402 files changed, 67596 insertions, 38162 deletions

diff --git a/CHANGES.TXT b/CHANGES.TXT
index 5c87780..c437e0c 100644
--- a/CHANGES.TXT
+++ b/CHANGES.TXT
@@ -11,41 +11,47 @@ Versions:
    1.5 => SDK 0.9_r1
    1.6 => SDK 1.0_r1
    1.7 => SDK 1.0_r2
-   1.8 => (unreleased, planned, named likely to change)
+   1.8 => SDK 1.1
+   1.9 => (unreleased, planned, named likely to change)
 
 ==============================================================================
-Changes between 1.7 and 1.8
+Changes between 1.8 and 1.9
 
 IMPORTANT CHANGES:
 
-- The emulator now requires that you specify a virtual machine name when
+- Many features have been integrated from upstream QEMU sources, including
+  the new TCG code generator used by the ARM translator. This should result
+  in slightly faster execution speed on all supported platforms.
+
+- The emulator now requires that you specify a virtual device name when
   starting the emulator, prefixed with the '@' sign. For example, to start
-  the 'foo' virtual machine, type:
+  the 'foo' virtual device, type:
 
       emulator @foo
 
-  Each VM corresponds to a directory used to store mutable disk images, an
-  optional system image/kernel/sdcard,  plus some configuration file(s).
+  Each AVD (Android Virtual Device) corresponds to a directory used to store
+  mutable disk images, an optional system image/kernel/sdcard, plus some
+  configuration file(s).
 
   The command-line tool 'android' that comes with the SDK can be used to
-  create/list/remove virtual machines on your system.
+  create/list/remove virtual devices on your system.
 
-  Note that the '@<name>' form is a convenience shortcut for '-vm <name>'.
-  It is thus possible to place options after the VM name on your command
+  Note that the '@<name>' form is a convenience shortcut for '-avd <name>'.
+  It is thus possible to place options after the AVD name on your command
   line, as in:
 
       emulator @foo -verbose -shell
 
-  Finally, when building the Android platform source tree, a VM name is not
+  Finally, when building the Android platform source tree, an AVD name is not
   required and 'emulator' will start a new emulator instance exactly as
   previously.
 
 - Hardware emulation is now limited to the corresponding Android Virtual
-  Machine's configuration. This means it is now possible to not emulate
+  Device's configuration. This means it is now possible to not emulate
   a touch-screen, trackball, dpad, keyboard, modem, etc...
 
   Note that in the case of the Android build system, all hardware properties
-  are enabled by default, so this only affects "normal" virtual machines
+  are enabled by default, so this only affects "normal" virtual devices
   created with the 'android' tool.
 
 - The emulator now supports capturing network packets to a file.
@@ -59,11 +65,21 @@ IMPORTANT CHANGES:
 
 OTHER:
 
-- A new console command 'vm name' can be used to query the name of the
-  virtual machine running in the emulator. Note that it will be '<build>'
+- The file in ~/.android/default.keyset was ignored, unless you used
+  '-keyset default' explicitely. It is now loaded automatically when
+  available.
+
+- Environment variable ANDROID_SDK_ROOT can be used to specifiy the location
+  of the SDK.
+
+- Environment variable ANDROID_SDK_HOME can be used to specify the location
+  of the '.android' data directory.
+
+- A new console command 'avd name' can be used to query the name of the
+  virtual device running in the emulator. Note that it will be '<build>'
   if you run from the Android build system.
 
-  Also, the emulator's window title also displays the VM name now.
+  Also, the emulator's window title also displays the AVD name now.
 
 - The option '-memory <size>' has been added. <memory> must be an integer
   specifying the amount of physical RAM in the emulated device in megabytes.
@@ -74,6 +90,10 @@ OTHER:
 
 - Better handling of Audio on Linux for the EsounD and Alsa backends
 
+- Fullscreen toggle should now work on Windows and OS X. On Linux, the
+  toggle will not switch the display resolution anymore (which resulted
+  in distorted images).
+
 ==============================================================================
 Changes between 1.6 and 1.7
 
@@ -492,8 +512,8 @@ NEW CONSOLE COMMANDS:
 - the new 'event text <textMessage>' command can be used to simulate
   keypresses of small text messages, where <textMessage> is an utf-8 string.
 
-- the new 'vm stop' and 'vm start' command can be used to stop/start the
-  emulation. you can also use 'vm status' to query the current state.
+- the new 'avd stop' and 'avd start' command can be used to stop/start the
+  emulation. you can also use 'avd status' to query the current state.
 
 - the new 'window scale <scale>' command allows you to change the scale of
   the emulator window dynamically. <scale> is either an integer followed by
@@ -607,9 +627,9 @@ OTHER:
   they are used internally by the voice/sms auto-forwarder and are probably
   not very useful to typical developers
 
-- some code has been added to support save/restore of the VM state to/from
+- some code has been added to support save/restore of the AVD state to/from
   a file. however this is not properly tested yet, and requires that you
-  use exactly the same options and disk images when reloading the VM state.
+  use exactly the same options and disk images when reloading the AVD state.
 
 - added a new -cache <file> option to specify the cache partition image
   file. the default is to use a temporary file instead
diff --git a/Makefile.android b/Makefile.android
index d51a6d2..fe89e4a 100644
--- a/Makefile.android
+++ b/Makefile.android
@@ -9,11 +9,15 @@ CONFIG_DIRS     := \
 
 CONFIG_INCLUDES := $(CONFIG_DIRS:%=-I%)
 
-MY_CFLAGS  := $(CONFIG_INCLUDES)
+MY_CFLAGS := $(CONFIG_INCLUDES) -O2 -g \
+             -fno-PIC \
+             -falign-functions=0 \
+             -fomit-frame-pointer \
+
 MY_LDFLAGS :=
 
 # this is needed to build the emulator on 64-bit Linux systems
-ifeq ($(HOST_OS),linux)
+ifeq ($(HOST_OS)-$(HOST_ARCH),linux-x86)
   MY_CFLAGS += -Wa,--32
 endif
 
@@ -27,6 +31,13 @@ ifeq ($(HOST_OS),windows)
   MY_CFLAGS += -DWINVER=0x501
 endif
 
+ifeq ($(HOST_ARCH),ppc)
+    MY_CFLAGS += -D__powerpc__
+endif
+
+ifeq ($(HOST_OS),darwin)
+    MY_CFLAGS += -mdynamic-no-pic
+endif
 MY_CC := $(HOST_CC)
 
 # BUILD_STANDALONE_EMULATOR is only defined when building with
@@ -34,14 +45,6 @@ MY_CC := $(HOST_CC)
 # adequate values for HOST_CC
 #
 ifneq ($(BUILD_STANDALONE_EMULATOR),true)
-  # We're going to use a specific version of gcc (3.4.6) if it is available
-  # from the prebuilt directory.  This prevents many nasty emulator problems
-  # due to the way QEMU works
-  #
-  ifneq ($(strip $(wildcard $(GCCQEMU))),)
-    # GCCQEMU is set by the host file under build/core/combo/
-    MY_CC := $(GCCQEMU)
-  endif
 
   ifneq ($(USE_CCACHE),)
     MY_CC := prebuilt/$(HOST_PREBUILT_TAG)/ccache/ccache $(MY_CC)
@@ -50,93 +53,104 @@ endif
 
 
 ifneq ($(combo_target)$(TARGET_SIMULATOR),HOST_true)
-  MY_CFLAGS  += -m32
-  MY_LDFLAGS += -m32
+  ifneq ($(HOST_ARCH),x86_64)
+    MY_CFLAGS  += -m32
+    MY_LDFLAGS += -m32
+  endif
 endif
 
 include $(CLEAR_VARS)
 
+###########################################################
+# Zlib configuration
+#
+ZLIB_DIR := distrib/zlib-1.2.3
+include $(LOCAL_PATH)/$(ZLIB_DIR)/sources.make
+
+###########################################################
+# Libpng configuration
+#
+LIBPNG_DIR := distrib/libpng-1.2.19
+include $(LOCAL_PATH)/$(LIBPNG_DIR)/sources.make
+
 ###############################################################################
-# compile the 'dyngen' executable, it is used to generate the various
-# runtime code generators used by the emulator. it does that by parsing a
-# special .o file containing routines for each one of the pseudo-opcodes
-# handled by the CPU-specific translator
+# build the TCG code generator
 #
+include $(CLEAR_VARS)
+
 LOCAL_NO_DEFAULT_COMPILER_FLAGS := true
 LOCAL_CC                        := $(MY_CC)
 LOCAL_CFLAGS                    := $(MY_CFLAGS) $(LOCAL_CFLAGS)
 LOCAL_LDFLAGS                   := $(MY_LDFLAGS)
-LOCAL_SRC_FILES                 := dyngen.c
+LOCAL_MODULE                    := emulator-tcg
 
-ifeq ($(HOST_OS),windows)
-  LOCAL_LDLIBS += -mno-cygwin -mconsole
+TCG_TARGET := $(HOST_ARCH)
+ifeq ($(TCG_TARGET),x86)
+  TCG_TARGET := i386
 endif
 
-LOCAL_MODULE := emulator-dyngen
-include $(BUILD_HOST_EXECUTABLE)
-
-DYNGEN := $(LOCAL_BUILT_MODULE)
+TCG_CFLAGS := -I$(LOCAL_PATH)/tcg -I$(LOCAL_PATH)/tcg/$(TCG_TARGET)
 
-###############################################################################
-# build the normal dynamic translation code as a library, because it needs
-# specific compilation flags. not that we are poking some object
-# files directly through dyngen !
-#
+LOCAL_CFLAGS += $(TCG_CFLAGS) \
+                -I$(LOCAL_PATH)/target-arm \
+                -I$(LOCAL_PATH)/fpu \
 
-# determine the C flags used to compile op.c into op.h and others
-#
-OP_CFLAGS := -I$(LOCAL_PATH)/target-arm \
-             -I$(LOCAL_PATH)/fpu \
-             $(MY_CFLAGS)
-
-OP_CFLAGS += -O2 -g -fomit-frame-pointer -fno-strict-aliasing -falign-functions=0 \
-             -fno-gcse -fno-reorder-blocks -fno-optimize-sibling-calls \
-             -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE \
-             -fno-PIC
-
-ifeq ($(HOST_ARCH),ppc)
-    OP_CFLAGS += -D__powerpc__ -mdynamic-no-pic
-endif
+LOCAL_SRC_FILES := \
+    tcg/tcg.c \
+    tcg/tcg-dyngen.c \
+    tcg/tcg-runtime.c \
 
-ifeq ($(HOST_ARCH),x86)
-ifeq ($(HOST_OS),darwin)
-    OP_CFLAGS += -mpreferred-stack-boundary=4 -mdynamic-no-pic
-else
-    OP_CFLAGS += -mpreferred-stack-boundary=2
-endif
-endif
+include $(BUILD_HOST_STATIC_LIBRARY)
 
-# build the nomal dynamic translation code as the 'emulator-op' library
+##############################################################################
+# build the HW emulation support
 #
 include $(CLEAR_VARS)
 
-LOCAL_MODULE := emulator-op
-OP_SUFFIX    :=
-
-include $(LOCAL_PATH)/translate.make
-
-include $(BUILD_HOST_STATIC_LIBRARY)
-
+LOCAL_NO_DEFAULT_COMPILER_FLAGS := true
+LOCAL_CC                        := $(MY_CC)
+LOCAL_MODULE                    := emulator-hw
 
-# build the tracing dynamic translation code as the 'emulator-op-trace' library
-#
-include $(CLEAR_VARS)
+HW_CFLAGS    := -I$(LOCAL_PATH)/hw
 
-LOCAL_MODULE := emulator-op-trace
-LOCAL_CFLAGS := -DGEN_TRACE=1
-OP_SUFFIX    := -trace
+LOCAL_CFLAGS := $(MY_CFLAGS) $(LOCAL_CFLAGS)
+LOCAL_CFLAGS += -I$(LOCAL_PATH)/target-arm -I$(LOCAL_PATH)/fpu $(HW_CFLAGS)
+LOCAL_CFLAGS += $(ZLIB_CFLAGS) -I$(LOCAL_PATH)/$(ZLIB_DIR)
+
+HW_SOURCES := \
+    android_arm.c \
+    arm_pic.c \
+    cdrom.c \
+    dma.c \
+    irq.c \
+    goldfish_audio.c \
+    goldfish_battery.c \
+    goldfish_device.c \
+    goldfish_events_device.c \
+    goldfish_fb.c \
+    goldfish_interrupt.c \
+    goldfish_memlog.c \
+    goldfish_mmc.c \
+    goldfish_nand.c  \
+    goldfish_switch.c \
+    goldfish_timer.c \
+    goldfish_trace.c \
+    goldfish_tty.c \
+    pci.c \
+    scsi-disk.c \
+    smc91c111.c \
+    usb-hid.c \
+    usb-hub.c \
+    usb-msd.c \
+    usb-ohci.c \
+    usb.c \
 
-include $(LOCAL_PATH)/translate.make
+LOCAL_SRC_FILES += $(HW_SOURCES:%=hw/%)
 
 include $(BUILD_HOST_STATIC_LIBRARY)
 
-# define to true to build the ARM-specific code generator as an independent
-# static library. this allows you to apply different optimization strategy
-BUILD_ARM_LIBRARY := true
-
-ifeq ($(BUILD_ARM_LIBRARY),true)
 ##############################################################################
-# build the ARM-specific target sources
+# build the ARM-specific emulation engine sources
 #
 include $(CLEAR_VARS)
 
@@ -144,53 +158,40 @@ LOCAL_NO_DEFAULT_COMPILER_FLAGS := true
 LOCAL_CC                        := $(MY_CC)
 LOCAL_MODULE                    := emulator-arm
 LOCAL_LDFLAGS                   := $(MY_LDFLAGS)
+LOCAL_CFLAGS                    := $(MY_CFLAGS) $(LOCAL_CFLAGS)
+LOCAL_STATIC_LIBRARIES          := emulator-hw
 
 LOCAL_CFLAGS := -fno-PIC -fomit-frame-pointer -Wno-sign-compare
 LOCAL_CFLAGS := $(MY_CFLAGS) $(LOCAL_CFLAGS)
 
-ifeq ($(HOST_OS),darwin)
-LOCAL_CFLAGS += -O2
-endif
-ifeq ($(HOST_OS),windows)
-LOCAL_CFLAGS += -O2
-endif
-
-# generate the normal translator source files from emulator-op library
-#
-LOCAL_CFLAGS    += -I$(LOCAL_PATH)/target-arm \
-                   -I$(LOCAL_PATH)/fpu \
-                   -I$(INTERMEDIATE)
+LOCAL_CFLAGS += -I$(LOCAL_PATH) \
+                -I$(LOCAL_PATH)/target-arm \
+                -I$(LOCAL_PATH)/fpu \
+                $(TCG_CFLAGS) \
+                $(HW_CFLAGS) \
 
 ifeq ($(HOST_ARCH),ppc)
     LOCAL_CFLAGS += -D__powerpc__
 endif
 
-ifeq ($(HOST_OS),darwin)
-    LOCAL_CFLAGS += -mdynamic-no-pic
-endif
-
-# include CPU translation sources
-#
 LOCAL_SRC_FILES += exec.c cpu-exec.c  \
                    target-arm/op_helper.c \
-                   target-arm/helper.c
-
-# include ARM-specific soft-float implementation
-#
-NWFPE_SOURCES := fpa11.c fpa11_cpdo.c fpa11_cpdt.c fpa11_cprt.c fpopcode.c single_cpdo.c \
-                 double_cpdo.c extended_cpdo.c
-
-FPU_SOURCES := softfloat.c
-
-LOCAL_SRC_FILES += $(XXNWFPE_SOURCES:%=target-arm/nwfpe/%) \
-                   $(FPU_SOURCES:%=fpu/%)
-
-LOCAL_CFLAGS    += -I$(LOCAL_PATH)/target-arm/nwfpe \
-                   -I$(LOCAL_PATH)/linux-user \
-                   -I$(LOCAL_PATH)/linux-user/arm
+                   target-arm/iwmmxt_helper.c \
+                   target-arm/neon_helper.c \
+                   target-arm/helper.c \
+                   target-arm/translate.c \
+                   target-arm/machine.c \
+                   translate-all.c \
+                   hw/armv7m.c \
+                   hw/armv7m_nvic.c \
+                   arm-semi.c \
+                   trace.c \
+                   varint.c \
+                   dcache.c \
+
+LOCAL_SRC_FILES += fpu/softfloat.c
 
 include $(BUILD_HOST_STATIC_LIBRARY)
-endif # BUILD_ARM_LIBRARY
 
 ##############################################################################
 # SDL-related definitions
@@ -230,6 +231,10 @@ ifeq ($(HOST_OS),linux)
   CONFIG_ESD  ?= yes
 endif
 
+ifeq ($(HOST_OS),freebsd)
+  CONFIG_OSS ?= yes
+endif
+
 ifeq ($(CONFIG_COREAUDIO),yes)
   AUDIO_SOURCES += coreaudio.c
   AUDIO_CFLAGS  += -DCONFIG_COREAUDIO
@@ -261,7 +266,10 @@ AUDIO_SOURCES := $(AUDIO_SOURCES:%=audio/%)
 # determine whether we're going to use the prebuilt
 # audio library (this is useful on Linux to avoid requiring
 # all sound-related development packages to be installed on
-# the build and developer machines.
+# the build and developer machines).
+#
+# note that you can define BUILD_QEMU_AUDIO_LIB to true
+# in your environment to force recompilation.
 #
 QEMU_AUDIO_LIB :=
 
@@ -277,9 +285,8 @@ ifeq ($(BUILD_QEMU_AUDIO_LIB),true)
   LOCAL_MODULE                    := libqemu-audio
   LOCAL_LDFLAGS                   := $(MY_LDFLAGS)
 
-  LOCAL_CFLAGS := -fno-PIC -fomit-frame-pointer -Wno-sign-compare \
-                  -fno-strict-aliasing -g -W -Wall -Wno-unused-parameter \
-                  -O2 \
+  LOCAL_CFLAGS := -Wno-sign-compare \
+                  -fno-strict-aliasing -W -Wall -Wno-unused-parameter \
                   -I$(LOCAL_PATH) \
                   -I$(LOCAL_PATH)/target-arm \
                   -I$(LOCAL_PATH)/fpu \
@@ -303,7 +310,7 @@ include $(CLEAR_VARS)
 LOCAL_NO_DEFAULT_COMPILER_FLAGS := true
 LOCAL_CC                        := $(MY_CC)
 LOCAL_MODULE                    := emulator
-LOCAL_STATIC_LIBRARIES          := $(EMULATOR_OP_LIBRARIES) emulator-arm
+LOCAL_STATIC_LIBRARIES          := emulator-hw emulator-arm emulator-tcg
 LOCAL_LDFLAGS                   := $(MY_LDFLAGS)
 
 # don't remove the -fno-strict-aliasing, or you'll break things
@@ -314,65 +321,24 @@ LOCAL_CFLAGS := -fno-PIC -fomit-frame-pointer -Wno-sign-compare \
 
 LOCAL_CFLAGS := $(MY_CFLAGS) $(LOCAL_CFLAGS)
 
-ifeq ($(HOST_OS),darwin)
-LOCAL_CFLAGS += -O2
-endif
-ifeq ($(HOST_OS),windows)
-LOCAL_CFLAGS += -O2
-endif
 # add the build ID to the default macro definitions
 LOCAL_CFLAGS += -DANDROID_BUILD_ID="$(strip $(BUILD_ID))-$(strip $(BUILD_NUMBER))"
 
-ifeq ($(HOST_ARCH),ppc)
-    LOCAL_CFLAGS += -D__powerpc__
-endif
-
-ifeq ($(HOST_OS),darwin)
-    LOCAL_CFLAGS += -mdynamic-no-pic
-endif
-
 # include the Zlib sources
 #
-ZLIB_DIR := distrib/zlib-1.2.3
-include $(LOCAL_PATH)/$(ZLIB_DIR)/sources.make
 LOCAL_SRC_FILES += $(ZLIB_SOURCES)
 LOCAL_CFLAGS    += $(ZLIB_CFLAGS) -I$(LOCAL_PATH)/$(ZLIB_DIR)
 
 # include the Libpng sources
 #
-LIBPNG_DIR := distrib/libpng-1.2.19
-include $(LOCAL_PATH)/$(LIBPNG_DIR)/sources.make
 LOCAL_SRC_FILES += $(LIBPNG_SOURCES)
 LOCAL_CFLAGS    += $(LIBPNG_CFLAGS) -I$(LOCAL_PATH)/$(LIBPNG_DIR)
 
-LOCAL_CFLAGS    += -I$(LOCAL_PATH)/target-arm \
+LOCAL_CFLAGS    += -I$(LOCAL_PATH)/ \
+                   -I$(LOCAL_PATH)/target-arm \
                    -I$(LOCAL_PATH)/fpu \
-                   -I$(INTERMEDIATE)
-
-ifneq ($(BUILD_ARM_LIBRARY),true)
-# generate the normal translator source files from emulator-op library
-#
-
-# include CPU translation sources
-#
-LOCAL_SRC_FILES += exec.c cpu-exec.c  \
-                   target-arm/op_helper.c \
-		   target-arm/helper.c
-
-# include ARM-specific soft-float implementation
-#
-NWFPE_SOURCES := fpa11.c fpa11_cpdo.c fpa11_cpdt.c fpa11_cprt.c fpopcode.c single_cpdo.c \
-                 double_cpdo.c extended_cpdo.c
-
-FPU_SOURCES := softfloat.c
-
-LOCAL_SRC_FILES += $(XXNWFPE_SOURCES:%=target-arm/nwfpe/%) \
-                   $(FPU_SOURCES:%=fpu/%)
-
-LOCAL_CFLAGS    += -I$(LOCAL_PATH)/target-arm/nwfpe \
-                   -I$(LOCAL_PATH)/linux-user \
-                   -I$(LOCAL_PATH)/linux-user/arm
-endif # !BUILD_ARM_LIBRARY
+                   $(TCG_CFLAGS) \
+                   $(HW_CFLAGS) \
 
 # include telephony stuff
 #
@@ -396,22 +362,6 @@ endif  # !QEMU_AUDIO_LIB
 LOCAL_CFLAGS  += $(AUDIO_CFLAGS)
 LOCAL_LDLIBS  += $(AUDIO_LDLIBS)
 
-# include emulated hardware source files
-#
-HW_SOURCES := android_arm.c  arm_boot.c  arm_pic.c  cdrom.c \
-              goldfish_events_device.c  pci.c irq.c \
-	      goldfish_nand.c  \
-	      goldfish_audio.c goldfish_device.c goldfish_fb.c \
-	      goldfish_interrupt.c goldfish_mmc.c goldfish_switch.c \
-	      goldfish_memlog.c  goldfish_battery.c \
-	      goldfish_timer.c  goldfish_tty.c scsi-disk.c \
-	      smc91c111.c goldfish_trace.c usb-hid.c usb-hub.c usb-msd.c usb-ohci.c \
-	      usb.c \
-	      dma.c
-
-LOCAL_SRC_FILES += $(HW_SOURCES:%=hw/%)
-LOCAL_CFLAGS    += -I$(LOCAL_PATH)/hw
-
 # include slirp2 code, i.e. the user-level networking stuff
 #
 SLIRP_SOURCES := bootp.c     cksum.c      debug.c  if.c     ip_icmp.c  ip_input.c   ip_output.c  \
@@ -439,20 +389,20 @@ LOCAL_CFLAGS    += -I$(LOCAL_PATH)/proxy
 
 # the skin support sources
 #
-SKIN_SOURCES := skin_rect.c \
-                skin_region.c \
-                skin_image.c \
-                skin_trackball.c \
-                skin_keyboard.c \
-                skin_keyset.c \
-                skin_file.c \
-                skin_window.c \
-                skin_scaler.c \
-                skin_composer.c \
-                skin_surface.c \
-
-LOCAL_SRC_FILES += $(SKIN_SOURCES:%=skins/%)
-LOCAL_CFLAGS    += -I$(LOCAL_PATH)/skins
+SKIN_SOURCES := rect.c \
+                region.c \
+                image.c \
+                trackball.c \
+                keyboard.c \
+                keyset.c \
+                file.c \
+                window.c \
+                scaler.c \
+                composer.c \
+                surface.c \
+
+LOCAL_SRC_FILES += $(SKIN_SOURCES:%=android/skin/%)
+#LOCAL_CFLAGS    += -I$(LOCAL_PATH)/skin
 
 ifeq ($(HOST_ARCH),x86)
 # enable MMX code for our skin scaler
@@ -461,35 +411,63 @@ endif
 
 # include other sources
 #
-VL_SOURCES := vl.c osdep.c \
-              block.c readline.c monitor.c console.c  loader.c sockets.c \
-              block-qcow.c aes.c block-cloop.c block-dmg.c \
+VL_SOURCES := vl.c osdep.c cutils.c \
+              block.c readline.c monitor.c console.c loader.c sockets.c \
+              block-qcow.c aes.c d3des.c block-cloop.c block-dmg.c block-vvfat.c \
+              block-qcow2.c block-cow.c \
               cbuffer.c \
               gdbstub.c usb-linux.c \
-              trace.c dcache.c varint.c vnc.c disas.c arm-dis.c \
-              qemu_timers.c \
+              vnc.c disas.c arm-dis.c \
               shaper.c charpipe.c loadpng.c \
               framebuffer.c \
               tcpdump.c \
-              android_debug.c \
-              android_help.c \
-              android_option.c \
-              android_main.c \
-              android_charmap.c \
-              android_resource.c \
-              android_utils.c \
-              android_console.c \
-              android_events.c \
-              android_timezone.c \
-              android_config.c \
-              android_gps.c \
-              android_qemud.c \
-              android_kmsg.c \
-              android_hw_control.c \
-              android/utils/ini.c \
+              android/charmap.c \
+              android/cmdline-option.c \
+              android/config.c \
+              android/console.c \
+              android/gps.c \
+              android/help.c \
+              android/hw-control.c \
+              android/hw-events.c \
+              android/hw-kmsg.c \
+              android/main.c \
+              android/qemud.c \
+              android/resource.c \
+              android/utils/bufprint.c \
+              android/utils/debug.c \
               android/utils/dirscanner.c \
-              android/vm/hw-config.c \
-              android/vm/info.c \
+              android/utils/display.c \
+              android/utils/ini.c \
+              android/utils/filelock.c \
+              android/utils/misc.c \
+              android/utils/path.c \
+              android/utils/reflist.c \
+              android/utils/stralloc.c \
+              android/utils/system.c \
+              android/utils/tempfile.c \
+              android/utils/timezone.c \
+              android/avd/hw-config.c \
+              android/avd/info.c \
+
+# we need to add a Quartz-specific file
+ifeq ($(HOST_OS),darwin)
+  # Alas, the Android build system doesn't know how to deal
+  # with Objective C sources yet.
+  ifeq ($(BUILD_STANDALONE_EMULATOR),true)
+    VL_SOURCES += android/utils/display-quartz.m
+  else
+    LOCAL_CFLAGS += -DCONFIG_NO_COCOA
+  endif
+endif
+
+VL_SOURCES += hw/arm_boot.c \
+              hw/android_arm.c \
+
+ifeq ($(HOST_OS),windows)
+  VL_SOURCES += block-raw-win32.c
+else
+  VL_SOURCES += block-raw-posix.c
+endif
 
 ifeq ($(HOST_OS),linux)
     LOCAL_LDLIBS += -lX11
@@ -498,12 +476,15 @@ endif
 ifeq ($(HOST_ARCH),x86)
     VL_SOURCES += i386-dis.c
 endif
+ifeq ($(HOST_ARCH),x86_64)
+    VL_SOURCES += i386-dis.c
+endif
 ifeq ($(HOST_ARCH),ppc)
     VL_SOURCES += ppc-dis.c
 endif
 
 ifeq ($(HOST_OS),windows)
-  VL_SOURCES   += tap-win32.c
+  #VL_SOURCES   += tap-win32.c
   LOCAL_LDLIBS += -mno-cygwin -mwindows -mconsole
 endif
 
@@ -518,6 +499,7 @@ endif
 LOCAL_CFLAGS += $(SDL_CFLAGS)
 LOCAL_LDLIBS += $(SDL_LDLIBS)
 LOCAL_STATIC_LIBRARIES += libSDL libSDLmain
+LOCAL_STATIC_LIBRARIES += libSDL libSDLmain
 
 # on Windows, link the icon file as well into the executable
 # unfortunately, our build system doesn't help us much, so we need
@@ -532,8 +514,8 @@ $(ANDROID_ICON_PATH)/$(ANDROID_ICON_OBJ): $(ANDROID_ICON_PATH)/android_icon.rc
 
 # seems to be the only way to add an object file that was not generated from
 # a C/C++/Java source file to our build system. and very unfortunately,
-# $(TOPDIR)/$(LOCALPATH) will always be prepend to this value, which forces
-# use to put the object file in the source directory...
+# $(TOPDIR)/$(LOCALPATH) will always be prepended to this value, which forces
+# us to put the object file in the source directory...
 #
 LOCAL_PREBUILT_OBJ_FILES += images/$(ANDROID_ICON_OBJ)
 endif
diff --git a/a.out.h b/a.out.h
index 1f978c1..2d35ebf 100644
--- a/a.out.h
+++ b/a.out.h
@@ -25,9 +25,9 @@ extern "C" {
 struct external_filehdr {
   short f_magic;	/* magic number			*/
   short f_nscns;	/* number of sections		*/
-  unsigned long f_timdat;	/* time & date stamp		*/
-  unsigned long f_symptr;	/* file pointer to symtab	*/
-  unsigned long f_nsyms;	/* number of symtab entries	*/
+  host_ulong f_timdat;	/* time & date stamp		*/
+  host_ulong f_symptr;	/* file pointer to symtab	*/
+  host_ulong f_nsyms;	/* number of symtab entries	*/
   short f_opthdr;	/* sizeof(optional hdr)		*/
   short f_flags;	/* flags			*/
 };
@@ -72,12 +72,12 @@ typedef struct
 {
   unsigned short magic;		/* type of file				*/
   unsigned short vstamp;	/* version stamp			*/
-  unsigned long	tsize;		/* text size in bytes, padded to FW bdry*/
-  unsigned long	dsize;		/* initialized data "  "		*/
-  unsigned long	bsize;		/* uninitialized data "   "		*/
-  unsigned long	entry;		/* entry pt.				*/
-  unsigned long text_start;	/* base of text used for this file */
-  unsigned long data_start;	/* base of data used for this file=
+  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
+  host_ulong	dsize;		/* initialized data "  "		*/
+  host_ulong	bsize;		/* uninitialized data "   "		*/
+  host_ulong	entry;		/* entry pt.				*/
+  host_ulong text_start;	/* base of text used for this file */
+  host_ulong data_start;	/* base of data used for this file=
  */
 }
 AOUTHDR;
@@ -103,16 +103,16 @@ AOUTHDR;
 
 struct external_scnhdr {
   char		s_name[8];	/* section name			*/
-  unsigned long	s_paddr;	/* physical address, offset
+  host_ulong	s_paddr;	/* physical address, offset
 				   of last addr in scn */
-  unsigned long	s_vaddr;	/* virtual address		*/
-  unsigned long	s_size;		/* section size			*/
-  unsigned long	s_scnptr;	/* file ptr to raw data for section */
-  unsigned long	s_relptr;	/* file ptr to relocation	*/
-  unsigned long	s_lnnoptr;	/* file ptr to line numbers	*/
+  host_ulong	s_vaddr;	/* virtual address		*/
+  host_ulong	s_size;		/* section size			*/
+  host_ulong	s_scnptr;	/* file ptr to raw data for section */
+  host_ulong	s_relptr;	/* file ptr to relocation	*/
+  host_ulong	s_lnnoptr;	/* file ptr to line numbers	*/
   unsigned short s_nreloc;	/* number of relocation entries	*/
   unsigned short s_nlnno;	/* number of line number entries*/
-  unsigned long	s_flags;	/* flags			*/
+  host_ulong	s_flags;	/* flags			*/
 };
 
 #define	SCNHDR	struct external_scnhdr
@@ -136,8 +136,8 @@ struct external_scnhdr {
  */
 struct external_lineno {
   union {
-    unsigned long l_symndx; /* function name symbol index, iff l_lnno 0 */
-    unsigned long l_paddr;	/* (physical) address of line number	*/
+    host_ulong l_symndx; /* function name symbol index, iff l_lnno 0 */
+    host_ulong l_paddr;	/* (physical) address of line number	*/
   } l_addr;
   unsigned short l_lnno;	/* line number		*/
 };
@@ -156,11 +156,11 @@ struct __attribute__((packed)) external_syment
   union {
     char e_name[E_SYMNMLEN];
     struct {
-      unsigned long e_zeroes;
-      unsigned long e_offset;
+      host_ulong e_zeroes;
+      host_ulong e_offset;
     } e;
   } e;
-  unsigned long e_value;
+  host_ulong e_value;
   unsigned short e_scnum;
   unsigned short e_type;
   char e_sclass[1];
@@ -174,18 +174,18 @@ struct __attribute__((packed)) external_syment
 
 union external_auxent {
   struct {
-    unsigned long x_tagndx;	/* str, un, or enum tag indx */
+    host_ulong x_tagndx;	/* str, un, or enum tag indx */
     union {
       struct {
 	unsigned short  x_lnno; /* declaration line number */
 	unsigned short  x_size; /* str/union/array size */
       } x_lnsz;
-      unsigned long x_fsize;	/* size of function */
+      host_ulong x_fsize;	/* size of function */
     } x_misc;
     union {
       struct {			/* if ISFCN, tag, or .bb */
-	unsigned long x_lnnoptr;/* ptr to fcn line # */
-	unsigned long x_endndx;	/* entry ndx past block end */
+	host_ulong x_lnnoptr;/* ptr to fcn line # */
+	host_ulong x_endndx;	/* entry ndx past block end */
       } x_fcn;
       struct {			/* if ISARY, up to 4 dimen. */
 	char x_dimen[E_DIMNUM][2];
@@ -197,22 +197,22 @@ union external_auxent {
   union {
     char x_fname[E_FILNMLEN];
     struct {
-      unsigned long x_zeroes;
-      unsigned long x_offset;
+      host_ulong x_zeroes;
+      host_ulong x_offset;
     } x_n;
   } x_file;
 
   struct {
-    unsigned long x_scnlen;	/* section length */
+    host_ulong x_scnlen;	/* section length */
     unsigned short x_nreloc;	/* # relocation entries */
     unsigned short x_nlinno;	/* # line numbers */
-    unsigned long x_checksum;	/* section COMDAT checksum */
+    host_ulong x_checksum;	/* section COMDAT checksum */
     unsigned short x_associated;/* COMDAT associated section index */
     char x_comdat[1];		/* COMDAT selection number */
   } x_scn;
 
   struct {
-    unsigned long x_tvfill;	/* tv fill value */
+    host_ulong x_tvfill;	/* tv fill value */
     unsigned short x_tvlen;	/* length of .tv */
     char x_tvran[2][2];		/* tv range */
   } x_tv;	/* info about .tv section (in auxent of symbol .tv)) */
@@ -344,7 +344,7 @@ struct external_PE_filehdr
   unsigned short e_oemid;	/* OEM identifier (for e_oeminfo), 0x0 */
   unsigned short e_oeminfo;	/* OEM information; e_oemid specific, 0x0 */
   char e_res2[10][2];		/* Reserved words, all 0x0 */
-  unsigned long e_lfanew;	/* File address of new exe header, 0x80 */
+  host_ulong e_lfanew;	/* File address of new exe header, 0x80 */
   char dos_message[16][4];	/* other stuff, always follow DOS header */
   unsigned int nt_signature;	/* required NT signature, 0x4550 */
 
@@ -352,9 +352,9 @@ struct external_PE_filehdr
 
   unsigned short f_magic;	/* magic number			*/
   unsigned short f_nscns;	/* number of sections		*/
-  unsigned long f_timdat;	/* time & date stamp		*/
-  unsigned long f_symptr;	/* file pointer to symtab	*/
-  unsigned long f_nsyms;	/* number of symtab entries	*/
+  host_ulong f_timdat;	/* time & date stamp		*/
+  host_ulong f_symptr;	/* file pointer to symtab	*/
+  host_ulong f_nsyms;	/* number of symtab entries	*/
   unsigned short f_opthdr;	/* sizeof(optional hdr)		*/
   unsigned short f_flags;	/* flags			*/
 };
@@ -370,17 +370,17 @@ typedef struct
 {
   unsigned short magic;		/* type of file				*/
   unsigned short vstamp;	/* version stamp			*/
-  unsigned long	tsize;		/* text size in bytes, padded to FW bdry*/
-  unsigned long	dsize;		/* initialized data "  "		*/
-  unsigned long	bsize;		/* uninitialized data "   "		*/
-  unsigned long	entry;		/* entry pt.				*/
-  unsigned long text_start;	/* base of text used for this file */
-  unsigned long data_start;	/* base of all data used for this file */
+  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
+  host_ulong	dsize;		/* initialized data "  "		*/
+  host_ulong	bsize;		/* uninitialized data "   "		*/
+  host_ulong	entry;		/* entry pt.				*/
+  host_ulong text_start;	/* base of text used for this file */
+  host_ulong data_start;	/* base of all data used for this file */
 
   /* NT extra fields; see internal.h for descriptions */
-  unsigned long  ImageBase;
-  unsigned long  SectionAlignment;
-  unsigned long  FileAlignment;
+  host_ulong  ImageBase;
+  host_ulong  SectionAlignment;
+  host_ulong  FileAlignment;
   unsigned short  MajorOperatingSystemVersion;
   unsigned short  MinorOperatingSystemVersion;
   unsigned short  MajorImageVersion;
@@ -388,17 +388,17 @@ typedef struct
   unsigned short  MajorSubsystemVersion;
   unsigned short  MinorSubsystemVersion;
   char  Reserved1[4];
-  unsigned long  SizeOfImage;
-  unsigned long  SizeOfHeaders;
-  unsigned long  CheckSum;
+  host_ulong  SizeOfImage;
+  host_ulong  SizeOfHeaders;
+  host_ulong  CheckSum;
   unsigned short Subsystem;
   unsigned short DllCharacteristics;
-  unsigned long  SizeOfStackReserve;
-  unsigned long  SizeOfStackCommit;
-  unsigned long  SizeOfHeapReserve;
-  unsigned long  SizeOfHeapCommit;
-  unsigned long  LoaderFlags;
-  unsigned long  NumberOfRvaAndSizes;
+  host_ulong  SizeOfStackReserve;
+  host_ulong  SizeOfStackCommit;
+  host_ulong  SizeOfHeapReserve;
+  host_ulong  SizeOfHeapCommit;
+  host_ulong  LoaderFlags;
+  host_ulong  NumberOfRvaAndSizes;
   /* IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; */
   char  DataDirectory[16][2][4]; /* 16 entries, 2 elements/entry, 4 chars */
 
diff --git a/aes.c b/aes.c
index cd4484f..3700894 100644
--- a/aes.c
+++ b/aes.c
@@ -1,5 +1,5 @@
 /**
- * 
+ *
  * aes.c - integrated in QEMU by Fabrice Bellard from the OpenSSL project.
  */
 /*
@@ -27,10 +27,13 @@
  * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
  * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "aes.h"
 
+#ifndef NDEBUG
 #define NDEBUG
+#endif
+
 #include <assert.h>
 
 typedef uint32_t u32;
@@ -1267,7 +1270,7 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
 
 void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
 		     const unsigned long length, const AES_KEY *key,
-		     unsigned char *ivec, const int enc) 
+		     unsigned char *ivec, const int enc)
 {
 
 	unsigned long n;
@@ -1294,7 +1297,7 @@ void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
 			AES_encrypt(tmp, tmp, key);
 			memcpy(out, tmp, AES_BLOCK_SIZE);
 			memcpy(ivec, tmp, AES_BLOCK_SIZE);
-		}			
+		}
 	} else {
 		while (len >= AES_BLOCK_SIZE) {
 			memcpy(tmp, in, AES_BLOCK_SIZE);
@@ -1312,6 +1315,6 @@ void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
 			for(n=0; n < len; ++n)
 				out[n] = tmp[n] ^ ivec[n];
 			memcpy(ivec, tmp, AES_BLOCK_SIZE);
-		}			
+		}
 	}
 }
diff --git a/aes.h b/aes.h
index 6fb9023..a0167eb 100644
--- a/aes.h
+++ b/aes.h
@@ -4,34 +4,23 @@
 #define AES_MAXNR 14
 #define AES_BLOCK_SIZE 16
 
-typedef struct aes_key_st
-{
-    uint32_t  rd_key[4 *(AES_MAXNR + 1)];
-    int       rounds;
-
-} AES_KEY;
-
-int AES_set_encrypt_key(const unsigned char*  userKey,
-                        const int             bits,
-                        AES_KEY*              key);
-
-int AES_set_decrypt_key(const unsigned char*  userKey,
-                        const int             bits,
-                        AES_KEY*              key);
-
-void AES_encrypt(const unsigned char*  in,
-                 unsigned char*        out,
-                 const AES_KEY*        key);
-
-void AES_decrypt(const unsigned char*  in,
-                 unsigned char*        out,
-                 const AES_KEY*        key);
-
-void AES_cbc_encrypt(const unsigned char*  in,
-                     unsigned char*        out,
-                     const unsigned long   length,
-                     const AES_KEY*        key,
-                     unsigned char*        ivec,
-                     const int             enc);
+struct aes_key_st {
+    uint32_t rd_key[4 *(AES_MAXNR + 1)];
+    int rounds;
+};
+typedef struct aes_key_st AES_KEY;
+
+int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
+	AES_KEY *key);
+int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
+	AES_KEY *key);
+
+void AES_encrypt(const unsigned char *in, unsigned char *out,
+	const AES_KEY *key);
+void AES_decrypt(const unsigned char *in, unsigned char *out,
+	const AES_KEY *key);
+void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
+		     const unsigned long length, const AES_KEY *key,
+		     unsigned char *ivec, const int enc);
 
 #endif
diff --git a/android-configure.sh b/android-configure.sh
index 95409c5..c5e60ef 100755
--- a/android-configure.sh
+++ b/android-configure.sh
@@ -76,21 +76,18 @@ function compile-exec-run()
 OS=`uname -s`
 CPU=`uname -m`
 EXE=""
+case "$CPU" in
+    i?86) CPU=x86
+    ;;
+esac
+
 case "$OS" in
     Darwin)
-        if [ $CPU = "i386" ] ; then
-            OS=darwin-x86
-         else
-            OS=darwin-ppc
-         fi
-         ;;
+        OS=darwin-$CPU
+        ;;
     Linux)
-        case "$CPU" in
-            i?86) OS=linux-x86
-                  ;;
-            # note that building on x86_64 is handled later
-            *)    OS=linux-$CPU
-        esac
+        # note that building on x86_64 is handled later
+        OS=linux-$CPU
         ;;
     *_NT-*)
         OS=windows
@@ -135,6 +132,10 @@ OPTION_NO_PREBUILTS=no
 OPTION_TRY_64=no
 OPTION_HELP=no
 
+if [ -z "$CC" ] ; then
+  CC=gcc
+fi
+
 for opt do
   optarg=`expr "x$opt" : 'x[^=]*=\(.*\)'`
   case "$opt" in
@@ -207,7 +208,7 @@ function clean-exit ()
 # Adjust a few things when we're building within the Android build
 # system:
 #    - locate prebuilt directory
-#    - locate and use prebuilt libraries and compiler
+#    - locate and use prebuilt libraries
 #    - copy the new binary to the correct location
 #
 if [ "$OPTION_NO_PREBUILTS" = "yes" ] ; then
@@ -254,29 +255,6 @@ if [ "$IN_ANDROID_BUILD" = "yes" ] ; then
     fi
     log "Prebuilt   : PREBUILT=$PREBUILT"
 
-    # if CC is unspecified, grab the prebuilt compiler
-    if [ -z "$CC" ] ; then
-        PREBUILT_GCC=$PREBUILT/gcc-qemu/bin/gcc
-        if [ ! -f $PREBUILT_GCC ] ; then
-            # try to find the prebuilt compiler in the new tree layout
-            # this is pretty specific to each OS and hard-coded in the
-            # build system
-            case "$OS" in
-                linux-*)
-                    QEMUGCC=i686-linux-gnu-3.4.6
-                    ;;
-                darwin-x86)
-                    QEMUGCC=i686-apple-darwin8-4.0.1
-                    ;;
-            esac
-            PREBUILT_GCC=$PREBUILT/toolchain/$QEMUGCC/bin/gcc
-        fi
-        if [ -f $PREBUILT_GCC ] ; then
-            CC=$PREBUILT_GCC
-            log "Prebuilt   : CC=$CC"
-        fi
-    fi
-
     # use ccache if USE_CCACHE is defined and the corresponding
     # binary is available.
     #
@@ -619,6 +597,7 @@ echo "CC                := $CC" >> $config_mk
 echo "HOST_CC           := $CC" >> $config_mk
 echo "LD                := $LD" >> $config_mk
 echo "NO_PREBUILT       := $OPTION_NO_PREBUILTS" >> $config_mk
+echo "HOST_PREBUILT_TAG := $PREBUILT_HOST_TAG" >> $config_mk
 echo "PREBUILT          := $PREBUILT" >> $config_mk
 echo "CFLAGS            := $CFLAGS" >> $config_mk
 echo "LDFLAGS           := $LDFLAGS" >> $config_mk
@@ -628,7 +607,7 @@ echo "CONFIG_WINAUDIO   := $PROBE_WINAUDIO" >> $config_mk
 echo "CONFIG_ESD        := $PROBE_ESD" >> $config_mk
 echo "CONFIG_ALSA       := $PROBE_ALSA" >> $config_mk
 echo "CONFIG_OSS        := $PROBE_OSS" >> $config_mk
-echo "" >> $config-mk
+echo "" >> $config_mk
 echo "BUILD_STANDALONE_EMULATOR := true" >> $config_mk
 echo "HOST_PREBUILT_TAG         := $PREBUILT_HOST_TAG" >> $config_mk
 
diff --git a/android.h b/android/android.h
index 05b579e..71a20f6 100644
--- a/android.h
+++ b/android/android.h
@@ -13,7 +13,7 @@
 #define  _qemu_android_h
 
 #define  ANDROID_VERSION_MAJOR  1
-#define  ANDROID_VERSION_MINOR  8
+#define  ANDROID_VERSION_MINOR  9
 
 #define  CONFIG_SHAPER  1
 
diff --git a/android/vm/hardware-properties.ini b/android/avd/hardware-properties.ini
index 3589e45..f2293d1 100644
--- a/android/vm/hardware-properties.ini
+++ b/android/avd/hardware-properties.ini
@@ -5,14 +5,14 @@
 #       parent is set to 'false' or 'no'
 #
 # This file is parsed by 'android/tools/gen-hw-config.py' to generate
-# 'android/vm/hw-config-defs.h'. The latter is a special header containing
+# 'android/avd/hw-config-defs.h'. The latter is a special header containing
 # macro statements that is used several times:
 #
 #  - once to define the fields of the AndroidHwConfig structure
-#    (see android/vm/hw-config.h)
+#    (see android/avd/hw-config.h)
 #
 #  - once to implement the hardware configuration loader
-#    (see android/vm/hw-config.h)
+#    (see android/avd/hw-config.h)
 #
 # Hopefully, this file should also be read by a virtual device creation
 # tool/wizard to provide a nice user interface (hence the presence of
diff --git a/android/vm/hw-config-defs.h b/android/avd/hw-config-defs.h
index 5c3b9ab..5c3b9ab 100644
--- a/android/vm/hw-config-defs.h
+++ b/android/avd/hw-config-defs.h
diff --git a/android/vm/hw-config.c b/android/avd/hw-config.c
index 7018d32..2362b59 100644
--- a/android/vm/hw-config.c
+++ b/android/avd/hw-config.c
@@ -9,7 +9,7 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android/vm/hw-config.h"
+#include "android/avd/hw-config.h"
 #include "android/utils/ini.h"
 #include <string.h>
 #include <stdlib.h>
@@ -33,7 +33,7 @@ androidHwConfig_read( AndroidHwConfig*  config,
 #define   HWCFG_DOUBLE(n,s,d,a,t)     config->n = iniFile_getDouble(ini, s, d);
 #define   HWCFG_DISKSIZE(n,s,d,a,t)   config->n = iniFile_getDiskSize(ini, s, d);
 
-#include "android/vm/hw-config-defs.h"
+#include "android/avd/hw-config-defs.h"
 
     return 0;
 }
diff --git a/android/vm/hw-config.h b/android/avd/hw-config.h
index 0ab231d..05eb828 100644
--- a/android/vm/hw-config.h
+++ b/android/avd/hw-config.h
@@ -9,8 +9,8 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#ifndef _ANDROID_VM_HW_CONFIG_H
-#define _ANDROID_VM_HW_CONFIG_H
+#ifndef _ANDROID_AVD_HW_CONFIG_H
+#define _ANDROID_AVD_HW_CONFIG_H
 
 #include <stdint.h>
 #include "android/utils/ini.h"
@@ -31,7 +31,7 @@ typedef double    hw_double_t;
 #define   HWCFG_DISKSIZE(n,s,d,a,t)   hw_disksize_t  n;
 
 typedef struct {
-#include "android/vm/hw-config-defs.h"
+#include "android/avd/hw-config-defs.h"
 } AndroidHwConfig;
 
 /* reads a hardware configuration file from disk.
@@ -43,4 +43,4 @@ typedef struct {
 int  androidHwConfig_read( AndroidHwConfig*  hwConfig,
                            IniFile*          configFile );
 
-#endif /* _ANDROID_VM_HW_CONFIG_H */
+#endif /* _ANDROID_AVD_HW_CONFIG_H */
diff --git a/android/vm/info.c b/android/avd/info.c
index 93312ac..3018d2f 100644
--- a/android/vm/info.c
+++ b/android/avd/info.c
@@ -9,23 +9,26 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android/vm/info.h"
-#include "android_utils.h"
+#include "android/avd/info.h"
+#include "android/utils/path.h"
+#include "android/utils/bufprint.h"
+#include "android/utils/filelock.h"
+#include "android/utils/tempfile.h"
 #include "android/utils/debug.h"
 #include "android/utils/dirscanner.h"
-#include "osdep.h"
+#include "qemu-common.h"
 #include <stddef.h>
 #include <string.h>
 #include <stdlib.h>
 #include <errno.h>
 
 /* global variables - see android/globals.h */
-AvmInfoParams   android_vmParams[1];
-AvmInfo*        android_vmInfo;
+AvdInfoParams   android_avdParams[1];
+AvdInfo*        android_avdInfo;
 
 /* for debugging */
 #define  D(...)   VERBOSE_PRINT(init,__VA_ARGS__)
-#define  DD(...)  VERBOSE_PRINT(vm_config,__VA_ARGS__)
+#define  DD(...)  VERBOSE_PRINT(avd_config,__VA_ARGS__)
 
 /* technical note on how all of this is supposed to work:
  *
@@ -111,21 +114,21 @@ AvmInfo*        android_vmInfo;
  *   <vendor>:<name>:<sdk> triplet
  *
  * - an add-on can provide a hardware.ini file. If present, this
- *   is used to force the hardware setting of any virtual machine
+ *   is used to force the hardware setting of any virtual device
  *   built from the add-on.
  *
  * - the file in SDK/tools/lib/hardware-properties.ini declares which
  *   hardware properties are supported by the emulator binary.
  *   these can appear in the config.ini file of a given virtual
- *   machine, or the hardware.ini of a given add-on.
+ *   device, or the hardware.ini of a given add-on.
  *
- * normally, a virtual machine corresponds to:
+ * normally, a virtual device corresponds to:
  *
- *  - a root configuration file, placed in ~/.android/vm/<foo>.ini
- *    where <foo> is the name of the virtual machine.
+ *  - a root configuration file, placed in ~/.android/avd/<foo>.ini
+ *    where <foo> is the name of the virtual device.
  *
  *  - a "content" directory, which contains disk images for the
- *    virtual machine (e.g. at a minimum, the userdata.img file)
+ *    virtual device (e.g. at a minimum, the userdata.img file)
  *    plus some configuration information.
  *
  *  - the root config file must have at least two lines like:
@@ -134,8 +137,8 @@ AvmInfo*        android_vmInfo;
  *      target=<targetAddonOrPlatform>
  *
  *    the 'path' value must point to the location of
- *    the virtual machine's content directory. By default, this
- *    should be ~/.android/vm/<foo>/, though the user should be
+ *    the virtual device's content directory. By default, this
+ *    should be ~/.android/avd/<foo>/, though the user should be
  *    able to choose an alternative path at creation time.
  *
  *    the 'target' value can be one of:
@@ -155,7 +158,7 @@ AvmInfo*        android_vmInfo;
  *    is invalid, the emulator will abort with an error.
  *
  * - the content directory shall contain a 'config.ini' that
- *   contains hardware properties for the virtual machine
+ *   contains hardware properties for the virtual device
  *   (as defined by SDK/tools/lib/hardware-properties.ini), as
  *   well as additional lines like:
  *
@@ -165,7 +168,7 @@ AvmInfo*        android_vmInfo;
  *
  *
  *  Finally, to find the skin to be used with a given virtual
- *  machine, the following logic is used:
+ *  device, the following logic is used:
  *
  *  - if no skin name has been manually specified on
  *    the command line, or in the config.ini file,
@@ -200,7 +203,7 @@ AvmInfo*        android_vmInfo;
  * root configuration files (and default content directories)
  * are located.
  */
-#define  ANDROID_VM_DIR    "vm"
+#define  ANDROID_AVD_DIR    "avd"
 
 /* certain disk image files are mounted read/write by the emulator
  * to ensure that several emulators referencing the same files
@@ -226,16 +229,16 @@ typedef enum {
     IMAGE_STATE_LOCKED,       /* locked */
     IMAGE_STATE_LOCKED_EMPTY, /* locked and empty */
     IMAGE_STATE_TEMPORARY,    /* copied to temp file (no lock needed) */
-} AvmImageState;
+} AvdImageState;
 
-struct AvmInfo {
+struct AvdInfo {
     /* for the Android build system case */
     char      inAndroidBuild;
     char*     androidOut;
     char*     androidBuildRoot;
 
-    /* for the normal virtual machine case */
-    char*     machineName;
+    /* for the normal virtual device case */
+    char*     deviceName;
     char*     sdkRootPath;
     int       platformVersion;
     char*     platformPath;
@@ -243,25 +246,25 @@ struct AvmInfo {
     char*     addonPath;
     char*     contentPath;
     IniFile*  rootIni;      /* root <foo>.ini file */
-    IniFile*  configIni;    /* virtual machine's config.ini */
+    IniFile*  configIni;    /* virtual device's config.ini */
 
     /* for both */
     char*     skinName;     /* skin name */
     char*     skinDirPath;  /* skin directory */
 
     /* image files */
-    char*     imagePath [ AVM_IMAGE_MAX ];
-    char      imageState[ AVM_IMAGE_MAX ];
+    char*     imagePath [ AVD_IMAGE_MAX ];
+    char      imageState[ AVD_IMAGE_MAX ];
 };
 
 
 void
-avmInfo_free( AvmInfo*  i )
+avdInfo_free( AvdInfo*  i )
 {
     if (i) {
         int  nn;
 
-        for (nn = 0; nn < AVM_IMAGE_MAX; nn++)
+        for (nn = 0; nn < AVD_IMAGE_MAX; nn++)
             qemu_free(i->imagePath[nn]);
 
         qemu_free(i->skinName);
@@ -289,29 +292,29 @@ avmInfo_free( AvmInfo*  i )
             qemu_free(i->addonPath);
         }
 
-        qemu_free(i->machineName);
+        qemu_free(i->deviceName);
         qemu_free(i);
     }
 }
 
 /* list of default file names for each supported image file type */
-static const char*  const  _imageFileNames[ AVM_IMAGE_MAX ] = {
-#define  _AVM_IMG(x,y,z)  y,
-    AVM_IMAGE_LIST
-#undef _AVM_IMG
+static const char*  const  _imageFileNames[ AVD_IMAGE_MAX ] = {
+#define  _AVD_IMG(x,y,z)  y,
+    AVD_IMAGE_LIST
+#undef _AVD_IMG
 };
 
 /* list of short text description for each supported image file type */
-static const char*  const _imageFileText[ AVM_IMAGE_MAX ] = {
-#define  _AVM_IMG(x,y,z)  z,
-    AVM_IMAGE_LIST
-#undef _AVM_IMG
+static const char*  const _imageFileText[ AVD_IMAGE_MAX ] = {
+#define  _AVD_IMG(x,y,z)  z,
+    AVD_IMAGE_LIST
+#undef _AVD_IMG
 };
 
 /***************************************************************
  ***************************************************************
  *****
- *****    NORMAL VIRTUAL MACHINE SUPPORT
+ *****    NORMAL VIRTUAL DEVICE SUPPORT
  *****
  *****/
 
@@ -319,9 +322,22 @@ static const char*  const _imageFileText[ AVM_IMAGE_MAX ] = {
  * assume we are in $SDKROOT/tools/emulator[.exe]
  */
 static int
-_getSdkRoot( AvmInfo*  i )
+_getSdkRoot( AvdInfo*  i )
 {
-    char   temp[PATH_MAX], *p=temp, *end=p+sizeof(temp);
+    const char*  env;
+    char         temp[PATH_MAX], *p=temp, *end=p+sizeof(temp);
+
+#define  SDK_ROOT_ENV  "ANDROID_SDK_ROOT"
+
+    env = getenv(SDK_ROOT_ENV);
+    if (env != NULL && env[0] != 0) {
+        if (path_exists(env)) {
+            D("found " SDK_ROOT_ENV ": %s", env);
+            i->sdkRootPath = qemu_strdup(env);
+            return 0;
+        }
+        D(SDK_ROOT_ENV " points to unknown directory: %s", env);
+    }
 
     (void) bufprint_app_dir(temp, end);
 
@@ -516,7 +532,7 @@ FAIL:
 }
 
 static int
-_checkAvmName( const char*  name )
+_checkAvdName( const char*  name )
 {
     int  len  = strlen(name);
     int  len2 = strspn(name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -526,37 +542,37 @@ _checkAvmName( const char*  name )
 }
 
 /* parse the root config .ini file. it is located in
- * ~/.android/vm/<name>.ini or Windows equivalent
+ * ~/.android/avd/<name>.ini or Windows equivalent
  */
 static int
-_getRootIni( AvmInfo*  i )
+_getRootIni( AvdInfo*  i )
 {
     char  temp[PATH_MAX], *p=temp, *end=p+sizeof(temp);
 
     p = bufprint_config_path(temp, end);
-    p = bufprint(p, end, "/" ANDROID_VM_DIR "/%s.ini", i->machineName);
+    p = bufprint(p, end, "/" ANDROID_AVD_DIR "/%s.ini", i->deviceName);
     if (p >= end) {
-        derror("machine name too long");
+        derror("device name too long");
         return -1;
     }
 
     i->rootIni = iniFile_newFromFile(temp);
     if (i->rootIni == NULL) {
-        derror("unknown virtual machine name: '%s'", i->machineName);
+        derror("unknown virtual device name: '%s'", i->deviceName);
         return -1;
     }
-    D("root virtual machine file at %s", temp);
+    D("root virtual device file at %s", temp);
     return 0;
 }
 
 /* the .ini variable name that points to the content directory
- * in a root AVM ini file. This is required */
+ * in a root AVD ini file. This is required */
 #   define  ROOT_PATH_KEY    "path"
 #   define  ROOT_TARGET_KEY  "target"
 
 /* retrieve the content path and target from the root .ini file */
 static int
-_getTarget( AvmInfo*  i )
+_getTarget( AvdInfo*  i )
 {
     i->contentPath = iniFile_getString(i->rootIni, ROOT_PATH_KEY);
     i->addonTarget = iniFile_getString(i->rootIni, ROOT_TARGET_KEY);
@@ -566,18 +582,18 @@ _getTarget( AvmInfo*  i )
 
     if (i->contentPath == NULL) {
         derror("bad config: %s",
-               "virtual machine file lacks a "ROOT_PATH_KEY" entry");
+               "virtual device file lacks a "ROOT_PATH_KEY" entry");
         return -1;
     }
 
     if (i->addonTarget == NULL) {
         derror("bad config: %s",
-               "virtual machine file lacks a "ROOT_TARGET_KEY" entry");
+               "virtual device file lacks a "ROOT_TARGET_KEY" entry");
         return -1;
     }
 
-    D("virtual machine content at %s", i->contentPath);
-    D("virtual machine target is %s", i->addonTarget);
+    D("virtual device content at %s", i->contentPath);
+    D("virtual device target is %s", i->addonTarget);
 
     if (!strncmp(i->addonTarget, "android-", 8)) {  /* target is platform */
         char*        end;
@@ -612,30 +628,30 @@ _getTarget( AvmInfo*  i )
                    "unknown add-on platform version: '%d'", i->platformVersion);
             return -1;
         }
-        D("virtual machine add-on path: %s", i->addonPath);
+        D("virtual device add-on path: %s", i->addonPath);
     }
-    D("virtual machine platform path: %s",   i->platformPath);
-    D("virtual machine platform version %d", i->platformVersion);
+    D("virtual device platform path: %s",   i->platformPath);
+    D("virtual device platform version %d", i->platformVersion);
     return 0;
 }
 
 
 /* find and parse the config.ini file from the content directory */
 static int
-_getConfigIni(AvmInfo*  i)
+_getConfigIni(AvdInfo*  i)
 {
     char  temp[PATH_MAX], *p=temp, *end=p+sizeof(temp);
 
     p = bufprint(p, end, "%s/config.ini", i->contentPath);
     if (p >= end) {
-        derror("can't access virtual machine content directory");
+        derror("can't access virtual device content directory");
         return -1;
     }
 
 #if 1   /* XXX: TODO: remove this in the future */
     /* for now, allow a non-existing config.ini */
     if (!path_exists(temp)) {
-        D("virtual machine has no config file - no problem");
+        D("virtual device has no config file - no problem");
         return 0;
     }
 #endif
@@ -643,10 +659,10 @@ _getConfigIni(AvmInfo*  i)
     i->configIni = iniFile_newFromFile(temp);
     if (i->configIni == NULL) {
         derror("bad config: %s",
-               "virtual machine directory lacks config.ini");
+               "virtual device directory lacks config.ini");
         return -1;
     }
-    D("virtual machine config file: %s", temp);
+    D("virtual device config file: %s", temp);
     return 0;
 }
 
@@ -661,9 +677,9 @@ _getConfigIni(AvmInfo*  i)
  * kernel/disk images.
  */
 typedef struct {
-    AvmInfo*        info;
-    AvmInfoParams*  params;
-    AvmImageType    id;
+    AvdInfo*        info;
+    AvdInfoParams*  params;
+    AvdImageType    id;
     const char*     imageFile;
     const char*     imageText;
     char**          pPath;
@@ -672,7 +688,7 @@ typedef struct {
 } ImageLoader;
 
 static void
-imageLoader_init( ImageLoader*  l, AvmInfo*  info, AvmInfoParams*  params )
+imageLoader_init( ImageLoader*  l, AvdInfo*  info, AvdInfoParams*  params )
 {
     memset(l, 0, sizeof(*l));
     l->info    = info;
@@ -681,7 +697,7 @@ imageLoader_init( ImageLoader*  l, AvmInfo*  info, AvmInfoParams*  params )
 
 /* set the type of the image to load */
 static void
-imageLoader_set( ImageLoader*  l, AvmImageType  id )
+imageLoader_set( ImageLoader*  l, AvdImageType  id )
 {
     l->id        = id;
     l->imageFile = _imageFileNames[id];
@@ -732,7 +748,7 @@ enum {
 static char*
 imageLoader_lookupSdk( ImageLoader*  l  )
 {
-    AvmInfo*  i     = l->info;
+    AvdInfo*  i     = l->info;
     char*     temp  = l->temp, *p = temp, *end = p + sizeof(l->temp);
 
     do {
@@ -776,7 +792,7 @@ imageLoader_lookupSdk( ImageLoader*  l  )
 static char*
 imageLoader_lookupContent( ImageLoader*  l )
 {
-    AvmInfo*  i     = l->info;
+    AvdInfo*  i     = l->info;
     char*     temp  = l->temp, *p = temp, *end = p + sizeof(l->temp);
 
     DD("searching %s in content directory", l->imageFile);
@@ -842,7 +858,7 @@ imageLoader_empty( ImageLoader*  l, unsigned  flags )
     if (path == NULL)  /* failed to lock, caller will handle it */
         return;
 
-    if (make_empty_file(path) < 0) {
+    if (path_empty_file(path) < 0) {
         derror("could not create %s image at %s: %s",
                 l->imageText, path, strerror(errno));
         exit(2);
@@ -874,7 +890,7 @@ imageLoader_copyFrom( ImageLoader*  l, const char*  srcPath )
     imageLoader_lock(l, 0);
 
     /* make the copy */
-    if (copy_file(dstPath, srcPath) < 0) {
+    if (path_copy_file(dstPath, srcPath) < 0) {
         derror("can't initialize %s image from SDK: %s: %s",
                l->imageText, dstPath, strerror(errno));
         exit(2);
@@ -965,12 +981,12 @@ EXIT:
  * and lock the files that need it.
  */
 static int
-_getImagePaths(AvmInfo*  i, AvmInfoParams*  params )
+_getImagePaths(AvdInfo*  i, AvdInfoParams*  params )
 {
-    int   wipeData  = (params->flags & AVMINFO_WIPE_DATA) != 0;
-    int   wipeCache = (params->flags & AVMINFO_WIPE_CACHE) != 0;
-    int   noCache   = (params->flags & AVMINFO_NO_CACHE) != 0;
-    int   noSdCard  = (params->flags & AVMINFO_NO_SDCARD) != 0;
+    int   wipeData  = (params->flags & AVDINFO_WIPE_DATA) != 0;
+    int   wipeCache = (params->flags & AVDINFO_WIPE_CACHE) != 0;
+    int   noCache   = (params->flags & AVDINFO_NO_CACHE) != 0;
+    int   noSdCard  = (params->flags & AVDINFO_NO_SDCARD) != 0;
 
     ImageLoader  l[1];
 
@@ -979,10 +995,10 @@ _getImagePaths(AvmInfo*  i, AvmInfoParams*  params )
     /* pick up the kernel and ramdisk image files - these don't
      * need a specific handling.
      */
-    imageLoader_set ( l, AVM_IMAGE_KERNEL );
+    imageLoader_set ( l, AVD_IMAGE_KERNEL );
     imageLoader_load( l, IMAGE_REQUIRED | IMAGE_SEARCH_SDK | IMAGE_DONT_LOCK );
 
-    imageLoader_set ( l, AVM_IMAGE_RAMDISK );
+    imageLoader_set ( l, AVD_IMAGE_RAMDISK );
     imageLoader_load( l, IMAGE_REQUIRED | IMAGE_SEARCH_SDK | IMAGE_DONT_LOCK );
 
     /* the system image
@@ -990,7 +1006,7 @@ _getImagePaths(AvmInfo*  i, AvmInfoParams*  params )
      * if there is one in the content directory just lock
      * and use it.
      */
-    imageLoader_set ( l, AVM_IMAGE_SYSTEM );
+    imageLoader_set ( l, AVD_IMAGE_SYSTEM );
     imageLoader_load( l, IMAGE_REQUIRED | IMAGE_SEARCH_SDK );
 
     /* the data partition - this one is special because if it
@@ -999,7 +1015,7 @@ _getImagePaths(AvmInfo*  i, AvmInfoParams*  params )
      * first, try to see if it is in the content directory
      * (or the user-provided path)
      */
-    imageLoader_set( l, AVM_IMAGE_USERDATA );
+    imageLoader_set( l, AVD_IMAGE_USERDATA );
     if ( !imageLoader_load( l, IMAGE_OPTIONAL |
                                IMAGE_EMPTY_IF_MISSING |
                                IMAGE_DONT_LOCK ) )
@@ -1035,12 +1051,12 @@ _getImagePaths(AvmInfo*  i, AvmInfoParams*  params )
      * we're going to create it in the content directory
      */
     if (!noCache) {
-        imageLoader_set (l, AVM_IMAGE_CACHE);
+        imageLoader_set (l, AVD_IMAGE_CACHE);
         imageLoader_load(l, IMAGE_OPTIONAL |
                             IMAGE_EMPTY_IF_MISSING );
 
         if (wipeCache) {
-            if (make_empty_file(l->pPath[0]) < 0) {
+            if (path_empty_file(l->pPath[0]) < 0) {
                 derror("cannot wipe %s image at %s: %s",
                        l->imageText, l->pPath[0],
                        strerror(errno));
@@ -1054,7 +1070,7 @@ _getImagePaths(AvmInfo*  i, AvmInfoParams*  params )
      * already used, we must ignore it.
      */
     if (!noSdCard) {
-        imageLoader_set (l, AVM_IMAGE_SDCARD);
+        imageLoader_set (l, AVD_IMAGE_SDCARD);
         imageLoader_load(l, IMAGE_OPTIONAL |
                             IMAGE_IGNORE_IF_LOCKED);
 
@@ -1066,7 +1082,7 @@ _getImagePaths(AvmInfo*  i, AvmInfoParams*  params )
 
             /* if the user provided the SD Card path by hand,
              * warn him. */
-            if (params->forcePaths[AVM_IMAGE_SDCARD] != NULL)
+            if (params->forcePaths[AVD_IMAGE_SDCARD] != NULL)
                 dwarning("ignoring non-existing SD Card image");
 
             imageLoader_setPath(l, NULL);
@@ -1136,7 +1152,7 @@ _checkSkinDir( char*  temp, char*  end, const char*  skinDirRoot, const char*  s
 }
 
 static int
-_getSkin( AvmInfo*  i, AvmInfoParams*  params )
+_getSkin( AvdInfo*  i, AvdInfoParams*  params )
 {
     char*  skinName;
     char   temp[PATH_MAX], *p=temp, *end=p+sizeof(temp);
@@ -1157,6 +1173,19 @@ _getSkin( AvmInfo*  i, AvmInfoParams*  params )
 
     i->skinName = skinName;
 
+    /* if the skin name has the format 'NNNNxNNN' where
+     * NNN is a decimal value, then this is a 'magic' skin
+     * name that doesn't require a skin directory
+     */
+    if (isdigit(skinName[0])) {
+        int  width, height;
+        if (sscanf(skinName, "%dx%d", &width, &height) == 2) {
+            D("'magic' skin format detected: %s", skinName);
+            i->skinDirPath = NULL;
+            return 0;
+        }
+    }
+
     /* now try to find the skin directory for that name -
      * first try the content directory */
     do {
@@ -1219,21 +1248,21 @@ _getSkin( AvmInfo*  i, AvmInfoParams*  params )
 }
 
 
-AvmInfo*
-avmInfo_new( const char*  name, AvmInfoParams*  params )
+AvdInfo*
+avdInfo_new( const char*  name, AvdInfoParams*  params )
 {
-    AvmInfo*  i;
+    AvdInfo*  i;
 
     if (name == NULL)
         return NULL;
 
-    if (!_checkAvmName(name)) {
-        derror("virtual machine name contains invalid characters");
+    if (!_checkAvdName(name)) {
+        derror("virtual device name contains invalid characters");
         exit(1);
     }
 
     i              = qemu_mallocz(sizeof *i);
-    i->machineName = qemu_strdup(name);
+    i->deviceName = qemu_strdup(name);
 
     if ( _getSdkRoot(i)    < 0 ||
          _getRootIni(i)    < 0 ||
@@ -1248,7 +1277,7 @@ avmInfo_new( const char*  name, AvmInfoParams*  params )
     return i;
 
 FAIL:
-    avmInfo_free(i);
+    avdInfo_free(i);
     return NULL;
 }
 
@@ -1279,7 +1308,7 @@ FAIL:
 
 /* used to fake a config.ini located in the content directory */
 static int
-_getBuildConfigIni( AvmInfo*  i )
+_getBuildConfigIni( AvdInfo*  i )
 {
     /* a blank file is ok at the moment */
     i->configIni = iniFile_newFromMemory( "", 0 );
@@ -1287,11 +1316,11 @@ _getBuildConfigIni( AvmInfo*  i )
 }
 
 static int
-_getBuildImagePaths( AvmInfo*  i, AvmInfoParams*  params )
+_getBuildImagePaths( AvdInfo*  i, AvdInfoParams*  params )
 {
-    int   wipeData  = (params->flags & AVMINFO_WIPE_DATA) != 0;
-    int   noCache   = (params->flags & AVMINFO_NO_CACHE) != 0;
-    int   noSdCard  = (params->flags & AVMINFO_NO_SDCARD) != 0;
+    int   wipeData  = (params->flags & AVDINFO_WIPE_DATA) != 0;
+    int   noCache   = (params->flags & AVDINFO_NO_CACHE) != 0;
+    int   noSdCard  = (params->flags & AVDINFO_NO_SDCARD) != 0;
 
     char         temp[PATH_MAX], *p=temp, *end=p+sizeof temp;
     char*        srcData;
@@ -1304,7 +1333,7 @@ _getBuildImagePaths( AvmInfo*  i, AvmInfoParams*  params )
 
     /* if it is not in the out directory, get it from prebuilt
      */
-    imageLoader_set ( l, AVM_IMAGE_KERNEL );
+    imageLoader_set ( l, AVD_IMAGE_KERNEL );
 
     if ( !imageLoader_load( l, IMAGE_OPTIONAL |
                                IMAGE_DONT_LOCK ) )
@@ -1322,14 +1351,14 @@ _getBuildImagePaths( AvmInfo*  i, AvmInfoParams*  params )
     /** load the data partition. note that we use userdata-qemu.img
      ** since we don't want to modify userdata.img at all
      **/
-    imageLoader_set ( l, AVM_IMAGE_USERDATA );
+    imageLoader_set ( l, AVD_IMAGE_USERDATA );
     imageLoader_load( l, IMAGE_OPTIONAL | IMAGE_DONT_LOCK );
 
     /* get the path of the source file, and check that it actually exists
      * if the user didn't provide an explicit data file
      */
     srcData = imageLoader_extractPath(l);
-    if (srcData == NULL && params->forcePaths[AVM_IMAGE_USERDATA] == NULL) {
+    if (srcData == NULL && params->forcePaths[AVD_IMAGE_USERDATA] == NULL) {
         derror("There is no %s image in your build directory. Please make a full build",
                 l->imageText, l->imageFile);
         exit(2);
@@ -1363,7 +1392,7 @@ _getBuildImagePaths( AvmInfo*  i, AvmInfoParams*  params )
                    l->imageText, _imageFileNames[l->id]);
             exit(2);
         }
-        if (copy_file( l->pPath[0], srcData ) < 0) {
+        if (path_copy_file( l->pPath[0], srcData ) < 0) {
             derror("could not initialize %s image from %s: %s",
                    l->imageText, temp, strerror(errno));
             exit(2);
@@ -1374,14 +1403,14 @@ _getBuildImagePaths( AvmInfo*  i, AvmInfoParams*  params )
 
     /** load the ramdisk image
      **/
-    imageLoader_set ( l, AVM_IMAGE_RAMDISK );
+    imageLoader_set ( l, AVD_IMAGE_RAMDISK );
     imageLoader_load( l, IMAGE_REQUIRED |
                          IMAGE_DONT_LOCK );
 
     /** load the system image. read-only. the caller must
      ** take care of checking the state
      **/
-    imageLoader_set ( l, AVM_IMAGE_SYSTEM );
+    imageLoader_set ( l, AVD_IMAGE_SYSTEM );
     imageLoader_load( l, IMAGE_REQUIRED | IMAGE_DONT_LOCK );
 
     /* force the system image to read-only status */
@@ -1390,7 +1419,7 @@ _getBuildImagePaths( AvmInfo*  i, AvmInfoParams*  params )
     /** cache partition handling
      **/
     if (!noCache) {
-        imageLoader_set (l, AVM_IMAGE_CACHE);
+        imageLoader_set (l, AVD_IMAGE_CACHE);
 
         /* if the user provided one cache image, lock & use it */
         if ( params->forcePaths[l->id] != NULL ) {
@@ -1402,7 +1431,7 @@ _getBuildImagePaths( AvmInfo*  i, AvmInfoParams*  params )
     /** SD Card image
      **/
     if (!noSdCard) {
-        imageLoader_set (l, AVM_IMAGE_SDCARD);
+        imageLoader_set (l, AVD_IMAGE_SDCARD);
         imageLoader_load(l, IMAGE_OPTIONAL | IMAGE_IGNORE_IF_LOCKED);
     }
 
@@ -1410,7 +1439,7 @@ _getBuildImagePaths( AvmInfo*  i, AvmInfoParams*  params )
 }
 
 static int
-_getBuildSkin( AvmInfo*  i, AvmInfoParams*  params )
+_getBuildSkin( AvdInfo*  i, AvdInfoParams*  params )
 {
     /* the (current) default skin name for our build system */
     const char*  skinName = params->skinName;
@@ -1452,12 +1481,12 @@ _getBuildSkin( AvmInfo*  i, AvmInfoParams*  params )
     return 0;
 }
 
-AvmInfo*
-avmInfo_newForAndroidBuild( const char*     androidBuildRoot,
+AvdInfo*
+avdInfo_newForAndroidBuild( const char*     androidBuildRoot,
                             const char*     androidOut,
-                            AvmInfoParams*  params )
+                            AvdInfoParams*  params )
 {
-    AvmInfo*  i;
+    AvdInfo*  i;
 
     i = qemu_mallocz(sizeof *i);
 
@@ -1467,7 +1496,7 @@ avmInfo_newForAndroidBuild( const char*     androidBuildRoot,
     i->contentPath      = qemu_strdup(androidOut);
 
     /* TODO: find a way to provide better information from the build files */
-    i->machineName = qemu_strdup("<build>");
+    i->deviceName = qemu_strdup("<build>");
 
     if (_getBuildConfigIni(i)          < 0 ||
         _getBuildImagePaths(i, params) < 0 )
@@ -1479,48 +1508,48 @@ avmInfo_newForAndroidBuild( const char*     androidBuildRoot,
     return i;
 
 FAIL:
-    avmInfo_free(i);
+    avdInfo_free(i);
     return NULL;
 }
 
 const char*
-avmInfo_getName( AvmInfo*  i )
+avdInfo_getName( AvdInfo*  i )
 {
-    return i ? i->machineName : NULL;
+    return i ? i->deviceName : NULL;
 }
 
 const char*
-avmInfo_getImageFile( AvmInfo*  i, AvmImageType  imageType )
+avdInfo_getImageFile( AvdInfo*  i, AvdImageType  imageType )
 {
-    if (i == NULL || (unsigned)imageType >= AVM_IMAGE_MAX)
+    if (i == NULL || (unsigned)imageType >= AVD_IMAGE_MAX)
         return NULL;
 
     return i->imagePath[imageType];
 }
 
 int
-avmInfo_isImageReadOnly( AvmInfo*  i, AvmImageType  imageType )
+avdInfo_isImageReadOnly( AvdInfo*  i, AvdImageType  imageType )
 {
-    if (i == NULL || (unsigned)imageType >= AVM_IMAGE_MAX)
+    if (i == NULL || (unsigned)imageType >= AVD_IMAGE_MAX)
         return 1;
 
     return (i->imageState[imageType] == IMAGE_STATE_READONLY);
 }
 
 const char*
-avmInfo_getSkinName( AvmInfo*  i )
+avdInfo_getSkinName( AvdInfo*  i )
 {
     return i->skinName;
 }
 
 const char*
-avmInfo_getSkinDir ( AvmInfo*  i )
+avdInfo_getSkinDir ( AvdInfo*  i )
 {
     return i->skinDirPath;
 }
 
 int
-avmInfo_getHwConfig( AvmInfo*  i, AndroidHwConfig*  hw )
+avdInfo_getHwConfig( AvdInfo*  i, AndroidHwConfig*  hw )
 {
     IniFile*   ini = i->configIni;
     int        ret;
@@ -1538,7 +1567,7 @@ avmInfo_getHwConfig( AvmInfo*  i, AndroidHwConfig*  hw )
 
 
 char*
-avmInfo_getTracePath( AvmInfo*  i, const char*  traceName )
+avdInfo_getTracePath( AvdInfo*  i, const char*  traceName )
 {
     char   tmp[MAX_PATH], *p=tmp, *end=p + sizeof(tmp);
 
diff --git a/android/vm/info.h b/android/avd/info.h
index cdad34f..ad8a138 100644
--- a/android/vm/info.h
+++ b/android/avd/info.h
@@ -9,25 +9,25 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#ifndef ANDROID_VM_INFO_H
-#define ANDROID_VM_INFO_H
+#ifndef ANDROID_AVD_INFO_H
+#define ANDROID_AVD_INFO_H
 
 #include "android/utils/ini.h"
-#include "android/vm/hw-config.h"
+#include "android/avd/hw-config.h"
 
-/* An Android Virtual Machine (AVM for short) corresponds to a
+/* An Android Virtual Device (AVD for short) corresponds to a
  * directory containing all kernel/disk images for a given virtual
  * device, as well as information about its hardware capabilities,
  * SDK version number, skin, etc...
  *
- * Each AVM has a human-readable name and is backed by a root
+ * Each AVD has a human-readable name and is backed by a root
  * configuration file and a content directory. For example, an
- *  AVM named 'foo' will correspond to the following:
+ *  AVD named 'foo' will correspond to the following:
  *
- *  - a root configuration file named ~/.android/vm/foo.ini
- *    describing where the AVM's content can be found
+ *  - a root configuration file named ~/.android/avd/foo.ini
+ *    describing where the AVD's content can be found
  *
- *  - a content directory like ~/.android/vm/foo/ containing all
+ *  - a content directory like ~/.android/avd/foo/ containing all
  *    disk image and configuration files for the virtual device.
  *
  * the 'foo.ini' file should contain at least one line of the form:
@@ -47,57 +47,57 @@
 
 /* a macro used to define the list of disk images managed by the
  * implementation. This macro will be expanded several times with
- * varying definitions of _AVM_IMG
+ * varying definitions of _AVD_IMG
  */
-#define  AVM_IMAGE_LIST \
-    _AVM_IMG(KERNEL,"kernel-qemu","kernel") \
-    _AVM_IMG(RAMDISK,"ramdisk.img","ramdisk") \
-    _AVM_IMG(SYSTEM,"system.img","system") \
-    _AVM_IMG(USERDATA,"userdata.img","user data") \
-    _AVM_IMG(CACHE,"cache.img","cache") \
-    _AVM_IMG(SDCARD,"sdcard.img","SD Card") \
-
-/* define the enumared values corresponding to each AVM image type
- * examples are: AVM_IMAGE_KERNEL, AVM_IMAGE_SYSTEM, etc..
+#define  AVD_IMAGE_LIST \
+    _AVD_IMG(KERNEL,"kernel-qemu","kernel") \
+    _AVD_IMG(RAMDISK,"ramdisk.img","ramdisk") \
+    _AVD_IMG(SYSTEM,"system.img","system") \
+    _AVD_IMG(USERDATA,"userdata.img","user data") \
+    _AVD_IMG(CACHE,"cache.img","cache") \
+    _AVD_IMG(SDCARD,"sdcard.img","SD Card") \
+
+/* define the enumared values corresponding to each AVD image type
+ * examples are: AVD_IMAGE_KERNEL, AVD_IMAGE_SYSTEM, etc..
  */
-#define _AVM_IMG(x,y,z)   AVM_IMAGE_##x ,
+#define _AVD_IMG(x,y,z)   AVD_IMAGE_##x ,
 typedef enum {
-    AVM_IMAGE_LIST
-    AVM_IMAGE_MAX /* do not remove */
-} AvmImageType;
-#undef  _AVM_IMG
+    AVD_IMAGE_LIST
+    AVD_IMAGE_MAX /* do not remove */
+} AvdImageType;
+#undef  _AVD_IMG
 
-/* AvmInfo is an opaque structure used to model the information
- * corresponding to a given AVM instance
+/* AvdInfo is an opaque structure used to model the information
+ * corresponding to a given AVD instance
  */
-typedef struct AvmInfo  AvmInfo;
+typedef struct AvdInfo  AvdInfo;
 
-/* various flags used when creating an AvmInfo object */
+/* various flags used when creating an AvdInfo object */
 typedef enum {
     /* use to force a data wipe */
-    AVMINFO_WIPE_DATA = (1 << 0),
+    AVDINFO_WIPE_DATA = (1 << 0),
     /* use to ignore the cache partition */
-    AVMINFO_NO_CACHE  = (1 << 1),
+    AVDINFO_NO_CACHE  = (1 << 1),
     /* use to wipe cache partition, ignored if NO_CACHE is set */
-    AVMINFO_WIPE_CACHE = (1 << 2),
+    AVDINFO_WIPE_CACHE = (1 << 2),
     /* use to ignore ignore SDCard image (default or provided) */
-    AVMINFO_NO_SDCARD = (1 << 3),
-} AvmFlags;
+    AVDINFO_NO_SDCARD = (1 << 3),
+} AvdFlags;
 
 typedef struct {
     unsigned     flags;
     const char*  skinName;
     const char*  skinRootPath;
-    const char*  forcePaths[AVM_IMAGE_MAX];
-} AvmInfoParams;
+    const char*  forcePaths[AVD_IMAGE_MAX];
+} AvdInfoParams;
 
-/* Creates a new AvmInfo object from a name. Returns NULL if name is NULL
+/* Creates a new AvdInfo object from a name. Returns NULL if name is NULL
  * or contains characters that are not part of the following list:
  * letters, digits, underscores, dashes and periods
  */
-AvmInfo*  avmInfo_new( const char*  name, AvmInfoParams*  params );
+AvdInfo*  avdInfo_new( const char*  name, AvdInfoParams*  params );
 
-/* A special function used to setup an AvmInfo for use when starting
+/* A special function used to setup an AvdInfo for use when starting
  * the emulator from the Android build system. In this specific instance
  * we're going to create temporary files to hold all writable image
  * files, and activate all hardware features by default
@@ -108,54 +108,54 @@ AvmInfo*  avmInfo_new( const char*  name, AvmInfoParams*  params );
  * 'androidOut' must be the target-specific out directory where
  * disk images will be looked for.
  */
-AvmInfo*  avmInfo_newForAndroidBuild( const char*     androidBuildRoot,
+AvdInfo*  avdInfo_newForAndroidBuild( const char*     androidBuildRoot,
                                       const char*     androidOut,
-                                      AvmInfoParams*  params );
+                                      AvdInfoParams*  params );
 
-/* Frees an AvmInfo object and the corresponding strings that may be
+/* Frees an AvdInfo object and the corresponding strings that may be
  * returned by its getXXX() methods
  */
-void        avmInfo_free( AvmInfo*  i );
+void        avdInfo_free( AvdInfo*  i );
 
-/* Return the name of the Android Virtual Machine
+/* Return the name of the Android Virtual Device
  */
-const char*  avmInfo_getName( AvmInfo*  i );
+const char*  avdInfo_getName( AvdInfo*  i );
 
 /* Try to find the path of a given image file, returns NULL
  * if the corresponding file could not be found. the string
- * belongs to the AvmInfo object.
+ * belongs to the AvdInfo object.
  */
-const char*  avmInfo_getImageFile( AvmInfo*  i, AvmImageType  imageType );
+const char*  avdInfo_getImageFile( AvdInfo*  i, AvdImageType  imageType );
 
 /* Returns 1 if the corresponding image file is read-only
  */
-int          avmInfo_isImageReadOnly( AvmInfo*  i, AvmImageType  imageType );
+int          avdInfo_isImageReadOnly( AvdInfo*  i, AvdImageType  imageType );
 
 /* lock an image file if it is writable. returns 0 on success, or -1
  * otherwise. note that if the file is read-only, it doesn't need to
  * be locked and the function will return success.
  */
-int          avmInfo_lockImageFile( AvmInfo*  i, AvmImageType  imageType, int  abortOnError);
+int          avdInfo_lockImageFile( AvdInfo*  i, AvdImageType  imageType, int  abortOnError);
 
 /* Manually set the path of a given image file. */
-void         avmInfo_setImageFile( AvmInfo*  i, AvmImageType  imageType, const char*  imagePath );
+void         avdInfo_setImageFile( AvdInfo*  i, AvdImageType  imageType, const char*  imagePath );
 
 /* Returns the path of the skin directory */
-/* the string belongs to the AvmInfo object */
-const char*  avmInfo_getSkinPath( AvmInfo*  i );
+/* the string belongs to the AvdInfo object */
+const char*  avdInfo_getSkinPath( AvdInfo*  i );
 
-/* Returns the name of the virtual machine's skin */
-const char*  avmInfo_getSkinName( AvmInfo*  i );
+/* Returns the name of the virtual device's skin */
+const char*  avdInfo_getSkinName( AvdInfo*  i );
 
-/* Returns the root skin directory for this machine */
-const char*  avmInfo_getSkinDir ( AvmInfo*  i );
+/* Returns the root skin directory for this device */
+const char*  avdInfo_getSkinDir ( AvdInfo*  i );
 
-/* Reads the AVM's hardware configuration into 'hw'. returns -1 on error, 0 otherwise */
-int          avmInfo_getHwConfig( AvmInfo*  i, AndroidHwConfig*  hw );
+/* Reads the AVD's hardware configuration into 'hw'. returns -1 on error, 0 otherwise */
+int          avdInfo_getHwConfig( AvdInfo*  i, AndroidHwConfig*  hw );
 
 /* Returns a *copy* of the path used to store trace 'foo'. result must be freed by caller */
-char*        avmInfo_getTracePath( AvmInfo*  i, const char*  traceName );
+char*        avdInfo_getTracePath( AvdInfo*  i, const char*  traceName );
 
 /* */
 
-#endif /* ANDROID_VM_INFO_H */
+#endif /* ANDROID_AVD_INFO_H */
diff --git a/android/build/binary.make b/android/build/binary.make
index 379ef9a..1c75d52 100644
--- a/android/build/binary.make
+++ b/android/build/binary.make
@@ -21,9 +21,14 @@ LOCAL_OBJS_DIR  := $(call intermediates-dir-for,EXECUTABLES,$(LOCAL_MODULE))
 LOCAL_OBJECTS   :=
 LOCAL_CC        ?= $(CC)
 LOCAL_C_SOURCES := $(filter  %.c,$(LOCAL_SRC_FILES))
+LOCAL_OBJC_SOURCES := $(filter %.m,$(LOCAL_SRC_FILES))
 
 $(foreach src,$(LOCAL_C_SOURCES), \
     $(eval $(call compile-c-source,$(src))) \
 )
 
+$(foreach src,$(LOCAL_OBJC_SOURCES), \
+    $(eval $(call compile-objc-source,$(src))) \
+)
+
 CLEAN_OBJS_DIRS += $(LOCAL_OBJS_DIR)
diff --git a/android/build/definitions.make b/android/build/definitions.make
index fd1dd63..cd03f89 100644
--- a/android/build/definitions.make
+++ b/android/build/definitions.make
@@ -68,6 +68,26 @@ $$(OBJ): $$(SRC_PATH)/$$(SRC)
 	$(hide) $$(SRC_PATH)/android/build/mkdeps.sh $$(PRIVATE_OBJ) $$(PRIVATE_OBJ).d.tmp $$(PRIVATE_OBJ).d
 endef
 
+# Compile an Objective-C source file
+#
+define  compile-objc-source
+SRC:=$(1)
+OBJ:=$$(LOCAL_OBJS_DIR)/$$(SRC:%.m=%.o)
+LOCAL_OBJECTS += $$(OBJ)
+DEPENDENCY_DIRS += $$(dir $$(OBJ))
+$$(OBJ): PRIVATE_CFLAGS := $$(CFLAGS) $$(LOCAL_CFLAGS) -I$$(LOCAL_PATH) -I$$(OBJS_DIR)
+$$(OBJ): PRIVATE_CC     := $$(LOCAL_CC)
+$$(OBJ): PRIVATE_OBJ    := $$(OBJ)
+$$(OBJ): PRIVATE_MODULE := $$(LOCAL_MODULE)
+$$(OBJ): PRIVATE_SRC    := $$(SRC_PATH)/$$(SRC)
+$$(OBJ): PRIVATE_SRC0   := $$(SRC)
+$$(OBJ): $$(SRC_PATH)/$$(SRC)
+	@mkdir -p $$(dir $$(PRIVATE_OBJ))
+	@echo "Compile: $$(PRIVATE_MODULE) <= $$(PRIVATE_SRC0)"
+	$(hide) $$(PRIVATE_CC) $$(PRIVATE_CFLAGS) -c -o $$(PRIVATE_OBJ) -MMD -MP -MF $$(PRIVATE_OBJ).d.tmp $$(PRIVATE_SRC)
+	$(hide) $$(SRC_PATH)/android/build/mkdeps.sh $$(PRIVATE_OBJ) $$(PRIVATE_OBJ).d.tmp $$(PRIVATE_OBJ).d
+endef
+
 # for now, we only use prebuilt SDL libraries, so copy them
 define copy-prebuilt-lib
 _SRC := $(1)
diff --git a/android/build/mkdeps.sh b/android/build/mkdeps.sh
index 2d25ca3..abecec7 100755
--- a/android/build/mkdeps.sh
+++ b/android/build/mkdeps.sh
@@ -40,9 +40,12 @@ OBJECT=`echo $1 | sed -e s/\\\\./\\\\\\\\./g`
 OBJ_NAME=`basename $OBJECT`
 #echo OBJ_NAME=$OBJ_NAME
 
-# we replace $OBJ_NAME with $OBJECT
+# we replace $OBJ_NAME with $OBJECT only if $OBJ_NAME starts the line
+# that's because some versions of GCC (e.g. 4.2.3) already produce
+# a correct dependency line with the full path to the object file.
+# In this case, we don't want to touch anything
 #
-cat $2 | sed -e s%$OBJ_NAME%$OBJECT%g > $3 && rm -f $2
+cat $2 | sed -e s%^$OBJ_NAME%$OBJECT%g > $3 && rm -f $2
 
 
 
diff --git a/android_charmap.c b/android/charmap.c
index bd57bc0..c8ed2d6 100644
--- a/android_charmap.c
+++ b/android/charmap.c
@@ -9,7 +9,7 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android_charmap.h"
+#include "android/charmap.h"
 
 /* the following is automatically generated by the 'gen-charmap.py' script
  * do not touch. the generation command was:
diff --git a/android_charmap.h b/android/charmap.h
index f300e68..f300e68 100644
--- a/android_charmap.h
+++ b/android/charmap.h
diff --git a/android_option.c b/android/cmdline-option.c
index 7f97b64..b773d9d 100644
--- a/android_option.c
+++ b/android/cmdline-option.c
@@ -1,6 +1,6 @@
-#include "android_option.h"
-#include "android_debug.h"
-#include "android_utils.h"
+#include "android/cmdline-option.h"
+#include "android/utils/debug.h"
+#include "android/utils/misc.h"
 #include <stdlib.h>
 #include <stddef.h>
 #include <string.h>
@@ -13,7 +13,7 @@ debug_tags[] = {
 };
 
 static void  parse_debug_tags( const char*  tags );
-static void  parse_env_debug_tags( void );
+void  parse_env_debug_tags( void );
 
 
 typedef struct {
@@ -32,7 +32,7 @@ static const OptionInfo  option_keys[] = {
 #define  OPT_FLAG(_name,_descr)             OPTION(_name,0,0)
 #define  CFG_PARAM(_name,_template,_descr)  OPTION(_name,1,1)
 #define  CFG_FLAG(_name,_descr)             OPTION(_name,0,1)
-#include "android_options.h"
+#include "android/cmdline-options.h"
     { NULL, 0, 0, 0 }
 };
 
@@ -51,10 +51,10 @@ android_parse_options( int  *pargc, char**  *pargv, AndroidOptions*  opt )
         int    nn;
 
         /* process @<name> as a special exception meaning
-         * '-vm <name>'
+         * '-avd <name>'
          */
         if (aread[0][0] == '@') {
-            opt->vm = aread[0]+1;
+            opt->avd = aread[0]+1;
             nargs--;
             aread++;
             continue;
@@ -246,8 +246,7 @@ parse_debug_tags( const char*  tags )
     free(x0);
 }
 
-
-static void
+void
 parse_env_debug_tags( void )
 {
     const char*  env = getenv( ENV_DEBUG );
diff --git a/android_option.h b/android/cmdline-option.h
index e33a030..b87144d 100644
--- a/android_option.h
+++ b/android/cmdline-option.h
@@ -17,7 +17,7 @@
 typedef struct {
 #define OPT_PARAM(n,t,d)   char*  n;
 #define OPT_FLAG(n,d)      int    n;
-#include "android_options.h"
+#include "android/cmdline-options.h"
 } AndroidOptions;
 
 
diff --git a/android_options.h b/android/cmdline-options.h
index 0a7d79b..c0d121e 100644
--- a/android_options.h
+++ b/android/cmdline-options.h
@@ -16,27 +16,27 @@
 #endif
 
 /* required to ensure that the CONFIG_XXX macros are properly defined */
-#include "config.h"
+//XXX#include "config.h"
 
-/* some options acts like flags, while others must be followed by a parameter
- * string. nothing really new here.
+/* Some options acts like flags, while others must be followed by a parameter
+ * string. Nothing really new here.
  *
- * some options correspond to AVM (Android Virtual Machine) configuration
- * and will be ignored if you start the emulator with the -avm <name> flag.
+ * Some options correspond to AVD (Android Virtual Device) configuration
+ * and will be ignored if you start the emulator with the -avd <name> flag.
  *
- * however, if you use them with -avm-create <name>, these options will be
- * recorded into the new AVM directory. once an AVM is created, there is no
+ * However, if you use them with -avd-create <name>, these options will be
+ * recorded into the new AVD directory. Once an AVD is created, there is no
  * way to change these options.
  *
- * several macros are used to define options:
+ * Several macros are used to define options:
  *
  *    OPT_FLAG( name, "description" )
  *       used to define a non-config flag option.
  *       * 'name' is the option suffix that must follow the dash (-)
  *          as well as the name of an integer variable whose value will
- *          be 1 if the flag is used, or 0 otherwise
+ *          be 1 if the flag is used, or 0 otherwise.
  *       * "description" is a short description string that will be
- *         displayed by 'emulator -help'
+ *         displayed by 'emulator -help'.
  *
  *    OPT_PARAM( name, "<param>", "description" )
  *       used to define a non-config parameter option
@@ -46,15 +46,15 @@
  *          to the parameter string, if any, or will be NULL otherwise.
  *
  *    CFG_FLAG( name, "description" )
- *        used to define a configuration-specific flag option
+ *        used to define a configuration-specific flag option.
  *
  *    CFG_PARAM( name, "<param>", "description" )
- *        used to define a configuration-specific parameter option
+ *        used to define a configuration-specific parameter option.
  *
- * NOTE: keep in mind that optio names are converted by translating
+ * NOTE: Keep in mind that optio names are converted by translating
  *       dashes into underscore.
  *
- *       this means that '-some-option' is equivalent to '-some_option'
+ *       This means that '-some-option' is equivalent to '-some_option'
  *       and will be backed by a variable name 'some_option'
  *
  */
@@ -70,7 +70,7 @@ CFG_PARAM( cache,    "<file>", "cache partition image (default is temporary file
 CFG_FLAG ( nocache,  "disable the cache partition" )
 OPT_PARAM( sdcard, "<file>", "SD card image (default <system>/sdcard.img")
 OPT_FLAG ( wipe_data, "reset the use data image (copy it from initdata)" )
-CFG_PARAM( vm, "<name>", "use a specific virtual machine" )
+CFG_PARAM( avd, "<name>", "use a specific android virtual device" )
 CFG_PARAM( skindir, "<dir>", "search skins in <dir> (default <system>/skins)" )
 CFG_PARAM( skin, "<file>", "select a given skin" )
 CFG_FLAG ( noskin, "don't use any emulator skin" )
diff --git a/android_config.c b/android/config.c
index c90a219..36fab11 100644
--- a/android_config.c
+++ b/android/config.c
@@ -15,12 +15,8 @@
 #include <fcntl.h>
 #include <unistd.h>
 
-#include "android_config.h"
-#include "android_utils.h"
-
-#if !defined(_WIN23) && !defined(O_BINARY)
-#  define  O_BINARY 0
-#endif
+#include "android/config.h"
+#include "android/utils/path.h"
 
 AConfig*
 aconfig_node(const char *name, const char *value)
@@ -341,7 +337,7 @@ int
 aconfig_load_file(AConfig *root, const char *fn)
 {
     char *data;
-    data = load_text_file(fn);
+    data = path_load_file(fn, NULL);
     if (data == NULL)
         return -1;
 
diff --git a/android_config.h b/android/config.h
index 5e8b048..5e8b048 100644
--- a/android_config.h
+++ b/android/config.h
diff --git a/android/config/Linux/config-host.h b/android/config/Linux/config-host.h
new file mode 100644
index 0000000..90defbd
--- /dev/null
+++ b/android/config/Linux/config-host.h
@@ -0,0 +1,10 @@
+/* Automatically generated by configure - do not modify */
+#define CONFIG_QEMU_SHAREDIR "/usr/local/share/qemu"
+#define HOST_I386 1
+#define HOST_LONG_BITS 32
+#define HAVE_BYTESWAP_H 1
+#define CONFIG_GDBSTUB 1
+#define CONFIG_SLIRP 1
+#define QEMU_VERSION "0.8.2"
+#define CONFIG_SKINS 1
+#define CONFIG_UNAME_RELEASE ""
diff --git a/android_console.c b/android/console.c
index defc0f9..3a769c1 100644
--- a/android_console.c
+++ b/android/console.c
@@ -22,15 +22,20 @@
  */
 
 #include "sockets.h"
-#include "vl.h"
-#include "android.h"
+#include "qemu-char.h"
+#include "sysemu.h"
+#include "android/android.h"
 #include "sockets.h"
+#include "cpu.h"
 #include "hw/goldfish_device.h"
 #include "hw/power_supply.h"
 #include "shaper.h"
 #include "modem_driver.h"
-#include "android_gps.h"
+#include "android/gps.h"
 #include "android/globals.h"
+#include "android/utils/bufprint.h"
+#include "android/utils/debug.h"
+#include "android/utils/stralloc.h"
 #include "tcpdump.h"
 
 #include <stdlib.h>
@@ -39,8 +44,8 @@
 #include <string.h>
 #include <unistd.h>
 #include <fcntl.h>
-#include "android_events.h"
-#include "skin_keyboard.h"
+#include "android/hw-events.h"
+#include "android/skin/keyboard.h"
 
 #if defined(CONFIG_SLIRP)
 #include "libslirp.h"
@@ -257,7 +262,7 @@ control_client_create( Socket         socket,
 
     if (client) {
 #if !USE_SYSDEPS
-        socket_set_lowlatency( socket );
+        socket_set_nodelay( socket );
         socket_set_nonblock( socket );
 #endif
         client->finished = 0;
@@ -1865,10 +1870,10 @@ static const CommandDefRec  event_commands[] =
 /********************************************************************************************/
 
 static int
-do_vm_stop( ControlClient  client, char*  args )
+do_avd_stop( ControlClient  client, char*  args )
 {
     if (!vm_running) {
-        control_write( client, "KO: virtual machine already stopped\r\n" );
+        control_write( client, "KO: virtual device already stopped\r\n" );
         return -1;
     }
     vm_stop(EXCP_INTERRUPT);
@@ -1876,10 +1881,10 @@ do_vm_stop( ControlClient  client, char*  args )
 }
 
 static int
-do_vm_start( ControlClient  client, char*  args )
+do_avd_start( ControlClient  client, char*  args )
 {
     if (vm_running) {
-        control_write( client, "KO: virtual machine already running\r\n" );
+        control_write( client, "KO: virtual device already running\r\n" );
         return -1;
     }
     vm_start();
@@ -1887,36 +1892,36 @@ do_vm_start( ControlClient  client, char*  args )
 }
 
 static int
-do_vm_status( ControlClient  client, char*  args )
+do_avd_status( ControlClient  client, char*  args )
 {
-    control_write( client, "virtual machine is %s\r\n", vm_running ? "running" : "stopped" );
+    control_write( client, "virtual device is %s\r\n", vm_running ? "running" : "stopped" );
     return 0;
 }
 
 static int
-do_vm_name( ControlClient  client, char*  args )
+do_avd_name( ControlClient  client, char*  args )
 {
-    control_write( client, "%s\r\n", avmInfo_getName(android_vmInfo) );
+    control_write( client, "%s\r\n", avdInfo_getName(android_avdInfo) );
     return 0;
 }
 
 static const CommandDefRec  vm_commands[] =
 {
-    { "stop", "stop the virtual machine",
-    "'vm stop' stops the virtual machine immediately, use 'vm start' to continue execution\r\n",
-    NULL, do_vm_stop, NULL },
+    { "stop", "stop the virtual device",
+    "'avd stop' stops the virtual device immediately, use 'avd start' to continue execution\r\n",
+    NULL, do_avd_stop, NULL },
 
-    { "start", "start/restart the virtual machine",
-    "'vm start' will start or continue the virtual machine, use 'vm stop' to stop it\r\n",
-    NULL, do_vm_start, NULL },
+    { "start", "start/restart the virtual device",
+    "'avd start' will start or continue the virtual device, use 'avd stop' to stop it\r\n",
+    NULL, do_avd_start, NULL },
 
-    { "status", "query virtual machine status",
-    "'vm status' will indicate wether the virtual machine is running or not\r\n",
-    NULL, do_vm_status, NULL },
+    { "status", "query virtual device status",
+    "'avd status' will indicate wether the virtual device is running or not\r\n",
+    NULL, do_avd_status, NULL },
 
-    { "name", "query virtual machine name",
-    "'vm name' will return the name of this virtual machine\r\n",
-    NULL, do_vm_name, NULL },
+    { "name", "query virtual device name",
+    "'avd name' will return the name of this virtual device\r\n",
+    NULL, do_avd_name, NULL },
 
     { NULL, NULL, NULL, NULL, NULL, NULL }
 };
@@ -2041,7 +2046,7 @@ do_geo_fix( ControlClient  client, char*  args )
 static const CommandDefRec  geo_commands[] =
 {
     { "nmea", "send an GPS NMEA sentence",
-    "'geo nema <sentence>' sends a NMEA 0183 sentence to the emulated machine, as\r\n"
+    "'geo nema <sentence>' sends a NMEA 0183 sentence to the emulated device, as\r\n"
     "if it came from an emulated GPS modem. <sentence> must begin with '$GP'. only\r\n"
     "'$GPGGA' and '$GPRCM' sentences are supported at the moment.\r\n",
     NULL, do_geo_nmea, NULL },
@@ -2164,8 +2169,8 @@ static const CommandDefRec   main_commands[] =
       "allows you to simulate an inbound SMS\r\n", NULL,
       NULL, sms_commands },
 
-    { "vm", "manager virtual machine state",
-    "allows to change (e.g. start/stop) the virtual machine state\r\n", NULL,
+    { "avd", "manager virtual device state",
+    "allows to change (e.g. start/stop) the virtual device state\r\n", NULL,
     NULL, vm_commands },
 
     { "window", "manage emulator window",
diff --git a/android/globals.h b/android/globals.h
index 625c84a..b26663d 100644
--- a/android/globals.h
+++ b/android/globals.h
@@ -12,22 +12,22 @@
 #ifndef _ANDROID_GLOBALS_H
 #define _ANDROID_GLOBALS_H
 
-#include "android/vm/info.h"
-#include "android/vm/hw-config.h"
+#include "android/avd/info.h"
+#include "android/avd/hw-config.h"
 
-/* this structure is setup when loading the virtual machine
+/* this structure is setup when loading the virtual device
  * after that, you can read the 'flags' field to determine
  * wether a data or cache wipe has been in effect.
  */
-extern AvmInfoParams     android_vmParams[1];
+extern AvdInfoParams     android_avdParams[1];
 
-/* a pointer to the android virtual machine information
+/* a pointer to the android virtual device information
  * object, which can be queried for the paths of various
  * image files or the skin
  */
-extern AvmInfo*          android_vmInfo;
+extern AvdInfo*          android_avdInfo;
 
-/* the hardware configuration for this specific virtual machine */
+/* the hardware configuration for this specific virtual device */
 extern AndroidHwConfig   android_hw[1];
 
 #endif /* _ANDROID_GLOBALS_H */
diff --git a/android_gps.c b/android/gps.c
index 219c178..be68cfc 100644
--- a/android_gps.c
+++ b/android/gps.c
@@ -9,8 +9,9 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android_gps.h"
-#include "android_debug.h"
+#include "android/gps.h"
+#include "android/utils/debug.h"
+#include "qemu-char.h"
 
 CharDriverState*   android_gps_cs;
 
@@ -30,7 +31,7 @@ android_gps_send_nmea( const char*  sentence )
     }
 
     qemu_chr_write( android_gps_cs, (const void*)sentence, strlen(sentence) );
-    qemu_chr_write( android_gps_cs, "\n", 1 );
+    qemu_chr_write( android_gps_cs, (const void*)"\n", 1 );
 }
 
 
diff --git a/android_gps.h b/android/gps.h
index d51d8f3..33ecece 100644
--- a/android_gps.h
+++ b/android/gps.h
@@ -12,7 +12,7 @@
 #ifndef _android_gps_h
 #define _android_gps_h
 
-#include "vl.h"
+#include "qemu-common.h"
 
 /* this is the internal character driver used to communicate with the
  * emulated GPS unit. see qemu_chr_open() in vl.c */
diff --git a/android_help.c b/android/help.c
index 87934de..cd1b827 100644
--- a/android_help.c
+++ b/android/help.c
@@ -1,44 +1,47 @@
-#include "android_help.h"
-#include "android_option.h"
-#include "skins/skin_keyset.h"
-#include "android.h"
+#include "android/help.h"
+#include "android/cmdline-option.h"
+#include "android/utils/path.h"
+#include "android/utils/bufprint.h"
+#include "android/utils/debug.h"
+#include "android/utils/misc.h"
+#include "android/skin/keyset.h"
+#include "android/android.h"
 #include <stdint.h>
 #include "audio/audio.h"
 #include <string.h>
 #include <stdlib.h>
-#include "vl.h"  /* for pstrcpy */
 
 /* XXX: TODO: put most of the help stuff in auto-generated files */
 
 #define  PRINTF(...)  stralloc_add_format(out,__VA_ARGS__)
 
 static void
-help_virtual_machine( stralloc_t*  out )
+help_virtual_device( stralloc_t*  out )
 {
     PRINTF(
-    "  An Android Virtual Machine (AVM) models a single virtual\n"
+    "  An Android Virtual Device (AVD) models a single virtual\n"
     "  device running the Android platform that has, at least, its own\n"
     "  kernel, system image and data partition.\n\n"
 
-    "  Only one emulator process can run a given AVM at a time, but\n"
-    "  you can create several AVMs and run them concurrently.\n\n"
+    "  Only one emulator process can run a given AVD at a time, but\n"
+    "  you can create several AVDs and run them concurrently.\n\n"
 
-    "  You can invoke a given AVM at startup using either '-vm <name>'\n"
+    "  You can invoke a given AVD at startup using either '-avd <name>'\n"
     "  or '@<name>', both forms being equivalent. For example, to launch\n"
-    "  the AVM named 'foo', type:\n\n"
+    "  the AVD named 'foo', type:\n\n"
 
     "      emulator @foo\n\n"
 
-    "  The 'android' helper tool can be used to manage virtual machines.\n"
+    "  The 'android' helper tool can be used to manage virtual devices.\n"
     "  For example:\n\n"
 
-    "    android vm    -- creates a new virtual machine.\n"
-    "    android list  -- list all virtual machines available.\n\n"
+    "    android avd   -- creates a new virtual device.\n"
+    "    android list  -- list all virtual devices available.\n\n"
 
-    "  Each AVM really corresponds to a content directory which stores\n"
+    "  Each AVD really corresponds to a content directory which stores\n"
     "  persistent and writable disk images as well as configuration files.\n"
 
-    "  Each AVM must be created against an existing SDK platform or add-on.\n"
+    "  Each AVD must be created against an existing SDK platform or add-on.\n"
     "  For more information on this topic, see -help-sdk-images.\n\n"
 
     "  SPECIAL NOTE: in the case where you are *not* using the emulator\n"
@@ -69,23 +72,23 @@ help_sdk_images( stralloc_t*  out )
     "  The purpose of add-ons is to allow vendors to provide their own customized\n"
     "  system images and APIs without needing to package a complete SDK.\n\n"
 
-    "  Before using the SDK, you need to create an Android Virtual Machine (AVM)\n"
-    "  (see -help-virtual-machine for details). Each AVM is created in reference\n"
+    "  Before using the SDK, you need to create an Android Virtual Device (AVD)\n"
+    "  (see -help-virtual-device for details). Each AVD is created in reference\n"
     "  to a given SDK platform *or* add-on, and will search the corresponding\n"
     "  directories for system image files, in the following order:\n\n" 
 
-    "    - in the AVM's content directory.\n"
-    "    - in the AVM's SDK add-on directory, if any.\n"
-    "    - in the AVM's SDK platform directory, if any.\n\n"
+    "    - in the AVD's content directory.\n"
+    "    - in the AVD's SDK add-on directory, if any.\n"
+    "    - in the AVD's SDK platform directory, if any.\n\n"
 
-    "  The image files are documented in -help-disk-images. By default, an AVM\n"
+    "  The image files are documented in -help-disk-images. By default, an AVD\n"
     "  content directory will contain the following persistent image files:\n\n"
 
     "     userdata-qemu.img     - the /data partition image file\n"
     "     cache.img             - the /cache partition image file\n\n"
 
     "  You can use -wipe-data to re-initialize the /data partition to its factory\n"
-    "  defaults. This will erase all user settings for the virtual machine.\n\n"
+    "  defaults. This will erase all user settings for the virtual device.\n\n"
     );
 }
 
@@ -160,7 +163,7 @@ help_disk_images( stralloc_t*  out )
     "    cache.img          an *optional* cache partition image\n"
     "    sdcard.img         an *optional* SD Card partition image\n\n"
 
-    "  If you use a virtual machine, its content directory should store\n"
+    "  If you use a virtual device, its content directory should store\n"
     "  all writable images, and read-only ones will be found from the\n"
     "  corresponding platform/add-on directories. See -help-sdk-images\n"
     "  for more details.\n\n"
@@ -240,11 +243,11 @@ static void
 help_environment(stralloc_t*  out)
 {
     PRINTF(
-    "  the Android emulator looks at various environment variables when it starts:\n\n"
+    "  The Android emulator looks at various environment variables when it starts:\n\n"
 
-    "  if ANDROID_LOG_TAGS is defined, it will be used as in '-logcat <tags>'\n\n"
+    "  If ANDROID_LOG_TAGS is defined, it will be used as in '-logcat <tags>'.\n\n"
 
-    "  if 'http_proxy' is defined, it will be used as in '-http-proxy <proxy>'\n\n"
+    "  If 'http_proxy' is defined, it will be used as in '-http-proxy <proxy>'.\n\n"
 
     "  If ANDROID_VERBOSE is defined, it can contain a comma-separated list of\n"
     "  verbose items. for example:\n\n"
@@ -252,7 +255,16 @@ help_environment(stralloc_t*  out)
     "      ANDROID_VERBOSE=socket,radio\n\n"
 
     "  is equivalent to using the '-verbose -verbose-socket -verbose-radio'\n"
-    "  options together. unsupported items will be ignored\n\n"
+    "  options together. unsupported items will be ignored.\n\n"
+
+    "  If ANDROID_LOG_TAGS is defined, it will be used as in '-logcat <tags>'.\n\n"
+
+    "  If ANDROID_SDK_HOME is defined, it indicates the path of the '.android'\n"
+    "  directory which contains the SDK user data (Android Virtual Devices,\n"
+    "  DDMS preferences, key stores, etc.).\n\n"
+
+    "  If ANDROID_SDK_ROOT is defined, it indicates the path of the SDK\n"
+    "  installation directory.\n\n"
 
     );
 }
@@ -430,17 +442,17 @@ help_char_devices(stralloc_t*  out)
 }
 
 static void
-help_vm(stralloc_t*  out)
+help_avd(stralloc_t*  out)
 {
     PRINTF(
-    "  use '-vm <name>' to start the emulator program with a given vm,\n"
+    "  use '-avd <name>' to start the emulator program with a given avd,\n"
     "  where <name> must correspond to the name of one of the\n"
-    "  Android virtual machines available on your host.\n\n"
+    "  Android Virtual Devices available on your host.\n\n"
 
     "  As a special convenience, using '@<name>' is equivalent to using\n"
-    "  '-vm <name>'.\n\n"
+    "  '-avd <name>'.\n\n"
 
-    "  For more information about virtual machines, see -help-virtual-machine.\n"
+    "  For more information about virtual devices, see -help-virtual-device.\n"
     );
 }
 
@@ -1272,7 +1284,7 @@ typedef struct {
 static const OptionHelp    option_help[] = {
 #define  OPT_FLAG(_name,_descr)             { STRINGIFY(_name), NULL, _descr, help_##_name },
 #define  OPT_PARAM(_name,_template,_descr)  { STRINGIFY(_name), _template, _descr, help_##_name },
-#include "android_options.h"
+#include "android/cmdline-options.h"
     { NULL, NULL, NULL, NULL }
 };
 
@@ -1290,7 +1302,7 @@ static const TopicHelp    topic_help[] = {
     { "char-devices", "character <device> specification", help_char_devices },
     { "environment",  "environment variables",  help_environment },
     { "keyset-file",  "key bindings configuration file", help_keyset_file },
-    { "virtual-machine", "virtual machine management", help_virtual_machine },
+    { "virtual-device", "virtual device management", help_virtual_device },
     { "sdk-images",   "about disk images when using the SDK", help_sdk_images },
     { "build-images", "about disk images when building Android", help_build_images },
     { NULL, NULL, NULL }
diff --git a/android_help.h b/android/help.h
index 30c907b..94feca1 100644
--- a/android_help.h
+++ b/android/help.h
@@ -12,7 +12,7 @@
 #ifndef _ANDROID_HELP_H
 #define _ANDROID_HELP_H
 
-#include "android_utils.h"
+#include "android/utils/stralloc.h"
 
 /* appends the list of options with a small description to a dynamic string */
 extern void  android_help_list_options( stralloc_t*  out );
diff --git a/android_hw_control.c b/android/hw-control.c
index ffd5509..681e85b 100644
--- a/android_hw_control.c
+++ b/android/hw-control.c
@@ -20,11 +20,14 @@
  *   - vibrator
  *   - flashlight
  */
-#include "android_hw_control.h"
+#include "android/hw-control.h"
 #include "cbuffer.h"
-#include "android_qemud.h"
-#include "android_utils.h"
+#include "android/qemud.h"
+#include "android/utils/misc.h"
+#include "android/utils/debug.h"
+#include "qemu-char.h"
 #include <stdio.h>
+#include <string.h>
 
 #define  D(...)  VERBOSE_PRINT(hw_control,__VA_ARGS__)
 
@@ -111,7 +114,7 @@ hw_control_read( void*  _hw, const uint8_t*  data, int  len )
                 return;
 
             cbuffer_read( input, header, 4 );
-            len = hex2int( header, 4 );
+            len = hex2int( (uint8_t*)header, 4 );
             if (len >= 0) {
                 /* if the message is too long, skip it */
                 if (len > input->size) {
@@ -131,14 +134,14 @@ hw_control_read( void*  _hw, const uint8_t*  data, int  len )
 
             cbuffer_read( input, h->query, h->wanted );
             h->query[h->wanted] = 0;
-            hw_control_do_query( h, h->query, h->wanted );
+            hw_control_do_query( h, (uint8_t*)h->query, h->wanted );
             h->wanted = 0;
         }
     }
 }
 
 
-static char*
+static uint8_t*
 if_starts_with( uint8_t*  buf, int buflen, const char*  prefix )
 {
     int  prefixlen = strlen(prefix);
@@ -146,7 +149,7 @@ if_starts_with( uint8_t*  buf, int buflen, const char*  prefix )
     if (buflen < prefixlen || memcmp(buf, prefix, prefixlen))
         return NULL;
 
-    return (char*)buf + prefixlen;
+    return (uint8_t*)buf + prefixlen;
 }
 
 
@@ -162,7 +165,7 @@ hw_control_do_query( HwControl*  h,
     q = if_starts_with( query, querylen, "power:light:brightness:" );
     if (q != NULL) {
         if (hw_control_funcs.light_brightness) {
-            char*  qq = strchr(q, ':');
+            char*  qq = strchr((const char*)q, ':');
             int    value;
             if (qq == NULL) {
                 D("%s: badly formatted", __FUNCTION__ );
@@ -170,7 +173,7 @@ hw_control_do_query( HwControl*  h,
             }
             *qq++ = 0;
             value = atoi(qq);
-            hw_control_funcs.light_brightness( hw_control_client, q, value );
+            hw_control_funcs.light_brightness( hw_control_client, (char*)q, value );
         }
         return;
     }
@@ -192,7 +195,7 @@ android_hw_control_init( void*  opaque, const AndroidHwControlFuncs*  funcs )
 
         hw_control_cs = cs;
         hw_control_init( hwstate, cs );
-        qemu_chr_add_read_handler( cs, hw_control_can_read, hw_control_read, hwstate );
+        qemu_chr_add_handlers( cs, hw_control_can_read, hw_control_read, NULL, hwstate );
 
         D("%s: hw-control char pipe initialized", __FUNCTION__);
     }
diff --git a/android_hw_control.h b/android/hw-control.h
index 9933819..6e9874e 100644
--- a/android_hw_control.h
+++ b/android/hw-control.h
@@ -12,7 +12,7 @@
 #ifndef _android_hw_control_h
 #define _android_hw_control_h
 
-#include "vl.h"
+#include "qemu-common.h"
 
 /* a callback function called when the system wants to change the brightness
  * of a given light. 'light' is a string which can be one of:
diff --git a/android_events.c b/android/hw-events.c
index b69e0fe..e72440c 100644
--- a/android_events.c
+++ b/android/hw-events.c
@@ -9,7 +9,8 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android_events.h"
+#include "android/hw-events.h"
+#include "android/utils/bufprint.h"
 #include <stdlib.h>
 #include <string.h>
 
diff --git a/android_events.h b/android/hw-events.h
index b3d69b6..74100b8 100644
--- a/android_events.h
+++ b/android/hw-events.h
@@ -9,10 +9,10 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#ifndef _ANDROID_EVENTS_H
-#define _ANDROID_EVENTS_H
+#ifndef _ANDROID_HW_EVENTS_H
+#define _ANDROID_HW_EVENTS_H
 
-#include "android_utils.h"
+#include "android/utils/system.h"
 
 /* from the Linux kernel */
 
@@ -181,4 +181,4 @@ extern char*  android_event_bufprint_type_str( char*  buff, char*  end, int  typ
 extern int    android_event_get_code_count( int  type );
 extern char*  android_event_bufprint_code_str( char*  buff, char*  end, int  type, int  code_index );
 
-#endif /* _ANDROID_EVENTS_H */
+#endif /* _ANDROID_HW_EVENTS_H */
diff --git a/android_kmsg.c b/android/hw-kmsg.c
index f6261b3..987943b 100644
--- a/android_kmsg.c
+++ b/android/hw-kmsg.c
@@ -9,9 +9,10 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android_kmsg.h"
+#include "android/hw-kmsg.h"
+#include "qemu-char.h"
 #include "charpipe.h"
-#include "android_debug.h"
+#include "android/utils/debug.h"
 
 static CharDriverState*  android_kmsg_cs;
 
@@ -45,7 +46,7 @@ kernel_log_init( KernelLog*  k, AndroidKmsgFlags  flags )
         exit(1);
     }
 
-    qemu_chr_add_read_handler( k->cs, kernel_log_can_read, kernel_log_read, k );
+    qemu_chr_add_handlers( k->cs, kernel_log_can_read, kernel_log_read, NULL, k );
 
     k->flags = flags;
 }
diff --git a/android_kmsg.h b/android/hw-kmsg.h
index 4419282..51d6731 100644
--- a/android_kmsg.h
+++ b/android/hw-kmsg.h
@@ -12,7 +12,7 @@
 #ifndef _android_kmsg_h
 #define _android_kmsg_h
 
-#include "vl.h"
+#include "qemu-common.h"
 
 /* this chardriver is used to read the kernel messages coming
  * from the first serial port (i.e. /dev/ttyS0) and store them
diff --git a/android_icons.h b/android/icons.h
index e4ec861..e4ec861 100644
--- a/android_icons.h
+++ b/android/icons.h
diff --git a/android_main.c b/android/main.c
index f8daef6..e1d983c 100644
--- a/android_main.c
+++ b/android/main.c
@@ -20,40 +20,45 @@
 #include "libslirp.h"
 #include "sockets.h"
 
-#include "android.h"
-#include "vl.h"
+#include "android/android.h"
+#include "qemu-common.h"
+#include "sysemu.h"
+#include "console.h"
 
 #include <SDL.h>
 #include <SDL_syswm.h>
 
 #include "math.h"
 
-#include "android.h"
-#include "android_charmap.h"
+#include "android/charmap.h"
 #include "modem_driver.h"
 #include "shaper.h"
 #include "proxy_http.h"
 
-#include "android_utils.h"
-#include "android_resource.h"
-#include "android_config.h"
-
-#include "skin_image.h"
-#include "skin_trackball.h"
-#include "skin_keyboard.h"
-#include "skin_file.h"
-#include "skin_window.h"
-#include "skin_keyset.h"
-
-#include "android_timezone.h"
-#include "android_gps.h"
-#include "android_qemud.h"
-#include "android_kmsg.h"
-#include "android_hw_control.h"
+#include "android/utils/debug.h"
+#include "android/resource.h"
+#include "android/config.h"
+#include "android/config/config.h"
+
+#include "android/skin/image.h"
+#include "android/skin/trackball.h"
+#include "android/skin/keyboard.h"
+#include "android/skin/file.h"
+#include "android/skin/window.h"
+#include "android/skin/keyset.h"
+
+#include "android/gps.h"
+#include "android/qemud.h"
+#include "android/hw-kmsg.h"
+#include "android/hw-control.h"
+#include "android/utils/bufprint.h"
 #include "android/utils/dirscanner.h"
+#include "android/utils/path.h"
+#include "android/utils/timezone.h"
+#include "android/utils/display.h"
 
-#include "android_option.h"
-#include "android_help.h"
+#include "android/cmdline-option.h"
+#include "android/help.h"
 #include "hw/goldfish_nand.h"
 
 #include "android/globals.h"
@@ -147,7 +152,7 @@ emulator_config_init( void )
         return;
     }
 
-    config = load_text_file( emulator_configpath );
+    config = path_load_file( emulator_configpath, NULL );
     if (config == NULL)
         D( "cannot load emulator configuration at '%s'\n",
            emulator_configpath );
@@ -578,7 +583,7 @@ qemulator_set_title( QEmulator*  emulator )
         return;
 
     snprintf( temp, sizeof(temp), "Android Emulator (%s:%d)",
-              avmInfo_getName( android_vmInfo ),
+              avdInfo_getName( android_avdInfo ),
               android_base_port );
 
     skin_window_set_title( emulator->window, temp );
@@ -675,7 +680,7 @@ qemulator_setup( QEmulator*  emulator )
 /* called by the emulated framebuffer device each time the framebuffer
  * is resized or rotated */
 static void
-sdl_resize(DisplayState *ds, int w, int h, int rotation)
+sdl_resize(DisplayState *ds, int w, int h)
 {
     fprintf(stderr, "weird, sdl_resize being called with framebuffer interface\n");
     exit(1);
@@ -800,7 +805,9 @@ handle_key_command( void*  opaque, SkinKeyCommand  command, int  down )
         { SKIN_KEY_COMMAND_NONE, 0 }
     };
     int          nn;
+#ifdef CONFIG_TRACE
     static int   tracing = 0;
+#endif
     QEmulator*   emulator = opaque;
 
 
@@ -943,7 +950,7 @@ static void sdl_at_exit(void)
 }
 
 
-void sdl_display_init(DisplayState *ds, int full_screen)
+void sdl_display_init(DisplayState *ds, int full_screen, int  no_frame)
 {
     QEmulator*    emulator = qemulator;
     SkinDisplay*  disp     = skin_layout_get_display(emulator->layout);
@@ -1770,7 +1777,7 @@ _getSdkSystemImage( const char*  path, const char*  optionName, const char*  fil
 }
 
 static void
-_forceVmImagePath( AvmImageType  imageType, 
+_forceAvdImagePath( AvdImageType  imageType, 
                    const char*   path, 
                    const char*   description,
                    int           required )
@@ -1782,7 +1789,7 @@ _forceVmImagePath( AvmImageType  imageType,
         derror("Cannot find %s image file: %s", description, path);
         exit(1);
     }
-    android_vmParams->forcePaths[imageType] = path;
+    android_avdParams->forcePaths[imageType] = path;
 }
 
 #ifdef _WIN32
@@ -1862,7 +1869,7 @@ int main(int argc, char **argv)
         }
 
         fprintf(stderr, "invalid command-line parameter: %s.\n", opt);
-        fprintf(stderr, "Hint: use '@foo' to launch a virtual machine named 'foo'.\n");
+        fprintf(stderr, "Hint: use '@foo' to launch a virtual device named 'foo'.\n");
         fprintf(stderr, "please use -help for more information\n");
         exit(1);
     }
@@ -1895,40 +1902,41 @@ int main(int argc, char **argv)
         }
     }
 
-    /* try to find the top of the Android build tree
-     * unless we have been given a virtual machine name
+    /* If no AVD name was given, try to find the top of the
+     * Android build tree
      */
-    do {
-        char*  out = getenv("ANDROID_PRODUCT_OUT");
-
-        if (out == NULL || out[0] == 0)
-            break;
+    if (opts->avd == NULL) {
+        do {
+            char*  out = getenv("ANDROID_PRODUCT_OUT");
 
-        if (!path_exists(out)) {
-            derror("Can't access ANDROID_PRODUCT_OUT as '%s\n"
-                   "You need to build the Android system before launching the emulator",
-                   out);
-            exit(2);
-        }
+            if (out == NULL || out[0] == 0)
+                break;
 
-        android_build_root = path_parent( out, 4 );
-        if (android_build_root == NULL || !path_exists(android_build_root)) {
-            derror("Can't find the Android build root from '%s'\n"
-                   "Please check the definition of the ANDROID_PRODUCT_OUT variable.\n"
-                   "It should point to your product-specific build output directory.\n",
-                   out );
-            exit(2);
-        }
-        android_build_out = out;
-        D( "found Android build root: %s", android_build_root );
-        D( "found Android build out:  %s", android_build_out );
-    } while (0);
+            if (!path_exists(out)) {
+                derror("Can't access ANDROID_PRODUCT_OUT as '%s\n"
+                    "You need to build the Android system before launching the emulator",
+                    out);
+                exit(2);
+            }
 
-    /* if no virtual machine name is given, and we're not in the
+            android_build_root = path_parent( out, 4 );
+            if (android_build_root == NULL || !path_exists(android_build_root)) {
+                derror("Can't find the Android build root from '%s'\n"
+                    "Please check the definition of the ANDROID_PRODUCT_OUT variable.\n"
+                    "It should point to your product-specific build output directory.\n",
+                    out );
+                exit(2);
+            }
+            android_build_out = out;
+            D( "found Android build root: %s", android_build_root );
+            D( "found Android build out:  %s", android_build_out );
+        } while (0);
+    }
+    /* if no virtual device name is given, and we're not in the
      * Android build system, we'll need to perform some auto-detection
      * magic :-)
      */
-    if (opts->vm == NULL && !android_build_out) 
+    if (opts->avd == NULL && !android_build_out) 
     {
         char   dataDirIsSystem = 0;
 
@@ -1936,10 +1944,10 @@ int main(int argc, char **argv)
             opts->system = _getSdkImagePath("system.img");
             if (!opts->system) {
                 derror(
-                "You did not specify a virtual machine name, and the system\n"
+                "You did not specify a virtual device name, and the system\n"
                 "directory could not be found.\n\n"
-                "If you are an Android SDK user, please use '@<name>' or '-vm <name>'\n"
-                "to start a given virtual machine (see -help-vm for details).\n\n"
+                "If you are an Android SDK user, please use '@<name>' or '-avd <name>'\n"
+                "to start a given virtual device (see -help-avd for details).\n\n"
 
                 "Otherwise, follow the instructions in -help-disk-images to start the emulator\n"
                 );
@@ -1995,24 +2003,24 @@ int main(int argc, char **argv)
         }
     }
 
-    /* setup the virtual machine parameters from our options
+    /* setup the virtual device parameters from our options
      */
     if (opts->nocache) {
-        android_vmParams->flags |= AVMINFO_NO_CACHE;
+        android_avdParams->flags |= AVDINFO_NO_CACHE;
     }
     if (opts->wipe_data) {
-        android_vmParams->flags |= AVMINFO_WIPE_DATA | AVMINFO_WIPE_CACHE;
+        android_avdParams->flags |= AVDINFO_WIPE_DATA | AVDINFO_WIPE_CACHE;
     }
 
     /* if certain options are set, we can force the path of
         * certain kernel/disk image files
         */
-    _forceVmImagePath(AVM_IMAGE_KERNEL,  opts->kernel, "kernel", 1);
-    _forceVmImagePath(AVM_IMAGE_SYSTEM,  opts->image,  "system", 1);
-    _forceVmImagePath(AVM_IMAGE_RAMDISK, opts->ramdisk,"ramdisk", 1);
-    _forceVmImagePath(AVM_IMAGE_USERDATA,opts->data,   "user data", 0);
-    _forceVmImagePath(AVM_IMAGE_CACHE,   opts->cache,  "cache", 0);
-    _forceVmImagePath(AVM_IMAGE_SDCARD,  opts->sdcard, "SD Card", 0);
+    _forceAvdImagePath(AVD_IMAGE_KERNEL,  opts->kernel, "kernel", 1);
+    _forceAvdImagePath(AVD_IMAGE_SYSTEM,  opts->image,  "system", 1);
+    _forceAvdImagePath(AVD_IMAGE_RAMDISK, opts->ramdisk,"ramdisk", 1);
+    _forceAvdImagePath(AVD_IMAGE_USERDATA,opts->data,   "user data", 0);
+    _forceAvdImagePath(AVD_IMAGE_CACHE,   opts->cache,  "cache", 0);
+    _forceAvdImagePath(AVD_IMAGE_SDCARD,  opts->sdcard, "SD Card", 0);
 
     /* we don't accept -skindir without -skin now
      * to simplify the autoconfig stuff with virtual devices
@@ -2041,17 +2049,17 @@ int main(int argc, char **argv)
             }
             D("autoconfig: -skin %s", opts->skin);
         }
-        android_vmParams->skinName = opts->skin;
+        android_avdParams->skinName = opts->skin;
     }
-    /* setup the virtual machine differently depending on whether
+    /* setup the virtual device differently depending on whether
      * we are in the Android build system or not
      */
-    if (opts->vm != NULL)
+    if (opts->avd != NULL)
     {
-        android_vmInfo = avmInfo_new( opts->vm, android_vmParams );
-        if (android_vmInfo == NULL) {
+        android_avdInfo = avdInfo_new( opts->avd, android_avdParams );
+        if (android_avdInfo == NULL) {
             /* an error message has already been printed */
-            D("could not find virtual machine named '%s'", opts->vm);
+            dprint("could not find virtual device named '%s'", opts->avd);
             exit(1);
         }
     }
@@ -2060,21 +2068,21 @@ int main(int argc, char **argv)
         if (!android_build_out) {
             android_build_out = android_build_root = opts->system;
         }
-        android_vmInfo = avmInfo_newForAndroidBuild(
+        android_avdInfo = avdInfo_newForAndroidBuild(
                             android_build_root,
                             android_build_out,
-                            android_vmParams );
+                            android_avdParams );
 
-        if(android_vmInfo == NULL) {
-            D("could not start virtual machine\n");
+        if(android_avdInfo == NULL) {
+            D("could not start virtual device\n");
             exit(1);
         }
     }
 
     if (!opts->skindir) {
-        /* get the skin from the virtual machine configuration */
-        opts->skin    = (char*) avmInfo_getSkinName( android_vmInfo );
-        opts->skindir = (char*) avmInfo_getSkinDir( android_vmInfo );
+        /* get the skin from the virtual device configuration */
+        opts->skin    = (char*) avdInfo_getSkinName( android_avdInfo );
+        opts->skindir = (char*) avdInfo_getSkinDir( android_avdInfo );
 
         if (opts->skin) {
             D("autoconfig: -skin %s", opts->skin);
@@ -2086,7 +2094,7 @@ int main(int argc, char **argv)
 
