const char *device, const char *filename)
 {
     BlockDriverState *bs;
@@ -1371,8 +1333,6 @@ static term_cmd_t term_cmds[] = {
        "capture index", "stop capture" },
     { "memsave", "lis", do_memory_save,
       "addr size file", "save to disk virtual memory dump starting at 'addr' of size 'size'", },
-    { "read_disk_io", "s", do_io_statistics,
-      "hdx", "read disk I/O statistics (VMDK format)" },
     { "migrate", "-ds", do_migrate,
       "[-d] command", "migrate the VM using command (use -d to not wait for command to complete)" },
     { "migrate_cancel", "", do_migrate_cancel,
@@ -1389,6 +1349,8 @@ static term_cmd_t info_cmds[] = {
       "", "show the network state" },
     { "block", "", do_info_block,
       "", "show the block devices" },
+    { "blockstats", "", do_info_blockstats,
+      "", "show block device statistics" },
     { "registers", "", do_info_registers,
       "", "show the cpu registers" },
     { "cpus", "", do_info_cpus,
@@ -1433,6 +1395,10 @@ static term_cmd_t info_cmds[] = {
     { "cpustats", "", do_info_cpu_stats,
       "", "show CPU statistics", },
 #endif
+#if defined(CONFIG_SLIRP)
+    { "slirp", "", do_info_slirp,
+      "", "show SLIRP statistics", },
+#endif
     { "migration", "", do_info_migration,
       "", "show migration information" },
     { NULL, NULL, },
@@ -1485,7 +1451,7 @@ static target_long monitor_get_msr (struct MonitorDef *md, int val)
     CPUState *env = mon_get_cpu();
     if (!env)
         return 0;
-    return do_load_msr(env);
+    return env->msr;
 }
 
 static target_long monitor_get_xer (struct MonitorDef *md, int val)
@@ -2652,6 +2618,8 @@ void monitor_init(CharDriverState *hd, int show_banner)
     hide_banner = !show_banner;
 
     qemu_chr_add_handlers(hd, term_can_read, term_read, term_event, NULL);
+
+    readline_start("", 0, monitor_handle_command1, NULL);
 }
 
 /* XXX: use threads ? */
diff --git a/net.h b/net.h
new file mode 100644
index 000000000..2dfff8def
--- /dev/null
+++ b/net.h
@@ -0,0 +1,50 @@
+#ifndef QEMU_NET_H
+#define QEMU_NET_H
+
+/* VLANs support */
+
+typedef struct VLANClientState VLANClientState;
+
+struct VLANClientState {
+    IOReadHandler *fd_read;
+    /* Packets may still be sent if this returns zero.  It's used to
+       rate-limit the slirp code.  */
+    IOCanRWHandler *fd_can_read;
+    void *opaque;
+    struct VLANClientState *next;
+    struct VLANState *vlan;
+    char info_str[256];
+};
+
+struct VLANState {
+    int id;
+    VLANClientState *first_client;
+    struct VLANState *next;
+    unsigned int nb_guest_devs, nb_host_devs;
+};
+
+VLANState *qemu_find_vlan(int id);
+VLANClientState *qemu_new_vlan_client(VLANState *vlan,
+                                      IOReadHandler *fd_read,
+                                      IOCanRWHandler *fd_can_read,
+                                      void *opaque);
+int qemu_can_send_packet(VLANClientState *vc);
+void qemu_send_packet(VLANClientState *vc, const uint8_t *buf, int size);
+void qemu_handler_true(void *opaque);
+
+void do_info_network(void);
+
+/* NIC info */
+
+#define MAX_NICS 8
+
+struct NICInfo {
+    uint8_t macaddr[6];
+    const char *model;
+    VLANState *vlan;
+};
+
+extern int nb_nics;
+extern NICInfo nd_table[MAX_NICS];
+
+#endif
diff --git a/osdep.c b/osdep.c
index 195eefc08..aa83b6d2b 100644
--- a/osdep.c
+++ b/osdep.c
@@ -33,10 +33,8 @@
 #include <sys/statvfs.h>
 #endif
 
-#include "cpu.h"
-#if defined(USE_KQEMU)
-#include "vl.h"
-#endif
+#include "qemu-common.h"
+#include "sysemu.h"
 
 #ifdef _WIN32
 #include <windows.h>
@@ -84,7 +82,7 @@ void qemu_vfree(void *ptr)
 #include <sys/mman.h>
 #include <fcntl.h>
 
-void *kqemu_vmalloc(size_t size)
+static void *kqemu_vmalloc(size_t size)
 {
     static int phys_ram_fd = -1;
     static int phys_ram_size = 0;
@@ -166,7 +164,7 @@ void *kqemu_vmalloc(size_t size)
     return ptr;
 }
 
-void kqemu_vfree(void *ptr)
+static void kqemu_vfree(void *ptr)
 {
     /* may be useful some day, but currently we do not need to free */
 }
diff --git a/osdep.h b/osdep.h
index 50686d593..c8ab667b4 100644
--- a/osdep.h
+++ b/osdep.h
@@ -3,6 +3,44 @@
 
 #include <stdarg.h>
 
+#ifndef glue
+#define xglue(x, y) x ## y
+#define glue(x, y) xglue(x, y)
+#define stringify(s)	tostring(s)
+#define tostring(s)	#s
+#endif
+
+#ifndef likely
+#if __GNUC__ < 3
+#define __builtin_expect(x, n) (x)
+#endif
+
+#define likely(x)   __builtin_expect(!!(x), 1)
+#define unlikely(x)   __builtin_expect(!!(x), 0)
+#endif
+
+#ifndef MIN
+#define MIN(a, b) (((a) < (b)) ? (a) : (b))
+#endif
+#ifndef MAX
+#define MAX(a, b) (((a) > (b)) ? (a) : (b))
+#endif
+
+#ifndef always_inline
+#if (__GNUC__ < 3) || defined(__APPLE__)
+#define always_inline inline
+#else
+#define always_inline __attribute__ (( always_inline )) __inline__
+#endif
+#endif
+#define inline always_inline
+
+#ifdef __i386__
+#define REGPARM(n) __attribute((regparm(n)))
+#else
+#define REGPARM(n)
+#endif
+
 #define qemu_printf printf
 
 void *qemu_malloc(size_t size);
@@ -18,6 +56,8 @@ void *get_mmap_addr(unsigned long size);
 int qemu_create_pidfile(const char *filename);
 
 #ifdef _WIN32
+int ffs(int i);
+
 typedef struct {
     long tv_sec;
     long tv_usec;
diff --git a/pc-bios/README b/pc-bios/README
index 9839fac7e..f24f40f8c 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -14,7 +14,8 @@
 - OpenBIOS (http://www.openbios.org/) is a free (GPL v2) portable
   firmware implementation. The goal is to implement a 100% IEEE
   1275-1994 (referred to as Open Firmware) compliant firmware.
-  The included Sparc32 and Sparc64 images are built from SVN revision 169.
+  The included Sparc32 and Sparc64 images are built from SVN
+  revision 181.
 
 - The PXE roms come from Rom-o-Matic etherboot 5.4.2.
   pcnet32:pcnet32 -- [0x1022,0x2000]
diff --git a/pc-bios/openbios-sparc32 b/pc-bios/openbios-sparc32
index 7a729aa81..0772c53d5 100644
--- a/pc-bios/openbios-sparc32
+++ b/pc-bios/openbios-sparc32
diff --git a/pc-bios/openbios-sparc64 b/pc-bios/openbios-sparc64
index 57b129ff7..6a4d06bf0 100644
--- a/pc-bios/openbios-sparc64
+++ b/pc-bios/openbios-sparc64
diff --git a/qemu-char.h b/qemu-char.h
new file mode 100644
index 000000000..29de03df5
--- /dev/null
+++ b/qemu-char.h
@@ -0,0 +1,77 @@
+#ifndef QEMU_CHAR_H
+#define QEMU_CHAR_H
+
+/* character device */
+
+#define CHR_EVENT_BREAK 0 /* serial break char */
+#define CHR_EVENT_FOCUS 1 /* focus to this terminal (modal input needed) */
+#define CHR_EVENT_RESET 2 /* new connection established */
+
+
+#define CHR_IOCTL_SERIAL_SET_PARAMS   1
+typedef struct {
+    int speed;
+    int parity;
+    int data_bits;
+    int stop_bits;
+} QEMUSerialSetParams;
+
+#define CHR_IOCTL_SERIAL_SET_BREAK    2
+
+#define CHR_IOCTL_PP_READ_DATA        3
+#define CHR_IOCTL_PP_WRITE_DATA       4
+#define CHR_IOCTL_PP_READ_CONTROL     5
+#define CHR_IOCTL_PP_WRITE_CONTROL    6
+#define CHR_IOCTL_PP_READ_STATUS      7
+#define CHR_IOCTL_PP_EPP_READ_ADDR    8
+#define CHR_IOCTL_PP_EPP_READ         9
+#define CHR_IOCTL_PP_EPP_WRITE_ADDR  10
+#define CHR_IOCTL_PP_EPP_WRITE       11
+
+typedef void IOEventHandler(void *opaque, int event);
+
+struct CharDriverState {
+    int (*chr_write)(struct CharDriverState *s, const uint8_t *buf, int len);
+    void (*chr_update_read_handler)(struct CharDriverState *s);
+    int (*chr_ioctl)(struct CharDriverState *s, int cmd, void *arg);
+    IOEventHandler *chr_event;
+    IOCanRWHandler *chr_can_read;
+    IOReadHandler *chr_read;
+    void *handler_opaque;
+    void (*chr_send_event)(struct CharDriverState *chr, int event);
+    void (*chr_close)(struct CharDriverState *chr);
+    void (*chr_accept_input)(struct CharDriverState *chr);
+    void *opaque;
+    int focus;
+    QEMUBH *bh;
+};
+
+CharDriverState *qemu_chr_open(const char *filename);
+void qemu_chr_close(CharDriverState *chr);
+void qemu_chr_printf(CharDriverState *s, const char *fmt, ...);
+int qemu_chr_write(CharDriverState *s, const uint8_t *buf, int len);
+void qemu_chr_send_event(CharDriverState *s, int event);
+void qemu_chr_add_handlers(CharDriverState *s,
+                           IOCanRWHandler *fd_can_read,
+                           IOReadHandler *fd_read,
+                           IOEventHandler *fd_event,
+                           void *opaque);
+int qemu_chr_ioctl(CharDriverState *s, int cmd, void *arg);
+void qemu_chr_reset(CharDriverState *s);
+int qemu_chr_can_read(CharDriverState *s);
+void qemu_chr_read(CharDriverState *s, uint8_t *buf, int len);
+void qemu_chr_accept_input(CharDriverState *s);
+
+/* async I/O support */
+
+int qemu_set_fd_handler2(int fd,
+                         IOCanRWHandler *fd_read_poll,
+                         IOHandler *fd_read,
+                         IOHandler *fd_write,
+                         void *opaque);
+int qemu_set_fd_handler(int fd,
+                        IOHandler *fd_read,
+                        IOHandler *fd_write,
+                        void *opaque);
+
+#endif
diff --git a/qemu-common.h b/qemu-common.h
new file mode 100644
index 000000000..a383f4fb5
--- /dev/null
+++ b/qemu-common.h
@@ -0,0 +1,125 @@
+/* Common header file that is included by all of qemu.  */
+#ifndef QEMU_COMMON_H
+#define QEMU_COMMON_H
+
+/* we put basic includes here to avoid repeating them in device drivers */
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <string.h>
+#include <inttypes.h>
+#include <limits.h>
+#include <time.h>
+#include <ctype.h>
+#include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+#ifndef O_LARGEFILE
+#define O_LARGEFILE 0
+#endif
+#ifndef O_BINARY
+#define O_BINARY 0
+#endif
+
+#ifndef ENOMEDIUM
+#define ENOMEDIUM ENODEV
+#endif
+
+#ifdef _WIN32
+#include <windows.h>
+#define fsync _commit
+#define lseek _lseeki64
+#define ENOTSUP 4096
+extern int qemu_ftruncate64(int, int64_t);
+#define ftruncate qemu_ftruncate64
+
+
+static inline char *realpath(const char *path, char *resolved_path)
+{
+    _fullpath(resolved_path, path, _MAX_PATH);
+    return resolved_path;
+}
+
+#define PRId64 "I64d"
+#define PRIx64 "I64x"
+#define PRIu64 "I64u"
+#define PRIo64 "I64o"
+#endif
+
+/* FIXME: Remove NEED_CPU_H.  */
+#ifndef NEED_CPU_H
+
+#include "config-host.h"
+#include <setjmp.h>
+#include "osdep.h"
+#include "bswap.h"
+
+#else
+
+#include "cpu.h"
+
+#endif /* !defined(NEED_CPU_H) */
+
+/* bottom halves */
+typedef struct QEMUBH QEMUBH;
+
+typedef void QEMUBHFunc(void *opaque);
+
+QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque);
+void qemu_bh_schedule(QEMUBH *bh);
+void qemu_bh_cancel(QEMUBH *bh);
+void qemu_bh_delete(QEMUBH *bh);
+int qemu_bh_poll(void);
+
+uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c);
+
+/* cutils.c */
+void pstrcpy(char *buf, int buf_size, const char *str);
+char *pstrcat(char *buf, int buf_size, const char *s);
+int strstart(const char *str, const char *val, const char **ptr);
+int stristart(const char *str, const char *val, const char **ptr);
+time_t mktimegm(struct tm *tm);
+int hex2bin(char ch);
+char *urldecode(const char *ptr);
+
+/* Error handling.  */
+
+void hw_error(const char *fmt, ...)
+    __attribute__ ((__format__ (__printf__, 1, 2)))
+    __attribute__ ((__noreturn__));
+
+/* IO callbacks.  */
+typedef void IOReadHandler(void *opaque, const uint8_t *buf, int size);
+typedef int IOCanRWHandler(void *opaque);
+typedef void IOHandler(void *opaque);
+
+struct ParallelIOArg {
+    void *buffer;
+    int count;
+};
+
+typedef int (*DMA_transfer_handler) (void *opaque, int nchan, int pos, int size);
+
+/* A load of opaque types so that device init declarations don't have to
+   pull in all the real definitions.  */
+typedef struct NICInfo NICInfo;
+typedef struct AudioState AudioState;
+typedef struct BlockDriverState BlockDriverState;
+typedef struct DisplayState DisplayState;
+typedef struct TextConsole TextConsole;
+typedef struct CharDriverState CharDriverState;
+typedef struct VLANState VLANState;
+typedef struct QEMUFile QEMUFile;
+typedef struct i2c_bus i2c_bus;
+typedef struct i2c_slave i2c_slave;
+typedef struct SMBusDevice SMBusDevice;
+typedef struct QEMUTimer QEMUTimer;
+typedef struct PCIBus PCIBus;
+typedef struct PCIDevice PCIDevice;
+typedef struct SerialState SerialState;
+typedef struct IRQState *qemu_irq;
+struct pcmcia_card_s;
+
+#endif
diff --git a/qemu-doc.texi b/qemu-doc.texi
index c3a529ba9..04529a115 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -77,12 +77,15 @@ For system emulation, the following hardware targets are supported:
 @item Sun4m (32-bit Sparc processor)
 @item Sun4u (64-bit Sparc processor, in progress)
 @item Malta board (32-bit MIPS processor)
-@item ARM Integrator/CP (ARM926E, 1026E or 946E processor)
-@item ARM Versatile baseboard (ARM926E)
-@item ARM RealView Emulation baseboard (ARM926EJ-S)
+@item ARM Integrator/CP (ARM)
+@item ARM Versatile baseboard (ARM)
+@item ARM RealView Emulation baseboard (ARM)
 @item Spitz, Akita, Borzoi and Terrier PDAs (PXA270 processor)
+@item Luminary Micro LM3S811EVB (ARM Cortex-M3)
+@item Luminary Micro LM3S6965EVB (ARM Cortex-M3)
 @item Freescale MCF5208EVB (ColdFire V2).
 @item Arnewsh MCF5206 evaluation board (ColdFire V2).
+@item Palm Tungsten|E PDA (OMAP310 processor)
 @end itemize
 
 For user emulation, x86, PowerPC, ARM, MIPS, Sparc32/64 and ColdFire(m68k) CPUs are supported.
@@ -196,7 +199,7 @@ Linux should boot and give you a prompt.
 
 @example
 @c man begin SYNOPSIS
-usage: qemu [options] [disk_image]
+usage: qemu [options] [@var{disk_image}]
 @c man end
 @end example
 
@@ -205,25 +208,95 @@ usage: qemu [options] [disk_image]
 
 General options:
 @table @option
-@item -M machine
-Select the emulated machine (@code{-M ?} for list)
+@item -M @var{machine}
+Select the emulated @var{machine} (@code{-M ?} for list)
 
-@item -fda file
-@item -fdb file
+@item -fda @var{file}
+@item -fdb @var{file}
 Use @var{file} as floppy disk 0/1 image (@pxref{disk_images}). You can
 use the host floppy by using @file{/dev/fd0} as filename (@pxref{host_drives}).
 
-@item -hda file
-@item -hdb file
-@item -hdc file
-@item -hdd file
+@item -hda @var{file}
+@item -hdb @var{file}
+@item -hdc @var{file}
+@item -hdd @var{file}
 Use @var{file} as hard disk 0, 1, 2 or 3 image (@pxref{disk_images}).
 
-@item -cdrom file
-Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and and
+@item -cdrom @var{file}
+Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and
 @option{-cdrom} at the same time). You can use the host CD-ROM by
 using @file{/dev/cdrom} as filename (@pxref{host_drives}).
 
+@item -drive @var{option}[,@var{option}[,@var{option}[,...]]]
+
+Define a new drive. Valid options are:
+
+@table @code
+@item file=@var{file}
+This option defines which disk image (@pxref{disk_images}) to use with
+this drive.
+@item if=@var{interface}
+This option defines on which type on interface the drive is connected.
+Available types are: ide, scsi, sd, mtd, floppy, pflash.
+@item bus=@var{bus},unit=@var{unit}
+These options define where is connected the drive by defining the bus number and
+the unit id.
+@item index=@var{index}
+This option defines where is connected the drive by using an index in the list
+of available connectors of a given interface type.
+@item media=@var{media}
+This option defines the type of the media: disk or cdrom.
+@item cyls=@var{c},heads=@var{h},secs=@var{s}[,trans=@var{t}]
+These options have the same definition as they have in @option{-hdachs}.
+@item snapshot=@var{snapshot}
+@var{snapshot} is "on" or "off" and allows to enable snapshot for given drive (see @option{-snapshot}).
+@end table
+
+Instead of @option{-cdrom} you can use:
+@example
+qemu -drive file=file,index=2,media=cdrom
+@end example
+
+Instead of @option{-hda}, @option{-hdb}, @option{-hdc}, @option{-hdd}, you can
+use:
+@example
+qemu -drive file=file,index=0,media=disk
+qemu -drive file=file,index=1,media=disk
+qemu -drive file=file,index=2,media=disk
+qemu -drive file=file,index=3,media=disk
+@end example
+
+You can connect a CDROM to the slave of ide0:
+@example
+qemu -drive file=file,if=ide,index=1,media=cdrom
+@end example
+
+If you don't specify the "file=" argument, you define an empty drive:
+@example
+qemu -drive if=ide,index=1,media=cdrom
+@end example
+
+You can connect a SCSI disk with unit ID 6 on the bus #0:
+@example
+qemu -drive file=file,if=scsi,bus=0,unit=6
+@end example
+
+Instead of @option{-fda}, @option{-fdb}, you can use:
+@example
+qemu -drive file=file,index=0,if=floppy
+qemu -drive file=file,index=1,if=floppy
+@end example
+
+By default, @var{interface} is "ide" and @var{index} is automatically
+incremented:
+@example
+qemu -drive file=a -drive file=b"
+@end example
+is interpreted like:
+@example
+qemu -hda a -hdb b
+@end example
+
 @item -boot [a|c|d|n]
 Boot on floppy (a), hard disk (c), CD-ROM (d), or Etherboot (n). Hard disk boot
 is the default.
@@ -237,19 +310,20 @@ the write back by pressing @key{C-a s} (@pxref{disk_images}).
 Disable boot signature checking for floppy disks in Bochs BIOS. It may
 be needed to boot from old floppy disks.
 
-@item -m megs
-Set virtual RAM size to @var{megs} megabytes. Default is 128 MB.
+@item -m @var{megs}
+Set virtual RAM size to @var{megs} megabytes. Default is 128 MiB.
 
-@item -smp n
+@item -smp @var{n}
 Simulate an SMP system with @var{n} CPUs. On the PC target, up to 255
-CPUs are supported.
+CPUs are supported. On Sparc32 target, Linux limits the number of usable CPUs
+to 4.
 
 @item -audio-help
 
 Will show the audio subsystem help: list of drivers, tunable
 parameters.
 
-@item -soundhw card1,card2,... or -soundhw all
+@item -soundhw @var{card1}[,@var{card2},...] or -soundhw all
 
 Enable audio and selected sound hardware. Use ? to print all
 available sound hardware.
@@ -266,7 +340,12 @@ Set the real time clock to local time (the default is to UTC
 time). This option is needed to have correct date in MS-DOS or
 Windows.
 
-@item -pidfile file
+@item -startdate @var{date}
+Set the initial date of the real time clock. Valid format for
+@var{date} are: @code{now} or @code{2006-06-17T16:01:21} or
+@code{2006-06-17}. The default value is @code{now}.
+
+@item -pidfile @var{file}
 Store the QEMU process PID in @var{file}. It is useful if you launch QEMU
 from a script.
 
@@ -281,13 +360,14 @@ Use it when installing Windows 2000 to avoid a disk full bug. After
 Windows 2000 is installed, you no longer need this option (this option
 slows down the IDE transfers).
 
-@item -option-rom file
-Load the contents of file as an option ROM.  This option is useful to load
-things like EtherBoot.
+@item -option-rom @var{file}
+Load the contents of @var{file} as an option ROM.
+This option is useful to load things like EtherBoot.
 
-@item -name string
-Sets the name of the guest.  This name will be display in the SDL window
-caption.  The name will also be used for the VNC server.
+@item -name @var{name}
+Sets the @var{name} of the guest.
+This name will be display in the SDL window caption.
+The @var{name} will also be used for the VNC server.
 
 @end table
 
@@ -311,7 +391,7 @@ workspace more convenient.
 @item -full-screen
 Start in full screen.
 
-@item -vnc display[,option[,option[,...]]]
+@item -vnc @var{display}[,@var{option}[,@var{option}[,...]]]
 
 Normally, QEMU uses SDL to display the VGA output.  With this option,
 you can have QEMU listen on VNC display @var{display} and redirect the VGA
@@ -323,18 +403,18 @@ syntax for the @var{display} is
 
 @table @code
 
-@item @var{interface:d}
+@item @var{interface}:@var{d}
 
 TCP connections will only be allowed from @var{interface} on display @var{d}.
 By convention the TCP port is 5900+@var{d}. Optionally, @var{interface} can
 be omitted in which case the server will bind to all interfaces.
 
-@item @var{unix:path}
+@item @var{unix}:@var{path}
 
 Connections will be allowed over UNIX domain sockets where @var{path} is the
 location of a unix socket to listen for connections on.
 
-@item @var{none}
+@item none
 
 VNC is initialized by not started. The monitor @code{change} command can be used
 to later start the VNC server.
@@ -346,31 +426,31 @@ separated by commas. Valid options are
 
 @table @code
 
-@item @var{password}
+@item password
 
 Require that password based authentication is used for client connections.
 The password must be set separately using the @code{change} command in the
 @ref{pcsys_monitor}
 
-@item @var{tls}
+@item tls
 
 Require that client use TLS when communicating with the VNC server. This
 uses anonymous TLS credentials so is susceptible to a man-in-the-middle
 attack. It is recommended that this option be combined with either the
 @var{x509} or @var{x509verify} options.
 
-@item @var{x509=/path/to/certificate/dir}
+@item x509=@var{/path/to/certificate/dir}
 
-Valid if @var{tls} is specified. Require that x509 credentials are used
+Valid if @option{tls} is specified. Require that x509 credentials are used
 for negotiating the TLS session. The server will send its x509 certificate
 to the client. It is recommended that a password be set on the VNC server
 to provide authentication of the client when this is used. The path following
 this option specifies where the x509 certificates are to be loaded from.
 See the @ref{vnc_security} section for details on generating certificates.
 
-@item @var{x509verify=/path/to/certificate/dir}
+@item x509verify=@var{/path/to/certificate/dir}
 
-Valid if @var{tls} is specified. Require that x509 credentials are used
+Valid if @option{tls} is specified. Require that x509 credentials are used
 for negotiating the TLS session. The server will send its x509 certificate
 to the client, and request that the client send its own x509 certificate.
 The server will validate the client's certificate against the CA certificate,
@@ -383,7 +463,7 @@ certificates.
 
 @end table
 
-@item -k language
+@item -k @var{language}
 
 Use keyboard layout @var{language} (for example @code{fr} for
 French). This option is only needed where it is not easy to get raw PC
@@ -408,7 +488,7 @@ USB options:
 @item -usb
 Enable the USB driver (will be the default soon)
 
-@item -usbdevice devname
+@item -usbdevice @var{devname}
 Add the USB device @var{devname}. @xref{usb_devices}.
 @end table
 
@@ -416,7 +496,7 @@ Network options:
 
 @table @option
 
-@item -net nic[,vlan=n][,macaddr=addr][,model=type]
+@item -net nic[,vlan=@var{n}][,macaddr=@var{addr}][,model=@var{type}]
 Create a new Network Interface Card and connect it to VLAN @var{n} (@var{n}
 = 0 is the default). The NIC is an ne2k_pci by default on the PC
 target. Optionally, the MAC address can be changed. If no
@@ -429,17 +509,17 @@ Valid values for @var{type} are
 Not all devices are supported on all targets.  Use -net nic,model=?
 for a list of available devices for your target.
 
-@item -net user[,vlan=n][,hostname=name]
+@item -net user[,vlan=@var{n}][,hostname=@var{name}]
 Use the user mode network stack which requires no administrator
 privilege to run.  @option{hostname=name} can be used to specify the client
 hostname reported by the builtin DHCP server.
 
-@item -net tap[,vlan=n][,fd=h][,ifname=name][,script=file]
+@item -net tap[,vlan=@var{n}][,fd=@var{h}][,ifname=@var{name}][,script=@var{file}]
 Connect the host TAP network interface @var{name} to VLAN @var{n} and
 use the network script @var{file} to configure it. The default
 network script is @file{/etc/qemu-ifup}. Use @option{script=no} to
 disable script execution. If @var{name} is not
-provided, the OS automatically provides one.  @option{fd=h} can be
+provided, the OS automatically provides one. @option{fd}=@var{h} can be
 used to specify the handle of an already opened host TAP interface. Example:
 
 @example
@@ -453,13 +533,13 @@ qemu linux.img -net nic,vlan=0 -net tap,vlan=0,ifname=tap0 \
 @end example
 
 
-@item -net socket[,vlan=n][,fd=h][,listen=[host]:port][,connect=host:port]
+@item -net socket[,vlan=@var{n}][,fd=@var{h}][,listen=[@var{host}]:@var{port}][,connect=@var{host}:@var{port}]
 
 Connect the VLAN @var{n} to a remote VLAN in another QEMU virtual
 machine using a TCP socket connection. If @option{listen} is
 specified, QEMU waits for incoming connections on @var{port}
 (@var{host} is optional). @option{connect} is used to connect to
-another QEMU instance using the @option{listen} option. @option{fd=h}
+another QEMU instance using the @option{listen} option. @option{fd}=@var{h}
 specifies an already opened TCP socket.
 
 Example:
@@ -473,7 +553,7 @@ qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \
                -net socket,connect=127.0.0.1:1234
 @end example
 
-@item -net socket[,vlan=n][,fd=h][,mcast=maddr:port]
+@item -net socket[,vlan=@var{n}][,fd=@var{h}][,mcast=@var{maddr}:@var{port}]
 
 Create a VLAN @var{n} shared with another QEMU virtual
 machines using a UDP multicast socket, effectively making a bus for
@@ -518,14 +598,14 @@ Indicate that no network devices should be configured. It is used to
 override the default configuration (@option{-net nic -net user}) which
 is activated if no @option{-net} options are provided.
 
-@item -tftp dir
+@item -tftp @var{dir}
 When using the user mode network stack, activate a built-in TFTP
 server. The files in @var{dir} will be exposed as the root of a TFTP server.
 The TFTP client on the guest must be configured in binary mode (use the command
 @code{bin} of the Unix TFTP client). The host IP address on the guest is as
 usual 10.0.2.2.
 
-@item -bootp file
+@item -bootp @var{file}
 When using the user mode network stack, broadcast @var{file} as the BOOTP
 filename.  In conjunction with @option{-tftp}, this can be used to network boot
 a guest from a local directory.
@@ -535,9 +615,9 @@ Example (using pxelinux):
 qemu -hda linux.img -boot n -tftp /path/to/tftp/files -bootp /pxelinux.0
 @end example
 
-@item -smb dir
+@item -smb @var{dir}
 When using the user mode network stack, activate a built-in SMB
-server so that Windows OSes can access to the host files in @file{dir}
+server so that Windows OSes can access to the host files in @file{@var{dir}}
 transparently.
 
 In the guest Windows OS, the line:
@@ -547,13 +627,13 @@ In the guest Windows OS, the line:
 must be added in the file @file{C:\WINDOWS\LMHOSTS} (for windows 9x/Me)
 or @file{C:\WINNT\SYSTEM32\DRIVERS\ETC\LMHOSTS} (Windows NT/2000).
 
-Then @file{dir} can be accessed in @file{\\smbserver\qemu}.
+Then @file{@var{dir}} can be accessed in @file{\\smbserver\qemu}.
 
 Note that a SAMBA server must be installed on the host OS in
 @file{/usr/sbin/smbd}. QEMU was tested successfully with smbd version
 2.2.7a from the Red Hat 9 and version 3.0.10-1.fc3 from Fedora Core 3.
 
-@item -redir [tcp|udp]:host-port:[guest-host]:guest-port
+@item -redir [tcp|udp]:@var{host-port}:[@var{guest-host}]:@var{guest-port}
 
 When using the user mode network stack, redirect incoming TCP or UDP
 connections to the host port @var{host-port} to the guest
@@ -591,13 +671,13 @@ for easier testing of various kernels.
 
 @table @option
 
-@item -kernel bzImage
+@item -kernel @var{bzImage}
 Use @var{bzImage} as kernel image.
 
-@item -append cmdline
+@item -append @var{cmdline}
 Use @var{cmdline} as kernel command line
 
-@item -initrd file
+@item -initrd @var{file}
 Use @var{file} as initial ram disk.
 
 @end table
@@ -605,7 +685,7 @@ Use @var{file} as initial ram disk.
 Debug/Expert options:
 @table @option
 
-@item -serial dev
+@item -serial @var{dev}
 Redirect the virtual serial port to host character device
 @var{dev}. The default device is @code{vc} in graphical mode and
 @code{stdio} in non graphical mode.
@@ -635,19 +715,22 @@ void device
 @item /dev/XXX
 [Linux only] Use host tty, e.g. @file{/dev/ttyS0}. The host serial port
 parameters are set according to the emulated ones.
-@item /dev/parportN
+@item /dev/parport@var{N}
 [Linux only, parallel port only] Use host parallel port
 @var{N}. Currently SPP and EPP parallel port features can be used.
-@item file:filename
-Write output to filename. No character can be read.
+@item file:@var{filename}
+Write output to @var{filename}. No character can be read.
 @item stdio
 [Unix only] standard input/output
-@item pipe:filename
+@item pipe:@var{filename}
 name pipe @var{filename}
-@item COMn
+@item COM@var{n}
 [Windows only] Use host serial port @var{n}
-@item udp:[remote_host]:remote_port[@@[src_ip]:src_port]
-This implements UDP Net Console.  When @var{remote_host} or @var{src_ip} are not specified they default to @code{0.0.0.0}.  When not using a specified @var{src_port} a random port is automatically chosen.
+@item udp:[@var{remote_host}]:@var{remote_port}[@@[@var{src_ip}]:@var{src_port}]
+This implements UDP Net Console.
+When @var{remote_host} or @var{src_ip} are not specified
+they default to @code{0.0.0.0}.
+When not using a specified @var{src_port} a random port is automatically chosen.
 
 If you just want a simple readonly console you can use @code{netcat} or
 @code{nc}, by starting qemu with: @code{-serial udp::4555} and nc as:
@@ -673,7 +756,7 @@ localhost 5555
 @end table
 
 
-@item tcp:[host]:port[,server][,nowait][,nodelay]
+@item tcp:[@var{host}]:@var{port}[,@var{server}][,nowait][,nodelay]
 The TCP Net Console has two modes of operation.  It can send the serial
 I/O to a location or wait for a connection from a location.  By default
 the TCP Net Console is sent to @var{host} at the @var{port}.  If you use
@@ -692,7 +775,7 @@ connect to the corresponding character device.
 -serial tcp:192.168.0.100:4444,server,nowait
 @end table
 
-@item telnet:host:port[,server][,nowait][,nodelay]
+@item telnet:@var{host}:@var{port}[,server][,nowait][,nodelay]
 The telnet protocol is used instead of raw tcp sockets.  The options
 work the same as if you had specified @code{-serial tcp}.  The
 difference is that the port acts like a telnet server or client using
@@ -701,12 +784,12 @@ MAGIC_SYSRQ sequence if you use a telnet that supports sending the break
 sequence.  Typically in unix telnet you do it with Control-] and then
 type "send break" followed by pressing the enter key.
 
-@item unix:path[,server][,nowait]
+@item unix:@var{path}[,server][,nowait]
 A unix domain socket is used instead of a tcp socket.  The option works the
 same as if you had specified @code{-serial tcp} except the unix domain socket
 @var{path} is used for connections.
 
-@item mon:dev_string
+@item mon:@var{dev_string}
 This is a special option to allow the monitor to be multiplexed onto
 another serial port.  The monitor is accessed with key sequence of
 @key{Control-a} and then pressing @key{c}. See monitor access
@@ -720,7 +803,7 @@ listening on port 4444 would be:
 
 @end table
 
-@item -parallel dev
+@item -parallel @var{dev}
 Redirect the virtual parallel port to host device @var{dev} (same
 devices as the serial port). On Linux hosts, @file{/dev/parportN} can
 be used to use hardware devices connected on the corresponding host
@@ -731,7 +814,7 @@ ports.
 
 Use @code{-parallel none} to disable all parallel ports.
 
-@item -monitor dev
+@item -monitor @var{dev}
 Redirect the monitor to host device @var{dev} (same devices as the
 serial port).
 The default device is @code{vc} in graphical mode and @code{stdio} in
@@ -752,14 +835,14 @@ character to Control-t.
 
 @item -s
 Wait gdb connection to port 1234 (@pxref{gdb_usage}).
-@item -p port
+@item -p @var{port}
 Change gdb connection port.  @var{port} can be either a decimal number
 to specify a TCP port, or a host device (same devices as the serial port).
 @item -S
 Do not start CPU at startup (you must type 'c' in the monitor).
 @item -d
 Output log in /tmp/qemu.log
-@item -hdachs c,h,s,[,t]
+@item -hdachs @var{c},@var{h},@var{s},[,@var{t}]
 Force hard disk 0 physical geometry (1 <= @var{c} <= 16383, 1 <=
 @var{h} <= 16, 1 <= @var{s} <= 63) and optionally force the BIOS
 translation mode (@var{t}=none, lba or auto). Usually QEMU can guess
@@ -870,7 +953,7 @@ emulator. You can use it to:
 
 @item
 Remove or insert removable media images
-(such as CD-ROM or floppies)
+(such as CD-ROM or floppies).
 
 @item
 Freeze/unfreeze the Virtual Machine (VM) and save or restore its state
@@ -886,14 +969,14 @@ The following commands are available:
 
 @table @option
 
-@item help or ? [cmd]
+@item help or ? [@var{cmd}]
 Show the help for all commands or just for command @var{cmd}.
 
 @item commit
-Commit changes to the disk images (if -snapshot is used)
+Commit changes to the disk images (if -snapshot is used).
 
-@item info subcommand
-show various information about the system state
+@item info @var{subcommand}
+Show various information about the system state.
 
 @table @option
 @item info network
@@ -921,12 +1004,12 @@ show which guest mouse is receiving events
 @item q or quit
 Quit the emulator.
 
-@item eject [-f] device
+@item eject [-f] @var{device}
 Eject a removable medium (use -f to force it).
 
-@item change device setting
+@item change @var{device} @var{setting}
 
-Change the configuration of a device
+Change the configuration of a device.
 
 @table @option
 @item change @var{diskdevice} @var{filename}
@@ -936,7 +1019,7 @@ Change the medium for a removable disk device to point to @var{filename}. eg
 (qemu) change cdrom /path/to/some.iso
 @end example
 
-@item change vnc @var{display,options}
+@item change vnc @var{display},@var{options}
 Change the configuration of the VNC server. The valid syntax for @var{display}
 and @var{options} are described at @ref{sec_invocation}. eg
 
@@ -957,24 +1040,24 @@ Password: ********
 
 @end table
 
-@item screendump filename
+@item screendump @var{filename}
 Save screen into PPM image @var{filename}.
 
-@item mouse_move dx dy [dz]
+@item mouse_move @var{dx} @var{dy} [@var{dz}]
 Move the active mouse to the specified coordinates @var{dx} @var{dy}
 with optional scroll axis @var{dz}.
 
-@item mouse_button val
+@item mouse_button @var{val}
 Change the active mouse button state @var{val} (1=L, 2=M, 4=R).
 
-@item mouse_set index
+@item mouse_set @var{index}
 Set which mouse device receives events at given @var{index}, index
 can be obtained with
 @example
 info mice
 @end example
 
-@item wavcapture filename [frequency [bits [channels]]]
+@item wavcapture @var{filename} [@var{frequency} [@var{bits} [@var{channels}]]]
 Capture audio into @var{filename}. Using sample rate @var{frequency}
 bits per sample @var{bits} and number of channels @var{channels}.
 
@@ -985,26 +1068,26 @@ Defaults:
 @item Number of channels = 2 - Stereo
 @end itemize
 
-@item stopcapture index
+@item stopcapture @var{index}
 Stop capture with a given @var{index}, index can be obtained with
 @example
 info capture
 @end example
 
-@item log item1[,...]
+@item log @var{item1}[,...]
 Activate logging of the specified items to @file{/tmp/qemu.log}.
 
-@item savevm [tag|id]
+@item savevm [@var{tag}|@var{id}]
 Create a snapshot of the whole virtual machine. If @var{tag} is
 provided, it is used as human readable identifier. If there is already
 a snapshot with the same tag or ID, it is replaced. More info at
 @ref{vm_snapshots}.
 
-@item loadvm tag|id
+@item loadvm @var{tag}|@var{id}
 Set the whole virtual machine to the snapshot identified by the tag
 @var{tag} or the unique snapshot ID @var{id}.
 
-@item delvm tag|id
+@item delvm @var{tag}|@var{id}
 Delete the snapshot identified by @var{tag} or @var{id}.
 
 @item stop
@@ -1013,13 +1096,13 @@ Stop emulation.
 @item c or cont
 Resume emulation.
 
-@item gdbserver [port]
-Start gdbserver session (default port=1234)
+@item gdbserver [@var{port}]
+Start gdbserver session (default @var{port}=1234)
 
-@item x/fmt addr
+@item x/fmt @var{addr}
 Virtual memory dump starting at @var{addr}.
 
-@item xp /fmt addr
+@item xp /@var{fmt} @var{addr}
 Physical memory dump starting at @var{addr}.
 
 @var{fmt} is a format which tells the command how to format the
@@ -1075,12 +1158,12 @@ Dump 80 16 bit values at the start of the video memory.
 @end smallexample
 @end itemize
 
-@item p or print/fmt expr
+@item p or print/@var{fmt} @var{expr}
 
 Print expression value. Only the @var{format} part of @var{fmt} is
 used.
 
-@item sendkey keys
+@item sendkey @var{keys}
 
 Send @var{keys} to the emulator. Use @code{-} to press several keys
 simultaneously. Example:
@@ -1095,12 +1178,12 @@ intercepts at low level, such as @code{ctrl-alt-f1} in X Window.
 
 Reset the system.
 
-@item usb_add devname
+@item usb_add @var{devname}
 
 Add the USB device @var{devname}.  For details of available devices see
 @ref{usb_devices}
 
-@item usb_del devname
+@item usb_del @var{devname}
 
 Remove the USB device @var{devname} from the QEMU virtual USB
 hub. @var{devname} has the syntax @code{bus.addr}. Use the monitor
@@ -1254,7 +1337,7 @@ Currently there is no specific code to handle removable media, so it
 is better to use the @code{change} or @code{eject} monitor commands to
 change or eject media.
 @item Hard disks
-Hard disks can be used with the syntax: @file{\\.\PhysicalDriveN}
+Hard disks can be used with the syntax: @file{\\.\PhysicalDrive@var{N}}
 where @var{N} is the drive number (0 is the first hard disk).
 
 WARNING: unless you know what you do, it is better to only make
@@ -1449,12 +1532,12 @@ Virtual Mouse.  This will override the PS/2 mouse emulation when activated.
 Pointer device that uses absolute coordinates (like a touchscreen).
 This means qemu is able to report the mouse position without having
 to grab the mouse.  Also overrides the PS/2 mouse emulation when activated.
-@item @code{disk:file}
+@item @code{disk:@var{file}}
 Mass storage device based on @var{file} (@pxref{disk_images})
-@item @code{host:bus.addr}
+@item @code{host:@var{bus.addr}}
 Pass through the host device identified by @var{bus.addr}
 (Linux only)
-@item @code{host:vendor_id:product_id}
+@item @code{host:@var{vendor_id:product_id}}
 Pass through the host device identified by @var{vendor_id:product_id}
 (Linux only)
 @item @code{wacom-tablet}
@@ -1940,8 +2023,10 @@ More information is available at
 @node Sparc32 System emulator
 @section Sparc32 System emulator
 
-Use the executable @file{qemu-system-sparc} to simulate a SparcStation 5
-or SparcStation 10 (sun4m architecture). The emulation is somewhat complete.
+Use the executable @file{qemu-system-sparc} to simulate a SPARCstation
+5, SPARCstation 10, or SPARCserver 600MP (sun4m architecture). The
+emulation is somewhat complete.  SMP up to 16 CPUs is supported, but
+Linux limits the number of usable CPUs to 4.
 
 QEMU emulates the following sun4m peripherals:
 
@@ -1960,12 +2045,14 @@ and power/reset logic
 @item
 ESP SCSI controller with hard disk and CD-ROM support
 @item
-Floppy drive
+Floppy drive (not on SS-600MP)
 @item
 CS4231 sound device (only on SS-5, not working yet)
 @end itemize
 
-The number of peripherals is fixed in the architecture.
+The number of peripherals is fixed in the architecture.  Maximum
+memory size depends on the machine type, for SS-5 it is 256MB and for
+SS-10 and SS-600MP 2047MB.
 
 Since version 0.8.2, QEMU uses OpenBIOS
 @url{http://www.openbios.org/}. OpenBIOS is a free (GPL v2) portable
@@ -1996,7 +2083,7 @@ qemu-system-sparc -prom-env 'auto-boot?=false' \
  -prom-env 'boot-device=sd(0,2,0):d' -prom-env 'boot-args=linux single'
 @end example
 
-@item -M [SS-5|SS-10]
+@item -M [SS-5|SS-10|SS-600MP]
 
 Set the emulated machine type. Default is SS-5.
 
@@ -2036,6 +2123,8 @@ A generic ISA PC-like machine "mips"
 The MIPS Malta prototype board "malta"
 @item
 An ACER Pica "pica61"
+@item
+MIPS emulator pseudo board "mipssim"
 @end itemize
 
 The generic emulation is supported by Debian 'Etch' and is able to
@@ -2044,7 +2133,7 @@ emulated:
 
 @itemize @minus
 @item
-MIPS 24Kf CPU
+A range of MIPS CPUs, default is the 24Kf
 @item
 PC style serial port
 @item
@@ -2083,6 +2172,19 @@ PC Keyboard
 IDE controller
 @end itemize
 
+The mipssim pseudo board emulation provides an environment similiar
+to what the proprietary MIPS emulator uses for running Linux.
+It supports:
+
+@itemize @minus
+@item
+A range of MIPS CPUs, default is the 24Kf
+@item
+PC style serial port
+@item
+MIPSnet network emulation
+@end itemize
+
 @node ARM System emulator
 @section ARM System emulator
 
@@ -2092,7 +2194,7 @@ devices:
 
 @itemize @minus
 @item
-ARM926E, ARM1026E or ARM946E CPU
+ARM926E, ARM1026E, ARM946E, ARM1136 or Cortex-A8 CPU
 @item
 Two PL011 UARTs
 @item
@@ -2109,7 +2211,7 @@ The ARM Versatile baseboard is emulated with the following devices:
 
 @itemize @minus
 @item
-ARM926E CPU
+ARM926E, ARM1136 or Cortex-A8 CPU
 @item
 PL190 Vectored Interrupt Controller
 @item
@@ -2138,7 +2240,7 @@ The ARM RealView Emulation baseboard is emulated with the following devices:
 
 @itemize @minus
 @item
-ARM926E CPU
+ARM926E, ARM1136, ARM11MPCORE(x4) or Cortex-A8 CPU
 @item
 ARM AMBA Generic/Distributed Interrupt Controller
 @item
@@ -2189,6 +2291,57 @@ Three on-chip UARTs
 WM8750 audio CODEC on I@math{^2}C and I@math{^2}S busses
 @end itemize
 
+The Palm Tungsten|E PDA (codename "Cheetah") emulation includes the
+following elements:
+
+@itemize @minus
+@item
+Texas Instruments OMAP310 System-on-chip (ARM 925T core)
+@item
+ROM and RAM memories (ROM firmware image can be loaded with -option-rom)
+@item
+On-chip LCD controller
+@item
+On-chip Real Time Clock
+@item
+TI TSC2102i touchscreen controller / analog-digital converter / Audio
+CODEC, connected through MicroWire and I@math{^2}S busses
+@item
+GPIO-connected matrix keypad
+@item
+Secure Digital card connected to OMAP MMC/SD host
+@item
+Three on-chip UARTs
+@end itemize
+
+The Luminary Micro Stellaris LM3S811EVB emulation includes the following
+devices:
+
+@itemize @minus
+@item
+Cortex-M3 CPU core.
+@item
+64k Flash and 8k SRAM.
+@item
+Timers, UARTs, ADC and I@math{^2}C interface.
+@item
+OSRAM Pictiva 96x16 OLED with SSD0303 controller on I@math{^2}C bus.
+@end itemize
+
+The Luminary Micro Stellaris LM3S6965EVB emulation includes the following
+devices:
+
+@itemize @minus
+@item
+Cortex-M3 CPU core.
+@item
+256k Flash and 64k SRAM.
+@item
+Timers, UARTs, ADC, I@math{^2}C and SSI interfaces.
+@item
+OSRAM Pictiva 128x64 OLED with SSD0323 controller connected via SSI.
+@end itemize
+
 A Linux 2.6 test image is available on the QEMU web site. More
 information is available in the QEMU mailing-list archive.
 
@@ -2354,6 +2507,17 @@ Activate log (logfile=/tmp/qemu.log)
 Act as if the host page size was 'pagesize' bytes
 @end table
 
+Environment variables:
+
+@table @env
+@item QEMU_STRACE
+Print system calls and arguments similar to the 'strace' program
+(NOTE: the actual 'strace' program will not work because the user
+space emulator hasn't implemented ptrace).  At the moment this is
+incomplete.  All system calls that don't have a specific argument
+format are printed with information for six arguments.  Many
+flag-style arguments don't have decoders and will show up as numbers.
+
 @node Other binaries
 @subsection Other binaries
 
@@ -2367,6 +2531,12 @@ coldfire uClinux bFLT format binaries.
 
 The binary format is detected automatically.
 
+@command{qemu-sparc32plus} can execute Sparc32 and SPARC32PLUS binaries
+(Sparc64 CPU, 32 bit ABI).
+
+@command{qemu-sparc64} can execute some Sparc64 (Sparc64 CPU, 64 bit ABI) and
+SPARC32PLUS binaries (Sparc64 CPU, 32 bit ABI).
+
 @node Mac OS X/Darwin User space emulator
 @section Mac OS X/Darwin User space emulator
 
diff --git a/qemu-img.c b/qemu-img.c
index d0210825c..f1a8aebf5 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -21,8 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
+#include <assert.h>
 
 #ifdef _WIN32
 #include <windows.h>
@@ -63,20 +64,7 @@ char *qemu_strdup(const char *str)
     return ptr;
 }
 
-void term_printf(const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
-    vprintf(fmt, ap);
-    va_end(ap);
-}
-
-void term_print_filename(const char *filename)
-{
-    term_printf(filename);
-}
-
-void __attribute__((noreturn)) error(const char *fmt, ...)
+static void __attribute__((noreturn)) error(const char *fmt, ...)
 {
     va_list ap;
     va_start(ap, fmt);
@@ -92,7 +80,7 @@ static void format_print(void *opaque, const char *name)
     printf(" %s", name);
 }
 
-void help(void)
+static void help(void)
 {
     printf("qemu-img version " QEMU_VERSION ", Copyright (c) 2004-2007 Fabrice Bellard\n"
            "usage: qemu-img command [command options]\n"
@@ -101,7 +89,7 @@ void help(void)
            "Command syntax:\n"
            "  create [-e] [-6] [-b base_image] [-f fmt] filename [size]\n"
            "  commit [-f fmt] filename\n"
-           "  convert [-c] [-e] [-6] [-f fmt] filename [-O output_fmt] output_filename\n"
+           "  convert [-c] [-e] [-6] [-f fmt] filename [filename2 [...]] [-O output_fmt] output_filename\n"
            "  info [-f fmt] filename\n"
            "\n"
            "Command parameters:\n"
@@ -174,7 +162,7 @@ static void term_init(void)
     atexit(term_exit);
 }
 
-int read_password(char *buf, int buf_size)
+static int read_password(char *buf, int buf_size)
 {
     uint8_t ch;
     int i, ret;
@@ -269,9 +257,9 @@ static int img_create(int argc, char **argv)
         case 'e':
             flags |= BLOCK_FLAG_ENCRYPT;
             break;
-		case '6':
+        case '6':
             flags |= BLOCK_FLAG_COMPAT6;
-			break;
+            break;
         }
     }
     if (optind >= argc)
@@ -418,11 +406,11 @@ static int is_allocated_sectors(const uint8_t *buf, int n, int *pnum)
 
 static int img_convert(int argc, char **argv)
 {
-    int c, ret, n, n1, flags, cluster_size, cluster_sectors;
-    const char *filename, *fmt, *out_fmt, *out_filename;
+    int c, ret, n, n1, bs_n, bs_i, flags, cluster_size, cluster_sectors;
+    const char *fmt, *out_fmt, *out_filename;
     BlockDriver *drv;
-    BlockDriverState *bs, *out_bs;
-    int64_t total_sectors, nb_sectors, sector_num;
+    BlockDriverState **bs, *out_bs;
+    int64_t total_sectors, nb_sectors, sector_num, bs_offset, bs_sectors;
     uint8_t buf[IO_BUF_SIZE];
     const uint8_t *buf1;
     BlockDriverInfo bdi;
@@ -455,14 +443,24 @@ static int img_convert(int argc, char **argv)
             break;
         }
     }
-    if (optind >= argc)
-        help();
-    filename = argv[optind++];
-    if (optind >= argc)
-        help();
-    out_filename = argv[optind++];
 
-    bs = bdrv_new_open(filename, fmt);
+    bs_n = argc - optind - 1;
+    if (bs_n < 1) help();
+
+    out_filename = argv[argc - 1];
+        
+    bs = calloc(bs_n, sizeof(BlockDriverState *));
+    if (!bs)
+        error("Out of memory");
+
+    total_sectors = 0;
+    for (bs_i = 0; bs_i < bs_n; bs_i++) {
+        bs[bs_i] = bdrv_new_open(argv[optind + bs_i], fmt);
+        if (!bs[bs_i])
+            error("Could not open '%s'", argv[optind + bs_i]);
+        bdrv_get_geometry(bs[bs_i], &bs_sectors);
+        total_sectors += bs_sectors;
+    }
 
     drv = bdrv_find_format(out_fmt);
     if (!drv)
@@ -471,11 +469,11 @@ static int img_convert(int argc, char **argv)
         error("Compression not supported for this file format");
     if (flags & BLOCK_FLAG_ENCRYPT && drv != &bdrv_qcow && drv != &bdrv_qcow2)
         error("Encryption not supported for this file format");
-    if (flags & BLOCK_FLAG_COMPRESS && drv != &bdrv_vmdk)
+    if (flags & BLOCK_FLAG_COMPAT6 && drv != &bdrv_vmdk)
         error("Alternative compatibility level not supported for this file format");
     if (flags & BLOCK_FLAG_ENCRYPT && flags & BLOCK_FLAG_COMPRESS)
         error("Compression and encryption not supported at the same time");
-    bdrv_get_geometry(bs, &total_sectors);
+
     ret = bdrv_create(drv, out_filename, total_sectors, NULL, flags);
     if (ret < 0) {
         if (ret == -ENOTSUP) {
@@ -487,7 +485,11 @@ static int img_convert(int argc, char **argv)
 
     out_bs = bdrv_new_open(out_filename, out_fmt);
 
-    if (flags && BLOCK_FLAG_COMPRESS) {
+    bs_i = 0;
+    bs_offset = 0;
+    bdrv_get_geometry(bs[0], &bs_sectors);
+
+    if (flags & BLOCK_FLAG_COMPRESS) {
         if (bdrv_get_info(out_bs, &bdi) < 0)
             error("could not get block driver info");
         cluster_size = bdi.cluster_size;
@@ -496,6 +498,10 @@ static int img_convert(int argc, char **argv)
         cluster_sectors = cluster_size >> 9;
         sector_num = 0;
         for(;;) {
+            int64_t bs_num;
+            int remainder;
+            uint8_t *buf2;
+
             nb_sectors = total_sectors - sector_num;
             if (nb_sectors <= 0)
                 break;
@@ -503,8 +509,37 @@ static int img_convert(int argc, char **argv)
                 n = cluster_sectors;
             else
                 n = nb_sectors;
-            if (bdrv_read(bs, sector_num, buf, n) < 0)
-                error("error while reading");
+
+            bs_num = sector_num - bs_offset;
+            assert (bs_num >= 0);
+            remainder = n;
+            buf2 = buf;
+            while (remainder > 0) {
+                int nlow;
+                while (bs_num == bs_sectors) {
+                    bs_i++;
+                    assert (bs_i < bs_n);
+                    bs_offset += bs_sectors;
+                    bdrv_get_geometry(bs[bs_i], &bs_sectors);
+                    bs_num = 0;
+                    /* printf("changing part: sector_num=%lld, "
+                       "bs_i=%d, bs_offset=%lld, bs_sectors=%lld\n",
+                       sector_num, bs_i, bs_offset, bs_sectors); */
+                }
+                assert (bs_num < bs_sectors);
+
+                nlow = (remainder > bs_sectors - bs_num) ? bs_sectors - bs_num : remainder;
+
+                if (bdrv_read(bs[bs_i], bs_num, buf2, nlow) < 0) 
+                    error("error while reading");
+
+                buf2 += nlow * 512;
+                bs_num += nlow;
+
+                remainder -= nlow;
+            }
+            assert (remainder == 0);
+
             if (n < cluster_sectors)
                 memset(buf + n * 512, 0, cluster_size - n * 512);
             if (is_not_zero(buf, cluster_size)) {
@@ -527,7 +562,21 @@ static int img_convert(int argc, char **argv)
                 n = (IO_BUF_SIZE / 512);
             else
                 n = nb_sectors;
-            if (bdrv_read(bs, sector_num, buf, n) < 0)
+
+            while (sector_num - bs_offset >= bs_sectors) {
+                bs_i ++;
+                assert (bs_i < bs_n);
+                bs_offset += bs_sectors;
+                bdrv_get_geometry(bs[bs_i], &bs_sectors);
+                /* printf("changing part: sector_num=%lld, bs_i=%d, "
+                  "bs_offset=%lld, bs_sectors=%lld\n",
+                   sector_num, bs_i, bs_offset, bs_sectors); */
+            }
+
+            if (n > bs_offset + bs_sectors - sector_num)
+                n = bs_offset + bs_sectors - sector_num;
+
+            if (bdrv_read(bs[bs_i], sector_num - bs_offset, buf, n) < 0) 
                 error("error while reading");
             /* NOTE: at the same time we convert, we do not write zero
                sectors to have a chance to compress the image. Ideally, we
@@ -545,7 +594,9 @@ static int img_convert(int argc, char **argv)
         }
     }
     bdrv_delete(out_bs);
-    bdrv_delete(bs);
+    for (bs_i = 0; bs_i < bs_n; bs_i++)
+        bdrv_delete(bs[bs_i]);
+    free(bs);
     return 0;
 }
 
diff --git a/qemu-kvm-x86.c b/qemu-kvm-x86.c
index 5f817b600..d86fec30e 100644
--- a/qemu-kvm-x86.c
+++ b/qemu-kvm-x86.c
@@ -8,7 +8,7 @@ extern int kvm_irqchip;
 #ifdef USE_KVM
 
 #include <string.h>
-#include "vl.h"
+#include "hw/hw.h"
 
 #include "qemu-kvm.h"
 #include <libkvm.h>
diff --git a/qemu-kvm.c b/qemu-kvm.c
index cc47ca2ad..8c48b2913 100644
--- a/qemu-kvm.c
+++ b/qemu-kvm.c
@@ -14,7 +14,8 @@ int kvm_irqchip = 1;
 #ifdef USE_KVM
 
 #include <string.h>
-#include "vl.h"
+#include "hw/hw.h"
+#include "sysemu.h"
 
 #include "qemu-kvm.h"
 #include <libkvm.h>
@@ -321,6 +322,10 @@ static int kvm_main_loop_cpu(CPUState *env)
 
     setup_kernel_sigmask(env);
     pthread_mutex_lock(&qemu_mutex);
+
+    kvm_qemu_init_env(env);
+    env->ready_for_interrupt_injection = 1;
+
     cpu_single_env = env;
     while (1) {
 	while (!has_work(env))
diff --git a/qemu-kvm.h b/qemu-kvm.h
index 4e9707fa3..9f4572862 100644
--- a/qemu-kvm.h
+++ b/qemu-kvm.h
@@ -40,6 +40,9 @@ int kvm_arch_has_work(CPUState *env);
 int kvm_arch_try_push_interrupts(void *opaque);
 void kvm_arch_update_regs_for_sipi(CPUState *env);
 
+extern int kvm_allowed;
+extern int kvm_irqchip;
+
 #define ALIGN(x, y)  (((x)+(y)-1) & ~((y)-1))
 #define BITMAP_SIZE(m) (ALIGN(((m)>>TARGET_PAGE_BITS), HOST_LONG_BITS) / 8)
 #endif
diff --git a/qemu-tech.texi b/qemu-tech.texi
index 242bbb641..cc027cf6a 100644
--- a/qemu-tech.texi
+++ b/qemu-tech.texi
@@ -199,9 +199,10 @@ FPU and MMU.
 
 @item Full SPARC V8 emulation, including privileged
 instructions, FPU and MMU. SPARC V9 emulation includes most privileged
-instructions, FPU and I/D MMU, but misses most VIS instructions.
+and VIS instructions, FPU and I/D MMU. Alignment is fully enforced.
 
-@item Can run most 32-bit SPARC Linux binaries and some handcrafted 64-bit SPARC Linux binaries.
+@item Can run most 32-bit SPARC Linux binaries, SPARC32PLUS Linux binaries and
+some 64-bit SPARC Linux binaries.
 
 @end itemize
 
@@ -211,11 +212,7 @@ Current QEMU limitations:
 
 @item IPC syscalls are missing.
 
-@item 128-bit floating point operations are not supported, though none of the
-real CPUs implement them either. FCMPE[SD] are not correctly
-implemented.  Floating point exception support is untested.
-
-@item Alignment is not enforced at all.
+@item Floating point exception support is buggy.
 
 @item Atomic instructions are not correctly implemented.
 
diff --git a/qemu-timer.h b/qemu-timer.h
new file mode 100644
index 000000000..3f8880ddf
--- /dev/null
+++ b/qemu-timer.h
@@ -0,0 +1,48 @@
+#ifndef QEMU_TIMER_H
+#define QEMU_TIMER_H
+
+/* timers */
+
+typedef struct QEMUClock QEMUClock;
+typedef void QEMUTimerCB(void *opaque);
+
+/* The real time clock should be used only for stuff which does not
+   change the virtual machine state, as it is run even if the virtual
+   machine is stopped. The real time clock has a frequency of 1000
+   Hz. */
+extern QEMUClock *rt_clock;
+
+/* The virtual clock is only run during the emulation. It is stopped
+   when the virtual machine is stopped. Virtual timers use a high
+   precision clock, usually cpu cycles (use ticks_per_sec). */
+extern QEMUClock *vm_clock;
+
+int64_t qemu_get_clock(QEMUClock *clock);
+
+QEMUTimer *qemu_new_timer(QEMUClock *clock, QEMUTimerCB *cb, void *opaque);
+void qemu_free_timer(QEMUTimer *ts);
+void qemu_del_timer(QEMUTimer *ts);
+void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time);
+int qemu_timer_pending(QEMUTimer *ts);
+
+extern int64_t ticks_per_sec;
+
+void qemu_get_timer(QEMUFile *f, QEMUTimer *ts);
+void qemu_put_timer(QEMUFile *f, QEMUTimer *ts);
+
+/* ptimer.c */
+typedef struct ptimer_state ptimer_state;
+typedef void (*ptimer_cb)(void *opaque);
+
+ptimer_state *ptimer_init(QEMUBH *bh);
+void ptimer_set_period(ptimer_state *s, int64_t period);
+void ptimer_set_freq(ptimer_state *s, uint32_t freq);
+void ptimer_set_limit(ptimer_state *s, uint64_t limit, int reload);
+uint64_t ptimer_get_count(ptimer_state *s);
+void ptimer_set_count(ptimer_state *s, uint64_t count);
+void ptimer_run(ptimer_state *s, int oneshot);
+void ptimer_stop(ptimer_state *s);
+void qemu_put_ptimer(QEMUFile *f, ptimer_state *s);
+void qemu_get_ptimer(QEMUFile *f, ptimer_state *s);
+
+#endif
diff --git a/readline.c b/readline.c
index de60cfcf5..f690f6e9e 100644
--- a/readline.c
+++ b/readline.c
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "console.h"
 
 #define TERM_CMD_BUF_SIZE 4095
 #define TERM_MAX_CMDS 64
diff --git a/sdl.c b/sdl.c
index e5018f7c1..5b9a06b81 100644
--- a/sdl.c
+++ b/sdl.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "console.h"
+#include "sysemu.h"
 
 #include <SDL.h>
 
diff --git a/slirp/.cvsignore b/slirp/.cvsignore
new file mode 100644
index 000000000..a4383358e
--- /dev/null
+++ b/slirp/.cvsignore
@@ -0,0 +1 @@
+*.d
diff --git a/slirp/bootp.c b/slirp/bootp.c
index 9f2635bf3..3ae3db209 100644
--- a/slirp/bootp.c
+++ b/slirp/bootp.c
@@ -149,7 +149,7 @@ static void bootp_reply(struct bootp_t *bp)
 
     if ((m = m_get()) == NULL)
         return;
-    m->m_data += if_maxlinkhdr;
+    m->m_data += IF_MAXLINKHDR;
     rbp = (struct bootp_t *)m->m_data;
     m->m_data += sizeof(struct udpiphdr);
     memset(rbp, 0, sizeof(struct bootp_t));
diff --git a/slirp/debug.c b/slirp/debug.c
index e31244550..7c8581d63 100644
--- a/slirp/debug.c
+++ b/slirp/debug.c
@@ -20,6 +20,7 @@ extern char *strerror _P((int));
 
 /* Carry over one item from main.c so that the tty's restored.
  * Only done when the tty being used is /dev/tty --RedWolf */
+#ifndef CONFIG_QEMU
 extern struct termios slirp_tty_settings;
 extern int slirp_tty_restore;
 
@@ -70,7 +71,9 @@ dump_packet(dat, n)
 	}
 }
 #endif
+#endif
 
+#ifdef LOG_ENABLED
 #if 0
 /*
  * Statistic routines
@@ -80,7 +83,7 @@ dump_packet(dat, n)
  * the link as well.
  */
 
-void
+static void
 ttystats(ttyp)
 	struct ttys *ttyp;
 {
@@ -89,9 +92,9 @@ ttystats(ttyp)
 
 	lprint(" \r\n");
 
-	if (if_comp & IF_COMPRESS)
+	if (IF_COMP & IF_COMPRESS)
 	   strcpy(buff, "on");
-	else if (if_comp & IF_NOCOMPRESS)
+	else if (IF_COMP & IF_NOCOMPRESS)
 	   strcpy(buff, "off");
 	else
 	   strcpy(buff, "off (for now)");
@@ -119,8 +122,8 @@ ttystats(ttyp)
 	lprint("  %6d bad input packets\r\n", is->in_mbad);
 }
 
-void
-allttystats()
+static void
+allttystats(void)
 {
 	struct ttys *ttyp;
 
@@ -129,8 +132,8 @@ allttystats()
 }
 #endif
 
-void
-ipstats()
+static void
+ipstats(void)
 {
 	lprint(" \r\n");
 
@@ -153,9 +156,9 @@ ipstats()
 	lprint("  %6d total packets delivered\r\n", ipstat.ips_delivered);
 }
 
-#if 0
-void
-vjstats()
+#ifndef CONFIG_QEMU
+static void
+vjstats(void)
 {
 	lprint(" \r\n");
 
@@ -172,8 +175,8 @@ vjstats()
 }
 #endif
 
-void
-tcpstats()
+static void
+tcpstats(void)
 {
 	lprint(" \r\n");
 
@@ -240,8 +243,8 @@ tcpstats()
 
 }
 
-void
-udpstats()
+static void
+udpstats(void)
 {
         lprint(" \r\n");
 
@@ -254,8 +257,8 @@ udpstats()
 	lprint("  %6d datagrams sent\r\n", udpstat.udps_opackets);
 }
 
-void
-icmpstats()
+static void
+icmpstats(void)
 {
 	lprint(" \r\n");
 	lprint("ICMP stats:\r\n");
@@ -267,8 +270,8 @@ icmpstats()
 	lprint("  %6d ICMP packets sent in reply\r\n", icmpstat.icps_reflect);
 }
 
-void
-mbufstats()
+static void
+mbufstats(void)
 {
 	struct mbuf *m;
 	int i;
@@ -291,8 +294,8 @@ mbufstats()
         lprint("  %6d mbufs queued as packets\r\n\r\n", if_queued);
 }
 
-void
-sockstats()
+static void
+sockstats(void)
 {
 	char buff[256];
 	int n;
@@ -331,8 +334,9 @@ sockstats()
 				so->so_rcv.sb_cc, so->so_snd.sb_cc);
 	}
 }
+#endif
 
-#if 0
+#ifndef CONFIG_QEMU
 void
 slirp_exit(exit_status)
 	int exit_status;
@@ -374,3 +378,18 @@ slirp_exit(exit_status)
 	exit(exit_status);
 }
 #endif
+
+void
+slirp_stats(void)
+{
+#ifdef LOG_ENABLED
+    ipstats();
+    tcpstats();
+    udpstats();
+    icmpstats();
+    mbufstats();
+    sockstats();
+#else
+    lprint("SLIRP statistics code not compiled.\n");
+#endif
+}
diff --git a/slirp/debug.h b/slirp/debug.h
index fa62cb9fe..8a523b2ed 100644
--- a/slirp/debug.h
+++ b/slirp/debug.h
@@ -37,14 +37,4 @@ extern int slirp_debug;
 #endif
 
 void debug_init _P((char *, int));
-//void ttystats _P((struct ttys *));
-void allttystats _P((void));
-void ipstats _P((void));
-void vjstats _P((void));
-void tcpstats _P((void));
-void udpstats _P((void));
-void icmpstats _P((void));
-void mbufstats _P((void));
-void sockstats _P((void));
-void slirp_exit _P((int));
 
diff --git a/slirp/icmp_var.h b/slirp/icmp_var.h
index 03fc8c3ac..cd865b797 100644
--- a/slirp/icmp_var.h
+++ b/slirp/icmp_var.h
@@ -64,6 +64,8 @@ struct icmpstat {
 	{ "stats", CTLTYPE_STRUCT }, \
 }
 
+#ifdef LOG_ENABLED
 extern struct icmpstat icmpstat;
+#endif
 
 #endif
diff --git a/slirp/if.c b/slirp/if.c
index 6d72fa72f..67a7b6ff8 100644
--- a/slirp/if.c
+++ b/slirp/if.c
@@ -7,12 +7,7 @@
 
 #include <slirp.h>
 
-int if_mtu, if_mru;
-int if_comp;
-int if_maxlinkhdr;
 int     if_queued = 0;                  /* Number of packets queued so far */
-int     if_thresh = 10;                 /* Number of packets queued before we start sending
-					 * (to prevent allocing too many mbufs) */
 
 struct  mbuf if_fastq;                  /* fast queue (for interactive data) */
 struct  mbuf if_batchq;                 /* queue for non-interactive data */
@@ -41,23 +36,6 @@ ifs_remque(ifm)
 void
 if_init()
 {
-#if 0
-	/*
-	 * Set if_maxlinkhdr to 48 because it's 40 bytes for TCP/IP,
-	 * and 8 bytes for PPP, but need to have it on an 8byte boundary
-	 */
-#ifdef USE_PPP
-	if_maxlinkhdr = 48;
-#else
-	if_maxlinkhdr = 40;
-#endif
-#else
-        /* 2 for alignment, 14 for ethernet, 40 for TCP/IP */
-        if_maxlinkhdr = 2 + 14 + 40;
-#endif
-	if_mtu = 1500;
-	if_mru = 1500;
-	if_comp = IF_AUTOCOMP;
 	if_fastq.ifq_next = if_fastq.ifq_prev = &if_fastq;
 	if_batchq.ifq_next = if_batchq.ifq_prev = &if_batchq;
         //	sl_compress_init(&comp_s);
diff --git a/slirp/if.h b/slirp/if.h
index bf24174a6..bed7152fe 100644
--- a/slirp/if.h
+++ b/slirp/if.h
@@ -13,15 +13,26 @@
 #define IF_AUTOCOMP	0x04	/* Autodetect (default) */
 #define IF_NOCIDCOMP	0x08	/* CID compression */
 
-/* Needed for FreeBSD */
-#undef if_mtu
-extern int	if_mtu;
-extern int	if_mru;	/* MTU and MRU */
-extern int	if_comp;	/* Flags for compression */
-extern int	if_maxlinkhdr;
+#define IF_MTU 1500
+#define IF_MRU 1500
+#define	IF_COMP IF_AUTOCOMP	/* Flags for compression */
+
+#if 0
+/*
+ * Set if_maxlinkhdr to 48 because it's 40 bytes for TCP/IP,
+ * and 8 bytes for PPP, but need to have it on an 8byte boundary
+ */
+#ifdef USE_PPP
+#define IF_MAXLINKHDR 48
+#else
+#define IF_MAXLINKHDR 40
+#endif
+#else
+        /* 2 for alignment, 14 for ethernet, 40 for TCP/IP */
+#define IF_MAXLINKHDR (2 + 14 + 40)
+#endif
+
 extern int	if_queued;	/* Number of packets queued so far */
-extern int	if_thresh;	/* Number of packets queued before we start sending
-				 * (to prevent allocing too many mbufs) */
 
 extern	struct mbuf if_fastq;                  /* fast queue (for interactive data) */
 extern	struct mbuf if_batchq;                 /* queue for non-interactive data */
@@ -29,6 +40,7 @@ extern	struct mbuf *next_m;
 
 #define ifs_init(ifm) ((ifm)->ifs_next = (ifm)->ifs_prev = (ifm))
 
+#ifdef LOG_ENABLED
 /* Interface statistics */
 struct slirp_ifstats {
 	u_int out_pkts;		/* Output packets */
@@ -46,5 +58,6 @@ struct slirp_ifstats {
 
 	u_int in_mbad;		/* Bad incoming packets */
 };
+#endif
 
 #endif
diff --git a/slirp/ip.h b/slirp/ip.h
index 371537d48..a8cdb0d3f 100644
--- a/slirp/ip.h
+++ b/slirp/ip.h
@@ -272,6 +272,7 @@ struct ipoption {
 	int8_t	ipopt_list[MAX_IPOPTLEN];	/* options proper */
 };
 
+#ifdef LOG_ENABLED
 /*
  * Structure attached to inpcb.ip_moptions and
  * passed to ip_output when IP multicast options are in use.
@@ -306,8 +307,9 @@ struct	ipstat {
 };
 
 extern struct	ipstat	ipstat;
+#endif
+
 extern struct	ipq	ipq;			/* ip reass. queue */
 extern u_int16_t	ip_id;				/* ip packet ctr, for ids */
-extern int	ip_defttl;			/* default IP ttl */
 
 #endif
diff --git a/slirp/ip_icmp.c b/slirp/ip_icmp.c
index ae5a32118..d1da0a2fc 100644
--- a/slirp/ip_icmp.c
+++ b/slirp/ip_icmp.c
@@ -37,14 +37,16 @@
 #include "slirp.h"
 #include "ip_icmp.h"
 
+#ifdef LOG_ENABLED
 struct icmpstat icmpstat;
+#endif
 
 /* The message sent when emulating PING */
-/* Be nice and tell them it's just a psuedo-ping packet */
-char icmp_ping_msg[] = "This is a psuedo-PING packet used by Slirp to emulate ICMP ECHO-REQUEST packets.\n";
+/* Be nice and tell them it's just a pseudo-ping packet */
+const char icmp_ping_msg[] = "This is a pseudo-PING packet used by Slirp to emulate ICMP ECHO-REQUEST packets.\n";
 
 /* list of actions for icmp_error() on RX of an icmp message */
-static int icmp_flush[19] = {
+static const int icmp_flush[19] = {
 /*  ECHO REPLY (0)  */   0,
 		         1,
 		         1,
@@ -83,14 +85,14 @@ icmp_input(m, hlen)
   DEBUG_ARG("m = %lx", (long )m);
   DEBUG_ARG("m_len = %d", m->m_len);
 
-  icmpstat.icps_received++;
+  STAT(icmpstat.icps_received++);
 
   /*
    * Locate icmp structure in mbuf, and check
    * that its not corrupted and of at least minimum length.
    */
   if (icmplen < ICMP_MINLEN) {          /* min 8 bytes payload */
-    icmpstat.icps_tooshort++;
+    STAT(icmpstat.icps_tooshort++);
   freeit:
     m_freem(m);
     goto end_error;
@@ -100,7 +102,7 @@ icmp_input(m, hlen)
   m->m_data += hlen;
   icp = mtod(m, struct icmp *);
   if (cksum(m, icmplen)) {
-    icmpstat.icps_checksum++;
+    STAT(icmpstat.icps_checksum++);
     goto freeit;
   }
   m->m_len += hlen;
@@ -170,12 +172,12 @@ icmp_input(m, hlen)
   case ICMP_TSTAMP:
   case ICMP_MASKREQ:
   case ICMP_REDIRECT:
-    icmpstat.icps_notsupp++;
+    STAT(icmpstat.icps_notsupp++);
     m_freem(m);
     break;
 
   default:
-    icmpstat.icps_badtype++;
+    STAT(icmpstat.icps_badtype++);
     m_freem(m);
   } /* swith */
 
@@ -314,7 +316,7 @@ icmp_error(msrc, type, code, minsize, message)
 
   (void ) ip_output((struct socket *)NULL, m);
 
-  icmpstat.icps_reflect++;
+  STAT(icmpstat.icps_reflect++);
 
 end_error:
   return;
@@ -371,5 +373,5 @@ icmp_reflect(m)
 
   (void ) ip_output((struct socket *)NULL, m);
 
-  icmpstat.icps_reflect++;
+  STAT(icmpstat.icps_reflect++);
 }
diff --git a/slirp/ip_input.c b/slirp/ip_input.c
index a7d6e3181..b04684027 100644
--- a/slirp/ip_input.c
+++ b/slirp/ip_input.c
@@ -45,10 +45,19 @@
 #include <slirp.h>
 #include "ip_icmp.h"
 
-int ip_defttl;
+#ifdef LOG_ENABLED
 struct ipstat ipstat;
+#endif
+
 struct ipq ipq;
 
+static struct ip *ip_reass(register struct ipasfrag *ip,
+                           register struct ipq *fp);
+static void ip_freef(struct ipq *fp);
+static void ip_enq(register struct ipasfrag *p,
+                   register struct ipasfrag *prev);
+static void ip_deq(register struct ipasfrag *p);
+
 /*
  * IP initialization: fill in IP protocol switch table.
  * All protocols not implemented in kernel go to raw IP protocol handler.
@@ -60,7 +69,6 @@ ip_init()
 	ip_id = tt.tv_sec & 0xffff;
 	udp_init();
 	tcp_init();
-	ip_defttl = IPDEFTTL;
 }
 
 /*
@@ -78,23 +86,23 @@ ip_input(m)
 	DEBUG_ARG("m = %lx", (long)m);
 	DEBUG_ARG("m_len = %d", m->m_len);
 
-	ipstat.ips_total++;
+	STAT(ipstat.ips_total++);
 
 	if (m->m_len < sizeof (struct ip)) {
-		ipstat.ips_toosmall++;
+		STAT(ipstat.ips_toosmall++);
 		return;
 	}
 
 	ip = mtod(m, struct ip *);
 
 	if (ip->ip_v != IPVERSION) {
-		ipstat.ips_badvers++;
+		STAT(ipstat.ips_badvers++);
 		goto bad;
 	}
 
 	hlen = ip->ip_hl << 2;
 	if (hlen<sizeof(struct ip ) || hlen>m->m_len) {/* min header length */
-	  ipstat.ips_badhlen++;                     /* or packet too short */
+	  STAT(ipstat.ips_badhlen++);                     /* or packet too short */
 	  goto bad;
 	}
 
@@ -103,7 +111,7 @@ ip_input(m)
 	 * if (ip->ip_sum) {
 	 */
 	if(cksum(m,hlen)) {
-	  ipstat.ips_badsum++;
+	  STAT(ipstat.ips_badsum++);
 	  goto bad;
 	}
 
@@ -112,7 +120,7 @@ ip_input(m)
 	 */
 	NTOHS(ip->ip_len);
 	if (ip->ip_len < hlen) {
-		ipstat.ips_badlen++;
+		STAT(ipstat.ips_badlen++);
 		goto bad;
 	}
 	NTOHS(ip->ip_id);
@@ -125,7 +133,7 @@ ip_input(m)
 	 * Drop packet if shorter than we expect.
 	 */
 	if (m->m_len < ip->ip_len) {
-		ipstat.ips_tooshort++;
+		STAT(ipstat.ips_tooshort++);
 		goto bad;
 	}
 	/* Should drop packet if mbuf too long? hmmm... */
@@ -192,11 +200,11 @@ ip_input(m)
 		 * attempt reassembly; if it succeeds, proceed.
 		 */
 		if (((struct ipasfrag *)ip)->ipf_mff & 1 || ip->ip_off) {
-			ipstat.ips_fragments++;
+			STAT(ipstat.ips_fragments++);
 			ip = ip_reass((struct ipasfrag *)ip, fp);
 			if (ip == 0)
 				return;
-			ipstat.ips_reassembled++;
+			STAT(ipstat.ips_reassembled++);
 			m = dtom(ip);
 		} else
 			if (fp)
@@ -208,7 +216,7 @@ ip_input(m)
 	/*
 	 * Switch out to protocol's input routine.
 	 */
-	ipstat.ips_delivered++;
+	STAT(ipstat.ips_delivered++);
 	switch (ip->ip_p) {
 	 case IPPROTO_TCP:
 		tcp_input(m, hlen, (struct socket *)NULL);
@@ -220,7 +228,7 @@ ip_input(m)
 		icmp_input(m, hlen);
 		break;
 	 default:
-		ipstat.ips_noproto++;
+		STAT(ipstat.ips_noproto++);
 		m_free(m);
 	}
 	return;
@@ -235,10 +243,8 @@ bad:
  * reassembly of this datagram already exists, then it
  * is given as fp; otherwise have to make a chain.
  */
-struct ip *
-ip_reass(ip, fp)
-	register struct ipasfrag *ip;
-	register struct ipq *fp;
+static struct ip *
+ip_reass(register struct ipasfrag *ip, register struct ipq *fp)
 {
 	register struct mbuf *m = dtom(ip);
 	register struct ipasfrag *q;
@@ -385,7 +391,7 @@ insert:
 	return ((struct ip *)ip);
 
 dropfrag:
-	ipstat.ips_fragdropped++;
+	STAT(ipstat.ips_fragdropped++);
 	m_freem(m);
 	return (0);
 }
@@ -394,9 +400,8 @@ dropfrag:
  * Free a fragment reassembly header and all
  * associated datagrams.
  */
-void
-ip_freef(fp)
-	struct ipq *fp;
+static void
+ip_freef(struct ipq *fp)
 {
 	register struct ipasfrag *q, *p;
 
@@ -414,9 +419,8 @@ ip_freef(fp)
  * Put an ip fragment on a reassembly chain.
  * Like insque, but pointers in middle of structure.
  */
-void
-ip_enq(p, prev)
-	register struct ipasfrag *p, *prev;
+static void
+ip_enq(register struct ipasfrag *p, register struct ipasfrag *prev)
 {
 	DEBUG_CALL("ip_enq");
 	DEBUG_ARG("prev = %lx", (long)prev);
@@ -429,9 +433,8 @@ ip_enq(p, prev)
 /*
  * To ip_enq as remque is to insque.
  */
-void
-ip_deq(p)
-	register struct ipasfrag *p;
+static void
+ip_deq(register struct ipasfrag *p)
 {
 	((struct ipasfrag *)(p->ipf_prev))->ipf_next = p->ipf_next;
 	((struct ipasfrag *)(p->ipf_next))->ipf_prev = p->ipf_prev;
@@ -457,7 +460,7 @@ ip_slowtimo()
 		--fp->ipq_ttl;
 		fp = (struct ipq *) fp->next;
 		if (((struct ipq *)(fp->prev))->ipq_ttl == 0) {
-			ipstat.ips_fragtimeout++;
+			STAT(ipstat.ips_fragtimeout++);
 			ip_freef((struct ipq *) fp->prev);
 		}
 	}
@@ -664,7 +667,7 @@ bad:
 /* Not yet */
  	icmp_error(m, type, code, 0, 0);
 
-	ipstat.ips_badoptions++;
+	STAT(ipstat.ips_badoptions++);
 	return (1);
 }
 
diff --git a/slirp/ip_output.c b/slirp/ip_output.c
index b1a848402..a8a6067bd 100644
--- a/slirp/ip_output.c
+++ b/slirp/ip_output.c
@@ -46,6 +46,10 @@
 
 u_int16_t ip_id;
 
+/* Number of packets queued before we start sending
+ * (to prevent allocing too many mbufs) */
+#define IF_THRESH 10
+
 /*
  * IP output.  The packet in mbuf chain m contains a skeletal IP
  * header (with len, off, ttl, proto, tos, src, dst).
@@ -80,14 +84,14 @@ ip_output(so, m0)
 	ip->ip_off &= IP_DF;
 	ip->ip_id = htons(ip_id++);
 	ip->ip_hl = hlen >> 2;
-	ipstat.ips_localout++;
+	STAT(ipstat.ips_localout++);
 
 	/*
 	 * Verify that we have any chance at all of being able to queue
 	 *      the packet or packet fragments
 	 */
 	/* XXX Hmmm... */
-/*	if (if_queued > if_thresh && towrite <= 0) {
+/*	if (if_queued > IF_THRESH && towrite <= 0) {
  *		error = ENOBUFS;
  *		goto bad;
  *	}
@@ -96,7 +100,7 @@ ip_output(so, m0)
 	/*
 	 * If small enough for interface, can just send directly.
 	 */
-	if ((u_int16_t)ip->ip_len <= if_mtu) {
+	if ((u_int16_t)ip->ip_len <= IF_MTU) {
 		ip->ip_len = htons((u_int16_t)ip->ip_len);
 		ip->ip_off = htons((u_int16_t)ip->ip_off);
 		ip->ip_sum = 0;
@@ -112,11 +116,11 @@ ip_output(so, m0)
 	 */
 	if (ip->ip_off & IP_DF) {
 		error = -1;
-		ipstat.ips_cantfrag++;
+		STAT(ipstat.ips_cantfrag++);
 		goto bad;
 	}
 
-	len = (if_mtu - hlen) &~ 7;       /* ip databytes per packet */
+	len = (IF_MTU - hlen) &~ 7;       /* ip databytes per packet */
 	if (len < 8) {
 		error = -1;
 		goto bad;
@@ -137,10 +141,10 @@ ip_output(so, m0)
 	  m = m_get();
 	  if (m == 0) {
 	    error = -1;
-	    ipstat.ips_odropped++;
+	    STAT(ipstat.ips_odropped++);
 	    goto sendorfree;
 	  }
-	  m->m_data += if_maxlinkhdr;
+	  m->m_data += IF_MAXLINKHDR;
 	  mhip = mtod(m, struct ip *);
 	  *mhip = *ip;
 
@@ -170,7 +174,7 @@ ip_output(so, m0)
 	  mhip->ip_sum = cksum(m, mhlen);
 	  *mnext = m;
 	  mnext = &m->m_nextpkt;
-	  ipstat.ips_ofragments++;
+	  STAT(ipstat.ips_ofragments++);
 	}
 	/*
 	 * Update first fragment by trimming what's been copied out
@@ -193,7 +197,7 @@ sendorfree:
 	}
 
 	if (error == 0)
-		ipstat.ips_fragmented++;
+		STAT(ipstat.ips_fragmented++);
     }
 
 done:
diff --git a/slirp/libslirp.h b/slirp/libslirp.h
index 639f5f222..7e4cfa98a 100644
--- a/slirp/libslirp.h
+++ b/slirp/libslirp.h
@@ -26,6 +26,8 @@ int slirp_add_exec(int do_pty, const char *args, int addr_low_byte,
 extern const char *tftp_prefix;
 extern char slirp_hostname[33];
 
+void slirp_stats(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/slirp/main.h b/slirp/main.h
index 9cd87584e..c01addac4 100644
--- a/slirp/main.h
+++ b/slirp/main.h
@@ -42,7 +42,6 @@ extern char *username;
 extern char *socket_path;
 extern int towrite_max;
 extern int ppp_exit;
-extern int so_options;
 extern int tcp_keepintvl;
 extern uint8_t client_ethaddr[6];
 
diff --git a/slirp/mbuf.c b/slirp/mbuf.c
index 392aea826..5d1255428 100644
--- a/slirp/mbuf.c
+++ b/slirp/mbuf.c
@@ -21,27 +21,20 @@ struct	mbuf *mbutl;
 char	*mclrefcnt;
 int mbuf_alloced = 0;
 struct mbuf m_freelist, m_usedlist;
-int mbuf_thresh = 30;
+#define MBUF_THRESH 30
 int mbuf_max = 0;
-int msize;
+
+/*
+ * Find a nice value for msize
+ * XXX if_maxlinkhdr already in mtu
+ */
+#define MSIZE (IF_MTU + IF_MAXLINKHDR + sizeof(struct m_hdr ) + 6)
 
 void
 m_init()
 {
 	m_freelist.m_next = m_freelist.m_prev = &m_freelist;
 	m_usedlist.m_next = m_usedlist.m_prev = &m_usedlist;
-	msize_init();
-}
-
-void
-msize_init()
-{
-	/*
-	 * Find a nice value for msize
-	 * XXX if_maxlinkhdr already in mtu
-	 */
-	msize = (if_mtu>if_mru?if_mtu:if_mru) +
-			if_maxlinkhdr + sizeof(struct m_hdr ) + 6;
 }
 
 /*
@@ -61,10 +54,10 @@ m_get()
 	DEBUG_CALL("m_get");
 
 	if (m_freelist.m_next == &m_freelist) {
-		m = (struct mbuf *)malloc(msize);
+		m = (struct mbuf *)malloc(MSIZE);
 		if (m == NULL) goto end_error;
 		mbuf_alloced++;
-		if (mbuf_alloced > mbuf_thresh)
+		if (mbuf_alloced > MBUF_THRESH)
 			flags = M_DOFREE;
 		if (mbuf_alloced > mbuf_max)
 			mbuf_max = mbuf_alloced;
@@ -78,7 +71,7 @@ m_get()
 	m->m_flags = (flags | M_USEDLIST);
 
 	/* Initialise it */
-	m->m_size = msize - sizeof(struct m_hdr);
+	m->m_size = MSIZE - sizeof(struct m_hdr);
 	m->m_data = m->m_dat;
 	m->m_len = 0;
 	m->m_nextpkt = 0;
diff --git a/slirp/mbuf.h b/slirp/mbuf.h
index 1e8f7a8e4..f9f213255 100644
--- a/slirp/mbuf.h
+++ b/slirp/mbuf.h
@@ -135,7 +135,6 @@ extern struct mbuf m_freelist, m_usedlist;
 extern int mbuf_max;
 
 void m_init _P((void));
-void msize_init _P((void));
 struct mbuf * m_get _P((void));
 void m_free _P((struct mbuf *));
 void m_cat _P((register struct mbuf *, register struct mbuf *));
diff --git a/slirp/misc.c b/slirp/misc.c
index a41dd769b..14808fe21 100644
--- a/slirp/misc.c
+++ b/slirp/misc.c
@@ -8,8 +8,7 @@
 #define WANT_SYS_IOCTL_H
 #include <slirp.h>
 
-u_int curtime, time_fasttimo, last_slowtimo, detach_time;
-u_int detach_wait = 600000;	/* 10 minutes */
+u_int curtime, time_fasttimo, last_slowtimo;
 
 #if 0
 int x_port = -1;
@@ -214,10 +213,7 @@ strerror(error)
 #ifdef _WIN32
 
 int
-fork_exec(so, ex, do_pty)
-	struct socket *so;
-	char *ex;
-	int do_pty;
+fork_exec(struct socket *so, const char *ex, int do_pty)
 {
     /* not implemented */
     return 0;
@@ -225,6 +221,7 @@ fork_exec(so, ex, do_pty)
 
 #else
 
+#ifndef CONFIG_QEMU
 int
 slirp_openpty(amaster, aslave)
      int *amaster, *aslave;
@@ -289,6 +286,7 @@ slirp_openpty(amaster, aslave)
 	return (-1);
 #endif
 }
+#endif
 
 /*
  * XXX This is ugly
@@ -302,23 +300,20 @@ slirp_openpty(amaster, aslave)
  * do_ptr = 2   Fork/exec using pty
  */
 int
-fork_exec(so, ex, do_pty)
-	struct socket *so;
-	char *ex;
-	int do_pty;
+fork_exec(struct socket *so, const char *ex, int do_pty)
 {
 	int s;
 	struct sockaddr_in addr;
 	int addrlen = sizeof(addr);
 	int opt;
-        int master;
+        int master = -1;
 	char *argv[256];
 #if 0
 	char buff[256];
 #endif
 	/* don't want to clobber the original */
 	char *bptr;
-	char *curarg;
+	const char *curarg;
 	int c, i, ret;
 
 	DEBUG_CALL("fork_exec");
@@ -327,10 +322,14 @@ fork_exec(so, ex, do_pty)
 	DEBUG_ARG("do_pty = %lx", (long)do_pty);
 
 	if (do_pty == 2) {
+#if 0
 		if (slirp_openpty(&master, &s) == -1) {
 			lprint("Error: openpty failed: %s\n", strerror(errno));
 			return 0;
 		}
+#else
+                return 0;
+#endif
 	} else {
 		addr.sin_family = AF_INET;
 		addr.sin_port = 0;
@@ -390,7 +389,7 @@ fork_exec(so, ex, do_pty)
 		dup2(s, 0);
 		dup2(s, 1);
 		dup2(s, 2);
-		for (s = 3; s <= 255; s++)
+		for (s = getdtablesize() - 1; s >= 3; s--)
 		   close(s);
 
 		i = 0;
@@ -603,6 +602,18 @@ relay(s)
 }
 #endif
 
+#ifdef CONFIG_QEMU
+extern void term_vprintf(const char *fmt, va_list ap);
+
+void lprint(const char *format, ...)
+{
+    va_list args;
+
+    va_start(args, format);
+    term_vprintf(format, args);
+    va_end(args);
+}
+#else
 int (*lprint_print) _P((void *, const char *, va_list));
 char *lprint_ptr, *lprint_ptr2, **lprint_arg;
 
@@ -754,6 +765,7 @@ add_emu(buff)
 
 	lprint("Adding emulation for %s to port %d/%d\r\n", buff1, emup->lport, emup->fport);
 }
+#endif
 
 #ifdef BAD_SPRINTF
 
diff --git a/slirp/misc.h b/slirp/misc.h
index 6484a8126..e405e38dc 100644
--- a/slirp/misc.h
+++ b/slirp/misc.h
@@ -12,12 +12,12 @@ struct ex_list {
 	int ex_pty;			/* Do we want a pty? */
 	int ex_addr;			/* The last byte of the address */
 	int ex_fport;                   /* Port to telnet to */
-	char *ex_exec;                  /* Command line of what to exec */
+	const char *ex_exec;            /* Command line of what to exec */
 	struct ex_list *ex_next;
 };
 
 extern struct ex_list *exec_list;
-extern u_int curtime, time_fasttimo, last_slowtimo, detach_time, detach_wait;
+extern u_int curtime, time_fasttimo, last_slowtimo;
 
 extern int (*lprint_print) _P((void *, const char *, va_list));
 extern char *lprint_ptr, *lprint_ptr2, **lprint_arg;
@@ -63,7 +63,9 @@ struct emu_t {
 	struct emu_t *next;
 };
 
+#ifndef CONFIG_QEMU
 extern struct emu_t *tcpemu;
+#endif
 
 extern int x_port, x_server, x_display;
 
@@ -74,7 +76,7 @@ inline  void slirp_insque  _P((void *, void *));
 inline  void slirp_remque  _P((void *));
 int add_exec _P((struct ex_list **, int, char *, int, int));
 int slirp_openpty _P((int *, int *));
-int fork_exec _P((struct socket *, char *, int));
+int fork_exec(struct socket *so, const char *ex, int do_pty);
 void snooze_hup _P((int));
 void snooze _P((void));
 void relay _P((int));
diff --git a/slirp/sbuf.c b/slirp/sbuf.c
index 209064b1a..02c5fce0a 100644
--- a/slirp/sbuf.c
+++ b/slirp/sbuf.c
@@ -7,6 +7,8 @@
 
 #include <slirp.h>
 
+static void sbappendsb(struct sbuf *sb, struct mbuf *m);
+
 /* Done as a macro in socket.h */
 /* int
  * sbspace(struct sockbuff *sb)
@@ -133,10 +135,8 @@ sbappend(so, m)
  * Copy the data from m into sb
  * The caller is responsible to make sure there's enough room
  */
-void
-sbappendsb(sb, m)
-	 struct sbuf *sb;
-	 struct mbuf *m;
+static void
+sbappendsb(struct sbuf *sb, struct mbuf *m)
 {
 	int len, n,  nn;
 
diff --git a/slirp/sbuf.h b/slirp/sbuf.h
index 89c4eb2f1..a4f103623 100644
--- a/slirp/sbuf.h
+++ b/slirp/sbuf.h
@@ -25,7 +25,6 @@ void sbfree _P((struct sbuf *));
 void sbdrop _P((struct sbuf *, int));
 void sbreserve _P((struct sbuf *, int));
 void sbappend _P((struct socket *, struct mbuf *));
-void sbappendsb _P((struct sbuf *, struct mbuf *));
 void sbcopy _P((struct sbuf *, int, int, char *));
 
 #endif
diff --git a/slirp/slirp.c b/slirp/slirp.c
index f535db12b..303f4825c 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -12,7 +12,7 @@ struct in_addr special_addr;
 /* virtual address alias for host */
 struct in_addr alias_addr;
 
-const uint8_t special_ethaddr[6] = {
+static const uint8_t special_ethaddr[6] = {
     0x52, 0x54, 0x00, 0x12, 0x35, 0x00
 };
 
@@ -93,7 +93,9 @@ static int get_dns_addr(struct in_addr *pdns_addr)
     if (!f)
         return -1;
 
+#ifdef DEBUG
     lprint("IP address of your DNS(s): ");
+#endif
     while (fgets(buff, 512, f) != NULL) {
         if (sscanf(buff, "nameserver%*[ \t]%256s", buff2) == 1) {
             if (!inet_aton(buff2, &tmp_addr))
@@ -103,13 +105,20 @@ static int get_dns_addr(struct in_addr *pdns_addr)
             /* If it's the first one, set it to dns_addr */
             if (!found)
                 *pdns_addr = tmp_addr;
+#ifdef DEBUG
             else
                 lprint(", ");
+#endif
             if (++found > 3) {
+#ifdef DEBUG
                 lprint("(more)");
+#endif
                 break;
-            } else
+            }
+#ifdef DEBUG
+            else
                 lprint("%s", inet_ntoa(tmp_addr));
+#endif
         }
     }
     fclose(f);
@@ -121,7 +130,7 @@ static int get_dns_addr(struct in_addr *pdns_addr)
 #endif
 
 #ifdef _WIN32
-void slirp_cleanup(void)
+static void slirp_cleanup(void)
 {
     WSACleanup();
 }
diff --git a/slirp/slirp.h b/slirp/slirp.h
index 1ff68cb0b..1809ba73c 100644
--- a/slirp/slirp.h
+++ b/slirp/slirp.h
@@ -3,12 +3,21 @@
 
 #define CONFIG_QEMU
 
-#define DEBUG 1
+//#define DEBUG 1
+
+// Uncomment the following line to enable SLIRP statistics printing in Qemu
+//#define LOG_ENABLED
+
+#ifdef LOG_ENABLED
+#define STAT(expr) expr
+#else
+#define STAT(expr) do { } while(0)
+#endif
 
 #ifndef CONFIG_QEMU
 #include "version.h"
 #endif
-#include "config.h"
+#include "config-host.h"
 #include "slirp_config.h"
 
 #ifdef _WIN32
@@ -255,8 +264,6 @@ void if_start _P((struct ttys *));
 
 void lprint _P((const char *, ...));
 
-extern int do_echo;
-
 #if SIZEOF_CHAR_P == 4
 # define insque_32 insque
 # define remque_32 remque
@@ -271,6 +278,9 @@ extern int do_echo;
 
 #define DEFAULT_BAUD 115200
 
+#define SO_OPTIONS DO_KEEPALIVE
+#define TCP_MAXIDLE (TCPTV_KEEPCNT * TCPTV_KEEPINTVL)
+
 /* cksum.c */
 int cksum(struct mbuf *m, int len);
 
@@ -281,10 +291,6 @@ void if_output _P((struct socket *, struct mbuf *));
 /* ip_input.c */
 void ip_init _P((void));
 void ip_input _P((struct mbuf *));
-struct ip * ip_reass _P((register struct ipasfrag *, register struct ipq *));
-void ip_freef _P((struct ipq *));
-void ip_enq _P((register struct ipasfrag *, register struct ipasfrag *));
-void ip_deq _P((register struct ipasfrag *));
 void ip_slowtimo _P((void));
 void ip_stripoptions _P((register struct mbuf *, struct mbuf *));
 
@@ -292,10 +298,7 @@ void ip_stripoptions _P((register struct mbuf *, struct mbuf *));
 int ip_output _P((struct socket *, struct mbuf *));
 
 /* tcp_input.c */
-int tcp_reass _P((register struct tcpcb *, register struct tcpiphdr *, struct mbuf *));
 void tcp_input _P((register struct mbuf *, int, struct socket *));
-void tcp_dooptions _P((struct tcpcb *, u_char *, int, struct tcpiphdr *));
-void tcp_xmit_timer _P((register struct tcpcb *, int));
 int tcp_mss _P((register struct tcpcb *, u_int));
 
 /* tcp_output.c */
@@ -308,7 +311,6 @@ void tcp_template _P((struct tcpcb *));
 void tcp_respond _P((struct tcpcb *, register struct tcpiphdr *, register struct mbuf *, tcp_seq, tcp_seq, int));
 struct tcpcb * tcp_newtcpcb _P((struct socket *));
 struct tcpcb * tcp_close _P((register struct tcpcb *));
-void tcp_drain _P((void));
 void tcp_sockclosed _P((struct tcpcb *));
 int tcp_fconnect _P((struct socket *));
 void tcp_connect _P((struct socket *));
diff --git a/slirp/socket.c b/slirp/socket.c
index 7e07cf894..0c15132ea 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -13,12 +13,16 @@
 #include <sys/filio.h>
 #endif
 
-void
+static void sofcantrcvmore(struct socket *so);
+static void sofcantsendmore(struct socket *so);
+
+#if 0
+static void
 so_init()
 {
 	/* Nothing yet */
 }
-
+#endif
 
 struct socket *
 solookup(head, laddr, lport, faddr, fport)
@@ -421,7 +425,7 @@ sorecvfrom(so)
 	  int len, n;
 
 	  if (!(m = m_get())) return;
-	  m->m_data += if_maxlinkhdr;
+	  m->m_data += IF_MAXLINKHDR;
 
 	  /*
 	   * XXX Shouldn't FIONREAD packets destined for port 53,
@@ -604,12 +608,13 @@ solisten(port, laddr, lport, flags)
 	return so;
 }
 
+#if 0
 /*
  * Data is available in so_rcv
  * Just write() the data to the socket
  * XXX not yet...
  */
-void
+static void
 sorwakeup(so)
 	struct socket *so;
 {
@@ -622,12 +627,13 @@ sorwakeup(so)
  * We have room for a read() if we want to
  * For now, don't read, it'll be done in the main loop
  */
-void
+static void
 sowwakeup(so)
 	struct socket *so;
 {
 	/* Nothing, yet */
 }
+#endif
 
 /*
  * Various session state calls
@@ -652,9 +658,8 @@ soisfconnected(so)
 	so->so_state |= SS_ISFCONNECTED; /* Clobber other states */
 }
 
-void
-sofcantrcvmore(so)
-	struct  socket *so;
+static void
+sofcantrcvmore(struct socket *so)
 {
 	if ((so->so_state & SS_NOFDREF) == 0) {
 		shutdown(so->s,0);
@@ -669,9 +674,8 @@ sofcantrcvmore(so)
 	   so->so_state |= SS_FCANTRCVMORE;
 }
 
-void
-sofcantsendmore(so)
-	struct socket *so;
+static void
+sofcantsendmore(struct socket *so)
 {
 	if ((so->so_state & SS_NOFDREF) == 0) {
             shutdown(so->s,1);           /* send FIN to fhost */
diff --git a/slirp/socket.h b/slirp/socket.h
index 99cc17f32..94fb8d8cf 100644
--- a/slirp/socket.h
+++ b/slirp/socket.h
@@ -81,7 +81,6 @@ struct iovec {
 };
 #endif
 
-void so_init _P((void));
 struct socket * solookup _P((struct socket *, struct in_addr, u_int, struct in_addr, u_int));
 struct socket * socreate _P((void));
 void sofree _P((struct socket *));
@@ -92,12 +91,8 @@ int sowrite _P((struct socket *));
 void sorecvfrom _P((struct socket *));
 int sosendto _P((struct socket *, struct mbuf *));
 struct socket * solisten _P((u_int, u_int32_t, u_int, int));
-void sorwakeup _P((struct socket *));
-void sowwakeup _P((struct socket *));
 void soisfconnecting _P((register struct socket *));
 void soisfconnected _P((register struct socket *));
-void sofcantrcvmore _P((struct  socket *));
-void sofcantsendmore _P((struct socket *));
 void soisfdisconnected _P((struct socket *));
 void sofwdrain _P((struct socket *));
 
diff --git a/slirp/tcp.h b/slirp/tcp.h
index 229293c49..11150766d 100644
--- a/slirp/tcp.h
+++ b/slirp/tcp.h
@@ -42,8 +42,6 @@ typedef	u_int32_t	tcp_seq;
 #define      PR_SLOWHZ       2               /* 2 slow timeouts per second (approx) */
 #define      PR_FASTHZ       5               /* 5 fast timeouts per second (not important) */
 
-extern int tcp_rcvspace;
-extern int tcp_sndspace;
 extern struct socket *tcp_last_so;
 
 #define TCP_SNDSPACE 8192
@@ -172,6 +170,6 @@ struct tcphdr {
 
 extern tcp_seq tcp_iss;                /* tcp initial send seq # */
 
-extern char *tcpstates[];
+extern const char * const tcpstates[];
 
 #endif
diff --git a/slirp/tcp_input.c b/slirp/tcp_input.c
index 04f655312..17a9387f0 100644
--- a/slirp/tcp_input.c
+++ b/slirp/tcp_input.c
@@ -47,7 +47,7 @@
 
 struct socket tcb;
 
-int	tcprexmtthresh = 3;
+#define	TCPREXMTTHRESH 3
 struct	socket *tcp_last_so = &tcb;
 
 tcp_seq tcp_iss;                /* tcp initial send seq # */
@@ -79,8 +79,8 @@ tcp_seq tcp_iss;                /* tcp initial send seq # */
                        tp->t_flags |= TF_DELACK; \
                (tp)->rcv_nxt += (ti)->ti_len; \
                flags = (ti)->ti_flags & TH_FIN; \
-               tcpstat.tcps_rcvpack++;\
-               tcpstat.tcps_rcvbyte += (ti)->ti_len;\
+               STAT(tcpstat.tcps_rcvpack++);         \
+               STAT(tcpstat.tcps_rcvbyte += (ti)->ti_len);   \
                if (so->so_emu) { \
 		       if (tcp_emu((so),(m))) sbappend((so), (m)); \
 	       } else \
@@ -99,8 +99,8 @@ tcp_seq tcp_iss;                /* tcp initial send seq # */
 		tp->t_flags |= TF_DELACK; \
 		(tp)->rcv_nxt += (ti)->ti_len; \
 		flags = (ti)->ti_flags & TH_FIN; \
-		tcpstat.tcps_rcvpack++;\
-		tcpstat.tcps_rcvbyte += (ti)->ti_len;\
+		STAT(tcpstat.tcps_rcvpack++);        \
+		STAT(tcpstat.tcps_rcvbyte += (ti)->ti_len);  \
 		if (so->so_emu) { \
 			if (tcp_emu((so),(m))) sbappend(so, (m)); \
 		} else \
@@ -112,12 +112,13 @@ tcp_seq tcp_iss;                /* tcp initial send seq # */
 	} \
 }
 #endif
+static void tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt,
+                          struct tcpiphdr *ti);
+static void tcp_xmit_timer(register struct tcpcb *tp, int rtt);
 
-int
-tcp_reass(tp, ti, m)
-	register struct tcpcb *tp;
-	register struct tcpiphdr *ti;
-	struct mbuf *m;
+static int
+tcp_reass(register struct tcpcb *tp, register struct tcpiphdr *ti,
+          struct mbuf *m)
 {
 	register struct tcpiphdr *q;
 	struct socket *so = tp->t_socket;
@@ -150,8 +151,8 @@ tcp_reass(tp, ti, m)
 		i = q->ti_seq + q->ti_len - ti->ti_seq;
 		if (i > 0) {
 			if (i >= ti->ti_len) {
-				tcpstat.tcps_rcvduppack++;
-				tcpstat.tcps_rcvdupbyte += ti->ti_len;
+				STAT(tcpstat.tcps_rcvduppack++);
+				STAT(tcpstat.tcps_rcvdupbyte += ti->ti_len);
 				m_freem(m);
 				/*
 				 * Try to present any queued data
@@ -167,8 +168,8 @@ tcp_reass(tp, ti, m)
 		}
 		q = (struct tcpiphdr *)(q->ti_next);
 	}
-	tcpstat.tcps_rcvoopack++;
-	tcpstat.tcps_rcvoobyte += ti->ti_len;
+	STAT(tcpstat.tcps_rcvoopack++);
+	STAT(tcpstat.tcps_rcvoobyte += ti->ti_len);
 	REASS_MBUF(ti) = (mbufp_32) m;		/* XXX */
 
 	/*
@@ -275,7 +276,7 @@ tcp_input(m, iphlen, inso)
 	}
 
 
-	tcpstat.tcps_rcvtotal++;
+	STAT(tcpstat.tcps_rcvtotal++);
 	/*
 	 * Get IP and TCP header together in first mbuf.
 	 * Note: IP leaves IP header in first mbuf.
@@ -308,7 +309,7 @@ tcp_input(m, iphlen, inso)
 	 * ti->ti_sum = cksum(m, len);
 	 * if (ti->ti_sum) { */
 	if(cksum(m, len)) {
-	  tcpstat.tcps_rcvbadsum++;
+	  STAT(tcpstat.tcps_rcvbadsum++);
 	  goto drop;
 	}
 
@@ -318,7 +319,7 @@ tcp_input(m, iphlen, inso)
 	 */
 	off = ti->ti_off << 2;
 	if (off < sizeof (struct tcphdr) || off > tlen) {
-	  tcpstat.tcps_rcvbadoff++;
+	  STAT(tcpstat.tcps_rcvbadoff++);
 	  goto drop;
 	}
 	tlen -= off;
@@ -375,7 +376,7 @@ findso:
 			       ti->ti_dst, ti->ti_dport);
 		if (so)
 			tcp_last_so = so;
-		++tcpstat.tcps_socachemiss;
+		STAT(tcpstat.tcps_socachemiss++);
 	}
 
 	/*
@@ -402,8 +403,8 @@ findso:
 	    goto dropwithreset;
 	  }
 
-	  sbreserve(&so->so_snd, tcp_sndspace);
-	  sbreserve(&so->so_rcv, tcp_rcvspace);
+	  sbreserve(&so->so_snd, TCP_SNDSPACE);
+	  sbreserve(&so->so_rcv, TCP_RCVSPACE);
 
 	  /*		tcp_last_so = so; */  /* XXX ? */
 	  /*		tp = sototcpcb(so);    */
@@ -448,10 +449,10 @@ findso:
 	 * Reset idle time and keep-alive timer.
 	 */
 	tp->t_idle = 0;
-	if (so_options)
-	   tp->t_timer[TCPT_KEEP] = tcp_keepintvl;
+	if (SO_OPTIONS)
+	   tp->t_timer[TCPT_KEEP] = TCPTV_KEEPINTVL;
 	else
-	   tp->t_timer[TCPT_KEEP] = tcp_keepidle;
+	   tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_IDLE;
 
 	/*
 	 * Process options if not in LISTEN state,
@@ -503,7 +504,7 @@ findso:
 				/*
 				 * this is a pure ack for outstanding data.
 				 */
-				++tcpstat.tcps_predack;
+				STAT(tcpstat.tcps_predack++);
 /*				if (ts_present)
  *					tcp_xmit_timer(tp, tcp_now-ts_ecr+1);
  *				else
@@ -511,8 +512,8 @@ findso:
 					    SEQ_GT(ti->ti_ack, tp->t_rtseq))
 					tcp_xmit_timer(tp, tp->t_rtt);
 				acked = ti->ti_ack - tp->snd_una;
-				tcpstat.tcps_rcvackpack++;
-				tcpstat.tcps_rcvackbyte += acked;
+				STAT(tcpstat.tcps_rcvackpack++);
+				STAT(tcpstat.tcps_rcvackbyte += acked);
 				sbdrop(&so->so_snd, acked);
 				tp->snd_una = ti->ti_ack;
 				m_freem(m);
@@ -556,10 +557,10 @@ findso:
 			 * with nothing on the reassembly queue and
 			 * we have enough buffer space to take it.
 			 */
-			++tcpstat.tcps_preddat;
+			STAT(tcpstat.tcps_preddat++);
 			tp->rcv_nxt += ti->ti_len;
-			tcpstat.tcps_rcvpack++;
-			tcpstat.tcps_rcvbyte += ti->ti_len;
+			STAT(tcpstat.tcps_rcvpack++);
+			STAT(tcpstat.tcps_rcvbyte += ti->ti_len);
 			/*
 			 * Add data to socket buffer.
 			 */
@@ -726,7 +727,7 @@ findso:
 	  tp->t_flags |= TF_ACKNOW;
 	  tp->t_state = TCPS_SYN_RECEIVED;
 	  tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
-	  tcpstat.tcps_accepts++;
+	  STAT(tcpstat.tcps_accepts++);
 	  goto trimthenstep6;
 	} /* case TCPS_LISTEN */
 
@@ -767,7 +768,7 @@ findso:
 		tcp_rcvseqinit(tp);
 		tp->t_flags |= TF_ACKNOW;
 		if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) {
-			tcpstat.tcps_connects++;
+			STAT(tcpstat.tcps_connects++);
 			soisfconnected(so);
 			tp->t_state = TCPS_ESTABLISHED;
 
@@ -801,8 +802,8 @@ trimthenstep6:
 			m_adj(m, -todrop);
 			ti->ti_len = tp->rcv_wnd;
 			tiflags &= ~TH_FIN;
-			tcpstat.tcps_rcvpackafterwin++;
-			tcpstat.tcps_rcvbyteafterwin += todrop;
+			STAT(tcpstat.tcps_rcvpackafterwin++);
+			STAT(tcpstat.tcps_rcvbyteafterwin += todrop);
 		}
 		tp->snd_wl1 = ti->ti_seq - 1;
 		tp->rcv_up = ti->ti_seq;
@@ -873,11 +874,11 @@ trimthenstep6:
 			 */
 			tp->t_flags |= TF_ACKNOW;
 			todrop = ti->ti_len;
-			tcpstat.tcps_rcvduppack++;
-			tcpstat.tcps_rcvdupbyte += todrop;
+			STAT(tcpstat.tcps_rcvduppack++);
+			STAT(tcpstat.tcps_rcvdupbyte += todrop);
 		} else {
-			tcpstat.tcps_rcvpartduppack++;
-			tcpstat.tcps_rcvpartdupbyte += todrop;
+			STAT(tcpstat.tcps_rcvpartduppack++);
+			STAT(tcpstat.tcps_rcvpartdupbyte += todrop);
 		}
 		m_adj(m, todrop);
 		ti->ti_seq += todrop;
@@ -896,7 +897,7 @@ trimthenstep6:
 	if ((so->so_state & SS_NOFDREF) &&
 	    tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) {
 		tp = tcp_close(tp);
-		tcpstat.tcps_rcvafterclose++;
+		STAT(tcpstat.tcps_rcvafterclose++);
 		goto dropwithreset;
 	}
 
@@ -906,9 +907,9 @@ trimthenstep6:
 	 */
 	todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
 	if (todrop > 0) {
-		tcpstat.tcps_rcvpackafterwin++;
+		STAT(tcpstat.tcps_rcvpackafterwin++);
 		if (todrop >= ti->ti_len) {
-			tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
+			STAT(tcpstat.tcps_rcvbyteafterwin += ti->ti_len);
 			/*
 			 * If a new connection request is received
 			 * while in TIME_WAIT, drop the old connection
@@ -931,11 +932,11 @@ trimthenstep6:
 			 */
 			if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) {
 				tp->t_flags |= TF_ACKNOW;
-				tcpstat.tcps_rcvwinprobe++;
+				STAT(tcpstat.tcps_rcvwinprobe++);
 			} else
 				goto dropafterack;
 		} else
-			tcpstat.tcps_rcvbyteafterwin += todrop;
+			STAT(tcpstat.tcps_rcvbyteafterwin += todrop);
 		m_adj(m, -todrop);
 		ti->ti_len -= todrop;
 		tiflags &= ~(TH_PUSH|TH_FIN);
@@ -976,7 +977,7 @@ trimthenstep6:
 /*		so->so_error = ECONNRESET; */
 	close:
 		tp->t_state = TCPS_CLOSED;
-		tcpstat.tcps_drops++;
+		STAT(tcpstat.tcps_drops++);
 		tp = tcp_close(tp);
 		goto drop;
 
@@ -1015,7 +1016,7 @@ trimthenstep6:
 		if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
 		    SEQ_GT(ti->ti_ack, tp->snd_max))
 			goto dropwithreset;
-		tcpstat.tcps_connects++;
+		STAT(tcpstat.tcps_connects++);
 		tp->t_state = TCPS_ESTABLISHED;
 		/*
 		 * The sent SYN is ack'ed with our sequence number +1
@@ -1072,7 +1073,7 @@ trimthenstep6:
 
 		if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) {
 			if (ti->ti_len == 0 && tiwin == tp->snd_wnd) {
-			  tcpstat.tcps_rcvdupack++;
+			  STAT(tcpstat.tcps_rcvdupack++);
 			  DEBUG_MISC((dfd," dup ack  m = %lx  so = %lx \n",
 				      (long )m, (long )so));
 				/*
@@ -1102,7 +1103,7 @@ trimthenstep6:
 				if (tp->t_timer[TCPT_REXMT] == 0 ||
 				    ti->ti_ack != tp->snd_una)
 					tp->t_dupacks = 0;
-				else if (++tp->t_dupacks == tcprexmtthresh) {
+				else if (++tp->t_dupacks == TCPREXMTTHRESH) {
 					tcp_seq onxt = tp->snd_nxt;
 					u_int win =
 					    min(tp->snd_wnd, tp->snd_cwnd) / 2 /
@@ -1121,7 +1122,7 @@ trimthenstep6:
 					if (SEQ_GT(onxt, tp->snd_nxt))
 						tp->snd_nxt = onxt;
 					goto drop;
-				} else if (tp->t_dupacks > tcprexmtthresh) {
+				} else if (tp->t_dupacks > TCPREXMTTHRESH) {
 					tp->snd_cwnd += tp->t_maxseg;
 					(void) tcp_output(tp);
 					goto drop;
@@ -1135,17 +1136,17 @@ trimthenstep6:
 		 * If the congestion window was inflated to account
 		 * for the other side's cached packets, retract it.
 		 */
-		if (tp->t_dupacks > tcprexmtthresh &&
+		if (tp->t_dupacks > TCPREXMTTHRESH &&
 		    tp->snd_cwnd > tp->snd_ssthresh)
 			tp->snd_cwnd = tp->snd_ssthresh;
 		tp->t_dupacks = 0;
 		if (SEQ_GT(ti->ti_ack, tp->snd_max)) {
-			tcpstat.tcps_rcvacktoomuch++;
+			STAT(tcpstat.tcps_rcvacktoomuch++);
 			goto dropafterack;
 		}
 		acked = ti->ti_ack - tp->snd_una;
-		tcpstat.tcps_rcvackpack++;
-		tcpstat.tcps_rcvackbyte += acked;
+		STAT(tcpstat.tcps_rcvackpack++);
+		STAT(tcpstat.tcps_rcvackbyte += acked);
 
 		/*
 		 * If we have a timestamp reply, update smoothed
@@ -1227,7 +1228,7 @@ trimthenstep6:
 				 */
 				if (so->so_state & SS_FCANTRCVMORE) {
 					soisfdisconnected(so);
-					tp->t_timer[TCPT_2MSL] = tcp_maxidle;
+					tp->t_timer[TCPT_2MSL] = TCP_MAXIDLE;
 				}
 				tp->t_state = TCPS_FIN_WAIT_2;
 			}
@@ -1284,7 +1285,7 @@ step6:
 		/* keep track of pure window updates */
 		if (ti->ti_len == 0 &&
 		    tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd)
-			tcpstat.tcps_rcvwinupd++;
+			STAT(tcpstat.tcps_rcvwinupd++);
 		tp->snd_wnd = tiwin;
 		tp->snd_wl1 = ti->ti_seq;
 		tp->snd_wl2 = ti->ti_ack;
@@ -1490,12 +1491,8 @@ drop:
 /*	int *ts_present;
  *	u_int32_t *ts_val, *ts_ecr;
  */
-void
-tcp_dooptions(tp, cp, cnt, ti)
-	struct tcpcb *tp;
-	u_char *cp;
-	int cnt;
-	struct tcpiphdr *ti;
+static void
+tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt, struct tcpiphdr *ti)
 {
 	u_int16_t mss;
 	int opt, optlen;
@@ -1605,10 +1602,8 @@ tcp_pulloutofband(so, ti, m)
  * and update averages and current timeout.
  */
 
-void
-tcp_xmit_timer(tp, rtt)
-	register struct tcpcb *tp;
-	int rtt;
+static void
+tcp_xmit_timer(register struct tcpcb *tp, int rtt)
 {
 	register short delta;
 
@@ -1616,7 +1611,7 @@ tcp_xmit_timer(tp, rtt)
 	DEBUG_ARG("tp = %lx", (long)tp);
 	DEBUG_ARG("rtt = %d", rtt);
 
-	tcpstat.tcps_rttupdated++;
+	STAT(tcpstat.tcps_rttupdated++);
 	if (tp->t_srtt != 0) {
 		/*
 		 * srtt is stored as fixed point with 3 bits after the
@@ -1707,7 +1702,7 @@ tcp_mss(tp, offer)
 	DEBUG_ARG("tp = %lx", (long)tp);
 	DEBUG_ARG("offer = %d", offer);
 
-	mss = min(if_mtu, if_mru) - sizeof(struct tcpiphdr);
+	mss = min(IF_MTU, IF_MRU) - sizeof(struct tcpiphdr);
 	if (offer)
 		mss = min(mss, offer);
 	mss = max(mss, 32);
@@ -1716,8 +1711,12 @@ tcp_mss(tp, offer)
 
 	tp->snd_cwnd = mss;
 
-	sbreserve(&so->so_snd, tcp_sndspace+((tcp_sndspace%mss)?(mss-(tcp_sndspace%mss)):0));
-	sbreserve(&so->so_rcv, tcp_rcvspace+((tcp_rcvspace%mss)?(mss-(tcp_rcvspace%mss)):0));
+	sbreserve(&so->so_snd, TCP_SNDSPACE + ((TCP_SNDSPACE % mss) ?
+                                               (mss - (TCP_SNDSPACE % mss)) :
+                                               0));
+	sbreserve(&so->so_rcv, TCP_RCVSPACE + ((TCP_RCVSPACE % mss) ?
+                                               (mss - (TCP_RCVSPACE % mss)) :
+                                               0));
 
 	DEBUG_MISC((dfd, " returning mss = %d\n", mss));
 
diff --git a/slirp/tcp_output.c b/slirp/tcp_output.c
index 3eddfd38e..dba4ed7a5 100644
--- a/slirp/tcp_output.c
+++ b/slirp/tcp_output.c
@@ -48,14 +48,14 @@
  * Since this is only used in "stats socket", we give meaning
  * names instead of the REAL names
  */
-char *tcpstates[] = {
+const char * const tcpstates[] = {
 /*	"CLOSED",       "LISTEN",       "SYN_SENT",     "SYN_RCVD", */
 	"REDIRECT",	"LISTEN",	"SYN_SENT",     "SYN_RCVD",
 	"ESTABLISHED",  "CLOSE_WAIT",   "FIN_WAIT_1",   "CLOSING",
 	"LAST_ACK",     "FIN_WAIT_2",   "TIME_WAIT",
 };
 
-u_char  tcp_outflags[TCP_NSTATES] = {
+static const u_char  tcp_outflags[TCP_NSTATES] = {
 	TH_RST|TH_ACK, 0,      TH_SYN,        TH_SYN|TH_ACK,
 	TH_ACK,        TH_ACK, TH_FIN|TH_ACK, TH_FIN|TH_ACK,
 	TH_FIN|TH_ACK, TH_ACK, TH_ACK,
@@ -263,7 +263,7 @@ again:
 	/*
 	 * No reason to send a segment, just return.
 	 */
-	tcpstat.tcps_didnuttin++;
+	STAT(tcpstat.tcps_didnuttin++);
 
 	return (0);
 
@@ -339,13 +339,13 @@ send:
 	 */
 	if (len) {
 		if (tp->t_force && len == 1)
-			tcpstat.tcps_sndprobe++;
+			STAT(tcpstat.tcps_sndprobe++);
 		else if (SEQ_LT(tp->snd_nxt, tp->snd_max)) {
-			tcpstat.tcps_sndrexmitpack++;
-			tcpstat.tcps_sndrexmitbyte += len;
+			STAT(tcpstat.tcps_sndrexmitpack++);
+			STAT(tcpstat.tcps_sndrexmitbyte += len);
 		} else {
-			tcpstat.tcps_sndpack++;
-			tcpstat.tcps_sndbyte += len;
+			STAT(tcpstat.tcps_sndpack++);
+			STAT(tcpstat.tcps_sndbyte += len);
 		}
 
 		m = m_get();
@@ -354,7 +354,7 @@ send:
 			error = 1;
 			goto out;
 		}
-		m->m_data += if_maxlinkhdr;
+		m->m_data += IF_MAXLINKHDR;
 		m->m_len = hdrlen;
 
 		/*
@@ -382,13 +382,13 @@ send:
 			flags |= TH_PUSH;
 	} else {
 		if (tp->t_flags & TF_ACKNOW)
-			tcpstat.tcps_sndacks++;
+			STAT(tcpstat.tcps_sndacks++);
 		else if (flags & (TH_SYN|TH_FIN|TH_RST))
-			tcpstat.tcps_sndctrl++;
+			STAT(tcpstat.tcps_sndctrl++);
 		else if (SEQ_GT(tp->snd_up, tp->snd_una))
-			tcpstat.tcps_sndurg++;
+			STAT(tcpstat.tcps_sndurg++);
 		else
-			tcpstat.tcps_sndwinup++;
+			STAT(tcpstat.tcps_sndwinup++);
 
 		m = m_get();
 		if (m == NULL) {
@@ -396,7 +396,7 @@ send:
 			error = 1;
 			goto out;
 		}
-		m->m_data += if_maxlinkhdr;
+		m->m_data += IF_MAXLINKHDR;
 		m->m_len = hdrlen;
 	}
 
@@ -500,7 +500,7 @@ send:
 			if (tp->t_rtt == 0) {
 				tp->t_rtt = 1;
 				tp->t_rtseq = startseq;
-				tcpstat.tcps_segstimed++;
+				STAT(tcpstat.tcps_segstimed++);
 			}
 		}
 
@@ -536,7 +536,7 @@ send:
 
 	((struct ip *)ti)->ip_len = m->m_len;
 
-	((struct ip *)ti)->ip_ttl = ip_defttl;
+	((struct ip *)ti)->ip_ttl = IPDEFTTL;
 	((struct ip *)ti)->ip_tos = so->so_iptos;
 
 /* #if BSD >= 43 */
@@ -567,7 +567,7 @@ out:
  */
 		return (error);
 	}
-	tcpstat.tcps_sndtotal++;
+	STAT(tcpstat.tcps_sndtotal++);
 
 	/*
 	 * Data sent (as far as we can tell).
diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
index 3814ec19b..ba1296d4b 100644
--- a/slirp/tcp_subr.c
+++ b/slirp/tcp_subr.c
@@ -46,11 +46,8 @@
 #include <slirp.h>
 
 /* patchable/settable parameters for tcp */
-int 	tcp_mssdflt = TCP_MSS;
-int 	tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
-int	tcp_do_rfc1323 = 0;	/* Don't do rfc1323 performance enhancements */
-int	tcp_rcvspace;	/* You may want to change this */
-int	tcp_sndspace;	/* Keep small if you have an error prone link */
+/* Don't do rfc1323 performance enhancements */
+#define TCP_DO_RFC1323 0
 
 /*
  * Tcp initialization
@@ -60,14 +57,6 @@ tcp_init()
 {
 	tcp_iss = 1;		/* wrong */
 	tcb.so_next = tcb.so_prev = &tcb;
-
-	/* tcp_rcvspace = our Window we advertise to the remote */
-	tcp_rcvspace = TCP_RCVSPACE;
-	tcp_sndspace = TCP_SNDSPACE;
-
-	/* Make sure tcp_sndspace is at least 2*MSS */
-	if (tcp_sndspace < 2*(min(if_mtu, if_mru) - sizeof(struct tcpiphdr)))
-		tcp_sndspace = 2*(min(if_mtu, if_mru) - sizeof(struct tcpiphdr));
 }
 
 /*
@@ -145,7 +134,7 @@ tcp_respond(tp, ti, m, ack, seq, flags)
 #else
 		tlen = 0;
 #endif
-		m->m_data += if_maxlinkhdr;
+		m->m_data += IF_MAXLINKHDR;
 		*mtod(m, struct tcpiphdr *) = *ti;
 		ti = mtod(m, struct tcpiphdr *);
 		flags = TH_ACK;
@@ -186,7 +175,7 @@ tcp_respond(tp, ti, m, ack, seq, flags)
 	if(flags & TH_RST)
 	  ((struct ip *)ti)->ip_ttl = MAXTTL;
 	else
-	  ((struct ip *)ti)->ip_ttl = ip_defttl;
+	  ((struct ip *)ti)->ip_ttl = IPDEFTTL;
 
 	(void) ip_output((struct socket *)0, m);
 }
@@ -208,9 +197,9 @@ tcp_newtcpcb(so)
 
 	memset((char *) tp, 0, sizeof(struct tcpcb));
 	tp->seg_next = tp->seg_prev = (tcpiphdrp_32)tp;
-	tp->t_maxseg = tcp_mssdflt;
+	tp->t_maxseg = TCP_MSS;
 
-	tp->t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
+	tp->t_flags = TCP_DO_RFC1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
 	tp->t_socket = so;
 
 	/*
@@ -219,7 +208,7 @@ tcp_newtcpcb(so)
 	 * reasonable initial retransmit time.
 	 */
 	tp->t_srtt = TCPTV_SRTTBASE;
-	tp->t_rttvar = tcp_rttdflt * PR_SLOWHZ << 2;
+	tp->t_rttvar = TCPTV_SRTTDFLT << 2;
 	tp->t_rttmin = TCPTV_MIN;
 
 	TCPT_RANGESET(tp->t_rxtcur,
@@ -255,9 +244,9 @@ struct tcpcb *tcp_drop(struct tcpcb *tp, int err)
 	if (TCPS_HAVERCVDSYN(tp->t_state)) {
 		tp->t_state = TCPS_CLOSED;
 		(void) tcp_output(tp);
-		tcpstat.tcps_drops++;
+		STAT(tcpstat.tcps_drops++);
 	} else
-		tcpstat.tcps_conndrops++;
+		STAT(tcpstat.tcps_conndrops++);
 /*	if (errno == ETIMEDOUT && tp->t_softerror)
  *		errno = tp->t_softerror;
  */
@@ -305,10 +294,11 @@ tcp_close(tp)
 	sbfree(&so->so_rcv);
 	sbfree(&so->so_snd);
 	sofree(so);
-	tcpstat.tcps_closed++;
+	STAT(tcpstat.tcps_closed++);
 	return ((struct tcpcb *)0);
 }
 
+#ifdef notdef
 void
 tcp_drain()
 {
@@ -319,9 +309,6 @@ tcp_drain()
  * When a source quench is received, close congestion window
  * to one segment.  We will gradually open it again as we proceed.
  */
-
-#ifdef notdef
-
 void
 tcp_quench(i, errno)
 
@@ -528,7 +515,7 @@ tcp_connect(inso)
  */
 
 /*	soisconnecting(so); */ /* NOFDREF used instead */
-	tcpstat.tcps_connattempt++;
+	STAT(tcpstat.tcps_connattempt++);
 
 	tp->t_state = TCPS_SYN_SENT;
 	tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
@@ -556,7 +543,7 @@ tcp_attach(so)
 /*
  * Set the socket's type of service field
  */
-struct tos_t tcptos[] = {
+static const struct tos_t tcptos[] = {
 	  {0, 20, IPTOS_THROUGHPUT, 0},	/* ftp data */
 	  {21, 21, IPTOS_LOWDELAY,  EMU_FTP},	/* ftp control */
 	  {0, 23, IPTOS_LOWDELAY, 0},	/* telnet */
@@ -572,6 +559,9 @@ struct tos_t tcptos[] = {
 	  {0, 0, 0, 0}
 };
 
+#ifdef CONFIG_QEMU
+static
+#endif
 struct emu_t *tcpemu = 0;
 
 /*
@@ -605,7 +595,9 @@ tcp_tos(so)
 	return 0;
 }
 
+#if 0
 int do_echo = -1;
+#endif
 
 /*
  * Emulate programs that try and connect to us
@@ -665,7 +657,7 @@ tcp_emu(so, m)
 			so_rcv->sb_rptr += m->m_len;
 			m->m_data[m->m_len] = 0; /* NULL terminate */
 			if (strchr(m->m_data, '\r') || strchr(m->m_data, '\n')) {
-				if (sscanf(so_rcv->sb_data, "%d%*[ ,]%d", &n1, &n2) == 2) {
+				if (sscanf(so_rcv->sb_data, "%u%*[ ,]%u", &n1, &n2) == 2) {
 					HTONS(n1);
 					HTONS(n2);
 					/* n2 is the one on our host */
@@ -857,7 +849,7 @@ tcp_emu(so, m)
 
                 /*soisfconnecting(ns);*/
 
-				tcpstat.tcps_connattempt++;
+				STAT(tcpstat.tcps_connattempt++);
 
 				tp->t_state = TCPS_SYN_SENT;
 				tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
@@ -991,7 +983,7 @@ do_prompt:
 			/*
 			 * Need to emulate the PORT command
 			 */
-			x = sscanf(bptr, "ORT %d,%d,%d,%d,%d,%d\r\n%256[^\177]",
+			x = sscanf(bptr, "ORT %u,%u,%u,%u,%u,%u\r\n%256[^\177]",
 				   &n1, &n2, &n3, &n4, &n5, &n6, buff);
 			if (x < 6)
 			   return 1;
@@ -1022,7 +1014,7 @@ do_prompt:
 			/*
 			 * Need to emulate the PASV response
 			 */
-			x = sscanf(bptr, "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%256[^\177]",
+			x = sscanf(bptr, "27 Entering Passive Mode (%u,%u,%u,%u,%u,%u)\r\n%256[^\177]",
 				   &n1, &n2, &n3, &n4, &n5, &n6, buff);
 			if (x < 6)
 			   return 1;
diff --git a/slirp/tcp_timer.c b/slirp/tcp_timer.c
index cc1bd50c0..244bad6a8 100644
--- a/slirp/tcp_timer.c
+++ b/slirp/tcp_timer.c
@@ -36,14 +36,14 @@
 
 #include <slirp.h>
 
-int	tcp_keepidle = TCPTV_KEEP_IDLE;
-int	tcp_keepintvl = TCPTV_KEEPINTVL;
-int	tcp_maxidle;
-int	so_options = DO_KEEPALIVE;
-
+#ifdef LOG_ENABLED
 struct   tcpstat tcpstat;        /* tcp statistics */
+#endif
+
 u_int32_t        tcp_now;                /* for RFC 1323 timestamps */
 
+static struct tcpcb *tcp_timers(register struct tcpcb *tp, int timer);
+
 /*
  * Fast timeout routine for processing delayed acks
  */
@@ -62,7 +62,7 @@ tcp_fasttimo()
 		    (tp->t_flags & TF_DELACK)) {
 			tp->t_flags &= ~TF_DELACK;
 			tp->t_flags |= TF_ACKNOW;
-			tcpstat.tcps_delack++;
+			STAT(tcpstat.tcps_delack++);
 			(void) tcp_output(tp);
 		}
 }
@@ -81,7 +81,6 @@ tcp_slowtimo()
 
 	DEBUG_CALL("tcp_slowtimo");
 
-	tcp_maxidle = TCPTV_KEEPCNT * tcp_keepintvl;
 	/*
 	 * Search through tcb's and update active timers.
 	 */
@@ -127,16 +126,14 @@ tcp_canceltimers(tp)
 		tp->t_timer[i] = 0;
 }
 
-int	tcp_backoff[TCP_MAXRXTSHIFT + 1] =
+const int tcp_backoff[TCP_MAXRXTSHIFT + 1] =
    { 1, 2, 4, 8, 16, 32, 64, 64, 64, 64, 64, 64, 64 };
 
 /*
  * TCP timer processing.
  */
-struct tcpcb *
-tcp_timers(tp, timer)
-	register struct tcpcb *tp;
-	int timer;
+static struct tcpcb *
+tcp_timers(register struct tcpcb *tp, int timer)
 {
 	register int rexmt;
 
@@ -152,8 +149,8 @@ tcp_timers(tp, timer)
 	 */
 	case TCPT_2MSL:
 		if (tp->t_state != TCPS_TIME_WAIT &&
-		    tp->t_idle <= tcp_maxidle)
-			tp->t_timer[TCPT_2MSL] = tcp_keepintvl;
+		    tp->t_idle <= TCP_MAXIDLE)
+			tp->t_timer[TCPT_2MSL] = TCPTV_KEEPINTVL;
 		else
 			tp = tcp_close(tp);
 		break;
@@ -192,7 +189,7 @@ tcp_timers(tp, timer)
 				 * We tried our best, now the connection must die!
 				 */
 				tp->t_rxtshift = TCP_MAXRXTSHIFT;
-				tcpstat.tcps_timeoutdrop++;
+				STAT(tcpstat.tcps_timeoutdrop++);
 				tp = tcp_drop(tp, tp->t_softerror);
 				/* tp->t_softerror : ETIMEDOUT); */ /* XXX */
 				return (tp); /* XXX */
@@ -204,7 +201,7 @@ tcp_timers(tp, timer)
 			 */
 			tp->t_rxtshift = 6;
 		}
-		tcpstat.tcps_rexmttimeo++;
+		STAT(tcpstat.tcps_rexmttimeo++);
 		rexmt = TCP_REXMTVAL(tp) * tcp_backoff[tp->t_rxtshift];
 		TCPT_RANGESET(tp->t_rxtcur, rexmt,
 		    (short)tp->t_rttmin, TCPTV_REXMTMAX); /* XXX */
@@ -267,7 +264,7 @@ tcp_timers(tp, timer)
 	 * Force a byte to be output, if possible.
 	 */
 	case TCPT_PERSIST:
-		tcpstat.tcps_persisttimeo++;
+		STAT(tcpstat.tcps_persisttimeo++);
 		tcp_setpersist(tp);
 		tp->t_force = 1;
 		(void) tcp_output(tp);
@@ -279,13 +276,13 @@ tcp_timers(tp, timer)
 	 * or drop connection if idle for too long.
 	 */
 	case TCPT_KEEP:
-		tcpstat.tcps_keeptimeo++;
+		STAT(tcpstat.tcps_keeptimeo++);
 		if (tp->t_state < TCPS_ESTABLISHED)
 			goto dropit;
 
 /*		if (tp->t_socket->so_options & SO_KEEPALIVE && */
-		if ((so_options) && tp->t_state <= TCPS_CLOSE_WAIT) {
-		    	if (tp->t_idle >= tcp_keepidle + tcp_maxidle)
+		if ((SO_OPTIONS) && tp->t_state <= TCPS_CLOSE_WAIT) {
+		    	if (tp->t_idle >= TCPTV_KEEP_IDLE + TCP_MAXIDLE)
 				goto dropit;
 			/*
 			 * Send a packet designed to force a response
@@ -299,7 +296,7 @@ tcp_timers(tp, timer)
 			 * by the protocol spec, this requires the
 			 * correspondent TCP to respond.
 			 */
-			tcpstat.tcps_keepprobe++;
+			STAT(tcpstat.tcps_keepprobe++);
 #ifdef TCP_COMPAT_42
 			/*
 			 * The keepalive packet must have nonzero length
@@ -311,13 +308,13 @@ tcp_timers(tp, timer)
 			tcp_respond(tp, &tp->t_template, (struct mbuf *)NULL,
 			    tp->rcv_nxt, tp->snd_una - 1, 0);
 #endif
-			tp->t_timer[TCPT_KEEP] = tcp_keepintvl;
+			tp->t_timer[TCPT_KEEP] = TCPTV_KEEPINTVL;
 		} else
-			tp->t_timer[TCPT_KEEP] = tcp_keepidle;
+			tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_IDLE;
 		break;
 
 	dropit:
-		tcpstat.tcps_keepdrops++;
+		STAT(tcpstat.tcps_keepdrops++);
 		tp = tcp_drop(tp, 0); /* ETIMEDOUT); */
 		break;
 	}
diff --git a/slirp/tcp_timer.h b/slirp/tcp_timer.h
index 59933bc1b..f251846b4 100644
--- a/slirp/tcp_timer.h
+++ b/slirp/tcp_timer.h
@@ -126,17 +126,12 @@ char *tcptimers[] =
 		(tv) = (tvmax); \
 }
 
-extern int tcp_keepidle;		/* time before keepalive probes begin */
-extern int tcp_keepintvl;		/* time between keepalive probes */
-extern int tcp_maxidle;			/* time to drop after starting probes */
-extern int tcp_ttl;			/* time to live for TCP segs */
-extern int tcp_backoff[];
+extern const int tcp_backoff[];
 
 struct tcpcb;
 
 void tcp_fasttimo _P((void));
 void tcp_slowtimo _P((void));
 void tcp_canceltimers _P((struct tcpcb *));
-struct tcpcb * tcp_timers _P((register struct tcpcb *, int));
 
 #endif
diff --git a/slirp/tcp_var.h b/slirp/tcp_var.h
index 0d6cd245e..82380f936 100644
--- a/slirp/tcp_var.h
+++ b/slirp/tcp_var.h
@@ -185,6 +185,7 @@ typedef u_int32_t mbufp_32;
 #endif
 #define REASS_MBUF(ti) (*(mbufp_32 *)&((ti)->ti_t))
 
+#ifdef LOG_ENABLED
 /*
  * TCP statistics.
  * Many of these should be kept per connection,
@@ -247,6 +248,8 @@ struct tcpstat {
 };
 
 extern struct	tcpstat tcpstat;	/* tcp statistics */
+#endif
+
 extern u_int32_t	tcp_now;		/* for RFC 1323 timestamps */
 
 #endif
diff --git a/slirp/tftp.c b/slirp/tftp.c
index 2b2bf2c5a..562ae8953 100644
--- a/slirp/tftp.c
+++ b/slirp/tftp.c
@@ -34,7 +34,7 @@ struct tftp_session {
     int timestamp;
 };
 
-struct tftp_session tftp_sessions[TFTP_SESSIONS_MAX];
+static struct tftp_session tftp_sessions[TFTP_SESSIONS_MAX];
 
 const char *tftp_prefix;
 
@@ -143,7 +143,7 @@ static int tftp_send_oack(struct tftp_session *spt,
 
     memset(m->m_data, 0, m->m_size);
 
-    m->m_data += if_maxlinkhdr;
+    m->m_data += IF_MAXLINKHDR;
     tp = (void *)m->m_data;
     m->m_data += sizeof(struct udpiphdr);
 
@@ -183,7 +183,7 @@ static int tftp_send_error(struct tftp_session *spt,
 
   memset(m->m_data, 0, m->m_size);
 
-  m->m_data += if_maxlinkhdr;
+  m->m_data += IF_MAXLINKHDR;
   tp = (void *)m->m_data;
   m->m_data += sizeof(struct udpiphdr);
 
@@ -230,7 +230,7 @@ static int tftp_send_data(struct tftp_session *spt,
 
   memset(m->m_data, 0, m->m_size);
 
-  m->m_data += if_maxlinkhdr;
+  m->m_data += IF_MAXLINKHDR;
   tp = (void *)m->m_data;
   m->m_data += sizeof(struct udpiphdr);
 
diff --git a/slirp/udp.c b/slirp/udp.c
index 44900ff14..c48923b0c 100644
--- a/slirp/udp.c
+++ b/slirp/udp.c
@@ -45,18 +45,23 @@
 #include <slirp.h>
 #include "ip_icmp.h"
 
+#ifdef LOG_ENABLED
 struct udpstat udpstat;
+#endif
 
 struct socket udb;
 
+static u_int8_t udp_tos(struct socket *so);
+static void udp_emu(struct socket *so, struct mbuf *m);
+
 /*
  * UDP protocol implementation.
  * Per RFC 768, August, 1980.
  */
 #ifndef	COMPAT_42
-int	udpcksum = 1;
+#define UDPCKSUM 1
 #else
-int	udpcksum = 0;		/* XXX */
+#define UDPCKSUM 0 /* XXX */
 #endif
 
 struct	socket *udp_last_so = &udb;
@@ -86,7 +91,7 @@ udp_input(m, iphlen)
 	DEBUG_ARG("m = %lx", (long)m);
 	DEBUG_ARG("iphlen = %d", iphlen);
 
-	udpstat.udps_ipackets++;
+	STAT(udpstat.udps_ipackets++);
 
 	/*
 	 * Strip IP options, if any; should skip this,
@@ -113,7 +118,7 @@ udp_input(m, iphlen)
 
 	if (ip->ip_len != len) {
 		if (len > ip->ip_len) {
-			udpstat.udps_badlen++;
+			STAT(udpstat.udps_badlen++);
 			goto bad;
 		}
 		m_adj(m, len - ip->ip_len);
@@ -130,7 +135,7 @@ udp_input(m, iphlen)
 	/*
 	 * Checksum extended UDP header and data.
 	 */
-	if (udpcksum && uh->uh_sum) {
+	if (UDPCKSUM && uh->uh_sum) {
 	  ((struct ipovly *)ip)->ih_next = 0;
 	  ((struct ipovly *)ip)->ih_prev = 0;
 	  ((struct ipovly *)ip)->ih_x1 = 0;
@@ -140,7 +145,7 @@ udp_input(m, iphlen)
 	   * if (uh->uh_sum) {
 	   */
 	  if(cksum(m, len + sizeof(struct ip))) {
-	    udpstat.udps_badsum++;
+	    STAT(udpstat.udps_badsum++);
 	    goto bad;
 	  }
 	}
@@ -181,7 +186,7 @@ udp_input(m, iphlen)
 		if (tmp == &udb) {
 		  so = NULL;
 		} else {
-		  udpstat.udpps_pcbcachemiss++;
+		  STAT(udpstat.udpps_pcbcachemiss++);
 		  udp_last_so = so;
 		}
 	}
@@ -290,16 +295,16 @@ int udp_output2(struct socket *so, struct mbuf *m,
 	 * Stuff checksum and output datagram.
 	 */
 	ui->ui_sum = 0;
-	if (udpcksum) {
+	if (UDPCKSUM) {
 	    if ((ui->ui_sum = cksum(m, /* sizeof (struct udpiphdr) + */ m->m_len)) == 0)
 		ui->ui_sum = 0xffff;
 	}
 	((struct ip *)ui)->ip_len = m->m_len;
 
-	((struct ip *)ui)->ip_ttl = ip_defttl;
+	((struct ip *)ui)->ip_ttl = IPDEFTTL;
 	((struct ip *)ui)->ip_tos = iptos;
 
-	udpstat.udps_opackets++;
+	STAT(udpstat.udps_opackets++);
 
 	error = ip_output(so, m);
 
@@ -367,7 +372,7 @@ udp_detach(so)
 	sofree(so);
 }
 
-struct tos_t udptos[] = {
+static const struct tos_t udptos[] = {
 	{0, 53, IPTOS_LOWDELAY, 0},			/* DNS */
 	{517, 517, IPTOS_LOWDELAY, EMU_TALK},	/* talk */
 	{518, 518, IPTOS_LOWDELAY, EMU_NTALK},	/* ntalk */
@@ -375,9 +380,8 @@ struct tos_t udptos[] = {
 	{0, 0, 0, 0}
 };
 
-u_int8_t
-udp_tos(so)
-	struct socket *so;
+static u_int8_t
+udp_tos(struct socket *so)
 {
 	int i = 0;
 
@@ -400,10 +404,8 @@ udp_tos(so)
 /*
  * Here, talk/ytalk/ntalk requests must be emulated
  */
-void
-udp_emu(so, m)
-	struct socket *so;
-	struct mbuf *m;
+static void
+udp_emu(struct socket *so, struct mbuf *m)
 {
 	struct sockaddr_in addr;
         int addrlen = sizeof(addr);
diff --git a/slirp/udp.h b/slirp/udp.h
index 67da6cd73..4f69b098c 100644
--- a/slirp/udp.h
+++ b/slirp/udp.h
@@ -72,6 +72,7 @@ struct udpiphdr {
 #define ui_ulen         ui_u.uh_ulen
 #define ui_sum          ui_u.uh_sum
 
+#ifdef LOG_ENABLED
 struct udpstat {
 	                                /* input statistics: */
 	        u_long  udps_ipackets;          /* total input packets */
@@ -85,6 +86,7 @@ struct udpstat {
 	                                /* output statistics: */
 	        u_long  udps_opackets;          /* total output packets */
 };
+#endif
 
 /*
  * Names for UDP sysctl objects
@@ -92,7 +94,10 @@ struct udpstat {
 #define UDPCTL_CHECKSUM         1       /* checksum UDP packets */
 #define UDPCTL_MAXID            2
 
+#ifdef LOG_ENABLED
 extern struct udpstat udpstat;
+#endif
+
 extern struct socket udb;
 struct mbuf;
 
@@ -101,8 +106,6 @@ void udp_input _P((register struct mbuf *, int));
 int udp_output _P((struct socket *, struct mbuf *, struct sockaddr_in *));
 int udp_attach _P((struct socket *));
 void udp_detach _P((struct socket *));
-u_int8_t udp_tos _P((struct socket *));
-void udp_emu _P((struct socket *, struct mbuf *));
 struct socket * udp_listen _P((u_int, u_int32_t, u_int, int));
 int udp_output2(struct socket *so, struct mbuf *m,
                 struct sockaddr_in *saddr, struct sockaddr_in *daddr,
diff --git a/softmmu-semi.h b/softmmu-semi.h
index 13c528bb8..8bf96f497 100644
--- a/softmmu-semi.h
+++ b/softmmu-semi.h
@@ -21,15 +21,18 @@ static inline uint32_t softmmu_tget8(CPUState *env, uint32_t addr)
     cpu_memory_rw_debug(env, addr, &val, 1, 0);
     return val;
 }
-#define tget32(p) softmmu_tget32(env, p)
-#define tget8(p) softmmu_tget8(env, p)
+
+#define get_user_u32(arg, p) ({ arg = softmmu_tget32(env, p) ; 0; })
+#define get_user_u8(arg, p) ({ arg = softmmu_tget8(env, p) ; 0; })
+#define get_user_ual(arg, p) get_user_u32(arg, p)
 
 static inline void softmmu_tput32(CPUState *env, uint32_t addr, uint32_t val)
 {
     val = tswap32(val);
     cpu_memory_rw_debug(env, addr, (uint8_t *)&val, 4, 1);
 }
-#define tput32(p, val) softmmu_tput32(env, p, val)
+#define put_user_u32(arg, p) ({ softmmu_tput32(env, p, arg) ; 0; })
+#define put_user_ual(arg, p) put_user_u32(arg, p)
 
 static void *softmmu_lock_user(CPUState *env, uint32_t addr, uint32_t len,
                                int copy)
@@ -41,7 +44,7 @@ static void *softmmu_lock_user(CPUState *env, uint32_t addr, uint32_t len,
         cpu_memory_rw_debug(env, addr, p, len, 0);
     return p;
 }
-#define lock_user(p, len, copy) softmmu_lock_user(env, p, len, copy)
+#define lock_user(type, p, len, copy) softmmu_lock_user(env, p, len, copy)
 static char *softmmu_lock_user_string(CPUState *env, uint32_t addr)
 {
     char *p;
diff --git a/softmmu_exec.h b/softmmu_exec.h
index 3b789eeb7..b6e484918 100644
--- a/softmmu_exec.h
+++ b/softmmu_exec.h
@@ -1,10 +1,16 @@
 /* Common softmmu definitions and inline routines.  */
 
-#define ldul_user ldl_user
-#define ldul_kernel ldl_kernel
+/* XXX: find something cleaner.
+ * Furthermore, this is false for 64 bits targets
+ */
+#define ldul_user       ldl_user
+#define ldul_kernel     ldl_kernel
+#define ldul_hypv       ldl_hypv
+#define ldul_executive  ldl_executive
+#define ldul_supervisor ldl_supervisor
 
 #define ACCESS_TYPE 0
-#define MEMSUFFIX _kernel
+#define MEMSUFFIX MMU_MODE0_SUFFIX
 #define DATA_SIZE 1
 #include "softmmu_header.h"
 
@@ -20,7 +26,7 @@
 #undef MEMSUFFIX
 
 #define ACCESS_TYPE 1
-#define MEMSUFFIX _user
+#define MEMSUFFIX MMU_MODE1_SUFFIX
 #define DATA_SIZE 1
 #include "softmmu_header.h"
 
@@ -35,8 +41,50 @@
 #undef ACCESS_TYPE
 #undef MEMSUFFIX
 
-/* these access are slower, they must be as rare as possible */
+#if (NB_MMU_MODES >= 3)
+
 #define ACCESS_TYPE 2
+#define MEMSUFFIX MMU_MODE2_SUFFIX
+#define DATA_SIZE 1
+#include "softmmu_header.h"
+
+#define DATA_SIZE 2
+#include "softmmu_header.h"
+
+#define DATA_SIZE 4
+#include "softmmu_header.h"
+
+#define DATA_SIZE 8
+#include "softmmu_header.h"
+#undef ACCESS_TYPE
+#undef MEMSUFFIX
+
+#if (NB_MMU_MODES >= 4)
+
+#define ACCESS_TYPE 3
+#define MEMSUFFIX MMU_MODE3_SUFFIX
+#define DATA_SIZE 1
+#include "softmmu_header.h"
+
+#define DATA_SIZE 2
+#include "softmmu_header.h"
+
+#define DATA_SIZE 4
+#include "softmmu_header.h"
+
+#define DATA_SIZE 8
+#include "softmmu_header.h"
+#undef ACCESS_TYPE
+#undef MEMSUFFIX
+
+#if (NB_MMU_MODES > 4)
+#error "NB_MMU_MODES > 4 is not supported for now"
+#endif /* (NB_MMU_MODES > 4) */
+#endif /* (NB_MMU_MODES == 4) */
+#endif /* (NB_MMU_MODES >= 3) */
+
+/* these access are slower, they must be as rare as possible */
+#define ACCESS_TYPE (NB_MMU_MODES)
 #define MEMSUFFIX _data
 #define DATA_SIZE 1
 #include "softmmu_header.h"
diff --git a/softmmu_header.h b/softmmu_header.h
index 9fca31193..80eefa80f 100644
--- a/softmmu_header.h
+++ b/softmmu_header.h
@@ -39,62 +39,19 @@
 #error unsupported data size
 #endif
 
-#if ACCESS_TYPE == 0
+#if ACCESS_TYPE < (NB_MMU_MODES)
 
-#define CPU_MEM_INDEX 0
+#define CPU_MMU_INDEX ACCESS_TYPE
 #define MMUSUFFIX _mmu
 
-#elif ACCESS_TYPE == 1
+#elif ACCESS_TYPE == (NB_MMU_MODES)
 
-#define CPU_MEM_INDEX 1
+#define CPU_MMU_INDEX (cpu_mmu_index(env))
 #define MMUSUFFIX _mmu
 
-#elif ACCESS_TYPE == 2
-
-#ifdef TARGET_I386
-#define CPU_MEM_INDEX ((env->hflags & HF_CPL_MASK) == 3)
-#elif defined (TARGET_PPC)
-#define CPU_MEM_INDEX (msr_pr)
-#elif defined (TARGET_MIPS)
-#define CPU_MEM_INDEX ((env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM)
-#elif defined (TARGET_SPARC)
-#define CPU_MEM_INDEX ((env->psrs) == 0)
-#elif defined (TARGET_ARM)
-#define CPU_MEM_INDEX ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR)
-#elif defined (TARGET_SH4)
-#define CPU_MEM_INDEX ((env->sr & SR_MD) == 0)
-#elif defined (TARGET_ALPHA)
-#define CPU_MEM_INDEX ((env->ps >> 3) & 3)
-#elif defined (TARGET_M68K)
-#define CPU_MEM_INDEX ((env->sr & SR_S) == 0)
-#else
-#error unsupported CPU
-#endif
-#define MMUSUFFIX _mmu
+#elif ACCESS_TYPE == (NB_MMU_MODES + 1)
 
-#elif ACCESS_TYPE == 3
-
-#ifdef TARGET_I386
-#define CPU_MEM_INDEX ((env->hflags & HF_CPL_MASK) == 3)
-#elif defined (TARGET_PPC)
-#define CPU_MEM_INDEX (msr_pr)
-#elif defined (TARGET_MIPS)
-#define CPU_MEM_INDEX ((env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM)
-#elif defined (TARGET_SPARC)
-#define CPU_MEM_INDEX ((env->psrs) == 0)
-#elif defined (TARGET_ARM)
-#define CPU_MEM_INDEX ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR)
-#elif defined (TARGET_SH4)
-#define CPU_MEM_INDEX ((env->sr & SR_MD) == 0)
-#elif defined (TARGET_ALPHA)
-#define CPU_MEM_INDEX ((env->ps >> 3) & 3)
-#elif defined (TARGET_M68K)
-#define CPU_MEM_INDEX ((env->sr & SR_S) == 0)
-#elif defined (TARGET_IA64)
-#define CPU_MEM_INDEX (0)
-#else
-#error unsupported CPU
-#endif
+#define CPU_MMU_INDEX (cpu_mmu_index(env))
 #define MMUSUFFIX _cmmu
 
 #else
@@ -107,18 +64,18 @@
 #define RES_TYPE int
 #endif
 
-#if ACCESS_TYPE == 3
+#if ACCESS_TYPE == (NB_MMU_MODES + 1)
 #define ADDR_READ addr_code
 #else
 #define ADDR_READ addr_read
 #endif
 
 DATA_TYPE REGPARM(1) glue(glue(__ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
-                                                         int is_user);
-void REGPARM(2) glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr, DATA_TYPE v, int is_user);
+                                                         int mmu_idx);
+void REGPARM(2) glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr, DATA_TYPE v, int mmu_idx);
 
 #if (DATA_SIZE <= 4) && (TARGET_LONG_BITS == 32) && defined(__i386__) && \
-    (ACCESS_TYPE <= 1) && defined(ASM_SOFTMMU)
+    (ACCESS_TYPE < NB_MMU_MODES) && defined(ASM_SOFTMMU)
 
 #define CPU_TLB_ENTRY_BITS 4
 
@@ -157,8 +114,8 @@ static inline RES_TYPE glue(glue(ld, USUFFIX), MEMSUFFIX)(target_ulong ptr)
                   "i" ((CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS),
                   "i" (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS),
                   "i" (TARGET_PAGE_MASK | (DATA_SIZE - 1)),
-                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MEM_INDEX][0].addr_read)),
-                  "i" (CPU_MEM_INDEX),
+                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MMU_INDEX][0].addr_read)),
+                  "i" (CPU_MMU_INDEX),
                   "m" (*(uint8_t *)&glue(glue(__ld, SUFFIX), MMUSUFFIX))
                   : "%eax", "%ecx", "%edx", "memory", "cc");
     return res;
@@ -204,8 +161,8 @@ static inline int glue(glue(lds, SUFFIX), MEMSUFFIX)(target_ulong ptr)
                   "i" ((CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS),
                   "i" (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS),
                   "i" (TARGET_PAGE_MASK | (DATA_SIZE - 1)),
-                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MEM_INDEX][0].addr_read)),
-                  "i" (CPU_MEM_INDEX),
+                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MMU_INDEX][0].addr_read)),
+                  "i" (CPU_MMU_INDEX),
                   "m" (*(uint8_t *)&glue(glue(__ld, SUFFIX), MMUSUFFIX))
                   : "%eax", "%ecx", "%edx", "memory", "cc");
     return res;
@@ -256,8 +213,8 @@ static inline void glue(glue(st, SUFFIX), MEMSUFFIX)(target_ulong ptr, RES_TYPE
                   "i" ((CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS),
                   "i" (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS),
                   "i" (TARGET_PAGE_MASK | (DATA_SIZE - 1)),
-                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MEM_INDEX][0].addr_write)),
-                  "i" (CPU_MEM_INDEX),
+                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MMU_INDEX][0].addr_write)),
+                  "i" (CPU_MMU_INDEX),
                   "m" (*(uint8_t *)&glue(glue(__st, SUFFIX), MMUSUFFIX))
                   : "%eax", "%ecx", "%edx", "memory", "cc");
 }
@@ -272,16 +229,16 @@ static inline RES_TYPE glue(glue(ld, USUFFIX), MEMSUFFIX)(target_ulong ptr)
     RES_TYPE res;
     target_ulong addr;
     unsigned long physaddr;
-    int is_user;
+    int mmu_idx;
 
     addr = ptr;
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    is_user = CPU_MEM_INDEX;
-    if (__builtin_expect(env->tlb_table[is_user][index].ADDR_READ !=
+    mmu_idx = CPU_MMU_INDEX;
+    if (__builtin_expect(env->tlb_table[mmu_idx][index].ADDR_READ !=
                          (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))), 0)) {
-        res = glue(glue(__ld, SUFFIX), MMUSUFFIX)(addr, is_user);
+        res = glue(glue(__ld, SUFFIX), MMUSUFFIX)(addr, mmu_idx);
     } else {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][index].addend;
         res = glue(glue(ld, USUFFIX), _raw)((uint8_t *)physaddr);
     }
     return res;
@@ -293,23 +250,23 @@ static inline int glue(glue(lds, SUFFIX), MEMSUFFIX)(target_ulong ptr)
     int res, index;
     target_ulong addr;
     unsigned long physaddr;
-    int is_user;
+    int mmu_idx;
 
     addr = ptr;
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    is_user = CPU_MEM_INDEX;
-    if (__builtin_expect(env->tlb_table[is_user][index].ADDR_READ !=
+    mmu_idx = CPU_MMU_INDEX;
+    if (__builtin_expect(env->tlb_table[mmu_idx][index].ADDR_READ !=
                          (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))), 0)) {
-        res = (DATA_STYPE)glue(glue(__ld, SUFFIX), MMUSUFFIX)(addr, is_user);
+        res = (DATA_STYPE)glue(glue(__ld, SUFFIX), MMUSUFFIX)(addr, mmu_idx);
     } else {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][index].addend;
         res = glue(glue(lds, SUFFIX), _raw)((uint8_t *)physaddr);
     }
     return res;
 }
 #endif
 
-#if ACCESS_TYPE != 3
+#if ACCESS_TYPE != (NB_MMU_MODES + 1)
 
 /* generic store macro */
 
@@ -318,25 +275,25 @@ static inline void glue(glue(st, SUFFIX), MEMSUFFIX)(target_ulong ptr, RES_TYPE
     int index;
     target_ulong addr;
     unsigned long physaddr;
-    int is_user;
+    int mmu_idx;
 
     addr = ptr;
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    is_user = CPU_MEM_INDEX;
-    if (__builtin_expect(env->tlb_table[is_user][index].addr_write !=
+    mmu_idx = CPU_MMU_INDEX;
+    if (__builtin_expect(env->tlb_table[mmu_idx][index].addr_write !=
                          (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))), 0)) {
-        glue(glue(__st, SUFFIX), MMUSUFFIX)(addr, v, is_user);
+        glue(glue(__st, SUFFIX), MMUSUFFIX)(addr, v, mmu_idx);
     } else {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][index].addend;
         glue(glue(st, SUFFIX), _raw)((uint8_t *)physaddr, v);
     }
 }
 
-#endif /* ACCESS_TYPE != 3 */
+#endif /* ACCESS_TYPE != (NB_MMU_MODES + 1) */
 
 #endif /* !asm */
 
-#if ACCESS_TYPE != 3
+#if ACCESS_TYPE != (NB_MMU_MODES + 1)
 
 #if DATA_SIZE == 8
 static inline float64 glue(ldfq, MEMSUFFIX)(target_ulong ptr)
@@ -382,7 +339,7 @@ static inline void glue(stfl, MEMSUFFIX)(target_ulong ptr, float32 v)
 }
 #endif /* DATA_SIZE == 4 */
 
-#endif /* ACCESS_TYPE != 3 */
+#endif /* ACCESS_TYPE != (NB_MMU_MODES + 1) */
 
 #undef RES_TYPE
 #undef DATA_TYPE
@@ -390,6 +347,6 @@ static inline void glue(stfl, MEMSUFFIX)(target_ulong ptr, float32 v)
 #undef SUFFIX
 #undef USUFFIX
 #undef DATA_SIZE
-#undef CPU_MEM_INDEX
+#undef CPU_MMU_INDEX
 #undef MMUSUFFIX
 #undef ADDR_READ
diff --git a/softmmu_template.h b/softmmu_template.h
index ce6e4bd07..45fcd4e1b 100644
--- a/softmmu_template.h
+++ b/softmmu_template.h
@@ -48,7 +48,7 @@
 #endif
 
 static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
-                                                        int is_user,
+                                                        int mmu_idx,
                                                         void *retaddr);
 static inline DATA_TYPE glue(io_read, SUFFIX)(target_phys_addr_t physaddr,
                                               target_ulong tlb_addr)
@@ -76,7 +76,7 @@ static inline DATA_TYPE glue(io_read, SUFFIX)(target_phys_addr_t physaddr,
 
 /* handle all cases except unaligned access which span two pages */
 DATA_TYPE REGPARM(1) glue(glue(__ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
-                                                         int is_user)
+                                                         int mmu_idx)
 {
     DATA_TYPE res;
     int index;
@@ -88,9 +88,9 @@ DATA_TYPE REGPARM(1) glue(glue(__ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
     /* XXX: could done more in memory macro in a non portable way */
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
  redo:
-    tlb_addr = env->tlb_table[is_user][index].ADDR_READ;
+    tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
     if ((addr & TARGET_PAGE_MASK) == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][index].addend;
         if (tlb_addr & ~TARGET_PAGE_MASK) {
             /* IO access */
             if ((addr & (DATA_SIZE - 1)) != 0)
@@ -101,16 +101,16 @@ DATA_TYPE REGPARM(1) glue(glue(__ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
         do_unaligned_access:
             retaddr = GETPC();
 #ifdef ALIGNED_ONLY
-            do_unaligned_access(addr, READ_ACCESS_TYPE, is_user, retaddr);
+            do_unaligned_access(addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
 #endif
             res = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(addr,
-                                                         is_user, retaddr);
+                                                         mmu_idx, retaddr);
         } else {
             /* unaligned/aligned access in the same page */
 #ifdef ALIGNED_ONLY
             if ((addr & (DATA_SIZE - 1)) != 0) {
                 retaddr = GETPC();
-                do_unaligned_access(addr, READ_ACCESS_TYPE, is_user, retaddr);
+                do_unaligned_access(addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
             }
 #endif
             res = glue(glue(ld, USUFFIX), _raw)((uint8_t *)(long)physaddr);
@@ -120,9 +120,9 @@ DATA_TYPE REGPARM(1) glue(glue(__ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
         retaddr = GETPC();
 #ifdef ALIGNED_ONLY
         if ((addr & (DATA_SIZE - 1)) != 0)
-            do_unaligned_access(addr, READ_ACCESS_TYPE, is_user, retaddr);
+            do_unaligned_access(addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
 #endif
-        tlb_fill(addr, READ_ACCESS_TYPE, is_user, retaddr);
+        tlb_fill(addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
         goto redo;
     }
     return res;
@@ -130,7 +130,7 @@ DATA_TYPE REGPARM(1) glue(glue(__ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
 
 /* handle all unaligned cases */
 static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
-                                                        int is_user,
+                                                        int mmu_idx,
                                                         void *retaddr)
 {
     DATA_TYPE res, res1, res2;
@@ -140,9 +140,9 @@ static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
 
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
  redo:
-    tlb_addr = env->tlb_table[is_user][index].ADDR_READ;
+    tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
     if ((addr & TARGET_PAGE_MASK) == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][index].addend;
         if (tlb_addr & ~TARGET_PAGE_MASK) {
             /* IO access */
             if ((addr & (DATA_SIZE - 1)) != 0)
@@ -154,9 +154,9 @@ static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
             addr1 = addr & ~(DATA_SIZE - 1);
             addr2 = addr1 + DATA_SIZE;
             res1 = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(addr1,
-                                                          is_user, retaddr);
+                                                          mmu_idx, retaddr);
             res2 = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(addr2,
-                                                          is_user, retaddr);
+                                                          mmu_idx, retaddr);
             shift = (addr & (DATA_SIZE - 1)) * 8;
 #ifdef TARGET_WORDS_BIGENDIAN
             res = (res1 << shift) | (res2 >> ((DATA_SIZE * 8) - shift));
@@ -170,7 +170,7 @@ static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
         }
     } else {
         /* the page is not in the TLB : fill it */
-        tlb_fill(addr, READ_ACCESS_TYPE, is_user, retaddr);
+        tlb_fill(addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
         goto redo;
     }
     return res;
@@ -180,7 +180,7 @@ static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
 
 static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(target_ulong addr,
                                                    DATA_TYPE val,
-                                                   int is_user,
+                                                   int mmu_idx,
                                                    void *retaddr);
 
 static inline void glue(io_write, SUFFIX)(target_phys_addr_t physaddr,
@@ -211,7 +211,7 @@ static inline void glue(io_write, SUFFIX)(target_phys_addr_t physaddr,
 
 void REGPARM(2) glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr,
                                                     DATA_TYPE val,
-                                                    int is_user)
+                                                    int mmu_idx)
 {
     target_phys_addr_t physaddr;
     target_ulong tlb_addr;
@@ -220,9 +220,9 @@ void REGPARM(2) glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr,
 
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
  redo:
-    tlb_addr = env->tlb_table[is_user][index].addr_write;
+    tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
     if ((addr & TARGET_PAGE_MASK) == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][index].addend;
         if (tlb_addr & ~TARGET_PAGE_MASK) {
             /* IO access */
             if ((addr & (DATA_SIZE - 1)) != 0)
@@ -233,16 +233,16 @@ void REGPARM(2) glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr,
         do_unaligned_access:
             retaddr = GETPC();
 #ifdef ALIGNED_ONLY
-            do_unaligned_access(addr, 1, is_user, retaddr);
+            do_unaligned_access(addr, 1, mmu_idx, retaddr);
 #endif
             glue(glue(slow_st, SUFFIX), MMUSUFFIX)(addr, val,
-                                                   is_user, retaddr);
+                                                   mmu_idx, retaddr);
         } else {
             /* aligned/unaligned access in the same page */
 #ifdef ALIGNED_ONLY
             if ((addr & (DATA_SIZE - 1)) != 0) {
                 retaddr = GETPC();
-                do_unaligned_access(addr, 1, is_user, retaddr);
+                do_unaligned_access(addr, 1, mmu_idx, retaddr);
             }
 #endif
             glue(glue(st, SUFFIX), _raw)((uint8_t *)(long)physaddr, val);
@@ -252,9 +252,9 @@ void REGPARM(2) glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr,
         retaddr = GETPC();
 #ifdef ALIGNED_ONLY
         if ((addr & (DATA_SIZE - 1)) != 0)
-            do_unaligned_access(addr, 1, is_user, retaddr);
+            do_unaligned_access(addr, 1, mmu_idx, retaddr);
 #endif
-        tlb_fill(addr, 1, is_user, retaddr);
+        tlb_fill(addr, 1, mmu_idx, retaddr);
         goto redo;
     }
 }
@@ -262,7 +262,7 @@ void REGPARM(2) glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr,
 /* handles all unaligned cases */
 static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(target_ulong addr,
                                                    DATA_TYPE val,
-                                                   int is_user,
+                                                   int mmu_idx,
                                                    void *retaddr)
 {
     target_phys_addr_t physaddr;
@@ -271,9 +271,9 @@ static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(target_ulong addr,
 
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
  redo:
-    tlb_addr = env->tlb_table[is_user][index].addr_write;
+    tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
     if ((addr & TARGET_PAGE_MASK) == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][index].addend;
         if (tlb_addr & ~TARGET_PAGE_MASK) {
             /* IO access */
             if ((addr & (DATA_SIZE - 1)) != 0)
@@ -282,13 +282,15 @@ static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(target_ulong addr,
         } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
         do_unaligned_access:
             /* XXX: not efficient, but simple */
-            for(i = 0;i < DATA_SIZE; i++) {
+            /* Note: relies on the fact that tlb_fill() does not remove the
+             * previous page from the TLB cache.  */
+            for(i = DATA_SIZE - 1; i >= 0; i--) {
 #ifdef TARGET_WORDS_BIGENDIAN
                 glue(slow_stb, MMUSUFFIX)(addr + i, val >> (((DATA_SIZE - 1) * 8) - (i * 8)),
-                                          is_user, retaddr);
+                                          mmu_idx, retaddr);
 #else
                 glue(slow_stb, MMUSUFFIX)(addr + i, val >> (i * 8),
-                                          is_user, retaddr);
+                                          mmu_idx, retaddr);
 #endif
             }
         } else {
@@ -297,7 +299,7 @@ static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(target_ulong addr,
         }
     } else {
         /* the page is not in the TLB : fill it */
-        tlb_fill(addr, 1, is_user, retaddr);
+        tlb_fill(addr, 1, mmu_idx, retaddr);
         goto redo;
     }
 }
diff --git a/sparc-dis.c b/sparc-dis.c
index 4d2020fcd..09fed0924 100644
--- a/sparc-dis.c
+++ b/sparc-dis.c
@@ -88,21 +88,21 @@ extern enum sparc_opcode_arch_val sparc_opcode_lookup_arch
 
 struct sparc_opcode {
   const char *name;
-  unsigned long match;	/* Bits that must be set. */
-  unsigned long lose;	/* Bits that must not be set. */
+  unsigned long match;  /* Bits that must be set. */
+  unsigned long lose;   /* Bits that must not be set. */
   const char *args;
   /* This was called "delayed" in versions before the flags. */
   char flags;
-  short architecture;	/* Bitmask of sparc_opcode_arch_val's.  */
+  short architecture;   /* Bitmask of sparc_opcode_arch_val's.  */
 };
 
-#define	F_DELAYED	1	/* Delayed branch */
-#define	F_ALIAS		2	/* Alias for a "real" instruction */
-#define	F_UNBR		4	/* Unconditional branch */
-#define	F_CONDBR	8	/* Conditional branch */
-#define	F_JSR		16	/* Subroutine call */
-#define F_FLOAT		32	/* Floating point instruction (not a branch) */
-#define F_FBR		64	/* Floating point branch */
+#define F_DELAYED       1       /* Delayed branch */
+#define F_ALIAS         2       /* Alias for a "real" instruction */
+#define F_UNBR          4       /* Unconditional branch */
+#define F_CONDBR        8       /* Conditional branch */
+#define F_JSR           16      /* Subroutine call */
+#define F_FLOAT         32      /* Floating point instruction (not a branch) */
+#define F_FBR           64      /* Floating point branch */
 /* FIXME: Add F_ANACHRONISTIC flag for v9.  */
 
 /*
@@ -117,104 +117,104 @@ The args component is a string containing one character for each operand of the
 instruction.
 
 Kinds of operands:
-	#	Number used by optimizer.	It is ignored.
-	1	rs1 register.
-	2	rs2 register.
-	d	rd register.
-	e	frs1 floating point register.
-	v	frs1 floating point register (double/even).
-	V	frs1 floating point register (quad/multiple of 4).
-	f	frs2 floating point register.
-	B	frs2 floating point register (double/even).
-	R	frs2 floating point register (quad/multiple of 4).
-	g	frsd floating point register.
-	H	frsd floating point register (double/even).
-	J	frsd floating point register (quad/multiple of 4).
-	b	crs1 coprocessor register
-	c	crs2 coprocessor register
-	D	crsd coprocessor register
-	m	alternate space register (asr) in rd
-	M	alternate space register (asr) in rs1
-	h	22 high bits.
-	X	5 bit unsigned immediate
-	Y	6 bit unsigned immediate
-	3	SIAM mode (3 bits). (v9b)
-	K	MEMBAR mask (7 bits). (v9)
-	j	10 bit Immediate. (v9)
-	I	11 bit Immediate. (v9)
-	i	13 bit Immediate.
-	n	22 bit immediate.
-	k	2+14 bit PC relative immediate. (v9)
-	G	19 bit PC relative immediate. (v9)
-	l	22 bit PC relative immediate.
-	L	30 bit PC relative immediate.
-	a	Annul.	The annul bit is set.
-	A	Alternate address space. Stored as 8 bits.
-	C	Coprocessor state register.
-	F	floating point state register.
-	p	Processor state register.
-	N	Branch predict clear ",pn" (v9)
-	T	Branch predict set ",pt" (v9)
-	z	%icc. (v9)
-	Z	%xcc. (v9)
-	q	Floating point queue.
-	r	Single register that is both rs1 and rd.
-	O	Single register that is both rs2 and rd.
-	Q	Coprocessor queue.
-	S	Special case.
-	t	Trap base register.
-	w	Window invalid mask register.
-	y	Y register.
-	u	sparclet coprocessor registers in rd position
-	U	sparclet coprocessor registers in rs1 position
-	E	%ccr. (v9)
-	s	%fprs. (v9)
-	P	%pc.  (v9)
-	W	%tick.	(v9)
-	o	%asi. (v9)
-	6	%fcc0. (v9)
-	7	%fcc1. (v9)
-	8	%fcc2. (v9)
-	9	%fcc3. (v9)
-	!	Privileged Register in rd (v9)
-	?	Privileged Register in rs1 (v9)
-	*	Prefetch function constant. (v9)
-	x	OPF field (v9 impdep).
-	0	32/64 bit immediate for set or setx (v9) insns
-	_	Ancillary state register in rd (v9a)
-	/	Ancillary state register in rs1 (v9a)
+        #       Number used by optimizer.       It is ignored.
+        1       rs1 register.
+        2       rs2 register.
+        d       rd register.
+        e       frs1 floating point register.
+        v       frs1 floating point register (double/even).
+        V       frs1 floating point register (quad/multiple of 4).
+        f       frs2 floating point register.
+        B       frs2 floating point register (double/even).
+        R       frs2 floating point register (quad/multiple of 4).
+        g       frsd floating point register.
+        H       frsd floating point register (double/even).
+        J       frsd floating point register (quad/multiple of 4).
+        b       crs1 coprocessor register
+        c       crs2 coprocessor register
+        D       crsd coprocessor register
+        m       alternate space register (asr) in rd
+        M       alternate space register (asr) in rs1
+        h       22 high bits.
+        X       5 bit unsigned immediate
+        Y       6 bit unsigned immediate
+        3       SIAM mode (3 bits). (v9b)
+        K       MEMBAR mask (7 bits). (v9)
+        j       10 bit Immediate. (v9)
+        I       11 bit Immediate. (v9)
+        i       13 bit Immediate.
+        n       22 bit immediate.
+        k       2+14 bit PC relative immediate. (v9)
+        G       19 bit PC relative immediate. (v9)
+        l       22 bit PC relative immediate.
+        L       30 bit PC relative immediate.
+        a       Annul.  The annul bit is set.
+        A       Alternate address space. Stored as 8 bits.
+        C       Coprocessor state register.
+        F       floating point state register.
+        p       Processor state register.
+        N       Branch predict clear ",pn" (v9)
+        T       Branch predict set ",pt" (v9)
+        z       %icc. (v9)
+        Z       %xcc. (v9)
+        q       Floating point queue.
+        r       Single register that is both rs1 and rd.
+        O       Single register that is both rs2 and rd.
+        Q       Coprocessor queue.
+        S       Special case.
+        t       Trap base register.
+        w       Window invalid mask register.
+        y       Y register.
+        u       sparclet coprocessor registers in rd position
+        U       sparclet coprocessor registers in rs1 position
+        E       %ccr. (v9)
+        s       %fprs. (v9)
+        P       %pc.  (v9)
+        W       %tick.  (v9)
+        o       %asi. (v9)
+        6       %fcc0. (v9)
+        7       %fcc1. (v9)
+        8       %fcc2. (v9)
+        9       %fcc3. (v9)
+        !       Privileged Register in rd (v9)
+        ?       Privileged Register in rs1 (v9)
+        *       Prefetch function constant. (v9)
+        x       OPF field (v9 impdep).
+        0       32/64 bit immediate for set or setx (v9) insns
+        _       Ancillary state register in rd (v9a)
+        /       Ancillary state register in rs1 (v9a)
 
 The following chars are unused: (note: ,[] are used as punctuation)
 [45]
 
 */
 
-#define OP2(x)		(((x)&0x7) << 22) /* op2 field of format2 insns */
-#define OP3(x)		(((x)&0x3f) << 19) /* op3 field of format3 insns */
-#define OP(x)		((unsigned)((x)&0x3) << 30) /* op field of all insns */
-#define OPF(x)		(((x)&0x1ff) << 5) /* opf field of float insns */
-#define OPF_LOW5(x)	OPF((x)&0x1f) /* v9 */
-#define F3F(x, y, z)	(OP(x) | OP3(y) | OPF(z)) /* format3 float insns */
-#define F3I(x)		(((x)&0x1) << 13) /* immediate field of format 3 insns */
-#define F2(x, y)	(OP(x) | OP2(y)) /* format 2 insns */
-#define F3(x, y, z)	(OP(x) | OP3(y) | F3I(z)) /* format3 insns */
-#define F1(x)		(OP(x))
-#define DISP30(x)	((x)&0x3fffffff)
-#define ASI(x)		(((x)&0xff) << 5) /* asi field of format3 insns */
-#define RS2(x)		((x)&0x1f) /* rs2 field */
-#define SIMM13(x)	((x)&0x1fff) /* simm13 field */
-#define RD(x)		(((x)&0x1f) << 25) /* destination register field */
-#define RS1(x)		(((x)&0x1f) << 14) /* rs1 field */
-#define ASI_RS2(x)	(SIMM13(x))
-#define MEMBAR(x)	((x)&0x7f)
-#define SLCPOP(x)	(((x)&0x7f) << 6) /* sparclet cpop */
-
-#define ANNUL	(1<<29)
-#define BPRED	(1<<19)	/* v9 */
-#define	IMMED	F3I(1)
-#define RD_G0	RD(~0)
-#define	RS1_G0	RS1(~0)
-#define	RS2_G0	RS2(~0)
+#define OP2(x)          (((x)&0x7) << 22) /* op2 field of format2 insns */
+#define OP3(x)          (((x)&0x3f) << 19) /* op3 field of format3 insns */
+#define OP(x)           ((unsigned)((x)&0x3) << 30) /* op field of all insns */
+#define OPF(x)          (((x)&0x1ff) << 5) /* opf field of float insns */
+#define OPF_LOW5(x)     OPF((x)&0x1f) /* v9 */
+#define F3F(x, y, z)    (OP(x) | OP3(y) | OPF(z)) /* format3 float insns */
+#define F3I(x)          (((x)&0x1) << 13) /* immediate field of format 3 insns */
+#define F2(x, y)        (OP(x) | OP2(y)) /* format 2 insns */
+#define F3(x, y, z)     (OP(x) | OP3(y) | F3I(z)) /* format3 insns */
+#define F1(x)           (OP(x))
+#define DISP30(x)       ((x)&0x3fffffff)
+#define ASI(x)          (((x)&0xff) << 5) /* asi field of format3 insns */
+#define RS2(x)          ((x)&0x1f) /* rs2 field */
+#define SIMM13(x)       ((x)&0x1fff) /* simm13 field */
+#define RD(x)           (((x)&0x1f) << 25) /* destination register field */
+#define RS1(x)          (((x)&0x1f) << 14) /* rs1 field */
+#define ASI_RS2(x)      (SIMM13(x))
+#define MEMBAR(x)       ((x)&0x7f)
+#define SLCPOP(x)       (((x)&0x7f) << 6) /* sparclet cpop */
+
+#define ANNUL   (1<<29)
+#define BPRED   (1<<19) /* v9 */
+#define IMMED   F3I(1)
+#define RD_G0   RD(~0)
+#define RS1_G0  RS1(~0)
+#define RS2_G0  RS2(~0)
 
 extern const struct sparc_opcode sparc_opcodes[];
 extern const int sparc_num_opcodes;
@@ -229,43 +229,43 @@ extern int sparc_encode_sparclet_cpreg PARAMS ((const char *));
 extern const char *sparc_decode_sparclet_cpreg PARAMS ((int));
 
 /* Some defines to make life easy.  */
-#define MASK_V6		SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V6)
-#define MASK_V7		SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V7)
-#define MASK_V8		SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V8)
-#define MASK_SPARCLET	SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_SPARCLET)
-#define MASK_SPARCLITE	SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_SPARCLITE)
-#define MASK_V9		SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V9)
-#define MASK_V9A	SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V9A)
-#define MASK_V9B	SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V9B)
+#define MASK_V6         SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V6)
+#define MASK_V7         SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V7)
+#define MASK_V8         SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V8)
+#define MASK_SPARCLET   SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_SPARCLET)
+#define MASK_SPARCLITE  SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_SPARCLITE)
+#define MASK_V9         SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V9)
+#define MASK_V9A        SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V9A)
+#define MASK_V9B        SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V9B)
 
 /* Bit masks of architectures supporting the insn.  */
 
-#define v6		(MASK_V6 | MASK_V7 | MASK_V8 | MASK_SPARCLET \
-			 | MASK_SPARCLITE | MASK_V9 | MASK_V9A | MASK_V9B)
+#define v6              (MASK_V6 | MASK_V7 | MASK_V8 | MASK_SPARCLET \
+                         | MASK_SPARCLITE | MASK_V9 | MASK_V9A | MASK_V9B)
 /* v6 insns not supported on the sparclet */
-#define v6notlet	(MASK_V6 | MASK_V7 | MASK_V8 \
-			 | MASK_SPARCLITE | MASK_V9 | MASK_V9A | MASK_V9B)
-#define v7		(MASK_V7 | MASK_V8 | MASK_SPARCLET \
-			 | MASK_SPARCLITE | MASK_V9 | MASK_V9A | MASK_V9B)
+#define v6notlet        (MASK_V6 | MASK_V7 | MASK_V8 \
+                         | MASK_SPARCLITE | MASK_V9 | MASK_V9A | MASK_V9B)
+#define v7              (MASK_V7 | MASK_V8 | MASK_SPARCLET \
+                         | MASK_SPARCLITE | MASK_V9 | MASK_V9A | MASK_V9B)
 /* Although not all insns are implemented in hardware, sparclite is defined
    to be a superset of v8.  Unimplemented insns trap and are then theoretically
    implemented in software.
    It's not clear that the same is true for sparclet, although the docs
    suggest it is.  Rather than complicating things, the sparclet assembler
    recognizes all v8 insns.  */
-#define v8		(MASK_V8 | MASK_SPARCLET | MASK_SPARCLITE \
-			 | MASK_V9 | MASK_V9A | MASK_V9B)
-#define sparclet	(MASK_SPARCLET)
-#define sparclite	(MASK_SPARCLITE)
-#define v9		(MASK_V9 | MASK_V9A | MASK_V9B)
-#define v9a		(MASK_V9A | MASK_V9B)
-#define v9b		(MASK_V9B)
+#define v8              (MASK_V8 | MASK_SPARCLET | MASK_SPARCLITE \
+                         | MASK_V9 | MASK_V9A | MASK_V9B)
+#define sparclet        (MASK_SPARCLET)
+#define sparclite       (MASK_SPARCLITE)
+#define v9              (MASK_V9 | MASK_V9A | MASK_V9B)
+#define v9a             (MASK_V9A | MASK_V9B)
+#define v9b             (MASK_V9B)
 /* v6 insns not supported by v9 */
-#define v6notv9		(MASK_V6 | MASK_V7 | MASK_V8 \
-			 | MASK_SPARCLET | MASK_SPARCLITE)
+#define v6notv9         (MASK_V6 | MASK_V7 | MASK_V8 \
+                         | MASK_SPARCLET | MASK_SPARCLITE)
 /* v9a instructions which would appear to be aliases to v9's impdep's
    otherwise */
-#define v9notv9a	(MASK_V9)
+#define v9notv9a        (MASK_V9)
 
 /* Table of opcode architectures.
    The order is defined in opcode/sparc.h.  */
@@ -296,959 +296,959 @@ sparc_opcode_lookup_arch (name)
   for (p = &sparc_opcode_archs[0]; p->name; ++p)
     {
       if (strcmp (name, p->name) == 0)
-	return (enum sparc_opcode_arch_val) (p - &sparc_opcode_archs[0]);
+        return (enum sparc_opcode_arch_val) (p - &sparc_opcode_archs[0]);
     }
 
   return SPARC_OPCODE_ARCH_BAD;
 }
 
 /* Branch condition field.  */
-#define COND(x)		(((x)&0xf)<<25)
+#define COND(x)         (((x)&0xf)<<25)
 
 /* v9: Move (MOVcc and FMOVcc) condition field.  */
-#define MCOND(x,i_or_f)	((((i_or_f)&1)<<18)|(((x)>>11)&(0xf<<14))) /* v9 */
+#define MCOND(x,i_or_f) ((((i_or_f)&1)<<18)|(((x)>>11)&(0xf<<14))) /* v9 */
 
 /* v9: Move register (MOVRcc and FMOVRcc) condition field.  */
-#define RCOND(x)	(((x)&0x7)<<10)	/* v9 */
-
-#define CONDA	(COND(0x8))
-#define CONDCC	(COND(0xd))
-#define CONDCS	(COND(0x5))
-#define CONDE	(COND(0x1))
-#define CONDG	(COND(0xa))
-#define CONDGE	(COND(0xb))
-#define CONDGU	(COND(0xc))
-#define CONDL	(COND(0x3))
-#define CONDLE	(COND(0x2))
-#define CONDLEU	(COND(0x4))
-#define CONDN	(COND(0x0))
-#define CONDNE	(COND(0x9))
-#define CONDNEG	(COND(0x6))
-#define CONDPOS	(COND(0xe))
-#define CONDVC	(COND(0xf))
-#define CONDVS	(COND(0x7))
-
-#define CONDNZ	CONDNE
-#define CONDZ	CONDE
-#define CONDGEU	CONDCC
-#define CONDLU	CONDCS
-
-#define FCONDA		(COND(0x8))
-#define FCONDE		(COND(0x9))
-#define FCONDG		(COND(0x6))
-#define FCONDGE		(COND(0xb))
-#define FCONDL		(COND(0x4))
-#define FCONDLE		(COND(0xd))
-#define FCONDLG		(COND(0x2))
-#define FCONDN		(COND(0x0))
-#define FCONDNE		(COND(0x1))
-#define FCONDO		(COND(0xf))
-#define FCONDU		(COND(0x7))
-#define FCONDUE		(COND(0xa))
-#define FCONDUG		(COND(0x5))
-#define FCONDUGE	(COND(0xc))
-#define FCONDUL		(COND(0x3))
-#define FCONDULE	(COND(0xe))
-
-#define FCONDNZ	FCONDNE
-#define FCONDZ	FCONDE
-
-#define ICC (0)	/* v9 */
+#define RCOND(x)        (((x)&0x7)<<10) /* v9 */
+
+#define CONDA   (COND(0x8))
+#define CONDCC  (COND(0xd))
+#define CONDCS  (COND(0x5))
+#define CONDE   (COND(0x1))
+#define CONDG   (COND(0xa))
+#define CONDGE  (COND(0xb))
+#define CONDGU  (COND(0xc))
+#define CONDL   (COND(0x3))
+#define CONDLE  (COND(0x2))
+#define CONDLEU (COND(0x4))
+#define CONDN   (COND(0x0))
+#define CONDNE  (COND(0x9))
+#define CONDNEG (COND(0x6))
+#define CONDPOS (COND(0xe))
+#define CONDVC  (COND(0xf))
+#define CONDVS  (COND(0x7))
+
+#define CONDNZ  CONDNE
+#define CONDZ   CONDE
+#define CONDGEU CONDCC
+#define CONDLU  CONDCS
+
+#define FCONDA          (COND(0x8))
+#define FCONDE          (COND(0x9))
+#define FCONDG          (COND(0x6))
+#define FCONDGE         (COND(0xb))
+#define FCONDL          (COND(0x4))
+#define FCONDLE         (COND(0xd))
+#define FCONDLG         (COND(0x2))
+#define FCONDN          (COND(0x0))
+#define FCONDNE         (COND(0x1))
+#define FCONDO          (COND(0xf))
+#define FCONDU          (COND(0x7))
+#define FCONDUE         (COND(0xa))
+#define FCONDUG         (COND(0x5))
+#define FCONDUGE        (COND(0xc))
+#define FCONDUL         (COND(0x3))
+#define FCONDULE        (COND(0xe))
+
+#define FCONDNZ FCONDNE
+#define FCONDZ  FCONDE
+
+#define ICC (0) /* v9 */
 #define XCC (1<<12) /* v9 */
-#define FCC(x)	(((x)&0x3)<<11) /* v9 */
-#define FBFCC(x)	(((x)&0x3)<<20)	/* v9 */
+#define FCC(x)  (((x)&0x3)<<11) /* v9 */
+#define FBFCC(x)        (((x)&0x3)<<20) /* v9 */
 
 /* The order of the opcodes in the table is significant:
 
-	* The assembler requires that all instances of the same mnemonic must
-	be consecutive.	If they aren't, the assembler will bomb at runtime.
+        * The assembler requires that all instances of the same mnemonic must
+        be consecutive. If they aren't, the assembler will bomb at runtime.
 
-	* The disassembler should not care about the order of the opcodes.
+        * The disassembler should not care about the order of the opcodes.
 
 */
 
 /* Entries for commutative arithmetic operations.  */
 /* ??? More entries can make use of this.  */
 #define COMMUTEOP(opcode, op3, arch_mask) \
-{ opcode,	F3(2, op3, 0), F3(~2, ~op3, ~0)|ASI(~0),	"1,2,d", 0, arch_mask }, \
-{ opcode,	F3(2, op3, 1), F3(~2, ~op3, ~1),		"1,i,d", 0, arch_mask }, \
-{ opcode,	F3(2, op3, 1), F3(~2, ~op3, ~1),		"i,1,d", 0, arch_mask }
+{ opcode,       F3(2, op3, 0), F3(~2, ~op3, ~0)|ASI(~0),        "1,2,d", 0, arch_mask }, \
+{ opcode,       F3(2, op3, 1), F3(~2, ~op3, ~1),                "1,i,d", 0, arch_mask }, \
+{ opcode,       F3(2, op3, 1), F3(~2, ~op3, ~1),                "i,1,d", 0, arch_mask }
 
 const struct sparc_opcode sparc_opcodes[] = {
 
-{ "ld",	F3(3, 0x00, 0), F3(~3, ~0x00, ~0),		"[1+2],d", 0, v6 },
-{ "ld",	F3(3, 0x00, 0), F3(~3, ~0x00, ~0)|RS2_G0,	"[1],d", 0, v6 }, /* ld [rs1+%g0],d */
-{ "ld",	F3(3, 0x00, 1), F3(~3, ~0x00, ~1),		"[1+i],d", 0, v6 },
-{ "ld",	F3(3, 0x00, 1), F3(~3, ~0x00, ~1),		"[i+1],d", 0, v6 },
-{ "ld",	F3(3, 0x00, 1), F3(~3, ~0x00, ~1)|RS1_G0,	"[i],d", 0, v6 },
-{ "ld",	F3(3, 0x00, 1), F3(~3, ~0x00, ~1)|SIMM13(~0),	"[1],d", 0, v6 }, /* ld [rs1+0],d */
-{ "ld",	F3(3, 0x20, 0), F3(~3, ~0x20, ~0),		"[1+2],g", 0, v6 },
-{ "ld",	F3(3, 0x20, 0), F3(~3, ~0x20, ~0)|RS2_G0,	"[1],g", 0, v6 }, /* ld [rs1+%g0],d */
-{ "ld",	F3(3, 0x20, 1), F3(~3, ~0x20, ~1),		"[1+i],g", 0, v6 },
-{ "ld",	F3(3, 0x20, 1), F3(~3, ~0x20, ~1),		"[i+1],g", 0, v6 },
-{ "ld",	F3(3, 0x20, 1), F3(~3, ~0x20, ~1)|RS1_G0,	"[i],g", 0, v6 },
-{ "ld",	F3(3, 0x20, 1), F3(~3, ~0x20, ~1)|SIMM13(~0),	"[1],g", 0, v6 }, /* ld [rs1+0],d */
-
-{ "ld",	F3(3, 0x21, 0), F3(~3, ~0x21, ~0)|RD(~0),	"[1+2],F", 0, v6 },
-{ "ld",	F3(3, 0x21, 0), F3(~3, ~0x21, ~0)|RS2_G0|RD(~0),"[1],F", 0, v6 }, /* ld [rs1+%g0],d */
-{ "ld",	F3(3, 0x21, 1), F3(~3, ~0x21, ~1)|RD(~0),	"[1+i],F", 0, v6 },
-{ "ld",	F3(3, 0x21, 1), F3(~3, ~0x21, ~1)|RD(~0),	"[i+1],F", 0, v6 },
-{ "ld",	F3(3, 0x21, 1), F3(~3, ~0x21, ~1)|RS1_G0|RD(~0),"[i],F", 0, v6 },
-{ "ld",	F3(3, 0x21, 1), F3(~3, ~0x21, ~1)|SIMM13(~0)|RD(~0),"[1],F", 0, v6 }, /* ld [rs1+0],d */
-
-{ "ld",	F3(3, 0x30, 0), F3(~3, ~0x30, ~0),		"[1+2],D", 0, v6notv9 },
-{ "ld",	F3(3, 0x30, 0), F3(~3, ~0x30, ~0)|RS2_G0,	"[1],D", 0, v6notv9 }, /* ld [rs1+%g0],d */
-{ "ld",	F3(3, 0x30, 1), F3(~3, ~0x30, ~1),		"[1+i],D", 0, v6notv9 },
-{ "ld",	F3(3, 0x30, 1), F3(~3, ~0x30, ~1),		"[i+1],D", 0, v6notv9 },
-{ "ld",	F3(3, 0x30, 1), F3(~3, ~0x30, ~1)|RS1_G0,	"[i],D", 0, v6notv9 },
-{ "ld",	F3(3, 0x30, 1), F3(~3, ~0x30, ~1)|SIMM13(~0),	"[1],D", 0, v6notv9 }, /* ld [rs1+0],d */
-{ "ld",	F3(3, 0x31, 0), F3(~3, ~0x31, ~0),		"[1+2],C", 0, v6notv9 },
-{ "ld",	F3(3, 0x31, 0), F3(~3, ~0x31, ~0)|RS2_G0,	"[1],C", 0, v6notv9 }, /* ld [rs1+%g0],d */
-{ "ld",	F3(3, 0x31, 1), F3(~3, ~0x31, ~1),		"[1+i],C", 0, v6notv9 },
-{ "ld",	F3(3, 0x31, 1), F3(~3, ~0x31, ~1),		"[i+1],C", 0, v6notv9 },
-{ "ld",	F3(3, 0x31, 1), F3(~3, ~0x31, ~1)|RS1_G0,	"[i],C", 0, v6notv9 },
-{ "ld",	F3(3, 0x31, 1), F3(~3, ~0x31, ~1)|SIMM13(~0),	"[1],C", 0, v6notv9 }, /* ld [rs1+0],d */
+{ "ld", F3(3, 0x00, 0), F3(~3, ~0x00, ~0),              "[1+2],d", 0, v6 },
+{ "ld", F3(3, 0x00, 0), F3(~3, ~0x00, ~0)|RS2_G0,       "[1],d", 0, v6 }, /* ld [rs1+%g0],d */
+{ "ld", F3(3, 0x00, 1), F3(~3, ~0x00, ~1),              "[1+i],d", 0, v6 },
+{ "ld", F3(3, 0x00, 1), F3(~3, ~0x00, ~1),              "[i+1],d", 0, v6 },
+{ "ld", F3(3, 0x00, 1), F3(~3, ~0x00, ~1)|RS1_G0,       "[i],d", 0, v6 },
+{ "ld", F3(3, 0x00, 1), F3(~3, ~0x00, ~1)|SIMM13(~0),   "[1],d", 0, v6 }, /* ld [rs1+0],d */
+{ "ld", F3(3, 0x20, 0), F3(~3, ~0x20, ~0),              "[1+2],g", 0, v6 },
+{ "ld", F3(3, 0x20, 0), F3(~3, ~0x20, ~0)|RS2_G0,       "[1],g", 0, v6 }, /* ld [rs1+%g0],d */
+{ "ld", F3(3, 0x20, 1), F3(~3, ~0x20, ~1),              "[1+i],g", 0, v6 },
+{ "ld", F3(3, 0x20, 1), F3(~3, ~0x20, ~1),              "[i+1],g", 0, v6 },
+{ "ld", F3(3, 0x20, 1), F3(~3, ~0x20, ~1)|RS1_G0,       "[i],g", 0, v6 },
+{ "ld", F3(3, 0x20, 1), F3(~3, ~0x20, ~1)|SIMM13(~0),   "[1],g", 0, v6 }, /* ld [rs1+0],d */
+
+{ "ld", F3(3, 0x21, 0), F3(~3, ~0x21, ~0)|RD(~0),       "[1+2],F", 0, v6 },
+{ "ld", F3(3, 0x21, 0), F3(~3, ~0x21, ~0)|RS2_G0|RD(~0),"[1],F", 0, v6 }, /* ld [rs1+%g0],d */
+{ "ld", F3(3, 0x21, 1), F3(~3, ~0x21, ~1)|RD(~0),       "[1+i],F", 0, v6 },
+{ "ld", F3(3, 0x21, 1), F3(~3, ~0x21, ~1)|RD(~0),       "[i+1],F", 0, v6 },
+{ "ld", F3(3, 0x21, 1), F3(~3, ~0x21, ~1)|RS1_G0|RD(~0),"[i],F", 0, v6 },
+{ "ld", F3(3, 0x21, 1), F3(~3, ~0x21, ~1)|SIMM13(~0)|RD(~0),"[1],F", 0, v6 }, /* ld [rs1+0],d */
+
+{ "ld", F3(3, 0x30, 0), F3(~3, ~0x30, ~0),              "[1+2],D", 0, v6notv9 },
+{ "ld", F3(3, 0x30, 0), F3(~3, ~0x30, ~0)|RS2_G0,       "[1],D", 0, v6notv9 }, /* ld [rs1+%g0],d */
+{ "ld", F3(3, 0x30, 1), F3(~3, ~0x30, ~1),              "[1+i],D", 0, v6notv9 },
+{ "ld", F3(3, 0x30, 1), F3(~3, ~0x30, ~1),              "[i+1],D", 0, v6notv9 },
+{ "ld", F3(3, 0x30, 1), F3(~3, ~0x30, ~1)|RS1_G0,       "[i],D", 0, v6notv9 },
+{ "ld", F3(3, 0x30, 1), F3(~3, ~0x30, ~1)|SIMM13(~0),   "[1],D", 0, v6notv9 }, /* ld [rs1+0],d */
+{ "ld", F3(3, 0x31, 0), F3(~3, ~0x31, ~0),              "[1+2],C", 0, v6notv9 },
+{ "ld", F3(3, 0x31, 0), F3(~3, ~0x31, ~0)|RS2_G0,       "[1],C", 0, v6notv9 }, /* ld [rs1+%g0],d */
+{ "ld", F3(3, 0x31, 1), F3(~3, ~0x31, ~1),              "[1+i],C", 0, v6notv9 },
+{ "ld", F3(3, 0x31, 1), F3(~3, ~0x31, ~1),              "[i+1],C", 0, v6notv9 },
+{ "ld", F3(3, 0x31, 1), F3(~3, ~0x31, ~1)|RS1_G0,       "[i],C", 0, v6notv9 },
+{ "ld", F3(3, 0x31, 1), F3(~3, ~0x31, ~1)|SIMM13(~0),   "[1],C", 0, v6notv9 }, /* ld [rs1+0],d */
 
 /* The v9 LDUW is the same as the old 'ld' opcode, it is not the same as the
    'ld' pseudo-op in v9.  */
-{ "lduw",	F3(3, 0x00, 0), F3(~3, ~0x00, ~0),		"[1+2],d", F_ALIAS, v9 },
-{ "lduw",	F3(3, 0x00, 0), F3(~3, ~0x00, ~0)|RS2_G0,	"[1],d", F_ALIAS, v9 }, /* ld [rs1+%g0],d */
-{ "lduw",	F3(3, 0x00, 1), F3(~3, ~0x00, ~1),		"[1+i],d", F_ALIAS, v9 },
-{ "lduw",	F3(3, 0x00, 1), F3(~3, ~0x00, ~1),		"[i+1],d", F_ALIAS, v9 },
-{ "lduw",	F3(3, 0x00, 1), F3(~3, ~0x00, ~1)|RS1_G0,	"[i],d", F_ALIAS, v9 },
-{ "lduw",	F3(3, 0x00, 1), F3(~3, ~0x00, ~1)|SIMM13(~0),	"[1],d", F_ALIAS, v9 }, /* ld [rs1+0],d */
-
-{ "ldd",	F3(3, 0x03, 0), F3(~3, ~0x03, ~0)|ASI(~0),	"[1+2],d", 0, v6 },
-{ "ldd",	F3(3, 0x03, 0), F3(~3, ~0x03, ~0)|ASI_RS2(~0),	"[1],d", 0, v6 }, /* ldd [rs1+%g0],d */
-{ "ldd",	F3(3, 0x03, 1), F3(~3, ~0x03, ~1),		"[1+i],d", 0, v6 },
-{ "ldd",	F3(3, 0x03, 1), F3(~3, ~0x03, ~1),		"[i+1],d", 0, v6 },
-{ "ldd",	F3(3, 0x03, 1), F3(~3, ~0x03, ~1)|RS1_G0,	"[i],d", 0, v6 },
-{ "ldd",	F3(3, 0x03, 1), F3(~3, ~0x03, ~1)|SIMM13(~0),	"[1],d", 0, v6 }, /* ldd [rs1+0],d */
-{ "ldd",	F3(3, 0x23, 0), F3(~3, ~0x23, ~0)|ASI(~0),	"[1+2],H", 0, v6 },
-{ "ldd",	F3(3, 0x23, 0), F3(~3, ~0x23, ~0)|ASI_RS2(~0),	"[1],H", 0, v6 }, /* ldd [rs1+%g0],d */
-{ "ldd",	F3(3, 0x23, 1), F3(~3, ~0x23, ~1),		"[1+i],H", 0, v6 },
-{ "ldd",	F3(3, 0x23, 1), F3(~3, ~0x23, ~1),		"[i+1],H", 0, v6 },
-{ "ldd",	F3(3, 0x23, 1), F3(~3, ~0x23, ~1)|RS1_G0,	"[i],H", 0, v6 },
-{ "ldd",	F3(3, 0x23, 1), F3(~3, ~0x23, ~1)|SIMM13(~0),	"[1],H", 0, v6 }, /* ldd [rs1+0],d */
-
-{ "ldd",	F3(3, 0x33, 0), F3(~3, ~0x33, ~0)|ASI(~0),	"[1+2],D", 0, v6notv9 },
-{ "ldd",	F3(3, 0x33, 0), F3(~3, ~0x33, ~0)|ASI_RS2(~0),	"[1],D", 0, v6notv9 }, /* ldd [rs1+%g0],d */
-{ "ldd",	F3(3, 0x33, 1), F3(~3, ~0x33, ~1),		"[1+i],D", 0, v6notv9 },
-{ "ldd",	F3(3, 0x33, 1), F3(~3, ~0x33, ~1),		"[i+1],D", 0, v6notv9 },
-{ "ldd",	F3(3, 0x33, 1), F3(~3, ~0x33, ~1)|RS1_G0,	"[i],D", 0, v6notv9 },
-{ "ldd",	F3(3, 0x33, 1), F3(~3, ~0x33, ~1)|SIMM13(~0),	"[1],D", 0, v6notv9 }, /* ldd [rs1+0],d */
-
-{ "ldq",	F3(3, 0x22, 0), F3(~3, ~0x22, ~0)|ASI(~0),	"[1+2],J", 0, v9 },
-{ "ldq",	F3(3, 0x22, 0), F3(~3, ~0x22, ~0)|ASI_RS2(~0),	"[1],J", 0, v9 }, /* ldd [rs1+%g0],d */
-{ "ldq",	F3(3, 0x22, 1), F3(~3, ~0x22, ~1),		"[1+i],J", 0, v9 },
-{ "ldq",	F3(3, 0x22, 1), F3(~3, ~0x22, ~1),		"[i+1],J", 0, v9 },
-{ "ldq",	F3(3, 0x22, 1), F3(~3, ~0x22, ~1)|RS1_G0,	"[i],J", 0, v9 },
-{ "ldq",	F3(3, 0x22, 1), F3(~3, ~0x22, ~1)|SIMM13(~0),	"[1],J", 0, v9 }, /* ldd [rs1+0],d */
-
-{ "ldsb",	F3(3, 0x09, 0), F3(~3, ~0x09, ~0)|ASI(~0),	"[1+2],d", 0, v6 },
-{ "ldsb",	F3(3, 0x09, 0), F3(~3, ~0x09, ~0)|ASI_RS2(~0),	"[1],d", 0, v6 }, /* ldsb [rs1+%g0],d */
-{ "ldsb",	F3(3, 0x09, 1), F3(~3, ~0x09, ~1),		"[1+i],d", 0, v6 },
-{ "ldsb",	F3(3, 0x09, 1), F3(~3, ~0x09, ~1),		"[i+1],d", 0, v6 },
-{ "ldsb",	F3(3, 0x09, 1), F3(~3, ~0x09, ~1)|RS1_G0,	"[i],d", 0, v6 },
-{ "ldsb",	F3(3, 0x09, 1), F3(~3, ~0x09, ~1)|SIMM13(~0),	"[1],d", 0, v6 }, /* ldsb [rs1+0],d */
-
-{ "ldsh",	F3(3, 0x0a, 0), F3(~3, ~0x0a, ~0)|ASI_RS2(~0),	"[1],d", 0, v6 }, /* ldsh [rs1+%g0],d */
-{ "ldsh",	F3(3, 0x0a, 0), F3(~3, ~0x0a, ~0)|ASI(~0),	"[1+2],d", 0, v6 },
-{ "ldsh",	F3(3, 0x0a, 1), F3(~3, ~0x0a, ~1),		"[1+i],d", 0, v6 },
-{ "ldsh",	F3(3, 0x0a, 1), F3(~3, ~0x0a, ~1),		"[i+1],d", 0, v6 },
-{ "ldsh",	F3(3, 0x0a, 1), F3(~3, ~0x0a, ~1)|RS1_G0,	"[i],d", 0, v6 },
-{ "ldsh",	F3(3, 0x0a, 1), F3(~3, ~0x0a, ~1)|SIMM13(~0),	"[1],d", 0, v6 }, /* ldsh [rs1+0],d */
-
-{ "ldstub",	F3(3, 0x0d, 0), F3(~3, ~0x0d, ~0)|ASI(~0),	"[1+2],d", 0, v6 },
-{ "ldstub",	F3(3, 0x0d, 0), F3(~3, ~0x0d, ~0)|ASI_RS2(~0),	"[1],d", 0, v6 }, /* ldstub [rs1+%g0],d */
-{ "ldstub",	F3(3, 0x0d, 1), F3(~3, ~0x0d, ~1),		"[1+i],d", 0, v6 },
-{ "ldstub",	F3(3, 0x0d, 1), F3(~3, ~0x0d, ~1),		"[i+1],d", 0, v6 },
-{ "ldstub",	F3(3, 0x0d, 1), F3(~3, ~0x0d, ~1)|RS1_G0,	"[i],d", 0, v6 },
-{ "ldstub",	F3(3, 0x0d, 1), F3(~3, ~0x0d, ~1)|SIMM13(~0),	"[1],d", 0, v6 }, /* ldstub [rs1+0],d */
-
-{ "ldsw",	F3(3, 0x08, 0), F3(~3, ~0x08, ~0)|ASI(~0),	"[1+2],d", 0, v9 },
-{ "ldsw",	F3(3, 0x08, 0), F3(~3, ~0x08, ~0)|ASI_RS2(~0),	"[1],d", 0, v9 }, /* ldsw [rs1+%g0],d */
-{ "ldsw",	F3(3, 0x08, 1), F3(~3, ~0x08, ~1),		"[1+i],d", 0, v9 },
-{ "ldsw",	F3(3, 0x08, 1), F3(~3, ~0x08, ~1),		"[i+1],d", 0, v9 },
-{ "ldsw",	F3(3, 0x08, 1), F3(~3, ~0x08, ~1)|RS1_G0,	"[i],d", 0, v9 },
-{ "ldsw",	F3(3, 0x08, 1), F3(~3, ~0x08, ~1)|SIMM13(~0),	"[1],d", 0, v9 }, /* ldsw [rs1+0],d */
-
-{ "ldub",	F3(3, 0x01, 0), F3(~3, ~0x01, ~0)|ASI(~0),	"[1+2],d", 0, v6 },
-{ "ldub",	F3(3, 0x01, 0), F3(~3, ~0x01, ~0)|ASI_RS2(~0),	"[1],d", 0, v6 }, /* ldub [rs1+%g0],d */
-{ "ldub",	F3(3, 0x01, 1), F3(~3, ~0x01, ~1),		"[1+i],d", 0, v6 },
-{ "ldub",	F3(3, 0x01, 1), F3(~3, ~0x01, ~1),		"[i+1],d", 0, v6 },
-{ "ldub",	F3(3, 0x01, 1), F3(~3, ~0x01, ~1)|RS1_G0,	"[i],d", 0, v6 },
-{ "ldub",	F3(3, 0x01, 1), F3(~3, ~0x01, ~1)|SIMM13(~0),	"[1],d", 0, v6 }, /* ldub [rs1+0],d */
-
-{ "lduh",	F3(3, 0x02, 0), F3(~3, ~0x02, ~0)|ASI(~0),	"[1+2],d", 0, v6 },
-{ "lduh",	F3(3, 0x02, 0), F3(~3, ~0x02, ~0)|ASI_RS2(~0),	"[1],d", 0, v6 }, /* lduh [rs1+%g0],d */
-{ "lduh",	F3(3, 0x02, 1), F3(~3, ~0x02, ~1),		"[1+i],d", 0, v6 },
-{ "lduh",	F3(3, 0x02, 1), F3(~3, ~0x02, ~1),		"[i+1],d", 0, v6 },
-{ "lduh",	F3(3, 0x02, 1), F3(~3, ~0x02, ~1)|RS1_G0,	"[i],d", 0, v6 },
-{ "lduh",	F3(3, 0x02, 1), F3(~3, ~0x02, ~1)|SIMM13(~0),	"[1],d", 0, v6 }, /* lduh [rs1+0],d */
-
-{ "ldx",	F3(3, 0x0b, 0), F3(~3, ~0x0b, ~0)|ASI(~0),	"[1+2],d", 0, v9 },
-{ "ldx",	F3(3, 0x0b, 0), F3(~3, ~0x0b, ~0)|ASI_RS2(~0),	"[1],d", 0, v9 }, /* ldx [rs1+%g0],d */
-{ "ldx",	F3(3, 0x0b, 1), F3(~3, ~0x0b, ~1),		"[1+i],d", 0, v9 },
-{ "ldx",	F3(3, 0x0b, 1), F3(~3, ~0x0b, ~1),		"[i+1],d", 0, v9 },
-{ "ldx",	F3(3, 0x0b, 1), F3(~3, ~0x0b, ~1)|RS1_G0,	"[i],d", 0, v9 },
-{ "ldx",	F3(3, 0x0b, 1), F3(~3, ~0x0b, ~1)|SIMM13(~0),	"[1],d", 0, v9 }, /* ldx [rs1+0],d */
-
-{ "ldx",	F3(3, 0x21, 0)|RD(1), F3(~3, ~0x21, ~0)|RD(~1),	"[1+2],F", 0, v9 },
-{ "ldx",	F3(3, 0x21, 0)|RD(1), F3(~3, ~0x21, ~0)|RS2_G0|RD(~1),	"[1],F", 0, v9 }, /* ld [rs1+%g0],d */
-{ "ldx",	F3(3, 0x21, 1)|RD(1), F3(~3, ~0x21, ~1)|RD(~1),	"[1+i],F", 0, v9 },
-{ "ldx",	F3(3, 0x21, 1)|RD(1), F3(~3, ~0x21, ~1)|RD(~1),	"[i+1],F", 0, v9 },
-{ "ldx",	F3(3, 0x21, 1)|RD(1), F3(~3, ~0x21, ~1)|RS1_G0|RD(~1),	"[i],F", 0, v9 },
-{ "ldx",	F3(3, 0x21, 1)|RD(1), F3(~3, ~0x21, ~1)|SIMM13(~0)|RD(~1),"[1],F", 0, v9 }, /* ld [rs1+0],d */
-
-{ "lda",	F3(3, 0x10, 0), F3(~3, ~0x10, ~0),		"[1+2]A,d", 0, v6 },
-{ "lda",	F3(3, 0x10, 0), F3(~3, ~0x10, ~0)|RS2_G0,	"[1]A,d", 0, v6 }, /* lda [rs1+%g0],d */
-{ "lda",	F3(3, 0x10, 1), F3(~3, ~0x10, ~1),		"[1+i]o,d", 0, v9 },
-{ "lda",	F3(3, 0x10, 1), F3(~3, ~0x10, ~1),		"[i+1]o,d", 0, v9 },
-{ "lda",	F3(3, 0x10, 1), F3(~3, ~0x10, ~1)|RS1_G0,	"[i]o,d", 0, v9 },
-{ "lda",	F3(3, 0x10, 1), F3(~3, ~0x10, ~1)|SIMM13(~0),	"[1]o,d", 0, v9 }, /* ld [rs1+0],d */
-{ "lda",	F3(3, 0x30, 0), F3(~3, ~0x30, ~0),		"[1+2]A,g", 0, v9 },
-{ "lda",	F3(3, 0x30, 0), F3(~3, ~0x30, ~0)|RS2_G0,	"[1]A,g", 0, v9 }, /* lda [rs1+%g0],d */
-{ "lda",	F3(3, 0x30, 1), F3(~3, ~0x30, ~1),		"[1+i]o,g", 0, v9 },
-{ "lda",	F3(3, 0x30, 1), F3(~3, ~0x30, ~1),		"[i+1]o,g", 0, v9 },
-{ "lda",	F3(3, 0x30, 1), F3(~3, ~0x30, ~1)|RS1_G0,	"[i]o,g", 0, v9 },
-{ "lda",	F3(3, 0x30, 1), F3(~3, ~0x30, ~1)|SIMM13(~0),	"[1]o,g", 0, v9 }, /* ld [rs1+0],d */
-
-{ "ldda",	F3(3, 0x13, 0), F3(~3, ~0x13, ~0),		"[1+2]A,d", 0, v6 },
-{ "ldda",	F3(3, 0x13, 0), F3(~3, ~0x13, ~0)|RS2_G0,	"[1]A,d", 0, v6 }, /* ldda [rs1+%g0],d */
-{ "ldda",	F3(3, 0x13, 1), F3(~3, ~0x13, ~1),		"[1+i]o,d", 0, v9 },
-{ "ldda",	F3(3, 0x13, 1), F3(~3, ~0x13, ~1),		"[i+1]o,d", 0, v9 },
-{ "ldda",	F3(3, 0x13, 1), F3(~3, ~0x13, ~1)|RS1_G0,	"[i]o,d", 0, v9 },
-{ "ldda",	F3(3, 0x13, 1), F3(~3, ~0x13, ~1)|SIMM13(~0),	"[1]o,d", 0, v9 }, /* ld [rs1+0],d */
-
-{ "ldda",	F3(3, 0x33, 0), F3(~3, ~0x33, ~0),		"[1+2]A,H", 0, v9 },
-{ "ldda",	F3(3, 0x33, 0), F3(~3, ~0x33, ~0)|RS2_G0,	"[1]A,H", 0, v9 }, /* ldda [rs1+%g0],d */
-{ "ldda",	F3(3, 0x33, 1), F3(~3, ~0x33, ~1),		"[1+i]o,H", 0, v9 },
-{ "ldda",	F3(3, 0x33, 1), F3(~3, ~0x33, ~1),		"[i+1]o,H", 0, v9 },
-{ "ldda",	F3(3, 0x33, 1), F3(~3, ~0x33, ~1)|RS1_G0,	"[i]o,H", 0, v9 },
-{ "ldda",	F3(3, 0x33, 1), F3(~3, ~0x33, ~1)|SIMM13(~0),	"[1]o,H", 0, v9 }, /* ld [rs1+0],d */
-
-{ "ldqa",	F3(3, 0x32, 0), F3(~3, ~0x32, ~0),		"[1+2]A,J", 0, v9 },
-{ "ldqa",	F3(3, 0x32, 0), F3(~3, ~0x32, ~0)|RS2_G0,	"[1]A,J", 0, v9 }, /* ldd [rs1+%g0],d */
-{ "ldqa",	F3(3, 0x32, 1), F3(~3, ~0x32, ~1),		"[1+i]o,J", 0, v9 },
-{ "ldqa",	F3(3, 0x32, 1), F3(~3, ~0x32, ~1),		"[i+1]o,J", 0, v9 },
-{ "ldqa",	F3(3, 0x32, 1), F3(~3, ~0x32, ~1)|RS1_G0,	"[i]o,J", 0, v9 },
-{ "ldqa",	F3(3, 0x32, 1), F3(~3, ~0x32, ~1)|SIMM13(~0),	"[1]o,J", 0, v9 }, /* ldd [rs1+0],d */
-
-{ "ldsba",	F3(3, 0x19, 0), F3(~3, ~0x19, ~0),		"[1+2]A,d", 0, v6 },
-{ "ldsba",	F3(3, 0x19, 0), F3(~3, ~0x19, ~0)|RS2_G0,	"[1]A,d", 0, v6 }, /* ldsba [rs1+%g0],d */
-{ "ldsba",	F3(3, 0x19, 1), F3(~3, ~0x19, ~1),		"[1+i]o,d", 0, v9 },
-{ "ldsba",	F3(3, 0x19, 1), F3(~3, ~0x19, ~1),		"[i+1]o,d", 0, v9 },
-{ "ldsba",	F3(3, 0x19, 1), F3(~3, ~0x19, ~1)|RS1_G0,	"[i]o,d", 0, v9 },
-{ "ldsba",	F3(3, 0x19, 1), F3(~3, ~0x19, ~1)|SIMM13(~0),	"[1]o,d", 0, v9 }, /* ld [rs1+0],d */
-
-{ "ldsha",	F3(3, 0x1a, 0), F3(~3, ~0x1a, ~0),		"[1+2]A,d", 0, v6 },
-{ "ldsha",	F3(3, 0x1a, 0), F3(~3, ~0x1a, ~0)|RS2_G0,	"[1]A,d", 0, v6 }, /* ldsha [rs1+%g0],d */
-{ "ldsha",	F3(3, 0x1a, 1), F3(~3, ~0x1a, ~1),		"[1+i]o,d", 0, v9 },
-{ "ldsha",	F3(3, 0x1a, 1), F3(~3, ~0x1a, ~1),		"[i+1]o,d", 0, v9 },
-{ "ldsha",	F3(3, 0x1a, 1), F3(~3, ~0x1a, ~1)|RS1_G0,	"[i]o,d", 0, v9 },
-{ "ldsha",	F3(3, 0x1a, 1), F3(~3, ~0x1a, ~1)|SIMM13(~0),	"[1]o,d", 0, v9 }, /* ld [rs1+0],d */
-
-{ "ldstuba",	F3(3, 0x1d, 0), F3(~3, ~0x1d, ~0),		"[1+2]A,d", 0, v6 },
-{ "ldstuba",	F3(3, 0x1d, 0), F3(~3, ~0x1d, ~0)|RS2_G0,	"[1]A,d", 0, v6 }, /* ldstuba [rs1+%g0],d */
-{ "ldstuba",	F3(3, 0x1d, 1), F3(~3, ~0x1d, ~1),		"[1+i]o,d", 0, v9 },
-{ "ldstuba",	F3(3, 0x1d, 1), F3(~3, ~0x1d, ~1),		"[i+1]o,d", 0, v9 },
-{ "ldstuba",	F3(3, 0x1d, 1), F3(~3, ~0x1d, ~1)|RS1_G0,	"[i]o,d", 0, v9 },
-{ "ldstuba",	F3(3, 0x1d, 1), F3(~3, ~0x1d, ~1)|SIMM13(~0),	"[1]o,d", 0, v9 }, /* ld [rs1+0],d */
-
-{ "ldswa",	F3(3, 0x18, 0), F3(~3, ~0x18, ~0),		"[1+2]A,d", 0, v9 },
-{ "ldswa",	F3(3, 0x18, 0), F3(~3, ~0x18, ~0)|RS2_G0,	"[1]A,d", 0, v9 }, /* lda [rs1+%g0],d */
-{ "ldswa",	F3(3, 0x18, 1), F3(~3, ~0x18, ~1),		"[1+i]o,d", 0, v9 },
-{ "ldswa",	F3(3, 0x18, 1), F3(~3, ~0x18, ~1),		"[i+1]o,d", 0, v9 },
-{ "ldswa",	F3(3, 0x18, 1), F3(~3, ~0x18, ~1)|RS1_G0,	"[i]o,d", 0, v9 },
-{ "ldswa",	F3(3, 0x18, 1), F3(~3, ~0x18, ~1)|SIMM13(~0),	"[1]o,d", 0, v9 }, /* ld [rs1+0],d */
-
-{ "lduba",	F3(3, 0x11, 0), F3(~3, ~0x11, ~0),		"[1+2]A,d", 0, v6 },
-{ "lduba",	F3(3, 0x11, 0), F3(~3, ~0x11, ~0)|RS2_G0,	"[1]A,d", 0, v6 }, /* lduba [rs1+%g0],d */
-{ "lduba",	F3(3, 0x11, 1), F3(~3, ~0x11, ~1),		"[1+i]o,d", 0, v9 },
-{ "lduba",	F3(3, 0x11, 1), F3(~3, ~0x11, ~1),		"[i+1]o,d", 0, v9 },
-{ "lduba",	F3(3, 0x11, 1), F3(~3, ~0x11, ~1)|RS1_G0,	"[i]o,d", 0, v9 },
-{ "lduba",	F3(3, 0x11, 1), F3(~3, ~0x11, ~1)|SIMM13(~0),	"[1]o,d", 0, v9 }, /* ld [rs1+0],d */
-
-{ "lduha",	F3(3, 0x12, 0), F3(~3, ~0x12, ~0),		"[1+2]A,d", 0, v6 },
-{ "lduha",	F3(3, 0x12, 0), F3(~3, ~0x12, ~0)|RS2_G0,	"[1]A,d", 0, v6 }, /* lduha [rs1+%g0],d */
-{ "lduha",	F3(3, 0x12, 1), F3(~3, ~0x12, ~1),		"[1+i]o,d", 0, v9 },
-{ "lduha",	F3(3, 0x12, 1), F3(~3, ~0x12, ~1),		"[i+1]o,d", 0, v9 },
-{ "lduha",	F3(3, 0x12, 1), F3(~3, ~0x12, ~1)|RS1_G0,	"[i]o,d", 0, v9 },
-{ "lduha",	F3(3, 0x12, 1), F3(~3, ~0x12, ~1)|SIMM13(~0),	"[1]o,d", 0, v9 }, /* ld [rs1+0],d */
-
-{ "lduwa",	F3(3, 0x10, 0), F3(~3, ~0x10, ~0),		"[1+2]A,d", F_ALIAS, v9 }, /* lduwa === lda */
-{ "lduwa",	F3(3, 0x10, 0), F3(~3, ~0x10, ~0)|RS2_G0,	"[1]A,d", F_ALIAS, v9 }, /* lda [rs1+%g0],d */
-{ "lduwa",	F3(3, 0x10, 1), F3(~3, ~0x10, ~1),		"[1+i]o,d", F_ALIAS, v9 },
-{ "lduwa",	F3(3, 0x10, 1), F3(~3, ~0x10, ~1),		"[i+1]o,d", F_ALIAS, v9 },
-{ "lduwa",	F3(3, 0x10, 1), F3(~3, ~0x10, ~1)|RS1_G0,	"[i]o,d", F_ALIAS, v9 },
-{ "lduwa",	F3(3, 0x10, 1), F3(~3, ~0x10, ~1)|SIMM13(~0),	"[1]o,d", F_ALIAS, v9 }, /* ld [rs1+0],d */
-
-{ "ldxa",	F3(3, 0x1b, 0), F3(~3, ~0x1b, ~0),		"[1+2]A,d", 0, v9 },
-{ "ldxa",	F3(3, 0x1b, 0), F3(~3, ~0x1b, ~0)|RS2_G0,	"[1]A,d", 0, v9 }, /* lda [rs1+%g0],d */
-{ "ldxa",	F3(3, 0x1b, 1), F3(~3, ~0x1b, ~1),		"[1+i]o,d", 0, v9 },
-{ "ldxa",	F3(3, 0x1b, 1), F3(~3, ~0x1b, ~1),		"[i+1]o,d", 0, v9 },
-{ "ldxa",	F3(3, 0x1b, 1), F3(~3, ~0x1b, ~1)|RS1_G0,	"[i]o,d", 0, v9 },
-{ "ldxa",	F3(3, 0x1b, 1), F3(~3, ~0x1b, ~1)|SIMM13(~0),	"[1]o,d", 0, v9 }, /* ld [rs1+0],d */
-
-{ "st",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI(~0),		"d,[1+2]", 0, v6 },
-{ "st",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI_RS2(~0),		"d,[1]", 0, v6 }, /* st d,[rs1+%g0] */
-{ "st",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1),			"d,[1+i]", 0, v6 },
-{ "st",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1),			"d,[i+1]", 0, v6 },
-{ "st",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RS1_G0,		"d,[i]", 0, v6 },
-{ "st",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|SIMM13(~0),		"d,[1]", 0, v6 }, /* st d,[rs1+0] */
-{ "st",	F3(3, 0x24, 0), F3(~3, ~0x24, ~0)|ASI(~0),		"g,[1+2]", 0, v6 },
-{ "st",	F3(3, 0x24, 0), F3(~3, ~0x24, ~0)|ASI_RS2(~0),		"g,[1]", 0, v6 }, /* st d[rs1+%g0] */
-{ "st",	F3(3, 0x24, 1), F3(~3, ~0x24, ~1),			"g,[1+i]", 0, v6 },
-{ "st",	F3(3, 0x24, 1), F3(~3, ~0x24, ~1),			"g,[i+1]", 0, v6 },
-{ "st",	F3(3, 0x24, 1), F3(~3, ~0x24, ~1)|RS1_G0,		"g,[i]", 0, v6 },
-{ "st",	F3(3, 0x24, 1), F3(~3, ~0x24, ~1)|SIMM13(~0),		"g,[1]", 0, v6 }, /* st d,[rs1+0] */
-
-{ "st",	F3(3, 0x34, 0), F3(~3, ~0x34, ~0)|ASI(~0),		"D,[1+2]", 0, v6notv9 },
-{ "st",	F3(3, 0x34, 0), F3(~3, ~0x34, ~0)|ASI_RS2(~0),		"D,[1]", 0, v6notv9 }, /* st d,[rs1+%g0] */
-{ "st",	F3(3, 0x34, 1), F3(~3, ~0x34, ~1),			"D,[1+i]", 0, v6notv9 },
-{ "st",	F3(3, 0x34, 1), F3(~3, ~0x34, ~1),			"D,[i+1]", 0, v6notv9 },
-{ "st",	F3(3, 0x34, 1), F3(~3, ~0x34, ~1)|RS1_G0,		"D,[i]", 0, v6notv9 },
-{ "st",	F3(3, 0x34, 1), F3(~3, ~0x34, ~1)|SIMM13(~0),		"D,[1]", 0, v6notv9 }, /* st d,[rs1+0] */
-{ "st",	F3(3, 0x35, 0), F3(~3, ~0x35, ~0)|ASI(~0),		"C,[1+2]", 0, v6notv9 },
-{ "st",	F3(3, 0x35, 0), F3(~3, ~0x35, ~0)|ASI_RS2(~0),		"C,[1]", 0, v6notv9 }, /* st d,[rs1+%g0] */
-{ "st",	F3(3, 0x35, 1), F3(~3, ~0x35, ~1),			"C,[1+i]", 0, v6notv9 },
-{ "st",	F3(3, 0x35, 1), F3(~3, ~0x35, ~1),			"C,[i+1]", 0, v6notv9 },
-{ "st",	F3(3, 0x35, 1), F3(~3, ~0x35, ~1)|RS1_G0,		"C,[i]", 0, v6notv9 },
-{ "st",	F3(3, 0x35, 1), F3(~3, ~0x35, ~1)|SIMM13(~0),		"C,[1]", 0, v6notv9 }, /* st d,[rs1+0] */
-
-{ "st",	F3(3, 0x25, 0), F3(~3, ~0x25, ~0)|RD_G0|ASI(~0),	"F,[1+2]", 0, v6 },
-{ "st",	F3(3, 0x25, 0), F3(~3, ~0x25, ~0)|RD_G0|ASI_RS2(~0),	"F,[1]", 0, v6 }, /* st d,[rs1+%g0] */
-{ "st",	F3(3, 0x25, 1), F3(~3, ~0x25, ~1)|RD_G0,		"F,[1+i]", 0, v6 },
-{ "st",	F3(3, 0x25, 1), F3(~3, ~0x25, ~1)|RD_G0,		"F,[i+1]", 0, v6 },
-{ "st",	F3(3, 0x25, 1), F3(~3, ~0x25, ~1)|RD_G0|RS1_G0,		"F,[i]", 0, v6 },
-{ "st",	F3(3, 0x25, 1), F3(~3, ~0x25, ~1)|RD_G0|SIMM13(~0),	"F,[1]", 0, v6 }, /* st d,[rs1+0] */
-
-{ "stw",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI(~0),	"d,[1+2]", F_ALIAS, v9 },
-{ "stw",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI_RS2(~0),	"d,[1]", F_ALIAS, v9 }, /* st d,[rs1+%g0] */
-{ "stw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1),		"d,[1+i]", F_ALIAS, v9 },
-{ "stw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1),		"d,[i+1]", F_ALIAS, v9 },
-{ "stw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RS1_G0,	"d,[i]", F_ALIAS, v9 },
-{ "stw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|SIMM13(~0),	"d,[1]", F_ALIAS, v9 }, /* st d,[rs1+0] */
-{ "stsw",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI(~0),	"d,[1+2]", F_ALIAS, v9 },
-{ "stsw",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI_RS2(~0),	"d,[1]", F_ALIAS, v9 }, /* st d,[rs1+%g0] */
-{ "stsw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1),		"d,[1+i]", F_ALIAS, v9 },
-{ "stsw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1),		"d,[i+1]", F_ALIAS, v9 },
-{ "stsw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RS1_G0,	"d,[i]", F_ALIAS, v9 },
-{ "stsw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|SIMM13(~0),	"d,[1]", F_ALIAS, v9 }, /* st d,[rs1+0] */
-{ "stuw",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI(~0),	"d,[1+2]", F_ALIAS, v9 },
-{ "stuw",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI_RS2(~0),	"d,[1]", F_ALIAS, v9 }, /* st d,[rs1+%g0] */
-{ "stuw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1),		"d,[1+i]", F_ALIAS, v9 },
-{ "stuw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1),		"d,[i+1]", F_ALIAS, v9 },
-{ "stuw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RS1_G0,	"d,[i]", F_ALIAS, v9 },
-{ "stuw",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|SIMM13(~0),	"d,[1]", F_ALIAS, v9 }, /* st d,[rs1+0] */
-
-{ "spill",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI(~0),	"d,[1+2]", F_ALIAS, v6 },
-{ "spill",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI_RS2(~0),	"d,[1]", F_ALIAS, v6 }, /* st d,[rs1+%g0] */
-{ "spill",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1),		"d,[1+i]", F_ALIAS, v6 },
-{ "spill",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1),		"d,[i+1]", F_ALIAS, v6 },
-{ "spill",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RS1_G0,	"d,[i]", F_ALIAS, v6 },
-{ "spill",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|SIMM13(~0),	"d,[1]", F_ALIAS, v6 }, /* st d,[rs1+0] */
-
-{ "sta",	F3(3, 0x14, 0), F3(~3, ~0x14, ~0),		"d,[1+2]A", 0, v6 },
-{ "sta",	F3(3, 0x14, 0), F3(~3, ~0x14, ~0)|RS2(~0),	"d,[1]A", 0, v6 }, /* sta d,[rs1+%g0] */
-{ "sta",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1),		"d,[1+i]o", 0, v9 },
-{ "sta",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1),		"d,[i+1]o", 0, v9 },
-{ "sta",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|RS1_G0,	"d,[i]o", 0, v9 },
-{ "sta",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|SIMM13(~0),	"d,[1]o", 0, v9 }, /* st d,[rs1+0] */
-
-{ "sta",	F3(3, 0x34, 0), F3(~3, ~0x34, ~0),		"g,[1+2]A", 0, v9 },
-{ "sta",	F3(3, 0x34, 0), F3(~3, ~0x34, ~0)|RS2(~0),	"g,[1]A", 0, v9 }, /* sta d,[rs1+%g0] */
-{ "sta",	F3(3, 0x34, 1), F3(~3, ~0x34, ~1),		"g,[1+i]o", 0, v9 },
-{ "sta",	F3(3, 0x34, 1), F3(~3, ~0x34, ~1),		"g,[i+1]o", 0, v9 },
-{ "sta",	F3(3, 0x34, 1), F3(~3, ~0x34, ~1)|RS1_G0,	"g,[i]o", 0, v9 },
-{ "sta",	F3(3, 0x34, 1), F3(~3, ~0x34, ~1)|SIMM13(~0),	"g,[1]o", 0, v9 }, /* st d,[rs1+0] */
-
-{ "stwa",	F3(3, 0x14, 0), F3(~3, ~0x14, ~0),		"d,[1+2]A", F_ALIAS, v9 },
-{ "stwa",	F3(3, 0x14, 0), F3(~3, ~0x14, ~0)|RS2(~0),	"d,[1]A", F_ALIAS, v9 }, /* sta d,[rs1+%g0] */
-{ "stwa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1),		"d,[1+i]o", F_ALIAS, v9 },
-{ "stwa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1),		"d,[i+1]o", F_ALIAS, v9 },
-{ "stwa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|RS1_G0,	"d,[i]o", F_ALIAS, v9 },
-{ "stwa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|SIMM13(~0),	"d,[1]o", F_ALIAS, v9 }, /* st d,[rs1+0] */
-{ "stswa",	F3(3, 0x14, 0), F3(~3, ~0x14, ~0),		"d,[1+2]A", F_ALIAS, v9 },
-{ "stswa",	F3(3, 0x14, 0), F3(~3, ~0x14, ~0)|RS2(~0),	"d,[1]A", F_ALIAS, v9 }, /* sta d,[rs1+%g0] */
-{ "stswa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1),		"d,[1+i]o", F_ALIAS, v9 },
-{ "stswa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1),		"d,[i+1]o", F_ALIAS, v9 },
-{ "stswa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|RS1_G0,	"d,[i]o", F_ALIAS, v9 },
-{ "stswa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|SIMM13(~0),	"d,[1]o", F_ALIAS, v9 }, /* st d,[rs1+0] */
-{ "stuwa",	F3(3, 0x14, 0), F3(~3, ~0x14, ~0),		"d,[1+2]A", F_ALIAS, v9 },
-{ "stuwa",	F3(3, 0x14, 0), F3(~3, ~0x14, ~0)|RS2(~0),	"d,[1]A", F_ALIAS, v9 }, /* sta d,[rs1+%g0] */
-{ "stuwa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1),		"d,[1+i]o", F_ALIAS, v9 },
-{ "stuwa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1),		"d,[i+1]o", F_ALIAS, v9 },
-{ "stuwa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|RS1_G0,	"d,[i]o", F_ALIAS, v9 },
-{ "stuwa",	F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|SIMM13(~0),	"d,[1]o", F_ALIAS, v9 }, /* st d,[rs1+0] */
-
-{ "stb",	F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI(~0),	"d,[1+2]", 0, v6 },
-{ "stb",	F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI_RS2(~0),	"d,[1]", 0, v6 }, /* stb d,[rs1+%g0] */
-{ "stb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1),		"d,[1+i]", 0, v6 },
-{ "stb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1),		"d,[i+1]", 0, v6 },
-{ "stb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RS1_G0,	"d,[i]", 0, v6 },
-{ "stb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|SIMM13(~0),	"d,[1]", 0, v6 }, /* stb d,[rs1+0] */
-
-{ "stsb",	F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI(~0),	"d,[1+2]", F_ALIAS, v6 },
-{ "stsb",	F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI_RS2(~0),	"d,[1]", F_ALIAS, v6 }, /* stb d,[rs1+%g0] */
-{ "stsb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1),		"d,[1+i]", F_ALIAS, v6 },
-{ "stsb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1),		"d,[i+1]", F_ALIAS, v6 },
-{ "stsb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RS1_G0,	"d,[i]", F_ALIAS, v6 },
-{ "stsb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|SIMM13(~0),	"d,[1]", F_ALIAS, v6 }, /* stb d,[rs1+0] */
-{ "stub",	F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI(~0),	"d,[1+2]", F_ALIAS, v6 },
-{ "stub",	F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI_RS2(~0),	"d,[1]", F_ALIAS, v6 }, /* stb d,[rs1+%g0] */
-{ "stub",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1),		"d,[1+i]", F_ALIAS, v6 },
-{ "stub",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1),		"d,[i+1]", F_ALIAS, v6 },
-{ "stub",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RS1_G0,	"d,[i]", F_ALIAS, v6 },
-{ "stub",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|SIMM13(~0),	"d,[1]", F_ALIAS, v6 }, /* stb d,[rs1+0] */
-
-{ "stba",	F3(3, 0x15, 0), F3(~3, ~0x15, ~0),		"d,[1+2]A", 0, v6 },
-{ "stba",	F3(3, 0x15, 0), F3(~3, ~0x15, ~0)|RS2(~0),	"d,[1]A", 0, v6 }, /* stba d,[rs1+%g0] */
-{ "stba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1),		"d,[1+i]o", 0, v9 },
-{ "stba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1),		"d,[i+1]o", 0, v9 },
-{ "stba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|RS1_G0,	"d,[i]o", 0, v9 },
-{ "stba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|SIMM13(~0),	"d,[1]o", 0, v9 }, /* stb d,[rs1+0] */
-
-{ "stsba",	F3(3, 0x15, 0), F3(~3, ~0x15, ~0),		"d,[1+2]A", F_ALIAS, v6 },
-{ "stsba",	F3(3, 0x15, 0), F3(~3, ~0x15, ~0)|RS2(~0),	"d,[1]A", F_ALIAS, v6 }, /* stba d,[rs1+%g0] */
-{ "stsba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1),		"d,[1+i]o", F_ALIAS, v9 },
-{ "stsba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1),		"d,[i+1]o", F_ALIAS, v9 },
-{ "stsba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|RS1_G0,	"d,[i]o", F_ALIAS, v9 },
-{ "stsba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|SIMM13(~0),	"d,[1]o", F_ALIAS, v9 }, /* stb d,[rs1+0] */
-{ "stuba",	F3(3, 0x15, 0), F3(~3, ~0x15, ~0),		"d,[1+2]A", F_ALIAS, v6 },
-{ "stuba",	F3(3, 0x15, 0), F3(~3, ~0x15, ~0)|RS2(~0),	"d,[1]A", F_ALIAS, v6 }, /* stba d,[rs1+%g0] */
-{ "stuba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1),		"d,[1+i]o", F_ALIAS, v9 },
-{ "stuba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1),		"d,[i+1]o", F_ALIAS, v9 },
-{ "stuba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|RS1_G0,	"d,[i]o", F_ALIAS, v9 },
-{ "stuba",	F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|SIMM13(~0),	"d,[1]o", F_ALIAS, v9 }, /* stb d,[rs1+0] */
-
-{ "std",	F3(3, 0x07, 0), F3(~3, ~0x07, ~0)|ASI(~0),	"d,[1+2]", 0, v6 },
-{ "std",	F3(3, 0x07, 0), F3(~3, ~0x07, ~0)|ASI_RS2(~0),	"d,[1]", 0, v6 }, /* std d,[rs1+%g0] */
-{ "std",	F3(3, 0x07, 1), F3(~3, ~0x07, ~1),		"d,[1+i]", 0, v6 },
-{ "std",	F3(3, 0x07, 1), F3(~3, ~0x07, ~1),		"d,[i+1]", 0, v6 },
-{ "std",	F3(3, 0x07, 1), F3(~3, ~0x07, ~1)|RS1_G0,	"d,[i]", 0, v6 },
-{ "std",	F3(3, 0x07, 1), F3(~3, ~0x07, ~1)|SIMM13(~0),	"d,[1]", 0, v6 }, /* std d,[rs1+0] */
-
-{ "std",	F3(3, 0x26, 0), F3(~3, ~0x26, ~0)|ASI(~0),	"q,[1+2]", 0, v6notv9 },
-{ "std",	F3(3, 0x26, 0), F3(~3, ~0x26, ~0)|ASI_RS2(~0),	"q,[1]", 0, v6notv9 }, /* std d,[rs1+%g0] */
-{ "std",	F3(3, 0x26, 1), F3(~3, ~0x26, ~1),		"q,[1+i]", 0, v6notv9 },
-{ "std",	F3(3, 0x26, 1), F3(~3, ~0x26, ~1),		"q,[i+1]", 0, v6notv9 },
-{ "std",	F3(3, 0x26, 1), F3(~3, ~0x26, ~1)|RS1_G0,	"q,[i]", 0, v6notv9 },
-{ "std",	F3(3, 0x26, 1), F3(~3, ~0x26, ~1)|SIMM13(~0),	"q,[1]", 0, v6notv9 }, /* std d,[rs1+0] */
-{ "std",	F3(3, 0x27, 0), F3(~3, ~0x27, ~0)|ASI(~0),	"H,[1+2]", 0, v6 },
-{ "std",	F3(3, 0x27, 0), F3(~3, ~0x27, ~0)|ASI_RS2(~0),	"H,[1]", 0, v6 }, /* std d,[rs1+%g0] */
-{ "std",	F3(3, 0x27, 1), F3(~3, ~0x27, ~1),		"H,[1+i]", 0, v6 },
-{ "std",	F3(3, 0x27, 1), F3(~3, ~0x27, ~1),		"H,[i+1]", 0, v6 },
-{ "std",	F3(3, 0x27, 1), F3(~3, ~0x27, ~1)|RS1_G0,	"H,[i]", 0, v6 },
-{ "std",	F3(3, 0x27, 1), F3(~3, ~0x27, ~1)|SIMM13(~0),	"H,[1]", 0, v6 }, /* std d,[rs1+0] */
-
-{ "std",	F3(3, 0x36, 0), F3(~3, ~0x36, ~0)|ASI(~0),	"Q,[1+2]", 0, v6notv9 },
-{ "std",	F3(3, 0x36, 0), F3(~3, ~0x36, ~0)|ASI_RS2(~0),	"Q,[1]", 0, v6notv9 }, /* std d,[rs1+%g0] */
-{ "std",	F3(3, 0x36, 1), F3(~3, ~0x36, ~1),		"Q,[1+i]", 0, v6notv9 },
-{ "std",	F3(3, 0x36, 1), F3(~3, ~0x36, ~1),		"Q,[i+1]", 0, v6notv9 },
-{ "std",	F3(3, 0x36, 1), F3(~3, ~0x36, ~1)|RS1_G0,	"Q,[i]", 0, v6notv9 },
-{ "std",	F3(3, 0x36, 1), F3(~3, ~0x36, ~1)|SIMM13(~0),	"Q,[1]", 0, v6notv9 }, /* std d,[rs1+0] */
-{ "std",	F3(3, 0x37, 0), F3(~3, ~0x37, ~0)|ASI(~0),	"D,[1+2]", 0, v6notv9 },
-{ "std",	F3(3, 0x37, 0), F3(~3, ~0x37, ~0)|ASI_RS2(~0),	"D,[1]", 0, v6notv9 }, /* std d,[rs1+%g0] */
-{ "std",	F3(3, 0x37, 1), F3(~3, ~0x37, ~1),		"D,[1+i]", 0, v6notv9 },
-{ "std",	F3(3, 0x37, 1), F3(~3, ~0x37, ~1),		"D,[i+1]", 0, v6notv9 },
-{ "std",	F3(3, 0x37, 1), F3(~3, ~0x37, ~1)|RS1_G0,	"D,[i]", 0, v6notv9 },
-{ "std",	F3(3, 0x37, 1), F3(~3, ~0x37, ~1)|SIMM13(~0),	"D,[1]", 0, v6notv9 }, /* std d,[rs1+0] */
-
-{ "spilld",	F3(3, 0x07, 0), F3(~3, ~0x07, ~0)|ASI(~0),	"d,[1+2]", F_ALIAS, v6 },
-{ "spilld",	F3(3, 0x07, 0), F3(~3, ~0x07, ~0)|ASI_RS2(~0),	"d,[1]", F_ALIAS, v6 }, /* std d,[rs1+%g0] */
-{ "spilld",	F3(3, 0x07, 1), F3(~3, ~0x07, ~1),		"d,[1+i]", F_ALIAS, v6 },
-{ "spilld",	F3(3, 0x07, 1), F3(~3, ~0x07, ~1),		"d,[i+1]", F_ALIAS, v6 },
-{ "spilld",	F3(3, 0x07, 1), F3(~3, ~0x07, ~1)|RS1_G0,	"d,[i]", F_ALIAS, v6 },
-{ "spilld",	F3(3, 0x07, 1), F3(~3, ~0x07, ~1)|SIMM13(~0),	"d,[1]", F_ALIAS, v6 }, /* std d,[rs1+0] */
-
-{ "stda",	F3(3, 0x17, 0), F3(~3, ~0x17, ~0),		"d,[1+2]A", 0, v6 },
-{ "stda",	F3(3, 0x17, 0), F3(~3, ~0x17, ~0)|RS2(~0),	"d,[1]A", 0, v6 }, /* stda d,[rs1+%g0] */
-{ "stda",	F3(3, 0x17, 1), F3(~3, ~0x17, ~1),		"d,[1+i]o", 0, v9 },
-{ "stda",	F3(3, 0x17, 1), F3(~3, ~0x17, ~1),		"d,[i+1]o", 0, v9 },
-{ "stda",	F3(3, 0x17, 1), F3(~3, ~0x17, ~1)|RS1_G0,	"d,[i]o", 0, v9 },
-{ "stda",	F3(3, 0x17, 1), F3(~3, ~0x17, ~1)|SIMM13(~0),	"d,[1]o", 0, v9 }, /* std d,[rs1+0] */
-{ "stda",	F3(3, 0x37, 0), F3(~3, ~0x37, ~0),		"H,[1+2]A", 0, v9 },
-{ "stda",	F3(3, 0x37, 0), F3(~3, ~0x37, ~0)|RS2(~0),	"H,[1]A", 0, v9 }, /* stda d,[rs1+%g0] */
-{ "stda",	F3(3, 0x37, 1), F3(~3, ~0x37, ~1),		"H,[1+i]o", 0, v9 },
-{ "stda",	F3(3, 0x37, 1), F3(~3, ~0x37, ~1),		"H,[i+1]o", 0, v9 },
-{ "stda",	F3(3, 0x37, 1), F3(~3, ~0x37, ~1)|RS1_G0,	"H,[i]o", 0, v9 },
-{ "stda",	F3(3, 0x37, 1), F3(~3, ~0x37, ~1)|SIMM13(~0),	"H,[1]o", 0, v9 }, /* std d,[rs1+0] */
-
-{ "sth",	F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI(~0),	"d,[1+2]", 0, v6 },
-{ "sth",	F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI_RS2(~0),	"d,[1]", 0, v6 }, /* sth d,[rs1+%g0] */
-{ "sth",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1),		"d,[1+i]", 0, v6 },
-{ "sth",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1),		"d,[i+1]", 0, v6 },
-{ "sth",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RS1_G0,	"d,[i]", 0, v6 },
-{ "sth",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|SIMM13(~0),	"d,[1]", 0, v6 }, /* sth d,[rs1+0] */
-
-{ "stsh",	F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI(~0),	"d,[1+2]", F_ALIAS, v6 },
-{ "stsh",	F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI_RS2(~0),	"d,[1]", F_ALIAS, v6 }, /* sth d,[rs1+%g0] */
-{ "stsh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1),		"d,[1+i]", F_ALIAS, v6 },
-{ "stsh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1),		"d,[i+1]", F_ALIAS, v6 },
-{ "stsh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RS1_G0,	"d,[i]", F_ALIAS, v6 },
-{ "stsh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|SIMM13(~0),	"d,[1]", F_ALIAS, v6 }, /* sth d,[rs1+0] */
-{ "stuh",	F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI(~0),	"d,[1+2]", F_ALIAS, v6 },
-{ "stuh",	F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI_RS2(~0),	"d,[1]", F_ALIAS, v6 }, /* sth d,[rs1+%g0] */
-{ "stuh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1),		"d,[1+i]", F_ALIAS, v6 },
-{ "stuh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1),		"d,[i+1]", F_ALIAS, v6 },
-{ "stuh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RS1_G0,	"d,[i]", F_ALIAS, v6 },
-{ "stuh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|SIMM13(~0),	"d,[1]", F_ALIAS, v6 }, /* sth d,[rs1+0] */
-
-{ "stha",	F3(3, 0x16, 0), F3(~3, ~0x16, ~0),		"d,[1+2]A", 0, v6 },
-{ "stha",	F3(3, 0x16, 0), F3(~3, ~0x16, ~0)|RS2(~0),	"d,[1]A", 0, v6 }, /* stha ,[rs1+%g0] */
-{ "stha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1),		"d,[1+i]o", 0, v9 },
-{ "stha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1),		"d,[i+1]o", 0, v9 },
-{ "stha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|RS1_G0,	"d,[i]o", 0, v9 },
-{ "stha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|SIMM13(~0),	"d,[1]o", 0, v9 }, /* sth d,[rs1+0] */
-
-{ "stsha",	F3(3, 0x16, 0), F3(~3, ~0x16, ~0),		"d,[1+2]A", F_ALIAS, v6 },
-{ "stsha",	F3(3, 0x16, 0), F3(~3, ~0x16, ~0)|RS2(~0),	"d,[1]A", F_ALIAS, v6 }, /* stha ,[rs1+%g0] */
-{ "stsha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1),		"d,[1+i]o", F_ALIAS, v9 },
-{ "stsha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1),		"d,[i+1]o", F_ALIAS, v9 },
-{ "stsha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|RS1_G0,	"d,[i]o", F_ALIAS, v9 },
-{ "stsha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|SIMM13(~0),	"d,[1]o", F_ALIAS, v9 }, /* sth d,[rs1+0] */
-{ "stuha",	F3(3, 0x16, 0), F3(~3, ~0x16, ~0),		"d,[1+2]A", F_ALIAS, v6 },
-{ "stuha",	F3(3, 0x16, 0), F3(~3, ~0x16, ~0)|RS2(~0),	"d,[1]A", F_ALIAS, v6 }, /* stha ,[rs1+%g0] */
-{ "stuha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1),		"d,[1+i]o", F_ALIAS, v9 },
-{ "stuha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1),		"d,[i+1]o", F_ALIAS, v9 },
-{ "stuha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|RS1_G0,	"d,[i]o", F_ALIAS, v9 },
-{ "stuha",	F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|SIMM13(~0),	"d,[1]o", F_ALIAS, v9 }, /* sth d,[rs1+0] */
-
-{ "stx",	F3(3, 0x0e, 0), F3(~3, ~0x0e, ~0)|ASI(~0),	"d,[1+2]", 0, v9 },
-{ "stx",	F3(3, 0x0e, 0), F3(~3, ~0x0e, ~0)|ASI_RS2(~0),	"d,[1]", 0, v9 }, /* stx d,[rs1+%g0] */
-{ "stx",	F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1),		"d,[1+i]", 0, v9 },
-{ "stx",	F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1),		"d,[i+1]", 0, v9 },
-{ "stx",	F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|RS1_G0,	"d,[i]", 0, v9 },
-{ "stx",	F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|SIMM13(~0),	"d,[1]", 0, v9 }, /* stx d,[rs1+0] */
-
-{ "stx",	F3(3, 0x25, 0)|RD(1), F3(~3, ~0x25, ~0)|ASI(~0)|RD(~1),	"F,[1+2]", 0, v9 },
-{ "stx",	F3(3, 0x25, 0)|RD(1), F3(~3, ~0x25, ~0)|ASI_RS2(~0)|RD(~1),"F,[1]", 0, v9 }, /* stx d,[rs1+%g0] */
-{ "stx",	F3(3, 0x25, 1)|RD(1), F3(~3, ~0x25, ~1)|RD(~1),		"F,[1+i]", 0, v9 },
-{ "stx",	F3(3, 0x25, 1)|RD(1), F3(~3, ~0x25, ~1)|RD(~1),		"F,[i+1]", 0, v9 },
-{ "stx",	F3(3, 0x25, 1)|RD(1), F3(~3, ~0x25, ~1)|RS1_G0|RD(~1),	"F,[i]", 0, v9 },
-{ "stx",	F3(3, 0x25, 1)|RD(1), F3(~3, ~0x25, ~1)|SIMM13(~0)|RD(~1),"F,[1]", 0, v9 }, /* stx d,[rs1+0] */
-
-{ "stxa",	F3(3, 0x1e, 0), F3(~3, ~0x1e, ~0),		"d,[1+2]A", 0, v9 },
-{ "stxa",	F3(3, 0x1e, 0), F3(~3, ~0x1e, ~0)|RS2(~0),	"d,[1]A", 0, v9 }, /* stxa d,[rs1+%g0] */
-{ "stxa",	F3(3, 0x1e, 1), F3(~3, ~0x1e, ~1),		"d,[1+i]o", 0, v9 },
-{ "stxa",	F3(3, 0x1e, 1), F3(~3, ~0x1e, ~1),		"d,[i+1]o", 0, v9 },
-{ "stxa",	F3(3, 0x1e, 1), F3(~3, ~0x1e, ~1)|RS1_G0,	"d,[i]o", 0, v9 },
-{ "stxa",	F3(3, 0x1e, 1), F3(~3, ~0x1e, ~1)|SIMM13(~0),	"d,[1]o", 0, v9 }, /* stx d,[rs1+0] */
-
-{ "stq",	F3(3, 0x26, 0), F3(~3, ~0x26, ~0)|ASI(~0),	"J,[1+2]", 0, v9 },
-{ "stq",	F3(3, 0x26, 0), F3(~3, ~0x26, ~0)|ASI_RS2(~0),	"J,[1]", 0, v9 }, /* stq [rs1+%g0] */
-{ "stq",	F3(3, 0x26, 1), F3(~3, ~0x26, ~1),		"J,[1+i]", 0, v9 },
-{ "stq",	F3(3, 0x26, 1), F3(~3, ~0x26, ~1),		"J,[i+1]", 0, v9 },
-{ "stq",	F3(3, 0x26, 1), F3(~3, ~0x26, ~1)|RS1_G0,	"J,[i]", 0, v9 },
-{ "stq",	F3(3, 0x26, 1), F3(~3, ~0x26, ~1)|SIMM13(~0),	"J,[1]", 0, v9 }, /* stq [rs1+0] */
-
-{ "stqa",	F3(3, 0x36, 0), F3(~3, ~0x36, ~0)|ASI(~0),	"J,[1+2]A", 0, v9 },
-{ "stqa",	F3(3, 0x36, 0), F3(~3, ~0x36, ~0)|ASI_RS2(~0),	"J,[1]A", 0, v9 }, /* stqa [rs1+%g0] */
-{ "stqa",	F3(3, 0x36, 1), F3(~3, ~0x36, ~1),		"J,[1+i]o", 0, v9 },
-{ "stqa",	F3(3, 0x36, 1), F3(~3, ~0x36, ~1),		"J,[i+1]o", 0, v9 },
-{ "stqa",	F3(3, 0x36, 1), F3(~3, ~0x36, ~1)|RS1_G0,	"J,[i]o", 0, v9 },
-{ "stqa",	F3(3, 0x36, 1), F3(~3, ~0x36, ~1)|SIMM13(~0),	"J,[1]o", 0, v9 }, /* stqa [rs1+0] */
-
-{ "swap",	F3(3, 0x0f, 0), F3(~3, ~0x0f, ~0)|ASI(~0),	"[1+2],d", 0, v7 },
-{ "swap",	F3(3, 0x0f, 0), F3(~3, ~0x0f, ~0)|ASI_RS2(~0),	"[1],d", 0, v7 }, /* swap [rs1+%g0],d */
-{ "swap",	F3(3, 0x0f, 1), F3(~3, ~0x0f, ~1),		"[1+i],d", 0, v7 },
-{ "swap",	F3(3, 0x0f, 1), F3(~3, ~0x0f, ~1),		"[i+1],d", 0, v7 },
-{ "swap",	F3(3, 0x0f, 1), F3(~3, ~0x0f, ~1)|RS1_G0,	"[i],d", 0, v7 },
-{ "swap",	F3(3, 0x0f, 1), F3(~3, ~0x0f, ~1)|SIMM13(~0),	"[1],d", 0, v7 }, /* swap [rs1+0],d */
-
-{ "swapa",	F3(3, 0x1f, 0), F3(~3, ~0x1f, ~0),		"[1+2]A,d", 0, v7 },
-{ "swapa",	F3(3, 0x1f, 0), F3(~3, ~0x1f, ~0)|RS2(~0),	"[1]A,d", 0, v7 }, /* swapa [rs1+%g0],d */
-{ "swapa",	F3(3, 0x1f, 1), F3(~3, ~0x1f, ~1),		"[1+i]o,d", 0, v9 },
-{ "swapa",	F3(3, 0x1f, 1), F3(~3, ~0x1f, ~1),		"[i+1]o,d", 0, v9 },
-{ "swapa",	F3(3, 0x1f, 1), F3(~3, ~0x1f, ~1)|RS1_G0,	"[i]o,d", 0, v9 },
-{ "swapa",	F3(3, 0x1f, 1), F3(~3, ~0x1f, ~1)|SIMM13(~0),	"[1]o,d", 0, v9 }, /* swap [rs1+0],d */
-
-{ "restore",	F3(2, 0x3d, 0), F3(~2, ~0x3d, ~0)|ASI(~0),			"1,2,d", 0, v6 },
-{ "restore",	F3(2, 0x3d, 0), F3(~2, ~0x3d, ~0)|RD_G0|RS1_G0|ASI_RS2(~0),	"", 0, v6 }, /* restore %g0,%g0,%g0 */
-{ "restore",	F3(2, 0x3d, 1), F3(~2, ~0x3d, ~1),				"1,i,d", 0, v6 },
-{ "restore",	F3(2, 0x3d, 1), F3(~2, ~0x3d, ~1)|RD_G0|RS1_G0|SIMM13(~0),	"", 0, v6 }, /* restore %g0,0,%g0 */
-
-{ "rett",	F3(2, 0x39, 0), F3(~2, ~0x39, ~0)|RD_G0|ASI(~0),	"1+2", F_UNBR|F_DELAYED, v6 }, /* rett rs1+rs2 */
-{ "rett",	F3(2, 0x39, 0), F3(~2, ~0x39, ~0)|RD_G0|ASI_RS2(~0),	"1", F_UNBR|F_DELAYED, v6 },	/* rett rs1,%g0 */
-{ "rett",	F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RD_G0,		"1+i", F_UNBR|F_DELAYED, v6 }, /* rett rs1+X */
-{ "rett",	F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RD_G0,		"i+1", F_UNBR|F_DELAYED, v6 }, /* rett X+rs1 */
-{ "rett",	F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RD_G0|RS1_G0,		"i", F_UNBR|F_DELAYED, v6 }, /* rett X+rs1 */
-{ "rett",	F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RD_G0|RS1_G0,		"i", F_UNBR|F_DELAYED, v6 },	/* rett X */
-{ "rett",	F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RD_G0|SIMM13(~0),	"1", F_UNBR|F_DELAYED, v6 },	/* rett rs1+0 */
-
-{ "save",	F3(2, 0x3c, 0), F3(~2, ~0x3c, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "save",	F3(2, 0x3c, 1), F3(~2, ~0x3c, ~1),		"1,i,d", 0, v6 },
-{ "save",	0x81e00000,	~0x81e00000,			"", F_ALIAS, v6 },
-
-{ "ret",  F3(2, 0x38, 1)|RS1(0x1f)|SIMM13(8), F3(~2, ~0x38, ~1)|SIMM13(~8),	       "", F_UNBR|F_DELAYED, v6 }, /* jmpl %i7+8,%g0 */
+{ "lduw",       F3(3, 0x00, 0), F3(~3, ~0x00, ~0),              "[1+2],d", F_ALIAS, v9 },
+{ "lduw",       F3(3, 0x00, 0), F3(~3, ~0x00, ~0)|RS2_G0,       "[1],d", F_ALIAS, v9 }, /* ld [rs1+%g0],d */
+{ "lduw",       F3(3, 0x00, 1), F3(~3, ~0x00, ~1),              "[1+i],d", F_ALIAS, v9 },
+{ "lduw",       F3(3, 0x00, 1), F3(~3, ~0x00, ~1),              "[i+1],d", F_ALIAS, v9 },
+{ "lduw",       F3(3, 0x00, 1), F3(~3, ~0x00, ~1)|RS1_G0,       "[i],d", F_ALIAS, v9 },
+{ "lduw",       F3(3, 0x00, 1), F3(~3, ~0x00, ~1)|SIMM13(~0),   "[1],d", F_ALIAS, v9 }, /* ld [rs1+0],d */
+
+{ "ldd",        F3(3, 0x03, 0), F3(~3, ~0x03, ~0)|ASI(~0),      "[1+2],d", 0, v6 },
+{ "ldd",        F3(3, 0x03, 0), F3(~3, ~0x03, ~0)|ASI_RS2(~0),  "[1],d", 0, v6 }, /* ldd [rs1+%g0],d */
+{ "ldd",        F3(3, 0x03, 1), F3(~3, ~0x03, ~1),              "[1+i],d", 0, v6 },
+{ "ldd",        F3(3, 0x03, 1), F3(~3, ~0x03, ~1),              "[i+1],d", 0, v6 },
+{ "ldd",        F3(3, 0x03, 1), F3(~3, ~0x03, ~1)|RS1_G0,       "[i],d", 0, v6 },
+{ "ldd",        F3(3, 0x03, 1), F3(~3, ~0x03, ~1)|SIMM13(~0),   "[1],d", 0, v6 }, /* ldd [rs1+0],d */
+{ "ldd",        F3(3, 0x23, 0), F3(~3, ~0x23, ~0)|ASI(~0),      "[1+2],H", 0, v6 },
+{ "ldd",        F3(3, 0x23, 0), F3(~3, ~0x23, ~0)|ASI_RS2(~0),  "[1],H", 0, v6 }, /* ldd [rs1+%g0],d */
+{ "ldd",        F3(3, 0x23, 1), F3(~3, ~0x23, ~1),              "[1+i],H", 0, v6 },
+{ "ldd",        F3(3, 0x23, 1), F3(~3, ~0x23, ~1),              "[i+1],H", 0, v6 },
+{ "ldd",        F3(3, 0x23, 1), F3(~3, ~0x23, ~1)|RS1_G0,       "[i],H", 0, v6 },
+{ "ldd",        F3(3, 0x23, 1), F3(~3, ~0x23, ~1)|SIMM13(~0),   "[1],H", 0, v6 }, /* ldd [rs1+0],d */
+
+{ "ldd",        F3(3, 0x33, 0), F3(~3, ~0x33, ~0)|ASI(~0),      "[1+2],D", 0, v6notv9 },
+{ "ldd",        F3(3, 0x33, 0), F3(~3, ~0x33, ~0)|ASI_RS2(~0),  "[1],D", 0, v6notv9 }, /* ldd [rs1+%g0],d */
+{ "ldd",        F3(3, 0x33, 1), F3(~3, ~0x33, ~1),              "[1+i],D", 0, v6notv9 },
+{ "ldd",        F3(3, 0x33, 1), F3(~3, ~0x33, ~1),              "[i+1],D", 0, v6notv9 },
+{ "ldd",        F3(3, 0x33, 1), F3(~3, ~0x33, ~1)|RS1_G0,       "[i],D", 0, v6notv9 },
+{ "ldd",        F3(3, 0x33, 1), F3(~3, ~0x33, ~1)|SIMM13(~0),   "[1],D", 0, v6notv9 }, /* ldd [rs1+0],d */
+
+{ "ldq",        F3(3, 0x22, 0), F3(~3, ~0x22, ~0)|ASI(~0),      "[1+2],J", 0, v9 },
+{ "ldq",        F3(3, 0x22, 0), F3(~3, ~0x22, ~0)|ASI_RS2(~0),  "[1],J", 0, v9 }, /* ldd [rs1+%g0],d */
+{ "ldq",        F3(3, 0x22, 1), F3(~3, ~0x22, ~1),              "[1+i],J", 0, v9 },
+{ "ldq",        F3(3, 0x22, 1), F3(~3, ~0x22, ~1),              "[i+1],J", 0, v9 },
+{ "ldq",        F3(3, 0x22, 1), F3(~3, ~0x22, ~1)|RS1_G0,       "[i],J", 0, v9 },
+{ "ldq",        F3(3, 0x22, 1), F3(~3, ~0x22, ~1)|SIMM13(~0),   "[1],J", 0, v9 }, /* ldd [rs1+0],d */
+
+{ "ldsb",       F3(3, 0x09, 0), F3(~3, ~0x09, ~0)|ASI(~0),      "[1+2],d", 0, v6 },
+{ "ldsb",       F3(3, 0x09, 0), F3(~3, ~0x09, ~0)|ASI_RS2(~0),  "[1],d", 0, v6 }, /* ldsb [rs1+%g0],d */
+{ "ldsb",       F3(3, 0x09, 1), F3(~3, ~0x09, ~1),              "[1+i],d", 0, v6 },
+{ "ldsb",       F3(3, 0x09, 1), F3(~3, ~0x09, ~1),              "[i+1],d", 0, v6 },
+{ "ldsb",       F3(3, 0x09, 1), F3(~3, ~0x09, ~1)|RS1_G0,       "[i],d", 0, v6 },
+{ "ldsb",       F3(3, 0x09, 1), F3(~3, ~0x09, ~1)|SIMM13(~0),   "[1],d", 0, v6 }, /* ldsb [rs1+0],d */
+
+{ "ldsh",       F3(3, 0x0a, 0), F3(~3, ~0x0a, ~0)|ASI_RS2(~0),  "[1],d", 0, v6 }, /* ldsh [rs1+%g0],d */
+{ "ldsh",       F3(3, 0x0a, 0), F3(~3, ~0x0a, ~0)|ASI(~0),      "[1+2],d", 0, v6 },
+{ "ldsh",       F3(3, 0x0a, 1), F3(~3, ~0x0a, ~1),              "[1+i],d", 0, v6 },
+{ "ldsh",       F3(3, 0x0a, 1), F3(~3, ~0x0a, ~1),              "[i+1],d", 0, v6 },
+{ "ldsh",       F3(3, 0x0a, 1), F3(~3, ~0x0a, ~1)|RS1_G0,       "[i],d", 0, v6 },
+{ "ldsh",       F3(3, 0x0a, 1), F3(~3, ~0x0a, ~1)|SIMM13(~0),   "[1],d", 0, v6 }, /* ldsh [rs1+0],d */
+
+{ "ldstub",     F3(3, 0x0d, 0), F3(~3, ~0x0d, ~0)|ASI(~0),      "[1+2],d", 0, v6 },
+{ "ldstub",     F3(3, 0x0d, 0), F3(~3, ~0x0d, ~0)|ASI_RS2(~0),  "[1],d", 0, v6 }, /* ldstub [rs1+%g0],d */
+{ "ldstub",     F3(3, 0x0d, 1), F3(~3, ~0x0d, ~1),              "[1+i],d", 0, v6 },
+{ "ldstub",     F3(3, 0x0d, 1), F3(~3, ~0x0d, ~1),              "[i+1],d", 0, v6 },
+{ "ldstub",     F3(3, 0x0d, 1), F3(~3, ~0x0d, ~1)|RS1_G0,       "[i],d", 0, v6 },
+{ "ldstub",     F3(3, 0x0d, 1), F3(~3, ~0x0d, ~1)|SIMM13(~0),   "[1],d", 0, v6 }, /* ldstub [rs1+0],d */
+
+{ "ldsw",       F3(3, 0x08, 0), F3(~3, ~0x08, ~0)|ASI(~0),      "[1+2],d", 0, v9 },
+{ "ldsw",       F3(3, 0x08, 0), F3(~3, ~0x08, ~0)|ASI_RS2(~0),  "[1],d", 0, v9 }, /* ldsw [rs1+%g0],d */
+{ "ldsw",       F3(3, 0x08, 1), F3(~3, ~0x08, ~1),              "[1+i],d", 0, v9 },
+{ "ldsw",       F3(3, 0x08, 1), F3(~3, ~0x08, ~1),              "[i+1],d", 0, v9 },
+{ "ldsw",       F3(3, 0x08, 1), F3(~3, ~0x08, ~1)|RS1_G0,       "[i],d", 0, v9 },
+{ "ldsw",       F3(3, 0x08, 1), F3(~3, ~0x08, ~1)|SIMM13(~0),   "[1],d", 0, v9 }, /* ldsw [rs1+0],d */
+
+{ "ldub",       F3(3, 0x01, 0), F3(~3, ~0x01, ~0)|ASI(~0),      "[1+2],d", 0, v6 },
+{ "ldub",       F3(3, 0x01, 0), F3(~3, ~0x01, ~0)|ASI_RS2(~0),  "[1],d", 0, v6 }, /* ldub [rs1+%g0],d */
+{ "ldub",       F3(3, 0x01, 1), F3(~3, ~0x01, ~1),              "[1+i],d", 0, v6 },
+{ "ldub",       F3(3, 0x01, 1), F3(~3, ~0x01, ~1),              "[i+1],d", 0, v6 },
+{ "ldub",       F3(3, 0x01, 1), F3(~3, ~0x01, ~1)|RS1_G0,       "[i],d", 0, v6 },
+{ "ldub",       F3(3, 0x01, 1), F3(~3, ~0x01, ~1)|SIMM13(~0),   "[1],d", 0, v6 }, /* ldub [rs1+0],d */
+
+{ "lduh",       F3(3, 0x02, 0), F3(~3, ~0x02, ~0)|ASI(~0),      "[1+2],d", 0, v6 },
+{ "lduh",       F3(3, 0x02, 0), F3(~3, ~0x02, ~0)|ASI_RS2(~0),  "[1],d", 0, v6 }, /* lduh [rs1+%g0],d */
+{ "lduh",       F3(3, 0x02, 1), F3(~3, ~0x02, ~1),              "[1+i],d", 0, v6 },
+{ "lduh",       F3(3, 0x02, 1), F3(~3, ~0x02, ~1),              "[i+1],d", 0, v6 },
+{ "lduh",       F3(3, 0x02, 1), F3(~3, ~0x02, ~1)|RS1_G0,       "[i],d", 0, v6 },
+{ "lduh",       F3(3, 0x02, 1), F3(~3, ~0x02, ~1)|SIMM13(~0),   "[1],d", 0, v6 }, /* lduh [rs1+0],d */
+
+{ "ldx",        F3(3, 0x0b, 0), F3(~3, ~0x0b, ~0)|ASI(~0),      "[1+2],d", 0, v9 },
+{ "ldx",        F3(3, 0x0b, 0), F3(~3, ~0x0b, ~0)|ASI_RS2(~0),  "[1],d", 0, v9 }, /* ldx [rs1+%g0],d */
+{ "ldx",        F3(3, 0x0b, 1), F3(~3, ~0x0b, ~1),              "[1+i],d", 0, v9 },
+{ "ldx",        F3(3, 0x0b, 1), F3(~3, ~0x0b, ~1),              "[i+1],d", 0, v9 },
+{ "ldx",        F3(3, 0x0b, 1), F3(~3, ~0x0b, ~1)|RS1_G0,       "[i],d", 0, v9 },
+{ "ldx",        F3(3, 0x0b, 1), F3(~3, ~0x0b, ~1)|SIMM13(~0),   "[1],d", 0, v9 }, /* ldx [rs1+0],d */
+
+{ "ldx",        F3(3, 0x21, 0)|RD(1), F3(~3, ~0x21, ~0)|RD(~1), "[1+2],F", 0, v9 },
+{ "ldx",        F3(3, 0x21, 0)|RD(1), F3(~3, ~0x21, ~0)|RS2_G0|RD(~1),  "[1],F", 0, v9 }, /* ld [rs1+%g0],d */
+{ "ldx",        F3(3, 0x21, 1)|RD(1), F3(~3, ~0x21, ~1)|RD(~1), "[1+i],F", 0, v9 },
+{ "ldx",        F3(3, 0x21, 1)|RD(1), F3(~3, ~0x21, ~1)|RD(~1), "[i+1],F", 0, v9 },
+{ "ldx",        F3(3, 0x21, 1)|RD(1), F3(~3, ~0x21, ~1)|RS1_G0|RD(~1),  "[i],F", 0, v9 },
+{ "ldx",        F3(3, 0x21, 1)|RD(1), F3(~3, ~0x21, ~1)|SIMM13(~0)|RD(~1),"[1],F", 0, v9 }, /* ld [rs1+0],d */
+
+{ "lda",        F3(3, 0x10, 0), F3(~3, ~0x10, ~0),              "[1+2]A,d", 0, v6 },
+{ "lda",        F3(3, 0x10, 0), F3(~3, ~0x10, ~0)|RS2_G0,       "[1]A,d", 0, v6 }, /* lda [rs1+%g0],d */
+{ "lda",        F3(3, 0x10, 1), F3(~3, ~0x10, ~1),              "[1+i]o,d", 0, v9 },
+{ "lda",        F3(3, 0x10, 1), F3(~3, ~0x10, ~1),              "[i+1]o,d", 0, v9 },
+{ "lda",        F3(3, 0x10, 1), F3(~3, ~0x10, ~1)|RS1_G0,       "[i]o,d", 0, v9 },
+{ "lda",        F3(3, 0x10, 1), F3(~3, ~0x10, ~1)|SIMM13(~0),   "[1]o,d", 0, v9 }, /* ld [rs1+0],d */
+{ "lda",        F3(3, 0x30, 0), F3(~3, ~0x30, ~0),              "[1+2]A,g", 0, v9 },
+{ "lda",        F3(3, 0x30, 0), F3(~3, ~0x30, ~0)|RS2_G0,       "[1]A,g", 0, v9 }, /* lda [rs1+%g0],d */
+{ "lda",        F3(3, 0x30, 1), F3(~3, ~0x30, ~1),              "[1+i]o,g", 0, v9 },
+{ "lda",        F3(3, 0x30, 1), F3(~3, ~0x30, ~1),              "[i+1]o,g", 0, v9 },
+{ "lda",        F3(3, 0x30, 1), F3(~3, ~0x30, ~1)|RS1_G0,       "[i]o,g", 0, v9 },
+{ "lda",        F3(3, 0x30, 1), F3(~3, ~0x30, ~1)|SIMM13(~0),   "[1]o,g", 0, v9 }, /* ld [rs1+0],d */
+
+{ "ldda",       F3(3, 0x13, 0), F3(~3, ~0x13, ~0),              "[1+2]A,d", 0, v6 },
+{ "ldda",       F3(3, 0x13, 0), F3(~3, ~0x13, ~0)|RS2_G0,       "[1]A,d", 0, v6 }, /* ldda [rs1+%g0],d */
+{ "ldda",       F3(3, 0x13, 1), F3(~3, ~0x13, ~1),              "[1+i]o,d", 0, v9 },
+{ "ldda",       F3(3, 0x13, 1), F3(~3, ~0x13, ~1),              "[i+1]o,d", 0, v9 },
+{ "ldda",       F3(3, 0x13, 1), F3(~3, ~0x13, ~1)|RS1_G0,       "[i]o,d", 0, v9 },
+{ "ldda",       F3(3, 0x13, 1), F3(~3, ~0x13, ~1)|SIMM13(~0),   "[1]o,d", 0, v9 }, /* ld [rs1+0],d */
+
+{ "ldda",       F3(3, 0x33, 0), F3(~3, ~0x33, ~0),              "[1+2]A,H", 0, v9 },
+{ "ldda",       F3(3, 0x33, 0), F3(~3, ~0x33, ~0)|RS2_G0,       "[1]A,H", 0, v9 }, /* ldda [rs1+%g0],d */
+{ "ldda",       F3(3, 0x33, 1), F3(~3, ~0x33, ~1),              "[1+i]o,H", 0, v9 },
+{ "ldda",       F3(3, 0x33, 1), F3(~3, ~0x33, ~1),              "[i+1]o,H", 0, v9 },
+{ "ldda",       F3(3, 0x33, 1), F3(~3, ~0x33, ~1)|RS1_G0,       "[i]o,H", 0, v9 },
+{ "ldda",       F3(3, 0x33, 1), F3(~3, ~0x33, ~1)|SIMM13(~0),   "[1]o,H", 0, v9 }, /* ld [rs1+0],d */
+
+{ "ldqa",       F3(3, 0x32, 0), F3(~3, ~0x32, ~0),              "[1+2]A,J", 0, v9 },
+{ "ldqa",       F3(3, 0x32, 0), F3(~3, ~0x32, ~0)|RS2_G0,       "[1]A,J", 0, v9 }, /* ldd [rs1+%g0],d */
+{ "ldqa",       F3(3, 0x32, 1), F3(~3, ~0x32, ~1),              "[1+i]o,J", 0, v9 },
+{ "ldqa",       F3(3, 0x32, 1), F3(~3, ~0x32, ~1),              "[i+1]o,J", 0, v9 },
+{ "ldqa",       F3(3, 0x32, 1), F3(~3, ~0x32, ~1)|RS1_G0,       "[i]o,J", 0, v9 },
+{ "ldqa",       F3(3, 0x32, 1), F3(~3, ~0x32, ~1)|SIMM13(~0),   "[1]o,J", 0, v9 }, /* ldd [rs1+0],d */
+
+{ "ldsba",      F3(3, 0x19, 0), F3(~3, ~0x19, ~0),              "[1+2]A,d", 0, v6 },
+{ "ldsba",      F3(3, 0x19, 0), F3(~3, ~0x19, ~0)|RS2_G0,       "[1]A,d", 0, v6 }, /* ldsba [rs1+%g0],d */
+{ "ldsba",      F3(3, 0x19, 1), F3(~3, ~0x19, ~1),              "[1+i]o,d", 0, v9 },
+{ "ldsba",      F3(3, 0x19, 1), F3(~3, ~0x19, ~1),              "[i+1]o,d", 0, v9 },
+{ "ldsba",      F3(3, 0x19, 1), F3(~3, ~0x19, ~1)|RS1_G0,       "[i]o,d", 0, v9 },
+{ "ldsba",      F3(3, 0x19, 1), F3(~3, ~0x19, ~1)|SIMM13(~0),   "[1]o,d", 0, v9 }, /* ld [rs1+0],d */
+
+{ "ldsha",      F3(3, 0x1a, 0), F3(~3, ~0x1a, ~0),              "[1+2]A,d", 0, v6 },
+{ "ldsha",      F3(3, 0x1a, 0), F3(~3, ~0x1a, ~0)|RS2_G0,       "[1]A,d", 0, v6 }, /* ldsha [rs1+%g0],d */
+{ "ldsha",      F3(3, 0x1a, 1), F3(~3, ~0x1a, ~1),              "[1+i]o,d", 0, v9 },
+{ "ldsha",      F3(3, 0x1a, 1), F3(~3, ~0x1a, ~1),              "[i+1]o,d", 0, v9 },
+{ "ldsha",      F3(3, 0x1a, 1), F3(~3, ~0x1a, ~1)|RS1_G0,       "[i]o,d", 0, v9 },
+{ "ldsha",      F3(3, 0x1a, 1), F3(~3, ~0x1a, ~1)|SIMM13(~0),   "[1]o,d", 0, v9 }, /* ld [rs1+0],d */
+
+{ "ldstuba",    F3(3, 0x1d, 0), F3(~3, ~0x1d, ~0),              "[1+2]A,d", 0, v6 },
+{ "ldstuba",    F3(3, 0x1d, 0), F3(~3, ~0x1d, ~0)|RS2_G0,       "[1]A,d", 0, v6 }, /* ldstuba [rs1+%g0],d */
+{ "ldstuba",    F3(3, 0x1d, 1), F3(~3, ~0x1d, ~1),              "[1+i]o,d", 0, v9 },
+{ "ldstuba",    F3(3, 0x1d, 1), F3(~3, ~0x1d, ~1),              "[i+1]o,d", 0, v9 },
+{ "ldstuba",    F3(3, 0x1d, 1), F3(~3, ~0x1d, ~1)|RS1_G0,       "[i]o,d", 0, v9 },
+{ "ldstuba",    F3(3, 0x1d, 1), F3(~3, ~0x1d, ~1)|SIMM13(~0),   "[1]o,d", 0, v9 }, /* ld [rs1+0],d */
+
+{ "ldswa",      F3(3, 0x18, 0), F3(~3, ~0x18, ~0),              "[1+2]A,d", 0, v9 },
+{ "ldswa",      F3(3, 0x18, 0), F3(~3, ~0x18, ~0)|RS2_G0,       "[1]A,d", 0, v9 }, /* lda [rs1+%g0],d */
+{ "ldswa",      F3(3, 0x18, 1), F3(~3, ~0x18, ~1),              "[1+i]o,d", 0, v9 },
+{ "ldswa",      F3(3, 0x18, 1), F3(~3, ~0x18, ~1),              "[i+1]o,d", 0, v9 },
+{ "ldswa",      F3(3, 0x18, 1), F3(~3, ~0x18, ~1)|RS1_G0,       "[i]o,d", 0, v9 },
+{ "ldswa",      F3(3, 0x18, 1), F3(~3, ~0x18, ~1)|SIMM13(~0),   "[1]o,d", 0, v9 }, /* ld [rs1+0],d */
+
+{ "lduba",      F3(3, 0x11, 0), F3(~3, ~0x11, ~0),              "[1+2]A,d", 0, v6 },
+{ "lduba",      F3(3, 0x11, 0), F3(~3, ~0x11, ~0)|RS2_G0,       "[1]A,d", 0, v6 }, /* lduba [rs1+%g0],d */
+{ "lduba",      F3(3, 0x11, 1), F3(~3, ~0x11, ~1),              "[1+i]o,d", 0, v9 },
+{ "lduba",      F3(3, 0x11, 1), F3(~3, ~0x11, ~1),              "[i+1]o,d", 0, v9 },
+{ "lduba",      F3(3, 0x11, 1), F3(~3, ~0x11, ~1)|RS1_G0,       "[i]o,d", 0, v9 },
+{ "lduba",      F3(3, 0x11, 1), F3(~3, ~0x11, ~1)|SIMM13(~0),   "[1]o,d", 0, v9 }, /* ld [rs1+0],d */
+
+{ "lduha",      F3(3, 0x12, 0), F3(~3, ~0x12, ~0),              "[1+2]A,d", 0, v6 },
+{ "lduha",      F3(3, 0x12, 0), F3(~3, ~0x12, ~0)|RS2_G0,       "[1]A,d", 0, v6 }, /* lduha [rs1+%g0],d */
+{ "lduha",      F3(3, 0x12, 1), F3(~3, ~0x12, ~1),              "[1+i]o,d", 0, v9 },
+{ "lduha",      F3(3, 0x12, 1), F3(~3, ~0x12, ~1),              "[i+1]o,d", 0, v9 },
+{ "lduha",      F3(3, 0x12, 1), F3(~3, ~0x12, ~1)|RS1_G0,       "[i]o,d", 0, v9 },
+{ "lduha",      F3(3, 0x12, 1), F3(~3, ~0x12, ~1)|SIMM13(~0),   "[1]o,d", 0, v9 }, /* ld [rs1+0],d */
+
+{ "lduwa",      F3(3, 0x10, 0), F3(~3, ~0x10, ~0),              "[1+2]A,d", F_ALIAS, v9 }, /* lduwa === lda */
+{ "lduwa",      F3(3, 0x10, 0), F3(~3, ~0x10, ~0)|RS2_G0,       "[1]A,d", F_ALIAS, v9 }, /* lda [rs1+%g0],d */
+{ "lduwa",      F3(3, 0x10, 1), F3(~3, ~0x10, ~1),              "[1+i]o,d", F_ALIAS, v9 },
+{ "lduwa",      F3(3, 0x10, 1), F3(~3, ~0x10, ~1),              "[i+1]o,d", F_ALIAS, v9 },
+{ "lduwa",      F3(3, 0x10, 1), F3(~3, ~0x10, ~1)|RS1_G0,       "[i]o,d", F_ALIAS, v9 },
+{ "lduwa",      F3(3, 0x10, 1), F3(~3, ~0x10, ~1)|SIMM13(~0),   "[1]o,d", F_ALIAS, v9 }, /* ld [rs1+0],d */
+
+{ "ldxa",       F3(3, 0x1b, 0), F3(~3, ~0x1b, ~0),              "[1+2]A,d", 0, v9 },
+{ "ldxa",       F3(3, 0x1b, 0), F3(~3, ~0x1b, ~0)|RS2_G0,       "[1]A,d", 0, v9 }, /* lda [rs1+%g0],d */
+{ "ldxa",       F3(3, 0x1b, 1), F3(~3, ~0x1b, ~1),              "[1+i]o,d", 0, v9 },
+{ "ldxa",       F3(3, 0x1b, 1), F3(~3, ~0x1b, ~1),              "[i+1]o,d", 0, v9 },
+{ "ldxa",       F3(3, 0x1b, 1), F3(~3, ~0x1b, ~1)|RS1_G0,       "[i]o,d", 0, v9 },
+{ "ldxa",       F3(3, 0x1b, 1), F3(~3, ~0x1b, ~1)|SIMM13(~0),   "[1]o,d", 0, v9 }, /* ld [rs1+0],d */
+
+{ "st", F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI(~0),              "d,[1+2]", 0, v6 },
+{ "st", F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI_RS2(~0),          "d,[1]", 0, v6 }, /* st d,[rs1+%g0] */
+{ "st", F3(3, 0x04, 1), F3(~3, ~0x04, ~1),                      "d,[1+i]", 0, v6 },
+{ "st", F3(3, 0x04, 1), F3(~3, ~0x04, ~1),                      "d,[i+1]", 0, v6 },
+{ "st", F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RS1_G0,               "d,[i]", 0, v6 },
+{ "st", F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|SIMM13(~0),           "d,[1]", 0, v6 }, /* st d,[rs1+0] */
+{ "st", F3(3, 0x24, 0), F3(~3, ~0x24, ~0)|ASI(~0),              "g,[1+2]", 0, v6 },
+{ "st", F3(3, 0x24, 0), F3(~3, ~0x24, ~0)|ASI_RS2(~0),          "g,[1]", 0, v6 }, /* st d[rs1+%g0] */
+{ "st", F3(3, 0x24, 1), F3(~3, ~0x24, ~1),                      "g,[1+i]", 0, v6 },
+{ "st", F3(3, 0x24, 1), F3(~3, ~0x24, ~1),                      "g,[i+1]", 0, v6 },
+{ "st", F3(3, 0x24, 1), F3(~3, ~0x24, ~1)|RS1_G0,               "g,[i]", 0, v6 },
+{ "st", F3(3, 0x24, 1), F3(~3, ~0x24, ~1)|SIMM13(~0),           "g,[1]", 0, v6 }, /* st d,[rs1+0] */
+
+{ "st", F3(3, 0x34, 0), F3(~3, ~0x34, ~0)|ASI(~0),              "D,[1+2]", 0, v6notv9 },
+{ "st", F3(3, 0x34, 0), F3(~3, ~0x34, ~0)|ASI_RS2(~0),          "D,[1]", 0, v6notv9 }, /* st d,[rs1+%g0] */
+{ "st", F3(3, 0x34, 1), F3(~3, ~0x34, ~1),                      "D,[1+i]", 0, v6notv9 },
+{ "st", F3(3, 0x34, 1), F3(~3, ~0x34, ~1),                      "D,[i+1]", 0, v6notv9 },
+{ "st", F3(3, 0x34, 1), F3(~3, ~0x34, ~1)|RS1_G0,               "D,[i]", 0, v6notv9 },
+{ "st", F3(3, 0x34, 1), F3(~3, ~0x34, ~1)|SIMM13(~0),           "D,[1]", 0, v6notv9 }, /* st d,[rs1+0] */
+{ "st", F3(3, 0x35, 0), F3(~3, ~0x35, ~0)|ASI(~0),              "C,[1+2]", 0, v6notv9 },
+{ "st", F3(3, 0x35, 0), F3(~3, ~0x35, ~0)|ASI_RS2(~0),          "C,[1]", 0, v6notv9 }, /* st d,[rs1+%g0] */
+{ "st", F3(3, 0x35, 1), F3(~3, ~0x35, ~1),                      "C,[1+i]", 0, v6notv9 },
+{ "st", F3(3, 0x35, 1), F3(~3, ~0x35, ~1),                      "C,[i+1]", 0, v6notv9 },
+{ "st", F3(3, 0x35, 1), F3(~3, ~0x35, ~1)|RS1_G0,               "C,[i]", 0, v6notv9 },
+{ "st", F3(3, 0x35, 1), F3(~3, ~0x35, ~1)|SIMM13(~0),           "C,[1]", 0, v6notv9 }, /* st d,[rs1+0] */
+
+{ "st", F3(3, 0x25, 0), F3(~3, ~0x25, ~0)|RD_G0|ASI(~0),        "F,[1+2]", 0, v6 },
+{ "st", F3(3, 0x25, 0), F3(~3, ~0x25, ~0)|RD_G0|ASI_RS2(~0),    "F,[1]", 0, v6 }, /* st d,[rs1+%g0] */
+{ "st", F3(3, 0x25, 1), F3(~3, ~0x25, ~1)|RD_G0,                "F,[1+i]", 0, v6 },
+{ "st", F3(3, 0x25, 1), F3(~3, ~0x25, ~1)|RD_G0,                "F,[i+1]", 0, v6 },
+{ "st", F3(3, 0x25, 1), F3(~3, ~0x25, ~1)|RD_G0|RS1_G0,         "F,[i]", 0, v6 },
+{ "st", F3(3, 0x25, 1), F3(~3, ~0x25, ~1)|RD_G0|SIMM13(~0),     "F,[1]", 0, v6 }, /* st d,[rs1+0] */
+
+{ "stw",        F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI(~0),      "d,[1+2]", F_ALIAS, v9 },
+{ "stw",        F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI_RS2(~0),  "d,[1]", F_ALIAS, v9 }, /* st d,[rs1+%g0] */
+{ "stw",        F3(3, 0x04, 1), F3(~3, ~0x04, ~1),              "d,[1+i]", F_ALIAS, v9 },
+{ "stw",        F3(3, 0x04, 1), F3(~3, ~0x04, ~1),              "d,[i+1]", F_ALIAS, v9 },
+{ "stw",        F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RS1_G0,       "d,[i]", F_ALIAS, v9 },
+{ "stw",        F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|SIMM13(~0),   "d,[1]", F_ALIAS, v9 }, /* st d,[rs1+0] */
+{ "stsw",       F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI(~0),      "d,[1+2]", F_ALIAS, v9 },
+{ "stsw",       F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI_RS2(~0),  "d,[1]", F_ALIAS, v9 }, /* st d,[rs1+%g0] */
+{ "stsw",       F3(3, 0x04, 1), F3(~3, ~0x04, ~1),              "d,[1+i]", F_ALIAS, v9 },
+{ "stsw",       F3(3, 0x04, 1), F3(~3, ~0x04, ~1),              "d,[i+1]", F_ALIAS, v9 },
+{ "stsw",       F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RS1_G0,       "d,[i]", F_ALIAS, v9 },
+{ "stsw",       F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|SIMM13(~0),   "d,[1]", F_ALIAS, v9 }, /* st d,[rs1+0] */
+{ "stuw",       F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI(~0),      "d,[1+2]", F_ALIAS, v9 },
+{ "stuw",       F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI_RS2(~0),  "d,[1]", F_ALIAS, v9 }, /* st d,[rs1+%g0] */
+{ "stuw",       F3(3, 0x04, 1), F3(~3, ~0x04, ~1),              "d,[1+i]", F_ALIAS, v9 },
+{ "stuw",       F3(3, 0x04, 1), F3(~3, ~0x04, ~1),              "d,[i+1]", F_ALIAS, v9 },
+{ "stuw",       F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RS1_G0,       "d,[i]", F_ALIAS, v9 },
+{ "stuw",       F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|SIMM13(~0),   "d,[1]", F_ALIAS, v9 }, /* st d,[rs1+0] */
+
+{ "spill",      F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI(~0),      "d,[1+2]", F_ALIAS, v6 },
+{ "spill",      F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|ASI_RS2(~0),  "d,[1]", F_ALIAS, v6 }, /* st d,[rs1+%g0] */
+{ "spill",      F3(3, 0x04, 1), F3(~3, ~0x04, ~1),              "d,[1+i]", F_ALIAS, v6 },
+{ "spill",      F3(3, 0x04, 1), F3(~3, ~0x04, ~1),              "d,[i+1]", F_ALIAS, v6 },
+{ "spill",      F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RS1_G0,       "d,[i]", F_ALIAS, v6 },
+{ "spill",      F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|SIMM13(~0),   "d,[1]", F_ALIAS, v6 }, /* st d,[rs1+0] */
+
+{ "sta",        F3(3, 0x14, 0), F3(~3, ~0x14, ~0),              "d,[1+2]A", 0, v6 },
+{ "sta",        F3(3, 0x14, 0), F3(~3, ~0x14, ~0)|RS2(~0),      "d,[1]A", 0, v6 }, /* sta d,[rs1+%g0] */
+{ "sta",        F3(3, 0x14, 1), F3(~3, ~0x14, ~1),              "d,[1+i]o", 0, v9 },
+{ "sta",        F3(3, 0x14, 1), F3(~3, ~0x14, ~1),              "d,[i+1]o", 0, v9 },
+{ "sta",        F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|RS1_G0,       "d,[i]o", 0, v9 },
+{ "sta",        F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|SIMM13(~0),   "d,[1]o", 0, v9 }, /* st d,[rs1+0] */
+
+{ "sta",        F3(3, 0x34, 0), F3(~3, ~0x34, ~0),              "g,[1+2]A", 0, v9 },
+{ "sta",        F3(3, 0x34, 0), F3(~3, ~0x34, ~0)|RS2(~0),      "g,[1]A", 0, v9 }, /* sta d,[rs1+%g0] */
+{ "sta",        F3(3, 0x34, 1), F3(~3, ~0x34, ~1),              "g,[1+i]o", 0, v9 },
+{ "sta",        F3(3, 0x34, 1), F3(~3, ~0x34, ~1),              "g,[i+1]o", 0, v9 },
+{ "sta",        F3(3, 0x34, 1), F3(~3, ~0x34, ~1)|RS1_G0,       "g,[i]o", 0, v9 },
+{ "sta",        F3(3, 0x34, 1), F3(~3, ~0x34, ~1)|SIMM13(~0),   "g,[1]o", 0, v9 }, /* st d,[rs1+0] */
+
+{ "stwa",       F3(3, 0x14, 0), F3(~3, ~0x14, ~0),              "d,[1+2]A", F_ALIAS, v9 },
+{ "stwa",       F3(3, 0x14, 0), F3(~3, ~0x14, ~0)|RS2(~0),      "d,[1]A", F_ALIAS, v9 }, /* sta d,[rs1+%g0] */
+{ "stwa",       F3(3, 0x14, 1), F3(~3, ~0x14, ~1),              "d,[1+i]o", F_ALIAS, v9 },
+{ "stwa",       F3(3, 0x14, 1), F3(~3, ~0x14, ~1),              "d,[i+1]o", F_ALIAS, v9 },
+{ "stwa",       F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|RS1_G0,       "d,[i]o", F_ALIAS, v9 },
+{ "stwa",       F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|SIMM13(~0),   "d,[1]o", F_ALIAS, v9 }, /* st d,[rs1+0] */
+{ "stswa",      F3(3, 0x14, 0), F3(~3, ~0x14, ~0),              "d,[1+2]A", F_ALIAS, v9 },
+{ "stswa",      F3(3, 0x14, 0), F3(~3, ~0x14, ~0)|RS2(~0),      "d,[1]A", F_ALIAS, v9 }, /* sta d,[rs1+%g0] */
+{ "stswa",      F3(3, 0x14, 1), F3(~3, ~0x14, ~1),              "d,[1+i]o", F_ALIAS, v9 },
+{ "stswa",      F3(3, 0x14, 1), F3(~3, ~0x14, ~1),              "d,[i+1]o", F_ALIAS, v9 },
+{ "stswa",      F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|RS1_G0,       "d,[i]o", F_ALIAS, v9 },
+{ "stswa",      F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|SIMM13(~0),   "d,[1]o", F_ALIAS, v9 }, /* st d,[rs1+0] */
+{ "stuwa",      F3(3, 0x14, 0), F3(~3, ~0x14, ~0),              "d,[1+2]A", F_ALIAS, v9 },
+{ "stuwa",      F3(3, 0x14, 0), F3(~3, ~0x14, ~0)|RS2(~0),      "d,[1]A", F_ALIAS, v9 }, /* sta d,[rs1+%g0] */
+{ "stuwa",      F3(3, 0x14, 1), F3(~3, ~0x14, ~1),              "d,[1+i]o", F_ALIAS, v9 },
+{ "stuwa",      F3(3, 0x14, 1), F3(~3, ~0x14, ~1),              "d,[i+1]o", F_ALIAS, v9 },
+{ "stuwa",      F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|RS1_G0,       "d,[i]o", F_ALIAS, v9 },
+{ "stuwa",      F3(3, 0x14, 1), F3(~3, ~0x14, ~1)|SIMM13(~0),   "d,[1]o", F_ALIAS, v9 }, /* st d,[rs1+0] */
+
+{ "stb",        F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI(~0),      "d,[1+2]", 0, v6 },
+{ "stb",        F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI_RS2(~0),  "d,[1]", 0, v6 }, /* stb d,[rs1+%g0] */
+{ "stb",        F3(3, 0x05, 1), F3(~3, ~0x05, ~1),              "d,[1+i]", 0, v6 },
+{ "stb",        F3(3, 0x05, 1), F3(~3, ~0x05, ~1),              "d,[i+1]", 0, v6 },
+{ "stb",        F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RS1_G0,       "d,[i]", 0, v6 },
+{ "stb",        F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|SIMM13(~0),   "d,[1]", 0, v6 }, /* stb d,[rs1+0] */
+
+{ "stsb",       F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI(~0),      "d,[1+2]", F_ALIAS, v6 },
+{ "stsb",       F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI_RS2(~0),  "d,[1]", F_ALIAS, v6 }, /* stb d,[rs1+%g0] */
+{ "stsb",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1),              "d,[1+i]", F_ALIAS, v6 },
+{ "stsb",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1),              "d,[i+1]", F_ALIAS, v6 },
+{ "stsb",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RS1_G0,       "d,[i]", F_ALIAS, v6 },
+{ "stsb",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|SIMM13(~0),   "d,[1]", F_ALIAS, v6 }, /* stb d,[rs1+0] */
+{ "stub",       F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI(~0),      "d,[1+2]", F_ALIAS, v6 },
+{ "stub",       F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|ASI_RS2(~0),  "d,[1]", F_ALIAS, v6 }, /* stb d,[rs1+%g0] */
+{ "stub",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1),              "d,[1+i]", F_ALIAS, v6 },
+{ "stub",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1),              "d,[i+1]", F_ALIAS, v6 },
+{ "stub",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RS1_G0,       "d,[i]", F_ALIAS, v6 },
+{ "stub",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|SIMM13(~0),   "d,[1]", F_ALIAS, v6 }, /* stb d,[rs1+0] */
+
+{ "stba",       F3(3, 0x15, 0), F3(~3, ~0x15, ~0),              "d,[1+2]A", 0, v6 },
+{ "stba",       F3(3, 0x15, 0), F3(~3, ~0x15, ~0)|RS2(~0),      "d,[1]A", 0, v6 }, /* stba d,[rs1+%g0] */
+{ "stba",       F3(3, 0x15, 1), F3(~3, ~0x15, ~1),              "d,[1+i]o", 0, v9 },
+{ "stba",       F3(3, 0x15, 1), F3(~3, ~0x15, ~1),              "d,[i+1]o", 0, v9 },
+{ "stba",       F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|RS1_G0,       "d,[i]o", 0, v9 },
+{ "stba",       F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|SIMM13(~0),   "d,[1]o", 0, v9 }, /* stb d,[rs1+0] */
+
+{ "stsba",      F3(3, 0x15, 0), F3(~3, ~0x15, ~0),              "d,[1+2]A", F_ALIAS, v6 },
+{ "stsba",      F3(3, 0x15, 0), F3(~3, ~0x15, ~0)|RS2(~0),      "d,[1]A", F_ALIAS, v6 }, /* stba d,[rs1+%g0] */
+{ "stsba",      F3(3, 0x15, 1), F3(~3, ~0x15, ~1),              "d,[1+i]o", F_ALIAS, v9 },
+{ "stsba",      F3(3, 0x15, 1), F3(~3, ~0x15, ~1),              "d,[i+1]o", F_ALIAS, v9 },
+{ "stsba",      F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|RS1_G0,       "d,[i]o", F_ALIAS, v9 },
+{ "stsba",      F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|SIMM13(~0),   "d,[1]o", F_ALIAS, v9 }, /* stb d,[rs1+0] */
+{ "stuba",      F3(3, 0x15, 0), F3(~3, ~0x15, ~0),              "d,[1+2]A", F_ALIAS, v6 },
+{ "stuba",      F3(3, 0x15, 0), F3(~3, ~0x15, ~0)|RS2(~0),      "d,[1]A", F_ALIAS, v6 }, /* stba d,[rs1+%g0] */
+{ "stuba",      F3(3, 0x15, 1), F3(~3, ~0x15, ~1),              "d,[1+i]o", F_ALIAS, v9 },
+{ "stuba",      F3(3, 0x15, 1), F3(~3, ~0x15, ~1),              "d,[i+1]o", F_ALIAS, v9 },
+{ "stuba",      F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|RS1_G0,       "d,[i]o", F_ALIAS, v9 },
+{ "stuba",      F3(3, 0x15, 1), F3(~3, ~0x15, ~1)|SIMM13(~0),   "d,[1]o", F_ALIAS, v9 }, /* stb d,[rs1+0] */
+
+{ "std",        F3(3, 0x07, 0), F3(~3, ~0x07, ~0)|ASI(~0),      "d,[1+2]", 0, v6 },
+{ "std",        F3(3, 0x07, 0), F3(~3, ~0x07, ~0)|ASI_RS2(~0),  "d,[1]", 0, v6 }, /* std d,[rs1+%g0] */
+{ "std",        F3(3, 0x07, 1), F3(~3, ~0x07, ~1),              "d,[1+i]", 0, v6 },
+{ "std",        F3(3, 0x07, 1), F3(~3, ~0x07, ~1),              "d,[i+1]", 0, v6 },
+{ "std",        F3(3, 0x07, 1), F3(~3, ~0x07, ~1)|RS1_G0,       "d,[i]", 0, v6 },
+{ "std",        F3(3, 0x07, 1), F3(~3, ~0x07, ~1)|SIMM13(~0),   "d,[1]", 0, v6 }, /* std d,[rs1+0] */
+
+{ "std",        F3(3, 0x26, 0), F3(~3, ~0x26, ~0)|ASI(~0),      "q,[1+2]", 0, v6notv9 },
+{ "std",        F3(3, 0x26, 0), F3(~3, ~0x26, ~0)|ASI_RS2(~0),  "q,[1]", 0, v6notv9 }, /* std d,[rs1+%g0] */
+{ "std",        F3(3, 0x26, 1), F3(~3, ~0x26, ~1),              "q,[1+i]", 0, v6notv9 },
+{ "std",        F3(3, 0x26, 1), F3(~3, ~0x26, ~1),              "q,[i+1]", 0, v6notv9 },
+{ "std",        F3(3, 0x26, 1), F3(~3, ~0x26, ~1)|RS1_G0,       "q,[i]", 0, v6notv9 },
+{ "std",        F3(3, 0x26, 1), F3(~3, ~0x26, ~1)|SIMM13(~0),   "q,[1]", 0, v6notv9 }, /* std d,[rs1+0] */
+{ "std",        F3(3, 0x27, 0), F3(~3, ~0x27, ~0)|ASI(~0),      "H,[1+2]", 0, v6 },
+{ "std",        F3(3, 0x27, 0), F3(~3, ~0x27, ~0)|ASI_RS2(~0),  "H,[1]", 0, v6 }, /* std d,[rs1+%g0] */
+{ "std",        F3(3, 0x27, 1), F3(~3, ~0x27, ~1),              "H,[1+i]", 0, v6 },
+{ "std",        F3(3, 0x27, 1), F3(~3, ~0x27, ~1),              "H,[i+1]", 0, v6 },
+{ "std",        F3(3, 0x27, 1), F3(~3, ~0x27, ~1)|RS1_G0,       "H,[i]", 0, v6 },
+{ "std",        F3(3, 0x27, 1), F3(~3, ~0x27, ~1)|SIMM13(~0),   "H,[1]", 0, v6 }, /* std d,[rs1+0] */
+
+{ "std",        F3(3, 0x36, 0), F3(~3, ~0x36, ~0)|ASI(~0),      "Q,[1+2]", 0, v6notv9 },
+{ "std",        F3(3, 0x36, 0), F3(~3, ~0x36, ~0)|ASI_RS2(~0),  "Q,[1]", 0, v6notv9 }, /* std d,[rs1+%g0] */
+{ "std",        F3(3, 0x36, 1), F3(~3, ~0x36, ~1),              "Q,[1+i]", 0, v6notv9 },
+{ "std",        F3(3, 0x36, 1), F3(~3, ~0x36, ~1),              "Q,[i+1]", 0, v6notv9 },
+{ "std",        F3(3, 0x36, 1), F3(~3, ~0x36, ~1)|RS1_G0,       "Q,[i]", 0, v6notv9 },
+{ "std",        F3(3, 0x36, 1), F3(~3, ~0x36, ~1)|SIMM13(~0),   "Q,[1]", 0, v6notv9 }, /* std d,[rs1+0] */
+{ "std",        F3(3, 0x37, 0), F3(~3, ~0x37, ~0)|ASI(~0),      "D,[1+2]", 0, v6notv9 },
+{ "std",        F3(3, 0x37, 0), F3(~3, ~0x37, ~0)|ASI_RS2(~0),  "D,[1]", 0, v6notv9 }, /* std d,[rs1+%g0] */
+{ "std",        F3(3, 0x37, 1), F3(~3, ~0x37, ~1),              "D,[1+i]", 0, v6notv9 },
+{ "std",        F3(3, 0x37, 1), F3(~3, ~0x37, ~1),              "D,[i+1]", 0, v6notv9 },
+{ "std",        F3(3, 0x37, 1), F3(~3, ~0x37, ~1)|RS1_G0,       "D,[i]", 0, v6notv9 },
+{ "std",        F3(3, 0x37, 1), F3(~3, ~0x37, ~1)|SIMM13(~0),   "D,[1]", 0, v6notv9 }, /* std d,[rs1+0] */
+
+{ "spilld",     F3(3, 0x07, 0), F3(~3, ~0x07, ~0)|ASI(~0),      "d,[1+2]", F_ALIAS, v6 },
+{ "spilld",     F3(3, 0x07, 0), F3(~3, ~0x07, ~0)|ASI_RS2(~0),  "d,[1]", F_ALIAS, v6 }, /* std d,[rs1+%g0] */
+{ "spilld",     F3(3, 0x07, 1), F3(~3, ~0x07, ~1),              "d,[1+i]", F_ALIAS, v6 },
+{ "spilld",     F3(3, 0x07, 1), F3(~3, ~0x07, ~1),              "d,[i+1]", F_ALIAS, v6 },
+{ "spilld",     F3(3, 0x07, 1), F3(~3, ~0x07, ~1)|RS1_G0,       "d,[i]", F_ALIAS, v6 },
+{ "spilld",     F3(3, 0x07, 1), F3(~3, ~0x07, ~1)|SIMM13(~0),   "d,[1]", F_ALIAS, v6 }, /* std d,[rs1+0] */
+
+{ "stda",       F3(3, 0x17, 0), F3(~3, ~0x17, ~0),              "d,[1+2]A", 0, v6 },
+{ "stda",       F3(3, 0x17, 0), F3(~3, ~0x17, ~0)|RS2(~0),      "d,[1]A", 0, v6 }, /* stda d,[rs1+%g0] */
+{ "stda",       F3(3, 0x17, 1), F3(~3, ~0x17, ~1),              "d,[1+i]o", 0, v9 },
+{ "stda",       F3(3, 0x17, 1), F3(~3, ~0x17, ~1),              "d,[i+1]o", 0, v9 },
+{ "stda",       F3(3, 0x17, 1), F3(~3, ~0x17, ~1)|RS1_G0,       "d,[i]o", 0, v9 },
+{ "stda",       F3(3, 0x17, 1), F3(~3, ~0x17, ~1)|SIMM13(~0),   "d,[1]o", 0, v9 }, /* std d,[rs1+0] */
+{ "stda",       F3(3, 0x37, 0), F3(~3, ~0x37, ~0),              "H,[1+2]A", 0, v9 },
+{ "stda",       F3(3, 0x37, 0), F3(~3, ~0x37, ~0)|RS2(~0),      "H,[1]A", 0, v9 }, /* stda d,[rs1+%g0] */
+{ "stda",       F3(3, 0x37, 1), F3(~3, ~0x37, ~1),              "H,[1+i]o", 0, v9 },
+{ "stda",       F3(3, 0x37, 1), F3(~3, ~0x37, ~1),              "H,[i+1]o", 0, v9 },
+{ "stda",       F3(3, 0x37, 1), F3(~3, ~0x37, ~1)|RS1_G0,       "H,[i]o", 0, v9 },
+{ "stda",       F3(3, 0x37, 1), F3(~3, ~0x37, ~1)|SIMM13(~0),   "H,[1]o", 0, v9 }, /* std d,[rs1+0] */
+
+{ "sth",        F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI(~0),      "d,[1+2]", 0, v6 },
+{ "sth",        F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI_RS2(~0),  "d,[1]", 0, v6 }, /* sth d,[rs1+%g0] */
+{ "sth",        F3(3, 0x06, 1), F3(~3, ~0x06, ~1),              "d,[1+i]", 0, v6 },
+{ "sth",        F3(3, 0x06, 1), F3(~3, ~0x06, ~1),              "d,[i+1]", 0, v6 },
+{ "sth",        F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RS1_G0,       "d,[i]", 0, v6 },
+{ "sth",        F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|SIMM13(~0),   "d,[1]", 0, v6 }, /* sth d,[rs1+0] */
+
+{ "stsh",       F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI(~0),      "d,[1+2]", F_ALIAS, v6 },
+{ "stsh",       F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI_RS2(~0),  "d,[1]", F_ALIAS, v6 }, /* sth d,[rs1+%g0] */
+{ "stsh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1),              "d,[1+i]", F_ALIAS, v6 },
+{ "stsh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1),              "d,[i+1]", F_ALIAS, v6 },
+{ "stsh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RS1_G0,       "d,[i]", F_ALIAS, v6 },
+{ "stsh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|SIMM13(~0),   "d,[1]", F_ALIAS, v6 }, /* sth d,[rs1+0] */
+{ "stuh",       F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI(~0),      "d,[1+2]", F_ALIAS, v6 },
+{ "stuh",       F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|ASI_RS2(~0),  "d,[1]", F_ALIAS, v6 }, /* sth d,[rs1+%g0] */
+{ "stuh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1),              "d,[1+i]", F_ALIAS, v6 },
+{ "stuh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1),              "d,[i+1]", F_ALIAS, v6 },
+{ "stuh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RS1_G0,       "d,[i]", F_ALIAS, v6 },
+{ "stuh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|SIMM13(~0),   "d,[1]", F_ALIAS, v6 }, /* sth d,[rs1+0] */
+
+{ "stha",       F3(3, 0x16, 0), F3(~3, ~0x16, ~0),              "d,[1+2]A", 0, v6 },
+{ "stha",       F3(3, 0x16, 0), F3(~3, ~0x16, ~0)|RS2(~0),      "d,[1]A", 0, v6 }, /* stha ,[rs1+%g0] */
+{ "stha",       F3(3, 0x16, 1), F3(~3, ~0x16, ~1),              "d,[1+i]o", 0, v9 },
+{ "stha",       F3(3, 0x16, 1), F3(~3, ~0x16, ~1),              "d,[i+1]o", 0, v9 },
+{ "stha",       F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|RS1_G0,       "d,[i]o", 0, v9 },
+{ "stha",       F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|SIMM13(~0),   "d,[1]o", 0, v9 }, /* sth d,[rs1+0] */
+
+{ "stsha",      F3(3, 0x16, 0), F3(~3, ~0x16, ~0),              "d,[1+2]A", F_ALIAS, v6 },
+{ "stsha",      F3(3, 0x16, 0), F3(~3, ~0x16, ~0)|RS2(~0),      "d,[1]A", F_ALIAS, v6 }, /* stha ,[rs1+%g0] */
+{ "stsha",      F3(3, 0x16, 1), F3(~3, ~0x16, ~1),              "d,[1+i]o", F_ALIAS, v9 },
+{ "stsha",      F3(3, 0x16, 1), F3(~3, ~0x16, ~1),              "d,[i+1]o", F_ALIAS, v9 },
+{ "stsha",      F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|RS1_G0,       "d,[i]o", F_ALIAS, v9 },
+{ "stsha",      F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|SIMM13(~0),   "d,[1]o", F_ALIAS, v9 }, /* sth d,[rs1+0] */
+{ "stuha",      F3(3, 0x16, 0), F3(~3, ~0x16, ~0),              "d,[1+2]A", F_ALIAS, v6 },
+{ "stuha",      F3(3, 0x16, 0), F3(~3, ~0x16, ~0)|RS2(~0),      "d,[1]A", F_ALIAS, v6 }, /* stha ,[rs1+%g0] */
+{ "stuha",      F3(3, 0x16, 1), F3(~3, ~0x16, ~1),              "d,[1+i]o", F_ALIAS, v9 },
+{ "stuha",      F3(3, 0x16, 1), F3(~3, ~0x16, ~1),              "d,[i+1]o", F_ALIAS, v9 },
+{ "stuha",      F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|RS1_G0,       "d,[i]o", F_ALIAS, v9 },
+{ "stuha",      F3(3, 0x16, 1), F3(~3, ~0x16, ~1)|SIMM13(~0),   "d,[1]o", F_ALIAS, v9 }, /* sth d,[rs1+0] */
+
+{ "stx",        F3(3, 0x0e, 0), F3(~3, ~0x0e, ~0)|ASI(~0),      "d,[1+2]", 0, v9 },
+{ "stx",        F3(3, 0x0e, 0), F3(~3, ~0x0e, ~0)|ASI_RS2(~0),  "d,[1]", 0, v9 }, /* stx d,[rs1+%g0] */
+{ "stx",        F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1),              "d,[1+i]", 0, v9 },
+{ "stx",        F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1),              "d,[i+1]", 0, v9 },
+{ "stx",        F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|RS1_G0,       "d,[i]", 0, v9 },
+{ "stx",        F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|SIMM13(~0),   "d,[1]", 0, v9 }, /* stx d,[rs1+0] */
+
+{ "stx",        F3(3, 0x25, 0)|RD(1), F3(~3, ~0x25, ~0)|ASI(~0)|RD(~1), "F,[1+2]", 0, v9 },
+{ "stx",        F3(3, 0x25, 0)|RD(1), F3(~3, ~0x25, ~0)|ASI_RS2(~0)|RD(~1),"F,[1]", 0, v9 }, /* stx d,[rs1+%g0] */
+{ "stx",        F3(3, 0x25, 1)|RD(1), F3(~3, ~0x25, ~1)|RD(~1),         "F,[1+i]", 0, v9 },
+{ "stx",        F3(3, 0x25, 1)|RD(1), F3(~3, ~0x25, ~1)|RD(~1),         "F,[i+1]", 0, v9 },
+{ "stx",        F3(3, 0x25, 1)|RD(1), F3(~3, ~0x25, ~1)|RS1_G0|RD(~1),  "F,[i]", 0, v9 },
+{ "stx",        F3(3, 0x25, 1)|RD(1), F3(~3, ~0x25, ~1)|SIMM13(~0)|RD(~1),"F,[1]", 0, v9 }, /* stx d,[rs1+0] */
+
+{ "stxa",       F3(3, 0x1e, 0), F3(~3, ~0x1e, ~0),              "d,[1+2]A", 0, v9 },
+{ "stxa",       F3(3, 0x1e, 0), F3(~3, ~0x1e, ~0)|RS2(~0),      "d,[1]A", 0, v9 }, /* stxa d,[rs1+%g0] */
+{ "stxa",       F3(3, 0x1e, 1), F3(~3, ~0x1e, ~1),              "d,[1+i]o", 0, v9 },
+{ "stxa",       F3(3, 0x1e, 1), F3(~3, ~0x1e, ~1),              "d,[i+1]o", 0, v9 },
+{ "stxa",       F3(3, 0x1e, 1), F3(~3, ~0x1e, ~1)|RS1_G0,       "d,[i]o", 0, v9 },
+{ "stxa",       F3(3, 0x1e, 1), F3(~3, ~0x1e, ~1)|SIMM13(~0),   "d,[1]o", 0, v9 }, /* stx d,[rs1+0] */
+
+{ "stq",        F3(3, 0x26, 0), F3(~3, ~0x26, ~0)|ASI(~0),      "J,[1+2]", 0, v9 },
+{ "stq",        F3(3, 0x26, 0), F3(~3, ~0x26, ~0)|ASI_RS2(~0),  "J,[1]", 0, v9 }, /* stq [rs1+%g0] */
+{ "stq",        F3(3, 0x26, 1), F3(~3, ~0x26, ~1),              "J,[1+i]", 0, v9 },
+{ "stq",        F3(3, 0x26, 1), F3(~3, ~0x26, ~1),              "J,[i+1]", 0, v9 },
+{ "stq",        F3(3, 0x26, 1), F3(~3, ~0x26, ~1)|RS1_G0,       "J,[i]", 0, v9 },
+{ "stq",        F3(3, 0x26, 1), F3(~3, ~0x26, ~1)|SIMM13(~0),   "J,[1]", 0, v9 }, /* stq [rs1+0] */
+
+{ "stqa",       F3(3, 0x36, 0), F3(~3, ~0x36, ~0)|ASI(~0),      "J,[1+2]A", 0, v9 },
+{ "stqa",       F3(3, 0x36, 0), F3(~3, ~0x36, ~0)|ASI_RS2(~0),  "J,[1]A", 0, v9 }, /* stqa [rs1+%g0] */
+{ "stqa",       F3(3, 0x36, 1), F3(~3, ~0x36, ~1),              "J,[1+i]o", 0, v9 },
+{ "stqa",       F3(3, 0x36, 1), F3(~3, ~0x36, ~1),              "J,[i+1]o", 0, v9 },
+{ "stqa",       F3(3, 0x36, 1), F3(~3, ~0x36, ~1)|RS1_G0,       "J,[i]o", 0, v9 },
+{ "stqa",       F3(3, 0x36, 1), F3(~3, ~0x36, ~1)|SIMM13(~0),   "J,[1]o", 0, v9 }, /* stqa [rs1+0] */
+
+{ "swap",       F3(3, 0x0f, 0), F3(~3, ~0x0f, ~0)|ASI(~0),      "[1+2],d", 0, v7 },
+{ "swap",       F3(3, 0x0f, 0), F3(~3, ~0x0f, ~0)|ASI_RS2(~0),  "[1],d", 0, v7 }, /* swap [rs1+%g0],d */
+{ "swap",       F3(3, 0x0f, 1), F3(~3, ~0x0f, ~1),              "[1+i],d", 0, v7 },
+{ "swap",       F3(3, 0x0f, 1), F3(~3, ~0x0f, ~1),              "[i+1],d", 0, v7 },
+{ "swap",       F3(3, 0x0f, 1), F3(~3, ~0x0f, ~1)|RS1_G0,       "[i],d", 0, v7 },
+{ "swap",       F3(3, 0x0f, 1), F3(~3, ~0x0f, ~1)|SIMM13(~0),   "[1],d", 0, v7 }, /* swap [rs1+0],d */
+
+{ "swapa",      F3(3, 0x1f, 0), F3(~3, ~0x1f, ~0),              "[1+2]A,d", 0, v7 },
+{ "swapa",      F3(3, 0x1f, 0), F3(~3, ~0x1f, ~0)|RS2(~0),      "[1]A,d", 0, v7 }, /* swapa [rs1+%g0],d */
+{ "swapa",      F3(3, 0x1f, 1), F3(~3, ~0x1f, ~1),              "[1+i]o,d", 0, v9 },
+{ "swapa",      F3(3, 0x1f, 1), F3(~3, ~0x1f, ~1),              "[i+1]o,d", 0, v9 },
+{ "swapa",      F3(3, 0x1f, 1), F3(~3, ~0x1f, ~1)|RS1_G0,       "[i]o,d", 0, v9 },
+{ "swapa",      F3(3, 0x1f, 1), F3(~3, ~0x1f, ~1)|SIMM13(~0),   "[1]o,d", 0, v9 }, /* swap [rs1+0],d */
+
+{ "restore",    F3(2, 0x3d, 0), F3(~2, ~0x3d, ~0)|ASI(~0),                      "1,2,d", 0, v6 },
+{ "restore",    F3(2, 0x3d, 0), F3(~2, ~0x3d, ~0)|RD_G0|RS1_G0|ASI_RS2(~0),     "", 0, v6 }, /* restore %g0,%g0,%g0 */
+{ "restore",    F3(2, 0x3d, 1), F3(~2, ~0x3d, ~1),                              "1,i,d", 0, v6 },
+{ "restore",    F3(2, 0x3d, 1), F3(~2, ~0x3d, ~1)|RD_G0|RS1_G0|SIMM13(~0),      "", 0, v6 }, /* restore %g0,0,%g0 */
+
+{ "rett",       F3(2, 0x39, 0), F3(~2, ~0x39, ~0)|RD_G0|ASI(~0),        "1+2", F_UNBR|F_DELAYED, v6 }, /* rett rs1+rs2 */
+{ "rett",       F3(2, 0x39, 0), F3(~2, ~0x39, ~0)|RD_G0|ASI_RS2(~0),    "1", F_UNBR|F_DELAYED, v6 },    /* rett rs1,%g0 */
+{ "rett",       F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RD_G0,                "1+i", F_UNBR|F_DELAYED, v6 }, /* rett rs1+X */
+{ "rett",       F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RD_G0,                "i+1", F_UNBR|F_DELAYED, v6 }, /* rett X+rs1 */
+{ "rett",       F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RD_G0|RS1_G0,         "i", F_UNBR|F_DELAYED, v6 }, /* rett X+rs1 */
+{ "rett",       F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RD_G0|RS1_G0,         "i", F_UNBR|F_DELAYED, v6 },    /* rett X */
+{ "rett",       F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RD_G0|SIMM13(~0),     "1", F_UNBR|F_DELAYED, v6 },    /* rett rs1+0 */
+
+{ "save",       F3(2, 0x3c, 0), F3(~2, ~0x3c, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "save",       F3(2, 0x3c, 1), F3(~2, ~0x3c, ~1),              "1,i,d", 0, v6 },
+{ "save",       0x81e00000,     ~0x81e00000,                    "", F_ALIAS, v6 },
+
+{ "ret",  F3(2, 0x38, 1)|RS1(0x1f)|SIMM13(8), F3(~2, ~0x38, ~1)|SIMM13(~8),            "", F_UNBR|F_DELAYED, v6 }, /* jmpl %i7+8,%g0 */
 { "retl", F3(2, 0x38, 1)|RS1(0x0f)|SIMM13(8), F3(~2, ~0x38, ~1)|RS1(~0x0f)|SIMM13(~8), "", F_UNBR|F_DELAYED, v6 }, /* jmpl %o7+8,%g0 */
 
-{ "jmpl",	F3(2, 0x38, 0), F3(~2, ~0x38, ~0)|ASI(~0),	"1+2,d", F_JSR|F_DELAYED, v6 },
-{ "jmpl",	F3(2, 0x38, 0), F3(~2, ~0x38, ~0)|ASI_RS2(~0),	"1,d", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+%g0,d */
-{ "jmpl",	F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|SIMM13(~0),	"1,d", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+0,d */
-{ "jmpl",	F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|RS1_G0,	"i,d", F_JSR|F_DELAYED, v6 }, /* jmpl %g0+i,d */
-{ "jmpl",	F3(2, 0x38, 1), F3(~2, ~0x38, ~1),		"1+i,d", F_JSR|F_DELAYED, v6 },
-{ "jmpl",	F3(2, 0x38, 1), F3(~2, ~0x38, ~1),		"i+1,d", F_JSR|F_DELAYED, v6 },
-
-{ "done",	F3(2, 0x3e, 0)|RD(0), F3(~2, ~0x3e, ~0)|RD(~0)|RS1_G0|SIMM13(~0),	"", 0, v9 },
-{ "retry",	F3(2, 0x3e, 0)|RD(1), F3(~2, ~0x3e, ~0)|RD(~1)|RS1_G0|SIMM13(~0),	"", 0, v9 },
-{ "saved",	F3(2, 0x31, 0)|RD(0), F3(~2, ~0x31, ~0)|RD(~0)|RS1_G0|SIMM13(~0),	"", 0, v9 },
-{ "restored",	F3(2, 0x31, 0)|RD(1), F3(~2, ~0x31, ~0)|RD(~1)|RS1_G0|SIMM13(~0),	"", 0, v9 },
-{ "sir",	F3(2, 0x30, 1)|RD(0xf), F3(~2, ~0x30, ~1)|RD(~0xf)|RS1_G0,		"i", 0, v9 },
-
-{ "flush",	F3(2, 0x3b, 0), F3(~2, ~0x3b, ~0)|ASI(~0),	"1+2", 0, v8 },
-{ "flush",	F3(2, 0x3b, 0), F3(~2, ~0x3b, ~0)|ASI_RS2(~0),	"1", 0, v8 }, /* flush rs1+%g0 */
-{ "flush",	F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1)|SIMM13(~0),	"1", 0, v8 }, /* flush rs1+0 */
-{ "flush",	F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1)|RS1_G0,	"i", 0, v8 }, /* flush %g0+i */
-{ "flush",	F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1),		"1+i", 0, v8 },
-{ "flush",	F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1),		"i+1", 0, v8 },
+{ "jmpl",       F3(2, 0x38, 0), F3(~2, ~0x38, ~0)|ASI(~0),      "1+2,d", F_JSR|F_DELAYED, v6 },
+{ "jmpl",       F3(2, 0x38, 0), F3(~2, ~0x38, ~0)|ASI_RS2(~0),  "1,d", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+%g0,d */
+{ "jmpl",       F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|SIMM13(~0),   "1,d", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+0,d */
+{ "jmpl",       F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|RS1_G0,       "i,d", F_JSR|F_DELAYED, v6 }, /* jmpl %g0+i,d */
+{ "jmpl",       F3(2, 0x38, 1), F3(~2, ~0x38, ~1),              "1+i,d", F_JSR|F_DELAYED, v6 },
+{ "jmpl",       F3(2, 0x38, 1), F3(~2, ~0x38, ~1),              "i+1,d", F_JSR|F_DELAYED, v6 },
+
+{ "done",       F3(2, 0x3e, 0)|RD(0), F3(~2, ~0x3e, ~0)|RD(~0)|RS1_G0|SIMM13(~0),       "", 0, v9 },
+{ "retry",      F3(2, 0x3e, 0)|RD(1), F3(~2, ~0x3e, ~0)|RD(~1)|RS1_G0|SIMM13(~0),       "", 0, v9 },
+{ "saved",      F3(2, 0x31, 0)|RD(0), F3(~2, ~0x31, ~0)|RD(~0)|RS1_G0|SIMM13(~0),       "", 0, v9 },
+{ "restored",   F3(2, 0x31, 0)|RD(1), F3(~2, ~0x31, ~0)|RD(~1)|RS1_G0|SIMM13(~0),       "", 0, v9 },
+{ "sir",        F3(2, 0x30, 1)|RD(0xf), F3(~2, ~0x30, ~1)|RD(~0xf)|RS1_G0,              "i", 0, v9 },
+
+{ "flush",      F3(2, 0x3b, 0), F3(~2, ~0x3b, ~0)|ASI(~0),      "1+2", 0, v8 },
+{ "flush",      F3(2, 0x3b, 0), F3(~2, ~0x3b, ~0)|ASI_RS2(~0),  "1", 0, v8 }, /* flush rs1+%g0 */
+{ "flush",      F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1)|SIMM13(~0),   "1", 0, v8 }, /* flush rs1+0 */
+{ "flush",      F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1)|RS1_G0,       "i", 0, v8 }, /* flush %g0+i */
+{ "flush",      F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1),              "1+i", 0, v8 },
+{ "flush",      F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1),              "i+1", 0, v8 },
 
 /* IFLUSH was renamed to FLUSH in v8.  */
-{ "iflush",	F3(2, 0x3b, 0), F3(~2, ~0x3b, ~0)|ASI(~0),	"1+2", F_ALIAS, v6 },
-{ "iflush",	F3(2, 0x3b, 0), F3(~2, ~0x3b, ~0)|ASI_RS2(~0),	"1", F_ALIAS, v6 }, /* flush rs1+%g0 */
-{ "iflush",	F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1)|SIMM13(~0),	"1", F_ALIAS, v6 }, /* flush rs1+0 */
-{ "iflush",	F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1)|RS1_G0,	"i", F_ALIAS, v6 },
-{ "iflush",	F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1),		"1+i", F_ALIAS, v6 },
-{ "iflush",	F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1),		"i+1", F_ALIAS, v6 },
-
-{ "return",	F3(2, 0x39, 0), F3(~2, ~0x39, ~0)|ASI(~0),	"1+2", 0, v9 },
-{ "return",	F3(2, 0x39, 0), F3(~2, ~0x39, ~0)|ASI_RS2(~0),	"1", 0, v9 }, /* return rs1+%g0 */
-{ "return",	F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|SIMM13(~0),	"1", 0, v9 }, /* return rs1+0 */
-{ "return",	F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RS1_G0,	"i", 0, v9 }, /* return %g0+i */
-{ "return",	F3(2, 0x39, 1), F3(~2, ~0x39, ~1),		"1+i", 0, v9 },
-{ "return",	F3(2, 0x39, 1), F3(~2, ~0x39, ~1),		"i+1", 0, v9 },
-
-{ "flushw",	F3(2, 0x2b, 0), F3(~2, ~0x2b, ~0)|RD_G0|RS1_G0|ASI_RS2(~0),	"", 0, v9 },
-
-{ "membar",	F3(2, 0x28, 1)|RS1(0xf), F3(~2, ~0x28, ~1)|RD_G0|RS1(~0xf)|SIMM13(~127), "K", 0, v9 },
-{ "stbar",	F3(2, 0x28, 0)|RS1(0xf), F3(~2, ~0x28, ~0)|RD_G0|RS1(~0xf)|SIMM13(~0), "", 0, v8 },
-
-{ "prefetch",	F3(3, 0x2d, 0), F3(~3, ~0x2d, ~0),		"[1+2],*", 0, v9 },
-{ "prefetch",	F3(3, 0x2d, 0), F3(~3, ~0x2d, ~0)|RS2_G0,	"[1],*", 0, v9 }, /* prefetch [rs1+%g0],prefetch_fcn */
-{ "prefetch",	F3(3, 0x2d, 1), F3(~3, ~0x2d, ~1),		"[1+i],*", 0, v9 },
-{ "prefetch",	F3(3, 0x2d, 1), F3(~3, ~0x2d, ~1),		"[i+1],*", 0, v9 },
-{ "prefetch",	F3(3, 0x2d, 1), F3(~3, ~0x2d, ~1)|RS1_G0,	"[i],*", 0, v9 },
-{ "prefetch",	F3(3, 0x2d, 1), F3(~3, ~0x2d, ~1)|SIMM13(~0),	"[1],*", 0, v9 }, /* prefetch [rs1+0],prefetch_fcn */
-{ "prefetcha",	F3(3, 0x3d, 0), F3(~3, ~0x3d, ~0),		"[1+2]A,*", 0, v9 },
-{ "prefetcha",	F3(3, 0x3d, 0), F3(~3, ~0x3d, ~0)|RS2_G0,	"[1]A,*", 0, v9 }, /* prefetcha [rs1+%g0],prefetch_fcn */
-{ "prefetcha",	F3(3, 0x3d, 1), F3(~3, ~0x3d, ~1),		"[1+i]o,*", 0, v9 },
-{ "prefetcha",	F3(3, 0x3d, 1), F3(~3, ~0x3d, ~1),		"[i+1]o,*", 0, v9 },
-{ "prefetcha",	F3(3, 0x3d, 1), F3(~3, ~0x3d, ~1)|RS1_G0,	"[i]o,*", 0, v9 },
-{ "prefetcha",	F3(3, 0x3d, 1), F3(~3, ~0x3d, ~1)|SIMM13(~0),	"[1]o,*", 0, v9 }, /* prefetcha [rs1+0],d */
-
-{ "sll",	F3(2, 0x25, 0), F3(~2, ~0x25, ~0)|(1<<12)|(0x7f<<5),	"1,2,d", 0, v6 },
-{ "sll",	F3(2, 0x25, 1), F3(~2, ~0x25, ~1)|(1<<12)|(0x7f<<5),	"1,X,d", 0, v6 },
-{ "sra",	F3(2, 0x27, 0), F3(~2, ~0x27, ~0)|(1<<12)|(0x7f<<5),	"1,2,d", 0, v6 },
-{ "sra",	F3(2, 0x27, 1), F3(~2, ~0x27, ~1)|(1<<12)|(0x7f<<5),	"1,X,d", 0, v6 },
-{ "srl",	F3(2, 0x26, 0), F3(~2, ~0x26, ~0)|(1<<12)|(0x7f<<5),	"1,2,d", 0, v6 },
-{ "srl",	F3(2, 0x26, 1), F3(~2, ~0x26, ~1)|(1<<12)|(0x7f<<5),	"1,X,d", 0, v6 },
-
-{ "sllx",	F3(2, 0x25, 0)|(1<<12), F3(~2, ~0x25, ~0)|(0x7f<<5),	"1,2,d", 0, v9 },
-{ "sllx",	F3(2, 0x25, 1)|(1<<12), F3(~2, ~0x25, ~1)|(0x3f<<6),	"1,Y,d", 0, v9 },
-{ "srax",	F3(2, 0x27, 0)|(1<<12), F3(~2, ~0x27, ~0)|(0x7f<<5),	"1,2,d", 0, v9 },
-{ "srax",	F3(2, 0x27, 1)|(1<<12), F3(~2, ~0x27, ~1)|(0x3f<<6),	"1,Y,d", 0, v9 },
-{ "srlx",	F3(2, 0x26, 0)|(1<<12), F3(~2, ~0x26, ~0)|(0x7f<<5),	"1,2,d", 0, v9 },
-{ "srlx",	F3(2, 0x26, 1)|(1<<12), F3(~2, ~0x26, ~1)|(0x3f<<6),	"1,Y,d", 0, v9 },
-
-{ "mulscc",	F3(2, 0x24, 0), F3(~2, ~0x24, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "mulscc",	F3(2, 0x24, 1), F3(~2, ~0x24, ~1),		"1,i,d", 0, v6 },
-
-{ "divscc",	F3(2, 0x1d, 0), F3(~2, ~0x1d, ~0)|ASI(~0),	"1,2,d", 0, sparclite },
-{ "divscc",	F3(2, 0x1d, 1), F3(~2, ~0x1d, ~1),		"1,i,d", 0, sparclite },
-
-{ "scan",	F3(2, 0x2c, 0), F3(~2, ~0x2c, ~0)|ASI(~0),	"1,2,d", 0, sparclet|sparclite },
-{ "scan",	F3(2, 0x2c, 1), F3(~2, ~0x2c, ~1),		"1,i,d", 0, sparclet|sparclite },
-
-{ "popc",	F3(2, 0x2e, 0), F3(~2, ~0x2e, ~0)|RS1_G0|ASI(~0),"2,d", 0, v9 },
-{ "popc",	F3(2, 0x2e, 1), F3(~2, ~0x2e, ~1)|RS1_G0,	"i,d", 0, v9 },
-
-{ "clr",	F3(2, 0x02, 0), F3(~2, ~0x02, ~0)|RD_G0|RS1_G0|ASI_RS2(~0),	"d", F_ALIAS, v6 }, /* or %g0,%g0,d */
-{ "clr",	F3(2, 0x02, 1), F3(~2, ~0x02, ~1)|RS1_G0|SIMM13(~0),		"d", F_ALIAS, v6 }, /* or %g0,0,d	*/
-{ "clr",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|RD_G0|ASI(~0),		"[1+2]", F_ALIAS, v6 },
-{ "clr",	F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|RD_G0|ASI_RS2(~0),		"[1]", F_ALIAS, v6 }, /* st %g0,[rs1+%g0] */
-{ "clr",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RD_G0,			"[1+i]", F_ALIAS, v6 },
-{ "clr",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RD_G0,			"[i+1]", F_ALIAS, v6 },
-{ "clr",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RD_G0|RS1_G0,			"[i]", F_ALIAS, v6 },
-{ "clr",	F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RD_G0|SIMM13(~0),		"[1]", F_ALIAS, v6 }, /* st %g0,[rs1+0] */
-
-{ "clrb",	F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|RD_G0|ASI(~0),	"[1+2]", F_ALIAS, v6 },
-{ "clrb",	F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|RD_G0|ASI_RS2(~0),	"[1]", F_ALIAS, v6 }, /* stb %g0,[rs1+%g0] */
-{ "clrb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RD_G0,		"[1+i]", F_ALIAS, v6 },
-{ "clrb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RD_G0,		"[i+1]", F_ALIAS, v6 },
-{ "clrb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RD_G0|RS1_G0,		"[i]", F_ALIAS, v6 },
-{ "clrb",	F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RD_G0|SIMM13(~0),	"[1]", F_ALIAS, v6 }, /* stb %g0,[rs1+0] */
-
-{ "clrh",	F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|RD_G0|ASI(~0),	"[1+2]", F_ALIAS, v6 },
-{ "clrh",	F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|RD_G0|ASI_RS2(~0),	"[1]", F_ALIAS, v6 }, /* sth %g0,[rs1+%g0] */
-{ "clrh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RD_G0,		"[1+i]", F_ALIAS, v6 },
-{ "clrh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RD_G0,		"[i+1]", F_ALIAS, v6 },
-{ "clrh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RD_G0|RS1_G0,		"[i]", F_ALIAS, v6 },
-{ "clrh",	F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RD_G0|SIMM13(~0),	"[1]", F_ALIAS, v6 }, /* sth %g0,[rs1+0] */
-
-{ "clrx",	F3(3, 0x0e, 0), F3(~3, ~0x0e, ~0)|RD_G0|ASI(~0),	"[1+2]", F_ALIAS, v9 },
-{ "clrx",	F3(3, 0x0e, 0), F3(~3, ~0x0e, ~0)|RD_G0|ASI_RS2(~0),	"[1]", F_ALIAS, v9 }, /* stx %g0,[rs1+%g0] */
-{ "clrx",	F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|RD_G0,		"[1+i]", F_ALIAS, v9 },
-{ "clrx",	F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|RD_G0,		"[i+1]", F_ALIAS, v9 },
-{ "clrx",	F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|RD_G0|RS1_G0,		"[i]", F_ALIAS, v9 },
-{ "clrx",	F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|RD_G0|SIMM13(~0),	"[1]", F_ALIAS, v9 }, /* stx %g0,[rs1+0] */
-
-{ "orcc",	F3(2, 0x12, 0), F3(~2, ~0x12, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "orcc",	F3(2, 0x12, 1), F3(~2, ~0x12, ~1),		"1,i,d", 0, v6 },
-{ "orcc",	F3(2, 0x12, 1), F3(~2, ~0x12, ~1),		"i,1,d", 0, v6 },
+{ "iflush",     F3(2, 0x3b, 0), F3(~2, ~0x3b, ~0)|ASI(~0),      "1+2", F_ALIAS, v6 },
+{ "iflush",     F3(2, 0x3b, 0), F3(~2, ~0x3b, ~0)|ASI_RS2(~0),  "1", F_ALIAS, v6 }, /* flush rs1+%g0 */
+{ "iflush",     F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1)|SIMM13(~0),   "1", F_ALIAS, v6 }, /* flush rs1+0 */
+{ "iflush",     F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1)|RS1_G0,       "i", F_ALIAS, v6 },
+{ "iflush",     F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1),              "1+i", F_ALIAS, v6 },
+{ "iflush",     F3(2, 0x3b, 1), F3(~2, ~0x3b, ~1),              "i+1", F_ALIAS, v6 },
+
+{ "return",     F3(2, 0x39, 0), F3(~2, ~0x39, ~0)|ASI(~0),      "1+2", 0, v9 },
+{ "return",     F3(2, 0x39, 0), F3(~2, ~0x39, ~0)|ASI_RS2(~0),  "1", 0, v9 }, /* return rs1+%g0 */
+{ "return",     F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|SIMM13(~0),   "1", 0, v9 }, /* return rs1+0 */
+{ "return",     F3(2, 0x39, 1), F3(~2, ~0x39, ~1)|RS1_G0,       "i", 0, v9 }, /* return %g0+i */
+{ "return",     F3(2, 0x39, 1), F3(~2, ~0x39, ~1),              "1+i", 0, v9 },
+{ "return",     F3(2, 0x39, 1), F3(~2, ~0x39, ~1),              "i+1", 0, v9 },
+
+{ "flushw",     F3(2, 0x2b, 0), F3(~2, ~0x2b, ~0)|RD_G0|RS1_G0|ASI_RS2(~0),     "", 0, v9 },
+
+{ "membar",     F3(2, 0x28, 1)|RS1(0xf), F3(~2, ~0x28, ~1)|RD_G0|RS1(~0xf)|SIMM13(~127), "K", 0, v9 },
+{ "stbar",      F3(2, 0x28, 0)|RS1(0xf), F3(~2, ~0x28, ~0)|RD_G0|RS1(~0xf)|SIMM13(~0), "", 0, v8 },
+
+{ "prefetch",   F3(3, 0x2d, 0), F3(~3, ~0x2d, ~0),              "[1+2],*", 0, v9 },
+{ "prefetch",   F3(3, 0x2d, 0), F3(~3, ~0x2d, ~0)|RS2_G0,       "[1],*", 0, v9 }, /* prefetch [rs1+%g0],prefetch_fcn */
+{ "prefetch",   F3(3, 0x2d, 1), F3(~3, ~0x2d, ~1),              "[1+i],*", 0, v9 },
+{ "prefetch",   F3(3, 0x2d, 1), F3(~3, ~0x2d, ~1),              "[i+1],*", 0, v9 },
+{ "prefetch",   F3(3, 0x2d, 1), F3(~3, ~0x2d, ~1)|RS1_G0,       "[i],*", 0, v9 },
+{ "prefetch",   F3(3, 0x2d, 1), F3(~3, ~0x2d, ~1)|SIMM13(~0),   "[1],*", 0, v9 }, /* prefetch [rs1+0],prefetch_fcn */
+{ "prefetcha",  F3(3, 0x3d, 0), F3(~3, ~0x3d, ~0),              "[1+2]A,*", 0, v9 },
+{ "prefetcha",  F3(3, 0x3d, 0), F3(~3, ~0x3d, ~0)|RS2_G0,       "[1]A,*", 0, v9 }, /* prefetcha [rs1+%g0],prefetch_fcn */
+{ "prefetcha",  F3(3, 0x3d, 1), F3(~3, ~0x3d, ~1),              "[1+i]o,*", 0, v9 },
+{ "prefetcha",  F3(3, 0x3d, 1), F3(~3, ~0x3d, ~1),              "[i+1]o,*", 0, v9 },
+{ "prefetcha",  F3(3, 0x3d, 1), F3(~3, ~0x3d, ~1)|RS1_G0,       "[i]o,*", 0, v9 },
+{ "prefetcha",  F3(3, 0x3d, 1), F3(~3, ~0x3d, ~1)|SIMM13(~0),   "[1]o,*", 0, v9 }, /* prefetcha [rs1+0],d */
+
+{ "sll",        F3(2, 0x25, 0), F3(~2, ~0x25, ~0)|(1<<12)|(0x7f<<5),    "1,2,d", 0, v6 },
+{ "sll",        F3(2, 0x25, 1), F3(~2, ~0x25, ~1)|(1<<12)|(0x7f<<5),    "1,X,d", 0, v6 },
+{ "sra",        F3(2, 0x27, 0), F3(~2, ~0x27, ~0)|(1<<12)|(0x7f<<5),    "1,2,d", 0, v6 },
+{ "sra",        F3(2, 0x27, 1), F3(~2, ~0x27, ~1)|(1<<12)|(0x7f<<5),    "1,X,d", 0, v6 },
+{ "srl",        F3(2, 0x26, 0), F3(~2, ~0x26, ~0)|(1<<12)|(0x7f<<5),    "1,2,d", 0, v6 },
+{ "srl",        F3(2, 0x26, 1), F3(~2, ~0x26, ~1)|(1<<12)|(0x7f<<5),    "1,X,d", 0, v6 },
+
+{ "sllx",       F3(2, 0x25, 0)|(1<<12), F3(~2, ~0x25, ~0)|(0x7f<<5),    "1,2,d", 0, v9 },
+{ "sllx",       F3(2, 0x25, 1)|(1<<12), F3(~2, ~0x25, ~1)|(0x3f<<6),    "1,Y,d", 0, v9 },
+{ "srax",       F3(2, 0x27, 0)|(1<<12), F3(~2, ~0x27, ~0)|(0x7f<<5),    "1,2,d", 0, v9 },
+{ "srax",       F3(2, 0x27, 1)|(1<<12), F3(~2, ~0x27, ~1)|(0x3f<<6),    "1,Y,d", 0, v9 },
+{ "srlx",       F3(2, 0x26, 0)|(1<<12), F3(~2, ~0x26, ~0)|(0x7f<<5),    "1,2,d", 0, v9 },
+{ "srlx",       F3(2, 0x26, 1)|(1<<12), F3(~2, ~0x26, ~1)|(0x3f<<6),    "1,Y,d", 0, v9 },
+
+{ "mulscc",     F3(2, 0x24, 0), F3(~2, ~0x24, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "mulscc",     F3(2, 0x24, 1), F3(~2, ~0x24, ~1),              "1,i,d", 0, v6 },
+
+{ "divscc",     F3(2, 0x1d, 0), F3(~2, ~0x1d, ~0)|ASI(~0),      "1,2,d", 0, sparclite },
+{ "divscc",     F3(2, 0x1d, 1), F3(~2, ~0x1d, ~1),              "1,i,d", 0, sparclite },
+
+{ "scan",       F3(2, 0x2c, 0), F3(~2, ~0x2c, ~0)|ASI(~0),      "1,2,d", 0, sparclet|sparclite },
+{ "scan",       F3(2, 0x2c, 1), F3(~2, ~0x2c, ~1),              "1,i,d", 0, sparclet|sparclite },
+
+{ "popc",       F3(2, 0x2e, 0), F3(~2, ~0x2e, ~0)|RS1_G0|ASI(~0),"2,d", 0, v9 },
+{ "popc",       F3(2, 0x2e, 1), F3(~2, ~0x2e, ~1)|RS1_G0,       "i,d", 0, v9 },
+
+{ "clr",        F3(2, 0x02, 0), F3(~2, ~0x02, ~0)|RD_G0|RS1_G0|ASI_RS2(~0),     "d", F_ALIAS, v6 }, /* or %g0,%g0,d */
+{ "clr",        F3(2, 0x02, 1), F3(~2, ~0x02, ~1)|RS1_G0|SIMM13(~0),            "d", F_ALIAS, v6 }, /* or %g0,0,d       */
+{ "clr",        F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|RD_G0|ASI(~0),                "[1+2]", F_ALIAS, v6 },
+{ "clr",        F3(3, 0x04, 0), F3(~3, ~0x04, ~0)|RD_G0|ASI_RS2(~0),            "[1]", F_ALIAS, v6 }, /* st %g0,[rs1+%g0] */
+{ "clr",        F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RD_G0,                        "[1+i]", F_ALIAS, v6 },
+{ "clr",        F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RD_G0,                        "[i+1]", F_ALIAS, v6 },
+{ "clr",        F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RD_G0|RS1_G0,                 "[i]", F_ALIAS, v6 },
+{ "clr",        F3(3, 0x04, 1), F3(~3, ~0x04, ~1)|RD_G0|SIMM13(~0),             "[1]", F_ALIAS, v6 }, /* st %g0,[rs1+0] */
+
+{ "clrb",       F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|RD_G0|ASI(~0),        "[1+2]", F_ALIAS, v6 },
+{ "clrb",       F3(3, 0x05, 0), F3(~3, ~0x05, ~0)|RD_G0|ASI_RS2(~0),    "[1]", F_ALIAS, v6 }, /* stb %g0,[rs1+%g0] */
+{ "clrb",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RD_G0,                "[1+i]", F_ALIAS, v6 },
+{ "clrb",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RD_G0,                "[i+1]", F_ALIAS, v6 },
+{ "clrb",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RD_G0|RS1_G0,         "[i]", F_ALIAS, v6 },
+{ "clrb",       F3(3, 0x05, 1), F3(~3, ~0x05, ~1)|RD_G0|SIMM13(~0),     "[1]", F_ALIAS, v6 }, /* stb %g0,[rs1+0] */
+
+{ "clrh",       F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|RD_G0|ASI(~0),        "[1+2]", F_ALIAS, v6 },
+{ "clrh",       F3(3, 0x06, 0), F3(~3, ~0x06, ~0)|RD_G0|ASI_RS2(~0),    "[1]", F_ALIAS, v6 }, /* sth %g0,[rs1+%g0] */
+{ "clrh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RD_G0,                "[1+i]", F_ALIAS, v6 },
+{ "clrh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RD_G0,                "[i+1]", F_ALIAS, v6 },
+{ "clrh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RD_G0|RS1_G0,         "[i]", F_ALIAS, v6 },
+{ "clrh",       F3(3, 0x06, 1), F3(~3, ~0x06, ~1)|RD_G0|SIMM13(~0),     "[1]", F_ALIAS, v6 }, /* sth %g0,[rs1+0] */
+
+{ "clrx",       F3(3, 0x0e, 0), F3(~3, ~0x0e, ~0)|RD_G0|ASI(~0),        "[1+2]", F_ALIAS, v9 },
+{ "clrx",       F3(3, 0x0e, 0), F3(~3, ~0x0e, ~0)|RD_G0|ASI_RS2(~0),    "[1]", F_ALIAS, v9 }, /* stx %g0,[rs1+%g0] */
+{ "clrx",       F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|RD_G0,                "[1+i]", F_ALIAS, v9 },
+{ "clrx",       F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|RD_G0,                "[i+1]", F_ALIAS, v9 },
+{ "clrx",       F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|RD_G0|RS1_G0,         "[i]", F_ALIAS, v9 },
+{ "clrx",       F3(3, 0x0e, 1), F3(~3, ~0x0e, ~1)|RD_G0|SIMM13(~0),     "[1]", F_ALIAS, v9 }, /* stx %g0,[rs1+0] */
+
+{ "orcc",       F3(2, 0x12, 0), F3(~2, ~0x12, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "orcc",       F3(2, 0x12, 1), F3(~2, ~0x12, ~1),              "1,i,d", 0, v6 },
+{ "orcc",       F3(2, 0x12, 1), F3(~2, ~0x12, ~1),              "i,1,d", 0, v6 },
 
 /* This is not a commutative instruction.  */
-{ "orncc",	F3(2, 0x16, 0), F3(~2, ~0x16, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "orncc",	F3(2, 0x16, 1), F3(~2, ~0x16, ~1),		"1,i,d", 0, v6 },
+{ "orncc",      F3(2, 0x16, 0), F3(~2, ~0x16, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "orncc",      F3(2, 0x16, 1), F3(~2, ~0x16, ~1),              "1,i,d", 0, v6 },
 