     /* Read hardware configuration */
     hw = android_hw;
-    if (avmInfo_getHwConfig(android_vmInfo, hw) < 0) {
+    if (avdInfo_getHwConfig(android_avdInfo, hw) < 0) {
         derror("could not read hardware configuration ?");
         exit(1);
     }
@@ -2106,14 +2114,17 @@ int main(int argc, char **argv)
         }
     }
     if (!android_keyset) {
-        android_keyset = skin_keyset_new_from_text( skin_keyset_get_default() );
+        parse_keyset("default", opts);
         if (!android_keyset) {
-            fprintf(stderr, "PANIC: default keyset file is corrupted !!\n" );
-            fprintf(stderr, "PANIC: please update the code in skins/skin_keyset.c\n" );
-            exit(1);
+            android_keyset = skin_keyset_new_from_text( skin_keyset_get_default() );
+            if (!android_keyset) {
+                fprintf(stderr, "PANIC: default keyset file is corrupted !!\n" );
+                fprintf(stderr, "PANIC: please update the code in android/skin/keyset.c\n" );
+                exit(1);
+            }
+            if (!opts->keyset)
+                write_default_keyset();
         }
-        if (!opts->keyset)
-            write_default_keyset();
     }
 
     if (opts->audio) {
@@ -2210,7 +2221,7 @@ int main(int argc, char **argv)
     }
 
     if (opts->trace) {
-        char*   tracePath = avmInfo_getTracePath(android_vmInfo, opts->trace);
+        char*   tracePath = avdInfo_getTracePath(android_avdInfo, opts->trace);
         int     ret;
 
         if (tracePath == NULL) {
@@ -2272,20 +2283,20 @@ int main(int argc, char **argv)
     n = 1;
     /* generate arguments for the underlying qemu main() */
     args[n++] = "-kernel";
-    args[n++] = (char*) avmInfo_getImageFile(android_vmInfo, AVM_IMAGE_KERNEL);
+    args[n++] = (char*) avdInfo_getImageFile(android_avdInfo, AVD_IMAGE_KERNEL);
 
     args[n++] = "-initrd";
-    args[n++] = (char*) avmInfo_getImageFile(android_vmInfo, AVM_IMAGE_RAMDISK);
+    args[n++] = (char*) avdInfo_getImageFile(android_avdInfo, AVD_IMAGE_RAMDISK);
 
     {
         const char*  filetype = "file";
 
-        if (avmInfo_isImageReadOnly(android_vmInfo, AVM_IMAGE_SYSTEM))
+        if (avdInfo_isImageReadOnly(android_avdInfo, AVD_IMAGE_SYSTEM))
             filetype = "initfile";
 
         bufprint(tmp, tmpend,
              "system,size=0x4200000,%s=%s", filetype,
-             avmInfo_getImageFile(android_vmInfo, AVM_IMAGE_SYSTEM));
+             avdInfo_getImageFile(android_avdInfo, AVD_IMAGE_SYSTEM));
 
         args[n++] = "-nand";
         args[n++] = strdup(tmp);
@@ -2293,13 +2304,13 @@ int main(int argc, char **argv)
 
     bufprint(tmp, tmpend,
              "userdata,size=0x4200000,file=%s",
-             avmInfo_getImageFile(android_vmInfo, AVM_IMAGE_USERDATA));
+             avdInfo_getImageFile(android_avdInfo, AVD_IMAGE_USERDATA));
 
     args[n++] = "-nand";
     args[n++] = strdup(tmp);
 
     if (hw->disk_cachePartition) {
-        opts->cache = (char*) avmInfo_getImageFile(android_vmInfo, AVM_IMAGE_CACHE);
+        opts->cache = (char*) avdInfo_getImageFile(android_avdInfo, AVD_IMAGE_CACHE);
         cachePartitionSize = hw->disk_cachePartition_size;
     }
     else if (opts->cache) {
@@ -2322,7 +2333,7 @@ int main(int argc, char **argv)
     }
 
     if (hw->hw_sdCard != 0)
-        opts->sdcard = (char*) avmInfo_getImageFile(android_vmInfo, AVM_IMAGE_SDCARD);
+        opts->sdcard = (char*) avdInfo_getImageFile(android_avdInfo, AVD_IMAGE_SDCARD);
     else if (opts->sdcard) {
         dwarning( "Emulated hardware doesn't support SD Cards" );
         opts->sdcard = NULL;
@@ -2371,8 +2382,13 @@ int main(int argc, char **argv)
     }
 
     /* XXXX: TODO: implement -shell and -logcat through qemud instead */
-    if (!opts->shell_serial)
+    if (!opts->shell_serial) {
+#ifdef _WIN32
+        opts->shell_serial = "con:";
+#else
         opts->shell_serial = "stdio";
+#endif
+    }
     else
         opts->shell = 1;
 
@@ -2563,6 +2579,15 @@ int main(int argc, char **argv)
     args[n++] = "-m";
     args[n++] = opts->memory;
 
+    /* on Linux, the 'dynticks' clock sometimes doesn't work
+     * properly. this results in the UI freezing while emulation
+     * continues, for several seconds...
+     */
+#ifdef __linux__
+    args[n++] = "-clock";
+    args[n++] = "unix";
+#endif
+
     while(argc-- > 0) {
         args[n++] = *argv++;
     }
diff --git a/android_qemud.c b/android/qemud.c
index 96d2eb4..b127fc9 100644
--- a/android_qemud.c
+++ b/android/qemud.c
@@ -9,11 +9,12 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android_qemud.h"
-#include "android_debug.h"
+#include "android/qemud.h"
+#include "android/utils/debug.h"
+#include "android/utils/misc.h"
+#include "qemu-char.h"
 #include "charpipe.h"
 #include "cbuffer.h"
-#include "android_utils.h"
 
 #define  D(...)    VERBOSE_PRINT(qemud,__VA_ARGS__)
 #define  D_ACTIVE  VERBOSE_CHECK(qemud)
@@ -134,10 +135,11 @@ static void
 channel_set_peer( Channel*  c, int  index, EnqueueFunc  enq_func, void*  enq_user )
 {
     c->index = index;
-    qemu_chr_add_read_handler( c->cs,
-                               channel_can_read,
-                               channel_read,
-                               c );
+    qemu_chr_add_handlers( c->cs,
+                           channel_can_read,
+                           channel_read,
+                           NULL,
+                           c );
     c->enq_func = enq_func;
     c->enq_user = enq_user;
 }
@@ -373,8 +375,8 @@ android_qemud_init( void )
         exit(1);
     }
 
-    qemu_chr_add_read_handler( m->cs, multiplexer_can_read,
-                               multiplexer_read, m );
+    qemu_chr_add_handlers( m->cs, multiplexer_can_read,
+                           multiplexer_read, NULL, m );
 }
 
 
diff --git a/android_qemud.h b/android/qemud.h
index dfd6ba1..4fa71d0 100644
--- a/android_qemud.h
+++ b/android/qemud.h
@@ -12,7 +12,7 @@
 #ifndef _android_qemud_h
 #define _android_qemud_h
 
-#include "vl.h"
+#include "qemu-common.h"
 
 /* recent versions of the emulated Android system contains a background
  * daemon, named 'qemud', which runs as root and opens /dev/ttyS0
diff --git a/android_resource.c b/android/resource.c
index 083a000..1327ea0 100644
--- a/android_resource.c
+++ b/android/resource.c
@@ -9,7 +9,7 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android_resource.h"
+#include "android/resource.h"
 #include "config-host.h"
 #include <string.h>
 
@@ -42,7 +42,7 @@ const unsigned char*
 android_resource_find( const char*  name,
                        size_t      *psize )
 {
-#    include "skin_default.h"
+#    include "android/skin/default.h"
     return _resource_find( name, _file_entries, psize );
 }
 
@@ -56,7 +56,7 @@ android_icon_find( const char*  name,
 #ifdef _WIN32
     return NULL;
 #else
-#   include "android_icons.h"
+#   include "android/icons.h"
     return _resource_find( name, _file_entries, psize );
 #endif
 }
diff --git a/android_resource.h b/android/resource.h
index 00453af..00453af 100644
--- a/android_resource.h
+++ b/android/resource.h
diff --git a/skins/skin_argb.h b/android/skin/argb.h
index b3f0a6d..b3f0a6d 100644
--- a/skins/skin_argb.h
+++ b/android/skin/argb.h
diff --git a/skins/skin_composer.c b/android/skin/composer.c
index 87cf20f..6076449 100644
--- a/skins/skin_composer.c
+++ b/android/skin/composer.c
@@ -9,9 +9,9 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skin_composer.h"
+#include "android/skin/composer.h"
 #include <stddef.h>
-#include "osdep.h"
+#include "android/utils/system.h"
 
 /* forwards */
 static void  skin_plate_get_region       ( SkinPlate*  p, SkinRegion  *pregion );
@@ -24,13 +24,13 @@ skin_plate_ensure_region( SkinPlate*  p )
     if (p->any.type == SKIN_PLATE_SURFACE || p->group.hasRegion)
         return;
     else {
-        int  n, count = qvector_len( p->group.children );
+        int  n, count = areflist_count( p->group.children );
 
         skin_region_reset(p->any.region);
 
         for (n = 0; n < count; n++) {
             SkinRegion  r[1];
-            SkinPlate*  child = qvector_get( p->group.children, n );
+            SkinPlate*  child = areflist_get( p->group.children, n );
 
             skin_plate_get_region( child, r );
             skin_region_translate( r, child->any.pos.x, child->any.pos.y );
@@ -57,13 +57,13 @@ static void
 skin_plate_ensure_opaque_region( SkinPlate*  p )
 {
     if (p->any.type != SKIN_PLATE_SURFACE && !p->group.hasOpaqueRegion) {
-        int  n, count = qvector_len( p->group.children );
+        int  n, count = areflist_count( p->group.children );
 
         skin_region_reset(p->group.opaqueRegion);
 
         for (n = 0; n < count; n++) {
             SkinRegion  r[1];
-            SkinPlate*  child = qvector_get( p->group.children, n );
+            SkinPlate*  child = areflist_get( p->group.children, n );
 
             skin_plate_get_opaque_region(child, r);
             skin_region_translate(r, child->any.pos.x, child->any.pos.y);
@@ -112,13 +112,13 @@ static void
 skin_plate_invalidate_( SkinPlate*  p, SkinRegion*  r, SkinPlate*  child )
 {
     if (p->any.type != SKIN_PLATE_SURFACE) {
-        int  n = qvector_len( p->group.children );
+        int  n = areflist_count( p->group.children );
         if (child != NULL) {
-            n = qvector_index( p->group.children, child );
+            n = areflist_indexOf( p->group.children, child );
         }
         while (n > 0) {
             n -= 1;
-            child = qvector_get( p->group.children, n );
+            child = areflist_get( p->group.children, n );
             skin_region_translate( r, child->any.pos.x, child->any.pos.y );
             skin_plate_invalidate_( p, r, NULL );
             skin_region_translate( r, -child->any.pos.x, -child->any.pos.y );
@@ -131,9 +131,9 @@ skin_plate_invalidate_( SkinPlate*  p, SkinRegion*  r, SkinPlate*  child )
             skin_plate_invalidate_(parent, r, p);
         } else {
             /* send to viewports */
-            int  n, count = qvector_len( p->space.viewports );
+            int  n, count = areflist_count( p->space.viewports );
             for (n = 0; n < count; n++) {
-                SkinViewport*  v = qvector_get( p->space.viewports, n );
+                SkinViewport*  v = areflist_get( p->space.viewports, n );
                 skin_viewport_invalidate(v, r);
             }
         }
@@ -185,8 +185,9 @@ skin_plate_surface( SkinPlate*         parent,
                     SkinPlateDrawFunc  draw,
                     SkinPlateDoneFunc  done )
 {
-    SkinPlate*  p = qemu_mallocz(sizeof(*p));
+    SkinPlate*  p;
 
+    ANEW0(p);
     p->any.type      = SKIN_PLATE_SURFACE;
     p->any.parent    = parent;
     p->any.pos.x     = pos->x;
@@ -211,7 +212,7 @@ skin_plate_group( SkinPlate*  parent, SkinPos*  pos )
     p->group.hasOpaqueRegion = 0;
     skin_region_init_empty( p->group.opaqueRegion );
 
-    qvector_init( p->group.children );
+    areflist_init( p->group.children );
     return p;
 }
 
@@ -225,7 +226,7 @@ skin_plate_space( void )
     pos.x       = pos.y = 0;
     p           = skin_plate_group( NULL, &pos );
     p->any.type = SKIN_PLATE_SPACE;
-    qvector_init( p->space.viewports );
+    areflist_init( p->space.viewports );
     return p;
 }
 
@@ -234,16 +235,16 @@ extern void
 skin_plate_free( SkinPlate*  p )
 {
     if (p->any.type >= SKIN_PLATE_SPACE) {
-        while ( qvector_len( p->space.viewports ) )
-            skin_viewport_free( qvector_get( p->space.viewports, 0 ) );
+        while ( areflist_count( p->space.viewports ) )
+            skin_viewport_free( areflist_get( p->space.viewports, 0 ) );
     }
     if (p->any.type >= SKIN_PLATE_GROUP) {
         skin_region_reset( p->group.opaqueRegion );
         p->group.hasOpaqueRegion = 0;
         p->group.hasRegion       = 0;
 
-        while ( qvector_len( p->group.children ) )
-            skin_plate_free( qvector_get( p->group.children, 0 ) );
+        while ( areflist_count( p->group.children ) )
+            skin_plate_free( areflist_get( p->group.children, 0 ) );
     }
     if (p->any.type == SKIN_PLATE_SURFACE) {
         if (p->surface.done)
@@ -253,7 +254,7 @@ skin_plate_free( SkinPlate*  p )
     skin_region_reset( p->any.region );
 
     if (p->any.parent) {
-        qvector_del( p->any.parent->group.children, p );
+        areflist_del( p->any.parent->group.children, p );
     }
 }
 
@@ -319,14 +320,14 @@ skin_plate_redraw( SkinPlate*  plate, SkinRegion*  updated, SkinRegion*  drawn,
         }
 
     } else {
-        int  n, count = qvector_len(plate->group.children);
+        int  n, count = areflist_count(plate->group.children);
         for (n = 0; n < count; n++) {
             SkinPos  pos;
 
             pos.x = apos->x + plate->any.pos.x;
             pos.y = apos->y + plate->any.pos.y;
 
-            skin_plate_redraw( qvector_get(plate->group.children, n ), updated, drawn, &pos, viewport );
+            skin_plate_redraw( areflist_get(plate->group.children, n ), updated, drawn, &pos, viewport );
             if (skin_region_is_empty(updated) && skin_region_is_empty(drawn))
                 break;
         }
@@ -343,7 +344,9 @@ skin_plate_redraw( SkinPlate*  plate, SkinRegion*  updated, SkinRegion*  drawn,
 extern SkinViewport*
 skin_viewport( SkinPlate*  space, SkinRect*  rect, void*  surface, int  sx, int  sy )
 {
-    SkinViewport*  v = qemu_mallocz(sizeof(*v));
+    SkinViewport*  v;
+
+    ANEW0(v);
     v->space   = space;
     v->rect    = rect[0];
     v->spos.x  = sx;
@@ -359,11 +362,11 @@ skin_viewport_free( SkinViewport*  v )
 {
     SkinPlate*  space = v->space;
     if (space != NULL) {
-        qvector_del( space->space.viewports, v );
+        areflist_del( space->space.viewports, v );
         v->space = NULL;
     }
     skin_region_reset( v->update );
-    qemu_free(v);
+    AFREE(v);
 }
 
 extern void
diff --git a/skins/skin_composer.h b/android/skin/composer.h
index d13339b..a52a972 100644
--- a/skins/skin_composer.h
+++ b/android/skin/composer.h
@@ -12,9 +12,9 @@
 #ifndef _ANDROID_SKIN_COMPOSER_H
 #define _ANDROID_SKIN_COMPOSER_H
 
-#include "skin_rect.h"
-#include "skin_region.h"
-#include "android_utils.h"
+#include "android/skin/rect.h"
+#include "android/skin/region.h"
+#include "android/utils/reflist.h"
 
 /* the composer displays stacked surfaces on a target window/SDL_Surface */
 
@@ -52,12 +52,12 @@ struct SkinPlateGroup {
     char                  hasRegion;
     char                  hasOpaqueRegion;
     SkinRegion            opaqueRegion[1];
-    qvector_t             children[1];
+    ARefList              children[1];
 };
 
 struct SkinPlateSpace {
     struct SkinPlateGroup   group;
-    qvector_t               viewports[1];
+    ARefList                viewports[1];
 };
 
 
diff --git a/skins/skin_default.h b/android/skin/default.h
index 8ab0c01..8ab0c01 100644
--- a/skins/skin_default.h
+++ b/android/skin/default.h
diff --git a/skins/skin_file.c b/android/skin/file.c
index 4856b76..b0cb9cf 100644
--- a/skins/skin_file.c
+++ b/android/skin/file.c
@@ -9,10 +9,14 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skin_file.h"
-#include "android_utils.h"
-#include "android_charmap.h"
-#include "osdep.h"
+#include "android/skin/file.h"
+#include "android/utils/path.h"
+#include "android/charmap.h"
+#include "android/utils/bufprint.h"
+#include "android/utils/system.h"
+#include "android/utils/debug.h"
+
+//#include "qemu-common.h"
 
 /** UTILITY ROUTINES
  **/
@@ -200,14 +204,15 @@ skin_button_free( SkinButton*  button )
 {
     if (button) {
         skin_image_unref( &button->image );
-        qemu_free(button);
+        AFREE(button);
     }
 }
 
 static SkinButton*
 skin_button_create_from( AConfig*   node, const char*  basepath )
 {
-    SkinButton*  button = qemu_mallocz(sizeof(*button));
+    SkinButton*  button;
+    ANEW0(button);
     if (button) {
         const char*  img = aconfig_str(node, "image", NULL);
         int          x   = aconfig_int(node, "x", 0);
@@ -250,7 +255,7 @@ skin_part_free( SkinPart*  part )
             skin_button_free(button);
         SKIN_PART_LOOP_END
         part->buttons = NULL;
-        qemu_free(part);
+        AFREE(part);
     }
 }
 
@@ -278,116 +283,112 @@ skin_location_create_from_v2( AConfig*  node, SkinPart*  parts )
         return NULL;
     }
 
-    location = qemu_mallocz(sizeof(*location));
-    if (location != NULL) {
-        location->part     = part;
-        location->anchor.x = x;
-        location->anchor.y = y;
-        location->rotation = rot;
-    }
+    ANEW0(location);
+    location->part     = part;
+    location->anchor.x = x;
+    location->anchor.y = y;
+    location->rotation = rot;
+
     return location;
 }
 
 static SkinPart*
 skin_part_create_from_v1( AConfig*  root, const char*  basepath )
 {
-    SkinPart*  part = qemu_mallocz(sizeof(*part));
-
-    if (part != NULL) {
-        AConfig*  node;
-        SkinBox   box;
+    SkinPart*  part;
+    AConfig*  node;
+    SkinBox   box;
 
-        part->name = root->name;
+    ANEW0(part);
+    part->name = root->name;
 
-        node = aconfig_find(root, "background");
-        if (node)
-            skin_background_init_from(part->background, node, basepath);
+    node = aconfig_find(root, "background");
+    if (node)
+        skin_background_init_from(part->background, node, basepath);
 
-        node = aconfig_find(root, "display");
-        if (node)
-            skin_display_init_from(part->display, node);
+    node = aconfig_find(root, "display");
+    if (node)
+        skin_display_init_from(part->display, node);
 
-        node = aconfig_find(root, "button");
-        if (node) {
-            for (node = node->first_child; node != NULL; node = node->next)
-            {
-                SkinButton*  button = skin_button_create_from(node, basepath);
+    node = aconfig_find(root, "button");
+    if (node) {
+        for (node = node->first_child; node != NULL; node = node->next)
+        {
+            SkinButton*  button = skin_button_create_from(node, basepath);
 
-                if (button != NULL) {
-                    button->next  = part->buttons;
-                    part->buttons = button;
-                }
+            if (button != NULL) {
+                button->next  = part->buttons;
+                part->buttons = button;
             }
         }
+    }
 
-        skin_box_minmax_init( &box );
+    skin_box_minmax_init( &box );
 
-        if (part->background->valid)
-            skin_box_minmax_update( &box, &part->background->rect );
+    if (part->background->valid)
+        skin_box_minmax_update( &box, &part->background->rect );
 
-        if (part->display->valid)
-            skin_box_minmax_update( &box, &part->display->rect );
+    if (part->display->valid)
+        skin_box_minmax_update( &box, &part->display->rect );
 
-        SKIN_PART_LOOP_BUTTONS(part, button)
-            skin_box_minmax_update( &box, &button->rect );
-        SKIN_PART_LOOP_END
+    SKIN_PART_LOOP_BUTTONS(part, button)
+        skin_box_minmax_update( &box, &button->rect );
+    SKIN_PART_LOOP_END
 
-        if ( !skin_box_minmax_to_rect( &box, &part->rect ) ) {
-            skin_part_free(part);
-            part = NULL;
-        }
+    if ( !skin_box_minmax_to_rect( &box, &part->rect ) ) {
+        skin_part_free(part);
+        part = NULL;
     }
+
     return part;
 }
 
 static SkinPart*
 skin_part_create_from_v2( AConfig*  root, const char*  basepath )
 {
-    SkinPart*  part = qemu_mallocz(sizeof(*part));
-
-    if (part != NULL) {
-        AConfig*  node;
-        SkinBox   box;
+    SkinPart*  part;
+    AConfig*  node;
+    SkinBox   box;
 
-        part->name = root->name;
+    ANEW0(part);
+    part->name = root->name;
 
-        node = aconfig_find(root, "background");
-        if (node)
-            skin_background_init_from(part->background, node, basepath);
+    node = aconfig_find(root, "background");
+    if (node)
+        skin_background_init_from(part->background, node, basepath);
 
-        node = aconfig_find(root, "display");
-        if (node)
-            skin_display_init_from(part->display, node);
+    node = aconfig_find(root, "display");
+    if (node)
+        skin_display_init_from(part->display, node);
 
-        node = aconfig_find(root, "buttons");
-        if (node) {
-            for (node = node->first_child; node != NULL; node = node->next)
-            {
-                SkinButton*  button = skin_button_create_from(node, basepath);
+    node = aconfig_find(root, "buttons");
+    if (node) {
+        for (node = node->first_child; node != NULL; node = node->next)
+        {
+            SkinButton*  button = skin_button_create_from(node, basepath);
 
-                if (button != NULL) {
-                    button->next  = part->buttons;
-                    part->buttons = button;
-                }
+            if (button != NULL) {
+                button->next  = part->buttons;
+                part->buttons = button;
             }
         }
+    }
 
-        skin_box_minmax_init( &box );
+    skin_box_minmax_init( &box );
 
-        if (part->background->valid)
-            skin_box_minmax_update( &box, &part->background->rect );
+    if (part->background->valid)
+        skin_box_minmax_update( &box, &part->background->rect );
 
-        if (part->display->valid)
-            skin_box_minmax_update( &box, &part->display->rect );
+    if (part->display->valid)
+        skin_box_minmax_update( &box, &part->display->rect );
 
-        SKIN_PART_LOOP_BUTTONS(part, button)
-            skin_box_minmax_update( &box, &button->rect );
-        SKIN_PART_LOOP_END
+    SKIN_PART_LOOP_BUTTONS(part, button)
+        skin_box_minmax_update( &box, &button->rect );
+    SKIN_PART_LOOP_END
 
-        if ( !skin_box_minmax_to_rect( &box, &part->rect ) ) {
-            skin_part_free(part);
-            part = NULL;
-        }
+    if ( !skin_box_minmax_to_rect( &box, &part->rect ) ) {
+        skin_part_free(part);
+        part = NULL;
     }
     return part;
 }
@@ -400,10 +401,10 @@ skin_layout_free( SkinLayout*  layout )
 {
     if (layout) {
         SKIN_LAYOUT_LOOP_LOCS(layout,loc)
-            qemu_free(loc);
+            AFREE(loc);
         SKIN_LAYOUT_LOOP_END
         layout->locations = NULL;
-        qemu_free(layout);
+        AFREE(layout);
     }
 }
 
@@ -477,13 +478,12 @@ skin_layout_event_decode( const char*  event, int  *ptype, int  *pcode, int *pva
 static SkinLayout*
 skin_layout_create_from_v2( AConfig*  root, SkinPart*  parts )
 {
-    SkinLayout*    layout = qemu_mallocz(sizeof(*layout));
+    SkinLayout*    layout;
     int            width, height;
     SkinLocation** ptail;
     AConfig*       node;
 
-    if (layout == NULL)
-        return NULL;
+    ANEW0(layout);
 
     width  = aconfig_int( root, "width", 400 );
     height = aconfig_int( root, "height", 400 );
@@ -547,16 +547,11 @@ skin_file_load_from_v1( SkinFile*  file, AConfig*  aconfig, const char*  basepat
 
     for (nn = 0; nn < 2; nn++)
     {
-        layout = qemu_mallocz(sizeof(*layout));
-        if (layout == NULL) return -1;
+        ANEW0(layout);
 
         layout->color = 0xff808080;
 
-        location = qemu_mallocz(sizeof(*location));
-        if (location == NULL) {
-            qemu_free(layout);
-            return -1;
-        }
+        ANEW0(location);
 
         layout->event_type  = 0x05;  /* close keyboard by default */
         layout->event_code  = 0;
@@ -661,20 +656,19 @@ skin_file_load_from_v2( SkinFile*  file, AConfig*  aconfig, const char*  basepat
 SkinFile*
 skin_file_create_from_aconfig( AConfig*   aconfig, const char*  basepath )
 {
-    SkinFile*  file = qemu_mallocz(sizeof(*file));
+    SkinFile*  file;
 
-    if (file != NULL) {
-        if ( aconfig_find(aconfig, "parts") != NULL) {
-            if (skin_file_load_from_v2( file, aconfig, basepath ) < 0) {
-                skin_file_free( file );
-                file = NULL;
-            }
+    ANEW0(file);
+    if ( aconfig_find(aconfig, "parts") != NULL) {
+        if (skin_file_load_from_v2( file, aconfig, basepath ) < 0) {
+            skin_file_free( file );
+            file = NULL;
         }
-        else {
-            if (skin_file_load_from_v1( file, aconfig, basepath ) < 0) {
-                skin_file_free( file );
-                file = NULL;
-            }
+    }
+    else {
+        if (skin_file_load_from_v1( file, aconfig, basepath ) < 0) {
+            skin_file_free( file );
+            file = NULL;
         }
     }
     return file;
@@ -694,6 +688,6 @@ skin_file_free( SkinFile*  file )
         SKIN_FILE_LOOP_END_PARTS
         file->parts = NULL;
 
-        qemu_free(file);
+        AFREE(file);
     }
 }
diff --git a/skins/skin_file.h b/android/skin/file.h
index 1670889..8f95368 100644
--- a/skins/skin_file.h
+++ b/android/skin/file.h
@@ -12,8 +12,8 @@
 #ifndef _ANDROID_SKIN_FILE_H
 #define _ANDROID_SKIN_FILE_H
 
-#include "skin_image.h"
-#include "android_config.h"
+#include "android/skin/image.h"
+#include "android/config.h"
 #include "framebuffer.h"
 
 /**  Layout
diff --git a/skins/skin_image.c b/android/skin/image.c
index 6ae4462..051fc6d 100644
--- a/skins/skin_image.c
+++ b/android/skin/image.c
@@ -9,8 +9,8 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skin_image.h"
-#include "android_resource.h"
+#include "android/skin/image.h"
+#include "android/resource.h"
 #include <assert.h>
 #include <limits.h>
 
diff --git a/skins/skin_image.h b/android/skin/image.h
index ad069b2..a94a372 100644
--- a/skins/skin_image.h
+++ b/android/skin/image.h
@@ -12,9 +12,9 @@
 #ifndef _ANDROID_SKIN_IMAGE_H
 #define _ANDROID_SKIN_IMAGE_H
 
-#include "android.h"
+#include "android/android.h"
 #include <SDL.h>
-#include "skin_rect.h"
+#include "android/skin/rect.h"
 
 /* helper functions */
 
diff --git a/skins/skin_keyboard.c b/android/skin/keyboard.c
index 829b279..6a9c79b 100644
--- a/skins/skin_keyboard.c
+++ b/android/skin/keyboard.c
@@ -9,10 +9,11 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skin_keyboard.h"
-#include "android_utils.h"
-#include "android.h"
-#include "vl.h"
+#include "android/skin/keyboard.h"
+#include "android/utils/debug.h"
+#include "android/utils/bufprint.h"
+#include "android/utils/system.h"
+#include "android/android.h"
 
 #define  DEBUG  1
 
@@ -735,12 +736,11 @@ skin_keyboard_process_event( SkinKeyboard*  kb, SDL_Event*  ev, int  down )
 SkinKeyboard*
 skin_keyboard_create_from_aconfig( AConfig*  aconfig, int  use_raw_keys )
 {
-    SkinKeyboard*  kb = qemu_mallocz(sizeof(*kb));
+    SkinKeyboard*  kb;
     const char*    charmap_name = "qwerty";
     AConfig*       node;
 
-    if (kb == NULL)
-        return kb;
+    ANEW0(kb);
 
     node = aconfig_find( aconfig, "keyboard" );
     if (node != NULL)
@@ -778,6 +778,6 @@ void
 skin_keyboard_free( SkinKeyboard*  keyboard )
 {
     if (keyboard) {
-        qemu_free(keyboard);
+        AFREE(keyboard);
     }
 }
diff --git a/skins/skin_keyboard.h b/android/skin/keyboard.h
index 6be3643..45efd18 100644
--- a/skins/skin_keyboard.h
+++ b/android/skin/keyboard.h
@@ -12,10 +12,10 @@
 #ifndef _ANDROID_SKIN_KEYBOARD_H
 #define _ANDROID_SKIN_KEYBOARD_H
 
-#include "android_charmap.h"
-#include "android_config.h"
-#include "skin_image.h"  /* for SkinRotation */
-#include "skin_keyset.h"
+#include "android/charmap.h"
+#include "android/config.h"
+#include "android/skin/image.h"  /* for SkinRotation */
+#include "android/skin/keyset.h"
 #include <SDL.h>
 
 typedef struct SkinKeyboard   SkinKeyboard;
diff --git a/skins/skin_keyset.c b/android/skin/keyset.c
index f9e6af7..7a92971 100644
--- a/skins/skin_keyset.c
+++ b/android/skin/keyset.c
@@ -9,9 +9,10 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skins/skin_keyset.h"
-#include "android_utils.h"
-#include "android.h"
+#include "android/skin/keyset.h"
+#include "android/utils/debug.h"
+#include "android/utils/bufprint.h"
+#include "android/android.h"
 #include <SDL.h>
 
 #define  DEBUG  1
diff --git a/skins/skin_keyset.h b/android/skin/keyset.h
index 10b60fa..d68d6a7 100644
--- a/skins/skin_keyset.h
+++ b/android/skin/keyset.h
@@ -12,7 +12,7 @@
 #ifndef _ANDROID_SKIN_KEYSET_H_
 #define _ANDROID_SKIN_KEYSET_H_
 
-#include "android_config.h"
+#include "android/config.h"
 
 /* A SkinKeySet maps keystrokes to specific commands. we have a few hard-coded
  * keysets in the emulator binary, and the user can define its own if he wants
diff --git a/skins/skin_rect.c b/android/skin/rect.c
index d60dbd2..93e8bc1 100644
--- a/skins/skin_rect.c
+++ b/android/skin/rect.c
@@ -9,7 +9,7 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skin_rect.h"
+#include "android/skin/rect.h"
 #include <limits.h>
 
 #define  SKIN_POS_INITIALIZER   { 0, 0 }
diff --git a/skins/skin_rect.h b/android/skin/rect.h
index 757f888..757f888 100644
--- a/skins/skin_rect.h
+++ b/android/skin/rect.h
diff --git a/skins/skin_region.c b/android/skin/region.c
index f15bf37..a5f26a5 100644
--- a/skins/skin_region.c
+++ b/android/skin/region.c
@@ -9,7 +9,7 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skin_region.h"
+#include "android/skin/region.h"
 #include <limits.h>
 #include <string.h>
 #include <stdlib.h>  /* malloc/free */
diff --git a/skins/skin_region.h b/android/skin/region.h
index e7236e8..9ac4103 100644
--- a/skins/skin_region.h
+++ b/android/skin/region.h
@@ -12,7 +12,7 @@
 #ifndef _ANDROID_SKIN_REGION_H
 #define _ANDROID_SKIN_REGION_H
 
-#include "skin_rect.h"
+#include "android/skin/rect.h"
 
 typedef struct SkinRegion  SkinRegion;
 
diff --git a/skins/skin_scaler.c b/android/skin/scaler.c
index 60dcf8c..59e212f 100644
--- a/skins/skin_scaler.c
+++ b/android/skin/scaler.c
@@ -9,11 +9,13 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skin_scaler.h"
+#include "android/skin/scaler.h"
+#include <stdint.h>
 #include <math.h>
 
 struct SkinScaler {
     double  scale;
+    double  xdisp, ydisp;
     double  invscale;
     int     valid;
 };
@@ -24,6 +26,8 @@ SkinScaler*
 skin_scaler_create( void )
 {
     _scaler0.scale    = 1.0;
+    _scaler0.xdisp    = 0.0;
+    _scaler0.ydisp    = 0.0;
     _scaler0.invscale = 1.0;
     return &_scaler0;
 }
@@ -31,15 +35,17 @@ skin_scaler_create( void )
 /* change the scale of a given scaler. returns 0 on success, or -1 in case of
  * problem (unsupported scale) */
 int
-skin_scaler_set( SkinScaler*  scaler, double  scale )
+skin_scaler_set( SkinScaler*  scaler, double  scale, double xdisp, double ydisp )
 {
     /* right now, we only support scales in the 0.5 .. 1.0 range */
     if (scale < 0.1)
         scale = 0.1;
-    else if (scale > 3.0)
-        scale = 3.0;
+    else if (scale > 6.0)
+        scale = 6.0;
 
     scaler->scale    = scale;
+    scaler->xdisp    = xdisp;
+    scaler->ydisp    = ydisp;
     scaler->invscale = 1/scale;
     scaler->valid    = 1;
 
@@ -71,7 +77,7 @@ typedef struct {
 #define  ARGB_SCALE_UP_BILINEAR   scale_up_bilinear
 #define  ARGB_SCALE_UP_QUICK_4x4  scale_up_quick_4x4
 
-#include "skin_argb.h"
+#include "android/skin/argb.h"
 
 
 void
@@ -100,15 +106,15 @@ skin_scaler_scale( SkinScaler*   scaler,
         op.dst_line  = dst_surface->pixels;
 
         /* compute the destination rectangle */
-        op.rd.x = (int)(sx * scaler->scale);
-        op.rd.y = (int)(sy * scaler->scale);
-        op.rd.w = (int)(ceil((sx + sw) * scaler->scale)) - op.rd.x;
-        op.rd.h = (int)(ceil((sy + sh) * scaler->scale)) - op.rd.y;
+        op.rd.x = (int)(sx * scaler->scale + scaler->xdisp);
+        op.rd.y = (int)(sy * scaler->scale + scaler->ydisp);
+        op.rd.w = (int)(ceil((sx + sw) * scaler->scale + scaler->xdisp)) - op.rd.x;
+        op.rd.h = (int)(ceil((sy + sh) * scaler->scale + scaler->ydisp)) - op.rd.y;
 
         /* compute the starting source position in 16.16 format
          * and the corresponding increments */
-        op.sx = (int)(op.rd.x * scaler->invscale * 65536);
-        op.sy = (int)(op.rd.y * scaler->invscale * 65536);
+        op.sx = (int)((op.rd.x - scaler->xdisp) * scaler->invscale * 65536);
+        op.sy = (int)((op.rd.y - scaler->ydisp) * scaler->invscale * 65536);
 
         op.ix = (int)( scaler->invscale * 65536 );
         op.iy = op.ix;
@@ -118,7 +124,7 @@ skin_scaler_scale( SkinScaler*   scaler,
         if (op.scale >= 0.5 && op.scale <= 1.0)
             scale_05_to_10( &op );
         else if (op.scale > 1.0)
-            scale_up_quick_4x4( &op );
+            scale_up_bilinear( &op );
         else
             scale_generic( &op );
     }
diff --git a/skins/skin_scaler.h b/android/skin/scaler.h
index 4f22c2b..4e0ec5a 100644
--- a/skins/skin_scaler.h
+++ b/android/skin/scaler.h
@@ -12,7 +12,7 @@
 #ifndef _ANDROID_SKIN_SCALER_H
 #define _ANDROID_SKIN_SCALER_H
 
-#include "skin_image.h"
+#include "android/skin/image.h"
 
 typedef struct SkinScaler   SkinScaler;
 
@@ -21,7 +21,10 @@ extern SkinScaler*  skin_scaler_create( void );
 
 /* change the scale of a given scaler. returns 0 on success, or -1 in case of
  * problem (unsupported scale) */
-extern int          skin_scaler_set( SkinScaler*  scaler, double  scale );
+extern int          skin_scaler_set( SkinScaler*  scaler,
+                                     double       scale,
+                                     double       xDisp,
+                                     double       yDisp );
 
 extern void         skin_scaler_free( SkinScaler*  scaler );
 
diff --git a/skins/skin_surface.c b/android/skin/surface.c
index a148db9..4424bd8 100644
--- a/skins/skin_surface.c
+++ b/android/skin/surface.c
@@ -9,14 +9,14 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skin_surface.h"
-#include "skin_argb.h"
+#include "android/skin/surface.h"
+#include "android/skin/argb.h"
 #include <SDL.h>
 
 #define  DEBUG  1
 
 #if DEBUG
-#include "android_debug.h"
+#include "android/utils/debug.h"
 #define  D(...)   VERBOSE_PRINT(surface,__VA_ARGS__)
 #else
 #define  D(...)   ((void)0)
diff --git a/skins/skin_surface.h b/android/skin/surface.h
index 2603a8f..39ab439 100644
--- a/skins/skin_surface.h
+++ b/android/skin/surface.h
@@ -12,7 +12,7 @@
 #ifndef _ANDROID_SKIN_SURFACE_H
 #define _ANDROID_SKIN_SURFACE_H
 
-#include "skin_region.h"
+#include "android/skin/region.h"
 #include <stdint.h>
 
 /* a SkinSurface models a 32-bit ARGB pixel image that can be blitted to or from
diff --git a/skins/skin_trackball.c b/android/skin/trackball.c
index ae0cd8e..b18923a 100644
--- a/skins/skin_trackball.c
+++ b/android/skin/trackball.c
@@ -9,10 +9,9 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skin_trackball.h"
-#include "skin_image.h"
-#include "osdep.h"
-#include "vl.h"
+#include "android/skin/trackball.h"
+#include "android/skin/image.h"
+#include "android/utils/system.h"
 #include <math.h>
 
 /***********************************************************************/
@@ -564,15 +563,15 @@ trackball_draw( TrackBall  ball, int  x, int  y, SDL_Surface*  dst )
 SkinTrackBall*
 skin_trackball_create  ( SkinTrackBallParameters*  params )
 {
-    TrackBall  ball = (TrackBall) qemu_mallocz(sizeof(*ball));
-    if (ball != NULL) {
-        trackball_init( ball,
-                        params->diameter,
-                        params->ring,
-                        params->ball_color,
-                        params->dot_color,
-                        params->ring_color );
-    }
+    TrackBall  ball;
+
+    ANEW0(ball);
+    trackball_init( ball,
+                    params->diameter,
+                    params->ring,
+                    params->ball_color,
+                    params->dot_color,
+                    params->ring_color );
     return  ball;
 }
 
@@ -605,7 +604,7 @@ skin_trackball_destroy ( SkinTrackBall*  ball )
 {
     if (ball) {
         trackball_done(ball);
-        qemu_free(ball);
+        AFREE(ball);
     }
 }
 
diff --git a/skins/skin_trackball.h b/android/skin/trackball.h
index b4f1ab3..06aa606 100644
--- a/skins/skin_trackball.h
+++ b/android/skin/trackball.h
@@ -13,7 +13,7 @@
 #define _ANDROID_SKIN_TRACKBALL_H
 
 #include <SDL.h>
-#include "skin_rect.h"
+#include "android/skin/rect.h"
 
 typedef struct SkinTrackBall  SkinTrackBall;
 
diff --git a/skins/skin_window.c b/android/skin/window.c
index 6d2c217..6612ffe 100644
--- a/skins/skin_window.c
+++ b/android/skin/window.c
@@ -9,11 +9,14 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "skin_window.h"
-#include "skin_image.h"
-#include "skin_scaler.h"
-#include "android_charmap.h"
+#include "android/skin/window.h"
+#include "android/skin/image.h"
+#include "android/skin/scaler.h"
+#include "android/charmap.h"
+#include "android/utils/debug.h"
+#include "android/utils/display.h"
 #include <SDL_syswm.h>
+#include "qemu-common.h"
 #include <math.h>
 
 #include "framebuffer.h"
@@ -285,7 +288,7 @@ lcd_brightness_argb32( unsigned char*  pixels, SkinRect*  r, int  pitch, int  br
     int             w     = r->size.w;
     int             h     = r->size.h;
 
-    if (alpha < b_min)
+    if (alpha <= b_min)
         alpha = b_min;
     else if (alpha > b_max)
         alpha = b_max;
@@ -821,11 +824,18 @@ struct SkinWindow {
     SkinRotation  onion_rotation;
     int           onion_alpha;
 
+    int           x_pos;
+    int           y_pos;
+
     SkinScaler*   scaler;
     int           shrink;
     double        shrink_scale;
     unsigned*     shrink_pixels;
     SDL_Surface*  shrink_surface;
+
+    double        effective_scale;
+    double        effective_x;
+    double        effective_y;
 };
 
 static void
@@ -994,19 +1004,13 @@ skin_window_show_trackball( SkinWindow*  window, int  enable )
 }
 
 
+static int  skin_window_reset_internal (SkinWindow*, SkinLayout*);
+
 SkinWindow*
 skin_window_create( SkinLayout*  slayout, int  x, int  y, double  scale, int  no_display )
 {
     SkinWindow*  window = qemu_mallocz(sizeof(*window));
 
-    /* position emulator window to its last position */
-    {
-        char  temp[32];
-        sprintf(temp,"SDL_VIDEO_WINDOW_POS=%d,%d",x,y);
-        putenv(temp);
-        putenv("SDL_VIDEO_WINDOW_FORCE_VISIBLE=1");
-    }
-
     window->shrink_scale = scale;
     window->shrink       = (scale != 1.0);
     window->scaler       = skin_scaler_create();
@@ -1018,7 +1022,10 @@ skin_window_create( SkinLayout*  slayout, int  x, int  y, double  scale, int  no
     window->enable_dpad      = 1;
     window->enable_qwerty    = 1;
 
-    if (skin_window_reset(window, slayout) < 0) {
+    window->x_pos = x;
+    window->y_pos = y;
+
+    if (skin_window_reset_internal(window, slayout) < 0) {
         skin_window_free( window );
         return NULL;
     }
@@ -1063,29 +1070,9 @@ skin_window_set_title( SkinWindow*  window, const char*  title )
         SDL_WM_SetCaption( title, title );
 }
 
-int
-skin_window_reset ( SkinWindow*  window, SkinLayout*  slayout )
+static void
+skin_window_resize( SkinWindow*  window )
 {
-    Layout         layout;
-    int            flags;
-    ADisplay*      disp;
-
-    if ( layout_init( &layout, slayout ) < 0 )
-        return -1;
-
-    disp = window->layout.displays;
-
-    layout_done( &window->layout );
-    window->layout = layout;
-
-    disp = window->layout.displays;
-    if (disp != NULL && window->onion)
-        display_set_onion( disp,
-                           window->onion,
-                           window->onion_rotation,
-                           window->onion_alpha );
-
-
     /* now resize window */
     if (window->surface) {
         SDL_FreeSurface(window->surface);
@@ -1103,31 +1090,68 @@ skin_window_reset ( SkinWindow*  window, SkinLayout*  slayout )
     }
 
     if ( !window->no_display ) {
-        int           window_w = layout.rect.size.w;
-        int           window_h = layout.rect.size.h;
+        int           layout_w = window->layout.rect.size.w;
+        int           layout_h = window->layout.rect.size.h;
+        int           window_w = layout_w;
+        int           window_h = layout_h;
+        int           window_x = window->x_pos;
+        int           window_y = window->y_pos;
+        int           flags;
         SDL_Surface*  surface;
+        double        scale = 1.0;
+        int           fullscreen = window->fullscreen;
+
+        if (fullscreen) {
+            if (get_nearest_monitor_rect(&window_x, &window_y,
+                                         &window_w, &window_h) < 0) {
+                fullscreen = 0;
+            } else {
+                double  x_scale = window_w * 1.0 / layout_w;
+                double  y_scale = window_h * 1.0 / layout_h;
+
+                scale = (x_scale <= y_scale) ? x_scale : y_scale;
+            }
+        }
+        else if (window->shrink) {
+            scale = window->shrink_scale;
+            window_w = (int) ceil(layout_w*scale);
+            window_h = (int) ceil(layout_h*scale);
+        }
 
-        if (window->shrink) {
-            window_w = (int) ceil(window_w*window->shrink_scale);
-            window_h = (int) ceil(window_h*window->shrink_scale);
+        {
+            char  temp[32];
+            sprintf(temp,"SDL_VIDEO_WINDOW_POS=%d,%d",window_x,window_y);
+            putenv(temp);
+            putenv("SDL_VIDEO_WINDOW_FORCE_VISIBLE=1");
         }
 
         flags = SDL_SWSURFACE;
-        if (window->fullscreen)
+        if (fullscreen) {
             flags |= SDL_FULLSCREEN;
-
+        }
         surface = SDL_SetVideoMode( window_w, window_h, 32, flags );
         if (surface == NULL) {
             fprintf(stderr, "### Error: could not create or resize SDL window: %s\n", SDL_GetError() );
             exit(1);
         }
 
-        if (!window->shrink)
+        SDL_WM_SetPos( window_x, window_y );
+
+        window->effective_scale = scale;
+        window->effective_x     = 0;
+        window->effective_y     = 0;
+
+        if (fullscreen) {
+            window->effective_x = (window_w - layout_w*scale)*0.5;
+            window->effective_y = (window_h - layout_h*scale)*0.5;
+        }
+
+        if (scale == 1.0)
             window->surface = surface;
         else
         {
-            window_w = (int) ceil(window_w / window->shrink_scale);
-            window_h = (int) ceil(window_h / window->shrink_scale);
+            window_w = (int) ceil(window_w / scale );
+            window_h = (int) ceil(window_h / scale );
 
             window->shrink_surface = surface;
             window->shrink_pixels  = qemu_mallocz( window_w * window_h * 4 );
@@ -1140,9 +1164,33 @@ skin_window_reset ( SkinWindow*  window, SkinLayout*  slayout )
                 fprintf(stderr, "### Error: could not create or resize SDL window: %s\n", SDL_GetError() );
                 exit(1);
             }
-            skin_scaler_set( window->scaler, window->shrink_scale );
+            skin_scaler_set( window->scaler, scale, window->effective_x, window->effective_y );
         }
     }
+}
+
+static int
+skin_window_reset_internal ( SkinWindow*  window, SkinLayout*  slayout )
+{
+    Layout         layout;
+    ADisplay*      disp;
+
+    if ( layout_init( &layout, slayout ) < 0 )
+        return -1;
+
+    disp = window->layout.displays;
+
+    layout_done( &window->layout );
+    window->layout = layout;
+
+    disp = window->layout.displays;
+    if (disp != NULL && window->onion)
+        display_set_onion( disp,
+                           window->onion,
+                           window->onion_rotation,
+                           window->onion_alpha );
+
+    skin_window_resize(window);
 
     finger_state_reset( &window->finger );
     button_state_reset( &window->button );
@@ -1157,6 +1205,15 @@ skin_window_reset ( SkinWindow*  window, SkinLayout*  slayout )
     return 0;
 }
 
+int
+skin_window_reset ( SkinWindow*  window, SkinLayout*  slayout )
+{
+    if (!window->fullscreen) {
+        SDL_WM_GetPos(&window->x_pos, &window->y_pos);
+    }
+    return skin_window_reset_internal( window, slayout );
+}
+
 void
 skin_window_set_lcd_brightness( SkinWindow*  window, int  brightness )
 {
@@ -1231,7 +1288,8 @@ skin_window_set_scale( SkinWindow*  window, double  scale )
     window->shrink       = (scale != 1.0);
     window->shrink_scale = scale;
 
-    skin_window_reset( window, window->layout.slayout );
+    skin_window_resize( window );
+    skin_window_redraw( window, NULL );
 }
 
 void
@@ -1281,7 +1339,7 @@ skin_window_redraw( SkinWindow*  window, SkinRect*  rect )
         if ( window->ball.tracking )
             ball_state_redraw( &window->ball, rect, window->surface );
 
-        if (window->shrink)
+        if (window->effective_scale != 1.0)
             skin_window_update_shrink( window, rect );
         else
         {
@@ -1300,8 +1358,11 @@ void
 skin_window_toggle_fullscreen( SkinWindow*  window )
 {
     if (window && window->surface) {
-        SDL_WM_ToggleFullScreen(window->surface);
+        if (!window->fullscreen)
+            SDL_WM_GetPos( &window->x_pos, &window->y_pos );
+
         window->fullscreen = !window->fullscreen;
+        skin_window_resize( window );
         skin_window_redraw( window, NULL );
     }
 }
@@ -1325,6 +1386,13 @@ skin_window_get_display( SkinWindow*  window, ADisplayInfo  *info )
 }
 
 
+static void
+skin_window_map_to_scale( SkinWindow*  window, int  *x, int  *y )
+{
+    *x = (*x - window->effective_x) / window->effective_scale;
+    *y = (*y - window->effective_y) / window->effective_scale;
+}
+
 void
 skin_window_process_event( SkinWindow*  window, SDL_Event*  ev )
 {
@@ -1343,10 +1411,7 @@ skin_window_process_event( SkinWindow*  window, SDL_Event*  ev )
 
         mx = ev->button.x;
         my = ev->button.y;
-        if ( window->shrink ) {
-            mx /= window->shrink_scale;
-            my /= window->shrink_scale;
-        }
+        skin_window_map_to_scale( window, &mx, &my );
         skin_window_move_mouse( window, mx, my );
         skin_window_find_finger( window, mx, my );
 #if 0
@@ -1379,10 +1444,7 @@ skin_window_process_event( SkinWindow*  window, SDL_Event*  ev )
         button = window->button.pressed;
         mx = ev->button.x;
         my = ev->button.y;
-        if ( window->shrink ) {
-            mx /= window->shrink_scale;
-            my /= window->shrink_scale;
-        }
+        skin_window_map_to_scale( window, &mx, &my );
         if (button)
         {
             button->down = 0;
@@ -1409,10 +1471,7 @@ skin_window_process_event( SkinWindow*  window, SDL_Event*  ev )
         }
         mx = ev->button.x;
         my = ev->button.y;
-        if ( window->shrink ) {
-            mx /= window->shrink_scale;
-            my /= window->shrink_scale;
-        }
+        skin_window_map_to_scale( window, &mx, &my );
         if ( !window->button.pressed )
         {
             skin_window_move_mouse( window, mx, my );
@@ -1449,7 +1508,7 @@ skin_window_update_display( SkinWindow*  window, int  x, int  y, int  w, int  h
         r.pos.x += disp->origin.x;
         r.pos.y += disp->origin.y;
 
-        if (window->shrink)
+        if (window->effective_scale != 1.0)
             skin_window_redraw( window, &r );
         else
             display_redraw( disp, &r, window->surface );
diff --git a/skins/skin_window.h b/android/skin/window.h
index 9f00f3e..3e92e40 100644
--- a/skins/skin_window.h
+++ b/android/skin/window.h
@@ -12,11 +12,8 @@
 #ifndef _SKIN_WINDOW_H
 #define _SKIN_WINDOW_H
 
-#include "skin_file.h"
-#include "skin_trackball.h"
-#include "android_utils.h"
-
-#include "vl.h"
+#include "android/skin/file.h"
+#include "android/skin/trackball.h"
 #include <SDL.h>
 
 typedef struct SkinWindow  SkinWindow;
diff --git a/android/tools/gen-hw-config.py b/android/tools/gen-hw-config.py
index ae3a8de..928ccc5 100755
--- a/android/tools/gen-hw-config.py
+++ b/android/tools/gen-hw-config.py
@@ -9,17 +9,17 @@
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
-# this script is used to generate 'android/vm/hw-config.h' by
-# parsing 'android/vm/hardware-properties.ini'
+# this script is used to generate 'android/avd/hw-config.h' by
+# parsing 'android/avd/hardware-properties.ini'
 #
 #
 import  sys, os, string, re
 
 # location of source file, relative to current program directory
-relativeSourcePath = "../vm/hardware-properties.ini"
+relativeSourcePath = "../avd/hardware-properties.ini"
 
 # location of target file, relative to current program directory
-relativeTargetPath = "../vm/hw-config-defs.h"
+relativeTargetPath = "../avd/hw-config-defs.h"
 
 def quoteStringForC(str):
     """quote a string so it can be used in C"""
diff --git a/android/utils/bufprint.c b/android/utils/bufprint.c
new file mode 100644
index 0000000..4309a4b
--- /dev/null
+++ b/android/utils/bufprint.c
@@ -0,0 +1,230 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#include "android/utils/bufprint.h"
+#include "android/utils/path.h"
+#include "android/utils/debug.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#ifdef _WIN32
+#  define WIN32_LEAN_AND_MEAN
+#  include "windows.h"
+#  include "shlobj.h"
+#else
+#  include <unistd.h>
+#  include <sys/stat.h>
+#endif
+
+#define  D(...)  VERBOSE_PRINT(init,__VA_ARGS__)
+
+
+/** USEFUL STRING BUFFER FUNCTIONS
+ **/
+
+char*
+vbufprint( char*        buffer,
+           char*        buffer_end,
+           const char*  fmt,
+           va_list      args )
+{
+    int  len = vsnprintf( buffer, buffer_end - buffer, fmt, args );
+    if (len < 0 || buffer+len >= buffer_end) {
+        if (buffer < buffer_end)
+            buffer_end[-1] = 0;
+        return buffer_end;
+    }
+    return buffer + len;
+}
+
+char*
+bufprint(char*  buffer, char*  end, const char*  fmt, ... )
+{
+    va_list  args;
+    char*    result;
+
+    va_start(args, fmt);
+    result = vbufprint(buffer, end, fmt, args);
+    va_end(args);
+    return  result;
+}
+
+/** USEFUL DIRECTORY SUPPORT
+ **
+ **  bufprint_app_dir() returns the directory where the emulator binary is located
+ **
+ **  get_android_home() returns a user-specific directory where the emulator will
+ **  store its writable data (e.g. config files, profiles, etc...).
+ **  on Unix, this is $HOME/.android, on Windows, this is something like
+ **  "%USERPROFILE%/Local Settings/AppData/Android" on XP, and something different
+ **  on Vista.
+ **
+ **  both functions return a string that must be freed by the caller
+ **/
+
+#ifdef __linux__
+char*
+bufprint_app_dir(char*  buff, char*  end)
+{
+    char   path[1024];
+    int    len;
+    char*  x;
+
+    len = readlink("/proc/self/exe", path, sizeof(path));
+    if (len <= 0 || len >= (int)sizeof(path)) goto Fail;
+    path[len] = 0;
+
+    x = strrchr(path, '/');
+    if (x == 0) goto Fail;
+    *x = 0;
+
+    return bufprint(buff, end, "%s", path);
+Fail:
+    fprintf(stderr,"cannot locate application directory\n");
+    exit(1);
+    return end;
+}
+
+#elif defined(__APPLE__)
+/* the following hack is needed in order to build with XCode 3.1
+ * don't ask me why, but it seems that there were changes in the
+ * GCC compiler that we don't have in our pre-compiled version
+ */
+#ifndef __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__
+#define __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ MAC_OS_X_VERSION_10_4
+#endif
+#import <Carbon/Carbon.h>
+#include <unistd.h>
+
+char*
+bufprint_app_dir(char*  buff, char*  end)
+{
+    ProcessSerialNumber psn;
+    CFDictionaryRef     dict;
+    CFStringRef         value;
+    char                s[PATH_MAX];
+    char*               x;
+
+    GetCurrentProcess(&psn);
+    dict  = ProcessInformationCopyDictionary(&psn, 0xffffffff);
+    value = (CFStringRef)CFDictionaryGetValue(dict,
+                                             CFSTR("CFBundleExecutable"));
+    CFStringGetCString(value, s, PATH_MAX - 1, kCFStringEncodingUTF8);
+    x = strrchr(s, '/');
+    if (x == 0) goto fail;
+    *x = 0;
+
+    return bufprint(buff, end, "%s", s);
+fail:
+    fprintf(stderr,"cannot locate application directory\n");
+    exit(1);
+    return end;
+}
+#elif defined _WIN32
+char*
+bufprint_app_dir(char*  buff, char*  end)
+{
+    char   appDir[MAX_PATH];
+	int    len;
+	char*  sep;
+
+    len = GetModuleFileName( 0, appDir, sizeof(appDir)-1 );
+	if (len == 0) {
+		fprintf(stderr, "PANIC CITY!!\n");
+		exit(1);
+	}
+	if (len >= (int)sizeof(appDir)) {
+		len = sizeof(appDir)-1;
+	    appDir[len] = 0;
+    }
+	
+	sep = strrchr(appDir, '\\');
+	if (sep)
+	  *sep = 0;
+
+    return bufprint(buff, end, "%s", appDir);
+}
+#else
+char*
+bufprint_app_dir(char*  buff, char*  end)
+{
+    return bufprint(buff, end, ".");
+}
+#endif
+
+#define  _ANDROID_PATH   ".android"
+
+char*
+bufprint_config_path(char*  buff, char*  end)
+{
+#ifdef _WIN32
+    const char*  home = getenv("ANDROID_SDK_HOME");
+    if (home != NULL) {
+        return bufprint(buff, end, "%s\\%s", home, _ANDROID_PATH );
+    } else {
+        char  path[MAX_PATH];
+
+        SHGetFolderPath( NULL, CSIDL_PROFILE,
+                         NULL, 0, path);
+
+        return bufprint(buff, end, "%s\\%s", path, _ANDROID_PATH );
+    }
+#else
+    const char*  home = getenv("HOME");
+    if (home == NULL)
+        home = "/tmp";
+    return bufprint(buff, end, "%s/%s", home, _ANDROID_PATH );
+#endif
+}
+
+char*
+bufprint_config_file(char*  buff, char*  end, const char*  suffix)
+{
+    char*   p;
+    p = bufprint_config_path(buff, end);
+    p = bufprint(p, end, PATH_SEP "%s", suffix);
+    return p;
+}
+
+char*
+bufprint_temp_dir(char*  buff, char*  end)
+{
+#ifdef _WIN32
+    char   path[MAX_PATH];
+    DWORD  retval;
+
+    retval = GetTempPath( sizeof(path), path );
+    if (retval > sizeof(path) || retval == 0) {
+        D( "can't locate TEMP directory" );
+        strncpy(path, "C:\\Temp", sizeof(path) );
+    }
+    strncat( path, "\\AndroidEmulator", sizeof(path)-1 );
+    path_mkdir(path, 0744);
+
+    return  bufprint(buff, end, "%s", path);
+#else
+    const char*  tmppath = "/tmp/android";
+    mkdir(tmppath, 0744);
+    return  bufprint(buff, end, "%s", tmppath );
+#endif
+}
+
+char*
+bufprint_temp_file(char*  buff, char*  end, const char*  suffix)
+{
+    char*  p;
+    p = bufprint_temp_dir(buff, end);
+    p = bufprint(p, end, PATH_SEP "%s", suffix);
+    return p;
+}
+
diff --git a/android/utils/bufprint.h b/android/utils/bufprint.h
new file mode 100644
index 0000000..32d64dc
--- /dev/null
+++ b/android/utils/bufprint.h
@@ -0,0 +1,76 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#ifndef _ANDROID_UTILS_BUFPRINT_H
+#define _ANDROID_UTILS_BUFPRINT_H
+
+#include <stdarg.h>
+
+/** FORMATTED BUFFER PRINTING
+ **
+ **  bufprint() allows your to easily and safely append formatted string
+ **  content to a given bounded character buffer, in a way that is easier
+ **  to use than raw snprintf()
+ **
+ **  'buffer'  is the start position in the buffer,
+ **  'buffend' is the end of the buffer, the function assumes (buffer <= buffend)
+ **  'format'  is a standard printf-style format string, followed by any number
+ **            of formatting arguments
+ **
+ **  the function returns the next position in the buffer if everything fits
+ **  in it. in case of overflow or formatting error, it will always return "buffend"
+ **
+ **  this allows you to chain several calls to bufprint() and only check for
+ **  overflow at the end, for exemple:
+ **
+ **     char   buffer[1024];
+ **     char*  p   = buffer;
+ **     char*  end = p + sizeof(buffer);
+ **
+ **     p = bufprint(p, end, "%s/%s", first, second);
+ **     p = bufprint(p, end, "/%s", third);
+ **     if (p >= end) ---> overflow
+ **
+ **  as a convenience, the appended string is zero-terminated if there is no overflow.
+ **  (this means that even if p >= end, the content of "buffer" is zero-terminated)
+ **
+ **  vbufprint() is a variant that accepts a va_list argument
+ **/
+
+extern char*   vbufprint(char*  buffer, char*  buffend, const char*  fmt, va_list  args );
+extern char*   bufprint (char*  buffer, char*  buffend, const char*  fmt, ... );
+
+/** USEFUL DIRECTORY SUPPORT
+ **
+ **  bufprint_add_dir() appends the application's directory to a given bounded buffer
+ **
+ **  bufprint_config_path() appends the applications' user-specific configuration directory
+ **  to a bounded buffer. on Unix this is usually ~/.android, and something a bit more
+ **  complex on Windows
+ **
+ **  bufprint_config_file() appends the name of a file or directory relative to the
+ **  user-specific configuration directory to a bounded buffer. this really is equivalent
+ **  to concat-ing the config path + path separator + 'suffix'
+ **
+ **  bufprint_temp_dir() appends the temporary directory's path to a given bounded buffer
+ **
+ **  bufprint_temp_file() appens the name of a file or directory relative to the
+ **  temporary directory. equivalent to concat-ing the temp path + path separator + 'suffix'
+ **/
+
+extern char*  bufprint_app_dir    (char*  buffer, char*  buffend);
+extern char*  bufprint_config_path(char*  buffer, char*  buffend);
+extern char*  bufprint_config_file(char*  buffer, char*  buffend, const char*  suffix);
+extern char*  bufprint_temp_dir   (char*  buffer, char*  buffend);
+extern char*  bufprint_temp_file  (char*  buffer, char*  buffend, const char*  suffix);
+
+#endif /* _ANDROID_UTILS_BUFPRINT_H */
diff --git a/android_debug.c b/android/utils/debug.c
index 8ec1d67..32936d2 100644
--- a/android_debug.c
+++ b/android/utils/debug.c
@@ -9,7 +9,7 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android_debug.h"
+#include "android/utils/debug.h"
 #include <stdio.h>
 #include <unistd.h>
 #include <fcntl.h>
diff --git a/android/utils/debug.h b/android/utils/debug.h
index 28b93ee..fdf93c9 100644
--- a/android/utils/debug.h
+++ b/android/utils/debug.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 2008 The Android Open Source Project
+/* Copyright (C) 2007-2008 The Android Open Source Project
 **
 ** This software is licensed under the terms of the GNU General Public
 ** License version 2, as published by the Free Software Foundation, and
@@ -12,7 +12,80 @@
 #ifndef _ANDROID_UTILS_DEBUG_H
 #define _ANDROID_UTILS_DEBUG_H
 
-/* we'll move android_debug.h here later */
-#include "android_debug.h"
+#include <stdarg.h>
+
+#define  VERBOSE_TAG_LIST    \
+    _VERBOSE_TAG(init,         "emulator initialization")  \
+    _VERBOSE_TAG(console,      "control console")  \
+    _VERBOSE_TAG(modem,        "emulated GSM modem")  \
+    _VERBOSE_TAG(radio,        "emulated GSM AT Command channel") \
+    _VERBOSE_TAG(keys,         "key bindings & presses") \
+    _VERBOSE_TAG(slirp,        "internal router/firewall") \
+    _VERBOSE_TAG(timezone,     "host timezone detection" ) \
+    _VERBOSE_TAG(socket,       "network sockets") \
+    _VERBOSE_TAG(proxy,        "network proxy support") \
+    _VERBOSE_TAG(audio,        "audio sub-system") \
+    _VERBOSE_TAG(audioin,      "audio input backend") \
+    _VERBOSE_TAG(audioout,     "audio output backend") \
+    _VERBOSE_TAG(surface,      "video surface support") \
+    _VERBOSE_TAG(qemud,        "qemud multiplexer daemon") \
+    _VERBOSE_TAG(gps,          "emulated GPS") \
+    _VERBOSE_TAG(nand_limits,  "nand/flash read/write thresholding") \
+    _VERBOSE_TAG(hw_control,   "emulated power/flashlight/led/vibrator") \
+    _VERBOSE_TAG(avd_config,   "android virtual device configuration") \
+
+#define  _VERBOSE_TAG(x,y)  VERBOSE_##x,
+typedef enum {
+    VERBOSE_TAG_LIST
+    VERBOSE_MAX  /* do not remove */
+} VerboseTag;
+#undef  _VERBOSE_TAG
+
+/* defined in android_main.c */
+extern unsigned long  android_verbose;
+
+#define  VERBOSE_ENABLE(tag)    \
+    android_verbose |= (1 << VERBOSE_##tag)
+
+#define  VERBOSE_DISABLE(tag)   \
+    android_verbose &= (1 << VERBOSE_##tag)
+
+#define  VERBOSE_CHECK(tag)    \
+    ((android_verbose & (1 << VERBOSE_##tag)) != 0)
+
+#define  VERBOSE_CHECK_ANY()    \
+    (android_verbose != 0)
+
+#define  VERBOSE_PRINT(tag,...)  \
+    do { if (VERBOSE_CHECK(tag)) dprint(__VA_ARGS__); } while (0)
+
+/** DEBUG TRACE SUPPORT
+ **
+ ** debug messages can be sent by calling these function
+ **
+ ** 'dprint' prints the message, then appends a '\n\
+ ** 'dprintn' simply prints the message as is
+ ** 'dprintnv' allows you to use a va_list argument
+ ** 'dwarning' prints a warning message, then appends a '\n'
+ ** 'derror' prints a severe error message, then appends a '\n'
+ */
+
+extern void   dprint( const char*  format, ... );
+extern void   dprintn( const char*  format, ... );
+extern void   dprintnv( const char*  format, va_list  args );
+extern void   dwarning( const char*  format, ... );
+extern void   derror( const char*  format, ... );
+
+/** STDOUT/STDERR REDIRECTION
+ **
+ ** allows you to shut temporarily shutdown stdout/stderr
+ ** this is useful to get rid of debug messages from ALSA and esd
+ ** on Linux.
+ **/
+
+extern void  stdio_disable( void );
+extern void  stdio_enable( void );
+
+/* */
 
 #endif /* _ANDROID_UTILS_DEBUG_H */
diff --git a/android/utils/dirscanner.c b/android/utils/dirscanner.c
index 9f44d2d..fc63ef0 100644
--- a/android/utils/dirscanner.c
+++ b/android/utils/dirscanner.c
@@ -10,8 +10,8 @@
 ** GNU General Public License for more details.
 */
 #include "android/utils/dirscanner.h"
-#include "android_utils.h"
-#include "vl.h"
+#include "android/utils/bufprint.h"
+#include "qemu-common.h"
 #include <stddef.h>
 
 #define  DIRSCANNER_BASE     \
@@ -46,7 +46,7 @@ _dirScannerInit( DirScanner*  s )
     if (p >= end)
         return -1;
 
-    ret = _findfirst(s->root, &s->findData) + 1;
+    ret = _findfirst(s->root, &s->findData);
 
     s->findIndex1 = ret+1;
     return ret;
diff --git a/android/utils/dirscanner.h b/android/utils/dirscanner.h
index 9486cfc..871b05e 100644
--- a/android/utils/dirscanner.h
+++ b/android/utils/dirscanner.h
@@ -17,9 +17,35 @@
 
 typedef struct DirScanner  DirScanner;
 
+/* Create a new directory scanner object from a given rootPath.
+ * returns NULL in case of failure (error code in errno)
+ */
 DirScanner*    dirScanner_new ( const char*  rootPath );
+
+/* Destroy a given directory scanner. You must always call
+ * this function to release proper system resources.
+ */
 void           dirScanner_free( DirScanner*  s );
+
+/* Get the name of the next file from a directory scanner.
+ * Returns NULL when there is no more elements in the list.
+ *
+ * This is only the file name, use dirScanner_nextFull to
+ * get its full path.
+ *
+ * This will never return '.' and '..'.
+ *
+ * The returned string is owned by the scanner, and will
+ * change on the next call to this function or when the
+ * scanner is destroyed.
+ */
 const char*    dirScanner_next( DirScanner*  s );
+
+/* A variant of dirScanner_next() which returns the full path
+ * to the next directory element.
+ */
 const char*    dirScanner_nextFull( DirScanner*  s );
 
+/* */
+
 #endif /* _ANDROID_UTILS_DIR_H */
diff --git a/android/utils/display-quartz.m b/android/utils/display-quartz.m
new file mode 100644
index 0000000..594657e
--- /dev/null
+++ b/android/utils/display-quartz.m
@@ -0,0 +1,111 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+/* this is the Quartz-specific implementation of
+ * <android/utils/display.h>
+ */
+
+#include "android/utils/display.h"
+#include "android/utils/debug.h"
+
+#define  D(...)   VERBOSE_PRINT(init,__VA_ARGS__)
+
+#include <stdio.h>
+#include <Cocoa/Cocoa.h>
+#include <Carbon/Carbon.h>
+#include <SDL_syswm.h>
+
+int
+get_monitor_resolution( int  *px_dpi, int  *py_dpi )
+{
+    fprintf(stderr, "emulator: FIXME: implement get_monitor_resolution on OS X\n" );
+    return -1;
+}
+
+int
+get_nearest_monitor_rect( int  *x, int  *y, int  *width, int  *height )
+{
+    SDL_SysWMinfo  info;
+    NSWindow*      window;
+
+    SDL_VERSION(&info.version);
+    if ( SDL_GetWMInfo(&info) < 0 ) {
+        D( "%s: SDL_GetWMInfo() failed: %s", __FUNCTION__, SDL_GetError());
+        return -1;
+    }
+    window = info.nsWindowPtr;
+    if (window == NULL) {
+        D( "%s: SDL_GetWMInfo() returned NULL NSWindow ptr",
+           __FUNCTION__ );
+        return -1;
+    }
+    else
+    {
+        NSRect        frame   = [ window frame ];
+        int           fx1     = frame.origin.x;
+        int           fy1     = frame.origin.y;
+        int           fx2     = frame.size.width + fx1;
+        int           fy2     = frame.size.height + fy1; 
+        NSArray*      screens = [ NSScreen screens ];
+        unsigned int  count   = [ screens count ];
+        int           bestScreen = -1;
+        int           bestArea = 0;
+
+        unsigned int  n;
+        printf( "window frame (%d,%d) (%d,%d)\n", fx1, fy1, fx2, fy2 );
+
+        /* we need to compute which screen has the most window pixels */
+        for (n = 0; n < count; n++) {
+            NSScreen*  screen = [ screens objectAtIndex: n ];
+            NSRect     vis    = [ screen visibleFrame ];
+            int        vx1    = vis.origin.x;
+            int        vy1    = vis.origin.y;
+            int        vx2    = vis.size.width + vx1;
+            int        vy2    = vis.size.height + vy1;
+            int        cx1, cx2, cy1, cy2, cArea;
+
+            //printf( "screen %d/%d  frame (%d,%d) (%d,%d)\n", n+1, count,
+            //        vx1, vy1, vx2, vy2 );
+
+            if (fx1 >= vx2 || vx1 >= fx2 || fy1 >= vy2 || vy1 >= fy2)
+                continue;
+
+            cx1 = (fx1 < vx1) ? vx1 : fx1;
+            cx2 = (fx2 > vx2) ? vx2 : fx2;
+            cy1 = (fy1 < vy1) ? vy1 : fy1;
+            cy2 = (fy2 > vy2) ? vy2 : fy2;
+
+            if (cx1 >= cx2 || cy1 >= cy2)
+                continue;
+
+            cArea = (cx2-cx1)*(cy2-cy1);
+
+            if (bestScreen < 0 || cArea > bestArea) {
+                bestScreen = n;
+                bestArea   = cArea;
+            }
+        }
+        if (bestScreen < 0)
+            bestScreen = 0;
+
+        {
+            NSScreen*  screen = [ screens objectAtIndex: bestScreen ];
+            NSRect     vis    = [ screen visibleFrame ];
+
+            *x      = vis.origin.x;
+            *y      = vis.origin.y;
+            *width  = vis.size.width;
+            *height = vis.size.height; 
+        }
+        return 0;
+    }
+};
diff --git a/android/utils/display.c b/android/utils/display.c
new file mode 100644
index 0000000..e1ba507
--- /dev/null
+++ b/android/utils/display.c
@@ -0,0 +1,245 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#include "android/utils/display.h"
+#include "android/utils/debug.h"
+
+#define  D(...)   VERBOSE_PRINT(init,__VA_ARGS__)
+
+/** HOST RESOLUTION SETTINGS
+ **
+ ** return the main monitor's DPI resolution according to the host device
+ ** beware: this is not always reliable or even obtainable.
+ **
+ ** returns 0 on success, or -1 in case of error (e.g. the system returns funky values)
+ **/
+
+/** NOTE: the following code assumes that we exclusively use X11 on Linux, and Quartz on OS X
+ **/
+
+#ifdef _WIN32
+
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <SDL_syswm.h>
+
+int
+get_monitor_resolution( int  *px_dpi, int  *py_dpi )
+{
+    HDC  displayDC = CreateDC( "DISPLAY", NULL, NULL, NULL );
+    int  xdpi, ydpi;
+
+    if (displayDC == NULL) {
+        D( "%s: could not get display DC\n", __FUNCTION__ );
+        return -1;
+    }
+    xdpi = GetDeviceCaps( displayDC, LOGPIXELSX );
+    ydpi = GetDeviceCaps( displayDC, LOGPIXELSY );
+
+    /* sanity checks */
+    if (xdpi < 20 || xdpi > 400 || ydpi < 20 || ydpi > 400) {
+        D( "%s: bad resolution: xpi=%d ydpi=%d", __FUNCTION__,
+                xdpi, ydpi );
+        return -1;
+    }
+
+    *px_dpi = xdpi;
+    *py_dpi = ydpi;
+    return 0;
+}
+
+int
+get_nearest_monitor_rect( int  *x, int  *y, int  *width, int  *height )
+{
+    SDL_SysWMinfo  info;
+    HMONITOR       monitor;
+    MONITORINFO    monitorInfo;
+
+    SDL_VERSION(&info.version);
+
+    if ( !SDL_GetWMInfo(&info) ) {
+        D( "%s: SDL_GetWMInfo() failed: %s", __FUNCTION__, SDL_GetError());
+        return -1;
+    }
+
+    monitor = MonitorFromWindow( info.window, MONITOR_DEFAULTTONEAREST );
+    monitorInfo.cbSize = sizeof(monitorInfo);
+    GetMonitorInfo( monitor, &monitorInfo );
+
+    *x      = monitorInfo.rcMonitor.left;
+    *y      = monitorInfo.rcMonitor.top;
+    *width  = monitorInfo.rcMonitor.right - *x;
+    *height = monitorInfo.rcMonitor.bottom - *y;
+
+    D("%s: found (x,y,w,h)=(%d,%d,%d,%d)", __FUNCTION__,
+      *x, *y, *width, *height);
+
+    return 0;
+}
+
+
+#elif defined __APPLE__
+
+/* the real implementation is in display-quartz.m, but
+ * unfortunately, the Android build system doesn't know
+ * how to build Objective-C sources, so provide stubs
+ * here instead.
+ *
+ * CONFIG_NO_COCOA is set by Makefile.android
+ */
+
+#ifdef CONFIG_NO_COCOA
+int
+get_monitor_resolution( int  *px_dpi, int  *py_dpi )
+{
+    return -1;
+}
+
+int
+get_nearest_monitor_rect( int  *x, int  *y, int  *width, int  *height )
+{
+    return -1;
+}
+#endif /* CONFIG_NO_COCOA */
+
+#else  /* Linux and others */
+#include <SDL.h>
+#include <SDL_syswm.h>
+#include <dlfcn.h>
+#include <X11/Xlib.h>
+#define  MM_PER_INCH   25.4
+
+#define  DYNLINK_FUNCTIONS  \
+    DYNLINK_FUNC(int,XDefaultScreen,(Display*)) \
+    DYNLINK_FUNC(int,XDisplayWidth,(Display*,int)) \
+    DYNLINK_FUNC(int,XDisplayWidthMM,(Display*,int)) \
+    DYNLINK_FUNC(int,XDisplayHeight,(Display*,int)) \
+    DYNLINK_FUNC(int,XDisplayHeightMM,(Display*,int)) \
+
+#define  DYNLINK_FUNCTIONS_INIT \
+    x11_dynlink_init
+
+#include "dynlink.h"
+
+static int    x11_lib_inited;
+static void*  x11_lib;
+
+int
+x11_lib_init( void )
+{
+    if (!x11_lib_inited) {
+        x11_lib_inited = 1;
+
+        x11_lib = dlopen( "libX11.so", RTLD_NOW );
+
+        if (x11_lib == NULL) {
+            x11_lib = dlopen( "libX11.so.6", RTLD_NOW );
+        }
+        if (x11_lib == NULL) {
+            D("%s: Could not find libX11.so on this machine",
+              __FUNCTION__);
+            return -1;
+        }
+
+        if (x11_dynlink_init(x11_lib) < 0) {
+            D("%s: didn't find necessary symbols in libX11.so",
+              __FUNCTION__);
+            dlclose(x11_lib);
+            x11_lib = NULL;
+        }
+    }
+    return x11_lib ? 0 : -1;
+}
+
+
+int
+get_monitor_resolution( int  *px_dpi, int  *py_dpi )
+{
+    SDL_SysWMinfo info;
+    Display*      display;
+    int           screen;
+    int           width, width_mm, height, height_mm, xdpi, ydpi;
+
+    SDL_VERSION(&info.version);
+
+    if ( !SDL_GetWMInfo(&info) ) {
+        D( "%s: SDL_GetWMInfo() failed: %s", __FUNCTION__, SDL_GetError());
+        return -1;
+    }
+
+    if (x11_lib_init() < 0)
+        return -1;
+
+    display = info.info.x11.display;
+    screen  = FF(XDefaultScreen)(display);
+
+    width     = FF(XDisplayWidth)(display, screen);
+    width_mm  = FF(XDisplayWidthMM)(display, screen);
+    height    = FF(XDisplayHeight)(display, screen);
+    height_mm = FF(XDisplayHeightMM)(display, screen);
+
+    if (width_mm <= 0 || height_mm <= 0) {
+        D( "%s: bad screen dimensions: width_mm = %d, height_mm = %d",
+                __FUNCTION__, width_mm, height_mm);
+        return -1;
+    }
+
+    D( "%s: found screen width=%d height=%d width_mm=%d height_mm=%d",
+            __FUNCTION__, width, height, width_mm, height_mm );
+
+    xdpi = width  * MM_PER_INCH / width_mm;
+    ydpi = height * MM_PER_INCH / height_mm;
+
+    if (xdpi < 20 || xdpi > 400 || ydpi < 20 || ydpi > 400) {
+        D( "%s: bad resolution: xpi=%d ydpi=%d", __FUNCTION__,
+                xdpi, ydpi );
+        return -1;
+    }
+
+    *px_dpi = xdpi;
+    *py_dpi = ydpi;
+
+    return 0;
+}
+
+int
+get_nearest_monitor_rect( int  *x, int *y, int  *width, int  *height )
+{
+    SDL_SysWMinfo info;
+    Display*      display;
+    int           screen;
+
+    SDL_VERSION(&info.version);
+
+    if ( !SDL_GetWMInfo(&info) ) {
+        D( "%s: SDL_GetWMInfo() failed: %s", __FUNCTION__, SDL_GetError());
+        return -1;
+    }
+
+    if (x11_lib_init() < 0)
+        return -1;
+
+    display = info.info.x11.display;
+    screen  = FF(XDefaultScreen)(display);
+
+    *x      = 0;
+    *y      = 0;
+    *width  = FF(XDisplayWidth)(display, screen);
+    *height = FF(XDisplayHeight)(display, screen);
+
+    D("%s: found (x,y,w,h)=(%d,%d,%d,%d)", __FUNCTION__,
+      *x, *y, *width, *height);
+
+    return 0;
+}
+
+#endif
diff --git a/android/utils/display.h b/android/utils/display.h
new file mode 100644
index 0000000..7254aca
--- /dev/null
+++ b/android/utils/display.h
@@ -0,0 +1,31 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#ifndef _ANDROID_UTILS_DISPLAY_H
+#define _ANDROID_UTILS_DISPLAY_H
+
+/** HOST RESOLUTION SETTINGS
+ **
+ ** return the main monitor's DPI resolution according to the host device
+ ** beware: this is not always reliable or even obtainable.
+ **
+ ** returns 0 on success, or -1 in case of error (e.g. the system returns funky values)
+ **/
+extern  int    get_monitor_resolution( int  *px_dpi, int  *py_dpi );
+
+/** return the size in pixels of the nearest monitor for the current window.
+ ** this is used to implement full-screen presentation mode.
+ **/
+
+extern  int    get_nearest_monitor_rect( int  *x, int *y, int *width, int *height );
+
+#endif /* _ANDROID_UTILS_DISPLAY_H */
diff --git a/android/utils/filelock.c b/android/utils/filelock.c
new file mode 100644
index 0000000..a8b18da
--- /dev/null
+++ b/android/utils/filelock.c
@@ -0,0 +1,414 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#include "android/utils/filelock.h"
+#include "android/utils/path.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <fcntl.h>
+#ifdef _WIN32
+#  include <process.h>
+#  include <windows.h>
+#  include <tlhelp32.h>
+#else
+#  include <sys/types.h>
+#  include <unistd.h>
+#  include <signal.h>
+#endif
+
+#define  D(...)  ((void)0)
+
+#ifndef CHECKED
+#  ifdef _WIN32
+#    define   CHECKED(ret, call)    (ret) = (call)
+#  else
+#    define   CHECKED(ret, call)    do { (ret) = (call); } while ((ret) < 0 && errno == EINTR)
+#  endif
+#endif
+
+/** FILE LOCKS SUPPORT
+ **
+ ** a FileLock is useful to prevent several emulator instances from using the same
+ ** writable file (e.g. the userdata.img disk images).
+ **
+ ** create a FileLock object with filelock_create(), ithis function should return NULL
+ ** only if the corresponding file path could not be locked.
+ **
+ ** all file locks are automatically released and destroyed when the program exits.
+ ** the filelock_lock() function can also detect stale file locks that can linger
+ ** when the emulator crashes unexpectedly, and will happily clean them for you
+ **
+ **  here's how it works, three files are used:
+ **     file  - the data file accessed by the emulator
+ **     lock  - a lock file  (file + '.lock')
+ **     temp  - a temporary file make unique with mkstemp
+ **
+ **  when locking:
+ **      create 'temp' and store our pid in it
+ **      attemp to link 'lock' to 'temp'
+ **         if the link succeeds, we obtain the lock
+ **      unlink 'temp'
+ **
+ **  when unlocking:
+ **      unlink 'lock'
+ **
+ **
+ **  on Windows, 'lock' is a directory name. locking is equivalent to
+ **  creating it...
+ **
+ **/
+
+struct FileLock
+{
+  const char*  file;
+  const char*  lock;
+  char*        temp;
+  int          locked;
+  FileLock*    next;
+};
+
+/* used to cleanup all locks at emulator exit */
+static FileLock*   _all_filelocks;
+
+
+#define  LOCK_NAME   ".lock"
+#define  TEMP_NAME   ".tmp-XXXXXX"
+
+#ifdef _WIN32
+#define  PIDFILE_NAME  "pid"
+#endif
+
+/* returns 0 on success, -1 on failure */
+static int
+filelock_lock( FileLock*  lock )
+{
+    int    ret;
+#ifdef _WIN32
+    int  pidfile_fd = -1;
+
+    ret = _mkdir( lock->lock );
+    if (ret < 0) {
+        if (errno == ENOENT) {
+            D( "could not access directory '%s', check path elements", lock->lock );
+            return -1;
+        } else if (errno != EEXIST) {
+            D( "_mkdir(%s): %s", lock->lock, strerror(errno) );
+            return -1;
+        }
+
+        /* if we get here, it's because the .lock directory already exists */
+        /* check to see if there is a pid file in it                       */
+        D("directory '%s' already exist, waiting a bit to ensure that no other emulator instance is starting", lock->lock );
+        {
+            int  _sleep = 200;
+            int  tries;
+
+            for ( tries = 4; tries > 0; tries-- )
+            {
+                pidfile_fd = open( lock->temp, O_RDONLY );
+
+                if (pidfile_fd >= 0)
+                    break;
+
+                Sleep( _sleep );
+                _sleep *= 2;
+            }
+        }
+
+        if (pidfile_fd < 0) {
+            D( "no pid file in '%s', assuming stale directory", lock->lock );
+        }
+        else
+        {
+            /* read the pidfile, and check wether the corresponding process is still running */
+            char            buf[16];
+            int             len, lockpid;
+            HANDLE          processSnapshot;
+            PROCESSENTRY32  pe32;
+            int             is_locked = 0;
+
+            len = read( pidfile_fd, buf, sizeof(buf)-1 );
+            if (len < 0) {
+                D( "could not read pid file '%s'", lock->temp );
+                close( pidfile_fd );
+                return -1;
+            }
+            buf[len] = 0;
+            lockpid  = atoi(buf);
+
+            /* PID 0 is the IDLE process, and 0 is returned in case of invalid input */
+            if (lockpid == 0)
+                lockpid = -1;
+
+            close( pidfile_fd );
+
+            pe32.dwSize     = sizeof( PROCESSENTRY32 );
+            processSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
+
+            if ( processSnapshot == INVALID_HANDLE_VALUE ) {
+                D( "could not retrieve the list of currently active processes\n" );
+                is_locked = 1;
+            }
+            else if ( !Process32First( processSnapshot, &pe32 ) )
+            {
+                D( "could not retrieve first process id\n" );
+                CloseHandle( processSnapshot );
+                is_locked = 1;
+            }
+            else
+            {
+                do {
+                    if (pe32.th32ProcessID == lockpid) {
+                        is_locked = 1;
+                        break;
+                    }
+                } while (Process32Next( processSnapshot, &pe32 ) );
+
+                CloseHandle( processSnapshot );
+            }
+
+            if (is_locked) {
+                D( "the file '%s' is locked by process ID %d\n", lock->file, lockpid );
+                return -1;
+            }
+        }
+    }
+
+    /* write our PID into the pid file */
+    pidfile_fd = open( lock->temp, O_WRONLY | O_CREAT | O_TRUNC );
+    if (pidfile_fd < 0) {
+        if (errno == EACCES) {
+            if ( path_delete_file( lock->temp ) < 0 ) {
+                D( "could not remove '%s': %s\n", lock->temp, strerror(errno) );
+                return -1;
+            }
+            pidfile_fd = open( lock->temp, O_WRONLY | O_CREAT | O_TRUNC );
+        }
+        if (pidfile_fd < 0) {
+            D( "could not create '%s': %s\n", lock->temp, strerror(errno) );
+            return -1;
+        }
+    }
+
+    {
+        char  buf[16];
+        sprintf( buf, "%ld", GetCurrentProcessId() );
+        ret = write( pidfile_fd, buf, strlen(buf) );
+        close(pidfile_fd);
+        if (ret < 0) {
+            D( "could not write PID to '%s'\n", lock->temp );
+            return -1;
+        }
+    }
+
+    lock->locked = 1;
+    return 0;
+#else
+    int    temp_fd = -1;
+    int    lock_fd = -1;
+    int    rc, tries, _sleep;
+    FILE*  f = NULL;
+    char   pid[8];
+    struct stat  st_temp;
+
+    strcpy( lock->temp, lock->file );
+    strcat( lock->temp, TEMP_NAME );
+    temp_fd = mkstemp( lock->temp );
+
+    if (temp_fd < 0) {
+        D("cannot create locking temp file '%s'", lock->temp );
+        goto Fail;
+    }
+
+    sprintf( pid, "%d", getpid() );
+    ret = write( temp_fd, pid, strlen(pid)+1 );
+    if (ret < 0) {
+        D( "cannot write to locking temp file '%s'", lock->temp);
+        goto Fail;
+    }
+    close( temp_fd );
+    temp_fd = -1;
+
+    CHECKED(rc, lstat( lock->temp, &st_temp ));
+    if (rc < 0) {
+        D( "can't properly stat our locking temp file '%s'", lock->temp );
+        goto Fail;
+    }
+
+    /* now attempt to link the temp file to the lock file */
+    _sleep = 0;
+    for ( tries = 4; tries > 0; tries-- )
+    {
+        struct stat  st_lock;
+        int          rc;
+
+        if (_sleep > 0) {
+            if (_sleep > 2000000) {
+                D( "cannot acquire lock file '%s'", lock->lock );
+                goto Fail;
+            }
+            usleep( _sleep );
+        }
+        _sleep += 200000;
+
+        /* the return value of link() is buggy on NFS */
+        CHECKED(rc, link( lock->temp, lock->lock ));
+
+        CHECKED(rc, lstat( lock->lock, &st_lock ));
+        if (rc == 0 &&
+            st_temp.st_rdev == st_lock.st_rdev &&
+            st_temp.st_ino  == st_lock.st_ino  )
+        {
+            /* SUCCESS */
+            lock->locked = 1;
+            CHECKED(rc, unlink( lock->temp ));
+            return 0;
+        }
+
+        /* if we get there, it means that the link() call failed */
+        /* check the lockfile to see if it is stale              */
+        if (rc == 0) {
+            char    buf[16];
+            time_t  now;
+            int     lockpid = 0;
+            int     lockfd;
+            int     stale = 2;  /* means don't know */
+            struct stat  st;
+
+            CHECKED(rc, time( &now));
+            st.st_mtime = now - 120;
+
+            CHECKED(lockfd, open( lock->lock,O_RDONLY ));
+            if ( lockfd >= 0 ) {
+                int  len;
+
+                CHECKED(len, read( lockfd, buf, sizeof(buf)-1 ));
+                buf[len] = 0;
+                lockpid = atoi(buf);
+
+                CHECKED(rc, fstat( lockfd, &st ));
+                if (rc == 0)
+                  now = st.st_atime;
+
+                CHECKED(rc, close(lockfd));
+            }
+            /* if there is a PID, check that it is still alive */
+            if (lockpid > 0) {
+                CHECKED(rc, kill( lockpid, 0 ));
+                if (rc == 0 || errno == EPERM) {
+                    stale = 0;
+                } else if (rc < 0 && errno == ESRCH) {
+                    stale = 1;
+                }
+            }
+            if (stale == 2) {
+                /* no pid, stale if the file is older than 1 minute */
+                stale = (now >= st.st_mtime + 60);
+            }
+
+            if (stale) {
+                D( "removing stale lockfile '%s'", lock->lock );
+                CHECKED(rc, unlink( lock->lock ));
+                _sleep = 0;
+                tries++;
+            }
+        }
+    }
+    D("file '%s' is already in use by another process", lock->file );
+
+Fail:
+    if (f)
+        fclose(f);
+
+    if (temp_fd >= 0) {
+        close(temp_fd);
+    }
+
+    if (lock_fd >= 0) {
+        close(lock_fd);
+    }
+
+    unlink( lock->lock );
+    unlink( lock->temp );
+    return -1;
+#endif
+}
+
+void
+filelock_release( FileLock*  lock )
+{
+    if (lock->locked) {
+#ifdef _WIN32
+        path_delete_file( (char*)lock->temp );
+        rmdir( (char*)lock->lock );
+#else
+        unlink( (char*)lock->lock );
+#endif
+        lock->locked = 0;
+    }
+}
+
+static void
+filelock_atexit( void )
+{
+  FileLock*  lock;
+
+  for (lock = _all_filelocks; lock != NULL; lock = lock->next)
+     filelock_release( lock );
+}
+
+/* create a file lock */
+FileLock*
+filelock_create( const char*  file )
+{
+    int    file_len = strlen(file);
+    int    lock_len = file_len + sizeof(LOCK_NAME);
+#ifdef _WIN32
+    int    temp_len = lock_len + 1 + sizeof(PIDFILE_NAME);
+#else
+    int    temp_len = file_len + sizeof(TEMP_NAME);
+#endif
+    int    total_len = sizeof(FileLock) + file_len + lock_len + temp_len + 3;
+
+    FileLock*  lock = malloc(total_len);
+
+    lock->file = (const char*)(lock + 1);
+    memcpy( (char*)lock->file, file, file_len+1 );
+
+    lock->lock = lock->file + file_len + 1;
+    memcpy( (char*)lock->lock, file, file_len+1 );
+    strcat( (char*)lock->lock, LOCK_NAME );
+
+    lock->temp    = (char*)lock->lock + lock_len + 1;
+#ifdef _WIN32
+    snprintf( (char*)lock->temp, temp_len, "%s\\" PIDFILE_NAME, lock->lock );
+#else
+    lock->temp[0] = 0;
+#endif
+    lock->locked = 0;
+
+    if (filelock_lock(lock) < 0) {
+        free(lock);
+        return NULL;
+    }
+
+    lock->next     = _all_filelocks;
+    _all_filelocks = lock;
+
+    if (lock->next == NULL)
+        atexit( filelock_atexit );
+
+    return lock;
+}
diff --git a/android/utils/filelock.h b/android/utils/filelock.h
new file mode 100644
index 0000000..9bc86b5
--- /dev/null
+++ b/android/utils/filelock.h
@@ -0,0 +1,38 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#ifndef _ANDROID_UTILS_FILELOCK_H
+#define _ANDROID_UTILS_FILELOCK_H
+
+/** FILE LOCKS SUPPORT
+ **
+ ** a FileLock is useful to prevent several emulator instances from using the same
+ ** writable file (e.g. the userdata.img disk images).
+ **
+ ** create a FileLock object with filelock_create(), the function will return
+ ** NULL only if the corresponding path is already locked by another emulator
+ ** of if the path is read-only.
+ **
+ ** note that 'path' can designate a non-existing path and that the lock creation
+ ** function can detect stale file locks that can longer when the emulator
+ ** crashes unexpectedly, and will happily clean them for you.
+ **
+ ** you can call filelock_release() to release a file lock explicitely. otherwise
+ ** all file locks are automatically released when the program exits.
+ **/
+
+typedef struct FileLock  FileLock;
+
+extern FileLock*  filelock_create ( const char*  path );
+extern void       filelock_release( FileLock*  lock );
+
+#endif /* _ANDROID_UTILS_FILELOCK_H */
diff --git a/android/utils/ini.c b/android/utils/ini.c
index 98355d4..56e40f2 100644
--- a/android/utils/ini.c
+++ b/android/utils/ini.c
@@ -15,12 +15,13 @@
 #include <string.h>
 #include <limits.h>
 #include <errno.h>
-#include "android_debug.h"
+#include "android/utils/debug.h"
+#include "android/utils/system.h" /* for ASTRDUP */
 #include "osdep.h"
 
 /* W() is used to print warnings, D() to print debugging info */
 #define  W(...)   dwarning(__VA_ARGS__)
-#define  D(...)   VERBOSE_PRINT(vm_config,__VA_ARGS__)
+#define  D(...)   VERBOSE_PRINT(avd_config,__VA_ARGS__)
 
 /* a simple .ini file parser and container for Android
  * no sections support. see android/utils/ini.h for
@@ -42,18 +43,20 @@ iniFile_free( IniFile*  i )
 {
     int  nn;
     for (nn = 0; nn < i->numPairs; nn++) {
-        free(i->pairs[nn].key);
+        AFREE(i->pairs[nn].key);
         i->pairs[nn].key   = NULL;
         i->pairs[nn].value = NULL;
     }
-    free(i->pairs);
-    free(i);
+    AFREE(i->pairs);
+    AFREE(i);
 }
 
 static IniFile*
 iniFile_alloc( void )
 {
-    IniFile*  i = calloc(1, sizeof(*i));
+    IniFile*  i;
+
+    ANEW0(i);
     return i;
 }
 
@@ -64,17 +67,16 @@ iniFile_addPair( IniFile*  i, const char*  key,   int  keyLen,
     IniPair*  pair;
 
     if (i->numPairs >= i->maxPairs) {
-        int       oldMax   = i->maxPairs;
-        int       newMax   = oldMax + (oldMax >> 1) + 4;
-        IniPair*  newPairs = realloc(i->pairs, newMax*sizeof(newPairs[0]));
+        int       oldMax = i->maxPairs;
+        int       newMax = oldMax + (oldMax >> 1) + 4;
 
-        i->pairs    = newPairs;
+        AARRAY_RENEW(i->pairs, newMax);
         i->maxPairs = newMax;
     }
 
     pair = i->pairs + i->numPairs;
 
-    pair->key   = malloc(keyLen + valueLen + 2);
+    AARRAY_NEW(pair->key, keyLen + valueLen + 2);
     memcpy(pair->key, key, keyLen);
     pair->key[keyLen] = 0;
 
@@ -269,12 +271,12 @@ iniFile_newFromFile( const char*  filepath )
     }
 
     /* read the file, add a sentinel at the end of it */
-    text = malloc(size+1);
+    AARRAY_NEW(text, size+1);
     fread(text, 1, size, fp);
     text[size] = 0;
 
     ini = iniFile_newFromMemory(text, filepath);
-    free(text);
+    AFREE(text);
 
 EXIT:
     fclose(fp);
@@ -289,7 +291,7 @@ iniFile_getString( IniFile*  f, const char*  key )
     if (!val)
         return NULL;
 
-    return qemu_strdup(val);
+    return ASTRDUP(val);
 }
 
 int
@@ -345,8 +347,8 @@ iniFile_getBoolean( IniFile*  f, const char*  key, const char*  defaultValue )
 int64_t
 iniFile_getDiskSize( IniFile*  f, const char*  key, const char*  defaultValue )
 {
-    const char*    valStr = iniFile_getValue(f, key);
-    int64_t        value  = 0;
+    const char*  valStr = iniFile_getValue(f, key);
+    int64_t      value  = 0;
 
     if (!valStr)
         valStr = defaultValue;
@@ -364,3 +366,21 @@ iniFile_getDiskSize( IniFile*  f, const char*  key, const char*  defaultValue )
     }
     return value;
 }
+
+int64_t
+iniFile_getInt64( IniFile*  f, const char*  key, int64_t  defaultValue )
+{
+    const char*  valStr = iniFile_getValue(f, key);
+    int64_t      value  = defaultValue;
+
+    if (valStr != NULL) {
+        char*    end;
+        int64_t  d;
+
+        d = strtoll(valStr, &end, 10);
+        if (end != NULL && end[0] == 0)
+            value = d;
+    }
+    return value;
+}
+
diff --git a/android/utils/ini.h b/android/utils/ini.h
index ad6b36a..bc8193e 100644
--- a/android/utils/ini.h
+++ b/android/utils/ini.h
@@ -93,6 +93,11 @@ char*   iniFile_getString( IniFile*  f, const char*  key );
  */
 int     iniFile_getInteger( IniFile*  f, const char*  key, int  defaultValue );
 
+/* returns a 64-bit integer value, or a default in case the value string is
+ * missing or badly formatted
+ */
+int64_t iniFile_getInt64( IniFile*  f, const char*  key, int64_t  defaultValue );
+
 /* returns a double value, or a default in case the value string is
  * missing or badly formatted
  */
diff --git a/android/utils/misc.c b/android/utils/misc.c
new file mode 100644
index 0000000..818ab78
--- /dev/null
+++ b/android/utils/misc.c
@@ -0,0 +1,193 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#include "android/utils/misc.h"
+#include "android/utils/stralloc.h"
+#include "android/utils/debug.h"
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+extern void
+print_tabular( const char** strings, int  count,
+               const char*  prefix,  int  width )
+{
+    int  nrows, ncols, r, c, n, maxw = 0;
+
+    for (n = 0; n < count; n++) {
+        int  len = strlen(strings[n]);
+        if (len > maxw)
+            maxw = len;
+    }
+    maxw += 2;
+    ncols = width/maxw;
+    nrows = (count + ncols-1)/ncols;
+
+    for (r = 0; r < nrows; r++) {
+        printf( "%s", prefix );
+        for (c = 0; c < ncols; c++) {
+            int  index = c*nrows + r;
+            if (index >= count) {
+                break;
+            }
+            printf( "%-*s", maxw, strings[index] );
+        }
+        printf( "\n" );
+    }
+}
+
+extern void
+string_translate_char( char*  str, char from, char to )
+{
+    char*  p = str;
+    while (p != NULL && (p = strchr(p, from)) != NULL)
+        *p++ = to;
+}
+
+extern void
+buffer_translate_char( char*        buff,
+                       unsigned     buffLen,
+                       const char*  src,
+                       char         fromChar,
+                       char         toChar )
+{
+    int    len = strlen(src);
+
+    if (len >= buffLen)
+        len = buffLen-1;
+
+    memcpy(buff, src, len);
+    buff[len] = 0;
+
+    string_translate_char( buff, fromChar, toChar );
+}
+
+
+/** TEMP CHAR STRINGS
+ **
+ ** implement a circular ring of temporary string buffers
+ **/
+
+typedef struct Temptring {
+    struct TempString*  next;
+    char*               buffer;
+    int                 size;
+} TempString;
+
+#define  MAX_TEMP_STRINGS   16
+
+static TempString  _temp_strings[ MAX_TEMP_STRINGS ];
+static int         _temp_string_n;
+
+extern char*
+tempstr_get( int  size )
+{
+    TempString*  t = &_temp_strings[_temp_string_n];
+
+    if ( ++_temp_string_n >= MAX_TEMP_STRINGS )
+        _temp_string_n = 0;
+
+    size += 1;  /* reserve 1 char for terminating zero */
+
+    if (t->size < size) {
+        t->buffer = realloc( t->buffer, size );
+        if (t->buffer == NULL) {
+            derror( "%s: could not allocate %d bytes",
+                    __FUNCTION__, size );
+            exit(1);
+        }
+        t->size   = size;
+    }
+    return  t->buffer;
+}
+
+extern char*
+tempstr_format( const char*  fmt, ... )
+{
+    va_list  args;
+    char*    result;
+    STRALLOC_DEFINE(s);
+    va_start(args, fmt);
+    stralloc_formatv(s, fmt, args);
+    va_end(args);
+    result = stralloc_to_tempstr(s);
+    stralloc_reset(s);
+    return result;
+}
+
+/** QUOTING
+ **
+ ** dumps a human-readable version of a string. this replaces
+ ** newlines with \n, etc...
+ **/
+
+extern const char*
+quote_bytes( const char*  str, int  len )
+{
+    STRALLOC_DEFINE(s);
+    char*  q;
+
+    stralloc_add_quote_bytes( s, str, len );
+    q = stralloc_to_tempstr( s );
+    stralloc_reset(s);
+    return q;
+}
+
+extern const char*
+quote_str( const char*  str )
+{
+    int  len = strlen(str);
+    return quote_bytes( str, len );
+}
+
+/** HEXADECIMAL CHARACTER SEQUENCES
+ **/
+
+static int
+hexdigit( int  c )
+{
+    unsigned  d;
+
+    d = (unsigned)(c - '0');
+    if (d < 10) return d;
+
+    d = (unsigned)(c - 'a');
+    if (d < 6) return d+10;
+
+    d = (unsigned)(c - 'A');
+    if (d < 6) return d+10;
+
+    return -1;
+}
+
+int
+hex2int( const uint8_t*  hex, int  len )
+{
+    int  result = 0;
+    while (len > 0) {
+        int  c = hexdigit(*hex++);
+        if (c < 0)
+            return -1;
+
+        result = (result << 4) | c;
+        len --;
+    }
+    return result;
+}
+
+void
+int2hex( uint8_t*  hex, int  len, int  val )
+{
+    static const uint8_t  hexchars[16] = "0123456789abcdef";
+    while ( --len >= 0 )
+        *hex++ = hexchars[(val >> (len*4)) & 15];
+}
diff --git a/android/utils/misc.h b/android/utils/misc.h
new file mode 100644
index 0000000..0db1e28
--- /dev/null
+++ b/android/utils/misc.h
@@ -0,0 +1,67 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+#ifndef _ANDROID_UTILS_MISC_H
+#define _ANDROID_UTILS_MISC_H
+
+#include <stdint.h>
+
+/** TABULAR OUTPUT
+ **
+ ** prints a list of strings in row/column format
+ **
+ **/
+
+extern void   print_tabular( const char** strings, int  count,
+                             const char*  prefix,  int  width );
+
+/** CHARACTER TRANSLATION
+ **
+ ** converts one character into another in strings
+ **/
+
+extern void   buffer_translate_char( char*        buff,
+                                     unsigned     buffLen,
+                                     const char*  src,
+                                     char         fromChar,
+                                     char         toChar );
+
+extern void   string_translate_char( char*  str, char from, char to );
+
+/** TEMP CHAR STRINGS
+ **
+ ** implement a circular ring of temporary string buffers
+ **/
+
+extern char*  tempstr_get( int   size );
+extern char*  tempstr_format( const char*  fmt, ... );
+
+/** QUOTING
+ **
+ ** dumps a human-readable version of a string. this replaces
+ ** newlines with \n, etc...
+ **/
+
+extern const char*   quote_bytes( const char*  str, int  len );
+extern const char*   quote_str( const char*  str );
+
+/** DECIMAL AND HEXADECIMAL CHARACTER SEQUENCES
+ **/
+
+/* decodes a sequence of 'len' hexadecimal chars from 'hex' into
+ * an integer. returns -1 in case of error (i.e. badly formed chars)
+ */
+extern int    hex2int( const uint8_t*  hex, int  len );
+
+/* encodes an integer 'val' into 'len' hexadecimal charaters into 'hex' */
+extern void   int2hex( uint8_t*  hex, int  len, int  val );
+
+#endif /* _ANDROID_UTILS_MISC_H */
diff --git a/android/utils/path.c b/android/utils/path.c
new file mode 100644
index 0000000..9dd238e
--- /dev/null
+++ b/android/utils/path.c
@@ -0,0 +1,430 @@
+/* Copyright (C) 2007-2009 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+#include "android/utils/path.h"
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <fcntl.h>
+
+#ifdef _WIN32
+#include <process.h>
+#include <shlobj.h>
+#include <tlhelp32.h>
+#include <io.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <stdint.h>
+#include <limits.h>
+#include <winbase.h>
+#else
+#include <unistd.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <signal.h>
+#endif
+
+#define  D(...)  ((void)0)
+
+#ifndef CHECKED
+#  ifdef _WIN32
+#    define   CHECKED(ret, call)    (ret) = (call)
+#  else
+#    define   CHECKED(ret, call)    do { (ret) = (call); } while ((ret) < 0 && errno == EINTR)
+#  endif
+#endif
+
+/** PATH HANDLING ROUTINES
+ **
+ **  path_parent() can be used to return the n-level parent of a given directory
+ **  this understands . and .. when encountered in the input path
+ **/
+
+static __inline__ int
+ispathsep(int  c)
+{
+#ifdef _WIN32
+    return (c == '/' || c == '\\');
+#else
+    return (c == '/');
+#endif
+}
+
+char*
+path_parent( const char*  path, int  levels )
+{
+    const char*  end = path + strlen(path);
+    char*        result;
+
+    while (levels > 0) {
+        const char*  base;
+
+        /* trim any trailing path separator */
+        while (end > path && ispathsep(end[-1]))
+            end--;
+
+        base = end;
+        while (base > path && !ispathsep(base[-1]))
+            base--;
+
+        if (base <= path) /* we can't go that far */
+            return NULL;
+
+        if (end == base+1 && base[0] == '.')
+            goto Next;
+
+        if (end == base+2 && base[0] == '.' && base[1] == '.') {
+            levels += 1;
+            goto Next;
+        }
+
+        levels -= 1;
+
+    Next:
+        end = base - 1;
+    }
+    result = malloc( end-path+1 );
+    if (result != NULL) {
+        memcpy( result, path, end-path );
+        result[end-path] = 0;
+    }
+    return result;
+}
+
+
+/** MISC FILE AND DIRECTORY HANDLING
+ **/
+
+ABool
+path_exists( const char*  path )
+{
+    int  ret;
+    CHECKED(ret, access(path, F_OK));
+    return (ret == 0) || (errno != ENOENT);
+}
+
+/* checks that a path points to a regular file */
+ABool
+path_is_regular( const char*  path )
+{
+    int          ret;
+    struct stat  st;
+
+    CHECKED(ret, stat(path, &st));
+    if (ret < 0)
+        return 0;
+
+    return S_ISREG(st.st_mode);
+}
+
+
+/* checks that a path points to a directory */
+ABool
+path_is_dir( const char*  path )
+{
+    int          ret;
+    struct stat  st;
+
+    CHECKED(ret, stat(path, &st));
+    if (ret < 0)
+        return 0;
+
+    return S_ISDIR(st.st_mode);
+}
+
+/* checks that one can read/write a given (regular) file */
+ABool
+path_can_read( const char*  path )
+{
+    int  ret;
+    CHECKED(ret, access(path, R_OK));
+    return (ret == 0);
+}
+
+ABool
+path_can_write( const char*  path )
+{
+    int  ret;
+    CHECKED(ret, access(path, R_OK));
+    return (ret == 0);
+}
+
+/* try to make a directory. returns 0 on success, -1 on failure
+ * (error code in errno) */
+APosixStatus
+path_mkdir( const char*  path, int  mode )
+{
+#ifdef _WIN32
+    (void)mode;
+    return _mkdir(path);
+#else
+    int  ret;
+    CHECKED(ret, mkdir(path, mode));
+    return ret;
+#endif
+}
+
+static APosixStatus
+path_mkdir_recursive( char*  path, unsigned  len, int  mode )
+{
+    char      old_c;
+    int       ret;
+    unsigned  len2;
+
+    /* get rid of trailing separators */
+    while (len > 0 && ispathsep(path[len-1]))
+        len -= 1;
+
+    if (len == 0) {
+        errno = ENOENT;
+        return -1;
+    }
+
+    /* check that the parent exists, 'len2' is the length of
+     * the parent part of the path */
+    len2 = len-1;
+    while (len2 > 0 && !ispathsep(path[len2-1]))
+        len2 -= 1;
+
+    if (len2 > 0) {
+        old_c      = path[len2];
+        path[len2] = 0;
+        ret        = 0;
+        if ( !path_exists(path) ) {
+            /* the parent doesn't exist, so try to create it */
+            ret = path_mkdir_recursive( path, len2, mode );
+        }
+        path[len2] = old_c;
+
+        if (ret < 0)
+            return ret;
+    }
+
+    /* at this point, we now the parent exists */
+    old_c     = path[len];
+    path[len] = 0;
+    ret       = path_mkdir( path, mode );
+    path[len] = old_c;
+
+    return ret;
+}
+
+/* ensure that a given directory exists, create it if not, 
+   0 on success, -1 on failure (error code in errno) */
+APosixStatus
+path_mkdir_if_needed( const char*  path, int  mode )
+{
+    int  ret = 0;
+
+    if (!path_exists(path)) {
+        ret = path_mkdir(path, mode);
+
+        if (ret < 0 && errno == ENOENT) {
+            char      temp[MAX_PATH];
+            unsigned  len = (unsigned)strlen(path);
+
+            if (len > sizeof(temp)-1) {
+                errno = EINVAL;
+                return -1;
+            }
+            memcpy( temp, path, len );
+            temp[len] = 0;
+
+            return path_mkdir_recursive(temp, len, mode);
+        }
+    }
+    return ret;
+}
+
+/* return the size of a given file in '*psize'. returns 0 on
+ * success, -1 on failure (error code in errno) */
+APosixStatus
+path_get_size( const char*  path, uint64_t  *psize )
+{
+#ifdef _WIN32
+    /* avoid _stat64 which is only defined in MSVCRT.DLL, not CRTDLL.DLL */
+    /* do not use OpenFile() because it has strange search behaviour that could */
+    /* result in getting the size of a different file */
+    LARGE_INTEGER  size;
+    HANDLE  file = CreateFile( /* lpFilename */        path,
+                               /* dwDesiredAccess */   GENERIC_READ,    
+                               /* dwSharedMode */     FILE_SHARE_READ|FILE_SHARE_WRITE, 
+                               /* lpSecurityAttributes */  NULL, 
+                               /* dwCreationDisposition */ OPEN_EXISTING,
+                               /* dwFlagsAndAttributes */  0,
+                               /* hTemplateFile */      NULL );
+    if (file == INVALID_HANDLE_VALUE) {
+        /* ok, just to play fair */
+        errno = ENOENT;
+        return -1;
+    }
+    if (!GetFileSizeEx(file, &size)) {
+        /* maybe we tried to get the size of a pipe or something like that ? */
+        *psize = 0;
+    }
+    else {
+        *psize = (uint64_t) size.QuadPart;
+    }
+    CloseHandle(file);
+    return 0;
+#else
+    int    ret;
+    struct stat  st;
+
+    CHECKED(ret, stat(path, &st));
+    if (ret == 0) {
+        *psize = (uint64_t) st.st_size;
+    }
+    return ret;
+#endif
+}
+
+
+/** OTHER FILE UTILITIES
+ **
+ **  path_empty_file() creates an empty file at a given path location.
+ **  if the file already exists, it is truncated without warning
+ **
+ **  path_copy_file() copies one file into another.
+ **
+ **  both functions return 0 on success, and -1 on error
+ **/
+
+APosixStatus
+path_empty_file( const char*  path )
+{
+#ifdef _WIN32
+    int  fd = _creat( path, S_IWRITE );
+#else
+    /* on Unix, only allow the owner to read/write, since the file *
+     * may contain some personal data we don't want to see exposed */
+    int  fd = creat(path, S_IRUSR | S_IWUSR);
+#endif
+    if (fd >= 0) {
+        close(fd);
+        return 0;
+    }
+    return -1;
+}
+
+APosixStatus
+path_copy_file( const char*  dest, const char*  source )
+{
+    int  fd, fs, result = -1;
+
+    /* if the destination doesn't exist, create it */
+    if ( access(source, F_OK)  < 0 ||
+         path_empty_file(dest) < 0) {
+        return -1;
+    }
+
+#ifdef _WIN32
+    fd = _open(dest, _O_RDWR | _O_BINARY);
+    fs = _open(source, _O_RDONLY |  _O_BINARY);
+#else
+    fd = creat(dest, S_IRUSR | S_IWUSR);
+    fs = open(source, S_IREAD);
+#endif
+    if (fs >= 0 && fd >= 0) {
+        char buf[4096];
+        ssize_t total = 0;
+        ssize_t n;
+        result = 0; /* success */
+        while ((n = read(fs, buf, 4096)) > 0) {
+            if (write(fd, buf, n) != n) {
+                /* write failed. Make it return -1 so that an
+                 * empty file be created. */
+                D("Failed to copy '%s' to '%s': %s (%d)",
+                       source, dest, strerror(errno), errno);
+                result = -1;
+                break;
+            }
+            total += n;
+        }
+    }
+
+    if (fs >= 0) {
+        close(fs);
+    }
+    if (fd >= 0) {
+        close(fd);
+    }
+    return result;
+}
+
+
+APosixStatus
+path_delete_file( const char*  path )
+{
+#ifdef _WIN32
+    int  ret = _unlink( path );
+    if (ret == -1 && errno == EACCES) {
+        /* a first call to _unlink will fail if the file is set read-only */
+        /* we can however try to change its mode first and call unlink    */
+        /* again...                                                       */
+        ret = _chmod( path, _S_IREAD | _S_IWRITE );
+        if (ret == 0)
+            ret = _unlink( path );
+    }
+    return ret;
+#else
+    return  unlink(path);
+#endif
+}
+
+
+void*
+path_load_file(const char *fn, size_t  *pSize)
+{
+    char*  data;
+    int    sz;
+    int    fd;
+
+    if (pSize)
+        *pSize = 0;
+
+    data   = NULL;
+
+    fd = open(fn, O_BINARY | O_RDONLY);
+    if(fd < 0) return NULL;
+
+    do {
+        sz = lseek(fd, 0, SEEK_END);
+        if(sz < 0) break;
+
+        if (pSize)
+            *pSize = (size_t) sz;
+
+        if (lseek(fd, 0, SEEK_SET) != 0)
+            break;
+
+        data = (char*) malloc(sz + 1);
+        if(data == NULL) break;
+
+        if (read(fd, data, sz) != sz)
+            break;
+
+        close(fd);
+        data[sz] = 0;
+
+        return data;
+    } while (0);
+
+    close(fd);
+
+    if(data != NULL)
+        free(data);
+
+    return NULL;
+}
+
diff --git a/android/utils/path.h b/android/utils/path.h
new file mode 100644
index 0000000..10436c6
--- /dev/null
+++ b/android/utils/path.h
@@ -0,0 +1,122 @@
+/* Copyright (C) 2007-2009 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+#ifndef _ANDROID_UTILS_PATH_H
+#define _ANDROID_UTILS_PATH_H
+
+#include <android/utils/system.h>
+#include <stdint.h>  /* for uint64_t */
+
+/** MISC FILE AND DIRECTORY HANDLING
+ **/
+
+/* O_BINARY is required in the MS C library to avoid opening file
+ * in text mode (the default, ahhhhh)
+ */
+#if !defined(_WIN32) && !defined(O_BINARY)
+#  define  O_BINARY  0
+#endif
+
+/* define  PATH_SEP as a string containing the directory separateor */
+#ifdef _WIN32
+#  define  PATH_SEP   "\\"
+#else
+#  define  PATH_SEP   "/"
+#endif
+
+/* get MAX_PATH, note that PATH_MAX is set to 260 on Windows for
+ * stupid backwards-compatibility reason, though any 32-bit version
+ * of the OS handles much much longer paths
+ */
+#ifdef _WIN32
+#  undef   MAX_PATH
+#  define  MAX_PATH    1024
+#  undef   PATH_MAX
+#  define  PATH_MAX    MAX_PATH
+#else
+#  include <limits.h>
+#  define  MAX_PATH    PATH_MAX
+#endif
+
+/* checks that a given file exists */
+extern ABool  path_exists( const char*  path );
+
+/* checks that a path points to a regular file */
+extern ABool  path_is_regular( const char*  path );
+
+/* checks that a path points to a directory */
+extern ABool  path_is_dir( const char*  path );
+
+/* checks that one can read/write a given (regular) file */
+extern ABool  path_can_read( const char*  path );
+extern ABool  path_can_write( const char*  path );
+
+/* try to make a directory */
+extern APosixStatus   path_mkdir( const char*  path, int  mode );
+
+/* ensure that a given directory exists, create it if not, 
+   0 on success, -1 on error */
+extern APosixStatus   path_mkdir_if_needed( const char*  path, int  mode );
+
+/* return the size of a given file in '*psize'. returns 0 on
+ * success, -1 on failure (error code in errno) */
+extern APosixStatus   path_get_size( const char*  path, uint64_t  *psize );
+
+/*  path_parent() can be used to return the n-level parent of a given directory
+ *  this understands . and .. when encountered in the input path.
+ *
+ *  the returned string must be freed by the caller.
+ */
+extern char*  path_parent( const char*  path, int  levels );
+
+/** OTHER FILE UTILITIES
+ **
+ **  path_empty_file() creates an empty file at a given path location.
+ **  if the file already exists, it is truncated without warning
+ **
+ **  path_copy_file() copies one file into another.
+ **
+ **  unlink_file() is equivalent to unlink() on Unix, on Windows,
+ **  it will handle the case where _unlink() fails because the file is
+ **  read-only by trying to change its access rights then calling _unlink()
+ **  again.
+ **
+ **  these functions return 0 on success, and -1 on error
+ **
+ **  load_text_file() reads a file into a heap-allocated memory block,
+ **  and appends a 0 to it. the caller must free it
+ **/
+
+/* creates an empty file at a given location. If the file already
+ * exists, it is truncated without warning. returns 0 on success,
+ * or -1 on failure.
+ */
+extern APosixStatus   path_empty_file( const char*  path );
+
+/* copies on file into another one. 0 on success, -1 on failure
+ * (error code in errno). Does not work on directories */
+extern APosixStatus   path_copy_file( const char*  dest, const char*  source );
+
+/* unlink/delete a given file. Note that on Win32, this will
+ * fail if the program has an opened handle to the file
+ */
+extern APosixStatus   path_delete_file( const char*  path );
+
+/* try to load a given file into a heap-allocated block.
+ * if 'pSize' is not NULL, this will set the file's size in '*pSize'
+ * note that this actually zero-terminates the file for convenience.
+ * In case of failure, NULL is returned and the error code is in errno
+ */
+extern void*          path_load_file( const char*  path, size_t  *pSize );
+
+/* */
+
+#endif /* _ANDROID_UTILS_PATH_H */
diff --git a/android/utils/reflist.c b/android/utils/reflist.c
new file mode 100644
index 0000000..bc604cd
--- /dev/null
+++ b/android/utils/reflist.c
@@ -0,0 +1,203 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+#include "android/utils/reflist.h"
+#include <stdlib.h>
+#include <string.h>
+
+void
+areflist_setEmpty(ARefList*  l)
+{
+    if (l->iteration > 0) {
+        /* deferred empty, set all items to NULL
+         * to stop iterations */
+        void**  items = areflist_items(l);
+        memset(items, 0, l->count*sizeof(items[0]));
+        l->iteration |= 1;
+    } else {
+        /* direct empty */
+        if (l->max > 1) {
+            free(l->u.items);
+            l->max = 1;
+        }
+    }
+    l->count = 0;
+}
+
+int
+areflist_indexOf(ARefList*  l, void*  item)
+{
+    if (item) {
+        void**  items = (l->max == 1) ? &l->u.item0 : l->u.items;
+        void**  end   = items + l->count;
+        void**  ii    = items;
+
+        for ( ; ii < end; ii += 1 )
+            if (*ii == item)
+                return (ii - items);
+    }
+    return -1;
+}
+
+static void
+areflist_grow(ARefList*  l, int  count)
+{
+    int   newcount = l->count + count;
+    if (newcount > l->max) {
+        int  oldmax = l->max == 1 ? 0 : l->max;
+        int  newmax = oldmax;
+        void**  olditems = l->max == 1 ? NULL : l->u.items;
+        void**  newitems;
+
+        while (oldmax < newcount)
+            oldmax += (oldmax >> 1) + 4;
+
+        newitems = realloc(olditems, newmax*sizeof(newitems[0]));
+
+        l->u.items = newitems;
+        l->max     = (uint16_t) newmax;
+    }
+}
+
+
+void
+areflist_add(ARefList*  l, void*  item)
+{
+    if (item) {
+        void**  items;
+
+        if (l->count >= l->max) {
+            areflist_grow(l, 1);
+        }
+        items = areflist_items(l);
+        items[l->count] = item;
+        l->count += 1;
+    }
+}
+
+void*
+areflist_pop(ARefList*  l)
+{
+    void*   item = NULL;
+    void**  items = areflist_items(l);
+
+    if (l->count > 0) {
+        if (l->iteration > 0) {
+            /* deferred deletion */
+            int  nn;
+            for (nn = l->count-1; nn > 0; nn--) {
+                item = items[nn];
+                if (item != NULL) {
+                    l->count -= 1;
+                    return item;
+                }
+            }
+        } else {
+            /* normal pop */
+            item = items[--l->count];
+            if (l->count <= 0 && l->max > 1) {
+                free(l->u.items);
+                l->max = 1;
+            }
+        }
+    }
+    return item;
+}
+
+ABool
+areflist_del(ARefList*  l, void*  item)
+{
+    if (item) {
+        int  index = areflist_indexOf(l, item);
+        if (index >= 0) {
+            void** items = areflist_items(l);
+
+            if (l->iteration > 0) {
+                /* deferred deletion */
+                items[index]  = NULL;
+                l->iteration |= 1;
+            } else {
+                /* direct deletion */
+                if (l->max > 1) {
+                    memmove(items + index, items + index + 1, l->count - index - 1);
+                    if (--l->count == 0) {
+                        free(l->u.items);
+                        l->max = 1;
+                    }
+                } else {
+                    l->u.item0 = NULL;
+                    l->count   = 0;
+                }
+            }
+            return 1;
+        }
+    }
+    return 0;
+}
+
+void
+_areflist_remove_deferred(ARefList*  l)
+{
+    if (l->iteration & 1) {
+        /* remove all NULL elements from the array */
+        void**  items = areflist_items(l);
+        int     rr = 0;
+        int     ww = 0;
+        for ( ; rr < l->count; rr++ ) {
+            if (items[rr] != NULL)
+                items[ww++] = items[rr];
+        }
+        l->count = (int16_t) ww;
+
+        /* if the list is empty, release its array */
+        if (l->count == 0 && l->max > 1) {
+            free(l->u.items);
+            l->max = 1;
+        }
+    }
+    l->iteration = 0;
+}
+
+void  
+areflist_copy(ARefList*  dst, ARefList*  src)
+{
+    dst[0] = src[0];
+
+    if (src->max > 1) {
+        dst->u.items = malloc( dst->count*sizeof(void*) );
+        dst->max     = dst->count;
+    }
+}
+
+void*
+areflist_get(ARefList*  l, int  n)
+{
+    if ((unsigned)n >= (unsigned)l->count)
+        return NULL;
+
+    if (l->max == 1)
+        return l->u.item0;
+
+    return l->u.items[n];
+}
+
+void**
+areflist_at(ARefList*  l, int  n)
+{
+    void**  items;
+
+    if ((unsigned)n >= (unsigned)l->count)
+        return NULL;
+
+    items = (l->max == 1) ? &l->u.item0 : l->u.items;
+
+    return items + n;
+}
diff --git a/android/utils/reflist.h b/android/utils/reflist.h
new file mode 100644
index 0000000..dffaef8
--- /dev/null
+++ b/android/utils/reflist.h
@@ -0,0 +1,129 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+#ifndef _ANDROID_UTILS_REFLIST_H
+#define _ANDROID_UTILS_REFLIST_H
+
+#include "android/utils/system.h"
+
+/* definitions for a smart list of references to generic objects.
+ * supports safe deletion and addition while they are being iterated
+ * with AREFLIST_FOREACH() macro
+ */
+
+typedef struct ARefList {
+    uint16_t   count, max;
+    uint16_t   iteration;
+    union {
+        struct ARefList*  next;
+        void*             item0;
+        void**            items;
+    } u;
+} ARefList;
+
+AINLINED void  
+areflist_init(ARefList*  l)
+{
+    l->count     = 0;
+    l->max       = 1;
+    l->iteration = 0;
+}
+
+void  areflist_setEmpty(ARefList*  l);
+
+AINLINED void
+areflist_done(ARefList*  l)
+{
+    areflist_setEmpty(l);
+}
+
+AINLINED ABool
+areflist_isEmpty(ARefList*  l)
+{
+    return (l->count == 0);
+}
+
+int    areflist_indexOf(ARefList*  l, void*  item);
+
+AINLINED ABool 
+areflist_has(ARefList*  l, void*  item)
+{
+    return areflist_indexOf(l, item) >= 0;
+}
+
+/* if 'item' is not NULL, append it to the list. An item
+ * can be added several times to a list */
+void    areflist_add(ARefList*  l, void*  item);
+
+/* if 'item' is not NULL, try to remove it from the list */
+/* returns TRUE iff the item was found in the list */
+ABool   areflist_del(ARefList*  l, void*  item);
+
+AINLINED void
+areflist_push(ARefList*  l, void*  item)
+{
+    areflist_add(l, item);
+}
+
+void*  areflist_pop(ARefList*  l);
+
+AINLINED void**
+areflist_items(ARefList*  l)
+{
+    return (l->max == 1) ? &l->u.item0 : l->u.items;
+}
+
+AINLINED int
+areflist_count(ARefList*  l)
+{
+    return l->count;
+}
+
+/* return a pointer to the n-th list array entry, 
+   or NULL in case of invalid index */
+void**  areflist_at(ARefList*  l, int  n);
+
+/* return the n-th array entry, or NULL in case of invalid index */
+void*   areflist_get(ARefList*  l, int  n);
+
+/* used internally */
+void    _areflist_remove_deferred(ARefList*  l);
+
+#define  AREFLIST_FOREACH(list_,item_,statement_) \
+    ({ ARefList*  _reflist   = (list_); \
+       int        _reflist_i = 0; \
+       int        _reflist_n = _reflist->count; \
+       _reflist->iteration += 2; \
+       for ( ; _reflist_i < _reflist_n; _reflist_i++ ) { \
+           void**  __reflist_at   = areflist_at(_reflist, _reflist_i); \
+           void*  item_ = *__reflist_at; \
+           if (item_ != NULL) { \
+               statement_; \
+           } \
+       } \
+       _reflist->iteration -= 2; \
+       if (_reflist->iteration == 1) \
+           _areflist_remove_deferred(_reflist); \
+    })
+
+/* use this to delete the currently iterated element */
+#define  AREFLIST_DEL_ITERATED()  \
+    ({ *_reflist_at = NULL; \
+       _reflist->iteration |= 1; })
+
+/* use this to replace the currently iterated element */
+#define  AREFLIST_SET_ITERATED(item) \
+    ({ *_reflist_at = (item); \
+       if (item == NULL) _reflist->iteration |= 1; })
+
+void  areflist_copy(ARefList*  dst, ARefList*  src);
+
+#endif /* _ANDROID_UTILS_REFLIST_H */
diff --git a/android/utils/stralloc.c b/android/utils/stralloc.c
new file mode 100644
index 0000000..2a924e4
--- /dev/null
+++ b/android/utils/stralloc.c
@@ -0,0 +1,300 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#include "android/utils/stralloc.h"
+#include "android/utils/debug.h"
+#include "android/utils/misc.h"
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <limits.h>
+
+extern void
+stralloc_tabular( stralloc_t*  out, 
+                  const char** strings, int  count,
+                  const char*  prefix,  int  width )
+{
+    int  nrows, ncols, r, c, n, maxw = 0;
+
+    for (n = 0; n < count; n++) {
+        int  len = strlen(strings[n]);
+        if (len > maxw)
+            maxw = len;
+    }
+    maxw += 2;
+    ncols = width/maxw;
+    nrows = (count + ncols-1)/ncols;
+
+    for (r = 0; r < nrows; r++) {
+        stralloc_add_str( out, prefix );
+        for (c = 0; c < ncols; c++) {
+            int  index = c*nrows + r;
+            if (index >= count) {
+                break;
+            }
+            stralloc_add_format( out, "%-*s", maxw, strings[index] );
+        }
+        stralloc_add_str( out, "\n" );
+    }
+}
+
+/** DYNAMIC STRINGS
+ **/
+
+extern void
+stralloc_reset( stralloc_t*  s )
+{
+    free(s->s);
+    s->s = NULL;
+    s->n = 0;
+    s->a = 0;
+}
+
+extern void
+stralloc_ready( stralloc_t*  s, unsigned int  len )
+{
+    unsigned  old_max = s->a;
+    unsigned  new_max = old_max;
+
+    while (new_max < len) {
+        unsigned  new_max2 = new_max + (new_max >> 1) + 16;
+        if (new_max2 < new_max)
+            new_max2 = UINT_MAX;
+        new_max = new_max2;
+    }
+
+    s->s = realloc( s->s, new_max );
+    if (s->s == NULL) {
+        derror( "%s: not enough memory to reallocate %ld bytes",
+                __FUNCTION__, new_max );
+        exit(1);
+    }
+    s->a = new_max;
+}
+
+extern void
+stralloc_readyplus( stralloc_t*  s, unsigned int  len )
+{
+    unsigned  len2 = s->n + len;
+
+    if (len2 < s->n) { /* overflow ? */
+        derror("%s: trying to grow by too many bytes: %ld",
+               __FUNCTION__, len);
+        exit(1);
+    }
+    stralloc_ready( s, len2 );
+}
+
+extern void
+stralloc_copy( stralloc_t*  s, stralloc_t*  from )
+{
+    stralloc_ready(s, from->n);
+    memcpy( s->s, from->s, from->n );
+    s->n = from->n;
+}
+
+extern void
+stralloc_append( stralloc_t*  s, stralloc_t*  from )
+{
+    stralloc_readyplus( s, from->n );
+    memcpy( s->s + s->n, from->s, from->n );
+    s->n += from->n;
+}
+
+extern void
+stralloc_add_c( stralloc_t*  s, int  c )
+{
+    stralloc_add_bytes( s, (char*)&c, 1 );
+}
+
+extern void
+stralloc_add_str( stralloc_t*  s, const char*  str )
+{
+    stralloc_add_bytes( s, str, strlen(str) );
+}
+
+extern void
+stralloc_add_bytes( stralloc_t*  s, const void*  from, unsigned len )
+{
+    stralloc_readyplus( s, len );
+    memcpy( s->s + s->n, from, len );
+    s->n += len;
+}
+
+extern char*
+stralloc_cstr( stralloc_t*  s )
+{
+    stralloc_readyplus( s, 1 );
+    s->s[s->n] = 0;
+    return s->s;
+}
+
+extern char*
+stralloc_to_tempstr( stralloc_t*  s )
+{
+    char*  q = tempstr_get( s->n );
+
+    memcpy( q, s->s, s->n );
+    q[s->n] = 0;
+    return q;
+}
+
+extern void
+stralloc_formatv( stralloc_t*  s, const char*  fmt, va_list  args )
+{
+    stralloc_reset(s);
+    stralloc_ready(s,10);
+
+    while (1) {
+        int      n;
+        va_list  args2;
+
+        va_copy(args2, args);
+        n = vsnprintf( s->s, s->a, fmt, args2 );
+        va_end(args2);
+
+        /* funky old C libraries returns -1 when truncation occurs */
+        if (n > -1 && n < s->a) {
+            s->n = n;
+            break;
+        }
+        if (n > -1) {  /* we now precisely what we need */
+            stralloc_ready( s, n+1 );
+        } else {
+            stralloc_ready( s, s->a*2 );
+        }
+    }
+}
+
+
+extern void
+stralloc_format( stralloc_t*  s, const char*  fmt, ... )
+{
+    va_list  args;
+    va_start(args, fmt);
+    stralloc_formatv(s, fmt, args);
+    va_end(args);
+}
+
+extern void
+stralloc_add_formatv( stralloc_t*  s, const char*  fmt, va_list  args )
+{
+    STRALLOC_DEFINE(s2);
+    stralloc_formatv(s2, fmt, args);
+    stralloc_append( s, s2 );
+    stralloc_reset( s2 );
+}
+
+extern void
+stralloc_add_format( stralloc_t*  s, const char*  fmt, ... )
+{
+    va_list  args;
+    va_start(args, fmt);
+    stralloc_add_formatv( s, fmt, args );
+    va_end(args);
+}
+
+extern void
+stralloc_add_quote_c( stralloc_t*  s, int  c )
+{
+    stralloc_add_quote_bytes( s, (char*)&c, 1 );
+}
+
+extern void
+stralloc_add_quote_str( stralloc_t*  s, const char*  str )
+{
+    stralloc_add_quote_bytes( s, str, strlen(str) );
+}
+
+extern void
+stralloc_add_quote_bytes( stralloc_t*  s, const void*  from, unsigned  len )
+{
+    uint8_t*   p   = (uint8_t*) from;
+    uint8_t*   end = p + len;
+
+    for ( ; p < end; p++ ) {
+        int  c = p[0];
+
+        if (c == '\\') {
+            stralloc_add_str( s, "\\\\" );
+        } else if (c >= ' ' && c < 128) {
+            stralloc_add_c( s, c );
+        } else if (c == '\n') {
+            stralloc_add_str( s, "\\n" );
+        } else if (c == '\t') {
+            stralloc_add_str( s, "\\t" );
+        } else if (c == '\r') {
+            stralloc_add_str( s, "\\r" );
+        } else {
+            stralloc_add_format( s, "\\x%02x", c );
+        }
+    }
+}
+
+extern void
+stralloc_add_hex( stralloc_t*  s, unsigned  value, int  num_digits )
+{
+    const char   hexdigits[16] = "0123456789abcdef";
+    int          nn;
+
+    if (num_digits <= 0)
+        return;
+
+    stralloc_readyplus(s, num_digits);
+    for (nn = num_digits-1; nn >= 0; nn--) {
+        s->s[s->n+nn] = hexdigits[value & 15];
+        value >>= 4;
+    }
+    s->n += num_digits;
+}
+
+extern void
+stralloc_add_hexdump( stralloc_t*  s, void*  base, int  size, const char*  prefix )
+{
+    uint8_t*   p          = (uint8_t*)base;
+    const int  max_count  = 16;
+    int        prefix_len = strlen(prefix);
+
+    while (size > 0) {
+        int          count = size > max_count ? max_count : size;
+        int          count2;
+        int          n;
+
+        stralloc_add_bytes( s, prefix, prefix_len );
+        stralloc_add_hex( s, p[0], 2 );
+
+        for (n = 1; n < count; n++) {
+            stralloc_add_c( s, ' ' );
+            stralloc_add_hex( s, p[n], 2 );
+        }
+
+        count2 = 4 + 3*(max_count - count);
+        stralloc_readyplus( s, count2 );
+        memset( s->s + s->n, ' ', count2 );
+        s->n += count2;
+
+        stralloc_readyplus(s, count+1);
+        for (n = 0; n < count; n++) {
+            int  c = p[n];
+
+            if (c < 32 || c > 127)
+                c = '.';
+
+            s->s[s->n++] = c;
+        }
+        s->s[s->n++] = '\n';
+
+        size -= count;
+        p    += count;
+    }
+}
+
diff --git a/android/utils/stralloc.h b/android/utils/stralloc.h
new file mode 100644
index 0000000..4d17060
--- /dev/null
+++ b/android/utils/stralloc.h
@@ -0,0 +1,60 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#ifndef _ANDROID_UTILS_STRALLOC_H
+#define _ANDROID_UTILS_STRALLOC_H
+
+#include <stddef.h>
+#include <stdarg.h>
+
+/** DYNAMIC STRINGS
+ **/
+
+typedef struct {
+    char*     s;
+    unsigned  n;
+    unsigned  a;
+} stralloc_t;
+
+#define  STRALLOC_INIT        { NULL, 0, 0 }
+#define  STRALLOC_DEFINE(s)   stralloc_t   s[1] = { STRALLOC_INIT }
+
+extern void   stralloc_reset( stralloc_t*  s );
+extern void   stralloc_ready( stralloc_t*  s, unsigned  len );
+extern void   stralloc_readyplus( stralloc_t*  s, unsigned  len );
+
+extern void   stralloc_copy( stralloc_t*  s, stralloc_t*  from );
+extern void   stralloc_append( stralloc_t*  s, stralloc_t*  from );
+
+extern void   stralloc_add_c( stralloc_t*  s, int  c );
+extern void   stralloc_add_str( stralloc_t*  s, const char*  str );
+extern void   stralloc_add_bytes( stralloc_t*  s, const void*  from, unsigned  len );
+
+extern char*  stralloc_cstr( stralloc_t*  s );
+
+extern void   stralloc_format( stralloc_t*  s, const char*  fmt, ... );
+extern void   stralloc_formatv( stralloc_t*  s, const char*  fmt, va_list  args );
+extern void   stralloc_add_format( stralloc_t*  s, const char*  fmt, ... );
+
+extern void   stralloc_add_quote_c( stralloc_t*  s, int  c );
+extern void   stralloc_add_quote_str( stralloc_t*  s, const char*  str );
+extern void   stralloc_add_quote_bytes( stralloc_t*  s, const void*  from, unsigned   len );
+
+extern void   stralloc_add_hex( stralloc_t*  s, unsigned  value, int  num_digits );
+extern void   stralloc_add_hexdump( stralloc_t*  s, void*  base, int  size, const char*  prefix );
+
+extern void   stralloc_tabular( stralloc_t*  s, const char** strings, int  count,
+                                                const char*  prefix,  int  width );
+
+extern char*  stralloc_to_tempstr( stralloc_t*  s );
+
+#endif /* ANDROID_UTILS_STRALLOC_H */
diff --git a/android/utils/system.c b/android/utils/system.c
new file mode 100644
index 0000000..e09fd6b
--- /dev/null
+++ b/android/utils/system.c
@@ -0,0 +1,172 @@
+/* Copyright (C) 2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+#include "android/utils/system.h"
+#include <stdlib.h>
+#include <stdio.h>
+#ifdef _WIN32
+#  define WIN32_LEAN_AND_MEAN
+#  include <windows.h>  /* for Sleep */
+#else
+#  include <unistd.h>  /* for usleep */
+#endif
+
+void*
+android_alloc( size_t  size )
+{
+    void*   block;
+
+    if (size == 0)
+        return NULL;
+
+    block = malloc(size);
+    if (block != NULL)
+        return block;
+
+    fprintf(stderr, "PANIC: not enough memory\n");
+    exit(1);
+    return NULL;
+}
+
+void*
+android_alloc0( size_t  size )
+{
+    void*   block;
+
+    if (size == 0)
+        return NULL;
+
+    block = calloc(1, size);
+    if (block != NULL)
+        return block;
+
+    fprintf(stderr, "PANIC: not enough memory\n");
+    exit(1);
+    return NULL;
+}
+
+void*
+android_realloc( void*  block, size_t  size )
+{
+    void*   block2;
+
+    if (size == 0) {
+        free(block);
+        return NULL;
+    }
+    block2 = realloc(block, size);
+    if (block2 != NULL)
+        return block2;
+
+    fprintf(stderr, "PANIC: not enough memory to reallocate %d bytes\n", size);
+    exit(1);
+    return NULL;
+}
+
+void
+android_free( void*  block )
+{
+    if (block)
+        free(block);
+}
+
+char*
+android_strdup( const char*  str )
+{
+    int    len;
+    char*  copy;
+
+    if (str == NULL)
+        return NULL;
+
+    len  = strlen(str);
+    copy = malloc(len+1);
+    memcpy(copy, str, len);
+    copy[len] = 0;
+
+    return copy;
+}
+
+#ifdef _WIN32
+char*
+win32_strsep(char**  pline, const char*  delim)
+{
+    char*  line = *pline;
+    char*  p    = line;
+
+    if (p == NULL)
+        return NULL;
+
+    for (;;) {
+        int          c = *p++;
+        const char*  q = delim;
+
+        if (c == 0) {
+            p = NULL;
+            break;
+        }
+
+        while (*q) {
+            if (*q == c) {
+                p[-1] = 0;
+                goto Exit;
+            }
+            q++;
+        }
+    }
+Exit:	
+    *pline = p;
+    return line;
+}
+#endif
+
+
+void
+disable_sigalrm( signal_state_t  *state )
+{
+#ifdef _WIN32
+    (void)state;
+#else
+    sigset_t  set;
+
+    sigemptyset(&set);
+    sigaddset(&set, SIGALRM);
+    pthread_sigmask (SIG_BLOCK, &set, &state->old);
+#endif
+}
+
+void
+restore_sigalrm( signal_state_t  *state )
+{
+#ifdef _WIN32
+    (void)state;
+#else
+    pthread_sigmask (SIG_SETMASK, &state->old, NULL);
+#endif
+}
+
+void
+sleep_ms( int  timeout_ms )
+{
+#ifdef _WIN32
+    if (timeout_ms <= 0)
+        return;
+
+    Sleep( timeout_ms );
+#else
+    if (timeout_ms <= 0)
+        return;
+
+    BEGIN_NOSIGALRM
+    usleep( timeout_ms*1000 );
+    END_NOSIGALRM
+#endif
+}
diff --git a/android/utils/system.h b/android/utils/system.h
new file mode 100644
index 0000000..804aa7d
--- /dev/null
+++ b/android/utils/system.h
@@ -0,0 +1,161 @@
+/* Copyright (C) 2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+#ifndef _ANDROID_UTILS_SYSTEM_H
+#define _ANDROID_UTILS_SYSTEM_H
+
+#include <string.h>
+#include <stdint.h>
+
+/* the following functions perform 'checked allocations', i.e.
+ * they abort if there is not enough memory.
+ */
+
+/* checked malloc, only returns NULL if size is 0 */
+void*  android_alloc( size_t  size );
+
+/* checked calloc, only returns NULL if size is 0 */
+void*  android_alloc0( size_t  size );
+
+/* checked realloc, only returns NULL if size if 0 */
+void*  android_realloc( void*  block, size_t  size );
+
+/* free memory block */
+void   android_free( void*  block );
+
+/* convenience macros */
+
+#define  AZERO(p)             memset((char*)(p),0,sizeof(*(p)))
+#define  ANEW(p)              (p = android_alloc(sizeof(*p)))
+#define  ANEW0(p)             (p = android_alloc0(sizeof(*p)))
+#define  AFREE(p)             android_free(p)
+
+#define  AMEM_ZERO(dst,size)      memset((char*)(dst), 0, (size_t)(size))
+#define  AMEM_COPY(dst,src,size)  memcpy((char*)(dst),(const char*)(src),(size_t)(size))
+#define  AMEM_MOVE(dst,src,size)  memmove((char*)(dst),(const char*)(src),(size_t)(size))
+
+#define  AARRAY_NEW(p,count)          ((p) = android_alloc(sizeof(*p)*(count)))
+#define  AARRAY_NEW0(p,count)         ((p) = android_alloc0(sizeof(*p)*(count)))
+
+#define  AARRAY_RENEW(p,count)        ((p) = android_realloc((p),sizeof(*(p))*(count)))
+
+#define  AARRAY_COPY(dst,src,count)   AMEM_COPY(dst,src,(count)*sizeof((dst)[0]))
+#define  AARRAY_MOVE(dst,src,count)   AMEM_MOVE(dst,src,(count)*sizeof((dst)[0]))
+#define  AARRAY_ZERO(dst,count)       AMEM_ZERO(dst,(count)*sizeof((dst)[0]))
+
+#define  AARRAY_STATIC_LEN(a)         (sizeof((a))/sizeof((a)[0]))
+
+#define  AINLINED  static __inline__
+
+/* unlike strdup(), this accepts NULL as valid input (and will return NULL then) */
+char*   android_strdup(const char*  src);
+
+#define  ASTRDUP(str)  android_strdup(str)
+
+/* used for functions that return a Posix-style status code, i.e.
+ * 0 means success, -1 means failure with the error code in 'errno'
+ */
+typedef int  APosixStatus;
+
+/* used for functions that return or accept a boolean type */
+typedef int  ABool;
+
+/** Stringification macro
+ **/
+#ifndef STRINGIFY
+#define  _STRINGIFY(x)  #x
+#define  STRINGIFY(x)  _STRINGIFY(x)
+#endif
+
+/** Concatenation macros
+ **/
+#ifndef GLUE
+#define  _GLUE(x,y)  x##y
+#define  GLUE(x,y)   _GLUE(x,y)
+
+#define  _GLUE3(x,y,z)  x##y##z
+#define  GLUE3(x,y,z)    _GLUE3(x,y,z)
+#endif
+
+/** Handle strsep() on Win32
+ **/
+#ifdef _WIN32
+#  undef   strsep
+#  define  strsep    win32_strsep
+extern char*  win32_strsep(char**  pline, const char*  delim);
+#endif
+
+/** Handle strcasecmp on Windows
+ **/
+#ifdef _WIN32
+#  define  strcasecmp  stricmp
+#endif
+
+/** EINTR HANDLING
+ **
+ ** since QEMU uses SIGALRM pretty extensively, having a system call returning
+ ** EINTR on Unix happens very frequently. provide a simple macro to guard against
+ ** this.
+ **/
+
+#ifdef _WIN32
+#  define   CHECKED(ret, call)    (ret) = (call)
+#else
+#  define   CHECKED(ret, call)    do { (ret) = (call); } while ((ret) < 0 && errno == EINTR)
+#endif
+
+/** SIGNAL HANDLING
+ **
+ ** the following can be used to block SIGALRM for a given period of time.
+ ** use with caution, the QEMU execution loop uses SIGALRM extensively
+ **
+ **/
+#ifdef _WIN32
+typedef struct { int  dumy; }      signal_state_t;
+#else
+#include <signal.h>
+typedef struct { sigset_t  old; }  signal_state_t;
+#endif
+
+extern  void   disable_sigalrm( signal_state_t  *state );
+extern  void   restore_sigalrm( signal_state_t  *state );
+
+#ifdef _WIN32
+
+#define   BEGIN_NOSIGALRM  \
+    {
+
+#define   END_NOSIGALRM  \
+    }
+
+#else /* !WIN32 */
+
+#define   BEGIN_NOSIGALRM  \
+    { signal_state_t  __sigalrm_state; \
+      disable_sigalrm( &__sigalrm_state );
+
+#define   END_NOSIGALRM  \
+      restore_sigalrm( &__sigalrm_state );  \
+    }
+
+#endif /* !WIN32 */
+
+/** TIME HANDLING
+ **
+ ** sleep for a given time in milliseconds. note: this uses
+ ** disable_sigalrm()/restore_sigalrm()
+ **/
+
+extern  void   sleep_ms( int  timeout );
+
+/* */
+
+#endif /* _ANDROID_UTILS_SYSTEM_H */
diff --git a/android/utils/tempfile.c b/android/utils/tempfile.c
new file mode 100644
index 0000000..6374c12
--- /dev/null
+++ b/android/utils/tempfile.c
@@ -0,0 +1,198 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#include "android/utils/tempfile.h"
+#include "android/utils/bufprint.h"
+#include "android/utils/debug.h"
+
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+
+#ifdef _WIN32
+#  define WIN32_LEAN_AND_MEAN
+#  include <windows.h>
+#else
+#  include <unistd.h>
+#endif
+
+#define  D(...)  ((void)0)
+
+/** TEMP FILE SUPPORT
+ **
+ ** simple interface to create an empty temporary file on the system.
+ **
+ ** create the file with tempfile_create(), which returns a reference to a TempFile
+ ** object, or NULL if your system is so weird it doesn't have a temporary directory.
+ **
+ ** you can then call tempfile_path() to retrieve the TempFile's real path to open
+ ** it. the returned path is owned by the TempFile object and should not be freed.
+ **
+ ** all temporary files are destroyed when the program quits, unless you explicitely
+ ** close them before that with tempfile_close()
+ **/
+
+struct TempFile
+{
+    const char*  name;
+    TempFile*    next;
+};
+
+static void       tempfile_atexit();
+static TempFile*  _all_tempfiles;
+
+TempFile*
+tempfile_create( void )
+{
+    TempFile*    tempfile;
+    const char*  tempname = NULL;
+
+#ifdef _WIN32
+    char  temp_namebuff[MAX_PATH];
+    char  temp_dir[MAX_PATH];
+    char  *p = temp_dir, *end = p + sizeof(temp_dir);
+    UINT  retval;
+
+    p = bufprint_temp_dir( p, end );
+    if (p >= end) {
+        D( "TEMP directory path is too long" );
+        return NULL;
+    }
+
+    retval = GetTempFileName(temp_dir, "TMP", 0, temp_namebuff);
+    if (retval == 0) {
+        D( "can't create temporary file in '%s'", temp_dir );
+        return NULL;
+    }
+
+    tempname = temp_namebuff;
+#else
+#define  TEMPLATE  "/tmp/.android-emulator-XXXXXX"
+    int   tempfd = -1;
+    char  template[512];
+    char  *p = template, *end = p + sizeof(template);
+
+    p = bufprint_temp_file( p, end, "emulator-XXXXXX" );
+    if (p >= end) {
+        D( "Xcannot create temporary file in /tmp/android !!" );
+        return NULL;
+    }
+
+    D( "template: %s", template );
+    tempfd = mkstemp( template );
+    if (tempfd < 0) {
+        D("cannot create temporary file in /tmp/android !!");
+        return NULL;
+    }
+    close(tempfd);
+    tempname = template;
+#endif
+    tempfile = malloc( sizeof(*tempfile) + strlen(tempname) + 1 );
+    tempfile->name = (char*)(tempfile + 1);
+    strcpy( (char*)tempfile->name, tempname );
+
+    tempfile->next = _all_tempfiles;
+    _all_tempfiles = tempfile;
+
+    if ( !tempfile->next ) {
+        atexit( tempfile_atexit );
+    }
+
+    return tempfile;
+}
+
+const char*
+tempfile_path(TempFile*  temp)
+{
+    return temp ? temp->name : NULL;
+}
+
+void
+tempfile_close(TempFile*  tempfile)
+{
+#ifdef _WIN32
+    DeleteFile(tempfile->name);
+#else
+    unlink(tempfile->name);
+#endif
+}
+
+/** TEMP FILE CLEANUP
+ **
+ **/
+
+/* we don't expect to use many temporary files */
+#define MAX_ATEXIT_FDS  16
+
+typedef struct {
+    int   count;
+    int   fds[ MAX_ATEXIT_FDS ];
+} AtExitFds;
+
+static void
+atexit_fds_add( AtExitFds*  t, int  fd )
+{
+    if (t->count < MAX_ATEXIT_FDS)
+        t->fds[t->count++] = fd;
+    else {
+        dwarning("%s: over %d calls. Program exit may not cleanup all temporary files",
+            __FUNCTION__, MAX_ATEXIT_FDS);
+    }
+}
+
+static void
+atexit_fds_del( AtExitFds*  t, int  fd )
+{
+    int  nn;
+    for (nn = 0; nn < t->count; nn++)
+        if (t->fds[nn] == fd) {
+            /* move the last element to the current position */
+            t->count  -= 1;
+            t->fds[nn] = t->fds[t->count];
+            break;
+        }
+}
+
+static void
+atexit_fds_close_all( AtExitFds*  t )
+{
+    int  nn;
+    for (nn = 0; nn < t->count; nn++)
+        close(t->fds[nn]);
+}
+
+static AtExitFds   _atexit_fds[1];
+
+void
+atexit_close_fd(int  fd)
+{
+    if (fd >= 0)
+        atexit_fds_add(_atexit_fds, fd);
+}
+
+void
+atexit_close_fd_remove(int  fd)
+{
+    if (fd >= 0)
+        atexit_fds_del(_atexit_fds, fd);
+}
+
+static void
+tempfile_atexit( void )
+{
+    TempFile*  tempfile;
+
+    atexit_fds_close_all( _atexit_fds );
+
+    for (tempfile = _all_tempfiles; tempfile; tempfile = tempfile->next)
+        tempfile_close(tempfile);
+}
diff --git a/android/utils/tempfile.h b/android/utils/tempfile.h
new file mode 100644
index 0000000..4264a84
--- /dev/null
+++ b/android/utils/tempfile.h
@@ -0,0 +1,52 @@
+/* Copyright (C) 2007-2008 The Android Open Source Project
+**
+** This software is licensed under the terms of the GNU General Public
+** License version 2, as published by the Free Software Foundation, and
+** may be copied, distributed, and modified under those terms.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+*/
+
+#ifndef _ANDROID_UTILS_TEMPFILE_H
+#define _ANDROID_UTILS_TEMPFILE_H
+
+/** TEMP FILE SUPPORT
+ **
+ ** simple interface to create an empty temporary file on the system.
+ **
+ ** create the file with tempfile_create(), which returns a reference to a TempFile
+ ** object, or NULL if your system is so weird it doesn't have a temporary directory.
+ **
+ ** you can then call tempfile_path() to retrieve the TempFile's real path to open
+ ** it. the returned path is owned by the TempFile object and should not be freed.
+ **
+ ** all temporary files are destroyed when the program quits, unless you explicitely
+ ** close them before that with tempfile_close()
+ **/
+
+typedef struct TempFile   TempFile;
+
+extern  TempFile*    tempfile_create( void );
+extern  const char*  tempfile_path( TempFile*  temp );
+extern  void         tempfile_close( TempFile*  temp );
+
+/** TEMP FILE CLEANUP
+ **
+ ** We delete all temporary files in atexit()-registered callbacks.
+ ** however, the Win32 DeleteFile is unable to remove a file unless
+ ** all HANDLEs to it are closed in the terminating process.
+ **
+ ** Call 'atexit_close_fd' on a newly open-ed file descriptor to indicate
+ ** that you want it closed in atexit() time. You should always call
+ ** this function unless you're certain that the corresponding file
+ ** cannot be temporary.
+ **
+ ** Call 'atexit_close_fd_remove' before explicitely closing a 'fd'
+ **/
+extern void          atexit_close_fd(int  fd);
+extern void          atexit_close_fd_remove(int  fd);
+
+#endif /* _ANDROID_UTILS_TEMPFILE_H */
diff --git a/android_timezone.c b/android/utils/timezone.c
index aac0696..b5588a3 100644
--- a/android_timezone.c
+++ b/android/utils/timezone.c
@@ -9,13 +9,14 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android_timezone.h"
-#include "android_utils.h"
-#include "android.h"
+#include "android/utils/debug.h"
+#include "android/utils/timezone.h"
+#include "android/utils/bufprint.h"
+#include "android/android.h"
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
-#include "vl.h"  /* for pstrcpy */
+#include "qemu-common.h"
 