 /* This is not a commutative instruction.  */
-{ "orn",	F3(2, 0x06, 0), F3(~2, ~0x06, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "orn",	F3(2, 0x06, 1), F3(~2, ~0x06, ~1),		"1,i,d", 0, v6 },
-
-{ "tst",	F3(2, 0x12, 0), F3(~2, ~0x12, ~0)|RD_G0|ASI_RS2(~0),	"1", 0, v6 }, /* orcc rs1, %g0, %g0 */
-{ "tst",	F3(2, 0x12, 0), F3(~2, ~0x12, ~0)|RD_G0|RS1_G0|ASI(~0),	"2", 0, v6 }, /* orcc %g0, rs2, %g0 */
-{ "tst",	F3(2, 0x12, 1), F3(~2, ~0x12, ~1)|RD_G0|SIMM13(~0),	"1", 0, v6 }, /* orcc rs1, 0, %g0 */
-
-{ "wr",	F3(2, 0x30, 0),		F3(~2, ~0x30, ~0)|ASI(~0),		"1,2,m", 0, v8 }, /* wr r,r,%asrX */
-{ "wr",	F3(2, 0x30, 1),		F3(~2, ~0x30, ~1),			"1,i,m", 0, v8 }, /* wr r,i,%asrX */
-{ "wr",	F3(2, 0x30, 0),		F3(~2, ~0x30, ~0)|ASI_RS2(~0),		"1,m", F_ALIAS, v8 }, /* wr rs1,%g0,%asrX */
-{ "wr",	F3(2, 0x30, 0),		F3(~2, ~0x30, ~0)|RD_G0|ASI(~0),	"1,2,y", 0, v6 }, /* wr r,r,%y */
-{ "wr",	F3(2, 0x30, 1),		F3(~2, ~0x30, ~1)|RD_G0,		"1,i,y", 0, v6 }, /* wr r,i,%y */
-{ "wr",	F3(2, 0x30, 0),		F3(~2, ~0x30, ~0)|RD_G0|ASI_RS2(~0),	"1,y", F_ALIAS, v6 }, /* wr rs1,%g0,%y */
-{ "wr",	F3(2, 0x31, 0),		F3(~2, ~0x31, ~0)|RD_G0|ASI(~0),	"1,2,p", 0, v6notv9 }, /* wr r,r,%psr */
-{ "wr",	F3(2, 0x31, 1),		F3(~2, ~0x31, ~1)|RD_G0,		"1,i,p", 0, v6notv9 }, /* wr r,i,%psr */
-{ "wr",	F3(2, 0x31, 0),		F3(~2, ~0x31, ~0)|RD_G0|ASI_RS2(~0),	"1,p", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%psr */
-{ "wr",	F3(2, 0x32, 0),		F3(~2, ~0x32, ~0)|RD_G0|ASI(~0),	"1,2,w", 0, v6notv9 }, /* wr r,r,%wim */
-{ "wr",	F3(2, 0x32, 1),		F3(~2, ~0x32, ~1)|RD_G0,		"1,i,w", 0, v6notv9 }, /* wr r,i,%wim */
-{ "wr",	F3(2, 0x32, 0),		F3(~2, ~0x32, ~0)|RD_G0|ASI_RS2(~0),	"1,w", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%wim */
-{ "wr",	F3(2, 0x33, 0),		F3(~2, ~0x33, ~0)|RD_G0|ASI(~0),	"1,2,t", 0, v6notv9 }, /* wr r,r,%tbr */
-{ "wr",	F3(2, 0x33, 1),		F3(~2, ~0x33, ~1)|RD_G0,		"1,i,t", 0, v6notv9 }, /* wr r,i,%tbr */
-{ "wr",	F3(2, 0x33, 0),		F3(~2, ~0x33, ~0)|RD_G0|ASI_RS2(~0),	"1,t", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%tbr */
-
-{ "wr", F3(2, 0x30, 0)|RD(2),	F3(~2, ~0x30, ~0)|RD(~2)|ASI(~0),	"1,2,E", 0, v9 }, /* wr r,r,%ccr */
-{ "wr", F3(2, 0x30, 1)|RD(2),	F3(~2, ~0x30, ~1)|RD(~2),		"1,i,E", 0, v9 }, /* wr r,i,%ccr */
-{ "wr", F3(2, 0x30, 0)|RD(3),	F3(~2, ~0x30, ~0)|RD(~3)|ASI(~0),	"1,2,o", 0, v9 }, /* wr r,r,%asi */
-{ "wr", F3(2, 0x30, 1)|RD(3),	F3(~2, ~0x30, ~1)|RD(~3),		"1,i,o", 0, v9 }, /* wr r,i,%asi */
-{ "wr", F3(2, 0x30, 0)|RD(6),	F3(~2, ~0x30, ~0)|RD(~6)|ASI(~0),	"1,2,s", 0, v9 }, /* wr r,r,%fprs */
-{ "wr", F3(2, 0x30, 1)|RD(6),	F3(~2, ~0x30, ~1)|RD(~6),		"1,i,s", 0, v9 }, /* wr r,i,%fprs */
-
-{ "wr", F3(2, 0x30, 0)|RD(16),	F3(~2, ~0x30, ~0)|RD(~16)|ASI(~0),	"1,2,_", 0, v9a }, /* wr r,r,%pcr */
-{ "wr", F3(2, 0x30, 1)|RD(16),	F3(~2, ~0x30, ~1)|RD(~16),		"1,i,_", 0, v9a }, /* wr r,i,%pcr */
-{ "wr", F3(2, 0x30, 0)|RD(17),	F3(~2, ~0x30, ~0)|RD(~17)|ASI(~0),	"1,2,_", 0, v9a }, /* wr r,r,%pic */
-{ "wr", F3(2, 0x30, 1)|RD(17),	F3(~2, ~0x30, ~1)|RD(~17),		"1,i,_", 0, v9a }, /* wr r,i,%pic */
-{ "wr", F3(2, 0x30, 0)|RD(18),	F3(~2, ~0x30, ~0)|RD(~18)|ASI(~0),	"1,2,_", 0, v9a }, /* wr r,r,%dcr */
-{ "wr", F3(2, 0x30, 1)|RD(18),	F3(~2, ~0x30, ~1)|RD(~18),		"1,i,_", 0, v9a }, /* wr r,i,%dcr */
-{ "wr", F3(2, 0x30, 0)|RD(19),	F3(~2, ~0x30, ~0)|RD(~19)|ASI(~0),	"1,2,_", 0, v9a }, /* wr r,r,%gsr */
-{ "wr", F3(2, 0x30, 1)|RD(19),	F3(~2, ~0x30, ~1)|RD(~19),		"1,i,_", 0, v9a }, /* wr r,i,%gsr */
-{ "wr", F3(2, 0x30, 0)|RD(20),	F3(~2, ~0x30, ~0)|RD(~20)|ASI(~0),	"1,2,_", 0, v9a }, /* wr r,r,%set_softint */
-{ "wr", F3(2, 0x30, 1)|RD(20),	F3(~2, ~0x30, ~1)|RD(~20),		"1,i,_", 0, v9a }, /* wr r,i,%set_softint */
-{ "wr", F3(2, 0x30, 0)|RD(21),	F3(~2, ~0x30, ~0)|RD(~21)|ASI(~0),	"1,2,_", 0, v9a }, /* wr r,r,%clear_softint */
-{ "wr", F3(2, 0x30, 1)|RD(21),	F3(~2, ~0x30, ~1)|RD(~21),		"1,i,_", 0, v9a }, /* wr r,i,%clear_softint */
-{ "wr", F3(2, 0x30, 0)|RD(22),	F3(~2, ~0x30, ~0)|RD(~22)|ASI(~0),	"1,2,_", 0, v9a }, /* wr r,r,%softint */
-{ "wr", F3(2, 0x30, 1)|RD(22),	F3(~2, ~0x30, ~1)|RD(~22),		"1,i,_", 0, v9a }, /* wr r,i,%softint */
-{ "wr", F3(2, 0x30, 0)|RD(23),	F3(~2, ~0x30, ~0)|RD(~23)|ASI(~0),	"1,2,_", 0, v9a }, /* wr r,r,%tick_cmpr */
-{ "wr", F3(2, 0x30, 1)|RD(23),	F3(~2, ~0x30, ~1)|RD(~23),		"1,i,_", 0, v9a }, /* wr r,i,%tick_cmpr */
-{ "wr", F3(2, 0x30, 0)|RD(24),	F3(~2, ~0x30, ~0)|RD(~24)|ASI(~0),	"1,2,_", 0, v9b }, /* wr r,r,%sys_tick */
-{ "wr", F3(2, 0x30, 1)|RD(24),	F3(~2, ~0x30, ~1)|RD(~24),		"1,i,_", 0, v9b }, /* wr r,i,%sys_tick */
-{ "wr", F3(2, 0x30, 0)|RD(25),	F3(~2, ~0x30, ~0)|RD(~25)|ASI(~0),	"1,2,_", 0, v9b }, /* wr r,r,%sys_tick_cmpr */
-{ "wr", F3(2, 0x30, 1)|RD(25),	F3(~2, ~0x30, ~1)|RD(~25),		"1,i,_", 0, v9b }, /* wr r,i,%sys_tick_cmpr */
-
-{ "rd",	F3(2, 0x28, 0),			F3(~2, ~0x28, ~0)|SIMM13(~0),		"M,d", 0, v8 }, /* rd %asrX,r */
-{ "rd",	F3(2, 0x28, 0),			F3(~2, ~0x28, ~0)|RS1_G0|SIMM13(~0),	"y,d", 0, v6 }, /* rd %y,r */
-{ "rd",	F3(2, 0x29, 0),			F3(~2, ~0x29, ~0)|RS1_G0|SIMM13(~0),	"p,d", 0, v6notv9 }, /* rd %psr,r */
-{ "rd",	F3(2, 0x2a, 0),			F3(~2, ~0x2a, ~0)|RS1_G0|SIMM13(~0),	"w,d", 0, v6notv9 }, /* rd %wim,r */
-{ "rd",	F3(2, 0x2b, 0),			F3(~2, ~0x2b, ~0)|RS1_G0|SIMM13(~0),	"t,d", 0, v6notv9 }, /* rd %tbr,r */
-
-{ "rd",	F3(2, 0x28, 0)|RS1(2),		F3(~2, ~0x28, ~0)|RS1(~2)|SIMM13(~0),	"E,d", 0, v9 }, /* rd %ccr,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(3),		F3(~2, ~0x28, ~0)|RS1(~3)|SIMM13(~0),	"o,d", 0, v9 }, /* rd %asi,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(4),		F3(~2, ~0x28, ~0)|RS1(~4)|SIMM13(~0),	"W,d", 0, v9 }, /* rd %tick,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(5),		F3(~2, ~0x28, ~0)|RS1(~5)|SIMM13(~0),	"P,d", 0, v9 }, /* rd %pc,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(6),		F3(~2, ~0x28, ~0)|RS1(~6)|SIMM13(~0),	"s,d", 0, v9 }, /* rd %fprs,r */
-
-{ "rd",	F3(2, 0x28, 0)|RS1(16),		F3(~2, ~0x28, ~0)|RS1(~16)|SIMM13(~0),	"/,d", 0, v9a }, /* rd %pcr,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(17),		F3(~2, ~0x28, ~0)|RS1(~17)|SIMM13(~0),	"/,d", 0, v9a }, /* rd %pic,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(18),		F3(~2, ~0x28, ~0)|RS1(~18)|SIMM13(~0),	"/,d", 0, v9a }, /* rd %dcr,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(19),		F3(~2, ~0x28, ~0)|RS1(~19)|SIMM13(~0),	"/,d", 0, v9a }, /* rd %gsr,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(22),		F3(~2, ~0x28, ~0)|RS1(~22)|SIMM13(~0),	"/,d", 0, v9a }, /* rd %softint,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(23),		F3(~2, ~0x28, ~0)|RS1(~23)|SIMM13(~0),	"/,d", 0, v9a }, /* rd %tick_cmpr,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(24),		F3(~2, ~0x28, ~0)|RS1(~24)|SIMM13(~0),	"/,d", 0, v9b }, /* rd %sys_tick,r */
-{ "rd",	F3(2, 0x28, 0)|RS1(25),		F3(~2, ~0x28, ~0)|RS1(~25)|SIMM13(~0),	"/,d", 0, v9b }, /* rd %sys_tick_cmpr,r */
-
-{ "rdpr",	F3(2, 0x2a, 0),		F3(~2, ~0x2a, ~0)|SIMM13(~0),	"?,d", 0, v9 },   /* rdpr %priv,r */
-{ "wrpr",	F3(2, 0x32, 0),		F3(~2, ~0x32, ~0),		"1,2,!", 0, v9 }, /* wrpr r1,r2,%priv */
-{ "wrpr",	F3(2, 0x32, 0),		F3(~2, ~0x32, ~0)|SIMM13(~0),	"1,!", 0, v9 },   /* wrpr r1,%priv */
-{ "wrpr",	F3(2, 0x32, 1),		F3(~2, ~0x32, ~1),		"1,i,!", 0, v9 }, /* wrpr r1,i,%priv */
-{ "wrpr",	F3(2, 0x32, 1),		F3(~2, ~0x32, ~1),		"i,1,!", F_ALIAS, v9 }, /* wrpr i,r1,%priv */
-{ "wrpr",	F3(2, 0x32, 1),		F3(~2, ~0x32, ~1)|RS1(~0),	"i,!", 0, v9 },   /* wrpr i,%priv */
+{ "orn",        F3(2, 0x06, 0), F3(~2, ~0x06, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "orn",        F3(2, 0x06, 1), F3(~2, ~0x06, ~1),              "1,i,d", 0, v6 },
+
+{ "tst",        F3(2, 0x12, 0), F3(~2, ~0x12, ~0)|RD_G0|ASI_RS2(~0),    "1", 0, v6 }, /* orcc rs1, %g0, %g0 */
+{ "tst",        F3(2, 0x12, 0), F3(~2, ~0x12, ~0)|RD_G0|RS1_G0|ASI(~0), "2", 0, v6 }, /* orcc %g0, rs2, %g0 */
+{ "tst",        F3(2, 0x12, 1), F3(~2, ~0x12, ~1)|RD_G0|SIMM13(~0),     "1", 0, v6 }, /* orcc rs1, 0, %g0 */
+
+{ "wr", F3(2, 0x30, 0),         F3(~2, ~0x30, ~0)|ASI(~0),              "1,2,m", 0, v8 }, /* wr r,r,%asrX */
+{ "wr", F3(2, 0x30, 1),         F3(~2, ~0x30, ~1),                      "1,i,m", 0, v8 }, /* wr r,i,%asrX */
+{ "wr", F3(2, 0x30, 0),         F3(~2, ~0x30, ~0)|ASI_RS2(~0),          "1,m", F_ALIAS, v8 }, /* wr rs1,%g0,%asrX */
+{ "wr", F3(2, 0x30, 0),         F3(~2, ~0x30, ~0)|RD_G0|ASI(~0),        "1,2,y", 0, v6 }, /* wr r,r,%y */
+{ "wr", F3(2, 0x30, 1),         F3(~2, ~0x30, ~1)|RD_G0,                "1,i,y", 0, v6 }, /* wr r,i,%y */
+{ "wr", F3(2, 0x30, 0),         F3(~2, ~0x30, ~0)|RD_G0|ASI_RS2(~0),    "1,y", F_ALIAS, v6 }, /* wr rs1,%g0,%y */
+{ "wr", F3(2, 0x31, 0),         F3(~2, ~0x31, ~0)|RD_G0|ASI(~0),        "1,2,p", 0, v6notv9 }, /* wr r,r,%psr */
+{ "wr", F3(2, 0x31, 1),         F3(~2, ~0x31, ~1)|RD_G0,                "1,i,p", 0, v6notv9 }, /* wr r,i,%psr */
+{ "wr", F3(2, 0x31, 0),         F3(~2, ~0x31, ~0)|RD_G0|ASI_RS2(~0),    "1,p", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%psr */
+{ "wr", F3(2, 0x32, 0),         F3(~2, ~0x32, ~0)|RD_G0|ASI(~0),        "1,2,w", 0, v6notv9 }, /* wr r,r,%wim */
+{ "wr", F3(2, 0x32, 1),         F3(~2, ~0x32, ~1)|RD_G0,                "1,i,w", 0, v6notv9 }, /* wr r,i,%wim */
+{ "wr", F3(2, 0x32, 0),         F3(~2, ~0x32, ~0)|RD_G0|ASI_RS2(~0),    "1,w", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%wim */
+{ "wr", F3(2, 0x33, 0),         F3(~2, ~0x33, ~0)|RD_G0|ASI(~0),        "1,2,t", 0, v6notv9 }, /* wr r,r,%tbr */
+{ "wr", F3(2, 0x33, 1),         F3(~2, ~0x33, ~1)|RD_G0,                "1,i,t", 0, v6notv9 }, /* wr r,i,%tbr */
+{ "wr", F3(2, 0x33, 0),         F3(~2, ~0x33, ~0)|RD_G0|ASI_RS2(~0),    "1,t", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%tbr */
+
+{ "wr", F3(2, 0x30, 0)|RD(2),   F3(~2, ~0x30, ~0)|RD(~2)|ASI(~0),       "1,2,E", 0, v9 }, /* wr r,r,%ccr */
+{ "wr", F3(2, 0x30, 1)|RD(2),   F3(~2, ~0x30, ~1)|RD(~2),               "1,i,E", 0, v9 }, /* wr r,i,%ccr */
+{ "wr", F3(2, 0x30, 0)|RD(3),   F3(~2, ~0x30, ~0)|RD(~3)|ASI(~0),       "1,2,o", 0, v9 }, /* wr r,r,%asi */
+{ "wr", F3(2, 0x30, 1)|RD(3),   F3(~2, ~0x30, ~1)|RD(~3),               "1,i,o", 0, v9 }, /* wr r,i,%asi */
+{ "wr", F3(2, 0x30, 0)|RD(6),   F3(~2, ~0x30, ~0)|RD(~6)|ASI(~0),       "1,2,s", 0, v9 }, /* wr r,r,%fprs */
+{ "wr", F3(2, 0x30, 1)|RD(6),   F3(~2, ~0x30, ~1)|RD(~6),               "1,i,s", 0, v9 }, /* wr r,i,%fprs */
+
+{ "wr", F3(2, 0x30, 0)|RD(16),  F3(~2, ~0x30, ~0)|RD(~16)|ASI(~0),      "1,2,_", 0, v9a }, /* wr r,r,%pcr */
+{ "wr", F3(2, 0x30, 1)|RD(16),  F3(~2, ~0x30, ~1)|RD(~16),              "1,i,_", 0, v9a }, /* wr r,i,%pcr */
+{ "wr", F3(2, 0x30, 0)|RD(17),  F3(~2, ~0x30, ~0)|RD(~17)|ASI(~0),      "1,2,_", 0, v9a }, /* wr r,r,%pic */
+{ "wr", F3(2, 0x30, 1)|RD(17),  F3(~2, ~0x30, ~1)|RD(~17),              "1,i,_", 0, v9a }, /* wr r,i,%pic */
+{ "wr", F3(2, 0x30, 0)|RD(18),  F3(~2, ~0x30, ~0)|RD(~18)|ASI(~0),      "1,2,_", 0, v9a }, /* wr r,r,%dcr */
+{ "wr", F3(2, 0x30, 1)|RD(18),  F3(~2, ~0x30, ~1)|RD(~18),              "1,i,_", 0, v9a }, /* wr r,i,%dcr */
+{ "wr", F3(2, 0x30, 0)|RD(19),  F3(~2, ~0x30, ~0)|RD(~19)|ASI(~0),      "1,2,_", 0, v9a }, /* wr r,r,%gsr */
+{ "wr", F3(2, 0x30, 1)|RD(19),  F3(~2, ~0x30, ~1)|RD(~19),              "1,i,_", 0, v9a }, /* wr r,i,%gsr */
+{ "wr", F3(2, 0x30, 0)|RD(20),  F3(~2, ~0x30, ~0)|RD(~20)|ASI(~0),      "1,2,_", 0, v9a }, /* wr r,r,%set_softint */
+{ "wr", F3(2, 0x30, 1)|RD(20),  F3(~2, ~0x30, ~1)|RD(~20),              "1,i,_", 0, v9a }, /* wr r,i,%set_softint */
+{ "wr", F3(2, 0x30, 0)|RD(21),  F3(~2, ~0x30, ~0)|RD(~21)|ASI(~0),      "1,2,_", 0, v9a }, /* wr r,r,%clear_softint */
+{ "wr", F3(2, 0x30, 1)|RD(21),  F3(~2, ~0x30, ~1)|RD(~21),              "1,i,_", 0, v9a }, /* wr r,i,%clear_softint */
+{ "wr", F3(2, 0x30, 0)|RD(22),  F3(~2, ~0x30, ~0)|RD(~22)|ASI(~0),      "1,2,_", 0, v9a }, /* wr r,r,%softint */
+{ "wr", F3(2, 0x30, 1)|RD(22),  F3(~2, ~0x30, ~1)|RD(~22),              "1,i,_", 0, v9a }, /* wr r,i,%softint */
+{ "wr", F3(2, 0x30, 0)|RD(23),  F3(~2, ~0x30, ~0)|RD(~23)|ASI(~0),      "1,2,_", 0, v9a }, /* wr r,r,%tick_cmpr */
+{ "wr", F3(2, 0x30, 1)|RD(23),  F3(~2, ~0x30, ~1)|RD(~23),              "1,i,_", 0, v9a }, /* wr r,i,%tick_cmpr */
+{ "wr", F3(2, 0x30, 0)|RD(24),  F3(~2, ~0x30, ~0)|RD(~24)|ASI(~0),      "1,2,_", 0, v9b }, /* wr r,r,%sys_tick */
+{ "wr", F3(2, 0x30, 1)|RD(24),  F3(~2, ~0x30, ~1)|RD(~24),              "1,i,_", 0, v9b }, /* wr r,i,%sys_tick */
+{ "wr", F3(2, 0x30, 0)|RD(25),  F3(~2, ~0x30, ~0)|RD(~25)|ASI(~0),      "1,2,_", 0, v9b }, /* wr r,r,%sys_tick_cmpr */
+{ "wr", F3(2, 0x30, 1)|RD(25),  F3(~2, ~0x30, ~1)|RD(~25),              "1,i,_", 0, v9b }, /* wr r,i,%sys_tick_cmpr */
+
+{ "rd", F3(2, 0x28, 0),                 F3(~2, ~0x28, ~0)|SIMM13(~0),           "M,d", 0, v8 }, /* rd %asrX,r */
+{ "rd", F3(2, 0x28, 0),                 F3(~2, ~0x28, ~0)|RS1_G0|SIMM13(~0),    "y,d", 0, v6 }, /* rd %y,r */
+{ "rd", F3(2, 0x29, 0),                 F3(~2, ~0x29, ~0)|RS1_G0|SIMM13(~0),    "p,d", 0, v6notv9 }, /* rd %psr,r */
+{ "rd", F3(2, 0x2a, 0),                 F3(~2, ~0x2a, ~0)|RS1_G0|SIMM13(~0),    "w,d", 0, v6notv9 }, /* rd %wim,r */
+{ "rd", F3(2, 0x2b, 0),                 F3(~2, ~0x2b, ~0)|RS1_G0|SIMM13(~0),    "t,d", 0, v6notv9 }, /* rd %tbr,r */
+
+{ "rd", F3(2, 0x28, 0)|RS1(2),          F3(~2, ~0x28, ~0)|RS1(~2)|SIMM13(~0),   "E,d", 0, v9 }, /* rd %ccr,r */
+{ "rd", F3(2, 0x28, 0)|RS1(3),          F3(~2, ~0x28, ~0)|RS1(~3)|SIMM13(~0),   "o,d", 0, v9 }, /* rd %asi,r */
+{ "rd", F3(2, 0x28, 0)|RS1(4),          F3(~2, ~0x28, ~0)|RS1(~4)|SIMM13(~0),   "W,d", 0, v9 }, /* rd %tick,r */
+{ "rd", F3(2, 0x28, 0)|RS1(5),          F3(~2, ~0x28, ~0)|RS1(~5)|SIMM13(~0),   "P,d", 0, v9 }, /* rd %pc,r */
+{ "rd", F3(2, 0x28, 0)|RS1(6),          F3(~2, ~0x28, ~0)|RS1(~6)|SIMM13(~0),   "s,d", 0, v9 }, /* rd %fprs,r */
+
+{ "rd", F3(2, 0x28, 0)|RS1(16),         F3(~2, ~0x28, ~0)|RS1(~16)|SIMM13(~0),  "/,d", 0, v9a }, /* rd %pcr,r */
+{ "rd", F3(2, 0x28, 0)|RS1(17),         F3(~2, ~0x28, ~0)|RS1(~17)|SIMM13(~0),  "/,d", 0, v9a }, /* rd %pic,r */
+{ "rd", F3(2, 0x28, 0)|RS1(18),         F3(~2, ~0x28, ~0)|RS1(~18)|SIMM13(~0),  "/,d", 0, v9a }, /* rd %dcr,r */
+{ "rd", F3(2, 0x28, 0)|RS1(19),         F3(~2, ~0x28, ~0)|RS1(~19)|SIMM13(~0),  "/,d", 0, v9a }, /* rd %gsr,r */
+{ "rd", F3(2, 0x28, 0)|RS1(22),         F3(~2, ~0x28, ~0)|RS1(~22)|SIMM13(~0),  "/,d", 0, v9a }, /* rd %softint,r */
+{ "rd", F3(2, 0x28, 0)|RS1(23),         F3(~2, ~0x28, ~0)|RS1(~23)|SIMM13(~0),  "/,d", 0, v9a }, /* rd %tick_cmpr,r */
+{ "rd", F3(2, 0x28, 0)|RS1(24),         F3(~2, ~0x28, ~0)|RS1(~24)|SIMM13(~0),  "/,d", 0, v9b }, /* rd %sys_tick,r */
+{ "rd", F3(2, 0x28, 0)|RS1(25),         F3(~2, ~0x28, ~0)|RS1(~25)|SIMM13(~0),  "/,d", 0, v9b }, /* rd %sys_tick_cmpr,r */
+
+{ "rdpr",       F3(2, 0x2a, 0),         F3(~2, ~0x2a, ~0)|SIMM13(~0),   "?,d", 0, v9 },   /* rdpr %priv,r */
+{ "wrpr",       F3(2, 0x32, 0),         F3(~2, ~0x32, ~0),              "1,2,!", 0, v9 }, /* wrpr r1,r2,%priv */
+{ "wrpr",       F3(2, 0x32, 0),         F3(~2, ~0x32, ~0)|SIMM13(~0),   "1,!", 0, v9 },   /* wrpr r1,%priv */
+{ "wrpr",       F3(2, 0x32, 1),         F3(~2, ~0x32, ~1),              "1,i,!", 0, v9 }, /* wrpr r1,i,%priv */
+{ "wrpr",       F3(2, 0x32, 1),         F3(~2, ~0x32, ~1),              "i,1,!", F_ALIAS, v9 }, /* wrpr i,r1,%priv */
+{ "wrpr",       F3(2, 0x32, 1),         F3(~2, ~0x32, ~1)|RS1(~0),      "i,!", 0, v9 },   /* wrpr i,%priv */
 
 /* ??? This group seems wrong.  A three operand move?  */
-{ "mov",	F3(2, 0x30, 0), F3(~2, ~0x30, ~0)|ASI(~0),		"1,2,m", F_ALIAS, v8 }, /* wr r,r,%asrX */
-{ "mov",	F3(2, 0x30, 1), F3(~2, ~0x30, ~1),			"1,i,m", F_ALIAS, v8 }, /* wr r,i,%asrX */
-{ "mov",	F3(2, 0x30, 0), F3(~2, ~0x30, ~0)|RD_G0|ASI(~0),	"1,2,y", F_ALIAS, v6 }, /* wr r,r,%y */
-{ "mov",	F3(2, 0x30, 1), F3(~2, ~0x30, ~1)|RD_G0,		"1,i,y", F_ALIAS, v6 }, /* wr r,i,%y */
-{ "mov",	F3(2, 0x31, 0), F3(~2, ~0x31, ~0)|RD_G0|ASI(~0),	"1,2,p", F_ALIAS, v6notv9 }, /* wr r,r,%psr */
-{ "mov",	F3(2, 0x31, 1), F3(~2, ~0x31, ~1)|RD_G0,		"1,i,p", F_ALIAS, v6notv9 }, /* wr r,i,%psr */
-{ "mov",	F3(2, 0x32, 0), F3(~2, ~0x32, ~0)|RD_G0|ASI(~0),	"1,2,w", F_ALIAS, v6notv9 }, /* wr r,r,%wim */
-{ "mov",	F3(2, 0x32, 1), F3(~2, ~0x32, ~1)|RD_G0,		"1,i,w", F_ALIAS, v6notv9 }, /* wr r,i,%wim */
-{ "mov",	F3(2, 0x33, 0), F3(~2, ~0x33, ~0)|RD_G0|ASI(~0),	"1,2,t", F_ALIAS, v6notv9 }, /* wr r,r,%tbr */
-{ "mov",	F3(2, 0x33, 1), F3(~2, ~0x33, ~1)|RD_G0,		"1,i,t", F_ALIAS, v6notv9 }, /* wr r,i,%tbr */
-
-{ "mov",	F3(2, 0x28, 0), F3(~2, ~0x28, ~0)|SIMM13(~0),		"M,d", F_ALIAS, v8 }, /* rd %asr1,r */
-{ "mov",	F3(2, 0x28, 0), F3(~2, ~0x28, ~0)|RS1_G0|SIMM13(~0),	"y,d", F_ALIAS, v6 }, /* rd %y,r */
-{ "mov",	F3(2, 0x29, 0), F3(~2, ~0x29, ~0)|RS1_G0|SIMM13(~0),	"p,d", F_ALIAS, v6notv9 }, /* rd %psr,r */
-{ "mov",	F3(2, 0x2a, 0), F3(~2, ~0x2a, ~0)|RS1_G0|SIMM13(~0),	"w,d", F_ALIAS, v6notv9 }, /* rd %wim,r */
-{ "mov",	F3(2, 0x2b, 0), F3(~2, ~0x2b, ~0)|RS1_G0|SIMM13(~0),	"t,d", F_ALIAS, v6notv9 }, /* rd %tbr,r */
-
-{ "mov",	F3(2, 0x30, 0), F3(~2, ~0x30, ~0)|ASI_RS2(~0),		"1,m", F_ALIAS, v8 }, /* wr rs1,%g0,%asrX */
-{ "mov",	F3(2, 0x30, 1), F3(~2, ~0x30, ~1),			"i,m", F_ALIAS, v8 }, /* wr %g0,i,%asrX */
-{ "mov",	F3(2, 0x30, 1), F3(~2, ~0x30, ~1)|SIMM13(~0),		"1,m", F_ALIAS, v8 }, /* wr rs1,0,%asrX */
-{ "mov",	F3(2, 0x30, 0), F3(~2, ~0x30, ~0)|RD_G0|ASI_RS2(~0),	"1,y", F_ALIAS, v6 }, /* wr rs1,%g0,%y */
-{ "mov",	F3(2, 0x30, 1), F3(~2, ~0x30, ~1)|RD_G0,		"i,y", F_ALIAS, v6 }, /* wr %g0,i,%y */
-{ "mov",	F3(2, 0x30, 1), F3(~2, ~0x30, ~1)|RD_G0|SIMM13(~0),	"1,y", F_ALIAS, v6 }, /* wr rs1,0,%y */
-{ "mov",	F3(2, 0x31, 0), F3(~2, ~0x31, ~0)|RD_G0|ASI_RS2(~0),	"1,p", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%psr */
-{ "mov",	F3(2, 0x31, 1), F3(~2, ~0x31, ~1)|RD_G0,		"i,p", F_ALIAS, v6notv9 }, /* wr %g0,i,%psr */
-{ "mov",	F3(2, 0x31, 1), F3(~2, ~0x31, ~1)|RD_G0|SIMM13(~0),	"1,p", F_ALIAS, v6notv9 }, /* wr rs1,0,%psr */
-{ "mov",	F3(2, 0x32, 0), F3(~2, ~0x32, ~0)|RD_G0|ASI_RS2(~0),	"1,w", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%wim */
-{ "mov",	F3(2, 0x32, 1), F3(~2, ~0x32, ~1)|RD_G0,		"i,w", F_ALIAS, v6notv9 }, /* wr %g0,i,%wim */
-{ "mov",	F3(2, 0x32, 1), F3(~2, ~0x32, ~1)|RD_G0|SIMM13(~0),	"1,w", F_ALIAS, v6notv9 }, /* wr rs1,0,%wim */
-{ "mov",	F3(2, 0x33, 0), F3(~2, ~0x33, ~0)|RD_G0|ASI_RS2(~0),	"1,t", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%tbr */
-{ "mov",	F3(2, 0x33, 1), F3(~2, ~0x33, ~1)|RD_G0,		"i,t", F_ALIAS, v6notv9 }, /* wr %g0,i,%tbr */
-{ "mov",	F3(2, 0x33, 1), F3(~2, ~0x33, ~1)|RD_G0|SIMM13(~0),	"1,t", F_ALIAS, v6notv9 }, /* wr rs1,0,%tbr */
-
-{ "mov",	F3(2, 0x02, 0), F3(~2, ~0x02, ~0)|RS1_G0|ASI(~0),	"2,d", 0, v6 }, /* or %g0,rs2,d */
-{ "mov",	F3(2, 0x02, 1), F3(~2, ~0x02, ~1)|RS1_G0,		"i,d", 0, v6 }, /* or %g0,i,d	*/
-{ "mov",        F3(2, 0x02, 0), F3(~2, ~0x02, ~0)|ASI_RS2(~0),		"1,d", 0, v6 }, /* or rs1,%g0,d   */
-{ "mov",        F3(2, 0x02, 1), F3(~2, ~0x02, ~1)|SIMM13(~0),		"1,d", 0, v6 }, /* or rs1,0,d */
-
-{ "or",	F3(2, 0x02, 0), F3(~2, ~0x02, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "or",	F3(2, 0x02, 1), F3(~2, ~0x02, ~1),		"1,i,d", 0, v6 },
-{ "or",	F3(2, 0x02, 1), F3(~2, ~0x02, ~1),		"i,1,d", 0, v6 },
-
-{ "bset",	F3(2, 0x02, 0), F3(~2, ~0x02, ~0)|ASI(~0),	"2,r", F_ALIAS, v6 },	/* or rd,rs2,rd */
-{ "bset",	F3(2, 0x02, 1), F3(~2, ~0x02, ~1),		"i,r", F_ALIAS, v6 },	/* or rd,i,rd */
+{ "mov",        F3(2, 0x30, 0), F3(~2, ~0x30, ~0)|ASI(~0),              "1,2,m", F_ALIAS, v8 }, /* wr r,r,%asrX */
+{ "mov",        F3(2, 0x30, 1), F3(~2, ~0x30, ~1),                      "1,i,m", F_ALIAS, v8 }, /* wr r,i,%asrX */
+{ "mov",        F3(2, 0x30, 0), F3(~2, ~0x30, ~0)|RD_G0|ASI(~0),        "1,2,y", F_ALIAS, v6 }, /* wr r,r,%y */
+{ "mov",        F3(2, 0x30, 1), F3(~2, ~0x30, ~1)|RD_G0,                "1,i,y", F_ALIAS, v6 }, /* wr r,i,%y */
+{ "mov",        F3(2, 0x31, 0), F3(~2, ~0x31, ~0)|RD_G0|ASI(~0),        "1,2,p", F_ALIAS, v6notv9 }, /* wr r,r,%psr */
+{ "mov",        F3(2, 0x31, 1), F3(~2, ~0x31, ~1)|RD_G0,                "1,i,p", F_ALIAS, v6notv9 }, /* wr r,i,%psr */
+{ "mov",        F3(2, 0x32, 0), F3(~2, ~0x32, ~0)|RD_G0|ASI(~0),        "1,2,w", F_ALIAS, v6notv9 }, /* wr r,r,%wim */
+{ "mov",        F3(2, 0x32, 1), F3(~2, ~0x32, ~1)|RD_G0,                "1,i,w", F_ALIAS, v6notv9 }, /* wr r,i,%wim */
+{ "mov",        F3(2, 0x33, 0), F3(~2, ~0x33, ~0)|RD_G0|ASI(~0),        "1,2,t", F_ALIAS, v6notv9 }, /* wr r,r,%tbr */
+{ "mov",        F3(2, 0x33, 1), F3(~2, ~0x33, ~1)|RD_G0,                "1,i,t", F_ALIAS, v6notv9 }, /* wr r,i,%tbr */
+
+{ "mov",        F3(2, 0x28, 0), F3(~2, ~0x28, ~0)|SIMM13(~0),           "M,d", F_ALIAS, v8 }, /* rd %asr1,r */
+{ "mov",        F3(2, 0x28, 0), F3(~2, ~0x28, ~0)|RS1_G0|SIMM13(~0),    "y,d", F_ALIAS, v6 }, /* rd %y,r */
+{ "mov",        F3(2, 0x29, 0), F3(~2, ~0x29, ~0)|RS1_G0|SIMM13(~0),    "p,d", F_ALIAS, v6notv9 }, /* rd %psr,r */
+{ "mov",        F3(2, 0x2a, 0), F3(~2, ~0x2a, ~0)|RS1_G0|SIMM13(~0),    "w,d", F_ALIAS, v6notv9 }, /* rd %wim,r */
+{ "mov",        F3(2, 0x2b, 0), F3(~2, ~0x2b, ~0)|RS1_G0|SIMM13(~0),    "t,d", F_ALIAS, v6notv9 }, /* rd %tbr,r */
+
+{ "mov",        F3(2, 0x30, 0), F3(~2, ~0x30, ~0)|ASI_RS2(~0),          "1,m", F_ALIAS, v8 }, /* wr rs1,%g0,%asrX */
+{ "mov",        F3(2, 0x30, 1), F3(~2, ~0x30, ~1),                      "i,m", F_ALIAS, v8 }, /* wr %g0,i,%asrX */
+{ "mov",        F3(2, 0x30, 1), F3(~2, ~0x30, ~1)|SIMM13(~0),           "1,m", F_ALIAS, v8 }, /* wr rs1,0,%asrX */
+{ "mov",        F3(2, 0x30, 0), F3(~2, ~0x30, ~0)|RD_G0|ASI_RS2(~0),    "1,y", F_ALIAS, v6 }, /* wr rs1,%g0,%y */
+{ "mov",        F3(2, 0x30, 1), F3(~2, ~0x30, ~1)|RD_G0,                "i,y", F_ALIAS, v6 }, /* wr %g0,i,%y */
+{ "mov",        F3(2, 0x30, 1), F3(~2, ~0x30, ~1)|RD_G0|SIMM13(~0),     "1,y", F_ALIAS, v6 }, /* wr rs1,0,%y */
+{ "mov",        F3(2, 0x31, 0), F3(~2, ~0x31, ~0)|RD_G0|ASI_RS2(~0),    "1,p", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%psr */
+{ "mov",        F3(2, 0x31, 1), F3(~2, ~0x31, ~1)|RD_G0,                "i,p", F_ALIAS, v6notv9 }, /* wr %g0,i,%psr */
+{ "mov",        F3(2, 0x31, 1), F3(~2, ~0x31, ~1)|RD_G0|SIMM13(~0),     "1,p", F_ALIAS, v6notv9 }, /* wr rs1,0,%psr */
+{ "mov",        F3(2, 0x32, 0), F3(~2, ~0x32, ~0)|RD_G0|ASI_RS2(~0),    "1,w", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%wim */
+{ "mov",        F3(2, 0x32, 1), F3(~2, ~0x32, ~1)|RD_G0,                "i,w", F_ALIAS, v6notv9 }, /* wr %g0,i,%wim */
+{ "mov",        F3(2, 0x32, 1), F3(~2, ~0x32, ~1)|RD_G0|SIMM13(~0),     "1,w", F_ALIAS, v6notv9 }, /* wr rs1,0,%wim */
+{ "mov",        F3(2, 0x33, 0), F3(~2, ~0x33, ~0)|RD_G0|ASI_RS2(~0),    "1,t", F_ALIAS, v6notv9 }, /* wr rs1,%g0,%tbr */
+{ "mov",        F3(2, 0x33, 1), F3(~2, ~0x33, ~1)|RD_G0,                "i,t", F_ALIAS, v6notv9 }, /* wr %g0,i,%tbr */
+{ "mov",        F3(2, 0x33, 1), F3(~2, ~0x33, ~1)|RD_G0|SIMM13(~0),     "1,t", F_ALIAS, v6notv9 }, /* wr rs1,0,%tbr */
+
+{ "mov",        F3(2, 0x02, 0), F3(~2, ~0x02, ~0)|RS1_G0|ASI(~0),       "2,d", 0, v6 }, /* or %g0,rs2,d */
+{ "mov",        F3(2, 0x02, 1), F3(~2, ~0x02, ~1)|RS1_G0,               "i,d", 0, v6 }, /* or %g0,i,d   */
+{ "mov",        F3(2, 0x02, 0), F3(~2, ~0x02, ~0)|ASI_RS2(~0),          "1,d", 0, v6 }, /* or rs1,%g0,d   */
+{ "mov",        F3(2, 0x02, 1), F3(~2, ~0x02, ~1)|SIMM13(~0),           "1,d", 0, v6 }, /* or rs1,0,d */
+
+{ "or", F3(2, 0x02, 0), F3(~2, ~0x02, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "or", F3(2, 0x02, 1), F3(~2, ~0x02, ~1),              "1,i,d", 0, v6 },
+{ "or", F3(2, 0x02, 1), F3(~2, ~0x02, ~1),              "i,1,d", 0, v6 },
+
+{ "bset",       F3(2, 0x02, 0), F3(~2, ~0x02, ~0)|ASI(~0),      "2,r", F_ALIAS, v6 },   /* or rd,rs2,rd */
+{ "bset",       F3(2, 0x02, 1), F3(~2, ~0x02, ~1),              "i,r", F_ALIAS, v6 },   /* or rd,i,rd */
 
 /* This is not a commutative instruction.  */
-{ "andn",	F3(2, 0x05, 0), F3(~2, ~0x05, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "andn",	F3(2, 0x05, 1), F3(~2, ~0x05, ~1),		"1,i,d", 0, v6 },
+{ "andn",       F3(2, 0x05, 0), F3(~2, ~0x05, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "andn",       F3(2, 0x05, 1), F3(~2, ~0x05, ~1),              "1,i,d", 0, v6 },
 
 /* This is not a commutative instruction.  */
-{ "andncc",	F3(2, 0x15, 0), F3(~2, ~0x15, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "andncc",	F3(2, 0x15, 1), F3(~2, ~0x15, ~1),		"1,i,d", 0, v6 },
-
-{ "bclr",	F3(2, 0x05, 0), F3(~2, ~0x05, ~0)|ASI(~0),	"2,r", F_ALIAS, v6 },	/* andn rd,rs2,rd */
-{ "bclr",	F3(2, 0x05, 1), F3(~2, ~0x05, ~1),		"i,r", F_ALIAS, v6 },	/* andn rd,i,rd */
-
-{ "cmp",	F3(2, 0x14, 0), F3(~2, ~0x14, ~0)|RD_G0|ASI(~0),	"1,2", 0, v6 },	/* subcc rs1,rs2,%g0 */
-{ "cmp",	F3(2, 0x14, 1), F3(~2, ~0x14, ~1)|RD_G0,		"1,i", 0, v6 },	/* subcc rs1,i,%g0 */
-
-{ "sub",	F3(2, 0x04, 0), F3(~2, ~0x04, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "sub",	F3(2, 0x04, 1), F3(~2, ~0x04, ~1),		"1,i,d", 0, v6 },
-
-{ "subcc",	F3(2, 0x14, 0), F3(~2, ~0x14, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "subcc",	F3(2, 0x14, 1), F3(~2, ~0x14, ~1),		"1,i,d", 0, v6 },
-
-{ "subx",	F3(2, 0x0c, 0), F3(~2, ~0x0c, ~0)|ASI(~0),	"1,2,d", 0, v6notv9 },
-{ "subx",	F3(2, 0x0c, 1), F3(~2, ~0x0c, ~1),		"1,i,d", 0, v6notv9 },
-{ "subc",	F3(2, 0x0c, 0), F3(~2, ~0x0c, ~0)|ASI(~0),	"1,2,d", 0, v9 },
-{ "subc",	F3(2, 0x0c, 1), F3(~2, ~0x0c, ~1),		"1,i,d", 0, v9 },
-
-{ "subxcc",	F3(2, 0x1c, 0), F3(~2, ~0x1c, ~0)|ASI(~0),	"1,2,d", 0, v6notv9 },
-{ "subxcc",	F3(2, 0x1c, 1), F3(~2, ~0x1c, ~1),		"1,i,d", 0, v6notv9 },
-{ "subccc",	F3(2, 0x1c, 0), F3(~2, ~0x1c, ~0)|ASI(~0),	"1,2,d", 0, v9 },
-{ "subccc",	F3(2, 0x1c, 1), F3(~2, ~0x1c, ~1),		"1,i,d", 0, v9 },
-
-{ "and",	F3(2, 0x01, 0), F3(~2, ~0x01, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "and",	F3(2, 0x01, 1), F3(~2, ~0x01, ~1),		"1,i,d", 0, v6 },
-{ "and",	F3(2, 0x01, 1), F3(~2, ~0x01, ~1),		"i,1,d", 0, v6 },
-
-{ "andcc",	F3(2, 0x11, 0), F3(~2, ~0x11, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "andcc",	F3(2, 0x11, 1), F3(~2, ~0x11, ~1),		"1,i,d", 0, v6 },
-{ "andcc",	F3(2, 0x11, 1), F3(~2, ~0x11, ~1),		"i,1,d", 0, v6 },
-
-{ "dec",	F3(2, 0x04, 1)|SIMM13(0x1), F3(~2, ~0x04, ~1)|SIMM13(~0x0001), "r", F_ALIAS, v6 },	/* sub rd,1,rd */
-{ "dec",	F3(2, 0x04, 1),		    F3(~2, ~0x04, ~1),		       "i,r", F_ALIAS, v8 },	/* sub rd,imm,rd */
-{ "deccc",	F3(2, 0x14, 1)|SIMM13(0x1), F3(~2, ~0x14, ~1)|SIMM13(~0x0001), "r", F_ALIAS, v6 },	/* subcc rd,1,rd */
-{ "deccc",	F3(2, 0x14, 1),		    F3(~2, ~0x14, ~1),		       "i,r", F_ALIAS, v8 },	/* subcc rd,imm,rd */
-{ "inc",	F3(2, 0x00, 1)|SIMM13(0x1), F3(~2, ~0x00, ~1)|SIMM13(~0x0001), "r", F_ALIAS, v6 },	/* add rd,1,rd */
-{ "inc",	F3(2, 0x00, 1),		    F3(~2, ~0x00, ~1),		       "i,r", F_ALIAS, v8 },	/* add rd,imm,rd */
-{ "inccc",	F3(2, 0x10, 1)|SIMM13(0x1), F3(~2, ~0x10, ~1)|SIMM13(~0x0001), "r", F_ALIAS, v6 },	/* addcc rd,1,rd */
-{ "inccc",	F3(2, 0x10, 1),		    F3(~2, ~0x10, ~1),		       "i,r", F_ALIAS, v8 },	/* addcc rd,imm,rd */
-
-{ "btst",	F3(2, 0x11, 0), F3(~2, ~0x11, ~0)|RD_G0|ASI(~0), "1,2", F_ALIAS, v6 },	/* andcc rs1,rs2,%g0 */
-{ "btst",	F3(2, 0x11, 1), F3(~2, ~0x11, ~1)|RD_G0, "i,1", F_ALIAS, v6 },	/* andcc rs1,i,%g0 */
-
-{ "neg",	F3(2, 0x04, 0), F3(~2, ~0x04, ~0)|RS1_G0|ASI(~0), "2,d", F_ALIAS, v6 }, /* sub %g0,rs2,rd */
-{ "neg",	F3(2, 0x04, 0), F3(~2, ~0x04, ~0)|RS1_G0|ASI(~0), "O", F_ALIAS, v6 }, /* sub %g0,rd,rd */
-
-{ "add",	F3(2, 0x00, 0), F3(~2, ~0x00, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "add",	F3(2, 0x00, 1), F3(~2, ~0x00, ~1),		"1,i,d", 0, v6 },
-{ "add",	F3(2, 0x00, 1), F3(~2, ~0x00, ~1),		"i,1,d", 0, v6 },
-{ "addcc",	F3(2, 0x10, 0), F3(~2, ~0x10, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "addcc",	F3(2, 0x10, 1), F3(~2, ~0x10, ~1),		"1,i,d", 0, v6 },
-{ "addcc",	F3(2, 0x10, 1), F3(~2, ~0x10, ~1),		"i,1,d", 0, v6 },
-
-{ "addx",	F3(2, 0x08, 0), F3(~2, ~0x08, ~0)|ASI(~0),	"1,2,d", 0, v6notv9 },
-{ "addx",	F3(2, 0x08, 1), F3(~2, ~0x08, ~1),		"1,i,d", 0, v6notv9 },
-{ "addx",	F3(2, 0x08, 1), F3(~2, ~0x08, ~1),		"i,1,d", 0, v6notv9 },
-{ "addc",	F3(2, 0x08, 0), F3(~2, ~0x08, ~0)|ASI(~0),	"1,2,d", 0, v9 },
-{ "addc",	F3(2, 0x08, 1), F3(~2, ~0x08, ~1),		"1,i,d", 0, v9 },
-{ "addc",	F3(2, 0x08, 1), F3(~2, ~0x08, ~1),		"i,1,d", 0, v9 },
-
-{ "addxcc",	F3(2, 0x18, 0), F3(~2, ~0x18, ~0)|ASI(~0),	"1,2,d", 0, v6notv9 },
-{ "addxcc",	F3(2, 0x18, 1), F3(~2, ~0x18, ~1),		"1,i,d", 0, v6notv9 },
-{ "addxcc",	F3(2, 0x18, 1), F3(~2, ~0x18, ~1),		"i,1,d", 0, v6notv9 },
-{ "addccc",	F3(2, 0x18, 0), F3(~2, ~0x18, ~0)|ASI(~0),	"1,2,d", 0, v9 },
-{ "addccc",	F3(2, 0x18, 1), F3(~2, ~0x18, ~1),		"1,i,d", 0, v9 },
-{ "addccc",	F3(2, 0x18, 1), F3(~2, ~0x18, ~1),		"i,1,d", 0, v9 },
-
-{ "smul",	F3(2, 0x0b, 0), F3(~2, ~0x0b, ~0)|ASI(~0),	"1,2,d", 0, v8 },
-{ "smul",	F3(2, 0x0b, 1), F3(~2, ~0x0b, ~1),		"1,i,d", 0, v8 },
-{ "smul",	F3(2, 0x0b, 1), F3(~2, ~0x0b, ~1),		"i,1,d", 0, v8 },
-{ "smulcc",	F3(2, 0x1b, 0), F3(~2, ~0x1b, ~0)|ASI(~0),	"1,2,d", 0, v8 },
-{ "smulcc",	F3(2, 0x1b, 1), F3(~2, ~0x1b, ~1),		"1,i,d", 0, v8 },
-{ "smulcc",	F3(2, 0x1b, 1), F3(~2, ~0x1b, ~1),		"i,1,d", 0, v8 },
-{ "umul",	F3(2, 0x0a, 0), F3(~2, ~0x0a, ~0)|ASI(~0),	"1,2,d", 0, v8 },
-{ "umul",	F3(2, 0x0a, 1), F3(~2, ~0x0a, ~1),		"1,i,d", 0, v8 },
-{ "umul",	F3(2, 0x0a, 1), F3(~2, ~0x0a, ~1),		"i,1,d", 0, v8 },
-{ "umulcc",	F3(2, 0x1a, 0), F3(~2, ~0x1a, ~0)|ASI(~0),	"1,2,d", 0, v8 },
-{ "umulcc",	F3(2, 0x1a, 1), F3(~2, ~0x1a, ~1),		"1,i,d", 0, v8 },
-{ "umulcc",	F3(2, 0x1a, 1), F3(~2, ~0x1a, ~1),		"i,1,d", 0, v8 },
-{ "sdiv",	F3(2, 0x0f, 0), F3(~2, ~0x0f, ~0)|ASI(~0),	"1,2,d", 0, v8 },
-{ "sdiv",	F3(2, 0x0f, 1), F3(~2, ~0x0f, ~1),		"1,i,d", 0, v8 },
-{ "sdiv",	F3(2, 0x0f, 1), F3(~2, ~0x0f, ~1),		"i,1,d", 0, v8 },
-{ "sdivcc",	F3(2, 0x1f, 0), F3(~2, ~0x1f, ~0)|ASI(~0),	"1,2,d", 0, v8 },
-{ "sdivcc",	F3(2, 0x1f, 1), F3(~2, ~0x1f, ~1),		"1,i,d", 0, v8 },
-{ "sdivcc",	F3(2, 0x1f, 1), F3(~2, ~0x1f, ~1),		"i,1,d", 0, v8 },
-{ "udiv",	F3(2, 0x0e, 0), F3(~2, ~0x0e, ~0)|ASI(~0),	"1,2,d", 0, v8 },
-{ "udiv",	F3(2, 0x0e, 1), F3(~2, ~0x0e, ~1),		"1,i,d", 0, v8 },
-{ "udiv",	F3(2, 0x0e, 1), F3(~2, ~0x0e, ~1),		"i,1,d", 0, v8 },
-{ "udivcc",	F3(2, 0x1e, 0), F3(~2, ~0x1e, ~0)|ASI(~0),	"1,2,d", 0, v8 },
-{ "udivcc",	F3(2, 0x1e, 1), F3(~2, ~0x1e, ~1),		"1,i,d", 0, v8 },
-{ "udivcc",	F3(2, 0x1e, 1), F3(~2, ~0x1e, ~1),		"i,1,d", 0, v8 },
-
-{ "mulx",	F3(2, 0x09, 0), F3(~2, ~0x09, ~0)|ASI(~0),	"1,2,d", 0, v9 },
-{ "mulx",	F3(2, 0x09, 1), F3(~2, ~0x09, ~1),		"1,i,d", 0, v9 },
-{ "sdivx",	F3(2, 0x2d, 0), F3(~2, ~0x2d, ~0)|ASI(~0),	"1,2,d", 0, v9 },
-{ "sdivx",	F3(2, 0x2d, 1), F3(~2, ~0x2d, ~1),		"1,i,d", 0, v9 },
-{ "udivx",	F3(2, 0x0d, 0), F3(~2, ~0x0d, ~0)|ASI(~0),	"1,2,d", 0, v9 },
-{ "udivx",	F3(2, 0x0d, 1), F3(~2, ~0x0d, ~1),		"1,i,d", 0, v9 },
-
-{ "call",	F1(0x1), F1(~0x1), "L", F_JSR|F_DELAYED, v6 },
-{ "call",	F1(0x1), F1(~0x1), "L,#", F_JSR|F_DELAYED, v6 },
-
-{ "call",	F3(2, 0x38, 0)|RD(0xf), F3(~2, ~0x38, ~0)|RD(~0xf)|ASI(~0),	"1+2", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+rs2,%o7 */
-{ "call",	F3(2, 0x38, 0)|RD(0xf), F3(~2, ~0x38, ~0)|RD(~0xf)|ASI(~0),	"1+2,#", F_JSR|F_DELAYED, v6 },
-{ "call",	F3(2, 0x38, 0)|RD(0xf), F3(~2, ~0x38, ~0)|RD(~0xf)|ASI_RS2(~0),	"1", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+%g0,%o7 */
-{ "call",	F3(2, 0x38, 0)|RD(0xf), F3(~2, ~0x38, ~0)|RD(~0xf)|ASI_RS2(~0),	"1,#", F_JSR|F_DELAYED, v6 },
-{ "call",	F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf),		"1+i", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+i,%o7 */
-{ "call",	F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf),		"1+i,#", F_JSR|F_DELAYED, v6 },
-{ "call",	F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf),		"i+1", F_JSR|F_DELAYED, v6 }, /* jmpl i+rs1,%o7 */
-{ "call",	F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf),		"i+1,#", F_JSR|F_DELAYED, v6 },
-{ "call",	F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf)|RS1_G0,	"i", F_JSR|F_DELAYED, v6 }, /* jmpl %g0+i,%o7 */
-{ "call",	F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf)|RS1_G0,	"i,#", F_JSR|F_DELAYED, v6 },
-{ "call",	F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf)|SIMM13(~0),	"1", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+0,%o7 */
-{ "call",	F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf)|SIMM13(~0),	"1,#", F_JSR|F_DELAYED, v6 },
+{ "andncc",     F3(2, 0x15, 0), F3(~2, ~0x15, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "andncc",     F3(2, 0x15, 1), F3(~2, ~0x15, ~1),              "1,i,d", 0, v6 },
+
+{ "bclr",       F3(2, 0x05, 0), F3(~2, ~0x05, ~0)|ASI(~0),      "2,r", F_ALIAS, v6 },   /* andn rd,rs2,rd */
+{ "bclr",       F3(2, 0x05, 1), F3(~2, ~0x05, ~1),              "i,r", F_ALIAS, v6 },   /* andn rd,i,rd */
+
+{ "cmp",        F3(2, 0x14, 0), F3(~2, ~0x14, ~0)|RD_G0|ASI(~0),        "1,2", 0, v6 }, /* subcc rs1,rs2,%g0 */
+{ "cmp",        F3(2, 0x14, 1), F3(~2, ~0x14, ~1)|RD_G0,                "1,i", 0, v6 }, /* subcc rs1,i,%g0 */
+
+{ "sub",        F3(2, 0x04, 0), F3(~2, ~0x04, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "sub",        F3(2, 0x04, 1), F3(~2, ~0x04, ~1),              "1,i,d", 0, v6 },
+
+{ "subcc",      F3(2, 0x14, 0), F3(~2, ~0x14, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "subcc",      F3(2, 0x14, 1), F3(~2, ~0x14, ~1),              "1,i,d", 0, v6 },
+
+{ "subx",       F3(2, 0x0c, 0), F3(~2, ~0x0c, ~0)|ASI(~0),      "1,2,d", 0, v6notv9 },
+{ "subx",       F3(2, 0x0c, 1), F3(~2, ~0x0c, ~1),              "1,i,d", 0, v6notv9 },
+{ "subc",       F3(2, 0x0c, 0), F3(~2, ~0x0c, ~0)|ASI(~0),      "1,2,d", 0, v9 },
+{ "subc",       F3(2, 0x0c, 1), F3(~2, ~0x0c, ~1),              "1,i,d", 0, v9 },
+
+{ "subxcc",     F3(2, 0x1c, 0), F3(~2, ~0x1c, ~0)|ASI(~0),      "1,2,d", 0, v6notv9 },
+{ "subxcc",     F3(2, 0x1c, 1), F3(~2, ~0x1c, ~1),              "1,i,d", 0, v6notv9 },
+{ "subccc",     F3(2, 0x1c, 0), F3(~2, ~0x1c, ~0)|ASI(~0),      "1,2,d", 0, v9 },
+{ "subccc",     F3(2, 0x1c, 1), F3(~2, ~0x1c, ~1),              "1,i,d", 0, v9 },
+
+{ "and",        F3(2, 0x01, 0), F3(~2, ~0x01, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "and",        F3(2, 0x01, 1), F3(~2, ~0x01, ~1),              "1,i,d", 0, v6 },
+{ "and",        F3(2, 0x01, 1), F3(~2, ~0x01, ~1),              "i,1,d", 0, v6 },
+
+{ "andcc",      F3(2, 0x11, 0), F3(~2, ~0x11, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "andcc",      F3(2, 0x11, 1), F3(~2, ~0x11, ~1),              "1,i,d", 0, v6 },
+{ "andcc",      F3(2, 0x11, 1), F3(~2, ~0x11, ~1),              "i,1,d", 0, v6 },
+
+{ "dec",        F3(2, 0x04, 1)|SIMM13(0x1), F3(~2, ~0x04, ~1)|SIMM13(~0x0001), "r", F_ALIAS, v6 },      /* sub rd,1,rd */
+{ "dec",        F3(2, 0x04, 1),             F3(~2, ~0x04, ~1),                 "i,r", F_ALIAS, v8 },    /* sub rd,imm,rd */
+{ "deccc",      F3(2, 0x14, 1)|SIMM13(0x1), F3(~2, ~0x14, ~1)|SIMM13(~0x0001), "r", F_ALIAS, v6 },      /* subcc rd,1,rd */
+{ "deccc",      F3(2, 0x14, 1),             F3(~2, ~0x14, ~1),                 "i,r", F_ALIAS, v8 },    /* subcc rd,imm,rd */
+{ "inc",        F3(2, 0x00, 1)|SIMM13(0x1), F3(~2, ~0x00, ~1)|SIMM13(~0x0001), "r", F_ALIAS, v6 },      /* add rd,1,rd */
+{ "inc",        F3(2, 0x00, 1),             F3(~2, ~0x00, ~1),                 "i,r", F_ALIAS, v8 },    /* add rd,imm,rd */
+{ "inccc",      F3(2, 0x10, 1)|SIMM13(0x1), F3(~2, ~0x10, ~1)|SIMM13(~0x0001), "r", F_ALIAS, v6 },      /* addcc rd,1,rd */
+{ "inccc",      F3(2, 0x10, 1),             F3(~2, ~0x10, ~1),                 "i,r", F_ALIAS, v8 },    /* addcc rd,imm,rd */
+
+{ "btst",       F3(2, 0x11, 0), F3(~2, ~0x11, ~0)|RD_G0|ASI(~0), "1,2", F_ALIAS, v6 },  /* andcc rs1,rs2,%g0 */
+{ "btst",       F3(2, 0x11, 1), F3(~2, ~0x11, ~1)|RD_G0, "i,1", F_ALIAS, v6 },  /* andcc rs1,i,%g0 */
+
+{ "neg",        F3(2, 0x04, 0), F3(~2, ~0x04, ~0)|RS1_G0|ASI(~0), "2,d", F_ALIAS, v6 }, /* sub %g0,rs2,rd */
+{ "neg",        F3(2, 0x04, 0), F3(~2, ~0x04, ~0)|RS1_G0|ASI(~0), "O", F_ALIAS, v6 }, /* sub %g0,rd,rd */
+
+{ "add",        F3(2, 0x00, 0), F3(~2, ~0x00, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "add",        F3(2, 0x00, 1), F3(~2, ~0x00, ~1),              "1,i,d", 0, v6 },
+{ "add",        F3(2, 0x00, 1), F3(~2, ~0x00, ~1),              "i,1,d", 0, v6 },
+{ "addcc",      F3(2, 0x10, 0), F3(~2, ~0x10, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "addcc",      F3(2, 0x10, 1), F3(~2, ~0x10, ~1),              "1,i,d", 0, v6 },
+{ "addcc",      F3(2, 0x10, 1), F3(~2, ~0x10, ~1),              "i,1,d", 0, v6 },
+
+{ "addx",       F3(2, 0x08, 0), F3(~2, ~0x08, ~0)|ASI(~0),      "1,2,d", 0, v6notv9 },
+{ "addx",       F3(2, 0x08, 1), F3(~2, ~0x08, ~1),              "1,i,d", 0, v6notv9 },
+{ "addx",       F3(2, 0x08, 1), F3(~2, ~0x08, ~1),              "i,1,d", 0, v6notv9 },
+{ "addc",       F3(2, 0x08, 0), F3(~2, ~0x08, ~0)|ASI(~0),      "1,2,d", 0, v9 },
+{ "addc",       F3(2, 0x08, 1), F3(~2, ~0x08, ~1),              "1,i,d", 0, v9 },
+{ "addc",       F3(2, 0x08, 1), F3(~2, ~0x08, ~1),              "i,1,d", 0, v9 },
+
+{ "addxcc",     F3(2, 0x18, 0), F3(~2, ~0x18, ~0)|ASI(~0),      "1,2,d", 0, v6notv9 },
+{ "addxcc",     F3(2, 0x18, 1), F3(~2, ~0x18, ~1),              "1,i,d", 0, v6notv9 },
+{ "addxcc",     F3(2, 0x18, 1), F3(~2, ~0x18, ~1),              "i,1,d", 0, v6notv9 },
+{ "addccc",     F3(2, 0x18, 0), F3(~2, ~0x18, ~0)|ASI(~0),      "1,2,d", 0, v9 },
+{ "addccc",     F3(2, 0x18, 1), F3(~2, ~0x18, ~1),              "1,i,d", 0, v9 },
+{ "addccc",     F3(2, 0x18, 1), F3(~2, ~0x18, ~1),              "i,1,d", 0, v9 },
+
+{ "smul",       F3(2, 0x0b, 0), F3(~2, ~0x0b, ~0)|ASI(~0),      "1,2,d", 0, v8 },
+{ "smul",       F3(2, 0x0b, 1), F3(~2, ~0x0b, ~1),              "1,i,d", 0, v8 },
+{ "smul",       F3(2, 0x0b, 1), F3(~2, ~0x0b, ~1),              "i,1,d", 0, v8 },
+{ "smulcc",     F3(2, 0x1b, 0), F3(~2, ~0x1b, ~0)|ASI(~0),      "1,2,d", 0, v8 },
+{ "smulcc",     F3(2, 0x1b, 1), F3(~2, ~0x1b, ~1),              "1,i,d", 0, v8 },
+{ "smulcc",     F3(2, 0x1b, 1), F3(~2, ~0x1b, ~1),              "i,1,d", 0, v8 },
+{ "umul",       F3(2, 0x0a, 0), F3(~2, ~0x0a, ~0)|ASI(~0),      "1,2,d", 0, v8 },
+{ "umul",       F3(2, 0x0a, 1), F3(~2, ~0x0a, ~1),              "1,i,d", 0, v8 },
+{ "umul",       F3(2, 0x0a, 1), F3(~2, ~0x0a, ~1),              "i,1,d", 0, v8 },
+{ "umulcc",     F3(2, 0x1a, 0), F3(~2, ~0x1a, ~0)|ASI(~0),      "1,2,d", 0, v8 },
+{ "umulcc",     F3(2, 0x1a, 1), F3(~2, ~0x1a, ~1),              "1,i,d", 0, v8 },
+{ "umulcc",     F3(2, 0x1a, 1), F3(~2, ~0x1a, ~1),              "i,1,d", 0, v8 },
+{ "sdiv",       F3(2, 0x0f, 0), F3(~2, ~0x0f, ~0)|ASI(~0),      "1,2,d", 0, v8 },
+{ "sdiv",       F3(2, 0x0f, 1), F3(~2, ~0x0f, ~1),              "1,i,d", 0, v8 },
+{ "sdiv",       F3(2, 0x0f, 1), F3(~2, ~0x0f, ~1),              "i,1,d", 0, v8 },
+{ "sdivcc",     F3(2, 0x1f, 0), F3(~2, ~0x1f, ~0)|ASI(~0),      "1,2,d", 0, v8 },
+{ "sdivcc",     F3(2, 0x1f, 1), F3(~2, ~0x1f, ~1),              "1,i,d", 0, v8 },
+{ "sdivcc",     F3(2, 0x1f, 1), F3(~2, ~0x1f, ~1),              "i,1,d", 0, v8 },
+{ "udiv",       F3(2, 0x0e, 0), F3(~2, ~0x0e, ~0)|ASI(~0),      "1,2,d", 0, v8 },
+{ "udiv",       F3(2, 0x0e, 1), F3(~2, ~0x0e, ~1),              "1,i,d", 0, v8 },
+{ "udiv",       F3(2, 0x0e, 1), F3(~2, ~0x0e, ~1),              "i,1,d", 0, v8 },
+{ "udivcc",     F3(2, 0x1e, 0), F3(~2, ~0x1e, ~0)|ASI(~0),      "1,2,d", 0, v8 },
+{ "udivcc",     F3(2, 0x1e, 1), F3(~2, ~0x1e, ~1),              "1,i,d", 0, v8 },
+{ "udivcc",     F3(2, 0x1e, 1), F3(~2, ~0x1e, ~1),              "i,1,d", 0, v8 },
+
+{ "mulx",       F3(2, 0x09, 0), F3(~2, ~0x09, ~0)|ASI(~0),      "1,2,d", 0, v9 },
+{ "mulx",       F3(2, 0x09, 1), F3(~2, ~0x09, ~1),              "1,i,d", 0, v9 },
+{ "sdivx",      F3(2, 0x2d, 0), F3(~2, ~0x2d, ~0)|ASI(~0),      "1,2,d", 0, v9 },
+{ "sdivx",      F3(2, 0x2d, 1), F3(~2, ~0x2d, ~1),              "1,i,d", 0, v9 },
+{ "udivx",      F3(2, 0x0d, 0), F3(~2, ~0x0d, ~0)|ASI(~0),      "1,2,d", 0, v9 },
+{ "udivx",      F3(2, 0x0d, 1), F3(~2, ~0x0d, ~1),              "1,i,d", 0, v9 },
+
+{ "call",       F1(0x1), F1(~0x1), "L", F_JSR|F_DELAYED, v6 },
+{ "call",       F1(0x1), F1(~0x1), "L,#", F_JSR|F_DELAYED, v6 },
+
+{ "call",       F3(2, 0x38, 0)|RD(0xf), F3(~2, ~0x38, ~0)|RD(~0xf)|ASI(~0),     "1+2", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+rs2,%o7 */
+{ "call",       F3(2, 0x38, 0)|RD(0xf), F3(~2, ~0x38, ~0)|RD(~0xf)|ASI(~0),     "1+2,#", F_JSR|F_DELAYED, v6 },
+{ "call",       F3(2, 0x38, 0)|RD(0xf), F3(~2, ~0x38, ~0)|RD(~0xf)|ASI_RS2(~0), "1", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+%g0,%o7 */
+{ "call",       F3(2, 0x38, 0)|RD(0xf), F3(~2, ~0x38, ~0)|RD(~0xf)|ASI_RS2(~0), "1,#", F_JSR|F_DELAYED, v6 },
+{ "call",       F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf),             "1+i", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+i,%o7 */
+{ "call",       F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf),             "1+i,#", F_JSR|F_DELAYED, v6 },
+{ "call",       F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf),             "i+1", F_JSR|F_DELAYED, v6 }, /* jmpl i+rs1,%o7 */
+{ "call",       F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf),             "i+1,#", F_JSR|F_DELAYED, v6 },
+{ "call",       F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf)|RS1_G0,      "i", F_JSR|F_DELAYED, v6 }, /* jmpl %g0+i,%o7 */
+{ "call",       F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf)|RS1_G0,      "i,#", F_JSR|F_DELAYED, v6 },
+{ "call",       F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf)|SIMM13(~0),  "1", F_JSR|F_DELAYED, v6 }, /* jmpl rs1+0,%o7 */
+{ "call",       F3(2, 0x38, 1)|RD(0xf), F3(~2, ~0x38, ~1)|RD(~0xf)|SIMM13(~0),  "1,#", F_JSR|F_DELAYED, v6 },
 
 
 /* Conditional instructions.
@@ -1278,18 +1278,18 @@ const struct sparc_opcode sparc_opcodes[] = {
 
 /* Define four traps: reg+reg, reg + immediate, immediate alone, reg alone. */
 #define tr(opcode, mask, lose, flags) \
- { opcode, (mask)|(2<<11)|IMMED, (lose)|RS1_G0,	"Z,i",   (flags), v9 }, /* %g0 + imm */ \
- { opcode, (mask)|(2<<11)|IMMED, (lose),	"Z,1+i", (flags), v9 }, /* rs1 + imm */ \
- { opcode, (mask)|(2<<11), IMMED|(lose),	"Z,1+2", (flags), v9 }, /* rs1 + rs2 */ \
- { opcode, (mask)|(2<<11), IMMED|(lose)|RS2_G0,	"Z,1",   (flags), v9 }, /* rs1 + %g0 */ \
- { opcode, (mask)|IMMED, (lose)|RS1_G0,	"z,i",   (flags)|F_ALIAS, v9 }, /* %g0 + imm */ \
- { opcode, (mask)|IMMED, (lose),	"z,1+i", (flags)|F_ALIAS, v9 }, /* rs1 + imm */ \
- { opcode, (mask), IMMED|(lose),	"z,1+2", (flags)|F_ALIAS, v9 }, /* rs1 + rs2 */ \
- { opcode, (mask), IMMED|(lose)|RS2_G0,	"z,1",   (flags)|F_ALIAS, v9 }, /* rs1 + %g0 */ \
- { opcode, (mask)|IMMED, (lose)|RS1_G0,		"i",     (flags), v6 }, /* %g0 + imm */ \
- { opcode, (mask)|IMMED, (lose),		"1+i",   (flags), v6 }, /* rs1 + imm */ \
- { opcode, (mask), IMMED|(lose),		"1+2",   (flags), v6 }, /* rs1 + rs2 */ \
- { opcode, (mask), IMMED|(lose)|RS2_G0,		"1",     (flags), v6 } /* rs1 + %g0 */
+ { opcode, (mask)|(2<<11)|IMMED, (lose)|RS1_G0, "Z,i",   (flags), v9 }, /* %g0 + imm */ \
+ { opcode, (mask)|(2<<11)|IMMED, (lose),        "Z,1+i", (flags), v9 }, /* rs1 + imm */ \
+ { opcode, (mask)|(2<<11), IMMED|(lose),        "Z,1+2", (flags), v9 }, /* rs1 + rs2 */ \
+ { opcode, (mask)|(2<<11), IMMED|(lose)|RS2_G0, "Z,1",   (flags), v9 }, /* rs1 + %g0 */ \
+ { opcode, (mask)|IMMED, (lose)|RS1_G0, "z,i",   (flags)|F_ALIAS, v9 }, /* %g0 + imm */ \
+ { opcode, (mask)|IMMED, (lose),        "z,1+i", (flags)|F_ALIAS, v9 }, /* rs1 + imm */ \
+ { opcode, (mask), IMMED|(lose),        "z,1+2", (flags)|F_ALIAS, v9 }, /* rs1 + rs2 */ \
+ { opcode, (mask), IMMED|(lose)|RS2_G0, "z,1",   (flags)|F_ALIAS, v9 }, /* rs1 + %g0 */ \
+ { opcode, (mask)|IMMED, (lose)|RS1_G0,         "i",     (flags), v6 }, /* %g0 + imm */ \
+ { opcode, (mask)|IMMED, (lose),                "1+i",   (flags), v6 }, /* rs1 + imm */ \
+ { opcode, (mask), IMMED|(lose),                "1+2",   (flags), v6 }, /* rs1 + rs2 */ \
+ { opcode, (mask), IMMED|(lose)|RS2_G0,         "1",     (flags), v6 } /* rs1 + %g0 */
 
 /* v9: We must put `brx' before `br', to ensure that we never match something
    v9: against an expression unless it is an expression.  Otherwise, we end
@@ -1305,32 +1305,32 @@ const struct sparc_opcode sparc_opcodes[] = {
 /* Define all the conditions, all the branches, all the traps.  */
 
 /* Standard branch, trap mnemonics */
-cond ("b",	"ta",   CONDA, F_UNBR),
+cond ("b",      "ta",   CONDA, F_UNBR),
 /* Alternative form (just for assembly, not for disassembly) */
-cond ("ba",	"t",    CONDA, F_UNBR|F_ALIAS),
-
-cond ("bcc",	"tcc",  CONDCC, F_CONDBR),
-cond ("bcs",	"tcs",  CONDCS, F_CONDBR),
-cond ("be",	"te",   CONDE, F_CONDBR),
-cond ("beq",	"teq",  CONDE, F_CONDBR|F_ALIAS),
-cond ("bg",	"tg",   CONDG, F_CONDBR),
-cond ("bgt",	"tgt",  CONDG, F_CONDBR|F_ALIAS),
-cond ("bge",	"tge",  CONDGE, F_CONDBR),
-cond ("bgeu",	"tgeu", CONDGEU, F_CONDBR|F_ALIAS), /* for cc */
-cond ("bgu",	"tgu",  CONDGU, F_CONDBR),
-cond ("bl",	"tl",   CONDL, F_CONDBR),
-cond ("blt",	"tlt",  CONDL, F_CONDBR|F_ALIAS),
-cond ("ble",	"tle",  CONDLE, F_CONDBR),
-cond ("bleu",	"tleu", CONDLEU, F_CONDBR),
-cond ("blu",	"tlu",  CONDLU, F_CONDBR|F_ALIAS), /* for cs */
-cond ("bn",	"tn",   CONDN, F_CONDBR),
-cond ("bne",	"tne",  CONDNE, F_CONDBR),
-cond ("bneg",	"tneg", CONDNEG, F_CONDBR),
-cond ("bnz",	"tnz",  CONDNZ, F_CONDBR|F_ALIAS), /* for ne */
-cond ("bpos",	"tpos", CONDPOS, F_CONDBR),
-cond ("bvc",	"tvc",  CONDVC, F_CONDBR),
-cond ("bvs",	"tvs",  CONDVS, F_CONDBR),
-cond ("bz",	"tz",   CONDZ, F_CONDBR|F_ALIAS), /* for e */
+cond ("ba",     "t",    CONDA, F_UNBR|F_ALIAS),
+
+cond ("bcc",    "tcc",  CONDCC, F_CONDBR),
+cond ("bcs",    "tcs",  CONDCS, F_CONDBR),
+cond ("be",     "te",   CONDE, F_CONDBR),
+cond ("beq",    "teq",  CONDE, F_CONDBR|F_ALIAS),
+cond ("bg",     "tg",   CONDG, F_CONDBR),
+cond ("bgt",    "tgt",  CONDG, F_CONDBR|F_ALIAS),
+cond ("bge",    "tge",  CONDGE, F_CONDBR),
+cond ("bgeu",   "tgeu", CONDGEU, F_CONDBR|F_ALIAS), /* for cc */
+cond ("bgu",    "tgu",  CONDGU, F_CONDBR),
+cond ("bl",     "tl",   CONDL, F_CONDBR),
+cond ("blt",    "tlt",  CONDL, F_CONDBR|F_ALIAS),
+cond ("ble",    "tle",  CONDLE, F_CONDBR),
+cond ("bleu",   "tleu", CONDLEU, F_CONDBR),
+cond ("blu",    "tlu",  CONDLU, F_CONDBR|F_ALIAS), /* for cs */
+cond ("bn",     "tn",   CONDN, F_CONDBR),
+cond ("bne",    "tne",  CONDNE, F_CONDBR),
+cond ("bneg",   "tneg", CONDNEG, F_CONDBR),
+cond ("bnz",    "tnz",  CONDNZ, F_CONDBR|F_ALIAS), /* for ne */
+cond ("bpos",   "tpos", CONDPOS, F_CONDBR),
+cond ("bvc",    "tvc",  CONDVC, F_CONDBR),
+cond ("bvs",    "tvs",  CONDVS, F_CONDBR),
+cond ("bz",     "tz",   CONDZ, F_CONDBR|F_ALIAS), /* for e */
 
 #undef cond
 #undef br
@@ -1436,42 +1436,42 @@ cond ("bz",	"tz",   CONDZ, F_CONDBR|F_ALIAS), /* for e */
   movfcc (opcode, fcond, flags), /* v9 */ \
   movicc (opcode, cond, flags) /* v9 */
 
-/* v9 */ movcc  ("mova",	CONDA, FCONDA, 0),
-/* v9 */ movicc ("movcc",	CONDCC, 0),
-/* v9 */ movicc ("movgeu",	CONDGEU, F_ALIAS),
-/* v9 */ movicc ("movcs",	CONDCS, 0),
-/* v9 */ movicc ("movlu",	CONDLU, F_ALIAS),
-/* v9 */ movcc  ("move",	CONDE, FCONDE, 0),
-/* v9 */ movcc  ("movg",	CONDG, FCONDG, 0),
-/* v9 */ movcc  ("movge",	CONDGE, FCONDGE, 0),
-/* v9 */ movicc ("movgu",	CONDGU, 0),
-/* v9 */ movcc  ("movl",	CONDL, FCONDL, 0),
-/* v9 */ movcc  ("movle",	CONDLE, FCONDLE, 0),
-/* v9 */ movicc ("movleu",	CONDLEU, 0),
-/* v9 */ movfcc ("movlg",	FCONDLG, 0),
-/* v9 */ movcc  ("movn",	CONDN, FCONDN, 0),
-/* v9 */ movcc  ("movne",	CONDNE, FCONDNE, 0),
-/* v9 */ movicc ("movneg",	CONDNEG, 0),
-/* v9 */ movcc  ("movnz",	CONDNZ, FCONDNZ, F_ALIAS),
-/* v9 */ movfcc ("movo",	FCONDO, 0),
-/* v9 */ movicc ("movpos",	CONDPOS, 0),
-/* v9 */ movfcc ("movu",	FCONDU, 0),
-/* v9 */ movfcc ("movue",	FCONDUE, 0),
-/* v9 */ movfcc ("movug",	FCONDUG, 0),
-/* v9 */ movfcc ("movuge",	FCONDUGE, 0),
-/* v9 */ movfcc ("movul",	FCONDUL, 0),
-/* v9 */ movfcc ("movule",	FCONDULE, 0),
-/* v9 */ movicc ("movvc",	CONDVC, 0),
-/* v9 */ movicc ("movvs",	CONDVS, 0),
-/* v9 */ movcc  ("movz",	CONDZ, FCONDZ, F_ALIAS),
+/* v9 */ movcc  ("mova",        CONDA, FCONDA, 0),
+/* v9 */ movicc ("movcc",       CONDCC, 0),
+/* v9 */ movicc ("movgeu",      CONDGEU, F_ALIAS),
+/* v9 */ movicc ("movcs",       CONDCS, 0),
+/* v9 */ movicc ("movlu",       CONDLU, F_ALIAS),
+/* v9 */ movcc  ("move",        CONDE, FCONDE, 0),
+/* v9 */ movcc  ("movg",        CONDG, FCONDG, 0),
+/* v9 */ movcc  ("movge",       CONDGE, FCONDGE, 0),
+/* v9 */ movicc ("movgu",       CONDGU, 0),
+/* v9 */ movcc  ("movl",        CONDL, FCONDL, 0),
+/* v9 */ movcc  ("movle",       CONDLE, FCONDLE, 0),
+/* v9 */ movicc ("movleu",      CONDLEU, 0),
+/* v9 */ movfcc ("movlg",       FCONDLG, 0),
+/* v9 */ movcc  ("movn",        CONDN, FCONDN, 0),
+/* v9 */ movcc  ("movne",       CONDNE, FCONDNE, 0),
+/* v9 */ movicc ("movneg",      CONDNEG, 0),
+/* v9 */ movcc  ("movnz",       CONDNZ, FCONDNZ, F_ALIAS),
+/* v9 */ movfcc ("movo",        FCONDO, 0),
+/* v9 */ movicc ("movpos",      CONDPOS, 0),
+/* v9 */ movfcc ("movu",        FCONDU, 0),
+/* v9 */ movfcc ("movue",       FCONDUE, 0),
+/* v9 */ movfcc ("movug",       FCONDUG, 0),
+/* v9 */ movfcc ("movuge",      FCONDUGE, 0),
+/* v9 */ movfcc ("movul",       FCONDUL, 0),
+/* v9 */ movfcc ("movule",      FCONDULE, 0),
+/* v9 */ movicc ("movvc",       CONDVC, 0),
+/* v9 */ movicc ("movvs",       CONDVS, 0),
+/* v9 */ movcc  ("movz",        CONDZ, FCONDZ, F_ALIAS),
 
 #undef movicc /* v9 */
 #undef movfcc /* v9 */
 #undef movcc /* v9 */
 
-#define FM_SF 1		/* v9 - values for fpsize */
-#define FM_DF 2		/* v9 */
-#define FM_QF 3		/* v9 */
+#define FM_SF 1         /* v9 - values for fpsize */
+#define FM_DF 2         /* v9 */
+#define FM_QF 3         /* v9 */
 
 #define fmovicc(opcode, fpsize, cond, flags) /* v9 */ \
 { opcode, F3F(2, 0x35, 0x100+fpsize)|MCOND(cond,0),  F3F(~2, ~0x35, ~(0x100+fpsize))|MCOND(~cond,~0),  "z,f,g", flags, v9 }, \
@@ -1492,90 +1492,90 @@ cond ("bz",	"tz",   CONDZ, F_CONDBR|F_ALIAS), /* for e */
 { opcode, F3F(2, 0x35, 0x080+fpsize)|MCOND(fcond,0), F3F(~2, ~0x35, ~(0x080+fpsize))|MCOND(~fcond,~0), "8,f,g", flags | F_FLOAT, v9 }, \
 { opcode, F3F(2, 0x35, 0x0c0+fpsize)|MCOND(fcond,0), F3F(~2, ~0x35, ~(0x0c0+fpsize))|MCOND(~fcond,~0), "9,f,g", flags | F_FLOAT, v9 }
 
-/* v9 */ fmovcc  ("fmovda",	FM_DF, CONDA, FCONDA, 0),
-/* v9 */ fmovcc  ("fmovqa",	FM_QF, CONDA, FCONDA, 0),
-/* v9 */ fmovcc  ("fmovsa",	FM_SF, CONDA, FCONDA, 0),
-/* v9 */ fmovicc ("fmovdcc",	FM_DF, CONDCC, 0),
-/* v9 */ fmovicc ("fmovqcc",	FM_QF, CONDCC, 0),
-/* v9 */ fmovicc ("fmovscc",	FM_SF, CONDCC, 0),
-/* v9 */ fmovicc ("fmovdcs",	FM_DF, CONDCS, 0),
-/* v9 */ fmovicc ("fmovqcs",	FM_QF, CONDCS, 0),
-/* v9 */ fmovicc ("fmovscs",	FM_SF, CONDCS, 0),
-/* v9 */ fmovcc  ("fmovde",	FM_DF, CONDE, FCONDE, 0),
-/* v9 */ fmovcc  ("fmovqe",	FM_QF, CONDE, FCONDE, 0),
-/* v9 */ fmovcc  ("fmovse",	FM_SF, CONDE, FCONDE, 0),
-/* v9 */ fmovcc  ("fmovdg",	FM_DF, CONDG, FCONDG, 0),
-/* v9 */ fmovcc  ("fmovqg",	FM_QF, CONDG, FCONDG, 0),
-/* v9 */ fmovcc  ("fmovsg",	FM_SF, CONDG, FCONDG, 0),
-/* v9 */ fmovcc  ("fmovdge",	FM_DF, CONDGE, FCONDGE, 0),
-/* v9 */ fmovcc  ("fmovqge",	FM_QF, CONDGE, FCONDGE, 0),
-/* v9 */ fmovcc  ("fmovsge",	FM_SF, CONDGE, FCONDGE, 0),
-/* v9 */ fmovicc ("fmovdgeu",	FM_DF, CONDGEU, F_ALIAS),
-/* v9 */ fmovicc ("fmovqgeu",	FM_QF, CONDGEU, F_ALIAS),
-/* v9 */ fmovicc ("fmovsgeu",	FM_SF, CONDGEU, F_ALIAS),
-/* v9 */ fmovicc ("fmovdgu",	FM_DF, CONDGU, 0),
-/* v9 */ fmovicc ("fmovqgu",	FM_QF, CONDGU, 0),
-/* v9 */ fmovicc ("fmovsgu",	FM_SF, CONDGU, 0),
-/* v9 */ fmovcc  ("fmovdl",	FM_DF, CONDL, FCONDL, 0),
-/* v9 */ fmovcc  ("fmovql",	FM_QF, CONDL, FCONDL, 0),
-/* v9 */ fmovcc  ("fmovsl",	FM_SF, CONDL, FCONDL, 0),
-/* v9 */ fmovcc  ("fmovdle",	FM_DF, CONDLE, FCONDLE, 0),
-/* v9 */ fmovcc  ("fmovqle",	FM_QF, CONDLE, FCONDLE, 0),
-/* v9 */ fmovcc  ("fmovsle",	FM_SF, CONDLE, FCONDLE, 0),
-/* v9 */ fmovicc ("fmovdleu",	FM_DF, CONDLEU, 0),
-/* v9 */ fmovicc ("fmovqleu",	FM_QF, CONDLEU, 0),
-/* v9 */ fmovicc ("fmovsleu",	FM_SF, CONDLEU, 0),
-/* v9 */ fmovfcc ("fmovdlg",	FM_DF, FCONDLG, 0),
-/* v9 */ fmovfcc ("fmovqlg",	FM_QF, FCONDLG, 0),
-/* v9 */ fmovfcc ("fmovslg",	FM_SF, FCONDLG, 0),
-/* v9 */ fmovicc ("fmovdlu",	FM_DF, CONDLU, F_ALIAS),
-/* v9 */ fmovicc ("fmovqlu",	FM_QF, CONDLU, F_ALIAS),
-/* v9 */ fmovicc ("fmovslu",	FM_SF, CONDLU, F_ALIAS),
-/* v9 */ fmovcc  ("fmovdn",	FM_DF, CONDN, FCONDN, 0),
-/* v9 */ fmovcc  ("fmovqn",	FM_QF, CONDN, FCONDN, 0),
-/* v9 */ fmovcc  ("fmovsn",	FM_SF, CONDN, FCONDN, 0),
-/* v9 */ fmovcc  ("fmovdne",	FM_DF, CONDNE, FCONDNE, 0),
-/* v9 */ fmovcc  ("fmovqne",	FM_QF, CONDNE, FCONDNE, 0),
-/* v9 */ fmovcc  ("fmovsne",	FM_SF, CONDNE, FCONDNE, 0),
-/* v9 */ fmovicc ("fmovdneg",	FM_DF, CONDNEG, 0),
-/* v9 */ fmovicc ("fmovqneg",	FM_QF, CONDNEG, 0),
-/* v9 */ fmovicc ("fmovsneg",	FM_SF, CONDNEG, 0),
-/* v9 */ fmovcc  ("fmovdnz",	FM_DF, CONDNZ, FCONDNZ, F_ALIAS),
-/* v9 */ fmovcc  ("fmovqnz",	FM_QF, CONDNZ, FCONDNZ, F_ALIAS),
-/* v9 */ fmovcc  ("fmovsnz",	FM_SF, CONDNZ, FCONDNZ, F_ALIAS),
-/* v9 */ fmovfcc ("fmovdo",	FM_DF, FCONDO, 0),
-/* v9 */ fmovfcc ("fmovqo",	FM_QF, FCONDO, 0),
-/* v9 */ fmovfcc ("fmovso",	FM_SF, FCONDO, 0),
-/* v9 */ fmovicc ("fmovdpos",	FM_DF, CONDPOS, 0),
-/* v9 */ fmovicc ("fmovqpos",	FM_QF, CONDPOS, 0),
-/* v9 */ fmovicc ("fmovspos",	FM_SF, CONDPOS, 0),
-/* v9 */ fmovfcc ("fmovdu",	FM_DF, FCONDU, 0),
-/* v9 */ fmovfcc ("fmovqu",	FM_QF, FCONDU, 0),
-/* v9 */ fmovfcc ("fmovsu",	FM_SF, FCONDU, 0),
-/* v9 */ fmovfcc ("fmovdue",	FM_DF, FCONDUE, 0),
-/* v9 */ fmovfcc ("fmovque",	FM_QF, FCONDUE, 0),
-/* v9 */ fmovfcc ("fmovsue",	FM_SF, FCONDUE, 0),
-/* v9 */ fmovfcc ("fmovdug",	FM_DF, FCONDUG, 0),
-/* v9 */ fmovfcc ("fmovqug",	FM_QF, FCONDUG, 0),
-/* v9 */ fmovfcc ("fmovsug",	FM_SF, FCONDUG, 0),
-/* v9 */ fmovfcc ("fmovduge",	FM_DF, FCONDUGE, 0),
-/* v9 */ fmovfcc ("fmovquge",	FM_QF, FCONDUGE, 0),
-/* v9 */ fmovfcc ("fmovsuge",	FM_SF, FCONDUGE, 0),
-/* v9 */ fmovfcc ("fmovdul",	FM_DF, FCONDUL, 0),
-/* v9 */ fmovfcc ("fmovqul",	FM_QF, FCONDUL, 0),
-/* v9 */ fmovfcc ("fmovsul",	FM_SF, FCONDUL, 0),
-/* v9 */ fmovfcc ("fmovdule",	FM_DF, FCONDULE, 0),
-/* v9 */ fmovfcc ("fmovqule",	FM_QF, FCONDULE, 0),
-/* v9 */ fmovfcc ("fmovsule",	FM_SF, FCONDULE, 0),
-/* v9 */ fmovicc ("fmovdvc",	FM_DF, CONDVC, 0),
-/* v9 */ fmovicc ("fmovqvc",	FM_QF, CONDVC, 0),
-/* v9 */ fmovicc ("fmovsvc",	FM_SF, CONDVC, 0),
-/* v9 */ fmovicc ("fmovdvs",	FM_DF, CONDVS, 0),
-/* v9 */ fmovicc ("fmovqvs",	FM_QF, CONDVS, 0),
-/* v9 */ fmovicc ("fmovsvs",	FM_SF, CONDVS, 0),
-/* v9 */ fmovcc  ("fmovdz",	FM_DF, CONDZ, FCONDZ, F_ALIAS),
-/* v9 */ fmovcc  ("fmovqz",	FM_QF, CONDZ, FCONDZ, F_ALIAS),
-/* v9 */ fmovcc  ("fmovsz",	FM_SF, CONDZ, FCONDZ, F_ALIAS),
+/* v9 */ fmovcc  ("fmovda",     FM_DF, CONDA, FCONDA, 0),
+/* v9 */ fmovcc  ("fmovqa",     FM_QF, CONDA, FCONDA, 0),
+/* v9 */ fmovcc  ("fmovsa",     FM_SF, CONDA, FCONDA, 0),
+/* v9 */ fmovicc ("fmovdcc",    FM_DF, CONDCC, 0),
+/* v9 */ fmovicc ("fmovqcc",    FM_QF, CONDCC, 0),
+/* v9 */ fmovicc ("fmovscc",    FM_SF, CONDCC, 0),
+/* v9 */ fmovicc ("fmovdcs",    FM_DF, CONDCS, 0),
+/* v9 */ fmovicc ("fmovqcs",    FM_QF, CONDCS, 0),
+/* v9 */ fmovicc ("fmovscs",    FM_SF, CONDCS, 0),
+/* v9 */ fmovcc  ("fmovde",     FM_DF, CONDE, FCONDE, 0),
+/* v9 */ fmovcc  ("fmovqe",     FM_QF, CONDE, FCONDE, 0),
+/* v9 */ fmovcc  ("fmovse",     FM_SF, CONDE, FCONDE, 0),
+/* v9 */ fmovcc  ("fmovdg",     FM_DF, CONDG, FCONDG, 0),
+/* v9 */ fmovcc  ("fmovqg",     FM_QF, CONDG, FCONDG, 0),
+/* v9 */ fmovcc  ("fmovsg",     FM_SF, CONDG, FCONDG, 0),
+/* v9 */ fmovcc  ("fmovdge",    FM_DF, CONDGE, FCONDGE, 0),
+/* v9 */ fmovcc  ("fmovqge",    FM_QF, CONDGE, FCONDGE, 0),
+/* v9 */ fmovcc  ("fmovsge",    FM_SF, CONDGE, FCONDGE, 0),
+/* v9 */ fmovicc ("fmovdgeu",   FM_DF, CONDGEU, F_ALIAS),
+/* v9 */ fmovicc ("fmovqgeu",   FM_QF, CONDGEU, F_ALIAS),
+/* v9 */ fmovicc ("fmovsgeu",   FM_SF, CONDGEU, F_ALIAS),
+/* v9 */ fmovicc ("fmovdgu",    FM_DF, CONDGU, 0),
+/* v9 */ fmovicc ("fmovqgu",    FM_QF, CONDGU, 0),
+/* v9 */ fmovicc ("fmovsgu",    FM_SF, CONDGU, 0),
+/* v9 */ fmovcc  ("fmovdl",     FM_DF, CONDL, FCONDL, 0),
+/* v9 */ fmovcc  ("fmovql",     FM_QF, CONDL, FCONDL, 0),
+/* v9 */ fmovcc  ("fmovsl",     FM_SF, CONDL, FCONDL, 0),
+/* v9 */ fmovcc  ("fmovdle",    FM_DF, CONDLE, FCONDLE, 0),
+/* v9 */ fmovcc  ("fmovqle",    FM_QF, CONDLE, FCONDLE, 0),
+/* v9 */ fmovcc  ("fmovsle",    FM_SF, CONDLE, FCONDLE, 0),
+/* v9 */ fmovicc ("fmovdleu",   FM_DF, CONDLEU, 0),
+/* v9 */ fmovicc ("fmovqleu",   FM_QF, CONDLEU, 0),
+/* v9 */ fmovicc ("fmovsleu",   FM_SF, CONDLEU, 0),
+/* v9 */ fmovfcc ("fmovdlg",    FM_DF, FCONDLG, 0),
+/* v9 */ fmovfcc ("fmovqlg",    FM_QF, FCONDLG, 0),
+/* v9 */ fmovfcc ("fmovslg",    FM_SF, FCONDLG, 0),
+/* v9 */ fmovicc ("fmovdlu",    FM_DF, CONDLU, F_ALIAS),
+/* v9 */ fmovicc ("fmovqlu",    FM_QF, CONDLU, F_ALIAS),
+/* v9 */ fmovicc ("fmovslu",    FM_SF, CONDLU, F_ALIAS),
+/* v9 */ fmovcc  ("fmovdn",     FM_DF, CONDN, FCONDN, 0),
+/* v9 */ fmovcc  ("fmovqn",     FM_QF, CONDN, FCONDN, 0),
+/* v9 */ fmovcc  ("fmovsn",     FM_SF, CONDN, FCONDN, 0),
+/* v9 */ fmovcc  ("fmovdne",    FM_DF, CONDNE, FCONDNE, 0),
+/* v9 */ fmovcc  ("fmovqne",    FM_QF, CONDNE, FCONDNE, 0),
+/* v9 */ fmovcc  ("fmovsne",    FM_SF, CONDNE, FCONDNE, 0),
+/* v9 */ fmovicc ("fmovdneg",   FM_DF, CONDNEG, 0),
+/* v9 */ fmovicc ("fmovqneg",   FM_QF, CONDNEG, 0),
+/* v9 */ fmovicc ("fmovsneg",   FM_SF, CONDNEG, 0),
+/* v9 */ fmovcc  ("fmovdnz",    FM_DF, CONDNZ, FCONDNZ, F_ALIAS),
+/* v9 */ fmovcc  ("fmovqnz",    FM_QF, CONDNZ, FCONDNZ, F_ALIAS),
+/* v9 */ fmovcc  ("fmovsnz",    FM_SF, CONDNZ, FCONDNZ, F_ALIAS),
+/* v9 */ fmovfcc ("fmovdo",     FM_DF, FCONDO, 0),
+/* v9 */ fmovfcc ("fmovqo",     FM_QF, FCONDO, 0),
+/* v9 */ fmovfcc ("fmovso",     FM_SF, FCONDO, 0),
+/* v9 */ fmovicc ("fmovdpos",   FM_DF, CONDPOS, 0),
+/* v9 */ fmovicc ("fmovqpos",   FM_QF, CONDPOS, 0),
+/* v9 */ fmovicc ("fmovspos",   FM_SF, CONDPOS, 0),
+/* v9 */ fmovfcc ("fmovdu",     FM_DF, FCONDU, 0),
+/* v9 */ fmovfcc ("fmovqu",     FM_QF, FCONDU, 0),
+/* v9 */ fmovfcc ("fmovsu",     FM_SF, FCONDU, 0),
+/* v9 */ fmovfcc ("fmovdue",    FM_DF, FCONDUE, 0),
+/* v9 */ fmovfcc ("fmovque",    FM_QF, FCONDUE, 0),
+/* v9 */ fmovfcc ("fmovsue",    FM_SF, FCONDUE, 0),
+/* v9 */ fmovfcc ("fmovdug",    FM_DF, FCONDUG, 0),
+/* v9 */ fmovfcc ("fmovqug",    FM_QF, FCONDUG, 0),
+/* v9 */ fmovfcc ("fmovsug",    FM_SF, FCONDUG, 0),
+/* v9 */ fmovfcc ("fmovduge",   FM_DF, FCONDUGE, 0),
+/* v9 */ fmovfcc ("fmovquge",   FM_QF, FCONDUGE, 0),
+/* v9 */ fmovfcc ("fmovsuge",   FM_SF, FCONDUGE, 0),
+/* v9 */ fmovfcc ("fmovdul",    FM_DF, FCONDUL, 0),
+/* v9 */ fmovfcc ("fmovqul",    FM_QF, FCONDUL, 0),
+/* v9 */ fmovfcc ("fmovsul",    FM_SF, FCONDUL, 0),
+/* v9 */ fmovfcc ("fmovdule",   FM_DF, FCONDULE, 0),
+/* v9 */ fmovfcc ("fmovqule",   FM_QF, FCONDULE, 0),
+/* v9 */ fmovfcc ("fmovsule",   FM_SF, FCONDULE, 0),
+/* v9 */ fmovicc ("fmovdvc",    FM_DF, CONDVC, 0),
+/* v9 */ fmovicc ("fmovqvc",    FM_QF, CONDVC, 0),
+/* v9 */ fmovicc ("fmovsvc",    FM_SF, CONDVC, 0),
+/* v9 */ fmovicc ("fmovdvs",    FM_DF, CONDVS, 0),
+/* v9 */ fmovicc ("fmovqvs",    FM_QF, CONDVS, 0),
+/* v9 */ fmovicc ("fmovsvs",    FM_SF, CONDVS, 0),
+/* v9 */ fmovcc  ("fmovdz",     FM_DF, CONDZ, FCONDZ, F_ALIAS),
+/* v9 */ fmovcc  ("fmovqz",     FM_QF, CONDZ, FCONDZ, F_ALIAS),
+/* v9 */ fmovcc  ("fmovsz",     FM_SF, CONDZ, FCONDZ, F_ALIAS),
 
 #undef fmovicc /* v9 */
 #undef fmovfcc /* v9 */
@@ -1641,19 +1641,19 @@ cond ("bz",	"tz",   CONDZ, F_CONDBR|F_ALIAS), /* for e */
   FBR(fop, F2(0, 6)|COND(mask), F2(~0, ~6)|COND(~(mask)), flags)
 
 CONDFC  ("fb",    "cb",    0x8, F_UNBR),
-CONDFCL ("fba",	  "cba",   0x8, F_UNBR|F_ALIAS),
-CONDFC  ("fbe",	  "cb0",   0x9, F_CONDBR),
+CONDFCL ("fba",   "cba",   0x8, F_UNBR|F_ALIAS),
+CONDFC  ("fbe",   "cb0",   0x9, F_CONDBR),
 CONDF   ("fbz",            0x9, F_CONDBR|F_ALIAS),
-CONDFC  ("fbg",	  "cb2",   0x6, F_CONDBR),
+CONDFC  ("fbg",   "cb2",   0x6, F_CONDBR),
 CONDFC  ("fbge",  "cb02",  0xb, F_CONDBR),
-CONDFC  ("fbl",	  "cb1",   0x4, F_CONDBR),
+CONDFC  ("fbl",   "cb1",   0x4, F_CONDBR),
 CONDFC  ("fble",  "cb01",  0xd, F_CONDBR),
 CONDFC  ("fblg",  "cb12",  0x2, F_CONDBR),
-CONDFCL ("fbn",	  "cbn",   0x0, F_UNBR),
+CONDFCL ("fbn",   "cbn",   0x0, F_UNBR),
 CONDFC  ("fbne",  "cb123", 0x1, F_CONDBR),
 CONDF   ("fbnz",           0x1, F_CONDBR|F_ALIAS),
-CONDFC  ("fbo",	  "cb012", 0xf, F_CONDBR),
-CONDFC  ("fbu",	  "cb3",   0x7, F_CONDBR),
+CONDFC  ("fbo",   "cb012", 0xf, F_CONDBR),
+CONDFC  ("fbu",   "cb3",   0x7, F_CONDBR),
 CONDFC  ("fbue",  "cb03",  0xa, F_CONDBR),
 CONDFC  ("fbug",  "cb23",  0x5, F_CONDBR),
 CONDFC  ("fbuge", "cb023", 0xc, F_CONDBR),
@@ -1665,167 +1665,167 @@ CONDFC  ("fbule", "cb013", 0xe, F_CONDBR),
 #undef CONDF
 #undef CBR
 #undef FBR
-#undef FBRX	/* v9 */
+#undef FBRX     /* v9 */
 
-{ "jmp",	F3(2, 0x38, 0), F3(~2, ~0x38, ~0)|RD_G0|ASI(~0),	"1+2", F_UNBR|F_DELAYED, v6 }, /* jmpl rs1+rs2,%g0 */
-{ "jmp",	F3(2, 0x38, 0), F3(~2, ~0x38, ~0)|RD_G0|ASI_RS2(~0),	"1", F_UNBR|F_DELAYED, v6 }, /* jmpl rs1+%g0,%g0 */
-{ "jmp",	F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|RD_G0,		"1+i", F_UNBR|F_DELAYED, v6 }, /* jmpl rs1+i,%g0 */
-{ "jmp",	F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|RD_G0,		"i+1", F_UNBR|F_DELAYED, v6 }, /* jmpl i+rs1,%g0 */
-{ "jmp",	F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|RD_G0|RS1_G0,		"i", F_UNBR|F_DELAYED, v6 }, /* jmpl %g0+i,%g0 */
-{ "jmp",	F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|RD_G0|SIMM13(~0),	"1", F_UNBR|F_DELAYED, v6 }, /* jmpl rs1+0,%g0 */
+{ "jmp",        F3(2, 0x38, 0), F3(~2, ~0x38, ~0)|RD_G0|ASI(~0),        "1+2", F_UNBR|F_DELAYED, v6 }, /* jmpl rs1+rs2,%g0 */
+{ "jmp",        F3(2, 0x38, 0), F3(~2, ~0x38, ~0)|RD_G0|ASI_RS2(~0),    "1", F_UNBR|F_DELAYED, v6 }, /* jmpl rs1+%g0,%g0 */
+{ "jmp",        F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|RD_G0,                "1+i", F_UNBR|F_DELAYED, v6 }, /* jmpl rs1+i,%g0 */
+{ "jmp",        F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|RD_G0,                "i+1", F_UNBR|F_DELAYED, v6 }, /* jmpl i+rs1,%g0 */
+{ "jmp",        F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|RD_G0|RS1_G0,         "i", F_UNBR|F_DELAYED, v6 }, /* jmpl %g0+i,%g0 */
+{ "jmp",        F3(2, 0x38, 1), F3(~2, ~0x38, ~1)|RD_G0|SIMM13(~0),     "1", F_UNBR|F_DELAYED, v6 }, /* jmpl rs1+0,%g0 */
 
-{ "nop",	F2(0, 4), 0xfeffffff, "", 0, v6 }, /* sethi 0, %g0 */
+{ "nop",        F2(0, 4), 0xfeffffff, "", 0, v6 }, /* sethi 0, %g0 */
 
-{ "set",	F2(0x0, 0x4), F2(~0x0, ~0x4), "S0,d", F_ALIAS, v6 },
-{ "setuw",	F2(0x0, 0x4), F2(~0x0, ~0x4), "S0,d", F_ALIAS, v9 },
-{ "setsw",	F2(0x0, 0x4), F2(~0x0, ~0x4), "S0,d", F_ALIAS, v9 },
-{ "setx",	F2(0x0, 0x4), F2(~0x0, ~0x4), "S0,1,d", F_ALIAS, v9 },
+{ "set",        F2(0x0, 0x4), F2(~0x0, ~0x4), "S0,d", F_ALIAS, v6 },
+{ "setuw",      F2(0x0, 0x4), F2(~0x0, ~0x4), "S0,d", F_ALIAS, v9 },
+{ "setsw",      F2(0x0, 0x4), F2(~0x0, ~0x4), "S0,d", F_ALIAS, v9 },
+{ "setx",       F2(0x0, 0x4), F2(~0x0, ~0x4), "S0,1,d", F_ALIAS, v9 },
 
-{ "sethi",	F2(0x0, 0x4), F2(~0x0, ~0x4), "h,d", 0, v6 },
+{ "sethi",      F2(0x0, 0x4), F2(~0x0, ~0x4), "h,d", 0, v6 },
 
-{ "taddcc",	F3(2, 0x20, 0), F3(~2, ~0x20, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "taddcc",	F3(2, 0x20, 1), F3(~2, ~0x20, ~1),		"1,i,d", 0, v6 },
-{ "taddcc",	F3(2, 0x20, 1), F3(~2, ~0x20, ~1),		"i,1,d", 0, v6 },
-{ "taddcctv",	F3(2, 0x22, 0), F3(~2, ~0x22, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "taddcctv",	F3(2, 0x22, 1), F3(~2, ~0x22, ~1),		"1,i,d", 0, v6 },
-{ "taddcctv",	F3(2, 0x22, 1), F3(~2, ~0x22, ~1),		"i,1,d", 0, v6 },
+{ "taddcc",     F3(2, 0x20, 0), F3(~2, ~0x20, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "taddcc",     F3(2, 0x20, 1), F3(~2, ~0x20, ~1),              "1,i,d", 0, v6 },
+{ "taddcc",     F3(2, 0x20, 1), F3(~2, ~0x20, ~1),              "i,1,d", 0, v6 },
+{ "taddcctv",   F3(2, 0x22, 0), F3(~2, ~0x22, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "taddcctv",   F3(2, 0x22, 1), F3(~2, ~0x22, ~1),              "1,i,d", 0, v6 },
+{ "taddcctv",   F3(2, 0x22, 1), F3(~2, ~0x22, ~1),              "i,1,d", 0, v6 },
 
-{ "tsubcc",	F3(2, 0x21, 0), F3(~2, ~0x21, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "tsubcc",	F3(2, 0x21, 1), F3(~2, ~0x21, ~1),		"1,i,d", 0, v6 },
-{ "tsubcctv",	F3(2, 0x23, 0), F3(~2, ~0x23, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "tsubcctv",	F3(2, 0x23, 1), F3(~2, ~0x23, ~1),		"1,i,d", 0, v6 },
+{ "tsubcc",     F3(2, 0x21, 0), F3(~2, ~0x21, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "tsubcc",     F3(2, 0x21, 1), F3(~2, ~0x21, ~1),              "1,i,d", 0, v6 },
+{ "tsubcctv",   F3(2, 0x23, 0), F3(~2, ~0x23, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "tsubcctv",   F3(2, 0x23, 1), F3(~2, ~0x23, ~1),              "1,i,d", 0, v6 },
 
-{ "unimp",	F2(0x0, 0x0), 0xffc00000, "n", 0, v6notv9 },
-{ "illtrap",	F2(0, 0), F2(~0, ~0)|RD_G0, "n", 0, v9 },
+{ "unimp",      F2(0x0, 0x0), 0xffc00000, "n", 0, v6notv9 },
+{ "illtrap",    F2(0, 0), F2(~0, ~0)|RD_G0, "n", 0, v9 },
 
 /* This *is* a commutative instruction.  */
-{ "xnor",	F3(2, 0x07, 0), F3(~2, ~0x07, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "xnor",	F3(2, 0x07, 1), F3(~2, ~0x07, ~1),		"1,i,d", 0, v6 },
-{ "xnor",	F3(2, 0x07, 1), F3(~2, ~0x07, ~1),		"i,1,d", 0, v6 },
+{ "xnor",       F3(2, 0x07, 0), F3(~2, ~0x07, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "xnor",       F3(2, 0x07, 1), F3(~2, ~0x07, ~1),              "1,i,d", 0, v6 },
+{ "xnor",       F3(2, 0x07, 1), F3(~2, ~0x07, ~1),              "i,1,d", 0, v6 },
 /* This *is* a commutative instruction.  */
-{ "xnorcc",	F3(2, 0x17, 0), F3(~2, ~0x17, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "xnorcc",	F3(2, 0x17, 1), F3(~2, ~0x17, ~1),		"1,i,d", 0, v6 },
-{ "xnorcc",	F3(2, 0x17, 1), F3(~2, ~0x17, ~1),		"i,1,d", 0, v6 },
-{ "xor",	F3(2, 0x03, 0), F3(~2, ~0x03, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "xor",	F3(2, 0x03, 1), F3(~2, ~0x03, ~1),		"1,i,d", 0, v6 },
-{ "xor",	F3(2, 0x03, 1), F3(~2, ~0x03, ~1),		"i,1,d", 0, v6 },
-{ "xorcc",	F3(2, 0x13, 0), F3(~2, ~0x13, ~0)|ASI(~0),	"1,2,d", 0, v6 },
-{ "xorcc",	F3(2, 0x13, 1), F3(~2, ~0x13, ~1),		"1,i,d", 0, v6 },
-{ "xorcc",	F3(2, 0x13, 1), F3(~2, ~0x13, ~1),		"i,1,d", 0, v6 },
-
-{ "not",	F3(2, 0x07, 0), F3(~2, ~0x07, ~0)|ASI(~0), "1,d", F_ALIAS, v6 }, /* xnor rs1,%0,rd */
-{ "not",	F3(2, 0x07, 0), F3(~2, ~0x07, ~0)|ASI(~0), "r", F_ALIAS, v6 }, /* xnor rd,%0,rd */
-
-{ "btog",	F3(2, 0x03, 0), F3(~2, ~0x03, ~0)|ASI(~0),	"2,r", F_ALIAS, v6 }, /* xor rd,rs2,rd */
-{ "btog",	F3(2, 0x03, 1), F3(~2, ~0x03, ~1),		"i,r", F_ALIAS, v6 }, /* xor rd,i,rd */
+{ "xnorcc",     F3(2, 0x17, 0), F3(~2, ~0x17, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "xnorcc",     F3(2, 0x17, 1), F3(~2, ~0x17, ~1),              "1,i,d", 0, v6 },
+{ "xnorcc",     F3(2, 0x17, 1), F3(~2, ~0x17, ~1),              "i,1,d", 0, v6 },
+{ "xor",        F3(2, 0x03, 0), F3(~2, ~0x03, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "xor",        F3(2, 0x03, 1), F3(~2, ~0x03, ~1),              "1,i,d", 0, v6 },
+{ "xor",        F3(2, 0x03, 1), F3(~2, ~0x03, ~1),              "i,1,d", 0, v6 },
+{ "xorcc",      F3(2, 0x13, 0), F3(~2, ~0x13, ~0)|ASI(~0),      "1,2,d", 0, v6 },
+{ "xorcc",      F3(2, 0x13, 1), F3(~2, ~0x13, ~1),              "1,i,d", 0, v6 },
+{ "xorcc",      F3(2, 0x13, 1), F3(~2, ~0x13, ~1),              "i,1,d", 0, v6 },
+
+{ "not",        F3(2, 0x07, 0), F3(~2, ~0x07, ~0)|ASI(~0), "1,d", F_ALIAS, v6 }, /* xnor rs1,%0,rd */
+{ "not",        F3(2, 0x07, 0), F3(~2, ~0x07, ~0)|ASI(~0), "r", F_ALIAS, v6 }, /* xnor rd,%0,rd */
+
+{ "btog",       F3(2, 0x03, 0), F3(~2, ~0x03, ~0)|ASI(~0),      "2,r", F_ALIAS, v6 }, /* xor rd,rs2,rd */
+{ "btog",       F3(2, 0x03, 1), F3(~2, ~0x03, ~1),              "i,r", F_ALIAS, v6 }, /* xor rd,i,rd */
 
 /* FPop1 and FPop2 are not instructions.  Don't accept them.  */
 
-{ "fdtoi",	F3F(2, 0x34, 0x0d2), F3F(~2, ~0x34, ~0x0d2)|RS1_G0, "B,g", F_FLOAT, v6 },
-{ "fstoi",	F3F(2, 0x34, 0x0d1), F3F(~2, ~0x34, ~0x0d1)|RS1_G0, "f,g", F_FLOAT, v6 },
-{ "fqtoi",	F3F(2, 0x34, 0x0d3), F3F(~2, ~0x34, ~0x0d3)|RS1_G0, "R,g", F_FLOAT, v8 },
-
-{ "fdtox",	F3F(2, 0x34, 0x082), F3F(~2, ~0x34, ~0x082)|RS1_G0, "B,g", F_FLOAT, v9 },
-{ "fstox",	F3F(2, 0x34, 0x081), F3F(~2, ~0x34, ~0x081)|RS1_G0, "f,g", F_FLOAT, v9 },
-{ "fqtox",	F3F(2, 0x34, 0x083), F3F(~2, ~0x34, ~0x083)|RS1_G0, "R,g", F_FLOAT, v9 },
-
-{ "fitod",	F3F(2, 0x34, 0x0c8), F3F(~2, ~0x34, ~0x0c8)|RS1_G0, "f,H", F_FLOAT, v6 },
-{ "fitos",	F3F(2, 0x34, 0x0c4), F3F(~2, ~0x34, ~0x0c4)|RS1_G0, "f,g", F_FLOAT, v6 },
-{ "fitoq",	F3F(2, 0x34, 0x0cc), F3F(~2, ~0x34, ~0x0cc)|RS1_G0, "f,J", F_FLOAT, v8 },
-
-{ "fxtod",	F3F(2, 0x34, 0x088), F3F(~2, ~0x34, ~0x088)|RS1_G0, "f,H", F_FLOAT, v9 },
-{ "fxtos",	F3F(2, 0x34, 0x084), F3F(~2, ~0x34, ~0x084)|RS1_G0, "f,g", F_FLOAT, v9 },
-{ "fxtoq",	F3F(2, 0x34, 0x08c), F3F(~2, ~0x34, ~0x08c)|RS1_G0, "f,J", F_FLOAT, v9 },
-
-{ "fdtoq",	F3F(2, 0x34, 0x0ce), F3F(~2, ~0x34, ~0x0ce)|RS1_G0, "B,J", F_FLOAT, v8 },
-{ "fdtos",	F3F(2, 0x34, 0x0c6), F3F(~2, ~0x34, ~0x0c6)|RS1_G0, "B,g", F_FLOAT, v6 },
-{ "fqtod",	F3F(2, 0x34, 0x0cb), F3F(~2, ~0x34, ~0x0cb)|RS1_G0, "R,H", F_FLOAT, v8 },
-{ "fqtos",	F3F(2, 0x34, 0x0c7), F3F(~2, ~0x34, ~0x0c7)|RS1_G0, "R,g", F_FLOAT, v8 },
-{ "fstod",	F3F(2, 0x34, 0x0c9), F3F(~2, ~0x34, ~0x0c9)|RS1_G0, "f,H", F_FLOAT, v6 },
-{ "fstoq",	F3F(2, 0x34, 0x0cd), F3F(~2, ~0x34, ~0x0cd)|RS1_G0, "f,J", F_FLOAT, v8 },
-
-{ "fdivd",	F3F(2, 0x34, 0x04e), F3F(~2, ~0x34, ~0x04e), "v,B,H", F_FLOAT, v6 },
-{ "fdivq",	F3F(2, 0x34, 0x04f), F3F(~2, ~0x34, ~0x04f), "V,R,J", F_FLOAT, v8 },
-{ "fdivx",	F3F(2, 0x34, 0x04f), F3F(~2, ~0x34, ~0x04f), "V,R,J", F_FLOAT|F_ALIAS, v8 },
-{ "fdivs",	F3F(2, 0x34, 0x04d), F3F(~2, ~0x34, ~0x04d), "e,f,g", F_FLOAT, v6 },
-{ "fmuld",	F3F(2, 0x34, 0x04a), F3F(~2, ~0x34, ~0x04a), "v,B,H", F_FLOAT, v6 },
-{ "fmulq",	F3F(2, 0x34, 0x04b), F3F(~2, ~0x34, ~0x04b), "V,R,J", F_FLOAT, v8 },
-{ "fmulx",	F3F(2, 0x34, 0x04b), F3F(~2, ~0x34, ~0x04b), "V,R,J", F_FLOAT|F_ALIAS, v8 },
-{ "fmuls",	F3F(2, 0x34, 0x049), F3F(~2, ~0x34, ~0x049), "e,f,g", F_FLOAT, v6 },
-
-{ "fdmulq",	F3F(2, 0x34, 0x06e), F3F(~2, ~0x34, ~0x06e), "v,B,J", F_FLOAT, v8 },
-{ "fdmulx",	F3F(2, 0x34, 0x06e), F3F(~2, ~0x34, ~0x06e), "v,B,J", F_FLOAT|F_ALIAS, v8 },
-{ "fsmuld",	F3F(2, 0x34, 0x069), F3F(~2, ~0x34, ~0x069), "e,f,H", F_FLOAT, v8 },
-
-{ "fsqrtd",	F3F(2, 0x34, 0x02a), F3F(~2, ~0x34, ~0x02a)|RS1_G0, "B,H", F_FLOAT, v7 },
-{ "fsqrtq",	F3F(2, 0x34, 0x02b), F3F(~2, ~0x34, ~0x02b)|RS1_G0, "R,J", F_FLOAT, v8 },
-{ "fsqrtx",	F3F(2, 0x34, 0x02b), F3F(~2, ~0x34, ~0x02b)|RS1_G0, "R,J", F_FLOAT|F_ALIAS, v8 },
-{ "fsqrts",	F3F(2, 0x34, 0x029), F3F(~2, ~0x34, ~0x029)|RS1_G0, "f,g", F_FLOAT, v7 },
-
-{ "fabsd",	F3F(2, 0x34, 0x00a), F3F(~2, ~0x34, ~0x00a)|RS1_G0, "B,H", F_FLOAT, v9 },
-{ "fabsq",	F3F(2, 0x34, 0x00b), F3F(~2, ~0x34, ~0x00b)|RS1_G0, "R,J", F_FLOAT, v9 },
-{ "fabsx",	F3F(2, 0x34, 0x00b), F3F(~2, ~0x34, ~0x00b)|RS1_G0, "R,J", F_FLOAT|F_ALIAS, v9 },
-{ "fabss",	F3F(2, 0x34, 0x009), F3F(~2, ~0x34, ~0x009)|RS1_G0, "f,g", F_FLOAT, v6 },
-{ "fmovd",	F3F(2, 0x34, 0x002), F3F(~2, ~0x34, ~0x002)|RS1_G0, "B,H", F_FLOAT, v9 },
-{ "fmovq",	F3F(2, 0x34, 0x003), F3F(~2, ~0x34, ~0x003)|RS1_G0, "R,J", F_FLOAT, v9 },
-{ "fmovx",	F3F(2, 0x34, 0x003), F3F(~2, ~0x34, ~0x003)|RS1_G0, "R,J", F_FLOAT|F_ALIAS, v9 },
-{ "fmovs",	F3F(2, 0x34, 0x001), F3F(~2, ~0x34, ~0x001)|RS1_G0, "f,g", F_FLOAT, v6 },
-{ "fnegd",	F3F(2, 0x34, 0x006), F3F(~2, ~0x34, ~0x006)|RS1_G0, "B,H", F_FLOAT, v9 },
-{ "fnegq",	F3F(2, 0x34, 0x007), F3F(~2, ~0x34, ~0x007)|RS1_G0, "R,J", F_FLOAT, v9 },
-{ "fnegx",	F3F(2, 0x34, 0x007), F3F(~2, ~0x34, ~0x007)|RS1_G0, "R,J", F_FLOAT|F_ALIAS, v9 },
-{ "fnegs",	F3F(2, 0x34, 0x005), F3F(~2, ~0x34, ~0x005)|RS1_G0, "f,g", F_FLOAT, v6 },
-
-{ "faddd",	F3F(2, 0x34, 0x042), F3F(~2, ~0x34, ~0x042), "v,B,H", F_FLOAT, v6 },
-{ "faddq",	F3F(2, 0x34, 0x043), F3F(~2, ~0x34, ~0x043), "V,R,J", F_FLOAT, v8 },
-{ "faddx",	F3F(2, 0x34, 0x043), F3F(~2, ~0x34, ~0x043), "V,R,J", F_FLOAT|F_ALIAS, v8 },
-{ "fadds",	F3F(2, 0x34, 0x041), F3F(~2, ~0x34, ~0x041), "e,f,g", F_FLOAT, v6 },
-{ "fsubd",	F3F(2, 0x34, 0x046), F3F(~2, ~0x34, ~0x046), "v,B,H", F_FLOAT, v6 },
-{ "fsubq",	F3F(2, 0x34, 0x047), F3F(~2, ~0x34, ~0x047), "V,R,J", F_FLOAT, v8 },
-{ "fsubx",	F3F(2, 0x34, 0x047), F3F(~2, ~0x34, ~0x047), "V,R,J", F_FLOAT|F_ALIAS, v8 },
-{ "fsubs",	F3F(2, 0x34, 0x045), F3F(~2, ~0x34, ~0x045), "e,f,g", F_FLOAT, v6 },
-
-#define CMPFCC(x)	(((x)&0x3)<<25)
-
-{ "fcmpd",	          F3F(2, 0x35, 0x052),            F3F(~2, ~0x35, ~0x052)|RD_G0,  "v,B",   F_FLOAT, v6 },
-{ "fcmpd",	CMPFCC(0)|F3F(2, 0x35, 0x052), CMPFCC(~0)|F3F(~2, ~0x35, ~0x052),	 "6,v,B", F_FLOAT, v9 },
-{ "fcmpd",	CMPFCC(1)|F3F(2, 0x35, 0x052), CMPFCC(~1)|F3F(~2, ~0x35, ~0x052),	 "7,v,B", F_FLOAT, v9 },
-{ "fcmpd",	CMPFCC(2)|F3F(2, 0x35, 0x052), CMPFCC(~2)|F3F(~2, ~0x35, ~0x052),	 "8,v,B", F_FLOAT, v9 },
-{ "fcmpd",	CMPFCC(3)|F3F(2, 0x35, 0x052), CMPFCC(~3)|F3F(~2, ~0x35, ~0x052),	 "9,v,B", F_FLOAT, v9 },
-{ "fcmped",	          F3F(2, 0x35, 0x056),            F3F(~2, ~0x35, ~0x056)|RD_G0,  "v,B",   F_FLOAT, v6 },
-{ "fcmped",	CMPFCC(0)|F3F(2, 0x35, 0x056), CMPFCC(~0)|F3F(~2, ~0x35, ~0x056),	 "6,v,B", F_FLOAT, v9 },
-{ "fcmped",	CMPFCC(1)|F3F(2, 0x35, 0x056), CMPFCC(~1)|F3F(~2, ~0x35, ~0x056),	 "7,v,B", F_FLOAT, v9 },
-{ "fcmped",	CMPFCC(2)|F3F(2, 0x35, 0x056), CMPFCC(~2)|F3F(~2, ~0x35, ~0x056),	 "8,v,B", F_FLOAT, v9 },
-{ "fcmped",	CMPFCC(3)|F3F(2, 0x35, 0x056), CMPFCC(~3)|F3F(~2, ~0x35, ~0x056),	 "9,v,B", F_FLOAT, v9 },
-{ "fcmpq",	          F3F(2, 0x35, 0x053),            F3F(~2, ~0x35, ~0x053)|RD_G0,	 "V,R", F_FLOAT, v8 },
-{ "fcmpq",	CMPFCC(0)|F3F(2, 0x35, 0x053), CMPFCC(~0)|F3F(~2, ~0x35, ~0x053),	 "6,V,R", F_FLOAT, v9 },
-{ "fcmpq",	CMPFCC(1)|F3F(2, 0x35, 0x053), CMPFCC(~1)|F3F(~2, ~0x35, ~0x053),	 "7,V,R", F_FLOAT, v9 },
-{ "fcmpq",	CMPFCC(2)|F3F(2, 0x35, 0x053), CMPFCC(~2)|F3F(~2, ~0x35, ~0x053),	 "8,V,R", F_FLOAT, v9 },
-{ "fcmpq",	CMPFCC(3)|F3F(2, 0x35, 0x053), CMPFCC(~3)|F3F(~2, ~0x35, ~0x053),	 "9,V,R", F_FLOAT, v9 },
-{ "fcmpeq",	          F3F(2, 0x35, 0x057),            F3F(~2, ~0x35, ~0x057)|RD_G0,	 "V,R", F_FLOAT, v8 },
-{ "fcmpeq",	CMPFCC(0)|F3F(2, 0x35, 0x057), CMPFCC(~0)|F3F(~2, ~0x35, ~0x057),	 "6,V,R", F_FLOAT, v9 },
-{ "fcmpeq",	CMPFCC(1)|F3F(2, 0x35, 0x057), CMPFCC(~1)|F3F(~2, ~0x35, ~0x057),	 "7,V,R", F_FLOAT, v9 },
-{ "fcmpeq",	CMPFCC(2)|F3F(2, 0x35, 0x057), CMPFCC(~2)|F3F(~2, ~0x35, ~0x057),	 "8,V,R", F_FLOAT, v9 },
-{ "fcmpeq",	CMPFCC(3)|F3F(2, 0x35, 0x057), CMPFCC(~3)|F3F(~2, ~0x35, ~0x057),	 "9,V,R", F_FLOAT, v9 },
-{ "fcmpx",	          F3F(2, 0x35, 0x053),            F3F(~2, ~0x35, ~0x053)|RD_G0,	 "V,R", F_FLOAT|F_ALIAS, v8 },
-{ "fcmpx",	CMPFCC(0)|F3F(2, 0x35, 0x053), CMPFCC(~0)|F3F(~2, ~0x35, ~0x053),	 "6,V,R", F_FLOAT|F_ALIAS, v9 },
-{ "fcmpx",	CMPFCC(1)|F3F(2, 0x35, 0x053), CMPFCC(~1)|F3F(~2, ~0x35, ~0x053),	 "7,V,R", F_FLOAT|F_ALIAS, v9 },
-{ "fcmpx",	CMPFCC(2)|F3F(2, 0x35, 0x053), CMPFCC(~2)|F3F(~2, ~0x35, ~0x053),	 "8,V,R", F_FLOAT|F_ALIAS, v9 },
-{ "fcmpx",	CMPFCC(3)|F3F(2, 0x35, 0x053), CMPFCC(~3)|F3F(~2, ~0x35, ~0x053),	 "9,V,R", F_FLOAT|F_ALIAS, v9 },
-{ "fcmpex",	          F3F(2, 0x35, 0x057),            F3F(~2, ~0x35, ~0x057)|RD_G0,	 "V,R", F_FLOAT|F_ALIAS, v8 },
-{ "fcmpex",	CMPFCC(0)|F3F(2, 0x35, 0x057), CMPFCC(~0)|F3F(~2, ~0x35, ~0x057),	 "6,V,R", F_FLOAT|F_ALIAS, v9 },
-{ "fcmpex",	CMPFCC(1)|F3F(2, 0x35, 0x057), CMPFCC(~1)|F3F(~2, ~0x35, ~0x057),	 "7,V,R", F_FLOAT|F_ALIAS, v9 },
-{ "fcmpex",	CMPFCC(2)|F3F(2, 0x35, 0x057), CMPFCC(~2)|F3F(~2, ~0x35, ~0x057),	 "8,V,R", F_FLOAT|F_ALIAS, v9 },
-{ "fcmpex",	CMPFCC(3)|F3F(2, 0x35, 0x057), CMPFCC(~3)|F3F(~2, ~0x35, ~0x057),	 "9,V,R", F_FLOAT|F_ALIAS, v9 },
-{ "fcmps",	          F3F(2, 0x35, 0x051),            F3F(~2, ~0x35, ~0x051)|RD_G0, "e,f",   F_FLOAT, v6 },
-{ "fcmps",	CMPFCC(0)|F3F(2, 0x35, 0x051), CMPFCC(~0)|F3F(~2, ~0x35, ~0x051),	 "6,e,f", F_FLOAT, v9 },
-{ "fcmps",	CMPFCC(1)|F3F(2, 0x35, 0x051), CMPFCC(~1)|F3F(~2, ~0x35, ~0x051),	 "7,e,f", F_FLOAT, v9 },
-{ "fcmps",	CMPFCC(2)|F3F(2, 0x35, 0x051), CMPFCC(~2)|F3F(~2, ~0x35, ~0x051),	 "8,e,f", F_FLOAT, v9 },
-{ "fcmps",	CMPFCC(3)|F3F(2, 0x35, 0x051), CMPFCC(~3)|F3F(~2, ~0x35, ~0x051),	 "9,e,f", F_FLOAT, v9 },
-{ "fcmpes",	          F3F(2, 0x35, 0x055),            F3F(~2, ~0x35, ~0x055)|RD_G0, "e,f",   F_FLOAT, v6 },
-{ "fcmpes",	CMPFCC(0)|F3F(2, 0x35, 0x055), CMPFCC(~0)|F3F(~2, ~0x35, ~0x055),	 "6,e,f", F_FLOAT, v9 },
-{ "fcmpes",	CMPFCC(1)|F3F(2, 0x35, 0x055), CMPFCC(~1)|F3F(~2, ~0x35, ~0x055),	 "7,e,f", F_FLOAT, v9 },
-{ "fcmpes",	CMPFCC(2)|F3F(2, 0x35, 0x055), CMPFCC(~2)|F3F(~2, ~0x35, ~0x055),	 "8,e,f", F_FLOAT, v9 },
-{ "fcmpes",	CMPFCC(3)|F3F(2, 0x35, 0x055), CMPFCC(~3)|F3F(~2, ~0x35, ~0x055),	 "9,e,f", F_FLOAT, v9 },
+{ "fdtoi",      F3F(2, 0x34, 0x0d2), F3F(~2, ~0x34, ~0x0d2)|RS1_G0, "B,g", F_FLOAT, v6 },
+{ "fstoi",      F3F(2, 0x34, 0x0d1), F3F(~2, ~0x34, ~0x0d1)|RS1_G0, "f,g", F_FLOAT, v6 },
+{ "fqtoi",      F3F(2, 0x34, 0x0d3), F3F(~2, ~0x34, ~0x0d3)|RS1_G0, "R,g", F_FLOAT, v8 },
+
+{ "fdtox",      F3F(2, 0x34, 0x082), F3F(~2, ~0x34, ~0x082)|RS1_G0, "B,g", F_FLOAT, v9 },
+{ "fstox",      F3F(2, 0x34, 0x081), F3F(~2, ~0x34, ~0x081)|RS1_G0, "f,g", F_FLOAT, v9 },
+{ "fqtox",      F3F(2, 0x34, 0x083), F3F(~2, ~0x34, ~0x083)|RS1_G0, "R,g", F_FLOAT, v9 },
+
+{ "fitod",      F3F(2, 0x34, 0x0c8), F3F(~2, ~0x34, ~0x0c8)|RS1_G0, "f,H", F_FLOAT, v6 },
+{ "fitos",      F3F(2, 0x34, 0x0c4), F3F(~2, ~0x34, ~0x0c4)|RS1_G0, "f,g", F_FLOAT, v6 },
+{ "fitoq",      F3F(2, 0x34, 0x0cc), F3F(~2, ~0x34, ~0x0cc)|RS1_G0, "f,J", F_FLOAT, v8 },
+
+{ "fxtod",      F3F(2, 0x34, 0x088), F3F(~2, ~0x34, ~0x088)|RS1_G0, "f,H", F_FLOAT, v9 },
+{ "fxtos",      F3F(2, 0x34, 0x084), F3F(~2, ~0x34, ~0x084)|RS1_G0, "f,g", F_FLOAT, v9 },
+{ "fxtoq",      F3F(2, 0x34, 0x08c), F3F(~2, ~0x34, ~0x08c)|RS1_G0, "f,J", F_FLOAT, v9 },
+
+{ "fdtoq",      F3F(2, 0x34, 0x0ce), F3F(~2, ~0x34, ~0x0ce)|RS1_G0, "B,J", F_FLOAT, v8 },
+{ "fdtos",      F3F(2, 0x34, 0x0c6), F3F(~2, ~0x34, ~0x0c6)|RS1_G0, "B,g", F_FLOAT, v6 },
+{ "fqtod",      F3F(2, 0x34, 0x0cb), F3F(~2, ~0x34, ~0x0cb)|RS1_G0, "R,H", F_FLOAT, v8 },
+{ "fqtos",      F3F(2, 0x34, 0x0c7), F3F(~2, ~0x34, ~0x0c7)|RS1_G0, "R,g", F_FLOAT, v8 },
+{ "fstod",      F3F(2, 0x34, 0x0c9), F3F(~2, ~0x34, ~0x0c9)|RS1_G0, "f,H", F_FLOAT, v6 },
+{ "fstoq",      F3F(2, 0x34, 0x0cd), F3F(~2, ~0x34, ~0x0cd)|RS1_G0, "f,J", F_FLOAT, v8 },
+
+{ "fdivd",      F3F(2, 0x34, 0x04e), F3F(~2, ~0x34, ~0x04e), "v,B,H", F_FLOAT, v6 },
+{ "fdivq",      F3F(2, 0x34, 0x04f), F3F(~2, ~0x34, ~0x04f), "V,R,J", F_FLOAT, v8 },
+{ "fdivx",      F3F(2, 0x34, 0x04f), F3F(~2, ~0x34, ~0x04f), "V,R,J", F_FLOAT|F_ALIAS, v8 },
+{ "fdivs",      F3F(2, 0x34, 0x04d), F3F(~2, ~0x34, ~0x04d), "e,f,g", F_FLOAT, v6 },
+{ "fmuld",      F3F(2, 0x34, 0x04a), F3F(~2, ~0x34, ~0x04a), "v,B,H", F_FLOAT, v6 },
+{ "fmulq",      F3F(2, 0x34, 0x04b), F3F(~2, ~0x34, ~0x04b), "V,R,J", F_FLOAT, v8 },
+{ "fmulx",      F3F(2, 0x34, 0x04b), F3F(~2, ~0x34, ~0x04b), "V,R,J", F_FLOAT|F_ALIAS, v8 },
+{ "fmuls",      F3F(2, 0x34, 0x049), F3F(~2, ~0x34, ~0x049), "e,f,g", F_FLOAT, v6 },
+
+{ "fdmulq",     F3F(2, 0x34, 0x06e), F3F(~2, ~0x34, ~0x06e), "v,B,J", F_FLOAT, v8 },
+{ "fdmulx",     F3F(2, 0x34, 0x06e), F3F(~2, ~0x34, ~0x06e), "v,B,J", F_FLOAT|F_ALIAS, v8 },
+{ "fsmuld",     F3F(2, 0x34, 0x069), F3F(~2, ~0x34, ~0x069), "e,f,H", F_FLOAT, v8 },
+
+{ "fsqrtd",     F3F(2, 0x34, 0x02a), F3F(~2, ~0x34, ~0x02a)|RS1_G0, "B,H", F_FLOAT, v7 },
+{ "fsqrtq",     F3F(2, 0x34, 0x02b), F3F(~2, ~0x34, ~0x02b)|RS1_G0, "R,J", F_FLOAT, v8 },
+{ "fsqrtx",     F3F(2, 0x34, 0x02b), F3F(~2, ~0x34, ~0x02b)|RS1_G0, "R,J", F_FLOAT|F_ALIAS, v8 },
+{ "fsqrts",     F3F(2, 0x34, 0x029), F3F(~2, ~0x34, ~0x029)|RS1_G0, "f,g", F_FLOAT, v7 },
+
+{ "fabsd",      F3F(2, 0x34, 0x00a), F3F(~2, ~0x34, ~0x00a)|RS1_G0, "B,H", F_FLOAT, v9 },
+{ "fabsq",      F3F(2, 0x34, 0x00b), F3F(~2, ~0x34, ~0x00b)|RS1_G0, "R,J", F_FLOAT, v9 },
+{ "fabsx",      F3F(2, 0x34, 0x00b), F3F(~2, ~0x34, ~0x00b)|RS1_G0, "R,J", F_FLOAT|F_ALIAS, v9 },
+{ "fabss",      F3F(2, 0x34, 0x009), F3F(~2, ~0x34, ~0x009)|RS1_G0, "f,g", F_FLOAT, v6 },
+{ "fmovd",      F3F(2, 0x34, 0x002), F3F(~2, ~0x34, ~0x002)|RS1_G0, "B,H", F_FLOAT, v9 },
+{ "fmovq",      F3F(2, 0x34, 0x003), F3F(~2, ~0x34, ~0x003)|RS1_G0, "R,J", F_FLOAT, v9 },
+{ "fmovx",      F3F(2, 0x34, 0x003), F3F(~2, ~0x34, ~0x003)|RS1_G0, "R,J", F_FLOAT|F_ALIAS, v9 },
+{ "fmovs",      F3F(2, 0x34, 0x001), F3F(~2, ~0x34, ~0x001)|RS1_G0, "f,g", F_FLOAT, v6 },
+{ "fnegd",      F3F(2, 0x34, 0x006), F3F(~2, ~0x34, ~0x006)|RS1_G0, "B,H", F_FLOAT, v9 },
+{ "fnegq",      F3F(2, 0x34, 0x007), F3F(~2, ~0x34, ~0x007)|RS1_G0, "R,J", F_FLOAT, v9 },
+{ "fnegx",      F3F(2, 0x34, 0x007), F3F(~2, ~0x34, ~0x007)|RS1_G0, "R,J", F_FLOAT|F_ALIAS, v9 },
+{ "fnegs",      F3F(2, 0x34, 0x005), F3F(~2, ~0x34, ~0x005)|RS1_G0, "f,g", F_FLOAT, v6 },
+
+{ "faddd",      F3F(2, 0x34, 0x042), F3F(~2, ~0x34, ~0x042), "v,B,H", F_FLOAT, v6 },
+{ "faddq",      F3F(2, 0x34, 0x043), F3F(~2, ~0x34, ~0x043), "V,R,J", F_FLOAT, v8 },
+{ "faddx",      F3F(2, 0x34, 0x043), F3F(~2, ~0x34, ~0x043), "V,R,J", F_FLOAT|F_ALIAS, v8 },
+{ "fadds",      F3F(2, 0x34, 0x041), F3F(~2, ~0x34, ~0x041), "e,f,g", F_FLOAT, v6 },
+{ "fsubd",      F3F(2, 0x34, 0x046), F3F(~2, ~0x34, ~0x046), "v,B,H", F_FLOAT, v6 },
+{ "fsubq",      F3F(2, 0x34, 0x047), F3F(~2, ~0x34, ~0x047), "V,R,J", F_FLOAT, v8 },
+{ "fsubx",      F3F(2, 0x34, 0x047), F3F(~2, ~0x34, ~0x047), "V,R,J", F_FLOAT|F_ALIAS, v8 },
+{ "fsubs",      F3F(2, 0x34, 0x045), F3F(~2, ~0x34, ~0x045), "e,f,g", F_FLOAT, v6 },
+
+#define CMPFCC(x)       (((x)&0x3)<<25)
+
+{ "fcmpd",                F3F(2, 0x35, 0x052),            F3F(~2, ~0x35, ~0x052)|RD_G0,  "v,B",   F_FLOAT, v6 },
+{ "fcmpd",      CMPFCC(0)|F3F(2, 0x35, 0x052), CMPFCC(~0)|F3F(~2, ~0x35, ~0x052),        "6,v,B", F_FLOAT, v9 },
+{ "fcmpd",      CMPFCC(1)|F3F(2, 0x35, 0x052), CMPFCC(~1)|F3F(~2, ~0x35, ~0x052),        "7,v,B", F_FLOAT, v9 },
+{ "fcmpd",      CMPFCC(2)|F3F(2, 0x35, 0x052), CMPFCC(~2)|F3F(~2, ~0x35, ~0x052),        "8,v,B", F_FLOAT, v9 },
+{ "fcmpd",      CMPFCC(3)|F3F(2, 0x35, 0x052), CMPFCC(~3)|F3F(~2, ~0x35, ~0x052),        "9,v,B", F_FLOAT, v9 },
+{ "fcmped",               F3F(2, 0x35, 0x056),            F3F(~2, ~0x35, ~0x056)|RD_G0,  "v,B",   F_FLOAT, v6 },
+{ "fcmped",     CMPFCC(0)|F3F(2, 0x35, 0x056), CMPFCC(~0)|F3F(~2, ~0x35, ~0x056),        "6,v,B", F_FLOAT, v9 },
+{ "fcmped",     CMPFCC(1)|F3F(2, 0x35, 0x056), CMPFCC(~1)|F3F(~2, ~0x35, ~0x056),        "7,v,B", F_FLOAT, v9 },
+{ "fcmped",     CMPFCC(2)|F3F(2, 0x35, 0x056), CMPFCC(~2)|F3F(~2, ~0x35, ~0x056),        "8,v,B", F_FLOAT, v9 },
+{ "fcmped",     CMPFCC(3)|F3F(2, 0x35, 0x056), CMPFCC(~3)|F3F(~2, ~0x35, ~0x056),        "9,v,B", F_FLOAT, v9 },
+{ "fcmpq",                F3F(2, 0x35, 0x053),            F3F(~2, ~0x35, ~0x053)|RD_G0,  "V,R", F_FLOAT, v8 },
+{ "fcmpq",      CMPFCC(0)|F3F(2, 0x35, 0x053), CMPFCC(~0)|F3F(~2, ~0x35, ~0x053),        "6,V,R", F_FLOAT, v9 },
+{ "fcmpq",      CMPFCC(1)|F3F(2, 0x35, 0x053), CMPFCC(~1)|F3F(~2, ~0x35, ~0x053),        "7,V,R", F_FLOAT, v9 },
+{ "fcmpq",      CMPFCC(2)|F3F(2, 0x35, 0x053), CMPFCC(~2)|F3F(~2, ~0x35, ~0x053),        "8,V,R", F_FLOAT, v9 },
+{ "fcmpq",      CMPFCC(3)|F3F(2, 0x35, 0x053), CMPFCC(~3)|F3F(~2, ~0x35, ~0x053),        "9,V,R", F_FLOAT, v9 },
+{ "fcmpeq",               F3F(2, 0x35, 0x057),            F3F(~2, ~0x35, ~0x057)|RD_G0,  "V,R", F_FLOAT, v8 },
+{ "fcmpeq",     CMPFCC(0)|F3F(2, 0x35, 0x057), CMPFCC(~0)|F3F(~2, ~0x35, ~0x057),        "6,V,R", F_FLOAT, v9 },
+{ "fcmpeq",     CMPFCC(1)|F3F(2, 0x35, 0x057), CMPFCC(~1)|F3F(~2, ~0x35, ~0x057),        "7,V,R", F_FLOAT, v9 },
+{ "fcmpeq",     CMPFCC(2)|F3F(2, 0x35, 0x057), CMPFCC(~2)|F3F(~2, ~0x35, ~0x057),        "8,V,R", F_FLOAT, v9 },
+{ "fcmpeq",     CMPFCC(3)|F3F(2, 0x35, 0x057), CMPFCC(~3)|F3F(~2, ~0x35, ~0x057),        "9,V,R", F_FLOAT, v9 },
+{ "fcmpx",                F3F(2, 0x35, 0x053),            F3F(~2, ~0x35, ~0x053)|RD_G0,  "V,R", F_FLOAT|F_ALIAS, v8 },
+{ "fcmpx",      CMPFCC(0)|F3F(2, 0x35, 0x053), CMPFCC(~0)|F3F(~2, ~0x35, ~0x053),        "6,V,R", F_FLOAT|F_ALIAS, v9 },
+{ "fcmpx",      CMPFCC(1)|F3F(2, 0x35, 0x053), CMPFCC(~1)|F3F(~2, ~0x35, ~0x053),        "7,V,R", F_FLOAT|F_ALIAS, v9 },
+{ "fcmpx",      CMPFCC(2)|F3F(2, 0x35, 0x053), CMPFCC(~2)|F3F(~2, ~0x35, ~0x053),        "8,V,R", F_FLOAT|F_ALIAS, v9 },
+{ "fcmpx",      CMPFCC(3)|F3F(2, 0x35, 0x053), CMPFCC(~3)|F3F(~2, ~0x35, ~0x053),        "9,V,R", F_FLOAT|F_ALIAS, v9 },
+{ "fcmpex",               F3F(2, 0x35, 0x057),            F3F(~2, ~0x35, ~0x057)|RD_G0,  "V,R", F_FLOAT|F_ALIAS, v8 },
+{ "fcmpex",     CMPFCC(0)|F3F(2, 0x35, 0x057), CMPFCC(~0)|F3F(~2, ~0x35, ~0x057),        "6,V,R", F_FLOAT|F_ALIAS, v9 },
+{ "fcmpex",     CMPFCC(1)|F3F(2, 0x35, 0x057), CMPFCC(~1)|F3F(~2, ~0x35, ~0x057),        "7,V,R", F_FLOAT|F_ALIAS, v9 },
+{ "fcmpex",     CMPFCC(2)|F3F(2, 0x35, 0x057), CMPFCC(~2)|F3F(~2, ~0x35, ~0x057),        "8,V,R", F_FLOAT|F_ALIAS, v9 },
+{ "fcmpex",     CMPFCC(3)|F3F(2, 0x35, 0x057), CMPFCC(~3)|F3F(~2, ~0x35, ~0x057),        "9,V,R", F_FLOAT|F_ALIAS, v9 },
+{ "fcmps",                F3F(2, 0x35, 0x051),            F3F(~2, ~0x35, ~0x051)|RD_G0, "e,f",   F_FLOAT, v6 },
+{ "fcmps",      CMPFCC(0)|F3F(2, 0x35, 0x051), CMPFCC(~0)|F3F(~2, ~0x35, ~0x051),        "6,e,f", F_FLOAT, v9 },
+{ "fcmps",      CMPFCC(1)|F3F(2, 0x35, 0x051), CMPFCC(~1)|F3F(~2, ~0x35, ~0x051),        "7,e,f", F_FLOAT, v9 },
+{ "fcmps",      CMPFCC(2)|F3F(2, 0x35, 0x051), CMPFCC(~2)|F3F(~2, ~0x35, ~0x051),        "8,e,f", F_FLOAT, v9 },
+{ "fcmps",      CMPFCC(3)|F3F(2, 0x35, 0x051), CMPFCC(~3)|F3F(~2, ~0x35, ~0x051),        "9,e,f", F_FLOAT, v9 },
+{ "fcmpes",               F3F(2, 0x35, 0x055),            F3F(~2, ~0x35, ~0x055)|RD_G0, "e,f",   F_FLOAT, v6 },
+{ "fcmpes",     CMPFCC(0)|F3F(2, 0x35, 0x055), CMPFCC(~0)|F3F(~2, ~0x35, ~0x055),        "6,e,f", F_FLOAT, v9 },
+{ "fcmpes",     CMPFCC(1)|F3F(2, 0x35, 0x055), CMPFCC(~1)|F3F(~2, ~0x35, ~0x055),        "7,e,f", F_FLOAT, v9 },
+{ "fcmpes",     CMPFCC(2)|F3F(2, 0x35, 0x055), CMPFCC(~2)|F3F(~2, ~0x35, ~0x055),        "8,e,f", F_FLOAT, v9 },
+{ "fcmpes",     CMPFCC(3)|F3F(2, 0x35, 0x055), CMPFCC(~3)|F3F(~2, ~0x35, ~0x055),        "9,e,f", F_FLOAT, v9 },
 
 /* These Extended FPop (FIFO) instructions are new in the Fujitsu
    MB86934, replacing the CPop instructions from v6 and later
@@ -1835,30 +1835,30 @@ CONDFC  ("fbule", "cb013", 0xe, F_CONDBR),
 #define EFPOP1_3(name, op, args) { name, F3F(2, 0x36, op), F3F(~2, ~0x36, ~op),        args, 0, sparclite }
 #define EFPOP2_2(name, op, args) { name, F3F(2, 0x37, op), F3F(~2, ~0x37, ~op)|RD_G0,  args, 0, sparclite }
 
-EFPOP1_2 ("efitod",	0x0c8, "f,H"),
-EFPOP1_2 ("efitos",	0x0c4, "f,g"),
-EFPOP1_2 ("efdtoi",	0x0d2, "B,g"),
-EFPOP1_2 ("efstoi",	0x0d1, "f,g"),
-EFPOP1_2 ("efstod",	0x0c9, "f,H"),
-EFPOP1_2 ("efdtos",	0x0c6, "B,g"),
-EFPOP1_2 ("efmovs",	0x001, "f,g"),
-EFPOP1_2 ("efnegs",	0x005, "f,g"),
-EFPOP1_2 ("efabss",	0x009, "f,g"),
-EFPOP1_2 ("efsqrtd",	0x02a, "B,H"),
-EFPOP1_2 ("efsqrts",	0x029, "f,g"),
-EFPOP1_3 ("efaddd",	0x042, "v,B,H"),
-EFPOP1_3 ("efadds",	0x041, "e,f,g"),
-EFPOP1_3 ("efsubd",	0x046, "v,B,H"),
-EFPOP1_3 ("efsubs",	0x045, "e,f,g"),
-EFPOP1_3 ("efdivd",	0x04e, "v,B,H"),
-EFPOP1_3 ("efdivs",	0x04d, "e,f,g"),
-EFPOP1_3 ("efmuld",	0x04a, "v,B,H"),
-EFPOP1_3 ("efmuls",	0x049, "e,f,g"),
-EFPOP1_3 ("efsmuld",	0x069, "e,f,H"),
-EFPOP2_2 ("efcmpd",	0x052, "v,B"),
-EFPOP2_2 ("efcmped",	0x056, "v,B"),
-EFPOP2_2 ("efcmps",	0x051, "e,f"),
-EFPOP2_2 ("efcmpes",	0x055, "e,f"),
+EFPOP1_2 ("efitod",     0x0c8, "f,H"),
+EFPOP1_2 ("efitos",     0x0c4, "f,g"),
+EFPOP1_2 ("efdtoi",     0x0d2, "B,g"),
+EFPOP1_2 ("efstoi",     0x0d1, "f,g"),
+EFPOP1_2 ("efstod",     0x0c9, "f,H"),
+EFPOP1_2 ("efdtos",     0x0c6, "B,g"),
+EFPOP1_2 ("efmovs",     0x001, "f,g"),
+EFPOP1_2 ("efnegs",     0x005, "f,g"),
+EFPOP1_2 ("efabss",     0x009, "f,g"),
+EFPOP1_2 ("efsqrtd",    0x02a, "B,H"),
+EFPOP1_2 ("efsqrts",    0x029, "f,g"),
+EFPOP1_3 ("efaddd",     0x042, "v,B,H"),
+EFPOP1_3 ("efadds",     0x041, "e,f,g"),
+EFPOP1_3 ("efsubd",     0x046, "v,B,H"),
+EFPOP1_3 ("efsubs",     0x045, "e,f,g"),
+EFPOP1_3 ("efdivd",     0x04e, "v,B,H"),
+EFPOP1_3 ("efdivs",     0x04d, "e,f,g"),
+EFPOP1_3 ("efmuld",     0x04a, "v,B,H"),
+EFPOP1_3 ("efmuls",     0x049, "e,f,g"),
+EFPOP1_3 ("efsmuld",    0x069, "e,f,H"),
+EFPOP2_2 ("efcmpd",     0x052, "v,B"),
+EFPOP2_2 ("efcmped",    0x056, "v,B"),
+EFPOP2_2 ("efcmps",     0x051, "e,f"),
+EFPOP2_2 ("efcmpes",    0x055, "e,f"),
 
 #undef EFPOP1_2
 #undef EFPOP1_3
@@ -1866,8 +1866,8 @@ EFPOP2_2 ("efcmpes",	0x055, "e,f"),
 
 /* These are marked F_ALIAS, so that they won't conflict with sparclite insns
    present.  Otherwise, the F_ALIAS flag is ignored.  */
-{ "cpop1",	F3(2, 0x36, 0), F3(~2, ~0x36, ~1), "[1+2],d", F_ALIAS, v6notv9 },
-{ "cpop2",	F3(2, 0x37, 0), F3(~2, ~0x37, ~1), "[1+2],d", F_ALIAS, v6notv9 },
+{ "cpop1",      F3(2, 0x36, 0), F3(~2, ~0x36, ~1), "[1+2],d", F_ALIAS, v6notv9 },
+{ "cpop2",      F3(2, 0x37, 0), F3(~2, ~0x37, ~1), "[1+2],d", F_ALIAS, v6notv9 },
 
 /* sparclet specific insns */
 
@@ -1878,20 +1878,20 @@ COMMUTEOP ("smacd", 0x2f, sparclet),
 COMMUTEOP ("umuld", 0x09, sparclet),
 COMMUTEOP ("smuld", 0x0d, sparclet),
 
-{ "shuffle",	F3(2, 0x2d, 0), F3(~2, ~0x2d, ~0)|ASI(~0),	"1,2,d", 0, sparclet },
-{ "shuffle",	F3(2, 0x2d, 1), F3(~2, ~0x2d, ~1),		"1,i,d", 0, sparclet },
+{ "shuffle",    F3(2, 0x2d, 0), F3(~2, ~0x2d, ~0)|ASI(~0),      "1,2,d", 0, sparclet },
+{ "shuffle",    F3(2, 0x2d, 1), F3(~2, ~0x2d, ~1),              "1,i,d", 0, sparclet },
 
 /* The manual isn't completely accurate on these insns.  The `rs2' field is
    treated as being 6 bits to account for 6 bit immediates to cpush.  It is
    assumed that it is intended that bit 5 is 0 when rs2 contains a reg.  */
 #define BIT5 (1<<5)
-{ "crdcxt",	F3(2, 0x36, 0)|SLCPOP(4), F3(~2, ~0x36, ~0)|SLCPOP(~4)|BIT5|RS2(~0),	"U,d", 0, sparclet },
-{ "cwrcxt",	F3(2, 0x36, 0)|SLCPOP(3), F3(~2, ~0x36, ~0)|SLCPOP(~3)|BIT5|RS2(~0),	"1,u", 0, sparclet },
-{ "cpush",	F3(2, 0x36, 0)|SLCPOP(0), F3(~2, ~0x36, ~0)|SLCPOP(~0)|BIT5|RD(~0),	"1,2", 0, sparclet },
-{ "cpush",	F3(2, 0x36, 1)|SLCPOP(0), F3(~2, ~0x36, ~1)|SLCPOP(~0)|RD(~0),		"1,Y", 0, sparclet },
-{ "cpusha",	F3(2, 0x36, 0)|SLCPOP(1), F3(~2, ~0x36, ~0)|SLCPOP(~1)|BIT5|RD(~0),	"1,2", 0, sparclet },
-{ "cpusha",	F3(2, 0x36, 1)|SLCPOP(1), F3(~2, ~0x36, ~1)|SLCPOP(~1)|RD(~0),		"1,Y", 0, sparclet },
-{ "cpull",	F3(2, 0x36, 0)|SLCPOP(2), F3(~2, ~0x36, ~0)|SLCPOP(~2)|BIT5|RS1(~0)|RS2(~0), "d", 0, sparclet },
+{ "crdcxt",     F3(2, 0x36, 0)|SLCPOP(4), F3(~2, ~0x36, ~0)|SLCPOP(~4)|BIT5|RS2(~0),    "U,d", 0, sparclet },
+{ "cwrcxt",     F3(2, 0x36, 0)|SLCPOP(3), F3(~2, ~0x36, ~0)|SLCPOP(~3)|BIT5|RS2(~0),    "1,u", 0, sparclet },
+{ "cpush",      F3(2, 0x36, 0)|SLCPOP(0), F3(~2, ~0x36, ~0)|SLCPOP(~0)|BIT5|RD(~0),     "1,2", 0, sparclet },
+{ "cpush",      F3(2, 0x36, 1)|SLCPOP(0), F3(~2, ~0x36, ~1)|SLCPOP(~0)|RD(~0),          "1,Y", 0, sparclet },
+{ "cpusha",     F3(2, 0x36, 0)|SLCPOP(1), F3(~2, ~0x36, ~0)|SLCPOP(~1)|BIT5|RD(~0),     "1,2", 0, sparclet },
+{ "cpusha",     F3(2, 0x36, 1)|SLCPOP(1), F3(~2, ~0x36, ~1)|SLCPOP(~1)|RD(~0),          "1,Y", 0, sparclet },
+{ "cpull",      F3(2, 0x36, 0)|SLCPOP(2), F3(~2, ~0x36, ~0)|SLCPOP(~2)|BIT5|RS1(~0)|RS2(~0), "d", 0, sparclet },
 #undef BIT5
 
 /* sparclet coprocessor branch insns */
@@ -1923,108 +1923,108 @@ SLCBCC("cbnefr", 15),
 #undef SLCBCC2
 #undef SLCBCC
 
-{ "casa",	F3(3, 0x3c, 0), F3(~3, ~0x3c, ~0), "[1]A,2,d", 0, v9 },
-{ "casa",	F3(3, 0x3c, 1), F3(~3, ~0x3c, ~1), "[1]o,2,d", 0, v9 },
-{ "casxa",	F3(3, 0x3e, 0), F3(~3, ~0x3e, ~0), "[1]A,2,d", 0, v9 },
-{ "casxa",	F3(3, 0x3e, 1), F3(~3, ~0x3e, ~1), "[1]o,2,d", 0, v9 },
+{ "casa",       F3(3, 0x3c, 0), F3(~3, ~0x3c, ~0), "[1]A,2,d", 0, v9 },
+{ "casa",       F3(3, 0x3c, 1), F3(~3, ~0x3c, ~1), "[1]o,2,d", 0, v9 },
+{ "casxa",      F3(3, 0x3e, 0), F3(~3, ~0x3e, ~0), "[1]A,2,d", 0, v9 },
+{ "casxa",      F3(3, 0x3e, 1), F3(~3, ~0x3e, ~1), "[1]o,2,d", 0, v9 },
 
 /* v9 synthetic insns */
-{ "iprefetch",	F2(0, 1)|(2<<20)|BPRED, F2(~0, ~1)|(1<<20)|ANNUL|COND(~0), "G", 0, v9 }, /* bn,a,pt %xcc,label */
-{ "signx",	F3(2, 0x27, 0), F3(~2, ~0x27, ~0)|(1<<12)|ASI(~0)|RS2_G0, "1,d", F_ALIAS, v9 }, /* sra rs1,%g0,rd */
-{ "signx",	F3(2, 0x27, 0), F3(~2, ~0x27, ~0)|(1<<12)|ASI(~0)|RS2_G0, "r", F_ALIAS, v9 }, /* sra rd,%g0,rd */
-{ "clruw",	F3(2, 0x26, 0), F3(~2, ~0x26, ~0)|(1<<12)|ASI(~0)|RS2_G0, "1,d", F_ALIAS, v9 }, /* srl rs1,%g0,rd */
-{ "clruw",	F3(2, 0x26, 0), F3(~2, ~0x26, ~0)|(1<<12)|ASI(~0)|RS2_G0, "r", F_ALIAS, v9 }, /* srl rd,%g0,rd */
-{ "cas",	F3(3, 0x3c, 0)|ASI(0x80), F3(~3, ~0x3c, ~0)|ASI(~0x80), "[1],2,d", F_ALIAS, v9 }, /* casa [rs1]ASI_P,rs2,rd */
-{ "casl",	F3(3, 0x3c, 0)|ASI(0x88), F3(~3, ~0x3c, ~0)|ASI(~0x88), "[1],2,d", F_ALIAS, v9 }, /* casa [rs1]ASI_P_L,rs2,rd */
-{ "casx",	F3(3, 0x3e, 0)|ASI(0x80), F3(~3, ~0x3e, ~0)|ASI(~0x80), "[1],2,d", F_ALIAS, v9 }, /* casxa [rs1]ASI_P,rs2,rd */
-{ "casxl",	F3(3, 0x3e, 0)|ASI(0x88), F3(~3, ~0x3e, ~0)|ASI(~0x88), "[1],2,d", F_ALIAS, v9 }, /* casxa [rs1]ASI_P_L,rs2,rd */
+{ "iprefetch",  F2(0, 1)|(2<<20)|BPRED, F2(~0, ~1)|(1<<20)|ANNUL|COND(~0), "G", 0, v9 }, /* bn,a,pt %xcc,label */
+{ "signx",      F3(2, 0x27, 0), F3(~2, ~0x27, ~0)|(1<<12)|ASI(~0)|RS2_G0, "1,d", F_ALIAS, v9 }, /* sra rs1,%g0,rd */
+{ "signx",      F3(2, 0x27, 0), F3(~2, ~0x27, ~0)|(1<<12)|ASI(~0)|RS2_G0, "r", F_ALIAS, v9 }, /* sra rd,%g0,rd */
+{ "clruw",      F3(2, 0x26, 0), F3(~2, ~0x26, ~0)|(1<<12)|ASI(~0)|RS2_G0, "1,d", F_ALIAS, v9 }, /* srl rs1,%g0,rd */
+{ "clruw",      F3(2, 0x26, 0), F3(~2, ~0x26, ~0)|(1<<12)|ASI(~0)|RS2_G0, "r", F_ALIAS, v9 }, /* srl rd,%g0,rd */
+{ "cas",        F3(3, 0x3c, 0)|ASI(0x80), F3(~3, ~0x3c, ~0)|ASI(~0x80), "[1],2,d", F_ALIAS, v9 }, /* casa [rs1]ASI_P,rs2,rd */
+{ "casl",       F3(3, 0x3c, 0)|ASI(0x88), F3(~3, ~0x3c, ~0)|ASI(~0x88), "[1],2,d", F_ALIAS, v9 }, /* casa [rs1]ASI_P_L,rs2,rd */
+{ "casx",       F3(3, 0x3e, 0)|ASI(0x80), F3(~3, ~0x3e, ~0)|ASI(~0x80), "[1],2,d", F_ALIAS, v9 }, /* casxa [rs1]ASI_P,rs2,rd */
+{ "casxl",      F3(3, 0x3e, 0)|ASI(0x88), F3(~3, ~0x3e, ~0)|ASI(~0x88), "[1],2,d", F_ALIAS, v9 }, /* casxa [rs1]ASI_P_L,rs2,rd */
 
 /* Ultrasparc extensions */
-{ "shutdown",	F3F(2, 0x36, 0x080), F3F(~2, ~0x36, ~0x080)|RD_G0|RS1_G0|RS2_G0, "", 0, v9a },
+{ "shutdown",   F3F(2, 0x36, 0x080), F3F(~2, ~0x36, ~0x080)|RD_G0|RS1_G0|RS2_G0, "", 0, v9a },
 
 /* FIXME: Do we want to mark these as F_FLOAT, or something similar?  */
-{ "fpadd16",	F3F(2, 0x36, 0x050), F3F(~2, ~0x36, ~0x050), "v,B,H", 0, v9a },
-{ "fpadd16s",	F3F(2, 0x36, 0x051), F3F(~2, ~0x36, ~0x051), "e,f,g", 0, v9a },
-{ "fpadd32",	F3F(2, 0x36, 0x052), F3F(~2, ~0x36, ~0x052), "v,B,H", 0, v9a },
-{ "fpadd32s",	F3F(2, 0x36, 0x053), F3F(~2, ~0x36, ~0x053), "e,f,g", 0, v9a },
-{ "fpsub16",	F3F(2, 0x36, 0x054), F3F(~2, ~0x36, ~0x054), "v,B,H", 0, v9a },
-{ "fpsub16s",	F3F(2, 0x36, 0x055), F3F(~2, ~0x36, ~0x055), "e,f,g", 0, v9a },
-{ "fpsub32",	F3F(2, 0x36, 0x056), F3F(~2, ~0x36, ~0x056), "v,B,H", 0, v9a },
-{ "fpsub32s",	F3F(2, 0x36, 0x057), F3F(~2, ~0x36, ~0x057), "e,f,g", 0, v9a },
-
-{ "fpack32",	F3F(2, 0x36, 0x03a), F3F(~2, ~0x36, ~0x03a), "v,B,H", 0, v9a },
-{ "fpack16",	F3F(2, 0x36, 0x03b), F3F(~2, ~0x36, ~0x03b)|RS1_G0, "B,g", 0, v9a },
-{ "fpackfix",	F3F(2, 0x36, 0x03d), F3F(~2, ~0x36, ~0x03d)|RS1_G0, "B,g", 0, v9a },
-{ "fexpand",	F3F(2, 0x36, 0x04d), F3F(~2, ~0x36, ~0x04d)|RS1_G0, "f,H", 0, v9a },
-{ "fpmerge",	F3F(2, 0x36, 0x04b), F3F(~2, ~0x36, ~0x04b), "e,f,H", 0, v9a },
+{ "fpadd16",    F3F(2, 0x36, 0x050), F3F(~2, ~0x36, ~0x050), "v,B,H", 0, v9a },
+{ "fpadd16s",   F3F(2, 0x36, 0x051), F3F(~2, ~0x36, ~0x051), "e,f,g", 0, v9a },
+{ "fpadd32",    F3F(2, 0x36, 0x052), F3F(~2, ~0x36, ~0x052), "v,B,H", 0, v9a },
+{ "fpadd32s",   F3F(2, 0x36, 0x053), F3F(~2, ~0x36, ~0x053), "e,f,g", 0, v9a },
+{ "fpsub16",    F3F(2, 0x36, 0x054), F3F(~2, ~0x36, ~0x054), "v,B,H", 0, v9a },
+{ "fpsub16s",   F3F(2, 0x36, 0x055), F3F(~2, ~0x36, ~0x055), "e,f,g", 0, v9a },
+{ "fpsub32",    F3F(2, 0x36, 0x056), F3F(~2, ~0x36, ~0x056), "v,B,H", 0, v9a },
+{ "fpsub32s",   F3F(2, 0x36, 0x057), F3F(~2, ~0x36, ~0x057), "e,f,g", 0, v9a },
+
+{ "fpack32",    F3F(2, 0x36, 0x03a), F3F(~2, ~0x36, ~0x03a), "v,B,H", 0, v9a },
+{ "fpack16",    F3F(2, 0x36, 0x03b), F3F(~2, ~0x36, ~0x03b)|RS1_G0, "B,g", 0, v9a },
+{ "fpackfix",   F3F(2, 0x36, 0x03d), F3F(~2, ~0x36, ~0x03d)|RS1_G0, "B,g", 0, v9a },
+{ "fexpand",    F3F(2, 0x36, 0x04d), F3F(~2, ~0x36, ~0x04d)|RS1_G0, "f,H", 0, v9a },
+{ "fpmerge",    F3F(2, 0x36, 0x04b), F3F(~2, ~0x36, ~0x04b), "e,f,H", 0, v9a },
 
 /* Note that the mixing of 32/64 bit regs is intentional.  */
-{ "fmul8x16",		F3F(2, 0x36, 0x031), F3F(~2, ~0x36, ~0x031), "e,B,H", 0, v9a },
-{ "fmul8x16au",		F3F(2, 0x36, 0x033), F3F(~2, ~0x36, ~0x033), "e,f,H", 0, v9a },
-{ "fmul8x16al",		F3F(2, 0x36, 0x035), F3F(~2, ~0x36, ~0x035), "e,f,H", 0, v9a },
-{ "fmul8sux16",		F3F(2, 0x36, 0x036), F3F(~2, ~0x36, ~0x036), "v,B,H", 0, v9a },
-{ "fmul8ulx16",		F3F(2, 0x36, 0x037), F3F(~2, ~0x36, ~0x037), "v,B,H", 0, v9a },
-{ "fmuld8sux16",	F3F(2, 0x36, 0x038), F3F(~2, ~0x36, ~0x038), "e,f,H", 0, v9a },
-{ "fmuld8ulx16",	F3F(2, 0x36, 0x039), F3F(~2, ~0x36, ~0x039), "e,f,H", 0, v9a },
-
-{ "alignaddr",	F3F(2, 0x36, 0x018), F3F(~2, ~0x36, ~0x018), "1,2,d", 0, v9a },
-{ "alignaddrl",	F3F(2, 0x36, 0x01a), F3F(~2, ~0x36, ~0x01a), "1,2,d", 0, v9a },
-{ "faligndata",	F3F(2, 0x36, 0x048), F3F(~2, ~0x36, ~0x048), "v,B,H", 0, v9a },
-
-{ "fzero",	F3F(2, 0x36, 0x060), F3F(~2, ~0x36, ~0x060), "H", 0, v9a },
-{ "fzeros",	F3F(2, 0x36, 0x061), F3F(~2, ~0x36, ~0x061), "g", 0, v9a },
-{ "fone",	F3F(2, 0x36, 0x07e), F3F(~2, ~0x36, ~0x07e), "H", 0, v9a },
-{ "fones",	F3F(2, 0x36, 0x07f), F3F(~2, ~0x36, ~0x07f), "g", 0, v9a },
-{ "fsrc1",	F3F(2, 0x36, 0x074), F3F(~2, ~0x36, ~0x074), "v,H", 0, v9a },
-{ "fsrc1s",	F3F(2, 0x36, 0x075), F3F(~2, ~0x36, ~0x075), "e,g", 0, v9a },
-{ "fsrc2",	F3F(2, 0x36, 0x078), F3F(~2, ~0x36, ~0x078), "B,H", 0, v9a },
-{ "fsrc2s",	F3F(2, 0x36, 0x079), F3F(~2, ~0x36, ~0x079), "f,g", 0, v9a },
-{ "fnot1",	F3F(2, 0x36, 0x06a), F3F(~2, ~0x36, ~0x06a), "v,H", 0, v9a },
-{ "fnot1s",	F3F(2, 0x36, 0x06b), F3F(~2, ~0x36, ~0x06b), "e,g", 0, v9a },
-{ "fnot2",	F3F(2, 0x36, 0x066), F3F(~2, ~0x36, ~0x066), "B,H", 0, v9a },
-{ "fnot2s",	F3F(2, 0x36, 0x067), F3F(~2, ~0x36, ~0x067), "f,g", 0, v9a },
-{ "for",	F3F(2, 0x36, 0x07c), F3F(~2, ~0x36, ~0x07c), "v,B,H", 0, v9a },
-{ "fors",	F3F(2, 0x36, 0x07d), F3F(~2, ~0x36, ~0x07d), "e,f,g", 0, v9a },
-{ "fnor",	F3F(2, 0x36, 0x062), F3F(~2, ~0x36, ~0x062), "v,B,H", 0, v9a },
-{ "fnors",	F3F(2, 0x36, 0x063), F3F(~2, ~0x36, ~0x063), "e,f,g", 0, v9a },
-{ "fand",	F3F(2, 0x36, 0x070), F3F(~2, ~0x36, ~0x070), "v,B,H", 0, v9a },
-{ "fands",	F3F(2, 0x36, 0x071), F3F(~2, ~0x36, ~0x071), "e,f,g", 0, v9a },
-{ "fnand",	F3F(2, 0x36, 0x06e), F3F(~2, ~0x36, ~0x06e), "v,B,H", 0, v9a },
-{ "fnands",	F3F(2, 0x36, 0x06f), F3F(~2, ~0x36, ~0x06f), "e,f,g", 0, v9a },
-{ "fxor",	F3F(2, 0x36, 0x06c), F3F(~2, ~0x36, ~0x06c), "v,B,H", 0, v9a },
-{ "fxors",	F3F(2, 0x36, 0x06d), F3F(~2, ~0x36, ~0x06d), "e,f,g", 0, v9a },
-{ "fxnor",	F3F(2, 0x36, 0x072), F3F(~2, ~0x36, ~0x072), "v,B,H", 0, v9a },
-{ "fxnors",	F3F(2, 0x36, 0x073), F3F(~2, ~0x36, ~0x073), "e,f,g", 0, v9a },
-{ "fornot1",	F3F(2, 0x36, 0x07a), F3F(~2, ~0x36, ~0x07a), "v,B,H", 0, v9a },
-{ "fornot1s",	F3F(2, 0x36, 0x07b), F3F(~2, ~0x36, ~0x07b), "e,f,g", 0, v9a },
-{ "fornot2",	F3F(2, 0x36, 0x076), F3F(~2, ~0x36, ~0x076), "v,B,H", 0, v9a },
-{ "fornot2s",	F3F(2, 0x36, 0x077), F3F(~2, ~0x36, ~0x077), "e,f,g", 0, v9a },
-{ "fandnot1",	F3F(2, 0x36, 0x068), F3F(~2, ~0x36, ~0x068), "v,B,H", 0, v9a },
-{ "fandnot1s",	F3F(2, 0x36, 0x069), F3F(~2, ~0x36, ~0x069), "e,f,g", 0, v9a },
-{ "fandnot2",	F3F(2, 0x36, 0x064), F3F(~2, ~0x36, ~0x064), "v,B,H", 0, v9a },
-{ "fandnot2s",	F3F(2, 0x36, 0x065), F3F(~2, ~0x36, ~0x065), "e,f,g", 0, v9a },
-
-{ "fcmpgt16",	F3F(2, 0x36, 0x028), F3F(~2, ~0x36, ~0x028), "v,B,d", 0, v9a },
-{ "fcmpgt32",	F3F(2, 0x36, 0x02c), F3F(~2, ~0x36, ~0x02c), "v,B,d", 0, v9a },
-{ "fcmple16",	F3F(2, 0x36, 0x020), F3F(~2, ~0x36, ~0x020), "v,B,d", 0, v9a },
-{ "fcmple32",	F3F(2, 0x36, 0x024), F3F(~2, ~0x36, ~0x024), "v,B,d", 0, v9a },
-{ "fcmpne16",	F3F(2, 0x36, 0x022), F3F(~2, ~0x36, ~0x022), "v,B,d", 0, v9a },
-{ "fcmpne32",	F3F(2, 0x36, 0x026), F3F(~2, ~0x36, ~0x026), "v,B,d", 0, v9a },
-{ "fcmpeq16",	F3F(2, 0x36, 0x02a), F3F(~2, ~0x36, ~0x02a), "v,B,d", 0, v9a },
-{ "fcmpeq32",	F3F(2, 0x36, 0x02e), F3F(~2, ~0x36, ~0x02e), "v,B,d", 0, v9a },
-
-{ "edge8",	F3F(2, 0x36, 0x000), F3F(~2, ~0x36, ~0x000), "1,2,d", 0, v9a },
-{ "edge8l",	F3F(2, 0x36, 0x002), F3F(~2, ~0x36, ~0x002), "1,2,d", 0, v9a },
-{ "edge16",	F3F(2, 0x36, 0x004), F3F(~2, ~0x36, ~0x004), "1,2,d", 0, v9a },
-{ "edge16l",	F3F(2, 0x36, 0x006), F3F(~2, ~0x36, ~0x006), "1,2,d", 0, v9a },
-{ "edge32",	F3F(2, 0x36, 0x008), F3F(~2, ~0x36, ~0x008), "1,2,d", 0, v9a },
-{ "edge32l",	F3F(2, 0x36, 0x00a), F3F(~2, ~0x36, ~0x00a), "1,2,d", 0, v9a },
-
-{ "pdist",	F3F(2, 0x36, 0x03e), F3F(~2, ~0x36, ~0x03e), "v,B,H", 0, v9a },
-
-{ "array8",	F3F(2, 0x36, 0x010), F3F(~2, ~0x36, ~0x010), "1,2,d", 0, v9a },
-{ "array16",	F3F(2, 0x36, 0x012), F3F(~2, ~0x36, ~0x012), "1,2,d", 0, v9a },
-{ "array32",	F3F(2, 0x36, 0x014), F3F(~2, ~0x36, ~0x014), "1,2,d", 0, v9a },
+{ "fmul8x16",           F3F(2, 0x36, 0x031), F3F(~2, ~0x36, ~0x031), "e,B,H", 0, v9a },
+{ "fmul8x16au",         F3F(2, 0x36, 0x033), F3F(~2, ~0x36, ~0x033), "e,f,H", 0, v9a },
+{ "fmul8x16al",         F3F(2, 0x36, 0x035), F3F(~2, ~0x36, ~0x035), "e,f,H", 0, v9a },
+{ "fmul8sux16",         F3F(2, 0x36, 0x036), F3F(~2, ~0x36, ~0x036), "v,B,H", 0, v9a },
+{ "fmul8ulx16",         F3F(2, 0x36, 0x037), F3F(~2, ~0x36, ~0x037), "v,B,H", 0, v9a },
+{ "fmuld8sux16",        F3F(2, 0x36, 0x038), F3F(~2, ~0x36, ~0x038), "e,f,H", 0, v9a },
+{ "fmuld8ulx16",        F3F(2, 0x36, 0x039), F3F(~2, ~0x36, ~0x039), "e,f,H", 0, v9a },
+
+{ "alignaddr",  F3F(2, 0x36, 0x018), F3F(~2, ~0x36, ~0x018), "1,2,d", 0, v9a },
+{ "alignaddrl", F3F(2, 0x36, 0x01a), F3F(~2, ~0x36, ~0x01a), "1,2,d", 0, v9a },
+{ "faligndata", F3F(2, 0x36, 0x048), F3F(~2, ~0x36, ~0x048), "v,B,H", 0, v9a },
+
+{ "fzero",      F3F(2, 0x36, 0x060), F3F(~2, ~0x36, ~0x060), "H", 0, v9a },
+{ "fzeros",     F3F(2, 0x36, 0x061), F3F(~2, ~0x36, ~0x061), "g", 0, v9a },
+{ "fone",       F3F(2, 0x36, 0x07e), F3F(~2, ~0x36, ~0x07e), "H", 0, v9a },
+{ "fones",      F3F(2, 0x36, 0x07f), F3F(~2, ~0x36, ~0x07f), "g", 0, v9a },
+{ "fsrc1",      F3F(2, 0x36, 0x074), F3F(~2, ~0x36, ~0x074), "v,H", 0, v9a },
+{ "fsrc1s",     F3F(2, 0x36, 0x075), F3F(~2, ~0x36, ~0x075), "e,g", 0, v9a },
+{ "fsrc2",      F3F(2, 0x36, 0x078), F3F(~2, ~0x36, ~0x078), "B,H", 0, v9a },
+{ "fsrc2s",     F3F(2, 0x36, 0x079), F3F(~2, ~0x36, ~0x079), "f,g", 0, v9a },
+{ "fnot1",      F3F(2, 0x36, 0x06a), F3F(~2, ~0x36, ~0x06a), "v,H", 0, v9a },
+{ "fnot1s",     F3F(2, 0x36, 0x06b), F3F(~2, ~0x36, ~0x06b), "e,g", 0, v9a },
+{ "fnot2",      F3F(2, 0x36, 0x066), F3F(~2, ~0x36, ~0x066), "B,H", 0, v9a },
+{ "fnot2s",     F3F(2, 0x36, 0x067), F3F(~2, ~0x36, ~0x067), "f,g", 0, v9a },
+{ "for",        F3F(2, 0x36, 0x07c), F3F(~2, ~0x36, ~0x07c), "v,B,H", 0, v9a },
+{ "fors",       F3F(2, 0x36, 0x07d), F3F(~2, ~0x36, ~0x07d), "e,f,g", 0, v9a },
+{ "fnor",       F3F(2, 0x36, 0x062), F3F(~2, ~0x36, ~0x062), "v,B,H", 0, v9a },
+{ "fnors",      F3F(2, 0x36, 0x063), F3F(~2, ~0x36, ~0x063), "e,f,g", 0, v9a },
+{ "fand",       F3F(2, 0x36, 0x070), F3F(~2, ~0x36, ~0x070), "v,B,H", 0, v9a },
+{ "fands",      F3F(2, 0x36, 0x071), F3F(~2, ~0x36, ~0x071), "e,f,g", 0, v9a },
+{ "fnand",      F3F(2, 0x36, 0x06e), F3F(~2, ~0x36, ~0x06e), "v,B,H", 0, v9a },
+{ "fnands",     F3F(2, 0x36, 0x06f), F3F(~2, ~0x36, ~0x06f), "e,f,g", 0, v9a },
+{ "fxor",       F3F(2, 0x36, 0x06c), F3F(~2, ~0x36, ~0x06c), "v,B,H", 0, v9a },
+{ "fxors",      F3F(2, 0x36, 0x06d), F3F(~2, ~0x36, ~0x06d), "e,f,g", 0, v9a },
+{ "fxnor",      F3F(2, 0x36, 0x072), F3F(~2, ~0x36, ~0x072), "v,B,H", 0, v9a },
+{ "fxnors",     F3F(2, 0x36, 0x073), F3F(~2, ~0x36, ~0x073), "e,f,g", 0, v9a },
+{ "fornot1",    F3F(2, 0x36, 0x07a), F3F(~2, ~0x36, ~0x07a), "v,B,H", 0, v9a },
+{ "fornot1s",   F3F(2, 0x36, 0x07b), F3F(~2, ~0x36, ~0x07b), "e,f,g", 0, v9a },
+{ "fornot2",    F3F(2, 0x36, 0x076), F3F(~2, ~0x36, ~0x076), "v,B,H", 0, v9a },
+{ "fornot2s",   F3F(2, 0x36, 0x077), F3F(~2, ~0x36, ~0x077), "e,f,g", 0, v9a },
+{ "fandnot1",   F3F(2, 0x36, 0x068), F3F(~2, ~0x36, ~0x068), "v,B,H", 0, v9a },
+{ "fandnot1s",  F3F(2, 0x36, 0x069), F3F(~2, ~0x36, ~0x069), "e,f,g", 0, v9a },
+{ "fandnot2",   F3F(2, 0x36, 0x064), F3F(~2, ~0x36, ~0x064), "v,B,H", 0, v9a },
+{ "fandnot2s",  F3F(2, 0x36, 0x065), F3F(~2, ~0x36, ~0x065), "e,f,g", 0, v9a },
+
+{ "fcmpgt16",   F3F(2, 0x36, 0x028), F3F(~2, ~0x36, ~0x028), "v,B,d", 0, v9a },
+{ "fcmpgt32",   F3F(2, 0x36, 0x02c), F3F(~2, ~0x36, ~0x02c), "v,B,d", 0, v9a },
+{ "fcmple16",   F3F(2, 0x36, 0x020), F3F(~2, ~0x36, ~0x020), "v,B,d", 0, v9a },
+{ "fcmple32",   F3F(2, 0x36, 0x024), F3F(~2, ~0x36, ~0x024), "v,B,d", 0, v9a },
+{ "fcmpne16",   F3F(2, 0x36, 0x022), F3F(~2, ~0x36, ~0x022), "v,B,d", 0, v9a },
+{ "fcmpne32",   F3F(2, 0x36, 0x026), F3F(~2, ~0x36, ~0x026), "v,B,d", 0, v9a },
+{ "fcmpeq16",   F3F(2, 0x36, 0x02a), F3F(~2, ~0x36, ~0x02a), "v,B,d", 0, v9a },
+{ "fcmpeq32",   F3F(2, 0x36, 0x02e), F3F(~2, ~0x36, ~0x02e), "v,B,d", 0, v9a },
+
+{ "edge8",      F3F(2, 0x36, 0x000), F3F(~2, ~0x36, ~0x000), "1,2,d", 0, v9a },
+{ "edge8l",     F3F(2, 0x36, 0x002), F3F(~2, ~0x36, ~0x002), "1,2,d", 0, v9a },
+{ "edge16",     F3F(2, 0x36, 0x004), F3F(~2, ~0x36, ~0x004), "1,2,d", 0, v9a },
+{ "edge16l",    F3F(2, 0x36, 0x006), F3F(~2, ~0x36, ~0x006), "1,2,d", 0, v9a },
+{ "edge32",     F3F(2, 0x36, 0x008), F3F(~2, ~0x36, ~0x008), "1,2,d", 0, v9a },
+{ "edge32l",    F3F(2, 0x36, 0x00a), F3F(~2, ~0x36, ~0x00a), "1,2,d", 0, v9a },
+
+{ "pdist",      F3F(2, 0x36, 0x03e), F3F(~2, ~0x36, ~0x03e), "v,B,H", 0, v9a },
+
+{ "array8",     F3F(2, 0x36, 0x010), F3F(~2, ~0x36, ~0x010), "1,2,d", 0, v9a },
+{ "array16",    F3F(2, 0x36, 0x012), F3F(~2, ~0x36, ~0x012), "1,2,d", 0, v9a },
+{ "array32",    F3F(2, 0x36, 0x014), F3F(~2, ~0x36, ~0x014), "1,2,d", 0, v9a },
 
 /* Cheetah instructions */
 { "edge8n",    F3F(2, 0x36, 0x001), F3F(~2, ~0x36, ~0x001), "1,2,d", 0, v9b },
@@ -2043,8 +2043,8 @@ SLCBCC("cbnefr", 15),
    with v9a instructions such as "edge8" which looks like impdep1. */
 
 #define IMPDEP(name, code) \
-{ name,	F3(2, code, 0), F3(~2, ~code, ~0)|ASI(~0), "1,2,d", 0, v9notv9a }, \
-{ name,	F3(2, code, 1), F3(~2, ~code, ~1),	   "1,i,d", 0, v9notv9a }, \
+{ name, F3(2, code, 0), F3(~2, ~code, ~0)|ASI(~0), "1,2,d", 0, v9notv9a }, \
+{ name, F3(2, code, 1), F3(~2, ~code, ~1),         "1,i,d", 0, v9notv9a }, \
 { name, F3(2, code, 0), F3(~2, ~code, ~0),         "x,1,2,d", 0, v9notv9a }, \
 { name, F3(2, code, 0), F3(~2, ~code, ~0),         "x,e,f,g", 0, v9notv9a }
 
@@ -2303,8 +2303,8 @@ sparc_decode_sparclet_cpreg (value)
 
 /* Bitmask of v9 architectures.  */
 #define MASK_V9 ((1 << SPARC_OPCODE_ARCH_V9) \
-		 | (1 << SPARC_OPCODE_ARCH_V9A) \
-		 | (1 << SPARC_OPCODE_ARCH_V9B))
+                 | (1 << SPARC_OPCODE_ARCH_V9A) \
+                 | (1 << SPARC_OPCODE_ARCH_V9B))
 /* 1 if INSN is for v9 only.  */
 #define V9_ONLY_P(insn) (! ((insn)->architecture & ~MASK_V9))
 /* 1 if INSN is for v9.  */
@@ -2336,9 +2336,9 @@ static int compare_opcodes PARAMS ((const void *, const void *));
 static int compute_arch_mask PARAMS ((unsigned long));
 
 /* Sign-extend a value which is N bits long.  */
-#define	SEX(value, bits) \
-	((((int)(value)) << ((8 * sizeof (int)) - bits))	\
-			 >> ((8 * sizeof (int)) - bits) )
+#define SEX(value, bits) \
+        ((((int)(value)) << ((8 * sizeof (int)) - bits))        \
+                         >> ((8 * sizeof (int)) - bits) )
 
 static const char * const reg_names[] =
 { "g0", "g1", "g2", "g3", "g4", "g5", "g6", "g7",
@@ -2357,7 +2357,7 @@ static const char * const reg_names[] =
   "y", "psr", "wim", "tbr", "pc", "npc", "fpsr", "cpsr"
 };
 
-#define	freg_names	(&reg_names[4 * 8])
+#define freg_names      (&reg_names[4 * 8])
 
 /* These are ordered according to there register number in
    rdpr and wrpr insns.  */
@@ -2403,55 +2403,55 @@ static const char * const v9a_asr_reg_names[] =
      {
        unsigned long int code;
        struct
-	 {
-	   unsigned int anop:2;
-	   #define	op	ldst.anop
-	   unsigned int anrd:5;
-	   #define	rd	ldst.anrd
-	   unsigned int op3:6;
-	   unsigned int anrs1:5;
-	   #define	rs1	ldst.anrs1
-	   unsigned int i:1;
-	   unsigned int anasi:8;
-	   #define	asi	ldst.anasi
-	   unsigned int anrs2:5;
-	   #define	rs2	ldst.anrs2
-	   #define	shcnt	rs2
-	 } ldst;
+         {
+           unsigned int anop:2;
+           #define      op      ldst.anop
+           unsigned int anrd:5;
+           #define      rd      ldst.anrd
+           unsigned int op3:6;
+           unsigned int anrs1:5;
+           #define      rs1     ldst.anrs1
+           unsigned int i:1;
+           unsigned int anasi:8;
+           #define      asi     ldst.anasi
+           unsigned int anrs2:5;
+           #define      rs2     ldst.anrs2
+           #define      shcnt   rs2
+         } ldst;
        struct
-	 {
-	   unsigned int anop:2, anrd:5, op3:6, anrs1:5, i:1;
-	   unsigned int IMM13:13;
-	   #define	imm13	IMM13.IMM13
-	 } IMM13;
+         {
+           unsigned int anop:2, anrd:5, op3:6, anrs1:5, i:1;
+           unsigned int IMM13:13;
+           #define      imm13   IMM13.IMM13
+         } IMM13;
        struct
-	 {
-	   unsigned int anop:2;
-	   unsigned int a:1;
-	   unsigned int cond:4;
-	   unsigned int op2:3;
-	   unsigned int DISP22:22;
-	   #define	disp22	branch.DISP22
-	   #define	imm22	disp22
-	 } branch;
+         {
+           unsigned int anop:2;
+           unsigned int a:1;
+           unsigned int cond:4;
+           unsigned int op2:3;
+           unsigned int DISP22:22;
+           #define      disp22  branch.DISP22
+           #define      imm22   disp22
+         } branch;
        struct
-	 {
-	   unsigned int anop:2;
-	   unsigned int a:1;
-	   unsigned int z:1;
-	   unsigned int rcond:3;
-	   unsigned int op2:3;
-	   unsigned int DISP16HI:2;
-	   unsigned int p:1;
-	   unsigned int _rs1:5;
-	   unsigned int DISP16LO:14;
-	 } branch16;
+         {
+           unsigned int anop:2;
+           unsigned int a:1;
+           unsigned int z:1;
+           unsigned int rcond:3;
+           unsigned int op2:3;
+           unsigned int DISP16HI:2;
+           unsigned int p:1;
+           unsigned int _rs1:5;
+           unsigned int DISP16LO:14;
+         } branch16;
        struct
-	 {
-	   unsigned int anop:2;
-	   unsigned int adisp30:30;
-	   #define	disp30	call.adisp30
-	 } call;
+         {
+           unsigned int anop:2;
+           unsigned int adisp30:30;
+           #define      disp30  call.adisp30
+         } call;
      };
 
    */
@@ -2467,8 +2467,8 @@ is_delayed_branch (insn)
     {
       const struct sparc_opcode *opcode = op->opcode;
       if ((opcode->match & insn) == opcode->match
-	  && (opcode->lose & insn) == 0)
-	return (opcode->flags & F_DELAYED);
+          && (opcode->lose & insn) == 0)
+        return (opcode->flags & F_DELAYED);
     }
   return 0;
 }
@@ -2510,13 +2510,13 @@ print_insn_sparc (memaddr, info)
       current_arch_mask = compute_arch_mask (info->mach);
 
       if (!opcodes_initialized)
-	sorted_opcodes = (const struct sparc_opcode **)
+        sorted_opcodes = (const struct sparc_opcode **)
             malloc (sparc_num_opcodes * sizeof (struct sparc_opcode *));
       /* Reset the sorted table so we can resort it.  */
       for (i = 0; i < sparc_num_opcodes; ++i)
-	sorted_opcodes[i] = &sparc_opcodes[i];
+        sorted_opcodes[i] = &sparc_opcodes[i];
       qsort ((char *) sorted_opcodes, sparc_num_opcodes,
-	     sizeof (sorted_opcodes[0]), compare_opcodes);
+             sizeof (sorted_opcodes[0]), compare_opcodes);
 
       build_hash_table (sorted_opcodes, opcode_hash_table, sparc_num_opcodes);
       current_mach = info->mach;
@@ -2528,8 +2528,8 @@ print_insn_sparc (memaddr, info)
       (*info->read_memory_func) (memaddr, buffer, sizeof (buffer), info);
     if (status != 0)
       {
-	(*info->memory_error_func) (status, memaddr, info);
-	return -1;
+        (*info->memory_error_func) (status, memaddr, info);
+        return -1;
       }
   }
 
@@ -2542,10 +2542,10 @@ print_insn_sparc (memaddr, info)
 
   insn = getword (buffer);
 
-  info->insn_info_valid = 1;			/* We do return this info */
-  info->insn_type = dis_nonbranch;		/* Assume non branch insn */
-  info->branch_delay_insns = 0;			/* Assume no delay */
-  info->target = 0;				/* Assume no target known */
+  info->insn_info_valid = 1;                    /* We do return this info */
+  info->insn_type = dis_nonbranch;              /* Assume non branch insn */
+  info->branch_delay_insns = 0;                 /* Assume no delay */
+  info->target = 0;                             /* Assume no target known */
 
   for (op = opcode_hash_table[HASH_INSN (insn)]; op; op = op->next)
     {
@@ -2553,484 +2553,484 @@ print_insn_sparc (memaddr, info)
 
       /* If the insn isn't supported by the current architecture, skip it.  */
       if (! (opcode->architecture & current_arch_mask))
-	continue;
+        continue;
 
       if ((opcode->match & insn) == opcode->match
-	  && (opcode->lose & insn) == 0)
-	{
-	  /* Nonzero means that we have found an instruction which has
-	     the effect of adding or or'ing the imm13 field to rs1.  */
-	  int imm_added_to_rs1 = 0;
-	  int imm_ored_to_rs1 = 0;
+          && (opcode->lose & insn) == 0)
+        {
+          /* Nonzero means that we have found an instruction which has
+             the effect of adding or or'ing the imm13 field to rs1.  */
+          int imm_added_to_rs1 = 0;
+          int imm_ored_to_rs1 = 0;
 
-	  /* Nonzero means that we have found a plus sign in the args
-	     field of the opcode table.  */
-	  int found_plus = 0;
+          /* Nonzero means that we have found a plus sign in the args
+             field of the opcode table.  */
+          int found_plus = 0;
 
-	  /* Nonzero means we have an annulled branch.  */
-	  int is_annulled = 0;
+          /* Nonzero means we have an annulled branch.  */
+          int is_annulled = 0;
 
-	  /* Do we have an `add' or `or' instruction combining an
+          /* Do we have an `add' or `or' instruction combining an
              immediate with rs1?  */
-	  if (opcode->match == 0x80102000) /* or */
-	    imm_ored_to_rs1 = 1;
-	  if (opcode->match == 0x80002000) /* add */
-	    imm_added_to_rs1 = 1;
-
-	  if (X_RS1 (insn) != X_RD (insn)
-	      && strchr (opcode->args, 'r') != 0)
-	      /* Can't do simple format if source and dest are different.  */
-	      continue;
-	  if (X_RS2 (insn) != X_RD (insn)
-	      && strchr (opcode->args, 'O') != 0)
-	      /* Can't do simple format if source and dest are different.  */
-	      continue;
-
-	  (*info->fprintf_func) (stream, opcode->name);
-
-	  {
-	    register const char *s;
-
-	    if (opcode->args[0] != ',')
-	      (*info->fprintf_func) (stream, " ");
-	    for (s = opcode->args; *s != '\0'; ++s)
-	      {
-		while (*s == ',')
-		  {
-		    (*info->fprintf_func) (stream, ",");
-		    ++s;
-		    switch (*s) {
-		    case 'a':
-		      (*info->fprintf_func) (stream, "a");
-		      is_annulled = 1;
-		      ++s;
-		      continue;
-		    case 'N':
-		      (*info->fprintf_func) (stream, "pn");
-		      ++s;
-		      continue;
-
-		    case 'T':
-		      (*info->fprintf_func) (stream, "pt");
-		      ++s;
-		      continue;
-
-		    default:
-		      break;
-		    }		/* switch on arg */
-		  }		/* while there are comma started args */
-
-		(*info->fprintf_func) (stream, " ");
-
-		switch (*s)
-		  {
-		  case '+':
-		    found_plus = 1;
-
-		    /* note fall-through */
-		  default:
-		    (*info->fprintf_func) (stream, "%c", *s);
-		    break;
-
-		  case '#':
-		    (*info->fprintf_func) (stream, "0");
-		    break;
-
-#define	reg(n)	(*info->fprintf_func) (stream, "%%%s", reg_names[n])
-		  case '1':
-		  case 'r':
-		    reg (X_RS1 (insn));
-		    break;
-
-		  case '2':
-		  case 'O':
-		    reg (X_RS2 (insn));
-		    break;
-
-		  case 'd':
-		    reg (X_RD (insn));
-		    break;
-#undef	reg
-
-#define	freg(n)		(*info->fprintf_func) (stream, "%%%s", freg_names[n])
-#define	fregx(n)	(*info->fprintf_func) (stream, "%%%s", freg_names[((n) & ~1) | (((n) & 1) << 5)])
-		  case 'e':
-		    freg (X_RS1 (insn));
-		    break;
-		  case 'v':	/* double/even */
-		  case 'V':	/* quad/multiple of 4 */
-		    fregx (X_RS1 (insn));
-		    break;
-
-		  case 'f':
-		    freg (X_RS2 (insn));
-		    break;
-		  case 'B':	/* double/even */
-		  case 'R':	/* quad/multiple of 4 */
-		    fregx (X_RS2 (insn));
-		    break;
-
-		  case 'g':
-		    freg (X_RD (insn));
-		    break;
-		  case 'H':	/* double/even */
-		  case 'J':	/* quad/multiple of 4 */
-		    fregx (X_RD (insn));
-		    break;
-#undef	freg
-#undef	fregx
-
-#define	creg(n)	(*info->fprintf_func) (stream, "%%c%u", (unsigned int) (n))
-		  case 'b':
-		    creg (X_RS1 (insn));
-		    break;
-
-		  case 'c':
-		    creg (X_RS2 (insn));
-		    break;
-
-		  case 'D':
-		    creg (X_RD (insn));
-		    break;
-#undef	creg
-
-		  case 'h':
-		    (*info->fprintf_func) (stream, "%%hi(%#x)",
-					   ((unsigned) 0xFFFFFFFF
-					    & ((int) X_IMM22 (insn) << 10)));
-		    break;
-
-		  case 'i':	/* 13 bit immediate */
-		  case 'I':	/* 11 bit immediate */
-		  case 'j':	/* 10 bit immediate */
-		    {
-		      int imm;
-
-		      if (*s == 'i')
-		        imm = X_SIMM (insn, 13);
-		      else if (*s == 'I')
-			imm = X_SIMM (insn, 11);
-		      else
-			imm = X_SIMM (insn, 10);
-
-		      /* Check to see whether we have a 1+i, and take
-			 note of that fact.
-
-			 Note: because of the way we sort the table,
-			 we will be matching 1+i rather than i+1,
-			 so it is OK to assume that i is after +,
-			 not before it.  */
-		      if (found_plus)
-			imm_added_to_rs1 = 1;
-
-		      if (imm <= 9)
-			(*info->fprintf_func) (stream, "%d", imm);
-		      else
-			(*info->fprintf_func) (stream, "%#x", imm);
-		    }
-		    break;
-
-		  case 'X':	/* 5 bit unsigned immediate */
-		  case 'Y':	/* 6 bit unsigned immediate */
-		    {
-		      int imm = X_IMM (insn, *s == 'X' ? 5 : 6);
-
-		      if (imm <= 9)
-			(info->fprintf_func) (stream, "%d", imm);
-		      else
-			(info->fprintf_func) (stream, "%#x", (unsigned) imm);
-		    }
-		    break;
-
-		  case '3':
-		    (info->fprintf_func) (stream, "%d", X_IMM (insn, 3));
-		    break;
-
-		  case 'K':
-		    {
-		      int mask = X_MEMBAR (insn);
-		      int bit = 0x40, printed_one = 0;
-		      const char *name;
-
-		      if (mask == 0)
-			(info->fprintf_func) (stream, "0");
-		      else
-			while (bit)
-			  {
-			    if (mask & bit)
-			      {
-				if (printed_one)
-				  (info->fprintf_func) (stream, "|");
-				name = sparc_decode_membar (bit);
-				(info->fprintf_func) (stream, "%s", name);
-				printed_one = 1;
-			      }
-			    bit >>= 1;
-			  }
-		      break;
-		    }
-
-		  case 'k':
-		    info->target = memaddr + SEX (X_DISP16 (insn), 16) * 4;
-		    (*info->print_address_func) (info->target, info);
-		    break;
-
-		  case 'G':
-		    info->target = memaddr + SEX (X_DISP19 (insn), 19) * 4;
-		    (*info->print_address_func) (info->target, info);
-		    break;
-
-		  case '6':
-		  case '7':
-		  case '8':
-		  case '9':
-		    (*info->fprintf_func) (stream, "%%fcc%c", *s - '6' + '0');
-		    break;
-
-		  case 'z':
-		    (*info->fprintf_func) (stream, "%%icc");
-		    break;
-
-		  case 'Z':
-		    (*info->fprintf_func) (stream, "%%xcc");
-		    break;
-
-		  case 'E':
-		    (*info->fprintf_func) (stream, "%%ccr");
-		    break;
-
-		  case 's':
-		    (*info->fprintf_func) (stream, "%%fprs");
-		    break;
-
-		  case 'o':
-		    (*info->fprintf_func) (stream, "%%asi");
-		    break;
-
-		  case 'W':
-		    (*info->fprintf_func) (stream, "%%tick");
-		    break;
-
-		  case 'P':
-		    (*info->fprintf_func) (stream, "%%pc");
-		    break;
-
-		  case '?':
-		    if (X_RS1 (insn) == 31)
-		      (*info->fprintf_func) (stream, "%%ver");
-		    else if ((unsigned) X_RS1 (insn) < 16)
-		      (*info->fprintf_func) (stream, "%%%s",
-					     v9_priv_reg_names[X_RS1 (insn)]);
-		    else
-		      (*info->fprintf_func) (stream, "%%reserved");
-		    break;
-
-		  case '!':
-		    if ((unsigned) X_RD (insn) < 15)
-		      (*info->fprintf_func) (stream, "%%%s",
-					     v9_priv_reg_names[X_RD (insn)]);
-		    else
-		      (*info->fprintf_func) (stream, "%%reserved");
-		    break;
-
-		  case '/':
-		    if (X_RS1 (insn) < 16 || X_RS1 (insn) > 25)
-		      (*info->fprintf_func) (stream, "%%reserved");
-		    else
-		      (*info->fprintf_func) (stream, "%%%s",
-					     v9a_asr_reg_names[X_RS1 (insn)-16]);
-		    break;
-
-		  case '_':
-		    if (X_RD (insn) < 16 || X_RD (insn) > 25)
-		      (*info->fprintf_func) (stream, "%%reserved");
-		    else
-		      (*info->fprintf_func) (stream, "%%%s",
-					     v9a_asr_reg_names[X_RD (insn)-16]);
-		    break;
-
-		  case '*':
-		    {
-		      const char *name = sparc_decode_prefetch (X_RD (insn));
-
-		      if (name)
-			(*info->fprintf_func) (stream, "%s", name);
-		      else
-			(*info->fprintf_func) (stream, "%d", X_RD (insn));
-		      break;
-		    }
-
-		  case 'M':
-		    (*info->fprintf_func) (stream, "%%asr%d", X_RS1 (insn));
-		    break;
-
-		  case 'm':
-		    (*info->fprintf_func) (stream, "%%asr%d", X_RD (insn));
-		    break;
-
-		  case 'L':
-		    info->target = memaddr + SEX (X_DISP30 (insn), 30) * 4;
-		    (*info->print_address_func) (info->target, info);
-		    break;
-
-		  case 'n':
-		    (*info->fprintf_func)
-		      (stream, "%#x", SEX (X_DISP22 (insn), 22));
-		    break;
-
-		  case 'l':
-		    info->target = memaddr + SEX (X_DISP22 (insn), 22) * 4;
-		    (*info->print_address_func) (info->target, info);
-		    break;
-
-		  case 'A':
-		    {
-		      const char *name;
-
-		      if ((info->mach == bfd_mach_sparc_v8plusa) ||
+          if (opcode->match == 0x80102000) /* or */
+            imm_ored_to_rs1 = 1;
+          if (opcode->match == 0x80002000) /* add */
+            imm_added_to_rs1 = 1;
+
+          if (X_RS1 (insn) != X_RD (insn)
+              && strchr (opcode->args, 'r') != 0)
+              /* Can't do simple format if source and dest are different.  */
+              continue;
+          if (X_RS2 (insn) != X_RD (insn)
+              && strchr (opcode->args, 'O') != 0)
+              /* Can't do simple format if source and dest are different.  */
+              continue;
+
+          (*info->fprintf_func) (stream, opcode->name);
+
+          {
+            register const char *s;
+
+            if (opcode->args[0] != ',')
+              (*info->fprintf_func) (stream, " ");
+            for (s = opcode->args; *s != '\0'; ++s)
+              {
+                while (*s == ',')
+                  {
+                    (*info->fprintf_func) (stream, ",");
+                    ++s;
+                    switch (*s) {
+                    case 'a':
+                      (*info->fprintf_func) (stream, "a");
+                      is_annulled = 1;
+                      ++s;
+                      continue;
+                    case 'N':
+                      (*info->fprintf_func) (stream, "pn");
+                      ++s;
+                      continue;
+
+                    case 'T':
+                      (*info->fprintf_func) (stream, "pt");
+                      ++s;
+                      continue;
+
+                    default:
+                      break;
+                    }           /* switch on arg */
+                  }             /* while there are comma started args */
+
+                (*info->fprintf_func) (stream, " ");
+
+                switch (*s)
+                  {
+                  case '+':
+                    found_plus = 1;
+
+                    /* note fall-through */
+                  default:
+                    (*info->fprintf_func) (stream, "%c", *s);
+                    break;
+
+                  case '#':
+                    (*info->fprintf_func) (stream, "0");
+                    break;
+
+#define reg(n)  (*info->fprintf_func) (stream, "%%%s", reg_names[n])
+                  case '1':
+                  case 'r':
+                    reg (X_RS1 (insn));
+                    break;
+
+                  case '2':
+                  case 'O':
+                    reg (X_RS2 (insn));
+                    break;
+
+                  case 'd':
+                    reg (X_RD (insn));
+                    break;
+#undef  reg
+
+#define freg(n)         (*info->fprintf_func) (stream, "%%%s", freg_names[n])
+#define fregx(n)        (*info->fprintf_func) (stream, "%%%s", freg_names[((n) & ~1) | (((n) & 1) << 5)])
+                  case 'e':
+                    freg (X_RS1 (insn));
+                    break;
+                  case 'v':     /* double/even */
+                  case 'V':     /* quad/multiple of 4 */
+                    fregx (X_RS1 (insn));
+                    break;
+
+                  case 'f':
+                    freg (X_RS2 (insn));
+                    break;
+                  case 'B':     /* double/even */
+                  case 'R':     /* quad/multiple of 4 */
+                    fregx (X_RS2 (insn));
+                    break;
+
+                  case 'g':
+                    freg (X_RD (insn));
+                    break;
+                  case 'H':     /* double/even */
+                  case 'J':     /* quad/multiple of 4 */
+                    fregx (X_RD (insn));
+                    break;
+#undef  freg
+#undef  fregx
+
+#define creg(n) (*info->fprintf_func) (stream, "%%c%u", (unsigned int) (n))
+                  case 'b':
+                    creg (X_RS1 (insn));
+                    break;
+
+                  case 'c':
+                    creg (X_RS2 (insn));
+                    break;
+
+                  case 'D':
+                    creg (X_RD (insn));
+                    break;
+#undef  creg
+
+                  case 'h':
+                    (*info->fprintf_func) (stream, "%%hi(%#x)",
+                                           ((unsigned) 0xFFFFFFFF
+                                            & ((int) X_IMM22 (insn) << 10)));
+                    break;
+
+                  case 'i':     /* 13 bit immediate */
+                  case 'I':     /* 11 bit immediate */
+                  case 'j':     /* 10 bit immediate */
+                    {
+                      int imm;
+
+                      if (*s == 'i')
+                        imm = X_SIMM (insn, 13);
+                      else if (*s == 'I')
+                        imm = X_SIMM (insn, 11);
+                      else
+                        imm = X_SIMM (insn, 10);
+
+                      /* Check to see whether we have a 1+i, and take
+                         note of that fact.
+
+                         Note: because of the way we sort the table,
+                         we will be matching 1+i rather than i+1,
+                         so it is OK to assume that i is after +,
+                         not before it.  */
+                      if (found_plus)
+                        imm_added_to_rs1 = 1;
+
+                      if (imm <= 9)
+                        (*info->fprintf_func) (stream, "%d", imm);
+                      else
+                        (*info->fprintf_func) (stream, "%#x", imm);
+                    }
+                    break;
+
+                  case 'X':     /* 5 bit unsigned immediate */
+                  case 'Y':     /* 6 bit unsigned immediate */
+                    {
+                      int imm = X_IMM (insn, *s == 'X' ? 5 : 6);
+
+                      if (imm <= 9)
+                        (info->fprintf_func) (stream, "%d", imm);
+                      else
+                        (info->fprintf_func) (stream, "%#x", (unsigned) imm);
+                    }
+                    break;
+
+                  case '3':
+                    (info->fprintf_func) (stream, "%d", X_IMM (insn, 3));
+                    break;
+
+                  case 'K':
+                    {
+                      int mask = X_MEMBAR (insn);
+                      int bit = 0x40, printed_one = 0;
+                      const char *name;
+
+                      if (mask == 0)
+                        (info->fprintf_func) (stream, "0");
+                      else
+                        while (bit)
+                          {
+                            if (mask & bit)
+                              {
+                                if (printed_one)
+                                  (info->fprintf_func) (stream, "|");
+                                name = sparc_decode_membar (bit);
+                                (info->fprintf_func) (stream, "%s", name);
+                                printed_one = 1;
+                              }
+                            bit >>= 1;
+                          }
+                      break;
+                    }
+
+                  case 'k':
+                    info->target = memaddr + SEX (X_DISP16 (insn), 16) * 4;
+                    (*info->print_address_func) (info->target, info);
+                    break;
+
+                  case 'G':
+                    info->target = memaddr + SEX (X_DISP19 (insn), 19) * 4;
+                    (*info->print_address_func) (info->target, info);
+                    break;
+
+                  case '6':
+                  case '7':
+                  case '8':
+                  case '9':
+                    (*info->fprintf_func) (stream, "%%fcc%c", *s - '6' + '0');
+                    break;
+
+                  case 'z':
+                    (*info->fprintf_func) (stream, "%%icc");
+                    break;
+
+                  case 'Z':
+                    (*info->fprintf_func) (stream, "%%xcc");
+                    break;
+
+                  case 'E':
+                    (*info->fprintf_func) (stream, "%%ccr");
+                    break;
+
+                  case 's':
+                    (*info->fprintf_func) (stream, "%%fprs");
+                    break;
+
+                  case 'o':
+                    (*info->fprintf_func) (stream, "%%asi");
+                    break;
+
+                  case 'W':
+                    (*info->fprintf_func) (stream, "%%tick");
+                    break;
+
+                  case 'P':
+                    (*info->fprintf_func) (stream, "%%pc");
+                    break;
+
+                  case '?':
+                    if (X_RS1 (insn) == 31)
+                      (*info->fprintf_func) (stream, "%%ver");
+                    else if ((unsigned) X_RS1 (insn) < 16)
+                      (*info->fprintf_func) (stream, "%%%s",
+                                             v9_priv_reg_names[X_RS1 (insn)]);
+                    else
+                      (*info->fprintf_func) (stream, "%%reserved");
+                    break;
+
+                  case '!':
+                    if ((unsigned) X_RD (insn) < 15)
+                      (*info->fprintf_func) (stream, "%%%s",
+                                             v9_priv_reg_names[X_RD (insn)]);
+                    else
+                      (*info->fprintf_func) (stream, "%%reserved");
+                    break;
+
+                  case '/':
+                    if (X_RS1 (insn) < 16 || X_RS1 (insn) > 25)
+                      (*info->fprintf_func) (stream, "%%reserved");
+                    else
+                      (*info->fprintf_func) (stream, "%%%s",
+                                             v9a_asr_reg_names[X_RS1 (insn)-16]);
+                    break;
+
+                  case '_':
+                    if (X_RD (insn) < 16 || X_RD (insn) > 25)
+                      (*info->fprintf_func) (stream, "%%reserved");
+                    else
+                      (*info->fprintf_func) (stream, "%%%s",
+                                             v9a_asr_reg_names[X_RD (insn)-16]);
+                    break;
+
+                  case '*':
+                    {
+                      const char *name = sparc_decode_prefetch (X_RD (insn));
+
+                      if (name)
+                        (*info->fprintf_func) (stream, "%s", name);
+                      else
+                        (*info->fprintf_func) (stream, "%d", X_RD (insn));
+                      break;
+                    }
+
+                  case 'M':
+                    (*info->fprintf_func) (stream, "%%asr%d", X_RS1 (insn));
+                    break;
+
+                  case 'm':
+                    (*info->fprintf_func) (stream, "%%asr%d", X_RD (insn));
+                    break;
+
+                  case 'L':
+                    info->target = memaddr + SEX (X_DISP30 (insn), 30) * 4;
+                    (*info->print_address_func) (info->target, info);
+                    break;
+
+                  case 'n':
+                    (*info->fprintf_func)
+                      (stream, "%#x", SEX (X_DISP22 (insn), 22));
+                    break;
+
+                  case 'l':
+                    info->target = memaddr + SEX (X_DISP22 (insn), 22) * 4;
+                    (*info->print_address_func) (info->target, info);
+                    break;
+
+                  case 'A':
+                    {
+                      const char *name;
+
+                      if ((info->mach == bfd_mach_sparc_v8plusa) ||
                           ((info->mach >= bfd_mach_sparc_v9) &&
                            (info->mach <= bfd_mach_sparc_v9b)))
-			name = sparc_decode_asi_v9 (X_ASI (insn));
-		      else
-			name = sparc_decode_asi_v8 (X_ASI (insn));
-
-		      if (name)
-			(*info->fprintf_func) (stream, "%s", name);
-		      else
-			(*info->fprintf_func) (stream, "(%d)", X_ASI (insn));
-		      break;
-		    }
-
-		  case 'C':
-		    (*info->fprintf_func) (stream, "%%csr");
-		    break;
-
-		  case 'F':
-		    (*info->fprintf_func) (stream, "%%fsr");
-		    break;
-
-		  case 'p':
-		    (*info->fprintf_func) (stream, "%%psr");
-		    break;
-
-		  case 'q':
-		    (*info->fprintf_func) (stream, "%%fq");
-		    break;
-
-		  case 'Q':
-		    (*info->fprintf_func) (stream, "%%cq");
-		    break;
-
-		  case 't':
-		    (*info->fprintf_func) (stream, "%%tbr");
-		    break;
-
-		  case 'w':
-		    (*info->fprintf_func) (stream, "%%wim");
-		    break;
-
-		  case 'x':
-		    (*info->fprintf_func) (stream, "%d",
-					   ((X_LDST_I (insn) << 8)
-					    + X_ASI (insn)));
-		    break;
-
-		  case 'y':
-		    (*info->fprintf_func) (stream, "%%y");
-		    break;
-
-		  case 'u':
-		  case 'U':
-		    {
-		      int val = *s == 'U' ? X_RS1 (insn) : X_RD (insn);
-		      const char *name = sparc_decode_sparclet_cpreg (val);
-
-		      if (name)
-			(*info->fprintf_func) (stream, "%s", name);
-		      else
-			(*info->fprintf_func) (stream, "%%cpreg(%d)", val);
-		      break;
-		    }
-		  }
-	      }
-	  }
-
-	  /* If we are adding or or'ing something to rs1, then
-	     check to see whether the previous instruction was
-	     a sethi to the same register as in the sethi.
-	     If so, attempt to print the result of the add or
-	     or (in this context add and or do the same thing)
-	     and its symbolic value.  */
-	  if (imm_ored_to_rs1 || imm_added_to_rs1)
-	    {
-	      unsigned long prev_insn;
-	      int errcode;
-
-	      errcode =
-		(*info->read_memory_func)
-		  (memaddr - 4, buffer, sizeof (buffer), info);
-	      prev_insn = getword (buffer);
-
-	      if (errcode == 0)
-		{
-		  /* If it is a delayed branch, we need to look at the
-		     instruction before the delayed branch.  This handles
-		     sequences such as
-
-		     sethi %o1, %hi(_foo), %o1
-		     call _printf
-		     or %o1, %lo(_foo), %o1
-		     */
-
-		  if (is_delayed_branch (prev_insn))
-		    {
-		      errcode = (*info->read_memory_func)
-			(memaddr - 8, buffer, sizeof (buffer), info);
-		      prev_insn = getword (buffer);
-		    }
-		}
-
-	      /* If there was a problem reading memory, then assume
-		 the previous instruction was not sethi.  */
-	      if (errcode == 0)
-		{
-		  /* Is it sethi to the same register?  */
-		  if ((prev_insn & 0xc1c00000) == 0x01000000
-		      && X_RD (prev_insn) == X_RS1 (insn))
-		    {
-		      (*info->fprintf_func) (stream, "\t! ");
-		      info->target =
-			((unsigned) 0xFFFFFFFF
-			 & ((int) X_IMM22 (prev_insn) << 10));
-		      if (imm_added_to_rs1)
-			info->target += X_SIMM (insn, 13);
-		      else
-			info->target |= X_SIMM (insn, 13);
-		      (*info->print_address_func) (info->target, info);
-		      info->insn_type = dis_dref;
-		      info->data_size = 4;  /* FIXME!!! */
-		    }
-		}
-	    }
-
-	  if (opcode->flags & (F_UNBR|F_CONDBR|F_JSR))
-	    {
-		/* FIXME -- check is_annulled flag */
-	      if (opcode->flags & F_UNBR)
-		info->insn_type = dis_branch;
-	      if (opcode->flags & F_CONDBR)
-		info->insn_type = dis_condbranch;
-	      if (opcode->flags & F_JSR)
-		info->insn_type = dis_jsr;
-	      if (opcode->flags & F_DELAYED)
-		info->branch_delay_insns = 1;
-	    }
-
-	  return sizeof (buffer);
-	}
+                        name = sparc_decode_asi_v9 (X_ASI (insn));
+                      else
+                        name = sparc_decode_asi_v8 (X_ASI (insn));
+
+                      if (name)
+                        (*info->fprintf_func) (stream, "%s", name);
+                      else
+                        (*info->fprintf_func) (stream, "(%d)", X_ASI (insn));
+                      break;
+                    }
+
+                  case 'C':
+                    (*info->fprintf_func) (stream, "%%csr");
+                    break;
+
+                  case 'F':
+                    (*info->fprintf_func) (stream, "%%fsr");
+                    break;
+
+                  case 'p':
+                    (*info->fprintf_func) (stream, "%%psr");
+                    break;
+
+                  case 'q':
+                    (*info->fprintf_func) (stream, "%%fq");
+                    break;
+
+                  case 'Q':
+                    (*info->fprintf_func) (stream, "%%cq");
+                    break;
+
+                  case 't':
+                    (*info->fprintf_func) (stream, "%%tbr");
+                    break;
+
+                  case 'w':
+                    (*info->fprintf_func) (stream, "%%wim");
+                    break;
+
+                  case 'x':
+                    (*info->fprintf_func) (stream, "%d",
+                                           ((X_LDST_I (insn) << 8)
+                                            + X_ASI (insn)));
+                    break;
+
+                  case 'y':
+                    (*info->fprintf_func) (stream, "%%y");
+                    break;
+
+                  case 'u':
+                  case 'U':
+                    {
+                      int val = *s == 'U' ? X_RS1 (insn) : X_RD (insn);
+                      const char *name = sparc_decode_sparclet_cpreg (val);
+
+                      if (name)
+                        (*info->fprintf_func) (stream, "%s", name);
+                      else
+                        (*info->fprintf_func) (stream, "%%cpreg(%d)", val);
+                      break;
+                    }
+                  }
+              }
+          }
+
+          /* If we are adding or or'ing something to rs1, then
+             check to see whether the previous instruction was
+             a sethi to the same register as in the sethi.
+             If so, attempt to print the result of the add or
+             or (in this context add and or do the same thing)
+             and its symbolic value.  */
+          if (imm_ored_to_rs1 || imm_added_to_rs1)
+            {
+              unsigned long prev_insn;
+              int errcode;
+
+              errcode =
+                (*info->read_memory_func)
+                  (memaddr - 4, buffer, sizeof (buffer), info);
+              prev_insn = getword (buffer);
+
+              if (errcode == 0)
+                {
+                  /* If it is a delayed branch, we need to look at the
+                     instruction before the delayed branch.  This handles
+                     sequences such as
+
+                     sethi %o1, %hi(_foo), %o1
+                     call _printf
+                     or %o1, %lo(_foo), %o1
+                     */
+
+                  if (is_delayed_branch (prev_insn))
+                    {
+                      errcode = (*info->read_memory_func)
+                        (memaddr - 8, buffer, sizeof (buffer), info);
+                      prev_insn = getword (buffer);
+                    }
+                }
+
+              /* If there was a problem reading memory, then assume
+                 the previous instruction was not sethi.  */
+              if (errcode == 0)
+                {
+                  /* Is it sethi to the same register?  */
+                  if ((prev_insn & 0xc1c00000) == 0x01000000
+                      && X_RD (prev_insn) == X_RS1 (insn))
+                    {
+                      (*info->fprintf_func) (stream, "\t! ");
+                      info->target =
+                        ((unsigned) 0xFFFFFFFF
+                         & ((int) X_IMM22 (prev_insn) << 10));
+                      if (imm_added_to_rs1)
+                        info->target += X_SIMM (insn, 13);
+                      else
+                        info->target |= X_SIMM (insn, 13);
+                      (*info->print_address_func) (info->target, info);
+                      info->insn_type = dis_dref;
+                      info->data_size = 4;  /* FIXME!!! */
+                    }
+                }
+            }
+
+          if (opcode->flags & (F_UNBR|F_CONDBR|F_JSR))
+            {
+                /* FIXME -- check is_annulled flag */
+              if (opcode->flags & F_UNBR)
+                info->insn_type = dis_branch;
+              if (opcode->flags & F_CONDBR)
+                info->insn_type = dis_condbranch;
+              if (opcode->flags & F_JSR)
+                info->insn_type = dis_jsr;
+              if (opcode->flags & F_DELAYED)
+                info->branch_delay_insns = 1;
+            }
+
+          return sizeof (buffer);
+        }
     }
 
-  info->insn_type = dis_noninsn;	/* Mark as non-valid instruction */
+  info->insn_type = dis_noninsn;        /* Mark as non-valid instruction */
   (*info->fprintf_func) (stream, _("unknown"));
   return sizeof (buffer);
 }
@@ -3051,10 +3051,10 @@ compute_arch_mask (mach)
     case bfd_mach_sparc_sparclite :
     case bfd_mach_sparc_sparclite_le :
       /* sparclites insns are recognized by default (because that's how
-	 they've always been treated, for better or worse).  Kludge this by
-	 indicating generic v8 is also selected.  */
+         they've always been treated, for better or worse).  Kludge this by
+         indicating generic v8 is also selected.  */
       return (SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_SPARCLITE)
-	      | SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V8));
+              | SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V8));
     case bfd_mach_sparc_v8plus :
     case bfd_mach_sparc_v9 :
       return SPARC_OPCODE_ARCH_MASK (SPARC_OPCODE_ARCH_V9);
@@ -3087,14 +3087,14 @@ compare_opcodes (const void *a, const void *b)
   if (op0->architecture & current_arch_mask)
     {
       if (! (op1->architecture & current_arch_mask))
-	return -1;
+        return -1;
     }
   else
     {
       if (op1->architecture & current_arch_mask)
-	return 1;
+        return 1;
       else if (op0->architecture != op1->architecture)
-	return op0->architecture - op1->architecture;
+        return op0->architecture - op1->architecture;
     }
 
   /* If a bit is set in both match and lose, there is something
@@ -3102,10 +3102,10 @@ compare_opcodes (const void *a, const void *b)
   if (match0 & lose0)
     {
       fprintf
-	(stderr,
-	 /* xgettext:c-format */
-	 _("Internal error:  bad sparc-opcode.h: \"%s\", %#.8lx, %#.8lx\n"),
-	 op0->name, match0, lose0);
+        (stderr,
+         /* xgettext:c-format */
+         _("Internal error:  bad sparc-opcode.h: \"%s\", %#.8lx, %#.8lx\n"),
+         op0->name, match0, lose0);
       op0->lose &= ~op0->match;
       lose0 = op0->lose;
     }
@@ -3113,10 +3113,10 @@ compare_opcodes (const void *a, const void *b)
   if (match1 & lose1)
     {
       fprintf
-	(stderr,
-	 /* xgettext:c-format */
-	 _("Internal error: bad sparc-opcode.h: \"%s\", %#.8lx, %#.8lx\n"),
-	 op1->name, match1, lose1);
+        (stderr,
+         /* xgettext:c-format */
+         _("Internal error: bad sparc-opcode.h: \"%s\", %#.8lx, %#.8lx\n"),
+         op1->name, match1, lose1);
       op1->lose &= ~op1->match;
       lose1 = op1->lose;
     }
@@ -3130,7 +3130,7 @@ compare_opcodes (const void *a, const void *b)
       int x1 = (match1 & x) != 0;
 
       if (x0 != x1)
-	return x1 - x0;
+        return x1 - x0;
     }
 
   for (i = 0; i < 32; ++i)
@@ -3140,7 +3140,7 @@ compare_opcodes (const void *a, const void *b)
       int x1 = (lose1 & x) != 0;
 
       if (x0 != x1)
-	return x1 - x0;
+        return x1 - x0;
     }
 
   /* They are functionally equal.  So as long as the opcode table is
@@ -3160,12 +3160,12 @@ compare_opcodes (const void *a, const void *b)
   if (i)
     {
       if (op0->flags & F_ALIAS) /* If they're both aliases, be arbitrary. */
-	return i;
+        return i;
       else
-	fprintf (stderr,
-		 /* xgettext:c-format */
-		 _("Internal error: bad sparc-opcode.h: \"%s\" == \"%s\"\n"),
-		 op0->name, op1->name);
+        fprintf (stderr,
+                 /* xgettext:c-format */
+                 _("Internal error: bad sparc-opcode.h: \"%s\" == \"%s\"\n"),
+                 op0->name, op1->name);
     }
 
   /* Fewer arguments are preferred.  */
@@ -3183,15 +3183,15 @@ compare_opcodes (const void *a, const void *b)
 
     if (p0 && p1)
       {
-	/* There is a plus in both operands.  Note that a plus
-	   sign cannot be the first character in args,
-	   so the following [-1]'s are valid.  */
-	if (p0[-1] == 'i' && p1[1] == 'i')
-	  /* op0 is i+1 and op1 is 1+i, so op1 goes first.  */
-	  return 1;
-	if (p0[1] == 'i' && p1[-1] == 'i')
-	  /* op0 is 1+i and op1 is i+1, so op0 goes first.  */
-	  return -1;
+        /* There is a plus in both operands.  Note that a plus
+           sign cannot be the first character in args,
+           so the following [-1]'s are valid.  */
+        if (p0[-1] == 'i' && p1[1] == 'i')
+          /* op0 is i+1 and op1 is 1+i, so op1 goes first.  */
+          return 1;
+        if (p0[1] == 'i' && p1[-1] == 'i')
+          /* op0 is 1+i and op1 is i+1, so op0 goes first.  */
+          return -1;
       }
   }
 
@@ -3252,14 +3252,14 @@ build_hash_table (opcode_table, hash_table, num_opcodes)
     for (i = 0; i < HASH_SIZE; ++i)
       {
         if (hash_count[i] < min_count)
-	  min_count = hash_count[i];
-	if (hash_count[i] > max_count)
-	  max_count = hash_count[i];
-	total += hash_count[i];
+          min_count = hash_count[i];
+        if (hash_count[i] > max_count)
+          max_count = hash_count[i];
+        total += hash_count[i];
       }
 
     printf ("Opcode hash table stats: min %d, max %d, ave %f\n",
-	    min_count, max_count, (double) total / HASH_SIZE);
+            min_count, max_count, (double) total / HASH_SIZE);
   }
 #endif
 }
diff --git a/sparc.ld b/sparc.ld
index 2b19d57ff..26ab4151f 100644
--- a/sparc.ld
+++ b/sparc.ld
@@ -1,5 +1,5 @@
 OUTPUT_FORMAT("elf32-sparc", "elf32-sparc",
-	      "elf32-sparc")
+              "elf32-sparc")
 OUTPUT_ARCH(sparc)
 SEARCH_DIR(/lib); SEARCH_DIR(/usr/lib); SEARCH_DIR(/usr/local/lib); SEARCH_DIR(/usr/alpha-unknown-linux-gnu/lib);
 ENTRY(_start)
@@ -7,13 +7,13 @@ SECTIONS
 {
   /* Read-only sections, merged into text segment: */
   . = 0x60000000 + SIZEOF_HEADERS;
-  .interp     : { *(.interp) 	}
-  .hash          : { *(.hash)		}
-  .dynsym        : { *(.dynsym)		}
-  .dynstr        : { *(.dynstr)		}
-  .gnu.version   : { *(.gnu.version)	}
-  .gnu.version_d   : { *(.gnu.version_d)	}
-  .gnu.version_r   : { *(.gnu.version_r)	}
+  .interp     : { *(.interp)    }
+  .hash          : { *(.hash)           }
+  .dynsym        : { *(.dynsym)         }
+  .dynstr        : { *(.dynstr)         }
+  .gnu.version   : { *(.gnu.version)    }
+  .gnu.version_d   : { *(.gnu.version_d)        }
+  .gnu.version_r   : { *(.gnu.version_r)        }
   .rel.text      :
     { *(.rel.text) *(.rel.gnu.linkonce.t*) }
   .rela.text     :
@@ -26,21 +26,21 @@ SECTIONS
     { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
   .rela.rodata   :
     { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
-  .rel.got       : { *(.rel.got)		}
-  .rela.got      : { *(.rela.got)		}
-  .rel.ctors     : { *(.rel.ctors)	}
-  .rela.ctors    : { *(.rela.ctors)	}
-  .rel.dtors     : { *(.rel.dtors)	}
-  .rela.dtors    : { *(.rela.dtors)	}
-  .rel.init      : { *(.rel.init)	}
-  .rela.init     : { *(.rela.init)	}
-  .rel.fini      : { *(.rel.fini)	}
-  .rela.fini     : { *(.rela.fini)	}
-  .rel.bss       : { *(.rel.bss)		}
-  .rela.bss      : { *(.rela.bss)		}
-  .rel.plt       : { *(.rel.plt)		}
-  .rela.plt      : { *(.rela.plt)		}
-  .init          : { *(.init)	} =0x47ff041f
+  .rel.got       : { *(.rel.got)                }
+  .rela.got      : { *(.rela.got)               }
+  .rel.ctors     : { *(.rel.ctors)      }
+  .rela.ctors    : { *(.rela.ctors)     }
+  .rel.dtors     : { *(.rel.dtors)      }
+  .rela.dtors    : { *(.rela.dtors)     }
+  .rel.init      : { *(.rel.init)       }
+  .rela.init     : { *(.rela.init)      }
+  .rel.fini      : { *(.rel.fini)       }
+  .rela.fini     : { *(.rela.fini)      }
+  .rel.bss       : { *(.rel.bss)                }
+  .rela.bss      : { *(.rela.bss)               }
+  .rel.plt       : { *(.rel.plt)                }
+  .rela.plt      : { *(.rela.plt)               }
+  .init          : { *(.init)   } =0x47ff041f
   .text      :
   {
     *(.text)
@@ -74,7 +74,7 @@ SECTIONS
   {
     *(.dtors)
   }
-  .plt      : { *(.plt)	}
+  .plt      : { *(.plt) }
   .got           : { *(.got.plt) *(.got) }
   .dynamic       : { *(.dynamic) }
   /* We want the small data sections together, so single-instruction offsets
diff --git a/sparc64.ld b/sparc64.ld
index 19853ff68..54d2f7dd8 100644
--- a/sparc64.ld
+++ b/sparc64.ld
@@ -1,5 +1,5 @@
 OUTPUT_FORMAT("elf64-sparc", "elf64-sparc",
-	      "elf64-sparc")
+              "elf64-sparc")
 OUTPUT_ARCH(sparc:v9)
 SEARCH_DIR(/lib64); SEARCH_DIR(/lib); SEARCH_DIR(/usr/lib64); SEARCH_DIR(/usr/lib); SEARCH_DIR(/usr/local/lib64); SEARCH_DIR(/usr/local/lib); SEARCH_DIR(/usr/alpha-unknown-linux-gnu/lib);
 ENTRY(_start)
@@ -7,13 +7,13 @@ SECTIONS
 {
   /* Read-only sections, merged into text segment: */
   . = 0x60000000 + SIZEOF_HEADERS;
-  .interp     : { *(.interp) 	}
-  .hash          : { *(.hash)		}
-  .dynsym        : { *(.dynsym)		}
-  .dynstr        : { *(.dynstr)		}
-  .gnu.version   : { *(.gnu.version)	}
-  .gnu.version_d   : { *(.gnu.version_d)	}
-  .gnu.version_r   : { *(.gnu.version_r)	}
+  .interp     : { *(.interp)    }
+  .hash          : { *(.hash)           }
+  .dynsym        : { *(.dynsym)         }
+  .dynstr        : { *(.dynstr)         }
+  .gnu.version   : { *(.gnu.version)    }
+  .gnu.version_d   : { *(.gnu.version_d)        }
+  .gnu.version_r   : { *(.gnu.version_r)        }
   .rel.text      :
     { *(.rel.text) *(.rel.gnu.linkonce.t*) }
   .rela.text     :
@@ -26,21 +26,21 @@ SECTIONS
     { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
   .rela.rodata   :
     { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
-  .rel.got       : { *(.rel.got)		}
-  .rela.got      : { *(.rela.got)		}
-  .rel.ctors     : { *(.rel.ctors)	}
-  .rela.ctors    : { *(.rela.ctors)	}
-  .rel.dtors     : { *(.rel.dtors)	}
-  .rela.dtors    : { *(.rela.dtors)	}
-  .rel.init      : { *(.rel.init)	}
-  .rela.init     : { *(.rela.init)	}
-  .rel.fini      : { *(.rel.fini)	}
-  .rela.fini     : { *(.rela.fini)	}
-  .rel.bss       : { *(.rel.bss)		}
-  .rela.bss      : { *(.rela.bss)		}
-  .rel.plt       : { *(.rel.plt)		}
-  .rela.plt      : { *(.rela.plt)		}
-  .init          : { *(.init)	} =0x47ff041f
+  .rel.got       : { *(.rel.got)                }
+  .rela.got      : { *(.rela.got)               }
+  .rel.ctors     : { *(.rel.ctors)      }
+  .rela.ctors    : { *(.rela.ctors)     }
+  .rel.dtors     : { *(.rel.dtors)      }
+  .rela.dtors    : { *(.rela.dtors)     }
+  .rel.init      : { *(.rel.init)       }
+  .rela.init     : { *(.rela.init)      }
+  .rel.fini      : { *(.rel.fini)       }
+  .rela.fini     : { *(.rela.fini)      }
+  .rel.bss       : { *(.rel.bss)                }
+  .rela.bss      : { *(.rela.bss)               }
+  .rel.plt       : { *(.rel.plt)                }
+  .rela.plt      : { *(.rela.plt)               }
+  .init          : { *(.init)   } =0x47ff041f
   .text      :
   {
     *(.text)
@@ -82,7 +82,7 @@ SECTIONS
   {
     *(.dtors)
   }
-  .plt      : { *(.plt)	}
+  .plt      : { *(.plt) }
   .got           : { *(.got.plt) *(.got) }
   .dynamic       : { *(.dynamic) }
   /* We want the small data sections together, so single-instruction offsets
diff --git a/sysemu.h b/sysemu.h
new file mode 100644
index 000000000..1f5b093b6
--- /dev/null
+++ b/sysemu.h
@@ -0,0 +1,185 @@
+#ifndef SYSEMU_H
+#define SYSEMU_H
+/* Misc. things related to the system emulator.  */
+
+/* vl.c */
+extern const char *bios_name;
+extern const char *bios_dir;
+
+extern int vm_running;
+extern const char *qemu_name;
+
+typedef struct vm_change_state_entry VMChangeStateEntry;
+typedef void VMChangeStateHandler(void *opaque, int running);
+typedef void VMStopHandler(void *opaque, int reason);
+
+VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb,
+                                                     void *opaque);
+void qemu_del_vm_change_state_handler(VMChangeStateEntry *e);
+
+int qemu_add_vm_stop_handler(VMStopHandler *cb, void *opaque);
+void qemu_del_vm_stop_handler(VMStopHandler *cb, void *opaque);
+
+void vm_start(void);
+void vm_stop(int reason);
+
+int64_t cpu_get_ticks(void);
+void cpu_enable_ticks(void);
+void cpu_disable_ticks(void);
+
+void qemu_system_reset_request(void);
+void qemu_system_shutdown_request(void);
+void qemu_system_powerdown_request(void);
+#if !defined(TARGET_SPARC)
+// Please implement a power failure function to signal the OS
+#define qemu_system_powerdown() do{}while(0)
+#else
+void qemu_system_powerdown(void);
+#endif
+
+void cpu_save(QEMUFile *f, void *opaque);
+int cpu_load(QEMUFile *f, void *opaque, int version_id);
+
+void do_savevm(const char *name);
+void do_loadvm(const char *name);
+void do_delvm(const char *name);
+void do_info_snapshots(void);
+
+void main_loop_wait(int timeout);
+
+/* Polling handling */
+
+/* return TRUE if no sleep should be done afterwards */
+typedef int PollingFunc(void *opaque);
+
+int qemu_add_polling_cb(PollingFunc *func, void *opaque);
+void qemu_del_polling_cb(PollingFunc *func, void *opaque);
+
+#ifdef _WIN32
+/* Wait objects handling */
+typedef void WaitObjectFunc(void *opaque);
+
+int qemu_add_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque);
+void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque);
+#endif
+
+/* TAP win32 */
+int tap_win32_init(VLANState *vlan, const char *ifname);
+
+/* SLIRP */
+void do_info_slirp(void);
+
+extern int64_t ram_size;
+extern int bios_size;
+extern int rtc_utc;
+extern int rtc_start_date;
+extern int cirrus_vga_enabled;
+extern int vmsvga_enabled;
+extern int graphic_width;
+extern int graphic_height;
+extern int graphic_depth;
+extern const char *keyboard_layout;
+extern int win2k_install_hack;
+extern int alt_grab;
+extern int usb_enabled;
+extern int smp_cpus;
+extern int cursor_hide;
+extern int graphic_rotate;
+extern int no_quit;
+extern int semihosting_enabled;
+extern int autostart;
+extern int old_param;
+extern const char *bootp_filename;
+
+
+#ifdef USE_KQEMU
+extern int kqemu_allowed;
+#endif
+
+#define MAX_OPTION_ROMS 16
+extern const char *option_rom[MAX_OPTION_ROMS];
+extern int nb_option_roms;
+
+#ifdef TARGET_SPARC
+#define MAX_PROM_ENVS 128
+extern const char *prom_envs[MAX_PROM_ENVS];
+extern unsigned int nb_prom_envs;
+#endif
+
+/* XXX: make it dynamic */
+#define MAX_BIOS_SIZE (4 * 1024 * 1024)
+#if defined (TARGET_PPC)
+#define BIOS_SIZE (1024 * 1024)
+#elif defined (TARGET_SPARC64)
+#define BIOS_SIZE ((512 + 32) * 1024)
+#elif defined(TARGET_MIPS)
+#define BIOS_SIZE (4 * 1024 * 1024)
+#endif
+
+typedef enum {
+    IF_IDE, IF_SCSI, IF_FLOPPY, IF_PFLASH, IF_MTD, IF_SD
+} BlockInterfaceType;
+
+typedef struct DriveInfo {
+    BlockDriverState *bdrv;
+    BlockInterfaceType interface;
+    int bus;
+    int unit;
+} DriveInfo;
+
+#define MAX_IDE_DEVS	2
+#define MAX_SCSI_DEVS	7
+#define MAX_DRIVES 32
+
+int nb_drives;
+DriveInfo drives_table[MAX_DRIVES+1];
+
+extern int drive_get_index(BlockInterfaceType interface, int bus, int unit);
+extern int drive_get_max_bus(BlockInterfaceType interface);
+
+/* vmchannel devices */
+
+#define MAX_VMCHANNEL_DEVICES 4
+
+/* serial ports */
+
+#define MAX_SERIAL_PORTS 4
+
+extern CharDriverState *serial_hds[MAX_SERIAL_PORTS];
+
+/* parallel ports */
+
+#define MAX_PARALLEL_PORTS 3
+
+extern CharDriverState *parallel_hds[MAX_PARALLEL_PORTS];
+
+#ifdef NEED_CPU_H
+/* loader.c */
+int get_image_size(const char *filename);
+int load_image(const char *filename, uint8_t *addr);
+int load_elf(const char *filename, int64_t virt_to_phys_addend,
+             uint64_t *pentry, uint64_t *lowaddr, uint64_t *highaddr);
+int load_aout(const char *filename, uint8_t *addr);
+int load_uboot(const char *filename, target_ulong *ep, int *is_linux);
+#endif
+
+#ifdef HAS_AUDIO
+struct soundhw {
+    const char *name;
+    const char *descr;
+    int enabled;
+    int isa;
+    union {
+        int (*init_isa) (AudioState *s, qemu_irq *pic);
+        int (*init_pci) (PCIBus *bus, AudioState *s);
+    } init;
+};
+
+extern struct soundhw soundhw[];
+#endif
+
+void do_usb_add(const char *devname);
+void do_usb_del(const char *devname);
+void usb_info(void);
+
+#endif
diff --git a/tap-win32.c b/tap-win32.c
index c900b4b76..694441eee 100644
--- a/tap-win32.c
+++ b/tap-win32.c
@@ -26,7 +26,9 @@
  *  distribution); if not, write to the Free Software Foundation, Inc.,
  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "net.h"
+#include "sysemu.h"
 #include <stdio.h>
 #include <windows.h>
 
diff --git a/target-alpha/STATUS b/target-alpha/STATUS
new file mode 100644
index 000000000..8b7f352fb
--- /dev/null
+++ b/target-alpha/STATUS
@@ -0,0 +1,33 @@
+(to be completed)
+
+Alpha emulation structure:
+cpu.h           : CPU definitions globally exported
+exec.h          : CPU definitions used only for translated code execution
+helper.c        : helpers that can be called either by the translated code
+                  or the Qemu core, including the exception handler.
+op.c            : Alpha dedicated micro-operations used by the code translator
+op_helper.c     : helpers that can be called only from micro-operations
+op_helper.h     : micro-operations helpers prototypes
+op_helper_mem.h : micro-operations templates
+                  for load and stores accesses helpers
+op_mem.h        : micro-operations templates for load and stores accesses
+op_template.h   : micro-operation templates for register moves
+translate.c     : Alpha instructions to micro-operations translator
+
+Code translator status:
+The Alpha CPU instruction emulation should be quite complete with the
+limitation that the VAX floating-point load and stores are not implemented.
+The 4 MMU modes are implemented.
+
+Linux user mode emulation status:
+a few programs start to run. Most crash at a certain point, dereferencing a
+NULL pointer. It seems that the UNIQUE register is not initialized properly.
+It may appear that old executables, not relying on TLS support, run but
+this is to be prooved...
+
+Full system emulation status:
+* Alpha PALCode emulation is in a very early stage and is not sufficient
+  to run any real OS. The alpha-softmmu target is not enabled for now.
+* no hardware platform description is implemented
+* there might be problems in the Alpha PALCode dedicated instructions
+  that would prevent to use a native PALCode image.
diff --git a/target-alpha/cpu.h b/target-alpha/cpu.h
index 3f517e67b..f8bbc70d7 100644
--- a/target-alpha/cpu.h
+++ b/target-alpha/cpu.h
@@ -27,14 +27,13 @@
 
 #include "cpu-defs.h"
 
-
 #include <setjmp.h>
 
 #include "softfloat.h"
 
 #define TARGET_HAS_ICE 1
 
-#define ELF_MACHINE	EM_ALPHA
+#define ELF_MACHINE     EM_ALPHA
 
 #define ICACHE_LINE_SIZE 32
 #define DCACHE_LINE_SIZE 32
@@ -256,6 +255,8 @@ struct pal_handler_t {
     void (*call_pal)(CPUAlphaState *env, uint32_t palcode);
 };
 
+#define NB_MMU_MODES 4
+
 struct CPUAlphaState {
     uint64_t ir[31];
     float64  fir[31];
@@ -302,6 +303,17 @@ struct CPUAlphaState {
 #define cpu_gen_code cpu_alpha_gen_code
 #define cpu_signal_handler cpu_alpha_signal_handler
 
+/* MMU modes definitions */
+#define MMU_MODE0_SUFFIX _kernel
+#define MMU_MODE1_SUFFIX _executive
+#define MMU_MODE2_SUFFIX _supervisor
+#define MMU_MODE3_SUFFIX _user
+#define MMU_USER_IDX 3
+static inline int cpu_mmu_index (CPUState *env)
+{
+    return (env->ps >> 3) & 3;
+}
+
 #include "cpu-all.h"
 
 enum {
@@ -384,7 +396,7 @@ enum {
     IR_ZERO = 31,
 };
 
-CPUAlphaState * cpu_alpha_init (void);
+CPUAlphaState * cpu_alpha_init (const char *cpu_model);
 int cpu_alpha_exec(CPUAlphaState *s);
 /* you can call this signal handler from your SIGBUS and SIGSEGV
    signal handlers to inform the virtual CPU of exceptions. non zero
diff --git a/target-alpha/exec.h b/target-alpha/exec.h
index 80f358ca3..3b9754d83 100644
--- a/target-alpha/exec.h
+++ b/target-alpha/exec.h
@@ -64,22 +64,22 @@ register uint64_t T2 asm(AREG3);
 #include "softmmu_exec.h"
 #endif /* !defined(CONFIG_USER_ONLY) */
 
-static inline void env_to_regs(void)
+static always_inline void env_to_regs(void)
 {
 }
 
-static inline void regs_to_env(void)
+static always_inline void regs_to_env(void)
 {
 }
 
 int cpu_alpha_handle_mmu_fault (CPUState *env, uint64_t address, int rw,
-                                int is_user, int is_softmmu);
+                                int mmu_idx, int is_softmmu);
 int cpu_alpha_mfpr (CPUState *env, int iprn, uint64_t *valp);
 int cpu_alpha_mtpr (CPUState *env, int iprn, uint64_t val, uint64_t *oldvalp);
 
 void do_interrupt (CPUState *env);
 
-static inline int cpu_halted(CPUState *env) {
+static always_inline int cpu_halted(CPUState *env) {
     if (!env->halted)
         return 0;
     if (env->interrupt_request & CPU_INTERRUPT_HARD) {
diff --git a/target-alpha/helper.c b/target-alpha/helper.c
index 72cae49cf..fd39f5f89 100644
--- a/target-alpha/helper.c
+++ b/target-alpha/helper.c
@@ -28,7 +28,7 @@
 #if defined(CONFIG_USER_ONLY)
 
 int cpu_alpha_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                                int is_user, int is_softmmu)
+                                int mmu_idx, int is_softmmu)
 {
     if (rw == 2)
         env->exception_index = EXCP_ITB_MISS;
@@ -57,7 +57,7 @@ target_phys_addr_t cpu_get_phys_page_debug (CPUState *env, target_ulong addr)
 }
 
 int cpu_alpha_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                                int is_user, int is_softmmu)
+                                int mmu_idx, int is_softmmu)
 {
     uint32_t opc;
 
diff --git a/target-alpha/op.c b/target-alpha/op.c
index 529a66de0..da93e7cdf 100644
--- a/target-alpha/op.c
+++ b/target-alpha/op.c
@@ -22,6 +22,7 @@
 
 #include "config.h"
 #include "exec.h"
+#include "host-utils.h"
 
 #include "op_helper.h"
 
@@ -140,11 +141,15 @@ void OPPROTO op_tb_flush (void)
 #define MEMSUFFIX _raw
 #include "op_mem.h"
 #if !defined(CONFIG_USER_ONLY)
-#define MEMSUFFIX _user
-#include "op_mem.h"
 #define MEMSUFFIX _kernel
 #include "op_mem.h"
-/* Those are used for supervisor, executive and pal modes */
+#define MEMSUFFIX _executive
+#include "op_mem.h"
+#define MEMSUFFIX _supervisor
+#include "op_mem.h"
+#define MEMSUFFIX _user
+#include "op_mem.h"
+/* This is used for pal modes */
 #define MEMSUFFIX _data
 #include "op_mem.h"
 #endif
@@ -291,7 +296,7 @@ void OPPROTO op_mullv (void)
 
 void OPPROTO op_mulq (void)
 {
-    T0 *= T1;
+    T0 = (int64_t)T0 * (int64_t)T1;
     RETURN();
 }
 
@@ -303,7 +308,10 @@ void OPPROTO op_mulqv (void)
 
 void OPPROTO op_umulh (void)
 {
-    helper_umulh();
+    uint64_t tl, th;
+
+    mulu64(&tl, &th, T0, T1);
+    T0 = th;
     RETURN();
 }
 
diff --git a/target-alpha/op_helper.c b/target-alpha/op_helper.c
index deac6c259..072499e30 100644
--- a/target-alpha/op_helper.c
+++ b/target-alpha/op_helper.c
@@ -19,6 +19,7 @@
  */
 
 #include "exec.h"
+#include "host-utils.h"
 #include "softfloat.h"
 
 #include "op_helper.h"
@@ -27,13 +28,19 @@
 #include "op_helper_mem.h"
 
 #if !defined(CONFIG_USER_ONLY)
-#define MEMSUFFIX _user
+#define MEMSUFFIX _kernel
 #include "op_helper_mem.h"
 
-#define MEMSUFFIX _kernel
+#define MEMSUFFIX _executive
+#include "op_helper_mem.h"
+
+#define MEMSUFFIX _supervisor
 #include "op_helper_mem.h"
 
-/* Those are used for supervisor and executive modes */
+#define MEMSUFFIX _user
+#include "op_helper_mem.h"
+
+/* This is used for pal modes */
 #define MEMSUFFIX _data
 #include "op_helper_mem.h"
 #endif
@@ -193,118 +200,32 @@ void helper_mullv (void)
 
 void helper_mulqv ()
 {
-    uint64_t res, tmp0, tmp1;
+    uint64_t tl, th;
 
-    res = (T0 >> 32) * (T1 >> 32);
-    tmp0 = ((T0 & 0xFFFFFFFF) * (T1 >> 32)) +
-        ((T0 >> 32) * (T1 & 0xFFFFFFFF));
-    tmp1 = (T0 & 0xFFFFFFFF) * (T1 & 0xFFFFFFFF);
-    tmp0 += tmp1 >> 32;
-    res += tmp0 >> 32;
-    T0 *= T1;
-    if (unlikely(res != 0)) {
+    muls64(&tl, &th, T0, T1);
+    /* If th != 0 && th != -1, then we had an overflow */
+    if (unlikely((th + 1) > 1)) {
         helper_excp(EXCP_ARITH, EXCP_ARITH_OVERFLOW);
     }
-}
-
-void helper_umulh (void)
-{
-    uint64_t tmp0, tmp1;
-
-    tmp0 = ((T0 & 0xFFFFFFFF) * (T1 >> 32)) +
-        ((T0 >> 32) * (T1 & 0xFFFFFFFF));
-    tmp1 = (T0 & 0xFFFFFFFF) * (T1 & 0xFFFFFFFF);
-    tmp0 += tmp1 >> 32;
-    T0 = (T0 >> 32) * (T0 >> 32);
-    T0 += tmp0 >> 32;
+    T0 = tl;
 }
 
 void helper_ctpop (void)
 {
-    int n;
-
-    for (n = 0; T0 != 0; n++)
-        T0 = T0 ^ (T0 - 1);
-    T0 = n;
+    T0 = ctpop64(T0);
 }
 
 void helper_ctlz (void)
 {
-    uint32_t op32;
-    int n;
-
-    n = 0;
-    if (!(T0 & 0xFFFFFFFF00000000ULL)) {
-        n += 32;
-        T0 <<= 32;
-    }
-    /* Make it easier for 32 bits hosts */
-    op32 = T0 >> 32;
-    if (!(op32 & 0xFFFF0000UL)) {
-        n += 16;
-        op32 <<= 16;
-    }
-    if (!(op32 & 0xFF000000UL)) {
-        n += 8;
-        op32 <<= 8;
-    }
-    if (!(op32 & 0xF0000000UL)) {
-        n += 4;
-        op32 <<= 4;
-    }
-    if (!(op32 & 0xC0000000UL)) {
-        n += 2;
-        op32 <<= 2;
-    }
-    if (!(op32 & 0x80000000UL)) {
-        n++;
-        op32 <<= 1;
-    }
-    if (!(op32 & 0x80000000UL)) {
-        n++;
-    }
-    T0 = n;
+    T0 = clz64(T0);
 }
 
 void helper_cttz (void)
 {
-    uint32_t op32;
-    int n;
-
-    n = 0;
-    if (!(T0 & 0x00000000FFFFFFFFULL)) {
-        n += 32;
-        T0 >>= 32;
-    }
-    /* Make it easier for 32 bits hosts */
-    op32 = T0;
-    if (!(op32 & 0x0000FFFFUL)) {
-        n += 16;
-        op32 >>= 16;
-    }
-    if (!(op32 & 0x000000FFUL)) {
-        n += 8;
-        op32 >>= 8;
-    }
-    if (!(op32 & 0x0000000FUL)) {
-        n += 4;
-        op32 >>= 4;
-    }
-    if (!(op32 & 0x00000003UL)) {
-        n += 2;
-        op32 >>= 2;
-    }
-    if (!(op32 & 0x00000001UL)) {
-        n++;
-        op32 >>= 1;
-    }
-    if (!(op32 & 0x00000001UL)) {
-        n++;
-    }
-    T0 = n;
+    T0 = ctz64(T0);
 }
 
-static inline uint64_t byte_zap (uint64_t op, uint8_t mskb)
+static always_inline uint64_t byte_zap (uint64_t op, uint8_t mskb)
 {
     uint64_t mask;
 
@@ -619,7 +540,7 @@ void helper_ftoit (void)
     FT0 = p.d;
 }
 
-static int vaxf_is_valid (float ff)
+static always_inline int vaxf_is_valid (float ff)
 {
     union {
         float f;
@@ -638,7 +559,7 @@ static int vaxf_is_valid (float ff)
     return 1;
 }
 
-static float vaxf_to_ieee32 (float ff)
+static always_inline float vaxf_to_ieee32 (float ff)
 {
     union {
         float f;
@@ -658,7 +579,7 @@ static float vaxf_to_ieee32 (float ff)
     return p.f;
 }
 
-static float ieee32_to_vaxf (float fi)
+static always_inline float ieee32_to_vaxf (float fi)
 {
     union {
         float f;
@@ -761,7 +682,7 @@ void helper_itoff (void)
     /* XXX: TODO */
 }
 
-static int vaxg_is_valid (double ff)
+static always_inline int vaxg_is_valid (double ff)
 {
     union {
         double f;
@@ -780,7 +701,7 @@ static int vaxg_is_valid (double ff)
     return 1;
 }
 
-static double vaxg_to_ieee64 (double fg)
+static always_inline double vaxg_to_ieee64 (double fg)
 {
     union {
         double f;
@@ -800,7 +721,7 @@ static double vaxg_to_ieee64 (double fg)
     return p.f;
 }
 
-static double ieee64_to_vaxg (double fi)
+static always_inline double ieee64_to_vaxg (double fi)
 {
     union {
         double f;
@@ -1054,7 +975,7 @@ void helper_cvtlq (void)
     FT0 = q.d;
 }
 
-static inline void __helper_cvtql (int s, int v)
+static always_inline void __helper_cvtql (int s, int v)
 {
     union {
         double d;
@@ -1151,11 +1072,32 @@ void helper_mtpr (int iprn)
 }
 #endif
 
+#if defined(HOST_SPARC) || defined(HOST_SPARC64)
+void helper_reset_FT0 (void)
+{
+    FT0 = 0;
+}
+
+void helper_reset_FT1 (void)
+{
+    FT1 = 0;
+}
+
+void helper_reset_FT2 (void)
+{
+    FT2 = 0;
+}
+#endif
+
 /*****************************************************************************/
 /* Softmmu support */
 #if !defined (CONFIG_USER_ONLY)
 
-#define GETPC() (__builtin_return_address(0))
+#ifdef __s390__
+# define GETPC() ((void*)((unsigned long)__builtin_return_address(0) & 0x7fffffffUL))
+#else
+# define GETPC() (__builtin_return_address(0))
+#endif
 
 /* XXX: the two following helpers are pure hacks.
  *      Hopefully, we emulate the PALcode, then we should never see
@@ -1164,20 +1106,20 @@ void helper_mtpr (int iprn)
 void helper_ld_phys_to_virt (void)
 {
     uint64_t tlb_addr, physaddr;
-    int index, is_user;
+    int index, mmu_idx;
     void *retaddr;
 
-    is_user = (env->ps >> 3) & 3;
+    mmu_idx = cpu_mmu_index(env);
     index = (T0 >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
  redo:
-    tlb_addr = env->tlb_table[is_user][index].addr_read;
+    tlb_addr = env->tlb_table[mmu_idx][index].addr_read;
     if ((T0 & TARGET_PAGE_MASK) ==
         (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = T0 + env->tlb_table[is_user][index].addend;
+        physaddr = T0 + env->tlb_table[mmu_idx][index].addend;
     } else {
         /* the page is not in the TLB : fill it */
         retaddr = GETPC();
-        tlb_fill(T0, 0, is_user, retaddr);
+        tlb_fill(T0, 0, mmu_idx, retaddr);
         goto redo;
     }
     T0 = physaddr;
@@ -1186,20 +1128,20 @@ void helper_ld_phys_to_virt (void)
 void helper_st_phys_to_virt (void)
 {
     uint64_t tlb_addr, physaddr;
-    int index, is_user;
+    int index, mmu_idx;
     void *retaddr;
 
-    is_user = (env->ps >> 3) & 3;
+    mmu_idx = cpu_mmu_index(env);
     index = (T0 >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
  redo:
-    tlb_addr = env->tlb_table[is_user][index].addr_write;
+    tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
     if ((T0 & TARGET_PAGE_MASK) ==
         (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = T0 + env->tlb_table[is_user][index].addend;
+        physaddr = T0 + env->tlb_table[mmu_idx][index].addend;
     } else {
         /* the page is not in the TLB : fill it */
         retaddr = GETPC();
-        tlb_fill(T0, 1, is_user, retaddr);
+        tlb_fill(T0, 1, mmu_idx, retaddr);
         goto redo;
     }
     T0 = physaddr;
@@ -1223,22 +1165,22 @@ void helper_st_phys_to_virt (void)
    NULL, it means that the function was called in C code (i.e. not
    from generated code or from helper.c) */
 /* XXX: fix it to restore all registers */
-void tlb_fill (target_ulong addr, int is_write, int is_user, void *retaddr)
+void tlb_fill (target_ulong addr, int is_write, int mmu_idx, void *retaddr)
 {
     TranslationBlock *tb;
     CPUState *saved_env;
-    target_phys_addr_t pc;
+    unsigned long pc;
     int ret;
 
     /* XXX: hack to restore env in all cases, even if not called from
        generated code */
     saved_env = env;
     env = cpu_single_env;
-    ret = cpu_alpha_handle_mmu_fault(env, addr, is_write, is_user, 1);
+    ret = cpu_alpha_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
     if (!likely(ret == 0)) {
         if (likely(retaddr)) {
             /* now we have a real cpu fault */
-            pc = (target_phys_addr_t)retaddr;
+            pc = (unsigned long)retaddr;
             tb = tb_find_pc(pc);
             if (likely(tb)) {
                 /* the PC is inside the translated code. It means that we have
diff --git a/target-alpha/op_helper.h b/target-alpha/op_helper.h
index 806a30d4a..7e79720bc 100644
--- a/target-alpha/op_helper.h
+++ b/target-alpha/op_helper.h
@@ -34,7 +34,6 @@ void helper_subqv (void);
 void helper_sublv (void);
 void helper_mullv (void);
 void helper_mulqv (void);
-void helper_umulh (void);
 void helper_ctpop (void);
 void helper_ctlz (void);
 void helper_cttz (void);
@@ -139,3 +138,9 @@ void helper_mtpr (int iprn);
 void helper_ld_phys_to_virt (void);
 void helper_st_phys_to_virt (void);
 void helper_tb_flush (void);
+
+#if defined(HOST_SPARC) || defined(HOST_SPARC64)
+void helper_reset_FT0 (void);
+void helper_reset_FT1 (void);
+void helper_reset_FT2 (void);
+#endif
diff --git a/target-alpha/op_mem.h b/target-alpha/op_mem.h
index 922d0d4de..5bf73afca 100644
--- a/target-alpha/op_mem.h
+++ b/target-alpha/op_mem.h
@@ -18,7 +18,7 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
-#define DEBUG_MEM_ACCESSES
+//#define DEBUG_MEM_ACCESSES
 #if defined (DEBUG_MEM_ACCESSES)
 void helper_print_mem_EA (target_ulong EA);
 #define print_mem_EA(EA) do { helper_print_mem_EA(EA); } while (0)
@@ -26,21 +26,22 @@ void helper_print_mem_EA (target_ulong EA);
 #define print_mem_EA(EA) do { } while (0)
 #endif
 
-static inline uint32_t glue(ldl_l, MEMSUFFIX) (target_ulong EA)
+static always_inline uint32_t glue(ldl_l, MEMSUFFIX) (target_ulong EA)
 {
     env->lock = EA;
 
     return glue(ldl, MEMSUFFIX)(EA);
 }
 
-static inline uint32_t glue(ldq_l, MEMSUFFIX) (target_ulong EA)
+static always_inline uint32_t glue(ldq_l, MEMSUFFIX) (target_ulong EA)
 {
     env->lock = EA;
 
     return glue(ldq, MEMSUFFIX)(EA);
 }
 
-static inline void glue(stl_c, MEMSUFFIX) (target_ulong EA, uint32_t data)
+static always_inline void glue(stl_c, MEMSUFFIX) (target_ulong EA,
+                                                  uint32_t data)
 {
     if (EA == env->lock) {
         glue(stl, MEMSUFFIX)(EA, data);
@@ -51,7 +52,8 @@ static inline void glue(stl_c, MEMSUFFIX) (target_ulong EA, uint32_t data)
     env->lock = -1;
 }
 
-static inline void glue(stq_c, MEMSUFFIX) (target_ulong EA, uint64_t data)
+static always_inline void glue(stq_c, MEMSUFFIX) (target_ulong EA,
+                                                  uint64_t data)
 {
     if (EA == env->lock) {
         glue(stq, MEMSUFFIX)(EA, data);
diff --git a/target-alpha/op_template.h b/target-alpha/op_template.h
index db15bb891..ab589f21e 100644
--- a/target-alpha/op_template.h
+++ b/target-alpha/op_template.h
@@ -26,11 +26,19 @@ void OPPROTO glue(op_reset_T, REG) (void)
     RETURN();
 }
 
+#if !defined(HOST_SPARC) && !defined(HOST_SPARC64)
 void OPPROTO glue(op_reset_FT, REG) (void)
 {
     glue(FT, REG) = 0;
     RETURN();
 }
+#else
+void OPPROTO glue(op_reset_FT, REG) (void)
+{
+    glue(helper_reset_FT, REG)();
+    RETURN();
+}
+#endif
 
 /* XXX: This can be great on most RISC machines */
 #if !defined(__i386__) && !defined(__x86_64__)
diff --git a/target-alpha/translate.c b/target-alpha/translate.c
index 6a7da5adf..01e6ded12 100644
--- a/target-alpha/translate.c
+++ b/target-alpha/translate.c
@@ -59,7 +59,7 @@ static uint32_t *gen_opparam_ptr;
 
 #include "gen-op.h"
 
-static inline void gen_op_nop (void)
+static always_inline void gen_op_nop (void)
 {
 #if defined(GENERATE_NOP)
     gen_op_no_op();
@@ -77,7 +77,7 @@ NAME ## 20, NAME ## 21, NAME ## 22, NAME ## 23,                               \
 NAME ## 24, NAME ## 25, NAME ## 26, NAME ## 27,                               \
 NAME ## 28, NAME ## 29, NAME ## 30, NAME ## 31,                               \
 };                                                                            \
-static inline void func(int n)                                                \
+static always_inline void func (int n)                                        \
 {                                                                             \
     NAME ## _table[n]();                                                      \
 }
@@ -99,7 +99,7 @@ GEN32(gen_op_store_T1_ir, gen_op_store_T1_ir);
 GEN32(gen_op_store_T2_ir, gen_op_store_T2_ir);
 GEN32(gen_op_cmov_ir, gen_op_cmov_ir);
 
-static inline void gen_load_ir (DisasContext *ctx, int irn, int Tn)
+static always_inline void gen_load_ir (DisasContext *ctx, int irn, int Tn)
 {
     switch (Tn) {
     case 0:
@@ -114,7 +114,7 @@ static inline void gen_load_ir (DisasContext *ctx, int irn, int Tn)
     }
 }
 
-static inline void gen_store_ir (DisasContext *ctx, int irn, int Tn)
+static always_inline void gen_store_ir (DisasContext *ctx, int irn, int Tn)
 {
     switch (Tn) {
     case 0:
@@ -146,7 +146,7 @@ GEN32(gen_op_store_FT1_fir, gen_op_store_FT1_fir);
 GEN32(gen_op_store_FT2_fir, gen_op_store_FT2_fir);
 GEN32(gen_op_cmov_fir, gen_op_cmov_fir);
 
-static inline void gen_load_fir (DisasContext *ctx, int firn, int Tn)
+static always_inline void gen_load_fir (DisasContext *ctx, int firn, int Tn)
 {
     switch (Tn) {
     case 0:
@@ -161,7 +161,7 @@ static inline void gen_load_fir (DisasContext *ctx, int firn, int Tn)
     }
 }
 
-static inline void gen_store_fir (DisasContext *ctx, int firn, int Tn)
+static always_inline void gen_store_fir (DisasContext *ctx, int firn, int Tn)
 {
     switch (Tn) {
     case 0:
@@ -190,29 +190,29 @@ static GenOpFunc *gen_op_st##width[] = {                                      \
 #define OP_LD_TABLE(width)                                                    \
 static GenOpFunc *gen_op_ld##width[] = {                                      \
     &gen_op_ld##width##_kernel,                                               \
-    &gen_op_ld##width##_user, /* executive */                                 \
-    &gen_op_ld##width##_data, /* supervisor */                                \
-    &gen_op_ld##width##_data, /* user */                                      \
+    &gen_op_ld##width##_executive,                                            \
+    &gen_op_ld##width##_supervisor,                                           \
+    &gen_op_ld##width##_user,                                                 \
 }
 #define OP_ST_TABLE(width)                                                    \
 static GenOpFunc *gen_op_st##width[] = {                                      \
     &gen_op_st##width##_kernel,                                               \
-    &gen_op_st##width##_user, /* executive */                                 \
-    &gen_op_st##width##_data, /* supervisor */                                \
-    &gen_op_st##width##_data, /* user */                                      \
+    &gen_op_st##width##_executive,                                            \
+    &gen_op_st##width##_supervisor,                                           \
+    &gen_op_st##width##_user,                                                 \
 }
 #endif
 
 #define GEN_LD(width)                                                         \
 OP_LD_TABLE(width);                                                           \
-static void gen_ld##width (DisasContext *ctx)                                 \
+static always_inline void gen_ld##width (DisasContext *ctx)                   \
 {                                                                             \
     (*gen_op_ld##width[ctx->mem_idx])();                                      \
 }
 
 #define GEN_ST(width)                                                         \
 OP_ST_TABLE(width);                                                           \
-static void gen_st##width (DisasContext *ctx)                                 \
+static always_inline void gen_st##width (DisasContext *ctx)                   \
 {                                                                             \
     (*gen_op_st##width[ctx->mem_idx])();                                      \
 }
@@ -244,28 +244,28 @@ GEN_LD(t);
 GEN_ST(t);
 
 #if defined(__i386__) || defined(__x86_64__)
-static inline void gen_op_set_s16_T0 (int16_t imm)
+static always_inline void gen_op_set_s16_T0 (int16_t imm)
 {
     gen_op_set_s32_T0((int32_t)imm);
 }
 
-static inline void gen_op_set_s16_T1 (int16_t imm)
+static always_inline void gen_op_set_s16_T1 (int16_t imm)
 {
     gen_op_set_s32_T1((int32_t)imm);
 }
 
-static inline void gen_op_set_u16_T0 (uint16_t imm)
+static always_inline void gen_op_set_u16_T0 (uint16_t imm)
 {
     gen_op_set_s32_T0((uint32_t)imm);
 }
 
-static inline void gen_op_set_u16_T1 (uint16_t imm)
+static always_inline void gen_op_set_u16_T1 (uint16_t imm)
 {
     gen_op_set_s32_T1((uint32_t)imm);
 }
 #endif
 
-static inline void gen_set_sT0 (DisasContext *ctx, int64_t imm)
+static always_inline void gen_set_sT0 (DisasContext *ctx, int64_t imm)
 {
     int32_t imm32;
     int16_t imm16;
@@ -291,7 +291,7 @@ static inline void gen_set_sT0 (DisasContext *ctx, int64_t imm)
     }
 }
 
-static inline void gen_set_sT1 (DisasContext *ctx, int64_t imm)
+static always_inline void gen_set_sT1 (DisasContext *ctx, int64_t imm)
 {
     int32_t imm32;
     int16_t imm16;
@@ -317,7 +317,7 @@ static inline void gen_set_sT1 (DisasContext *ctx, int64_t imm)
     }
 }
 
-static inline void gen_set_uT0 (DisasContext *ctx, uint64_t imm)
+static always_inline void gen_set_uT0 (DisasContext *ctx, uint64_t imm)
 {
     if (!(imm >> 32)) {
         if ((!imm >> 16)) {
@@ -337,7 +337,7 @@ static inline void gen_set_uT0 (DisasContext *ctx, uint64_t imm)
     }
 }
 
-static inline void gen_set_uT1 (DisasContext *ctx, uint64_t imm)
+static always_inline void gen_set_uT1 (DisasContext *ctx, uint64_t imm)
 {
     if (!(imm >> 32)) {
         if ((!imm >> 16)) {
@@ -357,7 +357,7 @@ static inline void gen_set_uT1 (DisasContext *ctx, uint64_t imm)
     }
 }
 
-static inline void gen_update_pc (DisasContext *ctx)
+static always_inline void gen_update_pc (DisasContext *ctx)
 {
     if (!(ctx->pc >> 32)) {
         gen_op_update_pc32(ctx->pc);
@@ -370,7 +370,7 @@ static inline void gen_update_pc (DisasContext *ctx)
     }
 }
 
-static inline void _gen_op_bcond (DisasContext *ctx)
+static always_inline void _gen_op_bcond (DisasContext *ctx)
 {
 #if 0 // Qemu does not know how to do this...
     gen_op_bcond(ctx->pc);
@@ -379,20 +379,22 @@ static inline void _gen_op_bcond (DisasContext *ctx)
 #endif
 }
 
-static inline void gen_excp (DisasContext *ctx, int exception, int error_code)
+static always_inline void gen_excp (DisasContext *ctx,
+                                    int exception, int error_code)
 {
     gen_update_pc(ctx);
     gen_op_excp(exception, error_code);
 }
 
-static inline void gen_invalid (DisasContext *ctx)
+static always_inline void gen_invalid (DisasContext *ctx)
 {
     gen_excp(ctx, EXCP_OPCDEC, 0);
 }
 
-static void gen_load_mem (DisasContext *ctx,
-                          void (*gen_load_op)(DisasContext *ctx),
-                          int ra, int rb, int32_t disp16, int clear)
+static always_inline void gen_load_mem (DisasContext *ctx,
+                                        void (*gen_load_op)(DisasContext *ctx),
+                                        int ra, int rb, int32_t disp16,
+                                        int clear)
 {
     if (ra == 31 && disp16 == 0) {
         /* UNOP */
@@ -410,9 +412,10 @@ static void gen_load_mem (DisasContext *ctx,
     }
 }
 
-static void gen_store_mem (DisasContext *ctx,
-                           void (*gen_store_op)(DisasContext *ctx),
-                           int ra, int rb, int32_t disp16, int clear)
+static always_inline void gen_store_mem (DisasContext *ctx,
+                                         void (*gen_store_op)(DisasContext *ctx),
+                                         int ra, int rb, int32_t disp16,
+                                         int clear)
 {
     gen_load_ir(ctx, rb, 0);
     if (disp16 != 0) {
@@ -425,9 +428,9 @@ static void gen_store_mem (DisasContext *ctx,
     (*gen_store_op)(ctx);
 }
 
-static void gen_load_fmem (DisasContext *ctx,
-                           void (*gen_load_fop)(DisasContext *ctx),
-                          int ra, int rb, int32_t disp16)
+static always_inline void gen_load_fmem (DisasContext *ctx,
+                                         void (*gen_load_fop)(DisasContext *ctx),
+                                         int ra, int rb, int32_t disp16)
 {
     gen_load_ir(ctx, rb, 0);
     if (disp16 != 0) {
@@ -438,9 +441,9 @@ static void gen_load_fmem (DisasContext *ctx,
     gen_store_fir(ctx, ra, 1);
 }
 
-static void gen_store_fmem (DisasContext *ctx,
-                            void (*gen_store_fop)(DisasContext *ctx),
-                            int ra, int rb, int32_t disp16)
+static always_inline void gen_store_fmem (DisasContext *ctx,
+                                          void (*gen_store_fop)(DisasContext *ctx),
+                                          int ra, int rb, int32_t disp16)
 {
     gen_load_ir(ctx, rb, 0);
     if (disp16 != 0) {
@@ -451,8 +454,9 @@ static void gen_store_fmem (DisasContext *ctx,
     (*gen_store_fop)(ctx);
 }
 
-static void gen_bcond (DisasContext *ctx, void (*gen_test_op)(void),
-                       int ra, int32_t disp16)
+static always_inline void gen_bcond (DisasContext *ctx,
+                                     void (*gen_test_op)(void),
+                                     int ra, int32_t disp16)
 {
     if (disp16 != 0) {
         gen_set_uT0(ctx, ctx->pc);
@@ -466,8 +470,9 @@ static void gen_bcond (DisasContext *ctx, void (*gen_test_op)(void),
     _gen_op_bcond(ctx);
 }
 
-static void gen_fbcond (DisasContext *ctx, void (*gen_test_op)(void),
-                        int ra, int32_t disp16)
+static always_inline void gen_fbcond (DisasContext *ctx,
+                                      void (*gen_test_op)(void),
+                                      int ra, int32_t disp16)
 {
     if (disp16 != 0) {
         gen_set_uT0(ctx, ctx->pc);
@@ -481,8 +486,9 @@ static void gen_fbcond (DisasContext *ctx, void (*gen_test_op)(void),
     _gen_op_bcond(ctx);
 }
 
-static void gen_arith2 (DisasContext *ctx, void (*gen_arith_op)(void),
-                        int rb, int rc, int islit, int8_t lit)
+static always_inline void gen_arith2 (DisasContext *ctx,
+                                      void (*gen_arith_op)(void),
+                                      int rb, int rc, int islit, int8_t lit)
 {
     if (islit)
         gen_set_sT0(ctx, lit);
@@ -492,8 +498,10 @@ static void gen_arith2 (DisasContext *ctx, void (*gen_arith_op)(void),
     gen_store_ir(ctx, rc, 0);
 }
 
-static void gen_arith3 (DisasContext *ctx, void (*gen_arith_op)(void),
-                        int ra, int rb, int rc, int islit, int8_t lit)
+static always_inline void gen_arith3 (DisasContext *ctx,
+                                      void (*gen_arith_op)(void),
+                                      int ra, int rb, int rc,
+                                      int islit, int8_t lit)
 {
     gen_load_ir(ctx, ra, 0);
     if (islit)
@@ -504,8 +512,10 @@ static void gen_arith3 (DisasContext *ctx, void (*gen_arith_op)(void),
     gen_store_ir(ctx, rc, 0);
 }
 
-static void gen_cmov (DisasContext *ctx, void (*gen_test_op)(void),
-                      int ra, int rb, int rc, int islit, int8_t lit)
+static always_inline void gen_cmov (DisasContext *ctx,
+                                    void (*gen_test_op)(void),
+                                    int ra, int rb, int rc,
+                                    int islit, int8_t lit)
 {
     gen_load_ir(ctx, ra, 1);
     if (islit)
@@ -516,16 +526,18 @@ static void gen_cmov (DisasContext *ctx, void (*gen_test_op)(void),
     gen_op_cmov_ir(rc);
 }
 
-static void gen_farith2 (DisasContext *ctx, void (*gen_arith_fop)(void),
-                         int rb, int rc)
+static always_inline void gen_farith2 (DisasContext *ctx,
+                                       void (*gen_arith_fop)(void),
+                                       int rb, int rc)
 {
     gen_load_fir(ctx, rb, 0);
     (*gen_arith_fop)();
     gen_store_fir(ctx, rc, 0);
 }
 
-static void gen_farith3 (DisasContext *ctx, void (*gen_arith_fop)(void),
-                         int ra, int rb, int rc)
+static always_inline void gen_farith3 (DisasContext *ctx,
+                                       void (*gen_arith_fop)(void),
+                                       int ra, int rb, int rc)
 {
     gen_load_fir(ctx, ra, 0);
     gen_load_fir(ctx, rb, 1);
@@ -533,8 +545,9 @@ static void gen_farith3 (DisasContext *ctx, void (*gen_arith_fop)(void),
     gen_store_fir(ctx, rc, 0);
 }
 
-static void gen_fcmov (DisasContext *ctx, void (*gen_test_fop)(void),
-                       int ra, int rb, int rc)
+static always_inline void gen_fcmov (DisasContext *ctx,
+                                     void (*gen_test_fop)(void),
+                                     int ra, int rb, int rc)
 {
     gen_load_fir(ctx, ra, 0);
     gen_load_fir(ctx, rb, 1);
@@ -542,77 +555,79 @@ static void gen_fcmov (DisasContext *ctx, void (*gen_test_fop)(void),
     gen_op_cmov_fir(rc);
 }
 
-static void gen_fti (DisasContext *ctx, void (*gen_move_fop)(void),
-                     int ra, int rc)
+static always_inline void gen_fti (DisasContext *ctx,
+                                   void (*gen_move_fop)(void),
+                                   int ra, int rc)
 {
     gen_load_fir(ctx, rc, 0);
     (*gen_move_fop)();
     gen_store_ir(ctx, ra, 0);
 }
 
-static void gen_itf (DisasContext *ctx, void (*gen_move_fop)(void),
-                     int ra, int rc)
+static always_inline void gen_itf (DisasContext *ctx,
+                                   void (*gen_move_fop)(void),
+                                   int ra, int rc)
 {
     gen_load_ir(ctx, ra, 0);
     (*gen_move_fop)();
     gen_store_fir(ctx, rc, 0);
 }
 
-static void gen_s4addl (void)
+static always_inline void gen_s4addl (void)
 {
     gen_op_s4();
     gen_op_addl();
 }
 
-static void gen_s4subl (void)
+static always_inline void gen_s4subl (void)
 {
     gen_op_s4();
     gen_op_subl();
 }
 
-static void gen_s8addl (void)
+static always_inline void gen_s8addl (void)
 {
     gen_op_s8();
     gen_op_addl();
 }
 
-static void gen_s8subl (void)
+static always_inline void gen_s8subl (void)
 {
     gen_op_s8();
     gen_op_subl();
 }
 
-static void gen_s4addq (void)
+static always_inline void gen_s4addq (void)
 {
     gen_op_s4();
     gen_op_addq();
 }
 
-static void gen_s4subq (void)
+static always_inline void gen_s4subq (void)
 {
     gen_op_s4();
     gen_op_subq();
 }
 
-static void gen_s8addq (void)
+static always_inline void gen_s8addq (void)
 {
     gen_op_s8();
     gen_op_addq();
 }
 
-static void gen_s8subq (void)
+static always_inline void gen_s8subq (void)
 {
     gen_op_s8();
     gen_op_subq();
 }
 
-static void gen_amask (void)
+static always_inline void gen_amask (void)
 {
     gen_op_load_amask();
     gen_op_bic();
 }
 
-static int translate_one (DisasContext *ctx, uint32_t insn)
+static always_inline int translate_one (DisasContext *ctx, uint32_t insn)
 {
     uint32_t palcode;
     int32_t disp21, disp16, disp12;
@@ -1958,8 +1973,9 @@ static int translate_one (DisasContext *ctx, uint32_t insn)
     return ret;
 }
 
-int gen_intermediate_code_internal (CPUState *env, TranslationBlock *tb,
-                                    int search_pc)
+static always_inline int gen_intermediate_code_internal (CPUState *env,
+                                                         TranslationBlock *tb,
+                                                         int search_pc)
 {
 #if defined ALPHA_DEBUG_DISAS
     static int insn_count;
@@ -2079,7 +2095,7 @@ int gen_intermediate_code_pc (CPUState *env, struct TranslationBlock *tb)
     return gen_intermediate_code_internal(env, tb, 1);
 }
 
-CPUAlphaState * cpu_alpha_init (void)
+CPUAlphaState * cpu_alpha_init (const char *cpu_model)
 {
     CPUAlphaState *env;
     uint64_t hwpcb;
@@ -2117,3 +2133,4 @@ CPUAlphaState * cpu_alpha_init (void)
 
     return env;
 }
+
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 76fdbb26b..b284a2169 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -37,12 +37,26 @@
 #define EXCP_IRQ             5
 #define EXCP_FIQ             6
 #define EXCP_BKPT            7
+#define EXCP_EXCEPTION_EXIT  8   /* Return from v7M exception.  */
+
+#define ARMV7M_EXCP_RESET   1
+#define ARMV7M_EXCP_NMI     2
+#define ARMV7M_EXCP_HARD    3
+#define ARMV7M_EXCP_MEM     4
+#define ARMV7M_EXCP_BUS     5
+#define ARMV7M_EXCP_USAGE   6
+#define ARMV7M_EXCP_SVC     11
+#define ARMV7M_EXCP_DEBUG   12
+#define ARMV7M_EXCP_PENDSV  14
+#define ARMV7M_EXCP_SYSTICK 15
 
 typedef void ARMWriteCPFunc(void *opaque, int cp_info,
                             int srcreg, int operand, uint32_t value);
 typedef uint32_t ARMReadCPFunc(void *opaque, int cp_info,
                                int dstreg, int operand);
 
+#define NB_MMU_MODES 2
+
 /* We currently assume float and double are IEEE single and double
    precision respectively.
    Doing runtime conversions is tricky because VFP registers may contain
@@ -74,17 +88,22 @@ typedef struct CPUARMState {
     uint32_t VF; /* V is the bit 31. All other bits are undefined */
     uint32_t NZF; /* N is bit 31. Z is computed from NZF */
     uint32_t QF; /* 0 or 1 */
-
-    int thumb; /* 0 = arm mode, 1 = thumb mode */
+    uint32_t GE; /* cpsr[19:16] */
+    int thumb; /* cprs[5]. 0 = arm mode, 1 = thumb mode. */
+    uint32_t condexec_bits; /* IT bits.  cpsr[15:10,26:25].  */
 
     /* System control coprocessor (cp15) */
     struct {
         uint32_t c0_cpuid;
         uint32_t c0_cachetype;
+        uint32_t c0_c1[8]; /* Feature registers.  */
+        uint32_t c0_c2[8]; /* Instruction set registers.  */
         uint32_t c1_sys; /* System control register.  */
         uint32_t c1_coproc; /* Coprocessor access register.  */
         uint32_t c1_xscaleauxcr; /* XScale auxiliary control register.  */
-        uint32_t c2_base; /* MMU translation table base.  */
+        uint32_t c2_base0; /* MMU translation table base 0.  */
+        uint32_t c2_base1; /* MMU translation table base 1.  */
+        uint32_t c2_mask; /* MMU translation table base mask.  */
         uint32_t c2_data; /* MPU data cachable bits.  */
         uint32_t c2_insn; /* MPU instruction cachable bits.  */
         uint32_t c3; /* MMU domain access control register
@@ -98,6 +117,9 @@ typedef struct CPUARMState {
         uint32_t c9_data;
         uint32_t c13_fcse; /* FCSE PID.  */
         uint32_t c13_context; /* Context ID.  */
+        uint32_t c13_tls1; /* User RW Thread register.  */
+        uint32_t c13_tls2; /* User RO Thread register.  */
+        uint32_t c13_tls3; /* Privileged Thread register.  */
         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
         uint32_t c15_i_max; /* Maximum D-cache dirty line index.  */
@@ -105,6 +127,17 @@ typedef struct CPUARMState {
         uint32_t c15_threadid; /* TI debugger thread-ID.  */
     } cp15;
 
+    struct {
+        uint32_t other_sp;
+        uint32_t vecbase;
+        uint32_t basepri;
+        uint32_t control;
+        int current_sp;
+        int exception;
+        int pending_exception;
+        void *nvic;
+    } v7m;
+
     /* Coprocessor IO used by peripherals */
     struct {
         ARMReadCPFunc *cp_read;
@@ -115,6 +148,10 @@ typedef struct CPUARMState {
     /* Internal CPU feature flags.  */
     uint32_t features;
 
+    /* Callback for vectored interrupt controller.  */
+    int (*get_irq_vector)(struct CPUARMState *);
+    void *irq_opaque;
+
     /* exception/interrupt handling */
     jmp_buf jmp_env;
     int exception_index;
@@ -124,7 +161,7 @@ typedef struct CPUARMState {
 
     /* VFP coprocessor state.  */
     struct {
-        float64 regs[16];
+        float64 regs[32];
 
         uint32_t xregs[16];
         /* We store these fpcsr fields separately for convenience.  */
@@ -134,9 +171,16 @@ typedef struct CPUARMState {
         /* Temporary variables if we don't have spare fp regs.  */
         float32 tmp0s, tmp1s;
         float64 tmp0d, tmp1d;
+        /* scratch space when Tn are not sufficient.  */
+        uint32_t scratch[8];
 
         float_status fp_status;
     } vfp;
+#if defined(CONFIG_USER_ONLY)
+    struct mmon_state *mmon_entry;
+#else
+    uint32_t mmon_addr;
+#endif
 
     /* iwMMXt coprocessor state.  */
     struct {
@@ -162,11 +206,12 @@ typedef struct CPUARMState {
     target_phys_addr_t loader_start;
 } CPUARMState;
 
-CPUARMState *cpu_arm_init(void);
+CPUARMState *cpu_arm_init(const char *cpu_model);
 int cpu_arm_exec(CPUARMState *s);
 void cpu_arm_close(CPUARMState *s);
 void do_interrupt(CPUARMState *);
 void switch_mode(CPUARMState *, int);
+uint32_t do_arm_semihosting(CPUARMState *env);
 
 /* you can call this signal handler from your SIGBUS and SIGSEGV
    signal handlers to inform the virtual CPU of exceptions. non zero
@@ -174,6 +219,9 @@ void switch_mode(CPUARMState *, int);
 int cpu_arm_signal_handler(int host_signum, void *pinfo,
                            void *puc);
 
+void cpu_lock(void);
+void cpu_unlock(void);
+
 #define CPSR_M (0x1f)
 #define CPSR_T (1 << 5)
 #define CPSR_F (1 << 6)
@@ -181,25 +229,43 @@ int cpu_arm_signal_handler(int host_signum, void *pinfo,
 #define CPSR_A (1 << 8)
 #define CPSR_E (1 << 9)
 #define CPSR_IT_2_7 (0xfc00)
-/* Bits 20-23 reserved.  */
+#define CPSR_GE (0xf << 16)
+#define CPSR_RESERVED (0xf << 20)
 #define CPSR_J (1 << 24)
 #define CPSR_IT_0_1 (3 << 25)
 #define CPSR_Q (1 << 27)
-#define CPSR_NZCV (0xf << 28)
+#define CPSR_V (1 << 28)
+#define CPSR_C (1 << 29)
+#define CPSR_Z (1 << 30)
+#define CPSR_N (1 << 31)
+#define CPSR_NZCV (CPSR_N | CPSR_Z | CPSR_C | CPSR_V)
+
+#define CPSR_IT (CPSR_IT_0_1 | CPSR_IT_2_7)
+#define CACHED_CPSR_BITS (CPSR_T | CPSR_GE | CPSR_IT | CPSR_Q | CPSR_NZCV)
+/* Bits writable in user mode.  */
+#define CPSR_USER (CPSR_NZCV | CPSR_Q | CPSR_GE)
+/* Execution state bits.  MRS read as zero, MSR writes ignored.  */
+#define CPSR_EXEC (CPSR_T | CPSR_IT | CPSR_J)
 
-#define CACHED_CPSR_BITS (CPSR_T | CPSR_Q | CPSR_NZCV)
 /* Return the current CPSR value.  */
-static inline uint32_t cpsr_read(CPUARMState *env)
+uint32_t cpsr_read(CPUARMState *env);
+/* Set the CPSR.  Note that some bits of mask must be all-set or all-clear.  */
+void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask);
+
+/* Return the current xPSR value.  */
+static inline uint32_t xpsr_read(CPUARMState *env)
 {
     int ZF;
     ZF = (env->NZF == 0);
-    return env->uncached_cpsr | (env->NZF & 0x80000000) | (ZF << 30) |
-        (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
-        | (env->thumb << 5);
+    return (env->NZF & 0x80000000) | (ZF << 30)
+        | (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
+        | (env->thumb << 24) | ((env->condexec_bits & 3) << 25)
+        | ((env->condexec_bits & 0xfc) << 8)
+        | env->v7m.exception;
 }
 
-/* Set the CPSR.  Note that some bits of mask must be all-set or all-clear.  */
-static inline void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+/* Set the xPSR.  Note that some bits of mask must be all-set or all-clear.  */
+static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 {
     /* NOTE: N = 1 and Z = 1 cannot be stored currently */
     if (mask & CPSR_NZCV) {
@@ -209,14 +275,19 @@ static inline void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
     }
     if (mask & CPSR_Q)
         env->QF = ((val & CPSR_Q) != 0);
-    if (mask & CPSR_T)
-        env->thumb = ((val & CPSR_T) != 0);
-
-    if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
-        switch_mode(env, val & CPSR_M);
+    if (mask & (1 << 24))
+        env->thumb = ((val & (1 << 24)) != 0);
+    if (mask & CPSR_IT_0_1) {
+        env->condexec_bits &= ~3;
+        env->condexec_bits |= (val >> 25) & 3;
+    }
+    if (mask & CPSR_IT_2_7) {
+        env->condexec_bits &= 3;
+        env->condexec_bits |= (val >> 8) & 0xfc;
+    }
+    if (mask & 0x1ff) {
+        env->v7m.exception = val & 0x1ff;
     }
-    mask &= ~CACHED_CPSR_BITS;
-    env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
 }
 
 enum arm_cpu_mode {
@@ -232,6 +303,8 @@ enum arm_cpu_mode {
 /* VFP system registers.  */
 #define ARM_VFP_FPSID   0
 #define ARM_VFP_FPSCR   1
+#define ARM_VFP_MVFR1   6
+#define ARM_VFP_MVFR0   7
 #define ARM_VFP_FPEXC   8
 #define ARM_VFP_FPINST  9
 #define ARM_VFP_FPINST2 10
@@ -251,7 +324,15 @@ enum arm_features {
     ARM_FEATURE_AUXCR,  /* ARM1026 Auxiliary control register.  */
     ARM_FEATURE_XSCALE, /* Intel XScale extensions.  */
     ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension.  */
+    ARM_FEATURE_V6,
+    ARM_FEATURE_V6K,
+    ARM_FEATURE_V7,
+    ARM_FEATURE_THUMB2,
     ARM_FEATURE_MPU,    /* Only has Memory Protection Unit, not full MMU.  */
+    ARM_FEATURE_VFP3,
+    ARM_FEATURE_NEON,
+    ARM_FEATURE_DIV,
+    ARM_FEATURE_M, /* Microcontroller profile.  */
     ARM_FEATURE_OMAPCP  /* OMAP specific CP15 ops handling.  */
 };
 
@@ -260,30 +341,46 @@ static inline int arm_feature(CPUARMState *env, int feature)
     return (env->features & (1u << feature)) != 0;
 }
 
-void arm_cpu_list(void);
-void cpu_arm_set_model(CPUARMState *env, const char *name);
+void arm_cpu_list(FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...));
+
+/* Interface between CPU and Interrupt controller.  */
+void armv7m_nvic_set_pending(void *opaque, int irq);
+int armv7m_nvic_acknowledge_irq(void *opaque);
+void armv7m_nvic_complete_irq(void *opaque, int irq);
 
 void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
                        ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
                        void *opaque);
 
-#define ARM_CPUID_ARM1026   0x4106a262
-#define ARM_CPUID_ARM926    0x41069265
-#define ARM_CPUID_ARM946    0x41059461
-#define ARM_CPUID_TI915T    0x54029152
-#define ARM_CPUID_TI925T    0x54029252
-#define ARM_CPUID_PXA250    0x69052100
-#define ARM_CPUID_PXA255    0x69052d00
-#define ARM_CPUID_PXA260    0x69052903
-#define ARM_CPUID_PXA261    0x69052d05
-#define ARM_CPUID_PXA262    0x69052d06
-#define ARM_CPUID_PXA270    0x69054110
-#define ARM_CPUID_PXA270_A0 0x69054110
-#define ARM_CPUID_PXA270_A1 0x69054111
-#define ARM_CPUID_PXA270_B0 0x69054112
-#define ARM_CPUID_PXA270_B1 0x69054113
-#define ARM_CPUID_PXA270_C0 0x69054114
-#define ARM_CPUID_PXA270_C5 0x69054117
+/* Does the core conform to the the "MicroController" profile. e.g. Cortex-M3.
+   Note the M in older cores (eg. ARM7TDMI) stands for Multiply. These are
+   conventional cores (ie. Application or Realtime profile).  */
+
+#define IS_M(env) arm_feature(env, ARM_FEATURE_M)
+#define ARM_CPUID(env) (env->cp15.c0_cpuid)
+
+#define ARM_CPUID_ARM1026     0x4106a262
+#define ARM_CPUID_ARM926      0x41069265
+#define ARM_CPUID_ARM946      0x41059461
+#define ARM_CPUID_TI915T      0x54029152
+#define ARM_CPUID_TI925T      0x54029252
+#define ARM_CPUID_PXA250      0x69052100
+#define ARM_CPUID_PXA255      0x69052d00
+#define ARM_CPUID_PXA260      0x69052903
+#define ARM_CPUID_PXA261      0x69052d05
+#define ARM_CPUID_PXA262      0x69052d06
+#define ARM_CPUID_PXA270      0x69054110
+#define ARM_CPUID_PXA270_A0   0x69054110
+#define ARM_CPUID_PXA270_A1   0x69054111
+#define ARM_CPUID_PXA270_B0   0x69054112
+#define ARM_CPUID_PXA270_B1   0x69054113
+#define ARM_CPUID_PXA270_C0   0x69054114
+#define ARM_CPUID_PXA270_C5   0x69054117
+#define ARM_CPUID_ARM1136     0x4117b363
+#define ARM_CPUID_ARM11MPCORE 0x410fb022
+#define ARM_CPUID_CORTEXA8    0x410fc080
+#define ARM_CPUID_CORTEXM3    0x410fc231
+#define ARM_CPUID_ANY         0xffffffff
 
 #if defined(CONFIG_USER_ONLY)
 #define TARGET_PAGE_BITS 12
@@ -299,6 +396,18 @@ void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
 #define cpu_exec cpu_arm_exec
 #define cpu_gen_code cpu_arm_gen_code
 #define cpu_signal_handler cpu_arm_signal_handler
+#define cpu_list arm_cpu_list
+
+#define ARM_CPU_SAVE_VERSION 1
+
+/* MMU modes definitions */
+#define MMU_MODE0_SUFFIX _kernel
+#define MMU_MODE1_SUFFIX _user
+#define MMU_USER_IDX 1
+static inline int cpu_mmu_index (CPUState *env)
+{
+    return (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR ? 1 : 0;
+}
 
 #include "cpu-all.h"
 
diff --git a/target-arm/exec.h b/target-arm/exec.h
index 9da19150b..cb202062d 100644
--- a/target-arm/exec.h
+++ b/target-arm/exec.h
@@ -46,7 +46,7 @@ static inline void regs_to_env(void)
 }
 
 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int is_user, int is_softmmu);
+                              int mmu_idx, int is_softmmu);
 
 static inline int cpu_halted(CPUState *env) {
     if (!env->halted)
@@ -68,12 +68,18 @@ static inline int cpu_halted(CPUState *env) {
 
 /* In op_helper.c */
 
-void cpu_lock(void);
-void cpu_unlock(void);
 void helper_set_cp(CPUState *, uint32_t, uint32_t);
 uint32_t helper_get_cp(CPUState *, uint32_t);
 void helper_set_cp15(CPUState *, uint32_t, uint32_t);
 uint32_t helper_get_cp15(CPUState *, uint32_t);
+void helper_set_r13_banked(CPUState *env, int mode, uint32_t val);
+uint32_t helper_get_r13_banked(CPUState *env, int mode);
+uint32_t helper_v7m_mrs(CPUState *env, int reg);
+void helper_v7m_msr(CPUState *env, int reg, uint32_t val);
+
+void helper_mark_exclusive(CPUARMState *, uint32_t addr);
+int helper_test_exclusive(CPUARMState *, uint32_t addr);
+void helper_clrex(CPUARMState *env);
 
 void cpu_loop_exit(void);
 
@@ -91,4 +97,11 @@ void do_vfp_cmpes(void);
 void do_vfp_cmped(void);
 void do_vfp_set_fpscr(void);
 void do_vfp_get_fpscr(void);
-
+float32 helper_recps_f32(float32, float32);
+float32 helper_rsqrts_f32(float32, float32);
+uint32_t helper_recpe_u32(uint32_t);
+uint32_t helper_rsqrte_u32(uint32_t);
+float32 helper_recpe_f32(float32);
+float32 helper_rsqrte_f32(float32);
+void helper_neon_tbl(int rn, int maxindex);
+uint32_t helper_neon_mul_p8(uint32_t op1, uint32_t op2);
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 01573a238..86470dbee 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -4,6 +4,27 @@
 
 #include "cpu.h"
 #include "exec-all.h"
+#include "gdbstub.h"
+
+static uint32_t cortexa8_cp15_c0_c1[8] =
+{ 0x1031, 0x11, 0x400, 0, 0x31100003, 0x20000000, 0x01202000, 0x11 };
+
+static uint32_t cortexa8_cp15_c0_c2[8] =
+{ 0x00101111, 0x12112111, 0x21232031, 0x11112131, 0x00111142, 0, 0, 0 };
+
+static uint32_t mpcore_cp15_c0_c1[8] =
+{ 0x111, 0x1, 0, 0x2, 0x01100103, 0x10020302, 0x01222000, 0 };
+
+static uint32_t mpcore_cp15_c0_c2[8] =
+{ 0x00100011, 0x12002111, 0x11221011, 0x01102131, 0x141, 0, 0, 0 };
+
+static uint32_t arm1136_cp15_c0_c1[8] =
+{ 0x111, 0x1, 0x2, 0x3, 0x01130003, 0x10030302, 0x01222110, 0 };
+
+static uint32_t arm1136_cp15_c0_c2[8] =
+{ 0x00140011, 0x12002111, 0x11231111, 0x01102131, 0x141, 0, 0, 0 };
+
+static uint32_t cpu_arm_find_by_name(const char *name);
 
 static inline void set_feature(CPUARMState *env, int feature)
 {
@@ -32,6 +53,62 @@ static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
         env->cp15.c0_cachetype = 0x1dd20d2;
         env->cp15.c1_sys = 0x00090078;
         break;
+    case ARM_CPUID_ARM1136:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_AUXCR);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
+        memcpy(env->cp15.c0_c1, arm1136_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c1, arm1136_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        break;
+    case ARM_CPUID_ARM11MPCORE:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_V6K);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_AUXCR);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
+        memcpy(env->cp15.c0_c1, mpcore_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c1, mpcore_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        break;
+    case ARM_CPUID_CORTEXA8:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_V6K);
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_AUXCR);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_VFP3);
+        set_feature(env, ARM_FEATURE_NEON);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410330c0;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x11110222;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x00011100;
+        memcpy(env->cp15.c0_c1, cortexa8_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c1, cortexa8_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        break;
+    case ARM_CPUID_CORTEXM3:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_M);
+        set_feature(env, ARM_FEATURE_DIV);
+        break;
+    case ARM_CPUID_ANY: /* For userspace emulation.  */
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_V6K);
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_VFP3);
+        set_feature(env, ARM_FEATURE_NEON);
+        set_feature(env, ARM_FEATURE_DIV);
+        break;
     case ARM_CPUID_TI915T:
     case ARM_CPUID_TI925T:
         set_feature(env, ARM_FEATURE_OMAPCP);
@@ -83,20 +160,30 @@ void cpu_reset(CPUARMState *env)
 #else
     /* SVC mode with interrupts disabled.  */
     env->uncached_cpsr = ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
+    /* On ARMv7-M the CPSR_I is the value of the PRIMASK register, and is
+       clear at reset.  */
+    if (IS_M(env))
+        env->uncached_cpsr &= ~CPSR_I;
     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 #endif
     env->regs[15] = 0;
     tlb_flush(env, 1);
 }
 
-CPUARMState *cpu_arm_init(void)
+CPUARMState *cpu_arm_init(const char *cpu_model)
 {
     CPUARMState *env;
+    uint32_t id;
 
+    id = cpu_arm_find_by_name(cpu_model);
+    if (id == 0)
+        return NULL;
     env = qemu_mallocz(sizeof(CPUARMState));
     if (!env)
         return NULL;
     cpu_exec_init(env);
+    env->cpu_model_str = cpu_model;
+    env->cp15.c0_cpuid = id;
     cpu_reset(env);
     return env;
 }
@@ -110,6 +197,10 @@ static const struct arm_cpu_t arm_cpu_names[] = {
     { ARM_CPUID_ARM926, "arm926"},
     { ARM_CPUID_ARM946, "arm946"},
     { ARM_CPUID_ARM1026, "arm1026"},
+    { ARM_CPUID_ARM1136, "arm1136"},
+    { ARM_CPUID_ARM11MPCORE, "arm11mpcore"},
+    { ARM_CPUID_CORTEXM3, "cortex-m3"},
+    { ARM_CPUID_CORTEXA8, "cortex-a8"},
     { ARM_CPUID_TI925T, "ti925t" },
     { ARM_CPUID_PXA250, "pxa250" },
     { ARM_CPUID_PXA255, "pxa255" },
@@ -123,37 +214,34 @@ static const struct arm_cpu_t arm_cpu_names[] = {
     { ARM_CPUID_PXA270_B1, "pxa270-b1" },
     { ARM_CPUID_PXA270_C0, "pxa270-c0" },
     { ARM_CPUID_PXA270_C5, "pxa270-c5" },
+    { ARM_CPUID_ANY, "any"},
     { 0, NULL}
 };
 
-void arm_cpu_list(void)
+void arm_cpu_list(FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
 {
     int i;
 
-    printf ("Available CPUs:\n");
+    (*cpu_fprintf)(f, "Available CPUs:\n");
     for (i = 0; arm_cpu_names[i].name; i++) {
-        printf("  %s\n", arm_cpu_names[i].name);
+        (*cpu_fprintf)(f, "  %s\n", arm_cpu_names[i].name);
     }
 }
 
-void cpu_arm_set_model(CPUARMState *env, const char *name)
+/* return 0 if not found */
+static uint32_t cpu_arm_find_by_name(const char *name)
 {
     int i;
     uint32_t id;
 
     id = 0;
-    i = 0;
     for (i = 0; arm_cpu_names[i].name; i++) {
         if (strcmp(name, arm_cpu_names[i].name) == 0) {
             id = arm_cpu_names[i].id;
             break;
         }
     }
-    if (!id) {
-        cpu_abort(env, "Unknown CPU '%s'", name);
-        return;
-    }
-    cpu_reset_model_id(env, id);
+    return id;
 }
 
 void cpu_arm_close(CPUARMState *env)
@@ -161,6 +249,72 @@ void cpu_arm_close(CPUARMState *env)
     free(env);
 }
 
+/* Polynomial multiplication is like integer multiplcation except the
+   partial products are XORed, not added.  */
+uint32_t helper_neon_mul_p8(uint32_t op1, uint32_t op2)
+{
+    uint32_t mask;
+    uint32_t result;
+    result = 0;
+    while (op1) {
+        mask = 0;
+        if (op1 & 1)
+            mask |= 0xff;
+        if (op1 & (1 << 8))
+            mask |= (0xff << 8);
+        if (op1 & (1 << 16))
+            mask |= (0xff << 16);
+        if (op1 & (1 << 24))
+            mask |= (0xff << 24);
+        result ^= op2 & mask;
+        op1 = (op1 >> 1) & 0x7f7f7f7f;
+        op2 = (op2 << 1) & 0xfefefefe;
+    }
+    return result;
+}
+
+uint32_t cpsr_read(CPUARMState *env)
+{
+    int ZF;
+    ZF = (env->NZF == 0);
+    return env->uncached_cpsr | (env->NZF & 0x80000000) | (ZF << 30) |
+        (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
+        | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
+        | ((env->condexec_bits & 0xfc) << 8)
+        | (env->GE << 16);
+}
+
+void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+{
+    /* NOTE: N = 1 and Z = 1 cannot be stored currently */
+    if (mask & CPSR_NZCV) {
+        env->NZF = (val & 0xc0000000) ^ 0x40000000;
+        env->CF = (val >> 29) & 1;
+        env->VF = (val << 3) & 0x80000000;
+    }
+    if (mask & CPSR_Q)
+        env->QF = ((val & CPSR_Q) != 0);
+    if (mask & CPSR_T)
+        env->thumb = ((val & CPSR_T) != 0);
+    if (mask & CPSR_IT_0_1) {
+        env->condexec_bits &= ~3;
+        env->condexec_bits |= (val >> 25) & 3;
+    }
+    if (mask & CPSR_IT_2_7) {
+        env->condexec_bits &= 3;
+        env->condexec_bits |= (val >> 8) & 0xfc;
+    }
+    if (mask & CPSR_GE) {
+        env->GE = (val >> 16) & 0xf;
+    }
+
+    if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
+        switch_mode(env, val & CPSR_M);
+    }
+    mask &= ~CACHED_CPSR_BITS;
+    env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
+}
+
 #if defined(CONFIG_USER_ONLY)
 
 void do_interrupt (CPUState *env)
@@ -168,8 +322,18 @@ void do_interrupt (CPUState *env)
     env->exception_index = -1;
 }
 
+/* Structure used to record exclusive memory locations.  */
+typedef struct mmon_state {
+    struct mmon_state *next;
+    CPUARMState *cpu_env;
+    uint32_t addr;
+} mmon_state;
+
+/* Chain of current locks.  */
+static mmon_state* mmon_head = NULL;
+
 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int is_user, int is_softmmu)
+                              int mmu_idx, int is_softmmu)
 {
     if (rw == 2) {
         env->exception_index = EXCP_PREFETCH_ABORT;
@@ -181,6 +345,64 @@ int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
     return 1;
 }
 
+static void allocate_mmon_state(CPUState *env)
+{
+    env->mmon_entry = malloc(sizeof (mmon_state));
+    if (!env->mmon_entry)
+        abort();
+    memset (env->mmon_entry, 0, sizeof (mmon_state));
+    env->mmon_entry->cpu_env = env;
+    mmon_head = env->mmon_entry;
+}
+
+/* Flush any monitor locks for the specified address.  */
+static void flush_mmon(uint32_t addr)
+{
+    mmon_state *mon;
+
+    for (mon = mmon_head; mon; mon = mon->next)
+      {
+        if (mon->addr != addr)
+          continue;
+
+        mon->addr = 0;
+        break;
+      }
+}
+
+/* Mark an address for exclusive access.  */
+void helper_mark_exclusive(CPUState *env, uint32_t addr)
+{
+    if (!env->mmon_entry)
+        allocate_mmon_state(env);
+    /* Clear any previous locks.  */
+    flush_mmon(addr);
+    env->mmon_entry->addr = addr;
+}
+
+/* Test if an exclusive address is still exclusive.  Returns zero
+   if the address is still exclusive.   */
+int helper_test_exclusive(CPUState *env, uint32_t addr)
+{
+    int res;
+
+    if (!env->mmon_entry)
+        return 1;
+    if (env->mmon_entry->addr == addr)
+        res = 0;
+    else
+        res = 1;
+    flush_mmon(addr);
+    return res;
+}
+
+void helper_clrex(CPUState *env)
+{
+    if (!(env->mmon_entry && env->mmon_entry->addr))
+        return;
+    flush_mmon(env->mmon_entry->addr);
+}
+
 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 {
     return addr;
@@ -212,12 +434,35 @@ uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
     return 0;
 }
 
+/* These should probably raise undefined insn exceptions.  */
+void helper_v7m_msr(CPUState *env, int reg, uint32_t val)
+{
+    cpu_abort(env, "v7m_mrs %d\n", reg);
+}
+
+uint32_t helper_v7m_mrs(CPUState *env, int reg)
+{
+    cpu_abort(env, "v7m_mrs %d\n", reg);
+    return 0;
+}
+
 void switch_mode(CPUState *env, int mode)
 {
     if (mode != ARM_CPU_MODE_USR)
         cpu_abort(env, "Tried to switch out of user mode\n");
 }
 
+void helper_set_r13_banked(CPUState *env, int mode, uint32_t val)
+{
+    cpu_abort(env, "banked r13 write\n");
+}
+
+uint32_t helper_get_r13_banked(CPUState *env, int mode)
+{
+    cpu_abort(env, "banked r13 read\n");
+    return 0;
+}
+
 #else
 
 extern int semihosting_enabled;
@@ -272,6 +517,138 @@ void switch_mode(CPUState *env, int mode)
     env->spsr = env->banked_spsr[i];
 }
 
+static void v7m_push(CPUARMState *env, uint32_t val)
+{
+    env->regs[13] -= 4;
+    stl_phys(env->regs[13], val);
+}
+
+static uint32_t v7m_pop(CPUARMState *env)
+{
+    uint32_t val;
+    val = ldl_phys(env->regs[13]);
+    env->regs[13] += 4;
+    return val;
+}
+
+/* Switch to V7M main or process stack pointer.  */
+static void switch_v7m_sp(CPUARMState *env, int process)
+{
+    uint32_t tmp;
+    if (env->v7m.current_sp != process) {
+        tmp = env->v7m.other_sp;
+        env->v7m.other_sp = env->regs[13];
+        env->regs[13] = tmp;
+        env->v7m.current_sp = process;
+    }
+}
+
+static void do_v7m_exception_exit(CPUARMState *env)
+{
+    uint32_t type;
+    uint32_t xpsr;
+
+    type = env->regs[15];
+    if (env->v7m.exception != 0)
+        armv7m_nvic_complete_irq(env->v7m.nvic, env->v7m.exception);
+
+    /* Switch to the target stack.  */
+    switch_v7m_sp(env, (type & 4) != 0);
+    /* Pop registers.  */
+    env->regs[0] = v7m_pop(env);
+    env->regs[1] = v7m_pop(env);
+    env->regs[2] = v7m_pop(env);
+    env->regs[3] = v7m_pop(env);
+    env->regs[12] = v7m_pop(env);
+    env->regs[14] = v7m_pop(env);
+    env->regs[15] = v7m_pop(env);
+    xpsr = v7m_pop(env);
+    xpsr_write(env, xpsr, 0xfffffdff);
+    /* Undo stack alignment.  */
+    if (xpsr & 0x200)
+        env->regs[13] |= 4;
+    /* ??? The exception return type specifies Thread/Handler mode.  However
+       this is also implied by the xPSR value. Not sure what to do
+       if there is a mismatch.  */
+    /* ??? Likewise for mismatches between the CONTROL register and the stack
+       pointer.  */
+}
+
+void do_interrupt_v7m(CPUARMState *env)
+{
+    uint32_t xpsr = xpsr_read(env);
+    uint32_t lr;
+    uint32_t addr;
+
+    lr = 0xfffffff1;
+    if (env->v7m.current_sp)
+        lr |= 4;
+    if (env->v7m.exception == 0)
+        lr |= 8;
+
+    /* For exceptions we just mark as pending on the NVIC, and let that
+       handle it.  */
+    /* TODO: Need to escalate if the current priority is higher than the
+       one we're raising.  */
+    switch (env->exception_index) {
+    case EXCP_UDEF:
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_USAGE);
+        return;
+    case EXCP_SWI:
+        env->regs[15] += 2;
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_SVC);
+        return;
+    case EXCP_PREFETCH_ABORT:
+    case EXCP_DATA_ABORT:
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_MEM);
+        return;
+    case EXCP_BKPT:
+        if (semihosting_enabled) {
+            int nr;
+            nr = lduw_code(env->regs[15]) & 0xff;
+            if (nr == 0xab) {
+                env->regs[15] += 2;
+                env->regs[0] = do_arm_semihosting(env);
+                return;
+            }
+        }
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_DEBUG);
+        return;
+    case EXCP_IRQ:
+        env->v7m.exception = armv7m_nvic_acknowledge_irq(env->v7m.nvic);
+        break;
+    case EXCP_EXCEPTION_EXIT:
+        do_v7m_exception_exit(env);
+        return;
+    default:
+        cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
+        return; /* Never happens.  Keep compiler happy.  */
+    }
+
+    /* Align stack pointer.  */
+    /* ??? Should only do this if Configuration Control Register
+       STACKALIGN bit is set.  */
+    if (env->regs[13] & 4) {
+        env->regs[13] += 4;
+        xpsr |= 0x200;
+    }
+    /* Switch to the hander mode.  */
+    v7m_push(env, xpsr);
+    v7m_push(env, env->regs[15]);
+    v7m_push(env, env->regs[14]);
+    v7m_push(env, env->regs[12]);
+    v7m_push(env, env->regs[3]);
+    v7m_push(env, env->regs[2]);
+    v7m_push(env, env->regs[1]);
+    v7m_push(env, env->regs[0]);
+    switch_v7m_sp(env, 0);
+    env->uncached_cpsr &= ~CPSR_IT;
+    env->regs[14] = lr;
+    addr = ldl_phys(env->v7m.vecbase + env->v7m.exception * 4);
+    env->regs[15] = addr & 0xfffffffe;
+    env->thumb = addr & 1;
+}
+
 /* Handle a CPU exception.  */
 void do_interrupt(CPUARMState *env)
 {
@@ -280,6 +657,10 @@ void do_interrupt(CPUARMState *env)
     int new_mode;
     uint32_t offset;
 
+    if (IS_M(env)) {
+        do_interrupt_v7m(env);
+        return;
+    }
     /* TODO: Vectored interrupt controller.  */
     switch (env->exception_index) {
     case EXCP_UDEF:
@@ -314,8 +695,19 @@ void do_interrupt(CPUARMState *env)
         /* The PC already points to the next instructon.  */
         offset = 0;
         break;
-    case EXCP_PREFETCH_ABORT:
     case EXCP_BKPT:
+        /* See if this is a semihosting syscall.  */
+        if (env->thumb && semihosting_enabled) {
+            mask = lduw_code(env->regs[15]) & 0xff;
+            if (mask == 0xab
+                  && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
+                env->regs[15] += 2;
+                env->regs[0] = do_arm_semihosting(env);
+                return;
+            }
+        }
+        /* Fall through to prefetch abort.  */
+    case EXCP_PREFETCH_ABORT:
         new_mode = ARM_CPU_MODE_ABT;
         addr = 0x0c;
         mask = CPSR_A | CPSR_I;
@@ -351,6 +743,8 @@ void do_interrupt(CPUARMState *env)
     }
     switch_mode (env, new_mode);
     env->spsr = cpsr_read(env);
+    /* Clear IT bits.  */
+    env->condexec_bits = 0;
     /* Switch to the new mode, and switch to Arm mode.  */
     /* ??? Thumb interrupt handlers not implemented.  */
     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
@@ -367,9 +761,16 @@ void do_interrupt(CPUARMState *env)
 static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
                            int is_user)
 {
+  int prot_ro;
+
   if (domain == 3)
     return PAGE_READ | PAGE_WRITE;
 
+  if (access_type == 1)
+      prot_ro = 0;
+  else
+      prot_ro = PAGE_READ;
+
   switch (ap) {
   case 0:
       if (access_type == 1)
@@ -386,18 +787,24 @@ static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
       return is_user ? 0 : PAGE_READ | PAGE_WRITE;
   case 2:
       if (is_user)
-          return (access_type == 1) ? 0 : PAGE_READ;
+          return prot_ro;
       else
           return PAGE_READ | PAGE_WRITE;
   case 3:
       return PAGE_READ | PAGE_WRITE;
+  case 4: case 7: /* Reserved.  */
+      return 0;
+  case 5:
+      return is_user ? 0 : prot_ro;
+  case 6:
+      return prot_ro;
   default:
       abort();
   }
 }
 
-static int get_phys_addr(CPUState *env, uint32_t address, int access_type,
-                         int is_user, uint32_t *phys_ptr, int *prot)
+static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
+			    int is_user, uint32_t *phys_ptr, int *prot)
 {
     int code;
     uint32_t table;
@@ -407,158 +814,273 @@ static int get_phys_addr(CPUState *env, uint32_t address, int access_type,
     int domain;
     uint32_t phys_addr;
 
-    /* Fast Context Switch Extension.  */
-    if (address < 0x02000000)
-        address += env->cp15.c13_fcse;
-
-    if ((env->cp15.c1_sys & 1) == 0) {
-        /* MMU/MPU disabled.  */
-        *phys_ptr = address;
-        *prot = PAGE_READ | PAGE_WRITE;
-    } else if (arm_feature(env, ARM_FEATURE_MPU)) {
-        int n;
-        uint32_t mask;
-        uint32_t base;
-
-        *phys_ptr = address;
-        for (n = 7; n >= 0; n--) {
-            base = env->cp15.c6_region[n];
-            if ((base & 1) == 0)
-                continue;
-            mask = 1 << ((base >> 1) & 0x1f);
-            /* Keep this shift separate from the above to avoid an
-               (undefined) << 32.  */
-            mask = (mask << 1) - 1;
-            if (((base ^ address) & ~mask) == 0)
-                break;
-        }
-        if (n < 0)
-            return 2;
-
-        if (access_type == 2) {
-            mask = env->cp15.c5_insn;
-        } else {
-            mask = env->cp15.c5_data;
-        }
-        mask = (mask >> (n * 4)) & 0xf;
-        switch (mask) {
-        case 0:
-            return 1;
-        case 1:
-            if (is_user)
-              return 1;
-            *prot = PAGE_READ | PAGE_WRITE;
-            break;
-        case 2:
-            *prot = PAGE_READ;
-            if (!is_user)
-                *prot |= PAGE_WRITE;
-            break;
-        case 3:
-            *prot = PAGE_READ | PAGE_WRITE;
+    /* Pagetable walk.  */
+    /* Lookup l1 descriptor.  */
+    if (address & env->cp15.c2_mask)
+        table = env->cp15.c2_base1;
+    else
+        table = env->cp15.c2_base0;
+    table = (table & 0xffffc000) | ((address >> 18) & 0x3ffc);
+    desc = ldl_phys(table);
+    type = (desc & 3);
+    domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
+    if (type == 0) {
+        /* Secton translation fault.  */
+        code = 5;
+        goto do_fault;
+    }
+    if (domain == 0 || domain == 2) {
+        if (type == 2)
+            code = 9; /* Section domain fault.  */
+        else
+            code = 11; /* Page domain fault.  */
+        goto do_fault;
+    }
+    if (type == 2) {
+        /* 1Mb section.  */
+        phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
+        ap = (desc >> 10) & 3;
+        code = 13;
+    } else {
+        /* Lookup l2 entry.  */
+	if (type == 1) {
+	    /* Coarse pagetable.  */
+	    table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
+	} else {
+	    /* Fine pagetable.  */
+	    table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
+	}
+        desc = ldl_phys(table);
+        switch (desc & 3) {
+        case 0: /* Page translation fault.  */
+            code = 7;
+            goto do_fault;
+        case 1: /* 64k page.  */
+            phys_addr = (desc & 0xffff0000) | (address & 0xffff);
+            ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
             break;
-        case 5:
-            if (is_user)
-                return 1;
-            *prot = PAGE_READ;
+        case 2: /* 4k page.  */
+            phys_addr = (desc & 0xfffff000) | (address & 0xfff);
+            ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
             break;
-        case 6:
-            *prot = PAGE_READ;
+        case 3: /* 1k page.  */
+	    if (type == 1) {
+		if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+		    phys_addr = (desc & 0xfffff000) | (address & 0xfff);
+		} else {
+		    /* Page translation fault.  */
+		    code = 7;
+		    goto do_fault;
+		}
+	    } else {
+		phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
+	    }
+            ap = (desc >> 4) & 3;
             break;
         default:
-            /* Bad permission.  */
-            return 1;
+            /* Never happens, but compiler isn't smart enough to tell.  */
+            abort();
         }
+        code = 15;
+    }
+    *prot = check_ap(env, ap, domain, access_type, is_user);
+    if (!*prot) {
+        /* Access permission fault.  */
+        goto do_fault;
+    }
+    *phys_ptr = phys_addr;
+    return 0;
+do_fault:
+    return code | (domain << 4);
+}
+
+static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
+			    int is_user, uint32_t *phys_ptr, int *prot)
+{
+    int code;
+    uint32_t table;
+    uint32_t desc;
+    uint32_t xn;
+    int type;
+    int ap;
+    int domain;
+    uint32_t phys_addr;
+
+    /* Pagetable walk.  */
+    /* Lookup l1 descriptor.  */
+    if (address & env->cp15.c2_mask)
+        table = env->cp15.c2_base1;
+    else
+        table = env->cp15.c2_base0;
+    table = (table & 0xffffc000) | ((address >> 18) & 0x3ffc);
+    desc = ldl_phys(table);
+    type = (desc & 3);
+    if (type == 0) {
+        /* Secton translation fault.  */
+        code = 5;
+        domain = 0;
+        goto do_fault;
+    } else if (type == 2 && (desc & (1 << 18))) {
+        /* Supersection.  */
+        domain = 0;
     } else {
-        /* Pagetable walk.  */
-        /* Lookup l1 descriptor.  */
-        table = (env->cp15.c2_base & 0xffffc000) | ((address >> 18) & 0x3ffc);
-        desc = ldl_phys(table);
-        type = (desc & 3);
-        domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
-        if (type == 0) {
-            /* Secton translation fault.  */
-            code = 5;
-            goto do_fault;
-        }
-        if (domain == 0 || domain == 2) {
-            if (type == 2)
-                code = 9; /* Section domain fault.  */
-            else
-                code = 11; /* Page domain fault.  */
-            goto do_fault;
-        }
-        if (type == 2) {
-            /* 1Mb section.  */
-            phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
-            ap = (desc >> 10) & 3;
-            code = 13;
+        /* Section or page.  */
+        domain = (desc >> 4) & 0x1e;
+    }
+    domain = (env->cp15.c3 >> domain) & 3;
+    if (domain == 0 || domain == 2) {
+        if (type == 2)
+            code = 9; /* Section domain fault.  */
+        else
+            code = 11; /* Page domain fault.  */
+        goto do_fault;
+    }
+    if (type == 2) {
+        if (desc & (1 << 18)) {
+            /* Supersection.  */
+            phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
         } else {
-            /* Lookup l2 entry.  */
-            if (type == 1) {
-                /* Coarse pagetable.  */
-                table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
-            } else {
-                /* Fine pagetable.  */
-                table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
-            }
-            desc = ldl_phys(table);
-            switch (desc & 3) {
-            case 0: /* Page translation fault.  */
-                code = 7;
-                goto do_fault;
-            case 1: /* 64k page.  */
-                phys_addr = (desc & 0xffff0000) | (address & 0xffff);
-                ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
-                break;
-            case 2: /* 4k page.  */
-                phys_addr = (desc & 0xfffff000) | (address & 0xfff);
-                ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
-                break;
-            case 3: /* 1k page.  */
-                if (type == 1) {
-                    if (arm_feature(env, ARM_FEATURE_XSCALE))
-                        phys_addr = (desc & 0xfffff000) | (address & 0xfff);
-                    else {
-                        /* Page translation fault.  */
-                        code = 7;
-                        goto do_fault;
-                    }
-                } else
-                    phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
-                ap = (desc >> 4) & 3;
-                break;
-            default:
-                /* Never happens, but compiler isn't smart enough to tell.  */
-                abort();
-            }
-            code = 15;
+            /* Section.  */
+            phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
         }
-        *prot = check_ap(env, ap, domain, access_type, is_user);
-        if (!*prot) {
-            /* Access permission fault.  */
+        ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
+        xn = desc & (1 << 4);
+        code = 13;
+    } else {
+        /* Lookup l2 entry.  */
+        table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
+        desc = ldl_phys(table);
+        ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
+        switch (desc & 3) {
+        case 0: /* Page translation fault.  */
+            code = 7;
             goto do_fault;
+        case 1: /* 64k page.  */
+            phys_addr = (desc & 0xffff0000) | (address & 0xffff);
+            xn = desc & (1 << 15);
+            break;
+        case 2: case 3: /* 4k page.  */
+            phys_addr = (desc & 0xfffff000) | (address & 0xfff);
+            xn = desc & 1;
+            break;
+        default:
+            /* Never happens, but compiler isn't smart enough to tell.  */
+            abort();
         }
-        *phys_ptr = phys_addr;
+        code = 15;
     }
+    if (xn && access_type == 2)
+        goto do_fault;
+
+    *prot = check_ap(env, ap, domain, access_type, is_user);
+    if (!*prot) {
+        /* Access permission fault.  */
+        goto do_fault;
+    }
+    *phys_ptr = phys_addr;
     return 0;
 do_fault:
     return code | (domain << 4);
 }
 
+static int get_phys_addr_mpu(CPUState *env, uint32_t address, int access_type,
+			     int is_user, uint32_t *phys_ptr, int *prot)
+{
+    int n;
+    uint32_t mask;
+    uint32_t base;
+
+    *phys_ptr = address;
+    for (n = 7; n >= 0; n--) {
+	base = env->cp15.c6_region[n];
+	if ((base & 1) == 0)
+	    continue;
+	mask = 1 << ((base >> 1) & 0x1f);
+	/* Keep this shift separate from the above to avoid an
+	   (undefined) << 32.  */
+	mask = (mask << 1) - 1;
+	if (((base ^ address) & ~mask) == 0)
+	    break;
+    }
+    if (n < 0)
+	return 2;
+
+    if (access_type == 2) {
+	mask = env->cp15.c5_insn;
+    } else {
+	mask = env->cp15.c5_data;
+    }
+    mask = (mask >> (n * 4)) & 0xf;
+    switch (mask) {
+    case 0:
+	return 1;
+    case 1:
+	if (is_user)
+	  return 1;
+	*prot = PAGE_READ | PAGE_WRITE;
+	break;
+    case 2:
+	*prot = PAGE_READ;
+	if (!is_user)
+	    *prot |= PAGE_WRITE;
+	break;
+    case 3:
+	*prot = PAGE_READ | PAGE_WRITE;
+	break;
+    case 5:
+	if (is_user)
+	    return 1;
+	*prot = PAGE_READ;
+	break;
+    case 6:
+	*prot = PAGE_READ;
+	break;
+    default:
+	/* Bad permission.  */
+	return 1;
+    }
+    return 0;
+}
+
+static inline int get_phys_addr(CPUState *env, uint32_t address,
+                                int access_type, int is_user,
+                                uint32_t *phys_ptr, int *prot)
+{
+    /* Fast Context Switch Extension.  */
+    if (address < 0x02000000)
+        address += env->cp15.c13_fcse;
+
+    if ((env->cp15.c1_sys & 1) == 0) {
+        /* MMU/MPU disabled.  */
+        *phys_ptr = address;
+        *prot = PAGE_READ | PAGE_WRITE;
+        return 0;
+    } else if (arm_feature(env, ARM_FEATURE_MPU)) {
+	return get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,
+				 prot);
+    } else if (env->cp15.c1_sys & (1 << 23)) {
+        return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,
+                                prot);
+    } else {
+        return get_phys_addr_v5(env, address, access_type, is_user, phys_ptr,
+                                prot);
+    }
+}
+
 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
-                              int access_type, int is_user, int is_softmmu)
+                              int access_type, int mmu_idx, int is_softmmu)
 {
     uint32_t phys_addr;
     int prot;
-    int ret;
+    int ret, is_user;
 
+    is_user = mmu_idx == MMU_USER_IDX;
     ret = get_phys_addr(env, address, access_type, is_user, &phys_addr, &prot);
     if (ret == 0) {
         /* Map a single [sub]page.  */
         phys_addr &= ~(uint32_t)0x3ff;
         address &= ~(uint32_t)0x3ff;
-        return tlb_set_page (env, address, phys_addr, prot, is_user,
+        return tlb_set_page (env, address, phys_addr, prot, mmu_idx,
                              is_softmmu);
     }
 
@@ -568,6 +1090,8 @@ int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
         env->exception_index = EXCP_PREFETCH_ABORT;
     } else {
         env->cp15.c5_data = ret;
+        if (access_type == 1 && arm_feature(env, ARM_FEATURE_V6))
+            env->cp15.c5_data |= (1 << 11);
         env->cp15.c6_data = address;
         env->exception_index = EXCP_DATA_ABORT;
     }
@@ -588,6 +1112,24 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
     return phys_addr;
 }
 
+/* Not really implemented.  Need to figure out a sane way of doing this.
+   Maybe add generic watchpoint support and use that.  */
+
+void helper_mark_exclusive(CPUState *env, uint32_t addr)
+{
+    env->mmon_addr = addr;
+}
+
+int helper_test_exclusive(CPUState *env, uint32_t addr)
+{
+    return (env->mmon_addr != addr);
+}
+
+void helper_clrex(CPUState *env)
+{
+    env->mmon_addr = -1;
+}
+
 void helper_set_cp(CPUState *env, uint32_t insn, uint32_t val)
 {
     int cp_num = (insn >> 8) & 0xf;
@@ -645,13 +1187,20 @@ static uint32_t extended_mpu_ap_bits(uint32_t val)
 
 void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
 {
-    uint32_t op2;
-    uint32_t crm;
+    int op1;
+    int op2;
+    int crm;
 
+    op1 = (insn >> 21) & 7;
     op2 = (insn >> 5) & 7;
     crm = insn & 0xf;
     switch ((insn >> 16) & 0xf) {
-    case 0: /* ID codes.  */
+    case 0:
+        if (((insn >> 21) & 7) == 2) {
+            /* ??? Select cache level.  Ignore.  */
+            return;
+        }
+        /* ID codes.  */
         if (arm_feature(env, ARM_FEATURE_XSCALE))
             break;
         if (arm_feature(env, ARM_FEATURE_OMAPCP))
@@ -668,12 +1217,13 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
             /* This may enable/disable the MMU, so do a TLB flush.  */
             tlb_flush(env, 1);
             break;
-        case 1:
+        case 1: /* Auxiliary cotrol register.  */
             if (arm_feature(env, ARM_FEATURE_XSCALE)) {
                 env->cp15.c1_xscaleauxcr = val;
                 break;
             }
-            goto bad_reg;
+            /* Not implemented.  */
+            break;
         case 2:
             if (arm_feature(env, ARM_FEATURE_XSCALE))
                 goto bad_reg;
@@ -698,11 +1248,24 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
                 goto bad_reg;
             }
         } else {
-            env->cp15.c2_base = val;
+	    switch (op2) {
+	    case 0:
+		env->cp15.c2_base0 = val;
+		break;
+	    case 1:
+		env->cp15.c2_base1 = val;
+		break;
+	    case 2:
+		env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> val);
+		break;
+	    default:
+		goto bad_reg;
+	    }
         }
         break;
     case 3: /* MMU Domain access control / MPU write buffer control.  */
         env->cp15.c3 = val;
+        tlb_flush(env, 1); /* Flush TLB as domain not tracked in TLB */
         break;
     case 4: /* Reserved.  */
         goto bad_reg;
@@ -746,7 +1309,8 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
             case 0:
                 env->cp15.c6_data = val;
                 break;
-            case 1:
+            case 1: /* ??? This is WFAR on armv6 */
+            case 2:
                 env->cp15.c6_insn = val;
                 break;
             default:
@@ -758,6 +1322,7 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
         env->cp15.c15_i_max = 0x000;
         env->cp15.c15_i_min = 0xff0;
         /* No cache, so nothing to do.  */
+        /* ??? MPCore has VA to PA translation functions.  */
         break;
     case 8: /* MMU TLB control.  */
         switch (op2) {
@@ -778,6 +1343,13 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
             tlb_flush(env, 1);
 #endif
             break;
+        case 2: /* Invalidate on ASID.  */
+            tlb_flush(env, val == 0);
+            break;
+        case 3: /* Invalidate single entry on MVA.  */
+            /* ??? This is like case 1, but ignores ASID.  */
+            tlb_flush(env, 1);
+            break;
         default:
             goto bad_reg;
         }
@@ -787,17 +1359,26 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
             break;
         switch (crm) {
         case 0: /* Cache lockdown.  */
-            switch (op2) {
-            case 0:
-                env->cp15.c9_data = val;
-                break;
-            case 1:
-                env->cp15.c9_insn = val;
-                break;
-            default:
-                goto bad_reg;
-            }
-            break;
+	    switch (op1) {
+	    case 0: /* L1 cache.  */
+		switch (op2) {
+		case 0:
+		    env->cp15.c9_data = val;
+		    break;
+		case 1:
+		    env->cp15.c9_insn = val;
+		    break;
+		default:
+		    goto bad_reg;
+		}
+		break;
+	    case 1: /* L2 cache.  */
+		/* Ignore writes to L2 lockdown/auxiliary registers.  */
+		break;
+	    default:
+		goto bad_reg;
+	    }
+	    break;
         case 1: /* TCM memory region registers.  */
             /* Not implemented.  */
             goto bad_reg;
@@ -813,8 +1394,6 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
     case 13: /* Process ID.  */
         switch (op2) {
         case 0:
-            if (!arm_feature(env, ARM_FEATURE_MPU))
-                goto bad_reg;
             /* Unlike real hardware the qemu TLB uses virtual addresses,
                not modified virtual addresses, so this causes a TLB flush.
              */
@@ -829,6 +1408,15 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
               tlb_flush(env, 0);
             env->cp15.c13_context = val;
             break;
+        case 2:
+            env->cp15.c13_tls1 = val;
+            break;
+        case 3:
+            env->cp15.c13_tls2 = val;
+            break;
+        case 4:
+            env->cp15.c13_tls3 = val;
+            break;
         default:
             goto bad_reg;
         }
@@ -877,27 +1465,64 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
     return;
 bad_reg:
     /* ??? For debugging only.  Should raise illegal instruction exception.  */
-    cpu_abort(env, "Unimplemented cp15 register write\n");
+    cpu_abort(env, "Unimplemented cp15 register write (c%d, c%d, {%d, %d})\n",
+              (insn >> 16) & 0xf, crm, op1, op2);
 }
 
 uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
 {
-    uint32_t op2;
-    uint32_t crm;
+    int op1;
+    int op2;
+    int crm;
 
+    op1 = (insn >> 21) & 7;
     op2 = (insn >> 5) & 7;
     crm = insn & 0xf;
     switch ((insn >> 16) & 0xf) {
     case 0: /* ID codes.  */
-        switch (op2) {
-        default: /* Device ID.  */
-            return env->cp15.c0_cpuid;
-        case 1: /* Cache Type.  */
-            return env->cp15.c0_cachetype;
-        case 2: /* TCM status.  */
+        switch (op1) {
+        case 0:
+            switch (crm) {
+            case 0:
+                switch (op2) {
+                case 0: /* Device ID.  */
+                    return env->cp15.c0_cpuid;
+                case 1: /* Cache Type.  */
+		    return env->cp15.c0_cachetype;
+                case 2: /* TCM status.  */
+                    return 0;
+                case 3: /* TLB type register.  */
+                    return 0; /* No lockable TLB entries.  */
+                case 5: /* CPU ID */
+                    return env->cpu_index;
+                default:
+                    goto bad_reg;
+                }
+            case 1:
+                if (!arm_feature(env, ARM_FEATURE_V6))
+                    goto bad_reg;
+                return env->cp15.c0_c1[op2];
+            case 2:
+                if (!arm_feature(env, ARM_FEATURE_V6))
+                    goto bad_reg;
+                return env->cp15.c0_c2[op2];
+            case 3: case 4: case 5: case 6: case 7:
+                return 0;
+            default:
+                goto bad_reg;
+            }
+        case 1:
+            /* These registers aren't documented on arm11 cores.  However
+               Linux looks at them anyway.  */
+            if (!arm_feature(env, ARM_FEATURE_V6))
+                goto bad_reg;
+            if (crm != 0)
+                goto bad_reg;
             if (arm_feature(env, ARM_FEATURE_XSCALE))
                 goto bad_reg;
             return 0;
+        default:
+            goto bad_reg;
         }
     case 1: /* System configuration.  */
         if (arm_feature(env, ARM_FEATURE_OMAPCP))
@@ -906,11 +1531,22 @@ uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
         case 0: /* Control register.  */
             return env->cp15.c1_sys;
         case 1: /* Auxiliary control register.  */
-            if (arm_feature(env, ARM_FEATURE_AUXCR))
-                return 1;
             if (arm_feature(env, ARM_FEATURE_XSCALE))
                 return env->cp15.c1_xscaleauxcr;
-            goto bad_reg;
+            if (!arm_feature(env, ARM_FEATURE_AUXCR))
+                goto bad_reg;
+            switch (ARM_CPUID(env)) {
+            case ARM_CPUID_ARM1026:
+                return 1;
+            case ARM_CPUID_ARM1136:
+                return 7;
+            case ARM_CPUID_ARM11MPCORE:
+                return 1;
+            case ARM_CPUID_CORTEXA8:
+                return 0;
+            default:
+                goto bad_reg;
+            }
         case 2: /* Coprocessor access register.  */
             if (arm_feature(env, ARM_FEATURE_XSCALE))
                 goto bad_reg;
@@ -931,8 +1567,27 @@ uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
                 goto bad_reg;
             }
         } else {
-            return env->cp15.c2_base;
-        }
+	    switch (op2) {
+	    case 0:
+		return env->cp15.c2_base0;
+	    case 1:
+		return env->cp15.c2_base1;
+	    case 2:
+		{
+		    int n;
+		    uint32_t mask;
+		    n = 0;
+		    mask = env->cp15.c2_mask;
+		    while (mask) {
+			n++;
+			mask <<= 1;
+		    }
+		    return n;
+		}
+	    default:
+		goto bad_reg;
+	    }
+	}
     case 3: /* MMU Domain access control / MPU write buffer control.  */
         return env->cp15.c3;
     case 4: /* Reserved.  */
@@ -960,26 +1615,37 @@ uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
         default:
             goto bad_reg;
         }
-    case 6: /* MMU Fault address / MPU base/size.  */
+    case 6: /* MMU Fault address.  */
         if (arm_feature(env, ARM_FEATURE_MPU)) {
-            int n;
-            n = (insn & 0xf);
-            if (n >= 8)
+            if (crm >= 8)
                 goto bad_reg;
-            return env->cp15.c6_region[n];
+            return env->cp15.c6_region[crm];
         } else {
             if (arm_feature(env, ARM_FEATURE_OMAPCP))
                 op2 = 0;
-            switch (op2) {
-            case 0:
-                return env->cp15.c6_data;
-            case 1:
-                /* Arm9 doesn't have an IFAR, but implementing it anyway
-                   shouldn't do any harm.  */
-                return env->cp15.c6_insn;
-            default:
-                goto bad_reg;
-            }
+	    switch (op2) {
+	    case 0:
+		return env->cp15.c6_data;
+	    case 1:
+		if (arm_feature(env, ARM_FEATURE_V6)) {
+		    /* Watchpoint Fault Adrress.  */
+		    return 0; /* Not implemented.  */
+		} else {
+		    /* Instruction Fault Adrress.  */
+		    /* Arm9 doesn't have an IFAR, but implementing it anyway
+		       shouldn't do any harm.  */
+		    return env->cp15.c6_insn;
+		}
+	    case 2:
+		if (arm_feature(env, ARM_FEATURE_V6)) {
+		    /* Instruction Fault Adrress.  */
+		    return env->cp15.c6_insn;
+		} else {
+		    goto bad_reg;
+		}
+	    default:
+		goto bad_reg;
+	    }
         }
     case 7: /* Cache control.  */
         /* ??? This is for test, clean and invaidate operations that set the
@@ -990,13 +1656,23 @@ uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
     case 8: /* MMU TLB control.  */
         goto bad_reg;
     case 9: /* Cache lockdown.  */
-        if (arm_feature(env, ARM_FEATURE_OMAPCP))
+        switch (op1) {
+        case 0: /* L1 cache.  */
+	    if (arm_feature(env, ARM_FEATURE_OMAPCP))
+		return 0;
+            switch (op2) {
+            case 0:
+                return env->cp15.c9_data;
+            case 1:
+                return env->cp15.c9_insn;
+            default:
+                goto bad_reg;
+            }
+        case 1: /* L2 cache */
+            if (crm != 0)
+                goto bad_reg;
+            /* L2 Lockdown and Auxiliary control.  */
             return 0;
-        switch (op2) {
-        case 0:
-            return env->cp15.c9_data;
-        case 1:
-            return env->cp15.c9_insn;
         default:
             goto bad_reg;
         }
@@ -1012,6 +1688,12 @@ uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
             return env->cp15.c13_fcse;
         case 1:
             return env->cp15.c13_context;
+        case 2:
+            return env->cp15.c13_tls1;
+        case 3:
+            return env->cp15.c13_tls2;
+        case 4:
+            return env->cp15.c13_tls3;
         default:
             goto bad_reg;
         }
@@ -1045,10 +1727,125 @@ uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
     }
 bad_reg:
     /* ??? For debugging only.  Should raise illegal instruction exception.  */
-    cpu_abort(env, "Unimplemented cp15 register read\n");
+    cpu_abort(env, "Unimplemented cp15 register read (c%d, c%d, {%d, %d})\n",
+              (insn >> 16) & 0xf, crm, op1, op2);
     return 0;
 }
 
+void helper_set_r13_banked(CPUState *env, int mode, uint32_t val)
+{
+    env->banked_r13[bank_number(mode)] = val;
+}
+
+uint32_t helper_get_r13_banked(CPUState *env, int mode)
+{
+    return env->banked_r13[bank_number(mode)];
+}
+
+uint32_t helper_v7m_mrs(CPUState *env, int reg)
+{
+    switch (reg) {
+    case 0: /* APSR */
+        return xpsr_read(env) & 0xf8000000;
+    case 1: /* IAPSR */
+        return xpsr_read(env) & 0xf80001ff;
+    case 2: /* EAPSR */
+        return xpsr_read(env) & 0xff00fc00;
+    case 3: /* xPSR */
+        return xpsr_read(env) & 0xff00fdff;
+    case 5: /* IPSR */
+        return xpsr_read(env) & 0x000001ff;
+    case 6: /* EPSR */
+        return xpsr_read(env) & 0x0700fc00;
+    case 7: /* IEPSR */
+        return xpsr_read(env) & 0x0700edff;
+    case 8: /* MSP */
+        return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
+    case 9: /* PSP */
+        return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
+    case 16: /* PRIMASK */
+        return (env->uncached_cpsr & CPSR_I) != 0;
+    case 17: /* FAULTMASK */
+        return (env->uncached_cpsr & CPSR_F) != 0;
+    case 18: /* BASEPRI */
+    case 19: /* BASEPRI_MAX */
+        return env->v7m.basepri;
+    case 20: /* CONTROL */
+        return env->v7m.control;
+    default:
+        /* ??? For debugging only.  */
+        cpu_abort(env, "Unimplemented system register read (%d)\n", reg);
+        return 0;
+    }
+}
+
+void helper_v7m_msr(CPUState *env, int reg, uint32_t val)
+{
+    switch (reg) {
+    case 0: /* APSR */
+        xpsr_write(env, val, 0xf8000000);
+        break;
+    case 1: /* IAPSR */
+        xpsr_write(env, val, 0xf8000000);
+        break;
+    case 2: /* EAPSR */
+        xpsr_write(env, val, 0xfe00fc00);
+        break;
+    case 3: /* xPSR */
+        xpsr_write(env, val, 0xfe00fc00);
+        break;
+    case 5: /* IPSR */
+        /* IPSR bits are readonly.  */
+        break;
+    case 6: /* EPSR */
+        xpsr_write(env, val, 0x0600fc00);
+        break;
+    case 7: /* IEPSR */
+        xpsr_write(env, val, 0x0600fc00);
+        break;
+    case 8: /* MSP */
+        if (env->v7m.current_sp)
+            env->v7m.other_sp = val;
+        else
+            env->regs[13] = val;
+        break;
+    case 9: /* PSP */
+        if (env->v7m.current_sp)
+            env->regs[13] = val;
+        else
+            env->v7m.other_sp = val;
+        break;
+    case 16: /* PRIMASK */
+        if (val & 1)
+            env->uncached_cpsr |= CPSR_I;
+        else
+            env->uncached_cpsr &= ~CPSR_I;
+        break;
+    case 17: /* FAULTMASK */
+        if (val & 1)
+            env->uncached_cpsr |= CPSR_F;
+        else
+            env->uncached_cpsr &= ~CPSR_F;
+        break;
+    case 18: /* BASEPRI */
+        env->v7m.basepri = val & 0xff;
+        break;
+    case 19: /* BASEPRI_MAX */
+        val &= 0xff;
+        if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
+            env->v7m.basepri = val;
+        break;
+    case 20: /* CONTROL */
+        env->v7m.control = val & 3;
+        switch_v7m_sp(env, (val & 2) != 0);
+        break;
+    default:
+        /* ??? For debugging only.  */
+        cpu_abort(env, "Unimplemented system register write (%d)\n", reg);
+        return;
+    }
+}
+
 void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
                 ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
                 void *opaque)
diff --git a/target-arm/nwfpe/double_cpdo.c b/target-arm/nwfpe/double_cpdo.c
index dbd496ea6..b5320c82a 100644
--- a/target-arm/nwfpe/double_cpdo.c
+++ b/target-arm/nwfpe/double_cpdo.c
@@ -38,7 +38,7 @@ float64 float64_pol(float64 rFn,float64 rFm);
 unsigned int DoubleCPDO(const unsigned int opcode)
 {
    FPA11 *fpa11 = GET_FPA11();
-   float64 rFm, rFn = 0;
+   float64 rFm, rFn = float64_zero;
    unsigned int Fd, Fm, Fn, nRc = 1;
 
    //printk("DoubleCPDO(0x%08x)\n",opcode);
diff --git a/target-arm/nwfpe/fpa11_cpdt.c b/target-arm/nwfpe/fpa11_cpdt.c
index cae2922e0..41877dfe8 100644
--- a/target-arm/nwfpe/fpa11_cpdt.c
+++ b/target-arm/nwfpe/fpa11_cpdt.c
@@ -34,7 +34,8 @@ void loadSingle(const unsigned int Fn,const unsigned int *pMem)
    target_ulong addr = (target_ulong)(long)pMem;
    FPA11 *fpa11 = GET_FPA11();
    fpa11->fType[Fn] = typeSingle;
-   fpa11->fpreg[Fn].fSingle = tget32(addr);
+   /* FIXME - handle failure of get_user() */
+   get_user_u32(fpa11->fpreg[Fn].fSingle, addr);
 }
 
 static inline
@@ -46,11 +47,13 @@ void loadDouble(const unsigned int Fn,const unsigned int *pMem)
    p = (unsigned int*)&fpa11->fpreg[Fn].fDouble;
    fpa11->fType[Fn] = typeDouble;
 #ifdef WORDS_BIGENDIAN
-   p[0] = tget32(addr); /* sign & exponent */
-   p[1] = tget32(addr + 4);
+   /* FIXME - handle failure of get_user() */
+   get_user_u32(p[0], addr); /* sign & exponent */
+   get_user_u32(p[1], addr + 4);
 #else
-   p[0] = tget32(addr + 4);
-   p[1] = tget32(addr); /* sign & exponent */
+   /* FIXME - handle failure of get_user() */
+   get_user_u32(p[0], addr + 4);
+   get_user_u32(p[1], addr); /* sign & exponent */
 #endif
 }
 
@@ -62,9 +65,10 @@ void loadExtended(const unsigned int Fn,const unsigned int *pMem)
    unsigned int *p;
    p = (unsigned int*)&fpa11->fpreg[Fn].fExtended;
    fpa11->fType[Fn] = typeExtended;
-   p[0] = tget32(addr);  /* sign & exponent */
-   p[1] = tget32(addr + 8);  /* ls bits */
-   p[2] = tget32(addr + 4);  /* ms bits */
+   /* FIXME - handle failure of get_user() */
+   get_user_u32(p[0], addr);  /* sign & exponent */
+   get_user_u32(p[1], addr + 8);  /* ls bits */
+   get_user_u32(p[2], addr + 4);  /* ms bits */
 }
 
 static inline
@@ -76,7 +80,8 @@ void loadMultiple(const unsigned int Fn,const unsigned int *pMem)
    unsigned long x;
 
    p = (unsigned int*)&(fpa11->fpreg[Fn]);
-   x = tget32(addr);
+   /* FIXME - handle failure of get_user() */
+   get_user_u32(x, addr);
    fpa11->fType[Fn] = (x >> 14) & 0x00000003;
 
    switch (fpa11->fType[Fn])
@@ -84,16 +89,18 @@ void loadMultiple(const unsigned int Fn,const unsigned int *pMem)
       case typeSingle:
       case typeDouble:
       {
-         p[0] = tget32(addr + 8);  /* Single */
-         p[1] = tget32(addr + 4);  /* double msw */
+         /* FIXME - handle failure of get_user() */
+         get_user_u32(p[0], addr + 8);  /* Single */
+         get_user_u32(p[1], addr + 4);  /* double msw */
          p[2] = 0;        /* empty */
       }
       break;
 
       case typeExtended:
       {
-         p[1] = tget32(addr + 8);
-         p[2] = tget32(addr + 4);  /* msw */
+         /* FIXME - handle failure of get_user() */
+         get_user_u32(p[1], addr + 8);
+         get_user_u32(p[2], addr + 4);  /* msw */
          p[0] = (x & 0x80003fff);
       }
       break;
@@ -121,7 +128,8 @@ void storeSingle(const unsigned int Fn,unsigned int *pMem)
       default: val = fpa11->fpreg[Fn].fSingle;
    }
 
-   tput32(addr, p[0]);
+   /* FIXME - handle put_user() failures */
+   put_user_u32(p[0], addr);
 }
 
 static inline
@@ -144,12 +152,13 @@ void storeDouble(const unsigned int Fn,unsigned int *pMem)
 
       default: val = fpa11->fpreg[Fn].fDouble;
    }
+   /* FIXME - handle put_user() failures */
 #ifdef WORDS_BIGENDIAN
-   tput32(addr, p[0]);	/* msw */
-   tput32(addr + 4, p[1]);	/* lsw */
+   put_user_u32(p[0], addr);	/* msw */
+   put_user_u32(p[1], addr + 4);	/* lsw */
 #else
-   tput32(addr, p[1]);	/* msw */
-   tput32(addr + 4, p[0]);	/* lsw */
+   put_user_u32(p[1], addr);	/* msw */
+   put_user_u32(p[0], addr + 4);	/* lsw */
 #endif
 }
 
@@ -174,9 +183,10 @@ void storeExtended(const unsigned int Fn,unsigned int *pMem)
       default: val = fpa11->fpreg[Fn].fExtended;
    }
 
-   tput32(addr, p[0]); /* sign & exp */
-   tput32(addr + 8, p[1]);
-   tput32(addr + 4, p[2]); /* msw */
+   /* FIXME - handle put_user() failures */
+   put_user_u32(p[0], addr); /* sign & exp */
+   put_user_u32(p[1], addr + 8);
+   put_user_u32(p[2], addr + 4); /* msw */
 }
 
 static inline
@@ -194,17 +204,17 @@ void storeMultiple(const unsigned int Fn,unsigned int *pMem)
       case typeSingle:
       case typeDouble:
       {
-	 tput32(addr + 8, p[0]); /* single */
-	 tput32(addr + 4, p[1]); /* double msw */
-	 tput32(addr, nType << 14);
+         put_user_u32(p[0], addr + 8); /* single */
+	 put_user_u32(p[1], addr + 4); /* double msw */
+	 put_user_u32(nType << 14, addr);
       }
       break;
 
       case typeExtended:
       {
-	 tput32(addr + 4, p[2]); /* msw */
-	 tput32(addr + 8, p[1]);
-	 tput32(addr, (p[0] & 0x80003fff) | (nType << 14));
+         put_user_u32(p[2], addr + 4); /* msw */
+	 put_user_u32(p[1], addr + 8);
+	 put_user_u32((p[0] & 0x80003fff) | (nType << 14), addr);
       }
       break;
    }
diff --git a/target-arm/nwfpe/single_cpdo.c b/target-arm/nwfpe/single_cpdo.c
index 1482f4712..65043bcb3 100644
--- a/target-arm/nwfpe/single_cpdo.c
+++ b/target-arm/nwfpe/single_cpdo.c
@@ -38,7 +38,7 @@ float32 float32_pol(float32 rFn,float32 rFm);
 unsigned int SingleCPDO(const unsigned int opcode)
 {
    FPA11 *fpa11 = GET_FPA11();
-   float32 rFm, rFn = 0;
+   float32 rFm, rFn = float32_zero;
    unsigned int Fd, Fm, Fn, nRc = 1;
 
    Fm = getFm(opcode);
@@ -128,13 +128,11 @@ unsigned int SingleCPDO(const unsigned int opcode)
       break;
 
       case MNF_CODE:
-         rFm ^= 0x80000000;
-         fpa11->fpreg[Fd].fSingle = rFm;
+         fpa11->fpreg[Fd].fSingle = float32_chs(rFm);
       break;
 
       case ABS_CODE:
-         rFm &= 0x7fffffff;
-         fpa11->fpreg[Fd].fSingle = rFm;
+         fpa11->fpreg[Fd].fSingle = float32_abs(rFm);
       break;
 
       case RND_CODE:
diff --git a/target-arm/op.c b/target-arm/op.c
index e8a536c1a..216944af5 100644
--- a/target-arm/op.c
+++ b/target-arm/op.c
@@ -2,7 +2,7 @@
  *  ARM micro operations
  *
  *  Copyright (c) 2003 Fabrice Bellard
- *  Copyright (c) 2005 CodeSourcery, LLC
+ *  Copyright (c) 2005-2007 CodeSourcery, LLC
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -101,11 +101,6 @@ void OPPROTO op_movl_T0_im(void)
     T0 = PARAM1;
 }
 
-void OPPROTO op_movl_T0_T1(void)
-{
-    T0 = T1;
-}
-
 void OPPROTO op_movl_T1_im(void)
 {
     T1 = PARAM1;
@@ -236,6 +231,11 @@ void OPPROTO op_bicl_T0_T1(void)
     T0 &= ~T1;
 }
 
+void OPPROTO op_notl_T0(void)
+{
+    T0 = ~T0;
+}
+
 void OPPROTO op_notl_T1(void)
 {
     T1 = ~T1;
@@ -351,6 +351,19 @@ void OPPROTO op_test_le(void)
     FORCE_RET();
 }
 
+void OPPROTO op_test_T0(void)
+{
+    if (T0)
+        GOTO_LABEL_PARAM(1);
+    FORCE_RET();
+}
+void OPPROTO op_testn_T0(void)
+{
+    if (!T0)
+        GOTO_LABEL_PARAM(1);
+    FORCE_RET();
+}
+
 void OPPROTO op_goto_tb0(void)
 {
     GOTO_TB(op_goto_tb0, PARAM1, 0);
@@ -368,7 +381,8 @@ void OPPROTO op_exit_tb(void)
 
 void OPPROTO op_movl_T0_cpsr(void)
 {
-    T0 = cpsr_read(env);
+    /* Execution state bits always read as zero.  */
+    T0 = cpsr_read(env) & ~CPSR_EXEC;
     FORCE_RET();
 }
 
@@ -438,6 +452,28 @@ void OPPROTO op_addq_lo_T0_T1(void)
     T0 = res;
 }
 
+/* Dual 16-bit accumulate.  */
+void OPPROTO op_addq_T0_T1_dual(void)
+{
+  uint64_t res;
+  res = ((uint64_t)(env->regs[PARAM2]) << 32) | (env->regs[PARAM1]);
+  res += (int32_t)T0;
+  res += (int32_t)T1;
+  env->regs[PARAM1] = (uint32_t)res;
+  env->regs[PARAM2] = res >> 32;
+}
+
+/* Dual 16-bit subtract accumulate.  */
+void OPPROTO op_subq_T0_T1_dual(void)
+{
+  uint64_t res;
+  res = ((uint64_t)(env->regs[PARAM2]) << 32) | (env->regs[PARAM1]);
+  res += (int32_t)T0;
+  res -= (int32_t)T1;
+  env->regs[PARAM1] = (uint32_t)res;
+  env->regs[PARAM2] = res >> 32;
+}
+
 void OPPROTO op_logicq_cc(void)
 {
     env->NZF = (T1 & 0x80000000) | ((T0 | T1) != 0);
@@ -455,8 +491,21 @@ void OPPROTO op_logicq_cc(void)
 #include "op_mem.h"
 #endif
 
+void OPPROTO op_clrex(void)
+{
+    cpu_lock();
+    helper_clrex(env);
+    cpu_unlock();
+}
+
 /* shifts */
 
+/* Used by NEON.  */
+void OPPROTO op_shll_T0_im(void)
+{
+    T1 = T1 << PARAM1;
+}
+
 /* T1 based */
 
 void OPPROTO op_shll_T1_im(void)
@@ -813,8 +862,39 @@ void OPPROTO op_double_T1_saturate(void)
   FORCE_RET();
 }
 
-/* thumb shift by immediate */
-void OPPROTO op_shll_T0_im_thumb(void)
+/* Unsigned saturating arithmetic for NEON.  */
+void OPPROTO op_addl_T0_T1_usaturate(void)
+{
+  uint32_t res;
+
+  res = T0 + T1;
+  if (res < T0) {
+      env->QF = 1;
+      T0 = 0xffffffff;
+  } else {
+      T0 = res;
+  }
+
+  FORCE_RET();
+}
+
+void OPPROTO op_subl_T0_T1_usaturate(void)
+{
+  uint32_t res;
+
+  res = T0 - T1;
+  if (res > T0) {
+      env->QF = 1;
+      T0 = 0;
+  } else {
+      T0 = res;
+  }
+
+  FORCE_RET();
+}
+
+/* Thumb shift by immediate */
+void OPPROTO op_shll_T0_im_thumb_cc(void)
 {
     int shift;
     shift = PARAM1;
@@ -826,7 +906,13 @@ void OPPROTO op_shll_T0_im_thumb(void)
     FORCE_RET();
 }
 
-void OPPROTO op_shrl_T0_im_thumb(void)
+void OPPROTO op_shll_T0_im_thumb(void)
+{
+    T0 = T0 << PARAM1;
+    FORCE_RET();
+}
+
+void OPPROTO op_shrl_T0_im_thumb_cc(void)
 {
     int shift;
 
@@ -842,7 +928,20 @@ void OPPROTO op_shrl_T0_im_thumb(void)
     FORCE_RET();
 }
 
-void OPPROTO op_sarl_T0_im_thumb(void)
+void OPPROTO op_shrl_T0_im_thumb(void)
+{
+    int shift;
+
+    shift = PARAM1;
+    if (shift == 0) {
+	T0 = 0;
+    } else {
+	T0 = T0 >> shift;
+    }
+    FORCE_RET();
+}
+
+void OPPROTO op_sarl_T0_im_thumb_cc(void)
 {
     int shift;
 