 #define  DEBUG  1
 
diff --git a/android_timezone.h b/android/utils/timezone.h
index daaccf6..bf5f731 100644
--- a/android_timezone.h
+++ b/android/utils/timezone.h
@@ -9,10 +9,8 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#ifndef _ANDROID_TIMEZONE_H
-#define _ANDROID_TIMEZONE_H
-
-#include "android_utils.h"
+#ifndef _ANDROID_UTILS_TIMEZONE_H
+#define _ANDROID_UTILS_TIMEZONE_H
 
 /* try to set the default host timezone, returns 0 on success, or -1 if
  * 'tzname' is not in zoneinfo format (e.g. Area/Location)
@@ -30,4 +28,4 @@ extern int  timezone_set( const char*  tzname );
  */
 extern char*  bufprint_zoneinfo_timezone( char*  buffer, char*  end );
 
-#endif /* _ANDROID_TIMEZONE_H */
+#endif /* _ANDROID_UTILS_TIMEZONE_H */
diff --git a/android_debug.h b/android_debug.h
deleted file mode 100644
index 9dc4f40..0000000
--- a/android_debug.h
+++ /dev/null
@@ -1,91 +0,0 @@
-/* Copyright (C) 2007-2008 The Android Open Source Project
-**
-** This software is licensed under the terms of the GNU General Public
-** License version 2, as published by the Free Software Foundation, and
-** may be copied, distributed, and modified under those terms.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-** GNU General Public License for more details.
-*/
-#ifndef _ANDROID_DEBUG_H
-#define _ANDROID_DEBUG_H
-
-#include <stdarg.h>
-
-#define  VERBOSE_TAG_LIST    \
-    _VERBOSE_TAG(init,         "emulator initialization")  \
-    _VERBOSE_TAG(console,      "control console")  \
-    _VERBOSE_TAG(modem,        "emulated GSM modem")  \
-    _VERBOSE_TAG(radio,        "emulated GSM AT Command channel") \
-    _VERBOSE_TAG(keys,         "key bindings & presses") \
-    _VERBOSE_TAG(slirp,        "internal router/firewall") \
-    _VERBOSE_TAG(timezone,     "host timezone detection" ) \
-    _VERBOSE_TAG(socket,       "network sockets") \
-    _VERBOSE_TAG(proxy,        "network proxy support") \
-    _VERBOSE_TAG(audio,        "audio sub-system") \
-    _VERBOSE_TAG(audioin,      "audio input backend") \
-    _VERBOSE_TAG(audioout,     "audio output backend") \
-    _VERBOSE_TAG(surface,      "video surface support") \
-    _VERBOSE_TAG(qemud,        "qemud multiplexer daemon") \
-    _VERBOSE_TAG(gps,          "emulated GPS") \
-    _VERBOSE_TAG(nand_limits,  "nand/flash read/write thresholding") \
-    _VERBOSE_TAG(hw_control,   "emulated power/flashlight/led/vibrator") \
-    _VERBOSE_TAG(vm_config,    "virtual device configuration") \
-
-#define  _VERBOSE_TAG(x,y)  VERBOSE_##x,
-typedef enum {
-    VERBOSE_TAG_LIST
-    VERBOSE_MAX  /* do not remove */
-} VerboseTag;
-#undef  _VERBOSE_TAG
-
-/* defined in android_main.c */
-extern unsigned long  android_verbose;
-
-#define  VERBOSE_ENABLE(tag)    \
-    android_verbose |= (1 << VERBOSE_##tag)
-
-#define  VERBOSE_DISABLE(tag)   \
-    android_verbose &= (1 << VERBOSE_##tag)
-
-#define  VERBOSE_CHECK(tag)    \
-    ((android_verbose & (1 << VERBOSE_##tag)) != 0)
-
-#define  VERBOSE_CHECK_ANY()    \
-    (android_verbose != 0)
-
-#define  VERBOSE_PRINT(tag,...)  \
-    do { if (VERBOSE_CHECK(tag)) dprint(__VA_ARGS__); } while (0)
-
-/** DEBUG TRACE SUPPORT
- **
- ** debug messages can be sent by calling these function
- **
- ** 'dprint' prints the message, then appends a '\n\
- ** 'dprintn' simply prints the message as is
- ** 'dprintnv' allows you to use a va_list argument
- ** 'dwarning' prints a warning message, then appends a '\n'
- ** 'derror' prints a severe error message, then appends a '\n'
- */
-
-extern void   dprint( const char*  format, ... );
-extern void   dprintn( const char*  format, ... );
-extern void   dprintnv( const char*  format, va_list  args );
-extern void   dwarning( const char*  format, ... );
-extern void   derror( const char*  format, ... );
-
-/** STDOUT/STDERR REDIRECTION
- **
- ** allows you to shut temporarily shutdown stdout/stderr
- ** this is useful to get rid of debug messages from ALSA and esd
- ** on Linux.
- **/
-
-extern void  stdio_disable( void );
-extern void  stdio_enable( void );
-
-/* */
-
-#endif /* _ANDROID_DEBUG_H */
diff --git a/android_utils.c b/android_utils.c
deleted file mode 100644
index b995504..0000000
--- a/android_utils.c
+++ /dev/null
@@ -1,1946 +0,0 @@
-/* Copyright (C) 2007-2008 The Android Open Source Project
-**
-** This software is licensed under the terms of the GNU General Public
-** License version 2, as published by the Free Software Foundation, and
-** may be copied, distributed, and modified under those terms.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-** GNU General Public License for more details.
-*/
-#include "android_utils.h"
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <fcntl.h>
-#ifdef _WIN32
-#include <process.h>
-#include <shlobj.h>
-#include <tlhelp32.h>
-#include <io.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <stdint.h>
-#include <limits.h>
-#include <winbase.h>
-#else
-#include <unistd.h>
-#include <sys/stat.h>
-#include <time.h>
-#include <signal.h>
-#endif
-#include "android.h"
-#include "android_debug.h"
-
-#define  D(...)   VERBOSE_PRINT(init,__VA_ARGS__)
-
-#ifdef _WIN32
-char*
-win32_strsep(char**  pline, const char*  delim)
-{
-    char*  line = *pline;
-    char*  p    = line;
-
-    if (p == NULL)
-        return NULL;
-
-    for (;;) {
-        int          c = *p++;
-        const char*  q = delim;
-
-        if (c == 0) {
-            p = NULL;
-            break;
-        }
-
-        while (*q) {
-            if (*q == c) {
-                p[-1] = 0;
-                goto Exit;
-            }
-            q++;
-        }
-    }
-Exit:	
-    *pline = p;
-    return line;
-}
-#endif
-
-/** PATH HANDLING ROUTINES
- **
- **  path_parent() can be used to return the n-level parent of a given directory
- **  this understands . and .. when encountered in the input path
- **/
-
-static __inline__ int
-ispathsep(int  c)
-{
-#ifdef _WIN32
-    return (c == '/' || c == '\\');
-#else
-    return (c == '/');
-#endif
-}
-
-char*  path_parent( const char*  path, int  levels )
-{
-    const char*  end = path + strlen(path);
-    char*        result;
-
-    while (levels > 0) {
-        const char*  base;
-
-        /* trim any trailing path separator */
-        while (end > path && ispathsep(end[-1]))
-            end--;
-
-        base = end;
-        while (base > path && !ispathsep(base[-1]))
-            base--;
-
-        if (base <= path) /* we can't go that far */
-            return NULL;
-
-        if (end == base+1 && base[0] == '.')
-            goto Next;
-
-        if (end == base+2 && base[0] == '.' && base[1] == '.') {
-            levels += 1;
-            goto Next;
-        }
-
-        levels -= 1;
-
-    Next:
-        end = base - 1;
-    }
-    result = malloc( end-path+1 );
-    if (result != NULL) {
-        memcpy( result, path, end-path );
-        result[end-path] = 0;
-    }
-    return result;
-}
-
-
-/** MISC FILE AND DIRECTORY HANDLING
- **/
-
-int
-path_exists( const char*  path )
-{
-    int  ret;
-    CHECKED(ret, access(path, F_OK));
-    return (ret == 0) || (errno != ENOENT);
-}
-
-/* checks that a path points to a regular file */
-int
-path_is_regular( const char*  path )
-{
-    int          ret;
-    struct stat  st;
-
-    CHECKED(ret, stat(path, &st));
-    if (ret < 0)
-        return 0;
-
-    return S_ISREG(st.st_mode);
-}
-
-
-/* checks that a path points to a directory */
-int
-path_is_dir( const char*  path )
-{
-    int          ret;
-    struct stat  st;
-
-    CHECKED(ret, stat(path, &st));
-    if (ret < 0)
-        return 0;
-
-    return S_ISDIR(st.st_mode);
-}
-
-/* checks that one can read/write a given (regular) file */
-int
-path_can_read( const char*  path )
-{
-    int  ret;
-    CHECKED(ret, access(path, R_OK));
-    return (ret == 0);
-}
-
-int
-path_can_write( const char*  path )
-{
-    int  ret;
-    CHECKED(ret, access(path, R_OK));
-    return (ret == 0);
-}
-
-/* try to make a directory. returns 0 on success, -1 on failure
- * (error code in errno) */
-int
-path_mkdir( const char*  path, int  mode )
-{
-#ifdef _WIN32
-    (void)mode;
-    return _mkdir(path);
-#else
-    int  ret;
-    CHECKED(ret, mkdir(path, mode));
-    return ret;
-#endif
-}
-
-static int
-path_mkdir_recursive( char*  path, unsigned  len, int  mode )
-{
-    char      old_c;
-    int       ret;
-    unsigned  len2;
-
-    /* get rid of trailing separators */
-    while (len > 0 && ispathsep(path[len-1]))
-        len -= 1;
-
-    if (len == 0) {
-        errno = ENOENT;
-        return -1;
-    }
-
-    /* check that the parent exists, 'len2' is the length of
-     * the parent part of the path */
-    len2 = len-1;
-    while (len2 > 0 && !ispathsep(path[len2-1]))
-        len2 -= 1;
-
-    if (len2 > 0) {
-        old_c      = path[len2];
-        path[len2] = 0;
-        ret        = 0;
-        if ( !path_exists(path) ) {
-            /* the parent doesn't exist, so try to create it */
-            ret = path_mkdir_recursive( path, len2, mode );
-        }
-        path[len2] = old_c;
-
-        if (ret < 0)
-            return ret;
-    }
-
-    /* at this point, we now the parent exists */
-    old_c     = path[len];
-    path[len] = 0;
-    ret       = path_mkdir( path, mode );
-    path[len] = old_c;
-
-    return ret;
-}
-
-/* ensure that a given directory exists, create it if not, 
-   0 on success, -1 on failure (error code in errno) */
-int
-path_mkdir_if_needed( const char*  path, int  mode )
-{
-    int  ret = 0;
-
-    if (!path_exists(path)) {
-        ret = path_mkdir(path, mode);
-
-        if (ret < 0 && errno == ENOENT) {
-            char      temp[MAX_PATH];
-            unsigned  len = (unsigned)strlen(path);
-
-            if (len > sizeof(temp)-1) {
-                errno = EINVAL;
-                return -1;
-            }
-            memcpy( temp, path, len );
-            temp[len] = 0;
-
-            return path_mkdir_recursive(temp, len, mode);
-        }
-    }
-    return ret;
-}
-
-/* return the size of a given file in '*psize'. returns 0 on
- * success, -1 on failure (error code in errno) */
-int
-path_get_size( const char*  path, uint64_t  *psize )
-{
-#ifdef _WIN32
-    /* avoid _stat64 which is only defined in MSVCRT.DLL, not CRTDLL.DLL */
-    /* do not use OpenFile() because it has strange search behaviour that could */
-    /* result in getting the size of a different file */
-    LARGE_INTEGER  size;
-    HANDLE  file = CreateFile( /* lpFilename */        path,
-                               /* dwDesiredAccess */   GENERIC_READ,    
-                               /* dwSharedMode */     FILE_SHARE_READ|FILE_SHARE_WRITE, 
-                               /* lpSecurityAttributes */  NULL, 
-                               /* dwCreationDisposition */ OPEN_EXISTING,
-                               /* dwFlagsAndAttributes */  0,
-                               /* hTemplateFile */      NULL );
-    if (file == INVALID_HANDLE_VALUE) {
-        /* ok, just to play fair */
-        errno = ENOENT;
-        return -1;
-    }
-    if (!GetFileSizeEx(file, &size)) {
-        /* maybe we tried to get the size of a pipe or something like that ? */
-        *psize = 0;
-    }
-    else {
-        *psize = (uint64_t) size.QuadPart;
-    }
-    CloseHandle(file);
-    return 0;
-#else
-    int    ret;
-    struct stat  st;
-
-    CHECKED(ret, stat(path, &st));
-    if (ret == 0) {
-        *psize = (uint64_t) st.st_size;
-    }
-    return ret;
-#endif
-}
-
-
-/** USEFUL STRING BUFFER FUNCTIONS
- **/
-
-char*
-vbufprint( char*        buffer,
-           char*        buffer_end,
-           const char*  fmt,
-           va_list      args )
-{
-    int  len = vsnprintf( buffer, buffer_end - buffer, fmt, args );
-    if (len < 0 || buffer+len >= buffer_end) {
-        if (buffer < buffer_end)
-            buffer_end[-1] = 0;
-        return buffer_end;
-    }
-    return buffer + len;
-}
-
-char*
-bufprint(char*  buffer, char*  end, const char*  fmt, ... )
-{
-    va_list  args;
-    char*    result;
-
-    va_start(args, fmt);
-    result = vbufprint(buffer, end, fmt, args);
-    va_end(args);
-    return  result;
-}
-
-/** USEFUL DIRECTORY SUPPORT
- **
- **  bufprint_app_dir() returns the directory where the emulator binary is located
- **
- **  get_android_home() returns a user-specific directory where the emulator will
- **  store its writable data (e.g. config files, profiles, etc...).
- **  on Unix, this is $HOME/.android, on Windows, this is something like
- **  "%USERPROFILE%/Local Settings/AppData/Android" on XP, and something different
- **  on Vista.
- **
- **  both functions return a string that must be freed by the caller
- **/
-
-#ifdef __linux__
-char*
-bufprint_app_dir(char*  buff, char*  end)
-{
-    char   path[1024];
-    int    len;
-    char*  x;
-
-    len = readlink("/proc/self/exe", path, sizeof(path));
-    if (len <= 0 || len >= (int)sizeof(path)) goto Fail;
-    path[len] = 0;
-
-    x = strrchr(path, '/');
-    if (x == 0) goto Fail;
-    *x = 0;
-
-    return bufprint(buff, end, "%s", path);
-Fail:
-    fprintf(stderr,"cannot locate application directory\n");
-    exit(1);
-    return end;
-}
-
-#elif defined(__APPLE__)
-/* the following hack is needed in order to build with XCode 3.1
- * don't ask me why, but it seems that there were changes in the
- * GCC compiler that we don't have in our pre-compiled version
- */
-#ifndef __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__
-#define __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ MAC_OS_X_VERSION_10_4
-#endif
-#import <Carbon/Carbon.h>
-#include <unistd.h>
-
-char*
-bufprint_app_dir(char*  buff, char*  end)
-{
-    ProcessSerialNumber psn;
-    CFDictionaryRef     dict;
-    CFStringRef         value;
-    char                s[PATH_MAX];
-    char*               x;
-
-    GetCurrentProcess(&psn);
-    dict  = ProcessInformationCopyDictionary(&psn, 0xffffffff);
-    value = (CFStringRef)CFDictionaryGetValue(dict,
-                                             CFSTR("CFBundleExecutable"));
-    CFStringGetCString(value, s, PATH_MAX - 1, kCFStringEncodingUTF8);
-    x = strrchr(s, '/');
-    if (x == 0) goto fail;
-    *x = 0;
-
-    return bufprint(buff, end, "%s", s);
-fail:
-    fprintf(stderr,"cannot locate application directory\n");
-    exit(1);
-    return end;
-}
-#elif defined _WIN32
-char*
-bufprint_app_dir(char*  buff, char*  end)
-{
-    char   appDir[MAX_PATH];
-    char*  sep;
-
-    GetModuleFileName( 0, appDir, sizeof(appDir)-1 );
-    sep = strrchr( appDir, '\\' );
-    if (sep)
-        *sep = 0;
-
-    return bufprint(buff, end, "%s", appDir);
-}
-#else
-char*
-bufprint_app_dir(char*  buff, char*  end)
-{
-    return bufprint(buff, end, ".");
-}
-#endif
-
-#define  _ANDROID_PATH   ".android"
-
-char*
-bufprint_config_path(char*  buff, char*  end)
-{
-#ifdef _WIN32
-    char  path[MAX_PATH];
-
-    SHGetFolderPath( NULL, CSIDL_PROFILE,
-                     NULL, 0, path);
-
-    return bufprint(buff, end, "%s\\%s", path, _ANDROID_PATH );
-#else
-    const char*  home = getenv("HOME");
-    if (home == NULL)
-        home = "/tmp";
-    return bufprint(buff, end, "%s/%s", home, _ANDROID_PATH );
-#endif
-}
-
-char*
-bufprint_config_file(char*  buff, char*  end, const char*  suffix)
-{
-    char*   p;
-    p = bufprint_config_path(buff, end);
-    p = bufprint(p, end, PATH_SEP "%s", suffix);
-    return p;
-}
-
-char*
-bufprint_temp_dir(char*  buff, char*  end)
-{
-#ifdef _WIN32
-    char   path[MAX_PATH];
-    DWORD  retval;
-
-    retval = GetTempPath( sizeof(path), path );
-    if (retval > sizeof(path) || retval == 0) {
-        D( "can't locate TEMP directory" );
-        pstrcpy(path, sizeof(path), "C:\\Temp");
-    }
-    strncat( path, "\\AndroidEmulator", sizeof(path)-1 );
-    _mkdir(path);
-
-    return  bufprint(buff, end, "%s", path);
-#else
-    const char*  tmppath = "/tmp/android";
-    mkdir(tmppath, 0744);
-    return  bufprint(buff, end, "%s", tmppath );
-#endif
-}
-
-char*
-bufprint_temp_file(char*  buff, char*  end, const char*  suffix)
-{
-    char*  p;
-    p = bufprint_temp_dir(buff, end);
-    p = bufprint(p, end, PATH_SEP "%s", suffix);
-    return p;
-}
-
-
-
-/** FILE LOCKS SUPPORT
- **
- ** a FileLock is useful to prevent several emulator instances from using the same
- ** writable file (e.g. the userdata.img disk images).
- **
- ** create a FileLock object with filelock_create(), ithis function should return NULL
- ** only if the corresponding file path could not be locked.
- **
- ** all file locks are automatically released and destroyed when the program exits.
- ** the filelock_lock() function can also detect stale file locks that can linger
- ** when the emulator crashes unexpectedly, and will happily clean them for you
- **
- **  here's how it works, three files are used:
- **     file  - the data file accessed by the emulator
- **     lock  - a lock file  (file + '.lock')
- **     temp  - a temporary file make unique with mkstemp
- **
- **  when locking:
- **      create 'temp' and store our pid in it
- **      attemp to link 'lock' to 'temp'
- **         if the link succeeds, we obtain the lock
- **      unlink 'temp'
- **
- **  when unlocking:
- **      unlink 'lock'
- **
- **
- **  on Windows, 'lock' is a directory name. locking is equivalent to
- **  creating it...
- **
- **/
-
-struct FileLock
-{
-  const char*  file;
-  const char*  lock;
-  char*        temp;
-  int          locked;
-  FileLock*    next;
-};
-
-/* used to cleanup all locks at emulator exit */
-static FileLock*   _all_filelocks;
-
-
-#define  LOCK_NAME   ".lock"
-#define  TEMP_NAME   ".tmp-XXXXXX"
-
-#ifdef _WIN32
-#define  PIDFILE_NAME  "pid"
-#endif
-
-/* returns 0 on success, -1 on failure */
-static int
-filelock_lock( FileLock*  lock )
-{
-    int    ret;
-#ifdef _WIN32
-    int  pidfile_fd = -1;
-
-    ret = _mkdir( lock->lock );
-    if (ret < 0) {
-        if (errno == ENOENT) {
-            D( "could not access directory '%s', check path elements", lock->lock );
-            return -1;
-        } else if (errno != EEXIST) {
-            D( "_mkdir(%s): %s", lock->lock, strerror(errno) );
-            return -1;
-        }
-
-        /* if we get here, it's because the .lock directory already exists */
-        /* check to see if there is a pid file in it                       */
-        D("directory '%s' already exist, waiting a bit to ensure that no other emulator instance is starting", lock->lock );
-        {
-            int  _sleep = 200;
-            int  tries;
-
-            for ( tries = 4; tries > 0; tries-- )
-            {
-                pidfile_fd = open( lock->temp, O_RDONLY );
-
-                if (pidfile_fd >= 0)
-                    break;
-
-                Sleep( _sleep );
-                _sleep *= 2;
-            }
-        }
-
-        if (pidfile_fd < 0) {
-            D( "no pid file in '%s', assuming stale directory", lock->lock );
-        }
-        else
-        {
-            /* read the pidfile, and check wether the corresponding process is still running */
-            char            buf[16];
-            int             len, lockpid;
-            HANDLE          processSnapshot;
-            PROCESSENTRY32  pe32;
-            int             is_locked = 0;
-
-            len = read( pidfile_fd, buf, sizeof(buf)-1 );
-            if (len < 0) {
-                D( "could not read pid file '%s'", lock->temp );
-                close( pidfile_fd );
-                return -1;
-            }
-            buf[len] = 0;
-            lockpid  = atoi(buf);
-
-            /* PID 0 is the IDLE process, and 0 is returned in case of invalid input */
-            if (lockpid == 0)
-                lockpid = -1;
-
-            close( pidfile_fd );
-
-            pe32.dwSize     = sizeof( PROCESSENTRY32 );
-            processSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
-
-            if ( processSnapshot == INVALID_HANDLE_VALUE ) {
-                D( "could not retrieve the list of currently active processes\n" );
-                is_locked = 1;
-            }
-            else if ( !Process32First( processSnapshot, &pe32 ) )
-            {
-                D( "could not retrieve first process id\n" );
-                CloseHandle( processSnapshot );
-                is_locked = 1;
-            }
-            else
-            {
-                do {
-                    if (pe32.th32ProcessID == lockpid) {
-                        is_locked = 1;
-                        break;
-                    }
-                } while (Process32Next( processSnapshot, &pe32 ) );
-
-                CloseHandle( processSnapshot );
-            }
-
-            if (is_locked) {
-                D( "the file '%s' is locked by process ID %d\n", lock->file, lockpid );
-                return -1;
-            }
-        }
-    }
-
-    /* write our PID into the pid file */
-    pidfile_fd = open( lock->temp, O_WRONLY | O_CREAT | O_TRUNC );
-    if (pidfile_fd < 0) {
-        if (errno == EACCES) {
-            if ( unlink_file( lock->temp ) < 0 ) {
-                D( "could not remove '%s': %s\n", lock->temp, strerror(errno) );
-                return -1;
-            }
-            pidfile_fd = open( lock->temp, O_WRONLY | O_CREAT | O_TRUNC );
-        }
-        if (pidfile_fd < 0) {
-            D( "could not create '%s': %s\n", lock->temp, strerror(errno) );
-            return -1;
-        }
-    }
-
-    {
-        char  buf[16];
-        sprintf( buf, "%ld", GetCurrentProcessId() );
-        ret = write( pidfile_fd, buf, strlen(buf) );
-        close(pidfile_fd);
-        if (ret < 0) {
-            D( "could not write PID to '%s'\n", lock->temp );
-            return -1;
-        }
-    }
-
-    lock->locked = 1;
-    return 0;
-#else
-    int    temp_fd = -1;
-    int    lock_fd = -1;
-    int    rc, tries, _sleep;
-    FILE*  f = NULL;
-    char   pid[8];
-    struct stat  st_temp;
-
-    strcpy( lock->temp, lock->file );
-    strcat( lock->temp, TEMP_NAME );
-    temp_fd = mkstemp( lock->temp );
-
-    if (temp_fd < 0) {
-        D("cannot create locking temp file '%s'", lock->temp );
-        goto Fail;
-    }
-
-    sprintf( pid, "%d", getpid() );
-    ret = write( temp_fd, pid, strlen(pid)+1 );
-    if (ret < 0) {
-        D( "cannot write to locking temp file '%s'", lock->temp);
-        goto Fail;
-    }
-    close( temp_fd );
-    temp_fd = -1;
-
-    CHECKED(rc, lstat( lock->temp, &st_temp ));
-    if (rc < 0) {
-        D( "can't properly stat our locking temp file '%s'", lock->temp );
-        goto Fail;
-    }
-
-    /* now attempt to link the temp file to the lock file */
-    _sleep = 0;
-    for ( tries = 4; tries > 0; tries-- )
-    {
-        struct stat  st_lock;
-        int          rc;
-
-        if (_sleep > 0) {
-            if (_sleep > 2000000) {
-                D( "cannot acquire lock file '%s'", lock->lock );
-                goto Fail;
-            }
-            usleep( _sleep );
-        }
-        _sleep += 200000;
-
-        /* the return value of link() is buggy on NFS */
-        CHECKED(rc, link( lock->temp, lock->lock ));
-
-        CHECKED(rc, lstat( lock->lock, &st_lock ));
-        if (rc == 0 &&
-            st_temp.st_rdev == st_lock.st_rdev &&
-            st_temp.st_ino  == st_lock.st_ino  )
-        {
-            /* SUCCESS */
-            lock->locked = 1;
-            CHECKED(rc, unlink( lock->temp ));
-            return 0;
-        }
-
-        /* if we get there, it means that the link() call failed */
-        /* check the lockfile to see if it is stale              */
-        if (rc == 0) {
-            char    buf[16];
-            time_t  now;
-            int     lockpid = 0;
-            int     lockfd;
-            int     stale = 2;  /* means don't know */
-            struct stat  st;
-
-            CHECKED(rc, time( &now));
-            st.st_mtime = now - 120;
-
-            CHECKED(lockfd, open( lock->lock,O_RDONLY ));
-            if ( lockfd >= 0 ) {
-                int  len;
-
-                CHECKED(len, read( lockfd, buf, sizeof(buf)-1 ));
-                buf[len] = 0;
-                lockpid = atoi(buf);
-
-                CHECKED(rc, fstat( lockfd, &st ));
-                if (rc == 0)
-                  now = st.st_atime;
-
-                CHECKED(rc, close(lockfd));
-            }
-            /* if there is a PID, check that it is still alive */
-            if (lockpid > 0) {
-                CHECKED(rc, kill( lockpid, 0 ));
-                if (rc == 0 || errno == EPERM) {
-                    stale = 0;
-                } else if (rc < 0 && errno == ESRCH) {
-                    stale = 1;
-                }
-            }
-            if (stale == 2) {
-                /* no pid, stale if the file is older than 1 minute */
-                stale = (now >= st.st_mtime + 60);
-            }
-
-            if (stale) {
-                D( "removing stale lockfile '%s'", lock->lock );
-                CHECKED(rc, unlink( lock->lock ));
-                _sleep = 0;
-                tries++;
-            }
-        }
-    }
-    D("file '%s' is already in use by another process", lock->file );
-
-Fail:
-    if (f)
-        fclose(f);
-
-    if (temp_fd >= 0) {
-        close(temp_fd);
-    }
-
-    if (lock_fd >= 0) {
-        close(lock_fd);
-    }
-
-    unlink( lock->lock );
-    unlink( lock->temp );
-    return -1;
-#endif
-}
-
-void
-filelock_release( FileLock*  lock )
-{
-    if (lock->locked) {
-#ifdef _WIN32
-        unlink_file( (char*)lock->temp );
-        rmdir( (char*)lock->lock );
-#else
-        unlink( (char*)lock->lock );
-#endif
-        lock->locked = 0;
-    }
-}
-
-static void
-filelock_atexit( void )
-{
-  FileLock*  lock;
-
-  for (lock = _all_filelocks; lock != NULL; lock = lock->next)
-     filelock_release( lock );
-}
-
-/* create a file lock */
-FileLock*
-filelock_create( const char*  file )
-{
-    int    file_len = strlen(file);
-    int    lock_len = file_len + sizeof(LOCK_NAME);
-#ifdef _WIN32
-    int    temp_len = lock_len + 1 + sizeof(PIDFILE_NAME);
-#else
-    int    temp_len = file_len + sizeof(TEMP_NAME);
-#endif
-    int    total_len = sizeof(FileLock) + file_len + lock_len + temp_len + 3;
-
-    FileLock*  lock = malloc(total_len);
-
-    lock->file = (const char*)(lock + 1);
-    memcpy( (char*)lock->file, file, file_len+1 );
-
-    lock->lock = lock->file + file_len + 1;
-    memcpy( (char*)lock->lock, file, file_len+1 );
-    strcat( (char*)lock->lock, LOCK_NAME );
-
-    lock->temp    = (char*)lock->lock + lock_len + 1;
-#ifdef _WIN32
-    snprintf( (char*)lock->temp, temp_len, "%s\\" PIDFILE_NAME, lock->lock );
-#else
-    lock->temp[0] = 0;
-#endif
-    lock->locked = 0;
-
-    if (filelock_lock(lock) < 0) {
-        free(lock);
-        return NULL;
-    }
-
-    lock->next     = _all_filelocks;
-    _all_filelocks = lock;
-
-    if (lock->next == NULL)
-        atexit( filelock_atexit );
-
-    return lock;
-}
-
-/** TEMP FILE SUPPORT
- **
- ** simple interface to create an empty temporary file on the system.
- **
- ** create the file with tempfile_create(), which returns a reference to a TempFile
- ** object, or NULL if your system is so weird it doesn't have a temporary directory.
- **
- ** you can then call tempfile_path() to retrieve the TempFile's real path to open
- ** it. the returned path is owned by the TempFile object and should not be freed.
- **
- ** all temporary files are destroyed when the program quits, unless you explicitely
- ** close them before that with tempfile_close()
- **/
-
-struct TempFile
-{
-    const char*  name;
-    TempFile*    next;
-};
-
-static void       tempfile_atexit();
-static TempFile*  _all_tempfiles;
-
-TempFile*
-tempfile_create( void )
-{
-    TempFile*    tempfile;
-    const char*  tempname = NULL;
-
-#ifdef _WIN32
-    char  temp_namebuff[MAX_PATH];
-    char  temp_dir[MAX_PATH];
-    char  *p = temp_dir, *end = p + sizeof(temp_dir);
-    UINT  retval;
-
-    p = bufprint_temp_dir( p, end );
-    if (p >= end) {
-        D( "TEMP directory path is too long" );
-        return NULL;
-    }
-
-    retval = GetTempFileName(temp_dir, "TMP", 0, temp_namebuff);
-    if (retval == 0) {
-        D( "can't create temporary file in '%s'", temp_dir );
-        return NULL;
-    }
-
-    tempname = temp_namebuff;
-#else
-#define  TEMPLATE  "/tmp/.android-emulator-XXXXXX"
-    int   tempfd = -1;
-    char  template[512];
-    char  *p = template, *end = p + sizeof(template);
-
-    p = bufprint_temp_file( p, end, "emulator-XXXXXX" );
-    if (p >= end) {
-        D( "Xcannot create temporary file in /tmp/android !!" );
-        return NULL;
-    }
-
-    D( "template: %s", template );
-    tempfd = mkstemp( template );
-    if (tempfd < 0) {
-        D("cannot create temporary file in /tmp/android !!");
-        return NULL;
-    }
-    close(tempfd);
-    tempname = template;
-#endif
-    tempfile = malloc( sizeof(*tempfile) + strlen(tempname) + 1 );
-    tempfile->name = (char*)(tempfile + 1);
-    strcpy( (char*)tempfile->name, tempname );
-
-    tempfile->next = _all_tempfiles;
-    _all_tempfiles = tempfile;
-
-    if ( !tempfile->next ) {
-        atexit( tempfile_atexit );
-    }
-
-    return tempfile;
-}
-
-const char*
-tempfile_path(TempFile*  temp)
-{
-    return temp ? temp->name : NULL;
-}
-
-void
-tempfile_close(TempFile*  tempfile)
-{
-#ifdef _WIN32
-    DeleteFile(tempfile->name);
-#else
-    unlink(tempfile->name);
-#endif
-}
-
-/** TEMP FILE CLEANUP
- **
- **/
-
-/* we don't expect to use many temporary files */
-#define MAX_ATEXIT_FDS  16
-
-typedef struct {
-    int   count;
-    int   fds[ MAX_ATEXIT_FDS ];
-} AtExitFds;
-
-static void
-atexit_fds_add( AtExitFds*  t, int  fd )
-{
-    if (t->count < MAX_ATEXIT_FDS)
-        t->fds[t->count++] = fd;
-    else {
-        dwarning("%s: over %d calls. Program exit may not cleanup all temporary files",
-            __FUNCTION__, MAX_ATEXIT_FDS);
-    }
-}
-
-static void
-atexit_fds_del( AtExitFds*  t, int  fd )
-{
-    int  nn;
-    for (nn = 0; nn < t->count; nn++)
-        if (t->fds[nn] == fd) {
-            /* move the last element to the current position */
-            t->count  -= 1;
-            t->fds[nn] = t->fds[t->count];
-            break;
-        }
-}
-
-static void
-atexit_fds_close_all( AtExitFds*  t )
-{
-    int  nn;
-    for (nn = 0; nn < t->count; nn++)
-        close(t->fds[nn]);
-}
-
-static AtExitFds   _atexit_fds[1];
-
-void
-atexit_close_fd(int  fd)
-{
-    if (fd >= 0)
-        atexit_fds_add(_atexit_fds, fd);
-}
-
-void
-atexit_close_fd_remove(int  fd)
-{
-    if (fd >= 0)
-        atexit_fds_del(_atexit_fds, fd);
-}
-
-static void
-tempfile_atexit( void )
-{
-    TempFile*  tempfile;
-
-    atexit_fds_close_all( _atexit_fds );
-
-    for (tempfile = _all_tempfiles; tempfile; tempfile = tempfile->next)
-        tempfile_close(tempfile);
-}
-
-
-/** OTHER FILE UTILITIES
- **
- **  make_empty_file() creates an empty file at a given path location.
- **  if the file already exists, it is truncated without warning
- **
- **  copy_file() copies one file into another.
- **
- **  both functions return 0 on success, and -1 on error
- **/
-
-int
-make_empty_file( const char*  path )
-{
-#ifdef _WIN32
-    int  fd = _creat( path, S_IWRITE );
-#else
-    /* on Unix, only allow the owner to read/write, since the file *
-     * may contain some personal data we don't want to see exposed */
-    int  fd = creat(path, S_IRUSR | S_IWUSR);
-#endif
-    if (fd >= 0) {
-        close(fd);
-        return 0;
-    }
-    return -1;
-}
-
-int
-copy_file( const char*  dest, const char*  source )
-{
-    int  fd, fs, result = -1;
-
-    if ( access(source, F_OK)  < 0 ||
-         make_empty_file(dest) < 0) {
-        return -1;
-    }
-
-#ifdef _WIN32
-    fd = _open(dest, _O_RDWR | _O_BINARY);
-    fs = _open(source, _O_RDONLY |  _O_BINARY);
-#else
-    fd = creat(dest, S_IRUSR | S_IWUSR);
-    fs = open(source, S_IREAD);
-#endif
-    if (fs >= 0 && fd >= 0) {
-        char buf[4096];
-        ssize_t total = 0;
-        ssize_t n;
-        result = 0; /* success */
-        while ((n = read(fs, buf, 4096)) > 0) {
-            if (write(fd, buf, n) != n) {
-                /* write failed. Make it return -1 so that an
-                 * empty file be created. */
-                D("Failed to copy '%s' to '%s': %s (%d)",
-                       source, dest, strerror(errno), errno);
-                result = -1;
-                break;
-            }
-            total += n;
-        }
-    }
-
-    if (fs >= 0) {
-        close(fs);
-    }
-    if (fd >= 0) {
-        close(fd);
-    }
-    return result;
-}
-
-int
-unlink_file( const char*  path )
-{
-#ifdef _WIN32
-    int  ret = _unlink( path );
-    if (ret == -1 && errno == EACCES) {
-        /* a first call to _unlink will fail if the file is set read-only */
-        /* we can however try to change its mode first and call unlink    */
-        /* again...                                                       */
-        ret = _chmod( path, _S_IREAD | _S_IWRITE );
-        if (ret == 0)
-            ret = _unlink( path );
-    }
-    return ret;
-#else
-    return  unlink(path);
-#endif
-}
-
-
-void*
-load_text_file(const char *fn)
-{
-    char *data;
-    int sz;
-    int fd;
-
-    data = NULL;
-    fd = open(fn, O_BINARY | O_RDONLY);
-    if(fd < 0) return NULL;
-
-    sz = lseek(fd, 0, SEEK_END);
-    if(sz < 0) goto oops;
-
-    if(lseek(fd, 0, SEEK_SET) != 0) goto oops;
-
-    data = (char*) malloc(sz + 1);
-    if(data == 0) goto oops;
-
-    if(read(fd, data, sz) != sz) goto oops;
-    close(fd);
-    data[sz] = 0;
-
-    return data;
-
-oops:
-    close(fd);
-    if(data != 0)
-        free(data);
-    return NULL;
-}
-
-/** HOST RESOLUTION SETTINGS
- **
- ** return the main monitor's DPI resolution according to the host device
- ** beware: this is not always reliable or even obtainable.
- **
- ** returns 0 on success, or -1 in case of error (e.g. the system returns funky values)
- **/
-
-/** NOTE: the following code assumes that we exclusively use X11 on Linux, and Quartz on OS X
- **/
-
-#ifdef _WIN32
-int
-get_monitor_resolution( int  *px_dpi, int  *py_dpi )
-{
-    HDC  displayDC = CreateDC( "DISPLAY", NULL, NULL, NULL );
-    int  xdpi, ydpi;
-
-    if (displayDC == NULL) {
-        D( "%s: could not get display DC\n", __FUNCTION__ );
-        return -1;
-    }
-    xdpi = GetDeviceCaps( displayDC, LOGPIXELSX );
-    ydpi = GetDeviceCaps( displayDC, LOGPIXELSY );
-
-    /* sanity checks */
-    if (xdpi < 20 || xdpi > 400 || ydpi < 20 || ydpi > 400) {
-        D( "%s: bad resolution: xpi=%d ydpi=%d", __FUNCTION__,
-                xdpi, ydpi );
-        return -1;
-    }
-
-    *px_dpi = xdpi;
-    *py_dpi = ydpi;
-    return 0;
-}
-#elif defined __APPLE__
-int
-get_monitor_resolution( int  *px_dpi, int  *py_dpi )
-{
-    fprintf(stderr, "emulator: FIXME: implement get_monitor_resolution on OS X\n" );
-    return -1;
-}
-#else  /* Linux and others */
-#include <SDL.h>
-#include <SDL_syswm.h>
-#include <dlfcn.h>
-#include <X11/Xlib.h>
-#define  MM_PER_INCH   25.4
-
-#define  DYNLINK_FUNCTIONS  \
-    DYNLINK_FUNC(int,XDefaultScreen,(Display*)) \
-    DYNLINK_FUNC(int,XDisplayWidth,(Display*,int)) \
-    DYNLINK_FUNC(int,XDisplayWidthMM,(Display*,int)) \
-    DYNLINK_FUNC(int,XDisplayHeight,(Display*,int)) \
-    DYNLINK_FUNC(int,XDisplayHeightMM,(Display*,int)) \
-
-#define  DYNLINK_FUNCTIONS_INIT \
-    x11_dynlink_init
-
-#include "dynlink.h"
-
-static int    x11_lib_inited;
-static void*  x11_lib;
-
-int
-x11_lib_init( void )
-{
-    if (!x11_lib_inited) {
-        x11_lib_inited = 1;
-
-        x11_lib = dlopen( "libX11.so", RTLD_NOW );
-
-        if (x11_lib == NULL) {
-            x11_lib = dlopen( "libX11.so.6", RTLD_NOW );
-        }
-        if (x11_lib == NULL) {
-            D("%s: Could not find libX11.so on this machine",
-              __FUNCTION__);
-            return -1;
-        }
-
-        if (x11_dynlink_init(x11_lib) < 0) {
-            D("%s: didn't find necessary symbols in libX11.so",
-              __FUNCTION__);
-            dlclose(x11_lib);
-            x11_lib = NULL;
-        }
-    }
-    return x11_lib ? 0 : -1;
-}
-
-
-int
-get_monitor_resolution( int  *px_dpi, int  *py_dpi )
-{
-    SDL_SysWMinfo info;
-    Display*      display;
-    int           screen;
-    int           width, width_mm, height, height_mm, xdpi, ydpi;
-
-    SDL_VERSION(&info.version);
-
-    if ( !SDL_GetWMInfo(&info) ) {
-        D( "%s: SDL_GetWMInfo() failed: %s", __FUNCTION__, SDL_GetError());
-        return -1;
-    }
-
-    if (x11_lib_init() < 0)
-        return -1;
-
-    display = info.info.x11.display;
-    screen  = FF(XDefaultScreen)(display);
-
-    width     = FF(XDisplayWidth)(display, screen);
-    width_mm  = FF(XDisplayWidthMM)(display, screen);
-    height    = FF(XDisplayHeight)(display, screen);
-    height_mm = FF(XDisplayHeightMM)(display, screen);
-
-    if (width_mm <= 0 || height_mm <= 0) {
-        D( "%s: bad screen dimensions: width_mm = %d, height_mm = %d",
-                __FUNCTION__, width_mm, height_mm);
-        return -1;
-    }
-
-    D( "%s: found screen width=%d height=%d width_mm=%d height_mm=%d",
-            __FUNCTION__, width, height, width_mm, height_mm );
-
-    xdpi = width  * MM_PER_INCH / width_mm;
-    ydpi = height * MM_PER_INCH / height_mm;
-
-    if (xdpi < 20 || xdpi > 400 || ydpi < 20 || ydpi > 400) {
-        D( "%s: bad resolution: xpi=%d ydpi=%d", __FUNCTION__,
-                xdpi, ydpi );
-        return -1;
-    }
-
-    *px_dpi = xdpi;
-    *py_dpi = ydpi;
-
-    return 0;
-}
-#endif
-
-
-
-void
-disable_sigalrm( signal_state_t  *state )
-{
-#ifdef _WIN32
-    (void)state;
-#else
-    sigset_t  set;
-
-    sigemptyset(&set);
-    sigaddset(&set, SIGALRM);
-    pthread_sigmask (SIG_BLOCK, &set, &state->old);
-#endif
-}
-
-void
-restore_sigalrm( signal_state_t  *state )
-{
-#ifdef _WIN32
-    (void)state;
-#else
-    pthread_sigmask (SIG_SETMASK, &state->old, NULL);
-#endif
-}
-
-void
-sleep_ms( int  timeout_ms )
-{
-#ifdef _WIN32
-    if (timeout_ms <= 0)
-        return;
-
-    Sleep( timeout_ms );
-#else
-    if (timeout_ms <= 0)
-        return;
-
-    BEGIN_NOSIGALRM
-    usleep( timeout_ms*1000 );
-    END_NOSIGALRM
-#endif
-}
-
-
-extern void
-print_tabular( const char** strings, int  count,
-               const char*  prefix,  int  width )
-{
-    int  nrows, ncols, r, c, n, maxw = 0;
-
-    for (n = 0; n < count; n++) {
-        int  len = strlen(strings[n]);
-        if (len > maxw)
-            maxw = len;
-    }
-    maxw += 2;
-    ncols = width/maxw;
-    nrows = (count + ncols-1)/ncols;
-
-    for (r = 0; r < nrows; r++) {
-        printf( "%s", prefix );
-        for (c = 0; c < ncols; c++) {
-            int  index = c*nrows + r;
-            if (index >= count) {
-                break;
-            }
-            printf( "%-*s", maxw, strings[index] );
-        }
-        printf( "\n" );
-    }
-}
-
-extern void
-stralloc_tabular( stralloc_t*  out, 
-                  const char** strings, int  count,
-                  const char*  prefix,  int  width )
-{
-    int  nrows, ncols, r, c, n, maxw = 0;
-
-    for (n = 0; n < count; n++) {
-        int  len = strlen(strings[n]);
-        if (len > maxw)
-            maxw = len;
-    }
-    maxw += 2;
-    ncols = width/maxw;
-    nrows = (count + ncols-1)/ncols;
-
-    for (r = 0; r < nrows; r++) {
-        stralloc_add_str( out, prefix );
-        for (c = 0; c < ncols; c++) {
-            int  index = c*nrows + r;
-            if (index >= count) {
-                break;
-            }
-            stralloc_add_format( out, "%-*s", maxw, strings[index] );
-        }
-        stralloc_add_str( out, "\n" );
-    }
-}
-
-extern void
-string_translate_char( char*  str, char from, char to )
-{
-    char*  p = str;
-    while (p != NULL && (p = strchr(p, from)) != NULL)
-        *p++ = to;
-}
-
-extern void
-buffer_translate_char( char*        buff,
-                       unsigned     buffLen,
-                       const char*  src,
-                       char         fromChar,
-                       char         toChar )
-{
-    int    len = strlen(src);
-
-    if (len >= buffLen)
-        len = buffLen-1;
-
-    memcpy(buff, src, len);
-    buff[len] = 0;
-
-    string_translate_char( buff, fromChar, toChar );
-}
-
-
-/** DYNAMIC STRINGS
- **/
-
-extern void
-stralloc_reset( stralloc_t*  s )
-{
-    free(s->s);
-    s->s = NULL;
-    s->n = 0;
-    s->a = 0;
-}
-
-extern void
-stralloc_ready( stralloc_t*  s, unsigned int  len )
-{
-    unsigned  old_max = s->a;
-    unsigned  new_max = old_max;
-
-    while (new_max < len) {
-        unsigned  new_max2 = new_max + (new_max >> 1) + 16;
-        if (new_max2 < new_max)
-            new_max2 = UINT_MAX;
-        new_max = new_max2;
-    }
-
-    s->s = realloc( s->s, new_max );
-    if (s->s == NULL) {
-        derror( "%s: not enough memory to reallocate %ld bytes",
-                __FUNCTION__, new_max );
-        exit(1);
-    }
-    s->a = new_max;
-}
-
-extern void
-stralloc_readyplus( stralloc_t*  s, unsigned int  len )
-{
-    unsigned  len2 = s->n + len;
-
-    if (len2 < s->n) { /* overflow ? */
-        derror("%s: trying to grow by too many bytes: %ld",
-               __FUNCTION__, len);
-        exit(1);
-    }
-    stralloc_ready( s, len2 );
-}
-
-extern void
-stralloc_copy( stralloc_t*  s, stralloc_t*  from )
-{
-    stralloc_ready(s, from->n);
-    memcpy( s->s, from->s, from->n );
-    s->n = from->n;
-}
-
-extern void
-stralloc_append( stralloc_t*  s, stralloc_t*  from )
-{
-    stralloc_readyplus( s, from->n );
-    memcpy( s->s + s->n, from->s, from->n );
-    s->n += from->n;
-}
-
-extern void
-stralloc_add_c( stralloc_t*  s, int  c )
-{
-    stralloc_add_bytes( s, (char*)&c, 1 );
-}
-
-extern void
-stralloc_add_str( stralloc_t*  s, const char*  str )
-{
-    stralloc_add_bytes( s, str, strlen(str) );
-}
-
-extern void
-stralloc_add_bytes( stralloc_t*  s, const void*  from, unsigned len )
-{
-    stralloc_readyplus( s, len );
-    memcpy( s->s + s->n, from, len );
-    s->n += len;
-}
-
-extern char*
-stralloc_cstr( stralloc_t*  s )
-{
-    stralloc_readyplus( s, 1 );
-    s->s[s->n] = 0;
-    return s->s;
-}
-
-extern void
-stralloc_format( stralloc_t*  s, const char*  fmt, ... )
-{
-    stralloc_reset(s);
-    stralloc_ready(s, 10);
-
-    while (1) {
-        int      n;
-        va_list  args;
-
-        va_start(args, fmt);
-        n = vsnprintf( s->s, s->a, fmt, args );
-        va_end(args);
-
-        /* funky old C libraries returns -1 when truncation occurs */
-        if (n > -1 && n < s->a) {
-            s->n = n;
-            break;
-        }
-        if (n > -1) {  /* we now precisely what we need */
-            stralloc_ready( s, n+1 );
-        } else {
-            stralloc_ready( s, s->a*2 );
-        }
-    }
-}
-
-extern void
-stralloc_add_format( stralloc_t*  s, const char*  fmt, ... )
-{
-    STRALLOC_DEFINE(s2);
-
-    stralloc_ready(s, 10);
-    while (1) {
-        int      n;
-        va_list  args;
-
-        va_start(args, fmt);
-        n = vsnprintf( s2->s, s2->a, fmt, args );
-        va_end(args);
-
-        /* some C libraries return -1 when truncation occurs */
-        if (n > -1 && n < s2->a) {
-            s2->n = n;
-            break;
-        }
-        if (n > -1) {  /* we now precisely what we need */
-            stralloc_ready( s2, n+1 );
-        } else {
-            stralloc_ready( s2, s2->a*2 );
-        }
-    }
-
-    stralloc_append( s, s2 );
-    stralloc_reset( s2 );
-}
-
-
-extern void
-stralloc_add_quote_c( stralloc_t*  s, int  c )
-{
-    stralloc_add_quote_bytes( s, (char*)&c, 1 );
-}
-
-extern void
-stralloc_add_quote_str( stralloc_t*  s, const char*  str )
-{
-    stralloc_add_quote_bytes( s, str, strlen(str) );
-}
-
-extern void
-stralloc_add_quote_bytes( stralloc_t*  s, const void*  from, unsigned  len )
-{
-    uint8_t*   p   = (uint8_t*) from;
-    uint8_t*   end = p + len;
-
-    for ( ; p < end; p++ ) {
-        int  c = p[0];
-
-        if (c == '\\') {
-            stralloc_add_str( s, "\\\\" );
-        } else if (c >= ' ' && c < 128) {
-            stralloc_add_c( s, c );
-        } else if (c == '\n') {
-            stralloc_add_str( s, "\\n" );
-        } else if (c == '\t') {
-            stralloc_add_str( s, "\\t" );
-        } else if (c == '\r') {
-            stralloc_add_str( s, "\\r" );
-        } else {
-            stralloc_add_format( s, "\\x%02x", c );
-        }
-    }
-}
-
-extern void
-stralloc_add_hex( stralloc_t*  s, unsigned  value, int  num_digits )
-{
-    const char   hexdigits[16] = "0123456789abcdef";
-    int          nn;
-
-    if (num_digits <= 0)
-        return;
-
-    stralloc_readyplus(s, num_digits);
-    for (nn = num_digits-1; nn >= 0; nn--) {
-        s->s[s->n+nn] = hexdigits[value & 15];
-        value >>= 4;
-    }
-    s->n += num_digits;
-}
-
-extern void
-stralloc_add_hexdump( stralloc_t*  s, void*  base, int  size, const char*  prefix )
-{
-    uint8_t*   p          = (uint8_t*)base;
-    const int  max_count  = 16;
-    int        prefix_len = strlen(prefix);
-
-    while (size > 0) {
-        int          count = size > max_count ? max_count : size;
-        int          count2;
-        int          n;
-
-        stralloc_add_bytes( s, prefix, prefix_len );
-        stralloc_add_hex( s, p[0], 2 );
-
-        for (n = 1; n < count; n++) {
-            stralloc_add_c( s, ' ' );
-            stralloc_add_hex( s, p[n], 2 );
-        }
-
-        count2 = 4 + 3*(max_count - count);
-        stralloc_readyplus( s, count2 );
-        memset( s->s + s->n, ' ', count2 );
-        s->n += count2;
-
-        stralloc_readyplus(s, count+1);
-        for (n = 0; n < count; n++) {
-            int  c = p[n];
-
-            if (c < 32 || c > 127)
-                c = '.';
-
-            s->s[s->n++] = c;
-        }
-        s->s[s->n++] = '\n';
-
-        size -= count;
-        p    += count;
-    }
-}
-
-/** TEMP CHAR STRINGS
- **
- ** implement a circular ring of temporary string buffers
- **/
-
-typedef struct Temptring {
-    struct TempString*  next;
-    char*               buffer;
-    int                 size;
-} TempString;
-
-#define  MAX_TEMP_STRINGS   16
-
-static TempString  _temp_strings[ MAX_TEMP_STRINGS ];
-static int         _temp_string_n;
-
-extern char*
-tempstr_get( int  size )
-{
-    TempString*  t = &_temp_strings[_temp_string_n];
-
-    if ( ++_temp_string_n >= MAX_TEMP_STRINGS )
-        _temp_string_n = 0;
-
-    size += 1;  /* reserve 1 char for terminating zero */
-
-    if (t->size < size) {
-        t->buffer = realloc( t->buffer, size );
-        if (t->buffer == NULL) {
-            derror( "%s: could not allocate %d bytes",
-                    __FUNCTION__, size );
-            exit(1);
-        }
-        t->size   = size;
-    }
-    return  t->buffer;
-}
-
-extern char*
-tempstr_from_stralloc( stralloc_t*  s )
-{
-    char*  q = tempstr_get( s->n );
-
-    memcpy( q, s->s, s->n );
-    q[s->n] = 0;
-    return q;
-}
-
-/** QUOTING
- **
- ** dumps a human-readable version of a string. this replaces
- ** newlines with \n, etc...
- **/
-
-extern const char*
-quote_bytes( const char*  str, int  len )
-{
-    STRALLOC_DEFINE(s);
-    char*  q;
-
-    stralloc_add_quote_bytes( s, str, len );
-    q = tempstr_from_stralloc( s );
-    stralloc_reset(s);
-    return q;
-}
-
-extern const char*
-quote_str( const char*  str )
-{
-    int  len = strlen(str);
-    return quote_bytes( str, len );
-}
-
-/** DYNAMIC ARRAYS OF POINTERS
- **/
-
-void
-qvector_init( qvector_t*  v )
-{
-    v->i = NULL;
-    v->n = v->a = 0;
-}
-
-void
-qvector_reset( qvector_t*  v )
-{
-    free(v->i);
-    v->i = NULL;
-    v->n = v->a = 0;
-}
-
-void
-qvector_ready( qvector_t*  v, unsigned  len )
-{
-    unsigned  old_a = v->a;
-    unsigned  new_a = old_a;
-    unsigned  max_a = UINT_MAX/sizeof(v->i[0]);
-
-    if (len <= old_a)
-        return;
-
-    if (len > max_a) {
-        derror("panic: %s: length too long (%d)", __FUNCTION__, len);
-        exit(1);
-    }
-
-    while (new_a < len) {
-        unsigned  new_a2 = new_a + (new_a >> 1) + 8;
-        if (new_a2 < new_a || new_a2 > max_a)
-            new_a2 = max_a;
-        new_a = max_a;
-    }
-    v->i = realloc( v->i, new_a*sizeof(v->i[0]) );
-    v->a = new_a;
-}
-
-void
-qvector_readyplus( qvector_t*  v, unsigned len )
-{
-    unsigned  len2 = len + v->n;
-
-    if (len2 < len) {
-        derror("panic: %s: length too long (%d)", __FUNCTION__, len);
-        exit(1);
-    }
-    qvector_ready(v, len2);
-}
-
-void
-qvector_add( qvector_t*  v, void*  item )
-{
-    qvector_readyplus(v, 1);
-    v->i[v->n] = item;
-    v->n += 1;
-}
-
-int
-qvector_del( qvector_t*  v, void*  item )
-{
-    int  index = qvector_index(v, item);
-    if (index < 0) return 0;
-    qvector_remove(v, index);
-    return 1;
-}
-
-extern void*
-qvector_get( qvector_t*  v, int  index )
-{
-    if ((unsigned)index >= (unsigned)v->n)
-        return NULL;
-
-    return v->i[index];
-}
-
-extern void
-qvector_set( qvector_t*  v, int  index, void*  item )
-{
-    if ((unsigned)index < (unsigned)v->n)
-        v->i[index] = item;
- }
-
-int
-qvector_len( qvector_t*  v )
-{
-    return v->n;
-}
-
-int
-qvector_index( qvector_t*  v, void*  item )
-{
-    int  nn;
-    for (nn = 0; nn < v->n; nn++)
-        if (v->i[nn] == item)
-            return nn;
-    return -1;
-}
-
-void
-qvector_insert( qvector_t*  v, int  index, void*  item )
-{
-    if (index < 0) index = 0;
-    if (index > v->n) index = v->n;
-
-    memmove( v->i + index, v->i + index + 1, sizeof(v->i[0]) );
-    v->i[index] = item;
-    v->n += 1;
-}
-
-void
-qvector_remove( qvector_t*  v, int  index )
-{
-    if (index < 0 || index >= v->n )
-        return;
-
-    memmove( v->i + index + 1, v->i + index, v->n - index - 1 );
-    v->n -= 1;
-}
-
-void
-qvector_remove_n( qvector_t*  v, int  index, int  count )
-{
-    int  end = index + count;
-
-    if (index < 0 || index >= v->n || end <= index)
-        return;
-
-    if (end > v->n) {
-        end = v->n;
-        count = end - index;
-    }
-
-    memmove( v->i + index + count, v->i + index, v->n - index - count );
-    v->n -= count;
-}
-
-
-/** HEXADECIMAL CHARACTER SEQUENCES
- **/
-
-static int
-hexdigit( int  c )
-{
-    unsigned  d;
-
-    d = (unsigned)(c - '0');
-    if (d < 10) return d;
-
-    d = (unsigned)(c - 'a');
-    if (d < 6) return d+10;
-
-    d = (unsigned)(c - 'A');
-    if (d < 6) return d+10;
-
-    return -1;
-}
-
-int
-hex2int( const uint8_t*  hex, int  len )
-{
-    int  result = 0;
-    while (len > 0) {
-        int  c = hexdigit(*hex++);
-        if (c < 0)
-            return -1;
-
-        result = (result << 4) | c;
-        len --;
-    }
-    return result;
-}
-
-void
-int2hex( uint8_t*  hex, int  len, int  val )
-{
-    static const uint8_t  hexchars[16] = "0123456789abcdef";
-    while ( --len >= 0 )
-        *hex++ = hexchars[(val >> (len*4)) & 15];
-}
diff --git a/android_utils.h b/android_utils.h
deleted file mode 100644
index 42a0d61..0000000
--- a/android_utils.h
+++ /dev/null
@@ -1,433 +0,0 @@
-/* Copyright (C) 2007-2008 The Android Open Source Project
-**
-** This software is licensed under the terms of the GNU General Public
-** License version 2, as published by the Free Software Foundation, and
-** may be copied, distributed, and modified under those terms.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-** GNU General Public License for more details.
-*/
-#ifndef _ANDROID_UTILS_H
-#define _ANDROID_UTILS_H
-
-#include "android_debug.h"
-#include <stdint.h>  /* for uint64_t */
-
-#ifndef STRINGIFY
-#define  _STRINGIFY(x)  #x
-#define  STRINGIFY(x)  _STRINGIFY(x)
-#endif
-
-#ifndef GLUE
-#define  _GLUE(x,y)  x##y
-#define  GLUE(x,y)   _GLUE(x,y)
-
-#define  _GLUE3(x,y,z)  x##y##z
-#define  GLUE3(x,y,z)    _GLUE3(x,y,z)
-#endif
-
-/* O_BINARY is required in the MS C library to avoid opening file
- * in text mode (the default, ahhhhh)
- */
-#if !defined(_WIN32) && !defined(O_BINARY)
-#  define  O_BINARY  0
-#endif
-
-/* define  PATH_SEP as a string containing the directory separateor */
-#ifdef _WIN32
-#  define  PATH_SEP   "\\"
-#else
-#  define  PATH_SEP   "/"
-#endif
-
-/* get MAX_PATH, note that PATH_MAX is set to 260 on Windows for
- * stupid backwards-compatibility reason, though any 32-bit version
- * of the OS handles much much longer paths
- */
-#ifdef _WIN32
-#  undef   MAX_PATH
-#  define  MAX_PATH    1024
-#  undef   PATH_MAX
-#  define  PATH_MAX    MAX_PATH
-#else
-#  include <limits.h>
-#  define  MAX_PATH    PATH_MAX
-#endif
-
-#ifdef _WIN32
-#  define  strcasecmp  stricmp
-#endif
-
-
-#ifdef _WIN32
-#  undef   strsep
-#  define  strsep    win32_strsep
-extern char*  win32_strsep(char**  pline, const char*  delim);
-#endif
-
-/** NON-GRAPHIC USAGE
- **
- ** this variable is TRUE if the -no-window argument was used.
- ** the emulator will still simulate a framebuffer according to the selected skin
- ** but no window will be displayed on the host computer.
- **/
-extern int    arg_no_window;
-
-/** EINTR HANDLING
- **
- ** since QEMU uses SIGALRM pretty extensively, having a system call returning
- ** EINTR on Unix happens very frequently. provide a simple macro to guard against
- ** this.
- **/
-
-#ifdef _WIN32
-#  define   CHECKED(ret, call)    (ret) = (call)
-#else
-#  define   CHECKED(ret, call)    do { (ret) = (call); } while ((ret) < 0 && errno == EINTR)
-#endif
-
-/** MISC FILE AND DIRECTORY HANDLING
- **/
-
-/* checks that a given file exists */
-extern int   path_exists( const char*  path );
-
-/* checks that a path points to a regular file */
-extern int   path_is_regular( const char*  path );
-
-/* checks that a path points to a directory */
-extern int   path_is_dir( const char*  path );
-
-/* checks that one can read/write a given (regular) file */
-extern int   path_can_read( const char*  path );
-extern int   path_can_write( const char*  path );
-
-/* try to make a directory. returns 0 on success, -1 on error */
-extern int   path_mkdir( const char*  path, int  mode );
-
-/* ensure that a given directory exists, create it if not, 
-   0 on success, -1 on error */
-extern int   path_mkdir_if_needed( const char*  path, int  mode );
-
-/* return the size of a given file in '*psize'. returns 0 on
- * success, -1 on failure (error code in errno) */
-extern int   path_get_size( const char*  path, uint64_t  *psize );
-
-/** PATH HANDLING ROUTINES
- **
- **  path_parent() can be used to return the n-level parent of a given directory
- **  this understands . and .. when encountered in the input path
- **/
-
-extern char*  path_parent( const char*  path, int  levels );
-
-/** FORMATTED BUFFER PRINTING
- **
- **  bufprint() allows your to easily and safely append formatted string
- **  content to a given bounded character buffer, in a way that is easier
- **  to use than raw snprintf()
- **
- **  'buffer'  is the start position in the buffer,
- **  'buffend' is the end of the buffer, the function assumes (buffer <= buffend)
- **  'format'  is a standard printf-style format string, followed by any number
- **            of formatting arguments
- **
- **  the function returns the next position in the buffer if everything fits
- **  in it. in case of overflow or formatting error, it will always return "buffend"
- **
- **  this allows you to chain several calls to bufprint() and only check for
- **  overflow at the end, for exemple:
- **
- **     char   buffer[1024];
- **     char*  p   = buffer;
- **     char*  end = p + sizeof(buffer);
- **
- **     p = bufprint(p, end, "%s/%s", first, second);
- **     p = bufprint(p, end, "/%s", third);
- **     if (p >= end) ---> overflow
- **
- **  as a convenience, the appended string is zero-terminated if there is no overflow.
- **  (this means that even if p >= end, the content of "buffer" is zero-terminated)
- **
- **  vbufprint() is a variant that accepts a va_list argument
- **/
-
-extern char*   vbufprint(char*  buffer, char*  buffend, const char*  fmt, va_list  args );
-extern char*   bufprint (char*  buffer, char*  buffend, const char*  fmt, ... );
-
-/** USEFUL DIRECTORY SUPPORT
- **
- **  bufprint_add_dir() appends the application's directory to a given bounded buffer
- **
- **  bufprint_config_path() appends the applications' user-specific configuration directory
- **  to a bounded buffer. on Unix this is usually ~/.android, and something a bit more
- **  complex on Windows
- **
- **  bufprint_config_file() appends the name of a file or directory relative to the
- **  user-specific configuration directory to a bounded buffer. this really is equivalent
- **  to concat-ing the config path + path separator + 'suffix'
- **
- **  bufprint_temp_dir() appends the temporary directory's path to a given bounded buffer
- **
- **  bufprint_temp_file() appens the name of a file or directory relative to the
- **  temporary directory. equivalent to concat-ing the temp path + path separator + 'suffix'
- **/
-
-extern char*  bufprint_app_dir    (char*  buffer, char*  buffend);
-extern char*  bufprint_config_path(char*  buffer, char*  buffend);
-extern char*  bufprint_config_file(char*  buffer, char*  buffend, const char*  suffix);
-extern char*  bufprint_temp_dir   (char*  buffer, char*  buffend);
-extern char*  bufprint_temp_file  (char*  buffer, char*  buffend, const char*  suffix);
-
-/** FILE LOCKS SUPPORT
- **
- ** a FileLock is useful to prevent several emulator instances from using the same
- ** writable file (e.g. the userdata.img disk images).
- **
- ** create a FileLock object with filelock_create(), the function will return
- ** NULL only if the corresponding path is already locked by another emulator
- ** of if the path is read-only.
- **
- ** note that 'path' can designate a non-existing path and that the lock creation
- ** function can detect stale file locks that can longer when the emulator
- ** crashes unexpectedly, and will happily clean them for you.
- **
- ** you can call filelock_release() to release a file lock explicitely. otherwise
- ** all file locks are automatically released when the program exits.
- **/
-
-typedef struct FileLock  FileLock;
-
-extern FileLock*  filelock_create ( const char*  path );
-extern void       filelock_release( FileLock*  lock );
-
-/** TEMP FILE SUPPORT
- **
- ** simple interface to create an empty temporary file on the system.
- **
- ** create the file with tempfile_create(), which returns a reference to a TempFile
- ** object, or NULL if your system is so weird it doesn't have a temporary directory.
- **
- ** you can then call tempfile_path() to retrieve the TempFile's real path to open
- ** it. the returned path is owned by the TempFile object and should not be freed.
- **
- ** all temporary files are destroyed when the program quits, unless you explicitely
- ** close them before that with tempfile_close()
- **/
-
-typedef struct TempFile   TempFile;
-
-extern  TempFile*    tempfile_create( void );
-extern  const char*  tempfile_path( TempFile*  temp );
-extern  void         tempfile_close( TempFile*  temp );
-
-/** TEMP FILE CLEANUP
- **
- ** We delete all temporary files in atexit()-registered callbacks.
- ** however, the Win32 DeleteFile is unable to remove a file unless
- ** all HANDLEs to it are closed in the terminating process.
- **
- ** Call 'atexit_close_fd' on a newly open-ed file descriptor to indicate
- ** that you want it closed in atexit() time. You should always call
- ** this function unless you're certain that the corresponding file
- ** cannot be temporary.
- **
- ** Call 'atexit_close_fd_remove' before explicitely closing a 'fd'
- **/
-extern void          atexit_close_fd(int  fd);
-extern void          atexit_close_fd_remove(int  fd);
-
-/** OTHER FILE UTILITIES
- **
- **  make_empty_file() creates an empty file at a given path location.
- **  if the file already exists, it is truncated without warning
- **
- **  copy_file() copies one file into another.
- **
- **  unlink_file() is equivalent to unlink() on Unix, on Windows,
- **  it will handle the case where _unlink() fails because the file is
- **  read-only by trying to change its access rights then calling _unlink()
- **  again.
- **
- **  these functions return 0 on success, and -1 on error
- **
- **  load_text_file() reads a file into a heap-allocated memory block,
- **  and appends a 0 to it. the caller must free it
- **/
-
-extern int     make_empty_file( const char*  path );
-extern int     copy_file( const char*  dest, const char*  source );
-extern int     unlink_file( const char*  path );
-extern void*   load_text_file( const char*  path );
-
-/** HOST RESOLUTION SETTINGS
- **
- ** return the main monitor's DPI resolution according to the host device
- ** beware: this is not always reliable or even obtainable.
- **
- ** returns 0 on success, or -1 in case of error (e.g. the system returns funky values)
- **/
-extern  int    get_monitor_resolution( int  *px_dpi, int  *py_dpi );
-
-/** SIGNAL HANDLING
- **
- ** the following can be used to block SIGALRM for a given period of time.
- ** use with caution, the QEMU execution loop uses SIGALRM extensively
- **
- **/
-#ifdef _WIN32
-typedef struct { int  dumy; }      signal_state_t;
-#else
-#include <signal.h>
-typedef struct { sigset_t  old; }  signal_state_t;
-#endif
-
-extern  void   disable_sigalrm( signal_state_t  *state );
-extern  void   restore_sigalrm( signal_state_t  *state );
-
-#ifdef _WIN32
-
-#define   BEGIN_NOSIGALRM  \
-    {
-
-#define   END_NOSIGALRM  \
-    }
-
-#else /* !WIN32 */
-
-#define   BEGIN_NOSIGALRM  \
-    { signal_state_t  __sigalrm_state; \
-      disable_sigalrm( &__sigalrm_state );
-
-#define   END_NOSIGALRM  \
-      restore_sigalrm( &__sigalrm_state );  \
-    }
-
-#endif /* !WIN32 */
-
-/** TIME HANDLING
- **
- ** sleep for a given time in milliseconds. note: this uses
- ** disable_sigalrm()/restore_sigalrm()
- **/
-
-extern  void   sleep_ms( int  timeout );
-
-/** TABULAR OUTPUT
- **
- ** prints a list of strings in row/column format
- **
- **/
-
-extern void   print_tabular( const char** strings, int  count,
-                             const char*  prefix,  int  width );
-
-/** CHARACTER TRANSLATION
- **
- ** converts one character into another in strings
- **/
-
-extern void   buffer_translate_char( char*        buff,
-                                     unsigned     buffLen,
-                                     const char*  src,
-                                     char         fromChar,
-                                     char         toChar );
-
-extern void   string_translate_char( char*  str, char from, char to );
-
-/** DYNAMIC STRINGS
- **/
-
-typedef struct {
-    char*     s;
-    unsigned  n;
-    unsigned  a;
-} stralloc_t;
-
-#define  STRALLOC_INIT        { NULL, 0, 0 }
-#define  STRALLOC_DEFINE(s)   stralloc_t   s[1] = { STRALLOC_INIT }
-
-extern void   stralloc_reset( stralloc_t*  s );
-extern void   stralloc_ready( stralloc_t*  s, unsigned  len );
-extern void   stralloc_readyplus( stralloc_t*  s, unsigned  len );
-
-extern void   stralloc_copy( stralloc_t*  s, stralloc_t*  from );
-extern void   stralloc_append( stralloc_t*  s, stralloc_t*  from );
-
-extern void   stralloc_add_c( stralloc_t*  s, int  c );
-extern void   stralloc_add_str( stralloc_t*  s, const char*  str );
-extern void   stralloc_add_bytes( stralloc_t*  s, const void*  from, unsigned  len );
-
-extern char*  stralloc_cstr( stralloc_t*  s );
-
-extern void   stralloc_format( stralloc_t*  s, const char*  fmt, ... );
-extern void   stralloc_add_format( stralloc_t*  s, const char*  fmt, ... );
-
-extern void   stralloc_add_quote_c( stralloc_t*  s, int  c );
-extern void   stralloc_add_quote_str( stralloc_t*  s, const char*  str );
-extern void   stralloc_add_quote_bytes( stralloc_t*  s, const void*  from, unsigned   len );
-
-extern void   stralloc_add_hex( stralloc_t*  s, unsigned  value, int  num_digits );
-extern void   stralloc_add_hexdump( stralloc_t*  s, void*  base, int  size, const char*  prefix );
-
-extern void   stralloc_tabular( stralloc_t*  s, const char** strings, int  count,
-                                                const char*  prefix,  int  width );
-
-
-/** TEMP CHAR STRINGS
- **
- ** implement a circular ring of temporary string buffers
- **/
-
-extern char*  tempstr_get( int   size );
-extern char*  tempstr_format( const char*  fmt, ... );
-extern char*  tempstr_from_stralloc( stralloc_t*  s );
-
-/** QUOTING
- **
- ** dumps a human-readable version of a string. this replaces
- ** newlines with \n, etc...
- **/
-
-extern const char*   quote_bytes( const char*  str, int  len );
-extern const char*   quote_str( const char*  str );
-
-/** DYNAMIC ARRAYS OF POINTERS
- **/
-
-typedef struct {
-    void**     i;
-    unsigned   n;
-    unsigned   a;
-} qvector_t;
-
-#define  QVECTOR_INIT                   { NULL, 0, 0 }
-#define  QVECTOR_DEFINE(v)  qvector_t   v[1] = QVECTOR_INIT
-
-extern void   qvector_init( qvector_t*  v );
-extern void   qvector_reset( qvector_t*  v );
-extern void   qvector_ready( qvector_t*  v, unsigned  len );
-extern void   qvector_readyplus( qvector_t*  v, unsigned len );
-extern void   qvector_add( qvector_t*  v, void*  item );
-extern int    qvector_del( qvector_t*  v, void*  item );  /* returns 1 if deleted, 0 otherwise */
-extern void*  qvector_get( qvector_t*  v, int  index );
-extern int    qvector_len( qvector_t*  v );
-extern int    qvector_index( qvector_t*  v, void*  item );  /* returns -1 is not found */
-extern void   qvector_insert( qvector_t*  v, int  index, void*  item );
-extern void   qvector_remove( qvector_t*  v, int  index );
-extern void   qvector_remove_n( qvector_t*  v, int  index, int  count );
-
-/** DECIMAL AND HEXADECIMAL CHARACTER SEQUENCES
- **/
-
-/* decodes a sequence of 'len' hexadecimal chars from 'hex' into
- * an integer. returns -1 in case of error (i.e. badly formed chars)
- */
-extern int    hex2int( const uint8_t*  hex, int  len );
-
-/* encodes an integer 'val' into 'len' hexadecimal charaters into 'hex' */
-extern void   int2hex( uint8_t*  hex, int  len, int  val );
-
-#endif /* _ANDROID_UTILS_H */
diff --git a/arm-dis.c b/arm-dis.c
index 1e027ef..ee44292 100644
--- a/arm-dis.c
+++ b/arm-dis.c
@@ -1,550 +1,1496 @@
 /* Instruction printing code for the ARM
-   Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002
-   Free Software Foundation, Inc.
+   Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004
+   2007, Free Software Foundation, Inc.
    Contributed by Richard Earnshaw (rwe@pegasus.esprit.ec.org)
    Modification by James G. Smith (jsmith@cygnus.co.uk)
 
-This file is part of libopcodes. 
+   This file is part of libopcodes.
 
-This program is free software; you can redistribute it and/or modify it under
-the terms of the GNU General Public License as published by the Free
-Software Foundation; either version 2 of the License, or (at your option)
-any later version. 
+   This program is free software; you can redistribute it and/or modify it under
+   the terms of the GNU General Public License as published by the Free
+   Software Foundation; either version 2 of the License, or (at your option)
+   any later version.
 
-This program is distributed in the hope that it will be useful, but WITHOUT
-ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-more details. 
+   This program is distributed in the hope that it will be useful, but WITHOUT
+   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+   more details.
 
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
-Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA.  */
+
+/* Start of qemu specific additions.  Mostly this is stub definitions
+   for things we don't care about.  */
 
 #include "dis-asm.h"
+#define FALSE 0
+#define TRUE (!FALSE)
+#define ATTRIBUTE_UNUSED __attribute__((unused))
+#define ISSPACE(x) ((x) == ' ' || (x) == '\t' || (x) == '\n')
+
+#define ARM_EXT_V1	 0
+#define ARM_EXT_V2	 0
+#define ARM_EXT_V2S	 0
+#define ARM_EXT_V3	 0
+#define ARM_EXT_V3M	 0
+#define ARM_EXT_V4	 0
+#define ARM_EXT_V4T	 0
+#define ARM_EXT_V5	 0
+#define ARM_EXT_V5T	 0
+#define ARM_EXT_V5ExP	 0
+#define ARM_EXT_V5E	 0
+#define ARM_EXT_V5J	 0
+#define ARM_EXT_V6       0
+#define ARM_EXT_V6K      0
+#define ARM_EXT_V6Z      0
+#define ARM_EXT_V6T2	 0
+#define ARM_EXT_V7	 0
+#define ARM_EXT_DIV	 0
+
+/* Co-processor space extensions.  */
+#define ARM_CEXT_XSCALE   0
+#define ARM_CEXT_MAVERICK 0
+#define ARM_CEXT_IWMMXT   0
+
+#define FPU_FPA_EXT_V1	 0
+#define FPU_FPA_EXT_V2	 0
+#define FPU_VFP_EXT_NONE 0
+#define FPU_VFP_EXT_V1xD 0
+#define FPU_VFP_EXT_V1	 0
+#define FPU_VFP_EXT_V2	 0
+#define FPU_MAVERICK	 0
+#define FPU_VFP_EXT_V3	 0
+#define FPU_NEON_EXT_V1	 0
+
+int floatformat_ieee_single_little;
+/* Assume host uses ieee float.  */
+static void floatformat_to_double (int *ignored, unsigned char *data,
+                                   double *dest)
+{
+    union {
+        uint32_t i;
+        float f;
+    } u;
+    u.i = data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24);
+    *dest = u.f;
+}
 
-struct arm_opcode {
-    unsigned long value, mask;	/* recognise instruction if (op&mask)==value */
-    char *assembler;		/* how to disassemble this instruction */
+/* End of qemu specific additions.  */
+
+/* FIXME: Belongs in global header.  */
+#ifndef strneq
+#define strneq(a,b,n)	(strncmp ((a), (b), (n)) == 0)
+#endif
+
+#ifndef NUM_ELEM
+#define NUM_ELEM(a)     (sizeof (a) / sizeof (a)[0])
+#endif
+
+struct opcode32
+{
+  unsigned long arch;		/* Architecture defining this insn.  */
+  unsigned long value, mask;	/* Recognise insn if (op&mask)==value.  */
+  const char *assembler;	/* How to disassemble this insn.  */
 };
 
-struct thumb_opcode
+struct opcode16
 {
-    unsigned short value, mask;	/* recognise instruction if (op&mask)==value */
-    char * assembler;		/* how to disassemble this instruction */
+  unsigned long arch;		/* Architecture defining this insn.  */
+  unsigned short value, mask;	/* Recognise insn if (op&mask)==value.  */
+  const char *assembler;	/* How to disassemble this insn.  */
 };
 