@@ -858,6 +957,19 @@ void OPPROTO op_sarl_T0_im_thumb(void)
     FORCE_RET();
 }
 
+void OPPROTO op_sarl_T0_im_thumb(void)
+{
+    int shift;
+
+    shift = PARAM1;
+    if (shift == 0) {
+	env->CF = T0 & 1;
+    } else {
+	T0 = ((int32_t)T0) >> shift;
+    }
+    FORCE_RET();
+}
+
 /* exceptions */
 
 void OPPROTO op_swi(void)
@@ -891,6 +1003,12 @@ void OPPROTO op_bkpt(void)
     cpu_loop_exit();
 }
 
+void OPPROTO op_exception_exit(void)
+{
+    env->exception_index = EXCP_EXCEPTION_EXIT;
+    cpu_loop_exit();
+}
+
 /* VFP support.  We follow the convention used for VFP instrunctions:
    Single precition routines have a "s" suffix, double precision a
    "d" suffix.  */
@@ -982,6 +1100,28 @@ static inline uint32_t vfp_stoi(float32 s)
     return v.i;
 }
 
+static inline float64 vfp_itod(uint64_t i)
+{
+    union {
+        uint64_t i;
+        float64 d;
+    } v;
+
+    v.i = i;
+    return v.d;
+}
+
+static inline uint64_t vfp_dtoi(float64 d)
+{
+    union {
+        uint64_t i;
+        float64 d;
+    } v;
+
+    v.d = d;
+    return v.i;
+}
+
 /* Integer to float conversion.  */
 VFP_OP(uito, s)
 {
@@ -1056,6 +1196,32 @@ VFP_OP(fcvts, d)
     FT0s = float64_to_float32(FT0d, &env->vfp.fp_status);
 }
 
+/* VFP3 fixed point conversion.  */
+#define VFP_CONV_FIX(name, p, ftype, itype, sign) \
+VFP_OP(name##to, p) \
+{ \
+    ftype tmp; \
+    tmp = sign##int32_to_##ftype ((itype)vfp_##p##toi(FT0##p), \
+                                  &env->vfp.fp_status); \
+    FT0##p = ftype##_scalbn(tmp, PARAM1, &env->vfp.fp_status); \
+} \
+VFP_OP(to##name, p) \
+{ \
+    ftype tmp; \
+    tmp = ftype##_scalbn(FT0##p, PARAM1, &env->vfp.fp_status); \
+    FT0##p = vfp_ito##p((itype)ftype##_to_##sign##int32_round_to_zero(tmp, \
+            &env->vfp.fp_status)); \
+}
+
+VFP_CONV_FIX(sh, d, float64, int16, )
+VFP_CONV_FIX(sl, d, float64, int32, )
+VFP_CONV_FIX(uh, d, float64, uint16, u)
+VFP_CONV_FIX(ul, d, float64, uint32, u)
+VFP_CONV_FIX(sh, s, float32, int16, )
+VFP_CONV_FIX(sl, s, float32, int32, )
+VFP_CONV_FIX(uh, s, float32, uint16, u)
+VFP_CONV_FIX(ul, s, float32, uint32, u)
+
 /* Get and Put values from registers.  */
 VFP_OP(getreg_F0, d)
 {
@@ -1142,6 +1308,20 @@ void OPPROTO op_vfp_mdrr(void)
     FT0d = u.d;
 }
 
+/* Load immediate.  PARAM1 is the 32 most significant bits of the value.  */
+void OPPROTO op_vfp_fconstd(void)
+{
+    CPU_DoubleU u;
+    u.l.upper = PARAM1;
+    u.l.lower = 0;
+    FT0d = u.d;
+}
+
+void OPPROTO op_vfp_fconsts(void)
+{
+    FT0s = vfp_itos(PARAM1);
+}
+
 /* Copy the most significant bit of T0 to all bits of T1.  */
 void OPPROTO op_signbit_T1_T0(void)
 {
@@ -1204,9 +1384,9 @@ void OPPROTO op_movl_user_T0(void)
     FORCE_RET();
 }
 
-void OPPROTO op_movl_T2_T0(void)
+void OPPROTO op_movl_T0_T1(void)
 {
-    T2 = T0;
+    T0 = T1;
 }
 
 void OPPROTO op_movl_T0_T2(void)
@@ -1214,5 +1394,530 @@ void OPPROTO op_movl_T0_T2(void)
     T0 = T2;
 }
 
+void OPPROTO op_movl_T1_T0(void)
+{
+    T1 = T0;
+}
+
+void OPPROTO op_movl_T1_T2(void)
+{
+    T1 = T2;
+}
+
+void OPPROTO op_movl_T2_T0(void)
+{
+    T2 = T0;
+}
+
+/* ARMv6 Media instructions.  */
+
+/* Note that signed overflow is undefined in C.  The following routines are
+   careful to use unsigned types where modulo arithmetic is required.
+   Failure to do so _will_ break on newer gcc.  */
+
+/* Signed saturating arithmetic.  */
+
+/* Perform 16-bit signed satruating addition.  */
+static inline uint16_t add16_sat(uint16_t a, uint16_t b)
+{
+    uint16_t res;
+
+    res = a + b;
+    if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
+        if (a & 0x8000)
+            res = 0x8000;
+        else
+            res = 0x7fff;
+    }
+    return res;
+}
+
+/* Perform 8-bit signed satruating addition.  */
+static inline uint8_t add8_sat(uint8_t a, uint8_t b)
+{
+    uint8_t res;
+
+    res = a + b;
+    if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
+        if (a & 0x80)
+            res = 0x80;
+        else
+            res = 0x7f;
+    }
+    return res;
+}
+
+/* Perform 16-bit signed satruating subtraction.  */
+static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
+{
+    uint16_t res;
+
+    res = a - b;
+    if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
+        if (a & 0x8000)
+            res = 0x8000;
+        else
+            res = 0x7fff;
+    }
+    return res;
+}
+
+/* Perform 8-bit signed satruating subtraction.  */
+static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
+{
+    uint8_t res;
+
+    res = a - b;
+    if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
+        if (a & 0x80)
+            res = 0x80;
+        else
+            res = 0x7f;
+    }
+    return res;
+}
+
+#define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
+#define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
+#define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
+#define SUB8(a, b, n)  RESULT(sub8_sat(a, b), n, 8);
+#define PFX q
+
+#include "op_addsub.h"
+
+/* Unsigned saturating arithmetic.  */
+static inline uint16_t add16_usat(uint16_t a, uint8_t b)
+{
+    uint16_t res;
+    res = a + b;
+    if (res < a)
+        res = 0xffff;
+    return res;
+}
+
+static inline uint16_t sub16_usat(uint16_t a, uint8_t b)
+{
+    if (a < b)
+        return a - b;
+    else
+        return 0;
+}
+
+static inline uint8_t add8_usat(uint8_t a, uint8_t b)
+{
+    uint8_t res;
+    res = a + b;
+    if (res < a)
+        res = 0xff;
+    return res;
+}
+
+static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
+{
+    if (a < b)
+        return a - b;
+    else
+        return 0;
+}
+
+#define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
+#define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
+#define ADD8(a, b, n)  RESULT(add8_usat(a, b), n, 8);
+#define SUB8(a, b, n)  RESULT(sub8_usat(a, b), n, 8);
+#define PFX uq
+
+#include "op_addsub.h"
+
+/* Signed modulo arithmetic.  */
+#define SARITH16(a, b, n, op) do { \
+    int32_t sum; \
+    sum = (int16_t)((uint16_t)(a) op (uint16_t)(b)); \
+    RESULT(sum, n, 16); \
+    if (sum >= 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define SARITH8(a, b, n, op) do { \
+    int32_t sum; \
+    sum = (int8_t)((uint8_t)(a) op (uint8_t)(b)); \
+    RESULT(sum, n, 8); \
+    if (sum >= 0) \
+        ge |= 1 << n; \
+    } while(0)
+
+
+#define ADD16(a, b, n) SARITH16(a, b, n, +)
+#define SUB16(a, b, n) SARITH16(a, b, n, -)
+#define ADD8(a, b, n)  SARITH8(a, b, n, +)
+#define SUB8(a, b, n)  SARITH8(a, b, n, -)
+#define PFX s
+#define ARITH_GE
+
+#include "op_addsub.h"
+
+/* Unsigned modulo arithmetic.  */
+#define ADD16(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
+    RESULT(sum, n, 16); \
+    if ((sum >> 16) == 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define ADD8(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
+    RESULT(sum, n, 8); \
+    if ((sum >> 8) == 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define SUB16(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
+    RESULT(sum, n, 16); \
+    if ((sum >> 16) == 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define SUB8(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
+    RESULT(sum, n, 8); \
+    if ((sum >> 8) == 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define PFX u
+#define ARITH_GE
+
+#include "op_addsub.h"
+
+/* Halved signed arithmetic.  */
+#define ADD16(a, b, n) \
+  RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
+#define SUB16(a, b, n) \
+  RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
+#define ADD8(a, b, n) \
+  RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
+#define SUB8(a, b, n) \
+  RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
+#define PFX sh
+
+#include "op_addsub.h"
+
+/* Halved unsigned arithmetic.  */
+#define ADD16(a, b, n) \
+  RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
+#define SUB16(a, b, n) \
+  RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
+#define ADD8(a, b, n) \
+  RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
+#define SUB8(a, b, n) \
+  RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
+#define PFX uh
+
+#include "op_addsub.h"
+
+void OPPROTO op_pkhtb_T0_T1(void)
+{
+    T0 = (T0 & 0xffff0000) | (T1 & 0xffff);
+}
+
+void OPPROTO op_pkhbt_T0_T1(void)
+{
+    T0 = (T0 & 0xffff) | (T1 & 0xffff0000);
+}
+void OPPROTO op_rev_T0(void)
+{
+    T0 =  ((T0 & 0xff000000) >> 24)
+        | ((T0 & 0x00ff0000) >> 8)
+        | ((T0 & 0x0000ff00) << 8)
+        | ((T0 & 0x000000ff) << 24);
+}
+
+void OPPROTO op_revh_T0(void)
+{
+    T0 = (T0 >> 16) | (T0 << 16);
+}
+
+void OPPROTO op_rev16_T0(void)
+{
+    T0 =  ((T0 & 0xff000000) >> 8)
+        | ((T0 & 0x00ff0000) << 8)
+        | ((T0 & 0x0000ff00) >> 8)
+        | ((T0 & 0x000000ff) << 8);
+}
+
+void OPPROTO op_revsh_T0(void)
+{
+    T0 = (int16_t)(  ((T0 & 0x0000ff00) >> 8)
+                   | ((T0 & 0x000000ff) << 8));
+}
+
+void OPPROTO op_rbit_T0(void)
+{
+    T0 =  ((T0 & 0xff000000) >> 24)
+        | ((T0 & 0x00ff0000) >> 8)
+        | ((T0 & 0x0000ff00) << 8)
+        | ((T0 & 0x000000ff) << 24);
+    T0 =  ((T0 & 0xf0f0f0f0) >> 4)
+        | ((T0 & 0x0f0f0f0f) << 4);
+    T0 =  ((T0 & 0x88888888) >> 3)
+        | ((T0 & 0x44444444) >> 1)
+        | ((T0 & 0x22222222) << 1)
+        | ((T0 & 0x11111111) << 3);
+}
+
+/* Swap low and high halfwords.  */
+void OPPROTO op_swap_half_T1(void)
+{
+    T1 = (T1 >> 16) | (T1 << 16);
+    FORCE_RET();
+}
+
+/* Dual 16-bit signed multiply.  */
+void OPPROTO op_mul_dual_T0_T1(void)
+{
+    int32_t low;
+    int32_t high;
+    low = (int32_t)(int16_t)T0 * (int32_t)(int16_t)T1;
+    high = (((int32_t)T0) >> 16) * (((int32_t)T1) >> 16);
+    T0 = low;
+    T1 = high;
+}
+
+void OPPROTO op_sel_T0_T1(void)
+{
+    uint32_t mask;
+    uint32_t flags;
+
+    flags = env->GE;
+    mask = 0;
+    if (flags & 1)
+        mask |= 0xff;
+    if (flags & 2)
+        mask |= 0xff00;
+    if (flags & 4)
+        mask |= 0xff0000;
+    if (flags & 8)
+        mask |= 0xff000000;
+    T0 = (T0 & mask) | (T1 & ~mask);
+    FORCE_RET();
+}
+
+void OPPROTO op_roundqd_T0_T1(void)
+{
+    T0 = T1 + ((uint32_t)T0 >> 31);
+}
+
+/* Signed saturation.  */
+static inline uint32_t do_ssat(int32_t val, int shift)
+{
+    int32_t top;
+    uint32_t mask;
+
+    shift = PARAM1;
+    top = val >> shift;
+    mask = (1u << shift) - 1;
+    if (top > 0) {
+        env->QF = 1;
+        return mask;
+    } else if (top < -1) {
+        env->QF = 1;
+        return ~mask;
+    }
+    return val;
+}
+
+/* Unsigned saturation.  */
+static inline uint32_t do_usat(int32_t val, int shift)
+{
+    uint32_t max;
+
+    shift = PARAM1;
+    max = (1u << shift) - 1;
+    if (val < 0) {
+        env->QF = 1;
+        return 0;
+    } else if (val > max) {
+        env->QF = 1;
+        return max;
+    }
+    return val;
+}
+
+/* Signed saturate.  */
+void OPPROTO op_ssat_T1(void)
+{
+    T0 = do_ssat(T0, PARAM1);
+    FORCE_RET();
+}
+
+/* Dual halfword signed saturate.  */
+void OPPROTO op_ssat16_T1(void)
+{
+    uint32_t res;
+
+    res = (uint16_t)do_ssat((int16_t)T0, PARAM1);
+    res |= do_ssat(((int32_t)T0) >> 16, PARAM1) << 16;
+    T0 = res;
+    FORCE_RET();
+}
+
+/* Unsigned saturate.  */
+void OPPROTO op_usat_T1(void)
+{
+    T0 = do_usat(T0, PARAM1);
+    FORCE_RET();
+}
+
+/* Dual halfword unsigned saturate.  */
+void OPPROTO op_usat16_T1(void)
+{
+    uint32_t res;
+
+    res = (uint16_t)do_usat((int16_t)T0, PARAM1);
+    res |= do_usat(((int32_t)T0) >> 16, PARAM1) << 16;
+    T0 = res;
+    FORCE_RET();
+}
+
+/* Dual 16-bit add.  */
+void OPPROTO op_add16_T1_T2(void)
+{
+    uint32_t mask;
+    mask = (T0 & T1) & 0x8000;
+    T0 ^= ~0x8000;
+    T1 ^= ~0x8000;
+    T0 = (T0 + T1) ^ mask;
+}
+
+static inline uint8_t do_usad(uint8_t a, uint8_t b)
+{
+    if (a > b)
+        return a - b;
+    else
+        return b - a;
+}
+
+/* Unsigned sum of absolute byte differences.  */
+void OPPROTO op_usad8_T0_T1(void)
+{
+    uint32_t sum;
+    sum = do_usad(T0, T1);
+    sum += do_usad(T0 >> 8, T1 >> 8);
+    sum += do_usad(T0 >> 16, T1 >>16);
+    sum += do_usad(T0 >> 24, T1 >> 24);
+    T0 = sum;
+}
+
+/* Thumb-2 instructions.  */
+
+/* Insert T1 into T0.  Result goes in T1.  */
+void OPPROTO op_bfi_T1_T0(void)
+{
+    int shift = PARAM1;
+    uint32_t mask = PARAM2;
+    uint32_t bits;
+
+    bits = (T1 << shift) & mask;
+    T1 = (T0 & ~mask) | bits;
+}
+
+/* Unsigned bitfield extract.  */
+void OPPROTO op_ubfx_T1(void)
+{
+    uint32_t shift = PARAM1;
+    uint32_t mask = PARAM2;
+
+    T1 >>= shift;
+    T1 &= mask;
+}
+
+/* Signed bitfield extract.  */
+void OPPROTO op_sbfx_T1(void)
+{
+    uint32_t shift = PARAM1;
+    uint32_t width = PARAM2;
+    int32_t val;
+
+    val = T1 << (32 - (shift + width));
+    T1 = val >> (32 - width);
+}
+
+void OPPROTO op_movtop_T0_im(void)
+{
+    T0 = (T0 & 0xffff) | PARAM1;
+}
+
+/* Used by table branch instructions.  */
+void OPPROTO op_jmp_T0_im(void)
+{
+    env->regs[15] = PARAM1 + (T0 << 1);
+}
+
+void OPPROTO op_set_condexec(void)
+{
+    env->condexec_bits = PARAM1;
+}
+
+void OPPROTO op_sdivl_T0_T1(void)
+{
+  int32_t num;
+  int32_t den;
+  num = T0;
+  den = T1;
+  if (den == 0)
+    T0 = 0;
+  else
+    T0 = num / den;
+  FORCE_RET();
+}
+
+void OPPROTO op_udivl_T0_T1(void)
+{
+  uint32_t num;
+  uint32_t den;
+  num = T0;
+  den = T1;
+  if (den == 0)
+    T0 = 0;
+  else
+    T0 = num / den;
+  FORCE_RET();
+}
+
+void OPPROTO op_movl_T1_r13_banked(void)
+{
+    T1 = helper_get_r13_banked(env, PARAM1);
+}
+
+void OPPROTO op_movl_r13_T1_banked(void)
+{
+    helper_set_r13_banked(env, PARAM1, T1);
+}
+
+void OPPROTO op_v7m_mrs_T0(void)
+{
+    T0 = helper_v7m_mrs(env, PARAM1);
+}
+
+void OPPROTO op_v7m_msr_T0(void)
+{
+    helper_v7m_msr(env, PARAM1, T0);
+}
+
+void OPPROTO op_movl_T0_sp(void)
+{
+    if (PARAM1 == env->v7m.current_sp)
+        T0 = env->regs[13];
+    else
+        T0 = env->v7m.other_sp;
+    FORCE_RET();
+}
+
+#include "op_neon.h"
+
 /* iwMMXt support */
 #include "op_iwmmxt.c"
diff --git a/target-arm/op_addsub.h b/target-arm/op_addsub.h
new file mode 100644
index 000000000..d15360d80
--- /dev/null
+++ b/target-arm/op_addsub.h
@@ -0,0 +1,106 @@
+/*
+ * ARMv6 integer SIMD operations.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#ifdef ARITH_GE
+#define DECLARE_GE uint32_t ge = 0
+#define SET_GE env->GE = ge
+#else
+#define DECLARE_GE do{}while(0)
+#define SET_GE do{}while(0)
+#endif
+
+#define RESULT(val, n, width) \
+    res |= ((uint32_t)(glue(glue(uint,width),_t))(val)) << (n * width)
+
+void OPPROTO glue(glue(op_,PFX),add16_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    ADD16(T0, T1, 0);
+    ADD16(T0 >> 16, T1 >> 16, 1);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+void OPPROTO glue(glue(op_,PFX),add8_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    ADD8(T0, T1, 0);
+    ADD8(T0 >> 8, T1 >> 8, 1);
+    ADD8(T0 >> 16, T1 >> 16, 2);
+    ADD8(T0 >> 24, T1 >> 24, 3);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+void OPPROTO glue(glue(op_,PFX),sub16_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    SUB16(T0, T1, 0);
+    SUB16(T0 >> 16, T1 >> 16, 1);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+void OPPROTO glue(glue(op_,PFX),sub8_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    SUB8(T0, T1, 0);
+    SUB8(T0 >> 8, T1 >> 8, 1);
+    SUB8(T0 >> 16, T1 >> 16, 2);
+    SUB8(T0 >> 24, T1 >> 24, 3);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+void OPPROTO glue(glue(op_,PFX),subaddx_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    ADD16(T0, T1, 0);
+    SUB16(T0 >> 16, T1 >> 16, 1);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+void OPPROTO glue(glue(op_,PFX),addsubx_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    SUB16(T0, T1, 0);
+    ADD16(T0 >> 16, T1 >> 16, 1);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+#undef DECLARE_GE
+#undef SET_GE
+#undef RESULT
+
+#undef ARITH_GE
+#undef PFX
+#undef ADD16
+#undef SUB16
+#undef ADD8
+#undef SUB8
diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
index c861bf7e4..2b9ec0fa7 100644
--- a/target-arm/op_helper.c
+++ b/target-arm/op_helper.c
@@ -1,7 +1,7 @@
 /*
  *  ARM helper routines
  *
- *  Copyright (c) 2005 CodeSourcery, LLC
+ *  Copyright (c) 2005-2007 CodeSourcery, LLC
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -175,10 +175,89 @@ void do_vfp_get_fpscr(void)
     T0 |= vfp_exceptbits_from_host(i);
 }
 
+float32 helper_recps_f32(float32 a, float32 b)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 two = int32_to_float32(2, s);
+    return float32_sub(two, float32_mul(a, b, s), s);
+}
+
+float32 helper_rsqrts_f32(float32 a, float32 b)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 three = int32_to_float32(3, s);
+    return float32_sub(three, float32_mul(a, b, s), s);
+}
+
+/* TODO: The architecture specifies the value that the estimate functions
+   should return.  We return the exact reciprocal/root instead.  */
+float32 helper_recpe_f32(float32 a)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 one = int32_to_float32(1, s);
+    return float32_div(one, a, s);
+}
+
+float32 helper_rsqrte_f32(float32 a)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 one = int32_to_float32(1, s);
+    return float32_div(one, float32_sqrt(a, s), s);
+}
+
+uint32_t helper_recpe_u32(uint32_t a)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 tmp;
+    tmp = int32_to_float32(a, s);
+    tmp = float32_scalbn(tmp, -32, s);
+    tmp = helper_recpe_f32(tmp);
+    tmp = float32_scalbn(tmp, 31, s);
+    return float32_to_int32(tmp, s);
+}
+
+uint32_t helper_rsqrte_u32(uint32_t a)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 tmp;
+    tmp = int32_to_float32(a, s);
+    tmp = float32_scalbn(tmp, -32, s);
+    tmp = helper_rsqrte_f32(tmp);
+    tmp = float32_scalbn(tmp, 31, s);
+    return float32_to_int32(tmp, s);
+}
+
+void helper_neon_tbl(int rn, int maxindex)
+{
+    uint32_t val;
+    uint32_t mask;
+    uint32_t tmp;
+    int index;
+    int shift;
+    uint64_t *table;
+    table = (uint64_t *)&env->vfp.regs[rn];
+    val = 0;
+    mask = 0;
+    for (shift = 0; shift < 32; shift += 8) {
+        index = (T1 >> shift) & 0xff;
+        if (index <= maxindex) {
+            tmp = (table[index >> 3] >> (index & 7)) & 0xff;
+            val |= tmp << shift;
+        } else {
+            val |= T0 & (0xff << shift);
+        }
+    }
+    T0 = val;
+}
+
 #if !defined(CONFIG_USER_ONLY)
 
 #define MMUSUFFIX _mmu
-#define GETPC() (__builtin_return_address(0))
+#ifdef __s390__
+# define GETPC() ((void*)((unsigned long)__builtin_return_address(0) & 0x7fffffffUL))
+#else
+# define GETPC() (__builtin_return_address(0))
+#endif
 
 #define SHIFT 0
 #include "softmmu_template.h"
@@ -196,22 +275,22 @@ void do_vfp_get_fpscr(void)
    NULL, it means that the function was called in C code (i.e. not
    from generated code or from helper.c) */
 /* XXX: fix it to restore all registers */
-void tlb_fill (target_ulong addr, int is_write, int is_user, void *retaddr)
+void tlb_fill (target_ulong addr, int is_write, int mmu_idx, void *retaddr)
 {
     TranslationBlock *tb;
     CPUState *saved_env;
-    target_phys_addr_t pc;
+    unsigned long pc;
     int ret;
 
     /* XXX: hack to restore env in all cases, even if not called from
        generated code */
     saved_env = env;
     env = cpu_single_env;
-    ret = cpu_arm_handle_mmu_fault(env, addr, is_write, is_user, 1);
+    ret = cpu_arm_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
     if (__builtin_expect(ret, 0)) {
         if (retaddr) {
             /* now we have a real cpu fault */
-            pc = (target_phys_addr_t)retaddr;
+            pc = (unsigned long)retaddr;
             tb = tb_find_pc(pc);
             if (tb) {
                 /* the PC is inside the translated code. It means that we have
@@ -223,5 +302,4 @@ void tlb_fill (target_ulong addr, int is_write, int is_user, void *retaddr)
     }
     env = saved_env;
 }
-
 #endif
diff --git a/target-arm/op_mem.h b/target-arm/op_mem.h
index 6bccb0651..b12b63c5f 100644
--- a/target-arm/op_mem.h
+++ b/target-arm/op_mem.h
@@ -1,5 +1,6 @@
 /* ARM memory operations.  */
 
+void helper_ld(uint32_t);
 /* Load from address T1 into T0.  */
 #define MEM_LD_OP(name) \
 void OPPROTO glue(op_ld##name,MEMSUFFIX)(void) \
@@ -49,6 +50,64 @@ MEM_SWP_OP(l, l)
 
 #undef MEM_SWP_OP
 
+/* Load-locked, store exclusive.  */
+#define EXCLUSIVE_OP(suffix, ldsuffix) \
+void OPPROTO glue(op_ld##suffix##ex,MEMSUFFIX)(void) \
+{ \
+    cpu_lock(); \
+    helper_mark_exclusive(env, T1); \
+    T0 = glue(ld##ldsuffix,MEMSUFFIX)(T1); \
+    cpu_unlock(); \
+    FORCE_RET(); \
+} \
+ \
+void OPPROTO glue(op_st##suffix##ex,MEMSUFFIX)(void) \
+{ \
+    int failed; \
+    cpu_lock(); \
+    failed = helper_test_exclusive(env, T1); \
+    /* ??? Is it safe to hold the cpu lock over a store?  */ \
+    if (!failed) { \
+        glue(st##suffix,MEMSUFFIX)(T1, T0); \
+    } \
+    T0 = failed; \
+    cpu_unlock(); \
+    FORCE_RET(); \
+}
+
+EXCLUSIVE_OP(b, ub)
+EXCLUSIVE_OP(w, uw)
+EXCLUSIVE_OP(l, l)
+
+#undef EXCLUSIVE_OP
+
+/* Load exclusive T0:T1 from address T1.  */
+void OPPROTO glue(op_ldqex,MEMSUFFIX)(void)
+{
+    cpu_lock();
+    helper_mark_exclusive(env, T1);
+    T0 = glue(ldl,MEMSUFFIX)(T1);
+    T1 = glue(ldl,MEMSUFFIX)((T1 + 4));
+    cpu_unlock();
+    FORCE_RET();
+}
+
+/* Store exclusive T0:T2 to address T1.  */
+void OPPROTO glue(op_stqex,MEMSUFFIX)(void)
+{
+    int failed;
+    cpu_lock();
+    failed = helper_test_exclusive(env, T1);
+    /* ??? Is it safe to hold the cpu lock over a store?  */
+    if (!failed) {
+        glue(stl,MEMSUFFIX)(T1, T0);
+        glue(stl,MEMSUFFIX)((T1 + 4), T2);
+    }
+    T0 = failed;
+    cpu_unlock();
+    FORCE_RET();
+}
+
 /* Floating point load/store.  Address is in T1 */
 #define VFP_MEM_OP(p, w) \
 void OPPROTO glue(op_vfp_ld##p,MEMSUFFIX)(void) \
diff --git a/target-arm/op_neon.h b/target-arm/op_neon.h
new file mode 100644
index 000000000..232375e18
--- /dev/null
+++ b/target-arm/op_neon.h
@@ -0,0 +1,1754 @@
+/*
+ * ARM NEON vector operations.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+/* Note that for NEON an "l" prefix means it is a wide operation, unlike
+   scalar arm ops where it means a word size operation.  */
+
+/* ??? NEON ops should probably have their own float status.  */
+#define NFS &env->vfp.fp_status
+#define NEON_OP(name) void OPPROTO op_neon_##name (void)
+
+NEON_OP(getreg_T0)
+{
+    T0 = *(uint32_t *)((char *) env + PARAM1);
+}
+
+NEON_OP(getreg_T1)
+{
+    T1 = *(uint32_t *)((char *) env + PARAM1);
+}
+
+NEON_OP(getreg_T2)
+{
+    T2 = *(uint32_t *)((char *) env + PARAM1);
+}
+
+NEON_OP(setreg_T0)
+{
+    *(uint32_t *)((char *) env + PARAM1) = T0;
+}
+
+NEON_OP(setreg_T1)
+{
+    *(uint32_t *)((char *) env + PARAM1) = T1;
+}
+
+NEON_OP(setreg_T2)
+{
+    *(uint32_t *)((char *) env + PARAM1) = T2;
+}
+
+#define NEON_TYPE1(name, type) \
+typedef struct \
+{ \
+    type v1; \
+} neon_##name;
+#ifdef WORDS_BIGENDIAN
+#define NEON_TYPE2(name, type) \
+typedef struct \
+{ \
+    type v2; \
+    type v1; \
+} neon_##name;
+#define NEON_TYPE4(name, type) \
+typedef struct \
+{ \
+    type v4; \
+    type v3; \
+    type v2; \
+    type v1; \
+} neon_##name;
+#else
+#define NEON_TYPE2(name, type) \
+typedef struct \
+{ \
+    type v1; \
+    type v2; \
+} neon_##name;
+#define NEON_TYPE4(name, type) \
+typedef struct \
+{ \
+    type v1; \
+    type v2; \
+    type v3; \
+    type v4; \
+} neon_##name;
+#endif
+
+NEON_TYPE4(s8, int8_t)
+NEON_TYPE4(u8, uint8_t)
+NEON_TYPE2(s16, int16_t)
+NEON_TYPE2(u16, uint16_t)
+NEON_TYPE1(s32, int32_t)
+NEON_TYPE1(u32, uint32_t)
+#undef NEON_TYPE4
+#undef NEON_TYPE2
+#undef NEON_TYPE1
+
+/* Copy from a uint32_t to a vector structure type.  */
+#define NEON_UNPACK(vtype, dest, val) do { \
+    union { \
+        vtype v; \
+        uint32_t i; \
+    } conv_u; \
+    conv_u.i = (val); \
+    dest = conv_u.v; \
+    } while(0)
+
+/* Copy from a vector structure type to a uint32_t.  */
+#define NEON_PACK(vtype, dest, val) do { \
+    union { \
+        vtype v; \
+        uint32_t i; \
+    } conv_u; \
+    conv_u.v = (val); \
+    dest = conv_u.i; \
+    } while(0)
+
+#define NEON_DO1 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc2.v1);
+#define NEON_DO2 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc2.v1); \
+    NEON_FN(vdest.v2, vsrc1.v2, vsrc2.v2);
+#define NEON_DO4 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc2.v1); \
+    NEON_FN(vdest.v2, vsrc1.v2, vsrc2.v2); \
+    NEON_FN(vdest.v3, vsrc1.v3, vsrc2.v3); \
+    NEON_FN(vdest.v4, vsrc1.v4, vsrc2.v4);
+
+#define NEON_VOP(name, vtype, n) \
+NEON_OP(name) \
+{ \
+    vtype vsrc1; \
+    vtype vsrc2; \
+    vtype vdest; \
+    NEON_UNPACK(vtype, vsrc1, T0); \
+    NEON_UNPACK(vtype, vsrc2, T1); \
+    NEON_DO##n; \
+    NEON_PACK(vtype, T0, vdest); \
+    FORCE_RET(); \
+}
+
+#define NEON_VOP1(name, vtype, n) \
+NEON_OP(name) \
+{ \
+    vtype vsrc1; \
+    vtype vdest; \
+    NEON_UNPACK(vtype, vsrc1, T0); \
+    NEON_DO##n; \
+    NEON_PACK(vtype, T0, vdest); \
+    FORCE_RET(); \
+}
+
+/* Pairwise operations.  */
+/* For 32-bit elements each segment only contains a single element, so
+   the elementwise and pairwise operations are the same.  */
+#define NEON_PDO2 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc1.v2); \
+    NEON_FN(vdest.v2, vsrc2.v1, vsrc2.v2);
+#define NEON_PDO4 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc1.v2); \
+    NEON_FN(vdest.v2, vsrc1.v3, vsrc1.v4); \
+    NEON_FN(vdest.v3, vsrc2.v1, vsrc2.v2); \
+    NEON_FN(vdest.v4, vsrc2.v3, vsrc2.v4); \
+
+#define NEON_POP(name, vtype, n) \
+NEON_OP(name) \
+{ \
+    vtype vsrc1; \
+    vtype vsrc2; \
+    vtype vdest; \
+    NEON_UNPACK(vtype, vsrc1, T0); \
+    NEON_UNPACK(vtype, vsrc2, T1); \
+    NEON_PDO##n; \
+    NEON_PACK(vtype, T0, vdest); \
+    FORCE_RET(); \
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 + src2) >> 1
+NEON_VOP(hadd_s8, neon_s8, 4)
+NEON_VOP(hadd_u8, neon_u8, 4)
+NEON_VOP(hadd_s16, neon_s16, 2)
+NEON_VOP(hadd_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(hadd_s32)
+{
+    int32_t src1 = T0;
+    int32_t src2 = T1;
+    int32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if (src1 & src2 & 1)
+        dest++;
+    T0 = dest;
+    FORCE_RET();
+}
+
+NEON_OP(hadd_u32)
+{
+    uint32_t src1 = T0;
+    uint32_t src2 = T1;
+    uint32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if (src1 & src2 & 1)
+        dest++;
+    T0 = dest;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 + src2 + 1) >> 1
+NEON_VOP(rhadd_s8, neon_s8, 4)
+NEON_VOP(rhadd_u8, neon_u8, 4)
+NEON_VOP(rhadd_s16, neon_s16, 2)
+NEON_VOP(rhadd_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(rhadd_s32)
+{
+    int32_t src1 = T0;
+    int32_t src2 = T1;
+    int32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if ((src1 | src2) & 1)
+        dest++;
+    T0 = dest;
+    FORCE_RET();
+}
+
+NEON_OP(rhadd_u32)
+{
+    uint32_t src1 = T0;
+    uint32_t src2 = T1;
+    uint32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if ((src1 | src2) & 1)
+        dest++;
+    T0 = dest;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 - src2) >> 1
+NEON_VOP(hsub_s8, neon_s8, 4)
+NEON_VOP(hsub_u8, neon_u8, 4)
+NEON_VOP(hsub_s16, neon_s16, 2)
+NEON_VOP(hsub_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(hsub_s32)
+{
+    int32_t src1 = T0;
+    int32_t src2 = T1;
+    int32_t dest;
+
+    dest = (src1 >> 1) - (src2 >> 1);
+    if ((~src1) & src2 & 1)
+        dest--;
+    T0 = dest;
+    FORCE_RET();
+}
+
+NEON_OP(hsub_u32)
+{
+    uint32_t src1 = T0;
+    uint32_t src2 = T1;
+    uint32_t dest;
+
+    dest = (src1 >> 1) - (src2 >> 1);
+    if ((~src1) & src2 & 1)
+        dest--;
+    T0 = dest;
+    FORCE_RET();
+}
+
+/* ??? bsl, bif and bit are all the same op, just with the oparands in a
+   differnet order.  It's currently easier to have 3 differnt ops than
+   rearange the operands.  */
+
+/* Bitwise Select.  */
+NEON_OP(bsl)
+{
+    T0 = (T0 & T2) | (T1 & ~T2);
+}
+
+/* Bitwise Insert If True.  */
+NEON_OP(bit)
+{
+    T0 = (T0 & T1) | (T2 & ~T1);
+}
+
+/* Bitwise Insert If False.  */
+NEON_OP(bif)
+{
+    T0 = (T2 & T1) | (T0 & ~T1);
+}
+
+#define NEON_USAT(dest, src1, src2, type) do { \
+    uint32_t tmp = (uint32_t)src1 + (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        env->QF = 1; \
+        dest = ~0; \
+    } else { \
+        dest = tmp; \
+    }} while(0)
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint8_t)
+NEON_VOP(qadd_u8, neon_u8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint16_t)
+NEON_VOP(qadd_u16, neon_u16, 2)
+#undef NEON_FN
+#undef NEON_USAT
+
+#define NEON_SSAT(dest, src1, src2, type) do { \
+    int32_t tmp = (uint32_t)src1 + (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        env->QF = 1; \
+        if (src2 > 0) { \
+            tmp = (1 << (sizeof(type) * 8 - 1)) - 1; \
+        } else { \
+            tmp = 1 << (sizeof(type) * 8 - 1); \
+        } \
+    } \
+    dest = tmp; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int8_t)
+NEON_VOP(qadd_s8, neon_s8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int16_t)
+NEON_VOP(qadd_s16, neon_s16, 2)
+#undef NEON_FN
+#undef NEON_SSAT
+
+#define NEON_USAT(dest, src1, src2, type) do { \
+    uint32_t tmp = (uint32_t)src1 - (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        env->QF = 1; \
+        dest = 0; \
+    } else { \
+        dest = tmp; \
+    }} while(0)
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint8_t)
+NEON_VOP(qsub_u8, neon_u8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint16_t)
+NEON_VOP(qsub_u16, neon_u16, 2)
+#undef NEON_FN
+#undef NEON_USAT
+
+#define NEON_SSAT(dest, src1, src2, type) do { \
+    int32_t tmp = (uint32_t)src1 - (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        env->QF = 1; \
+        if (src2 < 0) { \
+            tmp = (1 << (sizeof(type) * 8 - 1)) - 1; \
+        } else { \
+            tmp = 1 << (sizeof(type) * 8 - 1); \
+        } \
+    } \
+    dest = tmp; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int8_t)
+NEON_VOP(qsub_s8, neon_s8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int16_t)
+NEON_VOP(qsub_s16, neon_s16, 2)
+#undef NEON_FN
+#undef NEON_SSAT
+
+#define NEON_FN(dest, src1, src2) dest = (src1 > src2) ? ~0 : 0
+NEON_VOP(cgt_s8, neon_s8, 4)
+NEON_VOP(cgt_u8, neon_u8, 4)
+NEON_VOP(cgt_s16, neon_s16, 2)
+NEON_VOP(cgt_u16, neon_u16, 2)
+NEON_VOP(cgt_s32, neon_s32, 1)
+NEON_VOP(cgt_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = (src1 >= src2) ? ~0 : 0
+NEON_VOP(cge_s8, neon_s8, 4)
+NEON_VOP(cge_u8, neon_u8, 4)
+NEON_VOP(cge_s16, neon_s16, 2)
+NEON_VOP(cge_u16, neon_u16, 2)
+NEON_VOP(cge_s32, neon_s32, 1)
+NEON_VOP(cge_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src2; \
+    if (tmp < 0) { \
+        dest = src1 >> -tmp; \
+    } else { \
+        dest = src1 << tmp; \
+    }} while (0)
+NEON_VOP(shl_s8, neon_s8, 4)
+NEON_VOP(shl_u8, neon_u8, 4)
+NEON_VOP(shl_s16, neon_s16, 2)
+NEON_VOP(shl_u16, neon_u16, 2)
+NEON_VOP(shl_s32, neon_s32, 1)
+NEON_VOP(shl_u32, neon_u32, 1)
+#undef NEON_FN
+
+NEON_OP(shl_u64)
+{
+    int8_t shift = T2;
+    uint64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val >>= -shift;
+    } else {
+        val <<= shift;
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+NEON_OP(shl_s64)
+{
+    int8_t shift = T2;
+    int64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val >>= -shift;
+    } else {
+        val <<= shift;
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src1; \
+    if (tmp < 0) { \
+        dest = (src2 + (1 << (-1 - tmp))) >> -tmp; \
+    } else { \
+        dest = src2 << tmp; \
+    }} while (0)
+
+NEON_VOP(rshl_s8, neon_s8, 4)
+NEON_VOP(rshl_u8, neon_u8, 4)
+NEON_VOP(rshl_s16, neon_s16, 2)
+NEON_VOP(rshl_u16, neon_u16, 2)
+NEON_VOP(rshl_s32, neon_s32, 1)
+NEON_VOP(rshl_u32, neon_u32, 1)
+#undef NEON_FN
+
+NEON_OP(rshl_u64)
+{
+    int8_t shift = T2;
+    uint64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val = (val + ((uint64_t)1 << (-1 - shift))) >> -shift;
+        val >>= -shift;
+    } else {
+        val <<= shift;
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+NEON_OP(rshl_s64)
+{
+    int8_t shift = T2;
+    int64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val = (val + ((int64_t)1 << (-1 - shift))) >> -shift;
+    } else {
+        val <<= shift;
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src1; \
+    if (tmp < 0) { \
+        dest = src2 >> -tmp; \
+    } else { \
+        dest = src2 << tmp; \
+        if ((dest >> tmp) != src2) { \
+            env->QF = 1; \
+            dest = ~0; \
+        } \
+    }} while (0)
+NEON_VOP(qshl_s8, neon_s8, 4)
+NEON_VOP(qshl_s16, neon_s16, 2)
+NEON_VOP(qshl_s32, neon_s32, 1)
+#undef NEON_FN
+
+NEON_OP(qshl_s64)
+{
+    int8_t shift = T2;
+    int64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val >>= -shift;
+    } else {
+        int64_t tmp = val;
+        val <<= shift;
+        if ((val >> shift) != tmp) {
+            env->QF = 1;
+            val = (tmp >> 63) ^ 0x7fffffffffffffffULL;
+        }
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src1; \
+    if (tmp < 0) { \
+        dest = src2 >> -tmp; \
+    } else { \
+        dest = src2 << tmp; \
+        if ((dest >> tmp) != src2) { \
+            env->QF = 1; \
+            dest = src2 >> 31; \
+        } \
+    }} while (0)
+NEON_VOP(qshl_u8, neon_u8, 4)
+NEON_VOP(qshl_u16, neon_u16, 2)
+NEON_VOP(qshl_u32, neon_u32, 1)
+#undef NEON_FN
+
+NEON_OP(qshl_u64)
+{
+    int8_t shift = T2;
+    uint64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val >>= -shift;
+    } else {
+        uint64_t tmp = val;
+        val <<= shift;
+        if ((val >> shift) != tmp) {
+            env->QF = 1;
+            val = ~(uint64_t)0;
+        }
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src1; \
+    if (tmp < 0) { \
+        dest = (src2 + (1 << (-1 - tmp))) >> -tmp; \
+    } else { \
+        dest = src2 << tmp; \
+        if ((dest >> tmp) != src2) { \
+            dest = ~0; \
+        } \
+    }} while (0)
+NEON_VOP(qrshl_s8, neon_s8, 4)
+NEON_VOP(qrshl_s16, neon_s16, 2)
+NEON_VOP(qrshl_s32, neon_s32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src1; \
+    if (tmp < 0) { \
+        dest = (src2 + (1 << (-1 - tmp))) >> -tmp; \
+    } else { \
+        dest = src2 << tmp; \
+        if ((dest >> tmp) != src2) { \
+            env->QF = 1; \
+            dest = src2 >> 31; \
+        } \
+    }} while (0)
+NEON_VOP(qrshl_u8, neon_u8, 4)
+NEON_VOP(qrshl_u16, neon_u16, 2)
+NEON_VOP(qrshl_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = (src1 > src2) ? src1 : src2
+NEON_VOP(max_s8, neon_s8, 4)
+NEON_VOP(max_u8, neon_u8, 4)
+NEON_VOP(max_s16, neon_s16, 2)
+NEON_VOP(max_u16, neon_u16, 2)
+NEON_VOP(max_s32, neon_s32, 1)
+NEON_VOP(max_u32, neon_u32, 1)
+NEON_POP(pmax_s8, neon_s8, 4)
+NEON_POP(pmax_u8, neon_u8, 4)
+NEON_POP(pmax_s16, neon_s16, 2)
+NEON_POP(pmax_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(max_f32)
+{
+    float32 f0 = vfp_itos(T0);
+    float32 f1 = vfp_itos(T1);
+    T0 = (float32_compare_quiet(f0, f1, NFS) == 1) ? T0 : T1;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 < src2) ? src1 : src2
+NEON_VOP(min_s8, neon_s8, 4)
+NEON_VOP(min_u8, neon_u8, 4)
+NEON_VOP(min_s16, neon_s16, 2)
+NEON_VOP(min_u16, neon_u16, 2)
+NEON_VOP(min_s32, neon_s32, 1)
+NEON_VOP(min_u32, neon_u32, 1)
+NEON_POP(pmin_s8, neon_s8, 4)
+NEON_POP(pmin_u8, neon_u8, 4)
+NEON_POP(pmin_s16, neon_s16, 2)
+NEON_POP(pmin_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(min_f32)
+{
+    float32 f0 = vfp_itos(T0);
+    float32 f1 = vfp_itos(T1);
+    T0 = (float32_compare_quiet(f0, f1, NFS) == -1) ? T0 : T1;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) \
+    dest = (src1 > src2) ? (src1 - src2) : (src2 - src1)
+NEON_VOP(abd_s8, neon_s8, 4)
+NEON_VOP(abd_u8, neon_u8, 4)
+NEON_VOP(abd_s16, neon_s16, 2)
+NEON_VOP(abd_u16, neon_u16, 2)
+NEON_VOP(abd_s32, neon_s32, 1)
+NEON_VOP(abd_u32, neon_u32, 1)
+#undef NEON_FN
+
+NEON_OP(abd_f32)
+{
+    float32 f0 = vfp_itos(T0);
+    float32 f1 = vfp_itos(T1);
+    T0 = vfp_stoi((float32_compare_quiet(f0, f1, NFS) == 1)
+                  ? float32_sub(f0, f1, NFS)
+                  : float32_sub(f1, f0, NFS));
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = src1 + src2
+NEON_VOP(add_u8, neon_u8, 4)
+NEON_VOP(add_u16, neon_u16, 2)
+NEON_POP(padd_u8, neon_u8, 4)
+NEON_POP(padd_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(add_f32)
+{
+    T0 = vfp_stoi(float32_add(vfp_itos(T0), vfp_itos(T1), NFS));
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = src1 - src2
+NEON_VOP(sub_u8, neon_u8, 4)
+NEON_VOP(sub_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(sub_f32)
+{
+    T0 = vfp_stoi(float32_sub(vfp_itos(T0), vfp_itos(T1), NFS));
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = src2 - src1
+NEON_VOP(rsb_u8, neon_u8, 4)
+NEON_VOP(rsb_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(rsb_f32)
+{
+    T0 = vfp_stoi(float32_sub(vfp_itos(T1), vfp_itos(T0), NFS));
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = src1 * src2
+NEON_VOP(mul_u8, neon_u8, 4)
+NEON_VOP(mul_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(mul_f32)
+{
+    T0 = vfp_stoi(float32_mul(vfp_itos(T0), vfp_itos(T1), NFS));
+    FORCE_RET();
+}
+
+NEON_OP(mul_p8)
+{
+    T0 = helper_neon_mul_p8(T0, T1);
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 & src2) ? -1 : 0
+NEON_VOP(tst_u8, neon_u8, 4)
+NEON_VOP(tst_u16, neon_u16, 2)
+NEON_VOP(tst_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = (src1 == src2) ? -1 : 0
+NEON_VOP(ceq_u8, neon_u8, 4)
+NEON_VOP(ceq_u16, neon_u16, 2)
+NEON_VOP(ceq_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_QDMULH16(dest, src1, src2, round) do { \
+    uint32_t tmp = (int32_t)(int16_t) src1 * (int16_t) src2; \
+    if ((tmp ^ (tmp << 1)) & SIGNBIT) { \
+        env->QF = 1; \
+        tmp = (tmp >> 31) ^ ~SIGNBIT; \
+    } \
+    tmp <<= 1; \
+    if (round) { \
+        int32_t old = tmp; \
+        tmp += 1 << 15; \
+        if ((int32_t)tmp < old) { \
+            env->QF = 1; \
+            tmp = SIGNBIT - 1; \
+        } \
+    } \
+    dest = tmp >> 16; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_QDMULH16(dest, src1, src2, 0)
+NEON_VOP(qdmulh_s16, neon_s16, 2)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_QDMULH16(dest, src1, src2, 1)
+NEON_VOP(qrdmulh_s16, neon_s16, 2)
+#undef NEON_FN
+#undef NEON_QDMULH16
+
+#define SIGNBIT64 ((uint64_t)1 << 63)
+#define NEON_QDMULH32(dest, src1, src2, round) do { \
+    uint64_t tmp = (int64_t)(int32_t) src1 * (int32_t) src2; \
+    if ((tmp ^ (tmp << 1)) & SIGNBIT64) { \
+        env->QF = 1; \
+        tmp = (tmp >> 63) ^ ~SIGNBIT64; \
+    } else { \
+        tmp <<= 1; \
+    } \
+    if (round) { \
+        int64_t old = tmp; \
+        tmp += (int64_t)1 << 31; \
+        if ((int64_t)tmp < old) { \
+            env->QF = 1; \
+            tmp = SIGNBIT64 - 1; \
+        } \
+    } \
+    dest = tmp >> 32; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_QDMULH32(dest, src1, src2, 0)
+NEON_VOP(qdmulh_s32, neon_s32, 1)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_QDMULH32(dest, src1, src2, 1)
+NEON_VOP(qrdmulh_s32, neon_s32, 1)
+#undef NEON_FN
+#undef NEON_QDMULH32
+
+NEON_OP(recps_f32)
+{
+    T0 = vfp_stoi(helper_recps_f32(vfp_itos(T0), vfp_itos(T1)));
+    FORCE_RET();
+}
+
+NEON_OP(rsqrts_f32)
+{
+    T0 = vfp_stoi(helper_rsqrts_f32(vfp_itos(T0), vfp_itos(T1)));
+    FORCE_RET();
+}
+
+/* Floating point comparisons produce an integer result.  */
+#define NEON_VOP_FCMP(name, cmp) \
+NEON_OP(name) \
+{ \
+    if (float32_compare_quiet(vfp_itos(T0), vfp_itos(T1), NFS) cmp 0) \
+        T0 = -1; \
+    else \
+        T0 = 0; \
+    FORCE_RET(); \
+}
+
+NEON_VOP_FCMP(ceq_f32, ==)
+NEON_VOP_FCMP(cge_f32, >=)
+NEON_VOP_FCMP(cgt_f32, >)
+
+NEON_OP(acge_f32)
+{
+    float32 f0 = float32_abs(vfp_itos(T0));
+    float32 f1 = float32_abs(vfp_itos(T1));
+    T0 = (float32_compare_quiet(f0, f1,NFS) >= 0) ? -1 : 0;
+    FORCE_RET();
+}
+
+NEON_OP(acgt_f32)
+{
+    float32 f0 = float32_abs(vfp_itos(T0));
+    float32 f1 = float32_abs(vfp_itos(T1));
+    T0 = (float32_compare_quiet(f0, f1, NFS) > 0) ? -1 : 0;
+    FORCE_RET();
+}
+
+/* Narrowing instructions.  The named type is the destination type.  */
+NEON_OP(narrow_u8)
+{
+    T0 = (T0 & 0xff) | ((T0 >> 8) & 0xff00)
+         | ((T1 << 16) & 0xff0000) | (T1 << 24);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_sat_u8)
+{
+    neon_u16 src;
+    neon_u8 dest;
+#define SAT8(d, s) \
+    if (s > 0xff) { \
+        d = 0xff; \
+        env->QF = 1; \
+    } else  { \
+        d = s; \
+    }
+
+    NEON_UNPACK(neon_u16, src, T0);
+    SAT8(dest.v1, src.v1);
+    SAT8(dest.v2, src.v2);
+    NEON_UNPACK(neon_u16, src, T1);
+    SAT8(dest.v3, src.v1);
+    SAT8(dest.v4, src.v2);
+    NEON_PACK(neon_u8, T0, dest);
+    FORCE_RET();
+#undef SAT8
+}
+
+NEON_OP(narrow_sat_s8)
+{
+    neon_s16 src;
+    neon_s8 dest;
+#define SAT8(d, s) \
+    if (s != (uint8_t)s) { \
+        d = (s >> 15) ^ 0x7f; \
+        env->QF = 1; \
+    } else  { \
+        d = s; \
+    }
+
+    NEON_UNPACK(neon_s16, src, T0);
+    SAT8(dest.v1, src.v1);
+    SAT8(dest.v2, src.v2);
+    NEON_UNPACK(neon_s16, src, T1);
+    SAT8(dest.v3, src.v1);
+    SAT8(dest.v4, src.v2);
+    NEON_PACK(neon_s8, T0, dest);
+    FORCE_RET();
+#undef SAT8
+}
+
+NEON_OP(narrow_u16)
+{
+    T0 = (T0 & 0xffff) | (T1 << 16);
+}
+
+NEON_OP(narrow_sat_u16)
+{
+    if (T0 > 0xffff) {
+        T0 = 0xffff;
+        env->QF = 1;
+    }
+    if (T1 > 0xffff) {
+        T1 = 0xffff;
+        env->QF = 1;
+    }
+    T0 |= T1 << 16;
+    FORCE_RET();
+}
+
+NEON_OP(narrow_sat_s16)
+{
+    if ((int32_t)T0 != (int16_t)T0) {
+        T0 = ((int32_t)T0 >> 31) ^ 0x7fff;
+        env->QF = 1;
+    }
+    if ((int32_t)T1 != (int16_t) T1) {
+        T1 = ((int32_t)T1 >> 31) ^ 0x7fff;
+        env->QF = 1;
+    }
+    T0 = (uint16_t)T0 | (T1 << 16);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_sat_u32)
+{
+    if (T1) {
+        T0 = 0xffffffffu;
+        env->QF = 1;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(narrow_sat_s32)
+{
+    int32_t sign = (int32_t)T1 >> 31;
+
+    if ((int32_t)T1 != sign) {
+        T0 = sign ^ 0x7fffffff;
+        env->QF = 1;
+    }
+    FORCE_RET();
+}
+
+/* Narrowing instructions.  Named type is the narrow type.  */
+NEON_OP(narrow_high_u8)
+{
+    T0 = ((T0 >> 8) & 0xff) | ((T0 >> 16) & 0xff00)
+        | ((T1 << 8) & 0xff0000) | (T1 & 0xff000000);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_high_u16)
+{
+    T0 = (T0 >> 16) | (T1 & 0xffff0000);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_high_round_u8)
+{
+    T0 = (((T0 + 0x80) >> 8) & 0xff) | (((T0 + 0x800000) >> 16) & 0xff00)
+        | (((T1 + 0x80) << 8) & 0xff0000) | ((T1 + 0x800000) & 0xff000000);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_high_round_u16)
+{
+    T0 = ((T0 + 0x8000) >> 16) | ((T1 + 0x8000) & 0xffff0000);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_high_round_u32)
+{
+    if (T0 >= 0x80000000u)
+        T0 = T1 + 1;
+    else
+        T0 = T1;
+    FORCE_RET();
+}
+
+/* Widening instructions.  Named type is source type.  */
+NEON_OP(widen_s8)
+{
+    uint32_t src;
+
+    src = T0;
+    T0 = (uint16_t)(int8_t)src | ((int8_t)(src >> 8) << 16);
+    T1 = (uint16_t)(int8_t)(src >> 16) | ((int8_t)(src >> 24) << 16);
+}
+
+NEON_OP(widen_u8)
+{
+    T1 = ((T0 >> 8) & 0xff0000) | ((T0 >> 16) & 0xff);
+    T0 = ((T0 << 8) & 0xff0000) | (T0 & 0xff);
+}
+
+NEON_OP(widen_s16)
+{
+    int32_t src;
+
+    src = T0;
+    T0 = (int16_t)src;
+    T1 = src >> 16;
+}
+
+NEON_OP(widen_u16)
+{
+    T1 = T0 >> 16;
+    T0 &= 0xffff;
+}
+
+NEON_OP(widen_s32)
+{
+    T1 = (int32_t)T0 >> 31;
+    FORCE_RET();
+}
+
+NEON_OP(widen_high_u8)
+{
+    T1 = (T0 & 0xff000000) | ((T0 >> 8) & 0xff00);
+    T0 = ((T0 << 16) & 0xff000000) | ((T0 << 8) & 0xff00);
+}
+
+NEON_OP(widen_high_u16)
+{
+    T1 = T0 & 0xffff0000;
+    T0 <<= 16;
+}
+
+/* Long operations.  The type is the wide type.  */
+NEON_OP(shll_u16)
+{
+    int shift = PARAM1;
+    uint32_t mask;
+
+    mask = 0xffff >> (16 - shift);
+    mask |= mask << 16;
+    mask = ~mask;
+
+    T0 = (T0 << shift) & mask;
+    T1 = (T1 << shift) & mask;
+    FORCE_RET();
+}
+
+NEON_OP(shll_u64)
+{
+    int shift = PARAM1;
+
+    T1 <<= shift;
+    T1 |= T0 >> (32 - shift);
+    T0 <<= shift;
+    FORCE_RET();
+}
+
+NEON_OP(addl_u16)
+{
+    uint32_t tmp;
+    uint32_t high;
+
+    tmp = env->vfp.scratch[0];
+    high = (T0 >> 16) + (tmp >> 16);
+    T0 = (uint16_t)(T0 + tmp);
+    T0 |= (high << 16);
+    tmp = env->vfp.scratch[1];
+    high = (T1 >> 16) + (tmp >> 16);
+    T1 = (uint16_t)(T1 + tmp);
+    T1 |= (high << 16);
+    FORCE_RET();
+}
+
+NEON_OP(addl_u32)
+{
+    T0 += env->vfp.scratch[0];
+    T1 += env->vfp.scratch[1];
+    FORCE_RET();
+}
+
+NEON_OP(addl_u64)
+{
+    uint64_t tmp;
+    tmp = T0 | ((uint64_t)T1 << 32);
+    tmp += env->vfp.scratch[0];
+    tmp += (uint64_t)env->vfp.scratch[1] << 32;
+    T0 = tmp;
+    T1 = tmp >> 32;
+    FORCE_RET();
+}
+
+NEON_OP(subl_u16)
+{
+    uint32_t tmp;
+    uint32_t high;
+
+    tmp = env->vfp.scratch[0];
+    high = (T0 >> 16) - (tmp >> 16);
+    T0 = (uint16_t)(T0 - tmp);
+    T0 |= (high << 16);
+    tmp = env->vfp.scratch[1];
+    high = (T1 >> 16) - (tmp >> 16);
+    T1 = (uint16_t)(T1 - tmp);
+    T1 |= (high << 16);
+    FORCE_RET();
+}
+
+NEON_OP(subl_u32)
+{
+    T0 -= env->vfp.scratch[0];
+    T1 -= env->vfp.scratch[1];
+    FORCE_RET();
+}
+
+NEON_OP(subl_u64)
+{
+    uint64_t tmp;
+    tmp = T0 | ((uint64_t)T1 << 32);
+    tmp -= env->vfp.scratch[0];
+    tmp -= (uint64_t)env->vfp.scratch[1] << 32;
+    T0 = tmp;
+    T1 = tmp >> 32;
+    FORCE_RET();
+}
+
+#define DO_ABD(dest, x, y, type) do { \
+    type tmp_x = x; \
+    type tmp_y = y; \
+    dest = ((tmp_x > tmp_y) ? tmp_x - tmp_y : tmp_y - tmp_x); \
+    } while(0)
+
+NEON_OP(abdl_u16)
+{
+    uint32_t tmp;
+    uint32_t low;
+    uint32_t high;
+
+    DO_ABD(low, T0, T1, uint8_t);
+    DO_ABD(tmp, T0 >> 8, T1 >> 8, uint8_t);
+    low |= tmp << 16;
+    DO_ABD(high, T0 >> 16, T1 >> 16, uint8_t);
+    DO_ABD(tmp, T0 >> 24, T1 >> 24, uint8_t);
+    high |= tmp << 16;
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(abdl_s16)
+{
+    uint32_t tmp;
+    uint32_t low;
+    uint32_t high;
+
+    DO_ABD(low, T0, T1, int8_t);
+    DO_ABD(tmp, T0 >> 8, T1 >> 8, int8_t);
+    low |= tmp << 16;
+    DO_ABD(high, T0 >> 16, T1 >> 16, int8_t);
+    DO_ABD(tmp, T0 >> 24, T1 >> 24, int8_t);
+    high |= tmp << 16;
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(abdl_u32)
+{
+    uint32_t low;
+    uint32_t high;
+
+    DO_ABD(low, T0, T1, uint16_t);
+    DO_ABD(high, T0 >> 16, T1 >> 16, uint16_t);
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(abdl_s32)
+{
+    uint32_t low;
+    uint32_t high;
+
+    DO_ABD(low, T0, T1, int16_t);
+    DO_ABD(high, T0 >> 16, T1 >> 16, int16_t);
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(abdl_u64)
+{
+    DO_ABD(T0, T0, T1, uint32_t);
+    T1 = 0;
+}
+
+NEON_OP(abdl_s64)
+{
+    DO_ABD(T0, T0, T1, int32_t);
+    T1 = 0;
+}
+#undef DO_ABD
+
+/* Widening multiple. Named type is the source type.  */
+#define DO_MULL(dest, x, y, type1, type2) do { \
+    type1 tmp_x = x; \
+    type1 tmp_y = y; \
+    dest = (type2)((type2)tmp_x * (type2)tmp_y); \
+    } while(0)
+
+NEON_OP(mull_u8)
+{
+    uint32_t tmp;
+    uint32_t low;
+    uint32_t high;
+
+    DO_MULL(low, T0, T1, uint8_t, uint16_t);
+    DO_MULL(tmp, T0 >> 8, T1 >> 8, uint8_t, uint16_t);
+    low |= tmp << 16;
+    DO_MULL(high, T0 >> 16, T1 >> 16, uint8_t, uint16_t);
+    DO_MULL(tmp, T0 >> 24, T1 >> 24, uint8_t, uint16_t);
+    high |= tmp << 16;
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(mull_s8)
+{
+    uint32_t tmp;
+    uint32_t low;
+    uint32_t high;
+
+    DO_MULL(low, T0, T1, int8_t, uint16_t);
+    DO_MULL(tmp, T0 >> 8, T1 >> 8, int8_t, uint16_t);
+    low |= tmp << 16;
+    DO_MULL(high, T0 >> 16, T1 >> 16, int8_t, uint16_t);
+    DO_MULL(tmp, T0 >> 24, T1 >> 24, int8_t, uint16_t);
+    high |= tmp << 16;
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(mull_u16)
+{
+    uint32_t low;
+    uint32_t high;
+
+    DO_MULL(low, T0, T1, uint16_t, uint32_t);
+    DO_MULL(high, T0 >> 16, T1 >> 16, uint16_t, uint32_t);
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(mull_s16)
+{
+    uint32_t low;
+    uint32_t high;
+
+    DO_MULL(low, T0, T1, int16_t, uint32_t);
+    DO_MULL(high, T0 >> 16, T1 >> 16, int16_t, uint32_t);
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(addl_saturate_s32)
+{
+    uint32_t tmp;
+    uint32_t res;
+
+    tmp = env->vfp.scratch[0];
+    res = T0 + tmp;
+    if (((res ^ T0) & SIGNBIT) && !((T0 ^ tmp) & SIGNBIT)) {
+        env->QF = 1;
+        T0 = (T0 >> 31) ^ 0x7fffffff;
+    } else {
+      T0 = res;
+    }
+    tmp = env->vfp.scratch[1];
+    res = T1 + tmp;
+    if (((res ^ T1) & SIGNBIT) && !((T1 ^ tmp) & SIGNBIT)) {
+        env->QF = 1;
+        T1 = (T1 >> 31) ^ 0x7fffffff;
+    } else {
+      T1 = res;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(addl_saturate_s64)
+{
+    uint64_t src1;
+    uint64_t src2;
+    uint64_t res;
+
+    src1 = T0 + ((uint64_t)T1 << 32);
+    src2 = env->vfp.scratch[0] + ((uint64_t)env->vfp.scratch[1] << 32);
+    res = src1 + src2;
+    if (((res ^ src1) & SIGNBIT64) && !((src1 ^ src2) & SIGNBIT64)) {
+        env->QF = 1;
+        T0 = ~(int64_t)src1 >> 63;
+        T1 = T0 ^ 0x80000000;
+    } else {
+      T0 = res;
+      T1 = res >> 32;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(addl_saturate_u64)
+{
+    uint64_t src1;
+    uint64_t src2;
+    uint64_t res;
+
+    src1 = T0 + ((uint64_t)T1 << 32);
+    src2 = env->vfp.scratch[0] + ((uint64_t)env->vfp.scratch[1] << 32);
+    res = src1 + src2;
+    if (res < src1) {
+        env->QF = 1;
+        T0 = 0xffffffff;
+        T1 = 0xffffffff;
+    } else {
+      T0 = res;
+      T1 = res >> 32;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(subl_saturate_s64)
+{
+    uint64_t src1;
+    uint64_t src2;
+    uint64_t res;
+
+    src1 = T0 + ((uint64_t)T1 << 32);
+    src2 = env->vfp.scratch[0] + ((uint64_t)env->vfp.scratch[1] << 32);
+    res = src1 - src2;
+    if (((res ^ src1) & SIGNBIT64) && ((src1 ^ src2) & SIGNBIT64)) {
+        env->QF = 1;
+        T0 = ~(int64_t)src1 >> 63;
+        T1 = T0 ^ 0x80000000;
+    } else {
+      T0 = res;
+      T1 = res >> 32;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(subl_saturate_u64)
+{
+    uint64_t src1;
+    uint64_t src2;
+    uint64_t res;
+
+    src1 = T0 + ((uint64_t)T1 << 32);
+    src2 = env->vfp.scratch[0] + ((uint64_t)env->vfp.scratch[1] << 32);
+    if (src1 < src2) {
+        env->QF = 1;
+        T0 = 0;
+        T1 = 0;
+    } else {
+      res = src1 - src2;
+      T0 = res;
+      T1 = res >> 32;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(negl_u16)
+{
+    uint32_t tmp;
+    tmp = T0 >> 16;
+    tmp = -tmp;
+    T0 = (-T0 & 0xffff) | (tmp << 16);
+    tmp = T1 >> 16;
+    tmp = -tmp;
+    T1 = (-T1 & 0xffff) | (tmp << 16);
+    FORCE_RET();
+}
+
+NEON_OP(negl_u32)
+{
+    T0 = -T0;
+    T1 = -T1;
+    FORCE_RET();
+}
+
+NEON_OP(negl_u64)
+{
+    uint64_t val;
+
+    val = T0 | ((uint64_t)T1 << 32);
+    val = -val;
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+/* Scalar operations.  */
+NEON_OP(dup_low16)
+{
+    T0 = (T0 & 0xffff) | (T0 << 16);
+    FORCE_RET();
+}
+
+NEON_OP(dup_high16)
+{
+    T0 = (T0 >> 16) | (T0 & 0xffff0000);
+    FORCE_RET();
+}
+
+/* Helper for VEXT */
+NEON_OP(extract)
+{
+    int shift = PARAM1;
+    T0 = (T0 >> shift) | (T1 << (32 - shift));
+    FORCE_RET();
+}
+
+/* Pairwise add long.  Named type is source type.  */
+NEON_OP(paddl_s8)
+{
+    int8_t src1;
+    int8_t src2;
+    uint16_t result;
+    src1 = T0 >> 24;
+    src2 = T0 >> 16;
+    result = (uint16_t)src1 + src2;
+    src1 = T0 >> 8;
+    src2 = T0;
+    T0 = (uint16_t)((uint16_t)src1 + src2) | ((uint32_t)result << 16);
+    FORCE_RET();
+}
+
+NEON_OP(paddl_u8)
+{
+    uint8_t src1;
+    uint8_t src2;
+    uint16_t result;
+    src1 = T0 >> 24;
+    src2 = T0 >> 16;
+    result = (uint16_t)src1 + src2;
+    src1 = T0 >> 8;
+    src2 = T0;
+    T0 = (uint16_t)((uint16_t)src1 + src2) | ((uint32_t)result << 16);
+    FORCE_RET();
+}
+
+NEON_OP(paddl_s16)
+{
+    T0 = (uint32_t)(int16_t)T0 + (uint32_t)(int16_t)(T0 >> 16);
+    FORCE_RET();
+}
+
+NEON_OP(paddl_u16)
+{
+    T0 = (uint32_t)(uint16_t)T0 + (uint32_t)(uint16_t)(T0 >> 16);
+    FORCE_RET();
+}
+
+NEON_OP(paddl_s32)
+{
+    int64_t tmp;
+    tmp = (int64_t)(int32_t)T0 + (int64_t)(int32_t)T1;
+    T0 = tmp;
+    T1 = tmp >> 32;
+    FORCE_RET();
+}
+
+NEON_OP(paddl_u32)
+{
+    uint64_t tmp;
+    tmp = (uint64_t)T0 + (uint64_t)T1;
+    T0 = tmp;
+    T1 = tmp >> 32;
+    FORCE_RET();
+}
+
+/* Count Leading Sign/Zero Bits.  */
+static inline int do_clz8(uint8_t x)
+{
+    int n;
+    for (n = 8; x; n--)
+        x >>= 1;
+    return n;
+}
+
+static inline int do_clz16(uint16_t x)
+{
+    int n;
+    for (n = 16; x; n--)
+        x >>= 1;
+    return n;
+}
+
+NEON_OP(clz_u8)
+{
+    uint32_t result;
+    uint32_t tmp;
+
+    tmp = T0;
+    result = do_clz8(tmp);
+    result |= do_clz8(tmp >> 8) << 8;
+    result |= do_clz8(tmp >> 16) << 16;
+    result |= do_clz8(tmp >> 24) << 24;
+    T0 = result;
+    FORCE_RET();
+}
+
+NEON_OP(clz_u16)
+{
+    uint32_t result;
+    uint32_t tmp;
+    tmp = T0;
+    result = do_clz16(tmp);
+    result |= do_clz16(tmp >> 16) << 16;
+    T0 = result;
+    FORCE_RET();
+}
+
+NEON_OP(cls_s8)
+{
+    uint32_t result;
+    int8_t tmp;
+    tmp = T0;
+    result = do_clz8((tmp < 0) ? ~tmp : tmp) - 1;
+    tmp = T0 >> 8;
+    result |= (do_clz8((tmp < 0) ? ~tmp : tmp) - 1) << 8;
+    tmp = T0 >> 16;
+    result |= (do_clz8((tmp < 0) ? ~tmp : tmp) - 1) << 16;
+    tmp = T0 >> 24;
+    result |= (do_clz8((tmp < 0) ? ~tmp : tmp) - 1) << 24;
+    T0 = result;
+    FORCE_RET();
+}
+
+NEON_OP(cls_s16)
+{
+    uint32_t result;
+    int16_t tmp;
+    tmp = T0;
+    result = do_clz16((tmp < 0) ? ~tmp : tmp) - 1;
+    tmp = T0 >> 16;
+    result |= (do_clz16((tmp < 0) ? ~tmp : tmp) - 1) << 16;
+    T0 = result;
+    FORCE_RET();
+}
+
+NEON_OP(cls_s32)
+{
+    int count;
+    if ((int32_t)T0 < 0)
+        T0 = ~T0;
+    for (count = 32; T0 > 0; count--)
+        T0 = T0 >> 1;
+    T0 = count - 1;
+    FORCE_RET();
+}
+
+/* Bit count.  */
+NEON_OP(cnt_u8)
+{
+    T0 = (T0 & 0x55555555) + ((T0 >>  1) & 0x55555555);
+    T0 = (T0 & 0x33333333) + ((T0 >>  2) & 0x33333333);
+    T0 = (T0 & 0x0f0f0f0f) + ((T0 >>  4) & 0x0f0f0f0f);
+    FORCE_RET();
+}
+
+/* Saturnating negation.  */
+/* ??? Make these use NEON_VOP1 */
+#define DO_QABS8(x) do { \
+    if (x == (int8_t)0x80) { \
+        x = 0x7f; \
+        env->QF = 1; \
+    } else if (x < 0) { \
+        x = -x; \
+    }} while (0)
+NEON_OP(qabs_s8)
+{
+    neon_s8 vec;
+    NEON_UNPACK(neon_s8, vec, T0);
+    DO_QABS8(vec.v1);
+    DO_QABS8(vec.v2);
+    DO_QABS8(vec.v3);
+    DO_QABS8(vec.v4);
+    NEON_PACK(neon_s8, T0, vec);
+    FORCE_RET();
+}
+#undef DO_QABS8
+
+#define DO_QNEG8(x) do { \
+    if (x == (int8_t)0x80) { \
+        x = 0x7f; \
+        env->QF = 1; \
+    } else { \
+        x = -x; \
+    }} while (0)
+NEON_OP(qneg_s8)
+{
+    neon_s8 vec;
+    NEON_UNPACK(neon_s8, vec, T0);
+    DO_QNEG8(vec.v1);
+    DO_QNEG8(vec.v2);
+    DO_QNEG8(vec.v3);
+    DO_QNEG8(vec.v4);
+    NEON_PACK(neon_s8, T0, vec);
+    FORCE_RET();
+}
+#undef DO_QNEG8
+
+#define DO_QABS16(x) do { \
+    if (x == (int16_t)0x8000) { \
+        x = 0x7fff; \
+        env->QF = 1; \
+    } else if (x < 0) { \
+        x = -x; \
+    }} while (0)
+NEON_OP(qabs_s16)
+{
+    neon_s16 vec;
+    NEON_UNPACK(neon_s16, vec, T0);
+    DO_QABS16(vec.v1);
+    DO_QABS16(vec.v2);
+    NEON_PACK(neon_s16, T0, vec);
+    FORCE_RET();
+}
+#undef DO_QABS16
+
+#define DO_QNEG16(x) do { \
+    if (x == (int16_t)0x8000) { \
+        x = 0x7fff; \
+        env->QF = 1; \
+    } else { \
+        x = -x; \
+    }} while (0)
+NEON_OP(qneg_s16)
+{
+    neon_s16 vec;
+    NEON_UNPACK(neon_s16, vec, T0);
+    DO_QNEG16(vec.v1);
+    DO_QNEG16(vec.v2);
+    NEON_PACK(neon_s16, T0, vec);
+    FORCE_RET();
+}
+#undef DO_QNEG16
+
+NEON_OP(qabs_s32)
+{
+    if (T0 == 0x80000000) {
+        T0 = 0x7fffffff;
+        env->QF = 1;
+    } else if ((int32_t)T0 < 0) {
+        T0 = -T0;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(qneg_s32)
+{
+    if (T0 == 0x80000000) {
+        T0 = 0x7fffffff;
+        env->QF = 1;
+    } else {
+        T0 = -T0;
+    }
+    FORCE_RET();
+}
+
+/* Unary opperations */
+#define NEON_FN(dest, src, dummy) dest = (src < 0) ? -src : src
+NEON_VOP1(abs_s8, neon_s8, 4)
+NEON_VOP1(abs_s16, neon_s16, 2)
+NEON_OP(abs_s32)
+{
+    if ((int32_t)T0 < 0)
+        T0 = -T0;
+    FORCE_RET();
+}
+#undef NEON_FN
+
+/* Transpose.  Argument order is rather strange to avoid special casing
+   the tranlation code.
+   On input T0 = rm, T1 = rd.  On output T0 = rd, T1 = rm  */
+NEON_OP(trn_u8)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = ((T0 & 0x00ff00ff) << 8) | (T1 & 0x00ff00ff);
+    rm = ((T1 & 0xff00ff00) >> 8) | (T0 & 0xff00ff00);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+NEON_OP(trn_u16)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = (T0 << 16) | (T1 & 0xffff);
+    rm = (T1 >> 16) | (T0 & 0xffff0000);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+/* Worker routines for zip and unzip.  */
+NEON_OP(unzip_u8)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = (T0 & 0xff) | ((T0 >> 8) & 0xff00)
+         | ((T1 << 16) & 0xff0000) | ((T1 << 8) & 0xff000000);
+    rm = ((T0 >> 8) & 0xff) | ((T0 >> 16) & 0xff00)
+         | ((T1 << 8) & 0xff0000) | (T1 & 0xff000000);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+NEON_OP(zip_u8)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = (T0 & 0xff) | ((T1 << 8) & 0xff00)
+         | ((T0 << 16) & 0xff0000) | ((T1 << 24) & 0xff000000);
+    rm = ((T0 >> 16) & 0xff) | ((T1 >> 8) & 0xff00)
+         | ((T0 >> 8) & 0xff0000) | (T1 & 0xff000000);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+NEON_OP(zip_u16)
+{
+    uint32_t tmp;
+
+    tmp = (T0 & 0xffff) | (T1 << 16);
+    T1 = (T1 & 0xffff0000) | (T0 >> 16);
+    T0 = tmp;
+    FORCE_RET();
+}
+
+/* Reciprocal/root estimate.  */
+NEON_OP(recpe_u32)
+{
+    T0 = helper_recpe_u32(T0);
+}
+
+NEON_OP(rsqrte_u32)
+{
+    T0 = helper_rsqrte_u32(T0);
+}
+
+NEON_OP(recpe_f32)
+{
+    FT0s = helper_recpe_f32(FT0s);
+}
+
+NEON_OP(rsqrte_f32)
+{
+    FT0s = helper_rsqrte_f32(FT0s);
+}
+
+/* Table lookup.  This accessed the register file directly.  */
+NEON_OP(tbl)
+{
+    helper_neon_tbl(PARAM1, PARAM2);
+}
+
+NEON_OP(dup_u8)
+{
+    T0 = (T0 >> PARAM1) & 0xff;
+    T0 |= T0 << 8;
+    T0 |= T0 << 16;
+    FORCE_RET();
+}
+
+/* Helpers for element load/store.  */
+NEON_OP(insert_elt)
+{
+    int shift = PARAM1;
+    uint32_t mask = PARAM2;
+    T2 = (T2 & mask) | (T0 << shift);
+    FORCE_RET();
+}
+
+NEON_OP(extract_elt)
+{
+    int shift = PARAM1;
+    uint32_t mask = PARAM2;
+    T0 = (T2 & mask) >> shift;
+    FORCE_RET();
+}
diff --git a/target-arm/translate.c b/target-arm/translate.c
index bb01f2f34..513b17987 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -2,7 +2,7 @@
  *  ARM translation
  *
  *  Copyright (c) 2003 Fabrice Bellard
- *  Copyright (c) 2005 CodeSourcery, LLC
+ *  Copyright (c) 2005-2007 CodeSourcery
  *  Copyright (c) 2007 OpenedHand, Ltd.
  *
  * This library is free software; you can redistribute it and/or
@@ -29,9 +29,11 @@
 #include "exec-all.h"
 #include "disas.h"
 
-#define ENABLE_ARCH_5J  0
-#define ENABLE_ARCH_6   1
-#define ENABLE_ARCH_6T2 1
+#define ENABLE_ARCH_5J    0
+#define ENABLE_ARCH_6     arm_feature(env, ARM_FEATURE_V6)
+#define ENABLE_ARCH_6K   arm_feature(env, ARM_FEATURE_V6K)
+#define ENABLE_ARCH_6T2   arm_feature(env, ARM_FEATURE_THUMB2)
+#define ENABLE_ARCH_7     arm_feature(env, ARM_FEATURE_V7)
 
 #define ARCH(x) if (!ENABLE_ARCH_##x) goto illegal_op;
 
@@ -43,6 +45,9 @@ typedef struct DisasContext {
     int condjmp;
     /* The label that will be jumped to when the instruction is skipped.  */
     int condlabel;
+    /* Thumb-2 condtional execution bits.  */
+    int condexec_mask;
+    int condexec_cond;
     struct TranslationBlock *tb;
     int singlestep_enabled;
     int thumb;
@@ -58,7 +63,10 @@ typedef struct DisasContext {
 #define IS_USER(s) (s->user)
 #endif
 
-#define DISAS_JUMP_NEXT 4
+/* These instructions trap after executing, so defer them until after the
+   conditional executions state has been updated.  */
+#define DISAS_WFI 4
+#define DISAS_SWI 5
 
 #ifdef USE_DIRECT_JUMP
 #define TBPARAM(x)
@@ -81,6 +89,51 @@ enum {
 
 #include "gen-op.h"
 
+#define PAS_OP(pfx) {  \
+    gen_op_ ## pfx ## add16_T0_T1, \
+    gen_op_ ## pfx ## addsubx_T0_T1, \
+    gen_op_ ## pfx ## subaddx_T0_T1, \
+    gen_op_ ## pfx ## sub16_T0_T1, \
+    gen_op_ ## pfx ## add8_T0_T1, \
+    NULL, \
+    NULL, \
+    gen_op_ ## pfx ## sub8_T0_T1 }
+
+static GenOpFunc *gen_arm_parallel_addsub[8][8] = {
+    {},
+    PAS_OP(s),
+    PAS_OP(q),
+    PAS_OP(sh),
+    {},
+    PAS_OP(u),
+    PAS_OP(uq),
+    PAS_OP(uh),
+};
+#undef PAS_OP
+
+/* For unknown reasons Arm and Thumb-2 use arbitrarily diffenet encodings.  */
+#define PAS_OP(pfx) {  \
+    gen_op_ ## pfx ## add8_T0_T1, \
+    gen_op_ ## pfx ## add16_T0_T1, \
+    gen_op_ ## pfx ## addsubx_T0_T1, \
+    NULL, \
+    gen_op_ ## pfx ## sub8_T0_T1, \
+    gen_op_ ## pfx ## sub16_T0_T1, \
+    gen_op_ ## pfx ## subaddx_T0_T1, \
+    NULL }
+
+static GenOpFunc *gen_thumb2_parallel_addsub[8][8] = {
+    PAS_OP(s),
+    PAS_OP(q),
+    PAS_OP(sh),
+    {},
+    PAS_OP(u),
+    PAS_OP(uq),
+    PAS_OP(uh),
+    {}
+};
+#undef PAS_OP
+
 static GenOpFunc1 *gen_test_cc[14] = {
     gen_op_test_eq,
     gen_op_test_ne,
@@ -275,6 +328,12 @@ static GenOpFunc1 *gen_op_movl_TN_im[3] = {
     gen_op_movl_T2_im,
 };
 
+static GenOpFunc1 *gen_shift_T0_im_thumb_cc[3] = {
+    gen_op_shll_T0_im_thumb_cc,
+    gen_op_shrl_T0_im_thumb_cc,
+    gen_op_sarl_T0_im_thumb_cc,
+};
+
 static GenOpFunc1 *gen_shift_T0_im_thumb[3] = {
     gen_op_shll_T0_im_thumb,
     gen_op_shrl_T0_im_thumb,
@@ -421,6 +480,15 @@ static inline void gen_vfp_##name(int dp) \
         gen_op_vfp_##name##s();           \
 }
 
+#define VFP_OP1(name)                               \
+static inline void gen_vfp_##name(int dp, int arg)  \
+{                                                   \
+    if (dp)                                         \
+        gen_op_vfp_##name##d(arg);                  \
+    else                                            \
+        gen_op_vfp_##name##s(arg);                  \
+}
+
 VFP_OP(add)
 VFP_OP(sub)
 VFP_OP(mul)
@@ -437,9 +505,25 @@ VFP_OP(toui)
 VFP_OP(touiz)
 VFP_OP(tosi)
 VFP_OP(tosiz)
+VFP_OP1(tosh)
+VFP_OP1(tosl)
+VFP_OP1(touh)
+VFP_OP1(toul)
+VFP_OP1(shto)
+VFP_OP1(slto)
+VFP_OP1(uhto)
+VFP_OP1(ulto)
 
 #undef VFP_OP
 
+static inline void gen_vfp_fconst(int dp, uint32_t val)
+{
+    if (dp)
+        gen_op_vfp_fconstd(val);
+    else
+        gen_op_vfp_fconsts(val);
+}
+
 static inline void gen_vfp_ld(DisasContext *s, int dp)
 {
     if (dp)
@@ -469,6 +553,20 @@ vfp_reg_offset (int dp, int reg)
           + offsetof(CPU_DoubleU, l.lower);
     }
 }
+
+/* Return the offset of a 32-bit piece of a NEON register.
+   zero is the least significant end of the register.  */
+static inline long
+neon_reg_offset (int reg, int n)
+{
+    int sreg;
+    sreg = reg * 2 + n;
+    return vfp_reg_offset(0, sreg);
+}
+
+#define NEON_GET_REG(T, reg, n) gen_op_neon_getreg_##T(neon_reg_offset(reg, n))
+#define NEON_SET_REG(T, reg, n) gen_op_neon_setreg_##T(neon_reg_offset(reg, n))
+
 static inline void gen_mov_F0_vreg(int dp, int reg)
 {
     if (dp)
@@ -1582,14 +1680,49 @@ static int disas_cp_insn(CPUState *env, DisasContext *s, uint32_t insn)
     return 0;
 }
 
+static int cp15_user_ok(uint32_t insn)
+{
+    int cpn = (insn >> 16) & 0xf;
+    int cpm = insn & 0xf;
+    int op = ((insn >> 5) & 7) | ((insn >> 18) & 0x38);
+
+    if (cpn == 13 && cpm == 0) {
+        /* TLS register.  */
+        if (op == 2 || (op == 3 && (insn & ARM_CP_RW_BIT)))
+            return 1;
+    }
+    if (cpn == 7) {
+        /* ISB, DSB, DMB.  */
+        if ((cpm == 5 && op == 4)
+                || (cpm == 10 && (op == 4 || op == 5)))
+            return 1;
+    }
+    return 0;
+}
+
 /* Disassemble system coprocessor (cp15) instruction.  Return nonzero if
    instruction is not defined.  */
 static int disas_cp15_insn(CPUState *env, DisasContext *s, uint32_t insn)
 {
     uint32_t rd;
 
-    /* ??? Some cp15 registers are accessible from userspace.  */
-    if (IS_USER(s)) {
+    /* M profile cores use memory mapped registers instead of cp15.  */
+    if (arm_feature(env, ARM_FEATURE_M))
+	return 1;
+
+    if ((insn & (1 << 25)) == 0) {
+        if (insn & (1 << 20)) {
+            /* mrrc */
+            return 1;
+        }
+        /* mcrr.  Used for block cache operations, so implement as no-op.  */
+        return 0;
+    }
+    if ((insn & (1 << 4)) == 0) {
+        /* cdp */
+        return 1;
+    }
+    if (IS_USER(s) && !cp15_user_ok(insn)) {
         return 1;
     }
     if ((insn & 0x0fff0fff) == 0x0e070f90
@@ -1597,8 +1730,7 @@ static int disas_cp15_insn(CPUState *env, DisasContext *s, uint32_t insn)
         /* Wait for interrupt.  */
         gen_op_movl_T0_im((long)s->pc);
         gen_op_movl_reg_TN[0][15]();
-        gen_op_wfi();
-        s->is_jmp = DISAS_JUMP;
+        s->is_jmp = DISAS_WFI;
         return 0;
     }
     rd = (insn >> 12) & 0xf;
@@ -1620,6 +1752,32 @@ static int disas_cp15_insn(CPUState *env, DisasContext *s, uint32_t insn)
     return 0;
 }
 
+#define VFP_REG_SHR(x, n) (((n) > 0) ? (x) >> (n) : (x) << -(n))
+#define VFP_SREG(insn, bigbit, smallbit) \
+  ((VFP_REG_SHR(insn, bigbit - 1) & 0x1e) | (((insn) >> (smallbit)) & 1))
+#define VFP_DREG(reg, insn, bigbit, smallbit) do { \
+    if (arm_feature(env, ARM_FEATURE_VFP3)) { \
+        reg = (((insn) >> (bigbit)) & 0x0f) \
+              | (((insn) >> ((smallbit) - 4)) & 0x10); \
+    } else { \
+        if (insn & (1 << (smallbit))) \
+            return 1; \
+        reg = ((insn) >> (bigbit)) & 0x0f; \
+    }} while (0)
+
+#define VFP_SREG_D(insn) VFP_SREG(insn, 12, 22)
+#define VFP_DREG_D(reg, insn) VFP_DREG(reg, insn, 12, 22)
+#define VFP_SREG_N(insn) VFP_SREG(insn, 16,  7)
+#define VFP_DREG_N(reg, insn) VFP_DREG(reg, insn, 16,  7)
+#define VFP_SREG_M(insn) VFP_SREG(insn,  0,  5)
+#define VFP_DREG_M(reg, insn) VFP_DREG(reg, insn,  0,  5)
+
+static inline int
+vfp_enabled(CPUState * env)
+{
+    return ((env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) != 0);
+}
+
 /* Disassemble a VFP instruction.  Returns nonzero if an error occured
    (ie. an undefined instruction).  */
 static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
@@ -1630,12 +1788,13 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
     if (!arm_feature(env, ARM_FEATURE_VFP))
         return 1;
 
-    if ((env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) == 0) {
-        /* VFP disabled.  Only allow fmxr/fmrx to/from fpexc and fpsid.  */
+    if (!vfp_enabled(env)) {
+        /* VFP disabled.  Only allow fmxr/fmrx to/from some control regs.  */
         if ((insn & 0x0fe00fff) != 0x0ee00a10)
             return 1;
         rn = (insn >> 16) & 0xf;
-        if (rn != 0 && rn != 8)
+        if (rn != ARM_VFP_FPSID && rn != ARM_VFP_FPEXC
+            && rn != ARM_VFP_MVFR1 && rn != ARM_VFP_MVFR0)
             return 1;
     }
     dp = ((insn & 0xf00) == 0xb00);
@@ -1643,44 +1802,129 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
     case 0xe:
         if (insn & (1 << 4)) {
             /* single register transfer */
-            if ((insn & 0x6f) != 0x00)
-                return 1;
             rd = (insn >> 12) & 0xf;
             if (dp) {
-                if (insn & 0x80)
+                int size;
+                int pass;
+
+                VFP_DREG_N(rn, insn);
+                if (insn & 0xf)
                     return 1;
-                rn = (insn >> 16) & 0xf;
-                /* Get the existing value even for arm->vfp moves because
-                   we only set half the register.  */
-                gen_mov_F0_vreg(1, rn);
-                gen_op_vfp_mrrd();
+                if (insn & 0x00c00060
+                    && !arm_feature(env, ARM_FEATURE_NEON))
+                    return 1;
+
+                pass = (insn >> 21) & 1;
+                if (insn & (1 << 22)) {
+                    size = 0;
+                    offset = ((insn >> 5) & 3) * 8;
+                } else if (insn & (1 << 5)) {
+                    size = 1;
+                    offset = (insn & (1 << 6)) ? 16 : 0;
+                } else {
+                    size = 2;
+                    offset = 0;
+                }
                 if (insn & ARM_CP_RW_BIT) {
                     /* vfp->arm */
-                    if (insn & (1 << 21))
-                        gen_movl_reg_T1(s, rd);
-                    else
-                        gen_movl_reg_T0(s, rd);
+                    switch (size) {
+                    case 0:
+                        NEON_GET_REG(T1, rn, pass);
+                        if (offset)
+                            gen_op_shrl_T1_im(offset);
+                        if (insn & (1 << 23))
+                            gen_op_uxtb_T1();
+                        else
+                            gen_op_sxtb_T1();
+                        break;
+                    case 1:
+                        NEON_GET_REG(T1, rn, pass);
+                        if (insn & (1 << 23)) {
+                            if (offset) {
+                                gen_op_shrl_T1_im(16);
+                            } else {
+                                gen_op_uxth_T1();
+                            }
+                        } else {
+                            if (offset) {
+                                gen_op_sarl_T1_im(16);
+                            } else {
+                                gen_op_sxth_T1();
+                            }
+                        }
+                        break;
+                    case 2:
+                        NEON_GET_REG(T1, rn, pass);
+                        break;
+                    }
+                    gen_movl_reg_T1(s, rd);
                 } else {
                     /* arm->vfp */
-                    if (insn & (1 << 21))
-                        gen_movl_T1_reg(s, rd);
-                    else
-                        gen_movl_T0_reg(s, rd);
-                    gen_op_vfp_mdrr();
-                    gen_mov_vreg_F0(dp, rn);
+                    gen_movl_T0_reg(s, rd);
+                    if (insn & (1 << 23)) {
+                        /* VDUP */
+                        if (size == 0) {
+                            gen_op_neon_dup_u8(0);
+                        } else if (size == 1) {
+                            gen_op_neon_dup_low16();
+                        }
+                        NEON_SET_REG(T0, rn, 0);
+                        NEON_SET_REG(T0, rn, 1);
+                    } else {
+                        /* VMOV */
+                        switch (size) {
+                        case 0:
+                            NEON_GET_REG(T2, rn, pass);
+                            gen_op_movl_T1_im(0xff);
+                            gen_op_andl_T0_T1();
+                            gen_op_neon_insert_elt(offset, ~(0xff << offset));
+                            NEON_SET_REG(T2, rn, pass);
+                            break;
+                        case 1:
+                            NEON_GET_REG(T2, rn, pass);
+                            gen_op_movl_T1_im(0xffff);
+                            gen_op_andl_T0_T1();
+                            bank_mask = offset ? 0xffff : 0xffff0000;
+                            gen_op_neon_insert_elt(offset, bank_mask);
+                            NEON_SET_REG(T2, rn, pass);
+                            break;
+                        case 2:
+                            NEON_SET_REG(T0, rn, pass);
+                            break;
+                        }
+                    }
                 }
-            } else {
-                rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
+            } else { /* !dp */
+                if ((insn & 0x6f) != 0x00)
+                    return 1;
+                rn = VFP_SREG_N(insn);
                 if (insn & ARM_CP_RW_BIT) {
                     /* vfp->arm */
                     if (insn & (1 << 21)) {
                         /* system register */
                         rn >>= 1;
+
                         switch (rn) {
                         case ARM_VFP_FPSID:
+                            /* VFP2 allows access for FSID from userspace.
+                               VFP3 restricts all id registers to privileged
+                               accesses.  */
+                            if (IS_USER(s)
+                                && arm_feature(env, ARM_FEATURE_VFP3))
+                                return 1;
+                            gen_op_vfp_movl_T0_xreg(rn);
+                            break;
                         case ARM_VFP_FPEXC:
+                            if (IS_USER(s))
+                                return 1;
+                            gen_op_vfp_movl_T0_xreg(rn);
+                            break;
                         case ARM_VFP_FPINST:
                         case ARM_VFP_FPINST2:
+                            /* Not present in VFP3.  */
+                            if (IS_USER(s)
+                                || arm_feature(env, ARM_FEATURE_VFP3))
+                                return 1;
                             gen_op_vfp_movl_T0_xreg(rn);
                             break;
                         case ARM_VFP_FPSCR:
@@ -1689,6 +1933,13 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
 			    else
 				gen_op_vfp_movl_T0_fpscr();
                             break;
+                        case ARM_VFP_MVFR0:
+                        case ARM_VFP_MVFR1:
+                            if (IS_USER(s)
+                                || !arm_feature(env, ARM_FEATURE_VFP3))
+                                return 1;
+                            gen_op_vfp_movl_T0_xreg(rn);
+                            break;
                         default:
                             return 1;
                         }
@@ -1709,6 +1960,8 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                         /* system register */
                         switch (rn) {
                         case ARM_VFP_FPSID:
+                        case ARM_VFP_MVFR0:
+                        case ARM_VFP_MVFR1:
                             /* Writes are ignored.  */
                             break;
                         case ARM_VFP_FPSCR:
@@ -1716,6 +1969,8 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                             gen_lookup_tb(s);
                             break;
                         case ARM_VFP_FPEXC:
+                            if (IS_USER(s))
+                                return 1;
                             gen_op_vfp_movl_xreg_T0(rn);
                             gen_lookup_tb(s);
                             break;
@@ -1742,38 +1997,31 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                     rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
                 } else {
                     /* rn is register number */
-                    if (insn & (1 << 7))
-                        return 1;
-                    rn = (insn >> 16) & 0xf;
+                    VFP_DREG_N(rn, insn);
                 }
 
                 if (op == 15 && (rn == 15 || rn > 17)) {
                     /* Integer or single precision destination.  */
-                    rd = ((insn >> 11) & 0x1e) | ((insn >> 22) & 1);
+                    rd = VFP_SREG_D(insn);
                 } else {
-                    if (insn & (1 << 22))
-                        return 1;
-                    rd = (insn >> 12) & 0xf;
+                    VFP_DREG_D(rd, insn);
                 }
 
                 if (op == 15 && (rn == 16 || rn == 17)) {
                     /* Integer source.  */
                     rm = ((insn << 1) & 0x1e) | ((insn >> 5) & 1);
                 } else {
-                    if (insn & (1 << 5))
-                        return 1;
-                    rm = insn & 0xf;
+                    VFP_DREG_M(rm, insn);
                 }
             } else {
-                rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
+                rn = VFP_SREG_N(insn);
                 if (op == 15 && rn == 15) {
                     /* Double precision destination.  */
-                    if (insn & (1 << 22))
-                        return 1;
-                    rd = (insn >> 12) & 0xf;
-                } else
-                    rd = ((insn >> 11) & 0x1e) | ((insn >> 22) & 1);
-                rm = ((insn << 1) & 0x1e) | ((insn >> 5) & 1);
+                    VFP_DREG_D(rd, insn);
+                } else {
+                    rd = VFP_SREG_D(insn);
+                }
+                rm = VFP_SREG_M(insn);
             }
 
             veclen = env->vfp.vec_len;
@@ -1831,9 +2079,17 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                     gen_mov_F0_vreg(dp, rd);
                     gen_vfp_F1_ld0(dp);
                     break;
+                case 20:
+                case 21:
+                case 22:
+                case 23:
+                    /* Source and destination the same.  */
+                    gen_mov_F0_vreg(dp, rd);
+                    break;
                 default:
                     /* One source operand.  */
                     gen_mov_F0_vreg(dp, rm);
+                    break;
                 }
             } else {
                 /* Two source operands.  */
@@ -1882,6 +2138,27 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                 case 8: /* div: fn / fm */
                     gen_vfp_div(dp);
                     break;
+                case 14: /* fconst */
+                    if (!arm_feature(env, ARM_FEATURE_VFP3))
+                      return 1;
+
+                    n = (insn << 12) & 0x80000000;
+                    i = ((insn >> 12) & 0x70) | (insn & 0xf);
+                    if (dp) {
+                        if (i & 0x40)
+                            i |= 0x3f80;
+                        else
+                            i |= 0x4000;
+                        n |= i << 16;
+                    } else {
+                        if (i & 0x40)
+                            i |= 0x780;
+                        else
+                            i |= 0x800;
+                        n |= i << 19;
+                    }
+                    gen_vfp_fconst(dp, n);
+                    break;
                 case 15: /* extension space */
                     switch (rn) {
                     case 0: /* cpy */
@@ -1921,6 +2198,26 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                     case 17: /* fsito */
                         gen_vfp_sito(dp);
                         break;
+                    case 20: /* fshto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_shto(dp, rm);
+                        break;
+                    case 21: /* fslto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_slto(dp, rm);
+                        break;
+                    case 22: /* fuhto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_uhto(dp, rm);
+                        break;
+                    case 23: /* fulto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_ulto(dp, rm);
+                        break;
                     case 24: /* ftoui */
                         gen_vfp_toui(dp);
                         break;
@@ -1933,6 +2230,26 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                     case 27: /* ftosiz */
                         gen_vfp_tosiz(dp);
                         break;
+                    case 28: /* ftosh */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_tosh(dp, rm);
+                        break;
+                    case 29: /* ftosl */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_tosl(dp, rm);
+                        break;
+                    case 30: /* ftouh */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_touh(dp, rm);
+                        break;
+                    case 31: /* ftoul */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_toul(dp, rm);
+                        break;
                     default: /* undefined */
                         printf ("rn:%d\n", rn);
                         return 1;
@@ -1994,16 +2311,15 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
         break;
     case 0xc:
     case 0xd:
-        if (dp && (insn & (1 << 22))) {
+        if (dp && (insn & 0x03e00000) == 0x00400000) {
             /* two-register transfer */
             rn = (insn >> 16) & 0xf;
             rd = (insn >> 12) & 0xf;
             if (dp) {
-                if (insn & (1 << 5))
-                    return 1;
-                rm = insn & 0xf;
-            } else
-                rm = ((insn << 1) & 0x1e) | ((insn >> 5) & 1);
+                VFP_DREG_M(rm, insn);
+            } else {
+                rm = VFP_SREG_M(insn);
+            }
 
             if (insn & ARM_CP_RW_BIT) {
                 /* vfp->arm */
@@ -2040,10 +2356,14 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
             /* Load/store */
             rn = (insn >> 16) & 0xf;
             if (dp)
-                rd = (insn >> 12) & 0xf;
+                VFP_DREG_D(rd, insn);
             else
-                rd = ((insn >> 11) & 0x1e) | ((insn >> 22) & 1);
-            gen_movl_T1_reg(s, rn);
+                rd = VFP_SREG_D(insn);
+            if (s->thumb && rn == 15) {
+                gen_op_movl_T1_im(s->pc & ~2);
+            } else {
+                gen_movl_T1_reg(s, rn);
+            }
             if ((insn & 0x01200000) == 0x01000000) {
                 /* Single load/store */
                 offset = (insn & 0xff) << 2;
@@ -2156,7 +2476,7 @@ static inline void gen_mulxy(int x, int y)
 }
 
 /* Return the mask of PSR bits set by a MSR instruction.  */
-static uint32_t msr_mask(DisasContext *s, int flags, int spsr) {
+static uint32_t msr_mask(CPUState *env, DisasContext *s, int flags, int spsr) {
     uint32_t mask;
 
     mask = 0;
@@ -2168,14 +2488,19 @@ static uint32_t msr_mask(DisasContext *s, int flags, int spsr) {
         mask |= 0xff0000;
     if (flags & (1 << 3))
         mask |= 0xff000000;
+
     /* Mask out undefined bits.  */
-    mask &= 0xf90f03ff;
-    /* Mask out state bits.  */
+    mask &= ~CPSR_RESERVED;
+    if (!arm_feature(env, ARM_FEATURE_V6))
+        mask &= ~(CPSR_E | CPSR_GE);
+    if (!arm_feature(env, ARM_FEATURE_THUMB2))
+        mask &= ~CPSR_IT;
+    /* Mask out execution state bits.  */
     if (!spsr)
-        mask &= ~0x01000020;
+        mask &= ~CPSR_EXEC;
     /* Mask out privileged bits.  */
     if (IS_USER(s))
-        mask &= 0xf80f0200;
+        mask &= CPSR_USER;
     return mask;
 }
 
@@ -2194,6 +2519,7 @@ static int gen_set_psr_T0(DisasContext *s, uint32_t mask, int spsr)
     return 0;
 }
 
+/* Generate an old-style exception return.  */
 static void gen_exception_return(DisasContext *s)
 {
     gen_op_movl_reg_TN[0][15]();
@@ -2202,6 +2528,2122 @@ static void gen_exception_return(DisasContext *s)
     s->is_jmp = DISAS_UPDATE;
 }
 
+/* Generate a v6 exception return.  */
+static void gen_rfe(DisasContext *s)
+{
+    gen_op_movl_cpsr_T0(0xffffffff);
+    gen_op_movl_T0_T2();
+    gen_op_movl_reg_TN[0][15]();
+    s->is_jmp = DISAS_UPDATE;
+}
+
+static inline void
+gen_set_condexec (DisasContext *s)
+{
+    if (s->condexec_mask) {
+        gen_op_set_condexec((s->condexec_cond << 4) | (s->condexec_mask >> 1));
+    }
+}
+
+static void gen_nop_hint(DisasContext *s, int val)
+{
+    switch (val) {
+    case 3: /* wfi */
+        gen_op_movl_T0_im((long)s->pc);
+        gen_op_movl_reg_TN[0][15]();
+        s->is_jmp = DISAS_WFI;
+        break;
+    case 2: /* wfe */
+    case 4: /* sev */
+        /* TODO: Implement SEV and WFE.  May help SMP performance.  */
+    default: /* nop */
+        break;
+    }
+}
+
+/* Neon shift by constant.  The actual ops are the same as used for variable
+   shifts.  [OP][U][SIZE]  */
+static GenOpFunc *gen_neon_shift_im[8][2][4] = {
+    { /* 0 */ /* VSHR */
+      {
+        gen_op_neon_shl_u8,
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64
+      }, {
+        gen_op_neon_shl_s8,
+        gen_op_neon_shl_s16,
+        gen_op_neon_shl_s32,
+        gen_op_neon_shl_s64
+      }
+    }, { /* 1 */ /* VSRA */
+      {
+        gen_op_neon_shl_u8,
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64
+      }, {
+        gen_op_neon_shl_s8,
+        gen_op_neon_shl_s16,
+        gen_op_neon_shl_s32,
+        gen_op_neon_shl_s64
+      }
+    }, { /* 2 */ /* VRSHR */
+      {
+        gen_op_neon_rshl_u8,
+        gen_op_neon_rshl_u16,
+        gen_op_neon_rshl_u32,
+        gen_op_neon_rshl_u64
+      }, {
+        gen_op_neon_rshl_s8,
+        gen_op_neon_rshl_s16,
+        gen_op_neon_rshl_s32,
+        gen_op_neon_rshl_s64
+      }
+    }, { /* 3 */ /* VRSRA */
+      {
+        gen_op_neon_rshl_u8,
+        gen_op_neon_rshl_u16,
+        gen_op_neon_rshl_u32,
+        gen_op_neon_rshl_u64
+      }, {
+        gen_op_neon_rshl_s8,
+        gen_op_neon_rshl_s16,
+        gen_op_neon_rshl_s32,
+        gen_op_neon_rshl_s64
+      }
+    }, { /* 4 */
+      {
+        NULL, NULL, NULL, NULL
+      }, { /* VSRI */
+        gen_op_neon_shl_u8,
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64,
+      }
+    }, { /* 5 */
+      { /* VSHL */
+        gen_op_neon_shl_u8,
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64,
+      }, { /* VSLI */
+        gen_op_neon_shl_u8,
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64,
+      }
+    }, { /* 6 */ /* VQSHL */
+      {
+        gen_op_neon_qshl_u8,
+        gen_op_neon_qshl_u16,
+        gen_op_neon_qshl_u32,
+        gen_op_neon_qshl_u64
+      }, {
+        gen_op_neon_qshl_s8,
+        gen_op_neon_qshl_s16,
+        gen_op_neon_qshl_s32,
+        gen_op_neon_qshl_s64
+      }
+    }, { /* 7 */ /* VQSHLU */
+      {
+        gen_op_neon_qshl_u8,
+        gen_op_neon_qshl_u16,
+        gen_op_neon_qshl_u32,
+        gen_op_neon_qshl_u64
+      }, {
+        gen_op_neon_qshl_u8,
+        gen_op_neon_qshl_u16,
+        gen_op_neon_qshl_u32,
+        gen_op_neon_qshl_u64
+      }
+    }
+};
+
+/* [R][U][size - 1] */
+static GenOpFunc *gen_neon_shift_im_narrow[2][2][3] = {
+    {
+      {
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64
+      }, {
+        gen_op_neon_shl_s16,
+        gen_op_neon_shl_s32,
+        gen_op_neon_shl_s64
+      }
+    }, {
+      {
+        gen_op_neon_rshl_u16,
+        gen_op_neon_rshl_u32,
+        gen_op_neon_rshl_u64
+      }, {
+        gen_op_neon_rshl_s16,
+        gen_op_neon_rshl_s32,
+        gen_op_neon_rshl_s64
+      }
+    }
+};
+
+static inline void
+gen_op_neon_narrow_u32 ()
+{
+    /* No-op.  */
+}
+
+static GenOpFunc *gen_neon_narrow[3] = {
+    gen_op_neon_narrow_u8,
+    gen_op_neon_narrow_u16,
+    gen_op_neon_narrow_u32
+};
+
+static GenOpFunc *gen_neon_narrow_satu[3] = {
+    gen_op_neon_narrow_sat_u8,
+    gen_op_neon_narrow_sat_u16,
+    gen_op_neon_narrow_sat_u32
+};
+
+static GenOpFunc *gen_neon_narrow_sats[3] = {
+    gen_op_neon_narrow_sat_s8,
+    gen_op_neon_narrow_sat_s16,
+    gen_op_neon_narrow_sat_s32
+};
+
+static inline int gen_neon_add(int size)
+{
+    switch (size) {
+    case 0: gen_op_neon_add_u8(); break;
+    case 1: gen_op_neon_add_u16(); break;
+    case 2: gen_op_addl_T0_T1(); break;
+    default: return 1;
+    }
+    return 0;
+}
+
+/* 32-bit pairwise ops end up the same as the elementsise versions.  */
+#define gen_op_neon_pmax_s32  gen_op_neon_max_s32
+#define gen_op_neon_pmax_u32  gen_op_neon_max_u32
+#define gen_op_neon_pmin_s32  gen_op_neon_min_s32
+#define gen_op_neon_pmin_u32  gen_op_neon_min_u32
+
+#define GEN_NEON_INTEGER_OP(name) do { \
+    switch ((size << 1) | u) { \
+    case 0: gen_op_neon_##name##_s8(); break; \
+    case 1: gen_op_neon_##name##_u8(); break; \
+    case 2: gen_op_neon_##name##_s16(); break; \
+    case 3: gen_op_neon_##name##_u16(); break; \
+    case 4: gen_op_neon_##name##_s32(); break; \
+    case 5: gen_op_neon_##name##_u32(); break; \
+    default: return 1; \
+    }} while (0)
+
+static inline void
+gen_neon_movl_scratch_T0(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  gen_op_neon_setreg_T0(offset);
+}
+
+static inline void
+gen_neon_movl_scratch_T1(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  gen_op_neon_setreg_T1(offset);
+}
+
+static inline void
+gen_neon_movl_T0_scratch(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  gen_op_neon_getreg_T0(offset);
+}
+
+static inline void
+gen_neon_movl_T1_scratch(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  gen_op_neon_getreg_T1(offset);
+}
+
+static inline void gen_op_neon_widen_u32(void)
+{
+    gen_op_movl_T1_im(0);
+}
+
+static inline void gen_neon_get_scalar(int size, int reg)
+{
+    if (size == 1) {
+        NEON_GET_REG(T0, reg >> 1, reg & 1);
+    } else {
+        NEON_GET_REG(T0, reg >> 2, (reg >> 1) & 1);
+        if (reg & 1)
+            gen_op_neon_dup_low16();
+        else
+            gen_op_neon_dup_high16();
+    }
+}
+
+static void gen_neon_unzip(int reg, int q, int tmp, int size)
+{
+    int n;
+
+    for (n = 0; n < q + 1; n += 2) {
+        NEON_GET_REG(T0, reg, n);
+        NEON_GET_REG(T0, reg, n + n);
+        switch (size) {
+        case 0: gen_op_neon_unzip_u8(); break;
+        case 1: gen_op_neon_zip_u16(); break; /* zip and unzip are the same.  */
+        case 2: /* no-op */; break;
+        default: abort();
+        }
+        gen_neon_movl_scratch_T0(tmp + n);
+        gen_neon_movl_scratch_T1(tmp + n + 1);
+    }
+}
+
+static struct {
+    int nregs;
+    int interleave;
+    int spacing;
+} neon_ls_element_type[11] = {
+    {4, 4, 1},
+    {4, 4, 2},
+    {4, 1, 1},
+    {4, 2, 1},
+    {3, 3, 1},
+    {3, 3, 2},
+    {3, 1, 1},
+    {1, 1, 1},
+    {2, 2, 1},
+    {2, 2, 2},
+    {2, 1, 1}
+};
+
+/* Translate a NEON load/store element instruction.  Return nonzero if the
+   instruction is invalid.  */
+static int disas_neon_ls_insn(CPUState * env, DisasContext *s, uint32_t insn)
+{
+    int rd, rn, rm;
+    int op;
+    int nregs;
+    int interleave;
+    int stride;
+    int size;
+    int reg;
+    int pass;
+    int load;
+    int shift;
+    uint32_t mask;
+    int n;
+
+    if (!vfp_enabled(env))
+      return 1;
+    VFP_DREG_D(rd, insn);
+    rn = (insn >> 16) & 0xf;
+    rm = insn & 0xf;
+    load = (insn & (1 << 21)) != 0;
+    if ((insn & (1 << 23)) == 0) {
+        /* Load store all elements.  */
+        op = (insn >> 8) & 0xf;
+        size = (insn >> 6) & 3;
+        if (op > 10 || size == 3)
+            return 1;
+        nregs = neon_ls_element_type[op].nregs;
+        interleave = neon_ls_element_type[op].interleave;
+        gen_movl_T1_reg(s, rn);
+        stride = (1 << size) * interleave;
+        for (reg = 0; reg < nregs; reg++) {
+            if (interleave > 2 || (interleave == 2 && nregs == 2)) {
+                gen_movl_T1_reg(s, rn);
+                gen_op_addl_T1_im((1 << size) * reg);
+            } else if (interleave == 2 && nregs == 4 && reg == 2) {
+                gen_movl_T1_reg(s, rn);
+                gen_op_addl_T1_im(1 << size);
+            }
+            for (pass = 0; pass < 2; pass++) {
+                if (size == 2) {
+                    if (load) {
+                        gen_ldst(ldl, s);
+                        NEON_SET_REG(T0, rd, pass);
+                    } else {
+                        NEON_GET_REG(T0, rd, pass);
+                        gen_ldst(stl, s);
+                    }
+                    gen_op_addl_T1_im(stride);
+                } else if (size == 1) {
+                    if (load) {
+                        gen_ldst(lduw, s);
+                        gen_op_addl_T1_im(stride);
+                        gen_op_movl_T2_T0();
+                        gen_ldst(lduw, s);
+                        gen_op_addl_T1_im(stride);
+                        gen_op_neon_insert_elt(16, 0xffff);
+                        NEON_SET_REG(T2, rd, pass);
+                    } else {
+                        NEON_GET_REG(T2, rd, pass);
+                        gen_op_movl_T0_T2();
+                        gen_ldst(stw, s);
+                        gen_op_addl_T1_im(stride);
+                        gen_op_neon_extract_elt(16, 0xffff0000);
+                        gen_ldst(stw, s);
+                        gen_op_addl_T1_im(stride);
+                    }
+                } else /* size == 0 */ {
+                    if (load) {
+                        mask = 0xff;
+                        for (n = 0; n < 4; n++) {
+                            gen_ldst(ldub, s);
+                            gen_op_addl_T1_im(stride);
+                            if (n == 0) {
+                                gen_op_movl_T2_T0();
+                            } else {
+                                gen_op_neon_insert_elt(n * 8, ~mask);
+                            }
+                            mask <<= 8;
+                        }
+                        NEON_SET_REG(T2, rd, pass);
+                    } else {
+                        NEON_GET_REG(T2, rd, pass);
+                        mask = 0xff;
+                        for (n = 0; n < 4; n++) {
+                            if (n == 0) {
+                                gen_op_movl_T0_T2();
+                            } else {
+                                gen_op_neon_extract_elt(n * 8, mask);
+                            }
+                            gen_ldst(stb, s);
+                            gen_op_addl_T1_im(stride);
+                            mask <<= 8;
+                        }
+                    }
+                }
+            }
+            rd += neon_ls_element_type[op].spacing;
+        }
+        stride = nregs * 8;
+    } else {
+        size = (insn >> 10) & 3;
+        if (size == 3) {
+            /* Load single element to all lanes.  */
+            if (!load)
+                return 1;
+            size = (insn >> 6) & 3;
+            nregs = ((insn >> 8) & 3) + 1;
+            stride = (insn & (1 << 5)) ? 2 : 1;
+            gen_movl_T1_reg(s, rn);
+            for (reg = 0; reg < nregs; reg++) {
+                switch (size) {
+                case 0:
+                    gen_ldst(ldub, s);
+                    gen_op_neon_dup_u8(0);
+                    break;
+                case 1:
+                    gen_ldst(lduw, s);
+                    gen_op_neon_dup_low16();
+                    break;
+                case 2:
+                    gen_ldst(ldl, s);
+                    break;
+                case 3:
+                    return 1;
+                }
+                gen_op_addl_T1_im(1 << size);
+                NEON_SET_REG(T0, rd, 0);
+                NEON_SET_REG(T0, rd, 1);
+                rd += stride;
+            }
+            stride = (1 << size) * nregs;
+        } else {
+            /* Single element.  */
+            pass = (insn >> 7) & 1;
+            switch (size) {
+            case 0:
+                shift = ((insn >> 5) & 3) * 8;
+                mask = 0xff << shift;
+                stride = 1;
+                break;
+            case 1:
+                shift = ((insn >> 6) & 1) * 16;
+                mask = shift ? 0xffff0000 : 0xffff;
+                stride = (insn & (1 << 5)) ? 2 : 1;
+                break;
+            case 2:
+                shift = 0;
+                mask = 0xffffffff;
+                stride = (insn & (1 << 6)) ? 2 : 1;
+                break;
+            default:
+                abort();
+            }
+            nregs = ((insn >> 8) & 3) + 1;
+            gen_movl_T1_reg(s, rn);
+            for (reg = 0; reg < nregs; reg++) {
+                if (load) {
+                    if (size != 2) {
+                        NEON_GET_REG(T2, rd, pass);
+                    }
+                    switch (size) {
+                    case 0:
+                        gen_ldst(ldub, s);
+                        break;
+                    case 1:
+                        gen_ldst(lduw, s);
+                        break;
+                    case 2:
+                        gen_ldst(ldl, s);
+                        NEON_SET_REG(T0, rd, pass);
+                        break;
+                    }
+                    if (size != 2) {
+                        gen_op_neon_insert_elt(shift, ~mask);
+                        NEON_SET_REG(T0, rd, pass);
+                    }
+                } else { /* Store */
+                    if (size == 2) {
+                        NEON_GET_REG(T0, rd, pass);
+                    } else {
+                        NEON_GET_REG(T2, rd, pass);
+                        gen_op_neon_extract_elt(shift, mask);
+                    }
+                    switch (size) {
+                    case 0:
+                        gen_ldst(stb, s);
+                        break;
+                    case 1:
+                        gen_ldst(stw, s);
+                        break;
+                    case 2:
+                        gen_ldst(stl, s);
+                        break;
+                    }
+                }
+                rd += stride;
+                gen_op_addl_T1_im(1 << size);
+            }
+            stride = nregs * (1 << size);
+        }
+    }
+    if (rm != 15) {
+        gen_movl_T1_reg(s, rn);
+        if (rm == 13) {
+            gen_op_addl_T1_im(stride);
+        } else {
+            gen_movl_T2_reg(s, rm);
+            gen_op_addl_T1_T2();
+        }
+        gen_movl_reg_T1(s, rn);
+    }
+    return 0;
+}
+
+/* Translate a NEON data processing instruction.  Return nonzero if the
+   instruction is invalid.
+   In general we process vectors in 32-bit chunks.  This means we can reuse
+   some of the scalar ops, and hopefully the code generated for 32-bit
+   hosts won't be too awful.  The downside is that the few 64-bit operations
+   (mainly shifts) get complicated.  */
+
+static int disas_neon_data_insn(CPUState * env, DisasContext *s, uint32_t insn)
+{
+    int op;
+    int q;
+    int rd, rn, rm;
+    int size;
+    int shift;
+    int pass;
+    int count;
+    int pairwise;
+    int u;
+    int n;
+    uint32_t imm;
+
+    if (!vfp_enabled(env))
+      return 1;
+    q = (insn & (1 << 6)) != 0;
+    u = (insn >> 24) & 1;
+    VFP_DREG_D(rd, insn);
+    VFP_DREG_N(rn, insn);
+    VFP_DREG_M(rm, insn);
+    size = (insn >> 20) & 3;
+    if ((insn & (1 << 23)) == 0) {
+        /* Three register same length.  */
+        op = ((insn >> 7) & 0x1e) | ((insn >> 4) & 1);
+        if (size == 3 && (op == 1 || op == 5 || op == 16)) {
+            for (pass = 0; pass < (q ? 2 : 1); pass++) {
+                NEON_GET_REG(T0, rm, pass * 2);
+                NEON_GET_REG(T1, rm, pass * 2 + 1);
+                gen_neon_movl_scratch_T0(0);
+                gen_neon_movl_scratch_T1(1);
+                NEON_GET_REG(T0, rn, pass * 2);
+                NEON_GET_REG(T1, rn, pass * 2 + 1);
+                switch (op) {
+                case 1: /* VQADD */
+                    if (u) {
+                        gen_op_neon_addl_saturate_u64();
+                    } else {
+                        gen_op_neon_addl_saturate_s64();
+                    }
+                    break;
+                case 5: /* VQSUB */
+                    if (u) {
+                        gen_op_neon_subl_saturate_u64();
+                    } else {
+                        gen_op_neon_subl_saturate_s64();
+                    }
+                    break;
+                case 16:
+                    if (u) {
+                        gen_op_neon_subl_u64();
+                    } else {
+                        gen_op_neon_addl_u64();
+                    }
+                    break;
+                default:
+                    abort();
+                }
+                NEON_SET_REG(T0, rd, pass * 2);
+                NEON_SET_REG(T1, rd, pass * 2 + 1);
+            }
+            return 0;
+        }
+        switch (op) {
+        case 8: /* VSHL */
+        case 9: /* VQSHL */
+        case 10: /* VRSHL */
+        case 11: /* VQSHL */
+            /* Shift operations have Rn and Rm reversed.  */
+            {
+                int tmp;
+                tmp = rn;
+                rn = rm;
+                rm = tmp;
+                pairwise = 0;
+            }
+            break;
+        case 20: /* VPMAX */
+        case 21: /* VPMIN */
+        case 23: /* VPADD */
+            pairwise = 1;
+            break;
+        case 26: /* VPADD (float) */
+            pairwise = (u && size < 2);
+            break;
+        case 30: /* VPMIN/VPMAX (float) */
+            pairwise = u;
+            break;
+        default:
+            pairwise = 0;
+            break;
+        }
+        for (pass = 0; pass < (q ? 4 : 2); pass++) {
+
+        if (pairwise) {
+            /* Pairwise.  */
+            if (q)
+                n = (pass & 1) * 2;
+            else
+                n = 0;
+            if (pass < q + 1) {
+                NEON_GET_REG(T0, rn, n);
+                NEON_GET_REG(T1, rn, n + 1);
+            } else {
+                NEON_GET_REG(T0, rm, n);
+                NEON_GET_REG(T1, rm, n + 1);
+            }
+        } else {
+            /* Elementwise.  */
+            NEON_GET_REG(T0, rn, pass);
+            NEON_GET_REG(T1, rm, pass);
+        }
+        switch (op) {
+        case 0: /* VHADD */
+            GEN_NEON_INTEGER_OP(hadd);
+            break;
+        case 1: /* VQADD */
+            switch (size << 1| u) {
+            case 0: gen_op_neon_qadd_s8(); break;
+            case 1: gen_op_neon_qadd_u8(); break;
+            case 2: gen_op_neon_qadd_s16(); break;
+            case 3: gen_op_neon_qadd_u16(); break;
+            case 4: gen_op_addl_T0_T1_saturate(); break;
+            case 5: gen_op_addl_T0_T1_usaturate(); break;
+            default: abort();
+            }
+            break;
+        case 2: /* VRHADD */
+            GEN_NEON_INTEGER_OP(rhadd);
+            break;
+        case 3: /* Logic ops.  */
+            switch ((u << 2) | size) {
+            case 0: /* VAND */
+                gen_op_andl_T0_T1();
+                break;
+            case 1: /* BIC */
+                gen_op_bicl_T0_T1();
+                break;
+            case 2: /* VORR */
+                gen_op_orl_T0_T1();
+                break;
+            case 3: /* VORN */
+                gen_op_notl_T1();
+                gen_op_orl_T0_T1();
+                break;
+            case 4: /* VEOR */
+                gen_op_xorl_T0_T1();
+                break;
+            case 5: /* VBSL */
+                NEON_GET_REG(T2, rd, pass);
+                gen_op_neon_bsl();
+                break;
+            case 6: /* VBIT */
+                NEON_GET_REG(T2, rd, pass);
+                gen_op_neon_bit();
+                break;
+            case 7: /* VBIF */
+                NEON_GET_REG(T2, rd, pass);
+                gen_op_neon_bif();
+                break;
+            }
+            break;
+        case 4: /* VHSUB */
+            GEN_NEON_INTEGER_OP(hsub);
+            break;
+        case 5: /* VQSUB */
+            switch ((size << 1) | u) {
+            case 0: gen_op_neon_qsub_s8(); break;
+            case 1: gen_op_neon_qsub_u8(); break;
+            case 2: gen_op_neon_qsub_s16(); break;
+            case 3: gen_op_neon_qsub_u16(); break;
+            case 4: gen_op_subl_T0_T1_saturate(); break;
+            case 5: gen_op_subl_T0_T1_usaturate(); break;
+            default: abort();
+            }
+            break;
+        case 6: /* VCGT */
+            GEN_NEON_INTEGER_OP(cgt);
+            break;
+        case 7: /* VCGE */
+            GEN_NEON_INTEGER_OP(cge);
+            break;
+        case 8: /* VSHL */
+            switch ((size << 1) | u) {
+            case 0: gen_op_neon_shl_s8(); break;
+            case 1: gen_op_neon_shl_u8(); break;
+            case 2: gen_op_neon_shl_s16(); break;
+            case 3: gen_op_neon_shl_u16(); break;
+            case 4: gen_op_neon_shl_s32(); break;
+            case 5: gen_op_neon_shl_u32(); break;
+#if 0
+            /* ??? Implementing these is tricky because the vector ops work
+               on 32-bit pieces.  */
+            case 6: gen_op_neon_shl_s64(); break;
+            case 7: gen_op_neon_shl_u64(); break;
+#else
+            case 6: case 7: cpu_abort(env, "VSHL.64 not implemented");
+#endif
+            }
+            break;
+        case 9: /* VQSHL */
+            switch ((size << 1) | u) {
+            case 0: gen_op_neon_qshl_s8(); break;
+            case 1: gen_op_neon_qshl_u8(); break;
+            case 2: gen_op_neon_qshl_s16(); break;
+            case 3: gen_op_neon_qshl_u16(); break;
+            case 4: gen_op_neon_qshl_s32(); break;
+            case 5: gen_op_neon_qshl_u32(); break;
+#if 0
+            /* ??? Implementing these is tricky because the vector ops work
+               on 32-bit pieces.  */
+            case 6: gen_op_neon_qshl_s64(); break;
+            case 7: gen_op_neon_qshl_u64(); break;
+#else
+            case 6: case 7: cpu_abort(env, "VQSHL.64 not implemented");
+#endif
+            }
+            break;
+        case 10: /* VRSHL */
+            switch ((size << 1) | u) {
+            case 0: gen_op_neon_rshl_s8(); break;
+            case 1: gen_op_neon_rshl_u8(); break;
+            case 2: gen_op_neon_rshl_s16(); break;
+            case 3: gen_op_neon_rshl_u16(); break;
+            case 4: gen_op_neon_rshl_s32(); break;
+            case 5: gen_op_neon_rshl_u32(); break;
+#if 0
+            /* ??? Implementing these is tricky because the vector ops work
+               on 32-bit pieces.  */
+            case 6: gen_op_neon_rshl_s64(); break;
+            case 7: gen_op_neon_rshl_u64(); break;
+#else
+            case 6: case 7: cpu_abort(env, "VRSHL.64 not implemented");
+#endif
+            }
+            break;
+        case 11: /* VQRSHL */
+            switch ((size << 1) | u) {
+            case 0: gen_op_neon_qrshl_s8(); break;
+            case 1: gen_op_neon_qrshl_u8(); break;
+            case 2: gen_op_neon_qrshl_s16(); break;
+            case 3: gen_op_neon_qrshl_u16(); break;
+            case 4: gen_op_neon_qrshl_s32(); break;
+            case 5: gen_op_neon_qrshl_u32(); break;
+#if 0
+            /* ??? Implementing these is tricky because the vector ops work
+               on 32-bit pieces.  */
+            case 6: gen_op_neon_qrshl_s64(); break;
+            case 7: gen_op_neon_qrshl_u64(); break;
+#else
+            case 6: case 7: cpu_abort(env, "VQRSHL.64 not implemented");
+#endif
+            }
+            break;
+        case 12: /* VMAX */
+            GEN_NEON_INTEGER_OP(max);
+            break;
+        case 13: /* VMIN */
+            GEN_NEON_INTEGER_OP(min);
+            break;
+        case 14: /* VABD */
+            GEN_NEON_INTEGER_OP(abd);
+            break;
+        case 15: /* VABA */
+            GEN_NEON_INTEGER_OP(abd);
+            NEON_GET_REG(T1, rd, pass);
+            gen_neon_add(size);
+            break;
+        case 16:
+            if (!u) { /* VADD */
+                if (gen_neon_add(size))
+                    return 1;
+            } else { /* VSUB */
+                switch (size) {
+                case 0: gen_op_neon_sub_u8(); break;
+                case 1: gen_op_neon_sub_u16(); break;
+                case 2: gen_op_subl_T0_T1(); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 17:
+            if (!u) { /* VTST */
+                switch (size) {
+                case 0: gen_op_neon_tst_u8(); break;
+                case 1: gen_op_neon_tst_u16(); break;
+                case 2: gen_op_neon_tst_u32(); break;
+                default: return 1;
+                }
+            } else { /* VCEQ */
+                switch (size) {
+                case 0: gen_op_neon_ceq_u8(); break;
+                case 1: gen_op_neon_ceq_u16(); break;
+                case 2: gen_op_neon_ceq_u32(); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 18: /* Multiply.  */
+            switch (size) {
+            case 0: gen_op_neon_mul_u8(); break;
+            case 1: gen_op_neon_mul_u16(); break;
+            case 2: gen_op_mul_T0_T1(); break;
+            default: return 1;
+            }
+            NEON_GET_REG(T1, rd, pass);
+            if (u) { /* VMLS */
+                switch (size) {
+                case 0: gen_op_neon_rsb_u8(); break;
+                case 1: gen_op_neon_rsb_u16(); break;
+                case 2: gen_op_rsbl_T0_T1(); break;
+                default: return 1;
+                }
+            } else { /* VMLA */
+                gen_neon_add(size);
+            }
+            break;
+        case 19: /* VMUL */
+            if (u) { /* polynomial */
+                gen_op_neon_mul_p8();
+            } else { /* Integer */
+                switch (size) {
+                case 0: gen_op_neon_mul_u8(); break;
+                case 1: gen_op_neon_mul_u16(); break;
+                case 2: gen_op_mul_T0_T1(); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 20: /* VPMAX */
+            GEN_NEON_INTEGER_OP(pmax);
+            break;
+        case 21: /* VPMIN */
+            GEN_NEON_INTEGER_OP(pmin);
+            break;
+        case 22: /* Hultiply high.  */
+            if (!u) { /* VQDMULH */
+                switch (size) {
+                case 1: gen_op_neon_qdmulh_s16(); break;
+                case 2: gen_op_neon_qdmulh_s32(); break;
+                default: return 1;
+                }
+            } else { /* VQRDHMUL */
+                switch (size) {
+                case 1: gen_op_neon_qrdmulh_s16(); break;
+                case 2: gen_op_neon_qrdmulh_s32(); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 23: /* VPADD */
+            if (u)
+                return 1;
+            switch (size) {
+            case 0: gen_op_neon_padd_u8(); break;
+            case 1: gen_op_neon_padd_u16(); break;
+            case 2: gen_op_addl_T0_T1(); break;
+            default: return 1;
+            }
+            break;
+        case 26: /* Floating point arithnetic.  */
+            switch ((u << 2) | size) {
+            case 0: /* VADD */
+                gen_op_neon_add_f32();
+                break;
+            case 2: /* VSUB */
+                gen_op_neon_sub_f32();
+                break;
+            case 4: /* VPADD */
+                gen_op_neon_add_f32();
+                break;
+            case 6: /* VABD */
+                gen_op_neon_abd_f32();
+                break;
+            default:
+                return 1;
+            }
+            break;
+        case 27: /* Float multiply.  */
+            gen_op_neon_mul_f32();
+            if (!u) {
+                NEON_GET_REG(T1, rd, pass);
+                if (size == 0) {
+                    gen_op_neon_add_f32();
+                } else {
+                    gen_op_neon_rsb_f32();
+                }
+            }
+            break;
+        case 28: /* Float compare.  */
+            if (!u) {
+                gen_op_neon_ceq_f32();
+            } else {
+                if (size == 0)
+                    gen_op_neon_cge_f32();
+                else
+                    gen_op_neon_cgt_f32();
+            }
+            break;
+        case 29: /* Float compare absolute.  */
+            if (!u)
+                return 1;
+            if (size == 0)
+                gen_op_neon_acge_f32();
+            else
+                gen_op_neon_acgt_f32();
+            break;
+        case 30: /* Float min/max.  */
+            if (size == 0)
+                gen_op_neon_max_f32();
+            else
+                gen_op_neon_min_f32();
+            break;
+        case 31:
+            if (size == 0)
+                gen_op_neon_recps_f32();
+            else
+                gen_op_neon_rsqrts_f32();
+            break;
+        default:
+            abort();
+        }
+        /* Save the result.  For elementwise operations we can put it
+           straight into the destination register.  For pairwise operations
+           we have to be careful to avoid clobbering the source operands.  */
+        if (pairwise && rd == rm) {
+            gen_neon_movl_scratch_T0(pass);
+        } else {
+            NEON_SET_REG(T0, rd, pass);
+        }
+
+        } /* for pass */
+        if (pairwise && rd == rm) {
+            for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                gen_neon_movl_T0_scratch(pass);
+                NEON_SET_REG(T0, rd, pass);
+            }
+        }
+    } else if (insn & (1 << 4)) {
+        if ((insn & 0x00380080) != 0) {
+            /* Two registers and shift.  */
+            op = (insn >> 8) & 0xf;
+            if (insn & (1 << 7)) {
+                /* 64-bit shift.   */
+                size = 3;
+            } else {
+                size = 2;
+                while ((insn & (1 << (size + 19))) == 0)
+                    size--;
+            }
+            shift = (insn >> 16) & ((1 << (3 + size)) - 1);
+            /* To avoid excessive dumplication of ops we implement shift
+               by immediate using the variable shift operations.  */
+            if (op < 8) {
+                /* Shift by immediate:
+                   VSHR, VSRA, VRSHR, VRSRA, VSRI, VSHL, VQSHL, VQSHLU.  */
+                /* Right shifts are encoded as N - shift, where N is the
+                   element size in bits.  */
+                if (op <= 4)
+                    shift = shift - (1 << (size + 3));
+                else
+                    shift++;
+                if (size == 3) {
+                    count = q + 1;
+                } else {
+                    count = q ? 4: 2;
+                }
+                switch (size) {
+                case 0:
+                    imm = (uint8_t) shift;
+                    imm |= imm << 8;
+                    imm |= imm << 16;
+                    break;
+                case 1:
+                    imm = (uint16_t) shift;
+                    imm |= imm << 16;
+                    break;
+                case 2:
+                case 3:
+                    imm = shift;
+                    break;
+                default:
+                    abort();
+                }
+
+                for (pass = 0; pass < count; pass++) {
+                    if (size < 3) {
+                        /* Operands in T0 and T1.  */
+                        gen_op_movl_T1_im(imm);
+                        NEON_GET_REG(T0, rm, pass);
+                    } else {
+                        /* Operands in {T0, T1} and env->vfp.scratch.  */
+                        gen_op_movl_T0_im(imm);
+                        gen_neon_movl_scratch_T0(0);
+                        gen_op_movl_T0_im((int32_t)imm >> 31);
+                        gen_neon_movl_scratch_T0(1);
+                        NEON_GET_REG(T0, rm, pass * 2);
+                        NEON_GET_REG(T1, rm, pass * 2 + 1);
+                    }
+
+                    if (gen_neon_shift_im[op][u][size] == NULL)
+                        return 1;
+                    gen_neon_shift_im[op][u][size]();
+
+                    if (op == 1 || op == 3) {
+                        /* Accumulate.  */
+                        if (size == 3) {
+                            gen_neon_movl_scratch_T0(0);
+                            gen_neon_movl_scratch_T1(1);
+                            NEON_GET_REG(T0, rd, pass * 2);
+                            NEON_GET_REG(T1, rd, pass * 2 + 1);
+                            gen_op_neon_addl_u64();
+                        } else {
+                            NEON_GET_REG(T1, rd, pass);
+                            gen_neon_add(size);
+                        }
+                    } else if (op == 4 || (op == 5 && u)) {
+                        /* Insert */
+                        if (size == 3) {
+                            cpu_abort(env, "VS[LR]I.64 not implemented");
+                        }
+                        switch (size) {
+                        case 0:
+                            if (op == 4)
+                                imm = 0xff >> -shift;
+                            else
+                                imm = (uint8_t)(0xff << shift);
+                            imm |= imm << 8;
+                            imm |= imm << 16;
+                            break;
+                        case 1:
+                            if (op == 4)
+                                imm = 0xffff >> -shift;
+                            else
+                                imm = (uint16_t)(0xffff << shift);
+                            imm |= imm << 16;
+                            break;
+                        case 2:
+                            if (op == 4)
+                                imm = 0xffffffffu >> -shift;
+                            else
+                                imm = 0xffffffffu << shift;
+                            break;
+                        default:
+                            abort();
+                        }
+                        NEON_GET_REG(T1, rd, pass);
+                        gen_op_movl_T2_im(imm);
+                        gen_op_neon_bsl();
+                    }
+                    if (size == 3) {
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    } else {
+                        NEON_SET_REG(T0, rd, pass);
+                    }
+                } /* for pass */
+            } else if (op < 10) {
+                /* Shift by immedaiate and narrow:
+                   VSHRN, VRSHRN, VQSHRN, VQRSHRN.  */
+                shift = shift - (1 << (size + 3));
+                size++;
+                if (size == 3) {
+                    count = q + 1;
+                } else {
+                    count = q ? 4: 2;
+                }
+                switch (size) {
+                case 1:
+                    imm = (uint16_t) shift;
+                    imm |= imm << 16;
+                    break;
+                case 2:
+                case 3:
+                    imm = shift;
+                    break;
+                default:
+                    abort();
+                }
+
+                /* Processing MSB first means we need to do less shuffling at
+                   the end.  */
+                for (pass =  count - 1; pass >= 0; pass--) {
+                    /* Avoid clobbering the second operand before it has been
+                       written.  */
+                    n = pass;
+                    if (rd == rm)
+                        n ^= (count - 1);
+                    else
+                        n = pass;
+
+                    if (size < 3) {
+                        /* Operands in T0 and T1.  */
+                        gen_op_movl_T1_im(imm);
+                        NEON_GET_REG(T0, rm, n);
+                    } else {
+                        /* Operands in {T0, T1} and env->vfp.scratch.  */
+                        gen_op_movl_T0_im(imm);
+                        gen_neon_movl_scratch_T0(0);
+                        gen_op_movl_T0_im((int32_t)imm >> 31);
+                        gen_neon_movl_scratch_T0(1);
+                        NEON_GET_REG(T0, rm, n * 2);
+                        NEON_GET_REG(T0, rm, n * 2 + 1);
+                    }
+
+                    gen_neon_shift_im_narrow[q][u][size - 1]();
+
+                    if (size < 3 && (pass & 1) == 0) {
+                        gen_neon_movl_scratch_T0(0);
+                    } else {
+                        uint32_t offset;
+
+                        if (size < 3)
+                            gen_neon_movl_T1_scratch(0);
+
+                        if (op == 8 && !u) {
+                            gen_neon_narrow[size - 1]();
+                        } else {
+                            if (op == 8)
+                                gen_neon_narrow_sats[size - 2]();
+                            else
+                                gen_neon_narrow_satu[size - 1]();
+                        }
+                        if (size == 3)
+                            offset = neon_reg_offset(rd, n);
+                        else
+                            offset = neon_reg_offset(rd, n >> 1);
+                        gen_op_neon_setreg_T0(offset);
+                    }
+                } /* for pass */
+            } else if (op == 10) {
+                /* VSHLL */
+                if (q)
+                    return 1;
+                for (pass = 0; pass < 2; pass++) {
+                    /* Avoid clobbering the input operand.  */
+                    if (rd == rm)
+                        n = 1 - pass;
+                    else
+                        n = pass;
+
+                    NEON_GET_REG(T0, rm, n);
+                    GEN_NEON_INTEGER_OP(widen);
+                    if (shift != 0) {
+                        /* The shift is less than the width of the source
+                           type, so in some cases we can just
+                           shift the whole register.  */
+                        if (size == 1 || (size == 0 && u)) {
+                            gen_op_shll_T0_im(shift);
+                            gen_op_shll_T1_im(shift);
+                        } else {
+                            switch (size) {
+                            case 0: gen_op_neon_shll_u16(shift); break;
+                            case 2: gen_op_neon_shll_u64(shift); break;
+                            default: abort();
+                            }
+                        }
+                    }
+                    NEON_SET_REG(T0, rd, n * 2);
+                    NEON_SET_REG(T1, rd, n * 2 + 1);
+                }
+            } else if (op == 15 || op == 16) {
+                /* VCVT fixed-point.  */
+                for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                    gen_op_vfp_getreg_F0s(neon_reg_offset(rm, pass));
+                    if (op & 1) {
+                        if (u)
+                            gen_op_vfp_ultos(shift);
+                        else
+                            gen_op_vfp_sltos(shift);
+                    } else {
+                        if (u)
+                            gen_op_vfp_touls(shift);
+                        else
+                            gen_op_vfp_tosls(shift);
+                    }
+                    gen_op_vfp_setreg_F0s(neon_reg_offset(rd, pass));
+                }
+            } else {
+                return 1;
+            }
+        } else { /* (insn & 0x00380080) == 0 */
+            int invert;
+
+            op = (insn >> 8) & 0xf;
+            /* One register and immediate.  */
+            imm = (u << 7) | ((insn >> 12) & 0x70) | (insn & 0xf);
+            invert = (insn & (1 << 5)) != 0;
+            switch (op) {
+            case 0: case 1:
+                /* no-op */
+                break;
+            case 2: case 3:
+                imm <<= 8;
+                break;
+            case 4: case 5:
+                imm <<= 16;
+                break;
+            case 6: case 7:
+                imm <<= 24;
+                break;
+            case 8: case 9:
+                imm |= imm << 16;
+                break;
+            case 10: case 11:
+                imm = (imm << 8) | (imm << 24);
+                break;
+            case 12:
+                imm = (imm < 8) | 0xff;
+                break;
+            case 13:
+                imm = (imm << 16) | 0xffff;
+                break;
+            case 14:
+                imm |= (imm << 8) | (imm << 16) | (imm << 24);
+                if (invert)
+                    imm = ~imm;
+                break;
+            case 15:
+                imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
+                      | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
+                break;
+            }
+            if (invert)
+                imm = ~imm;
+
+            if (op != 14 || !invert)
+                gen_op_movl_T1_im(imm);
+
+            for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                if (op & 1 && op < 12) {
+                    NEON_GET_REG(T0, rd, pass);
+                    if (invert) {
+                        /* The immediate value has already been inverted, so
+                           BIC becomes AND.  */
+                        gen_op_andl_T0_T1();
+                    } else {
+                        gen_op_orl_T0_T1();
+                    }
+                    NEON_SET_REG(T0, rd, pass);
+                } else {
+                    if (op == 14 && invert) {
+                        uint32_t tmp;
+                        tmp = 0;
+                        for (n = 0; n < 4; n++) {
+                            if (imm & (1 << (n + (pass & 1) * 4)))
+                                tmp |= 0xff << (n * 8);
+                        }
+                        gen_op_movl_T1_im(tmp);
+                    }
+                    /* VMOV, VMVN.  */
+                    NEON_SET_REG(T1, rd, pass);
+                }
+            }
+        }
+    } else { /* (insn & 0x00800010 == 0x00800010) */
+        if (size != 3) {
+            op = (insn >> 8) & 0xf;
+            if ((insn & (1 << 6)) == 0) {
+                /* Three registers of different lengths.  */
+                int src1_wide;
+                int src2_wide;
+                int prewiden;
+                /* prewiden, src1_wide, src2_wide */
+                static const int neon_3reg_wide[16][3] = {
+                    {1, 0, 0}, /* VADDL */
+                    {1, 1, 0}, /* VADDW */
+                    {1, 0, 0}, /* VSUBL */
+                    {1, 1, 0}, /* VSUBW */
+                    {0, 1, 1}, /* VADDHN */
+                    {0, 0, 0}, /* VABAL */
+                    {0, 1, 1}, /* VSUBHN */
+                    {0, 0, 0}, /* VABDL */
+                    {0, 0, 0}, /* VMLAL */
+                    {0, 0, 0}, /* VQDMLAL */
+                    {0, 0, 0}, /* VMLSL */
+                    {0, 0, 0}, /* VQDMLSL */
+                    {0, 0, 0}, /* Integer VMULL */
+                    {0, 0, 0}, /* VQDMULL */
+                    {0, 0, 0}  /* Polynomial VMULL */
+                };
+
+                prewiden = neon_3reg_wide[op][0];
+                src1_wide = neon_3reg_wide[op][1];
+                src2_wide = neon_3reg_wide[op][2];
+
+                /* Avoid overlapping operands.  Wide source operands are
+                   always aligned so will never overlap with wide
+                   destinations in problematic ways.  */
+                if (rd == rm) {
+                    NEON_GET_REG(T2, rm, 1);
+                } else if (rd == rn) {
+                    NEON_GET_REG(T2, rn, 1);
+                }
+                for (pass = 0; pass < 2; pass++) {
+                    /* Load the second operand into env->vfp.scratch.
+                       Also widen narrow operands.  */
+                    if (pass == 1 && rd == rm) {
+                        if (prewiden) {
+                            gen_op_movl_T0_T2();
+                        } else {
+                            gen_op_movl_T1_T2();
+                        }
+                    } else {
+                        if (src2_wide) {
+                            NEON_GET_REG(T0, rm, pass * 2);
+                            NEON_GET_REG(T1, rm, pass * 2 + 1);
+                        } else {
+                            if (prewiden) {
+                                NEON_GET_REG(T0, rm, pass);
+                            } else {
+                                NEON_GET_REG(T1, rm, pass);
+                            }
+                        }
+                    }
+                    if (prewiden && !src2_wide) {
+                        GEN_NEON_INTEGER_OP(widen);
+                    }
+                    if (prewiden || src2_wide) {
+                        gen_neon_movl_scratch_T0(0);
+                        gen_neon_movl_scratch_T1(1);
+                    }
+
+                    /* Load the first operand.  */
+                    if (pass == 1 && rd == rn) {
+                        gen_op_movl_T0_T2();
+                    } else {
+                        if (src1_wide) {
+                            NEON_GET_REG(T0, rn, pass * 2);
+                            NEON_GET_REG(T1, rn, pass * 2 + 1);
+                        } else {
+                            NEON_GET_REG(T0, rn, pass);
+                        }
+                    }
+                    if (prewiden && !src1_wide) {
+                        GEN_NEON_INTEGER_OP(widen);
+                    }
+                    switch (op) {
+                    case 0: case 1: case 4: /* VADDL, VADDW, VADDHN, VRADDHN */
+                        switch (size) {
+                        case 0: gen_op_neon_addl_u16(); break;
+                        case 1: gen_op_neon_addl_u32(); break;
+                        case 2: gen_op_neon_addl_u64(); break;
+                        default: abort();
+                        }
+                        break;
+                    case 2: case 3: case 6: /* VSUBL, VSUBW, VSUBHL, VRSUBHL */
+                        switch (size) {
+                        case 0: gen_op_neon_subl_u16(); break;
+                        case 1: gen_op_neon_subl_u32(); break;
+                        case 2: gen_op_neon_subl_u64(); break;
+                        default: abort();
+                        }
+                        break;
+                    case 5: case 7: /* VABAL, VABDL */
+                        switch ((size << 1) | u) {
+                        case 0: gen_op_neon_abdl_s16(); break;
+                        case 1: gen_op_neon_abdl_u16(); break;
+                        case 2: gen_op_neon_abdl_s32(); break;
+                        case 3: gen_op_neon_abdl_u32(); break;
+                        case 4: gen_op_neon_abdl_s64(); break;
+                        case 5: gen_op_neon_abdl_u64(); break;
+                        default: abort();
+                        }
+                        break;
+                    case 8: case 9: case 10: case 11: case 12: case 13:
+                        /* VMLAL, VQDMLAL, VMLSL, VQDMLSL, VMULL, VQDMULL */
+                        switch ((size << 1) | u) {
+                        case 0: gen_op_neon_mull_s8(); break;
+                        case 1: gen_op_neon_mull_u8(); break;
+                        case 2: gen_op_neon_mull_s16(); break;
+                        case 3: gen_op_neon_mull_u16(); break;
+                        case 4: gen_op_imull_T0_T1(); break;
+                        case 5: gen_op_mull_T0_T1(); break;
+                        default: abort();
+                        }
+                        break;
+                    case 14: /* Polynomial VMULL */
+                        cpu_abort(env, "Polynomial VMULL not implemented");
+
+                    default: /* 15 is RESERVED.  */
+                        return 1;
+                    }
+                    if (op == 5 || op == 13 || (op >= 8 && op <= 11)) {
+                        /* Accumulate.  */
+                        if (op == 10 || op == 11) {
+                            switch (size) {
+                            case 0: gen_op_neon_negl_u16(); break;
+                            case 1: gen_op_neon_negl_u32(); break;
+                            case 2: gen_op_neon_negl_u64(); break;
+                            default: abort();
+                            }
+                        }
+
+                        gen_neon_movl_scratch_T0(0);
+                        gen_neon_movl_scratch_T1(1);
+
+                        if (op != 13) {
+                            NEON_GET_REG(T0, rd, pass * 2);
+                            NEON_GET_REG(T1, rd, pass * 2 + 1);
+                        }
+
+                        switch (op) {
+                        case 5: case 8: case 10: /* VABAL, VMLAL, VMLSL */
+                            switch (size) {
+                            case 0: gen_op_neon_addl_u16(); break;
+                            case 1: gen_op_neon_addl_u32(); break;
+                            case 2: gen_op_neon_addl_u64(); break;
+                            default: abort();
+                            }
+                            break;
+                        case 9: case 11: /* VQDMLAL, VQDMLSL */
+                            switch (size) {
+                            case 1: gen_op_neon_addl_saturate_s32(); break;
+                            case 2: gen_op_neon_addl_saturate_s64(); break;
+                            default: abort();
+                            }
+                            /* Fall through.  */
+                        case 13: /* VQDMULL */
+                            switch (size) {
+                            case 1: gen_op_neon_addl_saturate_s32(); break;
+                            case 2: gen_op_neon_addl_saturate_s64(); break;
+                            default: abort();
+                            }
+                            break;
+                        default:
+                            abort();
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    } else if (op == 4 || op == 6) {
+                        /* Narrowing operation.  */
+                        if (u) {
+                            switch (size) {
+                            case 0: gen_op_neon_narrow_high_u8(); break;
+                            case 1: gen_op_neon_narrow_high_u16(); break;
+                            case 2: gen_op_movl_T0_T1(); break;
+                            default: abort();
+                            }
+                        } else {
+                            switch (size) {
+                            case 0: gen_op_neon_narrow_high_round_u8(); break;
+                            case 1: gen_op_neon_narrow_high_round_u16(); break;
+                            case 2: gen_op_neon_narrow_high_round_u32(); break;
+                            default: abort();
+                            }
+                        }
+                        NEON_SET_REG(T0, rd, pass);
+                    } else {
+                        /* Write back the result.  */
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    }
+                }
+            } else {
+                /* Two registers and a scalar.  */
+                switch (op) {
+                case 0: /* Integer VMLA scalar */
+                case 1: /* Float VMLA scalar */
+                case 4: /* Integer VMLS scalar */
+                case 5: /* Floating point VMLS scalar */
+                case 8: /* Integer VMUL scalar */
+                case 9: /* Floating point VMUL scalar */
+                case 12: /* VQDMULH scalar */
+                case 13: /* VQRDMULH scalar */
+                    gen_neon_get_scalar(size, rm);
+                    gen_op_movl_T2_T0();
+                    for (pass = 0; pass < (u ? 4 : 2); pass++) {
+                        if (pass != 0)
+                            gen_op_movl_T0_T2();
+                        NEON_GET_REG(T1, rn, pass);
+                        if (op == 12) {
+                            if (size == 1) {
+                                gen_op_neon_qdmulh_s16();
+                            } else {
+                                gen_op_neon_qdmulh_s32();
+                            }
+                        } else if (op == 13) {
+                            if (size == 1) {
+                                gen_op_neon_qrdmulh_s16();
+                            } else {
+                                gen_op_neon_qrdmulh_s32();
+                            }
+                        } else if (op & 1) {
+                            gen_op_neon_mul_f32();
+                        } else {
+                            switch (size) {
+                            case 0: gen_op_neon_mul_u8(); break;
+                            case 1: gen_op_neon_mul_u16(); break;
+                            case 2: gen_op_mul_T0_T1(); break;
+                            default: return 1;
+                            }
+                        }
+                        if (op < 8) {
+                            /* Accumulate.  */
+                            NEON_GET_REG(T1, rd, pass);
+                            switch (op) {
+                            case 0:
+                                gen_neon_add(size);
+                                break;
+                            case 1:
+                                gen_op_neon_add_f32();
+                                break;
+                            case 4:
+                                switch (size) {
+                                case 0: gen_op_neon_rsb_u8(); break;
+                                case 1: gen_op_neon_rsb_u16(); break;
+                                case 2: gen_op_rsbl_T0_T1(); break;
+                                default: return 1;
+                                }
+                                break;
+                            case 5:
+                                gen_op_neon_rsb_f32();
+                                break;
+                            default:
+                                abort();
+                            }
+                        }
+                        NEON_SET_REG(T0, rd, pass);
+                    }
+                    break;
+                case 2: /* VMLAL sclar */
+                case 3: /* VQDMLAL scalar */
+                case 6: /* VMLSL scalar */
+                case 7: /* VQDMLSL scalar */
+                case 10: /* VMULL scalar */
+                case 11: /* VQDMULL scalar */
+                    if (rd == rn) {
+                        /* Save overlapping operands before they are
+                           clobbered.  */
+                        NEON_GET_REG(T0, rn, 1);
+                        gen_neon_movl_scratch_T0(2);
+                    }
+                    gen_neon_get_scalar(size, rm);
+                    gen_op_movl_T2_T0();
+                    for (pass = 0; pass < 2; pass++) {
+                        if (pass != 0) {
+                            gen_op_movl_T0_T2();
+                        }
+                        if (pass != 0 && rd == rn) {
+                            gen_neon_movl_T1_scratch(2);
+                        } else {
+                            NEON_GET_REG(T1, rn, pass);
+                        }
+                        switch ((size << 1) | u) {
+                        case 0: gen_op_neon_mull_s8(); break;
+                        case 1: gen_op_neon_mull_u8(); break;
+                        case 2: gen_op_neon_mull_s16(); break;
+                        case 3: gen_op_neon_mull_u16(); break;
+                        case 4: gen_op_imull_T0_T1(); break;
+                        case 5: gen_op_mull_T0_T1(); break;
+                        default: abort();
+                        }
+                        if (op == 6 || op == 7) {
+                            switch (size) {
+                            case 0: gen_op_neon_negl_u16(); break;
+                            case 1: gen_op_neon_negl_u32(); break;
+                            case 2: gen_op_neon_negl_u64(); break;
+                            default: abort();
+                            }
+                        }
+                        gen_neon_movl_scratch_T0(0);
+                        gen_neon_movl_scratch_T1(1);
+                        NEON_GET_REG(T0, rd, pass * 2);
+                        NEON_GET_REG(T1, rd, pass * 2 + 1);
+                        switch (op) {
+                        case 2: case 6:
+                            switch (size) {
+                            case 0: gen_op_neon_addl_u16(); break;
+                            case 1: gen_op_neon_addl_u32(); break;
+                            case 2: gen_op_neon_addl_u64(); break;
+                            default: abort();
+                            }
+                            break;
+                        case 3: case 7:
+                            switch (size) {
+                            case 1:
+                                gen_op_neon_addl_saturate_s32();
+                                gen_op_neon_addl_saturate_s32();
+                                break;
+                            case 2:
+                                gen_op_neon_addl_saturate_s64();
+                                gen_op_neon_addl_saturate_s64();
+                                break;
+                            default: abort();
+                            }
+                            break;
+                        case 10:
+                            /* no-op */
+                            break;
+                        case 11:
+                            switch (size) {
+                            case 1: gen_op_neon_addl_saturate_s32(); break;
+                            case 2: gen_op_neon_addl_saturate_s64(); break;
+                            default: abort();
+                            }
+                            break;
+                        default:
+                            abort();
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    }
+                    break;
+                default: /* 14 and 15 are RESERVED */
+                    return 1;
+                }
+            }
+        } else { /* size == 3 */
+            if (!u) {
+                /* Extract.  */
+                int reg;
+                imm = (insn >> 8) & 0xf;
+                reg = rn;
+                count = q ? 4 : 2;
+                n = imm >> 2;
+                NEON_GET_REG(T0, reg, n);
+                for (pass = 0; pass < count; pass++) {
+                    n++;
+                    if (n > count) {
+                        reg = rm;
+                        n -= count;
+                    }
+                    if (imm & 3) {
+                        NEON_GET_REG(T1, reg, n);
+                        gen_op_neon_extract((insn << 3) & 0x1f);
+                    }
+                    /* ??? This is broken if rd and rm overlap */
+                    NEON_SET_REG(T0, rd, pass);
+                    if (imm & 3) {
+                        gen_op_movl_T0_T1();
+                    } else {
+                        NEON_GET_REG(T0, reg, n);
+                    }
+                }
+            } else if ((insn & (1 << 11)) == 0) {
+                /* Two register misc.  */
+                op = ((insn >> 12) & 0x30) | ((insn >> 7) & 0xf);
+                size = (insn >> 18) & 3;
+                switch (op) {
+                case 0: /* VREV64 */
+                    if (size == 3)
+                        return 1;
+                    for (pass = 0; pass < (q ? 2 : 1); pass++) {
+                        NEON_GET_REG(T0, rm, pass * 2);
+                        NEON_GET_REG(T1, rm, pass * 2 + 1);
+                        switch (size) {
+                        case 0: gen_op_rev_T0(); break;
+                        case 1: gen_op_revh_T0(); break;
+                        case 2: /* no-op */ break;
+                        default: abort();
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2 + 1);
+                        if (size == 2) {
+                            NEON_SET_REG(T1, rd, pass * 2);
+                        } else {
+                            gen_op_movl_T0_T1();
+                            switch (size) {
+                            case 0: gen_op_rev_T0(); break;
+                            case 1: gen_op_revh_T0(); break;
+                            default: abort();
+                            }
+                            NEON_SET_REG(T0, rd, pass * 2);
+                        }
+                    }
+                    break;
+                case 4: case 5: /* VPADDL */
+                case 12: case 13: /* VPADAL */
+                    if (size < 2)
+                        goto elementwise;
+                    if (size == 3)
+                        return 1;
+                    for (pass = 0; pass < (q ? 2 : 1); pass++) {
+                        NEON_GET_REG(T0, rm, pass * 2);
+                        NEON_GET_REG(T1, rm, pass * 2 + 1);
+                        if (op & 1)
+                            gen_op_neon_paddl_u32();
+                        else
+                            gen_op_neon_paddl_s32();
+                        if (op >= 12) {
+                            /* Accumulate.  */
+                            gen_neon_movl_scratch_T0(0);
+                            gen_neon_movl_scratch_T1(1);
+
+                            NEON_GET_REG(T0, rd, pass * 2);
+                            NEON_GET_REG(T1, rd, pass * 2 + 1);
+                            gen_op_neon_addl_u64();
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    }
+                    break;
+                case 33: /* VTRN */
+                    if (size == 2) {
+                        for (n = 0; n < (q ? 4 : 2); n += 2) {
+                            NEON_GET_REG(T0, rm, n);
+                            NEON_GET_REG(T1, rd, n + 1);
+                            NEON_SET_REG(T1, rm, n);
+                            NEON_SET_REG(T0, rd, n + 1);
+                        }
+                    } else {
+                        goto elementwise;
+                    }
+                    break;
+                case 34: /* VUZP */
+                    /* Reg  Before       After
+                       Rd   A3 A2 A1 A0  B2 B0 A2 A0
+                       Rm   B3 B2 B1 B0  B3 B1 A3 A1
+                     */
+                    if (size == 3)
+                        return 1;
+                    gen_neon_unzip(rd, q, 0, size);
+                    gen_neon_unzip(rm, q, 4, size);
+                    if (q) {
+                        static int unzip_order_q[8] =
+                            {0, 2, 4, 6, 1, 3, 5, 7};
+                        for (n = 0; n < 8; n++) {
+                            int reg = (n < 4) ? rd : rm;
+                            gen_neon_movl_T0_scratch(unzip_order_q[n]);
+                            NEON_SET_REG(T0, reg, n % 4);
+                        }
+                    } else {
+                        static int unzip_order[4] =
+                            {0, 4, 1, 5};
+                        for (n = 0; n < 4; n++) {
+                            int reg = (n < 2) ? rd : rm;
+                            gen_neon_movl_T0_scratch(unzip_order[n]);
+                            NEON_SET_REG(T0, reg, n % 2);
+                        }
+                    }
+                    break;
+                case 35: /* VZIP */
+                    /* Reg  Before       After
+                       Rd   A3 A2 A1 A0  B1 A1 B0 A0
+                       Rm   B3 B2 B1 B0  B3 A3 B2 A2
+                     */
+                    if (size == 3)
+                        return 1;
+                    count = (q ? 4 : 2);
+                    for (n = 0; n < count; n++) {
+                        NEON_GET_REG(T0, rd, n);
+                        NEON_GET_REG(T1, rd, n);
+                        switch (size) {
+                        case 0: gen_op_neon_zip_u8(); break;
+                        case 1: gen_op_neon_zip_u16(); break;
+                        case 2: /* no-op */; break;
+                        default: abort();
+                        }
+                        gen_neon_movl_scratch_T0(n * 2);
+                        gen_neon_movl_scratch_T1(n * 2 + 1);
+                    }
+                    for (n = 0; n < count * 2; n++) {
+                        int reg = (n < count) ? rd : rm;
+                        gen_neon_movl_T0_scratch(n);
+                        NEON_SET_REG(T0, reg, n % count);
+                    }
+                    break;
+                case 36: case 37: /* VMOVN, VQMOVUN, VQMOVN */
+                    for (pass = 0; pass < 2; pass++) {
+                        if (rd == rm + 1) {
+                            n = 1 - pass;
+                        } else {
+                            n = pass;
+                        }
+                        NEON_GET_REG(T0, rm, n * 2);
+                        NEON_GET_REG(T1, rm, n * 2 + 1);
+                        if (op == 36 && q == 0) {
+                            switch (size) {
+                            case 0: gen_op_neon_narrow_u8(); break;
+                            case 1: gen_op_neon_narrow_u16(); break;
+                            case 2: /* no-op */ break;
+                            default: return 1;
+                            }
+                        } else if (q) {
+                            switch (size) {
+                            case 0: gen_op_neon_narrow_sat_u8(); break;
+                            case 1: gen_op_neon_narrow_sat_u16(); break;
+                            case 2: gen_op_neon_narrow_sat_u32(); break;
+                            default: return 1;
+                            }
+                        } else {
+                            switch (size) {
+                            case 0: gen_op_neon_narrow_sat_s8(); break;
+                            case 1: gen_op_neon_narrow_sat_s16(); break;
+                            case 2: gen_op_neon_narrow_sat_s32(); break;
+                            default: return 1;
+                            }
+                        }
+                        NEON_SET_REG(T0, rd, n);
+                    }
+                    break;
+                case 38: /* VSHLL */
+                    if (q)
+                        return 1;
+                    if (rm == rd) {
+                        NEON_GET_REG(T2, rm, 1);
+                    }
+                    for (pass = 0; pass < 2; pass++) {
+                        if (pass == 1 && rm == rd) {
+                            gen_op_movl_T0_T2();
+                        } else {
+                            NEON_GET_REG(T0, rm, pass);
+                        }
+                        switch (size) {
+                        case 0: gen_op_neon_widen_high_u8(); break;
+                        case 1: gen_op_neon_widen_high_u16(); break;
+                        case 2:
+                            gen_op_movl_T1_T0();
+                            gen_op_movl_T0_im(0);
+                            break;
+                        default: return 1;
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    }
+                    break;
+                default:
+                elementwise:
+                    for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                        if (op == 30 || op == 31 || op >= 58) {
+                            gen_op_vfp_getreg_F0s(neon_reg_offset(rm, pass));
+                        } else {
+                            NEON_GET_REG(T0, rm, pass);
+                        }
+                        switch (op) {
+                        case 1: /* VREV32 */
+                            switch (size) {
+                            case 0: gen_op_rev_T0(); break;
+                            case 1: gen_op_revh_T0(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 2: /* VREV16 */
+                            if (size != 0)
+                                return 1;
+                            gen_op_rev16_T0();
+                            break;
+                        case 4: case 5: /* VPADDL */
+                        case 12: case 13: /* VPADAL */
+                            switch ((size << 1) | (op & 1)) {
+                            case 0: gen_op_neon_paddl_s8(); break;
+                            case 1: gen_op_neon_paddl_u8(); break;
+                            case 2: gen_op_neon_paddl_s16(); break;
+                            case 3: gen_op_neon_paddl_u16(); break;
+                            default: abort();
+                            }
+                            if (op >= 12) {
+                                /* Accumulate */
+                                NEON_GET_REG(T1, rd, pass);
+                                switch (size) {
+                                case 0: gen_op_neon_add_u16(); break;
+                                case 1: gen_op_addl_T0_T1(); break;
+                                default: abort();
+                                }
+                            }
+                            break;
+                        case 8: /* CLS */
+                            switch (size) {
+                            case 0: gen_op_neon_cls_s8(); break;
+                            case 1: gen_op_neon_cls_s16(); break;
+                            case 2: gen_op_neon_cls_s32(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 9: /* CLZ */
+                            switch (size) {
+                            case 0: gen_op_neon_clz_u8(); break;
+                            case 1: gen_op_neon_clz_u16(); break;
+                            case 2: gen_op_clz_T0(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 10: /* CNT */
+                            if (size != 0)
+                                return 1;
+                            gen_op_neon_cnt_u8();
+                            break;
+                        case 11: /* VNOT */
+                            if (size != 0)
+                                return 1;
+                            gen_op_notl_T0();
+                            break;
+                        case 14: /* VQABS */
+                            switch (size) {
+                            case 0: gen_op_neon_qabs_s8(); break;
+                            case 1: gen_op_neon_qabs_s16(); break;
+                            case 2: gen_op_neon_qabs_s32(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 15: /* VQNEG */
+                            switch (size) {
+                            case 0: gen_op_neon_qneg_s8(); break;
+                            case 1: gen_op_neon_qneg_s16(); break;
+                            case 2: gen_op_neon_qneg_s32(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 16: case 19: /* VCGT #0, VCLE #0 */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_op_neon_cgt_s8(); break;
+                            case 1: gen_op_neon_cgt_s16(); break;
+                            case 2: gen_op_neon_cgt_s32(); break;
+                            default: return 1;
+                            }
+                            if (op == 19)
+                                gen_op_notl_T0();
+                            break;
+                        case 17: case 20: /* VCGE #0, VCLT #0 */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_op_neon_cge_s8(); break;
+                            case 1: gen_op_neon_cge_s16(); break;
+                            case 2: gen_op_neon_cge_s32(); break;
+                            default: return 1;
+                            }
+                            if (op == 20)
+                                gen_op_notl_T0();
+                            break;
+                        case 18: /* VCEQ #0 */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_op_neon_ceq_u8(); break;
+                            case 1: gen_op_neon_ceq_u16(); break;
+                            case 2: gen_op_neon_ceq_u32(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 22: /* VABS */
+                            switch(size) {
+                            case 0: gen_op_neon_abs_s8(); break;
+                            case 1: gen_op_neon_abs_s16(); break;
+                            case 2: gen_op_neon_abs_s32(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 23: /* VNEG */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_op_neon_rsb_u8(); break;
+                            case 1: gen_op_neon_rsb_u16(); break;
+                            case 2: gen_op_rsbl_T0_T1(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 24: case 27: /* Float VCGT #0, Float VCLE #0 */
+                            gen_op_movl_T1_im(0);
+                            gen_op_neon_cgt_f32();
+                            if (op == 27)
+                                gen_op_notl_T0();
+                            break;
+                        case 25: case 28: /* Float VCGE #0, Float VCLT #0 */
+                            gen_op_movl_T1_im(0);
+                            gen_op_neon_cge_f32();
+                            if (op == 28)
+                                gen_op_notl_T0();
+                            break;
+                        case 26: /* Float VCEQ #0 */
+                            gen_op_movl_T1_im(0);
+                            gen_op_neon_ceq_f32();
+                            break;
+                        case 30: /* Float VABS */
+                            gen_op_vfp_abss();
+                            break;
+                        case 31: /* Float VNEG */
+                            gen_op_vfp_negs();
+                            break;
+                        case 32: /* VSWP */
+                            NEON_GET_REG(T1, rd, pass);
+                            NEON_SET_REG(T1, rm, pass);
+                            break;
+                        case 33: /* VTRN */
+                            NEON_GET_REG(T1, rd, pass);
+                            switch (size) {
+                            case 0: gen_op_neon_trn_u8(); break;
+                            case 1: gen_op_neon_trn_u16(); break;
+                            case 2: abort();
+                            default: return 1;
+                            }
+                            NEON_SET_REG(T1, rm, pass);
+                            break;
+                        case 56: /* Integer VRECPE */
+                            gen_op_neon_recpe_u32();
+                            break;
+                        case 57: /* Integer VRSQRTE */
+                            gen_op_neon_rsqrte_u32();
+                            break;
+                        case 58: /* Float VRECPE */
+                            gen_op_neon_recpe_f32();
+                            break;
+                        case 59: /* Float VRSQRTE */
+                            gen_op_neon_rsqrte_f32();
+                            break;
+                        case 60: /* VCVT.F32.S32 */
+                            gen_op_vfp_tosizs();
+                            break;
+                        case 61: /* VCVT.F32.U32 */
+                            gen_op_vfp_touizs();
+                            break;
+                        case 62: /* VCVT.S32.F32 */
+                            gen_op_vfp_sitos();
+                            break;
+                        case 63: /* VCVT.U32.F32 */
+                            gen_op_vfp_uitos();
+                            break;
+                        default:
+                            /* Reserved: 21, 29, 39-56 */
+                            return 1;
+                        }
+                        if (op == 30 || op == 31 || op >= 58) {
+                            gen_op_vfp_setreg_F0s(neon_reg_offset(rm, pass));
+                        } else {
+                            NEON_SET_REG(T0, rd, pass);
+                        }
+                    }
+                    break;
+                }
+            } else if ((insn & (1 << 10)) == 0) {
+                /* VTBL, VTBX.  */
+                n = (insn >> 5) & 0x18;
+                NEON_GET_REG(T1, rm, 0);
+                if (insn & (1 << 6)) {
+                    NEON_GET_REG(T0, rd, 0);
+                } else {
+                    gen_op_movl_T0_im(0);
+                }
+                gen_op_neon_tbl(rn, n);
+                gen_op_movl_T2_T0();
+                NEON_GET_REG(T1, rm, 1);
+                if (insn & (1 << 6)) {
+                    NEON_GET_REG(T0, rd, 0);
+                } else {
+                    gen_op_movl_T0_im(0);
+                }
+                gen_op_neon_tbl(rn, n);
+                NEON_SET_REG(T2, rd, 0);
+                NEON_SET_REG(T0, rd, 1);
+            } else if ((insn & 0x380) == 0) {
+                /* VDUP */
+                if (insn & (1 << 19)) {
+                    NEON_SET_REG(T0, rm, 1);
+                } else {
+                    NEON_SET_REG(T0, rm, 0);
+                }
+                if (insn & (1 << 16)) {
+                    gen_op_neon_dup_u8(((insn >> 17) & 3) * 8);
+                } else if (insn & (1 << 17)) {
+                    if ((insn >> 18) & 1)
+                        gen_op_neon_dup_high16();
+                    else
+                        gen_op_neon_dup_low16();
+                }
+                for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                    NEON_SET_REG(T0, rd, pass);
+                }
+            } else {
+                return 1;
+            }
+        }
+    }
+    return 0;
+}
+
+static int disas_coproc_insn(CPUState * env, DisasContext *s, uint32_t insn)
+{
+    int cpnum;
+
+    cpnum = (insn >> 8) & 0xf;
+    if (arm_feature(env, ARM_FEATURE_XSCALE)
+	    && ((env->cp15.c15_cpar ^ 0x3fff) & (1 << cpnum)))
+	return 1;
+
+    switch (cpnum) {
+      case 0:
+      case 1:
+	if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
+	    return disas_iwmmxt_insn(env, s, insn);
+	} else if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+	    return disas_dsp_insn(env, s, insn);
+	}
+	return 1;
+    case 10:
+    case 11:
+	return disas_vfp_insn (env, s, insn);
+    case 15:
+	return disas_cp15_insn (env, s, insn);
+    default:
+	/* Unknown coprocessor.  See if the board has hooked it.  */
+	return disas_cp_insn (env, s, insn);
+    }
+}
+
 static void disas_arm_insn(CPUState * env, DisasContext *s)
 {
     unsigned int cond, insn, val, op1, i, shift, rm, rs, rn, rd, sh;
@@ -2209,12 +4651,137 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
     insn = ldl_code(s->pc);
     s->pc += 4;
 
+    /* M variants do not implement ARM mode.  */
+    if (IS_M(env))
+        goto illegal_op;
     cond = insn >> 28;
     if (cond == 0xf){
         /* Unconditional instructions.  */
+        if (((insn >> 25) & 7) == 1) {
+            /* NEON Data processing.  */
+            if (!arm_feature(env, ARM_FEATURE_NEON))
+                goto illegal_op;
+
+            if (disas_neon_data_insn(env, s, insn))
+                goto illegal_op;
+            return;
+        }
+        if ((insn & 0x0f100000) == 0x04000000) {
+            /* NEON load/store.  */
+            if (!arm_feature(env, ARM_FEATURE_NEON))
+                goto illegal_op;
+
+            if (disas_neon_ls_insn(env, s, insn))
+                goto illegal_op;
+            return;
+        }
         if ((insn & 0x0d70f000) == 0x0550f000)
             return; /* PLD */
-        else if ((insn & 0x0e000000) == 0x0a000000) {
+        else if ((insn & 0x0ffffdff) == 0x01010000) {
+            ARCH(6);
+            /* setend */
+            if (insn & (1 << 9)) {
+                /* BE8 mode not implemented.  */
+                goto illegal_op;
+            }
+            return;
+        } else if ((insn & 0x0fffff00) == 0x057ff000) {
+            switch ((insn >> 4) & 0xf) {
+            case 1: /* clrex */
+                ARCH(6K);
+                gen_op_clrex();
+                return;
+            case 4: /* dsb */
+            case 5: /* dmb */
+            case 6: /* isb */
+                ARCH(7);
+                /* We don't emulate caches so these are a no-op.  */
+                return;
+            default:
+                goto illegal_op;
+            }
+        } else if ((insn & 0x0e5fffe0) == 0x084d0500) {
+            /* srs */
+            uint32_t offset;
+            if (IS_USER(s))
+                goto illegal_op;
+            ARCH(6);
+            op1 = (insn & 0x1f);
+            if (op1 == (env->uncached_cpsr & CPSR_M)) {
+                gen_movl_T1_reg(s, 13);
+            } else {
+                gen_op_movl_T1_r13_banked(op1);
+            }
+            i = (insn >> 23) & 3;
+            switch (i) {
+            case 0: offset = -4; break; /* DA */
+            case 1: offset = -8; break; /* DB */
+            case 2: offset = 0; break; /* IA */
+            case 3: offset = 4; break; /* IB */
+            default: abort();
+            }
+            if (offset)
+                gen_op_addl_T1_im(offset);
+            gen_movl_T0_reg(s, 14);
+            gen_ldst(stl, s);
+            gen_op_movl_T0_cpsr();
+            gen_op_addl_T1_im(4);
+            gen_ldst(stl, s);
+            if (insn & (1 << 21)) {
+                /* Base writeback.  */
+                switch (i) {
+                case 0: offset = -8; break;
+                case 1: offset = -4; break;
+                case 2: offset = 4; break;
+                case 3: offset = 0; break;
+                default: abort();
+                }
+                if (offset)
+                    gen_op_addl_T1_im(offset);
+                if (op1 == (env->uncached_cpsr & CPSR_M)) {
+                    gen_movl_reg_T1(s, 13);
+                } else {
+                    gen_op_movl_r13_T1_banked(op1);
+                }
+            }
+        } else if ((insn & 0x0e5fffe0) == 0x081d0a00) {
+            /* rfe */
+            uint32_t offset;
+            if (IS_USER(s))
+                goto illegal_op;
+            ARCH(6);
+            rn = (insn >> 16) & 0xf;
+            gen_movl_T1_reg(s, rn);
+            i = (insn >> 23) & 3;
+            switch (i) {
+            case 0: offset = 0; break; /* DA */
+            case 1: offset = -4; break; /* DB */
+            case 2: offset = 4; break; /* IA */
+            case 3: offset = 8; break; /* IB */
+            default: abort();
+            }
+            if (offset)
+                gen_op_addl_T1_im(offset);
+            /* Load CPSR into T2 and PC into T0.  */
+            gen_ldst(ldl, s);
+            gen_op_movl_T2_T0();
+            gen_op_addl_T1_im(-4);
+            gen_ldst(ldl, s);
+            if (insn & (1 << 21)) {
+                /* Base writeback.  */
+                switch (i) {
+                case 0: offset = -4; break;
+                case 1: offset = 0; break;
+                case 2: offset = 8; break;
+                case 3: offset = 4; break;
+                default: abort();
+                }
+                if (offset)
+                    gen_op_addl_T1_im(offset);
+                gen_movl_reg_T1(s, rn);
+            }
+            gen_rfe(s);
+        } else if ((insn & 0x0e000000) == 0x0a000000) {
             /* branch link and change to thumb (blx <offset>) */
             int32_t offset;
 
@@ -2242,12 +4809,29 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
         } else if ((insn & 0x0f000010) == 0x0e000010) {
             /* Additional coprocessor register transfer.  */
         } else if ((insn & 0x0ff10010) == 0x01000000) {
+            uint32_t mask;
+            uint32_t val;
             /* cps (privileged) */
-        } else if ((insn & 0x0ffffdff) == 0x01010000) {
-            /* setend */
-            if (insn & (1 << 9)) {
-                /* BE8 mode not implemented.  */
-                goto illegal_op;
+            if (IS_USER(s))
+                return;
+            mask = val = 0;
+            if (insn & (1 << 19)) {
+                if (insn & (1 << 8))
+                    mask |= CPSR_A;
+                if (insn & (1 << 7))
+                    mask |= CPSR_I;
+                if (insn & (1 << 6))
+                    mask |= CPSR_F;
+                if (insn & (1 << 18))
+                    val |= mask;
+            }
+            if (insn & (1 << 14)) {
+                mask |= CPSR_M;
+                val |= (insn & 0x1f);
+            }
+            if (mask) {
+                gen_op_movl_T0_im(val);
+                gen_set_psr_T0(s, mask, 0);
             }
             return;
         }
@@ -2259,21 +4843,41 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
         s->condlabel = gen_new_label();
         gen_test_cc[cond ^ 1](s->condlabel);
         s->condjmp = 1;
-        //gen_test_cc[cond ^ 1]((long)s->tb, (long)s->pc);
-        //s->is_jmp = DISAS_JUMP_NEXT;
     }
     if ((insn & 0x0f900000) == 0x03000000) {
-        if ((insn & 0x0fb0f000) != 0x0320f000)
-            goto illegal_op;
-        /* CPSR = immediate */
-        val = insn & 0xff;
-        shift = ((insn >> 8) & 0xf) * 2;
-        if (shift)
-            val = (val >> shift) | (val << (32 - shift));
-        gen_op_movl_T0_im(val);
-        i = ((insn & (1 << 22)) != 0);
-        if (gen_set_psr_T0(s, msr_mask(s, (insn >> 16) & 0xf, i), i))
-            goto illegal_op;
+        if ((insn & (1 << 21)) == 0) {
+            ARCH(6T2);
+            rd = (insn >> 12) & 0xf;
+            val = ((insn >> 4) & 0xf000) | (insn & 0xfff);
+            if ((insn & (1 << 22)) == 0) {
+                /* MOVW */
+                gen_op_movl_T0_im(val);
+            } else {
+                /* MOVT */
+                gen_movl_T0_reg(s, rd);
+                gen_op_movl_T1_im(0xffff);
+                gen_op_andl_T0_T1();
+                gen_op_movl_T1_im(val << 16);
+                gen_op_orl_T0_T1();
+            }
+            gen_movl_reg_T0(s, rd);
+        } else {
+            if (((insn >> 12) & 0xf) != 0xf)
+                goto illegal_op;
+            if (((insn >> 16) & 0xf) == 0) {
+                gen_nop_hint(s, insn & 0xff);
+            } else {
+                /* CPSR = immediate */
+                val = insn & 0xff;
+                shift = ((insn >> 8) & 0xf) * 2;
+                if (shift)
+                    val = (val >> shift) | (val << (32 - shift));
+                gen_op_movl_T0_im(val);
+                i = ((insn & (1 << 22)) != 0);
+                if (gen_set_psr_T0(s, msr_mask(env, s, (insn >> 16) & 0xf, i), i))
+                    goto illegal_op;
+            }
+        }
     } else if ((insn & 0x0f900000) == 0x01000000
                && (insn & 0x00000090) != 0x00000090) {
         /* miscellaneous instructions */
@@ -2286,7 +4890,7 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                 /* PSR = reg */
                 gen_movl_T0_reg(s, rm);
                 i = ((op1 & 2) != 0);
-                if (gen_set_psr_T0(s, msr_mask(s, (insn >> 16) & 0xf, i), i))
+                if (gen_set_psr_T0(s, msr_mask(env, s, (insn >> 16) & 0xf, i), i))
                     goto illegal_op;
             } else {
                 /* reg = PSR */
@@ -2351,6 +4955,7 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
             gen_movl_reg_T0(s, rd);
             break;
         case 7: /* bkpt */
+            gen_set_condexec(s);
             gen_op_movl_T0_im((long)s->pc - 4);
             gen_op_movl_reg_TN[0][15]();
             gen_op_bkpt();
@@ -2585,19 +5190,28 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                     rn = (insn >> 12) & 0xf;
                     rs = (insn >> 8) & 0xf;
                     rm = (insn) & 0xf;
-                    if (((insn >> 22) & 3) == 0) {
+                    op1 = (insn >> 20) & 0xf;
+                    switch (op1) {
+                    case 0: case 1: case 2: case 3: case 6:
                         /* 32 bit mul */
                         gen_movl_T0_reg(s, rs);
                         gen_movl_T1_reg(s, rm);
                         gen_op_mul_T0_T1();
-                        if (insn & (1 << 21)) {
+                        if (insn & (1 << 22)) {
+                            /* Subtract (mls) */
+                            ARCH(6T2);
+                            gen_movl_T1_reg(s, rn);
+                            gen_op_rsbl_T0_T1();
+                        } else if (insn & (1 << 21)) {
+                            /* Add */
                             gen_movl_T1_reg(s, rn);
                             gen_op_addl_T0_T1();
                         }
                         if (insn & (1 << 20))
                             gen_op_logic_T0_cc();
                         gen_movl_reg_T0(s, rd);
-                    } else {
+                        break;
+                    default:
                         /* 64 bit mul */
                         gen_movl_T0_reg(s, rs);
                         gen_movl_T1_reg(s, rm);
@@ -2616,13 +5230,22 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                             gen_op_logicq_cc();
                         gen_movl_reg_T0(s, rn);
                         gen_movl_reg_T1(s, rd);
+                        break;
                     }
                 } else {
                     rn = (insn >> 16) & 0xf;
                     rd = (insn >> 12) & 0xf;
                     if (insn & (1 << 23)) {
                         /* load/store exclusive */
-                        goto illegal_op;
+                        gen_movl_T1_reg(s, rn);
+                        if (insn & (1 << 20)) {
+                            gen_ldst(ldlex, s);
+                        } else {
+                            rm = insn & 0xf;
+                            gen_movl_T0_reg(s, rm);
+                            gen_ldst(stlex, s);
+                        }
+                        gen_movl_reg_T0(s, rd);
                     } else {
                         /* SWP instruction */
                         rm = (insn) & 0xf;
@@ -2708,8 +5331,227 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
             break;
         case 0x4:
         case 0x5:
+            goto do_ldst;
         case 0x6:
         case 0x7:
+            if (insn & (1 << 4)) {
+                ARCH(6);
+                /* Armv6 Media instructions.  */
+                rm = insn & 0xf;
+                rn = (insn >> 16) & 0xf;
+                rd = (insn >> 12) & 0xf;
+                rs = (insn >> 8) & 0xf;
+                switch ((insn >> 23) & 3) {
+                case 0: /* Parallel add/subtract.  */
+                    op1 = (insn >> 20) & 7;
+                    gen_movl_T0_reg(s, rn);
+                    gen_movl_T1_reg(s, rm);
+                    sh = (insn >> 5) & 7;
+                    if ((op1 & 3) == 0 || sh == 5 || sh == 6)
+                        goto illegal_op;
+                    gen_arm_parallel_addsub[op1][sh]();
+                    gen_movl_reg_T0(s, rd);
+                    break;
+                case 1:
+                    if ((insn & 0x00700020) == 0) {
+                        /* Hafword pack.  */
+                        gen_movl_T0_reg(s, rn);
+                        gen_movl_T1_reg(s, rm);
+                        shift = (insn >> 7) & 0x1f;
+                        if (shift)
+                            gen_op_shll_T1_im(shift);
+                        if (insn & (1 << 6))
+                            gen_op_pkhtb_T0_T1();
+                        else
+                            gen_op_pkhbt_T0_T1();
+                        gen_movl_reg_T0(s, rd);
+                    } else if ((insn & 0x00200020) == 0x00200000) {
+                        /* [us]sat */
+                        gen_movl_T1_reg(s, rm);
+                        shift = (insn >> 7) & 0x1f;
+                        if (insn & (1 << 6)) {
+                            if (shift == 0)
+                                shift = 31;
+                            gen_op_sarl_T1_im(shift);
+                        } else {
+                            gen_op_shll_T1_im(shift);
+                        }
+                        sh = (insn >> 16) & 0x1f;
+                        if (sh != 0) {
+                            if (insn & (1 << 22))
+                                gen_op_usat_T1(sh);
+                            else
+                                gen_op_ssat_T1(sh);
+                        }
+                        gen_movl_T1_reg(s, rd);
+                    } else if ((insn & 0x00300fe0) == 0x00200f20) {
+                        /* [us]sat16 */
+                        gen_movl_T1_reg(s, rm);
+                        sh = (insn >> 16) & 0x1f;
+                        if (sh != 0) {
+                            if (insn & (1 << 22))
+                                gen_op_usat16_T1(sh);
+                            else
+                                gen_op_ssat16_T1(sh);
+                        }
+                        gen_movl_T1_reg(s, rd);
+                    } else if ((insn & 0x00700fe0) == 0x00000fa0) {
+                        /* Select bytes.  */
+                        gen_movl_T0_reg(s, rn);
+                        gen_movl_T1_reg(s, rm);
+                        gen_op_sel_T0_T1();
+                        gen_movl_reg_T0(s, rd);
+                    } else if ((insn & 0x000003e0) == 0x00000060) {
+                        gen_movl_T1_reg(s, rm);
+                        shift = (insn >> 10) & 3;
+                        /* ??? In many cases it's not neccessary to do a
+                           rotate, a shift is sufficient.  */
+                        if (shift != 0)
+                            gen_op_rorl_T1_im(shift * 8);
+                        op1 = (insn >> 20) & 7;
+                        switch (op1) {
+                        case 0: gen_op_sxtb16_T1(); break;
+                        case 2: gen_op_sxtb_T1();   break;
+                        case 3: gen_op_sxth_T1();   break;
+                        case 4: gen_op_uxtb16_T1(); break;
+                        case 6: gen_op_uxtb_T1();   break;
+                        case 7: gen_op_uxth_T1();   break;
+                        default: goto illegal_op;
+                        }
+                        if (rn != 15) {
+                            gen_movl_T2_reg(s, rn);
+                            if ((op1 & 3) == 0) {
+                                gen_op_add16_T1_T2();
+                            } else {
+                                gen_op_addl_T1_T2();
+                            }
+                        }
+                        gen_movl_reg_T1(s, rd);
+                    } else if ((insn & 0x003f0f60) == 0x003f0f20) {
+                        /* rev */
+                        gen_movl_T0_reg(s, rm);
+                        if (insn & (1 << 22)) {
+                            if (insn & (1 << 7)) {
+                                gen_op_revsh_T0();
+                            } else {
+                                ARCH(6T2);
+                                gen_op_rbit_T0();
+                            }
+                        } else {
+                            if (insn & (1 << 7))
+                                gen_op_rev16_T0();
+                            else
+                                gen_op_rev_T0();
+                        }
+                        gen_movl_reg_T0(s, rd);
+                    } else {
+                        goto illegal_op;
+                    }
+                    break;
+                case 2: /* Multiplies (Type 3).  */
+                    gen_movl_T0_reg(s, rm);
+                    gen_movl_T1_reg(s, rs);
+                    if (insn & (1 << 20)) {
+                        /* Signed multiply most significant [accumulate].  */
+                        gen_op_imull_T0_T1();
+                        if (insn & (1 << 5))
+                            gen_op_roundqd_T0_T1();
+                        else
+                            gen_op_movl_T0_T1();
+                        if (rn != 15) {
+                            gen_movl_T1_reg(s, rn);
+                            if (insn & (1 << 6)) {
+                                gen_op_addl_T0_T1();
+                            } else {
+                                gen_op_rsbl_T0_T1();
+                            }
+                        }
+                        gen_movl_reg_T0(s, rd);
+                    } else {
+                        if (insn & (1 << 5))
+                            gen_op_swap_half_T1();
+                        gen_op_mul_dual_T0_T1();
+                        if (insn & (1 << 22)) {
+                            if (insn & (1 << 6)) {
+                                /* smlald */
+                                gen_op_addq_T0_T1_dual(rn, rd);
+                            } else {
+                                /* smlsld */
+                                gen_op_subq_T0_T1_dual(rn, rd);
+                            }
+                        } else {
+                            /* This addition cannot overflow.  */
+                            if (insn & (1 << 6)) {
+                                /* sm[ul]sd */
+                                gen_op_subl_T0_T1();
+                            } else {
+                                /* sm[ul]ad */
+                                gen_op_addl_T0_T1();
+                            }
+                            if (rn != 15)
+                              {
+                                gen_movl_T1_reg(s, rn);
+                                gen_op_addl_T0_T1_setq();
+                              }
+                            gen_movl_reg_T0(s, rd);
+                        }
+                    }
+                    break;
+                case 3:
+                    op1 = ((insn >> 17) & 0x38) | ((insn >> 5) & 7);
+                    switch (op1) {
+                    case 0: /* Unsigned sum of absolute differences.  */
+                            goto illegal_op;
+                        gen_movl_T0_reg(s, rm);
+                        gen_movl_T1_reg(s, rs);
+                        gen_op_usad8_T0_T1();
+                        if (rn != 15) {
+                            gen_movl_T1_reg(s, rn);
+                            gen_op_addl_T0_T1();
+                        }
+                        gen_movl_reg_T0(s, rd);
+                        break;
+                    case 0x20: case 0x24: case 0x28: case 0x2c:
+                        /* Bitfield insert/clear.  */
+                        ARCH(6T2);
+                        shift = (insn >> 7) & 0x1f;
+                        i = (insn >> 16) & 0x1f;
+                        i = i + 1 - shift;
+                        if (rm == 15) {
+                            gen_op_movl_T1_im(0);
+                        } else {
+                            gen_movl_T1_reg(s, rm);
+                        }
+                        if (i != 32) {
+                            gen_movl_T0_reg(s, rd);
+                            gen_op_bfi_T1_T0(shift, ((1u << i) - 1) << shift);
+                        }
+                        gen_movl_reg_T1(s, rd);
+                        break;
+                    case 0x12: case 0x16: case 0x1a: case 0x1e: /* sbfx */
+                    case 0x32: case 0x36: case 0x3a: case 0x3e: /* ubfx */
+                        gen_movl_T1_reg(s, rm);
+                        shift = (insn >> 7) & 0x1f;
+                        i = ((insn >> 16) & 0x1f) + 1;
+                        if (shift + i > 32)
+                            goto illegal_op;
+                        if (i < 32) {
+                            if (op1 & 0x20) {
+                                gen_op_ubfx_T1(shift, (1u << i) - 1);
+                            } else {
+                                gen_op_sbfx_T1(shift, i);
+                            }
+                        }
+                        gen_movl_reg_T1(s, rd);
+                        break;
+                    default:
+                        goto illegal_op;
+                    }
+                    break;
+                }
+                break;
+            }
+        do_ldst:
             /* Check for undefined extension instructions
              * per the ARM Bible IE:
              * xxxx 0111 1111 xxxx  xxxx xxxx 1111 xxxx
@@ -2913,49 +5755,18 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
         case 0xd:
         case 0xe:
             /* Coprocessor.  */
-            op1 = (insn >> 8) & 0xf;
-            if (arm_feature(env, ARM_FEATURE_XSCALE) &&
-                    ((env->cp15.c15_cpar ^ 0x3fff) & (1 << op1)))
-                goto illegal_op;
-            switch (op1) {
-            case 0 ... 1:
-                if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-                    if (disas_iwmmxt_insn(env, s, insn))
-                        goto illegal_op;
-                } else if (arm_feature(env, ARM_FEATURE_XSCALE)) {
-                    if (disas_dsp_insn(env, s, insn))
-                        goto illegal_op;
-                } else
-                    goto illegal_op;
-                break;
-            case 2 ... 9:
-            case 12 ... 14:
-                if (disas_cp_insn (env, s, insn))
-                    goto illegal_op;
-                break;
-            case 10:
-            case 11:
-                if (disas_vfp_insn (env, s, insn))
-                    goto illegal_op;
-                break;
-            case 15:
-                if (disas_cp15_insn (env, s, insn))
-                    goto illegal_op;
-                break;
-            default:
-                /* unknown coprocessor.  */
+            if (disas_coproc_insn(env, s, insn))
                 goto illegal_op;
-            }
             break;
         case 0xf:
             /* swi */
             gen_op_movl_T0_im((long)s->pc);
             gen_op_movl_reg_TN[0][15]();
-            gen_op_swi();
-            s->is_jmp = DISAS_JUMP;
+            s->is_jmp = DISAS_SWI;
             break;
         default:
         illegal_op:
+            gen_set_condexec(s);
             gen_op_movl_T0_im((long)s->pc - 4);
             gen_op_movl_reg_TN[0][15]();
             gen_op_undef_insn();
@@ -2965,12 +5776,1061 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
     }
 }
 
-static void disas_thumb_insn(DisasContext *s)
+/* Return true if this is a Thumb-2 logical op.  */
+static int
+thumb2_logic_op(int op)
+{
+    return (op < 8);
+}
+
+/* Generate code for a Thumb-2 data processing operation.  If CONDS is nonzero
+   then set condition code flags based on the result of the operation.
+   If SHIFTER_OUT is nonzero then set the carry flag for logical operations
+   to the high bit of T1.
+   Returns zero if the opcode is valid.  */
+
+static int
+gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out)
+{
+    int logic_cc;
+
+    logic_cc = 0;
+    switch (op) {
+    case 0: /* and */
+        gen_op_andl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 1: /* bic */
+        gen_op_bicl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 2: /* orr */
+        gen_op_orl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 3: /* orn */
+        gen_op_notl_T1();
+        gen_op_orl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 4: /* eor */
+        gen_op_xorl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 8: /* add */
+        if (conds)
+            gen_op_addl_T0_T1_cc();
+        else
+            gen_op_addl_T0_T1();
+        break;
+    case 10: /* adc */
+        if (conds)
+            gen_op_adcl_T0_T1_cc();
+        else
+            gen_op_adcl_T0_T1();
+        break;
+    case 11: /* sbc */
+        if (conds)
+            gen_op_sbcl_T0_T1_cc();
+        else
+            gen_op_sbcl_T0_T1();
+        break;
+    case 13: /* sub */
+        if (conds)
+            gen_op_subl_T0_T1_cc();
+        else
+            gen_op_subl_T0_T1();
+        break;
+    case 14: /* rsb */
+        if (conds)
+            gen_op_rsbl_T0_T1_cc();
+        else
+            gen_op_rsbl_T0_T1();
+        break;
+    default: /* 5, 6, 7, 9, 12, 15. */
+        return 1;
+    }
+    if (logic_cc) {
+        gen_op_logic_T0_cc();
+        if (shifter_out)
+            gen_op_mov_CF_T1();
+    }
+    return 0;
+}
+
+/* Translate a 32-bit thumb instruction.  Returns nonzero if the instruction
+   is not legal.  */
+static int disas_thumb2_insn(CPUState *env, DisasContext *s, uint16_t insn_hw1)
+{
+    uint32_t insn, imm, shift, offset, addr;
+    uint32_t rd, rn, rm, rs;
+    int op;
+    int shiftop;
+    int conds;
+    int logic_cc;
+
+    if (!(arm_feature(env, ARM_FEATURE_THUMB2)
+          || arm_feature (env, ARM_FEATURE_M))) {
+        /* Thumb-1 cores may need to tread bl and blx as a pair of
+           16-bit instructions to get correct prefetch abort behavior.  */
+        insn = insn_hw1;
+        if ((insn & (1 << 12)) == 0) {
+            /* Second half of blx.  */
+            offset = ((insn & 0x7ff) << 1);
+            gen_movl_T0_reg(s, 14);
+            gen_op_movl_T1_im(offset);
+            gen_op_addl_T0_T1();
+            gen_op_movl_T1_im(0xfffffffc);
+            gen_op_andl_T0_T1();
+
+            addr = (uint32_t)s->pc;
+            gen_op_movl_T1_im(addr | 1);
+            gen_movl_reg_T1(s, 14);
+            gen_bx(s);
+            return 0;
+        }
+        if (insn & (1 << 11)) {
+            /* Second half of bl.  */
+            offset = ((insn & 0x7ff) << 1) | 1;
+            gen_movl_T0_reg(s, 14);
+            gen_op_movl_T1_im(offset);
+            gen_op_addl_T0_T1();
+
+            addr = (uint32_t)s->pc;
+            gen_op_movl_T1_im(addr | 1);
+            gen_movl_reg_T1(s, 14);
+            gen_bx(s);
+            return 0;
+        }
+        if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
+            /* Instruction spans a page boundary.  Implement it as two
+               16-bit instructions in case the second half causes an
+               prefetch abort.  */
+            offset = ((int32_t)insn << 21) >> 9;
+            addr = s->pc + 2 + offset;
+            gen_op_movl_T0_im(addr);
+            gen_movl_reg_T0(s, 14);
+            return 0;
+        }
+        /* Fall through to 32-bit decode.  */
+    }
+
+    insn = lduw_code(s->pc);
+    s->pc += 2;
+    insn |= (uint32_t)insn_hw1 << 16;
+
+    if ((insn & 0xf800e800) != 0xf000e800) {
+        ARCH(6T2);
+    }
+
+    rn = (insn >> 16) & 0xf;
+    rs = (insn >> 12) & 0xf;
+    rd = (insn >> 8) & 0xf;
+    rm = insn & 0xf;
+    switch ((insn >> 25) & 0xf) {
+    case 0: case 1: case 2: case 3:
+        /* 16-bit instructions.  Should never happen.  */
+        abort();
+    case 4:
+        if (insn & (1 << 22)) {
+            /* Other load/store, table branch.  */
+            if (insn & 0x01200000) {
+                /* Load/store doubleword.  */
+                if (rn == 15) {
+                    gen_op_movl_T1_im(s->pc & ~3);
+                } else {
+                    gen_movl_T1_reg(s, rn);
+                }
+                offset = (insn & 0xff) * 4;
+                if ((insn & (1 << 23)) == 0)
+                    offset = -offset;
+                if (insn & (1 << 24)) {
+                    gen_op_addl_T1_im(offset);
+                    offset = 0;
+                }
+                if (insn & (1 << 20)) {
+                    /* ldrd */
+                    gen_ldst(ldl, s);
+                    gen_movl_reg_T0(s, rs);
+                    gen_op_addl_T1_im(4);
+                    gen_ldst(ldl, s);
+                    gen_movl_reg_T0(s, rd);
+                } else {
+                    /* strd */
+                    gen_movl_T0_reg(s, rs);
+                    gen_ldst(stl, s);
+                    gen_op_addl_T1_im(4);
+                    gen_movl_T0_reg(s, rd);
+                    gen_ldst(stl, s);
+                }
+                if (insn & (1 << 21)) {
+                    /* Base writeback.  */
+                    if (rn == 15)
+                        goto illegal_op;
+                    gen_op_addl_T1_im(offset - 4);
+                    gen_movl_reg_T1(s, rn);
+                }
+            } else if ((insn & (1 << 23)) == 0) {
+                /* Load/store exclusive word.  */
+                gen_movl_T0_reg(s, rd);
+                gen_movl_T1_reg(s, rn);
+                if (insn & (1 << 20)) {
+                    gen_ldst(ldlex, s);
+                } else {
+                    gen_ldst(stlex, s);
+                }
+                gen_movl_reg_T0(s, rd);
+            } else if ((insn & (1 << 6)) == 0) {
+                /* Table Branch.  */
+                if (rn == 15) {
+                    gen_op_movl_T1_im(s->pc);
+                } else {
+                    gen_movl_T1_reg(s, rn);
+                }
+                gen_movl_T2_reg(s, rm);
+                gen_op_addl_T1_T2();
+                if (insn & (1 << 4)) {
+                    /* tbh */
+                    gen_op_addl_T1_T2();
+                    gen_ldst(lduw, s);
+                } else { /* tbb */
+                    gen_ldst(ldub, s);
+                }
+                gen_op_jmp_T0_im(s->pc);
+                s->is_jmp = DISAS_JUMP;
+            } else {
+                /* Load/store exclusive byte/halfword/doubleword.  */
+                op = (insn >> 4) & 0x3;
+                gen_movl_T1_reg(s, rn);
+                if (insn & (1 << 20)) {
+                    switch (op) {
+                    case 0:
+                        gen_ldst(ldbex, s);
+                        break;
+                    case 1:
+                        gen_ldst(ldwex, s);
+                        break;
+                    case 3:
+                        gen_ldst(ldqex, s);
+                        gen_movl_reg_T1(s, rd);
+                        break;
+                    default:
+                        goto illegal_op;
+                    }
+                    gen_movl_reg_T0(s, rs);
+                } else {
+                    gen_movl_T0_reg(s, rs);
+                    switch (op) {
+                    case 0:
+                        gen_ldst(stbex, s);
+                        break;
+                    case 1:
+                        gen_ldst(stwex, s);
+                        break;
+                    case 3:
+                        gen_movl_T2_reg(s, rd);
+                        gen_ldst(stqex, s);
+                        break;
+                    default:
+                        goto illegal_op;
+                    }
+                    gen_movl_reg_T0(s, rm);
+                }
+            }
+        } else {
+            /* Load/store multiple, RFE, SRS.  */
+            if (((insn >> 23) & 1) == ((insn >> 24) & 1)) {
+                /* Not available in user mode.  */
+                if (!IS_USER(s))
+                    goto illegal_op;
+                if (insn & (1 << 20)) {
+                    /* rfe */
+                    gen_movl_T1_reg(s, rn);
+                    if (insn & (1 << 24)) {
+                        gen_op_addl_T1_im(4);
+                    } else {
+                        gen_op_addl_T1_im(-4);
+                    }
+                    /* Load CPSR into T2 and PC into T0.  */
+                    gen_ldst(ldl, s);
+                    gen_op_movl_T2_T0();
+                    gen_op_addl_T1_im(-4);
+                    gen_ldst(ldl, s);
+                    if (insn & (1 << 21)) {
+                        /* Base writeback.  */
+                        if (insn & (1 << 24))
+                            gen_op_addl_T1_im(8);
+                        gen_movl_reg_T1(s, rn);
+                    }
+                    gen_rfe(s);
+                } else {
+                    /* srs */
+                    op = (insn & 0x1f);
+                    if (op == (env->uncached_cpsr & CPSR_M)) {
+                        gen_movl_T1_reg(s, 13);
+                    } else {
+                        gen_op_movl_T1_r13_banked(op);
+                    }
+                    if ((insn & (1 << 24)) == 0) {
+                        gen_op_addl_T1_im(-8);
+                    }
+                    gen_movl_T0_reg(s, 14);
+                    gen_ldst(stl, s);
+                    gen_op_movl_T0_cpsr();
+                    gen_op_addl_T1_im(4);
+                    gen_ldst(stl, s);
+                    if (insn & (1 << 21)) {
+                        if ((insn & (1 << 24)) == 0) {
+                            gen_op_addl_T1_im(-4);
+                        } else {
+                            gen_op_addl_T1_im(4);
+                        }
+                        if (op == (env->uncached_cpsr & CPSR_M)) {
+                            gen_movl_reg_T1(s, 13);
+                        } else {
+                            gen_op_movl_r13_T1_banked(op);
+                        }
+                    }
+                }
+            } else {
+                int i;
+                /* Load/store multiple.  */
+                gen_movl_T1_reg(s, rn);
+                offset = 0;
+                for (i = 0; i < 16; i++) {
+                    if (insn & (1 << i))
+                        offset += 4;
+                }
+                if (insn & (1 << 24)) {
+                    gen_op_addl_T1_im(-offset);
+                }
+
+                for (i = 0; i < 16; i++) {
+                    if ((insn & (1 << i)) == 0)
+                        continue;
+                    if (insn & (1 << 20)) {
+                        /* Load.  */
+                        gen_ldst(ldl, s);
+                        if (i == 15) {
+                            gen_bx(s);
+                        } else {
+                            gen_movl_reg_T0(s, i);
+                        }
+                    } else {
+                        /* Store.  */
+                        gen_movl_T0_reg(s, i);
+                        gen_ldst(stl, s);
+                    }
+                    gen_op_addl_T1_im(4);
+                }
+                if (insn & (1 << 21)) {
+                    /* Base register writeback.  */
+                    if (insn & (1 << 24)) {
+                        gen_op_addl_T1_im(-offset);
+                    }
+                    /* Fault if writeback register is in register list.  */
+                    if (insn & (1 << rn))
+                        goto illegal_op;
+                    gen_movl_reg_T1(s, rn);
+                }
+            }
+        }
+        break;
+    case 5: /* Data processing register constant shift.  */
+        if (rn == 15)
+            gen_op_movl_T0_im(0);
+        else
+            gen_movl_T0_reg(s, rn);
+        gen_movl_T1_reg(s, rm);
+        op = (insn >> 21) & 0xf;
+        shiftop = (insn >> 4) & 3;
+        shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
+        conds = (insn & (1 << 20)) != 0;
+        logic_cc = (conds && thumb2_logic_op(op));
+        if (shift != 0) {
+            if (logic_cc) {
+                gen_shift_T1_im_cc[shiftop](shift);
+            } else {
+                gen_shift_T1_im[shiftop](shift);
+            }
+        } else if (shiftop != 0) {
+            if (logic_cc) {
+                gen_shift_T1_0_cc[shiftop]();
+            } else {
+                gen_shift_T1_0[shiftop]();
+            }
+        }
+        if (gen_thumb2_data_op(s, op, conds, 0))
+            goto illegal_op;
+        if (rd != 15)
+            gen_movl_reg_T0(s, rd);
+        break;
+    case 13: /* Misc data processing.  */
+        op = ((insn >> 22) & 6) | ((insn >> 7) & 1);
+        if (op < 4 && (insn & 0xf000) != 0xf000)
+            goto illegal_op;
+        switch (op) {
+        case 0: /* Register controlled shift.  */
+            gen_movl_T0_reg(s, rm);
+            gen_movl_T1_reg(s, rn);
+            if ((insn & 0x70) != 0)
+                goto illegal_op;
+            op = (insn >> 21) & 3;
+            if (insn & (1 << 20)) {
+                gen_shift_T1_T0_cc[op]();
+                gen_op_logic_T1_cc();
+            } else {
+                gen_shift_T1_T0[op]();
+            }
+            gen_movl_reg_T1(s, rd);
+            break;
+        case 1: /* Sign/zero extend.  */
+            gen_movl_T1_reg(s, rm);
+            shift = (insn >> 4) & 3;
+            /* ??? In many cases it's not neccessary to do a
+               rotate, a shift is sufficient.  */
+            if (shift != 0)
+                gen_op_rorl_T1_im(shift * 8);
+            op = (insn >> 20) & 7;
+            switch (op) {
+            case 0: gen_op_sxth_T1();   break;
+            case 1: gen_op_uxth_T1();   break;
+            case 2: gen_op_sxtb16_T1(); break;
+            case 3: gen_op_uxtb16_T1(); break;
+            case 4: gen_op_sxtb_T1();   break;
+            case 5: gen_op_uxtb_T1();   break;
+            default: goto illegal_op;
+            }
+            if (rn != 15) {
+                gen_movl_T2_reg(s, rn);
+                if ((op >> 1) == 1) {
+                    gen_op_add16_T1_T2();
+                } else {
+                    gen_op_addl_T1_T2();
+                }
+            }
+            gen_movl_reg_T1(s, rd);
+            break;
+        case 2: /* SIMD add/subtract.  */
+            op = (insn >> 20) & 7;
+            shift = (insn >> 4) & 7;
+            if ((op & 3) == 3 || (shift & 3) == 3)
+                goto illegal_op;
+            gen_movl_T0_reg(s, rn);
+            gen_movl_T1_reg(s, rm);
+            gen_thumb2_parallel_addsub[op][shift]();
+            gen_movl_reg_T0(s, rd);
+            break;
+        case 3: /* Other data processing.  */
+            op = ((insn >> 17) & 0x38) | ((insn >> 4) & 7);
+            if (op < 4) {
+                /* Saturating add/subtract.  */
+                gen_movl_T0_reg(s, rm);
+                gen_movl_T1_reg(s, rn);
+                if (op & 2)
+                    gen_op_double_T1_saturate();
+                if (op & 1)
+                    gen_op_subl_T0_T1_saturate();
+                else
+                    gen_op_addl_T0_T1_saturate();
+            } else {
+                gen_movl_T0_reg(s, rn);
+                switch (op) {
+                case 0x0a: /* rbit */
+                    gen_op_rbit_T0();
+                    break;
+                case 0x08: /* rev */
+                    gen_op_rev_T0();
+                    break;
+                case 0x09: /* rev16 */
+                    gen_op_rev16_T0();
+                    break;
+                case 0x0b: /* revsh */
+                    gen_op_revsh_T0();
+                    break;
+                case 0x10: /* sel */
+                    gen_movl_T1_reg(s, rm);
+                    gen_op_sel_T0_T1();
+                    break;
+                case 0x18: /* clz */
+                    gen_op_clz_T0();
+                    break;
+                default:
+                    goto illegal_op;
+                }
+            }
+            gen_movl_reg_T0(s, rd);
+            break;
+        case 4: case 5: /* 32-bit multiply.  Sum of absolute differences.  */
+            op = (insn >> 4) & 0xf;
+            gen_movl_T0_reg(s, rn);
+            gen_movl_T1_reg(s, rm);
+            switch ((insn >> 20) & 7) {
+            case 0: /* 32 x 32 -> 32 */
+                gen_op_mul_T0_T1();
+                if (rs != 15) {
+                    gen_movl_T1_reg(s, rs);
+                    if (op)
+                        gen_op_rsbl_T0_T1();
+                    else
+                        gen_op_addl_T0_T1();
+                }
+                gen_movl_reg_T0(s, rd);
+                break;
+            case 1: /* 16 x 16 -> 32 */
+                gen_mulxy(op & 2, op & 1);
+                if (rs != 15) {
+                    gen_movl_T1_reg(s, rs);
+                    gen_op_addl_T0_T1_setq();
+                }
+                gen_movl_reg_T0(s, rd);
+                break;
+            case 2: /* Dual multiply add.  */
+            case 4: /* Dual multiply subtract.  */
+                if (op)
+                    gen_op_swap_half_T1();
+                gen_op_mul_dual_T0_T1();
+                /* This addition cannot overflow.  */
+                if (insn & (1 << 22)) {
+                    gen_op_subl_T0_T1();
+                } else {
+                    gen_op_addl_T0_T1();
+                }
+                if (rs != 15)
+                  {
+                    gen_movl_T1_reg(s, rs);
+                    gen_op_addl_T0_T1_setq();
+                  }
+                gen_movl_reg_T0(s, rd);
+                break;
+            case 3: /* 32 * 16 -> 32msb */
+                if (op)
+                    gen_op_sarl_T1_im(16);
+                else
+                    gen_op_sxth_T1();
+                gen_op_imulw_T0_T1();
+                if (rs != 15)
+                  {
+                    gen_movl_T1_reg(s, rs);
+                    gen_op_addl_T0_T1_setq();
+                  }
+                gen_movl_reg_T0(s, rd);
+                break;
+            case 5: case 6: /* 32 * 32 -> 32msb */
+                gen_op_imull_T0_T1();
+                if (insn & (1 << 5))
+                    gen_op_roundqd_T0_T1();
+                else
+                    gen_op_movl_T0_T1();
+                if (rs != 15) {
+                    gen_movl_T1_reg(s, rs);
+                    if (insn & (1 << 21)) {
+                        gen_op_addl_T0_T1();
+                    } else {
+                        gen_op_rsbl_T0_T1();
+                    }
+                }
+                gen_movl_reg_T0(s, rd);
+                break;
+            case 7: /* Unsigned sum of absolute differences.  */
+                gen_op_usad8_T0_T1();
+                if (rs != 15) {
+                    gen_movl_T1_reg(s, rs);
+                    gen_op_addl_T0_T1();
+                }
+                gen_movl_reg_T0(s, rd);
+                break;
+            }
+            break;
+        case 6: case 7: /* 64-bit multiply, Divide.  */
+            op = ((insn >> 4) & 0xf) | ((insn >> 16) & 0x70);
+            gen_movl_T0_reg(s, rn);
+            gen_movl_T1_reg(s, rm);
+            if ((op & 0x50) == 0x10) {
+                /* sdiv, udiv */
+                if (!arm_feature(env, ARM_FEATURE_DIV))
+                    goto illegal_op;
+                if (op & 0x20)
+                    gen_op_udivl_T0_T1();
+                else
+                    gen_op_sdivl_T0_T1();
+                gen_movl_reg_T0(s, rd);
+            } else if ((op & 0xe) == 0xc) {
+                /* Dual multiply accumulate long.  */
+                if (op & 1)
+                    gen_op_swap_half_T1();
+                gen_op_mul_dual_T0_T1();
+                if (op & 0x10) {
+                    gen_op_subl_T0_T1();
+                } else {
+                    gen_op_addl_T0_T1();
+                }
+                gen_op_signbit_T1_T0();
+                gen_op_addq_T0_T1(rs, rd);
+                gen_movl_reg_T0(s, rs);
+                gen_movl_reg_T1(s, rd);
+            } else {
+                if (op & 0x20) {
+                    /* Unsigned 64-bit multiply  */
+                    gen_op_mull_T0_T1();
+                } else {
+                    if (op & 8) {
+                        /* smlalxy */
+                        gen_mulxy(op & 2, op & 1);
+                        gen_op_signbit_T1_T0();
+                    } else {
+                        /* Signed 64-bit multiply  */
+                        gen_op_imull_T0_T1();
+                    }
+                }
+                if (op & 4) {
+                    /* umaal */
+                    gen_op_addq_lo_T0_T1(rs);
+                    gen_op_addq_lo_T0_T1(rd);
+                } else if (op & 0x40) {
+                    /* 64-bit accumulate.  */
+                    gen_op_addq_T0_T1(rs, rd);
+                }
+                gen_movl_reg_T0(s, rs);
+                gen_movl_reg_T1(s, rd);
+            }
+            break;
+        }
+        break;
+    case 6: case 7: case 14: case 15:
+        /* Coprocessor.  */
+        if (((insn >> 24) & 3) == 3) {
+            /* Translate into the equivalent ARM encoding.  */
+            insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4);
+            if (disas_neon_data_insn(env, s, insn))
+                goto illegal_op;
+        } else {
+            if (insn & (1 << 28))
+                goto illegal_op;
+            if (disas_coproc_insn (env, s, insn))
+                goto illegal_op;
+        }
+        break;
+    case 8: case 9: case 10: case 11:
+        if (insn & (1 << 15)) {
+            /* Branches, misc control.  */
+            if (insn & 0x5000) {
+                /* Unconditional branch.  */
+                /* signextend(hw1[10:0]) -> offset[:12].  */
+                offset = ((int32_t)insn << 5) >> 9 & ~(int32_t)0xfff;
+                /* hw1[10:0] -> offset[11:1].  */
+                offset |= (insn & 0x7ff) << 1;
+                /* (~hw2[13, 11] ^ offset[24]) -> offset[23,22]
+                   offset[24:22] already have the same value because of the
+                   sign extension above.  */
+                offset ^= ((~insn) & (1 << 13)) << 10;
+                offset ^= ((~insn) & (1 << 11)) << 11;
+
+                addr = s->pc;
+                if (insn & (1 << 14)) {
+                    /* Branch and link.  */
+                    gen_op_movl_T1_im(addr | 1);
+                    gen_movl_reg_T1(s, 14);
+                }
+
+                addr += offset;
+                if (insn & (1 << 12)) {
+                    /* b/bl */
+                    gen_jmp(s, addr);
+                } else {
+                    /* blx */
+                    addr &= ~(uint32_t)2;
+                    gen_op_movl_T0_im(addr);
+                    gen_bx(s);
+                }
+            } else if (((insn >> 23) & 7) == 7) {
+                /* Misc control */
+                if (insn & (1 << 13))
+                    goto illegal_op;
+
+                if (insn & (1 << 26)) {
+                    /* Secure monitor call (v6Z) */
+                    goto illegal_op; /* not implemented.  */
+                } else {
+                    op = (insn >> 20) & 7;
+                    switch (op) {
+                    case 0: /* msr cpsr.  */
+                        if (IS_M(env)) {
+                            gen_op_v7m_msr_T0(insn & 0xff);
+                            gen_movl_reg_T0(s, rn);
+                            gen_lookup_tb(s);
+                            break;
+                        }
+                        /* fall through */
+                    case 1: /* msr spsr.  */
+                        if (IS_M(env))
+                            goto illegal_op;
+                        gen_movl_T0_reg(s, rn);
+                        if (gen_set_psr_T0(s,
+                              msr_mask(env, s, (insn >> 8) & 0xf, op == 1),
+                              op == 1))
+                            goto illegal_op;
+                        break;
+                    case 2: /* cps, nop-hint.  */
+                        if (((insn >> 8) & 7) == 0) {
+                            gen_nop_hint(s, insn & 0xff);
+                        }
+                        /* Implemented as NOP in user mode.  */
+                        if (IS_USER(s))
+                            break;
+                        offset = 0;
+                        imm = 0;
+                        if (insn & (1 << 10)) {
+                            if (insn & (1 << 7))
+                                offset |= CPSR_A;
+                            if (insn & (1 << 6))
+                                offset |= CPSR_I;
+                            if (insn & (1 << 5))
+                                offset |= CPSR_F;
+                            if (insn & (1 << 9))
+                                imm = CPSR_A | CPSR_I | CPSR_F;
+                        }
+                        if (insn & (1 << 8)) {
+                            offset |= 0x1f;
+                            imm |= (insn & 0x1f);
+                        }
+                        if (offset) {
+                            gen_op_movl_T0_im(imm);
+                            gen_set_psr_T0(s, offset, 0);
+                        }
+                        break;
+                    case 3: /* Special control operations.  */
+                        op = (insn >> 4) & 0xf;
+                        switch (op) {
+                        case 2: /* clrex */
+                            gen_op_clrex();
+                            break;
+                        case 4: /* dsb */
+                        case 5: /* dmb */
+                        case 6: /* isb */
+                            /* These execute as NOPs.  */
+                            ARCH(7);
+                            break;
+                        default:
+                            goto illegal_op;
+                        }
+                        break;
+                    case 4: /* bxj */
+                        /* Trivial implementation equivalent to bx.  */
+                        gen_movl_T0_reg(s, rn);
+                        gen_bx(s);
+                        break;
+                    case 5: /* Exception return.  */
+                        /* Unpredictable in user mode.  */
+                        goto illegal_op;
+                    case 6: /* mrs cpsr.  */
+                        if (IS_M(env)) {
+                            gen_op_v7m_mrs_T0(insn & 0xff);
+                        } else {
+                            gen_op_movl_T0_cpsr();
+                        }
+                        gen_movl_reg_T0(s, rd);
+                        break;
+                    case 7: /* mrs spsr.  */
+                        /* Not accessible in user mode.  */
+                        if (IS_USER(s) || IS_M(env))
+                            goto illegal_op;
+                        gen_op_movl_T0_spsr();
+                        gen_movl_reg_T0(s, rd);
+                        break;
+                    }
+                }
+            } else {
+                /* Conditional branch.  */
+                op = (insn >> 22) & 0xf;
+                /* Generate a conditional jump to next instruction.  */
+                s->condlabel = gen_new_label();
+                gen_test_cc[op ^ 1](s->condlabel);
+                s->condjmp = 1;
+
+                /* offset[11:1] = insn[10:0] */
+                offset = (insn & 0x7ff) << 1;
+                /* offset[17:12] = insn[21:16].  */
+                offset |= (insn & 0x003f0000) >> 4;
+                /* offset[31:20] = insn[26].  */
+                offset |= ((int32_t)((insn << 5) & 0x80000000)) >> 11;
+                /* offset[18] = insn[13].  */
+                offset |= (insn & (1 << 13)) << 5;
+                /* offset[19] = insn[11].  */
+                offset |= (insn & (1 << 11)) << 8;
+
+                /* jump to the offset */
+                addr = s->pc + offset;
+                gen_jmp(s, addr);
+            }
+        } else {
+            /* Data processing immediate.  */
+            if (insn & (1 << 25)) {
+                if (insn & (1 << 24)) {
+                    if (insn & (1 << 20))
+                        goto illegal_op;
+                    /* Bitfield/Saturate.  */
+                    op = (insn >> 21) & 7;
+                    imm = insn & 0x1f;
+                    shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
+                    if (rn == 15)
+                        gen_op_movl_T1_im(0);
+                    else
+                        gen_movl_T1_reg(s, rn);
+                    switch (op) {
+                    case 2: /* Signed bitfield extract.  */
+                        imm++;
+                        if (shift + imm > 32)
+                            goto illegal_op;
+                        if (imm < 32)
+                            gen_op_sbfx_T1(shift, imm);
+                        break;
+                    case 6: /* Unsigned bitfield extract.  */
+                        imm++;
+                        if (shift + imm > 32)
+                            goto illegal_op;
+                        if (imm < 32)
+                            gen_op_ubfx_T1(shift, (1u << imm) - 1);
+                        break;
+                    case 3: /* Bitfield insert/clear.  */
+                        if (imm < shift)
+                            goto illegal_op;
+                        imm = imm + 1 - shift;
+                        if (imm != 32) {
+                            gen_movl_T0_reg(s, rd);
+                            gen_op_bfi_T1_T0(shift, ((1u << imm) - 1) << shift);
+                        }
+                        break;
+                    case 7:
+                        goto illegal_op;
+                    default: /* Saturate.  */
+                        gen_movl_T1_reg(s, rn);
+                        if (shift) {
+                            if (op & 1)
+                                gen_op_sarl_T1_im(shift);
+                            else
+                                gen_op_shll_T1_im(shift);
+                        }
+                        if (op & 4) {
+                            /* Unsigned.  */
+                            gen_op_ssat_T1(imm);
+                            if ((op & 1) && shift == 0)
+                                gen_op_usat16_T1(imm);
+                            else
+                                gen_op_usat_T1(imm);
+                        } else {
+                            /* Signed.  */
+                            gen_op_ssat_T1(imm);
+                            if ((op & 1) && shift == 0)
+                                gen_op_ssat16_T1(imm);
+                            else
+                                gen_op_ssat_T1(imm);
+                        }
+                        break;
+                    }
+                    gen_movl_reg_T1(s, rd);
+                } else {
+                    imm = ((insn & 0x04000000) >> 15)
+                          | ((insn & 0x7000) >> 4) | (insn & 0xff);
+                    if (insn & (1 << 22)) {
+                        /* 16-bit immediate.  */
+                        imm |= (insn >> 4) & 0xf000;
+                        if (insn & (1 << 23)) {
+                            /* movt */
+                            gen_movl_T0_reg(s, rd);
+                            gen_op_movtop_T0_im(imm << 16);
+                        } else {
+                            /* movw */
+                            gen_op_movl_T0_im(imm);
+                        }
+                    } else {
+                        /* Add/sub 12-bit immediate.  */
+                        if (rn == 15) {
+                            addr = s->pc & ~(uint32_t)3;
+                            if (insn & (1 << 23))
+                                addr -= imm;
+                            else
+                                addr += imm;
+                            gen_op_movl_T0_im(addr);
+                        } else {
+                            gen_movl_T0_reg(s, rn);
+                            gen_op_movl_T1_im(imm);
+                            if (insn & (1 << 23))
+                                gen_op_subl_T0_T1();
+                            else
+                                gen_op_addl_T0_T1();
+                        }
+                    }
+                    gen_movl_reg_T0(s, rd);
+                }
+            } else {
+                int shifter_out = 0;
+                /* modified 12-bit immediate.  */
+                shift = ((insn & 0x04000000) >> 23) | ((insn & 0x7000) >> 12);
+                imm = (insn & 0xff);
+                switch (shift) {
+                case 0: /* XY */
+                    /* Nothing to do.  */
+                    break;
+                case 1: /* 00XY00XY */
+                    imm |= imm << 16;
+                    break;
+                case 2: /* XY00XY00 */
+                    imm |= imm << 16;
+                    imm <<= 8;
+                    break;
+                case 3: /* XYXYXYXY */
+                    imm |= imm << 16;
+                    imm |= imm << 8;
+                    break;
+                default: /* Rotated constant.  */
+                    shift = (shift << 1) | (imm >> 7);
+                    imm |= 0x80;
+                    imm = imm << (32 - shift);
+                    shifter_out = 1;
+                    break;
+                }
+                gen_op_movl_T1_im(imm);
+                rn = (insn >> 16) & 0xf;
+                if (rn == 15)
+                    gen_op_movl_T0_im(0);
+                else
+                    gen_movl_T0_reg(s, rn);
+                op = (insn >> 21) & 0xf;
+                if (gen_thumb2_data_op(s, op, (insn & (1 << 20)) != 0,
+                                       shifter_out))
+                    goto illegal_op;
+                rd = (insn >> 8) & 0xf;
+                if (rd != 15) {
+                    gen_movl_reg_T0(s, rd);
+                }
+            }
+        }
+        break;
+    case 12: /* Load/store single data item.  */
+        {
+        int postinc = 0;
+        int writeback = 0;
+        if ((insn & 0x01100000) == 0x01000000) {
+            if (disas_neon_ls_insn(env, s, insn))
+                goto illegal_op;
+            break;
+        }
+        if (rn == 15) {
+            /* PC relative.  */
+            /* s->pc has already been incremented by 4.  */
+            imm = s->pc & 0xfffffffc;
+            if (insn & (1 << 23))
+                imm += insn & 0xfff;
+            else
+                imm -= insn & 0xfff;
+            gen_op_movl_T1_im(imm);
+        } else {
+            gen_movl_T1_reg(s, rn);
+            if (insn & (1 << 23)) {
+                /* Positive offset.  */
+                imm = insn & 0xfff;
+                gen_op_addl_T1_im(imm);
+            } else {
+                op = (insn >> 8) & 7;
+                imm = insn & 0xff;
+                switch (op) {
+                case 0: case 8: /* Shifted Register.  */
+                    shift = (insn >> 4) & 0xf;
+                    if (shift > 3)
+                        goto illegal_op;
+                    gen_movl_T2_reg(s, rm);
+                    if (shift)
+                        gen_op_shll_T2_im(shift);
+                    gen_op_addl_T1_T2();
+                    break;
+                case 4: /* Negative offset.  */
+                    gen_op_addl_T1_im(-imm);
+                    break;
+                case 6: /* User privilege.  */
+                    gen_op_addl_T1_im(imm);
+                    break;
+                case 1: /* Post-decrement.  */
+                    imm = -imm;
+                    /* Fall through.  */
+                case 3: /* Post-increment.  */
+                    gen_op_movl_T2_im(imm);
+                    postinc = 1;
+                    writeback = 1;
+                    break;
+                case 5: /* Pre-decrement.  */
+                    imm = -imm;
+                    /* Fall through.  */
+                case 7: /* Pre-increment.  */
+                    gen_op_addl_T1_im(imm);
+                    writeback = 1;
+                    break;
+                default:
+                    goto illegal_op;
+                }
+            }
+        }
+        op = ((insn >> 21) & 3) | ((insn >> 22) & 4);
+        if (insn & (1 << 20)) {
+            /* Load.  */
+            if (rs == 15 && op != 2) {
+                if (op & 2)
+                    goto illegal_op;
+                /* Memory hint.  Implemented as NOP.  */
+            } else {
+                switch (op) {
+                case 0: gen_ldst(ldub, s); break;
+                case 4: gen_ldst(ldsb, s); break;
+                case 1: gen_ldst(lduw, s); break;
+                case 5: gen_ldst(ldsw, s); break;
+                case 2: gen_ldst(ldl, s); break;
+                default: goto illegal_op;
+                }
+                if (rs == 15) {
+                    gen_bx(s);
+                } else {
+                    gen_movl_reg_T0(s, rs);
+                }
+            }
+        } else {
+            /* Store.  */
+            if (rs == 15)
+                goto illegal_op;
+            gen_movl_T0_reg(s, rs);
+            switch (op) {
+            case 0: gen_ldst(stb, s); break;
+            case 1: gen_ldst(stw, s); break;
+            case 2: gen_ldst(stl, s); break;
+            default: goto illegal_op;
+            }
+        }
+        if (postinc)
+            gen_op_addl_T1_im(imm);
+        if (writeback)
+            gen_movl_reg_T1(s, rn);
+        }
+        break;
+    default:
+        goto illegal_op;
+    }
+    return 0;
+illegal_op:
+    return 1;
+}
+
+static void disas_thumb_insn(CPUState *env, DisasContext *s)
 {
     uint32_t val, insn, op, rm, rn, rd, shift, cond;
     int32_t offset;
     int i;
 
+    if (s->condexec_mask) {
+        cond = s->condexec_cond;
+        s->condlabel = gen_new_label();
+        gen_test_cc[cond ^ 1](s->condlabel);
+        s->condjmp = 1;
+    }
+
     insn = lduw_code(s->pc);
     s->pc += 2;
 
@@ -2990,17 +6850,27 @@ static void disas_thumb_insn(DisasContext *s)
                 rm = (insn >> 6) & 7;
                 gen_movl_T1_reg(s, rm);
             }
-            if (insn & (1 << 9))
-                gen_op_subl_T0_T1_cc();
-            else
-                gen_op_addl_T0_T1_cc();
+            if (insn & (1 << 9)) {
+                if (s->condexec_mask)
+                    gen_op_subl_T0_T1();
+                else
+                    gen_op_subl_T0_T1_cc();
+            } else {
+                if (s->condexec_mask)
+                    gen_op_addl_T0_T1();
+                else
+                    gen_op_addl_T0_T1_cc();
+            }
             gen_movl_reg_T0(s, rd);
         } else {
             /* shift immediate */
             rm = (insn >> 3) & 7;
             shift = (insn >> 6) & 0x1f;
             gen_movl_T0_reg(s, rm);
-            gen_shift_T0_im_thumb[op](shift);
+            if (s->condexec_mask)
+                gen_shift_T0_im_thumb[op](shift);
+            else
+                gen_shift_T0_im_thumb_cc[op](shift);
             gen_movl_reg_T0(s, rd);
         }
         break;
@@ -3016,16 +6886,23 @@ static void disas_thumb_insn(DisasContext *s)
         }
         switch (op) {
         case 0: /* mov */
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 1: /* cmp */
             gen_op_subl_T0_T1_cc();
             break;
         case 2: /* add */
-            gen_op_addl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_addl_T0_T1();
+            else
+                gen_op_addl_T0_T1_cc();
             break;
         case 3: /* sub */
-            gen_op_subl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_subl_T0_T1();
+            else
+                gen_op_subl_T0_T1_cc();
             break;
         }
         if (op != 1)
@@ -3099,33 +6976,57 @@ static void disas_thumb_insn(DisasContext *s)
         switch (op) {
         case 0x0: /* and */
             gen_op_andl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0x1: /* eor */
             gen_op_xorl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0x2: /* lsl */
-            gen_op_shll_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_op_shll_T1_T0();
+            } else {
+                gen_op_shll_T1_T0_cc();
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x3: /* lsr */
-            gen_op_shrl_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_op_shrl_T1_T0();
+            } else {
+                gen_op_shrl_T1_T0_cc();
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x4: /* asr */
-            gen_op_sarl_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_op_sarl_T1_T0();
+            } else {
+                gen_op_sarl_T1_T0_cc();
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x5: /* adc */
-            gen_op_adcl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_adcl_T0_T1();
+            else
+                gen_op_adcl_T0_T1_cc();
             break;
         case 0x6: /* sbc */
-            gen_op_sbcl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_sbcl_T0_T1();
+            else
+                gen_op_sbcl_T0_T1_cc();
             break;
         case 0x7: /* ror */
-            gen_op_rorl_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_op_rorl_T1_T0();
+            } else {
+                gen_op_rorl_T1_T0_cc();
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x8: /* tst */
             gen_op_andl_T0_T1();
@@ -3133,7 +7034,10 @@ static void disas_thumb_insn(DisasContext *s)
             rd = 16;
             break;
         case 0x9: /* neg */
-            gen_op_subl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_subl_T0_T1();
+            else
+                gen_op_subl_T0_T1_cc();
             break;
         case 0xa: /* cmp */
             gen_op_subl_T0_T1_cc();
@@ -3145,19 +7049,23 @@ static void disas_thumb_insn(DisasContext *s)
             break;
         case 0xc: /* orr */
             gen_op_orl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0xd: /* mul */
             gen_op_mull_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0xe: /* bic */
             gen_op_bicl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0xf: /* mvn */
             gen_op_notl_T1();
-            gen_op_logic_T1_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T1_cc();
             val = 1;
             rm = rd;
             break;
@@ -3323,6 +7231,19 @@ static void disas_thumb_insn(DisasContext *s)
             gen_movl_reg_T1(s, 13);
             break;
 
+        case 2: /* sign/zero extend.  */
+            ARCH(6);
+            rd = insn & 7;
+            rm = (insn >> 3) & 7;
+            gen_movl_T1_reg(s, rm);
+            switch ((insn >> 6) & 3) {
+            case 0: gen_op_sxth_T1(); break;
+            case 1: gen_op_sxtb_T1(); break;
+            case 2: gen_op_uxth_T1(); break;
+            case 3: gen_op_uxtb_T1(); break;
+            }
+            gen_movl_reg_T1(s, rd);
+            break;
         case 4: case 5: case 0xc: case 0xd:
             /* push/pop */
             gen_movl_T1_reg(s, 13);
@@ -3378,13 +7299,82 @@ static void disas_thumb_insn(DisasContext *s)
                 gen_bx(s);
             break;
 
+        case 1: case 3: case 9: case 11: /* czb */
+            rm = insn & 7;
+            gen_movl_T0_reg(s, rm);
+            s->condlabel = gen_new_label();
+            s->condjmp = 1;
+            if (insn & (1 << 11))
+                gen_op_testn_T0(s->condlabel);
+            else
+                gen_op_test_T0(s->condlabel);
+
+            offset = ((insn & 0xf8) >> 2) | (insn & 0x200) >> 3;
+            val = (uint32_t)s->pc + 2;
+            val += offset;
+            gen_jmp(s, val);
+            break;
+
+        case 15: /* IT, nop-hint.  */
+            if ((insn & 0xf) == 0) {
+                gen_nop_hint(s, (insn >> 4) & 0xf);
+                break;
+            }
+            /* If Then.  */
+            s->condexec_cond = (insn >> 4) & 0xe;
+            s->condexec_mask = insn & 0x1f;
+            /* No actual code generated for this insn, just setup state.  */
+            break;
+
         case 0xe: /* bkpt */
+            gen_set_condexec(s);
             gen_op_movl_T0_im((long)s->pc - 2);
             gen_op_movl_reg_TN[0][15]();
             gen_op_bkpt();
             s->is_jmp = DISAS_JUMP;
             break;
 
+        case 0xa: /* rev */
+            ARCH(6);
+            rn = (insn >> 3) & 0x7;
+            rd = insn & 0x7;
+            gen_movl_T0_reg(s, rn);
+            switch ((insn >> 6) & 3) {
+            case 0: gen_op_rev_T0(); break;
+            case 1: gen_op_rev16_T0(); break;
+            case 3: gen_op_revsh_T0(); break;
+            default: goto illegal_op;
+            }
+            gen_movl_reg_T0(s, rd);
+            break;
+
+        case 6: /* cps */
+            ARCH(6);
+            if (IS_USER(s))
+                break;
+            if (IS_M(env)) {
+                val = (insn & (1 << 4)) != 0;
+                gen_op_movl_T0_im(val);
+                /* PRIMASK */
+                if (insn & 1)
+                    gen_op_v7m_msr_T0(16);
+                /* FAULTMASK */
+                if (insn & 2)
+                    gen_op_v7m_msr_T0(17);
+
+                gen_lookup_tb(s);
+            } else {
+                if (insn & (1 << 4))
+                    shift = CPSR_A | CPSR_I | CPSR_F;
+                else
+                    shift = 0;
+
+                val = ((insn & 7) << 6) & shift;
+                gen_op_movl_T0_im(val);
+                gen_set_psr_T0(s, shift, 0);
+            }
+            break;
+
         default:
             goto undef;
         }
@@ -3423,19 +7413,17 @@ static void disas_thumb_insn(DisasContext *s)
 
         if (cond == 0xf) {
             /* swi */
+            gen_set_condexec(s);
             gen_op_movl_T0_im((long)s->pc | 1);
             /* Don't set r15.  */
             gen_op_movl_reg_TN[0][15]();
-            gen_op_swi();
-            s->is_jmp = DISAS_JUMP;
+            s->is_jmp = DISAS_SWI;
             break;
         }
         /* generate a conditional jump to next instruction */
         s->condlabel = gen_new_label();
         gen_test_cc[cond ^ 1](s->condlabel);
         s->condjmp = 1;
-        //gen_test_cc[cond ^ 1]((long)s->tb, (long)s->pc);
-        //s->is_jmp = DISAS_JUMP_NEXT;
         gen_movl_T1_reg(s, 15);
 
         /* jump to the offset */
@@ -3446,22 +7434,12 @@ static void disas_thumb_insn(DisasContext *s)
         break;
 
     case 14:
-        /* unconditional branch */
         if (insn & (1 << 11)) {
-            /* Second half of blx.  */
-            offset = ((insn & 0x7ff) << 1);
-            gen_movl_T0_reg(s, 14);
-            gen_op_movl_T1_im(offset);
-            gen_op_addl_T0_T1();
-            gen_op_movl_T1_im(0xfffffffc);
-            gen_op_andl_T0_T1();
-
-            val = (uint32_t)s->pc;
-            gen_op_movl_T1_im(val | 1);
-            gen_movl_reg_T1(s, 14);
-            gen_bx(s);
+            if (disas_thumb2_insn(env, s, insn))
+              goto undef32;
             break;
         }
+        /* unconditional branch */
         val = (uint32_t)s->pc;
         offset = ((int32_t)insn << 21) >> 21;
         val += (offset << 1) + 2;
@@ -3469,51 +7447,21 @@ static void disas_thumb_insn(DisasContext *s)
         break;
 
     case 15:
-        /* branch and link [and switch to arm] */
-        if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
-            /* Instruction spans a page boundary.  Implement it as two
-               16-bit instructions in case the second half causes an
-               prefetch abort.  */
-            offset = ((int32_t)insn << 21) >> 9;
-            val = s->pc + 2 + offset;
-            gen_op_movl_T0_im(val);
-            gen_movl_reg_T0(s, 14);
-            break;
-        }
-        if (insn & (1 << 11)) {
-            /* Second half of bl.  */
-            offset = ((insn & 0x7ff) << 1) | 1;
-            gen_movl_T0_reg(s, 14);
-            gen_op_movl_T1_im(offset);
-            gen_op_addl_T0_T1();
-
-            val = (uint32_t)s->pc;
-            gen_op_movl_T1_im(val | 1);
-            gen_movl_reg_T1(s, 14);
-            gen_bx(s);
-            break;
-        }
-        offset = ((int32_t)insn << 21) >> 10;
-        insn = lduw_code(s->pc);
-        offset |= insn & 0x7ff;
-
-        val = (uint32_t)s->pc + 2;
-        gen_op_movl_T1_im(val | 1);
-        gen_movl_reg_T1(s, 14);
-
-        val += offset << 1;
-        if (insn & (1 << 12)) {
-            /* bl */
-            gen_jmp(s, val);
-        } else {
-            /* blx */
-            val &= ~(uint32_t)2;
-            gen_op_movl_T0_im(val);
-            gen_bx(s);
-        }
+        if (disas_thumb2_insn(env, s, insn))
+          goto undef32;
+        break;
     }
     return;
+undef32:
+    gen_set_condexec(s);
+    gen_op_movl_T0_im((long)s->pc - 4);
+    gen_op_movl_reg_TN[0][15]();
+    gen_op_undef_insn();
+    s->is_jmp = DISAS_JUMP;
+    return;
+illegal_op:
 undef:
+    gen_set_condexec(s);
     gen_op_movl_T0_im((long)s->pc - 2);
     gen_op_movl_reg_TN[0][15]();
     gen_op_undef_insn();
@@ -3547,21 +7495,44 @@ static inline int gen_intermediate_code_internal(CPUState *env,
     dc->singlestep_enabled = env->singlestep_enabled;
     dc->condjmp = 0;
     dc->thumb = env->thumb;
+    dc->condexec_mask = (env->condexec_bits & 0xf) << 1;
+    dc->condexec_cond = env->condexec_bits >> 4;
     dc->is_mem = 0;
 #if !defined(CONFIG_USER_ONLY)
-    dc->user = (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_USR;
+    if (IS_M(env)) {
+        dc->user = ((env->v7m.exception == 0) && (env->v7m.control & 1));
+    } else {
+        dc->user = (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_USR;
+    }
 #endif
     next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
     nb_gen_labels = 0;
     lj = -1;
+    /* Reset the conditional execution bits immediately. This avoids
+       complications trying to do it at the end of the block.  */
+    if (env->condexec_bits)
+      gen_op_set_condexec(0);
     do {
+#ifndef CONFIG_USER_ONLY
+        if (dc->pc >= 0xfffffff0 && IS_M(env)) {
+            /* We always get here via a jump, so know we are not in a
+               conditional execution block.  */
+            gen_op_exception_exit();
+        }
+#endif
+
         if (env->nb_breakpoints > 0) {
             for(j = 0; j < env->nb_breakpoints; j++) {
                 if (env->breakpoints[j] == dc->pc) {
+                    gen_set_condexec(dc);
                     gen_op_movl_T0_im((long)dc->pc);
                     gen_op_movl_reg_TN[0][15]();
                     gen_op_debug();
                     dc->is_jmp = DISAS_JUMP;
+                    /* Advance PC so that clearing the breakpoint will
+                       invalidate this TB.  */
+                    dc->pc += 2;
+                    goto done_generating;
                     break;
                 }
             }
@@ -3577,10 +7548,19 @@ static inline int gen_intermediate_code_internal(CPUState *env,
             gen_opc_instr_start[lj] = 1;
         }
 
-        if (env->thumb)
-          disas_thumb_insn(dc);
-        else
-          disas_arm_insn(env, dc);
+        if (env->thumb) {
+            disas_thumb_insn(env, dc);
+            if (dc->condexec_mask) {
+                dc->condexec_cond = (dc->condexec_cond & 0xe)
+                                   | ((dc->condexec_mask >> 4) & 1);
+                dc->condexec_mask = (dc->condexec_mask << 1) & 0x1f;
+                if (dc->condexec_mask == 0) {
+                    dc->condexec_cond = 0;
+                }
+            }
+        } else {
+            disas_arm_insn(env, dc);
+        }
 
         if (dc->condjmp && !dc->is_jmp) {
             gen_set_label(dc->condlabel);
@@ -3599,13 +7579,19 @@ static inline int gen_intermediate_code_internal(CPUState *env,
     } while (!dc->is_jmp && gen_opc_ptr < gen_opc_end &&
              !env->singlestep_enabled &&
              dc->pc < next_page_start);
+
     /* At this stage dc->condjmp will only be set when the skipped
-     * instruction was a conditional branch, and the PC has already been
-     * written.  */
+       instruction was a conditional branch or trap, and the PC has
+       already been written.  */
     if (__builtin_expect(env->singlestep_enabled, 0)) {
         /* Make sure the pc is updated, and raise a debug exception.  */
         if (dc->condjmp) {
-            gen_op_debug();
+            gen_set_condexec(dc);
+            if (dc->is_jmp == DISAS_SWI) {
+                gen_op_swi();
+            } else {
+                gen_op_debug();
+            }
             gen_set_label(dc->condlabel);
         }
         if (dc->condjmp || !dc->is_jmp) {
@@ -3613,8 +7599,24 @@ static inline int gen_intermediate_code_internal(CPUState *env,
             gen_op_movl_reg_TN[0][15]();
             dc->condjmp = 0;
         }
-        gen_op_debug();
+        gen_set_condexec(dc);
+        if (dc->is_jmp == DISAS_SWI && !dc->condjmp) {
+            gen_op_swi();
+        } else {
+            /* FIXME: Single stepping a WFI insn will not halt
+               the CPU.  */
+            gen_op_debug();
+        }
     } else {
+        /* While branches must always occur at the end of an IT block,
+           there are a few other things that can cause us to terminate
+           the TB in the middel of an IT block:
+            - Exception generating instructions (bkpt, swi, undefined).
+            - Page boundaries.
+            - Hardware watchpoints.
+           Hardware breakpoints have already been handled and skip this code.
+         */
+        gen_set_condexec(dc);
         switch(dc->is_jmp) {
         case DISAS_NEXT:
             gen_goto_tb(dc, 1, dc->pc);
@@ -3629,13 +7631,21 @@ static inline int gen_intermediate_code_internal(CPUState *env,
         case DISAS_TB_JUMP:
             /* nothing more to generate */
             break;
+        case DISAS_WFI:
+            gen_op_wfi();
+            break;
+        case DISAS_SWI:
+            gen_op_swi();
+            break;
         }
         if (dc->condjmp) {
             gen_set_label(dc->condlabel);
+            gen_set_condexec(dc);
             gen_goto_tb(dc, 1, dc->pc);
             dc->condjmp = 0;
         }
     }
+done_generating:
     *gen_opc_ptr = INDEX_op_end;
 
 #ifdef DEBUG_DISAS
@@ -3676,6 +7686,7 @@ static const char *cpu_mode_names[16] = {
   "usr", "fiq", "irq", "svc", "???", "???", "???", "abt",
   "???", "???", "???", "und", "???", "???", "???", "sys"
 };
+
 void cpu_dump_state(CPUState *env, FILE *f,
                     int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
                     int flags)
diff --git a/target-cris/cpu.h b/target-cris/cpu.h
new file mode 100644
index 000000000..56b0497f1
--- /dev/null
+++ b/target-cris/cpu.h
@@ -0,0 +1,264 @@
+/*
+ *  CRIS virtual CPU header
+ *
+ *  Copyright (c) 2007 AXIS Communications AB
+ *  Written by Edgar E. Iglesias
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#ifndef CPU_CRIS_H
+#define CPU_CRIS_H
+
+#define TARGET_LONG_BITS 32
+
+#include "cpu-defs.h"
+
+#include "softfloat.h"
+
+#define TARGET_HAS_ICE 1
+
+#define ELF_MACHINE	EM_CRIS
+
+#define EXCP_MMU_EXEC    0
+#define EXCP_MMU_READ    1
+#define EXCP_MMU_WRITE   2
+#define EXCP_MMU_FLUSH   3
+#define EXCP_MMU_MISS    4
+#define EXCP_BREAK      16 /* trap.  */
+
+/* CPU flags.  */
+#define S_FLAG 0x200
+#define R_FLAG 0x100
+#define P_FLAG 0x80
+#define U_FLAG 0x40
+#define P_FLAG 0x80
+#define U_FLAG 0x40
+#define I_FLAG 0x20
+#define X_FLAG 0x10
+#define N_FLAG 0x08
+#define Z_FLAG 0x04
+#define V_FLAG 0x02
+#define C_FLAG 0x01
+#define ALU_FLAGS 0x1F
+
+/* Condition codes.  */
+#define CC_CC   0
+#define CC_CS   1
+#define CC_NE   2
+#define CC_EQ   3
+#define CC_VC   4
+#define CC_VS   5
+#define CC_PL   6
+#define CC_MI   7
+#define CC_LS   8
+#define CC_HI   9
+#define CC_GE  10
+#define CC_LT  11
+#define CC_GT  12
+#define CC_LE  13
+#define CC_A   14
+#define CC_P   15
+
+/* Internal flags for the implementation.  */
+#define F_DELAYSLOT 1
+
+#define NB_MMU_MODES 2
+
+typedef struct CPUCRISState {
+	uint32_t debug1;
+	uint32_t debug2;
+	uint32_t debug3;
+
+	/*
+	 * We just store the stores to the tlbset here for later evaluation
+	 * when the hw needs access to them.
+	 *
+	 * One for I and another for D.
+	 */
+	struct
+	{
+		uint32_t hi;
+		uint32_t lo;
+	} tlbsets[2][4][16];
+
+	uint32_t sregs[256][16]; /* grrr why so many??  */
+	uint32_t regs[16];
+	uint32_t pregs[16];
+	uint32_t pc;
+	uint32_t sr;
+	uint32_t flag_mask; /* Per insn mask of affected flags.  */
+
+	/* SSP and USP.  */
+	int current_sp;
+	uint32_t sp[2];
+
+	/* These are setup up by the guest code just before transfering the
+	   control back to the host.  */
+	int jmp;
+	uint32_t btarget;
+	int btaken;
+
+	/* for traps.  */
+	int trapnr;
+
+	/* Condition flag tracking.  */
+	uint32_t cc_op;
+	uint32_t cc_mask;
+	uint32_t cc_dest;
+	uint32_t cc_src;
+	uint32_t cc_result;
+
+	/* size of the operation, 1 = byte, 2 = word, 4 = dword.  */
+	int cc_size;
+
+	/* extended arithmetics.  */
+	int cc_x_live;
+	int cc_x;
+
+	int features;
+
+        uint64_t pending_interrupts;
+	int interrupt_request;
+	int exception_index;
+	int user_mode_only;
+	int halted;
+
+	struct
+	{
+		int exec_insns;
+		int exec_loads;
+		int exec_stores;
+	} stats;
+
+
+	jmp_buf jmp_env;
+	CPU_COMMON
+} CPUCRISState;
+
+CPUCRISState *cpu_cris_init(const char *cpu_model);
+int cpu_cris_exec(CPUCRISState *s);
+void cpu_cris_close(CPUCRISState *s);
+void do_interrupt(CPUCRISState *env);
+/* you can call this signal handler from your SIGBUS and SIGSEGV
+   signal handlers to inform the virtual CPU of exceptions. non zero
+   is returned if the signal was handled by the virtual CPU.  */
+int cpu_cris_signal_handler(int host_signum, void *pinfo,
+                           void *puc);
+void cpu_cris_flush_flags(CPUCRISState *, int);
+
+
+void do_unassigned_access(target_phys_addr_t addr, int is_write, int is_exec,
+                          int is_asi);
+
+enum {
+    CC_OP_DYNAMIC, /* Use env->cc_op  */
+    CC_OP_FLAGS,
+    CC_OP_LOGIC,
+    CC_OP_CMP,
+    CC_OP_MOVE,
+    CC_OP_MOVE_PD,
+    CC_OP_MOVE_SD,
+    CC_OP_ADD,
+    CC_OP_ADDC,
+    CC_OP_MCP,
+    CC_OP_ADDU,
+    CC_OP_SUB,
+    CC_OP_SUBU,
+    CC_OP_NEG,
+    CC_OP_BTST,
+    CC_OP_MULS,
+    CC_OP_MULU,
+    CC_OP_DSTEP,
+    CC_OP_BOUND,
+
+    CC_OP_OR,
+    CC_OP_AND,
+    CC_OP_XOR,
+    CC_OP_LSL,
+    CC_OP_LSR,
+    CC_OP_ASR,
+    CC_OP_LZ
+};
+
+#define CCF_C 0x01
+#define CCF_V 0x02
+#define CCF_Z 0x04
+#define CCF_N 0x08
+#define CCF_X 0x10
+
+#define CRIS_SSP    0
+#define CRIS_USP    1
+
+void cris_set_irq_level(CPUCRISState *env, int level, uint8_t vector);
+void cris_set_macsr(CPUCRISState *env, uint32_t val);
+void cris_switch_sp(CPUCRISState *env);
+
+void do_cris_semihosting(CPUCRISState *env, int nr);
+
+enum cris_features {
+    CRIS_FEATURE_CF_ISA_MUL,
+};
+
+static inline int cris_feature(CPUCRISState *env, int feature)
+{
+    return (env->features & (1u << feature)) != 0;
+}
+
+void register_cris_insns (CPUCRISState *env);
+
+/* CRIS uses 8k pages.  */
+#define TARGET_PAGE_BITS 13
+
+#define CPUState CPUCRISState
+#define cpu_init cpu_cris_init
+#define cpu_exec cpu_cris_exec
+#define cpu_gen_code cpu_cris_gen_code
+#define cpu_signal_handler cpu_cris_signal_handler
+
+/* MMU modes definitions */
+#define MMU_MODE0_SUFFIX _kernel
+#define MMU_MODE1_SUFFIX _user
+#define MMU_USER_IDX 1
+/* CRIS FIXME: I guess we want to validate supervisor mode acceses here.  */
+static inline int cpu_mmu_index (CPUState *env)
+{
+    return 0;
+}
+
+#include "cpu-all.h"
+
+/* Register aliases.  */
+#define REG_SP  14
+#define REG_ACR 15
+#define REG_MOF 7
+
+/* Support regs.  */
+#define SR_PID 2
+#define SR_SRS 3
+#define SR_EBP 9
+#define SR_ERP 10
+#define SR_CCS 13
+
+/* Support func regs.  */
+#define SFR_RW_GC_CFG      0][0
+#define SFR_RW_MM_CFG      1][0
+#define SFR_RW_MM_KBASE_LO 1][1
+#define SFR_RW_MM_KBASE_HI 1][2
+#define SFR_R_MM_CAUSE     1][3
+#define SFR_RW_MM_TLB_SEL  1][4
+#define SFR_RW_MM_TLB_LO   1][5
+#define SFR_RW_MM_TLB_HI   1][6
+
+#endif
diff --git a/target-cris/crisv32-decode.h b/target-cris/crisv32-decode.h
new file mode 100644
index 000000000..5d30dcc4b
--- /dev/null
+++ b/target-cris/crisv32-decode.h
@@ -0,0 +1,126 @@
+/*
+ *  CRIS insn decoding macros.
+ *
+ *  Copyright (c) 2007 AXIS Communications AB
+ *  Written by Edgar E. Iglesias.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* Convenient binary macros.  */
+#define HEX__(n) 0x##n##LU
+#define B8__(x) ((x&0x0000000FLU)?1:0) \
+                 + ((x&0x000000F0LU)?2:0) \
+                 + ((x&0x00000F00LU)?4:0) \
+                 + ((x&0x0000F000LU)?8:0) \
+                 + ((x&0x000F0000LU)?16:0) \
+                 + ((x&0x00F00000LU)?32:0) \
+                 + ((x&0x0F000000LU)?64:0) \
+                 + ((x&0xF0000000LU)?128:0)
+#define B8(d) ((unsigned char)B8__(HEX__(d)))
+
+/* Quick imm.  */
+#define DEC_BCCQ     {B8(00000000), B8(11110000)}
+#define DEC_ADDOQ    {B8(00010000), B8(11110000)}
+#define DEC_ADDQ     {B8(00100000), B8(11111100)}
+#define DEC_MOVEQ    {B8(00100100), B8(11111100)}
+#define DEC_SUBQ     {B8(00101000), B8(11111100)}
+#define DEC_CMPQ     {B8(00101100), B8(11111100)}
+#define DEC_ANDQ     {B8(00110000), B8(11111100)}
+#define DEC_ORQ      {B8(00110100), B8(11111100)}
+#define DEC_BTSTQ    {B8(00111000), B8(11111110)}
+#define DEC_ASRQ     {B8(00111010), B8(11111110)}
+#define DEC_LSLQ     {B8(00111100), B8(11111110)}
+#define DEC_LSRQ     {B8(00111110), B8(11111110)}
+
+/* Register.  */
+#define DEC_MOVU_R   {B8(01000100), B8(11111110)}
+#define DEC_MOVU_R   {B8(01000100), B8(11111110)}
+#define DEC_MOVS_R   {B8(01000110), B8(11111110)}
+#define DEC_MOVE_R   {B8(01100100), B8(11111100)}
+#define DEC_MOVE_RP  {B8(01100011), B8(11111111)}
+#define DEC_MOVE_PR  {B8(01100111), B8(11111111)}
+#define DEC_DSTEP_R  {B8(01101111), B8(11111111)}
+#define DEC_MOVE_RS  {B8(10110111), B8(11111111)}
+#define DEC_MOVE_SR  {B8(11110111), B8(11111111)}
+#define DEC_ADDU_R   {B8(01000000), B8(11111110)}
+#define DEC_ADDS_R   {B8(01000010), B8(11111110)}
+#define DEC_ADD_R    {B8(01100000), B8(11111100)}
+#define DEC_ADDI_R   {B8(01010000), B8(11111100)}
+#define DEC_MULS_R   {B8(11010000), B8(11111100)}
+#define DEC_MULU_R   {B8(10010000), B8(11111100)}
+#define DEC_ADDI_ACR {B8(01010100), B8(11111100)}
+#define DEC_NEG_R    {B8(01011000), B8(11111100)}
+#define DEC_BOUND_R  {B8(01011100), B8(11111100)}
+#define DEC_SUBU_R   {B8(01001000), B8(11111110)}
+#define DEC_SUBS_R   {B8(01001010), B8(11111110)}
+#define DEC_SUB_R    {B8(01101000), B8(11111100)}
+#define DEC_CMP_R    {B8(01101100), B8(11111100)}
+#define DEC_AND_R    {B8(01110000), B8(11111100)}
+#define DEC_ABS_R    {B8(01101011), B8(11111111)}
+#define DEC_LZ_R     {B8(01110011), B8(11111111)}
+#define DEC_MCP_R    {B8(01111111), B8(11111111)}
+#define DEC_SWAP_R   {B8(01110111), B8(11111111)}
+#define DEC_XOR_R    {B8(01111011), B8(11111111)}
+#define DEC_LSL_R    {B8(01001100), B8(11111100)}
+#define DEC_LSR_R    {B8(01111100), B8(11111100)}
+#define DEC_ASR_R    {B8(01111000), B8(11111100)}
+#define DEC_OR_R     {B8(01110100), B8(11111100)}
+#define DEC_BTST_R   {B8(01001111), B8(11111111)}
+
+/* Fixed.  */
+#define DEC_SETF     {B8(01011011), B8(11111111)}
+#define DEC_CLEARF   {B8(01011111), B8(11111111)}
+
+/* Memory.  */
+#define DEC_ADDU_M   {B8(10000000), B8(10111110)}
+#define DEC_ADDS_M   {B8(10000010), B8(10111110)}
+#define DEC_MOVU_M   {B8(10000100), B8(10111110)}
+#define DEC_MOVS_M   {B8(10000110), B8(10111110)}
+#define DEC_SUBU_M   {B8(10001000), B8(10111110)}
+#define DEC_SUBS_M   {B8(10001010), B8(10111110)}
+#define DEC_CMPU_M   {B8(10001100), B8(10111110)}
+#define DEC_CMPS_M   {B8(10001110), B8(10111110)}
+#define DEC_ADDO_M   {B8(10010100), B8(10111100)}
+#define DEC_BOUND_M  {B8(10011100), B8(10111100)}
+#define DEC_ADD_M    {B8(10100000), B8(10111100)}
+#define DEC_MOVE_MR  {B8(10100100), B8(10111100)}
+#define DEC_SUB_M    {B8(10101000), B8(10111100)}
+#define DEC_CMP_M    {B8(10101100), B8(10111100)}
+#define DEC_AND_M    {B8(10110000), B8(10111100)}
+#define DEC_OR_M     {B8(10110100), B8(10111100)}
+#define DEC_TEST_M   {B8(10111000), B8(10111100)}
+#define DEC_MOVE_RM  {B8(10111100), B8(10111100)}
+
+#define DEC_ADDC_R   {B8(01010111), B8(11111111)}
+#define DEC_ADDC_MR  {B8(10011010), B8(10111111)}
+#define DEC_LAPCQ    {B8(10010111), B8(11111111)}
+#define DEC_LAPC_IM  {B8(11010111), B8(11111111)}
+
+#define DEC_MOVE_MP  {B8(10100011), B8(10111111)}
+#define DEC_MOVE_PM  {B8(10100111), B8(10111111)}
+
+#define DEC_SCC_R    {B8(01010011), B8(11111111)}
+#define DEC_RFE_ETC  {B8(10010011), B8(11111111)}
+#define DEC_JUMP_P   {B8(10011111), B8(11111111)}
+#define DEC_BCC_IM   {B8(11011111), B8(11111111)}
+#define DEC_JAS_R    {B8(10011011), B8(11111111)}
+#define DEC_JASC_R   {B8(10110011), B8(11111111)}
+#define DEC_JAS_IM   {B8(11011011), B8(11111111)}
+#define DEC_JASC_IM  {B8(11110011), B8(11111111)}
+#define DEC_BAS_IM   {B8(11101011), B8(11111111)}
+#define DEC_BASC_IM  {B8(11101111), B8(11111111)}
+#define DEC_MOVEM_MR {B8(10111011), B8(10111111)}
+#define DEC_MOVEM_RM {B8(10111111), B8(10111111)}
diff --git a/target-cris/exec.h b/target-cris/exec.h
new file mode 100644
index 000000000..fe63f1698
--- /dev/null
+++ b/target-cris/exec.h
@@ -0,0 +1,68 @@
+/*
+ *  CRIS execution defines
+ *
+ *  Copyright (c) 2007 AXIS Communications AB
+ *  Written by Edgar E. Iglesias
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#include "dyngen-exec.h"
+
+#if 1
+register struct CPUCRISState *env asm(AREG0);
+/* This is only used for tb lookup.  */
+register uint32_t T0 asm(AREG1);
+register uint32_t T1 asm(AREG2);
+#else
+struct CPUCRISState *env;
+/* This is only used for tb lookup.  */
+uint32_t T0;
+uint32_t T1;
+#endif
+#include "cpu.h"
+#include "exec-all.h"
+
+#define RETURN() __asm__ __volatile__("" : : : "memory");
+
+static inline void env_to_regs(void)
+{
+}
+
+static inline void regs_to_env(void)
+{
+}
+
+int cpu_cris_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
+                              int mmu_idx, int is_softmmu);
+void tlb_fill (target_ulong addr, int is_write, int mmu_idx, void *retaddr);
+
+#if !defined(CONFIG_USER_ONLY)
+#include "softmmu_exec.h"
+#endif
+
+void cpu_cris_flush_flags(CPUCRISState *env, int cc_op);
+void helper_movec(CPUCRISState *env, int reg, uint32_t val);
+
+void cpu_loop_exit(void);
+
+static inline int cpu_halted(CPUState *env) {
+	if (!env->halted)
+		return 0;
+	if (env->interrupt_request & CPU_INTERRUPT_HARD) {
+		env->halted = 0;
+		return 0;
+	}
+	return EXCP_HALTED;
+}
diff --git a/target-cris/helper.c b/target-cris/helper.c
new file mode 100644
index 000000000..d71959326
--- /dev/null
+++ b/target-cris/helper.c
@@ -0,0 +1,173 @@
+/*
+ *  CRIS helper routines.
+ *
+ *  Copyright (c) 2007 AXIS Communications AB
+ *  Written by Edgar E. Iglesias.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <stdio.h>
+#include <string.h>
+
+#include "config.h"
+#include "cpu.h"
+#include "mmu.h"
+#include "exec-all.h"
+#include "host-utils.h"
+
+#if defined(CONFIG_USER_ONLY)
+
+void do_interrupt (CPUState *env)
+{
+  env->exception_index = -1;
+}
+
+int cpu_cris_handle_mmu_fault(CPUState * env, target_ulong address, int rw,
+                             int mmu_idx, int is_softmmu)
+{
+    env->exception_index = 0xaa;
+    env->debug1 = address;
+    cpu_dump_state(env, stderr, fprintf, 0);
+    printf("%s addr=%x env->pc=%x\n", __func__, address, env->pc);
+    return 1;
+}
+
+target_phys_addr_t cpu_get_phys_page_debug(CPUState * env, target_ulong addr)
+{
+    return addr;
+}
+
+#else /* !CONFIG_USER_ONLY */
+
+int cpu_cris_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
+                               int mmu_idx, int is_softmmu)
+{
+	struct cris_mmu_result_t res;
+	int prot, miss;
+	target_ulong phy;
+
+	address &= TARGET_PAGE_MASK;
+	prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+//	printf ("%s pc=%x %x w=%d smmu=%d\n", __func__, env->pc, address, rw, is_softmmu);
+	miss = cris_mmu_translate(&res, env, address, rw, mmu_idx);
+	if (miss)
+	{
+		/* handle the miss.  */
+		phy = 0;
+		env->exception_index = EXCP_MMU_MISS;
+	}
+	else
+	{
+		phy = res.phy;
+	}
+//	printf ("a=%x phy=%x\n", address, phy);
+	return tlb_set_page(env, address, phy, prot, mmu_idx, is_softmmu);
+}
+
+
+static void cris_shift_ccs(CPUState *env)
+{
+	uint32_t ccs;
+	/* Apply the ccs shift.  */
+	ccs = env->pregs[SR_CCS];
+	ccs = (ccs & 0xc0000000) | ((ccs << 12) >> 2);
+//	printf ("ccs=%x %x\n", env->pregs[SR_CCS], ccs);
+	env->pregs[SR_CCS] = ccs;
+}
+
+void do_interrupt(CPUState *env)
+{
+	uint32_t ebp, isr;
+	int irqnum;
+
+	fflush(NULL);
+
+#if 0
+	printf ("exception index=%d interrupt_req=%d\n",
+		env->exception_index,
+		env->interrupt_request);
+#endif
+
+	switch (env->exception_index)
+	{
+		case EXCP_BREAK:
+//			printf ("BREAK! %d\n", env->trapnr);
+			irqnum = env->trapnr;
+			ebp = env->pregs[SR_EBP];
+			isr = ldl_code(ebp + irqnum * 4);
+			env->pregs[SR_ERP] = env->pc + 2;
+			env->pc = isr;
+
+			cris_shift_ccs(env);
+
+			break;
+		case EXCP_MMU_MISS:
+//			printf ("MMU miss\n");
+			irqnum = 4;
+			ebp = env->pregs[SR_EBP];
+			isr = ldl_code(ebp + irqnum * 4);
+			env->pregs[SR_ERP] = env->pc;
+			env->pc = isr;
+			cris_shift_ccs(env);
+			break;
+
+		default:
+		{
+			/* Maybe the irq was acked by sw before we got a
+			   change to take it.  */
+			if (env->interrupt_request & CPU_INTERRUPT_HARD) {
+				if (!env->pending_interrupts)
+					return;
+				if (!(env->pregs[SR_CCS] & I_FLAG)) {
+					return;
+				}
+
+				irqnum = 31 - clz32(env->pending_interrupts);
+				irqnum += 0x30;
+				ebp = env->pregs[SR_EBP];
+				isr = ldl_code(ebp + irqnum * 4);
+				env->pregs[SR_ERP] = env->pc;
+				env->pc = isr;
+
+				cris_shift_ccs(env);
+#if 0
+				printf ("%s ebp=%x %x isr=%x %d"
+					" ir=%x pending=%x\n",
+					__func__,
+					ebp, ebp + irqnum * 4,
+					isr, env->exception_index,
+					env->interrupt_request,
+					env->pending_interrupts);
+#endif
+			}
+
+		}
+		break;
+	}
+}
+
+target_phys_addr_t cpu_get_phys_page_debug(CPUState * env, target_ulong addr)
+{
+//	printf ("%s\n", __func__);
+	uint32_t phy = addr;
+	struct cris_mmu_result_t res;
+	int miss;
+	miss = cris_mmu_translate(&res, env, addr, 0, 0);
+	if (!miss)
+		phy = res.phy;
+	return phy;
+}
+#endif
diff --git a/target-cris/mmu.c b/target-cris/mmu.c
new file mode 100644
index 000000000..2be4eb8f7
--- /dev/null
+++ b/target-cris/mmu.c
@@ -0,0 +1,148 @@
+/*
+ *  CRIS mmu emulation.
+ *
+ *  Copyright (c) 2007 AXIS Communications AB
+ *  Written by Edgar E. Iglesias.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#ifndef CONFIG_USER_ONLY
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "config.h"
+#include "cpu.h"
+#include "mmu.h"
+#include "exec-all.h"
+
+
+static int cris_mmu_enabled(uint32_t rw_gc_cfg)
+{
+	return (rw_gc_cfg & 12) != 0;
+}
+
+static int cris_mmu_segmented_addr(int seg, uint32_t rw_mm_cfg)
+{
+	return (1 << seg) & rw_mm_cfg;
+}
+
+static uint32_t cris_mmu_translate_seg(CPUState *env, int seg)
+{
+	uint32_t base;
+	int i;
+
+	if (seg < 8)
+		base = env->sregs[SFR_RW_MM_KBASE_LO];
+	else
+		base = env->sregs[SFR_RW_MM_KBASE_HI];
+
+	i = seg & 7;
+	base >>= i * 4;
+	base &= 15;
+
+	base <<= 28;
+	return base;
+}
+/* Used by the tlb decoder.  */
+#define EXTRACT_FIELD(src, start, end) \
+            (((src) >> start) & ((1 << (end - start + 1)) - 1))
+
+static int cris_mmu_translate_page(struct cris_mmu_result_t *res,
+				   CPUState *env, uint32_t vaddr,
+				   int rw, int usermode)
+{
+	unsigned int vpage;
+	unsigned int idx;
+	uint32_t lo, hi;
+	uint32_t vpn, pfn = 0, pid, fg, fv, fk, fw, fx;
+	int i, match = 0;
+
+	vpage = vaddr >> 13;
+	idx = vpage & 31;
+	vpage >>= 4;
+
+	/* We know the index which to check on each set.
+	   Scan both I and D.  */
+	for (i = 0; i < 4; i++)
+	{
+		lo = env->tlbsets[0][i][idx].lo;
+		hi = env->tlbsets[0][i][idx].hi;
+
+		vpn = EXTRACT_FIELD(hi, 13, 31);
+		pid = EXTRACT_FIELD(hi, 0, 7);
+
+		if (vpn == vpage
+		    && pid == env->pregs[SR_PID]) {
+			match = 1;
+			break;
+		}
+	}
+
+	if (match) {
+		pfn = EXTRACT_FIELD(lo, 13, 31);
+		fg = EXTRACT_FIELD(lo, 4, 4);
+		fv = EXTRACT_FIELD(lo, 3, 3);
+		fk = EXTRACT_FIELD(lo, 2, 2);
+		fw = EXTRACT_FIELD(lo, 1, 1);
+		fx = EXTRACT_FIELD(lo, 0, 0);
+	}
+	printf ("%s match=%d vaddr=%x vpage=%x vpn=%x pfn=%x pid=%x %x\n",
+		__func__, match,
+		vaddr, vpage,
+		vpn, pfn, pid, env->pregs[SR_PID]);
+	res->pfn = pfn;
+	return !match;
+}
+
+int cris_mmu_translate(struct cris_mmu_result_t *res,
+		       CPUState *env, uint32_t vaddr,
+		       int rw, int mmu_idx)
+{
+	uint32_t phy = vaddr;
+	int seg;
+	int miss = 0;
+        int is_user = mmu_idx == MMU_USER_IDX;
+
+	if (!cris_mmu_enabled(env->sregs[SFR_RW_GC_CFG])) {
+		res->phy = vaddr;
+		return 0;
+	}
+
+	seg = vaddr >> 28;
+	if (cris_mmu_segmented_addr(seg, env->sregs[SFR_RW_MM_CFG]))
+	{
+		uint32_t base;
+
+		miss = 0;
+		base = cris_mmu_translate_seg(env, seg);
+		phy = base | (0x0fffffff & vaddr);
+		res->phy = phy;
+	}
+	else
+	{
+		miss = cris_mmu_translate_page(res, env, vaddr, rw, is_user);
+		if (!miss) {
+			phy &= 8191;
+			phy |= (res->pfn << 13);
+			res->phy = phy;
+		}
+	}
+//	printf ("miss=%d v=%x -> p=%x\n", miss, vaddr, phy);
+	return miss;
+}
+#endif
diff --git a/target-cris/mmu.h b/target-cris/mmu.h
new file mode 100644
index 000000000..519c0fc81
--- /dev/null
+++ b/target-cris/mmu.h
@@ -0,0 +1,20 @@
+#define CRIS_MMU_ERR_EXEC  0
+#define CRIS_MMU_ERR_READ  1
+#define CRIS_MMU_ERR_WRITE 2
+#define CRIS_MMU_ERR_FLUSH 3
+
+struct cris_mmu_result_t
+{
+	uint32_t phy;
+	uint32_t pfn;
+	int g:1;
+	int v:1;
+	int k:1;
+	int w:1;
+	int e:1;
+	int cause_op;
+};
+
+int cris_mmu_translate(struct cris_mmu_result_t *res,
+		       CPUState *env, uint32_t vaddr,
+		       int rw, int mmu_idx);
diff --git a/target-cris/op.c b/target-cris/op.c
new file mode 100644
index 000000000..6e17719b6
--- /dev/null
+++ b/target-cris/op.c
@@ -0,0 +1,1287 @@
+/*
+ *  CRIS emulation micro-operations for qemu.
+ *
+ *  Copyright (c) 2007 Edgar E. Iglesias, Axis Communications AB.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#include "exec.h"
+#include "host-utils.h"
+
+#define REGNAME r0
+#define REG (env->regs[0])
+#include "op_template.h"
+
+#define REGNAME r1
+#define REG (env->regs[1])
+#include "op_template.h"
+
+#define REGNAME r2
+#define REG (env->regs[2])
+#include "op_template.h"
+
+#define REGNAME r3
+#define REG (env->regs[3])
+#include "op_template.h"
+
+#define REGNAME r4
+#define REG (env->regs[4])
+#include "op_template.h"
+
+#define REGNAME r5
+#define REG (env->regs[5])
+#include "op_template.h"
+
+#define REGNAME r6
+#define REG (env->regs[6])
+#include "op_template.h"
+
+#define REGNAME r7
+#define REG (env->regs[7])
+#include "op_template.h"
+
+#define REGNAME r8
+#define REG (env->regs[8])
+#include "op_template.h"
+
+#define REGNAME r9
+#define REG (env->regs[9])
+#include "op_template.h"
+
+#define REGNAME r10
+#define REG (env->regs[10])
+#include "op_template.h"
+
+#define REGNAME r11
+#define REG (env->regs[11])
+#include "op_template.h"
+
+#define REGNAME r12
+#define REG (env->regs[12])
+#include "op_template.h"
+
+#define REGNAME r13
+#define REG (env->regs[13])
+#include "op_template.h"
+
+#define REGNAME r14
+#define REG (env->regs[14])
+#include "op_template.h"
+
+#define REGNAME r15
+#define REG (env->regs[15])
+#include "op_template.h"
+
+
+#define REGNAME p0
+#define REG (env->pregs[0])
+#include "op_template.h"
+
+#define REGNAME p1
+#define REG (env->pregs[1])
+#include "op_template.h"
+
+#define REGNAME p2
+#define REG (env->pregs[2])
+#include "op_template.h"
+
+#define REGNAME p3
+#define REG (env->pregs[3])
+#include "op_template.h"
+
+#define REGNAME p4
+#define REG (env->pregs[4])
+#include "op_template.h"
+
+#define REGNAME p5
+#define REG (env->pregs[5])
+#include "op_template.h"
+
+#define REGNAME p6
+#define REG (env->pregs[6])
+#include "op_template.h"
+
+#define REGNAME p7
+#define REG (env->pregs[7])
+#include "op_template.h"
+
+#define REGNAME p8
+#define REG (env->pregs[8])
+#include "op_template.h"
+
+#define REGNAME p9
+#define REG (env->pregs[9])
+#include "op_template.h"
+
+#define REGNAME p10
+#define REG (env->pregs[10])
+#include "op_template.h"
+
+#define REGNAME p11
+#define REG (env->pregs[11])
+#include "op_template.h"
+
+#define REGNAME p12
+#define REG (env->pregs[12])
+#include "op_template.h"
+
+#define REGNAME p13
+#define REG (env->pregs[13])
+#include "op_template.h"
+
+#define REGNAME p14
+#define REG (env->pregs[14])
+#include "op_template.h"
+
+#define REGNAME p15
+#define REG (env->pregs[15])
+#include "op_template.h"
+
+/* Microcode.  */
+
+void OPPROTO op_exit_tb (void)
+{
+	EXIT_TB();
+}
+
+void OPPROTO op_goto_tb0 (void)
+{
+	GOTO_TB(op_goto_tb0, PARAM1, 0);
+	RETURN();
+}
+
+void OPPROTO op_goto_tb1 (void)
+{
+	GOTO_TB(op_goto_tb1, PARAM1, 1);
+	RETURN();
+}
+
+void OPPROTO op_break_im(void)
+{
+	env->trapnr = PARAM1;
+	env->exception_index = EXCP_BREAK;
+	cpu_loop_exit();
+}
+
+void OPPROTO op_debug(void)
+{
+	env->exception_index = EXCP_DEBUG;
+	cpu_loop_exit();
+}
+
+void OPPROTO op_exec_insn(void)
+{
+	env->stats.exec_insns++;
+	RETURN();
+}
+void OPPROTO op_exec_load(void)
+{
+	env->stats.exec_loads++;
+	RETURN();
+}
+void OPPROTO op_exec_store(void)
+{
+	env->stats.exec_stores++;
+	RETURN();
+}
+
+void OPPROTO op_ccs_lshift (void)
+{
+	uint32_t ccs;
+
+	/* Apply the ccs shift.  */
+	ccs = env->pregs[SR_CCS];
+	ccs = (ccs & 0xc0000000) | ((ccs << 12) >> 2);
+	env->pregs[SR_CCS] = ccs;
+}
+void OPPROTO op_ccs_rshift (void)
+{
+	uint32_t ccs;
+
+	/* Apply the ccs shift.  */
+	ccs = env->pregs[SR_CCS];
+	ccs = (ccs & 0xc0000000) | (ccs >> 10);
+	env->pregs[SR_CCS] = ccs;
+}
+
+void OPPROTO op_setf (void)
+{
+	env->pregs[SR_CCS] |= PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_clrf (void)
+{
+	env->pregs[SR_CCS] &= ~PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_movl_debug1_T0 (void)
+{
+	env->debug1 = T0;
+	RETURN();
+}
+
+void OPPROTO op_movl_debug2_T0 (void)
+{
+	env->debug2 = T0;
+	RETURN();
+}
+
+void OPPROTO op_movl_debug3_T0 (void)
+{
+	env->debug3 = T0;
+	RETURN();
+}
+void OPPROTO op_movl_debug1_T1 (void)
+{
+	env->debug1 = T1;
+	RETURN();
+}
+
+void OPPROTO op_movl_debug2_T1 (void)
+{
+	env->debug2 = T1;
+	RETURN();
+}
+
+void OPPROTO op_movl_debug3_T1 (void)
+{
+	env->debug3 = T1;
+	RETURN();
+}
+void OPPROTO op_movl_debug3_im (void)
+{
+	env->debug3 = PARAM1;
+	RETURN();
+}
+void OPPROTO op_movl_T0_flags (void)
+{
+	T0 = env->pregs[SR_CCS];
+	RETURN();
+}
+void OPPROTO op_movl_flags_T0 (void)
+{
+	env->pregs[SR_CCS] = T0;
+	RETURN();
+}
+
+void OPPROTO op_movl_sreg_T0 (void)
+{
+	env->sregs[env->pregs[SR_SRS]][PARAM1] = T0;
+	RETURN();
+}
+
+void OPPROTO op_movl_tlb_lo_T0 (void)
+{
+	int srs;
+	srs = env->pregs[SR_SRS];
+	if (srs == 1 || srs == 2)
+	{
+		int set;
+		int idx;
+		uint32_t lo, hi;
+
+		idx = set = env->sregs[SFR_RW_MM_TLB_SEL];
+		set >>= 4;
+		set &= 3;
+
+		idx &= 31;
+		/* We've just made a write to tlb_lo.  */
+		lo = env->sregs[SFR_RW_MM_TLB_LO];
+		hi = env->sregs[SFR_RW_MM_TLB_HI];
+		env->tlbsets[srs - 1][set][idx].lo = lo;
+		env->tlbsets[srs - 1][set][idx].hi = hi;
+	}
+
+	RETURN();
+}
+
+void OPPROTO op_movl_T0_sreg (void)
+{
+	T0 = env->sregs[env->pregs[SR_SRS]][PARAM1];
+	RETURN();
+}
+
+void OPPROTO op_update_cc (void)
+{
+	env->cc_op = PARAM1;
+	env->cc_dest = PARAM2;
+	env->cc_src = PARAM3;
+	RETURN();
+}
+
+void OPPROTO op_update_cc_op (void)
+{
+	env->cc_op = PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_update_cc_mask (void)
+{
+	env->cc_mask = PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_update_cc_dest_T0 (void)
+{
+	env->cc_dest = T0;
+	RETURN();
+}
+
+void OPPROTO op_update_cc_result_T0 (void)
+{
+	env->cc_result = T0;
+	RETURN();
+}
+
+void OPPROTO op_update_cc_size_im (void)
+{
+	env->cc_size = PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_update_cc_src_T1 (void)
+{
+	env->cc_src = T1;
+	RETURN();
+}
+void OPPROTO op_update_cc_x (void)
+{
+	env->cc_x_live = PARAM1;
+	env->cc_x = PARAM2;
+	RETURN();
+}
+
+/* FIXME: is this allowed?  */
+extern inline void evaluate_flags_writeback(uint32_t flags)
+{
+	int x;
+
+	/* Extended arithmetics, leave the z flag alone.  */
+	env->debug3 = env->pregs[SR_CCS];
+
+	if (env->cc_x_live)
+		x = env->cc_x;
+	else
+		x = env->pregs[SR_CCS] & X_FLAG;
+
+	if ((x || env->cc_op == CC_OP_ADDC)
+	    && flags & Z_FLAG)
+		env->cc_mask &= ~Z_FLAG;
+
+	/* all insn clear the x-flag except setf or clrf.  */
+	env->pregs[SR_CCS] &= ~(env->cc_mask | X_FLAG);
+	flags &= env->cc_mask;
+	env->pregs[SR_CCS] |= flags;
+	RETURN();
+}
+
+void OPPROTO op_evaluate_flags_muls(void)
+{
+	uint32_t src;
+	uint32_t dst;
+	uint32_t res;
+	uint32_t flags = 0;
+	/* were gonna have to redo the muls.  */
+	int64_t tmp, t0 ,t1;
+	int32_t mof;
+	int dneg;
+
+	src = env->cc_src;
+	dst = env->cc_dest;
+	res = env->cc_result;
+
+
+	/* cast into signed values to make GCC sign extend.  */
+	t0 = (int32_t)src;
+	t1 = (int32_t)dst;
+	dneg = ((int32_t)res) < 0;
+
+	tmp = t0 * t1;
+	mof = tmp >> 32;
+	if (tmp == 0)
+		flags |= Z_FLAG;
+	else if (tmp < 0)
+		flags |= N_FLAG;
+	if ((dneg && mof != -1)
+	    || (!dneg && mof != 0))
+		flags |= V_FLAG;
+	evaluate_flags_writeback(flags);
+	RETURN();
+}
+
+void OPPROTO op_evaluate_flags_mulu(void)
+{
+	uint32_t src;
+	uint32_t dst;
+	uint32_t res;
+	uint32_t flags = 0;
+	/* were gonna have to redo the muls.  */
+	uint64_t tmp, t0 ,t1;
+	uint32_t mof;
+
+	src = env->cc_src;
+	dst = env->cc_dest;
+	res = env->cc_result;
+
+
+	/* cast into signed values to make GCC sign extend.  */
+	t0 = src;
+	t1 = dst;
+
+	tmp = t0 * t1;
+	mof = tmp >> 32;
+	if (tmp == 0)
+		flags |= Z_FLAG;
+	else if (tmp >> 63)
+		flags |= N_FLAG;
+	if (mof)
+		flags |= V_FLAG;
+
+	evaluate_flags_writeback(flags);
+	RETURN();
+}
+
+void OPPROTO op_evaluate_flags_mcp(void)
+{
+	uint32_t src;
+	uint32_t dst;
+	uint32_t res;
+	uint32_t flags = 0;
+
+	src = env->cc_src;
+	dst = env->cc_dest;
+	res = env->cc_result;
+
+	if ((res & 0x80000000L) != 0L)
+	{
+		flags |= N_FLAG;
+		if (((src & 0x80000000L) == 0L)
+		    && ((dst & 0x80000000L) == 0L))
+		{
+			flags |= V_FLAG;
+		}
+		else if (((src & 0x80000000L) != 0L) &&
+			 ((dst & 0x80000000L) != 0L))
+		{
+			flags |= R_FLAG;
+		}
+	}
+	else
+	{
+		if (res == 0L)
+			flags |= Z_FLAG;
+		if (((src & 0x80000000L) != 0L)
+		    && ((dst & 0x80000000L) != 0L))
+			flags |= V_FLAG;
+		if ((dst & 0x80000000L) != 0L
+		    || (src & 0x80000000L) != 0L)
+			flags |= R_FLAG;
+	}
+
+	evaluate_flags_writeback(flags);
+	RETURN();
+}
+
+void OPPROTO op_evaluate_flags_alu_4(void)
+{
+	uint32_t src;
+	uint32_t dst;
+	uint32_t res;
+	uint32_t flags = 0;
+
+	src = env->cc_src;
+	dst = env->cc_dest;
+	res = env->cc_result;
+
+	if ((res & 0x80000000L) != 0L)
+	{
+		flags |= N_FLAG;
+		if (((src & 0x80000000L) == 0L)
+		    && ((dst & 0x80000000L) == 0L))
+		{
+			flags |= V_FLAG;
+		}
+		else if (((src & 0x80000000L) != 0L) &&
+			 ((dst & 0x80000000L) != 0L))
+		{
+			flags |= C_FLAG;
+		}
+	}
+	else
+	{
+		if (res == 0L)
+			flags |= Z_FLAG;
+		if (((src & 0x80000000L) != 0L)
+		    && ((dst & 0x80000000L) != 0L))
+			flags |= V_FLAG;
+		if ((dst & 0x80000000L) != 0L
+		    || (src & 0x80000000L) != 0L)
+			flags |= C_FLAG;
+	}
+
+	if (env->cc_op == CC_OP_SUB
+	    || env->cc_op == CC_OP_CMP) {
+		flags ^= C_FLAG;
+	}
+	evaluate_flags_writeback(flags);
+	RETURN();
+}
+
+void OPPROTO op_evaluate_flags_move_4 (void)
+{
+	uint32_t src;
+	uint32_t res;
+	uint32_t flags = 0;
+
+	src = env->cc_src;
+	res = env->cc_result;
+
+	if ((int32_t)res < 0)
+		flags |= N_FLAG;
+	else if (res == 0L)
+		flags |= Z_FLAG;
+
+	evaluate_flags_writeback(flags);
+	RETURN();
+}
+void OPPROTO op_evaluate_flags_move_2 (void)
+{
+	uint32_t src;
+	uint32_t flags = 0;
+	uint16_t res;
+
+	src = env->cc_src;
+	res = env->cc_result;
+
+	if ((int16_t)res < 0L)
+		flags |= N_FLAG;
+	else if (res == 0)
+		flags |= Z_FLAG;
+
+	evaluate_flags_writeback(flags);
+	RETURN();
+}
+
+/* TODO: This is expensive. We could split things up and only evaluate part of
+   CCR on a need to know basis. For now, we simply re-evaluate everything.  */
+void OPPROTO op_evaluate_flags (void)
+{
+	uint32_t src;
+	uint32_t dst;
+	uint32_t res;
+	uint32_t flags = 0;
+
+	src = env->cc_src;
+	dst = env->cc_dest;
+	res = env->cc_result;
+
+
+	/* Now, evaluate the flags. This stuff is based on
+	   Per Zander's CRISv10 simulator.  */
+	switch (env->cc_size)
+	{
+		case 1:
+			if ((res & 0x80L) != 0L)
+			{
+				flags |= N_FLAG;
+				if (((src & 0x80L) == 0L)
+				    && ((dst & 0x80L) == 0L))
+				{
+					flags |= V_FLAG;
+				}
+				else if (((src & 0x80L) != 0L)
+					 && ((dst & 0x80L) != 0L))
+				{
+					flags |= C_FLAG;
+				}
+			}
+			else
+			{
+				if ((res & 0xFFL) == 0L)
+				{
+					flags |= Z_FLAG;
+				}
+				if (((src & 0x80L) != 0L)
+				    && ((dst & 0x80L) != 0L))
+				{
+					flags |= V_FLAG;
+				}
+				if ((dst & 0x80L) != 0L
+				    || (src & 0x80L) != 0L)
+				{
+					flags |= C_FLAG;
+				}
+			}
+			break;
+		case 2:
+			if ((res & 0x8000L) != 0L)
+			{
+				flags |= N_FLAG;
+				if (((src & 0x8000L) == 0L)
+				    && ((dst & 0x8000L) == 0L))
+				{
+					flags |= V_FLAG;
+				}
+				else if (((src & 0x8000L) != 0L)
+					 && ((dst & 0x8000L) != 0L))
+				{
+					flags |= C_FLAG;
+				}
+			}
+			else
+			{
+				if ((res & 0xFFFFL) == 0L)
+				{
+					flags |= Z_FLAG;
+				}
+				if (((src & 0x8000L) != 0L)
+				    && ((dst & 0x8000L) != 0L))
+				{
+					flags |= V_FLAG;
+				}
+				if ((dst & 0x8000L) != 0L
+				    || (src & 0x8000L) != 0L)
+				{
+					flags |= C_FLAG;
+				}
+			}
+			break;
+		case 4:
+			if ((res & 0x80000000L) != 0L)
+			{
+				flags |= N_FLAG;
+				if (((src & 0x80000000L) == 0L)
+				    && ((dst & 0x80000000L) == 0L))
+				{
+					flags |= V_FLAG;
+				}
+				else if (((src & 0x80000000L) != 0L) &&
+					 ((dst & 0x80000000L) != 0L))
+				{
+					flags |= C_FLAG;
+				}
+			}
+			else
+			{
+				if (res == 0L)
+					flags |= Z_FLAG;
+				if (((src & 0x80000000L) != 0L)
+				    && ((dst & 0x80000000L) != 0L))
+					flags |= V_FLAG;
+				if ((dst & 0x80000000L) != 0L
+				    || (src & 0x80000000L) != 0L)
+					flags |= C_FLAG;
+			}
+			break;
+		default:
+			break;
+	}
+
+	if (env->cc_op == CC_OP_SUB
+	    || env->cc_op == CC_OP_CMP) {
+		flags ^= C_FLAG;
+	}
+	evaluate_flags_writeback(flags);
+	RETURN();
+}
+
+void OPPROTO op_extb_T0_T0 (void)
+{
+	T0 = ((int8_t)T0);
+	RETURN();
+}
+void OPPROTO op_extb_T1_T0 (void)
+{
+	T1 = ((int8_t)T0);
+	RETURN();
+}
+void OPPROTO op_extb_T1_T1 (void)
+{
+	T1 = ((int8_t)T1);
+	RETURN();
+}
+void OPPROTO op_zextb_T0_T0 (void)
+{
+	T0 = ((uint8_t)T0);
+	RETURN();
+}
+void OPPROTO op_zextb_T1_T0 (void)
+{
+	T1 = ((uint8_t)T0);
+	RETURN();
+}
+void OPPROTO op_zextb_T1_T1 (void)
+{
+	T1 = ((uint8_t)T1);
+	RETURN();
+}
+void OPPROTO op_extw_T0_T0 (void)
+{
+	T0 = ((int16_t)T0);
+	RETURN();
+}
+void OPPROTO op_extw_T1_T0 (void)
+{
+	T1 = ((int16_t)T0);
+	RETURN();
+}
+void OPPROTO op_extw_T1_T1 (void)
+{
+	T1 = ((int16_t)T1);
+	RETURN();
+}
+
+void OPPROTO op_zextw_T0_T0 (void)
+{
+	T0 = ((uint16_t)T0);
+	RETURN();
+}
+void OPPROTO op_zextw_T1_T0 (void)
+{
+	T1 = ((uint16_t)T0);
+	RETURN();
+}
+
+void OPPROTO op_zextw_T1_T1 (void)
+{
+	T1 = ((uint16_t)T1);
+	RETURN();
+}
+
+void OPPROTO op_movl_T0_im (void)
+{
+	T0 = PARAM1;
+	RETURN();
+}
+void OPPROTO op_movl_T1_im (void)
+{
+	T1 = PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_addl_T0_im (void)
+{
+	T0 += PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_addl_T1_im (void)
+{
+	T1 += PARAM1;
+	RETURN();
+
+}
+void OPPROTO op_subl_T0_im (void)
+{
+	T0 -= PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_addxl_T0_C (void)
+{
+	if (env->pregs[SR_CCS] & X_FLAG)
+		T0 += !!(env->pregs[SR_CCS] & C_FLAG);
+	RETURN();
+}
+void OPPROTO op_subxl_T0_C (void)
+{
+	if (env->pregs[SR_CCS] & X_FLAG)
+		T0 -= !!(env->pregs[SR_CCS] & C_FLAG);
+	RETURN();
+}
+void OPPROTO op_addl_T0_C (void)
+{
+	T0 += !!(env->pregs[SR_CCS] & C_FLAG);
+	RETURN();
+}
+void OPPROTO op_addl_T0_R (void)
+{
+	T0 += !!(env->pregs[SR_CCS] & R_FLAG);
+	RETURN();
+}
+
+void OPPROTO op_clr_R (void)
+{
+	env->pregs[SR_CCS] &= ~R_FLAG;
+	RETURN();
+}
+
+
+void OPPROTO op_andl_T0_im (void)
+{
+	T0 &= PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_andl_T1_im (void)
+{
+	T1 &= PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_movl_T0_T1 (void)
+{
+	T0 = T1;
+	RETURN();
+}
+
+void OPPROTO op_swp_T0_T1 (void)
+{
+	T0 ^= T1;
+	T1 ^= T0;
+	T0 ^= T1;
+	RETURN();
+}
+
+void OPPROTO op_movl_T1_T0 (void)
+{
+	T1 = T0;
+	RETURN();
+}
+
+void OPPROTO op_movl_pc_T0 (void)
+{
+	env->pc = T0;
+	RETURN();
+}
+
+void OPPROTO op_movl_T0_0 (void)
+{
+	T0 = 0;
+	RETURN();
+}
+
+void OPPROTO op_addl_T0_T1 (void)
+{
+	T0 += T1;
+	RETURN();
+}
+
+void OPPROTO op_subl_T0_T1 (void)
+{
+	T0 -= T1;
+	RETURN();
+}
+
+void OPPROTO op_absl_T1_T1 (void)
+{
+	int32_t st = T1;
+
+	T1 = st < 0 ? -st : st;
+	RETURN();
+}
+
+void OPPROTO op_muls_T0_T1 (void)
+{
+	int64_t tmp, t0 ,t1;
+
+	/* cast into signed values to make GCC sign extend these babies.  */
+	t0 = (int32_t)T0;
+	t1 = (int32_t)T1;
+
+	tmp = t0 * t1;
+	T0 = tmp & 0xffffffff;
+	env->pregs[REG_MOF] = tmp >> 32;
+	RETURN();
+}
+
+void OPPROTO op_mulu_T0_T1 (void)
+{
+	uint64_t tmp, t0 ,t1;
+	t0 = T0;
+	t1 = T1;
+
+	tmp = t0 * t1;
+	T0 = tmp & 0xffffffff;
+	env->pregs[REG_MOF] = tmp >> 32;
+	RETURN();
+}
+
+void OPPROTO op_dstep_T0_T1 (void)
+{
+	T0 <<= 1;
+	if (T0 >= T1)
+		T0 -= T1;
+	RETURN();
+}
+
+void OPPROTO op_orl_T0_T1 (void)
+{
+	T0 |= T1;
+	RETURN();
+}
+
+void OPPROTO op_andl_T0_T1 (void)
+{
+	T0 &= T1;
+	RETURN();
+}
+
+void OPPROTO op_xorl_T0_T1 (void)
+{
+	T0 ^= T1;
+	RETURN();
+}
+
+void OPPROTO op_lsll_T0_T1 (void)
+{
+	int s = T1;
+	if (s > 31)
+		T0 = 0;
+	else
+		T0 <<= s;
+	RETURN();
+}
+
+void OPPROTO op_lsll_T0_im (void)
+{
+	T0 <<= PARAM1;
+	RETURN();
+}
+
+void OPPROTO op_lsrl_T0_T1 (void)
+{
+	int s = T1;
+	if (s > 31)
+		T0 = 0;
+	else
+		T0 >>= s;
+	RETURN();
+}
+
+/* Rely on GCC emitting an arithmetic shift for signed right shifts.  */
+void OPPROTO op_asrl_T0_T1 (void)
+{
+	int s = T1;
+	if (s > 31)
+		T0 = T0 & 0x80000000 ? -1 : 0;
+	else
+		T0 = (int32_t)T0 >> s;
+	RETURN();
+}
+
+void OPPROTO op_btst_T0_T1 (void)
+{
+	/* FIXME: clean this up.  */
+
+	/* des ref:
+	   The N flag is set according to the selected bit in the dest reg.
+	   The Z flag is set if the selected bit and all bits to the right are
+	   zero.
+	   The destination reg is not affected.*/
+	unsigned int fz, sbit, bset, mask, masked_t0;
+
+	sbit = T1 & 31;
+        bset = !!(T0 & (1 << sbit));
+	mask = sbit == 31 ? -1 : (1 << (sbit + 1)) - 1;
+	masked_t0 = T0 & mask;
+	fz = !(masked_t0 | bset);
+	/* Set the N and Z flags accordingly.  */
+	T0 = (bset << 3) | (fz << 2);
+	RETURN();
+}
+
+void OPPROTO op_bound_T0_T1 (void)
+{
+	if (T0 > T1)
+		T0 = T1;
+	RETURN();
+}
+
+void OPPROTO op_lz_T0_T1 (void)
+{
+	T0 = clz32(T1);
+	RETURN();
+}
+
+void OPPROTO op_negl_T0_T1 (void)
+{
+	T0 = -T1;
+	RETURN();
+}
+
+void OPPROTO op_negl_T1_T1 (void)
+{
+	T1 = -T1;
+	RETURN();
+}
+
+void OPPROTO op_not_T0_T0 (void)
+{
+	T0 = ~(T0);
+	RETURN();
+}
+void OPPROTO op_not_T1_T1 (void)
+{
+	T1 = ~(T1);
+	RETURN();
+}
+
+void OPPROTO op_swapw_T0_T0 (void)
+{
+	T0 = (T0 << 16) | ((T0 >> 16));
+	RETURN();
+}
+
+void OPPROTO op_swapb_T0_T0 (void)
+{
+	T0 = ((T0 << 8) & 0xff00ff00) | ((T0 >> 8) & 0x00ff00ff);
+	RETURN();
+}
+
+void OPPROTO op_swapr_T0_T0 (void)
+{
+	T0 = (((T0 << 7) & 0x80808080) |
+	      ((T0 << 5) & 0x40404040) |
+	      ((T0 << 3) & 0x20202020) |
+	      ((T0 << 1) & 0x10101010) |
+	      ((T0 >> 1) & 0x08080808) |
+	      ((T0 >> 3) & 0x04040404) |
+	      ((T0 >> 5) & 0x02020202) |
+	      ((T0 >> 7) & 0x01010101));
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_eq (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int z_set;
+
+	z_set = !!(flags & Z_FLAG);
+	T0 = z_set;
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_eq_fast (void) {
+	T0 = !(env->cc_result);
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_ne (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int z_set;
+
+	z_set = !!(flags & Z_FLAG);
+	T0 = !z_set;
+	RETURN();
+}
+void OPPROTO op_tst_cc_ne_fast (void) {
+	T0 = !!(env->cc_result);
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_cc (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int c_set;
+
+	c_set = !!(flags & C_FLAG);
+	T0 = !c_set;
+	RETURN();
+}
+void OPPROTO op_tst_cc_cs (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int c_set;
+
+	c_set = !!(flags & C_FLAG);
+	T0 = c_set;
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_vc (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int v_set;
+
+	v_set = !!(flags & V_FLAG);
+	T0 = !v_set;
+	RETURN();
+}
+void OPPROTO op_tst_cc_vs (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int v_set;
+
+	v_set = !!(flags & V_FLAG);
+	T0 = v_set;
+	RETURN();
+}
+void OPPROTO op_tst_cc_pl (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int n_set;
+
+	n_set = !!(flags & N_FLAG);
+	T0 = !n_set;
+	RETURN();
+}
+void OPPROTO op_tst_cc_pl_fast (void) {
+	T0 = ((int32_t)env->cc_result) >= 0;
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_mi (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int n_set;
+
+	n_set = !!(flags & N_FLAG);
+	T0 = n_set;
+	RETURN();
+}
+void OPPROTO op_tst_cc_mi_fast (void) {
+	T0 = ((int32_t)env->cc_result) < 0;
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_ls (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int c_set;
+	int z_set;
+
+	c_set = !!(flags & C_FLAG);
+	z_set = !!(flags & Z_FLAG);
+	T0 = c_set || z_set;
+	RETURN();
+}
+void OPPROTO op_tst_cc_hi (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int z_set;
+	int c_set;
+
+	z_set = !!(flags & Z_FLAG);
+	c_set = !!(flags & C_FLAG);
+	T0 = !c_set && !z_set;
+	RETURN();
+
+}
+
+void OPPROTO op_tst_cc_ge (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int n_set;
+	int v_set;
+
+	n_set = !!(flags & N_FLAG);
+	v_set = !!(flags & V_FLAG);
+	T0 = (n_set && v_set) || (!n_set && !v_set);
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_ge_fast (void) {
+	T0 = ((int32_t)env->cc_src < (int32_t)env->cc_dest);
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_lt (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int n_set;
+	int v_set;
+
+	n_set = !!(flags & N_FLAG);
+	v_set = !!(flags & V_FLAG);
+	T0 = (n_set && !v_set) || (!n_set && v_set);
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_gt (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int n_set;
+	int v_set;
+	int z_set;
+
+	n_set = !!(flags & N_FLAG);
+	v_set = !!(flags & V_FLAG);
+	z_set = !!(flags & Z_FLAG);
+	T0 = (n_set && v_set && !z_set)
+		|| (!n_set && !v_set && !z_set);
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_le (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int n_set;
+	int v_set;
+	int z_set;
+
+	n_set = !!(flags & N_FLAG);
+	v_set = !!(flags & V_FLAG);
+	z_set = !!(flags & Z_FLAG);
+	T0 = z_set || (n_set && !v_set) || (!n_set && v_set);
+	RETURN();
+}
+
+void OPPROTO op_tst_cc_p (void) {
+	uint32_t flags = env->pregs[SR_CCS];
+	int p_set;
+
+	p_set = !!(flags & P_FLAG);
+	T0 = p_set;
+	RETURN();
+}
+
+/* Evaluate the if the branch should be taken or not. Needs to be done in
+   the original sequence. The acutal branch is rescheduled to right after the
+   delay-slot.  */
+void OPPROTO op_evaluate_bcc (void)
+{
+	env->btaken = T0;
+	RETURN();
+}
+
+/* this one is used on every alu op, optimize it!.  */
+void OPPROTO op_goto_if_not_x (void)
+{
+	if (env->pregs[SR_CCS] & X_FLAG)
+		GOTO_LABEL_PARAM(1);
+	RETURN();
+}
+
+void OPPROTO op_cc_jmp (void)
+{
+	if (env->btaken)
+		env->pc = PARAM1;
+	else
+		env->pc = PARAM2;
+	RETURN();
+}
+
+void OPPROTO op_cc_ngoto (void)
+{
+	if (!env->btaken)
+		GOTO_LABEL_PARAM(1);
+	RETURN();
+}
+
+void OPPROTO op_movl_btarget_T0 (void)
+{
+	env->btarget = T0;
+	RETURN();
+}
+
+void OPPROTO op_jmp (void)
+{
+	env->pc = env->btarget;
+	RETURN();
+}
+
+/* Load and store */
+#define MEMSUFFIX _raw
+#include "op_mem.c"
+#undef MEMSUFFIX
+#if !defined(CONFIG_USER_ONLY)
+#define MEMSUFFIX _user
+#include "op_mem.c"
+#undef MEMSUFFIX
+
+#define MEMSUFFIX _kernel
+#include "op_mem.c"
+#undef MEMSUFFIX
+#endif
diff --git a/target-cris/op_helper.c b/target-cris/op_helper.c
new file mode 100644
index 000000000..458b0585d
--- /dev/null
+++ b/target-cris/op_helper.c
@@ -0,0 +1,80 @@
+/*
+ *  CRIS helper routines
+ *
+ *  Copyright (c) 2007 AXIS Communications
+ *  Written by Edgar E. Iglesias
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <assert.h>
+#include "exec.h"
+
+#define MMUSUFFIX _mmu
+#ifdef __s390__
+# define GETPC() ((void*)((unsigned long)__builtin_return_address(0) & 0x7fffffffUL))
+#else
+# define GETPC() (__builtin_return_address(0))
+#endif
+
+#define SHIFT 0
+#include "softmmu_template.h"
+
+#define SHIFT 1
+#include "softmmu_template.h"
+
+#define SHIFT 2
+#include "softmmu_template.h"
+
+#define SHIFT 3
+#include "softmmu_template.h"
+
+/* Try to fill the TLB and return an exception if error. If retaddr is
+   NULL, it means that the function was called in C code (i.e. not
+   from generated code or from helper.c) */
+/* XXX: fix it to restore all registers */
+void tlb_fill (target_ulong addr, int is_write, int mmu_idx, void *retaddr)
+{
+    TranslationBlock *tb;
+    CPUState *saved_env;
+    unsigned long pc;
+    int ret;
+
+    /* XXX: hack to restore env in all cases, even if not called from
+       generated code */
+    saved_env = env;
+    env = cpu_single_env;
+    ret = cpu_cris_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
+    if (__builtin_expect(ret, 0)) {
+        if (retaddr) {
+            /* now we have a real cpu fault */
+            pc = (unsigned long)retaddr;
+            tb = tb_find_pc(pc);
+            if (tb) {
+                /* the PC is inside the translated code. It means that we have
+                   a virtual CPU fault */
+                cpu_restore_state(tb, env, pc, NULL);
+            }
+        }
+        cpu_loop_exit();
+    }
+    env = saved_env;
+}
+
+void do_unassigned_access(target_phys_addr_t addr, int is_write, int is_exec,
+                          int is_asi)
+{
+
+}
diff --git a/target-cris/op_mem.c b/target-cris/op_mem.c
new file mode 100644
index 000000000..50ed10b57
--- /dev/null
+++ b/target-cris/op_mem.c
@@ -0,0 +1,59 @@
+/*
+ *  CRIS memory access (load and store) micro operations.
+ *
+ *  Copyright (c) 2007 Edgar E. Iglesias, Axis Communications AB.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+void glue(op_ldb_T0_T0, MEMSUFFIX) (void) {
+    T0 = glue(ldsb, MEMSUFFIX) (T0);
+    RETURN();
+}
+
+void glue(op_ldub_T0_T0, MEMSUFFIX) (void) {
+    T0 = glue(ldub, MEMSUFFIX) (T0);
+    RETURN();
+}
+
+void glue(op_stb_T0_T1, MEMSUFFIX) (void) {
+    glue(stb, MEMSUFFIX) (T0, T1);
+    RETURN();
+}
+
+void glue(op_ldw_T0_T0, MEMSUFFIX) (void) {
+    T0 = glue(ldsw, MEMSUFFIX) (T0);
+    RETURN();
+}
+
+void glue(op_lduw_T0_T0, MEMSUFFIX) (void) {
+    T0 = glue(lduw, MEMSUFFIX) (T0);
+    RETURN();
+}
+
+void glue(op_stw_T0_T1, MEMSUFFIX) (void) {
+    glue(stw, MEMSUFFIX) (T0, T1);
+    RETURN();
+}
+
+void glue(op_ldl_T0_T0, MEMSUFFIX) (void) {
+    T0 = glue(ldl, MEMSUFFIX) (T0);
+    RETURN();
+}
+
+void glue(op_stl_T0_T1, MEMSUFFIX) (void) {
+    glue(stl, MEMSUFFIX) (T0, T1);
+    RETURN();
+}
diff --git a/target-cris/op_template.h b/target-cris/op_template.h
new file mode 100644
index 000000000..370fbf395
--- /dev/null
+++ b/target-cris/op_template.h
@@ -0,0 +1,48 @@
+/*
+ *  CRIS micro operations (templates for various register related
+ *  operations)
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef SET_REG
+#define SET_REG(x) REG = x
+#endif
+
+void OPPROTO glue(op_movl_T0_, REGNAME)(void)
+{
+    T0 = REG;
+}
+
+void OPPROTO glue(op_movl_T1_, REGNAME)(void)
+{
+    T1 = REG;
+}
+
+void OPPROTO glue(glue(op_movl_, REGNAME), _T0)(void)
+{
+    SET_REG (T0);
+}
+
+void OPPROTO glue(glue(op_movl_, REGNAME), _T1)(void)
+{
+    SET_REG (T1);
+}
+
+#undef REG
+#undef REGNAME
+#undef SET_REG
diff --git a/target-cris/opcode-cris.h b/target-cris/opcode-cris.h
new file mode 100644
index 000000000..76fbc2f3c
--- /dev/null
+++ b/target-cris/opcode-cris.h
@@ -0,0 +1,366 @@
+/* cris.h -- Header file for CRIS opcode and register tables.
+   Copyright (C) 2000, 2001, 2004 Free Software Foundation, Inc.
+   Contributed by Axis Communications AB, Lund, Sweden.
+   Originally written for GAS 1.38.1 by Mikael Asker.
+   Updated, BFDized and GNUified by Hans-Peter Nilsson.
+
+This file is part of GAS, GDB and the GNU binutils.
+
+GAS, GDB, and GNU binutils is free software; you can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation; either version 2, or (at your
+option) any later version.
+
+GAS, GDB, and GNU binutils are distributed in the hope that they will be
+useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA.  */
+
+#ifndef __CRIS_H_INCLUDED_
+#define __CRIS_H_INCLUDED_
+
+#if !defined(__STDC__) && !defined(const)
+#define const
+#endif
+
+
+/* Registers.  */
+#define MAX_REG (15)
+#define REG_SP (14)
+#define REG_PC (15)
+
+/* CPU version control of disassembly and assembly of instructions.
+   May affect how the instruction is assembled, at least the size of
+   immediate operands.  */
+enum cris_insn_version_usage
+{
+  /* Any version.  */
+  cris_ver_version_all=0,
+
+  /* Indeterminate (intended for disassembly only, or obsolete).  */
+  cris_ver_warning,
+
+  /* Only for v0..3 (Etrax 1..4).  */
+  cris_ver_v0_3,
+
+  /* Only for v3 or higher (ETRAX 4 and beyond).  */
+  cris_ver_v3p,
+
+  /* Only for v8 (Etrax 100).  */
+  cris_ver_v8,
+
+  /* Only for v8 or higher (ETRAX 100, ETRAX 100 LX).  */
+  cris_ver_v8p,
+
+  /* Only for v0..10.  FIXME: Not sure what to do with this.  */
+  cris_ver_sim_v0_10,
+
+  /* Only for v0..10.  */
+  cris_ver_v0_10,
+
+  /* Only for v3..10.  (ETRAX 4, ETRAX 100 and ETRAX 100 LX).  */
+  cris_ver_v3_10,
+
+  /* Only for v8..10 (ETRAX 100 and ETRAX 100 LX).  */
+  cris_ver_v8_10,
+
+  /* Only for v10 (ETRAX 100 LX) and same series.  */
+  cris_ver_v10,
+
+  /* Only for v10 (ETRAX 100 LX) and same series.  */
+  cris_ver_v10p,
+
+  /* Only for v32 or higher (codename GUINNESS).
+     Of course some or all these of may change to cris_ver_v32p if/when
+     there's a new revision. */
+  cris_ver_v32p
+};
+
+
+/* Special registers.  */
+struct cris_spec_reg
+{
+  const char *const name;
+  unsigned int number;
+
+  /* The size of the register.  */
+  unsigned int reg_size;
+
+  /* What CPU version the special register of that name is implemented
+     in.  If cris_ver_warning, emit an unimplemented-warning.  */
+  enum cris_insn_version_usage applicable_version;
+
+  /* There might be a specific warning for using a special register
+     here.  */
+  const char *const warning;
+};
+extern const struct cris_spec_reg cris_spec_regs[];
+
+
+/* Support registers (kind of special too, but not named as such).  */
+struct cris_support_reg
+{
+  const char *const name;
+  unsigned int number;
+};
+extern const struct cris_support_reg cris_support_regs[];
+
+struct cris_cond15
+{
+  /* The name of the condition.  */
+  const char *const name;
+
+  /* What CPU version this condition name applies to.  */
+  enum cris_insn_version_usage applicable_version;
+};
+extern const struct cris_cond15 cris_conds15[];
+
+/* Opcode-dependent constants.  */
+#define AUTOINCR_BIT (0x04)
+
+/* Prefixes.  */
+#define BDAP_QUICK_OPCODE (0x0100)
+#define BDAP_QUICK_Z_BITS (0x0e00)
+
+#define BIAP_OPCODE	  (0x0540)
+#define BIAP_Z_BITS	  (0x0a80)
+
+#define DIP_OPCODE	  (0x0970)
+#define DIP_Z_BITS	  (0xf280)
+
+#define BDAP_INDIR_LOW	  (0x40)
+#define BDAP_INDIR_LOW_Z  (0x80)
+#define BDAP_INDIR_HIGH	  (0x09)
+#define BDAP_INDIR_HIGH_Z (0x02)
+
+#define BDAP_INDIR_OPCODE (BDAP_INDIR_HIGH * 0x0100 + BDAP_INDIR_LOW)
+#define BDAP_INDIR_Z_BITS (BDAP_INDIR_HIGH_Z * 0x100 + BDAP_INDIR_LOW_Z)
+#define BDAP_PC_LOW	  (BDAP_INDIR_LOW + REG_PC)
+#define BDAP_INCR_HIGH	  (BDAP_INDIR_HIGH + AUTOINCR_BIT)
+
+/* No prefix must have this code for its "match" bits in the
+   opcode-table.  "BCC .+2" will do nicely.  */
+#define NO_CRIS_PREFIX 0
+
+/* Definitions for condition codes.  */
+#define CC_CC  0x0
+#define CC_HS  0x0
+#define CC_CS  0x1
+#define CC_LO  0x1
+#define CC_NE  0x2
+#define CC_EQ  0x3
+#define CC_VC  0x4
+#define CC_VS  0x5
+#define CC_PL  0x6
+#define CC_MI  0x7
+#define CC_LS  0x8
+#define CC_HI  0x9
+#define CC_GE  0xA
+#define CC_LT  0xB
+#define CC_GT  0xC
+#define CC_LE  0xD
+#define CC_A   0xE
+#define CC_EXT 0xF
+
+/* A table of strings "cc", "cs"... indexed with condition code
+   values as above.  */
+extern const char *const cris_cc_strings[];
+
+/* Bcc quick.  */
+#define BRANCH_QUICK_LOW  (0)
+#define BRANCH_QUICK_HIGH (0)
+#define BRANCH_QUICK_OPCODE (BRANCH_QUICK_HIGH * 0x0100 + BRANCH_QUICK_LOW)
+#define BRANCH_QUICK_Z_BITS (0x0F00)
+
+/* BA quick.  */
+#define BA_QUICK_HIGH (BRANCH_QUICK_HIGH + CC_A * 0x10)
+#define BA_QUICK_OPCODE (BA_QUICK_HIGH * 0x100 + BRANCH_QUICK_LOW)
+
+/* Bcc [PC+].  */
+#define BRANCH_PC_LOW	 (0xFF)
+#define BRANCH_INCR_HIGH (0x0D)
+#define BA_PC_INCR_OPCODE \
+ ((BRANCH_INCR_HIGH + CC_A * 0x10) * 0x0100 + BRANCH_PC_LOW)
+
+/* Jump.  */
+/* Note that old versions generated special register 8 (in high bits)
+   and not-that-old versions recognized it as a jump-instruction.
+   That opcode now belongs to JUMPU.  */
+#define JUMP_INDIR_OPCODE (0x0930)
+#define JUMP_INDIR_Z_BITS (0xf2c0)
+#define JUMP_PC_INCR_OPCODE \
+ (JUMP_INDIR_OPCODE + AUTOINCR_BIT * 0x0100 + REG_PC)
+
+#define MOVE_M_TO_PREG_OPCODE 0x0a30
+#define MOVE_M_TO_PREG_ZBITS 0x01c0
+
+/* BDAP.D N,PC.  */
+#define MOVE_PC_INCR_OPCODE_PREFIX \
+ (((BDAP_INCR_HIGH | (REG_PC << 4)) << 8) | BDAP_PC_LOW | (2 << 4))
+#define MOVE_PC_INCR_OPCODE_SUFFIX \
+ (MOVE_M_TO_PREG_OPCODE | REG_PC | (AUTOINCR_BIT << 8))
+
+#define JUMP_PC_INCR_OPCODE_V32 (0x0DBF)
+
+/* BA DWORD (V32).  */
+#define BA_DWORD_OPCODE (0x0EBF)
+
+/* Nop.  */
+#define NOP_OPCODE (0x050F)
+#define NOP_Z_BITS (0xFFFF ^ NOP_OPCODE)
+
+#define NOP_OPCODE_V32 (0x05B0)
+#define NOP_Z_BITS_V32 (0xFFFF ^ NOP_OPCODE_V32)
+
+/* For the compatibility mode, let's use "MOVE R0,P0".  Doesn't affect
+   registers or flags.  Unfortunately shuts off interrupts for one cycle
+   for < v32, but there doesn't seem to be any alternative without that
+   effect.  */
+#define NOP_OPCODE_COMMON (0x630)
+#define NOP_OPCODE_ZBITS_COMMON (0xffff & ~NOP_OPCODE_COMMON)
+
+/* LAPC.D  */
+#define LAPC_DWORD_OPCODE (0x0D7F)
+#define LAPC_DWORD_Z_BITS (0x0fff & ~LAPC_DWORD_OPCODE)
+
+/* Structure of an opcode table entry.  */
+enum cris_imm_oprnd_size_type
+{
+  /* No size is applicable.  */
+  SIZE_NONE,
+
+  /* Always 32 bits.  */
+  SIZE_FIX_32,
+
+  /* Indicated by size of special register.  */
+  SIZE_SPEC_REG,
+
+  /* Indicated by size field, signed.  */
+  SIZE_FIELD_SIGNED,
+
+  /* Indicated by size field, unsigned.  */
+  SIZE_FIELD_UNSIGNED,
+
+  /* Indicated by size field, no sign implied.  */
+  SIZE_FIELD
+};
+
+/* For GDB.  FIXME: Is this the best way to handle opcode
+   interpretation?  */
+enum cris_op_type
+{
+  cris_not_implemented_op = 0,
+  cris_abs_op,
+  cris_addi_op,
+  cris_asr_op,
+  cris_asrq_op,
+  cris_ax_ei_setf_op,
+  cris_bdap_prefix,
+  cris_biap_prefix,
+  cris_break_op,
+  cris_btst_nop_op,
+  cris_clearf_di_op,
+  cris_dip_prefix,
+  cris_dstep_logshift_mstep_neg_not_op,
+  cris_eight_bit_offset_branch_op,
+  cris_move_mem_to_reg_movem_op,
+  cris_move_reg_to_mem_movem_op,
+  cris_move_to_preg_op,
+  cris_muls_op,
+  cris_mulu_op,
+  cris_none_reg_mode_add_sub_cmp_and_or_move_op,
+  cris_none_reg_mode_clear_test_op,
+  cris_none_reg_mode_jump_op,
+  cris_none_reg_mode_move_from_preg_op,
+  cris_quick_mode_add_sub_op,
+  cris_quick_mode_and_cmp_move_or_op,
+  cris_quick_mode_bdap_prefix,
+  cris_reg_mode_add_sub_cmp_and_or_move_op,
+  cris_reg_mode_clear_op,
+  cris_reg_mode_jump_op,
+  cris_reg_mode_move_from_preg_op,
+  cris_reg_mode_test_op,
+  cris_scc_op,
+  cris_sixteen_bit_offset_branch_op,
+  cris_three_operand_add_sub_cmp_and_or_op,
+  cris_three_operand_bound_op,
+  cris_two_operand_bound_op,
+  cris_xor_op
+};
+
+struct cris_opcode
+{
+  /* The name of the insn.  */
+  const char *name;
+
+  /* Bits that must be 1 for a match.  */
+  unsigned int match;
+
+  /* Bits that must be 0 for a match.  */
+  unsigned int lose;
+
+  /* See the table in "opcodes/cris-opc.c".  */
+  const char *args;
+
+  /* Nonzero if this is a delayed branch instruction.  */
+  char delayed;
+
+  /* Size of immediate operands.  */
+  enum cris_imm_oprnd_size_type imm_oprnd_size;
+
+  /* Indicates which version this insn was first implemented in.  */
+  enum cris_insn_version_usage applicable_version;
+
+  /* What kind of operation this is.  */
+  enum cris_op_type op;
+};
+extern const struct cris_opcode cris_opcodes[];
+
+
+/* These macros are for the target-specific flags in disassemble_info
+   used at disassembly.  */
+
+/* This insn accesses memory.  This flag is more trustworthy than
+   checking insn_type for "dis_dref" which does not work for
+   e.g. "JSR [foo]".  */
+#define CRIS_DIS_FLAG_MEMREF (1 << 0)
+
+/* The "target" field holds a register number.  */
+#define CRIS_DIS_FLAG_MEM_TARGET_IS_REG (1 << 1)
+
+/* The "target2" field holds a register number; add it to "target".  */
+#define CRIS_DIS_FLAG_MEM_TARGET2_IS_REG (1 << 2)
+
+/* Yet another add-on: the register in "target2" must be multiplied
+   by 2 before adding to "target".  */
+#define CRIS_DIS_FLAG_MEM_TARGET2_MULT2 (1 << 3)
+
+/* Yet another add-on: the register in "target2" must be multiplied
+   by 4 (mutually exclusive with .._MULT2).  */
+#define CRIS_DIS_FLAG_MEM_TARGET2_MULT4 (1 << 4)
+
+/* The register in "target2" is an indirect memory reference (of the
+   register there), add to "target".  Assumed size is dword (mutually
+   exclusive with .._MULT[24]).  */
+#define CRIS_DIS_FLAG_MEM_TARGET2_MEM (1 << 5)
+
+/* Add-on to CRIS_DIS_FLAG_MEM_TARGET2_MEM; the memory access is "byte";
+   sign-extended before adding to "target".  */
+#define CRIS_DIS_FLAG_MEM_TARGET2_MEM_BYTE (1 << 6)
+
+/* Add-on to CRIS_DIS_FLAG_MEM_TARGET2_MEM; the memory access is "word";
+   sign-extended before adding to "target".  */
+#define CRIS_DIS_FLAG_MEM_TARGET2_MEM_WORD (1 << 7)
+
+#endif /* __CRIS_H_INCLUDED_ */
+
+/*
+ * Local variables:
+ * eval: (c-set-style "gnu")
+ * indent-tabs-mode: t
+ * End:
+ */
diff --git a/target-cris/translate.c b/target-cris/translate.c
new file mode 100644
index 000000000..44ba804f2
--- /dev/null
+++ b/target-cris/translate.c
@@ -0,0 +1,2507 @@
+/*
+ *  CRIS emulation for qemu: main translation routines.
+ *
+ *  Copyright (c) 2007 AXIS Communications AB
+ *  Written by Edgar E. Iglesias.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/*
+ * This file implements a CRIS decoder-stage in SW. The decoder translates the
+ * guest (CRIS) machine-code into host machine code via dyngen using the
+ * micro-operations described in op.c
+ *
+ * The micro-operations for CRIS translation implement a RISC style ISA.
+ * Note that the micro-operations typically order their operands
+ * starting with the dst. CRIS asm, does the opposite.
+ *
+ * For example the following CRIS code:
+ * add.d [$r0], $r1
+ *
+ * translates into:
+ *
+ * gen_movl_T0_reg(0);   // Fetch $r0 into T0
+ * gen_load_T0_T0();     // Load T0, @T0
+ * gen_movl_reg_T0(1);   // Writeback T0 into $r1
+ *
+ * The actual names for the micro-code generators vary but the example
+ * illustrates the point.
+ */
+
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+#include <assert.h>
+
+#include "cpu.h"
+#include "exec-all.h"
+#include "disas.h"
+#include "crisv32-decode.h"
+
+#define CRIS_STATS 0
+#if CRIS_STATS
+#define STATS(x) x
+#else
+#define STATS(x)
+#endif
+
+#define DISAS_CRIS 0
+#if DISAS_CRIS
+#define DIS(x) x
+#else
+#define DIS(x)
+#endif
+
+#ifdef USE_DIRECT_JUMP
+#define TBPARAM(x)
+#else
+#define TBPARAM(x) (long)(x)
+#endif
+
+#define BUG() (gen_BUG(dc, __FILE__, __LINE__))
+#define BUG_ON(x) ({if (x) BUG();})
+
+/* Used by the decoder.  */
+#define EXTRACT_FIELD(src, start, end) \
+            (((src) >> start) & ((1 << (end - start + 1)) - 1))
+
+#define CC_MASK_NZ 0xc
+#define CC_MASK_NZV 0xe
+#define CC_MASK_NZVC 0xf
+#define CC_MASK_RNZV 0x10e
+
+static uint16_t *gen_opc_ptr;
+static uint32_t *gen_opparam_ptr;
+
+enum {
+#define DEF(s, n, copy_size) INDEX_op_ ## s,
+#include "opc.h"
+#undef DEF
+    NB_OPS,
+};
+#include "gen-op.h"
+
+/* This is the state at translation time.  */
+typedef struct DisasContext {
+	CPUState *env;
+	target_ulong pc, insn_pc;
+
+	/* Decoder.  */
+	uint32_t ir;
+	uint32_t opcode;
+	unsigned int op1;
+	unsigned int op2;
+	unsigned int zsize, zzsize;
+	unsigned int mode;
+	unsigned int postinc;
+
+
+	struct
+	{
+		int op;
+		int size;
+		unsigned int mask;
+	} cc_state[3];
+	int cc_i;
+
+	int update_cc;
+	int cc_op;
+	int cc_size;
+	uint32_t cc_mask;
+	int flags_live;
+	int flagx_live;
+	int flags_x;
+	uint32_t tb_entry_flags;
+
+	int memidx; /* user or kernel mode.  */
+	int is_jmp;
+	int dyn_jmp;
+
+	uint32_t delayed_pc;
+	int delayed_branch;
+	int bcc;
+	uint32_t condlabel;
+
+	struct TranslationBlock *tb;
+	int singlestep_enabled;
+} DisasContext;
+
+void cris_prepare_jmp (DisasContext *dc, uint32_t dst);
+static void gen_BUG(DisasContext *dc, char *file, int line)
+{
+	printf ("BUG: pc=%x %s %d\n", dc->pc, file, line);
+	fprintf (logfile, "BUG: pc=%x %s %d\n", dc->pc, file, line);
+	cpu_dump_state (dc->env, stdout, fprintf, 0);
+	fflush(NULL);
+	cris_prepare_jmp (dc, 0x70000000 + line);
+}
+
+/* Table to generate quick moves from T0 onto any register.  */
+static GenOpFunc *gen_movl_reg_T0[16] =
+{
+	gen_op_movl_r0_T0, gen_op_movl_r1_T0,
+	gen_op_movl_r2_T0, gen_op_movl_r3_T0,
+	gen_op_movl_r4_T0, gen_op_movl_r5_T0,
+	gen_op_movl_r6_T0, gen_op_movl_r7_T0,
+	gen_op_movl_r8_T0, gen_op_movl_r9_T0,
+	gen_op_movl_r10_T0, gen_op_movl_r11_T0,
+	gen_op_movl_r12_T0, gen_op_movl_r13_T0,
+	gen_op_movl_r14_T0, gen_op_movl_r15_T0,
+};
+static GenOpFunc *gen_movl_T0_reg[16] =
+{
+	gen_op_movl_T0_r0, gen_op_movl_T0_r1,
+	gen_op_movl_T0_r2, gen_op_movl_T0_r3,
+	gen_op_movl_T0_r4, gen_op_movl_T0_r5,
+	gen_op_movl_T0_r6, gen_op_movl_T0_r7,
+	gen_op_movl_T0_r8, gen_op_movl_T0_r9,
+	gen_op_movl_T0_r10, gen_op_movl_T0_r11,
+	gen_op_movl_T0_r12, gen_op_movl_T0_r13,
+	gen_op_movl_T0_r14, gen_op_movl_T0_r15,
+};
+
+static void noop_write(void) {
+	/* nop.  */
+}
+
+static void gen_vr_read(void) {
+	gen_op_movl_T0_im(32);
+}
+
+static void gen_ccs_read(void) {
+	gen_op_movl_T0_p13();
+}
+
+static void gen_ccs_write(void) {
+	gen_op_movl_p13_T0();
+}
+
+/* Table to generate quick moves from T0 onto any register.  */
+static GenOpFunc *gen_movl_preg_T0[16] =
+{
+	noop_write,  /* bz, not writeable.  */
+	noop_write,  /* vr, not writeable.  */
+	gen_op_movl_p2_T0, gen_op_movl_p3_T0,
+	noop_write,  /* wz, not writeable.  */
+	gen_op_movl_p5_T0,
+	gen_op_movl_p6_T0, gen_op_movl_p7_T0,
+	noop_write,  /* dz, not writeable.  */
+	gen_op_movl_p9_T0,
+	gen_op_movl_p10_T0, gen_op_movl_p11_T0,
+	gen_op_movl_p12_T0,
+	gen_ccs_write, /* ccs needs special treatment.  */
+	gen_op_movl_p14_T0, gen_op_movl_p15_T0,
+};
+static GenOpFunc *gen_movl_T0_preg[16] =
+{
+	gen_op_movl_T0_p0,
+	gen_vr_read,
+	gen_op_movl_T0_p2, gen_op_movl_T0_p3,
+	gen_op_movl_T0_p4, gen_op_movl_T0_p5,
+	gen_op_movl_T0_p6, gen_op_movl_T0_p7,
+	gen_op_movl_T0_p8, gen_op_movl_T0_p9,
+	gen_op_movl_T0_p10, gen_op_movl_T0_p11,
+	gen_op_movl_T0_p12,
+	gen_ccs_read, /* ccs needs special treatment.  */
+	gen_op_movl_T0_p14, gen_op_movl_T0_p15,
+};
+
+/* We need this table to handle moves with implicit width.  */
+int preg_sizes[] = {
+	1, /* bz.  */
+	1, /* vr.  */
+	4, /* pid.  */
+	1, /* srs.  */
+	2, /* wz.  */
+	4, 4, 4,
+	4, 4, 4, 4,
+	4, 4, 4, 4,
+};
+
+#ifdef CONFIG_USER_ONLY
+#define GEN_OP_LD(width, reg) \
+  void gen_op_ld##width##_T0_##reg (DisasContext *dc) { \
+    gen_op_ld##width##_T0_##reg##_raw(); \
+  }
+#define GEN_OP_ST(width, reg) \
+  void gen_op_st##width##_##reg##_T1 (DisasContext *dc) { \
+    gen_op_st##width##_##reg##_T1_raw(); \
+  }
+#else
+#define GEN_OP_LD(width, reg) \
+  void gen_op_ld##width##_T0_##reg (DisasContext *dc) { \
+    if (dc->memidx) gen_op_ld##width##_T0_##reg##_kernel(); \
+    else gen_op_ld##width##_T0_##reg##_user();\
+  }
+#define GEN_OP_ST(width, reg) \
+  void gen_op_st##width##_##reg##_T1 (DisasContext *dc) { \
+    if (dc->memidx) gen_op_st##width##_##reg##_T1_kernel(); \
+    else gen_op_st##width##_##reg##_T1_user();\
+  }
+#endif
+
+GEN_OP_LD(ub, T0)
+GEN_OP_LD(b, T0)
+GEN_OP_ST(b, T0)
+GEN_OP_LD(uw, T0)
+GEN_OP_LD(w, T0)
+GEN_OP_ST(w, T0)
+GEN_OP_LD(l, T0)
+GEN_OP_ST(l, T0)
+
+static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
+{
+	TranslationBlock *tb;
+	tb = dc->tb;
+	if ((tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK)) {
+		if (n == 0)
+			gen_op_goto_tb0(TBPARAM(tb));
+		else
+			gen_op_goto_tb1(TBPARAM(tb));
+		gen_op_movl_T0_0();
+	} else {
+		gen_op_movl_T0_0();
+	}
+	gen_op_exit_tb();
+}
+
+/* Sign extend at translation time.  */
+static int sign_extend(unsigned int val, unsigned int width)
+{
+	int sval;
+
+	/* LSL.  */
+	val <<= 31 - width;
+	sval = val;
+	/* ASR.  */
+	sval >>= 31 - width;
+	return sval;
+}
+
+static void cris_evaluate_flags(DisasContext *dc)
+{
+	if (!dc->flags_live) {
+
+		switch (dc->cc_op)
+		{
+			case CC_OP_MCP:
+				gen_op_evaluate_flags_mcp ();
+				break;
+			case CC_OP_MULS:
+				gen_op_evaluate_flags_muls ();
+				break;
+			case CC_OP_MULU:
+				gen_op_evaluate_flags_mulu ();
+				break;
+			case CC_OP_MOVE:
+				switch (dc->cc_size)
+				{
+					case 4:
+						gen_op_evaluate_flags_move_4();
+						break;
+					case 2:
+						gen_op_evaluate_flags_move_2();
+						break;
+					default:
+						gen_op_evaluate_flags ();
+						break;
+				}
+				break;
+
+			default:
+			{
+				switch (dc->cc_size)
+				{
+					case 4:
+						gen_op_evaluate_flags_alu_4 ();
+						break;
+					default:
+						gen_op_evaluate_flags ();
+						break;
+				}
+			}
+			break;
+		}
+		dc->flags_live = 1;
+	}
+}
+
+static void cris_cc_mask(DisasContext *dc, unsigned int mask)
+{
+	uint32_t ovl;
+
+	ovl = (dc->cc_mask ^ mask) & ~mask;
+	if (ovl) {
+		/* TODO: optimize this case. It trigs all the time.  */
+		cris_evaluate_flags (dc);
+	}
+	dc->cc_mask = mask;
+
+	dc->update_cc = 1;
+	if (mask == 0)
+		dc->update_cc = 0;
+	else {
+		gen_op_update_cc_mask(mask);
+		dc->flags_live = 0;
+	}
+}
+
+static void cris_update_cc_op(DisasContext *dc, int op)
+{
+	dc->cc_op = op;
+	gen_op_update_cc_op(op);
+	dc->flags_live = 0;
+}
+static void cris_update_cc_size(DisasContext *dc, int size)
+{
+	dc->cc_size = size;
+	gen_op_update_cc_size_im(size);
+}
+
+/* op is the operation.
+   T0, T1 are the operands.
+   dst is the destination reg.
+*/
+static void crisv32_alu_op(DisasContext *dc, int op, int rd, int size)
+{
+	int writeback = 1;
+	if (dc->update_cc) {
+		cris_update_cc_op(dc, op);
+		cris_update_cc_size(dc, size);
+		gen_op_update_cc_x(dc->flagx_live, dc->flags_x);
+		gen_op_update_cc_dest_T0();
+	}
+
+	/* Emit the ALU insns.  */
+	switch (op)
+	{
+		case CC_OP_ADD:
+			gen_op_addl_T0_T1();
+			/* Extended arithmetics.  */
+			if (!dc->flagx_live)
+				gen_op_addxl_T0_C();
+			else if (dc->flags_x)
+				gen_op_addxl_T0_C();
+			break;
+		case CC_OP_ADDC:
+			gen_op_addl_T0_T1();
+			gen_op_addl_T0_C();
+			break;
+		case CC_OP_MCP:
+			gen_op_addl_T0_T1();
+			gen_op_addl_T0_R();
+			break;
+		case CC_OP_SUB:
+			gen_op_negl_T1_T1();
+			gen_op_addl_T0_T1();
+			/* CRIS flag evaluation needs ~src.  */
+			gen_op_negl_T1_T1();
+			gen_op_not_T1_T1();
+
+			/* Extended arithmetics.  */
+			if (!dc->flagx_live)
+				gen_op_subxl_T0_C();
+			else if (dc->flags_x)
+				gen_op_subxl_T0_C();
+			break;
+		case CC_OP_MOVE:
+			gen_op_movl_T0_T1();
+			break;
+		case CC_OP_OR:
+			gen_op_orl_T0_T1();
+			break;
+		case CC_OP_AND:
+			gen_op_andl_T0_T1();
+			break;
+		case CC_OP_XOR:
+			gen_op_xorl_T0_T1();
+			break;
+		case CC_OP_LSL:
+			gen_op_lsll_T0_T1();
+			break;
+		case CC_OP_LSR:
+			gen_op_lsrl_T0_T1();
+			break;
+		case CC_OP_ASR:
+			gen_op_asrl_T0_T1();
+			break;
+		case CC_OP_NEG:
+			gen_op_negl_T0_T1();
+			/* Extended arithmetics.  */
+			gen_op_subxl_T0_C();
+			break;
+		case CC_OP_LZ:
+			gen_op_lz_T0_T1();
+			break;
+		case CC_OP_BTST:
+			gen_op_btst_T0_T1();
+			writeback = 0;
+			break;
+		case CC_OP_MULS:
+			gen_op_muls_T0_T1();
+			break;
+		case CC_OP_MULU:
+			gen_op_mulu_T0_T1();
+			break;
+		case CC_OP_DSTEP:
+			gen_op_dstep_T0_T1();
+			break;
+		case CC_OP_BOUND:
+			gen_op_bound_T0_T1();
+			break;
+		case CC_OP_CMP:
+			gen_op_negl_T1_T1();
+			gen_op_addl_T0_T1();
+			/* CRIS flag evaluation needs ~src.  */
+			gen_op_negl_T1_T1();
+			gen_op_not_T1_T1();
+
+			/* Extended arithmetics.  */
+			gen_op_subxl_T0_C();
+			writeback = 0;
+			break;
+		default:
+			fprintf (logfile, "illegal ALU op.\n");
+			BUG();
+			break;
+	}
+
+	if (dc->update_cc)
+		gen_op_update_cc_src_T1();
+
+	if (size == 1)
+		gen_op_andl_T0_im(0xff);
+	else if (size == 2)
+		gen_op_andl_T0_im(0xffff);
+	/* Writeback.  */
+	if (writeback) {
+		if (size == 4)
+			gen_movl_reg_T0[rd]();
+		else {
+			gen_op_movl_T1_T0();
+			gen_movl_T0_reg[rd]();
+			if (size == 1)
+				gen_op_andl_T0_im(~0xff);
+			else
+				gen_op_andl_T0_im(~0xffff);
+			gen_op_orl_T0_T1();
+			gen_movl_reg_T0[rd]();
+			gen_op_movl_T0_T1();
+		}
+	}
+	if (dc->update_cc)
+		gen_op_update_cc_result_T0();
+
+	{
+		/* TODO: Optimize this.  */
+		if (!dc->flagx_live)
+			cris_evaluate_flags(dc);
+	}
+}
+
+static int arith_cc(DisasContext *dc)
+{
+	if (dc->update_cc) {
+		switch (dc->cc_op) {
+			case CC_OP_ADD: return 1;
+			case CC_OP_SUB: return 1;
+			case CC_OP_LSL: return 1;
+			case CC_OP_LSR: return 1;
+			case CC_OP_ASR: return 1;
+			case CC_OP_CMP: return 1;
+			default:
+				return 0;
+		}
+	}
+	return 0;
+}
+
+static void gen_tst_cc (DisasContext *dc, int cond)
+{
+	int arith_opt;
+
+	/* TODO: optimize more condition codes.  */
+	arith_opt = arith_cc(dc) && !dc->flags_live;
+	switch (cond) {
+		case CC_EQ:
+			if (arith_opt)
+				gen_op_tst_cc_eq_fast ();
+			else {
+				cris_evaluate_flags(dc);
+				gen_op_tst_cc_eq ();
+			}
+			break;
+		case CC_NE:
+			if (arith_opt)
+				gen_op_tst_cc_ne_fast ();
+			else {
+				cris_evaluate_flags(dc);
+				gen_op_tst_cc_ne ();
+			}
+			break;
+		case CC_CS:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_cs ();
+			break;
+		case CC_CC:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_cc ();
+			break;
+		case CC_VS:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_vs ();
+			break;
+		case CC_VC:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_vc ();
+			break;
+		case CC_PL:
+			if (arith_opt)
+				gen_op_tst_cc_pl_fast ();
+			else {
+				cris_evaluate_flags(dc);
+				gen_op_tst_cc_pl ();
+			}
+			break;
+		case CC_MI:
+			if (arith_opt)
+				gen_op_tst_cc_mi_fast ();
+			else {
+				cris_evaluate_flags(dc);
+				gen_op_tst_cc_mi ();
+			}
+			break;
+		case CC_LS:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_ls ();
+			break;
+		case CC_HI:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_hi ();
+			break;
+		case CC_GE:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_ge ();
+			break;
+		case CC_LT:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_lt ();
+			break;
+		case CC_GT:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_gt ();
+			break;
+		case CC_LE:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_le ();
+			break;
+		case CC_P:
+			cris_evaluate_flags(dc);
+			gen_op_tst_cc_p ();
+			break;
+		case CC_A:
+			cris_evaluate_flags(dc);
+			gen_op_movl_T0_im (1);
+			break;
+		default:
+			BUG();
+			break;
+	};
+}
+
+static void cris_prepare_cc_branch (DisasContext *dc, int offset, int cond)
+{
+	/* This helps us re-schedule the micro-code to insns in delay-slots
+	   before the actual jump.  */
+	dc->delayed_branch = 2;
+	dc->delayed_pc = dc->pc + offset;
+	dc->bcc = cond;
+	if (cond != CC_A)
+	{
+		gen_tst_cc (dc, cond);
+		gen_op_evaluate_bcc ();
+	}
+	gen_op_movl_T0_im (dc->delayed_pc);
+	gen_op_movl_btarget_T0 ();
+}
+
+/* Dynamic jumps, when the dest is in a live reg for example.  */
+void cris_prepare_dyn_jmp (DisasContext *dc)
+{
+	/* This helps us re-schedule the micro-code to insns in delay-slots
+	   before the actual jump.  */
+	dc->delayed_branch = 2;
+	dc->dyn_jmp = 1;
+	dc->bcc = CC_A;
+}
+
+void cris_prepare_jmp (DisasContext *dc, uint32_t dst)
+{
+	/* This helps us re-schedule the micro-code to insns in delay-slots
+	   before the actual jump.  */
+	dc->delayed_branch = 2;
+	dc->delayed_pc = dst;
+	dc->dyn_jmp = 0;
+	dc->bcc = CC_A;
+}
+
+void gen_load_T0_T0 (DisasContext *dc, unsigned int size, int sign)
+{
+	if (size == 1) {
+		if (sign)
+			gen_op_ldb_T0_T0(dc);
+		else
+			gen_op_ldub_T0_T0(dc);
+	}
+	else if (size == 2) {
+		if (sign)
+			gen_op_ldw_T0_T0(dc);
+		else
+			gen_op_lduw_T0_T0(dc);
+	}
+	else {
+		gen_op_ldl_T0_T0(dc);
+	}
+}
+
+void gen_store_T0_T1 (DisasContext *dc, unsigned int size)
+{
+	/* Remember, operands are flipped. CRIS has reversed order.  */
+	if (size == 1) {
+		gen_op_stb_T0_T1(dc);
+	}
+	else if (size == 2) {
+		gen_op_stw_T0_T1(dc);
+	}
+	else
+		gen_op_stl_T0_T1(dc);
+}
+
+/* sign extend T1 according to size.  */
+static void gen_sext_T1_T0(int size)
+{
+	if (size == 1)
+		gen_op_extb_T1_T0();
+	else if (size == 2)
+		gen_op_extw_T1_T0();
+}
+
+static void gen_sext_T1_T1(int size)
+{
+	if (size == 1)
+		gen_op_extb_T1_T1();
+	else if (size == 2)
+		gen_op_extw_T1_T1();
+}
+
+static void gen_sext_T0_T0(int size)
+{
+	if (size == 1)
+		gen_op_extb_T0_T0();
+	else if (size == 2)
+		gen_op_extw_T0_T0();
+}
+
+static void gen_zext_T0_T0(int size)
+{
+	if (size == 1)
+		gen_op_zextb_T0_T0();
+	else if (size == 2)
+		gen_op_zextw_T0_T0();
+}
+
+static void gen_zext_T1_T0(int size)
+{
+	if (size == 1)
+		gen_op_zextb_T1_T0();
+	else if (size == 2)
+		gen_op_zextw_T1_T0();
+}
+
+static void gen_zext_T1_T1(int size)
+{
+	if (size == 1)
+		gen_op_zextb_T1_T1();
+	else if (size == 2)
+		gen_op_zextw_T1_T1();
+}
+
+#if DISAS_CRIS
+static char memsize_char(int size)
+{
+	switch (size)
+	{
+		case 1: return 'b';  break;
+		case 2: return 'w';  break;
+		case 4: return 'd';  break;
+		default:
+			return 'x';
+			break;
+	}
+}
+#endif
+
+static unsigned int memsize_z(DisasContext *dc)
+{
+	return dc->zsize + 1;
+}
+
+static unsigned int memsize_zz(DisasContext *dc)
+{
+	switch (dc->zzsize)
+	{
+		case 0: return 1;
+		case 1: return 2;
+		default:
+			return 4;
+	}
+}
+
+static void do_postinc (DisasContext *dc, int size)
+{
+	if (!dc->postinc)
+		return;
+	gen_movl_T0_reg[dc->op1]();
+	gen_op_addl_T0_im(size);
+	gen_movl_reg_T0[dc->op1]();
+}
+
+
+static void dec_prep_move_r(DisasContext *dc, int rs, int rd,
+			    int size, int s_ext)
+{
+	gen_movl_T0_reg[rs]();
+	gen_op_movl_T1_T0();
+	if (s_ext)
+		gen_sext_T1_T1(size);
+	else
+		gen_zext_T1_T1(size);
+}
+
+/* Prepare T0 and T1 for a register alu operation.
+   s_ext decides if the operand1 should be sign-extended or zero-extended when
+   needed.  */
+static void dec_prep_alu_r(DisasContext *dc, int rs, int rd,
+			  int size, int s_ext)
+{
+	dec_prep_move_r(dc, rs, rd, size, s_ext);
+
+	gen_movl_T0_reg[rd]();
+	if (s_ext)
+		gen_sext_T0_T0(size);
+	else
+		gen_zext_T0_T0(size);
+}
+
+/* Prepare T0 and T1 for a memory + alu operation.
+   s_ext decides if the operand1 should be sign-extended or zero-extended when
+   needed.  */
+static int dec_prep_alu_m(DisasContext *dc, int s_ext, int memsize)
+{
+	unsigned int rs, rd;
+	uint32_t imm;
+	int is_imm;
+	int insn_len = 2;
+
+	rs = dc->op1;
+	rd = dc->op2;
+	is_imm = rs == 15 && dc->postinc;
+
+	/* Load [$rs] onto T1.  */
+	if (is_imm) {
+		insn_len = 2 + memsize;
+		if (memsize == 1)
+			insn_len++;
+
+		imm = ldl_code(dc->pc + 2);
+		if (memsize != 4) {
+			if (s_ext) {
+				imm = sign_extend(imm, (memsize * 8) - 1);
+			} else {
+				if (memsize == 1)
+					imm &= 0xff;
+				else
+					imm &= 0xffff;
+			}
+		}
+		DIS(fprintf (logfile, "imm=%x rd=%d sext=%d ms=%d\n",
+			    imm, rd, s_ext, memsize));
+		gen_op_movl_T1_im (imm);
+		dc->postinc = 0;
+	} else {
+		gen_movl_T0_reg[rs]();
+		gen_load_T0_T0(dc, memsize, 0);
+		gen_op_movl_T1_T0();
+		if (s_ext)
+			gen_sext_T1_T1(memsize);
+		else
+			gen_zext_T1_T1(memsize);
+	}
+
+	/* put dest in T0.  */
+	gen_movl_T0_reg[rd]();
+	return insn_len;
+}
+
+#if DISAS_CRIS
+static const char *cc_name(int cc)
+{
+	static char *cc_names[16] = {
+		"cc", "cs", "ne", "eq", "vc", "vs", "pl", "mi",
+		"ls", "hi", "ge", "lt", "gt", "le", "a", "p"
+	};
+	assert(cc < 16);
+	return cc_names[cc];
+}
+#endif
+
+static unsigned int dec_bccq(DisasContext *dc)
+{
+	int32_t offset;
+	int sign;
+	uint32_t cond = dc->op2;
+	int tmp;
+
+	offset = EXTRACT_FIELD (dc->ir, 1, 7);
+	sign = EXTRACT_FIELD(dc->ir, 0, 0);
+
+	offset *= 2;
+	offset |= sign << 8;
+	tmp = offset;
+	offset = sign_extend(offset, 8);
+
+	/* op2 holds the condition-code.  */
+	cris_cc_mask(dc, 0);
+	cris_prepare_cc_branch (dc, offset, cond);
+	return 2;
+}
+static unsigned int dec_addoq(DisasContext *dc)
+{
+	uint32_t imm;
+
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 7);
+	imm = sign_extend(dc->op1, 7);
+
+	DIS(fprintf (logfile, "addoq %d, $r%u\n", imm, dc->op2));
+	cris_cc_mask(dc, 0);
+	/* Fetch register operand,  */
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_im(imm);
+	crisv32_alu_op(dc, CC_OP_ADD, REG_ACR, 4);
+	return 2;
+}
+static unsigned int dec_addq(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "addq %u, $r%u\n", dc->op1, dc->op2));
+
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 5);
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	/* Fetch register operand,  */
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_im(dc->op1);
+	crisv32_alu_op(dc, CC_OP_ADD, dc->op2, 4);
+	return 2;
+}
+static unsigned int dec_moveq(DisasContext *dc)
+{
+	uint32_t imm;
+
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 5);
+	imm = sign_extend(dc->op1, 5);
+	DIS(fprintf (logfile, "moveq %d, $r%u\n", imm, dc->op2));
+
+	cris_cc_mask(dc, 0);
+	gen_op_movl_T1_im(imm);
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op2, 4);
+
+	return 2;
+}
+static unsigned int dec_subq(DisasContext *dc)
+{
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 5);
+
+	DIS(fprintf (logfile, "subq %u, $r%u\n", dc->op1, dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	/* Fetch register operand,  */
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_im(dc->op1);
+	crisv32_alu_op(dc, CC_OP_SUB, dc->op2, 4);
+	return 2;
+}
+static unsigned int dec_cmpq(DisasContext *dc)
+{
+	uint32_t imm;
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 5);
+	imm = sign_extend(dc->op1, 5);
+
+	DIS(fprintf (logfile, "cmpq %d, $r%d\n", imm, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_im(imm);
+	crisv32_alu_op(dc, CC_OP_CMP, dc->op2, 4);
+	return 2;
+}
+static unsigned int dec_andq(DisasContext *dc)
+{
+	uint32_t imm;
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 5);
+	imm = sign_extend(dc->op1, 5);
+
+	DIS(fprintf (logfile, "andq %d, $r%d\n", imm, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_im(imm);
+	crisv32_alu_op(dc, CC_OP_AND, dc->op2, 4);
+	return 2;
+}
+static unsigned int dec_orq(DisasContext *dc)
+{
+	uint32_t imm;
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 5);
+	imm = sign_extend(dc->op1, 5);
+	DIS(fprintf (logfile, "orq %d, $r%d\n", imm, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_im(imm);
+	crisv32_alu_op(dc, CC_OP_OR, dc->op2, 4);
+	return 2;
+}
+static unsigned int dec_btstq(DisasContext *dc)
+{
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 4);
+	DIS(fprintf (logfile, "btstq %u, $r%d\n", dc->op1, dc->op2));
+	cris_evaluate_flags(dc);
+	cris_cc_mask(dc, CC_MASK_NZ);
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_im(dc->op1);
+	crisv32_alu_op(dc, CC_OP_BTST, dc->op2, 4);
+
+	cris_update_cc_op(dc, CC_OP_FLAGS);
+	gen_op_movl_flags_T0();
+	dc->flags_live = 1;
+	return 2;
+}
+static unsigned int dec_asrq(DisasContext *dc)
+{
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 4);
+	DIS(fprintf (logfile, "asrq %u, $r%d\n", dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_im(dc->op1);
+	crisv32_alu_op(dc, CC_OP_ASR, dc->op2, 4);
+	return 2;
+}
+static unsigned int dec_lslq(DisasContext *dc)
+{
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 4);
+	DIS(fprintf (logfile, "lslq %u, $r%d\n", dc->op1, dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_im(dc->op1);
+	crisv32_alu_op(dc, CC_OP_LSL, dc->op2, 4);
+	return 2;
+}
+static unsigned int dec_lsrq(DisasContext *dc)
+{
+	dc->op1 = EXTRACT_FIELD(dc->ir, 0, 4);
+	DIS(fprintf (logfile, "lsrq %u, $r%d\n", dc->op1, dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_im(dc->op1);
+	crisv32_alu_op(dc, CC_OP_LSR, dc->op2, 4);
+	return 2;
+}
+
+static unsigned int dec_move_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+
+	DIS(fprintf (logfile, "move.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_move_r(dc, dc->op1, dc->op2, size, 0);
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op2, size);
+	return 2;
+}
+
+static unsigned int dec_scc_r(DisasContext *dc)
+{
+	int cond = dc->op2;
+
+	DIS(fprintf (logfile, "s%s $r%u\n",
+		    cc_name(cond), dc->op1));
+
+	if (cond != CC_A)
+	{
+		gen_tst_cc (dc, cond);
+		gen_op_movl_T1_T0();
+	}
+	else
+		gen_op_movl_T1_im(1);
+
+	cris_cc_mask(dc, 0);
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op1, 4);
+	return 2;
+}
+
+static unsigned int dec_and_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+
+	DIS(fprintf (logfile, "and.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	crisv32_alu_op(dc, CC_OP_AND, dc->op2, size);
+	return 2;
+}
+
+static unsigned int dec_lz_r(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "lz $r%u, $r%u\n",
+		    dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, 4, 0);
+	crisv32_alu_op(dc, CC_OP_LZ, dc->op2, 4);
+	return 2;
+}
+
+static unsigned int dec_lsl_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+
+	DIS(fprintf (logfile, "lsl.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	gen_op_andl_T1_im(63);
+	crisv32_alu_op(dc, CC_OP_LSL, dc->op2, size);
+	return 2;
+}
+
+static unsigned int dec_lsr_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+
+	DIS(fprintf (logfile, "lsr.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	gen_op_andl_T1_im(63);
+	crisv32_alu_op(dc, CC_OP_LSR, dc->op2, size);
+	return 2;
+}
+
+static unsigned int dec_asr_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+
+	DIS(fprintf (logfile, "asr.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 1);
+	gen_op_andl_T1_im(63);
+	crisv32_alu_op(dc, CC_OP_ASR, dc->op2, size);
+	return 2;
+}
+
+static unsigned int dec_muls_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+
+	DIS(fprintf (logfile, "muls.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZV);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 1);
+	gen_sext_T0_T0(size);
+	crisv32_alu_op(dc, CC_OP_MULS, dc->op2, 4);
+	return 2;
+}
+
+static unsigned int dec_mulu_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+
+	DIS(fprintf (logfile, "mulu.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZV);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	gen_zext_T0_T0(size);
+	crisv32_alu_op(dc, CC_OP_MULU, dc->op2, 4);
+	return 2;
+}
+
+
+static unsigned int dec_dstep_r(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "dstep $r%u, $r%u\n", dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	gen_movl_T0_reg[dc->op1]();
+	gen_op_movl_T1_T0();
+	gen_movl_T0_reg[dc->op2]();
+	crisv32_alu_op(dc, CC_OP_DSTEP, dc->op2, 4);
+	return 2;
+}
+
+static unsigned int dec_xor_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+	DIS(fprintf (logfile, "xor.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	BUG_ON(size != 4); /* xor is dword.  */
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	crisv32_alu_op(dc, CC_OP_XOR, dc->op2, 4);
+	return 2;
+}
+
+static unsigned int dec_bound_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+	DIS(fprintf (logfile, "bound.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	/* TODO: needs optmimization.  */
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	/* rd should be 4.  */
+	gen_movl_T0_reg[dc->op2]();
+	crisv32_alu_op(dc, CC_OP_BOUND, dc->op2, 4);
+	return 2;
+}
+
+static unsigned int dec_cmp_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+	DIS(fprintf (logfile, "cmp.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	crisv32_alu_op(dc, CC_OP_CMP, dc->op2, size);
+	return 2;
+}
+
+static unsigned int dec_abs_r(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "abs $r%u, $r%u\n",
+		    dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_move_r(dc, dc->op1, dc->op2, 4, 0);
+	gen_op_absl_T1_T1();
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op2, 4);
+	return 2;
+}
+
+static unsigned int dec_add_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+	DIS(fprintf (logfile, "add.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	crisv32_alu_op(dc, CC_OP_ADD, dc->op2, size);
+	return 2;
+}
+
+static unsigned int dec_addc_r(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "addc $r%u, $r%u\n",
+		    dc->op1, dc->op2));
+	cris_evaluate_flags(dc);
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, 4, 0);
+	crisv32_alu_op(dc, CC_OP_ADDC, dc->op2, 4);
+	return 2;
+}
+
+static unsigned int dec_mcp_r(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "mcp $p%u, $r%u\n",
+		     dc->op2, dc->op1));
+	cris_evaluate_flags(dc);
+	cris_cc_mask(dc, CC_MASK_RNZV);
+	gen_movl_T0_preg[dc->op2]();
+	gen_op_movl_T1_T0();
+	gen_movl_T0_reg[dc->op1]();
+	crisv32_alu_op(dc, CC_OP_MCP, dc->op1, 4);
+	return 2;
+}
+
+#if DISAS_CRIS
+static char * swapmode_name(int mode, char *modename) {
+	int i = 0;
+	if (mode & 8)
+		modename[i++] = 'n';
+	if (mode & 4)
+		modename[i++] = 'w';
+	if (mode & 2)
+		modename[i++] = 'b';
+	if (mode & 1)
+		modename[i++] = 'r';
+	modename[i++] = 0;
+	return modename;
+}
+#endif
+
+static unsigned int dec_swap_r(DisasContext *dc)
+{
+	DIS(char modename[4]);
+	DIS(fprintf (logfile, "swap%s $r%u\n",
+		     swapmode_name(dc->op2, modename), dc->op1));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	gen_movl_T0_reg[dc->op1]();
+	if (dc->op2 & 8)
+		gen_op_not_T0_T0();
+	if (dc->op2 & 4)
+		gen_op_swapw_T0_T0();
+	if (dc->op2 & 2)
+		gen_op_swapb_T0_T0();
+	if (dc->op2 & 1)
+		gen_op_swapr_T0_T0();
+	gen_op_movl_T1_T0();
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op1, 4);
+	return 2;
+}
+
+static unsigned int dec_or_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+	DIS(fprintf (logfile, "or.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	crisv32_alu_op(dc, CC_OP_OR, dc->op2, size);
+	return 2;
+}
+
+static unsigned int dec_addi_r(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "addi.%c $r%u, $r%u\n",
+		    memsize_char(memsize_zz(dc)), dc->op2, dc->op1));
+	cris_cc_mask(dc, 0);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, 4, 0);
+	gen_op_lsll_T0_im(dc->zzsize);
+	gen_op_addl_T0_T1();
+	gen_movl_reg_T0[dc->op1]();
+	return 2;
+}
+
+static unsigned int dec_addi_acr(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "addi.%c $r%u, $r%u, $acr\n",
+		    memsize_char(memsize_zz(dc)), dc->op2, dc->op1));
+	cris_cc_mask(dc, 0);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, 4, 0);
+	gen_op_lsll_T0_im(dc->zzsize);
+	gen_op_addl_T0_T1();
+	gen_movl_reg_T0[REG_ACR]();
+	return 2;
+}
+
+static unsigned int dec_neg_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+	DIS(fprintf (logfile, "neg.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	crisv32_alu_op(dc, CC_OP_NEG, dc->op2, size);
+	return 2;
+}
+
+static unsigned int dec_btst_r(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "btst $r%u, $r%u\n",
+		    dc->op1, dc->op2));
+	cris_evaluate_flags(dc);
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, 4, 0);
+	crisv32_alu_op(dc, CC_OP_BTST, dc->op2, 4);
+
+	cris_update_cc_op(dc, CC_OP_FLAGS);
+	gen_op_movl_flags_T0();
+	dc->flags_live = 1;
+	return 2;
+}
+
+static unsigned int dec_sub_r(DisasContext *dc)
+{
+	int size = memsize_zz(dc);
+	DIS(fprintf (logfile, "sub.%c $r%u, $r%u\n",
+		    memsize_char(size), dc->op1, dc->op2));
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	dec_prep_alu_r(dc, dc->op1, dc->op2, size, 0);
+	crisv32_alu_op(dc, CC_OP_SUB, dc->op2, size);
+	return 2;
+}
+
+/* Zero extension. From size to dword.  */
+static unsigned int dec_movu_r(DisasContext *dc)
+{
+	int size = memsize_z(dc);
+	DIS(fprintf (logfile, "movu.%c $r%u, $r%u\n",
+		    memsize_char(size),
+		    dc->op1, dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	dec_prep_move_r(dc, dc->op1, dc->op2, size, 0);
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op2, 4);
+	return 2;
+}
+
+/* Sign extension. From size to dword.  */
+static unsigned int dec_movs_r(DisasContext *dc)
+{
+	int size = memsize_z(dc);
+	DIS(fprintf (logfile, "movs.%c $r%u, $r%u\n",
+		    memsize_char(size),
+		    dc->op1, dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	gen_movl_T0_reg[dc->op1]();
+	/* Size can only be qi or hi.  */
+	gen_sext_T1_T0(size);
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op2, 4);
+	return 2;
+}
+
+/* zero extension. From size to dword.  */
+static unsigned int dec_addu_r(DisasContext *dc)
+{
+	int size = memsize_z(dc);
+	DIS(fprintf (logfile, "addu.%c $r%u, $r%u\n",
+		    memsize_char(size),
+		    dc->op1, dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	gen_movl_T0_reg[dc->op1]();
+	/* Size can only be qi or hi.  */
+	gen_zext_T1_T0(size);
+	gen_movl_T0_reg[dc->op2]();
+	crisv32_alu_op(dc, CC_OP_ADD, dc->op2, 4);
+	return 2;
+}
+/* Sign extension. From size to dword.  */
+static unsigned int dec_adds_r(DisasContext *dc)
+{
+	int size = memsize_z(dc);
+	DIS(fprintf (logfile, "adds.%c $r%u, $r%u\n",
+		    memsize_char(size),
+		    dc->op1, dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	gen_movl_T0_reg[dc->op1]();
+	/* Size can only be qi or hi.  */
+	gen_sext_T1_T0(size);
+	gen_movl_T0_reg[dc->op2]();
+	crisv32_alu_op(dc, CC_OP_ADD, dc->op2, 4);
+	return 2;
+}
+
+/* Zero extension. From size to dword.  */
+static unsigned int dec_subu_r(DisasContext *dc)
+{
+	int size = memsize_z(dc);
+	DIS(fprintf (logfile, "subu.%c $r%u, $r%u\n",
+		    memsize_char(size),
+		    dc->op1, dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	gen_movl_T0_reg[dc->op1]();
+	/* Size can only be qi or hi.  */
+	gen_zext_T1_T0(size);
+	gen_movl_T0_reg[dc->op2]();
+	crisv32_alu_op(dc, CC_OP_SUB, dc->op2, 4);
+	return 2;
+}
+
+/* Sign extension. From size to dword.  */
+static unsigned int dec_subs_r(DisasContext *dc)
+{
+	int size = memsize_z(dc);
+	DIS(fprintf (logfile, "subs.%c $r%u, $r%u\n",
+		    memsize_char(size),
+		    dc->op1, dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	gen_movl_T0_reg[dc->op1]();
+	/* Size can only be qi or hi.  */
+	gen_sext_T1_T0(size);
+	gen_movl_T0_reg[dc->op2]();
+	crisv32_alu_op(dc, CC_OP_SUB, dc->op2, 4);
+	return 2;
+}
+
+static unsigned int dec_setclrf(DisasContext *dc)
+{
+	uint32_t flags;
+	int set = (~dc->opcode >> 2) & 1;
+
+	flags = (EXTRACT_FIELD(dc->ir, 12, 15) << 4)
+		| EXTRACT_FIELD(dc->ir, 0, 3);
+	DIS(fprintf (logfile, "set=%d flags=%x\n", set, flags));
+	if (set && flags == 0)
+		DIS(fprintf (logfile, "nop\n"));
+	else if (!set && (flags & 0x20))
+		DIS(fprintf (logfile, "di\n"));
+	else
+		DIS(fprintf (logfile, "%sf %x\n",
+			    set ? "set" : "clr",
+			    flags));
+
+	if (set && (flags & X_FLAG)) {
+		dc->flagx_live = 1;
+		dc->flags_x = 1;
+	}
+
+	/* Simply decode the flags.  */
+	cris_evaluate_flags (dc);
+	cris_update_cc_op(dc, CC_OP_FLAGS);
+	if (set)
+		gen_op_setf (flags);
+	else
+		gen_op_clrf (flags);
+	dc->flags_live = 1;
+	return 2;
+}
+
+static unsigned int dec_move_rs(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "move $r%u, $s%u\n", dc->op1, dc->op2));
+	cris_cc_mask(dc, 0);
+	gen_movl_T0_reg[dc->op1]();
+	gen_op_movl_sreg_T0(dc->op2);
+
+	if (dc->op2 == 5) /* srs is checked at runtime.  */
+		gen_op_movl_tlb_lo_T0();
+	return 2;
+}
+static unsigned int dec_move_sr(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "move $s%u, $r%u\n", dc->op1, dc->op2));
+	cris_cc_mask(dc, 0);
+	gen_op_movl_T0_sreg(dc->op1);
+	gen_op_movl_T1_T0();
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op2, 4);
+	return 2;
+}
+static unsigned int dec_move_rp(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "move $r%u, $p%u\n", dc->op1, dc->op2));
+	cris_cc_mask(dc, 0);
+	gen_movl_T0_reg[dc->op1]();
+	gen_op_movl_T1_T0();
+	gen_movl_preg_T0[dc->op2]();
+	return 2;
+}
+static unsigned int dec_move_pr(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "move $p%u, $r%u\n", dc->op1, dc->op2));
+	cris_cc_mask(dc, 0);
+	gen_movl_T0_preg[dc->op2]();
+	gen_op_movl_T1_T0();
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op1, preg_sizes[dc->op2]);
+	return 2;
+}
+
+static unsigned int dec_move_mr(DisasContext *dc)
+{
+	int memsize = memsize_zz(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "move.%c [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op2, memsize);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_movs_m(DisasContext *dc)
+{
+	int memsize = memsize_z(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "movs.%c [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	/* sign extend.  */
+	cris_cc_mask(dc, CC_MASK_NZ);
+	insn_len = dec_prep_alu_m(dc, 1, memsize);
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op2, 4);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_addu_m(DisasContext *dc)
+{
+	int memsize = memsize_z(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "addu.%c [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	/* sign extend.  */
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_ADD, dc->op2, 4);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_adds_m(DisasContext *dc)
+{
+	int memsize = memsize_z(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "adds.%c [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	/* sign extend.  */
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	insn_len = dec_prep_alu_m(dc, 1, memsize);
+	crisv32_alu_op(dc, CC_OP_ADD, dc->op2, 4);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_subu_m(DisasContext *dc)
+{
+	int memsize = memsize_z(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "subu.%c [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	/* sign extend.  */
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_SUB, dc->op2, 4);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_subs_m(DisasContext *dc)
+{
+	int memsize = memsize_z(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "subs.%c [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	/* sign extend.  */
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	insn_len = dec_prep_alu_m(dc, 1, memsize);
+	crisv32_alu_op(dc, CC_OP_SUB, dc->op2, 4);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_movu_m(DisasContext *dc)
+{
+	int memsize = memsize_z(dc);
+	int insn_len;
+
+	DIS(fprintf (logfile, "movu.%c [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op2, 4);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_cmpu_m(DisasContext *dc)
+{
+	int memsize = memsize_z(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "cmpu.%c [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_CMP, dc->op2, 4);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_cmps_m(DisasContext *dc)
+{
+	int memsize = memsize_z(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "cmps.%c [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	insn_len = dec_prep_alu_m(dc, 1, memsize);
+	crisv32_alu_op(dc, CC_OP_CMP, dc->op2, memsize_zz(dc));
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_cmp_m(DisasContext *dc)
+{
+	int memsize = memsize_zz(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "cmp.%c [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_CMP, dc->op2, memsize_zz(dc));
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_test_m(DisasContext *dc)
+{
+	int memsize = memsize_zz(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "test.%d [$r%u%s] op2=%x\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	gen_op_clrf(3);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	gen_op_swp_T0_T1();
+	gen_op_movl_T1_im(0);
+	crisv32_alu_op(dc, CC_OP_CMP, dc->op2, memsize_zz(dc));
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_and_m(DisasContext *dc)
+{
+	int memsize = memsize_zz(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "and.%d [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_AND, dc->op2, memsize_zz(dc));
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_add_m(DisasContext *dc)
+{
+	int memsize = memsize_zz(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "add.%d [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_ADD, dc->op2, memsize_zz(dc));
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_addo_m(DisasContext *dc)
+{
+	int memsize = memsize_zz(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "add.%d [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, 0);
+	insn_len = dec_prep_alu_m(dc, 1, memsize);
+	crisv32_alu_op(dc, CC_OP_ADD, REG_ACR, 4);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_bound_m(DisasContext *dc)
+{
+	int memsize = memsize_zz(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "bound.%d [$r%u%s, $r%u\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_BOUND, dc->op2, 4);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_addc_mr(DisasContext *dc)
+{
+	int insn_len = 2;
+	DIS(fprintf (logfile, "addc [$r%u%s, $r%u\n",
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_evaluate_flags(dc);
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	insn_len = dec_prep_alu_m(dc, 0, 4);
+	crisv32_alu_op(dc, CC_OP_ADDC, dc->op2, 4);
+	do_postinc(dc, 4);
+	return insn_len;
+}
+
+static unsigned int dec_sub_m(DisasContext *dc)
+{
+	int memsize = memsize_zz(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "sub.%c [$r%u%s, $r%u ir=%x zz=%x\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2, dc->ir, dc->zzsize));
+
+	cris_cc_mask(dc, CC_MASK_NZVC);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_SUB, dc->op2, memsize);
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_or_m(DisasContext *dc)
+{
+	int memsize = memsize_zz(dc);
+	int insn_len;
+	DIS(fprintf (logfile, "or.%d [$r%u%s, $r%u pc=%x\n",
+		    memsize_char(memsize),
+		    dc->op1, dc->postinc ? "+]" : "]",
+		    dc->op2, dc->pc));
+
+	cris_cc_mask(dc, CC_MASK_NZ);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	crisv32_alu_op(dc, CC_OP_OR, dc->op2, memsize_zz(dc));
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_move_mp(DisasContext *dc)
+{
+	int memsize = memsize_zz(dc);
+	int insn_len = 2;
+
+	DIS(fprintf (logfile, "move.%c [$r%u%s, $p%u\n",
+		    memsize_char(memsize),
+		    dc->op1,
+		    dc->postinc ? "+]" : "]",
+		    dc->op2));
+
+	cris_cc_mask(dc, 0);
+	insn_len = dec_prep_alu_m(dc, 0, memsize);
+	gen_op_movl_T0_T1();
+	gen_movl_preg_T0[dc->op2]();
+
+	do_postinc(dc, memsize);
+	return insn_len;
+}
+
+static unsigned int dec_move_pm(DisasContext *dc)
+{
+	int memsize;
+
+	memsize = preg_sizes[dc->op2];
+
+	DIS(fprintf (logfile, "move.%d $p%u, [$r%u%s\n",
+		     memsize, dc->op2, dc->op1, dc->postinc ? "+]" : "]"));
+
+	cris_cc_mask(dc, 0);
+	/* prepare store.  */
+	gen_movl_T0_preg[dc->op2]();
+	gen_op_movl_T1_T0();
+	gen_movl_T0_reg[dc->op1]();
+	gen_store_T0_T1(dc, memsize);
+	if (dc->postinc)
+	{
+		gen_op_addl_T0_im(memsize);
+		gen_movl_reg_T0[dc->op1]();
+	}
+	return 2;
+}
+
+static unsigned int dec_movem_mr(DisasContext *dc)
+{
+	int i;
+
+	DIS(fprintf (logfile, "movem [$r%u%s, $r%u\n", dc->op1,
+		    dc->postinc ? "+]" : "]", dc->op2));
+
+	cris_cc_mask(dc, 0);
+	/* fetch the address into T1.  */
+	gen_movl_T0_reg[dc->op1]();
+	gen_op_movl_T1_T0();
+	for (i = 0; i <= dc->op2; i++) {
+		/* Perform the load onto regnum i. Always dword wide.  */
+		gen_load_T0_T0(dc, 4, 0);
+		gen_movl_reg_T0[i]();
+		/* Update the address.  */
+		gen_op_addl_T1_im(4);
+		gen_op_movl_T0_T1();
+	}
+	if (dc->postinc) {
+		/* writeback the updated pointer value.  */
+		gen_movl_reg_T0[dc->op1]();
+	}
+	return 2;
+}
+
+static unsigned int dec_movem_rm(DisasContext *dc)
+{
+	int i;
+
+	DIS(fprintf (logfile, "movem $r%u, [$r%u%s\n", dc->op2, dc->op1,
+		     dc->postinc ? "+]" : "]"));
+
+	cris_cc_mask(dc, 0);
+	for (i = 0; i <= dc->op2; i++) {
+		/* Fetch register i into T1.  */
+		gen_movl_T0_reg[i]();
+		gen_op_movl_T1_T0();
+
+		/* Fetch the address into T0.  */
+		gen_movl_T0_reg[dc->op1]();
+		/* Displace it.  */
+		gen_op_addl_T0_im(i * 4);
+
+		/* Perform the store.  */
+		gen_store_T0_T1(dc, 4);
+	}
+	if (dc->postinc) {
+		/* Update the address.  */
+		gen_op_addl_T0_im(4);
+		/* writeback the updated pointer value.  */
+		gen_movl_reg_T0[dc->op1]();
+	}
+	return 2;
+}
+
+static unsigned int dec_move_rm(DisasContext *dc)
+{
+	int memsize;
+
+	memsize = memsize_zz(dc);
+
+	DIS(fprintf (logfile, "move.%d $r%u, [$r%u]\n",
+		     memsize, dc->op2, dc->op1));
+
+	cris_cc_mask(dc, 0);
+	/* prepare store.  */
+	gen_movl_T0_reg[dc->op2]();
+	gen_op_movl_T1_T0();
+	gen_movl_T0_reg[dc->op1]();
+	gen_store_T0_T1(dc, memsize);
+	if (dc->postinc)
+	{
+		gen_op_addl_T0_im(memsize);
+		gen_movl_reg_T0[dc->op1]();
+	}
+	return 2;
+}
+
+
+static unsigned int dec_lapcq(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "lapcq %x, $r%u\n",
+		    dc->pc + dc->op1*2, dc->op2));
+	cris_cc_mask(dc, 0);
+	gen_op_movl_T1_im(dc->pc + dc->op1*2);
+	crisv32_alu_op(dc, CC_OP_MOVE, dc->op2, 4);
+	return 2;
+}
+
+static unsigned int dec_lapc_im(DisasContext *dc)
+{
+	unsigned int rd;
+	int32_t imm;
+	int insn_len = 6;
+
+	rd = dc->op2;
+
+	cris_cc_mask(dc, 0);
+	imm = ldl_code(dc->pc + 2);
+	DIS(fprintf (logfile, "lapc 0x%x, $r%u\n", imm + dc->pc, dc->op2));
+	gen_op_movl_T0_im (dc->pc + imm);
+	gen_movl_reg_T0[rd] ();
+	return insn_len;
+}
+
+/* Jump to special reg.  */
+static unsigned int dec_jump_p(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "jump $p%u\n", dc->op2));
+	cris_cc_mask(dc, 0);
+	/* Store the return address in Pd.  */
+	gen_movl_T0_preg[dc->op2]();
+	gen_op_movl_btarget_T0();
+	cris_prepare_dyn_jmp(dc);
+	return 2;
+}
+
+/* Jump and save.  */
+static unsigned int dec_jas_r(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "jas $r%u, $p%u\n", dc->op1, dc->op2));
+	cris_cc_mask(dc, 0);
+	/* Stor the return address in Pd.  */
+	gen_movl_T0_reg[dc->op1]();
+	gen_op_movl_btarget_T0();
+	gen_op_movl_T0_im(dc->pc + 4);
+	gen_movl_preg_T0[dc->op2]();
+	cris_prepare_dyn_jmp(dc);
+	return 2;
+}
+
+static unsigned int dec_jas_im(DisasContext *dc)
+{
+	uint32_t imm;
+
+	imm = ldl_code(dc->pc + 2);
+
+	DIS(fprintf (logfile, "jas 0x%x\n", imm));
+	cris_cc_mask(dc, 0);
+	/* Stor the return address in Pd.  */
+	gen_op_movl_T0_im(imm);
+	gen_op_movl_btarget_T0();
+	gen_op_movl_T0_im(dc->pc + 8);
+	gen_movl_preg_T0[dc->op2]();
+	cris_prepare_dyn_jmp(dc);
+	return 6;
+}
+
+static unsigned int dec_jasc_im(DisasContext *dc)
+{
+	uint32_t imm;
+
+	imm = ldl_code(dc->pc + 2);
+
+	DIS(fprintf (logfile, "jasc 0x%x\n", imm));
+	cris_cc_mask(dc, 0);
+	/* Stor the return address in Pd.  */
+	gen_op_movl_T0_im(imm);
+	gen_op_movl_btarget_T0();
+	gen_op_movl_T0_im(dc->pc + 8 + 4);
+	gen_movl_preg_T0[dc->op2]();
+	cris_prepare_dyn_jmp(dc);
+	return 6;
+}
+
+static unsigned int dec_jasc_r(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "jasc_r $r%u, $p%u\n", dc->op1, dc->op2));
+	cris_cc_mask(dc, 0);
+	/* Stor the return address in Pd.  */
+	gen_movl_T0_reg[dc->op1]();
+	gen_op_movl_btarget_T0();
+	gen_op_movl_T0_im(dc->pc + 4 + 4);
+	gen_movl_preg_T0[dc->op2]();
+	cris_prepare_dyn_jmp(dc);
+	return 2;
+}
+
+static unsigned int dec_bcc_im(DisasContext *dc)
+{
+	int32_t offset;
+	uint32_t cond = dc->op2;
+
+	offset = ldl_code(dc->pc + 2);
+	offset = sign_extend(offset, 15);
+
+	DIS(fprintf (logfile, "b%s %d pc=%x dst=%x\n",
+		    cc_name(cond), offset,
+		    dc->pc, dc->pc + offset));
+
+	cris_cc_mask(dc, 0);
+	/* op2 holds the condition-code.  */
+	cris_prepare_cc_branch (dc, offset, cond);
+	return 4;
+}
+
+static unsigned int dec_bas_im(DisasContext *dc)
+{
+	int32_t simm;
+
+
+	simm = ldl_code(dc->pc + 2);
+
+	DIS(fprintf (logfile, "bas 0x%x, $p%u\n", dc->pc + simm, dc->op2));
+	cris_cc_mask(dc, 0);
+	/* Stor the return address in Pd.  */
+	gen_op_movl_T0_im(dc->pc + simm);
+	gen_op_movl_btarget_T0();
+	gen_op_movl_T0_im(dc->pc + 8);
+	gen_movl_preg_T0[dc->op2]();
+	cris_prepare_dyn_jmp(dc);
+	return 6;
+}
+
+static unsigned int dec_basc_im(DisasContext *dc)
+{
+	int32_t simm;
+	simm = ldl_code(dc->pc + 2);
+
+	DIS(fprintf (logfile, "basc 0x%x, $p%u\n", dc->pc + simm, dc->op2));
+	cris_cc_mask(dc, 0);
+	/* Stor the return address in Pd.  */
+	gen_op_movl_T0_im(dc->pc + simm);
+	gen_op_movl_btarget_T0();
+	gen_op_movl_T0_im(dc->pc + 12);
+	gen_movl_preg_T0[dc->op2]();
+	cris_prepare_dyn_jmp(dc);
+	return 6;
+}
+
+static unsigned int dec_rfe_etc(DisasContext *dc)
+{
+	DIS(fprintf (logfile, "rfe_etc opc=%x pc=0x%x op1=%d op2=%d\n",
+		    dc->opcode, dc->pc, dc->op1, dc->op2));
+
+	cris_cc_mask(dc, 0);
+
+	if (dc->op2 == 15) /* ignore halt.  */
+		goto done;
+
+	switch (dc->op2 & 7) {
+		case 2:
+			/* rfe.  */
+			cris_evaluate_flags(dc);
+			gen_op_ccs_rshift();
+			break;
+		case 5:
+			/* rfn.  */
+			BUG();
+			break;
+		case 6:
+			/* break.  */
+			gen_op_movl_T0_im(dc->pc);
+			gen_op_movl_pc_T0();
+			/* Breaks start at 16 in the exception vector.  */
+			gen_op_break_im(dc->op1 + 16);
+			break;
+		default:
+			printf ("op2=%x\n", dc->op2);
+			BUG();
+			break;
+
+	}
+  done:
+	return 2;
+}
+
+static unsigned int dec_null(DisasContext *dc)
+{
+	printf ("unknown insn pc=%x opc=%x op1=%x op2=%x\n",
+		dc->pc, dc->opcode, dc->op1, dc->op2);
+	fflush(NULL);
+	BUG();
+	return 2;
+}
+
+struct decoder_info {
+	struct {
+		uint32_t bits;
+		uint32_t mask;
+	};
+	unsigned int (*dec)(DisasContext *dc);
+} decinfo[] = {
+	/* Order matters here.  */
+	{DEC_MOVEQ, dec_moveq},
+	{DEC_BTSTQ, dec_btstq},
+	{DEC_CMPQ, dec_cmpq},
+	{DEC_ADDOQ, dec_addoq},
+	{DEC_ADDQ, dec_addq},
+	{DEC_SUBQ, dec_subq},
+	{DEC_ANDQ, dec_andq},
+	{DEC_ORQ, dec_orq},
+	{DEC_ASRQ, dec_asrq},
+	{DEC_LSLQ, dec_lslq},
+	{DEC_LSRQ, dec_lsrq},
+	{DEC_BCCQ, dec_bccq},
+
+	{DEC_BCC_IM, dec_bcc_im},
+	{DEC_JAS_IM, dec_jas_im},
+	{DEC_JAS_R, dec_jas_r},
+	{DEC_JASC_IM, dec_jasc_im},
+	{DEC_JASC_R, dec_jasc_r},
+	{DEC_BAS_IM, dec_bas_im},
+	{DEC_BASC_IM, dec_basc_im},
+	{DEC_JUMP_P, dec_jump_p},
+	{DEC_LAPC_IM, dec_lapc_im},
+	{DEC_LAPCQ, dec_lapcq},
+
+	{DEC_RFE_ETC, dec_rfe_etc},
+	{DEC_ADDC_MR, dec_addc_mr},
+
+	{DEC_MOVE_MP, dec_move_mp},
+	{DEC_MOVE_PM, dec_move_pm},
+	{DEC_MOVEM_MR, dec_movem_mr},
+	{DEC_MOVEM_RM, dec_movem_rm},
+	{DEC_MOVE_PR, dec_move_pr},
+	{DEC_SCC_R, dec_scc_r},
+	{DEC_SETF, dec_setclrf},
+	{DEC_CLEARF, dec_setclrf},
+
+	{DEC_MOVE_SR, dec_move_sr},
+	{DEC_MOVE_RP, dec_move_rp},
+	{DEC_SWAP_R, dec_swap_r},
+	{DEC_ABS_R, dec_abs_r},
+	{DEC_LZ_R, dec_lz_r},
+	{DEC_MOVE_RS, dec_move_rs},
+	{DEC_BTST_R, dec_btst_r},
+	{DEC_ADDC_R, dec_addc_r},
+
+	{DEC_DSTEP_R, dec_dstep_r},
+	{DEC_XOR_R, dec_xor_r},
+	{DEC_MCP_R, dec_mcp_r},
+	{DEC_CMP_R, dec_cmp_r},
+
+	{DEC_ADDI_R, dec_addi_r},
+	{DEC_ADDI_ACR, dec_addi_acr},
+
+	{DEC_ADD_R, dec_add_r},
+	{DEC_SUB_R, dec_sub_r},
+
+	{DEC_ADDU_R, dec_addu_r},
+	{DEC_ADDS_R, dec_adds_r},
+	{DEC_SUBU_R, dec_subu_r},
+	{DEC_SUBS_R, dec_subs_r},
+	{DEC_LSL_R, dec_lsl_r},
+
+	{DEC_AND_R, dec_and_r},
+	{DEC_OR_R, dec_or_r},
+	{DEC_BOUND_R, dec_bound_r},
+	{DEC_ASR_R, dec_asr_r},
+	{DEC_LSR_R, dec_lsr_r},
+
+	{DEC_MOVU_R, dec_movu_r},
+	{DEC_MOVS_R, dec_movs_r},
+	{DEC_NEG_R, dec_neg_r},
+	{DEC_MOVE_R, dec_move_r},
+
+	/* ftag_fidx_i_m.  */
+	/* ftag_fidx_d_m.  */
+
+	{DEC_MULS_R, dec_muls_r},
+	{DEC_MULU_R, dec_mulu_r},
+
+	{DEC_ADDU_M, dec_addu_m},
+	{DEC_ADDS_M, dec_adds_m},
+	{DEC_SUBU_M, dec_subu_m},
+	{DEC_SUBS_M, dec_subs_m},
+
+	{DEC_CMPU_M, dec_cmpu_m},
+	{DEC_CMPS_M, dec_cmps_m},
+	{DEC_MOVU_M, dec_movu_m},
+	{DEC_MOVS_M, dec_movs_m},
+
+	{DEC_CMP_M, dec_cmp_m},
+	{DEC_ADDO_M, dec_addo_m},
+	{DEC_BOUND_M, dec_bound_m},
+	{DEC_ADD_M, dec_add_m},
+	{DEC_SUB_M, dec_sub_m},
+	{DEC_AND_M, dec_and_m},
+	{DEC_OR_M, dec_or_m},
+	{DEC_MOVE_RM, dec_move_rm},
+	{DEC_TEST_M, dec_test_m},
+	{DEC_MOVE_MR, dec_move_mr},
+
+	{{0, 0}, dec_null}
+};
+
+static inline unsigned int
+cris_decoder(DisasContext *dc)
+{
+	unsigned int insn_len = 2;
+	uint32_t tmp;
+	int i;
+
+	/* Load a halfword onto the instruction register.  */
+	tmp = ldl_code(dc->pc);
+	dc->ir = tmp & 0xffff;
+
+	/* Now decode it.  */
+	dc->opcode   = EXTRACT_FIELD(dc->ir, 4, 11);
+	dc->op1      = EXTRACT_FIELD(dc->ir, 0, 3);
+	dc->op2      = EXTRACT_FIELD(dc->ir, 12, 15);
+	dc->zsize    = EXTRACT_FIELD(dc->ir, 4, 4);
+	dc->zzsize   = EXTRACT_FIELD(dc->ir, 4, 5);
+	dc->postinc  = EXTRACT_FIELD(dc->ir, 10, 10);
+
+	/* Large switch for all insns.  */
+	for (i = 0; i < sizeof decinfo / sizeof decinfo[0]; i++) {
+		if ((dc->opcode & decinfo[i].mask) == decinfo[i].bits)
+		{
+			insn_len = decinfo[i].dec(dc);
+			break;
+		}
+	}
+
+	return insn_len;
+}
+
+static void check_breakpoint(CPUState *env, DisasContext *dc)
+{
+	int j;
+	if (env->nb_breakpoints > 0) {
+		for(j = 0; j < env->nb_breakpoints; j++) {
+			if (env->breakpoints[j] == dc->pc) {
+				cris_evaluate_flags (dc);
+				gen_op_movl_T0_im((long)dc->pc);
+				gen_op_movl_pc_T0();
+				gen_op_debug();
+				dc->is_jmp = DISAS_UPDATE;
+			}
+		}
+	}
+}
+
+
+/* generate intermediate code for basic block 'tb'.  */
+struct DisasContext ctx;
+static int
+gen_intermediate_code_internal(CPUState *env, TranslationBlock *tb,
+                               int search_pc)
+{
+	uint16_t *gen_opc_end;
+   	uint32_t pc_start;
+	unsigned int insn_len;
+	int j, lj;
+	struct DisasContext *dc = &ctx;
+	uint32_t next_page_start;
+
+	pc_start = tb->pc;
+	dc->env = env;
+	dc->tb = tb;
+
+	gen_opc_ptr = gen_opc_buf;
+	gen_opc_end = gen_opc_buf + OPC_MAX_SIZE;
+	gen_opparam_ptr = gen_opparam_buf;
+
+	dc->is_jmp = DISAS_NEXT;
+	dc->pc = pc_start;
+	dc->singlestep_enabled = env->singlestep_enabled;
+	dc->flagx_live = 0;
+	dc->flags_x = 0;
+	next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+	lj = -1;
+	do
+	{
+		check_breakpoint(env, dc);
+		if (dc->is_jmp == DISAS_JUMP)
+			goto done;
+
+		if (search_pc) {
+			j = gen_opc_ptr - gen_opc_buf;
+			if (lj < j) {
+				lj++;
+				while (lj < j)
+					gen_opc_instr_start[lj++] = 0;
+			}
+			gen_opc_pc[lj] = dc->pc;
+			gen_opc_instr_start[lj] = 1;
+		}
+
+		insn_len = cris_decoder(dc);
+		STATS(gen_op_exec_insn());
+		dc->pc += insn_len;
+		if (!dc->flagx_live
+		    || (dc->flagx_live &&
+			!(dc->cc_op == CC_OP_FLAGS && dc->flags_x))) {
+			gen_movl_T0_preg[SR_CCS]();
+			gen_op_andl_T0_im(~X_FLAG);
+			gen_movl_preg_T0[SR_CCS]();
+			dc->flagx_live = 1;
+			dc->flags_x = 0;
+		}
+
+		/* Check for delayed branches here. If we do it before
+		   actually genereating any host code, the simulator will just
+		   loop doing nothing for on this program location.  */
+		if (dc->delayed_branch) {
+			dc->delayed_branch--;
+			if (dc->delayed_branch == 0)
+			{
+				if (dc->bcc == CC_A) {
+					gen_op_jmp ();
+					dc->is_jmp = DISAS_UPDATE;
+				}
+				else {
+					/* Conditional jmp.  */
+					gen_op_cc_jmp (dc->delayed_pc, dc->pc);
+					dc->is_jmp = DISAS_UPDATE;
+				}
+			}
+		}
+
+		if (env->singlestep_enabled)
+			break;
+	} while (!dc->is_jmp && gen_opc_ptr < gen_opc_end
+		 && dc->pc < next_page_start);
+
+	if (!dc->is_jmp) {
+		gen_op_movl_T0_im((long)dc->pc);
+		gen_op_movl_pc_T0();
+	}
+
+	cris_evaluate_flags (dc);
+  done:
+	if (__builtin_expect(env->singlestep_enabled, 0)) {
+		gen_op_debug();
+	} else {
+		switch(dc->is_jmp) {
+			case DISAS_NEXT:
+				gen_goto_tb(dc, 1, dc->pc);
+				break;
+			default:
+			case DISAS_JUMP:
+			case DISAS_UPDATE:
+				/* indicate that the hash table must be used
+				   to find the next TB */
+				/* T0 is used to index the jmp tables.  */
+				gen_op_movl_T0_0();
+				gen_op_exit_tb();
+				break;
+			case DISAS_TB_JUMP:
+				/* nothing more to generate */
+				break;
+		}
+	}
+	*gen_opc_ptr = INDEX_op_end;
+	if (search_pc) {
+		j = gen_opc_ptr - gen_opc_buf;
+		lj++;
+		while (lj <= j)
+			gen_opc_instr_start[lj++] = 0;
+	} else {
+		tb->size = dc->pc - pc_start;
+	}
+
+#ifdef DEBUG_DISAS
+	if (loglevel & CPU_LOG_TB_IN_ASM) {
+		fprintf(logfile, "--------------\n");
+		fprintf(logfile, "IN: %s\n", lookup_symbol(pc_start));
+		target_disas(logfile, pc_start, dc->pc + 4 - pc_start, 0);
+		fprintf(logfile, "\n");
+		if (loglevel & CPU_LOG_TB_OP) {
+			fprintf(logfile, "OP:\n");
+			dump_ops(gen_opc_buf, gen_opparam_buf);
+			fprintf(logfile, "\n");
+		}
+	}
+#endif
+	return 0;
+}
+
+int gen_intermediate_code (CPUState *env, struct TranslationBlock *tb)
+{
+    return gen_intermediate_code_internal(env, tb, 0);
+}
+
+int gen_intermediate_code_pc (CPUState *env, struct TranslationBlock *tb)
+{
+    return gen_intermediate_code_internal(env, tb, 1);
+}
+
+void cpu_dump_state (CPUState *env, FILE *f,
+                     int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
+                     int flags)
+{
+	int i;
+	uint32_t srs;
+
+	if (!env || !f)
+		return;
+
+	cpu_fprintf(f, "PC=%x CCS=%x btaken=%d btarget=%x\n"
+		    "cc_op=%d cc_src=%d cc_dest=%d cc_result=%x cc_mask=%x\n"
+		    "debug=%x %x %x\n",
+		    env->pc, env->pregs[SR_CCS], env->btaken, env->btarget,
+		    env->cc_op,
+		    env->cc_src, env->cc_dest, env->cc_result, env->cc_mask,
+		    env->debug1, env->debug2, env->debug3);
+
+	for (i = 0; i < 16; i++) {
+		cpu_fprintf(f, "r%2.2d=%8.8x ", i, env->regs[i]);
+		if ((i + 1) % 4 == 0)
+			cpu_fprintf(f, "\n");
+	}
+	cpu_fprintf(f, "\nspecial regs:\n");
+	for (i = 0; i < 16; i++) {
+		cpu_fprintf(f, "p%2.2d=%8.8x ", i, env->pregs[i]);
+		if ((i + 1) % 4 == 0)
+			cpu_fprintf(f, "\n");
+	}
+	srs = env->pregs[SR_SRS];
+	cpu_fprintf(f, "\nsupport function regs bank %d:\n", srs);
+	if (srs < 256) {
+		for (i = 0; i < 16; i++) {
+			cpu_fprintf(f, "s%2.2d=%8.8x ",
+				    i, env->sregs[srs][i]);
+			if ((i + 1) % 4 == 0)
+				cpu_fprintf(f, "\n");
+		}
+	}
+	cpu_fprintf(f, "\n\n");
+
+}
+
+CPUCRISState *cpu_cris_init (const char *cpu_model)
+{
+	CPUCRISState *env;
+
+	env = qemu_mallocz(sizeof(CPUCRISState));
+	if (!env)
+		return NULL;
+	cpu_exec_init(env);
+	cpu_reset(env);
+	return env;
+}
+
+void cpu_reset (CPUCRISState *env)
+{
+	memset(env, 0, offsetof(CPUCRISState, breakpoints));
+	tlb_flush(env, 1);
+}
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index de2669ecc..7143ab36a 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -46,10 +46,6 @@
 
 #include "softfloat.h"
 
-#if defined(__i386__) && !defined(CONFIG_SOFTMMU) && !defined(__APPLE__)
-#define USE_CODE_COPY
-#endif
-
 #define R_EAX 0
 #define R_ECX 1
 #define R_EDX 2
@@ -280,23 +276,56 @@
 #define CPUID_CMOV (1 << 15)
 #define CPUID_PAT  (1 << 16)
 #define CPUID_PSE36   (1 << 17)
+#define CPUID_PN   (1 << 18)
 #define CPUID_CLFLUSH (1 << 19)
-/* ... */
+#define CPUID_DTS (1 << 21)
+#define CPUID_ACPI (1 << 22)
 #define CPUID_MMX  (1 << 23)
 #define CPUID_FXSR (1 << 24)
 #define CPUID_SSE  (1 << 25)
 #define CPUID_SSE2 (1 << 26)
+#define CPUID_SS (1 << 27)
+#define CPUID_HT (1 << 28)
+#define CPUID_TM (1 << 29)
+#define CPUID_IA64 (1 << 30)
+#define CPUID_PBE (1 << 31)
 
 #define CPUID_EXT_SSE3     (1 << 0)
 #define CPUID_EXT_MONITOR  (1 << 3)
+#define CPUID_EXT_DSCPL    (1 << 4)
+#define CPUID_EXT_VMX      (1 << 5)
+#define CPUID_EXT_SMX      (1 << 6)
+#define CPUID_EXT_EST      (1 << 7)
+#define CPUID_EXT_TM2      (1 << 8)
+#define CPUID_EXT_SSSE3    (1 << 9)
+#define CPUID_EXT_CID      (1 << 10)
 #define CPUID_EXT_CX16     (1 << 13)
+#define CPUID_EXT_XTPR     (1 << 14)
+#define CPUID_EXT_DCA      (1 << 17)
+#define CPUID_EXT_POPCNT   (1 << 22)
 
 #define CPUID_EXT2_SYSCALL (1 << 11)
+#define CPUID_EXT2_MP      (1 << 19)
 #define CPUID_EXT2_NX      (1 << 20)
+#define CPUID_EXT2_MMXEXT  (1 << 22)
 #define CPUID_EXT2_FFXSR   (1 << 25)
+#define CPUID_EXT2_PDPE1GB (1 << 26)
+#define CPUID_EXT2_RDTSCP  (1 << 27)
 #define CPUID_EXT2_LM      (1 << 29)
+#define CPUID_EXT2_3DNOWEXT (1 << 30)
+#define CPUID_EXT2_3DNOW   (1 << 31)
 
+#define CPUID_EXT3_LAHF_LM (1 << 0)
+#define CPUID_EXT3_CMP_LEG (1 << 1)
 #define CPUID_EXT3_SVM     (1 << 2)
+#define CPUID_EXT3_EXTAPIC (1 << 3)
+#define CPUID_EXT3_CR8LEG  (1 << 4)
+#define CPUID_EXT3_ABM     (1 << 5)
+#define CPUID_EXT3_SSE4A   (1 << 6)
+#define CPUID_EXT3_MISALIGNSSE (1 << 7)
+#define CPUID_EXT3_3DNOWPREFETCH (1 << 8)
+#define CPUID_EXT3_OSVW    (1 << 9)
+#define CPUID_EXT3_IBS     (1 << 10)
 
 #define EXCP00_DIVZ	0
 #define EXCP01_SSTP	1
@@ -317,6 +346,9 @@
 #define EXCP11_ALGN	17
 #define EXCP12_MCHK	18
 
+#define EXCP_SYSCALL    0x100 /* only happens in user only emulation
+                                 for syscall instruction */
+
 enum {
     CC_OP_DYNAMIC, /* must use dynamic code to get cc_op */
     CC_OP_EFLAGS,  /* all cc are explicitely computed, CC_SRC = flags */
@@ -438,6 +470,8 @@ typedef union {
 #define CPU_NB_REGS 8
 #endif
 
+#define NB_MMU_MODES 2
+
 typedef struct CPUX86State {
 #if TARGET_LONG_BITS > HOST_LONG_BITS
     /* temporaries if we cannot store them in host registers */
@@ -527,13 +561,6 @@ typedef struct CPUX86State {
 #endif
     uint64_t pat;
 
-    /* temporary data for USE_CODE_COPY mode */
-#ifdef USE_CODE_COPY
-    uint32_t tmp0;
-    uint32_t saved_esp;
-    int native_fp_regs; /* if true, the FPU state is in the native CPU regs */
-#endif
-
     /* exception/interrupt handling */
     jmp_buf jmp_env;
     int exception_index;
@@ -578,9 +605,11 @@ typedef struct CPUX86State {
     struct APICState *apic_state;
 } CPUX86State;
 
-CPUX86State *cpu_x86_init(void);
+CPUX86State *cpu_x86_init(const char *cpu_model);
 int cpu_x86_exec(CPUX86State *s);
 void cpu_x86_close(CPUX86State *s);
+void x86_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt,
+                                                 ...));
 int cpu_get_pic_interrupt(CPUX86State *s);
 /* MSDOS compatibility mode FPU exception support */
 void cpu_set_ferr(CPUX86State *s);
@@ -661,8 +690,8 @@ CPU86_LDouble cpu_set_fp80(uint64_t mant, uint16_t upper);
 /* the following helpers are only usable in user mode simulation as
    they can trigger unexpected exceptions */
 void cpu_x86_load_seg(CPUX86State *s, int seg_reg, int selector);
-void cpu_x86_fsave(CPUX86State *s, uint8_t *ptr, int data32);
-void cpu_x86_frstor(CPUX86State *s, uint8_t *ptr, int data32);
+void cpu_x86_fsave(CPUX86State *s, target_ulong ptr, int data32);
+void cpu_x86_frstor(CPUX86State *s, target_ulong ptr, int data32);
 
 /* you can call this signal handler from your SIGBUS and SIGSEGV
    signal handlers to inform the virtual CPU of exceptions. non zero
@@ -704,6 +733,16 @@ static inline int cpu_get_time_fast(void)
 #define cpu_exec cpu_x86_exec
 #define cpu_gen_code cpu_x86_gen_code
 #define cpu_signal_handler cpu_x86_signal_handler
+#define cpu_list x86_cpu_list
+
+/* MMU modes definitions */
+#define MMU_MODE0_SUFFIX _kernel
+#define MMU_MODE1_SUFFIX _user
+#define MMU_USER_IDX 1
+static inline int cpu_mmu_index (CPUState *env)
+{
+    return (env->hflags & HF_CPL_MASK) == 3 ? 1 : 0;
+}
 
 #include "cpu-all.h"
 
diff --git a/target-i386/exec.h b/target-i386/exec.h
index 1cb73467b..20153f727 100644
--- a/target-i386/exec.h
+++ b/target-i386/exec.h
@@ -163,8 +163,8 @@ void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3);
 void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4);
 void cpu_x86_flush_tlb(CPUX86State *env, target_ulong addr);
 int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
-                             int is_write, int is_user, int is_softmmu);
-void tlb_fill(target_ulong addr, int is_write, int is_user,
+                             int is_write, int mmu_idx, int is_softmmu);
+void tlb_fill(target_ulong addr, int is_write, int mmu_idx,
               void *retaddr);
 void __hidden cpu_lock(void);
 void __hidden cpu_unlock(void);
@@ -199,6 +199,7 @@ void helper_sysexit(void);
 void helper_syscall(int next_eip_addend);
 void helper_sysret(int dflag);
 void helper_rdtsc(void);
+void helper_rdpmc(void);
 void helper_rdmsr(void);
 void helper_wrmsr(void);
 void helper_lsl(void);
@@ -419,12 +420,12 @@ static inline void helper_fstt(CPU86_LDouble f, target_ulong ptr)
 
 static inline CPU86_LDouble helper_fldt(target_ulong ptr)
 {
-    return *(CPU86_LDouble *)ptr;
+    return *(CPU86_LDouble *)(unsigned long)ptr;
 }
 
 static inline void helper_fstt(CPU86_LDouble f, target_ulong ptr)
 {
-    *(CPU86_LDouble *)ptr = f;
+    *(CPU86_LDouble *)(unsigned long)ptr = f;
 }
 
 #else
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 154708e56..bad3f7c1b 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -18,6 +18,8 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 #include "exec.h"
+#include "host-utils.h"
+
 //#define DEBUG_PCALL
 
 #if 0
@@ -969,6 +971,14 @@ static void do_interrupt64(int intno, int is_int, int error_code,
 }
 #endif
 
+#if defined(CONFIG_USER_ONLY)
+void helper_syscall(int next_eip_addend)
+{
+    env->exception_index = EXCP_SYSCALL;
+    env->exception_next_eip = env->eip + next_eip_addend;
+    cpu_loop_exit();
+}
+#else
 void helper_syscall(int next_eip_addend)
 {
     int selector;
@@ -1022,6 +1032,7 @@ void helper_syscall(int next_eip_addend)
         env->eip = (uint32_t)env->star;
     }
 }
+#endif
 
 void helper_sysret(int dflag)
 {
@@ -1141,18 +1152,23 @@ void do_interrupt_user(int intno, int is_int, int error_code,
 {
     SegmentCache *dt;
     target_ulong ptr;
-    int dpl, cpl;
+    int dpl, cpl, shift;
     uint32_t e2;
 
     dt = &env->idt;
-    ptr = dt->base + (intno * 8);
+    if (env->hflags & HF_LMA_MASK) {
+        shift = 4;
+    } else {
+        shift = 3;
+    }
+    ptr = dt->base + (intno << shift);
     e2 = ldl_kernel(ptr + 4);
 
     dpl = (e2 >> DESC_DPL_SHIFT) & 3;
     cpl = env->hflags & HF_CPL_MASK;
     /* check privledge if software int */
     if (is_int && dpl < cpl)
-        raise_exception_err(EXCP0D_GPF, intno * 8 + 2);
+        raise_exception_err(EXCP0D_GPF, (intno << shift) + 2);
 
     /* Since we emulate only user space, we cannot do more than
        exiting the emulation with the suitable exception and error
@@ -1219,7 +1235,7 @@ void do_interrupt(int intno, int is_int, int error_code,
  * needed. It should only be called, if this is not an interrupt.
  * Returns the new exception number.
  */
-int check_exception(int intno, int *error_code)
+static int check_exception(int intno, int *error_code)
 {
     char first_contributory = env->old_exception == 0 ||
                               (env->old_exception >= 10 &&
@@ -2727,6 +2743,18 @@ void helper_rdtsc(void)
     EDX = (uint32_t)(val >> 32);
 }
 
+void helper_rdpmc(void)
+{
+    if ((env->cr[4] & CR4_PCE_MASK) && ((env->hflags & HF_CPL_MASK) != 0)) {
+        raise_exception(EXCP0D_GPF);
+    }
+
+    if (!svm_check_intercept_param(SVM_EXIT_RDPMC, 0)) {
+        /* currently unimplemented */
+        raise_exception_err(EXCP06_ILLOP, 0);
+    }
+}
+
 #if defined(CONFIG_USER_ONLY)
 void helper_wrmsr(void)
 {
@@ -3035,7 +3063,7 @@ void helper_fstt_ST0_A0(void)
     helper_fstt(ST0, A0);
 }
 
-void fpu_set_exception(int mask)
+static void fpu_set_exception(int mask)
 {
     env->fpus |= mask;
     if (env->fpus & (~env->fpuc & FPUC_EM))
@@ -3723,7 +3751,7 @@ void helper_mulq_EAX_T0(void)
 {
     uint64_t r0, r1;
 
-    mulu64(&r1, &r0, EAX, T0);
+    mulu64(&r0, &r1, EAX, T0);
     EAX = r0;
     EDX = r1;
     CC_DST = r0;
@@ -3734,7 +3762,7 @@ void helper_imulq_EAX_T0(void)
 {
     uint64_t r0, r1;
 
-    muls64(&r1, &r0, EAX, T0);
+    muls64(&r0, &r1, EAX, T0);
     EAX = r0;
     EDX = r1;
     CC_DST = r0;
@@ -3745,7 +3773,7 @@ void helper_imulq_T0_T1(void)
 {
     uint64_t r0, r1;
 
-    muls64(&r1, &r0, T0, T1);
+    muls64(&r0, &r1, T0, T1);
     T0 = r0;
     CC_DST = r0;
     CC_SRC = ((int64_t)r1 != ((int64_t)r0 >> 63));
@@ -3864,7 +3892,11 @@ void update_fp_status(void)
 #if !defined(CONFIG_USER_ONLY)
 
 #define MMUSUFFIX _mmu
-#define GETPC() (__builtin_return_address(0))
+#ifdef __s390__
+# define GETPC() ((void*)((unsigned long)__builtin_return_address(0) & 0x7fffffffUL))
+#else
+# define GETPC() (__builtin_return_address(0))
+#endif
 
 #define SHIFT 0
 #include "softmmu_template.h"
@@ -3884,7 +3916,7 @@ void update_fp_status(void)
    NULL, it means that the function was called in C code (i.e. not
    from generated code or from helper.c) */
 /* XXX: fix it to restore all registers */
-void tlb_fill(target_ulong addr, int is_write, int is_user, void *retaddr)
+void tlb_fill(target_ulong addr, int is_write, int mmu_idx, void *retaddr)
 {
     TranslationBlock *tb;
     int ret;
@@ -3896,7 +3928,7 @@ void tlb_fill(target_ulong addr, int is_write, int is_user, void *retaddr)
     saved_env = env;
     env = cpu_single_env;
 
-    ret = cpu_x86_handle_mmu_fault(env, addr, is_write, is_user, 1);
+    ret = cpu_x86_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
     if (ret) {
         if (retaddr) {
             /* now we have a real cpu fault */
@@ -4230,7 +4262,8 @@ int svm_check_intercept_param(uint32_t type, uint64_t param)
             uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.iopm_base_pa));
             uint16_t port = (uint16_t) (param >> 16);
 
-            if(ldub_phys(addr + port / 8) & (1 << (port % 8)))
+            uint16_t mask = (1 << ((param >> 4) & 7)) - 1;
+            if(lduw_phys(addr + port / 8) & (mask << (port & 7)))
                 vmexit(type, param);
         }
         break;
diff --git a/target-i386/helper2.c b/target-i386/helper2.c
index b0e969257..1874b73ba 100644
--- a/target-i386/helper2.c
+++ b/target-i386/helper2.c
@@ -35,24 +35,68 @@
 
 //#define DEBUG_MMU
 
-#ifdef USE_CODE_COPY
-#include <asm/ldt.h>
-#include <linux/unistd.h>
-#include <linux/version.h>
+static int cpu_x86_register (CPUX86State *env, const char *cpu_model);
 
-int modify_ldt(int func, void *ptr, unsigned long bytecount)
+static void add_flagname_to_bitmaps(char *flagname, uint32_t *features, 
+                                    uint32_t *ext_features, 
+                                    uint32_t *ext2_features, 
+                                    uint32_t *ext3_features)
 {
-	return syscall(__NR_modify_ldt, func, ptr, bytecount);
+    int i;
+    /* feature flags taken from "Intel Processor Identification and the CPUID
+     * Instruction" and AMD's "CPUID Specification". In cases of disagreement 
+     * about feature names, the Linux name is used. */
+    const char *feature_name[] = {
+        "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce",
+        "cx8", "apic", NULL, "sep", "mtrr", "pge", "mca", "cmov",
+        "pat", "pse36", "pn" /* Intel psn */, "clflush" /* Intel clfsh */, NULL, "ds" /* Intel dts */, "acpi", "mmx",
+        "fxsr", "sse", "sse2", "ss", "ht" /* Intel htt */, "tm", "ia64", "pbe",
+    };
+    const char *ext_feature_name[] = {
+       "pni" /* Intel,AMD sse3 */, NULL, NULL, "monitor", "ds_cpl", "vmx", NULL /* Linux smx */, "est",
+       "tm2", "ssse3", "cid", NULL, NULL, "cx16", "xtpr", NULL,
+       NULL, NULL, "dca", NULL, NULL, NULL, NULL, "popcnt",
+       NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+    };
+    const char *ext2_feature_name[] = {
+       "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce",
+       "cx8" /* AMD CMPXCHG8B */, "apic", NULL, "syscall", "mttr", "pge", "mca", "cmov",
+       "pat", "pse36", NULL, NULL /* Linux mp */, "nx" /* Intel xd */, NULL, "mmxext", "mmx",
+       "fxsr", "fxsr_opt" /* AMD ffxsr */, "pdpe1gb" /* AMD Page1GB */, "rdtscp", NULL, "lm" /* Intel 64 */, "3dnowext", "3dnow",
+    };
+    const char *ext3_feature_name[] = {
+       "lahf_lm" /* AMD LahfSahf */, "cmp_legacy", "svm", "extapic" /* AMD ExtApicSpace */, "cr8legacy" /* AMD AltMovCr8 */, "abm", "sse4a", "misalignsse",
+       "3dnowprefetch", "osvw", NULL /* Linux ibs */, NULL, "skinit", "wdt", NULL, NULL,
+       NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+       NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+    };
+
+    for ( i = 0 ; i < 32 ; i++ ) 
+        if (feature_name[i] && !strcmp (flagname, feature_name[i])) {
+            *features |= 1 << i;
+            return;
+        }
+    for ( i = 0 ; i < 32 ; i++ ) 
+        if (ext_feature_name[i] && !strcmp (flagname, ext_feature_name[i])) {
+            *ext_features |= 1 << i;
+            return;
+        }
+    for ( i = 0 ; i < 32 ; i++ ) 
+        if (ext2_feature_name[i] && !strcmp (flagname, ext2_feature_name[i])) {
+            *ext2_features |= 1 << i;
+            return;
+        }
+    for ( i = 0 ; i < 32 ; i++ ) 
+        if (ext3_feature_name[i] && !strcmp (flagname, ext3_feature_name[i])) {
+            *ext3_features |= 1 << i;
+            return;
+        }
+    fprintf(stderr, "CPU feature %s not found\n", flagname);
 }
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 66)
-#define modify_ldt_ldt_s user_desc
-#endif
-#endif /* USE_CODE_COPY */
-
 extern const char *cpu_vendor_string;
 
-CPUX86State *cpu_x86_init(void)
+CPUX86State *cpu_x86_init(const char *cpu_model)
 {
     CPUX86State *env;
     static int inited;
@@ -61,109 +105,236 @@ CPUX86State *cpu_x86_init(void)
     if (!env)
         return NULL;
     cpu_exec_init(env);
+    env->cpu_model_str = cpu_model;
 
     /* init various static tables */
     if (!inited) {
         inited = 1;
         optimize_flags_init();
     }
-#ifdef USE_CODE_COPY
-    /* testing code for code copy case */
-    {
-        struct modify_ldt_ldt_s ldt;
-
-        ldt.entry_number = 1;
-        ldt.base_addr = (unsigned long)env;
-        ldt.limit = (sizeof(CPUState) + 0xfff) >> 12;
-        ldt.seg_32bit = 1;
-        ldt.contents = MODIFY_LDT_CONTENTS_DATA;
-        ldt.read_exec_only = 0;
-        ldt.limit_in_pages = 1;
-        ldt.seg_not_present = 0;
-        ldt.useable = 1;
-        modify_ldt(1, &ldt, sizeof(ldt)); /* write ldt entry */
-
-        asm volatile ("movl %0, %%fs" : : "r" ((1 << 3) | 7));
+    if (cpu_x86_register(env, cpu_model) < 0) {
+        cpu_x86_close(env);
+        return NULL;
     }
+    cpu_reset(env);
+#ifdef USE_KQEMU
+    kqemu_init(env);
 #endif
-    {
-        int family, model, stepping;
+    return env;
+}
+
+typedef struct x86_def_t {
+    const char *name;
+    uint32_t vendor1, vendor2, vendor3;
+    int family;
+    int model;
+    int stepping;
+    uint32_t features, ext_features, ext2_features, ext3_features;
+    uint32_t xlevel;
+} x86_def_t;
+
+#define PPRO_FEATURES (CPUID_FP87 | CPUID_DE | CPUID_PSE | CPUID_TSC | \
+          CPUID_MSR | CPUID_MCE | CPUID_CX8 | CPUID_PGE | CPUID_CMOV | \
+          CPUID_PAT | CPUID_FXSR | CPUID_MMX | CPUID_SSE | CPUID_SSE2 | \
+          CPUID_PAE | CPUID_SEP | CPUID_APIC)
+static x86_def_t x86_defs[] = {
 #ifdef TARGET_X86_64
-        env->cpuid_vendor1 = 0x68747541; /* "Auth" */
-        env->cpuid_vendor2 = 0x69746e65; /* "enti" */
-        env->cpuid_vendor3 = 0x444d4163; /* "cAMD" */
-        family = 6;
-        model = 2;
-        stepping = 3;
-#else
-        env->cpuid_vendor1 = 0x756e6547; /* "Genu" */
-        env->cpuid_vendor2 = 0x49656e69; /* "ineI" */
-        env->cpuid_vendor3 = 0x6c65746e; /* "ntel" */
-#if 0
-        /* pentium 75-200 */
-        family = 5;
-        model = 2;
-        stepping = 11;
-#else
-        /* pentium pro */
-        family = 6;
-        model = 3;
-        stepping = 3;
-#endif
+    {
+        .name = "qemu64",
+        .vendor1 = 0x68747541, /* "Auth" */
+        .vendor2 = 0x69746e65, /* "enti" */
+        .vendor3 = 0x444d4163, /* "cAMD" */
+        .family = 6,
+        .model = 2,
+        .stepping = 3,
+        .features = PPRO_FEATURES | 
+        /* these features are needed for Win64 and aren't fully implemented */
+            CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
+        /* this feature is needed for Solaris and isn't fully implemented */
+            CPUID_PSE36,
+        .ext_features = CPUID_EXT_SSE3,
+        .ext2_features = (PPRO_FEATURES & 0x0183F3FF) | 
+            CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
+        .ext3_features = CPUID_EXT3_SVM,
+        .xlevel = 0x80000008,
+    },
 #endif
-        env->cpuid_level = 2;
-        env->cpuid_version = (family << 8) | (model << 4) | stepping;
-        env->cpuid_features = (CPUID_FP87 | CPUID_DE | CPUID_PSE |
-                               CPUID_TSC | CPUID_MSR | CPUID_MCE |
-                               CPUID_CX8 | CPUID_PGE | CPUID_CMOV |
-                               CPUID_PAT);
-        env->pat = 0x0007040600070406ULL;
-        env->cpuid_ext3_features = CPUID_EXT3_SVM;
-        env->cpuid_ext_features = CPUID_EXT_SSE3;
-        env->cpuid_features |= CPUID_FXSR | CPUID_MMX | CPUID_SSE | CPUID_SSE2 | CPUID_PAE | CPUID_SEP;
-        env->cpuid_features |= CPUID_APIC;
-        env->cpuid_xlevel = 0x8000000e;
-        {
-            const char *model_id = "QEMU Virtual CPU version " QEMU_VERSION;
-            int c, len, i;
-
-            if (cpu_vendor_string != NULL)
-		model_id = cpu_vendor_string;
-
-            len = strlen(model_id);
-            for(i = 0; i < 48; i++) {
-                if (i >= len)
-                    c = '\0';
-                else
-                    c = model_id[i];
-                env->cpuid_model[i >> 2] |= c << (8 * (i & 3));
+    {
+        .name = "qemu32",
+        .family = 6,
+        .model = 3,
+        .stepping = 3,
+        .features = PPRO_FEATURES,
+        .ext_features = CPUID_EXT_SSE3,
+        .xlevel = 0,
+    },
+    {
+        .name = "486",
+        .family = 4,
+        .model = 0,
+        .stepping = 0,
+        .features = 0x0000000B,
+        .xlevel = 0,
+    },
+    {
+        .name = "pentium",
+        .family = 5,
+        .model = 4,
+        .stepping = 3,
+        .features = 0x008001BF,
+        .xlevel = 0,
+    },
+    {
+        .name = "pentium2",
+        .family = 6,
+        .model = 5,
+        .stepping = 2,
+        .features = 0x0183F9FF,
+        .xlevel = 0,
+    },
+    {
+        .name = "pentium3",
+        .family = 6,
+        .model = 7,
+        .stepping = 3,
+        .features = 0x0383F9FF,
+        .xlevel = 0,
+    },
+};
+
+static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, const char *cpu_model)
+{
+    unsigned int i;
+    x86_def_t *def;
+
+    char *s = strdup(cpu_model);
+    char *featurestr, *name = strtok(s, ",");
+    uint32_t plus_features = 0, plus_ext_features = 0, plus_ext2_features = 0, plus_ext3_features = 0;
+    uint32_t minus_features = 0, minus_ext_features = 0, minus_ext2_features = 0, minus_ext3_features = 0;
+    int family = -1, model = -1, stepping = -1;
+
+    def = NULL;
+    for (i = 0; i < sizeof(x86_defs) / sizeof(x86_def_t); i++) {
+        if (strcmp(name, x86_defs[i].name) == 0) {
+            def = &x86_defs[i];
+            break;
+        }
+    }
+    if (!def)
+        goto error;
+    memcpy(x86_cpu_def, def, sizeof(*def));
+
+    featurestr = strtok(NULL, ",");
+
+    while (featurestr) {
+        char *val;
+        if (featurestr[0] == '+') {
+            add_flagname_to_bitmaps(featurestr + 1, &plus_features, &plus_ext_features, &plus_ext2_features, &plus_ext3_features);
+        } else if (featurestr[0] == '-') {
+            add_flagname_to_bitmaps(featurestr + 1, &minus_features, &minus_ext_features, &minus_ext2_features, &minus_ext3_features);
+        } else if ((val = strchr(featurestr, '='))) {
+            *val = 0; val++;
+            if (!strcmp(featurestr, "family")) {
+                char *err;
+                family = strtol(val, &err, 10);
+                if (!*val || *err || family < 0) {
+                    fprintf(stderr, "bad numerical value %s\n", val);
+                    x86_cpu_def = 0;
+                    goto error;
+                }
+                x86_cpu_def->family = family;
+            } else if (!strcmp(featurestr, "model")) {
+                char *err;
+                model = strtol(val, &err, 10);
+                if (!*val || *err || model < 0 || model > 0xf) {
+                    fprintf(stderr, "bad numerical value %s\n", val);
+                    x86_cpu_def = 0;
+                    goto error;
+                }
+                x86_cpu_def->model = model;
+            } else if (!strcmp(featurestr, "stepping")) {
+                char *err;
+                stepping = strtol(val, &err, 10);
+                if (!*val || *err || stepping < 0 || stepping > 0xf) {
+                    fprintf(stderr, "bad numerical value %s\n", val);
+                    x86_cpu_def = 0;
+                    goto error;
+                }
+                x86_cpu_def->stepping = stepping;
+            } else {
+                fprintf(stderr, "unrecognized feature %s\n", featurestr);
+                x86_cpu_def = 0;
+                goto error;
             }
+        } else {
+            fprintf(stderr, "feature string `%s' not in format (+feature|-feature|feature=xyz)\n", featurestr);
+            x86_cpu_def = 0;
+            goto error;
         }
-#ifdef TARGET_X86_64
-        /* currently not enabled for std i386 because not fully tested */
-        env->cpuid_ext2_features = (env->cpuid_features & 0x0183F3FF);
-        env->cpuid_ext2_features |= CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX;
+        featurestr = strtok(NULL, ",");
+    }
+    x86_cpu_def->features |= plus_features;
+    x86_cpu_def->ext_features |= plus_ext_features;
+    x86_cpu_def->ext2_features |= plus_ext2_features;
+    x86_cpu_def->ext3_features |= plus_ext3_features;
+    x86_cpu_def->features &= ~minus_features;
+    x86_cpu_def->ext_features &= ~minus_ext_features;
+    x86_cpu_def->ext2_features &= ~minus_ext2_features;
+    x86_cpu_def->ext3_features &= ~minus_ext3_features;
+    free(s);
+    return 0;
+
+error:
+    free(s);
+    return -1;
+}
 
-        /* these features are needed for Win64 and aren't fully implemented */
-        env->cpuid_features |= CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA;
-        /* this feature is needed for Solaris and isn't fully implemented */
-        env->cpuid_features |= CPUID_PSE36;
-#endif
+void x86_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
+{
+    unsigned int i;
+
+    for (i = 0; i < sizeof(x86_defs) / sizeof(x86_def_t); i++)
+        (*cpu_fprintf)(f, "x86 %16s\n", x86_defs[i].name);
+}
+
+static int cpu_x86_register (CPUX86State *env, const char *cpu_model)
+{
+    x86_def_t def1, *def = &def1;
+
+    if (cpu_x86_find_by_name(def, cpu_model) < 0)
+        return -1;
+    if (def->vendor1) {
+        env->cpuid_vendor1 = def->vendor1;
+        env->cpuid_vendor2 = def->vendor2;
+        env->cpuid_vendor3 = def->vendor3;
+    } else {
+        env->cpuid_vendor1 = 0x756e6547; /* "Genu" */
+        env->cpuid_vendor2 = 0x49656e69; /* "ineI" */
+        env->cpuid_vendor3 = 0x6c65746e; /* "ntel" */
     }
-    cpu_reset(env);
-#ifdef USE_KQEMU
-    kqemu_init(env);
-#endif
-#ifdef USE_KVM
+    env->cpuid_level = 2;
+    env->cpuid_version = (def->family << 8) | (def->model << 4) | def->stepping;
+    env->cpuid_features = def->features;
+    env->pat = 0x0007040600070406ULL;
+    env->cpuid_ext_features = def->ext_features;
+    env->cpuid_ext2_features = def->ext2_features;
+    env->cpuid_xlevel = def->xlevel;
+    env->cpuid_ext3_features = def->ext3_features;
     {
-        extern int kvm_allowed;
-        if (kvm_allowed) {
-            kvm_qemu_init_env(env);
-            env->ready_for_interrupt_injection = 1;
+        const char *model_id = "QEMU Virtual CPU version " QEMU_VERSION;
+        int c, len, i;
+        if (cpu_vendor_string != NULL)
+            model_id = cpu_vendor_string;
+        len = strlen(model_id);
+        for(i = 0; i < 48; i++) {
+            if (i >= len)
+                c = '\0';
+            else
+                c = model_id[i];
+            env->cpuid_model[i >> 2] |= c << (8 * (i & 3));
         }
     }
-#endif
-    return env;
+    return 0;
 }
 
 /* NOTE: must be called outside the CPU execute loop */
@@ -203,7 +374,7 @@ void cpu_reset(CPUX86State *env)
     cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffff, 0);
 
     env->eip = 0xfff0;
-    env->regs[R_EDX] = 0x600; /* indicate P6 processor */
+    env->regs[R_EDX] = env->cpuid_version;
 
     env->eflags = 0x2;
 
@@ -590,7 +761,7 @@ void cpu_x86_flush_tlb(CPUX86State *env, target_ulong addr)
 #if defined(CONFIG_USER_ONLY)
 
 int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
-                             int is_write, int is_user, int is_softmmu)
+                             int is_write, int mmu_idx, int is_softmmu)
 {
     /* user mode only emulation */
     is_write &= 1;
@@ -617,14 +788,15 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
    2  = soft MMU activation required for this block
 */
 int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
-                             int is_write1, int is_user, int is_softmmu)
+                             int is_write1, int mmu_idx, int is_softmmu)
 {
     uint64_t ptep, pte;
     uint32_t pdpe_addr, pde_addr, pte_addr;
-    int error_code, is_dirty, prot, page_size, ret, is_write;
+    int error_code, is_dirty, prot, page_size, ret, is_write, is_user;
     unsigned long paddr, page_offset;
     target_ulong vaddr, virt_addr;
 
+    is_user = mmu_idx == MMU_USER_IDX;
 #if defined(DEBUG_MMU)
     printf("MMU fault: addr=" TARGET_FMT_lx " w=%d u=%d eip=" TARGET_FMT_lx "\n",
            addr, is_write1, is_user, env->eip);
@@ -881,7 +1053,7 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr,
     paddr = (pte & TARGET_PAGE_MASK) + page_offset;
     vaddr = virt_addr + page_offset;
 
-    ret = tlb_set_page_exec(env, vaddr, paddr, prot, is_user, is_softmmu);
+    ret = tlb_set_page_exec(env, vaddr, paddr, prot, mmu_idx, is_softmmu);
     return ret;
  do_fault_protect:
     error_code = PG_ERROR_P_MASK;
@@ -994,73 +1166,3 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
     return paddr;
 }
 #endif /* !CONFIG_USER_ONLY */
-
-#if defined(USE_CODE_COPY)
-struct fpstate {
-    uint16_t fpuc;
-    uint16_t dummy1;
-    uint16_t fpus;
-    uint16_t dummy2;
-    uint16_t fptag;
-    uint16_t dummy3;
-
-    uint32_t fpip;
-    uint32_t fpcs;
-    uint32_t fpoo;
-    uint32_t fpos;
-    uint8_t fpregs1[8 * 10];
-};
-
-void restore_native_fp_state(CPUState *env)
-{
-    int fptag, i, j;
-    struct fpstate fp1, *fp = &fp1;
-
-    fp->fpuc = env->fpuc;
-    fp->fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
-    fptag = 0;
-    for (i=7; i>=0; i--) {
-	fptag <<= 2;
-	if (env->fptags[i]) {
-            fptag |= 3;
-        } else {
-            /* the FPU automatically computes it */
-        }
-    }
-    fp->fptag = fptag;
-    j = env->fpstt;
-    for(i = 0;i < 8; i++) {
-        memcpy(&fp->fpregs1[i * 10], &env->fpregs[j].d, 10);
-        j = (j + 1) & 7;
-    }
-    asm volatile ("frstor %0" : "=m" (*fp));
-    env->native_fp_regs = 1;
-}
-
-void save_native_fp_state(CPUState *env)
-{
-    int fptag, i, j;
-    uint16_t fpuc;
-    struct fpstate fp1, *fp = &fp1;
-
-    asm volatile ("fsave %0" : : "m" (*fp));
-    env->fpuc = fp->fpuc;
-    env->fpstt = (fp->fpus >> 11) & 7;
-    env->fpus = fp->fpus & ~0x3800;
-    fptag = fp->fptag;
-    for(i = 0;i < 8; i++) {
-        env->fptags[i] = ((fptag & 3) == 3);
-        fptag >>= 2;
-    }
-    j = env->fpstt;
-    for(i = 0;i < 8; i++) {
-        memcpy(&env->fpregs[j].d, &fp->fpregs1[i * 10], 10);
-        j = (j + 1) & 7;
-    }
-    /* we must restore the default rounding state */
-    /* XXX: we do not restore the exception state */
-    fpuc = 0x037f | (env->fpuc & (3 << 10));
-    asm volatile("fldcw %0" : : "m" (fpuc));
-    env->native_fp_regs = 0;
-}
-#endif
diff --git a/target-i386/op.c b/target-i386/op.c
index 7d8950e07..77930db12 100644
--- a/target-i386/op.c
+++ b/target-i386/op.c
@@ -953,6 +953,11 @@ void OPPROTO op_rdtsc(void)
     helper_rdtsc();
 }
 
+void OPPROTO op_rdpmc(void)
+{
+    helper_rdpmc();
+}
+
 void OPPROTO op_cpuid(void)
 {
     helper_cpuid();
diff --git a/target-i386/translate-copy.c b/target-i386/translate-copy.c
deleted file mode 100644
index d68764360..000000000
--- a/target-i386/translate-copy.c
+++ /dev/null
@@ -1,1323 +0,0 @@
-/*
- *  i386 on i386 translation
- *
- *  Copyright (c) 2003 Fabrice Bellard
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-#include "config.h"
-
-#include <stdarg.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <inttypes.h>
-#include <assert.h>
-
-#include "cpu.h"
-#include "exec-all.h"
-#include "disas.h"
-
-#ifdef USE_CODE_COPY
-
-#include <signal.h>
-#include <sys/mman.h>
-#include <sys/ucontext.h>
-
-extern char exec_loop;
-
-/* operand size */
-enum {
-    OT_BYTE = 0,
-    OT_WORD,
-    OT_LONG,
-    OT_QUAD,
-};
-
-#define PREFIX_REPZ   0x01
-#define PREFIX_REPNZ  0x02
-#define PREFIX_LOCK   0x04
-#define PREFIX_DATA   0x08
-#define PREFIX_ADR    0x10
-
-typedef struct DisasContext {
-    /* current insn context */
-    int override; /* -1 if no override */
-    int prefix;
-    int aflag, dflag;
-    target_ulong pc; /* pc = eip + cs_base */
-    int is_jmp; /* 1 = means jump (stop translation), 2 means CPU
-                   static state change (stop translation) */
-    /* code output */
-    uint8_t *gen_code_ptr;
-    uint8_t *gen_code_start;
-
-    /* current block context */
-    target_ulong cs_base; /* base of CS segment */
-    int pe;     /* protected mode */
-    int code32; /* 32 bit code segment */
-    int f_st;   /* currently unused */
-    int vm86;   /* vm86 mode */
-    int cpl;
-    int iopl;
-    int flags;
-    struct TranslationBlock *tb;
-} DisasContext;
-
-#define CPU_FIELD_OFFSET(field) offsetof(CPUState, field)
-
-#define CPU_SEG 0x64 /* fs override */
-
-static inline void gb(DisasContext *s, uint32_t val)
-{
-    *s->gen_code_ptr++ = val;
-}
-
-static inline void gw(DisasContext *s, uint32_t val)
-{
-    *s->gen_code_ptr++ = val;
-    *s->gen_code_ptr++ = val >> 8;
-}
-
-static inline void gl(DisasContext *s, uint32_t val)
-{
-    *s->gen_code_ptr++ = val;
-    *s->gen_code_ptr++ = val >> 8;
-    *s->gen_code_ptr++ = val >> 16;
-    *s->gen_code_ptr++ = val >> 24;
-}
-
-static inline void gjmp(DisasContext *s, long val)
-{
-    gb(s, 0xe9); /* jmp */
-    gl(s, val - (long)(s->gen_code_ptr + 4));
-}
-
-static inline void gen_movl_addr_im(DisasContext *s,
-                                    uint32_t addr, uint32_t val)
-{
-    gb(s, CPU_SEG); /* seg movl im, addr */
-    gb(s, 0xc7);
-    gb(s, 0x05);
-    gl(s, addr);
-    gl(s, val);
-}
-
-static inline void gen_movw_addr_im(DisasContext *s,
-                                    uint32_t addr, uint32_t val)
-{
-    gb(s, CPU_SEG); /* seg movl im, addr */
-    gb(s, 0x66);
-    gb(s, 0xc7);
-    gb(s, 0x05);
-    gl(s, addr);
-    gw(s, val);
-}
-
-
-static void gen_jmp(DisasContext *s, uint32_t target_eip)
-{
-    TranslationBlock *tb = s->tb;
-
-    gb(s, 0xe9); /* jmp */
-    tb->tb_jmp_offset[0] = s->gen_code_ptr - s->gen_code_start;
-    gl(s, 0);
-
-    tb->tb_next_offset[0] = s->gen_code_ptr - s->gen_code_start;
-    gen_movl_addr_im(s, CPU_FIELD_OFFSET(eip), target_eip);
-    gen_movl_addr_im(s, CPU_FIELD_OFFSET(tmp0), (uint32_t)tb);
-    gjmp(s, (long)&exec_loop);
-
-    s->is_jmp = 1;
-}
-
-static void gen_jcc(DisasContext *s, int op,
-                    uint32_t target_eip, uint32_t next_eip)
-{
-    TranslationBlock *tb = s->tb;
-
-    gb(s, 0x0f); /* jcc */
-    gb(s, 0x80 + op);
-    tb->tb_jmp_offset[0] = s->gen_code_ptr - s->gen_code_start;
-    gl(s, 0);
-    gb(s, 0xe9); /* jmp */
-    tb->tb_jmp_offset[1] = s->gen_code_ptr - s->gen_code_start;
-    gl(s, 0);
-
-    tb->tb_next_offset[0] = s->gen_code_ptr - s->gen_code_start;
-    gen_movl_addr_im(s, CPU_FIELD_OFFSET(eip), target_eip);
-    gen_movl_addr_im(s, CPU_FIELD_OFFSET(tmp0), (uint32_t)tb);
-    gjmp(s, (long)&exec_loop);
-
-    tb->tb_next_offset[1] = s->gen_code_ptr - s->gen_code_start;
-    gen_movl_addr_im(s, CPU_FIELD_OFFSET(eip), next_eip);
-    gen_movl_addr_im(s, CPU_FIELD_OFFSET(tmp0), (uint32_t)tb | 1);
-    gjmp(s, (long)&exec_loop);
-
-    s->is_jmp = 1;
-}
-
-static void gen_eob(DisasContext *s)
-{
-    gen_movl_addr_im(s, CPU_FIELD_OFFSET(tmp0), 0);
-    gjmp(s, (long)&exec_loop);
-
-    s->is_jmp = 1;
-}
-
-static inline void gen_lea_modrm(DisasContext *s, int modrm)
-{
-    int havesib;
-    int base, disp;
-    int index;
-    int scale;
-    int mod, rm, code;
-
-    mod = (modrm >> 6) & 3;
-    rm = modrm & 7;
-
-    if (s->aflag) {
-
-        havesib = 0;
-        base = rm;
-        index = 0;
-        scale = 0;
-
-        if (base == 4) {
-            havesib = 1;
-            code = ldub_code(s->pc++);
-            scale = (code >> 6) & 3;
-            index = (code >> 3) & 7;
-            base = code & 7;
-        }
-
-        switch (mod) {
-        case 0:
-            if (base == 5) {
-                base = -1;
-                disp = ldl_code(s->pc);
-                s->pc += 4;
-            } else {
-                disp = 0;
-            }
-            break;
-        case 1:
-            disp = (int8_t)ldub_code(s->pc++);
-            break;
-        default:
-        case 2:
-            disp = ldl_code(s->pc);
-            s->pc += 4;
-            break;
-        }
-
-    } else {
-        switch (mod) {
-        case 0:
-            if (rm == 6) {
-                disp = lduw_code(s->pc);
-                s->pc += 2;
-            } else {
-                disp = 0;
-            }
-            break;
-        case 1:
-            disp = (int8_t)ldub_code(s->pc++);
-            break;
-        default:
-        case 2:
-            disp = lduw_code(s->pc);
-            s->pc += 2;
-            break;
-        }
-    }
-}
-
-static inline void parse_modrm(DisasContext *s, int modrm)
-{
-    if ((modrm & 0xc0) != 0xc0)
-        gen_lea_modrm(s, modrm);
-}
-
-static inline uint32_t insn_get(DisasContext *s, int ot)
-{
-    uint32_t ret;
-
-    switch(ot) {
-    case OT_BYTE:
-        ret = ldub_code(s->pc);
-        s->pc++;
-        break;
-    case OT_WORD:
-        ret = lduw_code(s->pc);
-        s->pc += 2;
-        break;
-    default:
-    case OT_LONG:
-        ret = ldl_code(s->pc);
-        s->pc += 4;
-        break;
-    }
-    return ret;
-}
-
-/* convert one instruction. s->is_jmp is set if the translation must
-   be stopped.  */
-static int disas_insn(DisasContext *s)
-{
-    target_ulong pc_start, pc_tmp, pc_start_insn;
-    int b, prefixes, aflag, dflag, next_eip, val;
-    int ot;
-    int modrm, mod, op, rm;
-
-    pc_start = s->pc;
-    prefixes = 0;
-    aflag = s->code32;
-    dflag = s->code32;
-    s->override = -1;
- next_byte:
-    b = ldub_code(s->pc);
-    s->pc++;
-    /* check prefixes */
-    switch (b) {
-    case 0xf3:
-        prefixes |= PREFIX_REPZ;
-        goto next_byte;
-    case 0xf2:
-        prefixes |= PREFIX_REPNZ;
-        goto next_byte;
-    case 0xf0:
-        prefixes |= PREFIX_LOCK;
-        goto next_byte;
-    case 0x2e:
-        s->override = R_CS;
-        goto next_byte;
-    case 0x36:
-        s->override = R_SS;
-        goto next_byte;
-    case 0x3e:
-        s->override = R_DS;
-        goto next_byte;
-    case 0x26:
-        s->override = R_ES;
-        goto next_byte;
-    case 0x64:
-        s->override = R_FS;
-        goto next_byte;
-    case 0x65:
-        s->override = R_GS;
-        goto next_byte;
-    case 0x66:
-        prefixes |= PREFIX_DATA;
-        goto next_byte;
-    case 0x67:
-        prefixes |= PREFIX_ADR;
-        goto next_byte;
-    }
-
-    if (prefixes & PREFIX_DATA)
-        dflag ^= 1;
-    if (prefixes & PREFIX_ADR)
-        aflag ^= 1;
-
-    s->prefix = prefixes;
-    s->aflag = aflag;
-    s->dflag = dflag;
-
-    /* lock generation */
-    if (prefixes & PREFIX_LOCK)
-        goto unsupported_op;
-    if (s->override == R_FS || s->override == R_GS || s->override == R_CS)
-        goto unsupported_op;
-
-    pc_start_insn = s->pc - 1;
-    /* now check op code */
- reswitch:
-    switch(b) {
-    case 0x0f:
-        /**************************/
-        /* extended op code */
-        b = ldub_code(s->pc++) | 0x100;
-        goto reswitch;
-
-        /**************************/
-        /* arith & logic */
-    case 0x00 ... 0x05:
-    case 0x08 ... 0x0d:
-    case 0x10 ... 0x15:
-    case 0x18 ... 0x1d:
-    case 0x20 ... 0x25:
-    case 0x28 ... 0x2d:
-    case 0x30 ... 0x35:
-    case 0x38 ... 0x3d:
-        {
-            int f;
-            f = (b >> 1) & 3;
-
-            if ((b & 1) == 0)
-                ot = OT_BYTE;
-            else
-                ot = dflag ? OT_LONG : OT_WORD;
-
-            switch(f) {
-            case 0: /* OP Ev, Gv */
-                modrm = ldub_code(s->pc++);
-                parse_modrm(s, modrm);
-                break;
-            case 1: /* OP Gv, Ev */
-                modrm = ldub_code(s->pc++);
-                parse_modrm(s, modrm);
-                break;
-            case 2: /* OP A, Iv */
-                insn_get(s, ot);
-                break;
-            }
-        }
-        break;
-
-    case 0x80: /* GRP1 */
-    case 0x81:
-    case 0x82:
-    case 0x83:
-        {
-            if ((b & 1) == 0)
-                ot = OT_BYTE;
-            else
-                ot = dflag ? OT_LONG : OT_WORD;
-
-            modrm = ldub_code(s->pc++);
-            parse_modrm(s, modrm);
-
-            switch(b) {
-            default:
-            case 0x80:
-            case 0x81:
-            case 0x82:
-                insn_get(s, ot);
-                break;
-            case 0x83:
-                insn_get(s, OT_BYTE);
-                break;
-            }
-        }
-        break;
-
-        /**************************/
-        /* inc, dec, and other misc arith */
-    case 0x40 ... 0x47: /* inc Gv */
-        break;
-    case 0x48 ... 0x4f: /* dec Gv */
-        break;
-    case 0xf6: /* GRP3 */
-    case 0xf7:
-        if ((b & 1) == 0)
-            ot = OT_BYTE;
-        else
-            ot = dflag ? OT_LONG : OT_WORD;
-
-        modrm = ldub_code(s->pc++);
-        op = (modrm >> 3) & 7;
-        parse_modrm(s, modrm);
-
-        switch(op) {
-        case 0: /* test */
-            insn_get(s, ot);
-            break;
-        case 2: /* not */
-            break;
-        case 3: /* neg */
-            break;
-        case 4: /* mul */
-            break;
-        case 5: /* imul */
-            break;
-        case 6: /* div */
-            break;
-        case 7: /* idiv */
-            break;
-        default:
-            goto illegal_op;
-        }
-        break;
-
-    case 0xfe: /* GRP4 */
-    case 0xff: /* GRP5 */
-        if ((b & 1) == 0)
-            ot = OT_BYTE;
-        else
-            ot = dflag ? OT_LONG : OT_WORD;
-
-        modrm = ldub_code(s->pc++);
-        mod = (modrm >> 6) & 3;
-        op = (modrm >> 3) & 7;
-        if (op >= 2 && b == 0xfe) {
-            goto illegal_op;
-        }
-        pc_tmp = s->pc;
-        parse_modrm(s, modrm);
-
-        switch(op) {
-        case 0: /* inc Ev */
-            break;
-        case 1: /* dec Ev */
-            break;
-        case 2: /* call Ev */
-            /* XXX: optimize and handle MEM exceptions specifically
-               fs movl %eax, regs[0]
-               movl Ev, %eax
-               pushl next_eip
-               fs movl %eax, eip
-            */
-            goto unsupported_op;
-        case 3: /* lcall Ev */
-            goto unsupported_op;
-        case 4: /* jmp Ev */
-            /* XXX: optimize and handle MEM exceptions specifically
-               fs movl %eax, regs[0]
-               movl Ev, %eax
-               fs movl %eax, eip
-            */
-            goto unsupported_op;
-        case 5: /* ljmp Ev */
-            goto unsupported_op;
-        case 6: /* push Ev */
-            break;
-        default:
-            goto illegal_op;
-        }
-        break;
-    case 0xa8: /* test eAX, Iv */
-    case 0xa9:
-        if ((b & 1) == 0)
-            ot = OT_BYTE;
-        else
-            ot = dflag ? OT_LONG : OT_WORD;
-        insn_get(s, ot);
-        break;
-
-    case 0x98: /* CWDE/CBW */
-        break;
-    case 0x99: /* CDQ/CWD */
-        break;
-    case 0x1af: /* imul Gv, Ev */
-    case 0x69: /* imul Gv, Ev, I */
-    case 0x6b:
-        ot = dflag ? OT_LONG : OT_WORD;
-        modrm = ldub_code(s->pc++);
-        parse_modrm(s, modrm);
-        if (b == 0x69) {
-            insn_get(s, ot);
-        } else if (b == 0x6b) {
-            insn_get(s, OT_BYTE);
-        } else {
-        }
-        break;
-
-    case 0x84: /* test Ev, Gv */
-    case 0x85:
-
-    case 0x1c0:
-    case 0x1c1: /* xadd Ev, Gv */
-
-    case 0x1b0:
-    case 0x1b1: /* cmpxchg Ev, Gv */
-
-    case 0x8f: /* pop Ev */
-
-    case 0x88:
-    case 0x89: /* mov Gv, Ev */
-
-    case 0x8a:
-    case 0x8b: /* mov Ev, Gv */
-
-    case 0x1b6: /* movzbS Gv, Eb */
-    case 0x1b7: /* movzwS Gv, Eb */
-    case 0x1be: /* movsbS Gv, Eb */
-    case 0x1bf: /* movswS Gv, Eb */
-
-    case 0x86:
-    case 0x87: /* xchg Ev, Gv */
-
-    case 0xd0:
-    case 0xd1: /* shift Ev,1 */
-
-    case 0xd2:
-    case 0xd3: /* shift Ev,cl */
-
-    case 0x1a5: /* shld cl */
-    case 0x1ad: /* shrd cl */
-
-    case 0x190 ... 0x19f: /* setcc Gv */
-
-    /* XXX: emulate cmov if not available ? */
-    case 0x140 ... 0x14f: /* cmov Gv, Ev */
-
-    case 0x1a3: /* bt Gv, Ev */
-    case 0x1ab: /* bts */
-    case 0x1b3: /* btr */
-    case 0x1bb: /* btc */
-
-    case 0x1bc: /* bsf */
-    case 0x1bd: /* bsr */
-
-        modrm = ldub_code(s->pc++);
-        parse_modrm(s, modrm);
-        break;
-
-    case 0x1c7: /* cmpxchg8b */
-        modrm = ldub_code(s->pc++);
-        mod = (modrm >> 6) & 3;
-        if (mod == 3)
-            goto illegal_op;
-        parse_modrm(s, modrm);
-        break;
-
-        /**************************/
-        /* push/pop */
-    case 0x50 ... 0x57: /* push */
-    case 0x58 ... 0x5f: /* pop */
-    case 0x60: /* pusha */
-    case 0x61: /* popa */
-        break;
-
-    case 0x68: /* push Iv */
-    case 0x6a:
-        ot = dflag ? OT_LONG : OT_WORD;
-        if (b == 0x68)
-            insn_get(s, ot);
-        else
-            insn_get(s, OT_BYTE);
-        break;
-    case 0xc8: /* enter */
-        lduw_code(s->pc);
-        s->pc += 2;
-        ldub_code(s->pc++);
-        break;
-    case 0xc9: /* leave */
-        break;
-
-    case 0x06: /* push es */
-    case 0x0e: /* push cs */
-    case 0x16: /* push ss */
-    case 0x1e: /* push ds */
-        /* XXX: optimize:
-         push segs[n].selector
-        */
-        goto unsupported_op;
-    case 0x1a0: /* push fs */
-    case 0x1a8: /* push gs */
-        goto unsupported_op;
-    case 0x07: /* pop es */
-    case 0x17: /* pop ss */
-    case 0x1f: /* pop ds */
-        goto unsupported_op;
-    case 0x1a1: /* pop fs */
-    case 0x1a9: /* pop gs */
-        goto unsupported_op;
-    case 0x8e: /* mov seg, Gv */
-        /* XXX: optimize:
-           fs movl r, regs[]
-           movl segs[].selector, r
-           mov r, Gv
-           fs movl regs[], r
-        */
-        goto unsupported_op;
-    case 0x8c: /* mov Gv, seg */
-        goto unsupported_op;
-    case 0xc4: /* les Gv */
-        op = R_ES;
-        goto do_lxx;
-    case 0xc5: /* lds Gv */
-        op = R_DS;
-        goto do_lxx;
-    case 0x1b2: /* lss Gv */
-        op = R_SS;
-        goto do_lxx;
-    case 0x1b4: /* lfs Gv */
-        op = R_FS;
-        goto do_lxx;
-    case 0x1b5: /* lgs Gv */
-        op = R_GS;
-    do_lxx:
-        goto unsupported_op;
-        /************************/
-        /* floats */
-    case 0xd8 ... 0xdf:
-#if 1
-        /* currently not stable enough */
-        goto unsupported_op;
-#else
-        if (s->flags & (HF_EM_MASK | HF_TS_MASK))
-            goto unsupported_op;
-#endif
-#if 0
-        /* for testing FPU context switch */
-        {
-            static int count;
-            count = (count + 1) % 3;
-            if (count != 0)
-                goto unsupported_op;
-        }
-#endif
-        modrm = ldub_code(s->pc++);
-        mod = (modrm >> 6) & 3;
-        rm = modrm & 7;
-        op = ((b & 7) << 3) | ((modrm >> 3) & 7);
-        if (mod != 3) {
-            /* memory op */
-            parse_modrm(s, modrm);
-            switch(op) {
-            case 0x00 ... 0x07: /* fxxxs */
-            case 0x10 ... 0x17: /* fixxxl */
-            case 0x20 ... 0x27: /* fxxxl */
-            case 0x30 ... 0x37: /* fixxx */
-                break;
-            case 0x08: /* flds */
-            case 0x0a: /* fsts */
-            case 0x0b: /* fstps */
-            case 0x18: /* fildl */
-            case 0x1a: /* fistl */
-            case 0x1b: /* fistpl */
-            case 0x28: /* fldl */
-            case 0x2a: /* fstl */
-            case 0x2b: /* fstpl */
-            case 0x38: /* filds */
-            case 0x3a: /* fists */
-            case 0x3b: /* fistps */
-            case 0x0c: /* fldenv mem */
-            case 0x0d: /* fldcw mem */
-            case 0x0e: /* fnstenv mem */
-            case 0x0f: /* fnstcw mem */
-            case 0x1d: /* fldt mem */
-            case 0x1f: /* fstpt mem */
-            case 0x2c: /* frstor mem */
-            case 0x2e: /* fnsave mem */
-            case 0x2f: /* fnstsw mem */
-            case 0x3c: /* fbld */
-            case 0x3e: /* fbstp */
-            case 0x3d: /* fildll */
-            case 0x3f: /* fistpll */
-                break;
-            default:
-                goto illegal_op;
-            }
-        } else {
-            /* register float ops */
-            switch(op) {
-            case 0x08: /* fld sti */
-            case 0x09: /* fxchg sti */
-                break;
-            case 0x0a: /* grp d9/2 */
-                switch(rm) {
-                case 0: /* fnop */
-                    break;
-                default:
-                    goto illegal_op;
-                }
-                break;
-            case 0x0c: /* grp d9/4 */
-                switch(rm) {
-                case 0: /* fchs */
-                case 1: /* fabs */
-                case 4: /* ftst */
-                case 5: /* fxam */
-                    break;
-                default:
-                    goto illegal_op;
-                }
-                break;
-            case 0x0d: /* grp d9/5 */
-                switch(rm) {
-                case 0:
-                case 1:
-                case 2:
-                case 3:
-                case 4:
-                case 5:
-                case 6:
-                    break;
-                default:
-                    goto illegal_op;
-                }
-                break;
-            case 0x0e: /* grp d9/6 */
-                break;
-            case 0x0f: /* grp d9/7 */
-                break;
-            case 0x00: case 0x01: case 0x04 ... 0x07: /* fxxx st, sti */
-            case 0x20: case 0x21: case 0x24 ... 0x27: /* fxxx sti, st */
-            case 0x30: case 0x31: case 0x34 ... 0x37: /* fxxxp sti, st */
-                break;
-            case 0x02: /* fcom */
-                break;
-            case 0x03: /* fcomp */
-                break;
-            case 0x15: /* da/5 */
-                switch(rm) {
-                case 1: /* fucompp */
-                    break;
-                default:
-                    goto illegal_op;
-                }
-                break;
-            case 0x1c:
-                switch(rm) {
-                case 0: /* feni (287 only, just do nop here) */
-                case 1: /* fdisi (287 only, just do nop here) */
-                    goto unsupported_op;
-                case 2: /* fclex */
-                case 3: /* fninit */
-                case 4: /* fsetpm (287 only, just do nop here) */
-                    break;
-                default:
-                    goto illegal_op;
-                }
-                break;
-            case 0x1d: /* fucomi */
-                break;
-            case 0x1e: /* fcomi */
-                break;
-            case 0x28: /* ffree sti */
-                break;
-            case 0x2a: /* fst sti */
-                break;
-            case 0x2b: /* fstp sti */
-                break;
-            case 0x2c: /* fucom st(i) */
-                break;
-            case 0x2d: /* fucomp st(i) */
-                break;
-            case 0x33: /* de/3 */
-                switch(rm) {
-                case 1: /* fcompp */
-                    break;
-                default:
-                    goto illegal_op;
-                }
-                break;
-            case 0x3c: /* df/4 */
-                switch(rm) {
-                case 0:
-                    break;
-                default:
-                    goto illegal_op;
-                }
-                break;
-            case 0x3d: /* fucomip */
-                break;
-            case 0x3e: /* fcomip */
-                break;
-            case 0x10 ... 0x13: /* fcmovxx */
-            case 0x18 ... 0x1b:
-                break;
-            default:
-                goto illegal_op;
-            }
-        }
-        s->tb->cflags |= CF_TB_FP_USED;
-        break;
-
-        /**************************/
-        /* mov */
-    case 0xc6:
-    case 0xc7: /* mov Ev, Iv */
-        if ((b & 1) == 0)
-            ot = OT_BYTE;
-        else
-            ot = dflag ? OT_LONG : OT_WORD;
-        modrm = ldub_code(s->pc++);
-        parse_modrm(s, modrm);
-        insn_get(s, ot);
-        break;
-
-    case 0x8d: /* lea */
-        ot = dflag ? OT_LONG : OT_WORD;
-        modrm = ldub_code(s->pc++);
-        mod = (modrm >> 6) & 3;
-        if (mod == 3)
-            goto illegal_op;
-        parse_modrm(s, modrm);
-        break;
-
-    case 0xa0: /* mov EAX, Ov */
-    case 0xa1:
-    case 0xa2: /* mov Ov, EAX */
-    case 0xa3:
-        if ((b & 1) == 0)
-            ot = OT_BYTE;
-        else
-            ot = dflag ? OT_LONG : OT_WORD;
-        if (s->aflag)
-            insn_get(s, OT_LONG);
-        else
-            insn_get(s, OT_WORD);
-        break;
-    case 0xd7: /* xlat */
-        break;
-    case 0xb0 ... 0xb7: /* mov R, Ib */
-        insn_get(s, OT_BYTE);
-        break;
-    case 0xb8 ... 0xbf: /* mov R, Iv */
-        ot = dflag ? OT_LONG : OT_WORD;
-        insn_get(s, ot);
-        break;
-
-    case 0x91 ... 0x97: /* xchg R, EAX */
-        break;
-
-        /************************/
-        /* shifts */
-    case 0xc0:
-    case 0xc1: /* shift Ev,imm */
-
-    case 0x1a4: /* shld imm */
-    case 0x1ac: /* shrd imm */
-        modrm = ldub_code(s->pc++);
-        parse_modrm(s, modrm);
-        ldub_code(s->pc++);
-        break;
-
-        /************************/
-        /* string ops */
-
-    case 0xa4: /* movsS */
-    case 0xa5:
-        break;
-
-    case 0xaa: /* stosS */
-    case 0xab:
-        break;
-
-    case 0xac: /* lodsS */
-    case 0xad:
-        break;
-
-    case 0xae: /* scasS */
-    case 0xaf:
-        break;
-
-    case 0xa6: /* cmpsS */
-    case 0xa7:
-        break;
-
-    case 0x6c: /* insS */
-    case 0x6d:
-        goto unsupported_op;
-
-    case 0x6e: /* outsS */
-    case 0x6f:
-        goto unsupported_op;
-
-        /************************/
-        /* port I/O */
-    case 0xe4:
-    case 0xe5:
-        goto unsupported_op;
-
-    case 0xe6:
-    case 0xe7:
-        goto unsupported_op;
-
-    case 0xec:
-    case 0xed:
-        goto unsupported_op;
-
-    case 0xee:
-    case 0xef:
-        goto unsupported_op;
-
-        /************************/
-        /* control */
-#if 0
-    case 0xc2: /* ret im */
-        val = ldsw_code(s->pc);
-        s->pc += 2;
-        gen_pop_T0(s);
-        gen_stack_update(s, val + (2 << s->dflag));
-        if (s->dflag == 0)
-            gen_op_andl_T0_ffff();
-        gen_op_jmp_T0();
-        gen_eob(s);
-        break;
-#endif
-
-    case 0xc3: /* ret */
-        gb(s, CPU_SEG);
-        if (!s->dflag)
-            gb(s, 0x66); /* d16 */
-        gb(s, 0x8f); /* pop addr */
-        gb(s, 0x05);
-        gl(s, CPU_FIELD_OFFSET(eip));
-        if (!s->dflag) {
-            /* reset high bits of EIP */
-            gen_movw_addr_im(s, CPU_FIELD_OFFSET(eip) + 2, 0);
-        }
-        gen_eob(s);
-        goto no_copy;
-    case 0xca: /* lret im */
-    case 0xcb: /* lret */
-    case 0xcf: /* iret */
-    case 0x9a: /* lcall im */
-    case 0xea: /* ljmp im */
-        goto unsupported_op;
-
-    case 0xe8: /* call im */
-        ot = dflag ? OT_LONG : OT_WORD;
-        val = insn_get(s, ot);
-        next_eip = s->pc - s->cs_base;
-        val += next_eip;
-        if (s->dflag) {
-            gb(s, 0x68); /* pushl imm */
-            gl(s, next_eip);
-        } else {
-            gb(s, 0x66); /* pushw imm */
-            gb(s, 0x68);
-            gw(s, next_eip);
-            val &= 0xffff;
-        }
-        gen_jmp(s, val);
-        goto no_copy;
-    case 0xe9: /* jmp */
-        ot = dflag ? OT_LONG : OT_WORD;
-        val = insn_get(s, ot);
-        val += s->pc - s->cs_base;
-        if (s->dflag == 0)
-            val = val & 0xffff;
-        gen_jmp(s, val);
-        goto no_copy;
-    case 0xeb: /* jmp Jb */
-        val = (int8_t)insn_get(s, OT_BYTE);
-        val += s->pc - s->cs_base;
-        if (s->dflag == 0)
-            val = val & 0xffff;
-        gen_jmp(s, val);
-        goto no_copy;
-    case 0x70 ... 0x7f: /* jcc Jb */
-        val = (int8_t)insn_get(s, OT_BYTE);
-        goto do_jcc;
-    case 0x180 ... 0x18f: /* jcc Jv */
-        if (dflag) {
-            val = insn_get(s, OT_LONG);
-        } else {
-            val = (int16_t)insn_get(s, OT_WORD);
-        }
-    do_jcc:
-        next_eip = s->pc - s->cs_base;
-        val += next_eip;
-        if (s->dflag == 0)
-            val &= 0xffff;
-        gen_jcc(s, b & 0xf, val, next_eip);
-        goto no_copy;
-
-        /************************/
-        /* flags */
-    case 0x9c: /* pushf */
-        /* XXX: put specific code ? */
-        goto unsupported_op;
-    case 0x9d: /* popf */
-        goto unsupported_op;
-
-    case 0x9e: /* sahf */
-    case 0x9f: /* lahf */
-    case 0xf5: /* cmc */
-    case 0xf8: /* clc */
-    case 0xf9: /* stc */
-    case 0xfc: /* cld */
-    case 0xfd: /* std */
-        break;
-
-        /************************/
-        /* bit operations */
-    case 0x1ba: /* bt/bts/btr/btc Gv, im */
-        ot = dflag ? OT_LONG : OT_WORD;
-        modrm = ldub_code(s->pc++);
-        op = (modrm >> 3) & 7;
-        parse_modrm(s, modrm);
-        /* load shift */
-        ldub_code(s->pc++);
-        if (op < 4)
-            goto illegal_op;
-        break;
-        /************************/
-        /* bcd */
-    case 0x27: /* daa */
-        break;
-    case 0x2f: /* das */
-        break;
-    case 0x37: /* aaa */
-        break;
-    case 0x3f: /* aas */
-        break;
-    case 0xd4: /* aam */
-        ldub_code(s->pc++);
-        break;
-    case 0xd5: /* aad */
-        ldub_code(s->pc++);
-        break;
-        /************************/
-        /* misc */
-    case 0x90: /* nop */
-        break;
-    case 0x9b: /* fwait */
-        if ((s->flags & (HF_MP_MASK | HF_TS_MASK)) ==
-            (HF_MP_MASK | HF_TS_MASK)) {
-            goto unsupported_op;
-        }
-        break;
-    case 0xcc: /* int3 */
-        goto unsupported_op;
-    case 0xcd: /* int N */
-        goto unsupported_op;
-    case 0xce: /* into */
-        goto unsupported_op;
-    case 0xf1: /* icebp (undocumented, exits to external debugger) */
-        goto unsupported_op;
-    case 0xfa: /* cli */
-        goto unsupported_op;
-    case 0xfb: /* sti */
-        goto unsupported_op;
-    case 0x62: /* bound */
-        modrm = ldub_code(s->pc++);
-        mod = (modrm >> 6) & 3;
-        if (mod == 3)
-            goto illegal_op;
-        parse_modrm(s, modrm);
-        break;
-    case 0x1c8 ... 0x1cf: /* bswap reg */
-        break;
-    case 0xd6: /* salc */
-        break;
-    case 0xe0: /* loopnz */
-    case 0xe1: /* loopz */
-    case 0xe2: /* loop */
-    case 0xe3: /* jecxz */
-        goto unsupported_op;
-
-    case 0x130: /* wrmsr */
-    case 0x132: /* rdmsr */
-        goto unsupported_op;
-    case 0x131: /* rdtsc */
-        goto unsupported_op;
-    case 0x1a2: /* cpuid */
-        goto unsupported_op;
-    case 0xf4: /* hlt */
-        goto unsupported_op;
-    case 0x100:
-        goto unsupported_op;
-    case 0x101:
-        goto unsupported_op;
-    case 0x108: /* invd */
-    case 0x109: /* wbinvd */
-        goto unsupported_op;
-    case 0x63: /* arpl */
-        goto unsupported_op;
-    case 0x102: /* lar */
-    case 0x103: /* lsl */
-        goto unsupported_op;
-    case 0x118:
-        goto unsupported_op;
-    case 0x120: /* mov reg, crN */
-    case 0x122: /* mov crN, reg */
-        goto unsupported_op;
-    case 0x121: /* mov reg, drN */
-    case 0x123: /* mov drN, reg */
-        goto unsupported_op;
-    case 0x106: /* clts */
-        goto unsupported_op;
-    default:
-        goto illegal_op;
-    }
-
-    /* just copy the code */
-
-    /* no override yet */
-    if (!s->dflag)
-        gb(s, 0x66);
-    if (!s->aflag)
-        gb(s, 0x67);
-    if (prefixes & PREFIX_REPZ)
-        gb(s, 0xf3);
-    else if (prefixes & PREFIX_REPNZ)
-        gb(s, 0xf2);
-    {
-        int len, i;
-        len = s->pc - pc_start_insn;
-        for(i = 0; i < len; i++) {
-            *s->gen_code_ptr++ = ldub_code(pc_start_insn + i);
-        }
-    }
- no_copy:
-    return 0;
- illegal_op:
- unsupported_op:
-    /* fall back to slower code gen necessary */
-    s->pc = pc_start;
-    return -1;
-}
-
-#define GEN_CODE_MAX_SIZE      8192
-#define GEN_CODE_MAX_INSN_SIZE 512
-
-static inline int gen_intermediate_code_internal(CPUState *env,
-                                                 TranslationBlock *tb,
-                                                 uint8_t *gen_code_ptr,
-                                                 int *gen_code_size_ptr,
-                                                 int search_pc,
-                                                 uint8_t *tc_ptr)
-{
-    DisasContext dc1, *dc = &dc1;
-    target_ulong pc_insn, pc_start, cs_base;
-    uint8_t *gen_code_end;
-    int flags, ret;
-
-    if (env->nb_breakpoints > 0 ||
-        env->singlestep_enabled)
-        return -1;
-    flags = tb->flags;
-    if (flags & (HF_TF_MASK | HF_ADDSEG_MASK |
-                 HF_SOFTMMU_MASK | HF_INHIBIT_IRQ_MASK))
-        return -1;
-    if (!(flags & HF_SS32_MASK))
-        return -1;
-    if (tb->cflags & CF_SINGLE_INSN)
-        return -1;
-    gen_code_end = gen_code_ptr +
-        GEN_CODE_MAX_SIZE - GEN_CODE_MAX_INSN_SIZE;
-    dc->gen_code_ptr = gen_code_ptr;
-    dc->gen_code_start = gen_code_ptr;
-
-    /* generate intermediate code */
-    pc_start = tb->pc;
-    cs_base = tb->cs_base;
-    dc->pc = pc_start;
-    dc->cs_base = cs_base;
-    dc->pe = (flags >> HF_PE_SHIFT) & 1;
-    dc->code32 = (flags >> HF_CS32_SHIFT) & 1;
-    dc->f_st = 0;
-    dc->vm86 = (flags >> VM_SHIFT) & 1;
-    dc->cpl = (flags >> HF_CPL_SHIFT) & 3;
-    dc->iopl = (flags >> IOPL_SHIFT) & 3;
-    dc->tb = tb;
-    dc->flags = flags;
-
-    dc->is_jmp = 0;
-
-    for(;;) {
-        pc_insn = dc->pc;
-        ret = disas_insn(dc);
-        if (ret < 0) {
-            /* unsupported insn */
-            if (dc->pc == pc_start) {
-                /* if first instruction, signal that no copying was done */
-                return -1;
-            } else {
-                gen_jmp(dc, dc->pc - dc->cs_base);
-                dc->is_jmp = 1;
-            }
-        }
-        if (search_pc) {
-            /* search pc mode */
-            if (tc_ptr < dc->gen_code_ptr) {
-                env->eip = pc_insn - cs_base;
-                return 0;
-            }
-        }
-        /* stop translation if indicated */
-        if (dc->is_jmp)
-            break;
-        /* if too long translation, stop generation */
-        if (dc->gen_code_ptr >= gen_code_end ||
-            (dc->pc - pc_start) >= (TARGET_PAGE_SIZE - 32)) {
-            gen_jmp(dc, dc->pc - dc->cs_base);
-            break;
-        }
-    }
-
-#ifdef DEBUG_DISAS
-    if (loglevel & CPU_LOG_TB_IN_ASM) {
-        fprintf(logfile, "----------------\n");
-        fprintf(logfile, "IN: COPY: %s fpu=%d\n",
-                lookup_symbol(pc_start),
-                tb->cflags & CF_TB_FP_USED ? 1 : 0);
-	target_disas(logfile, pc_start, dc->pc - pc_start, !dc->code32);
-        fprintf(logfile, "\n");
-    }
-#endif
-
-    if (!search_pc) {
-        *gen_code_size_ptr = dc->gen_code_ptr - dc->gen_code_start;
-        tb->size = dc->pc - pc_start;
-        tb->cflags |= CF_CODE_COPY;
-        return 0;
-    } else {
-        return -1;
-    }
-}
-
-/* generate code by just copying data. Return -1 if cannot generate
-   any code. Return 0 if code was generated */
-int cpu_gen_code_copy(CPUState *env, TranslationBlock *tb,
-                      int max_code_size, int *gen_code_size_ptr)
-{
-    /* generate machine code */
-    tb->tb_next_offset[0] = 0xffff;
-    tb->tb_next_offset[1] = 0xffff;
-#ifdef USE_DIRECT_JUMP
-    /* the following two entries are optional (only used for string ops) */
-    tb->tb_jmp_offset[2] = 0xffff;
-    tb->tb_jmp_offset[3] = 0xffff;
-#endif
-    return gen_intermediate_code_internal(env, tb,
-                                          tb->tc_ptr, gen_code_size_ptr,
-                                          0, NULL);
-}
-
-static uint8_t dummy_gen_code_buf[GEN_CODE_MAX_SIZE];
-
-int cpu_restore_state_copy(TranslationBlock *tb,
-                           CPUState *env, unsigned long searched_pc,
-                           void *puc)
-{
-    struct ucontext *uc = puc;
-    int ret, eflags;
-
-    /* find opc index corresponding to search_pc */
-    if (searched_pc < (unsigned long)tb->tc_ptr)
-        return -1;
-    searched_pc = searched_pc - (long)tb->tc_ptr + (long)dummy_gen_code_buf;
-    ret = gen_intermediate_code_internal(env, tb,
-                                         dummy_gen_code_buf, NULL,
-                                         1, (uint8_t *)searched_pc);
-    if (ret < 0)
-        return ret;
-    /* restore all the CPU state from the CPU context from the
-       signal. The FPU context stays in the host CPU. */
-
-    env->regs[R_EAX] = uc->uc_mcontext.gregs[REG_EAX];
-    env->regs[R_ECX] = uc->uc_mcontext.gregs[REG_ECX];
-    env->regs[R_EDX] = uc->uc_mcontext.gregs[REG_EDX];
-    env->regs[R_EBX] = uc->uc_mcontext.gregs[REG_EBX];
-    env->regs[R_ESP] = uc->uc_mcontext.gregs[REG_ESP];
-    env->regs[R_EBP] = uc->uc_mcontext.gregs[REG_EBP];
-    env->regs[R_ESI] = uc->uc_mcontext.gregs[REG_ESI];
-    env->regs[R_EDI] = uc->uc_mcontext.gregs[REG_EDI];
-    eflags = uc->uc_mcontext.gregs[REG_EFL];
-    env->df = 1 - (2 * ((eflags >> 10) & 1));
-    env->cc_src = eflags & (CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
-    env->cc_op = CC_OP_EFLAGS;
-    return 0;
-}
-
-#endif /* USE_CODE_COPY */
diff --git a/target-i386/translate.c b/target-i386/translate.c
index cd9541265..579831ef7 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -4888,9 +4888,6 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start)
                 goto illegal_op;
             }
         }
-#ifdef USE_CODE_COPY
-        s->tb->cflags |= CF_TB_FP_USED;
-#endif
         break;
         /************************/
         /* string ops */
@@ -5661,6 +5658,10 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start)
         gen_jmp_im(pc_start - s->cs_base);
         gen_op_rdtsc();
         break;
+    case 0x133: /* rdpmc */
+        gen_jmp_im(pc_start - s->cs_base);
+        gen_op_rdpmc();
+        break;
     case 0x134: /* sysenter */
         if (CODE64(s))
             goto illegal_op;
@@ -6010,7 +6011,7 @@ static target_ulong disas_insn(DisasContext *s, target_ulong pc_start)
         if (s->cpl != 0) {
             gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
         } else {
-            if (gen_svm_check_intercept(s, pc_start, SVM_EXIT_INVD))
+            if (gen_svm_check_intercept(s, pc_start, (b & 2) ? SVM_EXIT_INVD : SVM_EXIT_WBINVD))
                 break;
             /* nothing to do */
         }
diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index a34c13734..732929bfa 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -53,6 +53,8 @@
 #define EXCP_RTE            0x100
 #define EXCP_HALT_INSN      0x101
 
+#define NB_MMU_MODES 2
+
 typedef struct CPUM68KState {
     uint32_t dregs[8];
     uint32_t aregs[8];
@@ -98,8 +100,6 @@ typedef struct CPUM68KState {
     uint32_t rambar0;
     uint32_t cacr;
 
-    uint32_t features;
-
     /* ??? remove this.  */
     uint32_t t1;
 
@@ -116,9 +116,11 @@ typedef struct CPUM68KState {
     uint32_t qregs[MAX_QREGS];
 
     CPU_COMMON
+
+    uint32_t features;
 } CPUM68KState;
 
-CPUM68KState *cpu_m68k_init(void);
+CPUM68KState *cpu_m68k_init(const char *cpu_model);
 int cpu_m68k_exec(CPUM68KState *s);
 void cpu_m68k_close(CPUM68KState *s);
 void do_interrupt(int is_hw);
@@ -172,10 +174,6 @@ enum {
 #define MACSR_V     0x002
 #define MACSR_EV    0x001
 
-typedef struct m68k_def_t m68k_def_t;
-
-int cpu_m68k_set_model(CPUM68KState *env, const char * name);
-
 void m68k_set_irq_level(CPUM68KState *env, int level, uint8_t vector);
 void m68k_set_macsr(CPUM68KState *env, uint32_t val);
 void m68k_switch_sp(CPUM68KState *env);
@@ -223,6 +221,15 @@ void register_m68k_insns (CPUM68KState *env);
 #define cpu_gen_code cpu_m68k_gen_code
 #define cpu_signal_handler cpu_m68k_signal_handler
 
+/* MMU modes definitions */
+#define MMU_MODE0_SUFFIX _kernel
+#define MMU_MODE1_SUFFIX _user
+#define MMU_USER_IDX 1
+static inline int cpu_mmu_index (CPUState *env)
+{
+    return (env->sr & SR_S) == 0 ? 1 : 0;
+}
+
 #include "cpu-all.h"
 
 #endif
diff --git a/target-m68k/exec.h b/target-m68k/exec.h
index dc5bf5e60..b9e13ef04 100644
--- a/target-m68k/exec.h
+++ b/target-m68k/exec.h
@@ -38,7 +38,7 @@ static inline void regs_to_env(void)
 }
 
 int cpu_m68k_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int is_user, int is_softmmu);
+                              int mmu_idx, int is_softmmu);
 
 #if !defined(CONFIG_USER_ONLY)
 #include "softmmu_exec.h"
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index 423a0e00a..c63964891 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -33,6 +33,8 @@ enum m68k_cpuid {
     M68K_CPUID_ANY,
 };
 
+typedef struct m68k_def_t m68k_def_t;
+
 struct m68k_def_t {
     const char * name;
     enum m68k_cpuid id;
@@ -51,7 +53,7 @@ static void m68k_set_feature(CPUM68KState *env, int feature)
     env->features |= (1u << feature);
 }
 
-int cpu_m68k_set_model(CPUM68KState *env, const char * name)
+static int cpu_m68k_set_model(CPUM68KState *env, const char *name)
 {
     m68k_def_t *def;
 
@@ -60,7 +62,7 @@ int cpu_m68k_set_model(CPUM68KState *env, const char * name)
             break;
     }
     if (!def->name)
-        return 1;
+        return -1;
 
     switch (def->id) {
     case M68K_CPUID_M5206:
@@ -98,10 +100,48 @@ int cpu_m68k_set_model(CPUM68KState *env, const char * name)
     }
 
     register_m68k_insns(env);
-
     return 0;
 }
 
+void cpu_reset(CPUM68KState *env)
+{
+    memset(env, 0, offsetof(CPUM68KState, breakpoints));
+#if !defined (CONFIG_USER_ONLY)
+    env->sr = 0x2700;
+#endif
+    m68k_switch_sp(env);
+    /* ??? FP regs should be initialized to NaN.  */
+    env->cc_op = CC_OP_FLAGS;
+    /* TODO: We should set PC from the interrupt vector.  */
+    env->pc = 0;
+    tlb_flush(env, 1);
+}
+
+CPUM68KState *cpu_m68k_init(const char *cpu_model)
+{
+    CPUM68KState *env;
+
+    env = malloc(sizeof(CPUM68KState));
+    if (!env)
+        return NULL;
+    cpu_exec_init(env);
+
+    env->cpu_model_str = cpu_model;
+
+    if (cpu_m68k_set_model(env, cpu_model) < 0) {
+        cpu_m68k_close(env);
+        return NULL;
+    }
+
+    cpu_reset(env);
+    return env;
+}
+
+void cpu_m68k_close(CPUM68KState *env)
+{
+    qemu_free(env);
+}
+
 void cpu_m68k_flush_flags(CPUM68KState *env, int cc_op)
 {
     int flags;
@@ -217,7 +257,7 @@ float64 helper_sub_cmpf64(CPUM68KState *env, float64 src0, float64 src1)
         /* +/-inf compares equal against itself, but sub returns nan.  */
         if (!float64_is_nan(src0)
             && !float64_is_nan(src1)) {
-            res = 0;
+            res = float64_zero;
             if (float64_lt_quiet(src0, res, &env->fp_status))
                 res = float64_chs(res);
         }
@@ -301,7 +341,7 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 #if defined(CONFIG_USER_ONLY)
 
 int cpu_m68k_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                               int is_user, int is_softmmu)
+                               int mmu_idx, int is_softmmu)
 {
     env->exception_index = EXCP_ACCESS;
     env->mmu.ar = address;
@@ -311,13 +351,13 @@ int cpu_m68k_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
 #else
 
 int cpu_m68k_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                               int is_user, int is_softmmu)
+                               int mmu_idx, int is_softmmu)
 {
     int prot;
 
     address &= TARGET_PAGE_MASK;
     prot = PAGE_READ | PAGE_WRITE;
-    return tlb_set_page(env, address, address, prot, is_user, is_softmmu);
+    return tlb_set_page(env, address, address, prot, mmu_idx, is_softmmu);
 }
 
 /* Notify CPU of a pending interrupt.  Prioritization and vectoring should
diff --git a/target-m68k/op.c b/target-m68k/op.c
index 8600f43f1..140c71d89 100644
--- a/target-m68k/op.c
+++ b/target-m68k/op.c
@@ -108,7 +108,7 @@ OP(movf64)
 
 OP(zerof64)
 {
-    set_opf64(PARAM1, 0);
+    set_opf64(PARAM1, float64_zero);
     FORCE_RET();
 }
 
diff --git a/target-m68k/op_helper.c b/target-m68k/op_helper.c
index 70b7aec0e..547f13da5 100644
--- a/target-m68k/op_helper.c
+++ b/target-m68k/op_helper.c
@@ -31,7 +31,11 @@ void do_interrupt(int is_hw)
 extern int semihosting_enabled;
 
 #define MMUSUFFIX _mmu
-#define GETPC() (__builtin_return_address(0))
+#ifdef __s390__
+# define GETPC() ((void*)((unsigned long)__builtin_return_address(0) & 0x7fffffffUL))
+#else
+# define GETPC() (__builtin_return_address(0))
+#endif
 
 #define SHIFT 0
 #include "softmmu_template.h"
@@ -49,22 +53,22 @@ extern int semihosting_enabled;
    NULL, it means that the function was called in C code (i.e. not
    from generated code or from helper.c) */
 /* XXX: fix it to restore all registers */
-void tlb_fill (target_ulong addr, int is_write, int is_user, void *retaddr)
+void tlb_fill (target_ulong addr, int is_write, int mmu_idx, void *retaddr)
 {
     TranslationBlock *tb;
     CPUState *saved_env;
-    target_phys_addr_t pc;
+    unsigned long pc;
     int ret;
 
     /* XXX: hack to restore env in all cases, even if not called from
        generated code */
     saved_env = env;
     env = cpu_single_env;
-    ret = cpu_m68k_handle_mmu_fault(env, addr, is_write, is_user, 1);
+    ret = cpu_m68k_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
     if (__builtin_expect(ret, 0)) {
         if (retaddr) {
             /* now we have a real cpu fault */
-            pc = (target_phys_addr_t)retaddr;
+            pc = (unsigned long)retaddr;
             tb = tb_find_pc(pc);
             if (tb) {
                 /* the PC is inside the translated code. It means that we have
diff --git a/target-m68k/translate.c b/target-m68k/translate.c
index f6b4fad64..68f39aab7 100644
--- a/target-m68k/translate.c
+++ b/target-m68k/translate.c
@@ -3279,38 +3279,6 @@ int gen_intermediate_code_pc(CPUState *env, TranslationBlock *tb)
     return gen_intermediate_code_internal(env, tb, 1);
 }
 
-void cpu_reset(CPUM68KState *env)
-{
-    memset(env, 0, offsetof(CPUM68KState, breakpoints));
-#if !defined (CONFIG_USER_ONLY)
-    env->sr = 0x2700;
-#endif
-    m68k_switch_sp(env);
-    /* ??? FP regs should be initialized to NaN.  */
-    env->cc_op = CC_OP_FLAGS;
-    /* TODO: We should set PC from the interrupt vector.  */
-    env->pc = 0;
-    tlb_flush(env, 1);
-}
-
-CPUM68KState *cpu_m68k_init(void)
-{
-    CPUM68KState *env;
-
-    env = malloc(sizeof(CPUM68KState));
-    if (!env)
-        return NULL;
-    cpu_exec_init(env);
-
-    cpu_reset(env);
-    return env;
-}
-
-void cpu_m68k_close(CPUM68KState *env)
-{
-    free(env);
-}
-
 void cpu_dump_state(CPUState *env, FILE *f,
                     int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
                     int flags)
@@ -3323,13 +3291,13 @@ void cpu_dump_state(CPUState *env, FILE *f,
         u.d = env->fregs[i];
         cpu_fprintf (f, "D%d = %08x   A%d = %08x   F%d = %08x%08x (%12g)\n",
                      i, env->dregs[i], i, env->aregs[i],
-                     i, u.l.upper, u.l.lower, u.d);
+                     i, u.l.upper, u.l.lower, *(double *)&u.d);
       }
     cpu_fprintf (f, "PC = %08x   ", env->pc);
     sr = env->sr;
     cpu_fprintf (f, "SR = %04x %c%c%c%c%c ", sr, (sr & 0x10) ? 'X' : '-',
                  (sr & CCF_N) ? 'N' : '-', (sr & CCF_Z) ? 'Z' : '-',
                  (sr & CCF_V) ? 'V' : '-', (sr & CCF_C) ? 'C' : '-');
-    cpu_fprintf (f, "FPRESULT = %12g\n", env->fp_result);
+    cpu_fprintf (f, "FPRESULT = %12g\n", *(double *)&env->fp_result);
 }
 
diff --git a/target-mips/TODO b/target-mips/TODO
index 2d207cf90..6d842e014 100644
--- a/target-mips/TODO
+++ b/target-mips/TODO
@@ -3,7 +3,32 @@ Unsolved issues/bugs in the mips/mipsel backend
 
 General
 -------
-- [ls][dw][lr] report broken (aligned) BadVAddr
+- Unimplemented ASEs:
+  - MIPS16
+  - MDMX
+  - SmartMIPS
+  - DSP r1
+  - DSP r2
+- MT ASE only partially implemented and not functional
+- Shadow register support only partially implemented,
+  lacks set switching on interrupt/exception.
+- 34K ITC not implemented.
+- A general lack of documentation, especially for technical internals.
+  Existing documentation is x86-centric.
+- Reverse endianness bit not implemented
+- The TLB emulation is very inefficient:
+  Qemu's softmmu implements a x86-style MMU, with separate entries
+  for read/write/execute, a TLB index which is just a modulo of the
+  virtual address, and a set of TLBs for each user/kernel/supervisor
+  MMU mode.
+  MIPS has a single entry for read/write/execute and only one MMU mode.
+  But it is fully associative with randomized entry indices, and uses
+  up to 256 ASID tags as additional matching criterion (which roughly
+  equates to 256 MMU modes). It also has a global flag which causes
+  entries to match regardless of ASID.
+  To cope with these differences, Qemu currently flushes the TLB at
+  each ASID change. Using the MMU modes to implement ASIDs hinges on
+  implementing the global bit efficiently.
 
 MIPS64
 ------
@@ -22,3 +47,9 @@ MALTA system emulation
 - We fake firmware support instead of doing the real thing
 - Real firmware falls over when trying to init RAM, presumably due
   to lacking system controller emulation.
+
+mipssim system emulation
+------------------------
+- The mipsnet.c has a glitch: Booting from NFS root works up until
+  starting /sbin/init, then it Linux hangs with "NFS server not
+  responding".
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 569f9325b..482f27d1e 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -107,6 +107,8 @@ struct CPUMIPSFPUContext {
 #define FP_UNIMPLEMENTED  32
 };
 
+#define NB_MMU_MODES 3
+
 typedef struct CPUMIPSMVPContext CPUMIPSMVPContext;
 struct CPUMIPSMVPContext {
     int32_t CP0_MVPControl;
@@ -283,8 +285,7 @@ struct CPUMIPSState {
 #define CP0St_KX    7
 #define CP0St_SX    6
 #define CP0St_UX    5
-#define CP0St_UM    4
-#define CP0St_R0    3
+#define CP0St_KSU   3
 #define CP0St_ERL   2
 #define CP0St_EXL   1
 #define CP0St_IE    0
@@ -416,9 +417,14 @@ struct CPUMIPSState {
     /* TMASK defines different execution modes */
 #define MIPS_HFLAG_TMASK  0x00FF
 #define MIPS_HFLAG_MODE   0x0007 /* execution modes                    */
-#define MIPS_HFLAG_UM     0x0001 /* user mode                          */
-#define MIPS_HFLAG_DM     0x0002 /* Debug mode                         */
-#define MIPS_HFLAG_SM     0x0004 /* Supervisor mode                    */
+    /* The KSU flags must be the lowest bits in hflags. The flag order
+       must be the same as defined for CP0 Status. This allows to use
+       the bits as the value of mmu_idx. */
+#define MIPS_HFLAG_KSU    0x0003 /* kernel/supervisor/user mode mask   */
+#define MIPS_HFLAG_UM       0x0002 /* user mode flag */
+#define MIPS_HFLAG_SM       0x0001 /* supervisor mode flag */
+#define MIPS_HFLAG_KM       0x0000 /* kernel mode flag */
+#define MIPS_HFLAG_DM     0x0004 /* Debug mode                         */
 #define MIPS_HFLAG_64     0x0008 /* 64-bit instructions enabled        */
 #define MIPS_HFLAG_CP0    0x0010 /* CP0 enabled                        */
 #define MIPS_HFLAG_FPU    0x0020 /* FPU enabled                        */
@@ -450,12 +456,7 @@ struct CPUMIPSState {
 
     CPU_COMMON
 
-    int ram_size;
-    const char *kernel_filename;
-    const char *kernel_cmdline;
-    const char *initrd_filename;
-
-    mips_def_t *cpu_model;
+    const mips_def_t *cpu_model;
 #ifndef CONFIG_USER_ONLY
     void *irq[8];
 #endif
@@ -473,15 +474,28 @@ void r4k_do_tlbwi (void);
 void r4k_do_tlbwr (void);
 void r4k_do_tlbp (void);
 void r4k_do_tlbr (void);
-int mips_find_by_name (const unsigned char *name, mips_def_t **def);
 void mips_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...));
-int cpu_mips_register (CPUMIPSState *env, mips_def_t *def);
+
+void do_unassigned_access(target_phys_addr_t addr, int is_write, int is_exec,
+                          int unused);
 
 #define CPUState CPUMIPSState
 #define cpu_init cpu_mips_init
 #define cpu_exec cpu_mips_exec
 #define cpu_gen_code cpu_mips_gen_code
 #define cpu_signal_handler cpu_mips_signal_handler
+#define cpu_list mips_cpu_list
+
+/* MMU modes definitions. We carefully match the indices with our
+   hflags layout. */
+#define MMU_MODE0_SUFFIX _kernel
+#define MMU_MODE1_SUFFIX _super
+#define MMU_MODE2_SUFFIX _user
+#define MMU_USER_IDX 2
+static inline int cpu_mmu_index (CPUState *env)
+{
+    return env->hflags & MIPS_HFLAG_KSU;
+}
 
 #include "cpu-all.h"
 
@@ -544,7 +558,7 @@ enum {
 };
 
 int cpu_mips_exec(CPUMIPSState *s);
-CPUMIPSState *cpu_mips_init(void);
+CPUMIPSState *cpu_mips_init(const char *cpu_model);
 uint32_t cpu_mips_get_clock (void);
 int cpu_mips_signal_handler(int host_signum, void *pinfo, void *puc);
 
diff --git a/target-mips/exec.h b/target-mips/exec.h
index 8e909787e..307049ed3 100644
--- a/target-mips/exec.h
+++ b/target-mips/exec.h
@@ -43,12 +43,6 @@ register target_ulong T2 asm(AREG3);
 #define WTH2 (env->fpu->ft2.w[!FP_ENDIAN_IDX])
 #endif
 
-#if defined (DEBUG_OP)
-# define RETURN() __asm__ __volatile__("nop" : : : "memory");
-#else
-# define RETURN() __asm__ __volatile__("" : : : "memory");
-#endif
-
 #include "cpu.h"
 #include "exec-all.h"
 
@@ -56,7 +50,7 @@ register target_ulong T2 asm(AREG3);
 #include "softmmu_exec.h"
 #endif /* !defined(CONFIG_USER_ONLY) */
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 #if TARGET_LONG_BITS > HOST_LONG_BITS
 void do_dsll (void);
 void do_dsll32 (void);
@@ -70,6 +64,8 @@ void do_dsllv (void);
 void do_dsrav (void);
 void do_dsrlv (void);
 void do_drotrv (void);
+void do_dclo (void);
+void do_dclz (void);
 #endif
 #endif
 
@@ -84,7 +80,7 @@ void do_maddu (void);
 void do_msub (void);
 void do_msubu (void);
 #endif
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 void do_ddiv (void);
 #if TARGET_LONG_BITS > HOST_LONG_BITS
 void do_ddivu (void);
@@ -100,42 +96,12 @@ void fpu_dump_state(CPUState *env, FILE *f,
                     int (*fpu_fprintf)(FILE *f, const char *fmt, ...),
                     int flags);
 void dump_sc (void);
-void do_lwl_raw (uint32_t);
-void do_lwr_raw (uint32_t);
-uint32_t do_swl_raw (uint32_t);
-uint32_t do_swr_raw (uint32_t);
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
-void do_ldl_raw (uint64_t);
-void do_ldr_raw (uint64_t);
-uint64_t do_sdl_raw (uint64_t);
-uint64_t do_sdr_raw (uint64_t);
-#endif
-#if !defined(CONFIG_USER_ONLY)
-void do_lwl_user (uint32_t);
-void do_lwl_kernel (uint32_t);
-void do_lwr_user (uint32_t);
-void do_lwr_kernel (uint32_t);
-uint32_t do_swl_user (uint32_t);
-uint32_t do_swl_kernel (uint32_t);
-uint32_t do_swr_user (uint32_t);
-uint32_t do_swr_kernel (uint32_t);
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
-void do_ldl_user (uint64_t);
-void do_ldl_kernel (uint64_t);
-void do_ldr_user (uint64_t);
-void do_ldr_kernel (uint64_t);
-uint64_t do_sdl_user (uint64_t);
-uint64_t do_sdl_kernel (uint64_t);
-uint64_t do_sdr_user (uint64_t);
-uint64_t do_sdr_kernel (uint64_t);
-#endif
-#endif
 void do_pmon (int function);
 
 void dump_sc (void);
 
 int cpu_mips_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                               int is_user, int is_softmmu);
+                               int mmu_idx, int is_softmmu);
 void do_interrupt (CPUState *env);
 void r4k_invalidate_tlb (CPUState *env, int idx, int use_extra);
 
@@ -235,15 +201,15 @@ FOP_PROTO(le)
 FOP_PROTO(ngt)
 #undef FOP_PROTO
 
-static inline void env_to_regs(void)
+static always_inline void env_to_regs(void)
 {
 }
 
-static inline void regs_to_env(void)
+static always_inline void regs_to_env(void)
 {
 }
 
-static inline int cpu_halted(CPUState *env)
+static always_inline int cpu_halted(CPUState *env)
 {
     if (!env->halted)
         return 0;
@@ -255,27 +221,23 @@ static inline int cpu_halted(CPUState *env)
     return EXCP_HALTED;
 }
 
-static inline void compute_hflags(CPUState *env)
+static always_inline void compute_hflags(CPUState *env)
 {
     env->hflags &= ~(MIPS_HFLAG_64 | MIPS_HFLAG_CP0 | MIPS_HFLAG_F64 |
-                     MIPS_HFLAG_FPU | MIPS_HFLAG_UM);
+                     MIPS_HFLAG_FPU | MIPS_HFLAG_KSU);
     if (!(env->CP0_Status & (1 << CP0St_EXL)) &&
         !(env->CP0_Status & (1 << CP0St_ERL)) &&
         !(env->hflags & MIPS_HFLAG_DM)) {
-        if (env->CP0_Status & (1 << CP0St_UM))
-            env->hflags |= MIPS_HFLAG_UM;
-        if (env->CP0_Status & (1 << CP0St_R0))
-            env->hflags |= MIPS_HFLAG_SM;
+        env->hflags |= (env->CP0_Status >> CP0St_KSU) & MIPS_HFLAG_KSU;
     }
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
-    if (!(env->hflags & MIPS_HFLAG_UM) ||
+#if defined(TARGET_MIPS64)
+    if (((env->hflags & MIPS_HFLAG_KSU) != MIPS_HFLAG_UM) ||
         (env->CP0_Status & (1 << CP0St_PX)) ||
         (env->CP0_Status & (1 << CP0St_UX)))
         env->hflags |= MIPS_HFLAG_64;
 #endif
     if ((env->CP0_Status & (1 << CP0St_CU0)) ||
-        (!(env->hflags & MIPS_HFLAG_UM) &&
-         !(env->hflags & MIPS_HFLAG_SM)))
+        !(env->hflags & MIPS_HFLAG_KSU))
         env->hflags |= MIPS_HFLAG_CP0;
     if (env->CP0_Status & (1 << CP0St_CU1))
         env->hflags |= MIPS_HFLAG_FPU;
diff --git a/target-mips/fop_template.c b/target-mips/fop_template.c
index 25b2ca7a5..c5941d121 100644
--- a/target-mips/fop_template.c
+++ b/target-mips/fop_template.c
@@ -24,15 +24,15 @@
 #define OP_WLOAD_FREG(treg, tregname, FREG)              \
     void glue(glue(op_load_fpr_,tregname), FREG) (void)  \
     {                                                    \
-        treg = env->fpu->fpr[FREG].fs[FP_ENDIAN_IDX];    \
-        RETURN();                                        \
+        treg = env->fpu->fpr[FREG].w[FP_ENDIAN_IDX];    \
+        FORCE_RET();                                     \
     }
 
 #define OP_WSTORE_FREG(treg, tregname, FREG)             \
     void glue(glue(op_store_fpr_,tregname), FREG) (void) \
     {                                                    \
-        env->fpu->fpr[FREG].fs[FP_ENDIAN_IDX] = treg;    \
-        RETURN();                                        \
+        env->fpu->fpr[FREG].w[FP_ENDIAN_IDX] = treg;    \
+        FORCE_RET();                                     \
     }
 
 /* WT0 = FREG.w: op_load_fpr_WT0_fprFREG */
@@ -50,23 +50,23 @@ OP_WSTORE_FREG(WT2, WT2_fpr, FREG)
     void glue(glue(op_load_fpr_,tregname), FREG) (void)  \
     {                                                    \
         if (env->hflags & MIPS_HFLAG_F64)                \
-            treg = env->fpu->fpr[FREG].fd;               \
+            treg = env->fpu->fpr[FREG].d;                \
         else                                             \
-            treg = (uint64_t)(env->fpu->fpr[FREG | 1].fs[FP_ENDIAN_IDX]) << 32 | \
-                   env->fpu->fpr[FREG & ~1].fs[FP_ENDIAN_IDX]; \
-        RETURN();                                        \
+            treg = (uint64_t)(env->fpu->fpr[FREG | 1].w[FP_ENDIAN_IDX]) << 32 | \
+                   env->fpu->fpr[FREG & ~1].w[FP_ENDIAN_IDX]; \
+        FORCE_RET();                                     \
     }
 
 #define OP_DSTORE_FREG(treg, tregname, FREG)             \
     void glue(glue(op_store_fpr_,tregname), FREG) (void) \
     {                                                    \
         if (env->hflags & MIPS_HFLAG_F64)                \
-            env->fpu->fpr[FREG].fd = treg;               \
+            env->fpu->fpr[FREG].d = treg;                \
         else {                                           \
-            env->fpu->fpr[FREG | 1].fs[FP_ENDIAN_IDX] = treg >> 32; \
-            env->fpu->fpr[FREG & ~1].fs[FP_ENDIAN_IDX] = treg;      \
+            env->fpu->fpr[FREG | 1].w[FP_ENDIAN_IDX] = treg >> 32; \
+            env->fpu->fpr[FREG & ~1].w[FP_ENDIAN_IDX] = treg;      \
         }                                                \
-        RETURN();                                        \
+        FORCE_RET();                                     \
     }
 
 OP_DLOAD_FREG(DT0, DT0_fpr, FREG)
@@ -81,15 +81,15 @@ OP_DSTORE_FREG(DT2, DT2_fpr, FREG)
 #define OP_PSLOAD_FREG(treg, tregname, FREG)             \
     void glue(glue(op_load_fpr_,tregname), FREG) (void)  \
     {                                                    \
-        treg = env->fpu->fpr[FREG].fs[!FP_ENDIAN_IDX];   \
-        RETURN();                                        \
+        treg = env->fpu->fpr[FREG].w[!FP_ENDIAN_IDX];   \
+        FORCE_RET();                                     \
     }
 
 #define OP_PSSTORE_FREG(treg, tregname, FREG)            \
     void glue(glue(op_store_fpr_,tregname), FREG) (void) \
     {                                                    \
-        env->fpu->fpr[FREG].fs[!FP_ENDIAN_IDX] = treg;   \
-        RETURN();                                        \
+        env->fpu->fpr[FREG].w[!FP_ENDIAN_IDX] = treg;   \
+        FORCE_RET();                                     \
     }
 
 OP_PSLOAD_FREG(WTH0, WTH0_fpr, FREG)
@@ -109,12 +109,12 @@ OP_PSSTORE_FREG(WTH2, WTH2_fpr, FREG)
     void glue(op_set, tregname)(void)    \
     {                                    \
         treg = PARAM1;                   \
-        RETURN();                        \
+        FORCE_RET();                     \
     }                                    \
     void glue(op_reset, tregname)(void)  \
     {                                    \
         treg = 0;                        \
-        RETURN();                        \
+        FORCE_RET();                     \
     }
 
 SET_RESET(WT0, _WT0)
diff --git a/target-mips/helper.c b/target-mips/helper.c
index 9c72481c2..e7d788752 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -76,7 +76,7 @@ int r4k_map_address (CPUState *env, target_ulong *physical, int *prot,
         target_ulong mask = tlb->PageMask | ~(TARGET_PAGE_MASK << 1);
         target_ulong tag = address & ~mask;
         target_ulong VPN = tlb->VPN & ~mask;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
         tag &= env->SEGMask;
 #endif
 
@@ -108,7 +108,7 @@ static int get_physical_address (CPUState *env, target_ulong *physical,
     int user_mode = (env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM;
     int supervisor_mode = (env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_SM;
     int kernel_mode = !user_mode && !supervisor_mode;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     int UX = (env->CP0_Status & (1 << CP0St_UX)) != 0;
     int SX = (env->CP0_Status & (1 << CP0St_SX)) != 0;
     int KX = (env->CP0_Status & (1 << CP0St_KX)) != 0;
@@ -130,39 +130,36 @@ static int get_physical_address (CPUState *env, target_ulong *physical,
         } else {
             ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
         }
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
-/*
-   XXX: Assuming :
-   - PABITS = 36 (correct for MIPS64R1)
-*/
-    } else if (address < 0x3FFFFFFFFFFFFFFFULL) {
+#if defined(TARGET_MIPS64)
+    } else if (address < 0x4000000000000000ULL) {
         /* xuseg */
-	if (UX && address < (0x3FFFFFFFFFFFFFFFULL & env->SEGMask)) {
+	if (UX && address <= (0x3FFFFFFFFFFFFFFFULL & env->SEGMask)) {
             ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
 	} else {
 	    ret = TLBRET_BADADDR;
         }
-    } else if (address < 0x7FFFFFFFFFFFFFFFULL) {
+    } else if (address < 0x8000000000000000ULL) {
         /* xsseg */
 	if ((supervisor_mode || kernel_mode) &&
-	    SX && address < (0x7FFFFFFFFFFFFFFFULL & env->SEGMask)) {
+	    SX && address <= (0x7FFFFFFFFFFFFFFFULL & env->SEGMask)) {
             ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
 	} else {
 	    ret = TLBRET_BADADDR;
         }
-    } else if (address < 0xBFFFFFFFFFFFFFFFULL) {
+    } else if (address < 0xC000000000000000ULL) {
         /* xkphys */
+        /* XXX: Assumes PABITS = 36 (correct for MIPS64R1) */
         if (kernel_mode && KX &&
-            (address & 0x07FFFFFFFFFFFFFFULL) < 0X0000000FFFFFFFFFULL) {
-            *physical = address & 0X0000000FFFFFFFFFULL;
+            (address & 0x07FFFFFFFFFFFFFFULL) <= 0x0000000FFFFFFFFFULL) {
+            *physical = address & 0x0000000FFFFFFFFFULL;
             *prot = PAGE_READ | PAGE_WRITE;
 	} else {
 	    ret = TLBRET_BADADDR;
 	}
-    } else if (address < 0xFFFFFFFF7FFFFFFFULL) {
+    } else if (address < 0xFFFFFFFF80000000ULL) {
         /* xkseg */
 	if (kernel_mode && KX &&
-	    address < (0xFFFFFFFF7FFFFFFFULL & env->SEGMask)) {
+	    address <= (0xFFFFFFFF7FFFFFFFULL & env->SEGMask)) {
             ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
 	} else {
 	    ret = TLBRET_BADADDR;
@@ -185,7 +182,7 @@ static int get_physical_address (CPUState *env, target_ulong *physical,
             ret = TLBRET_BADADDR;
         }
     } else if (address < (int32_t)0xE0000000UL) {
-        /* sseg */
+        /* sseg (kseg2) */
         if (supervisor_mode || kernel_mode) {
             ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
         } else {
@@ -232,7 +229,7 @@ void cpu_mips_init_mmu (CPUState *env)
 #endif /* !defined(CONFIG_USER_ONLY) */
 
 int cpu_mips_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                               int is_user, int is_softmmu)
+                               int mmu_idx, int is_softmmu)
 {
     target_ulong physical;
     int prot;
@@ -244,8 +241,8 @@ int cpu_mips_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
 #if 0
         cpu_dump_state(env, logfile, fprintf, 0);
 #endif
-        fprintf(logfile, "%s pc " TARGET_FMT_lx " ad " TARGET_FMT_lx " rw %d is_user %d smmu %d\n",
-                __func__, env->PC[env->current_tc], address, rw, is_user, is_softmmu);
+        fprintf(logfile, "%s pc " TARGET_FMT_lx " ad " TARGET_FMT_lx " rw %d mmu_idx %d smmu %d\n",
+                __func__, env->PC[env->current_tc], address, rw, mmu_idx, is_softmmu);
     }
 
     rw &= 1;
@@ -268,7 +265,7 @@ int cpu_mips_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
     if (ret == TLBRET_MATCH) {
        ret = tlb_set_page(env, address & TARGET_PAGE_MASK,
                           physical & TARGET_PAGE_MASK, prot,
-                          is_user, is_softmmu);
+                          mmu_idx, is_softmmu);
     } else if (ret < 0) {
     do_fault:
         switch (ret) {
@@ -308,7 +305,7 @@ int cpu_mips_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
 	                   ((address >> 9) &   0x007ffff0);
         env->CP0_EntryHi =
             (env->CP0_EntryHi & 0xFF) | (address & (TARGET_PAGE_MASK << 1));
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
         env->CP0_EntryHi &= env->SEGMask;
         env->CP0_XContext = (env->CP0_XContext & ((~0ULL) << (env->SEGBITS - 7))) |
                             ((address & 0xC00000000000ULL) >> (env->SEGBITS - 9)) |
@@ -376,7 +373,7 @@ void do_interrupt (CPUState *env)
         }
     enter_debug_mode:
         env->hflags |= MIPS_HFLAG_DM | MIPS_HFLAG_64 | MIPS_HFLAG_CP0;
-        env->hflags &= ~(MIPS_HFLAG_SM | MIPS_HFLAG_UM);
+        env->hflags &= ~(MIPS_HFLAG_KSU);
         /* EJTAG probe trap enable is not implemented... */
         if (!(env->CP0_Status & (1 << CP0St_EXL)))
             env->CP0_Cause &= ~(1 << CP0Ca_BD);
@@ -402,7 +399,7 @@ void do_interrupt (CPUState *env)
         }
         env->CP0_Status |= (1 << CP0St_ERL) | (1 << CP0St_BEV);
         env->hflags |= MIPS_HFLAG_64 | MIPS_HFLAG_CP0;
-        env->hflags &= ~(MIPS_HFLAG_SM | MIPS_HFLAG_UM);
+        env->hflags &= ~(MIPS_HFLAG_KSU);
         if (!(env->CP0_Status & (1 << CP0St_EXL)))
             env->CP0_Cause &= ~(1 << CP0Ca_BD);
         env->PC[env->current_tc] = (int32_t)0xBFC00000;
@@ -428,7 +425,7 @@ void do_interrupt (CPUState *env)
     case EXCP_TLBL:
         cause = 2;
         if (env->error_code == 1 && !(env->CP0_Status & (1 << CP0St_EXL))) {
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
             int R = env->CP0_BadVAddr >> 62;
             int UX = (env->CP0_Status & (1 << CP0St_UX)) != 0;
             int SX = (env->CP0_Status & (1 << CP0St_SX)) != 0;
@@ -475,11 +472,8 @@ void do_interrupt (CPUState *env)
         goto set_EPC;
     case EXCP_TLBS:
         cause = 3;
-        goto set_EPC;
-    case EXCP_THREAD:
-        cause = 25;
         if (env->error_code == 1 && !(env->CP0_Status & (1 << CP0St_EXL))) {
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
             int R = env->CP0_BadVAddr >> 62;
             int UX = (env->CP0_Status & (1 << CP0St_UX)) != 0;
             int SX = (env->CP0_Status & (1 << CP0St_SX)) != 0;
@@ -491,6 +485,9 @@ void do_interrupt (CPUState *env)
 #endif
                 offset = 0x000;
         }
+        goto set_EPC;
+    case EXCP_THREAD:
+        cause = 25;
     set_EPC:
         if (!(env->CP0_Status & (1 << CP0St_EXL))) {
             if (env->hflags & MIPS_HFLAG_BMASK) {
@@ -504,7 +501,7 @@ void do_interrupt (CPUState *env)
             }
             env->CP0_Status |= (1 << CP0St_EXL);
             env->hflags |= MIPS_HFLAG_64 | MIPS_HFLAG_CP0;
-            env->hflags &= ~(MIPS_HFLAG_SM | MIPS_HFLAG_UM);
+            env->hflags &= ~(MIPS_HFLAG_KSU);
         }
         env->hflags &= ~MIPS_HFLAG_BMASK;
         if (env->CP0_Status & (1 << CP0St_BEV)) {
@@ -562,7 +559,7 @@ void r4k_invalidate_tlb (CPUState *env, int idx, int use_extra)
     mask = tlb->PageMask | ~(TARGET_PAGE_MASK << 1);
     if (tlb->V0) {
         addr = tlb->VPN & ~mask;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
         if (addr >= (0xFFFFFFFF80000000ULL & env->SEGMask)) {
             addr |= 0x3FFFFF0000000000ULL;
         }
@@ -575,7 +572,7 @@ void r4k_invalidate_tlb (CPUState *env, int idx, int use_extra)
     }
     if (tlb->V1) {
         addr = (tlb->VPN & ~mask) | ((mask >> 1) + 1);
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
         if (addr >= (0xFFFFFFFF80000000ULL & env->SEGMask)) {
             addr |= 0x3FFFFF0000000000ULL;
         }
diff --git a/target-mips/mips-defs.h b/target-mips/mips-defs.h
index 5c98edf97..76ea8d019 100644
--- a/target-mips/mips-defs.h
+++ b/target-mips/mips-defs.h
@@ -8,12 +8,15 @@
 #define TARGET_PAGE_BITS 12
 #define MIPS_TLB_MAX 128
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 #define TARGET_LONG_BITS 64
 #else
 #define TARGET_LONG_BITS 32
 #endif
 
+/* Even MIPS32 can have 36 bits physical address space. */
+#define TARGET_PHYS_ADDR_BITS 64
+
 /* Masks used to mark instructions to indicate which ISA level they
    were introduced in. */
 #define		ISA_MIPS1	0x00000001
@@ -32,6 +35,8 @@
 #define		ASE_MDMX	0x00004000
 #define		ASE_DSP		0x00008000
 #define		ASE_DSPR2	0x00010000
+#define		ASE_MT		0x00020000
+#define		ASE_SMARTMIPS	0x00040000
 
 /* Chip specific instructions.   */
 /* Currently void */
diff --git a/target-mips/op.c b/target-mips/op.c
index 429097052..ad619c9b4 100644
--- a/target-mips/op.c
+++ b/target-mips/op.c
@@ -22,6 +22,7 @@
 
 #include "config.h"
 #include "exec.h"
+#include "host-utils.h"
 
 #ifndef CALL_FROM_TB0
 #define CALL_FROM_TB0(func) func()
@@ -249,31 +250,31 @@
 void op_dup_T0 (void)
 {
     T2 = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_load_HI (void)
 {
     T0 = env->HI[PARAM1][env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_store_HI (void)
 {
     env->HI[PARAM1][env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_load_LO (void)
 {
     T0 = env->LO[PARAM1][env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_store_LO (void)
 {
     env->LO[PARAM1][env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 /* Load and store */
@@ -285,6 +286,10 @@ void op_store_LO (void)
 #include "op_mem.c"
 #undef MEMSUFFIX
 
+#define MEMSUFFIX _super
+#include "op_mem.c"
+#undef MEMSUFFIX
+
 #define MEMSUFFIX _kernel
 #include "op_mem.c"
 #undef MEMSUFFIX
@@ -296,21 +301,21 @@ void op_addr_add (void)
 /* For compatibility with 32-bit code, data reference in user mode
    with Status_UX = 0 should be casted to 32-bit and sign extended.
    See the MIPS64 PRA manual, section 4.10. */
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
-    if ((env->hflags & MIPS_HFLAG_UM) &&
+#if defined(TARGET_MIPS64)
+    if (((env->hflags & MIPS_HFLAG_KSU) == MIPS_HFLAG_UM) &&
         !(env->CP0_Status & (1 << CP0St_UX)))
         T0 = (int64_t)(int32_t)(T0 + T1);
     else
 #endif
         T0 += T1;
-    RETURN();
+    FORCE_RET();
 }
 
 /* Arithmetic */
 void op_add (void)
 {
     T0 = (int32_t)((int32_t)T0 + (int32_t)T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_addo (void)
@@ -324,13 +329,13 @@ void op_addo (void)
         CALL_FROM_TB1(do_raise_exception, EXCP_OVERFLOW);
     }
     T0 = (int32_t)T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_sub (void)
 {
     T0 = (int32_t)((int32_t)T0 - (int32_t)T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_subo (void)
@@ -344,20 +349,20 @@ void op_subo (void)
         CALL_FROM_TB1(do_raise_exception, EXCP_OVERFLOW);
     }
     T0 = (int32_t)T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mul (void)
 {
     T0 = (int32_t)((int32_t)T0 * (int32_t)T1);
-    RETURN();
+    FORCE_RET();
 }
 
 #if HOST_LONG_BITS < 64
 void op_div (void)
 {
     CALL_FROM_TB0(do_div);
-    RETURN();
+    FORCE_RET();
 }
 #else
 void op_div (void)
@@ -366,7 +371,7 @@ void op_div (void)
         env->LO[0][env->current_tc] = (int32_t)((int64_t)(int32_t)T0 / (int32_t)T1);
         env->HI[0][env->current_tc] = (int32_t)((int64_t)(int32_t)T0 % (int32_t)T1);
     }
-    RETURN();
+    FORCE_RET();
 }
 #endif
 
@@ -376,15 +381,15 @@ void op_divu (void)
         env->LO[0][env->current_tc] = (int32_t)((uint32_t)T0 / (uint32_t)T1);
         env->HI[0][env->current_tc] = (int32_t)((uint32_t)T0 % (uint32_t)T1);
     }
-    RETURN();
+    FORCE_RET();
 }
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 /* Arithmetic */
 void op_dadd (void)
 {
     T0 += T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_daddo (void)
@@ -397,13 +402,13 @@ void op_daddo (void)
         /* operands of same sign, result different sign */
         CALL_FROM_TB1(do_raise_exception, EXCP_OVERFLOW);
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsub (void)
 {
     T0 -= T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsubo (void)
@@ -416,27 +421,27 @@ void op_dsubo (void)
         /* operands of different sign, first operand and result different sign */
         CALL_FROM_TB1(do_raise_exception, EXCP_OVERFLOW);
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmul (void)
 {
     T0 = (int64_t)T0 * (int64_t)T1;
-    RETURN();
+    FORCE_RET();
 }
 
 /* Those might call libgcc functions.  */
 void op_ddiv (void)
 {
     do_ddiv();
-    RETURN();
+    FORCE_RET();
 }
 
 #if TARGET_LONG_BITS > HOST_LONG_BITS
 void op_ddivu (void)
 {
     do_ddivu();
-    RETURN();
+    FORCE_RET();
 }
 #else
 void op_ddivu (void)
@@ -445,52 +450,52 @@ void op_ddivu (void)
         env->LO[0][env->current_tc] = T0 / T1;
         env->HI[0][env->current_tc] = T0 % T1;
     }
-    RETURN();
+    FORCE_RET();
 }
 #endif
-#endif /* TARGET_MIPSN32 || TARGET_MIPS64 */
+#endif /* TARGET_MIPS64 */
 
 /* Logical */
 void op_and (void)
 {
     T0 &= T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_nor (void)
 {
     T0 = ~(T0 | T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_or (void)
 {
     T0 |= T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_xor (void)
 {
     T0 ^= T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_sll (void)
 {
     T0 = (int32_t)((uint32_t)T0 << T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_sra (void)
 {
     T0 = (int32_t)((int32_t)T0 >> T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_srl (void)
 {
     T0 = (int32_t)((uint32_t)T0 >> T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_rotr (void)
@@ -501,25 +506,25 @@ void op_rotr (void)
        tmp = (int32_t)((uint32_t)T0 << (0x20 - T1));
        T0 = (int32_t)((uint32_t)T0 >> T1) | tmp;
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_sllv (void)
 {
     T0 = (int32_t)((uint32_t)T1 << ((uint32_t)T0 & 0x1F));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_srav (void)
 {
     T0 = (int32_t)((int32_t)T1 >> (T0 & 0x1F));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_srlv (void)
 {
     T0 = (int32_t)((uint32_t)T1 >> (T0 & 0x1F));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_rotrv (void)
@@ -532,117 +537,107 @@ void op_rotrv (void)
        T0 = (int32_t)((uint32_t)T1 >> T0) | tmp;
     } else
        T0 = T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_clo (void)
 {
-    int n;
-
-    if (T0 == ~((target_ulong)0)) {
-        T0 = 32;
-    } else {
-        for (n = 0; n < 32; n++) {
-            if (!(T0 & (1 << 31)))
-                break;
-            T0 = T0 << 1;
-        }
-        T0 = n;
-    }
-    RETURN();
+    T0 = clo32(T0);
+    FORCE_RET();
 }
 
 void op_clz (void)
 {
-    int n;
-
-    if (T0 == 0) {
-        T0 = 32;
-    } else {
-        for (n = 0; n < 32; n++) {
-            if (T0 & (1 << 31))
-                break;
-            T0 = T0 << 1;
-        }
-        T0 = n;
-    }
-    RETURN();
+    T0 = clz32(T0);
+    FORCE_RET();
 }
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 
 #if TARGET_LONG_BITS > HOST_LONG_BITS
 /* Those might call libgcc functions.  */
 void op_dsll (void)
 {
     CALL_FROM_TB0(do_dsll);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsll32 (void)
 {
     CALL_FROM_TB0(do_dsll32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsra (void)
 {
     CALL_FROM_TB0(do_dsra);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsra32 (void)
 {
     CALL_FROM_TB0(do_dsra32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrl (void)
 {
     CALL_FROM_TB0(do_dsrl);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrl32 (void)
 {
     CALL_FROM_TB0(do_dsrl32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotr (void)
 {
     CALL_FROM_TB0(do_drotr);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotr32 (void)
 {
     CALL_FROM_TB0(do_drotr32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsllv (void)
 {
     CALL_FROM_TB0(do_dsllv);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrav (void)
 {
     CALL_FROM_TB0(do_dsrav);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrlv (void)
 {
     CALL_FROM_TB0(do_dsrlv);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotrv (void)
 {
     CALL_FROM_TB0(do_drotrv);
-    RETURN();
+    FORCE_RET();
+}
+
+void op_dclo (void)
+{
+    CALL_FROM_TB0(do_dclo);
+    FORCE_RET();
+}
+
+void op_dclz (void)
+{
+    CALL_FROM_TB0(do_dclz);
+    FORCE_RET();
 }
 
 #else /* TARGET_LONG_BITS > HOST_LONG_BITS */
@@ -650,37 +645,37 @@ void op_drotrv (void)
 void op_dsll (void)
 {
     T0 = T0 << T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsll32 (void)
 {
     T0 = T0 << (T1 + 32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsra (void)
 {
     T0 = (int64_t)T0 >> T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsra32 (void)
 {
     T0 = (int64_t)T0 >> (T1 + 32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrl (void)
 {
     T0 = T0 >> T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrl32 (void)
 {
     T0 = T0 >> (T1 + 32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotr (void)
@@ -688,39 +683,37 @@ void op_drotr (void)
     target_ulong tmp;
 
     if (T1) {
-       tmp = T0 << (0x40 - T1);
-       T0 = (T0 >> T1) | tmp;
+        tmp = T0 << (0x40 - T1);
+        T0 = (T0 >> T1) | tmp;
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotr32 (void)
 {
     target_ulong tmp;
 
-    if (T1) {
-       tmp = T0 << (0x40 - (32 + T1));
-       T0 = (T0 >> (32 + T1)) | tmp;
-    }
-    RETURN();
+    tmp = T0 << (0x40 - (32 + T1));
+    T0 = (T0 >> (32 + T1)) | tmp;
+    FORCE_RET();
 }
 
 void op_dsllv (void)
 {
     T0 = T1 << (T0 & 0x3F);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrav (void)
 {
     T0 = (int64_t)T1 >> (T0 & 0x3F);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrlv (void)
 {
     T0 = T1 >> (T0 & 0x3F);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotrv (void)
@@ -729,96 +722,74 @@ void op_drotrv (void)
 
     T0 &= 0x3F;
     if (T0) {
-       tmp = T1 << (0x40 - T0);
-       T0 = (T1 >> T0) | tmp;
+        tmp = T1 << (0x40 - T0);
+        T0 = (T1 >> T0) | tmp;
     } else
-       T0 = T1;
-    RETURN();
+        T0 = T1;
+    FORCE_RET();
 }
-#endif /* TARGET_LONG_BITS > HOST_LONG_BITS */
 
 void op_dclo (void)
 {
-    int n;
-
-    if (T0 == ~((target_ulong)0)) {
-        T0 = 64;
-    } else {
-        for (n = 0; n < 64; n++) {
-            if (!(T0 & (1ULL << 63)))
-                break;
-            T0 = T0 << 1;
-        }
-        T0 = n;
-    }
-    RETURN();
+    T0 = clo64(T0);
+    FORCE_RET();
 }
 
 void op_dclz (void)
 {
-    int n;
-
-    if (T0 == 0) {
-        T0 = 64;
-    } else {
-        for (n = 0; n < 64; n++) {
-            if (T0 & (1ULL << 63))
-                break;
-            T0 = T0 << 1;
-        }
-        T0 = n;
-    }
-    RETURN();
+    T0 = clz64(T0);
+    FORCE_RET();
 }
-#endif /* TARGET_MIPSN32 || TARGET_MIPS64 */
+#endif /* TARGET_LONG_BITS > HOST_LONG_BITS */
+#endif /* TARGET_MIPS64 */
 
 /* 64 bits arithmetic */
 #if TARGET_LONG_BITS > HOST_LONG_BITS
 void op_mult (void)
 {
     CALL_FROM_TB0(do_mult);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_multu (void)
 {
     CALL_FROM_TB0(do_multu);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_madd (void)
 {
     CALL_FROM_TB0(do_madd);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_maddu (void)
 {
     CALL_FROM_TB0(do_maddu);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_msub (void)
 {
     CALL_FROM_TB0(do_msub);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_msubu (void)
 {
     CALL_FROM_TB0(do_msubu);
-    RETURN();
+    FORCE_RET();
 }
 
 #else /* TARGET_LONG_BITS > HOST_LONG_BITS */
 
-static inline uint64_t get_HILO (void)
+static always_inline uint64_t get_HILO (void)
 {
     return ((uint64_t)env->HI[0][env->current_tc] << 32) |
             ((uint64_t)(uint32_t)env->LO[0][env->current_tc]);
 }
 
-static inline void set_HILO (uint64_t HILO)
+static always_inline void set_HILO (uint64_t HILO)
 {
     env->LO[0][env->current_tc] = (int32_t)(HILO & 0xFFFFFFFF);
     env->HI[0][env->current_tc] = (int32_t)(HILO >> 32);
@@ -827,13 +798,13 @@ static inline void set_HILO (uint64_t HILO)
 void op_mult (void)
 {
     set_HILO((int64_t)(int32_t)T0 * (int64_t)(int32_t)T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_multu (void)
 {
     set_HILO((uint64_t)(uint32_t)T0 * (uint64_t)(uint32_t)T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_madd (void)
@@ -842,7 +813,7 @@ void op_madd (void)
 
     tmp = ((int64_t)(int32_t)T0 * (int64_t)(int32_t)T1);
     set_HILO((int64_t)get_HILO() + tmp);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_maddu (void)
@@ -851,7 +822,7 @@ void op_maddu (void)
 
     tmp = ((uint64_t)(uint32_t)T0 * (uint64_t)(uint32_t)T1);
     set_HILO(get_HILO() + tmp);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_msub (void)
@@ -860,7 +831,7 @@ void op_msub (void)
 
     tmp = ((int64_t)(int32_t)T0 * (int64_t)(int32_t)T1);
     set_HILO((int64_t)get_HILO() - tmp);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_msubu (void)
@@ -869,21 +840,21 @@ void op_msubu (void)
 
     tmp = ((uint64_t)(uint32_t)T0 * (uint64_t)(uint32_t)T1);
     set_HILO(get_HILO() - tmp);
-    RETURN();
+    FORCE_RET();
 }
 #endif /* TARGET_LONG_BITS > HOST_LONG_BITS */
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 void op_dmult (void)
 {
-    CALL_FROM_TB4(muls64, &(env->HI[0][env->current_tc]), &(env->LO[0][env->current_tc]), T0, T1);
-    RETURN();
+    CALL_FROM_TB4(muls64, &(env->LO[0][env->current_tc]), &(env->HI[0][env->current_tc]), T0, T1);
+    FORCE_RET();
 }
 
 void op_dmultu (void)
 {
-    CALL_FROM_TB4(mulu64, &(env->HI[0][env->current_tc]), &(env->LO[0][env->current_tc]), T0, T1);
-    RETURN();
+    CALL_FROM_TB4(mulu64, &(env->LO[0][env->current_tc]), &(env->HI[0][env->current_tc]), T0, T1);
+    FORCE_RET();
 }
 #endif
 
@@ -892,28 +863,28 @@ void op_movn (void)
 {
     if (T1 != 0)
         env->gpr[PARAM1][env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_movz (void)
 {
     if (T1 == 0)
         env->gpr[PARAM1][env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_movf (void)
 {
     if (!(env->fpu->fcr31 & PARAM1))
         T0 = T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_movt (void)
 {
     if (env->fpu->fcr31 & PARAM1)
         T0 = T1;
-    RETURN();
+    FORCE_RET();
 }
 
 /* Tests */
@@ -925,7 +896,7 @@ void glue(op_, name) (void) \
     } else {                \
         T0 = 0;             \
     }                       \
-    RETURN();               \
+    FORCE_RET();            \
 }
 
 OP_COND(eq, T0 == T1);
@@ -943,45 +914,45 @@ OP_COND(ltz, (target_long)T0 < 0);
 void OPPROTO op_goto_tb0(void)
 {
     GOTO_TB(op_goto_tb0, PARAM1, 0);
-    RETURN();
+    FORCE_RET();
 }
 
 void OPPROTO op_goto_tb1(void)
 {
     GOTO_TB(op_goto_tb1, PARAM1, 1);
-    RETURN();
+    FORCE_RET();
 }
 
 /* Branch to register */
 void op_save_breg_target (void)
 {
     env->btarget = T2;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_restore_breg_target (void)
 {
     T2 = env->btarget;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_breg (void)
 {
     env->PC[env->current_tc] = T2;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_save_btarget (void)
 {
     env->btarget = PARAM1;
-    RETURN();
+    FORCE_RET();
 }
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 void op_save_btarget64 (void)
 {
     env->btarget = ((uint64_t)PARAM1 << 32) | (uint32_t)PARAM2;
-    RETURN();
+    FORCE_RET();
 }
 #endif
 
@@ -989,111 +960,111 @@ void op_save_btarget64 (void)
 void op_set_bcond (void)
 {
     T2 = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_save_bcond (void)
 {
     env->bcond = T2;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_restore_bcond (void)
 {
     T2 = env->bcond;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_jnz_T2 (void)
 {
     if (T2)
         GOTO_LABEL_PARAM(1);
-    RETURN();
+    FORCE_RET();
 }
 
 /* CP0 functions */
 void op_mfc0_index (void)
 {
     T0 = env->CP0_Index;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_mvpcontrol (void)
 {
     T0 = env->mvp->CP0_MVPControl;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_mvpconf0 (void)
 {
     T0 = env->mvp->CP0_MVPConf0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_mvpconf1 (void)
 {
     T0 = env->mvp->CP0_MVPConf1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_random (void)
 {
     CALL_FROM_TB0(do_mfc0_random);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpecontrol (void)
 {
     T0 = env->CP0_VPEControl;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpeconf0 (void)
 {
     T0 = env->CP0_VPEConf0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpeconf1 (void)
 {
     T0 = env->CP0_VPEConf1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_yqmask (void)
 {
     T0 = env->CP0_YQMask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpeschedule (void)
 {
     T0 = env->CP0_VPESchedule;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpeschefback (void)
 {
     T0 = env->CP0_VPEScheFBack;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpeopt (void)
 {
     T0 = env->CP0_VPEOpt;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_entrylo0 (void)
 {
     T0 = (int32_t)env->CP0_EntryLo0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tcstatus (void)
 {
     T0 = env->CP0_TCStatus[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tcstatus(void)
@@ -1101,13 +1072,13 @@ void op_mftc0_tcstatus(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCStatus[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tcbind (void)
 {
     T0 = env->CP0_TCBind[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tcbind(void)
@@ -1115,13 +1086,13 @@ void op_mftc0_tcbind(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCBind[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tcrestart (void)
 {
     T0 = env->PC[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tcrestart(void)
@@ -1129,13 +1100,13 @@ void op_mftc0_tcrestart(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->PC[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tchalt (void)
 {
     T0 = env->CP0_TCHalt[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tchalt(void)
@@ -1143,13 +1114,13 @@ void op_mftc0_tchalt(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCHalt[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tccontext (void)
 {
     T0 = env->CP0_TCContext[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tccontext(void)
@@ -1157,13 +1128,13 @@ void op_mftc0_tccontext(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCContext[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tcschedule (void)
 {
     T0 = env->CP0_TCSchedule[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tcschedule(void)
@@ -1171,13 +1142,13 @@ void op_mftc0_tcschedule(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCSchedule[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tcschefback (void)
 {
     T0 = env->CP0_TCScheFBack[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tcschefback(void)
@@ -1185,91 +1156,91 @@ void op_mftc0_tcschefback(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCScheFBack[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_entrylo1 (void)
 {
     T0 = (int32_t)env->CP0_EntryLo1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_context (void)
 {
     T0 = (int32_t)env->CP0_Context;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_pagemask (void)
 {
     T0 = env->CP0_PageMask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_pagegrain (void)
 {
     T0 = env->CP0_PageGrain;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_wired (void)
 {
     T0 = env->CP0_Wired;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsconf0 (void)
 {
     T0 = env->CP0_SRSConf0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsconf1 (void)
 {
     T0 = env->CP0_SRSConf1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsconf2 (void)
 {
     T0 = env->CP0_SRSConf2;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsconf3 (void)
 {
     T0 = env->CP0_SRSConf3;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsconf4 (void)
 {
     T0 = env->CP0_SRSConf4;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_hwrena (void)
 {
     T0 = env->CP0_HWREna;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_badvaddr (void)
 {
     T0 = (int32_t)env->CP0_BadVAddr;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_count (void)
 {
     CALL_FROM_TB0(do_mfc0_count);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_entryhi (void)
 {
     T0 = (int32_t)env->CP0_EntryHi;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_entryhi(void)
@@ -1277,19 +1248,19 @@ void op_mftc0_entryhi(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = (env->CP0_EntryHi & ~0xff) | (env->CP0_TCStatus[other_tc] & 0xff);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_compare (void)
 {
     T0 = env->CP0_Compare;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_status (void)
 {
     T0 = env->CP0_Status;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_status(void)
@@ -1300,116 +1271,116 @@ void op_mftc0_status(void)
     T0 = env->CP0_Status & ~0xf1000018;
     T0 |= tcstatus & (0xf << CP0TCSt_TCU0);
     T0 |= (tcstatus & (1 << CP0TCSt_TMX)) >> (CP0TCSt_TMX - CP0St_MX);
-    T0 |= (tcstatus & (0x3 << CP0TCSt_TKSU)) >> (CP0TCSt_TKSU - CP0St_R0);
-    RETURN();
+    T0 |= (tcstatus & (0x3 << CP0TCSt_TKSU)) >> (CP0TCSt_TKSU - CP0St_KSU);
+    FORCE_RET();
 }
 
 void op_mfc0_intctl (void)
 {
     T0 = env->CP0_IntCtl;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsctl (void)
 {
     T0 = env->CP0_SRSCtl;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsmap (void)
 {
     T0 = env->CP0_SRSMap;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_cause (void)
 {
     T0 = env->CP0_Cause;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_epc (void)
 {
     T0 = (int32_t)env->CP0_EPC;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_prid (void)
 {
     T0 = env->CP0_PRid;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_ebase (void)
 {
     T0 = env->CP0_EBase;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config0 (void)
 {
     T0 = env->CP0_Config0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config1 (void)
 {
     T0 = env->CP0_Config1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config2 (void)
 {
     T0 = env->CP0_Config2;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config3 (void)
 {
     T0 = env->CP0_Config3;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config6 (void)
 {
     T0 = env->CP0_Config6;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config7 (void)
 {
     T0 = env->CP0_Config7;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_lladdr (void)
 {
     T0 = (int32_t)env->CP0_LLAddr >> 4;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_watchlo (void)
 {
     T0 = (int32_t)env->CP0_WatchLo[PARAM1];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_watchhi (void)
 {
     T0 = env->CP0_WatchHi[PARAM1];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_xcontext (void)
 {
     T0 = (int32_t)env->CP0_XContext;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_framemask (void)
 {
     T0 = env->CP0_Framemask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_debug (void)
@@ -1417,7 +1388,7 @@ void op_mfc0_debug (void)
     T0 = env->CP0_Debug;
     if (env->hflags & MIPS_HFLAG_DM)
         T0 |= 1 << CP0DB_DM;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_debug(void)
@@ -1428,61 +1399,68 @@ void op_mftc0_debug(void)
     T0 = (env->CP0_Debug & ~((1 << CP0DB_SSt) | (1 << CP0DB_Halt))) |
          (env->CP0_Debug_tcstatus[other_tc] &
           ((1 << CP0DB_SSt) | (1 << CP0DB_Halt)));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_depc (void)
 {
     T0 = (int32_t)env->CP0_DEPC;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_performance0 (void)
 {
     T0 = env->CP0_Performance0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_taglo (void)
 {
     T0 = env->CP0_TagLo;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_datalo (void)
 {
     T0 = env->CP0_DataLo;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_taghi (void)
 {
     T0 = env->CP0_TagHi;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_datahi (void)
 {
     T0 = env->CP0_DataHi;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_errorepc (void)
 {
     T0 = (int32_t)env->CP0_ErrorEPC;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_desave (void)
 {
     T0 = env->CP0_DESAVE;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_index (void)
 {
-    env->CP0_Index = (env->CP0_Index & 0x80000000) | (T0 % env->tlb->nb_tlb);
-    RETURN();
+    int num = 1;
+    unsigned int tmp = env->tlb->nb_tlb;
+
+    do {
+        tmp >>= 1;
+        num <<= 1;
+    } while (tmp);
+    env->CP0_Index = (env->CP0_Index & 0x80000000) | (T0 & (num - 1));
+    FORCE_RET();
 }
 
 void op_mtc0_mvpcontrol (void)
@@ -1500,7 +1478,7 @@ void op_mtc0_mvpcontrol (void)
     // TODO: Enable/disable shared TLB, enable/disable VPEs.
 
     env->mvp->CP0_MVPControl = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpecontrol (void)
@@ -1518,7 +1496,7 @@ void op_mtc0_vpecontrol (void)
     // TODO: Enable/disable TCs.
 
     env->CP0_VPEControl = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpeconf0 (void)
@@ -1536,7 +1514,7 @@ void op_mtc0_vpeconf0 (void)
     // TODO: TC exclusive handling due to ERL/EXL.
 
     env->CP0_VPEConf0 = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpeconf1 (void)
@@ -1555,32 +1533,32 @@ void op_mtc0_vpeconf1 (void)
     // TODO: Handle FPU (CP1) binding.
 
     env->CP0_VPEConf1 = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_yqmask (void)
 {
     /* Yield qualifier inputs not implemented. */
     env->CP0_YQMask = 0x00000000;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpeschedule (void)
 {
     env->CP0_VPESchedule = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpeschefback (void)
 {
     env->CP0_VPEScheFBack = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpeopt (void)
 {
     env->CP0_VPEOpt = T0 & 0x0000ffff;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_entrylo0 (void)
@@ -1588,7 +1566,7 @@ void op_mtc0_entrylo0 (void)
     /* Large physaddr not implemented */
     /* 1k pages not implemented */
     env->CP0_EntryLo0 = T0 & 0x3FFFFFFF;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tcstatus (void)
@@ -1601,7 +1579,7 @@ void op_mtc0_tcstatus (void)
     // TODO: Sync with CP0_Status.
 
     env->CP0_TCStatus[env->current_tc] = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tcstatus (void)
@@ -1611,7 +1589,7 @@ void op_mttc0_tcstatus (void)
     // TODO: Sync with CP0_Status.
 
     env->CP0_TCStatus[other_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tcbind (void)
@@ -1623,7 +1601,7 @@ void op_mtc0_tcbind (void)
         mask |= (1 << CP0TCBd_CurVPE);
     newval = (env->CP0_TCBind[env->current_tc] & ~mask) | (T0 & mask);
     env->CP0_TCBind[env->current_tc] = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tcbind (void)
@@ -1636,7 +1614,7 @@ void op_mttc0_tcbind (void)
         mask |= (1 << CP0TCBd_CurVPE);
     newval = (env->CP0_TCBind[other_tc] & ~mask) | (T0 & mask);
     env->CP0_TCBind[other_tc] = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tcrestart (void)
@@ -1645,7 +1623,7 @@ void op_mtc0_tcrestart (void)
     env->CP0_TCStatus[env->current_tc] &= ~(1 << CP0TCSt_TDS);
     env->CP0_LLAddr = 0ULL;
     /* MIPS16 not implemented. */
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tcrestart (void)
@@ -1656,7 +1634,7 @@ void op_mttc0_tcrestart (void)
     env->CP0_TCStatus[other_tc] &= ~(1 << CP0TCSt_TDS);
     env->CP0_LLAddr = 0ULL;
     /* MIPS16 not implemented. */
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tchalt (void)
@@ -1665,7 +1643,7 @@ void op_mtc0_tchalt (void)
 
     // TODO: Halt TC / Restart (if allocated+active) TC.
 
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tchalt (void)
@@ -1675,13 +1653,13 @@ void op_mttc0_tchalt (void)
     // TODO: Halt TC / Restart (if allocated+active) TC.
 
     env->CP0_TCHalt[other_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tccontext (void)
 {
     env->CP0_TCContext[env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tccontext (void)
@@ -1689,13 +1667,13 @@ void op_mttc0_tccontext (void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     env->CP0_TCContext[other_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tcschedule (void)
 {
     env->CP0_TCSchedule[env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tcschedule (void)
@@ -1703,13 +1681,13 @@ void op_mttc0_tcschedule (void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     env->CP0_TCSchedule[other_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tcschefback (void)
 {
     env->CP0_TCScheFBack[env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tcschefback (void)
@@ -1717,7 +1695,7 @@ void op_mttc0_tcschefback (void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     env->CP0_TCScheFBack[other_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_entrylo1 (void)
@@ -1725,20 +1703,20 @@ void op_mtc0_entrylo1 (void)
     /* Large physaddr not implemented */
     /* 1k pages not implemented */
     env->CP0_EntryLo1 = T0 & 0x3FFFFFFF;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_context (void)
 {
     env->CP0_Context = (env->CP0_Context & 0x007FFFFF) | (T0 & ~0x007FFFFF);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_pagemask (void)
 {
     /* 1k pages not implemented */
     env->CP0_PageMask = T0 & (0x1FFFFFFF & (TARGET_PAGE_MASK << 1));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_pagegrain (void)
@@ -1747,55 +1725,55 @@ void op_mtc0_pagegrain (void)
     /* Large physaddr not implemented */
     /* 1k pages not implemented */
     env->CP0_PageGrain = 0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_wired (void)
 {
     env->CP0_Wired = T0 % env->tlb->nb_tlb;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_srsconf0 (void)
 {
     env->CP0_SRSConf0 |= T0 & env->CP0_SRSConf0_rw_bitmask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_srsconf1 (void)
 {
     env->CP0_SRSConf1 |= T0 & env->CP0_SRSConf1_rw_bitmask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_srsconf2 (void)
 {
     env->CP0_SRSConf2 |= T0 & env->CP0_SRSConf2_rw_bitmask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_srsconf3 (void)
 {
     env->CP0_SRSConf3 |= T0 & env->CP0_SRSConf3_rw_bitmask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_srsconf4 (void)
 {
     env->CP0_SRSConf4 |= T0 & env->CP0_SRSConf4_rw_bitmask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_hwrena (void)
 {
     env->CP0_HWREna = T0 & 0x0000000F;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_count (void)
 {
     CALL_FROM_TB2(cpu_mips_store_count, env, T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_entryhi (void)
@@ -1804,7 +1782,7 @@ void op_mtc0_entryhi (void)
 
     /* 1k pages not implemented */
     val = T0 & ((TARGET_PAGE_MASK << 1) | 0xFF);
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     val &= env->SEGMask;
 #endif
     old = env->CP0_EntryHi;
@@ -1816,7 +1794,7 @@ void op_mtc0_entryhi (void)
     /* If the ASID changes, flush qemu's TLB.  */
     if ((old & 0xFF) != (val & 0xFF))
         CALL_FROM_TB2(cpu_mips_tlb_flush, env, 1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_entryhi(void)
@@ -1825,13 +1803,13 @@ void op_mttc0_entryhi(void)
 
     env->CP0_EntryHi = (env->CP0_EntryHi & 0xff) | (T0 & ~0xff);
     env->CP0_TCStatus[other_tc] = (env->CP0_TCStatus[other_tc] & ~0xff) | (T0 & 0xff);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_compare (void)
 {
     CALL_FROM_TB2(cpu_mips_store_compare, env, T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_status (void)
@@ -1846,7 +1824,7 @@ void op_mtc0_status (void)
     if (loglevel & CPU_LOG_EXEC)
         CALL_FROM_TB2(do_mtc0_status_debug, old, val);
     CALL_FROM_TB1(cpu_mips_update_irq, env);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_status(void)
@@ -1857,29 +1835,29 @@ void op_mttc0_status(void)
     env->CP0_Status = T0 & ~0xf1000018;
     tcstatus = (tcstatus & ~(0xf << CP0TCSt_TCU0)) | (T0 & (0xf << CP0St_CU0));
     tcstatus = (tcstatus & ~(1 << CP0TCSt_TMX)) | ((T0 & (1 << CP0St_MX)) << (CP0TCSt_TMX - CP0St_MX));
-    tcstatus = (tcstatus & ~(0x3 << CP0TCSt_TKSU)) | ((T0 & (0x3 << CP0St_R0)) << (CP0TCSt_TKSU - CP0St_R0));
+    tcstatus = (tcstatus & ~(0x3 << CP0TCSt_TKSU)) | ((T0 & (0x3 << CP0St_KSU)) << (CP0TCSt_TKSU - CP0St_KSU));
     env->CP0_TCStatus[other_tc] = tcstatus;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_intctl (void)
 {
     /* vectored interrupts not implemented, no performance counters. */
     env->CP0_IntCtl = (env->CP0_IntCtl & ~0x000002e0) | (T0 & 0x000002e0);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_srsctl (void)
 {
     uint32_t mask = (0xf << CP0SRSCtl_ESS) | (0xf << CP0SRSCtl_PSS);
     env->CP0_SRSCtl = (env->CP0_SRSCtl & ~mask) | (T0 & mask);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_srsmap (void)
 {
     env->CP0_SRSMap = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_cause (void)
@@ -1904,13 +1882,13 @@ void op_mtc0_cause (void)
     if (T0 & CP0Ca_IP_mask) {
         CALL_FROM_TB1(cpu_mips_update_irq, env);
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_epc (void)
 {
     env->CP0_EPC = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_ebase (void)
@@ -1918,20 +1896,20 @@ void op_mtc0_ebase (void)
     /* vectored interrupts not implemented */
     /* Multi-CPU not implemented */
     env->CP0_EBase = 0x80000000 | (T0 & 0x3FFFF000);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_config0 (void)
 {
     env->CP0_Config0 = (env->CP0_Config0 & 0x81FFFFF8) | (T0 & 0x00000007);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_config2 (void)
 {
     /* tertiary/secondary caches not implemented */
     env->CP0_Config2 = (env->CP0_Config2 & 0x8FFF0FFF);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_watchlo (void)
@@ -1939,27 +1917,27 @@ void op_mtc0_watchlo (void)
     /* Watch exceptions for instructions, data loads, data stores
        not implemented. */
     env->CP0_WatchLo[PARAM1] = (T0 & ~0x7);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_watchhi (void)
 {
     env->CP0_WatchHi[PARAM1] = (T0 & 0x40FF0FF8);
     env->CP0_WatchHi[PARAM1] &= ~(env->CP0_WatchHi[PARAM1] & T0 & 0x7);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_xcontext (void)
 {
     target_ulong mask = (1ULL << (env->SEGBITS - 7)) - 1;
     env->CP0_XContext = (env->CP0_XContext & mask) | (T0 & ~mask);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_framemask (void)
 {
     env->CP0_Framemask = T0; /* XXX */
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_debug (void)
@@ -1969,7 +1947,7 @@ void op_mtc0_debug (void)
         env->hflags |= MIPS_HFLAG_DM;
     else
         env->hflags &= ~MIPS_HFLAG_DM;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_debug(void)
@@ -1980,172 +1958,172 @@ void op_mttc0_debug(void)
     env->CP0_Debug_tcstatus[other_tc] = T0 & ((1 << CP0DB_SSt) | (1 << CP0DB_Halt));
     env->CP0_Debug = (env->CP0_Debug & ((1 << CP0DB_SSt) | (1 << CP0DB_Halt))) |
                      (T0 & ~((1 << CP0DB_SSt) | (1 << CP0DB_Halt)));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_depc (void)
 {
     env->CP0_DEPC = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_performance0 (void)
 {
-    env->CP0_Performance0 = T0; /* XXX */
-    RETURN();
+    env->CP0_Performance0 = T0 & 0x000007ff;
+    FORCE_RET();
 }
 
 void op_mtc0_taglo (void)
 {
     env->CP0_TagLo = T0 & 0xFFFFFCF6;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_datalo (void)
 {
     env->CP0_DataLo = T0; /* XXX */
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_taghi (void)
 {
     env->CP0_TagHi = T0; /* XXX */
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_datahi (void)
 {
     env->CP0_DataHi = T0; /* XXX */
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_errorepc (void)
 {
     env->CP0_ErrorEPC = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_desave (void)
 {
     env->CP0_DESAVE = T0;
-    RETURN();
+    FORCE_RET();
 }
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 void op_dmfc0_yqmask (void)
 {
     T0 = env->CP0_YQMask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_vpeschedule (void)
 {
     T0 = env->CP0_VPESchedule;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_vpeschefback (void)
 {
     T0 = env->CP0_VPEScheFBack;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_entrylo0 (void)
 {
     T0 = env->CP0_EntryLo0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_tcrestart (void)
 {
     T0 = env->PC[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_tchalt (void)
 {
     T0 = env->CP0_TCHalt[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_tccontext (void)
 {
     T0 = env->CP0_TCContext[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_tcschedule (void)
 {
     T0 = env->CP0_TCSchedule[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_tcschefback (void)
 {
     T0 = env->CP0_TCScheFBack[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_entrylo1 (void)
 {
     T0 = env->CP0_EntryLo1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_context (void)
 {
     T0 = env->CP0_Context;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_badvaddr (void)
 {
     T0 = env->CP0_BadVAddr;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_entryhi (void)
 {
     T0 = env->CP0_EntryHi;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_epc (void)
 {
     T0 = env->CP0_EPC;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_lladdr (void)
 {
     T0 = env->CP0_LLAddr >> 4;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_watchlo (void)
 {
     T0 = env->CP0_WatchLo[PARAM1];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_xcontext (void)
 {
     T0 = env->CP0_XContext;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_depc (void)
 {
     T0 = env->CP0_DEPC;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc0_errorepc (void)
 {
     T0 = env->CP0_ErrorEPC;
-    RETURN();
+    FORCE_RET();
 }
-#endif /* TARGET_MIPSN32 || TARGET_MIPS64 */
+#endif /* TARGET_MIPS64 */
 
 /* MIPS MT functions */
 void op_mftgpr(void)
@@ -2153,7 +2131,7 @@ void op_mftgpr(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->gpr[PARAM1][other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftlo(void)
@@ -2161,7 +2139,7 @@ void op_mftlo(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->LO[PARAM1][other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfthi(void)
@@ -2169,7 +2147,7 @@ void op_mfthi(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->HI[PARAM1][other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftacx(void)
@@ -2177,7 +2155,7 @@ void op_mftacx(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->ACX[PARAM1][other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftdsp(void)
@@ -2185,7 +2163,7 @@ void op_mftdsp(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->DSPControl[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttgpr(void)
@@ -2193,7 +2171,7 @@ void op_mttgpr(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->gpr[PARAM1][other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttlo(void)
@@ -2201,7 +2179,7 @@ void op_mttlo(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->LO[PARAM1][other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtthi(void)
@@ -2209,7 +2187,7 @@ void op_mtthi(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->HI[PARAM1][other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttacx(void)
@@ -2217,7 +2195,7 @@ void op_mttacx(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->ACX[PARAM1][other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttdsp(void)
@@ -2225,7 +2203,7 @@ void op_mttdsp(void)
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->DSPControl[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 
@@ -2234,7 +2212,7 @@ void op_dmt(void)
     // TODO
     T0 = 0;
     // rt = T0
-    RETURN();
+    FORCE_RET();
 }
 
 void op_emt(void)
@@ -2242,7 +2220,7 @@ void op_emt(void)
     // TODO
     T0 = 0;
     // rt = T0
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dvpe(void)
@@ -2250,7 +2228,7 @@ void op_dvpe(void)
     // TODO
     T0 = 0;
     // rt = T0
-    RETURN();
+    FORCE_RET();
 }
 
 void op_evpe(void)
@@ -2258,7 +2236,7 @@ void op_evpe(void)
     // TODO
     T0 = 0;
     // rt = T0
-    RETURN();
+    FORCE_RET();
 }
 
 void op_fork(void)
@@ -2266,7 +2244,7 @@ void op_fork(void)
     // T0 = rt, T1 = rs
     T0 = 0;
     // TODO: store to TC register
-    RETURN();
+    FORCE_RET();
 }
 
 void op_yield(void)
@@ -2295,7 +2273,7 @@ void op_yield(void)
         CALL_FROM_TB1(do_raise_exception, EXCP_THREAD);
     }
     T0 = env->CP0_YQMask;
-    RETURN();
+    FORCE_RET();
 }
 
 /* CP1 functions */
@@ -2309,56 +2287,56 @@ void op_cfc1 (void)
 {
     CALL_FROM_TB1(do_cfc1, PARAM1);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 void op_ctc1 (void)
 {
     CALL_FROM_TB1(do_ctc1, PARAM1);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc1 (void)
 {
-    T0 = WT0;
+    T0 = (int32_t)WT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc1 (void)
 {
     WT0 = T0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmfc1 (void)
 {
     T0 = DT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmtc1 (void)
 {
     DT0 = T0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfhc1 (void)
 {
-    T0 = WTH0;
+    T0 = (int32_t)WTH0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mthc1 (void)
 {
     WTH0 = T0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 /* Float support.
@@ -2372,117 +2350,117 @@ FLOAT_OP(cvtd, s)
 {
     CALL_FROM_TB0(do_float_cvtd_s);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvtd, w)
 {
     CALL_FROM_TB0(do_float_cvtd_w);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvtd, l)
 {
     CALL_FROM_TB0(do_float_cvtd_l);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvtl, d)
 {
     CALL_FROM_TB0(do_float_cvtl_d);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvtl, s)
 {
     CALL_FROM_TB0(do_float_cvtl_s);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvtps, s)
 {
     WT2 = WT0;
     WTH2 = WT1;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvtps, pw)
 {
     CALL_FROM_TB0(do_float_cvtps_pw);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvtpw, ps)
 {
     CALL_FROM_TB0(do_float_cvtpw_ps);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvts, d)
 {
     CALL_FROM_TB0(do_float_cvts_d);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvts, w)
 {
     CALL_FROM_TB0(do_float_cvts_w);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvts, l)
 {
     CALL_FROM_TB0(do_float_cvts_l);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvts, pl)
 {
     CALL_FROM_TB0(do_float_cvts_pl);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvts, pu)
 {
     CALL_FROM_TB0(do_float_cvts_pu);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvtw, s)
 {
     CALL_FROM_TB0(do_float_cvtw_s);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(cvtw, d)
 {
     CALL_FROM_TB0(do_float_cvtw_d);
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 FLOAT_OP(pll, ps)
 {
     DT2 = ((uint64_t)WT0 << 32) | WT1;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(plu, ps)
 {
     DT2 = ((uint64_t)WT0 << 32) | WTH1;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(pul, ps)
 {
     DT2 = ((uint64_t)WTH0 << 32) | WT1;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(puu, ps)
 {
     DT2 = ((uint64_t)WTH0 << 32) | WTH1;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 #define FLOAT_ROUNDOP(op, ttype, stype)                    \
@@ -2490,7 +2468,7 @@ FLOAT_OP(op ## ttype, stype)                               \
 {                                                          \
     CALL_FROM_TB0(do_float_ ## op ## ttype ## _ ## stype); \
     DEBUG_FPU_STATE();                                     \
-    RETURN();                                              \
+    FORCE_RET();                                           \
 }
 
 FLOAT_ROUNDOP(round, l, d)
@@ -2519,14 +2497,14 @@ FLOAT_OP(movf, d)
     if (!(env->fpu->fcr31 & PARAM1))
         DT2 = DT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movf, s)
 {
     if (!(env->fpu->fcr31 & PARAM1))
         WT2 = WT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movf, ps)
 {
@@ -2535,21 +2513,21 @@ FLOAT_OP(movf, ps)
         WTH2 = WTH0;
     }
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movt, d)
 {
     if (env->fpu->fcr31 & PARAM1)
         DT2 = DT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movt, s)
 {
     if (env->fpu->fcr31 & PARAM1)
         WT2 = WT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movt, ps)
 {
@@ -2558,21 +2536,21 @@ FLOAT_OP(movt, ps)
         WTH2 = WTH0;
     }
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movz, d)
 {
     if (!T0)
         DT2 = DT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movz, s)
 {
     if (!T0)
         WT2 = WT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movz, ps)
 {
@@ -2581,21 +2559,21 @@ FLOAT_OP(movz, ps)
         WTH2 = WTH0;
     }
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movn, d)
 {
     if (T0)
         DT2 = DT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movn, s)
 {
     if (T0)
         WT2 = WT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(movn, ps)
 {
@@ -2604,28 +2582,28 @@ FLOAT_OP(movn, ps)
         WTH2 = WTH0;
     }
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 /* operations calling helpers, for s, d and ps */
-#define FLOAT_HOP(name) \
+#define FLOAT_HOP(name)   \
 FLOAT_OP(name, d)         \
 {                         \
     CALL_FROM_TB0(do_float_ ## name ## _d);  \
     DEBUG_FPU_STATE();    \
-    RETURN();             \
+    FORCE_RET();          \
 }                         \
 FLOAT_OP(name, s)         \
 {                         \
     CALL_FROM_TB0(do_float_ ## name ## _s);  \
     DEBUG_FPU_STATE();    \
-    RETURN();             \
+    FORCE_RET();          \
 }                         \
 FLOAT_OP(name, ps)        \
 {                         \
     CALL_FROM_TB0(do_float_ ## name ## _ps); \
     DEBUG_FPU_STATE();    \
-    RETURN();             \
+    FORCE_RET();          \
 }
 FLOAT_HOP(add)
 FLOAT_HOP(sub)
@@ -2643,13 +2621,13 @@ FLOAT_OP(name, d)         \
 {                         \
     CALL_FROM_TB0(do_float_ ## name ## _d);  \
     DEBUG_FPU_STATE();    \
-    RETURN();             \
+    FORCE_RET();          \
 }                         \
 FLOAT_OP(name, s)         \
 {                         \
     CALL_FROM_TB0(do_float_ ## name ## _s);  \
     DEBUG_FPU_STATE();    \
-    RETURN();             \
+    FORCE_RET();          \
 }
 FLOAT_HOP(rsqrt)
 FLOAT_HOP(recip)
@@ -2661,7 +2639,7 @@ FLOAT_OP(name, ps)        \
 {                         \
     CALL_FROM_TB0(do_float_ ## name ## _ps); \
     DEBUG_FPU_STATE();    \
-    RETURN();             \
+    FORCE_RET();          \
 }
 FLOAT_HOP(addr)
 FLOAT_HOP(mulr)
@@ -2674,14 +2652,14 @@ FLOAT_OP(name1 ## name2, d)        \
     FDT0 = float64_ ## name1 (FDT0, FDT1, &env->fpu->fp_status);    \
     FDT2 = float64_ ## name2 (FDT0, FDT2, &env->fpu->fp_status);    \
     DEBUG_FPU_STATE();             \
-    RETURN();                      \
+    FORCE_RET();                   \
 }                                  \
 FLOAT_OP(name1 ## name2, s)        \
 {                                  \
     FST0 = float32_ ## name1 (FST0, FST1, &env->fpu->fp_status);    \
     FST2 = float32_ ## name2 (FST0, FST2, &env->fpu->fp_status);    \
     DEBUG_FPU_STATE();             \
-    RETURN();                      \
+    FORCE_RET();                   \
 }                                  \
 FLOAT_OP(name1 ## name2, ps)       \
 {                                  \
@@ -2690,7 +2668,7 @@ FLOAT_OP(name1 ## name2, ps)       \
     FST2 = float32_ ## name2 (FST0, FST2, &env->fpu->fp_status);    \
     FSTH2 = float32_ ## name2 (FSTH0, FSTH2, &env->fpu->fp_status); \
     DEBUG_FPU_STATE();             \
-    RETURN();                      \
+    FORCE_RET();                   \
 }
 FLOAT_TERNOP(mul, add)
 FLOAT_TERNOP(mul, sub)
@@ -2702,17 +2680,17 @@ FLOAT_OP(n ## name1 ## name2, d)    \
 {                                   \
     FDT0 = float64_ ## name1 (FDT0, FDT1, &env->fpu->fp_status);    \
     FDT2 = float64_ ## name2 (FDT0, FDT2, &env->fpu->fp_status);    \
-    FDT2 ^= 1ULL << 63;             \
+    FDT2 = float64_chs(FDT2);       \
     DEBUG_FPU_STATE();              \
-    RETURN();                       \
+    FORCE_RET();                    \
 }                                   \
 FLOAT_OP(n ## name1 ## name2, s)    \
 {                                   \
     FST0 = float32_ ## name1 (FST0, FST1, &env->fpu->fp_status);    \
     FST2 = float32_ ## name2 (FST0, FST2, &env->fpu->fp_status);    \
-    FST2 ^= 1 << 31;                \
+    FST2 = float32_chs(FST2);       \
     DEBUG_FPU_STATE();              \
-    RETURN();                       \
+    FORCE_RET();                    \
 }                                   \
 FLOAT_OP(n ## name1 ## name2, ps)   \
 {                                   \
@@ -2720,10 +2698,10 @@ FLOAT_OP(n ## name1 ## name2, ps)   \
     FSTH0 = float32_ ## name1 (FSTH0, FSTH1, &env->fpu->fp_status); \
     FST2 = float32_ ## name2 (FST0, FST2, &env->fpu->fp_status);    \
     FSTH2 = float32_ ## name2 (FSTH0, FSTH2, &env->fpu->fp_status); \
-    FST2 ^= 1 << 31;                \
-    FSTH2 ^= 1 << 31;               \
+    FST2 = float32_chs(FST2);       \
+    FSTH2 = float32_chs(FSTH2);     \
     DEBUG_FPU_STATE();              \
-    RETURN();                       \
+    FORCE_RET();                    \
 }
 FLOAT_NTERNOP(mul, add)
 FLOAT_NTERNOP(mul, sub)
@@ -2733,15 +2711,15 @@ FLOAT_NTERNOP(mul, sub)
 #define FLOAT_UNOP(name)  \
 FLOAT_OP(name, d)         \
 {                         \
-    FDT2 = float64_ ## name(FDT0, &env->fpu->fp_status);   \
+    FDT2 = float64_ ## name(FDT0, &env->fpu->fp_status); \
     DEBUG_FPU_STATE();    \
-    RETURN();                      \
+    FORCE_RET();          \
 }                         \
 FLOAT_OP(name, s)         \
 {                         \
-    FST2 = float32_ ## name(FST0, &env->fpu->fp_status);   \
+    FST2 = float32_ ## name(FST0, &env->fpu->fp_status); \
     DEBUG_FPU_STATE();    \
-    RETURN();             \
+    FORCE_RET();          \
 }
 FLOAT_UNOP(sqrt)
 #undef FLOAT_UNOP
@@ -2752,20 +2730,20 @@ FLOAT_OP(name, d)         \
 {                         \
     FDT2 = float64_ ## name(FDT0);   \
     DEBUG_FPU_STATE();    \
-    RETURN();             \
+    FORCE_RET();          \
 }                         \
 FLOAT_OP(name, s)         \
 {                         \
     FST2 = float32_ ## name(FST0);   \
     DEBUG_FPU_STATE();    \
-    RETURN();             \
+    FORCE_RET();          \
 }                         \
 FLOAT_OP(name, ps)        \
 {                         \
     FST2 = float32_ ## name(FST0);   \
     FSTH2 = float32_ ## name(FSTH0); \
     DEBUG_FPU_STATE();    \
-    RETURN();             \
+    FORCE_RET();          \
 }
 FLOAT_UNOP(abs)
 FLOAT_UNOP(chs)
@@ -2775,20 +2753,20 @@ FLOAT_OP(mov, d)
 {
     FDT2 = FDT0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(mov, s)
 {
     FST2 = FST0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(mov, ps)
 {
     FST2 = FST0;
     FSTH2 = FSTH0;
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 FLOAT_OP(alnv, ps)
 {
@@ -2810,14 +2788,14 @@ FLOAT_OP(alnv, ps)
         break;
     }
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 #ifdef CONFIG_SOFTFLOAT
 #define clear_invalid() do {                                \
     int flags = get_float_exception_flags(&env->fpu->fp_status); \
     flags &= ~float_flag_invalid;                           \
-    set_float_exception_flags(flags, &env->fpu->fp_status);      \
+    set_float_exception_flags(flags, &env->fpu->fp_status); \
 } while(0)
 #else
 #define clear_invalid() do { } while(0)
@@ -2830,13 +2808,13 @@ void OPPROTO op_cmp ## _ ## fmt ## _ ## op(void)       \
 {                                                      \
     CALL_FROM_TB1(do_cmp ## _ ## fmt ## _ ## op, PARAM1); \
     DEBUG_FPU_STATE();                                 \
-    RETURN();                                          \
+    FORCE_RET();                                       \
 }                                                      \
 void OPPROTO op_cmpabs ## _ ## fmt ## _ ## op(void)    \
 {                                                      \
     CALL_FROM_TB1(do_cmpabs ## _ ## fmt ## _ ## op, PARAM1); \
     DEBUG_FPU_STATE();                                 \
-    RETURN();                                          \
+    FORCE_RET();                                       \
 }
 #define CMP_OPS(op)   \
 CMP_OP(d, op)         \
@@ -2866,62 +2844,62 @@ void op_bc1f (void)
 {
     T0 = !!(~GET_FP_COND(env->fpu) & (0x1 << PARAM1));
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 void op_bc1any2f (void)
 {
     T0 = !!(~GET_FP_COND(env->fpu) & (0x3 << PARAM1));
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 void op_bc1any4f (void)
 {
     T0 = !!(~GET_FP_COND(env->fpu) & (0xf << PARAM1));
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 void op_bc1t (void)
 {
     T0 = !!(GET_FP_COND(env->fpu) & (0x1 << PARAM1));
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 void op_bc1any2t (void)
 {
     T0 = !!(GET_FP_COND(env->fpu) & (0x3 << PARAM1));
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 void op_bc1any4t (void)
 {
     T0 = !!(GET_FP_COND(env->fpu) & (0xf << PARAM1));
     DEBUG_FPU_STATE();
-    RETURN();
+    FORCE_RET();
 }
 
 void op_tlbwi (void)
 {
     CALL_FROM_TB0(env->tlb->do_tlbwi);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_tlbwr (void)
 {
     CALL_FROM_TB0(env->tlb->do_tlbwr);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_tlbp (void)
 {
     CALL_FROM_TB0(env->tlb->do_tlbp);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_tlbr (void)
 {
     CALL_FROM_TB0(env->tlb->do_tlbr);
-    RETURN();
+    FORCE_RET();
 }
 
 /* Specials */
@@ -2935,7 +2913,7 @@ void op_tls_value (void)
 void op_pmon (void)
 {
     CALL_FROM_TB1(do_pmon, PARAM1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_di (void)
@@ -2943,7 +2921,7 @@ void op_di (void)
     T0 = env->CP0_Status;
     env->CP0_Status = T0 & ~(1 << CP0St_IE);
     CALL_FROM_TB1(cpu_mips_update_irq, env);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_ei (void)
@@ -2951,7 +2929,7 @@ void op_ei (void)
     T0 = env->CP0_Status;
     env->CP0_Status = T0 | (1 << CP0St_IE);
     CALL_FROM_TB1(cpu_mips_update_irq, env);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_trap (void)
@@ -2959,19 +2937,19 @@ void op_trap (void)
     if (T0) {
         CALL_FROM_TB1(do_raise_exception, EXCP_TRAP);
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_debug (void)
 {
     CALL_FROM_TB1(do_raise_exception, EXCP_DEBUG);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_set_lladdr (void)
 {
     env->CP0_LLAddr = T2;
-    RETURN();
+    FORCE_RET();
 }
 
 void debug_pre_eret (void);
@@ -2991,7 +2969,7 @@ void op_eret (void)
     if (loglevel & CPU_LOG_EXEC)
         CALL_FROM_TB0(debug_post_eret);
     env->CP0_LLAddr = 1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_deret (void)
@@ -3004,7 +2982,7 @@ void op_deret (void)
     if (loglevel & CPU_LOG_EXEC)
         CALL_FROM_TB0(debug_post_eret);
     env->CP0_LLAddr = 1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_rdhwr_cpunum(void)
@@ -3014,7 +2992,7 @@ void op_rdhwr_cpunum(void)
         T0 = env->CP0_EBase & 0x3ff;
     else
         CALL_FROM_TB1(do_raise_exception, EXCP_RI);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_rdhwr_synci_step(void)
@@ -3024,7 +3002,7 @@ void op_rdhwr_synci_step(void)
         T0 = env->SYNCI_Step;
     else
         CALL_FROM_TB1(do_raise_exception, EXCP_RI);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_rdhwr_cc(void)
@@ -3034,7 +3012,7 @@ void op_rdhwr_cc(void)
         T0 = env->CP0_Count;
     else
         CALL_FROM_TB1(do_raise_exception, EXCP_RI);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_rdhwr_ccres(void)
@@ -3044,26 +3022,26 @@ void op_rdhwr_ccres(void)
         T0 = env->CCRes;
     else
         CALL_FROM_TB1(do_raise_exception, EXCP_RI);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_save_state (void)
 {
     env->hflags = PARAM1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_save_pc (void)
 {
     env->PC[env->current_tc] = PARAM1;
-    RETURN();
+    FORCE_RET();
 }
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 void op_save_pc64 (void)
 {
     env->PC[env->current_tc] = ((uint64_t)PARAM1 << 32) | (uint32_t)PARAM2;
-    RETURN();
+    FORCE_RET();
 }
 #endif
 
@@ -3077,32 +3055,32 @@ void op_interrupt_restart (void)
         env->CP0_Cause &= ~(0x1f << CP0Ca_EC);
         CALL_FROM_TB1(do_raise_exception, EXCP_EXT_INTERRUPT);
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_raise_exception (void)
 {
     CALL_FROM_TB1(do_raise_exception, PARAM1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_raise_exception_err (void)
 {
     CALL_FROM_TB2(do_raise_exception_err, PARAM1, PARAM2);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_exit_tb (void)
 {
     EXIT_TB();
-    RETURN();
+    FORCE_RET();
 }
 
 void op_wait (void)
 {
     env->halted = 1;
     CALL_FROM_TB1(do_raise_exception, EXCP_HLT);
-    RETURN();
+    FORCE_RET();
 }
 
 /* Bitfield operations. */
@@ -3111,8 +3089,8 @@ void op_ext(void)
     unsigned int pos = PARAM1;
     unsigned int size = PARAM2;
 
-    T0 = ((uint32_t)T1 >> pos) & ((size < 32) ? ((1 << size) - 1) : ~0);
-    RETURN();
+    T0 = (int32_t)((T1 >> pos) & ((size < 32) ? ((1 << size) - 1) : ~0));
+    FORCE_RET();
 }
 
 void op_ins(void)
@@ -3121,57 +3099,58 @@ void op_ins(void)
     unsigned int size = PARAM2;
     target_ulong mask = ((size < 32) ? ((1 << size) - 1) : ~0) << pos;
 
-    T0 = (T0 & ~mask) | (((uint32_t)T1 << pos) & mask);
-    RETURN();
+    T0 = (int32_t)((T0 & ~mask) | ((T1 << pos) & mask));
+    FORCE_RET();
 }
 
 void op_wsbh(void)
 {
-    T0 = ((T1 << 8) & ~0x00FF00FF) | ((T1 >> 8) & 0x00FF00FF);
-    RETURN();
+    T0 = (int32_t)(((T1 << 8) & ~0x00FF00FF) | ((T1 >> 8) & 0x00FF00FF));
+    FORCE_RET();
 }
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 void op_dext(void)
 {
     unsigned int pos = PARAM1;
     unsigned int size = PARAM2;
 
-    T0 = (T1 >> pos) & ((size < 32) ? ((1 << size) - 1) : ~0);
-    RETURN();
+    T0 = (T1 >> pos) & ((size < 64) ? ((1ULL << size) - 1) : ~0ULL);
+    FORCE_RET();
 }
 
 void op_dins(void)
 {
     unsigned int pos = PARAM1;
     unsigned int size = PARAM2;
-    target_ulong mask = ((size < 32) ? ((1 << size) - 1) : ~0) << pos;
+    target_ulong mask = ((size < 64) ? ((1ULL << size) - 1) : ~0ULL) << pos;
 
     T0 = (T0 & ~mask) | ((T1 << pos) & mask);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsbh(void)
 {
     T0 = ((T1 << 8) & ~0x00FF00FF00FF00FFULL) | ((T1 >> 8) & 0x00FF00FF00FF00FFULL);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dshd(void)
 {
-    T0 = ((T1 << 16) & ~0x0000FFFF0000FFFFULL) | ((T1 >> 16) & 0x0000FFFF0000FFFFULL);
-    RETURN();
+    T1 = ((T1 << 16) & ~0x0000FFFF0000FFFFULL) | ((T1 >> 16) & 0x0000FFFF0000FFFFULL);
+    T0 = (T1 << 32) | (T1 >> 32);
+    FORCE_RET();
 }
 #endif
 
 void op_seb(void)
 {
     T0 = ((T1 & 0xFF) ^ 0x80) - 0x80;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_seh(void)
 {
     T0 = ((T1 & 0xFFFF) ^ 0x8000) - 0x8000;
-    RETURN();
+    FORCE_RET();
 }
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index f4313280e..032302161 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -20,7 +20,13 @@
 #include <stdlib.h>
 #include "exec.h"
 
-#define GETPC() (__builtin_return_address(0))
+#include "host-utils.h"
+
+#ifdef __s390__
+# define GETPC() ((void*)((unsigned long)__builtin_return_address(0) & 0x7fffffffUL))
+#else
+# define GETPC() (__builtin_return_address(0))
+#endif
 
 /*****************************************************************************/
 /* Exceptions processing helpers */
@@ -62,19 +68,7 @@ void do_raise_exception_direct (uint32_t exception)
     do_raise_exception_direct_err (exception, 0);
 }
 
-#define MEMSUFFIX _raw
-#include "op_helper_mem.c"
-#undef MEMSUFFIX
-#if !defined(CONFIG_USER_ONLY)
-#define MEMSUFFIX _user
-#include "op_helper_mem.c"
-#undef MEMSUFFIX
-#define MEMSUFFIX _kernel
-#include "op_helper_mem.c"
-#undef MEMSUFFIX
-#endif
-
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 #if TARGET_LONG_BITS > HOST_LONG_BITS
 /* Those might call libgcc functions.  */
 void do_dsll (void)
@@ -112,8 +106,8 @@ void do_drotr (void)
     target_ulong tmp;
 
     if (T1) {
-       tmp = T0 << (0x40 - T1);
-       T0 = (T0 >> T1) | tmp;
+        tmp = T0 << (0x40 - T1);
+        T0 = (T0 >> T1) | tmp;
     }
 }
 
@@ -121,10 +115,8 @@ void do_drotr32 (void)
 {
     target_ulong tmp;
 
-    if (T1) {
-       tmp = T0 << (0x40 - (32 + T1));
-       T0 = (T0 >> (32 + T1)) | tmp;
-    }
+    tmp = T0 << (0x40 - (32 + T1));
+    T0 = (T0 >> (32 + T1)) | tmp;
 }
 
 void do_dsllv (void)
@@ -148,22 +140,33 @@ void do_drotrv (void)
 
     T0 &= 0x3F;
     if (T0) {
-       tmp = T1 << (0x40 - T0);
-       T0 = (T1 >> T0) | tmp;
+        tmp = T1 << (0x40 - T0);
+        T0 = (T1 >> T0) | tmp;
     } else
-       T0 = T1;
+        T0 = T1;
+}
+
+void do_dclo (void)
+{
+    T0 = clo64(T0);
 }
+
+void do_dclz (void)
+{
+    T0 = clz64(T0);
+}
+
 #endif /* TARGET_LONG_BITS > HOST_LONG_BITS */
-#endif /* TARGET_MIPSN32 || TARGET_MIPS64 */
+#endif /* TARGET_MIPS64 */
 
 /* 64 bits arithmetic for 32 bits hosts */
 #if TARGET_LONG_BITS > HOST_LONG_BITS
-static inline uint64_t get_HILO (void)
+static always_inline uint64_t get_HILO (void)
 {
     return (env->HI[0][env->current_tc] << 32) | (uint32_t)env->LO[0][env->current_tc];
 }
 
-static inline void set_HILO (uint64_t HILO)
+static always_inline void set_HILO (uint64_t HILO)
 {
     env->LO[0][env->current_tc] = (int32_t)HILO;
     env->HI[0][env->current_tc] = (int32_t)(HILO >> 32);
@@ -223,7 +226,7 @@ void do_div (void)
 }
 #endif
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 void do_ddiv (void)
 {
     if (T1 != 0) {
@@ -242,7 +245,7 @@ void do_ddivu (void)
     }
 }
 #endif
-#endif /* TARGET_MIPSN32 || TARGET_MIPS64 */
+#endif /* TARGET_MIPS64 */
 
 #if defined(CONFIG_USER_ONLY)
 void do_mfc0_random (void)
@@ -314,8 +317,12 @@ void do_mtc0_status_debug(uint32_t old, uint32_t val)
             old, old & env->CP0_Cause & CP0Ca_IP_mask,
             val, val & env->CP0_Cause & CP0Ca_IP_mask,
             env->CP0_Cause);
-    (env->hflags & MIPS_HFLAG_UM) ? fputs(", UM\n", logfile)
-                                  : fputs("\n", logfile);
+    switch (env->hflags & MIPS_HFLAG_KSU) {
+    case MIPS_HFLAG_UM: fputs(", UM\n", logfile); break;
+    case MIPS_HFLAG_SM: fputs(", SM\n", logfile); break;
+    case MIPS_HFLAG_KM: fputs("\n", logfile); break;
+    default: cpu_abort(env, "Invalid MMU mode!\n"); break;
+    }
 }
 
 void do_mtc0_status_irqraise_debug(void)
@@ -383,7 +390,7 @@ static void r4k_fill_tlb (int idx)
     /* XXX: detect conflicting TLBs and raise a MCHECK exception when needed */
     tlb = &env->tlb->mmu.r4k.tlb[idx];
     tlb->VPN = env->CP0_EntryHi & (TARGET_PAGE_MASK << 1);
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     tlb->VPN &= env->SEGMask;
 #endif
     tlb->ASID = env->CP0_EntryHi & 0xFF;
@@ -517,10 +524,12 @@ void debug_post_eret (void)
         fprintf(logfile, " ErrorEPC " TARGET_FMT_lx, env->CP0_ErrorEPC);
     if (env->hflags & MIPS_HFLAG_DM)
         fprintf(logfile, " DEPC " TARGET_FMT_lx, env->CP0_DEPC);
-    if (env->hflags & MIPS_HFLAG_UM)
-        fputs(", UM\n", logfile);
-    else
-        fputs("\n", logfile);
+    switch (env->hflags & MIPS_HFLAG_KSU) {
+    case MIPS_HFLAG_UM: fputs(", UM\n", logfile); break;
+    case MIPS_HFLAG_SM: fputs(", SM\n", logfile); break;
+    case MIPS_HFLAG_KM: fputs("\n", logfile); break;
+    default: cpu_abort(env, "Invalid MMU mode!\n"); break;
+    }
 }
 
 void do_pmon (int function)
@@ -575,7 +584,7 @@ static void do_unaligned_access (target_ulong addr, int is_write, int is_user, v
     do_raise_exception ((is_write == 1) ? EXCP_AdES : EXCP_AdEL);
 }
 
-void tlb_fill (target_ulong addr, int is_write, int is_user, void *retaddr)
+void tlb_fill (target_ulong addr, int is_write, int mmu_idx, void *retaddr)
 {
     TranslationBlock *tb;
     CPUState *saved_env;
@@ -586,7 +595,7 @@ void tlb_fill (target_ulong addr, int is_write, int is_user, void *retaddr)
        generated code */
     saved_env = env;
     env = cpu_single_env;
-    ret = cpu_mips_handle_mmu_fault(env, addr, is_write, is_user, 1);
+    ret = cpu_mips_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
     if (ret) {
         if (retaddr) {
             /* now we have a real cpu fault */
@@ -603,16 +612,22 @@ void tlb_fill (target_ulong addr, int is_write, int is_user, void *retaddr)
     env = saved_env;
 }
 
+void do_unassigned_access(target_phys_addr_t addr, int is_write, int is_exec,
+                          int unused)
+{
+    if (is_exec)
+        do_raise_exception(EXCP_IBE);
+    else
+        do_raise_exception(EXCP_DBE);
+}
 #endif
 
 /* Complex FPU operations which may need stack space. */
 
-#define FLOAT_SIGN32 (1 << 31)
-#define FLOAT_SIGN64 (1ULL << 63)
-#define FLOAT_ONE32 (0x3f8 << 20)
-#define FLOAT_ONE64 (0x3ffULL << 52)
-#define FLOAT_TWO32 (1 << 30)
-#define FLOAT_TWO64 (1ULL << 62)
+#define FLOAT_ONE32 make_float32(0x3f8 << 20)
+#define FLOAT_ONE64 make_float64(0x3ffULL << 52)
+#define FLOAT_TWO32 make_float32(1 << 30)
+#define FLOAT_TWO64 make_float64(1ULL << 62)
 #define FLOAT_QNAN32 0x7fbfffff
 #define FLOAT_QNAN64 0x7ff7ffffffffffffULL
 #define FLOAT_SNAN32 0x7fffffff
@@ -685,7 +700,7 @@ void do_ctc1 (int reg)
         do_raise_exception(EXCP_FPE);
 }
 
-inline char ieee_ex_to_mips(char xcpt)
+static always_inline char ieee_ex_to_mips(char xcpt)
 {
     return (xcpt & float_flag_inexact) >> 5 |
            (xcpt & float_flag_underflow) >> 3 |
@@ -694,7 +709,7 @@ inline char ieee_ex_to_mips(char xcpt)
            (xcpt & float_flag_invalid) << 4;
 }
 
-inline char mips_ex_to_ieee(char xcpt)
+static always_inline char mips_ex_to_ieee(char xcpt)
 {
     return (xcpt & FP_INEXACT) << 5 |
            (xcpt & FP_UNDERFLOW) << 3 |
@@ -703,7 +718,7 @@ inline char mips_ex_to_ieee(char xcpt)
            (xcpt & FP_INVALID) >> 4;
 }
 
-inline void update_fcr31(void)
+static always_inline void update_fcr31(void)
 {
     int tmp = ieee_ex_to_mips(get_float_exception_flags(&env->fpu->fp_status));
 
@@ -1035,7 +1050,7 @@ FLOAT_OP(name, d)         \
     FDT2 = float64_ ## name (FDT0, FDT1, &env->fpu->fp_status);    \
     update_fcr31();                                                \
     if (GET_FP_CAUSE(env->fpu->fcr31) & FP_INVALID)                \
-        FDT2 = FLOAT_QNAN64;                                       \
+        DT2 = FLOAT_QNAN64;                                        \
 }                         \
 FLOAT_OP(name, s)         \
 {                         \
@@ -1043,7 +1058,7 @@ FLOAT_OP(name, s)         \
     FST2 = float32_ ## name (FST0, FST1, &env->fpu->fp_status);    \
     update_fcr31();                                                \
     if (GET_FP_CAUSE(env->fpu->fcr31) & FP_INVALID)                \
-        FST2 = FLOAT_QNAN32;                                       \
+        WT2 = FLOAT_QNAN32;                                        \
 }                         \
 FLOAT_OP(name, ps)        \
 {                         \
@@ -1052,8 +1067,8 @@ FLOAT_OP(name, ps)        \
     FSTH2 = float32_ ## name (FSTH0, FSTH1, &env->fpu->fp_status); \
     update_fcr31();       \
     if (GET_FP_CAUSE(env->fpu->fcr31) & FP_INVALID) {              \
-        FST2 = FLOAT_QNAN32;                                       \
-        FSTH2 = FLOAT_QNAN32;                                      \
+        WT2 = FLOAT_QNAN32;                                        \
+        WTH2 = FLOAT_QNAN32;                                       \
     }                     \
 }
 FLOAT_BINOP(add)
@@ -1067,14 +1082,14 @@ FLOAT_OP(recip2, d)
 {
     set_float_exception_flags(0, &env->fpu->fp_status);
     FDT2 = float64_mul(FDT0, FDT2, &env->fpu->fp_status);
-    FDT2 = float64_sub(FDT2, FLOAT_ONE64, &env->fpu->fp_status) ^ FLOAT_SIGN64;
+    FDT2 = float64_chs(float64_sub(FDT2, FLOAT_ONE64, &env->fpu->fp_status));
     update_fcr31();
 }
 FLOAT_OP(recip2, s)
 {
     set_float_exception_flags(0, &env->fpu->fp_status);
     FST2 = float32_mul(FST0, FST2, &env->fpu->fp_status);
-    FST2 = float32_sub(FST2, FLOAT_ONE32, &env->fpu->fp_status) ^ FLOAT_SIGN32;
+    FST2 = float32_chs(float32_sub(FST2, FLOAT_ONE32, &env->fpu->fp_status));
     update_fcr31();
 }
 FLOAT_OP(recip2, ps)
@@ -1082,8 +1097,8 @@ FLOAT_OP(recip2, ps)
     set_float_exception_flags(0, &env->fpu->fp_status);
     FST2 = float32_mul(FST0, FST2, &env->fpu->fp_status);
     FSTH2 = float32_mul(FSTH0, FSTH2, &env->fpu->fp_status);
-    FST2 = float32_sub(FST2, FLOAT_ONE32, &env->fpu->fp_status) ^ FLOAT_SIGN32;
-    FSTH2 = float32_sub(FSTH2, FLOAT_ONE32, &env->fpu->fp_status) ^ FLOAT_SIGN32;
+    FST2 = float32_chs(float32_sub(FST2, FLOAT_ONE32, &env->fpu->fp_status));
+    FSTH2 = float32_chs(float32_sub(FSTH2, FLOAT_ONE32, &env->fpu->fp_status));
     update_fcr31();
 }
 
@@ -1092,7 +1107,7 @@ FLOAT_OP(rsqrt2, d)
     set_float_exception_flags(0, &env->fpu->fp_status);
     FDT2 = float64_mul(FDT0, FDT2, &env->fpu->fp_status);
     FDT2 = float64_sub(FDT2, FLOAT_ONE64, &env->fpu->fp_status);
-    FDT2 = float64_div(FDT2, FLOAT_TWO64, &env->fpu->fp_status) ^ FLOAT_SIGN64;
+    FDT2 = float64_chs(float64_div(FDT2, FLOAT_TWO64, &env->fpu->fp_status));
     update_fcr31();
 }
 FLOAT_OP(rsqrt2, s)
@@ -1100,7 +1115,7 @@ FLOAT_OP(rsqrt2, s)
     set_float_exception_flags(0, &env->fpu->fp_status);
     FST2 = float32_mul(FST0, FST2, &env->fpu->fp_status);
     FST2 = float32_sub(FST2, FLOAT_ONE32, &env->fpu->fp_status);
-    FST2 = float32_div(FST2, FLOAT_TWO32, &env->fpu->fp_status) ^ FLOAT_SIGN32;
+    FST2 = float32_chs(float32_div(FST2, FLOAT_TWO32, &env->fpu->fp_status));
     update_fcr31();
 }
 FLOAT_OP(rsqrt2, ps)
@@ -1110,8 +1125,8 @@ FLOAT_OP(rsqrt2, ps)
     FSTH2 = float32_mul(FSTH0, FSTH2, &env->fpu->fp_status);
     FST2 = float32_sub(FST2, FLOAT_ONE32, &env->fpu->fp_status);
     FSTH2 = float32_sub(FSTH2, FLOAT_ONE32, &env->fpu->fp_status);
-    FST2 = float32_div(FST2, FLOAT_TWO32, &env->fpu->fp_status) ^ FLOAT_SIGN32;
-    FSTH2 = float32_div(FSTH2, FLOAT_TWO32, &env->fpu->fp_status) ^ FLOAT_SIGN32;
+    FST2 = float32_chs(float32_div(FST2, FLOAT_TWO32, &env->fpu->fp_status));
+    FSTH2 = float32_chs(float32_div(FSTH2, FLOAT_TWO32, &env->fpu->fp_status));
     update_fcr31();
 }
 
@@ -1145,8 +1160,8 @@ void do_cmp_d_ ## op (long cc)                 \
 void do_cmpabs_d_ ## op (long cc)              \
 {                                              \
     int c;                                     \
-    FDT0 &= ~FLOAT_SIGN64;                     \
-    FDT1 &= ~FLOAT_SIGN64;                     \
+    FDT0 = float64_chs(FDT0);                  \
+    FDT1 = float64_chs(FDT1);                  \
     c = cond;                                  \
     update_fcr31();                            \
     if (c)                                     \
@@ -1203,8 +1218,8 @@ void do_cmp_s_ ## op (long cc)                 \
 void do_cmpabs_s_ ## op (long cc)              \
 {                                              \
     int c;                                     \
-    FST0 &= ~FLOAT_SIGN32;                     \
-    FST1 &= ~FLOAT_SIGN32;                     \
+    FST0 = float32_abs(FST0);                  \
+    FST1 = float32_abs(FST1);                  \
     c = cond;                                  \
     update_fcr31();                            \
     if (c)                                     \
@@ -1266,10 +1281,10 @@ void do_cmp_ps_ ## op (long cc)                \
 void do_cmpabs_ps_ ## op (long cc)             \
 {                                              \
     int cl, ch;                                \
-    FST0 &= ~FLOAT_SIGN32;                     \
-    FSTH0 &= ~FLOAT_SIGN32;                    \
-    FST1 &= ~FLOAT_SIGN32;                     \
-    FSTH1 &= ~FLOAT_SIGN32;                    \
+    FST0 = float32_abs(FST0);                  \
+    FSTH0 = float32_abs(FSTH0);                \
+    FST1 = float32_abs(FST1);                  \
+    FSTH1 = float32_abs(FSTH1);                \
     cl = condl;                                \
     ch = condh;                                \
     update_fcr31();                            \
diff --git a/target-mips/op_helper_mem.c b/target-mips/op_helper_mem.c
deleted file mode 100644
index 700fc17b1..000000000
--- a/target-mips/op_helper_mem.c
+++ /dev/null
@@ -1,301 +0,0 @@
-#undef DEBUG_OP
-
-#ifdef TARGET_WORDS_BIGENDIAN
-#define GET_LMASK(v) ((v) & 3)
-#else
-#define GET_LMASK(v) (((v) & 3) ^ 3)
-#endif
-
-void glue(do_lwl, MEMSUFFIX) (uint32_t tmp)
-{
-#if defined (DEBUG_OP)
-    target_ulong sav = T0;
-#endif
-
-    switch (GET_LMASK(T0)) {
-    case 0:
-        T0 = (int32_t)tmp;
-        break;
-    case 1:
-        T0 = (int32_t)((tmp << 8) | (T1 & 0x000000FF));
-        break;
-    case 2:
-        T0 = (int32_t)((tmp << 16) | (T1 & 0x0000FFFF));
-        break;
-    case 3:
-        T0 = (int32_t)((tmp << 24) | (T1 & 0x00FFFFFF));
-        break;
-    }
-#if defined (DEBUG_OP)
-    if (logfile) {
-        fprintf(logfile, "%s: " TARGET_FMT_lx " - %08x " TARGET_FMT_lx " => " TARGET_FMT_lx "\n",
-                __func__, sav, tmp, T1, T0);
-    }
-#endif
-    RETURN();
-}
-
-void glue(do_lwr, MEMSUFFIX) (uint32_t tmp)
-{
-#if defined (DEBUG_OP)
-    target_ulong sav = T0;
-#endif
-
-    switch (GET_LMASK(T0)) {
-    case 0:
-        T0 = (int32_t)((tmp >> 24) | (T1 & 0xFFFFFF00));
-        break;
-    case 1:
-        T0 = (int32_t)((tmp >> 16) | (T1 & 0xFFFF0000));
-        break;
-    case 2:
-        T0 = (int32_t)((tmp >> 8) | (T1 & 0xFF000000));
-        break;
-    case 3:
-        T0 = (int32_t)tmp;
-        break;
-    }
-#if defined (DEBUG_OP)
-    if (logfile) {
-        fprintf(logfile, "%s: " TARGET_FMT_lx " - %08x " TARGET_FMT_lx " => " TARGET_FMT_lx "\n",
-                __func__, sav, tmp, T1, T0);
-    }
-#endif
-    RETURN();
-}
-
-uint32_t glue(do_swl, MEMSUFFIX) (uint32_t tmp)
-{
-#if defined (DEBUG_OP)
-    target_ulong sav = tmp;
-#endif
-
-    switch (GET_LMASK(T0)) {
-    case 0:
-        tmp = (int32_t)T1;
-        break;
-    case 1:
-        tmp = (int32_t)((tmp & 0xFF000000) | ((uint32_t)T1 >> 8));
-        break;
-    case 2:
-        tmp = (int32_t)((tmp & 0xFFFF0000) | ((uint32_t)T1 >> 16));
-        break;
-    case 3:
-        tmp = (int32_t)((tmp & 0xFFFFFF00) | ((uint32_t)T1 >> 24));
-        break;
-    }
-#if defined (DEBUG_OP)
-    if (logfile) {
-        fprintf(logfile, "%s: " TARGET_FMT_lx " - " TARGET_FMT_lx " " TARGET_FMT_lx " => %08x\n",
-                __func__, T0, sav, T1, tmp);
-    }
-#endif
-    RETURN();
-    return tmp;
-}
-
-uint32_t glue(do_swr, MEMSUFFIX) (uint32_t tmp)
-{
-#if defined (DEBUG_OP)
-    target_ulong sav = tmp;
-#endif
-
-    switch (GET_LMASK(T0)) {
-    case 0:
-        tmp = (int32_t)((tmp & 0x00FFFFFF) | (T1 << 24));
-        break;
-    case 1:
-        tmp = (int32_t)((tmp & 0x0000FFFF) | (T1 << 16));
-        break;
-    case 2:
-        tmp = (int32_t)((tmp & 0x000000FF) | (T1 << 8));
-        break;
-    case 3:
-        tmp = (int32_t)T1;
-        break;
-    }
-#if defined (DEBUG_OP)
-    if (logfile) {
-        fprintf(logfile, "%s: " TARGET_FMT_lx " - " TARGET_FMT_lx " " TARGET_FMT_lx " => %08x\n",
-                __func__, T0, sav, T1, tmp);
-    }
-#endif
-    RETURN();
-    return tmp;
-}
-
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
-
-#ifdef TARGET_WORDS_BIGENDIAN
-#define GET_LMASK64(v) ((v) & 7)
-#else
-#define GET_LMASK64(v) (((v) & 7) ^ 7)
-#endif
-
-void glue(do_ldl, MEMSUFFIX) (uint64_t tmp)
-{
-#if defined (DEBUG_OP)
-    target_ulong sav = T0;
-#endif
-
-    switch (GET_LMASK64(T0)) {
-    case 0:
-        T0 = tmp;
-        break;
-    case 1:
-        T0 = (tmp << 8) | (T1 & 0x00000000000000FFULL);
-        break;
-    case 2:
-        T0 = (tmp << 16) | (T1 & 0x000000000000FFFFULL);
-        break;
-    case 3:
-        T0 = (tmp << 24) | (T1 & 0x0000000000FFFFFFULL);
-        break;
-    case 4:
-        T0 = (tmp << 32) | (T1 & 0x00000000FFFFFFFFULL);
-        break;
-    case 5:
-        T0 = (tmp << 40) | (T1 & 0x000000FFFFFFFFFFULL);
-        break;
-    case 6:
-        T0 = (tmp << 48) | (T1 & 0x0000FFFFFFFFFFFFULL);
-        break;
-    case 7:
-        T0 = (tmp << 56) | (T1 & 0x00FFFFFFFFFFFFFFULL);
-        break;
-    }
-#if defined (DEBUG_OP)
-    if (logfile) {
-        fprintf(logfile, "%s: " TARGET_FMT_lx " - " TARGET_FMT_lx " " TARGET_FMT_lx " => " TARGET_FMT_lx "\n",
-                __func__, sav, tmp, T1, T0);
-    }
-#endif
-    RETURN();
-}
-
-void glue(do_ldr, MEMSUFFIX) (uint64_t tmp)
-{
-#if defined (DEBUG_OP)
-    target_ulong sav = T0;
-#endif
-
-    switch (GET_LMASK64(T0)) {
-    case 0:
-        T0 = (tmp >> 56) | (T1 & 0xFFFFFFFFFFFFFF00ULL);
-        break;
-    case 1:
-        T0 = (tmp >> 48) | (T1 & 0xFFFFFFFFFFFF0000ULL);
-        break;
-    case 2:
-        T0 = (tmp >> 40) | (T1 & 0xFFFFFFFFFF000000ULL);
-        break;
-    case 3:
-        T0 = (tmp >> 32) | (T1 & 0xFFFFFFFF00000000ULL);
-        break;
-    case 4:
-        T0 = (tmp >> 24) | (T1 & 0xFFFFFF0000000000ULL);
-        break;
-    case 5:
-        T0 = (tmp >> 16) | (T1 & 0xFFFF000000000000ULL);
-        break;
-    case 6:
-        T0 = (tmp >> 8) | (T1 & 0xFF00000000000000ULL);
-        break;
-    case 7:
-        T0 = tmp;
-        break;
-    }
-#if defined (DEBUG_OP)
-    if (logfile) {
-        fprintf(logfile, "%s: " TARGET_FMT_lx " - " TARGET_FMT_lx " " TARGET_FMT_lx " => " TARGET_FMT_lx "\n",
-                __func__, sav, tmp, T1, T0);
-    }
-#endif
-    RETURN();
-}
-
-uint64_t glue(do_sdl, MEMSUFFIX) (uint64_t tmp)
-{
-#if defined (DEBUG_OP)
-    target_ulong sav = tmp;
-#endif
-
-    switch (GET_LMASK64(T0)) {
-    case 0:
-        tmp = T1;
-        break;
-    case 1:
-        tmp = (tmp & 0xFF00000000000000ULL) | (T1 >> 8);
-        break;
-    case 2:
-        tmp = (tmp & 0xFFFF000000000000ULL) | (T1 >> 16);
-        break;
-    case 3:
-        tmp = (tmp & 0xFFFFFF0000000000ULL) | (T1 >> 24);
-        break;
-    case 4:
-        tmp = (tmp & 0xFFFFFFFF00000000ULL) | (T1 >> 32);
-        break;
-    case 5:
-        tmp = (tmp & 0xFFFFFFFFFF000000ULL) | (T1 >> 40);
-        break;
-    case 6:
-        tmp = (tmp & 0xFFFFFFFFFFFF0000ULL) | (T1 >> 48);
-        break;
-    case 7:
-        tmp = (tmp & 0xFFFFFFFFFFFFFF00ULL) | (T1 >> 56);
-        break;
-    }
-#if defined (DEBUG_OP)
-    if (logfile) {
-        fprintf(logfile, "%s: " TARGET_FMT_lx " - " TARGET_FMT_lx " " TARGET_FMT_lx " => " TARGET_FMT_lx "\n",
-                __func__, T0, sav, T1, tmp);
-    }
-#endif
-    RETURN();
-    return tmp;
-}
-
-uint64_t glue(do_sdr, MEMSUFFIX) (uint64_t tmp)
-{
-#if defined (DEBUG_OP)
-    target_ulong sav = tmp;
-#endif
-
-    switch (GET_LMASK64(T0)) {
-    case 0:
-        tmp = (tmp & 0x00FFFFFFFFFFFFFFULL) | (T1 << 56);
-        break;
-    case 1:
-        tmp = (tmp & 0x0000FFFFFFFFFFFFULL) | (T1 << 48);
-        break;
-    case 2:
-        tmp = (tmp & 0x000000FFFFFFFFFFULL) | (T1 << 40);
-        break;
-    case 3:
-        tmp = (tmp & 0x00000000FFFFFFFFULL) | (T1 << 32);
-        break;
-    case 4:
-        tmp = (tmp & 0x0000000000FFFFFFULL) | (T1 << 24);
-        break;
-    case 5:
-        tmp = (tmp & 0x000000000000FFFFULL) | (T1 << 16);
-        break;
-    case 6:
-        tmp = (tmp & 0x00000000000000FFULL) | (T1 << 8);
-        break;
-    case 7:
-        tmp = T1;
-        break;
-    }
-#if defined (DEBUG_OP)
-    if (logfile) {
-        fprintf(logfile, "%s: " TARGET_FMT_lx " - " TARGET_FMT_lx " " TARGET_FMT_lx " => " TARGET_FMT_lx "\n",
-                __func__, T0, sav, T1, tmp);
-    }
-#endif
-    RETURN();
-    return tmp;
-}
-
-#endif /* TARGET_MIPSN32 || TARGET_MIPS64 */
diff --git a/target-mips/op_mem.c b/target-mips/op_mem.c
index a15ad5a96..85872ca8f 100644
--- a/target-mips/op_mem.c
+++ b/target-mips/op_mem.c
@@ -22,88 +22,148 @@
 void glue(op_lb, MEMSUFFIX) (void)
 {
     T0 = glue(ldsb, MEMSUFFIX)(T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_lbu, MEMSUFFIX) (void)
 {
     T0 = glue(ldub, MEMSUFFIX)(T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_sb, MEMSUFFIX) (void)
 {
     glue(stb, MEMSUFFIX)(T0, T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_lh, MEMSUFFIX) (void)
 {
     T0 = glue(ldsw, MEMSUFFIX)(T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_lhu, MEMSUFFIX) (void)
 {
     T0 = glue(lduw, MEMSUFFIX)(T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_sh, MEMSUFFIX) (void)
 {
     glue(stw, MEMSUFFIX)(T0, T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_lw, MEMSUFFIX) (void)
 {
     T0 = glue(ldl, MEMSUFFIX)(T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_lwu, MEMSUFFIX) (void)
 {
     T0 = (uint32_t)glue(ldl, MEMSUFFIX)(T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_sw, MEMSUFFIX) (void)
 {
     glue(stl, MEMSUFFIX)(T0, T1);
-    RETURN();
+    FORCE_RET();
 }
 
 /* "half" load and stores.  We must do the memory access inline,
    or fault handling won't work.  */
-/* XXX: This is broken, CP0_BADVADDR has the wrong (aligned) value. */
+
+#ifdef TARGET_WORDS_BIGENDIAN
+#define GET_LMASK(v) ((v) & 3)
+#define GET_OFFSET(addr, offset) (addr + (offset))
+#else
+#define GET_LMASK(v) (((v) & 3) ^ 3)
+#define GET_OFFSET(addr, offset) (addr - (offset))
+#endif
+
 void glue(op_lwl, MEMSUFFIX) (void)
 {
-    uint32_t tmp = glue(ldl, MEMSUFFIX)(T0 & ~3);
-    CALL_FROM_TB1(glue(do_lwl, MEMSUFFIX), tmp);
-    RETURN();
+    target_ulong tmp;
+
+    tmp = glue(ldub, MEMSUFFIX)(T0);
+    T1 = (T1 & 0x00FFFFFF) | (tmp << 24);
+
+    if (GET_LMASK(T0) <= 2) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, 1));
+        T1 = (T1 & 0xFF00FFFF) | (tmp << 16);
+    }
+
+    if (GET_LMASK(T0) <= 1) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, 2));
+        T1 = (T1 & 0xFFFF00FF) | (tmp << 8);
+    }
+
+    if (GET_LMASK(T0) == 0) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, 3));
+        T1 = (T1 & 0xFFFFFF00) | tmp;
+    }
+    T1 = (int32_t)T1;
+    FORCE_RET();
 }
 
 void glue(op_lwr, MEMSUFFIX) (void)
 {
-    uint32_t tmp = glue(ldl, MEMSUFFIX)(T0 & ~3);
-    CALL_FROM_TB1(glue(do_lwr, MEMSUFFIX), tmp);
-    RETURN();
+    target_ulong tmp;
+
+    tmp = glue(ldub, MEMSUFFIX)(T0);
+    T1 = (T1 & 0xFFFFFF00) | tmp;
+
+    if (GET_LMASK(T0) >= 1) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, -1));
+        T1 = (T1 & 0xFFFF00FF) | (tmp << 8);
+    }
+
+    if (GET_LMASK(T0) >= 2) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, -2));
+        T1 = (T1 & 0xFF00FFFF) | (tmp << 16);
+    }
+
+    if (GET_LMASK(T0) == 3) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, -3));
+        T1 = (T1 & 0x00FFFFFF) | (tmp << 24);
+    }
+    T1 = (int32_t)T1;
+    FORCE_RET();
 }
 
 void glue(op_swl, MEMSUFFIX) (void)
 {
-    uint32_t tmp = glue(ldl, MEMSUFFIX)(T0 & ~3);
-    tmp = CALL_FROM_TB1(glue(do_swl, MEMSUFFIX), tmp);
-    glue(stl, MEMSUFFIX)(T0 & ~3, tmp);
-    RETURN();
+    glue(stb, MEMSUFFIX)(T0, (uint8_t)(T1 >> 24));
+
+    if (GET_LMASK(T0) <= 2)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, 1), (uint8_t)(T1 >> 16));
+
+    if (GET_LMASK(T0) <= 1)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, 2), (uint8_t)(T1 >> 8));
+
+    if (GET_LMASK(T0) == 0)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, 3), (uint8_t)T1);
+
+    FORCE_RET();
 }
 
 void glue(op_swr, MEMSUFFIX) (void)
 {
-    uint32_t tmp = glue(ldl, MEMSUFFIX)(T0 & ~3);
-    tmp = CALL_FROM_TB1(glue(do_swr, MEMSUFFIX), tmp);
-    glue(stl, MEMSUFFIX)(T0 & ~3, tmp);
-    RETURN();
+    glue(stb, MEMSUFFIX)(T0, (uint8_t)T1);
+
+    if (GET_LMASK(T0) >= 1)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, -1), (uint8_t)(T1 >> 8));
+
+    if (GET_LMASK(T0) >= 2)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, -2), (uint8_t)(T1 >> 16));
+
+    if (GET_LMASK(T0) == 3)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, -3), (uint8_t)(T1 >> 24));
+
+    FORCE_RET();
 }
 
 void glue(op_ll, MEMSUFFIX) (void)
@@ -111,7 +171,7 @@ void glue(op_ll, MEMSUFFIX) (void)
     T1 = T0;
     T0 = glue(ldl, MEMSUFFIX)(T0);
     env->CP0_LLAddr = T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_sc, MEMSUFFIX) (void)
@@ -127,52 +187,175 @@ void glue(op_sc, MEMSUFFIX) (void)
     } else {
         T0 = 0;
     }
-    RETURN();
+    FORCE_RET();
 }
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 void glue(op_ld, MEMSUFFIX) (void)
 {
     T0 = glue(ldq, MEMSUFFIX)(T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_sd, MEMSUFFIX) (void)
 {
     glue(stq, MEMSUFFIX)(T0, T1);
-    RETURN();
+    FORCE_RET();
 }
 
 /* "half" load and stores.  We must do the memory access inline,
    or fault handling won't work.  */
+
+#ifdef TARGET_WORDS_BIGENDIAN
+#define GET_LMASK64(v) ((v) & 7)
+#else
+#define GET_LMASK64(v) (((v) & 7) ^ 7)
+#endif
+
 void glue(op_ldl, MEMSUFFIX) (void)
 {
-    target_long tmp = glue(ldq, MEMSUFFIX)(T0 & ~7);
-    CALL_FROM_TB1(glue(do_ldl, MEMSUFFIX), tmp);
-    RETURN();
+    uint64_t tmp;
+
+    tmp = glue(ldub, MEMSUFFIX)(T0);
+    T1 = (T1 & 0x00FFFFFFFFFFFFFFULL) | (tmp << 56);
+
+    if (GET_LMASK64(T0) <= 6) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, 1));
+        T1 = (T1 & 0xFF00FFFFFFFFFFFFULL) | (tmp << 48);
+    }
+
+    if (GET_LMASK64(T0) <= 5) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, 2));
+        T1 = (T1 & 0xFFFF00FFFFFFFFFFULL) | (tmp << 40);
+    }
+
+    if (GET_LMASK64(T0) <= 4) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, 3));
+        T1 = (T1 & 0xFFFFFF00FFFFFFFFULL) | (tmp << 32);
+    }
+
+    if (GET_LMASK64(T0) <= 3) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, 4));
+        T1 = (T1 & 0xFFFFFFFF00FFFFFFULL) | (tmp << 24);
+    }
+
+    if (GET_LMASK64(T0) <= 2) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, 5));
+        T1 = (T1 & 0xFFFFFFFFFF00FFFFULL) | (tmp << 16);
+    }
+
+    if (GET_LMASK64(T0) <= 1) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, 6));
+        T1 = (T1 & 0xFFFFFFFFFFFF00FFULL) | (tmp << 8);
+    }
+
+    if (GET_LMASK64(T0) == 0) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, 7));
+        T1 = (T1 & 0xFFFFFFFFFFFFFF00ULL) | tmp;
+    }
+
+    FORCE_RET();
 }
 
 void glue(op_ldr, MEMSUFFIX) (void)
 {
-    target_long tmp = glue(ldq, MEMSUFFIX)(T0 & ~7);
-    CALL_FROM_TB1(glue(do_ldr, MEMSUFFIX), tmp);
-    RETURN();
+    uint64_t tmp;
+
+    tmp = glue(ldub, MEMSUFFIX)(T0);
+    T1 = (T1 & 0xFFFFFFFFFFFFFF00ULL) | tmp;
+
+    if (GET_LMASK64(T0) >= 1) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, -1));
+        T1 = (T1 & 0xFFFFFFFFFFFF00FFULL) | (tmp  << 8);
+    }
+
+    if (GET_LMASK64(T0) >= 2) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, -2));
+        T1 = (T1 & 0xFFFFFFFFFF00FFFFULL) | (tmp << 16);
+    }
+
+    if (GET_LMASK64(T0) >= 3) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, -3));
+        T1 = (T1 & 0xFFFFFFFF00FFFFFFULL) | (tmp << 24);
+    }
+
+    if (GET_LMASK64(T0) >= 4) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, -4));
+        T1 = (T1 & 0xFFFFFF00FFFFFFFFULL) | (tmp << 32);
+    }
+
+    if (GET_LMASK64(T0) >= 5) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, -5));
+        T1 = (T1 & 0xFFFF00FFFFFFFFFFULL) | (tmp << 40);
+    }
+
+    if (GET_LMASK64(T0) >= 6) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, -6));
+        T1 = (T1 & 0xFF00FFFFFFFFFFFFULL) | (tmp << 48);
+    }
+
+    if (GET_LMASK64(T0) == 7) {
+        tmp = glue(ldub, MEMSUFFIX)(GET_OFFSET(T0, -7));
+        T1 = (T1 & 0x00FFFFFFFFFFFFFFULL) | (tmp << 56);
+    }
+
+    FORCE_RET();
 }
 
 void glue(op_sdl, MEMSUFFIX) (void)
 {
-    target_long tmp = glue(ldq, MEMSUFFIX)(T0 & ~7);
-    tmp = CALL_FROM_TB1(glue(do_sdl, MEMSUFFIX), tmp);
-    glue(stq, MEMSUFFIX)(T0 & ~7, tmp);
-    RETURN();
+    glue(stb, MEMSUFFIX)(T0, (uint8_t)(T1 >> 56));
+
+    if (GET_LMASK64(T0) <= 6)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, 1), (uint8_t)(T1 >> 48));
+
+    if (GET_LMASK64(T0) <= 5)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, 2), (uint8_t)(T1 >> 40));
+
+    if (GET_LMASK64(T0) <= 4)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, 3), (uint8_t)(T1 >> 32));
+
+    if (GET_LMASK64(T0) <= 3)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, 4), (uint8_t)(T1 >> 24));
+
+    if (GET_LMASK64(T0) <= 2)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, 5), (uint8_t)(T1 >> 16));
+
+    if (GET_LMASK64(T0) <= 1)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, 6), (uint8_t)(T1 >> 8));
+
+    if (GET_LMASK64(T0) <= 0)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, 7), (uint8_t)T1);
+
+    FORCE_RET();
 }
 
 void glue(op_sdr, MEMSUFFIX) (void)
 {
-    target_long tmp = glue(ldq, MEMSUFFIX)(T0 & ~7);
-    tmp = CALL_FROM_TB1(glue(do_sdr, MEMSUFFIX), tmp);
-    glue(stq, MEMSUFFIX)(T0 & ~7, tmp);
-    RETURN();
+    glue(stb, MEMSUFFIX)(T0, (uint8_t)T1);
+
+    if (GET_LMASK64(T0) >= 1)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, -1), (uint8_t)(T1 >> 8));
+
+    if (GET_LMASK64(T0) >= 2)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, -2), (uint8_t)(T1 >> 16));
+
+    if (GET_LMASK64(T0) >= 3)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, -3), (uint8_t)(T1 >> 24));
+
+    if (GET_LMASK64(T0) >= 4)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, -4), (uint8_t)(T1 >> 32));
+
+    if (GET_LMASK64(T0) >= 5)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, -5), (uint8_t)(T1 >> 40));
+
+    if (GET_LMASK64(T0) >= 6)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, -6), (uint8_t)(T1 >> 48));
+
+    if (GET_LMASK64(T0) == 7)
+        glue(stb, MEMSUFFIX)(GET_OFFSET(T0, -7), (uint8_t)(T1 >> 56));
+
+    FORCE_RET();
 }
 
 void glue(op_lld, MEMSUFFIX) (void)
@@ -180,7 +363,7 @@ void glue(op_lld, MEMSUFFIX) (void)
     T1 = T0;
     T0 = glue(ldq, MEMSUFFIX)(T0);
     env->CP0_LLAddr = T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_scd, MEMSUFFIX) (void)
@@ -196,37 +379,37 @@ void glue(op_scd, MEMSUFFIX) (void)
     } else {
         T0 = 0;
     }
-    RETURN();
+    FORCE_RET();
 }
-#endif /* TARGET_MIPSN32 || TARGET_MIPS64 */
+#endif /* TARGET_MIPS64 */
 
 void glue(op_lwc1, MEMSUFFIX) (void)
 {
     WT0 = glue(ldl, MEMSUFFIX)(T0);
-    RETURN();
+    FORCE_RET();
 }
 void glue(op_swc1, MEMSUFFIX) (void)
 {
     glue(stl, MEMSUFFIX)(T0, WT0);
-    RETURN();
+    FORCE_RET();
 }
 void glue(op_ldc1, MEMSUFFIX) (void)
 {
     DT0 = glue(ldq, MEMSUFFIX)(T0);
-    RETURN();
+    FORCE_RET();
 }
 void glue(op_sdc1, MEMSUFFIX) (void)
 {
     glue(stq, MEMSUFFIX)(T0, DT0);
-    RETURN();
+    FORCE_RET();
 }
 void glue(op_luxc1, MEMSUFFIX) (void)
 {
     DT0 = glue(ldq, MEMSUFFIX)(T0 & ~0x7);
-    RETURN();
+    FORCE_RET();
 }
 void glue(op_suxc1, MEMSUFFIX) (void)
 {
     glue(stq, MEMSUFFIX)(T0 & ~0x7, DT0);
-    RETURN();
+    FORCE_RET();
 }
diff --git a/target-mips/op_template.c b/target-mips/op_template.c
index 148656eb2..48b91e1be 100644
--- a/target-mips/op_template.c
+++ b/target-mips/op_template.c
@@ -22,44 +22,44 @@
 void glue(op_load_gpr_T0_gpr, REG) (void)
 {
     T0 = env->gpr[REG][env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_store_T0_gpr_gpr, REG) (void)
 {
     env->gpr[REG][env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_load_gpr_T1_gpr, REG) (void)
 {
     T1 = env->gpr[REG][env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_store_T1_gpr_gpr, REG) (void)
 {
     env->gpr[REG][env->current_tc] = T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_load_gpr_T2_gpr, REG) (void)
 {
     T2 = env->gpr[REG][env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 
 void glue(op_load_srsgpr_T0_gpr, REG) (void)
 {
     T0 = env->gpr[REG][(env->CP0_SRSCtl >> CP0SRSCtl_PSS) & 0xf];
-    RETURN();
+    FORCE_RET();
 }
 
 void glue(op_store_T0_srsgpr_gpr, REG) (void)
 {
     env->gpr[REG][(env->CP0_SRSCtl >> CP0SRSCtl_PSS) & 0xf] = T0;
-    RETURN();
+    FORCE_RET();
 }
 #endif
 
@@ -68,12 +68,12 @@ void glue(op_store_T0_srsgpr_gpr, REG) (void)
     void glue(op_set, tregname)(void)    \
     {                                    \
         treg = (int32_t)PARAM1;          \
-        RETURN();                        \
+        FORCE_RET();                     \
     }                                    \
     void glue(op_reset, tregname)(void)  \
     {                                    \
         treg = 0;                        \
-        RETURN();                        \
+        FORCE_RET();                     \
     }                                    \
 
 SET_RESET(T0, _T0)
@@ -82,12 +82,12 @@ SET_RESET(T2, _T2)
 
 #undef SET_RESET
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 #define SET64(treg, tregname)                               \
     void glue(op_set64, tregname)(void)                     \
     {                                                       \
         treg = ((uint64_t)PARAM1 << 32) | (uint32_t)PARAM2; \
-        RETURN();                                           \
+        FORCE_RET();                                        \
     }
 
 SET64(T0, _T0)
diff --git a/target-mips/translate.c b/target-mips/translate.c
index d3f80f298..abbf0677c 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -436,7 +436,7 @@ NAME ## 20, NAME ## 21, NAME ## 22, NAME ## 23,  \
 NAME ## 24, NAME ## 25, NAME ## 26, NAME ## 27,  \
 NAME ## 28, NAME ## 29, NAME ## 30, NAME ## 31,  \
 };                                               \
-static inline void func(int n)                   \
+static always_inline void func(int n)            \
 {                                                \
     NAME ## _table[n]();                         \
 }
@@ -470,7 +470,7 @@ NAME ## 20, NAME ## 21, NAME ## 22, NAME ## 23,  \
 NAME ## 24, NAME ## 25, NAME ## 26, NAME ## 27,  \
 NAME ## 28, NAME ## 29, NAME ## 30, NAME ## 31,  \
 };                                               \
-static inline void func(int n)                   \
+static always_inline void func(int n)            \
 {                                                \
     NAME ## _table[n]();                         \
 }
@@ -521,7 +521,7 @@ static GenOpFunc1 * gen_op_cmp ## type ## _ ## fmt ## _table[16] = {    \
     gen_op_cmp ## type ## _ ## fmt ## _le,                              \
     gen_op_cmp ## type ## _ ## fmt ## _ngt,                             \
 };                                                                      \
-static inline void gen_cmp ## type ## _ ## fmt(int n, long cc)          \
+static always_inline void gen_cmp ## type ## _ ## fmt(int n, long cc)   \
 {                                                                       \
     gen_op_cmp ## type ## _ ## fmt ## _table[n](cc);                    \
 }
@@ -543,6 +543,8 @@ typedef struct DisasContext {
     uint32_t hflags, saved_hflags;
     int bstate;
     target_ulong btarget;
+    void *last_T0_store;
+    int last_T0_gpr;
 } DisasContext;
 
 enum {
@@ -572,12 +574,33 @@ do {                                                                          \
                ctx->opcode & 0x3F, ((ctx->opcode >> 16) & 0x1F));             \
 } while (0)
 
-#define GEN_LOAD_REG_TN(Tn, Rn)                                               \
+#define GEN_LOAD_REG_T0(Rn)                                                   \
 do {                                                                          \
     if (Rn == 0) {                                                            \
-        glue(gen_op_reset_, Tn)();                                            \
+        gen_op_reset_T0();                                                    \
+    } else {                                                                  \
+        if (ctx->glue(last_T0, _store) != gen_opc_ptr                         \
+            || ctx->glue(last_T0, _gpr) != Rn) {                              \
+                gen_op_load_gpr_T0(Rn);                                       \
+        }                                                                     \
+    }                                                                         \
+} while (0)
+
+#define GEN_LOAD_REG_T1(Rn)                                                   \
+do {                                                                          \
+    if (Rn == 0) {                                                            \
+        gen_op_reset_T1();                                                    \
+    } else {                                                                  \
+        gen_op_load_gpr_T1(Rn);                                               \
+    }                                                                         \
+} while (0)
+
+#define GEN_LOAD_REG_T2(Rn)                                                   \
+do {                                                                          \
+    if (Rn == 0) {                                                            \
+        gen_op_reset_T2();                                                    \
     } else {                                                                  \
-        glue(gen_op_load_gpr_, Tn)(Rn);                                       \
+        gen_op_load_gpr_T2(Rn);                                               \
     }                                                                         \
 } while (0)
 
@@ -590,7 +613,7 @@ do {                                                                          \
     }                                                                         \
 } while (0)
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 #define GEN_LOAD_IMM_TN(Tn, Imm)                                              \
 do {                                                                          \
     if (Imm == 0) {                                                           \
@@ -612,13 +635,21 @@ do {                                                                          \
 } while (0)
 #endif
 
-#define GEN_STORE_TN_REG(Rn, Tn)                                              \
+#define GEN_STORE_T0_REG(Rn)                                                  \
 do {                                                                          \
     if (Rn != 0) {                                                            \
-        glue(glue(gen_op_store_, Tn),_gpr)(Rn);                               \
+        glue(gen_op_store_T0,_gpr)(Rn);                                       \
+        ctx->glue(last_T0,_store) = gen_opc_ptr;                              \
+        ctx->glue(last_T0,_gpr) = Rn;                                         \
     }                                                                         \
 } while (0)
 
+#define GEN_STORE_T1_REG(Rn)                                                  \
+do {                                                                          \
+    if (Rn != 0)                                                              \
+        glue(gen_op_store_T1,_gpr)(Rn);                                       \
+} while (0)
+
 #define GEN_STORE_TN_SRSREG(Rn, Tn)                                           \
 do {                                                                          \
     if (Rn != 0) {                                                            \
@@ -636,9 +667,9 @@ do {                                                                          \
     glue(gen_op_store_fpr_, FTn)(Fn);                                         \
 } while (0)
 
-static inline void gen_save_pc(target_ulong pc)
+static always_inline void gen_save_pc(target_ulong pc)
 {
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     if (pc == (int32_t)pc) {
         gen_op_save_pc(pc);
     } else {
@@ -649,9 +680,9 @@ static inline void gen_save_pc(target_ulong pc)
 #endif
 }
 
-static inline void gen_save_btarget(target_ulong btarget)
+static always_inline void gen_save_btarget(target_ulong btarget)
 {
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     if (btarget == (int32_t)btarget) {
         gen_op_save_btarget(btarget);
     } else {
@@ -662,7 +693,7 @@ static inline void gen_save_btarget(target_ulong btarget)
 #endif
 }
 
-static inline void save_cpu_state (DisasContext *ctx, int do_save_pc)
+static always_inline void save_cpu_state (DisasContext *ctx, int do_save_pc)
 {
 #if defined MIPS_DEBUG_DISAS
     if (loglevel & CPU_LOG_TB_IN_ASM) {
@@ -694,7 +725,7 @@ static inline void save_cpu_state (DisasContext *ctx, int do_save_pc)
     }
 }
 
-static inline void restore_cpu_state (CPUState *env, DisasContext *ctx)
+static always_inline void restore_cpu_state (CPUState *env, DisasContext *ctx)
 {
     ctx->saved_hflags = ctx->hflags;
     switch (ctx->hflags & MIPS_HFLAG_BMASK) {
@@ -712,7 +743,7 @@ static inline void restore_cpu_state (CPUState *env, DisasContext *ctx)
     }
 }
 
-static inline void generate_exception_err (DisasContext *ctx, int excp, int err)
+static always_inline void generate_exception_err (DisasContext *ctx, int excp, int err)
 {
 #if defined MIPS_DEBUG_DISAS
     if (loglevel & CPU_LOG_TB_IN_ASM)
@@ -726,24 +757,24 @@ static inline void generate_exception_err (DisasContext *ctx, int excp, int err)
     ctx->bstate = BS_EXCP;
 }
 
-static inline void generate_exception (DisasContext *ctx, int excp)
+static always_inline void generate_exception (DisasContext *ctx, int excp)
 {
     generate_exception_err (ctx, excp, 0);
 }
 
-static inline void check_cp0_enabled(DisasContext *ctx)
+static always_inline void check_cp0_enabled(DisasContext *ctx)
 {
     if (unlikely(!(ctx->hflags & MIPS_HFLAG_CP0)))
         generate_exception_err(ctx, EXCP_CpU, 1);
 }
 
-static inline void check_cp1_enabled(DisasContext *ctx)
+static always_inline void check_cp1_enabled(DisasContext *ctx)
 {
     if (unlikely(!(ctx->hflags & MIPS_HFLAG_FPU)))
         generate_exception_err(ctx, EXCP_CpU, 1);
 }
 
-static inline void check_cp1_64bitmode(DisasContext *ctx)
+static always_inline void check_cp1_64bitmode(DisasContext *ctx)
 {
     if (unlikely(!(ctx->hflags & MIPS_HFLAG_F64)))
         generate_exception(ctx, EXCP_RI);
@@ -768,23 +799,15 @@ void check_cp1_registers(DisasContext *ctx, int regs)
 
 /* This code generates a "reserved instruction" exception if the
    CPU does not support the instruction set corresponding to flags. */
-static inline void check_insn(CPUState *env, DisasContext *ctx, int flags)
+static always_inline void check_insn(CPUState *env, DisasContext *ctx, int flags)
 {
     if (unlikely(!(env->insn_flags & flags)))
         generate_exception(ctx, EXCP_RI);
 }
 
-/* This code generates a "reserved instruction" exception if the
-   CPU is not MIPS MT capable. */
-static inline void check_mips_mt(CPUState *env, DisasContext *ctx)
-{
-    if (unlikely(!(env->CP0_Config3 & (1 << CP0C3_MT))))
-        generate_exception(ctx, EXCP_RI);
-}
-
 /* This code generates a "reserved instruction" exception if 64-bit
    instructions are not enabled. */
-static inline void check_mips_64(DisasContext *ctx)
+static always_inline void check_mips_64(DisasContext *ctx)
 {
     if (unlikely(!(ctx->hflags & MIPS_HFLAG_64)))
         generate_exception(ctx, EXCP_RI);
@@ -798,17 +821,19 @@ static inline void check_mips_64(DisasContext *ctx)
 #define op_ldst(name)        (*gen_op_##name[ctx->mem_idx])()
 #define OP_LD_TABLE(width)                                                    \
 static GenOpFunc *gen_op_l##width[] = {                                       \
-    &gen_op_l##width##_user,                                                  \
     &gen_op_l##width##_kernel,                                                \
+    &gen_op_l##width##_super,                                                 \
+    &gen_op_l##width##_user,                                                  \
 }
 #define OP_ST_TABLE(width)                                                    \
 static GenOpFunc *gen_op_s##width[] = {                                       \
-    &gen_op_s##width##_user,                                                  \
     &gen_op_s##width##_kernel,                                                \
+    &gen_op_s##width##_super,                                                 \
+    &gen_op_s##width##_user,                                                  \
 }
 #endif
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 OP_LD_TABLE(d);
 OP_LD_TABLE(dl);
 OP_LD_TABLE(dr);
@@ -858,129 +883,129 @@ static void gen_ldst (DisasContext *ctx, uint32_t opc, int rt,
     /* Don't do NOP if destination is zero: we must perform the actual
        memory access. */
     switch (opc) {
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     case OPC_LWU:
         op_ldst(lwu);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "lwu";
         break;
     case OPC_LD:
         op_ldst(ld);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "ld";
         break;
     case OPC_LLD:
         op_ldst(lld);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "lld";
         break;
     case OPC_SD:
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(sd);
         opn = "sd";
         break;
     case OPC_SCD:
         save_cpu_state(ctx, 1);
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(scd);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "scd";
         break;
     case OPC_LDL:
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(ldl);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T1_REG(rt);
         opn = "ldl";
         break;
     case OPC_SDL:
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(sdl);
         opn = "sdl";
         break;
     case OPC_LDR:
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(ldr);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T1_REG(rt);
         opn = "ldr";
         break;
     case OPC_SDR:
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(sdr);
         opn = "sdr";
         break;
 #endif
     case OPC_LW:
         op_ldst(lw);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "lw";
         break;
     case OPC_SW:
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(sw);
         opn = "sw";
         break;
     case OPC_LH:
         op_ldst(lh);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "lh";
         break;
     case OPC_SH:
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(sh);
         opn = "sh";
         break;
     case OPC_LHU:
         op_ldst(lhu);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "lhu";
         break;
     case OPC_LB:
         op_ldst(lb);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "lb";
         break;
     case OPC_SB:
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(sb);
         opn = "sb";
         break;
     case OPC_LBU:
         op_ldst(lbu);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "lbu";
         break;
     case OPC_LWL:
-	GEN_LOAD_REG_TN(T1, rt);
+	GEN_LOAD_REG_T1(rt);
         op_ldst(lwl);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T1_REG(rt);
         opn = "lwl";
         break;
     case OPC_SWL:
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(swl);
         opn = "swr";
         break;
     case OPC_LWR:
-	GEN_LOAD_REG_TN(T1, rt);
+	GEN_LOAD_REG_T1(rt);
         op_ldst(lwr);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T1_REG(rt);
         opn = "lwr";
         break;
     case OPC_SWR:
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(swr);
         opn = "swr";
         break;
     case OPC_LL:
         op_ldst(ll);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "ll";
         break;
     case OPC_SC:
         save_cpu_state(ctx, 1);
-        GEN_LOAD_REG_TN(T1, rt);
+        GEN_LOAD_REG_T1(rt);
         op_ldst(sc);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "sc";
         break;
     default:
@@ -1054,7 +1079,7 @@ static void gen_arith_imm (CPUState *env, DisasContext *ctx, uint32_t opc,
     switch (opc) {
     case OPC_ADDI:
     case OPC_ADDIU:
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     case OPC_DADDI:
     case OPC_DADDIU:
 #endif
@@ -1065,7 +1090,7 @@ static void gen_arith_imm (CPUState *env, DisasContext *ctx, uint32_t opc,
     case OPC_ANDI:
     case OPC_ORI:
     case OPC_XORI:
-        GEN_LOAD_REG_TN(T0, rs);
+        GEN_LOAD_REG_T0(rs);
         GEN_LOAD_IMM_TN(T1, uimm);
         break;
     case OPC_LUI:
@@ -1074,7 +1099,7 @@ static void gen_arith_imm (CPUState *env, DisasContext *ctx, uint32_t opc,
     case OPC_SLL:
     case OPC_SRA:
     case OPC_SRL:
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     case OPC_DSLL:
     case OPC_DSRA:
     case OPC_DSRL:
@@ -1083,7 +1108,7 @@ static void gen_arith_imm (CPUState *env, DisasContext *ctx, uint32_t opc,
     case OPC_DSRL32:
 #endif
         uimm &= 0x1f;
-        GEN_LOAD_REG_TN(T0, rs);
+        GEN_LOAD_REG_T0(rs);
         GEN_LOAD_IMM_TN(T1, uimm);
         break;
     }
@@ -1097,7 +1122,7 @@ static void gen_arith_imm (CPUState *env, DisasContext *ctx, uint32_t opc,
         gen_op_add();
         opn = "addiu";
         break;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     case OPC_DADDI:
         save_cpu_state(ctx, 1);
         gen_op_daddo();
@@ -1161,7 +1186,7 @@ static void gen_arith_imm (CPUState *env, DisasContext *ctx, uint32_t opc,
             break;
         }
         break;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     case OPC_DSLL:
         gen_op_dsll();
         opn = "dsll";
@@ -1228,7 +1253,7 @@ static void gen_arith_imm (CPUState *env, DisasContext *ctx, uint32_t opc,
         generate_exception(ctx, EXCP_RI);
         return;
     }
-    GEN_STORE_TN_REG(rt, T0);
+    GEN_STORE_T0_REG(rt);
     MIPS_DEBUG("%s %s, %s, " TARGET_FMT_lx, opn, regnames[rt], regnames[rs], uimm);
 }
 
@@ -1245,8 +1270,14 @@ static void gen_arith (CPUState *env, DisasContext *ctx, uint32_t opc,
         MIPS_DEBUG("NOP");
         return;
     }
-    GEN_LOAD_REG_TN(T0, rs);
-    GEN_LOAD_REG_TN(T1, rt);
+    GEN_LOAD_REG_T0(rs);
+    /* Specialcase the conventional move operation. */
+    if (rt == 0 && (opc == OPC_ADDU || opc == OPC_DADDU
+                    || opc == OPC_SUBU || opc == OPC_DSUBU)) {
+        GEN_STORE_T0_REG(rd);
+        return;
+    }
+    GEN_LOAD_REG_T1(rt);
     switch (opc) {
     case OPC_ADD:
         save_cpu_state(ctx, 1);
@@ -1266,7 +1297,7 @@ static void gen_arith (CPUState *env, DisasContext *ctx, uint32_t opc,
         gen_op_sub();
         opn = "subu";
         break;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     case OPC_DADD:
         save_cpu_state(ctx, 1);
         gen_op_daddo();
@@ -1352,7 +1383,7 @@ static void gen_arith (CPUState *env, DisasContext *ctx, uint32_t opc,
             break;
         }
         break;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     case OPC_DSLLV:
         gen_op_dsllv();
         opn = "dsllv";
@@ -1389,7 +1420,7 @@ static void gen_arith (CPUState *env, DisasContext *ctx, uint32_t opc,
         generate_exception(ctx, EXCP_RI);
         return;
     }
-    GEN_STORE_TN_REG(rd, T0);
+    GEN_STORE_T0_REG(rd);
  print:
     MIPS_DEBUG("%s %s, %s, %s", opn, regnames[rd], regnames[rs], regnames[rt]);
 }
@@ -1407,21 +1438,21 @@ static void gen_HILO (DisasContext *ctx, uint32_t opc, int reg)
     switch (opc) {
     case OPC_MFHI:
         gen_op_load_HI(0);
-        GEN_STORE_TN_REG(reg, T0);
+        GEN_STORE_T0_REG(reg);
         opn = "mfhi";
         break;
     case OPC_MFLO:
         gen_op_load_LO(0);
-        GEN_STORE_TN_REG(reg, T0);
+        GEN_STORE_T0_REG(reg);
         opn = "mflo";
         break;
     case OPC_MTHI:
-        GEN_LOAD_REG_TN(T0, reg);
+        GEN_LOAD_REG_T0(reg);
         gen_op_store_HI(0);
         opn = "mthi";
         break;
     case OPC_MTLO:
-        GEN_LOAD_REG_TN(T0, reg);
+        GEN_LOAD_REG_T0(reg);
         gen_op_store_LO(0);
         opn = "mtlo";
         break;
@@ -1438,8 +1469,8 @@ static void gen_muldiv (DisasContext *ctx, uint32_t opc,
 {
     const char *opn = "mul/div";
 
-    GEN_LOAD_REG_TN(T0, rs);
-    GEN_LOAD_REG_TN(T1, rt);
+    GEN_LOAD_REG_T0(rs);
+    GEN_LOAD_REG_T1(rt);
     switch (opc) {
     case OPC_DIV:
         gen_op_div();
@@ -1457,7 +1488,7 @@ static void gen_muldiv (DisasContext *ctx, uint32_t opc,
         gen_op_multu();
         opn = "multu";
         break;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     case OPC_DDIV:
         gen_op_ddiv();
         opn = "ddiv";
@@ -1508,7 +1539,7 @@ static void gen_cl (DisasContext *ctx, uint32_t opc,
         MIPS_DEBUG("NOP");
         return;
     }
-    GEN_LOAD_REG_TN(T0, rs);
+    GEN_LOAD_REG_T0(rs);
     switch (opc) {
     case OPC_CLO:
         gen_op_clo();
@@ -1518,7 +1549,7 @@ static void gen_cl (DisasContext *ctx, uint32_t opc,
         gen_op_clz();
         opn = "clz";
         break;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     case OPC_DCLO:
         gen_op_dclo();
         opn = "dclo";
@@ -1554,8 +1585,8 @@ static void gen_trap (DisasContext *ctx, uint32_t opc,
     case OPC_TNE:
         /* Compare two registers */
         if (rs != rt) {
-            GEN_LOAD_REG_TN(T0, rs);
-            GEN_LOAD_REG_TN(T1, rt);
+            GEN_LOAD_REG_T0(rs);
+            GEN_LOAD_REG_T1(rt);
             cond = 1;
         }
         break;
@@ -1567,7 +1598,7 @@ static void gen_trap (DisasContext *ctx, uint32_t opc,
     case OPC_TNEI:
         /* Compare register to immediate */
         if (rs != 0 || imm != 0) {
-            GEN_LOAD_REG_TN(T0, rs);
+            GEN_LOAD_REG_T0(rs);
             GEN_LOAD_IMM_TN(T1, (int32_t)imm);
             cond = 1;
         }
@@ -1634,7 +1665,7 @@ static void gen_trap (DisasContext *ctx, uint32_t opc,
     ctx->bstate = BS_STOP;
 }
 
-static inline void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+static always_inline void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
 {
     TranslationBlock *tb;
     tb = ctx->tb;
@@ -1680,8 +1711,8 @@ static void gen_compute_branch (DisasContext *ctx, uint32_t opc,
     case OPC_BNEL:
         /* Compare two registers */
         if (rs != rt) {
-            GEN_LOAD_REG_TN(T0, rs);
-            GEN_LOAD_REG_TN(T1, rt);
+            GEN_LOAD_REG_T0(rs);
+            GEN_LOAD_REG_T1(rt);
             bcond = 1;
         }
         btarget = ctx->pc + 4 + offset;
@@ -1720,7 +1751,7 @@ static void gen_compute_branch (DisasContext *ctx, uint32_t opc,
             generate_exception(ctx, EXCP_RI);
             return;
         }
-        GEN_LOAD_REG_TN(T2, rs);
+        GEN_LOAD_REG_T2(rs);
         break;
     default:
         MIPS_INVAL("branch/jump");
@@ -1896,57 +1927,63 @@ static void gen_compute_branch (DisasContext *ctx, uint32_t opc,
 static void gen_bitops (DisasContext *ctx, uint32_t opc, int rt,
                        int rs, int lsb, int msb)
 {
-    GEN_LOAD_REG_TN(T1, rs);
+    GEN_LOAD_REG_T1(rs);
     switch (opc) {
     case OPC_EXT:
         if (lsb + msb > 31)
             goto fail;
         gen_op_ext(lsb, msb + 1);
         break;
+#if defined(TARGET_MIPS64)
     case OPC_DEXTM:
         if (lsb + msb > 63)
             goto fail;
-        gen_op_ext(lsb, msb + 1 + 32);
+        gen_op_dext(lsb, msb + 1 + 32);
         break;
     case OPC_DEXTU:
         if (lsb + msb > 63)
             goto fail;
-        gen_op_ext(lsb + 32, msb + 1);
+        gen_op_dext(lsb + 32, msb + 1);
         break;
     case OPC_DEXT:
-        gen_op_ext(lsb, msb + 1);
+        if (lsb + msb > 63)
+            goto fail;
+        gen_op_dext(lsb, msb + 1);
         break;
+#endif
     case OPC_INS:
         if (lsb > msb)
             goto fail;
-        GEN_LOAD_REG_TN(T0, rt);
+        GEN_LOAD_REG_T0(rt);
         gen_op_ins(lsb, msb - lsb + 1);
         break;
+#if defined(TARGET_MIPS64)
     case OPC_DINSM:
         if (lsb > msb)
             goto fail;
-        GEN_LOAD_REG_TN(T0, rt);
-        gen_op_ins(lsb, msb - lsb + 1 + 32);
+        GEN_LOAD_REG_T0(rt);
+        gen_op_dins(lsb, msb - lsb + 1 + 32);
         break;
     case OPC_DINSU:
         if (lsb > msb)
             goto fail;
-        GEN_LOAD_REG_TN(T0, rt);
-        gen_op_ins(lsb + 32, msb - lsb + 1);
+        GEN_LOAD_REG_T0(rt);
+        gen_op_dins(lsb + 32, msb - lsb + 1);
         break;
     case OPC_DINS:
         if (lsb > msb)
             goto fail;
-        GEN_LOAD_REG_TN(T0, rt);
-        gen_op_ins(lsb, msb - lsb + 1);
+        GEN_LOAD_REG_T0(rt);
+        gen_op_dins(lsb, msb - lsb + 1);
         break;
+#endif
     default:
 fail:
         MIPS_INVAL("bitops");
         generate_exception(ctx, EXCP_RI);
         return;
     }
-    GEN_STORE_TN_REG(rt, T0);
+    GEN_STORE_T0_REG(rt);
 }
 
 /* CP0 (MMU and control) */
@@ -1965,17 +2002,17 @@ static void gen_mfc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "Index";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_mvpcontrol();
             rn = "MVPControl";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_mvpconf0();
             rn = "MVPConf0";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_mvpconf1();
             rn = "MVPConf1";
             break;
@@ -1990,37 +2027,37 @@ static void gen_mfc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "Random";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_vpecontrol();
             rn = "VPEControl";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_vpeconf0();
             rn = "VPEConf0";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_vpeconf1();
             rn = "VPEConf1";
             break;
         case 4:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_yqmask();
             rn = "YQMask";
             break;
         case 5:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_vpeschedule();
             rn = "VPESchedule";
             break;
         case 6:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_vpeschefback();
             rn = "VPEScheFBack";
             break;
         case 7:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_vpeopt();
             rn = "VPEOpt";
             break;
@@ -2035,37 +2072,37 @@ static void gen_mfc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "EntryLo0";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_tcstatus();
             rn = "TCStatus";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_tcbind();
             rn = "TCBind";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_tcrestart();
             rn = "TCRestart";
             break;
         case 4:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_tchalt();
             rn = "TCHalt";
             break;
         case 5:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_tccontext();
             rn = "TCContext";
             break;
         case 6:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_tcschedule();
             rn = "TCSchedule";
             break;
         case 7:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_tcschefback();
             rn = "TCScheFBack";
             break;
@@ -2325,7 +2362,7 @@ static void gen_mfc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
     case 20:
         switch (sel) {
         case 0:
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
             check_insn(env, ctx, ISA_MIPS3);
             gen_op_mfc0_xcontext();
             rn = "XContext";
@@ -2529,21 +2566,21 @@ static void gen_mtc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
     case 0:
         switch (sel) {
         case 0:
-           gen_op_mtc0_index();
+            gen_op_mtc0_index();
             rn = "Index";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_mvpcontrol();
             rn = "MVPControl";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             /* ignored */
             rn = "MVPConf0";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             /* ignored */
             rn = "MVPConf1";
             break;
@@ -2558,37 +2595,37 @@ static void gen_mtc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "Random";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpecontrol();
             rn = "VPEControl";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpeconf0();
             rn = "VPEConf0";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpeconf1();
             rn = "VPEConf1";
             break;
         case 4:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_yqmask();
             rn = "YQMask";
             break;
         case 5:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpeschedule();
             rn = "VPESchedule";
             break;
         case 6:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpeschefback();
             rn = "VPEScheFBack";
             break;
         case 7:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpeopt();
             rn = "VPEOpt";
             break;
@@ -2603,37 +2640,37 @@ static void gen_mtc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "EntryLo0";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tcstatus();
             rn = "TCStatus";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tcbind();
             rn = "TCBind";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tcrestart();
             rn = "TCRestart";
             break;
         case 4:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tchalt();
             rn = "TCHalt";
             break;
         case 5:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tccontext();
             rn = "TCContext";
             break;
         case 6:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tcschedule();
             rn = "TCSchedule";
             break;
         case 7:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tcschefback();
             rn = "TCScheFBack";
             break;
@@ -2907,7 +2944,7 @@ static void gen_mtc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
     case 20:
         switch (sel) {
         case 0:
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
             check_insn(env, ctx, ISA_MIPS3);
             gen_op_mtc0_xcontext();
             rn = "XContext";
@@ -3117,7 +3154,7 @@ die:
     generate_exception(ctx, EXCP_RI);
 }
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 static void gen_dmfc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
 {
     const char *rn = "invalid";
@@ -3133,17 +3170,17 @@ static void gen_dmfc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "Index";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_mvpcontrol();
             rn = "MVPControl";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_mvpconf0();
             rn = "MVPConf0";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_mvpconf1();
             rn = "MVPConf1";
             break;
@@ -3158,37 +3195,37 @@ static void gen_dmfc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "Random";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_vpecontrol();
             rn = "VPEControl";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_vpeconf0();
             rn = "VPEConf0";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_vpeconf1();
             rn = "VPEConf1";
             break;
         case 4:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_dmfc0_yqmask();
             rn = "YQMask";
             break;
         case 5:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_dmfc0_vpeschedule();
             rn = "VPESchedule";
             break;
         case 6:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_dmfc0_vpeschefback();
             rn = "VPEScheFBack";
             break;
         case 7:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_vpeopt();
             rn = "VPEOpt";
             break;
@@ -3203,37 +3240,37 @@ static void gen_dmfc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "EntryLo0";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_tcstatus();
             rn = "TCStatus";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mfc0_tcbind();
             rn = "TCBind";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_dmfc0_tcrestart();
             rn = "TCRestart";
             break;
         case 4:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_dmfc0_tchalt();
             rn = "TCHalt";
             break;
         case 5:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_dmfc0_tccontext();
             rn = "TCContext";
             break;
         case 6:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_dmfc0_tcschedule();
             rn = "TCSchedule";
             break;
         case 7:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_dmfc0_tcschefback();
             rn = "TCScheFBack";
             break;
@@ -3690,17 +3727,17 @@ static void gen_dmtc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "Index";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_mvpcontrol();
             rn = "MVPControl";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             /* ignored */
             rn = "MVPConf0";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             /* ignored */
             rn = "MVPConf1";
             break;
@@ -3715,37 +3752,37 @@ static void gen_dmtc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "Random";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpecontrol();
             rn = "VPEControl";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpeconf0();
             rn = "VPEConf0";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpeconf1();
             rn = "VPEConf1";
             break;
         case 4:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_yqmask();
             rn = "YQMask";
             break;
         case 5:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpeschedule();
             rn = "VPESchedule";
             break;
         case 6:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpeschefback();
             rn = "VPEScheFBack";
             break;
         case 7:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_vpeopt();
             rn = "VPEOpt";
             break;
@@ -3760,37 +3797,37 @@ static void gen_dmtc0 (CPUState *env, DisasContext *ctx, int reg, int sel)
             rn = "EntryLo0";
             break;
         case 1:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tcstatus();
             rn = "TCStatus";
             break;
         case 2:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tcbind();
             rn = "TCBind";
             break;
         case 3:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tcrestart();
             rn = "TCRestart";
             break;
         case 4:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tchalt();
             rn = "TCHalt";
             break;
         case 5:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tccontext();
             rn = "TCContext";
             break;
         case 6:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tcschedule();
             rn = "TCSchedule";
             break;
         case 7:
-            check_mips_mt(env, ctx);
+            check_insn(env, ctx, ASE_MT);
             gen_op_mtc0_tcschefback();
             rn = "TCScheFBack";
             break;
@@ -4260,7 +4297,7 @@ die:
 #endif
     generate_exception(ctx, EXCP_RI);
 }
-#endif /* TARGET_MIPSN32 || TARGET_MIPS64 */
+#endif /* TARGET_MIPS64 */
 
 static void gen_mftr(CPUState *env, DisasContext *ctx, int rt,
                      int u, int sel, int h)
@@ -4605,12 +4642,12 @@ static void gen_cp0 (CPUState *env, DisasContext *ctx, uint32_t opc, int rt, int
         opn = "mfc0";
         break;
     case OPC_MTC0:
-        GEN_LOAD_REG_TN(T0, rt);
+        GEN_LOAD_REG_T0(rt);
         save_cpu_state(ctx, 1);
         gen_mtc0(env, ctx, rd, ctx->opcode & 0x7);
         opn = "mtc0";
         break;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     case OPC_DMFC0:
         check_insn(env, ctx, ISA_MIPS3);
         if (rt == 0) {
@@ -4623,14 +4660,14 @@ static void gen_cp0 (CPUState *env, DisasContext *ctx, uint32_t opc, int rt, int
         break;
     case OPC_DMTC0:
         check_insn(env, ctx, ISA_MIPS3);
-        GEN_LOAD_REG_TN(T0, rt);
+        GEN_LOAD_REG_T0(rt);
         save_cpu_state(ctx, 1);
         gen_dmtc0(env, ctx, rd, ctx->opcode & 0x7);
         opn = "dmtc0";
         break;
 #endif
     case OPC_MFTR:
-        check_mips_mt(env, ctx);
+        check_insn(env, ctx, ASE_MT);
         if (rd == 0) {
             /* Treat as NOP. */
             return;
@@ -4641,8 +4678,8 @@ static void gen_cp0 (CPUState *env, DisasContext *ctx, uint32_t opc, int rt, int
         opn = "mftr";
         break;
     case OPC_MTTR:
-        check_mips_mt(env, ctx);
-        GEN_LOAD_REG_TN(T0, rt);
+        check_insn(env, ctx, ASE_MT);
+        GEN_LOAD_REG_T0(rt);
         gen_mttr(env, ctx, rd, (ctx->opcode >> 5) & 1,
                  ctx->opcode & 0x7, (ctx->opcode >> 4) & 1);
         opn = "mttr";
@@ -4783,33 +4820,33 @@ static void gen_cp1 (DisasContext *ctx, uint32_t opc, int rt, int fs)
     case OPC_MFC1:
         GEN_LOAD_FREG_FTN(WT0, fs);
         gen_op_mfc1();
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "mfc1";
         break;
     case OPC_MTC1:
-        GEN_LOAD_REG_TN(T0, rt);
+        GEN_LOAD_REG_T0(rt);
         gen_op_mtc1();
         GEN_STORE_FTN_FREG(fs, WT0);
         opn = "mtc1";
         break;
     case OPC_CFC1:
         gen_op_cfc1(fs);
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "cfc1";
         break;
     case OPC_CTC1:
-        GEN_LOAD_REG_TN(T0, rt);
+        GEN_LOAD_REG_T0(rt);
         gen_op_ctc1(fs);
         opn = "ctc1";
         break;
     case OPC_DMFC1:
         GEN_LOAD_FREG_FTN(DT0, fs);
         gen_op_dmfc1();
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "dmfc1";
         break;
     case OPC_DMTC1:
-        GEN_LOAD_REG_TN(T0, rt);
+        GEN_LOAD_REG_T0(rt);
         gen_op_dmtc1();
         GEN_STORE_FTN_FREG(fs, DT0);
         opn = "dmtc1";
@@ -4817,11 +4854,11 @@ static void gen_cp1 (DisasContext *ctx, uint32_t opc, int rt, int fs)
     case OPC_MFHC1:
         GEN_LOAD_FREG_FTN(WTH0, fs);
         gen_op_mfhc1();
-        GEN_STORE_TN_REG(rt, T0);
+        GEN_STORE_T0_REG(rt);
         opn = "mfhc1";
         break;
     case OPC_MTHC1:
-        GEN_LOAD_REG_TN(T0, rt);
+        GEN_LOAD_REG_T0(rt);
         gen_op_mthc1();
         GEN_STORE_FTN_FREG(fs, WTH0);
         opn = "mthc1";
@@ -4838,8 +4875,8 @@ static void gen_movci (DisasContext *ctx, int rd, int rs, int cc, int tf)
 {
     uint32_t ccbit;
 
-    GEN_LOAD_REG_TN(T0, rd);
-    GEN_LOAD_REG_TN(T1, rs);
+    GEN_LOAD_REG_T0(rd);
+    GEN_LOAD_REG_T1(rs);
     if (cc) {
         ccbit = 1 << (24 + cc);
     } else
@@ -4848,7 +4885,7 @@ static void gen_movci (DisasContext *ctx, int rd, int rs, int cc, int tf)
         gen_op_movf(ccbit);
     else
         gen_op_movt(ccbit);
-    GEN_STORE_TN_REG(rd, T0);
+    GEN_STORE_T0_REG(rd);
 }
 
 #define GEN_MOVCF(fmt)                                                \
@@ -5023,7 +5060,7 @@ static void gen_farith (DisasContext *ctx, uint32_t op1,
         opn = "floor.w.s";
         break;
     case FOP(17, 16):
-        GEN_LOAD_REG_TN(T0, ft);
+        GEN_LOAD_REG_T0(ft);
         GEN_LOAD_FREG_FTN(WT0, fs);
         GEN_LOAD_FREG_FTN(WT2, fd);
         gen_movcf_s(ctx, (ft >> 2) & 0x7, ft & 0x1);
@@ -5031,7 +5068,7 @@ static void gen_farith (DisasContext *ctx, uint32_t op1,
         opn = "movcf.s";
         break;
     case FOP(18, 16):
-        GEN_LOAD_REG_TN(T0, ft);
+        GEN_LOAD_REG_T0(ft);
         GEN_LOAD_FREG_FTN(WT0, fs);
         GEN_LOAD_FREG_FTN(WT2, fd);
         gen_op_float_movz_s();
@@ -5039,7 +5076,7 @@ static void gen_farith (DisasContext *ctx, uint32_t op1,
         opn = "movz.s";
         break;
     case FOP(19, 16):
-        GEN_LOAD_REG_TN(T0, ft);
+        GEN_LOAD_REG_T0(ft);
         GEN_LOAD_FREG_FTN(WT0, fs);
         GEN_LOAD_FREG_FTN(WT2, fd);
         gen_op_float_movn_s();
@@ -5264,7 +5301,7 @@ static void gen_farith (DisasContext *ctx, uint32_t op1,
         opn = "floor.w.d";
         break;
     case FOP(17, 17):
-        GEN_LOAD_REG_TN(T0, ft);
+        GEN_LOAD_REG_T0(ft);
         GEN_LOAD_FREG_FTN(DT0, fs);
         GEN_LOAD_FREG_FTN(DT2, fd);
         gen_movcf_d(ctx, (ft >> 2) & 0x7, ft & 0x1);
@@ -5272,7 +5309,7 @@ static void gen_farith (DisasContext *ctx, uint32_t op1,
         opn = "movcf.d";
         break;
     case FOP(18, 17):
-        GEN_LOAD_REG_TN(T0, ft);
+        GEN_LOAD_REG_T0(ft);
         GEN_LOAD_FREG_FTN(DT0, fs);
         GEN_LOAD_FREG_FTN(DT2, fd);
         gen_op_float_movz_d();
@@ -5280,7 +5317,7 @@ static void gen_farith (DisasContext *ctx, uint32_t op1,
         opn = "movz.d";
         break;
     case FOP(19, 17):
-        GEN_LOAD_REG_TN(T0, ft);
+        GEN_LOAD_REG_T0(ft);
         GEN_LOAD_FREG_FTN(DT0, fs);
         GEN_LOAD_FREG_FTN(DT2, fd);
         gen_op_float_movn_d();
@@ -5408,7 +5445,6 @@ static void gen_farith (DisasContext *ctx, uint32_t op1,
         opn = "cvt.d.l";
         break;
     case FOP(38, 20):
-    case FOP(38, 21):
         check_cp1_64bitmode(ctx);
         GEN_LOAD_FREG_FTN(WT0, fs);
         GEN_LOAD_FREG_FTN(WTH0, fs);
@@ -5479,7 +5515,7 @@ static void gen_farith (DisasContext *ctx, uint32_t op1,
         break;
     case FOP(17, 22):
         check_cp1_64bitmode(ctx);
-        GEN_LOAD_REG_TN(T0, ft);
+        GEN_LOAD_REG_T0(ft);
         GEN_LOAD_FREG_FTN(WT0, fs);
         GEN_LOAD_FREG_FTN(WTH0, fs);
         GEN_LOAD_FREG_FTN(WT2, fd);
@@ -5491,7 +5527,7 @@ static void gen_farith (DisasContext *ctx, uint32_t op1,
         break;
     case FOP(18, 22):
         check_cp1_64bitmode(ctx);
-        GEN_LOAD_REG_TN(T0, ft);
+        GEN_LOAD_REG_T0(ft);
         GEN_LOAD_FREG_FTN(WT0, fs);
         GEN_LOAD_FREG_FTN(WTH0, fs);
         GEN_LOAD_FREG_FTN(WT2, fd);
@@ -5503,7 +5539,7 @@ static void gen_farith (DisasContext *ctx, uint32_t op1,
         break;
     case FOP(19, 22):
         check_cp1_64bitmode(ctx);
-        GEN_LOAD_REG_TN(T0, ft);
+        GEN_LOAD_REG_T0(ft);
         GEN_LOAD_FREG_FTN(WT0, fs);
         GEN_LOAD_FREG_FTN(WTH0, fs);
         GEN_LOAD_FREG_FTN(WT2, fd);
@@ -5690,12 +5726,12 @@ static void gen_flt3_ldst (DisasContext *ctx, uint32_t opc,
         if (index == 0)
             gen_op_reset_T0();
         else
-            GEN_LOAD_REG_TN(T0, index);
+            GEN_LOAD_REG_T0(index);
     } else if (index == 0) {
-        GEN_LOAD_REG_TN(T0, base);
+        GEN_LOAD_REG_T0(base);
     } else {
-        GEN_LOAD_REG_TN(T0, base);
-        GEN_LOAD_REG_TN(T1, index);
+        GEN_LOAD_REG_T0(base);
+        GEN_LOAD_REG_T1(index);
         gen_op_addr_add();
     }
     /* Don't do NOP if destination is zero: we must perform the actual
@@ -5752,7 +5788,7 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
     check_cp1_64bitmode(ctx);
     switch (opc) {
     case OPC_ALNV_PS:
-        GEN_LOAD_REG_TN(T0, fr);
+        GEN_LOAD_REG_T0(fr);
         GEN_LOAD_FREG_FTN(DT0, fs);
         GEN_LOAD_FREG_FTN(DT1, ft);
         gen_op_float_alnv_ps();
@@ -5884,10 +5920,9 @@ static void gen_flt3_arith (DisasContext *ctx, uint32_t opc,
 /* MIPS16 extension to MIPS32 */
 /* SmartMIPS extension to MIPS32 */
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
 
 /* MDMX extension to MIPS64 */
-/* MIPS-3D extension to MIPS64 */
 
 #endif
 
@@ -5995,7 +6030,7 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
             }
             break;
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
        /* MIPS64 specific opcodes */
         case OPC_DSLL:
         case OPC_DSRL ... OPC_DSRA:
@@ -6051,7 +6086,7 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
             }
             /* Treat as NOP. */
             break;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
         case OPC_DCLZ ... OPC_DCLO:
             check_insn(env, ctx, ISA_MIPS64);
             check_mips_64(ctx);
@@ -6077,15 +6112,15 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
              op2 = MASK_BSHFL(ctx->opcode);
              switch (op2) {
              case OPC_WSBH:
-                 GEN_LOAD_REG_TN(T1, rt);
+                 GEN_LOAD_REG_T1(rt);
                  gen_op_wsbh();
                  break;
              case OPC_SEB:
-                 GEN_LOAD_REG_TN(T1, rt);
+                 GEN_LOAD_REG_T1(rt);
                  gen_op_seb();
                  break;
              case OPC_SEH:
-                 GEN_LOAD_REG_TN(T1, rt);
+                 GEN_LOAD_REG_T1(rt);
                  gen_op_seh();
                  break;
              default:            /* Invalid */
@@ -6093,7 +6128,7 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
                  generate_exception(ctx, EXCP_RI);
                  break;
             }
-            GEN_STORE_TN_REG(rd, T0);
+            GEN_STORE_T0_REG(rd);
             break;
         case OPC_RDHWR:
             check_insn(env, ctx, ISA_MIPS32R2);
@@ -6124,21 +6159,21 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
                 generate_exception(ctx, EXCP_RI);
                 break;
             }
-            GEN_STORE_TN_REG(rt, T0);
+            GEN_STORE_T0_REG(rt);
             break;
         case OPC_FORK:
-            check_mips_mt(env, ctx);
-            GEN_LOAD_REG_TN(T0, rt);
-            GEN_LOAD_REG_TN(T1, rs);
+            check_insn(env, ctx, ASE_MT);
+            GEN_LOAD_REG_T0(rt);
+            GEN_LOAD_REG_T1(rs);
             gen_op_fork();
             break;
         case OPC_YIELD:
-            check_mips_mt(env, ctx);
-            GEN_LOAD_REG_TN(T0, rs);
+            check_insn(env, ctx, ASE_MT);
+            GEN_LOAD_REG_T0(rs);
             gen_op_yield();
-            GEN_STORE_TN_REG(rd, T0);
+            GEN_STORE_T0_REG(rd);
             break;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
         case OPC_DEXTM ... OPC_DEXT:
         case OPC_DINSM ... OPC_DINS:
             check_insn(env, ctx, ISA_MIPS64R2);
@@ -6151,11 +6186,11 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
             op2 = MASK_DBSHFL(ctx->opcode);
             switch (op2) {
             case OPC_DSBH:
-                GEN_LOAD_REG_TN(T1, rt);
+                GEN_LOAD_REG_T1(rt);
                 gen_op_dsbh();
                 break;
             case OPC_DSHD:
-                GEN_LOAD_REG_TN(T1, rt);
+                GEN_LOAD_REG_T1(rt);
                 gen_op_dshd();
                 break;
             default:            /* Invalid */
@@ -6163,7 +6198,8 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
                 generate_exception(ctx, EXCP_RI);
                 break;
             }
-            GEN_STORE_TN_REG(rd, T0);
+            GEN_STORE_T0_REG(rd);
+            break;
 #endif
         default:            /* Invalid */
             MIPS_INVAL("special3");
@@ -6200,7 +6236,7 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
         case OPC_MTC0:
         case OPC_MFTR:
         case OPC_MTTR:
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
         case OPC_DMFC0:
         case OPC_DMTC0:
 #endif
@@ -6213,19 +6249,19 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
             op2 = MASK_MFMC0(ctx->opcode);
             switch (op2) {
             case OPC_DMT:
-                check_mips_mt(env, ctx);
+                check_insn(env, ctx, ASE_MT);
                 gen_op_dmt();
                 break;
             case OPC_EMT:
-                check_mips_mt(env, ctx);
+                check_insn(env, ctx, ASE_MT);
                 gen_op_emt();
                 break;
             case OPC_DVPE:
-                check_mips_mt(env, ctx);
+                check_insn(env, ctx, ASE_MT);
                 gen_op_dvpe();
                 break;
             case OPC_EVPE:
-                check_mips_mt(env, ctx);
+                check_insn(env, ctx, ASE_MT);
                 gen_op_evpe();
                 break;
             case OPC_DI:
@@ -6247,16 +6283,16 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
                 generate_exception(ctx, EXCP_RI);
                 break;
             }
-            GEN_STORE_TN_REG(rt, T0);
+            GEN_STORE_T0_REG(rt);
             break;
         case OPC_RDPGPR:
             check_insn(env, ctx, ISA_MIPS32R2);
             GEN_LOAD_SRSREG_TN(T0, rt);
-            GEN_STORE_TN_REG(rd, T0);
+            GEN_STORE_T0_REG(rd);
             break;
         case OPC_WRPGPR:
             check_insn(env, ctx, ISA_MIPS32R2);
-            GEN_LOAD_REG_TN(T0, rt);
+            GEN_LOAD_REG_T0(rt);
             GEN_STORE_TN_SRSREG(rd, T0);
             break;
         default:
@@ -6321,16 +6357,18 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
             case OPC_CTC1:
                 gen_cp1(ctx, op1, rt, rd);
                 break;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
             case OPC_DMFC1:
             case OPC_DMTC1:
                 check_insn(env, ctx, ISA_MIPS3);
                 gen_cp1(ctx, op1, rt, rd);
                 break;
 #endif
-            case OPC_BC1:
             case OPC_BC1ANY2:
             case OPC_BC1ANY4:
+                check_insn(env, ctx, ASE_MIPS3D);
+                /* fall through */
+            case OPC_BC1:
                 gen_compute_branch1(env, ctx, MASK_BC1(ctx->opcode),
                                     (rt >> 2) & 0x7, imm << 2);
                 return;
@@ -6404,7 +6442,7 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
         }
         break;
 
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     /* MIPS64 opcodes */
     case OPC_LWU:
     case OPC_LDL ... OPC_LDR:
@@ -6477,7 +6515,7 @@ static void decode_opc (CPUState *env, DisasContext *ctx)
     }
 }
 
-static inline int
+static always_inline int
 gen_intermediate_code_internal (CPUState *env, TranslationBlock *tb,
                                 int search_pc)
 {
@@ -6502,9 +6540,9 @@ gen_intermediate_code_internal (CPUState *env, TranslationBlock *tb,
     ctx.hflags = (uint32_t)tb->flags; /* FIXME: maybe use 64 bits here? */
     restore_cpu_state(env, &ctx);
 #if defined(CONFIG_USER_ONLY)
-    ctx.mem_idx = 0;
+    ctx.mem_idx = MIPS_HFLAG_UM;
 #else
-    ctx.mem_idx = !((ctx.hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM);
+    ctx.mem_idx = ctx.hflags & MIPS_HFLAG_KSU;
 #endif
 #ifdef DEBUG_DISAS
     if (loglevel & CPU_LOG_TB_CPU) {
@@ -6515,7 +6553,7 @@ gen_intermediate_code_internal (CPUState *env, TranslationBlock *tb,
 #endif
 #ifdef MIPS_DEBUG_DISAS
     if (loglevel & CPU_LOG_TB_IN_ASM)
-        fprintf(logfile, "\ntb %p super %d cond %04x\n",
+        fprintf(logfile, "\ntb %p idx %d hflags %04x\n",
                 tb, ctx.mem_idx, ctx.hflags);
 #endif
     while (ctx.bstate == BS_NONE && gen_opc_ptr < gen_opc_end) {
@@ -6582,6 +6620,7 @@ gen_intermediate_code_internal (CPUState *env, TranslationBlock *tb,
 	}
     }
 done_generating:
+    ctx.last_T0_store = NULL;
     *gen_opc_ptr = INDEX_op_end;
     if (search_pc) {
         j = gen_opc_ptr - gen_opc_buf;
@@ -6671,7 +6710,7 @@ void dump_fpu (CPUState *env)
     }
 }
 
-#if (defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)) && defined(MIPS_DEBUG_SIGN_EXTENSIONS)
+#if defined(TARGET_MIPS64) && defined(MIPS_DEBUG_SIGN_EXTENSIONS)
 /* Debug help: The architecture requires 32bit code to maintain proper
    sign-extened values on 64bit machines.  */
 
@@ -6726,19 +6765,28 @@ void cpu_dump_state (CPUState *env, FILE *f,
                 env->CP0_Config0, env->CP0_Config1, env->CP0_LLAddr);
     if (env->hflags & MIPS_HFLAG_FPU)
         fpu_dump_state(env, f, cpu_fprintf, flags);
-#if (defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)) && defined(MIPS_DEBUG_SIGN_EXTENSIONS)
+#if defined(TARGET_MIPS64) && defined(MIPS_DEBUG_SIGN_EXTENSIONS)
     cpu_mips_check_sign_extensions(env, f, cpu_fprintf, flags);
 #endif
 }
 
-CPUMIPSState *cpu_mips_init (void)
+#include "translate_init.c"
+
+CPUMIPSState *cpu_mips_init (const char *cpu_model)
 {
     CPUMIPSState *env;
+    const mips_def_t *def;
 
+    def = cpu_mips_find_by_name(cpu_model);
+    if (!def)
+        return NULL;
     env = qemu_mallocz(sizeof(CPUMIPSState));
     if (!env)
         return NULL;
+    env->cpu_model = def;
+
     cpu_exec_init(env);
+    env->cpu_model_str = cpu_model;
     cpu_reset(env);
     return env;
 }
@@ -6786,6 +6834,5 @@ void cpu_reset (CPUMIPSState *env)
 #else
     env->hflags = MIPS_HFLAG_CP0;
 #endif
+    cpu_mips_register(env, env->cpu_model);
 }
-
-#include "translate_init.c"
diff --git a/target-mips/translate_init.c b/target-mips/translate_init.c
index 748b9dd85..6a4c43576 100644
--- a/target-mips/translate_init.c
+++ b/target-mips/translate_init.c
@@ -53,7 +53,6 @@
    Define a major version 1, minor version 0. */
 #define MIPS_FCR0 ((0 << FCR0_S) | (0x1 << FCR0_PRID) | (0x10 << FCR0_REV))
 
-
 struct mips_def_t {
     const unsigned char *name;
     int32_t CP0_PRid;
@@ -102,6 +101,23 @@ static mips_def_t mips_defs[] =
         .insn_flags = CPU_MIPS32 | ASE_MIPS16,
     },
     {
+        .name = "4Km",
+        .CP0_PRid = 0x00018300,
+        /* Config1 implemented, fixed mapping MMU,
+           no virtual icache, uncached coherency. */
+        .CP0_Config0 = (1 << CP0C0_M) |
+                    (0x3 << CP0C0_MT) | (0x2 << CP0C0_K0),
+        .CP0_Config1 = MIPS_CONFIG1 |
+		    (0 << CP0C1_IS) | (3 << CP0C1_IL) | (1 << CP0C1_IA) |
+		    (0 << CP0C1_DS) | (3 << CP0C1_DL) | (1 << CP0C1_DA),
+        .CP0_Config2 = MIPS_CONFIG2,
+        .CP0_Config3 = MIPS_CONFIG3,
+        .SYNCI_Step = 32,
+        .CCRes = 2,
+        .CP0_Status_rw_bitmask = 0x1258FF17,
+        .insn_flags = CPU_MIPS32 | ASE_MIPS16,
+    },
+    {
         .name = "4KEcR1",
         .CP0_PRid = 0x00018400,
         .CP0_Config0 = MIPS_CONFIG0,
@@ -116,6 +132,23 @@ static mips_def_t mips_defs[] =
         .insn_flags = CPU_MIPS32 | ASE_MIPS16,
     },
     {
+        .name = "4KEmR1",
+        .CP0_PRid = 0x00018500,
+        /* Config1 implemented, fixed mapping MMU,
+           no virtual icache, uncached coherency. */
+        .CP0_Config0 = (1 << CP0C0_M) |
+                    (0x3 << CP0C0_MT) | (0x2 << CP0C0_K0),
+        .CP0_Config1 = MIPS_CONFIG1 |
+		    (0 << CP0C1_IS) | (3 << CP0C1_IL) | (1 << CP0C1_IA) |
+		    (0 << CP0C1_DS) | (3 << CP0C1_DL) | (1 << CP0C1_DA),
+        .CP0_Config2 = MIPS_CONFIG2,
+        .CP0_Config3 = MIPS_CONFIG3,
+        .SYNCI_Step = 32,
+        .CCRes = 2,
+        .CP0_Status_rw_bitmask = 0x1258FF17,
+        .insn_flags = CPU_MIPS32 | ASE_MIPS16,
+    },
+    {
         .name = "4KEc",
         .CP0_PRid = 0x00019000,
         .CP0_Config0 = MIPS_CONFIG0 | (0x1 << CP0C0_AR),
@@ -130,6 +163,23 @@ static mips_def_t mips_defs[] =
         .insn_flags = CPU_MIPS32R2 | ASE_MIPS16,
     },
     {
+        .name = "4KEm",
+        .CP0_PRid = 0x00019100,
+        /* Config1 implemented, MIPS32R2, fixed mapping MMU,
+           no virtual icache, uncached coherency. */
+        .CP0_Config0 = (1 << CP0C0_M) | (0x1 << CP0C0_AR) |
+                    (0x3 << CP0C0_MT) | (0x2 << CP0C0_K0),
+        .CP0_Config1 = MIPS_CONFIG1 |
+		    (0 << CP0C1_IS) | (3 << CP0C1_IL) | (1 << CP0C1_IA) |
+		    (0 << CP0C1_DS) | (3 << CP0C1_DL) | (1 << CP0C1_DA),
+        .CP0_Config2 = MIPS_CONFIG2,
+        .CP0_Config3 = MIPS_CONFIG3,
+        .SYNCI_Step = 32,
+        .CCRes = 2,
+        .CP0_Status_rw_bitmask = 0x1258FF17,
+        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16,
+    },
+    {
         .name = "24Kc",
         .CP0_PRid = 0x00019300,
         .CP0_Config0 = MIPS_CONFIG0 | (0x1 << CP0C0_AR),
@@ -142,7 +192,7 @@ static mips_def_t mips_defs[] =
         .CCRes = 2,
         /* No DSP implemented. */
         .CP0_Status_rw_bitmask = 0x1278FF1F,
-        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16 | ASE_DSP,
+        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16,
     },
     {
         .name = "24Kf",
@@ -159,7 +209,7 @@ static mips_def_t mips_defs[] =
         .CP0_Status_rw_bitmask = 0x3678FF1F,
         .CP1_fcr0 = (1 << FCR0_F64) | (1 << FCR0_L) | (1 << FCR0_W) |
                     (1 << FCR0_D) | (1 << FCR0_S) | (0x93 << FCR0_PRID),
-        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16 | ASE_DSP,
+        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16,
     },
     {
         .name = "34Kf",
@@ -199,9 +249,9 @@ static mips_def_t mips_defs[] =
         .CP0_SRSConf4_rw_bitmask = 0x3fffffff,
         .CP0_SRSConf4 = (0x3fe << CP0SRSC4_SRS15) |
                     (0x3fe << CP0SRSC4_SRS14) | (0x3fe << CP0SRSC4_SRS13),
-        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16 | ASE_DSP,
+        .insn_flags = CPU_MIPS32R2 | ASE_MIPS16 | ASE_DSP | ASE_MT,
     },
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     {
         .name = "R4000",
         .CP0_PRid = 0x00000400,
@@ -276,24 +326,40 @@ static mips_def_t mips_defs[] =
         .SEGBITS = 40,
         .insn_flags = CPU_MIPS64 | ASE_MIPS3D,
     },
+    {
+	/* A generic CPU providing MIPS64 Release 2 features.
+           FIXME: Eventually this should be replaced by a real CPU model. */
+        .name = "MIPS64R2-generic",
+        .CP0_PRid = 0x00010000,
+        .CP0_Config0 = MIPS_CONFIG0 | (0x2 << CP0C0_AT) | (0x1 << CP0C0_AR),
+        .CP0_Config1 = MIPS_CONFIG1 | (1 << CP0C1_FP) | (63 << CP0C1_MMU) |
+		    (2 << CP0C1_IS) | (4 << CP0C1_IL) | (3 << CP0C1_IA) |
+		    (2 << CP0C1_DS) | (4 << CP0C1_DL) | (3 << CP0C1_DA) |
+		    (1 << CP0C1_PC) | (1 << CP0C1_WR) | (1 << CP0C1_EP),
+        .CP0_Config2 = MIPS_CONFIG2,
+        .CP0_Config3 = MIPS_CONFIG3,
+        .SYNCI_Step = 32,
+        .CCRes = 2,
+        .CP0_Status_rw_bitmask = 0x36FBFFFF,
+        .CP1_fcr0 = (1 << FCR0_3D) | (1 << FCR0_PS) | (1 << FCR0_L) |
+                    (1 << FCR0_W) | (1 << FCR0_D) | (1 << FCR0_S) |
+                    (0x00 << FCR0_PRID) | (0x0 << FCR0_REV),
+        .SEGBITS = 40,
+        .insn_flags = CPU_MIPS64R2 | ASE_MIPS3D,
+    },
 #endif
 };
 
-int mips_find_by_name (const unsigned char *name, mips_def_t **def)
+static const mips_def_t *cpu_mips_find_by_name (const unsigned char *name)
 {
-    int i, ret;
+    int i;
 
-    ret = -1;
-    *def = NULL;
     for (i = 0; i < sizeof(mips_defs) / sizeof(mips_defs[0]); i++) {
         if (strcasecmp(name, mips_defs[i].name) == 0) {
-            *def = &mips_defs[i];
-            ret = 0;
-            break;
+            return &mips_defs[i];
         }
     }
-
-    return ret;
+    return NULL;
 }
 
 void mips_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
@@ -307,19 +373,19 @@ void mips_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
 }
 
 #ifndef CONFIG_USER_ONLY
-static void no_mmu_init (CPUMIPSState *env, mips_def_t *def)
+static void no_mmu_init (CPUMIPSState *env, const mips_def_t *def)
 {
     env->tlb->nb_tlb = 1;
     env->tlb->map_address = &no_mmu_map_address;
 }
 
-static void fixed_mmu_init (CPUMIPSState *env, mips_def_t *def)
+static void fixed_mmu_init (CPUMIPSState *env, const mips_def_t *def)
 {
     env->tlb->nb_tlb = 1;
     env->tlb->map_address = &fixed_mmu_map_address;
 }
 
-static void r4k_mmu_init (CPUMIPSState *env, mips_def_t *def)
+static void r4k_mmu_init (CPUMIPSState *env, const mips_def_t *def)
 {
     env->tlb->nb_tlb = 1 + ((def->CP0_Config1 >> CP0C1_MMU) & 63);
     env->tlb->map_address = &r4k_map_address;
@@ -329,7 +395,7 @@ static void r4k_mmu_init (CPUMIPSState *env, mips_def_t *def)
     env->tlb->do_tlbr = r4k_do_tlbr;
 }
 
-static void mmu_init (CPUMIPSState *env, mips_def_t *def)
+static void mmu_init (CPUMIPSState *env, const mips_def_t *def)
 {
     env->tlb = qemu_mallocz(sizeof(CPUMIPSTLBContext));
 
@@ -355,7 +421,7 @@ static void mmu_init (CPUMIPSState *env, mips_def_t *def)
 }
 #endif /* CONFIG_USER_ONLY */
 
-static void fpu_init (CPUMIPSState *env, mips_def_t *def)
+static void fpu_init (CPUMIPSState *env, const mips_def_t *def)
 {
     env->fpu = qemu_mallocz(sizeof(CPUMIPSFPUContext));
 
@@ -368,7 +434,7 @@ static void fpu_init (CPUMIPSState *env, mips_def_t *def)
 #endif
 }
 
-static void mvp_init (CPUMIPSState *env, mips_def_t *def)
+static void mvp_init (CPUMIPSState *env, const mips_def_t *def)
 {
     env->mvp = qemu_mallocz(sizeof(CPUMIPSMVPContext));
 
@@ -394,13 +460,8 @@ static void mvp_init (CPUMIPSState *env, mips_def_t *def)
                              (0x1 << CP0MVPC1_PCP1);
 }
 
-int cpu_mips_register (CPUMIPSState *env, mips_def_t *def)
+static int cpu_mips_register (CPUMIPSState *env, const mips_def_t *def)
 {
-    if (!def)
-        def = env->cpu_model;
-    if (!def)
-        cpu_abort(env, "Unable to find MIPS CPU definition\n");
-    env->cpu_model = def;
     env->CP0_PRid = def->CP0_PRid;
     env->CP0_Config0 = def->CP0_Config0;
 #ifdef TARGET_WORDS_BIGENDIAN
@@ -416,7 +477,7 @@ int cpu_mips_register (CPUMIPSState *env, mips_def_t *def)
     env->CP0_Status_rw_bitmask = def->CP0_Status_rw_bitmask;
     env->CP0_TCStatus_rw_bitmask = def->CP0_TCStatus_rw_bitmask;
     env->CP0_SRSCtl = def->CP0_SRSCtl;
-#if defined(TARGET_MIPSN32) || defined(TARGET_MIPS64)
+#if defined(TARGET_MIPS64)
     if (def->insn_flags & ISA_MIPS3)
     {
         env->hflags |= MIPS_HFLAG_64;
diff --git a/target-ppc/STATUS b/target-ppc/STATUS
index b4daa97af..32e7ffa49 100644
--- a/target-ppc/STATUS
+++ b/target-ppc/STATUS
@@ -86,8 +86,8 @@ MSR   OK
 IRQ   OK
 MMU   OK
 EXCP  OK
-=> Linux 2.4 boots (at least 1 proprietary firmware).
-
+Remarks: Linux 2.4 boots (at least 1 proprietary firmware).
+         uboot seems to freeze at boot time.
 To be checked: 405D2 405D4 405EZ 405LP Npe4GS3 STB03 STB04 STB25
                x2vp4 x2vp7 x2vp20 x2vp50
 
@@ -203,8 +203,8 @@ MSR   OK
 IRQ   OK
 MMU   ?
 EXCP  ? at least timer and external interrupt are OK
-Remarks: Linux crashes when entering user-mode. But it seems it does not
-         know about this CPU. As this CPU is close to 603e, it should be OK.
+Remarks: Linux 2.4 crashes when entering user-mode.
+         Linux 2.6.22 boots on this CPU but does not recognize it.
 
 PowerPC 603: (603)
 INSN  OK
@@ -214,6 +214,7 @@ IRQ   OK
 MMU   OK
 EXCP  OK
 Remarks: Linux 2.4 boots and properly recognizes the CPU
+         Linux 2.6.22 idem.
 
 PowerPC 603e: (603e11)
 INSN  OK
@@ -223,6 +224,7 @@ IRQ   OK
 MMU   OK
 EXCP  OK
 Remarks: Linux 2.4 boots and properly recognizes the CPU
+         Linux 2.6.22 idem.
 
 PowerPC G2:
 INSN  OK
@@ -232,6 +234,7 @@ IRQ   OK
 MMU   OK
 EXCP  OK
 Remarks: Linux 2.4 boots, recognizes the CPU as a 82xx.
+         Linux 2.6.22 idem.
 
 PowerPC G2le:
 INSN  OK
@@ -241,6 +244,7 @@ IRQ   OK
 MMU   OK
 EXCP  OK
 Remarks: Linux 2.4 does not boots. Same symptoms as 602.
+         Linux 2.6.22 boots and properly recognizes the CPU.
 
 PowerPC 604:
 INSN  OK
@@ -250,6 +254,7 @@ IRQ   OK
 MMU   OK
 EXCP  OK
 Remarks: Linux 2.4 boots and properly recognizes the CPU.
+         Linux 2.6.22 idem.
 
 PowerPC 7x0:
 INSN  OK
@@ -259,6 +264,7 @@ IRQ   OK
 MMU   OK
 EXCP  OK
 Remarks: Linux 2.4 boots and properly recognizes the CPU.
+         Linux 2.6.22 idem.
 
 PowerPC 750fx:
 INSN  OK
@@ -268,6 +274,7 @@ IRQ   OK
 MMU   OK
 EXCP  OK
 Remarks: Linux 2.4 boots but does not properly recognizes the CPU.
+         Linux 2.6.22 boots and properly recognizes the CPU.
 
 PowerPC 7x5:
 INSN  ?
@@ -276,7 +283,8 @@ MSR   ?
 IRQ   OK
 MMU   ?
 EXCP  OK
-=> Linux 2.4 does not boot.
+Remarks: Linux 2.4 does not boot.
+         Linux 2.6.22 idem.
 
 PowerPC 7400:
 INSN  KO Altivec missing
@@ -285,7 +293,8 @@ MSR   OK
 IRQ   OK
 MMU   OK
 EXCP  ?  Altivec, ...
-=> Linux 2.4 boots and properly recognize the CPU.
+Remarks: Linux 2.4 boots and properly recognize the CPU.
+         Linux 2.6.22 idem.
 
 PowerPC 7410:
 INSN  KO Altivec missing
@@ -294,42 +303,51 @@ MSR   OK
 IRQ   OK
 MMU   OK
 EXCP  ?  Altivec, ...
-=> Linux 2.4 boots and properly recognize the CPU.
-   Note that UM says tlbld & tlbli are implemented bus this may be a mistake
-   as TLB load are managed by the hardware and it does not implement the
+Remarks: Linux 2.4 boots and properly recognize the CPU.
+         Linux 2.6.22 idem.
+   Note that UM says tlbld & tlbli are implemented but this may be a mistake
+   as TLB loads are managed by the hardware and the CPU does not implement the
    needed registers.
 
 PowerPC 7441:
-INSN  KO Altivec missing + TLB load insns missing
+INSN  KO Altivec missing
 SPR   OK
 MSR   OK
 IRQ   OK
-MMU   KO not implemented
+MMU   OK
 EXCP  ?  Altivec, ...
+Remarks: Linux does not have the code to handle TLB miss on this CPU
+         Linux 2.6.22 idem.
 
 PowerPC 7450/7451:
-INSN  KO Altivec missing + TLB load insns missing
+INSN  KO Altivec missing
 SPR   OK
 MSR   OK
 IRQ   OK
-MMU   KO not implemented
+MMU   OK
 EXCP  ?  Altivec, ...
+Remarks: Linux does not have the code to handle TLB miss on this CPU
+         Linux 2.6.22 idem.
 
 PowerPC 7445/7447:
-INSN  KO Altivec missing + TLB load insns missing
+INSN  KO Altivec missing
 SPR   OK
 MSR   OK
 IRQ   OK
-MMU   KO not implemented
+MMU   OK
 EXCP  ?  Altivec, ...
+Remarks: Linux does not have the code to handle TLB miss on this CPU
+         Linux 2.6.22 idem.
 
 PowerPC 7455/7457:
-INSN  KO Altivec missing + TLB load insns missing
+INSN  KO Altivec missing
 SPR   OK
 MSR   OK
 IRQ   OK
-MMU   KO not implemented
+MMU   OK
 EXCP  ?  Altivec, ...
+Remarks: Linux does not have the code to handle TLB miss on this CPU
+         Linux 2.6.22 idem.
 
 64 bits PowerPC
 PowerPC 620: (disabled)
@@ -339,22 +357,44 @@ MSR   ?
 IRQ   KO
 MMU   KO
 EXCP  KO
+Remarks: not much documentation for this implementation...
 
-PowerPC 970: (disabled)
+PowerPC 970:
 INSN  KO Altivec missing and more
 SPR   KO
 MSR   ?
 IRQ   OK
-MMU   KO partially implemented
-EXCP  KO
+MMU   OK
+EXCP  KO partially implemented
+Remarks: Should be able to boot but there is no hw platform currently emulated.
 
-PowerPC 970FX: (disabled)
+PowerPC 970FX:
 INSN  KO Altivec missing and more
 SPR   KO
 MSR   ?
 IRQ   OK
-MMU   KO partially implemented
-EXCP  KO
+MMU   OK
+EXCP  KO partially implemented
+Remarks: Should be able to boot but there is no hw platform currently emulated.
+
+PowerPC 970GX:
+INSN  KO Altivec missing and more
+SPR   KO
+MSR   ?
+IRQ   OK
+MMU   OK
+EXCP  KO partially implemented
+Remarks: Should be able to boot but there is no hw platform currently emulated.
+
+PowerPC Cell:
+INSN  KO Altivec missing and more
+SPR   KO
+MSR   ?
+IRQ   ?
+MMU   ?
+EXCP  ? partially implemented
+Remarks: As the core is mostly a 970, should be able to boot.
+         SPE are not implemented.
 
 PowerPC 630: (disabled: lack of detailed specifications)
 INSN  KO
@@ -465,12 +505,20 @@ EXCP  KO
 PowerPC microcontrollers emulation status
 
 Implemementation should be sufficient to boot Linux:
+(there seem to be problems with uboot freezing at some point)
 - PowerPC 405CR
 - PowerPC 405EP
 
 TODO:
-- More PowerPC 40x microcontrollers emulation
-- PowerQUICC microcontrollers emulation
+- PowerPC 401 microcontrollers emulation
+- PowerPC 403 microcontrollers emulation
+- more PowerPC 405 microcontrollers emulation
+- Fixes / more features for implemented PowerPC 405 microcontrollers emulation
+- PowerPC 440 microcontrollers emulation
+- e200 microcontrollers emulation
+- e300 microcontrollers emulation
+- e500 microcontrollers emulation
+- e600 microcontrollers emulation
 
 ===============================================================================
 PowerPC based platforms emulation status
@@ -500,6 +548,8 @@ PowerPC based platforms emulation status
   Need to provide a flash image ready to boot for reproductible tests.
 