-/* format of the assembler string :
-   
+/* print_insn_coprocessor recognizes the following format control codes:
+
    %%			%
+
+   %c			print condition code (always bits 28-31 in ARM mode)
+   %q			print shifter argument
+   %u			print condition code (unconditional in ARM mode)
+   %A			print address for ldc/stc/ldf/stf instruction
+   %B			print vstm/vldm register list
+   %C			print vstr/vldr address operand
+   %I                   print cirrus signed shift immediate: bits 0..3|4..6
+   %F			print the COUNT field of a LFM/SFM instruction.
+   %P			print floating point precision in arithmetic insn
+   %Q			print floating point precision in ldf/stf insn
+   %R			print floating point rounding mode
+
+   %<bitfield>r		print as an ARM register
    %<bitfield>d		print the bitfield in decimal
+   %<bitfield>k		print immediate for VFPv3 conversion instruction
    %<bitfield>x		print the bitfield in hex
    %<bitfield>X		print the bitfield as 1 hex digit without leading "0x"
-   %<bitfield>r		print as an ARM register
    %<bitfield>f		print a floating point constant if >7 else a
 			floating point register
-   %<code>y		print a single precision VFP reg.
+   %<bitfield>w         print as an iWMMXt width field - [bhwd]ss/us
+   %<bitfield>g         print as an iWMMXt 64-bit register
+   %<bitfield>G         print as an iWMMXt general purpose or control register
+   %<bitfield>D		print as a NEON D register
+   %<bitfield>Q		print as a NEON Q register
+
+   %y<code>		print a single precision VFP reg.
 			  Codes: 0=>Sm, 1=>Sd, 2=>Sn, 3=>multi-list, 4=>Sm pair
-   %<code>z		print a double precision VFP reg
+   %z<code>		print a double precision VFP reg
 			  Codes: 0=>Dm, 1=>Dd, 2=>Dn, 3=>multi-list
-   %c			print condition code (always bits 28-31)
-   %P			print floating point precision in arithmetic insn
-   %Q			print floating point precision in ldf/stf insn
-   %R			print floating point rounding mode
-   %<bitnum>'c		print specified char iff bit is one
-   %<bitnum>`c		print specified char iff bit is zero
-   %<bitnum>?ab		print a if bit is one else print b
-   %p			print 'p' iff bits 12-15 are 15
-   %t			print 't' iff bit 21 set and bit 24 clear
-   %o			print operand2 (immediate or register + shift)
+
+   %<bitfield>'c	print specified char iff bitfield is all ones
+   %<bitfield>`c	print specified char iff bitfield is all zeroes
+   %<bitfield>?ab...    select from array of values in big endian order
+
+   %L			print as an iWMMXt N/M width field.
+   %Z			print the Immediate of a WSHUFH instruction.
+   %l			like 'A' except use byte offsets for 'B' & 'H'
+			versions.
+   %i			print 5-bit immediate in bits 8,3..0
+			(print "32" when 0)
+   %r			print register offset address for wldt/wstr instruction
+*/
+
+/* Common coprocessor opcodes shared between Arm and Thumb-2.  */
+
+static const struct opcode32 coprocessor_opcodes[] =
+{
+  /* XScale instructions.  */
+  {ARM_CEXT_XSCALE, 0x0e200010, 0x0fff0ff0, "mia%c\tacc0, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e280010, 0x0fff0ff0, "miaph%c\tacc0, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e2c0010, 0x0ffc0ff0, "mia%17'T%17`B%16'T%16`B%c\tacc0, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0c400000, 0x0ff00fff, "mar%c\tacc0, %12-15r, %16-19r"},
+  {ARM_CEXT_XSCALE, 0x0c500000, 0x0ff00fff, "mra%c\t%12-15r, %16-19r, acc0"},
+
+  /* Intel Wireless MMX technology instructions.  */
+#define FIRST_IWMMXT_INSN 0x0e130130
+#define IWMMXT_INSN_COUNT 73
+  {ARM_CEXT_IWMMXT, 0x0e130130, 0x0f3f0fff, "tandc%22-23w%c\t%12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e400010, 0x0ff00f3f, "tbcst%6-7w%c\t%16-19g, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e130170, 0x0f3f0ff8, "textrc%22-23w%c\t%12-15r, #%0-2d"},
+  {ARM_CEXT_XSCALE, 0x0e100070, 0x0f300ff0, "textrm%3?su%22-23w%c\t%12-15r, %16-19g, #%0-2d"},
+  {ARM_CEXT_XSCALE, 0x0e600010, 0x0ff00f38, "tinsr%6-7w%c\t%16-19g, %12-15r, #%0-2d"},
+  {ARM_CEXT_XSCALE, 0x0e000110, 0x0ff00fff, "tmcr%c\t%16-19G, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0c400000, 0x0ff00ff0, "tmcrr%c\t%0-3g, %12-15r, %16-19r"},
+  {ARM_CEXT_XSCALE, 0x0e2c0010, 0x0ffc0e10, "tmia%17?tb%16?tb%c\t%5-8g, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e200010, 0x0fff0e10, "tmia%c\t%5-8g, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e280010, 0x0fff0e10, "tmiaph%c\t%5-8g, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e100030, 0x0f300fff, "tmovmsk%22-23w%c\t%12-15r, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e100110, 0x0ff00ff0, "tmrc%c\t%12-15r, %16-19G"},
+  {ARM_CEXT_XSCALE, 0x0c500000, 0x0ff00ff0, "tmrrc%c\t%12-15r, %16-19r, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e130150, 0x0f3f0fff, "torc%22-23w%c\t%12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e130190, 0x0f3f0fff, "torvsc%22-23w%c\t%12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e2001c0, 0x0f300fff, "wabs%22-23w%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e0001c0, 0x0f300fff, "wacc%22-23w%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e000180, 0x0f000ff0, "wadd%20-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e2001a0, 0x0f300ff0, "waddbhus%22?ml%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ea001a0, 0x0ff00ff0, "waddsubhx%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000020, 0x0f800ff0, "waligni%c\t%12-15g, %16-19g, %0-3g, #%20-22d"},
+  {ARM_CEXT_XSCALE, 0x0e800020, 0x0fc00ff0, "walignr%20-21d%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e200000, 0x0fe00ff0, "wand%20'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e800000, 0x0fa00ff0, "wavg2%22?hb%20'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e400000, 0x0fe00ff0, "wavg4%20'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000060, 0x0f300ff0, "wcmpeq%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100060, 0x0f100ff0, "wcmpgt%21?su%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0xfc500100, 0xfe500f00, "wldrd\t%12-15g, %r"},
+  {ARM_CEXT_XSCALE, 0xfc100100, 0xfe500f00, "wldrw\t%12-15G, %A"},
+  {ARM_CEXT_XSCALE, 0x0c100000, 0x0e100e00, "wldr%L%c\t%12-15g, %l"},
+  {ARM_CEXT_XSCALE, 0x0e400100, 0x0fc00ff0, "wmac%21?su%20'z%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e800100, 0x0fc00ff0, "wmadd%21?su%20'x%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ec00100, 0x0fd00ff0, "wmadd%21?sun%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000160, 0x0f100ff0, "wmax%21?su%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000080, 0x0f100fe0, "wmerge%c\t%12-15g, %16-19g, %0-3g, #%21-23d"},
+  {ARM_CEXT_XSCALE, 0x0e0000a0, 0x0f800ff0, "wmia%21?tb%20?tb%22'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e800120, 0x0f800ff0, "wmiaw%21?tb%20?tb%22'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100160, 0x0f100ff0, "wmin%21?su%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000100, 0x0fc00ff0, "wmul%21?su%20?ml%23'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ed00100, 0x0fd00ff0, "wmul%21?sumr%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ee000c0, 0x0fe00ff0, "wmulwsm%20`r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ec000c0, 0x0fe00ff0, "wmulwum%20`r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0eb000c0, 0x0ff00ff0, "wmulwl%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e8000a0, 0x0f800ff0, "wqmia%21?tb%20?tb%22'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100080, 0x0fd00ff0, "wqmulm%21'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ec000e0, 0x0fd00ff0, "wqmulwm%21'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000000, 0x0ff00ff0, "wor%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000080, 0x0f000ff0, "wpack%20-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0xfe300040, 0xff300ef0, "wror%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e300040, 0x0f300ff0, "wror%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e300140, 0x0f300ff0, "wror%22-23wg%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0x0e000120, 0x0fa00ff0, "wsad%22?hb%20'z%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e0001e0, 0x0f000ff0, "wshufh%c\t%12-15g, %16-19g, #%Z"},
+  {ARM_CEXT_XSCALE, 0xfe100040, 0xff300ef0, "wsll%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e100040, 0x0f300ff0, "wsll%22-23w%8'g%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100148, 0x0f300ffc, "wsll%22-23w%8'g%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0xfe000040, 0xff300ef0, "wsra%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e000040, 0x0f300ff0, "wsra%22-23w%8'g%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000148, 0x0f300ffc, "wsra%22-23w%8'g%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0xfe200040, 0xff300ef0, "wsrl%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e200040, 0x0f300ff0, "wsrl%22-23w%8'g%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e200148, 0x0f300ffc, "wsrl%22-23w%8'g%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0xfc400100, 0xfe500f00, "wstrd\t%12-15g, %r"},
+  {ARM_CEXT_XSCALE, 0xfc000100, 0xfe500f00, "wstrw\t%12-15G, %A"},
+  {ARM_CEXT_XSCALE, 0x0c000000, 0x0e100e00, "wstr%L%c\t%12-15g, %l"},
+  {ARM_CEXT_XSCALE, 0x0e0001a0, 0x0f000ff0, "wsub%20-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ed001c0, 0x0ff00ff0, "wsubaddhx%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e1001c0, 0x0f300ff0, "wabsdiff%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e0000c0, 0x0fd00fff, "wunpckeh%21?sub%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e4000c0, 0x0fd00fff, "wunpckeh%21?suh%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e8000c0, 0x0fd00fff, "wunpckeh%21?suw%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e0000e0, 0x0f100fff, "wunpckel%21?su%22-23w%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e1000c0, 0x0f300ff0, "wunpckih%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e1000e0, 0x0f300ff0, "wunpckil%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100000, 0x0ff00ff0, "wxor%c\t%12-15g, %16-19g, %0-3g"},
+
+  /* Floating point coprocessor (FPA) instructions */
+  {FPU_FPA_EXT_V1, 0x0e000100, 0x0ff08f10, "adf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e100100, 0x0ff08f10, "muf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e200100, 0x0ff08f10, "suf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e300100, 0x0ff08f10, "rsf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e400100, 0x0ff08f10, "dvf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e500100, 0x0ff08f10, "rdf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e600100, 0x0ff08f10, "pow%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e700100, 0x0ff08f10, "rpw%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e800100, 0x0ff08f10, "rmf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e900100, 0x0ff08f10, "fml%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ea00100, 0x0ff08f10, "fdv%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0eb00100, 0x0ff08f10, "frd%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ec00100, 0x0ff08f10, "pol%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e008100, 0x0ff08f10, "mvf%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e108100, 0x0ff08f10, "mnf%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e208100, 0x0ff08f10, "abs%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e308100, 0x0ff08f10, "rnd%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e408100, 0x0ff08f10, "sqt%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e508100, 0x0ff08f10, "log%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e608100, 0x0ff08f10, "lgn%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e708100, 0x0ff08f10, "exp%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e808100, 0x0ff08f10, "sin%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e908100, 0x0ff08f10, "cos%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ea08100, 0x0ff08f10, "tan%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0eb08100, 0x0ff08f10, "asn%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ec08100, 0x0ff08f10, "acs%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ed08100, 0x0ff08f10, "atn%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ee08100, 0x0ff08f10, "urd%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ef08100, 0x0ff08f10, "nrm%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e000110, 0x0ff00f1f, "flt%c%P%R\t%16-18f, %12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e100110, 0x0fff0f98, "fix%c%R\t%12-15r, %0-2f"},
+  {FPU_FPA_EXT_V1, 0x0e200110, 0x0fff0fff, "wfs%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e300110, 0x0fff0fff, "rfs%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e400110, 0x0fff0fff, "wfc%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e500110, 0x0fff0fff, "rfc%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e90f110, 0x0ff8fff0, "cmf%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0eb0f110, 0x0ff8fff0, "cnf%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ed0f110, 0x0ff8fff0, "cmfe%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ef0f110, 0x0ff8fff0, "cnfe%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0c000100, 0x0e100f00, "stf%c%Q\t%12-14f, %A"},
+  {FPU_FPA_EXT_V1, 0x0c100100, 0x0e100f00, "ldf%c%Q\t%12-14f, %A"},
+  {FPU_FPA_EXT_V2, 0x0c000200, 0x0e100f00, "sfm%c\t%12-14f, %F, %A"},
+  {FPU_FPA_EXT_V2, 0x0c100200, 0x0e100f00, "lfm%c\t%12-14f, %F, %A"},
+
+  /* Register load/store */
+  {FPU_NEON_EXT_V1, 0x0d200b00, 0x0fb00f01, "vstmdb%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0d300b00, 0x0fb00f01, "vldmdb%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0c800b00, 0x0f900f01, "vstmia%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0c900b00, 0x0f900f01, "vldmia%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0d000b00, 0x0f300f00, "vstr%c\t%12-15,22D, %C"},
+  {FPU_NEON_EXT_V1, 0x0d100b00, 0x0f300f00, "vldr%c\t%12-15,22D, %C"},
+
+  /* Data transfer between ARM and NEON registers */
+  {FPU_NEON_EXT_V1, 0x0e800b10, 0x0ff00f70, "vdup%c.32\t%16-19,7D, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e800b30, 0x0ff00f70, "vdup%c.16\t%16-19,7D, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ea00b10, 0x0ff00f70, "vdup%c.32\t%16-19,7Q, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ea00b30, 0x0ff00f70, "vdup%c.16\t%16-19,7Q, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ec00b10, 0x0ff00f70, "vdup%c.8\t%16-19,7D, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ee00b10, 0x0ff00f70, "vdup%c.8\t%16-19,7Q, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0c400b10, 0x0ff00fd0, "vmov%c\t%0-3,5D, %12-15r, %16-19r"},
+  {FPU_NEON_EXT_V1, 0x0c500b10, 0x0ff00fd0, "vmov%c\t%12-15r, %16-19r, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0x0e000b10, 0x0fd00f70, "vmov%c.32\t%16-19,7D[%21d], %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e100b10, 0x0f500f70, "vmov%c.32\t%12-15r, %16-19,7D[%21d]"},
+  {FPU_NEON_EXT_V1, 0x0e000b30, 0x0fd00f30, "vmov%c.16\t%16-19,7D[%6,21d], %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e100b30, 0x0f500f30, "vmov%c.%23?us16\t%12-15r, %16-19,7D[%6,21d]"},
+  {FPU_NEON_EXT_V1, 0x0e400b10, 0x0fd00f10, "vmov%c.8\t%16-19,7D[%5,6,21d], %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e500b10, 0x0f500f10, "vmov%c.%23?us8\t%12-15r, %16-19,7D[%5,6,21d]"},
+
+  /* Floating point coprocessor (VFP) instructions */
+  {FPU_VFP_EXT_V1xD, 0x0ef1fa10, 0x0fffffff, "fmstat%c"},
+  {FPU_VFP_EXT_V1xD, 0x0ee00a10, 0x0fff0fff, "fmxr%c\tfpsid, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee10a10, 0x0fff0fff, "fmxr%c\tfpscr, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee60a10, 0x0fff0fff, "fmxr%c\tmvfr1, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee70a10, 0x0fff0fff, "fmxr%c\tmvfr0, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee80a10, 0x0fff0fff, "fmxr%c\tfpexc, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee90a10, 0x0fff0fff, "fmxr%c\tfpinst, %12-15r\t@ Impl def"},
+  {FPU_VFP_EXT_V1xD, 0x0eea0a10, 0x0fff0fff, "fmxr%c\tfpinst2, %12-15r\t@ Impl def"},
+  {FPU_VFP_EXT_V1xD, 0x0ef00a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpsid"},
+  {FPU_VFP_EXT_V1xD, 0x0ef10a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpscr"},
+  {FPU_VFP_EXT_V1xD, 0x0ef60a10, 0x0fff0fff, "fmrx%c\t%12-15r, mvfr1"},
+  {FPU_VFP_EXT_V1xD, 0x0ef70a10, 0x0fff0fff, "fmrx%c\t%12-15r, mvfr0"},
+  {FPU_VFP_EXT_V1xD, 0x0ef80a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpexc"},
+  {FPU_VFP_EXT_V1xD, 0x0ef90a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst\t@ Impl def"},
+  {FPU_VFP_EXT_V1xD, 0x0efa0a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst2\t@ Impl def"},
+  {FPU_VFP_EXT_V1, 0x0e000b10, 0x0ff00fff, "fmdlr%c\t%z2, %12-15r"},
+  {FPU_VFP_EXT_V1, 0x0e100b10, 0x0ff00fff, "fmrdl%c\t%12-15r, %z2"},
+  {FPU_VFP_EXT_V1, 0x0e200b10, 0x0ff00fff, "fmdhr%c\t%z2, %12-15r"},
+  {FPU_VFP_EXT_V1, 0x0e300b10, 0x0ff00fff, "fmrdh%c\t%12-15r, %z2"},
+  {FPU_VFP_EXT_V1xD, 0x0ee00a10, 0x0ff00fff, "fmxr%c\t<impl def %16-19x>, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ef00a10, 0x0ff00fff, "fmrx%c\t%12-15r, <impl def %16-19x>"},
+  {FPU_VFP_EXT_V1xD, 0x0e000a10, 0x0ff00f7f, "fmsr%c\t%y2, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0e100a10, 0x0ff00f7f, "fmrs%c\t%12-15r, %y2"},
+  {FPU_VFP_EXT_V1xD, 0x0eb50a40, 0x0fbf0f70, "fcmp%7'ezs%c\t%y1"},
+  {FPU_VFP_EXT_V1, 0x0eb50b40, 0x0fbf0f70, "fcmp%7'ezd%c\t%z1"},
+  {FPU_VFP_EXT_V1xD, 0x0eb00a40, 0x0fbf0fd0, "fcpys%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb00ac0, 0x0fbf0fd0, "fabss%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb00b40, 0x0fbf0fd0, "fcpyd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1, 0x0eb00bc0, 0x0fbf0fd0, "fabsd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb10a40, 0x0fbf0fd0, "fnegs%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb10ac0, 0x0fbf0fd0, "fsqrts%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb10b40, 0x0fbf0fd0, "fnegd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1, 0x0eb10bc0, 0x0fbf0fd0, "fsqrtd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1, 0x0eb70ac0, 0x0fbf0fd0, "fcvtds%c\t%z1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb70bc0, 0x0fbf0fd0, "fcvtsd%c\t%y1, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb80a40, 0x0fbf0fd0, "fuitos%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb80ac0, 0x0fbf0fd0, "fsitos%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb80b40, 0x0fbf0fd0, "fuitod%c\t%z1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb80bc0, 0x0fbf0fd0, "fsitod%c\t%z1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb40a40, 0x0fbf0f50, "fcmp%7'es%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb40b40, 0x0fbf0f50, "fcmp%7'ed%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V3, 0x0eba0a40, 0x0fbe0f50, "f%16?us%7?lhtos%c\t%y1, #%5,0-3k"},
+  {FPU_VFP_EXT_V3, 0x0eba0b40, 0x0fbe0f50, "f%16?us%7?lhtod%c\t%z1, #%5,0-3k"},
+  {FPU_VFP_EXT_V1xD, 0x0ebc0a40, 0x0fbe0f50, "fto%16?sui%7'zs%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0ebc0b40, 0x0fbe0f50, "fto%16?sui%7'zd%c\t%y1, %z0"},
+  {FPU_VFP_EXT_V3, 0x0ebe0a40, 0x0fbe0f50, "fto%16?us%7?lhs%c\t%y1, #%5,0-3k"},
+  {FPU_VFP_EXT_V3, 0x0ebe0b40, 0x0fbe0f50, "fto%16?us%7?lhd%c\t%z1, #%5,0-3k"},
+  {FPU_VFP_EXT_V1, 0x0c500b10, 0x0fb00ff0, "fmrrd%c\t%12-15r, %16-19r, %z0"},
+  {FPU_VFP_EXT_V3, 0x0eb00a00, 0x0fb00ff0, "fconsts%c\t%y1, #%0-3,16-19d"},
+  {FPU_VFP_EXT_V3, 0x0eb00b00, 0x0fb00ff0, "fconstd%c\t%z1, #%0-3,16-19d"},
+  {FPU_VFP_EXT_V2, 0x0c400a10, 0x0ff00fd0, "fmsrr%c\t%y4, %12-15r, %16-19r"},
+  {FPU_VFP_EXT_V2, 0x0c400b10, 0x0ff00fd0, "fmdrr%c\t%z0, %12-15r, %16-19r"},
+  {FPU_VFP_EXT_V2, 0x0c500a10, 0x0ff00fd0, "fmrrs%c\t%12-15r, %16-19r, %y4"},
+  {FPU_VFP_EXT_V1xD, 0x0e000a00, 0x0fb00f50, "fmacs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e000a40, 0x0fb00f50, "fnmacs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e000b00, 0x0fb00f50, "fmacd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e000b40, 0x0fb00f50, "fnmacd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e100a00, 0x0fb00f50, "fmscs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e100a40, 0x0fb00f50, "fnmscs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e100b00, 0x0fb00f50, "fmscd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e100b40, 0x0fb00f50, "fnmscd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e200a00, 0x0fb00f50, "fmuls%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e200a40, 0x0fb00f50, "fnmuls%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e200b00, 0x0fb00f50, "fmuld%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e200b40, 0x0fb00f50, "fnmuld%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e300a00, 0x0fb00f50, "fadds%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e300a40, 0x0fb00f50, "fsubs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e300b00, 0x0fb00f50, "faddd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e300b40, 0x0fb00f50, "fsubd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e800a00, 0x0fb00f50, "fdivs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e800b00, 0x0fb00f50, "fdivd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0d200a00, 0x0fb00f00, "fstmdbs%c\t%16-19r!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0d200b00, 0x0fb00f00, "fstmdb%0?xd%c\t%16-19r!, %z3"},
+  {FPU_VFP_EXT_V1xD, 0x0d300a00, 0x0fb00f00, "fldmdbs%c\t%16-19r!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0d300b00, 0x0fb00f00, "fldmdb%0?xd%c\t%16-19r!, %z3"},
+  {FPU_VFP_EXT_V1xD, 0x0d000a00, 0x0f300f00, "fsts%c\t%y1, %A"},
+  {FPU_VFP_EXT_V1, 0x0d000b00, 0x0f300f00, "fstd%c\t%z1, %A"},
+  {FPU_VFP_EXT_V1xD, 0x0d100a00, 0x0f300f00, "flds%c\t%y1, %A"},
+  {FPU_VFP_EXT_V1, 0x0d100b00, 0x0f300f00, "fldd%c\t%z1, %A"},
+  {FPU_VFP_EXT_V1xD, 0x0c800a00, 0x0f900f00, "fstmias%c\t%16-19r%21'!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0c800b00, 0x0f900f00, "fstmia%0?xd%c\t%16-19r%21'!, %z3"},
+  {FPU_VFP_EXT_V1xD, 0x0c900a00, 0x0f900f00, "fldmias%c\t%16-19r%21'!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0c900b00, 0x0f900f00, "fldmia%0?xd%c\t%16-19r%21'!, %z3"},
+
+  /* Cirrus coprocessor instructions.  */
+  {ARM_CEXT_MAVERICK, 0x0d100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0e000450, 0x0ff00ff0, "cfmvsr%c\tmvf%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100450, 0x0ff00ff0, "cfmvrs%c\t%12-15r, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000410, 0x0ff00ff0, "cfmvdlr%c\tmvd%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100410, 0x0ff00ff0, "cfmvrdl%c\t%12-15r, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000430, 0x0ff00ff0, "cfmvdhr%c\tmvd%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100430, 0x0ff00fff, "cfmvrdh%c\t%12-15r, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000510, 0x0ff00fff, "cfmv64lr%c\tmvdx%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100510, 0x0ff00fff, "cfmvr64l%c\t%12-15r, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000530, 0x0ff00fff, "cfmv64hr%c\tmvdx%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100530, 0x0ff00fff, "cfmvr64h%c\t%12-15r, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e200440, 0x0ff00fff, "cfmval32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100440, 0x0ff00fff, "cfmv32al%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e200460, 0x0ff00fff, "cfmvam32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100460, 0x0ff00fff, "cfmv32am%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e200480, 0x0ff00fff, "cfmvah32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100480, 0x0ff00fff, "cfmv32ah%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e2004a0, 0x0ff00fff, "cfmva32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004a0, 0x0ff00fff, "cfmv32a%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e2004c0, 0x0ff00fff, "cfmva64%c\tmvax%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004c0, 0x0ff00fff, "cfmv64a%c\tmvdx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e2004e0, 0x0fff0fff, "cfmvsc32%c\tdspsc, mvdx%12-15d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004e0, 0x0fff0fff, "cfmv32sc%c\tmvdx%12-15d, dspsc"},
+  {ARM_CEXT_MAVERICK, 0x0e000400, 0x0ff00fff, "cfcpys%c\tmvf%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000420, 0x0ff00fff, "cfcpyd%c\tmvd%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000460, 0x0ff00fff, "cfcvtsd%c\tmvd%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000440, 0x0ff00fff, "cfcvtds%c\tmvf%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000480, 0x0ff00fff, "cfcvt32s%c\tmvf%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e0004a0, 0x0ff00fff, "cfcvt32d%c\tmvd%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e0004c0, 0x0ff00fff, "cfcvt64s%c\tmvf%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e0004e0, 0x0ff00fff, "cfcvt64d%c\tmvd%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100580, 0x0ff00fff, "cfcvts32%c\tmvfx%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005a0, 0x0ff00fff, "cfcvtd32%c\tmvfx%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005c0, 0x0ff00fff, "cftruncs32%c\tmvfx%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005e0, 0x0ff00fff, "cftruncd32%c\tmvfx%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000550, 0x0ff00ff0, "cfrshl32%c\tmvfx%16-19d, mvfx%0-3d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e000570, 0x0ff00ff0, "cfrshl64%c\tmvdx%16-19d, mvdx%0-3d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e000500, 0x0ff00f10, "cfsh32%c\tmvfx%12-15d, mvfx%16-19d, #%I"},
+  {ARM_CEXT_MAVERICK, 0x0e200500, 0x0ff00f10, "cfsh64%c\tmvdx%12-15d, mvdx%16-19d, #%I"},
+  {ARM_CEXT_MAVERICK, 0x0e100490, 0x0ff00ff0, "cfcmps%c\t%12-15r, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004b0, 0x0ff00ff0, "cfcmpd%c\t%12-15r, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100590, 0x0ff00ff0, "cfcmp32%c\t%12-15r, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005b0, 0x0ff00ff0, "cfcmp64%c\t%12-15r, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e300400, 0x0ff00fff, "cfabss%c\tmvf%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300420, 0x0ff00fff, "cfabsd%c\tmvd%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300440, 0x0ff00fff, "cfnegs%c\tmvf%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300460, 0x0ff00fff, "cfnegd%c\tmvd%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300480, 0x0ff00ff0, "cfadds%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3004a0, 0x0ff00ff0, "cfaddd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3004c0, 0x0ff00ff0, "cfsubs%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3004e0, 0x0ff00ff0, "cfsubd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100400, 0x0ff00ff0, "cfmuls%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100420, 0x0ff00ff0, "cfmuld%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e300500, 0x0ff00fff, "cfabs32%c\tmvfx%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300520, 0x0ff00fff, "cfabs64%c\tmvdx%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300540, 0x0ff00fff, "cfneg32%c\tmvfx%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300560, 0x0ff00fff, "cfneg64%c\tmvdx%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300580, 0x0ff00ff0, "cfadd32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3005a0, 0x0ff00ff0, "cfadd64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3005c0, 0x0ff00ff0, "cfsub32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3005e0, 0x0ff00ff0, "cfsub64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100500, 0x0ff00ff0, "cfmul32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100520, 0x0ff00ff0, "cfmul64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100540, 0x0ff00ff0, "cfmac32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100560, 0x0ff00ff0, "cfmsc32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e000600, 0x0ff00f10, "cfmadd32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100600, 0x0ff00f10, "cfmsub32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e200600, 0x0ff00f10, "cfmadda32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e300600, 0x0ff00f10, "cfmsuba32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
+
+  /* Generic coprocessor instructions */
+  {ARM_EXT_V2, 0x0c400000, 0x0ff00000, "mcrr%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+  {ARM_EXT_V2, 0x0c500000, 0x0ff00000, "mrrc%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+  {ARM_EXT_V2, 0x0e000000, 0x0f000010, "cdp%c\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V2, 0x0e100010, 0x0f100010, "mrc%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V2, 0x0e000010, 0x0f100010, "mcr%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V2, 0x0c000000, 0x0e100000, "stc%22'l%c\t%8-11d, cr%12-15d, %A"},
+  {ARM_EXT_V2, 0x0c100000, 0x0e100000, "ldc%22'l%c\t%8-11d, cr%12-15d, %A"},
+
+  /* V6 coprocessor instructions */
+  {ARM_EXT_V6, 0xfc500000, 0xfff00000, "mrrc2%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+  {ARM_EXT_V6, 0xfc400000, 0xfff00000, "mcrr2%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+
+  /* V5 coprocessor instructions */
+  {ARM_EXT_V5, 0xfc100000, 0xfe100000, "ldc2%22'l%c\t%8-11d, cr%12-15d, %A"},
+  {ARM_EXT_V5, 0xfc000000, 0xfe100000, "stc2%22'l%c\t%8-11d, cr%12-15d, %A"},
+  {ARM_EXT_V5, 0xfe000000, 0xff000010, "cdp2%c\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V5, 0xfe000010, 0xff100010, "mcr2%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V5, 0xfe100010, 0xff100010, "mrc2%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+
+  {0, 0, 0, 0}
+};
+
+/* Neon opcode table:  This does not encode the top byte -- that is
+   checked by the print_insn_neon routine, as it depends on whether we are
+   doing thumb32 or arm32 disassembly.  */
+
+/* print_insn_neon recognizes the following format control codes:
+
+   %%			%
+
+   %c			print condition code
+   %A			print v{st,ld}[1234] operands
+   %B			print v{st,ld}[1234] any one operands
+   %C			print v{st,ld}[1234] single->all operands
+   %D			print scalar
+   %E			print vmov, vmvn, vorr, vbic encoded constant
+   %F			print vtbl,vtbx register list
+
+   %<bitfield>r		print as an ARM register
+   %<bitfield>d		print the bitfield in decimal
+   %<bitfield>e         print the 2^N - bitfield in decimal
+   %<bitfield>D		print as a NEON D register
+   %<bitfield>Q		print as a NEON Q register
+   %<bitfield>R		print as a NEON D or Q register
+   %<bitfield>Sn	print byte scaled width limited by n
+   %<bitfield>Tn	print short scaled width limited by n
+   %<bitfield>Un	print long scaled width limited by n
+
+   %<bitfield>'c	print specified char iff bitfield is all ones
+   %<bitfield>`c	print specified char iff bitfield is all zeroes
+   %<bitfield>?ab...    select from array of values in big endian order  */
+
+static const struct opcode32 neon_opcodes[] =
+{
+  /* Extract */
+  {FPU_NEON_EXT_V1, 0xf2b00840, 0xffb00850, "vext%c.8\t%12-15,22R, %16-19,7R, %0-3,5R, #%8-11d"},
+  {FPU_NEON_EXT_V1, 0xf2b00000, 0xffb00810, "vext%c.8\t%12-15,22R, %16-19,7R, %0-3,5R, #%8-11d"},
+
+  /* Move data element to all lanes */
+  {FPU_NEON_EXT_V1, 0xf3b40c00, 0xffb70f90, "vdup%c.32\t%12-15,22R, %0-3,5D[%19d]"},
+  {FPU_NEON_EXT_V1, 0xf3b20c00, 0xffb30f90, "vdup%c.16\t%12-15,22R, %0-3,5D[%18-19d]"},
+  {FPU_NEON_EXT_V1, 0xf3b10c00, 0xffb10f90, "vdup%c.8\t%12-15,22R, %0-3,5D[%17-19d]"},
+
+  /* Table lookup */
+  {FPU_NEON_EXT_V1, 0xf3b00800, 0xffb00c50, "vtbl%c.8\t%12-15,22D, %F, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf3b00840, 0xffb00c50, "vtbx%c.8\t%12-15,22D, %F, %0-3,5D"},
+
+  /* Two registers, miscellaneous */
+  {FPU_NEON_EXT_V1, 0xf2880a10, 0xfebf0fd0, "vmovl%c.%24?us8\t%12-15,22Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2900a10, 0xfebf0fd0, "vmovl%c.%24?us16\t%12-15,22Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2a00a10, 0xfebf0fd0, "vmovl%c.%24?us32\t%12-15,22Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf3b00500, 0xffbf0f90, "vcnt%c.8\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00580, 0xffbf0f90, "vmvn%c\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20000, 0xffbf0f90, "vswp%c\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20200, 0xffb30fd0, "vmovn%c.i%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b20240, 0xffb30fd0, "vqmovun%c.s%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b20280, 0xffb30fd0, "vqmovn%c.s%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b202c0, 0xffb30fd0, "vqmovn%c.u%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b20300, 0xffb30fd0, "vshll%c.i%18-19S2\t%12-15,22Q, %0-3,5D, #%18-19S2"},
+  {FPU_NEON_EXT_V1, 0xf3bb0400, 0xffbf0e90, "vrecpe%c.%8?fu%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3bb0480, 0xffbf0e90, "vrsqrte%c.%8?fu%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00000, 0xffb30f90, "vrev64%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00080, 0xffb30f90, "vrev32%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00100, 0xffb30f90, "vrev16%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00400, 0xffb30f90, "vcls%c.s%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00480, 0xffb30f90, "vclz%c.i%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00700, 0xffb30f90, "vqabs%c.s%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00780, 0xffb30f90, "vqneg%c.s%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20080, 0xffb30f90, "vtrn%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20100, 0xffb30f90, "vuzp%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20180, 0xffb30f90, "vzip%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b10000, 0xffb30b90, "vcgt%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10080, 0xffb30b90, "vcge%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10100, 0xffb30b90, "vceq%c.%10?fi%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10180, 0xffb30b90, "vcle%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10200, 0xffb30b90, "vclt%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10300, 0xffb30b90, "vabs%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b10380, 0xffb30b90, "vneg%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00200, 0xffb30f10, "vpaddl%c.%7?us%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00600, 0xffb30f10, "vpadal%c.%7?us%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b30600, 0xffb30e10, "vcvt%c.%7-8?usff%18-19Sa.%7-8?ffus%18-19Sa\t%12-15,22R, %0-3,5R"},
+
+  /* Three registers of the same length */
+  {FPU_NEON_EXT_V1, 0xf2000110, 0xffb00f10, "vand%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2100110, 0xffb00f10, "vbic%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200110, 0xffb00f10, "vorr%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2300110, 0xffb00f10, "vorn%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000110, 0xffb00f10, "veor%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3100110, 0xffb00f10, "vbsl%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200110, 0xffb00f10, "vbit%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3300110, 0xffb00f10, "vbif%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000d00, 0xffa00f10, "vadd%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000d10, 0xffa00f10, "vmla%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000e00, 0xffa00f10, "vceq%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000f00, 0xffa00f10, "vmax%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000f10, 0xffa00f10, "vrecps%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200d00, 0xffa00f10, "vsub%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200d10, 0xffa00f10, "vmls%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200f00, 0xffa00f10, "vmin%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200f10, 0xffa00f10, "vrsqrts%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000d00, 0xffa00f10, "vpadd%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000d10, 0xffa00f10, "vmul%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000e00, 0xffa00f10, "vcge%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000e10, 0xffa00f10, "vacge%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000f00, 0xffa00f10, "vpmax%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200d00, 0xffa00f10, "vabd%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200e00, 0xffa00f10, "vcgt%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200e10, 0xffa00f10, "vacgt%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200f00, 0xffa00f10, "vpmin%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000800, 0xff800f10, "vadd%c.i%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000810, 0xff800f10, "vtst%c.%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000900, 0xff800f10, "vmla%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000b00, 0xff800f10, "vqdmulh%c.s%20-21S6\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000b10, 0xff800f10, "vpadd%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000800, 0xff800f10, "vsub%c.i%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000810, 0xff800f10, "vceq%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000900, 0xff800f10, "vmls%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000b00, 0xff800f10, "vqrdmulh%c.s%20-21S6\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000000, 0xfe800f10, "vhadd%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000010, 0xfe800f10, "vqadd%c.%24?us%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000100, 0xfe800f10, "vrhadd%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000200, 0xfe800f10, "vhsub%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000210, 0xfe800f10, "vqsub%c.%24?us%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000300, 0xfe800f10, "vcgt%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000310, 0xfe800f10, "vcge%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000400, 0xfe800f10, "vshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000410, 0xfe800f10, "vqshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000500, 0xfe800f10, "vrshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000510, 0xfe800f10, "vqrshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000600, 0xfe800f10, "vmax%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000610, 0xfe800f10, "vmin%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000700, 0xfe800f10, "vabd%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000710, 0xfe800f10, "vaba%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000910, 0xfe800f10, "vmul%c.%24?pi%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000a00, 0xfe800f10, "vpmax%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000a10, 0xfe800f10, "vpmin%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+
+  /* One register and an immediate value */
+  {FPU_NEON_EXT_V1, 0xf2800e10, 0xfeb80fb0, "vmov%c.i8\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800e30, 0xfeb80fb0, "vmov%c.i64\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800f10, 0xfeb80fb0, "vmov%c.f32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800810, 0xfeb80db0, "vmov%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800830, 0xfeb80db0, "vmvn%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800910, 0xfeb80db0, "vorr%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800930, 0xfeb80db0, "vbic%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800c10, 0xfeb80eb0, "vmov%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800c30, 0xfeb80eb0, "vmvn%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800110, 0xfeb809b0, "vorr%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800130, 0xfeb809b0, "vbic%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800010, 0xfeb808b0, "vmov%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800030, 0xfeb808b0, "vmvn%c.i32\t%12-15,22R, %E"},
+
+  /* Two registers and a shift amount */
+  {FPU_NEON_EXT_V1, 0xf2880810, 0xffb80fd0, "vshrn%c.i16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880850, 0xffb80fd0, "vrshrn%c.i16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880810, 0xfeb80fd0, "vqshrun%c.s16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880850, 0xfeb80fd0, "vqrshrun%c.s16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880910, 0xfeb80fd0, "vqshrn%c.%24?us16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880950, 0xfeb80fd0, "vqrshrn%c.%24?us16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880a10, 0xfeb80fd0, "vshll%c.%24?us8\t%12-15,22D, %0-3,5Q, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf2900810, 0xffb00fd0, "vshrn%c.i32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900850, 0xffb00fd0, "vrshrn%c.i32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2880510, 0xffb80f90, "vshl%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf3880410, 0xffb80f90, "vsri%c.8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf3880510, 0xffb80f90, "vsli%c.8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf3880610, 0xffb80f90, "vqshlu%c.s8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf2900810, 0xfeb00fd0, "vqshrun%c.s32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900850, 0xfeb00fd0, "vqrshrun%c.s32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900910, 0xfeb00fd0, "vqshrn%c.%24?us32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900950, 0xfeb00fd0, "vqrshrn%c.%24?us32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900a10, 0xfeb00fd0, "vshll%c.%24?us16\t%12-15,22D, %0-3,5Q, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf2880010, 0xfeb80f90, "vshr%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880110, 0xfeb80f90, "vsra%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880210, 0xfeb80f90, "vrshr%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880310, 0xfeb80f90, "vrsra%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880710, 0xfeb80f90, "vqshl%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf2a00810, 0xffa00fd0, "vshrn%c.i64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00850, 0xffa00fd0, "vrshrn%c.i64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2900510, 0xffb00f90, "vshl%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf3900410, 0xffb00f90, "vsri%c.16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf3900510, 0xffb00f90, "vsli%c.16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf3900610, 0xffb00f90, "vqshlu%c.s16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf2a00a10, 0xfea00fd0, "vshll%c.%24?us32\t%12-15,22D, %0-3,5Q, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf2900010, 0xfeb00f90, "vshr%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900110, 0xfeb00f90, "vsra%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900210, 0xfeb00f90, "vrshr%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900310, 0xfeb00f90, "vrsra%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900710, 0xfeb00f90, "vqshl%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf2800810, 0xfec00fd0, "vqshrun%c.s64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2800850, 0xfec00fd0, "vqrshrun%c.s64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2800910, 0xfec00fd0, "vqshrn%c.%24?us64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2800950, 0xfec00fd0, "vqrshrn%c.%24?us64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00510, 0xffa00f90, "vshl%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf3a00410, 0xffa00f90, "vsri%c.32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf3a00510, 0xffa00f90, "vsli%c.32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf3a00610, 0xffa00f90, "vqshlu%c.s32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf2a00010, 0xfea00f90, "vshr%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00110, 0xfea00f90, "vsra%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00210, 0xfea00f90, "vrshr%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00310, 0xfea00f90, "vrsra%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00710, 0xfea00f90, "vqshl%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf2800590, 0xff800f90, "vshl%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf3800490, 0xff800f90, "vsri%c.64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf3800590, 0xff800f90, "vsli%c.64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf3800690, 0xff800f90, "vqshlu%c.s64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf2800090, 0xfe800f90, "vshr%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800190, 0xfe800f90, "vsra%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800290, 0xfe800f90, "vrshr%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800390, 0xfe800f90, "vrsra%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800790, 0xfe800f90, "vqshl%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf2a00e10, 0xfea00e90, "vcvt%c.%24,8?usff32.%24,8?ffus32\t%12-15,22R, %0-3,5R, #%16-20e"},
+
+  /* Three registers of different lengths */
+  {FPU_NEON_EXT_V1, 0xf2800e00, 0xfea00f50, "vmull%c.p%20S0\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800400, 0xff800f50, "vaddhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf2800600, 0xff800f50, "vsubhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf2800900, 0xff800f50, "vqdmlal%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800b00, 0xff800f50, "vqdmlsl%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800d00, 0xff800f50, "vqdmull%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf3800400, 0xff800f50, "vraddhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3800600, 0xff800f50, "vrsubhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf2800000, 0xfe800f50, "vaddl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800100, 0xfe800f50, "vaddw%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800200, 0xfe800f50, "vsubl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800300, 0xfe800f50, "vsubw%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800500, 0xfe800f50, "vabal%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800700, 0xfe800f50, "vabdl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800800, 0xfe800f50, "vmlal%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800a00, 0xfe800f50, "vmlsl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800c00, 0xfe800f50, "vmull%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+
+  /* Two registers and a scalar */
+  {FPU_NEON_EXT_V1, 0xf2800040, 0xff800f50, "vmla%c.i%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800140, 0xff800f50, "vmla%c.f%20-21Sa\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800340, 0xff800f50, "vqdmlal%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800440, 0xff800f50, "vmls%c.i%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800540, 0xff800f50, "vmls%c.f%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800740, 0xff800f50, "vqdmlsl%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800840, 0xff800f50, "vmul%c.i%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800940, 0xff800f50, "vmul%c.f%20-21Sa\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800b40, 0xff800f50, "vqdmull%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800c40, 0xff800f50, "vqdmulh%c.s%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800d40, 0xff800f50, "vqrdmulh%c.s%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800040, 0xff800f50, "vmla%c.i%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800140, 0xff800f50, "vmla%c.f%20-21Sa\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800440, 0xff800f50, "vmls%c.i%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800540, 0xff800f50, "vmls%c.f%20-21Sa\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800840, 0xff800f50, "vmul%c.i%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800940, 0xff800f50, "vmul%c.f%20-21Sa\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800c40, 0xff800f50, "vqdmulh%c.s%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800d40, 0xff800f50, "vqrdmulh%c.s%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800240, 0xfe800f50, "vmlal%c.%24?us%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800640, 0xfe800f50, "vmlsl%c.%24?us%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800a40, 0xfe800f50, "vmull%c.%24?us%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+
+  /* Element and structure load/store */
+  {FPU_NEON_EXT_V1, 0xf4a00fc0, 0xffb00fc0, "vld4%c.32\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00c00, 0xffb00f00, "vld1%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00d00, 0xffb00f00, "vld2%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00e00, 0xffb00f00, "vld3%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00f00, 0xffb00f00, "vld4%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4000200, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000300, 0xff900f00, "v%21?ls%21?dt2%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000400, 0xff900f00, "v%21?ls%21?dt3%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000500, 0xff900f00, "v%21?ls%21?dt3%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000600, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000700, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000800, 0xff900f00, "v%21?ls%21?dt2%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000900, 0xff900f00, "v%21?ls%21?dt2%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000a00, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000000, 0xff900e00, "v%21?ls%21?dt4%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4800000, 0xff900300, "v%21?ls%21?dt1%c.%10-11S2\t%B"},
+  {FPU_NEON_EXT_V1, 0xf4800100, 0xff900300, "v%21?ls%21?dt2%c.%10-11S2\t%B"},
+  {FPU_NEON_EXT_V1, 0xf4800200, 0xff900300, "v%21?ls%21?dt3%c.%10-11S2\t%B"},
+  {FPU_NEON_EXT_V1, 0xf4800300, 0xff900300, "v%21?ls%21?dt4%c.%10-11S2\t%B"},
+
+  {0,0 ,0, 0}
+};
+
+/* Opcode tables: ARM, 16-bit Thumb, 32-bit Thumb.  All three are partially
+   ordered: they must be searched linearly from the top to obtain a correct
+   match.  */
+
+/* print_insn_arm recognizes the following format control codes:
+
+   %%			%
+
    %a			print address for ldr/str instruction
    %s                   print address for ldr/str halfword/signextend instruction
    %b			print branch destination
-   %B			print arm BLX(1) destination
-   %A			print address for ldc/stc/ldf/stf instruction
+   %c			print condition code (always bits 28-31)
    %m			print register mask for ldm/stm instruction
+   %o			print operand2 (immediate or register + shift)
+   %p			print 'p' iff bits 12-15 are 15
+   %t			print 't' iff bit 21 set and bit 24 clear
+   %B			print arm BLX(1) destination
    %C			print the PSR sub type.
-   %F			print the COUNT field of a LFM/SFM instruction.
-Thumb specific format options:
-   %D                   print Thumb register (bits 0..2 as high number if bit 7 set)
+   %U			print barrier type.
+   %P			print address for pli instruction.
+
+   %<bitfield>r		print as an ARM register
+   %<bitfield>d		print the bitfield in decimal
+   %<bitfield>W         print the bitfield plus one in decimal
+   %<bitfield>x		print the bitfield in hex
+   %<bitfield>X		print the bitfield as 1 hex digit without leading "0x"
+
+   %<bitfield>'c	print specified char iff bitfield is all ones
+   %<bitfield>`c	print specified char iff bitfield is all zeroes
+   %<bitfield>?ab...    select from array of values in big endian order
+
+   %e                   print arm SMI operand (bits 0..7,8..19).
+   %E			print the LSB and WIDTH fields of a BFI or BFC instruction.
+   %V                   print the 16-bit immediate field of a MOVT or MOVW instruction.  */
+
+static const struct opcode32 arm_opcodes[] =
+{
+  /* ARM instructions.  */
+  {ARM_EXT_V1, 0xe1a00000, 0xffffffff, "nop\t\t\t(mov r0,r0)"},
+  {ARM_EXT_V4T | ARM_EXT_V5, 0x012FFF10, 0x0ffffff0, "bx%c\t%0-3r"},
+  {ARM_EXT_V2, 0x00000090, 0x0fe000f0, "mul%20's%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V2, 0x00200090, 0x0fe000f0, "mla%20's%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V2S, 0x01000090, 0x0fb00ff0, "swp%22'b%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V3M, 0x00800090, 0x0fa000f0, "%22?sumull%20's%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V3M, 0x00a00090, 0x0fa000f0, "%22?sumlal%20's%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+
+  /* V7 instructions.  */
+  {ARM_EXT_V7, 0xf450f000, 0xfd70f000, "pli\t%P"},
+  {ARM_EXT_V7, 0x0320f0f0, 0x0ffffff0, "dbg%c\t#%0-3d"},
+  {ARM_EXT_V7, 0xf57ff050, 0xfffffff0, "dmb\t%U"},
+  {ARM_EXT_V7, 0xf57ff040, 0xfffffff0, "dsb\t%U"},
+  {ARM_EXT_V7, 0xf57ff060, 0xfffffff0, "isb\t%U"},
+
+  /* ARM V6T2 instructions.  */
+  {ARM_EXT_V6T2, 0x07c0001f, 0x0fe0007f, "bfc%c\t%12-15r, %E"},
+  {ARM_EXT_V6T2, 0x07c00010, 0x0fe00070, "bfi%c\t%12-15r, %0-3r, %E"},
+  {ARM_EXT_V6T2, 0x00600090, 0x0ff000f0, "mls%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6T2, 0x006000b0, 0x0f7000f0, "strht%c\t%12-15r, %s"},
+  {ARM_EXT_V6T2, 0x00300090, 0x0f300090, "ldr%6's%5?hbt%c\t%12-15r, %s"},
+  {ARM_EXT_V6T2, 0x03000000, 0x0ff00000, "movw%c\t%12-15r, %V"},
+  {ARM_EXT_V6T2, 0x03400000, 0x0ff00000, "movt%c\t%12-15r, %V"},
+  {ARM_EXT_V6T2, 0x06ff0f30, 0x0fff0ff0, "rbit%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6T2, 0x07a00050, 0x0fa00070, "%22?usbfx%c\t%12-15r, %0-3r, #%7-11d, #%16-20W"},
+
+  /* ARM V6Z instructions.  */
+  {ARM_EXT_V6Z, 0x01600070, 0x0ff000f0, "smc%c\t%e"},
+
+  /* ARM V6K instructions.  */
+  {ARM_EXT_V6K, 0xf57ff01f, 0xffffffff, "clrex"},
+  {ARM_EXT_V6K, 0x01d00f9f, 0x0ff00fff, "ldrexb%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01b00f9f, 0x0ff00fff, "ldrexd%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01f00f9f, 0x0ff00fff, "ldrexh%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01c00f90, 0x0ff00ff0, "strexb%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01a00f90, 0x0ff00ff0, "strexd%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01e00f90, 0x0ff00ff0, "strexh%c\t%12-15r, %0-3r, [%16-19r]"},
+
+  /* ARM V6K NOP hints.  */
+  {ARM_EXT_V6K, 0x0320f001, 0x0fffffff, "yield%c"},
+  {ARM_EXT_V6K, 0x0320f002, 0x0fffffff, "wfe%c"},
+  {ARM_EXT_V6K, 0x0320f003, 0x0fffffff, "wfi%c"},
+  {ARM_EXT_V6K, 0x0320f004, 0x0fffffff, "sev%c"},
+  {ARM_EXT_V6K, 0x0320f000, 0x0fffff00, "nop%c\t{%0-7d}"},
+
+  /* ARM V6 instructions. */
+  {ARM_EXT_V6, 0xf1080000, 0xfffffe3f, "cpsie\t%8'a%7'i%6'f"},
+  {ARM_EXT_V6, 0xf10a0000, 0xfffffe20, "cpsie\t%8'a%7'i%6'f,#%0-4d"},
+  {ARM_EXT_V6, 0xf10C0000, 0xfffffe3f, "cpsid\t%8'a%7'i%6'f"},
+  {ARM_EXT_V6, 0xf10e0000, 0xfffffe20, "cpsid\t%8'a%7'i%6'f,#%0-4d"},
+  {ARM_EXT_V6, 0xf1000000, 0xfff1fe20, "cps\t#%0-4d"},
+  {ARM_EXT_V6, 0x06800010, 0x0ff00ff0, "pkhbt%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06800010, 0x0ff00070, "pkhbt%c\t%12-15r, %16-19r, %0-3r, lsl #%7-11d"},
+  {ARM_EXT_V6, 0x06800050, 0x0ff00ff0, "pkhtb%c\t%12-15r, %16-19r, %0-3r, asr #32"},
+  {ARM_EXT_V6, 0x06800050, 0x0ff00070, "pkhtb%c\t%12-15r, %16-19r, %0-3r, asr #%7-11d"},
+  {ARM_EXT_V6, 0x01900f9f, 0x0ff00fff, "ldrex%c\tr%12-15d, [%16-19r]"},
+  {ARM_EXT_V6, 0x06200f10, 0x0ff00ff0, "qadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f90, 0x0ff00ff0, "qadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f30, 0x0ff00ff0, "qaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f70, 0x0ff00ff0, "qsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200ff0, 0x0ff00ff0, "qsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f50, 0x0ff00ff0, "qsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f10, 0x0ff00ff0, "sadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f90, 0x0ff00ff0, "sadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f30, 0x0ff00ff0, "saddaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f10, 0x0ff00ff0, "shadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f90, 0x0ff00ff0, "shadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f30, 0x0ff00ff0, "shaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f70, 0x0ff00ff0, "shsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300ff0, 0x0ff00ff0, "shsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f50, 0x0ff00ff0, "shsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f70, 0x0ff00ff0, "ssub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100ff0, 0x0ff00ff0, "ssub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f50, 0x0ff00ff0, "ssubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f10, 0x0ff00ff0, "uadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f90, 0x0ff00ff0, "uadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f30, 0x0ff00ff0, "uaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f10, 0x0ff00ff0, "uhadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f90, 0x0ff00ff0, "uhadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f30, 0x0ff00ff0, "uhaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f70, 0x0ff00ff0, "uhsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700ff0, 0x0ff00ff0, "uhsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f50, 0x0ff00ff0, "uhsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f10, 0x0ff00ff0, "uqadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f90, 0x0ff00ff0, "uqadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f30, 0x0ff00ff0, "uqaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f70, 0x0ff00ff0, "uqsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600ff0, 0x0ff00ff0, "uqsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f50, 0x0ff00ff0, "uqsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f70, 0x0ff00ff0, "usub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500ff0, 0x0ff00ff0, "usub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f50, 0x0ff00ff0, "usubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06bf0f30, 0x0fff0ff0, "rev%c\t\%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06bf0fb0, 0x0fff0ff0, "rev16%c\t\%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06ff0fb0, 0x0fff0ff0, "revsh%c\t\%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0xf8100a00, 0xfe50ffff, "rfe%23?id%24?ba\t\%16-19r%21'!"},
+  {ARM_EXT_V6, 0x06bf0070, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06bf0470, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06bf0870, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06bf0c70, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x068f0070, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x068f0470, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x068f0870, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x068f0c70, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06af0070, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06af0470, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06af0870, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06af0c70, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06ff0070, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06ff0470, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06ff0870, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06ff0c70, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06cf0070, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06cf0470, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06cf0870, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06cf0c70, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06ef0070, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06ef0470, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06ef0870, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06ef0c70, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06b00070, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06b00470, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06b00870, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06b00c70, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06800070, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06800470, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06800870, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06800c70, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06a00070, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06a00470, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06a00870, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06a00c70, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06f00070, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06f00470, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06f00870, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06f00c70, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06c00070, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06c00470, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06c00870, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06c00c70, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r, ROR #24"},
+  {ARM_EXT_V6, 0x06e00070, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06e00470, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06e00870, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06e00c70, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06800fb0, 0x0ff00ff0, "sel%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0xf1010000, 0xfffffc00, "setend\t%9?ble"},
+  {ARM_EXT_V6, 0x0700f010, 0x0ff0f0d0, "smuad%5'x%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x0700f050, 0x0ff0f0d0, "smusd%5'x%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07000010, 0x0ff000d0, "smlad%5'x%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x07400010, 0x0ff000d0, "smlald%5'x%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07000050, 0x0ff000d0, "smlsd%5'x%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x07400050, 0x0ff000d0, "smlsld%5'x%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x0750f010, 0x0ff0f0d0, "smmul%5'r%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07500010, 0x0ff000d0, "smmla%5'r%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x075000d0, 0x0ff000d0, "smmls%5'r%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0xf84d0500, 0xfe5fffe0, "srs%23?id%24?ba\t%16-19r%21'!, #%0-4d"},
+  {ARM_EXT_V6, 0x06a00010, 0x0fe00ff0, "ssat%c\t%12-15r, #%16-20W, %0-3r"},
+  {ARM_EXT_V6, 0x06a00010, 0x0fe00070, "ssat%c\t%12-15r, #%16-20W, %0-3r, lsl #%7-11d"},
+  {ARM_EXT_V6, 0x06a00050, 0x0fe00070, "ssat%c\t%12-15r, #%16-20W, %0-3r, asr #%7-11d"},
+  {ARM_EXT_V6, 0x06a00f30, 0x0ff00ff0, "ssat16%c\t%12-15r, #%16-19W, %0-3r"},
+  {ARM_EXT_V6, 0x01800f90, 0x0ff00ff0, "strex%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V6, 0x00400090, 0x0ff000f0, "umaal%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x0780f010, 0x0ff0f0f0, "usad8%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07800010, 0x0ff000f0, "usada8%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x06e00010, 0x0fe00ff0, "usat%c\t%12-15r, #%16-20d, %0-3r"},
+  {ARM_EXT_V6, 0x06e00010, 0x0fe00070, "usat%c\t%12-15r, #%16-20d, %0-3r, lsl #%7-11d"},
+  {ARM_EXT_V6, 0x06e00050, 0x0fe00070, "usat%c\t%12-15r, #%16-20d, %0-3r, asr #%7-11d"},
+  {ARM_EXT_V6, 0x06e00f30, 0x0ff00ff0, "usat16%c\t%12-15r, #%16-19d, %0-3r"},
+
+  /* V5J instruction.  */
+  {ARM_EXT_V5J, 0x012fff20, 0x0ffffff0, "bxj%c\t%0-3r"},
+
+  /* V5 Instructions.  */
+  {ARM_EXT_V5, 0xe1200070, 0xfff000f0, "bkpt\t0x%16-19X%12-15X%8-11X%0-3X"},
+  {ARM_EXT_V5, 0xfa000000, 0xfe000000, "blx\t%B"},
+  {ARM_EXT_V5, 0x012fff30, 0x0ffffff0, "blx%c\t%0-3r"},
+  {ARM_EXT_V5, 0x016f0f10, 0x0fff0ff0, "clz%c\t%12-15r, %0-3r"},
+
+  /* V5E "El Segundo" Instructions.  */
+  {ARM_EXT_V5E, 0x000000d0, 0x0e1000f0, "ldrd%c\t%12-15r, %s"},
+  {ARM_EXT_V5E, 0x000000f0, 0x0e1000f0, "strd%c\t%12-15r, %s"},
+  {ARM_EXT_V5E, 0xf450f000, 0xfc70f000, "pld\t%a"},
+  {ARM_EXT_V5ExP, 0x01000080, 0x0ff000f0, "smlabb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x010000a0, 0x0ff000f0, "smlatb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x010000c0, 0x0ff000f0, "smlabt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x010000e0, 0x0ff000f0, "smlatt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+
+  {ARM_EXT_V5ExP, 0x01200080, 0x0ff000f0, "smlawb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x012000c0, 0x0ff000f0, "smlawt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+
+  {ARM_EXT_V5ExP, 0x01400080, 0x0ff000f0, "smlalbb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x014000a0, 0x0ff000f0, "smlaltb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x014000c0, 0x0ff000f0, "smlalbt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x014000e0, 0x0ff000f0, "smlaltt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+
+  {ARM_EXT_V5ExP, 0x01600080, 0x0ff0f0f0, "smulbb%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x016000a0, 0x0ff0f0f0, "smultb%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x016000c0, 0x0ff0f0f0, "smulbt%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x016000e0, 0x0ff0f0f0, "smultt%c\t%16-19r, %0-3r, %8-11r"},
+
+  {ARM_EXT_V5ExP, 0x012000a0, 0x0ff0f0f0, "smulwb%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x012000e0, 0x0ff0f0f0, "smulwt%c\t%16-19r, %0-3r, %8-11r"},
+
+  {ARM_EXT_V5ExP, 0x01000050, 0x0ff00ff0,  "qadd%c\t%12-15r, %0-3r, %16-19r"},
+  {ARM_EXT_V5ExP, 0x01400050, 0x0ff00ff0, "qdadd%c\t%12-15r, %0-3r, %16-19r"},
+  {ARM_EXT_V5ExP, 0x01200050, 0x0ff00ff0,  "qsub%c\t%12-15r, %0-3r, %16-19r"},
+  {ARM_EXT_V5ExP, 0x01600050, 0x0ff00ff0, "qdsub%c\t%12-15r, %0-3r, %16-19r"},
+
+  /* ARM Instructions.  */
+  {ARM_EXT_V1, 0x00000090, 0x0e100090, "str%6's%5?hb%c\t%12-15r, %s"},
+  {ARM_EXT_V1, 0x00100090, 0x0e100090, "ldr%6's%5?hb%c\t%12-15r, %s"},
+  {ARM_EXT_V1, 0x00000000, 0x0de00000, "and%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00200000, 0x0de00000, "eor%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00400000, 0x0de00000, "sub%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00600000, 0x0de00000, "rsb%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00800000, 0x0de00000, "add%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00a00000, 0x0de00000, "adc%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00c00000, 0x0de00000, "sbc%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00e00000, 0x0de00000, "rsc%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V3, 0x0120f000, 0x0db0f000, "msr%c\t%22?SCPSR%C, %o"},
+  {ARM_EXT_V3, 0x010f0000, 0x0fbf0fff, "mrs%c\t%12-15r, %22?SCPSR"},
+  {ARM_EXT_V1, 0x01000000, 0x0de00000, "tst%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01200000, 0x0de00000, "teq%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01400000, 0x0de00000, "cmp%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01600000, 0x0de00000, "cmn%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01800000, 0x0de00000, "orr%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x03a00000, 0x0fef0000, "mov%20's%c\t%12-15r, %o"},
+  {ARM_EXT_V1, 0x01a00000, 0x0def0ff0, "mov%20's%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V1, 0x01a00000, 0x0def0060, "lsl%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01a00020, 0x0def0060, "lsr%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01a00040, 0x0def0060, "asr%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01a00060, 0x0def0ff0, "rrx%20's%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V1, 0x01a00060, 0x0def0060, "ror%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01c00000, 0x0de00000, "bic%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x01e00000, 0x0de00000, "mvn%20's%c\t%12-15r, %o"},
+  {ARM_EXT_V1, 0x052d0004, 0x0fff0fff, "push%c\t{%12-15r}\t\t; (str%c %12-15r, %a)"},
+  {ARM_EXT_V1, 0x04000000, 0x0e100000, "str%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x06000000, 0x0e100ff0, "str%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x04000000, 0x0c100010, "str%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x06000010, 0x0e000010, "undefined"},
+  {ARM_EXT_V1, 0x049d0004, 0x0fff0fff, "pop%c\t{%12-15r}\t\t; (ldr%c %12-15r, %a)"},
+  {ARM_EXT_V1, 0x04100000, 0x0c100000, "ldr%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x092d0000, 0x0fff0000, "push%c\t%m"},
+  {ARM_EXT_V1, 0x08800000, 0x0ff00000, "stm%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x08000000, 0x0e100000, "stm%23?id%24?ba%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x08bd0000, 0x0fff0000, "pop%c\t%m"},
+  {ARM_EXT_V1, 0x08900000, 0x0f900000, "ldm%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x08100000, 0x0e100000, "ldm%23?id%24?ba%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x0a000000, 0x0e000000, "b%24'l%c\t%b"},
+  {ARM_EXT_V1, 0x0f000000, 0x0f000000, "svc%c\t%0-23x"},
+
+  /* The rest.  */
+  {ARM_EXT_V1, 0x00000000, 0x00000000, "undefined instruction %0-31x"},
+  {0, 0x00000000, 0x00000000, 0}
+};
+
+/* print_insn_thumb16 recognizes the following format control codes:
+
    %S                   print Thumb register (bits 3..5 as high number if bit 6 set)
+   %D                   print Thumb register (bits 0..2 as high number if bit 7 set)
    %<bitfield>I         print bitfield as a signed decimal
    				(top bit of range being the sign bit)
-   %M                   print Thumb register mask
    %N                   print Thumb register mask (with LR)
    %O                   print Thumb register mask (with PC)
-   %T                   print Thumb condition code (always bits 8-11)
-   %I                   print cirrus signed shift immediate: bits 0..3|4..6
-   %<bitfield>B         print Thumb branch destination (signed displacement)
-   %<bitfield>W         print (bitfield * 4) as a decimal
+   %M                   print Thumb register mask
+   %b			print CZB's 6-bit unsigned branch destination
+   %s			print Thumb right-shift immediate (6..10; 0 == 32).
+   %c			print the condition code
+   %C			print the condition code, or "s" if not conditional
+   %x			print warning if conditional an not at end of IT block"
+   %X			print "\t; unpredictable <IT:code>" if conditional
+   %I			print IT instruction suffix and operands
+   %<bitfield>r		print bitfield as an ARM register
+   %<bitfield>d		print bitfield as a decimal
    %<bitfield>H         print (bitfield * 2) as a decimal
+   %<bitfield>W         print (bitfield * 4) as a decimal
    %<bitfield>a         print (bitfield * 4) as a pc-rel offset + decoded symbol
-*/
-
-/* Note: There is a partial ordering in this table - it must be searched from
-   the top to obtain a correct match. */
-
-static struct arm_opcode arm_opcodes[] =
-{
-    /* ARM instructions.  */
-    {0xe1a00000, 0xffffffff, "nop\t\t\t(mov r0,r0)"},
-    {0x012FFF10, 0x0ffffff0, "bx%c\t%0-3r"},
-    {0x00000090, 0x0fe000f0, "mul%c%20's\t%16-19r, %0-3r, %8-11r"},
-    {0x00200090, 0x0fe000f0, "mla%c%20's\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x01000090, 0x0fb00ff0, "swp%c%22'b\t%12-15r, %0-3r, [%16-19r]"},
-    {0x00800090, 0x0fa000f0, "%22?sumull%c%20's\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x00a00090, 0x0fa000f0, "%22?sumlal%c%20's\t%12-15r, %16-19r, %0-3r, %8-11r"},
-
-    /* V5J instruction.  */
-    {0x012fff20, 0x0ffffff0, "bxj%c\t%0-3r"},
-
-    /* XScale instructions.  */
-    {0x0e200010, 0x0fff0ff0, "mia%c\tacc0, %0-3r, %12-15r"},
-    {0x0e280010, 0x0fff0ff0, "miaph%c\tacc0, %0-3r, %12-15r"},
-    {0x0e2c0010, 0x0ffc0ff0, "mia%17'T%17`B%16'T%16`B%c\tacc0, %0-3r, %12-15r"},
-    {0x0c400000, 0x0ff00fff, "mar%c\tacc0, %12-15r, %16-19r"},
-    {0x0c500000, 0x0ff00fff, "mra%c\t%12-15r, %16-19r, acc0"},
-    {0xf450f000, 0xfc70f000, "pld\t%a"},
-    
-    /* V5 Instructions.  */
-    {0xe1200070, 0xfff000f0, "bkpt\t0x%16-19X%12-15X%8-11X%0-3X"},
-    {0xfa000000, 0xfe000000, "blx\t%B"},
-    {0x012fff30, 0x0ffffff0, "blx%c\t%0-3r"},
-    {0x016f0f10, 0x0fff0ff0, "clz%c\t%12-15r, %0-3r"},
-    {0xfc100000, 0xfe100000, "ldc2%22'l\t%8-11d, cr%12-15d, %A"},
-    {0xfc000000, 0xfe100000, "stc2%22'l\t%8-11d, cr%12-15d, %A"},
-    {0xfe000000, 0xff000010, "cdp2\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0xfe000010, 0xff100010, "mcr2\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0xfe100010, 0xff100010, "mrc2\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-
-    /* V5E "El Segundo" Instructions.  */    
-    {0x000000d0, 0x0e1000f0, "ldr%cd\t%12-15r, %s"},
-    {0x000000f0, 0x0e1000f0, "str%cd\t%12-15r, %s"},
-    {0x01000080, 0x0ff000f0, "smlabb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x010000a0, 0x0ff000f0, "smlatb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x010000c0, 0x0ff000f0, "smlabt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x010000e0, 0x0ff000f0, "smlatt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-
-    {0x01200080, 0x0ff000f0, "smlawb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x012000c0, 0x0ff000f0, "smlawt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-
-    {0x01400080, 0x0ff000f0, "smlalbb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x014000a0, 0x0ff000f0, "smlaltb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x014000c0, 0x0ff000f0, "smlalbt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x014000e0, 0x0ff000f0, "smlaltt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-
-    {0x01600080, 0x0ff0f0f0, "smulbb%c\t%16-19r, %0-3r, %8-11r"},
-    {0x016000a0, 0x0ff0f0f0, "smultb%c\t%16-19r, %0-3r, %8-11r"},
-    {0x016000c0, 0x0ff0f0f0, "smulbt%c\t%16-19r, %0-3r, %8-11r"},
-    {0x016000e0, 0x0ff0f0f0, "smultt%c\t%16-19r, %0-3r, %8-11r"},
-
-    {0x012000a0, 0x0ff0f0f0, "smulwb%c\t%16-19r, %0-3r, %8-11r"},
-    {0x012000e0, 0x0ff0f0f0, "smulwt%c\t%16-19r, %0-3r, %8-11r"},
-
-    {0x01000050, 0x0ff00ff0,  "qadd%c\t%12-15r, %0-3r, %16-19r"},
-    {0x01400050, 0x0ff00ff0, "qdadd%c\t%12-15r, %0-3r, %16-19r"},
-    {0x01200050, 0x0ff00ff0,  "qsub%c\t%12-15r, %0-3r, %16-19r"},
-    {0x01600050, 0x0ff00ff0, "qdsub%c\t%12-15r, %0-3r, %16-19r"},
-
-    {0x0c400000, 0x0ff00000, "mcrr%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
-    {0x0c500000, 0x0ff00000, "mrrc%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
-
-    /* ARM Instructions.  */
-    {0x00000090, 0x0e100090, "str%c%6's%5?hb\t%12-15r, %s"},
-    {0x00100090, 0x0e100090, "ldr%c%6's%5?hb\t%12-15r, %s"},
-    {0x00000000, 0x0de00000, "and%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00200000, 0x0de00000, "eor%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00400000, 0x0de00000, "sub%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00600000, 0x0de00000, "rsb%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00800000, 0x0de00000, "add%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00a00000, 0x0de00000, "adc%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00c00000, 0x0de00000, "sbc%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00e00000, 0x0de00000, "rsc%c%20's\t%12-15r, %16-19r, %o"},
-    {0x0120f000, 0x0db0f000, "msr%c\t%22?SCPSR%C, %o"},
-    {0x010f0000, 0x0fbf0fff, "mrs%c\t%12-15r, %22?SCPSR"},
-    {0x01000000, 0x0de00000, "tst%c%p\t%16-19r, %o"},
-    {0x01200000, 0x0de00000, "teq%c%p\t%16-19r, %o"},
-    {0x01400000, 0x0de00000, "cmp%c%p\t%16-19r, %o"},
-    {0x01600000, 0x0de00000, "cmn%c%p\t%16-19r, %o"},
-    {0x01800000, 0x0de00000, "orr%c%20's\t%12-15r, %16-19r, %o"},
-    {0x01a00000, 0x0de00000, "mov%c%20's\t%12-15r, %o"},
-    {0x01c00000, 0x0de00000, "bic%c%20's\t%12-15r, %16-19r, %o"},
-    {0x01e00000, 0x0de00000, "mvn%c%20's\t%12-15r, %o"},
-    {0x04000000, 0x0e100000, "str%c%22'b%t\t%12-15r, %a"},
-    {0x06000000, 0x0e100ff0, "str%c%22'b%t\t%12-15r, %a"},
-    {0x04000000, 0x0c100010, "str%c%22'b%t\t%12-15r, %a"},
-    {0x06000010, 0x0e000010, "undefined"},
-    {0x04100000, 0x0c100000, "ldr%c%22'b%t\t%12-15r, %a"},
-    {0x08000000, 0x0e100000, "stm%c%23?id%24?ba\t%16-19r%21'!, %m%22'^"},
-    {0x08100000, 0x0e100000, "ldm%c%23?id%24?ba\t%16-19r%21'!, %m%22'^"},
-    {0x0a000000, 0x0e000000, "b%24'l%c\t%b"},
-    {0x0f000000, 0x0f000000, "swi%c\t%0-23x"},
-
-    /* Floating point coprocessor (FPA) instructions */
-    {0x0e000100, 0x0ff08f10, "adf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e100100, 0x0ff08f10, "muf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e200100, 0x0ff08f10, "suf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e300100, 0x0ff08f10, "rsf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e400100, 0x0ff08f10, "dvf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e500100, 0x0ff08f10, "rdf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e600100, 0x0ff08f10, "pow%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e700100, 0x0ff08f10, "rpw%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e800100, 0x0ff08f10, "rmf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e900100, 0x0ff08f10, "fml%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0ea00100, 0x0ff08f10, "fdv%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0eb00100, 0x0ff08f10, "frd%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0ec00100, 0x0ff08f10, "pol%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e008100, 0x0ff08f10, "mvf%c%P%R\t%12-14f, %0-3f"},
-    {0x0e108100, 0x0ff08f10, "mnf%c%P%R\t%12-14f, %0-3f"},
-    {0x0e208100, 0x0ff08f10, "abs%c%P%R\t%12-14f, %0-3f"},
-    {0x0e308100, 0x0ff08f10, "rnd%c%P%R\t%12-14f, %0-3f"},
-    {0x0e408100, 0x0ff08f10, "sqt%c%P%R\t%12-14f, %0-3f"},
-    {0x0e508100, 0x0ff08f10, "log%c%P%R\t%12-14f, %0-3f"},
-    {0x0e608100, 0x0ff08f10, "lgn%c%P%R\t%12-14f, %0-3f"},
-    {0x0e708100, 0x0ff08f10, "exp%c%P%R\t%12-14f, %0-3f"},
-    {0x0e808100, 0x0ff08f10, "sin%c%P%R\t%12-14f, %0-3f"},
-    {0x0e908100, 0x0ff08f10, "cos%c%P%R\t%12-14f, %0-3f"},
-    {0x0ea08100, 0x0ff08f10, "tan%c%P%R\t%12-14f, %0-3f"},
-    {0x0eb08100, 0x0ff08f10, "asn%c%P%R\t%12-14f, %0-3f"},
-    {0x0ec08100, 0x0ff08f10, "acs%c%P%R\t%12-14f, %0-3f"},
-    {0x0ed08100, 0x0ff08f10, "atn%c%P%R\t%12-14f, %0-3f"},
-    {0x0ee08100, 0x0ff08f10, "urd%c%P%R\t%12-14f, %0-3f"},
-    {0x0ef08100, 0x0ff08f10, "nrm%c%P%R\t%12-14f, %0-3f"},
-    {0x0e000110, 0x0ff00f1f, "flt%c%P%R\t%16-18f, %12-15r"},
-    {0x0e100110, 0x0fff0f98, "fix%c%R\t%12-15r, %0-2f"},
-    {0x0e200110, 0x0fff0fff, "wfs%c\t%12-15r"},
-    {0x0e300110, 0x0fff0fff, "rfs%c\t%12-15r"},
-    {0x0e400110, 0x0fff0fff, "wfc%c\t%12-15r"},
-    {0x0e500110, 0x0fff0fff, "rfc%c\t%12-15r"},
-    {0x0e90f110, 0x0ff8fff0, "cmf%c\t%16-18f, %0-3f"},
-    {0x0eb0f110, 0x0ff8fff0, "cnf%c\t%16-18f, %0-3f"},
-    {0x0ed0f110, 0x0ff8fff0, "cmfe%c\t%16-18f, %0-3f"},
-    {0x0ef0f110, 0x0ff8fff0, "cnfe%c\t%16-18f, %0-3f"},
-    {0x0c000100, 0x0e100f00, "stf%c%Q\t%12-14f, %A"},
-    {0x0c100100, 0x0e100f00, "ldf%c%Q\t%12-14f, %A"},
-    {0x0c000200, 0x0e100f00, "sfm%c\t%12-14f, %F, %A"},
-    {0x0c100200, 0x0e100f00, "lfm%c\t%12-14f, %F, %A"},
-
-    /* Floating point coprocessor (VFP) instructions */
-    {0x0eb00bc0, 0x0fff0ff0, "fabsd%c\t%1z, %0z"},
-    {0x0eb00ac0, 0x0fbf0fd0, "fabss%c\t%1y, %0y"},
-    {0x0e300b00, 0x0ff00ff0, "faddd%c\t%1z, %2z, %0z"},
-    {0x0e300a00, 0x0fb00f50, "fadds%c\t%1y, %2y, %1y"},
-    {0x0eb40b40, 0x0fff0f70, "fcmp%7'ed%c\t%1z, %0z"},
-    {0x0eb40a40, 0x0fbf0f50, "fcmp%7'es%c\t%1y, %0y"},
-    {0x0eb50b40, 0x0fff0f70, "fcmp%7'ezd%c\t%1z"},
-    {0x0eb50a40, 0x0fbf0f70, "fcmp%7'ezs%c\t%1y"},
-    {0x0eb00b40, 0x0fff0ff0, "fcpyd%c\t%1z, %0z"},
-    {0x0eb00a40, 0x0fbf0fd0, "fcpys%c\t%1y, %0y"},
-    {0x0eb70ac0, 0x0fff0fd0, "fcvtds%c\t%1z, %0y"},
-    {0x0eb70bc0, 0x0fbf0ff0, "fcvtsd%c\t%1y, %0z"},
-    {0x0e800b00, 0x0ff00ff0, "fdivd%c\t%1z, %2z, %0z"},
-    {0x0e800a00, 0x0fb00f50, "fdivs%c\t%1y, %2y, %0y"},
-    {0x0d100b00, 0x0f700f00, "fldd%c\t%1z, %A"},
-    {0x0c900b00, 0x0fd00f00, "fldmia%0?xd%c\t%16-19r%21'!, %3z"},
-    {0x0d300b00, 0x0ff00f00, "fldmdb%0?xd%c\t%16-19r!, %3z"},
-    {0x0d100a00, 0x0f300f00, "flds%c\t%1y, %A"},
-    {0x0c900a00, 0x0f900f00, "fldmias%c\t%16-19r%21'!, %3y"},
-    {0x0d300a00, 0x0fb00f00, "fldmdbs%c\t%16-19r!, %3y"},
-    {0x0e000b00, 0x0ff00ff0, "fmacd%c\t%1z, %2z, %0z"},
-    {0x0e000a00, 0x0fb00f50, "fmacs%c\t%1y, %2y, %0y"},
-    {0x0e200b10, 0x0ff00fff, "fmdhr%c\t%2z, %12-15r"},
-    {0x0e000b10, 0x0ff00fff, "fmdlr%c\t%2z, %12-15r"},
-    {0x0c400b10, 0x0ff00ff0, "fmdrr%c\t%0z, %12-15r, %16-19r"},
-    {0x0e300b10, 0x0ff00fff, "fmrdh%c\t%12-15r, %2z"},
-    {0x0e100b10, 0x0ff00fff, "fmrdl%c\t%12-15r, %2z"},
-    {0x0c500b10, 0x0ff00ff0, "fmrrd%c\t%12-15r, %16-19r, %0z"},
-    {0x0c500a10, 0x0ff00fd0, "fmrrs%c\t%12-15r, %16-19r, %4y"},
-    {0x0e100a10, 0x0ff00f7f, "fmrs%c\t%12-15r, %2y"},
-    {0x0ef1fa10, 0x0fffffff, "fmstat%c"},
-    {0x0ef00a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpsid"},
-    {0x0ef10a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpscr"},
-    {0x0ef80a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpexc"},
-    {0x0ef90a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst\t@ Impl def"},
-    {0x0efa0a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst2\t@ Impl def"},
-    {0x0ef00a10, 0x0ff00fff, "fmrx%c\t%12-15r, <impl def 0x%16-19x>"},
-    {0x0e100b00, 0x0ff00ff0, "fmscd%c\t%1z, %2z, %0z"},
-    {0x0e100a00, 0x0fb00f50, "fmscs%c\t%1y, %2y, %0y"},
-    {0x0e000a10, 0x0ff00f7f, "fmsr%c\t%2y, %12-15r"},
-    {0x0c400a10, 0x0ff00fd0, "fmsrr%c\t%12-15r, %16-19r, %4y"},
-    {0x0e200b00, 0x0ff00ff0, "fmuld%c\t%1z, %2z, %0z"},
-    {0x0e200a00, 0x0fb00f50, "fmuls%c\t%1y, %2y, %0y"},
-    {0x0ee00a10, 0x0fff0fff, "fmxr%c\tfpsid, %12-15r"},
-    {0x0ee10a10, 0x0fff0fff, "fmxr%c\tfpscr, %12-15r"},
-    {0x0ee80a10, 0x0fff0fff, "fmxr%c\tfpexc, %12-15r"},
-    {0x0ee90a10, 0x0fff0fff, "fmxr%c\tfpinst, %12-15r\t@ Impl def"},
-    {0x0eea0a10, 0x0fff0fff, "fmxr%c\tfpinst2, %12-15r\t@ Impl def"},
-    {0x0ee00a10, 0x0ff00fff, "fmxr%c\t<impl def 0x%16-19x>, %12-15r"},
-    {0x0eb10b40, 0x0fff0ff0, "fnegd%c\t%1z, %0z"},
-    {0x0eb10a40, 0x0fbf0fd0, "fnegs%c\t%1y, %0y"},
-    {0x0e000b40, 0x0ff00ff0, "fnmacd%c\t%1z, %2z, %0z"},
-    {0x0e000a40, 0x0fb00f50, "fnmacs%c\t%1y, %2y, %0y"},
-    {0x0e100b40, 0x0ff00ff0, "fnmscd%c\t%1z, %2z, %0z"},
-    {0x0e100a40, 0x0fb00f50, "fnmscs%c\t%1y, %2y, %0y"},
-    {0x0e200b40, 0x0ff00ff0, "fnmuld%c\t%1z, %2z, %0z"},
-    {0x0e200a40, 0x0fb00f50, "fnmuls%c\t%1y, %2y, %0y"},
-    {0x0eb80bc0, 0x0fff0fd0, "fsitod%c\t%1z, %0y"},
-    {0x0eb80ac0, 0x0fbf0fd0, "fsitos%c\t%1y, %0y"},
-    {0x0eb10bc0, 0x0fff0ff0, "fsqrtd%c\t%1z, %0z"},
-    {0x0eb10ac0, 0x0fbf0fd0, "fsqrts%c\t%1y, %0y"},
-    {0x0d000b00, 0x0f700f00, "fstd%c\t%1z, %A"},
-    {0x0c800b00, 0x0fd00f00, "fstmia%0?xd%c\t%16-19r%21'!, %3z"},
-    {0x0d200b00, 0x0ff00f00, "fstmdb%0?xd%c\t%16-19r!, %3z"},
-    {0x0d000a00, 0x0f300f00, "fsts%c\t%1y, %A"},
-    {0x0c800a00, 0x0f900f00, "fstmias%c\t%16-19r%21'!, %3y"},
-    {0x0d200a00, 0x0fb00f00, "fstmdbs%c\t%16-19r!, %3y"},
-    {0x0e300b40, 0x0ff00ff0, "fsubd%c\t%1z, %2z, %0z"},
-    {0x0e300a40, 0x0fb00f50, "fsubs%c\t%1y, %2y, %0y"},
-    {0x0ebc0b40, 0x0fbe0f70, "fto%16?sui%7'zd%c\t%1y, %0z"},
-    {0x0ebc0a40, 0x0fbe0f50, "fto%16?sui%7'zs%c\t%1y, %0y"},
-    {0x0eb80b40, 0x0fff0fd0, "fuitod%c\t%1z, %0y"},
-    {0x0eb80a40, 0x0fbf0fd0, "fuitos%c\t%1y, %0y"},
-
-    /* Cirrus coprocessor instructions.  */
-    {0x0d100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
-    {0x0c100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
-    {0x0d500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
-    {0x0c500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"}, 
-    {0x0d100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
-    {0x0c100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
-    {0x0d500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
-    {0x0c500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
-    {0x0d000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
-    {0x0c000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
-    {0x0d400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
-    {0x0c400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
-    {0x0d000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
-    {0x0c000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
-    {0x0d400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
-    {0x0c400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
-    {0x0e000450, 0x0ff00ff0, "cfmvsr%c\tmvf%16-19d, %12-15r"},
-    {0x0e100450, 0x0ff00ff0, "cfmvrs%c\t%12-15r, mvf%16-19d"},
-    {0x0e000410, 0x0ff00ff0, "cfmvdlr%c\tmvd%16-19d, %12-15r"},
-    {0x0e100410, 0x0ff00ff0, "cfmvrdl%c\t%12-15r, mvd%16-19d"},
-    {0x0e000430, 0x0ff00ff0, "cfmvdhr%c\tmvd%16-19d, %12-15r"},
-    {0x0e100430, 0x0ff00fff, "cfmvrdh%c\t%12-15r, mvd%16-19d"},
-    {0x0e000510, 0x0ff00fff, "cfmv64lr%c\tmvdx%16-19d, %12-15r"},
-    {0x0e100510, 0x0ff00fff, "cfmvr64l%c\t%12-15r, mvdx%16-19d"},
-    {0x0e000530, 0x0ff00fff, "cfmv64hr%c\tmvdx%16-19d, %12-15r"},
-    {0x0e100530, 0x0ff00fff, "cfmvr64h%c\t%12-15r, mvdx%16-19d"},
-    {0x0e100610, 0x0ff0fff0, "cfmval32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000610, 0x0ff0fff0, "cfmv32al%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e100630, 0x0ff0fff0, "cfmvam32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000630, 0x0ff0fff0, "cfmv32am%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e100650, 0x0ff0fff0, "cfmvah32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000650, 0x0ff0fff0, "cfmv32ah%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e000670, 0x0ff0fff0, "cfmv32a%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e100670, 0x0ff0fff0, "cfmva32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000690, 0x0ff0fff0, "cfmv64a%c\tmvdx%0-3d, mvax%16-19d"},
-    {0x0e100690, 0x0ff0fff0, "cfmva64%c\tmvax%0-3d, mvdx%16-19d"},
-    {0x0e1006b0, 0x0ff0fff0, "cfmvsc32%c\tdspsc, mvfx%16-19d"},
-    {0x0e0006b0, 0x0ff0fff0, "cfmv32sc%c\tmvfx%0-3d, dspsc"},
-    {0x0e000400, 0x0ff00fff, "cfcpys%c\tmvf%12-15d, mvf%16-19d"},
-    {0x0e000420, 0x0ff00fff, "cfcpyd%c\tmvd%12-15d, mvd%16-19d"},
-    {0x0e000460, 0x0ff00fff, "cfcvtsd%c\tmvd%12-15d, mvf%16-19d"},
-    {0x0e000440, 0x0ff00fff, "cfcvtds%c\tmvf%12-15d, mvd%16-19d"},
-    {0x0e000480, 0x0ff00fff, "cfcvt32s%c\tmvf%12-15d, mvfx%16-19d"},
-    {0x0e0004a0, 0x0ff00fff, "cfcvt32d%c\tmvd%12-15d, mvfx%16-19d"},
-    {0x0e0004c0, 0x0ff00fff, "cfcvt64s%c\tmvf%12-15d, mvdx%16-19d"},
-    {0x0e0004e0, 0x0ff00fff, "cfcvt64d%c\tmvd%12-15d, mvdx%16-19d"},
-    {0x0e100580, 0x0ff00fff, "cfcvts32%c\tmvfx%12-15d, mvf%16-19d"},
-    {0x0e1005a0, 0x0ff00fff, "cfcvtd32%c\tmvfx%12-15d, mvd%16-19d"},
-    {0x0e1005c0, 0x0ff00fff, "cftruncs32%c\tmvfx%12-15d, mvf%16-19d"},
-    {0x0e1005e0, 0x0ff00fff, "cftruncd32%c\tmvfx%12-15d, mvd%16-19d"},
-    {0x0e000550, 0x0ff00ff0, "cfrshl32%c\tmvfx%16-19d, mvfx%0-3d, %12-15r"},
-    {0x0e000570, 0x0ff00ff0, "cfrshl64%c\tmvdx%16-19d, mvdx%0-3d, %12-15r"},
-    {0x0e000500, 0x0ff00f00, "cfsh32%c\tmvfx%12-15d, mvfx%16-19d, #%I"},
-    {0x0e200500, 0x0ff00f00, "cfsh64%c\tmvdx%12-15d, mvdx%16-19d, #%I"},
-    {0x0e100490, 0x0ff00ff0, "cfcmps%c\t%12-15r, mvf%16-19d, mvf%0-3d"},
-    {0x0e1004b0, 0x0ff00ff0, "cfcmpd%c\t%12-15r, mvd%16-19d, mvd%0-3d"},
-    {0x0e100590, 0x0ff00ff0, "cfcmp32%c\t%12-15r, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e1005b0, 0x0ff00ff0, "cfcmp64%c\t%12-15r, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e300400, 0x0ff00fff, "cfabss%c\tmvf%12-15d, mvf%16-19d"},
-    {0x0e300420, 0x0ff00fff, "cfabsd%c\tmvd%12-15d, mvd%16-19d"},
-    {0x0e300440, 0x0ff00fff, "cfnegs%c\tmvf%12-15d, mvf%16-19d"},
-    {0x0e300460, 0x0ff00fff, "cfnegd%c\tmvd%12-15d, mvd%16-19d"},
-    {0x0e300480, 0x0ff00ff0, "cfadds%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
-    {0x0e3004a0, 0x0ff00ff0, "cfaddd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
-    {0x0e3004c0, 0x0ff00ff0, "cfsubs%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
-    {0x0e3004e0, 0x0ff00ff0, "cfsubd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
-    {0x0e100400, 0x0ff00ff0, "cfmuls%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
-    {0x0e100420, 0x0ff00ff0, "cfmuld%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
-    {0x0e300500, 0x0ff00fff, "cfabs32%c\tmvfx%12-15d, mvfx%16-19d"},
-    {0x0e300520, 0x0ff00fff, "cfabs64%c\tmvdx%12-15d, mvdx%16-19d"},
-    {0x0e300540, 0x0ff00fff, "cfneg32%c\tmvfx%12-15d, mvfx%16-19d"},
-    {0x0e300560, 0x0ff00fff, "cfneg64%c\tmvdx%12-15d, mvdx%16-19d"},
-    {0x0e300580, 0x0ff00ff0, "cfadd32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e3005a0, 0x0ff00ff0, "cfadd64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e3005c0, 0x0ff00ff0, "cfsub32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e3005e0, 0x0ff00ff0, "cfsub64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e100500, 0x0ff00ff0, "cfmul32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e100520, 0x0ff00ff0, "cfmul64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e100540, 0x0ff00ff0, "cfmac32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e100560, 0x0ff00ff0, "cfmsc32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e000600, 0x0ff00f00, "cfmadd32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e100600, 0x0ff00f00, "cfmsub32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e200600, 0x0ff00f00, "cfmadda32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e300600, 0x0ff00f00, "cfmsuba32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
-
-    /* Generic coprocessor instructions */
-    {0x0e000000, 0x0f000010, "cdp%c\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0x0e100010, 0x0f100010, "mrc%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0x0e000010, 0x0f100010, "mcr%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0x0c000000, 0x0e100000, "stc%c%22'l\t%8-11d, cr%12-15d, %A"},
-    {0x0c100000, 0x0e100000, "ldc%c%22'l\t%8-11d, cr%12-15d, %A"},
-
-    /* The rest.  */
-    {0x00000000, 0x00000000, "undefined instruction %0-31x"},
-    {0x00000000, 0x00000000, 0}
-};
-
-#define BDISP(x) ((((x) & 0xffffff) ^ 0x800000) - 0x800000) /* 26 bit */
+   %<bitfield>B         print Thumb branch destination (signed displacement)
+   %<bitfield>c         print bitfield as a condition code
+   %<bitnum>'c		print specified char iff bit is one
+   %<bitnum>?ab		print a if bit is one else print b.  */
 
-static struct thumb_opcode thumb_opcodes[] =
+static const struct opcode16 thumb_opcodes[] =
 {
   /* Thumb instructions.  */
 
+  /* ARM V6K no-argument instructions.  */
+  {ARM_EXT_V6K, 0xbf00, 0xffff, "nop%c"},
+  {ARM_EXT_V6K, 0xbf10, 0xffff, "yield%c"},
+  {ARM_EXT_V6K, 0xbf20, 0xffff, "wfe%c"},
+  {ARM_EXT_V6K, 0xbf30, 0xffff, "wfi%c"},
+  {ARM_EXT_V6K, 0xbf40, 0xffff, "sev%c"},
+  {ARM_EXT_V6K, 0xbf00, 0xff0f, "nop%c\t{%4-7d}"},
+
+  /* ARM V6T2 instructions.  */
+  {ARM_EXT_V6T2, 0xb900, 0xfd00, "cbnz\t%0-2r, %b%X"},
+  {ARM_EXT_V6T2, 0xb100, 0xfd00, "cbz\t%0-2r, %b%X"},
+  {ARM_EXT_V6T2, 0xbf00, 0xff00, "it%I%X"},
+
+  /* ARM V6.  */
+  {ARM_EXT_V6, 0xb660, 0xfff8, "cpsie\t%2'a%1'i%0'f%X"},
+  {ARM_EXT_V6, 0xb670, 0xfff8, "cpsid\t%2'a%1'i%0'f%X"},
+  {ARM_EXT_V6, 0x4600, 0xffc0, "mov%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xba00, 0xffc0, "rev%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xba40, 0xffc0, "rev16%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xbac0, 0xffc0, "revsh%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb650, 0xfff7, "setend\t%3?ble%X"},
+  {ARM_EXT_V6, 0xb200, 0xffc0, "sxth%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb240, 0xffc0, "sxtb%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb280, 0xffc0, "uxth%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb2c0, 0xffc0, "uxtb%c\t%0-2r, %3-5r"},
+
   /* ARM V5 ISA extends Thumb.  */
-  {0xbe00, 0xff00, "bkpt\t%0-7x"},
-  {0x4780, 0xff87, "blx\t%3-6r"},	/* note: 4 bit register number.  */
-  /* Note: this is BLX(2).  BLX(1) is done in arm-dis.c/print_insn_thumb()
-     as an extension of the special processing there for Thumb BL.
-     BL and BLX(1) involve 2 successive 16-bit instructions, which must
-     always appear together in the correct order.  So, the empty
-     string is put in this table, and the string interpreter takes <empty>
-     to mean it has a pair of BL-ish instructions.  */
-  {0x46C0, 0xFFFF, "nop\t\t\t(mov r8, r8)"},
-  /* Format 5 instructions do not update the PSR.  */
-  {0x1C00, 0xFFC0, "mov\t%0-2r, %3-5r\t\t(add %0-2r, %3-5r, #%6-8d)"},
+  {ARM_EXT_V5T, 0xbe00, 0xff00, "bkpt\t%0-7x"}, /* Is always unconditional.  */
+  /* This is BLX(2).  BLX(1) is a 32-bit instruction.  */
+  {ARM_EXT_V5T, 0x4780, 0xff87, "blx%c\t%3-6r%x"},	/* note: 4 bit register number.  */
+  /* ARM V4T ISA (Thumb v1).  */
+  {ARM_EXT_V4T, 0x46C0, 0xFFFF, "nop%c\t\t\t(mov r8, r8)"},
   /* Format 4.  */
-  {0x4000, 0xFFC0, "and\t%0-2r, %3-5r"},
-  {0x4040, 0xFFC0, "eor\t%0-2r, %3-5r"},
-  {0x4080, 0xFFC0, "lsl\t%0-2r, %3-5r"},
-  {0x40C0, 0xFFC0, "lsr\t%0-2r, %3-5r"},
-  {0x4100, 0xFFC0, "asr\t%0-2r, %3-5r"},
-  {0x4140, 0xFFC0, "adc\t%0-2r, %3-5r"},
-  {0x4180, 0xFFC0, "sbc\t%0-2r, %3-5r"},
-  {0x41C0, 0xFFC0, "ror\t%0-2r, %3-5r"},
-  {0x4200, 0xFFC0, "tst\t%0-2r, %3-5r"},
-  {0x4240, 0xFFC0, "neg\t%0-2r, %3-5r"},
-  {0x4280, 0xFFC0, "cmp\t%0-2r, %3-5r"},
-  {0x42C0, 0xFFC0, "cmn\t%0-2r, %3-5r"},
-  {0x4300, 0xFFC0, "orr\t%0-2r, %3-5r"},
-  {0x4340, 0xFFC0, "mul\t%0-2r, %3-5r"},
-  {0x4380, 0xFFC0, "bic\t%0-2r, %3-5r"},
-  {0x43C0, 0xFFC0, "mvn\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4000, 0xFFC0, "and%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4040, 0xFFC0, "eor%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4080, 0xFFC0, "lsl%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x40C0, 0xFFC0, "lsr%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4100, 0xFFC0, "asr%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4140, 0xFFC0, "adc%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4180, 0xFFC0, "sbc%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x41C0, 0xFFC0, "ror%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4200, 0xFFC0, "tst%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4240, 0xFFC0, "neg%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4280, 0xFFC0, "cmp%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x42C0, 0xFFC0, "cmn%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4300, 0xFFC0, "orr%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4340, 0xFFC0, "mul%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4380, 0xFFC0, "bic%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x43C0, 0xFFC0, "mvn%C\t%0-2r, %3-5r"},
   /* format 13 */
-  {0xB000, 0xFF80, "add\tsp, #%0-6W"},
-  {0xB080, 0xFF80, "sub\tsp, #%0-6W"},
+  {ARM_EXT_V4T, 0xB000, 0xFF80, "add%c\tsp, #%0-6W"},
+  {ARM_EXT_V4T, 0xB080, 0xFF80, "sub%c\tsp, #%0-6W"},
   /* format 5 */
-  {0x4700, 0xFF80, "bx\t%S"},
-  {0x4400, 0xFF00, "add\t%D, %S"},
-  {0x4500, 0xFF00, "cmp\t%D, %S"},
-  {0x4600, 0xFF00, "mov\t%D, %S"},
+  {ARM_EXT_V4T, 0x4700, 0xFF80, "bx%c\t%S%x"},
+  {ARM_EXT_V4T, 0x4400, 0xFF00, "add%c\t%D, %S"},
+  {ARM_EXT_V4T, 0x4500, 0xFF00, "cmp%c\t%D, %S"},
+  {ARM_EXT_V4T, 0x4600, 0xFF00, "mov%c\t%D, %S"},
   /* format 14 */
-  {0xB400, 0xFE00, "push\t%N"},
-  {0xBC00, 0xFE00, "pop\t%O"},
+  {ARM_EXT_V4T, 0xB400, 0xFE00, "push%c\t%N"},
+  {ARM_EXT_V4T, 0xBC00, 0xFE00, "pop%c\t%O"},
   /* format 2 */
-  {0x1800, 0xFE00, "add\t%0-2r, %3-5r, %6-8r"},
-  {0x1A00, 0xFE00, "sub\t%0-2r, %3-5r, %6-8r"},
-  {0x1C00, 0xFE00, "add\t%0-2r, %3-5r, #%6-8d"},
-  {0x1E00, 0xFE00, "sub\t%0-2r, %3-5r, #%6-8d"},
+  {ARM_EXT_V4T, 0x1800, 0xFE00, "add%C\t%0-2r, %3-5r, %6-8r"},
+  {ARM_EXT_V4T, 0x1A00, 0xFE00, "sub%C\t%0-2r, %3-5r, %6-8r"},
+  {ARM_EXT_V4T, 0x1C00, 0xFE00, "add%C\t%0-2r, %3-5r, #%6-8d"},
+  {ARM_EXT_V4T, 0x1E00, 0xFE00, "sub%C\t%0-2r, %3-5r, #%6-8d"},
   /* format 8 */
-  {0x5200, 0xFE00, "strh\t%0-2r, [%3-5r, %6-8r]"},
-  {0x5A00, 0xFE00, "ldrh\t%0-2r, [%3-5r, %6-8r]"},
-  {0x5600, 0xF600, "ldrs%11?hb\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5200, 0xFE00, "strh%c\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5A00, 0xFE00, "ldrh%c\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5600, 0xF600, "ldrs%11?hb%c\t%0-2r, [%3-5r, %6-8r]"},
   /* format 7 */
-  {0x5000, 0xFA00, "str%10'b\t%0-2r, [%3-5r, %6-8r]"},
-  {0x5800, 0xFA00, "ldr%10'b\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5000, 0xFA00, "str%10'b%c\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5800, 0xFA00, "ldr%10'b%c\t%0-2r, [%3-5r, %6-8r]"},
   /* format 1 */
-  {0x0000, 0xF800, "lsl\t%0-2r, %3-5r, #%6-10d"},
-  {0x0800, 0xF800, "lsr\t%0-2r, %3-5r, #%6-10d"},
-  {0x1000, 0xF800, "asr\t%0-2r, %3-5r, #%6-10d"},
+  {ARM_EXT_V4T, 0x0000, 0xF800, "lsl%C\t%0-2r, %3-5r, #%6-10d"},
+  {ARM_EXT_V4T, 0x0800, 0xF800, "lsr%C\t%0-2r, %3-5r, %s"},
+  {ARM_EXT_V4T, 0x1000, 0xF800, "asr%C\t%0-2r, %3-5r, %s"},
   /* format 3 */
-  {0x2000, 0xF800, "mov\t%8-10r, #%0-7d"},
-  {0x2800, 0xF800, "cmp\t%8-10r, #%0-7d"},
-  {0x3000, 0xF800, "add\t%8-10r, #%0-7d"},
-  {0x3800, 0xF800, "sub\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x2000, 0xF800, "mov%C\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x2800, 0xF800, "cmp%c\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x3000, 0xF800, "add%C\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x3800, 0xF800, "sub%C\t%8-10r, #%0-7d"},
   /* format 6 */
-  {0x4800, 0xF800, "ldr\t%8-10r, [pc, #%0-7W]\t(%0-7a)"},  /* TODO: Disassemble PC relative "LDR rD,=<symbolic>" */
+  {ARM_EXT_V4T, 0x4800, 0xF800, "ldr%c\t%8-10r, [pc, #%0-7W]\t(%0-7a)"},  /* TODO: Disassemble PC relative "LDR rD,=<symbolic>" */
   /* format 9 */
-  {0x6000, 0xF800, "str\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x6800, 0xF800, "ldr\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x7000, 0xF800, "strb\t%0-2r, [%3-5r, #%6-10d]"},
-  {0x7800, 0xF800, "ldrb\t%0-2r, [%3-5r, #%6-10d]"},
+  {ARM_EXT_V4T, 0x6000, 0xF800, "str%c\t%0-2r, [%3-5r, #%6-10W]"},
+  {ARM_EXT_V4T, 0x6800, 0xF800, "ldr%c\t%0-2r, [%3-5r, #%6-10W]"},
+  {ARM_EXT_V4T, 0x7000, 0xF800, "strb%c\t%0-2r, [%3-5r, #%6-10d]"},
+  {ARM_EXT_V4T, 0x7800, 0xF800, "ldrb%c\t%0-2r, [%3-5r, #%6-10d]"},
   /* format 10 */
-  {0x8000, 0xF800, "strh\t%0-2r, [%3-5r, #%6-10H]"},
-  {0x8800, 0xF800, "ldrh\t%0-2r, [%3-5r, #%6-10H]"},
+  {ARM_EXT_V4T, 0x8000, 0xF800, "strh%c\t%0-2r, [%3-5r, #%6-10H]"},
+  {ARM_EXT_V4T, 0x8800, 0xF800, "ldrh%c\t%0-2r, [%3-5r, #%6-10H]"},
   /* format 11 */
-  {0x9000, 0xF800, "str\t%8-10r, [sp, #%0-7W]"},
-  {0x9800, 0xF800, "ldr\t%8-10r, [sp, #%0-7W]"},
+  {ARM_EXT_V4T, 0x9000, 0xF800, "str%c\t%8-10r, [sp, #%0-7W]"},
+  {ARM_EXT_V4T, 0x9800, 0xF800, "ldr%c\t%8-10r, [sp, #%0-7W]"},
   /* format 12 */
-  {0xA000, 0xF800, "add\t%8-10r, pc, #%0-7W\t(adr %8-10r,%0-7a)"},
-  {0xA800, 0xF800, "add\t%8-10r, sp, #%0-7W"},
+  {ARM_EXT_V4T, 0xA000, 0xF800, "add%c\t%8-10r, pc, #%0-7W\t(adr %8-10r, %0-7a)"},
+  {ARM_EXT_V4T, 0xA800, 0xF800, "add%c\t%8-10r, sp, #%0-7W"},
   /* format 15 */
-  {0xC000, 0xF800, "stmia\t%8-10r!,%M"},
-  {0xC800, 0xF800, "ldmia\t%8-10r!,%M"},
-  /* format 18 */
-  {0xE000, 0xF800, "b\t%0-10B"},
-  {0xE800, 0xF800, "undefined"},
-  /* format 19 */
-  {0xF000, 0xF800, ""}, /* special processing required in disassembler */
-  {0xF800, 0xF800, "second half of BL instruction %0-15x"},
-  /* format 16 */
-  {0xD000, 0xFF00, "beq\t%0-7B"},
-  {0xD100, 0xFF00, "bne\t%0-7B"},
-  {0xD200, 0xFF00, "bcs\t%0-7B"},
-  {0xD300, 0xFF00, "bcc\t%0-7B"},
-  {0xD400, 0xFF00, "bmi\t%0-7B"},
-  {0xD500, 0xFF00, "bpl\t%0-7B"},
-  {0xD600, 0xFF00, "bvs\t%0-7B"},
-  {0xD700, 0xFF00, "bvc\t%0-7B"},
-  {0xD800, 0xFF00, "bhi\t%0-7B"},
-  {0xD900, 0xFF00, "bls\t%0-7B"},
-  {0xDA00, 0xFF00, "bge\t%0-7B"},
-  {0xDB00, 0xFF00, "blt\t%0-7B"},
-  {0xDC00, 0xFF00, "bgt\t%0-7B"},
-  {0xDD00, 0xFF00, "ble\t%0-7B"},
+  {ARM_EXT_V4T, 0xC000, 0xF800, "stmia%c\t%8-10r!, %M"},
+  {ARM_EXT_V4T, 0xC800, 0xF800, "ldmia%c\t%8-10r!, %M"},
   /* format 17 */
-  {0xDE00, 0xFF00, "bal\t%0-7B"},
-  {0xDF00, 0xFF00, "swi\t%0-7d"},
-  /* format 9 */
-  {0x6000, 0xF800, "str\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x6800, 0xF800, "ldr\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x7000, 0xF800, "strb\t%0-2r, [%3-5r, #%6-10d]"},
-  {0x7800, 0xF800, "ldrb\t%0-2r, [%3-5r, #%6-10d]"},
-  /* the rest */
-  {0x0000, 0x0000, "undefined instruction %0-15x"},
-  {0x0000, 0x0000, 0}
+  {ARM_EXT_V4T, 0xDF00, 0xFF00, "svc%c\t%0-7d"},
+  /* format 16 */
+  {ARM_EXT_V4T, 0xDE00, 0xFE00, "undefined"},
+  {ARM_EXT_V4T, 0xD000, 0xF000, "b%8-11c.n\t%0-7B%X"},
+  /* format 18 */
+  {ARM_EXT_V4T, 0xE000, 0xF800, "b%c.n\t%0-10B%x"},
+
+  /* The E800 .. FFFF range is unconditionally redirected to the
+     32-bit table, because even in pre-V6T2 ISAs, BL and BLX(1) pairs
+     are processed via that table.  Thus, we can never encounter a
+     bare "second half of BL/BLX(1)" instruction here.  */
+  {ARM_EXT_V1,  0x0000, 0x0000, "undefined"},
+  {0, 0, 0, 0}
 };
 
-#define BDISP23(x) ((((((x) & 0x07ff) << 11) | (((x) & 0x07ff0000) >> 16)) \
-                     ^ 0x200000) - 0x200000) /* 23bit */
-
-#ifndef streq
-#define streq(a,b)	(strcmp ((a), (b)) == 0)
-#endif
+/* Thumb32 opcodes use the same table structure as the ARM opcodes.
+   We adopt the convention that hw1 is the high 16 bits of .value and
+   .mask, hw2 the low 16 bits.
+
+   print_insn_thumb32 recognizes the following format control codes:
+
+       %%		%
+
+       %I		print a 12-bit immediate from hw1[10],hw2[14:12,7:0]
+       %M		print a modified 12-bit immediate (same location)
+       %J		print a 16-bit immediate from hw1[3:0,10],hw2[14:12,7:0]
+       %K		print a 16-bit immediate from hw2[3:0],hw1[3:0],hw2[11:4]
+       %S		print a possibly-shifted Rm
+
+       %a		print the address of a plain load/store
+       %w		print the width and signedness of a core load/store
+       %m		print register mask for ldm/stm
+
+       %E		print the lsb and width fields of a bfc/bfi instruction
+       %F		print the lsb and width fields of a sbfx/ubfx instruction
+       %b		print a conditional branch offset
+       %B		print an unconditional branch offset
+       %s		print the shift field of an SSAT instruction
+       %R		print the rotation field of an SXT instruction
+       %U		print barrier type.
+       %P		print address for pli instruction.
+       %c		print the condition code
+       %x		print warning if conditional an not at end of IT block"
+       %X		print "\t; unpredictable <IT:code>" if conditional
+
+       %<bitfield>d	print bitfield in decimal
+       %<bitfield>W	print bitfield*4 in decimal
+       %<bitfield>r	print bitfield as an ARM register
+       %<bitfield>c	print bitfield as a condition code
+
+       %<bitfield>'c	print specified char iff bitfield is all ones
+       %<bitfield>`c	print specified char iff bitfield is all zeroes
+       %<bitfield>?ab... select from array of values in big endian order
+
+   With one exception at the bottom (done because BL and BLX(1) need
+   to come dead last), this table was machine-sorted first in
+   decreasing order of number of bits set in the mask, then in
+   increasing numeric order of mask, then in increasing numeric order
+   of opcode.  This order is not the clearest for a human reader, but
+   is guaranteed never to catch a special-case bit pattern with a more
+   general mask, which is important, because this instruction encoding
+   makes heavy use of special-case bit patterns.  */
+static const struct opcode32 thumb32_opcodes[] =
+{
+  /* V7 instructions.  */
+  {ARM_EXT_V7, 0xf910f000, 0xff70f000, "pli%c\t%a"},
+  {ARM_EXT_V7, 0xf3af80f0, 0xfffffff0, "dbg%c\t#%0-3d"},
+  {ARM_EXT_V7, 0xf3bf8f50, 0xfffffff0, "dmb%c\t%U"},
+  {ARM_EXT_V7, 0xf3bf8f40, 0xfffffff0, "dsb%c\t%U"},
+  {ARM_EXT_V7, 0xf3bf8f60, 0xfffffff0, "isb%c\t%U"},
+  {ARM_EXT_DIV, 0xfb90f0f0, 0xfff0f0f0, "sdiv%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_DIV, 0xfbb0f0f0, 0xfff0f0f0, "udiv%c\t%8-11r, %16-19r, %0-3r"},
+
+  /* Instructions defined in the basic V6T2 set.  */
+  {ARM_EXT_V6T2, 0xf3af8000, 0xffffffff, "nop%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8001, 0xffffffff, "yield%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8002, 0xffffffff, "wfe%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8003, 0xffffffff, "wfi%c.w"},
+  {ARM_EXT_V6T2, 0xf3af9004, 0xffffffff, "sev%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8000, 0xffffff00, "nop%c.w\t{%0-7d}"},
+
+  {ARM_EXT_V6T2, 0xf3bf8f2f, 0xffffffff, "clrex%c"},
+  {ARM_EXT_V6T2, 0xf3af8400, 0xffffff1f, "cpsie.w\t%7'a%6'i%5'f%X"},
+  {ARM_EXT_V6T2, 0xf3af8600, 0xffffff1f, "cpsid.w\t%7'a%6'i%5'f%X"},
+  {ARM_EXT_V6T2, 0xf3c08f00, 0xfff0ffff, "bxj%c\t%16-19r%x"},
+  {ARM_EXT_V6T2, 0xe810c000, 0xffd0ffff, "rfedb%c\t%16-19r%21'!"},
+  {ARM_EXT_V6T2, 0xe990c000, 0xffd0ffff, "rfeia%c\t%16-19r%21'!"},
+  {ARM_EXT_V6T2, 0xf3ef8000, 0xffeff000, "mrs%c\t%8-11r, %D"},
+  {ARM_EXT_V6T2, 0xf3af8100, 0xffffffe0, "cps\t#%0-4d%X"},
+  {ARM_EXT_V6T2, 0xe8d0f000, 0xfff0fff0, "tbb%c\t[%16-19r, %0-3r]%x"},
+  {ARM_EXT_V6T2, 0xe8d0f010, 0xfff0fff0, "tbh%c\t[%16-19r, %0-3r, lsl #1]%x"},
+  {ARM_EXT_V6T2, 0xf3af8500, 0xffffff00, "cpsie\t%7'a%6'i%5'f, #%0-4d%X"},
+  {ARM_EXT_V6T2, 0xf3af8700, 0xffffff00, "cpsid\t%7'a%6'i%5'f, #%0-4d%X"},
+  {ARM_EXT_V6T2, 0xf3de8f00, 0xffffff00, "subs%c\tpc, lr, #%0-7d"},
+  {ARM_EXT_V6T2, 0xf3808000, 0xffe0f000, "msr%c\t%C, %16-19r"},
+  {ARM_EXT_V6T2, 0xe8500f00, 0xfff00fff, "ldrex%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe8d00f4f, 0xfff00fef, "ldrex%4?hb%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe800c000, 0xffd0ffe0, "srsdb%c\t%16-19r%21'!, #%0-4d"},
+  {ARM_EXT_V6T2, 0xe980c000, 0xffd0ffe0, "srsia%c\t%16-19r%21'!, #%0-4d"},
+  {ARM_EXT_V6T2, 0xfa0ff080, 0xfffff0c0, "sxth%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa1ff080, 0xfffff0c0, "uxth%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa2ff080, 0xfffff0c0, "sxtb16%c\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa3ff080, 0xfffff0c0, "uxtb16%c\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa4ff080, 0xfffff0c0, "sxtb%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa5ff080, 0xfffff0c0, "uxtb%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xe8400000, 0xfff000ff, "strex%c\t%8-11r, %12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe8d0007f, 0xfff000ff, "ldrexd%c\t%12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xfa80f000, 0xfff0f0f0, "sadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f010, 0xfff0f0f0, "qadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f020, 0xfff0f0f0, "shadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f040, 0xfff0f0f0, "uadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f050, 0xfff0f0f0, "uqadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f060, 0xfff0f0f0, "uhadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f080, 0xfff0f0f0, "qadd%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa80f090, 0xfff0f0f0, "qdadd%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa80f0a0, 0xfff0f0f0, "qsub%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa80f0b0, 0xfff0f0f0, "qdsub%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f000, 0xfff0f0f0, "sadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f010, 0xfff0f0f0, "qadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f020, 0xfff0f0f0, "shadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f040, 0xfff0f0f0, "uadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f050, 0xfff0f0f0, "uqadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f060, 0xfff0f0f0, "uhadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f080, 0xfff0f0f0, "rev%c.w\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f090, 0xfff0f0f0, "rev16%c.w\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f0a0, 0xfff0f0f0, "rbit%c\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f0b0, 0xfff0f0f0, "revsh%c.w\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfaa0f000, 0xfff0f0f0, "saddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f010, 0xfff0f0f0, "qaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f020, 0xfff0f0f0, "shaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f040, 0xfff0f0f0, "uaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f050, 0xfff0f0f0, "uqaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f060, 0xfff0f0f0, "uhaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f080, 0xfff0f0f0, "sel%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfab0f080, 0xfff0f0f0, "clz%c\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfac0f000, 0xfff0f0f0, "ssub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f010, 0xfff0f0f0, "qsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f020, 0xfff0f0f0, "shsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f040, 0xfff0f0f0, "usub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f050, 0xfff0f0f0, "uqsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f060, 0xfff0f0f0, "uhsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f000, 0xfff0f0f0, "ssub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f010, 0xfff0f0f0, "qsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f020, 0xfff0f0f0, "shsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f040, 0xfff0f0f0, "usub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f050, 0xfff0f0f0, "uqsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f060, 0xfff0f0f0, "uhsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f000, 0xfff0f0f0, "ssubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f010, 0xfff0f0f0, "qsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f020, 0xfff0f0f0, "shsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f040, 0xfff0f0f0, "usubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f050, 0xfff0f0f0, "uqsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f060, 0xfff0f0f0, "uhsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb00f000, 0xfff0f0f0, "mul%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb70f000, 0xfff0f0f0, "usad8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa00f000, 0xffe0f0f0, "lsl%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa20f000, 0xffe0f0f0, "lsr%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa40f000, 0xffe0f0f0, "asr%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa60f000, 0xffe0f0f0, "ror%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xe8c00f40, 0xfff00fe0, "strex%4?hb%c\t%0-3r, %12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xf3200000, 0xfff0f0e0, "ssat16%c\t%8-11r, #%0-4d, %16-19r"},
+  {ARM_EXT_V6T2, 0xf3a00000, 0xfff0f0e0, "usat16%c\t%8-11r, #%0-4d, %16-19r"},
+  {ARM_EXT_V6T2, 0xfb20f000, 0xfff0f0e0, "smuad%4'x%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb30f000, 0xfff0f0e0, "smulw%4?tb%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb40f000, 0xfff0f0e0, "smusd%4'x%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb50f000, 0xfff0f0e0, "smmul%4'r%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa00f080, 0xfff0f0c0, "sxtah%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa10f080, 0xfff0f0c0, "uxtah%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa20f080, 0xfff0f0c0, "sxtab16%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa30f080, 0xfff0f0c0, "uxtab16%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa40f080, 0xfff0f0c0, "sxtab%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa50f080, 0xfff0f0c0, "uxtab%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfb10f000, 0xfff0f0c0, "smul%5?tb%4?tb%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xf36f0000, 0xffff8020, "bfc%c\t%8-11r, %E"},
+  {ARM_EXT_V6T2, 0xea100f00, 0xfff08f00, "tst%c.w\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea900f00, 0xfff08f00, "teq%c\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb100f00, 0xfff08f00, "cmn%c.w\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xebb00f00, 0xfff08f00, "cmp%c.w\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xf0100f00, 0xfbf08f00, "tst%c.w\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0900f00, 0xfbf08f00, "teq%c\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1100f00, 0xfbf08f00, "cmn%c.w\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1b00f00, 0xfbf08f00, "cmp%c.w\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xea4f0000, 0xffef8000, "mov%20's%c.w\t%8-11r, %S"},
+  {ARM_EXT_V6T2, 0xea6f0000, 0xffef8000, "mvn%20's%c.w\t%8-11r, %S"},
+  {ARM_EXT_V6T2, 0xe8c00070, 0xfff000f0, "strexd%c\t%0-3r, %12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xfb000000, 0xfff000f0, "mla%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb000010, 0xfff000f0, "mls%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb700000, 0xfff000f0, "usada8%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb800000, 0xfff000f0, "smull%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfba00000, 0xfff000f0, "umull%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbc00000, 0xfff000f0, "smlal%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbe00000, 0xfff000f0, "umlal%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbe00060, 0xfff000f0, "umaal%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xe8500f00, 0xfff00f00, "ldrex%c\t%12-15r, [%16-19r, #%0-7W]"},
+  {ARM_EXT_V6T2, 0xf7f08000, 0xfff0f000, "smc%c\t%K"},
+  {ARM_EXT_V6T2, 0xf04f0000, 0xfbef8000, "mov%20's%c.w\t%8-11r, %M"},
+  {ARM_EXT_V6T2, 0xf06f0000, 0xfbef8000, "mvn%20's%c.w\t%8-11r, %M"},
+  {ARM_EXT_V6T2, 0xf810f000, 0xff70f000, "pld%c\t%a"},
+  {ARM_EXT_V6T2, 0xfb200000, 0xfff000e0, "smlad%4'x%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb300000, 0xfff000e0, "smlaw%4?tb%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb400000, 0xfff000e0, "smlsd%4'x%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb500000, 0xfff000e0, "smmla%4'r%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb600000, 0xfff000e0, "smmls%4'r%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfbc000c0, 0xfff000e0, "smlald%4'x%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbd000c0, 0xfff000e0, "smlsld%4'x%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xeac00000, 0xfff08030, "pkhbt%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeac00020, 0xfff08030, "pkhtb%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xf3400000, 0xfff08020, "sbfx%c\t%8-11r, %16-19r, %F"},
+  {ARM_EXT_V6T2, 0xf3c00000, 0xfff08020, "ubfx%c\t%8-11r, %16-19r, %F"},
+  {ARM_EXT_V6T2, 0xf8000e00, 0xff900f00, "str%wt%c\t%12-15r, %a"},
+  {ARM_EXT_V6T2, 0xfb100000, 0xfff000c0, "smla%5?tb%4?tb%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfbc00080, 0xfff000c0, "smlal%5?tb%4?tb%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xf3600000, 0xfff08020, "bfi%c\t%8-11r, %16-19r, %E"},
+  {ARM_EXT_V6T2, 0xf8100e00, 0xfe900f00, "ldr%wt%c\t%12-15r, %a"},
+  {ARM_EXT_V6T2, 0xf3000000, 0xffd08020, "ssat%c\t%8-11r, #%0-4d, %16-19r%s"},
+  {ARM_EXT_V6T2, 0xf3800000, 0xffd08020, "usat%c\t%8-11r, #%0-4d, %16-19r%s"},
+  {ARM_EXT_V6T2, 0xf2000000, 0xfbf08000, "addw%c\t%8-11r, %16-19r, %I"},
+  {ARM_EXT_V6T2, 0xf2400000, 0xfbf08000, "movw%c\t%8-11r, %J"},
+  {ARM_EXT_V6T2, 0xf2a00000, 0xfbf08000, "subw%c\t%8-11r, %16-19r, %I"},
+  {ARM_EXT_V6T2, 0xf2c00000, 0xfbf08000, "movt%c\t%8-11r, %J"},
+  {ARM_EXT_V6T2, 0xea000000, 0xffe08000, "and%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea200000, 0xffe08000, "bic%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea400000, 0xffe08000, "orr%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea600000, 0xffe08000, "orn%20's%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea800000, 0xffe08000, "eor%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb000000, 0xffe08000, "add%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb400000, 0xffe08000, "adc%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb600000, 0xffe08000, "sbc%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeba00000, 0xffe08000, "sub%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xebc00000, 0xffe08000, "rsb%20's%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xe8400000, 0xfff00000, "strex%c\t%8-11r, %12-15r, [%16-19r, #%0-7W]"},
+  {ARM_EXT_V6T2, 0xf0000000, 0xfbe08000, "and%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0200000, 0xfbe08000, "bic%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0400000, 0xfbe08000, "orr%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0600000, 0xfbe08000, "orn%20's%c\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0800000, 0xfbe08000, "eor%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1000000, 0xfbe08000, "add%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1400000, 0xfbe08000, "adc%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1600000, 0xfbe08000, "sbc%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1a00000, 0xfbe08000, "sub%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1c00000, 0xfbe08000, "rsb%20's%c\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xe8800000, 0xffd00000, "stmia%c.w\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe8900000, 0xffd00000, "ldmia%c.w\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe9000000, 0xffd00000, "stmdb%c\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe9100000, 0xffd00000, "ldmdb%c\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe9c00000, 0xffd000ff, "strd%c\t%12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe9d00000, 0xffd000ff, "ldrd%c\t%12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe9400000, 0xff500000, "strd%c\t%12-15r, %8-11r, [%16-19r, #%23`-%0-7W]%21'!"},
+  {ARM_EXT_V6T2, 0xe9500000, 0xff500000, "ldrd%c\t%12-15r, %8-11r, [%16-19r, #%23`-%0-7W]%21'!"},
+  {ARM_EXT_V6T2, 0xe8600000, 0xff700000, "strd%c\t%12-15r, %8-11r, [%16-19r], #%23`-%0-7W"},
+  {ARM_EXT_V6T2, 0xe8700000, 0xff700000, "ldrd%c\t%12-15r, %8-11r, [%16-19r], #%23`-%0-7W"},
+  {ARM_EXT_V6T2, 0xf8000000, 0xff100000, "str%w%c.w\t%12-15r, %a"},
+  {ARM_EXT_V6T2, 0xf8100000, 0xfe100000, "ldr%w%c.w\t%12-15r, %a"},
+
+  /* Filter out Bcc with cond=E or F, which are used for other instructions.  */
+  {ARM_EXT_V6T2, 0xf3c08000, 0xfbc0d000, "undefined (bcc, cond=0xF)"},
+  {ARM_EXT_V6T2, 0xf3808000, 0xfbc0d000, "undefined (bcc, cond=0xE)"},
+  {ARM_EXT_V6T2, 0xf0008000, 0xf800d000, "b%22-25c.w\t%b%X"},
+  {ARM_EXT_V6T2, 0xf0009000, 0xf800d000, "b%c.w\t%B%x"},
+
+  /* These have been 32-bit since the invention of Thumb.  */
+  {ARM_EXT_V4T,  0xf000c000, 0xf800d000, "blx%c\t%B%x"},
+  {ARM_EXT_V4T,  0xf000d000, 0xf800d000, "bl%c\t%B%x"},
+
+  /* Fallback.  */
+  {ARM_EXT_V1,   0x00000000, 0x00000000, "undefined"},
+  {0, 0, 0, 0}
+};
 
-#ifndef strneq
-#define strneq(a,b,n)	(strncmp ((a), (b), (n)) == 0)
-#endif
+static const char *const arm_conditional[] =
+{"eq", "ne", "cs", "cc", "mi", "pl", "vs", "vc",
+ "hi", "ls", "ge", "lt", "gt", "le", "al", "<und>", ""};
 
-#ifndef NUM_ELEM
-#define NUM_ELEM(a)     (sizeof (a) / sizeof (a)[0])
-#endif
+static const char *const arm_fp_const[] =
+{"0.0", "1.0", "2.0", "3.0", "4.0", "5.0", "0.5", "10.0"};
 
-static char * arm_conditional[] =
-{"eq", "ne", "cs", "cc", "mi", "pl", "vs", "vc",
- "hi", "ls", "ge", "lt", "gt", "le", "", "nv"};
+static const char *const arm_shift[] =
+{"lsl", "lsr", "asr", "ror"};
 
 typedef struct
 {
-  const char * name;
-  const char * description;
-  const char * reg_names[16];
+  const char *name;
+  const char *description;
+  const char *reg_names[16];
 }
 arm_regname;
 
-static arm_regname regnames[] =
+static const arm_regname regnames[] =
 {
   { "raw" , "Select raw register names",
     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"}},
@@ -557,44 +1503,67 @@ static arm_regname regnames[] =
   { "atpcs", "Select register names used in the ATPCS",
     { "a1", "a2", "a3", "a4", "v1", "v2", "v3", "v4", "v5", "v6", "v7",  "v8",  "IP",  "SP",  "LR",  "PC" }},
   { "special-atpcs", "Select special register names used in the ATPCS",
-    { "a1", "a2", "a3", "a4", "v1", "v2", "v3", "WR", "v5", "SB", "SL",  "FP",  "IP",  "SP",  "LR",  "PC" }}
+    { "a1", "a2", "a3", "a4", "v1", "v2", "v3", "WR", "v5", "SB", "SL",  "FP",  "IP",  "SP",  "LR",  "PC" }},
 };
 
-/* Default to STD register name set.  */
-static unsigned int regname_selected = 2;
+static const char *const iwmmxt_wwnames[] =
+{"b", "h", "w", "d"};
+
+static const char *const iwmmxt_wwssnames[] =
+{"b", "bus", "bc", "bss",
+ "h", "hus", "hc", "hss",
+ "w", "wus", "wc", "wss",
+ "d", "dus", "dc", "dss"
+};
+
+static const char *const iwmmxt_regnames[] =
+{ "wr0", "wr1", "wr2", "wr3", "wr4", "wr5", "wr6", "wr7",
+  "wr8", "wr9", "wr10", "wr11", "wr12", "wr13", "wr14", "wr15"
+};
+
+static const char *const iwmmxt_cregnames[] =
+{ "wcid", "wcon", "wcssf", "wcasf", "reserved", "reserved", "reserved", "reserved",
+  "wcgr0", "wcgr1", "wcgr2", "wcgr3", "reserved", "reserved", "reserved", "reserved"
+};
+
+/* Default to GCC register name set.  */
+static unsigned int regname_selected = 1;
 
 #define NUM_ARM_REGNAMES  NUM_ELEM (regnames)
 #define arm_regnames      regnames[regname_selected].reg_names
 
-static boolean force_thumb = false;
+static bfd_boolean force_thumb = FALSE;
+
+/* Current IT instruction state.  This contains the same state as the IT
+   bits in the CPSR.  */
+static unsigned int ifthen_state;
+/* IT state for the next instruction.  */
+static unsigned int ifthen_next_state;
+/* The address of the insn for which the IT state is valid.  */
+static bfd_vma ifthen_address;
+#define IFTHEN_COND ((ifthen_state >> 4) & 0xf)
+
+/* Cached mapping symbol state.  */
+enum map_type {
+  MAP_ARM,
+  MAP_THUMB,
+  MAP_DATA
+};
 
-static char * arm_fp_const[] =
-{"0.0", "1.0", "2.0", "3.0", "4.0", "5.0", "0.5", "10.0"};
+enum map_type last_type;
+int last_mapping_sym = -1;
+bfd_vma last_mapping_addr = 0;
 
-static char * arm_shift[] = 
-{"lsl", "lsr", "asr", "ror"};
-
-/* Forward declarations.  */
-static void arm_decode_shift PARAMS ((long, fprintf_ftype, void *));
-static int  print_insn_arm1 PARAMS ((bfd_vma, struct disassemble_info *, long));
-static int  print_insn_thumb PARAMS ((bfd_vma, struct disassemble_info *, long));
-static void parse_disassembler_options PARAMS ((char *));
-int get_arm_regname_num_options (void);
-int set_arm_regname_option (int option);
-int get_arm_regnames (int option, const char **setname,
-		      const char **setdescription,
-		      const char ***register_names);
 
 /* Functions.  */
 int
-get_arm_regname_num_options ()
+get_arm_regname_num_options (void)
 {
   return NUM_ARM_REGNAMES;
 }
 
 int
-set_arm_regname_option (option)
-     int option;
+set_arm_regname_option (int option)
 {
   int old = regname_selected;
   regname_selected = option;
@@ -602,11 +1571,8 @@ set_arm_regname_option (option)
 }
 
 int
-get_arm_regnames (option, setname, setdescription, register_names)
-     int option;
-     const char **setname;
-     const char **setdescription;
-     const char ***register_names;
+get_arm_regnames (int option, const char **setname, const char **setdescription,
+		  const char *const **register_names)
 {
   *setname = regnames[option].name;
   *setdescription = regnames[option].description;
@@ -614,21 +1580,56 @@ get_arm_regnames (option, setname, setdescription, register_names)
   return 16;
 }
 
+/* Decode a bitfield of the form matching regexp (N(-N)?,)*N(-N)?.
+   Returns pointer to following character of the format string and
+   fills in *VALUEP and *WIDTHP with the extracted value and number of
+   bits extracted.  WIDTHP can be NULL. */
+
+static const char *
+arm_decode_bitfield (const char *ptr, unsigned long insn,
+		     unsigned long *valuep, int *widthp)
+{
+  unsigned long value = 0;
+  int width = 0;
+
+  do
+    {
+      int start, end;
+      int bits;
+
+      for (start = 0; *ptr >= '0' && *ptr <= '9'; ptr++)
+	start = start * 10 + *ptr - '0';
+      if (*ptr == '-')
+	for (end = 0, ptr++; *ptr >= '0' && *ptr <= '9'; ptr++)
+	  end = end * 10 + *ptr - '0';
+      else
+	end = start;
+      bits = end - start;
+      if (bits < 0)
+	abort ();
+      value |= ((insn >> start) & ((2ul << bits) - 1)) << width;
+      width += bits + 1;
+    }
+  while (*ptr++ == ',');
+  *valuep = value;
+  if (widthp)
+    *widthp = width;
+  return ptr - 1;
+}
+
 static void
-arm_decode_shift (given, func, stream)
-     long given;
-     fprintf_ftype func;
-     void * stream;
+arm_decode_shift (long given, fprintf_ftype func, void *stream,
+		  int print_shift)
 {
   func (stream, "%s", arm_regnames[given & 0xf]);
-  
+
   if ((given & 0xff0) != 0)
     {
       if ((given & 0x10) == 0)
 	{
 	  int amount = (given & 0xf80) >> 7;
 	  int shift = (given & 0x60) >> 5;
-	  
+
 	  if (amount == 0)
 	    {
 	      if (shift == 3)
@@ -636,37 +1637,80 @@ arm_decode_shift (given, func, stream)
 		  func (stream, ", rrx");
 		  return;
 		}
-	      
+
 	      amount = 32;
 	    }
-	  
-	  func (stream, ", %s #%d", arm_shift[shift], amount);
+
+	  if (print_shift)
+	    func (stream, ", %s #%d", arm_shift[shift], amount);
+	  else
+	    func (stream, ", #%d", amount);
 	}
-      else
+      else if (print_shift)
 	func (stream, ", %s %s", arm_shift[(given & 0x60) >> 5],
 	      arm_regnames[(given & 0xf00) >> 8]);
+      else
+	func (stream, ", %s", arm_regnames[(given & 0xf00) >> 8]);
     }
 }
 
-/* Print one instruction from PC on INFO->STREAM.
-   Return the size of the instruction (always 4 on ARM). */
+/* Print one coprocessor instruction on INFO->STREAM.
+   Return TRUE if the instuction matched, FALSE if this is not a
+   recognised coprocessor instruction.  */
 
-static int
-print_insn_arm1 (pc, info, given)
-     bfd_vma                   pc;
-     struct disassemble_info * info;
-     long                      given;
+static bfd_boolean
+print_insn_coprocessor (bfd_vma pc, struct disassemble_info *info, long given,
+			bfd_boolean thumb)
 {
-  struct arm_opcode *  insn;
-  void *               stream = info->stream;
-  fprintf_ftype        func   = info->fprintf_func;
-
-  for (insn = arm_opcodes; insn->assembler; insn++)
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+  unsigned long mask;
+  unsigned long value;
+  int cond;
+
+  for (insn = coprocessor_opcodes; insn->assembler; insn++)
     {
-      if ((given & insn->mask) == insn->value)
+      if (insn->value == FIRST_IWMMXT_INSN
+	  && info->mach != bfd_mach_arm_XScale
+	  && info->mach != bfd_mach_arm_iWMMXt
+	  && info->mach != bfd_mach_arm_iWMMXt2)
+	insn = insn + IWMMXT_INSN_COUNT;
+
+      mask = insn->mask;
+      value = insn->value;
+      if (thumb)
+	{
+	  /* The high 4 bits are 0xe for Arm conditional instructions, and
+	     0xe for arm unconditional instructions.  The rest of the
+	     encoding is the same.  */
+	  mask |= 0xf0000000;
+	  value |= 0xe0000000;
+	  if (ifthen_state)
+	    cond = IFTHEN_COND;
+	  else
+	    cond = 16;
+	}
+      else
+	{
+	  /* Only match unconditional instuctions against unconditional
+	     patterns.  */
+	  if ((given & 0xf0000000) == 0xf0000000)
+	    {
+	      mask |= 0xf0000000;
+	      cond = 16;
+	    }
+	  else
+	    {
+	      cond = (given >> 28) & 0xf;
+	      if (cond == 0xe)
+		cond = 16;
+	    }
+	}
+      if ((given & mask) == value)
 	{
-	  char * c;
-	  
+	  const char *c;
+
 	  for (c = insn->assembler; *c; c++)
 	    {
 	      if (*c == '%')
@@ -677,89 +1721,1038 @@ print_insn_arm1 (pc, info, given)
 		      func (stream, "%%");
 		      break;
 
-		    case 'a':
-		      if (((given & 0x000f0000) == 0x000f0000)
-			  && ((given & 0x02000000) == 0))
+		    case 'A':
+		      func (stream, "[%s", arm_regnames [(given >> 16) & 0xf]);
+
+		      if ((given & (1 << 24)) != 0)
 			{
-			  int offset = given & 0xfff;
-			  
-			  func (stream, "[pc");
- 
-			  if (given & 0x01000000)
+			  int offset = given & 0xff;
+
+			  if (offset)
+			    func (stream, ", #%s%d]%s",
+				  ((given & 0x00800000) == 0 ? "-" : ""),
+				  offset * 4,
+				  ((given & 0x00200000) != 0 ? "!" : ""));
+			  else
+			    func (stream, "]");
+			}
+		      else
+			{
+			  int offset = given & 0xff;
+
+			  func (stream, "]");
+
+			  if (given & (1 << 21))
 			    {
-			      if ((given & 0x00800000) == 0)
-				offset = - offset;
-			  
-			      /* Pre-indexed.  */
-			      func (stream, ", #%d]", offset);
-
-			      offset += pc + 8;
-
-			      /* Cope with the possibility of write-back
-				 being used.  Probably a very dangerous thing
-				 for the programmer to do, but who are we to
-				 argue ?  */
-			      if (given & 0x00200000)
-				func (stream, "!");
+			      if (offset)
+				func (stream, ", #%s%d",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * 4);
 			    }
 			  else
-			    {
-			      /* Post indexed.  */
-			      func (stream, "], #%d", offset);
+			    func (stream, ", {%d}", offset);
+			}
+		      break;
 
-			      /* ie ignore the offset.  */
-			      offset = pc + 8;
-			    }
-			  
-			  func (stream, "\t; ");
-			  info->print_address_func (offset, info);
+		    case 'B':
+		      {
+			int regno = ((given >> 12) & 0xf) | ((given >> (22 - 4)) & 0x10);
+			int offset = (given >> 1) & 0x3f;
+
+			if (offset == 1)
+			  func (stream, "{d%d}", regno);
+			else if (regno + offset > 32)
+			  func (stream, "{d%d-<overflow reg d%d>}", regno, regno + offset - 1);
+			else
+			  func (stream, "{d%d-d%d}", regno, regno + offset - 1);
+		      }
+		      break;
+
+		    case 'C':
+		      {
+			int rn = (given >> 16) & 0xf;
+			int offset = (given & 0xff) * 4;
+			int add = (given >> 23) & 1;
+
+			func (stream, "[%s", arm_regnames[rn]);
+
+			if (offset)
+			  {
+			    if (!add)
+			      offset = -offset;
+			    func (stream, ", #%d", offset);
+			  }
+			func (stream, "]");
+			if (rn == 15)
+			  {
+			    func (stream, "\t; ");
+                            /* FIXME: Unsure if info->bytes_per_chunk is the
+                               right thing to use here.  */
+			    info->print_address_func (offset + pc
+                              + info->bytes_per_chunk * 2, info);
+			  }
+		      }
+		      break;
+
+		    case 'c':
+		      func (stream, "%s", arm_conditional[cond]);
+		      break;
+
+		    case 'I':
+		      /* Print a Cirrus/DSP shift immediate.  */
+		      /* Immediates are 7bit signed ints with bits 0..3 in
+			 bits 0..3 of opcode and bits 4..6 in bits 5..7
+			 of opcode.  */
+		      {
+			int imm;
+
+			imm = (given & 0xf) | ((given & 0xe0) >> 1);
+
+			/* Is ``imm'' a negative number?  */
+			if (imm & 0x40)
+			  imm |= (-1 << 7);
+
+			func (stream, "%d", imm);
+		      }
+
+		      break;
+
+		    case 'F':
+		      switch (given & 0x00408000)
+			{
+			case 0:
+			  func (stream, "4");
+			  break;
+			case 0x8000:
+			  func (stream, "1");
+			  break;
+			case 0x00400000:
+			  func (stream, "2");
+			  break;
+			default:
+			  func (stream, "3");
 			}
-		      else
+		      break;
+
+		    case 'P':
+		      switch (given & 0x00080080)
 			{
-			  func (stream, "[%s", 
-				arm_regnames[(given >> 16) & 0xf]);
-			  if ((given & 0x01000000) != 0)
+			case 0:
+			  func (stream, "s");
+			  break;
+			case 0x80:
+			  func (stream, "d");
+			  break;
+			case 0x00080000:
+			  func (stream, "e");
+			  break;
+			default:
+			  func (stream, _("<illegal precision>"));
+			  break;
+			}
+		      break;
+		    case 'Q':
+		      switch (given & 0x00408000)
+			{
+			case 0:
+			  func (stream, "s");
+			  break;
+			case 0x8000:
+			  func (stream, "d");
+			  break;
+			case 0x00400000:
+			  func (stream, "e");
+			  break;
+			default:
+			  func (stream, "p");
+			  break;
+			}
+		      break;
+		    case 'R':
+		      switch (given & 0x60)
+			{
+			case 0:
+			  break;
+			case 0x20:
+			  func (stream, "p");
+			  break;
+			case 0x40:
+			  func (stream, "m");
+			  break;
+			default:
+			  func (stream, "z");
+			  break;
+			}
+		      break;
+
+		    case '0': case '1': case '2': case '3': case '4':
+		    case '5': case '6': case '7': case '8': case '9':
+		      {
+			int width;
+			unsigned long value;
+
+			c = arm_decode_bitfield (c, given, &value, &width);
+
+			switch (*c)
+			  {
+			  case 'r':
+			    func (stream, "%s", arm_regnames[value]);
+			    break;
+			  case 'D':
+			    func (stream, "d%ld", value);
+			    break;
+			  case 'Q':
+			    if (value & 1)
+			      func (stream, "<illegal reg q%ld.5>", value >> 1);
+			    else
+			      func (stream, "q%ld", value >> 1);
+			    break;
+			  case 'd':
+			    func (stream, "%ld", value);
+			    break;
+                          case 'k':
+                            {
+                              int from = (given & (1 << 7)) ? 32 : 16;
+                              func (stream, "%ld", from - value);
+                            }
+                            break;
+
+			  case 'f':
+			    if (value > 7)
+			      func (stream, "#%s", arm_fp_const[value & 7]);
+			    else
+			      func (stream, "f%ld", value);
+			    break;
+
+			  case 'w':
+			    if (width == 2)
+			      func (stream, "%s", iwmmxt_wwnames[value]);
+			    else
+			      func (stream, "%s", iwmmxt_wwssnames[value]);
+			    break;
+
+			  case 'g':
+			    func (stream, "%s", iwmmxt_regnames[value]);
+			    break;
+			  case 'G':
+			    func (stream, "%s", iwmmxt_cregnames[value]);
+			    break;
+
+			  case 'x':
+			    func (stream, "0x%lx", value);
+			    break;
+
+			  case '`':
+			    c++;
+			    if (value == 0)
+			      func (stream, "%c", *c);
+			    break;
+			  case '\'':
+			    c++;
+			    if (value == ((1ul << width) - 1))
+			      func (stream, "%c", *c);
+			    break;
+			  case '?':
+			    func (stream, "%c", c[(1 << width) - (int)value]);
+			    c += 1 << width;
+			    break;
+			  default:
+			    abort ();
+			  }
+			break;
+
+		      case 'y':
+		      case 'z':
+			{
+			  int single = *c++ == 'y';
+			  int regno;
+
+			  switch (*c)
 			    {
-			      if ((given & 0x02000000) == 0)
+			    case '4': /* Sm pair */
+			      func (stream, "{");
+			      /* Fall through.  */
+			    case '0': /* Sm, Dm */
+			      regno = given & 0x0000000f;
+			      if (single)
 				{
-				  int offset = given & 0xfff;
-				  if (offset)
-				    func (stream, ", %s#%d",
-					  (((given & 0x00800000) == 0)
-					   ? "-" : ""), offset);
+				  regno <<= 1;
+				  regno += (given >> 5) & 1;
 				}
-			      else
+                              else
+                                regno += ((given >> 5) & 1) << 4;
+			      break;
+
+			    case '1': /* Sd, Dd */
+			      regno = (given >> 12) & 0x0000000f;
+			      if (single)
 				{
-				  func (stream, ", %s",
-					(((given & 0x00800000) == 0)
-					 ? "-" : ""));
-				  arm_decode_shift (given, func, stream);
+				  regno <<= 1;
+				  regno += (given >> 22) & 1;
 				}
+                              else
+                                regno += ((given >> 22) & 1) << 4;
+			      break;
 
-			      func (stream, "]%s", 
-				    ((given & 0x00200000) != 0) ? "!" : "");
+			    case '2': /* Sn, Dn */
+			      regno = (given >> 16) & 0x0000000f;
+			      if (single)
+				{
+				  regno <<= 1;
+				  regno += (given >> 7) & 1;
+				}
+                              else
+                                regno += ((given >> 7) & 1) << 4;
+			      break;
+
+			    case '3': /* List */
+			      func (stream, "{");
+			      regno = (given >> 12) & 0x0000000f;
+			      if (single)
+				{
+				  regno <<= 1;
+				  regno += (given >> 22) & 1;
+				}
+                              else
+                                regno += ((given >> 22) & 1) << 4;
+			      break;
+
+			    default:
+			      abort ();
 			    }
-			  else
+
+			  func (stream, "%c%d", single ? 's' : 'd', regno);
+
+			  if (*c == '3')
 			    {
-			      if ((given & 0x02000000) == 0)
+			      int count = given & 0xff;
+
+			      if (single == 0)
+				count >>= 1;
+
+			      if (--count)
 				{
-				  int offset = given & 0xfff;
-				  if (offset)
-				    func (stream, "], %s#%d",
-					  (((given & 0x00800000) == 0)
-					   ? "-" : ""), offset);
-				  else 
-				    func (stream, "]");
+				  func (stream, "-%c%d",
+					single ? 's' : 'd',
+					regno + count);
 				}
+
+			      func (stream, "}");
+			    }
+			  else if (*c == '4')
+			    func (stream, ", %c%d}", single ? 's' : 'd',
+				  regno + 1);
+			}
+			break;
+
+		      case 'L':
+			switch (given & 0x00400100)
+			  {
+			  case 0x00000000: func (stream, "b"); break;
+			  case 0x00400000: func (stream, "h"); break;
+			  case 0x00000100: func (stream, "w"); break;
+			  case 0x00400100: func (stream, "d"); break;
+			  default:
+			    break;
+			  }
+			break;
+
+		      case 'Z':
+			{
+			  int value;
+			  /* given (20, 23) | given (0, 3) */
+			  value = ((given >> 16) & 0xf0) | (given & 0xf);
+			  func (stream, "%d", value);
+			}
+			break;
+
+		      case 'l':
+			/* This is like the 'A' operator, except that if
+			   the width field "M" is zero, then the offset is
+			   *not* multiplied by four.  */
+			{
+			  int offset = given & 0xff;
+			  int multiplier = (given & 0x00000100) ? 4 : 1;
+
+			  func (stream, "[%s", arm_regnames [(given >> 16) & 0xf]);
+
+			  if (offset)
+			    {
+			      if ((given & 0x01000000) != 0)
+				func (stream, ", #%s%d]%s",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * multiplier,
+				      ((given & 0x00200000) != 0 ? "!" : ""));
 			      else
-				{
-				  func (stream, "], %s",
-					(((given & 0x00800000) == 0) 
-					 ? "-" : ""));
-				  arm_decode_shift (given, func, stream);
-				}
+				func (stream, "], #%s%d",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * multiplier);
 			    }
+			  else
+			    func (stream, "]");
 			}
+			break;
+
+		      case 'r':
+			{
+			  int imm4 = (given >> 4) & 0xf;
+			  int puw_bits = ((given >> 22) & 6) | ((given >> 21) & 1);
+			  int ubit = (given >> 23) & 1;
+			  const char *rm = arm_regnames [given & 0xf];
+			  const char *rn = arm_regnames [(given >> 16) & 0xf];
+
+			  switch (puw_bits)
+			    {
+			    case 1:
+			      /* fall through */
+			    case 3:
+			      func (stream, "[%s], %c%s", rn, ubit ? '+' : '-', rm);
+			      if (imm4)
+				func (stream, ", lsl #%d", imm4);
+			      break;
+
+			    case 4:
+			      /* fall through */
+			    case 5:
+			      /* fall through */
+			    case 6:
+			      /* fall through */
+			    case 7:
+			      func (stream, "[%s, %c%s", rn, ubit ? '+' : '-', rm);
+			      if (imm4 > 0)
+				func (stream, ", lsl #%d", imm4);
+			      func (stream, "]");
+			      if (puw_bits == 5 || puw_bits == 7)
+				func (stream, "!");
+			      break;
+
+			    default:
+			      func (stream, "INVALID");
+			    }
+			}
+			break;
+
+		      case 'i':
+			{
+			  long imm5;
+			  imm5 = ((given & 0x100) >> 4) | (given & 0xf);
+			  func (stream, "%ld", (imm5 == 0) ? 32 : imm5);
+			}
+			break;
+
+		      default:
+			abort ();
+		      }
+		    }
+		}
+	      else
+		func (stream, "%c", *c);
+	    }
+	  return TRUE;
+	}
+    }
+  return FALSE;
+}
+
+static void
+print_arm_address (bfd_vma pc, struct disassemble_info *info, long given)
+{
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+
+  if (((given & 0x000f0000) == 0x000f0000)
+      && ((given & 0x02000000) == 0))
+    {
+      int offset = given & 0xfff;
+
+      func (stream, "[pc");
+
+      if (given & 0x01000000)
+	{
+	  if ((given & 0x00800000) == 0)
+	    offset = - offset;
+
+	  /* Pre-indexed.  */
+	  func (stream, ", #%d]", offset);
+
+	  offset += pc + 8;
+
+	  /* Cope with the possibility of write-back
+	     being used.  Probably a very dangerous thing
+	     for the programmer to do, but who are we to
+	     argue ?  */
+	  if (given & 0x00200000)
+	    func (stream, "!");
+	}
+      else
+	{
+	  /* Post indexed.  */
+	  func (stream, "], #%d", offset);
+
+	  /* ie ignore the offset.  */
+	  offset = pc + 8;
+	}
+
+      func (stream, "\t; ");
+      info->print_address_func (offset, info);
+    }
+  else
+    {
+      func (stream, "[%s",
+	    arm_regnames[(given >> 16) & 0xf]);
+      if ((given & 0x01000000) != 0)
+	{
+	  if ((given & 0x02000000) == 0)
+	    {
+	      int offset = given & 0xfff;
+	      if (offset)
+		func (stream, ", #%s%d",
+		      (((given & 0x00800000) == 0)
+		       ? "-" : ""), offset);
+	    }
+	  else
+	    {
+	      func (stream, ", %s",
+		    (((given & 0x00800000) == 0)
+		     ? "-" : ""));
+	      arm_decode_shift (given, func, stream, 1);
+	    }
+
+	  func (stream, "]%s",
+		((given & 0x00200000) != 0) ? "!" : "");
+	}
+      else
+	{
+	  if ((given & 0x02000000) == 0)
+	    {
+	      int offset = given & 0xfff;
+	      if (offset)
+		func (stream, "], #%s%d",
+		      (((given & 0x00800000) == 0)
+		       ? "-" : ""), offset);
+	      else
+		func (stream, "]");
+	    }
+	  else
+	    {
+	      func (stream, "], %s",
+		    (((given & 0x00800000) == 0)
+		     ? "-" : ""));
+	      arm_decode_shift (given, func, stream, 1);
+	    }
+	}
+    }
+}
+
+/* Print one neon instruction on INFO->STREAM.
+   Return TRUE if the instuction matched, FALSE if this is not a
+   recognised neon instruction.  */
+
+static bfd_boolean
+print_insn_neon (struct disassemble_info *info, long given, bfd_boolean thumb)
+{
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+
+  if (thumb)
+    {
+      if ((given & 0xef000000) == 0xef000000)
+	{
+	  /* move bit 28 to bit 24 to translate Thumb2 to ARM encoding.  */
+	  unsigned long bit28 = given & (1 << 28);
+
+	  given &= 0x00ffffff;
+	  if (bit28)
+            given |= 0xf3000000;
+          else
+	    given |= 0xf2000000;
+	}
+      else if ((given & 0xff000000) == 0xf9000000)
+	given ^= 0xf9000000 ^ 0xf4000000;
+      else
+	return FALSE;
+    }
+
+  for (insn = neon_opcodes; insn->assembler; insn++)
+    {
+      if ((given & insn->mask) == insn->value)
+	{
+	  const char *c;
+
+	  for (c = insn->assembler; *c; c++)
+	    {
+	      if (*c == '%')
+		{
+		  switch (*++c)
+		    {
+		    case '%':
+		      func (stream, "%%");
+		      break;
+
+		    case 'c':
+		      if (thumb && ifthen_state)
+			func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		      break;
+
+		    case 'A':
+		      {
+			static const unsigned char enc[16] =
+			{
+			  0x4, 0x14, /* st4 0,1 */
+			  0x4, /* st1 2 */
+			  0x4, /* st2 3 */
+			  0x3, /* st3 4 */
+			  0x13, /* st3 5 */
+			  0x3, /* st1 6 */
+			  0x1, /* st1 7 */
+			  0x2, /* st2 8 */
+			  0x12, /* st2 9 */
+			  0x2, /* st1 10 */
+			  0, 0, 0, 0, 0
+			};
+			int rd = ((given >> 12) & 0xf) | (((given >> 22) & 1) << 4);
+			int rn = ((given >> 16) & 0xf);
+			int rm = ((given >> 0) & 0xf);
+			int align = ((given >> 4) & 0x3);
+			int type = ((given >> 8) & 0xf);
+			int n = enc[type] & 0xf;
+			int stride = (enc[type] >> 4) + 1;
+			int ix;
+
+			func (stream, "{");
+			if (stride > 1)
+			  for (ix = 0; ix != n; ix++)
+			    func (stream, "%sd%d", ix ? "," : "", rd + ix * stride);
+			else if (n == 1)
+			  func (stream, "d%d", rd);
+			else
+			  func (stream, "d%d-d%d", rd, rd + n - 1);
+			func (stream, "}, [%s", arm_regnames[rn]);
+			if (align)
+			  func (stream, ", :%d", 32 << align);
+			func (stream, "]");
+			if (rm == 0xd)
+			  func (stream, "!");
+			else if (rm != 0xf)
+			  func (stream, ", %s", arm_regnames[rm]);
+		      }
+		      break;
+
+		    case 'B':
+		      {
+			int rd = ((given >> 12) & 0xf) | (((given >> 22) & 1) << 4);
+			int rn = ((given >> 16) & 0xf);
+			int rm = ((given >> 0) & 0xf);
+			int idx_align = ((given >> 4) & 0xf);
+                        int align = 0;
+			int size = ((given >> 10) & 0x3);
+			int idx = idx_align >> (size + 1);
+                        int length = ((given >> 8) & 3) + 1;
+                        int stride = 1;
+                        int i;
+
+                        if (length > 1 && size > 0)
+                          stride = (idx_align & (1 << size)) ? 2 : 1;
+
+                        switch (length)
+                          {
+                          case 1:
+                            {
+                              int amask = (1 << size) - 1;
+                              if ((idx_align & (1 << size)) != 0)
+                                return FALSE;
+                              if (size > 0)
+                                {
+                                  if ((idx_align & amask) == amask)
+                                    align = 8 << size;
+                                  else if ((idx_align & amask) != 0)
+                                    return FALSE;
+                                }
+                              }
+                            break;
+
+                          case 2:
+                            if (size == 2 && (idx_align & 2) != 0)
+                              return FALSE;
+                            align = (idx_align & 1) ? 16 << size : 0;
+                            break;
+
+                          case 3:
+                            if ((size == 2 && (idx_align & 3) != 0)
+                                || (idx_align & 1) != 0)
+                              return FALSE;
+                            break;
+
+                          case 4:
+                            if (size == 2)
+                              {
+                                if ((idx_align & 3) == 3)
+                                  return FALSE;
+                                align = (idx_align & 3) * 64;
+                              }
+                            else
+                              align = (idx_align & 1) ? 32 << size : 0;
+                            break;
+
+                          default:
+                            abort ();
+                          }
+
+			func (stream, "{");
+                        for (i = 0; i < length; i++)
+                          func (stream, "%sd%d[%d]", (i == 0) ? "" : ",",
+                            rd + i * stride, idx);
+                        func (stream, "}, [%s", arm_regnames[rn]);
+			if (align)
+			  func (stream, ", :%d", align);
+			func (stream, "]");
+			if (rm == 0xd)
+			  func (stream, "!");
+			else if (rm != 0xf)
+			  func (stream, ", %s", arm_regnames[rm]);
+		      }
+		      break;
+
+		    case 'C':
+		      {
+			int rd = ((given >> 12) & 0xf) | (((given >> 22) & 1) << 4);
+			int rn = ((given >> 16) & 0xf);
+			int rm = ((given >> 0) & 0xf);
+			int align = ((given >> 4) & 0x1);
+			int size = ((given >> 6) & 0x3);
+			int type = ((given >> 8) & 0x3);
+			int n = type + 1;
+			int stride = ((given >> 5) & 0x1);
+			int ix;
+
+			if (stride && (n == 1))
+			  n++;
+			else
+			  stride++;
+
+			func (stream, "{");
+			if (stride > 1)
+			  for (ix = 0; ix != n; ix++)
+			    func (stream, "%sd%d[]", ix ? "," : "", rd + ix * stride);
+			else if (n == 1)
+			  func (stream, "d%d[]", rd);
+			else
+			  func (stream, "d%d[]-d%d[]", rd, rd + n - 1);
+			func (stream, "}, [%s", arm_regnames[rn]);
+			if (align)
+			  {
+                            int align = (8 * (type + 1)) << size;
+                            if (type == 3)
+                              align = (size > 1) ? align >> 1 : align;
+			    if (type == 2 || (type == 0 && !size))
+			      func (stream, ", :<bad align %d>", align);
+			    else
+			      func (stream, ", :%d", align);
+			  }
+			func (stream, "]");
+			if (rm == 0xd)
+			  func (stream, "!");
+			else if (rm != 0xf)
+			  func (stream, ", %s", arm_regnames[rm]);
+		      }
+		      break;
+
+		    case 'D':
+		      {
+			int raw_reg = (given & 0xf) | ((given >> 1) & 0x10);
+			int size = (given >> 20) & 3;
+			int reg = raw_reg & ((4 << size) - 1);
+			int ix = raw_reg >> size >> 2;
+
+			func (stream, "d%d[%d]", reg, ix);
+		      }
+		      break;
+
+		    case 'E':
+		      /* Neon encoded constant for mov, mvn, vorr, vbic */
+		      {
+			int bits = 0;
+			int cmode = (given >> 8) & 0xf;
+			int op = (given >> 5) & 0x1;
+			unsigned long value = 0, hival = 0;
+			unsigned shift;
+                        int size = 0;
+                        int isfloat = 0;
+
+			bits |= ((given >> 24) & 1) << 7;
+			bits |= ((given >> 16) & 7) << 4;
+			bits |= ((given >> 0) & 15) << 0;
+
+			if (cmode < 8)
+			  {
+			    shift = (cmode >> 1) & 3;
+			    value = (unsigned long)bits << (8 * shift);
+                            size = 32;
+			  }
+			else if (cmode < 12)
+			  {
+			    shift = (cmode >> 1) & 1;
+			    value = (unsigned long)bits << (8 * shift);
+                            size = 16;
+			  }
+			else if (cmode < 14)
+			  {
+			    shift = (cmode & 1) + 1;
+			    value = (unsigned long)bits << (8 * shift);
+			    value |= (1ul << (8 * shift)) - 1;
+                            size = 32;
+			  }
+			else if (cmode == 14)
+			  {
+			    if (op)
+			      {
+				/* bit replication into bytes */
+				int ix;
+				unsigned long mask;
+
+				value = 0;
+                                hival = 0;
+				for (ix = 7; ix >= 0; ix--)
+				  {
+				    mask = ((bits >> ix) & 1) ? 0xff : 0;
+                                    if (ix <= 3)
+				      value = (value << 8) | mask;
+                                    else
+                                      hival = (hival << 8) | mask;
+				  }
+                                size = 64;
+			      }
+                            else
+                              {
+                                /* byte replication */
+                                value = (unsigned long)bits;
+                                size = 8;
+                              }
+			  }
+			else if (!op)
+			  {
+			    /* floating point encoding */
+			    int tmp;
+
+			    value = (unsigned long)(bits & 0x7f) << 19;
+			    value |= (unsigned long)(bits & 0x80) << 24;
+			    tmp = bits & 0x40 ? 0x3c : 0x40;
+			    value |= (unsigned long)tmp << 24;
+                            size = 32;
+                            isfloat = 1;
+			  }
+			else
+			  {
+			    func (stream, "<illegal constant %.8x:%x:%x>",
+                                  bits, cmode, op);
+                            size = 32;
+			    break;
+			  }
+                        switch (size)
+                          {
+                          case 8:
+			    func (stream, "#%ld\t; 0x%.2lx", value, value);
+                            break;
+
+                          case 16:
+                            func (stream, "#%ld\t; 0x%.4lx", value, value);
+                            break;
+
+                          case 32:
+                            if (isfloat)
+                              {
+                                unsigned char valbytes[4];
+                                double fvalue;
+
+                                /* Do this a byte at a time so we don't have to
+                                   worry about the host's endianness.  */
+                                valbytes[0] = value & 0xff;
+                                valbytes[1] = (value >> 8) & 0xff;
+                                valbytes[2] = (value >> 16) & 0xff;
+                                valbytes[3] = (value >> 24) & 0xff;
+
+                                floatformat_to_double
+                                  (&floatformat_ieee_single_little, valbytes,
+                                  &fvalue);
+
+                                func (stream, "#%.7g\t; 0x%.8lx", fvalue,
+                                      value);
+                              }
+                            else
+                              func (stream, "#%ld\t; 0x%.8lx",
+				(long) ((value & 0x80000000)
+					? value | ~0xffffffffl : value), value);
+                            break;
+
+                          case 64:
+                            func (stream, "#0x%.8lx%.8lx", hival, value);
+                            break;
+
+                          default:
+                            abort ();
+                          }
+		      }
+		      break;
+
+		    case 'F':
+		      {
+			int regno = ((given >> 16) & 0xf) | ((given >> (7 - 4)) & 0x10);
+			int num = (given >> 8) & 0x3;
+
+			if (!num)
+			  func (stream, "{d%d}", regno);
+			else if (num + regno >= 32)
+			  func (stream, "{d%d-<overflow reg d%d}", regno, regno + num);
+			else
+			  func (stream, "{d%d-d%d}", regno, regno + num);
+		      }
+		      break;
+
+
+		    case '0': case '1': case '2': case '3': case '4':
+		    case '5': case '6': case '7': case '8': case '9':
+		      {
+			int width;
+			unsigned long value;
+
+			c = arm_decode_bitfield (c, given, &value, &width);
+
+			switch (*c)
+			  {
+			  case 'r':
+			    func (stream, "%s", arm_regnames[value]);
+			    break;
+			  case 'd':
+			    func (stream, "%ld", value);
+			    break;
+			  case 'e':
+			    func (stream, "%ld", (1ul << width) - value);
+			    break;
+
+			  case 'S':
+			  case 'T':
+			  case 'U':
+			    /* various width encodings */
+			    {
+			      int base = 8 << (*c - 'S'); /* 8,16 or 32 */
+			      int limit;
+			      unsigned low, high;
+
+			      c++;
+			      if (*c >= '0' && *c <= '9')
+				limit = *c - '0';
+			      else if (*c >= 'a' && *c <= 'f')
+				limit = *c - 'a' + 10;
+			      else
+				abort ();
+			      low = limit >> 2;
+			      high = limit & 3;
+
+			      if (value < low || value > high)
+				func (stream, "<illegal width %d>", base << value);
+			      else
+				func (stream, "%d", base << value);
+			    }
+			    break;
+			  case 'R':
+			    if (given & (1 << 6))
+			      goto Q;
+			    /* FALLTHROUGH */
+			  case 'D':
+			    func (stream, "d%ld", value);
+			    break;
+			  case 'Q':
+			  Q:
+			    if (value & 1)
+			      func (stream, "<illegal reg q%ld.5>", value >> 1);
+			    else
+			      func (stream, "q%ld", value >> 1);
+			    break;
+
+			  case '`':
+			    c++;
+			    if (value == 0)
+			      func (stream, "%c", *c);
+			    break;
+			  case '\'':
+			    c++;
+			    if (value == ((1ul << width) - 1))
+			      func (stream, "%c", *c);
+			    break;
+			  case '?':
+			    func (stream, "%c", c[(1 << width) - (int)value]);
+			    c += 1 << width;
+			    break;
+			  default:
+			    abort ();
+			  }
+			break;
+
+		      default:
+			abort ();
+		      }
+		    }
+		}
+	      else
+		func (stream, "%c", *c);
+	    }
+	  return TRUE;
+	}
+    }
+  return FALSE;
+}
+
+/* Print one ARM instruction from PC on INFO->STREAM.  */
+
+static void
+print_insn_arm_internal (bfd_vma pc, struct disassemble_info *info, long given)
+{
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+
+  if (print_insn_coprocessor (pc, info, given, FALSE))
+    return;
+
+  if (print_insn_neon (info, given, FALSE))
+    return;
+
+  for (insn = arm_opcodes; insn->assembler; insn++)
+    {
+      if (insn->value == FIRST_IWMMXT_INSN
+	  && info->mach != bfd_mach_arm_XScale
+	  && info->mach != bfd_mach_arm_iWMMXt)
+	insn = insn + IWMMXT_INSN_COUNT;
+
+      if ((given & insn->mask) == insn->value
+	  /* Special case: an instruction with all bits set in the condition field
+	     (0xFnnn_nnnn) is only matched if all those bits are set in insn->mask,
+	     or by the catchall at the end of the table.  */
+	  && ((given & 0xF0000000) != 0xF0000000
+	      || (insn->mask & 0xF0000000) == 0xF0000000
+	      || (insn->mask == 0 && insn->value == 0)))
+	{
+	  const char *c;
+
+	  for (c = insn->assembler; *c; c++)
+	    {
+	      if (*c == '%')
+		{
+		  switch (*++c)
+		    {
+		    case '%':
+		      func (stream, "%%");
+		      break;
+
+		    case 'a':
+		      print_arm_address (pc, info, given);
+		      break;
+
+		    case 'P':
+		      /* Set P address bit and use normal address
+			 printing routine.  */
+		      print_arm_address (pc, info, given | (1 << 24));
 		      break;
 
 		    case 's':
@@ -767,18 +2760,16 @@ print_insn_arm1 (pc, info, given)
 			{
                           /* PC relative with immediate offset.  */
 			  int offset = ((given & 0xf00) >> 4) | (given & 0xf);
-			  
+
 			  if ((given & 0x00800000) == 0)
 			    offset = -offset;
-			  
+
 			  func (stream, "[pc, #%d]\t; ", offset);
-			  
-			  (*info->print_address_func)
-			    (offset + pc + 8, info);
+			  info->print_address_func (offset + pc + 8, info);
 			}
 		      else
 			{
-			  func (stream, "[%s", 
+			  func (stream, "[%s",
 				arm_regnames[(given >> 16) & 0xf]);
 			  if ((given & 0x01000000) != 0)
 			    {
@@ -788,7 +2779,7 @@ print_insn_arm1 (pc, info, given)
                                   /* Immediate.  */
                                   int offset = ((given & 0xf00) >> 4) | (given & 0xf);
 				  if (offset)
-				    func (stream, ", %s#%d",
+				    func (stream, ", #%s%d",
 					  (((given & 0x00800000) == 0)
 					   ? "-" : ""), offset);
 				}
@@ -801,7 +2792,7 @@ print_insn_arm1 (pc, info, given)
                                         arm_regnames[given & 0xf]);
 				}
 
-			      func (stream, "]%s", 
+			      func (stream, "]%s",
 				    ((given & 0x00200000) != 0) ? "!" : "");
 			    }
 			  else
@@ -812,10 +2803,10 @@ print_insn_arm1 (pc, info, given)
                                   /* Immediate.  */
                                   int offset = ((given & 0xf00) >> 4) | (given & 0xf);
 				  if (offset)
-				    func (stream, "], %s#%d",
+				    func (stream, "], #%s%d",
 					  (((given & 0x00800000) == 0)
 					   ? "-" : ""), offset);
-				  else 
+				  else
 				    func (stream, "]");
 				}
 			      else
@@ -829,15 +2820,18 @@ print_insn_arm1 (pc, info, given)
 			    }
 			}
 		      break;
-			  
+
 		    case 'b':
-		      (*info->print_address_func)
-			(BDISP (given) * 4 + pc + 8, info);
+		      {
+			int disp = (((given & 0xffffff) ^ 0x800000) - 0x800000);
+			info->print_address_func (disp*4 + pc + 8, info);
+		      }
 		      break;
 
 		    case 'c':
-		      func (stream, "%s",
-			    arm_conditional [(given >> 28) & 0xf]);
+		      if (((given >> 28) & 0xf) != 0xe)
+			func (stream, "%s",
+			      arm_conditional [(given >> 28) & 0xf]);
 		      break;
 
 		    case 'm':
@@ -858,6 +2852,10 @@ print_insn_arm1 (pc, info, given)
 		      }
 		      break;
 
+		    case 'q':
+		      arm_decode_shift (given, func, stream, 0);
+		      break;
+
 		    case 'o':
 		      if ((given & 0x02000000) != 0)
 			{
@@ -868,7 +2866,7 @@ print_insn_arm1 (pc, info, given)
 			  func (stream, "#%d\t; 0x%x", immed, immed);
 			}
 		      else
-			arm_decode_shift (given, func, stream);
+			arm_decode_shift (given, func, stream, 1);
 		      break;
 
 		    case 'p':
@@ -883,11 +2881,13 @@ print_insn_arm1 (pc, info, given)
 
 		    case 'A':
 		      func (stream, "[%s", arm_regnames [(given >> 16) & 0xf]);
-		      if ((given & 0x01000000) != 0)
+
+		      if ((given & (1 << 24)) != 0)
 			{
 			  int offset = given & 0xff;
+
 			  if (offset)
-			    func (stream, ", %s#%d]%s",
+			    func (stream, ", #%s%d]%s",
 				  ((given & 0x00800000) == 0 ? "-" : ""),
 				  offset * 4,
 				  ((given & 0x00200000) != 0 ? "!" : ""));
@@ -897,12 +2897,18 @@ print_insn_arm1 (pc, info, given)
 		      else
 			{
 			  int offset = given & 0xff;
-			  if (offset)
-			    func (stream, "], %s#%d",
-				  ((given & 0x00800000) == 0 ? "-" : ""),
-				  offset * 4);
+
+			  func (stream, "]");
+
+			  if (given & (1 << 21))
+			    {
+			      if (offset)
+				func (stream, ", #%s%d",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * 4);
+			    }
 			  else
-			    func (stream, "]");
+			    func (stream, ", {%d}", offset);
 			}
 		      break;
 
@@ -911,7 +2917,7 @@ print_insn_arm1 (pc, info, given)
 		      {
 			bfd_vma address;
 			bfd_vma offset = 0;
-			
+
 			if (given & 0x00800000)
 			  /* Is signed, hi bits should be ones.  */
 			  offset = (-1) ^ 0x00ffffff;
@@ -920,7 +2926,7 @@ print_insn_arm1 (pc, info, given)
 			offset += given & 0x00ffffff;
 			offset <<= 2;
 			address = offset + pc + 8;
-			
+
 			if (given & 0x01000000)
 			  /* H bit allows addressing to 2-byte boundaries.  */
 			  address += 2;
@@ -929,25 +2935,6 @@ print_insn_arm1 (pc, info, given)
 		      }
 		      break;
 
-		    case 'I':
-		      /* Print a Cirrus/DSP shift immediate.  */
-		      /* Immediates are 7bit signed ints with bits 0..3 in
-			 bits 0..3 of opcode and bits 4..6 in bits 5..7
-			 of opcode.  */
-		      {
-			int imm;
-
-			imm = (given & 0xf) | ((given & 0xe0) >> 1);
-
-			/* Is ``imm'' a negative number?  */
-			if (imm & 0x40)
-			  imm |= (-1 << 7);
-
-			func (stream, "%d", imm);
-		      }
-
-		      break;
-
 		    case 'C':
 		      func (stream, "_");
 		      if (given & 0x80000)
@@ -960,261 +2947,108 @@ print_insn_arm1 (pc, info, given)
 			func (stream, "c");
 		      break;
 
-		    case 'F':
-		      switch (given & 0x00408000)
-			{
-			case 0:
-			  func (stream, "4");
-			  break;
-			case 0x8000:
-			  func (stream, "1");
-			  break;
-			case 0x00400000:
-			  func (stream, "2");
-			  break;
-			default:
-			  func (stream, "3");
-			}
-		      break;
-			
-		    case 'P':
-		      switch (given & 0x00080080)
-			{
-			case 0:
-			  func (stream, "s");
-			  break;
-			case 0x80:
-			  func (stream, "d");
-			  break;
-			case 0x00080000:
-			  func (stream, "e");
-			  break;
-			default:
-			  func (stream, _("<illegal precision>"));
-			  break;
-			}
-		      break;
-		    case 'Q':
-		      switch (given & 0x00408000)
+		    case 'U':
+		      switch (given & 0xf)
 			{
-			case 0:
-			  func (stream, "s");
-			  break;
-			case 0x8000:
-			  func (stream, "d");
-			  break;
-			case 0x00400000:
-			  func (stream, "e");
-			  break;
+			case 0xf: func(stream, "sy"); break;
+			case 0x7: func(stream, "un"); break;
+			case 0xe: func(stream, "st"); break;
+			case 0x6: func(stream, "unst"); break;
 			default:
-			  func (stream, "p");
-			  break;
-			}
-		      break;
-		    case 'R':
-		      switch (given & 0x60)
-			{
-			case 0:
-			  break;
-			case 0x20:
-			  func (stream, "p");
-			  break;
-			case 0x40:
-			  func (stream, "m");
-			  break;
-			default:
-			  func (stream, "z");
+			  func(stream, "#%d", (int)given & 0xf);
 			  break;
 			}
 		      break;
 
-		    case '0': case '1': case '2': case '3': case '4': 
+		    case '0': case '1': case '2': case '3': case '4':
 		    case '5': case '6': case '7': case '8': case '9':
 		      {
-			int bitstart = *c++ - '0';
-			int bitend = 0;
-			while (*c >= '0' && *c <= '9')
-			  bitstart = (bitstart * 10) + *c++ - '0';
+			int width;
+			unsigned long value;
+
+			c = arm_decode_bitfield (c, given, &value, &width);
 
 			switch (*c)
 			  {
-			  case '-':
-			    c++;
-			    
-			    while (*c >= '0' && *c <= '9')
-			      bitend = (bitend * 10) + *c++ - '0';
-			    
-			    if (!bitend)
-			      abort ();
-			    
-			    switch (*c)
-			      {
-			      case 'r':
-				{
-				  long reg;
-				  
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
-				  
-				  func (stream, "%s", arm_regnames[reg]);
-				}
-				break;
-			      case 'd':
-				{
-				  long reg;
-				  
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
-				  
-				  func (stream, "%d", reg);
-				}
-				break;
-			      case 'x':
-				{
-				  long reg;
-				  
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
-				  
-				  func (stream, "0x%08x", reg);
-				  
-				  /* Some SWI instructions have special
-				     meanings.  */
-				  if ((given & 0x0fffffff) == 0x0FF00000)
-				    func (stream, "\t; IMB");
-				  else if ((given & 0x0fffffff) == 0x0FF00001)
-				    func (stream, "\t; IMBRange");
-				}
-				break;
-			      case 'X':
-				{
-				  long reg;
-				  
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
-				  
-				  func (stream, "%01x", reg & 0xf);
-				}
-				break;
-			      case 'f':
-				{
-				  long reg;
-				  
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
-				  
-				  if (reg > 7)
-				    func (stream, "#%s",
-					  arm_fp_const[reg & 7]);
-				  else
-				    func (stream, "f%d", reg);
-				}
-				break;
-			      default:
-				abort ();
-			      }
+			  case 'r':
+			    func (stream, "%s", arm_regnames[value]);
+			    break;
+			  case 'd':
+			    func (stream, "%ld", value);
+			    break;
+			  case 'b':
+			    func (stream, "%ld", value * 8);
+			    break;
+			  case 'W':
+			    func (stream, "%ld", value + 1);
+			    break;
+			  case 'x':
+			    func (stream, "0x%08lx", value);
+
+			    /* Some SWI instructions have special
+			       meanings.  */
+			    if ((given & 0x0fffffff) == 0x0FF00000)
+			      func (stream, "\t; IMB");
+			    else if ((given & 0x0fffffff) == 0x0FF00001)
+			      func (stream, "\t; IMBRange");
+			    break;
+			  case 'X':
+			    func (stream, "%01lx", value & 0xf);
 			    break;
-
-			  case 'y':
-			  case 'z':
-			    {
-			      int single = *c == 'y';
-			      int regno;
-
-			      switch (bitstart)
-				{
-				case 4: /* Sm pair */
-				  func (stream, "{");
-				  /* Fall through.  */
-				case 0: /* Sm, Dm */
-				  regno = given & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 5) & 1;
-				    }
-				  break;
-
-				case 1: /* Sd, Dd */
-				  regno = (given >> 12) & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 22) & 1;
-				    }
-				  break;
-
-				case 2: /* Sn, Dn */
-				  regno = (given >> 16) & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 7) & 1;
-				    }
-				  break;
-
-				case 3: /* List */
-				  func (stream, "{");
-				  regno = (given >> 12) & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 22) & 1;
-				    }
-				  break;
-
-				  
-				default:
-				  abort ();
-				}
-
-			      func (stream, "%c%d", single ? 's' : 'd', regno);
-
-			      if (bitstart == 3)
-				{
-				  int count = given & 0xff;
-
-				  if (single == 0)
-				    count >>= 1;
-
-				  if (--count)
-				    {
-				      func (stream, "-%c%d",
-					    single ? 's' : 'd',
-					    regno + count);
-				    }
-
-				  func (stream, "}");
-				}
-			      else if (bitstart == 4)
-				func (stream, ", %c%d}", single ? 's' : 'd',
-				      regno + 1);
-
-			      break;
-			    }
-
 			  case '`':
 			    c++;
-			    if ((given & (1 << bitstart)) == 0)
+			    if (value == 0)
 			      func (stream, "%c", *c);
 			    break;
 			  case '\'':
 			    c++;
-			    if ((given & (1 << bitstart)) != 0)
+			    if (value == ((1ul << width) - 1))
 			      func (stream, "%c", *c);
 			    break;
 			  case '?':
-			    ++c;
-			    if ((given & (1 << bitstart)) != 0)
-			      func (stream, "%c", *c++);
-			    else
-			      func (stream, "%c", *++c);
+			    func (stream, "%c", c[(1 << width) - (int)value]);
+			    c += 1 << width;
 			    break;
 			  default:
 			    abort ();
 			  }
 			break;
 
+		      case 'e':
+			{
+			  int imm;
+
+			  imm = (given & 0xf) | ((given & 0xfff00) >> 4);
+			  func (stream, "%d", imm);
+			}
+			break;
+
+		      case 'E':
+			/* LSB and WIDTH fields of BFI or BFC.  The machine-
+			   language instruction encodes LSB and MSB.  */
+			{
+			  long msb = (given & 0x001f0000) >> 16;
+			  long lsb = (given & 0x00000f80) >> 7;
+
+			  long width = msb - lsb + 1;
+			  if (width > 0)
+			    func (stream, "#%lu, #%lu", lsb, width);
+			  else
+			    func (stream, "(invalid: %lu:%lu)", lsb, msb);
+			}
+			break;
+
+		      case 'V':
+			/* 16-bit unsigned immediate from a MOVT or MOVW
+			   instruction, encoded in bits 0:11 and 15:19.  */
+			{
+			  long hi = (given & 0x000f0000) >> 4;
+			  long lo = (given & 0x00000fff);
+			  long imm16 = hi | lo;
+			  func (stream, "#%lu\t; 0x%lx", imm16, imm16);
+			}
+			break;
+
 		      default:
 			abort ();
 		      }
@@ -1223,352 +3057,958 @@ print_insn_arm1 (pc, info, given)
 	      else
 		func (stream, "%c", *c);
 	    }
-	  return 4;
+	  return;
 	}
     }
   abort ();
 }
 
-/* Print one instruction from PC on INFO->STREAM.
-   Return the size of the instruction. */
+/* Print one 16-bit Thumb instruction from PC on INFO->STREAM.  */
 
-static int
-print_insn_thumb (pc, info, given)
-     bfd_vma                   pc;
-     struct disassemble_info * info;
-     long                      given;
+static void
+print_insn_thumb16 (bfd_vma pc, struct disassemble_info *info, long given)
 {
-  struct thumb_opcode * insn;
-  void *                stream = info->stream;
-  fprintf_ftype         func = info->fprintf_func;
+  const struct opcode16 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
 
   for (insn = thumb_opcodes; insn->assembler; insn++)
-    {
-      if ((given & insn->mask) == insn->value)
-        {
-          char * c = insn->assembler;
+    if ((given & insn->mask) == insn->value)
+      {
+	const char *c = insn->assembler;
+	for (; *c; c++)
+	  {
+	    int domaskpc = 0;
+	    int domasklr = 0;
 
-          /* Special processing for Thumb 2 instruction BL sequence:  */
-          if (!*c) /* Check for empty (not NULL) assembler string.  */
-            {
-	      long offset;
-	      
-	      info->bytes_per_chunk = 4;
-	      info->bytes_per_line  = 4;
+	    if (*c != '%')
+	      {
+		func (stream, "%c", *c);
+		continue;
+	      }
+
+	    switch (*++c)
+	      {
+	      case '%':
+		func (stream, "%%");
+		break;
+
+	      case 'c':
+		if (ifthen_state)
+		  func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		break;
+
+	      case 'C':
+		if (ifthen_state)
+		  func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		else
+		  func (stream, "s");
+		break;
+
+	      case 'I':
+		{
+		  unsigned int tmp;
 
-	      offset = BDISP23 (given);
-	      offset = offset * 2 + pc + 4;
+		  ifthen_next_state = given & 0xff;
+		  for (tmp = given << 1; tmp & 0xf; tmp <<= 1)
+		    func (stream, ((given ^ tmp) & 0x10) ? "e" : "t");
+		  func (stream, "\t%s", arm_conditional[(given >> 4) & 0xf]);
+		}
+		break;
+
+	      case 'x':
+		if (ifthen_next_state)
+		  func (stream, "\t; unpredictable branch in IT block\n");
+		break;
 
-	      if ((given & 0x10000000) == 0)
+	      case 'X':
+		if (ifthen_state)
+		  func (stream, "\t; unpredictable <IT:%s>",
+			arm_conditional[IFTHEN_COND]);
+		break;
+
+	      case 'S':
 		{
-		  func (stream, "blx\t");
-		  offset &= 0xfffffffc;
+		  long reg;
+
+		  reg = (given >> 3) & 0x7;
+		  if (given & (1 << 6))
+		    reg += 8;
+
+		  func (stream, "%s", arm_regnames[reg]);
 		}
-	      else
-		func (stream, "bl\t");
+		break;
 
-	      info->print_address_func (offset, info);
-              return 4;
-            }
-          else
-            {
-	      info->bytes_per_chunk = 2;
-	      info->bytes_per_line  = 4;
-	  	      
-              given &= 0xffff;
-	      
-              for (; *c; c++)
-                {
-                  if (*c == '%')
-                    {
-                      int domaskpc = 0;
-                      int domasklr = 0;
-		      
-                      switch (*++c)
-                        {
-                        case '%':
-                          func (stream, "%%");
-                          break;
-
-                        case 'S':
-                          {
-                            long reg;
-			    
-                            reg = (given >> 3) & 0x7;
-                            if (given & (1 << 6))
-                              reg += 8;
-			    
-                            func (stream, "%s", arm_regnames[reg]);
-                          }
-                          break;
+	      case 'D':
+		{
+		  long reg;
 
-                        case 'D':
-                          {
-                            long reg;
-			    
-                            reg = given & 0x7;
-                            if (given & (1 << 7))
-                             reg += 8;
-			    
-                            func (stream, "%s", arm_regnames[reg]);
-                          }
-                          break;
-
-                        case 'T':
-                          func (stream, "%s",
-                                arm_conditional [(given >> 8) & 0xf]);
-                          break;
-
-                        case 'N':
-                          if (given & (1 << 8))
-                            domasklr = 1;
-                          /* Fall through.  */
-                        case 'O':
-                          if (*c == 'O' && (given & (1 << 8)))
-                            domaskpc = 1;
-                          /* Fall through.  */
-                        case 'M':
-                          {
-                            int started = 0;
-                            int reg;
-			    
-                            func (stream, "{");
-			    
-                            /* It would be nice if we could spot
-                               ranges, and generate the rS-rE format: */
-                            for (reg = 0; (reg < 8); reg++)
-                              if ((given & (1 << reg)) != 0)
-                                {
-                                  if (started)
-                                    func (stream, ", ");
-                                  started = 1;
-                                  func (stream, "%s", arm_regnames[reg]);
-                                }
+		  reg = given & 0x7;
+		  if (given & (1 << 7))
+		    reg += 8;
 
-                            if (domasklr)
-                              {
-                                if (started)
-                                  func (stream, ", ");
-                                started = 1;
-                                func (stream, arm_regnames[14] /* "lr" */);
-                              }
+		  func (stream, "%s", arm_regnames[reg]);
+		}
+		break;
+
+	      case 'N':
+		if (given & (1 << 8))
+		  domasklr = 1;
+		/* Fall through.  */
+	      case 'O':
+		if (*c == 'O' && (given & (1 << 8)))
+		  domaskpc = 1;
+		/* Fall through.  */
+	      case 'M':
+		{
+		  int started = 0;
+		  int reg;
 
-                            if (domaskpc)
-                              {
-                                if (started)
-                                  func (stream, ", ");
-                                func (stream, arm_regnames[15] /* "pc" */);
-                              }
+		  func (stream, "{");
 
-                            func (stream, "}");
-                          }
-                          break;
+		  /* It would be nice if we could spot
+		     ranges, and generate the rS-rE format: */
+		  for (reg = 0; (reg < 8); reg++)
+		    if ((given & (1 << reg)) != 0)
+		      {
+			if (started)
+			  func (stream, ", ");
+			started = 1;
+			func (stream, "%s", arm_regnames[reg]);
+		      }
 
+		  if (domasklr)
+		    {
+		      if (started)
+			func (stream, ", ");
+		      started = 1;
+		      func (stream, arm_regnames[14] /* "lr" */);
+		    }
 
-                        case '0': case '1': case '2': case '3': case '4': 
-                        case '5': case '6': case '7': case '8': case '9':
-                          {
-                            int bitstart = *c++ - '0';
-                            int bitend = 0;
-			    
-                            while (*c >= '0' && *c <= '9')
-                              bitstart = (bitstart * 10) + *c++ - '0';
+		  if (domaskpc)
+		    {
+		      if (started)
+			func (stream, ", ");
+		      func (stream, arm_regnames[15] /* "pc" */);
+		    }
 
-                            switch (*c)
-                              {
-                              case '-':
-                                {
-                                  long reg;
-				  
-                                  c++;
-                                  while (*c >= '0' && *c <= '9')
-                                    bitend = (bitend * 10) + *c++ - '0';
-                                  if (!bitend)
-                                    abort ();
-                                  reg = given >> bitstart;
-                                  reg &= (2 << (bitend - bitstart)) - 1;
-                                  switch (*c)
-                                    {
-                                    case 'r':
-                                      func (stream, "%s", arm_regnames[reg]);
-                                      break;
-
-                                    case 'd':
-                                      func (stream, "%d", reg);
-                                      break;
-
-                                    case 'H':
-                                      func (stream, "%d", reg << 1);
-                                      break;
-
-                                    case 'W':
-                                      func (stream, "%d", reg << 2);
-                                      break;
-
-                                    case 'a':
-				      /* PC-relative address -- the bottom two
-					 bits of the address are dropped
-					 before the calculation.  */
-                                      info->print_address_func
-					(((pc + 4) & ~3) + (reg << 2), info);
-                                      break;
-
-                                    case 'x':
-                                      func (stream, "0x%04x", reg);
-                                      break;
-
-                                    case 'I':
-                                      reg = ((reg ^ (1 << bitend)) - (1 << bitend));
-                                      func (stream, "%d", reg);
-                                      break;
-
-                                    case 'B':
-                                      reg = ((reg ^ (1 << bitend)) - (1 << bitend));
-                                      (*info->print_address_func)
-                                        (reg * 2 + pc + 4, info);
-                                      break;
-
-                                    default:
-                                      abort ();
-                                    }
-                                }
-                                break;
-
-                              case '\'':
-                                c++;
-                                if ((given & (1 << bitstart)) != 0)
-                                  func (stream, "%c", *c);
-                                break;
-
-                              case '?':
-                                ++c;
-                                if ((given & (1 << bitstart)) != 0)
-                                  func (stream, "%c", *c++);
-                                else
-                                  func (stream, "%c", *++c);
-                                break;
-
-                              default:
-                                 abort ();
-                              }
-                          }
-                          break;
-
-                        default:
-                          abort ();
-                        }
-                    }
-                  else
-                    func (stream, "%c", *c);
-                }
-             }
-          return 2;
-       }
-    }
+		  func (stream, "}");
+		}
+		break;
+
+	      case 'b':
+		/* Print ARM V6T2 CZB address: pc+4+6 bits.  */
+		{
+		  bfd_vma address = (pc + 4
+				     + ((given & 0x00f8) >> 2)
+				     + ((given & 0x0200) >> 3));
+		  info->print_address_func (address, info);
+		}
+		break;
+
+	      case 's':
+		/* Right shift immediate -- bits 6..10; 1-31 print
+		   as themselves, 0 prints as 32.  */
+		{
+		  long imm = (given & 0x07c0) >> 6;
+		  if (imm == 0)
+		    imm = 32;
+		  func (stream, "#%ld", imm);
+		}
+		break;
+
+	      case '0': case '1': case '2': case '3': case '4':
+	      case '5': case '6': case '7': case '8': case '9':
+		{
+		  int bitstart = *c++ - '0';
+		  int bitend = 0;
+
+		  while (*c >= '0' && *c <= '9')
+		    bitstart = (bitstart * 10) + *c++ - '0';
+
+		  switch (*c)
+		    {
+		    case '-':
+		      {
+			long reg;
+
+			c++;
+			while (*c >= '0' && *c <= '9')
+			  bitend = (bitend * 10) + *c++ - '0';
+			if (!bitend)
+			  abort ();
+			reg = given >> bitstart;
+			reg &= (2 << (bitend - bitstart)) - 1;
+			switch (*c)
+			  {
+			  case 'r':
+			    func (stream, "%s", arm_regnames[reg]);
+			    break;
+
+			  case 'd':
+			    func (stream, "%ld", reg);
+			    break;
+
+			  case 'H':
+			    func (stream, "%ld", reg << 1);
+			    break;
+
+			  case 'W':
+			    func (stream, "%ld", reg << 2);
+			    break;
+
+			  case 'a':
+			    /* PC-relative address -- the bottom two
+			       bits of the address are dropped
+			       before the calculation.  */
+			    info->print_address_func
+			      (((pc + 4) & ~3) + (reg << 2), info);
+			    break;
+
+			  case 'x':
+			    func (stream, "0x%04lx", reg);
+			    break;
+
+			  case 'B':
+			    reg = ((reg ^ (1 << bitend)) - (1 << bitend));
+			    info->print_address_func (reg * 2 + pc + 4, info);
+			    break;
+
+			  case 'c':
+			    func (stream, "%s", arm_conditional [reg]);
+			    break;
+
+			  default:
+			    abort ();
+			  }
+		      }
+		      break;
+
+		    case '\'':
+		      c++;
+		      if ((given & (1 << bitstart)) != 0)
+			func (stream, "%c", *c);
+		      break;
+
+		    case '?':
+		      ++c;
+		      if ((given & (1 << bitstart)) != 0)
+			func (stream, "%c", *c++);
+		      else
+			func (stream, "%c", *++c);
+		      break;
+
+		    default:
+		      abort ();
+		    }
+		}
+		break;
+
+	      default:
+		abort ();
+	      }
+	  }
+	return;
+      }
 
   /* No match.  */
   abort ();
 }
 
-/* Parse an individual disassembler option.  */
+/* Return the name of an V7M special register.  */
+static const char *
+psr_name (int regno)
+{
+  switch (regno)
+    {
+    case 0: return "APSR";
+    case 1: return "IAPSR";
+    case 2: return "EAPSR";
+    case 3: return "PSR";
+    case 5: return "IPSR";
+    case 6: return "EPSR";
+    case 7: return "IEPSR";
+    case 8: return "MSP";
+    case 9: return "PSP";
+    case 16: return "PRIMASK";
+    case 17: return "BASEPRI";
+    case 18: return "BASEPRI_MASK";
+    case 19: return "FAULTMASK";
+    case 20: return "CONTROL";
+    default: return "<unknown>";
+    }
+}
+
+/* Print one 32-bit Thumb instruction from PC on INFO->STREAM.  */
 
-void
-parse_arm_disassembler_option (option)
-     char * option;
+static void
+print_insn_thumb32 (bfd_vma pc, struct disassemble_info *info, long given)
 {
-  if (option == NULL)
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+
+  if (print_insn_coprocessor (pc, info, given, TRUE))
+    return;
+
+  if (print_insn_neon (info, given, TRUE))
     return;
-      
-  if (strneq (option, "reg-names-", 10))
-    {
-      int i;
-	
-      option += 10;
 
-      for (i = NUM_ARM_REGNAMES; i--;)
-	if (streq (option, regnames[i].name))
+  for (insn = thumb32_opcodes; insn->assembler; insn++)
+    if ((given & insn->mask) == insn->value)
+      {
+	const char *c = insn->assembler;
+	for (; *c; c++)
 	  {
-	    regname_selected = i;
-	    break;
+	    if (*c != '%')
+	      {
+		func (stream, "%c", *c);
+		continue;
+	      }
+
+	    switch (*++c)
+	      {
+	      case '%':
+		func (stream, "%%");
+		break;
+
+	      case 'c':
+		if (ifthen_state)
+		  func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		break;
+
+	      case 'x':
+		if (ifthen_next_state)
+		  func (stream, "\t; unpredictable branch in IT block\n");
+		break;
+
+	      case 'X':
+		if (ifthen_state)
+		  func (stream, "\t; unpredictable <IT:%s>",
+			arm_conditional[IFTHEN_COND]);
+		break;
+
+	      case 'I':
+		{
+		  unsigned int imm12 = 0;
+		  imm12 |= (given & 0x000000ffu);
+		  imm12 |= (given & 0x00007000u) >> 4;
+		  imm12 |= (given & 0x04000000u) >> 15;
+		  func (stream, "#%u\t; 0x%x", imm12, imm12);
+		}
+		break;
+
+	      case 'M':
+		{
+		  unsigned int bits = 0, imm, imm8, mod;
+		  bits |= (given & 0x000000ffu);
+		  bits |= (given & 0x00007000u) >> 4;
+		  bits |= (given & 0x04000000u) >> 15;
+		  imm8 = (bits & 0x0ff);
+		  mod = (bits & 0xf00) >> 8;
+		  switch (mod)
+		    {
+		    case 0: imm = imm8; break;
+		    case 1: imm = ((imm8<<16) | imm8); break;
+		    case 2: imm = ((imm8<<24) | (imm8 << 8)); break;
+		    case 3: imm = ((imm8<<24) | (imm8 << 16) | (imm8 << 8) | imm8); break;
+		    default:
+		      mod  = (bits & 0xf80) >> 7;
+		      imm8 = (bits & 0x07f) | 0x80;
+		      imm  = (((imm8 << (32 - mod)) | (imm8 >> mod)) & 0xffffffff);
+		    }
+		  func (stream, "#%u\t; 0x%x", imm, imm);
+		}
+		break;
+
+	      case 'J':
+		{
+		  unsigned int imm = 0;
+		  imm |= (given & 0x000000ffu);
+		  imm |= (given & 0x00007000u) >> 4;
+		  imm |= (given & 0x04000000u) >> 15;
+		  imm |= (given & 0x000f0000u) >> 4;
+		  func (stream, "#%u\t; 0x%x", imm, imm);
+		}
+		break;
+
+	      case 'K':
+		{
+		  unsigned int imm = 0;
+		  imm |= (given & 0x000f0000u) >> 16;
+		  imm |= (given & 0x00000ff0u) >> 0;
+		  imm |= (given & 0x0000000fu) << 12;
+		  func (stream, "#%u\t; 0x%x", imm, imm);
+		}
+		break;
+
+	      case 'S':
+		{
+		  unsigned int reg = (given & 0x0000000fu);
+		  unsigned int stp = (given & 0x00000030u) >> 4;
+		  unsigned int imm = 0;
+		  imm |= (given & 0x000000c0u) >> 6;
+		  imm |= (given & 0x00007000u) >> 10;
+
+		  func (stream, "%s", arm_regnames[reg]);
+		  switch (stp)
+		    {
+		    case 0:
+		      if (imm > 0)
+			func (stream, ", lsl #%u", imm);
+		      break;
+
+		    case 1:
+		      if (imm == 0)
+			imm = 32;
+		      func (stream, ", lsr #%u", imm);
+		      break;
+
+		    case 2:
+		      if (imm == 0)
+			imm = 32;
+		      func (stream, ", asr #%u", imm);
+		      break;
+
+		    case 3:
+		      if (imm == 0)
+			func (stream, ", rrx");
+		      else
+			func (stream, ", ror #%u", imm);
+		    }
+		}
+		break;
+
+	      case 'a':
+		{
+		  unsigned int Rn  = (given & 0x000f0000) >> 16;
+		  unsigned int U   = (given & 0x00800000) >> 23;
+		  unsigned int op  = (given & 0x00000f00) >> 8;
+		  unsigned int i12 = (given & 0x00000fff);
+		  unsigned int i8  = (given & 0x000000ff);
+		  bfd_boolean writeback = FALSE, postind = FALSE;
+		  int offset = 0;
+
+		  func (stream, "[%s", arm_regnames[Rn]);
+		  if (U) /* 12-bit positive immediate offset */
+		    offset = i12;
+		  else if (Rn == 15) /* 12-bit negative immediate offset */
+		    offset = -(int)i12;
+		  else if (op == 0x0) /* shifted register offset */
+		    {
+		      unsigned int Rm = (i8 & 0x0f);
+		      unsigned int sh = (i8 & 0x30) >> 4;
+		      func (stream, ", %s", arm_regnames[Rm]);
+		      if (sh)
+			func (stream, ", lsl #%u", sh);
+		      func (stream, "]");
+		      break;
+		    }
+		  else switch (op)
+		    {
+		    case 0xE:  /* 8-bit positive immediate offset */
+		      offset = i8;
+		      break;
+
+		    case 0xC:  /* 8-bit negative immediate offset */
+		      offset = -i8;
+		      break;
+
+		    case 0xF:  /* 8-bit + preindex with wb */
+		      offset = i8;
+		      writeback = TRUE;
+		      break;
+
+		    case 0xD:  /* 8-bit - preindex with wb */
+		      offset = -i8;
+		      writeback = TRUE;
+		      break;
+
+		    case 0xB:  /* 8-bit + postindex */
+		      offset = i8;
+		      postind = TRUE;
+		      break;
+
+		    case 0x9:  /* 8-bit - postindex */
+		      offset = -i8;
+		      postind = TRUE;
+		      break;
+
+		    default:
+		      func (stream, ", <undefined>]");
+		      goto skip;
+		    }
+
+		  if (postind)
+		    func (stream, "], #%d", offset);
+		  else
+		    {
+		      if (offset)
+			func (stream, ", #%d", offset);
+		      func (stream, writeback ? "]!" : "]");
+		    }
+
+		  if (Rn == 15)
+		    {
+		      func (stream, "\t; ");
+		      info->print_address_func (((pc + 4) & ~3) + offset, info);
+		    }
+		}
+	      skip:
+		break;
+
+	      case 'A':
+		{
+		  unsigned int P   = (given & 0x01000000) >> 24;
+		  unsigned int U   = (given & 0x00800000) >> 23;
+		  unsigned int W   = (given & 0x00400000) >> 21;
+		  unsigned int Rn  = (given & 0x000f0000) >> 16;
+		  unsigned int off = (given & 0x000000ff);
+
+		  func (stream, "[%s", arm_regnames[Rn]);
+		  if (P)
+		    {
+		      if (off || !U)
+			func (stream, ", #%c%u", U ? '+' : '-', off * 4);
+		      func (stream, "]");
+		      if (W)
+			func (stream, "!");
+		    }
+		  else
+		    {
+		      func (stream, "], ");
+		      if (W)
+			func (stream, "#%c%u", U ? '+' : '-', off * 4);
+		      else
+			func (stream, "{%u}", off);
+		    }
+		}
+		break;
+
+	      case 'w':
+		{
+		  unsigned int Sbit = (given & 0x01000000) >> 24;
+		  unsigned int type = (given & 0x00600000) >> 21;
+		  switch (type)
+		    {
+		    case 0: func (stream, Sbit ? "sb" : "b"); break;
+		    case 1: func (stream, Sbit ? "sh" : "h"); break;
+		    case 2:
+		      if (Sbit)
+			func (stream, "??");
+		      break;
+		    case 3:
+		      func (stream, "??");
+		      break;
+		    }
+		}
+		break;
+
+	      case 'm':
+		{
+		  int started = 0;
+		  int reg;
+
+		  func (stream, "{");
+		  for (reg = 0; reg < 16; reg++)
+		    if ((given & (1 << reg)) != 0)
+		      {
+			if (started)
+			  func (stream, ", ");
+			started = 1;
+			func (stream, "%s", arm_regnames[reg]);
+		      }
+		  func (stream, "}");
+		}
+		break;
+
+	      case 'E':
+		{
+		  unsigned int msb = (given & 0x0000001f);
+		  unsigned int lsb = 0;
+		  lsb |= (given & 0x000000c0u) >> 6;
+		  lsb |= (given & 0x00007000u) >> 10;
+		  func (stream, "#%u, #%u", lsb, msb - lsb + 1);
+		}
+		break;
+
+	      case 'F':
+		{
+		  unsigned int width = (given & 0x0000001f) + 1;
+		  unsigned int lsb = 0;
+		  lsb |= (given & 0x000000c0u) >> 6;
+		  lsb |= (given & 0x00007000u) >> 10;
+		  func (stream, "#%u, #%u", lsb, width);
+		}
+		break;
+
+	      case 'b':
+		{
+		  unsigned int S = (given & 0x04000000u) >> 26;
+		  unsigned int J1 = (given & 0x00002000u) >> 13;
+		  unsigned int J2 = (given & 0x00000800u) >> 11;
+		  int offset = 0;
+
+		  offset |= !S << 20;
+		  offset |= J2 << 19;
+		  offset |= J1 << 18;
+		  offset |= (given & 0x003f0000) >> 4;
+		  offset |= (given & 0x000007ff) << 1;
+		  offset -= (1 << 20);
+
+		  info->print_address_func (pc + 4 + offset, info);
+		}
+		break;
+
+	      case 'B':
+		{
+		  unsigned int S = (given & 0x04000000u) >> 26;
+		  unsigned int I1 = (given & 0x00002000u) >> 13;
+		  unsigned int I2 = (given & 0x00000800u) >> 11;
+		  int offset = 0;
+
+		  offset |= !S << 24;
+		  offset |= !(I1 ^ S) << 23;
+		  offset |= !(I2 ^ S) << 22;
+		  offset |= (given & 0x03ff0000u) >> 4;
+		  offset |= (given & 0x000007ffu) << 1;
+		  offset -= (1 << 24);
+		  offset += pc + 4;
+
+		  /* BLX target addresses are always word aligned.  */
+		  if ((given & 0x00001000u) == 0)
+		      offset &= ~2u;
+
+		  info->print_address_func (offset, info);
+		}
+		break;
+
+	      case 's':
+		{
+		  unsigned int shift = 0;
+		  shift |= (given & 0x000000c0u) >> 6;
+		  shift |= (given & 0x00007000u) >> 10;
+		  if (given & 0x00200000u)
+		    func (stream, ", asr #%u", shift);
+		  else if (shift)
+		    func (stream, ", lsl #%u", shift);
+		  /* else print nothing - lsl #0 */
+		}
+		break;
+
+	      case 'R':
+		{
+		  unsigned int rot = (given & 0x00000030) >> 4;
+		  if (rot)
+		    func (stream, ", ror #%u", rot * 8);
+		}
+		break;
+
+	      case 'U':
+		switch (given & 0xf)
+		  {
+		  case 0xf: func(stream, "sy"); break;
+		  case 0x7: func(stream, "un"); break;
+		  case 0xe: func(stream, "st"); break;
+		  case 0x6: func(stream, "unst"); break;
+		  default:
+		    func(stream, "#%d", (int)given & 0xf);
+		    break;
+		  }
+		break;
+
+	      case 'C':
+		if ((given & 0xff) == 0)
+		  {
+		    func (stream, "%cPSR_", (given & 0x100000) ? 'S' : 'C');
+		    if (given & 0x800)
+		      func (stream, "f");
+		    if (given & 0x400)
+		      func (stream, "s");
+		    if (given & 0x200)
+		      func (stream, "x");
+		    if (given & 0x100)
+		      func (stream, "c");
+		  }
+		else
+		  {
+		    func (stream, psr_name (given & 0xff));
+		  }
+		break;
+
+	      case 'D':
+		if ((given & 0xff) == 0)
+		  func (stream, "%cPSR", (given & 0x100000) ? 'S' : 'C');
+		else
+		  func (stream, psr_name (given & 0xff));
+		break;
+
+	      case '0': case '1': case '2': case '3': case '4':
+	      case '5': case '6': case '7': case '8': case '9':
+		{
+		  int width;
+		  unsigned long val;
+
+		  c = arm_decode_bitfield (c, given, &val, &width);
+
+		  switch (*c)
+		    {
+		    case 'd': func (stream, "%lu", val); break;
+		    case 'W': func (stream, "%lu", val * 4); break;
+		    case 'r': func (stream, "%s", arm_regnames[val]); break;
+
+		    case 'c':
+		      func (stream, "%s", arm_conditional[val]);
+		      break;
+
+		    case '\'':
+		      c++;
+		      if (val == ((1ul << width) - 1))
+			func (stream, "%c", *c);
+		      break;
+
+		    case '`':
+		      c++;
+		      if (val == 0)
+			func (stream, "%c", *c);
+		      break;
+
+		    case '?':
+		      func (stream, "%c", c[(1 << width) - (int)val]);
+		      c += 1 << width;
+		      break;
+
+		    default:
+		      abort ();
+		    }
+		}
+		break;
+
+	      default:
+		abort ();
+	      }
 	  }
-      
-      if (i < 0)
-	fprintf (stderr, _("Unrecognised register name set: %s\n"), option);
-    }
-  else if (streq (option, "force-thumb"))
-    force_thumb = 1;
-  else if (streq (option, "no-force-thumb"))
-    force_thumb = 0;
-  else
-    fprintf (stderr, _("Unrecognised disassembler option: %s\n"), option);
-  
-  return;
+	return;
+      }
+
+  /* No match.  */
+  abort ();
 }
 
-/* Parse the string of disassembler options, spliting it at whitespaces.  */
+/* Print data bytes on INFO->STREAM.  */
 
 static void
-parse_disassembler_options (options)
-     char * options;
+print_insn_data (bfd_vma pc ATTRIBUTE_UNUSED, struct disassemble_info *info,
+		 long given)
 {
-  char * space;
-  
-  if (options == NULL)
-    return;
+  switch (info->bytes_per_chunk)
+    {
+    case 1:
+      info->fprintf_func (info->stream, ".byte\t0x%02lx", given);
+      break;
+    case 2:
+      info->fprintf_func (info->stream, ".short\t0x%04lx", given);
+      break;
+    case 4:
+      info->fprintf_func (info->stream, ".word\t0x%08lx", given);
+      break;
+    default:
+      abort ();
+    }
+}
 
-  do
+/* Search back through the insn stream to determine if this instruction is
+   conditionally executed.  */
+static void
+find_ifthen_state (bfd_vma pc, struct disassemble_info *info,
+		   bfd_boolean little)
+{
+  unsigned char b[2];
+  unsigned int insn;
+  int status;
+  /* COUNT is twice the number of instructions seen.  It will be odd if we
+     just crossed an instruction boundary.  */
+  int count;
+  int it_count;
+  unsigned int seen_it;
+  bfd_vma addr;
+
+  ifthen_address = pc;
+  ifthen_state = 0;
+
+  addr = pc;
+  count = 1;
+  it_count = 0;
+  seen_it = 0;
+  /* Scan backwards looking for IT instructions, keeping track of where
+     instruction boundaries are.  We don't know if something is actually an
+     IT instruction until we find a definite instruction boundary.  */
+  for (;;)
     {
-      space = strchr (options, ' ');
+      if (addr == 0 || info->symbol_at_address_func(addr, info))
+	{
+	  /* A symbol must be on an instruction boundary, and will not
+	     be within an IT block.  */
+	  if (seen_it && (count & 1))
+	    break;
+
+	  return;
+	}
+      addr -= 2;
+      status = info->read_memory_func (addr, (bfd_byte *)b, 2, info);
+      if (status)
+	return;
 
-      if (space)
+      if (little)
+	insn = (b[0]) | (b[1] << 8);
+      else
+	insn = (b[1]) | (b[0] << 8);
+      if (seen_it)
 	{
-	  * space = '\0';
-	  parse_arm_disassembler_option (options);
-	  * space = ' ';
-	  options = space + 1;
+	  if ((insn & 0xf800) < 0xe800)
+	    {
+	      /* Addr + 2 is an instruction boundary.  See if this matches
+	         the expected boundary based on the position of the last
+		 IT candidate.  */
+	      if (count & 1)
+		break;
+	      seen_it = 0;
+	    }
+	}
+      if ((insn & 0xff00) == 0xbf00 && (insn & 0xf) != 0)
+	{
+	  /* This could be an IT instruction.  */
+	  seen_it = insn;
+	  it_count = count >> 1;
 	}
+      if ((insn & 0xf800) >= 0xe800)
+	count++;
       else
-	parse_arm_disassembler_option (options);
+	count = (count + 2) | 1;
+      /* IT blocks contain at most 4 instructions.  */
+      if (count >= 8 && !seen_it)
+	return;
     }
-  while (space);
+  /* We found an IT instruction.  */
+  ifthen_state = (seen_it & 0xe0) | ((seen_it << it_count) & 0x1f);
+  if ((ifthen_state & 0xf) == 0)
+    ifthen_state = 0;
 }
 
 /* NOTE: There are no checks in these routines that
    the relevant number of data bytes exist.  */
 
 int
-print_insn_arm (pc, info)
-     bfd_vma pc;
-     struct disassemble_info * info;
+print_insn_arm (bfd_vma pc, struct disassemble_info *info)
 {
-  unsigned char      b[4];
-  long               given;
-  int                status;
-  int                is_thumb;
-  int little;
+  unsigned char b[4];
+  long		given;
+  int           status;
+  int           is_thumb = FALSE;
+  int           is_data = FALSE;
+  unsigned int	size = 4;
+  void	 	(*printer) (bfd_vma, struct disassemble_info *, long);
+#if 0
+  bfd_boolean   found = FALSE;
 
   if (info->disassembler_options)
     {
       parse_disassembler_options (info->disassembler_options);
-      
+
       /* To avoid repeated parsing of these options, we remove them here.  */
       info->disassembler_options = NULL;
     }
-  
-  is_thumb = force_thumb;
-  if (pc & 1)
+
+  /* First check the full symtab for a mapping symbol, even if there
+     are no usable non-mapping symbols for this address.  */
+  if (info->symtab != NULL
+      && bfd_asymbol_flavour (*info->symtab) == bfd_target_elf_flavour)
     {
-      is_thumb = 1;
-      pc &= ~(bfd_vma) 1;
+      bfd_vma addr;
+      int n;
+      int last_sym = -1;
+      enum map_type type = MAP_ARM;
+
+      if (pc <= last_mapping_addr)
+	last_mapping_sym = -1;
+      is_thumb = (last_type == MAP_THUMB);
+      found = FALSE;
+      /* Start scanning at the start of the function, or wherever
+	 we finished last time.  */
+      n = info->symtab_pos + 1;
+      if (n < last_mapping_sym)
+	n = last_mapping_sym;
+
+      /* Scan up to the location being disassembled.  */
+      for (; n < info->symtab_size; n++)
+	{
+	  addr = bfd_asymbol_value (info->symtab[n]);
+	  if (addr > pc)
+	    break;
+	  if ((info->section == NULL
+	       || info->section == info->symtab[n]->section)
+	      && get_sym_code_type (info, n, &type))
+	    {
+	      last_sym = n;
+	      found = TRUE;
+	    }
+	}
+
+      if (!found)
+	{
+	  n = info->symtab_pos;
+	  if (n < last_mapping_sym - 1)
+	    n = last_mapping_sym - 1;
+
+	  /* No mapping symbol found at this address.  Look backwards
+	     for a preceeding one.  */
+	  for (; n >= 0; n--)
+	    {
+	      if (get_sym_code_type (info, n, &type))
+		{
+		  last_sym = n;
+		  found = TRUE;
+		  break;
+		}
+	    }
+	}
+
+      last_mapping_sym = last_sym;
+      last_type = type;
+      is_thumb = (last_type == MAP_THUMB);
+      is_data = (last_type == MAP_DATA);
+
+      /* Look a little bit ahead to see if we should print out
+	 two or four bytes of data.  If there's a symbol,
+	 mapping or otherwise, after two bytes then don't
+	 print more.  */
+      if (is_data)
+	{
+	  size = 4 - (pc & 3);
+	  for (n = last_sym + 1; n < info->symtab_size; n++)
+	    {
+	      addr = bfd_asymbol_value (info->symtab[n]);
+	      if (addr > pc)
+		{
+		  if (addr - pc < size)
+		    size = addr - pc;
+		  break;
+		}
+	    }
+	  /* If the next symbol is after three bytes, we need to
+	     print only part of the data, so that we can use either
+	     .byte or .short.  */
+	  if (size == 3)
+	    size = (pc & 1) ? 1 : 2;
+	}
     }
-  
-#if 0
-  if (!is_thumb && info->symbols != NULL)
+
+  if (info->symbols != NULL)
     {
       if (bfd_asymbol_flavour (*info->symbols) == bfd_target_coff_flavour)
 	{
 	  coff_symbol_type * cs;
-	  
+
 	  cs = coffsymbol (*info->symbols);
 	  is_thumb = (   cs->native->u.syment.n_sclass == C_THUMBEXT
 		      || cs->native->u.syment.n_sclass == C_THUMBSTAT
@@ -1576,75 +4016,117 @@ print_insn_arm (pc, info)
 		      || cs->native->u.syment.n_sclass == C_THUMBEXTFUNC
 		      || cs->native->u.syment.n_sclass == C_THUMBSTATFUNC);
 	}
-      else if (bfd_asymbol_flavour (*info->symbols) == bfd_target_elf_flavour)
+      else if (bfd_asymbol_flavour (*info->symbols) == bfd_target_elf_flavour
+	       && !found)
 	{
+	  /* If no mapping symbol has been found then fall back to the type
+	     of the function symbol.  */
 	  elf_symbol_type *  es;
 	  unsigned int       type;
-	  
+
 	  es = *(elf_symbol_type **)(info->symbols);
 	  type = ELF_ST_TYPE (es->internal_elf_sym.st_info);
-	  
+
 	  is_thumb = (type == STT_ARM_TFUNC) || (type == STT_ARM_16BIT);
 	}
     }
-#endif
-  
+#else
+  int little;
+
   little = (info->endian == BFD_ENDIAN_LITTLE);
-  info->bytes_per_chunk = 4;
-  info->display_endian  = little ? BFD_ENDIAN_LITTLE : BFD_ENDIAN_BIG;
+  is_thumb |= (pc & 1);
+  pc &= ~(bfd_vma)1;
+#endif
+
+  if (force_thumb)
+    is_thumb = TRUE;
 
-  if (little)
+  info->bytes_per_line = 4;
+
+  if (is_data)
     {
-      status = info->read_memory_func (pc, (bfd_byte *) &b[0], 4, info);
-      if (status != 0 && is_thumb)
-	{
-	  info->bytes_per_chunk = 2;
-	  
-	  status = info->read_memory_func (pc, (bfd_byte *) b, 2, info);
-	  b[3] = b[2] = 0;
-	}
-      
-      if (status != 0)
-	{
-	  info->memory_error_func (status, pc, info);
-	  return -1;
-	}
-      
-      given = (b[0]) | (b[1] << 8) | (b[2] << 16) | (b[3] << 24);
+      int i;
+
+      /* size was already set above.  */
+      info->bytes_per_chunk = size;
+      printer = print_insn_data;
+
+      status = info->read_memory_func (pc, (bfd_byte *)b, size, info);
+      given = 0;
+      if (little)
+	for (i = size - 1; i >= 0; i--)
+	  given = b[i] | (given << 8);
+      else
+	for (i = 0; i < (int) size; i++)
+	  given = b[i] | (given << 8);
+    }
+  else if (!is_thumb)
+    {
+      /* In ARM mode endianness is a straightforward issue: the instruction
+	 is four bytes long and is either ordered 0123 or 3210.  */
+      printer = print_insn_arm_internal;
+      info->bytes_per_chunk = 4;
+      size = 4;
+
+      status = info->read_memory_func (pc, (bfd_byte *)b, 4, info);
+      if (little)
+	given = (b[0]) | (b[1] << 8) | (b[2] << 16) | (b[3] << 24);
+      else
+	given = (b[3]) | (b[2] << 8) | (b[1] << 16) | (b[0] << 24);
     }
   else
     {
-      status = info->read_memory_func
-	(pc & ~ 0x3, (bfd_byte *) &b[0], 4, info);
-      if (status != 0)
-	{
-	  info->memory_error_func (status, pc, info);
-	  return -1;
-	}
-      
-      if (is_thumb)
+      /* In Thumb mode we have the additional wrinkle of two
+	 instruction lengths.  Fortunately, the bits that determine
+	 the length of the current instruction are always to be found
+	 in the first two bytes.  */
+      printer = print_insn_thumb16;
+      info->bytes_per_chunk = 2;
+      size = 2;
+
+      status = info->read_memory_func (pc, (bfd_byte *)b, 2, info);
+      if (little)
+	given = (b[0]) | (b[1] << 8);
+      else
+	given = (b[1]) | (b[0] << 8);
+
+      if (!status)
 	{
-	  if (pc & 0x2)
+	  /* These bit patterns signal a four-byte Thumb
+	     instruction.  */
+	  if ((given & 0xF800) == 0xF800
+	      || (given & 0xF800) == 0xF000
+	      || (given & 0xF800) == 0xE800)
 	    {
-	      given = (b[2] << 8) | b[3];
-	      
-	      status = info->read_memory_func
-		((pc + 4) & ~ 0x3, (bfd_byte *) b, 4, info);
-	      if (status != 0)
-		{
-		  info->memory_error_func (status, pc + 4, info);
-		  return -1;
-		}
-	      
-	      given |= (b[0] << 24) | (b[1] << 16);
+	      status = info->read_memory_func (pc + 2, (bfd_byte *)b, 2, info);
+	      if (little)
+		given = (b[0]) | (b[1] << 8) | (given << 16);
+	      else
+		given = (b[1]) | (b[0] << 8) | (given << 16);
+
+	      printer = print_insn_thumb32;
+	      size = 4;
 	    }
+	}
+
+      if (ifthen_address != pc)
+	find_ifthen_state(pc, info, little);
+
+      if (ifthen_state)
+	{
+	  if ((ifthen_state & 0xf) == 0x8)
+	    ifthen_next_state = 0;
 	  else
-	    given = (b[0] << 8) | b[1] | (b[2] << 24) | (b[3] << 16);
+	    ifthen_next_state = (ifthen_state & 0xe0)
+				| ((ifthen_state & 0xf) << 1);
 	}
-      else
-	given = (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | (b[3]);
     }
-  
+
+  if (status)
+    {
+      info->memory_error_func (status, pc, info);
+      return -1;
+    }
   if (info->flags & INSN_HAS_RELOC)
     /* If the instruction has a reloc associated with it, then
        the offset field in the instruction will actually be the
@@ -1652,23 +4134,26 @@ print_insn_arm (pc, info)
        In such cases, we can ignore the pc when computing
        addresses, since the addend is not currently pc-relative.  */
     pc = 0;
-  if (is_thumb)
-    status = print_insn_thumb (pc, info, given);
-  else
-    status = print_insn_arm1 (pc, info, given);
 
-  return status;
+  printer (pc, info, given);
+
+  if (is_thumb)
+    {
+      ifthen_state = ifthen_next_state;
+      ifthen_address += size;
+    }
+  return size;
 }
 
 void
-print_arm_disassembler_options (FILE * stream)
+print_arm_disassembler_options (FILE *stream)
 {
   int i;
 
   fprintf (stream, _("\n\
 The following ARM specific disassembler options are supported for use with\n\
 the -M switch:\n"));
-  
+
   for (i = NUM_ARM_REGNAMES; i--;)
     fprintf (stream, "  reg-names-%s %*c%s\n",
 	     regnames[i].name,
diff --git a/arm-semi.c b/arm-semi.c
new file mode 100644
index 0000000..cd77d1d
--- /dev/null
+++ b/arm-semi.c
@@ -0,0 +1,469 @@
+/*
+ *  Arm "Angel" semihosting syscalls
+ *
+ *  Copyright (c) 2005, 2007 CodeSourcery.
+ *  Written by Paul Brook.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <time.h>
+
+#include "cpu.h"
+#ifdef CONFIG_USER_ONLY
+#include "qemu.h"
+
+#define ARM_ANGEL_HEAP_SIZE (128 * 1024 * 1024)
+#else
+#include "qemu-common.h"
+#include "sysemu.h"
+#include "gdbstub.h"
+#endif
+
+#define SYS_OPEN        0x01
+#define SYS_CLOSE       0x02
+#define SYS_WRITEC      0x03
+#define SYS_WRITE0      0x04
+#define SYS_WRITE       0x05
+#define SYS_READ        0x06
+#define SYS_READC       0x07
+#define SYS_ISTTY       0x09
+#define SYS_SEEK        0x0a
+#define SYS_FLEN        0x0c
+#define SYS_TMPNAM      0x0d
+#define SYS_REMOVE      0x0e
+#define SYS_RENAME      0x0f
+#define SYS_CLOCK       0x10
+#define SYS_TIME        0x11
+#define SYS_SYSTEM      0x12
+#define SYS_ERRNO       0x13
+#define SYS_GET_CMDLINE 0x15
+#define SYS_HEAPINFO    0x16
+#define SYS_EXIT        0x18
+
+#ifndef O_BINARY
+#define O_BINARY 0
+#endif
+
+#define GDB_O_RDONLY  0x000
+#define GDB_O_WRONLY  0x001
+#define GDB_O_RDWR    0x002
+#define GDB_O_APPEND  0x008
+#define GDB_O_CREAT   0x200
+#define GDB_O_TRUNC   0x400
+#define GDB_O_BINARY  0
+
+static int gdb_open_modeflags[12] = {
+    GDB_O_RDONLY,
+    GDB_O_RDONLY | GDB_O_BINARY,
+    GDB_O_RDWR,
+    GDB_O_RDWR | GDB_O_BINARY,
+    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_TRUNC,
+    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_TRUNC | GDB_O_BINARY,
+    GDB_O_RDWR | GDB_O_CREAT | GDB_O_TRUNC,
+    GDB_O_RDWR | GDB_O_CREAT | GDB_O_TRUNC | GDB_O_BINARY,
+    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_APPEND,
+    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_APPEND | GDB_O_BINARY,
+    GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND,
+    GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND | GDB_O_BINARY
+};
+
+static int open_modeflags[12] = {
+    O_RDONLY,
+    O_RDONLY | O_BINARY,
+    O_RDWR,
+    O_RDWR | O_BINARY,
+    O_WRONLY | O_CREAT | O_TRUNC,
+    O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
+    O_RDWR | O_CREAT | O_TRUNC,
+    O_RDWR | O_CREAT | O_TRUNC | O_BINARY,
+    O_WRONLY | O_CREAT | O_APPEND,
+    O_WRONLY | O_CREAT | O_APPEND | O_BINARY,
+    O_RDWR | O_CREAT | O_APPEND,
+    O_RDWR | O_CREAT | O_APPEND | O_BINARY
+};
+
+#ifdef CONFIG_USER_ONLY
+static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
+{
+    if (code == (uint32_t)-1)
+        ts->swi_errno = errno;
+    return code;
+}
+#else
+static inline uint32_t set_swi_errno(CPUState *env, uint32_t code)
+{
+    return code;
+}
+
+#include "softmmu-semi.h"
+#endif
+
+static target_ulong arm_semi_syscall_len;
+
+#if !defined(CONFIG_USER_ONLY)
+static target_ulong syscall_err;
+#endif
+
+static void arm_semi_cb(CPUState *env, target_ulong ret, target_ulong err)
+{
+#ifdef CONFIG_USER_ONLY
+    TaskState *ts = env->opaque;
+#endif
+
+    if (ret == (target_ulong)-1) {
+#ifdef CONFIG_USER_ONLY
+        ts->swi_errno = err;
+#else
+	syscall_err = err;
+#endif
+        env->regs[0] = ret;
+    } else {
+        /* Fixup syscalls that use nonstardard return conventions.  */
+        switch (env->regs[0]) {
+        case SYS_WRITE:
+        case SYS_READ:
+            env->regs[0] = arm_semi_syscall_len - ret;
+            break;
+        case SYS_SEEK:
+            env->regs[0] = 0;
+            break;
+        default:
+            env->regs[0] = ret;
+            break;
+        }
+    }
+}
+
+static void arm_semi_flen_cb(CPUState *env, target_ulong ret, target_ulong err)
+{
+    /* The size is always stored in big-endian order, extract
+       the value. We assume the size always fit in 32 bits.  */
+    uint32_t size;
+    cpu_memory_rw_debug(env, env->regs[13]-64+32, (uint8_t *)&size, 4, 0);
+    env->regs[0] = be32_to_cpu(size);
+#ifdef CONFIG_USER_ONLY
+    ((TaskState *)env->opaque)->swi_errno = err;
+#else
+    syscall_err = err;
+#endif
+}
+
+#define ARG(n)					\
+({						\
+    target_ulong __arg;				\
+    /* FIXME - handle get_user() failure */	\
+    get_user_ual(__arg, args + (n) * 4);	\
+    __arg;					\
+})
+#define SET_ARG(n, val) put_user_ual(val, args + (n) * 4)
+uint32_t do_arm_semihosting(CPUState *env)
+{
+    target_ulong args;
+    char * s;
+    int nr;
+    uint32_t ret;
+    uint32_t len;
+#ifdef CONFIG_USER_ONLY
+    TaskState *ts = env->opaque;
+#else
+    CPUState *ts = env;
+#endif
+
+    nr = env->regs[0];
+    args = env->regs[1];
+    switch (nr) {
+    case SYS_OPEN:
+        if (!(s = lock_user_string(ARG(0))))
+            /* FIXME - should this error code be -TARGET_EFAULT ? */
+            return (uint32_t)-1;
+        if (ARG(1) >= 12)
+            return (uint32_t)-1;
+        if (strcmp(s, ":tt") == 0) {
+            if (ARG(1) < 4)
+                return STDIN_FILENO;
+            else
+                return STDOUT_FILENO;
+        }
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_cb, "open,%s,%x,1a4", ARG(0),
+			   (int)ARG(2)+1, gdb_open_modeflags[ARG(1)]);
+            return env->regs[0];
+        } else {
+            ret = set_swi_errno(ts, open(s, open_modeflags[ARG(1)], 0644));
+        }
+        unlock_user(s, ARG(0), 0);
+        return ret;
+    case SYS_CLOSE:
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_cb, "close,%x", ARG(0));
+            return env->regs[0];
+        } else {
+            return set_swi_errno(ts, close(ARG(0)));
+        }
+    case SYS_WRITEC:
+        {
+          char c;
+
+          if (get_user_u8(c, args))
+              /* FIXME - should this error code be -TARGET_EFAULT ? */
+              return (uint32_t)-1;
+          /* Write to debug console.  stderr is near enough.  */
+          if (use_gdb_syscalls()) {
+                gdb_do_syscall(arm_semi_cb, "write,2,%x,1", args);
+                return env->regs[0];
+          } else {
+                return write(STDERR_FILENO, &c, 1);
+          }
+        }
+    case SYS_WRITE0:
+        if (!(s = lock_user_string(args)))
+            /* FIXME - should this error code be -TARGET_EFAULT ? */
+            return (uint32_t)-1;
+        len = strlen(s);
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_cb, "write,2,%x,%x\n", args, len);
+            ret = env->regs[0];
+        } else {
+            ret = write(STDERR_FILENO, s, len);
+        }
+        unlock_user(s, args, 0);
+        return ret;
+    case SYS_WRITE:
+        len = ARG(2);
+        if (use_gdb_syscalls()) {
+            arm_semi_syscall_len = len;
+            gdb_do_syscall(arm_semi_cb, "write,%x,%x,%x", ARG(0), ARG(1), len);
+            return env->regs[0];
+        } else {
+            if (!(s = lock_user(VERIFY_READ, ARG(1), len, 1)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
+            ret = set_swi_errno(ts, write(ARG(0), s, len));
+            unlock_user(s, ARG(1), 0);
+            if (ret == (uint32_t)-1)
+                return -1;
+            return len - ret;
+        }
+    case SYS_READ:
+        len = ARG(2);
+        if (use_gdb_syscalls()) {
+            arm_semi_syscall_len = len;
+            gdb_do_syscall(arm_semi_cb, "read,%x,%x,%x", ARG(0), ARG(1), len);
+            return env->regs[0];
+        } else {
+            if (!(s = lock_user(VERIFY_WRITE, ARG(1), len, 0)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
+            do
+              ret = set_swi_errno(ts, read(ARG(0), s, len));
+            while (ret == -1 && errno == EINTR);
+            unlock_user(s, ARG(1), len);
+            if (ret == (uint32_t)-1)
+                return -1;
+            return len - ret;
+        }
+    case SYS_READC:
+       /* XXX: Read from debug cosole. Not implemented.  */
+        return 0;
+    case SYS_ISTTY:
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_cb, "isatty,%x", ARG(0));
+            return env->regs[0];
+        } else {
+            return isatty(ARG(0));
+        }
+    case SYS_SEEK:
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_cb, "lseek,%x,%x,0", ARG(0), ARG(1));
+            return env->regs[0];
+        } else {
+            ret = set_swi_errno(ts, lseek(ARG(0), ARG(1), SEEK_SET));
+            if (ret == (uint32_t)-1)
+              return -1;
+            return 0;
+        }
+    case SYS_FLEN:
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_flen_cb, "fstat,%x,%x",
+			   ARG(0), env->regs[13]-64);
+            return env->regs[0];
+        } else {
+            struct stat buf;
+            ret = set_swi_errno(ts, fstat(ARG(0), &buf));
+            if (ret == (uint32_t)-1)
+                return -1;
+            return buf.st_size;
+        }
+    case SYS_TMPNAM:
+        /* XXX: Not implemented.  */
+        return -1;
+    case SYS_REMOVE:
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_cb, "unlink,%s", ARG(0), (int)ARG(1)+1);
+            ret = env->regs[0];
+        } else {
+            if (!(s = lock_user_string(ARG(0))))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
+            ret =  set_swi_errno(ts, remove(s));
+            unlock_user(s, ARG(0), 0);
+        }
+        return ret;
+    case SYS_RENAME:
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_cb, "rename,%s,%s",
+                           ARG(0), (int)ARG(1)+1, ARG(2), (int)ARG(3)+1);
+            return env->regs[0];
+        } else {
+            char *s2;
+            s = lock_user_string(ARG(0));
+            s2 = lock_user_string(ARG(2));
+            if (!s || !s2)
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                ret = (uint32_t)-1;
+            else
+                ret = set_swi_errno(ts, rename(s, s2));
+            if (s2)
+                unlock_user(s2, ARG(2), 0);
+            if (s)
+                unlock_user(s, ARG(0), 0);
+            return ret;
+        }
+    case SYS_CLOCK:
+        return clock() / (CLOCKS_PER_SEC / 100);
+    case SYS_TIME:
+        return set_swi_errno(ts, time(NULL));
+    case SYS_SYSTEM:
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_cb, "system,%s", ARG(0), (int)ARG(1)+1);
+            return env->regs[0];
+        } else {
+            if (!(s = lock_user_string(ARG(0))))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
+            ret = set_swi_errno(ts, system(s));
+            unlock_user(s, ARG(0), 0);
+            return ret;
+        }
+    case SYS_ERRNO:
+#ifdef CONFIG_USER_ONLY
+        return ts->swi_errno;
+#else
+        return syscall_err;
+#endif
+    case SYS_GET_CMDLINE:
+#ifdef CONFIG_USER_ONLY
+        /* Build a commandline from the original argv.  */
+        {
+            char **arg = ts->info->host_argv;
+            int len = ARG(1);
+            /* lock the buffer on the ARM side */
+            char *cmdline_buffer = (char*)lock_user(VERIFY_WRITE, ARG(0), len, 0);
+
+            if (!cmdline_buffer)
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
+
+            s = cmdline_buffer;
+            while (*arg && len > 2) {
+                int n = strlen(*arg);
+
+                if (s != cmdline_buffer) {
+                    *(s++) = ' ';
+                    len--;
+                }
+                if (n >= len)
+                    n = len - 1;
+                memcpy(s, *arg, n);
+                s += n;
+                len -= n;
+                arg++;
+            }
+            /* Null terminate the string.  */
+            *s = 0;
+            len = s - cmdline_buffer;
+
+            /* Unlock the buffer on the ARM side.  */
+            unlock_user(cmdline_buffer, ARG(0), len);
+
+            /* Adjust the commandline length argument.  */
+            SET_ARG(1, len);
+
+            /* Return success if commandline fit into buffer.  */
+            return *arg ? -1 : 0;
+        }
+#else
+      return -1;
+#endif
+    case SYS_HEAPINFO:
+        {
+            uint32_t *ptr;
+            uint32_t limit;
+
+#ifdef CONFIG_USER_ONLY
+            /* Some C libraries assume the heap immediately follows .bss, so
+               allocate it using sbrk.  */
+            if (!ts->heap_limit) {
+                long ret;
+
+                ts->heap_base = do_brk(0);
+                limit = ts->heap_base + ARM_ANGEL_HEAP_SIZE;
+                /* Try a big heap, and reduce the size if that fails.  */
+                for (;;) {
+                    ret = do_brk(limit);
+                    if (ret != -1)
+                        break;
+                    limit = (ts->heap_base >> 1) + (limit >> 1);
+                }
+                ts->heap_limit = limit;
+            }
+
+            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
+            ptr[0] = tswap32(ts->heap_base);
+            ptr[1] = tswap32(ts->heap_limit);
+            ptr[2] = tswap32(ts->stack_base);
+            ptr[3] = tswap32(0); /* Stack limit.  */
+            unlock_user(ptr, ARG(0), 16);
+#else
+            limit = ram_size;
+            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
+            /* TODO: Make this use the limit of the loaded application.  */
+            ptr[0] = tswap32(limit / 2);
+            ptr[1] = tswap32(limit);
+            ptr[2] = tswap32(limit); /* Stack base */
+            ptr[3] = tswap32(0); /* Stack limit.  */
+            unlock_user(ptr, ARG(0), 16);
+#endif
+            return 0;
+        }
+    case SYS_EXIT:
+        exit(0);
+    default:
+        fprintf(stderr, "qemu: Unsupported SemiHosting SWI 0x%02x\n", nr);
+        cpu_dump_state(env, stderr, fprintf, 0);
+        abort();
+    }
+}
diff --git a/arm.ld b/arm.ld
index 61f4c34..93285d6 100644
--- a/arm.ld
+++ b/arm.ld
@@ -53,17 +53,43 @@ SECTIONS
   .fini      : { *(.fini)    } =0x47ff041f
   .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
   .rodata1   : { *(.rodata1) }
+  .ARM.extab   : { *(.ARM.extab* .gnu.linkonce.armextab.*) }
+   __exidx_start = .;
+  .ARM.exidx   : { *(.ARM.exidx* .gnu.linkonce.armexidx.*) }
+   __exidx_end = .;
   .reginfo : { *(.reginfo) }
   /* Adjust the address for the data segment.  We want to adjust up to
      the same address within the page on the next page up.  */
   . = ALIGN(0x100000) + (. & (0x100000 - 1));
   .data    :
   {
+    *(.gen_code)
     *(.data)
     *(.gnu.linkonce.d*)
     CONSTRUCTORS
   }
+  .tbss           : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
   .data1   : { *(.data1) }
+  .preinit_array     :
+  {
+    PROVIDE_HIDDEN (__preinit_array_start = .);
+    KEEP (*(.preinit_array))
+    PROVIDE_HIDDEN (__preinit_array_end = .);
+  }
+  .init_array     :
+  {
+     PROVIDE_HIDDEN (__init_array_start = .);
+     KEEP (*(SORT(.init_array.*)))
+     KEEP (*(.init_array))
+     PROVIDE_HIDDEN (__init_array_end = .);
+  }
+  .fini_array     :
+  {
+    PROVIDE_HIDDEN (__fini_array_start = .);
+    KEEP (*(.fini_array))
+    KEEP (*(SORT(.fini_array.*)))
+    PROVIDE_HIDDEN (__fini_array_end = .);
+  }
   .ctors         :
   {
     *(.ctors)
diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index cc43841..1cc4d6e 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -23,13 +23,13 @@
  * THE SOFTWARE.
  */
 #include <alsa/asoundlib.h>
-#include "vl.h"
+#include "audio.h"
 
 #define AUDIO_CAP "alsa"
 #include "audio_int.h"
 #include <dlfcn.h>
 #include <pthread.h>
-#include "android_debug.h"
+#include "qemu_debug.h"
 
 #define  DEBUG  1
 
@@ -59,6 +59,7 @@
     DYNLINK_FUNC(size_t,snd_pcm_hw_params_sizeof,(void))  \
     DYNLINK_FUNC(int,snd_pcm_hw_params_any,(snd_pcm_t *pcm, snd_pcm_hw_params_t *params))  \
     DYNLINK_FUNC(int,snd_pcm_hw_params_set_access,(snd_pcm_t *pcm, snd_pcm_hw_params_t *params, snd_pcm_access_t _access))  \
+    DYNLINK_FUNC(int,snd_pcm_hw_params_get_format,(const snd_pcm_hw_params_t *params, snd_pcm_format_t *val)) \
     DYNLINK_FUNC(int,snd_pcm_hw_params_set_format,(snd_pcm_t *pcm, snd_pcm_hw_params_t *params, snd_pcm_format_t val))  \
     DYNLINK_FUNC(int,snd_pcm_hw_params_set_rate_near,(snd_pcm_t *pcm, snd_pcm_hw_params_t *params, unsigned int *val, int *dir))  \
     DYNLINK_FUNC(int,snd_pcm_hw_params_set_channels_near,(snd_pcm_t *pcm, snd_pcm_hw_params_t *params, unsigned int *val))  \
@@ -194,7 +195,7 @@ static int alsa_write (SWVoiceOut *sw, void *buf, int len)
     return audio_pcm_sw_write (sw, buf, len);
 }
 
-static int aud_to_alsafmt (audfmt_e fmt)
+static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt)
 {
     switch (fmt) {
     case AUD_FMT_S8:
@@ -209,6 +210,12 @@ static int aud_to_alsafmt (audfmt_e fmt)
     case AUD_FMT_U16:
         return SND_PCM_FORMAT_U16_LE;
 
+    case AUD_FMT_S32:
+        return SND_PCM_FORMAT_S32_LE;
+
+    case AUD_FMT_U32:
+        return SND_PCM_FORMAT_U32_LE;
+
     default:
         dolog ("Internal logic error: Bad audio format %d\n", fmt);
 #ifdef DEBUG_AUDIO
@@ -252,6 +259,26 @@ static int alsa_to_audfmt (snd_pcm_format_t alsafmt, audfmt_e *fmt,
         *fmt = AUD_FMT_U16;
         break;
 
+    case SND_PCM_FORMAT_S32_LE:
+        *endianness = 0;
+        *fmt = AUD_FMT_S32;
+        break;
+
+    case SND_PCM_FORMAT_U32_LE:
+        *endianness = 0;
+        *fmt = AUD_FMT_U32;
+        break;
+
+    case SND_PCM_FORMAT_S32_BE:
+        *endianness = 1;
+        *fmt = AUD_FMT_S32;
+        break;
+
+    case SND_PCM_FORMAT_U32_BE:
+        *endianness = 1;
+        *fmt = AUD_FMT_U32;
+        break;
+
     default:
         dolog ("Unrecognized audio format %d\n", alsafmt);
         return -1;
@@ -468,6 +495,7 @@ static int alsa_open (int in, struct alsa_params_req *req,
     }
 
     err = FF(snd_pcm_hw_params_get_format)(hw_params, &obtfmt);
+    err = FF(snd_pcm_hw_params_get_format) (hw_params, &obtfmt);
     if (err < 0) {
         alsa_logerr2 (err, typ, "Failed to get format\n");
         goto err;
@@ -499,6 +527,11 @@ static int alsa_open (int in, struct alsa_params_req *req,
         case AUD_FMT_U16:
             bytes_per_sec <<= 1;
             break;
+
+        case AUD_FMT_S32:
+        case AUD_FMT_U32:
+            bytes_per_sec <<= 2;
+            break;
         }
 
         threshold = (conf.threshold * bytes_per_sec) / 1000;
diff --git a/audio/audio.c b/audio/audio.c
index 4ba1f7d..5a77dac 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -22,12 +22,17 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw/hw.h"
+#include "audio.h"
+#include "console.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
 
 #define AUDIO_CAP "audio"
 #include "audio_int.h"
-#include "android_utils.h"
-#include "android.h"
+#include "android/utils/system.h"
+#include "qemu_debug.h"
+#include "android/android.h"
 
 /* #define DEBUG_PLIVE */
 /* #define DEBUG_LIVE */
@@ -161,7 +166,8 @@ static struct {
         {
             44100,              /* freq */
             2,                  /* nchannels */
-            AUD_FMT_S16         /* fmt */
+            AUD_FMT_S16,        /* fmt */
+            AUDIO_HOST_ENDIANNESS
         }
     },
 
@@ -172,7 +178,8 @@ static struct {
         {
             44100,              /* freq */
             2,                  /* nchannels */
-            AUD_FMT_S16         /* fmt */
+            AUD_FMT_S16,        /* fmt */
+            AUDIO_HOST_ENDIANNESS
         }
     },
 
@@ -189,8 +196,8 @@ volume_t nominal_volume = {
     1.0,
     1.0
 #else
-    UINT_MAX,
-    UINT_MAX
+    1ULL << 32,
+    1ULL << 32
 #endif
 };
 
@@ -247,6 +254,25 @@ int audio_bug (const char *funcname, int cond)
 }
 #endif
 
+static inline int audio_bits_to_index (int bits)
+{
+    switch (bits) {
+    case 8:
+        return 0;
+
+    case 16:
+        return 1;
+
+    case 32:
+        return 2;
+
+    default:
+        audio_bug ("bits_to_index", 1);
+        AUD_log (NULL, "invalid bits %d\n", bits);
+        return 0;
+    }
+}
+
 void *audio_calloc (const char *funcname, int nmemb, size_t size)
 {
     int cond;
@@ -294,7 +320,7 @@ static char *audio_alloc_prefix (const char *s)
     return r;
 }
 
-const char *audio_audfmt_to_string (audfmt_e fmt)
+static const char *audio_audfmt_to_string (audfmt_e fmt)
 {
     switch (fmt) {
     case AUD_FMT_U8:
@@ -308,13 +334,20 @@ const char *audio_audfmt_to_string (audfmt_e fmt)
 
     case AUD_FMT_S16:
         return "S16";
+
+    case AUD_FMT_U32:
+        return "U32";
+
+    case AUD_FMT_S32:
+        return "S32";
     }
 
     dolog ("Bogus audfmt %d returning S16\n", fmt);
     return "S16";
 }
 
-audfmt_e audio_string_to_audfmt (const char *s, audfmt_e defval, int *defaultp)
+static audfmt_e audio_string_to_audfmt (const char *s, audfmt_e defval,
+                                        int *defaultp)
 {
     if (!strcasecmp (s, "u8")) {
         *defaultp = 0;
@@ -324,6 +357,10 @@ audfmt_e audio_string_to_audfmt (const char *s, audfmt_e defval, int *defaultp)
         *defaultp = 0;
         return AUD_FMT_U16;
     }
+    else if (!strcasecmp (s, "u32")) {
+        *defaultp = 0;
+        return AUD_FMT_U32;
+    }
     else if (!strcasecmp (s, "s8")) {
         *defaultp = 0;
         return AUD_FMT_S8;
@@ -332,6 +369,10 @@ audfmt_e audio_string_to_audfmt (const char *s, audfmt_e defval, int *defaultp)
         *defaultp = 0;
         return AUD_FMT_S16;
     }
+    else if (!strcasecmp (s, "s32")) {
+        *defaultp = 0;
+        return AUD_FMT_S32;
+    }
     else {
         dolog ("Bogus audio format `%s' using %s\n",
                s, audio_audfmt_to_string (defval));
@@ -439,7 +480,7 @@ static void audio_print_options (const char *prefix,
         const char *state = "default";
         printf ("  %s_%s: ", uprefix, opt->name);
 
-        if (opt->overridenp && *opt->overridenp) {
+        if (opt->overriddenp && *opt->overriddenp) {
             state = "current";
         }
 
@@ -462,7 +503,7 @@ static void audio_print_options (const char *prefix,
             {
                 audfmt_e *fmtp = opt->valp;
                 printf (
-                    "format, %s = %s, (one of: U8 S8 U16 S16)\n",
+                    "format, %s = %s, (one of: U8 S8 U16 S16 U32 S32)\n",
                     state,
                     audio_audfmt_to_string (*fmtp)
                     );
@@ -569,10 +610,10 @@ static void audio_process_options (const char *prefix,
             break;
         }
 
-        if (!opt->overridenp) {
-            opt->overridenp = &opt->overriden;
+        if (!opt->overriddenp) {
+            opt->overriddenp = &opt->overridden;
         }
-        *opt->overridenp = !def;
+        *opt->overriddenp = !def;
         qemu_free (optname);
     }
 }
@@ -626,6 +667,8 @@ static int audio_validate_settings (audsettings_t *as)
     case AUD_FMT_U8:
     case AUD_FMT_S16:
     case AUD_FMT_U16:
+    case AUD_FMT_S32:
+    case AUD_FMT_U32:
         break;
     default:
         invalid = 1;
@@ -651,6 +694,11 @@ static int audio_pcm_info_eq (struct audio_pcm_info *info, audsettings_t *as)
     case AUD_FMT_U16:
         bits = 16;
         break;
+    case AUD_FMT_S32:
+        sign = 1;
+    case AUD_FMT_U32:
+        bits = 32;
+        break;
     }
     return info->freq == as->freq
         && info->nchannels == as->nchannels
@@ -661,7 +709,7 @@ static int audio_pcm_info_eq (struct audio_pcm_info *info, audsettings_t *as)
 
 void audio_pcm_init_info (struct audio_pcm_info *info, audsettings_t *as)
 {
-    int bits = 8, sign = 0;
+    int bits = 8, sign = 0, shift = 0;
 
     switch (as->fmt) {
     case AUD_FMT_S8:
@@ -673,6 +721,14 @@ void audio_pcm_init_info (struct audio_pcm_info *info, audsettings_t *as)
         sign = 1;
     case AUD_FMT_U16:
         bits = 16;
+        shift = 1;
+        break;
+
+    case AUD_FMT_S32:
+        sign = 1;
+    case AUD_FMT_U32:
+        bits = 32;
+        shift = 2;
         break;
     }
 
@@ -680,7 +736,7 @@ void audio_pcm_init_info (struct audio_pcm_info *info, audsettings_t *as)
     info->bits = bits;
     info->sign = sign;
     info->nchannels = as->nchannels;
-    info->shift = (as->nchannels == 2) + (bits == 16);
+    info->shift = (as->nchannels == 2) + shift;
     info->align = (1 << info->shift) - 1;
     info->bytes_per_second = info->freq << info->shift;
     info->swap_endianness = (as->endianness != AUDIO_HOST_ENDIANNESS);
@@ -693,25 +749,52 @@ void audio_pcm_info_clear_buf (struct audio_pcm_info *info, void *buf, int len)
     }
 
     if (info->sign) {
-        memset (buf, 0x80, len << info->shift);
+        memset (buf, 0x00, len << info->shift);
     }
     else {
-        if (info->bits == 8) {
+        switch (info->bits) {
+        case 8:
             memset (buf, 0x80, len << info->shift);
-        }
-        else {
-            int i;
-            uint16_t *p = buf;
-            int shift = info->nchannels - 1;
-            short s = INT16_MAX;
+            break;
 
-            if (info->swap_endianness) {
-                s = bswap16 (s);
+        case 16:
+            {
+                int i;
+                uint16_t *p = buf;
+                int shift = info->nchannels - 1;
+                short s = INT16_MAX;
+
+                if (info->swap_endianness) {
+                    s = bswap16 (s);
+                }
+
+                for (i = 0; i < len << shift; i++) {
+                    p[i] = s;
+                }
             }
+            break;
 
-            for (i = 0; i < len << shift; i++) {
-                p[i] = s;
+        case 32:
+            {
+                int i;
+                uint32_t *p = buf;
+                int shift = info->nchannels - 1;
+                int32_t s = INT32_MAX;
+
+                if (info->swap_endianness) {
+                    s = bswap32 (s);
+                }
+
+                for (i = 0; i < len << shift; i++) {
+                    p[i] = s;
+                }
             }
+            break;
+
+        default:
+            AUD_log (NULL, "audio_pcm_info_clear_buf: invalid bits %d\n",
+                     info->bits);
+            break;
         }
     }
 }
@@ -1508,7 +1591,7 @@ static void audio_run_capture (AudioState *s)
 
 static void audio_timer (void *opaque)
 {
-    AudioState*     s = opaque;
+    AudioState* s = opaque;
 #if 0
 #define  MAX_DIFFS  1000
     int64_t         now  = qemu_get_clock(vm_clock);
@@ -1586,7 +1669,7 @@ static struct audio_option audio_options[] = {
      "(undocumented)", NULL, 0},
 
     {"LOG_TO_MONITOR", AUD_OPT_BOOL, &conf.log_to_monitor,
-     "print logging messages to montior instead of stderr", NULL, 0},
+     "print logging messages to monitor instead of stderr", NULL, 0},
 
     {NULL, 0, NULL, NULL, NULL, 0}
 };
@@ -2011,7 +2094,7 @@ CaptureVoiceOut *AUD_add_capture (
             [hw->info.nchannels == 2]
             [hw->info.sign]
             [hw->info.swap_endianness]
-            [hw->info.bits == 16];
+            [audio_bits_to_index (hw->info.bits)];
 
         LIST_INSERT_HEAD (&s->cap_head, cap, entries);
         LIST_INSERT_HEAD (&cap->cb_head, cb, entries);
@@ -2045,16 +2128,21 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
 
             if (!cap->cb_head.lh_first) {
                 SWVoiceOut *sw = cap->hw.sw_head.lh_first, *sw1;
+
                 while (sw) {
+                    SWVoiceCap *sc = (SWVoiceCap *) sw;
 #ifdef DEBUG_CAPTURE
                     dolog ("freeing %s\n", sw->name);
 #endif
+
                     sw1 = sw->entries.le_next;
                     if (sw->rate) {
                         st_rate_stop (sw->rate);
                         sw->rate = NULL;
                     }
                     LIST_REMOVE (sw, entries);
+                    LIST_REMOVE (sc, entries);
+                    qemu_free (sc);
                     sw = sw1;
                 }
                 LIST_REMOVE (cap, entries);
@@ -2064,3 +2152,21 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
         }
     }
 }
+
+void AUD_set_volume_out (SWVoiceOut *sw, int mute, uint8_t lvol, uint8_t rvol)
+{
+    if (sw) {
+        sw->vol.mute = mute;
+        sw->vol.l = nominal_volume.l * lvol / 255;
+        sw->vol.r = nominal_volume.r * rvol / 255;
+    }
+}
+
+void AUD_set_volume_in (SWVoiceIn *sw, int mute, uint8_t lvol, uint8_t rvol)
+{
+    if (sw) {
+        sw->vol.mute = mute;
+        sw->vol.l = nominal_volume.l * lvol / 255;
+        sw->vol.r = nominal_volume.r * rvol / 255;
+    }
+}
diff --git a/audio/audio.h b/audio/audio.h
index cc7aa04..2c347bf 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -25,6 +25,7 @@
 #define QEMU_AUDIO_H
 
 #include "config.h"
+#include "qemu-common.h"
 #include "sys-queue.h"
 
 typedef void (*audio_callback_fn_t) (void *opaque, int avail);
@@ -33,7 +34,9 @@ typedef enum {
     AUD_FMT_U8,
     AUD_FMT_S8,
     AUD_FMT_U16,
-    AUD_FMT_S16
+    AUD_FMT_S16,
+    AUD_FMT_U32,
+    AUD_FMT_S32
 } audfmt_e;
 
 #ifdef WORDS_BIGENDIAN
@@ -71,7 +74,6 @@ typedef struct CaptureState {
     LIST_ENTRY (CaptureState) entries;
 } CaptureState;
 
-typedef struct AudioState AudioState;
 typedef struct SWVoiceOut SWVoiceOut;
 typedef struct CaptureVoiceOut CaptureVoiceOut;
 typedef struct SWVoiceIn SWVoiceIn;
@@ -125,6 +127,9 @@ int  AUD_is_active_out (SWVoiceOut *sw);
 void     AUD_init_time_stamp_out (SWVoiceOut *sw, QEMUAudioTimeStamp *ts);
 uint64_t AUD_get_elapsed_usec_out (SWVoiceOut *sw, QEMUAudioTimeStamp *ts);
 
+void AUD_set_volume_out (SWVoiceOut *sw, int mute, uint8_t lvol, uint8_t rvol);
+void AUD_set_volume_in (SWVoiceIn *sw, int mute, uint8_t lvol, uint8_t rvol);
+
 SWVoiceIn *AUD_open_in (
     QEMUSoundCard *card,
     SWVoiceIn *sw,
diff --git a/audio/audio_int.h b/audio/audio_int.h
index 099bcbd..6677ec1 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -24,6 +24,8 @@
 #ifndef QEMU_AUDIO_INT_H
 #define QEMU_AUDIO_INT_H
 
+#include "audio/audio.h"
+
 #ifdef CONFIG_COREAUDIO
 #define FLOAT_MIXENG
 /* #define RECIPROCAL */
@@ -44,8 +46,8 @@ struct audio_option {
     audio_option_tag_e tag;
     void *valp;
     const char *descr;
-    int *overridenp;
-    int overriden;
+    int *overriddenp;
+    int overridden;
 };
 
 struct audio_callback {
@@ -206,6 +208,7 @@ extern struct audio_driver esd_audio_driver;
 extern struct audio_driver alsa_audio_driver;
 extern struct audio_driver coreaudio_audio_driver;
 extern struct audio_driver dsound_audio_driver;
+extern struct audio_driver esd_audio_driver;
 extern volume_t nominal_volume;
 
 void audio_pcm_init_info (struct audio_pcm_info *info, audsettings_t *as);
diff --git a/audio/audio_pt_int.c b/audio/audio_pt_int.c
index 3f01762..c753774 100644
--- a/audio/audio_pt_int.c
+++ b/audio/audio_pt_int.c
@@ -1,4 +1,3 @@
-#include "vl.h"
 #include "audio.h"
 
 #define AUDIO_CAP "audio-pt"
diff --git a/audio/audio_template.h b/audio/audio_template.h
index 4575a56..6f8e166 100644
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -164,7 +164,7 @@ static int glue (audio_pcm_sw_init_, TYPE) (
         [sw->info.nchannels == 2]
         [sw->info.sign]
         [sw->info.swap_endianness]
-        [sw->info.bits == 16];
+        [audio_bits_to_index (sw->info.bits)];
 
     sw->name = qemu_strdup (name);
     err = glue (audio_pcm_sw_alloc_resources_, TYPE) (sw);
@@ -293,7 +293,7 @@ static HW *glue (audio_pcm_hw_add_new_, TYPE) (AudioState *s, audsettings_t *as)
         [hw->info.nchannels == 2]
         [hw->info.sign]
         [hw->info.swap_endianness]
-        [hw->info.bits == 16];
+        [audio_bits_to_index (hw->info.bits)];
 
     if (glue (audio_pcm_hw_alloc_resources_, TYPE) (hw)) {
         goto err1;
diff --git a/audio/coreaudio.c b/audio/coreaudio.c
index cf3eaf9..f23ebee 100644
--- a/audio/coreaudio.c
+++ b/audio/coreaudio.c
@@ -27,7 +27,7 @@
 #include <string.h>             /* strerror */
 #include <pthread.h>            /* pthread_X */
 
-#include "vl.h"
+#include "audio.h"
 
 #define AUDIO_CAP "coreaudio"
 #include "audio_int.h"
@@ -628,7 +628,6 @@ coreaudio_run_in (HWVoiceIn *hw)
     if (coreaudio_voice_lock (core, "coreaudio_run_in")) {
         return 0;
     }
-
     D("%s: core.decr=%d core.pos=%d\n", __FUNCTION__, core->decr, core->pos);
     decr        = core->decr;
     core->decr -= decr;
diff --git a/audio/dsound_template.h b/audio/dsound_template.h
index 0896b04..9cc0b9d 100644
--- a/audio/dsound_template.h
+++ b/audio/dsound_template.h
@@ -23,16 +23,20 @@
  */
 #ifdef DSBTYPE_IN
 #define NAME "capture buffer"
+#define NAME2 "DirectSoundCapture"
 #define TYPE in
 #define IFACE IDirectSoundCaptureBuffer
 #define BUFPTR LPDIRECTSOUNDCAPTUREBUFFER
 #define FIELD dsound_capture_buffer
+#define FIELD2 dsound_capture
 #else
 #define NAME "playback buffer"
+#define NAME2 "DirectSound"
 #define TYPE out
 #define IFACE IDirectSoundBuffer
 #define BUFPTR LPDIRECTSOUNDBUFFER
 #define FIELD dsound_buffer
+#define FIELD2 dsound
 #endif
 
 static int glue (dsound_unlock_, TYPE) (
@@ -192,6 +196,11 @@ static int dsound_init_out (HWVoiceOut *hw, audsettings_t *as)
     DSBCAPS bc;
 #endif
 
+    if (!s->FIELD2) {
+        dolog ("Attempt to initialize voice without " NAME2 " object\n");
+        return -1;
+    }
+
     err = waveformat_from_audio_settings (&wfx, as);
     if (err) {
         return -1;
diff --git a/audio/dsoundaudio.c b/audio/dsoundaudio.c
index 6104acb..8284067 100644
--- a/audio/dsoundaudio.c
+++ b/audio/dsoundaudio.c
@@ -26,12 +26,14 @@
  * SEAL 1.07 by Carlos 'pel' Hasan was used as documentation
  */
 
-#include "vl.h"
+#include "audio.h"
 
 #define AUDIO_CAP "dsound"
 #include "audio_int.h"
 
+#define WIN32_LEAN_AND_MEAN
 #include <windows.h>
+#include <mmsystem.h>
 #include <objbase.h>
 #include <dsound.h>
 
@@ -317,23 +319,22 @@ static int waveformat_from_audio_settings (WAVEFORMATEX *wfx, audsettings_t *as)
 
     switch (as->fmt) {
     case AUD_FMT_S8:
-        wfx->wBitsPerSample = 8;
-        break;
-
     case AUD_FMT_U8:
         wfx->wBitsPerSample = 8;
         break;
 
     case AUD_FMT_S16:
+    case AUD_FMT_U16:
         wfx->wBitsPerSample = 16;
         wfx->nAvgBytesPerSec <<= 1;
         wfx->nBlockAlign <<= 1;
         break;
 
-    case AUD_FMT_U16:
-        wfx->wBitsPerSample = 16;
-        wfx->nAvgBytesPerSec <<= 1;
-        wfx->nBlockAlign <<= 1;
+    case AUD_FMT_S32:
+    case AUD_FMT_U32:
+        wfx->wBitsPerSample = 32;
+        wfx->nAvgBytesPerSec <<= 2;
+        wfx->nBlockAlign <<= 2;
         break;
 
     default:
@@ -384,8 +385,13 @@ static int waveformat_to_audio_settings (WAVEFORMATEX *wfx, audsettings_t *as)
         as->fmt = AUD_FMT_S16;
         break;
 
+    case 32:
+        as->fmt = AUD_FMT_S32;
+        break;
+
     default:
-        dolog ("Invalid wave format, bits per sample is not 8 or 16, but %d\n",
+        dolog ("Invalid wave format, bits per sample is not "
+               "8, 16 or 32, but %d\n",
                wfx->wBitsPerSample);
         return -1;
     }
diff --git a/audio/esdaudio.c b/audio/esdaudio.c
index 35d6b45..05c030f 100644
--- a/audio/esdaudio.c
+++ b/audio/esdaudio.c
@@ -24,7 +24,6 @@
  */
 
 #include <esd.h>
-#include "vl.h"
 #include "audio.h"
 #include <signal.h>
 
@@ -33,7 +32,7 @@
 #include "audio_pt_int.h"
 #include <dlfcn.h>
 
-#include "android_debug.h"
+#include "qemu_debug.h"
 
 #define  DEBUG  1
 
@@ -494,14 +493,12 @@ static int qesd_init_in (HWVoiceIn *hw, audsettings_t *as)
         esdfmt |= ESD_BITS16;
         obt_as.fmt = AUD_FMT_S16;
         break;
-#if 0
     case AUD_FMT_S32:
     case AUD_FMT_U32:
         dolog ("Will use 16 instead of 32 bit samples\n");
         esdfmt |= ESD_BITS16;
         obt_as.fmt = AUD_FMT_S16;
         break;
-#endif
     }
     obt_as.endianness = AUDIO_HOST_ENDIANNESS;
 
diff --git a/audio/fmodaudio.c b/audio/fmodaudio.c
index 5875ba1..e230e8b 100644
--- a/audio/fmodaudio.c
+++ b/audio/fmodaudio.c
@@ -23,7 +23,7 @@
  */
 #include <fmod.h>
 #include <fmod_errors.h>
-#include "vl.h"
+#include "audio.h"
 
 #define AUDIO_CAP "fmod"
 #include "audio_int.h"
diff --git a/audio/mixeng.c b/audio/mixeng.c
index 6308d41..34fc6df 100644
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -22,7 +22,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "audio.h"
 
 #define AUDIO_CAP "mixeng"
 #include "audio_int.h"
@@ -82,6 +82,7 @@
 #undef IN_T
 #undef SHIFT
 
+/* Unsigned 16 bit */
 #define IN_T uint16_t
 #define IN_MIN 0
 #define IN_MAX USHRT_MAX
@@ -101,26 +102,72 @@
 #undef IN_T
 #undef SHIFT
 
-t_sample *mixeng_conv[2][2][2][2] = {
+/* Signed 32 bit */
+#define IN_T int32_t
+#define IN_MIN INT32_MIN
+#define IN_MAX INT32_MAX
+#define SIGNED
+#define SHIFT 32
+#define ENDIAN_CONVERSION natural
+#define ENDIAN_CONVERT(v) (v)
+#include "mixeng_template.h"
+#undef ENDIAN_CONVERT
+#undef ENDIAN_CONVERSION
+#define ENDIAN_CONVERSION swap
+#define ENDIAN_CONVERT(v) bswap32 (v)
+#include "mixeng_template.h"
+#undef ENDIAN_CONVERT
+#undef ENDIAN_CONVERSION
+#undef SIGNED
+#undef IN_MAX
+#undef IN_MIN
+#undef IN_T
+#undef SHIFT
+
+/* Unsigned 16 bit */
+#define IN_T uint32_t
+#define IN_MIN 0
+#define IN_MAX UINT32_MAX
+#define SHIFT 32
+#define ENDIAN_CONVERSION natural
+#define ENDIAN_CONVERT(v) (v)
+#include "mixeng_template.h"
+#undef ENDIAN_CONVERT
+#undef ENDIAN_CONVERSION
+#define ENDIAN_CONVERSION swap
+#define ENDIAN_CONVERT(v) bswap32 (v)
+#include "mixeng_template.h"
+#undef ENDIAN_CONVERT
+#undef ENDIAN_CONVERSION
+#undef IN_MAX
+#undef IN_MIN
+#undef IN_T
+#undef SHIFT
+
+t_sample *mixeng_conv[2][2][2][3] = {
     {
         {
             {
                 conv_natural_uint8_t_to_mono,
-                conv_natural_uint16_t_to_mono
+                conv_natural_uint16_t_to_mono,
+                conv_natural_uint32_t_to_mono
             },
             {
                 conv_natural_uint8_t_to_mono,
-                conv_swap_uint16_t_to_mono
+                conv_swap_uint16_t_to_mono,
+                conv_swap_uint32_t_to_mono,
             }
         },
         {
             {
                 conv_natural_int8_t_to_mono,
-                conv_natural_int16_t_to_mono
+                conv_natural_int16_t_to_mono,
+                conv_natural_int32_t_to_mono
             },
             {
                 conv_natural_int8_t_to_mono,
-                conv_swap_int16_t_to_mono
+                conv_swap_int16_t_to_mono,
+                conv_swap_int32_t_to_mono
             }
         }
     },
@@ -128,46 +175,54 @@ t_sample *mixeng_conv[2][2][2][2] = {
         {
             {
                 conv_natural_uint8_t_to_stereo,
-                conv_natural_uint16_t_to_stereo
+                conv_natural_uint16_t_to_stereo,
+                conv_natural_uint32_t_to_stereo
             },
             {
                 conv_natural_uint8_t_to_stereo,
-                conv_swap_uint16_t_to_stereo
+                conv_swap_uint16_t_to_stereo,
+                conv_swap_uint32_t_to_stereo
             }
         },
         {
             {
                 conv_natural_int8_t_to_stereo,
-                conv_natural_int16_t_to_stereo
+                conv_natural_int16_t_to_stereo,
+                conv_natural_int32_t_to_stereo
             },
             {
                 conv_natural_int8_t_to_stereo,
-                conv_swap_int16_t_to_stereo
+                conv_swap_int16_t_to_stereo,
+                conv_swap_int32_t_to_stereo,
             }
         }
     }
 };
 
-f_sample *mixeng_clip[2][2][2][2] = {
+f_sample *mixeng_clip[2][2][2][3] = {
     {
         {
             {
                 clip_natural_uint8_t_from_mono,
-                clip_natural_uint16_t_from_mono
+                clip_natural_uint16_t_from_mono,
+                clip_natural_uint32_t_from_mono
             },
             {
                 clip_natural_uint8_t_from_mono,
-                clip_swap_uint16_t_from_mono
+                clip_swap_uint16_t_from_mono,
+                clip_swap_uint32_t_from_mono
             }
         },
         {
             {
                 clip_natural_int8_t_from_mono,
-                clip_natural_int16_t_from_mono
+                clip_natural_int16_t_from_mono,
+                clip_natural_int32_t_from_mono
             },
             {
                 clip_natural_int8_t_from_mono,
-                clip_swap_int16_t_from_mono
+                clip_swap_int16_t_from_mono,
+                clip_swap_int32_t_from_mono
             }
         }
     },
@@ -175,21 +230,25 @@ f_sample *mixeng_clip[2][2][2][2] = {
         {
             {
                 clip_natural_uint8_t_from_stereo,
-                clip_natural_uint16_t_from_stereo
+                clip_natural_uint16_t_from_stereo,
+                clip_natural_uint32_t_from_stereo
             },
             {
                 clip_natural_uint8_t_from_stereo,
-                clip_swap_uint16_t_from_stereo
+                clip_swap_uint16_t_from_stereo,
+                clip_swap_uint32_t_from_stereo
             }
         },
         {
             {
                 clip_natural_int8_t_from_stereo,
-                clip_natural_int16_t_from_stereo
+                clip_natural_int16_t_from_stereo,
+                clip_natural_int32_t_from_stereo
             },
             {
                 clip_natural_int8_t_from_stereo,
-                clip_swap_int16_t_from_stereo
+                clip_swap_int16_t_from_stereo,
+                clip_swap_int32_t_from_stereo
             }
         }
     }
diff --git a/audio/mixeng.h b/audio/mixeng.h
index 9e3bac1..95b68df 100644
--- a/audio/mixeng.h
+++ b/audio/mixeng.h
@@ -37,8 +37,8 @@ typedef void (t_sample) (st_sample_t *dst, const void *src,
                          int samples, volume_t *vol);
 typedef void (f_sample) (void *dst, const st_sample_t *src, int samples);
 
-extern t_sample *mixeng_conv[2][2][2][2];
-extern f_sample *mixeng_clip[2][2][2][2];
+extern t_sample *mixeng_conv[2][2][2][3];
+extern f_sample *mixeng_clip[2][2][2][3];
 
 void *st_rate_start (int inrate, int outrate);
 void st_rate_flow (void *opaque, st_sample_t *ibuf, st_sample_t *obuf,
diff --git a/audio/noaudio.c b/audio/noaudio.c
index 3567e9c..8788a41 100644
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-timer.h"
 
 #define AUDIO_CAP "noaudio"
 #include "audio_int.h"
diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index 17d676a..2ccaade 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -25,7 +25,6 @@
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <sys/soundcard.h>
-#include "vl.h"
 
 #define AUDIO_CAP "oss"
 #include "audio_int.h"
diff --git a/audio/sdlaudio.c b/audio/sdlaudio.c
index eb353d7..ea5bccd 100644
--- a/audio/sdlaudio.c
+++ b/audio/sdlaudio.c
@@ -23,7 +23,6 @@
  */
 #include <SDL.h>
 #include <SDL_thread.h>
-#include "vl.h"
 
 #ifndef _WIN32
 #ifdef __sun__
diff --git a/audio/wavaudio.c b/audio/wavaudio.c
index 7d4fed1..8a500b9 100644
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -22,10 +22,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
-
 #define AUDIO_CAP "wav"
+#include "qemu-timer.h"
 #include "audio_int.h"
+#include "qemu_file.h"
 
 #define  WAV_AUDIO_IN  1
 
@@ -46,7 +46,8 @@ static struct {
     {
         44100,
         2,
-        AUD_FMT_S16
+        AUD_FMT_S16,
+        0
     },
     "qemu.wav"
 };
@@ -136,6 +137,11 @@ static int wav_out_init (HWVoiceOut *hw, audsettings_t *as)
     case AUD_FMT_U16:
         bits16 = 1;
         break;
+
+    case AUD_FMT_S32:
+    case AUD_FMT_U32:
+        dolog ("WAVE files can not handle 32bit formats\n");
+        return -1;
     }
 
     hdr[34] = bits16 ? 0x10 : 0x08;
@@ -156,7 +162,7 @@ static int wav_out_init (HWVoiceOut *hw, audsettings_t *as)
     le_store (hdr + 28, hw->info.freq << (bits16 + stereo), 4);
     le_store (hdr + 32, 1 << (bits16 + stereo), 2);
 
-    wav->f = fopen (conf_out.wav_path, "wb");
+    wav->f = qemu_fopen (conf_out.wav_path, "wb");
     if (!wav->f) {
         dolog ("Failed to open wave file `%s'\nReason: %s\n",
                conf_out.wav_path, strerror (errno));
@@ -190,7 +196,7 @@ static void wav_out_fini (HWVoiceOut *hw)
     qemu_fseek (wav->f, 32, SEEK_CUR);
     qemu_put_buffer (wav->f, dlen, 4);
 
-    fclose (wav->f);
+    qemu_fclose (wav->f);
     wav->f = NULL;
 
     qemu_free (wav->pcm_buf);
@@ -247,7 +253,7 @@ wav_in_init (HWVoiceIn *hw, audsettings_t *as)
     audsettings_t wav_as = *as;
     int           nchannels, freq, format, bits;
 
-    wav->f = fopen (path, "rb");
+    wav->f = qemu_fopen (path, "rb");
     if (wav->f == NULL) {
         dolog("Failed to open wave file '%s'\nReason: %s\n", path,
               strerror(errno));
@@ -316,7 +322,7 @@ wav_in_init (HWVoiceIn *hw, audsettings_t *as)
     return 0;
 
 Fail:
-    fclose (wav->f);
+    qemu_fclose (wav->f);
     wav->f = NULL;
     return -1;
 }
@@ -330,7 +336,7 @@ static void wav_in_fini (HWVoiceIn *hw)
         return;
     }
 
-    fclose (wav->f);
+    qemu_fclose (wav->f);
     wav->f = NULL;
 
     qemu_free (wav->pcm_buf);
diff --git a/audio/wavcapture.c b/audio/wavcapture.c
index 748b580..d6f733e 100644
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -1,4 +1,6 @@
-#include "vl.h"
+#include "audio/audio.h"
+#include "qemu_file.h"
+#include "console.h"
 
 typedef struct {
     QEMUFile *f;
@@ -46,7 +48,7 @@ static void wav_destroy (void *opaque)
 
     qemu_fseek (wav->f, 32, SEEK_CUR);
     qemu_put_buffer (wav->f, dlen, 4);
-    fclose (wav->f);
+    qemu_fclose (wav->f);
     if (wav->path) {
         qemu_free (wav->path);
     }
@@ -133,7 +135,7 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
     le_store (hdr + 28, freq << shift, 4);
     le_store (hdr + 32, 1 << shift, 2);
 
-    wav->f = fopen (path, "wb");
+    wav->f = qemu_fopen (path, "wb");
     if (!wav->f) {
         term_printf ("Failed to open wave file `%s'\nReason: %s\n",
                      path, strerror (errno));
@@ -151,6 +153,8 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
     cap = AUD_add_capture (NULL, &as, &ops, wav);
     if (!cap) {
         term_printf ("Failed to add audio capture\n");
+        qemu_free (wav->path);
+        qemu_fclose (wav->f);
         qemu_free (wav);
         return -1;
     }
diff --git a/audio/winaudio.c b/audio/winaudio.c
index 63cd351..6e8daef 100644
--- a/audio/winaudio.c
+++ b/audio/winaudio.c
@@ -1,7 +1,7 @@
 /*

  * QEMU "simple" Windows audio driver

  *

- * Copyright (c) 2007 The Android Open Source Project
+ * Copyright (c) 2007 The Android Open Source Project

  *

  * Permission is hereby granted, free of charge, to any person obtaining a copy

  * of this software and associated documentation files (the "Software"), to deal

@@ -21,8 +21,6 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

  * THE SOFTWARE.

  */

-#include "vl.h"

-

 #define WIN32_LEAN_AND_MEAN

 #include <windows.h>

 #include <mmsystem.h>

diff --git a/block-bochs.c b/block-bochs.c
new file mode 100644
index 0000000..b167e0b
--- /dev/null
+++ b/block-bochs.c
@@ -0,0 +1,254 @@
+/*
+ * Block driver for the various disk image formats used by Bochs
+ * Currently only for "growing" type in read-only mode
+ *
+ * Copyright (c) 2005 Alex Beregszaszi
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu-common.h"
+#include "block_int.h"
+
+/**************************************************************/
+
+#define HEADER_MAGIC "Bochs Virtual HD Image"
+#define HEADER_VERSION 0x00020000
+#define HEADER_V1 0x00010000
+#define HEADER_SIZE 512
+
+#define REDOLOG_TYPE "Redolog"
+#define GROWING_TYPE "Growing"
+
+// not allocated: 0xffffffff
+
+// always little-endian
+struct bochs_header_v1 {
+    char magic[32]; // "Bochs Virtual HD Image"
+    char type[16]; // "Redolog"
+    char subtype[16]; // "Undoable" / "Volatile" / "Growing"
+    uint32_t version;
+    uint32_t header; // size of header
+
+    union {
+	struct {
+	    uint32_t catalog; // num of entries
+	    uint32_t bitmap; // bitmap size
+	    uint32_t extent; // extent size
+	    uint64_t disk; // disk size
+	    char padding[HEADER_SIZE - 64 - 8 - 20];
+	} redolog;
+	char padding[HEADER_SIZE - 64 - 8];
+    } extra;
+};
+
+// always little-endian
+struct bochs_header {
+    char magic[32]; // "Bochs Virtual HD Image"
+    char type[16]; // "Redolog"
+    char subtype[16]; // "Undoable" / "Volatile" / "Growing"
+    uint32_t version;
+    uint32_t header; // size of header
+
+    union {
+	struct {
+	    uint32_t catalog; // num of entries
+	    uint32_t bitmap; // bitmap size
+	    uint32_t extent; // extent size
+	    uint32_t reserved; // for ???
+	    uint64_t disk; // disk size
+	    char padding[HEADER_SIZE - 64 - 8 - 24];
+	} redolog;
+	char padding[HEADER_SIZE - 64 - 8];
+    } extra;
+};
+
+typedef struct BDRVBochsState {
+    int fd;
+
+    uint32_t *catalog_bitmap;
+    int catalog_size;
+
+    int data_offset;
+
+    int bitmap_blocks;
+    int extent_blocks;
+    int extent_size;
+} BDRVBochsState;
+
+static int bochs_probe(const uint8_t *buf, int buf_size, const char *filename)
+{
+    const struct bochs_header *bochs = (const void *)buf;
+
+    if (buf_size < HEADER_SIZE)
+	return 0;
+
+    if (!strcmp(bochs->magic, HEADER_MAGIC) &&
+	!strcmp(bochs->type, REDOLOG_TYPE) &&
+	!strcmp(bochs->subtype, GROWING_TYPE) &&
+	((le32_to_cpu(bochs->version) == HEADER_VERSION) ||
+	(le32_to_cpu(bochs->version) == HEADER_V1)))
+	return 100;
+
+    return 0;
+}
+
+static int bochs_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVBochsState *s = bs->opaque;
+    int fd, i;
+    struct bochs_header bochs;
+    struct bochs_header_v1 header_v1;
+
+    fd = open(filename, O_RDWR | O_BINARY);
+    if (fd < 0) {
+        fd = open(filename, O_RDONLY | O_BINARY);
+        if (fd < 0)
+            return -1;
+    }
+
+    bs->read_only = 1; // no write support yet
+
+    s->fd = fd;
+
+    if (read(fd, &bochs, sizeof(bochs)) != sizeof(bochs)) {
+        goto fail;
+    }
+
+    if (strcmp(bochs.magic, HEADER_MAGIC) ||
+        strcmp(bochs.type, REDOLOG_TYPE) ||
+        strcmp(bochs.subtype, GROWING_TYPE) ||
+	((le32_to_cpu(bochs.version) != HEADER_VERSION) &&
+	(le32_to_cpu(bochs.version) != HEADER_V1))) {
+        goto fail;
+    }
+
+    if (le32_to_cpu(bochs.version) == HEADER_V1) {
+      memcpy(&header_v1, &bochs, sizeof(bochs));
+      bs->total_sectors = le64_to_cpu(header_v1.extra.redolog.disk) / 512;
+    } else {
+      bs->total_sectors = le64_to_cpu(bochs.extra.redolog.disk) / 512;
+    }
+
+    lseek(s->fd, le32_to_cpu(bochs.header), SEEK_SET);
+
+    s->catalog_size = le32_to_cpu(bochs.extra.redolog.catalog);
+    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
+    if (!s->catalog_bitmap)
+	goto fail;
+    if (read(s->fd, s->catalog_bitmap, s->catalog_size * 4) !=
+	s->catalog_size * 4)
+	goto fail;
+    for (i = 0; i < s->catalog_size; i++)
+	le32_to_cpus(&s->catalog_bitmap[i]);
+
+    s->data_offset = le32_to_cpu(bochs.header) + (s->catalog_size * 4);
+
+    s->bitmap_blocks = 1 + (le32_to_cpu(bochs.extra.redolog.bitmap) - 1) / 512;
+    s->extent_blocks = 1 + (le32_to_cpu(bochs.extra.redolog.extent) - 1) / 512;
+
+    s->extent_size = le32_to_cpu(bochs.extra.redolog.extent);
+
+    return 0;
+ fail:
+    close(fd);
+    return -1;
+}
+
+static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num)
+{
+    BDRVBochsState *s = bs->opaque;
+    int64_t offset = sector_num * 512;
+    int64_t extent_index, extent_offset, bitmap_offset, block_offset;
+    char bitmap_entry;
+
+    // seek to sector
+    extent_index = offset / s->extent_size;
+    extent_offset = (offset % s->extent_size) / 512;
+
+    if (s->catalog_bitmap[extent_index] == 0xffffffff)
+    {
+//	fprintf(stderr, "page not allocated [%x - %x:%x]\n",
+//	    sector_num, extent_index, extent_offset);
+	return -1; // not allocated
+    }
+
+    bitmap_offset = s->data_offset + (512 * s->catalog_bitmap[extent_index] *
+	(s->extent_blocks + s->bitmap_blocks));
+    block_offset = bitmap_offset + (512 * (s->bitmap_blocks + extent_offset));
+
+//    fprintf(stderr, "sect: %x [ext i: %x o: %x] -> %x bitmap: %x block: %x\n",
+//	sector_num, extent_index, extent_offset,
+//	le32_to_cpu(s->catalog_bitmap[extent_index]),
+//	bitmap_offset, block_offset);
+
+    // read in bitmap for current extent
+    lseek(s->fd, bitmap_offset + (extent_offset / 8), SEEK_SET);
+
+    read(s->fd, &bitmap_entry, 1);
+
+    if (!((bitmap_entry >> (extent_offset % 8)) & 1))
+    {
+//	fprintf(stderr, "sector (%x) in bitmap not allocated\n",
+//	    sector_num);
+	return -1; // not allocated
+    }
+
+    lseek(s->fd, block_offset, SEEK_SET);
+
+    return 0;
+}
+
+static int bochs_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
+{
+    BDRVBochsState *s = bs->opaque;
+    int ret;
+
+    while (nb_sectors > 0) {
+	if (!seek_to_sector(bs, sector_num))
+	{
+	    ret = read(s->fd, buf, 512);
+	    if (ret != 512)
+		return -1;
+	}
+	else
+            memset(buf, 0, 512);
+        nb_sectors--;
+        sector_num++;
+        buf += 512;
+    }
+    return 0;
+}
+
+static void bochs_close(BlockDriverState *bs)
+{
+    BDRVBochsState *s = bs->opaque;
+    qemu_free(s->catalog_bitmap);
+    close(s->fd);
+}
+
+BlockDriver bdrv_bochs = {
+    "bochs",
+    sizeof(BDRVBochsState),
+    bochs_probe,
+    bochs_open,
+    bochs_read,
+    NULL,
+    bochs_close,
+};
diff --git a/block-cloop.c b/block-cloop.c
index c617e1b..43d3801 100644
--- a/block-cloop.c
+++ b/block-cloop.c
@@ -1,8 +1,8 @@
 /*
  * QEMU Block driver for CLOOP images
- * 
+ *
  * Copyright (c) 2004 Johannes E. Schindelin
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <zlib.h>
 
@@ -50,14 +50,14 @@ static int cloop_probe(const uint8_t *buf, int buf_size, const char *filename)
     return 0;
 }
 
-static int cloop_open(BlockDriverState *bs, const char *filename)
+static int cloop_open(BlockDriverState *bs, const char *filename, int flags)
 {
     BDRVCloopState *s = bs->opaque;
     uint32_t offsets_size,max_compressed_block_size=1,i;
 
-    s->fd = open(filename, O_RDONLY | O_BINARY | O_LARGEFILE);
+    s->fd = open(filename, O_RDONLY | O_BINARY);
     if (s->fd < 0)
-        return -1;
+        return -errno;
     bs->read_only = 1;
 
     /* read header */
@@ -96,7 +96,7 @@ cloop_close:
     if(inflateInit(&s->zstream) != Z_OK)
 	goto cloop_close;
     s->current_block=s->n_blocks;
-    
+
     s->sectors_per_block = s->block_size/512;
     bs->total_sectors = s->n_blocks*s->sectors_per_block;
     return 0;
@@ -107,12 +107,12 @@ static inline int cloop_read_block(BDRVCloopState *s,int block_num)
     if(s->current_block != block_num) {
 	int ret;
         uint32_t bytes = s->offsets[block_num+1]-s->offsets[block_num];
-	    
+
 	lseek(s->fd, s->offsets[block_num], SEEK_SET);
         ret = read(s->fd, s->compressed_block, bytes);
-        if (ret != bytes) 
+        if (ret != bytes)
             return -1;
-	
+
 	s->zstream.next_in = s->compressed_block;
 	s->zstream.avail_in = bytes;
 	s->zstream.next_out = s->uncompressed_block;
@@ -123,13 +123,13 @@ static inline int cloop_read_block(BDRVCloopState *s,int block_num)
 	ret = inflate(&s->zstream, Z_FINISH);
 	if(ret != Z_STREAM_END || s->zstream.total_out != s->block_size)
 	    return -1;
-	
+
 	s->current_block = block_num;
     }
     return 0;
 }
 
-static int cloop_read(BlockDriverState *bs, int64_t sector_num, 
+static int cloop_read(BlockDriverState *bs, int64_t sector_num,
                     uint8_t *buf, int nb_sectors)
 {
     BDRVCloopState *s = bs->opaque;
diff --git a/block-cow.c b/block-cow.c
new file mode 100644
index 0000000..9e7b646
--- /dev/null
+++ b/block-cow.c
@@ -0,0 +1,267 @@
+/*
+ * Block driver for the COW format
+ *
+ * Copyright (c) 2004 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#ifndef _WIN32
+#include "qemu-common.h"
+#include "block_int.h"
+#include <sys/mman.h>
+
+/**************************************************************/
+/* COW block driver using file system holes */
+
+/* user mode linux compatible COW file */
+#define COW_MAGIC 0x4f4f4f4d  /* MOOO */
+#define COW_VERSION 2
+
+struct cow_header_v2 {
+    uint32_t magic;
+    uint32_t version;
+    char backing_file[1024];
+    int32_t mtime;
+    uint64_t size;
+    uint32_t sectorsize;
+};
+
+typedef struct BDRVCowState {
+    int fd;
+    uint8_t *cow_bitmap; /* if non NULL, COW mappings are used first */
+    uint8_t *cow_bitmap_addr; /* mmap address of cow_bitmap */
+    int cow_bitmap_size;
+    int64_t cow_sectors_offset;
+} BDRVCowState;
+
+static int cow_probe(const uint8_t *buf, int buf_size, const char *filename)
+{
+    const struct cow_header_v2 *cow_header = (const void *)buf;
+
+    if (buf_size >= sizeof(struct cow_header_v2) &&
+        be32_to_cpu(cow_header->magic) == COW_MAGIC &&
+        be32_to_cpu(cow_header->version) == COW_VERSION)
+        return 100;
+    else
+        return 0;
+}
+
+static int cow_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVCowState *s = bs->opaque;
+    int fd;
+    struct cow_header_v2 cow_header;
+    int64_t size;
+
+    fd = open(filename, O_RDWR | O_BINARY | O_LARGEFILE);
+    if (fd < 0) {
+        fd = open(filename, O_RDONLY | O_BINARY | O_LARGEFILE);
+        if (fd < 0)
+            return -1;
+    }
+    s->fd = fd;
+    /* see if it is a cow image */
+    if (read(fd, &cow_header, sizeof(cow_header)) != sizeof(cow_header)) {
+        goto fail;
+    }
+
+    if (be32_to_cpu(cow_header.magic) != COW_MAGIC ||
+        be32_to_cpu(cow_header.version) != COW_VERSION) {
+        goto fail;
+    }
+
+    /* cow image found */
+    size = be64_to_cpu(cow_header.size);
+    bs->total_sectors = size / 512;
+
+    pstrcpy(bs->backing_file, sizeof(bs->backing_file),
+            cow_header.backing_file);
+
+    /* mmap the bitmap */
+    s->cow_bitmap_size = ((bs->total_sectors + 7) >> 3) + sizeof(cow_header);
+    s->cow_bitmap_addr = mmap(get_mmap_addr(s->cow_bitmap_size),
+                              s->cow_bitmap_size,
+                              PROT_READ | PROT_WRITE,
+                              MAP_SHARED, s->fd, 0);
+    if (s->cow_bitmap_addr == MAP_FAILED)
+        goto fail;
+    s->cow_bitmap = s->cow_bitmap_addr + sizeof(cow_header);
+    s->cow_sectors_offset = (s->cow_bitmap_size + 511) & ~511;
+    return 0;
+ fail:
+    close(fd);
+    return -1;
+}
+
+static inline void cow_set_bit(uint8_t *bitmap, int64_t bitnum)
+{
+    bitmap[bitnum / 8] |= (1 << (bitnum%8));
+}
+
+static inline int is_bit_set(const uint8_t *bitmap, int64_t bitnum)
+{
+    return !!(bitmap[bitnum / 8] & (1 << (bitnum%8)));
+}
+
+
+/* Return true if first block has been changed (ie. current version is
+ * in COW file).  Set the number of continuous blocks for which that
+ * is true. */
+static inline int is_changed(uint8_t *bitmap,
+                             int64_t sector_num, int nb_sectors,
+                             int *num_same)
+{
+    int changed;
+
+    if (!bitmap || nb_sectors == 0) {
+	*num_same = nb_sectors;
+	return 0;
+    }
+
+    changed = is_bit_set(bitmap, sector_num);
+    for (*num_same = 1; *num_same < nb_sectors; (*num_same)++) {
+	if (is_bit_set(bitmap, sector_num + *num_same) != changed)
+	    break;
+    }
+
+    return changed;
+}
+
+static int cow_is_allocated(BlockDriverState *bs, int64_t sector_num,
+                            int nb_sectors, int *pnum)
+{
+    BDRVCowState *s = bs->opaque;
+    return is_changed(s->cow_bitmap, sector_num, nb_sectors, pnum);
+}
+
+static int cow_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
+{
+    BDRVCowState *s = bs->opaque;
+    int ret, n;
+
+    while (nb_sectors > 0) {
+        if (is_changed(s->cow_bitmap, sector_num, nb_sectors, &n)) {
+            lseek(s->fd, s->cow_sectors_offset + sector_num * 512, SEEK_SET);
+            ret = read(s->fd, buf, n * 512);
+            if (ret != n * 512)
+                return -1;
+        } else {
+            if (bs->backing_hd) {
+                /* read from the base image */
+                ret = bdrv_read(bs->backing_hd, sector_num, buf, n);
+                if (ret < 0)
+                    return -1;
+            } else {
+            memset(buf, 0, n * 512);
+        }
+        }
+        nb_sectors -= n;
+        sector_num += n;
+        buf += n * 512;
+    }
+    return 0;
+}
+
+static int cow_write(BlockDriverState *bs, int64_t sector_num,
+                     const uint8_t *buf, int nb_sectors)
+{
+    BDRVCowState *s = bs->opaque;
+    int ret, i;
+
+    lseek(s->fd, s->cow_sectors_offset + sector_num * 512, SEEK_SET);
+    ret = write(s->fd, buf, nb_sectors * 512);
+    if (ret != nb_sectors * 512)
+        return -1;
+    for (i = 0; i < nb_sectors; i++)
+        cow_set_bit(s->cow_bitmap, sector_num + i);
+    return 0;
+}
+
+static void cow_close(BlockDriverState *bs)
+{
+    BDRVCowState *s = bs->opaque;
+    munmap(s->cow_bitmap_addr, s->cow_bitmap_size);
+    close(s->fd);
+}
+
+static int cow_create(const char *filename, int64_t image_sectors,
+                      const char *image_filename, int flags)
+{
+    int fd, cow_fd;
+    struct cow_header_v2 cow_header;
+    struct stat st;
+
+    if (flags)
+        return -ENOTSUP;
+
+    cow_fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
+              0644);
+    if (cow_fd < 0)
+        return -1;
+    memset(&cow_header, 0, sizeof(cow_header));
+    cow_header.magic = cpu_to_be32(COW_MAGIC);
+    cow_header.version = cpu_to_be32(COW_VERSION);
+    if (image_filename) {
+        /* Note: if no file, we put a dummy mtime */
+        cow_header.mtime = cpu_to_be32(0);
+
+        fd = open(image_filename, O_RDONLY | O_BINARY);
+        if (fd < 0) {
+            close(cow_fd);
+            goto mtime_fail;
+        }
+        if (fstat(fd, &st) != 0) {
+            close(fd);
+            goto mtime_fail;
+        }
+        close(fd);
+        cow_header.mtime = cpu_to_be32(st.st_mtime);
+    mtime_fail:
+        pstrcpy(cow_header.backing_file, sizeof(cow_header.backing_file),
+                image_filename);
+    }
+    cow_header.sectorsize = cpu_to_be32(512);
+    cow_header.size = cpu_to_be64(image_sectors * 512);
+    write(cow_fd, &cow_header, sizeof(cow_header));
+    /* resize to include at least all the bitmap */
+    ftruncate(cow_fd, sizeof(cow_header) + ((image_sectors + 7) >> 3));
+    close(cow_fd);
+    return 0;
+}
+
+static void cow_flush(BlockDriverState *bs)
+{
+    BDRVCowState *s = bs->opaque;
+    fsync(s->fd);
+}
+
+BlockDriver bdrv_cow = {
+    "cow",
+    sizeof(BDRVCowState),
+    cow_probe,
+    cow_open,
+    cow_read,
+    cow_write,
+    cow_close,
+    cow_create,
+    cow_flush,
+    cow_is_allocated,
+};
+#endif
diff --git a/block-dmg.c b/block-dmg.c
index a16ab92..8c9d0da 100644
--- a/block-dmg.c
+++ b/block-dmg.c
@@ -1,8 +1,8 @@
 /*
  * QEMU Block driver for DMG images
- * 
+ *
  * Copyright (c) 2004 Johannes E. Schindelin
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -21,14 +21,14 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include "bswap.h"
 #include <zlib.h>
 
 typedef struct BDRVDMGState {
     int fd;
-    
+
     /* each chunk contains a certain number of sectors,
      * offsets[i] is the offset in the .dmg file,
      * lengths[i] is the length of the compressed chunk,
@@ -73,27 +73,27 @@ static off_t read_uint32(int fd)
 	return be32_to_cpu(buffer);
 }
 
-static int dmg_open(BlockDriverState *bs, const char *filename)
+static int dmg_open(BlockDriverState *bs, const char *filename, int flags)
 {
     BDRVDMGState *s = bs->opaque;
     off_t info_begin,info_end,last_in_offset,last_out_offset;
     uint32_t count;
     uint32_t max_compressed_size=1,max_sectors_per_chunk=1,i;
 
-    s->fd = open(filename, O_RDONLY | O_BINARY | O_LARGEFILE);
+    s->fd = open(filename, O_RDONLY | O_BINARY);
     if (s->fd < 0)
-        return -1;
+        return -errno;
     bs->read_only = 1;
     s->n_chunks = 0;
     s->offsets = s->lengths = s->sectors = s->sectorcounts = 0;
-    
+
     /* read offset of info blocks */
     if(lseek(s->fd,-0x1d8,SEEK_END)<0) {
 dmg_close:
 	close(s->fd);
 	/* open raw instead */
 	bs->drv=&bdrv_raw;
-	return bs->drv->bdrv_open(bs,filename);
+	return bs->drv->bdrv_open(bs, filename, flags);
     }
     info_begin=read_off(s->fd);
     if(info_begin==0)
@@ -125,11 +125,11 @@ dmg_close:
 	        goto dmg_close;
 	    chunk_count = (count-204)/40;
 	    new_size = sizeof(uint64_t) * (s->n_chunks + chunk_count);
-	    s->types = realloc(s->types, new_size/2);
-	    s->offsets = realloc(s->offsets, new_size);
-	    s->lengths = realloc(s->lengths, new_size);
-	    s->sectors = realloc(s->sectors, new_size);
-	    s->sectorcounts = realloc(s->sectorcounts, new_size);
+	    s->types = qemu_realloc(s->types, new_size/2);
+	    s->offsets = qemu_realloc(s->offsets, new_size);
+	    s->lengths = qemu_realloc(s->lengths, new_size);
+	    s->sectors = qemu_realloc(s->sectors, new_size);
+	    s->sectorcounts = qemu_realloc(s->sectorcounts, new_size);
 
 	    for(i=s->n_chunks;i<s->n_chunks+chunk_count;i++) {
 		s->types[i] = read_uint32(s->fd);
@@ -167,7 +167,7 @@ dmg_close:
 	goto dmg_close;
 
     s->current_chunk = s->n_chunks;
-    
+
     return 0;
 }
 
@@ -227,7 +227,7 @@ static inline int dmg_read_chunk(BDRVDMGState *s,int sector_num)
 
 	    if (ret != s->lengths[chunk])
 		return -1;
-	
+
 	    s->zstream.next_in = s->compressed_chunk;
 	    s->zstream.avail_in = s->lengths[chunk];
 	    s->zstream.next_out = s->uncompressed_chunk;
@@ -253,7 +253,7 @@ static inline int dmg_read_chunk(BDRVDMGState *s,int sector_num)
     return 0;
 }
 
-static int dmg_read(BlockDriverState *bs, int64_t sector_num, 
+static int dmg_read(BlockDriverState *bs, int64_t sector_num,
                     uint8_t *buf, int nb_sectors)
 {
     BDRVDMGState *s = bs->opaque;
diff --git a/block-nbd.c b/block-nbd.c
new file mode 100644
index 0000000..5b6cc4f
--- /dev/null
+++ b/block-nbd.c
@@ -0,0 +1,189 @@
+/*
+ * QEMU Block driver for  NBD
+ *
+ * Copyright (C) 2008 Bull S.A.S.
+ *     Author: Laurent Vivier <Laurent.Vivier@bull.net>
+ *
+ * Some parts:
+ *    Copyright (C) 2007 Anthony Liguori <anthony@codemonkey.ws>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu-common.h"
+#include "nbd.h"
+
+#include <sys/types.h>
+#include <unistd.h>
+
+typedef struct BDRVNBDState {
+    int sock;
+    off_t size;
+    size_t blocksize;
+} BDRVNBDState;
+
+static int nbd_open(BlockDriverState *bs, const char* filename, int flags)
+{
+    BDRVNBDState *s = bs->opaque;
+    const char *host;
+    const char *unixpath;
+    int sock;
+    off_t size;
+    size_t blocksize;
+    int ret;
+
+    if ((flags & BDRV_O_CREAT))
+        return -EINVAL;
+
+    if (!strstart(filename, "nbd:", &host))
+        return -EINVAL;
+
+    if (strstart(host, "unix:", &unixpath)) {
+
+        if (unixpath[0] != '/')
+            return -EINVAL;
+
+        sock = unix_socket_outgoing(unixpath);
+
+    } else {
+        uint16_t port;
+        char *p, *r;
+        char hostname[128];
+
+        pstrcpy(hostname, 128, host);
+
+        p = strchr(hostname, ':');
+        if (p == NULL)
+            return -EINVAL;
+
+        *p = '\0';
+        p++;
+
+        port = strtol(p, &r, 0);
+        if (r == p)
+            return -EINVAL;
+        sock = tcp_socket_outgoing(hostname, port);
+    }
+
+    if (sock == -1)
+        return -errno;
+
+    ret = nbd_receive_negotiate(sock, &size, &blocksize);
+    if (ret == -1)
+        return -errno;
+
+    s->sock = sock;
+    s->size = size;
+    s->blocksize = blocksize;
+
+    return 0;
+}
+
+static int nbd_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
+{
+    BDRVNBDState *s = bs->opaque;
+    struct nbd_request request;
+    struct nbd_reply reply;
+
+    request.type = NBD_CMD_READ;
+    request.handle = (uint64_t)(intptr_t)bs;
+    request.from = sector_num * 512;;
+    request.len = nb_sectors * 512;
+
+    if (nbd_send_request(s->sock, &request) == -1)
+        return -errno;
+
+    if (nbd_receive_reply(s->sock, &reply) == -1)
+        return -errno;
+
+    if (reply.error !=0)
+        return -reply.error;
+
+    if (reply.handle != request.handle)
+        return -EIO;
+
+    if (nbd_wr_sync(s->sock, buf, request.len, 1) != request.len)
+        return -EIO;
+
+    return 0;
+}
+
+static int nbd_write(BlockDriverState *bs, int64_t sector_num,
+                     const uint8_t *buf, int nb_sectors)
+{
+    BDRVNBDState *s = bs->opaque;
+    struct nbd_request request;
+    struct nbd_reply reply;
+
+    request.type = NBD_CMD_WRITE;
+    request.handle = (uint64_t)(intptr_t)bs;
+    request.from = sector_num * 512;;
+    request.len = nb_sectors * 512;
+
+    if (nbd_send_request(s->sock, &request) == -1)
+        return -errno;
+
+    if (nbd_wr_sync(s->sock, (uint8_t*)buf, request.len, 0) != request.len)
+        return -EIO;
+
+    if (nbd_receive_reply(s->sock, &reply) == -1)
+        return -errno;
+
+    if (reply.error !=0)
+        return -reply.error;
+
+    if (reply.handle != request.handle)
+        return -EIO;
+
+    return 0;
+}
+
+static void nbd_close(BlockDriverState *bs)
+{
+    BDRVNBDState *s = bs->opaque;
+    struct nbd_request request;
+
+    request.type = NBD_CMD_DISC;
+    request.handle = (uint64_t)(intptr_t)bs;
+    request.from = 0;
+    request.len = 0;
+    nbd_send_request(s->sock, &request);
+
+    close(s->sock);
+}
+
+static int64_t nbd_getlength(BlockDriverState *bs)
+{
+    BDRVNBDState *s = bs->opaque;
+
+    return s->size;
+}
+
+BlockDriver bdrv_nbd = {
+    "nbd",
+    sizeof(BDRVNBDState),
+    NULL, /* no probe for protocols */
+    nbd_open,
+    nbd_read,
+    nbd_write,
+    nbd_close,
+    .bdrv_getlength = nbd_getlength,
+    .protocol_name = "nbd",
+};
diff --git a/block-parallels.c b/block-parallels.c
new file mode 100644
index 0000000..4654b07
--- /dev/null
+++ b/block-parallels.c
@@ -0,0 +1,176 @@
+/*
+ * Block driver for Parallels disk image format
+ *
+ * Copyright (c) 2007 Alex Beregszaszi
+ *
+ * This code is based on comparing different disk images created by Parallels.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu-common.h"
+#include "block_int.h"
+
+/**************************************************************/
+
+#define HEADER_MAGIC "WithoutFreeSpace"
+#define HEADER_VERSION 2
+#define HEADER_SIZE 64
+
+// always little-endian
+struct parallels_header {
+    char magic[16]; // "WithoutFreeSpace"
+    uint32_t version;
+    uint32_t heads;
+    uint32_t cylinders;
+    uint32_t tracks;
+    uint32_t catalog_entries;
+    uint32_t nb_sectors;
+    char padding[24];
+} __attribute__((packed));
+
+typedef struct BDRVParallelsState {
+    int fd;
+
+    uint32_t *catalog_bitmap;
+    int catalog_size;
+
+    int tracks;
+} BDRVParallelsState;
+
+static int parallels_probe(const uint8_t *buf, int buf_size, const char *filename)
+{
+    const struct parallels_header *ph = (const void *)buf;
+
+    if (buf_size < HEADER_SIZE)
+	return 0;
+
+    if (!memcmp(ph->magic, HEADER_MAGIC, 16) &&
+	(le32_to_cpu(ph->version) == HEADER_VERSION))
+	return 100;
+
+    return 0;
+}
+
+static int parallels_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVParallelsState *s = bs->opaque;
+    int fd, i;
+    struct parallels_header ph;
+
+    fd = open(filename, O_RDWR | O_BINARY | O_LARGEFILE);
+    if (fd < 0) {
+        fd = open(filename, O_RDONLY | O_BINARY | O_LARGEFILE);
+        if (fd < 0)
+            return -1;
+    }
+
+    bs->read_only = 1; // no write support yet
+
+    s->fd = fd;
+
+    if (read(fd, &ph, sizeof(ph)) != sizeof(ph))
+        goto fail;
+
+    if (memcmp(ph.magic, HEADER_MAGIC, 16) ||
+	(le32_to_cpu(ph.version) != HEADER_VERSION)) {
+        goto fail;
+    }
+
+    bs->total_sectors = le32_to_cpu(ph.nb_sectors);
+
+    if (lseek(s->fd, 64, SEEK_SET) != 64)
+	goto fail;
+
+    s->tracks = le32_to_cpu(ph.tracks);
+
+    s->catalog_size = le32_to_cpu(ph.catalog_entries);
+    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
+    if (!s->catalog_bitmap)
+	goto fail;
+    if (read(s->fd, s->catalog_bitmap, s->catalog_size * 4) !=
+	s->catalog_size * 4)
+	goto fail;
+    for (i = 0; i < s->catalog_size; i++)
+	le32_to_cpus(&s->catalog_bitmap[i]);
+
+    return 0;
+fail:
+    if (s->catalog_bitmap)
+	qemu_free(s->catalog_bitmap);
+    close(fd);
+    return -1;
+}
+
+static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num)
+{
+    BDRVParallelsState *s = bs->opaque;
+    uint32_t index, offset, position;
+
+    index = sector_num / s->tracks;
+    offset = sector_num % s->tracks;
+
+    // not allocated
+    if ((index > s->catalog_size) || (s->catalog_bitmap[index] == 0))
+	return -1;
+
+    position = (s->catalog_bitmap[index] + offset) * 512;
+
+//    fprintf(stderr, "sector: %llx index=%x offset=%x pointer=%x position=%x\n",
+//	sector_num, index, offset, s->catalog_bitmap[index], position);
+
+    if (lseek(s->fd, position, SEEK_SET) != position)
+	return -1;
+
+    return 0;
+}
+
+static int parallels_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
+{
+    BDRVParallelsState *s = bs->opaque;
+
+    while (nb_sectors > 0) {
+	if (!seek_to_sector(bs, sector_num)) {
+	    if (read(s->fd, buf, 512) != 512)
+		return -1;
+	} else
+            memset(buf, 0, 512);
+        nb_sectors--;
+        sector_num++;
+        buf += 512;
+    }
+    return 0;
+}
+
+static void parallels_close(BlockDriverState *bs)
+{
+    BDRVParallelsState *s = bs->opaque;
+    qemu_free(s->catalog_bitmap);
+    close(s->fd);
+}
+
+BlockDriver bdrv_parallels = {
+    "parallels",
+    sizeof(BDRVParallelsState),
+    parallels_probe,
+    parallels_open,
+    parallels_read,
+    NULL,
+    parallels_close,
+};
diff --git a/block-qcow.c b/block-qcow.c
index e5b52fb..1fecf30 100644
--- a/block-qcow.c
+++ b/block-qcow.c
@@ -1,8 +1,8 @@
 /*
  * Block driver for the QCOW format
- * 
- * Copyright (c) 2004 Fabrice Bellard
- * 
+ *
+ * Copyright (c) 2004-2006 Fabrice Bellard
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <zlib.h>
 #include "aes.h"
@@ -53,7 +53,7 @@ typedef struct QCowHeader {
 #define L2_CACHE_SIZE 16
 
 typedef struct BDRVQcowState {
-    int fd;
+    BlockDriverState *hd;
     int cluster_bits;
     int cluster_size;
     int cluster_sectors;
@@ -80,29 +80,25 @@ static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset);
 static int qcow_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
     const QCowHeader *cow_header = (const void *)buf;
-    
+
     if (buf_size >= sizeof(QCowHeader) &&
         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
-        be32_to_cpu(cow_header->version) == QCOW_VERSION) 
+        be32_to_cpu(cow_header->version) == QCOW_VERSION)
         return 100;
     else
         return 0;
 }
 
-static int qcow_open(BlockDriverState *bs, const char *filename)
+static int qcow_open(BlockDriverState *bs, const char *filename, int flags)
 {
     BDRVQcowState *s = bs->opaque;
-    int fd, len, i, shift;
+    int len, i, shift, ret;
     QCowHeader header;
-    
-    fd = open(filename, O_RDWR | O_BINARY | O_LARGEFILE);
-    if (fd < 0) {
-        fd = open(filename, O_RDONLY | O_BINARY | O_LARGEFILE);
-        if (fd < 0)
-            return -1;
-    }
-    s->fd = fd;
-    if (read(fd, &header, sizeof(header)) != sizeof(header))
+
+    ret = bdrv_file_open(&s->hd, filename, flags);
+    if (ret < 0)
+        return ret;
+    if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
         goto fail;
     be32_to_cpus(&header.magic);
     be32_to_cpus(&header.version);
@@ -112,7 +108,7 @@ static int qcow_open(BlockDriverState *bs, const char *filename)
     be64_to_cpus(&header.size);
     be32_to_cpus(&header.crypt_method);
     be64_to_cpus(&header.l1_table_offset);
-    
+
     if (header.magic != QCOW_MAGIC || header.version != QCOW_VERSION)
         goto fail;
     if (header.size <= 1 || header.cluster_bits < 9)
@@ -138,8 +134,7 @@ static int qcow_open(BlockDriverState *bs, const char *filename)
     s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
     if (!s->l1_table)
         goto fail;
-    lseek(fd, s->l1_table_offset, SEEK_SET);
-    if (read(fd, s->l1_table, s->l1_size * sizeof(uint64_t)) != 
+    if (bdrv_pread(s->hd, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
         s->l1_size * sizeof(uint64_t))
         goto fail;
     for(i = 0;i < s->l1_size; i++) {
@@ -156,14 +151,13 @@ static int qcow_open(BlockDriverState *bs, const char *filename)
     if (!s->cluster_data)
         goto fail;
     s->cluster_cache_offset = -1;
-    
+
     /* read the backing file name */
     if (header.backing_file_offset != 0) {
         len = header.backing_file_size;
         if (len > 1023)
             len = 1023;
-        lseek(fd, header.backing_file_offset, SEEK_SET);
-        if (read(fd, bs->backing_file, len) != len)
+        if (bdrv_pread(s->hd, header.backing_file_offset, bs->backing_file, len) != len)
             goto fail;
         bs->backing_file[len] = '\0';
     }
@@ -174,7 +168,7 @@ static int qcow_open(BlockDriverState *bs, const char *filename)
     qemu_free(s->l2_cache);
     qemu_free(s->cluster_cache);
     qemu_free(s->cluster_data);
-    close(fd);
+    bdrv_delete(s->hd);
     return -1;
 }
 