 TODO:
+- URGENT: fix PreP and heathrow platforms
+- PowerPC 64 reference platform
 - MCA based RS/6000 emulation
 - CHRP emulation (not PowerMac)
 - PPAR emulation
@@ -507,4 +557,3 @@ TODO:
 - misc PowerPC reference boards emulation
 
 ===============================================================================
-(to be completed)
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index c4ae41441..88129758e 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -23,50 +23,52 @@
 #include "config.h"
 #include <inttypes.h>
 
+//#define PPC_EMULATE_32BITS_HYPV
+
 #if defined (TARGET_PPC64)
+/* PowerPC 64 definitions */
 typedef uint64_t ppc_gpr_t;
-#define TARGET_GPR_BITS  64
 #define TARGET_LONG_BITS 64
-#define REGX "%016" PRIx64
 #define TARGET_PAGE_BITS 12
-#elif defined(TARGET_PPCEMB)
-/* BookE have 36 bits physical address space */
-#define TARGET_PHYS_ADDR_BITS 64
-/* GPR are 64 bits: used by vector extension */
+
+#else /* defined (TARGET_PPC64) */
+/* PowerPC 32 definitions */
+#if (HOST_LONG_BITS >= 64)
+/* When using 64 bits temporary registers,
+ * we can use 64 bits GPR with no extra cost
+ * It's even an optimization as this will prevent
+ * the compiler to do unuseful masking in the micro-ops.
+ */
 typedef uint64_t ppc_gpr_t;
-#define TARGET_GPR_BITS  64
+#else /* (HOST_LONG_BITS >= 64) */
+typedef uint32_t ppc_gpr_t;
+#endif /* (HOST_LONG_BITS >= 64) */
+
 #define TARGET_LONG_BITS 32
-#define REGX "%016" PRIx64
+
+#if defined(TARGET_PPCEMB)
+/* Specific definitions for PowerPC embedded */
+/* BookE have 36 bits physical address space */
+#define TARGET_PHYS_ADDR_BITS 64
 #if defined(CONFIG_USER_ONLY)
 /* It looks like a lot of Linux programs assume page size
  * is 4kB long. This is evil, but we have to deal with it...
  */
 #define TARGET_PAGE_BITS 12
-#else
+#else /* defined(CONFIG_USER_ONLY) */
 /* Pages can be 1 kB small */
 #define TARGET_PAGE_BITS 10
-#endif
-#else
-#if (HOST_LONG_BITS >= 64)
-/* When using 64 bits temporary registers,
- * we can use 64 bits GPR with no extra cost
- * It's even an optimization as it will prevent
- * the compiler to do unuseful masking in the micro-ops.
- */
-typedef uint64_t ppc_gpr_t;
-#define TARGET_GPR_BITS  64
-#define REGX "%08" PRIx64
-#else
-typedef uint32_t ppc_gpr_t;
-#define TARGET_GPR_BITS  32
-#define REGX "%08" PRIx32
-#endif
-#define TARGET_LONG_BITS 32
+#endif /* defined(CONFIG_USER_ONLY) */
+#else /* defined(TARGET_PPCEMB) */
+/* "standard" PowerPC 32 definitions */
 #define TARGET_PAGE_BITS 12
-#endif
+#endif /* defined(TARGET_PPCEMB) */
+
+#endif /* defined (TARGET_PPC64) */
 
 #include "cpu-defs.h"
 
+#define REGX "%016" PRIx64
 #define ADDRX TARGET_FMT_lx
 #define PADDRX TARGET_FMT_plx
 
@@ -82,43 +84,44 @@ typedef uint32_t ppc_gpr_t;
 #define ELF_MACHINE     EM_PPC
 #endif
 
-/* XXX: this should be tunable: PowerPC 601 & 64 bits PowerPC
- *                              have different cache line sizes
- */
-#define ICACHE_LINE_SIZE 32
-#define DCACHE_LINE_SIZE 32
-
 /*****************************************************************************/
 /* MMU model                                                                 */
-enum {
-    POWERPC_MMU_UNKNOWN    = 0,
+typedef enum powerpc_mmu_t powerpc_mmu_t;
+enum powerpc_mmu_t {
+    POWERPC_MMU_UNKNOWN    = 0x00000000,
     /* Standard 32 bits PowerPC MMU                            */
-    POWERPC_MMU_32B,
-    /* Standard 64 bits PowerPC MMU                            */
-    POWERPC_MMU_64B,
-    /* PowerPC 601 MMU                                         */
-    POWERPC_MMU_601,
+    POWERPC_MMU_32B        = 0x00000001,
     /* PowerPC 6xx MMU with software TLB                       */
-    POWERPC_MMU_SOFT_6xx,
+    POWERPC_MMU_SOFT_6xx   = 0x00000002,
     /* PowerPC 74xx MMU with software TLB                      */
-    POWERPC_MMU_SOFT_74xx,
+    POWERPC_MMU_SOFT_74xx  = 0x00000003,
     /* PowerPC 4xx MMU with software TLB                       */
-    POWERPC_MMU_SOFT_4xx,
+    POWERPC_MMU_SOFT_4xx   = 0x00000004,
     /* PowerPC 4xx MMU with software TLB and zones protections */
-    POWERPC_MMU_SOFT_4xx_Z,
-    /* PowerPC 4xx MMU in real mode only                       */
-    POWERPC_MMU_REAL_4xx,
+    POWERPC_MMU_SOFT_4xx_Z = 0x00000005,
+    /* PowerPC MMU in real mode only                           */
+    POWERPC_MMU_REAL       = 0x00000006,
+    /* Freescale MPC8xx MMU model                              */
+    POWERPC_MMU_MPC8xx     = 0x00000007,
     /* BookE MMU model                                         */
-    POWERPC_MMU_BOOKE,
+    POWERPC_MMU_BOOKE      = 0x00000008,
     /* BookE FSL MMU model                                     */
-    POWERPC_MMU_BOOKE_FSL,
-    /* 64 bits "bridge" PowerPC MMU                            */
-    POWERPC_MMU_64BRIDGE,
+    POWERPC_MMU_BOOKE_FSL  = 0x00000009,
+    /* PowerPC 601 MMU model (specific BATs format)            */
+    POWERPC_MMU_601        = 0x0000000A,
+#if defined(TARGET_PPC64)
+#define POWERPC_MMU_64       0x00010000
+    /* 64 bits PowerPC MMU                                     */
+    POWERPC_MMU_64B        = POWERPC_MMU_64 | 0x00000001,
+    /* 620 variant (no segment exceptions)                     */
+    POWERPC_MMU_620        = POWERPC_MMU_64 | 0x00000002,
+#endif /* defined(TARGET_PPC64) */
 };
 
 /*****************************************************************************/
 /* Exception model                                                           */
-enum {
+typedef enum powerpc_excp_t powerpc_excp_t;
+enum powerpc_excp_t {
     POWERPC_EXCP_UNKNOWN   = 0,
     /* Standard PowerPC exception model */
     POWERPC_EXCP_STD,
@@ -142,10 +145,12 @@ enum {
     POWERPC_EXCP_7x5,
     /* PowerPC 74xx exception model     */
     POWERPC_EXCP_74xx,
-    /* PowerPC 970 exception model      */
-    POWERPC_EXCP_970,
     /* BookE exception model            */
     POWERPC_EXCP_BOOKE,
+#if defined(TARGET_PPC64)
+    /* PowerPC 970 exception model      */
+    POWERPC_EXCP_970,
+#endif /* defined(TARGET_PPC64) */
 };
 
 /*****************************************************************************/
@@ -166,35 +171,27 @@ enum {
     POWERPC_EXCP_DECR     = 10, /* Decrementer exception                     */
     POWERPC_EXCP_FIT      = 11, /* Fixed-interval timer interrupt            */
     POWERPC_EXCP_WDT      = 12, /* Watchdog timer interrupt                  */
-    POWERPC_EXCP_DTLB     = 13, /* Data TLB error                            */
-    POWERPC_EXCP_ITLB     = 14, /* Instruction TLB error                     */
+    POWERPC_EXCP_DTLB     = 13, /* Data TLB miss                             */
+    POWERPC_EXCP_ITLB     = 14, /* Instruction TLB miss                      */
     POWERPC_EXCP_DEBUG    = 15, /* Debug interrupt                           */
     /* Vectors 16 to 31 are reserved                                         */
-#if defined(TARGET_PPCEMB)
     POWERPC_EXCP_SPEU     = 32, /* SPE/embedded floating-point unavailable   */
     POWERPC_EXCP_EFPDI    = 33, /* Embedded floating-point data interrupt    */
     POWERPC_EXCP_EFPRI    = 34, /* Embedded floating-point round interrupt   */
     POWERPC_EXCP_EPERFM   = 35, /* Embedded performance monitor interrupt    */
     POWERPC_EXCP_DOORI    = 36, /* Embedded doorbell interrupt               */
     POWERPC_EXCP_DOORCI   = 37, /* Embedded doorbell critical interrupt      */
-#endif /* defined(TARGET_PPCEMB) */
     /* Vectors 38 to 63 are reserved                                         */
     /* Exceptions defined in the PowerPC server specification                */
     POWERPC_EXCP_RESET    = 64, /* System reset exception                    */
-#if defined(TARGET_PPC64) /* PowerPC 64 */
     POWERPC_EXCP_DSEG     = 65, /* Data segment exception                    */
     POWERPC_EXCP_ISEG     = 66, /* Instruction segment exception             */
-#endif /* defined(TARGET_PPC64) */
-#if defined(TARGET_PPC64H) /* PowerPC 64 with hypervisor mode support */
     POWERPC_EXCP_HDECR    = 67, /* Hypervisor decrementer exception          */
-#endif /* defined(TARGET_PPC64H) */
     POWERPC_EXCP_TRACE    = 68, /* Trace exception                           */
-#if defined(TARGET_PPC64H) /* PowerPC 64 with hypervisor mode support */
     POWERPC_EXCP_HDSI     = 69, /* Hypervisor data storage exception         */
     POWERPC_EXCP_HISI     = 70, /* Hypervisor instruction storage exception  */
     POWERPC_EXCP_HDSEG    = 71, /* Hypervisor data segment exception         */
     POWERPC_EXCP_HISEG    = 72, /* Hypervisor instruction segment exception  */
-#endif /* defined(TARGET_PPC64H) */
     POWERPC_EXCP_VPU      = 73, /* Vector unavailable exception              */
     /* 40x specific exceptions                                               */
     POWERPC_EXCP_PIT      = 74, /* Programmable interval timer interrupt     */
@@ -204,21 +201,27 @@ enum {
     /* 602 specific exceptions                                               */
     POWERPC_EXCP_EMUL     = 77, /* Emulation trap exception                  */
     /* 602/603 specific exceptions                                           */
-    POWERPC_EXCP_IFTLB    = 78, /* Instruction fetch TLB error               */
+    POWERPC_EXCP_IFTLB    = 78, /* Instruction fetch TLB miss                */
     POWERPC_EXCP_DLTLB    = 79, /* Data load TLB miss                        */
     POWERPC_EXCP_DSTLB    = 80, /* Data store TLB miss                       */
     /* Exceptions available on most PowerPC                                  */
     POWERPC_EXCP_FPA      = 81, /* Floating-point assist exception           */
-    POWERPC_EXCP_IABR     = 82, /* Instruction address breakpoint            */
-    POWERPC_EXCP_SMI      = 83, /* System management interrupt               */
-    POWERPC_EXCP_PERFM    = 84, /* Embedded performance monitor interrupt    */
+    POWERPC_EXCP_DABR     = 82, /* Data address breakpoint                   */
+    POWERPC_EXCP_IABR     = 83, /* Instruction address breakpoint            */
+    POWERPC_EXCP_SMI      = 84, /* System management interrupt               */
+    POWERPC_EXCP_PERFM    = 85, /* Embedded performance monitor interrupt    */
     /* 7xx/74xx specific exceptions                                          */
-    POWERPC_EXCP_THERM    = 85, /* Thermal interrupt                         */
+    POWERPC_EXCP_THERM    = 86, /* Thermal interrupt                         */
     /* 74xx specific exceptions                                              */
-    POWERPC_EXCP_VPUA     = 86, /* Vector assist exception                   */
+    POWERPC_EXCP_VPUA     = 87, /* Vector assist exception                   */
     /* 970FX specific exceptions                                             */
-    POWERPC_EXCP_SOFTP    = 87, /* Soft patch exception                      */
-    POWERPC_EXCP_MAINT    = 88, /* Maintenance exception                     */
+    POWERPC_EXCP_SOFTP    = 88, /* Soft patch exception                      */
+    POWERPC_EXCP_MAINT    = 89, /* Maintenance exception                     */
+    /* Freescale embeded cores specific exceptions                           */
+    POWERPC_EXCP_MEXTBR   = 90, /* Maskable external breakpoint              */
+    POWERPC_EXCP_NMEXTBR  = 91, /* Non maskable external breakpoint          */
+    POWERPC_EXCP_ITLBE    = 92, /* Instruction TLB error                     */
+    POWERPC_EXCP_DTLBE    = 93, /* Data TLB error                            */
     /* EOL                                                                   */
     POWERPC_EXCP_NB       = 96,
     /* Qemu exceptions: used internally during code translation              */
@@ -229,7 +232,6 @@ enum {
     POWERPC_EXCP_SYSCALL_USER = 0x203, /* System call in user mode only      */
 };
 
-
 /* Exceptions error codes                                                    */
 enum {
     /* Exception subtypes for POWERPC_EXCP_ALIGN                             */
@@ -246,7 +248,7 @@ enum {
     POWERPC_EXCP_FP_UX         = 0x02,  /* FP underflow                      */
     POWERPC_EXCP_FP_ZX         = 0x03,  /* FP divide by zero                 */
     POWERPC_EXCP_FP_XX         = 0x04,  /* FP inexact                        */
-    POWERPC_EXCP_FP_VXNAN      = 0x05,  /* FP invalid SNaN op                */
+    POWERPC_EXCP_FP_VXSNAN     = 0x05,  /* FP invalid SNaN op                */
     POWERPC_EXCP_FP_VXISI      = 0x06,  /* FP invalid infinite subtraction   */
     POWERPC_EXCP_FP_VXIDI      = 0x07,  /* FP invalid infinite divide        */
     POWERPC_EXCP_FP_VXZDZ      = 0x08,  /* FP invalid zero divide            */
@@ -271,7 +273,8 @@ enum {
 
 /*****************************************************************************/
 /* Input pins model                                                          */
-enum {
+typedef enum powerpc_input_t powerpc_input_t;
+enum powerpc_input_t {
     PPC_FLAGS_INPUT_UNKNOWN = 0,
     /* PowerPC 6xx bus                  */
     PPC_FLAGS_INPUT_6xx,
@@ -283,6 +286,8 @@ enum {
     PPC_FLAGS_INPUT_970,
     /* PowerPC 401 bus                  */
     PPC_FLAGS_INPUT_401,
+    /* Freescale RCPU bus               */
+    PPC_FLAGS_INPUT_RCPU,
 };
 
 #define PPC_INPUT(env) (env->bus_model)
@@ -297,7 +302,7 @@ typedef struct CPUPPCState CPUPPCState;
 typedef struct ppc_tb_t ppc_tb_t;
 typedef struct ppc_spr_t ppc_spr_t;
 typedef struct ppc_dcr_t ppc_dcr_t;
-typedef struct ppc_avr_t ppc_avr_t;
+typedef union ppc_avr_t ppc_avr_t;
 typedef union ppc_tlb_t ppc_tlb_t;
 
 /* SPR access micro-ops generations callbacks */
@@ -307,17 +312,18 @@ struct ppc_spr_t {
 #if !defined(CONFIG_USER_ONLY)
     void (*oea_read)(void *opaque, int spr_num);
     void (*oea_write)(void *opaque, int spr_num);
-#if defined(TARGET_PPC64H)
     void (*hea_read)(void *opaque, int spr_num);
     void (*hea_write)(void *opaque, int spr_num);
 #endif
-#endif
     const unsigned char *name;
 };
 
 /* Altivec registers (128 bits) */
-struct ppc_avr_t {
-    uint32_t u[4];
+union ppc_avr_t {
+    uint8_t u8[16];
+    uint16_t u16[8];
+    uint32_t u32[4];
+    uint64_t u64[2];
 };
 
 /* Software TLB cache */
@@ -346,102 +352,209 @@ union ppc_tlb_t {
 /*****************************************************************************/
 /* Machine state register bits definition                                    */
 #define MSR_SF   63 /* Sixty-four-bit mode                            hflags */
+#define MSR_TAG  62 /* Tag-active mode (POWERx ?)                            */
 #define MSR_ISF  61 /* Sixty-four-bit interrupt mode on 630                  */
-#define MSR_HV   60 /* hypervisor state                               hflags */
+#define MSR_SHV  60 /* hypervisor state                               hflags */
 #define MSR_CM   31 /* Computation mode for BookE                     hflags */
 #define MSR_ICM  30 /* Interrupt computation mode for BookE                  */
+#define MSR_THV  29 /* hypervisor state for 32 bits PowerPC           hflags */
 #define MSR_UCLE 26 /* User-mode cache lock enable for BookE                 */
-#define MSR_VR   25 /* altivec available                              hflags */
-#define MSR_SPE  25 /* SPE enable for BookE                           hflags */
+#define MSR_VR   25 /* altivec available                            x hflags */
+#define MSR_SPE  25 /* SPE enable for BookE                         x hflags */
 #define MSR_AP   23 /* Access privilege state on 602                  hflags */
 #define MSR_SA   22 /* Supervisor access mode on 602                  hflags */
 #define MSR_KEY  19 /* key bit on 603e                                       */
 #define MSR_POW  18 /* Power management                                      */
-#define MSR_WE   18 /* Wait state enable on embedded PowerPC                 */
-#define MSR_TGPR 17 /* TGPR usage on 602/603                                 */
-#define MSR_TLB  17 /* TLB update on ?                                       */
-#define MSR_CE   17 /* Critical interrupt enable on embedded PowerPC         */
+#define MSR_TGPR 17 /* TGPR usage on 602/603                        x        */
+#define MSR_CE   17 /* Critical interrupt enable on embedded PowerPC x       */
 #define MSR_ILE  16 /* Interrupt little-endian mode                          */
 #define MSR_EE   15 /* External interrupt enable                             */
 #define MSR_PR   14 /* Problem state                                  hflags */
 #define MSR_FP   13 /* Floating point available                       hflags */
 #define MSR_ME   12 /* Machine check interrupt enable                        */
 #define MSR_FE0  11 /* Floating point exception mode 0                hflags */
-#define MSR_SE   10 /* Single-step trace enable                       hflags */
-#define MSR_DWE  10 /* Debug wait enable on 405                              */
-#define MSR_UBLE 10 /* User BTB lock enable on e500                          */
-#define MSR_BE   9  /* Branch trace enable                            hflags */
-#define MSR_DE   9  /* Debug interrupts enable on embedded PowerPC           */
+#define MSR_SE   10 /* Single-step trace enable                     x hflags */
+#define MSR_DWE  10 /* Debug wait enable on 405                     x        */
+#define MSR_UBLE 10 /* User BTB lock enable on e500                 x        */
+#define MSR_BE   9  /* Branch trace enable                          x hflags */
+#define MSR_DE   9  /* Debug interrupts enable on embedded PowerPC  x        */
 #define MSR_FE1  8  /* Floating point exception mode 1                hflags */
 #define MSR_AL   7  /* AL bit on POWER                                       */
-#define MSR_IP   6  /* Interrupt prefix                                      */
+#define MSR_EP   6  /* Exception prefix on 601                               */
 #define MSR_IR   5  /* Instruction relocate                                  */
-#define MSR_IS   5  /* Instruction address space on embedded PowerPC         */
 #define MSR_DR   4  /* Data relocate                                         */
-#define MSR_DS   4  /* Data address space on embedded PowerPC                */
 #define MSR_PE   3  /* Protection enable on 403                              */
-#define MSR_EP   3  /* Exception prefix on 601                               */
-#define MSR_PX   2  /* Protection exclusive on 403                           */
-#define MSR_PMM  2  /* Performance monitor mark on POWER                     */
-#define MSR_RI   1  /* Recoverable interrupt                                 */
-#define MSR_LE   0  /* Little-endian mode                             hflags */
-#define msr_sf   env->msr[MSR_SF]
-#define msr_isf  env->msr[MSR_ISF]
-#define msr_hv   env->msr[MSR_HV]
-#define msr_cm   env->msr[MSR_CM]
-#define msr_icm  env->msr[MSR_ICM]
-#define msr_ucle env->msr[MSR_UCLE]
-#define msr_vr   env->msr[MSR_VR]
-#define msr_spe  env->msr[MSR_SPE]
-#define msr_ap   env->msr[MSR_AP]
-#define msr_sa   env->msr[MSR_SA]
-#define msr_key  env->msr[MSR_KEY]
-#define msr_pow  env->msr[MSR_POW]
-#define msr_we   env->msr[MSR_WE]
-#define msr_tgpr env->msr[MSR_TGPR]
-#define msr_tlb  env->msr[MSR_TLB]
-#define msr_ce   env->msr[MSR_CE]
-#define msr_ile  env->msr[MSR_ILE]
-#define msr_ee   env->msr[MSR_EE]
-#define msr_pr   env->msr[MSR_PR]
-#define msr_fp   env->msr[MSR_FP]
-#define msr_me   env->msr[MSR_ME]
-#define msr_fe0  env->msr[MSR_FE0]
-#define msr_se   env->msr[MSR_SE]
-#define msr_dwe  env->msr[MSR_DWE]
-#define msr_uble env->msr[MSR_UBLE]
-#define msr_be   env->msr[MSR_BE]
-#define msr_de   env->msr[MSR_DE]
-#define msr_fe1  env->msr[MSR_FE1]
-#define msr_al   env->msr[MSR_AL]
-#define msr_ip   env->msr[MSR_IP]
-#define msr_ir   env->msr[MSR_IR]
-#define msr_is   env->msr[MSR_IS]
-#define msr_dr   env->msr[MSR_DR]
-#define msr_ds   env->msr[MSR_DS]
-#define msr_pe   env->msr[MSR_PE]
-#define msr_ep   env->msr[MSR_EP]
-#define msr_px   env->msr[MSR_PX]
-#define msr_pmm  env->msr[MSR_PMM]
-#define msr_ri   env->msr[MSR_RI]
-#define msr_le   env->msr[MSR_LE]
+#define MSR_PX   2  /* Protection exclusive on 403                  x        */
+#define MSR_PMM  2  /* Performance monitor mark on POWER            x        */
+#define MSR_RI   1  /* Recoverable interrupt                        1        */
+#define MSR_LE   0  /* Little-endian mode                           1 hflags */
+
+#define msr_sf   ((env->msr >> MSR_SF)   & 1)
+#define msr_isf  ((env->msr >> MSR_ISF)  & 1)
+#define msr_shv  ((env->msr >> MSR_SHV)  & 1)
+#define msr_cm   ((env->msr >> MSR_CM)   & 1)
+#define msr_icm  ((env->msr >> MSR_ICM)  & 1)
+#define msr_thv  ((env->msr >> MSR_THV)  & 1)
+#define msr_ucle ((env->msr >> MSR_UCLE) & 1)
+#define msr_vr   ((env->msr >> MSR_VR)   & 1)
+#define msr_spe  ((env->msr >> MSR_SE)   & 1)
+#define msr_ap   ((env->msr >> MSR_AP)   & 1)
+#define msr_sa   ((env->msr >> MSR_SA)   & 1)
+#define msr_key  ((env->msr >> MSR_KEY)  & 1)
+#define msr_pow  ((env->msr >> MSR_POW)  & 1)
+#define msr_tgpr ((env->msr >> MSR_TGPR) & 1)
+#define msr_ce   ((env->msr >> MSR_CE)   & 1)
+#define msr_ile  ((env->msr >> MSR_ILE)  & 1)
+#define msr_ee   ((env->msr >> MSR_EE)   & 1)
+#define msr_pr   ((env->msr >> MSR_PR)   & 1)
+#define msr_fp   ((env->msr >> MSR_FP)   & 1)
+#define msr_me   ((env->msr >> MSR_ME)   & 1)
+#define msr_fe0  ((env->msr >> MSR_FE0)  & 1)
+#define msr_se   ((env->msr >> MSR_SE)   & 1)
+#define msr_dwe  ((env->msr >> MSR_DWE)  & 1)
+#define msr_uble ((env->msr >> MSR_UBLE) & 1)
+#define msr_be   ((env->msr >> MSR_BE)   & 1)
+#define msr_de   ((env->msr >> MSR_DE)   & 1)
+#define msr_fe1  ((env->msr >> MSR_FE1)  & 1)
+#define msr_al   ((env->msr >> MSR_AL)   & 1)
+#define msr_ep   ((env->msr >> MSR_EP)   & 1)
+#define msr_ir   ((env->msr >> MSR_IR)   & 1)
+#define msr_dr   ((env->msr >> MSR_DR)   & 1)
+#define msr_pe   ((env->msr >> MSR_PE)   & 1)
+#define msr_px   ((env->msr >> MSR_PX)   & 1)
+#define msr_pmm  ((env->msr >> MSR_PMM)  & 1)
+#define msr_ri   ((env->msr >> MSR_RI)   & 1)
+#define msr_le   ((env->msr >> MSR_LE)   & 1)
+/* Hypervisor bit is more specific */
+#if defined(TARGET_PPC64)
+#define MSR_HVB (1ULL << MSR_SHV)
+#define msr_hv  msr_shv
+#else
+#if defined(PPC_EMULATE_32BITS_HYPV)
+#define MSR_HVB (1ULL << MSR_THV)
+#define msr_hv  msr_thv
+#else
+#define MSR_HVB (0ULL)
+#define msr_hv  (0)
+#endif
+#endif
+
+enum {
+    POWERPC_FLAG_NONE     = 0x00000000,
+    /* Flag for MSR bit 25 signification (VRE/SPE)                           */
+    POWERPC_FLAG_SPE      = 0x00000001,
+    POWERPC_FLAG_VRE      = 0x00000002,
+    /* Flag for MSR bit 17 signification (TGPR/CE)                           */
+    POWERPC_FLAG_TGPR     = 0x00000004,
+    POWERPC_FLAG_CE       = 0x00000008,
+    /* Flag for MSR bit 10 signification (SE/DWE/UBLE)                       */
+    POWERPC_FLAG_SE       = 0x00000010,
+    POWERPC_FLAG_DWE      = 0x00000020,
+    POWERPC_FLAG_UBLE     = 0x00000040,
+    /* Flag for MSR bit 9 signification (BE/DE)                              */
+    POWERPC_FLAG_BE       = 0x00000080,
+    POWERPC_FLAG_DE       = 0x00000100,
+    /* Flag for MSR bit 2 signification (PX/PMM)                             */
+    POWERPC_FLAG_PX       = 0x00000200,
+    POWERPC_FLAG_PMM      = 0x00000400,
+    /* Flag for special features                                             */
+    /* Decrementer clock: RTC clock (POWER, 601) or bus clock                */
+    POWERPC_FLAG_RTC_CLK  = 0x00010000,
+    POWERPC_FLAG_BUS_CLK  = 0x00020000,
+};
+
+/*****************************************************************************/
+/* Floating point status and control register                                */
+#define FPSCR_FX     31 /* Floating-point exception summary                  */
+#define FPSCR_FEX    30 /* Floating-point enabled exception summary          */
+#define FPSCR_VX     29 /* Floating-point invalid operation exception summ.  */
+#define FPSCR_OX     28 /* Floating-point overflow exception                 */
+#define FPSCR_UX     27 /* Floating-point underflow exception                */
+#define FPSCR_ZX     26 /* Floating-point zero divide exception              */
+#define FPSCR_XX     25 /* Floating-point inexact exception                  */
+#define FPSCR_VXSNAN 24 /* Floating-point invalid operation exception (sNan) */
+#define FPSCR_VXISI  23 /* Floating-point invalid operation exception (inf)  */
+#define FPSCR_VXIDI  22 /* Floating-point invalid operation exception (inf)  */
+#define FPSCR_VXZDZ  21 /* Floating-point invalid operation exception (zero) */
+#define FPSCR_VXIMZ  20 /* Floating-point invalid operation exception (inf)  */
+#define FPSCR_VXVC   19 /* Floating-point invalid operation exception (comp) */
+#define FPSCR_FR     18 /* Floating-point fraction rounded                   */
+#define FPSCR_FI     17 /* Floating-point fraction inexact                   */
+#define FPSCR_C      16 /* Floating-point result class descriptor            */
+#define FPSCR_FL     15 /* Floating-point less than or negative              */
+#define FPSCR_FG     14 /* Floating-point greater than or negative           */
+#define FPSCR_FE     13 /* Floating-point equal or zero                      */
+#define FPSCR_FU     12 /* Floating-point unordered or NaN                   */
+#define FPSCR_FPCC   12 /* Floating-point condition code                     */
+#define FPSCR_FPRF   12 /* Floating-point result flags                       */
+#define FPSCR_VXSOFT 10 /* Floating-point invalid operation exception (soft) */
+#define FPSCR_VXSQRT 9  /* Floating-point invalid operation exception (sqrt) */
+#define FPSCR_VXCVI  8  /* Floating-point invalid operation exception (int)  */
+#define FPSCR_VE     7  /* Floating-point invalid operation exception enable */
+#define FPSCR_OE     6  /* Floating-point overflow exception enable          */
+#define FPSCR_UE     5  /* Floating-point undeflow exception enable          */
+#define FPSCR_ZE     4  /* Floating-point zero divide exception enable       */
+#define FPSCR_XE     3  /* Floating-point inexact exception enable           */
+#define FPSCR_NI     2  /* Floating-point non-IEEE mode                      */
+#define FPSCR_RN1    1
+#define FPSCR_RN     0  /* Floating-point rounding control                   */
+#define fpscr_fex    (((env->fpscr) >> FPSCR_FEX)    & 0x1)
+#define fpscr_vx     (((env->fpscr) >> FPSCR_VX)     & 0x1)
+#define fpscr_ox     (((env->fpscr) >> FPSCR_OX)     & 0x1)
+#define fpscr_ux     (((env->fpscr) >> FPSCR_UX)     & 0x1)
+#define fpscr_zx     (((env->fpscr) >> FPSCR_ZX)     & 0x1)
+#define fpscr_xx     (((env->fpscr) >> FPSCR_XX)     & 0x1)
+#define fpscr_vxsnan (((env->fpscr) >> FPSCR_VXSNAN) & 0x1)
+#define fpscr_vxisi  (((env->fpscr) >> FPSCR_VXISI)  & 0x1)
+#define fpscr_vxidi  (((env->fpscr) >> FPSCR_VXIDI)  & 0x1)
+#define fpscr_vxzdz  (((env->fpscr) >> FPSCR_VXZDZ)  & 0x1)
+#define fpscr_vximz  (((env->fpscr) >> FPSCR_VXIMZ)  & 0x1)
+#define fpscr_vxvc   (((env->fpscr) >> FPSCR_VXVC)   & 0x1)
+#define fpscr_fpcc   (((env->fpscr) >> FPSCR_FPCC)   & 0xF)
+#define fpscr_vxsoft (((env->fpscr) >> FPSCR_VXSOFT) & 0x1)
+#define fpscr_vxsqrt (((env->fpscr) >> FPSCR_VXSQRT) & 0x1)
+#define fpscr_vxcvi  (((env->fpscr) >> FPSCR_VXCVI)  & 0x1)
+#define fpscr_ve     (((env->fpscr) >> FPSCR_VE)     & 0x1)
+#define fpscr_oe     (((env->fpscr) >> FPSCR_OE)     & 0x1)
+#define fpscr_ue     (((env->fpscr) >> FPSCR_UE)     & 0x1)
+#define fpscr_ze     (((env->fpscr) >> FPSCR_ZE)     & 0x1)
+#define fpscr_xe     (((env->fpscr) >> FPSCR_XE)     & 0x1)
+#define fpscr_ni     (((env->fpscr) >> FPSCR_NI)     & 0x1)
+#define fpscr_rn     (((env->fpscr) >> FPSCR_RN)     & 0x3)
+/* Invalid operation exception summary */
+#define fpscr_ix ((env->fpscr) & ((1 << FPSCR_VXSNAN) | (1 << FPSCR_VXISI)  | \
+                                  (1 << FPSCR_VXIDI)  | (1 << FPSCR_VXZDZ)  | \
+                                  (1 << FPSCR_VXIMZ)  | (1 << FPSCR_VXVC)   | \
+                                  (1 << FPSCR_VXSOFT) | (1 << FPSCR_VXSQRT) | \
+                                  (1 << FPSCR_VXCVI)))
+/* exception summary */
+#define fpscr_ex  (((env->fpscr) >> FPSCR_XX) & 0x1F)
+/* enabled exception summary */
+#define fpscr_eex (((env->fpscr) >> FPSCR_XX) & ((env->fpscr) >> FPSCR_XE) &  \
+                   0x1F)
 
 /*****************************************************************************/
 /* The whole PowerPC CPU context */
+#define NB_MMU_MODES 3
+
 struct CPUPPCState {
     /* First are the most commonly used resources
      * during translated code execution
      */
-#if TARGET_GPR_BITS > HOST_LONG_BITS
+#if (HOST_LONG_BITS == 32)
     /* temporary fixed-point registers
-     * used to emulate 64 bits target on 32 bits hosts
+     * used to emulate 64 bits registers on 32 bits hosts
      */
-    ppc_gpr_t t0, t1, t2;
+    uint64_t t0, t1, t2;
 #endif
-    ppc_avr_t t0_avr, t1_avr, t2_avr;
+    ppc_avr_t avr0, avr1, avr2;
 
     /* general purpose registers */
     ppc_gpr_t gpr[32];
+#if !defined(TARGET_PPC64)
+    /* Storage for GPR MSB, used by the SPE extension */
+    ppc_gpr_t gprh[32];
+#endif
     /* LR */
     target_ulong lr;
     /* CTR */
@@ -456,7 +569,7 @@ struct CPUPPCState {
 
     /* Those ones are used in supervisor mode only */
     /* machine state register */
-    uint8_t msr[64];
+    target_ulong msr;
     /* temporary general purpose registers */
     ppc_gpr_t tgpr[4]; /* Used to speed-up TLB assist handlers */
 
@@ -469,7 +582,7 @@ struct CPUPPCState {
     /* floating point registers */
     float64 fpr[32];
     /* floating point status and control register */
-    uint8_t fpscr[8];
+    uint32_t fpscr;
 
     CPU_COMMON
 
@@ -478,9 +591,14 @@ struct CPUPPCState {
     int access_type; /* when a memory exception occurs, the access
                         type is stored here */
 
-    /* MMU context */
+    /* MMU context - only relevant for full system emulation */
+#if !defined(CONFIG_USER_ONLY)
+#if defined(TARGET_PPC64)
     /* Address space register */
     target_ulong asr;
+    /* PowerPC 64 SLB area */
+    int slb_nr;
+#endif
     /* segment registers */
     target_ulong sdr1;
     target_ulong sr[16];
@@ -488,10 +606,22 @@ struct CPUPPCState {
     int nb_BATs;
     target_ulong DBAT[2][8];
     target_ulong IBAT[2][8];
+    /* PowerPC TLB registers (for 4xx and 60x software driven TLBs) */
+    int nb_tlb;      /* Total number of TLB                                  */
+    int tlb_per_way; /* Speed-up helper: used to avoid divisions at run time */
+    int nb_ways;     /* Number of ways in the TLB set                        */
+    int last_way;    /* Last used way used to allocate TLB in a LRU way      */
+    int id_tlbs;     /* If 1, MMU has separated TLBs for instructions & data */
+    int nb_pids;     /* Number of available PID registers                    */
+    ppc_tlb_t *tlb;  /* TLB is optional. Allocate them only if needed        */
+    /* 403 dedicated access protection registers */
+    target_ulong pb[4];
+#endif
 
     /* Other registers */
     /* Special purpose registers */
     target_ulong spr[1024];
+    ppc_spr_t spr_cb[1024];
     /* Altivec registers */
     ppc_avr_t avr[32];
     uint32_t vscr;
@@ -506,24 +636,15 @@ struct CPUPPCState {
     /* Device control registers */
     ppc_dcr_t *dcr_env;
 
-    /* PowerPC TLB registers (for 4xx and 60x software driven TLBs) */
-    int nb_tlb;      /* Total number of TLB                                  */
-    int tlb_per_way; /* Speed-up helper: used to avoid divisions at run time */
-    int nb_ways;     /* Number of ways in the TLB set                        */
-    int last_way;    /* Last used way used to allocate TLB in a LRU way      */
-    int id_tlbs;     /* If 1, MMU has separated TLBs for instructions & data */
-    int nb_pids;     /* Number of available PID registers                    */
-    ppc_tlb_t *tlb;  /* TLB is optional. Allocate them only if needed        */
-    /* 403 dedicated access protection registers */
-    target_ulong pb[4];
+    int dcache_line_size;
+    int icache_line_size;
 
     /* Those resources are used during exception processing */
     /* CPU model definition */
     target_ulong msr_mask;
-    uint8_t mmu_model;
-    uint8_t excp_model;
-    uint8_t bus_model;
-    uint8_t pad;
+    powerpc_mmu_t mmu_model;
+    powerpc_excp_t excp_model;
+    powerpc_input_t bus_model;
     int bfd_mach;
     uint32_t flags;
 
@@ -542,23 +663,26 @@ struct CPUPPCState {
     target_ulong excp_prefix;
     target_ulong ivor_mask;
     target_ulong ivpr_mask;
+    target_ulong hreset_vector;
 #endif
 
     /* Those resources are used only during code translation */
     /* Next instruction pointer */
     target_ulong nip;
-    /* SPR translation callbacks */
-    ppc_spr_t spr_cb[1024];
+
     /* opcode handlers */
     opc_handler_t *opcodes[0x40];
 
     /* Those resources are used only in Qemu core */
     jmp_buf jmp_env;
     int user_mode_only; /* user mode only simulation */
-    target_ulong hflags; /* hflags is a MSR & HFLAGS_MASK */
+    target_ulong hflags;      /* hflags is a MSR & HFLAGS_MASK         */
+    target_ulong hflags_nmsr; /* specific hflags, not comming from MSR */
+    int mmu_idx;         /* precomputed MMU index to speed up mem accesses */
 
     /* Power management */
     int power_mode;
+    int (*check_pow)(CPUPPCState *env);
 
     /* temporary hack to handle OSI calls (only used if non NULL) */
     int (*osi_call)(struct CPUPPCState *env);
@@ -572,10 +696,11 @@ struct mmu_ctx_t {
     target_phys_addr_t pg_addr[2]; /* PTE tables base addresses */
     target_ulong ptem;             /* Virtual segment ID | API  */
     int key;                       /* Access key                */
+    int nx;                        /* Non-execute area          */
 };
 
 /*****************************************************************************/
-CPUPPCState *cpu_ppc_init (void);
+CPUPPCState *cpu_ppc_init (const char *cpu_model);
 int cpu_ppc_exec (CPUPPCState *s);
 void cpu_ppc_close (CPUPPCState *s);
 /* you can call this signal handler from your SIGBUS and SIGSEGV
@@ -599,32 +724,31 @@ target_ulong do_load_dbatu (CPUPPCState *env, int nr);
 target_ulong do_load_dbatl (CPUPPCState *env, int nr);
 void do_store_dbatu (CPUPPCState *env, int nr, target_ulong value);
 void do_store_dbatl (CPUPPCState *env, int nr, target_ulong value);
+void do_store_ibatu_601 (CPUPPCState *env, int nr, target_ulong value);
+void do_store_ibatl_601 (CPUPPCState *env, int nr, target_ulong value);
 target_ulong do_load_sdr1 (CPUPPCState *env);
 void do_store_sdr1 (CPUPPCState *env, target_ulong value);
 #if defined(TARGET_PPC64)
 target_ulong ppc_load_asr (CPUPPCState *env);
 void ppc_store_asr (CPUPPCState *env, target_ulong value);
-#endif
+target_ulong ppc_load_slb (CPUPPCState *env, int slb_nr);
+void ppc_store_slb (CPUPPCState *env, int slb_nr, target_ulong rs);
+#endif /* defined(TARGET_PPC64) */
+#if 0 // Unused
 target_ulong do_load_sr (CPUPPCState *env, int srnum);
-void do_store_sr (CPUPPCState *env, int srnum, target_ulong value);
 #endif
+void do_store_sr (CPUPPCState *env, int srnum, target_ulong value);
+#endif /* !defined(CONFIG_USER_ONLY) */
 target_ulong ppc_load_xer (CPUPPCState *env);
 void ppc_store_xer (CPUPPCState *env, target_ulong value);
-target_ulong do_load_msr (CPUPPCState *env);
-void do_store_msr (CPUPPCState *env, target_ulong value);
-#if defined(TARGET_PPC64)
-void ppc_store_msr_32 (CPUPPCState *env, uint32_t value);
-#endif
+void ppc_store_msr (CPUPPCState *env, target_ulong value);
 
-void do_compute_hflags (CPUPPCState *env);
 void cpu_ppc_reset (void *opaque);
-CPUPPCState *cpu_ppc_init (void);
-void cpu_ppc_close(CPUPPCState *env);
 
-int ppc_find_by_name (const unsigned char *name, ppc_def_t **def);
-int ppc_find_by_pvr (uint32_t apvr, ppc_def_t **def);
 void ppc_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...));
-int cpu_ppc_register (CPUPPCState *env, ppc_def_t *def);
+
+const ppc_def_t *cpu_ppc_find_by_name (const unsigned char *name);
+int cpu_ppc_register_internal (CPUPPCState *env, const ppc_def_t *def);
 
 /* Time-base and decrementer management */
 #ifndef NO_CPU_IO_DEFS
@@ -638,12 +762,10 @@ void cpu_ppc_store_atbl (CPUPPCState *env, uint32_t value);
 void cpu_ppc_store_atbu (CPUPPCState *env, uint32_t value);
 uint32_t cpu_ppc_load_decr (CPUPPCState *env);
 void cpu_ppc_store_decr (CPUPPCState *env, uint32_t value);
-#if defined(TARGET_PPC64H)
 uint32_t cpu_ppc_load_hdecr (CPUPPCState *env);
 void cpu_ppc_store_hdecr (CPUPPCState *env, uint32_t value);
 uint64_t cpu_ppc_load_purr (CPUPPCState *env);
 void cpu_ppc_store_purr (CPUPPCState *env, uint64_t value);
-#endif
 uint32_t cpu_ppc601_load_rtcl (CPUPPCState *env);
 uint32_t cpu_ppc601_load_rtcu (CPUPPCState *env);
 #if !defined(CONFIG_USER_ONLY)
@@ -665,6 +787,24 @@ int ppcemb_tlb_search (CPUPPCState *env, target_ulong address, uint32_t pid);
 #endif
 #endif
 
+static always_inline uint64_t ppc_dump_gpr (CPUPPCState *env, int gprn)
+{
+    uint64_t gprv;
+
+    gprv = env->gpr[gprn];
+#if !defined(TARGET_PPC64)
+    if (env->flags & POWERPC_FLAG_SPE) {
+        /* If the CPU implements the SPE extension, we have to get the
+         * high bits of the GPR from the gprh storage area
+         */
+        gprv &= 0xFFFFFFFFULL;
+        gprv |= (uint64_t)env->gprh[gprn] << 32;
+    }
+#endif
+
+    return gprv;
+}
+
 /* Device control registers */
 int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, target_ulong *valp);
 int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, target_ulong val);
@@ -674,6 +814,17 @@ int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, target_ulong val);
 #define cpu_exec cpu_ppc_exec
 #define cpu_gen_code cpu_ppc_gen_code
 #define cpu_signal_handler cpu_ppc_signal_handler
+#define cpu_list ppc_cpu_list
+
+/* MMU modes definitions */
+#define MMU_MODE0_SUFFIX _user
+#define MMU_MODE1_SUFFIX _kernel
+#define MMU_MODE2_SUFFIX _hypv
+#define MMU_USER_IDX 0
+static inline int cpu_mmu_index (CPUState *env)
+{
+    return env->mmu_idx;
+}
 
 #include "cpu-all.h"
 
@@ -691,393 +842,471 @@ int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, target_ulong val);
 #define xer_bc  env->xer[0]
 
 /* SPR definitions */
-#define SPR_MQ           (0x000)
-#define SPR_XER          (0x001)
-#define SPR_601_VRTCU    (0x004)
-#define SPR_601_VRTCL    (0x005)
-#define SPR_601_UDECR    (0x006)
-#define SPR_LR           (0x008)
-#define SPR_CTR          (0x009)
-#define SPR_DSISR        (0x012)
-#define SPR_DAR          (0x013) /* DAE for PowerPC 601 */
-#define SPR_601_RTCU     (0x014)
-#define SPR_601_RTCL     (0x015)
-#define SPR_DECR         (0x016)
-#define SPR_SDR1         (0x019)
-#define SPR_SRR0         (0x01A)
-#define SPR_SRR1         (0x01B)
-#define SPR_AMR          (0x01D)
-#define SPR_BOOKE_PID    (0x030)
-#define SPR_BOOKE_DECAR  (0x036)
-#define SPR_BOOKE_CSRR0  (0x03A)
-#define SPR_BOOKE_CSRR1  (0x03B)
-#define SPR_BOOKE_DEAR   (0x03D)
-#define SPR_BOOKE_ESR    (0x03E)
-#define SPR_BOOKE_IVPR   (0x03F)
-#define SPR_8xx_EIE      (0x050)
-#define SPR_8xx_EID      (0x051)
-#define SPR_8xx_NRE      (0x052)
-#define SPR_CTRL         (0x088)
-#define SPR_58x_CMPA     (0x090)
-#define SPR_58x_CMPB     (0x091)
-#define SPR_58x_CMPC     (0x092)
-#define SPR_58x_CMPD     (0x093)
-#define SPR_58x_ICR      (0x094)
-#define SPR_58x_DER      (0x094)
-#define SPR_58x_COUNTA   (0x096)
-#define SPR_58x_COUNTB   (0x097)
-#define SPR_UCTRL        (0x098)
-#define SPR_58x_CMPE     (0x098)
-#define SPR_58x_CMPF     (0x099)
-#define SPR_58x_CMPG     (0x09A)
-#define SPR_58x_CMPH     (0x09B)
-#define SPR_58x_LCTRL1   (0x09C)
-#define SPR_58x_LCTRL2   (0x09D)
-#define SPR_58x_ICTRL    (0x09E)
-#define SPR_58x_BAR      (0x09F)
-#define SPR_VRSAVE       (0x100)
-#define SPR_USPRG0       (0x100)
-#define SPR_USPRG1       (0x101)
-#define SPR_USPRG2       (0x102)
-#define SPR_USPRG3       (0x103)
-#define SPR_USPRG4       (0x104)
-#define SPR_USPRG5       (0x105)
-#define SPR_USPRG6       (0x106)
-#define SPR_USPRG7       (0x107)
-#define SPR_VTBL         (0x10C)
-#define SPR_VTBU         (0x10D)
-#define SPR_SPRG0        (0x110)
-#define SPR_SPRG1        (0x111)
-#define SPR_SPRG2        (0x112)
-#define SPR_SPRG3        (0x113)
-#define SPR_SPRG4        (0x114)
-#define SPR_SCOMC        (0x114)
-#define SPR_SPRG5        (0x115)
-#define SPR_SCOMD        (0x115)
-#define SPR_SPRG6        (0x116)
-#define SPR_SPRG7        (0x117)
-#define SPR_ASR          (0x118)
-#define SPR_EAR          (0x11A)
-#define SPR_TBL          (0x11C)
-#define SPR_TBU          (0x11D)
-#define SPR_TBU40        (0x11E)
-#define SPR_SVR          (0x11E)
-#define SPR_BOOKE_PIR    (0x11E)
-#define SPR_PVR          (0x11F)
-#define SPR_HSPRG0       (0x130)
-#define SPR_BOOKE_DBSR   (0x130)
-#define SPR_HSPRG1       (0x131)
-#define SPR_HDSISR       (0x132)
-#define SPR_HDAR         (0x133)
-#define SPR_BOOKE_DBCR0  (0x134)
-#define SPR_IBCR         (0x135)
-#define SPR_PURR         (0x135)
-#define SPR_BOOKE_DBCR1  (0x135)
-#define SPR_DBCR         (0x136)
-#define SPR_HDEC         (0x136)
-#define SPR_BOOKE_DBCR2  (0x136)
-#define SPR_HIOR         (0x137)
-#define SPR_MBAR         (0x137)
-#define SPR_RMOR         (0x138)
-#define SPR_BOOKE_IAC1   (0x138)
-#define SPR_HRMOR        (0x139)
-#define SPR_BOOKE_IAC2   (0x139)
-#define SPR_HSRR0        (0x13A)
-#define SPR_BOOKE_IAC3   (0x13A)
-#define SPR_HSRR1        (0x13B)
-#define SPR_BOOKE_IAC4   (0x13B)
-#define SPR_LPCR         (0x13C)
-#define SPR_BOOKE_DAC1   (0x13C)
-#define SPR_LPIDR        (0x13D)
-#define SPR_DABR2        (0x13D)
-#define SPR_BOOKE_DAC2   (0x13D)
-#define SPR_BOOKE_DVC1   (0x13E)
-#define SPR_BOOKE_DVC2   (0x13F)
-#define SPR_BOOKE_TSR    (0x150)
-#define SPR_BOOKE_TCR    (0x154)
-#define SPR_BOOKE_IVOR0  (0x190)
-#define SPR_BOOKE_IVOR1  (0x191)
-#define SPR_BOOKE_IVOR2  (0x192)
-#define SPR_BOOKE_IVOR3  (0x193)
-#define SPR_BOOKE_IVOR4  (0x194)
-#define SPR_BOOKE_IVOR5  (0x195)
-#define SPR_BOOKE_IVOR6  (0x196)
-#define SPR_BOOKE_IVOR7  (0x197)
-#define SPR_BOOKE_IVOR8  (0x198)
-#define SPR_BOOKE_IVOR9  (0x199)
-#define SPR_BOOKE_IVOR10 (0x19A)
-#define SPR_BOOKE_IVOR11 (0x19B)
-#define SPR_BOOKE_IVOR12 (0x19C)
-#define SPR_BOOKE_IVOR13 (0x19D)
-#define SPR_BOOKE_IVOR14 (0x19E)
-#define SPR_BOOKE_IVOR15 (0x19F)
-#define SPR_BOOKE_SPEFSCR (0x200)
-#define SPR_E500_BBEAR   (0x201)
-#define SPR_E500_BBTAR   (0x202)
-#define SPR_ATBL         (0x20E)
-#define SPR_ATBU         (0x20F)
-#define SPR_IBAT0U       (0x210)
-#define SPR_BOOKE_IVOR32 (0x210)
-#define SPR_IBAT0L       (0x211)
-#define SPR_BOOKE_IVOR33 (0x211)
-#define SPR_IBAT1U       (0x212)
-#define SPR_BOOKE_IVOR34 (0x212)
-#define SPR_IBAT1L       (0x213)
-#define SPR_BOOKE_IVOR35 (0x213)
-#define SPR_IBAT2U       (0x214)
-#define SPR_BOOKE_IVOR36 (0x214)
-#define SPR_IBAT2L       (0x215)
-#define SPR_E500_L1CFG0  (0x215)
-#define SPR_BOOKE_IVOR37 (0x215)
-#define SPR_IBAT3U       (0x216)
-#define SPR_E500_L1CFG1  (0x216)
-#define SPR_IBAT3L       (0x217)
-#define SPR_DBAT0U       (0x218)
-#define SPR_DBAT0L       (0x219)
-#define SPR_DBAT1U       (0x21A)
-#define SPR_DBAT1L       (0x21B)
-#define SPR_DBAT2U       (0x21C)
-#define SPR_DBAT2L       (0x21D)
-#define SPR_DBAT3U       (0x21E)
-#define SPR_DBAT3L       (0x21F)
-#define SPR_IBAT4U       (0x230)
-#define SPR_IBAT4L       (0x231)
-#define SPR_IBAT5U       (0x232)
-#define SPR_IBAT5L       (0x233)
-#define SPR_IBAT6U       (0x234)
-#define SPR_IBAT6L       (0x235)
-#define SPR_IBAT7U       (0x236)
-#define SPR_IBAT7L       (0x237)
-#define SPR_DBAT4U       (0x238)
-#define SPR_DBAT4L       (0x239)
-#define SPR_DBAT5U       (0x23A)
-#define SPR_BOOKE_MCSRR0 (0x23A)
-#define SPR_DBAT5L       (0x23B)
-#define SPR_BOOKE_MCSRR1 (0x23B)
-#define SPR_DBAT6U       (0x23C)
-#define SPR_BOOKE_MCSR   (0x23C)
-#define SPR_DBAT6L       (0x23D)
-#define SPR_E500_MCAR    (0x23D)
-#define SPR_DBAT7U       (0x23E)
-#define SPR_BOOKE_DSRR0  (0x23E)
-#define SPR_DBAT7L       (0x23F)
-#define SPR_BOOKE_DSRR1  (0x23F)
-#define SPR_BOOKE_SPRG8  (0x25C)
-#define SPR_BOOKE_SPRG9  (0x25D)
-#define SPR_BOOKE_MAS0   (0x270)
-#define SPR_BOOKE_MAS1   (0x271)
-#define SPR_BOOKE_MAS2   (0x272)
-#define SPR_BOOKE_MAS3   (0x273)
-#define SPR_BOOKE_MAS4   (0x274)
-#define SPR_BOOKE_MAS6   (0x276)
-#define SPR_BOOKE_PID1   (0x279)
-#define SPR_BOOKE_PID2   (0x27A)
-#define SPR_BOOKE_TLB0CFG (0x2B0)
-#define SPR_BOOKE_TLB1CFG (0x2B1)
-#define SPR_BOOKE_TLB2CFG (0x2B2)
-#define SPR_BOOKE_TLB3CFG (0x2B3)
-#define SPR_BOOKE_EPR    (0x2BE)
-#define SPR_PERF0        (0x300)
-#define SPR_PERF1        (0x301)
-#define SPR_PERF2        (0x302)
-#define SPR_PERF3        (0x303)
-#define SPR_PERF4        (0x304)
-#define SPR_PERF5        (0x305)
-#define SPR_PERF6        (0x306)
-#define SPR_PERF7        (0x307)
-#define SPR_PERF8        (0x308)
-#define SPR_PERF9        (0x309)
-#define SPR_PERFA        (0x30A)
-#define SPR_PERFB        (0x30B)
-#define SPR_PERFC        (0x30C)
-#define SPR_PERFD        (0x30D)
-#define SPR_PERFE        (0x30E)
-#define SPR_PERFF        (0x30F)
-#define SPR_UPERF0       (0x310)
-#define SPR_UPERF1       (0x311)
-#define SPR_UPERF2       (0x312)
-#define SPR_UPERF3       (0x313)
-#define SPR_UPERF4       (0x314)
-#define SPR_UPERF5       (0x315)
-#define SPR_UPERF6       (0x316)
-#define SPR_UPERF7       (0x317)
-#define SPR_UPERF8       (0x318)
-#define SPR_UPERF9       (0x319)
-#define SPR_UPERFA       (0x31A)
-#define SPR_UPERFB       (0x31B)
-#define SPR_UPERFC       (0x31C)
-#define SPR_UPERFD       (0x31D)
-#define SPR_UPERFE       (0x31E)
-#define SPR_UPERFF       (0x31F)
-#define SPR_440_INV0     (0x370)
-#define SPR_440_INV1     (0x371)
-#define SPR_440_INV2     (0x372)
-#define SPR_440_INV3     (0x373)
-#define SPR_440_ITV0     (0x374)
-#define SPR_440_ITV1     (0x375)
-#define SPR_440_ITV2     (0x376)
-#define SPR_440_ITV3     (0x377)
-#define SPR_440_CCR1     (0x378)
-#define SPR_DCRIPR       (0x37B)
-#define SPR_PPR          (0x380)
-#define SPR_440_DNV0     (0x390)
-#define SPR_440_DNV1     (0x391)
-#define SPR_440_DNV2     (0x392)
-#define SPR_440_DNV3     (0x393)
-#define SPR_440_DTV0     (0x394)
-#define SPR_440_DTV1     (0x395)
-#define SPR_440_DTV2     (0x396)
-#define SPR_440_DTV3     (0x397)
-#define SPR_440_DVLIM    (0x398)
-#define SPR_440_IVLIM    (0x399)
-#define SPR_440_RSTCFG   (0x39B)
-#define SPR_BOOKE_DCDBTRL (0x39C)
-#define SPR_BOOKE_DCDBTRH (0x39D)
-#define SPR_BOOKE_ICDBTRL (0x39E)
-#define SPR_BOOKE_ICDBTRH (0x39F)
-#define SPR_UMMCR2       (0x3A0)
-#define SPR_UPMC5        (0x3A1)
-#define SPR_UPMC6        (0x3A2)
-#define SPR_UBAMR        (0x3A7)
-#define SPR_UMMCR0       (0x3A8)
-#define SPR_UPMC1        (0x3A9)
-#define SPR_UPMC2        (0x3AA)
-#define SPR_USIAR        (0x3AB)
-#define SPR_UMMCR1       (0x3AC)
-#define SPR_UPMC3        (0x3AD)
-#define SPR_UPMC4        (0x3AE)
-#define SPR_USDA         (0x3AF)
-#define SPR_40x_ZPR      (0x3B0)
-#define SPR_BOOKE_MAS7   (0x3B0)
-#define SPR_620_PMR0     (0x3B0)
-#define SPR_MMCR2        (0x3B0)
-#define SPR_PMC5         (0x3B1)
-#define SPR_40x_PID      (0x3B1)
-#define SPR_620_PMR1     (0x3B1)
-#define SPR_PMC6         (0x3B2)
-#define SPR_440_MMUCR    (0x3B2)
-#define SPR_620_PMR2     (0x3B2)
-#define SPR_4xx_CCR0     (0x3B3)
-#define SPR_BOOKE_EPLC   (0x3B3)
-#define SPR_620_PMR3     (0x3B3)
-#define SPR_405_IAC3     (0x3B4)
-#define SPR_BOOKE_EPSC   (0x3B4)
-#define SPR_620_PMR4     (0x3B4)
-#define SPR_405_IAC4     (0x3B5)
-#define SPR_620_PMR5     (0x3B5)
-#define SPR_405_DVC1     (0x3B6)
-#define SPR_620_PMR6     (0x3B6)
-#define SPR_405_DVC2     (0x3B7)
-#define SPR_620_PMR7     (0x3B7)
-#define SPR_BAMR         (0x3B7)
-#define SPR_MMCR0        (0x3B8)
-#define SPR_620_PMR8     (0x3B8)
-#define SPR_PMC1         (0x3B9)
-#define SPR_40x_SGR      (0x3B9)
-#define SPR_620_PMR9     (0x3B9)
-#define SPR_PMC2         (0x3BA)
-#define SPR_40x_DCWR     (0x3BA)
-#define SPR_620_PMRA     (0x3BA)
-#define SPR_SIAR         (0x3BB)
-#define SPR_405_SLER     (0x3BB)
-#define SPR_620_PMRB     (0x3BB)
-#define SPR_MMCR1        (0x3BC)
-#define SPR_405_SU0R     (0x3BC)
-#define SPR_620_PMRC     (0x3BC)
-#define SPR_401_SKR      (0x3BC)
-#define SPR_PMC3         (0x3BD)
-#define SPR_405_DBCR1    (0x3BD)
-#define SPR_620_PMRD     (0x3BD)
-#define SPR_PMC4         (0x3BE)
-#define SPR_620_PMRE     (0x3BE)
-#define SPR_SDA          (0x3BF)
-#define SPR_620_PMRF     (0x3BF)
-#define SPR_403_VTBL     (0x3CC)
-#define SPR_403_VTBU     (0x3CD)
-#define SPR_DMISS        (0x3D0)
-#define SPR_DCMP         (0x3D1)
-#define SPR_HASH1        (0x3D2)
-#define SPR_HASH2        (0x3D3)
-#define SPR_BOOKE_ICDBDR (0x3D3)
-#define SPR_TLBMISS      (0x3D4)
-#define SPR_IMISS        (0x3D4)
-#define SPR_40x_ESR      (0x3D4)
-#define SPR_PTEHI        (0x3D5)
-#define SPR_ICMP         (0x3D5)
-#define SPR_40x_DEAR     (0x3D5)
-#define SPR_PTELO        (0x3D6)
-#define SPR_RPA          (0x3D6)
-#define SPR_40x_EVPR     (0x3D6)
-#define SPR_L3PM         (0x3D7)
-#define SPR_403_CDBCR    (0x3D7)
-#define SPR_L3OHCR       (0x3D8)
-#define SPR_TCR          (0x3D8)
-#define SPR_40x_TSR      (0x3D8)
-#define SPR_IBR          (0x3DA)
-#define SPR_40x_TCR      (0x3DA)
-#define SPR_ESASRR       (0x3DB)
-#define SPR_40x_PIT      (0x3DB)
-#define SPR_403_TBL      (0x3DC)
-#define SPR_403_TBU      (0x3DD)
-#define SPR_SEBR         (0x3DE)
-#define SPR_40x_SRR2     (0x3DE)
-#define SPR_SER          (0x3DF)
-#define SPR_40x_SRR3     (0x3DF)
-#define SPR_L3ITCR0      (0x3E8)
-#define SPR_L3ITCR1      (0x3E9)
-#define SPR_L3ITCR2      (0x3EA)
-#define SPR_L3ITCR3      (0x3EB)
-#define SPR_HID0         (0x3F0)
-#define SPR_40x_DBSR     (0x3F0)
-#define SPR_HID1         (0x3F1)
-#define SPR_IABR         (0x3F2)
-#define SPR_40x_DBCR0    (0x3F2)
-#define SPR_601_HID2     (0x3F2)
-#define SPR_E500_L1CSR0  (0x3F2)
-#define SPR_ICTRL        (0x3F3)
-#define SPR_HID2         (0x3F3)
-#define SPR_E500_L1CSR1  (0x3F3)
-#define SPR_440_DBDR     (0x3F3)
-#define SPR_LDSTDB       (0x3F4)
-#define SPR_40x_IAC1     (0x3F4)
-#define SPR_BOOKE_MMUCSR0 (0x3F4)
-#define SPR_DABR         (0x3F5)
+#define SPR_MQ                (0x000)
+#define SPR_XER               (0x001)
+#define SPR_601_VRTCU         (0x004)
+#define SPR_601_VRTCL         (0x005)
+#define SPR_601_UDECR         (0x006)
+#define SPR_LR                (0x008)
+#define SPR_CTR               (0x009)
+#define SPR_DSISR             (0x012)
+#define SPR_DAR               (0x013) /* DAE for PowerPC 601 */
+#define SPR_601_RTCU          (0x014)
+#define SPR_601_RTCL          (0x015)
+#define SPR_DECR              (0x016)
+#define SPR_SDR1              (0x019)
+#define SPR_SRR0              (0x01A)
+#define SPR_SRR1              (0x01B)
+#define SPR_AMR               (0x01D)
+#define SPR_BOOKE_PID         (0x030)
+#define SPR_BOOKE_DECAR       (0x036)
+#define SPR_BOOKE_CSRR0       (0x03A)
+#define SPR_BOOKE_CSRR1       (0x03B)
+#define SPR_BOOKE_DEAR        (0x03D)
+#define SPR_BOOKE_ESR         (0x03E)
+#define SPR_BOOKE_IVPR        (0x03F)
+#define SPR_MPC_EIE           (0x050)
+#define SPR_MPC_EID           (0x051)
+#define SPR_MPC_NRI           (0x052)
+#define SPR_CTRL              (0x088)
+#define SPR_MPC_CMPA          (0x090)
+#define SPR_MPC_CMPB          (0x091)
+#define SPR_MPC_CMPC          (0x092)
+#define SPR_MPC_CMPD          (0x093)
+#define SPR_MPC_ECR           (0x094)
+#define SPR_MPC_DER           (0x095)
+#define SPR_MPC_COUNTA        (0x096)
+#define SPR_MPC_COUNTB        (0x097)
+#define SPR_UCTRL             (0x098)
+#define SPR_MPC_CMPE          (0x098)
+#define SPR_MPC_CMPF          (0x099)
+#define SPR_MPC_CMPG          (0x09A)
+#define SPR_MPC_CMPH          (0x09B)
+#define SPR_MPC_LCTRL1        (0x09C)
+#define SPR_MPC_LCTRL2        (0x09D)
+#define SPR_MPC_ICTRL         (0x09E)
+#define SPR_MPC_BAR           (0x09F)
+#define SPR_VRSAVE            (0x100)
+#define SPR_USPRG0            (0x100)
+#define SPR_USPRG1            (0x101)
+#define SPR_USPRG2            (0x102)
+#define SPR_USPRG3            (0x103)
+#define SPR_USPRG4            (0x104)
+#define SPR_USPRG5            (0x105)
+#define SPR_USPRG6            (0x106)
+#define SPR_USPRG7            (0x107)
+#define SPR_VTBL              (0x10C)
+#define SPR_VTBU              (0x10D)
+#define SPR_SPRG0             (0x110)
+#define SPR_SPRG1             (0x111)
+#define SPR_SPRG2             (0x112)
+#define SPR_SPRG3             (0x113)
+#define SPR_SPRG4             (0x114)
+#define SPR_SCOMC             (0x114)
+#define SPR_SPRG5             (0x115)
+#define SPR_SCOMD             (0x115)
+#define SPR_SPRG6             (0x116)
+#define SPR_SPRG7             (0x117)
+#define SPR_ASR               (0x118)
+#define SPR_EAR               (0x11A)
+#define SPR_TBL               (0x11C)
+#define SPR_TBU               (0x11D)
+#define SPR_TBU40             (0x11E)
+#define SPR_SVR               (0x11E)
+#define SPR_BOOKE_PIR         (0x11E)
+#define SPR_PVR               (0x11F)
+#define SPR_HSPRG0            (0x130)
+#define SPR_BOOKE_DBSR        (0x130)
+#define SPR_HSPRG1            (0x131)
+#define SPR_HDSISR            (0x132)
+#define SPR_HDAR              (0x133)
+#define SPR_BOOKE_DBCR0       (0x134)
+#define SPR_IBCR              (0x135)
+#define SPR_PURR              (0x135)
+#define SPR_BOOKE_DBCR1       (0x135)
+#define SPR_DBCR              (0x136)
+#define SPR_HDEC              (0x136)
+#define SPR_BOOKE_DBCR2       (0x136)
+#define SPR_HIOR              (0x137)
+#define SPR_MBAR              (0x137)
+#define SPR_RMOR              (0x138)
+#define SPR_BOOKE_IAC1        (0x138)
+#define SPR_HRMOR             (0x139)
+#define SPR_BOOKE_IAC2        (0x139)
+#define SPR_HSRR0             (0x13A)
+#define SPR_BOOKE_IAC3        (0x13A)
+#define SPR_HSRR1             (0x13B)
+#define SPR_BOOKE_IAC4        (0x13B)
+#define SPR_LPCR              (0x13C)
+#define SPR_BOOKE_DAC1        (0x13C)
+#define SPR_LPIDR             (0x13D)
+#define SPR_DABR2             (0x13D)
+#define SPR_BOOKE_DAC2        (0x13D)
+#define SPR_BOOKE_DVC1        (0x13E)
+#define SPR_BOOKE_DVC2        (0x13F)
+#define SPR_BOOKE_TSR         (0x150)
+#define SPR_BOOKE_TCR         (0x154)
+#define SPR_BOOKE_IVOR0       (0x190)
+#define SPR_BOOKE_IVOR1       (0x191)
+#define SPR_BOOKE_IVOR2       (0x192)
+#define SPR_BOOKE_IVOR3       (0x193)
+#define SPR_BOOKE_IVOR4       (0x194)
+#define SPR_BOOKE_IVOR5       (0x195)
+#define SPR_BOOKE_IVOR6       (0x196)
+#define SPR_BOOKE_IVOR7       (0x197)
+#define SPR_BOOKE_IVOR8       (0x198)
+#define SPR_BOOKE_IVOR9       (0x199)
+#define SPR_BOOKE_IVOR10      (0x19A)
+#define SPR_BOOKE_IVOR11      (0x19B)
+#define SPR_BOOKE_IVOR12      (0x19C)
+#define SPR_BOOKE_IVOR13      (0x19D)
+#define SPR_BOOKE_IVOR14      (0x19E)
+#define SPR_BOOKE_IVOR15      (0x19F)
+#define SPR_BOOKE_SPEFSCR     (0x200)
+#define SPR_Exxx_BBEAR        (0x201)
+#define SPR_Exxx_BBTAR        (0x202)
+#define SPR_Exxx_L1CFG0       (0x203)
+#define SPR_Exxx_NPIDR        (0x205)
+#define SPR_ATBL              (0x20E)
+#define SPR_ATBU              (0x20F)
+#define SPR_IBAT0U            (0x210)
+#define SPR_BOOKE_IVOR32      (0x210)
+#define SPR_RCPU_MI_GRA       (0x210)
+#define SPR_IBAT0L            (0x211)
+#define SPR_BOOKE_IVOR33      (0x211)
+#define SPR_IBAT1U            (0x212)
+#define SPR_BOOKE_IVOR34      (0x212)
+#define SPR_IBAT1L            (0x213)
+#define SPR_BOOKE_IVOR35      (0x213)
+#define SPR_IBAT2U            (0x214)
+#define SPR_BOOKE_IVOR36      (0x214)
+#define SPR_IBAT2L            (0x215)
+#define SPR_BOOKE_IVOR37      (0x215)
+#define SPR_IBAT3U            (0x216)
+#define SPR_IBAT3L            (0x217)
+#define SPR_DBAT0U            (0x218)
+#define SPR_RCPU_L2U_GRA      (0x218)
+#define SPR_DBAT0L            (0x219)
+#define SPR_DBAT1U            (0x21A)
+#define SPR_DBAT1L            (0x21B)
+#define SPR_DBAT2U            (0x21C)
+#define SPR_DBAT2L            (0x21D)
+#define SPR_DBAT3U            (0x21E)
+#define SPR_DBAT3L            (0x21F)
+#define SPR_IBAT4U            (0x230)
+#define SPR_RPCU_BBCMCR       (0x230)
+#define SPR_MPC_IC_CST        (0x230)
+#define SPR_Exxx_CTXCR        (0x230)
+#define SPR_IBAT4L            (0x231)
+#define SPR_MPC_IC_ADR        (0x231)
+#define SPR_Exxx_DBCR3        (0x231)
+#define SPR_IBAT5U            (0x232)
+#define SPR_MPC_IC_DAT        (0x232)
+#define SPR_Exxx_DBCNT        (0x232)
+#define SPR_IBAT5L            (0x233)
+#define SPR_IBAT6U            (0x234)
+#define SPR_IBAT6L            (0x235)
+#define SPR_IBAT7U            (0x236)
+#define SPR_IBAT7L            (0x237)
+#define SPR_DBAT4U            (0x238)
+#define SPR_RCPU_L2U_MCR      (0x238)
+#define SPR_MPC_DC_CST        (0x238)
+#define SPR_Exxx_ALTCTXCR     (0x238)
+#define SPR_DBAT4L            (0x239)
+#define SPR_MPC_DC_ADR        (0x239)
+#define SPR_DBAT5U            (0x23A)
+#define SPR_BOOKE_MCSRR0      (0x23A)
+#define SPR_MPC_DC_DAT        (0x23A)
+#define SPR_DBAT5L            (0x23B)
+#define SPR_BOOKE_MCSRR1      (0x23B)
+#define SPR_DBAT6U            (0x23C)
+#define SPR_BOOKE_MCSR        (0x23C)
+#define SPR_DBAT6L            (0x23D)
+#define SPR_Exxx_MCAR         (0x23D)
+#define SPR_DBAT7U            (0x23E)
+#define SPR_BOOKE_DSRR0       (0x23E)
+#define SPR_DBAT7L            (0x23F)
+#define SPR_BOOKE_DSRR1       (0x23F)
+#define SPR_BOOKE_SPRG8       (0x25C)
+#define SPR_BOOKE_SPRG9       (0x25D)
+#define SPR_BOOKE_MAS0        (0x270)
+#define SPR_BOOKE_MAS1        (0x271)
+#define SPR_BOOKE_MAS2        (0x272)
+#define SPR_BOOKE_MAS3        (0x273)
+#define SPR_BOOKE_MAS4        (0x274)
+#define SPR_BOOKE_MAS5        (0x275)
+#define SPR_BOOKE_MAS6        (0x276)
+#define SPR_BOOKE_PID1        (0x279)
+#define SPR_BOOKE_PID2        (0x27A)
+#define SPR_MPC_DPDR          (0x280)
+#define SPR_MPC_IMMR          (0x288)
+#define SPR_BOOKE_TLB0CFG     (0x2B0)
+#define SPR_BOOKE_TLB1CFG     (0x2B1)
+#define SPR_BOOKE_TLB2CFG     (0x2B2)
+#define SPR_BOOKE_TLB3CFG     (0x2B3)
+#define SPR_BOOKE_EPR         (0x2BE)
+#define SPR_PERF0             (0x300)
+#define SPR_RCPU_MI_RBA0      (0x300)
+#define SPR_MPC_MI_CTR        (0x300)
+#define SPR_PERF1             (0x301)
+#define SPR_RCPU_MI_RBA1      (0x301)
+#define SPR_PERF2             (0x302)
+#define SPR_RCPU_MI_RBA2      (0x302)
+#define SPR_MPC_MI_AP         (0x302)
+#define SPR_PERF3             (0x303)
+#define SPR_620_PMC1R         (0x303)
+#define SPR_RCPU_MI_RBA3      (0x303)
+#define SPR_MPC_MI_EPN        (0x303)
+#define SPR_PERF4             (0x304)
+#define SPR_620_PMC2R         (0x304)
+#define SPR_PERF5             (0x305)
+#define SPR_MPC_MI_TWC        (0x305)
+#define SPR_PERF6             (0x306)
+#define SPR_MPC_MI_RPN        (0x306)
+#define SPR_PERF7             (0x307)
+#define SPR_PERF8             (0x308)
+#define SPR_RCPU_L2U_RBA0     (0x308)
+#define SPR_MPC_MD_CTR        (0x308)
+#define SPR_PERF9             (0x309)
+#define SPR_RCPU_L2U_RBA1     (0x309)
+#define SPR_MPC_MD_CASID      (0x309)
+#define SPR_PERFA             (0x30A)
+#define SPR_RCPU_L2U_RBA2     (0x30A)
+#define SPR_MPC_MD_AP         (0x30A)
+#define SPR_PERFB             (0x30B)
+#define SPR_620_MMCR0R        (0x30B)
+#define SPR_RCPU_L2U_RBA3     (0x30B)
+#define SPR_MPC_MD_EPN        (0x30B)
+#define SPR_PERFC             (0x30C)
+#define SPR_MPC_MD_TWB        (0x30C)
+#define SPR_PERFD             (0x30D)
+#define SPR_MPC_MD_TWC        (0x30D)
+#define SPR_PERFE             (0x30E)
+#define SPR_MPC_MD_RPN        (0x30E)
+#define SPR_PERFF             (0x30F)
+#define SPR_MPC_MD_TW         (0x30F)
+#define SPR_UPERF0            (0x310)
+#define SPR_UPERF1            (0x311)
+#define SPR_UPERF2            (0x312)
+#define SPR_UPERF3            (0x313)
+#define SPR_620_PMC1W         (0x313)
+#define SPR_UPERF4            (0x314)
+#define SPR_620_PMC2W         (0x314)
+#define SPR_UPERF5            (0x315)
+#define SPR_UPERF6            (0x316)
+#define SPR_UPERF7            (0x317)
+#define SPR_UPERF8            (0x318)
+#define SPR_UPERF9            (0x319)
+#define SPR_UPERFA            (0x31A)
+#define SPR_UPERFB            (0x31B)
+#define SPR_620_MMCR0W        (0x31B)
+#define SPR_UPERFC            (0x31C)
+#define SPR_UPERFD            (0x31D)
+#define SPR_UPERFE            (0x31E)
+#define SPR_UPERFF            (0x31F)
+#define SPR_RCPU_MI_RA0       (0x320)
+#define SPR_MPC_MI_DBCAM      (0x320)
+#define SPR_RCPU_MI_RA1       (0x321)
+#define SPR_MPC_MI_DBRAM0     (0x321)
+#define SPR_RCPU_MI_RA2       (0x322)
+#define SPR_MPC_MI_DBRAM1     (0x322)
+#define SPR_RCPU_MI_RA3       (0x323)
+#define SPR_RCPU_L2U_RA0      (0x328)
+#define SPR_MPC_MD_DBCAM      (0x328)
+#define SPR_RCPU_L2U_RA1      (0x329)
+#define SPR_MPC_MD_DBRAM0     (0x329)
+#define SPR_RCPU_L2U_RA2      (0x32A)
+#define SPR_MPC_MD_DBRAM1     (0x32A)
+#define SPR_RCPU_L2U_RA3      (0x32B)
+#define SPR_440_INV0          (0x370)
+#define SPR_440_INV1          (0x371)
+#define SPR_440_INV2          (0x372)
+#define SPR_440_INV3          (0x373)
+#define SPR_440_ITV0          (0x374)
+#define SPR_440_ITV1          (0x375)
+#define SPR_440_ITV2          (0x376)
+#define SPR_440_ITV3          (0x377)
+#define SPR_440_CCR1          (0x378)
+#define SPR_DCRIPR            (0x37B)
+#define SPR_PPR               (0x380)
+#define SPR_750_GQR0          (0x390)
+#define SPR_440_DNV0          (0x390)
+#define SPR_750_GQR1          (0x391)
+#define SPR_440_DNV1          (0x391)
+#define SPR_750_GQR2          (0x392)
+#define SPR_440_DNV2          (0x392)
+#define SPR_750_GQR3          (0x393)
+#define SPR_440_DNV3          (0x393)
+#define SPR_750_GQR4          (0x394)
+#define SPR_440_DTV0          (0x394)
+#define SPR_750_GQR5          (0x395)
+#define SPR_440_DTV1          (0x395)
+#define SPR_750_GQR6          (0x396)
+#define SPR_440_DTV2          (0x396)
+#define SPR_750_GQR7          (0x397)
+#define SPR_440_DTV3          (0x397)
+#define SPR_750_THRM4         (0x398)
+#define SPR_750CL_HID2        (0x398)
+#define SPR_440_DVLIM         (0x398)
+#define SPR_750_WPAR          (0x399)
+#define SPR_440_IVLIM         (0x399)
+#define SPR_750_DMAU          (0x39A)
+#define SPR_750_DMAL          (0x39B)
+#define SPR_440_RSTCFG        (0x39B)
+#define SPR_BOOKE_DCDBTRL     (0x39C)
+#define SPR_BOOKE_DCDBTRH     (0x39D)
+#define SPR_BOOKE_ICDBTRL     (0x39E)
+#define SPR_BOOKE_ICDBTRH     (0x39F)
+#define SPR_UMMCR2            (0x3A0)
+#define SPR_UPMC5             (0x3A1)
+#define SPR_UPMC6             (0x3A2)
+#define SPR_UBAMR             (0x3A7)
+#define SPR_UMMCR0            (0x3A8)
+#define SPR_UPMC1             (0x3A9)
+#define SPR_UPMC2             (0x3AA)
+#define SPR_USIAR             (0x3AB)
+#define SPR_UMMCR1            (0x3AC)
+#define SPR_UPMC3             (0x3AD)
+#define SPR_UPMC4             (0x3AE)
+#define SPR_USDA              (0x3AF)
+#define SPR_40x_ZPR           (0x3B0)
+#define SPR_BOOKE_MAS7        (0x3B0)
+#define SPR_620_PMR0          (0x3B0)
+#define SPR_MMCR2             (0x3B0)
+#define SPR_PMC5              (0x3B1)
+#define SPR_40x_PID           (0x3B1)
+#define SPR_620_PMR1          (0x3B1)
+#define SPR_PMC6              (0x3B2)
+#define SPR_440_MMUCR         (0x3B2)
+#define SPR_620_PMR2          (0x3B2)
+#define SPR_4xx_CCR0          (0x3B3)
+#define SPR_BOOKE_EPLC        (0x3B3)
+#define SPR_620_PMR3          (0x3B3)
+#define SPR_405_IAC3          (0x3B4)
+#define SPR_BOOKE_EPSC        (0x3B4)
+#define SPR_620_PMR4          (0x3B4)
+#define SPR_405_IAC4          (0x3B5)
+#define SPR_620_PMR5          (0x3B5)
+#define SPR_405_DVC1          (0x3B6)
+#define SPR_620_PMR6          (0x3B6)
+#define SPR_405_DVC2          (0x3B7)
+#define SPR_620_PMR7          (0x3B7)
+#define SPR_BAMR              (0x3B7)
+#define SPR_MMCR0             (0x3B8)
+#define SPR_620_PMR8          (0x3B8)
+#define SPR_PMC1              (0x3B9)
+#define SPR_40x_SGR           (0x3B9)
+#define SPR_620_PMR9          (0x3B9)
+#define SPR_PMC2              (0x3BA)
+#define SPR_40x_DCWR          (0x3BA)
+#define SPR_620_PMRA          (0x3BA)
+#define SPR_SIAR              (0x3BB)
+#define SPR_405_SLER          (0x3BB)
+#define SPR_620_PMRB          (0x3BB)
+#define SPR_MMCR1             (0x3BC)
+#define SPR_405_SU0R          (0x3BC)
+#define SPR_620_PMRC          (0x3BC)
+#define SPR_401_SKR           (0x3BC)
+#define SPR_PMC3              (0x3BD)
+#define SPR_405_DBCR1         (0x3BD)
+#define SPR_620_PMRD          (0x3BD)
+#define SPR_PMC4              (0x3BE)
+#define SPR_620_PMRE          (0x3BE)
+#define SPR_SDA               (0x3BF)
+#define SPR_620_PMRF          (0x3BF)
+#define SPR_403_VTBL          (0x3CC)
+#define SPR_403_VTBU          (0x3CD)
+#define SPR_DMISS             (0x3D0)
+#define SPR_DCMP              (0x3D1)
+#define SPR_HASH1             (0x3D2)
+#define SPR_HASH2             (0x3D3)
+#define SPR_BOOKE_ICDBDR      (0x3D3)
+#define SPR_TLBMISS           (0x3D4)
+#define SPR_IMISS             (0x3D4)
+#define SPR_40x_ESR           (0x3D4)
+#define SPR_PTEHI             (0x3D5)
+#define SPR_ICMP              (0x3D5)
+#define SPR_40x_DEAR          (0x3D5)
+#define SPR_PTELO             (0x3D6)
+#define SPR_RPA               (0x3D6)
+#define SPR_40x_EVPR          (0x3D6)
+#define SPR_L3PM              (0x3D7)
+#define SPR_403_CDBCR         (0x3D7)
+#define SPR_L3ITCR0           (0x3D8)
+#define SPR_TCR               (0x3D8)
+#define SPR_40x_TSR           (0x3D8)
+#define SPR_IBR               (0x3DA)
+#define SPR_40x_TCR           (0x3DA)
+#define SPR_ESASRR            (0x3DB)
+#define SPR_40x_PIT           (0x3DB)
+#define SPR_403_TBL           (0x3DC)
+#define SPR_403_TBU           (0x3DD)
+#define SPR_SEBR              (0x3DE)
+#define SPR_40x_SRR2          (0x3DE)
+#define SPR_SER               (0x3DF)
+#define SPR_40x_SRR3          (0x3DF)
+#define SPR_L3OHCR            (0x3E8)
+#define SPR_L3ITCR1           (0x3E9)
+#define SPR_L3ITCR2           (0x3EA)
+#define SPR_L3ITCR3           (0x3EB)
+#define SPR_HID0              (0x3F0)
+#define SPR_40x_DBSR          (0x3F0)
+#define SPR_HID1              (0x3F1)
+#define SPR_IABR              (0x3F2)
+#define SPR_40x_DBCR0         (0x3F2)
+#define SPR_601_HID2          (0x3F2)
+#define SPR_Exxx_L1CSR0       (0x3F2)
+#define SPR_ICTRL             (0x3F3)
+#define SPR_HID2              (0x3F3)
+#define SPR_750CL_HID4        (0x3F3)
+#define SPR_Exxx_L1CSR1       (0x3F3)
+#define SPR_440_DBDR          (0x3F3)
+#define SPR_LDSTDB            (0x3F4)
+#define SPR_750_TDCL          (0x3F4)
+#define SPR_40x_IAC1          (0x3F4)
+#define SPR_MMUCSR0           (0x3F4)
+#define SPR_DABR              (0x3F5)
 #define DABR_MASK (~(target_ulong)0x7)
-#define SPR_E500_BUCSR   (0x3F5)
-#define SPR_40x_IAC2     (0x3F5)
-#define SPR_601_HID5     (0x3F5)
-#define SPR_40x_DAC1     (0x3F6)
-#define SPR_MSSCR0       (0x3F6)
-#define SPR_MSSSR0       (0x3F7)
-#define SPR_DABRX        (0x3F7)
-#define SPR_40x_DAC2     (0x3F7)
-#define SPR_BOOKE_MMUCFG (0x3F7)
-#define SPR_LDSTCR       (0x3F8)
-#define SPR_L2PMCR       (0x3F8)
-#define SPR_750_HID2     (0x3F8)
-#define SPR_620_HID8     (0x3F8)
-#define SPR_L2CR         (0x3F9)
-#define SPR_620_HID9     (0x3F9)
-#define SPR_L3CR         (0x3FA)
-#define SPR_IABR2        (0x3FA)
-#define SPR_40x_DCCR     (0x3FA)
-#define SPR_ICTC         (0x3FB)
-#define SPR_40x_ICCR     (0x3FB)
-#define SPR_THRM1        (0x3FC)
-#define SPR_403_PBL1     (0x3FC)
-#define SPR_SP           (0x3FD)
-#define SPR_THRM2        (0x3FD)
-#define SPR_403_PBU1     (0x3FD)
-#define SPR_604_HID13    (0x3FD)
-#define SPR_LT           (0x3FE)
-#define SPR_THRM3        (0x3FE)
-#define SPR_FPECR        (0x3FE)
-#define SPR_403_PBL2     (0x3FE)
-#define SPR_PIR          (0x3FF)
-#define SPR_403_PBU2     (0x3FF)
-#define SPR_601_HID15    (0x3FF)
-#define SPR_604_HID15    (0x3FF)
-#define SPR_E500_SVR     (0x3FF)
+#define SPR_Exxx_BUCSR        (0x3F5)
+#define SPR_40x_IAC2          (0x3F5)
+#define SPR_601_HID5          (0x3F5)
+#define SPR_40x_DAC1          (0x3F6)
+#define SPR_MSSCR0            (0x3F6)
+#define SPR_970_HID5          (0x3F6)
+#define SPR_MSSSR0            (0x3F7)
+#define SPR_MSSCR1            (0x3F7)
+#define SPR_DABRX             (0x3F7)
+#define SPR_40x_DAC2          (0x3F7)
+#define SPR_MMUCFG            (0x3F7)
+#define SPR_LDSTCR            (0x3F8)
+#define SPR_L2PMCR            (0x3F8)
+#define SPR_750FX_HID2        (0x3F8)
+#define SPR_620_BUSCSR        (0x3F8)
+#define SPR_Exxx_L1FINV0      (0x3F8)
+#define SPR_L2CR              (0x3F9)
+#define SPR_620_L2CR          (0x3F9)
+#define SPR_L3CR              (0x3FA)
+#define SPR_750_TDCH          (0x3FA)
+#define SPR_IABR2             (0x3FA)
+#define SPR_40x_DCCR          (0x3FA)
+#define SPR_620_L2SR          (0x3FA)
+#define SPR_ICTC              (0x3FB)
+#define SPR_40x_ICCR          (0x3FB)
+#define SPR_THRM1             (0x3FC)
+#define SPR_403_PBL1          (0x3FC)
+#define SPR_SP                (0x3FD)
+#define SPR_THRM2             (0x3FD)
+#define SPR_403_PBU1          (0x3FD)
+#define SPR_604_HID13         (0x3FD)
+#define SPR_LT                (0x3FE)
+#define SPR_THRM3             (0x3FE)
+#define SPR_RCPU_FPECR        (0x3FE)
+#define SPR_403_PBL2          (0x3FE)
+#define SPR_PIR               (0x3FF)
+#define SPR_403_PBU2          (0x3FF)
+#define SPR_601_HID15         (0x3FF)
+#define SPR_604_HID15         (0x3FF)
+#define SPR_E500_SVR          (0x3FF)
 
 /*****************************************************************************/
 /* Memory access type :
@@ -1108,6 +1337,9 @@ enum {
     PPC6xx_INPUT_MCP        = 3,
     PPC6xx_INPUT_SMI        = 4,
     PPC6xx_INPUT_INT        = 5,
+    PPC6xx_INPUT_TBEN       = 6,
+    PPC6xx_INPUT_WAKEUP     = 7,
+    PPC6xx_INPUT_NB,
 };
 
 enum {
@@ -1119,6 +1351,7 @@ enum {
     PPCBookE_INPUT_SMI        = 4,
     PPCBookE_INPUT_INT        = 5,
     PPCBookE_INPUT_CINT       = 6,
+    PPCBookE_INPUT_NB,
 };
 
 enum {
@@ -1134,17 +1367,22 @@ enum {
 };
 
 enum {
-    /* PowerPC 620 (and probably others) input pins */
-    PPC620_INPUT_HRESET     = 0,
-    PPC620_INPUT_SRESET     = 1,
-    PPC620_INPUT_CKSTP      = 2,
-    PPC620_INPUT_TBEN       = 3,
-    PPC620_INPUT_WAKEUP     = 4,
-    PPC620_INPUT_MCP        = 5,
-    PPC620_INPUT_SMI        = 6,
-    PPC620_INPUT_INT        = 7,
+    /* RCPU input pins */
+    PPCRCPU_INPUT_PORESET   = 0,
+    PPCRCPU_INPUT_HRESET    = 1,
+    PPCRCPU_INPUT_SRESET    = 2,
+    PPCRCPU_INPUT_IRQ0      = 3,
+    PPCRCPU_INPUT_IRQ1      = 4,
+    PPCRCPU_INPUT_IRQ2      = 5,
+    PPCRCPU_INPUT_IRQ3      = 6,
+    PPCRCPU_INPUT_IRQ4      = 7,
+    PPCRCPU_INPUT_IRQ5      = 8,
+    PPCRCPU_INPUT_IRQ6      = 9,
+    PPCRCPU_INPUT_IRQ7      = 10,
+    PPCRCPU_INPUT_NB,
 };
 
+#if defined(TARGET_PPC64)
 enum {
     /* PowerPC 970 input pins */
     PPC970_INPUT_HRESET     = 0,
@@ -1154,27 +1392,30 @@ enum {
     PPC970_INPUT_MCP        = 4,
     PPC970_INPUT_INT        = 5,
     PPC970_INPUT_THINT      = 6,
+    PPC970_INPUT_NB,
 };
+#endif
 
 /* Hardware exceptions definitions */
 enum {
     /* External hardware exception sources */
     PPC_INTERRUPT_RESET     = 0,  /* Reset exception                      */
-    PPC_INTERRUPT_MCK       = 1,  /* Machine check exception              */
-    PPC_INTERRUPT_EXT       = 2,  /* External interrupt                   */
-    PPC_INTERRUPT_SMI       = 3,  /* System management interrupt          */
-    PPC_INTERRUPT_CEXT      = 4,  /* Critical external interrupt          */
-    PPC_INTERRUPT_DEBUG     = 5,  /* External debug exception             */
-    PPC_INTERRUPT_THERM     = 6,  /* Thermal exception                    */
+    PPC_INTERRUPT_WAKEUP,         /* Wakeup exception                     */
+    PPC_INTERRUPT_MCK,            /* Machine check exception              */
+    PPC_INTERRUPT_EXT,            /* External interrupt                   */
+    PPC_INTERRUPT_SMI,            /* System management interrupt          */
+    PPC_INTERRUPT_CEXT,           /* Critical external interrupt          */
+    PPC_INTERRUPT_DEBUG,          /* External debug exception             */
+    PPC_INTERRUPT_THERM,          /* Thermal exception                    */
     /* Internal hardware exception sources */
-    PPC_INTERRUPT_DECR      = 7,  /* Decrementer exception                */
-    PPC_INTERRUPT_HDECR     = 8,  /* Hypervisor decrementer exception     */
-    PPC_INTERRUPT_PIT       = 9,  /* Programmable inteval timer interrupt */
-    PPC_INTERRUPT_FIT       = 10, /* Fixed interval timer interrupt       */
-    PPC_INTERRUPT_WDT       = 11, /* Watchdog timer interrupt             */
-    PPC_INTERRUPT_CDOORBELL = 12, /* Critical doorbell interrupt          */
-    PPC_INTERRUPT_DOORBELL  = 13, /* Doorbell interrupt                   */
-    PPC_INTERRUPT_PERFM     = 14, /* Performance monitor interrupt        */
+    PPC_INTERRUPT_DECR,           /* Decrementer exception                */
+    PPC_INTERRUPT_HDECR,          /* Hypervisor decrementer exception     */
+    PPC_INTERRUPT_PIT,            /* Programmable inteval timer interrupt */
+    PPC_INTERRUPT_FIT,            /* Fixed interval timer interrupt       */
+    PPC_INTERRUPT_WDT,            /* Watchdog timer interrupt             */
+    PPC_INTERRUPT_CDOORBELL,      /* Critical doorbell interrupt          */
+    PPC_INTERRUPT_DOORBELL,       /* Doorbell interrupt                   */
+    PPC_INTERRUPT_PERFM,          /* Performance monitor interrupt        */
 };
 
 /*****************************************************************************/
diff --git a/target-ppc/exec.h b/target-ppc/exec.h
index 8a5425827..76fdb0b1d 100644
--- a/target-ppc/exec.h
+++ b/target-ppc/exec.h
@@ -37,13 +37,15 @@ register struct CPUPPCState *env asm(AREG0);
 #define T0 (env->t0)
 #define T1 (env->t1)
 #define T2 (env->t2)
+#define TDX "%016" PRIx64
 #else
 register unsigned long T0 asm(AREG1);
 register unsigned long T1 asm(AREG2);
 register unsigned long T2 asm(AREG3);
+#define TDX "%016lx"
 #endif
-/* We may, sometime, need 64 bits registers on 32 bits target */
-#if TARGET_GPR_BITS > HOST_LONG_BITS
+/* We may, sometime, need 64 bits registers on 32 bits targets */
+#if (HOST_LONG_BITS == 32)
 /* no registers can be used */
 #define T0_64 (env->t0)
 #define T1_64 (env->t1)
@@ -54,9 +56,9 @@ register unsigned long T2 asm(AREG3);
 #define T2_64 T2
 #endif
 /* Provision for Altivec */
-#define T0_avr (env->t0_avr)
-#define T1_avr (env->t1_avr)
-#define T2_avr (env->t2_avr)
+#define AVR0 (env->avr0)
+#define AVR1 (env->avr1)
+#define AVR2 (env->avr2)
 
 #define FT0 (env->ft0)
 #define FT1 (env->ft1)
@@ -68,23 +70,23 @@ register unsigned long T2 asm(AREG3);
 # define RETURN() __asm__ __volatile__("" : : : "memory");
 #endif
 
-static inline target_ulong rotl8 (target_ulong i, int n)
+static always_inline target_ulong rotl8 (target_ulong i, int n)
 {
     return (((uint8_t)i << n) | ((uint8_t)i >> (8 - n)));
 }
 
-static inline target_ulong rotl16 (target_ulong i, int n)
+static always_inline target_ulong rotl16 (target_ulong i, int n)
 {
     return (((uint16_t)i << n) | ((uint16_t)i >> (16 - n)));
 }
 
-static inline target_ulong rotl32 (target_ulong i, int n)
+static always_inline target_ulong rotl32 (target_ulong i, int n)
 {
     return (((uint32_t)i << n) | ((uint32_t)i >> (32 - n)));
 }
 
 #if defined(TARGET_PPC64)
-static inline target_ulong rotl64 (target_ulong i, int n)
+static always_inline target_ulong rotl64 (target_ulong i, int n)
 {
     return (((uint64_t)i << n) | ((uint64_t)i >> (64 - n)));
 }
@@ -98,27 +100,27 @@ void do_raise_exception_err (uint32_t exception, int error_code);
 void do_raise_exception (uint32_t exception);
 
 int get_physical_address (CPUState *env, mmu_ctx_t *ctx, target_ulong vaddr,
-                          int rw, int access_type, int check_BATs);
+                          int rw, int access_type);
 
 void ppc6xx_tlb_store (CPUState *env, target_ulong EPN, int way, int is_code,
                        target_ulong pte0, target_ulong pte1);
 
-static inline void env_to_regs (void)
+static always_inline void env_to_regs (void)
 {
 }
 
-static inline void regs_to_env (void)
+static always_inline void regs_to_env (void)
 {
 }
 
 int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int is_user, int is_softmmu);
+                              int mmu_idx, int is_softmmu);
 
-static inline int cpu_halted (CPUState *env)
+static always_inline int cpu_halted (CPUState *env)
 {
     if (!env->halted)
         return 0;
-    if (env->msr[MSR_EE] && (env->interrupt_request & CPU_INTERRUPT_HARD)) {
+    if (msr_ee && (env->interrupt_request & CPU_INTERRUPT_HARD)) {
         env->halted = 0;
         return 0;
     }
diff --git a/target-ppc/helper.c b/target-ppc/helper.c
index 5b0fd09b9..a808454a2 100644
--- a/target-ppc/helper.c
+++ b/target-ppc/helper.c
@@ -27,10 +27,13 @@
 
 #include "cpu.h"
 #include "exec-all.h"
+#include "helper_regs.h"
 
 //#define DEBUG_MMU
 //#define DEBUG_BATS
+//#define DEBUG_SLB
 //#define DEBUG_SOFTWARE_TLB
+//#define DUMP_PAGE_TABLES
 //#define DEBUG_EXCEPTIONS
 //#define FLUSH_ALL_TLBS
 
@@ -39,16 +42,16 @@
 
 #if defined(CONFIG_USER_ONLY)
 int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int is_user, int is_softmmu)
+                              int mmu_idx, int is_softmmu)
 {
     int exception, error_code;
 
     if (rw == 2) {
         exception = POWERPC_EXCP_ISI;
-        error_code = 0;
+        error_code = 0x40000000;
     } else {
         exception = POWERPC_EXCP_DSI;
-        error_code = 0;
+        error_code = 0x40000000;
         if (rw)
             error_code |= 0x02000000;
         env->spr[SPR_DAR] = address;
@@ -67,23 +70,23 @@ target_phys_addr_t cpu_get_phys_page_debug (CPUState *env, target_ulong addr)
 
 #else
 /* Common routines used by software and hardware TLBs emulation */
-static inline int pte_is_valid (target_ulong pte0)
+static always_inline int pte_is_valid (target_ulong pte0)
 {
     return pte0 & 0x80000000 ? 1 : 0;
 }
 
-static inline void pte_invalidate (target_ulong *pte0)
+static always_inline void pte_invalidate (target_ulong *pte0)
 {
     *pte0 &= ~0x80000000;
 }
 
 #if defined(TARGET_PPC64)
-static inline int pte64_is_valid (target_ulong pte0)
+static always_inline int pte64_is_valid (target_ulong pte0)
 {
     return pte0 & 0x0000000000000001ULL ? 1 : 0;
 }
 
-static inline void pte64_invalidate (target_ulong *pte0)
+static always_inline void pte64_invalidate (target_ulong *pte0)
 {
     *pte0 &= ~0x0000000000000001ULL;
 }
@@ -96,12 +99,76 @@ static inline void pte64_invalidate (target_ulong *pte0)
 #define PTE64_CHECK_MASK (TARGET_PAGE_MASK | 0x7F)
 #endif
 
-static inline int _pte_check (mmu_ctx_t *ctx, int is_64b,
-                              target_ulong pte0, target_ulong pte1,
-                              int h, int rw)
+static always_inline int pp_check (int key, int pp, int nx)
+{
+    int access;
+
+    /* Compute access rights */
+    /* When pp is 3/7, the result is undefined. Set it to noaccess */
+    access = 0;
+    if (key == 0) {
+        switch (pp) {
+        case 0x0:
+        case 0x1:
+        case 0x2:
+            access |= PAGE_WRITE;
+            /* No break here */
+        case 0x3:
+        case 0x6:
+            access |= PAGE_READ;
+            break;
+        }
+    } else {
+        switch (pp) {
+        case 0x0:
+        case 0x6:
+            access = 0;
+            break;
+        case 0x1:
+        case 0x3:
+            access = PAGE_READ;
+            break;
+        case 0x2:
+            access = PAGE_READ | PAGE_WRITE;
+            break;
+        }
+    }
+    if (nx == 0)
+        access |= PAGE_EXEC;
+
+    return access;
+}
+
+static always_inline int check_prot (int prot, int rw, int access_type)
+{
+    int ret;
+
+    if (access_type == ACCESS_CODE) {
+        if (prot & PAGE_EXEC)
+            ret = 0;
+        else
+            ret = -2;
+    } else if (rw) {
+        if (prot & PAGE_WRITE)
+            ret = 0;
+        else
+            ret = -2;
+    } else {
+        if (prot & PAGE_READ)
+            ret = 0;
+        else
+            ret = -2;
+    }
+
+    return ret;
+}
+
+static always_inline int _pte_check (mmu_ctx_t *ctx, int is_64b,
+                                     target_ulong pte0, target_ulong pte1,
+                                     int h, int rw, int type)
 {
     target_ulong ptem, mmask;
-    int access, ret, pteh, ptev;
+    int access, ret, pteh, ptev, pp;
 
     access = 0;
     ret = -1;
@@ -122,14 +189,18 @@ static inline int _pte_check (mmu_ctx_t *ctx, int is_64b,
         if (is_64b) {
             ptem = pte0 & PTE64_PTEM_MASK;
             mmask = PTE64_CHECK_MASK;
+            pp = (pte1 & 0x00000003) | ((pte1 >> 61) & 0x00000004);
+            ctx->nx |= (pte1 >> 2) & 1; /* No execute bit */
+            ctx->nx |= (pte1 >> 3) & 1; /* Guarded bit    */
         } else
 #endif
         {
             ptem = pte0 & PTE_PTEM_MASK;
             mmask = PTE_CHECK_MASK;
+            pp = pte1 & 0x00000003;
         }
         if (ptem == ctx->ptem) {
-            if (ctx->raddr != (target_ulong)-1) {
+            if (ctx->raddr != (target_phys_addr_t)-1ULL) {
                 /* all matches should have equal RPN, WIMG & PP */
                 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
                     if (loglevel != 0)
@@ -138,42 +209,23 @@ static inline int _pte_check (mmu_ctx_t *ctx, int is_64b,
                 }
             }
             /* Compute access rights */
-            if (ctx->key == 0) {
-                access = PAGE_READ;
-                if ((pte1 & 0x00000003) != 0x3)
-                    access |= PAGE_WRITE;
-            } else {
-                switch (pte1 & 0x00000003) {
-                case 0x0:
-                    access = 0;
-                    break;
-                case 0x1:
-                case 0x3:
-                    access = PAGE_READ;
-                    break;
-                case 0x2:
-                    access = PAGE_READ | PAGE_WRITE;
-                    break;
-                }
-            }
+            access = pp_check(ctx->key, pp, ctx->nx);
             /* Keep the matching PTE informations */
             ctx->raddr = pte1;
             ctx->prot = access;
-            if ((rw == 0 && (access & PAGE_READ)) ||
-                (rw == 1 && (access & PAGE_WRITE))) {
+            ret = check_prot(ctx->prot, rw, type);
+            if (ret == 0) {
                 /* Access granted */
 #if defined (DEBUG_MMU)
                 if (loglevel != 0)
                     fprintf(logfile, "PTE access granted !\n");
 #endif
-                ret = 0;
             } else {
                 /* Access right violation */
 #if defined (DEBUG_MMU)
                 if (loglevel != 0)
                     fprintf(logfile, "PTE access rejected\n");
 #endif
-                ret = -2;
             }
         }
     }
@@ -181,22 +233,24 @@ static inline int _pte_check (mmu_ctx_t *ctx, int is_64b,
     return ret;
 }
 
-static int pte32_check (mmu_ctx_t *ctx,
-                        target_ulong pte0, target_ulong pte1, int h, int rw)
+static always_inline int pte32_check (mmu_ctx_t *ctx,
+                                      target_ulong pte0, target_ulong pte1,
+                                      int h, int rw, int type)
 {
-    return _pte_check(ctx, 0, pte0, pte1, h, rw);
+    return _pte_check(ctx, 0, pte0, pte1, h, rw, type);
 }
 
 #if defined(TARGET_PPC64)
-static int pte64_check (mmu_ctx_t *ctx,
-                        target_ulong pte0, target_ulong pte1, int h, int rw)
+static always_inline int pte64_check (mmu_ctx_t *ctx,
+                                      target_ulong pte0, target_ulong pte1,
+                                      int h, int rw, int type)
 {
-    return _pte_check(ctx, 1, pte0, pte1, h, rw);
+    return _pte_check(ctx, 1, pte0, pte1, h, rw, type);
 }
 #endif
 
-static int pte_update_flags (mmu_ctx_t *ctx, target_ulong *pte1p,
-                             int ret, int rw)
+static always_inline int pte_update_flags (mmu_ctx_t *ctx, target_ulong *pte1p,
+                                           int ret, int rw)
 {
     int store = 0;
 
@@ -221,8 +275,8 @@ static int pte_update_flags (mmu_ctx_t *ctx, target_ulong *pte1p,
 }
 
 /* Software driven TLB helpers */
-static int ppc6xx_tlb_getnum (CPUState *env, target_ulong eaddr,
-                              int way, int is_code)
+static always_inline int ppc6xx_tlb_getnum (CPUState *env, target_ulong eaddr,
+                                            int way, int is_code)
 {
     int nr;
 
@@ -237,7 +291,7 @@ static int ppc6xx_tlb_getnum (CPUState *env, target_ulong eaddr,
     return nr;
 }
 
-static void ppc6xx_tlb_invalidate_all (CPUState *env)
+static always_inline void ppc6xx_tlb_invalidate_all (CPUState *env)
 {
     ppc6xx_tlb_t *tlb;
     int nr, max;
@@ -258,9 +312,10 @@ static void ppc6xx_tlb_invalidate_all (CPUState *env)
     tlb_flush(env, 1);
 }
 
-static inline void __ppc6xx_tlb_invalidate_virt (CPUState *env,
-                                                 target_ulong eaddr,
-                                                 int is_code, int match_epn)
+static always_inline void __ppc6xx_tlb_invalidate_virt (CPUState *env,
+                                                        target_ulong eaddr,
+                                                        int is_code,
+                                                        int match_epn)
 {
 #if !defined(FLUSH_ALL_TLBS)
     ppc6xx_tlb_t *tlb;
@@ -287,8 +342,9 @@ static inline void __ppc6xx_tlb_invalidate_virt (CPUState *env,
 #endif
 }
 
-static void ppc6xx_tlb_invalidate_virt (CPUState *env, target_ulong eaddr,
-                                        int is_code)
+static always_inline void ppc6xx_tlb_invalidate_virt (CPUState *env,
+                                                      target_ulong eaddr,
+                                                      int is_code)
 {
     __ppc6xx_tlb_invalidate_virt(env, eaddr, is_code, 0);
 }
@@ -316,8 +372,9 @@ void ppc6xx_tlb_store (CPUState *env, target_ulong EPN, int way, int is_code,
     env->last_way = way;
 }
 
-static int ppc6xx_tlb_check (CPUState *env, mmu_ctx_t *ctx,
-                             target_ulong eaddr, int rw, int access_type)
+static always_inline int ppc6xx_tlb_check (CPUState *env, mmu_ctx_t *ctx,
+                                           target_ulong eaddr, int rw,
+                                           int access_type)
 {
     ppc6xx_tlb_t *tlb;
     int nr, best, way;
@@ -352,7 +409,7 @@ static int ppc6xx_tlb_check (CPUState *env, mmu_ctx_t *ctx,
                     rw ? 'S' : 'L', access_type == ACCESS_CODE ? 'I' : 'D');
         }
 #endif
-        switch (pte32_check(ctx, tlb->pte0, tlb->pte1, 0, rw)) {
+        switch (pte32_check(ctx, tlb->pte0, tlb->pte1, 0, rw, access_type)) {
         case -3:
             /* TLB inconsistency */
             return -1;
@@ -380,7 +437,7 @@ static int ppc6xx_tlb_check (CPUState *env, mmu_ctx_t *ctx,
     done:
 #if defined (DEBUG_SOFTWARE_TLB)
         if (loglevel != 0) {
-            fprintf(logfile, "found TLB at addr 0x%08lx prot=0x%01x ret=%d\n",
+            fprintf(logfile, "found TLB at addr " PADDRX " prot=%01x ret=%d\n",
                     ctx->raddr & TARGET_PAGE_MASK, ctx->prot, ret);
         }
 #endif
@@ -392,17 +449,72 @@ static int ppc6xx_tlb_check (CPUState *env, mmu_ctx_t *ctx,
 }
 
 /* Perform BAT hit & translation */
-static int get_bat (CPUState *env, mmu_ctx_t *ctx,
-                    target_ulong virtual, int rw, int type)
+static always_inline void bat_size_prot (CPUState *env, target_ulong *blp,
+                                         int *validp, int *protp,
+                                         target_ulong *BATu, target_ulong *BATl)
+{
+    target_ulong bl;
+    int pp, valid, prot;
+
+    bl = (*BATu & 0x00001FFC) << 15;
+    valid = 0;
+    prot = 0;
+    if (((msr_pr == 0) && (*BATu & 0x00000002)) ||
+        ((msr_pr != 0) && (*BATu & 0x00000001))) {
+        valid = 1;
+        pp = *BATl & 0x00000003;
+        if (pp != 0) {
+            prot = PAGE_READ | PAGE_EXEC;
+            if (pp == 0x2)
+                prot |= PAGE_WRITE;
+        }
+    }
+    *blp = bl;
+    *validp = valid;
+    *protp = prot;
+}
+
+static always_inline void bat_601_size_prot (CPUState *env,target_ulong *blp,
+                                             int *validp, int *protp,
+                                             target_ulong *BATu,
+                                             target_ulong *BATl)
+{
+    target_ulong bl;
+    int key, pp, valid, prot;
+
+    bl = (*BATl & 0x0000003F) << 17;
+#if defined (DEBUG_BATS)
+    if (loglevel != 0) {
+        fprintf(logfile, "b %02x ==> bl " ADDRX " msk " ADDRX "\n",
+                (uint8_t)(*BATl & 0x0000003F), bl, ~bl);
+    }
+#endif
+    prot = 0;
+    valid = (*BATl >> 6) & 1;
+    if (valid) {
+        pp = *BATu & 0x00000003;
+        if (msr_pr == 0)
+            key = (*BATu >> 3) & 1;
+        else
+            key = (*BATu >> 2) & 1;
+        prot = pp_check(key, pp, 0);
+    }
+    *blp = bl;
+    *validp = valid;
+    *protp = prot;
+}
+
+static always_inline int get_bat (CPUState *env, mmu_ctx_t *ctx,
+                                  target_ulong virtual, int rw, int type)
 {
     target_ulong *BATlt, *BATut, *BATu, *BATl;
     target_ulong base, BEPIl, BEPIu, bl;
-    int i;
+    int i, valid, prot;
     int ret = -1;
 
 #if defined (DEBUG_BATS)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: %cBAT v 0x" ADDRX "\n", __func__,
+        fprintf(logfile, "%s: %cBAT v " ADDRX "\n", __func__,
                 type == ACCESS_CODE ? 'I' : 'D', virtual);
     }
 #endif
@@ -416,49 +528,42 @@ static int get_bat (CPUState *env, mmu_ctx_t *ctx,
         BATut = env->DBAT[0];
         break;
     }
-#if defined (DEBUG_BATS)
-    if (loglevel != 0) {
-        fprintf(logfile, "%s...: %cBAT v 0x" ADDRX "\n", __func__,
-                type == ACCESS_CODE ? 'I' : 'D', virtual);
-    }
-#endif
     base = virtual & 0xFFFC0000;
-    for (i = 0; i < 4; i++) {
+    for (i = 0; i < env->nb_BATs; i++) {
         BATu = &BATut[i];
         BATl = &BATlt[i];
         BEPIu = *BATu & 0xF0000000;
         BEPIl = *BATu & 0x0FFE0000;
-        bl = (*BATu & 0x00001FFC) << 15;
+        if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
+            bat_601_size_prot(env, &bl, &valid, &prot, BATu, BATl);
+        } else {
+            bat_size_prot(env, &bl, &valid, &prot, BATu, BATl);
+        }
 #if defined (DEBUG_BATS)
         if (loglevel != 0) {
-            fprintf(logfile, "%s: %cBAT%d v 0x" ADDRX " BATu 0x" ADDRX
-                    " BATl 0x" ADDRX "\n",
-                    __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
-                    *BATu, *BATl);
+            fprintf(logfile, "%s: %cBAT%d v " ADDRX " BATu " ADDRX
+                    " BATl " ADDRX "\n", __func__,
+                    type == ACCESS_CODE ? 'I' : 'D', i, virtual, *BATu, *BATl);
         }
 #endif
         if ((virtual & 0xF0000000) == BEPIu &&
             ((virtual & 0x0FFE0000) & ~bl) == BEPIl) {
             /* BAT matches */
-            if ((msr_pr == 0 && (*BATu & 0x00000002)) ||
-                (msr_pr == 1 && (*BATu & 0x00000001))) {
+            if (valid != 0) {
                 /* Get physical address */
                 ctx->raddr = (*BATl & 0xF0000000) |
                     ((virtual & 0x0FFE0000 & bl) | (*BATl & 0x0FFE0000)) |
                     (virtual & 0x0001F000);
-                if (*BATl & 0x00000001)
-                    ctx->prot = PAGE_READ;
-                if (*BATl & 0x00000002)
-                    ctx->prot = PAGE_WRITE | PAGE_READ;
+                /* Compute access rights */
+                ctx->prot = prot;
+                ret = check_prot(ctx->prot, rw, type);
 #if defined (DEBUG_BATS)
-                if (loglevel != 0) {
-                    fprintf(logfile, "BAT %d match: r 0x" PADDRX
-                            " prot=%c%c\n",
+                if (ret == 0 && loglevel != 0) {
+                    fprintf(logfile, "BAT %d match: r " PADDRX " prot=%c%c\n",
                             i, ctx->raddr, ctx->prot & PAGE_READ ? 'R' : '-',
                             ctx->prot & PAGE_WRITE ? 'W' : '-');
                 }
 #endif
-                ret = 0;
                 break;
             }
         }
@@ -466,28 +571,29 @@ static int get_bat (CPUState *env, mmu_ctx_t *ctx,
     if (ret < 0) {
 #if defined (DEBUG_BATS)
         if (loglevel != 0) {
-            fprintf(logfile, "no BAT match for 0x" ADDRX ":\n", virtual);
+            fprintf(logfile, "no BAT match for " ADDRX ":\n", virtual);
             for (i = 0; i < 4; i++) {
                 BATu = &BATut[i];
                 BATl = &BATlt[i];
                 BEPIu = *BATu & 0xF0000000;
                 BEPIl = *BATu & 0x0FFE0000;
                 bl = (*BATu & 0x00001FFC) << 15;
-                fprintf(logfile, "%s: %cBAT%d v 0x" ADDRX " BATu 0x" ADDRX
-                        " BATl 0x" ADDRX " \n\t"
-                        "0x" ADDRX " 0x" ADDRX " 0x" ADDRX "\n",
+                fprintf(logfile, "%s: %cBAT%d v " ADDRX " BATu " ADDRX
+                        " BATl " ADDRX " \n\t" ADDRX " " ADDRX " " ADDRX "\n",
                         __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
                         *BATu, *BATl, BEPIu, BEPIl, bl);
             }
         }
 #endif
     }
+
     /* No hit */
     return ret;
 }
 
 /* PTE table lookup */
-static inline int _find_pte (mmu_ctx_t *ctx, int is_64b, int h, int rw)
+static always_inline int _find_pte (mmu_ctx_t *ctx, int is_64b, int h,
+                                    int rw, int type)
 {
     target_ulong base, pte0, pte1;
     int i, good = -1;
@@ -500,22 +606,32 @@ static inline int _find_pte (mmu_ctx_t *ctx, int is_64b, int h, int rw)
         if (is_64b) {
             pte0 = ldq_phys(base + (i * 16));
             pte1 =  ldq_phys(base + (i * 16) + 8);
-            r = pte64_check(ctx, pte0, pte1, h, rw);
+            r = pte64_check(ctx, pte0, pte1, h, rw, type);
+#if defined (DEBUG_MMU)
+            if (loglevel != 0) {
+                fprintf(logfile, "Load pte from " ADDRX " => " ADDRX " " ADDRX
+                        " %d %d %d " ADDRX "\n",
+                        base + (i * 16), pte0, pte1,
+                        (int)(pte0 & 1), h, (int)((pte0 >> 1) & 1),
+                        ctx->ptem);
+            }
+#endif
         } else
 #endif
         {
             pte0 = ldl_phys(base + (i * 8));
             pte1 =  ldl_phys(base + (i * 8) + 4);
-            r = pte32_check(ctx, pte0, pte1, h, rw);
-        }
+            r = pte32_check(ctx, pte0, pte1, h, rw, type);
 #if defined (DEBUG_MMU)
-        if (loglevel != 0) {
-            fprintf(logfile, "Load pte from 0x" ADDRX " => 0x" ADDRX
-                    " 0x" ADDRX " %d %d %d 0x" ADDRX "\n",
-                    base + (i * 8), pte0, pte1,
-                    (int)(pte0 >> 31), h, (int)((pte0 >> 6) & 1), ctx->ptem);
-        }
+            if (loglevel != 0) {
+                fprintf(logfile, "Load pte from " ADDRX " => " ADDRX " " ADDRX
+                        " %d %d %d " ADDRX "\n",
+                        base + (i * 8), pte0, pte1,
+                        (int)(pte0 >> 31), h, (int)((pte0 >> 6) & 1),
+                        ctx->ptem);
+            }
 #endif
+        }
         switch (r) {
         case -3:
             /* PTE inconsistency */
@@ -544,8 +660,7 @@ static inline int _find_pte (mmu_ctx_t *ctx, int is_64b, int h, int rw)
     done:
 #if defined (DEBUG_MMU)
         if (loglevel != 0) {
-            fprintf(logfile, "found PTE at addr 0x" PADDRX " prot=0x%01x "
-                    "ret=%d\n",
+            fprintf(logfile, "found PTE at addr " PADDRX " prot=%01x ret=%d\n",
                     ctx->raddr, ctx->prot, ret);
         }
 #endif
@@ -566,59 +681,69 @@ static inline int _find_pte (mmu_ctx_t *ctx, int is_64b, int h, int rw)
     return ret;
 }
 
-static int find_pte32 (mmu_ctx_t *ctx, int h, int rw)
+static always_inline int find_pte32 (mmu_ctx_t *ctx, int h, int rw, int type)
 {
-    return _find_pte(ctx, 0, h, rw);
+    return _find_pte(ctx, 0, h, rw, type);
 }
 
 #if defined(TARGET_PPC64)
-static int find_pte64 (mmu_ctx_t *ctx, int h, int rw)
+static always_inline int find_pte64 (mmu_ctx_t *ctx, int h, int rw, int type)
 {
-    return _find_pte(ctx, 1, h, rw);
+    return _find_pte(ctx, 1, h, rw, type);
 }
 #endif
 
-static inline int find_pte (CPUState *env, mmu_ctx_t *ctx, int h, int rw)
+static always_inline int find_pte (CPUState *env, mmu_ctx_t *ctx,
+                                   int h, int rw, int type)
 {
 #if defined(TARGET_PPC64)
-    if (env->mmu_model == POWERPC_MMU_64B ||
-        env->mmu_model == POWERPC_MMU_64BRIDGE)
-        return find_pte64(ctx, h, rw);
+    if (env->mmu_model & POWERPC_MMU_64)
+        return find_pte64(ctx, h, rw, type);
 #endif
 
-    return find_pte32(ctx, h, rw);
+    return find_pte32(ctx, h, rw, type);
+}
+
+#if defined(TARGET_PPC64)
+static always_inline int slb_is_valid (uint64_t slb64)
+{
+    return slb64 & 0x0000000008000000ULL ? 1 : 0;
 }
 
-static inline target_phys_addr_t get_pgaddr (target_phys_addr_t sdr1,
-                                             int sdr_sh,
-                                             target_phys_addr_t hash,
-                                             target_phys_addr_t mask)
+static always_inline void slb_invalidate (uint64_t *slb64)
 {
-    return (sdr1 & ((target_ulong)(-1ULL) << sdr_sh)) | (hash & mask);
+    *slb64 &= ~0x0000000008000000ULL;
 }
 
-#if defined(TARGET_PPC64)
-static int slb_lookup (CPUState *env, target_ulong eaddr,
-                       target_ulong *vsid, target_ulong *page_mask, int *attr)
+static always_inline int slb_lookup (CPUPPCState *env, target_ulong eaddr,
+                                     target_ulong *vsid,
+                                     target_ulong *page_mask, int *attr)
 {
     target_phys_addr_t sr_base;
     target_ulong mask;
     uint64_t tmp64;
     uint32_t tmp;
     int n, ret;
-    int slb_nr;
 
     ret = -5;
     sr_base = env->spr[SPR_ASR];
-    mask = 0x0000000000000000ULL; /* Avoid gcc warning */
-#if 0 /* XXX: Fix this */
-    slb_nr = env->slb_nr;
-#else
-    slb_nr = 32;
+#if defined(DEBUG_SLB)
+    if (loglevel != 0) {
+        fprintf(logfile, "%s: eaddr " ADDRX " base " PADDRX "\n",
+                __func__, eaddr, sr_base);
+    }
 #endif
-    for (n = 0; n < slb_nr; n++) {
+    mask = 0x0000000000000000ULL; /* Avoid gcc warning */
+    for (n = 0; n < env->slb_nr; n++) {
         tmp64 = ldq_phys(sr_base);
-        if (tmp64 & 0x0000000008000000ULL) {
+        tmp = ldl_phys(sr_base + 8);
+#if defined(DEBUG_SLB)
+        if (loglevel != 0) {
+            fprintf(logfile, "%s: seg %d " PADDRX " %016" PRIx64 " %08"
+                    PRIx32 "\n", __func__, n, sr_base, tmp64, tmp);
+        }
+#endif
+        if (slb_is_valid(tmp64)) {
             /* SLB entry is valid */
             switch (tmp64 & 0x0000000006000000ULL) {
             case 0x0000000000000000ULL:
@@ -636,11 +761,10 @@ static int slb_lookup (CPUState *env, target_ulong eaddr,
             }
             if ((eaddr & mask) == (tmp64 & mask)) {
                 /* SLB match */
-                tmp = ldl_phys(sr_base + 8);
                 *vsid = ((tmp64 << 24) | (tmp >> 8)) & 0x0003FFFFFFFFFFFFULL;
                 *page_mask = ~mask;
                 *attr = tmp & 0xFF;
-                ret = 0;
+                ret = n;
                 break;
             }
         }
@@ -649,30 +773,154 @@ static int slb_lookup (CPUState *env, target_ulong eaddr,
 
     return ret;
 }
+
+void ppc_slb_invalidate_all (CPUPPCState *env)
+{
+    target_phys_addr_t sr_base;
+    uint64_t tmp64;
+    int n, do_invalidate;
+
+    do_invalidate = 0;
+    sr_base = env->spr[SPR_ASR];
+    /* XXX: Warning: slbia never invalidates the first segment */
+    for (n = 1; n < env->slb_nr; n++) {
+        tmp64 = ldq_phys(sr_base);
+        if (slb_is_valid(tmp64)) {
+            slb_invalidate(&tmp64);
+            stq_phys(sr_base, tmp64);
+            /* XXX: given the fact that segment size is 256 MB or 1TB,
+             *      and we still don't have a tlb_flush_mask(env, n, mask)
+             *      in Qemu, we just invalidate all TLBs
+             */
+            do_invalidate = 1;
+        }
+        sr_base += 12;
+    }
+    if (do_invalidate)
+        tlb_flush(env, 1);
+}
+
+void ppc_slb_invalidate_one (CPUPPCState *env, uint64_t T0)
+{
+    target_phys_addr_t sr_base;
+    target_ulong vsid, page_mask;
+    uint64_t tmp64;
+    int attr;
+    int n;
+
+    n = slb_lookup(env, T0, &vsid, &page_mask, &attr);
+    if (n >= 0) {
+        sr_base = env->spr[SPR_ASR];
+        sr_base += 12 * n;
+        tmp64 = ldq_phys(sr_base);
+        if (slb_is_valid(tmp64)) {
+            slb_invalidate(&tmp64);
+            stq_phys(sr_base, tmp64);
+            /* XXX: given the fact that segment size is 256 MB or 1TB,
+             *      and we still don't have a tlb_flush_mask(env, n, mask)
+             *      in Qemu, we just invalidate all TLBs
+             */
+            tlb_flush(env, 1);
+        }
+    }
+}
+
+target_ulong ppc_load_slb (CPUPPCState *env, int slb_nr)
+{
+    target_phys_addr_t sr_base;
+    target_ulong rt;
+    uint64_t tmp64;
+    uint32_t tmp;
+
+    sr_base = env->spr[SPR_ASR];
+    sr_base += 12 * slb_nr;
+    tmp64 = ldq_phys(sr_base);
+    tmp = ldl_phys(sr_base + 8);
+    if (tmp64 & 0x0000000008000000ULL) {
+        /* SLB entry is valid */
+        /* Copy SLB bits 62:88 to Rt 37:63 (VSID 23:49) */
+        rt = tmp >> 8;             /* 65:88 => 40:63 */
+        rt |= (tmp64 & 0x7) << 24; /* 62:64 => 37:39 */
+        /* Copy SLB bits 89:92 to Rt 33:36 (KsKpNL) */
+        rt |= ((tmp >> 4) & 0xF) << 27;
+    } else {
+        rt = 0;
+    }
+#if defined(DEBUG_SLB)
+    if (loglevel != 0) {
+        fprintf(logfile, "%s: " PADDRX " %016" PRIx64 " %08" PRIx32 " => %d "
+                ADDRX "\n", __func__, sr_base, tmp64, tmp, slb_nr, rt);
+    }
+#endif
+
+    return rt;
+}
+
+void ppc_store_slb (CPUPPCState *env, int slb_nr, target_ulong rs)
+{
+    target_phys_addr_t sr_base;
+    uint64_t tmp64;
+    uint32_t tmp;
+
+    sr_base = env->spr[SPR_ASR];
+    sr_base += 12 * slb_nr;
+    /* Copy Rs bits 37:63 to SLB 62:88 */
+    tmp = rs << 8;
+    tmp64 = (rs >> 24) & 0x7;
+    /* Copy Rs bits 33:36 to SLB 89:92 */
+    tmp |= ((rs >> 27) & 0xF) << 4;
+    /* Set the valid bit */
+    tmp64 |= 1 << 27;
+    /* Set ESID */
+    tmp64 |= (uint32_t)slb_nr << 28;
+#if defined(DEBUG_SLB)
+    if (loglevel != 0) {
+        fprintf(logfile, "%s: %d " ADDRX " => " PADDRX " %016" PRIx64
+                " %08" PRIx32 "\n", __func__,
+                slb_nr, rs, sr_base, tmp64, tmp);
+    }
+#endif
+    /* Write SLB entry to memory */
+    stq_phys(sr_base, tmp64);
+    stl_phys(sr_base + 8, tmp);
+}
 #endif /* defined(TARGET_PPC64) */
 
 /* Perform segment based translation */
-static int get_segment (CPUState *env, mmu_ctx_t *ctx,
-                        target_ulong eaddr, int rw, int type)
+static always_inline target_phys_addr_t get_pgaddr (target_phys_addr_t sdr1,
+                                                    int sdr_sh,
+                                                    target_phys_addr_t hash,
+                                                    target_phys_addr_t mask)
+{
+    return (sdr1 & ((target_phys_addr_t)(-1ULL) << sdr_sh)) | (hash & mask);
+}
+
+static always_inline int get_segment (CPUState *env, mmu_ctx_t *ctx,
+                                      target_ulong eaddr, int rw, int type)
 {
-    target_phys_addr_t sdr, hash, mask, sdr_mask;
+    target_phys_addr_t sdr, hash, mask, sdr_mask, htab_mask;
     target_ulong sr, vsid, vsid_mask, pgidx, page_mask;
 #if defined(TARGET_PPC64)
     int attr;
 #endif
-    int ds, nx, vsid_sh, sdr_sh;
+    int ds, vsid_sh, sdr_sh, pr;
     int ret, ret2;
 
+    pr = msr_pr;
 #if defined(TARGET_PPC64)
-    if (env->mmu_model == POWERPC_MMU_64B ||
-        env->mmu_model == POWERPC_MMU_64BRIDGE) {
+    if (env->mmu_model & POWERPC_MMU_64) {
+#if defined (DEBUG_MMU)
+        if (loglevel != 0) {
+            fprintf(logfile, "Check SLBs\n");
+        }
+#endif
         ret = slb_lookup(env, eaddr, &vsid, &page_mask, &attr);
         if (ret < 0)
             return ret;
-        ctx->key = ((attr & 0x40) && msr_pr == 1) ||
-            ((attr & 0x80) && msr_pr == 0) ? 1 : 0;
+        ctx->key = ((attr & 0x40) && (pr != 0)) ||
+            ((attr & 0x80) && (pr == 0)) ? 1 : 0;
         ds = 0;
-        nx = attr & 0x20 ? 1 : 0;
+        ctx->nx = attr & 0x20 ? 1 : 0;
         vsid_mask = 0x00003FFFFFFFFF80ULL;
         vsid_sh = 7;
         sdr_sh = 18;
@@ -682,10 +930,10 @@ static int get_segment (CPUState *env, mmu_ctx_t *ctx,
     {
         sr = env->sr[eaddr >> 28];
         page_mask = 0x0FFFFFFF;
-        ctx->key = (((sr & 0x20000000) && msr_pr == 1) ||
-                    ((sr & 0x40000000) && msr_pr == 0)) ? 1 : 0;
+        ctx->key = (((sr & 0x20000000) && (pr != 0)) ||
+                    ((sr & 0x40000000) && (pr == 0))) ? 1 : 0;
         ds = sr & 0x80000000 ? 1 : 0;
-        nx = sr & 0x10000000 ? 1 : 0;
+        ctx->nx = sr & 0x10000000 ? 1 : 0;
         vsid = sr & 0x00FFFFFF;
         vsid_mask = 0x01FFFFC0;
         vsid_sh = 6;
@@ -693,35 +941,60 @@ static int get_segment (CPUState *env, mmu_ctx_t *ctx,
         sdr_mask = 0xFFC0;
 #if defined (DEBUG_MMU)
         if (loglevel != 0) {
-            fprintf(logfile, "Check segment v=0x" ADDRX " %d 0x" ADDRX
-                    " nip=0x" ADDRX " lr=0x" ADDRX
-                    " ir=%d dr=%d pr=%d %d t=%d\n",
+            fprintf(logfile, "Check segment v=" ADDRX " %d " ADDRX
+                    " nip=" ADDRX " lr=" ADDRX " ir=%d dr=%d pr=%d %d t=%d\n",
                     eaddr, (int)(eaddr >> 28), sr, env->nip,
-                    env->lr, msr_ir, msr_dr, msr_pr, rw, type);
-        }
-        if (!ds && loglevel != 0) {
-            fprintf(logfile, "pte segment: key=%d n=0x" ADDRX "\n",
-                    ctx->key, sr & 0x10000000);
+                    env->lr, (int)msr_ir, (int)msr_dr, pr != 0 ? 1 : 0,
+                    rw, type);
         }
 #endif
     }
+#if defined (DEBUG_MMU)
+    if (loglevel != 0) {
+        fprintf(logfile, "pte segment: key=%d ds %d nx %d vsid " ADDRX "\n",
+                ctx->key, ds, ctx->nx, vsid);
+    }
+#endif
     ret = -1;
     if (!ds) {
         /* Check if instruction fetch is allowed, if needed */
-        if (type != ACCESS_CODE || nx == 0) {
+        if (type != ACCESS_CODE || ctx->nx == 0) {
             /* Page address translation */
-            pgidx = (eaddr & page_mask) >> TARGET_PAGE_BITS;
-            hash = ((vsid ^ pgidx) << vsid_sh) & vsid_mask;
             /* Primary table address */
             sdr = env->sdr1;
-            mask = ((sdr & 0x000001FF) << sdr_sh) | sdr_mask;
+            pgidx = (eaddr & page_mask) >> TARGET_PAGE_BITS;
+#if defined(TARGET_PPC64)
+            if (env->mmu_model & POWERPC_MMU_64) {
+                htab_mask = 0x0FFFFFFF >> (28 - (sdr & 0x1F));
+                /* XXX: this is false for 1 TB segments */
+                hash = ((vsid ^ pgidx) << vsid_sh) & vsid_mask;
+            } else
+#endif
+            {
+                htab_mask = sdr & 0x000001FF;
+                hash = ((vsid ^ pgidx) << vsid_sh) & vsid_mask;
+            }
+            mask = (htab_mask << sdr_sh) | sdr_mask;
+#if defined (DEBUG_MMU)
+            if (loglevel != 0) {
+                fprintf(logfile, "sdr " PADDRX " sh %d hash " PADDRX
+                        " mask " PADDRX " " ADDRX "\n",
+                        sdr, sdr_sh, hash, mask, page_mask);
+            }
+#endif
             ctx->pg_addr[0] = get_pgaddr(sdr, sdr_sh, hash, mask);
             /* Secondary table address */
             hash = (~hash) & vsid_mask;
+#if defined (DEBUG_MMU)
+            if (loglevel != 0) {
+                fprintf(logfile, "sdr " PADDRX " sh %d hash " PADDRX
+                        " mask " PADDRX "\n",
+                        sdr, sdr_sh, hash, mask);
+            }
+#endif
             ctx->pg_addr[1] = get_pgaddr(sdr, sdr_sh, hash, mask);
 #if defined(TARGET_PPC64)
-            if (env->mmu_model == POWERPC_MMU_64B ||
-                env->mmu_model == POWERPC_MMU_64BRIDGE) {
+            if (env->mmu_model & POWERPC_MMU_64) {
                 /* Only 5 bits of the page index are used in the AVPN */
                 ctx->ptem = (vsid << 12) | ((pgidx >> 4) & 0x0F80);
             } else
@@ -730,7 +1003,7 @@ static int get_segment (CPUState *env, mmu_ctx_t *ctx,
                 ctx->ptem = (vsid << 7) | (pgidx >> 10);
             }
             /* Initialize real address with an invalid value */
-            ctx->raddr = (target_ulong)-1;
+            ctx->raddr = (target_phys_addr_t)-1ULL;
             if (unlikely(env->mmu_model == POWERPC_MMU_SOFT_6xx ||
                          env->mmu_model == POWERPC_MMU_SOFT_74xx)) {
                 /* Software TLB search */
@@ -738,30 +1011,48 @@ static int get_segment (CPUState *env, mmu_ctx_t *ctx,
             } else {
 #if defined (DEBUG_MMU)
                 if (loglevel != 0) {
-                    fprintf(logfile, "0 sdr1=0x" PADDRX " vsid=0x%06x "
-                            "api=0x%04x hash=0x%07x pg_addr=0x" PADDRX "\n",
-                            sdr, (uint32_t)vsid, (uint32_t)pgidx,
-                            (uint32_t)hash, ctx->pg_addr[0]);
+                    fprintf(logfile, "0 sdr1=" PADDRX " vsid=" ADDRX " "
+                            "api=" ADDRX " hash=" PADDRX
+                            " pg_addr=" PADDRX "\n",
+                            sdr, vsid, pgidx, hash, ctx->pg_addr[0]);
                 }
 #endif
                 /* Primary table lookup */
-                ret = find_pte(env, ctx, 0, rw);
+                ret = find_pte(env, ctx, 0, rw, type);
                 if (ret < 0) {
                     /* Secondary table lookup */
 #if defined (DEBUG_MMU)
                     if (eaddr != 0xEFFFFFFF && loglevel != 0) {
-                        fprintf(logfile,
-                                "1 sdr1=0x" PADDRX " vsid=0x%06x api=0x%04x "
-                                "hash=0x%05x pg_addr=0x" PADDRX "\n",
-                                sdr, (uint32_t)vsid, (uint32_t)pgidx,
-                                (uint32_t)hash, ctx->pg_addr[1]);
+                        fprintf(logfile, "1 sdr1=" PADDRX " vsid=" ADDRX " "
+                                "api=" ADDRX " hash=" PADDRX
+                                " pg_addr=" PADDRX "\n",
+                                sdr, vsid, pgidx, hash, ctx->pg_addr[1]);
                     }
 #endif
-                    ret2 = find_pte(env, ctx, 1, rw);
+                    ret2 = find_pte(env, ctx, 1, rw, type);
                     if (ret2 != -1)
                         ret = ret2;
                 }
             }
+#if defined (DUMP_PAGE_TABLES)
+            if (loglevel != 0) {
+                target_phys_addr_t curaddr;
+                uint32_t a0, a1, a2, a3;
+                fprintf(logfile, "Page table: " PADDRX " len " PADDRX "\n",
+                        sdr, mask + 0x80);
+                for (curaddr = sdr; curaddr < (sdr + mask + 0x80);
+                     curaddr += 16) {
+                    a0 = ldl_phys(curaddr);
+                    a1 = ldl_phys(curaddr + 4);
+                    a2 = ldl_phys(curaddr + 8);
+                    a3 = ldl_phys(curaddr + 12);
+                    if (a0 != 0 || a1 != 0 || a2 != 0 || a3 != 0) {
+                        fprintf(logfile, PADDRX ": %08x %08x %08x %08x\n",
+                                curaddr, a0, a1, a2, a3);
+                    }
+                }
+            }
+#endif
         } else {
 #if defined (DEBUG_MMU)
             if (loglevel != 0)
@@ -817,10 +1108,10 @@ static int get_segment (CPUState *env, mmu_ctx_t *ctx,
 }
 
 /* Generic TLB check function for embedded PowerPC implementations */
-static int ppcemb_tlb_check (CPUState *env, ppcemb_tlb_t *tlb,
-                             target_phys_addr_t *raddrp,
-                             target_ulong address,
-                             uint32_t pid, int ext, int i)
+static always_inline int ppcemb_tlb_check (CPUState *env, ppcemb_tlb_t *tlb,
+                                           target_phys_addr_t *raddrp,
+                                           target_ulong address,
+                                           uint32_t pid, int ext, int i)
 {
     target_ulong mask;
 
@@ -833,9 +1124,9 @@ static int ppcemb_tlb_check (CPUState *env, ppcemb_tlb_t *tlb,
     mask = ~(tlb->size - 1);
 #if defined (DEBUG_SOFTWARE_TLB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: TLB %d address " ADDRX " PID %d <=> "
-                ADDRX " " ADDRX " %d\n",
-                __func__, i, address, pid, tlb->EPN, mask, (int)tlb->PID);
+        fprintf(logfile, "%s: TLB %d address " ADDRX " PID %u <=> " ADDRX
+                " " ADDRX " %u\n",
+                __func__, i, address, pid, tlb->EPN, mask, (uint32_t)tlb->PID);
     }
 #endif
     /* Check PID */
@@ -876,7 +1167,7 @@ int ppcemb_tlb_search (CPUPPCState *env, target_ulong address, uint32_t pid)
 }
 
 /* Helpers specific to PowerPC 40x implementations */
-static void ppc4xx_tlb_invalidate_all (CPUState *env)
+static always_inline void ppc4xx_tlb_invalidate_all (CPUState *env)
 {
     ppcemb_tlb_t *tlb;
     int i;
@@ -888,8 +1179,9 @@ static void ppc4xx_tlb_invalidate_all (CPUState *env)
     tlb_flush(env, 1);
 }
 
-static void ppc4xx_tlb_invalidate_virt (CPUState *env, target_ulong eaddr,
-                                        uint32_t pid)
+static always_inline void ppc4xx_tlb_invalidate_virt (CPUState *env,
+                                                      target_ulong eaddr,
+                                                      uint32_t pid)
 {
 #if !defined(FLUSH_ALL_TLBS)
     ppcemb_tlb_t *tlb;
@@ -917,10 +1209,11 @@ int mmu40x_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
 {
     ppcemb_tlb_t *tlb;
     target_phys_addr_t raddr;
-    int i, ret, zsel, zpr;
+    int i, ret, zsel, zpr, pr;
 
     ret = -1;
-    raddr = -1;
+    raddr = (target_phys_addr_t)-1ULL;
+    pr = msr_pr;
     for (i = 0; i < env->nb_tlb; i++) {
         tlb = &env->tlb[i].tlbe;
         if (ppcemb_tlb_check(env, tlb, &raddr, address,
@@ -934,82 +1227,38 @@ int mmu40x_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
                     __func__, i, zsel, zpr, rw, tlb->attr);
         }
 #endif
-        if (access_type == ACCESS_CODE) {
-            /* Check execute enable bit */
-            switch (zpr) {
-            case 0x2:
-                if (msr_pr)
-                    goto check_exec_perm;
-                goto exec_granted;
-            case 0x0:
-                if (msr_pr) {
-                    ctx->prot = 0;
-                    ret = -3;
-                    break;
-                }
-                /* No break here */
-            case 0x1:
-            check_exec_perm:
-                /* Check from TLB entry */
-                if (!(tlb->prot & PAGE_EXEC)) {
-                    ret = -3;
-                } else {
-                    if (tlb->prot & PAGE_WRITE) {
-                        ctx->prot = PAGE_READ | PAGE_WRITE;
-                    } else {
-                        ctx->prot = PAGE_READ;
-                    }
-                    ret = 0;
-                }
-                break;
-            case 0x3:
-            exec_granted:
-                /* All accesses granted */
-                ctx->prot = PAGE_READ | PAGE_WRITE;
-                ret = 0;
-                break;
-            }
-        } else {
-            switch (zpr) {
-            case 0x2:
-                if (msr_pr)
-                    goto check_rw_perm;
-                goto rw_granted;
-            case 0x0:
-                if (msr_pr) {
-                    ctx->prot = 0;
-                    ret = -2;
-                    break;
-                }
-                /* No break here */
-            case 0x1:
-            check_rw_perm:
-                /* Check from TLB entry */
-                /* Check write protection bit */
-                if (tlb->prot & PAGE_WRITE) {
-                    ctx->prot = PAGE_READ | PAGE_WRITE;
-                    ret = 0;
-                } else {
-                    ctx->prot = PAGE_READ;
-                    if (rw)
-                        ret = -2;
-                    else
-                        ret = 0;
-                }
-                break;
-            case 0x3:
-            rw_granted:
-                /* All accesses granted */
-                ctx->prot = PAGE_READ | PAGE_WRITE;
-                ret = 0;
+        /* Check execute enable bit */
+        switch (zpr) {
+        case 0x2:
+            if (pr != 0)
+                goto check_perms;
+            /* No break here */
+        case 0x3:
+            /* All accesses granted */
+            ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+            ret = 0;
+            break;
+        case 0x0:
+            if (pr != 0) {
+                ctx->prot = 0;
+                ret = -2;
                 break;
             }
+            /* No break here */
+        case 0x1:
+        check_perms:
+            /* Check from TLB entry */
+            /* XXX: there is a problem here or in the TLB fill code... */
+            ctx->prot = tlb->prot;
+            ctx->prot |= PAGE_EXEC;
+            ret = check_prot(ctx->prot, rw, access_type);
+            break;
         }
         if (ret >= 0) {
             ctx->raddr = raddr;
 #if defined (DEBUG_SOFTWARE_TLB)
             if (loglevel != 0) {
-                fprintf(logfile, "%s: access granted " ADDRX " => " REGX
+                fprintf(logfile, "%s: access granted " ADDRX " => " PADDRX
                         " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
                         ret);
             }
@@ -1019,7 +1268,7 @@ int mmu40x_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
     }
 #if defined (DEBUG_SOFTWARE_TLB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: access refused " ADDRX " => " REGX
+        fprintf(logfile, "%s: access refused " ADDRX " => " PADDRX
                 " %d %d\n", __func__, address, raddr, ctx->prot,
                 ret);
     }
@@ -1046,19 +1295,19 @@ int mmubooke_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
     int i, prot, ret;
 
     ret = -1;
-    raddr = -1;
+    raddr = (target_phys_addr_t)-1ULL;
     for (i = 0; i < env->nb_tlb; i++) {
         tlb = &env->tlb[i].tlbe;
         if (ppcemb_tlb_check(env, tlb, &raddr, address,
                              env->spr[SPR_BOOKE_PID], 1, i) < 0)
             continue;
-        if (msr_pr)
+        if (msr_pr != 0)
             prot = tlb->prot & 0xF;
         else
             prot = (tlb->prot >> 4) & 0xF;
         /* Check the address space */
         if (access_type == ACCESS_CODE) {
-            if (msr_is != (tlb->attr & 1))
+            if (msr_ir != (tlb->attr & 1))
                 continue;
             ctx->prot = prot;
             if (prot & PAGE_EXEC) {
@@ -1067,7 +1316,7 @@ int mmubooke_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
             }
             ret = -3;
         } else {
-            if (msr_ds != (tlb->attr & 1))
+            if (msr_dr != (tlb->attr & 1))
                 continue;
             ctx->prot = prot;
             if ((!rw && prot & PAGE_READ) || (rw && (prot & PAGE_WRITE))) {
@@ -1083,27 +1332,27 @@ int mmubooke_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
     return ret;
 }
 
-static int check_physical (CPUState *env, mmu_ctx_t *ctx,
-                           target_ulong eaddr, int rw)
+static always_inline int check_physical (CPUState *env, mmu_ctx_t *ctx,
+                                         target_ulong eaddr, int rw)
 {
     int in_plb, ret;
 
     ctx->raddr = eaddr;
-    ctx->prot = PAGE_READ;
+    ctx->prot = PAGE_READ | PAGE_EXEC;
     ret = 0;
     switch (env->mmu_model) {
     case POWERPC_MMU_32B:
+    case POWERPC_MMU_601:
     case POWERPC_MMU_SOFT_6xx:
     case POWERPC_MMU_SOFT_74xx:
-    case POWERPC_MMU_601:
     case POWERPC_MMU_SOFT_4xx:
-    case POWERPC_MMU_REAL_4xx:
+    case POWERPC_MMU_REAL:
     case POWERPC_MMU_BOOKE:
         ctx->prot |= PAGE_WRITE;
         break;
 #if defined(TARGET_PPC64)
+    case POWERPC_MMU_620:
     case POWERPC_MMU_64B:
-    case POWERPC_MMU_64BRIDGE:
         /* Real address are 60 bits long */
         ctx->raddr &= 0x0FFFFFFFFFFFFFFFULL;
         ctx->prot |= PAGE_WRITE;
@@ -1133,6 +1382,10 @@ static int check_physical (CPUState *env, mmu_ctx_t *ctx,
             }
         }
         break;
+    case POWERPC_MMU_MPC8xx:
+        /* XXX: TODO */
+        cpu_abort(env, "MPC8xx MMU model is not implemented\n");
+        break;
     case POWERPC_MMU_BOOKE_FSL:
         /* XXX: TODO */
         cpu_abort(env, "BookE FSL MMU model not implemented\n");
@@ -1146,9 +1399,10 @@ static int check_physical (CPUState *env, mmu_ctx_t *ctx,
 }
 
 int get_physical_address (CPUState *env, mmu_ctx_t *ctx, target_ulong eaddr,
-                          int rw, int access_type, int check_BATs)
+                          int rw, int access_type)
 {
     int ret;
+
 #if 0
     if (loglevel != 0) {
         fprintf(logfile, "%s\n", __func__);
@@ -1162,16 +1416,16 @@ int get_physical_address (CPUState *env, mmu_ctx_t *ctx, target_ulong eaddr,
         ret = -1;
         switch (env->mmu_model) {
         case POWERPC_MMU_32B:
+        case POWERPC_MMU_601:
         case POWERPC_MMU_SOFT_6xx:
         case POWERPC_MMU_SOFT_74xx:
-            /* Try to find a BAT */
-            if (check_BATs)
-                ret = get_bat(env, ctx, eaddr, rw, access_type);
-            /* No break here */
 #if defined(TARGET_PPC64)
+        case POWERPC_MMU_620:
         case POWERPC_MMU_64B:
-        case POWERPC_MMU_64BRIDGE:
 #endif
+            /* Try to find a BAT */
+            if (env->nb_BATs != 0)
+                ret = get_bat(env, ctx, eaddr, rw, access_type);
             if (ret < 0) {
                 /* We didn't match any BAT entry or don't have BATs */
                 ret = get_segment(env, ctx, eaddr, rw, access_type);
@@ -1182,20 +1436,20 @@ int get_physical_address (CPUState *env, mmu_ctx_t *ctx, target_ulong eaddr,
             ret = mmu40x_get_physical_address(env, ctx, eaddr,
                                               rw, access_type);
             break;
-        case POWERPC_MMU_601:
-            /* XXX: TODO */
-            cpu_abort(env, "601 MMU model not implemented\n");
-            return -1;
         case POWERPC_MMU_BOOKE:
             ret = mmubooke_get_physical_address(env, ctx, eaddr,
                                                 rw, access_type);
             break;
+        case POWERPC_MMU_MPC8xx:
+            /* XXX: TODO */
+            cpu_abort(env, "MPC8xx MMU model is not implemented\n");
+            break;
         case POWERPC_MMU_BOOKE_FSL:
             /* XXX: TODO */
             cpu_abort(env, "BookE FSL MMU model not implemented\n");
             return -1;
-        case POWERPC_MMU_REAL_4xx:
-            cpu_abort(env, "PowerPC 401 does not do any translation\n");
+        case POWERPC_MMU_REAL:
+            cpu_abort(env, "PowerPC in real mode do not do any translation\n");
             return -1;
         default:
             cpu_abort(env, "Unknown or invalid MMU model\n");
@@ -1216,7 +1470,7 @@ target_phys_addr_t cpu_get_phys_page_debug (CPUState *env, target_ulong addr)
 {
     mmu_ctx_t ctx;
 
-    if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT, 1) != 0))
+    if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0))
         return -1;
 
     return ctx.raddr & TARGET_PAGE_MASK;
@@ -1224,10 +1478,9 @@ target_phys_addr_t cpu_get_phys_page_debug (CPUState *env, target_ulong addr)
 
 /* Perform address translation */
 int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int is_user, int is_softmmu)
+                              int mmu_idx, int is_softmmu)
 {
     mmu_ctx_t ctx;
-    int exception = 0, error_code = 0;
     int access_type;
     int ret = 0;
 
@@ -1242,66 +1495,61 @@ int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
         access_type = ACCESS_INT;
         //        access_type = env->access_type;
     }
-    ret = get_physical_address(env, &ctx, address, rw, access_type, 1);
+    ret = get_physical_address(env, &ctx, address, rw, access_type);
     if (ret == 0) {
-        ret = tlb_set_page(env, address & TARGET_PAGE_MASK,
-                           ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
-                           is_user, is_softmmu);
+        ret = tlb_set_page_exec(env, address & TARGET_PAGE_MASK,
+                                ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
+                                mmu_idx, is_softmmu);
     } else if (ret < 0) {
 #if defined (DEBUG_MMU)
         if (loglevel != 0)
             cpu_dump_state(env, logfile, fprintf, 0);
 #endif
         if (access_type == ACCESS_CODE) {
-            exception = POWERPC_EXCP_ISI;
             switch (ret) {
             case -1:
                 /* No matches in page tables or TLB */
                 switch (env->mmu_model) {
                 case POWERPC_MMU_SOFT_6xx:
-                    exception = POWERPC_EXCP_IFTLB;
+                    env->exception_index = POWERPC_EXCP_IFTLB;
+                    env->error_code = 1 << 18;
                     env->spr[SPR_IMISS] = address;
                     env->spr[SPR_ICMP] = 0x80000000 | ctx.ptem;
-                    error_code = 1 << 18;
                     goto tlb_miss;
                 case POWERPC_MMU_SOFT_74xx:
-                    exception = POWERPC_EXCP_IFTLB;
+                    env->exception_index = POWERPC_EXCP_IFTLB;
                     goto tlb_miss_74xx;
                 case POWERPC_MMU_SOFT_4xx:
                 case POWERPC_MMU_SOFT_4xx_Z:
-                    exception = POWERPC_EXCP_ITLB;
-                    error_code = 0;
+                    env->exception_index = POWERPC_EXCP_ITLB;
+                    env->error_code = 0;
                     env->spr[SPR_40x_DEAR] = address;
                     env->spr[SPR_40x_ESR] = 0x00000000;
                     break;
                 case POWERPC_MMU_32B:
-                    error_code = 0x40000000;
-                    break;
+                case POWERPC_MMU_601:
 #if defined(TARGET_PPC64)
+                case POWERPC_MMU_620:
                 case POWERPC_MMU_64B:
-                    /* XXX: TODO */
-                    cpu_abort(env, "MMU model not implemented\n");
-                    return -1;
-                case POWERPC_MMU_64BRIDGE:
-                    /* XXX: TODO */
-                    cpu_abort(env, "MMU model not implemented\n");
-                    return -1;
 #endif
-                case POWERPC_MMU_601:
-                    /* XXX: TODO */
-                    cpu_abort(env, "MMU model not implemented\n");
-                    return -1;
+                    env->exception_index = POWERPC_EXCP_ISI;
+                    env->error_code = 0x40000000;
+                    break;
                 case POWERPC_MMU_BOOKE:
                     /* XXX: TODO */
-                    cpu_abort(env, "MMU model not implemented\n");
+                    cpu_abort(env, "BookE MMU model is not implemented\n");
                     return -1;
                 case POWERPC_MMU_BOOKE_FSL:
                     /* XXX: TODO */
-                    cpu_abort(env, "MMU model not implemented\n");
+                    cpu_abort(env, "BookE FSL MMU model is not implemented\n");
                     return -1;
-                case POWERPC_MMU_REAL_4xx:
-                    cpu_abort(env, "PowerPC 401 should never raise any MMU "
-                              "exceptions\n");
+                case POWERPC_MMU_MPC8xx:
+                    /* XXX: TODO */
+                    cpu_abort(env, "MPC8xx MMU model is not implemented\n");
+                    break;
+                case POWERPC_MMU_REAL:
+                    cpu_abort(env, "PowerPC in real mode should never raise "
+                              "any MMU exceptions\n");
                     return -1;
                 default:
                     cpu_abort(env, "Unknown or invalid MMU model\n");
@@ -1310,64 +1558,71 @@ int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
                 break;
             case -2:
                 /* Access rights violation */
-                error_code = 0x08000000;
+                env->exception_index = POWERPC_EXCP_ISI;
+                env->error_code = 0x08000000;
                 break;
             case -3:
                 /* No execute protection violation */
-                error_code = 0x10000000;
+                env->exception_index = POWERPC_EXCP_ISI;
+                env->error_code = 0x10000000;
                 break;
             case -4:
                 /* Direct store exception */
                 /* No code fetch is allowed in direct-store areas */
-                error_code = 0x10000000;
+                env->exception_index = POWERPC_EXCP_ISI;
+                env->error_code = 0x10000000;
                 break;
 #if defined(TARGET_PPC64)
             case -5:
                 /* No match in segment table */
-                exception = POWERPC_EXCP_ISEG;
-                error_code = 0;
+                if (env->mmu_model == POWERPC_MMU_620) {
+                    env->exception_index = POWERPC_EXCP_ISI;
+                    /* XXX: this might be incorrect */
+                    env->error_code = 0x40000000;
+                } else {
+                    env->exception_index = POWERPC_EXCP_ISEG;
+                    env->error_code = 0;
+                }
                 break;
 #endif
             }
         } else {
-            exception = POWERPC_EXCP_DSI;
             switch (ret) {
             case -1:
                 /* No matches in page tables or TLB */
                 switch (env->mmu_model) {
                 case POWERPC_MMU_SOFT_6xx:
                     if (rw == 1) {
-                        exception = POWERPC_EXCP_DSTLB;
-                        error_code = 1 << 16;
+                        env->exception_index = POWERPC_EXCP_DSTLB;
+                        env->error_code = 1 << 16;
                     } else {
-                        exception = POWERPC_EXCP_DLTLB;
-                        error_code = 0;
+                        env->exception_index = POWERPC_EXCP_DLTLB;
+                        env->error_code = 0;
                     }
                     env->spr[SPR_DMISS] = address;
                     env->spr[SPR_DCMP] = 0x80000000 | ctx.ptem;
                 tlb_miss:
-                    error_code |= ctx.key << 19;
+                    env->error_code |= ctx.key << 19;
                     env->spr[SPR_HASH1] = ctx.pg_addr[0];
                     env->spr[SPR_HASH2] = ctx.pg_addr[1];
-                    /* Do not alter DAR nor DSISR */
-                    goto out;
+                    break;
                 case POWERPC_MMU_SOFT_74xx:
                     if (rw == 1) {
-                        exception = POWERPC_EXCP_DSTLB;
+                        env->exception_index = POWERPC_EXCP_DSTLB;
                     } else {
-                        exception = POWERPC_EXCP_DLTLB;
+                        env->exception_index = POWERPC_EXCP_DLTLB;
                     }
                 tlb_miss_74xx:
                     /* Implement LRU algorithm */
+                    env->error_code = ctx.key << 19;
                     env->spr[SPR_TLBMISS] = (address & ~((target_ulong)0x3)) |
                         ((env->last_way + 1) & (env->nb_ways - 1));
                     env->spr[SPR_PTEHI] = 0x80000000 | ctx.ptem;
-                    error_code = ctx.key << 19;
                     break;
                 case POWERPC_MMU_SOFT_4xx:
                 case POWERPC_MMU_SOFT_4xx_Z:
-                    exception = POWERPC_EXCP_DTLB;
-                    error_code = 0;
+                    env->exception_index = POWERPC_EXCP_DTLB;
+                    env->error_code = 0;
                     env->spr[SPR_40x_DEAR] = address;
                     if (rw)
                         env->spr[SPR_40x_ESR] = 0x00800000;
@@ -1375,33 +1630,34 @@ int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
                         env->spr[SPR_40x_ESR] = 0x00000000;
                     break;
                 case POWERPC_MMU_32B:
-                    error_code = 0x40000000;
-                    break;
+                case POWERPC_MMU_601:
 #if defined(TARGET_PPC64)
+                case POWERPC_MMU_620:
                 case POWERPC_MMU_64B:
-                    /* XXX: TODO */
-                    cpu_abort(env, "MMU model not implemented\n");
-                    return -1;
-                case POWERPC_MMU_64BRIDGE:
-                    /* XXX: TODO */
-                    cpu_abort(env, "MMU model not implemented\n");
-                    return -1;
 #endif
-                case POWERPC_MMU_601:
+                    env->exception_index = POWERPC_EXCP_DSI;
+                    env->error_code = 0;
+                    env->spr[SPR_DAR] = address;
+                    if (rw == 1)
+                        env->spr[SPR_DSISR] = 0x42000000;
+                    else
+                        env->spr[SPR_DSISR] = 0x40000000;
+                    break;
+                case POWERPC_MMU_MPC8xx:
                     /* XXX: TODO */
-                    cpu_abort(env, "MMU model not implemented\n");
-                    return -1;
+                    cpu_abort(env, "MPC8xx MMU model is not implemented\n");
+                    break;
                 case POWERPC_MMU_BOOKE:
                     /* XXX: TODO */
-                    cpu_abort(env, "MMU model not implemented\n");
+                    cpu_abort(env, "BookE MMU model is not implemented\n");
                     return -1;
                 case POWERPC_MMU_BOOKE_FSL:
                     /* XXX: TODO */
-                    cpu_abort(env, "MMU model not implemented\n");
+                    cpu_abort(env, "BookE FSL MMU model is not implemented\n");
                     return -1;
-                case POWERPC_MMU_REAL_4xx:
-                    cpu_abort(env, "PowerPC 401 should never raise any MMU "
-                              "exceptions\n");
+                case POWERPC_MMU_REAL:
+                    cpu_abort(env, "PowerPC in real mode should never raise "
+                              "any MMU exceptions\n");
                     return -1;
                 default:
                     cpu_abort(env, "Unknown or invalid MMU model\n");
@@ -1410,52 +1666,77 @@ int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
                 break;
             case -2:
                 /* Access rights violation */
-                error_code = 0x08000000;
+                env->exception_index = POWERPC_EXCP_DSI;
+                env->error_code = 0;
+                env->spr[SPR_DAR] = address;
+                if (rw == 1)
+                    env->spr[SPR_DSISR] = 0x0A000000;
+                else
+                    env->spr[SPR_DSISR] = 0x08000000;
                 break;
             case -4:
                 /* Direct store exception */
                 switch (access_type) {
                 case ACCESS_FLOAT:
                     /* Floating point load/store */
-                    exception = POWERPC_EXCP_ALIGN;
-                    error_code = POWERPC_EXCP_ALIGN_FP;
+                    env->exception_index = POWERPC_EXCP_ALIGN;
+                    env->error_code = POWERPC_EXCP_ALIGN_FP;
+                    env->spr[SPR_DAR] = address;
                     break;
                 case ACCESS_RES:
-                    /* lwarx, ldarx or srwcx. */
-                    error_code = 0x04000000;
+                    /* lwarx, ldarx or stwcx. */
+                    env->exception_index = POWERPC_EXCP_DSI;
+                    env->error_code = 0;
+                    env->spr[SPR_DAR] = address;
+                    if (rw == 1)
+                        env->spr[SPR_DSISR] = 0x06000000;
+                    else
+                        env->spr[SPR_DSISR] = 0x04000000;
                     break;
                 case ACCESS_EXT:
                     /* eciwx or ecowx */
-                    error_code = 0x04100000;
+                    env->exception_index = POWERPC_EXCP_DSI;
+                    env->error_code = 0;
+                    env->spr[SPR_DAR] = address;
+                    if (rw == 1)
+                        env->spr[SPR_DSISR] = 0x06100000;
+                    else
+                        env->spr[SPR_DSISR] = 0x04100000;
                     break;
                 default:
                     printf("DSI: invalid exception (%d)\n", ret);
-                    exception = POWERPC_EXCP_PROGRAM;
-                    error_code = POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL;
+                    env->exception_index = POWERPC_EXCP_PROGRAM;
+                    env->error_code =
+                        POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL;
+                    env->spr[SPR_DAR] = address;
                     break;
                 }
                 break;
 #if defined(TARGET_PPC64)
             case -5:
                 /* No match in segment table */
-                exception = POWERPC_EXCP_DSEG;
-                error_code = 0;
+                if (env->mmu_model == POWERPC_MMU_620) {
+                    env->exception_index = POWERPC_EXCP_DSI;
+                    env->error_code = 0;
+                    env->spr[SPR_DAR] = address;
+                    /* XXX: this might be incorrect */
+                    if (rw == 1)
+                        env->spr[SPR_DSISR] = 0x42000000;
+                    else
+                        env->spr[SPR_DSISR] = 0x40000000;
+                } else {
+                    env->exception_index = POWERPC_EXCP_DSEG;
+                    env->error_code = 0;
+                    env->spr[SPR_DAR] = address;
+                }
                 break;
 #endif
             }
-            if (exception == POWERPC_EXCP_DSI && rw == 1)
-                error_code |= 0x02000000;
-            /* Store fault address */
-            env->spr[SPR_DAR] = address;
-            env->spr[SPR_DSISR] = error_code;
         }
-    out:
 #if 0
-        printf("%s: set exception to %d %02x\n",
-               __func__, exception, error_code);
+        printf("%s: set exception to %d %02x\n", __func__,
+               env->exception, env->error_code);
 #endif
-        env->exception_index = exception;
-        env->error_code = error_code;
         ret = 1;
     }
 
@@ -1465,8 +1746,9 @@ int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
 /*****************************************************************************/
 /* BATs management */
 #if !defined(FLUSH_ALL_TLBS)
-static inline void do_invalidate_BAT (CPUPPCState *env,
-                                      target_ulong BATu, target_ulong mask)
+static always_inline void do_invalidate_BAT (CPUPPCState *env,
+                                             target_ulong BATu,
+                                             target_ulong mask)
 {
     target_ulong base, end, page;
 
@@ -1487,12 +1769,12 @@ static inline void do_invalidate_BAT (CPUPPCState *env,
 }
 #endif
 
-static inline void dump_store_bat (CPUPPCState *env, char ID, int ul, int nr,
-                                   target_ulong value)
+static always_inline void dump_store_bat (CPUPPCState *env, char ID,
+                                          int ul, int nr, target_ulong value)
 {
 #if defined (DEBUG_BATS)
     if (loglevel != 0) {
-        fprintf(logfile, "Set %cBAT%d%c to 0x" ADDRX " (0x" ADDRX ")\n",
+        fprintf(logfile, "Set %cBAT%d%c to " ADDRX " (" ADDRX ")\n",
                 ID, nr, ul == 0 ? 'u' : 'l', value, env->nip);
     }
 #endif
@@ -1582,6 +1864,75 @@ void do_store_dbatl (CPUPPCState *env, int nr, target_ulong value)
     env->DBAT[1][nr] = value;
 }
 
+void do_store_ibatu_601 (CPUPPCState *env, int nr, target_ulong value)
+{
+    target_ulong mask;
+    int do_inval;
+
+    dump_store_bat(env, 'I', 0, nr, value);
+    if (env->IBAT[0][nr] != value) {
+        do_inval = 0;
+        mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
+        if (env->IBAT[1][nr] & 0x40) {
+            /* Invalidate BAT only if it is valid */
+#if !defined(FLUSH_ALL_TLBS)
+            do_invalidate_BAT(env, env->IBAT[0][nr], mask);
+#else
+            do_inval = 1;
+#endif
+        }
+        /* When storing valid upper BAT, mask BEPI and BRPN
+         * and invalidate all TLBs covered by this BAT
+         */
+        env->IBAT[0][nr] = (value & 0x00001FFFUL) |
+            (value & ~0x0001FFFFUL & ~mask);
+        env->DBAT[0][nr] = env->IBAT[0][nr];
+        if (env->IBAT[1][nr] & 0x40) {
+#if !defined(FLUSH_ALL_TLBS)
+            do_invalidate_BAT(env, env->IBAT[0][nr], mask);
+#else
+            do_inval = 1;
+#endif
+        }
+#if defined(FLUSH_ALL_TLBS)
+        if (do_inval)
+            tlb_flush(env, 1);
+#endif
+    }
+}
+
+void do_store_ibatl_601 (CPUPPCState *env, int nr, target_ulong value)
+{
+    target_ulong mask;
+    int do_inval;
+
+    dump_store_bat(env, 'I', 1, nr, value);
+    if (env->IBAT[1][nr] != value) {
+        do_inval = 0;
+        if (env->IBAT[1][nr] & 0x40) {
+#if !defined(FLUSH_ALL_TLBS)
+            mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
+            do_invalidate_BAT(env, env->IBAT[0][nr], mask);
+#else
+            do_inval = 1;
+#endif
+        }
+        if (value & 0x40) {
+#if !defined(FLUSH_ALL_TLBS)
+            mask = (value << 17) & 0x0FFE0000UL;
+            do_invalidate_BAT(env, env->IBAT[0][nr], mask);
+#else
+            do_inval = 1;
+#endif
+        }
+        env->IBAT[1][nr] = value;
+        env->DBAT[1][nr] = value;
+#if defined(FLUSH_ALL_TLBS)
+        if (do_inval)
+            tlb_flush(env, 1);
+#endif
+    }
+}
 
 /*****************************************************************************/
 /* TLB management */
@@ -1596,26 +1947,33 @@ void ppc_tlb_invalidate_all (CPUPPCState *env)
     case POWERPC_MMU_SOFT_4xx_Z:
         ppc4xx_tlb_invalidate_all(env);
         break;
-    case POWERPC_MMU_REAL_4xx:
+    case POWERPC_MMU_REAL:
         cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
         break;
-    case POWERPC_MMU_BOOKE:
+    case POWERPC_MMU_MPC8xx:
         /* XXX: TODO */
-        cpu_abort(env, "MMU model not implemented\n");
+        cpu_abort(env, "MPC8xx MMU model is not implemented\n");
         break;
-    case POWERPC_MMU_BOOKE_FSL:
+    case POWERPC_MMU_BOOKE:
         /* XXX: TODO */
-        cpu_abort(env, "MMU model not implemented\n");
+        cpu_abort(env, "BookE MMU model is not implemented\n");
         break;
-    case POWERPC_MMU_601:
+    case POWERPC_MMU_BOOKE_FSL:
         /* XXX: TODO */
-        cpu_abort(env, "MMU model not implemented\n");
+        cpu_abort(env, "BookE MMU model is not implemented\n");
         break;
     case POWERPC_MMU_32B:
+    case POWERPC_MMU_601:
+#if defined(TARGET_PPC64)
+    case POWERPC_MMU_620:
     case POWERPC_MMU_64B:
-    case POWERPC_MMU_64BRIDGE:
+#endif /* defined(TARGET_PPC64) */
         tlb_flush(env, 1);
         break;
+    default:
+        /* XXX: TODO */
+        cpu_abort(env, "Unknown MMU model\n");
+        break;
     }
 }
 
@@ -1634,24 +1992,25 @@ void ppc_tlb_invalidate_one (CPUPPCState *env, target_ulong addr)
     case POWERPC_MMU_SOFT_4xx_Z:
         ppc4xx_tlb_invalidate_virt(env, addr, env->spr[SPR_40x_PID]);
         break;
-    case POWERPC_MMU_REAL_4xx:
+    case POWERPC_MMU_REAL:
         cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
         break;
-    case POWERPC_MMU_BOOKE:
+    case POWERPC_MMU_MPC8xx:
         /* XXX: TODO */
-        cpu_abort(env, "MMU model not implemented\n");
+        cpu_abort(env, "MPC8xx MMU model is not implemented\n");
         break;
-    case POWERPC_MMU_BOOKE_FSL:
+    case POWERPC_MMU_BOOKE:
         /* XXX: TODO */
-        cpu_abort(env, "MMU model not implemented\n");
+        cpu_abort(env, "BookE MMU model is not implemented\n");
         break;
-    case POWERPC_MMU_601:
+    case POWERPC_MMU_BOOKE_FSL:
         /* XXX: TODO */
-        cpu_abort(env, "MMU model not implemented\n");
+        cpu_abort(env, "BookE FSL MMU model is not implemented\n");
         break;
     case POWERPC_MMU_32B:
+    case POWERPC_MMU_601:
         /* tlbie invalidate TLBs for all segments */
-        addr &= ~((target_ulong)-1 << 28);
+        addr &= ~((target_ulong)-1ULL << 28);
         /* XXX: this case should be optimized,
          * giving a mask to tlb_flush_page
          */
@@ -1672,35 +2031,27 @@ void ppc_tlb_invalidate_one (CPUPPCState *env, target_ulong addr)
         tlb_flush_page(env, addr | (0xE << 28));
         tlb_flush_page(env, addr | (0xF << 28));
         break;
+#if defined(TARGET_PPC64)
+    case POWERPC_MMU_620:
     case POWERPC_MMU_64B:
-    case POWERPC_MMU_64BRIDGE:
         /* tlbie invalidate TLBs for all segments */
         /* XXX: given the fact that there are too many segments to invalidate,
+         *      and we still don't have a tlb_flush_mask(env, n, mask) in Qemu,
          *      we just invalidate all TLBs
          */
         tlb_flush(env, 1);
         break;
+#endif /* defined(TARGET_PPC64) */
+    default:
+        /* XXX: TODO */
+        cpu_abort(env, "Unknown MMU model\n");
+        break;
     }
 #else
     ppc_tlb_invalidate_all(env);
 #endif
 }
 
-#if defined(TARGET_PPC64)
-void ppc_slb_invalidate_all (CPUPPCState *env)
-{
-    /* XXX: TODO */
-    tlb_flush(env, 1);
-}
-
-void ppc_slb_invalidate_one (CPUPPCState *env, uint64_t T0)
-{
-    /* XXX: TODO */
-    tlb_flush(env, 1);
-}
-#endif
-
-
 /*****************************************************************************/
 /* Special registers manipulation */
 #if defined(TARGET_PPC64)
@@ -1727,25 +2078,30 @@ void do_store_sdr1 (CPUPPCState *env, target_ulong value)
 {
 #if defined (DEBUG_MMU)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: 0x" ADDRX "\n", __func__, value);
+        fprintf(logfile, "%s: " ADDRX "\n", __func__, value);
     }
 #endif
     if (env->sdr1 != value) {
+        /* XXX: for PowerPC 64, should check that the HTABSIZE value
+         *      is <= 28
+         */
         env->sdr1 = value;
         tlb_flush(env, 1);
     }
 }
 
+#if 0 // Unused
 target_ulong do_load_sr (CPUPPCState *env, int srnum)
 {
     return env->sr[srnum];
 }
+#endif
 
 void do_store_sr (CPUPPCState *env, int srnum, target_ulong value)
 {
 #if defined (DEBUG_MMU)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: reg=%d 0x" ADDRX " " ADDRX "\n",
+        fprintf(logfile, "%s: reg=%d " ADDRX " " ADDRX "\n",
                 __func__, srnum, value, env->sr[srnum]);
     }
 #endif
@@ -1769,188 +2125,18 @@ void do_store_sr (CPUPPCState *env, int srnum, target_ulong value)
 
 target_ulong ppc_load_xer (CPUPPCState *env)
 {
-    return (xer_so << XER_SO) |
-        (xer_ov << XER_OV) |
-        (xer_ca << XER_CA) |
-        (xer_bc << XER_BC) |
-        (xer_cmp << XER_CMP);
+    return hreg_load_xer(env);
 }
 
 void ppc_store_xer (CPUPPCState *env, target_ulong value)
 {
-    xer_so = (value >> XER_SO) & 0x01;
-    xer_ov = (value >> XER_OV) & 0x01;
-    xer_ca = (value >> XER_CA) & 0x01;
-    xer_cmp = (value >> XER_CMP) & 0xFF;
-    xer_bc = (value >> XER_BC) & 0x7F;
-}
-
-/* Swap temporary saved registers with GPRs */
-static inline void swap_gpr_tgpr (CPUPPCState *env)
-{
-    ppc_gpr_t tmp;
-
-    tmp = env->gpr[0];
-    env->gpr[0] = env->tgpr[0];
-    env->tgpr[0] = tmp;
-    tmp = env->gpr[1];
-    env->gpr[1] = env->tgpr[1];
-    env->tgpr[1] = tmp;
-    tmp = env->gpr[2];
-    env->gpr[2] = env->tgpr[2];
-    env->tgpr[2] = tmp;
-    tmp = env->gpr[3];
-    env->gpr[3] = env->tgpr[3];
-    env->tgpr[3] = tmp;
+    hreg_store_xer(env, value);
 }
 
 /* GDBstub can read and write MSR... */
-target_ulong do_load_msr (CPUPPCState *env)
-{
-    return
-#if defined (TARGET_PPC64)
-        ((target_ulong)msr_sf   << MSR_SF)   |
-        ((target_ulong)msr_isf  << MSR_ISF)  |
-        ((target_ulong)msr_hv   << MSR_HV)   |
-#endif
-        ((target_ulong)msr_ucle << MSR_UCLE) |
-        ((target_ulong)msr_vr   << MSR_VR)   | /* VR / SPE */
-        ((target_ulong)msr_ap   << MSR_AP)   |
-        ((target_ulong)msr_sa   << MSR_SA)   |
-        ((target_ulong)msr_key  << MSR_KEY)  |
-        ((target_ulong)msr_pow  << MSR_POW)  | /* POW / WE */
-        ((target_ulong)msr_tlb  << MSR_TLB)  | /* TLB / TGPE / CE */
-        ((target_ulong)msr_ile  << MSR_ILE)  |
-        ((target_ulong)msr_ee   << MSR_EE)   |
-        ((target_ulong)msr_pr   << MSR_PR)   |
-        ((target_ulong)msr_fp   << MSR_FP)   |
-        ((target_ulong)msr_me   << MSR_ME)   |
-        ((target_ulong)msr_fe0  << MSR_FE0)  |
-        ((target_ulong)msr_se   << MSR_SE)   | /* SE / DWE / UBLE */
-        ((target_ulong)msr_be   << MSR_BE)   | /* BE / DE */
-        ((target_ulong)msr_fe1  << MSR_FE1)  |
-        ((target_ulong)msr_al   << MSR_AL)   |
-        ((target_ulong)msr_ip   << MSR_IP)   |
-        ((target_ulong)msr_ir   << MSR_IR)   | /* IR / IS */
-        ((target_ulong)msr_dr   << MSR_DR)   | /* DR / DS */
-        ((target_ulong)msr_pe   << MSR_PE)   | /* PE / EP */
-        ((target_ulong)msr_px   << MSR_PX)   | /* PX / PMM */
-        ((target_ulong)msr_ri   << MSR_RI)   |
-        ((target_ulong)msr_le   << MSR_LE);
-}
-
-void do_store_msr (CPUPPCState *env, target_ulong value)
-{
-    int enter_pm;
-
-    value &= env->msr_mask;
-    if (((value >> MSR_IR) & 1) != msr_ir ||
-        ((value >> MSR_DR) & 1) != msr_dr) {
-        /* Flush all tlb when changing translation mode */
-        tlb_flush(env, 1);
-        env->interrupt_request |= CPU_INTERRUPT_EXITTB;
-    }
-#if 0
-    if (loglevel != 0) {
-        fprintf(logfile, "%s: T0 %08lx\n", __func__, value);
-    }
-#endif
-    switch (env->excp_model) {
-    case POWERPC_EXCP_602:
-    case POWERPC_EXCP_603:
-    case POWERPC_EXCP_603E:
-    case POWERPC_EXCP_G2:
-        if (((value >> MSR_TGPR) & 1) != msr_tgpr) {
-            /* Swap temporary saved registers with GPRs */
-            swap_gpr_tgpr(env);
-        }
-        break;
-    default:
-        break;
-    }
-#if defined (TARGET_PPC64)
-    msr_sf   = (value >> MSR_SF)   & 1;
-    msr_isf  = (value >> MSR_ISF)  & 1;
-    msr_hv   = (value >> MSR_HV)   & 1;
-#endif
-    msr_ucle = (value >> MSR_UCLE) & 1;
-    msr_vr   = (value >> MSR_VR)   & 1; /* VR / SPE */
-    msr_ap   = (value >> MSR_AP)   & 1;
-    msr_sa   = (value >> MSR_SA)   & 1;
-    msr_key  = (value >> MSR_KEY)  & 1;
-    msr_pow  = (value >> MSR_POW)  & 1; /* POW / WE */
-    msr_tlb  = (value >> MSR_TLB)  & 1; /* TLB / TGPR / CE */
-    msr_ile  = (value >> MSR_ILE)  & 1;
-    msr_ee   = (value >> MSR_EE)   & 1;
-    msr_pr   = (value >> MSR_PR)   & 1;
-    msr_fp   = (value >> MSR_FP)   & 1;
-    msr_me   = (value >> MSR_ME)   & 1;
-    msr_fe0  = (value >> MSR_FE0)  & 1;
-    msr_se   = (value >> MSR_SE)   & 1; /* SE / DWE / UBLE */
-    msr_be   = (value >> MSR_BE)   & 1; /* BE / DE */
-    msr_fe1  = (value >> MSR_FE1)  & 1;
-    msr_al   = (value >> MSR_AL)   & 1;
-    msr_ip   = (value >> MSR_IP)   & 1;
-    msr_ir   = (value >> MSR_IR)   & 1; /* IR / IS */
-    msr_dr   = (value >> MSR_DR)   & 1; /* DR / DS */
-    msr_pe   = (value >> MSR_PE)   & 1; /* PE / EP */
-    msr_px   = (value >> MSR_PX)   & 1; /* PX / PMM */
-    msr_ri   = (value >> MSR_RI)   & 1;
-    msr_le   = (value >> MSR_LE)   & 1;
-    do_compute_hflags(env);
-
-    enter_pm = 0;
-    switch (env->excp_model) {
-    case POWERPC_EXCP_603:
-    case POWERPC_EXCP_603E:
-    case POWERPC_EXCP_G2:
-        /* Don't handle SLEEP mode: we should disable all clocks...
-         * No dynamic power-management.
-         */
-        if (msr_pow == 1 && (env->spr[SPR_HID0] & 0x00C00000) != 0)
-            enter_pm = 1;
-        break;
-    case POWERPC_EXCP_604:
-        if (msr_pow == 1)
-            enter_pm = 1;
-        break;
-    case POWERPC_EXCP_7x0:
-        if (msr_pow == 1 && (env->spr[SPR_HID0] & 0x00E00000) != 0)
-            enter_pm = 1;
-        break;
-    default:
-        break;
-    }
-    if (enter_pm) {
-        if (likely(!env->halted)) {
-            /* power save: exit cpu loop */
-            env->halted = 1;
-            env->exception_index = EXCP_HLT;
-            cpu_loop_exit();
-        }
-    }
-}
-
-#if defined(TARGET_PPC64)
-void ppc_store_msr_32 (CPUPPCState *env, uint32_t value)
+void ppc_store_msr (CPUPPCState *env, target_ulong value)
 {
-    do_store_msr(env,
-                 (do_load_msr(env) & ~0xFFFFFFFFULL) | (value & 0xFFFFFFFF));
-}
-#endif
-
-void do_compute_hflags (CPUPPCState *env)
-{
-    /* Compute current hflags */
-    env->hflags = (msr_vr << MSR_VR) |
-        (msr_ap << MSR_AP) | (msr_sa << MSR_SA) | (msr_pr << MSR_PR) |
-        (msr_fp << MSR_FP) | (msr_fe0 << MSR_FE0) | (msr_se << MSR_SE) |
-        (msr_be << MSR_BE) | (msr_fe1 << MSR_FE1) | (msr_le << MSR_LE);
-#if defined (TARGET_PPC64)
-    env->hflags |= msr_cm << MSR_CM;
-    env->hflags |= (uint64_t)msr_sf << MSR_SF;
-    env->hflags |= (uint64_t)msr_hv << MSR_HV;
-#endif
+    hreg_store_msr(env, value, 0);
 }
 
 /*****************************************************************************/
@@ -1968,12 +2154,12 @@ void ppc_hw_interrupt (CPUState *env)
     env->error_code = 0;
 }
 #else /* defined (CONFIG_USER_ONLY) */
-static void dump_syscall (CPUState *env)
+static always_inline void dump_syscall (CPUState *env)
 {
-    fprintf(logfile, "syscall r0=0x" REGX " r3=0x" REGX " r4=0x" REGX
-            " r5=0x" REGX " r6=0x" REGX " nip=0x" ADDRX "\n",
-            env->gpr[0], env->gpr[3], env->gpr[4],
-            env->gpr[5], env->gpr[6], env->nip);
+    fprintf(logfile, "syscall r0=" REGX " r3=" REGX " r4=" REGX
+            " r5=" REGX " r6=" REGX " nip=" ADDRX "\n",
+            ppc_dump_gpr(env, 0), ppc_dump_gpr(env, 3), ppc_dump_gpr(env, 4),
+            ppc_dump_gpr(env, 5), ppc_dump_gpr(env, 6), env->nip);
 }
 
 /* Note that this function should be greatly optimized
@@ -1982,14 +2168,26 @@ static void dump_syscall (CPUState *env)
 static always_inline void powerpc_excp (CPUState *env,
                                         int excp_model, int excp)
 {
-    target_ulong msr, vector;
+    target_ulong msr, new_msr, vector;
     int srr0, srr1, asrr0, asrr1;
+    int lpes0, lpes1, lev;
+
+    if (0) {
+        /* XXX: find a suitable condition to enable the hypervisor mode */
+        lpes0 = (env->spr[SPR_LPCR] >> 1) & 1;
+        lpes1 = (env->spr[SPR_LPCR] >> 2) & 1;
+    } else {
+        /* Those values ensure we won't enter the hypervisor mode */
+        lpes0 = 0;
+        lpes1 = 1;
+    }
 
     if (loglevel & CPU_LOG_INT) {
-        fprintf(logfile, "Raise exception at 0x" ADDRX " => 0x%08x (%02x)\n",
+        fprintf(logfile, "Raise exception at " ADDRX " => %08x (%02x)\n",
                 env->nip, excp, env->error_code);
     }
-    msr = do_load_msr(env);
+    msr = env->msr;
+    new_msr = msr;
     srr0 = SPR_SRR0;
     srr1 = SPR_SRR1;
     asrr0 = -1;
@@ -2000,7 +2198,7 @@ static always_inline void powerpc_excp (CPUState *env,
         /* Should never happen */
         return;
     case POWERPC_EXCP_CRITICAL:    /* Critical input                         */
-        msr_ri = 0; /* XXX: check this */
+        new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
         switch (excp_model) {
         case POWERPC_EXCP_40x:
             srr0 = SPR_40x_SRR2;
@@ -2018,16 +2216,25 @@ static always_inline void powerpc_excp (CPUState *env,
         goto store_next;
     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
         if (msr_me == 0) {
-            /* Machine check exception is not enabled */
-            /* XXX: we may just stop the processor here, to allow debugging */
-            excp = POWERPC_EXCP_RESET;
-            goto excp_reset;
+            /* Machine check exception is not enabled.
+             * Enter checkstop state.
+             */
+            if (loglevel != 0) {
+                fprintf(logfile, "Machine check while not allowed. "
+                        "Entering checkstop state\n");
+            } else {
+                fprintf(stderr, "Machine check while not allowed. "
+                        "Entering checkstop state\n");
+            }
+            env->halted = 1;
+            env->interrupt_request |= CPU_INTERRUPT_EXITTB;
+        }
+        new_msr &= ~((target_ulong)1 << MSR_RI);
+        new_msr &= ~((target_ulong)1 << MSR_ME);
+        if (0) {
+            /* XXX: find a suitable condition to enable the hypervisor mode */
+            new_msr |= (target_ulong)MSR_HVB;
         }
-        msr_ri = 0;
-        msr_me = 0;
-#if defined(TARGET_PPC64H)
-        msr_hv = 1;
-#endif
         /* XXX: should also have something loaded in DAR / DSISR */
         switch (excp_model) {
         case POWERPC_EXCP_40x:
@@ -2047,43 +2254,35 @@ static always_inline void powerpc_excp (CPUState *env,
     case POWERPC_EXCP_DSI:       /* Data storage exception                   */
 #if defined (DEBUG_EXCEPTIONS)
         if (loglevel != 0) {
-            fprintf(logfile, "DSI exception: DSISR=0x" ADDRX" DAR=0x" ADDRX
-                    "\n", env->spr[SPR_DSISR], env->spr[SPR_DAR]);
+            fprintf(logfile, "DSI exception: DSISR=" ADDRX" DAR=" ADDRX "\n",
+                    env->spr[SPR_DSISR], env->spr[SPR_DAR]);
         }
 #endif
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+            new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
     case POWERPC_EXCP_ISI:       /* Instruction storage exception            */
 #if defined (DEBUG_EXCEPTIONS)
         if (loglevel != 0) {
-            fprintf(logfile, "ISI exception: msr=0x" ADDRX ", nip=0x" ADDRX
-                    "\n", msr, env->nip);
+            fprintf(logfile, "ISI exception: msr=" ADDRX ", nip=" ADDRX "\n",
+                    msr, env->nip);
         }
 #endif
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+            new_msr |= (target_ulong)MSR_HVB;
         msr |= env->error_code;
         goto store_next;
     case POWERPC_EXCP_EXTERNAL:  /* External input                           */
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes0 == 1)
-            msr_hv = 1;
-#endif
+            new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
     case POWERPC_EXCP_ALIGN:     /* Alignment exception                      */
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+            new_msr |= (target_ulong)MSR_HVB;
         /* XXX: this is false */
         /* Get rS/rD and rA from faulting opcode */
         env->spr[SPR_DSISR] |= (ldl_code((env->nip - 4)) & 0x03FF0000) >> 16;
@@ -2097,53 +2296,40 @@ static always_inline void powerpc_excp (CPUState *env,
                     fprintf(logfile, "Ignore floating point exception\n");
                 }
 #endif
+                env->exception_index = POWERPC_EXCP_NONE;
+                env->error_code = 0;
                 return;
             }
-            msr_ri = 0;
-#if defined(TARGET_PPC64H)
+            new_msr &= ~((target_ulong)1 << MSR_RI);
             if (lpes1 == 0)
-                msr_hv = 1;
-#endif
+                new_msr |= (target_ulong)MSR_HVB;
             msr |= 0x00100000;
-            /* Set FX */
-            env->fpscr[7] |= 0x8;
-            /* Finally, update FEX */
-            if ((((env->fpscr[7] & 0x3) << 3) | (env->fpscr[6] >> 1)) &
-                ((env->fpscr[1] << 1) | (env->fpscr[0] >> 3)))
-                env->fpscr[7] |= 0x4;
-            if (msr_fe0 != msr_fe1) {
-                msr |= 0x00010000;
-                goto store_current;
-            }
+            if (msr_fe0 == msr_fe1)
+                goto store_next;
+            msr |= 0x00010000;
             break;
         case POWERPC_EXCP_INVAL:
 #if defined (DEBUG_EXCEPTIONS)
             if (loglevel != 0) {
-                fprintf(logfile, "Invalid instruction at 0x" ADDRX "\n",
+                fprintf(logfile, "Invalid instruction at " ADDRX "\n",
                         env->nip);
             }
 #endif
-            msr_ri = 0;
-#if defined(TARGET_PPC64H)
+            new_msr &= ~((target_ulong)1 << MSR_RI);
             if (lpes1 == 0)
-                msr_hv = 1;
-#endif
+                new_msr |= (target_ulong)MSR_HVB;
             msr |= 0x00080000;
             break;
         case POWERPC_EXCP_PRIV:
-            msr_ri = 0;
-#if defined(TARGET_PPC64H)
+            new_msr &= ~((target_ulong)1 << MSR_RI);
             if (lpes1 == 0)
-                msr_hv = 1;
-#endif
+                new_msr |= (target_ulong)MSR_HVB;
             msr |= 0x00040000;
             break;
         case POWERPC_EXCP_TRAP:
-            msr_ri = 0;
-#if defined(TARGET_PPC64H)
+            new_msr &= ~((target_ulong)1 << MSR_RI);
             if (lpes1 == 0)
-                msr_hv = 1;
-#endif
+                new_msr |= (target_ulong)MSR_HVB;
             msr |= 0x00020000;
             break;
         default:
@@ -2152,13 +2338,11 @@ static always_inline void powerpc_excp (CPUState *env,
                       env->error_code);
             break;
         }
-        goto store_next;
+        goto store_current;
     case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+            new_msr |= (target_ulong)MSR_HVB;
         goto store_current;
     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
         /* NOTE: this is a temporary hack to support graphics OSI
@@ -2166,27 +2350,27 @@ static always_inline void powerpc_excp (CPUState *env,
         /* XXX: To be removed */
         if (env->gpr[3] == 0x113724fa && env->gpr[4] == 0x77810f9b &&
             env->osi_call) {
-            if (env->osi_call(env) != 0)
+            if (env->osi_call(env) != 0) {
+                env->exception_index = POWERPC_EXCP_NONE;
+                env->error_code = 0;
                 return;
+            }
         }
         if (loglevel & CPU_LOG_INT) {
             dump_syscall(env);
         }
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
+        lev = env->error_code;
         if (lev == 1 || (lpes0 == 0 && lpes1 == 0))
-            msr_hv = 1;
-#endif
+            new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
     case POWERPC_EXCP_APU:       /* Auxiliary processor unavailable          */
-        msr_ri = 0;
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         goto store_current;
     case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+            new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
     case POWERPC_EXCP_FIT:       /* Fixed-interval timer interrupt           */
         /* FIT on 4xx */
@@ -2194,7 +2378,7 @@ static always_inline void powerpc_excp (CPUState *env,
         if (loglevel != 0)
             fprintf(logfile, "FIT exception\n");
 #endif
-        msr_ri = 0; /* XXX: check this */
+        new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
         goto store_next;
     case POWERPC_EXCP_WDT:       /* Watchdog timer interrupt                 */
 #if defined (DEBUG_EXCEPTIONS)
@@ -2209,13 +2393,13 @@ static always_inline void powerpc_excp (CPUState *env,
         default:
             break;
         }
-        msr_ri = 0; /* XXX: check this */
+        new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
         goto store_next;
     case POWERPC_EXCP_DTLB:      /* Data TLB error                           */
-        msr_ri = 0; /* XXX: check this */
+        new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
         goto store_next;
     case POWERPC_EXCP_ITLB:      /* Instruction TLB error                    */
-        msr_ri = 0; /* XXX: check this */
+        new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
         goto store_next;
     case POWERPC_EXCP_DEBUG:     /* Debug interrupt                          */
         switch (excp_model) {
@@ -2231,9 +2415,8 @@ static always_inline void powerpc_excp (CPUState *env,
         /* XXX: TODO */
         cpu_abort(env, "Debug exception is not implemented yet !\n");
         goto store_next;
-#if defined(TARGET_PPCEMB)
     case POWERPC_EXCP_SPEU:      /* SPE/embedded floating-point unavailable  */
-        msr_ri = 0; /* XXX: check this */
+        new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
         goto store_current;
     case POWERPC_EXCP_EFPDI:     /* Embedded floating-point data interrupt   */
         /* XXX: TODO */
@@ -2246,7 +2429,7 @@ static always_inline void powerpc_excp (CPUState *env,
                   "is not implemented yet !\n");
         goto store_next;
     case POWERPC_EXCP_EPERFM:    /* Embedded performance monitor interrupt   */
-        msr_ri = 0;
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         /* XXX: TODO */
         cpu_abort(env,
                   "Performance counter exception is not implemented yet !\n");
@@ -2269,87 +2452,64 @@ static always_inline void powerpc_excp (CPUState *env,
         cpu_abort(env, "Embedded doorbell critical interrupt "
                   "is not implemented yet !\n");
         goto store_next;
-#endif /* defined(TARGET_PPCEMB) */
     case POWERPC_EXCP_RESET:     /* System reset exception                   */
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
-        msr_hv = 1;
-#endif
-    excp_reset:
+        new_msr &= ~((target_ulong)1 << MSR_RI);
+        if (0) {
+            /* XXX: find a suitable condition to enable the hypervisor mode */
+            new_msr |= (target_ulong)MSR_HVB;
+        }
         goto store_next;
-#if defined(TARGET_PPC64)
     case POWERPC_EXCP_DSEG:      /* Data segment exception                   */
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes1 == 0)
-            msr_hv = 1;
-#endif
-        /* XXX: TODO */
-        cpu_abort(env, "Data segment exception is not implemented yet !\n");
+            new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
     case POWERPC_EXCP_ISEG:      /* Instruction segment exception            */
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes1 == 0)
-            msr_hv = 1;
-#endif
-        /* XXX: TODO */
-        cpu_abort(env,
-                  "Instruction segment exception is not implemented yet !\n");
+            new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
-#endif /* defined(TARGET_PPC64) */
-#if defined(TARGET_PPC64H)
     case POWERPC_EXCP_HDECR:     /* Hypervisor decrementer exception         */
         srr0 = SPR_HSRR0;
-        srr1 = SPR_HSSR1;
-        msr_hv = 1;
+        srr1 = SPR_HSRR1;
+        new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
-#endif
     case POWERPC_EXCP_TRACE:     /* Trace exception                          */
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+            new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
-#if defined(TARGET_PPC64H)
     case POWERPC_EXCP_HDSI:      /* Hypervisor data storage exception        */
         srr0 = SPR_HSRR0;
-        srr1 = SPR_HSSR1;
-        msr_hv = 1;
+        srr1 = SPR_HSRR1;
+        new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
     case POWERPC_EXCP_HISI:      /* Hypervisor instruction storage exception */
         srr0 = SPR_HSRR0;
-        srr1 = SPR_HSSR1;
-        msr_hv = 1;
-        /* XXX: TODO */
-        cpu_abort(env, "Hypervisor instruction storage exception "
-                  "is not implemented yet !\n");
+        srr1 = SPR_HSRR1;
+        new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
     case POWERPC_EXCP_HDSEG:     /* Hypervisor data segment exception        */
         srr0 = SPR_HSRR0;
-        srr1 = SPR_HSSR1;
-        msr_hv = 1;
+        srr1 = SPR_HSRR1;
+        new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
     case POWERPC_EXCP_HISEG:     /* Hypervisor instruction segment exception */
         srr0 = SPR_HSRR0;
-        srr1 = SPR_HSSR1;
-        msr_hv = 1;
+        srr1 = SPR_HSRR1;
+        new_msr |= (target_ulong)MSR_HVB;
         goto store_next;
-#endif /* defined(TARGET_PPC64H) */
     case POWERPC_EXCP_VPU:       /* Vector unavailable exception             */
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+            new_msr |= (target_ulong)MSR_HVB;
         goto store_current;
     case POWERPC_EXCP_PIT:       /* Programmable interval timer interrupt    */
 #if defined (DEBUG_EXCEPTIONS)
         if (loglevel != 0)
             fprintf(logfile, "PIT exception\n");
 #endif
-        msr_ri = 0; /* XXX: check this */
+        new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
         goto store_next;
     case POWERPC_EXCP_IO:        /* IO error exception                       */
         /* XXX: TODO */
@@ -2365,11 +2525,9 @@ static always_inline void powerpc_excp (CPUState *env,
                   "is not implemented yet !\n");
         goto store_next;
     case POWERPC_EXCP_IFTLB:     /* Instruction fetch TLB error              */
-        msr_ri = 0; /* XXX: check this */
-#if defined(TARGET_PPC64H) /* XXX: check this */
-        if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+        new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
+        if (lpes1 == 0) /* XXX: check this */
+            new_msr |= (target_ulong)MSR_HVB;
         switch (excp_model) {
         case POWERPC_EXCP_602:
         case POWERPC_EXCP_603:
@@ -2386,11 +2544,9 @@ static always_inline void powerpc_excp (CPUState *env,
         }
         break;
     case POWERPC_EXCP_DLTLB:     /* Data load TLB miss                       */
-        msr_ri = 0; /* XXX: check this */
-#if defined(TARGET_PPC64H) /* XXX: check this */
-        if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+        new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
+        if (lpes1 == 0) /* XXX: check this */
+            new_msr |= (target_ulong)MSR_HVB;
         switch (excp_model) {
         case POWERPC_EXCP_602:
         case POWERPC_EXCP_603:
@@ -2407,11 +2563,9 @@ static always_inline void powerpc_excp (CPUState *env,
         }
         break;
     case POWERPC_EXCP_DSTLB:     /* Data store TLB miss                      */
-        msr_ri = 0; /* XXX: check this */
-#if defined(TARGET_PPC64H) /* XXX: check this */
-        if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+        new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
+        if (lpes1 == 0) /* XXX: check this */
+            new_msr |= (target_ulong)MSR_HVB;
         switch (excp_model) {
         case POWERPC_EXCP_602:
         case POWERPC_EXCP_603:
@@ -2419,8 +2573,10 @@ static always_inline void powerpc_excp (CPUState *env,
         case POWERPC_EXCP_G2:
         tlb_miss_tgpr:
             /* Swap temporary saved registers with GPRs */
-            swap_gpr_tgpr(env);
-            msr_tgpr = 1;
+            if (!(new_msr & ((target_ulong)1 << MSR_TGPR))) {
+                new_msr |= (target_ulong)1 << MSR_TGPR;
+                hreg_swap_gpr_tgpr(env);
+            }
             goto tlb_miss;
         case POWERPC_EXCP_7x5:
         tlb_miss:
@@ -2465,8 +2621,8 @@ static always_inline void powerpc_excp (CPUState *env,
                 if (excp == POWERPC_EXCP_IFTLB) {
                     es = "I";
                     en = 'I';
-                    miss = &env->spr[SPR_IMISS];
-                    cmp = &env->spr[SPR_ICMP];
+                    miss = &env->spr[SPR_TLBMISS];
+                    cmp = &env->spr[SPR_PTEHI];
                 } else {
                     if (excp == POWERPC_EXCP_DLTLB)
                         es = "DL";
@@ -2493,6 +2649,10 @@ static always_inline void powerpc_excp (CPUState *env,
         cpu_abort(env, "Floating point assist exception "
                   "is not implemented yet !\n");
         goto store_next;
+    case POWERPC_EXCP_DABR:      /* Data address breakpoint                  */
+        /* XXX: TODO */
+        cpu_abort(env, "DABR exception is not implemented yet !\n");
+        goto store_next;
     case POWERPC_EXCP_IABR:      /* Instruction address breakpoint           */
         /* XXX: TODO */
         cpu_abort(env, "IABR exception is not implemented yet !\n");
@@ -2507,11 +2667,9 @@ static always_inline void powerpc_excp (CPUState *env,
                   "is not implemented yet !\n");
         goto store_next;
     case POWERPC_EXCP_PERFM:     /* Embedded performance monitor interrupt   */
-        msr_ri = 0;
-#if defined(TARGET_PPC64H)
+        new_msr &= ~((target_ulong)1 << MSR_RI);
         if (lpes1 == 0)
-            msr_hv = 1;
-#endif
+            new_msr |= (target_ulong)MSR_HVB;
         /* XXX: TODO */
         cpu_abort(env,
                   "Performance counter exception is not implemented yet !\n");
@@ -2530,6 +2688,16 @@ static always_inline void powerpc_excp (CPUState *env,
         cpu_abort(env,
                   "970 maintenance exception is not implemented yet !\n");
         goto store_next;
+    case POWERPC_EXCP_MEXTBR:    /* Maskable external breakpoint             */
+        /* XXX: TODO */
+        cpu_abort(env, "Maskable external exception "
+                  "is not implemented yet !\n");
+        goto store_next;
+    case POWERPC_EXCP_NMEXTBR:   /* Non maskable external breakpoint         */
+        /* XXX: TODO */
+        cpu_abort(env, "Non maskable external exception "
+                  "is not implemented yet !\n");
+        goto store_next;
     default:
     excp_invalid:
         cpu_abort(env, "Invalid PowerPC exception %d. Aborting\n", excp);
@@ -2551,41 +2719,55 @@ static always_inline void powerpc_excp (CPUState *env,
     if (asrr1 != -1)
         env->spr[asrr1] = env->spr[srr1];
     /* If we disactivated any translation, flush TLBs */
-    if (msr_ir || msr_dr)
+    if (new_msr & ((1 << MSR_IR) | (1 << MSR_DR)))
         tlb_flush(env, 1);
     /* reload MSR with correct bits */
-    msr_ee = 0;
-    msr_pr = 0;
-    msr_fp = 0;
-    msr_fe0 = 0;
-    msr_se = 0;
-    msr_be = 0;
-    msr_fe1 = 0;
-    msr_ir = 0;
-    msr_dr = 0;
+    new_msr &= ~((target_ulong)1 << MSR_EE);
+    new_msr &= ~((target_ulong)1 << MSR_PR);
+    new_msr &= ~((target_ulong)1 << MSR_FP);
+    new_msr &= ~((target_ulong)1 << MSR_FE0);
+    new_msr &= ~((target_ulong)1 << MSR_SE);
+    new_msr &= ~((target_ulong)1 << MSR_BE);
+    new_msr &= ~((target_ulong)1 << MSR_FE1);
+    new_msr &= ~((target_ulong)1 << MSR_IR);
+    new_msr &= ~((target_ulong)1 << MSR_DR);
 #if 0 /* Fix this: not on all targets */
-    msr_pmm = 0;
+    new_msr &= ~((target_ulong)1 << MSR_PMM);
 #endif
-    msr_le = msr_ile;
-    do_compute_hflags(env);
+    new_msr &= ~((target_ulong)1 << MSR_LE);
+    if (msr_ile)
+        new_msr |= (target_ulong)1 << MSR_LE;
+    else
+        new_msr &= ~((target_ulong)1 << MSR_LE);
     /* Jump to handler */
     vector = env->excp_vectors[excp];
-    if (vector == (target_ulong)-1) {
+    if (vector == (target_ulong)-1ULL) {
         cpu_abort(env, "Raised an exception without defined vector %d\n",
                   excp);
     }
     vector |= env->excp_prefix;
 #if defined(TARGET_PPC64)
     if (excp_model == POWERPC_EXCP_BOOKE) {
-        msr_cm = msr_icm;
-        if (!msr_cm)
+        if (!msr_icm) {
+            new_msr &= ~((target_ulong)1 << MSR_CM);
             vector = (uint32_t)vector;
+        } else {
+            new_msr |= (target_ulong)1 << MSR_CM;
+        }
     } else {
-        msr_sf = msr_isf;
-        if (!msr_sf)
+        if (!msr_isf) {
+            new_msr &= ~((target_ulong)1 << MSR_SF);
             vector = (uint32_t)vector;
+        } else {
+            new_msr |= (target_ulong)1 << MSR_SF;
+        }
     }
 #endif
+    /* XXX: we don't use hreg_store_msr here as already have treated
+     *      any special case that could occur. Just store MSR and update hflags
+     */
+    env->msr = new_msr & env->msr_mask;
+    hreg_compute_hflags(env);
     env->nip = vector;
     /* Reset exception state */
     env->exception_index = POWERPC_EXCP_NONE;
@@ -2599,11 +2781,13 @@ void do_interrupt (CPUState *env)
 
 void ppc_hw_interrupt (CPUPPCState *env)
 {
-#if 1
+    int hdice;
+
+#if 0
     if (loglevel & CPU_LOG_INT) {
         fprintf(logfile, "%s: %p pending %08x req %08x me %d ee %d\n",
                 __func__, env, env->pending_interrupts,
-                env->interrupt_request, msr_me, msr_ee);
+                env->interrupt_request, (int)msr_me, (int)msr_ee);
     }
 #endif
     /* External reset */
@@ -2626,8 +2810,13 @@ void ppc_hw_interrupt (CPUPPCState *env)
         return;
     }
 #endif
-#if defined(TARGET_PPC64H)
-    if ((msr_ee != 0 || msr_hv == 0 || msr_pr == 1) & hdice != 0) {
+    if (0) {
+        /* XXX: find a suitable condition to enable the hypervisor mode */
+        hdice = env->spr[SPR_LPCR] & 1;
+    } else {
+        hdice = 0;
+    }
+    if ((msr_ee != 0 || msr_hv == 0 || msr_pr != 0) && hdice != 0) {
         /* Hypervisor decrementer exception */
         if (env->pending_interrupts & (1 << PPC_INTERRUPT_HDECR)) {
             env->pending_interrupts &= ~(1 << PPC_INTERRUPT_HDECR);
@@ -2635,7 +2824,6 @@ void ppc_hw_interrupt (CPUPPCState *env)
             return;
         }
     }
-#endif
     if (msr_ce != 0) {
         /* External critical interrupt */
         if (env->pending_interrupts & (1 << PPC_INTERRUPT_CEXT)) {
@@ -2656,26 +2844,11 @@ void ppc_hw_interrupt (CPUPPCState *env)
             powerpc_excp(env, env->excp_model, POWERPC_EXCP_WDT);
             return;
         }
-#if defined(TARGET_PPCEMB)
         if (env->pending_interrupts & (1 << PPC_INTERRUPT_CDOORBELL)) {
             env->pending_interrupts &= ~(1 << PPC_INTERRUPT_CDOORBELL);
             powerpc_excp(env, env->excp_model, POWERPC_EXCP_DOORCI);
             return;
         }
-#endif
-#if defined(TARGET_PPCEMB)
-        /* External interrupt */
-        if (env->pending_interrupts & (1 << PPC_INTERRUPT_EXT)) {
-            /* Taking an external interrupt does not clear the external
-             * interrupt status
-             */
-#if 0
-            env->pending_interrupts &= ~(1 << PPC_INTERRUPT_EXT);
-#endif
-            powerpc_excp(env, env->excp_model, POWERPC_EXCP_EXTERNAL);
-            return;
-        }
-#endif
         /* Fixed interval timer on embedded PowerPC */
         if (env->pending_interrupts & (1 << PPC_INTERRUPT_FIT)) {
             env->pending_interrupts &= ~(1 << PPC_INTERRUPT_FIT);
@@ -2694,7 +2867,6 @@ void ppc_hw_interrupt (CPUPPCState *env)
             powerpc_excp(env, env->excp_model, POWERPC_EXCP_DECR);
             return;
         }
-#if !defined(TARGET_PPCEMB)
         /* External interrupt */
         if (env->pending_interrupts & (1 << PPC_INTERRUPT_EXT)) {
             /* Taking an external interrupt does not clear the external
@@ -2706,14 +2878,11 @@ void ppc_hw_interrupt (CPUPPCState *env)
             powerpc_excp(env, env->excp_model, POWERPC_EXCP_EXTERNAL);
             return;
         }
-#endif
-#if defined(TARGET_PPCEMB)
         if (env->pending_interrupts & (1 << PPC_INTERRUPT_DOORBELL)) {
             env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DOORBELL);
             powerpc_excp(env, env->excp_model, POWERPC_EXCP_DOORI);
             return;
         }
-#endif
         if (env->pending_interrupts & (1 << PPC_INTERRUPT_PERFM)) {
             env->pending_interrupts &= ~(1 << PPC_INTERRUPT_PERFM);
             powerpc_excp(env, env->excp_model, POWERPC_EXCP_PERFM);
@@ -2759,34 +2928,33 @@ void cpu_dump_rfi (target_ulong RA, target_ulong msr)
 void cpu_ppc_reset (void *opaque)
 {
     CPUPPCState *env;
-    int i;
+    target_ulong msr;
 
     env = opaque;
-    /* XXX: some of those flags initialisation values could depend
-     *      on the actual PowerPC implementation
-     */
-    for (i = 0; i < 63; i++)
-        env->msr[i] = 0;
-#if defined(TARGET_PPC64)
-    msr_hv = 0; /* Should be 1... */
-#endif
-    msr_ap = 0; /* TO BE CHECKED */
-    msr_sa = 0; /* TO BE CHECKED */
-    msr_ip = 0; /* TO BE CHECKED */
+    msr = (target_ulong)0;
+    if (0) {
+        /* XXX: find a suitable condition to enable the hypervisor mode */
+        msr |= (target_ulong)MSR_HVB;
+    }
+    msr |= (target_ulong)0 << MSR_AP; /* TO BE CHECKED */
+    msr |= (target_ulong)0 << MSR_SA; /* TO BE CHECKED */
+    msr |= (target_ulong)1 << MSR_EP;
 #if defined (DO_SINGLE_STEP) && 0
     /* Single step trace mode */
-    msr_se = 1;
-    msr_be = 1;
+    msr |= (target_ulong)1 << MSR_SE;
+    msr |= (target_ulong)1 << MSR_BE;
 #endif
 #if defined(CONFIG_USER_ONLY)
-    msr_fp = 1; /* Allow floating point exceptions */
-    msr_pr = 1;
+    msr |= (target_ulong)1 << MSR_FP; /* Allow floating point usage */
+    msr |= (target_ulong)1 << MSR_PR;
 #else
-    env->nip = 0xFFFFFFFC;
-    ppc_tlb_invalidate_all(env);
+    env->nip = env->hreset_vector | env->excp_prefix;
+    if (env->mmu_model != POWERPC_MMU_REAL)
+        ppc_tlb_invalidate_all(env);
 #endif
-    do_compute_hflags(env);
-    env->reserve = -1;
+    env->msr = msr;
+    hreg_compute_hflags(env);
+    env->reserve = (target_ulong)-1ULL;
     /* Be sure no exception or interrupt is pending */
     env->pending_interrupts = 0;
     env->exception_index = POWERPC_EXCP_NONE;
@@ -2795,21 +2963,27 @@ void cpu_ppc_reset (void *opaque)
     tlb_flush(env, 1);
 }
 
-CPUPPCState *cpu_ppc_init (void)
+CPUPPCState *cpu_ppc_init (const char *cpu_model)
 {
     CPUPPCState *env;
+    const ppc_def_t *def;
+
+    def = cpu_ppc_find_by_name(cpu_model);
+    if (!def)
+        return NULL;
 
     env = qemu_mallocz(sizeof(CPUPPCState));
     if (!env)
         return NULL;
     cpu_exec_init(env);
+    env->cpu_model_str = cpu_model;
+    cpu_ppc_register_internal(env, def);
     cpu_ppc_reset(env);
-
     return env;
 }
 
 void cpu_ppc_close (CPUPPCState *env)
 {
     /* Should also remove all opcode tables... */
-    free(env);
+    qemu_free(env);
 }
diff --git a/target-ppc/helper_regs.h b/target-ppc/helper_regs.h
new file mode 100644
index 000000000..c507d26cf
--- /dev/null
+++ b/target-ppc/helper_regs.h
@@ -0,0 +1,130 @@
+/*
+ *  PowerPC emulation special registers manipulation helpers for qemu.
+ *
+ *  Copyright (c) 2003-2007 Jocelyn Mayer
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#if !defined(__HELPER_REGS_H__)
+#define __HELPER_REGS_H__
+
+static always_inline target_ulong hreg_load_xer (CPUPPCState *env)
+{
+    return (xer_so << XER_SO) |
+        (xer_ov << XER_OV) |
+        (xer_ca << XER_CA) |
+        (xer_bc << XER_BC) |
+        (xer_cmp << XER_CMP);
+}
+
+static always_inline void hreg_store_xer (CPUPPCState *env, target_ulong value)
+{
+    xer_so = (value >> XER_SO) & 0x01;
+    xer_ov = (value >> XER_OV) & 0x01;
+    xer_ca = (value >> XER_CA) & 0x01;
+    xer_cmp = (value >> XER_CMP) & 0xFF;
+    xer_bc = (value >> XER_BC) & 0x7F;
+}
+
+/* Swap temporary saved registers with GPRs */
+static always_inline void hreg_swap_gpr_tgpr (CPUPPCState *env)
+{
+    ppc_gpr_t tmp;
+
+    tmp = env->gpr[0];
+    env->gpr[0] = env->tgpr[0];
+    env->tgpr[0] = tmp;
+    tmp = env->gpr[1];
+    env->gpr[1] = env->tgpr[1];
+    env->tgpr[1] = tmp;
+    tmp = env->gpr[2];
+    env->gpr[2] = env->tgpr[2];
+    env->tgpr[2] = tmp;
+    tmp = env->gpr[3];
+    env->gpr[3] = env->tgpr[3];
+    env->tgpr[3] = tmp;
+}
+
+static always_inline void hreg_compute_mem_idx (CPUPPCState *env)
+{
+    /* Precompute MMU index */
+    if (msr_pr == 0 && msr_hv != 0) {
+        env->mmu_idx = 2;
+    } else {
+        env->mmu_idx = 1 - msr_pr;
+    }
+}
+
+static always_inline void hreg_compute_hflags (CPUPPCState *env)
+{
+    target_ulong hflags_mask;
+
+    /* We 'forget' FE0 & FE1: we'll never generate imprecise exceptions */
+    hflags_mask = (1 << MSR_VR) | (1 << MSR_AP) | (1 << MSR_SA) |
+        (1 << MSR_PR) | (1 << MSR_FP) | (1 << MSR_SE) | (1 << MSR_BE) |
+        (1 << MSR_LE);
+    hflags_mask |= (1ULL << MSR_CM) | (1ULL << MSR_SF) | MSR_HVB;
+    hreg_compute_mem_idx(env);
+    env->hflags = env->msr & hflags_mask;
+    /* Merge with hflags coming from other registers */
+    env->hflags |= env->hflags_nmsr;
+}
+
+static always_inline int hreg_store_msr (CPUPPCState *env, target_ulong value,
+                                         int alter_hv)
+{
+    int excp;
+
+    excp = 0;
+    value &= env->msr_mask;
+#if !defined (CONFIG_USER_ONLY)
+    if (!alter_hv) {
+        /* mtmsr cannot alter the hypervisor state */
+        value &= ~MSR_HVB;
+        value |= env->msr & MSR_HVB;
+    }
+    if (((value >> MSR_IR) & 1) != msr_ir ||
+        ((value >> MSR_DR) & 1) != msr_dr) {
+        /* Flush all tlb when changing translation mode */
+        tlb_flush(env, 1);
+        excp = POWERPC_EXCP_NONE;
+        env->interrupt_request |= CPU_INTERRUPT_EXITTB;
+    }
+    if (unlikely((env->flags & POWERPC_FLAG_TGPR) &&
+                 ((value ^ env->msr) & (1 << MSR_TGPR)))) {
+        /* Swap temporary saved registers with GPRs */
+        hreg_swap_gpr_tgpr(env);
+    }
+    if (unlikely((value >> MSR_EP) & 1) != msr_ep) {
+        /* Change the exception prefix on PowerPC 601 */
+        env->excp_prefix = ((value >> MSR_EP) & 1) * 0xFFF00000;
+    }
+#endif
+    env->msr = value;
+    hreg_compute_hflags(env);
+#if !defined (CONFIG_USER_ONLY)
+    if (unlikely(msr_pow == 1)) {
+        if ((*env->check_pow)(env)) {
+            env->halted = 1;
+            excp = EXCP_HALTED;
+        }
+    }
+#endif
+
+    return excp;
+}
+
+#endif /* !defined(__HELPER_REGS_H__) */
diff --git a/target-ppc/op.c b/target-ppc/op.c
index 822c26769..c950579a1 100644
--- a/target-ppc/op.c
+++ b/target-ppc/op.c
@@ -22,6 +22,8 @@
 
 #include "config.h"
 #include "exec.h"
+#include "host-utils.h"
+#include "helper_regs.h"
 #include "op_helper.h"
 
 #define REG 0
@@ -120,7 +122,6 @@
 #define REG 31
 #include "op_template.h"
 
-
 void OPPROTO op_print_mem_EA (void)
 {
     do_print_mem_EA(T0);
@@ -135,13 +136,6 @@ void OPPROTO op_set_Rc0 (void)
     RETURN();
 }
 
-/* Set Rc1 (for floating point arithmetic) */
-void OPPROTO op_set_Rc1 (void)
-{
-    env->crf[1] = env->fpscr[7];
-    RETURN();
-}
-
 /* Constants load */
 void OPPROTO op_reset_T0 (void)
 {
@@ -180,7 +174,7 @@ void OPPROTO op_set_T1_64 (void)
 #if 0 // unused
 void OPPROTO op_set_T2 (void)
 {
-    T2 = PARAM1;
+    T2 = (uint32_t)PARAM1;
     RETURN();
 }
 #endif
@@ -197,6 +191,12 @@ void OPPROTO op_move_T2_T0 (void)
     RETURN();
 }
 
+void OPPROTO op_moven_T2_T0 (void)
+{
+    T2 = ~T0;
+    RETURN();
+}
+
 /* Generate exceptions */
 void OPPROTO op_raise_exception_err (void)
 {
@@ -285,13 +285,13 @@ void OPPROTO op_store_xer_bc (void)
 
 void OPPROTO op_load_xer (void)
 {
-    do_load_xer();
+    T0 = hreg_load_xer(env);
     RETURN();
 }
 
 void OPPROTO op_store_xer (void)
 {
-    do_store_xer();
+    hreg_store_xer(env, T0);
     RETURN();
 }
 
@@ -317,6 +317,20 @@ void OPPROTO op_store_sr (void)
     RETURN();
 }
 
+#if defined(TARGET_PPC64)
+void OPPROTO op_load_slb (void)
+{
+    T0 = ppc_load_slb(env, T1);
+    RETURN();
+}
+
+void OPPROTO op_store_slb (void)
+{
+    ppc_store_slb(env, T1, T0);
+    RETURN();
+}
+#endif /* defined(TARGET_PPC64) */
+
 void OPPROTO op_load_sdr1 (void)
 {
     T0 = env->sdr1;
@@ -345,31 +359,36 @@ void OPPROTO op_store_asr (void)
 
 void OPPROTO op_load_msr (void)
 {
-    T0 = do_load_msr(env);
+    T0 = env->msr;
     RETURN();
 }
 
 void OPPROTO op_store_msr (void)
 {
-    do_store_msr(env, T0);
+    do_store_msr();
     RETURN();
 }
 
-void OPPROTO op_update_riee (void)
+#if defined (TARGET_PPC64)
+void OPPROTO op_store_msr_32 (void)
 {
-    msr_ri = (T0 >> MSR_RI) & 1;
-    msr_ee = (T0 >> MSR_EE) & 1;
+    T0 = (env->msr & ~0xFFFFFFFFULL) | (T0 & 0xFFFFFFFF);
+    do_store_msr();
     RETURN();
 }
+#endif
 
-#if defined (TARGET_PPC64)
-void OPPROTO op_store_msr_32 (void)
+void OPPROTO op_update_riee (void)
 {
-    ppc_store_msr_32(env, T0);
+    /* We don't call do_store_msr here as we won't trigger
+     * any special case nor change hflags
+     */
+    T0 &= (1 << MSR_RI) | (1 << MSR_EE);
+    env->msr &= ~(1 << MSR_RI) | (1 << MSR_EE);
+    env->msr |= T0;
     RETURN();
 }
 #endif
-#endif
 
 /* SPR */
 void OPPROTO op_load_spr (void)
@@ -533,40 +552,108 @@ void OPPROTO op_store_dbatl (void)
 #endif /* !defined(CONFIG_USER_ONLY) */
 
 /* FPSCR */
-void OPPROTO op_load_fpscr (void)
+#ifdef CONFIG_SOFTFLOAT
+void OPPROTO op_reset_fpstatus (void)
 {
-    do_load_fpscr();
+    env->fp_status.float_exception_flags = 0;
     RETURN();
 }
+#endif
 
-void OPPROTO op_store_fpscr (void)
+void OPPROTO op_compute_fprf (void)
 {
-    do_store_fpscr(PARAM1);
+    do_compute_fprf(PARAM1);
+    RETURN();
+}
+
+#ifdef CONFIG_SOFTFLOAT
+void OPPROTO op_float_check_status (void)
+{
+    do_float_check_status();
     RETURN();
 }
+#else
+void OPPROTO op_float_check_status (void)
+{
+    if (env->exception_index == POWERPC_EXCP_PROGRAM &&
+        (env->error_code & POWERPC_EXCP_FP)) {
+        /* Differred floating-point exception after target FPR update */
+        if (msr_fe0 != 0 || msr_fe1 != 0)
+            do_raise_exception_err(env->exception_index, env->error_code);
+    }
+    RETURN();
+}
+#endif
 
-void OPPROTO op_reset_scrfx (void)
+#if defined(WORDS_BIGENDIAN)
+#define WORD0 0
+#define WORD1 1
+#else
+#define WORD0 1
+#define WORD1 0
+#endif
+void OPPROTO op_load_fpscr_FT0 (void)
 {
-    env->fpscr[7] &= ~0x8;
+    /* The 32 MSB of the target fpr are undefined.
+     * They'll be zero...
+     */
+    union {
+        float64 d;
+        struct {
+            uint32_t u[2];
+        } s;
+    } u;
+
+    u.s.u[WORD0] = 0;
+    u.s.u[WORD1] = env->fpscr;
+    FT0 = u.d;
+    RETURN();
+}
+
+void OPPROTO op_set_FT0 (void)
+{
+    union {
+        float64 d;
+        struct {
+            uint32_t u[2];
+        } s;
+    } u;
+
+    u.s.u[WORD0] = 0;
+    u.s.u[WORD1] = PARAM1;
+    FT0 = u.d;
     RETURN();
 }
+#undef WORD0
+#undef WORD1
 
-/* crf operations */
-void OPPROTO op_getbit_T0 (void)
+void OPPROTO op_load_fpscr_T0 (void)
 {
-    T0 = (T0 >> PARAM1) & 1;
+    T0 = (env->fpscr >> PARAM1) & 0xF;
     RETURN();
 }
 
-void OPPROTO op_getbit_T1 (void)
+void OPPROTO op_load_fpcc (void)
 {
-    T1 = (T1 >> PARAM1) & 1;
+    T0 = fpscr_fpcc;
     RETURN();
 }
 
-void OPPROTO op_setcrfbit (void)
+void OPPROTO op_fpscr_resetbit (void)
 {
-    T1 = (T1 & PARAM1) | (T0 << PARAM2);
+    env->fpscr &= PARAM1;
+    RETURN();
+}
+
+void OPPROTO op_fpscr_setbit (void)
+{
+    do_fpscr_setbit(PARAM1);
+    RETURN();
+}
+
+void OPPROTO op_store_fpscr (void)
+{
+    do_store_fpscr(PARAM1);
     RETURN();
 }
 
@@ -766,26 +853,18 @@ void OPPROTO op_add (void)
 
 void OPPROTO op_check_addo (void)
 {
-    if (likely(!(((uint32_t)T2 ^ (uint32_t)T1 ^ UINT32_MAX) &
-                 ((uint32_t)T2 ^ (uint32_t)T0) & (1UL << 31)))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
+    xer_ov = (((uint32_t)T2 ^ (uint32_t)T1 ^ UINT32_MAX) &
+              ((uint32_t)T2 ^ (uint32_t)T0)) >> 31;
+    xer_so |= xer_ov;
     RETURN();
 }
 
 #if defined(TARGET_PPC64)
 void OPPROTO op_check_addo_64 (void)
 {
-    if (likely(!(((uint64_t)T2 ^ (uint64_t)T1 ^ UINT64_MAX) &
-                 ((uint64_t)T2 ^ (uint64_t)T0) & (1ULL << 63)))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
+    xer_ov = (((uint64_t)T2 ^ (uint64_t)T1 ^ UINT64_MAX) &
+              ((uint64_t)T2 ^ (uint64_t)T0)) >> 63;
+    xer_so |= xer_ov;
     RETURN();
 }
 #endif
@@ -841,6 +920,8 @@ void OPPROTO op_add_me (void)
     T0 += xer_ca + (-1);
     if (likely((uint32_t)T1 != 0))
         xer_ca = 1;
+    else
+        xer_ca = 0;
     RETURN();
 }
 
@@ -850,6 +931,8 @@ void OPPROTO op_add_me_64 (void)
     T0 += xer_ca + (-1);
     if (likely((uint64_t)T1 != 0))
         xer_ca = 1;
+    else
+        xer_ca = 0;
     RETURN();
 }
 #endif
@@ -876,9 +959,9 @@ void OPPROTO op_add_ze (void)
 /* divide word */
 void OPPROTO op_divw (void)
 {
-    if (unlikely(((int32_t)T0 == INT32_MIN && (int32_t)T1 == -1) ||
+    if (unlikely(((int32_t)T0 == INT32_MIN && (int32_t)T1 == (int32_t)-1) ||
                  (int32_t)T1 == 0)) {
-        T0 = (int32_t)((-1) * ((uint32_t)T0 >> 31));
+        T0 = (int32_t)(UINT32_MAX * ((uint32_t)T0 >> 31));
     } else {
         T0 = (int32_t)T0 / (int32_t)T1;
     }
@@ -888,9 +971,9 @@ void OPPROTO op_divw (void)
 #if defined(TARGET_PPC64)
 void OPPROTO op_divd (void)
 {
-    if (unlikely(((int64_t)T0 == INT64_MIN && (int64_t)T1 == -1) ||
+    if (unlikely(((int64_t)T0 == INT64_MIN && (int64_t)T1 == (int64_t)-1LL) ||
                  (int64_t)T1 == 0)) {
-        T0 = (int64_t)((-1ULL) * ((uint64_t)T0 >> 63));
+        T0 = (int64_t)(UINT64_MAX * ((uint64_t)T0 >> 63));
     } else {
         T0 = (int64_t)T0 / (int64_t)T1;
     }
@@ -961,7 +1044,7 @@ void OPPROTO op_mulhd (void)
 {
     uint64_t tl, th;
 
-    do_imul64(&tl, &th);
+    muls64(&tl, &th, T0, T1);
     T0 = th;
     RETURN();
 }
@@ -979,7 +1062,7 @@ void OPPROTO op_mulhdu (void)
 {
     uint64_t tl, th;
 
-    do_mul64(&tl, &th);
+    mulu64(&tl, &th, T0, T1);
     T0 = th;
     RETURN();
 }
@@ -1061,32 +1144,6 @@ void OPPROTO op_subf (void)
     RETURN();
 }
 
-void OPPROTO op_check_subfo (void)
-{
-    if (likely(!(((uint32_t)(~T2) ^ (uint32_t)T1 ^ UINT32_MAX) &
-                 ((uint32_t)(~T2) ^ (uint32_t)T0) & (1UL << 31)))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
-    RETURN();
-}
-
-#if defined(TARGET_PPC64)
-void OPPROTO op_check_subfo_64 (void)
-{
-    if (likely(!(((uint64_t)(~T2) ^ (uint64_t)T1 ^ UINT64_MAX) &
-                 ((uint64_t)(~T2) ^ (uint64_t)T0) & (1ULL << 63)))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
-    RETURN();
-}
-#endif
-
 /* subtract from carrying */
 void OPPROTO op_check_subfc (void)
 {
@@ -1140,7 +1197,7 @@ void OPPROTO op_subfic (void)
 #if defined(TARGET_PPC64)
 void OPPROTO op_subfic_64 (void)
 {
-    T0 = PARAM1 + ~T0 + 1;
+    T0 = (int64_t)PARAM1 + ~T0 + 1;
     if ((uint64_t)T0 <= (uint64_t)PARAM1) {
         xer_ca = 1;
     } else {
@@ -1154,8 +1211,10 @@ void OPPROTO op_subfic_64 (void)
 void OPPROTO op_subfme (void)
 {
     T0 = ~T0 + xer_ca - 1;
-    if (likely((uint32_t)T0 != (uint32_t)-1))
+    if (likely((uint32_t)T0 != UINT32_MAX))
         xer_ca = 1;
+    else
+        xer_ca = 0;
     RETURN();
 }
 
@@ -1163,8 +1222,10 @@ void OPPROTO op_subfme (void)
 void OPPROTO op_subfme_64 (void)
 {
     T0 = ~T0 + xer_ca - 1;
-    if (likely((uint64_t)T0 != (uint64_t)-1))
+    if (likely((uint64_t)T0 != UINT64_MAX))
         xer_ca = 1;
+    else
+        xer_ca = 0;
     RETURN();
 }
 #endif
@@ -1382,42 +1443,41 @@ void OPPROTO op_andc (void)
 /* andi. */
 void OPPROTO op_andi_T0 (void)
 {
-    T0 &= PARAM1;
+    T0 &= (uint32_t)PARAM1;
     RETURN();
 }
 
 void OPPROTO op_andi_T1 (void)
 {
-    T1 &= PARAM1;
+    T1 &= (uint32_t)PARAM1;
     RETURN();
 }
 
 #if defined(TARGET_PPC64)
 void OPPROTO op_andi_T0_64 (void)
 {
-    T0 &= ((uint64_t)PARAM1 << 32) | PARAM2;
+    T0 &= ((uint64_t)PARAM1 << 32) | (uint64_t)PARAM2;
     RETURN();
 }
 
 void OPPROTO op_andi_T1_64 (void)
 {
-    T1 &= ((uint64_t)PARAM1 << 32) | PARAM2;
+    T1 &= ((uint64_t)PARAM1 << 32) | (uint64_t)PARAM2;
     RETURN();
 }
 #endif
 
-
 /* count leading zero */
 void OPPROTO op_cntlzw (void)
 {
-    T0 = _do_cntlzw(T0);
+    do_cntlzw();
     RETURN();
 }
 
 #if defined(TARGET_PPC64)
 void OPPROTO op_cntlzd (void)
 {
-    T0 = _do_cntlzd(T0);
+    do_cntlzd();
     RETURN();
 }
 #endif
@@ -1490,7 +1550,7 @@ void OPPROTO op_orc (void)
 /* ori */
 void OPPROTO op_ori (void)
 {
-    T0 |= PARAM1;
+    T0 |= (uint32_t)PARAM1;
     RETURN();
 }
 
@@ -1504,7 +1564,7 @@ void OPPROTO op_xor (void)
 /* xori */
 void OPPROTO op_xori (void)
 {
-    T0 ^= PARAM1;
+    T0 ^= (uint32_t)PARAM1;
     RETURN();
 }
 
@@ -1638,6 +1698,12 @@ void OPPROTO op_sli_T0 (void)
     RETURN();
 }
 
+void OPPROTO op_sli_T1 (void)
+{
+    T1 = T1 << PARAM1;
+    RETURN();
+}
+
 void OPPROTO op_srl_T0_T1 (void)
 {
     T0 = (uint32_t)T0 >> T1;
@@ -1684,28 +1750,44 @@ void OPPROTO op_srli_T1_64 (void)
 /* fadd - fadd. */
 void OPPROTO op_fadd (void)
 {
+#if USE_PRECISE_EMULATION
+    do_fadd();
+#else
     FT0 = float64_add(FT0, FT1, &env->fp_status);
+#endif
     RETURN();
 }
 
 /* fsub - fsub. */
 void OPPROTO op_fsub (void)
 {
+#if USE_PRECISE_EMULATION
+    do_fsub();
+#else
     FT0 = float64_sub(FT0, FT1, &env->fp_status);
+#endif
     RETURN();
 }
 
 /* fmul - fmul. */
 void OPPROTO op_fmul (void)
 {
+#if USE_PRECISE_EMULATION
+    do_fmul();
+#else
     FT0 = float64_mul(FT0, FT1, &env->fp_status);
+#endif
     RETURN();
 }
 
 /* fdiv - fdiv. */
 void OPPROTO op_fdiv (void)
 {
+#if USE_PRECISE_EMULATION
+    do_fdiv();
+#else
     FT0 = float64_div(FT0, FT1, &env->fp_status);
+#endif
     RETURN();
 }
 
@@ -1787,7 +1869,11 @@ void OPPROTO op_fnmsub (void)
 /* frsp - frsp. */
 void OPPROTO op_frsp (void)
 {
+#if USE_PRECISE_EMULATION
+    do_frsp();
+#else
     FT0 = float64_to_float32(FT0, &env->fp_status);
+#endif
     RETURN();
 }
 
@@ -1901,13 +1987,16 @@ void OPPROTO op_fneg (void)
 #define MEMSUFFIX _kernel
 #include "op_helper.h"
 #include "op_mem.h"
+#define MEMSUFFIX _hypv
+#include "op_helper.h"
+#include "op_mem.h"
 #endif
 
 /* Special op to check and maybe clear reservation */
 void OPPROTO op_check_reservation (void)
 {
     if ((uint32_t)env->reserve == (uint32_t)(T0 & ~0x00000003))
-        env->reserve = -1;
+        env->reserve = (target_ulong)-1ULL;
     RETURN();
 }
 
@@ -1915,7 +2004,7 @@ void OPPROTO op_check_reservation (void)
 void OPPROTO op_check_reservation_64 (void)
 {
     if ((uint64_t)env->reserve == (uint64_t)(T0 & ~0x00000003))
-        env->reserve = -1;
+        env->reserve = (target_ulong)-1ULL;
     RETURN();
 }
 #endif
@@ -1940,9 +2029,7 @@ void OPPROTO op_rfid (void)
     do_rfid();
     RETURN();
 }
-#endif
 
-#if defined(TARGET_PPC64H)
 void OPPROTO op_hrfid (void)
 {
     do_hrfid();
@@ -2079,30 +2166,27 @@ void OPPROTO op_store_601_rtcu (void)
     RETURN();
 }
 
+void OPPROTO op_store_hid0_601 (void)
+{
+    do_store_hid0_601();
+    RETURN();
+}
+
 void OPPROTO op_load_601_bat (void)
 {
     T0 = env->IBAT[PARAM1][PARAM2];
     RETURN();
 }
-#endif /* !defined(CONFIG_USER_ONLY) */
 
-/* 601 unified BATs store.
- * To avoid using specific MMU code for 601, we store BATs in
- * IBAT and DBAT simultaneously, then emulate unified BATs.
- */
-#if !defined(CONFIG_USER_ONLY)
 void OPPROTO op_store_601_batl (void)
 {
-    int nr = PARAM1;
-
-    env->IBAT[1][nr] = T0;
-    env->DBAT[1][nr] = T0;
+    do_store_ibatl_601(env, PARAM1, T0);
     RETURN();
 }
 
 void OPPROTO op_store_601_batu (void)
 {
-    do_store_601_batu(PARAM1);
+    do_store_ibatu_601(env, PARAM1, T0);
     RETURN();
 }
 #endif /* !defined(CONFIG_USER_ONLY) */
@@ -2111,9 +2195,9 @@ void OPPROTO op_store_601_batu (void)
 /* XXX: those micro-ops need tests ! */
 void OPPROTO op_POWER_abs (void)
 {
-    if (T0 == INT32_MIN)
+    if ((int32_t)T0 == INT32_MIN)
         T0 = INT32_MAX;
-    else if (T0 < 0)
+    else if ((int32_t)T0 < 0)
         T0 = -T0;
     RETURN();
 }
@@ -2223,7 +2307,7 @@ void OPPROTO op_POWER_nabso (void)
 void OPPROTO op_POWER_rlmi (void)
 {
     T0 = rotl32(T0, T2) & PARAM1;
-    T0 |= T1 & PARAM2;
+    T0 |= T1 & (uint32_t)PARAM2;
     RETURN();
 }
 
@@ -2256,7 +2340,7 @@ void OPPROTO op_POWER_sleq (void)
 
 void OPPROTO op_POWER_sllq (void)
 {
-    uint32_t msk = -1;
+    uint32_t msk = UINT32_MAX;
 
     msk = msk << (T1 & 0x1FUL);
     if (T1 & 0x20UL)
@@ -2269,7 +2353,7 @@ void OPPROTO op_POWER_sllq (void)
 
 void OPPROTO op_POWER_slq (void)
 {
-    uint32_t msk = -1, tmp;
+    uint32_t msk = UINT32_MAX, tmp;
 
     msk = msk << (T1 & 0x1FUL);
     if (T1 & 0x20UL)
@@ -2285,7 +2369,7 @@ void OPPROTO op_POWER_sraq (void)
 {
     env->spr[SPR_MQ] = rotl32(T0, 32 - (T1 & 0x1FUL));
     if (T1 & 0x20UL)
-        T0 = -1L;
+        T0 = UINT32_MAX;
     else
         T0 = (int32_t)T0 >> T1;
     RETURN();
@@ -2420,12 +2504,6 @@ void OPPROTO op_405_mullhwu (void)
     RETURN();
 }
 
-void OPPROTO op_405_check_ov (void)
-{
-    do_405_check_ov();
-    RETURN();
-}
-
 void OPPROTO op_405_check_sat (void)
 {
     do_405_check_sat();
@@ -2447,7 +2525,7 @@ void OPPROTO op_405_check_satu (void)
 {
     if (unlikely(T0 < T2)) {
         /* Saturate result */
-        T0 = -1;
+        T0 = UINT32_MAX;
     }
     RETURN();
 }
@@ -2494,7 +2572,12 @@ void OPPROTO op_rfmci (void)
 
 void OPPROTO op_wrte (void)
 {
-    msr_ee = T0 >> 16;
+    /* We don't call do_store_msr here as we won't trigger
+     * any special case nor change hflags
+     */
+    T0 &= 1 << MSR_EE;
+    env->msr &= ~(1 << MSR_EE);
+    env->msr |= T0;
     RETURN();
 }
 
@@ -2515,7 +2598,7 @@ void OPPROTO op_4xx_tlbsx_check (void)
     int tmp;
 
     tmp = xer_so;
-    if (T0 != -1)
+    if ((int)T0 != -1)
         tmp |= 0x02;
     env->crf[0] = tmp;
     RETURN();
@@ -2633,7 +2716,6 @@ void OPPROTO op_store_booke_tsr (void)
 }
 #endif /* !defined(CONFIG_USER_ONLY) */
 
-#if defined(TARGET_PPCEMB)
 /* SPE extension */
 void OPPROTO op_splatw_T1_64 (void)
 {
@@ -3352,4 +3434,3 @@ void OPPROTO op_efdtsteq (void)
     T0 = _do_efdtsteq(T0_64, T1_64);
     RETURN();
 }
-#endif /* defined(TARGET_PPCEMB) */
diff --git a/target-ppc/op_helper.c b/target-ppc/op_helper.c
index 8bb93ed36..1ea16951b 100644
--- a/target-ppc/op_helper.c
+++ b/target-ppc/op_helper.c
@@ -18,7 +18,9 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 #include "exec.h"
+#include "host-utils.h"
 
+#include "helper_regs.h"
 #include "op_helper.h"
 
 #define MEMSUFFIX _raw
@@ -31,6 +33,9 @@
 #define MEMSUFFIX _kernel
 #include "op_helper.h"
 #include "op_helper_mem.h"
+#define MEMSUFFIX _hypv
+#include "op_helper.h"
+#include "op_helper_mem.h"
 #endif
 
 //#define DEBUG_OP
@@ -45,14 +50,6 @@ void do_raise_exception_err (uint32_t exception, int error_code)
 #if 0
     printf("Raise exception %3x code : %d\n", exception, error_code);
 #endif
-    switch (exception) {
-    case POWERPC_EXCP_PROGRAM:
-        if (error_code == POWERPC_EXCP_FP && msr_fe0 == 0 && msr_fe1 == 0)
-            return;
-        break;
-    default:
-        break;
-    }
     env->exception_index = exception;
     env->error_code = error_code;
     cpu_loop_exit();
@@ -93,24 +90,6 @@ void do_store_cr (uint32_t mask)
     }
 }
 
-void do_load_xer (void)
-{
-    T0 = (xer_so << XER_SO) |
-        (xer_ov << XER_OV) |
-        (xer_ca << XER_CA) |
-        (xer_bc << XER_BC) |
-        (xer_cmp << XER_CMP);
-}
-
-void do_store_xer (void)
-{
-    xer_so = (T0 >> XER_SO) & 0x01;
-    xer_ov = (T0 >> XER_OV) & 0x01;
-    xer_ca = (T0 >> XER_CA) & 0x01;
-    xer_cmp = (T0 >> XER_CMP) & 0xFF;
-    xer_bc = (T0 >> XER_BC) & 0x7F;
-}
-
 #if defined(TARGET_PPC64)
 void do_store_pri (int prio)
 {
@@ -119,77 +98,6 @@ void do_store_pri (int prio)
 }
 #endif
 
-void do_load_fpscr (void)
-{
-    /* The 32 MSB of the target fpr are undefined.
-     * They'll be zero...
-     */
-    union {
-        float64 d;
-        struct {
-            uint32_t u[2];
-        } s;
-    } u;
-    int i;
-
-#if defined(WORDS_BIGENDIAN)
-#define WORD0 0
-#define WORD1 1
-#else
-#define WORD0 1
-#define WORD1 0
-#endif
-    u.s.u[WORD0] = 0;
-    u.s.u[WORD1] = 0;
-    for (i = 0; i < 8; i++)
-        u.s.u[WORD1] |= env->fpscr[i] << (4 * i);
-    FT0 = u.d;
-}
-
-void do_store_fpscr (uint32_t mask)
-{
-    /*
-     * We use only the 32 LSB of the incoming fpr
-     */
-    union {
-        double d;
-        struct {
-            uint32_t u[2];
-        } s;
-    } u;
-    int i, rnd_type;
-
-    u.d = FT0;
-    if (mask & 0x80)
-        env->fpscr[0] = (env->fpscr[0] & 0x9) | ((u.s.u[WORD1] >> 28) & ~0x9);
-    for (i = 1; i < 7; i++) {
-        if (mask & (1 << (7 - i)))
-            env->fpscr[i] = (u.s.u[WORD1] >> (4 * (7 - i))) & 0xF;
-    }
-    /* TODO: update FEX & VX */
-    /* Set rounding mode */
-    switch (env->fpscr[0] & 0x3) {
-    case 0:
-        /* Best approximation (round to nearest) */
-        rnd_type = float_round_nearest_even;
-        break;
-    case 1:
-        /* Smaller magnitude (round toward zero) */
-        rnd_type = float_round_to_zero;
-        break;
-    case 2:
-        /* Round toward +infinite */
-        rnd_type = float_round_up;
-        break;
-    default:
-    case 3:
-        /* Round toward -infinite */
-        rnd_type = float_round_down;
-        break;
-    }
-    set_float_rounding_mode(rnd_type, &env->fp_status);
-}
-
 target_ulong ppc_load_dump_spr (int sprn)
 {
     if (loglevel != 0) {
@@ -211,79 +119,6 @@ void ppc_store_dump_spr (int sprn, target_ulong val)
 
 /*****************************************************************************/
 /* Fixed point operations helpers */
-#if defined(TARGET_PPC64)
-static void add128 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
-{
-    *plow += a;
-    /* carry test */
-    if (*plow < a)
-        (*phigh)++;
-    *phigh += b;
-}
-
-static void neg128 (uint64_t *plow, uint64_t *phigh)
-{
-    *plow = ~*plow;
-    *phigh = ~*phigh;
-    add128(plow, phigh, 1, 0);
-}
-
-static void mul64 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
-{
-    uint32_t a0, a1, b0, b1;
-    uint64_t v;
-
-    a0 = a;
-    a1 = a >> 32;
-
-    b0 = b;
-    b1 = b >> 32;
-
-    v = (uint64_t)a0 * (uint64_t)b0;
-    *plow = v;
-    *phigh = 0;
-
-    v = (uint64_t)a0 * (uint64_t)b1;
-    add128(plow, phigh, v << 32, v >> 32);
-
-    v = (uint64_t)a1 * (uint64_t)b0;
-    add128(plow, phigh, v << 32, v >> 32);
-
-    v = (uint64_t)a1 * (uint64_t)b1;
-    *phigh += v;
-#if defined(DEBUG_MULDIV)
-    printf("mul: 0x%016llx * 0x%016llx = 0x%016llx%016llx\n",
-           a, b, *phigh, *plow);
-#endif
-}
-
-void do_mul64 (uint64_t *plow, uint64_t *phigh)
-{
-    mul64(plow, phigh, T0, T1);
-}
-
-static void imul64 (uint64_t *plow, uint64_t *phigh, int64_t a, int64_t b)
-{
-    int sa, sb;
-
-    sa = (a < 0);
-    if (sa)
-        a = -a;
-    sb = (b < 0);
-    if (sb)
-        b = -b;
-    mul64(plow, phigh, a, b);
-    if (sa ^ sb) {
-        neg128(plow, phigh);
-    }
-}
-
-void do_imul64 (uint64_t *plow, uint64_t *phigh)
-{
-    imul64(plow, phigh, T0, T1);
-}
-#endif
-
 void do_adde (void)
 {
     T2 = T0;
@@ -314,15 +149,12 @@ void do_addmeo (void)
 {
     T1 = T0;
     T0 += xer_ca + (-1);
-    if (likely(!((uint32_t)T1 &
-                 ((uint32_t)T1 ^ (uint32_t)T0) & (1UL << 31)))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
+    xer_ov = ((uint32_t)T1 & ((uint32_t)T1 ^ (uint32_t)T0)) >> 31;
+    xer_so |= xer_ov;
     if (likely(T1 != 0))
         xer_ca = 1;
+    else
+        xer_ca = 0;
 }
 
 #if defined(TARGET_PPC64)
@@ -330,43 +162,40 @@ void do_addmeo_64 (void)
 {
     T1 = T0;
     T0 += xer_ca + (-1);
-    if (likely(!((uint64_t)T1 &
-                 ((uint64_t)T1 ^ (uint64_t)T0) & (1ULL << 63)))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
+    xer_ov = ((uint64_t)T1 & ((uint64_t)T1 ^ (uint64_t)T0)) >> 63;
+    xer_so |= xer_ov;
     if (likely(T1 != 0))
         xer_ca = 1;
+    else
+        xer_ca = 0;
 }
 #endif
 
 void do_divwo (void)
 {
-    if (likely(!(((int32_t)T0 == INT32_MIN && (int32_t)T1 == -1) ||
+    if (likely(!(((int32_t)T0 == INT32_MIN && (int32_t)T1 == (int32_t)-1) ||
                  (int32_t)T1 == 0))) {
         xer_ov = 0;
         T0 = (int32_t)T0 / (int32_t)T1;
     } else {
         xer_ov = 1;
-        xer_so = 1;
-        T0 = (-1) * ((uint32_t)T0 >> 31);
+        T0 = UINT32_MAX * ((uint32_t)T0 >> 31);
     }
+    xer_so |= xer_ov;
 }
 
 #if defined(TARGET_PPC64)
 void do_divdo (void)
 {
-    if (likely(!(((int64_t)T0 == INT64_MIN && (int64_t)T1 == -1ULL) ||
+    if (likely(!(((int64_t)T0 == INT64_MIN && (int64_t)T1 == (int64_t)-1LL) ||
                  (int64_t)T1 == 0))) {
         xer_ov = 0;
         T0 = (int64_t)T0 / (int64_t)T1;
     } else {
         xer_ov = 1;
-        xer_so = 1;
-        T0 = (-1ULL) * ((uint64_t)T0 >> 63);
+        T0 = UINT64_MAX * ((uint64_t)T0 >> 63);
     }
+    xer_so |= xer_ov;
 }
 #endif
 
@@ -415,14 +244,15 @@ void do_mulldo (void)
     int64_t th;
     uint64_t tl;
 
-    do_imul64(&tl, &th);
-    if (likely(th == 0)) {
+    muls64(&tl, &th, T0, T1);
+    T0 = (int64_t)tl;
+    /* If th != 0 && th != -1, then we had an overflow */
+    if (likely((uint64_t)(th + 1) <= 1)) {
         xer_ov = 0;
     } else {
         xer_ov = 1;
-        xer_so = 1;
     }
-    T0 = (int64_t)tl;
+    xer_so |= xer_ov;
 }
 #endif
 
@@ -478,15 +308,12 @@ void do_subfmeo (void)
 {
     T1 = T0;
     T0 = ~T0 + xer_ca - 1;
-    if (likely(!((uint32_t)~T1 & ((uint32_t)~T1 ^ (uint32_t)T0) &
-                 (1UL << 31)))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
+    xer_ov = ((uint32_t)~T1 & ((uint32_t)~T1 ^ (uint32_t)T0)) >> 31;
+    xer_so |= xer_ov;
     if (likely((uint32_t)T1 != UINT32_MAX))
         xer_ca = 1;
+    else
+        xer_ca = 0;
 }
 
 #if defined(TARGET_PPC64)
@@ -494,15 +321,12 @@ void do_subfmeo_64 (void)
 {
     T1 = T0;
     T0 = ~T0 + xer_ca - 1;
-    if (likely(!((uint64_t)~T1 & ((uint64_t)~T1 ^ (uint64_t)T0) &
-                 (1ULL << 63)))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
+    xer_ov = ((uint64_t)~T1 & ((uint64_t)~T1 ^ (uint64_t)T0)) >> 63;
+    xer_so |= xer_ov;
     if (likely((uint64_t)T1 != UINT64_MAX))
         xer_ca = 1;
+    else
+        xer_ca = 0;
 }
 #endif
 
@@ -510,13 +334,9 @@ void do_subfzeo (void)
 {
     T1 = T0;
     T0 = ~T0 + xer_ca;
-    if (likely(!(((uint32_t)~T1 ^ UINT32_MAX) &
-                 ((uint32_t)(~T1) ^ (uint32_t)T0) & (1UL << 31)))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
+    xer_ov = (((uint32_t)~T1 ^ UINT32_MAX) &
+              ((uint32_t)(~T1) ^ (uint32_t)T0)) >> 31;
+    xer_so |= xer_ov;
     if (likely((uint32_t)T0 >= (uint32_t)~T1)) {
         xer_ca = 0;
     } else {
@@ -529,13 +349,9 @@ void do_subfzeo_64 (void)
 {
     T1 = T0;
     T0 = ~T0 + xer_ca;
-    if (likely(!(((uint64_t)~T1 ^ UINT64_MAX) &
-                 ((uint64_t)(~T1) ^ (uint64_t)T0) & (1ULL << 63)))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
+    xer_ov = (((uint64_t)~T1 ^  UINT64_MAX) &
+              ((uint64_t)(~T1) ^ (uint64_t)T0)) >> 63;
+    xer_so |= xer_ov;
     if (likely((uint64_t)T0 >= (uint64_t)~T1)) {
         xer_ca = 0;
     } else {
@@ -544,6 +360,18 @@ void do_subfzeo_64 (void)
 }
 #endif
 
+void do_cntlzw (void)
+{
+    T0 = clz32(T0);
+}
+
+#if defined(TARGET_PPC64)
+void do_cntlzd (void)
+{
+    T0 = clz64(T0);
+}
+#endif
+
 /* shift right arithmetic helper */
 void do_sraw (void)
 {
@@ -562,7 +390,7 @@ void do_sraw (void)
             xer_ca = 0;
         }
     } else {
-        ret = (-1) * ((uint32_t)T0 >> 31);
+        ret = UINT32_MAX * ((uint32_t)T0 >> 31);
         if (likely(ret >= 0 || ((uint32_t)T0 & ~0x80000000UL) == 0)) {
             xer_ca = 0;
         } else {
@@ -590,7 +418,7 @@ void do_srad (void)
             xer_ca = 0;
         }
     } else {
-        ret = (-1) * ((uint64_t)T0 >> 63);
+        ret = UINT64_MAX * ((uint64_t)T0 >> 63);
         if (likely(ret >= 0 || ((uint64_t)T0 & ~0x8000000000000000ULL) == 0)) {
             xer_ca = 0;
         } else {
@@ -601,16 +429,6 @@ void do_srad (void)
 }
 #endif
 
-static inline int popcnt (uint32_t val)
-{
-    int i;
-
-    for (i = 0; val != 0;)
-        val = val ^ (val - 1);
-
-    return i;
-}
-
 void do_popcntb (void)
 {
     uint32_t ret;
@@ -618,7 +436,7 @@ void do_popcntb (void)
 
     ret = 0;
     for (i = 0; i < 32; i += 8)
-        ret |= popcnt((T0 >> i) & 0xFF) << i;
+        ret |= ctpop8((T0 >> i) & 0xFF) << i;
     T0 = ret;
 }
 
@@ -630,13 +448,544 @@ void do_popcntb_64 (void)
 
     ret = 0;
     for (i = 0; i < 64; i += 8)
-        ret |= popcnt((T0 >> i) & 0xFF) << i;
+        ret |= ctpop8((T0 >> i) & 0xFF) << i;
     T0 = ret;
 }
 #endif
 
 /*****************************************************************************/
 /* Floating point operations helpers */
+static always_inline int fpisneg (float64 f)
+{
+    union {
+        float64 f;
+        uint64_t u;
+    } u;
+
+    u.f = f;
+
+    return u.u >> 63 != 0;
+}
+
+static always_inline int isden (float f)
+{
+    union {
+        float64 f;
+        uint64_t u;
+    } u;
+
+    u.f = f;
+
+    return ((u.u >> 52) & 0x7FF) == 0;
+}
+
+static always_inline int iszero (float64 f)
+{
+    union {
+        float64 f;
+        uint64_t u;
+    } u;
+
+    u.f = f;
+
+    return (u.u & ~0x8000000000000000ULL) == 0;
+}
+
+static always_inline int isinfinity (float64 f)
+{
+    union {
+        float64 f;
+        uint64_t u;
+    } u;
+
+    u.f = f;
+
+    return ((u.u >> 52) & 0x7FF) == 0x7FF &&
+        (u.u & 0x000FFFFFFFFFFFFFULL) == 0;
+}
+
+void do_compute_fprf (int set_fprf)
+{
+    int isneg;
+
+    isneg = fpisneg(FT0);
+    if (unlikely(float64_is_nan(FT0))) {
+        if (float64_is_signaling_nan(FT0)) {
+            /* Signaling NaN: flags are undefined */
+            T0 = 0x00;
+        } else {
+            /* Quiet NaN */
+            T0 = 0x11;
+        }
+    } else if (unlikely(isinfinity(FT0))) {
+        /* +/- infinity */
+        if (isneg)
+            T0 = 0x09;
+        else
+            T0 = 0x05;
+    } else {
+        if (iszero(FT0)) {
+            /* +/- zero */
+            if (isneg)
+                T0 = 0x12;
+            else
+                T0 = 0x02;
+        } else {
+            if (isden(FT0)) {
+                /* Denormalized numbers */
+                T0 = 0x10;
+            } else {
+                /* Normalized numbers */
+                T0 = 0x00;
+            }
+            if (isneg) {
+                T0 |= 0x08;
+            } else {
+                T0 |= 0x04;
+            }
+        }
+    }
+    if (set_fprf) {
+        /* We update FPSCR_FPRF */
+        env->fpscr &= ~(0x1F << FPSCR_FPRF);
+        env->fpscr |= T0 << FPSCR_FPRF;
+    }
+    /* We just need fpcc to update Rc1 */
+    T0 &= 0xF;
+}
+
+/* Floating-point invalid operations exception */
+static always_inline void fload_invalid_op_excp (int op)
+{
+    int ve;
+
+    ve = fpscr_ve;
+    if (op & POWERPC_EXCP_FP_VXSNAN) {
+        /* Operation on signaling NaN */
+        env->fpscr |= 1 << FPSCR_VXSNAN;
+    }
+    if (op & POWERPC_EXCP_FP_VXSOFT) {
+        /* Software-defined condition */
+        env->fpscr |= 1 << FPSCR_VXSOFT;
+    }
+    switch (op & ~(POWERPC_EXCP_FP_VXSOFT | POWERPC_EXCP_FP_VXSNAN)) {
+    case POWERPC_EXCP_FP_VXISI:
+        /* Magnitude subtraction of infinities */
+        env->fpscr |= 1 << FPSCR_VXISI;
+        goto update_arith;
+    case POWERPC_EXCP_FP_VXIDI:
+        /* Division of infinity by infinity */
+        env->fpscr |= 1 << FPSCR_VXIDI;
+        goto update_arith;
+    case POWERPC_EXCP_FP_VXZDZ:
+        /* Division of zero by zero */
+        env->fpscr |= 1 << FPSCR_VXZDZ;
+        goto update_arith;
+    case POWERPC_EXCP_FP_VXIMZ:
+        /* Multiplication of zero by infinity */
+        env->fpscr |= 1 << FPSCR_VXIMZ;
+        goto update_arith;
+    case POWERPC_EXCP_FP_VXVC:
+        /* Ordered comparison of NaN */
+        env->fpscr |= 1 << FPSCR_VXVC;
+        env->fpscr &= ~(0xF << FPSCR_FPCC);
+        env->fpscr |= 0x11 << FPSCR_FPCC;
+        /* We must update the target FPR before raising the exception */
+        if (ve != 0) {
+            env->exception_index = POWERPC_EXCP_PROGRAM;
+            env->error_code = POWERPC_EXCP_FP | POWERPC_EXCP_FP_VXVC;
+            /* Update the floating-point enabled exception summary */
+            env->fpscr |= 1 << FPSCR_FEX;
+            /* Exception is differed */
+            ve = 0;
+        }
+        break;
+    case POWERPC_EXCP_FP_VXSQRT:
+        /* Square root of a negative number */
+        env->fpscr |= 1 << FPSCR_VXSQRT;
+    update_arith:
+        env->fpscr &= ~((1 << FPSCR_FR) | (1 << FPSCR_FI));
+        if (ve == 0) {
+            /* Set the result to quiet NaN */
+            FT0 = UINT64_MAX;
+            env->fpscr &= ~(0xF << FPSCR_FPCC);
+            env->fpscr |= 0x11 << FPSCR_FPCC;
+        }
+        break;
+    case POWERPC_EXCP_FP_VXCVI:
+        /* Invalid conversion */
+        env->fpscr |= 1 << FPSCR_VXCVI;
+        env->fpscr &= ~((1 << FPSCR_FR) | (1 << FPSCR_FI));
+        if (ve == 0) {
+            /* Set the result to quiet NaN */
+            FT0 = UINT64_MAX;
+            env->fpscr &= ~(0xF << FPSCR_FPCC);
+            env->fpscr |= 0x11 << FPSCR_FPCC;
+        }
+        break;
+    }
+    /* Update the floating-point invalid operation summary */
+    env->fpscr |= 1 << FPSCR_VX;
+    /* Update the floating-point exception summary */
+    env->fpscr |= 1 << FPSCR_FX;
+    if (ve != 0) {
+        /* Update the floating-point enabled exception summary */
+        env->fpscr |= 1 << FPSCR_FEX;
+        if (msr_fe0 != 0 || msr_fe1 != 0)
+            do_raise_exception_err(POWERPC_EXCP_PROGRAM, POWERPC_EXCP_FP | op);
+    }
+}
+
+static always_inline void float_zero_divide_excp (void)
+{
+    union {
+        float64 f;
+        uint64_t u;
+    } u0, u1;
+
+    env->fpscr |= 1 << FPSCR_ZX;
+    env->fpscr &= ~((1 << FPSCR_FR) | (1 << FPSCR_FI));
+    /* Update the floating-point exception summary */
+    env->fpscr |= 1 << FPSCR_FX;
+    if (fpscr_ze != 0) {
+        /* Update the floating-point enabled exception summary */
+        env->fpscr |= 1 << FPSCR_FEX;
+        if (msr_fe0 != 0 || msr_fe1 != 0) {
+            do_raise_exception_err(POWERPC_EXCP_PROGRAM,
+                                   POWERPC_EXCP_FP | POWERPC_EXCP_FP_ZX);
+        }
+    } else {
+        /* Set the result to infinity */
+        u0.f = FT0;
+        u1.f = FT1;
+        u0.u = ((u0.u ^ u1.u) & 0x8000000000000000ULL);
+        u0.u |= 0x7FFULL << 52;
+        FT0 = u0.f;
+    }
+}
+
+static always_inline void float_overflow_excp (void)
+{
+    env->fpscr |= 1 << FPSCR_OX;
+    /* Update the floating-point exception summary */
+    env->fpscr |= 1 << FPSCR_FX;
+    if (fpscr_oe != 0) {
+        /* XXX: should adjust the result */
+        /* Update the floating-point enabled exception summary */
+        env->fpscr |= 1 << FPSCR_FEX;
+        /* We must update the target FPR before raising the exception */
+        env->exception_index = POWERPC_EXCP_PROGRAM;
+        env->error_code = POWERPC_EXCP_FP | POWERPC_EXCP_FP_OX;
+    } else {
+        env->fpscr |= 1 << FPSCR_XX;
+        env->fpscr |= 1 << FPSCR_FI;
+    }
+}
+
+static always_inline void float_underflow_excp (void)
+{
+    env->fpscr |= 1 << FPSCR_UX;
+    /* Update the floating-point exception summary */
+    env->fpscr |= 1 << FPSCR_FX;
+    if (fpscr_ue != 0) {
+        /* XXX: should adjust the result */
+        /* Update the floating-point enabled exception summary */
+        env->fpscr |= 1 << FPSCR_FEX;
+        /* We must update the target FPR before raising the exception */
+        env->exception_index = POWERPC_EXCP_PROGRAM;
+        env->error_code = POWERPC_EXCP_FP | POWERPC_EXCP_FP_UX;
+    }
+}
+
+static always_inline void float_inexact_excp (void)
+{
+    env->fpscr |= 1 << FPSCR_XX;
+    /* Update the floating-point exception summary */
+    env->fpscr |= 1 << FPSCR_FX;
+    if (fpscr_xe != 0) {
+        /* Update the floating-point enabled exception summary */
+        env->fpscr |= 1 << FPSCR_FEX;
+        /* We must update the target FPR before raising the exception */
+        env->exception_index = POWERPC_EXCP_PROGRAM;
+        env->error_code = POWERPC_EXCP_FP | POWERPC_EXCP_FP_XX;
+    }
+}
+
+static always_inline void fpscr_set_rounding_mode (void)
+{
+    int rnd_type;
+
+    /* Set rounding mode */
+    switch (fpscr_rn) {
+    case 0:
+        /* Best approximation (round to nearest) */
+        rnd_type = float_round_nearest_even;
+        break;
+    case 1:
+        /* Smaller magnitude (round toward zero) */
+        rnd_type = float_round_to_zero;
+        break;
+    case 2:
+        /* Round toward +infinite */
+        rnd_type = float_round_up;
+        break;
+    default:
+    case 3:
+        /* Round toward -infinite */
+        rnd_type = float_round_down;
+        break;
+    }
+    set_float_rounding_mode(rnd_type, &env->fp_status);
+}
+
+void do_fpscr_setbit (int bit)
+{
+    int prev;
+
+    prev = (env->fpscr >> bit) & 1;
+    env->fpscr |= 1 << bit;
+    if (prev == 0) {
+        switch (bit) {
+        case FPSCR_VX:
+            env->fpscr |= 1 << FPSCR_FX;
+            if (fpscr_ve)
+                goto raise_ve;
+        case FPSCR_OX:
+            env->fpscr |= 1 << FPSCR_FX;
+            if (fpscr_oe)
+                goto raise_oe;
+            break;
+        case FPSCR_UX:
+            env->fpscr |= 1 << FPSCR_FX;
+            if (fpscr_ue)
+                goto raise_ue;
+            break;
+        case FPSCR_ZX:
+            env->fpscr |= 1 << FPSCR_FX;
+            if (fpscr_ze)
+                goto raise_ze;
+            break;
+        case FPSCR_XX:
+            env->fpscr |= 1 << FPSCR_FX;
+            if (fpscr_xe)
+                goto raise_xe;
+            break;
+        case FPSCR_VXSNAN:
+        case FPSCR_VXISI:
+        case FPSCR_VXIDI:
+        case FPSCR_VXZDZ:
+        case FPSCR_VXIMZ:
+        case FPSCR_VXVC:
+        case FPSCR_VXSOFT:
+        case FPSCR_VXSQRT:
+        case FPSCR_VXCVI:
+            env->fpscr |= 1 << FPSCR_VX;
+            env->fpscr |= 1 << FPSCR_FX;
+            if (fpscr_ve != 0)
+                goto raise_ve;
+            break;
+        case FPSCR_VE:
+            if (fpscr_vx != 0) {
+            raise_ve:
+                env->error_code = POWERPC_EXCP_FP;
+                if (fpscr_vxsnan)
+                    env->error_code |= POWERPC_EXCP_FP_VXSNAN;
+                if (fpscr_vxisi)
+                    env->error_code |= POWERPC_EXCP_FP_VXISI;
+                if (fpscr_vxidi)
+                    env->error_code |= POWERPC_EXCP_FP_VXIDI;
+                if (fpscr_vxzdz)
+                    env->error_code |= POWERPC_EXCP_FP_VXZDZ;
+                if (fpscr_vximz)
+                    env->error_code |= POWERPC_EXCP_FP_VXIMZ;
+                if (fpscr_vxvc)
+                    env->error_code |= POWERPC_EXCP_FP_VXVC;
+                if (fpscr_vxsoft)
+                    env->error_code |= POWERPC_EXCP_FP_VXSOFT;
+                if (fpscr_vxsqrt)
+                    env->error_code |= POWERPC_EXCP_FP_VXSQRT;
+                if (fpscr_vxcvi)
+                    env->error_code |= POWERPC_EXCP_FP_VXCVI;
+                goto raise_excp;
+            }
+            break;
+        case FPSCR_OE:
+            if (fpscr_ox != 0) {
+            raise_oe:
+                env->error_code = POWERPC_EXCP_FP | POWERPC_EXCP_FP_OX;
+                goto raise_excp;
+            }
+            break;
+        case FPSCR_UE:
+            if (fpscr_ux != 0) {
+            raise_ue:
+                env->error_code = POWERPC_EXCP_FP | POWERPC_EXCP_FP_UX;
+                goto raise_excp;
+            }
+            break;
+        case FPSCR_ZE:
+            if (fpscr_zx != 0) {
+            raise_ze:
+                env->error_code = POWERPC_EXCP_FP | POWERPC_EXCP_FP_ZX;
+                goto raise_excp;
+            }
+            break;
+        case FPSCR_XE:
+            if (fpscr_xx != 0) {
+            raise_xe:
+                env->error_code = POWERPC_EXCP_FP | POWERPC_EXCP_FP_XX;
+                goto raise_excp;
+            }
+            break;
+        case FPSCR_RN1:
+        case FPSCR_RN:
+            fpscr_set_rounding_mode();
+            break;
+        default:
+            break;
+        raise_excp:
+            /* Update the floating-point enabled exception summary */
+            env->fpscr |= 1 << FPSCR_FEX;
+                /* We have to update Rc1 before raising the exception */
+            env->exception_index = POWERPC_EXCP_PROGRAM;
+            break;
+        }
+    }
+}
+
+#if defined(WORDS_BIGENDIAN)
+#define WORD0 0
+#define WORD1 1
+#else
+#define WORD0 1
+#define WORD1 0
+#endif
+void do_store_fpscr (uint32_t mask)
+{
+    /*
+     * We use only the 32 LSB of the incoming fpr
+     */
+    union {
+        double d;
+        struct {
+            uint32_t u[2];
+        } s;
+    } u;
+    uint32_t prev, new;
+    int i;
+
+    u.d = FT0;
+    prev = env->fpscr;
+    new = u.s.u[WORD1];
+    new &= ~0x90000000;
+    new |= prev & 0x90000000;
+    for (i = 0; i < 7; i++) {
+        if (mask & (1 << i)) {
+            env->fpscr &= ~(0xF << (4 * i));
+            env->fpscr |= new & (0xF << (4 * i));
+        }
+    }
+    /* Update VX and FEX */
+    if (fpscr_ix != 0)
+        env->fpscr |= 1 << FPSCR_VX;
+    if ((fpscr_ex & fpscr_eex) != 0) {
+        env->fpscr |= 1 << FPSCR_FEX;
+        env->exception_index = POWERPC_EXCP_PROGRAM;
+        /* XXX: we should compute it properly */
+        env->error_code = POWERPC_EXCP_FP;
+    }
+    fpscr_set_rounding_mode();
+}
+#undef WORD0
+#undef WORD1
+
+#ifdef CONFIG_SOFTFLOAT
+void do_float_check_status (void)
+{
+    if (env->exception_index == POWERPC_EXCP_PROGRAM &&
+        (env->error_code & POWERPC_EXCP_FP)) {
+        /* Differred floating-point exception after target FPR update */
+        if (msr_fe0 != 0 || msr_fe1 != 0)
+            do_raise_exception_err(env->exception_index, env->error_code);
+    } else if (env->fp_status.float_exception_flags & float_flag_overflow) {
+        float_overflow_excp();
+    } else if (env->fp_status.float_exception_flags & float_flag_underflow) {
+        float_underflow_excp();
+    } else if (env->fp_status.float_exception_flags & float_flag_inexact) {
+        float_inexact_excp();
+    }
+}
+#endif
+
+#if USE_PRECISE_EMULATION
+void do_fadd (void)
+{
+    if (unlikely(float64_is_signaling_nan(FT0) ||
+                 float64_is_signaling_nan(FT1))) {
+        /* sNaN addition */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else if (likely(isfinite(FT0) || isfinite(FT1) ||
+                      fpisneg(FT0) == fpisneg(FT1))) {
+        FT0 = float64_add(FT0, FT1, &env->fp_status);
+    } else {
+        /* Magnitude subtraction of infinities */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXISI);
+    }
+}
+
+void do_fsub (void)
+{
+    if (unlikely(float64_is_signaling_nan(FT0) ||
+                 float64_is_signaling_nan(FT1))) {
+        /* sNaN subtraction */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else if (likely(isfinite(FT0) || isfinite(FT1) ||
+                      fpisneg(FT0) != fpisneg(FT1))) {
+        FT0 = float64_sub(FT0, FT1, &env->fp_status);
+    } else {
+        /* Magnitude subtraction of infinities */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXISI);
+    }
+}
+
+void do_fmul (void)
+{
+    if (unlikely(float64_is_signaling_nan(FT0) ||
+                 float64_is_signaling_nan(FT1))) {
+        /* sNaN multiplication */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else if (unlikely((isinfinity(FT0) && iszero(FT1)) ||
+                        (iszero(FT0) && isinfinity(FT1)))) {
+        /* Multiplication of zero by infinity */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXIMZ);
+    } else {
+        FT0 = float64_mul(FT0, FT1, &env->fp_status);
+    }
+}
+
+void do_fdiv (void)
+{
+    if (unlikely(float64_is_signaling_nan(FT0) ||
+                 float64_is_signaling_nan(FT1))) {
+        /* sNaN division */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else if (unlikely(isinfinity(FT0) && isinfinity(FT1))) {
+        /* Division of infinity by infinity */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXIDI);
+    } else if (unlikely(iszero(FT1))) {
+        if (iszero(FT0)) {
+            /* Division of zero by zero */
+            fload_invalid_op_excp(POWERPC_EXCP_FP_VXZDZ);
+        } else {
+            /* Division by zero */
+            float_zero_divide_excp();
+        }
+    } else {
+        FT0 = float64_div(FT0, FT1, &env->fp_status);
+    }
+}
+#endif /* USE_PRECISE_EMULATION */
+
 void do_fctiw (void)
 {
     union {
@@ -644,14 +993,22 @@ void do_fctiw (void)
         uint64_t i;
     } p;
 
-    p.i = float64_to_int32(FT0, &env->fp_status);
+    if (unlikely(float64_is_signaling_nan(FT0))) {
+        /* sNaN conversion */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN | POWERPC_EXCP_FP_VXCVI);
+    } else if (unlikely(float64_is_nan(FT0) || isinfinity(FT0))) {
+        /* qNan / infinity conversion */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXCVI);
+    } else {
+        p.i = float64_to_int32(FT0, &env->fp_status);
 #if USE_PRECISE_EMULATION
-    /* XXX: higher bits are not supposed to be significant.
-     *     to make tests easier, return the same as a real PowerPC 750 (aka G3)
-     */
-    p.i |= 0xFFF80000ULL << 32;
+        /* XXX: higher bits are not supposed to be significant.
+         *     to make tests easier, return the same as a real PowerPC 750
+         */
+        p.i |= 0xFFF80000ULL << 32;
 #endif
-    FT0 = p.d;
+        FT0 = p.d;
+    }
 }
 
 void do_fctiwz (void)
@@ -661,14 +1018,22 @@ void do_fctiwz (void)
         uint64_t i;
     } p;
 
-    p.i = float64_to_int32_round_to_zero(FT0, &env->fp_status);
+    if (unlikely(float64_is_signaling_nan(FT0))) {
+        /* sNaN conversion */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN | POWERPC_EXCP_FP_VXCVI);
+    } else if (unlikely(float64_is_nan(FT0) || isinfinity(FT0))) {
+        /* qNan / infinity conversion */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXCVI);
+    } else {
+        p.i = float64_to_int32_round_to_zero(FT0, &env->fp_status);
 #if USE_PRECISE_EMULATION
-    /* XXX: higher bits are not supposed to be significant.
-     *     to make tests easier, return the same as a real PowerPC 750 (aka G3)
-     */
-    p.i |= 0xFFF80000ULL << 32;
+        /* XXX: higher bits are not supposed to be significant.
+         *     to make tests easier, return the same as a real PowerPC 750
+         */
+        p.i |= 0xFFF80000ULL << 32;
 #endif
-    FT0 = p.d;
+        FT0 = p.d;
+    }
 }
 
 #if defined(TARGET_PPC64)
@@ -690,8 +1055,16 @@ void do_fctid (void)
         uint64_t i;
     } p;
 
-    p.i = float64_to_int64(FT0, &env->fp_status);
-    FT0 = p.d;
+    if (unlikely(float64_is_signaling_nan(FT0))) {
+        /* sNaN conversion */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN | POWERPC_EXCP_FP_VXCVI);
+    } else if (unlikely(float64_is_nan(FT0) || isinfinity(FT0))) {
+        /* qNan / infinity conversion */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXCVI);
+    } else {
+        p.i = float64_to_int64(FT0, &env->fp_status);
+        FT0 = p.d;
+    }
 }
 
 void do_fctidz (void)
@@ -701,20 +1074,34 @@ void do_fctidz (void)
         uint64_t i;
     } p;
 
-    p.i = float64_to_int64_round_to_zero(FT0, &env->fp_status);
-    FT0 = p.d;
+    if (unlikely(float64_is_signaling_nan(FT0))) {
+        /* sNaN conversion */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN | POWERPC_EXCP_FP_VXCVI);
+    } else if (unlikely(float64_is_nan(FT0) || isinfinity(FT0))) {
+        /* qNan / infinity conversion */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXCVI);
+    } else {
+        p.i = float64_to_int64_round_to_zero(FT0, &env->fp_status);
+        FT0 = p.d;
+    }
 }
 
 #endif
 
-static inline void do_fri (int rounding_mode)
+static always_inline void do_fri (int rounding_mode)
 {
-    int curmode;
-
-    curmode = env->fp_status.float_rounding_mode;
-    set_float_rounding_mode(rounding_mode, &env->fp_status);
-    FT0 = float64_round_to_int(FT0, &env->fp_status);
-    set_float_rounding_mode(curmode, &env->fp_status);
+    if (unlikely(float64_is_signaling_nan(FT0))) {
+        /* sNaN round */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN | POWERPC_EXCP_FP_VXCVI);
+    } else if (unlikely(float64_is_nan(FT0) || isinfinity(FT0))) {
+        /* qNan / infinity round */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXCVI);
+    } else {
+        set_float_rounding_mode(rounding_mode, &env->fp_status);
+        FT0 = float64_round_to_int(FT0, &env->fp_status);
+        /* Restore rounding mode from FPSCR */
+        fpscr_set_rounding_mode();
+    }
 }
 
 void do_frin (void)
@@ -740,90 +1127,142 @@ void do_frim (void)
 #if USE_PRECISE_EMULATION
 void do_fmadd (void)
 {
+    if (unlikely(float64_is_signaling_nan(FT0) ||
+                 float64_is_signaling_nan(FT1) ||
+                 float64_is_signaling_nan(FT2))) {
+        /* sNaN operation */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else {
 #ifdef FLOAT128
-    float128 ft0_128, ft1_128;
-
-    ft0_128 = float64_to_float128(FT0, &env->fp_status);
-    ft1_128 = float64_to_float128(FT1, &env->fp_status);
-    ft0_128 = float128_mul(ft0_128, ft1_128, &env->fp_status);
-    ft1_128 = float64_to_float128(FT2, &env->fp_status);
-    ft0_128 = float128_add(ft0_128, ft1_128, &env->fp_status);
-    FT0 = float128_to_float64(ft0_128, &env->fp_status);
+        /* This is the way the PowerPC specification defines it */
+        float128 ft0_128, ft1_128;
+
+        ft0_128 = float64_to_float128(FT0, &env->fp_status);
+        ft1_128 = float64_to_float128(FT1, &env->fp_status);
+        ft0_128 = float128_mul(ft0_128, ft1_128, &env->fp_status);
+        ft1_128 = float64_to_float128(FT2, &env->fp_status);
+        ft0_128 = float128_add(ft0_128, ft1_128, &env->fp_status);
+        FT0 = float128_to_float64(ft0_128, &env->fp_status);
 #else
-    /* This is OK on x86 hosts */
-    FT0 = (FT0 * FT1) + FT2;
+        /* This is OK on x86 hosts */
+        FT0 = (FT0 * FT1) + FT2;
 #endif
+    }
 }
 
 void do_fmsub (void)
 {
+    if (unlikely(float64_is_signaling_nan(FT0) ||
+                 float64_is_signaling_nan(FT1) ||
+                 float64_is_signaling_nan(FT2))) {
+        /* sNaN operation */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else {
 #ifdef FLOAT128
-    float128 ft0_128, ft1_128;
-
-    ft0_128 = float64_to_float128(FT0, &env->fp_status);
-    ft1_128 = float64_to_float128(FT1, &env->fp_status);
-    ft0_128 = float128_mul(ft0_128, ft1_128, &env->fp_status);
-    ft1_128 = float64_to_float128(FT2, &env->fp_status);
-    ft0_128 = float128_sub(ft0_128, ft1_128, &env->fp_status);
-    FT0 = float128_to_float64(ft0_128, &env->fp_status);
+        /* This is the way the PowerPC specification defines it */
+        float128 ft0_128, ft1_128;
+
+        ft0_128 = float64_to_float128(FT0, &env->fp_status);
+        ft1_128 = float64_to_float128(FT1, &env->fp_status);
+        ft0_128 = float128_mul(ft0_128, ft1_128, &env->fp_status);
+        ft1_128 = float64_to_float128(FT2, &env->fp_status);
+        ft0_128 = float128_sub(ft0_128, ft1_128, &env->fp_status);
+        FT0 = float128_to_float64(ft0_128, &env->fp_status);
 #else
-    /* This is OK on x86 hosts */
-    FT0 = (FT0 * FT1) - FT2;
+        /* This is OK on x86 hosts */
+        FT0 = (FT0 * FT1) - FT2;
 #endif
+    }
 }
 #endif /* USE_PRECISE_EMULATION */
 
 void do_fnmadd (void)
 {
+    if (unlikely(float64_is_signaling_nan(FT0) ||
+                 float64_is_signaling_nan(FT1) ||
+                 float64_is_signaling_nan(FT2))) {
+        /* sNaN operation */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else {
 #if USE_PRECISE_EMULATION
 #ifdef FLOAT128
-    float128 ft0_128, ft1_128;
-
-    ft0_128 = float64_to_float128(FT0, &env->fp_status);
-    ft1_128 = float64_to_float128(FT1, &env->fp_status);
-    ft0_128 = float128_mul(ft0_128, ft1_128, &env->fp_status);
-    ft1_128 = float64_to_float128(FT2, &env->fp_status);
-    ft0_128 = float128_add(ft0_128, ft1_128, &env->fp_status);
-    FT0 = float128_to_float64(ft0_128, &env->fp_status);
+        /* This is the way the PowerPC specification defines it */
+        float128 ft0_128, ft1_128;
+
+        ft0_128 = float64_to_float128(FT0, &env->fp_status);
+        ft1_128 = float64_to_float128(FT1, &env->fp_status);
+        ft0_128 = float128_mul(ft0_128, ft1_128, &env->fp_status);
+        ft1_128 = float64_to_float128(FT2, &env->fp_status);
+        ft0_128 = float128_add(ft0_128, ft1_128, &env->fp_status);
+        FT0 = float128_to_float64(ft0_128, &env->fp_status);
 #else
-    /* This is OK on x86 hosts */
-    FT0 = (FT0 * FT1) + FT2;
+        /* This is OK on x86 hosts */
+        FT0 = (FT0 * FT1) + FT2;
 #endif
 #else
-    FT0 = float64_mul(FT0, FT1, &env->fp_status);
-    FT0 = float64_add(FT0, FT2, &env->fp_status);
+        FT0 = float64_mul(FT0, FT1, &env->fp_status);
+        FT0 = float64_add(FT0, FT2, &env->fp_status);
 #endif
-    if (likely(!isnan(FT0)))
-        FT0 = float64_chs(FT0);
+        if (likely(!isnan(FT0)))
+            FT0 = float64_chs(FT0);
+    }
 }
 
 void do_fnmsub (void)
 {
+    if (unlikely(float64_is_signaling_nan(FT0) ||
+                 float64_is_signaling_nan(FT1) ||
+                 float64_is_signaling_nan(FT2))) {
+        /* sNaN operation */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else {
 #if USE_PRECISE_EMULATION
 #ifdef FLOAT128
-    float128 ft0_128, ft1_128;
-
-    ft0_128 = float64_to_float128(FT0, &env->fp_status);
-    ft1_128 = float64_to_float128(FT1, &env->fp_status);
-    ft0_128 = float128_mul(ft0_128, ft1_128, &env->fp_status);
-    ft1_128 = float64_to_float128(FT2, &env->fp_status);
-    ft0_128 = float128_sub(ft0_128, ft1_128, &env->fp_status);
-    FT0 = float128_to_float64(ft0_128, &env->fp_status);
+        /* This is the way the PowerPC specification defines it */
+        float128 ft0_128, ft1_128;
+
+        ft0_128 = float64_to_float128(FT0, &env->fp_status);
+        ft1_128 = float64_to_float128(FT1, &env->fp_status);
+        ft0_128 = float128_mul(ft0_128, ft1_128, &env->fp_status);
+        ft1_128 = float64_to_float128(FT2, &env->fp_status);
+        ft0_128 = float128_sub(ft0_128, ft1_128, &env->fp_status);
+        FT0 = float128_to_float64(ft0_128, &env->fp_status);
 #else
-    /* This is OK on x86 hosts */
-    FT0 = (FT0 * FT1) - FT2;
+        /* This is OK on x86 hosts */
+        FT0 = (FT0 * FT1) - FT2;
 #endif
 #else
-    FT0 = float64_mul(FT0, FT1, &env->fp_status);
-    FT0 = float64_sub(FT0, FT2, &env->fp_status);
+        FT0 = float64_mul(FT0, FT1, &env->fp_status);
+        FT0 = float64_sub(FT0, FT2, &env->fp_status);
 #endif
-    if (likely(!isnan(FT0)))
-        FT0 = float64_chs(FT0);
+        if (likely(!isnan(FT0)))
+            FT0 = float64_chs(FT0);
+    }
 }
 
+#if USE_PRECISE_EMULATION
+void do_frsp (void)
+{
+    if (unlikely(float64_is_signaling_nan(FT0))) {
+        /* sNaN square root */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else {
+        FT0 = float64_to_float32(FT0, &env->fp_status);
+    }
+}
+#endif /* USE_PRECISE_EMULATION */
+
 void do_fsqrt (void)
 {
-    FT0 = float64_sqrt(FT0, &env->fp_status);
+    if (unlikely(float64_is_signaling_nan(FT0))) {
+        /* sNaN square root */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else if (unlikely(fpisneg(FT0) && !iszero(FT0))) {
+        /* Square root of a negative nonzero number */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSQRT);
+    } else {
+        FT0 = float64_sqrt(FT0, &env->fp_status);
+    }
 }
 
 void do_fre (void)
@@ -833,7 +1272,13 @@ void do_fre (void)
         uint64_t i;
     } p;
 
-    if (likely(isnormal(FT0))) {
+    if (unlikely(float64_is_signaling_nan(FT0))) {
+        /* sNaN reciprocal */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else if (unlikely(iszero(FT0))) {
+        /* Zero reciprocal */
+        float_zero_divide_excp();
+    } else if (likely(isnormal(FT0))) {
         FT0 = float64_div(1.0, FT0, &env->fp_status);
     } else {
         p.d = FT0;
@@ -843,7 +1288,7 @@ void do_fre (void)
             p.i = 0x7FF0000000000000ULL;
         } else if (isnan(FT0)) {
             p.i = 0x7FF8000000000000ULL;
-        } else if (FT0 < 0.0) {
+        } else if (fpisneg(FT0)) {
             p.i = 0x8000000000000000ULL;
         } else {
             p.i = 0x0000000000000000ULL;
@@ -859,7 +1304,13 @@ void do_fres (void)
         uint64_t i;
     } p;
 
-    if (likely(isnormal(FT0))) {
+    if (unlikely(float64_is_signaling_nan(FT0))) {
+        /* sNaN reciprocal */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else if (unlikely(iszero(FT0))) {
+        /* Zero reciprocal */
+        float_zero_divide_excp();
+    } else if (likely(isnormal(FT0))) {
 #if USE_PRECISE_EMULATION
         FT0 = float64_div(1.0, FT0, &env->fp_status);
         FT0 = float64_to_float32(FT0, &env->fp_status);
@@ -874,7 +1325,7 @@ void do_fres (void)
             p.i = 0x7FF0000000000000ULL;
         } else if (isnan(FT0)) {
             p.i = 0x7FF8000000000000ULL;
-        } else if (FT0 < 0.0) {
+        } else if (fpisneg(FT0)) {
             p.i = 0x8000000000000000ULL;
         } else {
             p.i = 0x0000000000000000ULL;
@@ -890,7 +1341,13 @@ void do_frsqrte (void)
         uint64_t i;
     } p;
 
-    if (likely(isnormal(FT0) && FT0 > 0.0)) {
+    if (unlikely(float64_is_signaling_nan(FT0))) {
+        /* sNaN reciprocal square root */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else if (unlikely(fpisneg(FT0) && !iszero(FT0))) {
+        /* Reciprocal square root of a negative nonzero number */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSQRT);
+    } else if (likely(isnormal(FT0))) {
         FT0 = float64_sqrt(FT0, &env->fp_status);
         FT0 = float32_div(1.0, FT0, &env->fp_status);
     } else {
@@ -900,9 +1357,8 @@ void do_frsqrte (void)
         } else if (p.i == 0x0000000000000000ULL) {
             p.i = 0x7FF0000000000000ULL;
         } else if (isnan(FT0)) {
-            if (!(p.i & 0x0008000000000000ULL))
-                p.i |= 0x000FFFFFFFFFFFFFULL;
-        } else if (FT0 < 0) {
+            p.i |= 0x000FFFFFFFFFFFFFULL;
+        } else if (fpisneg(FT0)) {
             p.i = 0x7FF8000000000000ULL;
         } else {
             p.i = 0x0000000000000000ULL;
@@ -913,7 +1369,7 @@ void do_frsqrte (void)
 
 void do_fsel (void)
 {
-    if (FT0 >= 0)
+    if (!fpisneg(FT0) || iszero(FT0))
         FT0 = FT1;
     else
         FT0 = FT2;
@@ -921,7 +1377,11 @@ void do_fsel (void)
 
 void do_fcmpu (void)
 {
-    if (likely(!isnan(FT0) && !isnan(FT1))) {
+    if (unlikely(float64_is_signaling_nan(FT0) ||
+                 float64_is_signaling_nan(FT1))) {
+        /* sNaN comparison */
+        fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);
+    } else {
         if (float64_lt(FT0, FT1, &env->fp_status)) {
             T0 = 0x08UL;
         } else if (!float64_le(FT0, FT1, &env->fp_status)) {
@@ -929,18 +1389,25 @@ void do_fcmpu (void)
         } else {
             T0 = 0x02UL;
         }
-    } else {
-        T0 = 0x01UL;
-        env->fpscr[4] |= 0x1;
-        env->fpscr[6] |= 0x1;
     }
-    env->fpscr[3] = T0;
+    env->fpscr &= ~(0x0F << FPSCR_FPRF);
+    env->fpscr |= T0 << FPSCR_FPRF;
 }
 
 void do_fcmpo (void)
 {
-    env->fpscr[4] &= ~0x1;
-    if (likely(!isnan(FT0) && !isnan(FT1))) {
+    if (unlikely(float64_is_nan(FT0) ||
+                 float64_is_nan(FT1))) {
+        if (float64_is_signaling_nan(FT0) ||
+            float64_is_signaling_nan(FT1)) {
+            /* sNaN comparison */
+            fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN |
+                                  POWERPC_EXCP_FP_VXVC);
+        } else {
+            /* qNaN comparison */
+            fload_invalid_op_excp(POWERPC_EXCP_FP_VXVC);
+        }
+    } else {
         if (float64_lt(FT0, FT1, &env->fp_status)) {
             T0 = 0x08UL;
         } else if (!float64_le(FT0, FT1, &env->fp_status)) {
@@ -948,73 +1415,69 @@ void do_fcmpo (void)
         } else {
             T0 = 0x02UL;
         }
-    } else {
-        T0 = 0x01UL;
-        env->fpscr[4] |= 0x1;
-        if (!float64_is_signaling_nan(FT0) || !float64_is_signaling_nan(FT1)) {
-            /* Quiet NaN case */
-            env->fpscr[6] |= 0x1;
-            if (!(env->fpscr[1] & 0x8))
-                env->fpscr[4] |= 0x8;
-        } else {
-            env->fpscr[4] |= 0x8;
-        }
     }
-    env->fpscr[3] = T0;
+    env->fpscr &= ~(0x0F << FPSCR_FPRF);
+    env->fpscr |= T0 << FPSCR_FPRF;
 }
 
 #if !defined (CONFIG_USER_ONLY)
 void cpu_dump_rfi (target_ulong RA, target_ulong msr);
-void do_rfi (void)
+
+void do_store_msr (void)
+{
+    T0 = hreg_store_msr(env, T0, 0);
+    if (T0 != 0) {
+        env->interrupt_request |= CPU_INTERRUPT_EXITTB;
+        do_raise_exception(T0);
+    }
+}
+
+static always_inline void __do_rfi (target_ulong nip, target_ulong msr,
+                                    target_ulong msrm, int keep_msrh)
 {
 #if defined(TARGET_PPC64)
-    if (env->spr[SPR_SRR1] & (1ULL << MSR_SF)) {
-        env->nip = (uint64_t)(env->spr[SPR_SRR0] & ~0x00000003);
-        do_store_msr(env, (uint64_t)(env->spr[SPR_SRR1] & ~0xFFFF0000UL));
+    if (msr & (1ULL << MSR_SF)) {
+        nip = (uint64_t)nip;
+        msr &= (uint64_t)msrm;
     } else {
-        env->nip = (uint32_t)(env->spr[SPR_SRR0] & ~0x00000003);
-        ppc_store_msr_32(env, (uint32_t)(env->spr[SPR_SRR1] & ~0xFFFF0000UL));
+        nip = (uint32_t)nip;
+        msr = (uint32_t)(msr & msrm);
+        if (keep_msrh)
+            msr |= env->msr & ~((uint64_t)0xFFFFFFFF);
     }
 #else
-    env->nip = (uint32_t)(env->spr[SPR_SRR0] & ~0x00000003);
-    do_store_msr(env, (uint32_t)(env->spr[SPR_SRR1] & ~0xFFFF0000UL));
+    nip = (uint32_t)nip;
+    msr &= (uint32_t)msrm;
 #endif
+    /* XXX: beware: this is false if VLE is supported */
+    env->nip = nip & ~((target_ulong)0x00000003);
+    hreg_store_msr(env, msr, 1);
 #if defined (DEBUG_OP)
-    cpu_dump_rfi(env->nip, do_load_msr(env));
+    cpu_dump_rfi(env->nip, env->msr);
 #endif
+    /* No need to raise an exception here,
+     * as rfi is always the last insn of a TB
+     */
     env->interrupt_request |= CPU_INTERRUPT_EXITTB;
 }
 
+void do_rfi (void)
+{
+    __do_rfi(env->spr[SPR_SRR0], env->spr[SPR_SRR1],
+             ~((target_ulong)0xFFFF0000), 1);
+}
+
 #if defined(TARGET_PPC64)
 void do_rfid (void)
 {
-    if (env->spr[SPR_SRR1] & (1ULL << MSR_SF)) {
-        env->nip = (uint64_t)(env->spr[SPR_SRR0] & ~0x00000003);
-        do_store_msr(env, (uint64_t)(env->spr[SPR_SRR1] & ~0xFFFF0000UL));
-    } else {
-        env->nip = (uint32_t)(env->spr[SPR_SRR0] & ~0x00000003);
-        do_store_msr(env, (uint32_t)(env->spr[SPR_SRR1] & ~0xFFFF0000UL));
-    }
-#if defined (DEBUG_OP)
-    cpu_dump_rfi(env->nip, do_load_msr(env));
-#endif
-    env->interrupt_request |= CPU_INTERRUPT_EXITTB;
+    __do_rfi(env->spr[SPR_SRR0], env->spr[SPR_SRR1],
+             ~((target_ulong)0xFFFF0000), 0);
 }
-#endif
-#if defined(TARGET_PPC64H)
+
 void do_hrfid (void)
 {
-    if (env->spr[SPR_HSRR1] & (1ULL << MSR_SF)) {
-        env->nip = (uint64_t)(env->spr[SPR_HSRR0] & ~0x00000003);
-        do_store_msr(env, (uint64_t)(env->spr[SPR_HSRR1] & ~0xFFFF0000UL));
-    } else {
-        env->nip = (uint32_t)(env->spr[SPR_HSRR0] & ~0x00000003);
-        do_store_msr(env, (uint32_t)(env->spr[SPR_HSRR1] & ~0xFFFF0000UL));
-    }
-#if defined (DEBUG_OP)
-    cpu_dump_rfi(env->nip, do_load_msr(env));
-#endif
-    env->interrupt_request |= CPU_INTERRUPT_EXITTB;
+    __do_rfi(env->spr[SPR_HSRR0], env->spr[SPR_HSRR1],
+             ~((target_ulong)0xFFFF0000), 0);
 }
 #endif
 #endif
@@ -1046,14 +1509,16 @@ void do_td (int flags)
 /* PowerPC 601 specific instructions (POWER bridge) */
 void do_POWER_abso (void)
 {
-    if ((uint32_t)T0 == INT32_MIN) {
+    if ((int32_t)T0 == INT32_MIN) {
         T0 = INT32_MAX;
         xer_ov = 1;
-        xer_so = 1;
-    } else {
+    } else if ((int32_t)T0 < 0) {
         T0 = -T0;
         xer_ov = 0;
+    } else {
+        xer_ov = 0;
     }
+    xer_so |= xer_ov;
 }
 
 void do_POWER_clcs (void)
@@ -1061,21 +1526,21 @@ void do_POWER_clcs (void)
     switch (T0) {
     case 0x0CUL:
         /* Instruction cache line size */
-        T0 = ICACHE_LINE_SIZE;
+        T0 = env->icache_line_size;
         break;
     case 0x0DUL:
         /* Data cache line size */
-        T0 = DCACHE_LINE_SIZE;
+        T0 = env->dcache_line_size;
         break;
     case 0x0EUL:
         /* Minimum cache line size */
-        T0 = ICACHE_LINE_SIZE < DCACHE_LINE_SIZE ?
-            ICACHE_LINE_SIZE : DCACHE_LINE_SIZE;
+        T0 = env->icache_line_size < env->dcache_line_size ?
+            env->icache_line_size : env->dcache_line_size;
         break;
     case 0x0FUL:
         /* Maximum cache line size */
-        T0 = ICACHE_LINE_SIZE > DCACHE_LINE_SIZE ?
-            ICACHE_LINE_SIZE : DCACHE_LINE_SIZE;
+        T0 = env->icache_line_size > env->dcache_line_size ?
+            env->icache_line_size : env->dcache_line_size;
         break;
     default:
         /* Undefined */
@@ -1087,8 +1552,9 @@ void do_POWER_div (void)
 {
     uint64_t tmp;
 
-    if (((int32_t)T0 == INT32_MIN && (int32_t)T1 == -1) || (int32_t)T1 == 0) {
-        T0 = (long)((-1) * (T0 >> 31));
+    if (((int32_t)T0 == INT32_MIN && (int32_t)T1 == (int32_t)-1) ||
+        (int32_t)T1 == 0) {
+        T0 = UINT32_MAX * ((uint32_t)T0 >> 31);
         env->spr[SPR_MQ] = 0;
     } else {
         tmp = ((uint64_t)T0 << 32) | env->spr[SPR_MQ];
@@ -1101,29 +1567,30 @@ void do_POWER_divo (void)
 {
     int64_t tmp;
 
-    if (((int32_t)T0 == INT32_MIN && (int32_t)T1 == -1) || (int32_t)T1 == 0) {
-        T0 = (long)((-1) * (T0 >> 31));
+    if (((int32_t)T0 == INT32_MIN && (int32_t)T1 == (int32_t)-1) ||
+        (int32_t)T1 == 0) {
+        T0 = UINT32_MAX * ((uint32_t)T0 >> 31);
         env->spr[SPR_MQ] = 0;
         xer_ov = 1;
-        xer_so = 1;
     } else {
         tmp = ((uint64_t)T0 << 32) | env->spr[SPR_MQ];
         env->spr[SPR_MQ] = tmp % T1;
         tmp /= (int32_t)T1;
         if (tmp > (int64_t)INT32_MAX || tmp < (int64_t)INT32_MIN) {
             xer_ov = 1;
-            xer_so = 1;
         } else {
             xer_ov = 0;
         }
         T0 = tmp;
     }
+    xer_so |= xer_ov;
 }
 
 void do_POWER_divs (void)
 {
-    if (((int32_t)T0 == INT32_MIN && (int32_t)T1 == -1) || (int32_t)T1 == 0) {
-        T0 = (long)((-1) * (T0 >> 31));
+    if (((int32_t)T0 == INT32_MIN && (int32_t)T1 == (int32_t)-1) ||
+        (int32_t)T1 == 0) {
+        T0 = UINT32_MAX * ((uint32_t)T0 >> 31);
         env->spr[SPR_MQ] = 0;
     } else {
         env->spr[SPR_MQ] = T0 % T1;
@@ -1133,16 +1600,17 @@ void do_POWER_divs (void)
 
 void do_POWER_divso (void)
 {
-    if (((int32_t)T0 == INT32_MIN && (int32_t)T1 == -1) || (int32_t)T1 == 0) {
-        T0 = (long)((-1) * (T0 >> 31));
+    if (((int32_t)T0 == INT32_MIN && (int32_t)T1 == (int32_t)-1) ||
+        (int32_t)T1 == 0) {
+        T0 = UINT32_MAX * ((uint32_t)T0 >> 31);
         env->spr[SPR_MQ] = 0;
         xer_ov = 1;
-        xer_so = 1;
     } else {
         T0 = (int32_t)T0 / (int32_t)T1;
         env->spr[SPR_MQ] = (int32_t)T0 % (int32_t)T1;
         xer_ov = 0;
     }
+    xer_so |= xer_ov;
 }
 
 void do_POWER_dozo (void)
@@ -1168,10 +1636,10 @@ void do_POWER_maskg (void)
     uint32_t ret;
 
     if ((uint32_t)T0 == (uint32_t)(T1 + 1)) {
-        ret = -1;
+        ret = UINT32_MAX;
     } else {
-        ret = (((uint32_t)(-1)) >> ((uint32_t)T0)) ^
-            (((uint32_t)(-1) >> ((uint32_t)T1)) >> 1);
+        ret = (UINT32_MAX >> ((uint32_t)T0)) ^
+            ((UINT32_MAX >> ((uint32_t)T1)) >> 1);
         if ((uint32_t)T0 > (uint32_t)T1)
             ret = ~ret;
     }
@@ -1196,34 +1664,42 @@ void do_POWER_mulo (void)
 #if !defined (CONFIG_USER_ONLY)
 void do_POWER_rac (void)
 {
-#if 0
     mmu_ctx_t ctx;
+    int nb_BATs;
 
     /* We don't have to generate many instances of this instruction,
      * as rac is supervisor only.
      */
-    if (get_physical_address(env, &ctx, T0, 0, ACCESS_INT, 1) == 0)
+    /* XXX: FIX THIS: Pretend we have no BAT */
+    nb_BATs = env->nb_BATs;
+    env->nb_BATs = 0;
+    if (get_physical_address(env, &ctx, T0, 0, ACCESS_INT) == 0)
         T0 = ctx.raddr;
-#endif
+    env->nb_BATs = nb_BATs;
 }
 
 void do_POWER_rfsvc (void)
 {
-    env->nip = env->lr & ~0x00000003UL;
-    T0 = env->ctr & 0x0000FFFFUL;
-    do_store_msr(env, T0);
-#if defined (DEBUG_OP)
-    cpu_dump_rfi(env->nip, do_load_msr(env));
-#endif
-    env->interrupt_request |= CPU_INTERRUPT_EXITTB;
+    __do_rfi(env->lr, env->ctr, 0x0000FFFF, 0);
 }
 
-/* PowerPC 601 BAT management helper */
-void do_store_601_batu (int nr)
+void do_store_hid0_601 (void)
 {
-    do_store_ibatu(env, nr, (uint32_t)T0);
-    env->DBAT[0][nr] = env->IBAT[0][nr];
-    env->DBAT[1][nr] = env->IBAT[1][nr];
+    uint32_t hid0;
+
+    hid0 = env->spr[SPR_HID0];
+    if ((T0 ^ hid0) & 0x00000008) {
+        /* Change current endianness */
+        env->hflags &= ~(1 << MSR_LE);
+        env->hflags_nmsr &= ~(1 << MSR_LE);
+        env->hflags_nmsr |= (1 << MSR_LE) & (((T0 >> 3) & 1) << MSR_LE);
+        env->hflags |= env->hflags_nmsr;
+        if (loglevel != 0) {
+            fprintf(logfile, "%s: set endianness to %c => " ADDRX "\n",
+                    __func__, T0 & 0x8 ? 'l' : 'b', env->hflags);
+        }
+    }
+    env->spr[SPR_HID0] = T0;
 }
 #endif
 
@@ -1261,17 +1737,6 @@ void do_op_602_mfrom (void)
 
 /*****************************************************************************/
 /* Embedded PowerPC specific helpers */
-void do_405_check_ov (void)
-{
-    if (likely((((uint32_t)T1 ^ (uint32_t)T2) >> 31) ||
-               !(((uint32_t)T0 ^ (uint32_t)T2) >> 31))) {
-        xer_ov = 0;
-    } else {
-        xer_ov = 1;
-        xer_so = 1;
-    }
-}
-
 void do_405_check_sat (void)
 {
     if (!likely((((uint32_t)T1 ^ (uint32_t)T2) >> 31) ||
@@ -1327,63 +1792,26 @@ void do_store_dcr (void)
 #if !defined(CONFIG_USER_ONLY)
 void do_40x_rfci (void)
 {
-    env->nip = env->spr[SPR_40x_SRR2];
-    do_store_msr(env, env->spr[SPR_40x_SRR3] & ~0xFFFF0000);
-#if defined (DEBUG_OP)
-    cpu_dump_rfi(env->nip, do_load_msr(env));
-#endif
-    env->interrupt_request = CPU_INTERRUPT_EXITTB;
+    __do_rfi(env->spr[SPR_40x_SRR2], env->spr[SPR_40x_SRR3],
+             ~((target_ulong)0xFFFF0000), 0);
 }
 
 void do_rfci (void)
 {
-#if defined(TARGET_PPC64)
-    if (env->spr[SPR_BOOKE_CSRR1] & (1 << MSR_CM)) {
-        env->nip = (uint64_t)env->spr[SPR_BOOKE_CSRR0];
-    } else
-#endif
-    {
-        env->nip = (uint32_t)env->spr[SPR_BOOKE_CSRR0];
-    }
-    do_store_msr(env, (uint32_t)env->spr[SPR_BOOKE_CSRR1] & ~0x3FFF0000);
-#if defined (DEBUG_OP)
-    cpu_dump_rfi(env->nip, do_load_msr(env));
-#endif
-    env->interrupt_request = CPU_INTERRUPT_EXITTB;
+    __do_rfi(env->spr[SPR_BOOKE_CSRR0], SPR_BOOKE_CSRR1,
+             ~((target_ulong)0x3FFF0000), 0);
 }
 
 void do_rfdi (void)
 {
-#if defined(TARGET_PPC64)
-    if (env->spr[SPR_BOOKE_DSRR1] & (1 << MSR_CM)) {
-        env->nip = (uint64_t)env->spr[SPR_BOOKE_DSRR0];
-    } else
-#endif
-    {
-        env->nip = (uint32_t)env->spr[SPR_BOOKE_DSRR0];
-    }
-    do_store_msr(env, (uint32_t)env->spr[SPR_BOOKE_DSRR1] & ~0x3FFF0000);
-#if defined (DEBUG_OP)
-    cpu_dump_rfi(env->nip, do_load_msr(env));
-#endif
-    env->interrupt_request = CPU_INTERRUPT_EXITTB;
+    __do_rfi(env->spr[SPR_BOOKE_DSRR0], SPR_BOOKE_DSRR1,
+             ~((target_ulong)0x3FFF0000), 0);
 }
 
 void do_rfmci (void)
 {
-#if defined(TARGET_PPC64)
-    if (env->spr[SPR_BOOKE_MCSRR1] & (1 << MSR_CM)) {
-        env->nip = (uint64_t)env->spr[SPR_BOOKE_MCSRR0];
-    } else
-#endif
-    {
-        env->nip = (uint32_t)env->spr[SPR_BOOKE_MCSRR0];
-    }
-    do_store_msr(env, (uint32_t)env->spr[SPR_BOOKE_MCSRR1] & ~0x3FFF0000);
-#if defined (DEBUG_OP)
-    cpu_dump_rfi(env->nip, do_load_msr(env));
-#endif
-    env->interrupt_request = CPU_INTERRUPT_EXITTB;
+    __do_rfi(env->spr[SPR_BOOKE_MCSRR0], SPR_BOOKE_MCSRR1,
+             ~((target_ulong)0x3FFF0000), 0);
 }
 
 void do_load_403_pb (int num)
@@ -1422,7 +1850,6 @@ void do_440_dlmzb (void)
     T0 = i;
 }
 
-#if defined(TARGET_PPCEMB)
 /* SPE extension helpers */
 /* Use a table to make this quicker */
 static uint8_t hbrev[16] = {
@@ -1430,27 +1857,27 @@ static uint8_t hbrev[16] = {
     0x1, 0x9, 0x5, 0xD, 0x3, 0xB, 0x7, 0xF,
 };
 
-static inline uint8_t byte_reverse (uint8_t val)
+static always_inline uint8_t byte_reverse (uint8_t val)
 {
     return hbrev[val >> 4] | (hbrev[val & 0xF] << 4);
 }
 
-static inline uint32_t word_reverse (uint32_t val)
+static always_inline uint32_t word_reverse (uint32_t val)
 {
     return byte_reverse(val >> 24) | (byte_reverse(val >> 16) << 8) |
         (byte_reverse(val >> 8) << 16) | (byte_reverse(val) << 24);
 }
 
-#define MASKBITS 16 // Random value - to be fixed
+#define MASKBITS 16 // Random value - to be fixed (implementation dependant)
 void do_brinc (void)
 {
     uint32_t a, b, d, mask;
 
-    mask = (uint32_t)(-1UL) >> MASKBITS;
-    b = T1_64 & mask;
-    a = T0_64 & mask;
-    d = word_reverse(1 + word_reverse(a | ~mask));
-    T0_64 = (T0_64 & ~mask) | (d & mask);
+    mask = UINT32_MAX >> (32 - MASKBITS);
+    a = T0 & mask;
+    b = T1 & mask;
+    d = word_reverse(1 + word_reverse(a | ~b));
+    T0 = (T0 & ~mask) | (d & b);
 }
 
 #define DO_SPE_OP2(name)                                                      \
@@ -1468,69 +1895,69 @@ void do_ev##name (void)                                                       \
 }
 
 /* Fixed-point vector arithmetic */
-static inline uint32_t _do_eabs (uint32_t val)
+static always_inline uint32_t _do_eabs (uint32_t val)
 {
-    if (val != 0x80000000)
-        val &= ~0x80000000;
+    if ((val & 0x80000000) && val != 0x80000000)
+        val -= val;
 
     return val;
 }
 
-static inline uint32_t _do_eaddw (uint32_t op1, uint32_t op2)
+static always_inline uint32_t _do_eaddw (uint32_t op1, uint32_t op2)
 {
     return op1 + op2;
 }
 
-static inline int _do_ecntlsw (uint32_t val)
+static always_inline int _do_ecntlsw (uint32_t val)
 {
     if (val & 0x80000000)
-        return _do_cntlzw(~val);
+        return clz32(~val);
     else
-        return _do_cntlzw(val);
+        return clz32(val);
 }
 
-static inline int _do_ecntlzw (uint32_t val)
+static always_inline int _do_ecntlzw (uint32_t val)
 {
-    return _do_cntlzw(val);
+    return clz32(val);
 }
 
-static inline uint32_t _do_eneg (uint32_t val)
+static always_inline uint32_t _do_eneg (uint32_t val)
 {
     if (val != 0x80000000)
-        val ^= 0x80000000;
+        val -= val;
 
     return val;
 }
 
-static inline uint32_t _do_erlw (uint32_t op1, uint32_t op2)
+static always_inline uint32_t _do_erlw (uint32_t op1, uint32_t op2)
 {
     return rotl32(op1, op2);
 }
 
-static inline uint32_t _do_erndw (uint32_t val)
+static always_inline uint32_t _do_erndw (uint32_t val)
 {
     return (val + 0x000080000000) & 0xFFFF0000;
 }
 
-static inline uint32_t _do_eslw (uint32_t op1, uint32_t op2)
+static always_inline uint32_t _do_eslw (uint32_t op1, uint32_t op2)
 {
     /* No error here: 6 bits are used */
     return op1 << (op2 & 0x3F);
 }
 
-static inline int32_t _do_esrws (int32_t op1, uint32_t op2)
+static always_inline int32_t _do_esrws (int32_t op1, uint32_t op2)
 {
     /* No error here: 6 bits are used */
     return op1 >> (op2 & 0x3F);
 }
 
-static inline uint32_t _do_esrwu (uint32_t op1, uint32_t op2)
+static always_inline uint32_t _do_esrwu (uint32_t op1, uint32_t op2)
 {
     /* No error here: 6 bits are used */
     return op1 >> (op2 & 0x3F);
 }
 
-static inline uint32_t _do_esubfw (uint32_t op1, uint32_t op2)
+static always_inline uint32_t _do_esubfw (uint32_t op1, uint32_t op2)
 {
     return op2 - op1;
 }
@@ -1559,7 +1986,7 @@ DO_SPE_OP2(srwu);
 DO_SPE_OP2(subfw);
 
 /* evsel is a little bit more complicated... */
-static inline uint32_t _do_esel (uint32_t op1, uint32_t op2, int n)
+static always_inline uint32_t _do_esel (uint32_t op1, uint32_t op2, int n)
 {
     if (n)
         return op1;
@@ -1582,31 +2009,31 @@ void do_ev##name (void)                                                       \
                          _do_e##name(T0_64, T1_64));                          \
 }
 
-static inline uint32_t _do_evcmp_merge (int t0, int t1)
+static always_inline uint32_t _do_evcmp_merge (int t0, int t1)
 {
     return (t0 << 3) | (t1 << 2) | ((t0 | t1) << 1) | (t0 & t1);
 }
-static inline int _do_ecmpeq (uint32_t op1, uint32_t op2)
+static always_inline int _do_ecmpeq (uint32_t op1, uint32_t op2)
 {
     return op1 == op2 ? 1 : 0;
 }
 
-static inline int _do_ecmpgts (int32_t op1, int32_t op2)
+static always_inline int _do_ecmpgts (int32_t op1, int32_t op2)
 {
     return op1 > op2 ? 1 : 0;
 }
 
-static inline int _do_ecmpgtu (uint32_t op1, uint32_t op2)
+static always_inline int _do_ecmpgtu (uint32_t op1, uint32_t op2)
 {
     return op1 > op2 ? 1 : 0;
 }
 
-static inline int _do_ecmplts (int32_t op1, int32_t op2)
+static always_inline int _do_ecmplts (int32_t op1, int32_t op2)
 {
     return op1 < op2 ? 1 : 0;
 }
 
-static inline int _do_ecmpltu (uint32_t op1, uint32_t op2)
+static always_inline int _do_ecmpltu (uint32_t op1, uint32_t op2)
 {
     return op1 < op2 ? 1 : 0;
 }
@@ -1623,7 +2050,7 @@ DO_SPE_CMP(cmplts);
 DO_SPE_CMP(cmpltu);
 
 /* Single precision floating-point conversions from/to integer */
-static inline uint32_t _do_efscfsi (int32_t val)
+static always_inline uint32_t _do_efscfsi (int32_t val)
 {
     union {
         uint32_t u;
@@ -1635,7 +2062,7 @@ static inline uint32_t _do_efscfsi (int32_t val)
     return u.u;
 }
 
-static inline uint32_t _do_efscfui (uint32_t val)
+static always_inline uint32_t _do_efscfui (uint32_t val)
 {
     union {
         uint32_t u;
@@ -1647,7 +2074,7 @@ static inline uint32_t _do_efscfui (uint32_t val)
     return u.u;
 }
 
-static inline int32_t _do_efsctsi (uint32_t val)
+static always_inline int32_t _do_efsctsi (uint32_t val)
 {
     union {
         int32_t u;
@@ -1662,7 +2089,7 @@ static inline int32_t _do_efsctsi (uint32_t val)
     return float32_to_int32(u.f, &env->spe_status);
 }
 
-static inline uint32_t _do_efsctui (uint32_t val)
+static always_inline uint32_t _do_efsctui (uint32_t val)
 {
     union {
         int32_t u;
@@ -1677,7 +2104,7 @@ static inline uint32_t _do_efsctui (uint32_t val)
     return float32_to_uint32(u.f, &env->spe_status);
 }
 
-static inline int32_t _do_efsctsiz (uint32_t val)
+static always_inline int32_t _do_efsctsiz (uint32_t val)
 {
     union {
         int32_t u;
@@ -1692,7 +2119,7 @@ static inline int32_t _do_efsctsiz (uint32_t val)
     return float32_to_int32_round_to_zero(u.f, &env->spe_status);
 }
 
-static inline uint32_t _do_efsctuiz (uint32_t val)
+static always_inline uint32_t _do_efsctuiz (uint32_t val)
 {
     union {
         int32_t u;
@@ -1738,7 +2165,7 @@ void do_efsctuiz (void)
 }
 
 /* Single precision floating-point conversion to/from fractional */
-static inline uint32_t _do_efscfsf (uint32_t val)
+static always_inline uint32_t _do_efscfsf (uint32_t val)
 {
     union {
         uint32_t u;
@@ -1753,7 +2180,7 @@ static inline uint32_t _do_efscfsf (uint32_t val)
     return u.u;
 }
 
-static inline uint32_t _do_efscfuf (uint32_t val)
+static always_inline uint32_t _do_efscfuf (uint32_t val)
 {
     union {
         uint32_t u;
@@ -1768,7 +2195,7 @@ static inline uint32_t _do_efscfuf (uint32_t val)
     return u.u;
 }
 
-static inline int32_t _do_efsctsf (uint32_t val)
+static always_inline int32_t _do_efsctsf (uint32_t val)
 {
     union {
         int32_t u;
@@ -1786,7 +2213,7 @@ static inline int32_t _do_efsctsf (uint32_t val)
     return float32_to_int32(u.f, &env->spe_status);
 }
 
-static inline uint32_t _do_efsctuf (uint32_t val)
+static always_inline uint32_t _do_efsctuf (uint32_t val)
 {
     union {
         int32_t u;
@@ -1804,7 +2231,7 @@ static inline uint32_t _do_efsctuf (uint32_t val)
     return float32_to_uint32(u.f, &env->spe_status);
 }
 
-static inline int32_t _do_efsctsfz (uint32_t val)
+static always_inline int32_t _do_efsctsfz (uint32_t val)
 {
     union {
         int32_t u;
@@ -1822,7 +2249,7 @@ static inline int32_t _do_efsctsfz (uint32_t val)
     return float32_to_int32_round_to_zero(u.f, &env->spe_status);
 }
 
-static inline uint32_t _do_efsctufz (uint32_t val)
+static always_inline uint32_t _do_efsctufz (uint32_t val)
 {
     union {
         int32_t u;
@@ -1871,19 +2298,19 @@ void do_efsctufz (void)
 }
 
 /* Double precision floating point helpers */
-static inline int _do_efdcmplt (uint64_t op1, uint64_t op2)
+static always_inline int _do_efdcmplt (uint64_t op1, uint64_t op2)
 {
     /* XXX: TODO: test special values (NaN, infinites, ...) */
     return _do_efdtstlt(op1, op2);
 }
 
-static inline int _do_efdcmpgt (uint64_t op1, uint64_t op2)
+static always_inline int _do_efdcmpgt (uint64_t op1, uint64_t op2)
 {
     /* XXX: TODO: test special values (NaN, infinites, ...) */
     return _do_efdtstgt(op1, op2);
 }
 
-static inline int _do_efdcmpeq (uint64_t op1, uint64_t op2)
+static always_inline int _do_efdcmpeq (uint64_t op1, uint64_t op2)
 {
     /* XXX: TODO: test special values (NaN, infinites, ...) */
     return _do_efdtsteq(op1, op2);
@@ -1905,7 +2332,7 @@ void do_efdcmpeq (void)
 }
 
 /* Double precision floating-point conversion to/from integer */
-static inline uint64_t _do_efdcfsi (int64_t val)
+static always_inline uint64_t _do_efdcfsi (int64_t val)
 {
     union {
         uint64_t u;
@@ -1917,7 +2344,7 @@ static inline uint64_t _do_efdcfsi (int64_t val)
     return u.u;
 }
 
-static inline uint64_t _do_efdcfui (uint64_t val)
+static always_inline uint64_t _do_efdcfui (uint64_t val)
 {
     union {
         uint64_t u;
@@ -1929,7 +2356,7 @@ static inline uint64_t _do_efdcfui (uint64_t val)
     return u.u;
 }
 
-static inline int64_t _do_efdctsi (uint64_t val)
+static always_inline int64_t _do_efdctsi (uint64_t val)
 {
     union {
         int64_t u;
@@ -1944,7 +2371,7 @@ static inline int64_t _do_efdctsi (uint64_t val)
     return float64_to_int64(u.f, &env->spe_status);
 }
 
-static inline uint64_t _do_efdctui (uint64_t val)
+static always_inline uint64_t _do_efdctui (uint64_t val)
 {
     union {
         int64_t u;
@@ -1959,7 +2386,7 @@ static inline uint64_t _do_efdctui (uint64_t val)
     return float64_to_uint64(u.f, &env->spe_status);
 }
 
-static inline int64_t _do_efdctsiz (uint64_t val)
+static always_inline int64_t _do_efdctsiz (uint64_t val)
 {
     union {
         int64_t u;
@@ -1974,7 +2401,7 @@ static inline int64_t _do_efdctsiz (uint64_t val)
     return float64_to_int64_round_to_zero(u.f, &env->spe_status);
 }
 
-static inline uint64_t _do_efdctuiz (uint64_t val)
+static always_inline uint64_t _do_efdctuiz (uint64_t val)
 {
     union {
         int64_t u;
@@ -2020,7 +2447,7 @@ void do_efdctuiz (void)
 }
 
 /* Double precision floating-point conversion to/from fractional */
-static inline uint64_t _do_efdcfsf (int64_t val)
+static always_inline uint64_t _do_efdcfsf (int64_t val)
 {
     union {
         uint64_t u;
@@ -2035,7 +2462,7 @@ static inline uint64_t _do_efdcfsf (int64_t val)
     return u.u;
 }
 
-static inline uint64_t _do_efdcfuf (uint64_t val)
+static always_inline uint64_t _do_efdcfuf (uint64_t val)
 {
     union {
         uint64_t u;
@@ -2050,7 +2477,7 @@ static inline uint64_t _do_efdcfuf (uint64_t val)
     return u.u;
 }
 
-static inline int64_t _do_efdctsf (uint64_t val)
+static always_inline int64_t _do_efdctsf (uint64_t val)
 {
     union {
         int64_t u;
@@ -2068,7 +2495,7 @@ static inline int64_t _do_efdctsf (uint64_t val)
     return float64_to_int32(u.f, &env->spe_status);
 }
 
-static inline uint64_t _do_efdctuf (uint64_t val)
+static always_inline uint64_t _do_efdctuf (uint64_t val)
 {
     union {
         int64_t u;
@@ -2086,7 +2513,7 @@ static inline uint64_t _do_efdctuf (uint64_t val)
     return float64_to_uint32(u.f, &env->spe_status);
 }
 
-static inline int64_t _do_efdctsfz (uint64_t val)
+static always_inline int64_t _do_efdctsfz (uint64_t val)
 {
     union {
         int64_t u;
@@ -2104,7 +2531,7 @@ static inline int64_t _do_efdctsfz (uint64_t val)
     return float64_to_int32_round_to_zero(u.f, &env->spe_status);
 }
 
-static inline uint64_t _do_efdctufz (uint64_t val)
+static always_inline uint64_t _do_efdctufz (uint64_t val)
 {
     union {
         int64_t u;
@@ -2153,7 +2580,7 @@ void do_efdctufz (void)
 }
 
 /* Floating point conversion between single and double precision */
-static inline uint32_t _do_efscfd (uint64_t val)
+static always_inline uint32_t _do_efscfd (uint64_t val)
 {
     union {
         uint64_t u;
@@ -2170,7 +2597,7 @@ static inline uint32_t _do_efscfd (uint64_t val)
     return u2.u;
 }
 
-static inline uint64_t _do_efdcfs (uint32_t val)
+static always_inline uint64_t _do_efdcfs (uint32_t val)
 {
     union {
         uint64_t u;
@@ -2214,19 +2641,19 @@ DO_SPE_OP2(fsmul);
 DO_SPE_OP2(fsdiv);
 
 /* Single-precision floating-point comparisons */
-static inline int _do_efscmplt (uint32_t op1, uint32_t op2)
+static always_inline int _do_efscmplt (uint32_t op1, uint32_t op2)
 {
     /* XXX: TODO: test special values (NaN, infinites, ...) */
     return _do_efststlt(op1, op2);
 }
 
-static inline int _do_efscmpgt (uint32_t op1, uint32_t op2)
+static always_inline int _do_efscmpgt (uint32_t op1, uint32_t op2)
 {
     /* XXX: TODO: test special values (NaN, infinites, ...) */
     return _do_efststgt(op1, op2);
 }
 
-static inline int _do_efscmpeq (uint32_t op1, uint32_t op2)
+static always_inline int _do_efscmpeq (uint32_t op1, uint32_t op2)
 {
     /* XXX: TODO: test special values (NaN, infinites, ...) */
     return _do_efststeq(op1, op2);
@@ -2282,14 +2709,17 @@ DO_SPE_OP1(fsctuiz);
 DO_SPE_OP1(fsctsf);
 /* evfsctuf */
 DO_SPE_OP1(fsctuf);
-#endif /* defined(TARGET_PPCEMB) */
 
 /*****************************************************************************/
 /* Softmmu support */
 #if !defined (CONFIG_USER_ONLY)
 
 #define MMUSUFFIX _mmu
-#define GETPC() (__builtin_return_address(0))
+#ifdef __s390__
+# define GETPC() ((void*)((unsigned long)__builtin_return_address(0) & 0x7fffffffUL))
+#else
+# define GETPC() (__builtin_return_address(0))
+#endif
 
 #define SHIFT 0
 #include "softmmu_template.h"
@@ -2307,22 +2737,22 @@ DO_SPE_OP1(fsctuf);
    NULL, it means that the function was called in C code (i.e. not
    from generated code or from helper.c) */
 /* XXX: fix it to restore all registers */
-void tlb_fill (target_ulong addr, int is_write, int is_user, void *retaddr)
+void tlb_fill (target_ulong addr, int is_write, int mmu_idx, void *retaddr)
 {
     TranslationBlock *tb;
     CPUState *saved_env;
-    target_phys_addr_t pc;
+    unsigned long pc;
     int ret;
 
     /* XXX: hack to restore env in all cases, even if not called from
        generated code */
     saved_env = env;
     env = cpu_single_env;
-    ret = cpu_ppc_handle_mmu_fault(env, addr, is_write, is_user, 1);
+    ret = cpu_ppc_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
     if (unlikely(ret != 0)) {
         if (likely(retaddr)) {
             /* now we have a real cpu fault */
-            pc = (target_phys_addr_t)(unsigned long)retaddr;
+            pc = (unsigned long)retaddr;
             tb = tb_find_pc(pc);
             if (likely(tb)) {
                 /* the PC is inside the translated code. It means that we have
@@ -2353,9 +2783,9 @@ void do_load_6xx_tlb (int is_code)
     way = (env->spr[SPR_SRR1] >> 17) & 1;
 #if defined (DEBUG_SOFTWARE_TLB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: EPN %08lx %08lx PTE0 %08lx PTE1 %08lx way %d\n",
-                __func__, (unsigned long)T0, (unsigned long)EPN,
-                (unsigned long)CMP, (unsigned long)RPN, way);
+        fprintf(logfile, "%s: EPN " TDX " " ADDRX " PTE0 " ADDRX
+                " PTE1 " ADDRX " way %d\n",
+                __func__, T0, EPN, CMP, RPN, way);
     }
 #endif
     /* Store this TLB */
@@ -2374,9 +2804,9 @@ void do_load_74xx_tlb (int is_code)
     way = env->spr[SPR_TLBMISS] & 0x3;
 #if defined (DEBUG_SOFTWARE_TLB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s: EPN %08lx %08lx PTE0 %08lx PTE1 %08lx way %d\n",
-                __func__, (unsigned long)T0, (unsigned long)EPN,
-                (unsigned long)CMP, (unsigned long)RPN, way);
+        fprintf(logfile, "%s: EPN " TDX " " ADDRX " PTE0 " ADDRX
+                " PTE1 " ADDRX " way %d\n",
+                __func__, T0, EPN, CMP, RPN, way);
     }
 #endif
     /* Store this TLB */
@@ -2384,12 +2814,12 @@ void do_load_74xx_tlb (int is_code)
                      way, is_code, CMP, RPN);
 }
 
-static target_ulong booke_tlb_to_page_size (int size)
+static always_inline target_ulong booke_tlb_to_page_size (int size)
 {
     return 1024 << (2 * size);
 }
 
-static int booke_page_size_to_tlb (target_ulong page_size)
+static always_inline int booke_page_size_to_tlb (target_ulong page_size)
 {
     int size;
 
@@ -2490,7 +2920,7 @@ void do_4xx_tlbwe_hi (void)
 
 #if defined (DEBUG_SOFTWARE_TLB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s T0 " REGX " T1 " REGX "\n", __func__, T0, T1);
+        fprintf(logfile, "%s T0 " TDX " T1 " TDX "\n", __func__, T0, T1);
     }
 #endif
     T0 &= 0x3F;
@@ -2559,7 +2989,7 @@ void do_4xx_tlbwe_lo (void)
 
 #if defined (DEBUG_SOFTWARE_TLB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s T0 " REGX " T1 " REGX "\n", __func__, T0, T1);
+        fprintf(logfile, "%s T0 " TDX " T1 " TDX "\n", __func__, T0, T1);
     }
 #endif
     T0 &= 0x3F;
@@ -2592,7 +3022,7 @@ void do_440_tlbwe (int word)
 
 #if defined (DEBUG_SOFTWARE_TLB)
     if (loglevel != 0) {
-        fprintf(logfile, "%s word %d T0 " REGX " T1 " REGX "\n",
+        fprintf(logfile, "%s word %d T0 " TDX " T1 " TDX "\n",
                 __func__, word, T0, T1);
     }
 #endif
diff --git a/target-ppc/op_helper.h b/target-ppc/op_helper.h
index 0406682c7..5ec13a420 100644
--- a/target-ppc/op_helper.h
+++ b/target-ppc/op_helper.h
@@ -22,14 +22,13 @@
 
 /* Memory load/store helpers */
 void glue(do_lsw, MEMSUFFIX) (int dst);
-void glue(do_lsw_le, MEMSUFFIX) (int dst);
 void glue(do_stsw, MEMSUFFIX) (int src);
-void glue(do_stsw_le, MEMSUFFIX) (int src);
 void glue(do_lmw, MEMSUFFIX) (int dst);
 void glue(do_lmw_le, MEMSUFFIX) (int dst);
 void glue(do_stmw, MEMSUFFIX) (int src);
 void glue(do_stmw_le, MEMSUFFIX) (int src);
 void glue(do_icbi, MEMSUFFIX) (void);
+void glue(do_dcbz, MEMSUFFIX) (void);
 void glue(do_POWER_lscbx, MEMSUFFIX) (int dest, int ra, int rb);
 void glue(do_POWER2_lfq, MEMSUFFIX) (void);
 void glue(do_POWER2_lfq_le, MEMSUFFIX) (void);
@@ -38,14 +37,13 @@ void glue(do_POWER2_stfq_le, MEMSUFFIX) (void);
 
 #if defined(TARGET_PPC64)
 void glue(do_lsw_64, MEMSUFFIX) (int dst);
-void glue(do_lsw_le_64, MEMSUFFIX) (int dst);
 void glue(do_stsw_64, MEMSUFFIX) (int src);
-void glue(do_stsw_le_64, MEMSUFFIX) (int src);
 void glue(do_lmw_64, MEMSUFFIX) (int dst);
 void glue(do_lmw_le_64, MEMSUFFIX) (int dst);
 void glue(do_stmw_64, MEMSUFFIX) (int src);
 void glue(do_stmw_le_64, MEMSUFFIX) (int src);
 void glue(do_icbi_64, MEMSUFFIX) (void);
+void glue(do_dcbz_64, MEMSUFFIX) (void);
 #endif
 
 #else
@@ -55,12 +53,10 @@ void do_print_mem_EA (target_ulong EA);
 /* Registers load and stores */
 void do_load_cr (void);
 void do_store_cr (uint32_t mask);
-void do_load_xer (void);
-void do_store_xer (void);
 #if defined(TARGET_PPC64)
 void do_store_pri (int prio);
 #endif
-void do_load_fpscr (void);
+void do_fpscr_setbit (int bit);
 void do_store_fpscr (uint32_t mask);
 target_ulong ppc_load_dump_spr (int sprn);
 void ppc_store_dump_spr (int sprn, target_ulong val);
@@ -75,12 +71,14 @@ void do_nego (void);
 void do_subfe (void);
 void do_subfmeo (void);
 void do_subfzeo (void);
+void do_cntlzw (void);
+#if defined(TARGET_PPC64)
+void do_cntlzd (void);
+#endif
 void do_sraw (void);
 #if defined(TARGET_PPC64)
 void do_adde_64 (void);
 void do_addmeo_64 (void);
-void do_imul64 (uint64_t *tl, uint64_t *th);
-void do_mul64 (uint64_t *tl, uint64_t *th);
 void do_divdo (void);
 void do_divduo (void);
 void do_mulldo (void);
@@ -96,6 +94,16 @@ void do_popcntb_64 (void);
 #endif
 
 /* Floating-point arithmetic helpers */
+void do_compute_fprf (int set_class);
+#ifdef CONFIG_SOFTFLOAT
+void do_float_check_status (void);
+#endif
+#if USE_PRECISE_EMULATION
+void do_fadd (void);
+void do_fsub (void);
+void do_fmul (void);
+void do_fdiv (void);
+#endif
 void do_fsqrt (void);
 void do_fre (void);
 void do_fres (void);
@@ -107,6 +115,9 @@ void do_fmsub (void);
 #endif
 void do_fnmadd (void);
 void do_fnmsub (void);
+#if USE_PRECISE_EMULATION
+void do_frsp (void);
+#endif
 void do_fctiw (void);
 void do_fctiwz (void);
 #if defined(TARGET_PPC64)
@@ -127,11 +138,10 @@ void do_tw (int flags);
 void do_td (int flags);
 #endif
 #if !defined(CONFIG_USER_ONLY)
+void do_store_msr (void);
 void do_rfi (void);
 #if defined(TARGET_PPC64)
 void do_rfid (void);
-#endif
-#if defined(TARGET_PPC64H)
 void do_hrfid (void);
 #endif
 void do_load_6xx_tlb (int is_code);
@@ -139,7 +149,6 @@ void do_load_74xx_tlb (int is_code);
 #endif
 
 /* POWER / PowerPC 601 specific helpers */
-void do_store_601_batu (int nr);
 void do_POWER_abso (void);
 void do_POWER_clcs (void);
 void do_POWER_div (void);
@@ -152,6 +161,7 @@ void do_POWER_mulo (void);
 #if !defined(CONFIG_USER_ONLY)
 void do_POWER_rac (void);
 void do_POWER_rfsvc (void);
+void do_store_hid0_601 (void);
 #endif
 
 /* PowerPC 602 specific helper */
@@ -166,7 +176,6 @@ void do_440_tlbwe (int word);
 #endif
 
 /* PowerPC 4xx specific helpers */
-void do_405_check_ov (void);
 void do_405_check_sat (void);
 void do_load_dcr (void);
 void do_store_dcr (void);
@@ -190,7 +199,6 @@ void do_load_403_pb (int num);
 void do_store_403_pb (int num);
 #endif
 
-#if defined(TARGET_PPCEMB)
 /* SPE extension helpers */
 void do_brinc (void);
 /* Fixed-point vector helpers */
@@ -271,96 +279,22 @@ void do_evfsctsi (void);
 void do_evfsctui (void);
 void do_evfsctsiz (void);
 void do_evfsctuiz (void);
-#endif /* defined(TARGET_PPCEMB) */
-
-/* Inlined helpers: used in micro-operation as well as helpers */
-/* Generic fixed-point helpers */
-static inline int _do_cntlzw (uint32_t val)
-{
-    int cnt = 0;
-    if (!(val & 0xFFFF0000UL)) {
-        cnt += 16;
-        val <<= 16;
-    }
-    if (!(val & 0xFF000000UL)) {
-        cnt += 8;
-        val <<= 8;
-    }
-    if (!(val & 0xF0000000UL)) {
-        cnt += 4;
-        val <<= 4;
-    }
-    if (!(val & 0xC0000000UL)) {
-        cnt += 2;
-        val <<= 2;
-    }
-    if (!(val & 0x80000000UL)) {
-        cnt++;
-        val <<= 1;
-    }
-    if (!(val & 0x80000000UL)) {
-        cnt++;
-    }
-    return cnt;
-}
-
-static inline int _do_cntlzd (uint64_t val)
-{
-    int cnt = 0;
-#if HOST_LONG_BITS == 64
-    if (!(val & 0xFFFFFFFF00000000ULL)) {
-        cnt += 32;
-        val <<= 32;
-    }
-    if (!(val & 0xFFFF000000000000ULL)) {
-        cnt += 16;
-        val <<= 16;
-    }
-    if (!(val & 0xFF00000000000000ULL)) {
-        cnt += 8;
-        val <<= 8;
-    }
-    if (!(val & 0xF000000000000000ULL)) {
-        cnt += 4;
-        val <<= 4;
-    }
-    if (!(val & 0xC000000000000000ULL)) {
-        cnt += 2;
-        val <<= 2;
-    }
-    if (!(val & 0x8000000000000000ULL)) {
-        cnt++;
-        val <<= 1;
-    }
-    if (!(val & 0x8000000000000000ULL)) {
-        cnt++;
-    }
-#else
-    /* Make it easier on 32 bits host machines */
-    if (!(val >> 32))
-        cnt = _do_cntlzw(val) + 32;
-    else
-        cnt = _do_cntlzw(val >> 32);
-#endif
-    return cnt;
-}
 
-#if defined(TARGET_PPCEMB)
 /* SPE extension */
 /* Single precision floating-point helpers */
-static inline uint32_t _do_efsabs (uint32_t val)
+static always_inline uint32_t _do_efsabs (uint32_t val)
 {
     return val & ~0x80000000;
 }
-static inline uint32_t _do_efsnabs (uint32_t val)
+static always_inline uint32_t _do_efsnabs (uint32_t val)
 {
     return val | 0x80000000;
 }
-static inline uint32_t _do_efsneg (uint32_t val)
+static always_inline uint32_t _do_efsneg (uint32_t val)
 {
     return val ^ 0x80000000;
 }
-static inline uint32_t _do_efsadd (uint32_t op1, uint32_t op2)
+static always_inline uint32_t _do_efsadd (uint32_t op1, uint32_t op2)
 {
     union {
         uint32_t u;
@@ -371,7 +305,7 @@ static inline uint32_t _do_efsadd (uint32_t op1, uint32_t op2)
     u1.f = float32_add(u1.f, u2.f, &env->spe_status);
     return u1.u;
 }
-static inline uint32_t _do_efssub (uint32_t op1, uint32_t op2)
+static always_inline uint32_t _do_efssub (uint32_t op1, uint32_t op2)
 {
     union {
         uint32_t u;
@@ -382,7 +316,7 @@ static inline uint32_t _do_efssub (uint32_t op1, uint32_t op2)
     u1.f = float32_sub(u1.f, u2.f, &env->spe_status);
     return u1.u;
 }
-static inline uint32_t _do_efsmul (uint32_t op1, uint32_t op2)
+static always_inline uint32_t _do_efsmul (uint32_t op1, uint32_t op2)
 {
     union {
         uint32_t u;
@@ -393,7 +327,7 @@ static inline uint32_t _do_efsmul (uint32_t op1, uint32_t op2)
     u1.f = float32_mul(u1.f, u2.f, &env->spe_status);
     return u1.u;
 }
-static inline uint32_t _do_efsdiv (uint32_t op1, uint32_t op2)
+static always_inline uint32_t _do_efsdiv (uint32_t op1, uint32_t op2)
 {
     union {
         uint32_t u;
@@ -405,7 +339,7 @@ static inline uint32_t _do_efsdiv (uint32_t op1, uint32_t op2)
     return u1.u;
 }
 
-static inline int _do_efststlt (uint32_t op1, uint32_t op2)
+static always_inline int _do_efststlt (uint32_t op1, uint32_t op2)
 {
     union {
         uint32_t u;
@@ -415,7 +349,7 @@ static inline int _do_efststlt (uint32_t op1, uint32_t op2)
     u2.u = op2;
     return float32_lt(u1.f, u2.f, &env->spe_status) ? 1 : 0;
 }
-static inline int _do_efststgt (uint32_t op1, uint32_t op2)
+static always_inline int _do_efststgt (uint32_t op1, uint32_t op2)
 {
     union {
         uint32_t u;
@@ -425,7 +359,7 @@ static inline int _do_efststgt (uint32_t op1, uint32_t op2)
     u2.u = op2;
     return float32_le(u1.f, u2.f, &env->spe_status) ? 0 : 1;
 }
-static inline int _do_efststeq (uint32_t op1, uint32_t op2)
+static always_inline int _do_efststeq (uint32_t op1, uint32_t op2)
 {
     union {
         uint32_t u;
@@ -436,7 +370,7 @@ static inline int _do_efststeq (uint32_t op1, uint32_t op2)
     return float32_eq(u1.f, u2.f, &env->spe_status) ? 1 : 0;
 }
 /* Double precision floating-point helpers */
-static inline int _do_efdtstlt (uint64_t op1, uint64_t op2)
+static always_inline int _do_efdtstlt (uint64_t op1, uint64_t op2)
 {
     union {
         uint64_t u;
@@ -446,7 +380,7 @@ static inline int _do_efdtstlt (uint64_t op1, uint64_t op2)
     u2.u = op2;
     return float64_lt(u1.f, u2.f, &env->spe_status) ? 1 : 0;
 }
-static inline int _do_efdtstgt (uint64_t op1, uint64_t op2)
+static always_inline int _do_efdtstgt (uint64_t op1, uint64_t op2)
 {
     union {
         uint64_t u;
@@ -456,7 +390,7 @@ static inline int _do_efdtstgt (uint64_t op1, uint64_t op2)
     u2.u = op2;
     return float64_le(u1.f, u2.f, &env->spe_status) ? 0 : 1;
 }
-static inline int _do_efdtsteq (uint64_t op1, uint64_t op2)
+static always_inline int _do_efdtsteq (uint64_t op1, uint64_t op2)
 {
     union {
         uint64_t u;
@@ -466,5 +400,4 @@ static inline int _do_efdtsteq (uint64_t op1, uint64_t op2)
     u2.u = op2;
     return float64_eq(u1.f, u2.f, &env->spe_status) ? 1 : 0;
 }
-#endif /* defined(TARGET_PPCEMB) */
 #endif
diff --git a/target-ppc/op_helper_mem.h b/target-ppc/op_helper_mem.h
index e8cca09e9..1d7b991ca 100644
--- a/target-ppc/op_helper_mem.h
+++ b/target-ppc/op_helper_mem.h
@@ -18,26 +18,13 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
-/* Multiple word / string load and store */
-static inline target_ulong glue(ld32r, MEMSUFFIX) (target_ulong EA)
-{
-    uint32_t tmp = glue(ldl, MEMSUFFIX)(EA);
-    return ((tmp & 0xFF000000UL) >> 24) | ((tmp & 0x00FF0000UL) >> 8) |
-        ((tmp & 0x0000FF00UL) << 8) | ((tmp & 0x000000FFUL) << 24);
-}
-
-static inline void glue(st32r, MEMSUFFIX) (target_ulong EA, target_ulong data)
-{
-    uint32_t tmp =
-        ((data & 0xFF000000UL) >> 24) | ((data & 0x00FF0000UL) >> 8) |
-        ((data & 0x0000FF00UL) << 8) | ((data & 0x000000FFUL) << 24);
-    glue(stl, MEMSUFFIX)(EA, tmp);
-}
+#include "op_mem_access.h"
 
+/* Multiple word / string load and store */
 void glue(do_lmw, MEMSUFFIX) (int dst)
 {
     for (; dst < 32; dst++, T0 += 4) {
-        env->gpr[dst] = glue(ldl, MEMSUFFIX)((uint32_t)T0);
+        env->gpr[dst] = glue(ldu32, MEMSUFFIX)((uint32_t)T0);
     }
 }
 
@@ -45,7 +32,7 @@ void glue(do_lmw, MEMSUFFIX) (int dst)
 void glue(do_lmw_64, MEMSUFFIX) (int dst)
 {
     for (; dst < 32; dst++, T0 += 4) {
-        env->gpr[dst] = glue(ldl, MEMSUFFIX)((uint64_t)T0);
+        env->gpr[dst] = glue(ldu32, MEMSUFFIX)((uint64_t)T0);
     }
 }
 #endif
@@ -53,7 +40,7 @@ void glue(do_lmw_64, MEMSUFFIX) (int dst)
 void glue(do_stmw, MEMSUFFIX) (int src)
 {
     for (; src < 32; src++, T0 += 4) {
-        glue(stl, MEMSUFFIX)((uint32_t)T0, env->gpr[src]);
+        glue(st32, MEMSUFFIX)((uint32_t)T0, env->gpr[src]);
     }
 }
 
@@ -61,7 +48,7 @@ void glue(do_stmw, MEMSUFFIX) (int src)
 void glue(do_stmw_64, MEMSUFFIX) (int src)
 {
     for (; src < 32; src++, T0 += 4) {
-        glue(stl, MEMSUFFIX)((uint64_t)T0, env->gpr[src]);
+        glue(st32, MEMSUFFIX)((uint64_t)T0, env->gpr[src]);
     }
 }
 #endif
@@ -69,7 +56,7 @@ void glue(do_stmw_64, MEMSUFFIX) (int src)
 void glue(do_lmw_le, MEMSUFFIX) (int dst)
 {
     for (; dst < 32; dst++, T0 += 4) {
-        env->gpr[dst] = glue(ld32r, MEMSUFFIX)((uint32_t)T0);
+        env->gpr[dst] = glue(ldu32r, MEMSUFFIX)((uint32_t)T0);
     }
 }
 
@@ -77,7 +64,7 @@ void glue(do_lmw_le, MEMSUFFIX) (int dst)
 void glue(do_lmw_le_64, MEMSUFFIX) (int dst)
 {
     for (; dst < 32; dst++, T0 += 4) {
-        env->gpr[dst] = glue(ld32r, MEMSUFFIX)((uint64_t)T0);
+        env->gpr[dst] = glue(ldu32r, MEMSUFFIX)((uint64_t)T0);
     }
 }
 #endif
@@ -104,14 +91,14 @@ void glue(do_lsw, MEMSUFFIX) (int dst)
     int sh;
 
     for (; T1 > 3; T1 -= 4, T0 += 4) {
-        env->gpr[dst++] = glue(ldl, MEMSUFFIX)((uint32_t)T0);
+        env->gpr[dst++] = glue(ldu32, MEMSUFFIX)((uint32_t)T0);
         if (unlikely(dst == 32))
             dst = 0;
     }
     if (unlikely(T1 != 0)) {
         tmp = 0;
         for (sh = 24; T1 > 0; T1--, T0++, sh -= 8) {
-            tmp |= glue(ldub, MEMSUFFIX)((uint32_t)T0) << sh;
+            tmp |= glue(ldu8, MEMSUFFIX)((uint32_t)T0) << sh;
         }
         env->gpr[dst] = tmp;
     }
@@ -124,14 +111,14 @@ void glue(do_lsw_64, MEMSUFFIX) (int dst)
     int sh;
 
     for (; T1 > 3; T1 -= 4, T0 += 4) {
-        env->gpr[dst++] = glue(ldl, MEMSUFFIX)((uint64_t)T0);
+        env->gpr[dst++] = glue(ldu32, MEMSUFFIX)((uint64_t)T0);
         if (unlikely(dst == 32))
             dst = 0;
     }
     if (unlikely(T1 != 0)) {
         tmp = 0;
         for (sh = 24; T1 > 0; T1--, T0++, sh -= 8) {
-            tmp |= glue(ldub, MEMSUFFIX)((uint64_t)T0) << sh;
+            tmp |= glue(ldu8, MEMSUFFIX)((uint64_t)T0) << sh;
         }
         env->gpr[dst] = tmp;
     }
@@ -143,13 +130,13 @@ void glue(do_stsw, MEMSUFFIX) (int src)
     int sh;
 
     for (; T1 > 3; T1 -= 4, T0 += 4) {
-        glue(stl, MEMSUFFIX)((uint32_t)T0, env->gpr[src++]);
+        glue(st32, MEMSUFFIX)((uint32_t)T0, env->gpr[src++]);
         if (unlikely(src == 32))
             src = 0;
     }
     if (unlikely(T1 != 0)) {
         for (sh = 24; T1 > 0; T1--, T0++, sh -= 8)
-            glue(stb, MEMSUFFIX)((uint32_t)T0, (env->gpr[src] >> sh) & 0xFF);
+            glue(st8, MEMSUFFIX)((uint32_t)T0, (env->gpr[src] >> sh) & 0xFF);
     }
 }
 
@@ -159,85 +146,13 @@ void glue(do_stsw_64, MEMSUFFIX) (int src)
     int sh;
 
     for (; T1 > 3; T1 -= 4, T0 += 4) {
-        glue(stl, MEMSUFFIX)((uint64_t)T0, env->gpr[src++]);
+        glue(st32, MEMSUFFIX)((uint64_t)T0, env->gpr[src++]);
         if (unlikely(src == 32))
             src = 0;
     }
     if (unlikely(T1 != 0)) {
         for (sh = 24; T1 > 0; T1--, T0++, sh -= 8)
-            glue(stb, MEMSUFFIX)((uint64_t)T0, (env->gpr[src] >> sh) & 0xFF);
-    }
-}
-#endif
-
-void glue(do_lsw_le, MEMSUFFIX) (int dst)
-{
-    uint32_t tmp;
-    int sh;
-
-    for (; T1 > 3; T1 -= 4, T0 += 4) {
-        env->gpr[dst++] = glue(ld32r, MEMSUFFIX)((uint32_t)T0);
-        if (unlikely(dst == 32))
-            dst = 0;
-    }
-    if (unlikely(T1 != 0)) {
-        tmp = 0;
-        for (sh = 0; T1 > 0; T1--, T0++, sh += 8) {
-            tmp |= glue(ldub, MEMSUFFIX)((uint32_t)T0) << sh;
-        }
-        env->gpr[dst] = tmp;
-    }
-}
-
-#if defined(TARGET_PPC64)
-void glue(do_lsw_le_64, MEMSUFFIX) (int dst)
-{
-    uint32_t tmp;
-    int sh;
-
-    for (; T1 > 3; T1 -= 4, T0 += 4) {
-        env->gpr[dst++] = glue(ld32r, MEMSUFFIX)((uint64_t)T0);
-        if (unlikely(dst == 32))
-            dst = 0;
-    }
-    if (unlikely(T1 != 0)) {
-        tmp = 0;
-        for (sh = 0; T1 > 0; T1--, T0++, sh += 8) {
-            tmp |= glue(ldub, MEMSUFFIX)((uint64_t)T0) << sh;
-        }
-        env->gpr[dst] = tmp;
-    }
-}
-#endif
-
-void glue(do_stsw_le, MEMSUFFIX) (int src)
-{
-    int sh;
-
-    for (; T1 > 3; T1 -= 4, T0 += 4) {
-        glue(st32r, MEMSUFFIX)((uint32_t)T0, env->gpr[src++]);
-        if (unlikely(src == 32))
-            src = 0;
-    }
-    if (unlikely(T1 != 0)) {
-        for (sh = 0; T1 > 0; T1--, T0++, sh += 8)
-            glue(stb, MEMSUFFIX)((uint32_t)T0, (env->gpr[src] >> sh) & 0xFF);
-    }
-}
-
-#if defined(TARGET_PPC64)
-void glue(do_stsw_le_64, MEMSUFFIX) (int src)
-{
-    int sh;
-
-    for (; T1 > 3; T1 -= 4, T0 += 4) {
-        glue(st32r, MEMSUFFIX)((uint64_t)T0, env->gpr[src++]);
-        if (unlikely(src == 32))
-            src = 0;
-    }
-    if (unlikely(T1 != 0)) {
-        for (sh = 0; T1 > 0; T1--, T0++, sh += 8)
-            glue(stb, MEMSUFFIX)((uint64_t)T0, (env->gpr[src] >> sh) & 0xFF);
+            glue(st8, MEMSUFFIX)((uint64_t)T0, (env->gpr[src] >> sh) & 0xFF);
     }
 }
 #endif
@@ -251,9 +166,10 @@ void glue(do_icbi, MEMSUFFIX) (void)
      * (not a fetch) by the MMU. To be sure it will be so,
      * do the load "by hand".
      */
+    T0 &= ~(env->icache_line_size - 1);
     tmp = glue(ldl, MEMSUFFIX)((uint32_t)T0);
-    T0 &= ~(ICACHE_LINE_SIZE - 1);
-    tb_invalidate_page_range((uint32_t)T0, (uint32_t)(T0 + ICACHE_LINE_SIZE));
+    tb_invalidate_page_range((uint32_t)T0,
+                             (uint32_t)(T0 + env->icache_line_size));
 }
 
 #if defined(TARGET_PPC64)
@@ -265,9 +181,104 @@ void glue(do_icbi_64, MEMSUFFIX) (void)
      * (not a fetch) by the MMU. To be sure it will be so,
      * do the load "by hand".
      */
+    T0 &= ~(env->icache_line_size - 1);
     tmp = glue(ldq, MEMSUFFIX)((uint64_t)T0);
-    T0 &= ~(ICACHE_LINE_SIZE - 1);
-    tb_invalidate_page_range((uint64_t)T0, (uint64_t)(T0 + ICACHE_LINE_SIZE));
+    tb_invalidate_page_range((uint64_t)T0,
+                             (uint64_t)(T0 + env->icache_line_size));
+}
+#endif
+
+void glue(do_dcbz, MEMSUFFIX) (void)
+{
+    int dcache_line_size = env->dcache_line_size;
+
+    /* XXX: should be 970 specific (?) */
+    if (((env->spr[SPR_970_HID5] >> 7) & 0x3) == 1)
+        dcache_line_size = 32;
+    T0 &= ~(uint32_t)(dcache_line_size - 1);
+    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x00), 0);
+    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x04), 0);
+    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x08), 0);
+    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x0C), 0);
+    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x10), 0);
+    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x14), 0);
+    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x18), 0);
+    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x1C), 0);
+    if (dcache_line_size >= 64) {
+        glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x20UL), 0);
+        glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x24UL), 0);
+        glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x28UL), 0);
+        glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x2CUL), 0);
+        glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x30UL), 0);
+        glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x34UL), 0);
+        glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x38UL), 0);
+        glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x3CUL), 0);
+        if (dcache_line_size >= 128) {
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x40UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x44UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x48UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x4CUL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x50UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x54UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x58UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x5CUL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x60UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x64UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x68UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x6CUL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x70UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x74UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x78UL), 0);
+            glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x7CUL), 0);
+        }
+    }
+}
+
+#if defined(TARGET_PPC64)
+void glue(do_dcbz_64, MEMSUFFIX) (void)
+{
+    int dcache_line_size = env->dcache_line_size;
+
+    /* XXX: should be 970 specific (?) */
+    if (((env->spr[SPR_970_HID5] >> 6) & 0x3) == 0x2)
+        dcache_line_size = 32;
+    T0 &= ~(uint64_t)(dcache_line_size - 1);
+    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x00), 0);
+    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x04), 0);
+    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x08), 0);
+    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x0C), 0);
+    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x10), 0);
+    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x14), 0);
+    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x18), 0);
+    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x1C), 0);
+    if (dcache_line_size >= 64) {
+        glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x20UL), 0);
+        glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x24UL), 0);
+        glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x28UL), 0);
+        glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x2CUL), 0);
+        glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x30UL), 0);
+        glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x34UL), 0);
+        glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x38UL), 0);
+        glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x3CUL), 0);
+        if (dcache_line_size >= 128) {
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x40UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x44UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x48UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x4CUL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x50UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x54UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x58UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x5CUL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x60UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x64UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x68UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x6CUL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x70UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x74UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x78UL), 0);
+            glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x7CUL), 0);
+        }
+    }
 }
 #endif
 
@@ -280,7 +291,7 @@ void glue(do_POWER_lscbx, MEMSUFFIX) (int dest, int ra, int rb)
     d = 24;
     reg = dest;
     for (i = 0; i < T1; i++) {
-        c = glue(ldub, MEMSUFFIX)((uint32_t)T0++);
+        c = glue(ldu8, MEMSUFFIX)((uint32_t)T0++);
         /* ra (if not 0) and rb are never modified */
         if (likely(reg != rb && (ra == 0 || reg != ra))) {
             env->gpr[reg] = (env->gpr[reg] & ~(0xFF << d)) | (c << d);
@@ -305,7 +316,7 @@ void glue(do_POWER2_lfq, MEMSUFFIX) (void)
     FT1 = glue(ldfq, MEMSUFFIX)((uint32_t)(T0 + 4));
 }
 
-static inline double glue(ldfqr, MEMSUFFIX) (target_ulong EA)
+static always_inline double glue(ldfqr, MEMSUFFIX) (target_ulong EA)
 {
     union {
         double d;
@@ -313,14 +324,7 @@ static inline double glue(ldfqr, MEMSUFFIX) (target_ulong EA)
     } u;
 
     u.d = glue(ldfq, MEMSUFFIX)(EA);
-    u.u = ((u.u & 0xFF00000000000000ULL) >> 56) |
-        ((u.u & 0x00FF000000000000ULL) >> 40) |
-        ((u.u & 0x0000FF0000000000ULL) >> 24) |
-        ((u.u & 0x000000FF00000000ULL) >> 8) |
-        ((u.u & 0x00000000FF000000ULL) << 8) |
-        ((u.u & 0x0000000000FF0000ULL) << 24) |
-        ((u.u & 0x000000000000FF00ULL) << 40) |
-        ((u.u & 0x00000000000000FFULL) << 56);
+    u.u = bswap64(u.u);
 
     return u.d;
 }
@@ -337,7 +341,7 @@ void glue(do_POWER2_stfq, MEMSUFFIX) (void)
     glue(stfq, MEMSUFFIX)((uint32_t)(T0 + 4), FT1);
 }
 
-static inline void glue(stfqr, MEMSUFFIX) (target_ulong EA, double d)
+static always_inline void glue(stfqr, MEMSUFFIX) (target_ulong EA, double d)
 {
     union {
         double d;
@@ -345,14 +349,7 @@ static inline void glue(stfqr, MEMSUFFIX) (target_ulong EA, double d)
     } u;
 
     u.d = d;
-    u.u = ((u.u & 0xFF00000000000000ULL) >> 56) |
-        ((u.u & 0x00FF000000000000ULL) >> 40) |
-        ((u.u & 0x0000FF0000000000ULL) >> 24) |
-        ((u.u & 0x000000FF00000000ULL) >> 8) |
-        ((u.u & 0x00000000FF000000ULL) << 8) |
-        ((u.u & 0x0000000000FF0000ULL) << 24) |
-        ((u.u & 0x000000000000FF00ULL) << 40) |
-        ((u.u & 0x00000000000000FFULL) << 56);
+    u.u = bswap64(u.u);
     glue(stfq, MEMSUFFIX)(EA, u.d);
 }
 
diff --git a/target-ppc/op_mem.h b/target-ppc/op_mem.h
index 71dfb1e34..16dd4ceeb 100644
--- a/target-ppc/op_mem.h
+++ b/target-ppc/op_mem.h
@@ -18,81 +18,7 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
-static inline uint16_t glue(ld16r, MEMSUFFIX) (target_ulong EA)
-{
-    uint16_t tmp = glue(lduw, MEMSUFFIX)(EA);
-    return ((tmp & 0xFF00) >> 8) | ((tmp & 0x00FF) << 8);
-}
-
-static inline int32_t glue(ld16rs, MEMSUFFIX) (target_ulong EA)
-{
-    int16_t tmp = glue(lduw, MEMSUFFIX)(EA);
-    return (int16_t)((tmp & 0xFF00) >> 8) | ((tmp & 0x00FF) << 8);
-}
-
-static inline uint32_t glue(ld32r, MEMSUFFIX) (target_ulong EA)
-{
-    uint32_t tmp = glue(ldl, MEMSUFFIX)(EA);
-    return ((tmp & 0xFF000000) >> 24) | ((tmp & 0x00FF0000) >> 8) |
-        ((tmp & 0x0000FF00) << 8) | ((tmp & 0x000000FF) << 24);
-}
-
-#if defined(TARGET_PPC64) || defined(TARGET_PPCEMB)
-static inline uint64_t glue(ld64r, MEMSUFFIX) (target_ulong EA)
-{
-    uint64_t tmp = glue(ldq, MEMSUFFIX)(EA);
-    return ((tmp & 0xFF00000000000000ULL) >> 56) |
-        ((tmp & 0x00FF000000000000ULL) >> 40) |
-        ((tmp & 0x0000FF0000000000ULL) >> 24) |
-        ((tmp & 0x000000FF00000000ULL) >> 8) |
-        ((tmp & 0x00000000FF000000ULL) << 8) |
-        ((tmp & 0x0000000000FF0000ULL) << 24) |
-        ((tmp & 0x000000000000FF00ULL) << 40) |
-        ((tmp & 0x00000000000000FFULL) << 54);
-}
-#endif
-
-#if defined(TARGET_PPC64)
-static inline int64_t glue(ldsl, MEMSUFFIX) (target_ulong EA)
-{
-    return (int32_t)glue(ldl, MEMSUFFIX)(EA);
-}
-
-static inline int64_t glue(ld32rs, MEMSUFFIX) (target_ulong EA)
-{
-    uint32_t tmp = glue(ldl, MEMSUFFIX)(EA);
-    return (int32_t)((tmp & 0xFF000000) >> 24) | ((tmp & 0x00FF0000) >> 8) |
-        ((tmp & 0x0000FF00) << 8) | ((tmp & 0x000000FF) << 24);
-}
-#endif
-
-static inline void glue(st16r, MEMSUFFIX) (target_ulong EA, uint16_t data)
-{
-    uint16_t tmp = ((data & 0xFF00) >> 8) | ((data & 0x00FF) << 8);
-    glue(stw, MEMSUFFIX)(EA, tmp);
-}
-
-static inline void glue(st32r, MEMSUFFIX) (target_ulong EA, uint32_t data)
-{
-    uint32_t tmp = ((data & 0xFF000000) >> 24) | ((data & 0x00FF0000) >> 8) |
-        ((data & 0x0000FF00) << 8) | ((data & 0x000000FF) << 24);
-    glue(stl, MEMSUFFIX)(EA, tmp);
-}
-
-#if defined(TARGET_PPC64) || defined(TARGET_PPCEMB)
-static inline void glue(st64r, MEMSUFFIX) (target_ulong EA, uint64_t data)
-{
-    uint64_t tmp = ((data & 0xFF00000000000000ULL) >> 56) |
-        ((data & 0x00FF000000000000ULL) >> 40) |
-        ((data & 0x0000FF0000000000ULL) >> 24) |
-        ((data & 0x000000FF00000000ULL) >> 8) |
-        ((data & 0x00000000FF000000ULL) << 8) |
-        ((data & 0x0000000000FF0000ULL) << 24) |
-        ((data & 0x000000000000FF00ULL) << 40) |
-        ((data & 0x00000000000000FFULL) << 56);
-    glue(stq, MEMSUFFIX)(EA, tmp);
-}
-#endif
+#include "op_mem_access.h"
 
 /***                             Integer load                              ***/
 #define PPC_LD_OP(name, op)                                                   \
@@ -127,76 +53,76 @@ void OPPROTO glue(glue(glue(op_st, name), _64), MEMSUFFIX) (void)             \
 }
 #endif
 
-PPC_LD_OP(bz, ldub);
-PPC_LD_OP(ha, ldsw);
-PPC_LD_OP(hz, lduw);
-PPC_LD_OP(wz, ldl);
+PPC_LD_OP(bz, ldu8);
+PPC_LD_OP(ha, lds16);
+PPC_LD_OP(hz, ldu16);
+PPC_LD_OP(wz, ldu32);
 #if defined(TARGET_PPC64)
-PPC_LD_OP(d, ldq);
-PPC_LD_OP(wa, ldsl);
-PPC_LD_OP_64(d, ldq);
-PPC_LD_OP_64(wa, ldsl);
-PPC_LD_OP_64(bz, ldub);
-PPC_LD_OP_64(ha, ldsw);
-PPC_LD_OP_64(hz, lduw);
-PPC_LD_OP_64(wz, ldl);
+PPC_LD_OP(wa, lds32);
+PPC_LD_OP(d, ldu64);
+PPC_LD_OP_64(bz, ldu8);
+PPC_LD_OP_64(ha, lds16);
+PPC_LD_OP_64(hz, ldu16);
+PPC_LD_OP_64(wz, ldu32);
+PPC_LD_OP_64(wa, lds32);
+PPC_LD_OP_64(d, ldu64);
 #endif
 
-PPC_LD_OP(ha_le, ld16rs);
-PPC_LD_OP(hz_le, ld16r);
-PPC_LD_OP(wz_le, ld32r);
+PPC_LD_OP(ha_le, lds16r);
+PPC_LD_OP(hz_le, ldu16r);
+PPC_LD_OP(wz_le, ldu32r);
 #if defined(TARGET_PPC64)
-PPC_LD_OP(d_le, ld64r);
-PPC_LD_OP(wa_le, ld32rs);
-PPC_LD_OP_64(d_le, ld64r);
-PPC_LD_OP_64(wa_le, ld32rs);
-PPC_LD_OP_64(ha_le, ld16rs);
-PPC_LD_OP_64(hz_le, ld16r);
-PPC_LD_OP_64(wz_le, ld32r);
+PPC_LD_OP(wa_le, lds32r);
+PPC_LD_OP(d_le, ldu64r);
+PPC_LD_OP_64(ha_le, lds16r);
+PPC_LD_OP_64(hz_le, ldu16r);
+PPC_LD_OP_64(wz_le, ldu32r);
+PPC_LD_OP_64(wa_le, lds32r);
+PPC_LD_OP_64(d_le, ldu64r);
 #endif
 
 /***                              Integer store                            ***/
-PPC_ST_OP(b, stb);
-PPC_ST_OP(h, stw);
-PPC_ST_OP(w, stl);
+PPC_ST_OP(b, st8);
+PPC_ST_OP(h, st16);
+PPC_ST_OP(w, st32);
 #if defined(TARGET_PPC64)
-PPC_ST_OP(d, stq);
-PPC_ST_OP_64(d, stq);
-PPC_ST_OP_64(b, stb);
-PPC_ST_OP_64(h, stw);
-PPC_ST_OP_64(w, stl);
+PPC_ST_OP(d, st64);
+PPC_ST_OP_64(b, st8);
+PPC_ST_OP_64(h, st16);
+PPC_ST_OP_64(w, st32);
+PPC_ST_OP_64(d, st64);
 #endif
 
 PPC_ST_OP(h_le, st16r);
 PPC_ST_OP(w_le, st32r);
 #if defined(TARGET_PPC64)
 PPC_ST_OP(d_le, st64r);
-PPC_ST_OP_64(d_le, st64r);
 PPC_ST_OP_64(h_le, st16r);
 PPC_ST_OP_64(w_le, st32r);
+PPC_ST_OP_64(d_le, st64r);
 #endif
 
 /***                Integer load and store with byte reverse               ***/
-PPC_LD_OP(hbr, ld16r);
-PPC_LD_OP(wbr, ld32r);
+PPC_LD_OP(hbr, ldu16r);
+PPC_LD_OP(wbr, ldu32r);
 PPC_ST_OP(hbr, st16r);
 PPC_ST_OP(wbr, st32r);
 #if defined(TARGET_PPC64)
-PPC_LD_OP_64(hbr, ld16r);
-PPC_LD_OP_64(wbr, ld32r);
+PPC_LD_OP_64(hbr, ldu16r);
+PPC_LD_OP_64(wbr, ldu32r);
 PPC_ST_OP_64(hbr, st16r);
 PPC_ST_OP_64(wbr, st32r);
 #endif
 
-PPC_LD_OP(hbr_le, lduw);
-PPC_LD_OP(wbr_le, ldl);
-PPC_ST_OP(hbr_le, stw);
-PPC_ST_OP(wbr_le, stl);
+PPC_LD_OP(hbr_le, ldu16);
+PPC_LD_OP(wbr_le, ldu32);
+PPC_ST_OP(hbr_le, st16);
+PPC_ST_OP(wbr_le, st32);
 #if defined(TARGET_PPC64)
-PPC_LD_OP_64(hbr_le, lduw);
-PPC_LD_OP_64(wbr_le, ldl);
-PPC_ST_OP_64(hbr_le, stw);
-PPC_ST_OP_64(wbr_le, stl);
+PPC_LD_OP_64(hbr_le, ldu16);
+PPC_LD_OP_64(wbr_le, ldu32);
+PPC_ST_OP_64(hbr_le, st16);
+PPC_ST_OP_64(wbr_le, st32);
 #endif
 
 /***                    Integer load and store multiple                    ***/
@@ -271,20 +197,6 @@ void OPPROTO glue(op_lswi_64, MEMSUFFIX) (void)
 }
 #endif
 
-void OPPROTO glue(op_lswi_le, MEMSUFFIX) (void)
-{
-    glue(do_lsw_le, MEMSUFFIX)(PARAM1);
-    RETURN();
-}
-
-#if defined(TARGET_PPC64)
-void OPPROTO glue(op_lswi_le_64, MEMSUFFIX) (void)
-{
-    glue(do_lsw_le_64, MEMSUFFIX)(PARAM1);
-    RETURN();
-}
-#endif
-
 /* PPC32 specification says we must generate an exception if
  * rA is in the range of registers to be loaded.
  * In an other hand, IBM says this is valid, but rA won't be loaded.
@@ -324,40 +236,6 @@ void OPPROTO glue(op_lswx_64, MEMSUFFIX) (void)
 }
 #endif
 
-void OPPROTO glue(op_lswx_le, MEMSUFFIX) (void)
-{
-    /* Note: T1 comes from xer_bc then no cast is needed */
-    if (likely(T1 != 0)) {
-        if (unlikely((PARAM1 < PARAM2 && (PARAM1 + T1) > PARAM2) ||
-                     (PARAM1 < PARAM3 && (PARAM1 + T1) > PARAM3))) {
-            do_raise_exception_err(POWERPC_EXCP_PROGRAM,
-                                   POWERPC_EXCP_INVAL |
-                                   POWERPC_EXCP_INVAL_LSWX);
-        } else {
-            glue(do_lsw_le, MEMSUFFIX)(PARAM1);
-        }
-    }
-    RETURN();
-}
-
-#if defined(TARGET_PPC64)
-void OPPROTO glue(op_lswx_le_64, MEMSUFFIX) (void)
-{
-    /* Note: T1 comes from xer_bc then no cast is needed */
-    if (likely(T1 != 0)) {
-        if (unlikely((PARAM1 < PARAM2 && (PARAM1 + T1) > PARAM2) ||
-                     (PARAM1 < PARAM3 && (PARAM1 + T1) > PARAM3))) {
-            do_raise_exception_err(POWERPC_EXCP_PROGRAM,
-                                   POWERPC_EXCP_INVAL |
-                                   POWERPC_EXCP_INVAL_LSWX);
-        } else {
-            glue(do_lsw_le_64, MEMSUFFIX)(PARAM1);
-        }
-    }
-    RETURN();
-}
-#endif
-
 void OPPROTO glue(op_stsw, MEMSUFFIX) (void)
 {
     glue(do_stsw, MEMSUFFIX)(PARAM1);
@@ -372,20 +250,6 @@ void OPPROTO glue(op_stsw_64, MEMSUFFIX) (void)
 }
 #endif
 
-void OPPROTO glue(op_stsw_le, MEMSUFFIX) (void)
-{
-    glue(do_stsw_le, MEMSUFFIX)(PARAM1);
-    RETURN();
-}
-
-#if defined(TARGET_PPC64)
-void OPPROTO glue(op_stsw_le_64, MEMSUFFIX) (void)
-{
-    glue(do_stsw_le_64, MEMSUFFIX)(PARAM1);
-    RETURN();
-}
-#endif
-
 /***                         Floating-point store                          ***/
 #define PPC_STF_OP(name, op)                                                  \
 void OPPROTO glue(glue(op_st, name), MEMSUFFIX) (void)                        \
@@ -403,33 +267,42 @@ void OPPROTO glue(glue(glue(op_st, name), _64), MEMSUFFIX) (void)             \
 }
 #endif
 
-static inline void glue(stfs, MEMSUFFIX) (target_ulong EA, double d)
+static always_inline void glue(stfs, MEMSUFFIX) (target_ulong EA, double d)
 {
     glue(stfl, MEMSUFFIX)(EA, float64_to_float32(d, &env->fp_status));
 }
 
-static inline void glue(stfiwx, MEMSUFFIX) (target_ulong EA, double d)
+#if defined(WORDS_BIGENDIAN)
+#define WORD0 0
+#define WORD1 1
+#else
+#define WORD0 1
+#define WORD1 0
+#endif
+static always_inline void glue(stfiw, MEMSUFFIX) (target_ulong EA, double d)
 {
     union {
         double d;
-        uint64_t u;
+        uint32_t u[2];
     } u;
 
     /* Store the low order 32 bits without any conversion */
     u.d = d;
-    glue(stl, MEMSUFFIX)(EA, u.u);
+    glue(st32, MEMSUFFIX)(EA, u.u[WORD0]);
 }
+#undef WORD0
+#undef WORD1
 
 PPC_STF_OP(fd, stfq);
 PPC_STF_OP(fs, stfs);
-PPC_STF_OP(fiwx, stfiwx);
+PPC_STF_OP(fiw, stfiw);
 #if defined(TARGET_PPC64)
 PPC_STF_OP_64(fd, stfq);
 PPC_STF_OP_64(fs, stfs);
-PPC_STF_OP_64(fiwx, stfiwx);
+PPC_STF_OP_64(fiw, stfiw);
 #endif
 
-static inline void glue(stfqr, MEMSUFFIX) (target_ulong EA, double d)
+static always_inline void glue(stfqr, MEMSUFFIX) (target_ulong EA, double d)
 {
     union {
         double d;
@@ -437,18 +310,11 @@ static inline void glue(stfqr, MEMSUFFIX) (target_ulong EA, double d)
     } u;
 
     u.d = d;
-    u.u = ((u.u & 0xFF00000000000000ULL) >> 56) |
-        ((u.u & 0x00FF000000000000ULL) >> 40) |
-        ((u.u & 0x0000FF0000000000ULL) >> 24) |
-        ((u.u & 0x000000FF00000000ULL) >> 8) |
-        ((u.u & 0x00000000FF000000ULL) << 8) |
-        ((u.u & 0x0000000000FF0000ULL) << 24) |
-        ((u.u & 0x000000000000FF00ULL) << 40) |
-        ((u.u & 0x00000000000000FFULL) << 56);
+    u.u = bswap64(u.u);
     glue(stfq, MEMSUFFIX)(EA, u.d);
 }
 
-static inline void glue(stfsr, MEMSUFFIX) (target_ulong EA, double d)
+static always_inline void glue(stfsr, MEMSUFFIX) (target_ulong EA, double d)
 {
     union {
         float f;
@@ -456,14 +322,11 @@ static inline void glue(stfsr, MEMSUFFIX) (target_ulong EA, double d)
     } u;
 
     u.f = float64_to_float32(d, &env->fp_status);
-    u.u = ((u.u & 0xFF000000UL) >> 24) |
-        ((u.u & 0x00FF0000ULL) >> 8) |
-        ((u.u & 0x0000FF00UL) << 8) |
-        ((u.u & 0x000000FFULL) << 24);
+    u.u = bswap32(u.u);
     glue(stfl, MEMSUFFIX)(EA, u.f);
 }
 
-static inline void glue(stfiwxr, MEMSUFFIX) (target_ulong EA, double d)
+static always_inline void glue(stfiwr, MEMSUFFIX) (target_ulong EA, double d)
 {
     union {
         double d;
@@ -472,21 +335,17 @@ static inline void glue(stfiwxr, MEMSUFFIX) (target_ulong EA, double d)
 
     /* Store the low order 32 bits without any conversion */
     u.d = d;
-    u.u = ((u.u & 0xFF000000UL) >> 24) |
-        ((u.u & 0x00FF0000ULL) >> 8) |
-        ((u.u & 0x0000FF00UL) << 8) |
-        ((u.u & 0x000000FFULL) << 24);
-    glue(stl, MEMSUFFIX)(EA, u.u);
+    u.u = bswap32(u.u);
+    glue(st32, MEMSUFFIX)(EA, u.u);
 }
 
-
 PPC_STF_OP(fd_le, stfqr);
 PPC_STF_OP(fs_le, stfsr);
-PPC_STF_OP(fiwx_le, stfiwxr);
+PPC_STF_OP(fiw_le, stfiwr);
 #if defined(TARGET_PPC64)
 PPC_STF_OP_64(fd_le, stfqr);
 PPC_STF_OP_64(fs_le, stfsr);
-PPC_STF_OP_64(fiwx_le, stfiwxr);
+PPC_STF_OP_64(fiw_le, stfiwr);
 #endif
 
 /***                         Floating-point load                           ***/
@@ -506,7 +365,7 @@ void OPPROTO glue(glue(glue(op_l, name), _64), MEMSUFFIX) (void)              \
 }
 #endif
 
-static inline double glue(ldfs, MEMSUFFIX) (target_ulong EA)
+static always_inline double glue(ldfs, MEMSUFFIX) (target_ulong EA)
 {
     return float32_to_float64(glue(ldfl, MEMSUFFIX)(EA), &env->fp_status);
 }
@@ -518,7 +377,7 @@ PPC_LDF_OP_64(fd, ldfq);
 PPC_LDF_OP_64(fs, ldfs);
 #endif
 
-static inline double glue(ldfqr, MEMSUFFIX) (target_ulong EA)
+static always_inline double glue(ldfqr, MEMSUFFIX) (target_ulong EA)
 {
     union {
         double d;
@@ -526,19 +385,12 @@ static inline double glue(ldfqr, MEMSUFFIX) (target_ulong EA)
     } u;
 
     u.d = glue(ldfq, MEMSUFFIX)(EA);
-    u.u = ((u.u & 0xFF00000000000000ULL) >> 56) |
-        ((u.u & 0x00FF000000000000ULL) >> 40) |
-        ((u.u & 0x0000FF0000000000ULL) >> 24) |
-        ((u.u & 0x000000FF00000000ULL) >> 8) |
-        ((u.u & 0x00000000FF000000ULL) << 8) |
-        ((u.u & 0x0000000000FF0000ULL) << 24) |
-        ((u.u & 0x000000000000FF00ULL) << 40) |
-        ((u.u & 0x00000000000000FFULL) << 56);
+    u.u = bswap64(u.u);
 
     return u.d;
 }
 
-static inline double glue(ldfsr, MEMSUFFIX) (target_ulong EA)
+static always_inline double glue(ldfsr, MEMSUFFIX) (target_ulong EA)
 {
     union {
         float f;
@@ -546,10 +398,7 @@ static inline double glue(ldfsr, MEMSUFFIX) (target_ulong EA)
     } u;
 
     u.f = glue(ldfl, MEMSUFFIX)(EA);
-    u.u = ((u.u & 0xFF000000UL) >> 24) |
-        ((u.u & 0x00FF0000ULL) >> 8) |
-        ((u.u & 0x0000FF00UL) << 8) |
-        ((u.u & 0x000000FFULL) << 24);
+    u.u = bswap32(u.u);
 
     return float32_to_float64(u.f, &env->fp_status);
 }
@@ -567,7 +416,7 @@ void OPPROTO glue(op_lwarx, MEMSUFFIX) (void)
     if (unlikely(T0 & 0x03)) {
         do_raise_exception(POWERPC_EXCP_ALIGN);
     } else {
-        T1 = glue(ldl, MEMSUFFIX)((uint32_t)T0);
+        T1 = glue(ldu32, MEMSUFFIX)((uint32_t)T0);
         env->reserve = (uint32_t)T0;
     }
     RETURN();
@@ -579,7 +428,7 @@ void OPPROTO glue(op_lwarx_64, MEMSUFFIX) (void)
     if (unlikely(T0 & 0x03)) {
         do_raise_exception(POWERPC_EXCP_ALIGN);
     } else {
-        T1 = glue(ldl, MEMSUFFIX)((uint64_t)T0);
+        T1 = glue(ldu32, MEMSUFFIX)((uint64_t)T0);
         env->reserve = (uint64_t)T0;
     }
     RETURN();
@@ -590,7 +439,7 @@ void OPPROTO glue(op_ldarx, MEMSUFFIX) (void)
     if (unlikely(T0 & 0x03)) {
         do_raise_exception(POWERPC_EXCP_ALIGN);
     } else {
-        T1 = glue(ldq, MEMSUFFIX)((uint32_t)T0);
+        T1 = glue(ldu64, MEMSUFFIX)((uint32_t)T0);
         env->reserve = (uint32_t)T0;
     }
     RETURN();
@@ -601,7 +450,7 @@ void OPPROTO glue(op_ldarx_64, MEMSUFFIX) (void)
     if (unlikely(T0 & 0x03)) {
         do_raise_exception(POWERPC_EXCP_ALIGN);
     } else {
-        T1 = glue(ldq, MEMSUFFIX)((uint64_t)T0);
+        T1 = glue(ldu64, MEMSUFFIX)((uint64_t)T0);
         env->reserve = (uint64_t)T0;
     }
     RETURN();
@@ -613,7 +462,7 @@ void OPPROTO glue(op_lwarx_le, MEMSUFFIX) (void)
     if (unlikely(T0 & 0x03)) {
         do_raise_exception(POWERPC_EXCP_ALIGN);
     } else {
-        T1 = glue(ld32r, MEMSUFFIX)((uint32_t)T0);
+        T1 = glue(ldu32r, MEMSUFFIX)((uint32_t)T0);
         env->reserve = (uint32_t)T0;
     }
     RETURN();
@@ -625,7 +474,7 @@ void OPPROTO glue(op_lwarx_le_64, MEMSUFFIX) (void)
     if (unlikely(T0 & 0x03)) {
         do_raise_exception(POWERPC_EXCP_ALIGN);
     } else {
-        T1 = glue(ld32r, MEMSUFFIX)((uint64_t)T0);
+        T1 = glue(ldu32r, MEMSUFFIX)((uint64_t)T0);
         env->reserve = (uint64_t)T0;
     }
     RETURN();
@@ -636,7 +485,7 @@ void OPPROTO glue(op_ldarx_le, MEMSUFFIX) (void)
     if (unlikely(T0 & 0x03)) {
         do_raise_exception(POWERPC_EXCP_ALIGN);
     } else {
-        T1 = glue(ld64r, MEMSUFFIX)((uint32_t)T0);
+        T1 = glue(ldu64r, MEMSUFFIX)((uint32_t)T0);
         env->reserve = (uint32_t)T0;
     }
     RETURN();
@@ -647,7 +496,7 @@ void OPPROTO glue(op_ldarx_le_64, MEMSUFFIX) (void)
     if (unlikely(T0 & 0x03)) {
         do_raise_exception(POWERPC_EXCP_ALIGN);
     } else {
-        T1 = glue(ld64r, MEMSUFFIX)((uint64_t)T0);
+        T1 = glue(ldu64r, MEMSUFFIX)((uint64_t)T0);
         env->reserve = (uint64_t)T0;
     }
     RETURN();
@@ -663,11 +512,11 @@ void OPPROTO glue(op_stwcx, MEMSUFFIX) (void)
         if (unlikely(env->reserve != (uint32_t)T0)) {
             env->crf[0] = xer_so;
         } else {
-            glue(stl, MEMSUFFIX)((uint32_t)T0, T1);
+            glue(st32, MEMSUFFIX)((uint32_t)T0, T1);
             env->crf[0] = xer_so | 0x02;
         }
     }
-    env->reserve = -1;
+    env->reserve = (target_ulong)-1ULL;
     RETURN();
 }
 
@@ -680,11 +529,11 @@ void OPPROTO glue(op_stwcx_64, MEMSUFFIX) (void)
         if (unlikely(env->reserve != (uint64_t)T0)) {
             env->crf[0] = xer_so;
         } else {
-            glue(stl, MEMSUFFIX)((uint64_t)T0, T1);
+            glue(st32, MEMSUFFIX)((uint64_t)T0, T1);
             env->crf[0] = xer_so | 0x02;
         }
     }
-    env->reserve = -1;
+    env->reserve = (target_ulong)-1ULL;
     RETURN();
 }
 
@@ -696,11 +545,11 @@ void OPPROTO glue(op_stdcx, MEMSUFFIX) (void)
         if (unlikely(env->reserve != (uint32_t)T0)) {
             env->crf[0] = xer_so;
         } else {
-            glue(stq, MEMSUFFIX)((uint32_t)T0, T1);
+            glue(st64, MEMSUFFIX)((uint32_t)T0, T1);
             env->crf[0] = xer_so | 0x02;
         }
     }
-    env->reserve = -1;
+    env->reserve = (target_ulong)-1ULL;
     RETURN();
 }
 
@@ -712,11 +561,11 @@ void OPPROTO glue(op_stdcx_64, MEMSUFFIX) (void)
         if (unlikely(env->reserve != (uint64_t)T0)) {
             env->crf[0] = xer_so;
         } else {
-            glue(stq, MEMSUFFIX)((uint64_t)T0, T1);
+            glue(st64, MEMSUFFIX)((uint64_t)T0, T1);
             env->crf[0] = xer_so | 0x02;
         }
     }
-    env->reserve = -1;
+    env->reserve = (target_ulong)-1ULL;
     RETURN();
 }
 #endif
@@ -733,7 +582,7 @@ void OPPROTO glue(op_stwcx_le, MEMSUFFIX) (void)
             env->crf[0] = xer_so | 0x02;
         }
     }
-    env->reserve = -1;
+    env->reserve = (target_ulong)-1ULL;
     RETURN();
 }
 
@@ -750,7 +599,7 @@ void OPPROTO glue(op_stwcx_le_64, MEMSUFFIX) (void)
             env->crf[0] = xer_so | 0x02;
         }
     }
-    env->reserve = -1;
+    env->reserve = (target_ulong)-1ULL;
     RETURN();
 }
 
@@ -766,7 +615,7 @@ void OPPROTO glue(op_stdcx_le, MEMSUFFIX) (void)
             env->crf[0] = xer_so | 0x02;
         }
     }
-    env->reserve = -1;
+    env->reserve = (target_ulong)-1ULL;
     RETURN();
 }
 
@@ -782,57 +631,169 @@ void OPPROTO glue(op_stdcx_le_64, MEMSUFFIX) (void)
             env->crf[0] = xer_so | 0x02;
         }
     }
-    env->reserve = -1;
+    env->reserve = (target_ulong)-1ULL;
     RETURN();
 }
 #endif
 
+void OPPROTO glue(op_dcbz_l32, MEMSUFFIX) (void)
+{
+    T0 &= ~((uint32_t)31);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x00), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x04), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x08), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x0C), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x10), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x14), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x18), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x1C), 0);
+    RETURN();
+}
+
+void OPPROTO glue(op_dcbz_l64, MEMSUFFIX) (void)
+{
+    T0 &= ~((uint32_t)63);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x00), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x04), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x08), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x0C), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x10), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x14), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x18), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x1C), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x20UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x24UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x28UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x2CUL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x30UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x34UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x38UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x3CUL), 0);
+    RETURN();
+}
+
+void OPPROTO glue(op_dcbz_l128, MEMSUFFIX) (void)
+{
+    T0 &= ~((uint32_t)127);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x00), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x04), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x08), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x0C), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x10), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x14), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x18), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x1C), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x20UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x24UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x28UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x2CUL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x30UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x34UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x38UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x3CUL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x40UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x44UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x48UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x4CUL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x50UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x54UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x58UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x5CUL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x60UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x64UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x68UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x6CUL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x70UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x74UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x78UL), 0);
+    glue(st32, MEMSUFFIX)((uint32_t)(T0 + 0x7CUL), 0);
+    RETURN();
+}
+
 void OPPROTO glue(op_dcbz, MEMSUFFIX) (void)
 {
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x00), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x04), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x08), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x0C), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x10), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x14), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x18), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x1C), 0);
-#if DCACHE_LINE_SIZE == 64
-    /* XXX: cache line size should be 64 for POWER & PowerPC 601 */
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x20UL), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x24UL), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x28UL), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x2CUL), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x30UL), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x34UL), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x38UL), 0);
-    glue(stl, MEMSUFFIX)((uint32_t)(T0 + 0x3CUL), 0);
-#endif
+    glue(do_dcbz, MEMSUFFIX)();
     RETURN();
 }
 
 #if defined(TARGET_PPC64)
+void OPPROTO glue(op_dcbz_l32_64, MEMSUFFIX) (void)
+{
+    T0 &= ~((uint64_t)31);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x00), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x04), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x08), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x0C), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x10), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x14), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x18), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x1C), 0);
+    RETURN();
+}
+
+void OPPROTO glue(op_dcbz_l64_64, MEMSUFFIX) (void)
+{
+    T0 &= ~((uint64_t)63);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x00), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x04), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x08), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x0C), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x10), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x14), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x18), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x1C), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x20UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x24UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x28UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x2CUL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x30UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x34UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x38UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x3CUL), 0);
+    RETURN();
+}
+
+void OPPROTO glue(op_dcbz_l128_64, MEMSUFFIX) (void)
+{
+    T0 &= ~((uint64_t)127);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x00), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x04), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x08), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x0C), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x10), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x14), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x18), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x1C), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x20UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x24UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x28UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x2CUL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x30UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x34UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x38UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x3CUL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x40UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x44UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x48UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x4CUL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x50UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x54UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x58UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x5CUL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x60UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x64UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x68UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x6CUL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x70UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x74UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x78UL), 0);
+    glue(st32, MEMSUFFIX)((uint64_t)(T0 + 0x7CUL), 0);
+    RETURN();
+}
+
 void OPPROTO glue(op_dcbz_64, MEMSUFFIX) (void)
 {
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x00), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x04), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x08), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x0C), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x10), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x14), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x18), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x1C), 0);
-#if DCACHE_LINE_SIZE == 64
-    /* XXX: cache line size should be 64 for POWER & PowerPC 601 */
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x20UL), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x24UL), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x28UL), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x2CUL), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x30UL), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x34UL), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x38UL), 0);
-    glue(stl, MEMSUFFIX)((uint64_t)(T0 + 0x3CUL), 0);
-#endif
+    glue(do_dcbz_64, MEMSUFFIX)();
     RETURN();
 }
 #endif
@@ -855,42 +816,42 @@ void OPPROTO glue(op_icbi_64, MEMSUFFIX) (void)
 /* External access */
 void OPPROTO glue(op_eciwx, MEMSUFFIX) (void)
 {
-    T1 = glue(ldl, MEMSUFFIX)((uint32_t)T0);
+    T1 = glue(ldu32, MEMSUFFIX)((uint32_t)T0);
     RETURN();
 }
 
 #if defined(TARGET_PPC64)
 void OPPROTO glue(op_eciwx_64, MEMSUFFIX) (void)
 {
-    T1 = glue(ldl, MEMSUFFIX)((uint64_t)T0);
+    T1 = glue(ldu32, MEMSUFFIX)((uint64_t)T0);
     RETURN();
 }
 #endif
 
 void OPPROTO glue(op_ecowx, MEMSUFFIX) (void)
 {
-    glue(stl, MEMSUFFIX)((uint32_t)T0, T1);
+    glue(st32, MEMSUFFIX)((uint32_t)T0, T1);
     RETURN();
 }
 
 #if defined(TARGET_PPC64)
 void OPPROTO glue(op_ecowx_64, MEMSUFFIX) (void)
 {
-    glue(stl, MEMSUFFIX)((uint64_t)T0, T1);
+    glue(st32, MEMSUFFIX)((uint64_t)T0, T1);
     RETURN();
 }
 #endif
 
 void OPPROTO glue(op_eciwx_le, MEMSUFFIX) (void)
 {
-    T1 = glue(ld32r, MEMSUFFIX)((uint32_t)T0);
+    T1 = glue(ldu32r, MEMSUFFIX)((uint32_t)T0);
     RETURN();
 }
 
 #if defined(TARGET_PPC64)
 void OPPROTO glue(op_eciwx_le_64, MEMSUFFIX) (void)
 {
-    T1 = glue(ld32r, MEMSUFFIX)((uint64_t)T0);
+    T1 = glue(ldu32r, MEMSUFFIX)((uint64_t)T0);
     RETURN();
 }
 #endif
@@ -946,7 +907,66 @@ void OPPROTO glue(op_POWER2_stfq_le, MEMSUFFIX) (void)
     RETURN();
 }
 