@@ -183,7 +177,7 @@ static int qcow_set_key(BlockDriverState *bs, const char *key)
     BDRVQcowState *s = bs->opaque;
     uint8_t keybuf[16];
     int len, i;
-    
+
     memset(keybuf, 0, 16);
     len = strlen(key);
     if (len > 16)
@@ -237,7 +231,7 @@ static void encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
     for(i = 0; i < nb_sectors; i++) {
         ivec.ll[0] = cpu_to_le64(sector_num);
         ivec.ll[1] = 0;
-        AES_cbc_encrypt(in_buf, out_buf, 512, key, 
+        AES_cbc_encrypt(in_buf, out_buf, 512, key,
                         ivec.b, enc);
         sector_num++;
         in_buf += 512;
@@ -254,7 +248,7 @@ static void encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
  *
  * 2 to allocate a compressed cluster of size
  * 'compressed_size'. 'compressed_size' must be > 0 and <
- * cluster_size 
+ * cluster_size
  *
  * return 0 if not allocated.
  */
@@ -268,7 +262,7 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
     uint64_t l2_offset, *l2_table, cluster_offset, tmp;
     uint32_t min_count;
     int new_l2_table;
-    
+
     l1_index = offset >> (s->l2_bits + s->cluster_bits);
     l2_offset = s->l1_table[l1_index];
     new_l2_table = 0;
@@ -276,14 +270,14 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
         if (!allocate)
             return 0;
         /* allocate a new l2 entry */
-        l2_offset = lseek(s->fd, 0, SEEK_END);
+        l2_offset = bdrv_getlength(s->hd);
         /* round to cluster size */
         l2_offset = (l2_offset + s->cluster_size - 1) & ~(s->cluster_size - 1);
         /* update the L1 entry */
         s->l1_table[l1_index] = l2_offset;
         tmp = cpu_to_be64(l2_offset);
-        lseek(s->fd, s->l1_table_offset + l1_index * sizeof(tmp), SEEK_SET);
-        if (write(s->fd, &tmp, sizeof(tmp)) != sizeof(tmp))
+        if (bdrv_pwrite(s->hd, s->l1_table_offset + l1_index * sizeof(tmp),
+                        &tmp, sizeof(tmp)) != sizeof(tmp))
             return 0;
         new_l2_table = 1;
     }
@@ -309,14 +303,13 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
         }
     }
     l2_table = s->l2_cache + (min_index << s->l2_bits);
-    lseek(s->fd, l2_offset, SEEK_SET);
     if (new_l2_table) {
         memset(l2_table, 0, s->l2_size * sizeof(uint64_t));
-        if (write(s->fd, l2_table, s->l2_size * sizeof(uint64_t)) !=
+        if (bdrv_pwrite(s->hd, l2_offset, l2_table, s->l2_size * sizeof(uint64_t)) !=
             s->l2_size * sizeof(uint64_t))
             return 0;
     } else {
-        if (read(s->fd, l2_table, s->l2_size * sizeof(uint64_t)) != 
+        if (bdrv_pread(s->hd, l2_offset, l2_table, s->l2_size * sizeof(uint64_t)) !=
             s->l2_size * sizeof(uint64_t))
             return 0;
     }
@@ -325,7 +318,7 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
  found:
     l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);
     cluster_offset = be64_to_cpu(l2_table[l2_index]);
-    if (!cluster_offset || 
+    if (!cluster_offset ||
         ((cluster_offset & QCOW_OFLAG_COMPRESSED) && allocate == 1)) {
         if (!allocate)
             return 0;
@@ -337,56 +330,50 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
                overwritten */
             if (decompress_cluster(s, cluster_offset) < 0)
                 return 0;
-            cluster_offset = lseek(s->fd, 0, SEEK_END);
-            cluster_offset = (cluster_offset + s->cluster_size - 1) & 
+            cluster_offset = bdrv_getlength(s->hd);
+            cluster_offset = (cluster_offset + s->cluster_size - 1) &
                 ~(s->cluster_size - 1);
             /* write the cluster content */
-            lseek(s->fd, cluster_offset, SEEK_SET);
-            if (write(s->fd, s->cluster_cache, s->cluster_size) != 
+            if (bdrv_pwrite(s->hd, cluster_offset, s->cluster_cache, s->cluster_size) !=
                 s->cluster_size)
                 return -1;
         } else {
-            cluster_offset = lseek(s->fd, 0, SEEK_END);
-            if (allocate == 1) {
-                /* round to cluster size */
-                cluster_offset = (cluster_offset + s->cluster_size - 1) & 
-                    ~(s->cluster_size - 1);
-                ftruncate(s->fd, cluster_offset + s->cluster_size);
-                /* if encrypted, we must initialize the cluster
-                   content which won't be written */
-                if (s->crypt_method && 
-                    (n_end - n_start) < s->cluster_sectors) {
-                    uint64_t start_sect;
-                    start_sect = (offset & ~(s->cluster_size - 1)) >> 9;
-                    memset(s->cluster_data + 512, 0xaa, 512);
-                    for(i = 0; i < s->cluster_sectors; i++) {
-                        if (i < n_start || i >= n_end) {
-                            encrypt_sectors(s, start_sect + i, 
-                                            s->cluster_data, 
-                                            s->cluster_data + 512, 1, 1,
-                                            &s->aes_encrypt_key);
-                            lseek(s->fd, cluster_offset + i * 512, SEEK_SET);
-                            if (write(s->fd, s->cluster_data, 512) != 512)
-                                return -1;
-                        }
+            cluster_offset = bdrv_getlength(s->hd);
+            /* round to cluster size */
+            cluster_offset = (cluster_offset + s->cluster_size - 1) &
+                ~(s->cluster_size - 1);
+            bdrv_truncate(s->hd, cluster_offset + s->cluster_size);
+            /* if encrypted, we must initialize the cluster
+               content which won't be written */
+            if (s->crypt_method &&
+                (n_end - n_start) < s->cluster_sectors) {
+                uint64_t start_sect;
+                start_sect = (offset & ~(s->cluster_size - 1)) >> 9;
+                memset(s->cluster_data + 512, 0x00, 512);
+                for(i = 0; i < s->cluster_sectors; i++) {
+                    if (i < n_start || i >= n_end) {
+                        encrypt_sectors(s, start_sect + i,
+                                        s->cluster_data,
+                                        s->cluster_data + 512, 1, 1,
+                                        &s->aes_encrypt_key);
+                        if (bdrv_pwrite(s->hd, cluster_offset + i * 512,
+                                        s->cluster_data, 512) != 512)
+                            return -1;
                     }
                 }
-            } else {
-                cluster_offset |= QCOW_OFLAG_COMPRESSED | 
-                    (uint64_t)compressed_size << (63 - s->cluster_bits);
             }
         }
         /* update L2 table */
         tmp = cpu_to_be64(cluster_offset);
         l2_table[l2_index] = tmp;
-        lseek(s->fd, l2_offset + l2_index * sizeof(tmp), SEEK_SET);
-        if (write(s->fd, &tmp, sizeof(tmp)) != sizeof(tmp))
+        if (bdrv_pwrite(s->hd,
+                        l2_offset + l2_index * sizeof(tmp), &tmp, sizeof(tmp)) != sizeof(tmp))
             return 0;
     }
     return cluster_offset;
 }
 
-static int qcow_is_allocated(BlockDriverState *bs, int64_t sector_num, 
+static int qcow_is_allocated(BlockDriverState *bs, int64_t sector_num,
                              int nb_sectors, int *pnum)
 {
     BDRVQcowState *s = bs->opaque;
@@ -428,7 +415,7 @@ static int decompress_buffer(uint8_t *out_buf, int out_buf_size,
     inflateEnd(strm);
     return 0;
 }
-                              
+
 static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset)
 {
     int ret, csize;
@@ -438,9 +425,8 @@ static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset)
     if (s->cluster_cache_offset != coffset) {
         csize = cluster_offset >> (63 - s->cluster_bits);
         csize &= (s->cluster_size - 1);
-        lseek(s->fd, coffset, SEEK_SET);
-        ret = read(s->fd, s->cluster_data, csize);
-        if (ret != csize) 
+        ret = bdrv_pread(s->hd, coffset, s->cluster_data, csize);
+        if (ret != csize)
             return -1;
         if (decompress_buffer(s->cluster_cache, s->cluster_size,
                               s->cluster_data, csize) < 0) {
@@ -451,13 +437,15 @@ static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset)
     return 0;
 }
 
-static int qcow_read(BlockDriverState *bs, int64_t sector_num, 
+#if 0
+
+static int qcow_read(BlockDriverState *bs, int64_t sector_num,
                      uint8_t *buf, int nb_sectors)
 {
     BDRVQcowState *s = bs->opaque;
     int ret, index_in_cluster, n;
     uint64_t cluster_offset;
-    
+
     while (nb_sectors > 0) {
         cluster_offset = get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0);
         index_in_cluster = sector_num & (s->cluster_sectors - 1);
@@ -465,18 +453,24 @@ static int qcow_read(BlockDriverState *bs, int64_t sector_num,
         if (n > nb_sectors)
             n = nb_sectors;
         if (!cluster_offset) {
-            memset(buf, 0, 512 * n);
+            if (bs->backing_hd) {
+                /* read from the base image */
+                ret = bdrv_read(bs->backing_hd, sector_num, buf, n);
+                if (ret < 0)
+                    return -1;
+            } else {
+                memset(buf, 0, 512 * n);
+            }
         } else if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
             if (decompress_cluster(s, cluster_offset) < 0)
                 return -1;
             memcpy(buf, s->cluster_cache + index_in_cluster * 512, 512 * n);
         } else {
-            lseek(s->fd, cluster_offset + index_in_cluster * 512, SEEK_SET);
-            ret = read(s->fd, buf, n * 512);
-            if (ret != n * 512) 
+            ret = bdrv_pread(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
+            if (ret != n * 512)
                 return -1;
             if (s->crypt_method) {
-                encrypt_sectors(s, sector_num, buf, buf, n, 0, 
+                encrypt_sectors(s, sector_num, buf, buf, n, 0,
                                 &s->aes_decrypt_key);
             }
         }
@@ -486,33 +480,34 @@ static int qcow_read(BlockDriverState *bs, int64_t sector_num,
     }
     return 0;
 }
+#endif
 
-static int qcow_write(BlockDriverState *bs, int64_t sector_num, 
+static int qcow_write(BlockDriverState *bs, int64_t sector_num,
                      const uint8_t *buf, int nb_sectors)
 {
     BDRVQcowState *s = bs->opaque;
     int ret, index_in_cluster, n;
     uint64_t cluster_offset;
-    
+
     while (nb_sectors > 0) {
         index_in_cluster = sector_num & (s->cluster_sectors - 1);
         n = s->cluster_sectors - index_in_cluster;
         if (n > nb_sectors)
             n = nb_sectors;
-        cluster_offset = get_cluster_offset(bs, sector_num << 9, 1, 0, 
-                                            index_in_cluster, 
+        cluster_offset = get_cluster_offset(bs, sector_num << 9, 1, 0,
+                                            index_in_cluster,
                                             index_in_cluster + n);
         if (!cluster_offset)
             return -1;
-        lseek(s->fd, cluster_offset + index_in_cluster * 512, SEEK_SET);
         if (s->crypt_method) {
             encrypt_sectors(s, sector_num, s->cluster_data, buf, n, 1,
                             &s->aes_encrypt_key);
-            ret = write(s->fd, s->cluster_data, n * 512);
+            ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512,
+                              s->cluster_data, n * 512);
         } else {
-            ret = write(s->fd, buf, n * 512);
+            ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
         }
-        if (ret != n * 512) 
+        if (ret != n * 512)
             return -1;
         nb_sectors -= n;
         sector_num += n;
@@ -522,6 +517,209 @@ static int qcow_write(BlockDriverState *bs, int64_t sector_num,
     return 0;
 }
 
+typedef struct QCowAIOCB {
+    BlockDriverAIOCB common;
+    int64_t sector_num;
+    uint8_t *buf;
+    int nb_sectors;
+    int n;
+    uint64_t cluster_offset;
+    uint8_t *cluster_data;
+    BlockDriverAIOCB *hd_aiocb;
+} QCowAIOCB;
+
+static void qcow_aio_read_cb(void *opaque, int ret)
+{
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVQcowState *s = bs->opaque;
+    int index_in_cluster;
+
+    acb->hd_aiocb = NULL;
+    if (ret < 0) {
+    fail:
+        acb->common.cb(acb->common.opaque, ret);
+        qemu_aio_release(acb);
+        return;
+    }
+
+ redo:
+    /* post process the read buffer */
+    if (!acb->cluster_offset) {
+        /* nothing to do */
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* nothing to do */
+    } else {
+        if (s->crypt_method) {
+            encrypt_sectors(s, acb->sector_num, acb->buf, acb->buf,
+                            acb->n, 0,
+                            &s->aes_decrypt_key);
+        }
+    }
+
+    acb->nb_sectors -= acb->n;
+    acb->sector_num += acb->n;
+    acb->buf += acb->n * 512;
+
+    if (acb->nb_sectors == 0) {
+        /* request completed */
+        acb->common.cb(acb->common.opaque, 0);
+        qemu_aio_release(acb);
+        return;
+    }
+
+    /* prepare next AIO request */
+    acb->cluster_offset = get_cluster_offset(bs, acb->sector_num << 9,
+                                             0, 0, 0, 0);
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+    acb->n = s->cluster_sectors - index_in_cluster;
+    if (acb->n > acb->nb_sectors)
+        acb->n = acb->nb_sectors;
+
+    if (!acb->cluster_offset) {
+        if (bs->backing_hd) {
+            /* read from the base image */
+            acb->hd_aiocb = bdrv_aio_read(bs->backing_hd,
+                acb->sector_num, acb->buf, acb->n, qcow_aio_read_cb, acb);
+            if (acb->hd_aiocb == NULL)
+                goto fail;
+        } else {
+            /* Note: in this case, no need to wait */
+            memset(acb->buf, 0, 512 * acb->n);
+            goto redo;
+        }
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* add AIO support for compressed blocks ? */
+        if (decompress_cluster(s, acb->cluster_offset) < 0)
+            goto fail;
+        memcpy(acb->buf,
+               s->cluster_cache + index_in_cluster * 512, 512 * acb->n);
+        goto redo;
+    } else {
+        if ((acb->cluster_offset & 511) != 0) {
+            ret = -EIO;
+            goto fail;
+        }
+        acb->hd_aiocb = bdrv_aio_read(s->hd,
+                            (acb->cluster_offset >> 9) + index_in_cluster,
+                            acb->buf, acb->n, qcow_aio_read_cb, acb);
+        if (acb->hd_aiocb == NULL)
+            goto fail;
+    }
+}
+
+static BlockDriverAIOCB *qcow_aio_read(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    QCowAIOCB *acb;
+
+    acb = qemu_aio_get(bs, cb, opaque);
+    if (!acb)
+        return NULL;
+    acb->hd_aiocb = NULL;
+    acb->sector_num = sector_num;
+    acb->buf = buf;
+    acb->nb_sectors = nb_sectors;
+    acb->n = 0;
+    acb->cluster_offset = 0;
+
+    qcow_aio_read_cb(acb, 0);
+    return &acb->common;
+}
+
+static void qcow_aio_write_cb(void *opaque, int ret)
+{
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVQcowState *s = bs->opaque;
+    int index_in_cluster;
+    uint64_t cluster_offset;
+    const uint8_t *src_buf;
+
+    acb->hd_aiocb = NULL;
+
+    if (ret < 0) {
+    fail:
+        acb->common.cb(acb->common.opaque, ret);
+        qemu_aio_release(acb);
+        return;
+    }
+
+    acb->nb_sectors -= acb->n;
+    acb->sector_num += acb->n;
+    acb->buf += acb->n * 512;
+
+    if (acb->nb_sectors == 0) {
+        /* request completed */
+        acb->common.cb(acb->common.opaque, 0);
+        qemu_aio_release(acb);
+        return;
+    }
+
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+    acb->n = s->cluster_sectors - index_in_cluster;
+    if (acb->n > acb->nb_sectors)
+        acb->n = acb->nb_sectors;
+    cluster_offset = get_cluster_offset(bs, acb->sector_num << 9, 1, 0,
+                                        index_in_cluster,
+                                        index_in_cluster + acb->n);
+    if (!cluster_offset || (cluster_offset & 511) != 0) {
+        ret = -EIO;
+        goto fail;
+    }
+    if (s->crypt_method) {
+        if (!acb->cluster_data) {
+            acb->cluster_data = qemu_mallocz(s->cluster_size);
+            if (!acb->cluster_data) {
+                ret = -ENOMEM;
+                goto fail;
+            }
+        }
+        encrypt_sectors(s, acb->sector_num, acb->cluster_data, acb->buf,
+                        acb->n, 1, &s->aes_encrypt_key);
+        src_buf = acb->cluster_data;
+    } else {
+        src_buf = acb->buf;
+    }
+    acb->hd_aiocb = bdrv_aio_write(s->hd,
+                                   (cluster_offset >> 9) + index_in_cluster,
+                                   src_buf, acb->n,
+                                   qcow_aio_write_cb, acb);
+    if (acb->hd_aiocb == NULL)
+        goto fail;
+}
+
+static BlockDriverAIOCB *qcow_aio_write(BlockDriverState *bs,
+        int64_t sector_num, const uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowAIOCB *acb;
+
+    s->cluster_cache_offset = -1; /* disable compressed cache */
+
+    acb = qemu_aio_get(bs, cb, opaque);
+    if (!acb)
+        return NULL;
+    acb->hd_aiocb = NULL;
+    acb->sector_num = sector_num;
+    acb->buf = (uint8_t *)buf;
+    acb->nb_sectors = nb_sectors;
+    acb->n = 0;
+
+    qcow_aio_write_cb(acb, 0);
+    return &acb->common;
+}
+
+static void qcow_aio_cancel(BlockDriverAIOCB *blockacb)
+{
+    QCowAIOCB *acb = (QCowAIOCB *)blockacb;
+    if (acb->hd_aiocb)
+        bdrv_aio_cancel(acb->hd_aiocb);
+    qemu_aio_release(acb);
+}
+
 static void qcow_close(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
@@ -529,7 +727,7 @@ static void qcow_close(BlockDriverState *bs)
     qemu_free(s->l2_cache);
     qemu_free(s->cluster_cache);
     qemu_free(s->cluster_data);
-    close(s->fd);
+    bdrv_delete(s->hd);
 }
 
 static int qcow_create(const char *filename, int64_t total_size,
@@ -537,12 +735,9 @@ static int qcow_create(const char *filename, int64_t total_size,
 {
     int fd, header_size, backing_filename_len, l1_size, i, shift;
     QCowHeader header;
-    char backing_filename[1024];
     uint64_t tmp;
-    struct stat st;
 
-    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE, 
-              0644);
+    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
     if (fd < 0)
         return -1;
     memset(&header, 0, sizeof(header));
@@ -552,28 +747,15 @@ static int qcow_create(const char *filename, int64_t total_size,
     header_size = sizeof(header);
     backing_filename_len = 0;
     if (backing_file) {
-	if (strcmp(backing_file, "fat:")) {
-	    const char *p;
-	    /* XXX: this is a hack: we do not attempt to check for URL
-	       like syntax */
-	    p = strchr(backing_file, ':');
-	    if (p && (p - backing_file) >= 2) {
-		/* URL like but exclude "c:" like filenames */
-		pstrcpy(backing_filename, sizeof(backing_filename),
-			backing_file);
-	    } else {
-		realpath(backing_file, backing_filename);
-		if (stat(backing_filename, &st) != 0) {
-		    return -1;
-		}
-	    }
-	    header.backing_file_offset = cpu_to_be64(header_size);
-	    backing_filename_len = strlen(backing_filename);
-	    header.backing_file_size = cpu_to_be32(backing_filename_len);
-	    header_size += backing_filename_len;
-	} else
-	    backing_file = NULL;
-        header.mtime = cpu_to_be32(st.st_mtime);
+        if (strcmp(backing_file, "fat:")) {
+            header.backing_file_offset = cpu_to_be64(header_size);
+            backing_filename_len = strlen(backing_file);
+            header.backing_file_size = cpu_to_be32(backing_filename_len);
+            header_size += backing_filename_len;
+        } else {
+            /* special backing file for vvfat */
+            backing_file = NULL;
+        }
         header.cluster_bits = 9; /* 512 byte cluster to avoid copying
                                     unmodifyed sectors */
         header.l2_bits = 12; /* 32 KB L2 tables */
@@ -586,16 +768,16 @@ static int qcow_create(const char *filename, int64_t total_size,
     l1_size = ((total_size * 512) + (1LL << shift) - 1) >> shift;
 
     header.l1_table_offset = cpu_to_be64(header_size);
-    if (flags) {
+    if (flags & BLOCK_FLAG_ENCRYPT) {
         header.crypt_method = cpu_to_be32(QCOW_CRYPT_AES);
     } else {
         header.crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
     }
-    
+
     /* write all the data */
     write(fd, &header, sizeof(header));
     if (backing_file) {
-        write(fd, backing_filename, backing_filename_len);
+        write(fd, backing_file, backing_filename_len);
     }
     lseek(fd, header_size, SEEK_SET);
     tmp = 0;
@@ -606,16 +788,18 @@ static int qcow_create(const char *filename, int64_t total_size,
     return 0;
 }
 
-int qcow_make_empty(BlockDriverState *bs)
+static int qcow_make_empty(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
     uint32_t l1_length = s->l1_size * sizeof(uint64_t);
+    int ret;
 
     memset(s->l1_table, 0, l1_length);
-    lseek(s->fd, s->l1_table_offset, SEEK_SET);
-    if (write(s->fd, s->l1_table, l1_length) < 0)
+    if (bdrv_pwrite(s->hd, s->l1_table_offset, s->l1_table, l1_length) < 0)
 	return -1;
-    ftruncate(s->fd, s->l1_table_offset + l1_length);
+    ret = bdrv_truncate(s->hd, s->l1_table_offset + l1_length);
+    if (ret < 0)
+        return ret;
 
     memset(s->l2_cache, 0, s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
     memset(s->l2_cache_offsets, 0, L2_CACHE_SIZE * sizeof(uint64_t));
@@ -624,18 +808,10 @@ int qcow_make_empty(BlockDriverState *bs)
     return 0;
 }
 
-int qcow_get_cluster_size(BlockDriverState *bs)
-{
-    BDRVQcowState *s = bs->opaque;
-    if (bs->drv != &bdrv_qcow)
-        return -1;
-    return s->cluster_size;
-}
-
 /* XXX: put compressed sectors first, then all the cluster aligned
    tables to avoid losing bytes in alignment */
-int qcow_compress_cluster(BlockDriverState *bs, int64_t sector_num, 
-                          const uint8_t *buf)
+static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
+                                 const uint8_t *buf, int nb_sectors)
 {
     BDRVQcowState *s = bs->opaque;
     z_stream strm;
@@ -643,8 +819,8 @@ int qcow_compress_cluster(BlockDriverState *bs, int64_t sector_num,
     uint8_t *out_buf;
     uint64_t cluster_offset;
 
-    if (bs->drv != &bdrv_qcow)
-        return -1;
+    if (nb_sectors != s->cluster_sectors)
+        return -EINVAL;
 
     out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
     if (!out_buf)
@@ -653,7 +829,7 @@ int qcow_compress_cluster(BlockDriverState *bs, int64_t sector_num,
     /* best compression, small window, no zlib header */
     memset(&strm, 0, sizeof(strm));
     ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION,
-                       Z_DEFLATED, -12, 
+                       Z_DEFLATED, -12,
                        9, Z_DEFAULT_STRATEGY);
     if (ret != 0) {
         qemu_free(out_buf);
@@ -679,16 +855,15 @@ int qcow_compress_cluster(BlockDriverState *bs, int64_t sector_num,
         /* could not compress: write normal cluster */
         qcow_write(bs, sector_num, buf, s->cluster_sectors);
     } else {
-        cluster_offset = get_cluster_offset(bs, sector_num << 9, 2, 
+        cluster_offset = get_cluster_offset(bs, sector_num << 9, 2,
                                             out_len, 0, 0);
         cluster_offset &= s->cluster_offset_mask;
-        lseek(s->fd, cluster_offset, SEEK_SET);
-        if (write(s->fd, out_buf, out_len) != out_len) {
+        if (bdrv_pwrite(s->hd, cluster_offset, out_buf, out_len) != out_len) {
             qemu_free(out_buf);
             return -1;
         }
     }
-    
+
     qemu_free(out_buf);
     return 0;
 }
@@ -696,7 +871,14 @@ int qcow_compress_cluster(BlockDriverState *bs, int64_t sector_num,
 static void qcow_flush(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
-    fsync(s->fd);
+    bdrv_flush(s->hd);
+}
+
+static int qcow_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
+{
+    BDRVQcowState *s = bs->opaque;
+    bdi->cluster_size = s->cluster_size;
+    return 0;
 }
 
 BlockDriver bdrv_qcow = {
@@ -704,14 +886,19 @@ BlockDriver bdrv_qcow = {
     sizeof(BDRVQcowState),
     qcow_probe,
     qcow_open,
-    qcow_read,
-    qcow_write,
+    NULL,
+    NULL,
     qcow_close,
     qcow_create,
     qcow_flush,
     qcow_is_allocated,
     qcow_set_key,
-    qcow_make_empty
+    qcow_make_empty,
+
+    .bdrv_aio_read = qcow_aio_read,
+    .bdrv_aio_write = qcow_aio_write,
+    .bdrv_aio_cancel = qcow_aio_cancel,
+    .aiocb_size = sizeof(QCowAIOCB),
+    .bdrv_write_compressed = qcow_write_compressed,
+    .bdrv_get_info = qcow_get_info,
 };
-
-
diff --git a/block-qcow2.c b/block-qcow2.c
new file mode 100644
index 0000000..5f0fbe8
--- /dev/null
+++ b/block-qcow2.c
@@ -0,0 +1,2620 @@
+/*
+ * Block driver for the QCOW version 2 format
+ *
+ * Copyright (c) 2004-2006 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu-common.h"
+#include "block_int.h"
+#include <zlib.h>
+#include "aes.h"
+#include <assert.h>
+
+/*
+  Differences with QCOW:
+
+  - Support for multiple incremental snapshots.
+  - Memory management by reference counts.
+  - Clusters which have a reference count of one have the bit
+    QCOW_OFLAG_COPIED to optimize write performance.
+  - Size of compressed clusters is stored in sectors to reduce bit usage
+    in the cluster offsets.
+  - Support for storing additional data (such as the VM state) in the
+    snapshots.
+  - If a backing store is used, the cluster size is not constrained
+    (could be backported to QCOW).
+  - L2 tables have always a size of one cluster.
+*/
+
+//#define DEBUG_ALLOC
+//#define DEBUG_ALLOC2
+
+#define QCOW_MAGIC (('Q' << 24) | ('F' << 16) | ('I' << 8) | 0xfb)
+#define QCOW_VERSION 2
+
+#define QCOW_CRYPT_NONE 0
+#define QCOW_CRYPT_AES  1
+
+#define QCOW_MAX_CRYPT_CLUSTERS 32
+
+/* indicate that the refcount of the referenced cluster is exactly one. */
+#define QCOW_OFLAG_COPIED     (1LL << 63)
+/* indicate that the cluster is compressed (they never have the copied flag) */
+#define QCOW_OFLAG_COMPRESSED (1LL << 62)
+
+#define REFCOUNT_SHIFT 1 /* refcount size is 2 bytes */
+
+typedef struct QCowHeader {
+    uint32_t magic;
+    uint32_t version;
+    uint64_t backing_file_offset;
+    uint32_t backing_file_size;
+    uint32_t cluster_bits;
+    uint64_t size; /* in bytes */
+    uint32_t crypt_method;
+    uint32_t l1_size; /* XXX: save number of clusters instead ? */
+    uint64_t l1_table_offset;
+    uint64_t refcount_table_offset;
+    uint32_t refcount_table_clusters;
+    uint32_t nb_snapshots;
+    uint64_t snapshots_offset;
+} QCowHeader;
+
+typedef struct __attribute__((packed)) QCowSnapshotHeader {
+    /* header is 8 byte aligned */
+    uint64_t l1_table_offset;
+
+    uint32_t l1_size;
+    uint16_t id_str_size;
+    uint16_t name_size;
+
+    uint32_t date_sec;
+    uint32_t date_nsec;
+
+    uint64_t vm_clock_nsec;
+
+    uint32_t vm_state_size;
+    uint32_t extra_data_size; /* for extension */
+    /* extra data follows */
+    /* id_str follows */
+    /* name follows  */
+} QCowSnapshotHeader;
+
+#define L2_CACHE_SIZE 16
+
+typedef struct QCowSnapshot {
+    uint64_t l1_table_offset;
+    uint32_t l1_size;
+    char *id_str;
+    char *name;
+    uint32_t vm_state_size;
+    uint32_t date_sec;
+    uint32_t date_nsec;
+    uint64_t vm_clock_nsec;
+} QCowSnapshot;
+
+typedef struct BDRVQcowState {
+    BlockDriverState *hd;
+    int cluster_bits;
+    int cluster_size;
+    int cluster_sectors;
+    int l2_bits;
+    int l2_size;
+    int l1_size;
+    int l1_vm_state_index;
+    int csize_shift;
+    int csize_mask;
+    uint64_t cluster_offset_mask;
+    uint64_t l1_table_offset;
+    uint64_t *l1_table;
+    uint64_t *l2_cache;
+    uint64_t l2_cache_offsets[L2_CACHE_SIZE];
+    uint32_t l2_cache_counts[L2_CACHE_SIZE];
+    uint8_t *cluster_cache;
+    uint8_t *cluster_data;
+    uint64_t cluster_cache_offset;
+
+    uint64_t *refcount_table;
+    uint64_t refcount_table_offset;
+    uint32_t refcount_table_size;
+    uint64_t refcount_block_cache_offset;
+    uint16_t *refcount_block_cache;
+    int64_t free_cluster_index;
+    int64_t free_byte_offset;
+
+    uint32_t crypt_method; /* current crypt method, 0 if no key yet */
+    uint32_t crypt_method_header;
+    AES_KEY aes_encrypt_key;
+    AES_KEY aes_decrypt_key;
+    uint64_t snapshots_offset;
+    int snapshots_size;
+    int nb_snapshots;
+    QCowSnapshot *snapshots;
+} BDRVQcowState;
+
+static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset);
+static int qcow_read(BlockDriverState *bs, int64_t sector_num,
+                     uint8_t *buf, int nb_sectors);
+static int qcow_read_snapshots(BlockDriverState *bs);
+static void qcow_free_snapshots(BlockDriverState *bs);
+static int refcount_init(BlockDriverState *bs);
+static void refcount_close(BlockDriverState *bs);
+static int get_refcount(BlockDriverState *bs, int64_t cluster_index);
+static int update_cluster_refcount(BlockDriverState *bs,
+                                   int64_t cluster_index,
+                                   int addend);
+static void update_refcount(BlockDriverState *bs,
+                            int64_t offset, int64_t length,
+                            int addend);
+static int64_t alloc_clusters(BlockDriverState *bs, int64_t size);
+static int64_t alloc_bytes(BlockDriverState *bs, int size);
+static void free_clusters(BlockDriverState *bs,
+                          int64_t offset, int64_t size);
+#ifdef DEBUG_ALLOC
+static void check_refcounts(BlockDriverState *bs);
+#endif
+
+static int qcow_probe(const uint8_t *buf, int buf_size, const char *filename)
+{
+    const QCowHeader *cow_header = (const void *)buf;
+
+    if (buf_size >= sizeof(QCowHeader) &&
+        be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
+        be32_to_cpu(cow_header->version) == QCOW_VERSION)
+        return 100;
+    else
+        return 0;
+}
+
+static int qcow_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVQcowState *s = bs->opaque;
+    int len, i, shift, ret;
+    QCowHeader header;
+
+    ret = bdrv_file_open(&s->hd, filename, flags);
+    if (ret < 0)
+        return ret;
+    if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
+        goto fail;
+    be32_to_cpus(&header.magic);
+    be32_to_cpus(&header.version);
+    be64_to_cpus(&header.backing_file_offset);
+    be32_to_cpus(&header.backing_file_size);
+    be64_to_cpus(&header.size);
+    be32_to_cpus(&header.cluster_bits);
+    be32_to_cpus(&header.crypt_method);
+    be64_to_cpus(&header.l1_table_offset);
+    be32_to_cpus(&header.l1_size);
+    be64_to_cpus(&header.refcount_table_offset);
+    be32_to_cpus(&header.refcount_table_clusters);
+    be64_to_cpus(&header.snapshots_offset);
+    be32_to_cpus(&header.nb_snapshots);
+
+    if (header.magic != QCOW_MAGIC || header.version != QCOW_VERSION)
+        goto fail;
+    if (header.size <= 1 ||
+        header.cluster_bits < 9 ||
+        header.cluster_bits > 16)
+        goto fail;
+    if (header.crypt_method > QCOW_CRYPT_AES)
+        goto fail;
+    s->crypt_method_header = header.crypt_method;
+    if (s->crypt_method_header)
+        bs->encrypted = 1;
+    s->cluster_bits = header.cluster_bits;
+    s->cluster_size = 1 << s->cluster_bits;
+    s->cluster_sectors = 1 << (s->cluster_bits - 9);
+    s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
+    s->l2_size = 1 << s->l2_bits;
+    bs->total_sectors = header.size / 512;
+    s->csize_shift = (62 - (s->cluster_bits - 8));
+    s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
+    s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
+    s->refcount_table_offset = header.refcount_table_offset;
+    s->refcount_table_size =
+        header.refcount_table_clusters << (s->cluster_bits - 3);
+
+    s->snapshots_offset = header.snapshots_offset;
+    s->nb_snapshots = header.nb_snapshots;
+
+    /* read the level 1 table */
+    s->l1_size = header.l1_size;
+    shift = s->cluster_bits + s->l2_bits;
+    s->l1_vm_state_index = (header.size + (1LL << shift) - 1) >> shift;
+    /* the L1 table must contain at least enough entries to put
+       header.size bytes */
+    if (s->l1_size < s->l1_vm_state_index)
+        goto fail;
+    s->l1_table_offset = header.l1_table_offset;
+    s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
+    if (!s->l1_table)
+        goto fail;
+    if (bdrv_pread(s->hd, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
+        s->l1_size * sizeof(uint64_t))
+        goto fail;
+    for(i = 0;i < s->l1_size; i++) {
+        be64_to_cpus(&s->l1_table[i]);
+    }
+    /* alloc L2 cache */
+    s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
+    if (!s->l2_cache)
+        goto fail;
+    s->cluster_cache = qemu_malloc(s->cluster_size);
+    if (!s->cluster_cache)
+        goto fail;
+    /* one more sector for decompressed data alignment */
+    s->cluster_data = qemu_malloc(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
+                                  + 512);
+    if (!s->cluster_data)
+        goto fail;
+    s->cluster_cache_offset = -1;
+
+    if (refcount_init(bs) < 0)
+        goto fail;
+
+    /* read the backing file name */
+    if (header.backing_file_offset != 0) {
+        len = header.backing_file_size;
+        if (len > 1023)
+            len = 1023;
+        if (bdrv_pread(s->hd, header.backing_file_offset, bs->backing_file, len) != len)
+            goto fail;
+        bs->backing_file[len] = '\0';
+    }
+    if (qcow_read_snapshots(bs) < 0)
+        goto fail;
+
+#ifdef DEBUG_ALLOC
+    check_refcounts(bs);
+#endif
+    return 0;
+
+ fail:
+    qcow_free_snapshots(bs);
+    refcount_close(bs);
+    qemu_free(s->l1_table);
+    qemu_free(s->l2_cache);
+    qemu_free(s->cluster_cache);
+    qemu_free(s->cluster_data);
+    bdrv_delete(s->hd);
+    return -1;
+}
+
+static int qcow_set_key(BlockDriverState *bs, const char *key)
+{
+    BDRVQcowState *s = bs->opaque;
+    uint8_t keybuf[16];
+    int len, i;
+
+    memset(keybuf, 0, 16);
+    len = strlen(key);
+    if (len > 16)
+        len = 16;
+    /* XXX: we could compress the chars to 7 bits to increase
+       entropy */
+    for(i = 0;i < len;i++) {
+        keybuf[i] = key[i];
+    }
+    s->crypt_method = s->crypt_method_header;
+
+    if (AES_set_encrypt_key(keybuf, 128, &s->aes_encrypt_key) != 0)
+        return -1;
+    if (AES_set_decrypt_key(keybuf, 128, &s->aes_decrypt_key) != 0)
+        return -1;
+#if 0
+    /* test */
+    {
+        uint8_t in[16];
+        uint8_t out[16];
+        uint8_t tmp[16];
+        for(i=0;i<16;i++)
+            in[i] = i;
+        AES_encrypt(in, tmp, &s->aes_encrypt_key);
+        AES_decrypt(tmp, out, &s->aes_decrypt_key);
+        for(i = 0; i < 16; i++)
+            printf(" %02x", tmp[i]);
+        printf("\n");
+        for(i = 0; i < 16; i++)
+            printf(" %02x", out[i]);
+        printf("\n");
+    }
+#endif
+    return 0;
+}
+
+/* The crypt function is compatible with the linux cryptoloop
+   algorithm for < 4 GB images. NOTE: out_buf == in_buf is
+   supported */
+static void encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
+                            uint8_t *out_buf, const uint8_t *in_buf,
+                            int nb_sectors, int enc,
+                            const AES_KEY *key)
+{
+    union {
+        uint64_t ll[2];
+        uint8_t b[16];
+    } ivec;
+    int i;
+
+    for(i = 0; i < nb_sectors; i++) {
+        ivec.ll[0] = cpu_to_le64(sector_num);
+        ivec.ll[1] = 0;
+        AES_cbc_encrypt(in_buf, out_buf, 512, key,
+                        ivec.b, enc);
+        sector_num++;
+        in_buf += 512;
+        out_buf += 512;
+    }
+}
+
+static int copy_sectors(BlockDriverState *bs, uint64_t start_sect,
+                        uint64_t cluster_offset, int n_start, int n_end)
+{
+    BDRVQcowState *s = bs->opaque;
+    int n, ret;
+
+    n = n_end - n_start;
+    if (n <= 0)
+        return 0;
+    ret = qcow_read(bs, start_sect + n_start, s->cluster_data, n);
+    if (ret < 0)
+        return ret;
+    if (s->crypt_method) {
+        encrypt_sectors(s, start_sect + n_start,
+                        s->cluster_data,
+                        s->cluster_data, n, 1,
+                        &s->aes_encrypt_key);
+    }
+    ret = bdrv_write(s->hd, (cluster_offset >> 9) + n_start,
+                     s->cluster_data, n);
+    if (ret < 0)
+        return ret;
+    return 0;
+}
+
+static void l2_cache_reset(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+
+    memset(s->l2_cache, 0, s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
+    memset(s->l2_cache_offsets, 0, L2_CACHE_SIZE * sizeof(uint64_t));
+    memset(s->l2_cache_counts, 0, L2_CACHE_SIZE * sizeof(uint32_t));
+}
+
+static inline int l2_cache_new_entry(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+    uint32_t min_count;
+    int min_index, i;
+
+    /* find a new entry in the least used one */
+    min_index = 0;
+    min_count = 0xffffffff;
+    for(i = 0; i < L2_CACHE_SIZE; i++) {
+        if (s->l2_cache_counts[i] < min_count) {
+            min_count = s->l2_cache_counts[i];
+            min_index = i;
+        }
+    }
+    return min_index;
+}
+
+static int64_t align_offset(int64_t offset, int n)
+{
+    offset = (offset + n - 1) & ~(n - 1);
+    return offset;
+}
+
+static int grow_l1_table(BlockDriverState *bs, int min_size)
+{
+    BDRVQcowState *s = bs->opaque;
+    int new_l1_size, new_l1_size2, ret, i;
+    uint64_t *new_l1_table;
+    uint64_t new_l1_table_offset;
+    uint64_t data64;
+    uint32_t data32;
+
+    new_l1_size = s->l1_size;
+    if (min_size <= new_l1_size)
+        return 0;
+    while (min_size > new_l1_size) {
+        new_l1_size = (new_l1_size * 3 + 1) / 2;
+    }
+#ifdef DEBUG_ALLOC2
+    printf("grow l1_table from %d to %d\n", s->l1_size, new_l1_size);
+#endif
+
+    new_l1_size2 = sizeof(uint64_t) * new_l1_size;
+    new_l1_table = qemu_mallocz(new_l1_size2);
+    if (!new_l1_table)
+        return -ENOMEM;
+    memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
+
+    /* write new table (align to cluster) */
+    new_l1_table_offset = alloc_clusters(bs, new_l1_size2);
+
+    for(i = 0; i < s->l1_size; i++)
+        new_l1_table[i] = cpu_to_be64(new_l1_table[i]);
+    ret = bdrv_pwrite(s->hd, new_l1_table_offset, new_l1_table, new_l1_size2);
+    if (ret != new_l1_size2)
+        goto fail;
+    for(i = 0; i < s->l1_size; i++)
+        new_l1_table[i] = be64_to_cpu(new_l1_table[i]);
+
+    /* set new table */
+    data64 = cpu_to_be64(new_l1_table_offset);
+    if (bdrv_pwrite(s->hd, offsetof(QCowHeader, l1_table_offset),
+                    &data64, sizeof(data64)) != sizeof(data64))
+        goto fail;
+    data32 = cpu_to_be32(new_l1_size);
+    if (bdrv_pwrite(s->hd, offsetof(QCowHeader, l1_size),
+                    &data32, sizeof(data32)) != sizeof(data32))
+        goto fail;
+    qemu_free(s->l1_table);
+    free_clusters(bs, s->l1_table_offset, s->l1_size * sizeof(uint64_t));
+    s->l1_table_offset = new_l1_table_offset;
+    s->l1_table = new_l1_table;
+    s->l1_size = new_l1_size;
+    return 0;
+ fail:
+    qemu_free(s->l1_table);
+    return -EIO;
+}
+
+/*
+ * seek_l2_table
+ *
+ * seek l2_offset in the l2_cache table
+ * if not found, return NULL,
+ * if found,
+ *   increments the l2 cache hit count of the entry,
+ *   if counter overflow, divide by two all counters
+ *   return the pointer to the l2 cache entry
+ *
+ */
+
+static uint64_t *seek_l2_table(BDRVQcowState *s, uint64_t l2_offset)
+{
+    int i, j;
+
+    for(i = 0; i < L2_CACHE_SIZE; i++) {
+        if (l2_offset == s->l2_cache_offsets[i]) {
+            /* increment the hit count */
+            if (++s->l2_cache_counts[i] == 0xffffffff) {
+                for(j = 0; j < L2_CACHE_SIZE; j++) {
+                    s->l2_cache_counts[j] >>= 1;
+                }
+            }
+            return s->l2_cache + (i << s->l2_bits);
+        }
+    }
+    return NULL;
+}
+
+/*
+ * l2_load
+ *
+ * Loads a L2 table into memory. If the table is in the cache, the cache
+ * is used; otherwise the L2 table is loaded from the image file.
+ *
+ * Returns a pointer to the L2 table on success, or NULL if the read from
+ * the image file failed.
+ */
+
+static uint64_t *l2_load(BlockDriverState *bs, uint64_t l2_offset)
+{
+    BDRVQcowState *s = bs->opaque;
+    int min_index;
+    uint64_t *l2_table;
+
+    /* seek if the table for the given offset is in the cache */
+
+    l2_table = seek_l2_table(s, l2_offset);
+    if (l2_table != NULL)
+        return l2_table;
+
+    /* not found: load a new entry in the least used one */
+
+    min_index = l2_cache_new_entry(bs);
+    l2_table = s->l2_cache + (min_index << s->l2_bits);
+    if (bdrv_pread(s->hd, l2_offset, l2_table, s->l2_size * sizeof(uint64_t)) !=
+        s->l2_size * sizeof(uint64_t))
+        return NULL;
+    s->l2_cache_offsets[min_index] = l2_offset;
+    s->l2_cache_counts[min_index] = 1;
+
+    return l2_table;
+}
+
+/*
+ * l2_allocate
+ *
+ * Allocate a new l2 entry in the file. If l1_index points to an already
+ * used entry in the L2 table (i.e. we are doing a copy on write for the L2
+ * table) copy the contents of the old L2 table into the newly allocated one.
+ * Otherwise the new table is initialized with zeros.
+ *
+ */
+
+static uint64_t *l2_allocate(BlockDriverState *bs, int l1_index)
+{
+    BDRVQcowState *s = bs->opaque;
+    int min_index;
+    uint64_t old_l2_offset, tmp;
+    uint64_t *l2_table, l2_offset;
+
+    old_l2_offset = s->l1_table[l1_index];
+
+    /* allocate a new l2 entry */
+
+    l2_offset = alloc_clusters(bs, s->l2_size * sizeof(uint64_t));
+
+    /* update the L1 entry */
+
+    s->l1_table[l1_index] = l2_offset | QCOW_OFLAG_COPIED;
+
+    tmp = cpu_to_be64(l2_offset | QCOW_OFLAG_COPIED);
+    if (bdrv_pwrite(s->hd, s->l1_table_offset + l1_index * sizeof(tmp),
+                    &tmp, sizeof(tmp)) != sizeof(tmp))
+        return NULL;
+
+    /* allocate a new entry in the l2 cache */
+
+    min_index = l2_cache_new_entry(bs);
+    l2_table = s->l2_cache + (min_index << s->l2_bits);
+
+    if (old_l2_offset == 0) {
+        /* if there was no old l2 table, clear the new table */
+        memset(l2_table, 0, s->l2_size * sizeof(uint64_t));
+    } else {
+        /* if there was an old l2 table, read it from the disk */
+        if (bdrv_pread(s->hd, old_l2_offset,
+                       l2_table, s->l2_size * sizeof(uint64_t)) !=
+            s->l2_size * sizeof(uint64_t))
+            return NULL;
+    }
+    /* write the l2 table to the file */
+    if (bdrv_pwrite(s->hd, l2_offset,
+                    l2_table, s->l2_size * sizeof(uint64_t)) !=
+        s->l2_size * sizeof(uint64_t))
+        return NULL;
+
+    /* update the l2 cache entry */
+
+    s->l2_cache_offsets[min_index] = l2_offset;
+    s->l2_cache_counts[min_index] = 1;
+
+    return l2_table;
+}
+
+/*
+ * get_cluster_offset
+ *
+ * For a given offset of the disk image, return cluster offset in
+ * qcow2 file.
+ *
+ * on entry, *num is the number of contiguous clusters we'd like to
+ * access following offset.
+ *
+ * on exit, *num is the number of contiguous clusters we can read.
+ *
+ * Return 1, if the offset is found
+ * Return 0, otherwise.
+ *
+ */
+
+static uint64_t get_cluster_offset(BlockDriverState *bs,
+                                   uint64_t offset, int *num)
+{
+    BDRVQcowState *s = bs->opaque;
+    int l1_index, l2_index;
+    uint64_t l2_offset, *l2_table, cluster_offset, next;
+    int l1_bits;
+    int index_in_cluster, nb_available, nb_needed;
+
+    index_in_cluster = (offset >> 9) & (s->cluster_sectors - 1);
+    nb_needed = *num + index_in_cluster;
+
+    l1_bits = s->l2_bits + s->cluster_bits;
+
+    /* compute how many bytes there are between the offset and
+     * and the end of the l1 entry
+     */
+
+    nb_available = (1 << l1_bits) - (offset & ((1 << l1_bits) - 1));
+
+    /* compute the number of available sectors */
+
+    nb_available = (nb_available >> 9) + index_in_cluster;
+
+    cluster_offset = 0;
+
+    /* seek the the l2 offset in the l1 table */
+
+    l1_index = offset >> l1_bits;
+    if (l1_index >= s->l1_size)
+        goto out;
+
+    l2_offset = s->l1_table[l1_index];
+
+    /* seek the l2 table of the given l2 offset */
+
+    if (!l2_offset)
+        goto out;
+
+    /* load the l2 table in memory */
+
+    l2_offset &= ~QCOW_OFLAG_COPIED;
+    l2_table = l2_load(bs, l2_offset);
+    if (l2_table == NULL)
+        return 0;
+
+    /* find the cluster offset for the given disk offset */
+
+    l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);
+    cluster_offset = be64_to_cpu(l2_table[l2_index]);
+    nb_available = s->cluster_sectors;
+    l2_index++;
+
+    if (!cluster_offset) {
+
+       /* how many empty clusters ? */
+
+       while (nb_available < nb_needed && !l2_table[l2_index]) {
+           l2_index++;
+           nb_available += s->cluster_sectors;
+       }
+    } else {
+
+       /* how many allocated clusters ? */
+
+       cluster_offset &= ~QCOW_OFLAG_COPIED;
+       while (nb_available < nb_needed) {
+           next = be64_to_cpu(l2_table[l2_index]) & ~QCOW_OFLAG_COPIED;
+           if (next != cluster_offset + (nb_available << 9))
+               break;
+           l2_index++;
+           nb_available += s->cluster_sectors;
+       }
+   }
+
+out:
+    if (nb_available > nb_needed)
+        nb_available = nb_needed;
+
+    *num = nb_available - index_in_cluster;
+
+    return cluster_offset;
+}
+
+/*
+ * free_any_clusters
+ *
+ * free clusters according to its type: compressed or not
+ *
+ */
+
+static void free_any_clusters(BlockDriverState *bs,
+                              uint64_t cluster_offset, int nb_clusters)
+{
+    BDRVQcowState *s = bs->opaque;
+
+    /* free the cluster */
+
+    if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        int nb_csectors;
+        nb_csectors = ((cluster_offset >> s->csize_shift) &
+                       s->csize_mask) + 1;
+        free_clusters(bs, (cluster_offset & s->cluster_offset_mask) & ~511,
+                      nb_csectors * 512);
+        return;
+    }
+
+    free_clusters(bs, cluster_offset, nb_clusters << s->cluster_bits);
+
+    return;
+}
+
+/*
+ * get_cluster_table
+ *
+ * for a given disk offset, load (and allocate if needed)
+ * the l2 table.
+ *
+ * the l2 table offset in the qcow2 file and the cluster index
+ * in the l2 table are given to the caller.
+ *
+ */
+
+static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
+                             uint64_t **new_l2_table,
+                             uint64_t *new_l2_offset,
+                             int *new_l2_index)
+{
+    BDRVQcowState *s = bs->opaque;
+    int l1_index, l2_index, ret;
+    uint64_t l2_offset, *l2_table;
+
+    /* seek the the l2 offset in the l1 table */
+
+    l1_index = offset >> (s->l2_bits + s->cluster_bits);
+    if (l1_index >= s->l1_size) {
+        ret = grow_l1_table(bs, l1_index + 1);
+        if (ret < 0)
+            return 0;
+    }
+    l2_offset = s->l1_table[l1_index];
+
+    /* seek the l2 table of the given l2 offset */
+
+    if (l2_offset & QCOW_OFLAG_COPIED) {
+        /* load the l2 table in memory */
+        l2_offset &= ~QCOW_OFLAG_COPIED;
+        l2_table = l2_load(bs, l2_offset);
+        if (l2_table == NULL)
+            return 0;
+    } else {
+        if (l2_offset)
+            free_clusters(bs, l2_offset, s->l2_size * sizeof(uint64_t));
+        l2_table = l2_allocate(bs, l1_index);
+        if (l2_table == NULL)
+            return 0;
+        l2_offset = s->l1_table[l1_index] & ~QCOW_OFLAG_COPIED;
+    }
+
+    /* find the cluster offset for the given disk offset */
+
+    l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);
+
+    *new_l2_table = l2_table;
+    *new_l2_offset = l2_offset;
+    *new_l2_index = l2_index;
+
+    return 1;
+}
+
+/*
+ * alloc_compressed_cluster_offset
+ *
+ * For a given offset of the disk image, return cluster offset in
+ * qcow2 file.
+ *
+ * If the offset is not found, allocate a new compressed cluster.
+ *
+ * Return the cluster offset if successful,
+ * Return 0, otherwise.
+ *
+ */
+
+static uint64_t alloc_compressed_cluster_offset(BlockDriverState *bs,
+                                                uint64_t offset,
+                                                int compressed_size)
+{
+    BDRVQcowState *s = bs->opaque;
+    int l2_index, ret;
+    uint64_t l2_offset, *l2_table, cluster_offset;
+    int nb_csectors;
+
+    ret = get_cluster_table(bs, offset, &l2_table, &l2_offset, &l2_index);
+    if (ret == 0)
+        return 0;
+
+    cluster_offset = be64_to_cpu(l2_table[l2_index]);
+    if (cluster_offset & QCOW_OFLAG_COPIED)
+        return cluster_offset & ~QCOW_OFLAG_COPIED;
+
+    if (cluster_offset)
+        free_any_clusters(bs, cluster_offset, 1);
+
+    cluster_offset = alloc_bytes(bs, compressed_size);
+    nb_csectors = ((cluster_offset + compressed_size - 1) >> 9) -
+                  (cluster_offset >> 9);
+
+    cluster_offset |= QCOW_OFLAG_COMPRESSED |
+                      ((uint64_t)nb_csectors << s->csize_shift);
+
+    /* update L2 table */
+
+    /* compressed clusters never have the copied flag */
+
+    l2_table[l2_index] = cpu_to_be64(cluster_offset);
+    if (bdrv_pwrite(s->hd,
+                    l2_offset + l2_index * sizeof(uint64_t),
+                    l2_table + l2_index,
+                    sizeof(uint64_t)) != sizeof(uint64_t))
+        return 0;
+
+    return cluster_offset;
+}
+
+/*
+ * alloc_cluster_offset
+ *
+ * For a given offset of the disk image, return cluster offset in
+ * qcow2 file.
+ *
+ * If the offset is not found, allocate a new cluster.
+ *
+ * Return the cluster offset if successful,
+ * Return 0, otherwise.
+ *
+ */
+
+static uint64_t alloc_cluster_offset(BlockDriverState *bs,
+                                     uint64_t offset,
+                                     int n_start, int n_end,
+                                     int *num)
+{
+    BDRVQcowState *s = bs->opaque;
+    int l2_index, ret;
+    uint64_t l2_offset, *l2_table, cluster_offset;
+    int nb_available, nb_clusters, i, j;
+    uint64_t start_sect, current;
+
+    ret = get_cluster_table(bs, offset, &l2_table, &l2_offset, &l2_index);
+    if (ret == 0)
+        return 0;
+
+    nb_clusters = ((n_end << 9) + s->cluster_size - 1) >>
+                  s->cluster_bits;
+    if (nb_clusters > s->l2_size - l2_index)
+            nb_clusters = s->l2_size - l2_index;
+
+    cluster_offset = be64_to_cpu(l2_table[l2_index]);
+
+    /* We keep all QCOW_OFLAG_COPIED clusters */
+
+    if (cluster_offset & QCOW_OFLAG_COPIED) {
+
+        for (i = 1; i < nb_clusters; i++) {
+            current = be64_to_cpu(l2_table[l2_index + i]);
+            if (cluster_offset + (i << s->cluster_bits) != current)
+                break;
+        }
+        nb_clusters = i;
+
+        nb_available = nb_clusters << (s->cluster_bits - 9);
+        if (nb_available > n_end)
+            nb_available = n_end;
+
+        cluster_offset &= ~QCOW_OFLAG_COPIED;
+
+        goto out;
+    }
+
+    /* for the moment, multiple compressed clusters are not managed */
+
+    if (cluster_offset & QCOW_OFLAG_COMPRESSED)
+        nb_clusters = 1;
+
+    /* how many available clusters ? */
+
+    i = 0;
+    while (i < nb_clusters) {
+
+        i++;
+
+        if (!cluster_offset) {
+
+            /* how many free clusters ? */
+
+            while (i < nb_clusters) {
+                cluster_offset = l2_table[l2_index + i];
+                if (cluster_offset != 0)
+                    break;
+                i++;
+            }
+
+            if ((cluster_offset & QCOW_OFLAG_COPIED) ||
+                (cluster_offset & QCOW_OFLAG_COMPRESSED))
+                break;
+
+        } else {
+
+            /* how many contiguous clusters ? */
+
+            j = 1;
+            current = 0;
+            while (i < nb_clusters) {
+                current = be64_to_cpu(l2_table[l2_index + i]);
+                if (cluster_offset + (j << s->cluster_bits) != current)
+                    break;
+
+                i++;
+                j++;
+            }
+
+            free_any_clusters(bs, cluster_offset, j);
+            if (current)
+                break;
+            cluster_offset = current;
+        }
+    }
+    nb_clusters = i;
+
+    /* allocate a new cluster */
+
+    cluster_offset = alloc_clusters(bs, nb_clusters * s->cluster_size);
+
+    /* we must initialize the cluster content which won't be
+       written */
+
+    nb_available = nb_clusters << (s->cluster_bits - 9);
+    if (nb_available > n_end)
+        nb_available = n_end;
+
+    /* copy content of unmodified sectors */
+
+    start_sect = (offset & ~(s->cluster_size - 1)) >> 9;
+    if (n_start) {
+        ret = copy_sectors(bs, start_sect, cluster_offset, 0, n_start);
+        if (ret < 0)
+            return 0;
+    }
+
+    if (nb_available & (s->cluster_sectors - 1)) {
+        uint64_t end = nb_available & ~(uint64_t)(s->cluster_sectors - 1);
+        ret = copy_sectors(bs, start_sect + end,
+                           cluster_offset + (end << 9),
+                           nb_available - end,
+                           s->cluster_sectors);
+        if (ret < 0)
+            return 0;
+    }
+
+    /* update L2 table */
+
+    for (i = 0; i < nb_clusters; i++)
+        l2_table[l2_index + i] = cpu_to_be64((cluster_offset +
+                                             (i << s->cluster_bits)) |
+                                             QCOW_OFLAG_COPIED);
+
+    if (bdrv_pwrite(s->hd,
+                    l2_offset + l2_index * sizeof(uint64_t),
+                    l2_table + l2_index,
+                    nb_clusters * sizeof(uint64_t)) !=
+                    nb_clusters * sizeof(uint64_t))
+        return 0;
+
+out:
+    *num = nb_available - n_start;
+
+    return cluster_offset;
+}
+
+static int qcow_is_allocated(BlockDriverState *bs, int64_t sector_num,
+                             int nb_sectors, int *pnum)
+{
+    uint64_t cluster_offset;
+
+    *pnum = nb_sectors;
+    cluster_offset = get_cluster_offset(bs, sector_num << 9, pnum);
+
+    return (cluster_offset != 0);
+}
+
+static int decompress_buffer(uint8_t *out_buf, int out_buf_size,
+                             const uint8_t *buf, int buf_size)
+{
+    z_stream strm1, *strm = &strm1;
+    int ret, out_len;
+
+    memset(strm, 0, sizeof(*strm));
+
+    strm->next_in = (uint8_t *)buf;
+    strm->avail_in = buf_size;
+    strm->next_out = out_buf;
+    strm->avail_out = out_buf_size;
+
+    ret = inflateInit2(strm, -12);
+    if (ret != Z_OK)
+        return -1;
+    ret = inflate(strm, Z_FINISH);
+    out_len = strm->next_out - out_buf;
+    if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) ||
+        out_len != out_buf_size) {
+        inflateEnd(strm);
+        return -1;
+    }
+    inflateEnd(strm);
+    return 0;
+}
+
+static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset)
+{
+    int ret, csize, nb_csectors, sector_offset;
+    uint64_t coffset;
+
+    coffset = cluster_offset & s->cluster_offset_mask;
+    if (s->cluster_cache_offset != coffset) {
+        nb_csectors = ((cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
+        sector_offset = coffset & 511;
+        csize = nb_csectors * 512 - sector_offset;
+        ret = bdrv_read(s->hd, coffset >> 9, s->cluster_data, nb_csectors);
+        if (ret < 0) {
+            return -1;
+        }
+        if (decompress_buffer(s->cluster_cache, s->cluster_size,
+                              s->cluster_data + sector_offset, csize) < 0) {
+            return -1;
+        }
+        s->cluster_cache_offset = coffset;
+    }
+    return 0;
+}
+
+/* handle reading after the end of the backing file */
+static int backing_read1(BlockDriverState *bs,
+                         int64_t sector_num, uint8_t *buf, int nb_sectors)
+{
+    int n1;
+    if ((sector_num + nb_sectors) <= bs->total_sectors)
+        return nb_sectors;
+    if (sector_num >= bs->total_sectors)
+        n1 = 0;
+    else
+        n1 = bs->total_sectors - sector_num;
+    memset(buf + n1 * 512, 0, 512 * (nb_sectors - n1));
+    return n1;
+}
+
+static int qcow_read(BlockDriverState *bs, int64_t sector_num,
+                     uint8_t *buf, int nb_sectors)
+{
+    BDRVQcowState *s = bs->opaque;
+    int ret, index_in_cluster, n, n1;
+    uint64_t cluster_offset;
+
+    while (nb_sectors > 0) {
+        n = nb_sectors;
+        cluster_offset = get_cluster_offset(bs, sector_num << 9, &n);
+        index_in_cluster = sector_num & (s->cluster_sectors - 1);
+        if (!cluster_offset) {
+            if (bs->backing_hd) {
+                /* read from the base image */
+                n1 = backing_read1(bs->backing_hd, sector_num, buf, n);
+                if (n1 > 0) {
+                    ret = bdrv_read(bs->backing_hd, sector_num, buf, n1);
+                    if (ret < 0)
+                        return -1;
+                }
+            } else {
+                memset(buf, 0, 512 * n);
+            }
+        } else if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
+            if (decompress_cluster(s, cluster_offset) < 0)
+                return -1;
+            memcpy(buf, s->cluster_cache + index_in_cluster * 512, 512 * n);
+        } else {
+            ret = bdrv_pread(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
+            if (ret != n * 512)
+                return -1;
+            if (s->crypt_method) {
+                encrypt_sectors(s, sector_num, buf, buf, n, 0,
+                                &s->aes_decrypt_key);
+            }
+        }
+        nb_sectors -= n;
+        sector_num += n;
+        buf += n * 512;
+    }
+    return 0;
+}
+
+static int qcow_write(BlockDriverState *bs, int64_t sector_num,
+                     const uint8_t *buf, int nb_sectors)
+{
+    BDRVQcowState *s = bs->opaque;
+    int ret, index_in_cluster, n;
+    uint64_t cluster_offset;
+    int n_end;
+
+    while (nb_sectors > 0) {
+        index_in_cluster = sector_num & (s->cluster_sectors - 1);
+        n_end = index_in_cluster + nb_sectors;
+        if (s->crypt_method &&
+            n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors)
+            n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;
+        cluster_offset = alloc_cluster_offset(bs, sector_num << 9,
+                                              index_in_cluster,
+                                              n_end, &n);
+        if (!cluster_offset)
+            return -1;
+        if (s->crypt_method) {
+            encrypt_sectors(s, sector_num, s->cluster_data, buf, n, 1,
+                            &s->aes_encrypt_key);
+            ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512,
+                              s->cluster_data, n * 512);
+        } else {
+            ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
+        }
+        if (ret != n * 512)
+            return -1;
+        nb_sectors -= n;
+        sector_num += n;
+        buf += n * 512;
+    }
+    s->cluster_cache_offset = -1; /* disable compressed cache */
+    return 0;
+}
+
+typedef struct QCowAIOCB {
+    BlockDriverAIOCB common;
+    int64_t sector_num;
+    uint8_t *buf;
+    int nb_sectors;
+    int n;
+    uint64_t cluster_offset;
+    uint8_t *cluster_data;
+    BlockDriverAIOCB *hd_aiocb;
+} QCowAIOCB;
+
+static void qcow_aio_read_cb(void *opaque, int ret)
+{
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVQcowState *s = bs->opaque;
+    int index_in_cluster, n1;
+
+    acb->hd_aiocb = NULL;
+    if (ret < 0) {
+    fail:
+        acb->common.cb(acb->common.opaque, ret);
+        qemu_aio_release(acb);
+        return;
+    }
+
+ redo:
+    /* post process the read buffer */
+    if (!acb->cluster_offset) {
+        /* nothing to do */
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* nothing to do */
+    } else {
+        if (s->crypt_method) {
+            encrypt_sectors(s, acb->sector_num, acb->buf, acb->buf,
+                            acb->n, 0,
+                            &s->aes_decrypt_key);
+        }
+    }
+
+    acb->nb_sectors -= acb->n;
+    acb->sector_num += acb->n;
+    acb->buf += acb->n * 512;
+
+    if (acb->nb_sectors == 0) {
+        /* request completed */
+        acb->common.cb(acb->common.opaque, 0);
+        qemu_aio_release(acb);
+        return;
+    }
+
+    /* prepare next AIO request */
+    acb->n = acb->nb_sectors;
+    acb->cluster_offset = get_cluster_offset(bs, acb->sector_num << 9, &acb->n);
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+
+    if (!acb->cluster_offset) {
+        if (bs->backing_hd) {
+            /* read from the base image */
+            n1 = backing_read1(bs->backing_hd, acb->sector_num,
+                               acb->buf, acb->n);
+            if (n1 > 0) {
+                acb->hd_aiocb = bdrv_aio_read(bs->backing_hd, acb->sector_num,
+                                    acb->buf, acb->n, qcow_aio_read_cb, acb);
+                if (acb->hd_aiocb == NULL)
+                    goto fail;
+            } else {
+                goto redo;
+            }
+        } else {
+            /* Note: in this case, no need to wait */
+            memset(acb->buf, 0, 512 * acb->n);
+            goto redo;
+        }
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* add AIO support for compressed blocks ? */
+        if (decompress_cluster(s, acb->cluster_offset) < 0)
+            goto fail;
+        memcpy(acb->buf,
+               s->cluster_cache + index_in_cluster * 512, 512 * acb->n);
+        goto redo;
+    } else {
+        if ((acb->cluster_offset & 511) != 0) {
+            ret = -EIO;
+            goto fail;
+        }
+        acb->hd_aiocb = bdrv_aio_read(s->hd,
+                            (acb->cluster_offset >> 9) + index_in_cluster,
+                            acb->buf, acb->n, qcow_aio_read_cb, acb);
+        if (acb->hd_aiocb == NULL)
+            goto fail;
+    }
+}
+
+static QCowAIOCB *qcow_aio_setup(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    QCowAIOCB *acb;
+
+    acb = qemu_aio_get(bs, cb, opaque);
+    if (!acb)
+        return NULL;
+    acb->hd_aiocb = NULL;
+    acb->sector_num = sector_num;
+    acb->buf = buf;
+    acb->nb_sectors = nb_sectors;
+    acb->n = 0;
+    acb->cluster_offset = 0;
+    return acb;
+}
+
+static BlockDriverAIOCB *qcow_aio_read(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    QCowAIOCB *acb;
+
+    acb = qcow_aio_setup(bs, sector_num, buf, nb_sectors, cb, opaque);
+    if (!acb)
+        return NULL;
+
+    qcow_aio_read_cb(acb, 0);
+    return &acb->common;
+}
+
+static void qcow_aio_write_cb(void *opaque, int ret)
+{
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVQcowState *s = bs->opaque;
+    int index_in_cluster;
+    uint64_t cluster_offset;
+    const uint8_t *src_buf;
+    int n_end;
+
+    acb->hd_aiocb = NULL;
+
+    if (ret < 0) {
+    fail:
+        acb->common.cb(acb->common.opaque, ret);
+        qemu_aio_release(acb);
+        return;
+    }
+
+    acb->nb_sectors -= acb->n;
+    acb->sector_num += acb->n;
+    acb->buf += acb->n * 512;
+
+    if (acb->nb_sectors == 0) {
+        /* request completed */
+        acb->common.cb(acb->common.opaque, 0);
+        qemu_aio_release(acb);
+        return;
+    }
+
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+    n_end = index_in_cluster + acb->nb_sectors;
+    if (s->crypt_method &&
+        n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors)
+        n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;
+
+    cluster_offset = alloc_cluster_offset(bs, acb->sector_num << 9,
+                                          index_in_cluster,
+                                          n_end, &acb->n);
+    if (!cluster_offset || (cluster_offset & 511) != 0) {
+        ret = -EIO;
+        goto fail;
+    }
+    if (s->crypt_method) {
+        if (!acb->cluster_data) {
+            acb->cluster_data = qemu_mallocz(QCOW_MAX_CRYPT_CLUSTERS *
+                                             s->cluster_size);
+            if (!acb->cluster_data) {
+                ret = -ENOMEM;
+                goto fail;
+            }
+        }
+        encrypt_sectors(s, acb->sector_num, acb->cluster_data, acb->buf,
+                        acb->n, 1, &s->aes_encrypt_key);
+        src_buf = acb->cluster_data;
+    } else {
+        src_buf = acb->buf;
+    }
+    acb->hd_aiocb = bdrv_aio_write(s->hd,
+                                   (cluster_offset >> 9) + index_in_cluster,
+                                   src_buf, acb->n,
+                                   qcow_aio_write_cb, acb);
+    if (acb->hd_aiocb == NULL)
+        goto fail;
+}
+
+static BlockDriverAIOCB *qcow_aio_write(BlockDriverState *bs,
+        int64_t sector_num, const uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowAIOCB *acb;
+
+    s->cluster_cache_offset = -1; /* disable compressed cache */
+
+    acb = qcow_aio_setup(bs, sector_num, (uint8_t*)buf, nb_sectors, cb, opaque);
+    if (!acb)
+        return NULL;
+
+    qcow_aio_write_cb(acb, 0);
+    return &acb->common;
+}
+
+static void qcow_aio_cancel(BlockDriverAIOCB *blockacb)
+{
+    QCowAIOCB *acb = (QCowAIOCB *)blockacb;
+    if (acb->hd_aiocb)
+        bdrv_aio_cancel(acb->hd_aiocb);
+    qemu_aio_release(acb);
+}
+
+static void qcow_close(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+    qemu_free(s->l1_table);
+    qemu_free(s->l2_cache);
+    qemu_free(s->cluster_cache);
+    qemu_free(s->cluster_data);
+    refcount_close(bs);
+    bdrv_delete(s->hd);
+}
+
+/* XXX: use std qcow open function ? */
+typedef struct QCowCreateState {
+    int cluster_size;
+    int cluster_bits;
+    uint16_t *refcount_block;
+    uint64_t *refcount_table;
+    int64_t l1_table_offset;
+    int64_t refcount_table_offset;
+    int64_t refcount_block_offset;
+} QCowCreateState;
+
+static void create_refcount_update(QCowCreateState *s,
+                                   int64_t offset, int64_t size)
+{
+    int refcount;
+    int64_t start, last, cluster_offset;
+    uint16_t *p;
+
+    start = offset & ~(s->cluster_size - 1);
+    last = (offset + size - 1)  & ~(s->cluster_size - 1);
+    for(cluster_offset = start; cluster_offset <= last;
+        cluster_offset += s->cluster_size) {
+        p = &s->refcount_block[cluster_offset >> s->cluster_bits];
+        refcount = be16_to_cpu(*p);
+        refcount++;
+        *p = cpu_to_be16(refcount);
+    }
+}
+
+static int qcow_create(const char *filename, int64_t total_size,
+                      const char *backing_file, int flags)
+{
+    int fd, header_size, backing_filename_len, l1_size, i, shift, l2_bits;
+    QCowHeader header;
+    uint64_t tmp, offset;
+    QCowCreateState s1, *s = &s1;
+
+    memset(s, 0, sizeof(*s));
+
+    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
+    if (fd < 0)
+        return -1;
+    memset(&header, 0, sizeof(header));
+    header.magic = cpu_to_be32(QCOW_MAGIC);
+    header.version = cpu_to_be32(QCOW_VERSION);
+    header.size = cpu_to_be64(total_size * 512);
+    header_size = sizeof(header);
+    backing_filename_len = 0;
+    if (backing_file) {
+        header.backing_file_offset = cpu_to_be64(header_size);
+        backing_filename_len = strlen(backing_file);
+        header.backing_file_size = cpu_to_be32(backing_filename_len);
+        header_size += backing_filename_len;
+    }
+    s->cluster_bits = 12;  /* 4 KB clusters */
+    s->cluster_size = 1 << s->cluster_bits;
+    header.cluster_bits = cpu_to_be32(s->cluster_bits);
+    header_size = (header_size + 7) & ~7;
+    if (flags & BLOCK_FLAG_ENCRYPT) {
+        header.crypt_method = cpu_to_be32(QCOW_CRYPT_AES);
+    } else {
+        header.crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
+    }
+    l2_bits = s->cluster_bits - 3;
+    shift = s->cluster_bits + l2_bits;
+    l1_size = (((total_size * 512) + (1LL << shift) - 1) >> shift);
+    offset = align_offset(header_size, s->cluster_size);
+    s->l1_table_offset = offset;
+    header.l1_table_offset = cpu_to_be64(s->l1_table_offset);
+    header.l1_size = cpu_to_be32(l1_size);
+    offset += align_offset(l1_size * sizeof(uint64_t), s->cluster_size);
+
+    s->refcount_table = qemu_mallocz(s->cluster_size);
+    if (!s->refcount_table)
+        goto fail;
+    s->refcount_block = qemu_mallocz(s->cluster_size);
+    if (!s->refcount_block)
+        goto fail;
+
+    s->refcount_table_offset = offset;
+    header.refcount_table_offset = cpu_to_be64(offset);
+    header.refcount_table_clusters = cpu_to_be32(1);
+    offset += s->cluster_size;
+
+    s->refcount_table[0] = cpu_to_be64(offset);
+    s->refcount_block_offset = offset;
+    offset += s->cluster_size;
+
+    /* update refcounts */
+    create_refcount_update(s, 0, header_size);
+    create_refcount_update(s, s->l1_table_offset, l1_size * sizeof(uint64_t));
+    create_refcount_update(s, s->refcount_table_offset, s->cluster_size);
+    create_refcount_update(s, s->refcount_block_offset, s->cluster_size);
+
+    /* write all the data */
+    write(fd, &header, sizeof(header));
+    if (backing_file) {
+        write(fd, backing_file, backing_filename_len);
+    }
+    lseek(fd, s->l1_table_offset, SEEK_SET);
+    tmp = 0;
+    for(i = 0;i < l1_size; i++) {
+        write(fd, &tmp, sizeof(tmp));
+    }
+    lseek(fd, s->refcount_table_offset, SEEK_SET);
+    write(fd, s->refcount_table, s->cluster_size);
+
+    lseek(fd, s->refcount_block_offset, SEEK_SET);
+    write(fd, s->refcount_block, s->cluster_size);
+
+    qemu_free(s->refcount_table);
+    qemu_free(s->refcount_block);
+    close(fd);
+    return 0;
+ fail:
+    qemu_free(s->refcount_table);
+    qemu_free(s->refcount_block);
+    close(fd);
+    return -ENOMEM;
+}
+
+static int qcow_make_empty(BlockDriverState *bs)
+{
+#if 0
+    /* XXX: not correct */
+    BDRVQcowState *s = bs->opaque;
+    uint32_t l1_length = s->l1_size * sizeof(uint64_t);
+    int ret;
+
+    memset(s->l1_table, 0, l1_length);
+    if (bdrv_pwrite(s->hd, s->l1_table_offset, s->l1_table, l1_length) < 0)
+	return -1;
+    ret = bdrv_truncate(s->hd, s->l1_table_offset + l1_length);
+    if (ret < 0)
+        return ret;
+
+    l2_cache_reset(bs);
+#endif
+    return 0;
+}
+
+/* XXX: put compressed sectors first, then all the cluster aligned
+   tables to avoid losing bytes in alignment */
+static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
+                                 const uint8_t *buf, int nb_sectors)
+{
+    BDRVQcowState *s = bs->opaque;
+    z_stream strm;
+    int ret, out_len;
+    uint8_t *out_buf;
+    uint64_t cluster_offset;
+
+    if (nb_sectors == 0) {
+        /* align end of file to a sector boundary to ease reading with
+           sector based I/Os */
+        cluster_offset = bdrv_getlength(s->hd);
+        cluster_offset = (cluster_offset + 511) & ~511;
+        bdrv_truncate(s->hd, cluster_offset);
+        return 0;
+    }
+
+    if (nb_sectors != s->cluster_sectors)
+        return -EINVAL;
+
+    out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    if (!out_buf)
+        return -ENOMEM;
+
+    /* best compression, small window, no zlib header */
+    memset(&strm, 0, sizeof(strm));
+    ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION,
+                       Z_DEFLATED, -12,
+                       9, Z_DEFAULT_STRATEGY);
+    if (ret != 0) {
+        qemu_free(out_buf);
+        return -1;
+    }
+
+    strm.avail_in = s->cluster_size;
+    strm.next_in = (uint8_t *)buf;
+    strm.avail_out = s->cluster_size;
+    strm.next_out = out_buf;
+
+    ret = deflate(&strm, Z_FINISH);
+    if (ret != Z_STREAM_END && ret != Z_OK) {
+        qemu_free(out_buf);
+        deflateEnd(&strm);
+        return -1;
+    }
+    out_len = strm.next_out - out_buf;
+
+    deflateEnd(&strm);
+
+    if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
+        /* could not compress: write normal cluster */
+        qcow_write(bs, sector_num, buf, s->cluster_sectors);
+    } else {
+        cluster_offset = alloc_compressed_cluster_offset(bs, sector_num << 9,
+                                              out_len);
+        if (!cluster_offset)
+            return -1;
+        cluster_offset &= s->cluster_offset_mask;
+        if (bdrv_pwrite(s->hd, cluster_offset, out_buf, out_len) != out_len) {
+            qemu_free(out_buf);
+            return -1;
+        }
+    }
+
+    qemu_free(out_buf);
+    return 0;
+}
+
+static void qcow_flush(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+    bdrv_flush(s->hd);
+}
+
+static int qcow_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
+{
+    BDRVQcowState *s = bs->opaque;
+    bdi->cluster_size = s->cluster_size;
+    bdi->vm_state_offset = (int64_t)s->l1_vm_state_index <<
+        (s->cluster_bits + s->l2_bits);
+    return 0;
+}
+
+/*********************************************************/
+/* snapshot support */
+
+/* update the refcounts of snapshots and the copied flag */
+static int update_snapshot_refcount(BlockDriverState *bs,
+                                    int64_t l1_table_offset,
+                                    int l1_size,
+                                    int addend)
+{
+    BDRVQcowState *s = bs->opaque;
+    uint64_t *l1_table, *l2_table, l2_offset, offset, l1_size2, l1_allocated;
+    int64_t old_offset, old_l2_offset;
+    int l2_size, i, j, l1_modified, l2_modified, nb_csectors, refcount;
+
+    l2_cache_reset(bs);
+
+    l2_table = NULL;
+    l1_table = NULL;
+    l1_size2 = l1_size * sizeof(uint64_t);
+    l1_allocated = 0;
+    if (l1_table_offset != s->l1_table_offset) {
+        l1_table = qemu_malloc(l1_size2);
+        if (!l1_table)
+            goto fail;
+        l1_allocated = 1;
+        if (bdrv_pread(s->hd, l1_table_offset,
+                       l1_table, l1_size2) != l1_size2)
+            goto fail;
+        for(i = 0;i < l1_size; i++)
+            be64_to_cpus(&l1_table[i]);
+    } else {
+        assert(l1_size == s->l1_size);
+        l1_table = s->l1_table;
+        l1_allocated = 0;
+    }
+
+    l2_size = s->l2_size * sizeof(uint64_t);
+    l2_table = qemu_malloc(l2_size);
+    if (!l2_table)
+        goto fail;
+    l1_modified = 0;
+    for(i = 0; i < l1_size; i++) {
+        l2_offset = l1_table[i];
+        if (l2_offset) {
+            old_l2_offset = l2_offset;
+            l2_offset &= ~QCOW_OFLAG_COPIED;
+            l2_modified = 0;
+            if (bdrv_pread(s->hd, l2_offset, l2_table, l2_size) != l2_size)
+                goto fail;
+            for(j = 0; j < s->l2_size; j++) {
+                offset = be64_to_cpu(l2_table[j]);
+                if (offset != 0) {
+                    old_offset = offset;
+                    offset &= ~QCOW_OFLAG_COPIED;
+                    if (offset & QCOW_OFLAG_COMPRESSED) {
+                        nb_csectors = ((offset >> s->csize_shift) &
+                                       s->csize_mask) + 1;
+                        if (addend != 0)
+                            update_refcount(bs, (offset & s->cluster_offset_mask) & ~511,
+                                            nb_csectors * 512, addend);
+                        /* compressed clusters are never modified */
+                        refcount = 2;
+                    } else {
+                        if (addend != 0) {
+                            refcount = update_cluster_refcount(bs, offset >> s->cluster_bits, addend);
+                        } else {
+                            refcount = get_refcount(bs, offset >> s->cluster_bits);
+                        }
+                    }
+
+                    if (refcount == 1) {
+                        offset |= QCOW_OFLAG_COPIED;
+                    }
+                    if (offset != old_offset) {
+                        l2_table[j] = cpu_to_be64(offset);
+                        l2_modified = 1;
+                    }
+                }
+            }
+            if (l2_modified) {
+                if (bdrv_pwrite(s->hd,
+                                l2_offset, l2_table, l2_size) != l2_size)
+                    goto fail;
+            }
+
+            if (addend != 0) {
+                refcount = update_cluster_refcount(bs, l2_offset >> s->cluster_bits, addend);
+            } else {
+                refcount = get_refcount(bs, l2_offset >> s->cluster_bits);
+            }
+            if (refcount == 1) {
+                l2_offset |= QCOW_OFLAG_COPIED;
+            }
+            if (l2_offset != old_l2_offset) {
+                l1_table[i] = l2_offset;
+                l1_modified = 1;
+            }
+        }
+    }
+    if (l1_modified) {
+        for(i = 0; i < l1_size; i++)
+            cpu_to_be64s(&l1_table[i]);
+        if (bdrv_pwrite(s->hd, l1_table_offset, l1_table,
+                        l1_size2) != l1_size2)
+            goto fail;
+        for(i = 0; i < l1_size; i++)
+            be64_to_cpus(&l1_table[i]);
+    }
+    if (l1_allocated)
+        qemu_free(l1_table);
+    qemu_free(l2_table);
+    return 0;
+ fail:
+    if (l1_allocated)
+        qemu_free(l1_table);
+    qemu_free(l2_table);
+    return -EIO;
+}
+
+static void qcow_free_snapshots(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+    int i;
+
+    for(i = 0; i < s->nb_snapshots; i++) {
+        qemu_free(s->snapshots[i].name);
+        qemu_free(s->snapshots[i].id_str);
+    }
+    qemu_free(s->snapshots);
+    s->snapshots = NULL;
+    s->nb_snapshots = 0;
+}
+
+static int qcow_read_snapshots(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowSnapshotHeader h;
+    QCowSnapshot *sn;
+    int i, id_str_size, name_size;
+    int64_t offset;
+    uint32_t extra_data_size;
+
+    offset = s->snapshots_offset;
+    s->snapshots = qemu_mallocz(s->nb_snapshots * sizeof(QCowSnapshot));
+    if (!s->snapshots)
+        goto fail;
+    for(i = 0; i < s->nb_snapshots; i++) {
+        offset = align_offset(offset, 8);
+        if (bdrv_pread(s->hd, offset, &h, sizeof(h)) != sizeof(h))
+            goto fail;
+        offset += sizeof(h);
+        sn = s->snapshots + i;
+        sn->l1_table_offset = be64_to_cpu(h.l1_table_offset);
+        sn->l1_size = be32_to_cpu(h.l1_size);
+        sn->vm_state_size = be32_to_cpu(h.vm_state_size);
+        sn->date_sec = be32_to_cpu(h.date_sec);
+        sn->date_nsec = be32_to_cpu(h.date_nsec);
+        sn->vm_clock_nsec = be64_to_cpu(h.vm_clock_nsec);
+        extra_data_size = be32_to_cpu(h.extra_data_size);
+
+        id_str_size = be16_to_cpu(h.id_str_size);
+        name_size = be16_to_cpu(h.name_size);
+
+        offset += extra_data_size;
+
+        sn->id_str = qemu_malloc(id_str_size + 1);
+        if (!sn->id_str)
+            goto fail;
+        if (bdrv_pread(s->hd, offset, sn->id_str, id_str_size) != id_str_size)
+            goto fail;
+        offset += id_str_size;
+        sn->id_str[id_str_size] = '\0';
+
+        sn->name = qemu_malloc(name_size + 1);
+        if (!sn->name)
+            goto fail;
+        if (bdrv_pread(s->hd, offset, sn->name, name_size) != name_size)
+            goto fail;
+        offset += name_size;
+        sn->name[name_size] = '\0';
+    }
+    s->snapshots_size = offset - s->snapshots_offset;
+    return 0;
+ fail:
+    qcow_free_snapshots(bs);
+    return -1;
+}
+
+/* add at the end of the file a new list of snapshots */
+static int qcow_write_snapshots(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowSnapshot *sn;
+    QCowSnapshotHeader h;
+    int i, name_size, id_str_size, snapshots_size;
+    uint64_t data64;
+    uint32_t data32;
+    int64_t offset, snapshots_offset;
+
+    /* compute the size of the snapshots */
+    offset = 0;
+    for(i = 0; i < s->nb_snapshots; i++) {
+        sn = s->snapshots + i;
+        offset = align_offset(offset, 8);
+        offset += sizeof(h);
+        offset += strlen(sn->id_str);
+        offset += strlen(sn->name);
+    }
+    snapshots_size = offset;
+
+    snapshots_offset = alloc_clusters(bs, snapshots_size);
+    offset = snapshots_offset;
+
+    for(i = 0; i < s->nb_snapshots; i++) {
+        sn = s->snapshots + i;
+        memset(&h, 0, sizeof(h));
+        h.l1_table_offset = cpu_to_be64(sn->l1_table_offset);
+        h.l1_size = cpu_to_be32(sn->l1_size);
+        h.vm_state_size = cpu_to_be32(sn->vm_state_size);
+        h.date_sec = cpu_to_be32(sn->date_sec);
+        h.date_nsec = cpu_to_be32(sn->date_nsec);
+        h.vm_clock_nsec = cpu_to_be64(sn->vm_clock_nsec);
+
+        id_str_size = strlen(sn->id_str);
+        name_size = strlen(sn->name);
+        h.id_str_size = cpu_to_be16(id_str_size);
+        h.name_size = cpu_to_be16(name_size);
+        offset = align_offset(offset, 8);
+        if (bdrv_pwrite(s->hd, offset, &h, sizeof(h)) != sizeof(h))
+            goto fail;
+        offset += sizeof(h);
+        if (bdrv_pwrite(s->hd, offset, sn->id_str, id_str_size) != id_str_size)
+            goto fail;
+        offset += id_str_size;
+        if (bdrv_pwrite(s->hd, offset, sn->name, name_size) != name_size)
+            goto fail;
+        offset += name_size;
+    }
+
+    /* update the various header fields */
+    data64 = cpu_to_be64(snapshots_offset);
+    if (bdrv_pwrite(s->hd, offsetof(QCowHeader, snapshots_offset),
+                    &data64, sizeof(data64)) != sizeof(data64))
+        goto fail;
+    data32 = cpu_to_be32(s->nb_snapshots);
+    if (bdrv_pwrite(s->hd, offsetof(QCowHeader, nb_snapshots),
+                    &data32, sizeof(data32)) != sizeof(data32))
+        goto fail;
+
+    /* free the old snapshot table */
+    free_clusters(bs, s->snapshots_offset, s->snapshots_size);
+    s->snapshots_offset = snapshots_offset;
+    s->snapshots_size = snapshots_size;
+    return 0;
+ fail:
+    return -1;
+}
+
+static void find_new_snapshot_id(BlockDriverState *bs,
+                                 char *id_str, int id_str_size)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowSnapshot *sn;
+    int i, id, id_max = 0;
+
+    for(i = 0; i < s->nb_snapshots; i++) {
+        sn = s->snapshots + i;
+        id = strtoul(sn->id_str, NULL, 10);
+        if (id > id_max)
+            id_max = id;
+    }
+    snprintf(id_str, id_str_size, "%d", id_max + 1);
+}
+
+static int find_snapshot_by_id(BlockDriverState *bs, const char *id_str)
+{
+    BDRVQcowState *s = bs->opaque;
+    int i;
+
+    for(i = 0; i < s->nb_snapshots; i++) {
+        if (!strcmp(s->snapshots[i].id_str, id_str))
+            return i;
+    }
+    return -1;
+}
+
+static int find_snapshot_by_id_or_name(BlockDriverState *bs, const char *name)
+{
+    BDRVQcowState *s = bs->opaque;
+    int i, ret;
+
+    ret = find_snapshot_by_id(bs, name);
+    if (ret >= 0)
+        return ret;
+    for(i = 0; i < s->nb_snapshots; i++) {
+        if (!strcmp(s->snapshots[i].name, name))
+            return i;
+    }
+    return -1;
+}
+
+/* if no id is provided, a new one is constructed */
+static int qcow_snapshot_create(BlockDriverState *bs,
+                                QEMUSnapshotInfo *sn_info)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowSnapshot *snapshots1, sn1, *sn = &sn1;
+    int i, ret;
+    uint64_t *l1_table = NULL;
+
+    memset(sn, 0, sizeof(*sn));
+
+    if (sn_info->id_str[0] == '\0') {
+        /* compute a new id */
+        find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str));
+    }
+
+    /* check that the ID is unique */
+    if (find_snapshot_by_id(bs, sn_info->id_str) >= 0)
+        return -ENOENT;
+
+    sn->id_str = qemu_strdup(sn_info->id_str);
+    if (!sn->id_str)
+        goto fail;
+    sn->name = qemu_strdup(sn_info->name);
+    if (!sn->name)
+        goto fail;
+    sn->vm_state_size = sn_info->vm_state_size;
+    sn->date_sec = sn_info->date_sec;
+    sn->date_nsec = sn_info->date_nsec;
+    sn->vm_clock_nsec = sn_info->vm_clock_nsec;
+
+    ret = update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1);
+    if (ret < 0)
+        goto fail;
+
+    /* create the L1 table of the snapshot */
+    sn->l1_table_offset = alloc_clusters(bs, s->l1_size * sizeof(uint64_t));
+    sn->l1_size = s->l1_size;
+
+    l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
+    if (!l1_table)
+        goto fail;
+    for(i = 0; i < s->l1_size; i++) {
+        l1_table[i] = cpu_to_be64(s->l1_table[i]);
+    }
+    if (bdrv_pwrite(s->hd, sn->l1_table_offset,
+                    l1_table, s->l1_size * sizeof(uint64_t)) !=
+        (s->l1_size * sizeof(uint64_t)))
+        goto fail;
+    qemu_free(l1_table);
+    l1_table = NULL;
+
+    snapshots1 = qemu_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
+    if (!snapshots1)
+        goto fail;
+    memcpy(snapshots1, s->snapshots, s->nb_snapshots * sizeof(QCowSnapshot));
+    s->snapshots = snapshots1;
+    s->snapshots[s->nb_snapshots++] = *sn;
+
+    if (qcow_write_snapshots(bs) < 0)
+        goto fail;
+#ifdef DEBUG_ALLOC
+    check_refcounts(bs);
+#endif
+    return 0;
+ fail:
+    qemu_free(sn->name);
+    qemu_free(l1_table);
+    return -1;
+}
+
+/* copy the snapshot 'snapshot_name' into the current disk image */
+static int qcow_snapshot_goto(BlockDriverState *bs,
+                              const char *snapshot_id)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowSnapshot *sn;
+    int i, snapshot_index, l1_size2;
+
+    snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
+    if (snapshot_index < 0)
+        return -ENOENT;
+    sn = &s->snapshots[snapshot_index];
+
+    if (update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, -1) < 0)
+        goto fail;
+
+    if (grow_l1_table(bs, sn->l1_size) < 0)
+        goto fail;
+
+    s->l1_size = sn->l1_size;
+    l1_size2 = s->l1_size * sizeof(uint64_t);
+    /* copy the snapshot l1 table to the current l1 table */
+    if (bdrv_pread(s->hd, sn->l1_table_offset,
+                   s->l1_table, l1_size2) != l1_size2)
+        goto fail;
+    if (bdrv_pwrite(s->hd, s->l1_table_offset,
+                    s->l1_table, l1_size2) != l1_size2)
+        goto fail;
+    for(i = 0;i < s->l1_size; i++) {
+        be64_to_cpus(&s->l1_table[i]);
+    }
+
+    if (update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1) < 0)
+        goto fail;
+
+#ifdef DEBUG_ALLOC
+    check_refcounts(bs);
+#endif
+    return 0;
+ fail:
+    return -EIO;
+}
+
+static int qcow_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowSnapshot *sn;
+    int snapshot_index, ret;
+
+    snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
+    if (snapshot_index < 0)
+        return -ENOENT;
+    sn = &s->snapshots[snapshot_index];
+
+    ret = update_snapshot_refcount(bs, sn->l1_table_offset, sn->l1_size, -1);
+    if (ret < 0)
+        return ret;
+    /* must update the copied flag on the current cluster offsets */
+    ret = update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
+    if (ret < 0)
+        return ret;
+    free_clusters(bs, sn->l1_table_offset, sn->l1_size * sizeof(uint64_t));
+
+    qemu_free(sn->id_str);
+    qemu_free(sn->name);
+    memmove(sn, sn + 1, (s->nb_snapshots - snapshot_index - 1) * sizeof(*sn));
+    s->nb_snapshots--;
+    ret = qcow_write_snapshots(bs);
+    if (ret < 0) {
+        /* XXX: restore snapshot if error ? */
+        return ret;
+    }
+#ifdef DEBUG_ALLOC
+    check_refcounts(bs);
+#endif
+    return 0;
+}
+
+static int qcow_snapshot_list(BlockDriverState *bs,
+                              QEMUSnapshotInfo **psn_tab)
+{
+    BDRVQcowState *s = bs->opaque;
+    QEMUSnapshotInfo *sn_tab, *sn_info;
+    QCowSnapshot *sn;
+    int i;
+
+    sn_tab = qemu_mallocz(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
+    if (!sn_tab)
+        goto fail;
+    for(i = 0; i < s->nb_snapshots; i++) {
+        sn_info = sn_tab + i;
+        sn = s->snapshots + i;
+        pstrcpy(sn_info->id_str, sizeof(sn_info->id_str),
+                sn->id_str);
+        pstrcpy(sn_info->name, sizeof(sn_info->name),
+                sn->name);
+        sn_info->vm_state_size = sn->vm_state_size;
+        sn_info->date_sec = sn->date_sec;
+        sn_info->date_nsec = sn->date_nsec;
+        sn_info->vm_clock_nsec = sn->vm_clock_nsec;
+    }
+    *psn_tab = sn_tab;
+    return s->nb_snapshots;
+ fail:
+    qemu_free(sn_tab);
+    *psn_tab = NULL;
+    return -ENOMEM;
+}
+
+/*********************************************************/
+/* refcount handling */
+
+static int refcount_init(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+    int ret, refcount_table_size2, i;
+
+    s->refcount_block_cache = qemu_malloc(s->cluster_size);
+    if (!s->refcount_block_cache)
+        goto fail;
+    refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);
+    s->refcount_table = qemu_malloc(refcount_table_size2);
+    if (!s->refcount_table)
+        goto fail;
+    if (s->refcount_table_size > 0) {
+        ret = bdrv_pread(s->hd, s->refcount_table_offset,
+                         s->refcount_table, refcount_table_size2);
+        if (ret != refcount_table_size2)
+            goto fail;
+        for(i = 0; i < s->refcount_table_size; i++)
+            be64_to_cpus(&s->refcount_table[i]);
+    }
+    return 0;
+ fail:
+    return -ENOMEM;
+}
+
+static void refcount_close(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+    qemu_free(s->refcount_block_cache);
+    qemu_free(s->refcount_table);
+}
+
+
+static int load_refcount_block(BlockDriverState *bs,
+                               int64_t refcount_block_offset)
+{
+    BDRVQcowState *s = bs->opaque;
+    int ret;
+    ret = bdrv_pread(s->hd, refcount_block_offset, s->refcount_block_cache,
+                     s->cluster_size);
+    if (ret != s->cluster_size)
+        return -EIO;
+    s->refcount_block_cache_offset = refcount_block_offset;
+    return 0;
+}
+
+static int get_refcount(BlockDriverState *bs, int64_t cluster_index)
+{
+    BDRVQcowState *s = bs->opaque;
+    int refcount_table_index, block_index;
+    int64_t refcount_block_offset;
+
+    refcount_table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT);
+    if (refcount_table_index >= s->refcount_table_size)
+        return 0;
+    refcount_block_offset = s->refcount_table[refcount_table_index];
+    if (!refcount_block_offset)
+        return 0;
+    if (refcount_block_offset != s->refcount_block_cache_offset) {
+        /* better than nothing: return allocated if read error */
+        if (load_refcount_block(bs, refcount_block_offset) < 0)
+            return 1;
+    }
+    block_index = cluster_index &
+        ((1 << (s->cluster_bits - REFCOUNT_SHIFT)) - 1);
+    return be16_to_cpu(s->refcount_block_cache[block_index]);
+}
+
+/* return < 0 if error */
+static int64_t alloc_clusters_noref(BlockDriverState *bs, int64_t size)
+{
+    BDRVQcowState *s = bs->opaque;
+    int i, nb_clusters;
+
+    nb_clusters = (size + s->cluster_size - 1) >> s->cluster_bits;
+    for(;;) {
+        if (get_refcount(bs, s->free_cluster_index) == 0) {
+            s->free_cluster_index++;
+            for(i = 1; i < nb_clusters; i++) {
+                if (get_refcount(bs, s->free_cluster_index) != 0)
+                    goto not_found;
+                s->free_cluster_index++;
+            }
+#ifdef DEBUG_ALLOC2
+            printf("alloc_clusters: size=%lld -> %lld\n",
+                   size,
+                   (s->free_cluster_index - nb_clusters) << s->cluster_bits);
+#endif
+            return (s->free_cluster_index - nb_clusters) << s->cluster_bits;
+        } else {
+        not_found:
+            s->free_cluster_index++;
+        }
+    }
+}
+
+static int64_t alloc_clusters(BlockDriverState *bs, int64_t size)
+{
+    int64_t offset;
+
+    offset = alloc_clusters_noref(bs, size);
+    update_refcount(bs, offset, size, 1);
+    return offset;
+}
+
+/* only used to allocate compressed sectors. We try to allocate
+   contiguous sectors. size must be <= cluster_size */
+static int64_t alloc_bytes(BlockDriverState *bs, int size)
+{
+    BDRVQcowState *s = bs->opaque;
+    int64_t offset, cluster_offset;
+    int free_in_cluster;
+
+    assert(size > 0 && size <= s->cluster_size);
+    if (s->free_byte_offset == 0) {
+        s->free_byte_offset = alloc_clusters(bs, s->cluster_size);
+    }
+ redo:
+    free_in_cluster = s->cluster_size -
+        (s->free_byte_offset & (s->cluster_size - 1));
+    if (size <= free_in_cluster) {
+        /* enough space in current cluster */
+        offset = s->free_byte_offset;
+        s->free_byte_offset += size;
+        free_in_cluster -= size;
+        if (free_in_cluster == 0)
+            s->free_byte_offset = 0;
+        if ((offset & (s->cluster_size - 1)) != 0)
+            update_cluster_refcount(bs, offset >> s->cluster_bits, 1);
+    } else {
+        offset = alloc_clusters(bs, s->cluster_size);
+        cluster_offset = s->free_byte_offset & ~(s->cluster_size - 1);
+        if ((cluster_offset + s->cluster_size) == offset) {
+            /* we are lucky: contiguous data */
+            offset = s->free_byte_offset;
+            update_cluster_refcount(bs, offset >> s->cluster_bits, 1);
+            s->free_byte_offset += size;
+        } else {
+            s->free_byte_offset = offset;
+            goto redo;
+        }
+    }
+    return offset;
+}
+
+static void free_clusters(BlockDriverState *bs,
+                          int64_t offset, int64_t size)
+{
+    update_refcount(bs, offset, size, -1);
+}
+
+static int grow_refcount_table(BlockDriverState *bs, int min_size)
+{
+    BDRVQcowState *s = bs->opaque;
+    int new_table_size, new_table_size2, refcount_table_clusters, i, ret;
+    uint64_t *new_table;
+    int64_t table_offset;
+    uint64_t data64;
+    uint32_t data32;
+    int old_table_size;
+    int64_t old_table_offset;
+
+    if (min_size <= s->refcount_table_size)
+        return 0;
+    /* compute new table size */
+    refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
+    for(;;) {
+        if (refcount_table_clusters == 0) {
+            refcount_table_clusters = 1;
+        } else {
+            refcount_table_clusters = (refcount_table_clusters * 3 + 1) / 2;
+        }
+        new_table_size = refcount_table_clusters << (s->cluster_bits - 3);
+        if (min_size <= new_table_size)
+            break;
+    }
+#ifdef DEBUG_ALLOC2
+    printf("grow_refcount_table from %d to %d\n",
+           s->refcount_table_size,
+           new_table_size);
+#endif
+    new_table_size2 = new_table_size * sizeof(uint64_t);
+    new_table = qemu_mallocz(new_table_size2);
+    if (!new_table)
+        return -ENOMEM;
+    memcpy(new_table, s->refcount_table,
+           s->refcount_table_size * sizeof(uint64_t));
+    for(i = 0; i < s->refcount_table_size; i++)
+        cpu_to_be64s(&new_table[i]);
+    /* Note: we cannot update the refcount now to avoid recursion */
+    table_offset = alloc_clusters_noref(bs, new_table_size2);
+    ret = bdrv_pwrite(s->hd, table_offset, new_table, new_table_size2);
+    if (ret != new_table_size2)
+        goto fail;
+    for(i = 0; i < s->refcount_table_size; i++)
+        be64_to_cpus(&new_table[i]);
+
+    data64 = cpu_to_be64(table_offset);
+    if (bdrv_pwrite(s->hd, offsetof(QCowHeader, refcount_table_offset),
+                    &data64, sizeof(data64)) != sizeof(data64))
+        goto fail;
+    data32 = cpu_to_be32(refcount_table_clusters);
+    if (bdrv_pwrite(s->hd, offsetof(QCowHeader, refcount_table_clusters),
+                    &data32, sizeof(data32)) != sizeof(data32))
+        goto fail;
+    qemu_free(s->refcount_table);
+    old_table_offset = s->refcount_table_offset;
+    old_table_size = s->refcount_table_size;
+    s->refcount_table = new_table;
+    s->refcount_table_size = new_table_size;
+    s->refcount_table_offset = table_offset;
+
+    update_refcount(bs, table_offset, new_table_size2, 1);
+    free_clusters(bs, old_table_offset, old_table_size * sizeof(uint64_t));
+    return 0;
+ fail:
+    free_clusters(bs, table_offset, new_table_size2);
+    qemu_free(new_table);
+    return -EIO;
+}
+
+/* addend must be 1 or -1 */
+/* XXX: cache several refcount block clusters ? */
+static int update_cluster_refcount(BlockDriverState *bs,
+                                   int64_t cluster_index,
+                                   int addend)
+{
+    BDRVQcowState *s = bs->opaque;
+    int64_t offset, refcount_block_offset;
+    int ret, refcount_table_index, block_index, refcount;
+    uint64_t data64;
+
+    refcount_table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT);
+    if (refcount_table_index >= s->refcount_table_size) {
+        if (addend < 0)
+            return -EINVAL;
+        ret = grow_refcount_table(bs, refcount_table_index + 1);
+        if (ret < 0)
+            return ret;
+    }
+    refcount_block_offset = s->refcount_table[refcount_table_index];
+    if (!refcount_block_offset) {
+        if (addend < 0)
+            return -EINVAL;
+        /* create a new refcount block */
+        /* Note: we cannot update the refcount now to avoid recursion */
+        offset = alloc_clusters_noref(bs, s->cluster_size);
+        memset(s->refcount_block_cache, 0, s->cluster_size);
+        ret = bdrv_pwrite(s->hd, offset, s->refcount_block_cache, s->cluster_size);
+        if (ret != s->cluster_size)
+            return -EINVAL;
+        s->refcount_table[refcount_table_index] = offset;
+        data64 = cpu_to_be64(offset);
+        ret = bdrv_pwrite(s->hd, s->refcount_table_offset +
+                          refcount_table_index * sizeof(uint64_t),
+                          &data64, sizeof(data64));
+        if (ret != sizeof(data64))
+            return -EINVAL;
+
+        refcount_block_offset = offset;
+        s->refcount_block_cache_offset = offset;
+        update_refcount(bs, offset, s->cluster_size, 1);
+    } else {
+        if (refcount_block_offset != s->refcount_block_cache_offset) {
+            if (load_refcount_block(bs, refcount_block_offset) < 0)
+                return -EIO;
+        }
+    }
+    /* we can update the count and save it */
+    block_index = cluster_index &
+        ((1 << (s->cluster_bits - REFCOUNT_SHIFT)) - 1);
+    refcount = be16_to_cpu(s->refcount_block_cache[block_index]);
+    refcount += addend;
+    if (refcount < 0 || refcount > 0xffff)
+        return -EINVAL;
+    if (refcount == 0 && cluster_index < s->free_cluster_index) {
+        s->free_cluster_index = cluster_index;
+    }
+    s->refcount_block_cache[block_index] = cpu_to_be16(refcount);
+    if (bdrv_pwrite(s->hd,
+                    refcount_block_offset + (block_index << REFCOUNT_SHIFT),
+                    &s->refcount_block_cache[block_index], 2) != 2)
+        return -EIO;
+    return refcount;
+}
+
+static void update_refcount(BlockDriverState *bs,
+                            int64_t offset, int64_t length,
+                            int addend)
+{
+    BDRVQcowState *s = bs->opaque;
+    int64_t start, last, cluster_offset;
+
+#ifdef DEBUG_ALLOC2
+    printf("update_refcount: offset=%lld size=%lld addend=%d\n",
+           offset, length, addend);
+#endif
+    if (length <= 0)
+        return;
+    start = offset & ~(s->cluster_size - 1);
+    last = (offset + length - 1) & ~(s->cluster_size - 1);
+    for(cluster_offset = start; cluster_offset <= last;
+        cluster_offset += s->cluster_size) {
+        update_cluster_refcount(bs, cluster_offset >> s->cluster_bits, addend);
+    }
+}
+
+#ifdef DEBUG_ALLOC
+static void inc_refcounts(BlockDriverState *bs,
+                          uint16_t *refcount_table,
+                          int refcount_table_size,
+                          int64_t offset, int64_t size)
+{
+    BDRVQcowState *s = bs->opaque;
+    int64_t start, last, cluster_offset;
+    int k;
+
+    if (size <= 0)
+        return;
+
+    start = offset & ~(s->cluster_size - 1);
+    last = (offset + size - 1) & ~(s->cluster_size - 1);
+    for(cluster_offset = start; cluster_offset <= last;
+        cluster_offset += s->cluster_size) {
+        k = cluster_offset >> s->cluster_bits;
+        if (k < 0 || k >= refcount_table_size) {
+            printf("ERROR: invalid cluster offset=0x%llx\n", cluster_offset);
+        } else {
+            if (++refcount_table[k] == 0) {
+                printf("ERROR: overflow cluster offset=0x%llx\n", cluster_offset);
+            }
+        }
+    }
+}
+
+static int check_refcounts_l1(BlockDriverState *bs,
+                              uint16_t *refcount_table,
+                              int refcount_table_size,
+                              int64_t l1_table_offset, int l1_size,
+                              int check_copied)
+{
+    BDRVQcowState *s = bs->opaque;
+    uint64_t *l1_table, *l2_table, l2_offset, offset, l1_size2;
+    int l2_size, i, j, nb_csectors, refcount;
+
+    l2_table = NULL;
+    l1_size2 = l1_size * sizeof(uint64_t);
+
+    inc_refcounts(bs, refcount_table, refcount_table_size,
+                  l1_table_offset, l1_size2);
+
+    l1_table = qemu_malloc(l1_size2);
+    if (!l1_table)
+        goto fail;
+    if (bdrv_pread(s->hd, l1_table_offset,
+                   l1_table, l1_size2) != l1_size2)
+        goto fail;
+    for(i = 0;i < l1_size; i++)
+        be64_to_cpus(&l1_table[i]);
+
+    l2_size = s->l2_size * sizeof(uint64_t);
+    l2_table = qemu_malloc(l2_size);
+    if (!l2_table)
+        goto fail;
+    for(i = 0; i < l1_size; i++) {
+        l2_offset = l1_table[i];
+        if (l2_offset) {
+            if (check_copied) {
+                refcount = get_refcount(bs, (l2_offset & ~QCOW_OFLAG_COPIED) >> s->cluster_bits);
+                if ((refcount == 1) != ((l2_offset & QCOW_OFLAG_COPIED) != 0)) {
+                    printf("ERROR OFLAG_COPIED: l2_offset=%llx refcount=%d\n",
+                           l2_offset, refcount);
+                }
+            }
+            l2_offset &= ~QCOW_OFLAG_COPIED;
+            if (bdrv_pread(s->hd, l2_offset, l2_table, l2_size) != l2_size)
+                goto fail;
+            for(j = 0; j < s->l2_size; j++) {
+                offset = be64_to_cpu(l2_table[j]);
+                if (offset != 0) {
+                    if (offset & QCOW_OFLAG_COMPRESSED) {
+                        if (offset & QCOW_OFLAG_COPIED) {
+                            printf("ERROR: cluster %lld: copied flag must never be set for compressed clusters\n",
+                                   offset >> s->cluster_bits);
+                            offset &= ~QCOW_OFLAG_COPIED;
+                        }
+                        nb_csectors = ((offset >> s->csize_shift) &
+                                       s->csize_mask) + 1;
+                        offset &= s->cluster_offset_mask;
+                        inc_refcounts(bs, refcount_table,
+                                      refcount_table_size,
+                                      offset & ~511, nb_csectors * 512);
+                    } else {
+                        if (check_copied) {
+                            refcount = get_refcount(bs, (offset & ~QCOW_OFLAG_COPIED) >> s->cluster_bits);
+                            if ((refcount == 1) != ((offset & QCOW_OFLAG_COPIED) != 0)) {
+                                printf("ERROR OFLAG_COPIED: offset=%llx refcount=%d\n",
+                                       offset, refcount);
+                            }
+                        }
+                        offset &= ~QCOW_OFLAG_COPIED;
+                        inc_refcounts(bs, refcount_table,
+                                      refcount_table_size,
+                                      offset, s->cluster_size);
+                    }
+                }
+            }
+            inc_refcounts(bs, refcount_table,
+                          refcount_table_size,
+                          l2_offset,
+                          s->cluster_size);
+        }
+    }
+    qemu_free(l1_table);
+    qemu_free(l2_table);
+    return 0;
+ fail:
+    printf("ERROR: I/O error in check_refcounts_l1\n");
+    qemu_free(l1_table);
+    qemu_free(l2_table);
+    return -EIO;
+}
+
+static void check_refcounts(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+    int64_t size;
+    int nb_clusters, refcount1, refcount2, i;
+    QCowSnapshot *sn;
+    uint16_t *refcount_table;
+
+    size = bdrv_getlength(s->hd);
+    nb_clusters = (size + s->cluster_size - 1) >> s->cluster_bits;
+    refcount_table = qemu_mallocz(nb_clusters * sizeof(uint16_t));
+
+    /* header */
+    inc_refcounts(bs, refcount_table, nb_clusters,
+                  0, s->cluster_size);
+
+    check_refcounts_l1(bs, refcount_table, nb_clusters,
+                       s->l1_table_offset, s->l1_size, 1);
+
+    /* snapshots */
+    for(i = 0; i < s->nb_snapshots; i++) {
+        sn = s->snapshots + i;
+        check_refcounts_l1(bs, refcount_table, nb_clusters,
+                           sn->l1_table_offset, sn->l1_size, 0);
+    }
+    inc_refcounts(bs, refcount_table, nb_clusters,
+                  s->snapshots_offset, s->snapshots_size);
+
+    /* refcount data */
+    inc_refcounts(bs, refcount_table, nb_clusters,
+                  s->refcount_table_offset,
+                  s->refcount_table_size * sizeof(uint64_t));
+    for(i = 0; i < s->refcount_table_size; i++) {
+        int64_t offset;
+        offset = s->refcount_table[i];
+        if (offset != 0) {
+            inc_refcounts(bs, refcount_table, nb_clusters,
+                          offset, s->cluster_size);
+        }
+    }
+
+    /* compare ref counts */
+    for(i = 0; i < nb_clusters; i++) {
+        refcount1 = get_refcount(bs, i);
+        refcount2 = refcount_table[i];
+        if (refcount1 != refcount2)
+            printf("ERROR cluster %d refcount=%d reference=%d\n",
+                   i, refcount1, refcount2);
+    }
+
+    qemu_free(refcount_table);
+}
+
+#if 0
+static void dump_refcounts(BlockDriverState *bs)
+{
+    BDRVQcowState *s = bs->opaque;
+    int64_t nb_clusters, k, k1, size;
+    int refcount;
+
+    size = bdrv_getlength(s->hd);
+    nb_clusters = (size + s->cluster_size - 1) >> s->cluster_bits;
+    for(k = 0; k < nb_clusters;) {
+        k1 = k;
+        refcount = get_refcount(bs, k);
+        k++;
+        while (k < nb_clusters && get_refcount(bs, k) == refcount)
+            k++;
+        printf("%lld: refcount=%d nb=%lld\n", k, refcount, k - k1);
+    }
+}
+#endif
+#endif
+
+BlockDriver bdrv_qcow2 = {
+    "qcow2",
+    sizeof(BDRVQcowState),
+    qcow_probe,
+    qcow_open,
+    NULL,
+    NULL,
+    qcow_close,
+    qcow_create,
+    qcow_flush,
+    qcow_is_allocated,
+    qcow_set_key,
+    qcow_make_empty,
+
+    .bdrv_aio_read = qcow_aio_read,
+    .bdrv_aio_write = qcow_aio_write,
+    .bdrv_aio_cancel = qcow_aio_cancel,
+    .aiocb_size = sizeof(QCowAIOCB),
+    .bdrv_write_compressed = qcow_write_compressed,
+
+    .bdrv_snapshot_create = qcow_snapshot_create,
+    .bdrv_snapshot_goto = qcow_snapshot_goto,
+    .bdrv_snapshot_delete = qcow_snapshot_delete,
+    .bdrv_snapshot_list = qcow_snapshot_list,
+    .bdrv_get_info = qcow_get_info,
+};
diff --git a/block-raw-posix.c b/block-raw-posix.c
new file mode 100644
index 0000000..7c42c10
--- /dev/null
+++ b/block-raw-posix.c
@@ -0,0 +1,1210 @@
+/*
+ * Block driver for RAW files (posix)
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu-common.h"
+#include "qemu-timer.h"
+#include "qemu-char.h"
+#include "block_int.h"
+#include "compatfd.h"
+#include <assert.h>
+#ifdef CONFIG_AIO
+#include <aio.h>
+#endif
+
+#ifdef CONFIG_COCOA
+#include <paths.h>
+#include <sys/param.h>
+#include <IOKit/IOKitLib.h>
+#include <IOKit/IOBSD.h>
+#include <IOKit/storage/IOMediaBSDClient.h>
+#include <IOKit/storage/IOMedia.h>
+#include <IOKit/storage/IOCDMedia.h>
+//#include <IOKit/storage/IOCDTypes.h>
+#include <CoreFoundation/CoreFoundation.h>
+#endif
+
+#ifdef __sun__
+#define _POSIX_PTHREAD_SEMANTICS 1
+#include <signal.h>
+#include <sys/dkio.h>
+#endif
+#ifdef __linux__
+#include <sys/ioctl.h>
+#include <linux/cdrom.h>
+#include <linux/fd.h>
+#endif
+#ifdef __FreeBSD__
+#include <signal.h>
+#include <sys/disk.h>
+#endif
+
+#ifdef __OpenBSD__
+#include <sys/ioctl.h>
+#include <sys/disklabel.h>
+#include <sys/dkio.h>
+#endif
+
+//#define DEBUG_FLOPPY
+
+//#define DEBUG_BLOCK
+#if defined(DEBUG_BLOCK)
+#define DEBUG_BLOCK_PRINT(formatCstr, args...) do { if (loglevel != 0)	\
+    { fprintf(logfile, formatCstr, ##args); fflush(logfile); } } while (0)
+#else
+#define DEBUG_BLOCK_PRINT(formatCstr, args...)
+#endif
+
+#define FTYPE_FILE   0
+#define FTYPE_CD     1
+#define FTYPE_FD     2
+
+#define ALIGNED_BUFFER_SIZE (32 * 512)
+
+/* if the FD is not accessed during that time (in ms), we try to
+   reopen it to see if the disk has been changed */
+#define FD_OPEN_TIMEOUT 1000
+
+typedef struct BDRVRawState {
+    int fd;
+    int type;
+    unsigned int lseek_err_cnt;
+#if defined(__linux__)
+    /* linux floppy specific */
+    int fd_open_flags;
+    int64_t fd_open_time;
+    int64_t fd_error_time;
+    int fd_got_error;
+    int fd_media_changed;
+#endif
+#if defined(O_DIRECT)
+    uint8_t* aligned_buf;
+#endif
+} BDRVRawState;
+
+static int fd_open(BlockDriverState *bs);
+
+static int raw_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVRawState *s = bs->opaque;
+    int fd, open_flags, ret;
+
+    s->lseek_err_cnt = 0;
+
+    open_flags = O_BINARY;
+    if ((flags & BDRV_O_ACCESS) == O_RDWR) {
+        open_flags |= O_RDWR;
+    } else {
+        open_flags |= O_RDONLY;
+        bs->read_only = 1;
+    }
+    if (flags & BDRV_O_CREAT)
+        open_flags |= O_CREAT | O_TRUNC;
+#ifdef O_DIRECT
+    if (flags & BDRV_O_DIRECT)
+        open_flags |= O_DIRECT;
+#endif
+
+    s->type = FTYPE_FILE;
+
+    fd = open(filename, open_flags, 0644);
+    if (fd < 0) {
+        ret = -errno;
+        if (ret == -EROFS)
+            ret = -EACCES;
+        return ret;
+    }
+    s->fd = fd;
+#if defined(O_DIRECT)
+    s->aligned_buf = NULL;
+    if (flags & BDRV_O_DIRECT) {
+        s->aligned_buf = qemu_memalign(512, ALIGNED_BUFFER_SIZE);
+        if (s->aligned_buf == NULL) {
+            ret = -errno;
+            close(fd);
+            return ret;
+        }
+    }
+#endif
+    return 0;
+}
+
+/* XXX: use host sector size if necessary with:
+#ifdef DIOCGSECTORSIZE
+        {
+            unsigned int sectorsize = 512;
+            if (!ioctl(fd, DIOCGSECTORSIZE, &sectorsize) &&
+                sectorsize > bufsize)
+                bufsize = sectorsize;
+        }
+#endif
+#ifdef CONFIG_COCOA
+        u_int32_t   blockSize = 512;
+        if ( !ioctl( fd, DKIOCGETBLOCKSIZE, &blockSize ) && blockSize > bufsize) {
+            bufsize = blockSize;
+        }
+#endif
+*/
+
+/*
+ * offset and count are in bytes, but must be multiples of 512 for files
+ * opened with O_DIRECT. buf must be aligned to 512 bytes then.
+ *
+ * This function may be called without alignment if the caller ensures
+ * that O_DIRECT is not in effect.
+ */
+static int raw_pread_aligned(BlockDriverState *bs, int64_t offset,
+                     uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    ret = fd_open(bs);
+    if (ret < 0)
+        return ret;
+
+    if (offset >= 0 && lseek(s->fd, offset, SEEK_SET) == (off_t)-1) {
+        ++(s->lseek_err_cnt);
+        if(s->lseek_err_cnt <= 10) {
+            DEBUG_BLOCK_PRINT("raw_pread(%d:%s, %" PRId64 ", %p, %d) [%" PRId64
+                              "] lseek failed : %d = %s\n",
+                              s->fd, bs->filename, offset, buf, count,
+                              bs->total_sectors, errno, strerror(errno));
+        }
+        return -1;
+    }
+    s->lseek_err_cnt=0;
+
+    ret = read(s->fd, buf, count);
+    if (ret == count)
+        goto label__raw_read__success;
+
+    DEBUG_BLOCK_PRINT("raw_pread(%d:%s, %" PRId64 ", %p, %d) [%" PRId64
+                      "] read failed %d : %d = %s\n",
+                      s->fd, bs->filename, offset, buf, count,
+                      bs->total_sectors, ret, errno, strerror(errno));
+
+    /* Try harder for CDrom. */
+    if (bs->type == BDRV_TYPE_CDROM) {
+        lseek(s->fd, offset, SEEK_SET);
+        ret = read(s->fd, buf, count);
+        if (ret == count)
+            goto label__raw_read__success;
+        lseek(s->fd, offset, SEEK_SET);
+        ret = read(s->fd, buf, count);
+        if (ret == count)
+            goto label__raw_read__success;
+
+        DEBUG_BLOCK_PRINT("raw_pread(%d:%s, %" PRId64 ", %p, %d) [%" PRId64
+                          "] retry read failed %d : %d = %s\n",
+                          s->fd, bs->filename, offset, buf, count,
+                          bs->total_sectors, ret, errno, strerror(errno));
+    }
+
+label__raw_read__success:
+
+    return ret;
+}
+
+/*
+ * offset and count are in bytes, but must be multiples of 512 for files
+ * opened with O_DIRECT. buf must be aligned to 512 bytes then.
+ *
+ * This function may be called without alignment if the caller ensures
+ * that O_DIRECT is not in effect.
+ */
+static int raw_pwrite_aligned(BlockDriverState *bs, int64_t offset,
+                      const uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    ret = fd_open(bs);
+    if (ret < 0)
+        return ret;
+
+    if (offset >= 0 && lseek(s->fd, offset, SEEK_SET) == (off_t)-1) {
+        ++(s->lseek_err_cnt);
+        if(s->lseek_err_cnt) {
+            DEBUG_BLOCK_PRINT("raw_pwrite(%d:%s, %" PRId64 ", %p, %d) [%"
+                              PRId64 "] lseek failed : %d = %s\n",
+                              s->fd, bs->filename, offset, buf, count,
+                              bs->total_sectors, errno, strerror(errno));
+        }
+        return -1;
+    }
+    s->lseek_err_cnt = 0;
+
+    ret = write(s->fd, buf, count);
+    if (ret == count)
+        goto label__raw_write__success;
+
+    DEBUG_BLOCK_PRINT("raw_pwrite(%d:%s, %" PRId64 ", %p, %d) [%" PRId64
+                      "] write failed %d : %d = %s\n",
+                      s->fd, bs->filename, offset, buf, count,
+                      bs->total_sectors, ret, errno, strerror(errno));
+
+label__raw_write__success:
+
+    return ret;
+}
+
+
+#if defined(O_DIRECT)
+/*
+ * offset and count are in bytes and possibly not aligned. For files opened
+ * with O_DIRECT, necessary alignments are ensured before calling
+ * raw_pread_aligned to do the actual read.
+ */
+static int raw_pread(BlockDriverState *bs, int64_t offset,
+                     uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    int size, ret, shift, sum;
+
+    sum = 0;
+
+    if (s->aligned_buf != NULL)  {
+
+        if (offset & 0x1ff) {
+            /* align offset on a 512 bytes boundary */
+
+            shift = offset & 0x1ff;
+            size = (shift + count + 0x1ff) & ~0x1ff;
+            if (size > ALIGNED_BUFFER_SIZE)
+                size = ALIGNED_BUFFER_SIZE;
+            ret = raw_pread_aligned(bs, offset - shift, s->aligned_buf, size);
+            if (ret < 0)
+                return ret;
+
+            size = 512 - shift;
+            if (size > count)
+                size = count;
+            memcpy(buf, s->aligned_buf + shift, size);
+
+            buf += size;
+            offset += size;
+            count -= size;
+            sum += size;
+
+            if (count == 0)
+                return sum;
+        }
+        if (count & 0x1ff || (uintptr_t) buf & 0x1ff) {
+
+            /* read on aligned buffer */
+
+            while (count) {
+
+                size = (count + 0x1ff) & ~0x1ff;
+                if (size > ALIGNED_BUFFER_SIZE)
+                    size = ALIGNED_BUFFER_SIZE;
+
+                ret = raw_pread_aligned(bs, offset, s->aligned_buf, size);
+                if (ret < 0)
+                    return ret;
+
+                size = ret;
+                if (size > count)
+                    size = count;
+
+                memcpy(buf, s->aligned_buf, size);
+
+                buf += size;
+                offset += size;
+                count -= size;
+                sum += size;
+            }
+
+            return sum;
+        }
+    }
+
+    return raw_pread_aligned(bs, offset, buf, count) + sum;
+}
+
+/*
+ * offset and count are in bytes and possibly not aligned. For files opened
+ * with O_DIRECT, necessary alignments are ensured before calling
+ * raw_pwrite_aligned to do the actual write.
+ */
+static int raw_pwrite(BlockDriverState *bs, int64_t offset,
+                      const uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    int size, ret, shift, sum;
+
+    sum = 0;
+
+    if (s->aligned_buf != NULL) {
+
+        if (offset & 0x1ff) {
+            /* align offset on a 512 bytes boundary */
+            shift = offset & 0x1ff;
+            ret = raw_pread_aligned(bs, offset - shift, s->aligned_buf, 512);
+            if (ret < 0)
+                return ret;
+
+            size = 512 - shift;
+            if (size > count)
+                size = count;
+            memcpy(s->aligned_buf + shift, buf, size);
+
+            ret = raw_pwrite_aligned(bs, offset - shift, s->aligned_buf, 512);
+            if (ret < 0)
+                return ret;
+
+            buf += size;
+            offset += size;
+            count -= size;
+            sum += size;
+
+            if (count == 0)
+                return sum;
+        }
+        if (count & 0x1ff || (uintptr_t) buf & 0x1ff) {
+
+            while ((size = (count & ~0x1ff)) != 0) {
+
+                if (size > ALIGNED_BUFFER_SIZE)
+                    size = ALIGNED_BUFFER_SIZE;
+
+                memcpy(s->aligned_buf, buf, size);
+
+                ret = raw_pwrite_aligned(bs, offset, s->aligned_buf, size);
+                if (ret < 0)
+                    return ret;
+
+                buf += ret;
+                offset += ret;
+                count -= ret;
+                sum += ret;
+            }
+            /* here, count < 512 because (count & ~0x1ff) == 0 */
+            if (count) {
+                ret = raw_pread_aligned(bs, offset, s->aligned_buf, 512);
+                if (ret < 0)
+                    return ret;
+                 memcpy(s->aligned_buf, buf, count);
+
+                 ret = raw_pwrite_aligned(bs, offset, s->aligned_buf, 512);
+                 if (ret < 0)
+                     return ret;
+                 if (count < ret)
+                     ret = count;
+
+                 sum += ret;
+            }
+            return sum;
+        }
+    }
+    return raw_pwrite_aligned(bs, offset, buf, count) + sum;
+}
+
+#else
+#define raw_pread raw_pread_aligned
+#define raw_pwrite raw_pwrite_aligned
+#endif
+
+
+#ifdef CONFIG_AIO
+/***********************************************************/
+/* Unix AIO using POSIX AIO */
+
+typedef struct RawAIOCB {
+    BlockDriverAIOCB common;
+    struct aiocb aiocb;
+    struct RawAIOCB *next;
+    int ret;
+} RawAIOCB;
+
+static int aio_sig_fd = -1;
+static int aio_sig_num = SIGUSR2;
+static RawAIOCB *first_aio; /* AIO issued */
+static int aio_initialized = 0;
+
+static void qemu_aio_poll(void *opaque)
+{
+    RawAIOCB *acb, **pacb;
+    int ret;
+    size_t offset;
+    union {
+        struct qemu_signalfd_siginfo siginfo;
+        char buf[128];
+    } sig;
+
+    /* try to read from signalfd, don't freak out if we can't read anything */
+    offset = 0;
+    while (offset < 128) {
+        ssize_t len;
+
+        len = read(aio_sig_fd, sig.buf + offset, 128 - offset);
+        if (len == -1 && errno == EINTR)
+            continue;
+        if (len == -1 && errno == EAGAIN) {
+            /* there is no natural reason for this to happen,
+             * so we'll spin hard until we get everything just
+             * to be on the safe side. */
+            if (offset > 0)
+                continue;
+        }
+
+        offset += len;
+    }
+
+    for(;;) {
+        pacb = &first_aio;
+        for(;;) {
+            acb = *pacb;
+            if (!acb)
+                goto the_end;
+            ret = aio_error(&acb->aiocb);
+            if (ret == ECANCELED) {
+                /* remove the request */
+                *pacb = acb->next;
+                qemu_aio_release(acb);
+            } else if (ret != EINPROGRESS) {
+                /* end of aio */
+                if (ret == 0) {
+                    ret = aio_return(&acb->aiocb);
+                    if (ret == acb->aiocb.aio_nbytes)
+                        ret = 0;
+                    else
+                        ret = -EINVAL;
+                } else {
+                    ret = -ret;
+                }
+                /* remove the request */
+                *pacb = acb->next;
+                /* call the callback */
+                acb->common.cb(acb->common.opaque, ret);
+                qemu_aio_release(acb);
+                break;
+            } else {
+                pacb = &acb->next;
+            }
+        }
+    }
+ the_end: ;
+}
+
+void qemu_aio_init(void)
+{
+    sigset_t mask;
+
+    aio_initialized = 1;
+
+    /* Make sure to block AIO signal */
+    sigemptyset(&mask);
+    sigaddset(&mask, aio_sig_num);
+    sigprocmask(SIG_BLOCK, &mask, NULL);
+    
+    aio_sig_fd = qemu_signalfd(&mask);
+
+    fcntl(aio_sig_fd, F_SETFL, O_NONBLOCK);
+
+    qemu_set_fd_handler2(aio_sig_fd, NULL, qemu_aio_poll, NULL, NULL);
+
+#if defined(__GLIBC__) && defined(__linux__)
+    {
+        /* XXX: aio thread exit seems to hang on RedHat 9 and this init
+           seems to fix the problem. */
+        struct aioinit ai;
+        memset(&ai, 0, sizeof(ai));
+        ai.aio_threads = 1;
+        ai.aio_num = 1;
+        ai.aio_idle_time = 365 * 100000;
+        aio_init(&ai);
+    }
+#endif
+}
+
+/* Wait for all IO requests to complete.  */
+void qemu_aio_flush(void)
+{
+    qemu_aio_poll(NULL);
+    while (first_aio) {
+        qemu_aio_wait();
+    }
+}
+
+void qemu_aio_wait(void)
+{
+    int ret;
+
+    if (qemu_bh_poll())
+        return;
+
+    if (!first_aio)
+        return;
+
+    do {
+        fd_set rdfds;
+
+        FD_ZERO(&rdfds);
+        FD_SET(aio_sig_fd, &rdfds);
+
+        ret = select(aio_sig_fd + 1, &rdfds, NULL, NULL, NULL);
+        if (ret == -1 && errno == EINTR)
+            continue;
+    } while (ret == 0);
+
+    qemu_aio_poll(NULL);
+}
+
+static RawAIOCB *raw_aio_setup(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BDRVRawState *s = bs->opaque;
+    RawAIOCB *acb;
+
+    if (fd_open(bs) < 0)
+        return NULL;
+
+    acb = qemu_aio_get(bs, cb, opaque);
+    if (!acb)
+        return NULL;
+    acb->aiocb.aio_fildes = s->fd;
+    acb->aiocb.aio_sigevent.sigev_signo = aio_sig_num;
+    acb->aiocb.aio_sigevent.sigev_notify = SIGEV_SIGNAL;
+    acb->aiocb.aio_buf = buf;
+    if (nb_sectors < 0)
+        acb->aiocb.aio_nbytes = -nb_sectors;
+    else
+        acb->aiocb.aio_nbytes = nb_sectors * 512;
+    acb->aiocb.aio_offset = sector_num * 512;
+    acb->next = first_aio;
+    first_aio = acb;
+    return acb;
+}
+
+static void raw_aio_em_cb(void* opaque)
+{
+    RawAIOCB *acb = opaque;
+    acb->common.cb(acb->common.opaque, acb->ret);
+    qemu_aio_release(acb);
+}
+
+static BlockDriverAIOCB *raw_aio_read(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    RawAIOCB *acb;
+
+    /*
+     * If O_DIRECT is used and the buffer is not aligned fall back
+     * to synchronous IO.
+     */
+#if defined(O_DIRECT)
+    BDRVRawState *s = bs->opaque;
+
+    if (unlikely(s->aligned_buf != NULL && ((uintptr_t) buf % 512))) {
+        QEMUBH *bh;
+        acb = qemu_aio_get(bs, cb, opaque);
+        acb->ret = raw_pread(bs, 512 * sector_num, buf, 512 * nb_sectors);
+        bh = qemu_bh_new(raw_aio_em_cb, acb);
+        qemu_bh_schedule(bh);
+        return &acb->common;
+    }
+#endif
+
+    acb = raw_aio_setup(bs, sector_num, buf, nb_sectors, cb, opaque);
+    if (!acb)
+        return NULL;
+    if (aio_read(&acb->aiocb) < 0) {
+        qemu_aio_release(acb);
+        return NULL;
+    }
+    return &acb->common;
+}
+
+static BlockDriverAIOCB *raw_aio_write(BlockDriverState *bs,
+        int64_t sector_num, const uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    RawAIOCB *acb;
+
+    /*
+     * If O_DIRECT is used and the buffer is not aligned fall back
+     * to synchronous IO.
+     */
+#if defined(O_DIRECT)
+    BDRVRawState *s = bs->opaque;
+
+    if (unlikely(s->aligned_buf != NULL && ((uintptr_t) buf % 512))) {
+        QEMUBH *bh;
+        acb = qemu_aio_get(bs, cb, opaque);
+        acb->ret = raw_pwrite(bs, 512 * sector_num, buf, 512 * nb_sectors);
+        bh = qemu_bh_new(raw_aio_em_cb, acb);
+        qemu_bh_schedule(bh);
+        return &acb->common;
+    }
+#endif
+
+    acb = raw_aio_setup(bs, sector_num, (uint8_t*)buf, nb_sectors, cb, opaque);
+    if (!acb)
+        return NULL;
+    if (aio_write(&acb->aiocb) < 0) {
+        qemu_aio_release(acb);
+        return NULL;
+    }
+    return &acb->common;
+}
+
+static void raw_aio_cancel(BlockDriverAIOCB *blockacb)
+{
+    int ret;
+    RawAIOCB *acb = (RawAIOCB *)blockacb;
+    RawAIOCB **pacb;
+
+    ret = aio_cancel(acb->aiocb.aio_fildes, &acb->aiocb);
+    if (ret == AIO_NOTCANCELED) {
+        /* fail safe: if the aio could not be canceled, we wait for
+           it */
+        while (aio_error(&acb->aiocb) == EINPROGRESS);
+    }
+
+    /* remove the callback from the queue */
+    pacb = &first_aio;
+    for(;;) {
+        if (*pacb == NULL) {
+            break;
+        } else if (*pacb == acb) {
+            *pacb = acb->next;
+            qemu_aio_release(acb);
+            break;
+        }
+        pacb = &acb->next;
+    }
+}
+
+# else /* CONFIG_AIO */
+
+void qemu_aio_init(void)
+{
+}
+
+void qemu_aio_flush(void)
+{
+}
+
+void qemu_aio_wait(void)
+{
+    qemu_bh_poll();
+}
+
+#endif /* CONFIG_AIO */
+
+static void raw_close(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    if (s->fd >= 0) {
+        close(s->fd);
+        s->fd = -1;
+#if defined(O_DIRECT)
+        if (s->aligned_buf != NULL)
+            qemu_free(s->aligned_buf);
+#endif
+    }
+}
+
+static int raw_truncate(BlockDriverState *bs, int64_t offset)
+{
+    BDRVRawState *s = bs->opaque;
+    if (s->type != FTYPE_FILE)
+        return -ENOTSUP;
+    if (ftruncate(s->fd, offset) < 0)
+        return -errno;
+    return 0;
+}
+
+#ifdef __OpenBSD__
+static int64_t raw_getlength(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    int fd = s->fd;
+    struct stat st;
+
+    if (fstat(fd, &st))
+        return -1;
+    if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
+        struct disklabel dl;
+
+        if (ioctl(fd, DIOCGDINFO, &dl))
+            return -1;
+        return (uint64_t)dl.d_secsize *
+            dl.d_partitions[DISKPART(st.st_rdev)].p_size;
+    } else
+        return st.st_size;
+}
+#else /* !__OpenBSD__ */
+static int64_t  raw_getlength(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    int fd = s->fd;
+    int64_t size;
+#ifdef _BSD
+    struct stat sb;
+#endif
+#ifdef __sun__
+    struct dk_minfo minfo;
+    int rv;
+#endif
+    int ret;
+
+    ret = fd_open(bs);
+    if (ret < 0)
+        return ret;
+
+#ifdef _BSD
+    if (!fstat(fd, &sb) && (S_IFCHR & sb.st_mode)) {
+#ifdef DIOCGMEDIASIZE
+	if (ioctl(fd, DIOCGMEDIASIZE, (off_t *)&size))
+#endif
+#ifdef CONFIG_COCOA
+        size = LONG_LONG_MAX;
+#else
+        size = lseek(fd, 0LL, SEEK_END);
+#endif
+    } else
+#endif
+#ifdef __sun__
+    /*
+     * use the DKIOCGMEDIAINFO ioctl to read the size.
+     */
+    rv = ioctl ( fd, DKIOCGMEDIAINFO, &minfo );
+    if ( rv != -1 ) {
+        size = minfo.dki_lbsize * minfo.dki_capacity;
+    } else /* there are reports that lseek on some devices
+              fails, but irc discussion said that contingency
+              on contingency was overkill */
+#endif
+    {
+        size = lseek(fd, 0, SEEK_END);
+    }
+    return size;
+}
+#endif
+
+static int raw_create(const char *filename, int64_t total_size,
+                      const char *backing_file, int flags)
+{
+    int fd;
+
+    if (flags || backing_file)
+        return -ENOTSUP;
+
+    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
+              0644);
+    if (fd < 0)
+        return -EIO;
+    ftruncate(fd, total_size * 512);
+    close(fd);
+    return 0;
+}
+
+static void raw_flush(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    fsync(s->fd);
+}
+
+BlockDriver bdrv_raw = {
+    "raw",
+    sizeof(BDRVRawState),
+    NULL, /* no probe for protocols */
+    raw_open,
+    NULL,
+    NULL,
+    raw_close,
+    raw_create,
+    raw_flush,
+
+#ifdef CONFIG_AIO
+    .bdrv_aio_read = raw_aio_read,
+    .bdrv_aio_write = raw_aio_write,
+    .bdrv_aio_cancel = raw_aio_cancel,
+    .aiocb_size = sizeof(RawAIOCB),
+#endif
+    .bdrv_pread = raw_pread,
+    .bdrv_pwrite = raw_pwrite,
+    .bdrv_truncate = raw_truncate,
+    .bdrv_getlength = raw_getlength,
+};
+
+/***********************************************/
+/* host device */
+
+#ifdef CONFIG_COCOA
+static kern_return_t FindEjectableCDMedia( io_iterator_t *mediaIterator );
+static kern_return_t GetBSDPath( io_iterator_t mediaIterator, char *bsdPath, CFIndex maxPathSize );
+
+kern_return_t FindEjectableCDMedia( io_iterator_t *mediaIterator )
+{
+    kern_return_t       kernResult;
+    mach_port_t     masterPort;
+    CFMutableDictionaryRef  classesToMatch;
+
+    kernResult = IOMasterPort( MACH_PORT_NULL, &masterPort );
+    if ( KERN_SUCCESS != kernResult ) {
+        printf( "IOMasterPort returned %d\n", kernResult );
+    }
+
+    classesToMatch = IOServiceMatching( kIOCDMediaClass );
+    if ( classesToMatch == NULL ) {
+        printf( "IOServiceMatching returned a NULL dictionary.\n" );
+    } else {
+    CFDictionarySetValue( classesToMatch, CFSTR( kIOMediaEjectableKey ), kCFBooleanTrue );
+    }
+    kernResult = IOServiceGetMatchingServices( masterPort, classesToMatch, mediaIterator );
+    if ( KERN_SUCCESS != kernResult )
+    {
+        printf( "IOServiceGetMatchingServices returned %d\n", kernResult );
+    }
+
+    return kernResult;
+}
+
+kern_return_t GetBSDPath( io_iterator_t mediaIterator, char *bsdPath, CFIndex maxPathSize )
+{
+    io_object_t     nextMedia;
+    kern_return_t   kernResult = KERN_FAILURE;
+    *bsdPath = '\0';
+    nextMedia = IOIteratorNext( mediaIterator );
+    if ( nextMedia )
+    {
+        CFTypeRef   bsdPathAsCFString;
+    bsdPathAsCFString = IORegistryEntryCreateCFProperty( nextMedia, CFSTR( kIOBSDNameKey ), kCFAllocatorDefault, 0 );
+        if ( bsdPathAsCFString ) {
+            size_t devPathLength;
+            strcpy( bsdPath, _PATH_DEV );
+            strcat( bsdPath, "r" );
+            devPathLength = strlen( bsdPath );
+            if ( CFStringGetCString( bsdPathAsCFString, bsdPath + devPathLength, maxPathSize - devPathLength, kCFStringEncodingASCII ) ) {
+                kernResult = KERN_SUCCESS;
+            }
+            CFRelease( bsdPathAsCFString );
+        }
+        IOObjectRelease( nextMedia );
+    }
+
+    return kernResult;
+}
+
+#endif
+
+static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVRawState *s = bs->opaque;
+    int fd, open_flags, ret;
+
+#ifdef CONFIG_COCOA
+    if (strstart(filename, "/dev/cdrom", NULL)) {
+        kern_return_t kernResult;
+        io_iterator_t mediaIterator;
+        char bsdPath[ MAXPATHLEN ];
+        int fd;
+
+        kernResult = FindEjectableCDMedia( &mediaIterator );
+        kernResult = GetBSDPath( mediaIterator, bsdPath, sizeof( bsdPath ) );
+
+        if ( bsdPath[ 0 ] != '\0' ) {
+            strcat(bsdPath,"s0");
+            /* some CDs don't have a partition 0 */
+            fd = open(bsdPath, O_RDONLY | O_BINARY | O_LARGEFILE);
+            if (fd < 0) {
+                bsdPath[strlen(bsdPath)-1] = '1';
+            } else {
+                close(fd);
+            }
+            filename = bsdPath;
+        }
+
+        if ( mediaIterator )
+            IOObjectRelease( mediaIterator );
+    }
+#endif
+    open_flags = O_BINARY;
+    if ((flags & BDRV_O_ACCESS) == O_RDWR) {
+        open_flags |= O_RDWR;
+    } else {
+        open_flags |= O_RDONLY;
+        bs->read_only = 1;
+    }
+#ifdef O_DIRECT
+    if (flags & BDRV_O_DIRECT)
+        open_flags |= O_DIRECT;
+#endif
+
+    s->type = FTYPE_FILE;
+#if defined(__linux__)
+    if (strstart(filename, "/dev/cd", NULL)) {
+        /* open will not fail even if no CD is inserted */
+        open_flags |= O_NONBLOCK;
+        s->type = FTYPE_CD;
+    } else if (strstart(filename, "/dev/fd", NULL)) {
+        s->type = FTYPE_FD;
+        s->fd_open_flags = open_flags;
+        /* open will not fail even if no floppy is inserted */
+        open_flags |= O_NONBLOCK;
+    } else if (strstart(filename, "/dev/sg", NULL)) {
+        bs->sg = 1;
+    }
+#endif
+    fd = open(filename, open_flags, 0644);
+    if (fd < 0) {
+        ret = -errno;
+        if (ret == -EROFS)
+            ret = -EACCES;
+        return ret;
+    }
+    s->fd = fd;
+#if defined(__linux__)
+    /* close fd so that we can reopen it as needed */
+    if (s->type == FTYPE_FD) {
+        close(s->fd);
+        s->fd = -1;
+        s->fd_media_changed = 1;
+    }
+#endif
+    return 0;
+}
+
+#if defined(__linux__)
+
+/* Note: we do not have a reliable method to detect if the floppy is
+   present. The current method is to try to open the floppy at every
+   I/O and to keep it opened during a few hundreds of ms. */
+static int fd_open(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    int last_media_present;
+
+    if (s->type != FTYPE_FD)
+        return 0;
+    last_media_present = (s->fd >= 0);
+    if (s->fd >= 0 &&
+        (qemu_get_clock(rt_clock) - s->fd_open_time) >= FD_OPEN_TIMEOUT) {
+        close(s->fd);
+        s->fd = -1;
+#ifdef DEBUG_FLOPPY
+        printf("Floppy closed\n");
+#endif
+    }
+    if (s->fd < 0) {
+        if (s->fd_got_error &&
+            (qemu_get_clock(rt_clock) - s->fd_error_time) < FD_OPEN_TIMEOUT) {
+#ifdef DEBUG_FLOPPY
+            printf("No floppy (open delayed)\n");
+#endif
+            return -EIO;
+        }
+        s->fd = open(bs->filename, s->fd_open_flags);
+        if (s->fd < 0) {
+            s->fd_error_time = qemu_get_clock(rt_clock);
+            s->fd_got_error = 1;
+            if (last_media_present)
+                s->fd_media_changed = 1;
+#ifdef DEBUG_FLOPPY
+            printf("No floppy\n");
+#endif
+            return -EIO;
+        }
+#ifdef DEBUG_FLOPPY
+        printf("Floppy opened\n");
+#endif
+    }
+    if (!last_media_present)
+        s->fd_media_changed = 1;
+    s->fd_open_time = qemu_get_clock(rt_clock);
+    s->fd_got_error = 0;
+    return 0;
+}
+
+static int raw_is_inserted(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    switch(s->type) {
+    case FTYPE_CD:
+        ret = ioctl(s->fd, CDROM_DRIVE_STATUS, CDSL_CURRENT);
+        if (ret == CDS_DISC_OK)
+            return 1;
+        else
+            return 0;
+        break;
+    case FTYPE_FD:
+        ret = fd_open(bs);
+        return (ret >= 0);
+    default:
+        return 1;
+    }
+}
+
+/* currently only used by fdc.c, but a CD version would be good too */
+static int raw_media_changed(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+
+    switch(s->type) {
+    case FTYPE_FD:
+        {
+            int ret;
+            /* XXX: we do not have a true media changed indication. It
+               does not work if the floppy is changed without trying
+               to read it */
+            fd_open(bs);
+            ret = s->fd_media_changed;
+            s->fd_media_changed = 0;
+#ifdef DEBUG_FLOPPY
+            printf("Floppy changed=%d\n", ret);
+#endif
+            return ret;
+        }
+    default:
+        return -ENOTSUP;
+    }
+}
+
+static int raw_eject(BlockDriverState *bs, int eject_flag)
+{
+    BDRVRawState *s = bs->opaque;
+
+    switch(s->type) {
+    case FTYPE_CD:
+        if (eject_flag) {
+            if (ioctl (s->fd, CDROMEJECT, NULL) < 0)
+                perror("CDROMEJECT");
+        } else {
+            if (ioctl (s->fd, CDROMCLOSETRAY, NULL) < 0)
+                perror("CDROMEJECT");
+        }
+        break;
+    case FTYPE_FD:
+        {
+            int fd;
+            if (s->fd >= 0) {
+                close(s->fd);
+                s->fd = -1;
+            }
+            fd = open(bs->filename, s->fd_open_flags | O_NONBLOCK);
+            if (fd >= 0) {
+                if (ioctl(fd, FDEJECT, 0) < 0)
+                    perror("FDEJECT");
+                close(fd);
+            }
+        }
+        break;
+    default:
+        return -ENOTSUP;
+    }
+    return 0;
+}
+
+static int raw_set_locked(BlockDriverState *bs, int locked)
+{
+    BDRVRawState *s = bs->opaque;
+
+    switch(s->type) {
+    case FTYPE_CD:
+        if (ioctl (s->fd, CDROM_LOCKDOOR, locked) < 0) {
+            /* Note: an error can happen if the distribution automatically
+               mounts the CD-ROM */
+            //        perror("CDROM_LOCKDOOR");
+        }
+        break;
+    default:
+        return -ENOTSUP;
+    }
+    return 0;
+}
+
+static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+{
+    BDRVRawState *s = bs->opaque;
+
+    return ioctl(s->fd, req, buf);
+}
+#else
+
+static int fd_open(BlockDriverState *bs)
+{
+    return 0;
+}
+
+static int raw_is_inserted(BlockDriverState *bs)
+{
+    return 1;
+}
+
+static int raw_media_changed(BlockDriverState *bs)
+{
+    return -ENOTSUP;
+}
+
+static int raw_eject(BlockDriverState *bs, int eject_flag)
+{
+    return -ENOTSUP;
+}
+
+static int raw_set_locked(BlockDriverState *bs, int locked)
+{
+    return -ENOTSUP;
+}
+
+static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+{
+    return -ENOTSUP;
+}
+#endif /* !linux */
+
+BlockDriver bdrv_host_device = {
+    "host_device",
+    sizeof(BDRVRawState),
+    NULL, /* no probe for protocols */
+    hdev_open,
+    NULL,
+    NULL,
+    raw_close,
+    NULL,
+    raw_flush,
+
+#ifdef CONFIG_AIO
+    .bdrv_aio_read = raw_aio_read,
+    .bdrv_aio_write = raw_aio_write,
+    .bdrv_aio_cancel = raw_aio_cancel,
+    .aiocb_size = sizeof(RawAIOCB),
+#endif
+    .bdrv_pread = raw_pread,
+    .bdrv_pwrite = raw_pwrite,
+    .bdrv_getlength = raw_getlength,
+
+    /* removable device support */
+    .bdrv_is_inserted = raw_is_inserted,
+    .bdrv_media_changed = raw_media_changed,
+    .bdrv_eject = raw_eject,
+    .bdrv_set_locked = raw_set_locked,
+    /* generic scsi device */
+    .bdrv_ioctl = raw_ioctl,
+};
diff --git a/block-raw-win32.c b/block-raw-win32.c
new file mode 100644
index 0000000..71404ac
--- /dev/null
+++ b/block-raw-win32.c
@@ -0,0 +1,526 @@
+/*
+ * Block driver for RAW files (win32)
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu-common.h"
+#include "qemu-timer.h"
+#include "block_int.h"
+#include <assert.h>
+#include <winioctl.h>
+
+//#define WIN32_AIO
+
+#define FTYPE_FILE 0
+#define FTYPE_CD     1
+#define FTYPE_HARDDISK 2
+
+typedef struct BDRVRawState {
+    HANDLE hfile;
+    int type;
+    char drive_path[16]; /* format: "d:\" */
+} BDRVRawState;
+
+typedef struct RawAIOCB {
+    BlockDriverAIOCB common;
+    HANDLE hEvent;
+    OVERLAPPED ov;
+    int count;
+} RawAIOCB;
+
+int qemu_ftruncate64(int fd, int64_t length)
+{
+    LARGE_INTEGER li;
+    LONG high;
+    HANDLE h;
+    BOOL res;
+
+    if ((GetVersion() & 0x80000000UL) && (length >> 32) != 0)
+	return -1;
+
+    h = (HANDLE)_get_osfhandle(fd);
+
+    /* get current position, ftruncate do not change position */
+    li.HighPart = 0;
+    li.LowPart = SetFilePointer (h, 0, &li.HighPart, FILE_CURRENT);
+    if (li.LowPart == 0xffffffffUL && GetLastError() != NO_ERROR)
+	return -1;
+
+    high = length >> 32;
+    if (!SetFilePointer(h, (DWORD) length, &high, FILE_BEGIN))
+	return -1;
+    res = SetEndOfFile(h);
+
+    /* back to old position */
+    SetFilePointer(h, li.LowPart, &li.HighPart, FILE_BEGIN);
+    return res ? 0 : -1;
+}
+
+static int set_sparse(int fd)
+{
+    DWORD returned;
+    return (int) DeviceIoControl((HANDLE)_get_osfhandle(fd), FSCTL_SET_SPARSE,
+				 NULL, 0, NULL, 0, &returned, NULL);
+}
+
+static int raw_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVRawState *s = bs->opaque;
+    int access_flags, create_flags;
+    DWORD overlapped;
+
+    s->type = FTYPE_FILE;
+
+    if ((flags & BDRV_O_ACCESS) == O_RDWR) {
+        access_flags = GENERIC_READ | GENERIC_WRITE;
+    } else {
+        access_flags = GENERIC_READ;
+    }
+    if (flags & BDRV_O_CREAT) {
+        create_flags = CREATE_ALWAYS;
+    } else {
+        create_flags = OPEN_EXISTING;
+    }
+#ifdef WIN32_AIO
+    overlapped = FILE_FLAG_OVERLAPPED;
+#else
+    overlapped = FILE_ATTRIBUTE_NORMAL;
+#endif
+    if (flags & BDRV_O_DIRECT)
+        overlapped |= FILE_FLAG_NO_BUFFERING | FILE_FLAG_WRITE_THROUGH;
+    s->hfile = CreateFile(filename, access_flags,
+                          FILE_SHARE_READ, NULL,
+                          create_flags, overlapped, NULL);
+    if (s->hfile == INVALID_HANDLE_VALUE) {
+        int err = GetLastError();
+
+        if (err == ERROR_ACCESS_DENIED)
+            return -EACCES;
+        return -1;
+    }
+    return 0;
+}
+
+static int raw_pread(BlockDriverState *bs, int64_t offset,
+                     uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    OVERLAPPED ov;
+    DWORD ret_count;
+    int ret;
+
+    memset(&ov, 0, sizeof(ov));
+    ov.Offset = offset;
+    ov.OffsetHigh = offset >> 32;
+    ret = ReadFile(s->hfile, buf, count, &ret_count, &ov);
+    if (!ret) {
+#ifdef WIN32_AIO
+        ret = GetOverlappedResult(s->hfile, &ov, &ret_count, TRUE);
+        if (!ret)
+            return -EIO;
+        else
+#endif
+            return ret_count;
+    }
+    return ret_count;
+}
+
+static int raw_pwrite(BlockDriverState *bs, int64_t offset,
+                      const uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    OVERLAPPED ov;
+    DWORD ret_count;
+    int ret;
+
+    memset(&ov, 0, sizeof(ov));
+    ov.Offset = offset;
+    ov.OffsetHigh = offset >> 32;
+    ret = WriteFile(s->hfile, buf, count, &ret_count, &ov);
+    if (!ret) {
+#ifdef WIN32_AIO
+        ret = GetOverlappedResult(s->hfile, &ov, &ret_count, TRUE);
+        if (!ret)
+            return -EIO;
+        else
+#endif
+            return ret_count;
+    }
+    return ret_count;
+}
+
+#ifdef WIN32_AIO
+static void raw_aio_cb(void *opaque)
+{
+    RawAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVRawState *s = bs->opaque;
+    DWORD ret_count;
+    int ret;
+
+    ret = GetOverlappedResult(s->hfile, &acb->ov, &ret_count, TRUE);
+    if (!ret || ret_count != acb->count) {
+        acb->common.cb(acb->common.opaque, -EIO);
+    } else {
+        acb->common.cb(acb->common.opaque, 0);
+    }
+}
+
+static RawAIOCB *raw_aio_setup(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    RawAIOCB *acb;
+    int64_t offset;
+
+    acb = qemu_aio_get(bs, cb, opaque);
+    if (acb->hEvent) {
+        acb->hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
+        if (!acb->hEvent) {
+            qemu_aio_release(acb);
+            return NULL;
+        }
+    }
+    memset(&acb->ov, 0, sizeof(acb->ov));
+    offset = sector_num * 512;
+    acb->ov.Offset = offset;
+    acb->ov.OffsetHigh = offset >> 32;
+    acb->ov.hEvent = acb->hEvent;
+    acb->count = nb_sectors * 512;
+    qemu_add_wait_object(acb->ov.hEvent, raw_aio_cb, acb);
+    return acb;
+}
+
+static BlockDriverAIOCB *raw_aio_read(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BDRVRawState *s = bs->opaque;
+    RawAIOCB *acb;
+    int ret;
+
+    acb = raw_aio_setup(bs, sector_num, buf, nb_sectors, cb, opaque);
+    if (!acb)
+        return NULL;
+    ret = ReadFile(s->hfile, buf, acb->count, NULL, &acb->ov);
+    if (!ret) {
+        qemu_aio_release(acb);
+        return NULL;
+    }
+    qemu_aio_release(acb);
+    return (BlockDriverAIOCB *)acb;
+}
+
+static BlockDriverAIOCB *raw_aio_write(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BDRVRawState *s = bs->opaque;
+    RawAIOCB *acb;
+    int ret;
+
+    acb = raw_aio_setup(bs, sector_num, buf, nb_sectors, cb, opaque);
+    if (!acb)
+        return NULL;
+    ret = WriteFile(s->hfile, buf, acb->count, NULL, &acb->ov);
+    if (!ret) {
+        qemu_aio_release(acb);
+        return NULL;
+    }
+    qemu_aio_release(acb);
+    return (BlockDriverAIOCB *)acb;
+}
+
+static void raw_aio_cancel(BlockDriverAIOCB *blockacb)
+{
+    RawAIOCB *acb = (RawAIOCB *)blockacb;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVRawState *s = bs->opaque;
+
+    qemu_del_wait_object(acb->ov.hEvent, raw_aio_cb, acb);
+    /* XXX: if more than one async I/O it is not correct */
+    CancelIo(s->hfile);
+    qemu_aio_release(acb);
+}
+#endif /* #if WIN32_AIO */
+
+static void raw_flush(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    FlushFileBuffers(s->hfile);
+}
+
+static void raw_close(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    CloseHandle(s->hfile);
+}
+
+static int raw_truncate(BlockDriverState *bs, int64_t offset)
+{
+    BDRVRawState *s = bs->opaque;
+    DWORD low, high;
+
+    low = offset;
+    high = offset >> 32;
+    if (!SetFilePointer(s->hfile, low, &high, FILE_BEGIN))
+	return -EIO;
+    if (!SetEndOfFile(s->hfile))
+        return -EIO;
+    return 0;
+}
+
+static int64_t raw_getlength(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    LARGE_INTEGER l;
+    ULARGE_INTEGER available, total, total_free;
+    DISK_GEOMETRY_EX dg;
+    DWORD count;
+    BOOL status;
+
+    switch(s->type) {
+    case FTYPE_FILE:
+        l.LowPart = GetFileSize(s->hfile, &l.HighPart);
+        if (l.LowPart == 0xffffffffUL && GetLastError() != NO_ERROR)
+            return -EIO;
+        break;
+    case FTYPE_CD:
+        if (!GetDiskFreeSpaceEx(s->drive_path, &available, &total, &total_free))
+            return -EIO;
+        l.QuadPart = total.QuadPart;
+        break;
+    case FTYPE_HARDDISK:
+        status = DeviceIoControl(s->hfile, IOCTL_DISK_GET_DRIVE_GEOMETRY_EX,
+                                 NULL, 0, &dg, sizeof(dg), &count, NULL);
+        if (status != 0) {
+            l = dg.DiskSize;
+        }
+        break;
+    default:
+        return -EIO;
+    }
+    return l.QuadPart;
+}
+
+static int raw_create(const char *filename, int64_t total_size,
+                      const char *backing_file, int flags)
+{
+    int fd;
+
+    if (flags || backing_file)
+        return -ENOTSUP;
+
+    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
+              0644);
+    if (fd < 0)
+        return -EIO;
+    set_sparse(fd);
+    ftruncate(fd, total_size * 512);
+    close(fd);
+    return 0;
+}
+
+void qemu_aio_init(void)
+{
+}
+
+void qemu_aio_flush(void)
+{
+}
+
+void qemu_aio_wait(void)
+{
+    qemu_bh_poll();
+}
+
+BlockDriver bdrv_raw = {
+    "raw",
+    sizeof(BDRVRawState),
+    NULL, /* no probe for protocols */
+    raw_open,
+    NULL,
+    NULL,
+    raw_close,
+    raw_create,
+    raw_flush,
+
+#ifdef WIN32_AIO
+    .bdrv_aio_read = raw_aio_read,
+    .bdrv_aio_write = raw_aio_write,
+    .bdrv_aio_cancel = raw_aio_cancel,
+    .aiocb_size = sizeof(RawAIOCB);
+#endif
+    .bdrv_pread = raw_pread,
+    .bdrv_pwrite = raw_pwrite,
+    .bdrv_truncate = raw_truncate,
+    .bdrv_getlength = raw_getlength,
+};
+
+/***********************************************/
+/* host device */
+
+static int find_cdrom(char *cdrom_name, int cdrom_name_size)
+{
+    char drives[256], *pdrv = drives;
+    UINT type;
+
+    memset(drives, 0, sizeof(drives));
+    GetLogicalDriveStrings(sizeof(drives), drives);
+    while(pdrv[0] != '\0') {
+        type = GetDriveType(pdrv);
+        switch(type) {
+        case DRIVE_CDROM:
+            snprintf(cdrom_name, cdrom_name_size, "\\\\.\\%c:", pdrv[0]);
+            return 0;
+            break;
+        }
+        pdrv += lstrlen(pdrv) + 1;
+    }
+    return -1;
+}
+
+static int find_device_type(BlockDriverState *bs, const char *filename)
+{
+    BDRVRawState *s = bs->opaque;
+    UINT type;
+    const char *p;
+
+    if (strstart(filename, "\\\\.\\", &p) ||
+        strstart(filename, "//./", &p)) {
+        if (stristart(p, "PhysicalDrive", NULL))
+            return FTYPE_HARDDISK;
+        snprintf(s->drive_path, sizeof(s->drive_path), "%c:\\", p[0]);
+        type = GetDriveType(s->drive_path);
+        if (type == DRIVE_CDROM)
+            return FTYPE_CD;
+        else
+            return FTYPE_FILE;
+    } else {
+        return FTYPE_FILE;
+    }
+}
+
+static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVRawState *s = bs->opaque;
+    int access_flags, create_flags;
+    DWORD overlapped;
+    char device_name[64];
+
+    if (strstart(filename, "/dev/cdrom", NULL)) {
+        if (find_cdrom(device_name, sizeof(device_name)) < 0)
+            return -ENOENT;
+        filename = device_name;
+    } else {
+        /* transform drive letters into device name */
+        if (((filename[0] >= 'a' && filename[0] <= 'z') ||
+             (filename[0] >= 'A' && filename[0] <= 'Z')) &&
+            filename[1] == ':' && filename[2] == '\0') {
+            snprintf(device_name, sizeof(device_name), "\\\\.\\%c:", filename[0]);
+            filename = device_name;
+        }
+    }
+    s->type = find_device_type(bs, filename);
+
+    if ((flags & BDRV_O_ACCESS) == O_RDWR) {
+        access_flags = GENERIC_READ | GENERIC_WRITE;
+    } else {
+        access_flags = GENERIC_READ;
+    }
+    create_flags = OPEN_EXISTING;
+
+#ifdef WIN32_AIO
+    overlapped = FILE_FLAG_OVERLAPPED;
+#else
+    overlapped = FILE_ATTRIBUTE_NORMAL;
+#endif
+    if (flags & BDRV_O_DIRECT)
+        overlapped |= FILE_FLAG_NO_BUFFERING | FILE_FLAG_WRITE_THROUGH;
+    s->hfile = CreateFile(filename, access_flags,
+                          FILE_SHARE_READ, NULL,
+                          create_flags, overlapped, NULL);
+    if (s->hfile == INVALID_HANDLE_VALUE) {
+        int err = GetLastError();
+
+        if (err == ERROR_ACCESS_DENIED)
+            return -EACCES;
+        return -1;
+    }
+    return 0;
+}
+
+#if 0
+/***********************************************/
+/* removable device additional commands */
+
+static int raw_is_inserted(BlockDriverState *bs)
+{
+    return 1;
+}
+
+static int raw_media_changed(BlockDriverState *bs)
+{
+    return -ENOTSUP;
+}
+
+static int raw_eject(BlockDriverState *bs, int eject_flag)
+{
+    DWORD ret_count;
+
+    if (s->type == FTYPE_FILE)
+        return -ENOTSUP;
+    if (eject_flag) {
+        DeviceIoControl(s->hfile, IOCTL_STORAGE_EJECT_MEDIA,
+                        NULL, 0, NULL, 0, &lpBytesReturned, NULL);
+    } else {
+        DeviceIoControl(s->hfile, IOCTL_STORAGE_LOAD_MEDIA,
+                        NULL, 0, NULL, 0, &lpBytesReturned, NULL);
+    }
+}
+
+static int raw_set_locked(BlockDriverState *bs, int locked)
+{
+    return -ENOTSUP;
+}
+#endif
+
+BlockDriver bdrv_host_device = {
+    "host_device",
+    sizeof(BDRVRawState),
+    NULL, /* no probe for protocols */
+    hdev_open,
+    NULL,
+    NULL,
+    raw_close,
+    NULL,
+    raw_flush,
+
+#ifdef WIN32_AIO
+    .bdrv_aio_read = raw_aio_read,
+    .bdrv_aio_write = raw_aio_write,
+    .bdrv_aio_cancel = raw_aio_cancel,
+    .aiocb_size = sizeof(RawAIOCB);
+#endif
+    .bdrv_pread = raw_pread,
+    .bdrv_pwrite = raw_pwrite,
+    .bdrv_getlength = raw_getlength,
+};
diff --git a/block-vmdk.c b/block-vmdk.c
new file mode 100644
index 0000000..8d67c2f
--- /dev/null
+++ b/block-vmdk.c
@@ -0,0 +1,834 @@
+/*
+ * Block driver for the VMDK format
+ *
+ * Copyright (c) 2004 Fabrice Bellard
+ * Copyright (c) 2005 Filip Navara
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu-common.h"
+#include "block_int.h"
+
+#define VMDK3_MAGIC (('C' << 24) | ('O' << 16) | ('W' << 8) | 'D')
+#define VMDK4_MAGIC (('K' << 24) | ('D' << 16) | ('M' << 8) | 'V')
+
+typedef struct {
+    uint32_t version;
+    uint32_t flags;
+    uint32_t disk_sectors;
+    uint32_t granularity;
+    uint32_t l1dir_offset;
+    uint32_t l1dir_size;
+    uint32_t file_sectors;
+    uint32_t cylinders;
+    uint32_t heads;
+    uint32_t sectors_per_track;
+} VMDK3Header;
+
+typedef struct {
+    uint32_t version;
+    uint32_t flags;
+    int64_t capacity;
+    int64_t granularity;
+    int64_t desc_offset;
+    int64_t desc_size;
+    int32_t num_gtes_per_gte;
+    int64_t rgd_offset;
+    int64_t gd_offset;
+    int64_t grain_offset;
+    char filler[1];
+    char check_bytes[4];
+} __attribute__((packed)) VMDK4Header;
+
+#define L2_CACHE_SIZE 16
+
+typedef struct BDRVVmdkState {
+    BlockDriverState *hd;
+    int64_t l1_table_offset;
+    int64_t l1_backup_table_offset;
+    uint32_t *l1_table;
+    uint32_t *l1_backup_table;
+    unsigned int l1_size;
+    uint32_t l1_entry_sectors;
+
+    unsigned int l2_size;
+    uint32_t *l2_cache;
+    uint32_t l2_cache_offsets[L2_CACHE_SIZE];
+    uint32_t l2_cache_counts[L2_CACHE_SIZE];
+
+    unsigned int cluster_sectors;
+    uint32_t parent_cid;
+    int is_parent;
+} BDRVVmdkState;
+
+typedef struct VmdkMetaData {
+    uint32_t offset;
+    unsigned int l1_index;
+    unsigned int l2_index;
+    unsigned int l2_offset;
+    int valid;
+} VmdkMetaData;
+
+typedef struct ActiveBDRVState{
+    BlockDriverState *hd;            // active image handler
+    uint64_t cluster_offset;         // current write offset
+}ActiveBDRVState;
+
+static ActiveBDRVState activeBDRV;
+
+
+static int vmdk_probe(const uint8_t *buf, int buf_size, const char *filename)
+{
+    uint32_t magic;
+
+    if (buf_size < 4)
+        return 0;
+    magic = be32_to_cpu(*(uint32_t *)buf);
+    if (magic == VMDK3_MAGIC ||
+        magic == VMDK4_MAGIC)
+        return 100;
+    else
+        return 0;
+}
+
+#define CHECK_CID 1
+
+#define SECTOR_SIZE 512
+#define DESC_SIZE 20*SECTOR_SIZE	// 20 sectors of 512 bytes each
+#define HEADER_SIZE 512   			// first sector of 512 bytes
+
+static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
+{
+    BDRVVmdkState *s = bs->opaque;
+    char desc[DESC_SIZE];
+    uint32_t cid;
+    const char *p_name, *cid_str;
+    size_t cid_str_size;
+
+    /* the descriptor offset = 0x200 */
+    if (bdrv_pread(s->hd, 0x200, desc, DESC_SIZE) != DESC_SIZE)
+        return 0;
+
+    if (parent) {
+        cid_str = "parentCID";
+        cid_str_size = sizeof("parentCID");
+    } else {
+        cid_str = "CID";
+        cid_str_size = sizeof("CID");
+    }
+
+    if ((p_name = strstr(desc,cid_str)) != 0) {
+        p_name += cid_str_size;
+        sscanf(p_name,"%x",&cid);
+    }
+
+    return cid;
+}
+
+static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
+{
+    BDRVVmdkState *s = bs->opaque;
+    char desc[DESC_SIZE], tmp_desc[DESC_SIZE];
+    char *p_name, *tmp_str;
+
+    /* the descriptor offset = 0x200 */
+    if (bdrv_pread(s->hd, 0x200, desc, DESC_SIZE) != DESC_SIZE)
+        return -1;
+
+    tmp_str = strstr(desc,"parentCID");
+    pstrcpy(tmp_desc, sizeof(tmp_desc), tmp_str);
+    if ((p_name = strstr(desc,"CID")) != 0) {
+        p_name += sizeof("CID");
+        snprintf(p_name, sizeof(desc) - (p_name - desc), "%x\n", cid);
+        pstrcat(desc, sizeof(desc), tmp_desc);
+    }
+
+    if (bdrv_pwrite(s->hd, 0x200, desc, DESC_SIZE) != DESC_SIZE)
+        return -1;
+    return 0;
+}
+
+static int vmdk_is_cid_valid(BlockDriverState *bs)
+{
+#ifdef CHECK_CID
+    BDRVVmdkState *s = bs->opaque;
+    BlockDriverState *p_bs = s->hd->backing_hd;
+    uint32_t cur_pcid;
+
+    if (p_bs) {
+        cur_pcid = vmdk_read_cid(p_bs,0);
+        if (s->parent_cid != cur_pcid)
+            // CID not valid
+            return 0;
+    }
+#endif
+    // CID valid
+    return 1;
+}
+
+static int vmdk_snapshot_create(const char *filename, const char *backing_file)
+{
+    int snp_fd, p_fd;
+    uint32_t p_cid;
+    char *p_name, *gd_buf, *rgd_buf;
+    const char *real_filename, *temp_str;
+    VMDK4Header header;
+    uint32_t gde_entries, gd_size;
+    int64_t gd_offset, rgd_offset, capacity, gt_size;
+    char p_desc[DESC_SIZE], s_desc[DESC_SIZE], hdr[HEADER_SIZE];
+    static const char desc_template[] =
+    "# Disk DescriptorFile\n"
+    "version=1\n"
+    "CID=%x\n"
+    "parentCID=%x\n"
+    "createType=\"monolithicSparse\"\n"
+    "parentFileNameHint=\"%s\"\n"
+    "\n"
+    "# Extent description\n"
+    "RW %u SPARSE \"%s\"\n"
+    "\n"
+    "# The Disk Data Base \n"
+    "#DDB\n"
+    "\n";
+
+    snp_fd = open(filename, O_RDWR | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE, 0644);
+    if (snp_fd < 0)
+        return -1;
+    p_fd = open(backing_file, O_RDONLY | O_BINARY | O_LARGEFILE);
+    if (p_fd < 0) {
+        close(snp_fd);
+        return -1;
+    }
+
+    /* read the header */
+    if (lseek(p_fd, 0x0, SEEK_SET) == -1)
+        goto fail;
+    if (read(p_fd, hdr, HEADER_SIZE) != HEADER_SIZE)
+        goto fail;
+
+    /* write the header */
+    if (lseek(snp_fd, 0x0, SEEK_SET) == -1)
+        goto fail;
+    if (write(snp_fd, hdr, HEADER_SIZE) == -1)
+        goto fail;
+
+    memset(&header, 0, sizeof(header));
+    memcpy(&header,&hdr[4], sizeof(header)); // skip the VMDK4_MAGIC
+
+    ftruncate(snp_fd, header.grain_offset << 9);
+    /* the descriptor offset = 0x200 */
+    if (lseek(p_fd, 0x200, SEEK_SET) == -1)
+        goto fail;
+    if (read(p_fd, p_desc, DESC_SIZE) != DESC_SIZE)
+        goto fail;
+
+    if ((p_name = strstr(p_desc,"CID")) != 0) {
+        p_name += sizeof("CID");
+        sscanf(p_name,"%x",&p_cid);
+    }
+
+    real_filename = filename;
+    if ((temp_str = strrchr(real_filename, '\\')) != NULL)
+        real_filename = temp_str + 1;
+    if ((temp_str = strrchr(real_filename, '/')) != NULL)
+        real_filename = temp_str + 1;
+    if ((temp_str = strrchr(real_filename, ':')) != NULL)
+        real_filename = temp_str + 1;
+
+    snprintf(s_desc, sizeof(s_desc), desc_template, p_cid, p_cid, backing_file,
+             (uint32_t)header.capacity, real_filename);
+
+    /* write the descriptor */
+    if (lseek(snp_fd, 0x200, SEEK_SET) == -1)
+        goto fail;
+    if (write(snp_fd, s_desc, strlen(s_desc)) == -1)
+        goto fail;
+
+    gd_offset = header.gd_offset * SECTOR_SIZE;     // offset of GD table
+    rgd_offset = header.rgd_offset * SECTOR_SIZE;   // offset of RGD table
+    capacity = header.capacity * SECTOR_SIZE;       // Extent size
+    /*
+     * Each GDE span 32M disk, means:
+     * 512 GTE per GT, each GTE points to grain
+     */
+    gt_size = (int64_t)header.num_gtes_per_gte * header.granularity * SECTOR_SIZE;
+    if (!gt_size)
+        goto fail;
+    gde_entries = (uint32_t)(capacity / gt_size);  // number of gde/rgde
+    gd_size = gde_entries * sizeof(uint32_t);
+
+    /* write RGD */
+    rgd_buf = qemu_malloc(gd_size);
+    if (!rgd_buf)
+        goto fail;
+    if (lseek(p_fd, rgd_offset, SEEK_SET) == -1)
+        goto fail_rgd;
+    if (read(p_fd, rgd_buf, gd_size) != gd_size)
+        goto fail_rgd;
+    if (lseek(snp_fd, rgd_offset, SEEK_SET) == -1)
+        goto fail_rgd;
+    if (write(snp_fd, rgd_buf, gd_size) == -1)
+        goto fail_rgd;
+    qemu_free(rgd_buf);
+
+    /* write GD */
+    gd_buf = qemu_malloc(gd_size);
+    if (!gd_buf)
+        goto fail_rgd;
+    if (lseek(p_fd, gd_offset, SEEK_SET) == -1)
+        goto fail_gd;
+    if (read(p_fd, gd_buf, gd_size) != gd_size)
+        goto fail_gd;
+    if (lseek(snp_fd, gd_offset, SEEK_SET) == -1)
+        goto fail_gd;
+    if (write(snp_fd, gd_buf, gd_size) == -1)
+        goto fail_gd;
+    qemu_free(gd_buf);
+
+    close(p_fd);
+    close(snp_fd);
+    return 0;
+
+    fail_gd:
+    qemu_free(gd_buf);
+    fail_rgd:
+    qemu_free(rgd_buf);
+    fail:
+    close(p_fd);
+    close(snp_fd);
+    return -1;
+}
+
+static void vmdk_parent_close(BlockDriverState *bs)
+{
+    if (bs->backing_hd)
+        bdrv_close(bs->backing_hd);
+}
+
+int parent_open = 0;
+static int vmdk_parent_open(BlockDriverState *bs, const char * filename)
+{
+    BDRVVmdkState *s = bs->opaque;
+    char *p_name;
+    char desc[DESC_SIZE];
+    char parent_img_name[1024];
+
+    /* the descriptor offset = 0x200 */
+    if (bdrv_pread(s->hd, 0x200, desc, DESC_SIZE) != DESC_SIZE)
+        return -1;
+
+    if ((p_name = strstr(desc,"parentFileNameHint")) != 0) {
+        char *end_name;
+        struct stat file_buf;
+
+        p_name += sizeof("parentFileNameHint") + 1;
+        if ((end_name = strchr(p_name,'\"')) == 0)
+            return -1;
+        if ((end_name - p_name) > sizeof (s->hd->backing_file) - 1)
+            return -1;
+
+        strncpy(s->hd->backing_file, p_name, end_name - p_name);
+        if (stat(s->hd->backing_file, &file_buf) != 0) {
+            path_combine(parent_img_name, sizeof(parent_img_name),
+                         filename, s->hd->backing_file);
+        } else {
+            pstrcpy(parent_img_name, sizeof(parent_img_name),
+                    s->hd->backing_file);
+        }
+
+        s->hd->backing_hd = bdrv_new("");
+        if (!s->hd->backing_hd) {
+            failure:
+            bdrv_close(s->hd);
+            return -1;
+        }
+        parent_open = 1;
+        if (bdrv_open(s->hd->backing_hd, parent_img_name, BDRV_O_RDONLY) < 0)
+            goto failure;
+        parent_open = 0;
+    }
+
+    return 0;
+}
+
+static int vmdk_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVVmdkState *s = bs->opaque;
+    uint32_t magic;
+    int l1_size, i, ret;
+
+    if (parent_open)
+        // Parent must be opened as RO.
+        flags = BDRV_O_RDONLY;
+
+    ret = bdrv_file_open(&s->hd, filename, flags);
+    if (ret < 0)
+        return ret;
+    if (bdrv_pread(s->hd, 0, &magic, sizeof(magic)) != sizeof(magic))
+        goto fail;
+
+    magic = be32_to_cpu(magic);
+    if (magic == VMDK3_MAGIC) {
+        VMDK3Header header;
+
+        if (bdrv_pread(s->hd, sizeof(magic), &header, sizeof(header)) != sizeof(header))
+            goto fail;
+        s->cluster_sectors = le32_to_cpu(header.granularity);
+        s->l2_size = 1 << 9;
+        s->l1_size = 1 << 6;
+        bs->total_sectors = le32_to_cpu(header.disk_sectors);
+        s->l1_table_offset = le32_to_cpu(header.l1dir_offset) << 9;
+        s->l1_backup_table_offset = 0;
+        s->l1_entry_sectors = s->l2_size * s->cluster_sectors;
+    } else if (magic == VMDK4_MAGIC) {
+        VMDK4Header header;
+
+        if (bdrv_pread(s->hd, sizeof(magic), &header, sizeof(header)) != sizeof(header))
+            goto fail;
+        bs->total_sectors = le64_to_cpu(header.capacity);
+        s->cluster_sectors = le64_to_cpu(header.granularity);
+        s->l2_size = le32_to_cpu(header.num_gtes_per_gte);
+        s->l1_entry_sectors = s->l2_size * s->cluster_sectors;
+        if (s->l1_entry_sectors <= 0)
+            goto fail;
+        s->l1_size = (bs->total_sectors + s->l1_entry_sectors - 1)
+            / s->l1_entry_sectors;
+        s->l1_table_offset = le64_to_cpu(header.rgd_offset) << 9;
+        s->l1_backup_table_offset = le64_to_cpu(header.gd_offset) << 9;
+
+        if (parent_open)
+            s->is_parent = 1;
+        else
+            s->is_parent = 0;
+
+        // try to open parent images, if exist
+        if (vmdk_parent_open(bs, filename) != 0)
+            goto fail;
+        // write the CID once after the image creation
+        s->parent_cid = vmdk_read_cid(bs,1);
+    } else {
+        goto fail;
+    }
+
+    /* read the L1 table */
+    l1_size = s->l1_size * sizeof(uint32_t);
+    s->l1_table = qemu_malloc(l1_size);
+    if (!s->l1_table)
+        goto fail;
+    if (bdrv_pread(s->hd, s->l1_table_offset, s->l1_table, l1_size) != l1_size)
+        goto fail;
+    for(i = 0; i < s->l1_size; i++) {
+        le32_to_cpus(&s->l1_table[i]);
+    }
+
+    if (s->l1_backup_table_offset) {
+        s->l1_backup_table = qemu_malloc(l1_size);
+        if (!s->l1_backup_table)
+            goto fail;
+        if (bdrv_pread(s->hd, s->l1_backup_table_offset, s->l1_backup_table, l1_size) != l1_size)
+            goto fail;
+        for(i = 0; i < s->l1_size; i++) {
+            le32_to_cpus(&s->l1_backup_table[i]);
+        }
+    }
+
+    s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint32_t));
+    if (!s->l2_cache)
+        goto fail;
+    return 0;
+ fail:
+    qemu_free(s->l1_backup_table);
+    qemu_free(s->l1_table);
+    qemu_free(s->l2_cache);
+    bdrv_delete(s->hd);
+    return -1;
+}
+
+static uint64_t get_cluster_offset(BlockDriverState *bs, VmdkMetaData *m_data,
+                                   uint64_t offset, int allocate);
+
+static int get_whole_cluster(BlockDriverState *bs, uint64_t cluster_offset,
+                             uint64_t offset, int allocate)
+{
+    uint64_t parent_cluster_offset;
+    BDRVVmdkState *s = bs->opaque;
+    uint8_t  whole_grain[s->cluster_sectors*512];        // 128 sectors * 512 bytes each = grain size 64KB
+
+    // we will be here if it's first write on non-exist grain(cluster).
+    // try to read from parent image, if exist
+    if (s->hd->backing_hd) {
+        BDRVVmdkState *ps = s->hd->backing_hd->opaque;
+
+        if (!vmdk_is_cid_valid(bs))
+            return -1;
+
+        parent_cluster_offset = get_cluster_offset(s->hd->backing_hd, NULL, offset, allocate);
+
+        if (parent_cluster_offset) {
+            BDRVVmdkState *act_s = activeBDRV.hd->opaque;
+
+            if (bdrv_pread(ps->hd, parent_cluster_offset, whole_grain, ps->cluster_sectors*512) != ps->cluster_sectors*512)
+                return -1;
+
+            //Write grain only into the active image
+            if (bdrv_pwrite(act_s->hd, activeBDRV.cluster_offset << 9, whole_grain, sizeof(whole_grain)) != sizeof(whole_grain))
+                return -1;
+        }
+    }
+    return 0;
+}
+
+static int vmdk_L2update(BlockDriverState *bs, VmdkMetaData *m_data)
+{
+    BDRVVmdkState *s = bs->opaque;
+
+    /* update L2 table */
+    if (bdrv_pwrite(s->hd, ((int64_t)m_data->l2_offset * 512) + (m_data->l2_index * sizeof(m_data->offset)),
+                    &(m_data->offset), sizeof(m_data->offset)) != sizeof(m_data->offset))
+        return -1;
+    /* update backup L2 table */
+    if (s->l1_backup_table_offset != 0) {
+        m_data->l2_offset = s->l1_backup_table[m_data->l1_index];
+        if (bdrv_pwrite(s->hd, ((int64_t)m_data->l2_offset * 512) + (m_data->l2_index * sizeof(m_data->offset)),
+                        &(m_data->offset), sizeof(m_data->offset)) != sizeof(m_data->offset))
+            return -1;
+    }
+
+    return 0;
+}
+
+static uint64_t get_cluster_offset(BlockDriverState *bs, VmdkMetaData *m_data,
+                                   uint64_t offset, int allocate)
+{
+    BDRVVmdkState *s = bs->opaque;
+    unsigned int l1_index, l2_offset, l2_index;
+    int min_index, i, j;
+    uint32_t min_count, *l2_table, tmp = 0;
+    uint64_t cluster_offset;
+
+    if (m_data)
+        m_data->valid = 0;
+
+    l1_index = (offset >> 9) / s->l1_entry_sectors;
+    if (l1_index >= s->l1_size)
+        return 0;
+    l2_offset = s->l1_table[l1_index];
+    if (!l2_offset)
+        return 0;
+    for(i = 0; i < L2_CACHE_SIZE; i++) {
+        if (l2_offset == s->l2_cache_offsets[i]) {
+            /* increment the hit count */
+            if (++s->l2_cache_counts[i] == 0xffffffff) {
+                for(j = 0; j < L2_CACHE_SIZE; j++) {
+                    s->l2_cache_counts[j] >>= 1;
+                }
+            }
+            l2_table = s->l2_cache + (i * s->l2_size);
+            goto found;
+        }
+    }
+    /* not found: load a new entry in the least used one */
+    min_index = 0;
+    min_count = 0xffffffff;
+    for(i = 0; i < L2_CACHE_SIZE; i++) {
+        if (s->l2_cache_counts[i] < min_count) {
+            min_count = s->l2_cache_counts[i];
+            min_index = i;
+        }
+    }
+    l2_table = s->l2_cache + (min_index * s->l2_size);
+    if (bdrv_pread(s->hd, (int64_t)l2_offset * 512, l2_table, s->l2_size * sizeof(uint32_t)) !=
+                                                                        s->l2_size * sizeof(uint32_t))
+        return 0;
+
+    s->l2_cache_offsets[min_index] = l2_offset;
+    s->l2_cache_counts[min_index] = 1;
+ found:
+    l2_index = ((offset >> 9) / s->cluster_sectors) % s->l2_size;
+    cluster_offset = le32_to_cpu(l2_table[l2_index]);
+
+    if (!cluster_offset) {
+        if (!allocate)
+            return 0;
+        // Avoid the L2 tables update for the images that have snapshots.
+        if (!s->is_parent) {
+            cluster_offset = bdrv_getlength(s->hd);
+            bdrv_truncate(s->hd, cluster_offset + (s->cluster_sectors << 9));
+
+            cluster_offset >>= 9;
+            tmp = cpu_to_le32(cluster_offset);
+            l2_table[l2_index] = tmp;
+            // Save the active image state
+            activeBDRV.cluster_offset = cluster_offset;
+            activeBDRV.hd = bs;
+        }
+        /* First of all we write grain itself, to avoid race condition
+         * that may to corrupt the image.
+         * This problem may occur because of insufficient space on host disk
+         * or inappropriate VM shutdown.
+         */
+        if (get_whole_cluster(bs, cluster_offset, offset, allocate) == -1)
+            return 0;
+
+        if (m_data) {
+            m_data->offset = tmp;
+            m_data->l1_index = l1_index;
+            m_data->l2_index = l2_index;
+            m_data->l2_offset = l2_offset;
+            m_data->valid = 1;
+        }
+    }
+    cluster_offset <<= 9;
+    return cluster_offset;
+}
+
+static int vmdk_is_allocated(BlockDriverState *bs, int64_t sector_num,
+                             int nb_sectors, int *pnum)
+{
+    BDRVVmdkState *s = bs->opaque;
+    int index_in_cluster, n;
+    uint64_t cluster_offset;
+
+    cluster_offset = get_cluster_offset(bs, NULL, sector_num << 9, 0);
+    index_in_cluster = sector_num % s->cluster_sectors;
+    n = s->cluster_sectors - index_in_cluster;
+    if (n > nb_sectors)
+        n = nb_sectors;
+    *pnum = n;
+    return (cluster_offset != 0);
+}
+
+static int vmdk_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
+{
+    BDRVVmdkState *s = bs->opaque;
+    int index_in_cluster, n, ret;
+    uint64_t cluster_offset;
+
+    while (nb_sectors > 0) {
+        cluster_offset = get_cluster_offset(bs, NULL, sector_num << 9, 0);
+        index_in_cluster = sector_num % s->cluster_sectors;
+        n = s->cluster_sectors - index_in_cluster;
+        if (n > nb_sectors)
+            n = nb_sectors;
+        if (!cluster_offset) {
+            // try to read from parent image, if exist
+            if (s->hd->backing_hd) {
+                if (!vmdk_is_cid_valid(bs))
+                    return -1;
+                ret = bdrv_read(s->hd->backing_hd, sector_num, buf, n);
+                if (ret < 0)
+                    return -1;
+            } else {
+                memset(buf, 0, 512 * n);
+            }
+        } else {
+            if(bdrv_pread(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512) != n * 512)
+                return -1;
+        }
+        nb_sectors -= n;
+        sector_num += n;
+        buf += n * 512;
+    }
+    return 0;
+}
+
+static int vmdk_write(BlockDriverState *bs, int64_t sector_num,
+                     const uint8_t *buf, int nb_sectors)
+{
+    BDRVVmdkState *s = bs->opaque;
+    VmdkMetaData m_data;
+    int index_in_cluster, n;
+    uint64_t cluster_offset;
+    static int cid_update = 0;
+
+    if (sector_num > bs->total_sectors) {
+        fprintf(stderr,
+                "(VMDK) Wrong offset: sector_num=0x%" PRIx64
+                " total_sectors=0x%" PRIx64 "\n",
+                sector_num, bs->total_sectors);
+        return -1;
+    }
+
+    while (nb_sectors > 0) {
+        index_in_cluster = sector_num & (s->cluster_sectors - 1);
+        n = s->cluster_sectors - index_in_cluster;
+        if (n > nb_sectors)
+            n = nb_sectors;
+        cluster_offset = get_cluster_offset(bs, &m_data, sector_num << 9, 1);
+        if (!cluster_offset)
+            return -1;
+
+        if (bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512) != n * 512)
+            return -1;
+        if (m_data.valid) {
+            /* update L2 tables */
+            if (vmdk_L2update(bs, &m_data) == -1)
+                return -1;
+        }
+        nb_sectors -= n;
+        sector_num += n;
+        buf += n * 512;
+
+        // update CID on the first write every time the virtual disk is opened
+        if (!cid_update) {
+            vmdk_write_cid(bs, time(NULL));
+            cid_update++;
+        }
+    }
+    return 0;
+}
+
+static int vmdk_create(const char *filename, int64_t total_size,
+                       const char *backing_file, int flags)
+{
+    int fd, i;
+    VMDK4Header header;
+    uint32_t tmp, magic, grains, gd_size, gt_size, gt_count;
+    static const char desc_template[] =
+        "# Disk DescriptorFile\n"
+        "version=1\n"
+        "CID=%x\n"
+        "parentCID=ffffffff\n"
+        "createType=\"monolithicSparse\"\n"
+        "\n"
+        "# Extent description\n"
+        "RW %lu SPARSE \"%s\"\n"
+        "\n"
+        "# The Disk Data Base \n"
+        "#DDB\n"
+        "\n"
+        "ddb.virtualHWVersion = \"%d\"\n"
+        "ddb.geometry.cylinders = \"%lu\"\n"
+        "ddb.geometry.heads = \"16\"\n"
+        "ddb.geometry.sectors = \"63\"\n"
+        "ddb.adapterType = \"ide\"\n";
+    char desc[1024];
+    const char *real_filename, *temp_str;
+
+    /* XXX: add support for backing file */
+    if (backing_file) {
+        return vmdk_snapshot_create(filename, backing_file);
+    }
+
+    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE,
+              0644);
+    if (fd < 0)
+        return -1;
+    magic = cpu_to_be32(VMDK4_MAGIC);
+    memset(&header, 0, sizeof(header));
+    header.version = cpu_to_le32(1);
+    header.flags = cpu_to_le32(3); /* ?? */
+    header.capacity = cpu_to_le64(total_size);
+    header.granularity = cpu_to_le64(128);
+    header.num_gtes_per_gte = cpu_to_le32(512);
+
+    grains = (total_size + header.granularity - 1) / header.granularity;
+    gt_size = ((header.num_gtes_per_gte * sizeof(uint32_t)) + 511) >> 9;
+    gt_count = (grains + header.num_gtes_per_gte - 1) / header.num_gtes_per_gte;
+    gd_size = (gt_count * sizeof(uint32_t) + 511) >> 9;
+
+    header.desc_offset = 1;
+    header.desc_size = 20;
+    header.rgd_offset = header.desc_offset + header.desc_size;
+    header.gd_offset = header.rgd_offset + gd_size + (gt_size * gt_count);
+    header.grain_offset =
+       ((header.gd_offset + gd_size + (gt_size * gt_count) +
+         header.granularity - 1) / header.granularity) *
+        header.granularity;
+
+    header.desc_offset = cpu_to_le64(header.desc_offset);
+    header.desc_size = cpu_to_le64(header.desc_size);
+    header.rgd_offset = cpu_to_le64(header.rgd_offset);
+    header.gd_offset = cpu_to_le64(header.gd_offset);
+    header.grain_offset = cpu_to_le64(header.grain_offset);
+
+    header.check_bytes[0] = 0xa;
+    header.check_bytes[1] = 0x20;
+    header.check_bytes[2] = 0xd;
+    header.check_bytes[3] = 0xa;
+
+    /* write all the data */
+    write(fd, &magic, sizeof(magic));
+    write(fd, &header, sizeof(header));
+
+    ftruncate(fd, header.grain_offset << 9);
+
+    /* write grain directory */
+    lseek(fd, le64_to_cpu(header.rgd_offset) << 9, SEEK_SET);
+    for (i = 0, tmp = header.rgd_offset + gd_size;
+         i < gt_count; i++, tmp += gt_size)
+        write(fd, &tmp, sizeof(tmp));
+
+    /* write backup grain directory */
+    lseek(fd, le64_to_cpu(header.gd_offset) << 9, SEEK_SET);
+    for (i = 0, tmp = header.gd_offset + gd_size;
+         i < gt_count; i++, tmp += gt_size)
+        write(fd, &tmp, sizeof(tmp));
+
+    /* compose the descriptor */
+    real_filename = filename;
+    if ((temp_str = strrchr(real_filename, '\\')) != NULL)
+        real_filename = temp_str + 1;
+    if ((temp_str = strrchr(real_filename, '/')) != NULL)
+        real_filename = temp_str + 1;
+    if ((temp_str = strrchr(real_filename, ':')) != NULL)
+        real_filename = temp_str + 1;
+    snprintf(desc, sizeof(desc), desc_template, (unsigned int)time(NULL),
+             (unsigned long)total_size, real_filename,
+             (flags & BLOCK_FLAG_COMPAT6 ? 6 : 4), total_size / (63 * 16));
+
+    /* write the descriptor */
+    lseek(fd, le64_to_cpu(header.desc_offset) << 9, SEEK_SET);
+    write(fd, desc, strlen(desc));
+
+    close(fd);
+    return 0;
+}
+
+static void vmdk_close(BlockDriverState *bs)
+{
+    BDRVVmdkState *s = bs->opaque;
+
+    qemu_free(s->l1_table);
+    qemu_free(s->l2_cache);
+    // try to close parent image, if exist
+    vmdk_parent_close(s->hd);
+    bdrv_delete(s->hd);
+}
+
+static void vmdk_flush(BlockDriverState *bs)
+{
+    BDRVVmdkState *s = bs->opaque;
+    bdrv_flush(s->hd);
+}
+
+BlockDriver bdrv_vmdk = {
+    "vmdk",
+    sizeof(BDRVVmdkState),
+    vmdk_probe,
+    vmdk_open,
+    vmdk_read,
+    vmdk_write,
+    vmdk_close,
+    vmdk_create,
+    vmdk_flush,
+    vmdk_is_allocated,
+};
diff --git a/block-vpc.c b/block-vpc.c
new file mode 100644
index 0000000..f76c451
--- /dev/null
+++ b/block-vpc.c
@@ -0,0 +1,239 @@
+/*
+ * Block driver for Conectix/Microsoft Virtual PC images
+ *
+ * Copyright (c) 2005 Alex Beregszaszi
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu-common.h"
+#include "block_int.h"
+
+/**************************************************************/
+
+#define HEADER_SIZE 512
+
+//#define CACHE
+
+// always big-endian
+struct vpc_subheader {
+    char magic[8]; // "conectix" / "cxsparse"
+    union {
+	struct {
+	    uint32_t unk1[2];
+	    uint32_t unk2; // always zero?
+	    uint32_t subheader_offset;
+	    uint32_t unk3; // some size?
+	    char creator[4]; // "vpc "
+	    uint16_t major;
+	    uint16_t minor;
+	    char guest[4]; // "Wi2k"
+	    uint32_t unk4[7];
+	    uint8_t vnet_id[16]; // virtual network id, purpose unknown
+	    // next 16 longs are used, but dunno the purpose
+	    // next 6 longs unknown, following 7 long maybe a serial
+	    char padding[HEADER_SIZE - 84];
+	} main;
+	struct {
+	    uint32_t unk1[2]; // all bits set
+	    uint32_t unk2; // always zero?
+	    uint32_t pagetable_offset;
+	    uint32_t unk3;
+	    uint32_t pagetable_entries; // 32bit/entry
+	    uint32_t pageentry_size; // 512*8*512
+	    uint32_t nb_sectors;
+	    char padding[HEADER_SIZE - 40];
+	} sparse;
+	char padding[HEADER_SIZE - 8];
+    } type;
+};
+
+typedef struct BDRVVPCState {
+    int fd;
+
+    int pagetable_entries;
+    uint32_t *pagetable;
+
+    uint32_t pageentry_size;
+#ifdef CACHE
+    uint8_t *pageentry_u8;
+    uint32_t *pageentry_u32;
+    uint16_t *pageentry_u16;
+
+    uint64_t last_bitmap;
+#endif
+} BDRVVPCState;
+
+static int vpc_probe(const uint8_t *buf, int buf_size, const char *filename)
+{
+    if (buf_size >= 8 && !strncmp((char *)buf, "conectix", 8))
+	return 100;
+    return 0;
+}
+
+static int vpc_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    BDRVVPCState *s = bs->opaque;
+    int fd, i;
+    struct vpc_subheader header;
+
+    fd = open(filename, O_RDONLY | O_BINARY);
+    if (fd < 0)
+        return -1;
+
+    bs->read_only = 1; // no write support yet
+
+    s->fd = fd;
+
+    if (read(fd, &header, HEADER_SIZE) != HEADER_SIZE)
+        goto fail;
+
+    if (strncmp(header.magic, "conectix", 8))
+        goto fail;
+    lseek(s->fd, be32_to_cpu(header.type.main.subheader_offset), SEEK_SET);
+
+    if (read(fd, &header, HEADER_SIZE) != HEADER_SIZE)
+        goto fail;
+
+    if (strncmp(header.magic, "cxsparse", 8))
+	goto fail;
+
+    bs->total_sectors = ((uint64_t)be32_to_cpu(header.type.sparse.pagetable_entries) *
+			be32_to_cpu(header.type.sparse.pageentry_size)) / 512;
+
+    lseek(s->fd, be32_to_cpu(header.type.sparse.pagetable_offset), SEEK_SET);
+
+    s->pagetable_entries = be32_to_cpu(header.type.sparse.pagetable_entries);
+    s->pagetable = qemu_malloc(s->pagetable_entries * 4);
+    if (!s->pagetable)
+	goto fail;
+    if (read(s->fd, s->pagetable, s->pagetable_entries * 4) !=
+	s->pagetable_entries * 4)
+	goto fail;
+    for (i = 0; i < s->pagetable_entries; i++)
+	be32_to_cpus(&s->pagetable[i]);
+
+    s->pageentry_size = be32_to_cpu(header.type.sparse.pageentry_size);
+#ifdef CACHE
+    s->pageentry_u8 = qemu_malloc(512);
+    if (!s->pageentry_u8)
+	goto fail;
+    s->pageentry_u32 = s->pageentry_u8;
+    s->pageentry_u16 = s->pageentry_u8;
+    s->last_pagetable = -1;
+#endif
+
+    return 0;
+ fail:
+    close(fd);
+    return -1;
+}
+
+static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num)
+{
+    BDRVVPCState *s = bs->opaque;
+    uint64_t offset = sector_num * 512;
+    uint64_t bitmap_offset, block_offset;
+    uint32_t pagetable_index, pageentry_index;
+
+    pagetable_index = offset / s->pageentry_size;
+    pageentry_index = (offset % s->pageentry_size) / 512;
+
+    if (pagetable_index > s->pagetable_entries || s->pagetable[pagetable_index] == 0xffffffff)
+	return -1; // not allocated
+
+    bitmap_offset = 512 * s->pagetable[pagetable_index];
+    block_offset = bitmap_offset + 512 + (512 * pageentry_index);
+
+//    printf("sector: %" PRIx64 ", index: %x, offset: %x, bioff: %" PRIx64 ", bloff: %" PRIx64 "\n",
+//	sector_num, pagetable_index, pageentry_index,
+//	bitmap_offset, block_offset);
+
+// disabled by reason
+#if 0
+#ifdef CACHE
+    if (bitmap_offset != s->last_bitmap)
+    {
+	lseek(s->fd, bitmap_offset, SEEK_SET);
+
+	s->last_bitmap = bitmap_offset;
+
+	// Scary! Bitmap is stored as big endian 32bit entries,
+	// while we used to look it up byte by byte
+	read(s->fd, s->pageentry_u8, 512);
+	for (i = 0; i < 128; i++)
+	    be32_to_cpus(&s->pageentry_u32[i]);
+    }
+
+    if ((s->pageentry_u8[pageentry_index / 8] >> (pageentry_index % 8)) & 1)
+	return -1;
+#else
+    lseek(s->fd, bitmap_offset + (pageentry_index / 8), SEEK_SET);
+
+    read(s->fd, &bitmap_entry, 1);
+
+    if ((bitmap_entry >> (pageentry_index % 8)) & 1)
+	return -1; // not allocated
+#endif
+#endif
+    lseek(s->fd, block_offset, SEEK_SET);
+
+    return 0;
+}
+
+static int vpc_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
+{
+    BDRVVPCState *s = bs->opaque;
+    int ret;
+
+    while (nb_sectors > 0) {
+	if (!seek_to_sector(bs, sector_num))
+	{
+	    ret = read(s->fd, buf, 512);
+	    if (ret != 512)
+		return -1;
+	}
+	else
+            memset(buf, 0, 512);
+        nb_sectors--;
+        sector_num++;
+        buf += 512;
+    }
+    return 0;
+}
+
+static void vpc_close(BlockDriverState *bs)
+{
+    BDRVVPCState *s = bs->opaque;
+    qemu_free(s->pagetable);
+#ifdef CACHE
+    qemu_free(s->pageentry_u8);
+#endif
+    close(s->fd);
+}
+
+BlockDriver bdrv_vpc = {
+    "vpc",
+    sizeof(BDRVVPCState),
+    vpc_probe,
+    vpc_open,
+    vpc_read,
+    NULL,
+    vpc_close,
+};
diff --git a/block-vvfat.c b/block-vvfat.c
index c365b9c..79804a7 100644
--- a/block-vvfat.c
+++ b/block-vvfat.c
@@ -25,7 +25,7 @@
 #include <sys/stat.h>
 #include <dirent.h>
 #include <assert.h>
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 #ifndef S_IWGRP
@@ -53,7 +53,7 @@
 #define stderr STDERR
 FILE* stderr = NULL;
 