-#if defined(TARGET_PPCEMB)
+/* Altivec vector extension */
+#if defined(WORDS_BIGENDIAN)
+#define VR_DWORD0 0
+#define VR_DWORD1 1
+#else
+#define VR_DWORD0 1
+#define VR_DWORD1 0
+#endif
+void OPPROTO glue(op_vr_lvx, MEMSUFFIX) (void)
+{
+    AVR0.u64[VR_DWORD0] = glue(ldu64, MEMSUFFIX)((uint32_t)T0);
+    AVR0.u64[VR_DWORD1] = glue(ldu64, MEMSUFFIX)((uint32_t)T0 + 8);
+}
+
+void OPPROTO glue(op_vr_lvx_le, MEMSUFFIX) (void)
+{
+    AVR0.u64[VR_DWORD1] = glue(ldu64r, MEMSUFFIX)((uint32_t)T0);
+    AVR0.u64[VR_DWORD0] = glue(ldu64r, MEMSUFFIX)((uint32_t)T0 + 8);
+}
+
+void OPPROTO glue(op_vr_stvx, MEMSUFFIX) (void)
+{
+    glue(st64, MEMSUFFIX)((uint32_t)T0, AVR0.u64[VR_DWORD0]);
+    glue(st64, MEMSUFFIX)((uint32_t)T0 + 8, AVR0.u64[VR_DWORD1]);
+}
+
+void OPPROTO glue(op_vr_stvx_le, MEMSUFFIX) (void)
+{
+    glue(st64r, MEMSUFFIX)((uint32_t)T0, AVR0.u64[VR_DWORD1]);
+    glue(st64r, MEMSUFFIX)((uint32_t)T0 + 8, AVR0.u64[VR_DWORD0]);
+}
+
+#if defined(TARGET_PPC64)
+void OPPROTO glue(op_vr_lvx_64, MEMSUFFIX) (void)
+{
+    AVR0.u64[VR_DWORD0] = glue(ldu64, MEMSUFFIX)((uint64_t)T0);
+    AVR0.u64[VR_DWORD1] = glue(ldu64, MEMSUFFIX)((uint64_t)T0 + 8);
+}
+
+void OPPROTO glue(op_vr_lvx_le_64, MEMSUFFIX) (void)
+{
+    AVR0.u64[VR_DWORD1] = glue(ldu64r, MEMSUFFIX)((uint64_t)T0);
+    AVR0.u64[VR_DWORD0] = glue(ldu64r, MEMSUFFIX)((uint64_t)T0 + 8);
+}
+
+void OPPROTO glue(op_vr_stvx_64, MEMSUFFIX) (void)
+{
+    glue(st64, MEMSUFFIX)((uint64_t)T0, AVR0.u64[VR_DWORD0]);
+    glue(st64, MEMSUFFIX)((uint64_t)T0 + 8, AVR0.u64[VR_DWORD1]);
+}
+
+void OPPROTO glue(op_vr_stvx_le_64, MEMSUFFIX) (void)
+{
+    glue(st64r, MEMSUFFIX)((uint64_t)T0, AVR0.u64[VR_DWORD1]);
+    glue(st64r, MEMSUFFIX)((uint64_t)T0 + 8, AVR0.u64[VR_DWORD0]);
+}
+#endif
+#undef VR_DWORD0
+#undef VR_DWORD1
+
 /* SPE extension */
 #define _PPC_SPE_LD_OP(name, op)                                              \
 void OPPROTO glue(glue(op_spe_l, name), MEMSUFFIX) (void)                     \
@@ -970,7 +990,6 @@ _PPC_SPE_LD_OP_64(name, op)
 _PPC_SPE_LD_OP(name, op)
 #endif
 
-
 #define _PPC_SPE_ST_OP(name, op)                                              \
 void OPPROTO glue(glue(op_spe_st, name), MEMSUFFIX) (void)                    \
 {                                                                             \
@@ -994,70 +1013,72 @@ _PPC_SPE_ST_OP(name, op)
 #endif
 
 #if !defined(TARGET_PPC64)
-PPC_SPE_LD_OP(dd, ldq);
-PPC_SPE_ST_OP(dd, stq);
-PPC_SPE_LD_OP(dd_le, ld64r);
+PPC_SPE_LD_OP(dd, ldu64);
+PPC_SPE_ST_OP(dd, st64);
+PPC_SPE_LD_OP(dd_le, ldu64r);
 PPC_SPE_ST_OP(dd_le, st64r);
 #endif
-static inline uint64_t glue(spe_ldw, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_ldw, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
-    ret = (uint64_t)glue(ldl, MEMSUFFIX)(EA) << 32;
-    ret |= (uint64_t)glue(ldl, MEMSUFFIX)(EA + 4);
+    ret = (uint64_t)glue(ldu32, MEMSUFFIX)(EA) << 32;
+    ret |= (uint64_t)glue(ldu32, MEMSUFFIX)(EA + 4);
     return ret;
 }
 PPC_SPE_LD_OP(dw, spe_ldw);
-static inline void glue(spe_stdw, MEMSUFFIX) (target_ulong EA, uint64_t data)
+static always_inline void glue(spe_stdw, MEMSUFFIX) (target_ulong EA,
+                                                     uint64_t data)
 {
-    glue(stl, MEMSUFFIX)(EA, data >> 32);
-    glue(stl, MEMSUFFIX)(EA + 4, data);
+    glue(st32, MEMSUFFIX)(EA, data >> 32);
+    glue(st32, MEMSUFFIX)(EA + 4, data);
 }
 PPC_SPE_ST_OP(dw, spe_stdw);
-static inline uint64_t glue(spe_ldw_le, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_ldw_le, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
-    ret = (uint64_t)glue(ld32r, MEMSUFFIX)(EA) << 32;
-    ret |= (uint64_t)glue(ld32r, MEMSUFFIX)(EA + 4);
+    ret = (uint64_t)glue(ldu32r, MEMSUFFIX)(EA) << 32;
+    ret |= (uint64_t)glue(ldu32r, MEMSUFFIX)(EA + 4);
     return ret;
 }
 PPC_SPE_LD_OP(dw_le, spe_ldw_le);
-static inline void glue(spe_stdw_le, MEMSUFFIX) (target_ulong EA,
-                                                 uint64_t data)
+static always_inline void glue(spe_stdw_le, MEMSUFFIX) (target_ulong EA,
+                                                        uint64_t data)
 {
     glue(st32r, MEMSUFFIX)(EA, data >> 32);
     glue(st32r, MEMSUFFIX)(EA + 4, data);
 }
 PPC_SPE_ST_OP(dw_le, spe_stdw_le);
-static inline uint64_t glue(spe_ldh, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_ldh, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
-    ret = (uint64_t)glue(lduw, MEMSUFFIX)(EA) << 48;
-    ret |= (uint64_t)glue(lduw, MEMSUFFIX)(EA + 2) << 32;
-    ret |= (uint64_t)glue(lduw, MEMSUFFIX)(EA + 4) << 16;
-    ret |= (uint64_t)glue(lduw, MEMSUFFIX)(EA + 6);
+    ret = (uint64_t)glue(ldu16, MEMSUFFIX)(EA) << 48;
+    ret |= (uint64_t)glue(ldu16, MEMSUFFIX)(EA + 2) << 32;
+    ret |= (uint64_t)glue(ldu16, MEMSUFFIX)(EA + 4) << 16;
+    ret |= (uint64_t)glue(ldu16, MEMSUFFIX)(EA + 6);
     return ret;
 }
 PPC_SPE_LD_OP(dh, spe_ldh);
-static inline void glue(spe_stdh, MEMSUFFIX) (target_ulong EA, uint64_t data)
+static always_inline void glue(spe_stdh, MEMSUFFIX) (target_ulong EA,
+                                                     uint64_t data)
 {
-    glue(stw, MEMSUFFIX)(EA, data >> 48);
-    glue(stw, MEMSUFFIX)(EA + 2, data >> 32);
-    glue(stw, MEMSUFFIX)(EA + 4, data >> 16);
-    glue(stw, MEMSUFFIX)(EA + 6, data);
+    glue(st16, MEMSUFFIX)(EA, data >> 48);
+    glue(st16, MEMSUFFIX)(EA + 2, data >> 32);
+    glue(st16, MEMSUFFIX)(EA + 4, data >> 16);
+    glue(st16, MEMSUFFIX)(EA + 6, data);
 }
 PPC_SPE_ST_OP(dh, spe_stdh);
-static inline uint64_t glue(spe_ldh_le, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_ldh_le, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
-    ret = (uint64_t)glue(ld16r, MEMSUFFIX)(EA) << 48;
-    ret |= (uint64_t)glue(ld16r, MEMSUFFIX)(EA + 2) << 32;
-    ret |= (uint64_t)glue(ld16r, MEMSUFFIX)(EA + 4) << 16;
-    ret |= (uint64_t)glue(ld16r, MEMSUFFIX)(EA + 6);
+    ret = (uint64_t)glue(ldu16r, MEMSUFFIX)(EA) << 48;
+    ret |= (uint64_t)glue(ldu16r, MEMSUFFIX)(EA + 2) << 32;
+    ret |= (uint64_t)glue(ldu16r, MEMSUFFIX)(EA + 4) << 16;
+    ret |= (uint64_t)glue(ldu16r, MEMSUFFIX)(EA + 6);
     return ret;
 }
 PPC_SPE_LD_OP(dh_le, spe_ldh_le);
-static inline void glue(spe_stdh_le, MEMSUFFIX) (target_ulong EA,
-                                                 uint64_t data)
+static always_inline void glue(spe_stdh_le, MEMSUFFIX) (target_ulong EA,
+                                                        uint64_t data)
 {
     glue(st16r, MEMSUFFIX)(EA, data >> 48);
     glue(st16r, MEMSUFFIX)(EA + 2, data >> 32);
@@ -1065,143 +1086,147 @@ static inline void glue(spe_stdh_le, MEMSUFFIX) (target_ulong EA,
     glue(st16r, MEMSUFFIX)(EA + 6, data);
 }
 PPC_SPE_ST_OP(dh_le, spe_stdh_le);
-static inline uint64_t glue(spe_lwhe, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_lwhe, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
-    ret = (uint64_t)glue(lduw, MEMSUFFIX)(EA) << 48;
-    ret |= (uint64_t)glue(lduw, MEMSUFFIX)(EA + 2) << 16;
+    ret = (uint64_t)glue(ldu16, MEMSUFFIX)(EA) << 48;
+    ret |= (uint64_t)glue(ldu16, MEMSUFFIX)(EA + 2) << 16;
     return ret;
 }
 PPC_SPE_LD_OP(whe, spe_lwhe);
-static inline void glue(spe_stwhe, MEMSUFFIX) (target_ulong EA, uint64_t data)
+static always_inline void glue(spe_stwhe, MEMSUFFIX) (target_ulong EA,
+                                                      uint64_t data)
 {
-    glue(stw, MEMSUFFIX)(EA, data >> 48);
-    glue(stw, MEMSUFFIX)(EA + 2, data >> 16);
+    glue(st16, MEMSUFFIX)(EA, data >> 48);
+    glue(st16, MEMSUFFIX)(EA + 2, data >> 16);
 }
 PPC_SPE_ST_OP(whe, spe_stwhe);
-static inline uint64_t glue(spe_lwhe_le, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_lwhe_le, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
-    ret = (uint64_t)glue(ld16r, MEMSUFFIX)(EA) << 48;
-    ret |= (uint64_t)glue(ld16r, MEMSUFFIX)(EA + 2) << 16;
+    ret = (uint64_t)glue(ldu16r, MEMSUFFIX)(EA) << 48;
+    ret |= (uint64_t)glue(ldu16r, MEMSUFFIX)(EA + 2) << 16;
     return ret;
 }
 PPC_SPE_LD_OP(whe_le, spe_lwhe_le);
-static inline void glue(spe_stwhe_le, MEMSUFFIX) (target_ulong EA,
-                                                  uint64_t data)
+static always_inline void glue(spe_stwhe_le, MEMSUFFIX) (target_ulong EA,
+                                                         uint64_t data)
 {
     glue(st16r, MEMSUFFIX)(EA, data >> 48);
     glue(st16r, MEMSUFFIX)(EA + 2, data >> 16);
 }
 PPC_SPE_ST_OP(whe_le, spe_stwhe_le);
-static inline uint64_t glue(spe_lwhou, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_lwhou, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
-    ret = (uint64_t)glue(lduw, MEMSUFFIX)(EA) << 32;
-    ret |= (uint64_t)glue(lduw, MEMSUFFIX)(EA + 2);
+    ret = (uint64_t)glue(ldu16, MEMSUFFIX)(EA) << 32;
+    ret |= (uint64_t)glue(ldu16, MEMSUFFIX)(EA + 2);
     return ret;
 }
 PPC_SPE_LD_OP(whou, spe_lwhou);
-static inline uint64_t glue(spe_lwhos, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_lwhos, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
-    ret = ((uint64_t)((int32_t)glue(ldsw, MEMSUFFIX)(EA))) << 32;
-    ret |= (uint64_t)((int32_t)glue(ldsw, MEMSUFFIX)(EA + 2));
+    ret = ((uint64_t)((int32_t)glue(lds16, MEMSUFFIX)(EA))) << 32;
+    ret |= (uint64_t)((int32_t)glue(lds16, MEMSUFFIX)(EA + 2));
     return ret;
 }
 PPC_SPE_LD_OP(whos, spe_lwhos);
-static inline void glue(spe_stwho, MEMSUFFIX) (target_ulong EA, uint64_t data)
+static always_inline void glue(spe_stwho, MEMSUFFIX) (target_ulong EA,
+                                                      uint64_t data)
 {
-    glue(stw, MEMSUFFIX)(EA, data >> 32);
-    glue(stw, MEMSUFFIX)(EA + 2, data);
+    glue(st16, MEMSUFFIX)(EA, data >> 32);
+    glue(st16, MEMSUFFIX)(EA + 2, data);
 }
 PPC_SPE_ST_OP(who, spe_stwho);
-static inline uint64_t glue(spe_lwhou_le, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_lwhou_le, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
-    ret = (uint64_t)glue(ld16r, MEMSUFFIX)(EA) << 32;
-    ret |= (uint64_t)glue(ld16r, MEMSUFFIX)(EA + 2);
+    ret = (uint64_t)glue(ldu16r, MEMSUFFIX)(EA) << 32;
+    ret |= (uint64_t)glue(ldu16r, MEMSUFFIX)(EA + 2);
     return ret;
 }
 PPC_SPE_LD_OP(whou_le, spe_lwhou_le);
-static inline uint64_t glue(spe_lwhos_le, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_lwhos_le, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
-    ret = ((uint64_t)((int32_t)glue(ld16rs, MEMSUFFIX)(EA))) << 32;
-    ret |= (uint64_t)((int32_t)glue(ld16rs, MEMSUFFIX)(EA + 2));
+    ret = ((uint64_t)((int32_t)glue(lds16r, MEMSUFFIX)(EA))) << 32;
+    ret |= (uint64_t)((int32_t)glue(lds16r, MEMSUFFIX)(EA + 2));
     return ret;
 }
 PPC_SPE_LD_OP(whos_le, spe_lwhos_le);
-static inline void glue(spe_stwho_le, MEMSUFFIX) (target_ulong EA,
-                                                  uint64_t data)
+static always_inline void glue(spe_stwho_le, MEMSUFFIX) (target_ulong EA,
+                                                         uint64_t data)
 {
     glue(st16r, MEMSUFFIX)(EA, data >> 32);
     glue(st16r, MEMSUFFIX)(EA + 2, data);
 }
 PPC_SPE_ST_OP(who_le, spe_stwho_le);
 #if !defined(TARGET_PPC64)
-static inline void glue(spe_stwwo, MEMSUFFIX) (target_ulong EA, uint64_t data)
+static always_inline void glue(spe_stwwo, MEMSUFFIX) (target_ulong EA,
+                                                      uint64_t data)
 {
-    glue(stl, MEMSUFFIX)(EA, data);
+    glue(st32, MEMSUFFIX)(EA, data);
 }
 PPC_SPE_ST_OP(wwo, spe_stwwo);
-static inline void glue(spe_stwwo_le, MEMSUFFIX) (target_ulong EA,
-                                                  uint64_t data)
+static always_inline void glue(spe_stwwo_le, MEMSUFFIX) (target_ulong EA,
+                                                         uint64_t data)
 {
     glue(st32r, MEMSUFFIX)(EA, data);
 }
 PPC_SPE_ST_OP(wwo_le, spe_stwwo_le);
 #endif
-static inline uint64_t glue(spe_lh, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_lh, MEMSUFFIX) (target_ulong EA)
 {
     uint16_t tmp;
-    tmp = glue(lduw, MEMSUFFIX)(EA);
+    tmp = glue(ldu16, MEMSUFFIX)(EA);
     return ((uint64_t)tmp << 48) | ((uint64_t)tmp << 16);
 }
 PPC_SPE_LD_OP(h, spe_lh);
-static inline uint64_t glue(spe_lh_le, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_lh_le, MEMSUFFIX) (target_ulong EA)
 {
     uint16_t tmp;
-    tmp = glue(ld16r, MEMSUFFIX)(EA);
+    tmp = glue(ldu16r, MEMSUFFIX)(EA);
     return ((uint64_t)tmp << 48) | ((uint64_t)tmp << 16);
 }
 PPC_SPE_LD_OP(h_le, spe_lh_le);
-static inline uint64_t glue(spe_lwwsplat, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_lwwsplat, MEMSUFFIX) (target_ulong EA)
 {
     uint32_t tmp;
-    tmp = glue(ldl, MEMSUFFIX)(EA);
+    tmp = glue(ldu32, MEMSUFFIX)(EA);
     return ((uint64_t)tmp << 32) | (uint64_t)tmp;
 }
 PPC_SPE_LD_OP(wwsplat, spe_lwwsplat);
-static inline uint64_t glue(spe_lwwsplat_le, MEMSUFFIX) (target_ulong EA)
+static always_inline
+uint64_t glue(spe_lwwsplat_le, MEMSUFFIX) (target_ulong EA)
 {
     uint32_t tmp;
-    tmp = glue(ld32r, MEMSUFFIX)(EA);
+    tmp = glue(ldu32r, MEMSUFFIX)(EA);
     return ((uint64_t)tmp << 32) | (uint64_t)tmp;
 }
 PPC_SPE_LD_OP(wwsplat_le, spe_lwwsplat_le);
-static inline uint64_t glue(spe_lwhsplat, MEMSUFFIX) (target_ulong EA)
+static always_inline uint64_t glue(spe_lwhsplat, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
     uint16_t tmp;
-    tmp = glue(lduw, MEMSUFFIX)(EA);
+    tmp = glue(ldu16, MEMSUFFIX)(EA);
     ret = ((uint64_t)tmp << 48) | ((uint64_t)tmp << 32);
-    tmp = glue(lduw, MEMSUFFIX)(EA + 2);
+    tmp = glue(ldu16, MEMSUFFIX)(EA + 2);
     ret |= ((uint64_t)tmp << 16) | (uint64_t)tmp;
     return ret;
 }
 PPC_SPE_LD_OP(whsplat, spe_lwhsplat);
-static inline uint64_t glue(spe_lwhsplat_le, MEMSUFFIX) (target_ulong EA)
+static always_inline
+uint64_t glue(spe_lwhsplat_le, MEMSUFFIX) (target_ulong EA)
 {
     uint64_t ret;
     uint16_t tmp;
-    tmp = glue(ld16r, MEMSUFFIX)(EA);
+    tmp = glue(ldu16r, MEMSUFFIX)(EA);
     ret = ((uint64_t)tmp << 48) | ((uint64_t)tmp << 32);
-    tmp = glue(ld16r, MEMSUFFIX)(EA + 2);
+    tmp = glue(ldu16r, MEMSUFFIX)(EA + 2);
     ret |= ((uint64_t)tmp << 16) | (uint64_t)tmp;
     return ret;
 }
 PPC_SPE_LD_OP(whsplat_le, spe_lwhsplat_le);
-#endif /* defined(TARGET_PPCEMB) */
 
 #undef MEMSUFFIX
diff --git a/target-ppc/op_mem_access.h b/target-ppc/op_mem_access.h
new file mode 100644
index 000000000..48be20e5a
--- /dev/null
+++ b/target-ppc/op_mem_access.h
@@ -0,0 +1,148 @@
+/*
+ *  PowerPC emulation memory access helpers for qemu.
+ *
+ *  Copyright (c) 2003-2007 Jocelyn Mayer
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* 8 bits accesses */
+static always_inline target_ulong glue(ldu8, MEMSUFFIX) (target_ulong EA)
+{
+    return (uint8_t)glue(ldub, MEMSUFFIX)(EA);
+}
+
+static always_inline target_long glue(lds8, MEMSUFFIX) (target_ulong EA)
+{
+    return (int8_t)glue(ldsb, MEMSUFFIX)(EA);
+}
+
+static always_inline void glue(st8, MEMSUFFIX) (target_ulong EA, uint8_t val)
+{
+    glue(stb, MEMSUFFIX)(EA, val);
+}
+
+/* 16 bits accesses */
+static always_inline target_ulong glue(ldu16, MEMSUFFIX) (target_ulong EA)
+{
+    return (uint16_t)glue(lduw, MEMSUFFIX)(EA);
+}
+
+static always_inline target_long glue(lds16, MEMSUFFIX) (target_ulong EA)
+{
+    return (int16_t)glue(ldsw, MEMSUFFIX)(EA);
+}
+
+static always_inline void glue(st16, MEMSUFFIX) (target_ulong EA, uint16_t val)
+{
+    glue(stw, MEMSUFFIX)(EA, val);
+}
+
+static always_inline target_ulong glue(ldu16r, MEMSUFFIX) (target_ulong EA)
+{
+    return (uint16_t)bswap16(glue(lduw, MEMSUFFIX)(EA));
+}
+
+static always_inline target_long glue(lds16r, MEMSUFFIX) (target_ulong EA)
+{
+    return (int16_t)bswap16(glue(lduw, MEMSUFFIX)(EA));
+}
+
+static always_inline void glue(st16r, MEMSUFFIX) (target_ulong EA, uint16_t val)
+{
+    glue(stw, MEMSUFFIX)(EA, bswap16(val));
+}
+
+/* 32 bits accesses */
+static always_inline uint32_t glue(__ldul, MEMSUFFIX) (target_ulong EA)
+{
+    return (uint32_t)glue(ldl, MEMSUFFIX)(EA);
+}
+
+static always_inline int32_t glue(__ldsl, MEMSUFFIX) (target_ulong EA)
+{
+    return (int32_t)glue(ldl, MEMSUFFIX)(EA);
+}
+
+static always_inline target_ulong glue(ldu32, MEMSUFFIX) (target_ulong EA)
+{
+    return glue(__ldul, MEMSUFFIX)(EA);
+}
+
+static always_inline target_long glue(lds32, MEMSUFFIX) (target_ulong EA)
+{
+    return glue(__ldsl, MEMSUFFIX)(EA);
+}
+
+static always_inline void glue(st32, MEMSUFFIX) (target_ulong EA, uint32_t val)
+{
+    glue(stl, MEMSUFFIX)(EA, val);
+}
+
+static always_inline target_ulong glue(ldu32r, MEMSUFFIX) (target_ulong EA)
+{
+    return bswap32(glue(__ldul, MEMSUFFIX)(EA));
+}
+
+static always_inline target_long glue(lds32r, MEMSUFFIX) (target_ulong EA)
+{
+    return (int32_t)bswap32(glue(__ldul, MEMSUFFIX)(EA));
+}
+
+static always_inline void glue(st32r, MEMSUFFIX) (target_ulong EA, uint32_t val)
+{
+    glue(stl, MEMSUFFIX)(EA, bswap32(val));
+}
+
+/* 64 bits accesses */
+static always_inline uint64_t glue(__lduq, MEMSUFFIX) (target_ulong EA)
+{
+    return (uint64_t)glue(ldq, MEMSUFFIX)(EA);
+}
+
+static always_inline int64_t glue(__ldsq, MEMSUFFIX) (target_ulong EA)
+{
+    return (int64_t)glue(ldq, MEMSUFFIX)(EA);
+}
+
+static always_inline uint64_t glue(ldu64, MEMSUFFIX) (target_ulong EA)
+{
+    return glue(__lduq, MEMSUFFIX)(EA);
+}
+
+static always_inline int64_t glue(lds64, MEMSUFFIX) (target_ulong EA)
+{
+    return glue(__ldsq, MEMSUFFIX)(EA);
+}
+
+static always_inline void glue(st64, MEMSUFFIX) (target_ulong EA, uint64_t val)
+{
+    glue(stq, MEMSUFFIX)(EA, val);
+}
+
+static always_inline uint64_t glue(ldu64r, MEMSUFFIX) (target_ulong EA)
+{
+    return bswap64(glue(__lduq, MEMSUFFIX)(EA));
+}
+
+static always_inline int64_t glue(lds64r, MEMSUFFIX) (target_ulong EA)
+{
+    return (int64_t)bswap64(glue(__lduq, MEMSUFFIX)(EA));
+}
+
+static always_inline void glue(st64r, MEMSUFFIX) (target_ulong EA, uint64_t val)
+{
+    glue(stq, MEMSUFFIX)(EA, bswap64(val));
+}
diff --git a/target-ppc/op_template.h b/target-ppc/op_template.h
index d45062592..e6d6afac5 100644
--- a/target-ppc/op_template.h
+++ b/target-ppc/op_template.h
@@ -57,23 +57,24 @@ void OPPROTO glue(op_store_T2_gpr_gpr, REG) (void)
 }
 #endif
 
-#if defined(TARGET_PPCEMB)
+/* General purpose registers containing vector operands moves */
+#if !defined(TARGET_PPC64)
 void OPPROTO glue(op_load_gpr64_T0_gpr, REG) (void)
 {
-    T0_64 = env->gpr[REG];
+    T0_64 = (uint64_t)env->gpr[REG] | ((uint64_t)env->gprh[REG] << 32);
     RETURN();
 }
 
 void OPPROTO glue(op_load_gpr64_T1_gpr, REG) (void)
 {
-    T1_64 = env->gpr[REG];
+    T1_64 = (uint64_t)env->gpr[REG] | ((uint64_t)env->gprh[REG] << 32);
     RETURN();
 }
 
 #if 0 // unused
 void OPPROTO glue(op_load_gpr64_T2_gpr, REG) (void)
 {
-    T2_64 = env->gpr[REG];
+    T2_64 = (uint64_t)env->gpr[REG] | ((uint64_t)env->gprh[REG] << 32);
     RETURN();
 }
 #endif
@@ -81,12 +82,14 @@ void OPPROTO glue(op_load_gpr64_T2_gpr, REG) (void)
 void OPPROTO glue(op_store_T0_gpr64_gpr, REG) (void)
 {
     env->gpr[REG] = T0_64;
+    env->gprh[REG] = T0_64 >> 32;
     RETURN();
 }
 
 void OPPROTO glue(op_store_T1_gpr64_gpr, REG) (void)
 {
     env->gpr[REG] = T1_64;
+    env->gprh[REG] = T1_64 >> 32;
     RETURN();
 }
 
@@ -94,66 +97,75 @@ void OPPROTO glue(op_store_T1_gpr64_gpr, REG) (void)
 void OPPROTO glue(op_store_T2_gpr64_gpr, REG) (void)
 {
     env->gpr[REG] = T2_64;
+    env->gprh[REG] = T2_64 >> 32;
     RETURN();
 }
 #endif
-#endif /* defined(TARGET_PPCEMB) */
+#endif /* !defined(TARGET_PPC64) */
 
-#if REG <= 7
-/* Condition register moves */
-void OPPROTO glue(op_load_crf_T0_crf, REG) (void)
+/* Altivec registers moves */
+void OPPROTO glue(op_load_avr_A0_avr, REG) (void)
 {
-    T0 = env->crf[REG];
+    AVR0 = env->avr[REG];
     RETURN();
 }
 
-void OPPROTO glue(op_load_crf_T1_crf, REG) (void)
+void OPPROTO glue(op_load_avr_A1_avr, REG) (void)
 {
-    T1 = env->crf[REG];
+    AVR1 = env->avr[REG];
     RETURN();
 }
 
-void OPPROTO glue(op_store_T0_crf_crf, REG) (void)
+void OPPROTO glue(op_load_avr_A2_avr, REG) (void)
 {
-    env->crf[REG] = T0;
+    AVR2 = env->avr[REG];
     RETURN();
 }
 
-void OPPROTO glue(op_store_T1_crf_crf, REG) (void)
+void OPPROTO glue(op_store_A0_avr_avr, REG) (void)
 {
-    env->crf[REG] = T1;
+    env->avr[REG] = AVR0;
     RETURN();
 }
 
-/* Floating point condition and status register moves */
-void OPPROTO glue(op_load_fpscr_T0_fpscr, REG) (void)
+void OPPROTO glue(op_store_A1_avr_avr, REG) (void)
 {
-    T0 = env->fpscr[REG];
+    env->avr[REG] = AVR1;
     RETURN();
 }
 
-#if REG == 0
-void OPPROTO glue(op_store_T0_fpscr_fpscr, REG) (void)
+#if 0 // unused
+void OPPROTO glue(op_store_A2_avr_avr, REG) (void)
 {
-    env->fpscr[REG] = (env->fpscr[REG] & 0x9) | (T0 & ~0x9);
+    env->avr[REG] = AVR2;
     RETURN();
 }
+#endif
 
-void OPPROTO glue(op_clear_fpscr_fpscr, REG) (void)
+#if REG <= 7
+/* Condition register moves */
+void OPPROTO glue(op_load_crf_T0_crf, REG) (void)
 {
-    env->fpscr[REG] = (env->fpscr[REG] & 0x9);
+    T0 = env->crf[REG];
     RETURN();
 }
-#else
-void OPPROTO glue(op_store_T0_fpscr_fpscr, REG) (void)
+
+void OPPROTO glue(op_load_crf_T1_crf, REG) (void)
 {
-    env->fpscr[REG] = T0;
+    T1 = env->crf[REG];
     RETURN();
 }
 
-void OPPROTO glue(op_clear_fpscr_fpscr, REG) (void)
+void OPPROTO glue(op_store_T0_crf_crf, REG) (void)
 {
-    env->fpscr[REG] = 0x0;
+    env->crf[REG] = T0;
+    RETURN();
+}
+
+#if 0 // Unused
+void OPPROTO glue(op_store_T1_crf_crf, REG) (void)
+{
+    env->crf[REG] = T1;
     RETURN();
 }
 #endif
diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index 3cb89f497..1313a7736 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -32,6 +32,7 @@
 //#define PPC_DEBUG_DISAS
 //#define DEBUG_MEMORY_ACCESSES
 //#define DO_PPC_STATISTICS
+//#define OPTIMIZE_FPRF_UPDATE
 
 /*****************************************************************************/
 /* Code translation helpers                                                  */
@@ -50,10 +51,14 @@ enum {
 
 static uint16_t *gen_opc_ptr;
 static uint32_t *gen_opparam_ptr;
+#if defined(OPTIMIZE_FPRF_UPDATE)
+static uint16_t *gen_fprf_buf[OPC_BUF_SIZE];
+static uint16_t **gen_fprf_ptr;
+#endif
 
 #include "gen-op.h"
 
-static inline void gen_set_T0 (target_ulong val)
+static always_inline void gen_set_T0 (target_ulong val)
 {
 #if defined(TARGET_PPC64)
     if (val >> 32)
@@ -63,7 +68,7 @@ static inline void gen_set_T0 (target_ulong val)
         gen_op_set_T0(val);
 }
 
-static inline void gen_set_T1 (target_ulong val)
+static always_inline void gen_set_T1 (target_ulong val)
 {
 #if defined(TARGET_PPC64)
     if (val >> 32)
@@ -78,7 +83,7 @@ static GenOpFunc *NAME ## _table [8] = {                                      \
 NAME ## 0, NAME ## 1, NAME ## 2, NAME ## 3,                                   \
 NAME ## 4, NAME ## 5, NAME ## 6, NAME ## 7,                                   \
 };                                                                            \
-static inline void func(int n)                                                \
+static always_inline void func (int n)                                        \
 {                                                                             \
     NAME ## _table[n]();                                                      \
 }
@@ -90,7 +95,7 @@ NAME ## 4, NAME ## 5, NAME ## 6, NAME ## 7,                                   \
 NAME ## 8, NAME ## 9, NAME ## 10, NAME ## 11,                                 \
 NAME ## 12, NAME ## 13, NAME ## 14, NAME ## 15,                               \
 };                                                                            \
-static inline void func(int n)                                                \
+static always_inline void func (int n)                                        \
 {                                                                             \
     NAME ## _table[n]();                                                      \
 }
@@ -106,7 +111,7 @@ NAME ## 20, NAME ## 21, NAME ## 22, NAME ## 23,                               \
 NAME ## 24, NAME ## 25, NAME ## 26, NAME ## 27,                               \
 NAME ## 28, NAME ## 29, NAME ## 30, NAME ## 31,                               \
 };                                                                            \
-static inline void func(int n)                                                \
+static always_inline void func (int n)                                        \
 {                                                                             \
     NAME ## _table[n]();                                                      \
 }
@@ -115,17 +120,9 @@ static inline void func(int n)                                                \
 GEN8(gen_op_load_crf_T0, gen_op_load_crf_T0_crf);
 GEN8(gen_op_load_crf_T1, gen_op_load_crf_T1_crf);
 GEN8(gen_op_store_T0_crf, gen_op_store_T0_crf_crf);
+#if 0 // Unused
 GEN8(gen_op_store_T1_crf, gen_op_store_T1_crf_crf);
-
-/* Floating point condition and status register moves */
-GEN8(gen_op_load_fpscr_T0, gen_op_load_fpscr_T0_fpscr);
-GEN8(gen_op_store_T0_fpscr, gen_op_store_T0_fpscr_fpscr);
-GEN8(gen_op_clear_fpscr, gen_op_clear_fpscr_fpscr);
-static inline void gen_op_store_T0_fpscri (int n, uint8_t param)
-{
-    gen_op_set_T0(param);
-    gen_op_store_T0_fpscr(n);
-}
+#endif
 
 /* General purpose registers moves */
 GEN32(gen_op_load_gpr_T0, gen_op_load_gpr_T0_gpr);
@@ -164,11 +161,11 @@ typedef struct DisasContext {
     int sf_mode;
 #endif
     int fpu_enabled;
-#if defined(TARGET_PPCEMB)
+    int altivec_enabled;
     int spe_enabled;
-#endif
     ppc_spr_t *spr_cb; /* Needed to check rights for mfspr/mtspr */
     int singlestep_enabled;
+    int dcache_line_size;
 } DisasContext;
 
 struct opc_handler_t {
@@ -186,7 +183,7 @@ struct opc_handler_t {
 #endif
 };
 
-static inline void gen_set_Rc0 (DisasContext *ctx)
+static always_inline void gen_set_Rc0 (DisasContext *ctx)
 {
 #if defined(TARGET_PPC64)
     if (ctx->sf_mode)
@@ -197,7 +194,45 @@ static inline void gen_set_Rc0 (DisasContext *ctx)
     gen_op_set_Rc0();
 }
 
-static inline void gen_update_nip (DisasContext *ctx, target_ulong nip)
+static always_inline void gen_reset_fpstatus (void)
+{
+#ifdef CONFIG_SOFTFLOAT
+    gen_op_reset_fpstatus();
+#endif
+}
+
+static always_inline void gen_compute_fprf (int set_fprf, int set_rc)
+{
+    if (set_fprf != 0) {
+        /* This case might be optimized later */
+#if defined(OPTIMIZE_FPRF_UPDATE)
+        *gen_fprf_ptr++ = gen_opc_ptr;
+#endif
+        gen_op_compute_fprf(1);
+        if (unlikely(set_rc))
+            gen_op_store_T0_crf(1);
+        gen_op_float_check_status();
+    } else if (unlikely(set_rc)) {
+        /* We always need to compute fpcc */
+        gen_op_compute_fprf(0);
+        gen_op_store_T0_crf(1);
+        if (set_fprf)
+            gen_op_float_check_status();
+    }
+}
+
+static always_inline void gen_optimize_fprf (void)
+{
+#if defined(OPTIMIZE_FPRF_UPDATE)
+    uint16_t **ptr;
+
+    for (ptr = gen_fprf_buf; ptr != (gen_fprf_ptr - 1); ptr++)
+        *ptr = INDEX_op_nop1;
+    gen_fprf_ptr = gen_fprf_buf;
+#endif
+}
+
+static always_inline void gen_update_nip (DisasContext *ctx, target_ulong nip)
 {
 #if defined(TARGET_PPC64)
     if (ctx->sf_mode)
@@ -234,15 +269,18 @@ GEN_EXCP(ctx, POWERPC_EXCP_FPU, 0)
 #define GEN_EXCP_NO_AP(ctx)                                                   \
 GEN_EXCP(ctx, POWERPC_EXCP_APU, 0)
 
+#define GEN_EXCP_NO_VR(ctx)                                                   \
+GEN_EXCP(ctx, POWERPC_EXCP_VPU, 0)
+
 /* Stop translation */
-static inline void GEN_STOP (DisasContext *ctx)
+static always_inline void GEN_STOP (DisasContext *ctx)
 {
     gen_update_nip(ctx, ctx->nip);
     ctx->exception = POWERPC_EXCP_STOP;
 }
 
 /* No need to update nip here, as execution flow will change */
-static inline void GEN_SYNC (DisasContext *ctx)
+static always_inline void GEN_SYNC (DisasContext *ctx)
 {
     ctx->exception = POWERPC_EXCP_SYNC;
 }
@@ -252,6 +290,11 @@ static void gen_##name (DisasContext *ctx);                                   \
 GEN_OPCODE(name, opc1, opc2, opc3, inval, type);                              \
 static void gen_##name (DisasContext *ctx)
 
+#define GEN_HANDLER2(name, onam, opc1, opc2, opc3, inval, type)               \
+static void gen_##name (DisasContext *ctx);                                   \
+GEN_OPCODE2(name, onam, opc1, opc2, opc3, inval, type);                       \
+static void gen_##name (DisasContext *ctx)
+
 typedef struct opcode_t {
     unsigned char opc1, opc2, opc3;
 #if HOST_LONG_BITS == 64 /* Explicitely align to 64 bits */
@@ -266,13 +309,13 @@ typedef struct opcode_t {
 /*****************************************************************************/
 /***                           Instruction decoding                        ***/
 #define EXTRACT_HELPER(name, shift, nb)                                       \
-static inline uint32_t name (uint32_t opcode)                                 \
+static always_inline uint32_t name (uint32_t opcode)                          \
 {                                                                             \
     return (opcode >> (shift)) & ((1 << (nb)) - 1);                           \
 }
 
 #define EXTRACT_SHELPER(name, shift, nb)                                      \
-static inline int32_t name (uint32_t opcode)                                  \
+static always_inline int32_t name (uint32_t opcode)                           \
 {                                                                             \
     return (int16_t)((opcode >> (shift)) & ((1 << (nb)) - 1));                \
 }
@@ -303,7 +346,7 @@ EXTRACT_HELPER(crbA, 16, 5);
 EXTRACT_HELPER(crbB, 11, 5);
 /* SPR / TBL */
 EXTRACT_HELPER(_SPR, 11, 10);
-static inline uint32_t SPR (uint32_t opcode)
+static always_inline uint32_t SPR (uint32_t opcode)
 {
     uint32_t sprn = _SPR(opcode);
 
@@ -335,12 +378,12 @@ EXTRACT_HELPER(FPIMM, 20, 4);
 /* Displacement */
 EXTRACT_SHELPER(d, 0, 16);
 /* Immediate address */
-static inline target_ulong LI (uint32_t opcode)
+static always_inline target_ulong LI (uint32_t opcode)
 {
     return (opcode >> 0) & 0x03FFFFFC;
 }
 
-static inline uint32_t BD (uint32_t opcode)
+static always_inline uint32_t BD (uint32_t opcode)
 {
     return (opcode >> 0) & 0xFFFC;
 }
@@ -353,21 +396,21 @@ EXTRACT_HELPER(AA, 1, 1);
 EXTRACT_HELPER(LK, 0, 1);
 
 /* Create a mask between <start> and <end> bits */
-static inline target_ulong MASK (uint32_t start, uint32_t end)
+static always_inline target_ulong MASK (uint32_t start, uint32_t end)
 {
     target_ulong ret;
 
 #if defined(TARGET_PPC64)
     if (likely(start == 0)) {
-        ret = (uint64_t)(-1ULL) << (63 - end);
+        ret = UINT64_MAX << (63 - end);
     } else if (likely(end == 63)) {
-        ret = (uint64_t)(-1ULL) >> start;
+        ret = UINT64_MAX >> start;
     }
 #else
     if (likely(start == 0)) {
-        ret = (uint32_t)(-1ULL) << (31  - end);
+        ret = UINT32_MAX << (31  - end);
     } else if (likely(end == 31)) {
-        ret = (uint32_t)(-1ULL) >> start;
+        ret = UINT32_MAX >> start;
     }
 #endif
     else {
@@ -383,105 +426,137 @@ static inline target_ulong MASK (uint32_t start, uint32_t end)
 /*****************************************************************************/
 /* PowerPC Instructions types definitions                                    */
 enum {
-    PPC_NONE          = 0x0000000000000000ULL,
-    /* integer operations instructions                  */
-    /* flow control instructions                        */
-    /* virtual memory instructions                      */
-    /* ld/st with reservation instructions              */
-    /* cache control instructions                       */
-    /* spr/msr access instructions                      */
-    PPC_INSNS_BASE    = 0x0000000000000001ULL,
+    PPC_NONE           = 0x0000000000000000ULL,
+    /* PowerPC base instructions set                                         */
+    PPC_INSNS_BASE     = 0x0000000000000001ULL,
+    /*   integer operations instructions                                     */
 #define PPC_INTEGER PPC_INSNS_BASE
+    /*   flow control instructions                                           */
 #define PPC_FLOW    PPC_INSNS_BASE
+    /*   virtual memory instructions                                         */
 #define PPC_MEM     PPC_INSNS_BASE
+    /*   ld/st with reservation instructions                                 */
 #define PPC_RES     PPC_INSNS_BASE
-#define PPC_CACHE   PPC_INSNS_BASE
+    /*   spr/msr access instructions                                         */
 #define PPC_MISC    PPC_INSNS_BASE
-    /* Optional floating point instructions             */
-    PPC_FLOAT         = 0x0000000000000002ULL,
-    PPC_FLOAT_FSQRT   = 0x0000000000000004ULL,
-    PPC_FLOAT_FRES    = 0x0000000000000008ULL,
-    PPC_FLOAT_FRSQRTE = 0x0000000000000010ULL,
-    PPC_FLOAT_FSEL    = 0x0000000000000020ULL,
-    PPC_FLOAT_STFIWX  = 0x0000000000000040ULL,
-    /* external control instructions                    */
-    PPC_EXTERN        = 0x0000000000000080ULL,
-    /* segment register access instructions             */
-    PPC_SEGMENT       = 0x0000000000000100ULL,
-    /* Optional cache control instruction               */
-    PPC_CACHE_DCBA    = 0x0000000000000200ULL,
-    /* Optional memory control instructions             */
-    PPC_MEM_TLBIA     = 0x0000000000000400ULL,
-    PPC_MEM_TLBIE     = 0x0000000000000800ULL,
-    PPC_MEM_TLBSYNC   = 0x0000000000001000ULL,
-    /* eieio & sync                                     */
-    PPC_MEM_SYNC      = 0x0000000000002000ULL,
-    /* PowerPC 6xx TLB management instructions          */
-    PPC_6xx_TLB       = 0x0000000000004000ULL,
-    /* Altivec support                                  */
-    PPC_ALTIVEC       = 0x0000000000008000ULL,
-    /* Time base mftb instruction                       */
-    PPC_MFTB          = 0x0000000000010000ULL,
-    /* Embedded PowerPC dedicated instructions          */
-    PPC_EMB_COMMON    = 0x0000000000020000ULL,
-    /* PowerPC 40x exception model                      */
-    PPC_40x_EXCP      = 0x0000000000040000ULL,
-    /* PowerPC 40x TLB management instructions          */
-    PPC_40x_TLB       = 0x0000000000080000ULL,
-    /* PowerPC 405 Mac instructions                     */
-    PPC_405_MAC       = 0x0000000000100000ULL,
-    /* PowerPC 440 specific instructions                */
-    PPC_440_SPEC      = 0x0000000000200000ULL,
-    /* Power-to-PowerPC bridge (601)                    */
-    PPC_POWER_BR      = 0x0000000000400000ULL,
-    /* PowerPC 602 specific */
-    PPC_602_SPEC      = 0x0000000000800000ULL,
-    /* Deprecated instructions                          */
-    /* Original POWER instruction set                   */
-    PPC_POWER         = 0x0000000001000000ULL,
-    /* POWER2 instruction set extension                 */
-    PPC_POWER2        = 0x0000000002000000ULL,
-    /* Power RTC support */
-    PPC_POWER_RTC     = 0x0000000004000000ULL,
-    /* 64 bits PowerPC instructions                     */
-    /* 64 bits PowerPC instruction set                  */
-    PPC_64B           = 0x0000000008000000ULL,
-    /* 64 bits hypervisor extensions                    */
-    PPC_64H           = 0x0000000010000000ULL,
-    /* 64 bits PowerPC "bridge" features                */
-    PPC_64_BRIDGE     = 0x0000000020000000ULL,
-    /* BookE (embedded) PowerPC specification           */
-    PPC_BOOKE         = 0x0000000040000000ULL,
-    /* eieio                                            */
-    PPC_MEM_EIEIO     = 0x0000000080000000ULL,
-    /* e500 vector instructions                         */
-    PPC_E500_VECTOR   = 0x0000000100000000ULL,
-    /* PowerPC 4xx dedicated instructions               */
-    PPC_4xx_COMMON    = 0x0000000200000000ULL,
-    /* PowerPC 2.03 specification extensions            */
-    PPC_203           = 0x0000000400000000ULL,
-    /* PowerPC 2.03 SPE extension                       */
-    PPC_SPE           = 0x0000000800000000ULL,
-    /* PowerPC 2.03 SPE floating-point extension        */
-    PPC_SPEFPU        = 0x0000001000000000ULL,
-    /* SLB management                                   */
-    PPC_SLBI          = 0x0000002000000000ULL,
-    /* PowerPC 40x ibct instructions                    */
-    PPC_40x_ICBT      = 0x0000004000000000ULL,
-    /* PowerPC 74xx TLB management instructions         */
-    PPC_74xx_TLB      = 0x0000008000000000ULL,
-    /* More BookE (embedded) instructions...            */
-    PPC_BOOKE_EXT     = 0x0000010000000000ULL,
-    /* rfmci is not implemented in all BookE PowerPC    */
-    PPC_RFMCI         = 0x0000020000000000ULL,
-    /* user-mode DCR access, implemented in PowerPC 460 */
-    PPC_DCRUX         = 0x0000040000000000ULL,
-    /* New floating-point extensions (PowerPC 2.0x)     */
-    PPC_FLOAT_EXT     = 0x0000080000000000ULL,
-    /* New wait instruction (PowerPC 2.0x)              */
-    PPC_WAIT          = 0x0000100000000000ULL,
-    /* New 64 bits extensions (PowerPC 2.0x)            */
-    PPC_64BX          = 0x0000200000000000ULL,
+    /* Deprecated instruction sets                                           */
+    /*   Original POWER instruction set                                      */
+    PPC_POWER          = 0x0000000000000002ULL,
+    /*   POWER2 instruction set extension                                    */
+    PPC_POWER2         = 0x0000000000000004ULL,
+    /*   Power RTC support                                                   */
+    PPC_POWER_RTC      = 0x0000000000000008ULL,
+    /*   Power-to-PowerPC bridge (601)                                       */
+    PPC_POWER_BR       = 0x0000000000000010ULL,
+    /* 64 bits PowerPC instruction set                                       */
+    PPC_64B            = 0x0000000000000020ULL,
+    /*   New 64 bits extensions (PowerPC 2.0x)                               */
+    PPC_64BX           = 0x0000000000000040ULL,
+    /*   64 bits hypervisor extensions                                       */
+    PPC_64H            = 0x0000000000000080ULL,
+    /*   New wait instruction (PowerPC 2.0x)                                 */
+    PPC_WAIT           = 0x0000000000000100ULL,
+    /*   Time base mftb instruction                                          */
+    PPC_MFTB           = 0x0000000000000200ULL,
+
+    /* Fixed-point unit extensions                                           */
+    /*   PowerPC 602 specific                                                */
+    PPC_602_SPEC       = 0x0000000000000400ULL,
+    /*   isel instruction                                                    */
+    PPC_ISEL           = 0x0000000000000800ULL,
+    /*   popcntb instruction                                                 */
+    PPC_POPCNTB        = 0x0000000000001000ULL,
+    /*   string load / store                                                 */
+    PPC_STRING         = 0x0000000000002000ULL,
+
+    /* Floating-point unit extensions                                        */
+    /*   Optional floating point instructions                                */
+    PPC_FLOAT          = 0x0000000000010000ULL,
+    /* New floating-point extensions (PowerPC 2.0x)                          */
+    PPC_FLOAT_EXT      = 0x0000000000020000ULL,
+    PPC_FLOAT_FSQRT    = 0x0000000000040000ULL,
+    PPC_FLOAT_FRES     = 0x0000000000080000ULL,
+    PPC_FLOAT_FRSQRTE  = 0x0000000000100000ULL,
+    PPC_FLOAT_FRSQRTES = 0x0000000000200000ULL,
+    PPC_FLOAT_FSEL     = 0x0000000000400000ULL,
+    PPC_FLOAT_STFIWX   = 0x0000000000800000ULL,
+
+    /* Vector/SIMD extensions                                                */
+    /*   Altivec support                                                     */
+    PPC_ALTIVEC        = 0x0000000001000000ULL,
+    /*   PowerPC 2.03 SPE extension                                          */
+    PPC_SPE            = 0x0000000002000000ULL,
+    /*   PowerPC 2.03 SPE floating-point extension                           */
+    PPC_SPEFPU         = 0x0000000004000000ULL,
+
+    /* Optional memory control instructions                                  */
+    PPC_MEM_TLBIA      = 0x0000000010000000ULL,
+    PPC_MEM_TLBIE      = 0x0000000020000000ULL,
+    PPC_MEM_TLBSYNC    = 0x0000000040000000ULL,
+    /*   sync instruction                                                    */
+    PPC_MEM_SYNC       = 0x0000000080000000ULL,
+    /*   eieio instruction                                                   */
+    PPC_MEM_EIEIO      = 0x0000000100000000ULL,
+
+    /* Cache control instructions                                            */
+    PPC_CACHE          = 0x0000000200000000ULL,
+    /*   icbi instruction                                                    */
+    PPC_CACHE_ICBI     = 0x0000000400000000ULL,
+    /*   dcbz instruction with fixed cache line size                         */
+    PPC_CACHE_DCBZ     = 0x0000000800000000ULL,
+    /*   dcbz instruction with tunable cache line size                       */
+    PPC_CACHE_DCBZT    = 0x0000001000000000ULL,
+    /*   dcba instruction                                                    */
+    PPC_CACHE_DCBA     = 0x0000002000000000ULL,
+    /*   Freescale cache locking instructions                                */
+    PPC_CACHE_LOCK     = 0x0000004000000000ULL,
+
+    /* MMU related extensions                                                */
+    /*   external control instructions                                       */
+    PPC_EXTERN         = 0x0000010000000000ULL,
+    /*   segment register access instructions                                */
+    PPC_SEGMENT        = 0x0000020000000000ULL,
+    /*   PowerPC 6xx TLB management instructions                             */
+    PPC_6xx_TLB        = 0x0000040000000000ULL,
+    /* PowerPC 74xx TLB management instructions                              */
+    PPC_74xx_TLB       = 0x0000080000000000ULL,
+    /*   PowerPC 40x TLB management instructions                             */
+    PPC_40x_TLB        = 0x0000100000000000ULL,
+    /*   segment register access instructions for PowerPC 64 "bridge"        */
+    PPC_SEGMENT_64B    = 0x0000200000000000ULL,
+    /*   SLB management                                                      */
+    PPC_SLBI           = 0x0000400000000000ULL,
+
+    /* Embedded PowerPC dedicated instructions                               */
+    PPC_WRTEE          = 0x0001000000000000ULL,
+    /* PowerPC 40x exception model                                           */
+    PPC_40x_EXCP       = 0x0002000000000000ULL,
+    /* PowerPC 405 Mac instructions                                          */
+    PPC_405_MAC        = 0x0004000000000000ULL,
+    /* PowerPC 440 specific instructions                                     */
+    PPC_440_SPEC       = 0x0008000000000000ULL,
+    /* BookE (embedded) PowerPC specification                                */
+    PPC_BOOKE          = 0x0010000000000000ULL,
+    /* mfapidi instruction                                                   */
+    PPC_MFAPIDI        = 0x0020000000000000ULL,
+    /* tlbiva instruction                                                    */
+    PPC_TLBIVA         = 0x0040000000000000ULL,
+    /* tlbivax instruction                                                   */
+    PPC_TLBIVAX        = 0x0080000000000000ULL,
+    /* PowerPC 4xx dedicated instructions                                    */
+    PPC_4xx_COMMON     = 0x0100000000000000ULL,
+    /* PowerPC 40x ibct instructions                                         */
+    PPC_40x_ICBT       = 0x0200000000000000ULL,
+    /* rfmci is not implemented in all BookE PowerPC                         */
+    PPC_RFMCI          = 0x0400000000000000ULL,
+    /* rfdi instruction                                                      */
+    PPC_RFDI           = 0x0800000000000000ULL,
+    /* DCR accesses                                                          */
+    PPC_DCR            = 0x1000000000000000ULL,
+    /* DCR extended accesse                                                  */
+    PPC_DCRX           = 0x2000000000000000ULL,
+    /* user-mode DCR access, implemented in PowerPC 460                      */
+    PPC_DCRUX          = 0x4000000000000000ULL,
 };
 
 /*****************************************************************************/
@@ -514,6 +589,20 @@ OPCODES_SECTION opcode_t opc_##name = {                                       \
     },                                                                        \
     .oname = stringify(name),                                                 \
 }
+#define GEN_OPCODE2(name, onam, op1, op2, op3, invl, _typ)                    \
+OPCODES_SECTION opcode_t opc_##name = {                                       \
+    .opc1 = op1,                                                              \
+    .opc2 = op2,                                                              \
+    .opc3 = op3,                                                              \
+    .pad  = { 0, },                                                           \
+    .handler = {                                                              \
+        .inval   = invl,                                                      \
+        .type = _typ,                                                         \
+        .handler = &gen_##name,                                               \
+        .oname = onam,                                                        \
+    },                                                                        \
+    .oname = onam,                                                            \
+}
 #else
 #define GEN_OPCODE(name, op1, op2, op3, invl, _typ)                           \
 OPCODES_SECTION opcode_t opc_##name = {                                       \
@@ -528,6 +617,19 @@ OPCODES_SECTION opcode_t opc_##name = {                                       \
     },                                                                        \
     .oname = stringify(name),                                                 \
 }
+#define GEN_OPCODE2(name, onam, op1, op2, op3, invl, _typ)                    \
+OPCODES_SECTION opcode_t opc_##name = {                                       \
+    .opc1 = op1,                                                              \
+    .opc2 = op2,                                                              \
+    .opc3 = op3,                                                              \
+    .pad  = { 0, },                                                           \
+    .handler = {                                                              \
+        .inval   = invl,                                                      \
+        .type = _typ,                                                         \
+        .handler = &gen_##name,                                               \
+    },                                                                        \
+    .oname = onam,                                                            \
+}
 #endif
 
 #define GEN_OPCODE_MARK(name)                                                 \
@@ -689,7 +791,7 @@ __GEN_INT_ARITH1_O_64(name##o, opc1, opc2, opc3 | 0x10, type)
 #endif
 
 /* add    add.    addo    addo.    */
-static inline void gen_op_addo (void)
+static always_inline void gen_op_addo (void)
 {
     gen_op_move_T2_T0();
     gen_op_add();
@@ -697,7 +799,7 @@ static inline void gen_op_addo (void)
 }
 #if defined(TARGET_PPC64)
 #define gen_op_add_64 gen_op_add
-static inline void gen_op_addo_64 (void)
+static always_inline void gen_op_addo_64 (void)
 {
     gen_op_move_T2_T0();
     gen_op_add();
@@ -706,13 +808,13 @@ static inline void gen_op_addo_64 (void)
 #endif
 GEN_INT_ARITH2_64 (add,    0x1F, 0x0A, 0x08, PPC_INTEGER);
 /* addc   addc.   addco   addco.   */
-static inline void gen_op_addc (void)
+static always_inline void gen_op_addc (void)
 {
     gen_op_move_T2_T0();
     gen_op_add();
     gen_op_check_addc();
 }
-static inline void gen_op_addco (void)
+static always_inline void gen_op_addco (void)
 {
     gen_op_move_T2_T0();
     gen_op_add();
@@ -720,13 +822,13 @@ static inline void gen_op_addco (void)
     gen_op_check_addo();
 }
 #if defined(TARGET_PPC64)
-static inline void gen_op_addc_64 (void)
+static always_inline void gen_op_addc_64 (void)
 {
     gen_op_move_T2_T0();
     gen_op_add();
     gen_op_check_addc_64();
 }
-static inline void gen_op_addco_64 (void)
+static always_inline void gen_op_addco_64 (void)
 {
     gen_op_move_T2_T0();
     gen_op_add();
@@ -736,14 +838,14 @@ static inline void gen_op_addco_64 (void)
 #endif
 GEN_INT_ARITH2_64 (addc,   0x1F, 0x0A, 0x00, PPC_INTEGER);
 /* adde   adde.   addeo   addeo.   */
-static inline void gen_op_addeo (void)
+static always_inline void gen_op_addeo (void)
 {
     gen_op_move_T2_T0();
     gen_op_adde();
     gen_op_check_addo();
 }
 #if defined(TARGET_PPC64)
-static inline void gen_op_addeo_64 (void)
+static always_inline void gen_op_addeo_64 (void)
 {
     gen_op_move_T2_T0();
     gen_op_adde_64();
@@ -752,13 +854,13 @@ static inline void gen_op_addeo_64 (void)
 #endif
 GEN_INT_ARITH2_64 (adde,   0x1F, 0x0A, 0x04, PPC_INTEGER);
 /* addme  addme.  addmeo  addmeo.  */
-static inline void gen_op_addme (void)
+static always_inline void gen_op_addme (void)
 {
     gen_op_move_T1_T0();
     gen_op_add_me();
 }
 #if defined(TARGET_PPC64)
-static inline void gen_op_addme_64 (void)
+static always_inline void gen_op_addme_64 (void)
 {
     gen_op_move_T1_T0();
     gen_op_add_me_64();
@@ -766,13 +868,13 @@ static inline void gen_op_addme_64 (void)
 #endif
 GEN_INT_ARITH1_64 (addme,  0x1F, 0x0A, 0x07, PPC_INTEGER);
 /* addze  addze.  addzeo  addzeo.  */
-static inline void gen_op_addze (void)
+static always_inline void gen_op_addze (void)
 {
     gen_op_move_T2_T0();
     gen_op_add_ze();
     gen_op_check_addc();
 }
-static inline void gen_op_addzeo (void)
+static always_inline void gen_op_addzeo (void)
 {
     gen_op_move_T2_T0();
     gen_op_add_ze();
@@ -780,13 +882,13 @@ static inline void gen_op_addzeo (void)
     gen_op_check_addo();
 }
 #if defined(TARGET_PPC64)
-static inline void gen_op_addze_64 (void)
+static always_inline void gen_op_addze_64 (void)
 {
     gen_op_move_T2_T0();
     gen_op_add_ze();
     gen_op_check_addc_64();
 }
-static inline void gen_op_addzeo_64 (void)
+static always_inline void gen_op_addzeo_64 (void)
 {
     gen_op_move_T2_T0();
     gen_op_add_ze();
@@ -808,64 +910,64 @@ GEN_INT_ARITH2 (mullw,  0x1F, 0x0B, 0x07, PPC_INTEGER);
 /* neg    neg.    nego    nego.    */
 GEN_INT_ARITH1_64 (neg,    0x1F, 0x08, 0x03, PPC_INTEGER);
 /* subf   subf.   subfo   subfo.   */
-static inline void gen_op_subfo (void)
+static always_inline void gen_op_subfo (void)
 {
-    gen_op_move_T2_T0();
+    gen_op_moven_T2_T0();
     gen_op_subf();
-    gen_op_check_subfo();
+    gen_op_check_addo();
 }
 #if defined(TARGET_PPC64)
 #define gen_op_subf_64 gen_op_subf
-static inline void gen_op_subfo_64 (void)
+static always_inline void gen_op_subfo_64 (void)
 {
-    gen_op_move_T2_T0();
+    gen_op_moven_T2_T0();
     gen_op_subf();
-    gen_op_check_subfo_64();
+    gen_op_check_addo_64();
 }
 #endif
 GEN_INT_ARITH2_64 (subf,   0x1F, 0x08, 0x01, PPC_INTEGER);
 /* subfc  subfc.  subfco  subfco.  */
-static inline void gen_op_subfc (void)
+static always_inline void gen_op_subfc (void)
 {
     gen_op_subf();
     gen_op_check_subfc();
 }
-static inline void gen_op_subfco (void)
+static always_inline void gen_op_subfco (void)
 {
-    gen_op_move_T2_T0();
+    gen_op_moven_T2_T0();
     gen_op_subf();
     gen_op_check_subfc();
-    gen_op_check_subfo();
+    gen_op_check_addo();
 }
 #if defined(TARGET_PPC64)
-static inline void gen_op_subfc_64 (void)
+static always_inline void gen_op_subfc_64 (void)
 {
     gen_op_subf();
     gen_op_check_subfc_64();
 }
-static inline void gen_op_subfco_64 (void)
+static always_inline void gen_op_subfco_64 (void)
 {
-    gen_op_move_T2_T0();
+    gen_op_moven_T2_T0();
     gen_op_subf();
     gen_op_check_subfc_64();
-    gen_op_check_subfo_64();
+    gen_op_check_addo_64();
 }
 #endif
 GEN_INT_ARITH2_64 (subfc,  0x1F, 0x08, 0x00, PPC_INTEGER);
 /* subfe  subfe.  subfeo  subfeo.  */
-static inline void gen_op_subfeo (void)
+static always_inline void gen_op_subfeo (void)
 {
-    gen_op_move_T2_T0();
+    gen_op_moven_T2_T0();
     gen_op_subfe();
-    gen_op_check_subfo();
+    gen_op_check_addo();
 }
 #if defined(TARGET_PPC64)
 #define gen_op_subfe_64 gen_op_subfe
-static inline void gen_op_subfeo_64 (void)
+static always_inline void gen_op_subfeo_64 (void)
 {
-    gen_op_move_T2_T0();
+    gen_op_moven_T2_T0();
     gen_op_subfe_64();
-    gen_op_check_subfo_64();
+    gen_op_check_addo_64();
 }
 #endif
 GEN_INT_ARITH2_64 (subfe,  0x1F, 0x08, 0x04, PPC_INTEGER);
@@ -909,7 +1011,7 @@ GEN_HANDLER(addic, 0x0C, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
     gen_op_store_T0_gpr(rD(ctx->opcode));
 }
 /* addic. */
-GEN_HANDLER(addic_, 0x0D, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
+GEN_HANDLER2(addic_, "addic.", 0x0D, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
 {
     target_long simm = SIMM(ctx->opcode);
 
@@ -1031,7 +1133,7 @@ GEN_HANDLER(cmpli, 0x0A, 0xFF, 0xFF, 0x00400000, PPC_INTEGER)
 }
 
 /* isel (PowerPC 2.03 specification) */
-GEN_HANDLER(isel, 0x1F, 0x0F, 0x00, 0x00000001, PPC_203)
+GEN_HANDLER(isel, 0x1F, 0x0F, 0x00, 0x00000001, PPC_ISEL)
 {
     uint32_t bi = rC(ctx->opcode);
     uint32_t mask;
@@ -1078,7 +1180,7 @@ GEN_LOGICAL2(and, 0x00, PPC_INTEGER);
 /* andc & andc. */
 GEN_LOGICAL2(andc, 0x01, PPC_INTEGER);
 /* andi. */
-GEN_HANDLER(andi_, 0x1C, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
+GEN_HANDLER2(andi_, "andi.", 0x1C, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
 {
     gen_op_load_gpr_T0(rS(ctx->opcode));
     gen_op_andi_T0(UIMM(ctx->opcode));
@@ -1086,7 +1188,7 @@ GEN_HANDLER(andi_, 0x1C, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
     gen_set_Rc0(ctx);
 }
 /* andis. */
-GEN_HANDLER(andis_, 0x1D, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
+GEN_HANDLER2(andis_, "andis.", 0x1D, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
 {
     gen_op_load_gpr_T0(rS(ctx->opcode));
     gen_op_andi_T0(UIMM(ctx->opcode) << 16);
@@ -1162,7 +1264,6 @@ GEN_HANDLER(or, 0x1F, 0x1C, 0x0D, 0x00000000, PPC_INTEGER)
                 gen_op_store_pri(6);
             }
             break;
-#if defined(TARGET_PPC64H)
         case 7:
             if (ctx->supervisor > 1) {
                 /* Set process priority to very high */
@@ -1170,7 +1271,6 @@ GEN_HANDLER(or, 0x1F, 0x1C, 0x0D, 0x00000000, PPC_INTEGER)
             }
             break;
 #endif
-#endif
         default:
             /* nop */
             break;
@@ -1256,7 +1356,7 @@ GEN_HANDLER(xoris, 0x1B, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
 }
 
 /* popcntb : PowerPC 2.03 specification */
-GEN_HANDLER(popcntb, 0x1F, 0x03, 0x03, 0x0000F801, PPC_203)
+GEN_HANDLER(popcntb, 0x1F, 0x03, 0x03, 0x0000F801, PPC_POPCNTB)
 {
     gen_op_load_gpr_T0(rS(ctx->opcode));
 #if defined(TARGET_PPC64)
@@ -1376,33 +1476,37 @@ GEN_HANDLER(rlwnm, 0x17, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
 
 #if defined(TARGET_PPC64)
 #define GEN_PPC64_R2(name, opc1, opc2)                                        \
-GEN_HANDLER(name##0, opc1, opc2, 0xFF, 0x00000000, PPC_64B)                   \
+GEN_HANDLER2(name##0, stringify(name), opc1, opc2, 0xFF, 0x00000000, PPC_64B) \
 {                                                                             \
     gen_##name(ctx, 0);                                                       \
 }                                                                             \
-GEN_HANDLER(name##1, opc1, opc2 | 0x10, 0xFF, 0x00000000, PPC_64B)            \
+GEN_HANDLER2(name##1, stringify(name), opc1, opc2 | 0x10, 0xFF, 0x00000000,   \
+             PPC_64B)                                                         \
 {                                                                             \
     gen_##name(ctx, 1);                                                       \
 }
 #define GEN_PPC64_R4(name, opc1, opc2)                                        \
-GEN_HANDLER(name##0, opc1, opc2, 0xFF, 0x00000000, PPC_64B)                   \
+GEN_HANDLER2(name##0, stringify(name), opc1, opc2, 0xFF, 0x00000000, PPC_64B) \
 {                                                                             \
     gen_##name(ctx, 0, 0);                                                    \
 }                                                                             \
-GEN_HANDLER(name##1, opc1, opc2 | 0x01, 0xFF, 0x00000000, PPC_64B)            \
+GEN_HANDLER2(name##1, stringify(name), opc1, opc2 | 0x01, 0xFF, 0x00000000,   \
+             PPC_64B)                                                         \
 {                                                                             \
     gen_##name(ctx, 0, 1);                                                    \
 }                                                                             \
-GEN_HANDLER(name##2, opc1, opc2 | 0x10, 0xFF, 0x00000000, PPC_64B)            \
+GEN_HANDLER2(name##2, stringify(name), opc1, opc2 | 0x10, 0xFF, 0x00000000,   \
+             PPC_64B)                                                         \
 {                                                                             \
     gen_##name(ctx, 1, 0);                                                    \
 }                                                                             \
-GEN_HANDLER(name##3, opc1, opc2 | 0x11, 0xFF, 0x00000000, PPC_64B)            \
+GEN_HANDLER2(name##3, stringify(name), opc1, opc2 | 0x11, 0xFF, 0x00000000,   \
+             PPC_64B)                                                         \
 {                                                                             \
     gen_##name(ctx, 1, 1);                                                    \
 }
 
-static inline void gen_andi_T0_64 (DisasContext *ctx, uint64_t mask)
+static always_inline void gen_andi_T0_64 (DisasContext *ctx, uint64_t mask)
 {
     if (mask >> 32)
         gen_op_andi_T0_64(mask >> 32, mask & 0xFFFFFFFF);
@@ -1410,7 +1514,7 @@ static inline void gen_andi_T0_64 (DisasContext *ctx, uint64_t mask)
         gen_op_andi_T0(mask);
 }
 
-static inline void gen_andi_T1_64 (DisasContext *ctx, uint64_t mask)
+static always_inline void gen_andi_T1_64 (DisasContext *ctx, uint64_t mask)
 {
     if (mask >> 32)
         gen_op_andi_T1_64(mask >> 32, mask & 0xFFFFFFFF);
@@ -1418,8 +1522,8 @@ static inline void gen_andi_T1_64 (DisasContext *ctx, uint64_t mask)
         gen_op_andi_T1(mask);
 }
 
-static inline void gen_rldinm (DisasContext *ctx, uint32_t mb, uint32_t me,
-                               uint32_t sh)
+static always_inline void gen_rldinm (DisasContext *ctx, uint32_t mb,
+                                      uint32_t me, uint32_t sh)
 {
     gen_op_load_gpr_T0(rS(ctx->opcode));
     if (likely(sh == 0)) {
@@ -1448,7 +1552,7 @@ static inline void gen_rldinm (DisasContext *ctx, uint32_t mb, uint32_t me,
         gen_set_Rc0(ctx);
 }
 /* rldicl - rldicl. */
-static inline void gen_rldicl (DisasContext *ctx, int mbn, int shn)
+static always_inline void gen_rldicl (DisasContext *ctx, int mbn, int shn)
 {
     uint32_t sh, mb;
 
@@ -1458,7 +1562,7 @@ static inline void gen_rldicl (DisasContext *ctx, int mbn, int shn)
 }
 GEN_PPC64_R4(rldicl, 0x1E, 0x00);
 /* rldicr - rldicr. */
-static inline void gen_rldicr (DisasContext *ctx, int men, int shn)
+static always_inline void gen_rldicr (DisasContext *ctx, int men, int shn)
 {
     uint32_t sh, me;
 
@@ -1468,7 +1572,7 @@ static inline void gen_rldicr (DisasContext *ctx, int men, int shn)
 }
 GEN_PPC64_R4(rldicr, 0x1E, 0x02);
 /* rldic - rldic. */
-static inline void gen_rldic (DisasContext *ctx, int mbn, int shn)
+static always_inline void gen_rldic (DisasContext *ctx, int mbn, int shn)
 {
     uint32_t sh, mb;
 
@@ -1478,7 +1582,8 @@ static inline void gen_rldic (DisasContext *ctx, int mbn, int shn)
 }
 GEN_PPC64_R4(rldic, 0x1E, 0x04);
 
-static inline void gen_rldnm (DisasContext *ctx, uint32_t mb, uint32_t me)
+static always_inline void gen_rldnm (DisasContext *ctx, uint32_t mb,
+                                     uint32_t me)
 {
     gen_op_load_gpr_T0(rS(ctx->opcode));
     gen_op_load_gpr_T1(rB(ctx->opcode));
@@ -1492,7 +1597,7 @@ static inline void gen_rldnm (DisasContext *ctx, uint32_t mb, uint32_t me)
 }
 
 /* rldcl - rldcl. */
-static inline void gen_rldcl (DisasContext *ctx, int mbn)
+static always_inline void gen_rldcl (DisasContext *ctx, int mbn)
 {
     uint32_t mb;
 
@@ -1501,7 +1606,7 @@ static inline void gen_rldcl (DisasContext *ctx, int mbn)
 }
 GEN_PPC64_R2(rldcl, 0x1E, 0x08);
 /* rldcr - rldcr. */
-static inline void gen_rldcr (DisasContext *ctx, int men)
+static always_inline void gen_rldcr (DisasContext *ctx, int men)
 {
     uint32_t me;
 
@@ -1510,20 +1615,18 @@ static inline void gen_rldcr (DisasContext *ctx, int men)
 }
 GEN_PPC64_R2(rldcr, 0x1E, 0x09);
 /* rldimi - rldimi. */
-static inline void gen_rldimi (DisasContext *ctx, int mbn, int shn)
+static always_inline void gen_rldimi (DisasContext *ctx, int mbn, int shn)
 {
     uint64_t mask;
-    uint32_t sh, mb;
+    uint32_t sh, mb, me;
 
     sh = SH(ctx->opcode) | (shn << 5);
     mb = MB(ctx->opcode) | (mbn << 5);
+    me = 63 - sh;
     if (likely(sh == 0)) {
         if (likely(mb == 0)) {
             gen_op_load_gpr_T0(rS(ctx->opcode));
             goto do_store;
-        } else if (likely(mb == 63)) {
-            gen_op_load_gpr_T0(rA(ctx->opcode));
-            goto do_store;
         }
         gen_op_load_gpr_T0(rS(ctx->opcode));
         gen_op_load_gpr_T1(rA(ctx->opcode));
@@ -1533,7 +1636,7 @@ static inline void gen_rldimi (DisasContext *ctx, int mbn, int shn)
     gen_op_load_gpr_T1(rA(ctx->opcode));
     gen_op_rotli64_T0(sh);
  do_mask:
-    mask = MASK(mb, 63 - sh);
+    mask = MASK(mb, me);
     gen_andi_T0_64(ctx, mask);
     gen_andi_T1_64(ctx, ~mask);
     gen_op_or();
@@ -1578,7 +1681,7 @@ __GEN_LOGICAL2(sld, 0x1B, 0x00, PPC_64B);
 /* srad & srad. */
 __GEN_LOGICAL2(srad, 0x1A, 0x18, PPC_64B);
 /* sradi & sradi. */
-static inline void gen_sradi (DisasContext *ctx, int n)
+static always_inline void gen_sradi (DisasContext *ctx, int n)
 {
     uint64_t mask;
     int sh, mb, me;
@@ -1596,11 +1699,11 @@ static inline void gen_sradi (DisasContext *ctx, int n)
     if (unlikely(Rc(ctx->opcode) != 0))
         gen_set_Rc0(ctx);
 }
-GEN_HANDLER(sradi0, 0x1F, 0x1A, 0x19, 0x00000000, PPC_64B)
+GEN_HANDLER2(sradi0, "sradi", 0x1F, 0x1A, 0x19, 0x00000000, PPC_64B)
 {
     gen_sradi(ctx, 0);
 }
-GEN_HANDLER(sradi1, 0x1F, 0x1B, 0x19, 0x00000000, PPC_64B)
+GEN_HANDLER2(sradi1, "sradi", 0x1F, 0x1B, 0x19, 0x00000000, PPC_64B)
 {
     gen_sradi(ctx, 1);
 }
@@ -1609,124 +1712,127 @@ __GEN_LOGICAL2(srd, 0x1B, 0x10, PPC_64B);
 #endif
 
 /***                       Floating-Point arithmetic                       ***/
-#define _GEN_FLOAT_ACB(name, op, op1, op2, isfloat, type)                     \
+#define _GEN_FLOAT_ACB(name, op, op1, op2, isfloat, set_fprf, type)           \
 GEN_HANDLER(f##name, op1, op2, 0xFF, 0x00000000, type)                        \
 {                                                                             \
     if (unlikely(!ctx->fpu_enabled)) {                                        \
         GEN_EXCP_NO_FP(ctx);                                                  \
         return;                                                               \
     }                                                                         \
-    gen_op_reset_scrfx();                                                     \
     gen_op_load_fpr_FT0(rA(ctx->opcode));                                     \
     gen_op_load_fpr_FT1(rC(ctx->opcode));                                     \
     gen_op_load_fpr_FT2(rB(ctx->opcode));                                     \
+    gen_reset_fpstatus();                                                     \
     gen_op_f##op();                                                           \
     if (isfloat) {                                                            \
         gen_op_frsp();                                                        \
     }                                                                         \
     gen_op_store_FT0_fpr(rD(ctx->opcode));                                    \
-    if (unlikely(Rc(ctx->opcode) != 0))                                       \
-        gen_op_set_Rc1();                                                     \
+    gen_compute_fprf(set_fprf, Rc(ctx->opcode) != 0);                         \
 }
 
-#define GEN_FLOAT_ACB(name, op2, type)                                        \
-_GEN_FLOAT_ACB(name, name, 0x3F, op2, 0, type);                               \
-_GEN_FLOAT_ACB(name##s, name, 0x3B, op2, 1, type);
+#define GEN_FLOAT_ACB(name, op2, set_fprf, type)                              \
+_GEN_FLOAT_ACB(name, name, 0x3F, op2, 0, set_fprf, type);                     \
+_GEN_FLOAT_ACB(name##s, name, 0x3B, op2, 1, set_fprf, type);
 
-#define _GEN_FLOAT_AB(name, op, op1, op2, inval, isfloat)                     \
-GEN_HANDLER(f##name, op1, op2, 0xFF, inval, PPC_FLOAT)                        \
+#define _GEN_FLOAT_AB(name, op, op1, op2, inval, isfloat, set_fprf, type)     \
+GEN_HANDLER(f##name, op1, op2, 0xFF, inval, type)                             \
 {                                                                             \
     if (unlikely(!ctx->fpu_enabled)) {                                        \
         GEN_EXCP_NO_FP(ctx);                                                  \
         return;                                                               \
     }                                                                         \
-    gen_op_reset_scrfx();                                                     \
     gen_op_load_fpr_FT0(rA(ctx->opcode));                                     \
     gen_op_load_fpr_FT1(rB(ctx->opcode));                                     \
+    gen_reset_fpstatus();                                                     \
     gen_op_f##op();                                                           \
     if (isfloat) {                                                            \
         gen_op_frsp();                                                        \
     }                                                                         \
     gen_op_store_FT0_fpr(rD(ctx->opcode));                                    \
-    if (unlikely(Rc(ctx->opcode) != 0))                                       \
-        gen_op_set_Rc1();                                                     \
+    gen_compute_fprf(set_fprf, Rc(ctx->opcode) != 0);                         \
 }
-#define GEN_FLOAT_AB(name, op2, inval)                                        \
-_GEN_FLOAT_AB(name, name, 0x3F, op2, inval, 0);                               \
-_GEN_FLOAT_AB(name##s, name, 0x3B, op2, inval, 1);
+#define GEN_FLOAT_AB(name, op2, inval, set_fprf, type)                        \
+_GEN_FLOAT_AB(name, name, 0x3F, op2, inval, 0, set_fprf, type);               \
+_GEN_FLOAT_AB(name##s, name, 0x3B, op2, inval, 1, set_fprf, type);
 
-#define _GEN_FLOAT_AC(name, op, op1, op2, inval, isfloat)                     \
-GEN_HANDLER(f##name, op1, op2, 0xFF, inval, PPC_FLOAT)                        \
+#define _GEN_FLOAT_AC(name, op, op1, op2, inval, isfloat, set_fprf, type)     \
+GEN_HANDLER(f##name, op1, op2, 0xFF, inval, type)                             \
 {                                                                             \
     if (unlikely(!ctx->fpu_enabled)) {                                        \
         GEN_EXCP_NO_FP(ctx);                                                  \
         return;                                                               \
     }                                                                         \
-    gen_op_reset_scrfx();                                                     \
     gen_op_load_fpr_FT0(rA(ctx->opcode));                                     \
     gen_op_load_fpr_FT1(rC(ctx->opcode));                                     \
+    gen_reset_fpstatus();                                                     \
     gen_op_f##op();                                                           \
     if (isfloat) {                                                            \
         gen_op_frsp();                                                        \
     }                                                                         \
     gen_op_store_FT0_fpr(rD(ctx->opcode));                                    \
-    if (unlikely(Rc(ctx->opcode) != 0))                                       \
-        gen_op_set_Rc1();                                                     \
+    gen_compute_fprf(set_fprf, Rc(ctx->opcode) != 0);                         \
 }
-#define GEN_FLOAT_AC(name, op2, inval)                                        \
-_GEN_FLOAT_AC(name, name, 0x3F, op2, inval, 0);                               \
-_GEN_FLOAT_AC(name##s, name, 0x3B, op2, inval, 1);
+#define GEN_FLOAT_AC(name, op2, inval, set_fprf, type)                        \
+_GEN_FLOAT_AC(name, name, 0x3F, op2, inval, 0, set_fprf, type);               \
+_GEN_FLOAT_AC(name##s, name, 0x3B, op2, inval, 1, set_fprf, type);
 
-#define GEN_FLOAT_B(name, op2, op3, type)                                     \
+#define GEN_FLOAT_B(name, op2, op3, set_fprf, type)                           \
 GEN_HANDLER(f##name, 0x3F, op2, op3, 0x001F0000, type)                        \
 {                                                                             \
     if (unlikely(!ctx->fpu_enabled)) {                                        \
         GEN_EXCP_NO_FP(ctx);                                                  \
         return;                                                               \
     }                                                                         \
-    gen_op_reset_scrfx();                                                     \
     gen_op_load_fpr_FT0(rB(ctx->opcode));                                     \
+    gen_reset_fpstatus();                                                     \
     gen_op_f##name();                                                         \
     gen_op_store_FT0_fpr(rD(ctx->opcode));                                    \
-    if (unlikely(Rc(ctx->opcode) != 0))                                       \
-        gen_op_set_Rc1();                                                     \
+    gen_compute_fprf(set_fprf, Rc(ctx->opcode) != 0);                         \
 }
 
-#define GEN_FLOAT_BS(name, op1, op2, type)                                    \
+#define GEN_FLOAT_BS(name, op1, op2, set_fprf, type)                          \
 GEN_HANDLER(f##name, op1, op2, 0xFF, 0x001F07C0, type)                        \
 {                                                                             \
     if (unlikely(!ctx->fpu_enabled)) {                                        \
         GEN_EXCP_NO_FP(ctx);                                                  \
         return;                                                               \
     }                                                                         \
-    gen_op_reset_scrfx();                                                     \
     gen_op_load_fpr_FT0(rB(ctx->opcode));                                     \
+    gen_reset_fpstatus();                                                     \
     gen_op_f##name();                                                         \
     gen_op_store_FT0_fpr(rD(ctx->opcode));                                    \
-    if (unlikely(Rc(ctx->opcode) != 0))                                       \
-        gen_op_set_Rc1();                                                     \
+    gen_compute_fprf(set_fprf, Rc(ctx->opcode) != 0);                         \
 }
 
 /* fadd - fadds */
-GEN_FLOAT_AB(add, 0x15, 0x000007C0);
+GEN_FLOAT_AB(add, 0x15, 0x000007C0, 1, PPC_FLOAT);
 /* fdiv - fdivs */
-GEN_FLOAT_AB(div, 0x12, 0x000007C0);
+GEN_FLOAT_AB(div, 0x12, 0x000007C0, 1, PPC_FLOAT);
 /* fmul - fmuls */
-GEN_FLOAT_AC(mul, 0x19, 0x0000F800);
+GEN_FLOAT_AC(mul, 0x19, 0x0000F800, 1, PPC_FLOAT);
 
 /* fre */
-GEN_FLOAT_BS(re, 0x3F, 0x18, PPC_FLOAT_EXT);
+GEN_FLOAT_BS(re, 0x3F, 0x18, 1, PPC_FLOAT_EXT);
 
 /* fres */
-GEN_FLOAT_BS(res, 0x3B, 0x18, PPC_FLOAT_FRES);
+GEN_FLOAT_BS(res, 0x3B, 0x18, 1, PPC_FLOAT_FRES);
 
 /* frsqrte */
-GEN_FLOAT_BS(rsqrte, 0x3F, 0x1A, PPC_FLOAT_FRSQRTE);
+GEN_FLOAT_BS(rsqrte, 0x3F, 0x1A, 1, PPC_FLOAT_FRSQRTE);
+
+/* frsqrtes */
+static always_inline void gen_op_frsqrtes (void)
+{
+    gen_op_frsqrte();
+    gen_op_frsp();
+}
+GEN_FLOAT_BS(rsqrtes, 0x3B, 0x1A, 1, PPC_FLOAT_FRSQRTES);
 
 /* fsel */
-_GEN_FLOAT_ACB(sel, sel, 0x3F, 0x17, 0, PPC_FLOAT_FSEL);
+_GEN_FLOAT_ACB(sel, sel, 0x3F, 0x17, 0, 0, PPC_FLOAT_FSEL);
 /* fsub - fsubs */
-GEN_FLOAT_AB(sub, 0x14, 0x000007C0);
+GEN_FLOAT_AB(sub, 0x14, 0x000007C0, 1, PPC_FLOAT);
 /* Optional: */
 /* fsqrt */
 GEN_HANDLER(fsqrt, 0x3F, 0x16, 0xFF, 0x001F07C0, PPC_FLOAT_FSQRT)
@@ -1735,12 +1841,11 @@ GEN_HANDLER(fsqrt, 0x3F, 0x16, 0xFF, 0x001F07C0, PPC_FLOAT_FSQRT)
         GEN_EXCP_NO_FP(ctx);
         return;
     }
-    gen_op_reset_scrfx();
     gen_op_load_fpr_FT0(rB(ctx->opcode));
+    gen_reset_fpstatus();
     gen_op_fsqrt();
     gen_op_store_FT0_fpr(rD(ctx->opcode));
-    if (unlikely(Rc(ctx->opcode) != 0))
-        gen_op_set_Rc1();
+    gen_compute_fprf(1, Rc(ctx->opcode) != 0);
 }
 
 GEN_HANDLER(fsqrts, 0x3B, 0x16, 0xFF, 0x001F07C0, PPC_FLOAT_FSQRT)
@@ -1749,49 +1854,48 @@ GEN_HANDLER(fsqrts, 0x3B, 0x16, 0xFF, 0x001F07C0, PPC_FLOAT_FSQRT)
         GEN_EXCP_NO_FP(ctx);
         return;
     }
-    gen_op_reset_scrfx();
     gen_op_load_fpr_FT0(rB(ctx->opcode));
+    gen_reset_fpstatus();
     gen_op_fsqrt();
     gen_op_frsp();
     gen_op_store_FT0_fpr(rD(ctx->opcode));
-    if (unlikely(Rc(ctx->opcode) != 0))
-        gen_op_set_Rc1();
+    gen_compute_fprf(1, Rc(ctx->opcode) != 0);
 }
 
 /***                     Floating-Point multiply-and-add                   ***/
 /* fmadd - fmadds */
-GEN_FLOAT_ACB(madd, 0x1D, PPC_FLOAT);
+GEN_FLOAT_ACB(madd, 0x1D, 1, PPC_FLOAT);
 /* fmsub - fmsubs */
-GEN_FLOAT_ACB(msub, 0x1C, PPC_FLOAT);
+GEN_FLOAT_ACB(msub, 0x1C, 1, PPC_FLOAT);
 /* fnmadd - fnmadds */
-GEN_FLOAT_ACB(nmadd, 0x1F, PPC_FLOAT);
+GEN_FLOAT_ACB(nmadd, 0x1F, 1, PPC_FLOAT);
 /* fnmsub - fnmsubs */
-GEN_FLOAT_ACB(nmsub, 0x1E, PPC_FLOAT);
+GEN_FLOAT_ACB(nmsub, 0x1E, 1, PPC_FLOAT);
 
 /***                     Floating-Point round & convert                    ***/
 /* fctiw */
-GEN_FLOAT_B(ctiw, 0x0E, 0x00, PPC_FLOAT);
+GEN_FLOAT_B(ctiw, 0x0E, 0x00, 0, PPC_FLOAT);
 /* fctiwz */
-GEN_FLOAT_B(ctiwz, 0x0F, 0x00, PPC_FLOAT);
+GEN_FLOAT_B(ctiwz, 0x0F, 0x00, 0, PPC_FLOAT);
 /* frsp */
-GEN_FLOAT_B(rsp, 0x0C, 0x00, PPC_FLOAT);
+GEN_FLOAT_B(rsp, 0x0C, 0x00, 1, PPC_FLOAT);
 #if defined(TARGET_PPC64)
 /* fcfid */
-GEN_FLOAT_B(cfid, 0x0E, 0x1A, PPC_64B);
+GEN_FLOAT_B(cfid, 0x0E, 0x1A, 1, PPC_64B);
 /* fctid */
-GEN_FLOAT_B(ctid, 0x0E, 0x19, PPC_64B);
+GEN_FLOAT_B(ctid, 0x0E, 0x19, 0, PPC_64B);
 /* fctidz */
-GEN_FLOAT_B(ctidz, 0x0F, 0x19, PPC_64B);
+GEN_FLOAT_B(ctidz, 0x0F, 0x19, 0, PPC_64B);
 #endif
 
 /* frin */
-GEN_FLOAT_B(rin, 0x08, 0x0C, PPC_FLOAT_EXT);
+GEN_FLOAT_B(rin, 0x08, 0x0C, 1, PPC_FLOAT_EXT);
 /* friz */
-GEN_FLOAT_B(riz, 0x08, 0x0D, PPC_FLOAT_EXT);
+GEN_FLOAT_B(riz, 0x08, 0x0D, 1, PPC_FLOAT_EXT);
 /* frip */
-GEN_FLOAT_B(rip, 0x08, 0x0E, PPC_FLOAT_EXT);
+GEN_FLOAT_B(rip, 0x08, 0x0E, 1, PPC_FLOAT_EXT);
 /* frim */
-GEN_FLOAT_B(rim, 0x08, 0x0F, PPC_FLOAT_EXT);
+GEN_FLOAT_B(rim, 0x08, 0x0F, 1, PPC_FLOAT_EXT);
 
 /***                         Floating-Point compare                        ***/
 /* fcmpo */
@@ -1801,11 +1905,12 @@ GEN_HANDLER(fcmpo, 0x3F, 0x00, 0x01, 0x00600001, PPC_FLOAT)
         GEN_EXCP_NO_FP(ctx);
         return;
     }
-    gen_op_reset_scrfx();
     gen_op_load_fpr_FT0(rA(ctx->opcode));
     gen_op_load_fpr_FT1(rB(ctx->opcode));
+    gen_reset_fpstatus();
     gen_op_fcmpo();
     gen_op_store_T0_crf(crfD(ctx->opcode));
+    gen_op_float_check_status();
 }
 
 /* fcmpu */
@@ -1815,47 +1920,54 @@ GEN_HANDLER(fcmpu, 0x3F, 0x00, 0x00, 0x00600001, PPC_FLOAT)
         GEN_EXCP_NO_FP(ctx);
         return;
     }
-    gen_op_reset_scrfx();
     gen_op_load_fpr_FT0(rA(ctx->opcode));
     gen_op_load_fpr_FT1(rB(ctx->opcode));
+    gen_reset_fpstatus();
     gen_op_fcmpu();
     gen_op_store_T0_crf(crfD(ctx->opcode));
+    gen_op_float_check_status();
 }
 
 /***                         Floating-point move                           ***/
 /* fabs */
-GEN_FLOAT_B(abs, 0x08, 0x08, PPC_FLOAT);
+/* XXX: beware that fabs never checks for NaNs nor update FPSCR */
+GEN_FLOAT_B(abs, 0x08, 0x08, 0, PPC_FLOAT);
 
 /* fmr  - fmr. */
+/* XXX: beware that fmr never checks for NaNs nor update FPSCR */
 GEN_HANDLER(fmr, 0x3F, 0x08, 0x02, 0x001F0000, PPC_FLOAT)
 {
     if (unlikely(!ctx->fpu_enabled)) {
         GEN_EXCP_NO_FP(ctx);
         return;
     }
-    gen_op_reset_scrfx();
     gen_op_load_fpr_FT0(rB(ctx->opcode));
     gen_op_store_FT0_fpr(rD(ctx->opcode));
-    if (unlikely(Rc(ctx->opcode) != 0))
-        gen_op_set_Rc1();
+    gen_compute_fprf(0, Rc(ctx->opcode) != 0);
 }
 
 /* fnabs */
-GEN_FLOAT_B(nabs, 0x08, 0x04, PPC_FLOAT);
+/* XXX: beware that fnabs never checks for NaNs nor update FPSCR */
+GEN_FLOAT_B(nabs, 0x08, 0x04, 0, PPC_FLOAT);
 /* fneg */
-GEN_FLOAT_B(neg, 0x08, 0x01, PPC_FLOAT);
+/* XXX: beware that fneg never checks for NaNs nor update FPSCR */
+GEN_FLOAT_B(neg, 0x08, 0x01, 0, PPC_FLOAT);
 
 /***                  Floating-Point status & ctrl register                ***/
 /* mcrfs */
 GEN_HANDLER(mcrfs, 0x3F, 0x00, 0x02, 0x0063F801, PPC_FLOAT)
 {
+    int bfa;
+
     if (unlikely(!ctx->fpu_enabled)) {
         GEN_EXCP_NO_FP(ctx);
         return;
     }
-    gen_op_load_fpscr_T0(crfS(ctx->opcode));
+    gen_optimize_fprf();
+    bfa = 4 * (7 - crfS(ctx->opcode));
+    gen_op_load_fpscr_T0(bfa);
     gen_op_store_T0_crf(crfD(ctx->opcode));
-    gen_op_clear_fpscr(crfS(ctx->opcode));
+    gen_op_fpscr_resetbit(~(0xF << bfa));
 }
 
 /* mffs */
@@ -1865,10 +1977,11 @@ GEN_HANDLER(mffs, 0x3F, 0x07, 0x12, 0x001FF800, PPC_FLOAT)
         GEN_EXCP_NO_FP(ctx);
         return;
     }
-    gen_op_load_fpscr();
+    gen_optimize_fprf();
+    gen_reset_fpstatus();
+    gen_op_load_fpscr_FT0();
     gen_op_store_FT0_fpr(rD(ctx->opcode));
-    if (unlikely(Rc(ctx->opcode) != 0))
-        gen_op_set_Rc1();
+    gen_compute_fprf(0, Rc(ctx->opcode) != 0);
 }
 
 /* mtfsb0 */
@@ -1880,12 +1993,15 @@ GEN_HANDLER(mtfsb0, 0x3F, 0x06, 0x02, 0x001FF800, PPC_FLOAT)
         GEN_EXCP_NO_FP(ctx);
         return;
     }
-    crb = crbD(ctx->opcode) >> 2;
-    gen_op_load_fpscr_T0(crb);
-    gen_op_andi_T0(~(1 << (crbD(ctx->opcode) & 0x03)));
-    gen_op_store_T0_fpscr(crb);
-    if (unlikely(Rc(ctx->opcode) != 0))
-        gen_op_set_Rc1();
+    crb = 32 - (crbD(ctx->opcode) >> 2);
+    gen_optimize_fprf();
+    gen_reset_fpstatus();
+    if (likely(crb != 30 && crb != 29))
+        gen_op_fpscr_resetbit(~(1 << crb));
+    if (unlikely(Rc(ctx->opcode) != 0)) {
+        gen_op_load_fpcc();
+        gen_op_set_Rc0();
+    }
 }
 
 /* mtfsb1 */
@@ -1897,12 +2013,18 @@ GEN_HANDLER(mtfsb1, 0x3F, 0x06, 0x01, 0x001FF800, PPC_FLOAT)
         GEN_EXCP_NO_FP(ctx);
         return;
     }
-    crb = crbD(ctx->opcode) >> 2;
-    gen_op_load_fpscr_T0(crb);
-    gen_op_ori(1 << (crbD(ctx->opcode) & 0x03));
-    gen_op_store_T0_fpscr(crb);
-    if (unlikely(Rc(ctx->opcode) != 0))
-        gen_op_set_Rc1();
+    crb = 32 - (crbD(ctx->opcode) >> 2);
+    gen_optimize_fprf();
+    gen_reset_fpstatus();
+    /* XXX: we pretend we can only do IEEE floating-point computations */
+    if (likely(crb != FPSCR_FEX && crb != FPSCR_VX && crb != FPSCR_NI))
+        gen_op_fpscr_setbit(crb);
+    if (unlikely(Rc(ctx->opcode) != 0)) {
+        gen_op_load_fpcc();
+        gen_op_set_Rc0();
+    }
+    /* We can raise a differed exception */
+    gen_op_float_check_status();
 }
 
 /* mtfsf */
@@ -1912,27 +2034,45 @@ GEN_HANDLER(mtfsf, 0x3F, 0x07, 0x16, 0x02010000, PPC_FLOAT)
         GEN_EXCP_NO_FP(ctx);
         return;
     }
+    gen_optimize_fprf();
     gen_op_load_fpr_FT0(rB(ctx->opcode));
+    gen_reset_fpstatus();
     gen_op_store_fpscr(FM(ctx->opcode));
-    if (unlikely(Rc(ctx->opcode) != 0))
-        gen_op_set_Rc1();
+    if (unlikely(Rc(ctx->opcode) != 0)) {
+        gen_op_load_fpcc();
+        gen_op_set_Rc0();
+    }
+    /* We can raise a differed exception */
+    gen_op_float_check_status();
 }
 
 /* mtfsfi */
 GEN_HANDLER(mtfsfi, 0x3F, 0x06, 0x04, 0x006f0800, PPC_FLOAT)
 {
+    int bf, sh;
+
     if (unlikely(!ctx->fpu_enabled)) {
         GEN_EXCP_NO_FP(ctx);
         return;
     }
-    gen_op_store_T0_fpscri(crbD(ctx->opcode) >> 2, FPIMM(ctx->opcode));
-    if (unlikely(Rc(ctx->opcode) != 0))
-        gen_op_set_Rc1();
+    bf = crbD(ctx->opcode) >> 2;
+    sh = 7 - bf;
+    gen_optimize_fprf();
+    gen_op_set_FT0(FPIMM(ctx->opcode) << (4 * sh));
+    gen_reset_fpstatus();
+    gen_op_store_fpscr(1 << sh);
+    if (unlikely(Rc(ctx->opcode) != 0)) {
+        gen_op_load_fpcc();
+        gen_op_set_Rc0();
+    }
+    /* We can raise a differed exception */
+    gen_op_float_check_status();
 }
 
 /***                           Addressing modes                            ***/
 /* Register indirect with immediate index : EA = (rA|0) + SIMM */
-static inline void gen_addr_imm_index (DisasContext *ctx, target_long maskl)
+static always_inline void gen_addr_imm_index (DisasContext *ctx,
+                                              target_long maskl)
 {
     target_long simm = SIMM(ctx->opcode);
 
@@ -1949,7 +2089,7 @@ static inline void gen_addr_imm_index (DisasContext *ctx, target_long maskl)
 #endif
 }
 
-static inline void gen_addr_reg_index (DisasContext *ctx)
+static always_inline void gen_addr_reg_index (DisasContext *ctx)
 {
     if (rA(ctx->opcode) == 0) {
         gen_op_load_gpr_T0(rB(ctx->opcode));
@@ -1963,7 +2103,7 @@ static inline void gen_addr_reg_index (DisasContext *ctx)
 #endif
 }
 
-static inline void gen_addr_register (DisasContext *ctx)
+static always_inline void gen_addr_register (DisasContext *ctx)
 {
     if (rA(ctx->opcode) == 0) {
         gen_op_reset_T0();
@@ -1975,93 +2115,64 @@ static inline void gen_addr_register (DisasContext *ctx)
 #endif
 }
 
-/***                             Integer load                              ***/
-#define op_ldst(name)        (*gen_op_##name[ctx->mem_idx])()
+#if defined(TARGET_PPC64)
+#define _GEN_MEM_FUNCS(name, mode)                                            \
+    &gen_op_##name##_##mode,                                                  \
+    &gen_op_##name##_le_##mode,                                               \
+    &gen_op_##name##_64_##mode,                                               \
+    &gen_op_##name##_le_64_##mode
+#else
+#define _GEN_MEM_FUNCS(name, mode)                                            \
+    &gen_op_##name##_##mode,                                                  \
+    &gen_op_##name##_le_##mode
+#endif
 #if defined(CONFIG_USER_ONLY)
 #if defined(TARGET_PPC64)
-#define OP_LD_TABLE(width)                                                    \
-static GenOpFunc *gen_op_l##width[] = {                                       \
-    &gen_op_l##width##_raw,                                                   \
-    &gen_op_l##width##_le_raw,                                                \
-    &gen_op_l##width##_64_raw,                                                \
-    &gen_op_l##width##_le_64_raw,                                             \
-};
-#define OP_ST_TABLE(width)                                                    \
-static GenOpFunc *gen_op_st##width[] = {                                      \
-    &gen_op_st##width##_raw,                                                  \
-    &gen_op_st##width##_le_raw,                                               \
-    &gen_op_st##width##_64_raw,                                               \
-    &gen_op_st##width##_le_64_raw,                                            \
-};
-/* Byte access routine are endian safe */
-#define gen_op_stb_le_64_raw gen_op_stb_64_raw
-#define gen_op_lbz_le_64_raw gen_op_lbz_64_raw
+#define NB_MEM_FUNCS 4
 #else
-#define OP_LD_TABLE(width)                                                    \
-static GenOpFunc *gen_op_l##width[] = {                                       \
-    &gen_op_l##width##_raw,                                                   \
-    &gen_op_l##width##_le_raw,                                                \
-};
-#define OP_ST_TABLE(width)                                                    \
-static GenOpFunc *gen_op_st##width[] = {                                      \
-    &gen_op_st##width##_raw,                                                  \
-    &gen_op_st##width##_le_raw,                                               \
-};
+#define NB_MEM_FUNCS 2
 #endif
-/* Byte access routine are endian safe */
-#define gen_op_stb_le_raw gen_op_stb_raw
-#define gen_op_lbz_le_raw gen_op_lbz_raw
+#define GEN_MEM_FUNCS(name)                                                   \
+    _GEN_MEM_FUNCS(name, raw)
 #else
 #if defined(TARGET_PPC64)
-#define OP_LD_TABLE(width)                                                    \
-static GenOpFunc *gen_op_l##width[] = {                                       \
-    &gen_op_l##width##_user,                                                  \
-    &gen_op_l##width##_le_user,                                               \
-    &gen_op_l##width##_kernel,                                                \
-    &gen_op_l##width##_le_kernel,                                             \
-    &gen_op_l##width##_64_user,                                               \
-    &gen_op_l##width##_le_64_user,                                            \
-    &gen_op_l##width##_64_kernel,                                             \
-    &gen_op_l##width##_le_64_kernel,                                          \
-};
-#define OP_ST_TABLE(width)                                                    \
-static GenOpFunc *gen_op_st##width[] = {                                      \
-    &gen_op_st##width##_user,                                                 \
-    &gen_op_st##width##_le_user,                                              \
-    &gen_op_st##width##_kernel,                                               \
-    &gen_op_st##width##_le_kernel,                                            \
-    &gen_op_st##width##_64_user,                                              \
-    &gen_op_st##width##_le_64_user,                                           \
-    &gen_op_st##width##_64_kernel,                                            \
-    &gen_op_st##width##_le_64_kernel,                                         \
-};
+#define NB_MEM_FUNCS 12
+#else
+#define NB_MEM_FUNCS 6
+#endif
+#define GEN_MEM_FUNCS(name)                                                   \
+    _GEN_MEM_FUNCS(name, user),                                               \
+    _GEN_MEM_FUNCS(name, kernel),                                             \
+    _GEN_MEM_FUNCS(name, hypv)
+#endif
+
+/***                             Integer load                              ***/
+#define op_ldst(name)        (*gen_op_##name[ctx->mem_idx])()
 /* Byte access routine are endian safe */
-#define gen_op_stb_le_64_user gen_op_stb_64_user
-#define gen_op_lbz_le_64_user gen_op_lbz_64_user
-#define gen_op_stb_le_64_kernel gen_op_stb_64_kernel
+#define gen_op_lbz_le_raw       gen_op_lbz_raw
+#define gen_op_lbz_le_user      gen_op_lbz_user
+#define gen_op_lbz_le_kernel    gen_op_lbz_kernel
+#define gen_op_lbz_le_hypv      gen_op_lbz_hypv
+#define gen_op_lbz_le_64_raw    gen_op_lbz_64_raw
+#define gen_op_lbz_le_64_user   gen_op_lbz_64_user
 #define gen_op_lbz_le_64_kernel gen_op_lbz_64_kernel
-#else
+#define gen_op_lbz_le_64_hypv   gen_op_lbz_64_hypv
+#define gen_op_stb_le_raw       gen_op_stb_raw
+#define gen_op_stb_le_user      gen_op_stb_user
+#define gen_op_stb_le_kernel    gen_op_stb_kernel
+#define gen_op_stb_le_hypv      gen_op_stb_hypv
+#define gen_op_stb_le_64_raw    gen_op_stb_64_raw
+#define gen_op_stb_le_64_user   gen_op_stb_64_user
+#define gen_op_stb_le_64_kernel gen_op_stb_64_kernel
+#define gen_op_stb_le_64_hypv   gen_op_stb_64_hypv
 #define OP_LD_TABLE(width)                                                    \
-static GenOpFunc *gen_op_l##width[] = {                                       \
-    &gen_op_l##width##_user,                                                  \
-    &gen_op_l##width##_le_user,                                               \
-    &gen_op_l##width##_kernel,                                                \
-    &gen_op_l##width##_le_kernel,                                             \
+static GenOpFunc *gen_op_l##width[NB_MEM_FUNCS] = {                           \
+    GEN_MEM_FUNCS(l##width),                                                  \
 };
 #define OP_ST_TABLE(width)                                                    \
-static GenOpFunc *gen_op_st##width[] = {                                      \
-    &gen_op_st##width##_user,                                                 \
-    &gen_op_st##width##_le_user,                                              \
-    &gen_op_st##width##_kernel,                                               \
-    &gen_op_st##width##_le_kernel,                                            \
+static GenOpFunc *gen_op_st##width[NB_MEM_FUNCS] = {                          \
+    GEN_MEM_FUNCS(st##width),                                                 \
 };
-#endif
-/* Byte access routine are endian safe */
-#define gen_op_stb_le_user gen_op_stb_user
-#define gen_op_lbz_le_user gen_op_lbz_user
-#define gen_op_stb_le_kernel gen_op_stb_kernel
-#define gen_op_lbz_le_kernel gen_op_lbz_kernel
-#endif
 
 #define GEN_LD(width, opc, type)                                              \
 GEN_HANDLER(l##width, opc, 0xFF, 0xFF, 0x00000000, type)                      \
@@ -2316,65 +2427,12 @@ GEN_STX(wbr, 0x16, 0x14, PPC_INTEGER);
 
 /***                    Integer load and store multiple                    ***/
 #define op_ldstm(name, reg) (*gen_op_##name[ctx->mem_idx])(reg)
-#if defined(TARGET_PPC64)
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc1 *gen_op_lmw[] = {
-    &gen_op_lmw_raw,
-    &gen_op_lmw_le_raw,
-    &gen_op_lmw_64_raw,
-    &gen_op_lmw_le_64_raw,
-};
-static GenOpFunc1 *gen_op_stmw[] = {
-    &gen_op_stmw_64_raw,
-    &gen_op_stmw_le_64_raw,
-};
-#else
-static GenOpFunc1 *gen_op_lmw[] = {
-    &gen_op_lmw_user,
-    &gen_op_lmw_le_user,
-    &gen_op_lmw_kernel,
-    &gen_op_lmw_le_kernel,
-    &gen_op_lmw_64_user,
-    &gen_op_lmw_le_64_user,
-    &gen_op_lmw_64_kernel,
-    &gen_op_lmw_le_64_kernel,
+static GenOpFunc1 *gen_op_lmw[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(lmw),
 };
-static GenOpFunc1 *gen_op_stmw[] = {
-    &gen_op_stmw_user,
-    &gen_op_stmw_le_user,
-    &gen_op_stmw_kernel,
-    &gen_op_stmw_le_kernel,
-    &gen_op_stmw_64_user,
-    &gen_op_stmw_le_64_user,
-    &gen_op_stmw_64_kernel,
-    &gen_op_stmw_le_64_kernel,
-};
-#endif
-#else
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc1 *gen_op_lmw[] = {
-    &gen_op_lmw_raw,
-    &gen_op_lmw_le_raw,
-};
-static GenOpFunc1 *gen_op_stmw[] = {
-    &gen_op_stmw_raw,
-    &gen_op_stmw_le_raw,
-};
-#else
-static GenOpFunc1 *gen_op_lmw[] = {
-    &gen_op_lmw_user,
-    &gen_op_lmw_le_user,
-    &gen_op_lmw_kernel,
-    &gen_op_lmw_le_kernel,
+static GenOpFunc1 *gen_op_stmw[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(stmw),
 };
-static GenOpFunc1 *gen_op_stmw[] = {
-    &gen_op_stmw_user,
-    &gen_op_stmw_le_user,
-    &gen_op_stmw_kernel,
-    &gen_op_stmw_le_kernel,
-};
-#endif
-#endif
 
 /* lmw */
 GEN_HANDLER(lmw, 0x2E, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
@@ -2397,93 +2455,40 @@ GEN_HANDLER(stmw, 0x2F, 0xFF, 0xFF, 0x00000000, PPC_INTEGER)
 /***                    Integer load and store strings                     ***/
 #define op_ldsts(name, start) (*gen_op_##name[ctx->mem_idx])(start)
 #define op_ldstsx(name, rd, ra, rb) (*gen_op_##name[ctx->mem_idx])(rd, ra, rb)
-#if defined(TARGET_PPC64)
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc1 *gen_op_lswi[] = {
-    &gen_op_lswi_raw,
-    &gen_op_lswi_le_raw,
-    &gen_op_lswi_64_raw,
-    &gen_op_lswi_le_64_raw,
-};
-static GenOpFunc3 *gen_op_lswx[] = {
-    &gen_op_lswx_raw,
-    &gen_op_lswx_le_raw,
-    &gen_op_lswx_64_raw,
-    &gen_op_lswx_le_64_raw,
-};
-static GenOpFunc1 *gen_op_stsw[] = {
-    &gen_op_stsw_raw,
-    &gen_op_stsw_le_raw,
-    &gen_op_stsw_64_raw,
-    &gen_op_stsw_le_64_raw,
+/* string load & stores are by definition endian-safe */
+#define gen_op_lswi_le_raw       gen_op_lswi_raw
+#define gen_op_lswi_le_user      gen_op_lswi_user
+#define gen_op_lswi_le_kernel    gen_op_lswi_kernel
+#define gen_op_lswi_le_hypv      gen_op_lswi_hypv
+#define gen_op_lswi_le_64_raw    gen_op_lswi_raw
+#define gen_op_lswi_le_64_user   gen_op_lswi_user
+#define gen_op_lswi_le_64_kernel gen_op_lswi_kernel
+#define gen_op_lswi_le_64_hypv   gen_op_lswi_hypv
+static GenOpFunc1 *gen_op_lswi[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(lswi),
 };
-#else
-static GenOpFunc1 *gen_op_lswi[] = {
-    &gen_op_lswi_user,
-    &gen_op_lswi_le_user,
-    &gen_op_lswi_kernel,
-    &gen_op_lswi_le_kernel,
-    &gen_op_lswi_64_user,
-    &gen_op_lswi_le_64_user,
-    &gen_op_lswi_64_kernel,
-    &gen_op_lswi_le_64_kernel,
-};
-static GenOpFunc3 *gen_op_lswx[] = {
-    &gen_op_lswx_user,
-    &gen_op_lswx_le_user,
-    &gen_op_lswx_kernel,
-    &gen_op_lswx_le_kernel,
-    &gen_op_lswx_64_user,
-    &gen_op_lswx_le_64_user,
-    &gen_op_lswx_64_kernel,
-    &gen_op_lswx_le_64_kernel,
-};
-static GenOpFunc1 *gen_op_stsw[] = {
-    &gen_op_stsw_user,
-    &gen_op_stsw_le_user,
-    &gen_op_stsw_kernel,
-    &gen_op_stsw_le_kernel,
-    &gen_op_stsw_64_user,
-    &gen_op_stsw_le_64_user,
-    &gen_op_stsw_64_kernel,
-    &gen_op_stsw_le_64_kernel,
-};
-#endif
-#else
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc1 *gen_op_lswi[] = {
-    &gen_op_lswi_raw,
-    &gen_op_lswi_le_raw,
+#define gen_op_lswx_le_raw       gen_op_lswx_raw
+#define gen_op_lswx_le_user      gen_op_lswx_user
+#define gen_op_lswx_le_kernel    gen_op_lswx_kernel
+#define gen_op_lswx_le_hypv      gen_op_lswx_hypv
+#define gen_op_lswx_le_64_raw    gen_op_lswx_raw
+#define gen_op_lswx_le_64_user   gen_op_lswx_user
+#define gen_op_lswx_le_64_kernel gen_op_lswx_kernel
+#define gen_op_lswx_le_64_hypv   gen_op_lswx_hypv
+static GenOpFunc3 *gen_op_lswx[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(lswx),
 };
-static GenOpFunc3 *gen_op_lswx[] = {
-    &gen_op_lswx_raw,
-    &gen_op_lswx_le_raw,
+#define gen_op_stsw_le_raw       gen_op_stsw_raw
+#define gen_op_stsw_le_user      gen_op_stsw_user
+#define gen_op_stsw_le_kernel    gen_op_stsw_kernel
+#define gen_op_stsw_le_hypv      gen_op_stsw_hypv
+#define gen_op_stsw_le_64_raw    gen_op_stsw_raw
+#define gen_op_stsw_le_64_user   gen_op_stsw_user
+#define gen_op_stsw_le_64_kernel gen_op_stsw_kernel
+#define gen_op_stsw_le_64_hypv   gen_op_stsw_hypv
+static GenOpFunc1 *gen_op_stsw[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(stsw),
 };
-static GenOpFunc1 *gen_op_stsw[] = {
-    &gen_op_stsw_raw,
-    &gen_op_stsw_le_raw,
-};
-#else
-static GenOpFunc1 *gen_op_lswi[] = {
-    &gen_op_lswi_user,
-    &gen_op_lswi_le_user,
-    &gen_op_lswi_kernel,
-    &gen_op_lswi_le_kernel,
-};
-static GenOpFunc3 *gen_op_lswx[] = {
-    &gen_op_lswx_user,
-    &gen_op_lswx_le_user,
-    &gen_op_lswx_kernel,
-    &gen_op_lswx_le_kernel,
-};
-static GenOpFunc1 *gen_op_stsw[] = {
-    &gen_op_stsw_user,
-    &gen_op_stsw_le_user,
-    &gen_op_stsw_kernel,
-    &gen_op_stsw_le_kernel,
-};
-#endif
-#endif
 
 /* lswi */
 /* PowerPC32 specification says we must generate an exception if
@@ -2491,7 +2496,7 @@ static GenOpFunc1 *gen_op_stsw[] = {
  * In an other hand, IBM says this is valid, but rA won't be loaded.
  * For now, I'll follow the spec...
  */
-GEN_HANDLER(lswi, 0x1F, 0x15, 0x12, 0x00000001, PPC_INTEGER)
+GEN_HANDLER(lswi, 0x1F, 0x15, 0x12, 0x00000001, PPC_STRING)
 {
     int nb = NB(ctx->opcode);
     int start = rD(ctx->opcode);
@@ -2516,7 +2521,7 @@ GEN_HANDLER(lswi, 0x1F, 0x15, 0x12, 0x00000001, PPC_INTEGER)
 }
 
 /* lswx */
-GEN_HANDLER(lswx, 0x1F, 0x15, 0x10, 0x00000001, PPC_INTEGER)
+GEN_HANDLER(lswx, 0x1F, 0x15, 0x10, 0x00000001, PPC_STRING)
 {
     int ra = rA(ctx->opcode);
     int rb = rB(ctx->opcode);
@@ -2532,7 +2537,7 @@ GEN_HANDLER(lswx, 0x1F, 0x15, 0x10, 0x00000001, PPC_INTEGER)
 }
 
 /* stswi */
-GEN_HANDLER(stswi, 0x1F, 0x15, 0x16, 0x00000001, PPC_INTEGER)
+GEN_HANDLER(stswi, 0x1F, 0x15, 0x16, 0x00000001, PPC_STRING)
 {
     int nb = NB(ctx->opcode);
 
@@ -2546,7 +2551,7 @@ GEN_HANDLER(stswi, 0x1F, 0x15, 0x16, 0x00000001, PPC_INTEGER)
 }
 
 /* stswx */
-GEN_HANDLER(stswx, 0x1F, 0x15, 0x14, 0x00000001, PPC_INTEGER)
+GEN_HANDLER(stswx, 0x1F, 0x15, 0x14, 0x00000001, PPC_STRING)
 {
     /* NIP cannot be restored if the memory exception comes from an helper */
     gen_update_nip(ctx, ctx->nip - 4);
@@ -2569,67 +2574,12 @@ GEN_HANDLER(isync, 0x13, 0x16, 0x04, 0x03FFF801, PPC_MEM)
 
 #define op_lwarx() (*gen_op_lwarx[ctx->mem_idx])()
 #define op_stwcx() (*gen_op_stwcx[ctx->mem_idx])()
-#if defined(TARGET_PPC64)
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc *gen_op_lwarx[] = {
-    &gen_op_lwarx_raw,
-    &gen_op_lwarx_le_raw,
-    &gen_op_lwarx_64_raw,
-    &gen_op_lwarx_le_64_raw,
-};
-static GenOpFunc *gen_op_stwcx[] = {
-    &gen_op_stwcx_raw,
-    &gen_op_stwcx_le_raw,
-    &gen_op_stwcx_64_raw,
-    &gen_op_stwcx_le_64_raw,
-};
-#else
-static GenOpFunc *gen_op_lwarx[] = {
-    &gen_op_lwarx_user,
-    &gen_op_lwarx_le_user,
-    &gen_op_lwarx_kernel,
-    &gen_op_lwarx_le_kernel,
-    &gen_op_lwarx_64_user,
-    &gen_op_lwarx_le_64_user,
-    &gen_op_lwarx_64_kernel,
-    &gen_op_lwarx_le_64_kernel,
-};
-static GenOpFunc *gen_op_stwcx[] = {
-    &gen_op_stwcx_user,
-    &gen_op_stwcx_le_user,
-    &gen_op_stwcx_kernel,
-    &gen_op_stwcx_le_kernel,
-    &gen_op_stwcx_64_user,
-    &gen_op_stwcx_le_64_user,
-    &gen_op_stwcx_64_kernel,
-    &gen_op_stwcx_le_64_kernel,
-};
-#endif
-#else
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc *gen_op_lwarx[] = {
-    &gen_op_lwarx_raw,
-    &gen_op_lwarx_le_raw,
+static GenOpFunc *gen_op_lwarx[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(lwarx),
 };
-static GenOpFunc *gen_op_stwcx[] = {
-    &gen_op_stwcx_raw,
-    &gen_op_stwcx_le_raw,
+static GenOpFunc *gen_op_stwcx[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(stwcx),
 };
-#else
-static GenOpFunc *gen_op_lwarx[] = {
-    &gen_op_lwarx_user,
-    &gen_op_lwarx_le_user,
-    &gen_op_lwarx_kernel,
-    &gen_op_lwarx_le_kernel,
-};
-static GenOpFunc *gen_op_stwcx[] = {
-    &gen_op_stwcx_user,
-    &gen_op_stwcx_le_user,
-    &gen_op_stwcx_kernel,
-    &gen_op_stwcx_le_kernel,
-};
-#endif
-#endif
 
 /* lwarx */
 GEN_HANDLER(lwarx, 0x1F, 0x14, 0x00, 0x00000001, PPC_RES)
@@ -2642,7 +2592,7 @@ GEN_HANDLER(lwarx, 0x1F, 0x14, 0x00, 0x00000001, PPC_RES)
 }
 
 /* stwcx. */
-GEN_HANDLER(stwcx_, 0x1F, 0x16, 0x04, 0x00000000, PPC_RES)
+GEN_HANDLER2(stwcx_, "stwcx.", 0x1F, 0x16, 0x04, 0x00000000, PPC_RES)
 {
     /* NIP cannot be restored if the memory exception comes from an helper */
     gen_update_nip(ctx, ctx->nip - 4);
@@ -2654,41 +2604,12 @@ GEN_HANDLER(stwcx_, 0x1F, 0x16, 0x04, 0x00000000, PPC_RES)
 #if defined(TARGET_PPC64)
 #define op_ldarx() (*gen_op_ldarx[ctx->mem_idx])()
 #define op_stdcx() (*gen_op_stdcx[ctx->mem_idx])()
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc *gen_op_ldarx[] = {
-    &gen_op_ldarx_raw,
-    &gen_op_ldarx_le_raw,
-    &gen_op_ldarx_64_raw,
-    &gen_op_ldarx_le_64_raw,
+static GenOpFunc *gen_op_ldarx[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(ldarx),
 };
-static GenOpFunc *gen_op_stdcx[] = {
-    &gen_op_stdcx_raw,
-    &gen_op_stdcx_le_raw,
-    &gen_op_stdcx_64_raw,
-    &gen_op_stdcx_le_64_raw,
-};
-#else
-static GenOpFunc *gen_op_ldarx[] = {
-    &gen_op_ldarx_user,
-    &gen_op_ldarx_le_user,
-    &gen_op_ldarx_kernel,
-    &gen_op_ldarx_le_kernel,
-    &gen_op_ldarx_64_user,
-    &gen_op_ldarx_le_64_user,
-    &gen_op_ldarx_64_kernel,
-    &gen_op_ldarx_le_64_kernel,
+static GenOpFunc *gen_op_stdcx[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(stdcx),
 };
-static GenOpFunc *gen_op_stdcx[] = {
-    &gen_op_stdcx_user,
-    &gen_op_stdcx_le_user,
-    &gen_op_stdcx_kernel,
-    &gen_op_stdcx_le_kernel,
-    &gen_op_stdcx_64_user,
-    &gen_op_stdcx_le_64_user,
-    &gen_op_stdcx_64_kernel,
-    &gen_op_stdcx_le_64_kernel,
-};
-#endif
 
 /* ldarx */
 GEN_HANDLER(ldarx, 0x1F, 0x14, 0x02, 0x00000001, PPC_64B)
@@ -2701,7 +2622,7 @@ GEN_HANDLER(ldarx, 0x1F, 0x14, 0x02, 0x00000001, PPC_64B)
 }
 
 /* stdcx. */
-GEN_HANDLER(stdcx_, 0x1F, 0x16, 0x06, 0x00000000, PPC_64B)
+GEN_HANDLER2(stdcx_, "stdcx.", 0x1F, 0x16, 0x06, 0x00000000, PPC_64B)
 {
     /* NIP cannot be restored if the memory exception comes from an helper */
     gen_update_nip(ctx, ctx->nip - 4);
@@ -2868,11 +2789,12 @@ GEN_STFS(fs, 0x14, PPC_FLOAT);
 
 /* Optional: */
 /* stfiwx */
-OP_ST_TABLE(fiwx);
-GEN_STXF(fiwx, 0x17, 0x1E, PPC_FLOAT_STFIWX);
+OP_ST_TABLE(fiw);
+GEN_STXF(fiw, 0x17, 0x1E, PPC_FLOAT_STFIWX);
 
 /***                                Branch                                 ***/
-static inline void gen_goto_tb (DisasContext *ctx, int n, target_ulong dest)
+static always_inline void gen_goto_tb (DisasContext *ctx, int n,
+                                       target_ulong dest)
 {
     TranslationBlock *tb;
     tb = ctx->tb;
@@ -2907,7 +2829,7 @@ static inline void gen_goto_tb (DisasContext *ctx, int n, target_ulong dest)
     }
 }
 
-static inline void gen_setlr (DisasContext *ctx, target_ulong nip)
+static always_inline void gen_setlr (DisasContext *ctx, target_ulong nip)
 {
 #if defined(TARGET_PPC64)
     if (ctx->sf_mode != 0 && (nip >> 32))
@@ -2947,7 +2869,7 @@ GEN_HANDLER(b, 0x12, 0xFF, 0xFF, 0x00000000, PPC_FLOW)
 #define BCOND_LR  1
 #define BCOND_CTR 2
 
-static inline void gen_bcond (DisasContext *ctx, int type)
+static always_inline void gen_bcond (DisasContext *ctx, int type)
 {
     target_ulong target = 0;
     target_ulong li;
@@ -3112,15 +3034,27 @@ GEN_HANDLER(bclr, 0x13, 0x10, 0x00, 0x00000000, PPC_FLOW)
 #define GEN_CRLOGIC(op, opc)                                                  \
 GEN_HANDLER(cr##op, 0x13, 0x01, opc, 0x00000001, PPC_INTEGER)                 \
 {                                                                             \
+    uint8_t bitmask;                                                          \
+    int sh;                                                                   \
     gen_op_load_crf_T0(crbA(ctx->opcode) >> 2);                               \
-    gen_op_getbit_T0(3 - (crbA(ctx->opcode) & 0x03));                         \
+    sh = (crbD(ctx->opcode) & 0x03) - (crbA(ctx->opcode) & 0x03);             \
+    if (sh > 0)                                                               \
+        gen_op_srli_T0(sh);                                                   \
+    else if (sh < 0)                                                          \
+        gen_op_sli_T0(-sh);                                                   \
     gen_op_load_crf_T1(crbB(ctx->opcode) >> 2);                               \
-    gen_op_getbit_T1(3 - (crbB(ctx->opcode) & 0x03));                         \
+    sh = (crbD(ctx->opcode) & 0x03) - (crbB(ctx->opcode) & 0x03);             \
+    if (sh > 0)                                                               \
+        gen_op_srli_T1(sh);                                                   \
+    else if (sh < 0)                                                          \
+        gen_op_sli_T1(-sh);                                                   \
     gen_op_##op();                                                            \
+    bitmask = 1 << (3 - (crbD(ctx->opcode) & 0x03));                          \
+    gen_op_andi_T0(bitmask);                                                  \
     gen_op_load_crf_T1(crbD(ctx->opcode) >> 2);                               \
-    gen_op_setcrfbit(~(1 << (3 - (crbD(ctx->opcode) & 0x03))),                \
-                     3 - (crbD(ctx->opcode) & 0x03));                         \
-    gen_op_store_T1_crf(crbD(ctx->opcode) >> 2);                              \
+    gen_op_andi_T1(~bitmask);                                                 \
+    gen_op_or();                                                              \
+    gen_op_store_T0_crf(crbD(ctx->opcode) >> 2);                              \
 }
 
 /* crand */
@@ -3178,10 +3112,8 @@ GEN_HANDLER(rfid, 0x13, 0x12, 0x00, 0x03FF8001, PPC_64B)
     GEN_SYNC(ctx);
 #endif
 }
-#endif
 
-#if defined(TARGET_PPC64H)
-GEN_HANDLER(hrfid, 0x13, 0x12, 0x08, 0x03FF8001, PPC_64B)
+GEN_HANDLER(hrfid, 0x13, 0x12, 0x08, 0x03FF8001, PPC_64H)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -3198,16 +3130,17 @@ GEN_HANDLER(hrfid, 0x13, 0x12, 0x08, 0x03FF8001, PPC_64B)
 #endif
 
 /* sc */
+#if defined(CONFIG_USER_ONLY)
+#define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL_USER
+#else
+#define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL
+#endif
 GEN_HANDLER(sc, 0x11, 0xFF, 0xFF, 0x03FFF01D, PPC_FLOW)
 {
     uint32_t lev;
 
     lev = (ctx->opcode >> 5) & 0x7F;
-#if defined(CONFIG_USER_ONLY)
-    GEN_EXCP(ctx, POWERPC_EXCP_SYSCALL_USER, lev);
-#else
-    GEN_EXCP(ctx, POWERPC_EXCP_SYSCALL, lev);
-#endif
+    GEN_EXCP(ctx, POWERPC_SYSCALL, lev);
 }
 
 /***                                Trap                                   ***/
@@ -3295,8 +3228,8 @@ GEN_HANDLER(mfmsr, 0x1F, 0x13, 0x02, 0x001FF801, PPC_MISC)
 #endif
 }
 
-#if 0
-#define SPR_NOACCESS ((void *)(-1))
+#if 1
+#define SPR_NOACCESS ((void *)(-1UL))
 #else
 static void spr_noaccess (void *opaque, int sprn)
 {
@@ -3307,18 +3240,15 @@ static void spr_noaccess (void *opaque, int sprn)
 #endif
 
 /* mfspr */
-static inline void gen_op_mfspr (DisasContext *ctx)
+static always_inline void gen_op_mfspr (DisasContext *ctx)
 {
     void (*read_cb)(void *opaque, int sprn);
     uint32_t sprn = SPR(ctx->opcode);
 
 #if !defined(CONFIG_USER_ONLY)
-#if defined(TARGET_PPC64H)
     if (ctx->supervisor == 2)
         read_cb = ctx->spr_cb[sprn].hea_read;
-    else
-#endif
-    if (ctx->supervisor)
+    else if (ctx->supervisor)
         read_cb = ctx->spr_cb[sprn].oea_read;
     else
 #endif
@@ -3329,20 +3259,28 @@ static inline void gen_op_mfspr (DisasContext *ctx)
             gen_op_store_T0_gpr(rD(ctx->opcode));
         } else {
             /* Privilege exception */
-            if (loglevel != 0) {
-                fprintf(logfile, "Trying to read privileged spr %d %03x\n",
-                        sprn, sprn);
+            /* This is a hack to avoid warnings when running Linux:
+             * this OS breaks the PowerPC virtualisation model,
+             * allowing userland application to read the PVR
+             */
+            if (sprn != SPR_PVR) {
+                if (loglevel != 0) {
+                    fprintf(logfile, "Trying to read privileged spr %d %03x at "
+                            ADDRX "\n", sprn, sprn, ctx->nip);
+                }
+                printf("Trying to read privileged spr %d %03x at " ADDRX "\n",
+                       sprn, sprn, ctx->nip);
             }
-            printf("Trying to read privileged spr %d %03x\n", sprn, sprn);
             GEN_EXCP_PRIVREG(ctx);
         }
     } else {
         /* Not defined */
         if (loglevel != 0) {
-            fprintf(logfile, "Trying to read invalid spr %d %03x\n",
-                    sprn, sprn);
+            fprintf(logfile, "Trying to read invalid spr %d %03x at "
+                    ADDRX "\n", sprn, sprn, ctx->nip);
         }
-        printf("Trying to read invalid spr %d %03x\n", sprn, sprn);
+        printf("Trying to read invalid spr %d %03x at " ADDRX "\n",
+               sprn, sprn, ctx->nip);
         GEN_EXCP(ctx, POWERPC_EXCP_PROGRAM,
                  POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_SPR);
     }
@@ -3445,12 +3383,9 @@ GEN_HANDLER(mtspr, 0x1F, 0x13, 0x0E, 0x00000001, PPC_MISC)
     uint32_t sprn = SPR(ctx->opcode);
 
 #if !defined(CONFIG_USER_ONLY)
-#if defined(TARGET_PPC64H)
     if (ctx->supervisor == 2)
         write_cb = ctx->spr_cb[sprn].hea_write;
-    else
-#endif
-    if (ctx->supervisor)
+    else if (ctx->supervisor)
         write_cb = ctx->spr_cb[sprn].oea_write;
     else
 #endif
@@ -3462,32 +3397,31 @@ GEN_HANDLER(mtspr, 0x1F, 0x13, 0x0E, 0x00000001, PPC_MISC)
         } else {
             /* Privilege exception */
             if (loglevel != 0) {
-                fprintf(logfile, "Trying to write privileged spr %d %03x\n",
-                        sprn, sprn);
+                fprintf(logfile, "Trying to write privileged spr %d %03x at "
+                        ADDRX "\n", sprn, sprn, ctx->nip);
             }
-            printf("Trying to write privileged spr %d %03x\n", sprn, sprn);
+            printf("Trying to write privileged spr %d %03x at " ADDRX "\n",
+                   sprn, sprn, ctx->nip);
             GEN_EXCP_PRIVREG(ctx);
         }
     } else {
         /* Not defined */
         if (loglevel != 0) {
-            fprintf(logfile, "Trying to write invalid spr %d %03x\n",
-                    sprn, sprn);
+            fprintf(logfile, "Trying to write invalid spr %d %03x at "
+                    ADDRX "\n", sprn, sprn, ctx->nip);
         }
-        printf("Trying to write invalid spr %d %03x\n", sprn, sprn);
+        printf("Trying to write invalid spr %d %03x at " ADDRX "\n",
+               sprn, sprn, ctx->nip);
         GEN_EXCP(ctx, POWERPC_EXCP_PROGRAM,
                  POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_SPR);
     }
 }
 
 /***                         Cache management                              ***/
-/* For now, all those will be implemented as nop:
- * this is valid, regarding the PowerPC specs...
- * We just have to flush tb while invalidating instruction cache lines...
- */
 /* dcbf */
 GEN_HANDLER(dcbf, 0x1F, 0x16, 0x02, 0x03C00001, PPC_CACHE)
 {
+    /* XXX: specification says this is treated as a load by the MMU */
     gen_addr_reg_index(ctx);
     op_ldst(lbz);
 }
@@ -3504,7 +3438,7 @@ GEN_HANDLER(dcbi, 0x1F, 0x16, 0x0E, 0x03E00001, PPC_CACHE)
     }
     gen_addr_reg_index(ctx);
     /* XXX: specification says this should be treated as a store by the MMU */
-    //op_ldst(lbz);
+    op_ldst(lbz);
     op_ldst(stb);
 #endif
 }
@@ -3536,89 +3470,112 @@ GEN_HANDLER(dcbtst, 0x1F, 0x16, 0x07, 0x02000001, PPC_CACHE)
 }
 
 /* dcbz */
-#define op_dcbz() (*gen_op_dcbz[ctx->mem_idx])()
-#if defined(TARGET_PPC64)
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc *gen_op_dcbz[] = {
-    &gen_op_dcbz_raw,
-    &gen_op_dcbz_raw,
-    &gen_op_dcbz_64_raw,
-    &gen_op_dcbz_64_raw,
-};
-#else
-static GenOpFunc *gen_op_dcbz[] = {
-    &gen_op_dcbz_user,
-    &gen_op_dcbz_user,
-    &gen_op_dcbz_kernel,
-    &gen_op_dcbz_kernel,
-    &gen_op_dcbz_64_user,
-    &gen_op_dcbz_64_user,
-    &gen_op_dcbz_64_kernel,
-    &gen_op_dcbz_64_kernel,
-};
-#endif
-#else
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc *gen_op_dcbz[] = {
-    &gen_op_dcbz_raw,
-    &gen_op_dcbz_raw,
+#define op_dcbz(n) (*gen_op_dcbz[n][ctx->mem_idx])()
+static GenOpFunc *gen_op_dcbz[4][NB_MEM_FUNCS] = {
+    /* 32 bytes cache line size */
+    {
+#define gen_op_dcbz_l32_le_raw        gen_op_dcbz_l32_raw
+#define gen_op_dcbz_l32_le_user       gen_op_dcbz_l32_user
+#define gen_op_dcbz_l32_le_kernel     gen_op_dcbz_l32_kernel
+#define gen_op_dcbz_l32_le_hypv       gen_op_dcbz_l32_hypv
+#define gen_op_dcbz_l32_le_64_raw     gen_op_dcbz_l32_64_raw
+#define gen_op_dcbz_l32_le_64_user    gen_op_dcbz_l32_64_user
+#define gen_op_dcbz_l32_le_64_kernel  gen_op_dcbz_l32_64_kernel
+#define gen_op_dcbz_l32_le_64_hypv    gen_op_dcbz_l32_64_hypv
+        GEN_MEM_FUNCS(dcbz_l32),
+    },
+    /* 64 bytes cache line size */
+    {
+#define gen_op_dcbz_l64_le_raw        gen_op_dcbz_l64_raw
+#define gen_op_dcbz_l64_le_user       gen_op_dcbz_l64_user
+#define gen_op_dcbz_l64_le_kernel     gen_op_dcbz_l64_kernel
+#define gen_op_dcbz_l64_le_hypv       gen_op_dcbz_l64_hypv
+#define gen_op_dcbz_l64_le_64_raw     gen_op_dcbz_l64_64_raw
+#define gen_op_dcbz_l64_le_64_user    gen_op_dcbz_l64_64_user
+#define gen_op_dcbz_l64_le_64_kernel  gen_op_dcbz_l64_64_kernel
+#define gen_op_dcbz_l64_le_64_hypv    gen_op_dcbz_l64_64_hypv
+        GEN_MEM_FUNCS(dcbz_l64),
+    },
+    /* 128 bytes cache line size */
+    {
+#define gen_op_dcbz_l128_le_raw       gen_op_dcbz_l128_raw
+#define gen_op_dcbz_l128_le_user      gen_op_dcbz_l128_user
+#define gen_op_dcbz_l128_le_kernel    gen_op_dcbz_l128_kernel
+#define gen_op_dcbz_l128_le_hypv      gen_op_dcbz_l128_hypv
+#define gen_op_dcbz_l128_le_64_raw    gen_op_dcbz_l128_64_raw
+#define gen_op_dcbz_l128_le_64_user   gen_op_dcbz_l128_64_user
+#define gen_op_dcbz_l128_le_64_kernel gen_op_dcbz_l128_64_kernel
+#define gen_op_dcbz_l128_le_64_hypv   gen_op_dcbz_l128_64_hypv
+        GEN_MEM_FUNCS(dcbz_l128),
+    },
+    /* tunable cache line size */
+    {
+#define gen_op_dcbz_le_raw            gen_op_dcbz_raw
+#define gen_op_dcbz_le_user           gen_op_dcbz_user
+#define gen_op_dcbz_le_kernel         gen_op_dcbz_kernel
+#define gen_op_dcbz_le_hypv           gen_op_dcbz_hypv
+#define gen_op_dcbz_le_64_raw         gen_op_dcbz_64_raw
+#define gen_op_dcbz_le_64_user        gen_op_dcbz_64_user
+#define gen_op_dcbz_le_64_kernel      gen_op_dcbz_64_kernel
+#define gen_op_dcbz_le_64_hypv        gen_op_dcbz_64_hypv
+        GEN_MEM_FUNCS(dcbz),
+    },
 };
-#else
-static GenOpFunc *gen_op_dcbz[] = {
-    &gen_op_dcbz_user,
-    &gen_op_dcbz_user,
-    &gen_op_dcbz_kernel,
-    &gen_op_dcbz_kernel,
-};
-#endif
-#endif
 
-GEN_HANDLER(dcbz, 0x1F, 0x16, 0x1F, 0x03E00001, PPC_CACHE)
+static always_inline void handler_dcbz (DisasContext *ctx,
+                                        int dcache_line_size)
+{
+    int n;
+
+    switch (dcache_line_size) {
+    case 32:
+        n = 0;
+        break;
+    case 64:
+        n = 1;
+        break;
+    case 128:
+        n = 2;
+        break;
+    default:
+        n = 3;
+        break;
+    }
+    op_dcbz(n);
+}
+
+GEN_HANDLER(dcbz, 0x1F, 0x16, 0x1F, 0x03E00001, PPC_CACHE_DCBZ)
+{
+    gen_addr_reg_index(ctx);
+    handler_dcbz(ctx, ctx->dcache_line_size);
+    gen_op_check_reservation();
+}
+
+GEN_HANDLER2(dcbz_970, "dcbz", 0x1F, 0x16, 0x1F, 0x03C00001, PPC_CACHE_DCBZT)
 {
     gen_addr_reg_index(ctx);
-    op_dcbz();
+    if (ctx->opcode & 0x00200000)
+        handler_dcbz(ctx, ctx->dcache_line_size);
+    else
+        handler_dcbz(ctx, -1);
     gen_op_check_reservation();
 }
 
 /* icbi */
 #define op_icbi() (*gen_op_icbi[ctx->mem_idx])()
-#if defined(TARGET_PPC64)
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc *gen_op_icbi[] = {
-    &gen_op_icbi_raw,
-    &gen_op_icbi_raw,
-    &gen_op_icbi_64_raw,
-    &gen_op_icbi_64_raw,
-};
-#else
-static GenOpFunc *gen_op_icbi[] = {
-    &gen_op_icbi_user,
-    &gen_op_icbi_user,
-    &gen_op_icbi_kernel,
-    &gen_op_icbi_kernel,
-    &gen_op_icbi_64_user,
-    &gen_op_icbi_64_user,
-    &gen_op_icbi_64_kernel,
-    &gen_op_icbi_64_kernel,
-};
-#endif
-#else
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc *gen_op_icbi[] = {
-    &gen_op_icbi_raw,
-    &gen_op_icbi_raw,
+#define gen_op_icbi_le_raw       gen_op_icbi_raw
+#define gen_op_icbi_le_user      gen_op_icbi_user
+#define gen_op_icbi_le_kernel    gen_op_icbi_kernel
+#define gen_op_icbi_le_hypv      gen_op_icbi_hypv
+#define gen_op_icbi_le_64_raw    gen_op_icbi_64_raw
+#define gen_op_icbi_le_64_user   gen_op_icbi_64_user
+#define gen_op_icbi_le_64_kernel gen_op_icbi_64_kernel
+#define gen_op_icbi_le_64_hypv   gen_op_icbi_64_hypv
+static GenOpFunc *gen_op_icbi[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(icbi),
 };
-#else
-static GenOpFunc *gen_op_icbi[] = {
-    &gen_op_icbi_user,
-    &gen_op_icbi_user,
-    &gen_op_icbi_kernel,
-    &gen_op_icbi_kernel,
-};
-#endif
-#endif
 
-GEN_HANDLER(icbi, 0x1F, 0x16, 0x1E, 0x03E00001, PPC_CACHE)
+GEN_HANDLER(icbi, 0x1F, 0x16, 0x1E, 0x03E00001, PPC_CACHE_ICBI)
 {
     /* NIP cannot be restored if the memory exception comes from an helper */
     gen_update_nip(ctx, ctx->nip - 4);
@@ -3704,6 +3661,77 @@ GEN_HANDLER(mtsrin, 0x1F, 0x12, 0x07, 0x001F0001, PPC_SEGMENT)
 #endif
 }
 
+#if defined(TARGET_PPC64)
+/* Specific implementation for PowerPC 64 "bridge" emulation using SLB */
+/* mfsr */
+GEN_HANDLER2(mfsr_64b, "mfsr", 0x1F, 0x13, 0x12, 0x0010F801, PPC_SEGMENT_64B)
+{
+#if defined(CONFIG_USER_ONLY)
+    GEN_EXCP_PRIVREG(ctx);
+#else
+    if (unlikely(!ctx->supervisor)) {
+        GEN_EXCP_PRIVREG(ctx);
+        return;
+    }
+    gen_op_set_T1(SR(ctx->opcode));
+    gen_op_load_slb();
+    gen_op_store_T0_gpr(rD(ctx->opcode));
+#endif
+}
+
+/* mfsrin */
+GEN_HANDLER2(mfsrin_64b, "mfsrin", 0x1F, 0x13, 0x14, 0x001F0001,
+             PPC_SEGMENT_64B)
+{
+#if defined(CONFIG_USER_ONLY)
+    GEN_EXCP_PRIVREG(ctx);
+#else
+    if (unlikely(!ctx->supervisor)) {
+        GEN_EXCP_PRIVREG(ctx);
+        return;
+    }
+    gen_op_load_gpr_T1(rB(ctx->opcode));
+    gen_op_srli_T1(28);
+    gen_op_load_slb();
+    gen_op_store_T0_gpr(rD(ctx->opcode));
+#endif
+}
+
+/* mtsr */
+GEN_HANDLER2(mtsr_64b, "mtsr", 0x1F, 0x12, 0x06, 0x0010F801, PPC_SEGMENT_64B)
+{
+#if defined(CONFIG_USER_ONLY)
+    GEN_EXCP_PRIVREG(ctx);
+#else
+    if (unlikely(!ctx->supervisor)) {
+        GEN_EXCP_PRIVREG(ctx);
+        return;
+    }
+    gen_op_load_gpr_T0(rS(ctx->opcode));
+    gen_op_set_T1(SR(ctx->opcode));
+    gen_op_store_slb();
+#endif
+}
+
+/* mtsrin */
+GEN_HANDLER2(mtsrin_64b, "mtsrin", 0x1F, 0x12, 0x07, 0x001F0001,
+             PPC_SEGMENT_64B)
+{
+#if defined(CONFIG_USER_ONLY)
+    GEN_EXCP_PRIVREG(ctx);
+#else
+    if (unlikely(!ctx->supervisor)) {
+        GEN_EXCP_PRIVREG(ctx);
+        return;
+    }
+    gen_op_load_gpr_T0(rS(ctx->opcode));
+    gen_op_load_gpr_T1(rB(ctx->opcode));
+    gen_op_srli_T1(28);
+    gen_op_store_slb();
+#endif
+}
+#endif /* defined(TARGET_PPC64) */
+
 /***                      Lookaside buffer management                      ***/
 /* Optional & supervisor only: */
 /* tlbia */
@@ -3713,8 +3741,6 @@ GEN_HANDLER(tlbia, 0x1F, 0x12, 0x0B, 0x03FFFC01, PPC_MEM_TLBIA)
     GEN_EXCP_PRIVOPC(ctx);
 #else
     if (unlikely(!ctx->supervisor)) {
-        if (loglevel != 0)
-            fprintf(logfile, "%s: ! supervisor\n", __func__);
         GEN_EXCP_PRIVOPC(ctx);
         return;
     }
@@ -3767,8 +3793,6 @@ GEN_HANDLER(slbia, 0x1F, 0x12, 0x0F, 0x03FFFC01, PPC_SLBI)
     GEN_EXCP_PRIVOPC(ctx);
 #else
     if (unlikely(!ctx->supervisor)) {
-        if (loglevel != 0)
-            fprintf(logfile, "%s: ! supervisor\n", __func__);
         GEN_EXCP_PRIVOPC(ctx);
         return;
     }
@@ -3796,67 +3820,12 @@ GEN_HANDLER(slbie, 0x1F, 0x12, 0x0D, 0x03FF0001, PPC_SLBI)
 /* Optional: */
 #define op_eciwx() (*gen_op_eciwx[ctx->mem_idx])()
 #define op_ecowx() (*gen_op_ecowx[ctx->mem_idx])()
-#if defined(TARGET_PPC64)
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc *gen_op_eciwx[] = {
-    &gen_op_eciwx_raw,
-    &gen_op_eciwx_le_raw,
-    &gen_op_eciwx_64_raw,
-    &gen_op_eciwx_le_64_raw,
-};
-static GenOpFunc *gen_op_ecowx[] = {
-    &gen_op_ecowx_raw,
-    &gen_op_ecowx_le_raw,
-    &gen_op_ecowx_64_raw,
-    &gen_op_ecowx_le_64_raw,
-};
-#else
-static GenOpFunc *gen_op_eciwx[] = {
-    &gen_op_eciwx_user,
-    &gen_op_eciwx_le_user,
-    &gen_op_eciwx_kernel,
-    &gen_op_eciwx_le_kernel,
-    &gen_op_eciwx_64_user,
-    &gen_op_eciwx_le_64_user,
-    &gen_op_eciwx_64_kernel,
-    &gen_op_eciwx_le_64_kernel,
-};
-static GenOpFunc *gen_op_ecowx[] = {
-    &gen_op_ecowx_user,
-    &gen_op_ecowx_le_user,
-    &gen_op_ecowx_kernel,
-    &gen_op_ecowx_le_kernel,
-    &gen_op_ecowx_64_user,
-    &gen_op_ecowx_le_64_user,
-    &gen_op_ecowx_64_kernel,
-    &gen_op_ecowx_le_64_kernel,
-};
-#endif
-#else
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc *gen_op_eciwx[] = {
-    &gen_op_eciwx_raw,
-    &gen_op_eciwx_le_raw,
-};
-static GenOpFunc *gen_op_ecowx[] = {
-    &gen_op_ecowx_raw,
-    &gen_op_ecowx_le_raw,
+static GenOpFunc *gen_op_eciwx[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(eciwx),
 };
-#else
-static GenOpFunc *gen_op_eciwx[] = {
-    &gen_op_eciwx_user,
-    &gen_op_eciwx_le_user,
-    &gen_op_eciwx_kernel,
-    &gen_op_eciwx_le_kernel,
-};
-static GenOpFunc *gen_op_ecowx[] = {
-    &gen_op_ecowx_user,
-    &gen_op_ecowx_le_user,
-    &gen_op_ecowx_kernel,
-    &gen_op_ecowx_le_kernel,
+static GenOpFunc *gen_op_ecowx[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(ecowx),
 };
-#endif
-#endif
 
 /* eciwx */
 GEN_HANDLER(eciwx, 0x1F, 0x16, 0x0D, 0x00000001, PPC_EXTERN)
@@ -3902,6 +3871,7 @@ GEN_HANDLER(clcs, 0x1F, 0x10, 0x13, 0x0000F800, PPC_POWER_BR)
 {
     gen_op_load_gpr_T0(rA(ctx->opcode));
     gen_op_POWER_clcs();
+    /* Rc=1 sets CR0 to an undefined state */
     gen_op_store_T0_gpr(rD(ctx->opcode));
 }
 
@@ -3980,22 +3950,26 @@ GEN_HANDLER(dozi, 0x09, 0xFF, 0xFF, 0x00000000, PPC_POWER_BR)
     gen_op_store_T0_gpr(rD(ctx->opcode));
 }
 
-/* As lscbx load from memory byte after byte, it's always endian safe */
-#define op_POWER_lscbx(start, ra, rb) \
+/* As lscbx load from memory byte after byte, it's always endian safe.
+ * Original POWER is 32 bits only, define 64 bits ops as 32 bits ones
+ */
+#define op_POWER_lscbx(start, ra, rb)                                         \
 (*gen_op_POWER_lscbx[ctx->mem_idx])(start, ra, rb)
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc3 *gen_op_POWER_lscbx[] = {
-    &gen_op_POWER_lscbx_raw,
-    &gen_op_POWER_lscbx_raw,
-};
-#else
-static GenOpFunc3 *gen_op_POWER_lscbx[] = {
-    &gen_op_POWER_lscbx_user,
-    &gen_op_POWER_lscbx_user,
-    &gen_op_POWER_lscbx_kernel,
-    &gen_op_POWER_lscbx_kernel,
+#define gen_op_POWER_lscbx_64_raw       gen_op_POWER_lscbx_raw
+#define gen_op_POWER_lscbx_64_user      gen_op_POWER_lscbx_user
+#define gen_op_POWER_lscbx_64_kernel    gen_op_POWER_lscbx_kernel
+#define gen_op_POWER_lscbx_64_hypv      gen_op_POWER_lscbx_hypv
+#define gen_op_POWER_lscbx_le_raw       gen_op_POWER_lscbx_raw
+#define gen_op_POWER_lscbx_le_user      gen_op_POWER_lscbx_user
+#define gen_op_POWER_lscbx_le_kernel    gen_op_POWER_lscbx_kernel
+#define gen_op_POWER_lscbx_le_hypv      gen_op_POWER_lscbx_hypv
+#define gen_op_POWER_lscbx_le_64_raw    gen_op_POWER_lscbx_raw
+#define gen_op_POWER_lscbx_le_64_user   gen_op_POWER_lscbx_user
+#define gen_op_POWER_lscbx_le_64_kernel gen_op_POWER_lscbx_kernel
+#define gen_op_POWER_lscbx_le_64_hypv   gen_op_POWER_lscbx_hypv
+static GenOpFunc3 *gen_op_POWER_lscbx[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(POWER_lscbx),
 };
-#endif
 
 /* lscbx - lscbx. */
 GEN_HANDLER(lscbx, 0x1F, 0x15, 0x08, 0x00000000, PPC_POWER_BR)
@@ -4309,7 +4283,7 @@ GEN_HANDLER(mfrom, 0x1F, 0x09, 0x08, 0x03E0F801, PPC_602_SPEC)
 
 /* 602 - 603 - G2 TLB management */
 /* tlbld */
-GEN_HANDLER(tlbld_6xx, 0x1F, 0x12, 0x1E, 0x03FF0001, PPC_6xx_TLB)
+GEN_HANDLER2(tlbld_6xx, "tlbld", 0x1F, 0x12, 0x1E, 0x03FF0001, PPC_6xx_TLB)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -4324,7 +4298,7 @@ GEN_HANDLER(tlbld_6xx, 0x1F, 0x12, 0x1E, 0x03FF0001, PPC_6xx_TLB)
 }
 
 /* tlbli */
-GEN_HANDLER(tlbli_6xx, 0x1F, 0x12, 0x1F, 0x03FF0001, PPC_6xx_TLB)
+GEN_HANDLER2(tlbli_6xx, "tlbli", 0x1F, 0x12, 0x1F, 0x03FF0001, PPC_6xx_TLB)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -4340,7 +4314,7 @@ GEN_HANDLER(tlbli_6xx, 0x1F, 0x12, 0x1F, 0x03FF0001, PPC_6xx_TLB)
 
 /* 74xx TLB management */
 /* tlbld */
-GEN_HANDLER(tlbld_74xx, 0x1F, 0x12, 0x1E, 0x03FF0001, PPC_74xx_TLB)
+GEN_HANDLER2(tlbld_74xx, "tlbld", 0x1F, 0x12, 0x1E, 0x03FF0001, PPC_74xx_TLB)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -4355,7 +4329,7 @@ GEN_HANDLER(tlbld_74xx, 0x1F, 0x12, 0x1E, 0x03FF0001, PPC_74xx_TLB)
 }
 
 /* tlbli */
-GEN_HANDLER(tlbli_74xx, 0x1F, 0x12, 0x1F, 0x03FF0001, PPC_74xx_TLB)
+GEN_HANDLER2(tlbli_74xx, "tlbli", 0x1F, 0x12, 0x1F, 0x03FF0001, PPC_74xx_TLB)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -4449,31 +4423,31 @@ GEN_HANDLER(rfsvc, 0x13, 0x12, 0x02, 0x03FFF0001, PPC_POWER)
 
 /* POWER2 specific instructions */
 /* Quad manipulation (load/store two floats at a time) */
+/* Original POWER2 is 32 bits only, define 64 bits ops as 32 bits ones */
 #define op_POWER2_lfq() (*gen_op_POWER2_lfq[ctx->mem_idx])()
 #define op_POWER2_stfq() (*gen_op_POWER2_stfq[ctx->mem_idx])()
-#if defined(CONFIG_USER_ONLY)
-static GenOpFunc *gen_op_POWER2_lfq[] = {
-    &gen_op_POWER2_lfq_le_raw,
-    &gen_op_POWER2_lfq_raw,
+#define gen_op_POWER2_lfq_64_raw        gen_op_POWER2_lfq_raw
+#define gen_op_POWER2_lfq_64_user       gen_op_POWER2_lfq_user
+#define gen_op_POWER2_lfq_64_kernel     gen_op_POWER2_lfq_kernel
+#define gen_op_POWER2_lfq_64_hypv       gen_op_POWER2_lfq_hypv
+#define gen_op_POWER2_lfq_le_64_raw     gen_op_POWER2_lfq_le_raw
+#define gen_op_POWER2_lfq_le_64_user    gen_op_POWER2_lfq_le_user
+#define gen_op_POWER2_lfq_le_64_kernel  gen_op_POWER2_lfq_le_kernel
+#define gen_op_POWER2_lfq_le_64_hypv    gen_op_POWER2_lfq_le_hypv
+#define gen_op_POWER2_stfq_64_raw       gen_op_POWER2_stfq_raw
+#define gen_op_POWER2_stfq_64_user      gen_op_POWER2_stfq_user
+#define gen_op_POWER2_stfq_64_kernel    gen_op_POWER2_stfq_kernel
+#define gen_op_POWER2_stfq_64_hypv      gen_op_POWER2_stfq_hypv
+#define gen_op_POWER2_stfq_le_64_raw    gen_op_POWER2_stfq_le_raw
+#define gen_op_POWER2_stfq_le_64_user   gen_op_POWER2_stfq_le_user
+#define gen_op_POWER2_stfq_le_64_kernel gen_op_POWER2_stfq_le_kernel
+#define gen_op_POWER2_stfq_le_64_hypv   gen_op_POWER2_stfq_le_hypv
+static GenOpFunc *gen_op_POWER2_lfq[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(POWER2_lfq),
 };
-static GenOpFunc *gen_op_POWER2_stfq[] = {
-    &gen_op_POWER2_stfq_le_raw,
-    &gen_op_POWER2_stfq_raw,
+static GenOpFunc *gen_op_POWER2_stfq[NB_MEM_FUNCS] = {
+    GEN_MEM_FUNCS(POWER2_stfq),
 };
-#else
-static GenOpFunc *gen_op_POWER2_lfq[] = {
-    &gen_op_POWER2_lfq_le_user,
-    &gen_op_POWER2_lfq_user,
-    &gen_op_POWER2_lfq_le_kernel,
-    &gen_op_POWER2_lfq_kernel,
-};
-static GenOpFunc *gen_op_POWER2_stfq[] = {
-    &gen_op_POWER2_stfq_le_user,
-    &gen_op_POWER2_stfq_user,
-    &gen_op_POWER2_stfq_le_kernel,
-    &gen_op_POWER2_stfq_kernel,
-};
-#endif
 
 /* lfq */
 GEN_HANDLER(lfq, 0x38, 0xFF, 0xFF, 0x00000003, PPC_POWER2)
@@ -4581,14 +4555,14 @@ GEN_HANDLER(stfqx, 0x1F, 0x17, 0x1C, 0x00000001, PPC_POWER2)
 
 /* BookE specific instructions */
 /* XXX: not implemented on 440 ? */
-GEN_HANDLER(mfapidi, 0x1F, 0x13, 0x08, 0x0000F801, PPC_BOOKE_EXT)
+GEN_HANDLER(mfapidi, 0x1F, 0x13, 0x08, 0x0000F801, PPC_MFAPIDI)
 {
     /* XXX: TODO */
     GEN_EXCP_INVAL(ctx);
 }
 
 /* XXX: not implemented on 440 ? */
-GEN_HANDLER(tlbiva, 0x1F, 0x12, 0x18, 0x03FFF801, PPC_BOOKE_EXT)
+GEN_HANDLER(tlbiva, 0x1F, 0x12, 0x18, 0x03FFF801, PPC_TLBIVA)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -4609,8 +4583,9 @@ GEN_HANDLER(tlbiva, 0x1F, 0x12, 0x18, 0x03FFF801, PPC_BOOKE_EXT)
 }
 
 /* All 405 MAC instructions are translated here */
-static inline void gen_405_mulladd_insn (DisasContext *ctx, int opc2, int opc3,
-                                         int ra, int rb, int rt, int Rc)
+static always_inline void gen_405_mulladd_insn (DisasContext *ctx,
+                                                int opc2, int opc3,
+                                                int ra, int rb, int rt, int Rc)
 {
     gen_op_load_gpr_T0(ra);
     gen_op_load_gpr_T1(rb);
@@ -4671,7 +4646,7 @@ static inline void gen_405_mulladd_insn (DisasContext *ctx, int opc2, int opc3,
     if (opc3 & 0x10) {
         /* Check overflow */
         if (opc3 & 0x01)
-            gen_op_405_check_ov();
+            gen_op_check_addo();
         else
             gen_op_405_check_ovu();
     }
@@ -4783,7 +4758,7 @@ GEN_MAC_HANDLER(mullhw, 0x08, 0x0D);
 GEN_MAC_HANDLER(mullhwu, 0x08, 0x0C);
 
 /* mfdcr */
-GEN_HANDLER(mfdcr, 0x1F, 0x03, 0x0A, 0x00000001, PPC_EMB_COMMON)
+GEN_HANDLER(mfdcr, 0x1F, 0x03, 0x0A, 0x00000001, PPC_DCR)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVREG(ctx);
@@ -4801,7 +4776,7 @@ GEN_HANDLER(mfdcr, 0x1F, 0x03, 0x0A, 0x00000001, PPC_EMB_COMMON)
 }
 
 /* mtdcr */
-GEN_HANDLER(mtdcr, 0x1F, 0x03, 0x0E, 0x00000001, PPC_EMB_COMMON)
+GEN_HANDLER(mtdcr, 0x1F, 0x03, 0x0E, 0x00000001, PPC_DCR)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVREG(ctx);
@@ -4820,7 +4795,7 @@ GEN_HANDLER(mtdcr, 0x1F, 0x03, 0x0E, 0x00000001, PPC_EMB_COMMON)
 
 /* mfdcrx */
 /* XXX: not implemented on 440 ? */
-GEN_HANDLER(mfdcrx, 0x1F, 0x03, 0x08, 0x00000000, PPC_BOOKE_EXT)
+GEN_HANDLER(mfdcrx, 0x1F, 0x03, 0x08, 0x00000000, PPC_DCRX)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVREG(ctx);
@@ -4838,7 +4813,7 @@ GEN_HANDLER(mfdcrx, 0x1F, 0x03, 0x08, 0x00000000, PPC_BOOKE_EXT)
 
 /* mtdcrx */
 /* XXX: not implemented on 440 ? */
-GEN_HANDLER(mtdcrx, 0x1F, 0x03, 0x0C, 0x00000000, PPC_BOOKE_EXT)
+GEN_HANDLER(mtdcrx, 0x1F, 0x03, 0x0C, 0x00000000, PPC_DCRX)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVREG(ctx);
@@ -4903,7 +4878,7 @@ GEN_HANDLER(dcread, 0x1F, 0x06, 0x0F, 0x00000001, PPC_4xx_COMMON)
 }
 
 /* icbt */
-GEN_HANDLER(icbt_40x, 0x1F, 0x06, 0x08, 0x03E00001, PPC_40x_ICBT)
+GEN_HANDLER2(icbt_40x, "icbt", 0x1F, 0x06, 0x08, 0x03E00001, PPC_40x_ICBT)
 {
     /* interpreted as no-op */
     /* XXX: specification say this is treated as a load by the MMU
@@ -4940,7 +4915,7 @@ GEN_HANDLER(icread, 0x1F, 0x06, 0x1F, 0x03E00001, PPC_4xx_COMMON)
 }
 
 /* rfci (supervisor only) */
-GEN_HANDLER(rfci_40x, 0x13, 0x13, 0x01, 0x03FF8001, PPC_40x_EXCP)
+GEN_HANDLER2(rfci_40x, "rfci", 0x13, 0x13, 0x01, 0x03FF8001, PPC_40x_EXCP)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -4972,7 +4947,7 @@ GEN_HANDLER(rfci, 0x13, 0x13, 0x01, 0x03FF8001, PPC_BOOKE)
 
 /* BookE specific */
 /* XXX: not implemented on 440 ? */
-GEN_HANDLER(rfdi, 0x13, 0x07, 0x01, 0x03FF8001, PPC_BOOKE_EXT)
+GEN_HANDLER(rfdi, 0x13, 0x07, 0x01, 0x03FF8001, PPC_RFDI)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -5005,7 +4980,7 @@ GEN_HANDLER(rfmci, 0x13, 0x06, 0x01, 0x03FF8001, PPC_RFMCI)
 
 /* TLB management - PowerPC 405 implementation */
 /* tlbre */
-GEN_HANDLER(tlbre_40x, 0x1F, 0x12, 0x1D, 0x00000001, PPC_40x_TLB)
+GEN_HANDLER2(tlbre_40x, "tlbre", 0x1F, 0x12, 0x1D, 0x00000001, PPC_40x_TLB)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -5033,7 +5008,7 @@ GEN_HANDLER(tlbre_40x, 0x1F, 0x12, 0x1D, 0x00000001, PPC_40x_TLB)
 }
 
 /* tlbsx - tlbsx. */
-GEN_HANDLER(tlbsx_40x, 0x1F, 0x12, 0x1C, 0x00000000, PPC_40x_TLB)
+GEN_HANDLER2(tlbsx_40x, "tlbsx", 0x1F, 0x12, 0x1C, 0x00000000, PPC_40x_TLB)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -5051,7 +5026,7 @@ GEN_HANDLER(tlbsx_40x, 0x1F, 0x12, 0x1C, 0x00000000, PPC_40x_TLB)
 }
 
 /* tlbwe */
-GEN_HANDLER(tlbwe_40x, 0x1F, 0x12, 0x1E, 0x00000001, PPC_40x_TLB)
+GEN_HANDLER2(tlbwe_40x, "tlbwe", 0x1F, 0x12, 0x1E, 0x00000001, PPC_40x_TLB)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -5080,7 +5055,7 @@ GEN_HANDLER(tlbwe_40x, 0x1F, 0x12, 0x1E, 0x00000001, PPC_40x_TLB)
 
 /* TLB management - PowerPC 440 implementation */
 /* tlbre */
-GEN_HANDLER(tlbre_440, 0x1F, 0x12, 0x1D, 0x00000001, PPC_BOOKE)
+GEN_HANDLER2(tlbre_440, "tlbre", 0x1F, 0x12, 0x1D, 0x00000001, PPC_BOOKE)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -5105,7 +5080,7 @@ GEN_HANDLER(tlbre_440, 0x1F, 0x12, 0x1D, 0x00000001, PPC_BOOKE)
 }
 
 /* tlbsx - tlbsx. */
-GEN_HANDLER(tlbsx_440, 0x1F, 0x12, 0x1C, 0x00000000, PPC_BOOKE)
+GEN_HANDLER2(tlbsx_440, "tlbsx", 0x1F, 0x12, 0x1C, 0x00000000, PPC_BOOKE)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -5123,7 +5098,7 @@ GEN_HANDLER(tlbsx_440, 0x1F, 0x12, 0x1C, 0x00000000, PPC_BOOKE)
 }
 
 /* tlbwe */
-GEN_HANDLER(tlbwe_440, 0x1F, 0x12, 0x1E, 0x00000001, PPC_BOOKE)
+GEN_HANDLER2(tlbwe_440, "tlbwe", 0x1F, 0x12, 0x1E, 0x00000001, PPC_BOOKE)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -5148,7 +5123,7 @@ GEN_HANDLER(tlbwe_440, 0x1F, 0x12, 0x1E, 0x00000001, PPC_BOOKE)
 }
 
 /* wrtee */
-GEN_HANDLER(wrtee, 0x1F, 0x03, 0x04, 0x000FFC01, PPC_EMB_COMMON)
+GEN_HANDLER(wrtee, 0x1F, 0x03, 0x04, 0x000FFC01, PPC_WRTEE)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -5167,7 +5142,7 @@ GEN_HANDLER(wrtee, 0x1F, 0x03, 0x04, 0x000FFC01, PPC_EMB_COMMON)
 }
 
 /* wrteei */
-GEN_HANDLER(wrteei, 0x1F, 0x03, 0x05, 0x000EFC01, PPC_EMB_COMMON)
+GEN_HANDLER(wrteei, 0x1F, 0x03, 0x05, 0x000EFC01, PPC_WRTEE)
 {
 #if defined(CONFIG_USER_ONLY)
     GEN_EXCP_PRIVOPC(ctx);
@@ -5213,7 +5188,7 @@ GEN_HANDLER(msync, 0x1F, 0x16, 0x12, 0x03FFF801, PPC_BOOKE)
 }
 
 /* icbt */
-GEN_HANDLER(icbt_440, 0x1F, 0x16, 0x00, 0x03E00001, PPC_BOOKE)
+GEN_HANDLER2(icbt_440, "icbt", 0x1F, 0x16, 0x00, 0x03E00001, PPC_BOOKE)
 {
     /* interpreted as no-op */
     /* XXX: specification say this is treated as a load by the MMU
@@ -5221,10 +5196,68 @@ GEN_HANDLER(icbt_440, 0x1F, 0x16, 0x00, 0x03E00001, PPC_BOOKE)
      */
 }
 
-#if defined(TARGET_PPCEMB)
-/***                           SPE extension                               ***/
+/***                      Altivec vector extension                         ***/
+/* Altivec registers moves */
+GEN32(gen_op_load_avr_A0, gen_op_load_avr_A0_avr);
+GEN32(gen_op_load_avr_A1, gen_op_load_avr_A1_avr);
+GEN32(gen_op_load_avr_A2, gen_op_load_avr_A2_avr);
+
+GEN32(gen_op_store_A0_avr, gen_op_store_A0_avr_avr);
+GEN32(gen_op_store_A1_avr, gen_op_store_A1_avr_avr);
+#if 0 // unused
+GEN32(gen_op_store_A2_avr, gen_op_store_A2_avr_avr);
+#endif
+
+#define op_vr_ldst(name)        (*gen_op_##name[ctx->mem_idx])()
+#define OP_VR_LD_TABLE(name)                                                  \
+static GenOpFunc *gen_op_vr_l##name[NB_MEM_FUNCS] = {                         \
+    GEN_MEM_FUNCS(vr_l##name),                                                \
+};
+#define OP_VR_ST_TABLE(name)                                                  \
+static GenOpFunc *gen_op_vr_st##name[NB_MEM_FUNCS] = {                        \
+    GEN_MEM_FUNCS(vr_st##name),                                               \
+};
+
+#define GEN_VR_LDX(name, opc2, opc3)                                          \
+GEN_HANDLER(l##name, 0x1F, opc2, opc3, 0x00000001, PPC_ALTIVEC)               \
+{                                                                             \
+    if (unlikely(!ctx->altivec_enabled)) {                                    \
+        GEN_EXCP_NO_VR(ctx);                                                  \
+        return;                                                               \
+    }                                                                         \
+    gen_addr_reg_index(ctx);                                                  \
+    op_vr_ldst(vr_l##name);                                                   \
+    gen_op_store_A0_avr(rD(ctx->opcode));                                     \
+}
+
+#define GEN_VR_STX(name, opc2, opc3)                                          \
+GEN_HANDLER(st##name, 0x1F, opc2, opc3, 0x00000001, PPC_ALTIVEC)              \
+{                                                                             \
+    if (unlikely(!ctx->altivec_enabled)) {                                    \
+        GEN_EXCP_NO_VR(ctx);                                                  \
+        return;                                                               \
+    }                                                                         \
+    gen_addr_reg_index(ctx);                                                  \
+    gen_op_load_avr_A0(rS(ctx->opcode));                                      \
+    op_vr_ldst(vr_st##name);                                                  \
+}
+
+OP_VR_LD_TABLE(vx);
+GEN_VR_LDX(vx, 0x07, 0x03);
+/* As we don't emulate the cache, lvxl is stricly equivalent to lvx */
+#define gen_op_vr_lvxl gen_op_vr_lvx
+GEN_VR_LDX(vxl, 0x07, 0x0B);
+
+OP_VR_ST_TABLE(vx);
+GEN_VR_STX(vx, 0x07, 0x07);
+/* As we don't emulate the cache, stvxl is stricly equivalent to stvx */
+#define gen_op_vr_stvxl gen_op_vr_stvx
+GEN_VR_STX(vxl, 0x07, 0x0F);
 
+/***                           SPE extension                               ***/
 /* Register moves */
+#if !defined(TARGET_PPC64)
+
 GEN32(gen_op_load_gpr64_T0, gen_op_load_gpr64_T0_gpr);
 GEN32(gen_op_load_gpr64_T1, gen_op_load_gpr64_T1_gpr);
 #if 0 // unused
@@ -5237,6 +5270,23 @@ GEN32(gen_op_store_T1_gpr64, gen_op_store_T1_gpr64_gpr);
 GEN32(gen_op_store_T2_gpr64, gen_op_store_T2_gpr64_gpr);
 #endif
 
+#else /* !defined(TARGET_PPC64) */
+
+/* No specific load/store functions: GPRs are already 64 bits */
+#define gen_op_load_gpr64_T0 gen_op_load_gpr_T0
+#define gen_op_load_gpr64_T1 gen_op_load_gpr_T1
+#if 0 // unused
+#define gen_op_load_gpr64_T2 gen_op_load_gpr_T2
+#endif
+
+#define gen_op_store_T0_gpr64 gen_op_store_T0_gpr
+#define gen_op_store_T1_gpr64 gen_op_store_T1_gpr
+#if 0 // unused
+#define gen_op_store_T2_gpr64 gen_op_store_T2_gpr
+#endif
+
+#endif /* !defined(TARGET_PPC64) */
+
 #define GEN_SPE(name0, name1, opc2, opc3, inval, type)                        \
 GEN_HANDLER(name0##_##name1, 0x04, opc2, opc3, inval, type)                   \
 {                                                                             \
@@ -5247,13 +5297,13 @@ GEN_HANDLER(name0##_##name1, 0x04, opc2, opc3, inval, type)                   \
 }
 
 /* Handler for undefined SPE opcodes */
-static inline void gen_speundef (DisasContext *ctx)
+static always_inline void gen_speundef (DisasContext *ctx)
 {
     GEN_EXCP_INVAL(ctx);
 }
 
 /* SPE load and stores */
-static inline void gen_addr_spe_imm_index (DisasContext *ctx, int sh)
+static always_inline void gen_addr_spe_imm_index (DisasContext *ctx, int sh)
 {
     target_long simm = rB(ctx->opcode);
 
@@ -5267,78 +5317,17 @@ static inline void gen_addr_spe_imm_index (DisasContext *ctx, int sh)
 }
 
 #define op_spe_ldst(name)        (*gen_op_##name[ctx->mem_idx])()
-#if defined(CONFIG_USER_ONLY)
-#if defined(TARGET_PPC64)
 #define OP_SPE_LD_TABLE(name)                                                 \
-static GenOpFunc *gen_op_spe_l##name[] = {                                    \
-    &gen_op_spe_l##name##_raw,                                                \
-    &gen_op_spe_l##name##_le_raw,                                             \
-    &gen_op_spe_l##name##_64_raw,                                             \
-    &gen_op_spe_l##name##_le_64_raw,                                          \
+static GenOpFunc *gen_op_spe_l##name[NB_MEM_FUNCS] = {                        \
+    GEN_MEM_FUNCS(spe_l##name),                                               \
 };
 #define OP_SPE_ST_TABLE(name)                                                 \
-static GenOpFunc *gen_op_spe_st##name[] = {                                   \
-    &gen_op_spe_st##name##_raw,                                               \
-    &gen_op_spe_st##name##_le_raw,                                            \
-    &gen_op_spe_st##name##_64_raw,                                            \
-    &gen_op_spe_st##name##_le_64_raw,                                         \
-};
-#else /* defined(TARGET_PPC64) */
-#define OP_SPE_LD_TABLE(name)                                                 \
-static GenOpFunc *gen_op_spe_l##name[] = {                                    \
-    &gen_op_spe_l##name##_raw,                                                \
-    &gen_op_spe_l##name##_le_raw,                                             \
+static GenOpFunc *gen_op_spe_st##name[NB_MEM_FUNCS] = {                       \
+    GEN_MEM_FUNCS(spe_st##name),                                              \
 };
-#define OP_SPE_ST_TABLE(name)                                                 \
-static GenOpFunc *gen_op_spe_st##name[] = {                                   \
-    &gen_op_spe_st##name##_raw,                                               \
-    &gen_op_spe_st##name##_le_raw,                                            \
-};
-#endif /* defined(TARGET_PPC64) */
-#else /* defined(CONFIG_USER_ONLY) */
-#if defined(TARGET_PPC64)
-#define OP_SPE_LD_TABLE(name)                                                 \
-static GenOpFunc *gen_op_spe_l##name[] = {                                    \
-    &gen_op_spe_l##name##_user,                                               \
-    &gen_op_spe_l##name##_le_user,                                            \
-    &gen_op_spe_l##name##_kernel,                                             \
-    &gen_op_spe_l##name##_le_kernel,                                          \
-    &gen_op_spe_l##name##_64_user,                                            \
-    &gen_op_spe_l##name##_le_64_user,                                         \
-    &gen_op_spe_l##name##_64_kernel,                                          \
-    &gen_op_spe_l##name##_le_64_kernel,                                       \
-};
-#define OP_SPE_ST_TABLE(name)                                                 \
-static GenOpFunc *gen_op_spe_st##name[] = {                                   \
-    &gen_op_spe_st##name##_user,                                              \
-    &gen_op_spe_st##name##_le_user,                                           \
-    &gen_op_spe_st##name##_kernel,                                            \
-    &gen_op_spe_st##name##_le_kernel,                                         \
-    &gen_op_spe_st##name##_64_user,                                           \
-    &gen_op_spe_st##name##_le_64_user,                                        \
-    &gen_op_spe_st##name##_64_kernel,                                         \
-    &gen_op_spe_st##name##_le_64_kernel,                                      \
-};
-#else /* defined(TARGET_PPC64) */
-#define OP_SPE_LD_TABLE(name)                                                 \
-static GenOpFunc *gen_op_spe_l##name[] = {                                    \
-    &gen_op_spe_l##name##_user,                                               \
-    &gen_op_spe_l##name##_le_user,                                            \
-    &gen_op_spe_l##name##_kernel,                                             \
-    &gen_op_spe_l##name##_le_kernel,                                          \
-};
-#define OP_SPE_ST_TABLE(name)                                                 \
-static GenOpFunc *gen_op_spe_st##name[] = {                                   \
-    &gen_op_spe_st##name##_user,                                              \
-    &gen_op_spe_st##name##_le_user,                                           \
-    &gen_op_spe_st##name##_kernel,                                            \
-    &gen_op_spe_st##name##_le_kernel,                                         \
-};
-#endif /* defined(TARGET_PPC64) */
-#endif /* defined(CONFIG_USER_ONLY) */
 
 #define GEN_SPE_LD(name, sh)                                                  \
-static inline void gen_evl##name (DisasContext *ctx)                          \
+static always_inline void gen_evl##name (DisasContext *ctx)                   \
 {                                                                             \
     if (unlikely(!ctx->spe_enabled)) {                                        \
         GEN_EXCP_NO_AP(ctx);                                                  \
@@ -5350,7 +5339,7 @@ static inline void gen_evl##name (DisasContext *ctx)                          \
 }
 
 #define GEN_SPE_LDX(name)                                                     \
-static inline void gen_evl##name##x (DisasContext *ctx)                       \
+static always_inline void gen_evl##name##x (DisasContext *ctx)                \
 {                                                                             \
     if (unlikely(!ctx->spe_enabled)) {                                        \
         GEN_EXCP_NO_AP(ctx);                                                  \
@@ -5367,7 +5356,7 @@ GEN_SPE_LD(name, sh);                                                         \
 GEN_SPE_LDX(name)
 
 #define GEN_SPE_ST(name, sh)                                                  \
-static inline void gen_evst##name (DisasContext *ctx)                         \
+static always_inline void gen_evst##name (DisasContext *ctx)                  \
 {                                                                             \
     if (unlikely(!ctx->spe_enabled)) {                                        \
         GEN_EXCP_NO_AP(ctx);                                                  \
@@ -5379,7 +5368,7 @@ static inline void gen_evst##name (DisasContext *ctx)                         \
 }
 
 #define GEN_SPE_STX(name)                                                     \
-static inline void gen_evst##name##x (DisasContext *ctx)                      \
+static always_inline void gen_evst##name##x (DisasContext *ctx)               \
 {                                                                             \
     if (unlikely(!ctx->spe_enabled)) {                                        \
         GEN_EXCP_NO_AP(ctx);                                                  \
@@ -5401,7 +5390,7 @@ GEN_SPEOP_ST(name, sh)
 
 /* SPE arithmetic and logic */
 #define GEN_SPEOP_ARITH2(name)                                                \
-static inline void gen_##name (DisasContext *ctx)                             \
+static always_inline void gen_##name (DisasContext *ctx)                      \
 {                                                                             \
     if (unlikely(!ctx->spe_enabled)) {                                        \
         GEN_EXCP_NO_AP(ctx);                                                  \
@@ -5414,7 +5403,7 @@ static inline void gen_##name (DisasContext *ctx)                             \
 }
 
 #define GEN_SPEOP_ARITH1(name)                                                \
-static inline void gen_##name (DisasContext *ctx)                             \
+static always_inline void gen_##name (DisasContext *ctx)                      \
 {                                                                             \
     if (unlikely(!ctx->spe_enabled)) {                                        \
         GEN_EXCP_NO_AP(ctx);                                                  \
@@ -5426,7 +5415,7 @@ static inline void gen_##name (DisasContext *ctx)                             \
 }
 
 #define GEN_SPEOP_COMP(name)                                                  \
-static inline void gen_##name (DisasContext *ctx)                             \
+static always_inline void gen_##name (DisasContext *ctx)                      \
 {                                                                             \
     if (unlikely(!ctx->spe_enabled)) {                                        \
         GEN_EXCP_NO_AP(ctx);                                                  \
@@ -5466,17 +5455,17 @@ GEN_SPEOP_ARITH1(evextsh);
 GEN_SPEOP_ARITH1(evrndw);
 GEN_SPEOP_ARITH1(evcntlzw);
 GEN_SPEOP_ARITH1(evcntlsw);
-static inline void gen_brinc (DisasContext *ctx)
+static always_inline void gen_brinc (DisasContext *ctx)
 {
     /* Note: brinc is usable even if SPE is disabled */
-    gen_op_load_gpr64_T0(rA(ctx->opcode));
-    gen_op_load_gpr64_T1(rB(ctx->opcode));
+    gen_op_load_gpr_T0(rA(ctx->opcode));
+    gen_op_load_gpr_T1(rB(ctx->opcode));
     gen_op_brinc();
-    gen_op_store_T0_gpr64(rD(ctx->opcode));
+    gen_op_store_T0_gpr(rD(ctx->opcode));
 }
 
 #define GEN_SPEOP_ARITH_IMM2(name)                                            \
-static inline void gen_##name##i (DisasContext *ctx)                          \
+static always_inline void gen_##name##i (DisasContext *ctx)                   \
 {                                                                             \
     if (unlikely(!ctx->spe_enabled)) {                                        \
         GEN_EXCP_NO_AP(ctx);                                                  \
@@ -5489,7 +5478,7 @@ static inline void gen_##name##i (DisasContext *ctx)                          \
 }
 
 #define GEN_SPEOP_LOGIC_IMM2(name)                                            \
-static inline void gen_##name##i (DisasContext *ctx)                          \
+static always_inline void gen_##name##i (DisasContext *ctx)                   \
 {                                                                             \
     if (unlikely(!ctx->spe_enabled)) {                                        \
         GEN_EXCP_NO_AP(ctx);                                                  \
@@ -5512,7 +5501,7 @@ GEN_SPEOP_LOGIC_IMM2(evsrws);
 #define gen_evsrwiu gen_evsrwui
 GEN_SPEOP_LOGIC_IMM2(evrlw);
 
-static inline void gen_evsplati (DisasContext *ctx)
+static always_inline void gen_evsplati (DisasContext *ctx)
 {
     int32_t imm = (int32_t)(rA(ctx->opcode) << 27) >> 27;
 
@@ -5520,7 +5509,7 @@ static inline void gen_evsplati (DisasContext *ctx)
     gen_op_store_T0_gpr64(rD(ctx->opcode));
 }
 
-static inline void gen_evsplatfi (DisasContext *ctx)
+static always_inline void gen_evsplatfi (DisasContext *ctx)
 {
     uint32_t imm = rA(ctx->opcode) << 27;
 
@@ -5561,7 +5550,7 @@ GEN_SPE(evcmpgtu,       evcmpgts,      0x18, 0x08, 0x00600000, PPC_SPE); ////
 GEN_SPE(evcmpltu,       evcmplts,      0x19, 0x08, 0x00600000, PPC_SPE); ////
 GEN_SPE(evcmpeq,        speundef,      0x1A, 0x08, 0x00600000, PPC_SPE); ////
 
-static inline void gen_evsel (DisasContext *ctx)
+static always_inline void gen_evsel (DisasContext *ctx)
 {
     if (unlikely(!ctx->spe_enabled)) {
         GEN_EXCP_NO_AP(ctx);
@@ -5574,19 +5563,19 @@ static inline void gen_evsel (DisasContext *ctx)
     gen_op_store_T0_gpr64(rD(ctx->opcode));
 }
 
-GEN_HANDLER(evsel0, 0x04, 0x1c, 0x09, 0x00000000, PPC_SPE)
+GEN_HANDLER2(evsel0, "evsel", 0x04, 0x1c, 0x09, 0x00000000, PPC_SPE)
 {
     gen_evsel(ctx);
 }
-GEN_HANDLER(evsel1, 0x04, 0x1d, 0x09, 0x00000000, PPC_SPE)
+GEN_HANDLER2(evsel1, "evsel", 0x04, 0x1d, 0x09, 0x00000000, PPC_SPE)
 {
     gen_evsel(ctx);
 }
-GEN_HANDLER(evsel2, 0x04, 0x1e, 0x09, 0x00000000, PPC_SPE)
+GEN_HANDLER2(evsel2, "evsel", 0x04, 0x1e, 0x09, 0x00000000, PPC_SPE)
 {
     gen_evsel(ctx);
 }
-GEN_HANDLER(evsel3, 0x04, 0x1f, 0x09, 0x00000000, PPC_SPE)
+GEN_HANDLER2(evsel3, "evsel", 0x04, 0x1f, 0x09, 0x00000000, PPC_SPE)
 {
     gen_evsel(ctx);
 }
@@ -5596,33 +5585,38 @@ GEN_HANDLER(evsel3, 0x04, 0x1f, 0x09, 0x00000000, PPC_SPE)
 /* In that case, we already have 64 bits load & stores
  * so, spe_ldd is equivalent to ld and spe_std is equivalent to std
  */
-#if defined(CONFIG_USER_ONLY)
-#define gen_op_spe_ldd_raw gen_op_ld_raw
-#define gen_op_spe_ldd_64_raw gen_op_ld_64_raw
-#define gen_op_spe_ldd_le_raw gen_op_ld_le_raw
-#define gen_op_spe_ldd_le_64_raw gen_op_ld_le_64_raw
-#define gen_op_spe_stdd_raw gen_op_ld_raw
-#define gen_op_spe_stdd_64_raw gen_op_std_64_raw
-#define gen_op_spe_stdd_le_raw gen_op_std_le_raw
-#define gen_op_spe_stdd_le_64_raw gen_op_std_le_64_raw
-#else /* defined(CONFIG_USER_ONLY) */
-#define gen_op_spe_ldd_kernel gen_op_ld_kernel
-#define gen_op_spe_ldd_64_kernel gen_op_ld_64_kernel
-#define gen_op_spe_ldd_le_kernel gen_op_ld_kernel
-#define gen_op_spe_ldd_le_64_kernel gen_op_ld_64_kernel
-#define gen_op_spe_ldd_user gen_op_ld_user
-#define gen_op_spe_ldd_64_user gen_op_ld_64_user
-#define gen_op_spe_ldd_le_user gen_op_ld_le_user
-#define gen_op_spe_ldd_le_64_user gen_op_ld_le_64_user
-#define gen_op_spe_stdd_kernel gen_op_std_kernel
-#define gen_op_spe_stdd_64_kernel gen_op_std_64_kernel
-#define gen_op_spe_stdd_le_kernel gen_op_std_kernel
-#define gen_op_spe_stdd_le_64_kernel gen_op_std_64_kernel
-#define gen_op_spe_stdd_user gen_op_std_user
-#define gen_op_spe_stdd_64_user gen_op_std_64_user
-#define gen_op_spe_stdd_le_user gen_op_std_le_user
-#define gen_op_spe_stdd_le_64_user gen_op_std_le_64_user
-#endif /* defined(CONFIG_USER_ONLY) */
+#define gen_op_spe_ldd_raw           gen_op_ld_raw
+#define gen_op_spe_ldd_user          gen_op_ld_user
+#define gen_op_spe_ldd_kernel        gen_op_ld_kernel
+#define gen_op_spe_ldd_hypv          gen_op_ld_hypv
+#define gen_op_spe_ldd_64_raw        gen_op_ld_64_raw
+#define gen_op_spe_ldd_64_user       gen_op_ld_64_user
+#define gen_op_spe_ldd_64_kernel     gen_op_ld_64_kernel
+#define gen_op_spe_ldd_64_hypv       gen_op_ld_64_hypv
+#define gen_op_spe_ldd_le_raw        gen_op_ld_le_raw
+#define gen_op_spe_ldd_le_user       gen_op_ld_le_user
+#define gen_op_spe_ldd_le_kernel     gen_op_ld_le_kernel
+#define gen_op_spe_ldd_le_hypv       gen_op_ld_le_hypv
+#define gen_op_spe_ldd_le_64_raw     gen_op_ld_le_64_raw
+#define gen_op_spe_ldd_le_64_user    gen_op_ld_le_64_user
+#define gen_op_spe_ldd_le_64_kernel  gen_op_ld_le_64_kernel
+#define gen_op_spe_ldd_le_64_hypv    gen_op_ld_le_64_hypv
+#define gen_op_spe_stdd_raw          gen_op_std_raw
+#define gen_op_spe_stdd_user         gen_op_std_user
+#define gen_op_spe_stdd_kernel       gen_op_std_kernel
+#define gen_op_spe_stdd_hypv         gen_op_std_hypv
+#define gen_op_spe_stdd_64_raw       gen_op_std_64_raw
+#define gen_op_spe_stdd_64_user      gen_op_std_64_user
+#define gen_op_spe_stdd_64_kernel    gen_op_std_64_kernel
+#define gen_op_spe_stdd_64_hypv      gen_op_std_64_hypv
+#define gen_op_spe_stdd_le_raw       gen_op_std_le_raw
+#define gen_op_spe_stdd_le_user      gen_op_std_le_user
+#define gen_op_spe_stdd_le_kernel    gen_op_std_le_kernel
+#define gen_op_spe_stdd_le_hypv      gen_op_std_le_hypv
+#define gen_op_spe_stdd_le_64_raw    gen_op_std_le_64_raw
+#define gen_op_spe_stdd_le_64_user   gen_op_std_le_64_user
+#define gen_op_spe_stdd_le_64_kernel gen_op_std_le_64_kernel
+#define gen_op_spe_stdd_le_64_hypv   gen_op_std_le_64_hypv
 #endif /* defined(TARGET_PPC64) */
 GEN_SPEOP_LDST(dd, 3);
 GEN_SPEOP_LDST(dw, 3);
@@ -5634,30 +5628,31 @@ GEN_SPEOP_ST(who, 2);
 
 #if defined(TARGET_PPC64)
 /* In that case, spe_stwwo is equivalent to stw */
-#if defined(CONFIG_USER_ONLY)
-#define gen_op_spe_stwwo_raw gen_op_stw_raw
-#define gen_op_spe_stwwo_le_raw gen_op_stw_le_raw
-#define gen_op_spe_stwwo_64_raw gen_op_stw_64_raw
-#define gen_op_spe_stwwo_le_64_raw gen_op_stw_le_64_raw
-#else
-#define gen_op_spe_stwwo_user gen_op_stw_user
-#define gen_op_spe_stwwo_le_user gen_op_stw_le_user
-#define gen_op_spe_stwwo_64_user gen_op_stw_64_user
-#define gen_op_spe_stwwo_le_64_user gen_op_stw_le_64_user
-#define gen_op_spe_stwwo_kernel gen_op_stw_kernel
-#define gen_op_spe_stwwo_le_kernel gen_op_stw_le_kernel
-#define gen_op_spe_stwwo_64_kernel gen_op_stw_64_kernel
+#define gen_op_spe_stwwo_raw          gen_op_stw_raw
+#define gen_op_spe_stwwo_user         gen_op_stw_user
+#define gen_op_spe_stwwo_kernel       gen_op_stw_kernel
+#define gen_op_spe_stwwo_hypv         gen_op_stw_hypv
+#define gen_op_spe_stwwo_le_raw       gen_op_stw_le_raw
+#define gen_op_spe_stwwo_le_user      gen_op_stw_le_user
+#define gen_op_spe_stwwo_le_kernel    gen_op_stw_le_kernel
+#define gen_op_spe_stwwo_le_hypv      gen_op_stw_le_hypv
+#define gen_op_spe_stwwo_64_raw       gen_op_stw_64_raw
+#define gen_op_spe_stwwo_64_user      gen_op_stw_64_user
+#define gen_op_spe_stwwo_64_kernel    gen_op_stw_64_kernel
+#define gen_op_spe_stwwo_64_hypv      gen_op_stw_64_hypv
+#define gen_op_spe_stwwo_le_64_raw    gen_op_stw_le_64_raw
+#define gen_op_spe_stwwo_le_64_user   gen_op_stw_le_64_user
 #define gen_op_spe_stwwo_le_64_kernel gen_op_stw_le_64_kernel
-#endif
+#define gen_op_spe_stwwo_le_64_hypv   gen_op_stw_le_64_hypv
 #endif
 #define _GEN_OP_SPE_STWWE(suffix)                                             \
-static inline void gen_op_spe_stwwe_##suffix (void)                           \
+static always_inline void gen_op_spe_stwwe_##suffix (void)                    \
 {                                                                             \
     gen_op_srli32_T1_64();                                                    \
     gen_op_spe_stwwo_##suffix();                                              \
 }
 #define _GEN_OP_SPE_STWWE_LE(suffix)                                          \
-static inline void gen_op_spe_stwwe_le_##suffix (void)                        \
+static always_inline void gen_op_spe_stwwe_le_##suffix (void)                 \
 {                                                                             \
     gen_op_srli32_T1_64();                                                    \
     gen_op_spe_stwwo_le_##suffix();                                           \
@@ -5666,12 +5661,12 @@ static inline void gen_op_spe_stwwe_le_##suffix (void)                        \
 #define GEN_OP_SPE_STWWE(suffix)                                              \
 _GEN_OP_SPE_STWWE(suffix);                                                    \
 _GEN_OP_SPE_STWWE_LE(suffix);                                                 \
-static inline void gen_op_spe_stwwe_64_##suffix (void)                        \
+static always_inline void gen_op_spe_stwwe_64_##suffix (void)                 \
 {                                                                             \
     gen_op_srli32_T1_64();                                                    \
     gen_op_spe_stwwo_64_##suffix();                                           \
 }                                                                             \
-static inline void gen_op_spe_stwwe_le_64_##suffix (void)                     \
+static always_inline void gen_op_spe_stwwe_le_64_##suffix (void)              \
 {                                                                             \
     gen_op_srli32_T1_64();                                                    \
     gen_op_spe_stwwo_le_64_##suffix();                                        \
@@ -5684,28 +5679,29 @@ _GEN_OP_SPE_STWWE_LE(suffix)
 #if defined(CONFIG_USER_ONLY)
 GEN_OP_SPE_STWWE(raw);
 #else /* defined(CONFIG_USER_ONLY) */
-GEN_OP_SPE_STWWE(kernel);
 GEN_OP_SPE_STWWE(user);
+GEN_OP_SPE_STWWE(kernel);
+GEN_OP_SPE_STWWE(hypv);
 #endif /* defined(CONFIG_USER_ONLY) */
 GEN_SPEOP_ST(wwe, 2);
 GEN_SPEOP_ST(wwo, 2);
 
 #define GEN_SPE_LDSPLAT(name, op, suffix)                                     \
-static inline void gen_op_spe_l##name##_##suffix (void)                       \
+static always_inline void gen_op_spe_l##name##_##suffix (void)                \
 {                                                                             \
     gen_op_##op##_##suffix();                                                 \
     gen_op_splatw_T1_64();                                                    \
 }
 
 #define GEN_OP_SPE_LHE(suffix)                                                \
-static inline void gen_op_spe_lhe_##suffix (void)                             \
+static always_inline void gen_op_spe_lhe_##suffix (void)                      \
 {                                                                             \
     gen_op_spe_lh_##suffix();                                                 \
     gen_op_sli16_T1_64();                                                     \
 }
 
 #define GEN_OP_SPE_LHX(suffix)                                                \
-static inline void gen_op_spe_lhx_##suffix (void)                             \
+static always_inline void gen_op_spe_lhx_##suffix (void)                      \
 {                                                                             \
     gen_op_spe_lh_##suffix();                                                 \
     gen_op_extsh_T1_64();                                                     \
@@ -5735,47 +5731,67 @@ GEN_OP_SPE_LHX(le_64_raw);
 GEN_SPE_LDSPLAT(hhossplat, spe_lhx, le_64_raw);
 #endif
 #else
-GEN_OP_SPE_LHE(kernel);
 GEN_OP_SPE_LHE(user);
-GEN_SPE_LDSPLAT(hhesplat, spe_lhe, kernel);
+GEN_OP_SPE_LHE(kernel);
+GEN_OP_SPE_LHE(hypv);
 GEN_SPE_LDSPLAT(hhesplat, spe_lhe, user);
-GEN_OP_SPE_LHE(le_kernel);
+GEN_SPE_LDSPLAT(hhesplat, spe_lhe, kernel);
+GEN_SPE_LDSPLAT(hhesplat, spe_lhe, hypv);
 GEN_OP_SPE_LHE(le_user);
-GEN_SPE_LDSPLAT(hhesplat, spe_lhe, le_kernel);
+GEN_OP_SPE_LHE(le_kernel);
+GEN_OP_SPE_LHE(le_hypv);
 GEN_SPE_LDSPLAT(hhesplat, spe_lhe, le_user);
-GEN_SPE_LDSPLAT(hhousplat, spe_lh, kernel);
+GEN_SPE_LDSPLAT(hhesplat, spe_lhe, le_kernel);
+GEN_SPE_LDSPLAT(hhesplat, spe_lhe, le_hypv);
 GEN_SPE_LDSPLAT(hhousplat, spe_lh, user);
-GEN_SPE_LDSPLAT(hhousplat, spe_lh, le_kernel);
+GEN_SPE_LDSPLAT(hhousplat, spe_lh, kernel);
+GEN_SPE_LDSPLAT(hhousplat, spe_lh, hypv);
 GEN_SPE_LDSPLAT(hhousplat, spe_lh, le_user);
-GEN_OP_SPE_LHX(kernel);
+GEN_SPE_LDSPLAT(hhousplat, spe_lh, le_kernel);
+GEN_SPE_LDSPLAT(hhousplat, spe_lh, le_hypv);
 GEN_OP_SPE_LHX(user);
-GEN_SPE_LDSPLAT(hhossplat, spe_lhx, kernel);
+GEN_OP_SPE_LHX(kernel);
+GEN_OP_SPE_LHX(hypv);
 GEN_SPE_LDSPLAT(hhossplat, spe_lhx, user);
-GEN_OP_SPE_LHX(le_kernel);
+GEN_SPE_LDSPLAT(hhossplat, spe_lhx, kernel);
+GEN_SPE_LDSPLAT(hhossplat, spe_lhx, hypv);
 GEN_OP_SPE_LHX(le_user);
-GEN_SPE_LDSPLAT(hhossplat, spe_lhx, le_kernel);
+GEN_OP_SPE_LHX(le_kernel);
+GEN_OP_SPE_LHX(le_hypv);
 GEN_SPE_LDSPLAT(hhossplat, spe_lhx, le_user);
+GEN_SPE_LDSPLAT(hhossplat, spe_lhx, le_kernel);
+GEN_SPE_LDSPLAT(hhossplat, spe_lhx, le_hypv);
 #if defined(TARGET_PPC64)
-GEN_OP_SPE_LHE(64_kernel);
 GEN_OP_SPE_LHE(64_user);
-GEN_SPE_LDSPLAT(hhesplat, spe_lhe, 64_kernel);
+GEN_OP_SPE_LHE(64_kernel);
+GEN_OP_SPE_LHE(64_hypv);
 GEN_SPE_LDSPLAT(hhesplat, spe_lhe, 64_user);
-GEN_OP_SPE_LHE(le_64_kernel);
+GEN_SPE_LDSPLAT(hhesplat, spe_lhe, 64_kernel);
+GEN_SPE_LDSPLAT(hhesplat, spe_lhe, 64_hypv);
 GEN_OP_SPE_LHE(le_64_user);
-GEN_SPE_LDSPLAT(hhesplat, spe_lhe, le_64_kernel);
+GEN_OP_SPE_LHE(le_64_kernel);
+GEN_OP_SPE_LHE(le_64_hypv);
 GEN_SPE_LDSPLAT(hhesplat, spe_lhe, le_64_user);
-GEN_SPE_LDSPLAT(hhousplat, spe_lh, 64_kernel);
+GEN_SPE_LDSPLAT(hhesplat, spe_lhe, le_64_kernel);
+GEN_SPE_LDSPLAT(hhesplat, spe_lhe, le_64_hypv);
 GEN_SPE_LDSPLAT(hhousplat, spe_lh, 64_user);
-GEN_SPE_LDSPLAT(hhousplat, spe_lh, le_64_kernel);
+GEN_SPE_LDSPLAT(hhousplat, spe_lh, 64_kernel);
+GEN_SPE_LDSPLAT(hhousplat, spe_lh, 64_hypv);
 GEN_SPE_LDSPLAT(hhousplat, spe_lh, le_64_user);
-GEN_OP_SPE_LHX(64_kernel);
+GEN_SPE_LDSPLAT(hhousplat, spe_lh, le_64_kernel);
+GEN_SPE_LDSPLAT(hhousplat, spe_lh, le_64_hypv);
 GEN_OP_SPE_LHX(64_user);
-GEN_SPE_LDSPLAT(hhossplat, spe_lhx, 64_kernel);
+GEN_OP_SPE_LHX(64_kernel);
+GEN_OP_SPE_LHX(64_hypv);
 GEN_SPE_LDSPLAT(hhossplat, spe_lhx, 64_user);
-GEN_OP_SPE_LHX(le_64_kernel);
+GEN_SPE_LDSPLAT(hhossplat, spe_lhx, 64_kernel);
+GEN_SPE_LDSPLAT(hhossplat, spe_lhx, 64_hypv);
 GEN_OP_SPE_LHX(le_64_user);
-GEN_SPE_LDSPLAT(hhossplat, spe_lhx, le_64_kernel);
+GEN_OP_SPE_LHX(le_64_kernel);
+GEN_OP_SPE_LHX(le_64_hypv);
 GEN_SPE_LDSPLAT(hhossplat, spe_lhx, le_64_user);
+GEN_SPE_LDSPLAT(hhossplat, spe_lhx, le_64_kernel);
+GEN_SPE_LDSPLAT(hhossplat, spe_lhx, le_64_hypv);
 #endif
 #endif
 GEN_SPEOP_LD(hhesplat, 1);
@@ -5881,7 +5897,7 @@ GEN_SPE(speundef,       evmwsmfan,     0x0D, 0x17, 0x00000000, PPC_SPE);
 
 /***                      SPE floating-point extension                     ***/
 #define GEN_SPEFPUOP_CONV(name)                                               \
-static inline void gen_##name (DisasContext *ctx)                             \
+static always_inline void gen_##name (DisasContext *ctx)                      \
 {                                                                             \
     gen_op_load_gpr64_T0(rB(ctx->opcode));                                    \
     gen_op_##name();                                                          \
@@ -5962,7 +5978,7 @@ GEN_SPEOP_COMP(efststlt);
 GEN_SPEOP_COMP(efststeq);
 
 /* Opcodes definitions */
-GEN_SPE(efsadd,         efssub,        0x00, 0x0A, 0x00000000, PPC_SPEFPU); //
+GEN_SPE(efsadd,         efssub,        0x00, 0x0B, 0x00000000, PPC_SPEFPU); //
 GEN_SPE(efsabs,         efsnabs,       0x02, 0x0B, 0x0000F800, PPC_SPEFPU); //
 GEN_SPE(efsneg,         speundef,      0x03, 0x0B, 0x0000F800, PPC_SPEFPU); //
 GEN_SPE(efsmul,         efsdiv,        0x04, 0x0B, 0x00000000, PPC_SPEFPU); //
@@ -6027,62 +6043,44 @@ GEN_SPE(efdctuiz,       speundef,      0x1C, 0x0B, 0x00180000, PPC_SPEFPU); //
 GEN_SPE(efdctsiz,       speundef,      0x1D, 0x0B, 0x00180000, PPC_SPEFPU); //
 GEN_SPE(efdtstgt,       efdtstlt,      0x1E, 0x0B, 0x00600000, PPC_SPEFPU); //
 GEN_SPE(efdtsteq,       speundef,      0x1F, 0x0B, 0x00600000, PPC_SPEFPU); //
-#endif
 
 /* End opcode list */
 GEN_OPCODE_MARK(end);
 
 #include "translate_init.c"
+#include "helper_regs.h"
 
 /*****************************************************************************/
 /* Misc PowerPC helpers */
-static inline uint32_t load_xer (CPUState *env)
-{
-    return (xer_so << XER_SO) |
-        (xer_ov << XER_OV) |
-        (xer_ca << XER_CA) |
-        (xer_bc << XER_BC) |
-        (xer_cmp << XER_CMP);
-}
-
 void cpu_dump_state (CPUState *env, FILE *f,
                      int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
                      int flags)
 {
-#if defined(TARGET_PPC64) || 1
-#define FILL ""
 #define RGPL  4
 #define RFPL  4
-#else
-#define FILL "        "
-#define RGPL  8
-#define RFPL  4
-#endif
 
     int i;
 
-    cpu_fprintf(f, "NIP " ADDRX " LR " ADDRX " CTR " ADDRX "\n",
-                env->nip, env->lr, env->ctr);
-    cpu_fprintf(f, "MSR " REGX FILL " XER %08x      "
+    cpu_fprintf(f, "NIP " ADDRX "   LR " ADDRX " CTR " ADDRX " XER %08x\n",
+                env->nip, env->lr, env->ctr, hreg_load_xer(env));
+    cpu_fprintf(f, "MSR " ADDRX " HID0 " ADDRX "  HF " ADDRX " idx %d\n",
+                env->msr, env->spr[SPR_HID0], env->hflags, env->mmu_idx);
 #if !defined(NO_TIMER_DUMP)
-                "TB %08x %08x "
+    cpu_fprintf(f, "TB %08x %08x "
 #if !defined(CONFIG_USER_ONLY)
                 "DECR %08x"
 #endif
-#endif
                 "\n",
-                do_load_msr(env), load_xer(env)
-#if !defined(NO_TIMER_DUMP)
-                , cpu_ppc_load_tbu(env), cpu_ppc_load_tbl(env)
+                cpu_ppc_load_tbu(env), cpu_ppc_load_tbl(env)
 #if !defined(CONFIG_USER_ONLY)
                 , cpu_ppc_load_decr(env)
 #endif
-#endif
                 );
+#endif
     for (i = 0; i < 32; i++) {
         if ((i & (RGPL - 1)) == 0)
             cpu_fprintf(f, "GPR%02d", i);
-        cpu_fprintf(f, " " REGX, (target_ulong)env->gpr[i]);
+        cpu_fprintf(f, " " REGX, ppc_dump_gpr(env, i));
         if ((i & (RGPL - 1)) == (RGPL - 1))
             cpu_fprintf(f, "\n");
     }
@@ -6100,7 +6098,7 @@ void cpu_dump_state (CPUState *env, FILE *f,
             a = 'E';
         cpu_fprintf(f, " %c%c", a, env->crf[i] & 0x01 ? 'O' : ' ');
     }
-    cpu_fprintf(f, " ]             " FILL "RES " REGX "\n", env->reserve);
+    cpu_fprintf(f, " ]             RES " ADDRX "\n", env->reserve);
     for (i = 0; i < 32; i++) {
         if ((i & (RFPL - 1)) == 0)
             cpu_fprintf(f, "FPR%02d", i);
@@ -6108,13 +6106,13 @@ void cpu_dump_state (CPUState *env, FILE *f,
         if ((i & (RFPL - 1)) == (RFPL - 1))
             cpu_fprintf(f, "\n");
     }
-    cpu_fprintf(f, "SRR0 " REGX " SRR1 " REGX "         " FILL FILL FILL
-                "SDR1 " REGX "\n",
+#if !defined(CONFIG_USER_ONLY)
+    cpu_fprintf(f, "SRR0 " ADDRX " SRR1 " ADDRX " SDR1 " ADDRX "\n",
                 env->spr[SPR_SRR0], env->spr[SPR_SRR1], env->sdr1);
+#endif
 
 #undef RGPL
 #undef RFPL
-#undef FILL
 }
 
 void cpu_dump_statistics (CPUState *env, FILE*f,
@@ -6165,50 +6163,60 @@ void cpu_dump_statistics (CPUState *env, FILE*f,
 }
 
 /*****************************************************************************/
-static inline int gen_intermediate_code_internal (CPUState *env,
-                                                  TranslationBlock *tb,
-                                                  int search_pc)
+static always_inline int gen_intermediate_code_internal (CPUState *env,
+                                                         TranslationBlock *tb,
+                                                         int search_pc)
 {
     DisasContext ctx, *ctxp = &ctx;
     opc_handler_t **table, *handler;
     target_ulong pc_start;
     uint16_t *gen_opc_end;
+    int supervisor, little_endian;
+    int single_step, branch_step;
     int j, lj = -1;
 
     pc_start = tb->pc;
     gen_opc_ptr = gen_opc_buf;
     gen_opc_end = gen_opc_buf + OPC_MAX_SIZE;
     gen_opparam_ptr = gen_opparam_buf;
+#if defined(OPTIMIZE_FPRF_UPDATE)
+    gen_fprf_ptr = gen_fprf_buf;
+#endif
     nb_gen_labels = 0;
     ctx.nip = pc_start;
     ctx.tb = tb;
     ctx.exception = POWERPC_EXCP_NONE;
     ctx.spr_cb = env->spr_cb;
-#if defined(CONFIG_USER_ONLY)
-    ctx.mem_idx = msr_le;
-#if defined(TARGET_PPC64)
-    ctx.mem_idx |= msr_sf << 1;
-#endif
-#else
-#if defined(TARGET_PPC64H)
-    if (msr_pr == 0 && msr_hv == 1)
-        ctx.supervisor = 2;
-    else
-#endif
-        ctx.supervisor = 1 - msr_pr;
-    ctx.mem_idx = ((1 - msr_pr) << 1) | msr_le;
-#if defined(TARGET_PPC64)
-    ctx.mem_idx |= msr_sf << 2;
-#endif
+    supervisor = env->mmu_idx;
+#if !defined(CONFIG_USER_ONLY)
+    ctx.supervisor = supervisor;
 #endif
+    little_endian = env->hflags & (1 << MSR_LE) ? 1 : 0;
 #if defined(TARGET_PPC64)
     ctx.sf_mode = msr_sf;
+    ctx.mem_idx = (supervisor << 2) | (msr_sf << 1) | little_endian;
+#else
+    ctx.mem_idx = (supervisor << 1) | little_endian;
 #endif
+    ctx.dcache_line_size = env->dcache_line_size;
     ctx.fpu_enabled = msr_fp;
-#if defined(TARGET_PPCEMB)
-    ctx.spe_enabled = msr_spe;
-#endif
-    ctx.singlestep_enabled = env->singlestep_enabled;
+    if ((env->flags & POWERPC_FLAG_SPE) && msr_spe)
+        ctx.spe_enabled = msr_spe;
+    else
+        ctx.spe_enabled = 0;
+    if ((env->flags & POWERPC_FLAG_VRE) && msr_vr)
+        ctx.altivec_enabled = msr_vr;
+    else
+        ctx.altivec_enabled = 0;
+    if ((env->flags & POWERPC_FLAG_SE) && msr_se)
+        single_step = 1;
+    else
+        single_step = 0;
+    if ((env->flags & POWERPC_FLAG_BE) && msr_be)
+        branch_step = 1;
+    else
+        branch_step = 0;
+    ctx.singlestep_enabled = env->singlestep_enabled || single_step == 1;
 #if defined (DO_SINGLE_STEP) && 0
     /* Single step trace mode */
     msr_se = 1;
@@ -6238,21 +6246,19 @@ static inline int gen_intermediate_code_internal (CPUState *env,
         if (loglevel & CPU_LOG_TB_IN_ASM) {
             fprintf(logfile, "----------------\n");
             fprintf(logfile, "nip=" ADDRX " super=%d ir=%d\n",
-                    ctx.nip, 1 - msr_pr, msr_ir);
+                    ctx.nip, supervisor, (int)msr_ir);
         }
 #endif
-        ctx.opcode = ldl_code(ctx.nip);
-        if (msr_le) {
-            ctx.opcode = ((ctx.opcode & 0xFF000000) >> 24) |
-                ((ctx.opcode & 0x00FF0000) >> 8) |
-                ((ctx.opcode & 0x0000FF00) << 8) |
-                ((ctx.opcode & 0x000000FF) << 24);
+        if (unlikely(little_endian)) {
+            ctx.opcode = bswap32(ldl_code(ctx.nip));
+        } else {
+            ctx.opcode = ldl_code(ctx.nip);
         }
 #if defined PPC_DEBUG_DISAS
         if (loglevel & CPU_LOG_TB_IN_ASM) {
             fprintf(logfile, "translate opcode %08x (%02x %02x %02x) (%s)\n",
                     ctx.opcode, opc1(ctx.opcode), opc2(ctx.opcode),
-                    opc3(ctx.opcode), msr_le ? "little" : "big");
+                    opc3(ctx.opcode), little_endian ? "little" : "big");
         }
 #endif
         ctx.nip += 4;
@@ -6270,26 +6276,26 @@ static inline int gen_intermediate_code_internal (CPUState *env,
         if (unlikely(handler->handler == &gen_invalid)) {
             if (loglevel != 0) {
                 fprintf(logfile, "invalid/unsupported opcode: "
-                        "%02x - %02x - %02x (%08x) 0x" ADDRX " %d\n",
+                        "%02x - %02x - %02x (%08x) " ADDRX " %d\n",
                         opc1(ctx.opcode), opc2(ctx.opcode),
-                        opc3(ctx.opcode), ctx.opcode, ctx.nip - 4, msr_ir);
+                        opc3(ctx.opcode), ctx.opcode, ctx.nip - 4, (int)msr_ir);
             } else {
                 printf("invalid/unsupported opcode: "
-                       "%02x - %02x - %02x (%08x) 0x" ADDRX " %d\n",
+                       "%02x - %02x - %02x (%08x) " ADDRX " %d\n",
                        opc1(ctx.opcode), opc2(ctx.opcode),
-                       opc3(ctx.opcode), ctx.opcode, ctx.nip - 4, msr_ir);
+                       opc3(ctx.opcode), ctx.opcode, ctx.nip - 4, (int)msr_ir);
             }
         } else {
             if (unlikely((ctx.opcode & handler->inval) != 0)) {
                 if (loglevel != 0) {
                     fprintf(logfile, "invalid bits: %08x for opcode: "
-                            "%02x - %02x - %02x (%08x) 0x" ADDRX "\n",
+                            "%02x - %02x - %02x (%08x) " ADDRX "\n",
                             ctx.opcode & handler->inval, opc1(ctx.opcode),
                             opc2(ctx.opcode), opc3(ctx.opcode),
                             ctx.opcode, ctx.nip - 4);
                 } else {
                     printf("invalid bits: %08x for opcode: "
-                           "%02x - %02x - %02x (%08x) 0x" ADDRX "\n",
+                           "%02x - %02x - %02x (%08x) " ADDRX "\n",
                            ctx.opcode & handler->inval, opc1(ctx.opcode),
                            opc2(ctx.opcode), opc3(ctx.opcode),
                            ctx.opcode, ctx.nip - 4);
@@ -6303,30 +6309,20 @@ static inline int gen_intermediate_code_internal (CPUState *env,
         handler->count++;
 #endif
         /* Check trace mode exceptions */
-#if 0 // XXX: buggy on embedded PowerPC
-        if (unlikely((msr_be && ctx.exception == POWERPC_EXCP_BRANCH) ||
-                     /* Check in single step trace mode
-                      * we need to stop except if:
-                      * - rfi, trap or syscall
-                      * - first instruction of an exception handler
-                      */
-                     (msr_se && (ctx.nip < 0x100 ||
-                                 ctx.nip > 0xF00 ||
-                                 (ctx.nip & 0xFC) != 0x04) &&
-#if defined(CONFIG_USER_ONLY)
-                      ctx.exception != POWERPC_EXCP_SYSCALL_USER &&
-#else
-                      ctx.exception != POWERPC_EXCP_SYSCALL &&
-#endif
-                      ctx.exception != POWERPC_EXCP_TRAP))) {
+        if (unlikely(branch_step != 0 &&
+                     ctx.exception == POWERPC_EXCP_BRANCH)) {
             GEN_EXCP(ctxp, POWERPC_EXCP_TRACE, 0);
-        }
-#endif
-        /* if we reach a page boundary or are single stepping, stop
-         * generation
-         */
-        if (unlikely(((ctx.nip & (TARGET_PAGE_SIZE - 1)) == 0) ||
-                     (env->singlestep_enabled))) {
+        } else if (unlikely(single_step != 0 &&
+                            (ctx.nip <= 0x100 || ctx.nip > 0xF00 ||
+                             (ctx.nip & 0xFC) != 0x04) &&
+                            ctx.exception != POWERPC_SYSCALL &&
+                            ctx.exception != POWERPC_EXCP_TRAP)) {
+            GEN_EXCP(ctxp, POWERPC_EXCP_TRACE, 0);
+        } else if (unlikely(((ctx.nip & (TARGET_PAGE_SIZE - 1)) == 0) ||
+                            (env->singlestep_enabled))) {
+            /* if we reach a page boundary or are single stepping, stop
+             * generation
+             */
             break;
         }
 #if defined (DO_SINGLE_STEP)
@@ -6357,7 +6353,7 @@ static inline int gen_intermediate_code_internal (CPUState *env,
     if (loglevel & CPU_LOG_TB_IN_ASM) {
         int flags;
         flags = env->bfd_mach;
-        flags |= msr_le << 16;
+        flags |= little_endian << 16;
         fprintf(logfile, "IN: %s\n", lookup_symbol(pc_start));
         target_disas(logfile, pc_start, ctx.nip - pc_start, flags);
         fprintf(logfile, "\n");
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 88d67d9cf..ad12364ac 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -24,23 +24,28 @@
  */
 
 #include "dis-asm.h"
+#include "host-utils.h"
 
 //#define PPC_DUMP_CPU
 //#define PPC_DEBUG_SPR
-//#define PPC_DEBUG_IRQ
+//#define PPC_DUMP_SPR_ACCESSES
+#if defined(CONFIG_USER_ONLY)
+#define TODO_USER_ONLY 1
+#endif
 
 struct ppc_def_t {
     const unsigned char *name;
     uint32_t pvr;
-    uint32_t pvr_mask;
+    uint32_t svr;
     uint64_t insns_flags;
     uint64_t msr_mask;
-    uint8_t mmu_model;
-    uint8_t excp_model;
-    uint8_t bus_model;
-    uint8_t pad;
+    powerpc_mmu_t   mmu_model;
+    powerpc_excp_t  excp_model;
+    powerpc_input_t bus_model;
+    uint32_t flags;
     int bfd_mach;
     void (*init_proc)(CPUPPCState *env);
+    int  (*check_pow)(CPUPPCState *env);
 };
 
 /* For user-mode emulation, we don't emulate any IRQ controller */
@@ -239,7 +244,7 @@ static void spr_read_dbat (void *opaque, int sprn)
 
 static void spr_read_dbat_h (void *opaque, int sprn)
 {
-    gen_op_load_dbat(sprn & 1, (sprn - SPR_DBAT4U) / 2);
+    gen_op_load_dbat(sprn & 1, ((sprn - SPR_DBAT4U) / 2) + 4);
 }
 
 static void spr_write_dbatu (void *opaque, int sprn)
@@ -249,7 +254,7 @@ static void spr_write_dbatu (void *opaque, int sprn)
 
 static void spr_write_dbatu_h (void *opaque, int sprn)
 {
-    gen_op_store_dbatu((sprn - SPR_DBAT4U) / 2);
+    gen_op_store_dbatu(((sprn - SPR_DBAT4U) / 2) + 4);
 }
 
 static void spr_write_dbatl (void *opaque, int sprn)
@@ -259,7 +264,7 @@ static void spr_write_dbatl (void *opaque, int sprn)
 
 static void spr_write_dbatl_h (void *opaque, int sprn)
 {
-    gen_op_store_dbatl((sprn - SPR_DBAT4L) / 2);
+    gen_op_store_dbatl(((sprn - SPR_DBAT4L) / 2) + 4);
 }
 
 /* SDR1 */
@@ -276,13 +281,11 @@ static void spr_write_sdr1 (void *opaque, int sprn)
 /* 64 bits PowerPC specific SPRs */
 /* ASR */
 #if defined(TARGET_PPC64)
-__attribute__ (( unused ))
 static void spr_read_asr (void *opaque, int sprn)
 {
     gen_op_load_asr();
 }
 
-__attribute__ (( unused ))
 static void spr_write_asr (void *opaque, int sprn)
 {
     gen_op_store_asr();
@@ -312,6 +315,15 @@ static void spr_write_601_rtcl (void *opaque, int sprn)
 {
     gen_op_store_601_rtcl();
 }
+
+static void spr_write_hid0_601 (void *opaque, int sprn)
+{
+    DisasContext *ctx = opaque;
+
+    gen_op_store_hid0_601();
+    /* Must stop the translation as endianness may have changed */
+    GEN_STOP(ctx);
+}
 #endif
 
 /* Unified bats */
@@ -532,6 +544,7 @@ static void gen_spr_ne_601 (CPUPPCState *env)
 /* BATs 0-3 */
 static void gen_low_BATs (CPUPPCState *env)
 {
+#if !defined(CONFIG_USER_ONLY)
     spr_register(env, SPR_IBAT0U, "IBAT0U",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_ibat, &spr_write_ibatu,
@@ -597,11 +610,13 @@ static void gen_low_BATs (CPUPPCState *env)
                  &spr_read_dbat, &spr_write_dbatl,
                  0x00000000);
     env->nb_BATs += 4;
+#endif
 }
 
 /* BATs 4-7 */
 static void gen_high_BATs (CPUPPCState *env)
 {
+#if !defined(CONFIG_USER_ONLY)
     spr_register(env, SPR_IBAT4U, "IBAT4U",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_ibat_h, &spr_write_ibatu_h,
@@ -667,6 +682,7 @@ static void gen_high_BATs (CPUPPCState *env)
                  &spr_read_dbat_h, &spr_write_dbatl_h,
                  0x00000000);
     env->nb_BATs += 4;
+#endif
 }
 
 /* Generic PowerPC time base */
@@ -693,6 +709,7 @@ static void gen_tbl (CPUPPCState *env)
 /* Softare table search registers */
 static void gen_6xx_7xx_soft_tlb (CPUPPCState *env, int nb_tlbs, int nb_ways)
 {
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = nb_tlbs;
     env->nb_ways = nb_ways;
     env->id_tlbs = 1;
@@ -724,6 +741,7 @@ static void gen_6xx_7xx_soft_tlb (CPUPPCState *env, int nb_tlbs, int nb_ways)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
+#endif
 }
 
 /* SPR common to MPC755 and G2 */
@@ -746,12 +764,6 @@ static void gen_spr_G2_755 (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    /* External access control */
-    /* XXX : not implemented */
-    spr_register(env, SPR_EAR, "EAR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
 }
 
 /* SPR common to all 7xx PowerPC implementations */
@@ -774,11 +786,6 @@ static void gen_spr_7xx (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_L2CR, "L2CR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
     /* Performance monitors */
     /* XXX : not implemented */
     spr_register(env, SPR_MMCR0, "MMCR0",
@@ -904,11 +911,6 @@ static void gen_spr_604 (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_MMCR1, "MMCR1",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
     spr_register(env, SPR_PMC1, "PMC1",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
@@ -919,16 +921,6 @@ static void gen_spr_604 (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_PMC3, "PMC3",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_PMC4, "PMC4",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
     spr_register(env, SPR_SIAR, "SIAR",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, SPR_NOACCESS,
@@ -967,13 +959,6 @@ static void gen_spr_G2 (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    /* System version register */
-    /* SVR */
-    /* XXX : TODO: initialize it to an appropriate value */
-    spr_register(env, SPR_SVR, "SVR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, SPR_NOACCESS,
-                 0x00000000);
     /* Exception processing */
     spr_register(env, SPR_BOOKE_CSRR0, "CSRR0",
                  SPR_NOACCESS, SPR_NOACCESS,
@@ -1104,6 +1089,7 @@ static void gen_spr_601 (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     spr_register(env, SPR_IBAT0U, "IBAT0U",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_601_ubat, &spr_write_601_ubatu,
@@ -1137,6 +1123,7 @@ static void gen_spr_601 (CPUPPCState *env)
                  &spr_read_601_ubat, &spr_write_601_ubatl,
                  0x00000000);
     env->nb_BATs = 4;
+#endif
 }
 
 static void gen_spr_74xx (CPUPPCState *env)
@@ -1162,11 +1149,6 @@ static void gen_spr_74xx (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_UBAMR, "UBAMR",
-                 &spr_read_ureg, SPR_NOACCESS,
-                 &spr_read_ureg, SPR_NOACCESS,
-                 0x00000000);
-    /* XXX : not implemented */
     spr_register(env, SPR_MSSCR0, "MSSCR0",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
@@ -1187,6 +1169,11 @@ static void gen_spr_74xx (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_L2CR, "L2CR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
 }
 
 static void gen_l3_ctrl (CPUPPCState *env)
@@ -1203,30 +1190,6 @@ static void gen_l3_ctrl (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    /* L3ITCR1 */
-    /* XXX : not implemented */
-    spr_register(env, SPR_L3ITCR1, "L3ITCR1",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* L3ITCR2 */
-    /* XXX : not implemented */
-    spr_register(env, SPR_L3ITCR2, "L3ITCR2",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* L3ITCR3 */
-    /* XXX : not implemented */
-    spr_register(env, SPR_L3ITCR3, "L3ITCR3",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* L3OHCR */
-    /* XXX : not implemented */
-    spr_register(env, SPR_L3OHCR, "L3OHCR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
     /* L3PM */
     /* XXX : not implemented */
     spr_register(env, SPR_L3PM, "L3PM",
@@ -1237,6 +1200,7 @@ static void gen_l3_ctrl (CPUPPCState *env)
 
 static void gen_74xx_soft_tlb (CPUPPCState *env, int nb_tlbs, int nb_ways)
 {
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = nb_tlbs;
     env->nb_ways = nb_ways;
     env->id_tlbs = 1;
@@ -1255,16 +1219,71 @@ static void gen_74xx_soft_tlb (CPUPPCState *env, int nb_tlbs, int nb_ways)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
+#endif
 }
 
-/* PowerPC BookE SPR */
-static void gen_spr_BookE (CPUPPCState *env)
+static void gen_spr_usprgh (CPUPPCState *env)
 {
-    /* Processor identification */
-    spr_register(env, SPR_BOOKE_PIR, "PIR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_pir,
+    spr_register(env, SPR_USPRG4, "USPRG4",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_USPRG5, "USPRG5",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_USPRG6, "USPRG6",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_USPRG7, "USPRG7",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
                  0x00000000);
+}
+
+/* PowerPC BookE SPR */
+static void gen_spr_BookE (CPUPPCState *env, uint64_t ivor_mask)
+{
+    const unsigned char *ivor_names[64] = {
+        "IVOR0",  "IVOR1",  "IVOR2",  "IVOR3",
+        "IVOR4",  "IVOR5",  "IVOR6",  "IVOR7",
+        "IVOR8",  "IVOR9",  "IVOR10", "IVOR11",
+        "IVOR12", "IVOR13", "IVOR14", "IVOR15",
+        "IVOR16", "IVOR17", "IVOR18", "IVOR19",
+        "IVOR20", "IVOR21", "IVOR22", "IVOR23",
+        "IVOR24", "IVOR25", "IVOR26", "IVOR27",
+        "IVOR28", "IVOR29", "IVOR30", "IVOR31",
+        "IVOR32", "IVOR33", "IVOR34", "IVOR35",
+        "IVOR36", "IVOR37", "IVOR38", "IVOR39",
+        "IVOR40", "IVOR41", "IVOR42", "IVOR43",
+        "IVOR44", "IVOR45", "IVOR46", "IVOR47",
+        "IVOR48", "IVOR49", "IVOR50", "IVOR51",
+        "IVOR52", "IVOR53", "IVOR54", "IVOR55",
+        "IVOR56", "IVOR57", "IVOR58", "IVOR59",
+        "IVOR60", "IVOR61", "IVOR62", "IVOR63",
+    };
+#define SPR_BOOKE_IVORxx (-1)
+    int ivor_sprn[64] = {
+        SPR_BOOKE_IVOR0,  SPR_BOOKE_IVOR1,  SPR_BOOKE_IVOR2,  SPR_BOOKE_IVOR3,
+        SPR_BOOKE_IVOR4,  SPR_BOOKE_IVOR5,  SPR_BOOKE_IVOR6,  SPR_BOOKE_IVOR7,
+        SPR_BOOKE_IVOR8,  SPR_BOOKE_IVOR9,  SPR_BOOKE_IVOR10, SPR_BOOKE_IVOR11,
+        SPR_BOOKE_IVOR12, SPR_BOOKE_IVOR13, SPR_BOOKE_IVOR14, SPR_BOOKE_IVOR15,
+        SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+        SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+        SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+        SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+        SPR_BOOKE_IVOR32, SPR_BOOKE_IVOR33, SPR_BOOKE_IVOR34, SPR_BOOKE_IVOR35,
+        SPR_BOOKE_IVOR36, SPR_BOOKE_IVOR37, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+        SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+        SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+        SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+        SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+        SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+        SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx, SPR_BOOKE_IVORxx,
+    };
+    int i;
+
     /* Interrupt processing */
     spr_register(env, SPR_BOOKE_CSRR0, "CSRR0",
                  SPR_NOACCESS, SPR_NOACCESS,
@@ -1274,16 +1293,6 @@ static void gen_spr_BookE (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-#if 0
-    spr_register(env, SPR_BOOKE_DSRR0, "DSRR0",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_DSRR1, "DSRR1",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-#endif
     /* Debug */
     /* XXX : not implemented */
     spr_register(env, SPR_BOOKE_IAC1, "IAC1",
@@ -1296,16 +1305,6 @@ static void gen_spr_BookE (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_IAC3, "IAC3",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_IAC4, "IAC4",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
     spr_register(env, SPR_BOOKE_DAC1, "DAC1",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
@@ -1316,16 +1315,6 @@ static void gen_spr_BookE (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_DVC1, "DVC1",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_DVC2, "DVC2",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
     spr_register(env, SPR_BOOKE_DBCR0, "DBCR0",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
@@ -1358,96 +1347,18 @@ static void gen_spr_BookE (CPUPPCState *env)
                  &spr_read_generic, &spr_write_excp_prefix,
                  0x00000000);
     /* Exception vectors */
-    spr_register(env, SPR_BOOKE_IVOR0, "IVOR0",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR1, "IVOR1",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR2, "IVOR2",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR3, "IVOR3",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR4, "IVOR4",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR5, "IVOR5",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR6, "IVOR6",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR7, "IVOR7",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR8, "IVOR8",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR9, "IVOR9",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR10, "IVOR10",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR11, "IVOR11",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR12, "IVOR12",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR13, "IVOR13",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR14, "IVOR14",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR15, "IVOR15",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-#if 0
-    spr_register(env, SPR_BOOKE_IVOR32, "IVOR32",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR33, "IVOR33",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR34, "IVOR34",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR35, "IVOR35",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR36, "IVOR36",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-    spr_register(env, SPR_BOOKE_IVOR37, "IVOR37",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_excp_vector,
-                 0x00000000);
-#endif
+    for (i = 0; i < 64; i++) {
+        if (ivor_mask & (1ULL << i)) {
+            if (ivor_sprn[i] == SPR_BOOKE_IVORxx) {
+                fprintf(stderr, "ERROR: IVOR %d SPR is not defined\n", i);
+                exit(1);
+            }
+            spr_register(env, ivor_sprn[i], ivor_names[i],
+                         SPR_NOACCESS, SPR_NOACCESS,
+                         &spr_read_generic, &spr_write_excp_vector,
+                         0x00000000);
+        }
+    }
     spr_register(env, SPR_BOOKE_PID, "PID",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
@@ -1478,75 +1389,43 @@ static void gen_spr_BookE (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    spr_register(env, SPR_USPRG4, "USPRG4",
-                 &spr_read_ureg, SPR_NOACCESS,
-                 &spr_read_ureg, SPR_NOACCESS,
-                 0x00000000);
     spr_register(env, SPR_SPRG5, "SPRG5",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    spr_register(env, SPR_USPRG5, "USPRG5",
-                 &spr_read_ureg, SPR_NOACCESS,
-                 &spr_read_ureg, SPR_NOACCESS,
-                 0x00000000);
     spr_register(env, SPR_SPRG6, "SPRG6",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    spr_register(env, SPR_USPRG6, "USPRG6",
-                 &spr_read_ureg, SPR_NOACCESS,
-                 &spr_read_ureg, SPR_NOACCESS,
-                 0x00000000);
     spr_register(env, SPR_SPRG7, "SPRG7",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    spr_register(env, SPR_USPRG7, "USPRG7",
-                 &spr_read_ureg, SPR_NOACCESS,
-                 &spr_read_ureg, SPR_NOACCESS,
-                 0x00000000);
 }
 
 /* FSL storage control registers */
-static void gen_spr_BookE_FSL (CPUPPCState *env)
+static void gen_spr_BookE_FSL (CPUPPCState *env, uint32_t mas_mask)
 {
+#if !defined(CONFIG_USER_ONLY)
+    const unsigned char *mas_names[8] = {
+        "MAS0", "MAS1", "MAS2", "MAS3", "MAS4", "MAS5", "MAS6", "MAS7",
+    };
+    int mas_sprn[8] = {
+        SPR_BOOKE_MAS0, SPR_BOOKE_MAS1, SPR_BOOKE_MAS2, SPR_BOOKE_MAS3,
+        SPR_BOOKE_MAS4, SPR_BOOKE_MAS5, SPR_BOOKE_MAS6, SPR_BOOKE_MAS7,
+    };
+    int i;
+
     /* TLB assist registers */
     /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_MAS0, "MAS0",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_MAS1, "MAS2",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_MAS2, "MAS3",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_MAS3, "MAS4",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_MAS4, "MAS5",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_MAS6, "MAS6",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_MAS7, "MAS7",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
+    for (i = 0; i < 8; i++) {
+        if (mas_mask & (1 << i)) {
+            spr_register(env, mas_sprn[i], mas_names[i],
+                         SPR_NOACCESS, SPR_NOACCESS,
+                         &spr_read_generic, &spr_write_generic,
+                         0x00000000);
+        }
+    }
     if (env->nb_pids > 1) {
         /* XXX : not implemented */
         spr_register(env, SPR_BOOKE_PID1, "PID1",
@@ -1562,12 +1441,12 @@ static void gen_spr_BookE_FSL (CPUPPCState *env)
                      0x00000000);
     }
     /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_MMUCFG, "MMUCFG",
+    spr_register(env, SPR_MMUCFG, "MMUCFG",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, SPR_NOACCESS,
                  0x00000000); /* TOFIX */
     /* XXX : not implemented */
-    spr_register(env, SPR_BOOKE_MMUCSR0, "MMUCSR0",
+    spr_register(env, SPR_MMUCSR0, "MMUCSR0",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000); /* TOFIX */
@@ -1604,6 +1483,7 @@ static void gen_spr_BookE_FSL (CPUPPCState *env)
     default:
         break;
     }
+#endif
 }
 
 /* SPR specific to PowerPC 440 implementation */
@@ -1893,34 +1773,19 @@ static void gen_spr_405 (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    spr_register(env, SPR_USPRG4, "USPRG4",
-                 &spr_read_ureg, SPR_NOACCESS,
-                 &spr_read_ureg, SPR_NOACCESS,
-                 0x00000000);
     spr_register(env, SPR_SPRG5, "SPRG5",
                  SPR_NOACCESS, SPR_NOACCESS,
                  spr_read_generic, &spr_write_generic,
                  0x00000000);
-    spr_register(env, SPR_USPRG5, "USPRG5",
-                 &spr_read_ureg, SPR_NOACCESS,
-                 &spr_read_ureg, SPR_NOACCESS,
-                 0x00000000);
     spr_register(env, SPR_SPRG6, "SPRG6",
                  SPR_NOACCESS, SPR_NOACCESS,
                  spr_read_generic, &spr_write_generic,
                  0x00000000);
-    spr_register(env, SPR_USPRG6, "USPRG6",
-                 &spr_read_ureg, SPR_NOACCESS,
-                 &spr_read_ureg, SPR_NOACCESS,
-                 0x00000000);
     spr_register(env, SPR_SPRG7, "SPRG7",
                  SPR_NOACCESS, SPR_NOACCESS,
                  spr_read_generic, &spr_write_generic,
                  0x00000000);
-    spr_register(env, SPR_USPRG7, "USPRG7",
-                 &spr_read_ureg, SPR_NOACCESS,
-                 &spr_read_ureg, SPR_NOACCESS,
-                 0x00000000);
+    gen_spr_usprgh(env);
 }
 
 /* SPR shared between PowerPC 401 & 403 implementations */
@@ -2091,6 +1956,70 @@ static void gen_spr_compress (CPUPPCState *env)
 /* SPR specific to PowerPC 620 */
 static void gen_spr_620 (CPUPPCState *env)
 {
+    /* Processor identification */
+    spr_register(env, SPR_PIR, "PIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_pir,
+                 0x00000000);
+    spr_register(env, SPR_ASR, "ASR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_asr, &spr_write_asr,
+                 0x00000000);
+    /* Breakpoints */
+    /* XXX : not implemented */
+    spr_register(env, SPR_IABR, "IABR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_DABR, "DABR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_SIAR, "SIAR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_SDA, "SDA",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_620_PMC1R, "PMC1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_620_PMC1W, "PMC1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                  SPR_NOACCESS, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_620_PMC2R, "PMC2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_620_PMC2W, "PMC2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                  SPR_NOACCESS, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_620_MMCR0R, "MMCR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_620_MMCR0W, "MMCR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                  SPR_NOACCESS, &spr_write_generic,
+                 0x00000000);
+    /* External access control */
+    /* XXX : not implemented */
+    spr_register(env, SPR_EAR, "EAR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+#if 0 // XXX: check this
     /* XXX : not implemented */
     spr_register(env, SPR_620_PMR0, "PMR0",
                  SPR_NOACCESS, SPR_NOACCESS,
@@ -2171,19 +2100,381 @@ static void gen_spr_620 (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
+#endif
+    /* XXX : not implemented */
+    spr_register(env, SPR_620_BUSCSR, "BUSCSR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_620_HID8, "HID8",
+    spr_register(env, SPR_620_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_620_HID9, "HID9",
+    spr_register(env, SPR_620_L2SR, "L2SR",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
 }
 #endif /* defined (TARGET_PPC64) */
 
+static void gen_spr_5xx_8xx (CPUPPCState *env)
+{
+    /* Exception processing */
+    spr_register(env, SPR_DSISR, "DSISR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_DAR, "DAR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Timer */
+    spr_register(env, SPR_DECR, "DECR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_decr, &spr_write_decr,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_EIE, "EIE",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_EID, "EID",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_NRI, "NRI",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_CMPA, "CMPA",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_CMPB, "CMPB",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_CMPC, "CMPC",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_CMPD, "CMPD",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_ECR, "ECR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_DER, "DER",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_COUNTA, "COUNTA",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_COUNTB, "COUNTB",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_CMPE, "CMPE",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_CMPF, "CMPF",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_CMPG, "CMPG",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_CMPH, "CMPH",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_LCTRL1, "LCTRL1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_LCTRL2, "LCTRL2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_BAR, "BAR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_DPDR, "DPDR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_IMMR, "IMMR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+}
+
+static void gen_spr_5xx (CPUPPCState *env)
+{
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_MI_GRA, "MI_GRA",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_L2U_GRA, "L2U_GRA",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RPCU_BBCMCR, "L2U_BBCMCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_L2U_MCR, "L2U_MCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_MI_RBA0, "MI_RBA0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_MI_RBA1, "MI_RBA1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_MI_RBA2, "MI_RBA2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_MI_RBA3, "MI_RBA3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_L2U_RBA0, "L2U_RBA0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_L2U_RBA1, "L2U_RBA1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_L2U_RBA2, "L2U_RBA2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_L2U_RBA3, "L2U_RBA3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_MI_RA0, "MI_RA0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_MI_RA1, "MI_RA1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_MI_RA2, "MI_RA2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_MI_RA3, "MI_RA3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_L2U_RA0, "L2U_RA0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_L2U_RA1, "L2U_RA1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_L2U_RA2, "L2U_RA2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_L2U_RA3, "L2U_RA3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_RCPU_FPECR, "FPECR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+}
+
+static void gen_spr_8xx (CPUPPCState *env)
+{
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_IC_CST, "IC_CST",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_IC_ADR, "IC_ADR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_IC_DAT, "IC_DAT",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_DC_CST, "DC_CST",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_DC_ADR, "DC_ADR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_DC_DAT, "DC_DAT",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MI_CTR, "MI_CTR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MI_AP, "MI_AP",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MI_EPN, "MI_EPN",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MI_TWC, "MI_TWC",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MI_RPN, "MI_RPN",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MI_DBCAM, "MI_DBCAM",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MI_DBRAM0, "MI_DBRAM0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MI_DBRAM1, "MI_DBRAM1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_CTR, "MD_CTR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_CASID, "MD_CASID",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_AP, "MD_AP",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_EPN, "MD_EPN",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_TWB, "MD_TWB",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_TWC, "MD_TWC",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_RPN, "MD_RPN",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_TW, "MD_TW",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_DBCAM, "MD_DBCAM",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_DBRAM0, "MD_DBRAM0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MPC_MD_DBRAM1, "MD_DBRAM1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+}
+
 // XXX: TODO
 /*
  * AMR     => SPR 29 (Power 2.04)
@@ -2232,9 +2523,11 @@ static void init_excp_4xx_real (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_FIT]      = 0x00001010;
     env->excp_vectors[POWERPC_EXCP_WDT]      = 0x00001020;
     env->excp_vectors[POWERPC_EXCP_DEBUG]    = 0x00002000;
-    env->excp_prefix = 0x00000000;
-    env->ivor_mask = 0x0000FFF0;
-    env->ivpr_mask = 0xFFFF0000;
+    env->excp_prefix = 0x00000000UL;
+    env->ivor_mask = 0x0000FFF0UL;
+    env->ivpr_mask = 0xFFFF0000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
 
@@ -2255,9 +2548,126 @@ static void init_excp_4xx_softmmu (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_DTLB]     = 0x00001100;
     env->excp_vectors[POWERPC_EXCP_ITLB]     = 0x00001200;
     env->excp_vectors[POWERPC_EXCP_DEBUG]    = 0x00002000;
-    env->excp_prefix = 0x00000000;
-    env->ivor_mask = 0x0000FFF0;
-    env->ivpr_mask = 0xFFFF0000;
+    env->excp_prefix = 0x00000000UL;
+    env->ivor_mask = 0x0000FFF0UL;
+    env->ivpr_mask = 0xFFFF0000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
+#endif
+}
+
+static void init_excp_MPC5xx (CPUPPCState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000100;
+    env->excp_vectors[POWERPC_EXCP_MCHECK]   = 0x00000200;
+    env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000500;
+    env->excp_vectors[POWERPC_EXCP_ALIGN]    = 0x00000600;
+    env->excp_vectors[POWERPC_EXCP_PROGRAM]  = 0x00000700;
+    env->excp_vectors[POWERPC_EXCP_FPU]      = 0x00000900;
+    env->excp_vectors[POWERPC_EXCP_DECR]     = 0x00000900;
+    env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000C00;
+    env->excp_vectors[POWERPC_EXCP_TRACE]    = 0x00000D00;
+    env->excp_vectors[POWERPC_EXCP_FPA]      = 0x00000E00;
+    env->excp_vectors[POWERPC_EXCP_EMUL]     = 0x00001000;
+    env->excp_vectors[POWERPC_EXCP_DABR]     = 0x00001C00;
+    env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001C00;
+    env->excp_vectors[POWERPC_EXCP_MEXTBR]   = 0x00001E00;
+    env->excp_vectors[POWERPC_EXCP_NMEXTBR]  = 0x00001F00;
+    env->excp_prefix = 0x00000000UL;
+    env->ivor_mask = 0x0000FFF0UL;
+    env->ivpr_mask = 0xFFFF0000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
+#endif
+}
+
+static void init_excp_MPC8xx (CPUPPCState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000100;
+    env->excp_vectors[POWERPC_EXCP_MCHECK]   = 0x00000200;
+    env->excp_vectors[POWERPC_EXCP_DSI]      = 0x00000300;
+    env->excp_vectors[POWERPC_EXCP_ISI]      = 0x00000400;
+    env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000500;
+    env->excp_vectors[POWERPC_EXCP_ALIGN]    = 0x00000600;
+    env->excp_vectors[POWERPC_EXCP_PROGRAM]  = 0x00000700;
+    env->excp_vectors[POWERPC_EXCP_FPU]      = 0x00000900;
+    env->excp_vectors[POWERPC_EXCP_DECR]     = 0x00000900;
+    env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000C00;
+    env->excp_vectors[POWERPC_EXCP_TRACE]    = 0x00000D00;
+    env->excp_vectors[POWERPC_EXCP_FPA]      = 0x00000E00;
+    env->excp_vectors[POWERPC_EXCP_EMUL]     = 0x00001000;
+    env->excp_vectors[POWERPC_EXCP_ITLB]     = 0x00001100;
+    env->excp_vectors[POWERPC_EXCP_DTLB]     = 0x00001200;
+    env->excp_vectors[POWERPC_EXCP_ITLBE]    = 0x00001300;
+    env->excp_vectors[POWERPC_EXCP_DTLBE]    = 0x00001400;
+    env->excp_vectors[POWERPC_EXCP_DABR]     = 0x00001C00;
+    env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001C00;
+    env->excp_vectors[POWERPC_EXCP_MEXTBR]   = 0x00001E00;
+    env->excp_vectors[POWERPC_EXCP_NMEXTBR]  = 0x00001F00;
+    env->excp_prefix = 0x00000000UL;
+    env->ivor_mask = 0x0000FFF0UL;
+    env->ivpr_mask = 0xFFFF0000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
+#endif
+}
+
+static void init_excp_G2 (CPUPPCState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000100;
+    env->excp_vectors[POWERPC_EXCP_MCHECK]   = 0x00000200;
+    env->excp_vectors[POWERPC_EXCP_DSI]      = 0x00000300;
+    env->excp_vectors[POWERPC_EXCP_ISI]      = 0x00000400;
+    env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000500;
+    env->excp_vectors[POWERPC_EXCP_ALIGN]    = 0x00000600;
+    env->excp_vectors[POWERPC_EXCP_PROGRAM]  = 0x00000700;
+    env->excp_vectors[POWERPC_EXCP_FPU]      = 0x00000800;
+    env->excp_vectors[POWERPC_EXCP_DECR]     = 0x00000900;
+    env->excp_vectors[POWERPC_EXCP_CRITICAL] = 0x00000A00;
+    env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000C00;
+    env->excp_vectors[POWERPC_EXCP_TRACE]    = 0x00000D00;
+    env->excp_vectors[POWERPC_EXCP_IFTLB]    = 0x00001000;
+    env->excp_vectors[POWERPC_EXCP_DLTLB]    = 0x00001100;
+    env->excp_vectors[POWERPC_EXCP_DSTLB]    = 0x00001200;
+    env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001300;
+    env->excp_vectors[POWERPC_EXCP_SMI]      = 0x00001400;
+    env->excp_prefix = 0x00000000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
+#endif
+}
+
+static void init_excp_e200 (CPUPPCState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000FFC;
+    env->excp_vectors[POWERPC_EXCP_CRITICAL] = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_MCHECK]   = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_DSI]      = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_ISI]      = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_ALIGN]    = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_PROGRAM]  = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_FPU]      = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_APU]      = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_DECR]     = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_FIT]      = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_WDT]      = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_DTLB]     = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_ITLB]     = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_DEBUG]    = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_SPEU]     = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_EFPDI]    = 0x00000000;
+    env->excp_vectors[POWERPC_EXCP_EFPRI]    = 0x00000000;
+    env->excp_prefix = 0x00000000UL;
+    env->ivor_mask = 0x0000FFF7UL;
+    env->ivpr_mask = 0xFFFF0000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
 
@@ -2280,9 +2690,11 @@ static void init_excp_BookE (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_DTLB]     = 0x00000000;
     env->excp_vectors[POWERPC_EXCP_ITLB]     = 0x00000000;
     env->excp_vectors[POWERPC_EXCP_DEBUG]    = 0x00000000;
-    env->excp_prefix = 0x00000000;
-    env->ivor_mask = 0x0000FFE0;
-    env->ivpr_mask = 0xFFFF0000;
+    env->excp_prefix = 0x00000000UL;
+    env->ivor_mask = 0x0000FFE0UL;
+    env->ivpr_mask = 0xFFFF0000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
 
@@ -2301,13 +2713,16 @@ static void init_excp_601 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_IO]       = 0x00000A00;
     env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000C00;
     env->excp_vectors[POWERPC_EXCP_RUNM]     = 0x00002000;
-    env->excp_prefix = 0xFFF00000;
+    env->excp_prefix = 0xFFF00000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0x00000100UL;
 #endif
 }
 
 static void init_excp_602 (CPUPPCState *env)
 {
 #if !defined(CONFIG_USER_ONLY)
+    /* XXX: exception prefix has a special behavior on 602 */
     env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000100;
     env->excp_vectors[POWERPC_EXCP_MCHECK]   = 0x00000200;
     env->excp_vectors[POWERPC_EXCP_DSI]      = 0x00000300;
@@ -2319,7 +2734,6 @@ static void init_excp_602 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_DECR]     = 0x00000900;
     env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000C00;
     env->excp_vectors[POWERPC_EXCP_TRACE]    = 0x00000D00;
-    env->excp_vectors[POWERPC_EXCP_FPA]      = 0x00000E00;
     env->excp_vectors[POWERPC_EXCP_IFTLB]    = 0x00001000;
     env->excp_vectors[POWERPC_EXCP_DLTLB]    = 0x00001100;
     env->excp_vectors[POWERPC_EXCP_DSTLB]    = 0x00001200;
@@ -2327,7 +2741,9 @@ static void init_excp_602 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_SMI]      = 0x00001400;
     env->excp_vectors[POWERPC_EXCP_WDT]      = 0x00001500;
     env->excp_vectors[POWERPC_EXCP_EMUL]     = 0x00001600;
-    env->excp_prefix = 0xFFF00000;
+    env->excp_prefix = 0xFFF00000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
 
@@ -2350,10 +2766,13 @@ static void init_excp_603 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_DSTLB]    = 0x00001200;
     env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001300;
     env->excp_vectors[POWERPC_EXCP_SMI]      = 0x00001400;
+    env->excp_prefix = 0x00000000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
 
-static void init_excp_G2 (CPUPPCState *env)
+static void init_excp_604 (CPUPPCState *env)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000100;
@@ -2365,18 +2784,19 @@ static void init_excp_G2 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_PROGRAM]  = 0x00000700;
     env->excp_vectors[POWERPC_EXCP_FPU]      = 0x00000800;
     env->excp_vectors[POWERPC_EXCP_DECR]     = 0x00000900;
-    env->excp_vectors[POWERPC_EXCP_CRITICAL] = 0x00000A00;
     env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000C00;
     env->excp_vectors[POWERPC_EXCP_TRACE]    = 0x00000D00;
-    env->excp_vectors[POWERPC_EXCP_IFTLB]    = 0x00001000;
-    env->excp_vectors[POWERPC_EXCP_DLTLB]    = 0x00001100;
-    env->excp_vectors[POWERPC_EXCP_DSTLB]    = 0x00001200;
+    env->excp_vectors[POWERPC_EXCP_PERFM]    = 0x00000F00;
     env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001300;
     env->excp_vectors[POWERPC_EXCP_SMI]      = 0x00001400;
+    env->excp_prefix = 0x00000000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
 
-static void init_excp_604 (CPUPPCState *env)
+#if defined(TARGET_PPC64)
+static void init_excp_620 (CPUPPCState *env)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000100;
@@ -2393,11 +2813,14 @@ static void init_excp_604 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_PERFM]    = 0x00000F00;
     env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001300;
     env->excp_vectors[POWERPC_EXCP_SMI]      = 0x00001400;
+    env->excp_prefix = 0xFFF00000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0x0000000000000100ULL;
 #endif
 }
+#endif /* defined(TARGET_PPC64) */
 
-#if defined(TARGET_PPC64)
-static void init_excp_620 (CPUPPCState *env)
+static void init_excp_7x0 (CPUPPCState *env)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000100;
@@ -2411,15 +2834,40 @@ static void init_excp_620 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_DECR]     = 0x00000900;
     env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000C00;
     env->excp_vectors[POWERPC_EXCP_TRACE]    = 0x00000D00;
-    env->excp_vectors[POWERPC_EXCP_FPA]      = 0x00000E00;
     env->excp_vectors[POWERPC_EXCP_PERFM]    = 0x00000F00;
     env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001300;
     env->excp_vectors[POWERPC_EXCP_SMI]      = 0x00001400;
+    env->excp_vectors[POWERPC_EXCP_THERM]    = 0x00001700;
+    env->excp_prefix = 0x00000000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
-#endif /* defined(TARGET_PPC64) */
 
-static void init_excp_7x0 (CPUPPCState *env)
+static void init_excp_750cl (CPUPPCState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000100;
+    env->excp_vectors[POWERPC_EXCP_MCHECK]   = 0x00000200;
+    env->excp_vectors[POWERPC_EXCP_DSI]      = 0x00000300;
+    env->excp_vectors[POWERPC_EXCP_ISI]      = 0x00000400;
+    env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000500;
+    env->excp_vectors[POWERPC_EXCP_ALIGN]    = 0x00000600;
+    env->excp_vectors[POWERPC_EXCP_PROGRAM]  = 0x00000700;
+    env->excp_vectors[POWERPC_EXCP_FPU]      = 0x00000800;
+    env->excp_vectors[POWERPC_EXCP_DECR]     = 0x00000900;
+    env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000C00;
+    env->excp_vectors[POWERPC_EXCP_TRACE]    = 0x00000D00;
+    env->excp_vectors[POWERPC_EXCP_PERFM]    = 0x00000F00;
+    env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001300;
+    env->excp_vectors[POWERPC_EXCP_SMI]      = 0x00001400;
+    env->excp_prefix = 0x00000000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
+#endif
+}
+
+static void init_excp_750cx (CPUPPCState *env)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000100;
@@ -2436,10 +2884,14 @@ static void init_excp_7x0 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_PERFM]    = 0x00000F00;
     env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001300;
     env->excp_vectors[POWERPC_EXCP_THERM]    = 0x00001700;
+    env->excp_prefix = 0x00000000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
 
-static void init_excp_750FX (CPUPPCState *env)
+/* XXX: Check if this is correct */
+static void init_excp_7x5 (CPUPPCState *env)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000100;
@@ -2454,9 +2906,15 @@ static void init_excp_750FX (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000C00;
     env->excp_vectors[POWERPC_EXCP_TRACE]    = 0x00000D00;
     env->excp_vectors[POWERPC_EXCP_PERFM]    = 0x00000F00;
+    env->excp_vectors[POWERPC_EXCP_IFTLB]    = 0x00001000;
+    env->excp_vectors[POWERPC_EXCP_DLTLB]    = 0x00001100;
+    env->excp_vectors[POWERPC_EXCP_DSTLB]    = 0x00001200;
     env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001300;
     env->excp_vectors[POWERPC_EXCP_SMI]      = 0x00001400;
     env->excp_vectors[POWERPC_EXCP_THERM]    = 0x00001700;
+    env->excp_prefix = 0x00000000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
 
@@ -2480,6 +2938,9 @@ static void init_excp_7400 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_SMI]      = 0x00001400;
     env->excp_vectors[POWERPC_EXCP_VPUA]     = 0x00001600;
     env->excp_vectors[POWERPC_EXCP_THERM]    = 0x00001700;
+    env->excp_prefix = 0x00000000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
 
@@ -2505,6 +2966,9 @@ static void init_excp_7450 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_IABR]     = 0x00001300;
     env->excp_vectors[POWERPC_EXCP_SMI]      = 0x00001400;
     env->excp_vectors[POWERPC_EXCP_VPUA]     = 0x00001600;
+    env->excp_prefix = 0x00000000UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0xFFFFFFFCUL;
 #endif
 }
 
@@ -2523,9 +2987,7 @@ static void init_excp_970 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_PROGRAM]  = 0x00000700;
     env->excp_vectors[POWERPC_EXCP_FPU]      = 0x00000800;
     env->excp_vectors[POWERPC_EXCP_DECR]     = 0x00000900;
-#if defined(TARGET_PPC64H) /* PowerPC 64 with hypervisor mode support */
     env->excp_vectors[POWERPC_EXCP_HDECR]    = 0x00000980;
-#endif
     env->excp_vectors[POWERPC_EXCP_SYSCALL]  = 0x00000C00;
     env->excp_vectors[POWERPC_EXCP_TRACE]    = 0x00000D00;
     env->excp_vectors[POWERPC_EXCP_PERFM]    = 0x00000F00;
@@ -2534,25 +2996,59 @@ static void init_excp_970 (CPUPPCState *env)
     env->excp_vectors[POWERPC_EXCP_MAINT]    = 0x00001600;
     env->excp_vectors[POWERPC_EXCP_VPUA]     = 0x00001700;
     env->excp_vectors[POWERPC_EXCP_THERM]    = 0x00001800;
+    env->excp_prefix   = 0x00000000FFF00000ULL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0x0000000000000100ULL;
 #endif
 }
 #endif
 
 /*****************************************************************************/
-/* PowerPC implementations definitions                                       */
+/* Power management enable checks                                            */
+static int check_pow_none (CPUPPCState *env)
+{
+    return 0;
+}
+
+static int check_pow_nocheck (CPUPPCState *env)
+{
+    return 1;
+}
+
+static int check_pow_hid0 (CPUPPCState *env)
+{
+    if (env->spr[SPR_HID0] & 0x00E00000)
+        return 1;
 
-/* PowerPC 40x instruction set                                               */
-#define POWERPC_INSNS_EMB    (PPC_INSNS_BASE | PPC_EMB_COMMON)
+    return 0;
+}
+
+static int check_pow_hid0_74xx (CPUPPCState *env)
+{
+    if (env->spr[SPR_HID0] & 0x00600000)
+        return 1;
+
+    return 0;
+}
+
+/*****************************************************************************/
+/* PowerPC implementations definitions                                       */
 
 /* PowerPC 401                                                               */
-#define POWERPC_INSNS_401    (POWERPC_INSNS_EMB |                             \
+#define POWERPC_INSNS_401    (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_WRTEE | PPC_DCR |                           \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_40x_ICBT |     \
+                              PPC_CACHE_DCBZ |                                \
                               PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
-                              PPC_4xx_COMMON | PPC_40x_EXCP | PPC_40x_ICBT)
+                              PPC_4xx_COMMON | PPC_40x_EXCP)
 #define POWERPC_MSRM_401     (0x00000000000FD201ULL)
-#define POWERPC_MMU_401      (POWERPC_MMU_REAL_4xx)
+#define POWERPC_MMU_401      (POWERPC_MMU_REAL)
 #define POWERPC_EXCP_401     (POWERPC_EXCP_40x)
 #define POWERPC_INPUT_401    (PPC_FLAGS_INPUT_401)
 #define POWERPC_BFDM_401     (bfd_mach_ppc_403)
+#define POWERPC_FLAG_401     (POWERPC_FLAG_CE | POWERPC_FLAG_DE |             \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_401        check_pow_nocheck
 
 static void init_proc_401 (CPUPPCState *env)
 {
@@ -2560,21 +3056,28 @@ static void init_proc_401 (CPUPPCState *env)
     gen_spr_401_403(env);
     gen_spr_401(env);
     init_excp_4xx_real(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc40x_irq_init(env);
 }
 
 /* PowerPC 401x2                                                             */
-#define POWERPC_INSNS_401x2  (POWERPC_INSNS_EMB |                             \
+#define POWERPC_INSNS_401x2  (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_DCR | PPC_WRTEE |                           \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_40x_ICBT |     \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
                               PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
                               PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC | \
-                              PPC_CACHE_DCBA | PPC_MFTB |                     \
-                              PPC_4xx_COMMON | PPC_40x_EXCP | PPC_40x_ICBT)
+                              PPC_4xx_COMMON | PPC_40x_EXCP)
 #define POWERPC_MSRM_401x2   (0x00000000001FD231ULL)
 #define POWERPC_MMU_401x2    (POWERPC_MMU_SOFT_4xx_Z)
 #define POWERPC_EXCP_401x2   (POWERPC_EXCP_40x)
 #define POWERPC_INPUT_401x2  (PPC_FLAGS_INPUT_401)
 #define POWERPC_BFDM_401x2   (bfd_mach_ppc_403)
+#define POWERPC_FLAG_401x2   (POWERPC_FLAG_CE | POWERPC_FLAG_DE |             \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_401x2      check_pow_nocheck
 
 static void init_proc_401x2 (CPUPPCState *env)
 {
@@ -2583,25 +3086,34 @@ static void init_proc_401x2 (CPUPPCState *env)
     gen_spr_401x2(env);
     gen_spr_compress(env);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
+#endif
     init_excp_4xx_softmmu(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc40x_irq_init(env);
 }
 
 /* PowerPC 401x3                                                             */
-#define POWERPC_INSNS_401x3  (POWERPC_INSNS_EMB |                             \
+#define POWERPC_INSNS_401x3  (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_DCR | PPC_WRTEE |                           \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_40x_ICBT |     \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
                               PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
                               PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC | \
-                              PPC_CACHE_DCBA | PPC_MFTB |                     \
-                              PPC_4xx_COMMON | PPC_40x_EXCP | PPC_40x_ICBT)
+                              PPC_4xx_COMMON | PPC_40x_EXCP)
 #define POWERPC_MSRM_401x3   (0x00000000001FD631ULL)
 #define POWERPC_MMU_401x3    (POWERPC_MMU_SOFT_4xx_Z)
 #define POWERPC_EXCP_401x3   (POWERPC_EXCP_40x)
 #define POWERPC_INPUT_401x3  (PPC_FLAGS_INPUT_401)
 #define POWERPC_BFDM_401x3   (bfd_mach_ppc_403)
+#define POWERPC_FLAG_401x3   (POWERPC_FLAG_CE | POWERPC_FLAG_DE |             \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_401x3      check_pow_nocheck
 
 __attribute__ (( unused ))
 static void init_proc_401x3 (CPUPPCState *env)
@@ -2612,21 +3124,28 @@ static void init_proc_401x3 (CPUPPCState *env)
     gen_spr_401x2(env);
     gen_spr_compress(env);
     init_excp_4xx_softmmu(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc40x_irq_init(env);
 }
 
 /* IOP480                                                                    */
-#define POWERPC_INSNS_IOP480 (POWERPC_INSNS_EMB |                             \
+#define POWERPC_INSNS_IOP480 (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_DCR | PPC_WRTEE |                           \
+                              PPC_CACHE | PPC_CACHE_ICBI |  PPC_40x_ICBT |    \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
                               PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
                               PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC | \
-                              PPC_CACHE_DCBA |                                \
-                              PPC_4xx_COMMON | PPC_40x_EXCP |  PPC_40x_ICBT)
+                              PPC_4xx_COMMON | PPC_40x_EXCP)
 #define POWERPC_MSRM_IOP480  (0x00000000001FD231ULL)
 #define POWERPC_MMU_IOP480   (POWERPC_MMU_SOFT_4xx_Z)
 #define POWERPC_EXCP_IOP480  (POWERPC_EXCP_40x)
 #define POWERPC_INPUT_IOP480 (PPC_FLAGS_INPUT_401)
 #define POWERPC_BFDM_IOP480  (bfd_mach_ppc_403)
+#define POWERPC_FLAG_IOP480  (POWERPC_FLAG_CE | POWERPC_FLAG_DE |             \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_IOP480     check_pow_nocheck
 
 static void init_proc_IOP480 (CPUPPCState *env)
 {
@@ -2635,24 +3154,33 @@ static void init_proc_IOP480 (CPUPPCState *env)
     gen_spr_401x2(env);
     gen_spr_compress(env);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
+#endif
     init_excp_4xx_softmmu(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc40x_irq_init(env);
 }
 
 /* PowerPC 403                                                               */
-#define POWERPC_INSNS_403    (POWERPC_INSNS_EMB |                             \
+#define POWERPC_INSNS_403    (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_DCR | PPC_WRTEE |                           \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_40x_ICBT |     \
+                              PPC_CACHE_DCBZ |                                \
                               PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
-                              PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC | \
-                              PPC_4xx_COMMON | PPC_40x_EXCP | PPC_40x_ICBT)
+                              PPC_4xx_COMMON | PPC_40x_EXCP)
 #define POWERPC_MSRM_403     (0x000000000007D00DULL)
-#define POWERPC_MMU_403      (POWERPC_MMU_REAL_4xx)
+#define POWERPC_MMU_403      (POWERPC_MMU_REAL)
 #define POWERPC_EXCP_403     (POWERPC_EXCP_40x)
 #define POWERPC_INPUT_403    (PPC_FLAGS_INPUT_401)
 #define POWERPC_BFDM_403     (bfd_mach_ppc_403)
+#define POWERPC_FLAG_403     (POWERPC_FLAG_CE | POWERPC_FLAG_PX |             \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_403        check_pow_nocheck
 
 static void init_proc_403 (CPUPPCState *env)
 {
@@ -2661,20 +3189,28 @@ static void init_proc_403 (CPUPPCState *env)
     gen_spr_403(env);
     gen_spr_403_real(env);
     init_excp_4xx_real(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc40x_irq_init(env);
 }
 
 /* PowerPC 403 GCX                                                           */
-#define POWERPC_INSNS_403GCX (POWERPC_INSNS_EMB |                             \
+#define POWERPC_INSNS_403GCX (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_DCR | PPC_WRTEE |                           \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_40x_ICBT |     \
+                              PPC_CACHE_DCBZ |                                \
                               PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
                               PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC | \
-                              PPC_4xx_COMMON | PPC_40x_EXCP | PPC_40x_ICBT)
+                              PPC_4xx_COMMON | PPC_40x_EXCP)
 #define POWERPC_MSRM_403GCX  (0x000000000007D00DULL)
 #define POWERPC_MMU_403GCX   (POWERPC_MMU_SOFT_4xx_Z)
 #define POWERPC_EXCP_403GCX  (POWERPC_EXCP_40x)
 #define POWERPC_INPUT_403GCX (PPC_FLAGS_INPUT_401)
 #define POWERPC_BFDM_403GCX  (bfd_mach_ppc_403)
+#define POWERPC_FLAG_403GCX  (POWERPC_FLAG_CE | POWERPC_FLAG_PX |             \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_403GCX     check_pow_nocheck
 
 static void init_proc_403GCX (CPUPPCState *env)
 {
@@ -2695,25 +3231,34 @@ static void init_proc_403GCX (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
+#endif
     init_excp_4xx_softmmu(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc40x_irq_init(env);
 }
 
 /* PowerPC 405                                                               */
-#define POWERPC_INSNS_405    (POWERPC_INSNS_EMB | PPC_MFTB |                  \
-                              PPC_MEM_SYNC | PPC_MEM_EIEIO | PPC_CACHE_DCBA | \
+#define POWERPC_INSNS_405    (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_DCR | PPC_WRTEE |                           \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_40x_ICBT |     \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
                               PPC_40x_TLB | PPC_MEM_TLBIA | PPC_MEM_TLBSYNC | \
-                              PPC_4xx_COMMON | PPC_40x_EXCP | PPC_40x_ICBT |  \
-                              PPC_405_MAC)
+                              PPC_4xx_COMMON | PPC_405_MAC | PPC_40x_EXCP)
 #define POWERPC_MSRM_405     (0x000000000006E630ULL)
 #define POWERPC_MMU_405      (POWERPC_MMU_SOFT_4xx)
 #define POWERPC_EXCP_405     (POWERPC_EXCP_40x)
 #define POWERPC_INPUT_405    (PPC_FLAGS_INPUT_405)
 #define POWERPC_BFDM_405     (bfd_mach_ppc_403)
+#define POWERPC_FLAG_405     (POWERPC_FLAG_CE | POWERPC_FLAG_DWE |            \
+                              POWERPC_FLAG_DE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_405        check_pow_nocheck
 
 static void init_proc_405 (CPUPPCState *env)
 {
@@ -2733,31 +3278,68 @@ static void init_proc_405 (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
+#endif
     init_excp_4xx_softmmu(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc40x_irq_init(env);
 }
 
 /* PowerPC 440 EP                                                            */
-#define POWERPC_INSNS_440EP  (POWERPC_INSNS_EMB |                             \
-                              PPC_CACHE_DCBA | PPC_MEM_TLBSYNC |              \
+#define POWERPC_INSNS_440EP  (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_DCR | PPC_WRTEE | PPC_RFMCI |               \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
+                              PPC_MEM_TLBSYNC |                               \
                               PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |      \
-                              PPC_440_SPEC | PPC_RFMCI)
+                              PPC_440_SPEC)
 #define POWERPC_MSRM_440EP   (0x000000000006D630ULL)
 #define POWERPC_MMU_440EP    (POWERPC_MMU_BOOKE)
 #define POWERPC_EXCP_440EP   (POWERPC_EXCP_BOOKE)
 #define POWERPC_INPUT_440EP  (PPC_FLAGS_INPUT_BookE)
 #define POWERPC_BFDM_440EP   (bfd_mach_ppc_403)
+#define POWERPC_FLAG_440EP   (POWERPC_FLAG_CE | POWERPC_FLAG_DWE |            \
+                              POWERPC_FLAG_DE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_440EP      check_pow_nocheck
 
+__attribute__ (( unused ))
 static void init_proc_440EP (CPUPPCState *env)
 {
     /* Time base */
     gen_tbl(env);
-    gen_spr_BookE(env);
+    gen_spr_BookE(env, 0x000000000000FFFFULL);
     gen_spr_440(env);
+    gen_spr_usprgh(env);
+    /* Processor identification */
+    spr_register(env, SPR_BOOKE_PIR, "PIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_pir,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC3, "IAC3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC4, "IAC4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC1, "DVC1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC2, "DVC2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* XXX : not implemented */
     spr_register(env, SPR_BOOKE_MCSR, "MCSR",
                  SPR_NOACCESS, SPR_NOACCESS,
@@ -2777,41 +3359,85 @@ static void init_proc_440EP (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
+#endif
     init_excp_BookE(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* XXX: TODO: allocate internal IRQ controller */
 }
 
 /* PowerPC 440 GP                                                            */
-#define POWERPC_INSNS_440GP  (POWERPC_INSNS_EMB |                             \
-                              PPC_CACHE_DCBA | PPC_MEM_TLBSYNC |              \
-                              PPC_BOOKE | PPC_BOOKE_EXT | PPC_4xx_COMMON |    \
-                              PPC_405_MAC | PPC_440_SPEC)
+#define POWERPC_INSNS_440GP  (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_DCR | PPC_DCRX | PPC_WRTEE | PPC_MFAPIDI |  \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
+                              PPC_MEM_TLBSYNC | PPC_TLBIVA |                  \
+                              PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |      \
+                              PPC_440_SPEC)
 #define POWERPC_MSRM_440GP   (0x000000000006FF30ULL)
 #define POWERPC_MMU_440GP    (POWERPC_MMU_BOOKE)
 #define POWERPC_EXCP_440GP   (POWERPC_EXCP_BOOKE)
 #define POWERPC_INPUT_440GP  (PPC_FLAGS_INPUT_BookE)
 #define POWERPC_BFDM_440GP   (bfd_mach_ppc_403)
+#define POWERPC_FLAG_440GP   (POWERPC_FLAG_CE | POWERPC_FLAG_DWE |            \
+                              POWERPC_FLAG_DE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_440GP      check_pow_nocheck
 
+__attribute__ (( unused ))
 static void init_proc_440GP (CPUPPCState *env)
 {
     /* Time base */
     gen_tbl(env);
-    gen_spr_BookE(env);
+    gen_spr_BookE(env, 0x000000000000FFFFULL);
     gen_spr_440(env);
+    gen_spr_usprgh(env);
+    /* Processor identification */
+    spr_register(env, SPR_BOOKE_PIR, "PIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_pir,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC3, "IAC3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC4, "IAC4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC1, "DVC1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC2, "DVC2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
+#endif
     init_excp_BookE(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* XXX: TODO: allocate internal IRQ controller */
 }
 
 /* PowerPC 440x4                                                             */
-#define POWERPC_INSNS_440x4  (POWERPC_INSNS_EMB |                             \
-                              PPC_CACHE_DCBA | PPC_MEM_TLBSYNC |              \
+#define POWERPC_INSNS_440x4  (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_DCR | PPC_WRTEE |                           \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
+                              PPC_MEM_TLBSYNC |                               \
                               PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |      \
                               PPC_440_SPEC)
 #define POWERPC_MSRM_440x4   (0x000000000006FF30ULL)
@@ -2819,39 +3445,105 @@ static void init_proc_440GP (CPUPPCState *env)
 #define POWERPC_EXCP_440x4   (POWERPC_EXCP_BOOKE)
 #define POWERPC_INPUT_440x4  (PPC_FLAGS_INPUT_BookE)
 #define POWERPC_BFDM_440x4   (bfd_mach_ppc_403)
+#define POWERPC_FLAG_440x4   (POWERPC_FLAG_CE | POWERPC_FLAG_DWE |            \
+                              POWERPC_FLAG_DE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_440x4      check_pow_nocheck
 
 __attribute__ (( unused ))
 static void init_proc_440x4 (CPUPPCState *env)
 {
     /* Time base */
     gen_tbl(env);
-    gen_spr_BookE(env);
+    gen_spr_BookE(env, 0x000000000000FFFFULL);
     gen_spr_440(env);
+    gen_spr_usprgh(env);
+    /* Processor identification */
+    spr_register(env, SPR_BOOKE_PIR, "PIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_pir,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC3, "IAC3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC4, "IAC4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC1, "DVC1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC2, "DVC2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
+#endif
     init_excp_BookE(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* XXX: TODO: allocate internal IRQ controller */
 }
 
 /* PowerPC 440x5                                                             */
-#define POWERPC_INSNS_440x5  (POWERPC_INSNS_EMB |                             \
-                              PPC_CACHE_DCBA | PPC_MEM_TLBSYNC |              \
+#define POWERPC_INSNS_440x5  (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_DCR | PPC_WRTEE | PPC_RFMCI |               \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
+                              PPC_MEM_TLBSYNC |                               \
                               PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |      \
-                              PPC_440_SPEC | PPC_RFMCI)
+                              PPC_440_SPEC)
 #define POWERPC_MSRM_440x5   (0x000000000006FF30ULL)
 #define POWERPC_MMU_440x5    (POWERPC_MMU_BOOKE)
 #define POWERPC_EXCP_440x5   (POWERPC_EXCP_BOOKE)
 #define POWERPC_INPUT_440x5  (PPC_FLAGS_INPUT_BookE)
 #define POWERPC_BFDM_440x5   (bfd_mach_ppc_403)
+#define POWERPC_FLAG_440x5   (POWERPC_FLAG_CE | POWERPC_FLAG_DWE |           \
+                              POWERPC_FLAG_DE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_440x5      check_pow_nocheck
 
+__attribute__ (( unused ))
 static void init_proc_440x5 (CPUPPCState *env)
 {
     /* Time base */
     gen_tbl(env);
-    gen_spr_BookE(env);
+    gen_spr_BookE(env, 0x000000000000FFFFULL);
     gen_spr_440(env);
+    gen_spr_usprgh(env);
+    /* Processor identification */
+    spr_register(env, SPR_BOOKE_PIR, "PIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_pir,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC3, "IAC3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC4, "IAC4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC1, "DVC1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC2, "DVC2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* XXX : not implemented */
     spr_register(env, SPR_BOOKE_MCSR, "MCSR",
                  SPR_NOACCESS, SPR_NOACCESS,
@@ -2871,31 +3563,68 @@ static void init_proc_440x5 (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
+#endif
     init_excp_BookE(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* XXX: TODO: allocate internal IRQ controller */
 }
 
 /* PowerPC 460 (guessed)                                                     */
-#define POWERPC_INSNS_460    (POWERPC_INSNS_EMB |                             \
-                              PPC_CACHE_DCBA | PPC_MEM_TLBSYNC |              \
-                              PPC_BOOKE | PPC_BOOKE_EXT | PPC_4xx_COMMON |    \
-                              PPC_405_MAC | PPC_440_SPEC | PPC_DCRUX)
+#define POWERPC_INSNS_460    (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_DCR | PPC_DCRX  | PPC_DCRUX |               \
+                              PPC_WRTEE | PPC_MFAPIDI |                       \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
+                              PPC_MEM_TLBSYNC | PPC_TLBIVA |                  \
+                              PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |      \
+                              PPC_440_SPEC)
 #define POWERPC_MSRM_460     (0x000000000006FF30ULL)
 #define POWERPC_MMU_460      (POWERPC_MMU_BOOKE)
 #define POWERPC_EXCP_460     (POWERPC_EXCP_BOOKE)
 #define POWERPC_INPUT_460    (PPC_FLAGS_INPUT_BookE)
 #define POWERPC_BFDM_460     (bfd_mach_ppc_403)
+#define POWERPC_FLAG_460     (POWERPC_FLAG_CE | POWERPC_FLAG_DWE |            \
+                              POWERPC_FLAG_DE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_460        check_pow_nocheck
 
 __attribute__ (( unused ))
 static void init_proc_460 (CPUPPCState *env)
 {
     /* Time base */
     gen_tbl(env);
-    gen_spr_BookE(env);
+    gen_spr_BookE(env, 0x000000000000FFFFULL);
     gen_spr_440(env);
+    gen_spr_usprgh(env);
+    /* Processor identification */
+    spr_register(env, SPR_BOOKE_PIR, "PIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_pir,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC3, "IAC3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC4, "IAC4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC1, "DVC1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC2, "DVC2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* XXX : not implemented */
     spr_register(env, SPR_BOOKE_MCSR, "MCSR",
                  SPR_NOACCESS, SPR_NOACCESS,
@@ -2920,34 +3649,71 @@ static void init_proc_460 (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
+#endif
     init_excp_BookE(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* XXX: TODO: allocate internal IRQ controller */
 }
 
 /* PowerPC 460F (guessed)                                                    */
-#define POWERPC_INSNS_460F   (POWERPC_INSNS_EMB |                             \
-                              PPC_CACHE_DCBA | PPC_MEM_TLBSYNC |              \
-                              PPC_FLOAT | PPC_FLOAT_FSQRT | PPC_FLOAT_FRES |  \
-                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_FSEL |            \
+#define POWERPC_INSNS_460F   (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_FLOAT | PPC_FLOAT_FRES | PPC_FLOAT_FSEL |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
                               PPC_FLOAT_STFIWX |                              \
-                              PPC_BOOKE | PPC_BOOKE_EXT | PPC_4xx_COMMON |    \
-                              PPC_405_MAC | PPC_440_SPEC | PPC_DCRUX)
+                              PPC_DCR | PPC_DCRX | PPC_DCRUX |                \
+                              PPC_WRTEE | PPC_MFAPIDI |                       \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
+                              PPC_MEM_TLBSYNC | PPC_TLBIVA |                  \
+                              PPC_BOOKE | PPC_4xx_COMMON | PPC_405_MAC |      \
+                              PPC_440_SPEC)
 #define POWERPC_MSRM_460     (0x000000000006FF30ULL)
 #define POWERPC_MMU_460F     (POWERPC_MMU_BOOKE)
 #define POWERPC_EXCP_460F    (POWERPC_EXCP_BOOKE)
 #define POWERPC_INPUT_460F   (PPC_FLAGS_INPUT_BookE)
 #define POWERPC_BFDM_460F    (bfd_mach_ppc_403)
+#define POWERPC_FLAG_460F    (POWERPC_FLAG_CE | POWERPC_FLAG_DWE |            \
+                              POWERPC_FLAG_DE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_460F       check_pow_nocheck
 
 __attribute__ (( unused ))
 static void init_proc_460F (CPUPPCState *env)
 {
     /* Time base */
     gen_tbl(env);
-    gen_spr_BookE(env);
+    gen_spr_BookE(env, 0x000000000000FFFFULL);
     gen_spr_440(env);
+    gen_spr_usprgh(env);
+    /* Processor identification */
+    spr_register(env, SPR_BOOKE_PIR, "PIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_pir,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC3, "IAC3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC4, "IAC4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC1, "DVC1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_DVC2, "DVC2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* XXX : not implemented */
     spr_register(env, SPR_BOOKE_MCSR, "MCSR",
                  SPR_NOACCESS, SPR_NOACCESS,
@@ -2972,73 +3738,483 @@ static void init_proc_460F (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
+#endif
     init_excp_BookE(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* XXX: TODO: allocate internal IRQ controller */
 }
 
-/* Generic BookE PowerPC                                                     */
-#define POWERPC_INSNS_BookE  (POWERPC_INSNS_EMB |                             \
-                              PPC_MEM_EIEIO | PPC_MEM_TLBSYNC |               \
-                              PPC_CACHE_DCBA |                                \
-                              PPC_FLOAT | PPC_FLOAT_FSQRT |                   \
-                              PPC_FLOAT_FRES | PPC_FLOAT_FRSQRTE |            \
-                              PPC_FLOAT_FSEL | PPC_FLOAT_STFIW |              \
-                              PPC_BOOKE)
-#define POWERPC_MSRM_BookE   (0x000000000006D630ULL)
-#define POWERPC_MMU_BookE    (POWERPC_MMU_BOOKE)
-#define POWERPC_EXCP_BookE   (POWERPC_EXCP_BOOKE)
-#define POWERPC_INPUT_BookE  (PPC_FLAGS_INPUT_BookE)
-#define POWERPC_BFDM_BookE   (bfd_mach_ppc_403)
+/* Freescale 5xx cores (aka RCPU) */
+#define POWERPC_INSNS_MPC5xx (PPC_INSNS_BASE | PPC_STRING |                   \
+                              PPC_MEM_EIEIO | PPC_MEM_SYNC |                  \
+                              PPC_CACHE_ICBI | PPC_FLOAT | PPC_FLOAT_STFIWX | \
+                              PPC_MFTB)
+#define POWERPC_MSRM_MPC5xx  (0x000000000001FF43ULL)
+#define POWERPC_MMU_MPC5xx   (POWERPC_MMU_REAL)
+#define POWERPC_EXCP_MPC5xx  (POWERPC_EXCP_603)
+#define POWERPC_INPUT_MPC5xx (PPC_FLAGS_INPUT_RCPU)
+#define POWERPC_BFDM_MPC5xx  (bfd_mach_ppc_505)
+#define POWERPC_FLAG_MPC5xx  (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_MPC5xx     check_pow_none
 
 __attribute__ (( unused ))
-static void init_proc_BookE (CPUPPCState *env)
+static void init_proc_MPC5xx (CPUPPCState *env)
 {
-    init_excp_BookE(env);
+    /* Time base */
+    gen_tbl(env);
+    gen_spr_5xx_8xx(env);
+    gen_spr_5xx(env);
+    init_excp_MPC5xx(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* XXX: TODO: allocate internal IRQ controller */
+}
+
+/* Freescale 8xx cores (aka PowerQUICC) */
+#define POWERPC_INSNS_MPC8xx (PPC_INSNS_BASE | PPC_STRING  |                  \
+                              PPC_MEM_EIEIO | PPC_MEM_SYNC |                  \
+                              PPC_CACHE_ICBI | PPC_MFTB)
+#define POWERPC_MSRM_MPC8xx  (0x000000000001F673ULL)
+#define POWERPC_MMU_MPC8xx   (POWERPC_MMU_MPC8xx)
+#define POWERPC_EXCP_MPC8xx  (POWERPC_EXCP_603)
+#define POWERPC_INPUT_MPC8xx (PPC_FLAGS_INPUT_RCPU)
+#define POWERPC_BFDM_MPC8xx  (bfd_mach_ppc_860)
+#define POWERPC_FLAG_MPC8xx  (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_MPC8xx     check_pow_none
+
+__attribute__ (( unused ))
+static void init_proc_MPC8xx (CPUPPCState *env)
+{
+    /* Time base */
+    gen_tbl(env);
+    gen_spr_5xx_8xx(env);
+    gen_spr_8xx(env);
+    init_excp_MPC8xx(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* XXX: TODO: allocate internal IRQ controller */
+}
+
+/* Freescale 82xx cores (aka PowerQUICC-II)                                  */
+/* PowerPC G2                                                                */
+#define POWERPC_INSNS_G2     (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB | \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_G2      (0x000000000006FFF2ULL)
+#define POWERPC_MMU_G2       (POWERPC_MMU_SOFT_6xx)
+//#define POWERPC_EXCP_G2      (POWERPC_EXCP_G2)
+#define POWERPC_INPUT_G2     (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_G2      (bfd_mach_ppc_ec603e)
+#define POWERPC_FLAG_G2      (POWERPC_FLAG_TGPR | POWERPC_FLAG_SE |           \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_G2         check_pow_hid0
+
+static void init_proc_G2 (CPUPPCState *env)
+{
+    gen_spr_ne_601(env);
+    gen_spr_G2_755(env);
+    gen_spr_G2(env);
+    /* Time base */
+    gen_tbl(env);
+    /* External access control */
+    /* XXX : not implemented */
+    spr_register(env, SPR_EAR, "EAR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Hardware implementation register */
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID2, "HID2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Memory management */
+    gen_low_BATs(env);
+    gen_high_BATs(env);
+    gen_6xx_7xx_soft_tlb(env, 64, 2);
+    init_excp_G2(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
+}
+
+/* PowerPC G2LE                                                              */
+#define POWERPC_INSNS_G2LE   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB | \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_G2LE    (0x000000000007FFF3ULL)
+#define POWERPC_MMU_G2LE     (POWERPC_MMU_SOFT_6xx)
+#define POWERPC_EXCP_G2LE    (POWERPC_EXCP_G2)
+#define POWERPC_INPUT_G2LE   (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_G2LE    (bfd_mach_ppc_ec603e)
+#define POWERPC_FLAG_G2LE    (POWERPC_FLAG_TGPR | POWERPC_FLAG_SE |           \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_G2LE       check_pow_hid0
+
+static void init_proc_G2LE (CPUPPCState *env)
+{
+    gen_spr_ne_601(env);
+    gen_spr_G2_755(env);
+    gen_spr_G2(env);
+    /* Time base */
+    gen_tbl(env);
+    /* External access control */
+    /* XXX : not implemented */
+    spr_register(env, SPR_EAR, "EAR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Hardware implementation register */
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID2, "HID2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Memory management */
+    gen_low_BATs(env);
+    gen_high_BATs(env);
+    gen_6xx_7xx_soft_tlb(env, 64, 2);
+    init_excp_G2(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
 }
 
 /* e200 core                                                                 */
+/* XXX: unimplemented instructions:
+ * dcblc
+ * dcbtlst
+ * dcbtstls
+ * icblc
+ * icbtls
+ * tlbivax
+ * all SPE multiply-accumulate instructions
+ */
+#define POWERPC_INSNS_e200   (PPC_INSNS_BASE | PPC_ISEL |                     \
+                              PPC_SPE | PPC_SPEFPU |                          \
+                              PPC_WRTEE | PPC_RFDI |                          \
+                              PPC_CACHE | PPC_CACHE_LOCK | PPC_CACHE_ICBI |   \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
+                              PPC_MEM_TLBSYNC | PPC_TLBIVAX |                 \
+                              PPC_BOOKE)
+#define POWERPC_MSRM_e200    (0x000000000606FF30ULL)
+#define POWERPC_MMU_e200     (POWERPC_MMU_BOOKE_FSL)
+#define POWERPC_EXCP_e200    (POWERPC_EXCP_BOOKE)
+#define POWERPC_INPUT_e200   (PPC_FLAGS_INPUT_BookE)
+#define POWERPC_BFDM_e200    (bfd_mach_ppc_860)
+#define POWERPC_FLAG_e200    (POWERPC_FLAG_SPE | POWERPC_FLAG_CE |            \
+                              POWERPC_FLAG_UBLE | POWERPC_FLAG_DE |           \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_e200       check_pow_hid0
+
+__attribute__ (( unused ))
+static void init_proc_e200 (CPUPPCState *env)
+{
+    /* Time base */
+    gen_tbl(env);
+    gen_spr_BookE(env, 0x000000070000FFFFULL);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_SPEFSCR, "SPEFSCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Memory management */
+    gen_spr_BookE_FSL(env, 0x0000005D);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_ALTCTXCR, "ALTCTXCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_BUCSR, "BUCSR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_CTXCR, "CTXCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_DBCNT, "DBCNT",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_DBCR3, "DBCR3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_L1CFG0, "L1CFG0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_L1CSR0, "L1CSR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_L1FINV0, "L1FINV0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_TLB0CFG, "TLB0CFG",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_TLB1CFG, "TLB1CFG",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC3, "IAC3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_IAC4, "IAC4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_BOOKE_DSRR0, "DSRR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_BOOKE_DSRR1, "DSRR1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+#if !defined(CONFIG_USER_ONLY)
+    env->nb_tlb = 64;
+    env->nb_ways = 1;
+    env->id_tlbs = 0;
+#endif
+    init_excp_e200(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* XXX: TODO: allocate internal IRQ controller */
+}
 
 /* e300 core                                                                 */
+#define POWERPC_INSNS_e300   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB | \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_e300    (0x000000000007FFF3ULL)
+#define POWERPC_MMU_e300     (POWERPC_MMU_SOFT_6xx)
+#define POWERPC_EXCP_e300    (POWERPC_EXCP_603)
+#define POWERPC_INPUT_e300   (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_e300    (bfd_mach_ppc_603)
+#define POWERPC_FLAG_e300    (POWERPC_FLAG_TGPR | POWERPC_FLAG_SE |           \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_e300       check_pow_hid0
+
+__attribute__ (( unused ))
+static void init_proc_e300 (CPUPPCState *env)
+{
+    gen_spr_ne_601(env);
+    gen_spr_603(env);
+    /* Time base */
+    gen_tbl(env);
+    /* hardware implementation registers */
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Memory management */
+    gen_low_BATs(env);
+    gen_6xx_7xx_soft_tlb(env, 64, 2);
+    init_excp_603(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
+}
 
 /* e500 core                                                                 */
-#define POWERPC_INSNS_e500   (POWERPC_INSNS_EMB |                             \
-                              PPC_MEM_EIEIO | PPC_MEM_TLBSYNC |               \
-                              PPC_CACHE_DCBA |                                \
-                              PPC_BOOKE | PPC_E500_VECTOR)
-#define POWERPC_MMU_e500     (POWERPC_MMU_SOFT_4xx)
-#define POWERPC_EXCP_e500    (POWERPC_EXCP_40x)
+#define POWERPC_INSNS_e500   (PPC_INSNS_BASE | PPC_ISEL |                     \
+                              PPC_SPE | PPC_SPEFPU |                          \
+                              PPC_WRTEE | PPC_RFDI |                          \
+                              PPC_CACHE | PPC_CACHE_LOCK | PPC_CACHE_ICBI |   \
+                              PPC_CACHE_DCBZ | PPC_CACHE_DCBA |               \
+                              PPC_MEM_TLBSYNC | PPC_TLBIVAX |                 \
+                              PPC_BOOKE)
+#define POWERPC_MSRM_e500    (0x000000000606FF30ULL)
+#define POWERPC_MMU_e500     (POWERPC_MMU_BOOKE_FSL)
+#define POWERPC_EXCP_e500    (POWERPC_EXCP_BOOKE)
 #define POWERPC_INPUT_e500   (PPC_FLAGS_INPUT_BookE)
-#define POWERPC_BFDM_e500    (bfd_mach_ppc_403)
+#define POWERPC_BFDM_e500    (bfd_mach_ppc_860)
+#define POWERPC_FLAG_e500    (POWERPC_FLAG_SPE | POWERPC_FLAG_CE |            \
+                              POWERPC_FLAG_UBLE | POWERPC_FLAG_DE |           \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_e500       check_pow_hid0
 
 __attribute__ (( unused ))
 static void init_proc_e500 (CPUPPCState *env)
 {
     /* Time base */
     gen_tbl(env);
-    gen_spr_BookE(env);
+    gen_spr_BookE(env, 0x0000000F0000FD7FULL);
+    /* Processor identification */
+    spr_register(env, SPR_BOOKE_PIR, "PIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_pir,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_SPEFSCR, "SPEFSCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Memory management */
-    gen_spr_BookE_FSL(env);
+#if !defined(CONFIG_USER_ONLY)
+    env->nb_pids = 3;
+#endif
+    gen_spr_BookE_FSL(env, 0x0000005F);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_BBEAR, "BBEAR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_BBTAR, "BBTAR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_MCAR, "MCAR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_MCSR, "MCSR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_NPIDR, "NPIDR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_BUCSR, "BUCSR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_L1CFG0, "L1CFG0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_L1CSR0, "L1CSR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_Exxx_L1CSR1, "L1CSR1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_TLB0CFG, "TLB0CFG",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_BOOKE_TLB1CFG, "TLB1CFG",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_BOOKE_MCSRR0, "MCSRR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_BOOKE_MCSRR1, "MCSRR1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+#if !defined(CONFIG_USER_ONLY)
     env->nb_tlb = 64;
     env->nb_ways = 1;
     env->id_tlbs = 0;
-    init_excp_BookE(env);
+#endif
+    init_excp_e200(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* XXX: TODO: allocate internal IRQ controller */
 }
 
-/* e600 core                                                                 */
-
 /* Non-embedded PowerPC                                                      */
-/* Base instructions set for all 6xx/7xx/74xx/970 PowerPC                    */
-#define POWERPC_INSNS_6xx    (PPC_INSNS_BASE | PPC_FLOAT | PPC_MEM_SYNC |     \
-                              PPC_MEM_EIEIO | PPC_SEGMENT | PPC_MEM_TLBIE)
-/* Instructions common to all 6xx/7xx/74xx/970 PowerPC except 601 & 602      */
-#define POWERPC_INSNS_WORKS  (POWERPC_INSNS_6xx | PPC_FLOAT_FSQRT |           \
-                              PPC_FLOAT_FRES | PPC_FLOAT_FRSQRTE |            \
-                              PPC_FLOAT_FSEL | PPC_FLOAT_STFIWX |             \
-                              PPC_MEM_TLBSYNC | PPC_MFTB)
 
 /* POWER : same as 601, without mfmsr, mfsr                                  */
 #if defined(TODO)
@@ -3048,12 +4224,19 @@ static void init_proc_e500 (CPUPPCState *env)
 #endif /* TODO */
 
 /* PowerPC 601                                                               */
-#define POWERPC_INSNS_601    (POWERPC_INSNS_6xx | PPC_EXTERN | PPC_POWER_BR)
-#define POWERPC_MSRM_601     (0x000000000000FE70ULL)
+#define POWERPC_INSNS_601    (PPC_INSNS_BASE | PPC_STRING | PPC_POWER_BR |    \
+                              PPC_FLOAT |                                     \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO | PPC_MEM_TLBIE |  \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_601     (0x000000000000FD70ULL)
+#define POWERPC_MSRR_601     (0x0000000000001040ULL)
 //#define POWERPC_MMU_601      (POWERPC_MMU_601)
 //#define POWERPC_EXCP_601     (POWERPC_EXCP_601)
 #define POWERPC_INPUT_601    (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_601     (bfd_mach_ppc_601)
+#define POWERPC_FLAG_601     (POWERPC_FLAG_SE | POWERPC_FLAG_RTC_CLK)
+#define check_pow_601        check_pow_none
 
 static void init_proc_601 (CPUPPCState *env)
 {
@@ -3063,8 +4246,8 @@ static void init_proc_601 (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
+                 &spr_read_generic, &spr_write_hid0_601,
+                 0x80010080);
     /* XXX : not implemented */
     spr_register(env, SPR_HID1, "HID1",
                  SPR_NOACCESS, SPR_NOACCESS,
@@ -3080,30 +4263,60 @@ static void init_proc_601 (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
+    /* Memory management */
+    init_excp_601(env);
+    /* XXX: beware that dcache line size is 64 
+     *      but dcbz uses 32 bytes "sectors"
+     * XXX: this breaks clcs instruction !
+     */
+    env->dcache_line_size = 32;
+    env->icache_line_size = 64;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
+}
+
+/* PowerPC 601v                                                              */
+#define POWERPC_INSNS_601v   (PPC_INSNS_BASE | PPC_STRING | PPC_POWER_BR |    \
+                              PPC_FLOAT |                                     \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO | PPC_MEM_TLBIE |  \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_601v    (0x000000000000FD70ULL)
+#define POWERPC_MSRR_601v    (0x0000000000001040ULL)
+#define POWERPC_MMU_601v     (POWERPC_MMU_601)
+#define POWERPC_EXCP_601v    (POWERPC_EXCP_601)
+#define POWERPC_INPUT_601v   (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_601v    (bfd_mach_ppc_601)
+#define POWERPC_FLAG_601v    (POWERPC_FLAG_SE | POWERPC_FLAG_RTC_CLK)
+#define check_pow_601v       check_pow_none
+
+static void init_proc_601v (CPUPPCState *env)
+{
+    init_proc_601(env);
     /* XXX : not implemented */
     spr_register(env, SPR_601_HID15, "HID15",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
-    /* Memory management */
-    env->nb_tlb = 64;
-    env->nb_ways = 2;
-    env->id_tlbs = 0;
-    env->id_tlbs = 0;
-    init_excp_601(env);
-    /* XXX: TODO: allocate internal IRQ controller */
 }
 
 /* PowerPC 602                                                               */
-#define POWERPC_INSNS_602    (POWERPC_INSNS_6xx | PPC_MFTB |                  \
-                              PPC_FLOAT_FRES | PPC_FLOAT_FRSQRTE |            \
-                              PPC_FLOAT_FSEL | PPC_FLOAT_STFIWX |             \
-                              PPC_6xx_TLB | PPC_MEM_TLBSYNC | PPC_602_SPEC)
-#define POWERPC_MSRM_602     (0x000000000033FF73ULL)
+#define POWERPC_INSNS_602    (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_6xx_TLB | PPC_MEM_TLBSYNC | \
+                              PPC_SEGMENT | PPC_602_SPEC)
+#define POWERPC_MSRM_602     (0x0000000000C7FF73ULL)
+/* XXX: 602 MMU is quite specific. Should add a special case */
 #define POWERPC_MMU_602      (POWERPC_MMU_SOFT_6xx)
 //#define POWERPC_EXCP_602     (POWERPC_EXCP_602)
 #define POWERPC_INPUT_602    (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_602     (bfd_mach_ppc_602)
+#define POWERPC_FLAG_602     (POWERPC_FLAG_TGPR | POWERPC_FLAG_SE |           \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_602        check_pow_hid0
 
 static void init_proc_602 (CPUPPCState *env)
 {
@@ -3126,17 +4339,28 @@ static void init_proc_602 (CPUPPCState *env)
     gen_low_BATs(env);
     gen_6xx_7xx_soft_tlb(env, 64, 2);
     init_excp_602(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
 /* PowerPC 603                                                               */
-#define POWERPC_INSNS_603    (POWERPC_INSNS_WORKS | PPC_6xx_TLB | PPC_EXTERN)
-#define POWERPC_MSRM_603     (0x000000000001FF73ULL)
+#define POWERPC_INSNS_603    (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB | \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_603     (0x000000000007FF73ULL)
 #define POWERPC_MMU_603      (POWERPC_MMU_SOFT_6xx)
 //#define POWERPC_EXCP_603     (POWERPC_EXCP_603)
 #define POWERPC_INPUT_603    (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_603     (bfd_mach_ppc_603)
+#define POWERPC_FLAG_603     (POWERPC_FLAG_TGPR | POWERPC_FLAG_SE |           \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_603        check_pow_hid0
 
 static void init_proc_603 (CPUPPCState *env)
 {
@@ -3159,17 +4383,28 @@ static void init_proc_603 (CPUPPCState *env)
     gen_low_BATs(env);
     gen_6xx_7xx_soft_tlb(env, 64, 2);
     init_excp_603(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
 /* PowerPC 603e                                                              */
-#define POWERPC_INSNS_603E   (POWERPC_INSNS_WORKS | PPC_6xx_TLB | PPC_EXTERN)
+#define POWERPC_INSNS_603E   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB | \
+                              PPC_SEGMENT | PPC_EXTERN)
 #define POWERPC_MSRM_603E    (0x000000000007FF73ULL)
 #define POWERPC_MMU_603E     (POWERPC_MMU_SOFT_6xx)
 //#define POWERPC_EXCP_603E    (POWERPC_EXCP_603E)
 #define POWERPC_INPUT_603E   (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_603E    (bfd_mach_ppc_ec603e)
+#define POWERPC_FLAG_603E    (POWERPC_FLAG_TGPR | POWERPC_FLAG_SE |           \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK)
+#define check_pow_603E       check_pow_hid0
 
 static void init_proc_603E (CPUPPCState *env)
 {
@@ -3197,66 +4432,134 @@ static void init_proc_603E (CPUPPCState *env)
     gen_low_BATs(env);
     gen_6xx_7xx_soft_tlb(env, 64, 2);
     init_excp_603(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
-/* PowerPC G2                                                                */
-#define POWERPC_INSNS_G2     (POWERPC_INSNS_WORKS | PPC_6xx_TLB | PPC_EXTERN)
-#define POWERPC_MSRM_G2      (0x000000000006FFF2ULL)
-#define POWERPC_MMU_G2       (POWERPC_MMU_SOFT_6xx)
-//#define POWERPC_EXCP_G2      (POWERPC_EXCP_G2)
-#define POWERPC_INPUT_G2     (PPC_FLAGS_INPUT_6xx)
-#define POWERPC_BFDM_G2      (bfd_mach_ppc_ec603e)
+/* PowerPC 604                                                               */
+#define POWERPC_INSNS_604    (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_604     (0x000000000005FF77ULL)
+#define POWERPC_MMU_604      (POWERPC_MMU_32B)
+//#define POWERPC_EXCP_604     (POWERPC_EXCP_604)
+#define POWERPC_INPUT_604    (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_604     (bfd_mach_ppc_604)
+#define POWERPC_FLAG_604     (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_604        check_pow_nocheck
 
-static void init_proc_G2 (CPUPPCState *env)
+static void init_proc_604 (CPUPPCState *env)
 {
     gen_spr_ne_601(env);
-    gen_spr_G2_755(env);
-    gen_spr_G2(env);
+    gen_spr_604(env);
     /* Time base */
     gen_tbl(env);
-    /* Hardware implementation register */
+    /* Hardware implementation registers */
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
+    /* Memory management */
+    gen_low_BATs(env);
+    init_excp_604(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
+}
+
+/* PowerPC 604E                                                              */
+#define POWERPC_INSNS_604E   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_604E    (0x000000000005FF77ULL)
+#define POWERPC_MMU_604E     (POWERPC_MMU_32B)
+#define POWERPC_EXCP_604E    (POWERPC_EXCP_604)
+#define POWERPC_INPUT_604E   (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_604E    (bfd_mach_ppc_604)
+#define POWERPC_FLAG_604E    (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_604E       check_pow_nocheck
+
+static void init_proc_604E (CPUPPCState *env)
+{
+    gen_spr_ne_601(env);
+    gen_spr_604(env);
     /* XXX : not implemented */
-    spr_register(env, SPR_HID1, "HID1",
+    spr_register(env, SPR_MMCR1, "MMCR1",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_HID2, "HID2",
+    spr_register(env, SPR_PMC3, "PMC3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_PMC4, "PMC4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Time base */
+    gen_tbl(env);
+    /* Hardware implementation registers */
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
     gen_low_BATs(env);
-    gen_high_BATs(env);
-    gen_6xx_7xx_soft_tlb(env, 64, 2);
-    init_excp_G2(env);
+    init_excp_604(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
-/* PowerPC G2LE                                                              */
-#define POWERPC_INSNS_G2LE   (POWERPC_INSNS_WORKS | PPC_6xx_TLB | PPC_EXTERN)
-#define POWERPC_MSRM_G2LE    (0x000000000007FFF3ULL)
-#define POWERPC_MMU_G2LE     (POWERPC_MMU_SOFT_6xx)
-#define POWERPC_EXCP_G2LE    (POWERPC_EXCP_G2)
-#define POWERPC_INPUT_G2LE   (PPC_FLAGS_INPUT_6xx)
-#define POWERPC_BFDM_G2LE    (bfd_mach_ppc_ec603e)
-
-static void init_proc_G2LE (CPUPPCState *env)
+/* PowerPC 740                                                               */
+#define POWERPC_INSNS_740    (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_740     (0x000000000005FF77ULL)
+#define POWERPC_MMU_740      (POWERPC_MMU_32B)
+#define POWERPC_EXCP_740     (POWERPC_EXCP_7x0)
+#define POWERPC_INPUT_740    (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_740     (bfd_mach_ppc_750)
+#define POWERPC_FLAG_740     (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_740        check_pow_hid0
+
+static void init_proc_740 (CPUPPCState *env)
 {
     gen_spr_ne_601(env);
-    gen_spr_G2_755(env);
-    gen_spr_G2(env);
+    gen_spr_7xx(env);
     /* Time base */
     gen_tbl(env);
-    /* Hardware implementation register */
+    /* Thermal management */
+    gen_spr_thrm(env);
+    /* Hardware implementation registers */
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
                  SPR_NOACCESS, SPR_NOACCESS,
@@ -3267,34 +4570,171 @@ static void init_proc_G2LE (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
+    /* Memory management */
+    gen_low_BATs(env);
+    init_excp_7x0(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
+}
+
+/* PowerPC 750                                                               */
+#define POWERPC_INSNS_750    (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_750     (0x000000000005FF77ULL)
+#define POWERPC_MMU_750      (POWERPC_MMU_32B)
+#define POWERPC_EXCP_750     (POWERPC_EXCP_7x0)
+#define POWERPC_INPUT_750    (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_750     (bfd_mach_ppc_750)
+#define POWERPC_FLAG_750     (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_750        check_pow_hid0
+
+static void init_proc_750 (CPUPPCState *env)
+{
+    gen_spr_ne_601(env);
+    gen_spr_7xx(env);
     /* XXX : not implemented */
-    spr_register(env, SPR_HID2, "HID2",
+    spr_register(env, SPR_L2CR, "L2CR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Time base */
+    gen_tbl(env);
+    /* Thermal management */
+    gen_spr_thrm(env);
+    /* Hardware implementation registers */
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
     gen_low_BATs(env);
-    gen_high_BATs(env);
-    gen_6xx_7xx_soft_tlb(env, 64, 2);
-    init_excp_G2(env);
+    /* XXX: high BATs are also present but are known to be bugged on
+     *      die version 1.x
+     */
+    init_excp_7x0(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
-/* PowerPC 604                                                               */
-#define POWERPC_INSNS_604    (POWERPC_INSNS_WORKS | PPC_EXTERN)
-#define POWERPC_MSRM_604     (0x000000000005FF77ULL)
-#define POWERPC_MMU_604      (POWERPC_MMU_32B)
-//#define POWERPC_EXCP_604     (POWERPC_EXCP_604)
-#define POWERPC_INPUT_604    (PPC_FLAGS_INPUT_6xx)
-#define POWERPC_BFDM_604     (bfd_mach_ppc_604)
-
-static void init_proc_604 (CPUPPCState *env)
+/* PowerPC 750 CL                                                            */
+/* XXX: not implemented:
+ * cache lock instructions:
+ * dcbz_l
+ * floating point paired instructions
+ * psq_lux
+ * psq_lx
+ * psq_stux
+ * psq_stx
+ * ps_abs
+ * ps_add
+ * ps_cmpo0
+ * ps_cmpo1
+ * ps_cmpu0
+ * ps_cmpu1
+ * ps_div
+ * ps_madd
+ * ps_madds0
+ * ps_madds1
+ * ps_merge00
+ * ps_merge01
+ * ps_merge10
+ * ps_merge11
+ * ps_mr
+ * ps_msub
+ * ps_mul
+ * ps_muls0
+ * ps_muls1
+ * ps_nabs
+ * ps_neg
+ * ps_nmadd
+ * ps_nmsub
+ * ps_res
+ * ps_rsqrte
+ * ps_sel
+ * ps_sub
+ * ps_sum0
+ * ps_sum1
+ */
+#define POWERPC_INSNS_750cl  (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_750cl   (0x000000000005FF77ULL)
+#define POWERPC_MMU_750cl    (POWERPC_MMU_32B)
+#define POWERPC_EXCP_750cl   (POWERPC_EXCP_7x0)
+#define POWERPC_INPUT_750cl  (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_750cl   (bfd_mach_ppc_750)
+#define POWERPC_FLAG_750cl   (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_750cl      check_pow_hid0
+
+static void init_proc_750cl (CPUPPCState *env)
 {
     gen_spr_ne_601(env);
-    gen_spr_604(env);
+    gen_spr_7xx(env);
+    /* XXX : not implemented */
+    spr_register(env, SPR_L2CR, "L2CR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Time base */
     gen_tbl(env);
+    /* Thermal management */
+    /* Those registers are fake on 750CL */
+    spr_register(env, SPR_THRM1, "THRM1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_THRM2, "THRM2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_THRM3, "THRM3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX: not implemented */
+    spr_register(env, SPR_750_TDCL, "TDCL",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_750_TDCH, "TDCH",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* DMA */
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_WPAR, "WPAR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_750_DMAL, "DMAL",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_750_DMAU, "DMAU",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Hardware implementation registers */
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
@@ -3306,29 +4746,103 @@ static void init_proc_604 (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750CL_HID2, "HID2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750CL_HID4, "HID4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Quantization registers */
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_GQR0, "GQR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_GQR1, "GQR1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_GQR2, "GQR2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_GQR3, "GQR3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_GQR4, "GQR4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_GQR5, "GQR5",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_GQR6, "GQR6",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_GQR7, "GQR7",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Memory management */
     gen_low_BATs(env);
-    init_excp_604(env);
+    /* PowerPC 750cl has 8 DBATs and 8 IBATs */
+    gen_high_BATs(env);
+    init_excp_750cl(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
-/* PowerPC 740/750 (aka G3)                                                  */
-#define POWERPC_INSNS_7x0    (POWERPC_INSNS_WORKS | PPC_EXTERN)
-#define POWERPC_MSRM_7x0     (0x000000000007FF77ULL)
-#define POWERPC_MMU_7x0      (POWERPC_MMU_32B)
-//#define POWERPC_EXCP_7x0     (POWERPC_EXCP_7x0)
-#define POWERPC_INPUT_7x0    (PPC_FLAGS_INPUT_6xx)
-#define POWERPC_BFDM_7x0     (bfd_mach_ppc_750)
-
-static void init_proc_7x0 (CPUPPCState *env)
+/* PowerPC 750CX                                                             */
+#define POWERPC_INSNS_750cx  (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_750cx   (0x000000000005FF77ULL)
+#define POWERPC_MMU_750cx    (POWERPC_MMU_32B)
+#define POWERPC_EXCP_750cx   (POWERPC_EXCP_7x0)
+#define POWERPC_INPUT_750cx  (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_750cx   (bfd_mach_ppc_750)
+#define POWERPC_FLAG_750cx   (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_750cx      check_pow_hid0
+
+static void init_proc_750cx (CPUPPCState *env)
 {
     gen_spr_ne_601(env);
     gen_spr_7xx(env);
+    /* XXX : not implemented */
+    spr_register(env, SPR_L2CR, "L2CR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Time base */
     gen_tbl(env);
     /* Thermal management */
     gen_spr_thrm(env);
+    /* This register is not implemented but is present for compatibility */
+    spr_register(env, SPR_SDA, "SDA",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Hardware implementation registers */
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
@@ -3342,27 +4856,50 @@ static void init_proc_7x0 (CPUPPCState *env)
                  0x00000000);
     /* Memory management */
     gen_low_BATs(env);
-    init_excp_7x0(env);
+    /* PowerPC 750cx has 8 DBATs and 8 IBATs */
+    gen_high_BATs(env);
+    init_excp_750cx(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
-/* PowerPC 750FX/GX                                                          */
-#define POWERPC_INSNS_750fx  (POWERPC_INSNS_WORKS | PPC_EXTERN)
-#define POWERPC_MSRM_750fx   (0x000000000007FF77ULL)
+/* PowerPC 750FX                                                             */
+#define POWERPC_INSNS_750fx  (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_SEGMENT  | PPC_EXTERN)
+#define POWERPC_MSRM_750fx   (0x000000000005FF77ULL)
 #define POWERPC_MMU_750fx    (POWERPC_MMU_32B)
 #define POWERPC_EXCP_750fx   (POWERPC_EXCP_7x0)
 #define POWERPC_INPUT_750fx  (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_750fx   (bfd_mach_ppc_750)
+#define POWERPC_FLAG_750fx   (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_750fx      check_pow_hid0
 
 static void init_proc_750fx (CPUPPCState *env)
 {
     gen_spr_ne_601(env);
     gen_spr_7xx(env);
+    /* XXX : not implemented */
+    spr_register(env, SPR_L2CR, "L2CR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Time base */
     gen_tbl(env);
     /* Thermal management */
     gen_spr_thrm(env);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_THRM4, "THRM4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Hardware implementation registers */
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
@@ -3375,7 +4912,7 @@ static void init_proc_750fx (CPUPPCState *env)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_750_HID2, "HID2",
+    spr_register(env, SPR_750FX_HID2, "HID2",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
@@ -3383,28 +4920,155 @@ static void init_proc_750fx (CPUPPCState *env)
     gen_low_BATs(env);
     /* PowerPC 750fx & 750gx has 8 DBATs and 8 IBATs */
     gen_high_BATs(env);
-    init_excp_750FX(env);
+    init_excp_7x0(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
-/* PowerPC 745/755                                                           */
-#define POWERPC_INSNS_7x5    (POWERPC_INSNS_WORKS | PPC_EXTERN | PPC_6xx_TLB)
-#define POWERPC_MSRM_7x5     (0x000000000007FF77ULL)
-#define POWERPC_MMU_7x5      (POWERPC_MMU_SOFT_6xx)
-//#define POWERPC_EXCP_7x5     (POWERPC_EXCP_7x5)
-#define POWERPC_INPUT_7x5    (PPC_FLAGS_INPUT_6xx)
-#define POWERPC_BFDM_7x5     (bfd_mach_ppc_750)
+/* PowerPC 750GX                                                             */
+#define POWERPC_INSNS_750gx  (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_SEGMENT  | PPC_EXTERN)
+#define POWERPC_MSRM_750gx   (0x000000000005FF77ULL)
+#define POWERPC_MMU_750gx    (POWERPC_MMU_32B)
+#define POWERPC_EXCP_750gx   (POWERPC_EXCP_7x0)
+#define POWERPC_INPUT_750gx  (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_750gx   (bfd_mach_ppc_750)
+#define POWERPC_FLAG_750gx   (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_750gx      check_pow_hid0
+
+static void init_proc_750gx (CPUPPCState *env)
+{
+    gen_spr_ne_601(env);
+    gen_spr_7xx(env);
+    /* XXX : not implemented (XXX: different from 750fx) */
+    spr_register(env, SPR_L2CR, "L2CR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Time base */
+    gen_tbl(env);
+    /* Thermal management */
+    gen_spr_thrm(env);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750_THRM4, "THRM4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Hardware implementation registers */
+    /* XXX : not implemented (XXX: different from 750fx) */
+    spr_register(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented (XXX: different from 750fx) */
+    spr_register(env, SPR_750FX_HID2, "HID2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Memory management */
+    gen_low_BATs(env);
+    /* PowerPC 750fx & 750gx has 8 DBATs and 8 IBATs */
+    gen_high_BATs(env);
+    init_excp_7x0(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
+}
+
+/* PowerPC 745                                                               */
+#define POWERPC_INSNS_745    (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB | \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_745     (0x000000000005FF77ULL)
+#define POWERPC_MMU_745      (POWERPC_MMU_SOFT_6xx)
+#define POWERPC_EXCP_745     (POWERPC_EXCP_7x5)
+#define POWERPC_INPUT_745    (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_745     (bfd_mach_ppc_750)
+#define POWERPC_FLAG_745     (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_745        check_pow_hid0
+
+static void init_proc_745 (CPUPPCState *env)
+{
+    gen_spr_ne_601(env);
+    gen_spr_7xx(env);
+    gen_spr_G2_755(env);
+    /* Time base */
+    gen_tbl(env);
+    /* Thermal management */
+    gen_spr_thrm(env);
+    /* Hardware implementation registers */
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID2, "HID2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Memory management */
+    gen_low_BATs(env);
+    gen_high_BATs(env);
+    gen_6xx_7xx_soft_tlb(env, 64, 2);
+    init_excp_7x5(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
+}
 
-static void init_proc_7x5 (CPUPPCState *env)
+/* PowerPC 755                                                               */
+#define POWERPC_INSNS_755    (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FRSQRTE | PPC_FLOAT_STFIWX |          \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB | \
+                              PPC_SEGMENT | PPC_EXTERN)
+#define POWERPC_MSRM_755     (0x000000000005FF77ULL)
+#define POWERPC_MMU_755      (POWERPC_MMU_SOFT_6xx)
+#define POWERPC_EXCP_755     (POWERPC_EXCP_7x5)
+#define POWERPC_INPUT_755    (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_755     (bfd_mach_ppc_750)
+#define POWERPC_FLAG_755     (POWERPC_FLAG_SE | POWERPC_FLAG_BE |             \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_755        check_pow_hid0
+
+static void init_proc_755 (CPUPPCState *env)
 {
     gen_spr_ne_601(env);
+    gen_spr_7xx(env);
     gen_spr_G2_755(env);
     /* Time base */
     gen_tbl(env);
     /* L2 cache control */
     /* XXX : not implemented */
-    spr_register(env, SPR_ICTC, "ICTC",
+    spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
@@ -3413,6 +5077,8 @@ static void init_proc_7x5 (CPUPPCState *env)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
+    /* Thermal management */
+    gen_spr_thrm(env);
     /* Hardware implementation registers */
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
@@ -3433,19 +5099,34 @@ static void init_proc_7x5 (CPUPPCState *env)
     gen_low_BATs(env);
     gen_high_BATs(env);
     gen_6xx_7xx_soft_tlb(env, 64, 2);
+    init_excp_7x5(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
 /* PowerPC 7400 (aka G4)                                                     */
-#define POWERPC_INSNS_7400   (POWERPC_INSNS_WORKS | PPC_CACHE_DCBA |          \
-                              PPC_EXTERN | PPC_MEM_TLBIA |                    \
+#define POWERPC_INSNS_7400   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBA | PPC_CACHE_DCBZ |               \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_MEM_TLBIA |                                 \
+                              PPC_SEGMENT | PPC_EXTERN |                      \
                               PPC_ALTIVEC)
 #define POWERPC_MSRM_7400    (0x000000000205FF77ULL)
 #define POWERPC_MMU_7400     (POWERPC_MMU_32B)
 #define POWERPC_EXCP_7400    (POWERPC_EXCP_74xx)
 #define POWERPC_INPUT_7400   (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_7400    (bfd_mach_ppc_7400)
+#define POWERPC_FLAG_7400    (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_7400       check_pow_hid0_74xx
 
 static void init_proc_7400 (CPUPPCState *env)
 {
@@ -3455,24 +5136,49 @@ static void init_proc_7400 (CPUPPCState *env)
     gen_tbl(env);
     /* 74xx specific SPR */
     gen_spr_74xx(env);
+    /* XXX : not implemented */
+    spr_register(env, SPR_UBAMR, "UBAMR",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    /* XXX: this seems not implemented on all revisions. */
+    /* XXX : not implemented */
+    spr_register(env, SPR_MSSCR1, "MSSCR1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
     /* Thermal management */
     gen_spr_thrm(env);
     /* Memory management */
     gen_low_BATs(env);
     init_excp_7400(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
 /* PowerPC 7410 (aka G4)                                                     */
-#define POWERPC_INSNS_7410   (POWERPC_INSNS_WORKS | PPC_CACHE_DCBA |          \
-                              PPC_EXTERN | PPC_MEM_TLBIA |                    \
+#define POWERPC_INSNS_7410   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBA | PPC_CACHE_DCBZ |               \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_MEM_TLBIA |                                 \
+                              PPC_SEGMENT | PPC_EXTERN |                      \
                               PPC_ALTIVEC)
 #define POWERPC_MSRM_7410    (0x000000000205FF77ULL)
 #define POWERPC_MMU_7410     (POWERPC_MMU_32B)
 #define POWERPC_EXCP_7410    (POWERPC_EXCP_74xx)
 #define POWERPC_INPUT_7410   (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_7410    (bfd_mach_ppc_7400)
+#define POWERPC_FLAG_7410    (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_7410       check_pow_hid0_74xx
 
 static void init_proc_7410 (CPUPPCState *env)
 {
@@ -3482,6 +5188,11 @@ static void init_proc_7410 (CPUPPCState *env)
     gen_tbl(env);
     /* 74xx specific SPR */
     gen_spr_74xx(env);
+    /* XXX : not implemented */
+    spr_register(env, SPR_UBAMR, "UBAMR",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
     /* Thermal management */
     gen_spr_thrm(env);
     /* L2PMCR */
@@ -3499,19 +5210,33 @@ static void init_proc_7410 (CPUPPCState *env)
     /* Memory management */
     gen_low_BATs(env);
     init_excp_7400(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
 /* PowerPC 7440 (aka G4)                                                     */
-#define POWERPC_INSNS_7440   (POWERPC_INSNS_WORKS | PPC_CACHE_DCBA |          \
-                              PPC_EXTERN | PPC_74xx_TLB | PPC_MEM_TLBIA |     \
+#define POWERPC_INSNS_7440   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBA | PPC_CACHE_DCBZ |               \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_MEM_TLBIA | PPC_74xx_TLB |                  \
+                              PPC_SEGMENT | PPC_EXTERN |                      \
                               PPC_ALTIVEC)
 #define POWERPC_MSRM_7440    (0x000000000205FF77ULL)
 #define POWERPC_MMU_7440     (POWERPC_MMU_SOFT_74xx)
 #define POWERPC_EXCP_7440    (POWERPC_EXCP_74xx)
 #define POWERPC_INPUT_7440   (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_7440    (bfd_mach_ppc_7400)
+#define POWERPC_FLAG_7440    (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_7440       check_pow_hid0_74xx
 
 __attribute__ (( unused ))
 static void init_proc_7440 (CPUPPCState *env)
@@ -3522,6 +5247,11 @@ static void init_proc_7440 (CPUPPCState *env)
     gen_tbl(env);
     /* 74xx specific SPR */
     gen_spr_74xx(env);
+    /* XXX : not implemented */
+    spr_register(env, SPR_UBAMR, "UBAMR",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
     /* LDSTCR */
     /* XXX : not implemented */
     spr_register(env, SPR_LDSTCR, "LDSTCR",
@@ -3564,19 +5294,34 @@ static void init_proc_7440 (CPUPPCState *env)
     /* Memory management */
     gen_low_BATs(env);
     gen_74xx_soft_tlb(env, 128, 2);
+    init_excp_7450(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
 /* PowerPC 7450 (aka G4)                                                     */
-#define POWERPC_INSNS_7450   (POWERPC_INSNS_WORKS | PPC_CACHE_DCBA |          \
-                              PPC_EXTERN | PPC_74xx_TLB | PPC_MEM_TLBIA |     \
+#define POWERPC_INSNS_7450   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBA | PPC_CACHE_DCBZ |               \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_MEM_TLBIA | PPC_74xx_TLB |                  \
+                              PPC_SEGMENT | PPC_EXTERN |                      \
                               PPC_ALTIVEC)
 #define POWERPC_MSRM_7450    (0x000000000205FF77ULL)
 #define POWERPC_MMU_7450     (POWERPC_MMU_SOFT_74xx)
 #define POWERPC_EXCP_7450    (POWERPC_EXCP_74xx)
 #define POWERPC_INPUT_7450   (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_7450    (bfd_mach_ppc_7400)
+#define POWERPC_FLAG_7450    (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_7450       check_pow_hid0_74xx
 
 __attribute__ (( unused ))
 static void init_proc_7450 (CPUPPCState *env)
@@ -3589,6 +5334,35 @@ static void init_proc_7450 (CPUPPCState *env)
     gen_spr_74xx(env);
     /* Level 3 cache control */
     gen_l3_ctrl(env);
+    /* L3ITCR1 */
+    /* XXX : not implemented */
+    spr_register(env, SPR_L3ITCR1, "L3ITCR1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* L3ITCR2 */
+    /* XXX : not implemented */
+    spr_register(env, SPR_L3ITCR2, "L3ITCR2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* L3ITCR3 */
+    /* XXX : not implemented */
+    spr_register(env, SPR_L3ITCR3, "L3ITCR3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* L3OHCR */
+    /* XXX : not implemented */
+    spr_register(env, SPR_L3OHCR, "L3OHCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_UBAMR, "UBAMR",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
     /* LDSTCR */
     /* XXX : not implemented */
     spr_register(env, SPR_LDSTCR, "LDSTCR",
@@ -3632,19 +5406,33 @@ static void init_proc_7450 (CPUPPCState *env)
     gen_low_BATs(env);
     gen_74xx_soft_tlb(env, 128, 2);
     init_excp_7450(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
 /* PowerPC 7445 (aka G4)                                                     */
-#define POWERPC_INSNS_7445   (POWERPC_INSNS_WORKS | PPC_CACHE_DCBA |          \
-                              PPC_EXTERN | PPC_74xx_TLB | PPC_MEM_TLBIA |     \
+#define POWERPC_INSNS_7445   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBA | PPC_CACHE_DCBZ |               \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_MEM_TLBIA | PPC_74xx_TLB |                  \
+                              PPC_SEGMENT | PPC_EXTERN |                      \
                               PPC_ALTIVEC)
 #define POWERPC_MSRM_7445    (0x000000000205FF77ULL)
 #define POWERPC_MMU_7445     (POWERPC_MMU_SOFT_74xx)
 #define POWERPC_EXCP_7445    (POWERPC_EXCP_74xx)
 #define POWERPC_INPUT_7445   (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_7445    (bfd_mach_ppc_7400)
+#define POWERPC_FLAG_7445    (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_7445       check_pow_hid0_74xx
 
 __attribute__ (( unused ))
 static void init_proc_7445 (CPUPPCState *env)
@@ -3732,19 +5520,33 @@ static void init_proc_7445 (CPUPPCState *env)
     gen_high_BATs(env);
     gen_74xx_soft_tlb(env, 128, 2);
     init_excp_7450(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
 /* PowerPC 7455 (aka G4)                                                     */
-#define POWERPC_INSNS_7455   (POWERPC_INSNS_WORKS | PPC_CACHE_DCBA |          \
-                              PPC_EXTERN | PPC_74xx_TLB | PPC_MEM_TLBIA |     \
+#define POWERPC_INSNS_7455   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBA | PPC_CACHE_DCBZ |               \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_MEM_TLBIA | PPC_74xx_TLB |                  \
+                              PPC_SEGMENT | PPC_EXTERN |                      \
                               PPC_ALTIVEC)
 #define POWERPC_MSRM_7455    (0x000000000205FF77ULL)
 #define POWERPC_MMU_7455     (POWERPC_MMU_SOFT_74xx)
 #define POWERPC_EXCP_7455    (POWERPC_EXCP_74xx)
 #define POWERPC_INPUT_7455   (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_7455    (bfd_mach_ppc_7400)
+#define POWERPC_FLAG_7455    (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_7455       check_pow_hid0_74xx
 
 __attribute__ (( unused ))
 static void init_proc_7455 (CPUPPCState *env)
@@ -3834,20 +5636,185 @@ static void init_proc_7455 (CPUPPCState *env)
     gen_high_BATs(env);
     gen_74xx_soft_tlb(env, 128, 2);
     init_excp_7450(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
+}
+
+/* PowerPC 7457 (aka G4)                                                     */
+#define POWERPC_INSNS_7457   (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI |                    \
+                              PPC_CACHE_DCBA | PPC_CACHE_DCBZ |               \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_MEM_TLBIA | PPC_74xx_TLB |                  \
+                              PPC_SEGMENT | PPC_EXTERN |                      \
+                              PPC_ALTIVEC)
+#define POWERPC_MSRM_7457    (0x000000000205FF77ULL)
+#define POWERPC_MMU_7457     (POWERPC_MMU_SOFT_74xx)
+#define POWERPC_EXCP_7457    (POWERPC_EXCP_74xx)
+#define POWERPC_INPUT_7457   (PPC_FLAGS_INPUT_6xx)
+#define POWERPC_BFDM_7457    (bfd_mach_ppc_7400)
+#define POWERPC_FLAG_7457    (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+#define check_pow_7457       check_pow_hid0_74xx
+
+__attribute__ (( unused ))
+static void init_proc_7457 (CPUPPCState *env)
+{
+    gen_spr_ne_601(env);
+    gen_spr_7xx(env);
+    /* Time base */
+    gen_tbl(env);
+    /* 74xx specific SPR */
+    gen_spr_74xx(env);
+    /* Level 3 cache control */
+    gen_l3_ctrl(env);
+    /* L3ITCR1 */
+    /* XXX : not implemented */
+    spr_register(env, SPR_L3ITCR1, "L3ITCR1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* L3ITCR2 */
+    /* XXX : not implemented */
+    spr_register(env, SPR_L3ITCR2, "L3ITCR2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* L3ITCR3 */
+    /* XXX : not implemented */
+    spr_register(env, SPR_L3ITCR3, "L3ITCR3",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* L3OHCR */
+    /* XXX : not implemented */
+    spr_register(env, SPR_L3OHCR, "L3OHCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* LDSTCR */
+    /* XXX : not implemented */
+    spr_register(env, SPR_LDSTCR, "LDSTCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* ICTRL */
+    /* XXX : not implemented */
+    spr_register(env, SPR_ICTRL, "ICTRL",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* MSSSR0 */
+    /* XXX : not implemented */
+    spr_register(env, SPR_MSSSR0, "MSSSR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* PMC */
+    /* XXX : not implemented */
+    spr_register(env, SPR_PMC5, "PMC5",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_UPMC5, "UPMC5",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_PMC6, "PMC6",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_UPMC6, "UPMC6",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    /* SPRGs */
+    spr_register(env, SPR_SPRG4, "SPRG4",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_USPRG4, "USPRG4",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_SPRG5, "SPRG5",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_USPRG5, "USPRG5",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_SPRG6, "SPRG6",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_USPRG6, "USPRG6",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    spr_register(env, SPR_SPRG7, "SPRG7",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_USPRG7, "USPRG7",
+                 &spr_read_ureg, SPR_NOACCESS,
+                 &spr_read_ureg, SPR_NOACCESS,
+                 0x00000000);
+    /* Memory management */
+    gen_low_BATs(env);
+    gen_high_BATs(env);
+    gen_74xx_soft_tlb(env, 128, 2);
+    init_excp_7450(env);
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
     ppc6xx_irq_init(env);
 }
 
 #if defined (TARGET_PPC64)
 /* PowerPC 970                                                               */
-#define POWERPC_INSNS_970    (POWERPC_INSNS_WORKS | PPC_FLOAT_FSQRT |         \
+#define POWERPC_INSNS_970    (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZT |  \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
                               PPC_64B | PPC_ALTIVEC |                         \
-                              PPC_64_BRIDGE | PPC_SLBI)
+                              PPC_SEGMENT_64B | PPC_SLBI)
 #define POWERPC_MSRM_970     (0x900000000204FF36ULL)
-#define POWERPC_MMU_970      (POWERPC_MMU_64BRIDGE)
+#define POWERPC_MMU_970      (POWERPC_MMU_64B)
 //#define POWERPC_EXCP_970     (POWERPC_EXCP_970)
 #define POWERPC_INPUT_970    (PPC_FLAGS_INPUT_970)
 #define POWERPC_BFDM_970     (bfd_mach_ppc64)
+#define POWERPC_FLAG_970     (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+
+#if defined(CONFIG_USER_ONLY)
+#define POWERPC970_HID5_INIT 0x00000080
+#else
+#define POWERPC970_HID5_INIT 0x00000000
+#endif
+
+static int check_pow_970 (CPUPPCState *env)
+{
+    if (env->spr[SPR_HID0] & 0x00600000)
+        return 1;
+
+    return 0;
+}
 
 static void init_proc_970 (CPUPPCState *env)
 {
@@ -3859,38 +5826,81 @@ static void init_proc_970 (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
                  SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_clear,
+                 0x60000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
+                 SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_HID1, "HID1",
+    spr_register(env, SPR_750FX_HID2, "HID2",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_750_HID2, "HID2",
+    spr_register(env, SPR_970_HID5, "HID5",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 POWERPC970_HID5_INIT);
+    /* XXX : not implemented */
+    spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
     /* XXX: not correct */
     gen_low_BATs(env);
-#if 0 // TODO
+    /* XXX : not implemented */
+    spr_register(env, SPR_MMUCFG, "MMUCFG",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 0x00000000); /* TOFIX */
+    /* XXX : not implemented */
+    spr_register(env, SPR_MMUCSR0, "MMUCSR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000); /* TOFIX */
+    spr_register(env, SPR_HIOR, "SPR_HIOR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0xFFF00000); /* XXX: This is a hack */
+#if !defined(CONFIG_USER_ONLY)
     env->slb_nr = 32;
 #endif
     init_excp_970(env);
+    env->dcache_line_size = 128;
+    env->icache_line_size = 128;
     /* Allocate hardware IRQ controller */
     ppc970_irq_init(env);
 }
 
 /* PowerPC 970FX (aka G5)                                                    */
-#define POWERPC_INSNS_970FX  (POWERPC_INSNS_WORKS | PPC_FLOAT_FSQRT |         \
+#define POWERPC_INSNS_970FX  (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZT |  \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
                               PPC_64B | PPC_ALTIVEC |                         \
-                              PPC_64_BRIDGE | PPC_SLBI)
+                              PPC_SEGMENT_64B | PPC_SLBI)
 #define POWERPC_MSRM_970FX   (0x800000000204FF36ULL)
-#define POWERPC_MMU_970FX    (POWERPC_MMU_64BRIDGE)
+#define POWERPC_MMU_970FX    (POWERPC_MMU_64B)
 #define POWERPC_EXCP_970FX   (POWERPC_EXCP_970)
 #define POWERPC_INPUT_970FX  (PPC_FLAGS_INPUT_970)
 #define POWERPC_BFDM_970FX   (bfd_mach_ppc64)
+#define POWERPC_FLAG_970FX   (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+
+static int check_pow_970FX (CPUPPCState *env)
+{
+    if (env->spr[SPR_HID0] & 0x00600000)
+        return 1;
+
+    return 0;
+}
 
 static void init_proc_970FX (CPUPPCState *env)
 {
@@ -3902,38 +5912,81 @@ static void init_proc_970FX (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
                  SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_clear,
+                 0x60000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
+                 SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_HID1, "HID1",
+    spr_register(env, SPR_750FX_HID2, "HID2",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_750_HID2, "HID2",
+    spr_register(env, SPR_970_HID5, "HID5",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 POWERPC970_HID5_INIT);
+    /* XXX : not implemented */
+    spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
     /* XXX: not correct */
     gen_low_BATs(env);
-#if 0 // TODO
+    /* XXX : not implemented */
+    spr_register(env, SPR_MMUCFG, "MMUCFG",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 0x00000000); /* TOFIX */
+    /* XXX : not implemented */
+    spr_register(env, SPR_MMUCSR0, "MMUCSR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000); /* TOFIX */
+    spr_register(env, SPR_HIOR, "SPR_HIOR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0xFFF00000); /* XXX: This is a hack */
+#if !defined(CONFIG_USER_ONLY)
     env->slb_nr = 32;
 #endif
     init_excp_970(env);
+    env->dcache_line_size = 128;
+    env->icache_line_size = 128;
     /* Allocate hardware IRQ controller */
     ppc970_irq_init(env);
 }
 
 /* PowerPC 970 GX                                                            */
-#define POWERPC_INSNS_970GX  (POWERPC_INSNS_WORKS | PPC_FLOAT_FSQRT |         \
+#define POWERPC_INSNS_970GX  (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZT |  \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
                               PPC_64B | PPC_ALTIVEC |                         \
-                              PPC_64_BRIDGE | PPC_SLBI)
+                              PPC_SEGMENT_64B | PPC_SLBI)
 #define POWERPC_MSRM_970GX   (0x800000000204FF36ULL)
-#define POWERPC_MMU_970GX    (POWERPC_MMU_64BRIDGE)
+#define POWERPC_MMU_970GX    (POWERPC_MMU_64B)
 #define POWERPC_EXCP_970GX   (POWERPC_EXCP_970)
 #define POWERPC_INPUT_970GX  (PPC_FLAGS_INPUT_970)
 #define POWERPC_BFDM_970GX   (bfd_mach_ppc64)
+#define POWERPC_FLAG_970GX   (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+
+static int check_pow_970GX (CPUPPCState *env)
+{
+    if (env->spr[SPR_HID0] & 0x00600000)
+        return 1;
+
+    return 0;
+}
 
 static void init_proc_970GX (CPUPPCState *env)
 {
@@ -3945,37 +5998,159 @@ static void init_proc_970GX (CPUPPCState *env)
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
                  SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_clear,
+                 0x60000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID1, "HID1",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_750FX_HID2, "HID2",
+                 SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
+    spr_register(env, SPR_970_HID5, "HID5",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 POWERPC970_HID5_INIT);
+    /* XXX : not implemented */
+    spr_register(env, SPR_L2CR, "L2CR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Memory management */
+    /* XXX: not correct */
+    gen_low_BATs(env);
+    /* XXX : not implemented */
+    spr_register(env, SPR_MMUCFG, "MMUCFG",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 0x00000000); /* TOFIX */
+    /* XXX : not implemented */
+    spr_register(env, SPR_MMUCSR0, "MMUCSR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000); /* TOFIX */
+    spr_register(env, SPR_HIOR, "SPR_HIOR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0xFFF00000); /* XXX: This is a hack */
+#if !defined(CONFIG_USER_ONLY)
+    env->slb_nr = 32;
+#endif
+    init_excp_970(env);
+    env->dcache_line_size = 128;
+    env->icache_line_size = 128;
+    /* Allocate hardware IRQ controller */
+    ppc970_irq_init(env);
+}
+
+/* PowerPC 970 MP                                                            */
+#define POWERPC_INSNS_970MP  (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZT |  \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_64B | PPC_ALTIVEC |                         \
+                              PPC_SEGMENT_64B | PPC_SLBI)
+#define POWERPC_MSRM_970MP   (0x900000000204FF36ULL)
+#define POWERPC_MMU_970MP    (POWERPC_MMU_64B)
+#define POWERPC_EXCP_970MP   (POWERPC_EXCP_970)
+#define POWERPC_INPUT_970MP  (PPC_FLAGS_INPUT_970)
+#define POWERPC_BFDM_970MP   (bfd_mach_ppc64)
+#define POWERPC_FLAG_970MP   (POWERPC_FLAG_VRE | POWERPC_FLAG_SE |            \
+                              POWERPC_FLAG_BE | POWERPC_FLAG_PMM |            \
+                              POWERPC_FLAG_BUS_CLK)
+
+static int check_pow_970MP (CPUPPCState *env)
+{
+    if (env->spr[SPR_HID0] & 0x01C00000)
+        return 1;
+
+    return 0;
+}
+
+static void init_proc_970MP (CPUPPCState *env)
+{
+    gen_spr_ne_601(env);
+    gen_spr_7xx(env);
+    /* Time base */
+    gen_tbl(env);
+    /* Hardware implementation registers */
+    /* XXX : not implemented */
+    spr_register(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_clear,
+                 0x60000000);
+    /* XXX : not implemented */
     spr_register(env, SPR_HID1, "HID1",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* XXX : not implemented */
-    spr_register(env, SPR_750_HID2, "HID2",
+    spr_register(env, SPR_750FX_HID2, "HID2",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* XXX : not implemented */
+    spr_register(env, SPR_970_HID5, "HID5",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 POWERPC970_HID5_INIT);
+    /* XXX : not implemented */
+    spr_register(env, SPR_L2CR, "L2CR",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
     /* Memory management */
     /* XXX: not correct */
     gen_low_BATs(env);
-#if 0 // TODO
+    /* XXX : not implemented */
+    spr_register(env, SPR_MMUCFG, "MMUCFG",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 0x00000000); /* TOFIX */
+    /* XXX : not implemented */
+    spr_register(env, SPR_MMUCSR0, "MMUCSR0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000); /* TOFIX */
+    spr_register(env, SPR_HIOR, "SPR_HIOR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0xFFF00000); /* XXX: This is a hack */
+#if !defined(CONFIG_USER_ONLY)
     env->slb_nr = 32;
 #endif
     init_excp_970(env);
+    env->dcache_line_size = 128;
+    env->icache_line_size = 128;
     /* Allocate hardware IRQ controller */
     ppc970_irq_init(env);
 }
 
 /* PowerPC 620                                                               */
-#define POWERPC_INSNS_620    (POWERPC_INSNS_WORKS | PPC_FLOAT_FSQRT |         \
+#define POWERPC_INSNS_620    (PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |        \
+                              PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |   \
+                              PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |           \
+                              PPC_FLOAT_STFIWX |                              \
+                              PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |   \
+                              PPC_MEM_SYNC | PPC_MEM_EIEIO |                  \
+                              PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |               \
+                              PPC_SEGMENT | PPC_EXTERN |                      \
                               PPC_64B | PPC_SLBI)
-#define POWERPC_MSRM_620     (0x800000000005FF73ULL)
-#define POWERPC_MMU_620      (POWERPC_MMU_64B)
+#define POWERPC_MSRM_620     (0x800000000005FF77ULL)
+//#define POWERPC_MMU_620      (POWERPC_MMU_620)
 #define POWERPC_EXCP_620     (POWERPC_EXCP_970)
-#define POWERPC_INPUT_620    (PPC_FLAGS_INPUT_970)
+#define POWERPC_INPUT_620    (PPC_FLAGS_INPUT_6xx)
 #define POWERPC_BFDM_620     (bfd_mach_ppc64)
+#define POWERPC_FLAG_620     (POWERPC_FLAG_SE | POWERPC_FLAG_BE |            \
+                              POWERPC_FLAG_PMM | POWERPC_FLAG_BUS_CLK)
+#define check_pow_620        check_pow_nocheck /* Check this */
 
 __attribute__ (( unused ))
 static void init_proc_620 (CPUPPCState *env)
@@ -3992,9 +6167,11 @@ static void init_proc_620 (CPUPPCState *env)
                  0x00000000);
     /* Memory management */
     gen_low_BATs(env);
-    gen_high_BATs(env);
     init_excp_620(env);
-    /* XXX: TODO: initialize internal interrupt controller */
+    env->dcache_line_size = 64;
+    env->icache_line_size = 64;
+    /* Allocate hardware IRQ controller */
+    ppc6xx_irq_init(env);
 }
 #endif /* defined (TARGET_PPC64) */
 
@@ -4005,8 +6182,10 @@ static void init_proc_620 (CPUPPCState *env)
 #define POWERPC_MMU_PPC32     POWERPC_MMU_604
 #define POWERPC_EXCP_PPC32    POWERPC_EXCP_604
 #define POWERPC_INPUT_PPC32   POWERPC_INPUT_604
-#define init_proc_PPC32       init_proc_604
 #define POWERPC_BFDM_PPC32    POWERPC_BFDM_604
+#define POWERPC_FLAG_PPC32    POWERPC_FLAG_604
+#define check_pow_PPC32       check_pow_604
+#define init_proc_PPC32       init_proc_604
 
 /* Default 64 bits PowerPC target will be 970 FX */
 #define CPU_POWERPC_PPC64     CPU_POWERPC_970FX
@@ -4015,8 +6194,10 @@ static void init_proc_620 (CPUPPCState *env)
 #define POWERPC_MMU_PPC64     POWERPC_MMU_970FX
 #define POWERPC_EXCP_PPC64    POWERPC_EXCP_970FX
 #define POWERPC_INPUT_PPC64   POWERPC_INPUT_970FX
-#define init_proc_PPC64       init_proc_970FX
 #define POWERPC_BFDM_PPC64    POWERPC_BFDM_970FX
+#define POWERPC_FLAG_PPC64    POWERPC_FLAG_970FX
+#define check_pow_PPC64       check_pow_970FX
+#define init_proc_PPC64       init_proc_970FX
 
 /* Default PowerPC target will be PowerPC 32 */
 #if defined (TARGET_PPC64) && 0 // XXX: TODO
@@ -4026,8 +6207,10 @@ static void init_proc_620 (CPUPPCState *env)
 #define POWERPC_MMU_DEFAULT   POWERPC_MMU_PPC64
 #define POWERPC_EXCP_DEFAULT  POWERPC_EXCP_PPC64
 #define POWERPC_INPUT_DEFAULT POWERPC_INPUT_PPC64
-#define init_proc_DEFAULT     init_proc_PPC64
 #define POWERPC_BFDM_DEFAULT  POWERPC_BFDM_PPC64
+#define POWERPC_FLAG_DEFAULT  POWERPC_FLAG_PPC64
+#define check_pow_DEFAULT     check_pow_PPC64
+#define init_proc_DEFAULT     init_proc_PPC64
 #else
 #define CPU_POWERPC_DEFAULT   CPU_POWERPC_PPC32
 #define POWERPC_INSNS_DEFAULT POWERPC_INSNS_PPC32
@@ -4035,8 +6218,10 @@ static void init_proc_620 (CPUPPCState *env)
 #define POWERPC_MMU_DEFAULT   POWERPC_MMU_PPC32
 #define POWERPC_EXCP_DEFAULT  POWERPC_EXCP_PPC32
 #define POWERPC_INPUT_DEFAULT POWERPC_INPUT_PPC32
-#define init_proc_DEFAULT     init_proc_PPC32
 #define POWERPC_BFDM_DEFAULT  POWERPC_BFDM_PPC32
+#define POWERPC_FLAG_DEFAULT  POWERPC_FLAG_PPC32
+#define check_pow_DEFAULT     check_pow_PPC32
+#define init_proc_DEFAULT     init_proc_PPC32
 #endif
 
 /*****************************************************************************/
@@ -4044,1382 +6229,2465 @@ static void init_proc_620 (CPUPPCState *env)
 enum {
     /* PowerPC 401 family */
     /* Generic PowerPC 401 */
-#define CPU_POWERPC_401       CPU_POWERPC_401G2
+#define CPU_POWERPC_401              CPU_POWERPC_401G2
     /* PowerPC 401 cores */
-    CPU_POWERPC_401A1       = 0x00210000,
-    CPU_POWERPC_401B2       = 0x00220000,
+    CPU_POWERPC_401A1              = 0x00210000,
+    CPU_POWERPC_401B2              = 0x00220000,
 #if 0
-    CPU_POWERPC_401B3       = xxx,
+    CPU_POWERPC_401B3              = xxx,
 #endif
-    CPU_POWERPC_401C2       = 0x00230000,
-    CPU_POWERPC_401D2       = 0x00240000,
-    CPU_POWERPC_401E2       = 0x00250000,
-    CPU_POWERPC_401F2       = 0x00260000,
-    CPU_POWERPC_401G2       = 0x00270000,
+    CPU_POWERPC_401C2              = 0x00230000,
+    CPU_POWERPC_401D2              = 0x00240000,
+    CPU_POWERPC_401E2              = 0x00250000,
+    CPU_POWERPC_401F2              = 0x00260000,
+    CPU_POWERPC_401G2              = 0x00270000,
     /* PowerPC 401 microcontrolers */
 #if 0
-    CPU_POWERPC_401GF       = xxx,
+    CPU_POWERPC_401GF              = xxx,
 #endif
-#define CPU_POWERPC_IOP480    CPU_POWERPC_401B2
+#define CPU_POWERPC_IOP480           CPU_POWERPC_401B2
     /* IBM Processor for Network Resources */
-    CPU_POWERPC_COBRA       = 0x10100000, /* XXX: 405 ? */
+    CPU_POWERPC_COBRA              = 0x10100000, /* XXX: 405 ? */
 #if 0
-    CPU_POWERPC_XIPCHIP     = xxx,
+    CPU_POWERPC_XIPCHIP            = xxx,
 #endif
     /* PowerPC 403 family */
     /* Generic PowerPC 403 */
-#define CPU_POWERPC_403       CPU_POWERPC_403GC
+#define CPU_POWERPC_403              CPU_POWERPC_403GC
     /* PowerPC 403 microcontrollers */
-    CPU_POWERPC_403GA       = 0x00200011,
-    CPU_POWERPC_403GB       = 0x00200100,
-    CPU_POWERPC_403GC       = 0x00200200,
-    CPU_POWERPC_403GCX      = 0x00201400,
+    CPU_POWERPC_403GA              = 0x00200011,
+    CPU_POWERPC_403GB              = 0x00200100,
+    CPU_POWERPC_403GC              = 0x00200200,
+    CPU_POWERPC_403GCX             = 0x00201400,
 #if 0
-    CPU_POWERPC_403GP       = xxx,
+    CPU_POWERPC_403GP              = xxx,
 #endif
     /* PowerPC 405 family */
     /* Generic PowerPC 405 */
-#define CPU_POWERPC_405       CPU_POWERPC_405D4
+#define CPU_POWERPC_405              CPU_POWERPC_405D4
     /* PowerPC 405 cores */
 #if 0
-    CPU_POWERPC_405A3       = xxx,
+    CPU_POWERPC_405A3              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405A4       = xxx,
+    CPU_POWERPC_405A4              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405B3       = xxx,
+    CPU_POWERPC_405B3              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405B4       = xxx,
+    CPU_POWERPC_405B4              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405C3       = xxx,
+    CPU_POWERPC_405C3              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405C4       = xxx,
+    CPU_POWERPC_405C4              = xxx,
 #endif
-    CPU_POWERPC_405D2       = 0x20010000,
+    CPU_POWERPC_405D2              = 0x20010000,
 #if 0
-    CPU_POWERPC_405D3       = xxx,
+    CPU_POWERPC_405D3              = xxx,
 #endif
-    CPU_POWERPC_405D4       = 0x41810000,
+    CPU_POWERPC_405D4              = 0x41810000,
 #if 0
-    CPU_POWERPC_405D5       = xxx,
+    CPU_POWERPC_405D5              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405E4       = xxx,
+    CPU_POWERPC_405E4              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405F4       = xxx,
+    CPU_POWERPC_405F4              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405F5       = xxx,
+    CPU_POWERPC_405F5              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405F6       = xxx,
+    CPU_POWERPC_405F6              = xxx,
 #endif
     /* PowerPC 405 microcontrolers */
     /* XXX: missing 0x200108a0 */
-#define CPU_POWERPC_405CR     CPU_POWERPC_405CRc
-    CPU_POWERPC_405CRa      = 0x40110041,
-    CPU_POWERPC_405CRb      = 0x401100C5,
-    CPU_POWERPC_405CRc      = 0x40110145,
-    CPU_POWERPC_405EP       = 0x51210950,
+#define CPU_POWERPC_405CR            CPU_POWERPC_405CRc
+    CPU_POWERPC_405CRa             = 0x40110041,
+    CPU_POWERPC_405CRb             = 0x401100C5,
+    CPU_POWERPC_405CRc             = 0x40110145,
+    CPU_POWERPC_405EP              = 0x51210950,
 #if 0
-    CPU_POWERPC_405EXr      = xxx,
+    CPU_POWERPC_405EXr             = xxx,
 #endif
-    CPU_POWERPC_405EZ       = 0x41511460, /* 0x51210950 ? */
+    CPU_POWERPC_405EZ              = 0x41511460, /* 0x51210950 ? */
 #if 0
-    CPU_POWERPC_405FX       = xxx,
-#endif
-#define CPU_POWERPC_405GP     CPU_POWERPC_405GPd
-    CPU_POWERPC_405GPa      = 0x40110000,
-    CPU_POWERPC_405GPb      = 0x40110040,
-    CPU_POWERPC_405GPc      = 0x40110082,
-    CPU_POWERPC_405GPd      = 0x401100C4,
-#define CPU_POWERPC_405GPe    CPU_POWERPC_405CRc
-    CPU_POWERPC_405GPR      = 0x50910951,
+    CPU_POWERPC_405FX              = xxx,
+#endif
+#define CPU_POWERPC_405GP            CPU_POWERPC_405GPd
+    CPU_POWERPC_405GPa             = 0x40110000,
+    CPU_POWERPC_405GPb             = 0x40110040,
+    CPU_POWERPC_405GPc             = 0x40110082,
+    CPU_POWERPC_405GPd             = 0x401100C4,
+#define CPU_POWERPC_405GPe           CPU_POWERPC_405CRc
+    CPU_POWERPC_405GPR             = 0x50910951,
 #if 0
-    CPU_POWERPC_405H        = xxx,
+    CPU_POWERPC_405H               = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405L        = xxx,
+    CPU_POWERPC_405L               = xxx,
 #endif
-    CPU_POWERPC_405LP       = 0x41F10000,
+    CPU_POWERPC_405LP              = 0x41F10000,
 #if 0
-    CPU_POWERPC_405PM       = xxx,
+    CPU_POWERPC_405PM              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405PS       = xxx,
+    CPU_POWERPC_405PS              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_405S        = xxx,
+    CPU_POWERPC_405S               = xxx,
 #endif
     /* IBM network processors */
-    CPU_POWERPC_NPE405H     = 0x414100C0,
-    CPU_POWERPC_NPE405H2    = 0x41410140,
-    CPU_POWERPC_NPE405L     = 0x416100C0,
-    CPU_POWERPC_NPE4GS3     = 0x40B10000,
+    CPU_POWERPC_NPE405H            = 0x414100C0,
+    CPU_POWERPC_NPE405H2           = 0x41410140,
+    CPU_POWERPC_NPE405L            = 0x416100C0,
+    CPU_POWERPC_NPE4GS3            = 0x40B10000,
 #if 0
-    CPU_POWERPC_NPCxx1      = xxx,
+    CPU_POWERPC_NPCxx1             = xxx,
 #endif
 #if 0
-    CPU_POWERPC_NPR161      = xxx,
+    CPU_POWERPC_NPR161             = xxx,
 #endif
 #if 0
-    CPU_POWERPC_LC77700     = xxx,
+    CPU_POWERPC_LC77700            = xxx,
 #endif
     /* IBM STBxxx (PowerPC 401/403/405 core based microcontrollers) */
 #if 0
-    CPU_POWERPC_STB01000    = xxx,
+    CPU_POWERPC_STB01000           = xxx,
 #endif
 #if 0
-    CPU_POWERPC_STB01010    = xxx,
+    CPU_POWERPC_STB01010           = xxx,
 #endif
 #if 0
-    CPU_POWERPC_STB0210     = xxx, /* 401B3 */
+    CPU_POWERPC_STB0210            = xxx, /* 401B3 */
 #endif
-    CPU_POWERPC_STB03       = 0x40310000, /* 0x40130000 ? */
+    CPU_POWERPC_STB03              = 0x40310000, /* 0x40130000 ? */
 #if 0
-    CPU_POWERPC_STB043      = xxx,
+    CPU_POWERPC_STB043             = xxx,
 #endif
 #if 0
-    CPU_POWERPC_STB045      = xxx,
+    CPU_POWERPC_STB045             = xxx,
 #endif
-    CPU_POWERPC_STB04       = 0x41810000,
-    CPU_POWERPC_STB25       = 0x51510950,
+    CPU_POWERPC_STB04              = 0x41810000,
+    CPU_POWERPC_STB25              = 0x51510950,
 #if 0
-    CPU_POWERPC_STB130      = xxx,
+    CPU_POWERPC_STB130             = xxx,
 #endif
     /* Xilinx cores */
-    CPU_POWERPC_X2VP4       = 0x20010820,
-#define CPU_POWERPC_X2VP7     CPU_POWERPC_X2VP4
-    CPU_POWERPC_X2VP20      = 0x20010860,
-#define CPU_POWERPC_X2VP50    CPU_POWERPC_X2VP20
+    CPU_POWERPC_X2VP4              = 0x20010820,
+#define CPU_POWERPC_X2VP7            CPU_POWERPC_X2VP4
+    CPU_POWERPC_X2VP20             = 0x20010860,
+#define CPU_POWERPC_X2VP50           CPU_POWERPC_X2VP20
 #if 0
-    CPU_POWERPC_ZL10310     = xxx,
+    CPU_POWERPC_ZL10310            = xxx,
 #endif
 #if 0
-    CPU_POWERPC_ZL10311     = xxx,
+    CPU_POWERPC_ZL10311            = xxx,
 #endif
 #if 0
-    CPU_POWERPC_ZL10320     = xxx,
+    CPU_POWERPC_ZL10320            = xxx,
 #endif
 #if 0
-    CPU_POWERPC_ZL10321     = xxx,
+    CPU_POWERPC_ZL10321            = xxx,
 #endif
     /* PowerPC 440 family */
     /* Generic PowerPC 440 */
-#define CPU_POWERPC_440       CPU_POWERPC_440GXf
+#define CPU_POWERPC_440              CPU_POWERPC_440GXf
     /* PowerPC 440 cores */
 #if 0
-    CPU_POWERPC_440A4       = xxx,
+    CPU_POWERPC_440A4              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_440A5       = xxx,
+    CPU_POWERPC_440A5              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_440B4       = xxx,
+    CPU_POWERPC_440B4              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_440F5       = xxx,
+    CPU_POWERPC_440F5              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_440G5       = xxx,
+    CPU_POWERPC_440G5              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_440H4       = xxx,
+    CPU_POWERPC_440H4              = xxx,
 #endif
 #if 0
-    CPU_POWERPC_440H6       = xxx,
+    CPU_POWERPC_440H6              = xxx,
 #endif
     /* PowerPC 440 microcontrolers */
-#define CPU_POWERPC_440EP     CPU_POWERPC_440EPb
-    CPU_POWERPC_440EPa      = 0x42221850,
-    CPU_POWERPC_440EPb      = 0x422218D3,
-#define CPU_POWERPC_440GP     CPU_POWERPC_440GPc
-    CPU_POWERPC_440GPb      = 0x40120440,
-    CPU_POWERPC_440GPc      = 0x40120481,
-#define CPU_POWERPC_440GR     CPU_POWERPC_440GRa
-#define CPU_POWERPC_440GRa    CPU_POWERPC_440EPb
-    CPU_POWERPC_440GRX      = 0x200008D0,
-#define CPU_POWERPC_440EPX    CPU_POWERPC_440GRX
-#define CPU_POWERPC_440GX     CPU_POWERPC_440GXf
-    CPU_POWERPC_440GXa      = 0x51B21850,
-    CPU_POWERPC_440GXb      = 0x51B21851,
-    CPU_POWERPC_440GXc      = 0x51B21892,
-    CPU_POWERPC_440GXf      = 0x51B21894,
+#define CPU_POWERPC_440EP            CPU_POWERPC_440EPb
+    CPU_POWERPC_440EPa             = 0x42221850,
+    CPU_POWERPC_440EPb             = 0x422218D3,
+#define CPU_POWERPC_440GP            CPU_POWERPC_440GPc
+    CPU_POWERPC_440GPb             = 0x40120440,
+    CPU_POWERPC_440GPc             = 0x40120481,
+#define CPU_POWERPC_440GR            CPU_POWERPC_440GRa
+#define CPU_POWERPC_440GRa           CPU_POWERPC_440EPb
+    CPU_POWERPC_440GRX             = 0x200008D0,
+#define CPU_POWERPC_440EPX           CPU_POWERPC_440GRX
+#define CPU_POWERPC_440GX            CPU_POWERPC_440GXf
+    CPU_POWERPC_440GXa             = 0x51B21850,
+    CPU_POWERPC_440GXb             = 0x51B21851,
+    CPU_POWERPC_440GXc             = 0x51B21892,
+    CPU_POWERPC_440GXf             = 0x51B21894,
 #if 0
-    CPU_POWERPC_440S        = xxx,
+    CPU_POWERPC_440S               = xxx,
 #endif
-    CPU_POWERPC_440SP       = 0x53221850,
-    CPU_POWERPC_440SP2      = 0x53221891,
-    CPU_POWERPC_440SPE      = 0x53421890,
+    CPU_POWERPC_440SP              = 0x53221850,
+    CPU_POWERPC_440SP2             = 0x53221891,
+    CPU_POWERPC_440SPE             = 0x53421890,
     /* PowerPC 460 family */
 #if 0
     /* Generic PowerPC 464 */
-#define CPU_POWERPC_464       CPU_POWERPC_464H90
+#define CPU_POWERPC_464              CPU_POWERPC_464H90
 #endif
     /* PowerPC 464 microcontrolers */
 #if 0
-    CPU_POWERPC_464H90      = xxx,
+    CPU_POWERPC_464H90             = xxx,
 #endif
 #if 0
-    CPU_POWERPC_464H90FP    = xxx,
+    CPU_POWERPC_464H90FP           = xxx,
 #endif
     /* Freescale embedded PowerPC cores */
+    /* PowerPC MPC 5xx cores (aka RCPU) */
+    CPU_POWERPC_MPC5xx             = 0x00020020,
+#define CPU_POWERPC_MGT560           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC509           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC533           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC534           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC555           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC556           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC560           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC561           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC562           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC563           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC564           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC565           CPU_POWERPC_MPC5xx
+#define CPU_POWERPC_MPC566           CPU_POWERPC_MPC5xx
+    /* PowerPC MPC 8xx cores (aka PowerQUICC) */
+    CPU_POWERPC_MPC8xx             = 0x00500000,
+#define CPU_POWERPC_MGT823           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC821           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC823           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC850           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC852T          CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC855T          CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC857           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC859           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC860           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC862           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC866           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC870           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC875           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC880           CPU_POWERPC_MPC8xx
+#define CPU_POWERPC_MPC885           CPU_POWERPC_MPC8xx
+    /* G2 cores (aka PowerQUICC-II) */
+    CPU_POWERPC_G2                 = 0x00810011,
+    CPU_POWERPC_G2H4               = 0x80811010,
+    CPU_POWERPC_G2gp               = 0x80821010,
+    CPU_POWERPC_G2ls               = 0x90810010,
+    CPU_POWERPC_MPC603             = 0x00810100,
+    CPU_POWERPC_G2_HIP3            = 0x00810101,
+    CPU_POWERPC_G2_HIP4            = 0x80811014,
+    /*   G2_LE core (aka PowerQUICC-II) */
+    CPU_POWERPC_G2LE               = 0x80820010,
+    CPU_POWERPC_G2LEgp             = 0x80822010,
+    CPU_POWERPC_G2LEls             = 0xA0822010,
+    CPU_POWERPC_G2LEgp1            = 0x80822011,
+    CPU_POWERPC_G2LEgp3            = 0x80822013,
+    /* MPC52xx microcontrollers  */
+    /* XXX: MPC 5121 ? */
+#define CPU_POWERPC_MPC52xx          CPU_POWERPC_MPC5200
+#define CPU_POWERPC_MPC5200          CPU_POWERPC_MPC5200_v12
+#define CPU_POWERPC_MPC5200_v10      CPU_POWERPC_G2LEgp1
+#define CPU_POWERPC_MPC5200_v11      CPU_POWERPC_G2LEgp1
+#define CPU_POWERPC_MPC5200_v12      CPU_POWERPC_G2LEgp1
+#define CPU_POWERPC_MPC5200B         CPU_POWERPC_MPC5200B_v21
+#define CPU_POWERPC_MPC5200B_v20     CPU_POWERPC_G2LEgp1
+#define CPU_POWERPC_MPC5200B_v21     CPU_POWERPC_G2LEgp1
+    /* MPC82xx microcontrollers */
+#define CPU_POWERPC_MPC82xx          CPU_POWERPC_MPC8280
+#define CPU_POWERPC_MPC8240          CPU_POWERPC_MPC603
+#define CPU_POWERPC_MPC8241          CPU_POWERPC_G2_HIP4
+#define CPU_POWERPC_MPC8245          CPU_POWERPC_G2_HIP4
+#define CPU_POWERPC_MPC8247          CPU_POWERPC_G2LEgp3
+#define CPU_POWERPC_MPC8248          CPU_POWERPC_G2LEgp3
+#define CPU_POWERPC_MPC8250          CPU_POWERPC_MPC8250_HiP4
+#define CPU_POWERPC_MPC8250_HiP3     CPU_POWERPC_G2_HIP3
+#define CPU_POWERPC_MPC8250_HiP4     CPU_POWERPC_G2_HIP4
+#define CPU_POWERPC_MPC8255          CPU_POWERPC_MPC8255_HiP4
+#define CPU_POWERPC_MPC8255_HiP3     CPU_POWERPC_G2_HIP3
+#define CPU_POWERPC_MPC8255_HiP4     CPU_POWERPC_G2_HIP4
+#define CPU_POWERPC_MPC8260          CPU_POWERPC_MPC8260_HiP4
+#define CPU_POWERPC_MPC8260_HiP3     CPU_POWERPC_G2_HIP3
+#define CPU_POWERPC_MPC8260_HiP4     CPU_POWERPC_G2_HIP4
+#define CPU_POWERPC_MPC8264          CPU_POWERPC_MPC8264_HiP4
+#define CPU_POWERPC_MPC8264_HiP3     CPU_POWERPC_G2_HIP3
+#define CPU_POWERPC_MPC8264_HiP4     CPU_POWERPC_G2_HIP4
+#define CPU_POWERPC_MPC8265          CPU_POWERPC_MPC8265_HiP4
+#define CPU_POWERPC_MPC8265_HiP3     CPU_POWERPC_G2_HIP3
+#define CPU_POWERPC_MPC8265_HiP4     CPU_POWERPC_G2_HIP4
+#define CPU_POWERPC_MPC8266          CPU_POWERPC_MPC8266_HiP4
+#define CPU_POWERPC_MPC8266_HiP3     CPU_POWERPC_G2_HIP3
+#define CPU_POWERPC_MPC8266_HiP4     CPU_POWERPC_G2_HIP4
+#define CPU_POWERPC_MPC8270          CPU_POWERPC_G2LEgp3
+#define CPU_POWERPC_MPC8271          CPU_POWERPC_G2LEgp3
+#define CPU_POWERPC_MPC8272          CPU_POWERPC_G2LEgp3
+#define CPU_POWERPC_MPC8275          CPU_POWERPC_G2LEgp3
+#define CPU_POWERPC_MPC8280          CPU_POWERPC_G2LEgp3
     /* e200 family */
-#define CPU_POWERPC_e200      CPU_POWERPC_e200z6
+    /* e200 cores */
+#define CPU_POWERPC_e200             CPU_POWERPC_e200z6
 #if 0
-    CPU_POWERPC_e200z0      = xxx,
+    CPU_POWERPC_e200z0             = xxx,
 #endif
 #if 0
-    CPU_POWERPC_e200z3      = xxx,
+    CPU_POWERPC_e200z1             = xxx,
 #endif
-    CPU_POWERPC_e200z5      = 0x81000000,
-    CPU_POWERPC_e200z6      = 0x81120000,
-    /* e300 family */
-#define CPU_POWERPC_e300      CPU_POWERPC_e300c3
-    CPU_POWERPC_e300c1      = 0x00830000,
-    CPU_POWERPC_e300c2      = 0x00840000,
-    CPU_POWERPC_e300c3      = 0x00850000,
-    /* e500 family */
-#define CPU_POWERPC_e500      CPU_POWERPC_e500_v22
-    CPU_POWERPC_e500_v11    = 0x80200010,
-    CPU_POWERPC_e500_v12    = 0x80200020,
-    CPU_POWERPC_e500_v21    = 0x80210010,
-    CPU_POWERPC_e500_v22    = 0x80210020,
+#if 0 /* ? */
+    CPU_POWERPC_e200z3             = 0x81120000,
+#endif
+    CPU_POWERPC_e200z5             = 0x81000000,
+    CPU_POWERPC_e200z6             = 0x81120000,
+    /* MPC55xx microcontrollers */
+#define CPU_POWERPC_MPC55xx          CPU_POWERPC_MPC5567
 #if 0
-    CPU_POWERPC_e500mc      = xxx,
+#define CPU_POWERPC_MPC5514E         CPU_POWERPC_MPC5514E_v1
+#define CPU_POWERPC_MPC5514E_v0      CPU_POWERPC_e200z0
+#define CPU_POWERPC_MPC5514E_v1      CPU_POWERPC_e200z1
+#define CPU_POWERPC_MPC5514G         CPU_POWERPC_MPC5514G_v1
+#define CPU_POWERPC_MPC5514G_v0      CPU_POWERPC_e200z0
+#define CPU_POWERPC_MPC5514G_v1      CPU_POWERPC_e200z1
+#define CPU_POWERPC_MPC5515S         CPU_POWERPC_e200z1
+#define CPU_POWERPC_MPC5516E         CPU_POWERPC_MPC5516E_v1
+#define CPU_POWERPC_MPC5516E_v0      CPU_POWERPC_e200z0
+#define CPU_POWERPC_MPC5516E_v1      CPU_POWERPC_e200z1
+#define CPU_POWERPC_MPC5516G         CPU_POWERPC_MPC5516G_v1
+#define CPU_POWERPC_MPC5516G_v0      CPU_POWERPC_e200z0
+#define CPU_POWERPC_MPC5516G_v1      CPU_POWERPC_e200z1
+#define CPU_POWERPC_MPC5516S         CPU_POWERPC_e200z1
 #endif
+#if 0
+#define CPU_POWERPC_MPC5533          CPU_POWERPC_e200z3
+#define CPU_POWERPC_MPC5534          CPU_POWERPC_e200z3
+#endif
+#define CPU_POWERPC_MPC5553          CPU_POWERPC_e200z6
+#define CPU_POWERPC_MPC5554          CPU_POWERPC_e200z6
+#define CPU_POWERPC_MPC5561          CPU_POWERPC_e200z6
+#define CPU_POWERPC_MPC5565          CPU_POWERPC_e200z6
+#define CPU_POWERPC_MPC5566          CPU_POWERPC_e200z6
+#define CPU_POWERPC_MPC5567          CPU_POWERPC_e200z6
+    /* e300 family */
+    /* e300 cores */
+#define CPU_POWERPC_e300             CPU_POWERPC_e300c3
+    CPU_POWERPC_e300c1             = 0x00830010,
+    CPU_POWERPC_e300c2             = 0x00840010,
+    CPU_POWERPC_e300c3             = 0x00850010,
+    CPU_POWERPC_e300c4             = 0x00860010,
+    /* MPC83xx microcontrollers */
+#define CPU_POWERPC_MPC8313          CPU_POWERPC_e300c3
+#define CPU_POWERPC_MPC8313E         CPU_POWERPC_e300c3
+#define CPU_POWERPC_MPC8314          CPU_POWERPC_e300c3
+#define CPU_POWERPC_MPC8314E         CPU_POWERPC_e300c3
+#define CPU_POWERPC_MPC8315          CPU_POWERPC_e300c3
+#define CPU_POWERPC_MPC8315E         CPU_POWERPC_e300c3
+#define CPU_POWERPC_MPC8321          CPU_POWERPC_e300c2
+#define CPU_POWERPC_MPC8321E         CPU_POWERPC_e300c2
+#define CPU_POWERPC_MPC8323          CPU_POWERPC_e300c2
+#define CPU_POWERPC_MPC8323E         CPU_POWERPC_e300c2
+#define CPU_POWERPC_MPC8343A         CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8343EA        CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8347A         CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8347AT        CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8347AP        CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8347EA        CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8347EAT       CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8347EAP       CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8349          CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8349A         CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8349E         CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8349EA        CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8358E         CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8360E         CPU_POWERPC_e300c1
+#define CPU_POWERPC_MPC8377          CPU_POWERPC_e300c4
+#define CPU_POWERPC_MPC8377E         CPU_POWERPC_e300c4
+#define CPU_POWERPC_MPC8378          CPU_POWERPC_e300c4
+#define CPU_POWERPC_MPC8378E         CPU_POWERPC_e300c4
+#define CPU_POWERPC_MPC8379          CPU_POWERPC_e300c4
+#define CPU_POWERPC_MPC8379E         CPU_POWERPC_e300c4
+    /* e500 family */
+    /* e500 cores  */
+#define CPU_POWERPC_e500             CPU_POWERPC_e500v2_v22
+#define CPU_POWERPC_e500v2           CPU_POWERPC_e500v2_v22
+    CPU_POWERPC_e500_v10           = 0x80200010,
+    CPU_POWERPC_e500_v20           = 0x80200020,
+    CPU_POWERPC_e500v2_v10         = 0x80210010,
+    CPU_POWERPC_e500v2_v11         = 0x80210011,
+    CPU_POWERPC_e500v2_v20         = 0x80210020,
+    CPU_POWERPC_e500v2_v21         = 0x80210021,
+    CPU_POWERPC_e500v2_v22         = 0x80210022,
+    CPU_POWERPC_e500v2_v30         = 0x80210030,
+    /* MPC85xx microcontrollers */
+#define CPU_POWERPC_MPC8533          CPU_POWERPC_MPC8533_v11
+#define CPU_POWERPC_MPC8533_v10      CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8533_v11      CPU_POWERPC_e500v2_v22
+#define CPU_POWERPC_MPC8533E         CPU_POWERPC_MPC8533E_v11
+#define CPU_POWERPC_MPC8533E_v10     CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8533E_v11     CPU_POWERPC_e500v2_v22
+#define CPU_POWERPC_MPC8540          CPU_POWERPC_MPC8540_v21
+#define CPU_POWERPC_MPC8540_v10      CPU_POWERPC_e500_v10
+#define CPU_POWERPC_MPC8540_v20      CPU_POWERPC_e500_v20
+#define CPU_POWERPC_MPC8540_v21      CPU_POWERPC_e500_v20
+#define CPU_POWERPC_MPC8541          CPU_POWERPC_MPC8541_v11
+#define CPU_POWERPC_MPC8541_v10      CPU_POWERPC_e500_v20
+#define CPU_POWERPC_MPC8541_v11      CPU_POWERPC_e500_v20
+#define CPU_POWERPC_MPC8541E         CPU_POWERPC_MPC8541E_v11
+#define CPU_POWERPC_MPC8541E_v10     CPU_POWERPC_e500_v20
+#define CPU_POWERPC_MPC8541E_v11     CPU_POWERPC_e500_v20
+#define CPU_POWERPC_MPC8543          CPU_POWERPC_MPC8543_v21
+#define CPU_POWERPC_MPC8543_v10      CPU_POWERPC_e500v2_v10
+#define CPU_POWERPC_MPC8543_v11      CPU_POWERPC_e500v2_v11
+#define CPU_POWERPC_MPC8543_v20      CPU_POWERPC_e500v2_v20
+#define CPU_POWERPC_MPC8543_v21      CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8543E         CPU_POWERPC_MPC8543E_v21
+#define CPU_POWERPC_MPC8543E_v10     CPU_POWERPC_e500v2_v10
+#define CPU_POWERPC_MPC8543E_v11     CPU_POWERPC_e500v2_v11
+#define CPU_POWERPC_MPC8543E_v20     CPU_POWERPC_e500v2_v20
+#define CPU_POWERPC_MPC8543E_v21     CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8544          CPU_POWERPC_MPC8544_v11
+#define CPU_POWERPC_MPC8544_v10      CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8544_v11      CPU_POWERPC_e500v2_v22
+#define CPU_POWERPC_MPC8544E_v11     CPU_POWERPC_e500v2_v22
+#define CPU_POWERPC_MPC8544E         CPU_POWERPC_MPC8544E_v11
+#define CPU_POWERPC_MPC8544E_v10     CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8545          CPU_POWERPC_MPC8545_v21
+#define CPU_POWERPC_MPC8545_v10      CPU_POWERPC_e500v2_v10
+#define CPU_POWERPC_MPC8545_v20      CPU_POWERPC_e500v2_v20
+#define CPU_POWERPC_MPC8545_v21      CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8545E         CPU_POWERPC_MPC8545E_v21
+#define CPU_POWERPC_MPC8545E_v10     CPU_POWERPC_e500v2_v10
+#define CPU_POWERPC_MPC8545E_v20     CPU_POWERPC_e500v2_v20
+#define CPU_POWERPC_MPC8545E_v21     CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8547E         CPU_POWERPC_MPC8545E_v21
+#define CPU_POWERPC_MPC8547E_v10     CPU_POWERPC_e500v2_v10
+#define CPU_POWERPC_MPC8547E_v20     CPU_POWERPC_e500v2_v20
+#define CPU_POWERPC_MPC8547E_v21     CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8548          CPU_POWERPC_MPC8548_v21
+#define CPU_POWERPC_MPC8548_v10      CPU_POWERPC_e500v2_v10
+#define CPU_POWERPC_MPC8548_v11      CPU_POWERPC_e500v2_v11
+#define CPU_POWERPC_MPC8548_v20      CPU_POWERPC_e500v2_v20
+#define CPU_POWERPC_MPC8548_v21      CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8548E         CPU_POWERPC_MPC8548E_v21
+#define CPU_POWERPC_MPC8548E_v10     CPU_POWERPC_e500v2_v10
+#define CPU_POWERPC_MPC8548E_v11     CPU_POWERPC_e500v2_v11
+#define CPU_POWERPC_MPC8548E_v20     CPU_POWERPC_e500v2_v20
+#define CPU_POWERPC_MPC8548E_v21     CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8555          CPU_POWERPC_MPC8555_v11
+#define CPU_POWERPC_MPC8555_v10      CPU_POWERPC_e500v2_v10
+#define CPU_POWERPC_MPC8555_v11      CPU_POWERPC_e500v2_v11
+#define CPU_POWERPC_MPC8555E         CPU_POWERPC_MPC8555E_v11
+#define CPU_POWERPC_MPC8555E_v10     CPU_POWERPC_e500v2_v10
+#define CPU_POWERPC_MPC8555E_v11     CPU_POWERPC_e500v2_v11
+#define CPU_POWERPC_MPC8560          CPU_POWERPC_MPC8560_v21
+#define CPU_POWERPC_MPC8560_v10      CPU_POWERPC_e500v2_v10
+#define CPU_POWERPC_MPC8560_v20      CPU_POWERPC_e500v2_v20
+#define CPU_POWERPC_MPC8560_v21      CPU_POWERPC_e500v2_v21
+#define CPU_POWERPC_MPC8567          CPU_POWERPC_e500v2_v22
+#define CPU_POWERPC_MPC8567E         CPU_POWERPC_e500v2_v22
+#define CPU_POWERPC_MPC8568          CPU_POWERPC_e500v2_v22
+#define CPU_POWERPC_MPC8568E         CPU_POWERPC_e500v2_v22
+#define CPU_POWERPC_MPC8572          CPU_POWERPC_e500v2_v30
+#define CPU_POWERPC_MPC8572E         CPU_POWERPC_e500v2_v30
     /* e600 family */
-    CPU_POWERPC_e600        = 0x80040010,
-    /* PowerPC MPC 5xx cores */
-    CPU_POWERPC_5xx         = 0x00020020,
-    /* PowerPC MPC 8xx cores (aka PowerQUICC) */
-    CPU_POWERPC_8xx         = 0x00500000,
-    /* PowerPC MPC 8xxx cores (aka PowerQUICC-II) */
-    CPU_POWERPC_82xx_HIP3   = 0x00810101,
-    CPU_POWERPC_82xx_HIP4   = 0x80811014,
-    CPU_POWERPC_827x        = 0x80822013,
+    /* e600 cores */
+    CPU_POWERPC_e600               = 0x80040010,
+    /* MPC86xx microcontrollers */
+#define CPU_POWERPC_MPC8610          CPU_POWERPC_e600
+#define CPU_POWERPC_MPC8641          CPU_POWERPC_e600
+#define CPU_POWERPC_MPC8641D         CPU_POWERPC_e600
     /* PowerPC 6xx cores */
-    CPU_POWERPC_601         = 0x00010001,
-    CPU_POWERPC_601a        = 0x00010002,
-    CPU_POWERPC_602         = 0x00050100,
-    CPU_POWERPC_603         = 0x00030100,
-#define CPU_POWERPC_603E      CPU_POWERPC_603E_v41
-    CPU_POWERPC_603E_v11    = 0x00060101,
-    CPU_POWERPC_603E_v12    = 0x00060102,
-    CPU_POWERPC_603E_v13    = 0x00060103,
-    CPU_POWERPC_603E_v14    = 0x00060104,
-    CPU_POWERPC_603E_v22    = 0x00060202,
-    CPU_POWERPC_603E_v3     = 0x00060300,
-    CPU_POWERPC_603E_v4     = 0x00060400,
-    CPU_POWERPC_603E_v41    = 0x00060401,
-    CPU_POWERPC_603E7t      = 0x00071201,
-    CPU_POWERPC_603E7v      = 0x00070100,
-    CPU_POWERPC_603E7v1     = 0x00070101,
-    CPU_POWERPC_603E7v2     = 0x00070201,
-    CPU_POWERPC_603E7       = 0x00070200,
-    CPU_POWERPC_603P        = 0x00070000,
-#define CPU_POWERPC_603R      CPU_POWERPC_603E7t
-    CPU_POWERPC_G2          = 0x00810011,
-#if 0 // Linux pretends the MSB is zero...
-    CPU_POWERPC_G2H4        = 0x80811010,
-    CPU_POWERPC_G2gp        = 0x80821010,
-    CPU_POWERPC_G2ls        = 0x90810010,
-    CPU_POWERPC_G2LE        = 0x80820010,
-    CPU_POWERPC_G2LEgp      = 0x80822010,
-    CPU_POWERPC_G2LEls      = 0xA0822010,
-#else
-    CPU_POWERPC_G2H4        = 0x00811010,
-    CPU_POWERPC_G2gp        = 0x00821010,
-    CPU_POWERPC_G2ls        = 0x10810010,
-    CPU_POWERPC_G2LE        = 0x00820010,
-    CPU_POWERPC_G2LEgp      = 0x00822010,
-    CPU_POWERPC_G2LEls      = 0x20822010,
-#endif
-    CPU_POWERPC_604         = 0x00040103,
-#define CPU_POWERPC_604E      CPU_POWERPC_604E_v24
-    CPU_POWERPC_604E_v10    = 0x00090100, /* Also 2110 & 2120 */
-    CPU_POWERPC_604E_v22    = 0x00090202,
-    CPU_POWERPC_604E_v24    = 0x00090204,
-    CPU_POWERPC_604R        = 0x000a0101, /* Also 0x00093102 */
+#define CPU_POWERPC_601              CPU_POWERPC_601_v2
+    CPU_POWERPC_601_v0             = 0x00010001,
+    CPU_POWERPC_601_v1             = 0x00010001,
+#define CPU_POWERPC_601v             CPU_POWERPC_601_v2
+    CPU_POWERPC_601_v2             = 0x00010002,
+    CPU_POWERPC_602                = 0x00050100,
+    CPU_POWERPC_603                = 0x00030100,
+#define CPU_POWERPC_603E             CPU_POWERPC_603E_v41
+    CPU_POWERPC_603E_v11           = 0x00060101,
+    CPU_POWERPC_603E_v12           = 0x00060102,
+    CPU_POWERPC_603E_v13           = 0x00060103,
+    CPU_POWERPC_603E_v14           = 0x00060104,
+    CPU_POWERPC_603E_v22           = 0x00060202,
+    CPU_POWERPC_603E_v3            = 0x00060300,
+    CPU_POWERPC_603E_v4            = 0x00060400,
+    CPU_POWERPC_603E_v41           = 0x00060401,
+    CPU_POWERPC_603E7t             = 0x00071201,
+    CPU_POWERPC_603E7v             = 0x00070100,
+    CPU_POWERPC_603E7v1            = 0x00070101,
+    CPU_POWERPC_603E7v2            = 0x00070201,
+    CPU_POWERPC_603E7              = 0x00070200,
+    CPU_POWERPC_603P               = 0x00070000,
+#define CPU_POWERPC_603R             CPU_POWERPC_603E7t
+    /* XXX: missing 0x00040303 (604) */
+    CPU_POWERPC_604                = 0x00040103,
+#define CPU_POWERPC_604E             CPU_POWERPC_604E_v24
+    /* XXX: missing 0x00091203 */
+    /* XXX: missing 0x00092110 */
+    /* XXX: missing 0x00092120 */
+    CPU_POWERPC_604E_v10           = 0x00090100,
+    CPU_POWERPC_604E_v22           = 0x00090202,
+    CPU_POWERPC_604E_v24           = 0x00090204,
+    /* XXX: missing 0x000a0100 */
+    /* XXX: missing 0x00093102 */
+    CPU_POWERPC_604R               = 0x000a0101,
 #if 0
-    CPU_POWERPC_604EV       = xxx,
+    CPU_POWERPC_604EV              = xxx, /* XXX: same as 604R ? */
 #endif
     /* PowerPC 740/750 cores (aka G3) */
     /* XXX: missing 0x00084202 */
-#define CPU_POWERPC_7x0       CPU_POWERPC_7x0_v31
-    CPU_POWERPC_7x0_v20     = 0x00080200,
-    CPU_POWERPC_7x0_v21     = 0x00080201,
-    CPU_POWERPC_7x0_v22     = 0x00080202,
-    CPU_POWERPC_7x0_v30     = 0x00080300,
-    CPU_POWERPC_7x0_v31     = 0x00080301,
-    CPU_POWERPC_740E        = 0x00080100,
-    CPU_POWERPC_7x0P        = 0x10080000,
+#define CPU_POWERPC_7x0              CPU_POWERPC_7x0_v31
+    CPU_POWERPC_7x0_v10            = 0x00080100,
+    CPU_POWERPC_7x0_v20            = 0x00080200,
+    CPU_POWERPC_7x0_v21            = 0x00080201,
+    CPU_POWERPC_7x0_v22            = 0x00080202,
+    CPU_POWERPC_7x0_v30            = 0x00080300,
+    CPU_POWERPC_7x0_v31            = 0x00080301,
+    CPU_POWERPC_740E               = 0x00080100,
+    CPU_POWERPC_750E               = 0x00080200,
+    CPU_POWERPC_7x0P               = 0x10080000,
     /* XXX: missing 0x00087010 (CL ?) */
-    CPU_POWERPC_750CL       = 0x00087200,
-#define CPU_POWERPC_750CX     CPU_POWERPC_750CX_v22
-    CPU_POWERPC_750CX_v21   = 0x00082201,
-    CPU_POWERPC_750CX_v22   = 0x00082202,
-#define CPU_POWERPC_750CXE    CPU_POWERPC_750CXE_v31b
-    CPU_POWERPC_750CXE_v21  = 0x00082211,
-    CPU_POWERPC_750CXE_v22  = 0x00082212,
-    CPU_POWERPC_750CXE_v23  = 0x00082213,
-    CPU_POWERPC_750CXE_v24  = 0x00082214,
-    CPU_POWERPC_750CXE_v24b = 0x00083214,
-    CPU_POWERPC_750CXE_v31  = 0x00083211,
-    CPU_POWERPC_750CXE_v31b = 0x00083311,
-    CPU_POWERPC_750CXR      = 0x00083410,
-    CPU_POWERPC_750E        = 0x00080200,
-    CPU_POWERPC_750FL       = 0x700A0203,
-#define CPU_POWERPC_750FX     CPU_POWERPC_750FX_v23
-    CPU_POWERPC_750FX_v10   = 0x70000100,
-    CPU_POWERPC_750FX_v20   = 0x70000200,
-    CPU_POWERPC_750FX_v21   = 0x70000201,
-    CPU_POWERPC_750FX_v22   = 0x70000202,
-    CPU_POWERPC_750FX_v23   = 0x70000203,
-    CPU_POWERPC_750GL       = 0x70020102,
-#define CPU_POWERPC_750GX     CPU_POWERPC_750GX_v12
-    CPU_POWERPC_750GX_v10   = 0x70020100,
-    CPU_POWERPC_750GX_v11   = 0x70020101,
-    CPU_POWERPC_750GX_v12   = 0x70020102,
-#define CPU_POWERPC_750L      CPU_POWERPC_750L_v32 /* Aka LoneStar */
-    CPU_POWERPC_750L_v22    = 0x00088202,
-    CPU_POWERPC_750L_v30    = 0x00088300,
-    CPU_POWERPC_750L_v32    = 0x00088302,
+#define CPU_POWERPC_750CL            CPU_POWERPC_750CL_v20
+    CPU_POWERPC_750CL_v10          = 0x00087200,
+    CPU_POWERPC_750CL_v20          = 0x00087210, /* aka rev E */
+#define CPU_POWERPC_750CX            CPU_POWERPC_750CX_v22
+    CPU_POWERPC_750CX_v10          = 0x00082100,
+    CPU_POWERPC_750CX_v20          = 0x00082200,
+    CPU_POWERPC_750CX_v21          = 0x00082201,
+    CPU_POWERPC_750CX_v22          = 0x00082202,
+#define CPU_POWERPC_750CXE           CPU_POWERPC_750CXE_v31b
+    CPU_POWERPC_750CXE_v21         = 0x00082211,
+    CPU_POWERPC_750CXE_v22         = 0x00082212,
+    CPU_POWERPC_750CXE_v23         = 0x00082213,
+    CPU_POWERPC_750CXE_v24         = 0x00082214,
+    CPU_POWERPC_750CXE_v24b        = 0x00083214,
+    CPU_POWERPC_750CXE_v30         = 0x00082310,
+    CPU_POWERPC_750CXE_v31         = 0x00082311,
+    CPU_POWERPC_750CXE_v31b        = 0x00083311,
+    CPU_POWERPC_750CXR             = 0x00083410,
+    CPU_POWERPC_750FL              = 0x70000203,
+#define CPU_POWERPC_750FX            CPU_POWERPC_750FX_v23
+    CPU_POWERPC_750FX_v10          = 0x70000100,
+    CPU_POWERPC_750FX_v20          = 0x70000200,
+    CPU_POWERPC_750FX_v21          = 0x70000201,
+    CPU_POWERPC_750FX_v22          = 0x70000202,
+    CPU_POWERPC_750FX_v23          = 0x70000203,
+    CPU_POWERPC_750GL              = 0x70020102,
+#define CPU_POWERPC_750GX            CPU_POWERPC_750GX_v12
+    CPU_POWERPC_750GX_v10          = 0x70020100,
+    CPU_POWERPC_750GX_v11          = 0x70020101,
+    CPU_POWERPC_750GX_v12          = 0x70020102,
+#define CPU_POWERPC_750L             CPU_POWERPC_750L_v32 /* Aka LoneStar */
+    CPU_POWERPC_750L_v20           = 0x00088200,
+    CPU_POWERPC_750L_v21           = 0x00088201,
+    CPU_POWERPC_750L_v22           = 0x00088202,
+    CPU_POWERPC_750L_v30           = 0x00088300,
+    CPU_POWERPC_750L_v32           = 0x00088302,
     /* PowerPC 745/755 cores */
-#define CPU_POWERPC_7x5       CPU_POWERPC_7x5_v28
-    CPU_POWERPC_7x5_v10     = 0x00083100,
-    CPU_POWERPC_7x5_v11     = 0x00083101,
-    CPU_POWERPC_7x5_v20     = 0x00083200,
-    CPU_POWERPC_7x5_v21     = 0x00083201,
-    CPU_POWERPC_7x5_v22     = 0x00083202, /* aka D */
-    CPU_POWERPC_7x5_v23     = 0x00083203, /* aka E */
-    CPU_POWERPC_7x5_v24     = 0x00083204,
-    CPU_POWERPC_7x5_v25     = 0x00083205,
-    CPU_POWERPC_7x5_v26     = 0x00083206,
-    CPU_POWERPC_7x5_v27     = 0x00083207,
-    CPU_POWERPC_7x5_v28     = 0x00083208,
+#define CPU_POWERPC_7x5              CPU_POWERPC_7x5_v28
+    CPU_POWERPC_7x5_v10            = 0x00083100,
+    CPU_POWERPC_7x5_v11            = 0x00083101,
+    CPU_POWERPC_7x5_v20            = 0x00083200,
+    CPU_POWERPC_7x5_v21            = 0x00083201,
+    CPU_POWERPC_7x5_v22            = 0x00083202, /* aka D */
+    CPU_POWERPC_7x5_v23            = 0x00083203, /* aka E */
+    CPU_POWERPC_7x5_v24            = 0x00083204,
+    CPU_POWERPC_7x5_v25            = 0x00083205,
+    CPU_POWERPC_7x5_v26            = 0x00083206,
+    CPU_POWERPC_7x5_v27            = 0x00083207,
+    CPU_POWERPC_7x5_v28            = 0x00083208,
 #if 0
-    CPU_POWERPC_7x5P        = xxx,
+    CPU_POWERPC_7x5P               = xxx,
 #endif
     /* PowerPC 74xx cores (aka G4) */
     /* XXX: missing 0x000C1101 */
-#define CPU_POWERPC_7400      CPU_POWERPC_7400_v29
-    CPU_POWERPC_7400_v10    = 0x000C0100,
-    CPU_POWERPC_7400_v11    = 0x000C0101,
-    CPU_POWERPC_7400_v20    = 0x000C0200,
-    CPU_POWERPC_7400_v22    = 0x000C0202,
-    CPU_POWERPC_7400_v26    = 0x000C0206,
-    CPU_POWERPC_7400_v27    = 0x000C0207,
-    CPU_POWERPC_7400_v28    = 0x000C0208,
-    CPU_POWERPC_7400_v29    = 0x000C0209,
-#define CPU_POWERPC_7410      CPU_POWERPC_7410_v14
-    CPU_POWERPC_7410_v10    = 0x800C1100,
-    CPU_POWERPC_7410_v11    = 0x800C1101,
-    CPU_POWERPC_7410_v12    = 0x800C1102, /* aka C */
-    CPU_POWERPC_7410_v13    = 0x800C1103, /* aka D */
-    CPU_POWERPC_7410_v14    = 0x800C1104, /* aka E */
-#define CPU_POWERPC_7448      CPU_POWERPC_7448_v21
-    CPU_POWERPC_7448_v10    = 0x80040100,
-    CPU_POWERPC_7448_v11    = 0x80040101,
-    CPU_POWERPC_7448_v20    = 0x80040200,
-    CPU_POWERPC_7448_v21    = 0x80040201,
-#define CPU_POWERPC_7450      CPU_POWERPC_7450_v21
-    CPU_POWERPC_7450_v10    = 0x80000100,
-    CPU_POWERPC_7450_v11    = 0x80000101,
-    CPU_POWERPC_7450_v12    = 0x80000102,
-    CPU_POWERPC_7450_v20    = 0x80000200, /* aka D: 2.04 */
-    CPU_POWERPC_7450_v21    = 0x80000201, /* aka E */
-    CPU_POWERPC_74x1        = 0x80000203,
-    CPU_POWERPC_74x1G       = 0x80000210, /* aka G: 2.3 */
+#define CPU_POWERPC_7400             CPU_POWERPC_7400_v29
+    CPU_POWERPC_7400_v10           = 0x000C0100,
+    CPU_POWERPC_7400_v11           = 0x000C0101,
+    CPU_POWERPC_7400_v20           = 0x000C0200,
+    CPU_POWERPC_7400_v21           = 0x000C0201,
+    CPU_POWERPC_7400_v22           = 0x000C0202,
+    CPU_POWERPC_7400_v26           = 0x000C0206,
+    CPU_POWERPC_7400_v27           = 0x000C0207,
+    CPU_POWERPC_7400_v28           = 0x000C0208,
+    CPU_POWERPC_7400_v29           = 0x000C0209,
+#define CPU_POWERPC_7410             CPU_POWERPC_7410_v14
+    CPU_POWERPC_7410_v10           = 0x800C1100,
+    CPU_POWERPC_7410_v11           = 0x800C1101,
+    CPU_POWERPC_7410_v12           = 0x800C1102, /* aka C */
+    CPU_POWERPC_7410_v13           = 0x800C1103, /* aka D */
+    CPU_POWERPC_7410_v14           = 0x800C1104, /* aka E */
+#define CPU_POWERPC_7448             CPU_POWERPC_7448_v21
+    CPU_POWERPC_7448_v10           = 0x80040100,
+    CPU_POWERPC_7448_v11           = 0x80040101,
+    CPU_POWERPC_7448_v20           = 0x80040200,
+    CPU_POWERPC_7448_v21           = 0x80040201,
+#define CPU_POWERPC_7450             CPU_POWERPC_7450_v21
+    CPU_POWERPC_7450_v10           = 0x80000100,
+    CPU_POWERPC_7450_v11           = 0x80000101,
+    CPU_POWERPC_7450_v12           = 0x80000102,
+    CPU_POWERPC_7450_v20           = 0x80000200, /* aka A, B, C, D: 2.04 */
+    CPU_POWERPC_7450_v21           = 0x80000201, /* aka E */
+#define CPU_POWERPC_74x1             CPU_POWERPC_74x1_v23
+    CPU_POWERPC_74x1_v23           = 0x80000203, /* aka G: 2.3 */
+    /* XXX: this entry might be a bug in some documentation */
+    CPU_POWERPC_74x1_v210          = 0x80000210, /* aka G: 2.3 ? */
+#define CPU_POWERPC_74x5             CPU_POWERPC_74x5_v32
+    CPU_POWERPC_74x5_v10           = 0x80010100,
     /* XXX: missing 0x80010200 */
-#define CPU_POWERPC_74x5      CPU_POWERPC_74x5_v32
-    CPU_POWERPC_74x5_v10    = 0x80010100,
-    CPU_POWERPC_74x5_v21    = 0x80010201, /* aka C: 2.1 */
-    CPU_POWERPC_74x5_v32    = 0x80010302,
-    CPU_POWERPC_74x5_v33    = 0x80010303, /* aka F: 3.3 */
-    CPU_POWERPC_74x5_v34    = 0x80010304, /* aka G: 3.4 */
-#define CPU_POWERPC_74x7      CPU_POWERPC_74x7_v12
-    CPU_POWERPC_74x7_v10    = 0x80020100, /* aka A: 1.0 */
-    CPU_POWERPC_74x7_v11    = 0x80030101, /* aka B: 1.1 */
-    CPU_POWERPC_74x7_v12    = 0x80020102, /* aka C: 1.2 */
+    CPU_POWERPC_74x5_v21           = 0x80010201, /* aka C: 2.1 */
+    CPU_POWERPC_74x5_v32           = 0x80010302,
+    CPU_POWERPC_74x5_v33           = 0x80010303, /* aka F: 3.3 */
+    CPU_POWERPC_74x5_v34           = 0x80010304, /* aka G: 3.4 */
+#define CPU_POWERPC_74x7             CPU_POWERPC_74x7_v12
+    CPU_POWERPC_74x7_v10           = 0x80020100, /* aka A: 1.0 */
+    CPU_POWERPC_74x7_v11           = 0x80020101, /* aka B: 1.1 */
+    CPU_POWERPC_74x7_v12           = 0x80020102, /* aka C: 1.2 */
+#define CPU_POWERPC_74x7A            CPU_POWERPC_74x7A_v12
+    CPU_POWERPC_74x7A_v10          = 0x80030100, /* aka A: 1.0 */
+    CPU_POWERPC_74x7A_v11          = 0x80030101, /* aka B: 1.1 */
+    CPU_POWERPC_74x7A_v12          = 0x80030102, /* aka C: 1.2 */
     /* 64 bits PowerPC */
-    CPU_POWERPC_620         = 0x00140000,
-    CPU_POWERPC_630         = 0x00400000,
-    CPU_POWERPC_631         = 0x00410104,
-    CPU_POWERPC_POWER4      = 0x00350000,
-    CPU_POWERPC_POWER4P     = 0x00380000,
-    CPU_POWERPC_POWER5      = 0x003A0203,
-#define CPU_POWERPC_POWER5GR  CPU_POWERPC_POWER5
-    CPU_POWERPC_POWER5P     = 0x003B0000,
-#define CPU_POWERPC_POWER5GS  CPU_POWERPC_POWER5P
-    CPU_POWERPC_POWER6      = 0x003E0000,
-    CPU_POWERPC_POWER6_5    = 0x0F000001, /* POWER6 running POWER5 mode */
-    CPU_POWERPC_POWER6A     = 0x0F000002,
-    CPU_POWERPC_970         = 0x00390202,
-#define CPU_POWERPC_970FX     CPU_POWERPC_970FX_v31
-    CPU_POWERPC_970FX_v10   = 0x00391100,
-    CPU_POWERPC_970FX_v20   = 0x003C0200,
-    CPU_POWERPC_970FX_v21   = 0x003C0201,
-    CPU_POWERPC_970FX_v30   = 0x003C0300,
-    CPU_POWERPC_970FX_v31   = 0x003C0301,
-    CPU_POWERPC_970GX       = 0x00450000,
-#define CPU_POWERPC_970MP     CPU_POWERPC_970MP_v11
-    CPU_POWERPC_970MP_v10   = 0x00440100,
-    CPU_POWERPC_970MP_v11   = 0x00440101,
-#define CPU_POWERPC_CELL      CPU_POWERPC_CELL_v32
-    CPU_POWERPC_CELL_v10    = 0x00700100,
-    CPU_POWERPC_CELL_v20    = 0x00700400,
-    CPU_POWERPC_CELL_v30    = 0x00700500,
-    CPU_POWERPC_CELL_v31    = 0x00700501,
-#define CPU_POWERPC_CELL_v32  CPU_POWERPC_CELL_v31
-    CPU_POWERPC_RS64        = 0x00330000,
-    CPU_POWERPC_RS64II      = 0x00340000,
-    CPU_POWERPC_RS64III     = 0x00360000,
-    CPU_POWERPC_RS64IV      = 0x00370000,
+#if defined(TARGET_PPC64)
+    CPU_POWERPC_620                = 0x00140000,
+    CPU_POWERPC_630                = 0x00400000,
+    CPU_POWERPC_631                = 0x00410104,
+    CPU_POWERPC_POWER4             = 0x00350000,
+    CPU_POWERPC_POWER4P            = 0x00380000,
+     /* XXX: missing 0x003A0201 */
+    CPU_POWERPC_POWER5             = 0x003A0203,
+#define CPU_POWERPC_POWER5GR         CPU_POWERPC_POWER5
+    CPU_POWERPC_POWER5P            = 0x003B0000,
+#define CPU_POWERPC_POWER5GS         CPU_POWERPC_POWER5P
+    CPU_POWERPC_POWER6             = 0x003E0000,
+    CPU_POWERPC_POWER6_5           = 0x0F000001, /* POWER6 in POWER5 mode */
+    CPU_POWERPC_POWER6A            = 0x0F000002,
+    CPU_POWERPC_970                = 0x00390202,
+#define CPU_POWERPC_970FX            CPU_POWERPC_970FX_v31
+    CPU_POWERPC_970FX_v10          = 0x00391100,
+    CPU_POWERPC_970FX_v20          = 0x003C0200,
+    CPU_POWERPC_970FX_v21          = 0x003C0201,
+    CPU_POWERPC_970FX_v30          = 0x003C0300,
+    CPU_POWERPC_970FX_v31          = 0x003C0301,
+    CPU_POWERPC_970GX              = 0x00450000,
+#define CPU_POWERPC_970MP            CPU_POWERPC_970MP_v11
+    CPU_POWERPC_970MP_v10          = 0x00440100,
+    CPU_POWERPC_970MP_v11          = 0x00440101,
+#define CPU_POWERPC_CELL             CPU_POWERPC_CELL_v32
+    CPU_POWERPC_CELL_v10           = 0x00700100,
+    CPU_POWERPC_CELL_v20           = 0x00700400,
+    CPU_POWERPC_CELL_v30           = 0x00700500,
+    CPU_POWERPC_CELL_v31           = 0x00700501,
+#define CPU_POWERPC_CELL_v32         CPU_POWERPC_CELL_v31
+    CPU_POWERPC_RS64               = 0x00330000,
+    CPU_POWERPC_RS64II             = 0x00340000,
+    CPU_POWERPC_RS64III            = 0x00360000,
+    CPU_POWERPC_RS64IV             = 0x00370000,
+#endif /* defined(TARGET_PPC64) */
     /* Original POWER */
     /* XXX: should be POWER (RIOS), RSC3308, RSC4608,
      * POWER2 (RIOS2) & RSC2 (P2SC) here
      */
 #if 0
-    CPU_POWER           = xxx, /* 0x20000 ? 0x30000 for RSC ? */
+    CPU_POWER                      = xxx, /* 0x20000 ? 0x30000 for RSC ? */
 #endif
 #if 0
-    CPU_POWER2          = xxx, /* 0x40000 ? */
+    CPU_POWER2                     = xxx, /* 0x40000 ? */
 #endif
     /* PA Semi core */
-    CPU_POWERPC_PA6T        = 0x00900000,
+    CPU_POWERPC_PA6T               = 0x00900000,
 };
 
 /* System version register (used on MPC 8xxx)                                */
 enum {
-    PPC_SVR_8540      = 0x80300000,
-    PPC_SVR_8541E     = 0x807A0010,
-    PPC_SVR_8543v10   = 0x80320010,
-    PPC_SVR_8543v11   = 0x80320011,
-    PPC_SVR_8543v20   = 0x80320020,
-    PPC_SVR_8543Ev10  = 0x803A0010,
-    PPC_SVR_8543Ev11  = 0x803A0011,
-    PPC_SVR_8543Ev20  = 0x803A0020,
-    PPC_SVR_8545      = 0x80310220,
-    PPC_SVR_8545E     = 0x80390220,
-    PPC_SVR_8547E     = 0x80390120,
-    PPC_SCR_8548v10   = 0x80310010,
-    PPC_SCR_8548v11   = 0x80310011,
-    PPC_SCR_8548v20   = 0x80310020,
-    PPC_SVR_8548Ev10  = 0x80390010,
-    PPC_SVR_8548Ev11  = 0x80390011,
-    PPC_SVR_8548Ev20  = 0x80390020,
-    PPC_SVR_8555E     = 0x80790010,
-    PPC_SVR_8560v10   = 0x80700010,
-    PPC_SVR_8560v20   = 0x80700020,
+    POWERPC_SVR_NONE               = 0x00000000,
+#define POWERPC_SVR_52xx             POWERPC_SVR_5200
+#define POWERPC_SVR_5200             POWERPC_SVR_5200_v12
+    POWERPC_SVR_5200_v10           = 0x80110010,
+    POWERPC_SVR_5200_v11           = 0x80110011,
+    POWERPC_SVR_5200_v12           = 0x80110012,
+#define POWERPC_SVR_5200B            POWERPC_SVR_5200B_v21
+    POWERPC_SVR_5200B_v20          = 0x80110020,
+    POWERPC_SVR_5200B_v21          = 0x80110021,
+#define POWERPC_SVR_55xx             POWERPC_SVR_5567
+#if 0
+    POWERPC_SVR_5533               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_5534               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_5553               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_5554               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_5561               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_5565               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_5566               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_5567               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8313               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8313E              = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8314               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8314E              = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8315               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8315E              = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8321               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8321E              = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8323               = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8323E              = xxx,
+#endif
+    POWERPC_SVR_8343A              = 0x80570030,
+    POWERPC_SVR_8343EA             = 0x80560030,
+#define POWERPC_SVR_8347A            POWERPC_SVR_8347AT
+    POWERPC_SVR_8347AP             = 0x80550030, /* PBGA package */
+    POWERPC_SVR_8347AT             = 0x80530030, /* TBGA package */
+#define POWERPC_SVR_8347EA            POWERPC_SVR_8347EAT
+    POWERPC_SVR_8347EAP            = 0x80540030, /* PBGA package */
+    POWERPC_SVR_8347EAT            = 0x80520030, /* TBGA package */
+    POWERPC_SVR_8349               = 0x80510010,
+    POWERPC_SVR_8349A              = 0x80510030,
+    POWERPC_SVR_8349E              = 0x80500010,
+    POWERPC_SVR_8349EA             = 0x80500030,
+#if 0
+    POWERPC_SVR_8358E              = xxx,
+#endif
+#if 0
+    POWERPC_SVR_8360E              = xxx,
+#endif
+#define POWERPC_SVR_E500             0x40000000
+    POWERPC_SVR_8377               = 0x80C70010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8377E              = 0x80C60010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8378               = 0x80C50010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8378E              = 0x80C40010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8379               = 0x80C30010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8379E              = 0x80C00010 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8533             POWERPC_SVR_8533_v11
+    POWERPC_SVR_8533_v10           = 0x80340010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8533_v11           = 0x80340011 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8533E            POWERPC_SVR_8533E_v11
+    POWERPC_SVR_8533E_v10          = 0x803C0010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8533E_v11          = 0x803C0011 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8540             POWERPC_SVR_8540_v21
+    POWERPC_SVR_8540_v10           = 0x80300010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8540_v20           = 0x80300020 | POWERPC_SVR_E500,
+    POWERPC_SVR_8540_v21           = 0x80300021 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8541             POWERPC_SVR_8541_v11
+    POWERPC_SVR_8541_v10           = 0x80720010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8541_v11           = 0x80720011 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8541E            POWERPC_SVR_8541E_v11
+    POWERPC_SVR_8541E_v10          = 0x807A0010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8541E_v11          = 0x807A0011 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8543             POWERPC_SVR_8543_v21
+    POWERPC_SVR_8543_v10           = 0x80320010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8543_v11           = 0x80320011 | POWERPC_SVR_E500,
+    POWERPC_SVR_8543_v20           = 0x80320020 | POWERPC_SVR_E500,
+    POWERPC_SVR_8543_v21           = 0x80320021 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8543E            POWERPC_SVR_8543E_v21
+    POWERPC_SVR_8543E_v10          = 0x803A0010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8543E_v11          = 0x803A0011 | POWERPC_SVR_E500,
+    POWERPC_SVR_8543E_v20          = 0x803A0020 | POWERPC_SVR_E500,
+    POWERPC_SVR_8543E_v21          = 0x803A0021 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8544             POWERPC_SVR_8544_v11
+    POWERPC_SVR_8544_v10           = 0x80340110 | POWERPC_SVR_E500,
+    POWERPC_SVR_8544_v11           = 0x80340111 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8544E            POWERPC_SVR_8544E_v11
+    POWERPC_SVR_8544E_v10          = 0x803C0110 | POWERPC_SVR_E500,
+    POWERPC_SVR_8544E_v11          = 0x803C0111 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8545             POWERPC_SVR_8545_v21
+    POWERPC_SVR_8545_v20           = 0x80310220 | POWERPC_SVR_E500,
+    POWERPC_SVR_8545_v21           = 0x80310221 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8545E            POWERPC_SVR_8545E_v21
+    POWERPC_SVR_8545E_v20          = 0x80390220 | POWERPC_SVR_E500,
+    POWERPC_SVR_8545E_v21          = 0x80390221 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8547E            POWERPC_SVR_8547E_v21
+    POWERPC_SVR_8547E_v20          = 0x80390120 | POWERPC_SVR_E500,
+    POWERPC_SVR_8547E_v21          = 0x80390121 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8548             POWERPC_SVR_8548_v21
+    POWERPC_SVR_8548_v10           = 0x80310010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8548_v11           = 0x80310011 | POWERPC_SVR_E500,
+    POWERPC_SVR_8548_v20           = 0x80310020 | POWERPC_SVR_E500,
+    POWERPC_SVR_8548_v21           = 0x80310021 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8548E            POWERPC_SVR_8548E_v21
+    POWERPC_SVR_8548E_v10          = 0x80390010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8548E_v11          = 0x80390011 | POWERPC_SVR_E500,
+    POWERPC_SVR_8548E_v20          = 0x80390020 | POWERPC_SVR_E500,
+    POWERPC_SVR_8548E_v21          = 0x80390021 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8555             POWERPC_SVR_8555_v11
+    POWERPC_SVR_8555_v10           = 0x80710010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8555_v11           = 0x80710011 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8555E            POWERPC_SVR_8555_v11
+    POWERPC_SVR_8555E_v10          = 0x80790010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8555E_v11          = 0x80790011 | POWERPC_SVR_E500,
+#define POWERPC_SVR_8560             POWERPC_SVR_8560_v21
+    POWERPC_SVR_8560_v10           = 0x80700010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8560_v20           = 0x80700020 | POWERPC_SVR_E500,
+    POWERPC_SVR_8560_v21           = 0x80700021 | POWERPC_SVR_E500,
+    POWERPC_SVR_8567               = 0x80750111 | POWERPC_SVR_E500,
+    POWERPC_SVR_8567E              = 0x807D0111 | POWERPC_SVR_E500,
+    POWERPC_SVR_8568               = 0x80750011 | POWERPC_SVR_E500,
+    POWERPC_SVR_8568E              = 0x807D0011 | POWERPC_SVR_E500,
+    POWERPC_SVR_8572               = 0x80E00010 | POWERPC_SVR_E500,
+    POWERPC_SVR_8572E              = 0x80E80010 | POWERPC_SVR_E500,
+#if 0
+    POWERPC_SVR_8610               = xxx,
+#endif
+    POWERPC_SVR_8641               = 0x80900021,
+    POWERPC_SVR_8641D              = 0x80900121,
 };
 
 /*****************************************************************************/
 /* PowerPC CPU definitions                                                   */
-#define POWERPC_DEF(_name, _pvr, _pvr_mask, _type)                            \
+#define POWERPC_DEF_SVR(_name, _pvr, _svr, _type)                             \
     {                                                                         \
         .name        = _name,                                                 \
         .pvr         = _pvr,                                                  \
-        .pvr_mask    = _pvr_mask,                                             \
+        .svr         = _svr,                                                  \
         .insns_flags = glue(POWERPC_INSNS_,_type),                            \
         .msr_mask    = glue(POWERPC_MSRM_,_type),                             \
         .mmu_model   = glue(POWERPC_MMU_,_type),                              \
         .excp_model  = glue(POWERPC_EXCP_,_type),                             \
         .bus_model   = glue(POWERPC_INPUT_,_type),                            \
         .bfd_mach    = glue(POWERPC_BFDM_,_type),                             \
+        .flags       = glue(POWERPC_FLAG_,_type),                             \
         .init_proc   = &glue(init_proc_,_type),                               \
+        .check_pow   = &glue(check_pow_,_type),                               \
     }
+#define POWERPC_DEF(_name, _pvr, _type)                                       \
+POWERPC_DEF_SVR(_name, _pvr, POWERPC_SVR_NONE, _type)
 
-static ppc_def_t ppc_defs[] = {
+static const ppc_def_t ppc_defs[] = {
     /* Embedded PowerPC                                                      */
     /* PowerPC 401 family                                                    */
     /* Generic PowerPC 401 */
-    POWERPC_DEF("401",         CPU_POWERPC_401,         0xFFFF0000, 401),
+    POWERPC_DEF("401",           CPU_POWERPC_401,                    401),
     /* PowerPC 401 cores                                                     */
     /* PowerPC 401A1 */
-    POWERPC_DEF("401A1",       CPU_POWERPC_401A1,       0xFFFFFFFF, 401),
+    POWERPC_DEF("401A1",         CPU_POWERPC_401A1,                  401),
     /* PowerPC 401B2                                                         */
-    POWERPC_DEF("401B2",       CPU_POWERPC_401B2,       0xFFFFFFFF, 401x2),
+    POWERPC_DEF("401B2",         CPU_POWERPC_401B2,                  401x2),
 #if defined (TODO)
     /* PowerPC 401B3                                                         */
-    POWERPC_DEF("401B3",       CPU_POWERPC_401B3,       0xFFFFFFFF, 401x3),
+    POWERPC_DEF("401B3",         CPU_POWERPC_401B3,                  401x3),
 #endif
     /* PowerPC 401C2                                                         */
-    POWERPC_DEF("401C2",       CPU_POWERPC_401C2,       0xFFFFFFFF, 401x2),
+    POWERPC_DEF("401C2",         CPU_POWERPC_401C2,                  401x2),
     /* PowerPC 401D2                                                         */
-    POWERPC_DEF("401D2",       CPU_POWERPC_401D2,       0xFFFFFFFF, 401x2),
+    POWERPC_DEF("401D2",         CPU_POWERPC_401D2,                  401x2),
     /* PowerPC 401E2                                                         */
-    POWERPC_DEF("401E2",       CPU_POWERPC_401E2,       0xFFFFFFFF, 401x2),
+    POWERPC_DEF("401E2",         CPU_POWERPC_401E2,                  401x2),
     /* PowerPC 401F2                                                         */
-    POWERPC_DEF("401F2",       CPU_POWERPC_401F2,       0xFFFFFFFF, 401x2),
+    POWERPC_DEF("401F2",         CPU_POWERPC_401F2,                  401x2),
     /* PowerPC 401G2                                                         */
     /* XXX: to be checked */
-    POWERPC_DEF("401G2",       CPU_POWERPC_401G2,       0xFFFFFFFF, 401x2),
+    POWERPC_DEF("401G2",         CPU_POWERPC_401G2,                  401x2),
     /* PowerPC 401 microcontrolers                                           */
 #if defined (TODO)
     /* PowerPC 401GF                                                         */
-    POWERPC_DEF("401GF",       CPU_POWERPC_401GF,       0xFFFFFFFF, 401),
+    POWERPC_DEF("401GF",         CPU_POWERPC_401GF,                  401),
 #endif
     /* IOP480 (401 microcontroler)                                           */
-    POWERPC_DEF("IOP480",      CPU_POWERPC_IOP480,      0xFFFFFFFF, IOP480),
+    POWERPC_DEF("IOP480",        CPU_POWERPC_IOP480,                 IOP480),
     /* IBM Processor for Network Resources                                   */
-    POWERPC_DEF("Cobra",       CPU_POWERPC_COBRA,       0xFFFFFFFF, 401),
+    POWERPC_DEF("Cobra",         CPU_POWERPC_COBRA,                  401),
 #if defined (TODO)
-    POWERPC_DEF("Xipchip",     CPU_POWERPC_XIPCHIP,     0xFFFFFFFF, 401),
+    POWERPC_DEF("Xipchip",       CPU_POWERPC_XIPCHIP,                401),
 #endif
     /* PowerPC 403 family                                                    */
     /* Generic PowerPC 403                                                   */
-    POWERPC_DEF("403",         CPU_POWERPC_403,         0xFFFF0000, 403),
+    POWERPC_DEF("403",           CPU_POWERPC_403,                    403),
     /* PowerPC 403 microcontrolers                                           */
     /* PowerPC 403 GA                                                        */
-    POWERPC_DEF("403GA",       CPU_POWERPC_403GA,       0xFFFFFFFF, 403),
+    POWERPC_DEF("403GA",         CPU_POWERPC_403GA,                  403),
     /* PowerPC 403 GB                                                        */
-    POWERPC_DEF("403GB",       CPU_POWERPC_403GB,       0xFFFFFFFF, 403),
+    POWERPC_DEF("403GB",         CPU_POWERPC_403GB,                  403),
     /* PowerPC 403 GC                                                        */
-    POWERPC_DEF("403GC",       CPU_POWERPC_403GC,       0xFFFFFFFF, 403),
+    POWERPC_DEF("403GC",         CPU_POWERPC_403GC,                  403),
     /* PowerPC 403 GCX                                                       */
-    POWERPC_DEF("403GCX",      CPU_POWERPC_403GCX,      0xFFFFFFFF, 403GCX),
+    POWERPC_DEF("403GCX",        CPU_POWERPC_403GCX,                 403GCX),
 #if defined (TODO)
     /* PowerPC 403 GP                                                        */
-    POWERPC_DEF("403GP",       CPU_POWERPC_403GP,       0xFFFFFFFF, 403),
+    POWERPC_DEF("403GP",         CPU_POWERPC_403GP,                  403),
 #endif
     /* PowerPC 405 family                                                    */
     /* Generic PowerPC 405                                                   */
-    POWERPC_DEF("405",         CPU_POWERPC_405,         0xFFFF0000, 405),
+    POWERPC_DEF("405",           CPU_POWERPC_405,                    405),
     /* PowerPC 405 cores                                                     */
 #if defined (TODO)
     /* PowerPC 405 A3                                                        */
-    POWERPC_DEF("405A3",       CPU_POWERPC_405A3,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405A3",         CPU_POWERPC_405A3,                  405),
 #endif
 #if defined (TODO)
     /* PowerPC 405 A4                                                        */
-    POWERPC_DEF("405A4",       CPU_POWERPC_405A4,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405A4",         CPU_POWERPC_405A4,                  405),
 #endif
 #if defined (TODO)
     /* PowerPC 405 B3                                                        */
-    POWERPC_DEF("405B3",       CPU_POWERPC_405B3,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405B3",         CPU_POWERPC_405B3,                  405),
 #endif
 #if defined (TODO)
     /* PowerPC 405 B4                                                        */
-    POWERPC_DEF("405B4",       CPU_POWERPC_405B4,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405B4",         CPU_POWERPC_405B4,                  405),
 #endif
 #if defined (TODO)
     /* PowerPC 405 C3                                                        */
-    POWERPC_DEF("405C3",       CPU_POWERPC_405C3,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405C3",         CPU_POWERPC_405C3,                  405),
 #endif
 #if defined (TODO)
     /* PowerPC 405 C4                                                        */
-    POWERPC_DEF("405C4",       CPU_POWERPC_405C4,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405C4",         CPU_POWERPC_405C4,                  405),
 #endif
     /* PowerPC 405 D2                                                        */
-    POWERPC_DEF("405D2",       CPU_POWERPC_405D2,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405D2",         CPU_POWERPC_405D2,                  405),
 #if defined (TODO)
     /* PowerPC 405 D3                                                        */
-    POWERPC_DEF("405D3",       CPU_POWERPC_405D3,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405D3",         CPU_POWERPC_405D3,                  405),
 #endif
     /* PowerPC 405 D4                                                        */
-    POWERPC_DEF("405D4",       CPU_POWERPC_405D4,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405D4",         CPU_POWERPC_405D4,                  405),
 #if defined (TODO)
     /* PowerPC 405 D5                                                        */
-    POWERPC_DEF("405D5",       CPU_POWERPC_405D5,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405D5",         CPU_POWERPC_405D5,                  405),
 #endif
 #if defined (TODO)
     /* PowerPC 405 E4                                                        */
-    POWERPC_DEF("405E4",       CPU_POWERPC_405E4,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405E4",         CPU_POWERPC_405E4,                  405),
 #endif
 #if defined (TODO)
     /* PowerPC 405 F4                                                        */
-    POWERPC_DEF("405F4",       CPU_POWERPC_405F4,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405F4",         CPU_POWERPC_405F4,                  405),
 #endif
 #if defined (TODO)
     /* PowerPC 405 F5                                                        */
-    POWERPC_DEF("405F5",       CPU_POWERPC_405F5,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405F5",         CPU_POWERPC_405F5,                  405),
 #endif
 #if defined (TODO)
     /* PowerPC 405 F6                                                        */
-    POWERPC_DEF("405F6",       CPU_POWERPC_405F6,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405F6",         CPU_POWERPC_405F6,                  405),
 #endif
     /* PowerPC 405 microcontrolers                                           */
     /* PowerPC 405 CR                                                        */
-    POWERPC_DEF("405CR",       CPU_POWERPC_405CR,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405CR",         CPU_POWERPC_405CR,                  405),
     /* PowerPC 405 CRa                                                       */
-    POWERPC_DEF("405CRa",      CPU_POWERPC_405CRa,      0xFFFFFFFF, 405),
+    POWERPC_DEF("405CRa",        CPU_POWERPC_405CRa,                 405),
     /* PowerPC 405 CRb                                                       */
-    POWERPC_DEF("405CRb",      CPU_POWERPC_405CRb,      0xFFFFFFFF, 405),
+    POWERPC_DEF("405CRb",        CPU_POWERPC_405CRb,                 405),
     /* PowerPC 405 CRc                                                       */
-    POWERPC_DEF("405CRc",      CPU_POWERPC_405CRc,      0xFFFFFFFF, 405),
+    POWERPC_DEF("405CRc",        CPU_POWERPC_405CRc,                 405),
     /* PowerPC 405 EP                                                        */
-    POWERPC_DEF("405EP",       CPU_POWERPC_405EP,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405EP",         CPU_POWERPC_405EP,                  405),
 #if defined(TODO)
     /* PowerPC 405 EXr                                                       */
-    POWERPC_DEF("405EXr",      CPU_POWERPC_405EXr,      0xFFFFFFFF, 405),
+    POWERPC_DEF("405EXr",        CPU_POWERPC_405EXr,                 405),
 #endif
     /* PowerPC 405 EZ                                                        */
-    POWERPC_DEF("405EZ",       CPU_POWERPC_405EZ,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405EZ",         CPU_POWERPC_405EZ,                  405),
 #if defined(TODO)
     /* PowerPC 405 FX                                                        */
-    POWERPC_DEF("405FX",       CPU_POWERPC_405FX,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405FX",         CPU_POWERPC_405FX,                  405),
 #endif
     /* PowerPC 405 GP                                                        */
-    POWERPC_DEF("405GP",       CPU_POWERPC_405GP,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405GP",         CPU_POWERPC_405GP,                  405),
     /* PowerPC 405 GPa                                                       */
-    POWERPC_DEF("405GPa",      CPU_POWERPC_405GPa,      0xFFFFFFFF, 405),
+    POWERPC_DEF("405GPa",        CPU_POWERPC_405GPa,                 405),
     /* PowerPC 405 GPb                                                       */
-    POWERPC_DEF("405GPb",      CPU_POWERPC_405GPb,      0xFFFFFFFF, 405),
+    POWERPC_DEF("405GPb",        CPU_POWERPC_405GPb,                 405),
     /* PowerPC 405 GPc                                                       */
-    POWERPC_DEF("405GPc",      CPU_POWERPC_405GPc,      0xFFFFFFFF, 405),
+    POWERPC_DEF("405GPc",        CPU_POWERPC_405GPc,                 405),
     /* PowerPC 405 GPd                                                       */
-    POWERPC_DEF("405GPd",      CPU_POWERPC_405GPd,      0xFFFFFFFF, 405),
+    POWERPC_DEF("405GPd",        CPU_POWERPC_405GPd,                 405),
     /* PowerPC 405 GPe                                                       */
-    POWERPC_DEF("405GPe",      CPU_POWERPC_405GPe,      0xFFFFFFFF, 405),
+    POWERPC_DEF("405GPe",        CPU_POWERPC_405GPe,                 405),
     /* PowerPC 405 GPR                                                       */
-    POWERPC_DEF("405GPR",      CPU_POWERPC_405GPR,      0xFFFFFFFF, 405),
+    POWERPC_DEF("405GPR",        CPU_POWERPC_405GPR,                 405),
 #if defined(TODO)
     /* PowerPC 405 H                                                         */
-    POWERPC_DEF("405H",        CPU_POWERPC_405H,        0xFFFFFFFF, 405),
+    POWERPC_DEF("405H",          CPU_POWERPC_405H,                   405),
 #endif
 #if defined(TODO)
     /* PowerPC 405 L                                                         */
-    POWERPC_DEF("405L",        CPU_POWERPC_405L,        0xFFFFFFFF, 405),
+    POWERPC_DEF("405L",          CPU_POWERPC_405L,                   405),
 #endif
     /* PowerPC 405 LP                                                        */
-    POWERPC_DEF("405LP",       CPU_POWERPC_405LP,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405LP",         CPU_POWERPC_405LP,                  405),
 #if defined(TODO)
     /* PowerPC 405 PM                                                        */
-    POWERPC_DEF("405PM",       CPU_POWERPC_405PM,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405PM",         CPU_POWERPC_405PM,                  405),
 #endif
 #if defined(TODO)
     /* PowerPC 405 PS                                                        */
-    POWERPC_DEF("405PS",       CPU_POWERPC_405PS,       0xFFFFFFFF, 405),
+    POWERPC_DEF("405PS",         CPU_POWERPC_405PS,                  405),
 #endif
 #if defined(TODO)
     /* PowerPC 405 S                                                         */
-    POWERPC_DEF("405S",        CPU_POWERPC_405S,        0xFFFFFFFF, 405),
+    POWERPC_DEF("405S",          CPU_POWERPC_405S,                   405),
 #endif
     /* Npe405 H                                                              */
-    POWERPC_DEF("Npe405H",     CPU_POWERPC_NPE405H,     0xFFFFFFFF, 405),
+    POWERPC_DEF("Npe405H",       CPU_POWERPC_NPE405H,                405),
     /* Npe405 H2                                                             */
-    POWERPC_DEF("Npe405H2",    CPU_POWERPC_NPE405H2,    0xFFFFFFFF, 405),
+    POWERPC_DEF("Npe405H2",      CPU_POWERPC_NPE405H2,               405),
     /* Npe405 L                                                              */
-    POWERPC_DEF("Npe405L",     CPU_POWERPC_NPE405L,     0xFFFFFFFF, 405),
+    POWERPC_DEF("Npe405L",       CPU_POWERPC_NPE405L,                405),
     /* Npe4GS3                                                               */
-    POWERPC_DEF("Npe4GS3",     CPU_POWERPC_NPE4GS3,     0xFFFFFFFF, 405),
+    POWERPC_DEF("Npe4GS3",       CPU_POWERPC_NPE4GS3,                405),
 #if defined (TODO)
-    POWERPC_DEF("Npcxx1",      CPU_POWERPC_NPCxx1,      0xFFFFFFFF, 405),
+    POWERPC_DEF("Npcxx1",        CPU_POWERPC_NPCxx1,                 405),
 #endif
 #if defined (TODO)
-    POWERPC_DEF("Npr161",      CPU_POWERPC_NPR161,      0xFFFFFFFF, 405),
+    POWERPC_DEF("Npr161",        CPU_POWERPC_NPR161,                 405),
 #endif
 #if defined (TODO)
     /* PowerPC LC77700 (Sanyo)                                               */
-    POWERPC_DEF("LC77700",     CPU_POWERPC_LC77700,     0xFFFFFFFF, 405),
+    POWERPC_DEF("LC77700",       CPU_POWERPC_LC77700,                405),
 #endif
     /* PowerPC 401/403/405 based set-top-box microcontrolers                 */
 #if defined (TODO)
     /* STB010000                                                             */
-    POWERPC_DEF("STB01000",    CPU_POWERPC_STB01000,    0xFFFFFFFF, 401x2),
+    POWERPC_DEF("STB01000",      CPU_POWERPC_STB01000,               401x2),
 #endif
 #if defined (TODO)
     /* STB01010                                                              */
-    POWERPC_DEF("STB01010",    CPU_POWERPC_STB01010,    0xFFFFFFFF, 401x2),
+    POWERPC_DEF("STB01010",      CPU_POWERPC_STB01010,               401x2),
 #endif
 #if defined (TODO)
     /* STB0210                                                               */
-    POWERPC_DEF("STB0210",     CPU_POWERPC_STB0210,     0xFFFFFFFF, 401x3),
+    POWERPC_DEF("STB0210",       CPU_POWERPC_STB0210,                401x3),
 #endif
     /* STB03xx                                                               */
-    POWERPC_DEF("STB03",       CPU_POWERPC_STB03,       0xFFFFFFFF, 405),
+    POWERPC_DEF("STB03",         CPU_POWERPC_STB03,                  405),
 #if defined (TODO)
     /* STB043x                                                               */
-    POWERPC_DEF("STB043",      CPU_POWERPC_STB043,      0xFFFFFFFF, 405),
+    POWERPC_DEF("STB043",        CPU_POWERPC_STB043,                 405),
 #endif
 #if defined (TODO)
     /* STB045x                                                               */
-    POWERPC_DEF("STB045",      CPU_POWERPC_STB045,      0xFFFFFFFF, 405),
+    POWERPC_DEF("STB045",        CPU_POWERPC_STB045,                 405),
 #endif
     /* STB04xx                                                               */
-    POWERPC_DEF("STB04",       CPU_POWERPC_STB04,       0xFFFF0000, 405),
+    POWERPC_DEF("STB04",         CPU_POWERPC_STB04,                  405),
     /* STB25xx                                                               */
-    POWERPC_DEF("STB25",       CPU_POWERPC_STB25,       0xFFFFFFFF, 405),
+    POWERPC_DEF("STB25",         CPU_POWERPC_STB25,                  405),
 #if defined (TODO)
     /* STB130                                                                */
-    POWERPC_DEF("STB130",      CPU_POWERPC_STB130,      0xFFFFFFFF, 405),
+    POWERPC_DEF("STB130",        CPU_POWERPC_STB130,                 405),
 #endif
     /* Xilinx PowerPC 405 cores                                              */
-    POWERPC_DEF("x2vp4",       CPU_POWERPC_X2VP4,       0xFFFFFFFF, 405),
-    POWERPC_DEF("x2vp7",       CPU_POWERPC_X2VP7,       0xFFFFFFFF, 405),
-    POWERPC_DEF("x2vp20",      CPU_POWERPC_X2VP20,      0xFFFFFFFF, 405),
-    POWERPC_DEF("x2vp50",      CPU_POWERPC_X2VP50,      0xFFFFFFFF, 405),
+    POWERPC_DEF("x2vp4",         CPU_POWERPC_X2VP4,                  405),
+    POWERPC_DEF("x2vp7",         CPU_POWERPC_X2VP7,                  405),
+    POWERPC_DEF("x2vp20",        CPU_POWERPC_X2VP20,                 405),
+    POWERPC_DEF("x2vp50",        CPU_POWERPC_X2VP50,                 405),
 #if defined (TODO)
     /* Zarlink ZL10310                                                       */
-    POWERPC_DEF("zl10310",     CPU_POWERPC_ZL10310,     0xFFFFFFFF, 405),
+    POWERPC_DEF("zl10310",       CPU_POWERPC_ZL10310,                405),
 #endif
 #if defined (TODO)
     /* Zarlink ZL10311                                                       */
-    POWERPC_DEF("zl10311",     CPU_POWERPC_ZL10311,     0xFFFFFFFF, 405),
+    POWERPC_DEF("zl10311",       CPU_POWERPC_ZL10311,                405),
 #endif
 #if defined (TODO)
     /* Zarlink ZL10320                                                       */
-    POWERPC_DEF("zl10320",     CPU_POWERPC_ZL10320,     0xFFFFFFFF, 405),
+    POWERPC_DEF("zl10320",       CPU_POWERPC_ZL10320,                405),
 #endif
 #if defined (TODO)
     /* Zarlink ZL10321                                                       */
-    POWERPC_DEF("zl10321",     CPU_POWERPC_ZL10321,     0xFFFFFFFF, 405),
+    POWERPC_DEF("zl10321",       CPU_POWERPC_ZL10321,                405),
 #endif
     /* PowerPC 440 family                                                    */
+#if defined(TODO_USER_ONLY)
     /* Generic PowerPC 440                                                   */
-    POWERPC_DEF("440",         CPU_POWERPC_440,         0xFFFFFFFF, 440GP),
+    POWERPC_DEF("440",           CPU_POWERPC_440,                    440GP),
+#endif
     /* PowerPC 440 cores                                                     */
 #if defined (TODO)
     /* PowerPC 440 A4                                                        */
-    POWERPC_DEF("440A4",       CPU_POWERPC_440A4,       0xFFFFFFFF, 440x4),
+    POWERPC_DEF("440A4",         CPU_POWERPC_440A4,                  440x4),
 #endif
 #if defined (TODO)
     /* PowerPC 440 A5                                                        */
-    POWERPC_DEF("440A5",       CPU_POWERPC_440A5,       0xFFFFFFFF, 440x5),
+    POWERPC_DEF("440A5",         CPU_POWERPC_440A5,                  440x5),
 #endif
 #if defined (TODO)
     /* PowerPC 440 B4                                                        */
-    POWERPC_DEF("440B4",       CPU_POWERPC_440B4,       0xFFFFFFFF, 440x4),
+    POWERPC_DEF("440B4",         CPU_POWERPC_440B4,                  440x4),
 #endif
 #if defined (TODO)
     /* PowerPC 440 G4                                                        */
-    POWERPC_DEF("440G4",       CPU_POWERPC_440G4,       0xFFFFFFFF, 440x4),
+    POWERPC_DEF("440G4",         CPU_POWERPC_440G4,                  440x4),
 #endif
 #if defined (TODO)
     /* PowerPC 440 F5                                                        */
-    POWERPC_DEF("440F5",       CPU_POWERPC_440F5,       0xFFFFFFFF, 440x5),
+    POWERPC_DEF("440F5",         CPU_POWERPC_440F5,                  440x5),
 #endif
 #if defined (TODO)
     /* PowerPC 440 G5                                                        */
-    POWERPC_DEF("440G5",       CPU_POWERPC_440G5,       0xFFFFFFFF, 440x5),
+    POWERPC_DEF("440G5",         CPU_POWERPC_440G5,                  440x5),
 #endif
 #if defined (TODO)
     /* PowerPC 440H4                                                         */
-    POWERPC_DEF("440H4",       CPU_POWERPC_440H4,       0xFFFFFFFF, 440x4),
+    POWERPC_DEF("440H4",         CPU_POWERPC_440H4,                  440x4),
 #endif
 #if defined (TODO)
     /* PowerPC 440H6                                                         */
-    POWERPC_DEF("440H6",       CPU_POWERPC_440H6,       0xFFFFFFFF, 440Gx5),
+    POWERPC_DEF("440H6",         CPU_POWERPC_440H6,                  440Gx5),
 #endif
     /* PowerPC 440 microcontrolers                                           */
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 EP                                                        */
-    POWERPC_DEF("440EP",       CPU_POWERPC_440EP,       0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440EP",         CPU_POWERPC_440EP,                  440EP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 EPa                                                       */
-    POWERPC_DEF("440EPa",      CPU_POWERPC_440EPa,      0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440EPa",        CPU_POWERPC_440EPa,                 440EP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 EPb                                                       */
-    POWERPC_DEF("440EPb",      CPU_POWERPC_440EPb,      0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440EPb",        CPU_POWERPC_440EPb,                 440EP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 EPX                                                       */
-    POWERPC_DEF("440EPX",      CPU_POWERPC_440EPX,      0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440EPX",        CPU_POWERPC_440EPX,                 440EP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GP                                                        */
-    POWERPC_DEF("440GP",       CPU_POWERPC_440GP,       0xFFFFFFFF, 440GP),
+    POWERPC_DEF("440GP",         CPU_POWERPC_440GP,                  440GP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GPb                                                       */
-    POWERPC_DEF("440GPb",      CPU_POWERPC_440GPb,      0xFFFFFFFF, 440GP),
+    POWERPC_DEF("440GPb",        CPU_POWERPC_440GPb,                 440GP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GPc                                                       */
-    POWERPC_DEF("440GPc",      CPU_POWERPC_440GPc,      0xFFFFFFFF, 440GP),
+    POWERPC_DEF("440GPc",        CPU_POWERPC_440GPc,                 440GP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GR                                                        */
-    POWERPC_DEF("440GR",       CPU_POWERPC_440GR,       0xFFFFFFFF, 440x5),
+    POWERPC_DEF("440GR",         CPU_POWERPC_440GR,                  440x5),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GRa                                                       */
-    POWERPC_DEF("440GRa",      CPU_POWERPC_440GRa,      0xFFFFFFFF, 440x5),
+    POWERPC_DEF("440GRa",        CPU_POWERPC_440GRa,                 440x5),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GRX                                                       */
-    POWERPC_DEF("440GRX",      CPU_POWERPC_440GRX,      0xFFFFFFFF, 440x5),
+    POWERPC_DEF("440GRX",        CPU_POWERPC_440GRX,                 440x5),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GX                                                        */
-    POWERPC_DEF("440GX",       CPU_POWERPC_440GX,       0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440GX",         CPU_POWERPC_440GX,                  440EP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GXa                                                       */
-    POWERPC_DEF("440GXa",      CPU_POWERPC_440GXa,      0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440GXa",        CPU_POWERPC_440GXa,                 440EP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GXb                                                       */
-    POWERPC_DEF("440GXb",      CPU_POWERPC_440GXb,      0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440GXb",        CPU_POWERPC_440GXb,                 440EP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GXc                                                       */
-    POWERPC_DEF("440GXc",      CPU_POWERPC_440GXc,      0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440GXc",        CPU_POWERPC_440GXc,                 440EP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 GXf                                                       */
-    POWERPC_DEF("440GXf",      CPU_POWERPC_440GXf,      0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440GXf",        CPU_POWERPC_440GXf,                 440EP),
+#endif
 #if defined(TODO)
     /* PowerPC 440 S                                                         */
-    POWERPC_DEF("440S",        CPU_POWERPC_440S,        0xFFFFFFFF, 440),
+    POWERPC_DEF("440S",          CPU_POWERPC_440S,                   440),
 #endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 SP                                                        */
-    POWERPC_DEF("440SP",       CPU_POWERPC_440SP,       0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440SP",         CPU_POWERPC_440SP,                  440EP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 SP2                                                       */
-    POWERPC_DEF("440SP2",      CPU_POWERPC_440SP2,      0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440SP2",        CPU_POWERPC_440SP2,                 440EP),
+#endif
+#if defined(TODO_USER_ONLY)
     /* PowerPC 440 SPE                                                       */
-    POWERPC_DEF("440SPE",      CPU_POWERPC_440SPE,      0xFFFFFFFF, 440EP),
+    POWERPC_DEF("440SPE",        CPU_POWERPC_440SPE,                 440EP),
+#endif
     /* PowerPC 460 family                                                    */
 #if defined (TODO)
     /* Generic PowerPC 464                                                   */
-    POWERPC_DEF("464",         CPU_POWERPC_464,         0xFFFFFFFF, 460),
+    POWERPC_DEF("464",           CPU_POWERPC_464,                    460),
 #endif
     /* PowerPC 464 microcontrolers                                           */
 #if defined (TODO)
     /* PowerPC 464H90                                                        */
-    POWERPC_DEF("464H90",      CPU_POWERPC_464H90,      0xFFFFFFFF, 460),
+    POWERPC_DEF("464H90",        CPU_POWERPC_464H90,                 460),
 #endif
 #if defined (TODO)
     /* PowerPC 464H90F                                                       */
-    POWERPC_DEF("464H90F",     CPU_POWERPC_464H90F,     0xFFFFFFFF, 460F),
+    POWERPC_DEF("464H90F",       CPU_POWERPC_464H90F,                460F),
 #endif
     /* Freescale embedded PowerPC cores                                      */
+    /* MPC5xx family (aka RCPU)                                              */
+#if defined(TODO_USER_ONLY)
+    /* Generic MPC5xx core                                                   */
+    POWERPC_DEF("MPC5xx",        CPU_POWERPC_MPC5xx,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* Codename for MPC5xx core                                              */
+    POWERPC_DEF("RCPU",          CPU_POWERPC_MPC5xx,                 MPC5xx),
+#endif
+    /* MPC5xx microcontrollers                                               */
+#if defined(TODO_USER_ONLY)
+    /* MGT560                                                                */
+    POWERPC_DEF("MGT560",        CPU_POWERPC_MGT560,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC509                                                                */
+    POWERPC_DEF("MPC509",        CPU_POWERPC_MPC509,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC533                                                                */
+    POWERPC_DEF("MPC533",        CPU_POWERPC_MPC533,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC534                                                                */
+    POWERPC_DEF("MPC534",        CPU_POWERPC_MPC534,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC555                                                                */
+    POWERPC_DEF("MPC555",        CPU_POWERPC_MPC555,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC556                                                                */
+    POWERPC_DEF("MPC556",        CPU_POWERPC_MPC556,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC560                                                                */
+    POWERPC_DEF("MPC560",        CPU_POWERPC_MPC560,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC561                                                                */
+    POWERPC_DEF("MPC561",        CPU_POWERPC_MPC561,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC562                                                                */
+    POWERPC_DEF("MPC562",        CPU_POWERPC_MPC562,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC563                                                                */
+    POWERPC_DEF("MPC563",        CPU_POWERPC_MPC563,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC564                                                                */
+    POWERPC_DEF("MPC564",        CPU_POWERPC_MPC564,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC565                                                                */
+    POWERPC_DEF("MPC565",        CPU_POWERPC_MPC565,                 MPC5xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC566                                                                */
+    POWERPC_DEF("MPC566",        CPU_POWERPC_MPC566,                 MPC5xx),
+#endif
+    /* MPC8xx family (aka PowerQUICC)                                        */
+#if defined(TODO_USER_ONLY)
+    /* Generic MPC8xx core                                                   */
+    POWERPC_DEF("MPC8xx",        CPU_POWERPC_MPC8xx,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* Codename for MPC8xx core                                              */
+    POWERPC_DEF("PowerQUICC",    CPU_POWERPC_MPC8xx,                 MPC8xx),
+#endif
+    /* MPC8xx microcontrollers                                               */
+#if defined(TODO_USER_ONLY)
+    /* MGT823                                                                */
+    POWERPC_DEF("MGT823",        CPU_POWERPC_MGT823,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC821                                                                */
+    POWERPC_DEF("MPC821",        CPU_POWERPC_MPC821,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC823                                                                */
+    POWERPC_DEF("MPC823",        CPU_POWERPC_MPC823,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC850                                                                */
+    POWERPC_DEF("MPC850",        CPU_POWERPC_MPC850,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC852T                                                               */
+    POWERPC_DEF("MPC852T",       CPU_POWERPC_MPC852T,                MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC855T                                                               */
+    POWERPC_DEF("MPC855T",       CPU_POWERPC_MPC855T,                MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC857                                                                */
+    POWERPC_DEF("MPC857",        CPU_POWERPC_MPC857,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC859                                                                */
+    POWERPC_DEF("MPC859",        CPU_POWERPC_MPC859,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC860                                                                */
+    POWERPC_DEF("MPC860",        CPU_POWERPC_MPC860,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC862                                                                */
+    POWERPC_DEF("MPC862",        CPU_POWERPC_MPC862,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC866                                                                */
+    POWERPC_DEF("MPC866",        CPU_POWERPC_MPC866,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC870                                                                */
+    POWERPC_DEF("MPC870",        CPU_POWERPC_MPC870,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC875                                                                */
+    POWERPC_DEF("MPC875",        CPU_POWERPC_MPC875,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC880                                                                */
+    POWERPC_DEF("MPC880",        CPU_POWERPC_MPC880,                 MPC8xx),
+#endif
+#if defined(TODO_USER_ONLY)
+    /* MPC885                                                                */
+    POWERPC_DEF("MPC885",        CPU_POWERPC_MPC885,                 MPC8xx),
+#endif
+    /* MPC82xx family (aka PowerQUICC-II)                                    */
+    /* Generic MPC52xx core                                                  */
+    POWERPC_DEF_SVR("MPC52xx",
+                    CPU_POWERPC_MPC52xx,      POWERPC_SVR_52xx,      G2LE),
+    /* Generic MPC82xx core                                                  */
+    POWERPC_DEF("MPC82xx",       CPU_POWERPC_MPC82xx,                G2),
+    /* Codename for MPC82xx                                                  */
+    POWERPC_DEF("PowerQUICC-II", CPU_POWERPC_MPC82xx,                G2),
+    /* PowerPC G2 core                                                       */
+    POWERPC_DEF("G2",            CPU_POWERPC_G2,                     G2),
+    /* PowerPC G2 H4 core                                                    */
+    POWERPC_DEF("G2H4",          CPU_POWERPC_G2H4,                   G2),
+    /* PowerPC G2 GP core                                                    */
+    POWERPC_DEF("G2GP",          CPU_POWERPC_G2gp,                   G2),
+    /* PowerPC G2 LS core                                                    */
+    POWERPC_DEF("G2LS",          CPU_POWERPC_G2ls,                   G2),
+    /* PowerPC G2 HiP3 core                                                  */
+    POWERPC_DEF("G2HiP3",        CPU_POWERPC_G2_HIP3,                G2),
+    /* PowerPC G2 HiP4 core                                                  */
+    POWERPC_DEF("G2HiP4",        CPU_POWERPC_G2_HIP4,                G2),
+    /* PowerPC MPC603 core                                                   */
+    POWERPC_DEF("MPC603",        CPU_POWERPC_MPC603,                 603E),
+    /* PowerPC G2le core (same as G2 plus little-endian mode support)        */
+    POWERPC_DEF("G2le",          CPU_POWERPC_G2LE,                   G2LE),
+    /* PowerPC G2LE GP core                                                  */
+    POWERPC_DEF("G2leGP",        CPU_POWERPC_G2LEgp,                 G2LE),
+    /* PowerPC G2LE LS core                                                  */
+    POWERPC_DEF("G2leLS",        CPU_POWERPC_G2LEls,                 G2LE),
+    /* PowerPC G2LE GP1 core                                                 */
+    POWERPC_DEF("G2leGP1",       CPU_POWERPC_G2LEgp1,                G2LE),
+    /* PowerPC G2LE GP3 core                                                 */
+    POWERPC_DEF("G2leGP3",       CPU_POWERPC_G2LEgp1,                G2LE),
+    /* PowerPC MPC603 microcontrollers                                       */
+    /* MPC8240                                                               */
+    POWERPC_DEF("MPC8240",       CPU_POWERPC_MPC8240,                603E),
+    /* PowerPC G2 microcontrollers                                           */
+#if defined(TODO)
+    /* MPC5121                                                               */
+    POWERPC_DEF_SVR("MPC5121",
+                    CPU_POWERPC_MPC5121,      POWERPC_SVR_5121,      G2LE),
+#endif
+    /* MPC5200                                                               */
+    POWERPC_DEF_SVR("MPC5200",
+                    CPU_POWERPC_MPC5200,      POWERPC_SVR_5200,      G2LE),
+    /* MPC5200 v1.0                                                          */
+    POWERPC_DEF_SVR("MPC5200_v10",
+                    CPU_POWERPC_MPC5200_v10,  POWERPC_SVR_5200_v10,  G2LE),
+    /* MPC5200 v1.1                                                          */
+    POWERPC_DEF_SVR("MPC5200_v11",
+                    CPU_POWERPC_MPC5200_v11,  POWERPC_SVR_5200_v11,  G2LE),
+    /* MPC5200 v1.2                                                          */
+    POWERPC_DEF_SVR("MPC5200_v12",
+                    CPU_POWERPC_MPC5200_v12,  POWERPC_SVR_5200_v12,  G2LE),
+    /* MPC5200B                                                              */
+    POWERPC_DEF_SVR("MPC5200B",
+                    CPU_POWERPC_MPC5200B,     POWERPC_SVR_5200B,     G2LE),
+    /* MPC5200B v2.0                                                         */
+    POWERPC_DEF_SVR("MPC5200B_v20",
+                    CPU_POWERPC_MPC5200B_v20, POWERPC_SVR_5200B_v20, G2LE),
+    /* MPC5200B v2.1                                                         */
+    POWERPC_DEF_SVR("MPC5200B_v21",
+                    CPU_POWERPC_MPC5200B_v21, POWERPC_SVR_5200B_v21, G2LE),
+    /* MPC8241                                                               */
+    POWERPC_DEF("MPC8241",       CPU_POWERPC_MPC8241,                G2),
+    /* MPC8245                                                               */
+    POWERPC_DEF("MPC8245",       CPU_POWERPC_MPC8245,                G2),
+    /* MPC8247                                                               */
+    POWERPC_DEF("MPC8247",       CPU_POWERPC_MPC8247,                G2LE),
+    /* MPC8248                                                               */
+    POWERPC_DEF("MPC8248",       CPU_POWERPC_MPC8248,                G2LE),
+    /* MPC8250                                                               */
+    POWERPC_DEF("MPC8250",       CPU_POWERPC_MPC8250,                G2),
+    /* MPC8250 HiP3                                                          */
+    POWERPC_DEF("MPC8250_HiP3",  CPU_POWERPC_MPC8250_HiP3,           G2),
+    /* MPC8250 HiP4                                                          */
+    POWERPC_DEF("MPC8250_HiP4",  CPU_POWERPC_MPC8250_HiP4,           G2),
+    /* MPC8255                                                               */
+    POWERPC_DEF("MPC8255",       CPU_POWERPC_MPC8255,                G2),
+    /* MPC8255 HiP3                                                          */
+    POWERPC_DEF("MPC8255_HiP3",  CPU_POWERPC_MPC8255_HiP3,           G2),
+    /* MPC8255 HiP4                                                          */
+    POWERPC_DEF("MPC8255_HiP4",  CPU_POWERPC_MPC8255_HiP4,           G2),
+    /* MPC8260                                                               */
+    POWERPC_DEF("MPC8260",       CPU_POWERPC_MPC8260,                G2),
+    /* MPC8260 HiP3                                                          */
+    POWERPC_DEF("MPC8260_HiP3",  CPU_POWERPC_MPC8260_HiP3,           G2),
+    /* MPC8260 HiP4                                                          */
+    POWERPC_DEF("MPC8260_HiP4",  CPU_POWERPC_MPC8260_HiP4,           G2),
+    /* MPC8264                                                               */
+    POWERPC_DEF("MPC8264",       CPU_POWERPC_MPC8264,                G2),
+    /* MPC8264 HiP3                                                          */
+    POWERPC_DEF("MPC8264_HiP3",  CPU_POWERPC_MPC8264_HiP3,           G2),
+    /* MPC8264 HiP4                                                          */
+    POWERPC_DEF("MPC8264_HiP4",  CPU_POWERPC_MPC8264_HiP4,           G2),
+    /* MPC8265                                                               */
+    POWERPC_DEF("MPC8265",       CPU_POWERPC_MPC8265,                G2),
+    /* MPC8265 HiP3                                                          */
+    POWERPC_DEF("MPC8265_HiP3",  CPU_POWERPC_MPC8265_HiP3,           G2),
+    /* MPC8265 HiP4                                                          */
+    POWERPC_DEF("MPC8265_HiP4",  CPU_POWERPC_MPC8265_HiP4,           G2),
+    /* MPC8266                                                               */
+    POWERPC_DEF("MPC8266",       CPU_POWERPC_MPC8266,                G2),
+    /* MPC8266 HiP3                                                          */
+    POWERPC_DEF("MPC8266_HiP3",  CPU_POWERPC_MPC8266_HiP3,           G2),
+    /* MPC8266 HiP4                                                          */
+    POWERPC_DEF("MPC8266_HiP4",  CPU_POWERPC_MPC8266_HiP4,           G2),
+    /* MPC8270                                                               */
+    POWERPC_DEF("MPC8270",       CPU_POWERPC_MPC8270,                G2LE),
+    /* MPC8271                                                               */
+    POWERPC_DEF("MPC8271",       CPU_POWERPC_MPC8271,                G2LE),
+    /* MPC8272                                                               */
+    POWERPC_DEF("MPC8272",       CPU_POWERPC_MPC8272,                G2LE),
+    /* MPC8275                                                               */
+    POWERPC_DEF("MPC8275",       CPU_POWERPC_MPC8275,                G2LE),
+    /* MPC8280                                                               */
+    POWERPC_DEF("MPC8280",       CPU_POWERPC_MPC8280,                G2LE),
     /* e200 family                                                           */
-#if defined (TODO)
     /* Generic PowerPC e200 core                                             */
-    POWERPC_DEF("e200",        CPU_POWERPC_e200,        0xFFFFFFFF, e200),
+    POWERPC_DEF("e200",          CPU_POWERPC_e200,                   e200),
+    /* Generic MPC55xx core                                                  */
+#if defined (TODO)
+    POWERPC_DEF_SVR("MPC55xx",
+                    CPU_POWERPC_MPC55xx,      POWERPC_SVR_55xx,      e200),
 #endif
 #if defined (TODO)
-    /* PowerPC e200z5 core                                                   */
-    POWERPC_DEF("e200z5",      CPU_POWERPC_e200z5,      0xFFFFFFFF, e200),
+    /* PowerPC e200z0 core                                                   */
+    POWERPC_DEF("e200z0",        CPU_POWERPC_e200z0,                 e200),
+#endif
+#if defined (TODO)
+    /* PowerPC e200z1 core                                                   */
+    POWERPC_DEF("e200z1",        CPU_POWERPC_e200z1,                 e200),
 #endif
 #if defined (TODO)
+    /* PowerPC e200z3 core                                                   */
+    POWERPC_DEF("e200z3",        CPU_POWERPC_e200z3,                 e200),
+#endif
+    /* PowerPC e200z5 core                                                   */
+    POWERPC_DEF("e200z5",        CPU_POWERPC_e200z5,                 e200),
     /* PowerPC e200z6 core                                                   */
-    POWERPC_DEF("e200z6",      CPU_POWERPC_e200z6,      0xFFFFFFFF, e200),
+    POWERPC_DEF("e200z6",        CPU_POWERPC_e200z6,                 e200),
+    /* PowerPC e200 microcontrollers                                         */
+#if defined (TODO)
+    /* MPC5514E                                                              */
+    POWERPC_DEF_SVR("MPC5514E",
+                    CPU_POWERPC_MPC5514E,     POWERPC_SVR_5514E,     e200),
 #endif
-    /* e300 family                                                           */
 #if defined (TODO)
-    /* Generic PowerPC e300 core                                             */
-    POWERPC_DEF("e300",        CPU_POWERPC_e300,        0xFFFFFFFF, e300),
+    /* MPC5514E v0                                                           */
+    POWERPC_DEF_SVR("MPC5514E_v0",
+                    CPU_POWERPC_MPC5514E_v0,  POWERPC_SVR_5514E_v0,  e200),
 #endif
 #if defined (TODO)
-    /* PowerPC e300c1 core                                                   */
-    POWERPC_DEF("e300c1",      CPU_POWERPC_e300c1,      0xFFFFFFFF, e300),
+    /* MPC5514E v1                                                           */
+    POWERPC_DEF_SVR("MPC5514E_v1",
+                    CPU_POWERPC_MPC5514E_v1,  POWERPC_SVR_5514E_v1,  e200),
 #endif
 #if defined (TODO)
-    /* PowerPC e300c2 core                                                   */
-    POWERPC_DEF("e300c2",      CPU_POWERPC_e300c2,      0xFFFFFFFF, e300),
+    /* MPC5514G                                                              */
+    POWERPC_DEF_SVR("MPC5514G",
+                    CPU_POWERPC_MPC5514G,     POWERPC_SVR_5514G,     e200),
 #endif
 #if defined (TODO)
-    /* PowerPC e300c3 core                                                   */
-    POWERPC_DEF("e300c3",      CPU_POWERPC_e300c3,      0xFFFFFFFF, e300),
+    /* MPC5514G v0                                                           */
+    POWERPC_DEF_SVR("MPC5514G_v0",
+                    CPU_POWERPC_MPC5514G_v0,  POWERPC_SVR_5514G_v0,  e200),
 #endif
-    /* e500 family                                                           */
 #if defined (TODO)
-    /* PowerPC e500 core                                                     */
-    POWERPC_DEF("e500",        CPU_POWERPC_e500,        0xFFFFFFFF, e500),
+    /* MPC5514G v1                                                           */
+    POWERPC_DEF_SVR("MPC5514G_v1",
+                    CPU_POWERPC_MPC5514G_v1,  POWERPC_SVR_5514G_v1,  e200),
 #endif
 #if defined (TODO)
-    /* PowerPC e500 v1.1 core                                                */
-    POWERPC_DEF("e500v1.1",    CPU_POWERPC_e500_v11,    0xFFFFFFFF, e500),
+    /* MPC5515S                                                              */
+    POWERPC_DEF_SVR("MPC5515S",
+                    CPU_POWERPC_MPC5515S,     POWERPC_SVR_5515S,     e200),
 #endif
 #if defined (TODO)
-    /* PowerPC e500 v1.2 core                                                */
-    POWERPC_DEF("e500v1.2",    CPU_POWERPC_e500_v12,    0xFFFFFFFF, e500),
+    /* MPC5516E                                                              */
+    POWERPC_DEF_SVR("MPC5516E",
+                    CPU_POWERPC_MPC5516E,     POWERPC_SVR_5516E,     e200),
 #endif
 #if defined (TODO)
-    /* PowerPC e500 v2.1 core                                                */
-    POWERPC_DEF("e500v2.1",    CPU_POWERPC_e500_v21,    0xFFFFFFFF, e500),
+    /* MPC5516E v0                                                           */
+    POWERPC_DEF_SVR("MPC5516E_v0",
+                    CPU_POWERPC_MPC5516E_v0,  POWERPC_SVR_5516E_v0,  e200),
 #endif
 #if defined (TODO)
-    /* PowerPC e500 v2.2 core                                                */
-    POWERPC_DEF("e500v2.2",    CPU_POWERPC_e500_v22,    0xFFFFFFFF, e500),
+    /* MPC5516E v1                                                           */
+    POWERPC_DEF_SVR("MPC5516E_v1",
+                    CPU_POWERPC_MPC5516E_v1,  POWERPC_SVR_5516E_v1,  e200),
 #endif
-    /* e600 family                                                           */
 #if defined (TODO)
-    /* PowerPC e600 core                                                     */
-    POWERPC_DEF("e600",        CPU_POWERPC_e600,        0xFFFFFFFF, e600),
+    /* MPC5516G                                                              */
+    POWERPC_DEF_SVR("MPC5516G",
+                    CPU_POWERPC_MPC5516G,     POWERPC_SVR_5516G,     e200),
 #endif
-    /* PowerPC MPC 5xx cores                                                 */
 #if defined (TODO)
-    /* PowerPC MPC 5xx                                                       */
-    POWERPC_DEF("mpc5xx",      CPU_POWERPC_5xx,         0xFFFFFFFF, 5xx),
+    /* MPC5516G v0                                                           */
+    POWERPC_DEF_SVR("MPC5516G_v0",
+                    CPU_POWERPC_MPC5516G_v0,  POWERPC_SVR_5516G_v0,  e200),
 #endif
-    /* PowerPC MPC 8xx cores                                                 */
 #if defined (TODO)
-    /* PowerPC MPC 8xx                                                       */
-    POWERPC_DEF("mpc8xx",      CPU_POWERPC_8xx,         0xFFFFFFFF, 8xx),
+    /* MPC5516G v1                                                           */
+    POWERPC_DEF_SVR("MPC5516G_v1",
+                    CPU_POWERPC_MPC5516G_v1,  POWERPC_SVR_5516G_v1,  e200),
 #endif
-    /* PowerPC MPC 8xxx cores                                                */
 #if defined (TODO)
-    /* PowerPC MPC 82xx HIP3                                                 */
-    POWERPC_DEF("mpc82xxhip3", CPU_POWERPC_82xx_HIP3,   0xFFFFFFFF, 82xx),
+    /* MPC5516S                                                              */
+    POWERPC_DEF_SVR("MPC5516S",
+                    CPU_POWERPC_MPC5516S,     POWERPC_SVR_5516S,     e200),
 #endif
 #if defined (TODO)
-    /* PowerPC MPC 82xx HIP4                                                 */
-    POWERPC_DEF("mpc82xxhip4", CPU_POWERPC_82xx_HIP4,   0xFFFFFFFF, 82xx),
+    /* MPC5533                                                               */
+    POWERPC_DEF_SVR("MPC5533",
+                    CPU_POWERPC_MPC5533,      POWERPC_SVR_5533,      e200),
 #endif
 #if defined (TODO)
-    /* PowerPC MPC 827x                                                      */
-    POWERPC_DEF("mpc827x",     CPU_POWERPC_827x,        0xFFFFFFFF, 827x),
+    /* MPC5534                                                               */
+    POWERPC_DEF_SVR("MPC5534",
+                    CPU_POWERPC_MPC5534,      POWERPC_SVR_5534,      e200),
 #endif
-
+#if defined (TODO)
+    /* MPC5553                                                               */
+    POWERPC_DEF_SVR("MPC5553",
+                    CPU_POWERPC_MPC5553,      POWERPC_SVR_5553,      e200),
+#endif
+#if defined (TODO)
+    /* MPC5554                                                               */
+    POWERPC_DEF_SVR("MPC5554",
+                    CPU_POWERPC_MPC5554,      POWERPC_SVR_5554,      e200),
+#endif
+#if defined (TODO)
+    /* MPC5561                                                               */
+    POWERPC_DEF_SVR("MPC5561",
+                    CPU_POWERPC_MPC5561,      POWERPC_SVR_5561,      e200),
+#endif
+#if defined (TODO)
+    /* MPC5565                                                               */
+    POWERPC_DEF_SVR("MPC5565",
+                    CPU_POWERPC_MPC5565,      POWERPC_SVR_5565,      e200),
+#endif
+#if defined (TODO)
+    /* MPC5566                                                               */
+    POWERPC_DEF_SVR("MPC5566",
+                    CPU_POWERPC_MPC5566,      POWERPC_SVR_5566,      e200),
+#endif
+#if defined (TODO)
+    /* MPC5567                                                               */
+    POWERPC_DEF_SVR("MPC5567",
+                    CPU_POWERPC_MPC5567,      POWERPC_SVR_5567,      e200),
+#endif
+    /* e300 family                                                           */
+    /* Generic PowerPC e300 core                                             */
+    POWERPC_DEF("e300",          CPU_POWERPC_e300,                   e300),
+    /* PowerPC e300c1 core                                                   */
+    POWERPC_DEF("e300c1",        CPU_POWERPC_e300c1,                 e300),
+    /* PowerPC e300c2 core                                                   */
+    POWERPC_DEF("e300c2",        CPU_POWERPC_e300c2,                 e300),
+    /* PowerPC e300c3 core                                                   */
+    POWERPC_DEF("e300c3",        CPU_POWERPC_e300c3,                 e300),
+    /* PowerPC e300c4 core                                                   */
+    POWERPC_DEF("e300c4",        CPU_POWERPC_e300c4,                 e300),
+    /* PowerPC e300 microcontrollers                                         */
+#if defined (TODO)
+    /* MPC8313                                                               */
+    POWERPC_DEF_SVR("MPC8313",
+                    CPU_POWERPC_MPC8313,      POWERPC_SVR_8313,      e300),
+#endif
+#if defined (TODO)
+    /* MPC8313E                                                              */
+    POWERPC_DEF_SVR("MPC8313E",
+                    CPU_POWERPC_MPC8313E,     POWERPC_SVR_8313E,     e300),
+#endif
+#if defined (TODO)
+    /* MPC8314                                                               */
+    POWERPC_DEF_SVR("MPC8314",
+                    CPU_POWERPC_MPC8314,      POWERPC_SVR_8314,      e300),
+#endif
+#if defined (TODO)
+    /* MPC8314E                                                              */
+    POWERPC_DEF_SVR("MPC8314E",
+                    CPU_POWERPC_MPC8314E,     POWERPC_SVR_8314E,     e300),
+#endif
+#if defined (TODO)
+    /* MPC8315                                                               */
+    POWERPC_DEF_SVR("MPC8315",
+                    CPU_POWERPC_MPC8315,      POWERPC_SVR_8315,      e300),
+#endif
+#if defined (TODO)
+    /* MPC8315E                                                              */
+    POWERPC_DEF_SVR("MPC8315E",
+                    CPU_POWERPC_MPC8315E,     POWERPC_SVR_8315E,     e300),
+#endif
+#if defined (TODO)
+    /* MPC8321                                                               */
+    POWERPC_DEF_SVR("MPC8321",
+                    CPU_POWERPC_MPC8321,      POWERPC_SVR_8321,      e300),
+#endif
+#if defined (TODO)
+    /* MPC8321E                                                              */
+    POWERPC_DEF_SVR("MPC8321E",
+                    CPU_POWERPC_MPC8321E,     POWERPC_SVR_8321E,     e300),
+#endif
+#if defined (TODO)
+    /* MPC8323                                                               */
+    POWERPC_DEF_SVR("MPC8323",
+                    CPU_POWERPC_MPC8323,      POWERPC_SVR_8323,      e300),
+#endif
+#if defined (TODO)
+    /* MPC8323E                                                              */
+    POWERPC_DEF_SVR("MPC8323E",
+                    CPU_POWERPC_MPC8323E,     POWERPC_SVR_8323E,     e300),
+#endif
+    /* MPC8343A                                                              */
+    POWERPC_DEF_SVR("MPC8343A",
+                    CPU_POWERPC_MPC8343A,     POWERPC_SVR_8343A,     e300),
+    /* MPC8343EA                                                             */
+    POWERPC_DEF_SVR("MPC8343EA",
+                    CPU_POWERPC_MPC8343EA,    POWERPC_SVR_8343EA,    e300),
+    /* MPC8347A                                                              */
+    POWERPC_DEF_SVR("MPC8347A",
+                    CPU_POWERPC_MPC8347A,     POWERPC_SVR_8347A,     e300),
+    /* MPC8347AT                                                             */
+    POWERPC_DEF_SVR("MPC8347AT",
+                    CPU_POWERPC_MPC8347AT,    POWERPC_SVR_8347AT,    e300),
+    /* MPC8347AP                                                             */
+    POWERPC_DEF_SVR("MPC8347AP",
+                    CPU_POWERPC_MPC8347AP,    POWERPC_SVR_8347AP,    e300),
+    /* MPC8347EA                                                             */
+    POWERPC_DEF_SVR("MPC8347EA",
+                    CPU_POWERPC_MPC8347EA,    POWERPC_SVR_8347EA,    e300),
+    /* MPC8347EAT                                                            */
+    POWERPC_DEF_SVR("MPC8347EAT",
+                    CPU_POWERPC_MPC8347EAT,   POWERPC_SVR_8347EAT,   e300),
+    /* MPC8343EAP                                                            */
+    POWERPC_DEF_SVR("MPC8347EAP",
+                    CPU_POWERPC_MPC8347EAP,   POWERPC_SVR_8347EAP,   e300),
+    /* MPC8349                                                               */
+    POWERPC_DEF_SVR("MPC8349",
+                    CPU_POWERPC_MPC8349,      POWERPC_SVR_8349,      e300),
+    /* MPC8349A                                                              */
+    POWERPC_DEF_SVR("MPC8349A",
+                    CPU_POWERPC_MPC8349A,     POWERPC_SVR_8349A,     e300),
+    /* MPC8349E                                                              */
+    POWERPC_DEF_SVR("MPC8349E",
+                    CPU_POWERPC_MPC8349E,     POWERPC_SVR_8349E,     e300),
+    /* MPC8349EA                                                             */
+    POWERPC_DEF_SVR("MPC8349EA",
+                    CPU_POWERPC_MPC8349EA,    POWERPC_SVR_8349EA,    e300),
+#if defined (TODO)
+    /* MPC8358E                                                              */
+    POWERPC_DEF_SVR("MPC8358E",
+                    CPU_POWERPC_MPC8358E,     POWERPC_SVR_8358E,     e300),
+#endif
+#if defined (TODO)
+    /* MPC8360E                                                              */
+    POWERPC_DEF_SVR("MPC8360E",
+                    CPU_POWERPC_MPC8360E,     POWERPC_SVR_8360E,     e300),
+#endif
+    /* MPC8377                                                               */
+    POWERPC_DEF_SVR("MPC8377",
+                    CPU_POWERPC_MPC8377,      POWERPC_SVR_8377,      e300),
+    /* MPC8377E                                                              */
+    POWERPC_DEF_SVR("MPC8377E",
+                    CPU_POWERPC_MPC8377E,     POWERPC_SVR_8377E,     e300),
+    /* MPC8378                                                               */
+    POWERPC_DEF_SVR("MPC8378",
+                    CPU_POWERPC_MPC8378,      POWERPC_SVR_8378,      e300),
+    /* MPC8378E                                                              */
+    POWERPC_DEF_SVR("MPC8378E",
+                    CPU_POWERPC_MPC8378E,     POWERPC_SVR_8378E,     e300),
+    /* MPC8379                                                               */
+    POWERPC_DEF_SVR("MPC8379",
+                    CPU_POWERPC_MPC8379,      POWERPC_SVR_8379,      e300),
+    /* MPC8379E                                                              */
+    POWERPC_DEF_SVR("MPC8379E",
+                    CPU_POWERPC_MPC8379E,     POWERPC_SVR_8379E,     e300),
+    /* e500 family                                                           */
+    /* PowerPC e500 core                                                     */
+    POWERPC_DEF("e500",          CPU_POWERPC_e500,                   e500),
+    /* PowerPC e500 v1.0 core                                                */
+    POWERPC_DEF("e500_v10",      CPU_POWERPC_e500_v10,               e500),
+    /* PowerPC e500 v2.0 core                                                */
+    POWERPC_DEF("e500_v20",      CPU_POWERPC_e500_v20,               e500),
+    /* PowerPC e500v2 core                                                   */
+    POWERPC_DEF("e500v2",        CPU_POWERPC_e500v2,                 e500),
+    /* PowerPC e500v2 v1.0 core                                              */
+    POWERPC_DEF("e500v2_v10",    CPU_POWERPC_e500v2_v10,             e500),
+    /* PowerPC e500v2 v2.0 core                                              */
+    POWERPC_DEF("e500v2_v20",    CPU_POWERPC_e500v2_v20,             e500),
+    /* PowerPC e500v2 v2.1 core                                              */
+    POWERPC_DEF("e500v2_v21",    CPU_POWERPC_e500v2_v21,             e500),
+    /* PowerPC e500v2 v2.2 core                                              */
+    POWERPC_DEF("e500v2_v22",    CPU_POWERPC_e500v2_v22,             e500),
+    /* PowerPC e500v2 v3.0 core                                              */
+    POWERPC_DEF("e500v2_v30",    CPU_POWERPC_e500v2_v30,             e500),
+    /* PowerPC e500 microcontrollers                                         */
+    /* MPC8533                                                               */
+    POWERPC_DEF_SVR("MPC8533",
+                    CPU_POWERPC_MPC8533,      POWERPC_SVR_8533,      e500),
+    /* MPC8533 v1.0                                                          */
+    POWERPC_DEF_SVR("MPC8533_v10",
+                    CPU_POWERPC_MPC8533_v10,  POWERPC_SVR_8533_v10,  e500),
+    /* MPC8533 v1.1                                                          */
+    POWERPC_DEF_SVR("MPC8533_v11",
+                    CPU_POWERPC_MPC8533_v11,  POWERPC_SVR_8533_v11,  e500),
+    /* MPC8533E                                                              */
+    POWERPC_DEF_SVR("MPC8533E",
+                    CPU_POWERPC_MPC8533E,     POWERPC_SVR_8533E,     e500),
+    /* MPC8533E v1.0                                                         */
+    POWERPC_DEF_SVR("MPC8533E_v10",
+                    CPU_POWERPC_MPC8533E_v10, POWERPC_SVR_8533E_v10, e500),
+    POWERPC_DEF_SVR("MPC8533E_v11",
+                    CPU_POWERPC_MPC8533E_v11, POWERPC_SVR_8533E_v11, e500),
+    /* MPC8540                                                               */
+    POWERPC_DEF_SVR("MPC8540",
+                    CPU_POWERPC_MPC8540,      POWERPC_SVR_8540,      e500),
+    /* MPC8540 v1.0                                                          */
+    POWERPC_DEF_SVR("MPC8540_v10",
+                    CPU_POWERPC_MPC8540_v10,  POWERPC_SVR_8540_v10,  e500),
+    /* MPC8540 v2.0                                                          */
+    POWERPC_DEF_SVR("MPC8540_v20",
+                    CPU_POWERPC_MPC8540_v20,  POWERPC_SVR_8540_v20,  e500),
+    /* MPC8540 v2.1                                                          */
+    POWERPC_DEF_SVR("MPC8540_v21",
+                    CPU_POWERPC_MPC8540_v21,  POWERPC_SVR_8540_v21,  e500),
+    /* MPC8541                                                               */
+    POWERPC_DEF_SVR("MPC8541",
+                    CPU_POWERPC_MPC8541,      POWERPC_SVR_8541,      e500),
+    /* MPC8541 v1.0                                                          */
+    POWERPC_DEF_SVR("MPC8541_v10",
+                    CPU_POWERPC_MPC8541_v10,  POWERPC_SVR_8541_v10,  e500),
+    /* MPC8541 v1.1                                                          */
+    POWERPC_DEF_SVR("MPC8541_v11",
+                    CPU_POWERPC_MPC8541_v11,  POWERPC_SVR_8541_v11,  e500),
+    /* MPC8541E                                                              */
+    POWERPC_DEF_SVR("MPC8541E",
+                    CPU_POWERPC_MPC8541E,     POWERPC_SVR_8541E,     e500),
+    /* MPC8541E v1.0                                                         */
+    POWERPC_DEF_SVR("MPC8541E_v10",
+                    CPU_POWERPC_MPC8541E_v10, POWERPC_SVR_8541E_v10, e500),
+    /* MPC8541E v1.1                                                         */
+    POWERPC_DEF_SVR("MPC8541E_v11",
+                    CPU_POWERPC_MPC8541E_v11, POWERPC_SVR_8541E_v11, e500),
+    /* MPC8543                                                               */
+    POWERPC_DEF_SVR("MPC8543",
+                    CPU_POWERPC_MPC8543,      POWERPC_SVR_8543,      e500),
+    /* MPC8543 v1.0                                                          */
+    POWERPC_DEF_SVR("MPC8543_v10",
+                    CPU_POWERPC_MPC8543_v10,  POWERPC_SVR_8543_v10,  e500),
+    /* MPC8543 v1.1                                                          */
+    POWERPC_DEF_SVR("MPC8543_v11",
+                    CPU_POWERPC_MPC8543_v11,  POWERPC_SVR_8543_v11,  e500),
+    /* MPC8543 v2.0                                                          */
+    POWERPC_DEF_SVR("MPC8543_v20",
+                    CPU_POWERPC_MPC8543_v20,  POWERPC_SVR_8543_v20,  e500),
+    /* MPC8543 v2.1                                                          */
+    POWERPC_DEF_SVR("MPC8543_v21",
+                    CPU_POWERPC_MPC8543_v21,  POWERPC_SVR_8543_v21,  e500),
+    /* MPC8543E                                                              */
+    POWERPC_DEF_SVR("MPC8543E",
+                    CPU_POWERPC_MPC8543E,     POWERPC_SVR_8543E,     e500),
+    /* MPC8543E v1.0                                                         */
+    POWERPC_DEF_SVR("MPC8543E_v10",
+                    CPU_POWERPC_MPC8543E_v10, POWERPC_SVR_8543E_v10, e500),
+    /* MPC8543E v1.1                                                         */
+    POWERPC_DEF_SVR("MPC8543E_v11",
+                    CPU_POWERPC_MPC8543E_v11, POWERPC_SVR_8543E_v11, e500),
+    /* MPC8543E v2.0                                                         */
+    POWERPC_DEF_SVR("MPC8543E_v20",
+                    CPU_POWERPC_MPC8543E_v20, POWERPC_SVR_8543E_v20, e500),
+    /* MPC8543E v2.1                                                         */
+    POWERPC_DEF_SVR("MPC8543E_v21",
+                    CPU_POWERPC_MPC8543E_v21, POWERPC_SVR_8543E_v21, e500),
+    /* MPC8544                                                               */
+    POWERPC_DEF_SVR("MPC8544",
+                    CPU_POWERPC_MPC8544,      POWERPC_SVR_8544,      e500),
+    /* MPC8544 v1.0                                                          */
+    POWERPC_DEF_SVR("MPC8544_v10",
+                    CPU_POWERPC_MPC8544_v10,  POWERPC_SVR_8544_v10,  e500),
+    /* MPC8544 v1.1                                                          */
+    POWERPC_DEF_SVR("MPC8544_v11",
+                    CPU_POWERPC_MPC8544_v11,  POWERPC_SVR_8544_v11,  e500),
+    /* MPC8544E                                                              */
+    POWERPC_DEF_SVR("MPC8544E",
+                    CPU_POWERPC_MPC8544E,     POWERPC_SVR_8544E,     e500),
+    /* MPC8544E v1.0                                                         */
+    POWERPC_DEF_SVR("MPC8544E_v10",
+                    CPU_POWERPC_MPC8544E_v10, POWERPC_SVR_8544E_v10, e500),
+    /* MPC8544E v1.1                                                         */
+    POWERPC_DEF_SVR("MPC8544E_v11",
+                    CPU_POWERPC_MPC8544E_v11, POWERPC_SVR_8544E_v11, e500),
+    /* MPC8545                                                               */
+    POWERPC_DEF_SVR("MPC8545",
+                    CPU_POWERPC_MPC8545,      POWERPC_SVR_8545,      e500),
+    /* MPC8545 v2.0                                                          */
+    POWERPC_DEF_SVR("MPC8545_v20",
+                    CPU_POWERPC_MPC8545_v20,  POWERPC_SVR_8545_v20,  e500),
+    /* MPC8545 v2.1                                                          */
+    POWERPC_DEF_SVR("MPC8545_v21",
+                    CPU_POWERPC_MPC8545_v21,  POWERPC_SVR_8545_v21,  e500),
+    /* MPC8545E                                                              */
+    POWERPC_DEF_SVR("MPC8545E",
+                    CPU_POWERPC_MPC8545E,     POWERPC_SVR_8545E,     e500),
+    /* MPC8545E v2.0                                                         */
+    POWERPC_DEF_SVR("MPC8545E_v20",
+                    CPU_POWERPC_MPC8545E_v20, POWERPC_SVR_8545E_v20, e500),
+    /* MPC8545E v2.1                                                         */
+    POWERPC_DEF_SVR("MPC8545E_v21",
+                    CPU_POWERPC_MPC8545E_v21, POWERPC_SVR_8545E_v21, e500),
+    /* MPC8547E                                                              */
+    POWERPC_DEF_SVR("MPC8547E",
+                    CPU_POWERPC_MPC8547E,     POWERPC_SVR_8547E,     e500),
+    /* MPC8547E v2.0                                                         */
+    POWERPC_DEF_SVR("MPC8547E_v20",
+                    CPU_POWERPC_MPC8547E_v20, POWERPC_SVR_8547E_v20, e500),
+    /* MPC8547E v2.1                                                         */
+    POWERPC_DEF_SVR("MPC8547E_v21",
+                    CPU_POWERPC_MPC8547E_v21, POWERPC_SVR_8547E_v21, e500),
+    /* MPC8548                                                               */
+    POWERPC_DEF_SVR("MPC8548",
+                    CPU_POWERPC_MPC8548,      POWERPC_SVR_8548,      e500),
+    /* MPC8548 v1.0                                                          */
+    POWERPC_DEF_SVR("MPC8548_v10",
+                    CPU_POWERPC_MPC8548_v10,  POWERPC_SVR_8548_v10,  e500),
+    /* MPC8548 v1.1                                                          */
+    POWERPC_DEF_SVR("MPC8548_v11",
+                    CPU_POWERPC_MPC8548_v11,  POWERPC_SVR_8548_v11,  e500),
+    /* MPC8548 v2.0                                                          */
+    POWERPC_DEF_SVR("MPC8548_v20",
+                    CPU_POWERPC_MPC8548_v20,  POWERPC_SVR_8548_v20,  e500),
+    /* MPC8548 v2.1                                                          */
+    POWERPC_DEF_SVR("MPC8548_v21",
+                    CPU_POWERPC_MPC8548_v21,  POWERPC_SVR_8548_v21,  e500),
+    /* MPC8548E                                                              */
+    POWERPC_DEF_SVR("MPC8548E",
+                    CPU_POWERPC_MPC8548E,     POWERPC_SVR_8548E,     e500),
+    /* MPC8548E v1.0                                                         */
+    POWERPC_DEF_SVR("MPC8548E_v10",
+                    CPU_POWERPC_MPC8548E_v10, POWERPC_SVR_8548E_v10, e500),
+    /* MPC8548E v1.1                                                         */
+    POWERPC_DEF_SVR("MPC8548E_v11",
+                    CPU_POWERPC_MPC8548E_v11, POWERPC_SVR_8548E_v11, e500),
+    /* MPC8548E v2.0                                                         */
+    POWERPC_DEF_SVR("MPC8548E_v20",
+                    CPU_POWERPC_MPC8548E_v20, POWERPC_SVR_8548E_v20, e500),
+    /* MPC8548E v2.1                                                         */
+    POWERPC_DEF_SVR("MPC8548E_v21",
+                    CPU_POWERPC_MPC8548E_v21, POWERPC_SVR_8548E_v21, e500),
+    /* MPC8555                                                               */
+    POWERPC_DEF_SVR("MPC8555",
+                    CPU_POWERPC_MPC8555,      POWERPC_SVR_8555,      e500),
+    /* MPC8555 v1.0                                                          */
+    POWERPC_DEF_SVR("MPC8555_v10",
+                    CPU_POWERPC_MPC8555_v10,  POWERPC_SVR_8555_v10,  e500),
+    /* MPC8555 v1.1                                                          */
+    POWERPC_DEF_SVR("MPC8555_v11",
+                    CPU_POWERPC_MPC8555_v11,  POWERPC_SVR_8555_v11,  e500),
+    /* MPC8555E                                                              */
+    POWERPC_DEF_SVR("MPC8555E",
+                    CPU_POWERPC_MPC8555E,     POWERPC_SVR_8555E,     e500),
+    /* MPC8555E v1.0                                                         */
+    POWERPC_DEF_SVR("MPC8555E_v10",
+                    CPU_POWERPC_MPC8555E_v10, POWERPC_SVR_8555E_v10, e500),
+    /* MPC8555E v1.1                                                         */
+    POWERPC_DEF_SVR("MPC8555E_v11",
+                    CPU_POWERPC_MPC8555E_v11, POWERPC_SVR_8555E_v11, e500),
+    /* MPC8560                                                               */
+    POWERPC_DEF_SVR("MPC8560",
+                    CPU_POWERPC_MPC8560,      POWERPC_SVR_8560,      e500),
+    /* MPC8560 v1.0                                                          */
+    POWERPC_DEF_SVR("MPC8560_v10",
+                    CPU_POWERPC_MPC8560_v10,  POWERPC_SVR_8560_v10,  e500),
+    /* MPC8560 v2.0                                                          */
+    POWERPC_DEF_SVR("MPC8560_v20",
+                    CPU_POWERPC_MPC8560_v20,  POWERPC_SVR_8560_v20,  e500),
+    /* MPC8560 v2.1                                                          */
+    POWERPC_DEF_SVR("MPC8560_v21",
+                    CPU_POWERPC_MPC8560_v21,  POWERPC_SVR_8560_v21,  e500),
+    /* MPC8567                                                               */
+    POWERPC_DEF_SVR("MPC8567",
+                    CPU_POWERPC_MPC8567,      POWERPC_SVR_8567,      e500),
+    /* MPC8567E                                                              */
+    POWERPC_DEF_SVR("MPC8567E",
+                    CPU_POWERPC_MPC8567E,     POWERPC_SVR_8567E,     e500),
+    /* MPC8568                                                               */
+    POWERPC_DEF_SVR("MPC8568",
+                    CPU_POWERPC_MPC8568,      POWERPC_SVR_8568,      e500),
+    /* MPC8568E                                                              */
+    POWERPC_DEF_SVR("MPC8568E",
+                    CPU_POWERPC_MPC8568E,     POWERPC_SVR_8568E,     e500),
+    /* MPC8572                                                               */
+    POWERPC_DEF_SVR("MPC8572",
+                    CPU_POWERPC_MPC8572,      POWERPC_SVR_8572,      e500),
+    /* MPC8572E                                                              */
+    POWERPC_DEF_SVR("MPC8572E",
+                    CPU_POWERPC_MPC8572E,     POWERPC_SVR_8572E,     e500),
+    /* e600 family                                                           */
+    /* PowerPC e600 core                                                     */
+    POWERPC_DEF("e600",          CPU_POWERPC_e600,                   7400),
+    /* PowerPC e600 microcontrollers                                         */
+#if defined (TODO)
+    /* MPC8610                                                               */
+    POWERPC_DEF_SVR("MPC8610",
+                    CPU_POWERPC_MPC8610,      POWERPC_SVR_8610,      7400),
+#endif
+    /* MPC8641                                                               */
+    POWERPC_DEF_SVR("MPC8641",
+                    CPU_POWERPC_MPC8641,      POWERPC_SVR_8641,      7400),
+    /* MPC8641D                                                              */
+    POWERPC_DEF_SVR("MPC8641D",
+                    CPU_POWERPC_MPC8641D,     POWERPC_SVR_8641D,     7400),
     /* 32 bits "classic" PowerPC                                             */
     /* PowerPC 6xx family                                                    */
     /* PowerPC 601                                                           */
-    POWERPC_DEF("601",         CPU_POWERPC_601,         0xFFFFFFFF, 601),
+    POWERPC_DEF("601",           CPU_POWERPC_601,                    601v),
+    /* PowerPC 601v0                                                         */
+    POWERPC_DEF("601_v0",        CPU_POWERPC_601_v0,                 601),
+    /* PowerPC 601v1                                                         */
+    POWERPC_DEF("601_v1",        CPU_POWERPC_601_v1,                 601),
+    /* PowerPC 601v                                                          */
+    POWERPC_DEF("601v",          CPU_POWERPC_601v,                   601v),
     /* PowerPC 601v2                                                         */
-    POWERPC_DEF("601a",        CPU_POWERPC_601a,        0xFFFFFFFF, 601),
+    POWERPC_DEF("601_v2",        CPU_POWERPC_601_v2,                 601v),
     /* PowerPC 602                                                           */
-    POWERPC_DEF("602",         CPU_POWERPC_602,         0xFFFFFFFF, 602),
+    POWERPC_DEF("602",           CPU_POWERPC_602,                    602),
     /* PowerPC 603                                                           */
-    POWERPC_DEF("603",         CPU_POWERPC_603,         0xFFFFFFFF, 603),
+    POWERPC_DEF("603",           CPU_POWERPC_603,                    603),
     /* Code name for PowerPC 603                                             */
-    POWERPC_DEF("Vanilla",     CPU_POWERPC_603,         0xFFFFFFFF, 603),
-    /* PowerPC 603e                                                          */
-    POWERPC_DEF("603e",        CPU_POWERPC_603E,        0xFFFFFFFF, 603E),
+    POWERPC_DEF("Vanilla",       CPU_POWERPC_603,                    603),
+    /* PowerPC 603e (aka PID6)                                               */
+    POWERPC_DEF("603e",          CPU_POWERPC_603E,                   603E),
     /* Code name for PowerPC 603e                                            */
-    POWERPC_DEF("Stretch",     CPU_POWERPC_603E,        0xFFFFFFFF, 603E),
+    POWERPC_DEF("Stretch",       CPU_POWERPC_603E,                   603E),
     /* PowerPC 603e v1.1                                                     */
-    POWERPC_DEF("603e1.1",     CPU_POWERPC_603E_v11,    0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e_v1.1",     CPU_POWERPC_603E_v11,               603E),
     /* PowerPC 603e v1.2                                                     */
-    POWERPC_DEF("603e1.2",     CPU_POWERPC_603E_v12,    0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e_v1.2",     CPU_POWERPC_603E_v12,               603E),
     /* PowerPC 603e v1.3                                                     */
-    POWERPC_DEF("603e1.3",     CPU_POWERPC_603E_v13,    0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e_v1.3",     CPU_POWERPC_603E_v13,               603E),
     /* PowerPC 603e v1.4                                                     */
-    POWERPC_DEF("603e1.4",     CPU_POWERPC_603E_v14,    0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e_v1.4",     CPU_POWERPC_603E_v14,               603E),
     /* PowerPC 603e v2.2                                                     */
-    POWERPC_DEF("603e2.2",     CPU_POWERPC_603E_v22,    0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e_v2.2",     CPU_POWERPC_603E_v22,               603E),
     /* PowerPC 603e v3                                                       */
-    POWERPC_DEF("603e3",       CPU_POWERPC_603E_v3,     0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e_v3",       CPU_POWERPC_603E_v3,                603E),
     /* PowerPC 603e v4                                                       */
-    POWERPC_DEF("603e4",       CPU_POWERPC_603E_v4,     0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e_v4",       CPU_POWERPC_603E_v4,                603E),
     /* PowerPC 603e v4.1                                                     */
-    POWERPC_DEF("603e4.1",     CPU_POWERPC_603E_v41,    0xFFFFFFFF, 603E),
-    /* PowerPC 603e                                                          */
-    POWERPC_DEF("603e7",       CPU_POWERPC_603E7,       0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e_v4.1",     CPU_POWERPC_603E_v41,               603E),
+    /* PowerPC 603e (aka PID7)                                               */
+    POWERPC_DEF("603e7",         CPU_POWERPC_603E7,                  603E),
     /* PowerPC 603e7t                                                        */
-    POWERPC_DEF("603e7t",      CPU_POWERPC_603E7t,      0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e7t",        CPU_POWERPC_603E7t,                 603E),
     /* PowerPC 603e7v                                                        */
-    POWERPC_DEF("603e7v",      CPU_POWERPC_603E7v,      0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e7v",        CPU_POWERPC_603E7v,                 603E),
     /* Code name for PowerPC 603ev                                           */
-    POWERPC_DEF("Vaillant",    CPU_POWERPC_603E7v,      0xFFFFFFFF, 603E),
+    POWERPC_DEF("Vaillant",      CPU_POWERPC_603E7v,                 603E),
     /* PowerPC 603e7v1                                                       */
-    POWERPC_DEF("603e7v1",     CPU_POWERPC_603E7v1,     0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e7v1",       CPU_POWERPC_603E7v1,                603E),
     /* PowerPC 603e7v2                                                       */
-    POWERPC_DEF("603e7v2",     CPU_POWERPC_603E7v2,     0xFFFFFFFF, 603E),
-    /* PowerPC 603p                                                          */
-    /* to be checked */
-    POWERPC_DEF("603p",        CPU_POWERPC_603P,        0xFFFFFFFF, 603),
-    /* PowerPC 603r                                                          */
-    POWERPC_DEF("603r",        CPU_POWERPC_603R,        0xFFFFFFFF, 603E),
+    POWERPC_DEF("603e7v2",       CPU_POWERPC_603E7v2,                603E),
+    /* PowerPC 603p (aka PID7v)                                              */
+    POWERPC_DEF("603p",          CPU_POWERPC_603P,                   603E),
+    /* PowerPC 603r (aka PID7t)                                              */
+    POWERPC_DEF("603r",          CPU_POWERPC_603R,                   603E),
     /* Code name for PowerPC 603r                                            */
-    POWERPC_DEF("Goldeneye",   CPU_POWERPC_603R,        0xFFFFFFFF, 603E),
-    /* PowerPC G2 core                                                       */
-    POWERPC_DEF("G2",          CPU_POWERPC_G2,          0xFFFFFFFF, G2),
-    /* PowerPC G2 H4                                                         */
-    POWERPC_DEF("G2H4",        CPU_POWERPC_G2H4,        0xFFFFFFFF, G2),
-    /* PowerPC G2 GP                                                         */
-    POWERPC_DEF("G2GP",        CPU_POWERPC_G2gp,        0xFFFFFFFF, G2),
-    /* PowerPC G2 LS                                                         */
-    POWERPC_DEF("G2LS",        CPU_POWERPC_G2ls,        0xFFFFFFFF, G2),
-    /* PowerPC G2LE                                                          */
-    /* Same as G2, with little-endian mode support                           */
-    POWERPC_DEF("G2le",        CPU_POWERPC_G2LE,        0xFFFFFFFF, G2LE),
-    /* PowerPC G2LE GP                                                       */
-    POWERPC_DEF("G2leGP",      CPU_POWERPC_G2LEgp,      0xFFFFFFFF, G2LE),
-    /* PowerPC G2LE LS                                                       */
-    POWERPC_DEF("G2leLS",      CPU_POWERPC_G2LEls,      0xFFFFFFFF, G2LE),
+    POWERPC_DEF("Goldeneye",     CPU_POWERPC_603R,                   603E),
     /* PowerPC 604                                                           */
-    POWERPC_DEF("604",         CPU_POWERPC_604,         0xFFFFFFFF, 604),
-    /* PowerPC 604e                                                          */
-    POWERPC_DEF("604e",        CPU_POWERPC_604E,        0xFFFFFFFF, 604),
+    POWERPC_DEF("604",           CPU_POWERPC_604,                    604),
+    /* PowerPC 604e (aka PID9)                                               */
+    POWERPC_DEF("604e",          CPU_POWERPC_604E,                   604E),
+    /* Code name for PowerPC 604e                                            */
+    POWERPC_DEF("Sirocco",       CPU_POWERPC_604E,                   604E),
     /* PowerPC 604e v1.0                                                     */
-    POWERPC_DEF("604e1.0",     CPU_POWERPC_604E_v10,    0xFFFFFFFF, 604),
+    POWERPC_DEF("604e_v1.0",     CPU_POWERPC_604E_v10,               604E),
     /* PowerPC 604e v2.2                                                     */
-    POWERPC_DEF("604e2.2",     CPU_POWERPC_604E_v22,    0xFFFFFFFF, 604),
+    POWERPC_DEF("604e_v2.2",     CPU_POWERPC_604E_v22,               604E),
     /* PowerPC 604e v2.4                                                     */
-    POWERPC_DEF("604e2.4",     CPU_POWERPC_604E_v24,    0xFFFFFFFF, 604),
-    /* PowerPC 604r                                                          */
-    POWERPC_DEF("604r",        CPU_POWERPC_604R,        0xFFFFFFFF, 604),
+    POWERPC_DEF("604e_v2.4",     CPU_POWERPC_604E_v24,               604E),
+    /* PowerPC 604r (aka PIDA)                                               */
+    POWERPC_DEF("604r",          CPU_POWERPC_604R,                   604E),
+    /* Code name for PowerPC 604r                                            */
+    POWERPC_DEF("Mach5",         CPU_POWERPC_604R,                   604E),
 #if defined(TODO)
     /* PowerPC 604ev                                                         */
-    POWERPC_DEF("604ev",       CPU_POWERPC_604EV,       0xFFFFFFFF, 604),
+    POWERPC_DEF("604ev",         CPU_POWERPC_604EV,                  604E),
 #endif
     /* PowerPC 7xx family                                                    */
     /* Generic PowerPC 740 (G3)                                              */
-    POWERPC_DEF("740",         CPU_POWERPC_7x0,         0xFFFFFFFF, 7x0),
+    POWERPC_DEF("740",           CPU_POWERPC_7x0,                    740),
+    /* Code name for PowerPC 740                                             */
+    POWERPC_DEF("Arthur",        CPU_POWERPC_7x0,                    740),
     /* Generic PowerPC 750 (G3)                                              */
-    POWERPC_DEF("750",         CPU_POWERPC_7x0,         0xFFFFFFFF, 7x0),
-    /* Code name for generic PowerPC 740/750 (G3)                            */
-    POWERPC_DEF("Arthur",      CPU_POWERPC_7x0,         0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750",           CPU_POWERPC_7x0,                    750),
+    /* Code name for PowerPC 750                                             */
+    POWERPC_DEF("Typhoon",       CPU_POWERPC_7x0,                    750),
     /* PowerPC 740/750 is also known as G3                                   */
-    POWERPC_DEF("G3",          CPU_POWERPC_7x0,         0xFFFFFFFF, 7x0),
+    POWERPC_DEF("G3",            CPU_POWERPC_7x0,                    750),
+    /* PowerPC 740 v1.0 (G3)                                                 */
+    POWERPC_DEF("740_v1.0",      CPU_POWERPC_7x0_v10,                740),
+    /* PowerPC 750 v1.0 (G3)                                                 */
+    POWERPC_DEF("750_v1.0",      CPU_POWERPC_7x0_v10,                750),
     /* PowerPC 740 v2.0 (G3)                                                 */
-    POWERPC_DEF("740v2.0",     CPU_POWERPC_7x0_v20,     0xFFFFFFFF, 7x0),
+    POWERPC_DEF("740_v2.0",      CPU_POWERPC_7x0_v20,                740),
     /* PowerPC 750 v2.0 (G3)                                                 */
-    POWERPC_DEF("750v2.0",     CPU_POWERPC_7x0_v20,     0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750_v2.0",      CPU_POWERPC_7x0_v20,                750),
     /* PowerPC 740 v2.1 (G3)                                                 */
-    POWERPC_DEF("740v2.1",     CPU_POWERPC_7x0_v21,     0xFFFFFFFF, 7x0),
+    POWERPC_DEF("740_v2.1",      CPU_POWERPC_7x0_v21,                740),
     /* PowerPC 750 v2.1 (G3)                                                 */
-    POWERPC_DEF("750v2.1",     CPU_POWERPC_7x0_v21,     0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750_v2.1",      CPU_POWERPC_7x0_v21,                750),
     /* PowerPC 740 v2.2 (G3)                                                 */
-    POWERPC_DEF("740v2.2",     CPU_POWERPC_7x0_v22,     0xFFFFFFFF, 7x0),
+    POWERPC_DEF("740_v2.2",      CPU_POWERPC_7x0_v22,                740),
     /* PowerPC 750 v2.2 (G3)                                                 */
-    POWERPC_DEF("750v2.2",     CPU_POWERPC_7x0_v22,     0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750_v2.2",      CPU_POWERPC_7x0_v22,                750),
     /* PowerPC 740 v3.0 (G3)                                                 */
-    POWERPC_DEF("740v3.0",     CPU_POWERPC_7x0_v30,     0xFFFFFFFF, 7x0),
+    POWERPC_DEF("740_v3.0",      CPU_POWERPC_7x0_v30,                740),
     /* PowerPC 750 v3.0 (G3)                                                 */
-    POWERPC_DEF("750v3.0",     CPU_POWERPC_7x0_v30,     0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750_v3.0",      CPU_POWERPC_7x0_v30,                750),
     /* PowerPC 740 v3.1 (G3)                                                 */
-    POWERPC_DEF("740v3.1",     CPU_POWERPC_7x0_v31,     0xFFFFFFFF, 7x0),
+    POWERPC_DEF("740_v3.1",      CPU_POWERPC_7x0_v31,                740),
     /* PowerPC 750 v3.1 (G3)                                                 */
-    POWERPC_DEF("750v3.1",     CPU_POWERPC_7x0_v31,     0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750_v3.1",      CPU_POWERPC_7x0_v31,                750),
     /* PowerPC 740E (G3)                                                     */
-    POWERPC_DEF("740e",        CPU_POWERPC_740E,        0xFFFFFFFF, 7x0),
+    POWERPC_DEF("740e",          CPU_POWERPC_740E,                   740),
+    /* PowerPC 750E (G3)                                                     */
+    POWERPC_DEF("750e",          CPU_POWERPC_750E,                   750),
     /* PowerPC 740P (G3)                                                     */
-    POWERPC_DEF("740p",        CPU_POWERPC_7x0P,        0xFFFFFFFF, 7x0),
+    POWERPC_DEF("740p",          CPU_POWERPC_7x0P,                   740),
     /* PowerPC 750P (G3)                                                     */
-    POWERPC_DEF("750p",        CPU_POWERPC_7x0P,        0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750p",          CPU_POWERPC_7x0P,                   750),
     /* Code name for PowerPC 740P/750P (G3)                                  */
-    POWERPC_DEF("Conan/Doyle", CPU_POWERPC_7x0P,        0xFFFFFFFF, 7x0),
+    POWERPC_DEF("Conan/Doyle",   CPU_POWERPC_7x0P,                   750),
     /* PowerPC 750CL (G3 embedded)                                           */
-    POWERPC_DEF("750cl",       CPU_POWERPC_750CL,       0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cl",         CPU_POWERPC_750CL,                  750cl),
+    /* PowerPC 750CL v1.0                                                    */
+    POWERPC_DEF("750cl_v1.0",    CPU_POWERPC_750CL_v10,              750cl),
+    /* PowerPC 750CL v2.0                                                    */
+    POWERPC_DEF("750cl_v2.0",    CPU_POWERPC_750CL_v20,              750cl),
     /* PowerPC 750CX (G3 embedded)                                           */
-    POWERPC_DEF("750cx",       CPU_POWERPC_750CX,       0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cx",         CPU_POWERPC_750CX,                  750cx),
+    /* PowerPC 750CX v1.0 (G3 embedded)                                      */
+    POWERPC_DEF("750cx_v1.0",    CPU_POWERPC_750CX_v10,              750cx),
     /* PowerPC 750CX v2.1 (G3 embedded)                                      */
-    POWERPC_DEF("750cx2.1",    CPU_POWERPC_750CX_v21,   0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cx_v2.0",    CPU_POWERPC_750CX_v20,              750cx),
+    /* PowerPC 750CX v2.1 (G3 embedded)                                      */
+    POWERPC_DEF("750cx_v2.1",    CPU_POWERPC_750CX_v21,              750cx),
     /* PowerPC 750CX v2.2 (G3 embedded)                                      */
-    POWERPC_DEF("750cx2.2",    CPU_POWERPC_750CX_v22,   0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cx_v2.2",    CPU_POWERPC_750CX_v22,              750cx),
     /* PowerPC 750CXe (G3 embedded)                                          */
-    POWERPC_DEF("750cxe",      CPU_POWERPC_750CXE,      0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cxe",        CPU_POWERPC_750CXE,                 750cx),
     /* PowerPC 750CXe v2.1 (G3 embedded)                                     */
-    POWERPC_DEF("750cxe21",    CPU_POWERPC_750CXE_v21,  0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cxe_v2.1",   CPU_POWERPC_750CXE_v21,             750cx),
     /* PowerPC 750CXe v2.2 (G3 embedded)                                     */
-    POWERPC_DEF("750cxe22",    CPU_POWERPC_750CXE_v22,  0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cxe_v2.2",   CPU_POWERPC_750CXE_v22,             750cx),
     /* PowerPC 750CXe v2.3 (G3 embedded)                                     */
-    POWERPC_DEF("750cxe23",    CPU_POWERPC_750CXE_v23,  0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cxe_v2.3",   CPU_POWERPC_750CXE_v23,             750cx),
     /* PowerPC 750CXe v2.4 (G3 embedded)                                     */
-    POWERPC_DEF("750cxe24",    CPU_POWERPC_750CXE_v24,  0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cxe_v2.4",   CPU_POWERPC_750CXE_v24,             750cx),
     /* PowerPC 750CXe v2.4b (G3 embedded)                                    */
-    POWERPC_DEF("750cxe24b",   CPU_POWERPC_750CXE_v24b, 0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cxe_v2.4b",  CPU_POWERPC_750CXE_v24b,            750cx),
+    /* PowerPC 750CXe v3.0 (G3 embedded)                                     */
+    POWERPC_DEF("750cxe_v3.0",   CPU_POWERPC_750CXE_v30,             750cx),
     /* PowerPC 750CXe v3.1 (G3 embedded)                                     */
-    POWERPC_DEF("750cxe31",    CPU_POWERPC_750CXE_v31,  0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cxe_v3.1",   CPU_POWERPC_750CXE_v31,             750cx),
     /* PowerPC 750CXe v3.1b (G3 embedded)                                    */
-    POWERPC_DEF("750cxe3.1b",  CPU_POWERPC_750CXE_v31b, 0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cxe_v3.1b",  CPU_POWERPC_750CXE_v31b,            750cx),
     /* PowerPC 750CXr (G3 embedded)                                          */
-    POWERPC_DEF("750cxr",      CPU_POWERPC_750CXR,      0xFFFFFFFF, 7x0),
-    /* PowerPC 750E (G3)                                                     */
-    POWERPC_DEF("750e",        CPU_POWERPC_750E,        0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750cxr",        CPU_POWERPC_750CXR,                 750cx),
     /* PowerPC 750FL (G3 embedded)                                           */
-    POWERPC_DEF("750fl",       CPU_POWERPC_750FL,       0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750fl",         CPU_POWERPC_750FL,                  750fx),
     /* PowerPC 750FX (G3 embedded)                                           */
-    POWERPC_DEF("750fx",       CPU_POWERPC_750FX,       0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750fx",         CPU_POWERPC_750FX,                  750fx),
     /* PowerPC 750FX v1.0 (G3 embedded)                                      */
-    POWERPC_DEF("750fx1.0",    CPU_POWERPC_750FX_v10,   0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750fx_v1.0",    CPU_POWERPC_750FX_v10,              750fx),
     /* PowerPC 750FX v2.0 (G3 embedded)                                      */
-    POWERPC_DEF("750fx2.0",    CPU_POWERPC_750FX_v20,   0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750fx_v2.0",    CPU_POWERPC_750FX_v20,              750fx),
     /* PowerPC 750FX v2.1 (G3 embedded)                                      */
-    POWERPC_DEF("750fx2.1",    CPU_POWERPC_750FX_v21,   0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750fx_v2.1",    CPU_POWERPC_750FX_v21,              750fx),
     /* PowerPC 750FX v2.2 (G3 embedded)                                      */
-    POWERPC_DEF("750fx2.2",    CPU_POWERPC_750FX_v22,   0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750fx_v2.2",    CPU_POWERPC_750FX_v22,              750fx),
     /* PowerPC 750FX v2.3 (G3 embedded)                                      */
-    POWERPC_DEF("750fx2.3",    CPU_POWERPC_750FX_v23,   0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750fx_v2.3",    CPU_POWERPC_750FX_v23,              750fx),
     /* PowerPC 750GL (G3 embedded)                                           */
-    POWERPC_DEF("750gl",       CPU_POWERPC_750GL,       0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750gl",         CPU_POWERPC_750GL,                  750gx),
     /* PowerPC 750GX (G3 embedded)                                           */
-    POWERPC_DEF("750gx",       CPU_POWERPC_750GX,       0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750gx",         CPU_POWERPC_750GX,                  750gx),
     /* PowerPC 750GX v1.0 (G3 embedded)                                      */
-    POWERPC_DEF("750gx1.0",    CPU_POWERPC_750GX_v10,   0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750gx_v1.0",    CPU_POWERPC_750GX_v10,              750gx),
     /* PowerPC 750GX v1.1 (G3 embedded)                                      */
-    POWERPC_DEF("750gx1.1",    CPU_POWERPC_750GX_v11,   0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750gx_v1.1",    CPU_POWERPC_750GX_v11,              750gx),
     /* PowerPC 750GX v1.2 (G3 embedded)                                      */
-    POWERPC_DEF("750gx1.2",    CPU_POWERPC_750GX_v12,   0xFFFFFFFF, 750fx),
+    POWERPC_DEF("750gx_v1.2",    CPU_POWERPC_750GX_v12,              750gx),
     /* PowerPC 750L (G3 embedded)                                            */
-    POWERPC_DEF("750l",        CPU_POWERPC_750L,        0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750l",          CPU_POWERPC_750L,                   750),
     /* Code name for PowerPC 750L (G3 embedded)                              */
-    POWERPC_DEF("LoneStar",    CPU_POWERPC_750L,        0xFFFFFFFF, 7x0),
+    POWERPC_DEF("LoneStar",      CPU_POWERPC_750L,                   750),
+    /* PowerPC 750L v2.0 (G3 embedded)                                       */
+    POWERPC_DEF("750l_v2.0",     CPU_POWERPC_750L_v20,               750),
+    /* PowerPC 750L v2.1 (G3 embedded)                                       */
+    POWERPC_DEF("750l_v2.1",     CPU_POWERPC_750L_v21,               750),
     /* PowerPC 750L v2.2 (G3 embedded)                                       */
-    POWERPC_DEF("750l2.2",     CPU_POWERPC_750L_v22,    0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750l_v2.2",     CPU_POWERPC_750L_v22,               750),
     /* PowerPC 750L v3.0 (G3 embedded)                                       */
-    POWERPC_DEF("750l3.0",     CPU_POWERPC_750L_v30,    0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750l_v3.0",     CPU_POWERPC_750L_v30,               750),
     /* PowerPC 750L v3.2 (G3 embedded)                                       */
-    POWERPC_DEF("750l3.2",     CPU_POWERPC_750L_v32,    0xFFFFFFFF, 7x0),
+    POWERPC_DEF("750l_v3.2",     CPU_POWERPC_750L_v32,               750),
     /* Generic PowerPC 745                                                   */
-    POWERPC_DEF("745",         CPU_POWERPC_7x5,         0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745",           CPU_POWERPC_7x5,                    745),
     /* Generic PowerPC 755                                                   */
-    POWERPC_DEF("755",         CPU_POWERPC_7x5,         0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755",           CPU_POWERPC_7x5,                    755),
     /* Code name for PowerPC 745/755                                         */
-    POWERPC_DEF("Goldfinger",  CPU_POWERPC_7x5,         0xFFFFFFFF, 7x5),
+    POWERPC_DEF("Goldfinger",    CPU_POWERPC_7x5,                    755),
     /* PowerPC 745 v1.0                                                      */
-    POWERPC_DEF("745v1.0",     CPU_POWERPC_7x5_v10,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v1.0",      CPU_POWERPC_7x5_v10,                745),
     /* PowerPC 755 v1.0                                                      */
-    POWERPC_DEF("755v1.0",     CPU_POWERPC_7x5_v10,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v1.0",      CPU_POWERPC_7x5_v10,                755),
     /* PowerPC 745 v1.1                                                      */
-    POWERPC_DEF("745v1.1",     CPU_POWERPC_7x5_v11,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v1.1",      CPU_POWERPC_7x5_v11,                745),
     /* PowerPC 755 v1.1                                                      */
-    POWERPC_DEF("755v1.1",     CPU_POWERPC_7x5_v11,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v1.1",      CPU_POWERPC_7x5_v11,                755),
     /* PowerPC 745 v2.0                                                      */
-    POWERPC_DEF("745v2.0",     CPU_POWERPC_7x5_v20,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v2.0",      CPU_POWERPC_7x5_v20,                745),
     /* PowerPC 755 v2.0                                                      */
-    POWERPC_DEF("755v2.0",     CPU_POWERPC_7x5_v20,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v2.0",      CPU_POWERPC_7x5_v20,                755),
     /* PowerPC 745 v2.1                                                      */
-    POWERPC_DEF("745v2.1",     CPU_POWERPC_7x5_v21,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v2.1",      CPU_POWERPC_7x5_v21,                745),
     /* PowerPC 755 v2.1                                                      */
-    POWERPC_DEF("755v2.1",     CPU_POWERPC_7x5_v21,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v2.1",      CPU_POWERPC_7x5_v21,                755),
     /* PowerPC 745 v2.2                                                      */
-    POWERPC_DEF("745v2.2",     CPU_POWERPC_7x5_v22,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v2.2",      CPU_POWERPC_7x5_v22,                745),
     /* PowerPC 755 v2.2                                                      */
-    POWERPC_DEF("755v2.2",     CPU_POWERPC_7x5_v22,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v2.2",      CPU_POWERPC_7x5_v22,                755),
     /* PowerPC 745 v2.3                                                      */
-    POWERPC_DEF("745v2.3",     CPU_POWERPC_7x5_v23,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v2.3",      CPU_POWERPC_7x5_v23,                745),
     /* PowerPC 755 v2.3                                                      */
-    POWERPC_DEF("755v2.3",     CPU_POWERPC_7x5_v23,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v2.3",      CPU_POWERPC_7x5_v23,                755),
     /* PowerPC 745 v2.4                                                      */
-    POWERPC_DEF("745v2.4",     CPU_POWERPC_7x5_v24,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v2.4",      CPU_POWERPC_7x5_v24,                745),
     /* PowerPC 755 v2.4                                                      */
-    POWERPC_DEF("755v2.4",     CPU_POWERPC_7x5_v24,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v2.4",      CPU_POWERPC_7x5_v24,                755),
     /* PowerPC 745 v2.5                                                      */
-    POWERPC_DEF("745v2.5",     CPU_POWERPC_7x5_v25,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v2.5",      CPU_POWERPC_7x5_v25,                745),
     /* PowerPC 755 v2.5                                                      */
-    POWERPC_DEF("755v2.5",     CPU_POWERPC_7x5_v25,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v2.5",      CPU_POWERPC_7x5_v25,                755),
     /* PowerPC 745 v2.6                                                      */
-    POWERPC_DEF("745v2.6",     CPU_POWERPC_7x5_v26,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v2.6",      CPU_POWERPC_7x5_v26,                745),
     /* PowerPC 755 v2.6                                                      */
-    POWERPC_DEF("755v2.6",     CPU_POWERPC_7x5_v26,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v2.6",      CPU_POWERPC_7x5_v26,                755),
     /* PowerPC 745 v2.7                                                      */
-    POWERPC_DEF("745v2.7",     CPU_POWERPC_7x5_v27,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v2.7",      CPU_POWERPC_7x5_v27,                745),
     /* PowerPC 755 v2.7                                                      */
-    POWERPC_DEF("755v2.7",     CPU_POWERPC_7x5_v27,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v2.7",      CPU_POWERPC_7x5_v27,                755),
     /* PowerPC 745 v2.8                                                      */
-    POWERPC_DEF("745v2.8",     CPU_POWERPC_7x5_v28,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745_v2.8",      CPU_POWERPC_7x5_v28,                745),
     /* PowerPC 755 v2.8                                                      */
-    POWERPC_DEF("755v2.8",     CPU_POWERPC_7x5_v28,     0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755_v2.8",      CPU_POWERPC_7x5_v28,                755),
 #if defined (TODO)
     /* PowerPC 745P (G3)                                                     */
-    POWERPC_DEF("745p",        CPU_POWERPC_7x5P,        0xFFFFFFFF, 7x5),
+    POWERPC_DEF("745p",          CPU_POWERPC_7x5P,                   745),
     /* PowerPC 755P (G3)                                                     */
-    POWERPC_DEF("755p",        CPU_POWERPC_7x5P,        0xFFFFFFFF, 7x5),
+    POWERPC_DEF("755p",          CPU_POWERPC_7x5P,                   755),
 #endif
     /* PowerPC 74xx family                                                   */
     /* PowerPC 7400 (G4)                                                     */
-    POWERPC_DEF("7400",        CPU_POWERPC_7400,        0xFFFFFFFF, 7400),
+    POWERPC_DEF("7400",          CPU_POWERPC_7400,                   7400),
     /* Code name for PowerPC 7400                                            */
-    POWERPC_DEF("Max",         CPU_POWERPC_7400,        0xFFFFFFFF, 7400),
+    POWERPC_DEF("Max",           CPU_POWERPC_7400,                   7400),
     /* PowerPC 74xx is also well known as G4                                 */
-    POWERPC_DEF("G4",          CPU_POWERPC_7400,        0xFFFFFFFF, 7400),
+    POWERPC_DEF("G4",            CPU_POWERPC_7400,                   7400),
     /* PowerPC 7400 v1.0 (G4)                                                */
-    POWERPC_DEF("7400v1.0",    CPU_POWERPC_7400_v10,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7400_v1.0",     CPU_POWERPC_7400_v10,               7400),
     /* PowerPC 7400 v1.1 (G4)                                                */
-    POWERPC_DEF("7400v1.1",    CPU_POWERPC_7400_v11,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7400_v1.1",     CPU_POWERPC_7400_v11,               7400),
     /* PowerPC 7400 v2.0 (G4)                                                */
-    POWERPC_DEF("7400v2.0",    CPU_POWERPC_7400_v20,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7400_v2.0",     CPU_POWERPC_7400_v20,               7400),
+    /* PowerPC 7400 v2.1 (G4)                                                */
+    POWERPC_DEF("7400_v2.1",     CPU_POWERPC_7400_v21,               7400),
     /* PowerPC 7400 v2.2 (G4)                                                */
-    POWERPC_DEF("7400v2.2",    CPU_POWERPC_7400_v22,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7400_v2.2",     CPU_POWERPC_7400_v22,               7400),
     /* PowerPC 7400 v2.6 (G4)                                                */
-    POWERPC_DEF("7400v2.6",    CPU_POWERPC_7400_v26,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7400_v2.6",     CPU_POWERPC_7400_v26,               7400),
     /* PowerPC 7400 v2.7 (G4)                                                */
-    POWERPC_DEF("7400v2.7",    CPU_POWERPC_7400_v27,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7400_v2.7",     CPU_POWERPC_7400_v27,               7400),
     /* PowerPC 7400 v2.8 (G4)                                                */
-    POWERPC_DEF("7400v2.8",    CPU_POWERPC_7400_v28,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7400_v2.8",     CPU_POWERPC_7400_v28,               7400),
     /* PowerPC 7400 v2.9 (G4)                                                */
-    POWERPC_DEF("7400v2.9",    CPU_POWERPC_7400_v29,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7400_v2.9",     CPU_POWERPC_7400_v29,               7400),
     /* PowerPC 7410 (G4)                                                     */
-    POWERPC_DEF("7410",        CPU_POWERPC_7410,        0xFFFFFFFF, 7410),
+    POWERPC_DEF("7410",          CPU_POWERPC_7410,                   7410),
     /* Code name for PowerPC 7410                                            */
-    POWERPC_DEF("Nitro",       CPU_POWERPC_7410,        0xFFFFFFFF, 7410),
+    POWERPC_DEF("Nitro",         CPU_POWERPC_7410,                   7410),
     /* PowerPC 7410 v1.0 (G4)                                                */
-    POWERPC_DEF("7410v1.0",    CPU_POWERPC_7410_v10,    0xFFFFFFFF, 7410),
+    POWERPC_DEF("7410_v1.0",     CPU_POWERPC_7410_v10,               7410),
     /* PowerPC 7410 v1.1 (G4)                                                */
-    POWERPC_DEF("7410v1.1",    CPU_POWERPC_7410_v11,    0xFFFFFFFF, 7410),
+    POWERPC_DEF("7410_v1.1",     CPU_POWERPC_7410_v11,               7410),
     /* PowerPC 7410 v1.2 (G4)                                                */
-    POWERPC_DEF("7410v1.2",    CPU_POWERPC_7410_v12,    0xFFFFFFFF, 7410),
+    POWERPC_DEF("7410_v1.2",     CPU_POWERPC_7410_v12,               7410),
     /* PowerPC 7410 v1.3 (G4)                                                */
-    POWERPC_DEF("7410v1.3",    CPU_POWERPC_7410_v13,    0xFFFFFFFF, 7410),
+    POWERPC_DEF("7410_v1.3",     CPU_POWERPC_7410_v13,               7410),
     /* PowerPC 7410 v1.4 (G4)                                                */
-    POWERPC_DEF("7410v1.4",    CPU_POWERPC_7410_v14,    0xFFFFFFFF, 7410),
+    POWERPC_DEF("7410_v1.4",     CPU_POWERPC_7410_v14,               7410),
     /* PowerPC 7448 (G4)                                                     */
-    POWERPC_DEF("7448",        CPU_POWERPC_7448,        0xFFFFFFFF, 7400),
+    POWERPC_DEF("7448",          CPU_POWERPC_7448,                   7400),
     /* PowerPC 7448 v1.0 (G4)                                                */
-    POWERPC_DEF("7448v1.0",    CPU_POWERPC_7448_v10,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7448_v1.0",     CPU_POWERPC_7448_v10,               7400),
     /* PowerPC 7448 v1.1 (G4)                                                */
-    POWERPC_DEF("7448v1.1",    CPU_POWERPC_7448_v11,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7448_v1.1",     CPU_POWERPC_7448_v11,               7400),
     /* PowerPC 7448 v2.0 (G4)                                                */
-    POWERPC_DEF("7448v2.0",    CPU_POWERPC_7448_v20,    0xFFFFFFFF, 7400),
+    POWERPC_DEF("7448_v2.0",     CPU_POWERPC_7448_v20,               7400),
     /* PowerPC 7448 v2.1 (G4)                                                */
-    POWERPC_DEF("7448v2.1",    CPU_POWERPC_7448_v21,    0xFFFFFFFF, 7400),
-#if defined (TODO)
+    POWERPC_DEF("7448_v2.1",     CPU_POWERPC_7448_v21,               7400),
     /* PowerPC 7450 (G4)                                                     */
-    POWERPC_DEF("7450",        CPU_POWERPC_7450,        0xFFFFFFFF, 7450),
+    POWERPC_DEF("7450",          CPU_POWERPC_7450,                   7450),
     /* Code name for PowerPC 7450                                            */
-    POWERPC_DEF("Vger",        CPU_POWERPC_7450,        0xFFFFFFFF, 7450),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("Vger",          CPU_POWERPC_7450,                   7450),
     /* PowerPC 7450 v1.0 (G4)                                                */
-    POWERPC_DEF("7450v1.0",    CPU_POWERPC_7450_v10,    0xFFFFFFFF, 7450),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7450_v1.0",     CPU_POWERPC_7450_v10,               7450),
     /* PowerPC 7450 v1.1 (G4)                                                */
-    POWERPC_DEF("7450v1.1",    CPU_POWERPC_7450_v11,    0xFFFFFFFF, 7450),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7450_v1.1",     CPU_POWERPC_7450_v11,               7450),
     /* PowerPC 7450 v1.2 (G4)                                                */
-    POWERPC_DEF("7450v1.2",    CPU_POWERPC_7450_v12,    0xFFFFFFFF, 7450),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7450_v1.2",     CPU_POWERPC_7450_v12,               7450),
     /* PowerPC 7450 v2.0 (G4)                                                */
-    POWERPC_DEF("7450v2.0",    CPU_POWERPC_7450_v20,    0xFFFFFFFF, 7450),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7450_v2.0",     CPU_POWERPC_7450_v20,               7450),
     /* PowerPC 7450 v2.1 (G4)                                                */
-    POWERPC_DEF("7450v2.1",    CPU_POWERPC_7450_v21,    0xFFFFFFFF, 7450),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7450_v2.1",     CPU_POWERPC_7450_v21,               7450),
     /* PowerPC 7441 (G4)                                                     */
-    POWERPC_DEF("7441",        CPU_POWERPC_74x1,        0xFFFFFFFF, 7440),
+    POWERPC_DEF("7441",          CPU_POWERPC_74x1,                   7440),
     /* PowerPC 7451 (G4)                                                     */
-    POWERPC_DEF("7451",        CPU_POWERPC_74x1,        0xFFFFFFFF, 7450),
-#endif
-#if defined (TODO)
-    /* PowerPC 7441g (G4)                                                    */
-    POWERPC_DEF("7441g",       CPU_POWERPC_74x1G,       0xFFFFFFFF, 7440),
-    /* PowerPC 7451g (G4)                                                    */
-    POWERPC_DEF("7451g",       CPU_POWERPC_74x1G,       0xFFFFFFFF, 7450),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7451",          CPU_POWERPC_74x1,                   7450),
+    /* PowerPC 7441 v2.1 (G4)                                                */
+    POWERPC_DEF("7441_v2.1",     CPU_POWERPC_7450_v21,               7440),
+    /* PowerPC 7441 v2.3 (G4)                                                */
+    POWERPC_DEF("7441_v2.3",     CPU_POWERPC_74x1_v23,               7440),
+    /* PowerPC 7451 v2.3 (G4)                                                */
+    POWERPC_DEF("7451_v2.3",     CPU_POWERPC_74x1_v23,               7450),
+    /* PowerPC 7441 v2.10 (G4)                                                */
+    POWERPC_DEF("7441_v2.10",    CPU_POWERPC_74x1_v210,              7440),
+    /* PowerPC 7451 v2.10 (G4)                                               */
+    POWERPC_DEF("7451_v2.10",    CPU_POWERPC_74x1_v210,              7450),
     /* PowerPC 7445 (G4)                                                     */
-    POWERPC_DEF("7445",        CPU_POWERPC_74x5,        0xFFFFFFFF, 7445),
+    POWERPC_DEF("7445",          CPU_POWERPC_74x5,                   7445),
     /* PowerPC 7455 (G4)                                                     */
-    POWERPC_DEF("7455",        CPU_POWERPC_74x5,        0xFFFFFFFF, 7455),
+    POWERPC_DEF("7455",          CPU_POWERPC_74x5,                   7455),
     /* Code name for PowerPC 7445/7455                                       */
-    POWERPC_DEF("Apollo6",     CPU_POWERPC_74x5,        0xFFFFFFFF, 7455),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("Apollo6",       CPU_POWERPC_74x5,                   7455),
     /* PowerPC 7445 v1.0 (G4)                                                */
-    POWERPC_DEF("7445v1.0",    CPU_POWERPC_74x5_v10,    0xFFFFFFFF, 7445),
+    POWERPC_DEF("7445_v1.0",     CPU_POWERPC_74x5_v10,               7445),
     /* PowerPC 7455 v1.0 (G4)                                                */
-    POWERPC_DEF("7455v1.0",    CPU_POWERPC_74x5_v10,    0xFFFFFFFF, 7455),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7455_v1.0",     CPU_POWERPC_74x5_v10,               7455),
     /* PowerPC 7445 v2.1 (G4)                                                */
-    POWERPC_DEF("7445v2.1",    CPU_POWERPC_74x5_v21,    0xFFFFFFFF, 7445),
+    POWERPC_DEF("7445_v2.1",     CPU_POWERPC_74x5_v21,               7445),
     /* PowerPC 7455 v2.1 (G4)                                                */
-    POWERPC_DEF("7455v2.1",    CPU_POWERPC_74x5_v21,    0xFFFFFFFF, 7455),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7455_v2.1",     CPU_POWERPC_74x5_v21,               7455),
     /* PowerPC 7445 v3.2 (G4)                                                */
-    POWERPC_DEF("7445v3.2",    CPU_POWERPC_74x5_v32,    0xFFFFFFFF, 7445),
+    POWERPC_DEF("7445_v3.2",     CPU_POWERPC_74x5_v32,               7445),
     /* PowerPC 7455 v3.2 (G4)                                                */
-    POWERPC_DEF("7455v3.2",    CPU_POWERPC_74x5_v32,    0xFFFFFFFF, 7455),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7455_v3.2",     CPU_POWERPC_74x5_v32,               7455),
     /* PowerPC 7445 v3.3 (G4)                                                */
-    POWERPC_DEF("7445v3.3",    CPU_POWERPC_74x5_v33,    0xFFFFFFFF, 7445),
+    POWERPC_DEF("7445_v3.3",     CPU_POWERPC_74x5_v33,               7445),
     /* PowerPC 7455 v3.3 (G4)                                                */
-    POWERPC_DEF("7455v3.3",    CPU_POWERPC_74x5_v33,    0xFFFFFFFF, 7455),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7455_v3.3",     CPU_POWERPC_74x5_v33,               7455),
     /* PowerPC 7445 v3.4 (G4)                                                */
-    POWERPC_DEF("7445v3.4",    CPU_POWERPC_74x5_v34,    0xFFFFFFFF, 7445),
+    POWERPC_DEF("7445_v3.4",     CPU_POWERPC_74x5_v34,               7445),
     /* PowerPC 7455 v3.4 (G4)                                                */
-    POWERPC_DEF("7455v3.4",    CPU_POWERPC_74x5_v34,    0xFFFFFFFF, 7455),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7455_v3.4",     CPU_POWERPC_74x5_v34,               7455),
     /* PowerPC 7447 (G4)                                                     */
-    POWERPC_DEF("7447",        CPU_POWERPC_74x7,        0xFFFFFFFF, 7445),
+    POWERPC_DEF("7447",          CPU_POWERPC_74x7,                   7445),
     /* PowerPC 7457 (G4)                                                     */
-    POWERPC_DEF("7457",        CPU_POWERPC_74x7,        0xFFFFFFFF, 7455),
+    POWERPC_DEF("7457",          CPU_POWERPC_74x7,                   7455),
     /* Code name for PowerPC 7447/7457                                       */
-    POWERPC_DEF("Apollo7",     CPU_POWERPC_74x7,        0xFFFFFFFF, 7455),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("Apollo7",       CPU_POWERPC_74x7,                   7455),
     /* PowerPC 7447 v1.0 (G4)                                                */
-    POWERPC_DEF("7447v1.0",    CPU_POWERPC_74x7_v10,    0xFFFFFFFF, 7445),
+    POWERPC_DEF("7447_v1.0",     CPU_POWERPC_74x7_v10,               7445),
     /* PowerPC 7457 v1.0 (G4)                                                */
-    POWERPC_DEF("7457v1.0",    CPU_POWERPC_74x7_v10,    0xFFFFFFFF, 7455),
-    /* Code name for PowerPC 7447A/7457A                                     */
-    POWERPC_DEF("Apollo7PM",   CPU_POWERPC_74x7_v10,    0xFFFFFFFF, 7455),
-#endif
-#if defined (TODO)
+    POWERPC_DEF("7457_v1.0",     CPU_POWERPC_74x7_v10,               7455),
     /* PowerPC 7447 v1.1 (G4)                                                */
-    POWERPC_DEF("7447v1.1",    CPU_POWERPC_74x7_v11,    0xFFFFFFFF, 7445),
+    POWERPC_DEF("7447_v1.1",     CPU_POWERPC_74x7_v11,               7445),
     /* PowerPC 7457 v1.1 (G4)                                                */
-    POWERPC_DEF("7457v1.1",    CPU_POWERPC_74x7_v11,    0xFFFFFFFF, 7455),
-#endif
-#if defined (TODO)
-    /* PowerPC 7447 v1.2 (G4)                                                */
-    POWERPC_DEF("7447v1.2",    CPU_POWERPC_74x7_v12,    0xFFFFFFFF, 7445),
+    POWERPC_DEF("7457_v1.1",     CPU_POWERPC_74x7_v11,               7455),
     /* PowerPC 7457 v1.2 (G4)                                                */
-    POWERPC_DEF("7457v1.2",    CPU_POWERPC_74x7_v12,    0xFFFFFFFF, 7455),
-#endif
+    POWERPC_DEF("7457_v1.2",     CPU_POWERPC_74x7_v12,               7455),
+    /* PowerPC 7447A (G4)                                                    */
+    POWERPC_DEF("7447A",         CPU_POWERPC_74x7A,                  7445),
+    /* PowerPC 7457A (G4)                                                    */
+    POWERPC_DEF("7457A",         CPU_POWERPC_74x7A,                  7455),
+    /* PowerPC 7447A v1.0 (G4)                                               */
+    POWERPC_DEF("7447A_v1.0",    CPU_POWERPC_74x7A_v10,              7445),
+    /* PowerPC 7457A v1.0 (G4)                                               */
+    POWERPC_DEF("7457A_v1.0",    CPU_POWERPC_74x7A_v10,              7455),
+    /* Code name for PowerPC 7447A/7457A                                     */
+    POWERPC_DEF("Apollo7PM",     CPU_POWERPC_74x7A_v10,              7455),
+    /* PowerPC 7447A v1.1 (G4)                                               */
+    POWERPC_DEF("7447A_v1.1",    CPU_POWERPC_74x7A_v11,              7445),
+    /* PowerPC 7457A v1.1 (G4)                                               */
+    POWERPC_DEF("7457A_v1.1",    CPU_POWERPC_74x7A_v11,              7455),
+    /* PowerPC 7447A v1.2 (G4)                                               */
+    POWERPC_DEF("7447A_v1.2",    CPU_POWERPC_74x7A_v12,              7445),
+    /* PowerPC 7457A v1.2 (G4)                                               */
+    POWERPC_DEF("7457A_v1.2",    CPU_POWERPC_74x7A_v12,              7455),
     /* 64 bits PowerPC                                                       */
 #if defined (TARGET_PPC64)
-#if defined (TODO)
     /* PowerPC 620                                                           */
-    POWERPC_DEF("620",         CPU_POWERPC_620,         0xFFFFFFFF, 620),
-#endif
+    POWERPC_DEF("620",           CPU_POWERPC_620,                    620),
+    /* Code name for PowerPC 620                                             */
+    POWERPC_DEF("Trident",       CPU_POWERPC_620,                    620),
 #if defined (TODO)
     /* PowerPC 630 (POWER3)                                                  */
-    POWERPC_DEF("630",         CPU_POWERPC_630,         0xFFFFFFFF, 630),
-    POWERPC_DEF("POWER3",      CPU_POWERPC_630,         0xFFFFFFFF, 630),
+    POWERPC_DEF("630",           CPU_POWERPC_630,                    630),
+    POWERPC_DEF("POWER3",        CPU_POWERPC_630,                    630),
+    /* Code names for POWER3                                                 */
+    POWERPC_DEF("Boxer",         CPU_POWERPC_630,                    630),
+    POWERPC_DEF("Dino",          CPU_POWERPC_630,                    630),
 #endif
 #if defined (TODO)
     /* PowerPC 631 (Power 3+)                                                */
-    POWERPC_DEF("631",         CPU_POWERPC_631,         0xFFFFFFFF, 631),
-    POWERPC_DEF("POWER3+",     CPU_POWERPC_631,         0xFFFFFFFF, 631),
+    POWERPC_DEF("631",           CPU_POWERPC_631,                    631),
+    POWERPC_DEF("POWER3+",       CPU_POWERPC_631,                    631),
 #endif
 #if defined (TODO)
     /* POWER4                                                                */
-    POWERPC_DEF("POWER4",      CPU_POWERPC_POWER4,      0xFFFFFFFF, POWER4),
+    POWERPC_DEF("POWER4",        CPU_POWERPC_POWER4,                 POWER4),
 #endif
 #if defined (TODO)
     /* POWER4p                                                               */
-    POWERPC_DEF("POWER4+",     CPU_POWERPC_POWER4P,     0xFFFFFFFF, POWER4P),
+    POWERPC_DEF("POWER4+",       CPU_POWERPC_POWER4P,                POWER4P),
 #endif
 #if defined (TODO)
     /* POWER5                                                                */
-    POWERPC_DEF("POWER5",      CPU_POWERPC_POWER5,      0xFFFFFFFF, POWER5),
+    POWERPC_DEF("POWER5",        CPU_POWERPC_POWER5,                 POWER5),
     /* POWER5GR                                                              */
-    POWERPC_DEF("POWER5gr",    CPU_POWERPC_POWER5GR,    0xFFFFFFFF, POWER5),
+    POWERPC_DEF("POWER5gr",      CPU_POWERPC_POWER5GR,               POWER5),
 #endif
 #if defined (TODO)
     /* POWER5+                                                               */
-    POWERPC_DEF("POWER5+",     CPU_POWERPC_POWER5P,     0xFFFFFFFF, POWER5P),
+    POWERPC_DEF("POWER5+",       CPU_POWERPC_POWER5P,                POWER5P),
     /* POWER5GS                                                              */
-    POWERPC_DEF("POWER5gs",    CPU_POWERPC_POWER5GS,    0xFFFFFFFF, POWER5P),
+    POWERPC_DEF("POWER5gs",      CPU_POWERPC_POWER5GS,               POWER5P),
 #endif
 #if defined (TODO)
     /* POWER6                                                                */
-    POWERPC_DEF("POWER6",      CPU_POWERPC_POWER6,      0xFFFFFFFF, POWER6),
+    POWERPC_DEF("POWER6",        CPU_POWERPC_POWER6,                 POWER6),
     /* POWER6 running in POWER5 mode                                         */
-    POWERPC_DEF("POWER6_5",    CPU_POWERPC_POWER6_5,    0xFFFFFFFF, POWER5),
+    POWERPC_DEF("POWER6_5",      CPU_POWERPC_POWER6_5,               POWER5),
     /* POWER6A                                                               */
-    POWERPC_DEF("POWER6A",     CPU_POWERPC_POWER6A,     0xFFFFFFFF, POWER6),
+    POWERPC_DEF("POWER6A",       CPU_POWERPC_POWER6A,                POWER6),
 #endif
     /* PowerPC 970                                                           */
-    POWERPC_DEF("970",         CPU_POWERPC_970,         0xFFFFFFFF, 970),
+    POWERPC_DEF("970",           CPU_POWERPC_970,                    970),
     /* PowerPC 970FX (G5)                                                    */
-    POWERPC_DEF("970fx",       CPU_POWERPC_970FX,       0xFFFFFFFF, 970FX),
+    POWERPC_DEF("970fx",         CPU_POWERPC_970FX,                  970FX),
     /* PowerPC 970FX v1.0 (G5)                                               */
-    POWERPC_DEF("970fx1.0",    CPU_POWERPC_970FX_v10,   0xFFFFFFFF, 970FX),
+    POWERPC_DEF("970fx_v1.0",    CPU_POWERPC_970FX_v10,              970FX),
     /* PowerPC 970FX v2.0 (G5)                                               */
-    POWERPC_DEF("970fx2.0",    CPU_POWERPC_970FX_v20,   0xFFFFFFFF, 970FX),
+    POWERPC_DEF("970fx_v2.0",    CPU_POWERPC_970FX_v20,              970FX),
     /* PowerPC 970FX v2.1 (G5)                                               */
-    POWERPC_DEF("970fx2.1",    CPU_POWERPC_970FX_v21,   0xFFFFFFFF, 970FX),
+    POWERPC_DEF("970fx_v2.1",    CPU_POWERPC_970FX_v21,              970FX),
     /* PowerPC 970FX v3.0 (G5)                                               */
-    POWERPC_DEF("970fx3.0",    CPU_POWERPC_970FX_v30,   0xFFFFFFFF, 970FX),
+    POWERPC_DEF("970fx_v3.0",    CPU_POWERPC_970FX_v30,              970FX),
     /* PowerPC 970FX v3.1 (G5)                                               */
-    POWERPC_DEF("970fx3.1",    CPU_POWERPC_970FX_v31,   0xFFFFFFFF, 970FX),
+    POWERPC_DEF("970fx_v3.1",    CPU_POWERPC_970FX_v31,              970FX),
     /* PowerPC 970GX (G5)                                                    */
-    POWERPC_DEF("970gx",       CPU_POWERPC_970GX,       0xFFFFFFFF, 970GX),
+    POWERPC_DEF("970gx",         CPU_POWERPC_970GX,                  970GX),
     /* PowerPC 970MP                                                         */
-    POWERPC_DEF("970mp",       CPU_POWERPC_970MP,       0xFFFFFFFF, 970),
+    POWERPC_DEF("970mp",         CPU_POWERPC_970MP,                  970MP),
     /* PowerPC 970MP v1.0                                                    */
-    POWERPC_DEF("970mp1.0",    CPU_POWERPC_970MP_v10,   0xFFFFFFFF, 970),
+    POWERPC_DEF("970mp_v1.0",    CPU_POWERPC_970MP_v10,              970MP),
     /* PowerPC 970MP v1.1                                                    */
-    POWERPC_DEF("970mp1.1",    CPU_POWERPC_970MP_v11,   0xFFFFFFFF, 970),
+    POWERPC_DEF("970mp_v1.1",    CPU_POWERPC_970MP_v11,              970MP),
 #if defined (TODO)
     /* PowerPC Cell                                                          */
-    POWERPC_DEF("Cell",        CPU_POWERPC_CELL,        0xFFFFFFFF, 970),
+    POWERPC_DEF("Cell",          CPU_POWERPC_CELL,                   970),
 #endif
 #if defined (TODO)
     /* PowerPC Cell v1.0                                                     */
-    POWERPC_DEF("Cell1.0",     CPU_POWERPC_CELL_v10,    0xFFFFFFFF, 970),
+    POWERPC_DEF("Cell_v1.0",     CPU_POWERPC_CELL_v10,               970),
 #endif
 #if defined (TODO)
     /* PowerPC Cell v2.0                                                     */
-    POWERPC_DEF("Cell2.0",     CPU_POWERPC_CELL_v20,    0xFFFFFFFF, 970),
+    POWERPC_DEF("Cell_v2.0",     CPU_POWERPC_CELL_v20,               970),
 #endif
 #if defined (TODO)
     /* PowerPC Cell v3.0                                                     */
-    POWERPC_DEF("Cell3.0",     CPU_POWERPC_CELL_v30,    0xFFFFFFFF, 970),
+    POWERPC_DEF("Cell_v3.0",     CPU_POWERPC_CELL_v30,               970),
 #endif
 #if defined (TODO)
     /* PowerPC Cell v3.1                                                     */
-    POWERPC_DEF("Cell3.1",     CPU_POWERPC_CELL_v31,    0xFFFFFFFF, 970),
+    POWERPC_DEF("Cell_v3.1",     CPU_POWERPC_CELL_v31,               970),
 #endif
 #if defined (TODO)
     /* PowerPC Cell v3.2                                                     */
-    POWERPC_DEF("Cell3.2",     CPU_POWERPC_CELL_v32,    0xFFFFFFFF, 970),
+    POWERPC_DEF("Cell_v3.2",     CPU_POWERPC_CELL_v32,               970),
 #endif
 #if defined (TODO)
     /* RS64 (Apache/A35)                                                     */
@@ -5427,64 +8695,62 @@ static ppc_def_t ppc_defs[] = {
      * and the PowerPC 64 one.
      */
     /* What about A10 & A30 ? */
-    POWERPC_DEF("RS64",        CPU_POWERPC_RS64,        0xFFFFFFFF, RS64),
-    POWERPC_DEF("Apache",      CPU_POWERPC_RS64,        0xFFFFFFFF, RS64),
-    POWERPC_DEF("A35",         CPU_POWERPC_RS64,        0xFFFFFFFF, RS64),
+    POWERPC_DEF("RS64",          CPU_POWERPC_RS64,                   RS64),
+    POWERPC_DEF("Apache",        CPU_POWERPC_RS64,                   RS64),
+    POWERPC_DEF("A35",           CPU_POWERPC_RS64,                   RS64),
 #endif
 #if defined (TODO)
     /* RS64-II (NorthStar/A50)                                               */
-    POWERPC_DEF("RS64-II",     CPU_POWERPC_RS64II,      0xFFFFFFFF, RS64),
-    POWERPC_DEF("NorthStar",   CPU_POWERPC_RS64II,      0xFFFFFFFF, RS64),
-    POWERPC_DEF("A50",         CPU_POWERPC_RS64II,      0xFFFFFFFF, RS64),
+    POWERPC_DEF("RS64-II",       CPU_POWERPC_RS64II,                 RS64),
+    POWERPC_DEF("NorthStar",     CPU_POWERPC_RS64II,                 RS64),
+    POWERPC_DEF("A50",           CPU_POWERPC_RS64II,                 RS64),
 #endif
 #if defined (TODO)
     /* RS64-III (Pulsar)                                                     */
-    POWERPC_DEF("RS64-III",    CPU_POWERPC_RS64III,     0xFFFFFFFF, RS64),
-    POWERPC_DEF("Pulsar",      CPU_POWERPC_RS64III,     0xFFFFFFFF, RS64),
+    POWERPC_DEF("RS64-III",      CPU_POWERPC_RS64III,                RS64),
+    POWERPC_DEF("Pulsar",        CPU_POWERPC_RS64III,                RS64),
 #endif
 #if defined (TODO)
     /* RS64-IV (IceStar/IStar/SStar)                                         */
-    POWERPC_DEF("RS64-IV",     CPU_POWERPC_RS64IV,      0xFFFFFFFF, RS64),
-    POWERPC_DEF("IceStar",     CPU_POWERPC_RS64IV,      0xFFFFFFFF, RS64),
-    POWERPC_DEF("IStar",       CPU_POWERPC_RS64IV,      0xFFFFFFFF, RS64),
-    POWERPC_DEF("SStar",       CPU_POWERPC_RS64IV,      0xFFFFFFFF, RS64),
+    POWERPC_DEF("RS64-IV",       CPU_POWERPC_RS64IV,                 RS64),
+    POWERPC_DEF("IceStar",       CPU_POWERPC_RS64IV,                 RS64),
+    POWERPC_DEF("IStar",         CPU_POWERPC_RS64IV,                 RS64),
+    POWERPC_DEF("SStar",         CPU_POWERPC_RS64IV,                 RS64),
 #endif
 #endif /* defined (TARGET_PPC64) */
     /* POWER                                                                 */
 #if defined (TODO)
     /* Original POWER                                                        */
-    POWERPC_DEF("POWER",       CPU_POWERPC_POWER,       0xFFFFFFFF, POWER),
-    POWERPC_DEF("RIOS",        CPU_POWERPC_POWER,       0xFFFFFFFF, POWER),
-    POWERPC_DEF("RSC",         CPU_POWERPC_POWER,       0xFFFFFFFF, POWER),
-    POWERPC_DEF("RSC3308",     CPU_POWERPC_POWER,       0xFFFFFFFF, POWER),
-    POWERPC_DEF("RSC4608",     CPU_POWERPC_POWER,       0xFFFFFFFF, POWER),
+    POWERPC_DEF("POWER",         CPU_POWERPC_POWER,                  POWER),
+    POWERPC_DEF("RIOS",          CPU_POWERPC_POWER,                  POWER),
+    POWERPC_DEF("RSC",           CPU_POWERPC_POWER,                  POWER),
+    POWERPC_DEF("RSC3308",       CPU_POWERPC_POWER,                  POWER),
+    POWERPC_DEF("RSC4608",       CPU_POWERPC_POWER,                  POWER),
 #endif
 #if defined (TODO)
     /* POWER2                                                                */
-    POWERPC_DEF("POWER2",      CPU_POWERPC_POWER2,      0xFFFFFFFF, POWER),
-    POWERPC_DEF("RSC2",        CPU_POWERPC_POWER2,      0xFFFFFFFF, POWER),
-    POWERPC_DEF("P2SC",        CPU_POWERPC_POWER2,      0xFFFFFFFF, POWER),
+    POWERPC_DEF("POWER2",        CPU_POWERPC_POWER2,                 POWER),
+    POWERPC_DEF("RSC2",          CPU_POWERPC_POWER2,                 POWER),
+    POWERPC_DEF("P2SC",          CPU_POWERPC_POWER2,                 POWER),
 #endif
     /* PA semi cores                                                         */
 #if defined (TODO)
     /* PA PA6T */
-    POWERPC_DEF("PA6T",        CPU_POWERPC_PA6T,        0xFFFFFFFF, PA6T),
+    POWERPC_DEF("PA6T",          CPU_POWERPC_PA6T,                   PA6T),
 #endif
     /* Generic PowerPCs                                                      */
 #if defined (TARGET_PPC64)
-#if defined (TODO)
-    POWERPC_DEF("ppc64",       CPU_POWERPC_PPC64,       0xFFFFFFFF, PPC64),
+    POWERPC_DEF("ppc64",         CPU_POWERPC_PPC64,                  PPC64),
 #endif
-#endif
-    POWERPC_DEF("ppc32",       CPU_POWERPC_PPC32,       0xFFFFFFFF, PPC32),
-    POWERPC_DEF("ppc",         CPU_POWERPC_DEFAULT,     0xFFFFFFFF, DEFAULT),
+    POWERPC_DEF("ppc32",         CPU_POWERPC_PPC32,                  PPC32),
+    POWERPC_DEF("ppc",           CPU_POWERPC_DEFAULT,                DEFAULT),
     /* Fallback                                                              */
-    POWERPC_DEF("default",     CPU_POWERPC_DEFAULT,     0xFFFFFFFF, DEFAULT),
+    POWERPC_DEF("default",       CPU_POWERPC_DEFAULT,                DEFAULT),
 };
 
 /*****************************************************************************/
 /* Generic CPU instanciation routine                                         */
-static void init_ppc_proc (CPUPPCState *env, ppc_def_t *def)
+static void init_ppc_proc (CPUPPCState *env, const ppc_def_t *def)
 {
 #if !defined(CONFIG_USER_ONLY)
     int i;
@@ -5496,20 +8762,121 @@ static void init_ppc_proc (CPUPPCState *env, ppc_def_t *def)
     env->excp_prefix = 0x00000000;
     env->ivor_mask = 0x00000000;
     env->ivpr_mask = 0x00000000;
-#endif
     /* Default MMU definitions */
     env->nb_BATs = 0;
     env->nb_tlb = 0;
     env->nb_ways = 0;
+#endif
     /* Register SPR common to all PowerPC implementations */
     gen_spr_generic(env);
     spr_register(env, SPR_PVR, "PVR",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, SPR_NOACCESS,
                  def->pvr);
+    /* Register SVR if it's defined to anything else than POWERPC_SVR_NONE */
+    if (def->svr != POWERPC_SVR_NONE) {
+        if (def->svr & POWERPC_SVR_E500) {
+            spr_register(env, SPR_E500_SVR, "SVR",
+                         SPR_NOACCESS, SPR_NOACCESS,
+                         &spr_read_generic, SPR_NOACCESS,
+                         def->svr & ~POWERPC_SVR_E500);
+        } else {
+            spr_register(env, SPR_SVR, "SVR",
+                         SPR_NOACCESS, SPR_NOACCESS,
+                         &spr_read_generic, SPR_NOACCESS,
+                         def->svr);
+        }
+    }
     /* PowerPC implementation specific initialisations (SPRs, timers, ...) */
     (*def->init_proc)(env);
+    /* MSR bits & flags consistency checks */
+    if (env->msr_mask & (1 << 25)) {
+        switch (env->flags & (POWERPC_FLAG_SPE | POWERPC_FLAG_VRE)) {
+        case POWERPC_FLAG_SPE:
+        case POWERPC_FLAG_VRE:
+            break;
+        default:
+            fprintf(stderr, "PowerPC MSR definition inconsistency\n"
+                    "Should define POWERPC_FLAG_SPE or POWERPC_FLAG_VRE\n");
+            exit(1);
+        }
+    } else if (env->flags & (POWERPC_FLAG_SPE | POWERPC_FLAG_VRE)) {
+        fprintf(stderr, "PowerPC MSR definition inconsistency\n"
+                "Should not define POWERPC_FLAG_SPE nor POWERPC_FLAG_VRE\n");
+        exit(1);
+    }
+    if (env->msr_mask & (1 << 17)) {
+        switch (env->flags & (POWERPC_FLAG_TGPR | POWERPC_FLAG_CE)) {
+        case POWERPC_FLAG_TGPR:
+        case POWERPC_FLAG_CE:
+            break;
+        default:
+            fprintf(stderr, "PowerPC MSR definition inconsistency\n"
+                    "Should define POWERPC_FLAG_TGPR or POWERPC_FLAG_CE\n");
+            exit(1);
+        }
+    } else if (env->flags & (POWERPC_FLAG_TGPR | POWERPC_FLAG_CE)) {
+        fprintf(stderr, "PowerPC MSR definition inconsistency\n"
+                "Should not define POWERPC_FLAG_TGPR nor POWERPC_FLAG_CE\n");
+        exit(1);
+    }
+    if (env->msr_mask & (1 << 10)) {
+        switch (env->flags & (POWERPC_FLAG_SE | POWERPC_FLAG_DWE |
+                              POWERPC_FLAG_UBLE)) {
+        case POWERPC_FLAG_SE:
+        case POWERPC_FLAG_DWE:
+        case POWERPC_FLAG_UBLE:
+            break;
+        default:
+            fprintf(stderr, "PowerPC MSR definition inconsistency\n"
+                    "Should define POWERPC_FLAG_SE or POWERPC_FLAG_DWE or "
+                    "POWERPC_FLAG_UBLE\n");
+            exit(1);
+        }
+    } else if (env->flags & (POWERPC_FLAG_SE | POWERPC_FLAG_DWE |
+                             POWERPC_FLAG_UBLE)) {
+        fprintf(stderr, "PowerPC MSR definition inconsistency\n"
+                "Should not define POWERPC_FLAG_SE nor POWERPC_FLAG_DWE nor "
+                "POWERPC_FLAG_UBLE\n");
+            exit(1);
+    }
+    if (env->msr_mask & (1 << 9)) {
+        switch (env->flags & (POWERPC_FLAG_BE | POWERPC_FLAG_DE)) {
+        case POWERPC_FLAG_BE:
+        case POWERPC_FLAG_DE:
+            break;
+        default:
+            fprintf(stderr, "PowerPC MSR definition inconsistency\n"
+                    "Should define POWERPC_FLAG_BE or POWERPC_FLAG_DE\n");
+            exit(1);
+        }
+    } else if (env->flags & (POWERPC_FLAG_BE | POWERPC_FLAG_DE)) {
+        fprintf(stderr, "PowerPC MSR definition inconsistency\n"
+                "Should not define POWERPC_FLAG_BE nor POWERPC_FLAG_DE\n");
+        exit(1);
+    }
+    if (env->msr_mask & (1 << 2)) {
+        switch (env->flags & (POWERPC_FLAG_PX | POWERPC_FLAG_PMM)) {
+        case POWERPC_FLAG_PX:
+        case POWERPC_FLAG_PMM:
+            break;
+        default:
+            fprintf(stderr, "PowerPC MSR definition inconsistency\n"
+                    "Should define POWERPC_FLAG_PX or POWERPC_FLAG_PMM\n");
+            exit(1);
+        }
+    } else if (env->flags & (POWERPC_FLAG_PX | POWERPC_FLAG_PMM)) {
+        fprintf(stderr, "PowerPC MSR definition inconsistency\n"
+                "Should not define POWERPC_FLAG_PX nor POWERPC_FLAG_PMM\n");
+        exit(1);
+    }
+    if ((env->flags & (POWERPC_FLAG_RTC_CLK | POWERPC_FLAG_BUS_CLK)) == 0) {
+        fprintf(stderr, "PowerPC flags inconsistency\n"
+                "Should define the time-base and decrementer clock source\n");
+        exit(1);
+    }
     /* Allocate TLBs buffer when needed */
+#if !defined(CONFIG_USER_ONLY)
     if (env->nb_tlb != 0) {
         int nb_tlb = env->nb_tlb;
         if (env->id_tlbs != 0)
@@ -5518,12 +8885,16 @@ static void init_ppc_proc (CPUPPCState *env, ppc_def_t *def)
         /* Pre-compute some useful values */
         env->tlb_per_way = env->nb_tlb / env->nb_ways;
     }
-#if !defined(CONFIG_USER_ONLY)
     if (env->irq_inputs == NULL) {
         fprintf(stderr, "WARNING: no internal IRQ controller registered.\n"
                 " Attempt Qemu to crash very soon !\n");
     }
 #endif
+    if (env->check_pow == NULL) {
+        fprintf(stderr, "WARNING: no power management check handler "
+                "registered.\n"
+                " Attempt Qemu to crash very soon !\n");
+    }
 }
 
 #if defined(PPC_DUMP_CPU)
@@ -5627,6 +8998,10 @@ static int register_direct_insn (opc_handler_t **ppc_opcodes,
     if (insert_in_table(ppc_opcodes, idx, handler) < 0) {
         printf("*** ERROR: opcode %02x already assigned in main "
                "opcode table\n", idx);
+#if defined(DO_PPC_STATISTICS) || defined(PPC_DUMP_CPU)
+        printf("           Registered handler '%s' - new handler '%s'\n",
+               ppc_opcodes[idx]->oname, handler->oname);
+#endif
         return -1;
     }
 
@@ -5647,6 +9022,10 @@ static int register_ind_in_table (opc_handler_t **table,
         if (!is_indirect_opcode(table[idx1])) {
             printf("*** ERROR: idx %02x already assigned to a direct "
                    "opcode\n", idx1);
+#if defined(DO_PPC_STATISTICS) || defined(PPC_DUMP_CPU)
+            printf("           Registered handler '%s' - new handler '%s'\n",
+                   ind_table(table[idx1])[idx2]->oname, handler->oname);
+#endif
             return -1;
         }
     }
@@ -5654,6 +9033,10 @@ static int register_ind_in_table (opc_handler_t **table,
         insert_in_table(ind_table(table[idx1]), idx2, handler) < 0) {
         printf("*** ERROR: opcode %02x already assigned in "
                "opcode table %02x\n", idx2, idx1);
+#if defined(DO_PPC_STATISTICS) || defined(PPC_DUMP_CPU)
+        printf("           Registered handler '%s' - new handler '%s'\n",
+               ind_table(table[idx1])[idx2]->oname, handler->oname);
+#endif
         return -1;
     }
 
@@ -5743,7 +9126,7 @@ static void fix_opcode_tables (opc_handler_t **ppc_opcodes)
 }
 
 /*****************************************************************************/
-static int create_ppc_opcodes (CPUPPCState *env, ppc_def_t *def)
+static int create_ppc_opcodes (CPUPPCState *env, const ppc_def_t *def)
 {
     opcode_t *opc, *start, *end;
 
@@ -5773,9 +9156,10 @@ static int create_ppc_opcodes (CPUPPCState *env, ppc_def_t *def)
 }
 
 #if defined(PPC_DUMP_CPU)
-static int dump_ppc_insns (CPUPPCState *env)
+static void dump_ppc_insns (CPUPPCState *env)
 {
     opc_handler_t **table, *handler;
+    const unsigned char *p, *q;
     uint8_t opc1, opc2, opc3;
 
     printf("Instructions set:\n");
@@ -5796,9 +9180,35 @@ static int dump_ppc_insns (CPUPPCState *env)
                     for (opc3 = 0; opc3 < 0x20; opc3++) {
                         handler = table[opc3];
                         if (handler->handler != &gen_invalid) {
-                            printf("INSN: %02x %02x %02x (%02d %04d) : %s\n",
-                                   opc1, opc2, opc3, opc1, (opc3 << 5) | opc2,
-                                   handler->oname);
+                            /* Special hack to properly dump SPE insns */
+                            p = strchr(handler->oname, '_');
+                            if (p == NULL) {
+                                printf("INSN: %02x %02x %02x (%02d %04d) : "
+                                       "%s\n",
+                                       opc1, opc2, opc3, opc1,
+                                       (opc3 << 5) | opc2,
+                                       handler->oname);
+                            } else {
+                                q = "speundef";
+                                if ((p - handler->oname) != strlen(q) ||
+                                    memcmp(handler->oname, q, strlen(q)) != 0) {
+                                    /* First instruction */
+                                    printf("INSN: %02x %02x %02x (%02d %04d) : "
+                                           "%.*s\n",
+                                           opc1, opc2 << 1, opc3, opc1,
+                                           (opc3 << 6) | (opc2 << 1),
+                                           (int)(p - handler->oname),
+                                           handler->oname);
+                                }
+                                if (strcmp(p + 1, q) != 0) {
+                                    /* Second instruction */
+                                    printf("INSN: %02x %02x %02x (%02d %04d) : "
+                                           "%s\n",
+                                           opc1, (opc2 << 1) | 1, opc3, opc1,
+                                           (opc3 << 6) | (opc2 << 1) | 1,
+                                           p + 1);
+                                }
+                            }
                         }
                     }
                 } else {
@@ -5818,13 +9228,15 @@ static int dump_ppc_insns (CPUPPCState *env)
 }
 #endif
 
-int cpu_ppc_register (CPUPPCState *env, ppc_def_t *def)
+int cpu_ppc_register_internal (CPUPPCState *env, const ppc_def_t *def)
 {
     env->msr_mask = def->msr_mask;
     env->mmu_model = def->mmu_model;
     env->excp_model = def->excp_model;
     env->bus_model = def->bus_model;
+    env->flags = def->flags;
     env->bfd_mach = def->bfd_mach;
+    env->check_pow = def->check_pow;
     if (create_ppc_opcodes(env, def) < 0)
         return -1;
     init_ppc_proc(env, def);
@@ -5835,12 +9247,6 @@ int cpu_ppc_register (CPUPPCState *env, ppc_def_t *def)
         case POWERPC_MMU_32B:
             mmu_model = "PowerPC 32";
             break;
-        case POWERPC_MMU_64B:
-            mmu_model = "PowerPC 64";
-            break;
-        case POWERPC_MMU_601:
-            mmu_model = "PowerPC 601";
-            break;
         case POWERPC_MMU_SOFT_6xx:
             mmu_model = "PowerPC 6xx/7xx with software driven TLBs";
             break;
@@ -5854,8 +9260,11 @@ int cpu_ppc_register (CPUPPCState *env, ppc_def_t *def)
             mmu_model = "PowerPC 4xx with software driven TLBs "
                 "and zones protections";
             break;
-        case POWERPC_MMU_REAL_4xx:
-            mmu_model = "PowerPC 4xx real mode only";
+        case POWERPC_MMU_REAL:
+            mmu_model = "PowerPC real mode only";
+            break;
+        case POWERPC_MMU_MPC8xx:
+            mmu_model = "PowerPC MPC8xx";
             break;
         case POWERPC_MMU_BOOKE:
             mmu_model = "PowerPC BookE";
@@ -5863,9 +9272,17 @@ int cpu_ppc_register (CPUPPCState *env, ppc_def_t *def)
         case POWERPC_MMU_BOOKE_FSL:
             mmu_model = "PowerPC BookE FSL";
             break;
-        case POWERPC_MMU_64BRIDGE:
-            mmu_model = "PowerPC 64 bridge";
+        case POWERPC_MMU_601:
+            mmu_model = "PowerPC 601";
+            break;
+#if defined (TARGET_PPC64)
+        case POWERPC_MMU_64B:
+            mmu_model = "PowerPC 64";
             break;
+        case POWERPC_MMU_620:
+            mmu_model = "PowerPC 620";
+            break;
+#endif
         default:
             mmu_model = "Unknown or invalid";
             break;
@@ -5901,12 +9318,14 @@ int cpu_ppc_register (CPUPPCState *env, ppc_def_t *def)
         case POWERPC_EXCP_74xx:
             excp_model = "PowerPC 74xx";
             break;
-        case POWERPC_EXCP_970:
-            excp_model = "PowerPC 970";
-            break;
         case POWERPC_EXCP_BOOKE:
             excp_model = "PowerPC BookE";
             break;
+#if defined (TARGET_PPC64)
+        case POWERPC_EXCP_970:
+            excp_model = "PowerPC 970";
+            break;
+#endif
         default:
             excp_model = "Unknown or invalid";
             break;
@@ -5921,12 +9340,17 @@ int cpu_ppc_register (CPUPPCState *env, ppc_def_t *def)
         case PPC_FLAGS_INPUT_405:
             bus_model = "PowerPC 405";
             break;
-        case PPC_FLAGS_INPUT_970:
-            bus_model = "PowerPC 970";
-            break;
         case PPC_FLAGS_INPUT_401:
             bus_model = "PowerPC 401/403";
             break;
+        case PPC_FLAGS_INPUT_RCPU:
+            bus_model = "RCPU / MPC8xx";
+            break;
+#if defined (TARGET_PPC64)
+        case PPC_FLAGS_INPUT_970:
+            bus_model = "PowerPC 970";
+            break;
+#endif
         default:
             bus_model = "Unknown or invalid";
             break;
@@ -5934,14 +9358,44 @@ int cpu_ppc_register (CPUPPCState *env, ppc_def_t *def)
         printf("PowerPC %-12s : PVR %08x MSR %016" PRIx64 "\n"
                "    MMU model        : %s\n",
                def->name, def->pvr, def->msr_mask, mmu_model);
+#if !defined(CONFIG_USER_ONLY)
         if (env->tlb != NULL) {
             printf("                       %d %s TLB in %d ways\n",
                    env->nb_tlb, env->id_tlbs ? "splitted" : "merged",
                    env->nb_ways);
         }
+#endif
         printf("    Exceptions model : %s\n"
                "    Bus model        : %s\n",
                excp_model, bus_model);
+        printf("    MSR features     :\n");
+        if (env->flags & POWERPC_FLAG_SPE)
+            printf("                        signal processing engine enable"
+                   "\n");
+        else if (env->flags & POWERPC_FLAG_VRE)
+            printf("                        vector processor enable\n");
+        if (env->flags & POWERPC_FLAG_TGPR)
+            printf("                        temporary GPRs\n");
+        else if (env->flags & POWERPC_FLAG_CE)
+            printf("                        critical input enable\n");
+        if (env->flags & POWERPC_FLAG_SE)
+            printf("                        single-step trace mode\n");
+        else if (env->flags & POWERPC_FLAG_DWE)
+            printf("                        debug wait enable\n");
+        else if (env->flags & POWERPC_FLAG_UBLE)
+            printf("                        user BTB lock enable\n");
+        if (env->flags & POWERPC_FLAG_BE)
+            printf("                        branch-step trace mode\n");
+        else if (env->flags & POWERPC_FLAG_DE)
+            printf("                        debug interrupt enable\n");
+        if (env->flags & POWERPC_FLAG_PX)
+            printf("                        inclusive protection\n");
+        else if (env->flags & POWERPC_FLAG_PMM)
+            printf("                        performance monitor mark\n");
+        if (env->flags == POWERPC_FLAG_NONE)
+            printf("                        none\n");
+        printf("    Time-base/decrementer clock source: %s\n",
+               env->flags & POWERPC_FLAG_RTC_CLK ? "RTC clock" : "bus clock");
     }
     dump_ppc_insns(env);
     dump_ppc_sprs(env);
@@ -5951,36 +9405,72 @@ int cpu_ppc_register (CPUPPCState *env, ppc_def_t *def)
     return 0;
 }
 
-int ppc_find_by_name (const unsigned char *name, ppc_def_t **def)
+static const ppc_def_t *ppc_find_by_pvr (uint32_t pvr)
 {
-    int i, max, ret;
+    const ppc_def_t *ret;
+    uint32_t pvr_rev;
+    int i, best, match, best_match, max;
 
-    ret = -1;
-    *def = NULL;
+    ret = NULL;
     max = sizeof(ppc_defs) / sizeof(ppc_def_t);
+    best = -1;
+    pvr_rev = pvr & 0xFFFF;
+    /* We want all specified bits to match */
+    best_match = 32 - ctz32(pvr_rev);
     for (i = 0; i < max; i++) {
-        if (strcasecmp(name, ppc_defs[i].name) == 0) {
-            *def = &ppc_defs[i];
-            ret = 0;
-            break;
+        /* We check that the 16 higher bits are the same to ensure the CPU
+         * model will be the choosen one.
+         */
+        if (((pvr ^ ppc_defs[i].pvr) >> 16) == 0) {
+            /* We want as much as possible of the low-level 16 bits
+             * to be the same but we allow inexact matches.
+             */
+            match = clz32(pvr_rev ^ (ppc_defs[i].pvr & 0xFFFF));
+            /* We check '>=' instead of '>' because the PPC_defs table
+             * is ordered by increasing revision.
+             * Then, we will match the higher revision compatible
+             * with the requested PVR
+             */
+            if (match >= best_match) {
+                best = i;
+                best_match = match;
+            }
         }
     }
+    if (best != -1)
+        ret = &ppc_defs[best];
 
     return ret;
 }
 
-int ppc_find_by_pvr (uint32_t pvr, ppc_def_t **def)
+#include <ctype.h>
+
+const ppc_def_t *cpu_ppc_find_by_name (const unsigned char *name)
 {
-    int i, max, ret;
+    const ppc_def_t *ret;
+    const unsigned char *p;
+    int i, max, len;
 
-    ret = -1;
-    *def = NULL;
+    /* Check if the given name is a PVR */
+    len = strlen(name);
+    if (len == 10 && name[0] == '0' && name[1] == 'x') {
+        p = name + 2;
+        goto check_pvr;
+    } else if (len == 8) {
+        p = name;
+    check_pvr:
+        for (i = 0; i < 8; i++) {
+            if (!isxdigit(*p++))
+                break;
+        }
+        if (i == 8)
+            return ppc_find_by_pvr(strtoul(name, NULL, 16));
+    }
+    ret = NULL;
     max = sizeof(ppc_defs) / sizeof(ppc_def_t);
     for (i = 0; i < max; i++) {
-        if ((pvr & ppc_defs[i].pvr_mask) ==
-            (ppc_defs[i].pvr & ppc_defs[i].pvr_mask)) {
-            *def = &ppc_defs[i];
-            ret = 0;
+        if (strcasecmp(name, ppc_defs[i].name) == 0) {
+            ret = &ppc_defs[i];
             break;
         }
     }
diff --git a/target-sh4/cpu.h b/target-sh4/cpu.h
index add6a47b1..6b90f47d1 100644
--- a/target-sh4/cpu.h
+++ b/target-sh4/cpu.h
@@ -46,16 +46,16 @@
 #define FPSCR_SZ (1 << 20)
 #define FPSCR_PR (1 << 19)
 #define FPSCR_DN (1 << 18)
-
-#define DELAY_SLOT             (1 << 0) /* Must be the same as SR_T.  */
-/* This flag is set if the next insn is a delay slot for a conditional jump.
-   The dynamic value of the DELAY_SLOT determines whether the jup is taken. */
+#define DELAY_SLOT             (1 << 0)
 #define DELAY_SLOT_CONDITIONAL (1 << 1)
-/* Those are used in contexts only */
-#define BRANCH                 (1 << 2)
-#define BRANCH_CONDITIONAL     (1 << 3)
-#define MODE_CHANGE            (1 << 4)	/* Potential MD|RB change */
-#define BRANCH_EXCEPTION       (1 << 5)	/* Branch after exception */
+#define DELAY_SLOT_TRUE        (1 << 2)
+#define DELAY_SLOT_CLEARME     (1 << 3)
+/* The dynamic value of the DELAY_SLOT_TRUE flag determines whether the jump
+ * after the delay slot should be taken or not. It is calculated from SR_T.
+ *
+ * It is unclear if it is permitted to modify the SR_T flag in a delay slot.
+ * The use of DELAY_SLOT_TRUE flag makes us accept such SR_T modification.
+ */
 
 /* XXXXX The structure could be made more compact */
 typedef struct tlb_t {
@@ -77,6 +77,8 @@ typedef struct tlb_t {
 #define UTLB_SIZE 64
 #define ITLB_SIZE 4
 
+#define NB_MMU_MODES 2
+
 typedef struct CPUSH4State {
     uint32_t flags;		/* general execution flags */
     uint32_t gregs[24];		/* general registers */
@@ -119,9 +121,10 @@ typedef struct CPUSH4State {
     int exception_index;
      CPU_COMMON tlb_t utlb[UTLB_SIZE];	/* unified translation table */
     tlb_t itlb[ITLB_SIZE];	/* instruction translation table */
+    void *intc_handle;
 } CPUSH4State;
 
-CPUSH4State *cpu_sh4_init(void);
+CPUSH4State *cpu_sh4_init(const char *cpu_model);
 int cpu_sh4_exec(CPUSH4State * s);
 int cpu_sh4_signal_handler(int host_signum, void *pinfo,
                            void *puc);
@@ -134,6 +137,15 @@ int cpu_sh4_signal_handler(int host_signum, void *pinfo,
 #define cpu_gen_code cpu_sh4_gen_code
 #define cpu_signal_handler cpu_sh4_signal_handler
 
+/* MMU modes definitions */
+#define MMU_MODE0_SUFFIX _kernel
+#define MMU_MODE1_SUFFIX _user
+#define MMU_USER_IDX 1
+static inline int cpu_mmu_index (CPUState *env)
+{
+    return (env->sr & SR_MD) == 0 ? 1 : 0;
+}
+
 #include "cpu-all.h"
 
 /* Memory access type */
diff --git a/target-sh4/exec.h b/target-sh4/exec.h
index a606fd186..608179918 100644
--- a/target-sh4/exec.h
+++ b/target-sh4/exec.h
@@ -63,7 +63,7 @@ static inline void env_to_regs(void)
 }
 
 int cpu_sh4_handle_mmu_fault(CPUState * env, target_ulong address, int rw,
-			     int is_user, int is_softmmu);
+			     int mmu_idx, int is_softmmu);
 
 int find_itlb_entry(CPUState * env, target_ulong address,
 		    int use_asid, int update);
diff --git a/target-sh4/helper.c b/target-sh4/helper.c
index a5af5ba15..52bef2fca 100644
--- a/target-sh4/helper.c
+++ b/target-sh4/helper.c
@@ -27,6 +27,7 @@
 
 #include "cpu.h"
 #include "exec-all.h"
+#include "hw/sh_intc.h"
 
 #if defined(CONFIG_USER_ONLY)
 
@@ -36,19 +37,19 @@ void do_interrupt (CPUState *env)
 }
 
 int cpu_sh4_handle_mmu_fault(CPUState * env, target_ulong address, int rw,
-			     int is_user, int is_softmmu)
+			     int mmu_idx, int is_softmmu)
 {
     env->tea = address;
+    env->exception_index = 0;
     switch (rw) {
     case 0:
+	env->tea = address;
         env->exception_index = 0x0a0;
         break;
     case 1:
+	env->tea = address;
         env->exception_index = 0x0c0;
         break;
-    case 2:
-        env->exception_index = 0x0a0;
-        break;
     }
     return 1;
 }
@@ -74,6 +75,31 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState * env, target_ulong addr)
 
 void do_interrupt(CPUState * env)
 {
+    int do_irq = env->interrupt_request & CPU_INTERRUPT_HARD;
+    int do_exp, irq_vector = env->exception_index;
+
+    /* prioritize exceptions over interrupts */
+
+    do_exp = env->exception_index != -1;
+    do_irq = do_irq && (env->exception_index == -1);
+
+    if (env->sr & SR_BL) {
+        if (do_exp && env->exception_index != 0x1e0) {
+            env->exception_index = 0x000; /* masked exception -> reset */
+        }
+        if (do_irq) {
+            return; /* masked */
+        }
+    }
+
+    if (do_irq) {
+        irq_vector = sh_intc_get_pending_vector(env->intc_handle,
+						(env->sr >> 4) & 0xf);
+        if (irq_vector == -1) {
+            return; /* masked */
+	}
+    }
+
     if (loglevel & CPU_LOG_INT) {
 	const char *expname;
 	switch (env->exception_index) {
@@ -117,32 +143,47 @@ void do_interrupt(CPUState * env)
 	    expname = "trapa";
 	    break;
 	default:
-	    expname = "???";
-	    break;
+            expname = do_irq ? "interrupt" : "???";
+            break;
 	}
 	fprintf(logfile, "exception 0x%03x [%s] raised\n",
-		env->exception_index, expname);
+		irq_vector, expname);
 	cpu_dump_state(env, logfile, fprintf, 0);
     }
 
     env->ssr = env->sr;
-    env->spc = env->spc;
+    env->spc = env->pc;
     env->sgr = env->gregs[15];
     env->sr |= SR_BL | SR_MD | SR_RB;
 
-    env->expevt = env->exception_index & 0x7ff;
-    switch (env->exception_index) {
-    case 0x040:
-    case 0x060:
-    case 0x080:
-	env->pc = env->vbr + 0x400;
-	break;
-    case 0x140:
-	env->pc = 0xa0000000;
-	break;
-    default:
-	env->pc = env->vbr + 0x100;
-	break;
+    if (do_exp) {
+        env->expevt = env->exception_index;
+        switch (env->exception_index) {
+        case 0x000:
+        case 0x020:
+        case 0x140:
+            env->sr &= ~SR_FD;
+            env->sr |= 0xf << 4; /* IMASK */
+            env->pc = 0xa0000000;
+            break;
+        case 0x040:
+        case 0x060:
+            env->pc = env->vbr + 0x400;
+            break;
+        case 0x160:
+            env->spc += 2; /* special case for TRAPA */
+            /* fall through */
+        default:
+            env->pc = env->vbr + 0x100;
+            break;
+        }
+        return;
+    }
+
+    if (do_irq) {
+        env->intevt = irq_vector;
+        env->pc = env->vbr + 0x600;
+        return;
     }
 }
 
@@ -372,15 +413,15 @@ int get_physical_address(CPUState * env, target_ulong * physical,
 }
 
 int cpu_sh4_handle_mmu_fault(CPUState * env, target_ulong address, int rw,
-			     int is_user, int is_softmmu)
+			     int mmu_idx, int is_softmmu)
 {
     target_ulong physical, page_offset, page_size;
     int prot, ret, access_type;
 
     /* XXXXX */
 #if 0
-    fprintf(stderr, "%s pc %08x ad %08x rw %d is_user %d smmu %d\n",
-	    __func__, env->pc, address, rw, is_user, is_softmmu);
+    fprintf(stderr, "%s pc %08x ad %08x rw %d mmu_idx %d smmu %d\n",
+	    __func__, env->pc, address, rw, mmu_idx, is_softmmu);
 #endif
 
     access_type = ACCESS_INT;
@@ -426,7 +467,7 @@ int cpu_sh4_handle_mmu_fault(CPUState * env, target_ulong address, int rw,
     address = (address & TARGET_PAGE_MASK) + page_offset;
     physical = (physical & TARGET_PAGE_MASK) + page_offset;
 
-    return tlb_set_page(env, address, physical, prot, is_user, is_softmmu);
+    return tlb_set_page(env, address, physical, prot, mmu_idx, is_softmmu);
 }
 
 target_phys_addr_t cpu_get_phys_page_debug(CPUState * env, target_ulong addr)
diff --git a/target-sh4/op.c b/target-sh4/op.c
index 0902fca35..1004ef4c7 100644
--- a/target-sh4/op.c
+++ b/target-sh4/op.c
@@ -19,16 +19,6 @@
  */
 #include "exec.h"
 
-static inline void set_flag(uint32_t flag)
-{
-    env->flags |= flag;
-}
-
-static inline void clr_flag(uint32_t flag)
-{
-    env->flags &= ~flag;
-}
-
 static inline void set_t(void)
 {
     env->sr |= SR_T;
@@ -110,28 +100,37 @@ void OPPROTO op_not_T0(void)
 void OPPROTO op_bf_s(void)
 {
     env->delayed_pc = PARAM1;
-    set_flag(DELAY_SLOT_CONDITIONAL | ((~env->sr) & SR_T));
+    if (!(env->sr & SR_T)) {
+        env->flags |= DELAY_SLOT_TRUE;
+    }
     RETURN();
 }
 
 void OPPROTO op_bt_s(void)
 {
     env->delayed_pc = PARAM1;
-    set_flag(DELAY_SLOT_CONDITIONAL | (env->sr & SR_T));
+    if (env->sr & SR_T) {
+        env->flags |= DELAY_SLOT_TRUE;
+    }
+    RETURN();
+}
+
+void OPPROTO op_store_flags(void)
+{
+    env->flags &= DELAY_SLOT_TRUE;
+    env->flags |= PARAM1;
     RETURN();
 }
 
 void OPPROTO op_bra(void)
 {
     env->delayed_pc = PARAM1;
-    set_flag(DELAY_SLOT);
     RETURN();
 }
 
 void OPPROTO op_braf_T0(void)
 {
     env->delayed_pc = PARAM1 + T0;
-    set_flag(DELAY_SLOT);
     RETURN();
 }
 
@@ -139,7 +138,6 @@ void OPPROTO op_bsr(void)
 {
     env->pr = PARAM1;
     env->delayed_pc = PARAM2;
-    set_flag(DELAY_SLOT);
     RETURN();
 }
 
@@ -147,7 +145,6 @@ void OPPROTO op_bsrf_T0(void)
 {
     env->pr = PARAM1;
     env->delayed_pc = PARAM1 + T0;
-    set_flag(DELAY_SLOT);
     RETURN();
 }
 
@@ -155,26 +152,12 @@ void OPPROTO op_jsr_T0(void)
 {
     env->pr = PARAM1;
     env->delayed_pc = T0;
-    set_flag(DELAY_SLOT);
     RETURN();
 }
 
 void OPPROTO op_rts(void)
 {
     env->delayed_pc = env->pr;
-    set_flag(DELAY_SLOT);
-    RETURN();
-}
-
-void OPPROTO op_clr_delay_slot(void)
-{
-    clr_flag(DELAY_SLOT);
-    RETURN();
-}
-
-void OPPROTO op_clr_delay_slot_conditional(void)
-{
-    clr_flag(DELAY_SLOT_CONDITIONAL);
     RETURN();
 }
 
@@ -242,7 +225,6 @@ void OPPROTO op_rte(void)
 {
     env->sr = env->ssr;
     env->delayed_pc = env->spc;
-    set_flag(DELAY_SLOT);
     RETURN();
 }
 
@@ -437,7 +419,7 @@ void OPPROTO op_subv_T0_T1(void)
 
 void OPPROTO op_trapa(void)
 {
-    env->tra = PARAM1 * 2;
+    env->tra = PARAM1 << 2;
     env->exception_index = 0x160;
     do_raise_exception();
     RETURN();
@@ -458,7 +440,6 @@ void OPPROTO op_cmp_pz_T0(void)
 void OPPROTO op_jmp_T0(void)
 {
     env->delayed_pc = T0;
-    set_flag(DELAY_SLOT);
     RETURN();
 }
 
@@ -993,11 +974,10 @@ void OPPROTO op_jT(void)
 
 void OPPROTO op_jdelayed(void)
 {
-    uint32_t flags;
-    flags = env->flags;
-    env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
-    if (flags & DELAY_SLOT)
-	GOTO_LABEL_PARAM(1);
+    if (env->flags & DELAY_SLOT_TRUE) {
+        env->flags &= ~DELAY_SLOT_TRUE;
+        GOTO_LABEL_PARAM(1);
+    }
     RETURN();
 }
 
diff --git a/target-sh4/op_helper.c b/target-sh4/op_helper.c
index 292e9b30d..c1bc4e894 100644
--- a/target-sh4/op_helper.c
+++ b/target-sh4/op_helper.c
@@ -28,7 +28,11 @@ void do_raise_exception(void)
 #ifndef CONFIG_USER_ONLY
 
 #define MMUSUFFIX _mmu
-#define GETPC() (__builtin_return_address(0))
+#ifdef __s390__
+# define GETPC() ((void*)((unsigned long)__builtin_return_address(0) & 0x7fffffffUL))
+#else
+# define GETPC() (__builtin_return_address(0))
+#endif
 
 #define SHIFT 0
 #include "softmmu_template.h"
@@ -42,7 +46,7 @@ void do_raise_exception(void)
 #define SHIFT 3
 #include "softmmu_template.h"
 
-void tlb_fill(target_ulong addr, int is_write, int is_user, void *retaddr)
+void tlb_fill(target_ulong addr, int is_write, int mmu_idx, void *retaddr)
 {
     TranslationBlock *tb;
     CPUState *saved_env;
@@ -53,7 +57,7 @@ void tlb_fill(target_ulong addr, int is_write, int is_user, void *retaddr)
        generated code */
     saved_env = env;
     env = cpu_single_env;
-    ret = cpu_sh4_handle_mmu_fault(env, addr, is_write, is_user, 1);
+    ret = cpu_sh4_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
     if (ret) {
 	if (retaddr) {
 	    /* now we have a real cpu fault */
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 35b6f08dc..802f926ca 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -57,11 +57,21 @@ typedef struct DisasContext {
     uint32_t fpscr;
     uint16_t opcode;
     uint32_t flags;
+    int bstate;
     int memidx;
     uint32_t delayed_pc;
     int singlestep_enabled;
 } DisasContext;
 
+enum {
+    BS_NONE     = 0, /* We go out of the TB without reaching a branch or an
+                      * exception condition
+                      */
+    BS_STOP     = 1, /* We want to stop translation for any reason */
+    BS_BRANCH   = 2, /* We reached a branch condition     */
+    BS_EXCP     = 3, /* We reached an exception condition */
+};
+
 #ifdef CONFIG_USER_ONLY
 
 #define GEN_OP_LD(width, reg) \
@@ -133,15 +143,15 @@ void cpu_sh4_reset(CPUSH4State * env)
     env->pc = 0xA0000000;
 #if defined(CONFIG_USER_ONLY)
     env->fpscr = FPSCR_PR; /* value for userspace according to the kernel */
-    env->fp_status.float_rounding_mode = float_round_nearest_even; /* ?! */
+    set_float_rounding_mode(float_round_nearest_even, &env->fp_status); /* ?! */
 #else
     env->fpscr = 0x00040001; /* CPU reset value according to SH4 manual */
-    env->fp_status.float_rounding_mode = float_round_to_zero;
+    set_float_rounding_mode(float_round_to_zero, &env->fp_status);
 #endif
     env->mmucr = 0;
 }
 
-CPUSH4State *cpu_sh4_init(void)
+CPUSH4State *cpu_sh4_init(const char *cpu_model)
 {
     CPUSH4State *env;
 
@@ -176,15 +186,6 @@ static void gen_goto_tb(DisasContext * ctx, int n, target_ulong dest)
     gen_op_exit_tb();
 }
 
-/* Jump to pc after an exception */
-static void gen_jump_exception(DisasContext * ctx)
-{
-    gen_op_movl_imm_T0(0);
-    if (ctx->singlestep_enabled)
-	gen_op_debug();
-    gen_op_exit_tb();
-}
-
 static void gen_jump(DisasContext * ctx)
 {
     if (ctx->delayed_pc == (uint32_t) - 1) {
@@ -220,7 +221,7 @@ static void gen_delayed_conditional_jump(DisasContext * ctx)
 
     l1 = gen_new_label();
     gen_op_jdelayed(l1);
-    gen_goto_tb(ctx, 1, ctx->pc);
+    gen_goto_tb(ctx, 1, ctx->pc + 2);
     gen_set_label(l1);
     gen_jump(ctx);
 }
@@ -248,10 +249,10 @@ static void gen_delayed_conditional_jump(DisasContext * ctx)
 
 #define CHECK_NOT_DELAY_SLOT \
   if (ctx->flags & (DELAY_SLOT | DELAY_SLOT_CONDITIONAL)) \
-  {gen_op_raise_slot_illegal_instruction (); ctx->flags |= BRANCH_EXCEPTION; \
+  {gen_op_raise_slot_illegal_instruction (); ctx->bstate = BS_EXCP; \
    return;}
 
-void decode_opc(DisasContext * ctx)
+void _decode_opc(DisasContext * ctx)
 {
 #if 0
     fprintf(stderr, "Translating opcode 0x%04x\n", ctx->opcode);
@@ -290,11 +291,11 @@ void decode_opc(DisasContext * ctx)
 	return;
     case 0xfbfb:		/* frchg */
 	gen_op_frchg();
-	ctx->flags |= MODE_CHANGE;
+	ctx->bstate = BS_STOP;
 	return;
     case 0xf3fb:		/* fschg */
 	gen_op_fschg();
-	ctx->flags |= MODE_CHANGE;
+	ctx->bstate = BS_STOP;
 	return;
     case 0x0009:		/* nop */
 	return;
@@ -805,7 +806,7 @@ void decode_opc(DisasContext * ctx)
 	CHECK_NOT_DELAY_SLOT
 	    gen_conditional_jump(ctx, ctx->pc + 2,
 				 ctx->pc + 4 + B7_0s * 2);
-	ctx->flags |= BRANCH_CONDITIONAL;
+	ctx->bstate = BS_BRANCH;
 	return;
     case 0x8f00:		/* bf/s label */
 	CHECK_NOT_DELAY_SLOT
@@ -816,7 +817,7 @@ void decode_opc(DisasContext * ctx)
 	CHECK_NOT_DELAY_SLOT
 	    gen_conditional_jump(ctx, ctx->pc + 4 + B7_0s * 2,
 				 ctx->pc + 2);
-	ctx->flags |= BRANCH_CONDITIONAL;
+	ctx->bstate = BS_BRANCH;
 	return;
     case 0x8d00:		/* bt/s label */
 	CHECK_NOT_DELAY_SLOT
@@ -908,7 +909,7 @@ void decode_opc(DisasContext * ctx)
     case 0xc300:		/* trapa #imm */
 	CHECK_NOT_DELAY_SLOT gen_op_movl_imm_PC(ctx->pc);
 	gen_op_trapa(B7_0);
-	ctx->flags |= BRANCH;
+	ctx->bstate = BS_BRANCH;
 	return;
     case 0xc800:		/* tst #imm,R0 */
 	gen_op_tst_imm_rN(B7_0, REG(0));
@@ -1012,8 +1013,8 @@ void decode_opc(DisasContext * ctx)
     gen_op_movl_rN_T1 (REG(B11_8));				\
     gen_op_stl_T0_T1 (ctx);					\
     return;
-	LDST(sr, 0x400e, 0x4007, ldc, 0x0002, 0x4003, stc, ctx->flags |=
-	     MODE_CHANGE;)
+	LDST(sr, 0x400e, 0x4007, ldc, 0x0002, 0x4003, stc, ctx->bstate =
+	     BS_STOP;)
 	LDST(gbr, 0x401e, 0x4017, ldc, 0x0012, 0x4013, stc,)
 	LDST(vbr, 0x402e, 0x4027, ldc, 0x0022, 0x4023, stc,)
 	LDST(ssr, 0x403e, 0x4037, ldc, 0x0032, 0x4033, stc,)
@@ -1023,8 +1024,8 @@ void decode_opc(DisasContext * ctx)
 	LDST(macl, 0x401a, 0x4016, lds, 0x001a, 0x4012, sts,)
 	LDST(pr, 0x402a, 0x4026, lds, 0x002a, 0x4022, sts,)
 	LDST(fpul, 0x405a, 0x4056, lds, 0x005a, 0x4052, sts,)
-	LDST(fpscr, 0x406a, 0x4066, lds, 0x006a, 0x4062, sts, ctx->flags |=
-	     MODE_CHANGE;)
+	LDST(fpscr, 0x406a, 0x4066, lds, 0x006a, 0x4062, sts, ctx->bstate =
+	     BS_STOP;)
     case 0x00c3:		/* movca.l R0,@Rm */
 	gen_op_movl_rN_T0(REG(0));
 	gen_op_movl_rN_T1(REG(B11_8));
@@ -1141,7 +1142,28 @@ void decode_opc(DisasContext * ctx)
     fprintf(stderr, "unknown instruction 0x%04x at pc 0x%08x\n",
 	    ctx->opcode, ctx->pc);
     gen_op_raise_illegal_instruction();
-    ctx->flags |= BRANCH_EXCEPTION;
+    ctx->bstate = BS_EXCP;
+}
+
+void decode_opc(DisasContext * ctx)
+{
+    uint32_t old_flags = ctx->flags;
+
+    _decode_opc(ctx);
+
+    if (old_flags & (DELAY_SLOT | DELAY_SLOT_CONDITIONAL)) {
+        if (ctx->flags & DELAY_SLOT_CLEARME) {
+            gen_op_store_flags(0);
+        }
+        ctx->flags = 0;
+        ctx->bstate = BS_BRANCH;
+        if (old_flags & DELAY_SLOT_CONDITIONAL) {
+	    gen_delayed_conditional_jump(ctx);
+        } else if (old_flags & DELAY_SLOT) {
+            gen_jump(ctx);
+	}
+
+    }
 }
 
 static inline int
@@ -1151,7 +1173,6 @@ gen_intermediate_code_internal(CPUState * env, TranslationBlock * tb,
     DisasContext ctx;
     target_ulong pc_start;
     static uint16_t *gen_opc_end;
-    uint32_t old_flags;
     int i, ii;
 
     pc_start = tb->pc;
@@ -1159,14 +1180,14 @@ gen_intermediate_code_internal(CPUState * env, TranslationBlock * tb,
     gen_opc_end = gen_opc_buf + OPC_MAX_SIZE;
     gen_opparam_ptr = gen_opparam_buf;
     ctx.pc = pc_start;
-    ctx.flags = env->flags;
-    old_flags = 0;
+    ctx.flags = (uint32_t)tb->flags;
+    ctx.bstate = BS_NONE;
     ctx.sr = env->sr;
     ctx.fpscr = env->fpscr;
     ctx.memidx = (env->sr & SR_MD) ? 1 : 0;
     /* We don't know if the delayed pc came from a dynamic or static branch,
        so assume it is a dynamic branch.  */
-    ctx.delayed_pc = -1;
+    ctx.delayed_pc = -1; /* use delayed pc from env pointer */
     ctx.tb = tb;
     ctx.singlestep_enabled = env->singlestep_enabled;
     nb_gen_labels = 0;
@@ -1180,18 +1201,14 @@ gen_intermediate_code_internal(CPUState * env, TranslationBlock * tb,
 #endif
 
     ii = -1;
-    while ((old_flags & (DELAY_SLOT | DELAY_SLOT_CONDITIONAL)) == 0 &&
-	   (ctx.flags & (BRANCH | BRANCH_CONDITIONAL | MODE_CHANGE |
-			 BRANCH_EXCEPTION)) == 0 &&
-	   gen_opc_ptr < gen_opc_end && ctx.sr == env->sr) {
-	old_flags = ctx.flags;
+    while (ctx.bstate == BS_NONE && gen_opc_ptr < gen_opc_end) {
 	if (env->nb_breakpoints > 0) {
 	    for (i = 0; i < env->nb_breakpoints; i++) {
 		if (ctx.pc == env->breakpoints[i]) {
 		    /* We have hit a breakpoint - make sure PC is up-to-date */
 		    gen_op_movl_imm_PC(ctx.pc);
 		    gen_op_debug();
-		    ctx.flags |= BRANCH_EXCEPTION;
+		    ctx.bstate = BS_EXCP;
 		    break;
 		}
 	    }
@@ -1204,6 +1221,7 @@ gen_intermediate_code_internal(CPUState * env, TranslationBlock * tb,
                     gen_opc_instr_start[ii++] = 0;
             }
             gen_opc_pc[ii] = ctx.pc;
+            gen_opc_hflags[ii] = ctx.flags;
             gen_opc_instr_start[ii] = 1;
         }
 #if 0
@@ -1221,21 +1239,30 @@ gen_intermediate_code_internal(CPUState * env, TranslationBlock * tb,
 	break;
 #endif
     }
-
-    if (old_flags & DELAY_SLOT_CONDITIONAL) {
-	gen_delayed_conditional_jump(&ctx);
-    } else if (old_flags & DELAY_SLOT) {
-	gen_op_clr_delay_slot();
-	gen_jump(&ctx);
-    } else if (ctx.flags & BRANCH_EXCEPTION) {
-        gen_jump_exception(&ctx);
-    } else if ((ctx.flags & (BRANCH | BRANCH_CONDITIONAL)) == 0) {
-        gen_goto_tb(&ctx, 0, ctx.pc);
-    }
-
     if (env->singlestep_enabled) {
-	gen_op_debug();
+        gen_op_debug();
+    } else {
+	switch (ctx.bstate) {
+        case BS_STOP:
+            /* gen_op_interrupt_restart(); */
+            /* fall through */
+        case BS_NONE:
+            if (ctx.flags) {
+                gen_op_store_flags(ctx.flags | DELAY_SLOT_CLEARME);
+	    }
+            gen_goto_tb(&ctx, 0, ctx.pc);
+            break;
+        case BS_EXCP:
+            /* gen_op_interrupt_restart(); */
+            gen_op_movl_imm_T0(0);
+            gen_op_exit_tb();
+            break;
+        case BS_BRANCH:
+        default:
+            break;
+	}
     }
+
     *gen_opc_ptr = INDEX_op_end;
     if (search_pc) {
         i = gen_opc_ptr - gen_opc_buf;
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index 5c8c49ab6..6f95d9469 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -98,6 +98,8 @@
 #define PS_AG    (1<<0)
 
 #define FPRS_FEF (1<<2)
+
+#define HS_PRIV  (1<<2)
 #endif
 
 /* Fcc */
@@ -145,7 +147,6 @@
 /* MMU */
 #define MMU_E     (1<<0)
 #define MMU_NF    (1<<1)
-#define MMU_BM    (1<<14)
 
 #define PTE_ENTRYTYPE_MASK 3
 #define PTE_ACCESS_MASK    0x1c
@@ -164,7 +165,11 @@
 /* 2 <= NWINDOWS <= 32. In QEMU it must also be a power of two. */
 #define NWINDOWS  8
 
-typedef struct sparc_def_t sparc_def_t;
+#if !defined(TARGET_SPARC64)
+#define NB_MMU_MODES 2
+#else
+#define NB_MMU_MODES 3
+#endif
 
 typedef struct CPUSPARCState {
     target_ulong gregs[8]; /* general registers */
@@ -192,6 +197,7 @@ typedef struct CPUSPARCState {
     int interrupt_index;
     int interrupt_request;
     int halted;
+    uint32_t mmu_bm;
     /* NOTE: we allow 8 more registers to handle wrapping */
     target_ulong regbase[NWINDOWS * 16 + 8];
 
@@ -209,11 +215,17 @@ typedef struct CPUSPARCState {
     uint64_t dtlb_tag[64];
     uint64_t dtlb_tte[64];
 #else
-    uint32_t mmuregs[16];
+    uint32_t mmuregs[32];
+    uint64_t mxccdata[4];
+    uint64_t mxccregs[8];
+    uint64_t prom_addr;
 #endif
     /* temporary float registers */
     float32 ft0, ft1;
     float64 dt0, dt1;
+#if defined(CONFIG_USER_ONLY)
+    float128 qt0, qt1;
+#endif
     float_status fp_status;
 #if defined(TARGET_SPARC64)
 #define MAXTL 4
@@ -260,13 +272,12 @@ typedef struct CPUSPARCState {
     } while (0)
 #endif
 
-CPUSPARCState *cpu_sparc_init(void);
+CPUSPARCState *cpu_sparc_init(const char *cpu_model);
 int cpu_sparc_exec(CPUSPARCState *s);
 int cpu_sparc_close(CPUSPARCState *s);
-int sparc_find_by_name (const unsigned char *name, const sparc_def_t **def);
 void sparc_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt,
                                                  ...));
-int cpu_sparc_register (CPUSPARCState *env, const sparc_def_t *def);
+void cpu_sparc_set_id(CPUSPARCState *env, unsigned int cpu);
 
 #define GET_PSR(env) (env->version | (env->psr & PSR_ICC) |             \
                       (env->psref? PSR_EF : 0) |                        \
@@ -315,6 +326,41 @@ void cpu_check_irqs(CPUSPARCState *env);
 #define cpu_exec cpu_sparc_exec
 #define cpu_gen_code cpu_sparc_gen_code
 #define cpu_signal_handler cpu_sparc_signal_handler
+#define cpu_list sparc_cpu_list
+
+/* MMU modes definitions */
+#define MMU_MODE0_SUFFIX _user
+#define MMU_MODE1_SUFFIX _kernel
+#ifdef TARGET_SPARC64
+#define MMU_MODE2_SUFFIX _hypv
+#endif
+#define MMU_USER_IDX 0
+static inline int cpu_mmu_index (CPUState *env)
+{
+#if defined(CONFIG_USER_ONLY)
+    return 0;
+#elif !defined(TARGET_SPARC64)
+    return env->psrs;
+#else
+    if (!env->psrs)
+        return 0;
+    else if ((env->hpstate & HS_PRIV) == 0)
+        return 1;
+    else
+        return 2;
+#endif
+}
+
+static inline int cpu_fpu_enabled(CPUState *env)
+{
+#if defined(CONFIG_USER_ONLY)
+    return 1;
+#elif !defined(TARGET_SPARC64)
+    return env->psref;
+#else
+    return ((env->pstate & PS_PEF) != 0) && ((env->fprs & FPRS_FEF) != 0);
+#endif
+}
 
 #include "cpu-all.h"
 
diff --git a/target-sparc/exec.h b/target-sparc/exec.h
index 063e2ee64..54c824ee8 100644
--- a/target-sparc/exec.h
+++ b/target-sparc/exec.h
@@ -41,6 +41,10 @@ register uint32_t T2 asm(AREG3);
 #define FT1 (env->ft1)
 #define DT0 (env->dt0)
 #define DT1 (env->dt1)
+#if defined(CONFIG_USER_ONLY)
+#define QT0 (env->qt0)
+#define QT1 (env->qt1)
+#endif
 
 #include "cpu.h"
 #include "exec-all.h"
@@ -65,8 +69,16 @@ void do_fcmps(void);
 void do_fcmpd(void);
 void do_fcmpes(void);
 void do_fcmped(void);
+#if defined(CONFIG_USER_ONLY)
+void do_fitoq(void);
+void do_fsqrtq(void);
+void do_fcmpq(void);
+void do_fcmpeq(void);
+#endif
 #ifdef TARGET_SPARC64
 void do_fabsd(void);
+void do_fxtos(void);
+void do_fxtod(void);
 void do_fcmps_fcc1(void);
 void do_fcmpd_fcc1(void);
 void do_fcmps_fcc2(void);
@@ -79,6 +91,16 @@ void do_fcmpes_fcc2(void);
 void do_fcmped_fcc2(void);
 void do_fcmpes_fcc3(void);
 void do_fcmped_fcc3(void);
+#if defined(CONFIG_USER_ONLY)
+void do_fabsq(void);
+void do_fxtoq(void);
+void do_fcmpq_fcc1(void);
+void do_fcmpq_fcc2(void);
+void do_fcmpq_fcc3(void);
+void do_fcmpeq_fcc1(void);
+void do_fcmpeq_fcc2(void);
+void do_fcmpeq_fcc3(void);
+#endif
 void do_popc();
 void do_wrpstate();
 void do_done();
@@ -115,7 +137,7 @@ static inline void regs_to_env(void)
 }
 
 int cpu_sparc_handle_mmu_fault(CPUState *env, target_ulong address, int rw,
-                               int is_user, int is_softmmu);
+                               int mmu_idx, int is_softmmu);
 
 static inline int cpu_halted(CPUState *env) {
     if (!env->halted)
diff --git a/target-sparc/fop_template.h b/target-sparc/fop_template.h
index 0598b3020..0c045b835 100644
--- a/target-sparc/fop_template.h
+++ b/target-sparc/fop_template.h
@@ -77,5 +77,52 @@ void OPPROTO glue(op_store_DT1_fpr_fpr, REGNAME)(void)
     *p = u.l.upper;
 }
 
+#if defined(CONFIG_USER_ONLY)
+/* quad floating point registers moves */
+void OPPROTO glue(op_load_fpr_QT0_fpr, REGNAME)(void)
+{
+    CPU_QuadU u;
+    uint32_t *p = (uint32_t *)&REG;
+    u.l.lowest = *(p + 3);
+    u.l.lower = *(p + 2);
+    u.l.upper = *(p + 1);
+    u.l.upmost = *p;
+    QT0 = u.q;
+}
+
+void OPPROTO glue(op_store_QT0_fpr_fpr, REGNAME)(void)
+{
+    CPU_QuadU u;
+    uint32_t *p = (uint32_t *)&REG;
+    u.q = QT0;
+    *(p + 3) = u.l.lowest;
+    *(p + 2) = u.l.lower;
+    *(p + 1) = u.l.upper;
+    *p = u.l.upmost;
+}
+
+void OPPROTO glue(op_load_fpr_QT1_fpr, REGNAME)(void)
+{
+    CPU_QuadU u;
+    uint32_t *p = (uint32_t *)&REG;
+    u.l.lowest = *(p + 3);
+    u.l.lower = *(p + 2);
+    u.l.upper = *(p + 1);
+    u.l.upmost = *p;
+    QT1 = u.q;
+}
+
+void OPPROTO glue(op_store_QT1_fpr_fpr, REGNAME)(void)
+{
+    CPU_QuadU u;
+    uint32_t *p = (uint32_t *)&REG;
+    u.q = QT1;
+    *(p + 3) = u.l.lowest;
+    *(p + 2) = u.l.lower;
+    *(p + 1) = u.l.upper;
+    *p = u.l.upmost;
+}
+#endif
+
 #undef REG
 #undef REGNAME
diff --git a/target-sparc/helper.c b/target-sparc/helper.c
index af8bc9694..894e32628 100644
--- a/target-sparc/helper.c
+++ b/target-sparc/helper.c
@@ -49,7 +49,7 @@ void cpu_unlock(void)
 #if defined(CONFIG_USER_ONLY)
 
 int cpu_sparc_handle_mmu_fault(CPUState *env, target_ulong address, int rw,
-                               int is_user, int is_softmmu)
+                               int mmu_idx, int is_softmmu)
 {
     if (rw & 2)
         env->exception_index = TT_TFAULT;
@@ -100,21 +100,22 @@ static const int perm_table[2][8] = {
 
 int get_physical_address (CPUState *env, target_phys_addr_t *physical, int *prot,
                           int *access_index, target_ulong address, int rw,
-                          int is_user)
+                          int mmu_idx)
 {
     int access_perms = 0;
     target_phys_addr_t pde_ptr;
     uint32_t pde;
     target_ulong virt_addr;
-    int error_code = 0, is_dirty;
+    int error_code = 0, is_dirty, is_user;
     unsigned long page_offset;
 
+    is_user = mmu_idx == MMU_USER_IDX;
     virt_addr = address & TARGET_PAGE_MASK;
 
     if ((env->mmuregs[0] & MMU_E) == 0) { /* MMU disabled */
         // Boot mode: instruction fetches are taken from PROM
-        if (rw == 2 && (env->mmuregs[0] & MMU_BM)) {
-            *physical = 0xff0000000ULL | (address & 0x3ffffULL);
+        if (rw == 2 && (env->mmuregs[0] & env->mmu_bm)) {
+            *physical = env->prom_addr | (address & 0x7ffffULL);
             *prot = PAGE_READ | PAGE_EXEC;
             return 0;
         }
@@ -216,13 +217,13 @@ int get_physical_address (CPUState *env, target_phys_addr_t *physical, int *prot
 
 /* Perform address translation */
 int cpu_sparc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int is_user, int is_softmmu)
+                              int mmu_idx, int is_softmmu)
 {
     target_phys_addr_t paddr;
     target_ulong vaddr;
     int error_code = 0, prot, ret = 0, access_index;
 
-    error_code = get_physical_address(env, &paddr, &prot, &access_index, address, rw, is_user);
+    error_code = get_physical_address(env, &paddr, &prot, &access_index, address, rw, mmu_idx);
     if (error_code == 0) {
         vaddr = address & TARGET_PAGE_MASK;
         paddr &= TARGET_PAGE_MASK;
@@ -230,7 +231,7 @@ int cpu_sparc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
         printf("Translate at " TARGET_FMT_lx " -> " TARGET_FMT_plx ", vaddr "
                TARGET_FMT_lx "\n", address, paddr, vaddr);
 #endif
-        ret = tlb_set_page_exec(env, vaddr, paddr, prot, is_user, is_softmmu);
+        ret = tlb_set_page_exec(env, vaddr, paddr, prot, mmu_idx, is_softmmu);
         return ret;
     }
 
@@ -246,7 +247,7 @@ int cpu_sparc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
         // switching to normal mode.
         vaddr = address & TARGET_PAGE_MASK;
         prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
-        ret = tlb_set_page_exec(env, vaddr, paddr, prot, is_user, is_softmmu);
+        ret = tlb_set_page_exec(env, vaddr, paddr, prot, mmu_idx, is_softmmu);
         return ret;
     } else {
         if (rw & 2)
@@ -484,8 +485,10 @@ static int get_physical_address_code(CPUState *env, target_phys_addr_t *physical
 
 int get_physical_address(CPUState *env, target_phys_addr_t *physical, int *prot,
                           int *access_index, target_ulong address, int rw,
-                          int is_user)
+                          int mmu_idx)
 {
+    int is_user = mmu_idx == MMU_USER_IDX;
+
     if (rw == 2)
         return get_physical_address_code(env, physical, prot, access_index, address, rw, is_user);
     else
@@ -494,20 +497,20 @@ int get_physical_address(CPUState *env, target_phys_addr_t *physical, int *prot,
 
 /* Perform address translation */
 int cpu_sparc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int is_user, int is_softmmu)
+                              int mmu_idx, int is_softmmu)
 {
     target_ulong virt_addr, vaddr;
     target_phys_addr_t paddr;
     int error_code = 0, prot, ret = 0, access_index;
 
-    error_code = get_physical_address(env, &paddr, &prot, &access_index, address, rw, is_user);
+    error_code = get_physical_address(env, &paddr, &prot, &access_index, address, rw, mmu_idx);
     if (error_code == 0) {
         virt_addr = address & TARGET_PAGE_MASK;
         vaddr = virt_addr + ((address & TARGET_PAGE_MASK) & (TARGET_PAGE_SIZE - 1));
 #ifdef DEBUG_MMU
         printf("Translate at 0x%" PRIx64 " -> 0x%" PRIx64 ", vaddr 0x%" PRIx64 "\n", address, paddr, vaddr);
 #endif
-        ret = tlb_set_page_exec(env, vaddr, paddr, prot, is_user, is_softmmu);
+        ret = tlb_set_page_exec(env, vaddr, paddr, prot, mmu_idx, is_softmmu);
         return ret;
     }
     // XXX
@@ -601,3 +604,34 @@ void memcpy32(target_ulong *dst, const target_ulong *src)
     dst[6] = src[6];
     dst[7] = src[7];
 }
+
+#ifdef TARGET_SPARC64
+#if !defined(CONFIG_USER_ONLY)
+#include "qemu-common.h"
+#include "hw/irq.h"
+#include "qemu-timer.h"
+#endif
+
+void do_tick_set_count(void *opaque, uint64_t count)
+{
+#if !defined(CONFIG_USER_ONLY)
+    ptimer_set_count(opaque, -count);
+#endif
+}
+
+uint64_t do_tick_get_count(void *opaque)
+{
+#if !defined(CONFIG_USER_ONLY)
+    return -ptimer_get_count(opaque);
+#else
+    return 0;
+#endif
+}
+
+void do_tick_set_limit(void *opaque, uint64_t limit)
+{
+#if !defined(CONFIG_USER_ONLY)
+    ptimer_set_limit(opaque, -limit, 0);
+#endif
+}
+#endif
diff --git a/target-sparc/op.c b/target-sparc/op.c
index 613bcb09a..52b824cc7 100644
--- a/target-sparc/op.c
+++ b/target-sparc/op.c
@@ -534,7 +534,7 @@ void OPPROTO op_tadd_T1_T0_ccTV(void)
          ((src1 & 0xffffffff) ^ (T0 & 0xffffffff))) & (1 << 31))
         raise_exception(TT_TOVF);
 #else
-    if ((src1 & 0x03) || (T1 & 0x03))
+    if (((src1 ^ T1 ^ -1) & (src1 ^ T0)) & (1 << 31))
         raise_exception(TT_TOVF);
 #endif
 
@@ -1023,6 +1023,11 @@ void OPPROTO op_sra(void)
 
 #define MEMSUFFIX _kernel
 #include "op_mem.h"
+
+#ifdef TARGET_SPARC64
+#define MEMSUFFIX _hypv
+#include "op_mem.h"
+#endif
 #endif
 
 void OPPROTO op_ldfsr(void)
@@ -1239,12 +1244,14 @@ void OPPROTO op_exception(void)
 {
     env->exception_index = PARAM1;
     cpu_loop_exit();
+    FORCE_RET();
 }
 
 void OPPROTO op_trap_T0(void)
 {
     env->exception_index = TT_TRAP + (T0 & 0x7f);
     cpu_loop_exit();
+    FORCE_RET();
 }
 
 void OPPROTO op_trapcc_T0(void)
@@ -1576,6 +1583,7 @@ void OPPROTO op_clear_ieee_excp_and_FTT(void)
 
 #define F_OP(name, p) void OPPROTO op_f##name##p(void)
 
+#if defined(CONFIG_USER_ONLY)
 #define F_BINOP(name)                                           \
     F_OP(name, s)                                               \
     {                                                           \
@@ -1588,7 +1596,28 @@ void OPPROTO op_clear_ieee_excp_and_FTT(void)
         set_float_exception_flags(0, &env->fp_status);          \
         DT0 = float64_ ## name (DT0, DT1, &env->fp_status);     \
         check_ieee_exceptions();                                \
+    }                                                           \
+    F_OP(name, q)                                               \
+    {                                                           \
+        set_float_exception_flags(0, &env->fp_status);          \
+        QT0 = float128_ ## name (QT0, QT1, &env->fp_status);    \
+        check_ieee_exceptions();                                \
     }
+#else
+#define F_BINOP(name)                                           \
+    F_OP(name, s)                                               \
+    {                                                           \
+        set_float_exception_flags(0, &env->fp_status);          \
+        FT0 = float32_ ## name (FT0, FT1, &env->fp_status);     \
+        check_ieee_exceptions();                                \
+    }                                                           \
+    F_OP(name, d)                                               \
+    {                                                           \
+        set_float_exception_flags(0, &env->fp_status);          \
+        DT0 = float64_ ## name (DT0, DT1, &env->fp_status);     \
+        check_ieee_exceptions();                                \
+    }
+#endif
 
 F_BINOP(add);
 F_BINOP(sub);
@@ -1605,6 +1634,32 @@ void OPPROTO op_fsmuld(void)
     check_ieee_exceptions();
 }
 
+#if defined(CONFIG_USER_ONLY)
+void OPPROTO op_fdmulq(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    QT0 = float128_mul(float64_to_float128(DT0, &env->fp_status),
+                       float64_to_float128(DT1, &env->fp_status),
+                       &env->fp_status);
+    check_ieee_exceptions();
+}
+#endif
+
+#if defined(CONFIG_USER_ONLY)
+#define F_HELPER(name)    \
+    F_OP(name, s)         \
+    {                     \
+        do_f##name##s();  \
+    }                     \
+    F_OP(name, d)         \
+    {                     \
+        do_f##name##d();  \
+    }                     \
+    F_OP(name, q)         \
+    {                     \
+        do_f##name##q();  \
+    }
+#else
 #define F_HELPER(name)    \
     F_OP(name, s)         \
     {                     \
@@ -1614,6 +1669,7 @@ void OPPROTO op_fsmuld(void)
     {                     \
         do_f##name##d();  \
     }
+#endif
 
 F_HELPER(sqrt);
 
@@ -1641,6 +1697,18 @@ F_OP(abs, d)
     do_fabsd();
 }
 
+#if defined(CONFIG_USER_ONLY)
+F_OP(neg, q)
+{
+    QT0 = float128_chs(QT1);
+}
+
+F_OP(abs, q)
+{
+    do_fabsd();
+}
+#endif
+
 void OPPROTO op_fcmps_fcc1(void)
 {
     do_fcmps_fcc1();
@@ -1701,11 +1769,46 @@ void OPPROTO op_fcmped_fcc3(void)
     do_fcmped_fcc3();
 }
 
+#if defined(CONFIG_USER_ONLY)
+void OPPROTO op_fcmpq_fcc1(void)
+{
+    do_fcmpq_fcc1();
+}
+
+void OPPROTO op_fcmpq_fcc2(void)
+{
+    do_fcmpq_fcc2();
+}
+
+void OPPROTO op_fcmpq_fcc3(void)
+{
+    do_fcmpq_fcc3();
+}
+
+void OPPROTO op_fcmpeq_fcc1(void)
+{
+    do_fcmpeq_fcc1();
+}
+
+void OPPROTO op_fcmpeq_fcc2(void)
+{
+    do_fcmpeq_fcc2();
+}
+
+void OPPROTO op_fcmpeq_fcc3(void)
+{
+    do_fcmpeq_fcc3();
+}
+#endif
+
 #endif
 
 /* Integer to float conversion.  */
 #ifdef USE_INT_TO_FLOAT_HELPERS
 F_HELPER(ito);
+#ifdef TARGET_SPARC64
+F_HELPER(xto);
+#endif
 #else
 F_OP(ito, s)
 {
@@ -1721,6 +1824,15 @@ F_OP(ito, d)
     check_ieee_exceptions();
 }
 
+#if defined(CONFIG_USER_ONLY)
+F_OP(ito, q)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    QT0 = int32_to_float128(*((int32_t *)&FT1), &env->fp_status);
+    check_ieee_exceptions();
+}
+#endif
+
 #ifdef TARGET_SPARC64
 F_OP(xto, s)
 {
@@ -1735,6 +1847,14 @@ F_OP(xto, d)
     DT0 = int64_to_float64(*((int64_t *)&DT1), &env->fp_status);
     check_ieee_exceptions();
 }
+#if defined(CONFIG_USER_ONLY)
+F_OP(xto, q)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    QT0 = int64_to_float128(*((int64_t *)&DT1), &env->fp_status);
+    check_ieee_exceptions();
+}
+#endif
 #endif
 #endif
 #undef F_HELPER
@@ -1754,6 +1874,36 @@ void OPPROTO op_fstod(void)
     check_ieee_exceptions();
 }
 
+#if defined(CONFIG_USER_ONLY)
+void OPPROTO op_fqtos(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    FT0 = float128_to_float32(QT1, &env->fp_status);
+    check_ieee_exceptions();
+}
+
+void OPPROTO op_fstoq(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    QT0 = float32_to_float128(FT1, &env->fp_status);
+    check_ieee_exceptions();
+}
+
+void OPPROTO op_fqtod(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    DT0 = float128_to_float64(QT1, &env->fp_status);
+    check_ieee_exceptions();
+}
+
+void OPPROTO op_fdtoq(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    QT0 = float64_to_float128(DT1, &env->fp_status);
+    check_ieee_exceptions();
+}
+#endif
+
 /* Float to integer conversion.  */
 void OPPROTO op_fstoi(void)
 {
@@ -1769,6 +1919,15 @@ void OPPROTO op_fdtoi(void)
     check_ieee_exceptions();
 }
 
+#if defined(CONFIG_USER_ONLY)
+void OPPROTO op_fqtoi(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    *((int32_t *)&FT0) = float128_to_int32_round_to_zero(QT1, &env->fp_status);
+    check_ieee_exceptions();
+}
+#endif
+
 #ifdef TARGET_SPARC64
 void OPPROTO op_fstox(void)
 {
@@ -1784,6 +1943,15 @@ void OPPROTO op_fdtox(void)
     check_ieee_exceptions();
 }
 
+#if defined(CONFIG_USER_ONLY)
+void OPPROTO op_fqtox(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    *((int64_t *)&DT0) = float128_to_int64_round_to_zero(QT1, &env->fp_status);
+    check_ieee_exceptions();
+}
+#endif
+
 void OPPROTO op_fmovs_cc(void)
 {
     if (T2)
@@ -1796,6 +1964,14 @@ void OPPROTO op_fmovd_cc(void)
         DT0 = DT1;
 }
 
+#if defined(CONFIG_USER_ONLY)
+void OPPROTO op_fmovq_cc(void)
+{
+    if (T2)
+        QT0 = QT1;
+}
+#endif
+
 void OPPROTO op_mov_cc(void)
 {
     if (T2)
diff --git a/target-sparc/op_helper.c b/target-sparc/op_helper.c
index fa51cdee9..b711c6273 100644
--- a/target-sparc/op_helper.c
+++ b/target-sparc/op_helper.c
@@ -1,10 +1,26 @@
 #include "exec.h"
+#include "host-utils.h"
 
 //#define DEBUG_PCALL
 //#define DEBUG_MMU
+//#define DEBUG_MXCC
 //#define DEBUG_UNALIGNED
 //#define DEBUG_UNASSIGNED
 
+#ifdef DEBUG_MMU
+#define DPRINTF_MMU(fmt, args...) \
+do { printf("MMU: " fmt , ##args); } while (0)
+#else
+#define DPRINTF_MMU(fmt, args...)
+#endif
+
+#ifdef DEBUG_MXCC
+#define DPRINTF_MXCC(fmt, args...) \
+do { printf("MXCC: " fmt , ##args); } while (0)
+#else
+#define DPRINTF_MXCC(fmt, args...)
+#endif
+
 void raise_exception(int tt)
 {
     env->exception_index = tt;
@@ -54,6 +70,38 @@ void do_fitod(void)
 {
     DT0 = int32_to_float64(*((int32_t *)&FT1), &env->fp_status);
 }
+
+#if defined(CONFIG_USER_ONLY)
+void do_fitoq(void)
+{
+    QT0 = int32_to_float128(*((int32_t *)&FT1), &env->fp_status);
+}
+#endif
+
+#ifdef TARGET_SPARC64
+void do_fxtos(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    FT0 = int64_to_float32(*((int64_t *)&DT1), &env->fp_status);
+    check_ieee_exceptions();
+}
+
+void do_fxtod(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    DT0 = int64_to_float64(*((int64_t *)&DT1), &env->fp_status);
+    check_ieee_exceptions();
+}
+
+#if defined(CONFIG_USER_ONLY)
+void do_fxtoq(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    QT0 = int64_to_float128(*((int32_t *)&DT1), &env->fp_status);
+    check_ieee_exceptions();
+}
+#endif
+#endif
 #endif
 
 void do_fabss(void)
@@ -66,6 +114,13 @@ void do_fabsd(void)
 {
     DT0 = float64_abs(DT1);
 }
+
+#if defined(CONFIG_USER_ONLY)
+void do_fabsq(void)
+{
+    QT0 = float128_abs(QT1);
+}
+#endif
 #endif
 
 void do_fsqrts(void)
@@ -82,6 +137,15 @@ void do_fsqrtd(void)
     check_ieee_exceptions();
 }
 
+#if defined(CONFIG_USER_ONLY)
+void do_fsqrtq(void)
+{
+    set_float_exception_flags(0, &env->fp_status);
+    QT0 = float128_sqrt(QT1, &env->fp_status);
+    check_ieee_exceptions();
+}
+#endif
+
 #define GEN_FCMP(name, size, reg1, reg2, FS, TRAP)                      \
     void glue(do_, name) (void)                                         \
     {                                                                   \
@@ -117,6 +181,11 @@ GEN_FCMP(fcmpd, float64, DT0, DT1, 0, 0);
 GEN_FCMP(fcmpes, float32, FT0, FT1, 0, 1);
 GEN_FCMP(fcmped, float64, DT0, DT1, 0, 1);
 
+#ifdef CONFIG_USER_ONLY
+GEN_FCMP(fcmpq, float128, QT0, QT1, 0, 0);
+GEN_FCMP(fcmpeq, float128, QT0, QT1, 0, 1);
+#endif
+
 #ifdef TARGET_SPARC64
 GEN_FCMP(fcmps_fcc1, float32, FT0, FT1, 22, 0);
 GEN_FCMP(fcmpd_fcc1, float64, DT0, DT1, 22, 0);
@@ -135,16 +204,79 @@ GEN_FCMP(fcmped_fcc2, float64, DT0, DT1, 24, 1);
 
 GEN_FCMP(fcmpes_fcc3, float32, FT0, FT1, 26, 1);
 GEN_FCMP(fcmped_fcc3, float64, DT0, DT1, 26, 1);
+#ifdef CONFIG_USER_ONLY
+GEN_FCMP(fcmpq_fcc1, float128, QT0, QT1, 22, 0);
+GEN_FCMP(fcmpq_fcc2, float128, QT0, QT1, 24, 0);
+GEN_FCMP(fcmpq_fcc3, float128, QT0, QT1, 26, 0);
+GEN_FCMP(fcmpeq_fcc1, float128, QT0, QT1, 22, 1);
+GEN_FCMP(fcmpeq_fcc2, float128, QT0, QT1, 24, 1);
+GEN_FCMP(fcmpeq_fcc3, float128, QT0, QT1, 26, 1);
+#endif
 #endif
 
 #ifndef TARGET_SPARC64
 #ifndef CONFIG_USER_ONLY
+
+#ifdef DEBUG_MXCC
+static void dump_mxcc(CPUState *env)
+{
+    printf("mxccdata: %016llx %016llx %016llx %016llx\n",
+        env->mxccdata[0], env->mxccdata[1], env->mxccdata[2], env->mxccdata[3]);
+    printf("mxccregs: %016llx %016llx %016llx %016llx\n"
+           "          %016llx %016llx %016llx %016llx\n",
+        env->mxccregs[0], env->mxccregs[1], env->mxccregs[2], env->mxccregs[3],
+        env->mxccregs[4], env->mxccregs[5], env->mxccregs[6], env->mxccregs[7]);
+}
+#endif
+
 void helper_ld_asi(int asi, int size, int sign)
 {
     uint32_t ret = 0;
+    uint64_t tmp;
+#ifdef DEBUG_MXCC
+    uint32_t last_T0 = T0;
+#endif
 
     switch (asi) {
     case 2: /* SuperSparc MXCC registers */
+        switch (T0) {
+        case 0x01c00a00: /* MXCC control register */
+            if (size == 8) {
+                ret = env->mxccregs[3] >> 32;
+                T0 = env->mxccregs[3];
+            } else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        case 0x01c00a04: /* MXCC control register */
+            if (size == 4)
+                ret = env->mxccregs[3];
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        case 0x01c00c00: /* Module reset register */
+            if (size == 8) {
+                ret = env->mxccregs[5] >> 32;
+                T0 = env->mxccregs[5];
+                // should we do something here?
+            } else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        case 0x01c00f00: /* MBus port address register */
+            if (size == 8) {
+                ret = env->mxccregs[7] >> 32;
+                T0 = env->mxccregs[7];
+            } else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        default:
+            DPRINTF_MXCC("%08x: unimplemented address, size: %d\n", T0, size);
+            break;
+        }
+        DPRINTF_MXCC("asi = %d, size = %d, sign = %d, T0 = %08x -> ret = %08x,"
+                     "T0 = %08x\n", asi, size, sign, last_T0, ret, T0);
+#ifdef DEBUG_MXCC
+        dump_mxcc(env);
+#endif
         break;
     case 3: /* MMU probe */
         {
@@ -157,21 +289,21 @@ void helper_ld_asi(int asi, int size, int sign)
                 ret = mmu_probe(env, T0, mmulev);
                 //bswap32s(&ret);
             }
-#ifdef DEBUG_MMU
-            printf("mmu_probe: 0x%08x (lev %d) -> 0x%08x\n", T0, mmulev, ret);
-#endif
+            DPRINTF_MMU("mmu_probe: 0x%08x (lev %d) -> 0x%08x\n", T0, mmulev, ret);
         }
         break;
     case 4: /* read MMU regs */
         {
-            int reg = (T0 >> 8) & 0xf;
+            int reg = (T0 >> 8) & 0x1f;
 
             ret = env->mmuregs[reg];
             if (reg == 3) /* Fault status cleared on read */
-                env->mmuregs[reg] = 0;
-#ifdef DEBUG_MMU
-            printf("mmu_read: reg[%d] = 0x%08x\n", reg, ret);
-#endif
+                env->mmuregs[3] = 0;
+            else if (reg == 0x13) /* Fault status read */
+                ret = env->mmuregs[3];
+            else if (reg == 0x14) /* Fault address read */
+                ret = env->mmuregs[4];
+            DPRINTF_MMU("mmu_read: reg[%d] = 0x%08x\n", reg, ret);
         }
         break;
     case 9: /* Supervisor code access */
@@ -187,8 +319,9 @@ void helper_ld_asi(int asi, int size, int sign)
             ret = ldl_code(T0 & ~3);
             break;
         case 8:
-            ret = ldl_code(T0 & ~3);
-            T0 = ldl_code((T0 + 4) & ~3);
+            tmp = ldq_code(T0 & ~7);
+            ret = tmp >> 32;
+            T0 = tmp;
             break;
         }
         break;
@@ -205,8 +338,9 @@ void helper_ld_asi(int asi, int size, int sign)
             ret = ldl_user(T0 & ~3);
             break;
         case 8:
-            ret = ldl_user(T0 & ~3);
-            T0 = ldl_user((T0 + 4) & ~3);
+            tmp = ldq_user(T0 & ~7);
+            ret = tmp >> 32;
+            T0 = tmp;
             break;
         }
         break;
@@ -223,8 +357,9 @@ void helper_ld_asi(int asi, int size, int sign)
             ret = ldl_kernel(T0 & ~3);
             break;
         case 8:
-            ret = ldl_kernel(T0 & ~3);
-            T0 = ldl_kernel((T0 + 4) & ~3);
+            tmp = ldq_kernel(T0 & ~7);
+            ret = tmp >> 32;
+            T0 = tmp;
             break;
         }
         break;
@@ -246,8 +381,9 @@ void helper_ld_asi(int asi, int size, int sign)
             ret = ldl_phys(T0 & ~3);
             break;
         case 8:
-            ret = ldl_phys(T0 & ~3);
-            T0 = ldl_phys((T0 + 4) & ~3);
+            tmp = ldq_phys(T0 & ~7);
+            ret = tmp >> 32;
+            T0 = tmp;
             break;
         }
         break;
@@ -268,13 +404,16 @@ void helper_ld_asi(int asi, int size, int sign)
                            | ((target_phys_addr_t)(asi & 0xf) << 32));
             break;
         case 8:
-            ret = ldl_phys((target_phys_addr_t)(T0 & ~3)
-                           | ((target_phys_addr_t)(asi & 0xf) << 32));
-            T0 = ldl_phys((target_phys_addr_t)((T0 + 4) & ~3)
+            tmp = ldq_phys((target_phys_addr_t)(T0 & ~7)
                            | ((target_phys_addr_t)(asi & 0xf) << 32));
+            ret = tmp >> 32;
+            T0 = tmp;
             break;
         }
         break;
+    case 0x39: /* data cache diagnostic register */
+        ret = 0;
+        break;
     case 0x21 ... 0x2d: /* MMU passthrough, unassigned */
     default:
         do_unassigned_access(T0, 0, 0, 1);
@@ -302,15 +441,91 @@ void helper_st_asi(int asi, int size)
 {
     switch(asi) {
     case 2: /* SuperSparc MXCC registers */
+        switch (T0) {
+        case 0x01c00000: /* MXCC stream data register 0 */
+            if (size == 8)
+                env->mxccdata[0] = ((uint64_t)T1 << 32) | T2;
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        case 0x01c00008: /* MXCC stream data register 1 */
+            if (size == 8)
+                env->mxccdata[1] = ((uint64_t)T1 << 32) | T2;
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        case 0x01c00010: /* MXCC stream data register 2 */
+            if (size == 8)
+                env->mxccdata[2] = ((uint64_t)T1 << 32) | T2;
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        case 0x01c00018: /* MXCC stream data register 3 */
+            if (size == 8)
+                env->mxccdata[3] = ((uint64_t)T1 << 32) | T2;
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        case 0x01c00100: /* MXCC stream source */
+            if (size == 8)
+                env->mxccregs[0] = ((uint64_t)T1 << 32) | T2;
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            env->mxccdata[0] = ldq_phys((env->mxccregs[0] & 0xffffffffULL) +  0);
+            env->mxccdata[1] = ldq_phys((env->mxccregs[0] & 0xffffffffULL) +  8);
+            env->mxccdata[2] = ldq_phys((env->mxccregs[0] & 0xffffffffULL) + 16);
+            env->mxccdata[3] = ldq_phys((env->mxccregs[0] & 0xffffffffULL) + 24);
+            break;
+        case 0x01c00200: /* MXCC stream destination */
+            if (size == 8)
+                env->mxccregs[1] = ((uint64_t)T1 << 32) | T2;
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            stq_phys((env->mxccregs[1] & 0xffffffffULL) +  0, env->mxccdata[0]);
+            stq_phys((env->mxccregs[1] & 0xffffffffULL) +  8, env->mxccdata[1]);
+            stq_phys((env->mxccregs[1] & 0xffffffffULL) + 16, env->mxccdata[2]);
+            stq_phys((env->mxccregs[1] & 0xffffffffULL) + 24, env->mxccdata[3]);
+            break;
+        case 0x01c00a00: /* MXCC control register */
+            if (size == 8)
+                env->mxccregs[3] = ((uint64_t)T1 << 32) | T2;
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        case 0x01c00a04: /* MXCC control register */
+            if (size == 4)
+                env->mxccregs[3] = (env->mxccregs[0xa] & 0xffffffff00000000ULL) | T1;
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        case 0x01c00e00: /* MXCC error register  */
+            // writing a 1 bit clears the error
+            if (size == 8)
+                env->mxccregs[6] &= ~(((uint64_t)T1 << 32) | T2);
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        case 0x01c00f00: /* MBus port address register */
+            if (size == 8)
+                env->mxccregs[7] = ((uint64_t)T1 << 32) | T2;
+            else
+                DPRINTF_MXCC("%08x: unimplemented access size: %d\n", T0, size);
+            break;
+        default:
+            DPRINTF_MXCC("%08x: unimplemented address, size: %d\n", T0, size);
+            break;
+        }
+        DPRINTF_MXCC("asi = %d, size = %d, T0 = %08x, T1 = %08x\n", asi, size, T0, T1);
+#ifdef DEBUG_MXCC
+        dump_mxcc(env);
+#endif
         break;
     case 3: /* MMU flush */
         {
             int mmulev;
 
             mmulev = (T0 >> 8) & 15;
-#ifdef DEBUG_MMU
-            printf("mmu flush level %d\n", mmulev);
-#endif
+            DPRINTF_MMU("mmu flush level %d\n", mmulev);
             switch (mmulev) {
             case 0: // flush page
                 tlb_flush_page(env, T0 & 0xfffff000);
@@ -331,17 +546,18 @@ void helper_st_asi(int asi, int size)
         }
     case 4: /* write MMU regs */
         {
-            int reg = (T0 >> 8) & 0xf;
+            int reg = (T0 >> 8) & 0x1f;
             uint32_t oldreg;
 
             oldreg = env->mmuregs[reg];
             switch(reg) {
             case 0:
-                env->mmuregs[reg] &= ~(MMU_E | MMU_NF | MMU_BM);
-                env->mmuregs[reg] |= T1 & (MMU_E | MMU_NF | MMU_BM);
+                env->mmuregs[reg] = (env->mmuregs[reg] & 0xff000000) |
+                                    (T1 & 0x00ffffff);
                 // Mappings generated during no-fault mode or MMU
                 // disabled mode are invalid in normal mode
-                if (oldreg != env->mmuregs[reg])
+                if ((oldreg & (MMU_E | MMU_NF | env->mmu_bm)) !=
+                    (env->mmuregs[reg] & (MMU_E | MMU_NF | env->mmu_bm)))
                     tlb_flush(env, 1);
                 break;
             case 2:
@@ -355,14 +571,20 @@ void helper_st_asi(int asi, int size)
             case 3:
             case 4:
                 break;
+            case 0x13:
+                env->mmuregs[3] = T1;
+                break;
+            case 0x14:
+                env->mmuregs[4] = T1;
+                break;
             default:
                 env->mmuregs[reg] = T1;
                 break;
             }
-#ifdef DEBUG_MMU
             if (oldreg != env->mmuregs[reg]) {
-                printf("mmu change reg[%d]: 0x%08x -> 0x%08x\n", reg, oldreg, env->mmuregs[reg]);
+                DPRINTF_MMU("mmu change reg[%d]: 0x%08x -> 0x%08x\n", reg, oldreg, env->mmuregs[reg]);
             }
+#ifdef DEBUG_MMU
             dump_mmu(env);
 #endif
             return;
@@ -380,8 +602,7 @@ void helper_st_asi(int asi, int size)
             stl_user(T0 & ~3, T1);
             break;
         case 8:
-            stl_user(T0 & ~3, T1);
-            stl_user((T0 + 4) & ~3, T2);
+            stq_user(T0 & ~7, ((uint64_t)T1 << 32) | T2);
             break;
         }
         break;
@@ -398,8 +619,7 @@ void helper_st_asi(int asi, int size)
             stl_kernel(T0 & ~3, T1);
             break;
         case 8:
-            stl_kernel(T0 & ~3, T1);
-            stl_kernel((T0 + 4) & ~3, T2);
+            stq_kernel(T0 & ~7, ((uint64_t)T1 << 32) | T2);
             break;
         }
         break;
@@ -456,8 +676,7 @@ void helper_st_asi(int asi, int size)
                 stl_phys(T0 & ~3, T1);
                 break;
             case 8:
-                stl_phys(T0 & ~3, T1);
-                stl_phys((T0 + 4) & ~3, T2);
+                stq_phys(T0 & ~7, ((uint64_t)T1 << 32) | T2);
                 break;
             }
         }
@@ -480,17 +699,20 @@ void helper_st_asi(int asi, int size)
                            | ((target_phys_addr_t)(asi & 0xf) << 32), T1);
                 break;
             case 8:
-                stl_phys((target_phys_addr_t)(T0 & ~3)
-                           | ((target_phys_addr_t)(asi & 0xf) << 32), T1);
-                stl_phys((target_phys_addr_t)((T0 + 4) & ~3)
-                           | ((target_phys_addr_t)(asi & 0xf) << 32), T1);
+                stq_phys((target_phys_addr_t)(T0 & ~7)
+                           | ((target_phys_addr_t)(asi & 0xf) << 32),
+                         ((uint64_t)T1 << 32) | T2);
                 break;
             }
         }
         return;
-    case 0x31: /* Ross RT620 I-cache flush */
+    case 0x30: /* store buffer tags */
+    case 0x31: /* store buffer data or Ross RT620 I-cache flush */
+    case 0x32: /* store buffer control */
     case 0x36: /* I-cache flash clear */
     case 0x37: /* D-cache flash clear */
+    case 0x38: /* breakpoint diagnostics */
+    case 0x4c: /* breakpoint action */
         break;
     case 9: /* Supervisor code access, XXX */
     case 0x21 ... 0x2d: /* MMU passthrough, unassigned */
@@ -654,7 +876,8 @@ void helper_ld_asi(int asi, int size, int sign)
 {
     uint64_t ret = 0;
 
-    if (asi < 0x80 && (env->pstate & PS_PRIV) == 0)
+    if ((asi < 0x80 && (env->pstate & PS_PRIV) == 0)
+        || (asi >= 0x30 && asi < 0x80 && !(env->hpstate & HS_PRIV)))
         raise_exception(TT_PRIV_ACT);
 
     switch (asi) {
@@ -665,20 +888,38 @@ void helper_ld_asi(int asi, int size, int sign)
     case 0x88: // Primary LE
     case 0x8a: // Primary no-fault LE
         if ((asi & 0x80) && (env->pstate & PS_PRIV)) {
-            switch(size) {
-            case 1:
-                ret = ldub_kernel(T0);
-                break;
-            case 2:
-                ret = lduw_kernel(T0 & ~1);
-                break;
-            case 4:
-                ret = ldl_kernel(T0 & ~3);
-                break;
-            default:
-            case 8:
-                ret = ldq_kernel(T0 & ~7);
-                break;
+            if (env->hpstate & HS_PRIV) {
+                switch(size) {
+                case 1:
+                    ret = ldub_hypv(T0);
+                    break;
+                case 2:
+                    ret = lduw_hypv(T0 & ~1);
+                    break;
+                case 4:
+                    ret = ldl_hypv(T0 & ~3);
+                    break;
+                default:
+                case 8:
+                    ret = ldq_hypv(T0 & ~7);
+                    break;
+                }
+            } else {
+                switch(size) {
+                case 1:
+                    ret = ldub_kernel(T0);
+                    break;
+                case 2:
+                    ret = lduw_kernel(T0 & ~1);
+                    break;
+                case 4:
+                    ret = ldl_kernel(T0 & ~3);
+                    break;
+                default:
+                case 8:
+                    ret = ldq_kernel(T0 & ~7);
+                    break;
+                }
             }
         } else {
             switch(size) {
@@ -852,7 +1093,8 @@ void helper_ld_asi(int asi, int size, int sign)
 
 void helper_st_asi(int asi, int size)
 {
-    if (asi < 0x80 && (env->pstate & PS_PRIV) == 0)
+    if ((asi < 0x80 && (env->pstate & PS_PRIV) == 0)
+        || (asi >= 0x30 && asi < 0x80 && !(env->hpstate & HS_PRIV)))
         raise_exception(TT_PRIV_ACT);
 
     /* Convert to little endian */
@@ -862,7 +1104,6 @@ void helper_st_asi(int asi, int size)
     case 0x19: // As if user secondary LE
     case 0x1c: // Bypass LE
     case 0x1d: // Bypass, non-cacheable LE
-    case 0x81: // Secondary
     case 0x88: // Primary LE
     case 0x89: // Secondary LE
         switch(size) {
@@ -888,20 +1129,38 @@ void helper_st_asi(int asi, int size)
     case 0x80: // Primary
     case 0x88: // Primary LE
         if ((asi & 0x80) && (env->pstate & PS_PRIV)) {
-            switch(size) {
-            case 1:
-                stb_kernel(T0, T1);
-                break;
-            case 2:
-                stw_kernel(T0 & ~1, T1);
-                break;
-            case 4:
-                stl_kernel(T0 & ~3, T1);
-                break;
-            case 8:
-            default:
-                stq_kernel(T0 & ~7, T1);
-                break;
+            if (env->hpstate & HS_PRIV) {
+                switch(size) {
+                case 1:
+                    stb_hypv(T0, T1);
+                    break;
+                case 2:
+                    stw_hypv(T0 & ~1, T1);
+                    break;
+                case 4:
+                    stl_hypv(T0 & ~3, T1);
+                    break;
+                case 8:
+                default:
+                    stq_hypv(T0 & ~7, T1);
+                    break;
+                }
+            } else {
+                switch(size) {
+                case 1:
+                    stb_kernel(T0, T1);
+                    break;
+                case 2:
+                    stw_kernel(T0 & ~1, T1);
+                    break;
+                case 4:
+                    stl_kernel(T0 & ~3, T1);
+                    break;
+                case 8:
+                default:
+                    stq_kernel(T0 & ~7, T1);
+                    break;
+                }
             }
         } else {
             switch(size) {
@@ -950,6 +1209,7 @@ void helper_st_asi(int asi, int size)
     case 0x24: // Nucleus quad LDD 128 bit atomic
     case 0x2c: // Nucleus quad LDD 128 bit atomic
     case 0x4a: // UPA config
+    case 0x81: // Secondary
     case 0x89: // Secondary LE
         // XXX
         return;
@@ -962,8 +1222,8 @@ void helper_st_asi(int asi, int size)
             // Mappings generated during D/I MMU disabled mode are
             // invalid in normal mode
             if (oldreg != env->lsu) {
+                DPRINTF_MMU("LSU change: 0x%" PRIx64 " -> 0x%" PRIx64 "\n", oldreg, env->lsu);
 #ifdef DEBUG_MMU
-                printf("LSU change: 0x%" PRIx64 " -> 0x%" PRIx64 "\n", oldreg, env->lsu);
                 dump_mmu(env);
 #endif
                 tlb_flush(env, 1);
@@ -995,10 +1255,10 @@ void helper_st_asi(int asi, int size)
                 break;
             }
             env->immuregs[reg] = T1;
-#ifdef DEBUG_MMU
             if (oldreg != env->immuregs[reg]) {
-                printf("mmu change reg[%d]: 0x%08" PRIx64 " -> 0x%08" PRIx64 "\n", reg, oldreg, env->immuregs[reg]);
+                DPRINTF_MMU("mmu change reg[%d]: 0x%08" PRIx64 " -> 0x%08" PRIx64 "\n", reg, oldreg, env->immuregs[reg]);
             }
+#ifdef DEBUG_MMU
             dump_mmu(env);
 #endif
             return;
@@ -1064,10 +1324,10 @@ void helper_st_asi(int asi, int size)
                 break;
             }
             env->dmmuregs[reg] = T1;
-#ifdef DEBUG_MMU
             if (oldreg != env->dmmuregs[reg]) {
-                printf("mmu change reg[%d]: 0x%08" PRIx64 " -> 0x%08" PRIx64 "\n", reg, oldreg, env->dmmuregs[reg]);
+                DPRINTF_MMU("mmu change reg[%d]: 0x%08" PRIx64 " -> 0x%08" PRIx64 "\n", reg, oldreg, env->dmmuregs[reg]);
             }
+#ifdef DEBUG_MMU
             dump_mmu(env);
 #endif
             return;
@@ -1137,10 +1397,18 @@ void helper_ldf_asi(int asi, int size, int rd)
     case 0xf1: // Block load secondary
     case 0xf8: // Block load primary LE
     case 0xf9: // Block load secondary LE
-        for (i = 0; i < 8; i++) {
-            helper_ld_asi(asi & 0x8f, 8, 0);
-            *((int64_t *)&DT0) = T1;
-            T0 += 8;
+        if (rd & 7) {
+            raise_exception(TT_ILL_INSN);
+            return;
+        }
+        if (T0 & 0x3f) {
+            raise_exception(TT_UNALIGNED);
+            return;
+        }
+        for (i = 0; i < 16; i++) {
+            helper_ld_asi(asi & 0x8f, 4, 0);
+            *(uint32_t *)&env->fpr[rd++] = T1;
+            T0 += 4;
         }
         T0 = tmp_T0;
         T1 = tmp_T1;
@@ -1159,6 +1427,11 @@ void helper_ldf_asi(int asi, int size, int rd)
     case 8:
         *((int64_t *)&DT0) = T1;
         break;
+#if defined(CONFIG_USER_ONLY)
+    case 16:
+        // XXX
+        break;
+#endif
     }
     T1 = tmp_T1;
 }
@@ -1173,10 +1446,18 @@ void helper_stf_asi(int asi, int size, int rd)
     case 0xf1: // Block store secondary
     case 0xf8: // Block store primary LE
     case 0xf9: // Block store secondary LE
-        for (i = 0; i < 8; i++) {
-            T1 = *((int64_t *)&DT0);
-            helper_st_asi(asi & 0x8f, 8);
-            T0 += 8;
+        if (rd & 7) {
+            raise_exception(TT_ILL_INSN);
+            return;
+        }
+        if (T0 & 0x3f) {
+            raise_exception(TT_UNALIGNED);
+            return;
+        }
+        for (i = 0; i < 16; i++) {
+            T1 = *(uint32_t *)&env->fpr[rd++];
+            helper_st_asi(asi & 0x8f, 4);
+            T0 += 4;
         }
         T0 = tmp_T0;
         T1 = tmp_T1;
@@ -1194,6 +1475,11 @@ void helper_stf_asi(int asi, int size, int rd)
     case 8:
         T1 = *((int64_t *)&DT0);
         break;
+#if defined(CONFIG_USER_ONLY)
+    case 16:
+        // XXX
+        break;
+#endif
     }
     helper_st_asi(asi, size);
     T1 = tmp_T1;
@@ -1264,12 +1550,7 @@ void do_rdpsr()
 
 void do_popc()
 {
-    T0 = (T1 & 0x5555555555555555ULL) + ((T1 >> 1) & 0x5555555555555555ULL);
-    T0 = (T0 & 0x3333333333333333ULL) + ((T0 >> 2) & 0x3333333333333333ULL);
-    T0 = (T0 & 0x0f0f0f0f0f0f0f0fULL) + ((T0 >> 4) & 0x0f0f0f0f0f0f0f0fULL);
-    T0 = (T0 & 0x00ff00ff00ff00ffULL) + ((T0 >> 8) & 0x00ff00ff00ff00ffULL);
-    T0 = (T0 & 0x0000ffff0000ffffULL) + ((T0 >> 16) & 0x0000ffff0000ffffULL);
-    T0 = (T0 & 0x00000000ffffffffULL) + ((T0 >> 32) & 0x00000000ffffffffULL);
+    T0 = ctpop64(T1);
 }
 
 static inline uint64_t *get_gregset(uint64_t pstate)
@@ -1479,7 +1760,11 @@ static void do_unaligned_access(target_ulong addr, int is_write, int is_user,
 
 #define MMUSUFFIX _mmu
 #define ALIGNED_ONLY
-#define GETPC() (__builtin_return_address(0))
+#ifdef __s390__
+# define GETPC() ((void*)((unsigned long)__builtin_return_address(0) & 0x7fffffffUL))
+#else
+# define GETPC() (__builtin_return_address(0))
+#endif
 
 #define SHIFT 0
 #include "softmmu_template.h"
@@ -1506,7 +1791,7 @@ static void do_unaligned_access(target_ulong addr, int is_write, int is_user,
    NULL, it means that the function was called in C code (i.e. not
    from generated code or from helper.c) */
 /* XXX: fix it to restore all registers */
-void tlb_fill(target_ulong addr, int is_write, int is_user, void *retaddr)
+void tlb_fill(target_ulong addr, int is_write, int mmu_idx, void *retaddr)
 {
     TranslationBlock *tb;
     int ret;
@@ -1518,7 +1803,7 @@ void tlb_fill(target_ulong addr, int is_write, int is_user, void *retaddr)
     saved_env = env;
     env = cpu_single_env;
 
-    ret = cpu_sparc_handle_mmu_fault(env, addr, is_write, is_user, 1);
+    ret = cpu_sparc_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
     if (ret) {
         if (retaddr) {
             /* now we have a real cpu fault */
@@ -1593,27 +1878,3 @@ void do_unassigned_access(target_phys_addr_t addr, int is_write, int is_exec,
 }
 #endif
 
-#ifdef TARGET_SPARC64
-void do_tick_set_count(void *opaque, uint64_t count)
-{
-#if !defined(CONFIG_USER_ONLY)
-    ptimer_set_count(opaque, -count);
-#endif
-}
-
-uint64_t do_tick_get_count(void *opaque)
-{
-#if !defined(CONFIG_USER_ONLY)
-    return -ptimer_get_count(opaque);
-#else
-    return 0;
-#endif
-}
-
-void do_tick_set_limit(void *opaque, uint64_t limit)
-{
-#if !defined(CONFIG_USER_ONLY)
-    ptimer_set_limit(opaque, -limit, 0);
-#endif
-}
-#endif
diff --git a/target-sparc/op_mem.h b/target-sparc/op_mem.h
index c0cf043b3..894fc3666 100644
--- a/target-sparc/op_mem.h
+++ b/target-sparc/op_mem.h
@@ -1,20 +1,26 @@
+#ifdef TARGET_ABI32
+#define ADDR(x) ((x) & 0xffffffff)
+#else
+#define ADDR(x) (x)
+#endif
+
 /***                             Integer load                              ***/
 #define SPARC_LD_OP(name, qp)                                                 \
 void OPPROTO glue(glue(op_, name), MEMSUFFIX)(void)                           \
 {                                                                             \
-    T1 = (target_ulong)glue(qp, MEMSUFFIX)(T0);                         \
+    T1 = (target_ulong)glue(qp, MEMSUFFIX)(ADDR(T0));                         \
 }
 
 #define SPARC_LD_OP_S(name, qp)                                         \
     void OPPROTO glue(glue(op_, name), MEMSUFFIX)(void)                 \
     {                                                                   \
-        T1 = (target_long)glue(qp, MEMSUFFIX)(T0);                      \
+        T1 = (target_long)glue(qp, MEMSUFFIX)(ADDR(T0));                      \
     }
 
 #define SPARC_ST_OP(name, op)                                                 \
 void OPPROTO glue(glue(op_, name), MEMSUFFIX)(void)                           \
 {                                                                             \
-    glue(op, MEMSUFFIX)(T0, T1);                                      \
+    glue(op, MEMSUFFIX)(ADDR(T0), T1);                                      \
 }
 
 SPARC_LD_OP(ld, ldl);
@@ -30,60 +36,86 @@ SPARC_ST_OP(sth, stw);
 
 void OPPROTO glue(op_std, MEMSUFFIX)(void)
 {
-    glue(stl, MEMSUFFIX)(T0, T1);
-    glue(stl, MEMSUFFIX)((T0 + 4), T2);
+    uint64_t tmp = ((uint64_t)T1 << 32) | (uint64_t)(T2 & 0xffffffff);
+
+    glue(stq, MEMSUFFIX)(ADDR(T0), tmp);
 }
 
 void OPPROTO glue(op_ldstub, MEMSUFFIX)(void)
 {
-    T1 = glue(ldub, MEMSUFFIX)(T0);
-    glue(stb, MEMSUFFIX)(T0, 0xff);     /* XXX: Should be Atomically */
+    T1 = glue(ldub, MEMSUFFIX)(ADDR(T0));
+    glue(stb, MEMSUFFIX)(ADDR(T0), 0xff);     /* XXX: Should be Atomically */
 }
 
 void OPPROTO glue(op_swap, MEMSUFFIX)(void)
 {
-    target_ulong tmp = glue(ldl, MEMSUFFIX)(T0);
-    glue(stl, MEMSUFFIX)(T0, T1);       /* XXX: Should be Atomically */
+    target_ulong tmp = glue(ldl, MEMSUFFIX)(ADDR(T0));
+    glue(stl, MEMSUFFIX)(ADDR(T0), T1);       /* XXX: Should be Atomically */
     T1 = tmp;
 }
 
 void OPPROTO glue(op_ldd, MEMSUFFIX)(void)
 {
-    T1 = glue(ldl, MEMSUFFIX)(T0);
-    T0 = glue(ldl, MEMSUFFIX)((T0 + 4));
+    uint64_t tmp;
+
+    tmp = glue(ldq, MEMSUFFIX)(ADDR(T0));
+    T1 = tmp >> 32;
+    T0 = tmp & 0xffffffff;
 }
 
 /***                         Floating-point store                          ***/
 void OPPROTO glue(op_stf, MEMSUFFIX) (void)
 {
-    glue(stfl, MEMSUFFIX)(T0, FT0);
+    glue(stfl, MEMSUFFIX)(ADDR(T0), FT0);
 }
 
 void OPPROTO glue(op_stdf, MEMSUFFIX) (void)
 {
-    glue(stfq, MEMSUFFIX)(T0, DT0);
+    glue(stfq, MEMSUFFIX)(ADDR(T0), DT0);
 }
 
 /***                         Floating-point load                           ***/
 void OPPROTO glue(op_ldf, MEMSUFFIX) (void)
 {
-    FT0 = glue(ldfl, MEMSUFFIX)(T0);
+    FT0 = glue(ldfl, MEMSUFFIX)(ADDR(T0));
 }
 
 void OPPROTO glue(op_lddf, MEMSUFFIX) (void)
 {
-    DT0 = glue(ldfq, MEMSUFFIX)(T0);
+    DT0 = glue(ldfq, MEMSUFFIX)(ADDR(T0));
 }
 
+#if defined(CONFIG_USER_ONLY)
+void OPPROTO glue(op_ldqf, MEMSUFFIX) (void)
+{
+    // XXX add 128 bit load
+    CPU_QuadU u;
+
+    u.ll.upper = glue(ldq, MEMSUFFIX)(ADDR(T0));
+    u.ll.lower = glue(ldq, MEMSUFFIX)(ADDR(T0 + 8));
+    QT0 = u.q;
+}
+
+void OPPROTO glue(op_stqf, MEMSUFFIX) (void)
+{
+    // XXX add 128 bit store
+    CPU_QuadU u;
+
+    u.q = QT0;
+    glue(stq, MEMSUFFIX)(ADDR(T0), u.ll.upper);
+    glue(stq, MEMSUFFIX)(ADDR(T0 + 8), u.ll.lower);
+}
+#endif
+
 #ifdef TARGET_SPARC64
 void OPPROTO glue(op_lduw, MEMSUFFIX)(void)
 {
-    T1 = (uint64_t)(glue(ldl, MEMSUFFIX)(T0) & 0xffffffff);
+    T1 = (uint64_t)(glue(ldl, MEMSUFFIX)(ADDR(T0)) & 0xffffffff);
 }
 
 void OPPROTO glue(op_ldsw, MEMSUFFIX)(void)
 {
-    T1 = (int64_t)(glue(ldl, MEMSUFFIX)(T0) & 0xffffffff);
+    T1 = (int64_t)(glue(ldl, MEMSUFFIX)(ADDR(T0)) & 0xffffffff);
 }
 
 SPARC_LD_OP(ldx, ldq);
diff --git a/target-sparc/translate.c b/target-sparc/translate.c
index 94503bee8..ecec37272 100644
--- a/target-sparc/translate.c
+++ b/target-sparc/translate.c
@@ -25,7 +25,6 @@
    Rest of V9 instructions, VIS instructions
    NPC/PC static optimisations (use JUMP_TB when possible)
    Optimize synthetic instructions
-   128-bit float
 */
 
 #include <stdarg.h>
@@ -54,13 +53,18 @@ typedef struct DisasContext {
     struct TranslationBlock *tb;
 } DisasContext;
 
+typedef struct sparc_def_t sparc_def_t;
+
 struct sparc_def_t {
     const unsigned char *name;
     target_ulong iu_version;
     uint32_t fpu_version;
     uint32_t mmu_version;
+    uint32_t mmu_bm;
 };
 
+static const sparc_def_t *cpu_sparc_find_by_name(const unsigned char *name);
+
 static uint16_t *gen_opc_ptr;
 static uint32_t *gen_opparam_ptr;
 extern FILE *logfile;
@@ -87,9 +91,11 @@ enum {
 #define GET_FIELD_SPs(x,a,b) sign_extend (GET_FIELD_SP(x,a,b), ((b) - (a) + 1))
 
 #ifdef TARGET_SPARC64
-#define DFPREG(r) (((r & 1) << 6) | (r & 0x1e))
+#define DFPREG(r) (((r & 1) << 5) | (r & 0x1e))
+#define QFPREG(r) (((r & 1) << 5) | (r & 0x1c))
 #else
 #define DFPREG(r) (r & 0x1e)
+#define QFPREG(r) (r & 0x1c)
 #endif
 
 #ifdef USE_DIRECT_JUMP
@@ -346,11 +352,11 @@ GEN32(gen_op_load_fpr_DT1, gen_op_load_fpr_DT1_fprf);
 GEN32(gen_op_store_DT0_fpr, gen_op_store_DT0_fpr_fprf);
 GEN32(gen_op_store_DT1_fpr, gen_op_store_DT1_fpr_fprf);
 
-#ifdef ALIGN_7_BUGS_FIXED
-#else
-#ifndef CONFIG_USER_ONLY
-#define gen_op_check_align_T0_7()
-#endif
+#if defined(CONFIG_USER_ONLY)
+GEN32(gen_op_load_fpr_QT0, gen_op_load_fpr_QT0_fprf);
+GEN32(gen_op_load_fpr_QT1, gen_op_load_fpr_QT1_fprf);
+GEN32(gen_op_store_QT0_fpr, gen_op_store_QT0_fpr_fprf);
+GEN32(gen_op_store_QT1_fpr, gen_op_store_QT1_fpr_fprf);
 #endif
 
 /* moves */
@@ -361,17 +367,24 @@ GEN32(gen_op_store_DT1_fpr, gen_op_store_DT1_fpr_fprf);
 #endif
 #define gen_op_ldst(name)        gen_op_##name##_raw()
 #else
-#define supervisor(dc) (dc->mem_idx == 1)
+#define supervisor(dc) (dc->mem_idx >= 1)
 #ifdef TARGET_SPARC64
 #define hypervisor(dc) (dc->mem_idx == 2)
-#endif
-#define gen_op_ldst(name)        (*gen_op_##name[dc->mem_idx])()
+#define OP_LD_TABLE(width)                                              \
+    static GenOpFunc * const gen_op_##width[] = {                       \
+        &gen_op_##width##_user,                                         \
+        &gen_op_##width##_kernel,                                       \
+        &gen_op_##width##_hypv,                                         \
+    };
+#else
 #define OP_LD_TABLE(width)                                              \
     static GenOpFunc * const gen_op_##width[] = {                       \
         &gen_op_##width##_user,                                         \
         &gen_op_##width##_kernel,                                       \
     };
 #endif
+#define gen_op_ldst(name)        (*gen_op_##name[dc->mem_idx])()
+#endif
 
 #ifndef CONFIG_USER_ONLY
 OP_LD_TABLE(ld);
@@ -427,11 +440,10 @@ static inline void gen_st_asi(int insn, int size)
     }
 }
 
-static inline void gen_ldf_asi(int insn, int size)
+static inline void gen_ldf_asi(int insn, int size, int rd)
 {
-    int asi, offset, rd;
+    int asi, offset;
 
-    rd = GET_FIELD(insn, 2, 6);
     if (IS_IMM) {
         offset = GET_FIELD(insn, 25, 31);
         gen_op_ldf_asi_reg(offset, size, rd);
@@ -441,11 +453,10 @@ static inline void gen_ldf_asi(int insn, int size)
     }
 }
 
-static inline void gen_stf_asi(int insn, int size)
+static inline void gen_stf_asi(int insn, int size, int rd)
 {
-    int asi, offset, rd;
+    int asi, offset;
 
-    rd = GET_FIELD(insn, 2, 6);
     if (IS_IMM) {
         offset = GET_FIELD(insn, 25, 31);
         gen_op_stf_asi_reg(offset, size, rd);
@@ -1055,6 +1066,15 @@ static GenOpFunc * const gen_fcmpd[4] = {
     gen_op_fcmpd_fcc3,
 };
 
+#if defined(CONFIG_USER_ONLY)
+static GenOpFunc * const gen_fcmpq[4] = {
+    gen_op_fcmpq,
+    gen_op_fcmpq_fcc1,
+    gen_op_fcmpq_fcc2,
+    gen_op_fcmpq_fcc3,
+};
+#endif
+
 static GenOpFunc * const gen_fcmpes[4] = {
     gen_op_fcmpes,
     gen_op_fcmpes_fcc1,
@@ -1069,6 +1089,14 @@ static GenOpFunc * const gen_fcmped[4] = {
     gen_op_fcmped_fcc3,
 };
 
+#if defined(CONFIG_USER_ONLY)
+static GenOpFunc * const gen_fcmpeq[4] = {
+    gen_op_fcmpeq,
+    gen_op_fcmpeq_fcc1,
+    gen_op_fcmpeq_fcc2,
+    gen_op_fcmpeq_fcc3,
+};
+#endif
 #endif
 
 static int gen_trap_ifnofpu(DisasContext * dc)
@@ -1479,7 +1507,14 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x2b: /* fsqrtq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_fsqrtq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0x41:
                         gen_op_load_fpr_FT0(rs1);
                         gen_op_load_fpr_FT1(rs2);
@@ -1493,7 +1528,15 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x43: /* faddq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT0(QFPREG(rs1));
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_faddq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0x45:
                         gen_op_load_fpr_FT0(rs1);
                         gen_op_load_fpr_FT1(rs2);
@@ -1507,7 +1550,15 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x47: /* fsubq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT0(QFPREG(rs1));
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_fsubq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0x49:
                         gen_op_load_fpr_FT0(rs1);
                         gen_op_load_fpr_FT1(rs2);
@@ -1518,10 +1569,18 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_load_fpr_DT0(DFPREG(rs1));
                         gen_op_load_fpr_DT1(DFPREG(rs2));
                         gen_op_fmuld();
-                        gen_op_store_DT0_fpr(rd);
+                        gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x4b: /* fmulq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT0(QFPREG(rs1));
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_fmulq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0x4d:
                         gen_op_load_fpr_FT0(rs1);
                         gen_op_load_fpr_FT1(rs2);
@@ -1535,7 +1594,15 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x4f: /* fdivq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT0(QFPREG(rs1));
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_fdivq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0x69:
                         gen_op_load_fpr_FT0(rs1);
                         gen_op_load_fpr_FT1(rs2);
@@ -1543,7 +1610,15 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x6e: /* fdmulq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_DT0(DFPREG(rs1));
+                        gen_op_load_fpr_DT1(DFPREG(rs2));
+                        gen_op_fdmulq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0xc4:
                         gen_op_load_fpr_FT1(rs2);
                         gen_op_fitos();
@@ -1555,7 +1630,14 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_store_FT0_fpr(rd);
                         break;
                     case 0xc7: /* fqtos */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_fqtos();
+                        gen_op_store_FT0_fpr(rd);
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0xc8:
                         gen_op_load_fpr_FT1(rs2);
                         gen_op_fitod();
@@ -1567,40 +1649,101 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0xcb: /* fqtod */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_fqtod();
+                        gen_op_store_DT0_fpr(DFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0xcc: /* fitoq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_FT1(rs2);
+                        gen_op_fitoq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0xcd: /* fstoq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_FT1(rs2);
+                        gen_op_fstoq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0xce: /* fdtoq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_DT1(DFPREG(rs2));
+                        gen_op_fdtoq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0xd1:
                         gen_op_load_fpr_FT1(rs2);
                         gen_op_fstoi();
                         gen_op_store_FT0_fpr(rd);
                         break;
                     case 0xd2:
-                        gen_op_load_fpr_DT1(rs2);
+                        gen_op_load_fpr_DT1(DFPREG(rs2));
                         gen_op_fdtoi();
                         gen_op_store_FT0_fpr(rd);
                         break;
                     case 0xd3: /* fqtoi */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_fqtoi();
+                        gen_op_store_FT0_fpr(rd);
+                        break;
+#else
                         goto nfpu_insn;
+#endif
 #ifdef TARGET_SPARC64
                     case 0x2: /* V9 fmovd */
                         gen_op_load_fpr_DT0(DFPREG(rs2));
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
+                    case 0x3: /* V9 fmovq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT0(QFPREG(rs2));
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
+                        goto nfpu_insn;
+#endif
                     case 0x6: /* V9 fnegd */
                         gen_op_load_fpr_DT1(DFPREG(rs2));
                         gen_op_fnegd();
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
+                    case 0x7: /* V9 fnegq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_fnegq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
+                        goto nfpu_insn;
+#endif
                     case 0xa: /* V9 fabsd */
                         gen_op_load_fpr_DT1(DFPREG(rs2));
                         gen_op_fabsd();
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
+                    case 0xb: /* V9 fabsq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_fabsq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
+                        goto nfpu_insn;
+#endif
                     case 0x81: /* V9 fstox */
                         gen_op_load_fpr_FT1(rs2);
                         gen_op_fstox();
@@ -1611,6 +1754,15 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_fdtox();
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
+                    case 0x83: /* V9 fqtox */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        gen_op_fqtox();
+                        gen_op_store_DT0_fpr(DFPREG(rd));
+                        break;
+#else
+                        goto nfpu_insn;
+#endif
                     case 0x84: /* V9 fxtos */
                         gen_op_load_fpr_DT1(DFPREG(rs2));
                         gen_op_fxtos();
@@ -1621,13 +1773,16 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_fxtod();
                         gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
-                    case 0x3: /* V9 fmovq */
-                    case 0x7: /* V9 fnegq */
-                    case 0xb: /* V9 fabsq */
-                    case 0x83: /* V9 fqtox */
                     case 0x8c: /* V9 fxtoq */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_DT1(DFPREG(rs2));
+                        gen_op_fxtoq();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
 #endif
+#endif
                     default:
                         goto illegal_insn;
                 }
@@ -1655,17 +1810,30 @@ static void disas_sparc_insn(DisasContext * dc)
                     break;
                 } else if ((xop & 0x11f) == 0x006) { // V9 fmovdr
                     cond = GET_FIELD_SP(insn, 14, 17);
-                    gen_op_load_fpr_DT0(rd);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rd));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     flush_T2(dc);
                     rs1 = GET_FIELD(insn, 13, 17);
                     gen_movl_reg_T0(rs1);
                     gen_cond_reg(cond);
                     gen_op_fmovs_cc();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 } else if ((xop & 0x11f) == 0x007) { // V9 fmovqr
+#if defined(CONFIG_USER_ONLY)
+                    cond = GET_FIELD_SP(insn, 14, 17);
+                    gen_op_load_fpr_QT0(QFPREG(rd));
+                    gen_op_load_fpr_QT1(QFPREG(rs2));
+                    flush_T2(dc);
+                    rs1 = GET_FIELD(insn, 13, 17);
+                    gen_movl_reg_T0(rs1);
+                    gen_cond_reg(cond);
+                    gen_op_fmovq_cc();
+                    gen_op_store_QT0_fpr(QFPREG(rd));
+                    break;
+#else
                     goto nfpu_insn;
+#endif
                 }
 #endif
                 switch (xop) {
@@ -1681,15 +1849,26 @@ static void disas_sparc_insn(DisasContext * dc)
                         break;
                     case 0x002: /* V9 fmovdcc %fcc0 */
                         cond = GET_FIELD_SP(insn, 14, 17);
-                        gen_op_load_fpr_DT0(rd);
-                        gen_op_load_fpr_DT1(rs2);
+                        gen_op_load_fpr_DT0(DFPREG(rd));
+                        gen_op_load_fpr_DT1(DFPREG(rs2));
                         flush_T2(dc);
                         gen_fcond[0][cond]();
                         gen_op_fmovd_cc();
-                        gen_op_store_DT0_fpr(rd);
+                        gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x003: /* V9 fmovqcc %fcc0 */
+#if defined(CONFIG_USER_ONLY)
+                        cond = GET_FIELD_SP(insn, 14, 17);
+                        gen_op_load_fpr_QT0(QFPREG(rd));
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        flush_T2(dc);
+                        gen_fcond[0][cond]();
+                        gen_op_fmovq_cc();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0x041: /* V9 fmovscc %fcc1 */
                         cond = GET_FIELD_SP(insn, 14, 17);
                         gen_op_load_fpr_FT0(rd);
@@ -1701,15 +1880,26 @@ static void disas_sparc_insn(DisasContext * dc)
                         break;
                     case 0x042: /* V9 fmovdcc %fcc1 */
                         cond = GET_FIELD_SP(insn, 14, 17);
-                        gen_op_load_fpr_DT0(rd);
-                        gen_op_load_fpr_DT1(rs2);
+                        gen_op_load_fpr_DT0(DFPREG(rd));
+                        gen_op_load_fpr_DT1(DFPREG(rs2));
                         flush_T2(dc);
                         gen_fcond[1][cond]();
                         gen_op_fmovd_cc();
-                        gen_op_store_DT0_fpr(rd);
+                        gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x043: /* V9 fmovqcc %fcc1 */
+#if defined(CONFIG_USER_ONLY)
+                        cond = GET_FIELD_SP(insn, 14, 17);
+                        gen_op_load_fpr_QT0(QFPREG(rd));
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        flush_T2(dc);
+                        gen_fcond[1][cond]();
+                        gen_op_fmovq_cc();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0x081: /* V9 fmovscc %fcc2 */
                         cond = GET_FIELD_SP(insn, 14, 17);
                         gen_op_load_fpr_FT0(rd);
@@ -1721,15 +1911,26 @@ static void disas_sparc_insn(DisasContext * dc)
                         break;
                     case 0x082: /* V9 fmovdcc %fcc2 */
                         cond = GET_FIELD_SP(insn, 14, 17);
-                        gen_op_load_fpr_DT0(rd);
-                        gen_op_load_fpr_DT1(rs2);
+                        gen_op_load_fpr_DT0(DFPREG(rd));
+                        gen_op_load_fpr_DT1(DFPREG(rs2));
                         flush_T2(dc);
                         gen_fcond[2][cond]();
                         gen_op_fmovd_cc();
-                        gen_op_store_DT0_fpr(rd);
+                        gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x083: /* V9 fmovqcc %fcc2 */
+#if defined(CONFIG_USER_ONLY)
+                        cond = GET_FIELD_SP(insn, 14, 17);
+                        gen_op_load_fpr_QT0(rd);
+                        gen_op_load_fpr_QT1(rs2);
+                        flush_T2(dc);
+                        gen_fcond[2][cond]();
+                        gen_op_fmovq_cc();
+                        gen_op_store_QT0_fpr(rd);
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0x0c1: /* V9 fmovscc %fcc3 */
                         cond = GET_FIELD_SP(insn, 14, 17);
                         gen_op_load_fpr_FT0(rd);
@@ -1741,15 +1942,26 @@ static void disas_sparc_insn(DisasContext * dc)
                         break;
                     case 0x0c2: /* V9 fmovdcc %fcc3 */
                         cond = GET_FIELD_SP(insn, 14, 17);
-                        gen_op_load_fpr_DT0(rd);
-                        gen_op_load_fpr_DT1(rs2);
+                        gen_op_load_fpr_DT0(DFPREG(rd));
+                        gen_op_load_fpr_DT1(DFPREG(rs2));
                         flush_T2(dc);
                         gen_fcond[3][cond]();
                         gen_op_fmovd_cc();
-                        gen_op_store_DT0_fpr(rd);
+                        gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x0c3: /* V9 fmovqcc %fcc3 */
+#if defined(CONFIG_USER_ONLY)
+                        cond = GET_FIELD_SP(insn, 14, 17);
+                        gen_op_load_fpr_QT0(QFPREG(rd));
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+                        flush_T2(dc);
+                        gen_fcond[3][cond]();
+                        gen_op_fmovq_cc();
+                        gen_op_store_QT0_fpr(QFPREG(rd));
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0x101: /* V9 fmovscc %icc */
                         cond = GET_FIELD_SP(insn, 14, 17);
                         gen_op_load_fpr_FT0(rd);
@@ -1761,15 +1973,26 @@ static void disas_sparc_insn(DisasContext * dc)
                         break;
                     case 0x102: /* V9 fmovdcc %icc */
                         cond = GET_FIELD_SP(insn, 14, 17);
-                        gen_op_load_fpr_DT0(rd);
-                        gen_op_load_fpr_DT1(rs2);
+                        gen_op_load_fpr_DT0(DFPREG(rd));
+                        gen_op_load_fpr_DT1(DFPREG(rs2));
                         flush_T2(dc);
                         gen_cond[0][cond]();
                         gen_op_fmovd_cc();
-                        gen_op_store_DT0_fpr(rd);
+                        gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x103: /* V9 fmovqcc %icc */
+#if defined(CONFIG_USER_ONLY)
+                        cond = GET_FIELD_SP(insn, 14, 17);
+                        gen_op_load_fpr_QT0(rd);
+                        gen_op_load_fpr_QT1(rs2);
+                        flush_T2(dc);
+                        gen_cond[0][cond]();
+                        gen_op_fmovq_cc();
+                        gen_op_store_QT0_fpr(rd);
+                        break;
+#else
                         goto nfpu_insn;
+#endif
                     case 0x181: /* V9 fmovscc %xcc */
                         cond = GET_FIELD_SP(insn, 14, 17);
                         gen_op_load_fpr_FT0(rd);
@@ -1781,17 +2004,28 @@ static void disas_sparc_insn(DisasContext * dc)
                         break;
                     case 0x182: /* V9 fmovdcc %xcc */
                         cond = GET_FIELD_SP(insn, 14, 17);
-                        gen_op_load_fpr_DT0(rd);
-                        gen_op_load_fpr_DT1(rs2);
+                        gen_op_load_fpr_DT0(DFPREG(rd));
+                        gen_op_load_fpr_DT1(DFPREG(rs2));
                         flush_T2(dc);
                         gen_cond[1][cond]();
                         gen_op_fmovd_cc();
-                        gen_op_store_DT0_fpr(rd);
+                        gen_op_store_DT0_fpr(DFPREG(rd));
                         break;
                     case 0x183: /* V9 fmovqcc %xcc */
+#if defined(CONFIG_USER_ONLY)
+                        cond = GET_FIELD_SP(insn, 14, 17);
+                        gen_op_load_fpr_QT0(rd);
+                        gen_op_load_fpr_QT1(rs2);
+                        flush_T2(dc);
+                        gen_cond[1][cond]();
+                        gen_op_fmovq_cc();
+                        gen_op_store_QT0_fpr(rd);
+                        break;
+#else
                         goto nfpu_insn;
 #endif
-                    case 0x51: /* V9 %fcc */
+#endif
+                    case 0x51: /* fcmps, V9 %fcc */
                         gen_op_load_fpr_FT0(rs1);
                         gen_op_load_fpr_FT1(rs2);
 #ifdef TARGET_SPARC64
@@ -1800,7 +2034,7 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_fcmps();
 #endif
                         break;
-                    case 0x52: /* V9 %fcc */
+                    case 0x52: /* fcmpd, V9 %fcc */
                         gen_op_load_fpr_DT0(DFPREG(rs1));
                         gen_op_load_fpr_DT1(DFPREG(rs2));
 #ifdef TARGET_SPARC64
@@ -1809,8 +2043,19 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_fcmpd();
 #endif
                         break;
-                    case 0x53: /* fcmpq */
+                    case 0x53: /* fcmpq, V9 %fcc */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT0(QFPREG(rs1));
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+#ifdef TARGET_SPARC64
+                        gen_fcmpq[rd & 3]();
+#else
+                        gen_op_fcmpq();
+#endif
+                        break;
+#else /* !defined(CONFIG_USER_ONLY) */
                         goto nfpu_insn;
+#endif
                     case 0x55: /* fcmpes, V9 %fcc */
                         gen_op_load_fpr_FT0(rs1);
                         gen_op_load_fpr_FT1(rs2);
@@ -1829,8 +2074,19 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_op_fcmped();
 #endif
                         break;
-                    case 0x57: /* fcmpeq */
+                    case 0x57: /* fcmpeq, V9 %fcc */
+#if defined(CONFIG_USER_ONLY)
+                        gen_op_load_fpr_QT0(QFPREG(rs1));
+                        gen_op_load_fpr_QT1(QFPREG(rs2));
+#ifdef TARGET_SPARC64
+                        gen_fcmpeq[rd & 3]();
+#else
+                        gen_op_fcmpeq();
+#endif
+                        break;
+#else/* !defined(CONFIG_USER_ONLY) */
                         goto nfpu_insn;
+#endif
                     default:
                         goto illegal_insn;
                 }
@@ -2027,10 +2283,12 @@ static void disas_sparc_insn(DisasContext * dc)
                         gen_movl_T0_reg(rd);
                         break;
                     case 0x22: /* taddcctv */
+                        save_state(dc);
                         gen_op_tadd_T1_T0_ccTV();
                         gen_movl_T0_reg(rd);
                         break;
                     case 0x23: /* tsubcctv */
+                        save_state(dc);
                         gen_op_tsub_T1_T0_ccTV();
                         gen_movl_T0_reg(rd);
                         break;
@@ -2408,94 +2666,94 @@ static void disas_sparc_insn(DisasContext * dc)
                     // XXX
                     goto illegal_insn;
                 case 0x020: /* VIS I fcmple16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fcmple16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x022: /* VIS I fcmpne16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fcmpne16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x024: /* VIS I fcmple32 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fcmple32();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x026: /* VIS I fcmpne32 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fcmpne32();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x028: /* VIS I fcmpgt16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fcmpgt16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x02a: /* VIS I fcmpeq16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fcmpeq16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x02c: /* VIS I fcmpgt32 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fcmpgt32();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x02e: /* VIS I fcmpeq32 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fcmpeq32();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x031: /* VIS I fmul8x16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fmul8x16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x033: /* VIS I fmul8x16au */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fmul8x16au();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x035: /* VIS I fmul8x16al */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fmul8x16al();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x036: /* VIS I fmul8sux16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fmul8sux16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x037: /* VIS I fmul8ulx16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fmul8ulx16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x038: /* VIS I fmuld8sux16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fmuld8sux16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x039: /* VIS I fmuld8ulx16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fmuld8ulx16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x03a: /* VIS I fpack32 */
                 case 0x03b: /* VIS I fpack16 */
@@ -2504,31 +2762,31 @@ static void disas_sparc_insn(DisasContext * dc)
                     // XXX
                     goto illegal_insn;
                 case 0x048: /* VIS I faligndata */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_faligndata();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x04b: /* VIS I fpmerge */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fpmerge();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x04c: /* VIS II bshuffle */
                     // XXX
                     goto illegal_insn;
                 case 0x04d: /* VIS I fexpand */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fexpand();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x050: /* VIS I fpadd16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fpadd16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x051: /* VIS I fpadd16s */
                     gen_op_load_fpr_FT0(rs1);
@@ -2537,10 +2795,10 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x052: /* VIS I fpadd32 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fpadd32();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x053: /* VIS I fpadd32s */
                     gen_op_load_fpr_FT0(rs1);
@@ -2549,10 +2807,10 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x054: /* VIS I fpsub16 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fpsub16();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x055: /* VIS I fpsub16s */
                     gen_op_load_fpr_FT0(rs1);
@@ -2561,10 +2819,10 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x056: /* VIS I fpsub32 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fpadd32();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x057: /* VIS I fpsub32s */
                     gen_op_load_fpr_FT0(rs1);
@@ -2574,17 +2832,17 @@ static void disas_sparc_insn(DisasContext * dc)
                     break;
                 case 0x060: /* VIS I fzero */
                     gen_op_movl_DT0_0();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x061: /* VIS I fzeros */
                     gen_op_movl_FT0_0();
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x062: /* VIS I fnor */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fnor();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x063: /* VIS I fnors */
                     gen_op_load_fpr_FT0(rs1);
@@ -2593,10 +2851,10 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x064: /* VIS I fandnot2 */
-                    gen_op_load_fpr_DT1(rs1);
-                    gen_op_load_fpr_DT0(rs2);
+                    gen_op_load_fpr_DT1(DFPREG(rs1));
+                    gen_op_load_fpr_DT0(DFPREG(rs2));
                     gen_op_fandnot();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x065: /* VIS I fandnot2s */
                     gen_op_load_fpr_FT1(rs1);
@@ -2605,9 +2863,9 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x066: /* VIS I fnot2 */
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fnot();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x067: /* VIS I fnot2s */
                     gen_op_load_fpr_FT1(rs2);
@@ -2615,10 +2873,10 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x068: /* VIS I fandnot1 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fandnot();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x069: /* VIS I fandnot1s */
                     gen_op_load_fpr_FT0(rs1);
@@ -2627,9 +2885,9 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x06a: /* VIS I fnot1 */
-                    gen_op_load_fpr_DT1(rs1);
+                    gen_op_load_fpr_DT1(DFPREG(rs1));
                     gen_op_fnot();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x06b: /* VIS I fnot1s */
                     gen_op_load_fpr_FT1(rs1);
@@ -2637,10 +2895,10 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x06c: /* VIS I fxor */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fxor();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x06d: /* VIS I fxors */
                     gen_op_load_fpr_FT0(rs1);
@@ -2649,10 +2907,10 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x06e: /* VIS I fnand */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fnand();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x06f: /* VIS I fnands */
                     gen_op_load_fpr_FT0(rs1);
@@ -2661,10 +2919,10 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x070: /* VIS I fand */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fand();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x071: /* VIS I fands */
                     gen_op_load_fpr_FT0(rs1);
@@ -2673,10 +2931,10 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x072: /* VIS I fxnor */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fxnor();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x073: /* VIS I fxnors */
                     gen_op_load_fpr_FT0(rs1);
@@ -2685,18 +2943,18 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x074: /* VIS I fsrc1 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x075: /* VIS I fsrc1s */
                     gen_op_load_fpr_FT0(rs1);
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x076: /* VIS I fornot2 */
-                    gen_op_load_fpr_DT1(rs1);
-                    gen_op_load_fpr_DT0(rs2);
+                    gen_op_load_fpr_DT1(DFPREG(rs1));
+                    gen_op_load_fpr_DT0(DFPREG(rs2));
                     gen_op_fornot();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x077: /* VIS I fornot2s */
                     gen_op_load_fpr_FT1(rs1);
@@ -2705,18 +2963,18 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x078: /* VIS I fsrc2 */
-                    gen_op_load_fpr_DT0(rs2);
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_load_fpr_DT0(DFPREG(rs2));
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x079: /* VIS I fsrc2s */
                     gen_op_load_fpr_FT0(rs2);
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x07a: /* VIS I fornot1 */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_fornot();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x07b: /* VIS I fornot1s */
                     gen_op_load_fpr_FT0(rs1);
@@ -2725,10 +2983,10 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x07c: /* VIS I for */
-                    gen_op_load_fpr_DT0(rs1);
-                    gen_op_load_fpr_DT1(rs2);
+                    gen_op_load_fpr_DT0(DFPREG(rs1));
+                    gen_op_load_fpr_DT1(DFPREG(rs2));
                     gen_op_for();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x07d: /* VIS I fors */
                     gen_op_load_fpr_FT0(rs1);
@@ -2738,7 +2996,7 @@ static void disas_sparc_insn(DisasContext * dc)
                     break;
                 case 0x07e: /* VIS I fone */
                     gen_op_movl_DT0_1();
-                    gen_op_store_DT0_fpr(rd);
+                    gen_op_store_DT0_fpr(DFPREG(rd));
                     break;
                 case 0x07f: /* VIS I fones */
                     gen_op_movl_FT0_1();
@@ -2932,9 +3190,7 @@ static void disas_sparc_insn(DisasContext * dc)
                 (xop > 0x2c && xop <= 0x33) || xop == 0x1f || xop == 0x3d) {
                 switch (xop) {
                 case 0x0:       /* load word */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
 #ifndef TARGET_SPARC64
                     gen_op_ldst(ld);
 #else
@@ -2945,15 +3201,13 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_ldst(ldub);
                     break;
                 case 0x2:       /* load unsigned halfword */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_1();
-#endif
                     gen_op_ldst(lduh);
                     break;
                 case 0x3:       /* load double word */
-                    gen_op_check_align_T0_7();
                     if (rd & 1)
                         goto illegal_insn;
+                    gen_op_check_align_T0_7();
                     gen_op_ldst(ldd);
                     gen_movl_T0_reg(rd + 1);
                     break;
@@ -2961,18 +3215,14 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_ldst(ldsb);
                     break;
                 case 0xa:       /* load signed halfword */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_1();
-#endif
                     gen_op_ldst(ldsh);
                     break;
                 case 0xd:       /* ldstub -- XXX: should be atomically */
                     gen_op_ldst(ldstub);
                     break;
                 case 0x0f:      /* swap register with memory. Also atomically */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
                     gen_movl_reg_T1(rd);
                     gen_op_ldst(swap);
                     break;
@@ -2983,9 +3233,8 @@ static void disas_sparc_insn(DisasContext * dc)
                         goto illegal_insn;
                     if (!supervisor(dc))
                         goto priv_insn;
-#elif CONFIG_USER_ONLY
-                    gen_op_check_align_T0_3();
 #endif
+                    gen_op_check_align_T0_3();
                     gen_ld_asi(insn, 4, 0);
                     break;
                 case 0x11:      /* load unsigned byte alternate */
@@ -3003,9 +3252,8 @@ static void disas_sparc_insn(DisasContext * dc)
                         goto illegal_insn;
                     if (!supervisor(dc))
                         goto priv_insn;
-#elif CONFIG_USER_ONLY
-                    gen_op_check_align_T0_1();
 #endif
+                    gen_op_check_align_T0_1();
                     gen_ld_asi(insn, 2, 0);
                     break;
                 case 0x13:      /* load double word alternate */
@@ -3036,9 +3284,8 @@ static void disas_sparc_insn(DisasContext * dc)
                         goto illegal_insn;
                     if (!supervisor(dc))
                         goto priv_insn;
-#elif CONFIG_USER_ONLY
-                    gen_op_check_align_T0_1();
 #endif
+                    gen_op_check_align_T0_1();
                     gen_ld_asi(insn, 2, 1);
                     break;
                 case 0x1d:      /* ldstuba -- XXX: should be atomically */
@@ -3056,9 +3303,8 @@ static void disas_sparc_insn(DisasContext * dc)
                         goto illegal_insn;
                     if (!supervisor(dc))
                         goto priv_insn;
-#elif CONFIG_USER_ONLY
-                    gen_op_check_align_T0_3();
 #endif
+                    gen_op_check_align_T0_3();
                     gen_movl_reg_T1(rd);
                     gen_swap_asi(insn);
                     break;
@@ -3072,9 +3318,7 @@ static void disas_sparc_insn(DisasContext * dc)
 #endif
 #ifdef TARGET_SPARC64
                 case 0x08: /* V9 ldsw */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
                     gen_op_ldst(ldsw);
                     break;
                 case 0x0b: /* V9 ldx */
@@ -3082,9 +3326,7 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_ldst(ldx);
                     break;
                 case 0x18: /* V9 ldswa */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
                     gen_ld_asi(insn, 4, 1);
                     break;
                 case 0x1b: /* V9 ldxa */
@@ -3094,20 +3336,24 @@ static void disas_sparc_insn(DisasContext * dc)
                 case 0x2d: /* V9 prefetch, no effect */
                     goto skip_move;
                 case 0x30: /* V9 ldfa */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
-                    gen_ldf_asi(insn, 4);
+                    gen_ldf_asi(insn, 4, rd);
                     goto skip_move;
                 case 0x33: /* V9 lddfa */
                     gen_op_check_align_T0_3();
-                    gen_ldf_asi(insn, 8);
+                    gen_ldf_asi(insn, 8, DFPREG(rd));
                     goto skip_move;
                 case 0x3d: /* V9 prefetcha, no effect */
                     goto skip_move;
                 case 0x32: /* V9 ldqfa */
+#if defined(CONFIG_USER_ONLY)
+                    gen_op_check_align_T0_3();
+                    gen_ldf_asi(insn, 16, QFPREG(rd));
+                    goto skip_move;
+#else
                     goto nfpu_insn;
 #endif
+#endif
                 default:
                     goto illegal_insn;
                 }
@@ -3120,21 +3366,24 @@ static void disas_sparc_insn(DisasContext * dc)
                     goto jmp_insn;
                 switch (xop) {
                 case 0x20:      /* load fpreg */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
                     gen_op_ldst(ldf);
                     gen_op_store_FT0_fpr(rd);
                     break;
                 case 0x21:      /* load fsr */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
                     gen_op_ldst(ldf);
                     gen_op_ldfsr();
                     break;
                 case 0x22:      /* load quad fpreg */
+#if defined(CONFIG_USER_ONLY)
+                    gen_op_check_align_T0_7();
+                    gen_op_ldst(ldqf);
+                    gen_op_store_QT0_fpr(QFPREG(rd));
+                    break;
+#else
                     goto nfpu_insn;
+#endif
                 case 0x23:      /* load double fpreg */
                     gen_op_check_align_T0_7();
                     gen_op_ldst(lddf);
@@ -3148,18 +3397,14 @@ static void disas_sparc_insn(DisasContext * dc)
                 gen_movl_reg_T1(rd);
                 switch (xop) {
                 case 0x4:
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
                     gen_op_ldst(st);
                     break;
                 case 0x5:
                     gen_op_ldst(stb);
                     break;
                 case 0x6:
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_1();
-#endif
                     gen_op_ldst(sth);
                     break;
                 case 0x7:
@@ -3178,9 +3423,7 @@ static void disas_sparc_insn(DisasContext * dc)
                     if (!supervisor(dc))
                         goto priv_insn;
 #endif
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
                     gen_st_asi(insn, 4);
                     break;
                 case 0x15:
@@ -3199,9 +3442,7 @@ static void disas_sparc_insn(DisasContext * dc)
                     if (!supervisor(dc))
                         goto priv_insn;
 #endif
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_1();
-#endif
                     gen_st_asi(insn, 2);
                     break;
                 case 0x17:
@@ -3237,9 +3478,7 @@ static void disas_sparc_insn(DisasContext * dc)
                     goto jmp_insn;
                 switch (xop) {
                 case 0x24:
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
                     gen_op_load_fpr_FT0(rd);
                     gen_op_ldst(stf);
                     break;
@@ -3250,14 +3489,29 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_op_stfsr();
                     gen_op_ldst(stf);
                     break;
-#if !defined(CONFIG_USER_ONLY)
-                case 0x26: /* stdfq */
+                case 0x26:
+#ifdef TARGET_SPARC64
+#if defined(CONFIG_USER_ONLY)
+                    /* V9 stqf, store quad fpreg */
+                    gen_op_check_align_T0_7();
+                    gen_op_load_fpr_QT0(QFPREG(rd));
+                    gen_op_ldst(stqf);
+                    break;
+#else
+                    goto nfpu_insn;
+#endif
+#else /* !TARGET_SPARC64 */
+                    /* stdfq, store floating point queue */
+#if defined(CONFIG_USER_ONLY)
+                    goto illegal_insn;
+#else
                     if (!supervisor(dc))
                         goto priv_insn;
                     if (gen_trap_ifnofpu(dc))
                         goto jmp_insn;
                     goto nfq_insn;
 #endif
+#endif
                 case 0x27:
                     gen_op_check_align_T0_7();
                     gen_op_load_fpr_DT0(DFPREG(rd));
@@ -3270,21 +3524,26 @@ static void disas_sparc_insn(DisasContext * dc)
                 switch (xop) {
 #ifdef TARGET_SPARC64
                 case 0x34: /* V9 stfa */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
                     gen_op_load_fpr_FT0(rd);
-                    gen_stf_asi(insn, 4);
+                    gen_stf_asi(insn, 4, rd);
+                    break;
+                case 0x36: /* V9 stqfa */
+#if defined(CONFIG_USER_ONLY)
+                    gen_op_check_align_T0_7();
+                    gen_op_load_fpr_QT0(QFPREG(rd));
+                    gen_stf_asi(insn, 16, QFPREG(rd));
                     break;
+#else
+                    goto nfpu_insn;
+#endif
                 case 0x37: /* V9 stdfa */
                     gen_op_check_align_T0_3();
                     gen_op_load_fpr_DT0(DFPREG(rd));
-                    gen_stf_asi(insn, 8);
+                    gen_stf_asi(insn, 8, DFPREG(rd));
                     break;
                 case 0x3c: /* V9 casa */
-#ifdef CONFIG_USER_ONLY
                     gen_op_check_align_T0_3();
-#endif
                     flush_T2(dc);
                     gen_movl_reg_T2(rd);
                     gen_cas_asi(insn);
@@ -3297,8 +3556,6 @@ static void disas_sparc_insn(DisasContext * dc)
                     gen_casx_asi(insn);
                     gen_movl_T1_reg(rd);
                     break;
-                case 0x36: /* V9 stqfa */
-                    goto nfpu_insn;
 #else
                 case 0x34: /* stc */
                 case 0x35: /* stcsr */
@@ -3340,19 +3597,19 @@ static void disas_sparc_insn(DisasContext * dc)
     gen_op_exception(TT_PRIV_INSN);
     dc->is_br = 1;
     return;
-#endif
  nfpu_insn:
     save_state(dc);
     gen_op_fpexception_im(FSR_FTT_UNIMPFPOP);
     dc->is_br = 1;
     return;
-#if !defined(CONFIG_USER_ONLY)
+#ifndef TARGET_SPARC64
  nfq_insn:
     save_state(dc);
     gen_op_fpexception_im(FSR_FTT_SEQ_ERROR);
     dc->is_br = 1;
     return;
 #endif
+#endif
 #ifndef TARGET_SPARC64
  ncp_insn:
     save_state(dc);
@@ -3376,17 +3633,8 @@ static inline int gen_intermediate_code_internal(TranslationBlock * tb,
     dc->pc = pc_start;
     last_pc = dc->pc;
     dc->npc = (target_ulong) tb->cs_base;
-#if defined(CONFIG_USER_ONLY)
-    dc->mem_idx = 0;
-    dc->fpu_enabled = 1;
-#else
-    dc->mem_idx = ((env->psrs) != 0);
-#ifdef TARGET_SPARC64
-    dc->fpu_enabled = (((env->pstate & PS_PEF) != 0) && ((env->fprs & FPRS_FEF) != 0));
-#else
-    dc->fpu_enabled = ((env->psref) != 0);
-#endif
-#endif
+    dc->mem_idx = cpu_mmu_index(env);
+    dc->fpu_enabled = cpu_fpu_enabled(env);
     gen_opc_ptr = gen_opc_buf;
     gen_opc_end = gen_opc_buf + OPC_MAX_SIZE;
     gen_opparam_ptr = gen_opparam_buf;
@@ -3520,87 +3768,304 @@ void cpu_reset(CPUSPARCState *env)
     env->psrps = 1;
 #ifdef TARGET_SPARC64
     env->pstate = PS_PRIV;
+    env->hpstate = HS_PRIV;
     env->pc = 0x1fff0000000ULL;
 #else
     env->pc = 0;
     env->mmuregs[0] &= ~(MMU_E | MMU_NF);
-    env->mmuregs[0] |= MMU_BM;
+    env->mmuregs[0] |= env->mmu_bm;
 #endif
     env->npc = env->pc + 4;
 #endif
 }
 
-CPUSPARCState *cpu_sparc_init(void)
+CPUSPARCState *cpu_sparc_init(const char *cpu_model)
 {
     CPUSPARCState *env;
+    const sparc_def_t *def;
+
+    def = cpu_sparc_find_by_name(cpu_model);
+    if (!def)
+        return NULL;
 
     env = qemu_mallocz(sizeof(CPUSPARCState));
     if (!env)
         return NULL;
     cpu_exec_init(env);
+    env->cpu_model_str = cpu_model;
+    env->version = def->iu_version;
+    env->fsr = def->fpu_version;
+#if !defined(TARGET_SPARC64)
+    env->mmu_bm = def->mmu_bm;
+    env->mmuregs[0] |= def->mmu_version;
+    cpu_sparc_set_id(env, 0);
+#endif
     cpu_reset(env);
-    return (env);
+    
+    return env;
+}
+
+void cpu_sparc_set_id(CPUSPARCState *env, unsigned int cpu)
+{
+#if !defined(TARGET_SPARC64)
+    env->mxccregs[7] = ((cpu + 8) & 0xf) << 24;
+#endif
 }
 
 static const sparc_def_t sparc_defs[] = {
 #ifdef TARGET_SPARC64
     {
+        .name = "Fujitsu Sparc64",
+        .iu_version = ((0x04ULL << 48) | (0x02ULL << 32) | (0ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "Fujitsu Sparc64 III",
+        .iu_version = ((0x04ULL << 48) | (0x03ULL << 32) | (0ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "Fujitsu Sparc64 IV",
+        .iu_version = ((0x04ULL << 48) | (0x04ULL << 32) | (0ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "Fujitsu Sparc64 V",
+        .iu_version = ((0x04ULL << 48) | (0x05ULL << 32) | (0x51ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "TI UltraSparc I",
+        .iu_version = ((0x17ULL << 48) | (0x10ULL << 32) | (0x40ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
         .name = "TI UltraSparc II",
-        .iu_version = ((0x17ULL << 48) | (0x11ULL << 32) | (0 << 24)
+        .iu_version = ((0x17ULL << 48) | (0x11ULL << 32) | (0x20ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "TI UltraSparc IIi",
+        .iu_version = ((0x17ULL << 48) | (0x12ULL << 32) | (0x91ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "TI UltraSparc IIe",
+        .iu_version = ((0x17ULL << 48) | (0x13ULL << 32) | (0x14ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "Sun UltraSparc III",
+        .iu_version = ((0x3eULL << 48) | (0x14ULL << 32) | (0x34ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "Sun UltraSparc III Cu",
+        .iu_version = ((0x3eULL << 48) | (0x15ULL << 32) | (0x41ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "Sun UltraSparc IIIi",
+        .iu_version = ((0x3eULL << 48) | (0x16ULL << 32) | (0x34ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "Sun UltraSparc IV",
+        .iu_version = ((0x3eULL << 48) | (0x18ULL << 32) | (0x31ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "Sun UltraSparc IV+",
+        .iu_version = ((0x3eULL << 48) | (0x19ULL << 32) | (0x22ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "Sun UltraSparc IIIi+",
+        .iu_version = ((0x3eULL << 48) | (0x22ULL << 32) | (0ULL << 24)
+                       | (MAXTL << 8) | (NWINDOWS - 1)),
+        .fpu_version = 0x00000000,
+        .mmu_version = 0,
+    },
+    {
+        .name = "NEC UltraSparc I",
+        .iu_version = ((0x22ULL << 48) | (0x10ULL << 32) | (0x40ULL << 24)
                        | (MAXTL << 8) | (NWINDOWS - 1)),
         .fpu_version = 0x00000000,
         .mmu_version = 0,
     },
 #else
     {
+        .name = "Fujitsu MB86900",
+        .iu_version = 0x00 << 24, /* Impl 0, ver 0 */
+        .fpu_version = 4 << 17, /* FPU version 4 (Meiko) */
+        .mmu_version = 0x00 << 24, /* Impl 0, ver 0 */
+        .mmu_bm = 0x00004000,
+    },
+    {
         .name = "Fujitsu MB86904",
         .iu_version = 0x04 << 24, /* Impl 0, ver 4 */
         .fpu_version = 4 << 17, /* FPU version 4 (Meiko) */
         .mmu_version = 0x04 << 24, /* Impl 0, ver 4 */
+        .mmu_bm = 0x00004000,
     },
     {
         .name = "Fujitsu MB86907",
         .iu_version = 0x05 << 24, /* Impl 0, ver 5 */
         .fpu_version = 4 << 17, /* FPU version 4 (Meiko) */
         .mmu_version = 0x05 << 24, /* Impl 0, ver 5 */
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "LSI L64811",
+        .iu_version = 0x10 << 24, /* Impl 1, ver 0 */
+        .fpu_version = 1 << 17, /* FPU version 1 (LSI L64814) */
+        .mmu_version = 0x10 << 24,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "Cypress CY7C601",
+        .iu_version = 0x11 << 24, /* Impl 1, ver 1 */
+        .fpu_version = 3 << 17, /* FPU version 3 (Cypress CY7C602) */
+        .mmu_version = 0x10 << 24,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "Cypress CY7C611",
+        .iu_version = 0x13 << 24, /* Impl 1, ver 3 */
+        .fpu_version = 3 << 17, /* FPU version 3 (Cypress CY7C602) */
+        .mmu_version = 0x10 << 24,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "TI SuperSparc II",
+        .iu_version = 0x40000000,
+        .fpu_version = 0 << 17,
+        .mmu_version = 0x04000000,
+        .mmu_bm = 0x00002000,
     },
     {
         .name = "TI MicroSparc I",
         .iu_version = 0x41000000,
         .fpu_version = 4 << 17,
         .mmu_version = 0x41000000,
+        .mmu_bm = 0x00004000,
     },
     {
-        .name = "TI SuperSparc II",
-        .iu_version = 0x40000000,
+        .name = "TI MicroSparc II",
+        .iu_version = 0x42000000,
+        .fpu_version = 4 << 17,
+        .mmu_version = 0x02000000,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "TI MicroSparc IIep",
+        .iu_version = 0x42000000,
+        .fpu_version = 4 << 17,
+        .mmu_version = 0x04000000,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "TI SuperSparc 51",
+        .iu_version = 0x43000000,
         .fpu_version = 0 << 17,
         .mmu_version = 0x04000000,
+        .mmu_bm = 0x00002000,
     },
     {
-        .name = "Ross RT620",
+        .name = "TI SuperSparc 61",
+        .iu_version = 0x44000000,
+        .fpu_version = 0 << 17,
+        .mmu_version = 0x04000000,
+        .mmu_bm = 0x00002000,
+    },
+    {
+        .name = "Ross RT625",
         .iu_version = 0x1e000000,
         .fpu_version = 1 << 17,
-        .mmu_version = 0x17000000,
+        .mmu_version = 0x1e000000,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "Ross RT620",
+        .iu_version = 0x1f000000,
+        .fpu_version = 1 << 17,
+        .mmu_version = 0x1f000000,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "BIT B5010",
+        .iu_version = 0x20000000,
+        .fpu_version = 0 << 17, /* B5010/B5110/B5120/B5210 */
+        .mmu_version = 0x20000000,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "Matsushita MN10501",
+        .iu_version = 0x50000000,
+        .fpu_version = 0 << 17,
+        .mmu_version = 0x50000000,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "Weitek W8601",
+        .iu_version = 0x90 << 24, /* Impl 9, ver 0 */
+        .fpu_version = 3 << 17, /* FPU version 3 (Weitek WTL3170/2) */
+        .mmu_version = 0x10 << 24,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "LEON2",
+        .iu_version = 0xf2000000,
+        .fpu_version = 4 << 17, /* FPU version 4 (Meiko) */
+        .mmu_version = 0xf2000000,
+        .mmu_bm = 0x00004000,
+    },
+    {
+        .name = "LEON3",
+        .iu_version = 0xf3000000,
+        .fpu_version = 4 << 17, /* FPU version 4 (Meiko) */
+        .mmu_version = 0xf3000000,
+        .mmu_bm = 0x00004000,
     },
 #endif
 };
 
-int sparc_find_by_name(const unsigned char *name, const sparc_def_t **def)
+static const sparc_def_t *cpu_sparc_find_by_name(const unsigned char *name)
 {
-    int ret;
     unsigned int i;
 
-    ret = -1;
-    *def = NULL;
     for (i = 0; i < sizeof(sparc_defs) / sizeof(sparc_def_t); i++) {
         if (strcasecmp(name, sparc_defs[i].name) == 0) {
-            *def = &sparc_defs[i];
-            ret = 0;
-            break;
+            return &sparc_defs[i];
         }
     }
-
-    return ret;
+    return NULL;
 }
 
 void sparc_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
@@ -3616,16 +4081,6 @@ void sparc_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
     }
 }
 
-int cpu_sparc_register (CPUSPARCState *env, const sparc_def_t *def)
-{
-    env->version = def->iu_version;
-    env->fsr = def->fpu_version;
-#if !defined(TARGET_SPARC64)
-    env->mmuregs[0] |= def->mmu_version;
-#endif
-    return 0;
-}
-
 #define GET_FLAG(a,b) ((env->psr & a)?b:'-')
 
 void cpu_dump_state(CPUState *env, FILE *f,
@@ -3687,7 +4142,7 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 #else
 extern int get_physical_address (CPUState *env, target_phys_addr_t *physical, int *prot,
                                  int *access_index, target_ulong address, int rw,
-                                 int is_user);
+                                 int mmu_idx);
 
 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 {
diff --git a/tests/Makefile b/tests/Makefile
index ec3a93ce6..f8bad3232 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -1,6 +1,6 @@
 -include ../config-host.mak
 
-CFLAGS=-Wall -O2 -g
+CFLAGS=-Wall -O2 -g -fno-strict-aliasing
 #CFLAGS+=-msse2
 LDFLAGS=
 
@@ -92,11 +92,9 @@ hello-mips: hello-mips.c
 hello-mipsel: hello-mips.c
 	mipsel-linux-gnu-gcc -nostdlib -static -mno-abicalls -fno-PIC -mabi=32 -Wall -Wextra -g -O2 -o $@ $<
 