-static void checkpoint();
+static void checkpoint(void);
 
 #ifdef __MINGW32__
 void nonono(const char* file, int line, const char* msg) {
@@ -61,7 +61,7 @@ void nonono(const char* file, int line, const char* msg) {
     exit(-5);
 }
 #undef assert
-#define assert(a) if (!(a)) nonono(__FILE__, __LINE__, #a)
+#define assert(a) do {if (!(a)) nonono(__FILE__, __LINE__, #a);}while(0)
 #endif
 
 #else
@@ -93,7 +93,6 @@ static inline void array_free(array_t* array)
 
 /* does not automatically grow */
 static inline void* array_get(array_t* array,unsigned int index) {
-    assert(index >= 0);
     assert(index < array->next);
     return array->pointer + index * array->item_size;
 }
@@ -102,7 +101,7 @@ static inline int array_ensure_allocated(array_t* array, int index)
 {
     if((index + 1) * array->item_size > array->size) {
 	int new_size = (index + 32) * array->item_size;
-	array->pointer = realloc(array->pointer, new_size);
+	array->pointer = qemu_realloc(array->pointer, new_size);
 	if (!array->pointer)
 	    return -1;
 	array->size = new_size;
@@ -128,7 +127,7 @@ static inline void* array_get_next(array_t* array) {
 static inline void* array_insert(array_t* array,unsigned int index,unsigned int count) {
     if((array->next+count)*array->item_size>array->size) {
 	int increment=count*array->item_size;
-	array->pointer=realloc(array->pointer,array->size+increment);
+	array->pointer=qemu_realloc(array->pointer,array->size+increment);
 	if(!array->pointer)
 	    return 0;
 	array->size+=increment;
@@ -175,7 +174,7 @@ static inline int array_roll(array_t* array,int index_to,int index_from,int coun
     return 0;
 }
 
-inline int array_remove_slice(array_t* array,int index, int count)
+static inline int array_remove_slice(array_t* array,int index, int count)
 {
     assert(index >=0);
     assert(count > 0);
@@ -186,16 +185,15 @@ inline int array_remove_slice(array_t* array,int index, int count)
     return 0;
 }
 
-int array_remove(array_t* array,int index)
+static int array_remove(array_t* array,int index)
 {
     return array_remove_slice(array, index, 1);
 }
 
 /* return the index for a given member */
-int array_index(array_t* array, void* pointer)
+static int array_index(array_t* array, void* pointer)
 {
     size_t offset = (char*)pointer - array->pointer;
-    assert(offset >= 0);
     assert((offset % array->item_size) == 0);
     assert(offset/array->item_size < array->next);
     return offset/array->item_size;
@@ -242,21 +240,25 @@ typedef struct bootsector_t {
     uint8_t magic[2];
 } __attribute__((packed)) bootsector_t;
 
+typedef struct {
+    uint8_t head;
+    uint8_t sector;
+    uint8_t cylinder;
+} mbr_chs_t;
+
 typedef struct partition_t {
     uint8_t attributes; /* 0x80 = bootable */
-    uint8_t start_head;
-    uint8_t start_sector;
-    uint8_t start_cylinder;
-    uint8_t fs_type; /* 0x1 = FAT12, 0x6 = FAT16, 0xb = FAT32 */
-    uint8_t end_head;
-    uint8_t end_sector;
-    uint8_t end_cylinder;
+    mbr_chs_t start_CHS;
+    uint8_t   fs_type; /* 0x1 = FAT12, 0x6 = FAT16, 0xe = FAT16_LBA, 0xb = FAT32, 0xc = FAT32_LBA */
+    mbr_chs_t end_CHS;
     uint32_t start_sector_long;
-    uint32_t end_sector_long;
+    uint32_t length_sector_long;
 } __attribute__((packed)) partition_t;
 
 typedef struct mbr_t {
-    uint8_t ignored[0x1be];
+    uint8_t ignored[0x1b8];
+    uint32_t nt_id;
+    uint8_t ignored2[2];
     partition_t partition[4];
     uint8_t magic[2];
 } __attribute__((packed)) mbr_t;
@@ -350,11 +352,26 @@ typedef struct BDRVVVFATState {
     int downcase_short_names;
 } BDRVVVFATState;
 
-
-static int vvfat_probe(const uint8_t *buf, int buf_size, const char *filename)
-{
-    if (strstart(filename, "fat:", NULL))
-	return 100;
+/* take the sector position spos and convert it to Cylinder/Head/Sector position
+ * if the position is outside the specified geometry, fill maximum value for CHS
+ * and return 1 to signal overflow.
+ */
+static int sector2CHS(BlockDriverState* bs, mbr_chs_t * chs, int spos){
+    int head,sector;
+    sector   = spos % (bs->secs);  spos/= bs->secs;
+    head     = spos % (bs->heads); spos/= bs->heads;
+    if(spos >= bs->cyls){
+        /* Overflow,
+        it happens if 32bit sector positions are used, while CHS is only 24bit.
+        Windows/Dos is said to take 1023/255/63 as nonrepresentable CHS */
+        chs->head     = 0xFF;
+        chs->sector   = 0xFF;
+        chs->cylinder = 0xFF;
+        return 1;
+    }
+    chs->head     = (uint8_t)head;
+    chs->sector   = (uint8_t)( (sector+1) | ((spos>>8)<<6) );
+    chs->cylinder = (uint8_t)spos;
     return 0;
 }
 
@@ -363,20 +380,29 @@ static void init_mbr(BDRVVVFATState* s)
     /* TODO: if the files mbr.img and bootsect.img exist, use them */
     mbr_t* real_mbr=(mbr_t*)s->first_sectors;
     partition_t* partition=&(real_mbr->partition[0]);
+    int lba;
 
     memset(s->first_sectors,0,512);
 
+    /* Win NT Disk Signature */
+    real_mbr->nt_id= cpu_to_le32(0xbe1afdfa);
+
     partition->attributes=0x80; /* bootable */
-    partition->start_head=1;
-    partition->start_sector=1;
-    partition->start_cylinder=0;
+
+    /* LBA is used when partition is outside the CHS geometry */
+    lba = sector2CHS(s->bs, &partition->start_CHS, s->first_sectors_number-1);
+    lba|= sector2CHS(s->bs, &partition->end_CHS,   s->sector_count);
+
+    /*LBA partitions are identified only by start/length_sector_long not by CHS*/
+    partition->start_sector_long =cpu_to_le32(s->first_sectors_number-1);
+    partition->length_sector_long=cpu_to_le32(s->sector_count - s->first_sectors_number+1);
+
     /* FAT12/FAT16/FAT32 */
-    partition->fs_type=(s->fat_type==12?0x1:s->fat_type==16?0x6:0xb);
-    partition->end_head=s->bs->heads-1;
-    partition->end_sector=0xff; /* end sector & upper 2 bits of cylinder */;
-    partition->end_cylinder=0xff; /* lower 8 bits of end cylinder */;
-    partition->start_sector_long=cpu_to_le32(s->bs->secs);
-    partition->end_sector_long=cpu_to_le32(s->sector_count);
+    /* DOS uses different types when partition is LBA,
+       probably to prevent older versions from using CHS on them */
+    partition->fs_type= s->fat_type==12 ? 0x1:
+                        s->fat_type==16 ? (lba?0xe:0x06):
+                         /*fat_tyoe==32*/ (lba?0xc:0x0b);
 
     real_mbr->magic[0]=0x55; real_mbr->magic[1]=0xaa;
 }
@@ -384,17 +410,19 @@ static void init_mbr(BDRVVVFATState* s)
 /* direntry functions */
 
 /* dest is assumed to hold 258 bytes, and pads with 0xffff up to next multiple of 26 */
-static inline int short2long_name(unsigned char* dest,const char* src)
+static inline int short2long_name(char* dest,const char* src)
 {
     int i;
+    int len;
     for(i=0;i<129 && src[i];i++) {
         dest[2*i]=src[i];
 	dest[2*i+1]=0;
     }
+    len=2*i;
     dest[2*i]=dest[2*i+1]=0;
     for(i=2*i+2;(i%26);i++)
 	dest[i]=0xff;
-    return i;
+    return len;
 }
 
 static inline direntry_t* create_long_filename(BDRVVVFATState* s,const char* filename)
@@ -411,7 +439,7 @@ static inline direntry_t* create_long_filename(BDRVVVFATState* s,const char* fil
 	entry->begin=0;
 	entry->name[0]=(number_of_entries-i)|(i==0?0x40:0);
     }
-    for(i=0;i<length;i++) {
+    for(i=0;i<26*number_of_entries;i++) {
 	int offset=(i%26);
 	if(offset<10) offset=1+offset;
 	else if(offset<22) offset=14+offset-10;
@@ -424,8 +452,7 @@ static inline direntry_t* create_long_filename(BDRVVVFATState* s,const char* fil
 
 static char is_free(const direntry_t* direntry)
 {
-    /* return direntry->name[0]==0 ; */
-    return direntry->attributes == 0 || direntry->name[0]==0xe5;
+    return direntry->name[0]==0xe5 || direntry->name[0]==0x00;
 }
 
 static char is_volume_label(const direntry_t* direntry)
@@ -537,7 +564,7 @@ static inline uint32_t fat_get(BDRVVVFATState* s,unsigned int cluster)
 	uint16_t* entry=array_get(&(s->fat),cluster);
 	return le16_to_cpu(*entry);
     } else {
-	const uint8_t* x=s->fat.pointer+cluster*3/2;
+	const uint8_t* x=(uint8_t*)(s->fat.pointer)+cluster*3/2;
 	return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
     }
 }
@@ -598,7 +625,7 @@ static inline direntry_t* create_short_and_long_name(BDRVVVFATState* s,
 
     entry=array_get_next(&(s->directory));
     memset(entry->name,0x20,11);
-    strncpy(entry->name,filename,i);
+    strncpy((char*)entry->name,filename,i);
 
     if(j > 0)
 	for (i = 0; i < 3 && filename[j+1+i]; i++)
@@ -840,7 +867,7 @@ static int init_directories(BDRVVVFATState* s,
     {
 	direntry_t* entry=array_get_next(&(s->directory));
 	entry->attributes=0x28; /* archive | volume label */
-	snprintf(entry->name,11,"QEMU VVFAT");
+	snprintf((char*)entry->name,11,"QEMU VVFAT");
     }
 
     /* Now build FAT, and write back information into directory */
@@ -954,18 +981,22 @@ static int init_directories(BDRVVVFATState* s,
     return 0;
 }
 
+#ifdef DEBUG
 static BDRVVVFATState *vvv = NULL;
+#endif
 
 static int enable_write_target(BDRVVVFATState *s);
 static int is_consistent(BDRVVVFATState *s);
 
-static int vvfat_open(BlockDriverState *bs, const char* dirname)
+static int vvfat_open(BlockDriverState *bs, const char* dirname, int flags)
 {
     BDRVVVFATState *s = bs->opaque;
     int floppy = 0;
     int i;
 
+#ifdef DEBUG
     vvv = s;
+#endif
 
 DLOG(if (stderr == NULL) {
     stderr = fopen("vvfat.log", "a");
@@ -976,10 +1007,9 @@ DLOG(if (stderr == NULL) {
 
     s->fat_type=16;
     /* LATER TODO: if FAT32, adjust */
-    s->sector_count=0xec04f;
     s->sectors_per_cluster=0x10;
-    /* LATER TODO: this could be wrong for FAT32 */
-    bs->cyls=1023; bs->heads=15; bs->secs=63;
+    /* 504MB disk*/
+    bs->cyls=1024; bs->heads=16; bs->secs=63;
 
     s->current_cluster=0xffffffff;
 
@@ -994,12 +1024,6 @@ DLOG(if (stderr == NULL) {
     if (!strstart(dirname, "fat:", NULL))
 	return -1;
 
-    if (strstr(dirname, ":rw:")) {
-	if (enable_write_target(s))
-	    return -1;
-	bs->read_only = 0;
-    }
-
     if (strstr(dirname, ":floppy:")) {
 	floppy = 1;
 	s->fat_type = 12;
@@ -1008,6 +1032,8 @@ DLOG(if (stderr == NULL) {
 	bs->cyls = 80; bs->heads = 2; bs->secs = 36;
     }
 
+    s->sector_count=bs->cyls*bs->heads*bs->secs;
+
     if (strstr(dirname, ":32:")) {
 	fprintf(stderr, "Big fat greek warning: FAT32 has not been tested. You are welcome to do so!\n");
 	s->fat_type = 32;
@@ -1018,6 +1044,12 @@ DLOG(if (stderr == NULL) {
 	s->sector_count=2880;
     }
 
+    if (strstr(dirname, ":rw:")) {
+	if (enable_write_target(s))
+	    return -1;
+	bs->read_only = 0;
+    }
+
     i = strrchr(dirname, ':') - dirname;
     assert(i >= 3);
     if (dirname[i-2] == ':' && isalpha(dirname[i-1]))
@@ -1027,11 +1059,12 @@ DLOG(if (stderr == NULL) {
 	dirname += i+1;
 
     bs->total_sectors=bs->cyls*bs->heads*bs->secs;
-    if (s->sector_count > bs->total_sectors)
-	s->sector_count = bs->total_sectors;
+
     if(init_directories(s, dirname))
 	return -1;
 
+    s->sector_count = s->faked_sectors + s->sectors_per_cluster*s->cluster_count;
+
     if(s->first_sectors_number==0x40)
 	init_mbr(s);
 
@@ -1040,7 +1073,6 @@ DLOG(if (stderr == NULL) {
 	bs->heads = bs->cyls = bs->secs = 0;
 
     //    assert(is_consistent(s));
-
     return 0;
 }
 
@@ -1154,7 +1186,7 @@ static inline int read_cluster(BDRVVVFATState *s,int cluster_num)
 		s->current_mapping = mapping;
 read_cluster_directory:
 		offset = s->cluster_size*(cluster_num-s->current_mapping->begin);
-		s->cluster = s->directory.pointer+offset
+		s->cluster = (unsigned char*)s->directory.pointer+offset
 			+ 0x20*s->current_mapping->info.dir.first_dir_index;
 		assert(((s->cluster-(unsigned char*)s->directory.pointer)%s->cluster_size)==0);
 		assert((char*)s->cluster+s->cluster_size <= s->directory.pointer+s->directory.next*s->directory.item_size);
@@ -1376,7 +1408,12 @@ static void schedule_mkdir(BDRVVVFATState* s, uint32_t cluster, char* path)
 }
 
 typedef struct {
-    unsigned char name[1024];
+    /*
+     * Since the sequence number is at most 0x3f, and the filename
+     * length is at most 13 times the sequence number, the maximal
+     * filename length is 0x3f * 13 bytes.
+     */
+    unsigned char name[0x3f * 13 + 1];
     int checksum, len;
     int sequence_number;
 } long_file_name;
@@ -1401,6 +1438,7 @@ static int parse_long_name(long_file_name* lfn,
 	lfn->sequence_number = pointer[0] & 0x3f;
 	lfn->checksum = pointer[13];
 	lfn->name[0] = 0;
+	lfn->name[lfn->sequence_number * 13] = 0;
     } else if ((pointer[0] & 0x3f) != --lfn->sequence_number)
 	return -1;
     else if (pointer[13] != lfn->checksum)
@@ -1424,7 +1462,7 @@ static int parse_long_name(long_file_name* lfn,
     }
 
     if (pointer[0] & 0x40)
-	lfn->len = offset + strlen(lfn->name + offset);
+	lfn->len = offset + strlen((char*)lfn->name + offset);
 
     return 0;
 }
@@ -1463,7 +1501,7 @@ static int parse_short_name(BDRVVVFATState* s,
     } else
 	lfn->name[i + j + 1] = '\0';
 
-    lfn->len = strlen(lfn->name);
+    lfn->len = strlen((char*)lfn->name);
 
     return 0;
 }
@@ -1695,7 +1733,7 @@ static int check_directory_consistency(BDRVVVFATState *s,
     char path2[PATH_MAX];
 
     assert(path_len < PATH_MAX); /* len was tested before! */
-    strcpy(path2, path);
+    pstrcpy(path2, sizeof(path2), path);
     path2[path_len] = '/';
     path2[path_len + 1] = '\0';
 
@@ -1759,8 +1797,8 @@ DLOG(fprintf(stderr, "check direntry %d: \n", i); print_direntry(direntries + i)
 		    fprintf(stderr, "Error in short name (%d)\n", subret);
 		    goto fail;
 		}
-		if (subret > 0 || !strcmp(lfn.name, ".")
-			|| !strcmp(lfn.name, ".."))
+		if (subret > 0 || !strcmp((char*)lfn.name, ".")
+			|| !strcmp((char*)lfn.name, ".."))
 		    continue;
 	    }
 	    lfn.checksum = 0x100; /* cannot use long name twice */
@@ -1769,7 +1807,8 @@ DLOG(fprintf(stderr, "check direntry %d: \n", i); print_direntry(direntries + i)
 		fprintf(stderr, "Name too long: %s/%s\n", path, lfn.name);
 		goto fail;
 	    }
-	    strcpy(path2 + path_len + 1, lfn.name);
+            pstrcpy(path2 + path_len + 1, sizeof(path2) - path_len - 1,
+                    (char*)lfn.name);
 
 	    if (is_directory(direntries + i)) {
 		if (begin_of_direntry(direntries + i) == 0) {
@@ -2178,7 +2217,7 @@ static int commit_one_file(BDRVVVFATState* s,
     for (i = s->cluster_size; i < offset; i += s->cluster_size)
 	c = modified_fat_get(s, c);
 
-    fd = open(mapping->path, O_BINARY | O_RDWR | O_CREAT, 0666);
+    fd = open(mapping->path, O_RDWR | O_CREAT | O_BINARY, 0666);
     if (fd < 0) {
 	fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
 		strerror(errno), errno);
@@ -2198,10 +2237,9 @@ static int commit_one_file(BDRVVVFATState* s,
 
 	assert((size - offset == 0 && fat_eof(s, c)) ||
 		(size > offset && c >=2 && !fat_eof(s, c)));
-	assert(size >= 0);
 
 	ret = vvfat_read(s->bs, cluster2sector(s, c),
-	    cluster, (rest_size + 0x1ff) / 0x200);
+	    (uint8_t*)cluster, (rest_size + 0x1ff) / 0x200);
 
 	if (ret < 0)
 	    return ret;
@@ -2335,8 +2373,9 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* s)
 
 			    assert(!strncmp(m->path, mapping->path, l2));
 
-			    strcpy(new_path, mapping->path);
-			    strcpy(new_path + l1, m->path + l2);
+                            pstrcpy(new_path, l + diff + 1, mapping->path);
+                            pstrcpy(new_path + l1, l + diff + 1 - l1,
+                                    m->path + l2);
 
 			    schedule_rename(s, m->begin, new_path);
 			}
@@ -2732,8 +2771,7 @@ static int enable_write_target(BDRVVVFATState *s)
     array_init(&(s->commits), sizeof(commit_t));
 
     s->qcow_filename = malloc(1024);
-    strcpy(s->qcow_filename, "/tmp/vl.XXXXXX");
-    get_tmp_filename(s->qcow_filename, strlen(s->qcow_filename) + 1);
+    get_tmp_filename(s->qcow_filename, 1024);
     if (bdrv_create(&bdrv_qcow,
 		s->qcow_filename, s->sector_count, "fat:", 0) < 0)
 	return -1;
@@ -2767,18 +2805,19 @@ static void vvfat_close(BlockDriverState *bs)
 BlockDriver bdrv_vvfat = {
     "vvfat",
     sizeof(BDRVVVFATState),
-    vvfat_probe,
+    NULL, /* no probe for protocols */
     vvfat_open,
     vvfat_read,
     vvfat_write,
     vvfat_close,
     NULL, /* ??? Not sure if we can do any meaningful flushing.  */
     NULL,
-    vvfat_is_allocated
+    vvfat_is_allocated,
+    .protocol_name = "fat",
 };
 
 #ifdef DEBUG
-static void checkpoint() {
+static void checkpoint(void) {
     assert(((mapping_t*)array_get(&(vvv->mapping), 0))->end == 2);
     check1(vvv);
     check2(vvv);
diff --git a/block.c b/block.c
index 3afd3d7..23ce5e4 100644
--- a/block.c
+++ b/block.c
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "console.h"
 #include "block_int.h"
 
 #ifdef _BSD
@@ -32,85 +33,107 @@
 #include <sys/disk.h>
 #endif
 
-#ifdef CONFIG_COCOA
-#include <paths.h>
-#include <sys/param.h>
-#include <IOKit/IOKitLib.h>
-#include <IOKit/IOBSD.h>
-#include <IOKit/storage/IOMediaBSDClient.h>
-#include <IOKit/storage/IOMedia.h>
-#include <IOKit/storage/IOCDMedia.h>
-//#include <IOKit/storage/IOCDTypes.h>
-#include <CoreFoundation/CoreFoundation.h>
-#endif
+#define SECTOR_BITS 9
+#define SECTOR_SIZE (1 << SECTOR_BITS)
 
-#ifdef __sun__
-#include <sys/dkio.h>
-#endif
+typedef struct BlockDriverAIOCBSync {
+    BlockDriverAIOCB common;
+    QEMUBH *bh;
+    int ret;
+} BlockDriverAIOCBSync;
+
+static BlockDriverAIOCB *bdrv_aio_read_em(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque);
+static BlockDriverAIOCB *bdrv_aio_write_em(BlockDriverState *bs,
+        int64_t sector_num, const uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque);
+static void bdrv_aio_cancel_em(BlockDriverAIOCB *acb);
+static int bdrv_read_em(BlockDriverState *bs, int64_t sector_num,
+                        uint8_t *buf, int nb_sectors);
+static int bdrv_write_em(BlockDriverState *bs, int64_t sector_num,
+                         const uint8_t *buf, int nb_sectors);
 
-static BlockDriverState *bdrv_first;
 static BlockDriver *first_drv;
 
-#ifdef CONFIG_COCOA
-static kern_return_t FindEjectableCDMedia( io_iterator_t *mediaIterator );
-static kern_return_t GetBSDPath( io_iterator_t mediaIterator, char *bsdPath, CFIndex maxPathSize );
-
-kern_return_t FindEjectableCDMedia( io_iterator_t *mediaIterator )
+int path_is_absolute(const char *path)
 {
-    kern_return_t       kernResult;
-    mach_port_t     masterPort;
-    CFMutableDictionaryRef  classesToMatch;
-
-    kernResult = IOMasterPort( MACH_PORT_NULL, &masterPort );
-    if ( KERN_SUCCESS != kernResult ) {
-        printf( "IOMasterPort returned %d\n", kernResult );
-    }
-
-    classesToMatch = IOServiceMatching( kIOCDMediaClass );
-    if ( classesToMatch == NULL ) {
-        printf( "IOServiceMatching returned a NULL dictionary.\n" );
-    } else {
-    CFDictionarySetValue( classesToMatch, CFSTR( kIOMediaEjectableKey ), kCFBooleanTrue );
-    }
-    kernResult = IOServiceGetMatchingServices( masterPort, classesToMatch, mediaIterator );
-    if ( KERN_SUCCESS != kernResult )
-    {
-        printf( "IOServiceGetMatchingServices returned %d\n", kernResult );
-    }
-
-    return kernResult;
+    const char *p;
+#ifdef _WIN32
+    /* specific case for names like: "\\.\d:" */
+    if (*path == '/' || *path == '\\')
+        return 1;
+#endif
+    p = strchr(path, ':');
+    if (p)
+        p++;
+    else
+        p = path;
+#ifdef _WIN32
+    return (*p == '/' || *p == '\\');
+#else
+    return (*p == '/');
+#endif
 }
 
-kern_return_t GetBSDPath( io_iterator_t mediaIterator, char *bsdPath, CFIndex maxPathSize )
+/* if filename is absolute, just copy it to dest. Otherwise, build a
+   path to it by considering it is relative to base_path. URL are
+   supported. */
+void path_combine(char *dest, int dest_size,
+                  const char *base_path,
+                  const char *filename)
 {
-    io_object_t     nextMedia;
-    kern_return_t   kernResult = KERN_FAILURE;
-    *bsdPath = '\0';
-    nextMedia = IOIteratorNext( mediaIterator );
-    if ( nextMedia )
-    {
-        CFTypeRef   bsdPathAsCFString;
-    bsdPathAsCFString = IORegistryEntryCreateCFProperty( nextMedia, CFSTR( kIOBSDNameKey ), kCFAllocatorDefault, 0 );
-        if ( bsdPathAsCFString ) {
-            size_t devPathLength;
-            strcpy( bsdPath, _PATH_DEV );
-            strcat( bsdPath, "r" );
-            devPathLength = strlen( bsdPath );
-            if ( CFStringGetCString( bsdPathAsCFString, bsdPath + devPathLength, maxPathSize - devPathLength, kCFStringEncodingASCII ) ) {
-                kernResult = KERN_SUCCESS;
-            }
-            CFRelease( bsdPathAsCFString );
+    const char *p, *p1;
+    int len;
+
+    if (dest_size <= 0)
+        return;
+    if (path_is_absolute(filename)) {
+        pstrcpy(dest, dest_size, filename);
+    } else {
+        p = strchr(base_path, ':');
+        if (p)
+            p++;
+        else
+            p = base_path;
+        p1 = strrchr(base_path, '/');
+#ifdef _WIN32
+        {
+            const char *p2;
+            p2 = strrchr(base_path, '\\');
+            if (!p1 || p2 > p1)
+                p1 = p2;
         }
-        IOObjectRelease( nextMedia );
+#endif
+        if (p1)
+            p1++;
+        else
+            p1 = base_path;
+        if (p1 > p)
+            p = p1;
+        len = p - base_path;
+        if (len > dest_size - 1)
+            len = dest_size - 1;
+        memcpy(dest, base_path, len);
+        dest[len] = '\0';
+        pstrcat(dest, dest_size, filename);
     }
-
-    return kernResult;
 }
 
-#endif
 
-void bdrv_register(BlockDriver *bdrv)
+static void bdrv_register(BlockDriver *bdrv)
 {
+    if (!bdrv->bdrv_aio_read) {
+        /* add AIO emulation layer */
+        bdrv->bdrv_aio_read = bdrv_aio_read_em;
+        bdrv->bdrv_aio_write = bdrv_aio_write_em;
+        bdrv->bdrv_aio_cancel = bdrv_aio_cancel_em;
+        bdrv->aiocb_size = sizeof(BlockDriverAIOCBSync);
+    } else if (!bdrv->bdrv_read && !bdrv->bdrv_pread) {
+        /* add synchronous IO emulation layer */
+        bdrv->bdrv_read = bdrv_read_em;
+        bdrv->bdrv_write = bdrv_write_em;
+    }
     bdrv->next = first_drv;
     first_drv = bdrv;
 }
@@ -156,123 +179,164 @@ int bdrv_create(BlockDriver *drv,
 #ifdef _WIN32
 void get_tmp_filename(char *filename, int size)
 {
-    char* p = strrchr(filename, '/');
-
-    if (p == NULL)
-	return;
+    char temp_dir[MAX_PATH];
 
-    /* XXX: find a better function */
-    tmpnam(p);
-    *p = '/';
+    GetTempPath(MAX_PATH, temp_dir);
+    GetTempFileName(temp_dir, "qem", 0, filename);
 }
 #else
 void get_tmp_filename(char *filename, int size)
 {
     int fd;
+    const char *tmpdir;
     /* XXX: race condition possible */
-    pstrcpy(filename, size, "/tmp/vl.XXXXXX");
+    tmpdir = getenv("TMPDIR");
+    if (!tmpdir)
+        tmpdir = "/tmp";
+    snprintf(filename, size, "%s/vl.XXXXXX", tmpdir);
     fd = mkstemp(filename);
     close(fd);
 }
 #endif
 
+#ifdef _WIN32
+static int is_windows_drive_prefix(const char *filename)
+{
+    return (((filename[0] >= 'a' && filename[0] <= 'z') ||
+             (filename[0] >= 'A' && filename[0] <= 'Z')) &&
+            filename[1] == ':');
+}
+
+static int is_windows_drive(const char *filename)
+{
+    if (is_windows_drive_prefix(filename) &&
+        filename[2] == '\0')
+        return 1;
+    if (strstart(filename, "\\\\.\\", NULL) ||
+        strstart(filename, "//./", NULL))
+        return 1;
+    return 0;
+}
+#endif
+
+static BlockDriver *find_protocol(const char *filename)
+{
+    BlockDriver *drv1;
+    char protocol[128];
+    int len;
+    const char *p;
+
+#ifdef _WIN32
+    if (is_windows_drive(filename) ||
+        is_windows_drive_prefix(filename))
+        return &bdrv_raw;
+#endif
+    p = strchr(filename, ':');
+    if (!p)
+        return &bdrv_raw;
+    len = p - filename;
+    if (len > sizeof(protocol) - 1)
+        len = sizeof(protocol) - 1;
+    memcpy(protocol, filename, len);
+    protocol[len] = '\0';
+    for(drv1 = first_drv; drv1 != NULL; drv1 = drv1->next) {
+        if (drv1->protocol_name &&
+            !strcmp(drv1->protocol_name, protocol))
+            return drv1;
+    }
+    return NULL;
+}
+
 /* XXX: force raw format if block or character device ? It would
    simplify the BSD case */
 static BlockDriver *find_image_format(const char *filename)
 {
-    int fd, ret, score, score_max;
+    int ret, score, score_max;
     BlockDriver *drv1, *drv;
-    uint8_t *buf;
-    size_t bufsize = 1024;
+    uint8_t buf[2048];
+    BlockDriverState *bs;
 
-    fd = open(filename, O_RDONLY | O_BINARY | O_LARGEFILE);
-    if (fd < 0) {
-        buf = NULL;
-        ret = 0;
-    } else {
-#ifdef DIOCGSECTORSIZE
-        {
-            unsigned int sectorsize = 512;
-            if (!ioctl(fd, DIOCGSECTORSIZE, &sectorsize) &&
-                sectorsize > bufsize)
-                bufsize = sectorsize;
-        }
-#endif
-#ifdef CONFIG_COCOA
-        u_int32_t   blockSize = 512;
-        if ( !ioctl( fd, DKIOCGETBLOCKSIZE, &blockSize ) && blockSize > bufsize) {
-            bufsize = blockSize;
+    /* detect host devices. By convention, /dev/cdrom[N] is always
+       recognized as a host CDROM */
+    if (strstart(filename, "/dev/cdrom", NULL))
+        return &bdrv_host_device;
+#ifdef _WIN32
+    if (is_windows_drive(filename))
+        return &bdrv_host_device;
+#else
+    {
+        struct stat st;
+        if (stat(filename, &st) >= 0 &&
+            (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode))) {
+            return &bdrv_host_device;
         }
+    }
 #endif
-        buf = qemu_malloc(bufsize);
-        if (!buf)
-            return NULL;
-        ret = read(fd, buf, bufsize);
-        if (ret < 0) {
-            close(fd);
-            qemu_free(buf);
-            return NULL;
-        }
-        close(fd);
+
+    drv = find_protocol(filename);
+    /* no need to test disk image formats for vvfat */
+    if (drv == &bdrv_vvfat)
+        return drv;
+
+    ret = bdrv_file_open(&bs, filename, BDRV_O_RDONLY);
+    if (ret < 0)
+        return NULL;
+    ret = bdrv_pread(bs, 0, buf, sizeof(buf));
+    bdrv_delete(bs);
+    if (ret < 0) {
+        return NULL;
     }
 
-    drv = NULL;
     score_max = 0;
     for(drv1 = first_drv; drv1 != NULL; drv1 = drv1->next) {
-        score = drv1->bdrv_probe(buf, ret, filename);
-        if (score > score_max) {
-            score_max = score;
-            drv = drv1;
+        if (drv1->bdrv_probe) {
+            score = drv1->bdrv_probe(buf, ret, filename);
+            if (score > score_max) {
+                score_max = score;
+                drv = drv1;
+            }
         }
     }
-    qemu_free(buf);
     return drv;
 }
 
-int bdrv_open(BlockDriverState *bs, const char *filename, int snapshot)
+int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags)
 {
-#ifdef CONFIG_COCOA
-    if ( strncmp( filename, "/dev/cdrom", 10 ) == 0 ) {
-        kern_return_t kernResult;
-        io_iterator_t mediaIterator;
-        char bsdPath[ MAXPATHLEN ];
-        int fd;
-
-        kernResult = FindEjectableCDMedia( &mediaIterator );
-        kernResult = GetBSDPath( mediaIterator, bsdPath, sizeof( bsdPath ) );
-
-        if ( bsdPath[ 0 ] != '\0' ) {
-            strcat(bsdPath,"s0");
-            /* some CDs don't have a partition 0 */
-            fd = open(bsdPath, O_RDONLY | O_BINARY | O_LARGEFILE);
-            if (fd < 0) {
-                bsdPath[strlen(bsdPath)-1] = '1';
-            } else {
-                close(fd);
-            }
-            filename = bsdPath;
-        }
+    BlockDriverState *bs;
+    int ret;
 
-        if ( mediaIterator )
-            IOObjectRelease( mediaIterator );
+    bs = bdrv_new("");
+    if (!bs)
+        return -ENOMEM;
+    ret = bdrv_open2(bs, filename, flags | BDRV_O_FILE, NULL);
+    if (ret < 0) {
+        bdrv_delete(bs);
+        return ret;
     }
-#endif
-    return bdrv_open2(bs, filename, snapshot, NULL);
+    *pbs = bs;
+    return 0;
+}
+
+int bdrv_open(BlockDriverState *bs, const char *filename, int flags)
+{
+    return bdrv_open2(bs, filename, flags, NULL);
 }
 
-int bdrv_open2(BlockDriverState *bs, const char *filename, int snapshot,
+int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
                BlockDriver *drv)
 {
-    int ret;
-    char tmp_filename[1024];
+    int ret, open_flags;
+    char tmp_filename[PATH_MAX];
+    char backing_filename[PATH_MAX];
 
     bs->read_only = 0;
     bs->is_temporary = 0;
     bs->encrypted = 0;
 
-    if (snapshot) {
+    if (flags & BDRV_O_SNAPSHOT) {
         BlockDriverState *bs1;
         int64_t total_size;
+        int is_protocol = 0;
 
         /* if snapshot, we create a temporary backing file and open it
            instead of opening 'filename' directly */
@@ -280,19 +344,30 @@ int bdrv_open2(BlockDriverState *bs, const char *filename, int snapshot,
         /* if there is a backing file, use it */
         bs1 = bdrv_new("");
         if (!bs1) {
-            return -1;
+            return -ENOMEM;
         }
         if (bdrv_open(bs1, filename, 0) < 0) {
             bdrv_delete(bs1);
             return -1;
         }
-        total_size = bs1->total_sectors;
+        total_size = bdrv_getlength(bs1) >> SECTOR_BITS;
+
+        if (bs1->drv && bs1->drv->protocol_name)
+            is_protocol = 1;
+
         bdrv_delete(bs1);
 
         get_tmp_filename(tmp_filename, sizeof(tmp_filename));
-        /* XXX: use cow for linux as it is more efficient ? */
-        if (bdrv_create(&bdrv_qcow, tmp_filename,
-                        total_size, filename, 0) < 0) {
+
+        /* Real path is meaningless for protocols */
+        if (is_protocol)
+            snprintf(backing_filename, sizeof(backing_filename),
+                     "%s", filename);
+        else
+            realpath(filename, backing_filename);
+
+        if (bdrv_create(&bdrv_qcow2, tmp_filename,
+                        total_size, backing_filename, 0) < 0) {
             return -1;
         }
         filename = tmp_filename;
@@ -300,41 +375,62 @@ int bdrv_open2(BlockDriverState *bs, const char *filename, int snapshot,
     }
 
     pstrcpy(bs->filename, sizeof(bs->filename), filename);
-    if (!drv) {
-        drv = find_image_format(filename);
+    if (flags & BDRV_O_FILE) {
+        drv = find_protocol(filename);
         if (!drv)
-            return -1;
+            return -ENOENT;
+    } else {
+        if (!drv) {
+            drv = find_image_format(filename);
+            if (!drv)
+                return -1;
+        }
     }
     bs->drv = drv;
     bs->opaque = qemu_mallocz(drv->instance_size);
     if (bs->opaque == NULL && drv->instance_size > 0)
         return -1;
-
-    ret = drv->bdrv_open(bs, filename);
+    /* Note: for compatibility, we open disk image files as RDWR, and
+       RDONLY as fallback */
+    if (!(flags & BDRV_O_FILE))
+        open_flags = BDRV_O_RDWR | (flags & BDRV_O_DIRECT);
+    else
+        open_flags = flags & ~(BDRV_O_FILE | BDRV_O_SNAPSHOT);
+    ret = drv->bdrv_open(bs, filename, open_flags);
+    if (ret == -EACCES && !(flags & BDRV_O_FILE)) {
+        ret = drv->bdrv_open(bs, filename, BDRV_O_RDONLY);
+        bs->read_only = 1;
+    }
     if (ret < 0) {
         qemu_free(bs->opaque);
-        return -1;
+        bs->opaque = NULL;
+        bs->drv = NULL;
+        return ret;
+    }
+    if (drv->bdrv_getlength) {
+        bs->total_sectors = bdrv_getlength(bs) >> SECTOR_BITS;
     }
 #ifndef _WIN32
     if (bs->is_temporary) {
         unlink(filename);
     }
 #endif
-    if (bs->backing_file[0] != '\0' && drv->bdrv_is_allocated) {
+    if (bs->backing_file[0] != '\0') {
         /* if there is a backing file, use it */
         bs->backing_hd = bdrv_new("");
         if (!bs->backing_hd) {
         fail:
             bdrv_close(bs);
-            return -1;
+            return -ENOMEM;
         }
-        if (bdrv_open(bs->backing_hd, bs->backing_file, 0) < 0)
+        path_combine(backing_filename, sizeof(backing_filename),
+                     filename, bs->backing_file);
+        if (bdrv_open(bs->backing_hd, backing_filename, 0) < 0)
             goto fail;
     }
 
-    bs->inserted = 1;
-
     /* call the change callback */
+    bs->media_changed = 1;
     if (bs->change_cb)
         bs->change_cb(bs->change_opaque);
 
@@ -343,7 +439,7 @@ int bdrv_open2(BlockDriverState *bs, const char *filename, int snapshot,
 
 void bdrv_close(BlockDriverState *bs)
 {
-    if (bs->inserted) {
+    if (bs->drv) {
         if (bs->backing_hd)
             bdrv_delete(bs->backing_hd);
         bs->drv->bdrv_close(bs);
@@ -355,9 +451,9 @@ void bdrv_close(BlockDriverState *bs)
 #endif
         bs->opaque = NULL;
         bs->drv = NULL;
-        bs->inserted = 0;
 
         /* call the change callback */
+        bs->media_changed = 1;
         if (bs->change_cb)
             bs->change_cb(bs->change_opaque);
     }
@@ -365,7 +461,14 @@ void bdrv_close(BlockDriverState *bs)
 
 void bdrv_delete(BlockDriverState *bs)
 {
-    /* XXX: remove the driver list */
+    BlockDriverState **pbs;
+
+    pbs = &bdrv_first;
+    while (*pbs != bs && *pbs != NULL)
+        pbs = &(*pbs)->next;
+    if (*pbs == bs)
+        *pbs = bs->next;
+
     bdrv_close(bs);
     qemu_free(bs);
 }
@@ -373,12 +476,13 @@ void bdrv_delete(BlockDriverState *bs)
 /* commit COW file into the raw image */
 int bdrv_commit(BlockDriverState *bs)
 {
-    int64_t i;
+    BlockDriver *drv = bs->drv;
+    int64_t i, total_sectors;
     int n, j;
     unsigned char sector[512];
 
-    if (!bs->inserted)
-        return -ENOENT;
+    if (!drv)
+        return -ENOMEDIUM;
 
     if (bs->read_only) {
 	return -EACCES;
@@ -388,8 +492,9 @@ int bdrv_commit(BlockDriverState *bs)
 	return -ENOTSUP;
     }
 
-    for (i = 0; i < bs->total_sectors;) {
-        if (bs->drv->bdrv_is_allocated(bs, i, 65536, &n)) {
+    total_sectors = bdrv_getlength(bs) >> SECTOR_BITS;
+    for (i = 0; i < total_sectors;) {
+        if (drv->bdrv_is_allocated(bs, i, 65536, &n)) {
             for(j = 0; j < n; j++) {
                 if (bdrv_read(bs, i, sector, 1) != 0) {
                     return -EIO;
@@ -405,68 +510,242 @@ int bdrv_commit(BlockDriverState *bs)
         }
     }
 
-    if (bs->drv->bdrv_make_empty)
-	return bs->drv->bdrv_make_empty(bs);
+    if (drv->bdrv_make_empty)
+	return drv->bdrv_make_empty(bs);
 
     return 0;
 }
 
-/* return -1 if error */
+/* return < 0 if error. See bdrv_write() for the return codes */
 int bdrv_read(BlockDriverState *bs, int64_t sector_num,
               uint8_t *buf, int nb_sectors)
 {
-    int ret, n;
     BlockDriver *drv = bs->drv;
 
-    if (!bs->inserted)
-        return -1;
+    if (!drv)
+        return -ENOMEDIUM;
 
-    while (nb_sectors > 0) {
-        if (sector_num == 0 && bs->boot_sector_enabled) {
+    if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
             memcpy(buf, bs->boot_sector_data, 512);
-            n = 1;
-        } else if (bs->backing_hd) {
-            if (drv->bdrv_is_allocated(bs, sector_num, nb_sectors, &n)) {
-                ret = drv->bdrv_read(bs, sector_num, buf, n);
-                if (ret < 0)
-                    return -1;
-            } else {
-                /* read from the base image */
-                ret = bdrv_read(bs->backing_hd, sector_num, buf, n);
-                if (ret < 0)
-                    return -1;
-            }
-        } else {
-            ret = drv->bdrv_read(bs, sector_num, buf, nb_sectors);
-            if (ret < 0)
-                return -1;
-            /* no need to loop */
-            break;
-        }
-        nb_sectors -= n;
-        sector_num += n;
-        buf += n * 512;
+        sector_num++;
+        nb_sectors--;
+        buf += 512;
+        if (nb_sectors == 0)
+            return 0;
+    }
+    if (drv->bdrv_pread) {
+        int ret, len;
+        len = nb_sectors * 512;
+        ret = drv->bdrv_pread(bs, sector_num * 512, buf, len);
+        if (ret < 0)
+            return ret;
+        else if (ret != len)
+            return -EINVAL;
+        else {
+	    bs->rd_bytes += (unsigned) len;
+	    bs->rd_ops ++;
+            return 0;
+	}
+    } else {
+        return drv->bdrv_read(bs, sector_num, buf, nb_sectors);
     }
-    return 0;
 }
 
-/* return -1 if error */
+/* Return < 0 if error. Important errors are:
+  -EIO         generic I/O error (may happen for all errors)
+  -ENOMEDIUM   No media inserted.
+  -EINVAL      Invalid sector number or nb_sectors
+  -EACCES      Trying to write a read-only device
+*/
 int bdrv_write(BlockDriverState *bs, int64_t sector_num,
                const uint8_t *buf, int nb_sectors)
 {
-    if (!bs->inserted)
-        return -1;
+    BlockDriver *drv = bs->drv;
+    if (!bs->drv)
+        return -ENOMEDIUM;
     if (bs->read_only)
-        return -1;
+        return -EACCES;
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
         memcpy(bs->boot_sector_data, buf, 512);
     }
-    return bs->drv->bdrv_write(bs, sector_num, buf, nb_sectors);
+    if (drv->bdrv_pwrite) {
+        int ret, len;
+        len = nb_sectors * 512;
+        ret = drv->bdrv_pwrite(bs, sector_num * 512, buf, len);
+        if (ret < 0)
+            return ret;
+        else if (ret != len)
+            return -EIO;
+        else {
+	    bs->wr_bytes += (unsigned) len;
+	    bs->wr_ops ++;
+            return 0;
+	}
+    } else {
+        return drv->bdrv_write(bs, sector_num, buf, nb_sectors);
+    }
+}
+
+static int bdrv_pread_em(BlockDriverState *bs, int64_t offset,
+                         uint8_t *buf, int count1)
+{
+    uint8_t tmp_buf[SECTOR_SIZE];
+    int len, nb_sectors, count;
+    int64_t sector_num;
+
+    count = count1;
+    /* first read to align to sector start */
+    len = (SECTOR_SIZE - offset) & (SECTOR_SIZE - 1);
+    if (len > count)
+        len = count;
+    sector_num = offset >> SECTOR_BITS;
+    if (len > 0) {
+        if (bdrv_read(bs, sector_num, tmp_buf, 1) < 0)
+            return -EIO;
+        memcpy(buf, tmp_buf + (offset & (SECTOR_SIZE - 1)), len);
+        count -= len;
+        if (count == 0)
+            return count1;
+        sector_num++;
+        buf += len;
+    }
+
+    /* read the sectors "in place" */
+    nb_sectors = count >> SECTOR_BITS;
+    if (nb_sectors > 0) {
+        if (bdrv_read(bs, sector_num, buf, nb_sectors) < 0)
+            return -EIO;
+        sector_num += nb_sectors;
+        len = nb_sectors << SECTOR_BITS;
+        buf += len;
+        count -= len;
+    }
+
+    /* add data from the last sector */
+    if (count > 0) {
+        if (bdrv_read(bs, sector_num, tmp_buf, 1) < 0)
+            return -EIO;
+        memcpy(buf, tmp_buf, count);
+    }
+    return count1;
+}
+
+static int bdrv_pwrite_em(BlockDriverState *bs, int64_t offset,
+                          const uint8_t *buf, int count1)
+{
+    uint8_t tmp_buf[SECTOR_SIZE];
+    int len, nb_sectors, count;
+    int64_t sector_num;
+
+    count = count1;
+    /* first write to align to sector start */
+    len = (SECTOR_SIZE - offset) & (SECTOR_SIZE - 1);
+    if (len > count)
+        len = count;
+    sector_num = offset >> SECTOR_BITS;
+    if (len > 0) {
+        if (bdrv_read(bs, sector_num, tmp_buf, 1) < 0)
+            return -EIO;
+        memcpy(tmp_buf + (offset & (SECTOR_SIZE - 1)), buf, len);
+        if (bdrv_write(bs, sector_num, tmp_buf, 1) < 0)
+            return -EIO;
+        count -= len;
+        if (count == 0)
+            return count1;
+        sector_num++;
+        buf += len;
+    }
+
+    /* write the sectors "in place" */
+    nb_sectors = count >> SECTOR_BITS;
+    if (nb_sectors > 0) {
+        if (bdrv_write(bs, sector_num, buf, nb_sectors) < 0)
+            return -EIO;
+        sector_num += nb_sectors;
+        len = nb_sectors << SECTOR_BITS;
+        buf += len;
+        count -= len;
+    }
+
+    /* add data from the last sector */
+    if (count > 0) {
+        if (bdrv_read(bs, sector_num, tmp_buf, 1) < 0)
+            return -EIO;
+        memcpy(tmp_buf, buf, count);
+        if (bdrv_write(bs, sector_num, tmp_buf, 1) < 0)
+            return -EIO;
+    }
+    return count1;
 }
 
-void bdrv_get_geometry(BlockDriverState *bs, int64_t *nb_sectors_ptr)
+/**
+ * Read with byte offsets (needed only for file protocols)
+ */
+int bdrv_pread(BlockDriverState *bs, int64_t offset,
+               void *buf1, int count1)
+{
+    BlockDriver *drv = bs->drv;
+
+    if (!drv)
+        return -ENOMEDIUM;
+    if (!drv->bdrv_pread)
+        return bdrv_pread_em(bs, offset, buf1, count1);
+    return drv->bdrv_pread(bs, offset, buf1, count1);
+}
+
+/**
+ * Write with byte offsets (needed only for file protocols)
+ */
+int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
+                const void *buf1, int count1)
+{
+    BlockDriver *drv = bs->drv;
+
+    if (!drv)
+        return -ENOMEDIUM;
+    if (!drv->bdrv_pwrite)
+        return bdrv_pwrite_em(bs, offset, buf1, count1);
+    return drv->bdrv_pwrite(bs, offset, buf1, count1);
+}
+
+/**
+ * Truncate file to 'offset' bytes (needed only for file protocols)
+ */
+int bdrv_truncate(BlockDriverState *bs, int64_t offset)
+{
+    BlockDriver *drv = bs->drv;
+    if (!drv)
+        return -ENOMEDIUM;
+    if (!drv->bdrv_truncate)
+        return -ENOTSUP;
+    return drv->bdrv_truncate(bs, offset);
+}
+
+/**
+ * Length of a file in bytes. Return < 0 if error or unknown.
+ */
+int64_t bdrv_getlength(BlockDriverState *bs)
+{
+    BlockDriver *drv = bs->drv;
+    if (!drv)
+        return -ENOMEDIUM;
+    if (!drv->bdrv_getlength) {
+        /* legacy mode */
+        return bs->total_sectors * SECTOR_SIZE;
+    }
+    return drv->bdrv_getlength(bs);
+}
+
+/* return 0 as number of sectors if no device present or error */
+void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr)
 {
-    *nb_sectors_ptr = bs->total_sectors;
+    int64_t length;
+    length = bdrv_getlength(bs);
+    if (length < 0)
+        length = 0;
+    else
+        length = length >> SECTOR_BITS;
+    *nb_sectors_ptr = length;
 }
 
 /* force a given boot sector. */
@@ -527,21 +806,12 @@ int bdrv_is_read_only(BlockDriverState *bs)
     return bs->read_only;
 }
 
-int bdrv_is_inserted(BlockDriverState *bs)
-{
-    return bs->inserted;
-}
-
-int bdrv_is_locked(BlockDriverState *bs)
-{
-    return bs->locked;
-}
-
-void bdrv_set_locked(BlockDriverState *bs, int locked)
+int bdrv_is_sg(BlockDriverState *bs)
 {
-    bs->locked = locked;
+    return bs->sg;
 }
 
+/* XXX: no longer used */
 void bdrv_set_change_cb(BlockDriverState *bs,
                         void (*change_cb)(void *opaque), void *opaque)
 {
@@ -573,7 +843,7 @@ int bdrv_set_key(BlockDriverState *bs, const char *key)
 
 void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size)
 {
-    if (!bs->inserted || !bs->drv) {
+    if (!bs->drv) {
         buf[0] = '\0';
     } else {
         pstrcpy(buf, buf_size, bs->drv->format_name);
@@ -623,6 +893,33 @@ void bdrv_flush(BlockDriverState *bs)
         bdrv_flush(bs->backing_hd);
 }
 
+/*
+ * Returns true iff the specified sector is present in the disk image. Drivers
+ * not implementing the functionality are assumed to not support backing files,
+ * hence all their sectors are reported as allocated.
+ *
+ * 'pnum' is set to the number of sectors (including and immediately following
+ * the specified sector) that are known to be in the same
+ * allocated/unallocated state.
+ *
+ * 'nb_sectors' is the max value 'pnum' should be set to.
+ */
+int bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
+	int *pnum)
+{
+    int64_t n;
+    if (!bs->drv->bdrv_is_allocated) {
+        if (sector_num >= bs->total_sectors) {
+            *pnum = 0;
+            return 0;
+        }
+        n = bs->total_sectors - sector_num;
+        *pnum = (n < nb_sectors) ? (n) : (nb_sectors);
+        return 1;
+    }
+    return bs->drv->bdrv_is_allocated(bs, sector_num, nb_sectors, pnum);
+}
+
 void bdrv_info(void)
 {
     BlockDriverState *bs;
@@ -645,10 +942,13 @@ void bdrv_info(void)
         if (bs->removable) {
             term_printf(" locked=%d", bs->locked);
         }
-        if (bs->inserted) {
-            term_printf(" file=%s", bs->filename);
-            if (bs->backing_file[0] != '\0')
-                term_printf(" backing_file=%s", bs->backing_file);
+        if (bs->drv) {
+            term_printf(" file=");
+	    term_print_filename(bs->filename);
+            if (bs->backing_file[0] != '\0') {
+                term_printf(" backing_file=");
+		term_print_filename(bs->backing_file);
+	    }
             term_printf(" ro=%d", bs->read_only);
             term_printf(" drv=%s", bs->drv->format_name);
             if (bs->encrypted)
@@ -660,192 +960,474 @@ void bdrv_info(void)
     }
 }
 
+/* The "info blockstats" command. */
+void bdrv_info_stats (void)
+{
+    BlockDriverState *bs;
+
+    for (bs = bdrv_first; bs != NULL; bs = bs->next) {
+	term_printf ("%s:"
+		     " rd_bytes=%" PRIu64
+		     " wr_bytes=%" PRIu64
+		     " rd_operations=%" PRIu64
+		     " wr_operations=%" PRIu64
+		     "\n",
+		     bs->device_name,
+		     bs->rd_bytes, bs->wr_bytes,
+		     bs->rd_ops, bs->wr_ops);
+    }
+}
+
+void bdrv_get_backing_filename(BlockDriverState *bs,
+                               char *filename, int filename_size)
+{
+    if (!bs->backing_hd) {
+        pstrcpy(filename, filename_size, "");
+    } else {
+        pstrcpy(filename, filename_size, bs->backing_file);
+    }
+}
+
+int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
+                          const uint8_t *buf, int nb_sectors)
+{
+    BlockDriver *drv = bs->drv;
+    if (!drv)
+        return -ENOMEDIUM;
+    if (!drv->bdrv_write_compressed)
+        return -ENOTSUP;
+    return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
+}
+
+int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
+{
+    BlockDriver *drv = bs->drv;
+    if (!drv)
+        return -ENOMEDIUM;
+    if (!drv->bdrv_get_info)
+        return -ENOTSUP;
+    memset(bdi, 0, sizeof(*bdi));
+    return drv->bdrv_get_info(bs, bdi);
+}
+
 /**************************************************************/
-/* RAW block driver */
+/* handling of snapshots */
 
-typedef struct BDRVRawState {
-    int fd;
-} BDRVRawState;
+int bdrv_snapshot_create(BlockDriverState *bs,
+                         QEMUSnapshotInfo *sn_info)
+{
+    BlockDriver *drv = bs->drv;
+    if (!drv)
+        return -ENOMEDIUM;
+    if (!drv->bdrv_snapshot_create)
+        return -ENOTSUP;
+    return drv->bdrv_snapshot_create(bs, sn_info);
+}
 
-static int raw_probe(const uint8_t *buf, int buf_size, const char *filename)
+int bdrv_snapshot_goto(BlockDriverState *bs,
+                       const char *snapshot_id)
 {
-    return 1; /* maybe */
+    BlockDriver *drv = bs->drv;
+    if (!drv)
+        return -ENOMEDIUM;
+    if (!drv->bdrv_snapshot_goto)
+        return -ENOTSUP;
+    return drv->bdrv_snapshot_goto(bs, snapshot_id);
 }
 
-static int raw_open(BlockDriverState *bs, const char *filename)
+int bdrv_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
 {
-    BDRVRawState *s = bs->opaque;
-    int fd;
-    int64_t size;
-#ifdef _BSD
-    struct stat sb;
-#endif
-#ifdef __sun__
-    struct dk_minfo minfo;
-    int rv;
-#endif
+    BlockDriver *drv = bs->drv;
+    if (!drv)
+        return -ENOMEDIUM;
+    if (!drv->bdrv_snapshot_delete)
+        return -ENOTSUP;
+    return drv->bdrv_snapshot_delete(bs, snapshot_id);
+}
 
-    fd = open(filename, O_RDWR | O_BINARY | O_LARGEFILE);
-    if (fd < 0) {
-        fd = open(filename, O_RDONLY | O_BINARY | O_LARGEFILE);
-        if (fd < 0)
-            return -1;
-        bs->read_only = 1;
+int bdrv_snapshot_list(BlockDriverState *bs,
+                       QEMUSnapshotInfo **psn_info)
+{
+    BlockDriver *drv = bs->drv;
+    if (!drv)
+        return -ENOMEDIUM;
+    if (!drv->bdrv_snapshot_list)
+        return -ENOTSUP;
+    return drv->bdrv_snapshot_list(bs, psn_info);
+}
+
+#define NB_SUFFIXES 4
+
+char *get_human_readable_size(char *buf, int buf_size, int64_t size)
+{
+    static const char suffixes[NB_SUFFIXES] = "KMGT";
+    int64_t base;
+    int i;
+
+    if (size <= 999) {
+        snprintf(buf, buf_size, "%" PRId64, size);
+    } else {
+        base = 1024;
+        for(i = 0; i < NB_SUFFIXES; i++) {
+            if (size < (10 * base)) {
+                snprintf(buf, buf_size, "%0.1f%c",
+                         (double)size / base,
+                         suffixes[i]);
+                break;
+            } else if (size < (1000 * base) || i == (NB_SUFFIXES - 1)) {
+                snprintf(buf, buf_size, "%" PRId64 "%c",
+                         ((size + (base >> 1)) / base),
+                         suffixes[i]);
+                break;
+            }
+            base = base * 1024;
+        }
     }
-#ifdef _BSD
-    if (!fstat(fd, &sb) && (S_IFCHR & sb.st_mode)) {
-#ifdef DIOCGMEDIASIZE
-	if (ioctl(fd, DIOCGMEDIASIZE, (off_t *)&size))
-#endif
-#ifdef CONFIG_COCOA
-        size = LONG_LONG_MAX;
+    return buf;
+}
+
+char *bdrv_snapshot_dump(char *buf, int buf_size, QEMUSnapshotInfo *sn)
+{
+    char buf1[128], date_buf[128], clock_buf[128];
+#ifdef _WIN32
+    struct tm *ptm;
 #else
-        size = lseek(fd, 0LL, SEEK_END);
+    struct tm tm;
 #endif
-    } else
-#endif
-#ifdef __sun__
-    /*
-     * use the DKIOCGMEDIAINFO ioctl to read the size.
-     */
-    rv = ioctl ( fd, DKIOCGMEDIAINFO, &minfo );
-    if ( rv != -1 ) {
-        size = minfo.dki_lbsize * minfo.dki_capacity;
-    } else /* there are reports that lseek on some devices
-              fails, but irc discussion said that contingency
-              on contingency was overkill */
-#endif
-    {
-        size = lseek(fd, 0, SEEK_END);
-    }
+    time_t ti;
+    int64_t secs;
+
+    if (!sn) {
+        snprintf(buf, buf_size,
+                 "%-10s%-20s%7s%20s%15s",
+                 "ID", "TAG", "VM SIZE", "DATE", "VM CLOCK");
+    } else {
+        ti = sn->date_sec;
 #ifdef _WIN32
-    /* On Windows hosts it can happen that we're unable to get file size
-       for CD-ROM raw device (it's inherent limitation of the CDFS driver). */
-    if (size == -1)
-        size = LONG_LONG_MAX;
+        ptm = localtime(&ti);
+        strftime(date_buf, sizeof(date_buf),
+                 "%Y-%m-%d %H:%M:%S", ptm);
+#else
+        localtime_r(&ti, &tm);
+        strftime(date_buf, sizeof(date_buf),
+                 "%Y-%m-%d %H:%M:%S", &tm);
 #endif
-    bs->total_sectors = size / 512;
-    s->fd = fd;
-    return 0;
+        secs = sn->vm_clock_nsec / 1000000000;
+        snprintf(clock_buf, sizeof(clock_buf),
+                 "%02d:%02d:%02d.%03d",
+                 (int)(secs / 3600),
+                 (int)((secs / 60) % 60),
+                 (int)(secs % 60),
+                 (int)((sn->vm_clock_nsec / 1000000) % 1000));
+        snprintf(buf, buf_size,
+                 "%-10s%-20s%7s%20s%15s",
+                 sn->id_str, sn->name,
+                 get_human_readable_size(buf1, sizeof(buf1), sn->vm_state_size),
+                 date_buf,
+                 clock_buf);
+    }
+    return buf;
 }
 
-static int raw_read(BlockDriverState *bs, int64_t sector_num,
-                    uint8_t *buf, int nb_sectors)
+
+/**************************************************************/
+/* async I/Os */
+
+BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num,
+                                uint8_t *buf, int nb_sectors,
+                                BlockDriverCompletionFunc *cb, void *opaque)
 {
-    BDRVRawState *s = bs->opaque;
-    int ret;
+    BlockDriver *drv = bs->drv;
+    BlockDriverAIOCB *ret;
 
-    lseek(s->fd, sector_num * 512, SEEK_SET);
-    ret = read(s->fd, buf, nb_sectors * 512);
-    if (ret != nb_sectors * 512)
-        return -1;
-    return 0;
+    if (!drv)
+        return NULL;
+
+    /* XXX: we assume that nb_sectors == 0 is suppored by the async read */
+    if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+        memcpy(buf, bs->boot_sector_data, 512);
+        sector_num++;
+        nb_sectors--;
+        buf += 512;
+    }
+
+    ret = drv->bdrv_aio_read(bs, sector_num, buf, nb_sectors, cb, opaque);
+
+    if (ret) {
+	/* Update stats even though technically transfer has not happened. */
+	bs->rd_bytes += (unsigned) nb_sectors * SECTOR_SIZE;
+	bs->rd_ops ++;
+    }
+
+    return ret;
 }
 
-static int raw_write(BlockDriverState *bs, int64_t sector_num,
-                     const uint8_t *buf, int nb_sectors)
+BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,
+                                 const uint8_t *buf, int nb_sectors,
+                                 BlockDriverCompletionFunc *cb, void *opaque)
 {
-    BDRVRawState *s = bs->opaque;
-    int ret;
+    BlockDriver *drv = bs->drv;
+    BlockDriverAIOCB *ret;
 
-    lseek(s->fd, sector_num * 512, SEEK_SET);
-    ret = write(s->fd, buf, nb_sectors * 512);
-    if (ret != nb_sectors * 512)
-        return -1;
-    return 0;
+    if (!drv)
+        return NULL;
+    if (bs->read_only)
+        return NULL;
+    if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+        memcpy(bs->boot_sector_data, buf, 512);
+    }
+
+    ret = drv->bdrv_aio_write(bs, sector_num, buf, nb_sectors, cb, opaque);
+
+    if (ret) {
+	/* Update stats even though technically transfer has not happened. */
+	bs->wr_bytes += (unsigned) nb_sectors * SECTOR_SIZE;
+	bs->wr_ops ++;
+    }
+
+    return ret;
 }
 
-static void raw_close(BlockDriverState *bs)
+void bdrv_aio_cancel(BlockDriverAIOCB *acb)
 {
-    BDRVRawState *s = bs->opaque;
-    close(s->fd);
+    BlockDriver *drv = acb->bs->drv;
+
+    drv->bdrv_aio_cancel(acb);
 }
 
-#ifdef _WIN32
-#include <windows.h>
-#include <winioctl.h>
 
-int qemu_ftruncate64(int fd, int64_t length)
-{
-    LARGE_INTEGER li;
-    LONG high;
-    HANDLE h;
-    BOOL res;
+/**************************************************************/
+/* async block device emulation */
 
-    if ((GetVersion() & 0x80000000UL) && (length >> 32) != 0)
-	return -1;
+static void bdrv_aio_bh_cb(void *opaque)
+{
+    BlockDriverAIOCBSync *acb = opaque;
+    acb->common.cb(acb->common.opaque, acb->ret);
+    qemu_aio_release(acb);
+}
 
-    h = (HANDLE)_get_osfhandle(fd);
+static BlockDriverAIOCB *bdrv_aio_read_em(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BlockDriverAIOCBSync *acb;
+    int ret;
 
-    /* get current position, ftruncate do not change position */
-    li.HighPart = 0;
-    li.LowPart = SetFilePointer (h, 0, &li.HighPart, FILE_CURRENT);
-    if (li.LowPart == 0xffffffffUL && GetLastError() != NO_ERROR)
-	return -1;
+    acb = qemu_aio_get(bs, cb, opaque);
+    if (!acb->bh)
+        acb->bh = qemu_bh_new(bdrv_aio_bh_cb, acb);
+    ret = bdrv_read(bs, sector_num, buf, nb_sectors);
+    acb->ret = ret;
+    qemu_bh_schedule(acb->bh);
+    return &acb->common;
+}
 
-    high = length >> 32;
-    if (!SetFilePointer(h, (DWORD) length, &high, FILE_BEGIN))
-	return -1;
-    res = SetEndOfFile(h);
+static BlockDriverAIOCB *bdrv_aio_write_em(BlockDriverState *bs,
+        int64_t sector_num, const uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BlockDriverAIOCBSync *acb;
+    int ret;
 
-    /* back to old position */
-    SetFilePointer(h, li.LowPart, &li.HighPart, FILE_BEGIN);
-    return res ? 0 : -1;
+    acb = qemu_aio_get(bs, cb, opaque);
+    if (!acb->bh)
+        acb->bh = qemu_bh_new(bdrv_aio_bh_cb, acb);
+    ret = bdrv_write(bs, sector_num, buf, nb_sectors);
+    acb->ret = ret;
+    qemu_bh_schedule(acb->bh);
+    return &acb->common;
 }
 
-static int set_sparse(int fd)
+static void bdrv_aio_cancel_em(BlockDriverAIOCB *blockacb)
 {
-    DWORD returned;
-    return (int) DeviceIoControl((HANDLE)_get_osfhandle(fd), FSCTL_SET_SPARSE,
-				 NULL, 0, NULL, 0, &returned, NULL);
+    BlockDriverAIOCBSync *acb = (BlockDriverAIOCBSync *)blockacb;
+    qemu_bh_cancel(acb->bh);
+    qemu_aio_release(acb);
 }
-#else
-static inline int set_sparse(int fd)
+
+/**************************************************************/
+/* sync block device emulation */
+
+static void bdrv_rw_em_cb(void *opaque, int ret)
 {
-    return 1;
+    *(int *)opaque = ret;
 }
-#endif
 
-static int raw_create(const char *filename, int64_t total_size,
-                      const char *backing_file, int flags)
+#define NOT_DONE 0x7fffffff
+
+static int bdrv_read_em(BlockDriverState *bs, int64_t sector_num,
+                        uint8_t *buf, int nb_sectors)
 {
-    int fd;
+    int async_ret;
+    BlockDriverAIOCB *acb;
 
-    if (flags || backing_file)
-        return -ENOTSUP;
+    async_ret = NOT_DONE;
+    acb = bdrv_aio_read(bs, sector_num, buf, nb_sectors,
+                        bdrv_rw_em_cb, &async_ret);
+    if (acb == NULL)
+        return -1;
 
-    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE,
-              0644);
-    if (fd < 0)
-        return -EIO;
-    set_sparse(fd);
-    ftruncate(fd, total_size * 512);
-    close(fd);
-    return 0;
+    while (async_ret == NOT_DONE) {
+        qemu_aio_wait();
+    }
+
+    return async_ret;
 }
 
-static void raw_flush(BlockDriverState *bs)
+static int bdrv_write_em(BlockDriverState *bs, int64_t sector_num,
+                         const uint8_t *buf, int nb_sectors)
 {
-    BDRVRawState *s = bs->opaque;
-    fsync(s->fd);
-}
+    int async_ret;
+    BlockDriverAIOCB *acb;
 