-# XXX: find a way to compile easily a test for each arch
-test2:
-	@for arch in i386 arm armeb sparc ppc mips mipsel; do \
-           ../$${arch}-linux-user/qemu-$${arch} $${arch}/ls -l linux-test.c ; \
-        done
+# testsuite for the CRIS port.
+test-cris:
+	$(MAKE) -C cris check
 
 clean:
 	rm -f *~ *.o test-i386.out test-i386.ref \
diff --git a/tests/cris/.gdbinit b/tests/cris/.gdbinit
new file mode 100644
index 000000000..579eac943
--- /dev/null
+++ b/tests/cris/.gdbinit
@@ -0,0 +1,12 @@
+b main
+b _fail
+b exit
+display /i $pc
+display /x $srp
+display /x $r0
+display /x $r1
+display /x $r2
+display /x $r3
+display /x $r4
+display /t $ccs
+
diff --git a/tests/cris/Makefile b/tests/cris/Makefile
new file mode 100644
index 000000000..a6a28f4ec
--- /dev/null
+++ b/tests/cris/Makefile
@@ -0,0 +1,153 @@
+-include ../../config-host.mak
+
+CROSS=crisv32-axis-linux-gnu-
+SIM=../../cris-linux-user/qemu-cris -L ./
+SIMG=cris-axis-linux-gnu-run --sysroot=./
+
+CC      = $(CROSS)gcc
+#AS      = $(CROSS)as
+AS	= $(CC) -x assembler-with-cpp
+SIZE    = $(CROSS)size
+LD      = $(CC)
+OBJCOPY = $(CROSS)objcopy
+
+# we rely on GCC inline:ing the stuff we tell it to in many places here.
+CFLAGS  = -Winline -Wall -g -O2 -static
+NOSTDFLAGS = -nostartfiles -nostdlib
+ASFLAGS += -g -Wa,-I,$(SRC_PATH)/tests/cris/
+LDLIBS  =
+NOSTDLIBS = -lgcc
+
+CRT        = crt.o
+SYS        = sys.o
+TESTCASES += check_abs.tst
+TESTCASES += check_addc.tst
+TESTCASES += check_addcm.tst
+TESTCASES += check_addo.tst
+TESTCASES += check_addoq.tst
+TESTCASES += check_addi.tst
+TESTCASES += check_addiv32.tst
+TESTCASES += check_addm.tst
+TESTCASES += check_addr.tst
+TESTCASES += check_addq.tst
+TESTCASES += check_addxc.tst
+TESTCASES += check_addxm.tst
+TESTCASES += check_addxr.tst
+TESTCASES += check_andc.tst
+TESTCASES += check_andm.tst
+TESTCASES += check_andr.tst
+TESTCASES += check_andq.tst
+TESTCASES += check_asr.tst
+TESTCASES += check_ba.tst
+TESTCASES += check_bas.tst
+TESTCASES += check_bcc.tst
+TESTCASES += check_bound.tst
+TESTCASES += check_boundc.tst
+TESTCASES += check_boundr.tst
+TESTCASES += check_btst.tst
+TESTCASES += check_clearfv32.tst
+TESTCASES += check_cmpc.tst
+TESTCASES += check_cmpr.tst
+TESTCASES += check_cmpq.tst
+TESTCASES += check_cmpm.tst
+TESTCASES += check_cmpxc.tst
+TESTCASES += check_cmpxm.tst
+TESTCASES += check_cmp-2.tst
+TESTCASES += check_clrjmp1.tst
+TESTCASES += check_dstep.tst
+TESTCASES += check_int64.tst
+# check_jsr is broken.
+#TESTCASES += check_jsr.tst
+TESTCASES += check_mcp.tst
+TESTCASES += check_movei.tst
+TESTCASES += check_mover.tst
+TESTCASES += check_moverm.tst
+TESTCASES += check_moveq.tst
+TESTCASES += check_movemr.tst
+TESTCASES += check_movemrv32.tst
+TESTCASES += check_movecr.tst
+TESTCASES += check_movmp.tst
+TESTCASES += check_movpr.tst
+TESTCASES += check_movprv32.tst
+TESTCASES += check_movdelsr1.tst
+TESTCASES += check_movpmv32.tst
+TESTCASES += check_movsr.tst
+TESTCASES += check_movsm.tst
+TESTCASES += check_movscr.tst
+TESTCASES += check_movur.tst
+TESTCASES += check_movum.tst
+TESTCASES += check_movucr.tst
+TESTCASES += check_mulx.tst
+TESTCASES += check_mulv32.tst
+TESTCASES += check_neg.tst
+TESTCASES += check_not.tst
+TESTCASES += check_lz.tst
+TESTCASES += check_lapc.tst
+TESTCASES += check_lsl.tst
+TESTCASES += check_lsr.tst
+TESTCASES += check_orc.tst
+TESTCASES += check_orm.tst
+TESTCASES += check_orr.tst
+TESTCASES += check_orq.tst
+TESTCASES += check_ret.tst
+TESTCASES += check_swap.tst
+TESTCASES += check_scc.tst
+TESTCASES += check_subc.tst
+TESTCASES += check_subq.tst
+TESTCASES += check_subr.tst
+TESTCASES += check_subm.tst
+TESTCASES += check_glibc_kernelversion.tst
+TESTCASES += check_xarith.tst
+
+TESTCASES += check_hello.ctst
+TESTCASES += check_stat1.ctst
+TESTCASES += check_stat2.ctst
+TESTCASES += check_stat3.ctst
+TESTCASES += check_stat4.ctst
+TESTCASES += check_openpf1.ctst
+TESTCASES += check_openpf2.ctst
+TESTCASES += check_openpf3.ctst
+TESTCASES += check_openpf4.ctst
+TESTCASES += check_openpf5.ctst
+TESTCASES += check_mapbrk.ctst
+TESTCASES += check_mmap1.ctst
+TESTCASES += check_mmap2.ctst
+TESTCASES += check_mmap3.ctst
+TESTCASES += check_time1.ctst
+TESTCASES += check_time2.ctst
+
+
+TESTCASES += check_gcctorture_pr28634-1.ctst
+#TESTCASES += check_gcctorture_pr28634.ctst
+
+all: build
+
+%.o: $(SRC_PATH)/tests/cris/%.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+%.o: $(SRC_PATH)/tests/cris/%.s
+	$(AS) $(ASFLAGS) -c $< -o $@
+
+%.tst: %.o
+	$(CC) $(CFLAGS) $(NOSTDFLAGS) $(LDLIBS) $(NOSTDLIBS) $(CRT) $< $(SYS) -o $@
+
+%.ctst: %.o
+	$(CC) $(CFLAGS) $(LDLIBS) $< -o $@
+
+build: $(CRT) $(SYS) $(TESTCASES)
+
+check: $(CRT) $(SYS) $(TESTCASES)
+	@echo -e "\nQEMU simulator."
+	@for case in $(TESTCASES); do \
+		echo -n "$$case "; \
+		$(SIM) $$case; \
+	done
+check-g: $(CRT) $(SYS) $(TESTCASES)
+	@echo -e "\nGDB simulator."
+	@for case in $(TESTCASES); do \
+		echo -n "$$case "; \
+		$(SIMG) $$case; \
+	done
+
+clean:
+	$(RM) -fr $(TESTCASES) $(CRT) $(SYS)
diff --git a/tests/cris/README b/tests/cris/README
new file mode 100644
index 000000000..93c955cbb
--- /dev/null
+++ b/tests/cris/README
@@ -0,0 +1,2 @@
+Test-suite for the cris port. Heavily based on the test-suite for the CRIS port of sim by Hans-Peter Nilsson.
+
diff --git a/tests/cris/check_abs.c b/tests/cris/check_abs.c
new file mode 100644
index 000000000..3966c87c7
--- /dev/null
+++ b/tests/cris/check_abs.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+#include "crisutils.h"
+
+extern inline int cris_abs(int n) {
+	int r;
+	asm ("abs\t%1, %0\n" : "=r" (r) : "r" (n));
+	return r;
+}
+
+extern inline void
+verify_abs(int val, int res,
+	   const int n, const int z, const int v, const int c)
+{
+	int r;
+
+	cris_tst_cc_init();
+	r = cris_abs(val);
+	cris_tst_cc(n, z, v, c);
+	if (r != res)
+		err();
+}
+
+int main(void)
+{
+	verify_abs(-1, 1, 0, 0, 0, 0);
+	verify_abs(0x80000000, 0x80000000, 1, 0, 0, 0);
+	verify_abs(0x7fffffff, 0x7fffffff, 0, 0, 0, 0);
+	verify_abs(42, 42, 0, 0, 0, 0);
+	verify_abs(1, 1, 0, 0, 0, 0);
+	verify_abs(0xffff, 0xffff, 0, 0, 0, 0);
+	verify_abs(0xffff, 0xffff, 0, 0, 0, 0);
+	verify_abs(-31, 0x1f, 0, 0, 0, 0);
+	verify_abs(0, 0, 0, 1, 0, 0);
+	pass();
+	return 0;
+}
diff --git a/tests/cris/check_addc.c b/tests/cris/check_addc.c
new file mode 100644
index 000000000..e4078555f
--- /dev/null
+++ b/tests/cris/check_addc.c
@@ -0,0 +1,57 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+#include "crisutils.h"
+
+extern inline int cris_addc(int a, const int b) {
+	asm ("addc\t%1, %0\n" : "+r" (a) : "r" (b));
+	return a;
+}
+
+#define verify_addc(a, b, res, n, z, v, c)  \
+{                                           \
+	int r;                              \
+	r = cris_addc((a), (b));            \
+	cris_tst_cc((n), (z), (v), (c));    \
+	if (r != (res))                     \
+		err();                      \
+}
+
+int main(void)
+{
+	cris_tst_cc_init();
+	asm volatile ("clearf cz");
+	verify_addc(0, 0, 0, 0, 0, 0, 0);
+
+	cris_tst_cc_init();
+	asm volatile ("setf z");
+	verify_addc(0, 0, 0, 0, 1, 0, 0);
+
+	cris_tst_cc_init();
+	asm volatile ("setf cz");
+	verify_addc(0, 0, 1, 0, 0, 0, 0);
+	cris_tst_cc_init();
+	asm volatile ("clearf c");
+	verify_addc(-1, 2, 1, 0, 0, 0, 1);
+
+	cris_tst_cc_init();
+	asm volatile ("clearf nzv");
+	asm volatile ("setf c");
+	verify_addc(-1, 2, 2, 0, 0, 0, 1);
+
+	cris_tst_cc_init();
+	asm volatile ("setf c");
+	verify_addc(0xffff, 0xffff, 0x1ffff, 0, 0, 0, 0);
+
+	cris_tst_cc_init();
+	asm volatile ("clearf nzvc");
+	verify_addc(-1, -1, 0xfffffffe, 1, 0, 0, 1);
+
+	cris_tst_cc_init();
+	asm volatile ("setf c");
+	verify_addc(0x78134452, 0x5432f789, 0xcc463bdc, 1, 0, 1, 0);
+
+	pass();
+	return 0;
+}
diff --git a/tests/cris/check_addcm.c b/tests/cris/check_addcm.c
new file mode 100644
index 000000000..9ffea29bd
--- /dev/null
+++ b/tests/cris/check_addcm.c
@@ -0,0 +1,83 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+#include "crisutils.h"
+
+/* need to avoid acr as source here.  */
+extern inline int cris_addc_m(int a, const int *b) {
+	asm volatile ("addc [%1], %0\n" : "+r" (a) : "r" (b));
+	return a;
+}
+
+/* 'b' is a crisv32 constrain to avoid postinc with $acr.  */
+extern inline int cris_addc_pi_m(int a, int **b) {
+	asm volatile ("addc [%1+], %0\n" : "+r" (a), "+b" (*b));
+	return a;
+}
+
+#define verify_addc_m(a, b, res, n, z, v, c)  \
+{                                           \
+	int r;                              \
+	r = cris_addc_m((a), (b));            \
+	cris_tst_cc((n), (z), (v), (c));    \
+	if (r != (res))                     \
+		err();                      \
+}
+
+#define verify_addc_pi_m(a, b, res, n, z, v, c)  \
+{                                           \
+	int r;                              \
+	r = cris_addc_pi_m((a), (b));            \
+	cris_tst_cc((n), (z), (v), (c));    \
+	if (r != (res))                     \
+		err();                      \
+}
+
+int x[] = { 0, 0, 2, -1, 0xffff, -1, 0x5432f789};
+
+int main(void)
+{
+	int *p = (void *)&x[0];
+#if 1
+	cris_tst_cc_init();
+	asm volatile ("clearf cz");
+	verify_addc_m(0, p, 0, 0, 0, 0, 0);
+
+	cris_tst_cc_init();
+	asm volatile ("setf z");
+	verify_addc_m(0, p, 0, 0, 1, 0, 0);
+
+	cris_tst_cc_init();
+	asm volatile ("setf c");
+	verify_addc_m(0, p, 1, 0, 0, 0, 0);
+
+	cris_tst_cc_init();
+	asm volatile ("clearf c");
+	verify_addc_pi_m(0, &p, 0, 0, 1, 0, 0);
+
+	p = &x[1];
+	cris_tst_cc_init();
+	asm volatile ("setf c");
+	verify_addc_pi_m(0, &p, 1, 0, 0, 0, 0);
+
+	if (p != &x[2])
+		err();
+
+	cris_tst_cc_init();
+	asm volatile ("clearf c");
+	verify_addc_pi_m(-1, &p, 1, 0, 0, 0, 1);
+
+	if (p != &x[3])
+		err();
+#endif
+	p = &x[3];
+	/* TODO: investigate why this one fails.  */
+	cris_tst_cc_init();
+	asm volatile ("setf c");
+	verify_addc_m(2, p, 2, 0, 0, 0, 1);
+	p += 4;
+
+	pass();
+	return 0;
+}
diff --git a/tests/cris/check_addi.s b/tests/cris/check_addi.s
new file mode 100644
index 000000000..a00dec02a
--- /dev/null
+++ b/tests/cris/check_addi.s
@@ -0,0 +1,57 @@
+# mach:  crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 0\n1\n2\n4\nbe02460f\n69d035a6\nc16c14d4\n
+
+ .include "testutils.inc"
+ start
+ moveq 0,r3
+ moveq 0,r4
+ clearf zcvn
+ addi r4.b,r3
+ test_cc 0 0 0 0
+ checkr3 0
+
+ moveq 0,r3
+ moveq 1,r4
+ setf zcvn
+ addi r4.b,r3
+ test_cc 1 1 1 1
+ checkr3 1
+
+ moveq 0,r3
+ moveq 1,r4
+ setf cv
+ clearf zn
+ addi r4.w,r3
+ test_cc 0 0 1 1
+ checkr3 2
+
+ moveq 0,r3
+ moveq 1,r4
+ clearf cv
+ setf zn
+ addi r4.d,r3
+ test_cc 1 1 0 0
+ checkr3 4
+
+ move.d 0x12345678,r3
+ move.d 0xabcdef97,r4
+ clearf cn
+ setf zv
+ addi r4.b,r3
+ test_cc 0 1 1 0
+ checkr3 be02460f
+
+ move.d 0x12345678,r3
+ move.d 0xabcdef97,r4
+ setf cn
+ clearf zv
+ addi r4.w,r3
+ test_cc 1 0 0 1
+ checkr3 69d035a6
+
+ move.d 0x12345678,r3
+ move.d 0xabcdef97,r4
+ addi r4.d,r3
+ checkr3 c16c14d4
+
+ quit
diff --git a/tests/cris/check_addiv32.s b/tests/cris/check_addiv32.s
new file mode 100644
index 000000000..20ba25d21
--- /dev/null
+++ b/tests/cris/check_addiv32.s
@@ -0,0 +1,62 @@
+# mach: crisv32
+# output: 4455aa77\n4455aa77\nee19ccff\nff22\n4455aa77\nff224455\n55aa77ff\n
+
+ .include "testutils.inc"
+ .data
+x:
+ .dword 0x55aa77ff
+ .dword 0xccff2244
+ .dword 0x88ccee19
+
+ start
+ setf cv
+ moveq -1,r0
+ move.d x-32768,r5
+ move.d 32769,r6
+ addi r6.b,r5,acr
+ test_cc 0 0 1 1
+ move.d [acr],r3
+ checkr3 4455aa77
+
+ addu.w 32771,r5
+ setf znvc
+ moveq -1,r8
+ addi r8.w,r5,acr
+ test_cc 1 1 1 1
+ move.d [acr],r3
+ checkr3 4455aa77
+
+ moveq 5,r10
+ clearf znvc
+ addi r10.b,acr,acr
+ test_cc 0 0 0 0
+ move.d [acr],r3
+ checkr3 ee19ccff
+
+ subq 1,r5
+ move.d r5,r8
+ subq 1,r8
+ moveq 1,r9
+ addi r9.d,r8,acr
+ test_cc 0 0 0 0
+ movu.w [acr],r3
+ checkr3 ff22
+
+ moveq -2,r11
+ addi r11.w,acr,acr
+ move.d [acr],r3
+ checkr3 4455aa77
+
+ moveq 5,r9
+ addi r9.d,acr,acr
+ subq 18,acr
+ move.d [acr],r3
+ checkr3 ff224455
+
+ move.d -76789888/4,r12
+ addi r12.d,r5,acr
+ add.d 76789886,acr
+ move.d [acr],r3
+ checkr3 55aa77ff
+
+ quit
diff --git a/tests/cris/check_addm.s b/tests/cris/check_addm.s
new file mode 100644
index 000000000..efece9f53
--- /dev/null
+++ b/tests/cris/check_addm.s
@@ -0,0 +1,96 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 1\n1\n1fffe\nfffffffe\ncc463bdb\nffff0001\n1\nfffe\nfedafffe\n78133bdb\nffffff01\n1\nfe\nfeda49fe\n781344db\n781344d0\n
+
+ .include "testutils.inc"
+ .data
+x:
+ .dword 2,-1,0xffff,-1,0x5432f789
+ .word 2,-1,0xffff,0xf789
+ .byte 2,0xff,0x89
+ .byte 0x7e
+
+ start
+ moveq -1,r3
+ move.d x,r5
+ add.d [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ moveq 2,r3
+ add.d [r5],r3
+ test_cc 0 0 0 1
+ addq 4,r5
+ checkr3 1
+
+ move.d 0xffff,r3
+ add.d [r5+],r3
+ test_cc 0 0 0 0
+ checkr3 1fffe
+
+ moveq -1,r3
+ add.d [r5+],r3
+ test_cc 1 0 0 1
+ checkr3 fffffffe
+
+ move.d 0x78134452,r3
+ add.d [r5+],r3
+ test_cc 1 0 1 0
+ checkr3 cc463bdb
+
+ moveq -1,r3
+ add.w [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 ffff0001
+
+ moveq 2,r3
+ add.w [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ move.d 0xffff,r3
+ add.w [r5],r3
+ test_cc 1 0 0 1
+ checkr3 fffe
+
+ move.d 0xfedaffff,r3
+ add.w [r5+],r3
+ test_cc 1 0 0 1
+ checkr3 fedafffe
+
+ move.d 0x78134452,r3
+ add.w [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 78133bdb
+
+ moveq -1,r3
+ add.b [r5],r3
+ test_cc 0 0 0 1
+ addq 1,r5
+ checkr3 ffffff01
+
+ moveq 2,r3
+ add.b [r5],r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ move.d 0xff,r3
+ add.b [r5],r3
+ test_cc 1 0 0 1
+ checkr3 fe
+
+ move.d 0xfeda49ff,r3
+ add.b [r5+],r3
+ test_cc 1 0 0 1
+ checkr3 feda49fe
+
+ move.d 0x78134452,r3
+ add.b [r5+],r3
+ test_cc 1 0 0 0
+ checkr3 781344db
+
+ move.d 0x78134452,r3
+ add.b [r5],r3
+ test_cc 1 0 1 0
+ checkr3 781344d0
+
+ quit
diff --git a/tests/cris/check_addo.c b/tests/cris/check_addo.c
new file mode 100644
index 000000000..8a0565a1a
--- /dev/null
+++ b/tests/cris/check_addo.c
@@ -0,0 +1,125 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+#include "crisutils.h"
+
+/* this would be better to do in asm, it's an orgy in GCC inline asm now.  */
+
+#define cris_addo_b(o, v) \
+	asm volatile ("addo.b\t[%0], %1, $acr\n" : : "r" (o), "r" (v) : "acr");
+#define cris_addo_w(o, v) \
+	asm volatile ("addo.w\t[%0], %1, $acr\n" : : "r" (o), "r" (v) : "acr");
+#define cris_addo_d(o, v) \
+	asm volatile ("addo.d\t[%0], %1, $acr\n" : : "r" (o), "r" (v) : "acr");
+#define cris_addo_pi_b(o, v) \
+	asm volatile ("addo.b\t[%0+], %1, $acr\n" \
+                         : "+b" (o): "r" (v) : "acr");
+#define cris_addo_pi_w(o, v) \
+	asm volatile ("addo.w\t[%0+], %1, $acr\n" \
+                         : "+b" (o): "r" (v) : "acr");
+#define cris_addo_pi_d(o, v) \
+	asm volatile ("addo.d\t[%0+], %1, $acr\n" \
+                         : "+b" (o): "r" (v) : "acr");
+
+struct {
+	uint32_t v1;
+	uint16_t v2;
+	uint32_t v3;
+	uint8_t v4;
+	uint8_t v5;
+	uint16_t v6;
+	uint32_t v7;
+} y = {
+	32769,
+	-1,
+	5,
+	3, -4,
+	2,
+	-76789887
+};
+
+static int x[3] = {0x55aa77ff, 0xccff2244, 0x88ccee19};
+
+int main(void)
+{
+	int *r;
+	unsigned char *t, *p;
+
+	/* Note, this test-case will trig an unaligned access, partly
+	   to x[0] and to [x1].  */
+	t = (unsigned char *)x;
+	t -= 32768;
+	p = (unsigned char *) &y.v1;
+	mb(); /* dont reorder anything beyond here.  */
+	cris_tst_cc_init();
+	asm volatile ("setf\tzvnc\n");
+	cris_addo_pi_d(p, t);
+	cris_tst_cc(1, 1, 1, 1);
+	asm volatile ("move.d\t$acr, %0\n" : "=r" (r));
+	if (*r != 0x4455aa77)
+		err();
+
+
+	t += 32770;
+	mb(); /* dont reorder anything beyond here.  */
+	cris_tst_cc_init();
+	asm volatile ("setf\tzvnc\n");
+	cris_addo_pi_w(p, t);
+	cris_tst_cc(1, 1, 1, 1);
+	asm volatile ("move.d\t$acr, %0\n" : "=r" (r));
+	if (*r != 0x4455aa77)
+		err();
+
+	mb(); /* dont reorder anything beyond here.  */
+	cris_tst_cc_init();
+	asm volatile ("setf\tzvnc\n");
+	cris_addo_d(p, r);
+	cris_tst_cc(1, 1, 1, 1);
+	p += 4;
+	asm volatile ("move.d\t$acr, %0\n" : "=r" (r));
+	if (*r != 0xee19ccff)
+		err();
+
+	mb(); /* dont reorder anything beyond here.  */
+	cris_tst_cc_init();
+	asm volatile ("setf\tzvnc\n");
+	cris_addo_pi_b(p, t);
+	cris_tst_cc(1, 1, 1, 1);
+	asm volatile ("move.d\t$acr, %0\n" : "=r" (r));
+	if (*(uint16_t*)r != 0xff22)
+		err();
+
+	mb(); /* dont reorder anything beyond here.  */
+	cris_tst_cc_init();
+	asm volatile ("setf\tzvnc\n");
+	cris_addo_b(p, r);
+	cris_tst_cc(1, 1, 1, 1);
+	p += 1;
+	asm volatile ("move.d\t$acr, %0\n" : "=r" (r));
+	if (*r != 0x4455aa77)
+		err();
+
+	mb(); /* dont reorder anything beyond here.  */
+	cris_tst_cc_init();
+	asm volatile ("setf\tzvnc\n");
+	cris_addo_w(p, r);
+	cris_tst_cc(1, 1, 1, 1);
+	p += 2;
+	asm volatile ("move.d\t$acr, %0\n" : "=r" (r));
+	if (*r != 0xff224455)
+		err();
+
+	mb(); /* dont reorder anything beyond here.  */
+	cris_tst_cc_init();
+	asm volatile ("setf\tzvnc\n");
+	cris_addo_pi_d(p, t);
+	cris_tst_cc(1, 1, 1, 1);
+	asm volatile ("move.d\t$acr, %0\n" : "=r" (r));
+	r = (void*)(((char *)r) + 76789885);
+	if (*r != 0x55aa77ff)
+		err();
+
+	pass();
+	return 0;
+}
diff --git a/tests/cris/check_addoq.c b/tests/cris/check_addoq.c
new file mode 100644
index 000000000..b8b15c309
--- /dev/null
+++ b/tests/cris/check_addoq.c
@@ -0,0 +1,44 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+#include "crisutils.h"
+
+/* this would be better to do in asm, it's an orgy in GCC inline asm now.  */
+
+/* ACR will be clobbered.  */
+#define cris_addoq(o, v) \
+	asm volatile ("addoq\t%1, %0, $acr\n" : : "r" (v), "i" (o) : "acr");
+
+
+int main(void)
+{
+	int x[3] = {0x55aa77ff, 0xccff2244, 0x88ccee19};
+	int *p, *t = x + 1;
+
+	cris_tst_cc_init();
+	asm volatile ("setf\tzvnc\n");
+	cris_addoq(0, t);
+	cris_tst_cc(1, 1, 1, 1);
+	asm volatile ("move.d\t$acr, %0\n" : "=r" (p));
+	if (*p != 0xccff2244)
+		err();
+
+	cris_tst_cc_init();
+	asm volatile ("setf\tzvnc\n");
+	cris_addoq(4, t);
+	cris_tst_cc(1, 1, 1, 1);
+	asm volatile ("move.d\t$acr, %0\n" : "=r" (p));
+	if (*p != 0x88ccee19)
+		err();
+
+	cris_tst_cc_init();
+	asm volatile ("clearf\tzvnc\n");
+	cris_addoq(-8, t + 1);
+	cris_tst_cc(0, 0, 0, 0);
+	asm volatile ("move.d\t$acr, %0\n" : "=r" (p));
+	if (*p != 0x55aa77ff)
+		err();
+	pass();
+	return 0;
+}
diff --git a/tests/cris/check_addq.s b/tests/cris/check_addq.s
new file mode 100644
index 000000000..e6f874f9b
--- /dev/null
+++ b/tests/cris/check_addq.s
@@ -0,0 +1,47 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: ffffffff\n0\n1\n100\n10000\n47\n67\na6\n80000001\n
+
+ .include "testutils.inc"
+ start
+ moveq -2,r3
+ addq 1,r3
+ test_cc 1 0 0 0
+ checkr3 ffffffff
+
+ addq 1,r3
+ test_cc 0 1 0 1
+ checkr3 0
+
+ addq 1,r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ move.d 0xff,r3
+ addq 1,r3
+ test_cc 0 0 0 0
+ checkr3 100
+
+ move.d 0xffff,r3
+ addq 1,r3
+ test_cc 0 0 0 0
+ checkr3 10000
+
+ move.d 0x42,r3
+ addq 5,r3
+ test_cc 0 0 0 0
+ checkr3 47
+
+ addq 32,r3
+ test_cc 0 0 0 0
+ checkr3 67
+
+ addq 63,r3
+ test_cc 0 0 0 0
+ checkr3 a6
+
+ move.d 0x7ffffffe,r3
+ addq 3,r3
+ test_cc 1 0 1 0
+ checkr3 80000001
+
+ quit
diff --git a/tests/cris/check_addr.s b/tests/cris/check_addr.s
new file mode 100644
index 000000000..7f55cdc1b
--- /dev/null
+++ b/tests/cris/check_addr.s
@@ -0,0 +1,96 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 1\n1\n1fffe\nfffffffe\ncc463bdb\nffff0001\n1\nfffe\nfedafffe\n78133bdb\nffffff01\n1\nfe\nfeda49fe\n781344db\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ moveq 2,r4
+ add.d r4,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ moveq 2,r3
+ moveq -1,r4
+ add.d r4,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ add.d r4,r3
+ test_cc 0 0 0 0
+ checkr3 1fffe
+
+ moveq -1,r4
+ move.d r4,r3
+ add.d r4,r3
+ test_cc 1 0 0 1
+ checkr3 fffffffe
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ add.d r4,r3
+ test_cc 1 0 1 0
+ checkr3 cc463bdb
+
+ moveq -1,r3
+ moveq 2,r4
+ add.w r4,r3
+ test_cc 0 0 0 1
+ checkr3 ffff0001
+
+ moveq 2,r3
+ moveq -1,r4
+ add.w r4,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ add.w r4,r3
+ test_cc 1 0 0 1
+ checkr3 fffe
+
+ move.d 0xfedaffff,r4
+ move.d r4,r3
+ add.w r4,r3
+ test_cc 1 0 0 1
+ checkr3 fedafffe
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ add.w r4,r3
+ test_cc 0 0 0 1
+ checkr3 78133bdb
+
+ moveq -1,r3
+ moveq 2,r4
+ add.b r4,r3
+ test_cc 0 0 0 1
+ checkr3 ffffff01
+
+ moveq 2,r3
+ moveq -1,r4
+ add.b r4,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ move.d 0xff,r4
+ move.d r4,r3
+ add.b r4,r3
+ test_cc 1 0 0 1
+ checkr3 fe
+
+ move.d 0xfeda49ff,r4
+ move.d r4,r3
+ add.b r4,r3
+ test_cc 1 0 0 1
+ checkr3 feda49fe
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ add.b r4,r3
+ test_cc 1 0 0 0
+ checkr3 781344db
+
+ quit
diff --git a/tests/cris/check_addxc.s b/tests/cris/check_addxc.s
new file mode 100644
index 000000000..09c8355bf
--- /dev/null
+++ b/tests/cris/check_addxc.s
@@ -0,0 +1,91 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 1\n1\n101\n10001\n100fe\n1fffe\nfffe\nfffe\nfffffffe\nfe\nfffffffe\n781344db\n781343db\n78143bdb\n78133bdb\n800000ed\n0\n
+
+ .include "testutils.inc"
+ start
+ moveq 2,r3
+ adds.b 0xff,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ moveq 2,r3
+ adds.w 0xffff,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ moveq 2,r3
+ addu.b 0xff,r3
+ checkr3 101
+
+ moveq 2,r3
+ move.d 0xffffffff,r4
+ addu.w -1,r3
+ test_cc 0 0 0 0
+ checkr3 10001
+
+ move.d 0xffff,r3
+ addu.b -1,r3
+ test_cc 0 0 0 0
+ checkr3 100fe
+
+ move.d 0xffff,r3
+ addu.w -1,r3
+ test_cc 0 0 0 0
+ checkr3 1fffe
+
+ move.d 0xffff,r3
+ adds.b 0xff,r3
+ test_cc 0 0 0 1
+ checkr3 fffe
+
+ move.d 0xffff,r3
+ adds.w 0xffff,r3
+ test_cc 0 0 0 1
+ checkr3 fffe
+
+ moveq -1,r3
+ adds.b 0xff,r3
+ test_cc 1 0 0 1
+ checkr3 fffffffe
+
+ moveq -1,r3
+ adds.w 0xff,r3
+ test_cc 0 0 0 1
+ checkr3 fe
+
+ moveq -1,r3
+ adds.w 0xffff,r3
+ test_cc 1 0 0 1
+ checkr3 fffffffe
+
+ move.d 0x78134452,r3
+ addu.b 0x89,r3
+ test_cc 0 0 0 0
+ checkr3 781344db
+
+ move.d 0x78134452,r3
+ adds.b 0x89,r3
+ test_cc 0 0 0 1
+ checkr3 781343db
+
+ move.d 0x78134452,r3
+ addu.w 0xf789,r3
+ test_cc 0 0 0 0
+ checkr3 78143bdb
+
+ move.d 0x78134452,r3
+ adds.w 0xf789,r3
+ test_cc 0 0 0 1
+ checkr3 78133bdb
+
+ move.d 0x7fffffee,r3
+ addu.b 0xff,r3
+ test_cc 1 0 1 0
+ checkr3 800000ed
+
+ move.d 0x1,r3
+ adds.w 0xffff,r3
+ test_cc 0 1 0 1
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_addxm.s b/tests/cris/check_addxm.s
new file mode 100644
index 000000000..7563494b9
--- /dev/null
+++ b/tests/cris/check_addxm.s
@@ -0,0 +1,106 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 1\n1\n101\n10001\n100fe\n1fffe\nfffe\nfffe\nfffffffe\nfe\nfffffffe\n781344db\n781343db\n78143bdb\n78133bdb\n800000ed\n0\n
+
+ .include "testutils.inc"
+ .data
+x:
+ .byte 0xff
+ .word 0xffff
+ .word 0xff
+ .word 0xffff
+ .byte 0x89
+ .word 0xf789
+ .byte 0xff
+ .word 0xffff
+
+ start
+ moveq 2,r3
+ move.d x,r5
+ adds.b [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ moveq 2,r3
+ adds.w [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ moveq 2,r3
+ subq 3,r5
+ addu.b [r5+],r3
+ test_cc 0 0 0 0
+ checkr3 101
+
+ moveq 2,r3
+ addu.w [r5+],r3
+ subq 3,r5
+ test_cc 0 0 0 0
+ checkr3 10001
+
+ move.d 0xffff,r3
+ addu.b [r5],r3
+ test_cc 0 0 0 0
+ checkr3 100fe
+
+ move.d 0xffff,r3
+ addu.w [r5],r3
+ test_cc 0 0 0 0
+ checkr3 1fffe
+
+ move.d 0xffff,r3
+ adds.b [r5],r3
+ test_cc 0 0 0 1
+ checkr3 fffe
+
+ move.d 0xffff,r3
+ adds.w [r5],r3
+ test_cc 0 0 0 1
+ checkr3 fffe
+
+ moveq -1,r3
+ adds.b [r5],r3
+ test_cc 1 0 0 1
+ addq 3,r5
+ checkr3 fffffffe
+
+ moveq -1,r3
+ adds.w [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 fe
+
+ moveq -1,r3
+ adds.w [r5+],r3
+ test_cc 1 0 0 1
+ checkr3 fffffffe
+
+ move.d 0x78134452,r3
+ addu.b [r5],r3
+ test_cc 0 0 0 0
+ checkr3 781344db
+
+ move.d 0x78134452,r3
+ adds.b [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 781343db
+
+ move.d 0x78134452,r3
+ addu.w [r5],r3
+ test_cc 0 0 0 0
+ checkr3 78143bdb
+
+ move.d 0x78134452,r3
+ adds.w [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 78133bdb
+
+ move.d 0x7fffffee,r3
+ addu.b [r5+],r3
+ test_cc 1 0 1 0
+ checkr3 800000ed
+
+ move.d 0x1,r3
+ adds.w [r5+],r3
+ test_cc 0 1 0 1
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_addxr.s b/tests/cris/check_addxr.s
new file mode 100644
index 000000000..7f55cdc1b
--- /dev/null
+++ b/tests/cris/check_addxr.s
@@ -0,0 +1,96 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 1\n1\n1fffe\nfffffffe\ncc463bdb\nffff0001\n1\nfffe\nfedafffe\n78133bdb\nffffff01\n1\nfe\nfeda49fe\n781344db\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ moveq 2,r4
+ add.d r4,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ moveq 2,r3
+ moveq -1,r4
+ add.d r4,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ add.d r4,r3
+ test_cc 0 0 0 0
+ checkr3 1fffe
+
+ moveq -1,r4
+ move.d r4,r3
+ add.d r4,r3
+ test_cc 1 0 0 1
+ checkr3 fffffffe
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ add.d r4,r3
+ test_cc 1 0 1 0
+ checkr3 cc463bdb
+
+ moveq -1,r3
+ moveq 2,r4
+ add.w r4,r3
+ test_cc 0 0 0 1
+ checkr3 ffff0001
+
+ moveq 2,r3
+ moveq -1,r4
+ add.w r4,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ add.w r4,r3
+ test_cc 1 0 0 1
+ checkr3 fffe
+
+ move.d 0xfedaffff,r4
+ move.d r4,r3
+ add.w r4,r3
+ test_cc 1 0 0 1
+ checkr3 fedafffe
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ add.w r4,r3
+ test_cc 0 0 0 1
+ checkr3 78133bdb
+
+ moveq -1,r3
+ moveq 2,r4
+ add.b r4,r3
+ test_cc 0 0 0 1
+ checkr3 ffffff01
+
+ moveq 2,r3
+ moveq -1,r4
+ add.b r4,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ move.d 0xff,r4
+ move.d r4,r3
+ add.b r4,r3
+ test_cc 1 0 0 1
+ checkr3 fe
+
+ move.d 0xfeda49ff,r4
+ move.d r4,r3
+ add.b r4,r3
+ test_cc 1 0 0 1
+ checkr3 feda49fe
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ add.b r4,r3
+ test_cc 1 0 0 0
+ checkr3 781344db
+
+ quit
diff --git a/tests/cris/check_andc.s b/tests/cris/check_andc.s
new file mode 100644
index 000000000..a947b773c
--- /dev/null
+++ b/tests/cris/check_andc.s
@@ -0,0 +1,80 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 2\n2\nffff\nffffffff\n50124400\nffff0002\n2\nfffff\nfedaff0f\n78134400\nffffff02\n2\nf02\n78134401\n78134400\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ and.d 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq 2,r3
+ and.d -1,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r3
+ and.d 0xffff,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ moveq -1,r3
+ and.d -1,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x78134452,r3
+ and.d 0x5432f789,r3
+ test_move_cc 0 0 0 0
+ checkr3 50124400
+
+ moveq -1,r3
+ and.w 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff0002
+
+ moveq 2,r3
+ and.w -1,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xfffff,r3
+ and.w 0xffff,r3
+ test_move_cc 1 0 0 0
+ checkr3 fffff
+
+ move.d 0xfedaffaf,r3
+ and.w 0xff5f,r3
+ test_move_cc 1 0 0 0
+ checkr3 fedaff0f
+
+ move.d 0x78134452,r3
+ and.w 0xf789,r3
+ test_move_cc 0 0 0 0
+ checkr3 78134400
+
+ moveq -1,r3
+ and.b 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffffff02
+
+ moveq 2,r3
+ and.b -1,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xfa7,r3
+ and.b 0x5a,r3
+ test_move_cc 0 0 0 0
+ checkr3 f02
+
+ move.d 0x78134453,r3
+ and.b 0x89,r3
+ test_move_cc 0 0 0 0
+ checkr3 78134401
+
+ and.b 0,r3
+ test_move_cc 0 1 0 0
+ checkr3 78134400
+
+ quit
diff --git a/tests/cris/check_andm.s b/tests/cris/check_andm.s
new file mode 100644
index 000000000..93858863f
--- /dev/null
+++ b/tests/cris/check_andm.s
@@ -0,0 +1,90 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 2\n2\nffff\nffffffff\n50124400\nffff0002\n2\nfffff\nfedaff0f\n78134400\nffffff02\n2\nf02\n78134401\n78134400\n
+
+ .include "testutils.inc"
+ .data
+x:
+ .dword 2,-1,0xffff,-1,0x5432f789
+ .word 2,-1,0xffff,0xff5f,0xf789
+ .byte 2,-1,0x5a,0x89,0
+
+ start
+ moveq -1,r3
+ move.d x,r5
+ and.d [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq 2,r3
+ and.d [r5],r3
+ test_move_cc 0 0 0 0
+ addq 4,r5
+ checkr3 2
+
+ move.d 0xffff,r3
+ and.d [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ moveq -1,r3
+ and.d [r5+],r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x78134452,r3
+ and.d [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 50124400
+
+ moveq -1,r3
+ and.w [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff0002
+
+ moveq 2,r3
+ and.w [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xfffff,r3
+ and.w [r5],r3
+ test_move_cc 1 0 0 0
+ addq 2,r5
+ checkr3 fffff
+
+ move.d 0xfedaffaf,r3
+ and.w [r5+],r3
+ test_move_cc 1 0 0 0
+ checkr3 fedaff0f
+
+ move.d 0x78134452,r3
+ and.w [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 78134400
+
+ moveq -1,r3
+ and.b [r5],r3
+ test_move_cc 0 0 0 0
+ addq 1,r5
+ checkr3 ffffff02
+
+ moveq 2,r3
+ and.b [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xfa7,r3
+ and.b [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 f02
+
+ move.d 0x78134453,r3
+ and.b [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 78134401
+
+ and.b [r5],r3
+ test_move_cc 0 1 0 0
+ checkr3 78134400
+
+ quit
diff --git a/tests/cris/check_andq.s b/tests/cris/check_andq.s
new file mode 100644
index 000000000..55aa7b060
--- /dev/null
+++ b/tests/cris/check_andq.s
@@ -0,0 +1,46 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 2\n2\nffff\nffffffff\n1f\nffffffe0\n78134452\n0\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ andq 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq 2,r3
+ andq -1,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r3
+ andq -1,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ moveq -1,r3
+ andq -1,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ andq 31,r3
+ test_move_cc 0 0 0 0
+ checkr3 1f
+
+ moveq -1,r3
+ andq -32,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffe0
+
+ move.d 0x78134457,r3
+ andq -14,r3
+ test_move_cc 0 0 0 0
+ checkr3 78134452
+
+ moveq 0,r3
+ andq -14,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_andr.s b/tests/cris/check_andr.s
new file mode 100644
index 000000000..61aa1dc32
--- /dev/null
+++ b/tests/cris/check_andr.s
@@ -0,0 +1,95 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 2\n2\nffff\nffffffff\n50124400\nffff0002\n2\nfffff\nfedaff0f\n78134400\nffffff02\n2\nf02\n78134401\n78134400\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ moveq 2,r4
+ and.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq 2,r3
+ moveq -1,r4
+ and.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ and.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ moveq -1,r4
+ move.d r4,r3
+ and.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ and.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 50124400
+
+ moveq -1,r3
+ moveq 2,r4
+ and.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff0002
+
+ moveq 2,r3
+ moveq -1,r4
+ and.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xfffff,r3
+ move.d 0xffff,r4
+ and.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 fffff
+
+ move.d 0xfedaffaf,r3
+ move.d 0xff5f,r4
+ and.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 fedaff0f
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ and.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 78134400
+
+ moveq -1,r3
+ moveq 2,r4
+ and.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffffff02
+
+ moveq 2,r3
+ moveq -1,r4
+ and.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0x5a,r4
+ move.d 0xfa7,r3
+ and.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 f02
+
+ move.d 0x5432f789,r4
+ move.d 0x78134453,r3
+ and.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 78134401
+
+ moveq 0,r7
+ and.b r7,r3
+ test_move_cc 0 1 0 0
+ checkr3 78134400
+
+ quit
diff --git a/tests/cris/check_asr.s b/tests/cris/check_asr.s
new file mode 100644
index 000000000..0a02ae6f7
--- /dev/null
+++ b/tests/cris/check_asr.s
@@ -0,0 +1,230 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: ffffffff\n1\nffffffff\nffffffff\n5a67f\nffffffff\nffffffff\nffffffff\nf699fc67\nffffffff\n1\nffffffff\nffffffff\n5a67f\nda67ffff\nda67ffff\nda67ffff\nda67fc67\nffffffff\nffffffff\n1\nffffffff\nffffffff\n5a670007\nda67f1ff\nda67f1ff\nda67f1ff\nda67f1e7\nffffffff\nffffffff\n1\nffffffff\nffffffff\nffffffff\n5a67f1ff\n5a67f1f9\n0\n5a670000\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ asrq 0,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ asrq 1,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ moveq -1,r3
+ asrq 31,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ asrq 15,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x5a67f19f,r3
+ asrq 12,r3
+ test_move_cc 0 0 0 0
+ checkr3 5a67f
+
+ move.d 0xda67f19f,r3
+ move.d 31,r4
+ asr.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0xda67f19f,r3
+ move.d 32,r4
+ asr.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0xda67f19f,r3
+ move.d 33,r4
+ asr.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0xda67f19f,r3
+ move.d 66,r4
+ asr.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 f699fc67
+
+ moveq -1,r3
+ moveq 0,r4
+ asr.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq 1,r4
+ asr.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ moveq -1,r3
+ moveq 31,r4
+ asr.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 15,r4
+ asr.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x5a67f19f,r3
+ moveq 12,r4
+ asr.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 5a67f
+
+ move.d 0xda67f19f,r3
+ move.d 31,r4
+ asr.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 da67ffff
+
+ move.d 0xda67f19f,r3
+ move.d 32,r4
+ asr.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 da67ffff
+
+ move.d 0xda67f19f,r3
+ move.d 33,r4
+ asr.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 da67ffff
+
+ move.d 0xda67f19f,r3
+ move.d 66,r4
+ asr.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 da67fc67
+
+ moveq -1,r3
+ moveq 0,r4
+ asr.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 1,r4
+ asr.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq 1,r4
+ asr.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ moveq -1,r3
+ moveq 31,r4
+ asr.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 15,r4
+ asr.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x5a67719f,r3
+ moveq 12,r4
+ asr.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 5a670007
+
+ move.d 0xda67f19f,r3
+ move.d 31,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 da67f1ff
+
+ move.d 0xda67f19f,r3
+ move.d 32,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 da67f1ff
+
+ move.d 0xda67f19f,r3
+ move.d 33,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 da67f1ff
+
+ move.d 0xda67f19f,r3
+ move.d 66,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 da67f1e7
+
+ moveq -1,r3
+ moveq 0,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 1,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq 1,r4
+ asr.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ moveq -1,r3
+ moveq 31,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 15,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 7,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+; FIXME: was wrong.
+ move.d 0x5a67f19f,r3
+ moveq 12,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 5a67f1ff
+
+; FIXME: was wrong.
+ move.d 0x5a67f19f,r3
+ moveq 4,r4
+ asr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 5a67f1f9
+
+ move.d 0x5a67f19f,r3
+ asrq 31,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0x5a67419f,r3
+ moveq 16,r4
+ asr.w r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 5a670000
+
+ quit
diff --git a/tests/cris/check_ba.s b/tests/cris/check_ba.s
new file mode 100644
index 000000000..873a4086c
--- /dev/null
+++ b/tests/cris/check_ba.s
@@ -0,0 +1,93 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: a\n
+
+
+ .set smalloffset,0
+ .set largeoffset,0
+
+
+	.macro fail
+	jump _fail
+	.endm
+
+	.global	main
+main:
+ moveq 0,$r3
+
+; Short forward branch.
+ ba 0f
+ addq 1,$r3
+ fail
+
+; Max short forward branch.
+1:
+ ba 2f
+ addq 1,$r3
+ fail
+
+; Short backward branch.
+0:
+ ba 1b
+ addq 1,$r3
+ fail
+
+ .space 254-2+smalloffset+1b-.,0
+ moveq 0,$r3
+
+2:
+; Transit branch (long).
+ ba 3f
+ addq 1,$r3
+ fail
+
+ moveq 0,$r3
+4:
+; Long forward branch.
+ ba 5f
+ addq 1,$r3
+ fail
+
+ .space 256-2-smalloffset+4b-.,0
+
+ moveq 0,$r3
+
+; Max short backward branch.
+3:
+ ba 4b
+ addq 1,$r3
+ fail
+
+5:
+; Max long forward branch.
+ ba 6f
+ addq 1,$r3
+ fail
+
+ .space 32766+largeoffset-2+5b-.,0
+
+ moveq 0,$r3
+6:
+; Transit branch.
+ ba 7f
+ addq 1,$r3
+ fail
+
+ moveq 0,$r3
+9:
+ jsr pass
+ nop
+
+; Transit branch.
+ moveq 0,$r3
+7:
+ ba 8f
+ addq 1,$r3
+ fail
+
+ .space 32768-largeoffset+9b-.,0
+
+8:
+; Max long backward branch.
+ ba 9b
+ addq 1,$r3
+ fail
diff --git a/tests/cris/check_bas.s b/tests/cris/check_bas.s
new file mode 100644
index 000000000..11929d420
--- /dev/null
+++ b/tests/cris/check_bas.s
@@ -0,0 +1,102 @@
+# mach: crisv32
+# output: 0\n0\n0\nfb349abc\n0\n12124243\n0\n0\neab5baad\n0\nefb37832\n
+
+ .include "testutils.inc"
+ start
+x:
+ setf zncv
+ bsr 0f
+ nop
+0:
+ test_cc 1 1 1 1
+ move srp,r3
+ sub.d 0b,r3
+ checkr3 0
+
+ bas 1f,mof
+ moveq 0,r0
+6:
+ nop
+ quit
+
+2:
+ move srp,r3
+ sub.d 3f,r3
+ checkr3 0
+ move srp,r4
+ subq 4,r4
+ move.d [r4],r3
+ checkr3 fb349abc
+
+ basc 4f,mof
+ nop
+ .dword 0x12124243
+7:
+ nop
+ quit
+
+8:
+ move mof,r3
+ sub.d 7f,r3
+ checkr3 0
+
+ move mof,r4
+ subq 4,r4
+ move.d [r4],r3
+ checkr3 eab5baad
+
+ jasc 9f,mof
+ nop
+ .dword 0xefb37832
+0:
+ quit
+
+ quit
+9:
+ move mof,r3
+ sub.d 0b,r3
+ checkr3 0
+
+ move mof,r4
+ subq 4,r4
+ move.d [r4],r3
+ checkr3 efb37832
+
+ quit
+
+4:
+ move mof,r3
+ sub.d 7b,r3
+ checkr3 0
+ move mof,r4
+ subq 4,r4
+ move.d [r4],r3
+ checkr3 12124243
+ basc 5f,bz
+ moveq 0,r3
+ .dword 0x7634aeba
+ quit
+
+ .space 32770,0
+1:
+ move mof,r3
+ sub.d 6b,r3
+ checkr3 0
+
+ bsrc 2b
+ nop
+ .dword 0xfb349abc
+3:
+
+ quit
+
+5:
+ move mof,r3
+ sub.d 7b,r3
+ checkr3 0
+ move.d 8b,r6
+ jasc r6,mof
+ nop
+ .dword 0xeab5baad
+7:
+ quit
diff --git a/tests/cris/check_bcc.s b/tests/cris/check_bcc.s
new file mode 100644
index 000000000..c57ffa6fa
--- /dev/null
+++ b/tests/cris/check_bcc.s
@@ -0,0 +1,197 @@
+	.global	main
+	.type	main, @function
+main:
+	clearf nzvc
+	setf   nzv
+	bcc    0f
+	addq   1, $r3
+	jump   dofail
+
+0:
+	clearf nzvc
+	setf   nzv
+	bcs    dofail
+	addq   1,$r3
+
+	clearf nzvc
+	setf   ncv
+	bne    1f
+	addq   1, $r3
+
+fail:
+dofail:
+	jump	_fail
+
+1:
+	clearf nzvc
+	setf ncv
+	beq dofail
+	addq 1,$r3
+
+	clearf nzvc
+	setf ncz
+	bvc 2f
+	addq 1,$r3
+	jump dofail
+
+2:
+	clearf nzvc
+	setf ncz
+	bvs dofail
+	addq 1,$r3
+
+	clearf	nzvc
+	setf	vcz
+	bpl	3f
+	addq	1,$r3
+	jump	fail
+3:
+	clearf	nzvc
+	setf	vcz
+	bmi	dofail
+	addq	1,$r3
+
+	clearf	nzvc
+	setf	nv
+	bls	dofail
+	addq	1,$r3
+
+	clearf	nzvc
+	setf	nv
+	bhi	4f
+	addq	1,$r3
+	jump	dofail
+
+4:
+	clearf	nzvc
+	setf	zc
+	bge	5f
+	addq	1,$r3
+	jump	dofail
+
+5:
+	clearf	nzvc
+	setf zc
+	blt dofail
+	addq 1,$r3
+
+	clearf nzvc
+	setf c
+	bgt 6f
+	addq 1,$r3
+	jump  fail
+
+6:
+ clearf nzvc
+ setf c
+ ble dofail
+ addq 1,$r3
+
+;;;;;;;;;;
+
+ setf nzvc
+ clearf nzv
+ bcc dofail
+ addq 1,$r3
+
+ setf nzvc
+ clearf nzv
+ bcs 0f
+ addq 1,$r3
+ jump fail
+
+0:
+ setf nzvc
+ clearf ncv
+ bne dofail
+ addq 1,$r3
+
+ setf nzvc
+ clearf ncv
+ beq 1f
+ addq 1,$r3
+ jump fail
+
+1:
+ setf nzvc
+ clearf ncz
+ bvc dofail
+ addq 1,$r3
+
+ setf nzvc
+ clearf ncz
+ bvs 2f
+ addq 1,$r3
+ jump fail
+
+2:
+ setf nzvc
+ clearf vcz
+ bpl dofail
+ addq 1,$r3
+
+ setf nzvc
+ clearf vcz
+ bmi 3f
+ addq 1,$r3
+ jump fail
+
+3:
+ setf nzvc
+ clearf nv
+ bls 4f
+ addq 1,$r3
+ jump fail
+
+4:
+ setf nzvc
+ clearf nv
+ bhi dofail
+ addq 1,$r3
+
+ setf zvc
+ clearf nzc
+ bge dofail
+ addq 1,$r3
+
+ setf nzc
+ clearf vzc
+ blt 5f
+ addq 1,$r3
+ jump fail
+
+5:
+ setf nzvc
+ clearf c
+ bgt dofail
+ addq 1,$r3
+
+ setf nzvc
+ clearf c
+ ble 6f
+ addq 1,$r3
+ jump fail
+
+6:
+	; do a forward branch.
+	ba   2f
+	nop
+	.fill	100
+1:
+	ba	3f
+	nop
+	.fill	800
+2:
+	ba	1b
+	nop
+	.fill	1024
+3:
+
+	moveq	31, $r0
+1:	bne	1b
+	subq	1, $r0
+
+	jsr	pass
+	moveq	0, $r10
+	ret
+	nop
diff --git a/tests/cris/check_bound.c b/tests/cris/check_bound.c
new file mode 100644
index 000000000..411d2ad56
--- /dev/null
+++ b/tests/cris/check_bound.c
@@ -0,0 +1,139 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+#include "crisutils.h"
+
+extern inline int cris_bound_b(int v, int b) {
+	int r = v;
+	asm ("bound.b\t%1, %0\n" : "+r" (r) : "ri" (b));
+	return r;
+}
+
+extern inline int cris_bound_w(int v, int b) {
+	int r = v;
+	asm ("bound.w\t%1, %0\n" : "+r" (r) : "ri" (b));
+	return r;
+}
+
+extern inline int cris_bound_d(int v, int b) {
+	int r = v;
+	asm ("bound.d\t%1, %0\n" : "+r" (r) : "ri" (b));
+	return r;
+}
+
+int main(void)
+{
+	int r;
+
+	cris_tst_cc_init();
+	r = cris_bound_d(-1, 2);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 2)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_d(2, 0xffffffff);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 2)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_d(0xffff, 0xffff);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 0xffff)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_d(-1, 0xffffffff);
+	cris_tst_cc(1, 0, 0, 0);
+	if (r != 0xffffffff)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_d(0x78134452, 0x5432f789);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 0x5432f789)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_w(-1, 2);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 2)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_w(-1, 0xffff);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 0xffff)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_w(2, 0xffff);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 2)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_w(0xfedaffff, 0xffff);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 0xffff)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_w(0x78134452, 0xf789);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 0xf789)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_b(-1, 2);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 2)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_b(2, 0xff);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 2)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_b(-1, 0xff);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 0xff)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_b(0xff, 0xff);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 0xff)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_b(0xfeda49ff, 0xff);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 0xff)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_b(0x78134452, 0x89);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 0x89)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_w(0x78134452, 0);
+	cris_tst_cc(0, 1, 0, 0);
+	if (r != 0)
+		err();
+
+	cris_tst_cc_init();
+	r = cris_bound_b(0xffff, -1);
+	cris_tst_cc(0, 0, 0, 0);
+	if (r != 0xff)
+		err();
+
+	pass();
+	return 0;
+}
diff --git a/tests/cris/check_boundc.s b/tests/cris/check_boundc.s
new file mode 100644
index 000000000..fb9e5bc90
--- /dev/null
+++ b/tests/cris/check_boundc.s
@@ -0,0 +1,101 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 2\n2\nffff\nffffffff\n5432f789\n2\nffff\n2\nffff\nffff\nf789\n2\n2\nff\nff\nff\n89\n0\nff\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ moveq 2,r4
+ bound.d 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq 2,r3
+ bound.d 0xffffffff,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r3
+ bound.d 0xffff,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ moveq -1,r3
+ bound.d 0xffffffff,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x78134452,r3
+ bound.d 0x5432f789,r3
+ test_move_cc 0 0 0 0
+ checkr3 5432f789
+
+ moveq -1,r3
+ bound.w 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq -1,r3
+ bound.w 0xffff,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ moveq 2,r3
+ bound.w 0xffff,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r3
+ bound.w 0xffff,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ move.d 0xfedaffff,r3
+ bound.w 0xffff,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ move.d 0x78134452,r3
+ bound.w 0xf789,r3
+ test_move_cc 0 0 0 0
+ checkr3 f789
+
+ moveq -1,r3
+ bound.b 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq 2,r3
+ bound.b 0xff,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq -1,r3
+ bound.b 0xff,r3
+ test_move_cc 0 0 0 0
+ checkr3 ff
+
+ move.d 0xff,r3
+ bound.b 0xff,r3
+ test_move_cc 0 0 0 0
+ checkr3 ff
+
+ move.d 0xfeda49ff,r3
+ bound.b 0xff,r3
+ test_move_cc 0 0 0 0
+ checkr3 ff
+
+ move.d 0x78134452,r3
+ bound.b 0x89,r3
+ test_move_cc 0 0 0 0
+ checkr3 89
+
+ bound.w 0,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0xffff,r3
+ bound.b -1,r3
+ test_move_cc 0 0 0 0
+ checkr3 ff
+
+ quit
diff --git a/tests/cris/check_boundr.s b/tests/cris/check_boundr.s
new file mode 100644
index 000000000..5c50cc5f6
--- /dev/null
+++ b/tests/cris/check_boundr.s
@@ -0,0 +1,125 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 2\n2\nffff\nffffffff\n5432f789\n2\n2\nffff\nffff\nffff\nf789\n2\n2\nff\nff\n89\nfeda4953\nfeda4962\n0\n0\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ moveq 2,r4
+ bound.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq 2,r3
+ moveq -1,r4
+ bound.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ bound.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ moveq -1,r4
+ move.d r4,r3
+ bound.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ bound.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 5432f789
+
+ moveq -1,r3
+ moveq 2,r4
+ bound.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq 2,r3
+ moveq -1,r4
+ bound.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq -1,r3
+ bound.w r3,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ bound.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ move.d 0xfedaffff,r4
+ move.d r4,r3
+ bound.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ bound.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 f789
+
+ moveq -1,r3
+ moveq 2,r4
+ bound.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ moveq 2,r3
+ moveq -1,r4
+ bound.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xff,r4
+ move.d r4,r3
+ bound.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ff
+
+ move.d 0xfeda49ff,r4
+ move.d r4,r3
+ bound.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ff
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ bound.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 89
+
+ move.d 0xfeda4956,r3
+ move.d 0xfeda4953,r4
+ bound.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 feda4953
+
+ move.d 0xfeda4962,r3
+ move.d 0xfeda4963,r4
+ bound.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 feda4962
+
+ move.d 0xfeda4956,r3
+ move.d 0,r4
+ bound.d r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0xfeda4956,r4
+ move.d 0,r3
+ bound.d r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_btst.s b/tests/cris/check_btst.s
new file mode 100644
index 000000000..741817731
--- /dev/null
+++ b/tests/cris/check_btst.s
@@ -0,0 +1,87 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 1111\n
+
+ .include "testutils.inc"
+ start
+ clearf nzvc
+ moveq -1,r3
+ .if 1 ;..asm.arch.cris.v32
+ .else
+ setf vc
+ .endif
+ btstq 0,r3
+ test_cc 1 0 0 0
+
+ moveq 2,r3
+ btstq 1,r3
+ test_cc 1 0 0 0
+
+ moveq 4,r3
+ btstq 1,r3
+ test_cc 0 1 0 0
+
+ moveq -1,r3
+ btstq 31,r3
+ test_cc 1 0 0 0
+
+ move.d 0x5a67f19f,r3
+ btstq 12,r3
+ test_cc 1 0 0 0
+
+ move.d 0xda67f19f,r3
+ move.d 29,r4
+ btst r4,r3
+ test_cc 0 0 0 0
+
+ move.d 0xda67f19f,r3
+ move.d 32,r4
+ btst r4,r3
+ test_cc 1 0 0 0
+
+ move.d 0xda67f191,r3
+ move.d 33,r4
+ btst r4,r3
+ test_cc 0 0 0 0
+
+ moveq -1,r3
+ moveq 0,r4
+ btst r4,r3
+ test_cc 1 0 0 0
+
+ moveq 2,r3
+ moveq 1,r4
+ btst r4,r3
+ test_cc 1 0 0 0
+
+ moveq -1,r3
+ moveq 31,r4
+ btst r4,r3
+ test_cc 1 0 0 0
+
+ moveq 4,r3
+ btstq 1,r3
+ test_cc 0 1 0 0
+
+ moveq -1,r3
+ moveq 15,r4
+ btst r4,r3
+ test_cc 1 0 0 0
+
+ move.d 0x5a67f19f,r3
+ moveq 12,r4
+ btst r4,r3
+ test_cc 1 0 0 0
+
+ move.d 0x5a678000,r3
+ moveq 11,r4
+ btst r4,r3
+ test_cc 0 1 0 0
+
+ move.d 0x5a67f19f,r3
+ btst r3,r3
+ test_cc 0 0 0 0
+
+ move.d 0x1111,r3
+ checkr3 1111
+
+ quit
diff --git a/tests/cris/check_clearfv32.s b/tests/cris/check_clearfv32.s
new file mode 100644
index 000000000..db700728a
--- /dev/null
+++ b/tests/cris/check_clearfv32.s
@@ -0,0 +1,17 @@
+# mach: crisv32
+# output: ef\nef\n
+
+; Check that "clearf x" doesn't trivially fail.
+
+ .include "testutils.inc"
+ start
+ setf puixnzvc
+ clearf x	; Actually, x would be cleared by almost-all other insns.
+ move ccs,r3
+ checkr3 ef
+
+ setf puixnzvc
+ moveq 0, $r3	; moveq should only clear the xflag.
+ move ccs,r3
+ checkr3 ef
+ quit
diff --git a/tests/cris/check_clrjmp1.s b/tests/cris/check_clrjmp1.s
new file mode 100644
index 000000000..45a7005e2
--- /dev/null
+++ b/tests/cris/check_clrjmp1.s
@@ -0,0 +1,36 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: ffffff00\n
+
+; A bug resulting in a non-effectual clear.b discovered running the GCC
+; testsuite; jump actually wrote to p0.
+
+ .include "testutils.inc"
+
+ start
+ jump 1f
+ nop
+ .p2align 8
+1:
+ move.d y,r4
+
+ .if 0 ;0 == ..asm.arch.cris.v32
+; There was a bug causing this insn to set special register p0
+; (byte-clear) to 8 (low 8 bits of location after insn).
+ jump [r4+]
+ .endif
+
+1:
+ move.d 0f,r4
+
+; The corresponding bug would cause this insn too, to set p0.
+ jump r4
+ nop
+ quit
+0:
+ moveq -1,r3
+ clear.b r3
+ checkr3 ffffff00
+ quit
+
+y:
+ .dword 1b
diff --git a/tests/cris/check_cmp-2.s b/tests/cris/check_cmp-2.s
new file mode 100644
index 000000000..c5c3f5ce8
--- /dev/null
+++ b/tests/cris/check_cmp-2.s
@@ -0,0 +1,15 @@
+
+
+.include "testutils.inc"
+
+	start
+
+	move.d	4294967283, $r0
+	move.d	$r0, $r10
+	cmp.d	$r0, $r10
+	beq	1f
+	move.d $r10, $r3
+	fail
+1:
+	pass
+	quit
\ No newline at end of file
diff --git a/tests/cris/check_cmpc.s b/tests/cris/check_cmpc.s
new file mode 100644
index 000000000..267c9ba8c
--- /dev/null
+++ b/tests/cris/check_cmpc.s
@@ -0,0 +1,86 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: ffffffff\n2\nffff\nffffffff\n78134452\nffffffff\n2\nffff\nfedaffff\n78134452\nffffffff\n2\nff\nfeda49ff\n78134452\n85649282\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ cmp.d -2,r3
+ test_cc 0 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ cmp.d 1,r3
+ test_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r3
+ cmp.d -0xffff,r3
+ test_cc 0 0 0 1
+ checkr3 ffff
+
+ moveq -1,r3
+ cmp.d 1,r3
+ test_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x78134452,r3
+ cmp.d -0x5432f789,r3
+ test_cc 1 0 1 1
+ checkr3 78134452
+
+ moveq -1,r3
+ cmp.w -2,r3
+ test_cc 0 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ cmp.w 1,r3
+ test_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r3
+ cmp.w 1,r3
+ test_cc 1 0 0 0
+ checkr3 ffff
+
+ move.d 0xfedaffff,r3
+ cmp.w 1,r3
+ test_cc 1 0 0 0
+ checkr3 fedaffff
+
+ move.d 0x78134452,r3
+ cmp.w 0x877,r3
+ test_cc 0 0 0 0
+ checkr3 78134452
+
+ moveq -1,r3
+ cmp.b -2,r3
+ test_cc 0 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ cmp.b 1,r3
+ test_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xff,r3
+ cmp.b 1,r3
+ test_cc 1 0 0 0
+ checkr3 ff
+
+ move.d 0xfeda49ff,r3
+ cmp.b 1,r3
+ test_cc 1 0 0 0
+ checkr3 feda49ff
+
+ move.d 0x78134452,r3
+ cmp.b 0x77,r3
+ test_cc 1 0 0 1
+ checkr3 78134452
+
+ move.d 0x85649282,r3
+ cmp.b 0x82,r3
+ test_cc 0 1 0 0
+ checkr3 85649282
+
+ quit
diff --git a/tests/cris/check_cmpm.s b/tests/cris/check_cmpm.s
new file mode 100644
index 000000000..e4dde15b3
--- /dev/null
+++ b/tests/cris/check_cmpm.s
@@ -0,0 +1,96 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: ffffffff\n2\nffff\nffffffff\n78134452\nffffffff\n2\nffff\nfedaffff\n78134452\nffffffff\n2\nff\nfeda49ff\n78134452\n85649222\n
+
+ .include "testutils.inc"
+ .data
+x:
+ .dword -2,1,-0xffff,1,-0x5432f789
+ .word -2,1,1,0x877
+ .byte -2,1,0x77
+ .byte 0x22
+
+ start
+ moveq -1,r3
+ move.d x,r5
+ cmp.d [r5+],r3
+ test_cc 0 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ cmp.d [r5],r3
+ test_cc 0 0 0 0
+ addq 4,r5
+ checkr3 2
+
+ move.d 0xffff,r3
+ cmp.d [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 ffff
+
+ moveq -1,r3
+ cmp.d [r5+],r3
+ test_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x78134452,r3
+ cmp.d [r5+],r3
+ test_cc 1 0 1 1
+ checkr3 78134452
+
+ moveq -1,r3
+ cmp.w [r5+],r3
+ test_cc 0 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ cmp.w [r5+],r3
+ test_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r3
+ cmp.w [r5],r3
+ test_cc 1 0 0 0
+ checkr3 ffff
+
+ move.d 0xfedaffff,r3
+ cmp.w [r5+],r3
+ test_cc 1 0 0 0
+ checkr3 fedaffff
+
+ move.d 0x78134452,r3
+ cmp.w [r5+],r3
+ test_cc 0 0 0 0
+ checkr3 78134452
+
+ moveq -1,r3
+ cmp.b [r5],r3
+ test_cc 0 0 0 0
+ addq 1,r5
+ checkr3 ffffffff
+
+ moveq 2,r3
+ cmp.b [r5],r3
+ test_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xff,r3
+ cmp.b [r5],r3
+ test_cc 1 0 0 0
+ checkr3 ff
+
+ move.d 0xfeda49ff,r3
+ cmp.b [r5+],r3
+ test_cc 1 0 0 0
+ checkr3 feda49ff
+
+ move.d 0x78134452,r3
+ cmp.b [r5+],r3
+ test_cc 1 0 0 1
+ checkr3 78134452
+
+ move.d 0x85649222,r3
+ cmp.b [r5],r3
+ test_cc 0 1 0 0
+ checkr3 85649222
+
+ quit
diff --git a/tests/cris/check_cmpq.s b/tests/cris/check_cmpq.s
new file mode 100644
index 000000000..5469141c9
--- /dev/null
+++ b/tests/cris/check_cmpq.s
@@ -0,0 +1,75 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 1\n1\n1\n1f\n1f\nffffffe1\nffffffe1\nffffffe0\n0\n0\nffffffff\nffffffff\n10000\n100\n5678900\n
+
+ .include "testutils.inc"
+ start
+ moveq 1,r3
+ cmpq 1,r3
+ test_cc 0 1 0 0
+ checkr3 1
+
+ cmpq -1,r3
+ test_cc 0 0 0 1
+ checkr3 1
+
+ cmpq 31,r3
+ test_cc 1 0 0 1
+ checkr3 1
+
+ moveq 31,r3
+ cmpq 31,r3
+ test_cc 0 1 0 0
+ checkr3 1f
+
+ cmpq -31,r3
+ test_cc 0 0 0 1
+ checkr3 1f
+
+ movs.b -31,r3
+ cmpq -31,r3
+ test_cc 0 1 0 0
+ checkr3 ffffffe1
+
+ cmpq -32,r3
+ test_cc 0 0 0 0
+ checkr3 ffffffe1
+
+ movs.b -32,r3
+ cmpq -32,r3
+ test_cc 0 1 0 0
+ checkr3 ffffffe0
+
+ moveq 0,r3
+ cmpq 1,r3
+ test_cc 1 0 0 1
+ checkr3 0
+
+ cmpq -32,r3
+ test_cc 0 0 0 1
+ checkr3 0
+
+ moveq -1,r3
+ cmpq 1,r3
+ test_cc 1 0 0 0
+ checkr3 ffffffff
+
+ cmpq -1,r3
+ test_cc 0 1 0 0
+ checkr3 ffffffff
+
+ move.d 0x10000,r3
+ cmpq 1,r3
+ test_cc 0 0 0 0
+ checkr3 10000
+
+ move.d 0x100,r3
+ cmpq 1,r3
+ test_cc 0 0 0 0
+ checkr3 100
+
+ move.d 0x5678900,r3
+ cmpq 7,r3
+ test_cc 0 0 0 0
+ checkr3 5678900
+
+ quit
diff --git a/tests/cris/check_cmpr.s b/tests/cris/check_cmpr.s
new file mode 100644
index 000000000..b30af7a53
--- /dev/null
+++ b/tests/cris/check_cmpr.s
@@ -0,0 +1,102 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: ffffffff\n2\nffff\nffffffff\n78134452\nffffffff\n2\nffff\nfedaffff\n78134452\nffffffff\n2\nff\nfeda49ff\n78134452\n85649222\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ moveq -2,r4
+ cmp.d r4,r3
+ test_cc 0 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq 1,r4
+ cmp.d r4,r3
+ test_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r3
+ move.d -0xffff,r4
+ cmp.d r4,r3
+ test_cc 0 0 0 1
+ checkr3 ffff
+
+ moveq 1,r4
+ moveq -1,r3
+ cmp.d r4,r3
+ test_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d -0x5432f789,r4
+ move.d 0x78134452,r3
+ cmp.d r4,r3
+ test_cc 1 0 1 1
+ checkr3 78134452
+
+ moveq -1,r3
+ moveq -2,r4
+ cmp.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq 1,r4
+ cmp.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 2
+
+ move.d 0xffff,r3
+ move.d -0xffff,r4
+ cmp.w r4,r3
+ test_cc 1 0 0 0
+ checkr3 ffff
+
+ move.d 0xfedaffff,r3
+ move.d -0xfedaffff,r4
+ cmp.w r4,r3
+ test_cc 1 0 0 0
+ checkr3 fedaffff
+
+ move.d -0x5432f789,r4
+ move.d 0x78134452,r3
+ cmp.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 78134452
+
+ moveq -1,r3
+ moveq -2,r4
+ cmp.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq 1,r4
+ cmp.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 2
+
+ move.d -0xff,r4
+ move.d 0xff,r3
+ cmp.b r4,r3
+ test_cc 1 0 0 0
+ checkr3 ff
+
+ move.d -0xfeda49ff,r4
+ move.d 0xfeda49ff,r3
+ cmp.b r4,r3
+ test_cc 1 0 0 0
+ checkr3 feda49ff
+
+ move.d -0x5432f789,r4
+ move.d 0x78134452,r3
+ cmp.b r4,r3
+ test_cc 1 0 0 1
+ checkr3 78134452
+
+ move.d 0x85649222,r3
+ move.d 0x77445622,r4
+ cmp.b r4,r3
+ test_cc 0 1 0 0
+ checkr3 85649222
+
+ quit
diff --git a/tests/cris/check_cmpxc.s b/tests/cris/check_cmpxc.s
new file mode 100644
index 000000000..b237a9317
--- /dev/null
+++ b/tests/cris/check_cmpxc.s
@@ -0,0 +1,92 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 2\n2\n2\n2\nffff\nffff\nffff\nffff\nffffffff\nffffffff\nffffffff\n78134452\n78134452\n78134452\n78134452\n4452\n80000032\n
+
+ .include "testutils.inc"
+ start
+ moveq 2,r3
+ cmps.b 0xff,r3
+ test_cc 0 0 0 1
+ checkr3 2
+
+ moveq 2,r3
+ cmps.w 0xffff,r3
+ test_cc 0 0 0 1
+ checkr3 2
+
+ moveq 2,r3
+ cmpu.b 0xff,r3
+ test_cc 1 0 0 1
+ checkr3 2
+
+ moveq 2,r3
+ move.d 0xffffffff,r4
+ cmpu.w -1,r3
+ test_cc 1 0 0 1
+ checkr3 2
+
+ move.d 0xffff,r3
+ cmpu.b -1,r3
+ test_cc 0 0 0 0
+ checkr3 ffff
+
+ move.d 0xffff,r3
+ cmpu.w -1,r3
+ test_cc 0 1 0 0
+ checkr3 ffff
+
+ move.d 0xffff,r3
+ cmps.b 0xff,r3
+ test_cc 0 0 0 1
+ checkr3 ffff
+
+ move.d 0xffff,r3
+ cmps.w 0xffff,r3
+ test_cc 0 0 0 1
+ checkr3 ffff
+
+ moveq -1,r3
+ cmps.b 0xff,r3
+ test_cc 0 1 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ cmps.w 0xff,r3
+ test_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ cmps.w 0xffff,r3
+ test_cc 0 1 0 0
+ checkr3 ffffffff
+
+ move.d 0x78134452,r3
+ cmpu.b 0x89,r3
+ test_cc 0 0 0 0
+ checkr3 78134452
+
+ move.d 0x78134452,r3
+ cmps.b 0x89,r3
+ test_cc 0 0 0 1
+ checkr3 78134452
+
+ move.d 0x78134452,r3
+ cmpu.w 0xf789,r3
+ test_cc 0 0 0 0
+ checkr3 78134452
+
+ move.d 0x78134452,r3
+ cmps.w 0xf789,r3
+ test_cc 0 0 0 1
+ checkr3 78134452
+
+ move.d 0x4452,r3
+ cmps.w 0x8002,r3
+ test_cc 0 0 0 1
+ checkr3 4452
+
+ move.d 0x80000032,r3
+ cmpu.w 0x764,r3
+ test_cc 0 0 1 0
+ checkr3 80000032
+
+ quit
diff --git a/tests/cris/check_cmpxm.s b/tests/cris/check_cmpxm.s
new file mode 100644
index 000000000..87ea5bf8e
--- /dev/null
+++ b/tests/cris/check_cmpxm.s
@@ -0,0 +1,106 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 2\n2\n2\n2\nffff\nffff\nffff\nffff\nffffffff\nffffffff\nffffffff\n78134452\n78134452\n78134452\n78134452\n4452\n80000032\n
+
+ .include "testutils.inc"
+ .data
+x:
+ .byte 0xff
+ .word 0xffff
+ .word 0xff
+ .word 0xffff
+ .byte 0x89
+ .word 0xf789
+ .word 0x8002
+ .word 0x764
+
+ start
+ moveq 2,r3
+ move.d x,r5
+ cmps.b [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 2
+
+ moveq 2,r3
+ cmps.w [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 2
+
+ moveq 2,r3
+ subq 3,r5
+ cmpu.b [r5+],r3
+ test_cc 1 0 0 1
+ checkr3 2
+
+ moveq 2,r3
+ cmpu.w [r5+],r3
+ test_cc 1 0 0 1
+ subq 3,r5
+ checkr3 2
+
+ move.d 0xffff,r3
+ cmpu.b [r5],r3
+ test_cc 0 0 0 0
+ checkr3 ffff
+
+ move.d 0xffff,r3
+ cmpu.w [r5],r3
+ test_cc 0 1 0 0
+ checkr3 ffff
+
+ move.d 0xffff,r3
+ cmps.b [r5],r3
+ test_cc 0 0 0 1
+ checkr3 ffff
+
+ move.d 0xffff,r3
+ cmps.w [r5],r3
+ test_cc 0 0 0 1
+ checkr3 ffff
+
+ moveq -1,r3
+ cmps.b [r5],r3
+ test_cc 0 1 0 0
+ addq 3,r5
+ checkr3 ffffffff
+
+ moveq -1,r3
+ cmps.w [r5+],r3
+ test_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ cmps.w [r5+],r3
+ test_cc 0 1 0 0
+ checkr3 ffffffff
+
+ move.d 0x78134452,r3
+ cmpu.b [r5],r3
+ test_cc 0 0 0 0
+ checkr3 78134452
+
+ move.d 0x78134452,r3
+ cmps.b [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 78134452
+
+ move.d 0x78134452,r3
+ cmpu.w [r5],r3
+ test_cc 0 0 0 0
+ checkr3 78134452
+
+ move.d 0x78134452,r3
+ cmps.w [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 78134452
+
+ move.d 0x4452,r3
+ cmps.w [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 4452
+
+ move.d 0x80000032,r3
+ cmpu.w [r5+],r3
+ test_cc 0 0 1 0
+ checkr3 80000032
+
+ quit
diff --git a/tests/cris/check_dstep.s b/tests/cris/check_dstep.s
new file mode 100644
index 000000000..bd43b838e
--- /dev/null
+++ b/tests/cris/check_dstep.s
@@ -0,0 +1,42 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: fffffffc\n4\nffff\nfffffffe\n9bf3911b\n0\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ moveq 2,r4
+ dstep r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 fffffffc
+
+ moveq 2,r3
+ moveq -1,r4
+ dstep r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 4
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ dstep r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ moveq -1,r4
+ move.d r4,r3
+ dstep r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 fffffffe
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ dstep r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 9bf3911b
+
+ move.d 0xffff,r3
+ move.d 0x1fffe,r4
+ dstep r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_gcctorture_pr28634-1.c b/tests/cris/check_gcctorture_pr28634-1.c
new file mode 100644
index 000000000..45ecd159b
--- /dev/null
+++ b/tests/cris/check_gcctorture_pr28634-1.c
@@ -0,0 +1,15 @@
+/* PR rtl-optimization/28634.  On targets with delayed branches,
+   dbr_schedule could do the next iteration's addition in the
+   branch delay slot, then subtract the value again if the branch
+   wasn't taken.  This can lead to rounding errors.  */
+int x = -1;
+int y = 1;
+int
+main (void)
+{
+  while (y > 0)
+    y += x;
+  if (y != x + 1)
+    abort ();
+  exit (0);
+}
diff --git a/tests/cris/check_gcctorture_pr28634.c b/tests/cris/check_gcctorture_pr28634.c
new file mode 100644
index 000000000..a0c525497
--- /dev/null
+++ b/tests/cris/check_gcctorture_pr28634.c
@@ -0,0 +1,15 @@
+/* PR rtl-optimization/28634.  On targets with delayed branches,
+   dbr_schedule could do the next iteration's addition in the
+   branch delay slot, then subtract the value again if the branch
+   wasn't taken.  This can lead to rounding errors.  */
+double x = -0x1.0p53;
+double y = 1;
+int
+main (void)
+{
+  while (y > 0)
+    y += x;
+  if (y != x + 1)
+    abort ();
+  exit (0);
+}
diff --git a/tests/cris/check_glibc_kernelversion.c b/tests/cris/check_glibc_kernelversion.c
new file mode 100644
index 000000000..fcbc7b07f
--- /dev/null
+++ b/tests/cris/check_glibc_kernelversion.c
@@ -0,0 +1,116 @@
+/*
+ * Check the lz insn.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+
+#define __LINUX_KERNEL_VERSION 131584
+
+#define DL_SYSDEP_OSCHECK(FATAL) \
+  do {                                                                        \
+    /* Test whether the kernel is new enough.  This test is only              \
+       performed if the library is not compiled to run on all                 \
+       kernels.  */                                                           \
+    if (__LINUX_KERNEL_VERSION > 0)                                           \
+      {                                                                       \
+        char bufmem[64];                                                      \
+        char *buf = bufmem;                                                   \
+        unsigned int version;                                                 \
+        int parts;                                                            \
+        char *cp;                                                             \
+        struct utsname uts;                                                   \
+                                                                              \
+        /* Try the uname syscall */                                           \
+        if (__uname (&uts))                                                   \
+          {                                                                   \
+            /* This was not successful.  Now try reading the /proc            \
+               filesystem.  */                                                \
+            ssize_t reslen;                                                   \
+            int fd = __open ("/proc/sys/kernel/osrelease", O_RDONLY);         \
+            if (fd == -1                                                      \
+                || (reslen = __read (fd, bufmem, sizeof (bufmem))) <= 0)      \
+              /* This also didn't work.  We give up since we cannot           \
+                 make sure the library can actually work.  */                 \
+              FATAL ("FATAL: cannot determine library version\n");            \
+            __close (fd);                                                     \
+            buf[MIN (reslen, (ssize_t) sizeof (bufmem) - 1)] = '\0';          \
+          }                                                                   \
+        else                                                                  \
+          buf = uts.release;                                                  \
+                                                                              \
+        /* Now convert it into a number.  The string consists of at most      \
+           three parts.  */                                                   \
+        version = 0;                                                          \
+        parts = 0;                                                            \
+        cp = buf;                                                             \
+        while ((*cp >= '0') && (*cp <= '9'))                                  \
+          {                                                                   \
+            unsigned int here = *cp++ - '0';                                  \
+                                                                              \
+            while ((*cp >= '0') && (*cp <= '9'))                              \
+              {                                                               \
+                here *= 10;                                                   \
+                here += *cp++ - '0';                                          \
+              }                                                               \
+                                                                              \
+            ++parts;                                                          \
+            version <<= 8;                                                    \
+            version |= here;                                                  \
+                                                                              \
+            if (*cp++ != '.')                                                 \
+              /* Another part following?  */                                  \
+              break;                                                          \
+          }                                                                   \
+                                                                              \
+        if (parts < 3)                                                        \
+          version <<= 8 * (3 - parts);                                        \
+                                                                              \
+        /* Now we can test with the required version.  */                     \
+        if (version < __LINUX_KERNEL_VERSION)                                 \
+          /* Not sufficent.  */                                               \
+          FATAL ("FATAL: kernel too old\n");                                  \
+                                                                              \
+        _dl_osversion = version;                                              \
+      }                                                                       \
+  } while (0)
+
+int main(void)
+{
+        char bufmem[64] = "2.6.22";
+        char *buf = bufmem;
+        unsigned int version;
+        int parts;
+        char *cp;
+
+        version = 0;
+        parts = 0;
+        cp = buf;
+        while ((*cp >= '0') && (*cp <= '9'))
+          {
+            unsigned int here = *cp++ - '0';
+
+            while ((*cp >= '0') && (*cp <= '9'))
+              {
+                here *= 10;
+                here += *cp++ - '0';
+              }
+
+            ++parts;
+            version <<= 8;
+            version |= here;
+
+            if (*cp++ != '.')
+              /* Another part following?  */
+              break;
+          }
+
+        if (parts < 3)
+          version <<= 8 * (3 - parts);
+	if (version < __LINUX_KERNEL_VERSION)
+		err();
+	pass();
+	exit(0);
+}
diff --git a/tests/cris/check_hello.c b/tests/cris/check_hello.c
new file mode 100644
index 000000000..fb403ba99
--- /dev/null
+++ b/tests/cris/check_hello.c
@@ -0,0 +1,7 @@
+#include <stdio.h>
+#include <stdlib.h>
+int main ()
+{
+  printf ("pass\n");
+  exit (0);
+}
diff --git a/tests/cris/check_int64.c b/tests/cris/check_int64.c
new file mode 100644
index 000000000..99ca6f115
--- /dev/null
+++ b/tests/cris/check_int64.c
@@ -0,0 +1,45 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+#include "crisutils.h"
+
+
+extern inline int64_t add64(const int64_t a, const int64_t b) {
+	return a + b;
+}
+
+extern inline int64_t sub64(const int64_t a, const int64_t b) {
+	return a - b;
+}
+
+int main(void)
+{
+	int64_t a = 1;
+	int64_t b = 2;
+
+	/* FIXME: add some tests.  */
+	a = add64(a, b);
+	if (a != 3)
+		err();
+
+	a = sub64(a, b);
+	if (a != 1)
+		err();
+
+	a = add64(a, -4);
+	if (a != -3)
+		err();
+
+	a = add64(a, 3);
+	if (a != 0)
+		err();
+
+	a = 0;
+	a = sub64(a, 1);
+	if (a != -1)
+		err();
+
+	pass();
+	return 0;
+}
diff --git a/tests/cris/check_jsr.s b/tests/cris/check_jsr.s
new file mode 100644
index 000000000..106023787
--- /dev/null
+++ b/tests/cris/check_jsr.s
@@ -0,0 +1,85 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 0\n0\n0\n0\n0\n0\n
+
+# Test that jsr Rn and jsr [PC+] work.
+
+ .include "testutils.inc"
+ start
+x:
+ move.d 0f,r6
+ setf nzvc
+ jsr r6
+ .if 1; ..asm.arch.cris.v32
+ nop
+ .endif
+0:
+ test_move_cc 1 1 1 1
+ move srp,r3
+ sub.d 0b,r3
+ checkr3 0
+
+ move.d 1f,r0
+ setf nzvc
+ jsr r0
+ .if 1 ; ..asm.arch.cris.v32
+ moveq 0,r0
+ .endif
+6:
+ nop
+ quit
+
+2:
+ test_move_cc 0 0 0 0
+ move srp,r3
+ sub.d 3f,r3
+ checkr3 0
+ jsr 4f
+ .if 1 ; ..asm.arch.cris.v32
+ nop
+ .endif
+7:
+ nop
+ quit
+
+8:
+ move srp,r3
+ sub.d 7b,r3
+ checkr3 0
+ quit
+
+4:
+ move srp,r3
+ sub.d 7b,r3
+ checkr3 0
+ move.d 5f,r3
+ jump r3
+ .if 1; ..asm.arch.cris.v32
+ moveq 0,r3
+ .endif
+ quit
+
+ .space 32770,0
+1:
+ test_move_cc 1 1 1 1
+ move srp,r3
+ sub.d 6b,r3
+ checkr3 0
+
+ clearf cznv
+ jsr 2b
+ .if 1; ..asm.arch.cris.v32
+ nop
+ .endif
+3:
+
+ quit
+
+5:
+ move srp,r3
+ sub.d 7b,r3
+ checkr3 0
+ jump 8b
+ .if 1 ; ..asm.arch.cris.v32
+ nop
+ .endif
+ quit
diff --git a/tests/cris/check_lapc.s b/tests/cris/check_lapc.s
new file mode 100644
index 000000000..9a6150b74
--- /dev/null
+++ b/tests/cris/check_lapc.s
@@ -0,0 +1,78 @@
+# mach: crisv32
+# output: 0\n0\nfffffffa\nfffffffe\nffffffda\n1e\n1e\n0\n
+
+.include "testutils.inc"
+
+; To accommodate dumpr3 with more than one instruction, keep it
+; out of lapc operand ranges and difference calculations.
+
+ start
+ lapc.d 0f,r3
+0:
+ sub.d .,r3
+ checkr3 0
+
+ lapcq 0f,r3
+0:
+ sub.d .,r3
+ checkr3 0
+
+ lapc.d .,r3
+ sub.d .,r3
+ checkr3 fffffffa
+
+ lapcq .,r3
+ sub.d .,r3
+ checkr3 fffffffe
+
+0:
+ .rept 16
+ nop
+ .endr
+ lapc.d 0b,r3
+ sub.d .,r3
+ checkr3 ffffffda
+
+ setf zcvn
+ lapc.d 0f,r3
+ test_cc 1 1 1 1
+ sub.d .,r3
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+0:
+ checkr3 1e
+0:
+ lapcq 0f,r3
+ sub.d 0b,r3
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+ nop
+0:
+ checkr3 1e
+ clearf cn
+ setf zv
+1:
+ lapcq .,r3
+ test_cc 0 1 1 0
+ sub.d 1b,r3
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_lsl.s b/tests/cris/check_lsl.s
new file mode 100644
index 000000000..9e2ddd7cd
--- /dev/null
+++ b/tests/cris/check_lsl.s
@@ -0,0 +1,217 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: ffffffff\n4\n80000000\nffff8000\n7f19f000\n80000000\n0\n0\n699fc67c\nffffffff\n4\n80000000\nffff8000\n7f19f000\nda670000\nda670000\nda670000\nda67c67c\nffffffff\nfffafffe\n4\nffff0000\nffff8000\n5a67f000\nda67f100\nda67f100\nda67f100\nda67f17c\nfff3faff\nfff3fafe\n4\nffffff00\nffffff00\nffffff80\n5a67f100\n5a67f1f0\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ lslq 0,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ lslq 1,r3
+ test_move_cc 0 0 0 0
+ checkr3 4
+
+ moveq -1,r3
+ lslq 31,r3
+ test_move_cc 1 0 0 0
+ checkr3 80000000
+
+ moveq -1,r3
+ lslq 15,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffff8000
+
+ move.d 0x5a67f19f,r3
+ lslq 12,r3
+ test_move_cc 0 0 0 0
+ checkr3 7f19f000
+
+ move.d 0xda67f19f,r3
+ move.d 31,r4
+ lsl.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 80000000
+
+ move.d 0xda67f19f,r3
+ move.d 32,r4
+ lsl.d r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0xda67f19f,r3
+ move.d 33,r4
+ lsl.d r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0xda67f19f,r3
+ move.d 66,r4
+ lsl.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 699fc67c
+
+ moveq -1,r3
+ moveq 0,r4
+ lsl.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq 1,r4
+ lsl.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 4
+
+ moveq -1,r3
+ moveq 31,r4
+ lsl.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 80000000
+
+ moveq -1,r3
+ moveq 15,r4
+ lsl.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffff8000
+
+ move.d 0x5a67f19f,r3
+ moveq 12,r4
+ lsl.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 7f19f000
+
+ move.d 0xda67f19f,r3
+ move.d 31,r4
+ lsl.w r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da670000
+
+ move.d 0xda67f19f,r3
+ move.d 32,r4
+ lsl.w r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da670000
+
+ move.d 0xda67f19f,r3
+ move.d 33,r4
+ lsl.w r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da670000
+
+ move.d 0xda67f19f,r3
+ move.d 66,r4
+ lsl.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 da67c67c
+
+ moveq -1,r3
+ moveq 0,r4
+ lsl.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0xfffaffff,r3
+ moveq 1,r4
+ lsl.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 fffafffe
+
+ moveq 2,r3
+ moveq 1,r4
+ lsl.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 4
+
+ moveq -1,r3
+ moveq 31,r4
+ lsl.w r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 ffff0000
+
+ moveq -1,r3
+ moveq 15,r4
+ lsl.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffff8000
+
+ move.d 0x5a67f19f,r3
+ moveq 12,r4
+ lsl.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 5a67f000
+
+ move.d 0xda67f19f,r3
+ move.d 31,r4
+ lsl.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da67f100
+
+ move.d 0xda67f19f,r3
+ move.d 32,r4
+ lsl.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da67f100
+
+ move.d 0xda67f19f,r3
+ move.d 33,r4
+ lsl.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da67f100
+
+ move.d 0xda67f19f,r3
+ move.d 66,r4
+ lsl.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 da67f17c
+
+ move.d 0xfff3faff,r3
+ moveq 0,r4
+ lsl.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 fff3faff
+
+ move.d 0xfff3faff,r3
+ moveq 1,r4
+ lsl.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 fff3fafe
+
+ moveq 2,r3
+ moveq 1,r4
+ lsl.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 4
+
+ moveq -1,r3
+ moveq 31,r4
+ lsl.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 ffffff00
+
+ moveq -1,r3
+ moveq 15,r4
+ lsl.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 ffffff00
+
+ moveq -1,r3
+ moveq 7,r4
+ lsl.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffff80
+
+ move.d 0x5a67f19f,r3
+ moveq 12,r4
+ lsl.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 5a67f100
+
+ move.d 0x5a67f19f,r3
+ moveq 4,r4
+ lsl.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 5a67f1f0
+
+ quit
diff --git a/tests/cris/check_lsr.s b/tests/cris/check_lsr.s
new file mode 100644
index 000000000..18fdbef9b
--- /dev/null
+++ b/tests/cris/check_lsr.s
@@ -0,0 +1,218 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: ffffffff\n1\n1\n1ffff\n5a67f\n1\n0\n0\n3699fc67\nffffffff\n1\n1\n1ffff\n5a67f\nda670000\nda670000\nda670000\nda673c67\nffffffff\nffff7fff\n1\nffff0000\nffff0001\n5a67000f\nda67f100\nda67f100\nda67f100\nda67f127\nffffffff\nffffff7f\n1\nffffff00\nffffff00\nffffff01\n5a67f100\n5a67f109\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ lsrq 0,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ lsrq 1,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ moveq -1,r3
+ lsrq 31,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ moveq -1,r3
+ lsrq 15,r3
+ test_move_cc 0 0 0 0
+ checkr3 1ffff
+
+ move.d 0x5a67f19f,r3
+ lsrq 12,r3
+ test_move_cc 0 0 0 0
+ checkr3 5a67f
+
+ move.d 0xda67f19f,r3
+ move.d 31,r4
+ lsr.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ move.d 0xda67f19f,r3
+ move.d 32,r4
+ lsr.d r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0xda67f19f,r3
+ move.d 33,r4
+ lsr.d r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0xda67f19f,r3
+ move.d 66,r4
+ lsr.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 3699fc67
+
+ moveq -1,r3
+ moveq 0,r4
+ lsr.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq 1,r4
+ lsr.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ moveq -1,r3
+ moveq 31,r4
+ lsr.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ moveq -1,r3
+ moveq 15,r4
+ lsr.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 1ffff
+
+ move.d 0x5a67f19f,r3
+ moveq 12,r4
+ lsr.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 5a67f
+
+ move.d 0xda67f19f,r3
+ move.d 31,r4
+ lsr.w r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da670000
+
+ move.d 0xda67f19f,r3
+ move.d 32,r4
+ lsr.w r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da670000
+
+ move.d 0xda67f19f,r3
+ move.d 33,r4
+ lsr.w r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da670000
+
+ move.d 0xda67f19f,r3
+ move.d 66,r4
+ lsr.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 da673c67
+
+ moveq -1,r3
+ moveq 0,r4
+ lsr.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 1,r4
+ lsr.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff7fff
+
+ moveq 2,r3
+ moveq 1,r4
+ lsr.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+;; FIXME: this was wrong. Z should be set.
+ moveq -1,r3
+ moveq 31,r4
+ lsr.w r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 ffff0000
+
+ moveq -1,r3
+ moveq 15,r4
+ lsr.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff0001
+
+ move.d 0x5a67f19f,r3
+ moveq 12,r4
+ lsr.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 5a67000f
+
+ move.d 0xda67f19f,r3
+ move.d 31,r4
+ lsr.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da67f100
+
+ move.d 0xda67f19f,r3
+ move.d 32,r4
+ lsr.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da67f100
+
+ move.d 0xda67f19f,r3
+ move.d 33,r4
+ lsr.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 da67f100
+
+ move.d 0xda67f19f,r3
+ move.d 66,r4
+ lsr.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 da67f127
+
+ moveq -1,r3
+ moveq 0,r4
+ lsr.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 1,r4
+ lsr.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffffff7f
+
+ moveq 2,r3
+ moveq 1,r4
+ lsr.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ moveq -1,r3
+ moveq 31,r4
+ lsr.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 ffffff00
+
+ moveq -1,r3
+ moveq 15,r4
+ lsr.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 ffffff00
+
+ moveq -1,r3
+ moveq 7,r4
+ lsr.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffffff01
+
+ move.d 0x5a67f19f,r3
+ moveq 12,r4
+ lsr.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 5a67f100
+
+ move.d 0x5a67f19f,r3
+ moveq 4,r4
+ lsr.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 5a67f109
+
+ quit
diff --git a/tests/cris/check_lz.c b/tests/cris/check_lz.c
new file mode 100644
index 000000000..7b30a265a
--- /dev/null
+++ b/tests/cris/check_lz.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+
+extern inline int cris_lz(int x)
+{
+	int r;
+	asm ("lz\t%1, %0\n" : "=r" (r) : "r" (x));
+	return r;
+}
+
+void check_lz(void)
+{
+	int i;
+
+	if (cris_lz(0) != 32)
+		err();
+	if (cris_lz(1) != 31)
+		err();
+	if (cris_lz(2) != 30)
+		err();
+	if (cris_lz(4) != 29)
+		err();
+	if (cris_lz(8) != 28)
+		err();
+
+	/* try all positions with a single bit.  */
+	for (i = 1; i < 32; i++) {
+		if (cris_lz(1 << (i-1)) != (32 - i))
+			err();
+	}
+
+	/* try all positions with all bits.  */
+	for (i = 1; i < 32; i++) {
+		/* split up this computation to clarify it.  */
+		uint32_t val;
+		val = (unsigned int)-1 >> (32 - i);
+		if (cris_lz(val) != (32 - i))
+			err();
+	}
+}
+
+int main(void)
+{
+	check_lz();
+	pass();
+	exit(0);
+}
diff --git a/tests/cris/check_mapbrk.c b/tests/cris/check_mapbrk.c
new file mode 100644
index 000000000..1aff7622b
--- /dev/null
+++ b/tests/cris/check_mapbrk.c
@@ -0,0 +1,39 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+/* Basic sanity check that syscalls to implement malloc (brk, mmap2,
+   munmap) are trivially functional.  */
+
+int main ()
+{
+  void *p1, *p2, *p3, *p4, *p5, *p6;
+
+  if ((p1 = malloc (8100)) == NULL
+      || (p2 = malloc (16300)) == NULL
+      || (p3 = malloc (4000)) == NULL
+      || (p4 = malloc (500)) == NULL
+      || (p5 = malloc (1023*1024)) == NULL
+      || (p6 = malloc (8191*1024)) == NULL)
+  {
+    printf ("fail\n");
+    exit (1);
+  }
+
+  free (p1);
+  free (p2);
+  free (p3);
+  free (p4);
+  free (p5);
+  free (p6);
+
+  p1 = malloc (64000);
+  if (p1 == NULL)
+  {
+    printf ("fail\n");
+    exit (1);
+  }
+  free (p1);
+
+  printf ("pass\n");
+  exit (0);
+}
diff --git a/tests/cris/check_mcp.s b/tests/cris/check_mcp.s
new file mode 100644
index 000000000..e65ccddfd
--- /dev/null
+++ b/tests/cris/check_mcp.s
@@ -0,0 +1,49 @@
+# mach: crisv32
+# output: fffffffe\n1\n1ffff\nfffffffe\ncc463bdc\n4c463bdc\n0\n
+
+ .include "testutils.inc"
+ start
+
+; Set R, clear C.
+ move 0x100,ccs
+ moveq -5,r3
+ move 2,mof
+ mcp mof,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+
+ moveq 2,r3
+ move -1,srp
+ mcp srp,r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ move 0xffff,srp
+ move srp,r3
+ mcp srp,r3
+ test_cc 0 0 0 0
+ checkr3 1ffff
+
+ move -1,mof
+ move mof,r3
+ mcp mof,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+
+ move 0x5432f789,mof
+ move.d 0x78134452,r3
+ mcp mof,r3
+ test_cc 1 0 1 0
+ checkr3 cc463bdc
+
+ move 0x80000000,srp
+ mcp srp,r3
+ test_cc 0 0 1 0
+ checkr3 4c463bdc
+
+ move 0xb3b9c423,srp
+ mcp srp,r3
+ test_cc 0 1 0 0
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_mmap1.c b/tests/cris/check_mmap1.c
new file mode 100644
index 000000000..b803f0c43
--- /dev/null
+++ b/tests/cris/check_mmap1.c
@@ -0,0 +1,48 @@
+/*
+#notarget: cris*-*-elf
+*/
+
+#define _GNU_SOURCE
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+int main (int argc, char *argv[])
+{
+  int fd = open (argv[0], O_RDONLY);
+  struct stat sb;
+  int size;
+  void *a;
+  const char *str = "a string you'll only find in the program";
+
+  if (fd == -1)
+    {
+      perror ("open");
+      abort ();
+    }
+
+  if (fstat (fd, &sb) < 0)
+    {
+      perror ("fstat");
+      abort ();
+    }
+
+  size = sb.st_size;
+
+  /* We want to test mmapping a size that isn't exactly a page.  */
+  if ((size & 8191) == 0)
+    size--;
+
+  a = mmap (NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
+
+  if (memmem (a, size, str, strlen (str) + 1) == NULL)
+    abort ();
+
+  printf ("pass\n");
+  exit (0);
+}
diff --git a/tests/cris/check_mmap2.c b/tests/cris/check_mmap2.c
new file mode 100644
index 000000000..35139a0ed
--- /dev/null
+++ b/tests/cris/check_mmap2.c
@@ -0,0 +1,48 @@
+/*
+#notarget: cris*-*-elf
+*/
+
+#define _GNU_SOURCE
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+int main (int argc, char *argv[])
+{
+  int fd = open (argv[0], O_RDONLY);
+  struct stat sb;
+  int size;
+  void *a;
+  const char *str = "a string you'll only find in the program";
+
+  if (fd == -1)
+    {
+      perror ("open");
+      abort ();
+    }
+
+  if (fstat (fd, &sb) < 0)
+    {
+      perror ("fstat");
+      abort ();
+    }
+
+  size = sb.st_size;
+
+  /* We want to test mmapping a size that isn't exactly a page.  */
+  if ((size & 8191) == 0)
+    size--;
+
+  a = mmap (NULL, size, PROT_READ, MAP_SHARED, fd, 0);
+
+  if (memmem (a, size, str, strlen (str) + 1) == NULL)
+    abort ();
+
+  printf ("pass\n");
+  exit (0);
+}
diff --git a/tests/cris/check_mmap3.c b/tests/cris/check_mmap3.c
new file mode 100644
index 000000000..34401fa0c
--- /dev/null
+++ b/tests/cris/check_mmap3.c
@@ -0,0 +1,33 @@
+/*
+#notarget: cris*-*-elf
+*/
+
+#define _GNU_SOURCE
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+int main (int argc, char *argv[])
+{
+  volatile unsigned char *a;
+
+  /* Check that we can map a non-multiple of a page and still get a full page.  */
+  a = mmap (NULL, 0x4c, PROT_READ | PROT_WRITE | PROT_EXEC,
+	    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+  if (a == NULL || a == (unsigned char *) -1)
+    abort ();
+
+  a[0] = 0xbe;
+  a[8191] = 0xef;
+  memset ((char *) a + 1, 0, 8190);
+
+  if (a[0] != 0xbe || a[8191] != 0xef)
+    abort ();
+
+  printf ("pass\n");
+  exit (0);
+}
diff --git a/tests/cris/check_movdelsr1.s b/tests/cris/check_movdelsr1.s
new file mode 100644
index 000000000..300cc8774
--- /dev/null
+++ b/tests/cris/check_movdelsr1.s
@@ -0,0 +1,33 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: aa117acd\n
+# output: eeaabb42\n
+
+; Bug with move to special register in delay slot, due to
+; special flush-insn-cache simulator use.  Ordinary move worked;
+; special register caused branch to fail.
+
+ .include "testutils.inc"
+ start
+ move -1,srp
+
+ move.d 0xaa117acd,r1
+ moveq 3,r9
+ cmpq 1,r9
+ bhi 0f
+ move.d r1,r3
+
+ fail
+0:
+ checkr3 aa117acd
+
+ move.d 0xeeaabb42,r1
+ moveq 3,r9
+ cmpq 1,r9
+ bhi 0f
+ move r1,srp
+
+ fail
+0:
+ move srp,r3
+ checkr3 eeaabb42
+ quit
diff --git a/tests/cris/check_movecr.s b/tests/cris/check_movecr.s
new file mode 100644
index 000000000..da8ec2628
--- /dev/null
+++ b/tests/cris/check_movecr.s
@@ -0,0 +1,37 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: ffffff42\n94\nffff4321\n9234\n76543210\n76540000\n
+
+; Move constant byte, word, dword to register.  Check that no extension is
+; performed, that only part of the register is set.
+
+ .include "testutils.inc"
+ startnostack
+ moveq -1,r3
+ move.b 0x42,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffffff42
+
+ moveq 0,r3
+ move.b 0x94,r3
+ test_move_cc 1 0 0 0
+ checkr3 94
+
+ moveq -1,r3
+ move.w 0x4321,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff4321
+
+ moveq 0,r3
+ move.w 0x9234,r3
+ test_move_cc 1 0 0 0
+ checkr3 9234
+
+ move.d 0x76543210,r3
+ test_move_cc 0 0 0 0
+ checkr3 76543210
+
+ move.w 0,r3
+ test_move_cc 0 1 0 0
+ checkr3 76540000
+
+ quit
diff --git a/tests/cris/check_movei.s b/tests/cris/check_movei.s
new file mode 100644
index 000000000..2defda5f3
--- /dev/null
+++ b/tests/cris/check_movei.s
@@ -0,0 +1,47 @@
+# mach: crisv32
+# output: fffffffe\n
+# output: fffffffe\n
+
+; Check basic integral-write semantics regarding flags.
+
+ .include "testutils.inc"
+ start
+
+; A write that works.  Check that flags are set correspondingly.
+ move.d d,r4
+ moveq -2,r5
+ setf c
+ clearf p
+ move.d [r4],r3
+ ax
+ move.d r5,[r4]
+ move.d [r4],r3
+
+ bcc 0f
+ nop
+ fail
+
+0:
+ checkr3 fffffffe
+
+; A write that fails; check flags too.
+ move.d d,r4
+ moveq 23,r5
+ setf p
+ clearf c
+ move.d [r4],r3
+ ax
+ move.d r5,[r4]
+ move.d [r4],r3
+
+ bcs 0f
+ nop
+ fail
+
+0:
+ checkr3 fffffffe
+ quit
+
+ .data
+d:
+ .dword 42424242
diff --git a/tests/cris/check_movemr.s b/tests/cris/check_movemr.s
new file mode 100644
index 000000000..776da7683
--- /dev/null
+++ b/tests/cris/check_movemr.s
@@ -0,0 +1,79 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 12345678\n10234567\n12345678\n12344567\n12344523\n76543210\nffffffaa\naa\n9911\nffff9911\n78\n56\n3456\n6712\n
+
+ .include "testutils.inc"
+ start
+
+ .data
+mem1:
+ .dword 0x12345678
+mem2:
+ .word 0x4567
+mem3:
+ .byte 0x23
+ .dword 0x76543210
+ .byte 0xaa,0x11,0x99
+
+ .text
+ move.d mem1,r2
+ move.d [r2],r3
+ test_move_cc 0 0 0 0
+ checkr3 12345678
+
+ move.d mem2,r3
+ move.d [r3],r3
+ test_move_cc 0 0 0 0
+ checkr3 10234567
+
+ move.d mem1,r2
+ move.d [r2+],r3
+ test_move_cc 0 0 0 0
+ checkr3 12345678
+
+ move.w [r2+],r3
+ test_move_cc 0 0 0 0
+ checkr3 12344567
+
+ move.b [r2+],r3
+ test_move_cc 0 0 0 0
+ checkr3 12344523
+
+ move.d [r2+],r3
+ test_move_cc 0 0 0 0
+ checkr3 76543210
+
+ movs.b [r2],r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffaa
+
+ movu.b [r2+],r3
+ test_move_cc 0 0 0 0
+ checkr3 aa
+
+ movu.w [r2],r3
+ test_move_cc 0 0 0 0
+ checkr3 9911
+
+ movs.w [r2+],r3
+ test_move_cc 1 0 0 0
+ checkr3 ffff9911
+
+ move.d mem1,r13
+ movs.b [r13+],r3
+ test_move_cc 0 0 0 0
+ checkr3 78
+
+ movu.b [r13],r3
+ test_move_cc 0 0 0 0
+ checkr3 56
+
+ movs.w [r13+],r3
+ test_move_cc 0 0 0 0
+ checkr3 3456
+
+ movu.w [r13+],r3
+ test_move_cc 0 0 0 0
+ checkr3 6712
+
+ quit
+
diff --git a/tests/cris/check_movemrv32.s b/tests/cris/check_movemrv32.s
new file mode 100644
index 000000000..dc340afa4
--- /dev/null
+++ b/tests/cris/check_movemrv32.s
@@ -0,0 +1,97 @@
+# mach: crisv32
+# output: 15\n7\n2\nffff1234\nb\n16\nf\n2\nffffffef\nf\nffff1234\nf\nfffffff4\nd\nfffffff2\n10\nfffffff2\nd\n
+
+ .include "testutils.inc"
+ .data
+x:
+ .dword 8,9,10,11
+y:
+ .dword -12,13,-14,15,16
+
+ start
+ moveq 7,r0
+ moveq 2,r1
+ move.d 0xffff1234,r2
+ moveq 21,r3
+ move.d x,r4
+ setf zcvn
+ movem r2,[r4+]
+ test_cc 1 1 1 1
+ subq 12,r4
+
+ checkr3 15
+
+ move.d [r4+],r3
+ checkr3 7
+
+ move.d [r4+],r3
+ checkr3 2
+
+ move.d [r4+],r3
+ checkr3 ffff1234
+
+ move.d [r4+],r3
+ checkr3 b
+
+ subq 16,r4
+ moveq 22,r0
+ moveq 15,r1
+ clearf zcvn
+ movem r0,[r4]
+ test_cc 0 0 0 0
+ move.d [r4+],r3
+ checkr3 16
+
+ move.d r1,r3
+ checkr3 f
+
+ move.d [r4+],r3
+ checkr3 2
+
+ subq 8,r4
+ moveq 10,r2
+ moveq -17,r0
+ clearf zc
+ setf vn
+ movem r1,[r4]
+ test_cc 1 0 1 0
+ move.d [r4+],r3
+ checkr3 ffffffef
+
+ move.d [r4+],r3
+ checkr3 f
+
+ move.d [r4+],r3
+ checkr3 ffff1234
+
+ move.d y,r4
+ setf zc
+ clearf vn
+ movem [r4+],r3
+ test_cc 0 1 0 1
+ checkr3 f
+
+ move.d r0,r3
+ checkr3 fffffff4
+
+ move.d r1,r3
+ checkr3 d
+
+ move.d r2,r3
+ checkr3 fffffff2
+
+ move.d [r4],r3
+ checkr3 10
+
+ subq 8,r4
+ setf zcvn
+ movem [r4+],r0
+ test_cc 1 1 1 1
+ move.d r0,r3
+ checkr3 fffffff2
+
+ move.d r1,r3
+ checkr3 d
+
+ quit
+
diff --git a/tests/cris/check_moveq.c b/tests/cris/check_moveq.c
new file mode 100644
index 000000000..9f71194ac
--- /dev/null
+++ b/tests/cris/check_moveq.c
@@ -0,0 +1,51 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+#include "crisutils.h"
+
+#define cris_moveq(dst, src) \
+               asm volatile ("moveq %1, %0\n" : "=r" (dst) : "i" (src));
+
+
+
+int main(void)
+{
+	int t;
+
+	cris_tst_cc_init();
+	asm volatile ("setf\tzvnc\n");
+	cris_moveq(t, 10);
+	cris_tst_cc(1, 1, 1, 1);
+	if (t != 10)
+		err();
+
+	/* make sure moveq doesnt clobber the zflag.  */
+	cris_tst_cc_init();
+	asm volatile ("setf vnc\n");
+	asm volatile ("clearf z\n");
+	cris_moveq(t, 0);
+	cris_tst_cc(1, 0, 1, 1);
+	if (t != 0)
+		err();
+
+	/* make sure moveq doesnt clobber the nflag.
+	   Also check large immediates  */
+	cris_tst_cc_init();
+	asm volatile ("setf zvc\n");
+	asm volatile ("clearf n\n");
+	cris_moveq(t, -31);
+	cris_tst_cc(0, 1, 1, 1);
+	if (t != -31)
+		err();
+
+	cris_tst_cc_init();
+	asm volatile ("setf nzvc\n");
+	cris_moveq(t, 31);
+	cris_tst_cc(1, 1, 1, 1);
+	if (t != 31)
+		err();
+
+	pass();
+	return 0;
+}
diff --git a/tests/cris/check_mover.s b/tests/cris/check_mover.s
new file mode 100644
index 000000000..c93106f17
--- /dev/null
+++ b/tests/cris/check_mover.s
@@ -0,0 +1,29 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: ffffff05\nffff0005\n5\nffffff00\n
+
+; Move between registers.  Check that just the subreg is copied.
+
+ .include "testutils.inc"
+ startnostack
+ moveq -30,r3
+ moveq 5,r4
+ move.b r4,r3
+ test_move_cc 0 0 0 0  		; FIXME
+ checkr3 ffffff05
+
+ move.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff0005
+
+ move.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 5
+
+ moveq -1,r3
+ moveq 0,r4
+ move.b r4,r3
+ test_move_cc 0 1 0 0
+ checkr3 ffffff00
+
+ quit
+
diff --git a/tests/cris/check_moverm.s b/tests/cris/check_moverm.s
new file mode 100644
index 000000000..95498464e
--- /dev/null
+++ b/tests/cris/check_moverm.s
@@ -0,0 +1,45 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 7823fec2\n10231879\n102318fe\n
+
+ .include "testutils.inc"
+ start
+
+ .data
+mem1:
+ .dword 0x12345678
+mem2:
+ .word 0x4567
+mem3:
+ .byte 0x23
+ .dword 0x76543210
+ .byte 0xaa,0x11,0x99
+
+ .text
+ move.d mem1,r2
+ move.d 0x7823fec2,r4
+ setf nzvc
+ move.d r4,[r2+]
+ test_cc 1 1 1 1
+ subq 4,r2
+ move.d [r2],r3
+ checkr3 7823fec2
+
+ move.d mem2,r3
+ move.d 0x45231879,r4
+ clearf nzvc
+ move.w r4,[r3]
+ test_cc 0 0 0 0
+ move.d [r3],r3
+ checkr3 10231879
+
+ move.d mem2,r2
+ moveq -2,r4
+ clearf nc
+ setf zv
+ move.b r4,[r2+]
+ test_cc 0 1 1 0
+ subq 1,r2
+ move.d [r2],r3
+ checkr3 102318ff
+
+ quit
diff --git a/tests/cris/check_movmp.s b/tests/cris/check_movmp.s
new file mode 100644
index 000000000..7fc11f064
--- /dev/null
+++ b/tests/cris/check_movmp.s
@@ -0,0 +1,131 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: ffffff00\nffff0000\n0\nffffff00\nffff0000\n0\nffffff00\nffff0000\n0\nbb113344\n664433aa\ncc557788\nabcde012\nabcde000\n77880000\n0\n
+
+# Test generic "move Ps,[]" and "move [],Pd" insns; the ones with
+# functionality common to all models.
+
+ .include "testutils.inc"
+ start
+
+ .data
+filler:
+ .byte 0xaa
+ .word 0x4433
+ .dword 0x55778866
+ .byte 0xcc
+
+ .text
+; Test that writing to zero-registers is a nop
+ .if 0
+ ; We used to just ignore the writes, but now an error is emitted.  We
+ ; keep the test-code but disabled, in case we need to change this again.
+ move 0xaa,p0
+ move 0x4433,p4
+ move 0x55774433,p8
+ .endif
+
+ moveq -1,r3
+ setf zcvn
+ clear.b r3
+ test_cc 1 1 1 1
+ checkr3 ffffff00
+
+ moveq -1,r3
+ clearf zcvn
+ clear.w r3
+ test_cc 0 0 0 0
+ checkr3 ffff0000
+
+ moveq -1,r3
+ clear.d r3
+ checkr3 0
+
+; "Write" using ordinary memory references too.
+ .if 0 ; See ".if 0" above.
+ move.d filler,r6
+ move [r6],p0
+ move [r6],p4
+ move [r6],p8
+ .endif
+
+# ffffff00\nffff0000\n0\nffffff00\nffff0000\n0\nbb113344\n664433aa\ncc557788\nabcde012\nabcde000\n77880000\n0\n
+
+ moveq -1,r3
+ clear.b r3
+ checkr3 ffffff00
+
+ moveq -1,r3
+ clear.w r3
+ checkr3 ffff0000
+
+ moveq -1,r3
+ clear.d r3
+ checkr3 0
+
+; And postincremented.
+ .if 0 ; See ".if 0" above.
+ move [r6+],p0
+ move [r6+],p4
+ move [r6+],p8
+ .endif
+
+# ffffff00\nffff0000\n0\nbb113344\n664433aa\ncc557788\nabcde012\nabcde000\n77880000\n0\n
+
+ moveq -1,r3
+ clear.b r3
+ checkr3 ffffff00
+
+ moveq -1,r3
+ clear.w r3
+ checkr3 ffff0000
+
+ moveq -1,r3
+ clear.d r3
+ checkr3 0
+
+; Now see that we can write to the registers too.
+# bb113344\n664433aa\ncc557788\nabcde012\nabcde000\n77880000\n0\n
+; [PC+]
+ move.d filler,r9
+ move 0xbb113344,srp
+ move srp,r3
+ checkr3 bb113344
+
+; [R+]
+ move [r9+],srp
+ move srp,r3
+ checkr3 664433aa
+
+; [R]
+ move [r9],srp
+ move srp,r3
+ checkr3 cc557788
+
+; And check writing to memory, clear and srp.
+
+ move.d filler,r9
+ move 0xabcde012,srp
+ setf zcvn
+ move srp,[r9+]
+ test_cc 1 1 1 1
+ subq 4,r9
+ move.d [r9],r3
+ checkr3 abcde012
+
+ clearf zcvn
+ clear.b [r9]
+ test_cc 0 0 0 0
+ move.d [r9],r3
+ checkr3 abcde000
+
+ addq 2,r9
+ clear.w [r9+]
+ subq 2,r9
+ move.d [r9],r3
+ checkr3 77880000
+
+ clear.d [r9]
+ move.d [r9],r3
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_movpmv32.s b/tests/cris/check_movpmv32.s
new file mode 100644
index 000000000..daf0970e4
--- /dev/null
+++ b/tests/cris/check_movpmv32.s
@@ -0,0 +1,35 @@
+# mach: crisv32
+# output: 11223320\nbb113344\naa557711\n
+
+# Test v32-specific special registers.  FIXME: more registers.
+
+ .include "testutils.inc"
+ start
+ .data
+store:
+ .dword 0x11223344
+ .dword 0x77665544
+
+ .text
+ moveq -1,r3
+ move.d store,r4
+ move vr,[r4]
+ move [r4+],mof
+ move mof,r3
+ checkr3 11223320
+
+ moveq -1,r3
+ clearf zcvn
+ move 0xbb113344,mof
+ test_cc 0 0 0 0
+ move mof,r3
+ checkr3 bb113344
+
+ setf zcvn
+ move 0xaa557711,mof
+ test_cc 1 1 1 1
+ move mof,[r4]
+ move.d [r4],r3
+ checkr3 aa557711
+
+ quit
diff --git a/tests/cris/check_movpr.s b/tests/cris/check_movpr.s
new file mode 100644
index 000000000..eef9bdb4f
--- /dev/null
+++ b/tests/cris/check_movpr.s
@@ -0,0 +1,28 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: ffffff00\nffff0000\n0\nbb113344\n
+
+# Test generic "move Ps,Rd" and "move Rs,Pd" insns; the ones with
+# functionality common to all models.
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ clear.b r3
+ checkr3 ffffff00
+
+ moveq -1,r3
+ clear.w r3
+ checkr3 ffff0000
+
+ moveq -1,r3
+ clear.d r3
+ checkr3 0
+
+ moveq -1,r3
+ move.d 0xbb113344,r4
+ setf zcvn
+ move r4,srp
+ move srp,r3
+ test_cc 1 1 1 1
+ checkr3 bb113344
+ quit
diff --git a/tests/cris/check_movprv32.s b/tests/cris/check_movprv32.s
new file mode 100644
index 000000000..d0d90e124
--- /dev/null
+++ b/tests/cris/check_movprv32.s
@@ -0,0 +1,21 @@
+# mach: crisv32
+# output: ffffff20\nbb113344\n
+
+# Test v32-specific special registers.  FIXME: more registers.
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ setf zcvn
+ move vr,r3
+ test_cc 1 1 1 1
+ checkr3 ffffff20
+
+ moveq -1,r3
+ move.d 0xbb113344,r4
+ clearf cvnz
+ move r4,mof
+ test_cc 0 0 0 0
+ move mof,r3
+ checkr3 bb113344
+ quit
diff --git a/tests/cris/check_movscr.s b/tests/cris/check_movscr.s
new file mode 100644
index 000000000..53c8ce6b5
--- /dev/null
+++ b/tests/cris/check_movscr.s
@@ -0,0 +1,29 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 42\nffffff85\n7685\nffff8765\n0\n
+
+; Move constant byte, word, dword to register.  Check that sign-extension
+; is performed.
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ movs.b 0x42,r3
+ checkr3 42
+
+ movs.b 0x85,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffff85
+
+ movs.w 0x7685,r3
+ test_move_cc 0 0 0 0
+ checkr3 7685
+
+ movs.w 0x8765,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffff8765
+
+ movs.w 0,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_movsm.s b/tests/cris/check_movsm.s
new file mode 100644
index 000000000..7074336e7
--- /dev/null
+++ b/tests/cris/check_movsm.s
@@ -0,0 +1,44 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 5\nfffffff5\n5\nfffffff5\n0\n
+
+; Movs between registers.  Check that sign-extension is performed and the
+; full register is set.
+
+ .include "testutils.inc"
+
+ .data
+x:
+ .byte 5,-11
+ .word 5,-11
+ .word 0
+
+ start
+ move.d x,r5
+
+ moveq -1,r3
+ movs.b [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 5
+
+ moveq 0,r3
+ movs.b [r5],r3
+ test_move_cc 1 0 0 0
+ addq 1,r5
+ checkr3 fffffff5
+
+ moveq -1,r3
+ movs.w [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 5
+
+ moveq 0,r3
+ movs.w [r5],r3
+ test_move_cc 1 0 0 0
+ addq 2,r5
+ checkr3 fffffff5
+
+ movs.w [r5],r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_movsr.s b/tests/cris/check_movsr.s
new file mode 100644
index 000000000..d1889a7a1
--- /dev/null
+++ b/tests/cris/check_movsr.s
@@ -0,0 +1,46 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 5\nfffffff5\n5\nfffffff5\n0\n
+
+; Movs between registers.  Check that sign-extension is performed and the
+; full register is set.
+
+ .include "testutils.inc"
+ start
+ moveq -1,r5
+ moveq 5,r4
+ move.b r4,r5
+ moveq -1,r3
+ movs.b r5,r3
+ test_move_cc 0 0 0 0
+ checkr3 5
+
+ moveq 0,r5
+ moveq -11,r4
+ move.b r4,r5
+ moveq 0,r3
+ movs.b r5,r3
+ test_move_cc 1 0 0 0
+ checkr3 fffffff5
+
+ moveq -1,r5
+ moveq 5,r4
+ move.w r4,r5
+ moveq -1,r3
+ movs.w r5,r3
+ test_move_cc 0 0 0 0
+ checkr3 5
+
+ moveq 0,r5
+ moveq -11,r4
+ move.w r4,r5
+ moveq 0,r3
+ movs.w r5,r3
+ test_move_cc 1 0 0 0
+ checkr3 fffffff5
+
+ moveq 0,r5
+ movs.b r5,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_movucr.s b/tests/cris/check_movucr.s
new file mode 100644
index 000000000..7c8487d1a
--- /dev/null
+++ b/tests/cris/check_movucr.s
@@ -0,0 +1,33 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 42\n85\n7685\n8765\n0\n
+
+; Move constant byte, word, dword to register.  Check that zero-extension
+; is performed.
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ movu.b 0x42,r3
+ test_move_cc 0 0 0 0
+ checkr3 42
+
+ moveq -1,r3
+ movu.b 0x85,r3
+ test_move_cc 0 0 0 0
+ checkr3 85
+
+ moveq -1,r3
+ movu.w 0x7685,r3
+ test_move_cc 0 0 0 0
+ checkr3 7685
+
+ moveq -1,r3
+ movu.w 0x8765,r3
+ test_move_cc 0 0 0 0
+ checkr3 8765
+
+ movu.b 0,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_movum.s b/tests/cris/check_movum.s
new file mode 100644
index 000000000..038e53946
--- /dev/null
+++ b/tests/cris/check_movum.s
@@ -0,0 +1,40 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 5\nf5\n5\nfff5\n0\n
+
+; Movu between registers.  Check that zero-extension is performed and the
+; full register is set.
+
+ .include "testutils.inc"
+
+ .data
+x:
+ .byte 5,-11
+ .word 5,-11
+ .word 0
+
+ start
+ move.d x,r5
+
+ movu.b [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 5
+
+ movu.b [r5],r3
+ test_move_cc 0 0 0 0
+ addq 1,r5
+ checkr3 f5
+
+ movu.w [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 5
+
+ movu.w [r5],r3
+ test_move_cc 0 0 0 0
+ addq 2,r5
+ checkr3 fff5
+
+ movu.w [r5],r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_movur.s b/tests/cris/check_movur.s
new file mode 100644
index 000000000..3ecf475f7
--- /dev/null
+++ b/tests/cris/check_movur.s
@@ -0,0 +1,45 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 5\nf5\n5\nfff5\n0\n
+
+; Movu between registers.  Check that zero-extension is performed and the
+; full register is set.
+
+ .include "testutils.inc"
+ start
+ moveq -1,r5
+ moveq 5,r4
+ move.b r4,r5
+ moveq -1,r3
+ movu.b r5,r3
+ test_move_cc 0 0 0 0
+ checkr3 5
+
+ moveq 0,r5
+ moveq -11,r4
+ move.b r4,r5
+ moveq -1,r3
+ movu.b r5,r3
+ test_move_cc 0 0 0 0
+ checkr3 f5
+
+ moveq -1,r5
+ moveq 5,r4
+ move.w r4,r5
+ moveq -1,r3
+ movu.w r5,r3
+ test_move_cc 0 0 0 0
+ checkr3 5
+
+ moveq 0,r5
+ moveq -11,r4
+ move.w r4,r5
+ moveq -1,r3
+ movu.w r5,r3
+ test_move_cc 0 0 0 0
+ checkr3 fff5
+
+ movu.w 0,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_mulv32.s b/tests/cris/check_mulv32.s
new file mode 100644
index 000000000..f37935876
--- /dev/null
+++ b/tests/cris/check_mulv32.s
@@ -0,0 +1,51 @@
+# mach: crisv32
+# output: fffffffe\n
+# output: ffffffff\n
+# output: fffffffe\n
+# output: 1\n
+# output: fffffffe\n
+# output: ffffffff\n
+# output: fffffffe\n
+# output: 1\n
+
+; Check that carry is not modified on v32.
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ moveq 2,r4
+ setf c
+ muls.d r4,r3
+ test_cc 1 0 0 1
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 2,r4
+ setf c
+ mulu.d r4,r3
+ test_cc 0 0 1 1
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 1
+
+ moveq -1,r3
+ moveq 2,r4
+ clearf c
+ muls.d r4,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 2,r4
+ clearf c
+ mulu.d r4,r3
+ test_cc 0 0 1 0
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 1
+
+ quit
diff --git a/tests/cris/check_mulx.s b/tests/cris/check_mulx.s
new file mode 100644
index 000000000..d43241a6f
--- /dev/null
+++ b/tests/cris/check_mulx.s
@@ -0,0 +1,246 @@
+# mach: crisv10 crisv32
+# output: fffffffe\nffffffff\nfffffffe\n1\nfffffffe\nffffffff\nfffffffe\n1\nfffe0001\n0\nfffe0001\n0\n1\n0\n1\nfffffffe\n193eade2\n277e3a49\n193eade2\n277e3a49\nfffffffe\nffffffff\n1fffe\n0\nfffffffe\nffffffff\n1fffe\n0\n1\n0\nfffe0001\n0\nfdbdade2\nffffffff\n420fade2\n0\nfffffffe\nffffffff\n1fe\n0\nfffffffe\nffffffff\n1fe\n0\n1\n0\nfe01\n0\n1\n0\nfe01\n0\nffffd9e2\nffffffff\n2be2\n0\n0\n0\n0\n0\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ moveq 2,r4
+ muls.d r4,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 2,r4
+ mulu.d r4,r3
+ test_cc 0 0 1 0
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 1
+
+ moveq 2,r3
+ moveq -1,r4
+ muls.d r4,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq -1,r4
+ mulu.d r4,r3
+ test_cc 0 0 1 0
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 1
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ muls.d r4,r3
+ test_cc 0 0 1 0
+ checkr3 fffe0001
+ move mof,r3
+ checkr3 0
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ mulu.d r4,r3
+ test_cc 0 0 0 0
+ checkr3 fffe0001
+ move mof,r3
+ checkr3 0
+
+ moveq -1,r4
+ move.d r4,r3
+ muls.d r4,r3
+ test_cc 0 0 0 0
+ checkr3 1
+ move mof,r3
+ checkr3 0
+
+ moveq -1,r4
+ move.d r4,r3
+ mulu.d r4,r3
+ test_cc 1 0 1 0
+ checkr3 1
+ move mof,r3
+ checkr3 fffffffe
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ muls.d r4,r3
+ test_cc 0 0 1 0
+ checkr3 193eade2
+ move mof,r3
+ checkr3 277e3a49
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ mulu.d r4,r3
+ test_cc 0 0 1 0
+ checkr3 193eade2
+ move mof,r3
+ checkr3 277e3a49
+
+ move.d 0xffff,r3
+ moveq 2,r4
+ muls.w r4,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 2,r4
+ mulu.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 1fffe
+ move mof,r3
+ checkr3 0
+
+ moveq 2,r3
+ move.d 0xffff,r4
+ muls.w r4,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq -1,r4
+ mulu.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 1fffe
+ move mof,r3
+ checkr3 0
+
+ move.d 0xffff,r4
+ move.d r4,r3
+ muls.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 1
+ move mof,r3
+ checkr3 0
+
+ moveq -1,r4
+ move.d r4,r3
+ mulu.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 fffe0001
+ move mof,r3
+ checkr3 0
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ muls.w r4,r3
+ test_cc 1 0 0 0
+ checkr3 fdbdade2
+ move mof,r3
+ checkr3 ffffffff
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ mulu.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 420fade2
+ move mof,r3
+ checkr3 0
+
+ move.d 0xff,r3
+ moveq 2,r4
+ muls.b r4,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 ffffffff
+
+ moveq -1,r3
+ moveq 2,r4
+ mulu.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 1fe
+ move mof,r3
+ checkr3 0
+
+ moveq 2,r3
+ moveq -1,r4
+ muls.b r4,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+ move mof,r3
+ checkr3 ffffffff
+
+ moveq 2,r3
+ moveq -1,r4
+ mulu.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 1fe
+ move mof,r3
+ checkr3 0
+
+ move.d 0xff,r4
+ move.d r4,r3
+ muls.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 1
+ move mof,r3
+ checkr3 0
+
+ moveq -1,r4
+ move.d r4,r3
+ mulu.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 fe01
+ move mof,r3
+ checkr3 0
+
+ move.d 0xfeda49ff,r4
+ move.d r4,r3
+ muls.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 1
+ move mof,r3
+ checkr3 0
+
+ move.d 0xfeda49ff,r4
+ move.d r4,r3
+ mulu.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 fe01
+ move mof,r3
+ checkr3 0
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ muls.b r4,r3
+ test_cc 1 0 0 0
+ checkr3 ffffd9e2
+ move mof,r3
+ checkr3 ffffffff
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ mulu.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 2be2
+ move mof,r3
+ checkr3 0
+
+ moveq 0,r3
+ move.d 0xf87f4aeb,r4
+ muls.d r4,r3
+ test_cc 0 1 0 0
+ checkr3 0
+ move mof,r3
+ checkr3 0
+
+ move.d 0xf87f4aeb,r3
+ moveq 0,r4
+ mulu.d r4,r3
+ test_cc 0 1 0 0
+ checkr3 0
+ move mof,r3
+ checkr3 0
+
+ quit
diff --git a/tests/cris/check_neg.s b/tests/cris/check_neg.s
new file mode 100644
index 000000000..963c4b6f5
--- /dev/null
+++ b/tests/cris/check_neg.s
@@ -0,0 +1,104 @@
+# mach:  crisv0 crisv3 crisv8 crisv10 crisv32
+# output: ffffffff\nffffffff\n0\n80000000\n1\nba987655\nffff\nffff\n0\n89ab8000\nffff0001\n45677655\nff\nff\n0\n89abae80\nffffff01\n45678955\n
+
+ .include "testutils.inc"
+ start
+ moveq 0,r3
+ moveq 1,r4
+ neg.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 1,r3
+ moveq 0,r4
+ neg.d r3,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+;; FIXME: this was wrong.
+ moveq 0,r3
+ neg.d r3,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0x80000000,r3
+ neg.d r3,r3
+ test_move_cc 1 0 0 0
+ checkr3 80000000
+
+ moveq -1,r3
+ neg.d r3,r3
+ test_move_cc 0 0 0 0
+ checkr3 1
+
+ move.d 0x456789ab,r3
+ neg.d r3,r3
+ test_move_cc 1 0 0 0
+ checkr3 ba987655
+
+ moveq 0,r3
+ moveq 1,r4
+ neg.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffff
+
+ moveq 1,r3
+ moveq 0,r4
+ neg.w r3,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffff
+
+ moveq 0,r3
+ neg.w r3,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0x89ab8000,r3
+ neg.w r3,r3
+ test_move_cc 1 0 0 0
+ checkr3 89ab8000
+
+ moveq -1,r3
+ neg.w r3,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff0001
+
+ move.d 0x456789ab,r3
+ neg.w r3,r3
+ test_move_cc 0 0 0 0
+ checkr3 45677655
+
+ moveq 0,r3
+ moveq 1,r4
+ neg.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ff
+
+ moveq 1,r3
+ moveq 0,r4
+ neg.b r3,r3
+ test_move_cc 1 0 0 0
+ checkr3 ff
+
+ moveq 0,r3
+ neg.b r3,r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+;; FIXME: was wrong.
+ move.d 0x89abae80,r3
+ neg.b r3,r3
+ test_move_cc 1 0 0 1
+ checkr3 89abae80
+
+ moveq -1,r3
+ neg.b r3,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffffff01
+
+ move.d 0x456789ab,r3
+ neg.b r3,r3
+ test_move_cc 0 0 0 0
+ checkr3 45678955
+
+ quit
diff --git a/tests/cris/check_not.s b/tests/cris/check_not.s
new file mode 100644
index 000000000..33bcf155e
--- /dev/null
+++ b/tests/cris/check_not.s
@@ -0,0 +1,31 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: fffffffe\nfffffffd\nffff0f00\n0\n87ecbbad\n
+
+ .include "testutils.inc"
+ start
+ moveq 1,r3
+ not r3
+ test_move_cc 1 0 0 0
+ checkr3 fffffffe
+
+ moveq 2,r3
+ not r3
+ test_move_cc 1 0 0 0
+ checkr3 fffffffd
+
+ move.d 0xf0ff,r3
+ not r3
+ test_move_cc 1 0 0 0
+ checkr3 ffff0f00
+
+ moveq -1,r3
+ not r3
+ test_move_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0x78134452,r3
+ not r3
+ test_move_cc 1 0 0 0
+ checkr3 87ecbbad
+
+ quit
diff --git a/tests/cris/check_openpf1.c b/tests/cris/check_openpf1.c
new file mode 100644
index 000000000..1d71e0bdd
--- /dev/null
+++ b/tests/cris/check_openpf1.c
@@ -0,0 +1,38 @@
+/* Check that --sysroot is applied to open(2).
+#sim: --sysroot=@exedir@
+
+   We assume, with EXE being the name of the executable:
+   - The simulator executes with cwd the same directory where the executable
+     is located (so argv[0] contains a plain filename without directory
+     components).
+   - There's no /EXE on the host file system.  */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+int main (int argc, char *argv[])
+{
+  char *fnam = argv[0];
+  FILE *f;
+  if (argv[0][0] != '/')
+    {
+      fnam = malloc (strlen (argv[0]) + 2);
+      if (fnam == NULL)
+	abort ();
+      strcpy (fnam, "/");
+      strcat (fnam, argv[0]);
+    }
+
+  f = fopen (fnam, "rb");
+  if (f == NULL)
+    abort ();
+  close (f);
+
+  /* Cover another execution path.  */
+  if (fopen ("/nonexistent", "rb") != NULL
+      || errno != ENOENT)
+    abort ();
+  printf ("pass\n");
+  return 0;
+}
diff --git a/tests/cris/check_openpf2.c b/tests/cris/check_openpf2.c
new file mode 100644
index 000000000..f44a8f34b
--- /dev/null
+++ b/tests/cris/check_openpf2.c
@@ -0,0 +1,16 @@
+/* Check that the simulator has chdir:ed to the --sysroot argument
+#sim: --sysroot=@srcdir@
+   (or that  --sysroot is applied to relative file paths).  */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+int main (int argc, char *argv[])
+{
+  FILE *f = fopen ("check_openpf2.c", "rb");
+  if (f == NULL)
+    abort ();
+  close (f);
+  printf ("pass\n");
+  return 0;
+}
diff --git a/tests/cris/check_openpf3.c b/tests/cris/check_openpf3.c
new file mode 100644
index 000000000..557adee92
--- /dev/null
+++ b/tests/cris/check_openpf3.c
@@ -0,0 +1,49 @@
+/* Basic file operations (rename, unlink); once without sysroot.  We
+   also test that the simulator has chdir:ed to PREFIX, when defined.  */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#ifndef PREFIX
+#define PREFIX
+#endif
+
+void err (const char *s)
+{
+  perror (s);
+  abort ();
+}
+
+int main (int argc, char *argv[])
+{
+  FILE *f;
+  struct stat buf;
+
+  unlink (PREFIX "testfoo2.tmp");
+
+  f = fopen ("testfoo1.tmp", "w");
+  if (f == NULL)
+    err ("open");
+  fclose (f);
+
+  if (rename (PREFIX "testfoo1.tmp", PREFIX "testfoo2.tmp") != 0)
+    err ("rename");
+
+  if (stat (PREFIX "testfoo2.tmp", &buf) != 0
+      || !S_ISREG (buf.st_mode))
+    err ("stat 1");
+
+  if (stat ("testfoo2.tmp", &buf) != 0
+      || !S_ISREG (buf.st_mode))
+    err ("stat 2");
+
+  if (unlink (PREFIX "testfoo2.tmp") != 0)
+    err ("unlink");
+
+  printf ("pass\n");
+  return 0;
+}
diff --git a/tests/cris/check_openpf4.c b/tests/cris/check_openpf4.c
new file mode 100644
index 000000000..8bbee41a6
--- /dev/null
+++ b/tests/cris/check_openpf4.c
@@ -0,0 +1,5 @@
+/* Basic file operations, now *with* sysroot.
+#sim: --sysroot=@exedir@
+*/
+#define PREFIX "/"
+#include "check_openpf3.c"
diff --git a/tests/cris/check_openpf5.c b/tests/cris/check_openpf5.c
new file mode 100644
index 000000000..1f86ea283
--- /dev/null
+++ b/tests/cris/check_openpf5.c
@@ -0,0 +1,56 @@
+/* Check that TRT happens when error on too many opened files.
+#notarget: cris*-*-elf
+#sim: --sysroot=@exedir@
+*/
+#include <stddef.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <errno.h>
+#include <limits.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <string.h>
+
+int main (int argc, char *argv[])
+{
+  int i;
+  int filemax;
+
+#ifdef OPEN_MAX
+  filemax = OPEN_MAX;
+#else
+  filemax = sysconf (_SC_OPEN_MAX);
+#endif
+
+  char *fn = malloc (strlen (argv[0]) + 2);
+  if (fn == NULL)
+    abort ();
+  strcpy (fn, "/");
+  strcat (fn, argv[0]);
+
+  for (i = 0; i < filemax + 1; i++)
+    {
+      if (open (fn, O_RDONLY) < 0)
+	{
+	  /* Shouldn't happen too early.  */
+	  if (i < filemax - 3 - 1)
+	    {
+	      fprintf (stderr, "i: %d\n", i);
+	      abort ();
+	    }
+	  if (errno != EMFILE)
+	    {
+	      perror ("open");
+	      abort ();
+	    }
+	  goto ok;
+	}
+    }
+  abort ();
+
+ok:
+  printf ("pass\n");
+  exit (0);
+}
diff --git a/tests/cris/check_orc.s b/tests/cris/check_orc.s
new file mode 100644
index 000000000..c733f036a
--- /dev/null
+++ b/tests/cris/check_orc.s
@@ -0,0 +1,71 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 3\n3\nffff\nffffffff\n7c33f7db\nffff0003\n3\nfedaffff\n7813f7db\n3\n3\nfeb\n781344db\n
+
+ .include "testutils.inc"
+ start
+ moveq 1,r3
+ or.d 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ moveq 2,r3
+ or.d 1,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ move.d 0xf0ff,r3
+ or.d 0xff0f,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ moveq -1,r3
+ or.d -1,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x78134452,r3
+ or.d 0x5432f789,r3
+ test_move_cc 0 0 0 0
+ checkr3 7c33f7db
+
+ move.d 0xffff0001,r3
+ or.w 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff0003
+
+ moveq 2,r3
+ or.w 1,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ move.d 0xfedaffaf,r3
+ or.w 0xff5f,r3
+ test_move_cc 1 0 0 0
+ checkr3 fedaffff
+
+ move.d 0x78134452,r3
+ or.w 0xf789,r3
+ test_move_cc 1 0 0 0
+ checkr3 7813f7db
+
+ moveq 1,r3
+ or.b 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ moveq 2,r3
+ or.b 1,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ move.d 0xfa3,r3
+ or.b 0x4a,r3
+ test_move_cc 1 0 0 0
+ checkr3 feb
+
+ move.d 0x78134453,r3
+ or.b 0x89,r3
+ test_move_cc 1 0 0 0
+ checkr3 781344db
+
+ quit
diff --git a/tests/cris/check_orm.s b/tests/cris/check_orm.s
new file mode 100644
index 000000000..ee723a6aa
--- /dev/null
+++ b/tests/cris/check_orm.s
@@ -0,0 +1,75 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 3\n3\nffff\nffffffff\n7c33f7db\nffff0003\n3\nfedaffff\n7813f7db\n3\n3\nfeb\n781344db\n
+
+ .include "testutils.inc"
+ .data
+x:
+ .dword 2,1,0xff0f,-1,0x5432f789
+ .word 2,1,0xff5f,0xf789
+ .byte 2,1,0x4a,0x89
+
+ start
+ moveq 1,r3
+ move.d x,r5
+ or.d [r5+],r3
+ checkr3 3
+
+ moveq 2,r3
+ or.d [r5],r3
+ addq 4,r5
+ checkr3 3
+
+ move.d 0xf0ff,r3
+ or.d [r5+],r3
+ checkr3 ffff
+
+ moveq -1,r3
+ or.d [r5+],r3
+ checkr3 ffffffff
+
+ move.d 0x78134452,r3
+ or.d [r5+],r3
+ checkr3 7c33f7db
+
+ move.d 0xffff0001,r3
+ or.w [r5+],r3
+ checkr3 ffff0003
+
+ moveq 2,r3
+ or.w [r5],r3
+ addq 2,r5
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ move.d 0xfedaffaf,r3
+ or.w [r5+],r3
+ test_move_cc 1 0 0 0
+ checkr3 fedaffff
+
+ move.d 0x78134452,r3
+ or.w [r5+],r3
+ test_move_cc 1 0 0 0
+ checkr3 7813f7db
+
+ moveq 1,r3
+ or.b [r5+],r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ moveq 2,r3
+ or.b [r5],r3
+ addq 1,r5
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ move.d 0xfa3,r3
+ or.b [r5+],r3
+ test_move_cc 1 0 0 0
+ checkr3 feb
+
+ move.d 0x78134453,r3
+ or.b [r5],r3
+ test_move_cc 1 0 0 0
+ checkr3 781344db
+
+ quit
diff --git a/tests/cris/check_orq.s b/tests/cris/check_orq.s
new file mode 100644
index 000000000..5060edc72
--- /dev/null
+++ b/tests/cris/check_orq.s
@@ -0,0 +1,41 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 3\n3\nffffffff\nffffffff\n1f\nffffffe0\n7813445e\n
+
+ .include "testutils.inc"
+ start
+ moveq 1,r3
+ orq 2,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ moveq 2,r3
+ orq 1,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ move.d 0xf0ff,r3
+ orq -1,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 0,r3
+ orq -1,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ moveq 0,r3
+ orq 31,r3
+ test_move_cc 0 0 0 0
+ checkr3 1f
+
+ moveq 0,r3
+ orq -32,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffe0
+
+ move.d 0x78134452,r3
+ orq 12,r3
+ test_move_cc 0 0 0 0
+ checkr3 7813445e
+
+ quit
diff --git a/tests/cris/check_orr.s b/tests/cris/check_orr.s
new file mode 100644
index 000000000..a514c11bc
--- /dev/null
+++ b/tests/cris/check_orr.s
@@ -0,0 +1,84 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 3\n3\nffff\nffffffff\n7c33f7db\nffff0003\n3\nfedaffff\n7813f7db\n3\n3\nfeb\n781344db\n
+
+ .include "testutils.inc"
+ start
+ moveq 1,r3
+ moveq 2,r4
+ or.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ moveq 2,r3
+ moveq 1,r4
+ or.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ move.d 0xff0f,r4
+ move.d 0xf0ff,r3
+ or.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff
+
+ moveq -1,r4
+ move.d r4,r3
+ or.d r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 ffffffff
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ or.d r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 7c33f7db
+
+ move.d 0xffff0001,r3
+ moveq 2,r4
+ or.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 ffff0003
+
+ moveq 2,r3
+ move.d 0xffff0001,r4
+ or.w r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ move.d 0xfedaffaf,r3
+ move.d 0xffffff5f,r4
+ or.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 fedaffff
+
+ move.d 0x5432f789,r4
+ move.d 0x78134452,r3
+ or.w r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 7813f7db
+
+ moveq 1,r3
+ move.d 0xffffff02,r4
+ or.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ moveq 2,r3
+ moveq 1,r4
+ or.b r4,r3
+ test_move_cc 0 0 0 0
+ checkr3 3
+
+ move.d 0x4a,r4
+ move.d 0xfa3,r3
+ or.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 feb
+
+ move.d 0x5432f789,r4
+ move.d 0x78134453,r3
+ or.b r4,r3
+ test_move_cc 1 0 0 0
+ checkr3 781344db
+
+ quit
diff --git a/tests/cris/check_ret.s b/tests/cris/check_ret.s
new file mode 100644
index 000000000..b44fb2593
--- /dev/null
+++ b/tests/cris/check_ret.s
@@ -0,0 +1,25 @@
+# mach: crisv3 crisv8 crisv10
+# output: 3\n
+
+# Test that ret works.
+
+ .include "testutils.inc"
+ start
+x:
+ moveq 0,r3
+ jsr z
+w:
+ quit
+y:
+ addq 1,r3
+ checkr3 3
+ quit
+
+z:
+ addq 1,r3
+ move srp,r2
+ add.d y-w,r2
+ move r2,srp
+ ret
+ addq 1,r3
+ quit
diff --git a/tests/cris/check_scc.s b/tests/cris/check_scc.s
new file mode 100644
index 000000000..4a8674cc1
--- /dev/null
+++ b/tests/cris/check_scc.s
@@ -0,0 +1,95 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 1\n0\n1\n0\n1\n0\n1\n0\n0\n1\n1\n0\n1\n0\n1\n0\n1\n0\n0\n1\n0\n1\n1\n0\n1\n0\n0\n1\n1\n0\n1\n1\n0\n
+
+ .include "testutils.inc"
+
+ .macro lcheckr3 v
+	move	 $ccs, $r9
+	checkr3 \v
+	move	$r9, $ccs
+ .endm
+
+ start
+ clearf nzvc
+ scc r3
+ lcheckr3 1
+ scs r3
+ lcheckr3 0
+ sne r3
+ lcheckr3 1
+ seq r3
+ lcheckr3 0
+ svc r3
+ lcheckr3 1
+ svs r3
+ lcheckr3 0
+ spl r3
+ lcheckr3 1
+ smi r3
+ lcheckr3 0
+ sls r3
+ lcheckr3 0
+ shi r3
+ lcheckr3 1
+ sge r3
+ lcheckr3 1
+ slt r3
+ lcheckr3 0
+ sgt r3
+ lcheckr3 1
+ sle r3
+ lcheckr3 0
+ sa r3
+ lcheckr3 1
+ setf nzvc
+ scc r3
+ lcheckr3 0
+ scs r3
+ lcheckr3 1
+ sne r3
+ lcheckr3 0
+ svc r3
+ lcheckr3 0
+ svs r3
+ lcheckr3 1
+ spl r3
+ lcheckr3 0
+ smi r3
+ lcheckr3 1
+ sls r3
+ lcheckr3 1
+ shi r3
+ lcheckr3 0
+ sge r3
+ lcheckr3 1
+ slt r3
+ lcheckr3 0
+ sgt r3
+ lcheckr3 0
+ sle r3
+ lcheckr3 1
+ sa r3
+ lcheckr3 1
+ clearf n
+ sge r3
+ lcheckr3 0
+ slt r3
+ lcheckr3 1
+
+ .if 1 ;..asm.arch.cris.v32
+ setf p
+ ssb r3
+ .else
+ moveq 1,r3
+ .endif
+ lcheckr3 1
+
+ .if 1 ;..asm.arch.cris.v32
+ clearf p
+ ssb r3
+ .else
+ moveq 0,r3
+ .endif
+ lcheckr3 0
+
+ quit
diff --git a/tests/cris/check_stat1.c b/tests/cris/check_stat1.c
new file mode 100644
index 000000000..2e2cae51d
--- /dev/null
+++ b/tests/cris/check_stat1.c
@@ -0,0 +1,16 @@
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int main (void)
+{
+  struct stat buf;
+
+  if (stat (".", &buf) != 0
+      || !S_ISDIR (buf.st_mode))
+    abort ();
+  printf ("pass\n");
+  exit (0);
+}
diff --git a/tests/cris/check_stat2.c b/tests/cris/check_stat2.c
new file mode 100644
index 000000000..e36172ed2
--- /dev/null
+++ b/tests/cris/check_stat2.c
@@ -0,0 +1,20 @@
+/*
+#notarget: cris*-*-elf
+*/
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int main (void)
+{
+  struct stat buf;
+
+  if (lstat (".", &buf) != 0
+      || !S_ISDIR (buf.st_mode))
+    abort ();
+  printf ("pass\n");
+  exit (0);
+}
diff --git a/tests/cris/check_stat3.c b/tests/cris/check_stat3.c
new file mode 100644
index 000000000..a248ec086
--- /dev/null
+++ b/tests/cris/check_stat3.c
@@ -0,0 +1,26 @@
+/* Simulator options:
+#sim: --sysroot=@exedir@
+*/
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+int main (int argc, char *argv[])
+{
+  char path[1024] = "/";
+  struct stat buf;
+
+  strcat (path, argv[0]);
+  if (stat (".", &buf) != 0
+      || !S_ISDIR (buf.st_mode))
+    abort ();
+  if (stat (path, &buf) != 0
+      || !S_ISREG (buf.st_mode))
+    abort ();
+  printf ("pass\n");
+  exit (0);
+}
+
diff --git a/tests/cris/check_stat4.c b/tests/cris/check_stat4.c
new file mode 100644
index 000000000..d10655d40
--- /dev/null
+++ b/tests/cris/check_stat4.c
@@ -0,0 +1,28 @@
+/* Simulator options:
+#notarget: cris*-*-elf
+#sim: --sysroot=@exedir@
+*/
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+int main (int argc, char *argv[])
+{
+  char path[1024] = "/";
+  struct stat buf;
+
+  strcat (path, argv[0]);
+  if (lstat (".", &buf) != 0
+      || !S_ISDIR (buf.st_mode))
+    abort ();
+  if (lstat (path, &buf) != 0
+      || !S_ISREG (buf.st_mode))
+    abort ();
+  printf ("pass\n");
+  exit (0);
+}
+
diff --git a/tests/cris/check_subc.s b/tests/cris/check_subc.s
new file mode 100644
index 000000000..e34b5448e
--- /dev/null
+++ b/tests/cris/check_subc.s
@@ -0,0 +1,87 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 1\n1\n1fffe\nfffffffe\ncc463bdb\nffff0001\n1\nfffe\nfedafffe\n78133bdb\nffffff01\n1\nfe\nfeda49fe\n781344db\n85649200\n
+
+ .include "testutils.inc"
+ start
+
+ moveq -1,r3
+ sub.d -2,r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ moveq 2,r3
+ sub.d 1,r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ move.d 0xffff,r3
+ sub.d -0xffff,r3
+ test_cc 0 0 0 1
+ checkr3 1fffe
+
+ moveq -1,r3
+ sub.d 1,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+
+ move.d 0x78134452,r3
+ sub.d -0x5432f789,r3
+ test_cc 1 0 1 1
+ checkr3 cc463bdb
+
+ moveq -1,r3
+ sub.w -2,r3
+ test_cc 0 0 0 0
+ checkr3 ffff0001
+
+ moveq 2,r3
+ sub.w 1,r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ move.d 0xffff,r3
+ sub.w 1,r3
+ test_cc 1 0 0 0
+ checkr3 fffe
+
+ move.d 0xfedaffff,r3
+ sub.w 1,r3
+ test_cc 1 0 0 0
+ checkr3 fedafffe
+
+ move.d 0x78134452,r3
+ sub.w 0x877,r3
+ test_cc 0 0 0 0
+ checkr3 78133bdb
+
+ moveq -1,r3
+ sub.b -2,r3
+ test_cc 0 0 0 0
+ checkr3 ffffff01
+
+ moveq 2,r3
+ sub.b 1,r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ move.d 0xff,r3
+ sub.b 1,r3
+ test_cc 1 0 0 0
+ checkr3 fe
+
+ move.d 0xfeda49ff,r3
+ sub.b 1,r3
+ test_cc 1 0 0 0
+ checkr3 feda49fe
+
+ move.d 0x78134452,r3
+ sub.b 0x77,r3
+ test_cc 1 0 0 1
+ checkr3 781344db
+
+ move.d 0x85649282,r3
+ sub.b 0x82,r3
+ test_cc 0 1 0 0
+ checkr3 85649200
+
+ quit
diff --git a/tests/cris/check_subm.s b/tests/cris/check_subm.s
new file mode 100644
index 000000000..e07ea02dd
--- /dev/null
+++ b/tests/cris/check_subm.s
@@ -0,0 +1,96 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 1\n1\n1fffe\nfffffffe\ncc463bdb\nffff0001\n1\nfffe\nfedafffe\n78133bdb\nffffff01\n1\nfe\nfeda49fe\n781344db\n85649200\n
+
+ .include "testutils.inc"
+ .data
+x:
+ .dword -2,1,-0xffff,1,-0x5432f789
+ .word -2,1,1,0x877
+ .byte -2,1,0x77
+ .byte 0x22
+
+ start
+ moveq -1,r3
+ move.d x,r5
+ sub.d [r5+],r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ moveq 2,r3
+ sub.d [r5],r3
+ test_cc 0 0 0 0
+ addq 4,r5
+ checkr3 1
+
+ move.d 0xffff,r3
+ sub.d [r5+],r3
+ test_cc 0 0 0 1
+ checkr3 1fffe
+
+ moveq -1,r3
+ sub.d [r5+],r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+
+ move.d 0x78134452,r3
+ sub.d [r5+],r3
+ test_cc 1 0 1 1
+ checkr3 cc463bdb
+
+ moveq -1,r3
+ sub.w [r5+],r3
+ test_cc 0 0 0 0
+ checkr3 ffff0001
+
+ moveq 2,r3
+ sub.w [r5+],r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ move.d 0xffff,r3
+ sub.w [r5],r3
+ test_cc 1 0 0 0
+ checkr3 fffe
+
+ move.d 0xfedaffff,r3
+ sub.w [r5+],r3
+ test_cc 1 0 0 0
+ checkr3 fedafffe
+
+ move.d 0x78134452,r3
+ sub.w [r5+],r3
+ test_cc 0 0 0 0
+ checkr3 78133bdb
+
+ moveq -1,r3
+ sub.b [r5],r3
+ test_cc 0 0 0 0
+ addq 1,r5
+ checkr3 ffffff01
+
+ moveq 2,r3
+ sub.b [r5],r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ move.d 0xff,r3
+ sub.b [r5],r3
+ test_cc 1 0 0 0
+ checkr3 fe
+
+ move.d 0xfeda49ff,r3
+ sub.b [r5+],r3
+ test_cc 1 0 0 0
+ checkr3 feda49fe
+
+ move.d 0x78134452,r3
+ sub.b [r5+],r3
+ test_cc 1 0 0 1
+ checkr3 781344db
+
+ move.d 0x85649222,r3
+ sub.b [r5],r3
+ test_cc 0 1 0 0
+ checkr3 85649200
+
+ quit
diff --git a/tests/cris/check_subq.s b/tests/cris/check_subq.s
new file mode 100644
index 000000000..9e34fa31a
--- /dev/null
+++ b/tests/cris/check_subq.s
@@ -0,0 +1,52 @@
+# mach: crisv3 crisv8 crisv10 crisv32
+# output: 0\nffffffff\nfffffffe\nffff\nff\n56788f9\n56788d9\n567889a\n0\n7ffffffc\n
+
+ .include "testutils.inc"
+ start
+ moveq 1,r3
+ subq 1,r3
+ test_cc 0 1 0 0
+ checkr3 0
+
+ subq 1,r3
+ test_cc 1 0 0 1
+ checkr3 ffffffff
+
+ subq 1,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+
+ move.d 0x10000,r3
+ subq 1,r3
+ test_cc 0 0 0 0
+ checkr3 ffff
+
+ move.d 0x100,r3
+ subq 1,r3
+ test_cc 0 0 0 0
+ checkr3 ff
+
+ move.d 0x5678900,r3
+ subq 7,r3
+ test_cc 0 0 0 0
+ checkr3 56788f9
+
+ subq 32,r3
+ test_cc 0 0 0 0
+ checkr3 56788d9
+
+ subq 63,r3
+ test_cc 0 0 0 0
+ checkr3 567889a
+
+ move.d 34,r3
+ subq 34,r3
+ test_cc 0 1 0 0
+ checkr3 0
+
+ move.d 0x80000024,r3
+ subq 40,r3
+ test_cc 0 0 1 0
+ checkr3 7ffffffc
+
+ quit
diff --git a/tests/cris/check_subr.s b/tests/cris/check_subr.s
new file mode 100644
index 000000000..742fbc891
--- /dev/null
+++ b/tests/cris/check_subr.s
@@ -0,0 +1,102 @@
+# mach: crisv0 crisv3 crisv8 crisv10 crisv32
+# output: 1\n1\n1fffe\nfffffffe\ncc463bdb\nffff0001\n1\nfffe\nfedafffe\n78133bdb\nffffff01\n1\nfe\nfeda49fe\n781344db\n85649200\n
+
+ .include "testutils.inc"
+ start
+ moveq -1,r3
+ moveq -2,r4
+ sub.d r4,r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ moveq 2,r3
+ moveq 1,r4
+ sub.d r4,r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ move.d 0xffff,r3
+ move.d -0xffff,r4
+ sub.d r4,r3
+ test_cc 0 0 0 1
+ checkr3 1fffe
+
+ moveq 1,r4
+ moveq -1,r3
+ sub.d r4,r3
+ test_cc 1 0 0 0
+ checkr3 fffffffe
+
+ move.d -0x5432f789,r4
+ move.d 0x78134452,r3
+ sub.d r4,r3
+ test_cc 1 0 1 1
+ checkr3 cc463bdb
+
+ moveq -1,r3
+ moveq -2,r4
+ sub.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 ffff0001
+
+ moveq 2,r3
+ moveq 1,r4
+ sub.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ move.d 0xffff,r3
+ move.d -0xffff,r4
+ sub.w r4,r3
+ test_cc 1 0 0 0
+ checkr3 fffe
+
+ move.d 0xfedaffff,r3
+ move.d -0xfedaffff,r4
+ sub.w r4,r3
+ test_cc 1 0 0 0
+ checkr3 fedafffe
+
+ move.d -0x5432f789,r4
+ move.d 0x78134452,r3
+ sub.w r4,r3
+ test_cc 0 0 0 0
+ checkr3 78133bdb
+
+ moveq -1,r3
+ moveq -2,r4
+ sub.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 ffffff01
+
+ moveq 2,r3
+ moveq 1,r4
+ sub.b r4,r3
+ test_cc 0 0 0 0
+ checkr3 1
+
+ move.d -0xff,r4
+ move.d 0xff,r3
+ sub.b r4,r3
+ test_cc 1 0 0 0
+ checkr3 fe
+
+ move.d -0xfeda49ff,r4
+ move.d 0xfeda49ff,r3
+ sub.b r4,r3
+ test_cc 1 0 0 0
+ checkr3 feda49fe
+
+ move.d -0x5432f789,r4
+ move.d 0x78134452,r3
+ sub.b r4,r3
+ test_cc 1 0 0 1
+ checkr3 781344db
+
+ move.d 0x85649222,r3
+ move.d 0x77445622,r4
+ sub.b r4,r3
+ test_cc 0 1 0 0
+ checkr3 85649200
+
+ quit
diff --git a/tests/cris/check_swap.c b/tests/cris/check_swap.c
new file mode 100644
index 000000000..c1eac88e5
--- /dev/null
+++ b/tests/cris/check_swap.c
@@ -0,0 +1,75 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "sys.h"
+#include "crisutils.h"
+
+#define N 8
+#define W 4
+#define B 2
+#define R 1
+
+extern inline int cris_swap(const int mode, int x)
+{
+	switch (mode)
+	{
+		case N: asm ("swapn\t%0\n" : "+r" (x) : "0" (x)); break;
+		case W: asm ("swapw\t%0\n" : "+r" (x) : "0" (x)); break;
+		case B: asm ("swapb\t%0\n" : "+r" (x) : "0" (x)); break;
+		case R: asm ("swapr\t%0\n" : "+r" (x) : "0" (x)); break;
+		case B|R: asm ("swapbr\t%0\n" : "+r" (x) : "0" (x)); break;
+		case W|R: asm ("swapwr\t%0\n" : "+r" (x) : "0" (x)); break;
+		case W|B: asm ("swapwb\t%0\n" : "+r" (x) : "0" (x)); break;
+		case W|B|R: asm ("swapwbr\t%0\n" : "+r" (x) : "0" (x)); break;
+		case N|R: asm ("swapnr\t%0\n" : "+r" (x) : "0" (x)); break;
+		case N|B: asm ("swapnb\t%0\n" : "+r" (x) : "0" (x)); break;
+		case N|B|R: asm ("swapnbr\t%0\n" : "+r" (x) : "0" (x)); break;
+		case N|W: asm ("swapnw\t%0\n" : "+r" (x) : "0" (x)); break;
+		default:
+			err();
+			break;
+	}
+	return x;
+}
+
+/* Made this a macro to be able to pick up the location of the errors.  */
+#define verify_swap(mode, val, expected, n, z)          \
+do {                                                    \
+        int r;                                          \
+        cris_tst_cc_init();                             \
+	r = cris_swap(mode, val);                       \
+        cris_tst_mov_cc(n, z);                          \
+	if (r != expected)                              \
+		err();                                  \
+} while(0);
+
+void check_swap(void)
+{
+	/* Some of these numbers are borrowed from GDB's cris sim
+	   testsuite.  */
+	if (cris_swap(N, 0) != 0xffffffff)
+		err();
+	if (cris_swap(W, 0x12345678) != 0x56781234)
+		err();
+	if (cris_swap(B, 0x12345678) != 0x34127856)
+		err();
+
+	verify_swap(R, 0x78134452, 0x1ec8224a, 0, 0);
+	verify_swap(B, 0x78134452, 0x13785244, 0, 0);
+	verify_swap(B|R, 0x78134452, 0xc81e4a22, 1, 0);
+	verify_swap(W, 0x78134452, 0x44527813, 0, 0);
+	verify_swap(W|R, 0x78134452, 0x224a1ec8, 0, 0);
+	verify_swap(W|B|R, 0x78134452, 0x4a22c81e, 0, 0);
+	verify_swap(N, 0x78134452, 0x87ecbbad, 1, 0);
+	verify_swap(N|R, 0x78134452, 0xe137ddb5, 1, 0);
+	verify_swap(N|B, 0x78134452, 0xec87adbb, 1, 0);
+	verify_swap(N|B|R, 0x78134452, 0x37e1b5dd, 0, 0);
+	verify_swap(N|W, 0x78134452, 0xbbad87ec, 1, 0);
+	verify_swap(N|B|R, 0xffffffff, 0, 0, 1);
+}
+
+int main(void)
+{
+	check_swap();
+	pass();
+}
diff --git a/tests/cris/check_time1.c b/tests/cris/check_time1.c
new file mode 100644
index 000000000..3fcf0e153
--- /dev/null
+++ b/tests/cris/check_time1.c
@@ -0,0 +1,46 @@
+/* Basic time functionality test: check that milliseconds are
+   incremented for each syscall (does not work on host).  */
+#include <stdio.h>
+#include <time.h>
+#include <sys/time.h>
+#include <string.h>
+#include <stdlib.h>
+
+void err (const char *s)
+{
+  perror (s);
+  abort ();
+}
+
+int
+main (void)
+{
+  struct timeval t_m = {0, 0};
+  struct timezone t_z = {0, 0};
+  struct timeval t_m1 = {0, 0};
+  int i;
+
+  if (gettimeofday (&t_m, &t_z) != 0)
+    err ("gettimeofday");
+
+  for (i = 1; i < 10000; i++)
+    if (gettimeofday (&t_m1, NULL) != 0)
+      err ("gettimeofday 1");
+    else
+      if (t_m1.tv_sec * 1000000 + t_m1.tv_usec
+	  != (t_m.tv_sec * 1000000 + t_m.tv_usec + i * 1000))
+	{
+	  fprintf (stderr, "t0 (%ld, %ld), i %d, t1 (%ld, %ld)\n",
+		   t_m.tv_sec, t_m.tv_usec, i, t_m1.tv_sec, t_m1.tv_usec);
+	  abort ();
+	}
+
+  if (time (NULL) != t_m1.tv_sec)
+    {
+      fprintf (stderr, "time != gettod\n");
+      abort ();
+    }
+
+  printf ("pass\n");
+  exit (0);
+}
diff --git a/tests/cris/check_time2.c b/tests/cris/check_time2.c
new file mode 100644
index 000000000..20b69b4f6
--- /dev/null
+++ b/tests/cris/check_time2.c
@@ -0,0 +1,18 @@
+/* CB_SYS_time doesn't implement the Linux time syscall; the return
+   value isn't written to the argument.  */
+
+#include <time.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int
+main (void)
+{
+  time_t x = (time_t) -1;
+  time_t t = time (&x);
+
+  if (t == (time_t) -1 || t != x)
+    abort ();
+  printf ("pass\n");
+  exit (0);
+}
diff --git a/tests/cris/check_xarith.s b/tests/cris/check_xarith.s
new file mode 100644
index 000000000..d0356abed
--- /dev/null
+++ b/tests/cris/check_xarith.s
@@ -0,0 +1,46 @@
+
+.include "testutils.inc"
+
+	start
+
+	moveq	-1, $r0
+	moveq	0, $r1
+	addq	1, $r0
+	ax
+	addq	0, $r1
+
+	move.d	$r0, $r3
+	checkr3 0
+	move.d	$r1, $r3
+	checkr3 1
+
+	move.d  0, $r0
+	moveq	-1, $r1
+	subq	1, $r0
+	ax
+	subq	0, $r1
+
+	move.d	$r0, $r3
+	checkr3 ffffffff
+	move.d	$r1, $r3
+	checkr3 fffffffe
+
+
+	moveq	-1, $r0
+	moveq	-1, $r1
+	cmpq	-1, $r0
+	ax
+	cmpq	-1, $r1
+	beq	1f
+	nop
+	fail
+1:
+	cmpq	0, $r0
+	ax
+	cmpq	-1, $r1
+	bne	1f
+	nop
+	fail
+1:
+	pass
+	quit
diff --git a/tests/cris/crisutils.h b/tests/cris/crisutils.h
new file mode 100644
index 000000000..63c713897
--- /dev/null
+++ b/tests/cris/crisutils.h
@@ -0,0 +1,71 @@
+static char *tst_cc_loc = NULL;
+
+#define cris_tst_cc_init() \
+do { tst_cc_loc = "test_cc failed at " CURRENT_LOCATION; } while(0)
+
+/* We need a real symbol to signal error.  */
+static void _err(void) {
+	if (!tst_cc_loc)
+		tst_cc_loc = "tst_cc_failed\n";
+	_fail(tst_cc_loc);
+}
+
+extern inline void cris_tst_cc_n1(void)
+{
+	asm volatile ("bpl _err\n"
+		      "nop\n");
+}
+extern inline void cris_tst_cc_n0(void)
+{
+	asm volatile ("bmi _err\n"
+		      "nop\n");
+}
+
+extern inline void cris_tst_cc_z1(void)
+{
+	asm volatile ("bne _err\n"
+		      "nop\n");
+}
+extern inline void cris_tst_cc_z0(void)
+{
+	asm volatile ("beq _err\n"
+		      "nop\n");
+}
+extern inline void cris_tst_cc_v1(void)
+{
+	asm volatile ("bvc _err\n"
+		      "nop\n");
+}
+extern inline void cris_tst_cc_v0(void)
+{
+	asm volatile ("bvs _err\n"
+		      "nop\n");
+}
+
+extern inline void cris_tst_cc_c1(void)
+{
+	asm volatile ("bcc _err\n"
+		      "nop\n");
+}
+extern inline void cris_tst_cc_c0(void)
+{
+	asm volatile ("bcs _err\n"
+		      "nop\n");
+}
+
+extern inline void cris_tst_mov_cc(int n, int z)
+{
+	if (n) cris_tst_cc_n1(); else cris_tst_cc_n0();
+	if (z) cris_tst_cc_z1(); else cris_tst_cc_z0();
+	asm volatile ("" : : "g" (_err));
+}
+
+extern inline void cris_tst_cc(const int n, const int z,
+			       const int v, const int c)
+{
+	if (n) cris_tst_cc_n1(); else cris_tst_cc_n0();
+	if (z) cris_tst_cc_z1(); else cris_tst_cc_z0();
+	if (v) cris_tst_cc_v1(); else cris_tst_cc_v0();
+	if (c) cris_tst_cc_c1(); else cris_tst_cc_c0();
+	asm volatile ("" : : "g" (_err));
+}
diff --git a/tests/cris/crt.s b/tests/cris/crt.s
new file mode 100644
index 000000000..af027d747
--- /dev/null
+++ b/tests/cris/crt.s
@@ -0,0 +1,13 @@
+	.data
+_stack_start:
+	.space	8192, 0
+_stack_end:
+	.text
+	.global	_start
+_start:
+	move.d	_stack_end, $sp
+	jsr	main
+	nop
+	moveq	0, $r10
+	jump	exit
+	nop
diff --git a/tests/cris/sys.c b/tests/cris/sys.c
new file mode 100644
index 000000000..264ec06f3
--- /dev/null
+++ b/tests/cris/sys.c
@@ -0,0 +1,48 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+static inline int mystrlen(char *s) {
+	int i = 0;
+	while (s[i])
+		i++;
+	return i;
+}
+
+void pass(void) {
+	char s[] = "passed.\n";
+	write (1, s, sizeof (s) - 1);
+	exit (0);
+}
+
+void _fail(char *reason) {
+	char s[] = "failed: ";
+	int len = mystrlen(reason);
+	write (1, s, sizeof (s) - 1);
+	write (1, reason, len);
+	write (1, "\n", 1);
+//	exit (1);
+}
+
+void *memset (void *s, int c, size_t n) {
+	char *p = s;
+	int i;
+	for (i = 0; i < n; i++)
+		p[i] = c;
+	return p;
+}
+
+void exit (int status) {
+	asm volatile ("moveq 1, $r9\n" /* NR_exit.  */
+		      "break 13\n");
+	while(1)
+		;
+}
+
+ssize_t write (int fd, const void *buf, size_t count) {
+	int r;
+	asm volatile ("moveq 4, $r9\n" /* NR_write.  */
+		      "break 13\n" : : : "memory");
+	asm volatile ("move.d $r10, %0\n" : "=r" (r));
+	return r;
+}
diff --git a/tests/cris/sys.h b/tests/cris/sys.h
new file mode 100644
index 000000000..d2ed4ce75
--- /dev/null
+++ b/tests/cris/sys.h
@@ -0,0 +1,16 @@
+#include <unistd.h>
+
+#define STRINGIFY(x) #x
+#define TOSTRING(x) STRINGIFY(x)
+
+#define CURRENT_LOCATION __FILE__ ":" TOSTRING(__LINE__)
+
+#define err()                         \
+{                                     \
+  _fail("at " CURRENT_LOCATION " ");  \
+}
+
+#define mb() asm volatile ("" : : : "memory")
+
+extern void pass(void);
+extern void _fail(char *reason);
diff --git a/tests/cris/testutils.inc b/tests/cris/testutils.inc
new file mode 100644
index 000000000..4f434e1e4
--- /dev/null
+++ b/tests/cris/testutils.inc
@@ -0,0 +1,117 @@
+	.syntax	no_register_prefix
+
+	.macro	start
+	.text
+	.global	main
+main:
+	.endm
+
+	.macro	quit
+	jump	pass
+	nop
+	.endm
+
+	.macro	pass
+	jump	pass
+	nop
+	.endm
+
+	.macro	startnostack
+	start
+	.endm
+
+	.macro	fail
+	.data
+99:
+	.asciz " checkr3 failed"
+	.text
+	move.d	99b, $r10
+	jsr	_fail
+	nop
+	.endm
+
+	.macro	checkr3 val
+	cmp.d	0x\val, $r3
+	beq	100f
+	nop
+	.data
+99:
+	.asciz "checkr3 failed"
+	.text
+	move.d	99b, $r10
+	jsr	_fail
+	nop
+100:
+	.endm
+
+; Test the condition codes
+        .macro test_cc N Z V C
+        .if \N
+        bpl 9f
+        nop
+        .else
+        bmi 9f
+        nop
+        .endif
+        .if \Z
+        bne 9f
+        nop
+        .else
+        beq 9f
+        nop
+        .endif
+        .if \V
+        bvc 9f
+        nop
+        .else
+        bvs 9f
+        nop
+        .endif
+        .if \C
+        bcc 9f
+        nop
+        .else
+        bcs 9f
+        nop
+        .endif
+        ba 8f
+        nop
+9:
+	.data
+99:
+	.asciz "test_move_cc failed"
+	.text
+	move.d	99b, $r10
+	jsr	_fail
+	nop
+8:
+        .endm
+
+
+        .macro test_move_cc N Z V C
+        .if \N
+        bpl 9f
+        nop
+        .else
+        bmi 9f
+        nop
+        .endif
+        .if \Z
+        bne 9f
+        nop
+        .else
+        beq 9f
+        nop
+        .endif
+        ba 8f
+        nop
+9:
+	.data
+99:
+	.asciz "test_move_cc failed"
+	.text
+	move.d	99b, $r10
+	jsr	_fail
+	nop
+8:
+        .endm
diff --git a/tests/qruncom.c b/tests/qruncom.c
index ad0d938ee..7b25fcded 100644
--- a/tests/qruncom.c
+++ b/tests/qruncom.c
@@ -193,14 +193,11 @@ int main(int argc, char **argv)
         act.sa_sigaction = host_segv_handler;
         sigaction(SIGSEGV, &act, NULL);
         sigaction(SIGBUS, &act, NULL);
-#if defined (TARGET_I386) && defined(USE_CODE_COPY)
-        sigaction(SIGFPE, &act, NULL);
-#endif
     }
 
     //    cpu_set_log(CPU_LOG_TB_IN_ASM | CPU_LOG_TB_OUT_ASM | CPU_LOG_EXEC);
 
-    env = cpu_init();
+    env = cpu_init("qemu32");
 
     /* disable code copy to simplify debugging */
     code_copy_enabled = 0;
diff --git a/tests/test-i386.c b/tests/test-i386.c
index 2d4b0a0df..1cc34e3dc 100644
--- a/tests/test-i386.c
+++ b/tests/test-i386.c
@@ -703,8 +703,8 @@ union float64u {
     uint64_t l;
 };
 
-union float64u q_nan = { .l = 0xFFF8000000000000 };
-union float64u s_nan = { .l = 0xFFF0000000000000 };
+union float64u q_nan = { .l = 0xFFF8000000000000LL };
+union float64u s_nan = { .l = 0xFFF0000000000000LL };
 
 void test_fops(double a, double b)
 {
@@ -819,7 +819,9 @@ void test_fcvt(double a)
     /* test all roundings */
     asm volatile ("fstcw %0" : "=m" (fpuc));
     for(i=0;i<4;i++) {
-        asm volatile ("fldcw %0" : : "m" ((fpuc & ~0x0c00) | (i << 10)));
+        uint16_t val16;
+        val16 = (fpuc & ~0x0c00) | (i << 10);
+        asm volatile ("fldcw %0" : : "m" (val16));
         asm volatile ("fist %0" : "=m" (wa) : "t" (a));
         asm volatile ("fistl %0" : "=m" (ia) : "t" (a));
         asm volatile ("fistpll %0" : "=m" (lla) : "t" (a) : "st");
@@ -976,8 +978,8 @@ void test_floats(void)
     test_fcvt(1.0/0.0);
     test_fcvt(q_nan.d);
     test_fconst();
-    test_fbcd(1234567890123456);
-    test_fbcd(-123451234567890);
+    test_fbcd(1234567890123456.0);
+    test_fbcd(-123451234567890.0);
     test_fenv();
     if (TEST_CMOV) {
         test_fcmov();
@@ -1151,12 +1153,12 @@ void test_xchg(void)
         long i, eflags;
 
         for(i = 0; i < 2; i++) {
-            op0 = 0x123456789abcd;
+            op0 = 0x123456789abcdLL;
             if (i == 0)
-                op1 = 0xfbca765423456;
+                op1 = 0xfbca765423456LL;
             else
                 op1 = op0;
-            op2 = 0x6532432432434;
+            op2 = 0x6532432432434LL;
             asm("cmpxchg8b %1\n"
                 "pushf\n"
                 "pop %2\n"
@@ -1172,11 +1174,15 @@ void test_xchg(void)
 /**********************************************/
 /* segmentation tests */
 
+#include <sys/syscall.h>
+#include <unistd.h>
 #include <asm/ldt.h>
-#include <linux/unistd.h>
 #include <linux/version.h>
 
-_syscall3(int, modify_ldt, int, func, void *, ptr, unsigned long, bytecount)
+static inline int modify_ldt(int func, void * ptr, unsigned long bytecount)
+{
+    return syscall(__NR_modify_ldt, func, ptr, bytecount);
+}
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 66)
 #define modify_ldt_ldt_s user_desc
@@ -1505,13 +1511,10 @@ static inline void pushw(struct vm86_regs *r, int val)
     *(uint16_t *)seg_to_linear(r->ss, r->esp) = val;
 }
 
-#undef __syscall_return
-#define __syscall_return(type, res) \
-do { \
-	return (type) (res); \
-} while (0)
-
-_syscall2(int, vm86, int, func, struct vm86plus_struct *, v86)
+static inline int vm86(int func, struct vm86plus_struct *v86)
+{
+    return syscall(__NR_vm86, func, v86);
+}
 
 extern char vm86_code_start;
 extern char vm86_code_end;
diff --git a/thunk.c b/thunk.c
index dbeb2b1fc..7331aeb47 100644
--- a/thunk.c
+++ b/thunk.c
@@ -31,6 +31,8 @@
 /* XXX: make it dynamic */
 StructEntry struct_entries[MAX_STRUCTS];
 
+static const argtype *thunk_type_next_ptr(const argtype *type_ptr);
+
 static inline const argtype *thunk_type_next(const argtype *type_ptr)
 {
     int type;
@@ -47,9 +49,9 @@ static inline const argtype *thunk_type_next(const argtype *type_ptr)
     case TYPE_PTRVOID:
         return type_ptr;
     case TYPE_PTR:
-        return thunk_type_next(type_ptr);
+        return thunk_type_next_ptr(type_ptr);
     case TYPE_ARRAY:
-        return thunk_type_next(type_ptr + 1);
+        return thunk_type_next_ptr(type_ptr + 1);
     case TYPE_STRUCT:
         return type_ptr + 1;
     default:
@@ -57,6 +59,11 @@ static inline const argtype *thunk_type_next(const argtype *type_ptr)
     }
 }
 
+static const argtype *thunk_type_next_ptr(const argtype *type_ptr)
+{
+    return thunk_type_next(type_ptr);
+}
+
 void thunk_register_struct(int id, const char *name, const argtype *types)
 {
     const argtype *type_ptr;
@@ -136,22 +143,48 @@ const argtype *thunk_convert(void *dst, const void *src,
     case TYPE_ULONGLONG:
         *(uint64_t *)dst = tswap64(*(uint64_t *)src);
         break;
-#if HOST_LONG_BITS == 32 && TARGET_LONG_BITS == 32
+#if HOST_LONG_BITS == 32 && TARGET_ABI_BITS == 32
     case TYPE_LONG:
     case TYPE_ULONG:
     case TYPE_PTRVOID:
         *(uint32_t *)dst = tswap32(*(uint32_t *)src);
         break;
-#elif HOST_LONG_BITS == 64 && TARGET_LONG_BITS == 32
+#elif HOST_LONG_BITS == 64 && TARGET_ABI_BITS == 32
     case TYPE_LONG:
     case TYPE_ULONG:
     case TYPE_PTRVOID:
         if (to_host) {
-            *(uint64_t *)dst = tswap32(*(uint32_t *)src);
+            if (type == TYPE_LONG) {
+                /* sign extension */
+                *(uint64_t *)dst = (int32_t)tswap32(*(uint32_t *)src);
+            } else {
+                *(uint64_t *)dst = tswap32(*(uint32_t *)src);
+            }
         } else {
             *(uint32_t *)dst = tswap32(*(uint64_t *)src & 0xffffffff);
         }
         break;
+#elif HOST_LONG_BITS == 64 && TARGET_ABI_BITS == 64
+    case TYPE_LONG:
+    case TYPE_ULONG:
+    case TYPE_PTRVOID:
+        *(uint64_t *)dst = tswap64(*(uint64_t *)src);
+        break;
+#elif HOST_LONG_BITS == 32 && TARGET_ABI_BITS == 64
+    case TYPE_LONG:
+    case TYPE_ULONG:
+    case TYPE_PTRVOID:
+        if (to_host) {
+            *(uint32_t *)dst = tswap64(*(uint64_t *)src);
+        } else {
+            if (type == TYPE_LONG) {
+                /* sign extension */
+                *(uint64_t *)dst = tswap64(*(int32_t *)src);
+            } else {
+                *(uint64_t *)dst = tswap64(*(uint32_t *)src);
+            }
+        }
+        break;
 #else
 #warning unsupported conversion
 #endif
@@ -241,3 +274,15 @@ unsigned int host_to_target_bitmask(unsigned int alpha_mask,
     }
     return(x86_mask);
 }
+
+#ifndef NO_THUNK_TYPE_SIZE
+int thunk_type_size_array(const argtype *type_ptr, int is_host)
+{
+    return thunk_type_size(type_ptr, is_host);
+}
+
+int thunk_type_align_array(const argtype *type_ptr, int is_host)
+{
+    return thunk_type_align(type_ptr, is_host);
+}
+#endif /* ndef NO_THUNK_TYPE_SIZE */
diff --git a/thunk.h b/thunk.h
index 7811df397..d650fa4c1 100644
--- a/thunk.h
+++ b/thunk.h
@@ -75,6 +75,9 @@ const argtype *thunk_convert(void *dst, const void *src,
 
 extern StructEntry struct_entries[];
 
+int thunk_type_size_array(const argtype *type_ptr, int is_host);
+int thunk_type_align_array(const argtype *type_ptr, int is_host);
+
 static inline int thunk_type_size(const argtype *type_ptr, int is_host)
 {
     int type, size;
@@ -98,12 +101,12 @@ static inline int thunk_type_size(const argtype *type_ptr, int is_host)
         if (is_host) {
             return HOST_LONG_SIZE;
         } else {
-            return TARGET_LONG_SIZE;
+            return TARGET_ABI_BITS / 8;
         }
         break;
     case TYPE_ARRAY:
         size = type_ptr[1];
-        return size * thunk_type_size(type_ptr + 2, is_host);
+        return size * thunk_type_size_array(type_ptr + 2, is_host);
     case TYPE_STRUCT:
         se = struct_entries + type_ptr[1];
         return se->size[is_host];
@@ -135,11 +138,11 @@ static inline int thunk_type_align(const argtype *type_ptr, int is_host)
         if (is_host) {
             return HOST_LONG_SIZE;
         } else {
-            return TARGET_LONG_SIZE;
+            return TARGET_ABI_BITS / 8;
         }
         break;
     case TYPE_ARRAY:
-        return thunk_type_align(type_ptr + 2, is_host);
+        return thunk_type_align_array(type_ptr + 2, is_host);
     case TYPE_STRUCT:
         se = struct_entries + type_ptr[1];
         return se->align[is_host];
diff --git a/translate-all.c b/translate-all.c
index 197c48c54..d8b91023e 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -53,7 +53,7 @@ uint8_t gen_opc_cc_op[OPC_BUF_SIZE];
 #elif defined(TARGET_SPARC)
 target_ulong gen_opc_npc[OPC_BUF_SIZE];
 target_ulong gen_opc_jump_pc[2];
-#elif defined(TARGET_MIPS)
+#elif defined(TARGET_MIPS) || defined(TARGET_SH4)
 uint32_t gen_opc_hflags[OPC_BUF_SIZE];
 #endif
 
@@ -132,47 +132,52 @@ static void dyngen_labels(long *gen_labels, int nb_gen_labels,
     }
 }
 
+unsigned long code_gen_max_block_size(void)
+{
+    static unsigned long max;
+
+    if (max == 0) {
+#define DEF(s, n, copy_size) max = copy_size > max? copy_size : max;
+#include "opc.h"
+#undef DEF
+        max *= OPC_MAX_SIZE;
+    }
+
+    return max;
+}
+
 /* return non zero if the very first instruction is invalid so that
    the virtual CPU can trigger an exception.
 
    '*gen_code_size_ptr' contains the size of the generated code (host
    code).
 */
-int cpu_gen_code(CPUState *env, TranslationBlock *tb,
-                 int max_code_size, int *gen_code_size_ptr)
+int cpu_gen_code(CPUState *env, TranslationBlock *tb, int *gen_code_size_ptr)
 {
     uint8_t *gen_code_buf;
     int gen_code_size;
 
-#ifdef USE_CODE_COPY
-    if (code_copy_enabled &&
-        cpu_gen_code_copy(env, tb, max_code_size, &gen_code_size) == 0) {
-        /* nothing more to do */
-    } else
-#endif
-    {
-        if (gen_intermediate_code(env, tb) < 0)
-            return -1;
-
-        /* generate machine code */
-        tb->tb_next_offset[0] = 0xffff;
-        tb->tb_next_offset[1] = 0xffff;
-        gen_code_buf = tb->tc_ptr;
+    if (gen_intermediate_code(env, tb) < 0)
+        return -1;
+    
+    /* generate machine code */
+    tb->tb_next_offset[0] = 0xffff;
+    tb->tb_next_offset[1] = 0xffff;
+    gen_code_buf = tb->tc_ptr;
 #ifdef USE_DIRECT_JUMP
-        /* the following two entries are optional (only used for string ops) */
-        tb->tb_jmp_offset[2] = 0xffff;
-        tb->tb_jmp_offset[3] = 0xffff;
+    /* the following two entries are optional (only used for string ops) */
+    tb->tb_jmp_offset[2] = 0xffff;
+    tb->tb_jmp_offset[3] = 0xffff;
 #endif
-        dyngen_labels(gen_labels, nb_gen_labels, gen_code_buf, gen_opc_buf);
-
-        gen_code_size = dyngen_code(gen_code_buf, tb->tb_next_offset,
+    dyngen_labels(gen_labels, nb_gen_labels, gen_code_buf, gen_opc_buf);
+    
+    gen_code_size = dyngen_code(gen_code_buf, tb->tb_next_offset,
 #ifdef USE_DIRECT_JUMP
-                                    tb->tb_jmp_offset,
+                                tb->tb_jmp_offset,
 #else
-                                    NULL,
+                                NULL,
 #endif
-                                    gen_opc_buf, gen_opparam_buf, gen_labels);
-    }
+                                gen_opc_buf, gen_opparam_buf, gen_labels);
     *gen_code_size_ptr = gen_code_size;
 #ifdef DEBUG_DISAS
     if (loglevel & CPU_LOG_TB_OUT_ASM) {
@@ -195,11 +200,6 @@ int cpu_restore_state(TranslationBlock *tb,
     unsigned long tc_ptr;
     uint16_t *opc_ptr;
 
-#ifdef USE_CODE_COPY
-    if (tb->cflags & CF_CODE_COPY) {
-        return cpu_restore_state_copy(tb, env, searched_pc, puc);
-    }
-#endif
     if (gen_intermediate_code_pc(env, tb) < 0)
         return -1;
 
@@ -254,7 +254,7 @@ int cpu_restore_state(TranslationBlock *tb,
         if (npc == 1) {
             /* dynamic NPC: already stored */
         } else if (npc == 2) {
-            target_ulong t2 = (target_ulong)puc;
+            target_ulong t2 = (target_ulong)(unsigned long)puc;
             /* jump PC: use T2 and the jump targets of the translation */
             if (t2)
                 env->npc = gen_opc_jump_pc[0];
@@ -277,7 +277,8 @@ int cpu_restore_state(TranslationBlock *tb,
 #else
 #define CASE3(op)\
         case INDEX_op_ ## op ## _user:\
-        case INDEX_op_ ## op ## _kernel
+        case INDEX_op_ ## op ## _kernel:\
+        case INDEX_op_ ## op ## _hypv
 #endif
 
         CASE3(stfd):
@@ -310,6 +311,9 @@ int cpu_restore_state(TranslationBlock *tb,
     env->hflags |= gen_opc_hflags[j];
 #elif defined(TARGET_ALPHA)
     env->pc = gen_opc_pc[j];
+#elif defined(TARGET_SH4)
+    env->pc = gen_opc_pc[j];
+    env->flags = gen_opc_hflags[j];
 #endif
     return 0;
 }
diff --git a/translate-op.c b/translate-op.c
index 37c61e1b7..8104e86f2 100644
--- a/translate-op.c
+++ b/translate-op.c
@@ -24,6 +24,7 @@
 #include <inttypes.h>
 
 #include "config.h"
+#include "osdep.h"
 
 enum {
 #define DEF(s, n, copy_size) INDEX_op_ ## s,
@@ -33,5 +34,8 @@ enum {
 };
 
 #include "dyngen.h"
+extern int dyngen_code(uint8_t *gen_code_buf,
+                       uint16_t *label_offsets, uint16_t *jmp_offsets,
+                       const uint16_t *opc_buf, const uint32_t *opparam_buf, const long *gen_labels);
 #include "op.h"
 
diff --git a/usb-linux.c b/usb-linux.c
index 3a2330162..d3e4e2ef4 100644
--- a/usb-linux.c
+++ b/usb-linux.c
@@ -21,13 +21,16 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "hw/usb.h"
+#include "console.h"
 
 #if defined(__linux__)
 #include <dirent.h>
 #include <sys/ioctl.h>
 #include <linux/usbdevice_fs.h>
 #include <linux/version.h>
+#include <signal.h>
 
 /* We redefine it to avoid version problems */
 struct usb_ctrltransfer {
@@ -48,15 +51,171 @@ static int usb_host_find_device(int *pbus_num, int *paddr,
                                 const char *devname);
 
 //#define DEBUG
+//#define DEBUG_ISOCH
+//#define USE_ASYNCIO
 
 #define USBDEVFS_PATH "/proc/bus/usb"
 #define PRODUCT_NAME_SZ 32
+#define SIG_ISOCOMPLETE (SIGRTMIN+7)
+#define MAX_ENDPOINTS 16
 
+struct sigaction sigact;
+
+/* endpoint association data */
+struct endp_data {
+    uint8_t type;
+};
+
+/* FIXME: move USBPacket to PendingURB */
 typedef struct USBHostDevice {
     USBDevice dev;
     int fd;
+    int pipe_fds[2];
+    USBPacket *packet;
+    struct endp_data endp_table[MAX_ENDPOINTS];
+    int configuration;
+    uint8_t descr[1024];
+    int descr_len;
+    int urbs_ready;
 } USBHostDevice;
 
+typedef struct PendingURB {
+    struct usbdevfs_urb *urb;
+    int status;
+    struct PendingURB *next;
+} PendingURB;
+
+static PendingURB *pending_urbs = NULL;
+
+static int add_pending_urb(struct usbdevfs_urb *urb)
+{
+    PendingURB *purb = qemu_mallocz(sizeof(PendingURB));
+    if (purb) {
+        purb->urb = urb;
+        purb->status = 0;
+        purb->next = pending_urbs;
+        pending_urbs = purb;
+        return 1;
+    }
+    return 0;
+}
+
+static int del_pending_urb(struct usbdevfs_urb *urb)
+{
+    PendingURB *purb = pending_urbs;
+    PendingURB *prev = NULL;
+
+    while (purb && purb->urb != urb) {
+        prev = purb;
+        purb = purb->next;
+    }
+
+    if (purb && purb->urb == urb) {
+        if (prev) {
+            prev->next = purb->next;
+        } else {
+            pending_urbs = purb->next;
+        }
+        qemu_free(purb);
+        return 1;
+    }
+    return 0;
+}
+
+#ifdef USE_ASYNCIO
+static PendingURB *get_pending_urb(struct usbdevfs_urb *urb)
+{
+    PendingURB *purb = pending_urbs;
+
+    while (purb && purb->urb != urb) {
+        purb = purb->next;
+    }
+
+    if (purb && purb->urb == urb) {
+        return purb;
+    }
+    return NULL;
+}
+#endif
+
+static int usb_host_update_interfaces(USBHostDevice *dev, int configuration)
+{
+    int dev_descr_len, config_descr_len;
+    int interface, nb_interfaces, nb_configurations;
+    int ret, i;
+
+    if (configuration == 0) /* address state - ignore */
+        return 1;
+
+    i = 0;
+    dev_descr_len = dev->descr[0];
+    if (dev_descr_len > dev->descr_len)
+        goto fail;
+    nb_configurations = dev->descr[17];
+
+    i += dev_descr_len;
+    while (i < dev->descr_len) {
+#ifdef DEBUG
+        printf("i is %d, descr_len is %d, dl %d, dt %d\n", i, dev->descr_len,
+               dev->descr[i], dev->descr[i+1]);
+#endif
+        if (dev->descr[i+1] != USB_DT_CONFIG) {
+            i += dev->descr[i];
+            continue;
+        }
+        config_descr_len = dev->descr[i];
+
+        if (configuration == dev->descr[i + 5])
+            break;
+
+        i += config_descr_len;
+    }
+
+    if (i >= dev->descr_len) {
+        printf("usb_host: error - device has no matching configuration\n");
+        goto fail;
+    }
+    nb_interfaces = dev->descr[i + 4];
+
+#ifdef USBDEVFS_DISCONNECT
+    /* earlier Linux 2.4 do not support that */
+    {
+        struct usbdevfs_ioctl ctrl;
+        for (interface = 0; interface < nb_interfaces; interface++) {
+            ctrl.ioctl_code = USBDEVFS_DISCONNECT;
+            ctrl.ifno = interface;
+            ret = ioctl(dev->fd, USBDEVFS_IOCTL, &ctrl);
+            if (ret < 0 && errno != ENODATA) {
+                perror("USBDEVFS_DISCONNECT");
+                goto fail;
+            }
+        }
+    }
+#endif
+
+    /* XXX: only grab if all interfaces are free */
+    for (interface = 0; interface < nb_interfaces; interface++) {
+        ret = ioctl(dev->fd, USBDEVFS_CLAIMINTERFACE, &interface);
+        if (ret < 0) {
+            if (errno == EBUSY) {
+                fprintf(stderr,
+                        "usb_host: warning - device already grabbed\n");
+            } else {
+                perror("USBDEVFS_CLAIMINTERFACE");
+            }
+        fail:
+            return 0;
+        }
+    }
+
+#ifdef DEBUG
+    printf("usb_host: %d interfaces claimed for configuration %d\n",
+           nb_interfaces, configuration);
+#endif
+
+    return 1;
+}
+
 static void usb_host_handle_reset(USBDevice *dev)
 {
 #if 0
@@ -76,6 +235,8 @@ static void usb_host_handle_destroy(USBDevice *dev)
     qemu_free(s);
 }
 
+static int usb_linux_update_endp_table(USBHostDevice *s);
+
 static int usb_host_handle_control(USBDevice *dev,
                                    int request,
                                    int value,
@@ -85,13 +246,33 @@ static int usb_host_handle_control(USBDevice *dev,
 {
     USBHostDevice *s = (USBHostDevice *)dev;
     struct usb_ctrltransfer ct;
+    struct usbdevfs_setinterface si;
+    int intf_update_required = 0;
     int ret;
 
     if (request == (DeviceOutRequest | USB_REQ_SET_ADDRESS)) {
         /* specific SET_ADDRESS support */
         dev->addr = value;
         return 0;
+    } else if (request == ((USB_RECIP_INTERFACE << 8) |
+                           USB_REQ_SET_INTERFACE)) {
+        /* set alternate setting for the interface */
+        si.interface = index;
+        si.altsetting = value;
+        ret = ioctl(s->fd, USBDEVFS_SETINTERFACE, &si);
+        usb_linux_update_endp_table(s);
+    } else if (request == (DeviceOutRequest | USB_REQ_SET_CONFIGURATION)) {
+#ifdef DEBUG
+        printf("usb_host_handle_control: SET_CONFIGURATION request - "
+               "config %d\n", value & 0xff);
+#endif
+        if (s->configuration != (value & 0xff)) {
+            s->configuration = (value & 0xff);
+            intf_update_required = 1;
+        }
+        goto do_request;
     } else {
+    do_request:
         ct.bRequestType = request >> 8;
         ct.bRequest = request;
         ct.wValue = value;
@@ -100,19 +281,28 @@ static int usb_host_handle_control(USBDevice *dev,
         ct.timeout = 50;
         ct.data = data;
         ret = ioctl(s->fd, USBDEVFS_CONTROL, &ct);
-        if (ret < 0) {
-            switch(errno) {
-            case ETIMEDOUT:
-                return USB_RET_NAK;
-            default:
-                return USB_RET_STALL;
-            }
-        } else {
-            return ret;
+    }
+
+    if (ret < 0) {
+        switch(errno) {
+        case ETIMEDOUT:
+            return USB_RET_NAK;
+        default:
+            return USB_RET_STALL;
+        }
+    } else {
+        if (intf_update_required) {
+#ifdef DEBUG
+            printf("usb_host_handle_control: updating interfaces\n");
+#endif
+            usb_host_update_interfaces(s, value & 0xff);
         }
-   }
+        return ret;
+    }
 }
 
+static int usb_host_handle_isoch(USBDevice *dev, USBPacket *p);
+
 static int usb_host_handle_data(USBDevice *dev, USBPacket *p)
 {
     USBHostDevice *s = (USBHostDevice *)dev;
@@ -120,6 +310,10 @@ static int usb_host_handle_data(USBDevice *dev, USBPacket *p)
     int ret;
     uint8_t devep = p->devep;
 
+    if (s->endp_table[p->devep - 1].type == USBDEVFS_URB_TYPE_ISO) {
+        return usb_host_handle_isoch(dev, p);
+    }
+
     /* XXX: optimize and handle all data types by looking at the
        config descriptor */
     if (p->pid == USB_TOKEN_IN)
@@ -145,18 +339,278 @@ static int usb_host_handle_data(USBDevice *dev, USBPacket *p)
     }
 }
 
+#ifdef USE_ASYNCIO
+static void urb_completion_pipe_read(void *opaque)
+{
+    USBHostDevice *s = opaque;
+    USBPacket *p = s->packet;
+    PendingURB *pending_urb = NULL;
+    struct usbdevfs_urb *purb = NULL;
+    int len, ret;
+
+    len = read(s->pipe_fds[0], &pending_urb, sizeof(pending_urb));
+    if (len != sizeof(pending_urb)) {
+        printf("urb_completion: error reading pending_urb, len=%d\n", len);
+        return;
+    }
+
+    /* FIXME: handle pending_urb->status */
+    del_pending_urb(pending_urb->urb);
+
+    if (!p) {
+        s->urbs_ready++;
+        return;
+    }
+
+    ret = ioctl(s->fd, USBDEVFS_REAPURBNDELAY, &purb);
+    if (ret < 0) {
+        printf("urb_completion: REAPURBNDELAY ioctl=%d errno=%d\n",
+               ret, errno);
+        return;
+    }
+
+#ifdef DEBUG_ISOCH
+    if (purb == pending_urb->urb) {
+        printf("urb_completion: urb mismatch reaped=%p pending=%p\n",
+               purb, urb);
+    }
+#endif
+
+    p->len = purb->actual_length;
+    usb_packet_complete(p);
+    qemu_free(purb);
+    s->packet = NULL;
+}
+
+static void isoch_done(int signum, siginfo_t *info, void *context)
+{
+    struct usbdevfs_urb *urb = (struct usbdevfs_urb *)info->si_addr;
+    USBHostDevice *s = (USBHostDevice *)urb->usercontext;
+    PendingURB *purb;
+
+    if (info->si_code != SI_ASYNCIO ||
+        info->si_signo != SIG_ISOCOMPLETE) {
+        return;
+    }
+
+    purb = get_pending_urb(urb);
+    if (purb) {
+        purb->status = info->si_errno;
+        write(s->pipe_fds[1], &purb, sizeof(purb));
+    }
+}
+#endif
+
+static int usb_host_handle_isoch(USBDevice *dev, USBPacket *p)
+{
+    USBHostDevice *s = (USBHostDevice *)dev;
+    struct usbdevfs_urb *urb, *purb = NULL;
+    int ret;
+    uint8_t devep = p->devep;
+
+    if (p->pid == USB_TOKEN_IN)
+        devep |= 0x80;
+
+    urb = qemu_mallocz(sizeof(struct usbdevfs_urb) +
+                       sizeof(struct usbdevfs_iso_packet_desc));
+    if (!urb) {
+        printf("usb_host_handle_isoch: malloc failed\n");
+        return 0;
+    }
+
+    urb->type = USBDEVFS_URB_TYPE_ISO;
+    urb->endpoint = devep;
+    urb->status = 0;
+    urb->flags = USBDEVFS_URB_ISO_ASAP;
+    urb->buffer = p->data;
+    urb->buffer_length = p->len;
+    urb->actual_length = 0;
+    urb->start_frame = 0;
+    urb->error_count = 0;
+#ifdef USE_ASYNCIO
+    urb->signr = SIG_ISOCOMPLETE;
+#else
+    urb->signr = 0;
+#endif
+    urb->usercontext = s;
+    urb->number_of_packets = 1;
+    urb->iso_frame_desc[0].length = p->len;
+    urb->iso_frame_desc[0].actual_length = 0;
+    urb->iso_frame_desc[0].status = 0;
+    ret = ioctl(s->fd, USBDEVFS_SUBMITURB, urb);
+    if (ret == 0) {
+        if (!add_pending_urb(urb)) {
+            printf("usb_host_handle_isoch: add_pending_urb failed %p\n", urb);
+        }
+    } else {
+        printf("usb_host_handle_isoch: SUBMITURB ioctl=%d errno=%d\n",
+               ret, errno);
+        qemu_free(urb);
+        switch(errno) {
+        case ETIMEDOUT:
+            return USB_RET_NAK;
+        case EPIPE:
+        default:
+            return USB_RET_STALL;
+        }
+    }
+#ifdef USE_ASYNCIO
+    /* FIXME: handle urbs_ready together with sync io
+     * workaround for injecting the signaled urbs into current frame */
+    if (s->urbs_ready > 0) {
+        ret = ioctl(s->fd, USBDEVFS_REAPURBNDELAY, &purb);
+        if (ret == 0) {
+            ret = purb->actual_length;
+            qemu_free(purb);
+            s->urbs_ready--;
+        }
+        return ret;
+    }
+    s->packet = p;
+    return USB_RET_ASYNC;
+#else
+    ret = ioctl(s->fd, USBDEVFS_REAPURBNDELAY, &purb);
+    if (ret == 0) {
+        if (del_pending_urb(purb)) {
+            ret = purb->actual_length;
+            qemu_free(purb);
+        } else {
+            printf("usb_host_handle_isoch: del_pending_urb failed %p\n", purb);
+        }
+    } else {
+#ifdef DEBUG_ISOCH
+        printf("usb_host_handle_isoch: REAPURBNDELAY ioctl=%d errno=%d\n",
+               ret, errno);
+#endif
+    }
+    return ret;
+#endif
+}
+
+/* returns 1 on problem encountered or 0 for success */
+static int usb_linux_update_endp_table(USBHostDevice *s)
+{
+    uint8_t *descriptors;
+    uint8_t devep, type, configuration, alt_interface;
+    struct usb_ctrltransfer ct;
+    int interface, ret, length, i;
+
+    ct.bRequestType = USB_DIR_IN;
+    ct.bRequest = USB_REQ_GET_CONFIGURATION;
+    ct.wValue = 0;
+    ct.wIndex = 0;
+    ct.wLength = 1;
+    ct.data = &configuration;
+    ct.timeout = 50;
+
+    ret = ioctl(s->fd, USBDEVFS_CONTROL, &ct);
+    if (ret < 0) {
+        perror("usb_linux_update_endp_table");
+        return 1;
+    }
+
+    /* in address state */
+    if (configuration == 0)
+        return 1;
+
+    /* get the desired configuration, interface, and endpoint descriptors
+     * from device description */
+    descriptors = &s->descr[18];
+    length = s->descr_len - 18;
+    i = 0;
+
+    if (descriptors[i + 1] != USB_DT_CONFIG ||
+        descriptors[i + 5] != configuration) {
+        printf("invalid descriptor data - configuration\n");
+        return 1;
+    }
+    i += descriptors[i];
+
+    while (i < length) {
+        if (descriptors[i + 1] != USB_DT_INTERFACE ||
+            (descriptors[i + 1] == USB_DT_INTERFACE &&
+             descriptors[i + 4] == 0)) {
+            i += descriptors[i];
+            continue;
+        }
+
+        interface = descriptors[i + 2];
+
+        ct.bRequestType = USB_DIR_IN | USB_RECIP_INTERFACE;
+        ct.bRequest = USB_REQ_GET_INTERFACE;
+        ct.wValue = 0;
+        ct.wIndex = interface;
+        ct.wLength = 1;
+        ct.data = &alt_interface;
+        ct.timeout = 50;
+
+        ret = ioctl(s->fd, USBDEVFS_CONTROL, &ct);
+        if (ret < 0) {
+            perror("usb_linux_update_endp_table");
+            return 1;
+        }
+
+        /* the current interface descriptor is the active interface
+         * and has endpoints */
+        if (descriptors[i + 3] != alt_interface) {
+            i += descriptors[i];
+            continue;
+        }
+
+        /* advance to the endpoints */
+        while (i < length && descriptors[i +1] != USB_DT_ENDPOINT)
+            i += descriptors[i];
+
+        if (i >= length)
+            break;
+
+        while (i < length) {
+            if (descriptors[i + 1] != USB_DT_ENDPOINT)
+                break;
+
+            devep = descriptors[i + 2];
+            switch (descriptors[i + 3] & 0x3) {
+            case 0x00:
+                type = USBDEVFS_URB_TYPE_CONTROL;
+                break;
+            case 0x01:
+                type = USBDEVFS_URB_TYPE_ISO;
+                break;
+            case 0x02:
+                type = USBDEVFS_URB_TYPE_BULK;
+                break;
+            case 0x03:
+                type = USBDEVFS_URB_TYPE_INTERRUPT;
+                break;
+            default:
+                printf("usb_host: malformed endpoint type\n");
+                type = USBDEVFS_URB_TYPE_BULK;
+            }
+            s->endp_table[(devep & 0xf) - 1].type = type;
+
+            i += descriptors[i];
+        }
+    }
+    return 0;
+}
+
 /* XXX: exclude high speed devices or implement EHCI */
 USBDevice *usb_host_device_open(const char *devname)
 {
-    int fd, interface, ret, i;
-    USBHostDevice *dev;
+    int fd = -1, ret;
+    USBHostDevice *dev = NULL;
     struct usbdevfs_connectinfo ci;
-    uint8_t descr[1024];
     char buf[1024];
-    int descr_len, dev_descr_len, config_descr_len, nb_interfaces;
     int bus_num, addr;
     char product_name[PRODUCT_NAME_SZ];
 
+    dev = qemu_mallocz(sizeof(USBHostDevice));
+    if (!dev)
+        goto fail;
+
+#ifdef DEBUG_ISOCH
+    printf("usb_host_device_open %s\n", devname);
+#endif
     if (usb_host_find_device(&bus_num, &addr,
                              product_name, sizeof(product_name),
                              devname) < 0)
@@ -164,65 +618,39 @@ USBDevice *usb_host_device_open(const char *devname)
 
     snprintf(buf, sizeof(buf), USBDEVFS_PATH "/%03d/%03d",
              bus_num, addr);
-    fd = open(buf, O_RDWR);
+    fd = open(buf, O_RDWR | O_NONBLOCK);
     if (fd < 0) {
         perror(buf);
         return NULL;
     }
 
-    /* read the config description */
-    descr_len = read(fd, descr, sizeof(descr));
-    if (descr_len <= 0) {
-        perror("read descr");
+    /* read the device description */
+    dev->descr_len = read(fd, dev->descr, sizeof(dev->descr));
+    if (dev->descr_len <= 0) {
+        perror("usb_host_device_open: reading device data failed");
         goto fail;
     }
 
-    i = 0;
-    dev_descr_len = descr[0];
-    if (dev_descr_len > descr_len)
-        goto fail;
-    i += dev_descr_len;
-    config_descr_len = descr[i];
-    if (i + config_descr_len > descr_len)
-        goto fail;
-    nb_interfaces = descr[i + 4];
-    if (nb_interfaces != 1) {
-        /* NOTE: currently we grab only one interface */
-        fprintf(stderr, "usb_host: only one interface supported\n");
-        goto fail;
-    }
-
-#ifdef USBDEVFS_DISCONNECT
-    /* earlier Linux 2.4 do not support that */
+#ifdef DEBUG
     {
-        struct usbdevfs_ioctl ctrl;
-        ctrl.ioctl_code = USBDEVFS_DISCONNECT;
-        ctrl.ifno = 0;
-        ret = ioctl(fd, USBDEVFS_IOCTL, &ctrl);
-        if (ret < 0 && errno != ENODATA) {
-            perror("USBDEVFS_DISCONNECT");
-            goto fail;
-        }
+        int x;
+        printf("=== begin dumping device descriptor data ===\n");
+        for (x = 0; x < dev->descr_len; x++)
+            printf("%02x ", dev->descr[x]);
+        printf("\n=== end dumping device descriptor data ===\n");
     }
 #endif
 
-    /* XXX: only grab if all interfaces are free */
-    interface = 0;
-    ret = ioctl(fd, USBDEVFS_CLAIMINTERFACE, &interface);
-    if (ret < 0) {
-        if (errno == EBUSY) {
-            fprintf(stderr, "usb_host: device already grabbed\n");
-        } else {
-            perror("USBDEVFS_CLAIMINTERFACE");
-        }
-    fail:
-        close(fd);
-        return NULL;
-    }
+    dev->fd = fd;
+    dev->configuration = 1;
+
+    /* XXX - do something about initial configuration */
+    if (!usb_host_update_interfaces(dev, 1))
+        goto fail;
 
     ret = ioctl(fd, USBDEVFS_CONNECTINFO, &ci);
     if (ret < 0) {
-        perror("USBDEVFS_CONNECTINFO");
+        perror("usb_host_device_open: USBDEVFS_CONNECTINFO");
         goto fail;
     }
 
@@ -230,10 +658,10 @@ USBDevice *usb_host_device_open(const char *devname)
     printf("host USB device %d.%d grabbed\n", bus_num, addr);
 #endif
 
-    dev = qemu_mallocz(sizeof(USBHostDevice));
-    if (!dev)
+    ret = usb_linux_update_endp_table(dev);
+    if (ret)
         goto fail;
-    dev->fd = fd;
+
     if (ci.slow)
         dev->dev.speed = USB_SPEED_LOW;
     else
@@ -252,7 +680,33 @@ USBDevice *usb_host_device_open(const char *devname)
         pstrcpy(dev->dev.devname, sizeof(dev->dev.devname),
                 product_name);
 
+#ifdef USE_ASYNCIO
+    /* set up the signal handlers */
+    sigemptyset(&sigact.sa_mask);
+    sigact.sa_sigaction = isoch_done;
+    sigact.sa_flags = SA_SIGINFO;
+    sigact.sa_restorer = 0;
+    ret = sigaction(SIG_ISOCOMPLETE, &sigact, NULL);
+    if (ret < 0) {
+        perror("usb_host_device_open: sigaction failed");
+        goto fail;
+    }
+
+    if (pipe(dev->pipe_fds) < 0) {
+        perror("usb_host_device_open: pipe creation failed");
+        goto fail;
+    }
+    fcntl(dev->pipe_fds[0], F_SETFL, O_NONBLOCK | O_ASYNC);
+    fcntl(dev->pipe_fds[1], F_SETFL, O_NONBLOCK);
+    qemu_set_fd_handler(dev->pipe_fds[0], urb_completion_pipe_read, NULL, dev);
+#endif
+    dev->urbs_ready = 0;
     return (USBDevice *)dev;
+fail:
+    if (dev)
+        qemu_free(dev);
+    close(fd);
+    return NULL;
 }
 
 static int get_tag_value(char *buf, int buf_size,
@@ -438,7 +892,7 @@ static const struct usb_class_info usb_class_info[] = {
     { USB_CLASS_APP_SPEC, "Application Specific" },
     { USB_CLASS_VENDOR_SPEC, "Vendor Specific" },
     { USB_CLASS_STILL_IMAGE, "Still Image" },
-    { USB_CLASS_CSCID, 	"Smart Card" },
+    { USB_CLASS_CSCID, "Smart Card" },
     { USB_CLASS_CONTENT_SEC, "Content Security" },
     { -1, NULL }
 };
@@ -453,10 +907,10 @@ static const char *usb_class_str(uint8_t class)
     return p->class_name;
 }
 
-void usb_info_device(int bus_num, int addr, int class_id,
-                     int vendor_id, int product_id,
-                     const char *product_name,
-                     int speed)
+static void usb_info_device(int bus_num, int addr, int class_id,
+                            int vendor_id, int product_id,
+                            const char *product_name,
+                            int speed)
 {
     const char *class_str, *speed_str;
 
diff --git a/vl.c b/vl.c
index 80ceb2f76..28805a6cd 100644
--- a/vl.c
+++ b/vl.c
@@ -21,7 +21,23 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw/hw.h"
+#include "hw/boards.h"
+#include "hw/usb.h"
+#include "hw/pcmcia.h"
+#include "hw/pc.h"
+#include "hw/fdc.h"
+#include "hw/audiodev.h"
+#include "hw/isa.h"
+#include "net.h"
+#include "console.h"
+#include "sysemu.h"
+#include "gdbstub.h"
+#include "qemu-timer.h"
+#include "qemu-char.h"
+#include "block.h"
+#include "audio/audio.h"
+#include "qemu-kvm.h"
 
 #include <unistd.h>
 #include <fcntl.h>
@@ -121,6 +137,7 @@ int inet_aton(const char *cp, struct in_addr *ia);
 #endif
 
 #define DEFAULT_NETWORK_SCRIPT "/etc/qemu-ifup"
+#define DEFAULT_NETWORK_DOWN_SCRIPT "/etc/qemu-ifdown"
 #ifdef __sun__
 #define SMBD_COMMAND "/usr/sfw/sbin/smbd"
 #else
@@ -151,16 +168,14 @@ int inet_aton(const char *cp, struct in_addr *ia);
 #define MAX_IOPORTS 65536
 
 const char *bios_dir = CONFIG_QEMU_SHAREDIR;
-char phys_ram_file[1024];
+const char *bios_name = NULL;
 void *ioport_opaque[MAX_IOPORTS];
 IOPortReadFunc *ioport_read_table[3][MAX_IOPORTS];
 IOPortWriteFunc *ioport_write_table[3][MAX_IOPORTS];
-/* Note: bs_table[MAX_DISKS] is a dummy block driver if none available
+/* Note: drives_table[MAX_DRIVES] is a dummy block driver if none available
    to store the VM snapshots */
-BlockDriverState *bs_table[MAX_DISKS + 1], *fd_table[MAX_FD];
-BlockDriverState *pflash_table[MAX_PFLASH];
-BlockDriverState *sd_bdrv;
-BlockDriverState *mtd_bdrv;
+DriveInfo drives_table[MAX_DRIVES+1];
+int nb_drives;
 /* point to the block driver where the snapshots are managed */
 BlockDriverState *bs_snapshots;
 int vga_ram_size;
@@ -168,13 +183,13 @@ static DisplayState display_state;
 int nographic;
 const char* keyboard_layout = NULL;
 int64_t ticks_per_sec;
-int boot_device = 'c';
 int64_t ram_size;
 int pit_min_timer_count = 0;
 int nb_nics;
 NICInfo nd_table[MAX_NICS];
 int vm_running;
 int rtc_utc = 1;
+int rtc_start_date = -1; /* -1 means now */
 int cirrus_vga_enabled = 1;
 int vmsvga_enabled = 0;
 #ifdef TARGET_SPARC
@@ -230,6 +245,12 @@ int alt_grab = 0;
 unsigned int nb_prom_envs = 0;
 const char *prom_envs[MAX_PROM_ENVS];
 #endif
+int nb_drives_opt;
+char drives_opt[MAX_DRIVES][1024];
+
+static CPUState *cur_cpu;
+static CPUState *next_cpu;
+static int event_pending = 1;
 
 #define TFR(expr) do { if ((expr) != -1) break; } while (errno == EINTR)
 
@@ -239,7 +260,7 @@ const char *prom_envs[MAX_PROM_ENVS];
 target_phys_addr_t isa_mem_base = 0;
 PicState2 *isa_pic;
 
-uint32_t default_ioport_readb(void *opaque, uint32_t address)
+static uint32_t default_ioport_readb(void *opaque, uint32_t address)
 {
 #ifdef DEBUG_UNUSED_IOPORT
     fprintf(stderr, "unused inb: port=0x%04x\n", address);
@@ -247,7 +268,7 @@ uint32_t default_ioport_readb(void *opaque, uint32_t address)
     return 0xff;
 }
 
-void default_ioport_writeb(void *opaque, uint32_t address, uint32_t data)
+static void default_ioport_writeb(void *opaque, uint32_t address, uint32_t data)
 {
 #ifdef DEBUG_UNUSED_IOPORT
     fprintf(stderr, "unused outb: port=0x%04x data=0x%02x\n", address, data);
@@ -255,7 +276,7 @@ void default_ioport_writeb(void *opaque, uint32_t address, uint32_t data)
 }
 
 /* default is to make two byte accesses */
-uint32_t default_ioport_readw(void *opaque, uint32_t address)
+static uint32_t default_ioport_readw(void *opaque, uint32_t address)
 {
     uint32_t data;
     data = ioport_read_table[0][address](ioport_opaque[address], address);
@@ -264,14 +285,14 @@ uint32_t default_ioport_readw(void *opaque, uint32_t address)
     return data;
 }
 
-void default_ioport_writew(void *opaque, uint32_t address, uint32_t data)
+static void default_ioport_writew(void *opaque, uint32_t address, uint32_t data)
 {
     ioport_write_table[0][address](ioport_opaque[address], address, data & 0xff);
     address = (address + 1) & (MAX_IOPORTS - 1);
     ioport_write_table[0][address](ioport_opaque[address], address, (data >> 8) & 0xff);
 }
 
-uint32_t default_ioport_readl(void *opaque, uint32_t address)
+static uint32_t default_ioport_readl(void *opaque, uint32_t address)
 {
 #ifdef DEBUG_UNUSED_IOPORT
     fprintf(stderr, "unused inl: port=0x%04x\n", address);
@@ -279,14 +300,14 @@ uint32_t default_ioport_readl(void *opaque, uint32_t address)
     return 0xffffffff;
 }
 
-void default_ioport_writel(void *opaque, uint32_t address, uint32_t data)
+static void default_ioport_writel(void *opaque, uint32_t address, uint32_t data)
 {
 #ifdef DEBUG_UNUSED_IOPORT
     fprintf(stderr, "unused outl: port=0x%04x data=0x%02x\n", address, data);
 #endif
 }
 
-void init_ioports(void)
+static void init_ioports(void)
 {
     int i;
 
@@ -958,7 +979,7 @@ QEMUClock *vm_clock;
 
 static QEMUTimer *active_timers[2];
 
-QEMUClock *qemu_new_clock(int type)
+static QEMUClock *qemu_new_clock(int type)
 {
     QEMUClock *clock;
     clock = qemu_mallocz(sizeof(QEMUClock));
@@ -1002,8 +1023,6 @@ void qemu_del_timer(QEMUTimer *ts)
         }
         pt = &t->next;
     }
-
-    qemu_rearm_alarm_timer(alarm_timer);
 }
 
 /* modify the current timer so that it will be fired when current_time
@@ -1115,9 +1134,9 @@ static void timer_save(QEMUFile *f, void *opaque)
     if (cpu_ticks_enabled) {
         hw_error("cannot save state if virtual timers are running");
     }
-    qemu_put_be64s(f, &cpu_ticks_offset);
-    qemu_put_be64s(f, &ticks_per_sec);
-    qemu_put_be64s(f, &cpu_clock_offset);
+    qemu_put_be64(f, cpu_ticks_offset);
+    qemu_put_be64(f, ticks_per_sec);
+    qemu_put_be64(f, cpu_clock_offset);
 }
 
 static int timer_load(QEMUFile *f, void *opaque, int version_id)
@@ -1127,10 +1146,10 @@ static int timer_load(QEMUFile *f, void *opaque, int version_id)
     if (cpu_ticks_enabled) {
         return -EINVAL;
     }
-    qemu_get_be64s(f, &cpu_ticks_offset);
-    qemu_get_be64s(f, &ticks_per_sec);
+    cpu_ticks_offset=qemu_get_be64(f);
+    ticks_per_sec=qemu_get_be64(f);
     if (version_id == 2) {
-        qemu_get_be64s(f, &cpu_clock_offset);
+        cpu_clock_offset=qemu_get_be64(f);
     }
     return 0;
 }
@@ -1181,7 +1200,8 @@ static void host_alarm_handler(int host_signum)
         struct qemu_alarm_win32 *data = ((struct qemu_alarm_timer*)dwUser)->priv;
         SetEvent(data->host_alarm);
 #endif
-        CPUState *env = cpu_single_env;
+        CPUState *env = next_cpu;
+
         if (env) {
             /* stop the currently executing cpu because a timer occured */
             cpu_interrupt(env, CPU_INTERRUPT_EXIT);
@@ -1191,12 +1211,13 @@ static void host_alarm_handler(int host_signum)
             }
 #endif
         }
+        event_pending = 1;
     }
 }
 
 static uint64_t qemu_next_deadline(void)
 {
-    int64_t nearest_delta_us = UINT64_MAX;
+    int64_t nearest_delta_us = INT64_MAX;
     int64_t vmdelta_us;
 
     if (active_timers[QEMU_TIMER_REALTIME])
@@ -1231,9 +1252,6 @@ static void enable_sigio_timer(int fd)
     /* timer signal */
     sigfillset(&act.sa_mask);
     act.sa_flags = 0;
-#if defined (TARGET_I386) && defined(USE_CODE_COPY)
-    act.sa_flags |= SA_ONSTACK;
-#endif
     act.sa_handler = host_alarm_handler;
 
     sigaction(SIGIO, &act, NULL);
@@ -1331,9 +1349,6 @@ static int dynticks_start_timer(struct qemu_alarm_timer *t)
 
     sigfillset(&act.sa_mask);
     act.sa_flags = 0;
-#if defined(TARGET_I386) && defined(USE_CODE_COPY)
-    act.sa_flags |= SA_ONSTACK;
-#endif
     act.sa_handler = host_alarm_handler;
 
     sigaction(SIGALRM, &act, NULL);
@@ -1408,9 +1423,6 @@ static int unix_start_timer(struct qemu_alarm_timer *t)
     /* timer signal */
     sigfillset(&act.sa_mask);
     act.sa_flags = 0;
-#if defined(TARGET_I386) && defined(USE_CODE_COPY)
-    act.sa_flags |= SA_ONSTACK;
-#endif
     act.sa_handler = host_alarm_handler;
 
     sigaction(SIGALRM, &act, NULL);
@@ -1548,7 +1560,7 @@ static void init_timer_alarm(void)
     alarm_timer = t;
 }
 
-void quit_timers(void)
+static void quit_timers(void)
 {
     alarm_timer->stop(alarm_timer);
     alarm_timer = NULL;
@@ -1604,6 +1616,11 @@ void qemu_chr_read(CharDriverState *s, uint8_t *buf, int len)
     s->chr_read(s->handler_opaque, buf, len);
 }
 
+void qemu_chr_accept_input(CharDriverState *s)
+{
+    if (s->chr_accept_input)
+        s->chr_accept_input(s);
+}
 
 void qemu_chr_printf(CharDriverState *s, const char *fmt, ...)
 {
@@ -1611,7 +1628,7 @@ void qemu_chr_printf(CharDriverState *s, const char *fmt, ...)
     va_list ap;
     va_start(ap, fmt);
     vsnprintf(buf, sizeof(buf), fmt, ap);
-    qemu_chr_write(s, buf, strlen(buf));
+    qemu_chr_write(s, (uint8_t *)buf, strlen(buf));
     va_end(ap);
 }
 
@@ -1655,12 +1672,17 @@ static CharDriverState *qemu_chr_open_null(void)
 static int term_timestamps;
 static int64_t term_timestamps_start;
 #define MAX_MUX 4
+#define MUX_BUFFER_SIZE 32	/* Must be a power of 2.  */
+#define MUX_BUFFER_MASK (MUX_BUFFER_SIZE - 1)
 typedef struct {
     IOCanRWHandler *chr_can_read[MAX_MUX];
     IOReadHandler *chr_read[MAX_MUX];
     IOEventHandler *chr_event[MAX_MUX];
     void *ext_opaque[MAX_MUX];
     CharDriverState *drv;
+    unsigned char buffer[MUX_BUFFER_SIZE];
+    int prod;
+    int cons;
     int mux_cnt;
     int term_got_escape;
     int max_size;
@@ -1695,7 +1717,7 @@ static int mux_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
                          (secs / 60) % 60,
                          secs % 60,
                          (int)((ti / 1000000) % 1000));
-                d->drv->chr_write(d->drv, buf1, strlen(buf1));
+                d->drv->chr_write(d->drv, (uint8_t *)buf1, strlen(buf1));
             }
         }
     }
@@ -1724,15 +1746,16 @@ static void mux_print_help(CharDriverState *chr)
         sprintf(cbuf,"\n\r");
         sprintf(ebuf,"C-%c", term_escape_char - 1 + 'a');
     } else {
-        sprintf(cbuf,"\n\rEscape-Char set to Ascii: 0x%02x\n\r\n\r", term_escape_char);
+        sprintf(cbuf,"\n\rEscape-Char set to Ascii: 0x%02x\n\r\n\r",
+            term_escape_char);
     }
-    chr->chr_write(chr, cbuf, strlen(cbuf));
+    chr->chr_write(chr, (uint8_t *)cbuf, strlen(cbuf));
     for (i = 0; mux_help[i] != NULL; i++) {
         for (j=0; mux_help[i][j] != '\0'; j++) {
             if (mux_help[i][j] == '%')
-                chr->chr_write(chr, ebuf, strlen(ebuf));
+                chr->chr_write(chr, (uint8_t *)ebuf, strlen(ebuf));
             else
-                chr->chr_write(chr, &mux_help[i][j], 1);
+                chr->chr_write(chr, (uint8_t *)&mux_help[i][j], 1);
         }
     }
 }
@@ -1751,19 +1774,16 @@ static int mux_proc_byte(CharDriverState *chr, MuxDriver *d, int ch)
         case 'x':
             {
                  char *term =  "QEMU: Terminated\n\r";
-                 chr->chr_write(chr,term,strlen(term));
+                 chr->chr_write(chr,(uint8_t *)term,strlen(term));
                  exit(0);
                  break;
             }
         case 's':
             {
                 int i;
-                for (i = 0; i < MAX_DISKS; i++) {
-                    if (bs_table[i])
-                        bdrv_commit(bs_table[i]);
+                for (i = 0; i < nb_drives; i++) {
+                        bdrv_commit(drives_table[i].bdrv);
                 }
-                if (mtd_bdrv)
-                    bdrv_commit(mtd_bdrv);
             }
             break;
         case 'b':
@@ -1789,12 +1809,28 @@ static int mux_proc_byte(CharDriverState *chr, MuxDriver *d, int ch)
     return 0;
 }
 
+static void mux_chr_accept_input(CharDriverState *chr)
+{
+    int m = chr->focus;
+    MuxDriver *d = chr->opaque;
+
+    while (d->prod != d->cons &&
+           d->chr_can_read[m] &&
+           d->chr_can_read[m](d->ext_opaque[m])) {
+        d->chr_read[m](d->ext_opaque[m],
+                       &d->buffer[d->cons++ & MUX_BUFFER_MASK], 1);
+    }
+}
+
 static int mux_chr_can_read(void *opaque)
 {
     CharDriverState *chr = opaque;
     MuxDriver *d = chr->opaque;
+
+    if ((d->prod - d->cons) < MUX_BUFFER_SIZE)
+        return 1;
     if (d->chr_can_read[chr->focus])
-       return d->chr_can_read[chr->focus](d->ext_opaque[chr->focus]);
+        return d->chr_can_read[chr->focus](d->ext_opaque[chr->focus]);
     return 0;
 }
 
@@ -1802,10 +1838,20 @@ static void mux_chr_read(void *opaque, const uint8_t *buf, int size)
 {
     CharDriverState *chr = opaque;
     MuxDriver *d = chr->opaque;
+    int m = chr->focus;
     int i;
+
+    mux_chr_accept_input (opaque);
+
     for(i = 0; i < size; i++)
-        if (mux_proc_byte(chr, d, buf[i]))
-            d->chr_read[chr->focus](d->ext_opaque[chr->focus], &buf[i], 1);
+        if (mux_proc_byte(chr, d, buf[i])) {
+            if (d->prod == d->cons &&
+                d->chr_can_read[m] &&
+                d->chr_can_read[m](d->ext_opaque[m]))
+                d->chr_read[m](d->ext_opaque[m], &buf[i], 1);
+            else
+                d->buffer[d->prod++ & MUX_BUFFER_MASK] = buf[i];
+        }
 }
 
 static void mux_chr_event(void *opaque, int event)
@@ -1841,7 +1887,7 @@ static void mux_chr_update_read_handler(CharDriverState *chr)
     d->mux_cnt++;
 }
 
-CharDriverState *qemu_chr_open_mux(CharDriverState *drv)
+static CharDriverState *qemu_chr_open_mux(CharDriverState *drv)
 {
     CharDriverState *chr;
     MuxDriver *d;
@@ -1860,6 +1906,7 @@ CharDriverState *qemu_chr_open_mux(CharDriverState *drv)
     chr->focus = -1;
     chr->chr_write = mux_chr_write;
     chr->chr_update_read_handler = mux_chr_update_read_handler;
+    chr->chr_accept_input = mux_chr_accept_input;
     return chr;
 }
 
@@ -2848,7 +2895,7 @@ static CharDriverState *qemu_chr_open_win_file_out(const char *file_out)
 typedef struct {
     int fd;
     struct sockaddr_in daddr;
-    char buf[1024];
+    uint8_t buf[1024];
     int bufcnt;
     int bufptr;
     int max_size;
@@ -3005,7 +3052,7 @@ static int tcp_chr_read_poll(void *opaque)
 #define IAC_BREAK 243
 static void tcp_chr_process_IAC_bytes(CharDriverState *chr,
                                       TCPCharDriver *s,
-                                      char *buf, int *size)
+                                      uint8_t *buf, int *size)
 {
     /* Handle any telnet client's basic IAC options to satisfy char by
      * char mode with no echo.  All IAC options will be removed from
@@ -3393,7 +3440,8 @@ void qemu_chr_close(CharDriverState *chr)
 /***********************************************************/
 /* network device redirectors */
 
-void hex_dump(FILE *f, const uint8_t *buf, int size)
+__attribute__ (( unused ))
+static void hex_dump(FILE *f, const uint8_t *buf, int size)
 {
     int len, i, j, c;
 
@@ -3422,18 +3470,33 @@ void hex_dump(FILE *f, const uint8_t *buf, int size)
 static int parse_macaddr(uint8_t *macaddr, const char *p)
 {
     int i;
-    for(i = 0; i < 6; i++) {
-        macaddr[i] = strtol(p, (char **)&p, 16);
-        if (i == 5) {
-            if (*p != '\0')
-                return -1;
-        } else {
-            if (*p != ':')
-                return -1;
-            p++;
+    char *last_char;
+    long int offset;
+
+    errno = 0;
+    offset = strtol(p, &last_char, 0);    
+    if (0 == errno && '\0' == *last_char &&
+            offset >= 0 && offset <= 0xFFFFFF) {
+        macaddr[3] = (offset & 0xFF0000) >> 16;
+        macaddr[4] = (offset & 0xFF00) >> 8;
+        macaddr[5] = offset & 0xFF;
+        return 0;
+    } else {
+        for(i = 0; i < 6; i++) {
+            macaddr[i] = strtol(p, (char **)&p, 16);
+            if (i == 5) {
+                if (*p != '\0')
+                    return -1;
+            } else {
+                if (*p != ':' && *p != '-')
+                    return -1;
+                p++;
+            }
         }
+        return 0;    
     }
-    return 0;
+
+    return -1;
 }
 
 static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
@@ -3741,7 +3804,7 @@ static void smb_exit(void)
 }
 
 /* automatic user mode samba server configuration */
-void net_slirp_smb(const char *exported_dir)
+static void net_slirp_smb(const char *exported_dir)
 {
     char smb_conf[1024];
     char smb_cmdline[1024];
@@ -3796,6 +3859,10 @@ void net_slirp_smb(const char *exported_dir)
 }
 
 #endif /* !defined(_WIN32) */
+void do_info_slirp(void)
+{
+    slirp_stats();
+}
 
 #endif /* CONFIG_SLIRP */
 
@@ -3804,6 +3871,7 @@ void net_slirp_smb(const char *exported_dir)
 typedef struct TAPState {
     VLANClientState *vc;
     int fd;
+    char down_script[1024];
 } TAPState;
 
 static void tap_receive(void *opaque, const uint8_t *buf, int size)
@@ -4040,27 +4108,13 @@ static int tap_open(char *ifname, int ifname_size)
 }
 #endif
 
-static int net_tap_init(VLANState *vlan, const char *ifname1,
-                        const char *setup_script)
+static int launch_script(const char *setup_script, const char *ifname, int fd)
 {
-    TAPState *s;
-    int pid, status, fd;
+    int pid, status;
     char *args[3];
     char **parg;
-    char ifname[128];
 
-    if (ifname1 != NULL)
-        pstrcpy(ifname, sizeof(ifname), ifname1);
-    else
-        ifname[0] = '\0';
-    TFR(fd = tap_open(ifname, sizeof(ifname)));
-    if (fd < 0)
-        return -1;
-
-    if (!setup_script || !strcmp(setup_script, "no"))
-        setup_script = "";
-    if (setup_script[0] != '\0') {
-        /* try to launch network init script */
+        /* try to launch network script */
         pid = fork();
         if (pid >= 0) {
             if (pid == 0) {
@@ -4074,7 +4128,7 @@ static int net_tap_init(VLANState *vlan, const char *ifname1,
 
                 parg = args;
                 *parg++ = (char *)setup_script;
-                *parg++ = ifname;
+                *parg++ = (char *)ifname;
                 *parg++ = NULL;
                 execv(setup_script, args);
                 _exit(1);
@@ -4087,12 +4141,37 @@ static int net_tap_init(VLANState *vlan, const char *ifname1,
                 return -1;
             }
         }
+    return 0;
+}
+
+static int net_tap_init(VLANState *vlan, const char *ifname1,
+                        const char *setup_script, const char *down_script)
+{
+    TAPState *s;
+    int fd;
+    char ifname[128];
+
+    if (ifname1 != NULL)
+        pstrcpy(ifname, sizeof(ifname), ifname1);
+    else
+        ifname[0] = '\0';
+    TFR(fd = tap_open(ifname, sizeof(ifname)));
+    if (fd < 0)
+        return -1;
+
+    if (!setup_script || !strcmp(setup_script, "no"))
+        setup_script = "";
+    if (setup_script[0] != '\0') {
+	if (launch_script(setup_script, ifname, fd))
+	    return -1;
     }
     s = net_tap_fd_init(vlan, fd);
     if (!s)
         return -1;
     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
              "tap: ifname=%s setup_script=%s", ifname, setup_script);
+    if (down_script && strcmp(down_script, "no"))
+        snprintf(s->down_script, sizeof(s->down_script), "%s", down_script);
     return 0;
 }
 
@@ -4510,38 +4589,51 @@ static int net_socket_mcast_init(VLANState *vlan, const char *host_str)
 
 }
 
+static const char *get_word(char *buf, int buf_size, const char *p)
+{
+    char *q;
+    int substring;
+
+    substring = 0;
+    q = buf;
+    while (*p != '\0') {
+        if (*p == '\\') {
+            p++;
+            if (*p == '\0')
+                break;
+        } else if (*p == '\"') {
+            substring = !substring;
+            p++;
+            continue;
+        } else if (!substring && (*p == ',' || *p == '='))
+            break;
+        if (q && (q - buf) < buf_size - 1)
+            *q++ = *p;
+        p++;
+    }
+    if (q)
+        *q = '\0';
+
+    return p;
+}
+
 static int get_param_value(char *buf, int buf_size,
                            const char *tag, const char *str)
 {
     const char *p;
-    char *q;
     char option[128];
 
     p = str;
     for(;;) {
-        q = option;
-        while (*p != '\0' && *p != '=') {
-            if ((q - option) < sizeof(option) - 1)
-                *q++ = *p;
-            p++;
-        }
-        *q = '\0';
+        p = get_word(option, sizeof(option), p);
         if (*p != '=')
             break;
         p++;
         if (!strcmp(tag, option)) {
-            q = buf;
-            while (*p != '\0' && *p != ',') {
-                if ((q - buf) < buf_size - 1)
-                    *q++ = *p;
-                p++;
-            }
-            *q = '\0';
-            return q - buf;
+            (void)get_word(buf, buf_size, p);
+            return strlen(buf);
         } else {
-            while (*p != '\0' && *p != ',') {
-                p++;
-            }
+            p = get_word(NULL, 0, p);
         }
         if (*p != ',')
             break;
@@ -4550,6 +4642,32 @@ static int get_param_value(char *buf, int buf_size,
     return 0;
 }
 
+static int check_params(char *buf, int buf_size,
+                        char **params, const char *str)
+{
+    const char *p;
+    int i;
+
+    p = str;
+    for(;;) {
+        p = get_word(buf, buf_size, p);
+        if (*p != '=')
+            return -1;
+        p++;
+        for(i = 0; params[i] != NULL; i++)
+            if (!strcmp(params[i], buf))
+                break;
+        if (params[i] == NULL)
+            return -1;
+        p = get_word(NULL, 0, p);
+        if (*p != ',')
+            break;
+        p++;
+    }
+    return 0;
+}
+
+
 static int net_client_init(const char *str)
 {
     const char *p;
@@ -4636,7 +4754,7 @@ static int net_client_init(const char *str)
 #else
     if (!strcmp(device, "tap")) {
         char ifname[64];
-        char setup_script[1024];
+        char setup_script[1024], down_script[1024];
         int fd;
         vlan->nb_host_devs++;
         if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
@@ -4651,7 +4769,10 @@ static int net_client_init(const char *str)
             if (get_param_value(setup_script, sizeof(setup_script), "script", p) == 0) {
                 pstrcpy(setup_script, sizeof(setup_script), DEFAULT_NETWORK_SCRIPT);
             }
-            ret = net_tap_init(vlan, ifname, setup_script);
+            if (get_param_value(down_script, sizeof(down_script), "downscript", p) == 0) {
+                pstrcpy(down_script, sizeof(down_script), DEFAULT_NETWORK_DOWN_SCRIPT);
+            }
+            ret = net_tap_init(vlan, ifname, setup_script, down_script);
         }
     } else
 #endif
@@ -4697,6 +4818,331 @@ void do_info_network(void)
     }
 }
 
+#define HD_ALIAS "file=\"%s\",index=%d,media=disk"
+#ifdef TARGET_PPC
+#define CDROM_ALIAS "index=1,media=cdrom"
+#else
+#define CDROM_ALIAS "index=2,media=cdrom"
+#endif
+#define FD_ALIAS "index=%d,if=floppy"
+#define PFLASH_ALIAS "file=\"%s\",if=pflash"
+#define MTD_ALIAS "file=\"%s\",if=mtd"
+#define SD_ALIAS "index=0,if=sd"
+
+static int drive_add(const char *fmt, ...)
+{
+    va_list ap;
+
+    if (nb_drives_opt >= MAX_DRIVES) {
+        fprintf(stderr, "qemu: too many drives\n");
+        exit(1);
+    }
+
+    va_start(ap, fmt);
+    vsnprintf(drives_opt[nb_drives_opt], sizeof(drives_opt[0]), fmt, ap);
+    va_end(ap);
+
+    return nb_drives_opt++;
+}
+
+int drive_get_index(BlockInterfaceType interface, int bus, int unit)
+{
+    int index;
+
+    /* seek interface, bus and unit */
+
+    for (index = 0; index < nb_drives; index++)
+        if (drives_table[index].interface == interface &&
+	    drives_table[index].bus == bus &&
+	    drives_table[index].unit == unit)
+        return index;
+
+    return -1;
+}
+
+int drive_get_max_bus(BlockInterfaceType interface)
+{
+    int max_bus;
+    int index;
+
+    max_bus = -1;
+    for (index = 0; index < nb_drives; index++) {
+        if(drives_table[index].interface == interface &&
+           drives_table[index].bus > max_bus)
+            max_bus = drives_table[index].bus;
+    }
+    return max_bus;
+}
+
+static int drive_init(const char *str, int snapshot, QEMUMachine *machine)
+{
+    char buf[128];
+    char file[1024];
+    char devname[128];
+    const char *mediastr = "";
+    BlockInterfaceType interface;
+    enum { MEDIA_DISK, MEDIA_CDROM } media;
+    int bus_id, unit_id;
+    int cyls, heads, secs, translation;
+    BlockDriverState *bdrv;
+    int max_devs;
+    int index;
+    char *params[] = { "bus", "unit", "if", "index", "cyls", "heads",
+                       "secs", "trans", "media", "snapshot", "file", NULL };
+
+    if (check_params(buf, sizeof(buf), params, str) < 0) {
+         fprintf(stderr, "qemu: unknowm parameter '%s' in '%s'\n",
+                         buf, str);
+         return -1;
+    }
+
+    file[0] = 0;
+    cyls = heads = secs = 0;
+    bus_id = 0;
+    unit_id = -1;
+    translation = BIOS_ATA_TRANSLATION_AUTO;
+    index = -1;
+
+    if (!strcmp(machine->name, "realview") ||
+        !strcmp(machine->name, "SS-5") ||
+        !strcmp(machine->name, "SS-10") ||
+        !strcmp(machine->name, "SS-600MP") ||
+        !strcmp(machine->name, "versatilepb") ||
+        !strcmp(machine->name, "versatileab")) {
+        interface = IF_SCSI;
+        max_devs = MAX_SCSI_DEVS;
+        strcpy(devname, "scsi");
+    } else {
+        interface = IF_IDE;
+        max_devs = MAX_IDE_DEVS;
+        strcpy(devname, "ide");
+    }
+    media = MEDIA_DISK;
+
+    /* extract parameters */
+
+    if (get_param_value(buf, sizeof(buf), "bus", str)) {
+        bus_id = strtol(buf, NULL, 0);
+	if (bus_id < 0) {
+	    fprintf(stderr, "qemu: '%s' invalid bus id\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "unit", str)) {
+        unit_id = strtol(buf, NULL, 0);
+	if (unit_id < 0) {
+	    fprintf(stderr, "qemu: '%s' invalid unit id\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "if", str)) {
+        strncpy(devname, buf, sizeof(devname));
+        if (!strcmp(buf, "ide")) {
+	    interface = IF_IDE;
+            max_devs = MAX_IDE_DEVS;
+        } else if (!strcmp(buf, "scsi")) {
+	    interface = IF_SCSI;
+            max_devs = MAX_SCSI_DEVS;
+        } else if (!strcmp(buf, "floppy")) {
+	    interface = IF_FLOPPY;
+            max_devs = 0;
+        } else if (!strcmp(buf, "pflash")) {
+	    interface = IF_PFLASH;
+            max_devs = 0;
+	} else if (!strcmp(buf, "mtd")) {
+	    interface = IF_MTD;
+            max_devs = 0;
+	} else if (!strcmp(buf, "sd")) {
+	    interface = IF_SD;
+            max_devs = 0;
+	} else {
+            fprintf(stderr, "qemu: '%s' unsupported bus type '%s'\n", str, buf);
+            return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "index", str)) {
+        index = strtol(buf, NULL, 0);
+	if (index < 0) {
+	    fprintf(stderr, "qemu: '%s' invalid index\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "cyls", str)) {
+        cyls = strtol(buf, NULL, 0);
+    }
+
+    if (get_param_value(buf, sizeof(buf), "heads", str)) {
+        heads = strtol(buf, NULL, 0);
+    }
+
+    if (get_param_value(buf, sizeof(buf), "secs", str)) {
+        secs = strtol(buf, NULL, 0);
+    }
+
+    if (cyls || heads || secs) {
+        if (cyls < 1 || cyls > 16383) {
+            fprintf(stderr, "qemu: '%s' invalid physical cyls number\n", str);
+	    return -1;
+	}
+        if (heads < 1 || heads > 16) {
+            fprintf(stderr, "qemu: '%s' invalid physical heads number\n", str);
+	    return -1;
+	}
+        if (secs < 1 || secs > 63) {
+            fprintf(stderr, "qemu: '%s' invalid physical secs number\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "trans", str)) {
+        if (!cyls) {
+            fprintf(stderr,
+                    "qemu: '%s' trans must be used with cyls,heads and secs\n",
+                    str);
+            return -1;
+        }
+        if (!strcmp(buf, "none"))
+            translation = BIOS_ATA_TRANSLATION_NONE;
+        else if (!strcmp(buf, "lba"))
+            translation = BIOS_ATA_TRANSLATION_LBA;
+        else if (!strcmp(buf, "auto"))
+            translation = BIOS_ATA_TRANSLATION_AUTO;
+	else {
+            fprintf(stderr, "qemu: '%s' invalid translation type\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "media", str)) {
+        if (!strcmp(buf, "disk")) {
+	    media = MEDIA_DISK;
+	} else if (!strcmp(buf, "cdrom")) {
+            if (cyls || secs || heads) {
+                fprintf(stderr,
+                        "qemu: '%s' invalid physical CHS format\n", str);
+	        return -1;
+            }
+	    media = MEDIA_CDROM;
+	} else {
+	    fprintf(stderr, "qemu: '%s' invalid media\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "snapshot", str)) {
+        if (!strcmp(buf, "on"))
+	    snapshot = 1;
+        else if (!strcmp(buf, "off"))
+	    snapshot = 0;
+	else {
+	    fprintf(stderr, "qemu: '%s' invalid snapshot option\n", str);
+	    return -1;
+	}
+    }
+
+    get_param_value(file, sizeof(file), "file", str);
+
+    /* compute bus and unit according index */
+
+    if (index != -1) {
+        if (bus_id != 0 || unit_id != -1) {
+            fprintf(stderr,
+                    "qemu: '%s' index cannot be used with bus and unit\n", str);
+            return -1;
+        }
+        if (max_devs == 0)
+        {
+            unit_id = index;
+            bus_id = 0;
+        } else {
+            unit_id = index % max_devs;
+            bus_id = index / max_devs;
+        }
+    }
+
+    /* if user doesn't specify a unit_id,
+     * try to find the first free
+     */
+
+    if (unit_id == -1) {
+       unit_id = 0;
+       while (drive_get_index(interface, bus_id, unit_id) != -1) {
+           unit_id++;
+           if (max_devs && unit_id >= max_devs) {
+               unit_id -= max_devs;
+               bus_id++;
+           }
+       }
+    }
+
+    /* check unit id */
+
+    if (max_devs && unit_id >= max_devs) {
+        fprintf(stderr, "qemu: '%s' unit %d too big (max is %d)\n",
+                        str, unit_id, max_devs - 1);
+        return -1;
+    }
+
+    /*
+     * ignore multiple definitions
+     */
+
+    if (drive_get_index(interface, bus_id, unit_id) != -1)
+        return 0;
+
+    /* init */
+
+    if (interface == IF_IDE || interface == IF_SCSI)
+        mediastr = (media == MEDIA_CDROM) ? "-cd" : "-hd";
+    snprintf(buf, sizeof(buf), max_devs ? "%1$s%4$i%2$s%3$i" : "%s%s%i",
+             devname, mediastr, unit_id, bus_id);
+    bdrv = bdrv_new(buf);
+    drives_table[nb_drives].bdrv = bdrv;
+    drives_table[nb_drives].interface = interface;
+    drives_table[nb_drives].bus = bus_id;
+    drives_table[nb_drives].unit = unit_id;
+    nb_drives++;
+
+    switch(interface) {
+    case IF_IDE:
+    case IF_SCSI:
+        switch(media) {
+	case MEDIA_DISK:
+            if (cyls != 0) {
+                bdrv_set_geometry_hint(bdrv, cyls, heads, secs);
+                bdrv_set_translation_hint(bdrv, translation);
+            }
+	    break;
+	case MEDIA_CDROM:
+            bdrv_set_type_hint(bdrv, BDRV_TYPE_CDROM);
+	    break;
+	}
+        break;
+    case IF_SD:
+        /* FIXME: This isn't really a floppy, but it's a reasonable
+           approximation.  */
+    case IF_FLOPPY:
+        bdrv_set_type_hint(bdrv, BDRV_TYPE_FLOPPY);
+        break;
+    case IF_PFLASH:
+    case IF_MTD:
+        break;
+    }
+    if (!file[0])
+        return 0;
+    if (bdrv_open(bdrv, file, snapshot ? BDRV_O_SNAPSHOT : 0) < 0 ||
+        qemu_key_check(bdrv, file)) {
+        fprintf(stderr, "qemu: could not open disk image %s\n",
+                        file);
+        return -1;
+    }
+    return 0;
+}
+
 /***********************************************************/
 /* USB devices */
 
@@ -5467,7 +5913,7 @@ int register_savevm(const char *idstr,
 #define QEMU_VM_FILE_MAGIC   0x5145564d
 #define QEMU_VM_FILE_VERSION 0x00000002
 
-int qemu_savevm_state(QEMUFile *f)
+static int qemu_savevm_state(QEMUFile *f)
 {
     SaveStateEntry *se;
     int len, ret;
@@ -5482,7 +5928,7 @@ int qemu_savevm_state(QEMUFile *f)
         /* ID string */
         len = strlen(se->idstr);
         qemu_put_byte(f, len);
-        qemu_put_buffer(f, se->idstr, len);
+        qemu_put_buffer(f, (uint8_t *)se->idstr, len);
 
         qemu_put_be32(f, se->instance_id);
         qemu_put_be32(f, se->version_id);
@@ -5490,7 +5936,6 @@ int qemu_savevm_state(QEMUFile *f)
         /* record size: filled later */
         len_pos = qemu_ftell(f);
         qemu_put_be32(f, 0);
-
         se->save_state(f, se->opaque);
 
         /* fill record size */
@@ -5521,7 +5966,7 @@ static SaveStateEntry *find_se(const char *idstr, int instance_id)
     return NULL;
 }
 
-int qemu_loadvm_state(QEMUFile *f)
+static int qemu_loadvm_state(QEMUFile *f)
 {
     SaveStateEntry *se;
     int len, ret, instance_id, record_len, version_id;
@@ -5544,7 +5989,7 @@ int qemu_loadvm_state(QEMUFile *f)
         if (qemu_ftell(f) >= end_pos)
             break;
         len = qemu_get_byte(f);
-        qemu_get_buffer(f, idstr, len);
+        qemu_get_buffer(f, (uint8_t *)idstr, len);
         idstr[len] = '\0';
         instance_id = qemu_get_be32(f);
         version_id = qemu_get_be32(f);
@@ -5674,8 +6119,8 @@ static BlockDriverState *get_bs_snapshots(void)
 
     if (bs_snapshots)
         return bs_snapshots;
-    for(i = 0; i <= MAX_DISKS; i++) {
-        bs = bs_table[i];
+    for(i = 0; i <= nb_drives; i++) {
+        bs = drives_table[i].bdrv;
         if (bdrv_can_snapshot(bs))
             goto ok;
     }
@@ -5783,8 +6228,8 @@ void do_savevm(const char *name)
 
     /* create the snapshots */
 
-    for(i = 0; i < MAX_DISKS; i++) {
-        bs1 = bs_table[i];
+    for(i = 0; i < nb_drives; i++) {
+        bs1 = drives_table[i].bdrv;
         if (bdrv_has_snapshot(bs1)) {
             if (must_delete) {
                 ret = bdrv_snapshot_delete(bs1, old_sn->id_str);
@@ -5826,8 +6271,8 @@ void do_loadvm(const char *name)
     saved_vm_running = vm_running;
     vm_stop(0);
 
-    for(i = 0; i <= MAX_DISKS; i++) {
-        bs1 = bs_table[i];
+    for(i = 0; i <= nb_drives; i++) {
+        bs1 = drives_table[i].bdrv;
         if (bdrv_has_snapshot(bs1)) {
             ret = bdrv_snapshot_goto(bs1, name);
             if (ret < 0) {
@@ -5887,8 +6332,8 @@ void do_delvm(const char *name)
         return;
     }
 
-    for(i = 0; i <= MAX_DISKS; i++) {
-        bs1 = bs_table[i];
+    for(i = 0; i <= nb_drives; i++) {
+        bs1 = drives_table[i].bdrv;
         if (bdrv_has_snapshot(bs1)) {
             ret = bdrv_snapshot_delete(bs1, name);
             if (ret < 0) {
@@ -5916,8 +6361,8 @@ void do_info_snapshots(void)
         return;
     }
     term_printf("Snapshot devices:");
-    for(i = 0; i <= MAX_DISKS; i++) {
-        bs1 = bs_table[i];
+    for(i = 0; i <= nb_drives; i++) {
+        bs1 = drives_table[i].bdrv;
         if (bdrv_has_snapshot(bs1)) {
             if (bs == bs1)
                 term_printf(" %s", bdrv_get_device_name(bs1));
@@ -6346,7 +6791,9 @@ void cpu_save(QEMUFile *f, void *opaque)
     qemu_put_be32(f, env->cp15.c1_sys);
     qemu_put_be32(f, env->cp15.c1_coproc);
     qemu_put_be32(f, env->cp15.c1_xscaleauxcr);
-    qemu_put_be32(f, env->cp15.c2_base);
+    qemu_put_be32(f, env->cp15.c2_base0);
+    qemu_put_be32(f, env->cp15.c2_base1);
+    qemu_put_be32(f, env->cp15.c2_mask);
     qemu_put_be32(f, env->cp15.c2_data);
     qemu_put_be32(f, env->cp15.c2_insn);
     qemu_put_be32(f, env->cp15.c3);
@@ -6361,6 +6808,9 @@ void cpu_save(QEMUFile *f, void *opaque)
     qemu_put_be32(f, env->cp15.c9_data);
     qemu_put_be32(f, env->cp15.c13_fcse);
     qemu_put_be32(f, env->cp15.c13_context);
+    qemu_put_be32(f, env->cp15.c13_tls1);
+    qemu_put_be32(f, env->cp15.c13_tls2);
+    qemu_put_be32(f, env->cp15.c13_tls3);
     qemu_put_be32(f, env->cp15.c15_cpar);
 
     qemu_put_be32(f, env->features);
@@ -6379,6 +6829,15 @@ void cpu_save(QEMUFile *f, void *opaque)
         /* TODO: Should use proper FPSCR access functions.  */
         qemu_put_be32(f, env->vfp.vec_len);
         qemu_put_be32(f, env->vfp.vec_stride);
+
+        if (arm_feature(env, ARM_FEATURE_VFP3)) {
+            for (i = 16;  i < 32; i++) {
+                CPU_DoubleU u;
+                u.d = env->vfp.regs[i];
+                qemu_put_be32(f, u.l.upper);
+                qemu_put_be32(f, u.l.lower);
+            }
+        }
     }
 
     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
@@ -6389,6 +6848,15 @@ void cpu_save(QEMUFile *f, void *opaque)
             qemu_put_be32(f, env->iwmmxt.cregs[i]);
         }
     }
+
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        qemu_put_be32(f, env->v7m.other_sp);
+        qemu_put_be32(f, env->v7m.vecbase);
+        qemu_put_be32(f, env->v7m.basepri);
+        qemu_put_be32(f, env->v7m.control);
+        qemu_put_be32(f, env->v7m.current_sp);
+        qemu_put_be32(f, env->v7m.exception);
+    }
 }
 
 int cpu_load(QEMUFile *f, void *opaque, int version_id)
@@ -6396,7 +6864,7 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
     CPUARMState *env = (CPUARMState *)opaque;
     int i;
 
-    if (version_id != 0)
+    if (version_id != ARM_CPU_SAVE_VERSION)
         return -EINVAL;
 
     for (i = 0; i < 16; i++) {
@@ -6418,7 +6886,9 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
     env->cp15.c1_sys = qemu_get_be32(f);
     env->cp15.c1_coproc = qemu_get_be32(f);
     env->cp15.c1_xscaleauxcr = qemu_get_be32(f);
-    env->cp15.c2_base = qemu_get_be32(f);
+    env->cp15.c2_base0 = qemu_get_be32(f);
+    env->cp15.c2_base1 = qemu_get_be32(f);
+    env->cp15.c2_mask = qemu_get_be32(f);
     env->cp15.c2_data = qemu_get_be32(f);
     env->cp15.c2_insn = qemu_get_be32(f);
     env->cp15.c3 = qemu_get_be32(f);
@@ -6433,6 +6903,9 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
     env->cp15.c9_data = qemu_get_be32(f);
     env->cp15.c13_fcse = qemu_get_be32(f);
     env->cp15.c13_context = qemu_get_be32(f);
+    env->cp15.c13_tls1 = qemu_get_be32(f);
+    env->cp15.c13_tls2 = qemu_get_be32(f);
+    env->cp15.c13_tls3 = qemu_get_be32(f);
     env->cp15.c15_cpar = qemu_get_be32(f);
 
     env->features = qemu_get_be32(f);
@@ -6451,6 +6924,15 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
         /* TODO: Should use proper FPSCR access functions.  */
         env->vfp.vec_len = qemu_get_be32(f);
         env->vfp.vec_stride = qemu_get_be32(f);
+
+        if (arm_feature(env, ARM_FEATURE_VFP3)) {
+            for (i = 0;  i < 16; i++) {
+                CPU_DoubleU u;
+                u.l.upper = qemu_get_be32(f);
+                u.l.lower = qemu_get_be32(f);
+                env->vfp.regs[i] = u.d;
+            }
+        }
     }
 
     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
@@ -6462,6 +6944,15 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
         }
     }
 
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        env->v7m.other_sp = qemu_get_be32(f);
+        env->v7m.vecbase = qemu_get_be32(f);
+        env->v7m.basepri = qemu_get_be32(f);
+        env->v7m.control = qemu_get_be32(f);
+        env->v7m.current_sp = qemu_get_be32(f);
+        env->v7m.exception = qemu_get_be32(f);
+    }
+
     return 0;
 }
 
@@ -6476,7 +6967,7 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 }
 #else
 
-#warning No CPU save/restore functions
+//#warning No CPU save/restore functions
 
 #endif
 
@@ -6682,15 +7173,14 @@ static void ram_save_static(QEMUFile *f, void *opaque)
             /* find if the memory block is available on a virtual
                block device */
             sector_num = -1;
-            for(j = 0; j < MAX_DISKS; j++) {
-                if (bs_table[j]) {
-                    sector_num = bdrv_hash_find(bs_table[j],
-                                                phys_ram_base + i, BDRV_HASH_BLOCK_SIZE);
-                    if (sector_num >= 0)
-                        break;
-                }
+            for(j = 0; j < nb_drives; j++) {
+                sector_num = bdrv_hash_find(drives_table[j].bdrv,
+                                            phys_ram_base + i,
+					    BDRV_HASH_BLOCK_SIZE);
+                if (sector_num >= 0)
+                    break;
             }
-            if (j == MAX_DISKS)
+            if (j == nb_drives)
                 goto normal_compress;
             buf[0] = 1;
             buf[1] = j;
@@ -6768,11 +7258,12 @@ static int ram_load_static(QEMUFile *f, void *opaque)
             ram_decompress_buf(s, buf + 1, 9);
             bs_index = buf[1];
             sector_num = be64_to_cpupu((const uint64_t *)(buf + 2));
-            if (bs_index >= MAX_DISKS || bs_table[bs_index] == NULL) {
+            if (bs_index >= nb_drives) {
                 fprintf(stderr, "Invalid block device index %d\n", bs_index);
                 goto error;
             }
-            if (bdrv_read(bs_table[bs_index], sector_num, phys_ram_base + i,
+            if (bdrv_read(drives_table[bs_index].bdrv, sector_num,
+	                  phys_ram_base + i,
                           BDRV_HASH_BLOCK_SIZE / 512) < 0) {
                 fprintf(stderr, "Error while reading sector %d:%" PRId64 "\n",
                         bs_index, sector_num);
@@ -6905,7 +7396,7 @@ int qemu_register_machine(QEMUMachine *m)
     return 0;
 }
 
-QEMUMachine *find_machine(const char *name)
+static QEMUMachine *find_machine(const char *name)
 {
     QEMUMachine *m;
 
@@ -6919,7 +7410,7 @@ QEMUMachine *find_machine(const char *name)
 /***********************************************************/
 /* main execution loop */
 
-void gui_update(void *opaque)
+static void gui_update(void *opaque)
 {
     DisplayState *ds = opaque;
     ds->dpy_refresh(ds);
@@ -7222,9 +7713,7 @@ void main_loop_wait(int timeout)
 
 }
 
-static CPUState *cur_cpu;
-
-int main_loop(void)
+static int main_loop(void)
 {
     int ret, timeout;
 #ifdef CONFIG_PROFILER
@@ -7241,15 +7730,13 @@ int main_loop(void)
     }
 #endif
     cur_cpu = first_cpu;
+    next_cpu = cur_cpu->next_cpu ?: first_cpu;
     for(;;) {
         if (vm_running) {
 
-            env = cur_cpu;
             for(;;) {
                 /* get next cpu */
-                env = env->next_cpu;
-                if (!env)
-                    env = first_cpu;
+                env = next_cpu;
 #ifdef CONFIG_PROFILER
                 ti = profile_getclock();
 #endif
@@ -7257,6 +7744,12 @@ int main_loop(void)
 #ifdef CONFIG_PROFILER
                 qemu_time += profile_getclock() - ti;
 #endif
+                next_cpu = env->next_cpu ?: first_cpu;
+                if (event_pending) {
+                    ret = EXCP_INTERRUPT;
+                    event_pending = 0;
+                    break;
+                }
                 if (ret == EXCP_HLT) {
                     /* Give the next CPU a chance to run.  */
                     cur_cpu = env;
@@ -7327,6 +7820,9 @@ static void help(int exitcode)
            "-hda/-hdb file  use 'file' as IDE hard disk 0/1 image\n"
            "-hdc/-hdd file  use 'file' as IDE hard disk 2/3 image\n"
            "-cdrom file     use 'file' as IDE cdrom image (cdrom is ide1 master)\n"
+	   "-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][index=i]\n"
+           "       [,cyls=c,heads=h,secs=s[,trans=t]][snapshot=on|off]\n"
+	   "                use 'file' as a drive image\n"
            "-mtdblock file  use 'file' as on-board Flash memory image\n"
            "-sd file        use 'file' as SecureDigital card image\n"
            "-pflash file    use 'file' as a parallel flash image\n"
@@ -7378,10 +7874,11 @@ static void help(int exitcode)
            "-net tap[,vlan=n],ifname=name\n"
            "                connect the host TAP network interface to VLAN 'n'\n"
 #else
-           "-net tap[,vlan=n][,fd=h][,ifname=name][,script=file]\n"
-           "                connect the host TAP network interface to VLAN 'n' and use\n"
-           "                the network script 'file' (default=%s);\n"
-           "                use 'script=no' to disable script execution;\n"
+           "-net tap[,vlan=n][,fd=h][,ifname=name][,script=file][,downscript=dfile]\n"
+           "                connect the host TAP network interface to VLAN 'n' and use the\n"
+           "                network scripts 'file' (default=%s)\n"
+           "                and 'dfile' (default=%s);\n"
+           "                use '[down]script=no' to disable script execution;\n"
            "                use 'fd=h' to connect to an already opened TAP interface\n"
 #endif
            "-net socket[,vlan=n][,fd=h][,listen=[host]:port][,connect=host:port]\n"
@@ -7428,9 +7925,6 @@ static void help(int exitcode)
 	   "-no-kvm         disable KVM hardware virtualization\n"
 	   "-no-kvm-irqchip disable KVM kernel mode PIC/IOAPIC/LAPIC\n"
 #endif
-#ifdef USE_CODE_COPY
-           "-no-code-copy   disable code copy acceleration\n"
-#endif
 #ifdef TARGET_I386
            "-std-vga        simulate a standard VGA card with VESA Bochs Extensions\n"
            "                (default is CL-GD5446 PCI VGA)\n"
@@ -7462,6 +7956,7 @@ static void help(int exitcode)
            DEFAULT_RAM_SIZE,
 #ifndef _WIN32
            DEFAULT_NETWORK_SCRIPT,
+           DEFAULT_NETWORK_DOWN_SCRIPT,
 #endif
            DEFAULT_GDBSTUB_PORT,
            "/tmp/qemu.log");
@@ -7481,6 +7976,7 @@ enum {
     QEMU_OPTION_hdb,
     QEMU_OPTION_hdc,
     QEMU_OPTION_hdd,
+    QEMU_OPTION_drive,
     QEMU_OPTION_cdrom,
     QEMU_OPTION_mtdblock,
     QEMU_OPTION_sd,
@@ -7514,6 +8010,7 @@ enum {
     QEMU_OPTION_d,
     QEMU_OPTION_hdachs,
     QEMU_OPTION_L,
+    QEMU_OPTION_bios,
     QEMU_OPTION_no_code_copy,
     QEMU_OPTION_k,
     QEMU_OPTION_localtime,
@@ -7553,6 +8050,7 @@ enum {
     QEMU_OPTION_prom_env,
     QEMU_OPTION_old_param,
     QEMU_OPTION_clock,
+    QEMU_OPTION_startdate,
     QEMU_OPTION_incoming,
     QEMU_OPTION_tdf,
     QEMU_OPTION_kvm_shadow_memory,
@@ -7576,6 +8074,7 @@ const QEMUOption qemu_options[] = {
     { "hdb", HAS_ARG, QEMU_OPTION_hdb },
     { "hdc", HAS_ARG, QEMU_OPTION_hdc },
     { "hdd", HAS_ARG, QEMU_OPTION_hdd },
+    { "drive", HAS_ARG, QEMU_OPTION_drive },
     { "cdrom", HAS_ARG, QEMU_OPTION_cdrom },
     { "mtdblock", HAS_ARG, QEMU_OPTION_mtdblock },
     { "sd", HAS_ARG, QEMU_OPTION_sd },
@@ -7614,6 +8113,7 @@ const QEMUOption qemu_options[] = {
     { "d", HAS_ARG, QEMU_OPTION_d },
     { "hdachs", HAS_ARG, QEMU_OPTION_hdachs },
     { "L", HAS_ARG, QEMU_OPTION_L },
+    { "bios", HAS_ARG, QEMU_OPTION_bios },
     { "no-code-copy", 0, QEMU_OPTION_no_code_copy },
 #ifdef USE_KQEMU
     { "no-kqemu", 0, QEMU_OPTION_no_kqemu },
@@ -7672,18 +8172,10 @@ const QEMUOption qemu_options[] = {
     { "old-param", 0, QEMU_OPTION_old_param },
 #endif
     { "clock", HAS_ARG, QEMU_OPTION_clock },
+    { "startdate", HAS_ARG, QEMU_OPTION_startdate },
     { NULL },
 };
 
-#if defined (TARGET_I386) && defined(USE_CODE_COPY)
-
-/* this stack is only used during signal handling */
-#define SIGNAL_STACK_SIZE 32768
-
-static uint8_t *signal_stack;
-
-#endif
-
 /* password input */
 
 int qemu_key_check(BlockDriverState *bs, const char *name)
@@ -7706,16 +8198,9 @@ int qemu_key_check(BlockDriverState *bs, const char *name)
 
 static BlockDriverState *get_bdrv(int index)
 {
-    BlockDriverState *bs;
-
-    if (index < 4) {
-        bs = bs_table[index];
-    } else if (index < 6) {
-        bs = fd_table[index - 4];
-    } else {
-        bs = NULL;
-    }
-    return bs;
+    if (index > nb_drives)
+        return NULL;
+    return drives_table[index].bdrv;
 }
 
 static void read_passwords(void)
@@ -7731,7 +8216,7 @@ static void read_passwords(void)
 }
 
 /* XXX: currently we cannot use simultaneously different CPUs */
-void register_machines(void)
+static void register_machines(void)
 {
 #if defined(TARGET_I386)
     qemu_register_machine(&pc_machine);
@@ -7746,12 +8231,15 @@ void register_machines(void)
     qemu_register_machine(&mips_machine);
     qemu_register_machine(&mips_malta_machine);
     qemu_register_machine(&mips_pica61_machine);
+    qemu_register_machine(&mips_mipssim_machine);
 #elif defined(TARGET_SPARC)
 #ifdef TARGET_SPARC64
     qemu_register_machine(&sun4u_machine);
 #else
     qemu_register_machine(&ss5_machine);
     qemu_register_machine(&ss10_machine);
+    qemu_register_machine(&ss600mp_machine);
+    qemu_register_machine(&ss20_machine);
 #endif
 #elif defined(TARGET_ARM)
     qemu_register_machine(&integratorcp_machine);
@@ -7763,6 +8251,11 @@ void register_machines(void)
     qemu_register_machine(&borzoipda_machine);
     qemu_register_machine(&terrierpda_machine);
     qemu_register_machine(&palmte_machine);
+    qemu_register_machine(&lm3s811evb_machine);
+    qemu_register_machine(&lm3s6965evb_machine);
+    qemu_register_machine(&connex_machine);
+    qemu_register_machine(&verdex_machine);
+    qemu_register_machine(&mainstone2_machine);
 #elif defined(TARGET_SH4)
     qemu_register_machine(&shix_machine);
     qemu_register_machine(&r2d_machine);
@@ -7771,6 +8264,9 @@ void register_machines(void)
 #elif defined(TARGET_M68K)
     qemu_register_machine(&mcf5208evb_machine);
     qemu_register_machine(&an5206_machine);
+    qemu_register_machine(&dummy_m68k_machine);
+#elif defined(TARGET_CRIS)
+    qemu_register_machine(&bareetraxfs_machine);
 #elif defined(TARGET_IA64)
     qemu_register_machine(&ipf_machine);
 #else
@@ -7920,18 +8416,17 @@ int main(int argc, char **argv)
     int use_gdbstub;
     const char *gdbstub_port;
 #endif
-    int i, cdrom_index, pflash_index;
-    int snapshot, linux_boot;
+    uint32_t boot_devices_bitmap = 0;
+    int i;
+    int snapshot, linux_boot, net_boot;
     const char *initrd_filename;
-    const char *hd_filename[MAX_DISKS], *fd_filename[MAX_FD];
-    const char *pflash_filename[MAX_PFLASH];
-    const char *sd_filename;
-    const char *mtd_filename;
     const char *kernel_filename, *kernel_cmdline;
+    const char *boot_devices = "";
     DisplayState *ds = &display_state;
     int cyls, heads, secs, translation;
     char net_clients[MAX_NET_CLIENTS][256];
     int nb_net_clients;
+    int hda_index;
     int optind;
     const char *r, *optarg;
     CharDriverState *monitor_hd;
@@ -7989,15 +8484,6 @@ int main(int argc, char **argv)
     machine = first_machine;
     cpu_model = NULL;
     initrd_filename = NULL;
-    for(i = 0; i < MAX_FD; i++)
-        fd_filename[i] = NULL;
-    for(i = 0; i < MAX_DISKS; i++)
-        hd_filename[i] = NULL;
-    for(i = 0; i < MAX_PFLASH; i++)
-        pflash_filename[i] = NULL;
-    pflash_index = 0;
-    sd_filename = NULL;
-    mtd_filename = NULL;
     ram_size = DEFAULT_RAM_SIZE * 1024 * 1024;
     vga_ram_size = VGA_RAM_SIZE;
 #ifdef CONFIG_GDBSTUB
@@ -8008,11 +8494,6 @@ int main(int argc, char **argv)
     nographic = 0;
     kernel_filename = NULL;
     kernel_cmdline = "";
-#ifdef TARGET_PPC
-    cdrom_index = 1;
-#else
-    cdrom_index = 2;
-#endif
     cyls = heads = secs = 0;
     translation = BIOS_ATA_TRANSLATION_AUTO;
     pstrcpy(monitor_device, sizeof(monitor_device), "vc");
@@ -8034,6 +8515,9 @@ int main(int argc, char **argv)
     usb_devices_index = 0;
 
     nb_net_clients = 0;
+    nb_drives = 0;
+    nb_drives_opt = 0;
+    hda_index = -1;
 
     nb_nics = 0;
     /* default mac address of the first network interface */
@@ -8044,7 +8528,7 @@ int main(int argc, char **argv)
             break;
         r = argv[optind];
         if (r[0] != '-') {
-            hd_filename[0] = argv[optind++];
+	    hda_index = drive_add(HD_ALIAS, argv[optind++], 0);
         } else {
             const QEMUOption *popt;
 
@@ -8091,14 +8575,9 @@ int main(int argc, char **argv)
             case QEMU_OPTION_cpu:
                 /* hw initialization will check this */
                 if (*optarg == '?') {
-#if defined(TARGET_PPC)
-                    ppc_cpu_list(stdout, &fprintf);
-#elif defined(TARGET_ARM)
-                    arm_cpu_list();
-#elif defined(TARGET_MIPS)
-                    mips_cpu_list(stdout, &fprintf);
-#elif defined(TARGET_SPARC)
-                    sparc_cpu_list(stdout, &fprintf);
+/* XXX: implement xxx_cpu_list for targets that still miss it */
+#if defined(cpu_list)
+                    cpu_list(stdout, &fprintf);
 #endif
                     exit(0);
                 } else {
@@ -8109,29 +8588,33 @@ int main(int argc, char **argv)
                 initrd_filename = optarg;
                 break;
             case QEMU_OPTION_hda:
+                if (cyls == 0)
+                    hda_index = drive_add(HD_ALIAS, optarg, 0);
+                else
+                    hda_index = drive_add(HD_ALIAS
+			     ",cyls=%d,heads=%d,secs=%d%s",
+                             optarg, 0, cyls, heads, secs,
+                             translation == BIOS_ATA_TRANSLATION_LBA ?
+                                 ",trans=lba" :
+                             translation == BIOS_ATA_TRANSLATION_NONE ?
+                                 ",trans=none" : "");
+                 break;
             case QEMU_OPTION_hdb:
             case QEMU_OPTION_hdc:
             case QEMU_OPTION_hdd:
-                {
-                    int hd_index;
-                    hd_index = popt->index - QEMU_OPTION_hda;
-                    hd_filename[hd_index] = optarg;
-                    if (hd_index == cdrom_index)
-                        cdrom_index = -1;
-                }
+		drive_add(HD_ALIAS, optarg, popt->index - QEMU_OPTION_hda);
                 break;
+            case QEMU_OPTION_drive:
+                drive_add("%s", optarg);
+	        break;
             case QEMU_OPTION_mtdblock:
-                mtd_filename = optarg;
+	        drive_add(MTD_ALIAS, optarg);
                 break;
             case QEMU_OPTION_sd:
-                sd_filename = optarg;
+                drive_add("file=\"%s\"," SD_ALIAS, optarg);
                 break;
             case QEMU_OPTION_pflash:
-                if (pflash_index >= MAX_PFLASH) {
-                    fprintf(stderr, "qemu: too many parallel flash images\n");
-                    exit(1);
-                }
-                pflash_filename[pflash_index++] = optarg;
+	        drive_add(PFLASH_ALIAS, optarg);
                 break;
             case QEMU_OPTION_snapshot:
                 snapshot = 1;
@@ -8170,6 +8653,17 @@ int main(int argc, char **argv)
                         fprintf(stderr, "qemu: invalid physical CHS format\n");
                         exit(1);
                     }
+		    if (hda_index != -1)
+		        snprintf(drives_opt[hda_index] +
+			         strlen(drives_opt[hda_index]),
+			         sizeof(drives_opt[0]) -
+				 strlen(drives_opt[hda_index]),
+		                 ",cyls=%d,heads=%d,secs=%d%s",
+			         cyls, heads, secs,
+			         translation == BIOS_ATA_TRANSLATION_LBA ?
+			     	    ",trans=lba" :
+			         translation == BIOS_ATA_TRANSLATION_NONE ?
+			             ",trans=none" : "");
                 }
                 break;
             case QEMU_OPTION_nographic:
@@ -8188,27 +8682,43 @@ int main(int argc, char **argv)
                 kernel_cmdline = optarg;
                 break;
             case QEMU_OPTION_cdrom:
-                if (cdrom_index >= 0) {
-                    hd_filename[cdrom_index] = optarg;
-                }
+		drive_add("file=\"%s\"," CDROM_ALIAS, optarg);
                 break;
             case QEMU_OPTION_boot:
-                boot_device = optarg[0];
-                if (boot_device != 'a' &&
-#if defined(TARGET_SPARC) || defined(TARGET_I386)
-		    // Network boot
-		    boot_device != 'n' &&
-#endif
-                    boot_device != 'c' && boot_device != 'd') {
-                    fprintf(stderr, "qemu: invalid boot device '%c'\n", boot_device);
-                    exit(1);
+                boot_devices = optarg;
+                /* We just do some generic consistency checks */
+                {
+                    /* Could easily be extended to 64 devices if needed */
+                    const char *p;
+                    
+                    boot_devices_bitmap = 0;
+                    for (p = boot_devices; *p != '\0'; p++) {
+                        /* Allowed boot devices are:
+                         * a b     : floppy disk drives
+                         * c ... f : IDE disk drives
+                         * g ... m : machine implementation dependant drives
+                         * n ... p : network devices
+                         * It's up to each machine implementation to check
+                         * if the given boot devices match the actual hardware
+                         * implementation and firmware features.
+                         */
+                        if (*p < 'a' || *p > 'q') {
+                            fprintf(stderr, "Invalid boot device '%c'\n", *p);
+                            exit(1);
+                        }
+                        if (boot_devices_bitmap & (1 << (*p - 'a'))) {
+                            fprintf(stderr,
+                                    "Boot device '%c' was given twice\n",*p);
+                            exit(1);
+                        }
+                        boot_devices_bitmap |= 1 << (*p - 'a');
+                    }
                 }
                 break;
             case QEMU_OPTION_fda:
-                fd_filename[0] = optarg;
-                break;
             case QEMU_OPTION_fdb:
-                fd_filename[1] = optarg;
+		drive_add("file=\"%s\"," FD_ALIAS, optarg,
+		          popt->index - QEMU_OPTION_fda);
                 break;
 #ifdef TARGET_I386
             case QEMU_OPTION_no_fd_bootchk:
@@ -8293,6 +8803,9 @@ int main(int argc, char **argv)
             case QEMU_OPTION_L:
                 bios_dir = optarg;
                 break;
+            case QEMU_OPTION_bios:
+                bios_name = optarg;
+                break;
             case QEMU_OPTION_S:
                 autostart = 0;
                 break;
@@ -8519,6 +9032,42 @@ int main(int argc, char **argv)
             case QEMU_OPTION_clock:
                 configure_alarms(optarg);
                 break;
+            case QEMU_OPTION_startdate:
+                {
+                    struct tm tm;
+                    if (!strcmp(optarg, "now")) {
+                        rtc_start_date = -1;
+                    } else {
+                        if (sscanf(optarg, "%d-%d-%dT%d:%d:%d",
+                               &tm.tm_year,
+                               &tm.tm_mon,
+                               &tm.tm_mday,
+                               &tm.tm_hour,
+                               &tm.tm_min,
+                               &tm.tm_sec) == 6) {
+                            /* OK */
+                        } else if (sscanf(optarg, "%d-%d-%d",
+                                          &tm.tm_year,
+                                          &tm.tm_mon,
+                                          &tm.tm_mday) == 3) {
+                            tm.tm_hour = 0;
+                            tm.tm_min = 0;
+                            tm.tm_sec = 0;
+                        } else {
+                            goto date_fail;
+                        }
+                        tm.tm_year -= 1900;
+                        tm.tm_mon--;
+                        rtc_start_date = mktimegm(&tm);
+                        if (rtc_start_date == -1) {
+                        date_fail:
+                            fprintf(stderr, "Invalid date format. Valid format are:\n"
+                                    "'now' or '2006-06-17T16:01:21' or '2006-06-17'\n");
+                            exit(1);
+                        }
+                    }
+                }
+                break;
             }
         }
     }
@@ -8591,22 +9140,17 @@ int main(int argc, char **argv)
         kqemu_allowed = 0;
 #endif
     linux_boot = (kernel_filename != NULL);
+    net_boot = (boot_devices_bitmap >> ('n' - 'a')) & 0xF;
 
-    if (!linux_boot &&
-        boot_device != 'n' &&
-        hd_filename[0] == '\0' &&
-        (cdrom_index >= 0 && hd_filename[cdrom_index] == '\0') &&
-        fd_filename[0] == '\0')
+    /* XXX: this should not be: some embedded targets just have flash */
+    if (!linux_boot && net_boot == 0 &&
+        nb_drives_opt == 0)
         help(1);
 
     /* boot to floppy or the default cd if no hard disk defined yet */
-    if (hd_filename[0] == '\0' && boot_device == 'c') {
-        if (fd_filename[0] != '\0')
-            boot_device = 'a';
-        else
-            boot_device = 'd';
+    if (!boot_devices[0]) {
+        boot_devices = "cad";
     }
-
     setvbuf(stdout, NULL, _IOLBF, 0);
 
     init_timers();
@@ -8645,20 +9189,28 @@ int main(int argc, char **argv)
     }
 
 #ifdef TARGET_I386
-    if (boot_device == 'n') {
-	for (i = 0; i < nb_nics; i++) {
+    /* XXX: this should be moved in the PC machine instantiation code */
+    if (net_boot != 0) {
+        int netroms = 0;
+	for (i = 0; i < nb_nics && i < 4; i++) {
 	    const char *model = nd_table[i].model;
 	    char buf[1024];
-	    if (model == NULL)
-		model = "ne2k_pci";
-	    snprintf(buf, sizeof(buf), "%s/pxe-%s.bin", bios_dir, model);
-	    if (get_image_size(buf) > 0) {
-		option_rom[nb_option_roms] = strdup(buf);
-		nb_option_roms++;
-		break;
-	    }
+            if (net_boot & (1 << i)) {
+                if (model == NULL)
+                    model = "ne2k_pci";
+                snprintf(buf, sizeof(buf), "%s/pxe-%s.bin", bios_dir, model);
+                if (get_image_size(buf) > 0) {
+                    if (nb_option_roms >= MAX_OPTION_ROMS) {
+                        fprintf(stderr, "Too many option ROMs\n");
+                        exit(1);
+                    }
+                    option_rom[nb_option_roms] = strdup(buf);
+                    nb_option_roms++;
+                    netroms++;
+                }
+            }
 	}
-	if (i == nb_nics) {
+	if (netroms == 0) {
 	    fprintf(stderr, "No valid PXE rom found for network device\n");
 	    exit(1);
 	}
@@ -8670,6 +9222,11 @@ int main(int argc, char **argv)
 
 #if USE_KVM
     /* Initialize kvm */
+#ifdef TARGET_IA64
+#define KVM_EXTRA_PAGES 0
+#else
+#define KVM_EXTRA_PAGES 3
+#endif
     if (kvm_allowed) {
 	    phys_ram_size += KVM_EXTRA_PAGES * TARGET_PAGE_SIZE;
 	    if (kvm_qemu_create_context() < 0) {
@@ -8705,97 +9262,28 @@ int main(int argc, char **argv)
     }
 #endif
 
-    /* we always create the cdrom drive, even if no disk is there */
     bdrv_init();
-    if (cdrom_index >= 0) {
-        bs_table[cdrom_index] = bdrv_new("cdrom");
-        bdrv_set_type_hint(bs_table[cdrom_index], BDRV_TYPE_CDROM);
-    }
 
-    /* open the virtual block devices */
-    for(i = 0; i < MAX_DISKS; i++) {
-        if (hd_filename[i]) {
-            if (!bs_table[i]) {
-                char buf[64];
-                snprintf(buf, sizeof(buf), "hd%c", i + 'a');
-                bs_table[i] = bdrv_new(buf);
-            }
-            if (bdrv_open(bs_table[i], hd_filename[i], snapshot ? BDRV_O_SNAPSHOT : 0) < 0) {
-                fprintf(stderr, "qemu: could not open hard disk image '%s'\n",
-                        hd_filename[i]);
-                exit(1);
-            }
-            if (i == 0 && cyls != 0) {
-                bdrv_set_geometry_hint(bs_table[i], cyls, heads, secs);
-                bdrv_set_translation_hint(bs_table[i], translation);
-            }
-        }
-    }
+    /* we always create the cdrom drive, even if no disk is there */
 
-    /* we always create at least one floppy disk */
-    fd_table[0] = bdrv_new("fda");
-    bdrv_set_type_hint(fd_table[0], BDRV_TYPE_FLOPPY);
+    if (nb_drives_opt < MAX_DRIVES)
+        drive_add(CDROM_ALIAS);
 
-    for(i = 0; i < MAX_FD; i++) {
-        if (fd_filename[i]) {
-            if (!fd_table[i]) {
-                char buf[64];
-                snprintf(buf, sizeof(buf), "fd%c", i + 'a');
-                fd_table[i] = bdrv_new(buf);
-                bdrv_set_type_hint(fd_table[i], BDRV_TYPE_FLOPPY);
-            }
-            if (fd_filename[i][0] != '\0') {
-                if (bdrv_open(fd_table[i], fd_filename[i],
-                              snapshot ? BDRV_O_SNAPSHOT : 0) < 0) {
-                    fprintf(stderr, "qemu: could not open floppy disk image '%s'\n",
-                            fd_filename[i]);
-                    exit(1);
-                }
-            }
-        }
-    }
+    /* we always create at least one floppy */
 
-    /* Open the virtual parallel flash block devices */
-    for(i = 0; i < MAX_PFLASH; i++) {
-        if (pflash_filename[i]) {
-            if (!pflash_table[i]) {
-                char buf[64];
-                snprintf(buf, sizeof(buf), "fl%c", i + 'a');
-                pflash_table[i] = bdrv_new(buf);
-            }
-            if (bdrv_open(pflash_table[i], pflash_filename[i],
-                          snapshot ? BDRV_O_SNAPSHOT : 0) < 0) {
-                fprintf(stderr, "qemu: could not open flash image '%s'\n",
-                        pflash_filename[i]);
-                exit(1);
-            }
-        }
-    }
+    if (nb_drives_opt < MAX_DRIVES)
+        drive_add(FD_ALIAS, 0);
 
-    sd_bdrv = bdrv_new ("sd");
-    /* FIXME: This isn't really a floppy, but it's a reasonable
-       approximation.  */
-    bdrv_set_type_hint(sd_bdrv, BDRV_TYPE_FLOPPY);
-    if (sd_filename) {
-        if (bdrv_open(sd_bdrv, sd_filename,
-                      snapshot ? BDRV_O_SNAPSHOT : 0) < 0) {
-            fprintf(stderr, "qemu: could not open SD card image %s\n",
-                    sd_filename);
-        } else
-            qemu_key_check(sd_bdrv, sd_filename);
-    }
-
-    if (mtd_filename) {
-        mtd_bdrv = bdrv_new ("mtd");
-        if (bdrv_open(mtd_bdrv, mtd_filename,
-                      snapshot ? BDRV_O_SNAPSHOT : 0) < 0 ||
-            qemu_key_check(mtd_bdrv, mtd_filename)) {
-            fprintf(stderr, "qemu: could not open Flash image %s\n",
-                    mtd_filename);
-            bdrv_delete(mtd_bdrv);
-            mtd_bdrv = 0;
-        }
-    }
+    /* we always create one sd slot, even if no card is in it */
+
+    if (nb_drives_opt < MAX_DRIVES)
+        drive_add(SD_ALIAS);
+
+    /* open the virtual block devices */
+
+    for(i = 0; i < nb_drives_opt; i++)
+        if (drive_init(drives_opt[i], snapshot, machine) == -1)
+	    exit(1);
 
     register_savevm("timer", 0, 2, timer_save, timer_load, NULL);
     register_savevm("ram", 0, 3, ram_save, ram_load, NULL);
@@ -8816,6 +9304,8 @@ int main(int argc, char **argv)
         sdl_display_init(ds, full_screen, no_frame);
 #elif defined(CONFIG_COCOA)
         cocoa_display_init(ds, full_screen);
+#else
+        dumb_display_init(ds);
 #endif
     }
 
@@ -8894,8 +9384,7 @@ int main(int argc, char **argv)
         }
     }
 
-    machine->init(ram_size, vga_ram_size, boot_device,
-                  ds, fd_filename, snapshot,
+    machine->init(ram_size, vga_ram_size, boot_devices, ds,
                   kernel_filename, kernel_cmdline, initrd_filename, cpu_model);
 
     /* init USB devices */
@@ -8977,5 +9466,23 @@ int main(int argc, char **argv)
 
     main_loop();
     quit_timers();
+
+#if !defined(_WIN32)
+    /* close network clients */
+    for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
+        VLANClientState *vc;
+
+        for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
+            if (vc->fd_read == tap_receive) {
+                char ifname[64];
+                TAPState *s = vc->opaque;
+
+                if (sscanf(vc->info_str, "tap: ifname=%63s ", ifname) == 1 &&
+                    s->down_script[0])
+                    launch_script(s->down_script, ifname, s->fd);
+            }
+    }
+    }
+#endif
     return 0;
 }
diff --git a/vl.h b/vl.h
deleted file mode 100644
index f162a4d43..000000000
--- a/vl.h
+++ /dev/null
@@ -1,1774 +0,0 @@
-/*
- * QEMU System Emulator header
- *
- * Copyright (c) 2003 Fabrice Bellard
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#ifndef VL_H
-#define VL_H
-
-/* we put basic includes here to avoid repeating them in device drivers */
-#include <stdlib.h>
-#include <stdio.h>
-#include <stdarg.h>
-#include <string.h>
-#include <inttypes.h>
-#include <limits.h>
-#include <time.h>
-#include <ctype.h>
-#include <errno.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <sys/stat.h>
-
-#ifndef O_LARGEFILE
-#define O_LARGEFILE 0
-#endif
-#ifndef O_BINARY
-#define O_BINARY 0
-#endif
-
-#ifndef ENOMEDIUM
-#define ENOMEDIUM ENODEV
-#endif
-
-#ifdef _WIN32
-#include <windows.h>
-#define fsync _commit
-#define lseek _lseeki64
-#define ENOTSUP 4096
-extern int qemu_ftruncate64(int, int64_t);
-#define ftruncate qemu_ftruncate64
-
-
-static inline char *realpath(const char *path, char *resolved_path)
-{
-    _fullpath(resolved_path, path, _MAX_PATH);
-    return resolved_path;
-}
-
-#define PRId64 "I64d"
-#define PRIx64 "I64x"
-#define PRIu64 "I64u"
-#define PRIo64 "I64o"
-#endif
-
-#ifdef QEMU_TOOL
-
-/* we use QEMU_TOOL in the command line tools which do not depend on
-   the target CPU type */
-#include "config-host.h"
-#include <setjmp.h>
-#include "osdep.h"
-#include "bswap.h"
-
-#else
-
-#include "audio/audio.h"
-#include "cpu.h"
-
-#endif /* !defined(QEMU_TOOL) */
-
-#ifndef glue
-#define xglue(x, y) x ## y
-#define glue(x, y) xglue(x, y)
-#define stringify(s)	tostring(s)
-#define tostring(s)	#s
-#endif
-
-#ifndef likely
-#if __GNUC__ < 3
-#define __builtin_expect(x, n) (x)
-#endif
-
-#define likely(x)   __builtin_expect(!!(x), 1)
-#define unlikely(x)   __builtin_expect(!!(x), 0)
-#endif
-
-#ifndef MIN
-#define MIN(a, b) (((a) < (b)) ? (a) : (b))
-#endif
-#ifndef MAX
-#define MAX(a, b) (((a) > (b)) ? (a) : (b))
-#endif
-
-#ifndef always_inline
-#if (__GNUC__ < 3) || defined(__APPLE__)
-#define always_inline inline
-#else
-#define always_inline __attribute__ (( always_inline )) inline
-#endif
-#endif
-
-/* cutils.c */
-void pstrcpy(char *buf, int buf_size, const char *str);
-char *pstrcat(char *buf, int buf_size, const char *s);
-int strstart(const char *str, const char *val, const char **ptr);
-int stristart(const char *str, const char *val, const char **ptr);
-int hex2bin(char ch);
-char *urldecode(const char *ptr);
-
-/* vl.c */
-void qemu_get_launch_info(int *argc, char ***argv, int *opt_daemonize, const char **opt_incoming);
-
-uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c);
-
-void hw_error(const char *fmt, ...);
-
-extern const char *bios_dir;
-
-extern int vm_running;
-extern const char *qemu_name;
-
-typedef struct vm_change_state_entry VMChangeStateEntry;
-typedef void VMChangeStateHandler(void *opaque, int running);
-typedef void VMStopHandler(void *opaque, int reason);
-
-VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb,
-                                                     void *opaque);
-void qemu_del_vm_change_state_handler(VMChangeStateEntry *e);
-
-int qemu_add_vm_stop_handler(VMStopHandler *cb, void *opaque);
-void qemu_del_vm_stop_handler(VMStopHandler *cb, void *opaque);
-
-void vm_start(void);
-void vm_stop(int reason);
-
-typedef void QEMUResetHandler(void *opaque);
-
-void qemu_register_reset(QEMUResetHandler *func, void *opaque);
-void qemu_system_reset(void);
-void qemu_system_reset_request(void);
-void qemu_system_shutdown_request(void);
-void qemu_system_powerdown_request(void);
-int qemu_shutdown_requested(void);
-int qemu_reset_requested(void);
-int qemu_powerdown_requested(void);
-
-#if !defined(TARGET_SPARC)
-// Please implement a power failure function to signal the OS
-#define qemu_system_powerdown() do{}while(0)
-#else
-void qemu_system_powerdown(void);
-#endif
-
-void main_loop_wait(int timeout);
-
-extern int64_t ram_size;
-extern int bios_size;
-extern int rtc_utc;
-extern int cirrus_vga_enabled;
-extern int vmsvga_enabled;
-extern int graphic_width;
-extern int graphic_height;
-extern int graphic_depth;
-extern const char *keyboard_layout;
-extern int kqemu_allowed;
-extern int kvm_allowed;
-extern int kvm_irqchip;
-extern int win2k_install_hack;
-extern int alt_grab;
-extern int usb_enabled;
-extern int smp_cpus;
-extern int cursor_hide;
-extern int graphic_rotate;
-extern int no_quit;
-extern int semihosting_enabled;
-extern int autostart;
-extern int time_drift_fix;
-extern int old_param;
-extern const char *bootp_filename;
-
-#define MAX_OPTION_ROMS 16
-extern const char *option_rom[MAX_OPTION_ROMS];
-extern int nb_option_roms;
-
-#ifdef TARGET_SPARC
-#define MAX_PROM_ENVS 128
-extern const char *prom_envs[MAX_PROM_ENVS];
-extern unsigned int nb_prom_envs;
-#endif
-
-/* XXX: make it dynamic */
-#ifndef TARGET_IA64
-#define MAX_BIOS_SIZE (4 * 1024 * 1024)
-#else
-#define MAX_BIOS_SIZE (16 * 1024 *1024)
-#endif
-#if defined (TARGET_PPC) || defined (TARGET_SPARC64)
-#define BIOS_SIZE ((512 + 32) * 1024)
-#elif defined(TARGET_MIPS)
-#define BIOS_SIZE (4 * 1024 * 1024)
-#endif
-
-#if USE_KVM
-#ifdef TARGET_IA64
-#define KVM_EXTRA_PAGES 0
-#else
-#define KVM_EXTRA_PAGES 3
-#endif
-#endif
-
-/* keyboard/mouse support */
-
-#define MOUSE_EVENT_LBUTTON 0x01
-#define MOUSE_EVENT_RBUTTON 0x02
-#define MOUSE_EVENT_MBUTTON 0x04
-
-typedef void QEMUPutKBDEvent(void *opaque, int keycode);
-typedef void QEMUPutMouseEvent(void *opaque, int dx, int dy, int dz, int buttons_state);
-
-typedef struct QEMUPutMouseEntry {
-    QEMUPutMouseEvent *qemu_put_mouse_event;
-    void *qemu_put_mouse_event_opaque;
-    int qemu_put_mouse_event_absolute;
-    char *qemu_put_mouse_event_name;
-
-    /* used internally by qemu for handling mice */
-    struct QEMUPutMouseEntry *next;
-} QEMUPutMouseEntry;
-
-void qemu_add_kbd_event_handler(QEMUPutKBDEvent *func, void *opaque);
-QEMUPutMouseEntry *qemu_add_mouse_event_handler(QEMUPutMouseEvent *func,
-                                                void *opaque, int absolute,
-                                                const char *name);
-void qemu_remove_mouse_event_handler(QEMUPutMouseEntry *entry);
-
-void kbd_put_keycode(int keycode);
-void kbd_mouse_event(int dx, int dy, int dz, int buttons_state);
-int kbd_mouse_is_absolute(void);
-
-void do_info_mice(void);
-void do_mouse_set(int index);
-
-/* keysym is a unicode code except for special keys (see QEMU_KEY_xxx
-   constants) */
-#define QEMU_KEY_ESC1(c) ((c) | 0xe100)
-#define QEMU_KEY_BACKSPACE  0x007f
-#define QEMU_KEY_UP         QEMU_KEY_ESC1('A')
-#define QEMU_KEY_DOWN       QEMU_KEY_ESC1('B')
-#define QEMU_KEY_RIGHT      QEMU_KEY_ESC1('C')
-#define QEMU_KEY_LEFT       QEMU_KEY_ESC1('D')
-#define QEMU_KEY_HOME       QEMU_KEY_ESC1(1)
-#define QEMU_KEY_END        QEMU_KEY_ESC1(4)
-#define QEMU_KEY_PAGEUP     QEMU_KEY_ESC1(5)
-#define QEMU_KEY_PAGEDOWN   QEMU_KEY_ESC1(6)
-#define QEMU_KEY_DELETE     QEMU_KEY_ESC1(3)
-
-#define QEMU_KEY_CTRL_UP         0xe400
-#define QEMU_KEY_CTRL_DOWN       0xe401
-#define QEMU_KEY_CTRL_LEFT       0xe402
-#define QEMU_KEY_CTRL_RIGHT      0xe403
-#define QEMU_KEY_CTRL_HOME       0xe404
-#define QEMU_KEY_CTRL_END        0xe405
-#define QEMU_KEY_CTRL_PAGEUP     0xe406
-#define QEMU_KEY_CTRL_PAGEDOWN   0xe407
-
-void kbd_put_keysym(int keysym);
-
-/* async I/O support */
-
-typedef void IOReadHandler(void *opaque, const uint8_t *buf, int size);
-typedef int IOCanRWHandler(void *opaque);
-typedef void IOHandler(void *opaque);
-
-int qemu_set_fd_handler2(int fd,
-                         IOCanRWHandler *fd_read_poll,
-                         IOHandler *fd_read,
-                         IOHandler *fd_write,
-                         void *opaque);
-int qemu_set_fd_handler(int fd,
-                        IOHandler *fd_read,
-                        IOHandler *fd_write,
-                        void *opaque);
-
-/* Polling handling */
-
-/* return TRUE if no sleep should be done afterwards */
-typedef int PollingFunc(void *opaque);
-
-int qemu_add_polling_cb(PollingFunc *func, void *opaque);
-void qemu_del_polling_cb(PollingFunc *func, void *opaque);
-
-#ifdef _WIN32
-/* Wait objects handling */
-typedef void WaitObjectFunc(void *opaque);
-
-int qemu_add_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque);
-void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque);
-#endif
-
-typedef struct QEMUBH QEMUBH;
-
-/* character device */
-
-#define CHR_EVENT_BREAK 0 /* serial break char */
-#define CHR_EVENT_FOCUS 1 /* focus to this terminal (modal input needed) */
-#define CHR_EVENT_RESET 2 /* new connection established */
-
-
-#define CHR_IOCTL_SERIAL_SET_PARAMS   1
-typedef struct {
-    int speed;
-    int parity;
-    int data_bits;
-    int stop_bits;
-} QEMUSerialSetParams;
-
-#define CHR_IOCTL_SERIAL_SET_BREAK    2
-
-#define CHR_IOCTL_PP_READ_DATA        3
-#define CHR_IOCTL_PP_WRITE_DATA       4
-#define CHR_IOCTL_PP_READ_CONTROL     5
-#define CHR_IOCTL_PP_WRITE_CONTROL    6
-#define CHR_IOCTL_PP_READ_STATUS      7
-#define CHR_IOCTL_PP_EPP_READ_ADDR    8
-#define CHR_IOCTL_PP_EPP_READ         9
-#define CHR_IOCTL_PP_EPP_WRITE_ADDR  10
-#define CHR_IOCTL_PP_EPP_WRITE       11
-
-typedef void IOEventHandler(void *opaque, int event);
-
-typedef struct CharDriverState {
-    int (*chr_write)(struct CharDriverState *s, const uint8_t *buf, int len);
-    void (*chr_update_read_handler)(struct CharDriverState *s);
-    int (*chr_ioctl)(struct CharDriverState *s, int cmd, void *arg);
-    IOEventHandler *chr_event;
-    IOCanRWHandler *chr_can_read;
-    IOReadHandler *chr_read;
-    void *handler_opaque;
-    void (*chr_send_event)(struct CharDriverState *chr, int event);
-    void (*chr_close)(struct CharDriverState *chr);
-    void *opaque;
-    int focus;
-    QEMUBH *bh;
-} CharDriverState;
-
-CharDriverState *qemu_chr_open(const char *filename);
-void qemu_chr_printf(CharDriverState *s, const char *fmt, ...);
-int qemu_chr_write(CharDriverState *s, const uint8_t *buf, int len);
-void qemu_chr_send_event(CharDriverState *s, int event);
-void qemu_chr_add_handlers(CharDriverState *s,
-                           IOCanRWHandler *fd_can_read,
-                           IOReadHandler *fd_read,
-                           IOEventHandler *fd_event,
-                           void *opaque);
-int qemu_chr_ioctl(CharDriverState *s, int cmd, void *arg);
-void qemu_chr_reset(CharDriverState *s);
-int qemu_chr_can_read(CharDriverState *s);
-void qemu_chr_read(CharDriverState *s, uint8_t *buf, int len);
-
-/* consoles */
-
-typedef struct DisplayState DisplayState;
-typedef struct TextConsole TextConsole;
-
-typedef void (*vga_hw_update_ptr)(void *);
-typedef void (*vga_hw_invalidate_ptr)(void *);
-typedef void (*vga_hw_screen_dump_ptr)(void *, const char *);
-
-TextConsole *graphic_console_init(DisplayState *ds, vga_hw_update_ptr update,
-                                  vga_hw_invalidate_ptr invalidate,
-                                  vga_hw_screen_dump_ptr screen_dump,
-                                  void *opaque);
-void vga_hw_update(void);
-void vga_hw_invalidate(void);
-void vga_hw_screen_dump(const char *filename);
-
-int is_graphic_console(void);
-CharDriverState *text_console_init(DisplayState *ds, const char *p);
-void console_select(unsigned int index);
-
-/* vmchannel devices */
-
-#define MAX_VMCHANNEL_DEVICES 4
-
-/* serial ports */
-
-#define MAX_SERIAL_PORTS 4
-
-extern CharDriverState *serial_hds[MAX_SERIAL_PORTS];
-
-/* parallel ports */
-
-#define MAX_PARALLEL_PORTS 3
-
-extern CharDriverState *parallel_hds[MAX_PARALLEL_PORTS];
-
-struct ParallelIOArg {
-    void *buffer;
-    int count;
-};
-
-/* VLANs support */
-
-typedef struct VLANClientState VLANClientState;
-
-struct VLANClientState {
-    IOReadHandler *fd_read;
-    /* Packets may still be sent if this returns zero.  It's used to
-       rate-limit the slirp code.  */
-    IOCanRWHandler *fd_can_read;
-    void *opaque;
-    struct VLANClientState *next;
-    struct VLANState *vlan;
-    char info_str[256];
-};
-
-typedef struct VLANState {
-    int id;
-    VLANClientState *first_client;
-    struct VLANState *next;
-    unsigned int nb_guest_devs, nb_host_devs;
-} VLANState;
-
-VLANState *qemu_find_vlan(int id);
-VLANClientState *qemu_new_vlan_client(VLANState *vlan,
-                                      IOReadHandler *fd_read,
-                                      IOCanRWHandler *fd_can_read,
-                                      void *opaque);
-int qemu_can_send_packet(VLANClientState *vc);
-void qemu_send_packet(VLANClientState *vc, const uint8_t *buf, int size);
-void qemu_handler_true(void *opaque);
-
-void do_info_network(void);
-
-/* TAP win32 */
-int tap_win32_init(VLANState *vlan, const char *ifname);
-
-/* NIC info */
-
-#define MAX_NICS 8
-
-typedef struct NICInfo {
-    uint8_t macaddr[6];
-    const char *model;
-    VLANState *vlan;
-} NICInfo;
-
-extern int nb_nics;
-extern NICInfo nd_table[MAX_NICS];
-
-/* timers */
-
-typedef struct QEMUClock QEMUClock;
-typedef struct QEMUTimer QEMUTimer;
-typedef void QEMUTimerCB(void *opaque);
-
-/* The real time clock should be used only for stuff which does not
-   change the virtual machine state, as it is run even if the virtual
-   machine is stopped. The real time clock has a frequency of 1000
-   Hz. */
-extern QEMUClock *rt_clock;
-
-/* The virtual clock is only run during the emulation. It is stopped
-   when the virtual machine is stopped. Virtual timers use a high
-   precision clock, usually cpu cycles (use ticks_per_sec). */
-extern QEMUClock *vm_clock;
-
-int64_t qemu_get_clock(QEMUClock *clock);
-
-QEMUTimer *qemu_new_timer(QEMUClock *clock, QEMUTimerCB *cb, void *opaque);
-void qemu_free_timer(QEMUTimer *ts);
-void qemu_del_timer(QEMUTimer *ts);
-void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time);
-int qemu_timer_pending(QEMUTimer *ts);
-
-extern int64_t ticks_per_sec;
-
-int64_t cpu_get_ticks(void);
-void cpu_enable_ticks(void);
-void cpu_disable_ticks(void);
-
-/* VM Load/Save */
-
-typedef struct QEMUFile QEMUFile;
-
-typedef void (QEMUFilePutBufferFunc)(void *opaque, const uint8_t *buf, int64_t pos, int size);
-typedef int (QEMUFileGetBufferFunc)(void *opaque, uint8_t *buf, int64_t pos, int size);
-typedef void (QEMUFileCloseFunc)(void *opaque);
-
-QEMUFile *qemu_fopen(void *opaque, QEMUFilePutBufferFunc *put_buffer,
-		     QEMUFileGetBufferFunc *get_buffer, QEMUFileCloseFunc *close);
-QEMUFile *qemu_fopen_file(const char *filename, const char *mode);
-QEMUFile *qemu_fopen_fd(int fd);
-void qemu_fflush(QEMUFile *f);
-void qemu_fclose(QEMUFile *f);
-void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, int size);
-void qemu_put_byte(QEMUFile *f, int v);
-void qemu_put_be16(QEMUFile *f, unsigned int v);
-void qemu_put_be32(QEMUFile *f, unsigned int v);
-void qemu_put_be64(QEMUFile *f, uint64_t v);
-int qemu_get_buffer(QEMUFile *f, uint8_t *buf, int size);
-int qemu_get_byte(QEMUFile *f);
-unsigned int qemu_get_be16(QEMUFile *f);
-unsigned int qemu_get_be32(QEMUFile *f);
-uint64_t qemu_get_be64(QEMUFile *f);
-
-static inline void qemu_put_be64s(QEMUFile *f, const uint64_t *pv)
-{
-    qemu_put_be64(f, *pv);
-}
-
-static inline void qemu_put_be32s(QEMUFile *f, const uint32_t *pv)
-{
-    qemu_put_be32(f, *pv);
-}
-
-static inline void qemu_put_be16s(QEMUFile *f, const uint16_t *pv)
-{
-    qemu_put_be16(f, *pv);
-}
-
-static inline void qemu_put_8s(QEMUFile *f, const uint8_t *pv)
-{
-    qemu_put_byte(f, *pv);
-}
-
-static inline void qemu_get_be64s(QEMUFile *f, uint64_t *pv)
-{
-    *pv = qemu_get_be64(f);
-}
-
-static inline void qemu_get_be32s(QEMUFile *f, uint32_t *pv)
-{
-    *pv = qemu_get_be32(f);
-}
-
-static inline void qemu_get_be16s(QEMUFile *f, uint16_t *pv)
-{
-    *pv = qemu_get_be16(f);
-}
-
-static inline void qemu_get_8s(QEMUFile *f, uint8_t *pv)
-{
-    *pv = qemu_get_byte(f);
-}
-
-#if TARGET_LONG_BITS == 64
-#define qemu_put_betl qemu_put_be64
-#define qemu_get_betl qemu_get_be64
-#define qemu_put_betls qemu_put_be64s
-#define qemu_get_betls qemu_get_be64s
-#else
-#define qemu_put_betl qemu_put_be32
-#define qemu_get_betl qemu_get_be32
-#define qemu_put_betls qemu_put_be32s
-#define qemu_get_betls qemu_get_be32s
-#endif
-
-int64_t qemu_ftell(QEMUFile *f);
-int64_t qemu_fseek(QEMUFile *f, int64_t pos, int whence);
-
-typedef void SaveStateHandler(QEMUFile *f, void *opaque);
-typedef int LoadStateHandler(QEMUFile *f, void *opaque, int version_id);
-
-int register_savevm(const char *idstr,
-                    int instance_id,
-                    int version_id,
-                    SaveStateHandler *save_state,
-                    LoadStateHandler *load_state,
-                    void *opaque);
-void qemu_get_timer(QEMUFile *f, QEMUTimer *ts);
-void qemu_put_timer(QEMUFile *f, QEMUTimer *ts);
-
-void cpu_save(QEMUFile *f, void *opaque);
-int cpu_load(QEMUFile *f, void *opaque, int version_id);
-
-void do_savevm(const char *name);
-void do_loadvm(const char *name);
-void do_delvm(const char *name);
-void do_info_snapshots(void);
-
-int qemu_live_savevm_state(QEMUFile *f);
-int qemu_live_loadvm_state(QEMUFile *f);
-
-/* bottom halves */
-typedef void QEMUBHFunc(void *opaque);
-
-QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque);
-void qemu_bh_schedule(QEMUBH *bh);
-void qemu_bh_cancel(QEMUBH *bh);
-void qemu_bh_delete(QEMUBH *bh);
-int qemu_bh_poll(void);
-
-/* block.c */
-typedef struct BlockDriverState BlockDriverState;
-typedef struct BlockDriver BlockDriver;
-
-extern BlockDriver bdrv_raw;
-extern BlockDriver bdrv_host_device;
-extern BlockDriver bdrv_cow;
-extern BlockDriver bdrv_qcow;
-extern BlockDriver bdrv_vmdk;
-extern BlockDriver bdrv_cloop;
-extern BlockDriver bdrv_dmg;
-extern BlockDriver bdrv_bochs;
-extern BlockDriver bdrv_vpc;
-extern BlockDriver bdrv_vvfat;
-extern BlockDriver bdrv_qcow2;
-extern BlockDriver bdrv_parallels;
-
-typedef struct BlockDriverInfo {
-    /* in bytes, 0 if irrelevant */
-    int cluster_size;
-    /* offset at which the VM state can be saved (0 if not possible) */
-    int64_t vm_state_offset;
-} BlockDriverInfo;
-
-typedef struct QEMUSnapshotInfo {
-    char id_str[128]; /* unique snapshot id */
-    /* the following fields are informative. They are not needed for
-       the consistency of the snapshot */
-    char name[256]; /* user choosen name */
-    uint32_t vm_state_size; /* VM state info size */
-    uint32_t date_sec; /* UTC date of the snapshot */
-    uint32_t date_nsec;
-    uint64_t vm_clock_nsec; /* VM clock relative to boot */
-} QEMUSnapshotInfo;
-
-typedef struct DiskIOStatistics {
-    uint64_t read_byte_counter;
-    uint64_t write_byte_counter;
-}DiskIOStatistics;
-
-#define BDRV_O_RDONLY      0x0000
-#define BDRV_O_RDWR        0x0002
-#define BDRV_O_ACCESS      0x0003
-#define BDRV_O_CREAT       0x0004 /* create an empty file */
-#define BDRV_O_SNAPSHOT    0x0008 /* open the file read only and save writes in a snapshot */
-#define BDRV_O_FILE        0x0010 /* open as a raw file (do not try to
-                                     use a disk image format on top of
-                                     it (default for
-                                     bdrv_file_open()) */
-
-void bdrv_init(void);
-BlockDriver *bdrv_find_format(const char *format_name);
-int bdrv_create(BlockDriver *drv,
-                const char *filename, int64_t size_in_sectors,
-                const char *backing_file, int flags);
-BlockDriverState *bdrv_new(const char *device_name);
-void bdrv_delete(BlockDriverState *bs);
-int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags);
-int bdrv_open(BlockDriverState *bs, const char *filename, int flags);
-int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
-               BlockDriver *drv);
-void bdrv_close(BlockDriverState *bs);
-int bdrv_read(BlockDriverState *bs, int64_t sector_num,
-              uint8_t *buf, int nb_sectors);
-int bdrv_write(BlockDriverState *bs, int64_t sector_num,
-               const uint8_t *buf, int nb_sectors);
-int bdrv_pread(BlockDriverState *bs, int64_t offset,
-               void *buf, int count);
-int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
-                const void *buf, int count);
-int bdrv_truncate(BlockDriverState *bs, int64_t offset);
-int64_t bdrv_getlength(BlockDriverState *bs);
-void bdrv_get_geometry(BlockDriverState *bs, int64_t *nb_sectors_ptr);
-int bdrv_commit(BlockDriverState *bs);
-void bdrv_set_boot_sector(BlockDriverState *bs, const uint8_t *data, int size);
-void bdrv_flush_all(void);
-/* async block I/O */
-typedef struct BlockDriverAIOCB BlockDriverAIOCB;
-typedef void BlockDriverCompletionFunc(void *opaque, int ret);
-
-BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num,
-                                uint8_t *buf, int nb_sectors,
-                                BlockDriverCompletionFunc *cb, void *opaque);
-BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,
-                                 const uint8_t *buf, int nb_sectors,
-                                 BlockDriverCompletionFunc *cb, void *opaque);
-void bdrv_aio_cancel(BlockDriverAIOCB *acb);
-
-void qemu_aio_init(void);
-void qemu_aio_poll(void);
-void qemu_aio_flush(void);
-void qemu_aio_wait_start(void);
-void qemu_aio_wait(void);
-void qemu_aio_wait_end(void);
-
-int qemu_key_check(BlockDriverState *bs, const char *name);
-
-/* Ensure contents are flushed to disk.  */
-void bdrv_flush(BlockDriverState *bs);
-
-#define BDRV_TYPE_HD     0
-#define BDRV_TYPE_CDROM  1
-#define BDRV_TYPE_FLOPPY 2
-#define BIOS_ATA_TRANSLATION_AUTO   0
-#define BIOS_ATA_TRANSLATION_NONE   1
-#define BIOS_ATA_TRANSLATION_LBA    2
-#define BIOS_ATA_TRANSLATION_LARGE  3
-#define BIOS_ATA_TRANSLATION_RECHS  4
-
-void bdrv_set_geometry_hint(BlockDriverState *bs,
-                            int cyls, int heads, int secs);
-void bdrv_set_type_hint(BlockDriverState *bs, int type);
-void bdrv_set_translation_hint(BlockDriverState *bs, int translation);
-void bdrv_get_geometry_hint(BlockDriverState *bs,
-                            int *pcyls, int *pheads, int *psecs);
-int bdrv_get_type_hint(BlockDriverState *bs);
-int bdrv_get_translation_hint(BlockDriverState *bs);
-int bdrv_is_removable(BlockDriverState *bs);
-int bdrv_is_read_only(BlockDriverState *bs);
-int bdrv_is_inserted(BlockDriverState *bs);
-int bdrv_media_changed(BlockDriverState *bs);
-int bdrv_is_locked(BlockDriverState *bs);
-void bdrv_set_locked(BlockDriverState *bs, int locked);
-void bdrv_eject(BlockDriverState *bs, int eject_flag);
-void bdrv_set_change_cb(BlockDriverState *bs,
-                        void (*change_cb)(void *opaque), void *opaque);
-void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
-void bdrv_info(void);
-BlockDriverState *bdrv_find(const char *name);
-void bdrv_iterate(void (*it)(void *opaque, const char *name), void *opaque);
-int bdrv_is_encrypted(BlockDriverState *bs);
-int bdrv_set_key(BlockDriverState *bs, const char *key);
-void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
-                         void *opaque);
-const char *bdrv_get_device_name(BlockDriverState *bs);
-int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
-                          const uint8_t *buf, int nb_sectors);
-int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi);
-
-void bdrv_get_backing_filename(BlockDriverState *bs,
-                               char *filename, int filename_size);
-int bdrv_snapshot_create(BlockDriverState *bs,
-                         QEMUSnapshotInfo *sn_info);
-int bdrv_snapshot_goto(BlockDriverState *bs,
-                       const char *snapshot_id);
-int bdrv_snapshot_delete(BlockDriverState *bs, const char *snapshot_id);
-int bdrv_snapshot_list(BlockDriverState *bs,
-                       QEMUSnapshotInfo **psn_info);
-char *bdrv_snapshot_dump(char *buf, int buf_size, QEMUSnapshotInfo *sn);
-
-char *get_human_readable_size(char *buf, int buf_size, int64_t size);
-int path_is_absolute(const char *path);
-void path_combine(char *dest, int dest_size,
-                  const char *base_path,
-                  const char *filename);
-
-#ifndef QEMU_TOOL
-
-typedef void QEMUMachineInitFunc(ram_addr_t ram_size, int vga_ram_size,
-                                 int boot_device,
-             DisplayState *ds, const char **fd_filename, int snapshot,
-             const char *kernel_filename, const char *kernel_cmdline,
-             const char *initrd_filename, const char *cpu_model);
-
-typedef struct QEMUMachine {
-    const char *name;
-    const char *desc;
-    QEMUMachineInitFunc *init;
-    struct QEMUMachine *next;
-} QEMUMachine;
-
-int qemu_register_machine(QEMUMachine *m);
-
-typedef void SetIRQFunc(void *opaque, int irq_num, int level);
-
-#if defined(TARGET_PPC)
-void ppc_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...));
-#endif
-
-#if defined(TARGET_MIPS)
-void mips_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...));
-#endif
-
-#include "hw/irq.h"
-
-/* ISA bus */
-
-extern target_phys_addr_t isa_mem_base;
-
-typedef void (IOPortWriteFunc)(void *opaque, uint32_t address, uint32_t data);
-typedef uint32_t (IOPortReadFunc)(void *opaque, uint32_t address);
-
-int register_ioport_read(int start, int length, int size,
-                         IOPortReadFunc *func, void *opaque);
-int register_ioport_write(int start, int length, int size,
-                          IOPortWriteFunc *func, void *opaque);
-void isa_unassign_ioport(int start, int length);
-
-void isa_mmio_init(target_phys_addr_t base, target_phys_addr_t size);
-
-/* PCI bus */
-
-extern target_phys_addr_t pci_mem_base;
-
-typedef struct PCIBus PCIBus;
-typedef struct PCIDevice PCIDevice;
-
-typedef void PCIConfigWriteFunc(PCIDevice *pci_dev,
-                                uint32_t address, uint32_t data, int len);
-typedef uint32_t PCIConfigReadFunc(PCIDevice *pci_dev,
-                                   uint32_t address, int len);
-typedef void PCIMapIORegionFunc(PCIDevice *pci_dev, int region_num,
-                                uint32_t addr, uint32_t size, int type);
-
-#define PCI_ADDRESS_SPACE_MEM		0x00
-#define PCI_ADDRESS_SPACE_IO		0x01
-#define PCI_ADDRESS_SPACE_MEM_PREFETCH	0x08
-
-typedef struct PCIIORegion {
-    uint32_t addr; /* current PCI mapping address. -1 means not mapped */
-    uint32_t size;
-    uint8_t type;
-    PCIMapIORegionFunc *map_func;
-} PCIIORegion;
-
-#define PCI_ROM_SLOT 6
-#define PCI_NUM_REGIONS 7
-
-#define PCI_DEVICES_MAX 64
-
-#define PCI_VENDOR_ID		0x00	/* 16 bits */
-#define PCI_DEVICE_ID		0x02	/* 16 bits */
-#define PCI_COMMAND		0x04	/* 16 bits */
-#define  PCI_COMMAND_IO		0x1	/* Enable response in I/O space */
-#define  PCI_COMMAND_MEMORY	0x2	/* Enable response in Memory space */
-#define PCI_CLASS_DEVICE        0x0a    /* Device class */
-#define PCI_INTERRUPT_LINE	0x3c	/* 8 bits */
-#define PCI_INTERRUPT_PIN	0x3d	/* 8 bits */
-#define PCI_MIN_GNT		0x3e	/* 8 bits */
-#define PCI_MAX_LAT		0x3f	/* 8 bits */
-
-struct PCIDevice {
-    /* PCI config space */
-    uint8_t config[256];
-
-    /* the following fields are read only */
-    PCIBus *bus;
-    int devfn;
-    char name[64];
-    PCIIORegion io_regions[PCI_NUM_REGIONS];
-
-    /* do not access the following fields */
-    PCIConfigReadFunc *config_read;
-    PCIConfigWriteFunc *config_write;
-    /* ??? This is a PC-specific hack, and should be removed.  */
-    int irq_index;
-
-    /* IRQ objects for the INTA-INTD pins.  */
-    qemu_irq *irq;
-
-    /* Current IRQ levels.  Used internally by the generic PCI code.  */
-    int irq_state[4];
-};
-
-PCIDevice *pci_register_device(PCIBus *bus, const char *name,
-                               int instance_size, int devfn,
-                               PCIConfigReadFunc *config_read,
-                               PCIConfigWriteFunc *config_write);
-
-void pci_register_io_region(PCIDevice *pci_dev, int region_num,
-                            uint32_t size, int type,
-                            PCIMapIORegionFunc *map_func);
-
-uint32_t pci_default_read_config(PCIDevice *d,
-                                 uint32_t address, int len);
-void pci_default_write_config(PCIDevice *d,
-                              uint32_t address, uint32_t val, int len);
-void pci_device_save(PCIDevice *s, QEMUFile *f);
-int pci_device_load(PCIDevice *s, QEMUFile *f);
-
-typedef void (*pci_set_irq_fn)(qemu_irq *pic, int irq_num, int level);
-typedef int (*pci_map_irq_fn)(PCIDevice *pci_dev, int irq_num);
-PCIBus *pci_register_bus(pci_set_irq_fn set_irq, pci_map_irq_fn map_irq,
-                         qemu_irq *pic, int devfn_min, int nirq);
-
-void pci_nic_init(PCIBus *bus, NICInfo *nd, int devfn);
-void pci_data_write(void *opaque, uint32_t addr, uint32_t val, int len);
-uint32_t pci_data_read(void *opaque, uint32_t addr, int len);
-int pci_bus_num(PCIBus *s);
-void pci_for_each_device(int bus_num, void (*fn)(PCIDevice *d));
-
-void pci_info(void);
-PCIBus *pci_bridge_init(PCIBus *bus, int devfn, uint32_t id,
-                        pci_map_irq_fn map_irq, const char *name);
-
-/* prep_pci.c */
-PCIBus *pci_prep_init(qemu_irq *pic);
-
-/* grackle_pci.c */
-PCIBus *pci_grackle_init(uint32_t base, qemu_irq *pic);
-
-/* unin_pci.c */
-PCIBus *pci_pmac_init(qemu_irq *pic);
-
-/* apb_pci.c */
-PCIBus *pci_apb_init(target_phys_addr_t special_base, target_phys_addr_t mem_base,
-                     qemu_irq *pic);
-
-PCIBus *pci_vpb_init(qemu_irq *pic, int irq, int realview);
-
-/* piix_pci.c */
-PCIBus *i440fx_init(PCIDevice **pi440fx_state, qemu_irq *pic);
-void i440fx_set_smm(PCIDevice *d, int val);
-int piix3_init(PCIBus *bus, int devfn);
-void i440fx_init_memory_mappings(PCIDevice *d);
-
-int piix4_init(PCIBus *bus, int devfn);
-
-/* openpic.c */
-/* OpenPIC have 5 outputs per CPU connected and one IRQ out single output */
-enum {
-    OPENPIC_OUTPUT_INT = 0, /* IRQ                       */
-    OPENPIC_OUTPUT_CINT,    /* critical IRQ              */
-    OPENPIC_OUTPUT_MCK,     /* Machine check event       */
-    OPENPIC_OUTPUT_DEBUG,   /* Inconditional debug event */
-    OPENPIC_OUTPUT_RESET,   /* Core reset event          */
-    OPENPIC_OUTPUT_NB,
-};
-qemu_irq *openpic_init (PCIBus *bus, int *pmem_index, int nb_cpus,
-                        qemu_irq **irqs, qemu_irq irq_out);
-
-/* heathrow_pic.c */
-qemu_irq *heathrow_pic_init(int *pmem_index);
-
-/* gt64xxx.c */
-PCIBus *pci_gt64120_init(qemu_irq *pic);
-
-#ifdef HAS_AUDIO
-struct soundhw {
-    const char *name;
-    const char *descr;
-    int enabled;
-    int isa;
-    union {
-        int (*init_isa) (AudioState *s, qemu_irq *pic);
-        int (*init_pci) (PCIBus *bus, AudioState *s);
-    } init;
-};
-
-extern struct soundhw soundhw[];
-#endif
-
-/* vga.c */
-
-#ifndef TARGET_SPARC
-#define VGA_RAM_SIZE (8192 * 1024)
-#else
-#define VGA_RAM_SIZE (9 * 1024 * 1024)
-#endif
-
-struct DisplayState {
-    uint8_t *data;
-    int linesize;
-    int depth;
-    int bgr; /* BGR color order instead of RGB. Only valid for depth == 32 */
-    int width;
-    int height;
-    void *opaque;
-    QEMUTimer *gui_timer;
-
-    void (*dpy_update)(struct DisplayState *s, int x, int y, int w, int h);
-    void (*dpy_resize)(struct DisplayState *s, int w, int h);
-    void (*dpy_refresh)(struct DisplayState *s);
-    void (*dpy_copy)(struct DisplayState *s, int src_x, int src_y,
-                     int dst_x, int dst_y, int w, int h);
-    void (*dpy_fill)(struct DisplayState *s, int x, int y,
-                     int w, int h, uint32_t c);
-    void (*mouse_set)(int x, int y, int on);
-    void (*cursor_define)(int width, int height, int bpp, int hot_x, int hot_y,
-                          uint8_t *image, uint8_t *mask);
-};
-
-static inline void dpy_update(DisplayState *s, int x, int y, int w, int h)
-{
-    s->dpy_update(s, x, y, w, h);
-}
-
-static inline void dpy_resize(DisplayState *s, int w, int h)
-{
-    s->dpy_resize(s, w, h);
-}
-
-int isa_vga_init(DisplayState *ds, uint8_t *vga_ram_base,
-                 unsigned long vga_ram_offset, int vga_ram_size);
-int pci_vga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
-                 unsigned long vga_ram_offset, int vga_ram_size,
-                 unsigned long vga_bios_offset, int vga_bios_size);
-int isa_vga_mm_init(DisplayState *ds, uint8_t *vga_ram_base,
-                    unsigned long vga_ram_offset, int vga_ram_size,
-                    target_phys_addr_t vram_base, target_phys_addr_t ctrl_base,
-                    int it_shift);
-
-/* cirrus_vga.c */
-void pci_cirrus_vga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
-                         unsigned long vga_ram_offset, int vga_ram_size);
-void isa_cirrus_vga_init(DisplayState *ds, uint8_t *vga_ram_base,
-                         unsigned long vga_ram_offset, int vga_ram_size);
-
-/* vmware_vga.c */
-void pci_vmsvga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
-                     unsigned long vga_ram_offset, int vga_ram_size);
-
-/* sdl.c */
-void sdl_display_init(DisplayState *ds, int full_screen, int no_frame);
-
-/* cocoa.m */
-void cocoa_display_init(DisplayState *ds, int full_screen);
-
-/* vnc.c */
-void vnc_display_init(DisplayState *ds);
-void vnc_display_close(DisplayState *ds);
-int vnc_display_open(DisplayState *ds, const char *display);
-int vnc_display_password(DisplayState *ds, const char *password);
-void do_info_vnc(void);
-
-/* x_keymap.c */
-extern uint8_t _translate_keycode(const int key);
-
-/* ide.c */
-#define MAX_DISKS 4
-
-extern BlockDriverState *bs_table[MAX_DISKS + 1];
-extern BlockDriverState *sd_bdrv;
-extern BlockDriverState *mtd_bdrv;
-
-void isa_ide_init(int iobase, int iobase2, qemu_irq irq,
-                  BlockDriverState *hd0, BlockDriverState *hd1);
-void pci_cmd646_ide_init(PCIBus *bus, BlockDriverState **hd_table,
-                         int secondary_ide_enabled);
-void pci_piix3_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
-                        qemu_irq *pic);
-void pci_piix4_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
-                        qemu_irq *pic);
-int pmac_ide_init (BlockDriverState **hd_table, qemu_irq irq);
-
-/* cdrom.c */
-int cdrom_read_toc(int nb_sectors, uint8_t *buf, int msf, int start_track);
-int cdrom_read_toc_raw(int nb_sectors, uint8_t *buf, int msf, int session_num);
-
-/* ds1225y.c */
-typedef struct ds1225y_t ds1225y_t;
-ds1225y_t *ds1225y_init(target_phys_addr_t mem_base, const char *filename);
-
-/* es1370.c */
-int es1370_init (PCIBus *bus, AudioState *s);
-
-/* sb16.c */
-int SB16_init (AudioState *s, qemu_irq *pic);
-
-/* adlib.c */
-int Adlib_init (AudioState *s, qemu_irq *pic);
-
-/* gus.c */
-int GUS_init (AudioState *s, qemu_irq *pic);
-
-/* dma.c */
-typedef int (*DMA_transfer_handler) (void *opaque, int nchan, int pos, int size);
-int DMA_get_channel_mode (int nchan);
-int DMA_read_memory (int nchan, void *buf, int pos, int size);
-int DMA_write_memory (int nchan, void *buf, int pos, int size);
-void DMA_hold_DREQ (int nchan);
-void DMA_release_DREQ (int nchan);
-void DMA_schedule(int nchan);
-void DMA_run (void);
-void DMA_init (int high_page_enable);
-void DMA_register_channel (int nchan,
-                           DMA_transfer_handler transfer_handler,
-                           void *opaque);
-/* fdc.c */
-#define MAX_FD 2
-extern BlockDriverState *fd_table[MAX_FD];
-
-typedef struct fdctrl_t fdctrl_t;
-
-fdctrl_t *fdctrl_init (qemu_irq irq, int dma_chann, int mem_mapped,
-                       target_phys_addr_t io_base,
-                       BlockDriverState **fds);
-int fdctrl_get_drive_type(fdctrl_t *fdctrl, int drive_num);
-
-/* eepro100.c */
-
-void pci_i82551_init(PCIBus *bus, NICInfo *nd, int devfn);
-void pci_i82557b_init(PCIBus *bus, NICInfo *nd, int devfn);
-void pci_i82559er_init(PCIBus *bus, NICInfo *nd, int devfn);
-
-/* ne2000.c */
-
-void isa_ne2000_init(int base, qemu_irq irq, NICInfo *nd);
-void pci_ne2000_init(PCIBus *bus, NICInfo *nd, int devfn);
-
-/* rtl8139.c */
-
-void pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn);
-
-/* pcnet.c */
-
-void pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn);
-void lance_init(NICInfo *nd, target_phys_addr_t leaddr, void *dma_opaque,
-                qemu_irq irq, qemu_irq *reset);
-
-/* vmmouse.c */
-void *vmmouse_init(void *m);
-
-/* vmport.c */
-#ifdef TARGET_I386
-void vmport_init(CPUState *env);
-void vmport_register(unsigned char command, IOPortReadFunc *func, void *opaque);
-#endif
-
-/* pckbd.c */
-
-void i8042_init(qemu_irq kbd_irq, qemu_irq mouse_irq, uint32_t io_base);
-void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq,
-                   target_phys_addr_t base, int it_shift);
-
-/* mc146818rtc.c */
-
-typedef struct RTCState RTCState;
-
-RTCState *rtc_init(int base, qemu_irq irq);
-RTCState *rtc_mm_init(target_phys_addr_t base, int it_shift, qemu_irq irq);
-void rtc_set_memory(RTCState *s, int addr, int val);
-void rtc_set_date(RTCState *s, const struct tm *tm);
-
-/* serial.c */
-
-typedef struct SerialState SerialState;
-SerialState *serial_init(int base, qemu_irq irq, CharDriverState *chr);
-SerialState *serial_mm_init (target_phys_addr_t base, int it_shift,
-                             qemu_irq irq, CharDriverState *chr,
-                             int ioregister);
-uint32_t serial_mm_readb (void *opaque, target_phys_addr_t addr);
-void serial_mm_writeb (void *opaque, target_phys_addr_t addr, uint32_t value);
-uint32_t serial_mm_readw (void *opaque, target_phys_addr_t addr);
-void serial_mm_writew (void *opaque, target_phys_addr_t addr, uint32_t value);
-uint32_t serial_mm_readl (void *opaque, target_phys_addr_t addr);
-void serial_mm_writel (void *opaque, target_phys_addr_t addr, uint32_t value);
-
-/* parallel.c */
-
-typedef struct ParallelState ParallelState;
-ParallelState *parallel_init(int base, qemu_irq irq, CharDriverState *chr);
-ParallelState *parallel_mm_init(target_phys_addr_t base, int it_shift, qemu_irq irq, CharDriverState *chr);
-
-/* i8259.c */
-
-typedef struct PicState2 PicState2;
-extern PicState2 *isa_pic;
-void pic_set_irq(int irq, int level);
-void pic_set_irq_new(void *opaque, int irq, int level);
-qemu_irq *i8259_init(qemu_irq parent_irq);
-void pic_set_alt_irq_func(PicState2 *s, SetIRQFunc *alt_irq_func,
-                          void *alt_irq_opaque);
-int pic_read_irq(PicState2 *s);
-void pic_update_irq(PicState2 *s);
-uint32_t pic_intack_read(PicState2 *s);
-void pic_info(void);
-void irq_info(void);
-
-/* APIC */
-typedef struct IOAPICState IOAPICState;
-
-int apic_init(CPUState *env);
-int apic_get_interrupt(CPUState *env);
-int apic_accept_pic_intr(CPUState *env);
-IOAPICState *ioapic_init(void);
-void ioapic_set_irq(void *opaque, int vector, int level);
-
-/* i8254.c */
-
-#define PIT_FREQ 1193182
-
-typedef struct PITState PITState;
-
-PITState *pit_init(int base, qemu_irq irq);
-void pit_set_gate(PITState *pit, int channel, int val);
-int pit_get_gate(PITState *pit, int channel);
-int pit_get_initial_count(PITState *pit, int channel);
-int pit_get_mode(PITState *pit, int channel);
-int pit_get_out(PITState *pit, int channel, int64_t current_time);
-
-/* jazz_led.c */
-extern void jazz_led_init(DisplayState *ds, target_phys_addr_t base);
-
-/* pcspk.c */
-void pcspk_init(PITState *);
-int pcspk_audio_init(AudioState *, qemu_irq *pic);
-
-#include "hw/i2c.h"
-
-#include "hw/smbus.h"
-
-/* acpi.c */
-extern int acpi_enabled;
-i2c_bus *piix4_pm_init(PCIBus *bus, int devfn, uint32_t smb_io_base);
-void piix4_smbus_register_device(SMBusDevice *dev, uint8_t addr);
-void acpi_bios_init(void);
-
-/* pc.c */
-extern QEMUMachine pc_machine;
-extern QEMUMachine isapc_machine;
-extern int fd_bootchk;
-
-void ioport_set_a20(int enable);
-int ioport_get_a20(void);
-
-/* ipf.c*/
-extern QEMUMachine ipf_machine;
-
-/* ppc.c */
-extern QEMUMachine prep_machine;
-extern QEMUMachine core99_machine;
-extern QEMUMachine heathrow_machine;
-extern QEMUMachine ref405ep_machine;
-extern QEMUMachine taihu_machine;
-
-/* mips_r4k.c */
-extern QEMUMachine mips_machine;
-
-/* mips_malta.c */
-extern QEMUMachine mips_malta_machine;
-
-/* mips_int.c */
-extern void cpu_mips_irq_init_cpu(CPUState *env);
-
-/* mips_pica61.c */
-extern QEMUMachine mips_pica61_machine;
-
-/* mips_timer.c */
-extern void cpu_mips_clock_init(CPUState *);
-extern void cpu_mips_irqctrl_init (void);
-
-/* shix.c */
-extern QEMUMachine shix_machine;
-
-/* r2d.c */
-extern QEMUMachine r2d_machine;
-
-#ifdef TARGET_PPC
-/* PowerPC hardware exceptions management helpers */
-typedef void (*clk_setup_cb)(void *opaque, uint32_t freq);
-typedef struct clk_setup_t clk_setup_t;
-struct clk_setup_t {
-    clk_setup_cb cb;
-    void *opaque;
-};
-static inline void clk_setup (clk_setup_t *clk, uint32_t freq)
-{
-    if (clk->cb != NULL)
-        (*clk->cb)(clk->opaque, freq);
-}
-
-clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq);
-/* Embedded PowerPC DCR management */
-typedef target_ulong (*dcr_read_cb)(void *opaque, int dcrn);
-typedef void (*dcr_write_cb)(void *opaque, int dcrn, target_ulong val);
-int ppc_dcr_init (CPUState *env, int (*dcr_read_error)(int dcrn),
-                  int (*dcr_write_error)(int dcrn));
-int ppc_dcr_register (CPUState *env, int dcrn, void *opaque,
-                      dcr_read_cb drc_read, dcr_write_cb dcr_write);
-clk_setup_cb ppc_emb_timers_init (CPUState *env, uint32_t freq);
-/* Embedded PowerPC reset */
-void ppc40x_core_reset (CPUState *env);
-void ppc40x_chip_reset (CPUState *env);
-void ppc40x_system_reset (CPUState *env);
-#endif
-void PREP_debug_write (void *opaque, uint32_t addr, uint32_t val);
-
-extern CPUWriteMemoryFunc *PPC_io_write[];
-extern CPUReadMemoryFunc *PPC_io_read[];
-void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val);
-
-/* sun4m.c */
-extern QEMUMachine ss5_machine, ss10_machine;
-
-/* iommu.c */
-void *iommu_init(target_phys_addr_t addr);
-void sparc_iommu_memory_rw(void *opaque, target_phys_addr_t addr,
-                                 uint8_t *buf, int len, int is_write);
-static inline void sparc_iommu_memory_read(void *opaque,
-                                           target_phys_addr_t addr,
-                                           uint8_t *buf, int len)
-{
-    sparc_iommu_memory_rw(opaque, addr, buf, len, 0);
-}
-
-static inline void sparc_iommu_memory_write(void *opaque,
-                                            target_phys_addr_t addr,
-                                            uint8_t *buf, int len)
-{
-    sparc_iommu_memory_rw(opaque, addr, buf, len, 1);
-}
-
-/* tcx.c */
-void tcx_init(DisplayState *ds, target_phys_addr_t addr, uint8_t *vram_base,
-              unsigned long vram_offset, int vram_size, int width, int height,
-              int depth);
-
-/* slavio_intctl.c */
-void *slavio_intctl_init(target_phys_addr_t addr, target_phys_addr_t addrg,
-                         const uint32_t *intbit_to_level,
-                         qemu_irq **irq, qemu_irq **cpu_irq,
-                         qemu_irq **parent_irq, unsigned int cputimer);
-void slavio_pic_info(void *opaque);
-void slavio_irq_info(void *opaque);
-
-/* loader.c */
-int get_image_size(const char *filename);
-int load_image(const char *filename, uint8_t *addr);
-int load_elf(const char *filename, int64_t virt_to_phys_addend,
-             uint64_t *pentry, uint64_t *lowaddr, uint64_t *highaddr);
-int load_aout(const char *filename, uint8_t *addr);
-int load_uboot(const char *filename, target_ulong *ep, int *is_linux);
-
-/* slavio_timer.c */
-void slavio_timer_init(target_phys_addr_t addr, qemu_irq irq, int mode);
-
-/* slavio_serial.c */
-SerialState *slavio_serial_init(target_phys_addr_t base, qemu_irq irq,
-                                CharDriverState *chr1, CharDriverState *chr2);
-void slavio_serial_ms_kbd_init(target_phys_addr_t base, qemu_irq irq);
-
-/* slavio_misc.c */
-void *slavio_misc_init(target_phys_addr_t base, target_phys_addr_t power_base,
-                       qemu_irq irq);
-void slavio_set_power_fail(void *opaque, int power_failing);
-
-/* esp.c */
-void esp_scsi_attach(void *opaque, BlockDriverState *bd, int id);
-void *esp_init(BlockDriverState **bd, target_phys_addr_t espaddr,
-               void *dma_opaque, qemu_irq irq, qemu_irq *reset);
-
-/* sparc32_dma.c */
-void *sparc32_dma_init(target_phys_addr_t daddr, qemu_irq parent_irq,
-                       void *iommu, qemu_irq **dev_irq, qemu_irq **reset);
-void ledma_memory_read(void *opaque, target_phys_addr_t addr,
-                       uint8_t *buf, int len, int do_bswap);
-void ledma_memory_write(void *opaque, target_phys_addr_t addr,
-                        uint8_t *buf, int len, int do_bswap);
-void espdma_memory_read(void *opaque, uint8_t *buf, int len);
-void espdma_memory_write(void *opaque, uint8_t *buf, int len);
-
-/* cs4231.c */
-void cs_init(target_phys_addr_t base, int irq, void *intctl);
-
-/* sun4u.c */
-extern QEMUMachine sun4u_machine;
-
-/* NVRAM helpers */
-#include "hw/m48t59.h"
-
-void NVRAM_set_byte (m48t59_t *nvram, uint32_t addr, uint8_t value);
-uint8_t NVRAM_get_byte (m48t59_t *nvram, uint32_t addr);
-void NVRAM_set_word (m48t59_t *nvram, uint32_t addr, uint16_t value);
-uint16_t NVRAM_get_word (m48t59_t *nvram, uint32_t addr);
-void NVRAM_set_lword (m48t59_t *nvram, uint32_t addr, uint32_t value);
-uint32_t NVRAM_get_lword (m48t59_t *nvram, uint32_t addr);
-void NVRAM_set_string (m48t59_t *nvram, uint32_t addr,
-                       const unsigned char *str, uint32_t max);
-int NVRAM_get_string (m48t59_t *nvram, uint8_t *dst, uint16_t addr, int max);
-void NVRAM_set_crc (m48t59_t *nvram, uint32_t addr,
-                    uint32_t start, uint32_t count);
-int PPC_NVRAM_set_params (m48t59_t *nvram, uint16_t NVRAM_size,
-                          const unsigned char *arch,
-                          uint32_t RAM_size, int boot_device,
-                          uint32_t kernel_image, uint32_t kernel_size,
-                          const char *cmdline,
-                          uint32_t initrd_image, uint32_t initrd_size,
-                          uint32_t NVRAM_image,
-                          int width, int height, int depth);
-
-/* adb.c */
-
-#define MAX_ADB_DEVICES 16
-
-#define ADB_MAX_OUT_LEN 16
-
-typedef struct ADBDevice ADBDevice;
-
-/* hypercall.c */
-
-void pci_hypercall_init(PCIBus *bus);
-void vmchannel_init(CharDriverState *hd, uint32_t deviceid, uint32_t index);
-
-/* buf = NULL means polling */
-typedef int ADBDeviceRequest(ADBDevice *d, uint8_t *buf_out,
-                              const uint8_t *buf, int len);
-typedef int ADBDeviceReset(ADBDevice *d);
-
-struct ADBDevice {
-    struct ADBBusState *bus;
-    int devaddr;
-    int handler;
-    ADBDeviceRequest *devreq;
-    ADBDeviceReset *devreset;
-    void *opaque;
-};
-
-typedef struct ADBBusState {
-    ADBDevice devices[MAX_ADB_DEVICES];
-    int nb_devices;
-    int poll_index;
-} ADBBusState;
-
-int adb_request(ADBBusState *s, uint8_t *buf_out,
-                const uint8_t *buf, int len);
-int adb_poll(ADBBusState *s, uint8_t *buf_out);
-
-ADBDevice *adb_register_device(ADBBusState *s, int devaddr,
-                               ADBDeviceRequest *devreq,
-                               ADBDeviceReset *devreset,
-                               void *opaque);
-void adb_kbd_init(ADBBusState *bus);
-void adb_mouse_init(ADBBusState *bus);
-
-/* cuda.c */
-
-extern ADBBusState adb_bus;
-int cuda_init(qemu_irq irq);
-
-#include "hw/usb.h"
-
-/* usb ports of the VM */
-
-void qemu_register_usb_port(USBPort *port, void *opaque, int index,
-                            usb_attachfn attach);
-
-#define VM_USB_HUB_SIZE 8
-
-void do_usb_add(const char *devname);
-void do_usb_del(const char *devname);
-void usb_info(void);
-
-/* scsi-disk.c */
-enum scsi_reason {
-    SCSI_REASON_DONE, /* Command complete.  */
-    SCSI_REASON_DATA  /* Transfer complete, more data required.  */
-};
-
-typedef struct SCSIDevice SCSIDevice;
-typedef void (*scsi_completionfn)(void *opaque, int reason, uint32_t tag,
-                                  uint32_t arg);
-
-SCSIDevice *scsi_disk_init(BlockDriverState *bdrv,
-                           int tcq,
-                           scsi_completionfn completion,
-                           void *opaque);
-void scsi_disk_destroy(SCSIDevice *s);
-
-int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun);
-/* SCSI data transfers are asynchrnonous.  However, unlike the block IO
-   layer the completion routine may be called directly by
-   scsi_{read,write}_data.  */
-void scsi_read_data(SCSIDevice *s, uint32_t tag);
-int scsi_write_data(SCSIDevice *s, uint32_t tag);
-void scsi_cancel_io(SCSIDevice *s, uint32_t tag);
-uint8_t *scsi_get_buf(SCSIDevice *s, uint32_t tag);
-
-/* lsi53c895a.c */
-void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id);
-void *lsi_scsi_init(PCIBus *bus, int devfn);
-
-/* integratorcp.c */
-extern QEMUMachine integratorcp_machine;
-
-/* versatilepb.c */
-extern QEMUMachine versatilepb_machine;
-extern QEMUMachine versatileab_machine;
-
-/* realview.c */
-extern QEMUMachine realview_machine;
-
-/* spitz.c */
-extern QEMUMachine akitapda_machine;
-extern QEMUMachine spitzpda_machine;
-extern QEMUMachine borzoipda_machine;
-extern QEMUMachine terrierpda_machine;
-
-/* palm.c */
-extern QEMUMachine palmte_machine;
-
-/* ps2.c */
-void *ps2_kbd_init(void (*update_irq)(void *, int), void *update_arg);
-void *ps2_mouse_init(void (*update_irq)(void *, int), void *update_arg);
-void ps2_write_mouse(void *, int val);
-void ps2_write_keyboard(void *, int val);
-uint32_t ps2_read_data(void *);
-void ps2_queue(void *, int b);
-void ps2_keyboard_set_translation(void *opaque, int mode);
-void ps2_mouse_fake_event(void *opaque);
-
-/* smc91c111.c */
-void smc91c111_init(NICInfo *, uint32_t, qemu_irq);
-
-/* pl031.c */
-void pl031_init(uint32_t base, qemu_irq irq);
-
-/* pl110.c */
-void *pl110_init(DisplayState *ds, uint32_t base, qemu_irq irq, int);
-
-/* pl011.c */
-void pl011_init(uint32_t base, qemu_irq irq, CharDriverState *chr);
-
-/* pl050.c */
-void pl050_init(uint32_t base, qemu_irq irq, int is_mouse);
-
-/* pl080.c */
-void *pl080_init(uint32_t base, qemu_irq irq, int nchannels);
-
-/* pl181.c */
-void pl181_init(uint32_t base, BlockDriverState *bd,
-                qemu_irq irq0, qemu_irq irq1);
-
-/* pl190.c */
-qemu_irq *pl190_init(uint32_t base, qemu_irq irq, qemu_irq fiq);
-
-/* arm-timer.c */
-void sp804_init(uint32_t base, qemu_irq irq);
-void icp_pit_init(uint32_t base, qemu_irq *pic, int irq);
-
-/* arm_sysctl.c */
-void arm_sysctl_init(uint32_t base, uint32_t sys_id);
-
-/* arm_gic.c */
-qemu_irq *arm_gic_init(uint32_t base, qemu_irq parent_irq);
-
-/* arm_boot.c */
-
-void arm_load_kernel(CPUState *env, int ram_size, const char *kernel_filename,
-                     const char *kernel_cmdline, const char *initrd_filename,
-                     int board_id, target_phys_addr_t loader_start);
-
-/* sh7750.c */
-struct SH7750State;
-
-struct SH7750State *sh7750_init(CPUState * cpu);
-
-typedef struct {
-    /* The callback will be triggered if any of the designated lines change */
-    uint16_t portamask_trigger;
-    uint16_t portbmask_trigger;
-    /* Return 0 if no action was taken */
-    int (*port_change_cb) (uint16_t porta, uint16_t portb,
-			   uint16_t * periph_pdtra,
-			   uint16_t * periph_portdira,
-			   uint16_t * periph_pdtrb,
-			   uint16_t * periph_portdirb);
-} sh7750_io_device;
-
-int sh7750_register_io_device(struct SH7750State *s,
-			      sh7750_io_device * device);
-/* sh_timer.c */
-#define TMU012_FEAT_TOCR   (1 << 0)
-#define TMU012_FEAT_3CHAN  (1 << 1)
-#define TMU012_FEAT_EXTCLK (1 << 2)
-void tmu012_init(uint32_t base, int feat, uint32_t freq);
-
-/* sh_serial.c */
-#define SH_SERIAL_FEAT_SCIF (1 << 0)
-void sh_serial_init (target_phys_addr_t base, int feat,
-		     uint32_t freq, CharDriverState *chr);
-
-/* tc58128.c */
-int tc58128_init(struct SH7750State *s, char *zone1, char *zone2);
-
-/* NOR flash devices */
-#define MAX_PFLASH 4
-extern BlockDriverState *pflash_table[MAX_PFLASH];
-typedef struct pflash_t pflash_t;
-
-pflash_t *pflash_register (target_phys_addr_t base, ram_addr_t off,
-                           BlockDriverState *bs,
-                           uint32_t sector_len, int nb_blocs, int width,
-                           uint16_t id0, uint16_t id1,
-                           uint16_t id2, uint16_t id3);
-
-/* nand.c */
-struct nand_flash_s;
-struct nand_flash_s *nand_init(int manf_id, int chip_id);
-void nand_done(struct nand_flash_s *s);
-void nand_setpins(struct nand_flash_s *s,
-                int cle, int ale, int ce, int wp, int gnd);
-void nand_getpins(struct nand_flash_s *s, int *rb);
-void nand_setio(struct nand_flash_s *s, uint8_t value);
-uint8_t nand_getio(struct nand_flash_s *s);
-
-#define NAND_MFR_TOSHIBA	0x98
-#define NAND_MFR_SAMSUNG	0xec
-#define NAND_MFR_FUJITSU	0x04
-#define NAND_MFR_NATIONAL	0x8f
-#define NAND_MFR_RENESAS	0x07
-#define NAND_MFR_STMICRO	0x20
-#define NAND_MFR_HYNIX		0xad
-#define NAND_MFR_MICRON		0x2c
-
-/* ecc.c */
-struct ecc_state_s {
-    uint8_t cp;		/* Column parity */
-    uint16_t lp[2];	/* Line parity */
-    uint16_t count;
-};
-
-uint8_t ecc_digest(struct ecc_state_s *s, uint8_t sample);
-void ecc_reset(struct ecc_state_s *s);
-void ecc_put(QEMUFile *f, struct ecc_state_s *s);
-void ecc_get(QEMUFile *f, struct ecc_state_s *s);
-
-/* GPIO */
-typedef void (*gpio_handler_t)(int line, int level, void *opaque);
-
-/* ads7846.c */
-struct ads7846_state_s;
-uint32_t ads7846_read(void *opaque);
-void ads7846_write(void *opaque, uint32_t value);
-struct ads7846_state_s *ads7846_init(qemu_irq penirq);
-
-/* max111x.c */
-struct max111x_s;
-uint32_t max111x_read(void *opaque);
-void max111x_write(void *opaque, uint32_t value);
-struct max111x_s *max1110_init(qemu_irq cb);
-struct max111x_s *max1111_init(qemu_irq cb);
-void max111x_set_input(struct max111x_s *s, int line, uint8_t value);
-
-/* PCMCIA/Cardbus */
-
-struct pcmcia_socket_s {
-    qemu_irq irq;
-    int attached;
-    const char *slot_string;
-    const char *card_string;
-};
-
-void pcmcia_socket_register(struct pcmcia_socket_s *socket);
-void pcmcia_socket_unregister(struct pcmcia_socket_s *socket);
-void pcmcia_info(void);
-
-struct pcmcia_card_s {
-    void *state;
-    struct pcmcia_socket_s *slot;
-    int (*attach)(void *state);
-    int (*detach)(void *state);
-    const uint8_t *cis;
-    int cis_len;
-
-    /* Only valid if attached */
-    uint8_t (*attr_read)(void *state, uint32_t address);
-    void (*attr_write)(void *state, uint32_t address, uint8_t value);
-    uint16_t (*common_read)(void *state, uint32_t address);
-    void (*common_write)(void *state, uint32_t address, uint16_t value);
-    uint16_t (*io_read)(void *state, uint32_t address);
-    void (*io_write)(void *state, uint32_t address, uint16_t value);
-};
-
-#define CISTPL_DEVICE		0x01	/* 5V Device Information Tuple */
-#define CISTPL_NO_LINK		0x14	/* No Link Tuple */
-#define CISTPL_VERS_1		0x15	/* Level 1 Version Tuple */
-#define CISTPL_JEDEC_C		0x18	/* JEDEC ID Tuple */
-#define CISTPL_JEDEC_A		0x19	/* JEDEC ID Tuple */
-#define CISTPL_CONFIG		0x1a	/* Configuration Tuple */
-#define CISTPL_CFTABLE_ENTRY	0x1b	/* 16-bit PCCard Configuration */
-#define CISTPL_DEVICE_OC	0x1c	/* Additional Device Information */
-#define CISTPL_DEVICE_OA	0x1d	/* Additional Device Information */
-#define CISTPL_DEVICE_GEO	0x1e	/* Additional Device Information */
-#define CISTPL_DEVICE_GEO_A	0x1f	/* Additional Device Information */
-#define CISTPL_MANFID		0x20	/* Manufacture ID Tuple */
-#define CISTPL_FUNCID		0x21	/* Function ID Tuple */
-#define CISTPL_FUNCE		0x22	/* Function Extension Tuple */
-#define CISTPL_END		0xff	/* Tuple End */
-#define CISTPL_ENDMARK		0xff
-
-/* dscm1xxxx.c */
-struct pcmcia_card_s *dscm1xxxx_init(BlockDriverState *bdrv);
-
-/* ptimer.c */
-typedef struct ptimer_state ptimer_state;
-typedef void (*ptimer_cb)(void *opaque);
-
-ptimer_state *ptimer_init(QEMUBH *bh);
-void ptimer_set_period(ptimer_state *s, int64_t period);
-void ptimer_set_freq(ptimer_state *s, uint32_t freq);
-void ptimer_set_limit(ptimer_state *s, uint64_t limit, int reload);
-uint64_t ptimer_get_count(ptimer_state *s);
-void ptimer_set_count(ptimer_state *s, uint64_t count);
-void ptimer_run(ptimer_state *s, int oneshot);
-void ptimer_stop(ptimer_state *s);
-void qemu_put_ptimer(QEMUFile *f, ptimer_state *s);
-void qemu_get_ptimer(QEMUFile *f, ptimer_state *s);
-
-#include "hw/pxa.h"
-
-#include "hw/omap.h"
-
-/* mcf_uart.c */
-uint32_t mcf_uart_read(void *opaque, target_phys_addr_t addr);
-void mcf_uart_write(void *opaque, target_phys_addr_t addr, uint32_t val);
-void *mcf_uart_init(qemu_irq irq, CharDriverState *chr);
-void mcf_uart_mm_init(target_phys_addr_t base, qemu_irq irq,
-                      CharDriverState *chr);
-
-/* mcf_intc.c */
-qemu_irq *mcf_intc_init(target_phys_addr_t base, CPUState *env);
-
-/* mcf_fec.c */
-void mcf_fec_init(NICInfo *nd, target_phys_addr_t base, qemu_irq *irq);
-
-/* mcf5206.c */
-qemu_irq *mcf5206_init(uint32_t base, CPUState *env);
-
-/* an5206.c */
-extern QEMUMachine an5206_machine;
-
-/* mcf5208.c */
-extern QEMUMachine mcf5208evb_machine;
-
-#include "gdbstub.h"
-
-#endif /* defined(QEMU_TOOL) */
-
-/* migration.c */
-void do_info_migration(void);
-void do_migrate(int detach, const char *uri);
-void do_migrate_cancel(void);
-void do_migrate_set_speed(const char *value);
-int migrate_incoming(const char *device);
-
-/* monitor.c */
-void monitor_init(CharDriverState *hd, int show_banner);
-void term_puts(const char *str);
-void term_vprintf(const char *fmt, va_list ap);
-void term_printf(const char *fmt, ...) __attribute__ ((__format__ (__printf__, 1, 2)));
-void term_print_filename(const char *filename);
-void term_flush(void);
-void term_print_help(void);
-void monitor_readline(const char *prompt, int is_password,
-                      char *buf, int buf_size);
-void monitor_suspend(void);
-void monitor_resume(void);
-
-/* readline.c */
-typedef void ReadLineFunc(void *opaque, const char *str);
-
-extern int completion_index;
-void add_completion(const char *str);
-void readline_handle_byte(int ch);
-void readline_find_completion(const char *cmdline);
-const char *readline_get_history(unsigned int index);
-void readline_start(const char *prompt, int is_password,
-                    ReadLineFunc *readline_func, void *opaque);
-
-void kqemu_record_dump(void);
-
-#endif /* VL_H */
diff --git a/vnc.c b/vnc.c
index b823d86ce..f1eeedb9a 100644
--- a/vnc.c
+++ b/vnc.c
@@ -23,8 +23,11 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "qemu-common.h"
+#include "console.h"
+#include "sysemu.h"
 #include "qemu_socket.h"
+#include "qemu-timer.h"
 
 #define VNC_REFRESH_INTERVAL (1000 / 30)
 
@@ -57,12 +60,12 @@ typedef struct Buffer
 {
     size_t capacity;
     size_t offset;
-    char *buffer;
+    uint8_t *buffer;
 } Buffer;
 
 typedef struct VncState VncState;
 
-typedef int VncReadEvent(VncState *vs, char *data, size_t len);
+typedef int VncReadEvent(VncState *vs, uint8_t *data, size_t len);
 
 typedef void VncWritePixels(VncState *vs, void *data, int size);
 
@@ -255,6 +258,13 @@ static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
 
     h += y;
 
+    /* round x down to ensure the loop only spans one 16-pixel block per,
+       iteration.  otherwise, if (x % 16) != 0, the last iteration may span
+       two 16-pixel blocks but we only mark the first as dirty
+    */
+    w += (x % 16);
+    x -= (x % 16);
+
     for (; y < h; y++)
 	for (i = 0; i < w; i += 16)
 	    vnc_set_bit(vs->dirty_row[y], (x + i) / 16);
@@ -284,7 +294,10 @@ static void vnc_dpy_resize(DisplayState *ds, int w, int h)
 	exit(1);
     }
 
-    ds->depth = vs->depth * 8;
+    if (ds->depth != vs->depth * 8) {
+        ds->depth = vs->depth * 8;
+        console_color_init(ds);
+    }
     size_changed = ds->width != w || ds->height != h;
     ds->width = w;
     ds->height = h;
@@ -363,7 +376,7 @@ static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
 {
     int i;
-    char *row;
+    uint8_t *row;
 
     vnc_framebuffer_update(vs, x, y, w, h, 0);
 
@@ -427,8 +440,8 @@ static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
 static void vnc_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
 {
     int src, dst;
-    char *src_row;
-    char *dst_row;
+    uint8_t *src_row;
+    uint8_t *dst_row;
     char *old_row;
     int y = 0;
     int pitch = ds->linesize;
@@ -486,7 +499,7 @@ static void vnc_update_client(void *opaque)
 
     if (vs->need_update && vs->csock != -1) {
 	int y;
-	char *row;
+	uint8_t *row;
 	char *old_row;
 	uint32_t width_mask[VNC_DIRTY_WORDS];
 	int n_rectangles;
@@ -503,10 +516,11 @@ static void vnc_update_client(void *opaque)
 	for (y = 0; y < vs->height; y++) {
 	    if (vnc_and_bits(vs->dirty_row[y], width_mask, VNC_DIRTY_WORDS)) {
 		int x;
-		char *ptr, *old_ptr;
+		uint8_t *ptr;
+		char *old_ptr;
 
 		ptr = row;
-		old_ptr = old_row;
+		old_ptr = (char*)old_row;
 
 		for (x = 0; x < vs->ds->width; x += 16) {
 		    if (memcmp(old_ptr, ptr, 16 * vs->depth) == 0) {
@@ -609,7 +623,7 @@ static int buffer_empty(Buffer *buffer)
     return buffer->offset == 0;
 }
 
-static char *buffer_end(Buffer *buffer)
+static uint8_t *buffer_end(Buffer *buffer)
 {
     return buffer->buffer + buffer->offset;
 }
@@ -806,9 +820,9 @@ static uint32_t read_u32(uint8_t *data, size_t offset)
 }
 
 #if CONFIG_VNC_TLS
-ssize_t vnc_tls_push(gnutls_transport_ptr_t transport,
-		     const void *data,
-		     size_t len) {
+static ssize_t vnc_tls_push(gnutls_transport_ptr_t transport,
+                            const void *data,
+                            size_t len) {
     struct VncState *vs = (struct VncState *)transport;
     int ret;
 
@@ -823,9 +837,9 @@ ssize_t vnc_tls_push(gnutls_transport_ptr_t transport,
 }
 
 
-ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,
-		     void *data,
-		     size_t len) {
+static ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,
+                            void *data,
+                            size_t len) {
     struct VncState *vs = (struct VncState *)transport;
     int ret;
 
@@ -840,7 +854,7 @@ ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,
 }
 #endif /* CONFIG_VNC_TLS */
 
-static void client_cut_text(VncState *vs, size_t len, char *text)
+static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
 {
 }
 
@@ -907,6 +921,12 @@ static void reset_keys(VncState *vs)
     }
 }
 
+static void press_key(VncState *vs, int keysym)
+{
+    kbd_put_keycode(keysym2scancode(vs->kbd_layout, keysym) & 0x7f);
+    kbd_put_keycode(keysym2scancode(vs->kbd_layout, keysym) | 0x80);
+}
+
 static void do_key_event(VncState *vs, int down, uint32_t sym)
 {
     int keycode;
@@ -934,6 +954,28 @@ static void do_key_event(VncState *vs, int down, uint32_t sym)
             return;
         }
         break;
+    case 0x45:			/* NumLock */
+        if (!down)
+            vs->modifiers_state[keycode] ^= 1;
+        break;
+    }
+
+    if (keycode_is_keypad(vs->kbd_layout, keycode)) {
+        /* If the numlock state needs to change then simulate an additional
+           keypress before sending this one.  This will happen if the user
+           toggles numlock away from the VNC window.
+        */
+        if (keysym_is_numlock(vs->kbd_layout, sym & 0xFFFF)) {
+            if (!vs->modifiers_state[0x45]) {
+                vs->modifiers_state[0x45] = 1;
+                press_key(vs, 0xff7f);
+            }
+        } else {
+            if (vs->modifiers_state[0x45]) {
+                vs->modifiers_state[0x45] = 0;
+                press_key(vs, 0xff7f);
+            }
+        }
     }
 
     if (is_graphic_console()) {
@@ -991,7 +1033,7 @@ static void do_key_event(VncState *vs, int down, uint32_t sym)
 
 static void key_event(VncState *vs, int down, uint32_t sym)
 {
-    if (sym >= 'A' && sym <= 'Z')
+    if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
 	sym = sym - 'A' + 'a';
     do_key_event(vs, down, sym);
 }
@@ -1140,7 +1182,7 @@ static void set_pixel_format(VncState *vs,
     vga_hw_update();
 }
 
-static int protocol_client_msg(VncState *vs, char *data, size_t len)
+static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
 {
     int i;
     uint16_t limit;
@@ -1213,7 +1255,7 @@ static int protocol_client_msg(VncState *vs, char *data, size_t len)
     return 0;
 }
 
-static int protocol_client_init(VncState *vs, char *data, size_t len)
+static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
 {
     char pad[3] = { 0, 0, 0 };
     char buf[1024];
@@ -1292,11 +1334,11 @@ static void make_challenge(VncState *vs)
         vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
 }
 
-static int protocol_client_auth_vnc(VncState *vs, char *data, size_t len)
+static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
 {
-    char response[VNC_AUTH_CHALLENGE_SIZE];
+    unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
     int i, j, pwlen;
-    char key[8];
+    unsigned char key[8];
 
     if (!vs->password || !vs->password[0]) {
 	VNC_DEBUG("No password configured on server");
@@ -1703,7 +1745,7 @@ static int vnc_start_tls(struct VncState *vs) {
     return vnc_continue_handshake(vs);
 }
 
-static int protocol_client_vencrypt_auth(VncState *vs, char *data, size_t len)
+static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len)
 {
     int auth = read_u32(data, 0);
 
@@ -1733,7 +1775,7 @@ static int protocol_client_vencrypt_auth(VncState *vs, char *data, size_t len)
     return 0;
 }
 
-static int protocol_client_vencrypt_init(VncState *vs, char *data, size_t len)
+static int protocol_client_vencrypt_init(VncState *vs, uint8_t *data, size_t len)
 {
     if (data[0] != 0 ||
 	data[1] != 2) {
@@ -1763,7 +1805,7 @@ static int start_auth_vencrypt(VncState *vs)
 }
 #endif /* CONFIG_VNC_TLS */
 
-static int protocol_client_auth(VncState *vs, char *data, size_t len)
+static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
 {
     /* We only advertise 1 auth scheme at a time, so client
      * must pick the one we sent. Verify this */
@@ -1812,7 +1854,7 @@ static int protocol_client_auth(VncState *vs, char *data, size_t len)
     return 0;
 }
 
-static int protocol_version(VncState *vs, char *version, size_t len)
+static int protocol_version(VncState *vs, uint8_t *version, size_t len)
 {
     char local[13];
 
diff --git a/vnc_keysym.h b/vnc_keysym.h
index 14fe47f9e..5c4710444 100644
--- a/vnc_keysym.h
+++ b/vnc_keysym.h
@@ -231,6 +231,19 @@ static name2keysym_t name2keysym[]={
 {"Home", 0xff50},      /* XK_Home */
 {"End", 0xff57},       /* XK_End */
 {"Scroll_Lock", 0xff14}, /* XK_Scroll_Lock */
+{"KP_Home", 0xff95},
+{"KP_Left", 0xff96},
+{"KP_Up", 0xff97},
+{"KP_Right", 0xff98},
+{"KP_Down", 0xff99},
+{"KP_Prior", 0xff9a},
+{"KP_Page_Up", 0xff9a},
+{"KP_Next", 0xff9b},
+{"KP_Page_Down", 0xff9b},
+{"KP_End", 0xff9c},
+{"KP_Begin", 0xff9d},
+{"KP_Insert", 0xff9e},
+{"KP_Delete", 0xff9f},
 {"F1", 0xffbe},        /* XK_F1 */
 {"F2", 0xffbf},        /* XK_F2 */
 {"F3", 0xffc0},        /* XK_F3 */
@@ -258,6 +271,7 @@ static name2keysym_t name2keysym[]={
 {"KP_8", 0xffb8},      /* XK_KP_8 */
 {"KP_9", 0xffb9},      /* XK_KP_9 */
 {"KP_Add", 0xffab},    /* XK_KP_Add */
+{"KP_Separator", 0xffac},/* XK_KP_Separator */
 {"KP_Decimal", 0xffae},  /* XK_KP_Decimal */
 {"KP_Divide", 0xffaf},   /* XK_KP_Divide */
 {"KP_Enter", 0xff8d},    /* XK_KP_Enter */
diff --git a/vnchextile.h b/vnchextile.h
index 35dcc5727..09c1b2785 100644
--- a/vnchextile.h
+++ b/vnchextile.h
@@ -13,7 +13,7 @@ static void CONCAT(send_hextile_tile_, NAME)(VncState *vs,
                                              uint32_t *last_fg32,
                                              int *has_bg, int *has_fg)
 {
-    char *row = (vs->ds->data + y * vs->ds->linesize + x * vs->depth);
+    uint8_t *row = (vs->ds->data + y * vs->ds->linesize + x * vs->depth);
     pixel_t *irow = (pixel_t *)row;
     int j, i;
     pixel_t *last_bg = (pixel_t *)last_bg32;
diff --git a/x_keymap.c b/x_keymap.c
index 9f72fc3eb..f000475e9 100644
--- a/x_keymap.c
+++ b/x_keymap.c
@@ -21,7 +21,9 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "console.h"
+
 static const uint8_t x_keycode_to_pc_keycode[115] = {
    0xc7,      /*  97  Home   */
    0xc8,      /*  98  Up     */