-BlockDriver bdrv_raw = {
-    "raw",
-    sizeof(BDRVRawState),
-    raw_probe,
-    raw_open,
-    raw_read,
-    raw_write,
-    raw_close,
-    raw_create,
-    raw_flush,
-};
+    async_ret = NOT_DONE;
+    acb = bdrv_aio_write(bs, sector_num, buf, nb_sectors,
+                         bdrv_rw_em_cb, &async_ret);
+    if (acb == NULL)
+        return -1;
+    while (async_ret == NOT_DONE) {
+        qemu_aio_wait();
+    }
+    return async_ret;
+}
 
 void bdrv_init(void)
 {
     bdrv_register(&bdrv_raw);
-    bdrv_register(&bdrv_cloop);
+    bdrv_register(&bdrv_host_device);
+#ifndef _WIN32
+    bdrv_register(&bdrv_cow);
+#endif
     bdrv_register(&bdrv_qcow);
+#if 0
+    bdrv_register(&bdrv_vmdk);
+#endif
+    bdrv_register(&bdrv_cloop);
     bdrv_register(&bdrv_dmg);
+#if 0
+    bdrv_register(&bdrv_bochs);
+    bdrv_register(&bdrv_vpc);
+#endif
+    bdrv_register(&bdrv_vvfat);
+#if 0
+    bdrv_register(&bdrv_qcow2);
+    bdrv_register(&bdrv_parallels);
+    bdrv_register(&bdrv_nbd);
+#endif
+    qemu_aio_init();
+}
+
+void *qemu_aio_get(BlockDriverState *bs, BlockDriverCompletionFunc *cb,
+                   void *opaque)
+{
+    BlockDriver *drv;
+    BlockDriverAIOCB *acb;
+
+    drv = bs->drv;
+    if (drv->free_aiocb) {
+        acb = drv->free_aiocb;
+        drv->free_aiocb = acb->next;
+    } else {
+        acb = qemu_mallocz(drv->aiocb_size);
+        if (!acb)
+            return NULL;
+    }
+    acb->bs = bs;
+    acb->cb = cb;
+    acb->opaque = opaque;
+    return acb;
+}
+
+void qemu_aio_release(void *p)
+{
+    BlockDriverAIOCB *acb = p;
+    BlockDriver *drv = acb->bs->drv;
+    acb->next = drv->free_aiocb;
+    drv->free_aiocb = acb;
+}
+
+/**************************************************************/
+/* removable device support */
+
+/**
+ * Return TRUE if the media is present
+ */
+int bdrv_is_inserted(BlockDriverState *bs)
+{
+    BlockDriver *drv = bs->drv;
+    int ret;
+    if (!drv)
+        return 0;
+    if (!drv->bdrv_is_inserted)
+        return 1;
+    ret = drv->bdrv_is_inserted(bs);
+    return ret;
+}
+
+/**
+ * Return TRUE if the media changed since the last call to this
+ * function. It is currently only used for floppy disks
+ */
+int bdrv_media_changed(BlockDriverState *bs)
+{
+    BlockDriver *drv = bs->drv;
+    int ret;
+
+    if (!drv || !drv->bdrv_media_changed)
+        ret = -ENOTSUP;
+    else
+        ret = drv->bdrv_media_changed(bs);
+    if (ret == -ENOTSUP)
+        ret = bs->media_changed;
+    bs->media_changed = 0;
+    return ret;
+}
+
+/**
+ * If eject_flag is TRUE, eject the media. Otherwise, close the tray
+ */
+void bdrv_eject(BlockDriverState *bs, int eject_flag)
+{
+    BlockDriver *drv = bs->drv;
+    int ret;
+
+    if (!drv || !drv->bdrv_eject) {
+        ret = -ENOTSUP;
+    } else {
+        ret = drv->bdrv_eject(bs, eject_flag);
+    }
+    if (ret == -ENOTSUP) {
+        if (eject_flag)
+            bdrv_close(bs);
+    }
+}
+
+int bdrv_is_locked(BlockDriverState *bs)
+{
+    return bs->locked;
+}
+
+/**
+ * Lock or unlock the media (if it is locked, the user won't be able
+ * to eject it manually).
+ */
+void bdrv_set_locked(BlockDriverState *bs, int locked)
+{
+    BlockDriver *drv = bs->drv;
+
+    bs->locked = locked;
+    if (drv && drv->bdrv_set_locked) {
+        drv->bdrv_set_locked(bs, locked);
+    }
+}
+
+/* needed for generic scsi interface */
+
+int bdrv_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+{
+    BlockDriver *drv = bs->drv;
+
+    if (drv && drv->bdrv_ioctl)
+        return drv->bdrv_ioctl(bs, req, buf);
+    return -ENOTSUP;
 }
diff --git a/block.h b/block.h
new file mode 100644
index 0000000..d774a2e
--- /dev/null
+++ b/block.h
@@ -0,0 +1,158 @@
+#ifndef BLOCK_H
+#define BLOCK_H
+
+/* block.c */
+typedef struct BlockDriver BlockDriver;
+
+extern BlockDriver bdrv_raw;
+extern BlockDriver bdrv_host_device;
+extern BlockDriver bdrv_cow;
+extern BlockDriver bdrv_qcow;
+extern BlockDriver bdrv_vmdk;
+extern BlockDriver bdrv_cloop;
+extern BlockDriver bdrv_dmg;
+extern BlockDriver bdrv_bochs;
+extern BlockDriver bdrv_vpc;
+extern BlockDriver bdrv_vvfat;
+extern BlockDriver bdrv_qcow2;
+extern BlockDriver bdrv_parallels;
+extern BlockDriver bdrv_nbd;
+
+typedef struct BlockDriverInfo {
+    /* in bytes, 0 if irrelevant */
+    int cluster_size;
+    /* offset at which the VM state can be saved (0 if not possible) */
+    int64_t vm_state_offset;
+} BlockDriverInfo;
+
+typedef struct QEMUSnapshotInfo {
+    char id_str[128]; /* unique snapshot id */
+    /* the following fields are informative. They are not needed for
+       the consistency of the snapshot */
+    char name[256]; /* user choosen name */
+    uint32_t vm_state_size; /* VM state info size */
+    uint32_t date_sec; /* UTC date of the snapshot */
+    uint32_t date_nsec;
+    uint64_t vm_clock_nsec; /* VM clock relative to boot */
+} QEMUSnapshotInfo;
+
+#define BDRV_O_RDONLY      0x0000
+#define BDRV_O_RDWR        0x0002
+#define BDRV_O_ACCESS      0x0003
+#define BDRV_O_CREAT       0x0004 /* create an empty file */
+#define BDRV_O_SNAPSHOT    0x0008 /* open the file read only and save writes in a snapshot */
+#define BDRV_O_FILE        0x0010 /* open as a raw file (do not try to
+                                     use a disk image format on top of
+                                     it (default for
+                                     bdrv_file_open()) */
+#define BDRV_O_DIRECT      0x0020
+
+void bdrv_info(void);
+void bdrv_info_stats(void);
+
+void bdrv_init(void);
+BlockDriver *bdrv_find_format(const char *format_name);
+int bdrv_create(BlockDriver *drv,
+                const char *filename, int64_t size_in_sectors,
+                const char *backing_file, int flags);
+BlockDriverState *bdrv_new(const char *device_name);
+void bdrv_delete(BlockDriverState *bs);
+int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags);
+int bdrv_open(BlockDriverState *bs, const char *filename, int flags);
+int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
+               BlockDriver *drv);
+void bdrv_close(BlockDriverState *bs);
+int bdrv_read(BlockDriverState *bs, int64_t sector_num,
+              uint8_t *buf, int nb_sectors);
+int bdrv_write(BlockDriverState *bs, int64_t sector_num,
+               const uint8_t *buf, int nb_sectors);
+int bdrv_pread(BlockDriverState *bs, int64_t offset,
+               void *buf, int count);
+int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
+                const void *buf, int count);
+int bdrv_truncate(BlockDriverState *bs, int64_t offset);
+int64_t bdrv_getlength(BlockDriverState *bs);
+void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
+int bdrv_commit(BlockDriverState *bs);
+void bdrv_set_boot_sector(BlockDriverState *bs, const uint8_t *data, int size);
+/* async block I/O */
+typedef struct BlockDriverAIOCB BlockDriverAIOCB;
+typedef void BlockDriverCompletionFunc(void *opaque, int ret);
+
+BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num,
+                                uint8_t *buf, int nb_sectors,
+                                BlockDriverCompletionFunc *cb, void *opaque);
+BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,
+                                 const uint8_t *buf, int nb_sectors,
+                                 BlockDriverCompletionFunc *cb, void *opaque);
+void bdrv_aio_cancel(BlockDriverAIOCB *acb);
+
+void qemu_aio_init(void);
+void qemu_aio_flush(void);
+void qemu_aio_wait(void);
+
+int qemu_key_check(BlockDriverState *bs, const char *name);
+
+/* Ensure contents are flushed to disk.  */
+void bdrv_flush(BlockDriverState *bs);
+int bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
+	int *pnum);
+
+#define BDRV_TYPE_HD     0
+#define BDRV_TYPE_CDROM  1
+#define BDRV_TYPE_FLOPPY 2
+#define BIOS_ATA_TRANSLATION_AUTO   0
+#define BIOS_ATA_TRANSLATION_NONE   1
+#define BIOS_ATA_TRANSLATION_LBA    2
+#define BIOS_ATA_TRANSLATION_LARGE  3
+#define BIOS_ATA_TRANSLATION_RECHS  4
+
+void bdrv_set_geometry_hint(BlockDriverState *bs,
+                            int cyls, int heads, int secs);
+void bdrv_set_type_hint(BlockDriverState *bs, int type);
+void bdrv_set_translation_hint(BlockDriverState *bs, int translation);
+void bdrv_get_geometry_hint(BlockDriverState *bs,
+                            int *pcyls, int *pheads, int *psecs);
+int bdrv_get_type_hint(BlockDriverState *bs);
+int bdrv_get_translation_hint(BlockDriverState *bs);
+int bdrv_is_removable(BlockDriverState *bs);
+int bdrv_is_read_only(BlockDriverState *bs);
+int bdrv_is_sg(BlockDriverState *bs);
+int bdrv_is_inserted(BlockDriverState *bs);
+int bdrv_media_changed(BlockDriverState *bs);
+int bdrv_is_locked(BlockDriverState *bs);
+void bdrv_set_locked(BlockDriverState *bs, int locked);
+void bdrv_eject(BlockDriverState *bs, int eject_flag);
+void bdrv_set_change_cb(BlockDriverState *bs,
+                        void (*change_cb)(void *opaque), void *opaque);
+void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
+BlockDriverState *bdrv_find(const char *name);
+void bdrv_iterate(void (*it)(void *opaque, const char *name), void *opaque);
+int bdrv_is_encrypted(BlockDriverState *bs);
+int bdrv_set_key(BlockDriverState *bs, const char *key);
+void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
+                         void *opaque);
+const char *bdrv_get_device_name(BlockDriverState *bs);
+int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
+                          const uint8_t *buf, int nb_sectors);
+int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi);
+
+void bdrv_get_backing_filename(BlockDriverState *bs,
+                               char *filename, int filename_size);
+int bdrv_snapshot_create(BlockDriverState *bs,
+                         QEMUSnapshotInfo *sn_info);
+int bdrv_snapshot_goto(BlockDriverState *bs,
+                       const char *snapshot_id);
+int bdrv_snapshot_delete(BlockDriverState *bs, const char *snapshot_id);
+int bdrv_snapshot_list(BlockDriverState *bs,
+                       QEMUSnapshotInfo **psn_info);
+char *bdrv_snapshot_dump(char *buf, int buf_size, QEMUSnapshotInfo *sn);
+int bdrv_ioctl(BlockDriverState *bs, unsigned long int req, void *buf);
+
+char *get_human_readable_size(char *buf, int buf_size, int64_t size);
+int path_is_absolute(const char *path);
+void path_combine(char *dest, int dest_size,
+                  const char *base_path,
+                  const char *filename);
+
+#endif
diff --git a/block_int.h b/block_int.h
index c2a2e30..137000e 100644
--- a/block_int.h
+++ b/block_int.h
@@ -1,8 +1,8 @@
 /*
  * QEMU System Emulator block driver
- * 
+ *
  * Copyright (c) 2003 Fabrice Bellard
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -24,38 +24,84 @@
 #ifndef BLOCK_INT_H
 #define BLOCK_INT_H
 
+#include "block.h"
+
+#define BLOCK_FLAG_ENCRYPT	1
+#define BLOCK_FLAG_COMPRESS	2
+#define BLOCK_FLAG_COMPAT6	4
+
 struct BlockDriver {
     const char *format_name;
     int instance_size;
     int (*bdrv_probe)(const uint8_t *buf, int buf_size, const char *filename);
-    int (*bdrv_open)(BlockDriverState *bs, const char *filename);
-    int (*bdrv_read)(BlockDriverState *bs, int64_t sector_num, 
+    int (*bdrv_open)(BlockDriverState *bs, const char *filename, int flags);
+    int (*bdrv_read)(BlockDriverState *bs, int64_t sector_num,
                      uint8_t *buf, int nb_sectors);
-    int (*bdrv_write)(BlockDriverState *bs, int64_t sector_num, 
+    int (*bdrv_write)(BlockDriverState *bs, int64_t sector_num,
                       const uint8_t *buf, int nb_sectors);
     void (*bdrv_close)(BlockDriverState *bs);
-    int (*bdrv_create)(const char *filename, int64_t total_sectors, 
+    int (*bdrv_create)(const char *filename, int64_t total_sectors,
                        const char *backing_file, int flags);
     void (*bdrv_flush)(BlockDriverState *bs);
     int (*bdrv_is_allocated)(BlockDriverState *bs, int64_t sector_num,
                              int nb_sectors, int *pnum);
     int (*bdrv_set_key)(BlockDriverState *bs, const char *key);
     int (*bdrv_make_empty)(BlockDriverState *bs);
+    /* aio */
+    BlockDriverAIOCB *(*bdrv_aio_read)(BlockDriverState *bs,
+        int64_t sector_num, uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque);
+    BlockDriverAIOCB *(*bdrv_aio_write)(BlockDriverState *bs,
+        int64_t sector_num, const uint8_t *buf, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque);
+    void (*bdrv_aio_cancel)(BlockDriverAIOCB *acb);
+    int aiocb_size;
+
+    const char *protocol_name;
+    int (*bdrv_pread)(BlockDriverState *bs, int64_t offset,
+                      uint8_t *buf, int count);
+    int (*bdrv_pwrite)(BlockDriverState *bs, int64_t offset,
+                       const uint8_t *buf, int count);
+    int (*bdrv_truncate)(BlockDriverState *bs, int64_t offset);
+    int64_t (*bdrv_getlength)(BlockDriverState *bs);
+    int (*bdrv_write_compressed)(BlockDriverState *bs, int64_t sector_num,
+                                 const uint8_t *buf, int nb_sectors);
+
+    int (*bdrv_snapshot_create)(BlockDriverState *bs,
+                                QEMUSnapshotInfo *sn_info);
+    int (*bdrv_snapshot_goto)(BlockDriverState *bs,
+                              const char *snapshot_id);
+    int (*bdrv_snapshot_delete)(BlockDriverState *bs, const char *snapshot_id);
+    int (*bdrv_snapshot_list)(BlockDriverState *bs,
+                              QEMUSnapshotInfo **psn_info);
+    int (*bdrv_get_info)(BlockDriverState *bs, BlockDriverInfo *bdi);
+
+    /* removable device specific */
+    int (*bdrv_is_inserted)(BlockDriverState *bs);
+    int (*bdrv_media_changed)(BlockDriverState *bs);
+    int (*bdrv_eject)(BlockDriverState *bs, int eject_flag);
+    int (*bdrv_set_locked)(BlockDriverState *bs, int locked);
+
+    /* to control generic scsi devices */
+    int (*bdrv_ioctl)(BlockDriverState *bs, unsigned long int req, void *buf);
+
+    BlockDriverAIOCB *free_aiocb;
     struct BlockDriver *next;
 };
 
 struct BlockDriverState {
-    int64_t total_sectors;
+    int64_t total_sectors; /* if we are reading a disk image, give its
+                              size in sectors */
     int read_only; /* if true, the media is read only */
-    int inserted; /* if true, the media is present */
     int removable; /* if true, the media can be removed */
     int locked;    /* if true, the media cannot temporarily be ejected */
     int encrypted; /* if true, the media is encrypted */
+    int sg;        /* if true, the device is a /dev/sg* */
     /* event callback when inserting/removing */
     void (*change_cb)(void *opaque);
     void *change_opaque;
 
-    BlockDriver *drv;
+    BlockDriver *drv; /* NULL means no media */
     void *opaque;
 
     int boot_sector_enabled;
@@ -65,9 +111,19 @@ struct BlockDriverState {
     char backing_file[1024]; /* if non zero, the image is a diff of
                                 this file image */
     int is_temporary;
-    
+    int media_changed;
+
     BlockDriverState *backing_hd;
-    
+    /* async read/write emulation */
+
+    void *sync_aiocb;
+
+    /* I/O stats (display with "info blockstats"). */
+    uint64_t rd_bytes;
+    uint64_t wr_bytes;
+    uint64_t rd_ops;
+    uint64_t wr_ops;
+
     /* NOTE: the following infos are only hints for real hardware
        drivers. They are not used by the block driver */
     int cyls, heads, secs, translation;
@@ -76,6 +132,19 @@ struct BlockDriverState {
     BlockDriverState *next;
 };
 
+struct BlockDriverAIOCB {
+    BlockDriverState *bs;
+    BlockDriverCompletionFunc *cb;
+    void *opaque;
+    BlockDriverAIOCB *next;
+};
+
 void get_tmp_filename(char *filename, int size);
 
+void *qemu_aio_get(BlockDriverState *bs, BlockDriverCompletionFunc *cb,
+                   void *opaque);
+void qemu_aio_release(void *p);
+
+BlockDriverState *bdrv_first;
+
 #endif /* BLOCK_INT_H */
diff --git a/bswap.h b/bswap.h
index 37fb04e..523d805 100644
--- a/bswap.h
+++ b/bswap.h
@@ -48,12 +48,12 @@ static inline uint16_t bswap16(uint16_t x)
     return bswap_16(x);
 }
 
-static inline uint32_t bswap32(uint32_t x) 
+static inline uint32_t bswap32(uint32_t x)
 {
     return bswap_32(x);
 }
 
-static inline uint64_t bswap64(uint64_t x) 
+static inline uint64_t bswap64(uint64_t x)
 {
     return bswap_64(x);
 }
@@ -132,6 +132,7 @@ CPU_CONVERT(le, 64, uint64_t)
 #define cpu_to_le32wu(p, v) cpu_to_le32w(p, v)
 #define le16_to_cpupu(p) le16_to_cpup(p)
 #define le32_to_cpupu(p) le32_to_cpup(p)
+#define be32_to_cpupu(p) be32_to_cpup(p)
 
 #define cpu_to_be16wu(p, v) cpu_to_be16w(p, v)
 #define cpu_to_be32wu(p, v) cpu_to_be32w(p, v)
@@ -168,6 +169,12 @@ static inline uint32_t le32_to_cpupu(const uint32_t *p)
     return p1[0] | (p1[1] << 8) | (p1[2] << 16) | (p1[3] << 24);
 }
 
+static inline uint32_t be32_to_cpupu(const uint32_t *p)
+{
+    const uint8_t *p1 = (const uint8_t *)p;
+    return p1[3] | (p1[2] << 8) | (p1[1] << 16) | (p1[0] << 24);
+}
+
 static inline void cpu_to_be16wu(uint16_t *p, uint16_t v)
 {
     uint8_t *p1 = (uint8_t *)p;
diff --git a/cbuffer.c b/cbuffer.c
index 082b0dd..0e99237 100644
--- a/cbuffer.c
+++ b/cbuffer.c
@@ -10,7 +10,7 @@
 ** GNU General Public License for more details.
 */
 #include "cbuffer.h"
-#include "android_utils.h"
+#include "android/utils/stralloc.h"
 #include <string.h>
 #include <stdlib.h>
 #include <assert.h>
@@ -188,7 +188,7 @@ cbuffer_quote( CBuffer*  cb )
     stralloc_format( s, "cbuffer %p (pos=%d count=%d size=%d)",
                      cb, cb->rpos, cb->count, cb->size );
 
-    q = tempstr_from_stralloc( s );
+    q = stralloc_to_tempstr( s );
     stralloc_reset(s);
 
     return q;
@@ -216,7 +216,7 @@ cbuffer_quote_data( CBuffer*  cb )
         len  -= avail;
     }
 
-    result = tempstr_from_stralloc(s);
+    result = stralloc_to_tempstr(s);
     stralloc_reset(s);
 
     return result;
diff --git a/charpipe.c b/charpipe.c
index cb4698f..d6b9829 100644
--- a/charpipe.c
+++ b/charpipe.c
@@ -9,9 +9,9 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "qemu-char.h"
 #include "cbuffer.h"
-#include "android_debug.h"
+#include "qemu_debug.h"
 
 #define  xxDEBUG
 
@@ -73,9 +73,6 @@ typedef struct CharPipeHalf {
     BipBuffer*            bip_first;
     BipBuffer*            bip_last;
     struct CharPipeHalf*  peer;         /* NULL if closed */
-    IOCanRWHandler*       fd_can_read;
-    IOReadHandler*        fd_read;
-    void*                 fd_opaque;
 } CharPipeHalf;
 
 
@@ -91,25 +88,7 @@ charpipehalf_close( CharDriverState*  cs )
         bip_buffer_free(bip);
     }
     ph->bip_last    = NULL;
-
     ph->peer        = NULL;
-    ph->fd_can_read = NULL;
-    ph->fd_read     = NULL;
-    ph->fd_opaque   = NULL;
-}
-
-
-static void
-charpipehalf_add_read_handler( CharDriverState*  cs,
-                               IOCanRWHandler*   fd_can_read,
-                               IOReadHandler*    fd_read,
-                               void*             fd_opaque )
-{
-    CharPipeHalf*  ph = cs->opaque;
-
-    ph->fd_can_read = fd_can_read;
-    ph->fd_read     = fd_read;
-    ph->fd_opaque   = fd_opaque;
 }
 
 
@@ -124,13 +103,13 @@ charpipehalf_write( CharDriverState*  cs, const uint8_t*  buf, int  len )
     D("%s: writing %d bytes to %p: '%s'", __FUNCTION__,
       len, ph, quote_bytes( buf, len ));
 
-    if (bip == NULL && peer != NULL && peer->fd_read != NULL) {
+    if (bip == NULL && peer != NULL && peer->cs->chr_read != NULL) {
         /* no buffered data, try to write directly to the peer */
         while (len > 0) {
             int  size;
 
-            if (peer->fd_can_read) {
-                size = peer->fd_can_read( peer->fd_opaque );
+            if (peer->cs->chr_can_read) {
+                size = qemu_chr_can_read( peer->cs );
                 if (size == 0)
                     break;
 
@@ -139,7 +118,7 @@ charpipehalf_write( CharDriverState*  cs, const uint8_t*  buf, int  len )
             } else
                 size = len;
 
-            peer->fd_read( peer->fd_opaque, buf, size );
+            qemu_chr_read( peer->cs, (uint8_t*)buf, size );
             buf += size;
             len -= size;
             ret += size;
@@ -179,7 +158,7 @@ charpipehalf_poll( CharPipeHalf*  ph )
     CharPipeHalf*   peer = ph->peer;
     int             size;
 
-    if (peer == NULL || peer->fd_read == NULL)
+    if (peer == NULL || peer->cs->chr_read == NULL)
         return;
 
     while (1) {
@@ -199,8 +178,8 @@ charpipehalf_poll( CharPipeHalf*  ph )
             continue;
         }
 
-        if (ph->fd_can_read) {
-            int  size2 = peer->fd_can_read( peer->fd_opaque );
+        if (ph->cs->chr_can_read) {
+            int  size2 = qemu_chr_can_read(peer->cs);
 
             if (size2 == 0)
                 break;
@@ -215,7 +194,7 @@ charpipehalf_poll( CharPipeHalf*  ph )
         D("%s: sending %d bytes from %p: '%s'", __FUNCTION__,
             avail, ph, quote_bytes( base, avail ));
 
-        peer->fd_read( peer->fd_opaque, base, avail );
+        qemu_chr_read( peer->cs, base, avail );
         cbuffer_read_step( bip->cb, avail );
     }
 }
@@ -229,12 +208,8 @@ charpipehalf_init( CharPipeHalf*  ph, CharPipeHalf*  peer )
     ph->bip_first   = NULL;
     ph->bip_last    = NULL;
     ph->peer        = peer;
-    ph->fd_can_read = NULL;
-    ph->fd_read     = NULL;
-    ph->fd_opaque   = NULL;
 
     cs->chr_write            = charpipehalf_write;
-    cs->chr_add_read_handler = charpipehalf_add_read_handler;
     cs->chr_ioctl            = NULL;
     cs->chr_send_event       = NULL;
     cs->chr_close            = charpipehalf_close;
diff --git a/charpipe.h b/charpipe.h
index 77f5fb2..88dffde 100644
--- a/charpipe.h
+++ b/charpipe.h
@@ -12,7 +12,7 @@
 #ifndef _CHARPIPE_H
 #define _CHARPIPE_H
 
-#include "vl.h"
+#include "qemu-common.h"
 
 /* open two connected character drivers that can be used to communicate by internal
  * QEMU components. For Android, this is used to connect an emulated serial port
diff --git a/cocoa.m b/cocoa.m
deleted file mode 100644
index 9551aff..0000000
--- a/cocoa.m
+++ /dev/null
@@ -1,927 +0,0 @@
-/*
- * QEMU Cocoa display driver
- * 
- * Copyright (c) 2005 Pierre d'Herbemont
- *                    many code/inspiration from SDL 1.2 code (LGPL)
- * 
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-/*
-    Todo :    x  miniaturize window 
-              x  center the window
-              -  save window position
-              -  handle keyboard event
-              -  handle mouse event
-              -  non 32 bpp support
-              -  full screen
-              -  mouse focus
-              x  simple graphical prompt to demo
-              -  better graphical prompt
-*/
-
-#import <Cocoa/Cocoa.h>
-
-#include "vl.h"
-
-NSWindow *window = NULL;
-NSQuickDrawView *qd_view = NULL;
-
-
-int gArgc;
-char **gArgv;
-DisplayState current_ds;
-
-int grab = 0;
-int modifiers_state[256];
-
-/* main defined in qemu/vl.c */
-int qemu_main(int argc, char **argv);
-
-/* To deal with miniaturization */
-@interface QemuWindow : NSWindow
-{ }
-@end
-
-
-/*
- ------------------------------------------------------
-    Qemu Video Driver
- ------------------------------------------------------
-*/
-
-/*
- ------------------------------------------------------
-    cocoa_update
- ------------------------------------------------------
-*/
-static void cocoa_update(DisplayState *ds, int x, int y, int w, int h)
-{
-    //printf("updating x=%d y=%d w=%d h=%d\n", x, y, w, h);
-
-    /* Use QDFlushPortBuffer() to flush content to display */
-    RgnHandle dirty = NewRgn ();
-    RgnHandle temp  = NewRgn ();
-
-    SetEmptyRgn (dirty);
-
-    /* Build the region of dirty rectangles */
-    MacSetRectRgn (temp, x, y,
-                        x + w, y + h);
-    MacUnionRgn (dirty, temp, dirty);
-                
-    /* Flush the dirty region */
-    QDFlushPortBuffer ( [ qd_view  qdPort ], dirty );
-    DisposeRgn (dirty);
-    DisposeRgn (temp);
-}
-
-/*
- ------------------------------------------------------
-    cocoa_resize
- ------------------------------------------------------
-*/
-static void cocoa_resize(DisplayState *ds, int w, int h)
-{
-    const int device_bpp = 32;
-    static void *screen_pixels;
-    static int  screen_pitch;
-    NSRect contentRect;
-    
-    //printf("resizing to %d %d\n", w, h);
-    
-    contentRect = NSMakeRect (0, 0, w, h);
-    if(window)
-    {
-        [window close];
-        [window release];
-    }
-    window = [ [ QemuWindow alloc ] initWithContentRect:contentRect
-                                  styleMask:NSTitledWindowMask|NSMiniaturizableWindowMask|NSClosableWindowMask
-                                  backing:NSBackingStoreBuffered defer:NO];
-    if(!window)
-    {
-        fprintf(stderr, "(cocoa) can't create window\n");
-        exit(1);
-    }
-    
-    if(qd_view)
-        [qd_view release];
-    
-    qd_view = [ [ NSQuickDrawView alloc ] initWithFrame:contentRect ];
-    
-    if(!qd_view)
-    {
-         fprintf(stderr, "(cocoa) can't create qd_view\n");
-        exit(1);
-    }
-    
-    [ window setAcceptsMouseMovedEvents:YES ];
-    [ window setTitle:@"Qemu" ];
-    [ window setReleasedWhenClosed:NO ];
-    
-    /* Set screen to black */
-    [ window setBackgroundColor: [NSColor blackColor] ];
-    
-    /* set window position */
-    [ window center ];
-    
-    [ qd_view setAutoresizingMask: NSViewWidthSizable | NSViewHeightSizable ];
-    [ [ window contentView ] addSubview:qd_view ];
-    [ qd_view release ];
-    [ window makeKeyAndOrderFront:nil ];
-    
-    /* Careful here, the window seems to have to be onscreen to do that */
-    LockPortBits ( [ qd_view qdPort ] );
-    screen_pixels = GetPixBaseAddr ( GetPortPixMap ( [ qd_view qdPort ] ) );
-    screen_pitch  = GetPixRowBytes ( GetPortPixMap ( [ qd_view qdPort ] ) );
-    UnlockPortBits ( [ qd_view qdPort ] );
-    { 
-            int vOffset = [ window frame ].size.height - 
-                [ qd_view frame ].size.height - [ qd_view frame ].origin.y;
-            
-            int hOffset = [ qd_view frame ].origin.x;
-                    
-            screen_pixels += (vOffset * screen_pitch) + hOffset * (device_bpp/8);
-    }
-    ds->data = screen_pixels;
-    ds->linesize = screen_pitch;
-    ds->depth = device_bpp;
-    ds->width = w;
-    ds->height = h;
-    
-    current_ds = *ds;
-}
-
-/*
- ------------------------------------------------------
-    keymap conversion
- ------------------------------------------------------
-*/
-
-int keymap[] =
-{
-//  SdlI    macI    macH    SdlH    104xtH  104xtC  sdl
-    30, //  0       0x00    0x1e            A       QZ_a
-    31, //  1       0x01    0x1f            S       QZ_s
-    32, //  2       0x02    0x20            D       QZ_d
-    33, //  3       0x03    0x21            F       QZ_f
-    35, //  4       0x04    0x23            H       QZ_h
-    34, //  5       0x05    0x22            G       QZ_g
-    44, //  6       0x06    0x2c            Z       QZ_z
-    45, //  7       0x07    0x2d            X       QZ_x
-    46, //  8       0x08    0x2e            C       QZ_c
-    47, //  9       0x09    0x2f            V       QZ_v
-    0,  //  10      0x0A    Undefined
-    48, //  11      0x0B    0x30            B       QZ_b
-    16, //  12      0x0C    0x10            Q       QZ_q
-    17, //  13      0x0D    0x11            W       QZ_w
-    18, //  14      0x0E    0x12            E       QZ_e
-    19, //  15      0x0F    0x13            R       QZ_r
-    21, //  16      0x10    0x15            Y       QZ_y
-    20, //  17      0x11    0x14            T       QZ_t
-    2,  //  18      0x12    0x02            1       QZ_1
-    3,  //  19      0x13    0x03            2       QZ_2
-    4,  //  20      0x14    0x04            3       QZ_3
-    5,  //  21      0x15    0x05            4       QZ_4
-    7,  //  22      0x16    0x07            6       QZ_6
-    6,  //  23      0x17    0x06            5       QZ_5
-    13, //  24      0x18    0x0d            =       QZ_EQUALS
-    10, //  25      0x19    0x0a            9       QZ_9
-    8,  //  26      0x1A    0x08            7       QZ_7
-    12, //  27      0x1B    0x0c            -       QZ_MINUS
-    9,  //  28      0x1C    0x09            8       QZ_8
-    11, //  29      0x1D    0x0b            0       QZ_0
-    27, //  30      0x1E    0x1b            ]       QZ_RIGHTBRACKET
-    24, //  31      0x1F    0x18            O       QZ_o
-    22, //  32      0x20    0x16            U       QZ_u
-    26, //  33      0x21    0x1a            [       QZ_LEFTBRACKET
-    23, //  34      0x22    0x17            I       QZ_i
-    25, //  35      0x23    0x19            P       QZ_p
-    28, //  36      0x24    0x1c            ENTER   QZ_RETURN
-    38, //  37      0x25    0x26            L       QZ_l
-    36, //  38      0x26    0x24            J       QZ_j
-    40, //  39      0x27    0x28            '       QZ_QUOTE
-    37, //  40      0x28    0x25            K       QZ_k
-    39, //  41      0x29    0x27            ;       QZ_SEMICOLON
-    43, //  42      0x2A    0x2b            \       QZ_BACKSLASH
-    51, //  43      0x2B    0x33            ,       QZ_COMMA
-    53, //  44      0x2C    0x35            /       QZ_SLASH
-    49, //  45      0x2D    0x31            N       QZ_n
-    50, //  46      0x2E    0x32            M       QZ_m
-    52, //  47      0x2F    0x34            .       QZ_PERIOD
-    15, //  48      0x30    0x0f            TAB     QZ_TAB
-    57, //  49      0x31    0x39            SPACE   QZ_SPACE
-    41, //  50      0x32    0x29            `       QZ_BACKQUOTE
-    14, //  51      0x33    0x0e            BKSP    QZ_BACKSPACE
-    0,  //  52      0x34    Undefined
-    1,  //  53      0x35    0x01            ESC     QZ_ESCAPE
-    0,  //  54      0x36                            QZ_RMETA
-    0,  //  55      0x37                            QZ_LMETA
-    42, //  56      0x38    0x2a            L SHFT  QZ_LSHIFT
-    58, //  57      0x39    0x3a            CAPS    QZ_CAPSLOCK
-    56, //  58      0x3A    0x38            L ALT   QZ_LALT
-    29, //  59      0x3B    0x1d            L CTRL  QZ_LCTRL
-    54, //  60      0x3C    0x36            R SHFT  QZ_RSHIFT
-    184,//  61      0x3D    0xb8    E0,38   R ALT   QZ_RALT
-    157,//  62      0x3E    0x9d    E0,1D   R CTRL  QZ_RCTRL
-    0,  //  63      0x3F    Undefined
-    0,  //  64      0x40    Undefined
-    0,  //  65      0x41    Undefined
-    0,  //  66      0x42    Undefined
-    55, //  67      0x43    0x37            KP *    QZ_KP_MULTIPLY
-    0,  //  68      0x44    Undefined
-    78, //  69      0x45    0x4e            KP +    QZ_KP_PLUS
-    0,  //  70      0x46    Undefined
-    69, //  71      0x47    0x45            NUM     QZ_NUMLOCK
-    0,  //  72      0x48    Undefined
-    0,  //  73      0x49    Undefined
-    0,  //  74      0x4A    Undefined
-    181,//  75      0x4B    0xb5    E0,35   KP /    QZ_KP_DIVIDE
-    152,//  76      0x4C    0x9c    E0,1C   KP EN   QZ_KP_ENTER
-    0,  //  77      0x4D    undefined
-    74, //  78      0x4E    0x4a            KP -    QZ_KP_MINUS
-    0,  //  79      0x4F    Undefined
-    0,  //  80      0x50    Undefined
-    0,  //  81      0x51                            QZ_KP_EQUALS
-    82, //  82      0x52    0x52            KP 0    QZ_KP0
-    79, //  83      0x53    0x4f            KP 1    QZ_KP1
-    80, //  84      0x54    0x50            KP 2    QZ_KP2
-    81, //  85      0x55    0x51            KP 3    QZ_KP3
-    75, //  86      0x56    0x4b            KP 4    QZ_KP4
-    76, //  87      0x57    0x4c            KP 5    QZ_KP5
-    77, //  88      0x58    0x4d            KP 6    QZ_KP6
-    71, //  89      0x59    0x47            KP 7    QZ_KP7
-    0,  //  90      0x5A    Undefined
-    72, //  91      0x5B    0x48            KP 8    QZ_KP8
-    73, //  92      0x5C    0x49            KP 9    QZ_KP9
-    0,  //  93      0x5D    Undefined
-    0,  //  94      0x5E    Undefined
-    0,  //  95      0x5F    Undefined
-    63, //  96      0x60    0x3f            F5      QZ_F5
-    64, //  97      0x61    0x40            F6      QZ_F6
-    65, //  98      0x62    0x41            F7      QZ_F7
-    61, //  99      0x63    0x3d            F3      QZ_F3
-    66, //  100     0x64    0x42            F8      QZ_F8
-    67, //  101     0x65    0x43            F9      QZ_F9
-    0,  //  102     0x66    Undefined
-    87, //  103     0x67    0x57            F11     QZ_F11
-    0,  //  104     0x68    Undefined
-    183,//  105     0x69    0xb7            QZ_PRINT
-    0,  //  106     0x6A    Undefined
-    70, //  107     0x6B    0x46            SCROLL  QZ_SCROLLOCK
-    0,  //  108     0x6C    Undefined
-    68, //  109     0x6D    0x44            F10     QZ_F10
-    0,  //  110     0x6E    Undefined
-    88, //  111     0x6F    0x58            F12     QZ_F12
-    0,  //  112     0x70    Undefined
-    110,//  113     0x71    0x0                     QZ_PAUSE
-    210,//  114     0x72    0xd2    E0,52   INSERT  QZ_INSERT
-    199,//  115     0x73    0xc7    E0,47   HOME    QZ_HOME
-    201,//  116     0x74    0xc9    E0,49   PG UP   QZ_PAGEUP
-    211,//  117     0x75    0xd3    E0,53   DELETE  QZ_DELETE
-    62, //  118     0x76    0x3e            F4      QZ_F4
-    207,//  119     0x77    0xcf    E0,4f   END     QZ_END
-    60, //  120     0x78    0x3c            F2      QZ_F2
-    209,//  121     0x79    0xd1    E0,51   PG DN   QZ_PAGEDOWN
-    59, //  122     0x7A    0x3b            F1      QZ_F1
-    203,//  123     0x7B    0xcb    e0,4B   L ARROW QZ_LEFT
-    205,//  124     0x7C    0xcd    e0,4D   R ARROW QZ_RIGHT
-    208,//  125     0x7D    0xd0    E0,50   D ARROW QZ_DOWN
-    200,//  126     0x7E    0xc8    E0,48   U ARROW QZ_UP
-/* completed according to http://www.libsdl.org/cgi/cvsweb.cgi/SDL12/src/video/quartz/SDL_QuartzKeys.h?rev=1.6&content-type=text/x-cvsweb-markup */
-  
-/* Aditional 104 Key XP-Keyboard Scancodes from http://www.computer-engineering.org/ps2keyboard/scancodes1.html */
-/*
-    219 //          0xdb            e0,5b   L GUI   
-    220 //          0xdc            e0,5c   R GUI   
-    221 //          0xdd            e0,5d   APPS    
-        //              E0,2A,E0,37         PRNT SCRN   
-        //              E1,1D,45,E1,9D,C5   PAUSE   
-    83  //          0x53    0x53            KP .    
-// ACPI Scan Codes                              
-    222 //          0xde            E0, 5E  Power   
-    223 //          0xdf            E0, 5F  Sleep   
-    227 //          0xe3            E0, 63  Wake    
-// Windows Multimedia Scan Codes                                
-    153 //          0x99            E0, 19  Next Track  
-    144 //          0x90            E0, 10  Previous Track  
-    164 //          0xa4            E0, 24  Stop    
-    162 //          0xa2            E0, 22  Play/Pause  
-    160 //          0xa0            E0, 20  Mute    
-    176 //          0xb0            E0, 30  Volume Up   
-    174 //          0xae            E0, 2E  Volume Down 
-    237 //          0xed            E0, 6D  Media Select    
-    236 //          0xec            E0, 6C  E-Mail  
-    161 //          0xa1            E0, 21  Calculator  
-    235 //          0xeb            E0, 6B  My Computer 
-    229 //          0xe5            E0, 65  WWW Search  
-    178 //          0xb2            E0, 32  WWW Home    
-    234 //          0xea            E0, 6A  WWW Back    
-    233 //          0xe9            E0, 69  WWW Forward 
-    232 //          0xe8            E0, 68  WWW Stop    
-    231 //          0xe7            E0, 67  WWW Refresh 
-    230 //          0xe6            E0, 66  WWW Favorites   
-*/
-};
-
-int cocoa_keycode_to_qemu(int keycode)
-{
-    if((sizeof(keymap)/sizeof(int)) <= keycode)
-    {
-        printf("(cocoa) warning unknow keycode 0x%x\n", keycode);
-        return 0;
-    }
-    return keymap[keycode];
-}
-
-/*
- ------------------------------------------------------
-    cocoa_refresh
- ------------------------------------------------------
-*/
-static void cocoa_refresh(DisplayState *ds)
-{
-    //printf("cocoa_refresh \n");
-    NSDate *distantPast;
-    NSEvent *event;
-    NSAutoreleasePool *pool;
-    
-    pool = [ [ NSAutoreleasePool alloc ] init ];
-    distantPast = [ NSDate distantPast ];
-    
-    vga_hw_update();
-
-    do {
-        event = [ NSApp nextEventMatchingMask:NSAnyEventMask untilDate:distantPast
-                        inMode: NSDefaultRunLoopMode dequeue:YES ];
-        if (event != nil) {
-            switch ([event type]) {
-                case NSFlagsChanged:
-                    {
-                        int keycode = cocoa_keycode_to_qemu([event keyCode]);
-
-                        if (keycode)
-                        {
-                            if (keycode == 58 || keycode == 69) {
-                                /* emulate caps lock and num lock keydown and keyup */
-                                kbd_put_keycode(keycode);
-                                kbd_put_keycode(keycode | 0x80);
-                            } else if (is_graphic_console()) {
-                                if (keycode & 0x80)
-                                    kbd_put_keycode(0xe0);
-                                if (modifiers_state[keycode] == 0) {
-                                    /* keydown */
-                                    kbd_put_keycode(keycode & 0x7f);
-                                    modifiers_state[keycode] = 1;
-                                } else {
-                                    /* keyup */
-                                    kbd_put_keycode(keycode | 0x80);
-                                    modifiers_state[keycode] = 0;
-                                }
-                            }
-                        }
-
-                        /* release Mouse grab when pressing ctrl+alt */
-                        if (([event modifierFlags] & NSControlKeyMask) && ([event modifierFlags] & NSAlternateKeyMask))
-                        {
-                            [window setTitle: @"QEMU"];
-                            [NSCursor unhide];
-                            CGAssociateMouseAndMouseCursorPosition ( TRUE );
-                            grab = 0;
-                        }
-                    }
-                    break;
-
-                case NSKeyDown:
-                    {
-                        int keycode = cocoa_keycode_to_qemu([event keyCode]);               
-                        
-                        /* handle command Key Combos */
-                        if ([event modifierFlags] & NSCommandKeyMask) {
-                            switch ([event keyCode]) {
-                                /* quit */
-                                case 12: /* q key */
-                                    /* switch to windowed View */
-                                    exit(0);
-                                    return;
-                            }
-                        }
-                        
-                        /* handle control + alt Key Combos */
-                        if (([event modifierFlags] & NSControlKeyMask) && ([event modifierFlags] & NSAlternateKeyMask)) {
-                            switch (keycode) {
-                                /* toggle Monitor */
-                                case 0x02 ... 0x0a: /* '1' to '9' keys */
-                                    console_select(keycode - 0x02);
-                                    break;
-                            }
-                        } else {
-                            /* handle standard key events */
-                            if (is_graphic_console()) {
-                                if (keycode & 0x80) //check bit for e0 in front
-                                    kbd_put_keycode(0xe0);
-                                kbd_put_keycode(keycode & 0x7f); //remove e0 bit in front
-                            /* handle monitor key events */
-                            } else {
-                                int keysym = 0;
-
-                                switch([event keyCode]) {
-                                case 115:
-                                    keysym = QEMU_KEY_HOME;
-                                    break;
-                                case 117:
-                                    keysym = QEMU_KEY_DELETE;
-                                    break;
-                                case 119:
-                                    keysym = QEMU_KEY_END;
-                                    break;
-                                case 123:
-                                    keysym = QEMU_KEY_LEFT;
-                                    break;
-                                case 124:
-                                    keysym = QEMU_KEY_RIGHT;
-                                    break;
-                                case 125:
-                                    keysym = QEMU_KEY_DOWN;
-                                    break;
-                                case 126:
-                                    keysym = QEMU_KEY_UP;
-                                    break;
-                                default:
-                                    {
-                                        NSString *ks = [event characters];
-
-                                        if ([ks length] > 0)
-                                            keysym = [ks characterAtIndex:0];
-                                    }
-                                }
-                                if (keysym)
-                                    kbd_put_keysym(keysym);
-                            }
-                        }
-                    }
-                    break;
-                    
-                case NSKeyUp:
-                    {
-                        int keycode = cocoa_keycode_to_qemu([event keyCode]);   
-                        if (is_graphic_console()) {
-                            if (keycode & 0x80)
-                                kbd_put_keycode(0xe0);
-                            kbd_put_keycode(keycode | 0x80); //add 128 to signal release of key
-                        }
-                    }
-                    break;
-                    
-                case NSMouseMoved:
-                    if (grab) {
-                        int dx = [event deltaX];
-                        int dy = [event deltaY];
-                        int dz = [event deltaZ];
-                        int buttons = 0;
-                        kbd_mouse_event(dx, dy, dz, buttons);
-                    }
-                    break;
-                        
-                case NSLeftMouseDown:
-                    if (grab) {
-                        int buttons = 0;
-                        
-                        /* leftclick+command simulates rightclick */
-                        if ([event modifierFlags] & NSCommandKeyMask) {
-                            buttons |= MOUSE_EVENT_RBUTTON;
-                        } else {
-                            buttons |= MOUSE_EVENT_LBUTTON;
-                        }
-                        kbd_mouse_event(0, 0, 0, buttons);
-                    } else {
-                        [NSApp sendEvent: event];
-                    }
-                    break;
-                        
-                case NSLeftMouseDragged:
-                    if (grab) {
-                        int dx = [event deltaX];
-                        int dy = [event deltaY];
-                        int dz = [event deltaZ];
-                        int buttons = 0;
-                        if ([[NSApp currentEvent] modifierFlags] & NSCommandKeyMask) { //leftclick+command simulates rightclick
-                            buttons |= MOUSE_EVENT_RBUTTON;
-                        } else {
-                            buttons |= MOUSE_EVENT_LBUTTON;
-                        }
-                        kbd_mouse_event(dx, dy, dz, buttons);
-                    }
-                    break;
-                        
-                case NSLeftMouseUp:
-                    if (grab) {
-                        kbd_mouse_event(0, 0, 0, 0);
-                    } else {
-                        [window setTitle: @"QEMU (Press ctrl + alt to release Mouse)"];
-                        [NSCursor hide];
-                        CGAssociateMouseAndMouseCursorPosition ( FALSE );
-                        grab = 1;
-                        //[NSApp sendEvent: event];
-                    }
-                    break;
-                        
-                case NSRightMouseDown:
-                    if (grab) {
-                        int buttons = 0;
-                        
-                        buttons |= MOUSE_EVENT_RBUTTON;
-                        kbd_mouse_event(0, 0, 0, buttons);
-                    } else {
-                        [NSApp sendEvent: event];
-                    }
-                    break;
-                    
-                case NSRightMouseDragged:
-                    if (grab) {
-                        int dx = [event deltaX];
-                        int dy = [event deltaY];
-                        int dz = [event deltaZ];
-                        int buttons = 0;
-                        buttons |= MOUSE_EVENT_RBUTTON;
-                        kbd_mouse_event(dx, dy, dz, buttons);
-                    }
-                    break;
-                    
-                case NSRightMouseUp:
-                    if (grab) {
-                        kbd_mouse_event(0, 0, 0, 0);
-                    } else {
-                        [NSApp sendEvent: event];
-                    }
-                    break;
-                        
-                case NSOtherMouseDragged:
-                    if (grab) {
-                        int dx = [event deltaX];
-                        int dy = [event deltaY];
-                        int dz = [event deltaZ];
-                        int buttons = 0;
-                        buttons |= MOUSE_EVENT_MBUTTON;
-                        kbd_mouse_event(dx, dy, dz, buttons);
-                    }
-                    break;
-                    
-                case NSOtherMouseDown:
-                    if (grab) {
-                        int buttons = 0;
-                        buttons |= MOUSE_EVENT_MBUTTON;
-                        kbd_mouse_event(0, 0, 0, buttons);
-                    } else {
-                        [NSApp sendEvent:event];
-                    }
-                    break;
-                        
-                case NSOtherMouseUp:
-                    if (grab) {
-                        kbd_mouse_event(0, 0, 0, 0);
-                    } else {
-                        [NSApp sendEvent: event];
-                    }
-                    break;
-                        
-                case NSScrollWheel:
-                    if (grab) {
-                        int dz = [event deltaY];
-                        kbd_mouse_event(0, 0, -dz, 0);
-                    }
-                    break;
-                
-                default: [NSApp sendEvent:event];
-            }
-        }
-    } while(event != nil);
-}
-
-/*
- ------------------------------------------------------
-    cocoa_cleanup
- ------------------------------------------------------
-*/
-
-static void cocoa_cleanup(void) 
-{
-
-}
-
-/*
- ------------------------------------------------------
-    cocoa_display_init
- ------------------------------------------------------
-*/
-
-void cocoa_display_init(DisplayState *ds, int full_screen)
-{
-    ds->dpy_update = cocoa_update;
-    ds->dpy_resize = cocoa_resize;
-    ds->dpy_refresh = cocoa_refresh;
-    
-    cocoa_resize(ds, 640, 400);
-    
-    atexit(cocoa_cleanup);
-}
-
-/*
- ------------------------------------------------------
-    Interface with Cocoa
- ------------------------------------------------------
-*/
-
-
-/*
- ------------------------------------------------------
-    QemuWindow
-    Some trick from SDL to use miniwindow
- ------------------------------------------------------
-*/
-static void QZ_SetPortAlphaOpaque ()
-{    
-    /* Assume 32 bit if( bpp == 32 )*/
-    if ( 1 ) {
-    
-        uint32_t    *pixels = (uint32_t*) current_ds.data;
-        uint32_t    rowPixels = current_ds.linesize / 4;
-        uint32_t    i, j;
-        
-        for (i = 0; i < current_ds.height; i++)
-            for (j = 0; j < current_ds.width; j++) {
-        
-                pixels[ (i * rowPixels) + j ] |= 0xFF000000;
-            }
-    }
-}
-
-@implementation QemuWindow
-- (void)miniaturize:(id)sender
-{
-        
-    /* make the alpha channel opaque so anim won't have holes in it */
-    QZ_SetPortAlphaOpaque ();
-    
-    [ super miniaturize:sender ];
-    
-}
-- (void)display
-{    
-    /* 
-        This method fires just before the window deminaturizes from the Dock.
-        
-        We'll save the current visible surface, let the window manager redraw any
-        UI elements, and restore the SDL surface. This way, no expose event 
-        is required, and the deminiaturize works perfectly.
-    */
-    
-    /* make sure pixels are fully opaque */
-    QZ_SetPortAlphaOpaque ();
-    
-    /* save current visible SDL surface */
-    [ self cacheImageInRect:[ qd_view frame ] ];
-    
-    /* let the window manager redraw controls, border, etc */
-    [ super display ];
-    
-    /* restore visible SDL surface */
-    [ self restoreCachedImage ];
-}
-
-@end
-
-
-/*
- ------------------------------------------------------
-    QemuCocoaGUIController
-    NSApp's delegate - indeed main object
- ------------------------------------------------------
-*/
-
-@interface QemuCocoaGUIController : NSObject
-{
-}
-- (void)applicationDidFinishLaunching: (NSNotification *) note;
-- (void)applicationWillTerminate:(NSNotification *)aNotification;
-
-- (void)openPanelDidEnd:(NSOpenPanel *)sheet returnCode:(int)returnCode contextInfo:(void *)contextInfo;
-
-- (void)startEmulationWithArgc:(int)argc argv:(char**)argv;
-@end
-
-@implementation QemuCocoaGUIController
-/* Called when the internal event loop has just started running */
-- (void)applicationDidFinishLaunching: (NSNotification *) note
-{
-
-    /* Display an open dialog box if no argument were passed or
-       if qemu was launched from the finder ( the Finder passes "-psn" ) */
-
-    if( gArgc <= 1 || strncmp (gArgv[1], "-psn", 4) == 0)
-    {
-        NSOpenPanel *op = [[NSOpenPanel alloc] init];
-        
-        cocoa_resize(&current_ds, 640, 400);
-        
-        [op setPrompt:@"Boot image"];
-        
-        [op setMessage:@"Select the disk image you want to boot.\n\nHit the \"Cancel\" button to quit"];
-        
-        [op beginSheetForDirectory:nil file:nil types:[NSArray arrayWithObjects:@"img",@"iso",@"dmg",@"qcow",@"cow",@"cloop",@"vmdk",nil]
-              modalForWindow:window modalDelegate:self
-              didEndSelector:@selector(openPanelDidEnd:returnCode:contextInfo:) contextInfo:NULL];
-    }
-    else
-    {
-        /* or Launch Qemu, with the global args */
-        [self startEmulationWithArgc:gArgc argv:gArgv];
-    }
-}
-
-- (void)applicationWillTerminate:(NSNotification *)aNotification
-{
-    printf("Application will terminate\n");
-    qemu_system_shutdown_request();
-    /* In order to avoid a crash */
-    exit(0);
-}
-
-- (void)openPanelDidEnd:(NSOpenPanel *)sheet returnCode:(int)returnCode contextInfo:(void *)contextInfo
-{
-    if(returnCode == NSCancelButton)
-    {
-        exit(0);
-    }
-    
-    if(returnCode == NSOKButton)
-    {
-        char *bin = "qemu";
-        char *img = (char*)[ [ sheet filename ] cString];
-        
-        char **argv = (char**)malloc( sizeof(char*)*3 );
-        
-        asprintf(&argv[0], "%s", bin);
-        asprintf(&argv[1], "-hda");
-        asprintf(&argv[2], "%s", img);
-        
-        printf("Using argc %d argv %s -hda %s\n", 3, bin, img);
-        
-        [self startEmulationWithArgc:3 argv:(char**)argv];
-    }
-}
-
-- (void)startEmulationWithArgc:(int)argc argv:(char**)argv
-{
-    int status;
-    /* Launch Qemu */
-    printf("starting qemu...\n");
-    status = qemu_main (argc, argv);
-    exit(status);
-}
-@end
-
-/*
- ------------------------------------------------------
-    Application Creation
- ------------------------------------------------------
-*/
-
-/* Dock Connection */
-typedef struct CPSProcessSerNum
-{
-        UInt32                lo;
-        UInt32                hi;
-} CPSProcessSerNum;
-
-extern OSErr    CPSGetCurrentProcess( CPSProcessSerNum *psn);
-extern OSErr    CPSEnableForegroundOperation( CPSProcessSerNum *psn, UInt32 _arg2, UInt32 _arg3, UInt32 _arg4, UInt32 _arg5);
-extern OSErr    CPSSetFrontProcess( CPSProcessSerNum *psn);
-
-/* Menu Creation */
-static void setApplicationMenu(void)
-{
-    /* warning: this code is very odd */
-    NSMenu *appleMenu;
-    NSMenuItem *menuItem;
-    NSString *title;
-    NSString *appName;
-    
-    appName = @"Qemu";
-    appleMenu = [[NSMenu alloc] initWithTitle:@""];
-    
-    /* Add menu items */
-    title = [@"About " stringByAppendingString:appName];
-    [appleMenu addItemWithTitle:title action:@selector(orderFrontStandardAboutPanel:) keyEquivalent:@""];
-
-    [appleMenu addItem:[NSMenuItem separatorItem]];
-
-    title = [@"Hide " stringByAppendingString:appName];
-    [appleMenu addItemWithTitle:title action:@selector(hide:) keyEquivalent:@"h"];
-
-    menuItem = (NSMenuItem *)[appleMenu addItemWithTitle:@"Hide Others" action:@selector(hideOtherApplications:) keyEquivalent:@"h"];
-    [menuItem setKeyEquivalentModifierMask:(NSAlternateKeyMask|NSCommandKeyMask)];
-
-    [appleMenu addItemWithTitle:@"Show All" action:@selector(unhideAllApplications:) keyEquivalent:@""];
-
-    [appleMenu addItem:[NSMenuItem separatorItem]];
-
-    title = [@"Quit " stringByAppendingString:appName];
-    [appleMenu addItemWithTitle:title action:@selector(terminate:) keyEquivalent:@"q"];
-
-    
-    /* Put menu into the menubar */
-    menuItem = [[NSMenuItem alloc] initWithTitle:@"" action:nil keyEquivalent:@""];
-    [menuItem setSubmenu:appleMenu];
-    [[NSApp mainMenu] addItem:menuItem];
-
-    /* Tell the application object that this is now the application menu */
-    [NSApp setAppleMenu:appleMenu];
-
-    /* Finally give up our references to the objects */
-    [appleMenu release];
-    [menuItem release];
-}
-
-/* Create a window menu */
-static void setupWindowMenu(void)
-{
-    NSMenu      *windowMenu;
-    NSMenuItem  *windowMenuItem;
-    NSMenuItem  *menuItem;
-
-    windowMenu = [[NSMenu alloc] initWithTitle:@"Window"];
-    
-    /* "Minimize" item */
-    menuItem = [[NSMenuItem alloc] initWithTitle:@"Minimize" action:@selector(performMiniaturize:) keyEquivalent:@"m"];
-    [windowMenu addItem:menuItem];
-    [menuItem release];
-    
-    /* Put menu into the menubar */
-    windowMenuItem = [[NSMenuItem alloc] initWithTitle:@"Window" action:nil keyEquivalent:@""];
-    [windowMenuItem setSubmenu:windowMenu];
-    [[NSApp mainMenu] addItem:windowMenuItem];
-    
-    /* Tell the application object that this is now the window menu */
-    [NSApp setWindowsMenu:windowMenu];
-
-    /* Finally give up our references to the objects */
-    [windowMenu release];
-    [windowMenuItem release];
-}
-
-static void CustomApplicationMain(void)
-{
-    NSAutoreleasePool   *pool = [[NSAutoreleasePool alloc] init];
-    QemuCocoaGUIController *gui_controller;
-    CPSProcessSerNum PSN;
-    
-    [NSApplication sharedApplication];
-    
-    if (!CPSGetCurrentProcess(&PSN))
-        if (!CPSEnableForegroundOperation(&PSN,0x03,0x3C,0x2C,0x1103))
-            if (!CPSSetFrontProcess(&PSN))
-                [NSApplication sharedApplication];
-                
-    /* Set up the menubar */
-    [NSApp setMainMenu:[[NSMenu alloc] init]];
-    setApplicationMenu();
-    setupWindowMenu();
-
-    /* Create SDLMain and make it the app delegate */
-    gui_controller = [[QemuCocoaGUIController alloc] init];
-    [NSApp setDelegate:gui_controller];
-    
-    /* Start the main event loop */
-    [NSApp run];
-    
-    [gui_controller release];
-    [pool release];
-}
-
-/* Real main of qemu-cocoa */
-int main(int argc, char **argv)
-{
-    gArgc = argc;
-    gArgv = argv;
-
-    CustomApplicationMain();
-
-    return 0;
-}
diff --git a/compatfd.c b/compatfd.c
new file mode 100644
index 0000000..46b0ae7
--- /dev/null
+++ b/compatfd.c
@@ -0,0 +1,128 @@
+/*
+ * signalfd/eventfd compatibility
+ *
+ * Copyright IBM, Corp. 2008
+ *
+ * Authors:
+ *  Anthony Liguori   <aliguori@us.ibm.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu-common.h"
+#include "compatfd.h"
+
+#include <sys/syscall.h>
+#include <pthread.h>
+
+struct sigfd_compat_info
+{
+    sigset_t mask;
+    int fd;
+};
+
+static void *sigwait_compat(void *opaque)
+{
+    struct sigfd_compat_info *info = opaque;
+    int err;
+    sigset_t all;
+
+    sigfillset(&all);
+    sigprocmask(SIG_BLOCK, &all, NULL);
+
+    do {
+	siginfo_t siginfo;
+
+	err = sigwaitinfo(&info->mask, &siginfo);
+	if (err == -1 && errno == EINTR) {
+            err = 0;
+            continue;
+        }
+
+	if (err > 0) {
+	    char buffer[128];
+	    size_t offset = 0;
+
+	    memcpy(buffer, &err, sizeof(err));
+	    while (offset < sizeof(buffer)) {
+		ssize_t len;
+
+		len = write(info->fd, buffer + offset,
+			    sizeof(buffer) - offset);
+		if (len == -1 && errno == EINTR)
+		    continue;
+
+		if (len <= 0) {
+		    err = -1;
+		    break;
+		}
+
+		offset += len;
+	    }
+	}
+    } while (err >= 0);
+
+    return NULL;
+}
+
+static int qemu_signalfd_compat(const sigset_t *mask)
+{
+    pthread_attr_t attr;
+    pthread_t tid;
+    struct sigfd_compat_info *info;
+    int fds[2];
+
+    info = malloc(sizeof(*info));
+    if (info == NULL) {
+	errno = ENOMEM;
+	return -1;
+    }
+
+    if (pipe(fds) == -1) {
+	free(info);
+	return -1;
+    }
+
+    memcpy(&info->mask, mask, sizeof(*mask));
+    info->fd = fds[1];
+
+    pthread_attr_init(&attr);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+
+    pthread_create(&tid, &attr, sigwait_compat, info);
+
+    pthread_attr_destroy(&attr);
+
+    return fds[0];
+}
+
+int qemu_signalfd(const sigset_t *mask)
+{
+#if defined(SYS_signalfd)
+    int ret;
+
+    ret = syscall(SYS_signalfd, -1, mask, _NSIG / 8);
+    if (!(ret == -1 && errno == ENOSYS))
+	return ret;
+#endif
+
+    return qemu_signalfd_compat(mask);
+}
+
+int qemu_eventfd(int *fds)
+{
+#if defined(SYS_eventfd)
+    int ret;
+
+    ret = syscall(SYS_eventfd, 0);
+    if (ret >= 0) {
+	fds[0] = fds[1] = ret;
+	return 0;
+    } else if (!(ret == -1 && errno == ENOSYS))
+	return ret;
+#endif
+
+    return pipe(fds);
+}
diff --git a/compatfd.h b/compatfd.h
new file mode 100644
index 0000000..55a111a
--- /dev/null
+++ b/compatfd.h
@@ -0,0 +1,28 @@
+/*
+ * signalfd/eventfd compatibility
+ *
+ * Copyright IBM, Corp. 2008
+ *
+ * Authors:
+ *  Anthony Liguori   <aliguori@us.ibm.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ */
+
+#ifndef QEMU_COMPATFD_H
+#define QEMU_COMPATFD_H
+
+#include <signal.h>
+
+struct qemu_signalfd_siginfo {
+    uint32_t ssi_signo;
+    uint8_t pad[124];
+};
+
+int qemu_signalfd(const sigset_t *mask);
+
+int qemu_eventfd(int *fds);
+
+#endif
diff --git a/console.c b/console.c
index e9e2fe6..785710a 100644
--- a/console.c
+++ b/console.c
@@ -21,11 +21,14 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "console.h"
+#include "qemu-timer.h"
 
 //#define DEBUG_CONSOLE
 #define DEFAULT_BACKSCROLL 512
 #define MAX_CONSOLES 12
+#define DEFAULT_MONITOR_SIZE "800x600"
 
 #define QEMU_RGBA(r, g, b, a) (((a) << 24) | ((r) << 16) | ((g) << 8) | (b))
 #define QEMU_RGB(r, g, b) QEMU_RGBA(r, g, b, 0xff)
@@ -59,7 +62,7 @@ typedef struct QEMUFIFO {
     int count, wptr, rptr;
 } QEMUFIFO;
 
-int qemu_fifo_write(QEMUFIFO *f, const uint8_t *buf, int len1)
+static int qemu_fifo_write(QEMUFIFO *f, const uint8_t *buf, int len1)
 {
     int l, len;
 
@@ -82,7 +85,7 @@ int qemu_fifo_write(QEMUFIFO *f, const uint8_t *buf, int len1)
     return len1;
 }
 
-int qemu_fifo_read(QEMUFIFO *f, uint8_t *buf, int len1)
+static int qemu_fifo_read(QEMUFIFO *f, uint8_t *buf, int len1)
 {
     int l, len;
 
@@ -104,15 +107,21 @@ int qemu_fifo_read(QEMUFIFO *f, uint8_t *buf, int len1)
     return len1;
 }
 
+typedef enum {
+    GRAPHIC_CONSOLE,
+    TEXT_CONSOLE
+} console_type_t;
+
 /* ??? This is mis-named.
    It is used for both text and graphical consoles.  */
 struct TextConsole {
-    int text_console; /* true if text console */
+    console_type_t console_type;
     DisplayState *ds;
     /* Graphic console state.  */
     vga_hw_update_ptr hw_update;
     vga_hw_invalidate_ptr hw_invalidate;
     vga_hw_screen_dump_ptr hw_screen_dump;
+    vga_hw_text_update_ptr hw_text_update;
     void *hw;
 
     int g_width, g_height;
@@ -121,20 +130,19 @@ struct TextConsole {
     int total_height;
     int backscroll_height;
     int x, y;
+    int x_saved, y_saved;
     int y_displayed;
     int y_base;
     TextAttributes t_attrib_default; /* default text attributes */
     TextAttributes t_attrib; /* currently active text attributes */
     TextCell *cells;
+    int text_x[2], text_y[2], cursor_invalidate;
 
     enum TTYState state;
     int esc_params[MAX_ESC_PARAMS];
     int nb_esc_params;
 
-    /* kbd read handler */
-    IOCanRWHandler *fd_can_read;
-    IOReadHandler *fd_read;
-    void *fd_opaque;
+    CharDriverState *chr;
     /* fifo for key pressed */
     QEMUFIFO out_fifo;
     uint8_t out_fifo_buf[16];
@@ -147,7 +155,7 @@ static int nb_consoles = 0;
 
 void vga_hw_update(void)
 {
-    if (active_console->hw_update)
+    if (active_console && active_console->hw_update)
         active_console->hw_update(active_console->hw);
 }
 
@@ -159,10 +167,21 @@ void vga_hw_invalidate(void)
 
 void vga_hw_screen_dump(const char *filename)
 {
-    /* There is currently no was of specifying which screen we want to dump,
-       so always dump the dirst one.  */
+    TextConsole *previous_active_console;
+
+    previous_active_console = active_console;
+    active_console = consoles[0];
+    /* There is currently no way of specifying which screen we want to dump,
+       so always dump the first one.  */
     if (consoles[0]->hw_screen_dump)
         consoles[0]->hw_screen_dump(consoles[0]->hw, filename);
+    active_console = previous_active_console;
+}
+
+void vga_hw_text_update(console_ch_t *chardata)
+{
+    if (active_console && active_console->hw_text_update)
+        active_console->hw_text_update(active_console->hw, chardata);
 }
 
 /* convert a RGBA color to a color index usable in graphic primitives */
@@ -505,16 +524,29 @@ static void text_console_resize(TextConsole *s)
             c++;
         }
     }
-    free(s->cells);
+    qemu_free(s->cells);
     s->cells = cells;
 }
 
+static inline void text_update_xy(TextConsole *s, int x, int y)
+{
+    s->text_x[0] = MIN(s->text_x[0], x);
+    s->text_x[1] = MAX(s->text_x[1], x);
+    s->text_y[0] = MIN(s->text_y[0], y);
+    s->text_y[1] = MAX(s->text_y[1], y);
+}
+
 static void update_xy(TextConsole *s, int x, int y)
 {
     TextCell *c;
     int y1, y2;
 
     if (s == active_console) {
+        if (!s->ds->depth) {
+            text_update_xy(s, x, y);
+            return;
+        }
+
         y1 = (s->y_base + y) % s->total_height;
         y2 = y1 - s->y_displayed;
         if (y2 < 0)
@@ -535,21 +567,30 @@ static void console_show_cursor(TextConsole *s, int show)
     int y, y1;
 
     if (s == active_console) {
+        int x = s->x;
+
+        if (!s->ds->depth) {
+            s->cursor_invalidate = 1;
+            return;
+        }
+
+        if (x >= s->width) {
+            x = s->width - 1;
+        }
         y1 = (s->y_base + s->y) % s->total_height;
         y = y1 - s->y_displayed;
         if (y < 0)
             y += s->total_height;
         if (y < s->height) {
-            c = &s->cells[y1 * s->width + s->x];
+            c = &s->cells[y1 * s->width + x];
             if (show) {
                 TextAttributes t_attrib = s->t_attrib_default;
                 t_attrib.invers = !(t_attrib.invers); /* invert fg and bg */
-                vga_putcharxy(s->ds, s->x, y, c->ch, &t_attrib);
+                vga_putcharxy(s->ds, x, y, c->ch, &t_attrib);
             } else {
-                vga_putcharxy(s->ds, s->x, y, c->ch,
-                              &(c->t_attrib));
+                vga_putcharxy(s->ds, x, y, c->ch, &(c->t_attrib));
             }
-            dpy_update(s->ds, s->x * FONT_WIDTH, y * FONT_HEIGHT,
+            dpy_update(s->ds, x * FONT_WIDTH, y * FONT_HEIGHT,
                        FONT_WIDTH, FONT_HEIGHT);
         }
     }
@@ -562,6 +603,14 @@ static void console_refresh(TextConsole *s)
 
     if (s != active_console)
         return;
+    if (!s->ds->depth) {
+        s->text_x[0] = 0;
+        s->text_y[0] = 0;
+        s->text_x[1] = s->width - 1;
+        s->text_y[1] = s->height - 1;
+        s->cursor_invalidate = 1;
+        return;
+    }
 
     vga_fill_rect(s->ds, 0, 0, s->ds->width, s->ds->height,
                   color_table[0][COLOR_BLACK]);
@@ -586,7 +635,7 @@ static void console_scroll(int ydelta)
     int i, y1;
 
     s = active_console;
-    if (!s || !s->text_console)
+    if (!s || (s->console_type == GRAPHIC_CONSOLE))
         return;
 
     if (ydelta > 0) {
@@ -639,6 +688,14 @@ static void console_put_lf(TextConsole *s)
             c++;
         }
         if (s == active_console && s->y_displayed == s->y_base) {
+            if (!s->ds->depth) {
+                s->text_x[0] = 0;
+                s->text_y[0] = 0;
+                s->text_x[1] = s->width - 1;
+                s->text_y[1] = s->height - 1;
+                return;
+            }
+
             vga_bitblt(s->ds, 0, FONT_HEIGHT, 0, 0,
                        s->width * FONT_WIDTH,
                        (s->height - 1) * FONT_HEIGHT);
@@ -659,10 +716,6 @@ static void console_handle_escape(TextConsole *s)
 {
     int i;
 
-    if (s->nb_esc_params == 0) { /* ESC[m sets all attributes to default */
-        s->t_attrib = s->t_attrib_default;
-        return;
-    }
     for (i=0; i<s->nb_esc_params; i++) {
         switch (s->esc_params[i]) {
             case 0: /* reset all console attributes to default */
@@ -752,10 +805,21 @@ static void console_handle_escape(TextConsole *s)
     }
 }
 
+static void console_clear_xy(TextConsole *s, int x, int y)
+{
+    int y1 = (s->y_base + y) % s->total_height;
+    TextCell *c = &s->cells[y1 * s->width + x];
+    c->ch = ' ';
+    c->t_attrib = s->t_attrib_default;
+    c++;
+    update_xy(s, x, y);
+}
+
 static void console_putchar(TextConsole *s, int ch)
 {
     TextCell *c;
-    int y1, i, x;
+    int y1, i;
+    int x, y;
 
     switch(s->state) {
     case TTY_STATE_NORM:
@@ -781,22 +845,27 @@ static void console_putchar(TextConsole *s, int ch)
         case '\a':  /* alert aka. bell */
             /* TODO: has to be implemented */
             break;
+        case 14:
+            /* SI (shift in), character set 0 (ignored) */
+            break;
+        case 15:
+            /* SO (shift out), character set 1 (ignored) */
+            break;
         case 27:    /* esc (introducing an escape sequence) */
             s->state = TTY_STATE_ESC;
             break;
         default:
-            y1 = (s->y_base + s->y) % s->total_height;
-            if (s->x < s->width) {
-                c = &s->cells[y1 * s->width + s->x];
-                c->ch = ch;
-                c->t_attrib = s->t_attrib;
-            }
-            update_xy(s, s->x, s->y);
-            s->x++;
             if (s->x >= s->width) {
+                /* line wrap */
                 s->x = 0;
                 console_put_lf(s);
             }
+            y1 = (s->y_base + s->y) % s->total_height;
+            c = &s->cells[y1 * s->width + s->x];
+            c->ch = ch;
+            c->t_attrib = s->t_attrib;
+            update_xy(s, s->x, s->y);
+            s->x++;
             break;
         }
         break;
@@ -820,32 +889,150 @@ static void console_putchar(TextConsole *s, int ch)
             s->nb_esc_params++;
             if (ch == ';')
                 break;
+#ifdef DEBUG_CONSOLE
+            fprintf(stderr, "escape sequence CSI%d;%d%c, %d parameters\n",
+                    s->esc_params[0], s->esc_params[1], ch, s->nb_esc_params);
+#endif
             s->state = TTY_STATE_NORM;
             switch(ch) {
-            case 'D':
-                if (s->x > 0)
-                    s->x--;
+            case 'A':
+                /* move cursor up */
+                if (s->esc_params[0] == 0) {
+                    s->esc_params[0] = 1;
+                }
+                s->y -= s->esc_params[0];
+                if (s->y < 0) {
+                    s->y = 0;
+                }
+                break;
+            case 'B':
+                /* move cursor down */
+                if (s->esc_params[0] == 0) {
+                    s->esc_params[0] = 1;
+                }
+                s->y += s->esc_params[0];
+                if (s->y >= s->height) {
+                    s->y = s->height - 1;
+                }
                 break;
             case 'C':
-                if (s->x < (s->width - 1))
-                    s->x++;
+                /* move cursor right */
+                if (s->esc_params[0] == 0) {
+                    s->esc_params[0] = 1;
+                }
+                s->x += s->esc_params[0];
+                if (s->x >= s->width) {
+                    s->x = s->width - 1;
+                }
+                break;
+            case 'D':
+                /* move cursor left */
+                if (s->esc_params[0] == 0) {
+                    s->esc_params[0] = 1;
+                }
+                s->x -= s->esc_params[0];
+                if (s->x < 0) {
+                    s->x = 0;
+                }
+                break;
+            case 'G':
+                /* move cursor to column */
+                s->x = s->esc_params[0] - 1;
+                if (s->x < 0) {
+                    s->x = 0;
+                }
                 break;
+            case 'f':
+            case 'H':
+                /* move cursor to row, column */
+                s->x = s->esc_params[1] - 1;
+                if (s->x < 0) {
+                    s->x = 0;
+                }
+                s->y = s->esc_params[0] - 1;
+                if (s->y < 0) {
+                    s->y = 0;
+                }
+                break;
+            case 'J':
+                switch (s->esc_params[0]) {
+                case 0:
+                    /* clear to end of screen */
+                    for (y = s->y; y < s->height; y++) {
+                        for (x = 0; x < s->width; x++) {
+                            if (y == s->y && x < s->x) {
+                                continue;
+                            }
+                            console_clear_xy(s, x, y);
+                        }
+                    }
+                    break;
+                case 1:
+                    /* clear from beginning of screen */
+                    for (y = 0; y <= s->y; y++) {
+                        for (x = 0; x < s->width; x++) {
+                            if (y == s->y && x > s->x) {
+                                break;
+                            }
+                            console_clear_xy(s, x, y);
+                        }
+                    }
+                    break;
+                case 2:
+                    /* clear entire screen */
+                    for (y = 0; y <= s->height; y++) {
+                        for (x = 0; x < s->width; x++) {
+                            console_clear_xy(s, x, y);
+                        }
+                    }
+                break;
+                }
             case 'K':
+                switch (s->esc_params[0]) {
+                case 0:
                 /* clear to eol */
-                y1 = (s->y_base + s->y) % s->total_height;
                 for(x = s->x; x < s->width; x++) {
-                    c = &s->cells[y1 * s->width + x];
-                    c->ch = ' ';
-                    c->t_attrib = s->t_attrib_default;
-                    c++;
-                    update_xy(s, x, s->y);
+                        console_clear_xy(s, x, s->y);
                 }
                 break;
-            default:
+                case 1:
+                    /* clear from beginning of line */
+                    for (x = 0; x <= s->x; x++) {
+                        console_clear_xy(s, x, s->y);
+                    }
+                    break;
+                case 2:
+                    /* clear entire line */
+                    for(x = 0; x < s->width; x++) {
+                        console_clear_xy(s, x, s->y);
+                    }
                 break;
             }
+                break;
+            case 'm':
             console_handle_escape(s);
             break;
+            case 'n':
+                /* report cursor position */
+                /* TODO: send ESC[row;colR */
+                break;
+            case 's':
+                /* save cursor position */
+                s->x_saved = s->x;
+                s->y_saved = s->y;
+                break;
+            case 'u':
+                /* restore cursor position */
+                s->x = s->x_saved;
+                s->y = s->y_saved;
+                break;
+            default:
+#ifdef DEBUG_CONSOLE
+                fprintf(stderr, "unhandled escape character '%c'\n", ch);
+#endif
+                break;
+            }
+            break;
         }
     }
 }
@@ -859,17 +1046,10 @@ void console_select(unsigned int index)
     s = consoles[index];
     if (s) {
         active_console = s;
-        if (s->text_console) {
-            if (s->g_width != s->ds->width ||
-                s->g_height != s->ds->height) {
-                s->g_width = s->ds->width;
-                s->g_height = s->ds->height;
-                text_console_resize(s);
-            }
-            console_refresh(s);
-        } else {
-            vga_hw_invalidate();
-        }
+        if (s->g_width && s->g_height
+            && (s->g_width != s->ds->width || s->g_height != s->ds->height))
+            dpy_resize(s->ds, s->g_width, s->g_height);
+        vga_hw_invalidate();
     }
 }
 
@@ -886,16 +1066,6 @@ static int console_puts(CharDriverState *chr, const uint8_t *buf, int len)
     return len;
 }
 
-static void console_chr_add_read_handler(CharDriverState *chr,
-                                         IOCanRWHandler *fd_can_read,
-                                         IOReadHandler *fd_read, void *opaque)
-{
-    TextConsole *s = chr->opaque;
-    s->fd_can_read = fd_can_read;
-    s->fd_read = fd_read;
-    s->fd_opaque = opaque;
-}
-
 static void console_send_event(CharDriverState *chr, int event)
 {
     TextConsole *s = chr->opaque;
@@ -917,14 +1087,14 @@ static void kbd_send_chars(void *opaque)
     int len;
     uint8_t buf[16];
 
-    len = s->fd_can_read(s->fd_opaque);
+    len = qemu_chr_can_read(s->chr);
     if (len > s->out_fifo.count)
         len = s->out_fifo.count;
     if (len > 0) {
         if (len > sizeof(buf))
             len = sizeof(buf);
         qemu_fifo_read(&s->out_fifo, buf, len);
-        s->fd_read(s->fd_opaque, buf, len);
+        qemu_chr_read(s->chr, buf, len);
     }
     /* characters are pending: we send them a bit later (XXX:
        horrible, should change char device API) */
@@ -941,7 +1111,7 @@ void kbd_put_keysym(int keysym)
     int c;
 
     s = active_console;
-    if (!s || !s->text_console)
+    if (!s || (s->console_type == GRAPHIC_CONSOLE))
         return;
 
     switch(keysym) {
@@ -975,7 +1145,7 @@ void kbd_put_keysym(int keysym)
         } else {
                 *q++ = keysym;
         }
-        if (s->fd_read) {
+        if (s->chr->chr_read) {
             qemu_fifo_write(&s->out_fifo, buf, q - buf);
             kbd_send_chars(s);
         }
@@ -983,7 +1153,41 @@ void kbd_put_keysym(int keysym)
     }
 }
 
-static TextConsole *new_console(DisplayState *ds, int text)
+static void text_console_invalidate(void *opaque)
+{
+    TextConsole *s = (TextConsole *) opaque;
+
+    console_refresh(s);
+}
+
+static void text_console_update(void *opaque, console_ch_t *chardata)
+{
+    TextConsole *s = (TextConsole *) opaque;
+    int i, j, src;
+
+    if (s->text_x[0] <= s->text_x[1]) {
+        src = (s->y_base + s->text_y[0]) * s->width;
+        chardata += s->text_y[0] * s->width;
+        for (i = s->text_y[0]; i <= s->text_y[1]; i ++)
+            for (j = 0; j < s->width; j ++, src ++)
+                console_write_ch(chardata ++, s->cells[src].ch |
+                                (s->cells[src].t_attrib.fgcol << 12) |
+                                (s->cells[src].t_attrib.bgcol << 8) |
+                                (s->cells[src].t_attrib.bold << 21));
+        dpy_update(s->ds, s->text_x[0], s->text_y[0],
+                   s->text_x[1] - s->text_x[0], i - s->text_y[0]);
+        s->text_x[0] = s->width;
+        s->text_y[0] = s->height;
+        s->text_x[1] = 0;
+        s->text_y[1] = 0;
+    }
+    if (s->cursor_invalidate) {
+        dpy_cursor(s->ds, s->x, s->y);
+        s->cursor_invalidate = 0;
+    }
+}
+
+static TextConsole *new_console(DisplayState *ds, console_type_t console_type)
 {
     TextConsole *s;
     int i;
@@ -994,16 +1198,18 @@ static TextConsole *new_console(DisplayState *ds, int text)
     if (!s) {
         return NULL;
     }
-    if (!active_console || (active_console->text_console && !text))
+    if (!active_console || ((active_console->console_type != GRAPHIC_CONSOLE) &&
+        (console_type == GRAPHIC_CONSOLE))) {
         active_console = s;
+    }
     s->ds = ds;
-    s->text_console = text;
-    if (text) {
+    s->console_type = console_type;
+    if (console_type != GRAPHIC_CONSOLE) {
         consoles[nb_consoles++] = s;
     } else {
         /* HACK: Put graphical consoles before text consoles.  */
         for (i = nb_consoles; i > 0; i--) {
-            if (!consoles[i - 1]->text_console)
+            if (consoles[i - 1]->console_type == GRAPHIC_CONSOLE)
                 break;
             consoles[i] = consoles[i - 1];
         }
@@ -1015,65 +1221,98 @@ static TextConsole *new_console(DisplayState *ds, int text)
 TextConsole *graphic_console_init(DisplayState *ds, vga_hw_update_ptr update,
                                   vga_hw_invalidate_ptr invalidate,
                                   vga_hw_screen_dump_ptr screen_dump,
+                                  vga_hw_text_update_ptr text_update,
                                   void *opaque)
 {
     TextConsole *s;
 
-    s = new_console(ds, 0);
+    s = new_console(ds, GRAPHIC_CONSOLE);
     if (!s)
       return NULL;
     s->hw_update = update;
     s->hw_invalidate = invalidate;
     s->hw_screen_dump = screen_dump;
+    s->hw_text_update = text_update;
     s->hw = opaque;
     return s;
 }
 
 int is_graphic_console(void)
 {
-    return !active_console->text_console;
+    return active_console && active_console->console_type == GRAPHIC_CONSOLE;
 }
 
-CharDriverState *text_console_init(DisplayState *ds)
+void console_color_init(DisplayState *ds)
+{
+    int i, j;
+    for (j = 0; j < 2; j++) {
+        for (i = 0; i < 8; i++) {
+            color_table[j][i] = col_expand(ds, 
+                   vga_get_color(ds, color_table_rgb[j][i]));
+        }
+    }
+}
+
+CharDriverState *text_console_init(DisplayState *ds, const char *p)
 {
     CharDriverState *chr;
     TextConsole *s;
-    int i,j;
+    unsigned width;
+    unsigned height;
     static int color_inited;
 
     chr = qemu_mallocz(sizeof(CharDriverState));
     if (!chr)
         return NULL;
-    s = new_console(ds, 1);
+    s = new_console(ds, TEXT_CONSOLE);
     if (!s) {
         free(chr);
         return NULL;
     }
+    if (!p)
+        p = DEFAULT_MONITOR_SIZE;
+
     chr->opaque = s;
     chr->chr_write = console_puts;
-    chr->chr_add_read_handler = console_chr_add_read_handler;
     chr->chr_send_event = console_send_event;
 
+    s->chr = chr;
     s->out_fifo.buf = s->out_fifo_buf;
     s->out_fifo.buf_size = sizeof(s->out_fifo_buf);
     s->kbd_timer = qemu_new_timer(rt_clock, kbd_send_chars, s);
 
     if (!color_inited) {
         color_inited = 1;
-        for(j = 0; j < 2; j++) {
-            for(i = 0; i < 8; i++) {
-                color_table[j][i] = col_expand(s->ds,
-                        vga_get_color(s->ds, color_table_rgb[j][i]));
-            }
-        }
+        console_color_init(s->ds);
     }
     s->y_displayed = 0;
     s->y_base = 0;
     s->total_height = DEFAULT_BACKSCROLL;
     s->x = 0;
     s->y = 0;
-    s->g_width = s->ds->width;
-    s->g_height = s->ds->height;
+    width = s->ds->width;
+    height = s->ds->height;
+    if (p != 0) {
+        width = strtoul(p, (char **)&p, 10);
+        if (*p == 'C') {
+            p++;
+            width *= FONT_WIDTH;
+        }
+        if (*p == 'x') {
+            p++;
+            height = strtoul(p, (char **)&p, 10);
+            if (*p == 'C') {
+                p++;
+                height *= FONT_HEIGHT;
+            }
+        }
+    }
+    s->g_width = width;
+    s->g_height = height;
+
+    s->hw_invalidate = text_console_invalidate;
+    s->hw_text_update = text_console_update;
+    s->hw = s;
 
     /* Set text attribute defaults */
     s->t_attrib_default.bold = 0;
@@ -1088,5 +1327,19 @@ CharDriverState *text_console_init(DisplayState *ds)
     s->t_attrib = s->t_attrib_default;
     text_console_resize(s);
 
+    qemu_chr_reset(chr);
+
     return chr;
 }
+
+void qemu_console_resize(QEMUConsole *console, int width, int height)
+{
+    if (console->g_width != width || console->g_height != height
+        || !console->ds->data) {
+        console->g_width = width;
+        console->g_height = height;
+        if (active_console == console) {
+            dpy_resize(console->ds, width, height);
+        }
+    }
+}
diff --git a/console.h b/console.h
new file mode 100644
index 0000000..52dc4d8
--- /dev/null
+++ b/console.h
@@ -0,0 +1,195 @@
+#ifndef CONSOLE_H
+#define CONSOLE_H
+
+#include "qemu-char.h"
+
+/* keyboard/mouse support */
+
+#define MOUSE_EVENT_LBUTTON 0x01
+#define MOUSE_EVENT_RBUTTON 0x02
+#define MOUSE_EVENT_MBUTTON 0x04
+
+/* in ms */
+#if 1  /* ANDROID */
+#define GUI_REFRESH_INTERVAL (1000/60)  /* 60 frames/s is better */
+#else
+#define GUI_REFRESH_INTERVAL 30
+#endif
+
+typedef void QEMUPutKBDEvent(void *opaque, int keycode);
+typedef void QEMUPutKBDEventN(void *opaque, int*  keycodes, int  count);
+typedef void QEMUPutMouseEvent(void *opaque, int dx, int dy, int dz, int buttons_state);
+typedef void QEMUPutGenericEvent(void*  opaque, int  type, int  code, int  value);
+
+typedef struct QEMUPutMouseEntry {
+    QEMUPutMouseEvent *qemu_put_mouse_event;
+    void *qemu_put_mouse_event_opaque;
+    int qemu_put_mouse_event_absolute;
+    char *qemu_put_mouse_event_name;
+
+    /* used internally by qemu for handling mice */
+    struct QEMUPutMouseEntry *next;
+} QEMUPutMouseEntry;
+
+void qemu_add_kbd_event_handler(QEMUPutKBDEvent *func, void *opaque);
+QEMUPutMouseEntry *qemu_add_mouse_event_handler(QEMUPutMouseEvent *func,
+                                                void *opaque, int absolute,
+                                                const char *name);
+void qemu_remove_mouse_event_handler(QEMUPutMouseEntry *entry);
+
+void kbd_put_keycode(int keycode);
+void kbd_put_keycodes(int*  keycodes, int  count);
+void  kbd_generic_event(int  type, int code, int  value);
+void kbd_mouse_event(int dx, int dy, int dz, int buttons_state);
+int kbd_mouse_is_absolute(void);
+
+struct mouse_transform_info_s {
+    /* Touchscreen resolution */
+    int x;
+    int y;
+    /* Calibration values as used/generated by tslib */
+    int a[7];
+};
+
+void do_info_mice(void);
+void do_mouse_set(int index);
+
+/* keysym is a unicode code except for special keys (see QEMU_KEY_xxx
+   constants) */
+#define QEMU_KEY_ESC1(c) ((c) | 0xe100)
+#define QEMU_KEY_BACKSPACE  0x007f
+#define QEMU_KEY_UP         QEMU_KEY_ESC1('A')
+#define QEMU_KEY_DOWN       QEMU_KEY_ESC1('B')
+#define QEMU_KEY_RIGHT      QEMU_KEY_ESC1('C')
+#define QEMU_KEY_LEFT       QEMU_KEY_ESC1('D')
+#define QEMU_KEY_HOME       QEMU_KEY_ESC1(1)
+#define QEMU_KEY_END        QEMU_KEY_ESC1(4)
+#define QEMU_KEY_PAGEUP     QEMU_KEY_ESC1(5)
+#define QEMU_KEY_PAGEDOWN   QEMU_KEY_ESC1(6)
+#define QEMU_KEY_DELETE     QEMU_KEY_ESC1(3)
+
+#define QEMU_KEY_CTRL_UP         0xe400
+#define QEMU_KEY_CTRL_DOWN       0xe401
+#define QEMU_KEY_CTRL_LEFT       0xe402
+#define QEMU_KEY_CTRL_RIGHT      0xe403
+#define QEMU_KEY_CTRL_HOME       0xe404
+#define QEMU_KEY_CTRL_END        0xe405
+#define QEMU_KEY_CTRL_PAGEUP     0xe406
+#define QEMU_KEY_CTRL_PAGEDOWN   0xe407
+
+void kbd_put_keysym(int keysym);
+
+/* consoles */
+
+struct DisplayState {
+    uint8_t *data;
+    int linesize;
+    int depth;
+    int bgr; /* BGR color order instead of RGB. Only valid for depth == 32 */
+    int width;
+    int height;
+    void *opaque;
+    struct QEMUTimer *gui_timer;
+    uint64_t gui_timer_interval;
+    int idle; /* there is nothing to update (window invisible), set by vnc/sdl */
+
+    void (*dpy_update)(struct DisplayState *s, int x, int y, int w, int h);
+    void (*dpy_resize)(struct DisplayState *s, int w, int h);
+    void (*dpy_refresh)(struct DisplayState *s);
+    void (*dpy_copy)(struct DisplayState *s, int src_x, int src_y,
+                     int dst_x, int dst_y, int w, int h);
+    void (*dpy_fill)(struct DisplayState *s, int x, int y,
+                     int w, int h, uint32_t c);
+    void (*dpy_text_cursor)(struct DisplayState *s, int x, int y);
+    void (*mouse_set)(int x, int y, int on);
+    void (*cursor_define)(int width, int height, int bpp, int hot_x, int hot_y,
+                          uint8_t *image, uint8_t *mask);
+};
+
+static inline void dpy_update(DisplayState *s, int x, int y, int w, int h)
+{
+    s->dpy_update(s, x, y, w, h);
+}
+
+static inline void dpy_resize(DisplayState *s, int w, int h)
+{
+    s->dpy_resize(s, w, h);
+}
+
+static inline void dpy_cursor(DisplayState *s, int x, int y)
+{
+    if (s->dpy_text_cursor)
+        s->dpy_text_cursor(s, x, y);
+}
+
+typedef unsigned long console_ch_t;
+static inline void console_write_ch(console_ch_t *dest, uint32_t ch)
+{
+    cpu_to_le32wu((uint32_t *) dest, ch);
+}
+
+typedef void (*vga_hw_update_ptr)(void *);
+typedef void (*vga_hw_invalidate_ptr)(void *);
+typedef void (*vga_hw_screen_dump_ptr)(void *, const char *);
+typedef void (*vga_hw_text_update_ptr)(void *, console_ch_t *);
+
+TextConsole *graphic_console_init(DisplayState *ds, vga_hw_update_ptr update,
+                                  vga_hw_invalidate_ptr invalidate,
+                                  vga_hw_screen_dump_ptr screen_dump,
+                                  vga_hw_text_update_ptr text_update,
+                                  void *opaque);
+void vga_hw_update(void);
+void vga_hw_invalidate(void);
+void vga_hw_screen_dump(const char *filename);
+void vga_hw_text_update(console_ch_t *chardata);
+
+int is_graphic_console(void);
+CharDriverState *text_console_init(DisplayState *ds, const char *p);
+void console_select(unsigned int index);
+void console_color_init(DisplayState *ds);
+void qemu_console_resize(QEMUConsole *console, int width, int height);
+
+/* sdl.c */
+void sdl_display_init(DisplayState *ds, int full_screen, int no_frame);
+
+/* cocoa.m */
+void cocoa_display_init(DisplayState *ds, int full_screen);
+
+/* vnc.c */
+void vnc_display_init(DisplayState *ds);
+void vnc_display_close(DisplayState *ds);
+int vnc_display_open(DisplayState *ds, const char *display);
+int vnc_display_password(DisplayState *ds, const char *password);
+void do_info_vnc(void);
+
+/* curses.c */
+void curses_display_init(DisplayState *ds, int full_screen);
+
+/* x_keymap.c */
+extern uint8_t _translate_keycode(const int key);
+
+/* FIXME: term_printf et al should probably go elsewhere so everything
+   does not need to include console.h  */
+/* monitor.c */
+void monitor_init(CharDriverState *hd, int show_banner);
+void term_puts(const char *str);
+void term_vprintf(const char *fmt, va_list ap);
+void term_printf(const char *fmt, ...) __attribute__ ((__format__ (__printf__, 1, 2)));
+void term_print_filename(const char *filename);
+void term_flush(void);
+void term_print_help(void);
+void monitor_readline(const char *prompt, int is_password,
+                      char *buf, int buf_size);
+
+/* readline.c */
+typedef void ReadLineFunc(void *opaque, const char *str);
+
+extern int completion_index;
+void add_completion(const char *str);
+void readline_handle_byte(int ch);
+void readline_find_completion(const char *cmdline);
+const char *readline_get_history(unsigned int index);
+void readline_start(const char *prompt, int is_password,
+                    ReadLineFunc *readline_func, void *opaque);
+
+#endif
diff --git a/cpu-all.h b/cpu-all.h
index d4fd2a7..8f4cb3c 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -1,6 +1,6 @@
 /*
  * defines common to all virtual CPUs
- * 
+ *
  *  Copyright (c) 2003 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -20,24 +20,25 @@
 #ifndef CPU_ALL_H
 #define CPU_ALL_H
 
-#if defined(__arm__) || defined(__sparc__)
+#if defined(__arm__) || defined(__sparc__) || defined(__mips__) || defined(__hppa__)
 #define WORDS_ALIGNED
 #endif
 
-/* some important defines: 
- * 
+/* some important defines:
+ *
  * WORDS_ALIGNED : if defined, the host cpu can only make word aligned
  * memory accesses.
- * 
+ *
  * WORDS_BIGENDIAN : if defined, the host cpu is big endian and
  * otherwise little endian.
- * 
+ *
  * (TARGET_WORDS_ALIGNED : same for target cpu (not supported yet))
- * 
+ *
  * TARGET_WORDS_BIGENDIAN : same for target cpu
  */
 
 #include "bswap.h"
+#include "softfloat.h"
 
 #if defined(WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
 #define BSWAP_NEEDED
@@ -116,6 +117,11 @@ static inline void tswap64s(uint64_t *s)
 #define bswaptls(s) bswap64s(s)
 #endif
 
+typedef union {
+    float32 f;
+    uint32_t l;
+} CPU_FloatU;
+
 /* NOTE: arm FPA is horrible as double 32 bit words are stored in big
    endian ! */
 typedef union {
@@ -135,6 +141,36 @@ typedef union {
     uint64_t ll;
 } CPU_DoubleU;
 
+#ifdef TARGET_SPARC
+typedef union {
+    float128 q;
+#if defined(WORDS_BIGENDIAN) \
+    || (defined(__arm__) && !defined(__VFP_FP__) && !defined(CONFIG_SOFTFLOAT))
+    struct {
+        uint32_t upmost;
+        uint32_t upper;
+        uint32_t lower;
+        uint32_t lowest;
+    } l;
+    struct {
+        uint64_t upper;
+        uint64_t lower;
+    } ll;
+#else
+    struct {
+        uint32_t lowest;
+        uint32_t lower;
+        uint32_t upper;
+        uint32_t upmost;
+    } l;
+    struct {
+        uint64_t lower;
+        uint64_t upper;
+    } ll;
+#endif
+} CPU_QuadU;
+#endif
+
 /* CPU memory access without any memory or io remapping */
 
 /*
@@ -147,7 +183,7 @@ typedef union {
  * type is:
  * (empty): integer access
  *   f    : float access
- * 
+ *
  * sign is:
  * (empty): for floats or 32 bit size
  *   u    : unsigned
@@ -158,7 +194,7 @@ typedef union {
  *   w: 16 bits
  *   l: 32 bits
  *   q: 64 bits
- * 
+ *
  * endian is:
  * (empty): target cpu endianness or 8 bit access
  *   r    : reversed target cpu endianness (not implemented yet)
@@ -422,7 +458,7 @@ static inline uint64_t ldq_be_p(void *ptr)
 {
     uint32_t a,b;
     a = ldl_be_p(ptr);
-    b = ldl_be_p(ptr+4);
+    b = ldl_be_p((uint8_t *)ptr + 4);
     return (((uint64_t)a<<32)|b);
 }
 
@@ -459,7 +495,7 @@ static inline void stl_be_p(void *ptr, int v)
 static inline void stq_be_p(void *ptr, uint64_t v)
 {
     stl_be_p(ptr, v >> 32);
-    stl_be_p(ptr + 4, v);
+    stl_be_p((uint8_t *)ptr + 4, v);
 }
 
 /* float access */
@@ -488,7 +524,7 @@ static inline float64 ldfq_be_p(void *ptr)
 {
     CPU_DoubleU u;
     u.l.upper = ldl_be_p(ptr);
-    u.l.lower = ldl_be_p(ptr + 4);
+    u.l.lower = ldl_be_p((uint8_t *)ptr + 4);
     return u.d;
 }
 
@@ -497,7 +533,7 @@ static inline void stfq_be_p(void *ptr, float64 v)
     CPU_DoubleU u;
     u.d = v;
     stl_be_p(ptr, u.l.upper);
-    stl_be_p(ptr + 4, u.l.lower);
+    stl_be_p((uint8_t *)ptr + 4, u.l.lower);
 }
 
 #else
@@ -599,7 +635,7 @@ static inline void stfq_be_p(void *ptr, float64 v)
 
 /* All direct uses of g2h and h2g need to go away for usermode softmmu.  */
 #define g2h(x) ((void *)((unsigned long)(x) + GUEST_BASE))
-#define h2g(x) ((target_ulong)(x - GUEST_BASE))
+#define h2g(x) ((target_ulong)((unsigned long)(x) - GUEST_BASE))
 
 #define saddr(x) g2h(x)
 #define laddr(x) g2h(x)
@@ -627,7 +663,7 @@ static inline void stfq_be_p(void *ptr, float64 v)
 #define stfq_raw(p, v) stfq_p(saddr((p)), v)
 
 
-#if defined(CONFIG_USER_ONLY) 
+#if defined(CONFIG_USER_ONLY)
 
 /* if user mode, no other memory access functions */
 #define ldub(p) ldub_raw(p)
@@ -650,12 +686,14 @@ static inline void stfq_be_p(void *ptr, float64 v)
 #define lduw_code(p) lduw_raw(p)
 #define ldsw_code(p) ldsw_raw(p)
 #define ldl_code(p) ldl_raw(p)
+#define ldq_code(p) ldq_raw(p)
 
 #define ldub_kernel(p) ldub_raw(p)
 #define ldsb_kernel(p) ldsb_raw(p)
 #define lduw_kernel(p) lduw_raw(p)
 #define ldsw_kernel(p) ldsw_raw(p)
 #define ldl_kernel(p) ldl_raw(p)
+#define ldq_kernel(p) ldq_raw(p)
 #define ldfl_kernel(p) ldfl_raw(p)
 #define ldfq_kernel(p) ldfq_raw(p)
 #define stb_kernel(p, v) stb_raw(p, v)
@@ -689,78 +727,31 @@ extern unsigned long qemu_host_page_mask;
 #define PAGE_VALID     0x0008
 /* original state of the write flag (used when tracking self-modifying
    code */
-#define PAGE_WRITE_ORG 0x0010 
+#define PAGE_WRITE_ORG 0x0010
+#define PAGE_RESERVED  0x0020
 
 void page_dump(FILE *f);
 int page_get_flags(target_ulong address);
 void page_set_flags(target_ulong start, target_ulong end, int flags);
-void page_unprotect_range(target_ulong data, target_ulong data_size);
-
-#define SINGLE_CPU_DEFINES
-#ifdef SINGLE_CPU_DEFINES
-
-#if defined(TARGET_I386)
-
-#define CPUState CPUX86State
-#define cpu_init cpu_x86_init
-#define cpu_exec cpu_x86_exec
-#define cpu_gen_code cpu_x86_gen_code
-#define cpu_signal_handler cpu_x86_signal_handler
-
-#elif defined(TARGET_ARM)
-
-#define CPUState CPUARMState
-#define cpu_init cpu_arm_init
-#define cpu_exec cpu_arm_exec
-#define cpu_gen_code cpu_arm_gen_code
-#define cpu_signal_handler cpu_arm_signal_handler
-
-#elif defined(TARGET_SPARC)
-
-#define CPUState CPUSPARCState
-#define cpu_init cpu_sparc_init
-#define cpu_exec cpu_sparc_exec
-#define cpu_gen_code cpu_sparc_gen_code
-#define cpu_signal_handler cpu_sparc_signal_handler
-
-#elif defined(TARGET_PPC)
-
-#define CPUState CPUPPCState
-#define cpu_init cpu_ppc_init
-#define cpu_exec cpu_ppc_exec
-#define cpu_gen_code cpu_ppc_gen_code
-#define cpu_signal_handler cpu_ppc_signal_handler
-
-#elif defined(TARGET_MIPS)
-#define CPUState CPUMIPSState
-#define cpu_init cpu_mips_init
-#define cpu_exec cpu_mips_exec
-#define cpu_gen_code cpu_mips_gen_code
-#define cpu_signal_handler cpu_mips_signal_handler
-
-#elif defined(TARGET_SH4)
-#define CPUState CPUSH4State
-#define cpu_init cpu_sh4_init
-#define cpu_exec cpu_sh4_exec
-#define cpu_gen_code cpu_sh4_gen_code
-#define cpu_signal_handler cpu_sh4_signal_handler
+int page_check_range(target_ulong start, target_ulong len, int flags);
 
-#else
-
-#error unsupported target CPU
-
-#endif
-
-#endif /* SINGLE_CPU_DEFINES */
+void cpu_exec_init_all(unsigned long tb_size);
+CPUState *cpu_copy(CPUState *env);
 
-void cpu_dump_state(CPUState *env, FILE *f, 
+void cpu_dump_state(CPUState *env, FILE *f,
                     int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
                     int flags);
+void cpu_dump_statistics (CPUState *env, FILE *f,
+                          int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
+                          int flags);
 
-void cpu_abort(CPUState *env, const char *fmt, ...);
+void cpu_abort(CPUState *env, const char *fmt, ...)
+    __attribute__ ((__format__ (__printf__, 2, 3)))
+    __attribute__ ((__noreturn__));
 extern CPUState *first_cpu;
 extern CPUState *cpu_single_env;
-extern int code_copy_enabled;
+extern int64_t qemu_icount;
+extern int use_icount;
 
 #define CPU_INTERRUPT_EXIT   0x01 /* wants exit from main loop */
 #define CPU_INTERRUPT_HARD   0x02 /* hardware interrupt pending */
@@ -768,21 +759,34 @@ extern int code_copy_enabled;
 #define CPU_INTERRUPT_TIMER  0x08 /* internal timer exception pending */
 #define CPU_INTERRUPT_FIQ    0x10 /* Fast interrupt pending.  */
 #define CPU_INTERRUPT_HALT   0x20 /* CPU halt wanted */
+#define CPU_INTERRUPT_SMI    0x40 /* (x86 only) SMI interrupt pending */
+#define CPU_INTERRUPT_DEBUG  0x80 /* Debug event occured.  */
+#define CPU_INTERRUPT_VIRQ   0x100 /* virtual interrupt pending.  */
+#define CPU_INTERRUPT_NMI    0x200 /* NMI pending. */
 
 void cpu_interrupt(CPUState *s, int mask);
 void cpu_reset_interrupt(CPUState *env, int mask);
 
+int cpu_watchpoint_insert(CPUState *env, target_ulong addr, int type);
+int cpu_watchpoint_remove(CPUState *env, target_ulong addr);
+void cpu_watchpoint_remove_all(CPUState *env);
 int cpu_breakpoint_insert(CPUState *env, target_ulong pc);
 int cpu_breakpoint_remove(CPUState *env, target_ulong pc);
+void cpu_breakpoint_remove_all(CPUState *env);
+
+#define SSTEP_ENABLE  0x1  /* Enable simulated HW single stepping */
+#define SSTEP_NOIRQ   0x2  /* Do not use IRQ while single stepping */
+#define SSTEP_NOTIMER 0x4  /* Do not Timers while single stepping */
+
 void cpu_single_step(CPUState *env, int enabled);
 void cpu_reset(CPUState *s);
 
 /* Return the physical page corresponding to a virtual one. Use it
    only for debugging because no protection checks are done. Return -1
    if no page found. */
-target_ulong cpu_get_phys_page_debug(CPUState *env, target_ulong addr);
+target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr);
 
-#define CPU_LOG_TB_OUT_ASM (1 << 0) 
+#define CPU_LOG_TB_OUT_ASM (1 << 0)
 #define CPU_LOG_TB_IN_ASM  (1 << 1)
 #define CPU_LOG_TB_OP      (1 << 2)
 #define CPU_LOG_TB_OP_OPT  (1 << 3)
@@ -818,33 +822,59 @@ int cpu_inw(CPUState *env, int addr);
 int cpu_inl(CPUState *env, int addr);
 #endif
 
+/* address in the RAM (different from a physical address) */
+#ifdef USE_KQEMU
+typedef uint32_t ram_addr_t;
+#else
+typedef unsigned long ram_addr_t;
+#endif
+
 /* memory API */
 
-extern int phys_ram_size;
+extern ram_addr_t phys_ram_size;
 extern int phys_ram_fd;
 extern uint8_t *phys_ram_base;
 extern uint8_t *phys_ram_dirty;
+extern ram_addr_t ram_size;
 
 /* physical memory access */
-#define TLB_INVALID_MASK   (1 << 3)
-#define IO_MEM_SHIFT       4
+
+/* MMIO pages are identified by a combination of an IO device index and
+   3 flags.  The ROMD code stores the page ram offset in iotlb entry, 
+   so only a limited number of ids are avaiable.  */
+
+#define IO_MEM_SHIFT       3
 #define IO_MEM_NB_ENTRIES  (1 << (TARGET_PAGE_BITS  - IO_MEM_SHIFT))
 
 #define IO_MEM_RAM         (0 << IO_MEM_SHIFT) /* hardcoded offset */
 #define IO_MEM_ROM         (1 << IO_MEM_SHIFT) /* hardcoded offset */
 #define IO_MEM_UNASSIGNED  (2 << IO_MEM_SHIFT)
-#define IO_MEM_NOTDIRTY    (4 << IO_MEM_SHIFT) /* used internally, never use directly */
-/* acts like a ROM when read and like a device when written. As an
-   exception, the write memory callback gets the ram offset instead of
-   the physical address */
+#define IO_MEM_NOTDIRTY    (3 << IO_MEM_SHIFT)
+
+/* Acts like a ROM when read and like a device when written.  */
 #define IO_MEM_ROMD        (1)
+#define IO_MEM_SUBPAGE     (2)
+#define IO_MEM_SUBWIDTH    (4)
+
+/* Flags stored in the low bits of the TLB virtual address.  These are
+   defined so that fast path ram access is all zeros.  */
+/* Zero if TLB entry is valid.  */
+#define TLB_INVALID_MASK   (1 << 3)
+/* Set if TLB entry references a clean RAM page.  The iotlb entry will
+   contain the page physical address.  */
+#define TLB_NOTDIRTY    (1 << 4)
+/* Set if TLB entry is an IO callback.  */
+#define TLB_MMIO        (1 << 5)
 
 typedef void CPUWriteMemoryFunc(void *opaque, target_phys_addr_t addr, uint32_t value);
 typedef uint32_t CPUReadMemoryFunc(void *opaque, target_phys_addr_t addr);
 
-void cpu_register_physical_memory(target_phys_addr_t start_addr, 
-                                  unsigned long size,
-                                  unsigned long phys_offset);
+void cpu_register_physical_memory(target_phys_addr_t start_addr,
+                                  ram_addr_t size,
+                                  ram_addr_t phys_offset);
+ram_addr_t cpu_get_physical_page_desc(target_phys_addr_t addr);
+ram_addr_t qemu_ram_alloc(ram_addr_t);
+void qemu_ram_free(ram_addr_t addr);
 int cpu_register_io_memory(int io_index,
                            CPUReadMemoryFunc **mem_read,
                            CPUWriteMemoryFunc **mem_write,
@@ -854,12 +884,12 @@ CPUReadMemoryFunc **cpu_get_io_memory_read(int io_index);
 
 void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
                             int len, int is_write);
-static inline void cpu_physical_memory_read(target_phys_addr_t addr, 
+static inline void cpu_physical_memory_read(target_phys_addr_t addr,
                                             uint8_t *buf, int len)
 {
     cpu_physical_memory_rw(addr, buf, len, 0);
 }
-static inline void cpu_physical_memory_write(target_phys_addr_t addr, 
+static inline void cpu_physical_memory_write(target_phys_addr_t addr,
                                              const uint8_t *buf, int len)
 {
     cpu_physical_memory_rw(addr, (uint8_t *)buf, len, 1);
@@ -869,14 +899,15 @@ uint32_t lduw_phys(target_phys_addr_t addr);
 uint32_t ldl_phys(target_phys_addr_t addr);
 uint64_t ldq_phys(target_phys_addr_t addr);
 void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val);
+void stq_phys_notdirty(target_phys_addr_t addr, uint64_t val);
 void stb_phys(target_phys_addr_t addr, uint32_t val);
 void stw_phys(target_phys_addr_t addr, uint32_t val);
 void stl_phys(target_phys_addr_t addr, uint32_t val);
 void stq_phys(target_phys_addr_t addr, uint64_t val);
 
-void cpu_physical_memory_write_rom(target_phys_addr_t addr, 
+void cpu_physical_memory_write_rom(target_phys_addr_t addr,
                                    const uint8_t *buf, int len);
-int cpu_memory_rw_debug(CPUState *env, target_ulong addr, 
+int cpu_memory_rw_debug(CPUState *env, target_ulong addr,
                         uint8_t *buf, int len, int is_write);
 
 #define VGA_DIRTY_FLAG  0x01
@@ -888,7 +919,7 @@ static inline int cpu_physical_memory_is_dirty(ram_addr_t addr)
     return phys_ram_dirty[addr >> TARGET_PAGE_BITS] == 0xff;
 }
 
-static inline int cpu_physical_memory_get_dirty(ram_addr_t addr, 
+static inline int cpu_physical_memory_get_dirty(ram_addr_t addr,
                                                 int dirty_flags)
 {
     return phys_ram_dirty[addr >> TARGET_PAGE_BITS] & dirty_flags;
@@ -911,14 +942,14 @@ void dump_exec_info(FILE *f,
 
 #if defined(__powerpc__)
 
-static inline uint32_t get_tbl(void) 
+static inline uint32_t get_tbl(void)
 {
     uint32_t tbl;
     asm volatile("mftb %0" : "=r" (tbl));
     return tbl;
 }
 
-static inline uint32_t get_tbu(void) 
+static inline uint32_t get_tbu(void)
 {
 	uint32_t tbl;
 	asm volatile("mftbu %0" : "=r" (tbl));
@@ -959,6 +990,15 @@ static inline int64_t cpu_get_real_ticks(void)
     return val;
 }
 
+#elif defined(__hppa__)
+
+static inline int64_t cpu_get_real_ticks(void)
+{
+    int val;
+    asm volatile ("mfctl %%cr16, %0" : "=r"(val));
+    return val;
+}
+
 #elif defined(__ia64)
 
 static inline int64_t cpu_get_real_ticks(void)
@@ -977,7 +1017,7 @@ static inline int64_t cpu_get_real_ticks(void)
     return val;
 }
 
-#elif defined(__sparc__) && defined(HOST_SOLARIS)
+#elif defined(__sparc_v8plus__) || defined(__sparc_v8plusa__) || defined(__sparc_v9__)
 
 static inline int64_t cpu_get_real_ticks (void)
 {
@@ -998,6 +1038,36 @@ static inline int64_t cpu_get_real_ticks (void)
         return rval.i64;
 #endif
 }
+
+#elif defined(__mips__)
+
+static inline int64_t cpu_get_real_ticks(void)
+{
+#if __mips_isa_rev >= 2
+    uint32_t count;
+    static uint32_t cyc_per_count = 0;
+
+    if (!cyc_per_count)
+        __asm__ __volatile__("rdhwr %0, $3" : "=r" (cyc_per_count));
+
+    __asm__ __volatile__("rdhwr %1, $2" : "=r" (count));
+    return (int64_t)(count * cyc_per_count);
+#else
+    /* FIXME */
+    static int64_t ticks = 0;
+    return ticks++;
+#endif
+}
+
+#else
+/* The host CPU doesn't have an easily accessible cycle counter.
+   Just return a monotonically increasing value.  This will be
+   totally wrong, but hopefully better than nothing.  */
+static inline int64_t cpu_get_real_ticks (void)
+{
+    static int64_t ticks = 0;
+    return ticks++;
+}
 #endif
 
 /* profiling */
@@ -1015,7 +1085,6 @@ extern int64_t dev_time;
 extern int64_t kqemu_ret_int_count;
 extern int64_t kqemu_ret_excp_count;
 extern int64_t kqemu_ret_intr_count;
-
 #endif
 
 #endif /* CPU_ALL_H */
diff --git a/cpu-defs.h b/cpu-defs.h
index 674c0bd..108d395 100644
--- a/cpu-defs.h
+++ b/cpu-defs.h
@@ -1,6 +1,6 @@
 /*
  * common defines for all CPUs
- * 
+ *
  * Copyright (c) 2003 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -29,7 +29,7 @@
 #error TARGET_LONG_BITS must be defined before including this header
 #endif
 
-#ifndef TARGET_PHYS_ADDR_BITS 
+#ifndef TARGET_PHYS_ADDR_BITS
 #if TARGET_LONG_BITS >= HOST_LONG_BITS
 #define TARGET_PHYS_ADDR_BITS TARGET_LONG_BITS
 #else
@@ -44,10 +44,14 @@
 typedef int32_t target_long;
 typedef uint32_t target_ulong;
 #define TARGET_FMT_lx "%08x"
+#define TARGET_FMT_ld "%d"
+#define TARGET_FMT_lu "%u"
 #elif TARGET_LONG_SIZE == 8
 typedef int64_t target_long;
 typedef uint64_t target_ulong;
 #define TARGET_FMT_lx "%016" PRIx64
+#define TARGET_FMT_ld "%" PRId64
+#define TARGET_FMT_lu "%" PRIu64
 #else
 #error TARGET_LONG_SIZE undefined
 #endif
@@ -60,15 +64,14 @@ typedef uint64_t target_ulong;
 
 #if TARGET_PHYS_ADDR_BITS == 32
 typedef uint32_t target_phys_addr_t;
+#define TARGET_FMT_plx "%08x"
 #elif TARGET_PHYS_ADDR_BITS == 64
 typedef uint64_t target_phys_addr_t;
+#define TARGET_FMT_plx "%016" PRIx64
 #else
 #error TARGET_PHYS_ADDR_BITS undefined
 #endif
 
-/* address in the RAM (different from a physical address) */
-typedef unsigned long ram_addr_t;
-
 #define HOST_LONG_SIZE (HOST_LONG_BITS / 8)
 
 #define EXCP_INTERRUPT 	0x10000 /* async interruption */
@@ -76,40 +79,94 @@ typedef unsigned long ram_addr_t;
 #define EXCP_DEBUG      0x10002 /* cpu stopped after a breakpoint or singlestep */
 #define EXCP_HALTED     0x10003 /* cpu is halted (waiting for external event) */
 #define MAX_BREAKPOINTS 32
+#define MAX_WATCHPOINTS 32
 
 #define TB_JMP_CACHE_BITS 12
 #define TB_JMP_CACHE_SIZE (1 << TB_JMP_CACHE_BITS)
 
+/* Only the bottom TB_JMP_PAGE_BITS of the jump cache hash bits vary for
+   addresses on the same page.  The top bits are the same.  This allows
+   TLB invalidation to quickly clear a subset of the hash table.  */
+#define TB_JMP_PAGE_BITS (TB_JMP_CACHE_BITS / 2)
+#define TB_JMP_PAGE_SIZE (1 << TB_JMP_PAGE_BITS)
+#define TB_JMP_ADDR_MASK (TB_JMP_PAGE_SIZE - 1)
+#define TB_JMP_PAGE_MASK (TB_JMP_CACHE_SIZE - TB_JMP_PAGE_SIZE)
+
 #define CPU_TLB_BITS 8
 #define CPU_TLB_SIZE (1 << CPU_TLB_BITS)
 
+#if TARGET_PHYS_ADDR_BITS == 32 && TARGET_LONG_BITS == 32
+#define CPU_TLB_ENTRY_BITS 4
+#else
+#define CPU_TLB_ENTRY_BITS 5
+#endif
+
 typedef struct CPUTLBEntry {
-    /* bit 31 to TARGET_PAGE_BITS : virtual address 
-       bit TARGET_PAGE_BITS-1..IO_MEM_SHIFT : if non zero, memory io
-                                              zone number
+    /* bit TARGET_LONG_BITS to TARGET_PAGE_BITS : virtual address
+       bit TARGET_PAGE_BITS-1..4  : Nonzero for accesses that should not
+                                    go directly to ram.
        bit 3                      : indicates that the entry is invalid
        bit 2..0                   : zero
     */
-    target_ulong addr_read; 
-    target_ulong addr_write; 
-    target_ulong addr_code; 
-    /* addend to virtual address to get physical address */
-    target_phys_addr_t addend; 
+    target_ulong addr_read;
+    target_ulong addr_write;
+    target_ulong addr_code;
+    /* Addend to virtual address to get physical address.  IO accesses
+       use the correcponding iotlb value.  */
+#if TARGET_PHYS_ADDR_BITS == 64
+    /* on i386 Linux make sure it is aligned */
+    target_phys_addr_t addend __attribute__((aligned(8)));
+#else
+    target_phys_addr_t addend;
+#endif
+    /* padding to get a power of two size */
+    uint8_t dummy[(1 << CPU_TLB_ENTRY_BITS) - 
+                  (sizeof(target_ulong) * 3 + 
+                   ((-sizeof(target_ulong) * 3) & (sizeof(target_phys_addr_t) - 1)) + 
+                   sizeof(target_phys_addr_t))];
 } CPUTLBEntry;
 
+#ifdef WORDS_BIGENDIAN
+typedef struct icount_decr_u16 {
+    uint16_t high;
+    uint16_t low;
+} icount_decr_u16;
+#else
+typedef struct icount_decr_u16 {
+    uint16_t low;
+    uint16_t high;
+} icount_decr_u16;
+#endif
+
+#define CPU_TEMP_BUF_NLONGS 128
 #define CPU_COMMON                                                      \
     struct TranslationBlock *current_tb; /* currently executing TB  */  \
     /* soft mmu support */                                              \
-    /* in order to avoid passing too many arguments to the memory       \
-       write helpers, we store some rarely used information in the CPU  \
+    /* in order to avoid passing too many arguments to the MMIO         \
+       helpers, we store some rarely used information in the CPU        \
        context) */                                                      \
-    unsigned long mem_write_pc; /* host pc at which the memory was      \
-                                   written */                           \
-    target_ulong mem_write_vaddr; /* target virtual addr at which the   \
-                                     memory was written */              \
-    /* 0 = kernel, 1 = user */                                          \
-    CPUTLBEntry tlb_table[2][CPU_TLB_SIZE];                             \
+    unsigned long mem_io_pc; /* host pc at which the memory was         \
+                                accessed */                             \
+    target_ulong mem_io_vaddr; /* target virtual addr at which the      \
+                                     memory was accessed */             \
+    uint32_t halted; /* Nonzero if the CPU is in suspend state */       \
+    uint32_t interrupt_request;                                         \
+    /* The meaning of the MMU modes is defined in the target code. */   \
+    CPUTLBEntry tlb_table[NB_MMU_MODES][CPU_TLB_SIZE];                  \
+    target_phys_addr_t iotlb[NB_MMU_MODES][CPU_TLB_SIZE];               \
     struct TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];           \
+    /* buffer for temporaries in the code generator */                  \
+    long temp_buf[CPU_TEMP_BUF_NLONGS];                                 \
+                                                                        \
+    int64_t icount_extra; /* Instructions until next timer event.  */   \
+    /* Number of cycles left, with interrupt flag in high bit.          \
+       This allows a single read-compare-cbranch-write sequence to test \
+       for both decrementer underflow and exceptions.  */               \
+    union {                                                             \
+        uint32_t u32;                                                   \
+        icount_decr_u16 u16;                                            \
+    } icount_decr;                                                      \
+    uint32_t can_do_io; /* nonzero if memory mapped IO is safe.  */     \
                                                                         \
     /* from this point: preserved by CPU reset */                       \
     /* ice debug support */                                             \
@@ -117,9 +174,25 @@ typedef struct CPUTLBEntry {
     int nb_breakpoints;                                                 \
     int singlestep_enabled;                                             \
                                                                         \
+    struct {                                                            \
+        target_ulong vaddr;                                             \
+        int type; /* PAGE_READ/PAGE_WRITE */                            \
+    } watchpoint[MAX_WATCHPOINTS];                                      \
+    int nb_watchpoints;                                                 \
+    int watchpoint_hit;                                                 \
+                                                                        \
+    /* Core interrupt code */                                           \
+    jmp_buf jmp_env;                                                    \
+    int exception_index;                                                \
+                                                                        \
+    int user_mode_only;                                                 \
+                                                                        \
     void *next_cpu; /* next CPU sharing TB cache */                     \
     int cpu_index; /* CPU index (informative) */                        \
+    int running; /* Nonzero if cpu is currently running(usermode).  */  \
     /* user data */                                                     \
-    void *opaque;
+    void *opaque;                                                       \
+                                                                        \
+    const char *cpu_model_str;
 
 #endif
diff --git a/cpu-exec.c b/cpu-exec.c
index 8d733bd..8637e2a 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -18,24 +18,10 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 #include "config.h"
+#define CPU_NO_GLOBAL_REGS
 #include "exec.h"
 #include "disas.h"
-
-#ifdef _WIN32
-#define WIN32_LEAN_AND_MEAN
-#include <windows.h>
-#endif
-
-#ifndef _WIN32
-#include <unistd.h>
-#endif
-
-extern int  qemu_milli_needed;
-extern int  qemu_milli_check(void);
-extern void qemu_check_interrupts(void);
-
-extern int  qemu_cpu_delay;
-extern int  qemu_cpu_delay_count;
+#include "tcg.h"
 
 #if !defined(CONFIG_SOFTMMU)
 #undef EAX
@@ -51,19 +37,26 @@ extern int  qemu_cpu_delay_count;
 #include <sys/ucontext.h>
 #endif
 
+#if defined(__sparc__) && !defined(HOST_SOLARIS)
+// Work around ugly bugs in glibc that mangle global register contents
+#undef env
+#define env cpu_single_env
+#endif
+
 int tb_invalidated_flag;
 
 //#define DEBUG_EXEC
 //#define DEBUG_SIGNAL
 
-#if defined(TARGET_ARM) || defined(TARGET_SPARC)
-/* XXX: unify with i386 target */
 void cpu_loop_exit(void)
 {
+    /* NOTE: the register at this point must be saved by hand because
+       longjmp restore them */
+    regs_to_env();
     longjmp(env->jmp_env, 1);
 }
-#endif
-#if !(defined(TARGET_SPARC) || defined(TARGET_SH4))
+
+#if !(defined(TARGET_SPARC) || defined(TARGET_SH4) || defined(TARGET_M68K))
 #define reg_T2
 #endif
 
@@ -89,18 +82,40 @@ void cpu_resume_from_signal(CPUState *env1, void *puc)
     longjmp(env->jmp_env, 1);
 }
 
+/* Execute the code without caching the generated code. An interpreter
+   could be used if available. */
+static void cpu_exec_nocache(int max_cycles, TranslationBlock *orig_tb)
+{
+    unsigned long next_tb;
+    TranslationBlock *tb;
+
+    /* Should never happen.
+       We only end up here when an existing TB is too long.  */
+    if (max_cycles > CF_COUNT_MASK)
+        max_cycles = CF_COUNT_MASK;
+
+    tb = tb_gen_code(env, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
+                     max_cycles);
+    env->current_tb = tb;
+    /* execute the generated code */
+    next_tb = tcg_qemu_tb_exec(tb->tc_ptr);
+
+    if ((next_tb & 3) == 2) {
+        /* Restore PC.  This may happen if async event occurs before
+           the TB starts executing.  */
+        CPU_PC_FROM_TB(env, tb);
+    }
+    tb_phys_invalidate(tb, -1);
+    tb_free(tb);
+}
 
 static TranslationBlock *tb_find_slow(target_ulong pc,
                                       target_ulong cs_base,
-                                      unsigned int flags)
+                                      uint64_t flags)
 {
     TranslationBlock *tb, **ptb1;
-    int code_gen_size;
     unsigned int h;
     target_ulong phys_pc, phys_page1, phys_page2, virt_page2;
-    uint8_t *tc_ptr;
-
-    spin_lock(&tb_lock);
 
     tb_invalidated_flag = 0;
 
@@ -134,39 +149,12 @@ static TranslationBlock *tb_find_slow(target_ulong pc,
         ptb1 = &tb->phys_hash_next;
     }
  not_found:
-    /* if no translated code available, then translate it now */
-    tb = tb_alloc(pc);
-    if (!tb) {
-        /* flush must be done */
-        tb_flush(env);
-        /* cannot fail at this point */
-        tb = tb_alloc(pc);
-        /* don't forget to invalidate previous TB info */
-        tb_invalidated_flag = 1;
-    }
-    tc_ptr = code_gen_ptr;
-    tb->tc_ptr = tc_ptr;
-    tb->cs_base = cs_base;
-    tb->flags = flags;
-#ifdef CONFIG_TRACE
-    tb->bb_rec = NULL;
-    tb->prev_time = 0;
-#endif
-    cpu_gen_code(env, tb, CODE_GEN_MAX_SIZE, &code_gen_size);
-    code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
-
-    /* check next page if needed */
-    virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
-    phys_page2 = -1;
-    if ((pc & TARGET_PAGE_MASK) != virt_page2) {
-        phys_page2 = get_phys_addr_code(env, virt_page2);
-    }
-    tb_link_phys(tb, phys_pc, phys_page2);
+   /* if no translated code available, then translate it now */
+    tb = tb_gen_code(env, pc, cs_base, flags, 0);
 
  found:
     /* we add the TB in the virtual pc hash table */
     env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)] = tb;
-    spin_unlock(&tb_lock);
     return tb;
 }
 
@@ -174,7 +162,7 @@ static inline TranslationBlock *tb_find_fast(void)
 {
     TranslationBlock *tb;
     target_ulong cs_base, pc;
-    unsigned int flags;
+    uint64_t flags;
 
     /* we record a subset of the CPU state. It will
        always be the same before a given translated block
@@ -191,207 +179,101 @@ static inline TranslationBlock *tb_find_fast(void)
         flags |= (1 << 6);
     if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30))
         flags |= (1 << 7);
+    flags |= (env->condexec_bits << 8);
     cs_base = 0;
     pc = env->regs[15];
 #elif defined(TARGET_SPARC)
 #ifdef TARGET_SPARC64
-    // Combined FPU enable bits . PRIV . DMMU enabled . IMMU enabled
-    flags = (((env->pstate & PS_PEF) >> 1) | ((env->fprs & FPRS_FEF) << 2))
+    // AM . Combined FPU enable bits . PRIV . DMMU enabled . IMMU enabled
+    flags = ((env->pstate & PS_AM) << 2)
+        | (((env->pstate & PS_PEF) >> 1) | ((env->fprs & FPRS_FEF) << 2))
         | (env->pstate & PS_PRIV) | ((env->lsu & (DMMU_E | IMMU_E)) >> 2);
 #else
-    // FPU enable . MMU enabled . MMU no-fault . Supervisor
-    flags = (env->psref << 3) | ((env->mmuregs[0] & (MMU_E | MMU_NF)) << 1)
-        | env->psrs;
+    // FPU enable . Supervisor
+    flags = (env->psref << 4) | env->psrs;
 #endif
     cs_base = env->npc;
     pc = env->pc;
 #elif defined(TARGET_PPC)
-    flags = (msr_pr << MSR_PR) | (msr_fp << MSR_FP) |
-        (msr_se << MSR_SE) | (msr_le << MSR_LE);
+    flags = env->hflags;
     cs_base = 0;
     pc = env->nip;
 #elif defined(TARGET_MIPS)
     flags = env->hflags & (MIPS_HFLAG_TMASK | MIPS_HFLAG_BMASK);
     cs_base = 0;
-    pc = env->PC;
+    pc = env->active_tc.PC;
+#elif defined(TARGET_M68K)
+    flags = (env->fpcr & M68K_FPCR_PREC)  /* Bit  6 */
+            | (env->sr & SR_S)            /* Bit  13 */
+            | ((env->macsr >> 4) & 0xf);  /* Bits 0-3 */
+    cs_base = 0;
+    pc = env->pc;
 #elif defined(TARGET_SH4)
-    flags = env->sr & (SR_MD | SR_RB);
-    cs_base = 0;         /* XXXXX */
+    flags = (env->flags & (DELAY_SLOT | DELAY_SLOT_CONDITIONAL
+                    | DELAY_SLOT_TRUE | DELAY_SLOT_CLEARME))   /* Bits  0- 3 */
+            | (env->fpscr & (FPSCR_FR | FPSCR_SZ | FPSCR_PR))  /* Bits 19-21 */
+            | (env->sr & (SR_MD | SR_RB));                     /* Bits 29-30 */
+    cs_base = 0;
+    pc = env->pc;
+#elif defined(TARGET_ALPHA)
+    flags = env->ps;
+    cs_base = 0;
+    pc = env->pc;
+#elif defined(TARGET_CRIS)
+    flags = env->pregs[PR_CCS] & (P_FLAG | U_FLAG | X_FLAG);
+    flags |= env->dslot;
+    cs_base = 0;
     pc = env->pc;
 #else
 #error unsupported CPU
 #endif
     tb = env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)];
-    if (__builtin_expect(!tb || tb->pc != pc || tb->cs_base != cs_base ||
-                         tb->flags != flags, 0)) {
+    if (unlikely(!tb || tb->pc != pc || tb->cs_base != cs_base ||
+                 tb->flags != flags)) {
         tb = tb_find_slow(pc, cs_base, flags);
-        /* Note: we do it here to avoid a gcc bug on Mac OS X when
-           doing it in tb_find_slow */
-        if (tb_invalidated_flag) {
-            /* as some TB could have been invalidated because
-               of memory exceptions while generating the code, we
-               must recompute the hash index here */
-            T0 = 0;
-        }
     }
     return tb;
 }
 
-
 /* main execution loop */
 
 int cpu_exec(CPUState *env1)
 {
-    int saved_T0, saved_T1;
-#if defined(reg_T2)
-    int saved_T2;
-#endif
-    CPUState *saved_env;
-#if defined(TARGET_I386)
-#ifdef reg_EAX
-    int saved_EAX;
-#endif
-#ifdef reg_ECX
-    int saved_ECX;
-#endif
-#ifdef reg_EDX
-    int saved_EDX;
-#endif
-#ifdef reg_EBX
-    int saved_EBX;
-#endif
-#ifdef reg_ESP
-    int saved_ESP;
-#endif
-#ifdef reg_EBP
-    int saved_EBP;
-#endif
-#ifdef reg_ESI
-    int saved_ESI;
-#endif
-#ifdef reg_EDI
-    int saved_EDI;
-#endif
-#elif defined(TARGET_SPARC)
-#if defined(reg_REGWPTR)
-    uint32_t *saved_regwptr;
-#endif
-#endif
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-    int saved_i7, tmp_T0;
-#endif
+#define DECLARE_HOST_REGS 1
+#include "hostregs_helper.h"
     int ret, interrupt_request;
-    void (*gen_func)(void);
     TranslationBlock *tb;
     uint8_t *tc_ptr;
+    unsigned long next_tb;
 
-#if defined(TARGET_I386)
-    /* handle exit of HALTED state */
-    if (env1->hflags & HF_HALTED_MASK) {
-        /* disable halt condition */
-        if ((env1->interrupt_request & CPU_INTERRUPT_HARD) &&
-            (env1->eflags & IF_MASK)) {
-            env1->hflags &= ~HF_HALTED_MASK;
-        } else {
-            return EXCP_HALTED;
-        }
-    }
-#elif defined(TARGET_PPC)
-    if (env1->halted) {
-        if (env1->msr[MSR_EE] &&
-            (env1->interrupt_request &
-             (CPU_INTERRUPT_HARD | CPU_INTERRUPT_TIMER))) {
-            env1->halted = 0;
-        } else {
-            return EXCP_HALTED;
-        }
-    }
-#elif defined(TARGET_SPARC)
-    if (env1->halted) {
-        if ((env1->interrupt_request & CPU_INTERRUPT_HARD) &&
-            (env1->psret != 0)) {
-            env1->halted = 0;
-        } else {
-            return EXCP_HALTED;
-        }
-    }
-#elif defined(TARGET_ARM)
-    if (env1->halted) {
-        /* An interrupt wakes the CPU even if the I and F CPSR bits are
-           set.  */
-        if (env1->interrupt_request
-            & (CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD)) {
-            env1->halted = 0;
-        } else {
-            return EXCP_HALTED;
-        }
-    }
-#elif defined(TARGET_MIPS)
-    if (env1->halted) {
-        if (env1->interrupt_request &
-            (CPU_INTERRUPT_HARD | CPU_INTERRUPT_TIMER)) {
-            env1->halted = 0;
-        } else {
-            return EXCP_HALTED;
-        }
-    }
-#endif
+    if (cpu_halted(env1) == EXCP_HALTED)
+        return EXCP_HALTED;
 
     cpu_single_env = env1;
 
     /* first we save global registers */
-    saved_env = env;
+#define SAVE_HOST_REGS 1
+#include "hostregs_helper.h"
     env = env1;
-    saved_T0 = T0;
-    saved_T1 = T1;
-#if defined(reg_T2)
-    saved_T2 = T2;
-#endif
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-    /* we also save i7 because longjmp may not restore it */
-    asm volatile ("mov %%i7, %0" : "=r" (saved_i7));
-#endif
-
-#if defined(TARGET_I386)
-#ifdef reg_EAX
-    saved_EAX = EAX;
-#endif
-#ifdef reg_ECX
-    saved_ECX = ECX;
-#endif
-#ifdef reg_EDX
-    saved_EDX = EDX;
-#endif
-#ifdef reg_EBX
-    saved_EBX = EBX;
-#endif
-#ifdef reg_ESP
-    saved_ESP = ESP;
-#endif
-#ifdef reg_EBP
-    saved_EBP = EBP;
-#endif
-#ifdef reg_ESI
-    saved_ESI = ESI;
-#endif
-#ifdef reg_EDI
-    saved_EDI = EDI;
-#endif
 
     env_to_regs();
+#if defined(TARGET_I386)
     /* put eflags in CPU temporary format */
     CC_SRC = env->eflags & (CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
     DF = 1 - (2 * ((env->eflags >> 10) & 1));
     CC_OP = CC_OP_EFLAGS;
     env->eflags &= ~(DF_MASK | CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
-#elif defined(TARGET_ARM)
 #elif defined(TARGET_SPARC)
-#if defined(reg_REGWPTR)
-    saved_regwptr = REGWPTR;
-#endif
+#elif defined(TARGET_M68K)
+    env->cc_op = CC_OP_FLAGS;
+    env->cc_dest = env->sr & 0xf;
+    env->cc_x = (env->sr >> 4) & 1;
+#elif defined(TARGET_ALPHA)
+#elif defined(TARGET_ARM)
 #elif defined(TARGET_PPC)
 #elif defined(TARGET_MIPS)
 #elif defined(TARGET_SH4)
+#elif defined(TARGET_CRIS)
     /* XXXXX */
 #else
 #error unsupported target CPU
@@ -410,13 +292,15 @@ int cpu_exec(CPUState *env1)
                     break;
                 } else if (env->user_mode_only) {
                     /* if user mode only, we simulate a fake exception
-                       which will be hanlded outside the cpu execution
+                       which will be handled outside the cpu execution
                        loop */
 #if defined(TARGET_I386)
                     do_interrupt_user(env->exception_index,
                                       env->exception_is_int,
                                       env->error_code,
                                       env->exception_next_eip);
+                    /* successfully delivered */
+                    env->old_exception = -1;
 #endif
                     ret = env->exception_index;
                     break;
@@ -429,16 +313,24 @@ int cpu_exec(CPUState *env1)
                                  env->exception_is_int,
                                  env->error_code,
                                  env->exception_next_eip, 0);
+                    /* successfully delivered */
+                    env->old_exception = -1;
 #elif defined(TARGET_PPC)
                     do_interrupt(env);
 #elif defined(TARGET_MIPS)
                     do_interrupt(env);
 #elif defined(TARGET_SPARC)
-                    do_interrupt(env->exception_index);
+                    do_interrupt(env);
 #elif defined(TARGET_ARM)
                     do_interrupt(env);
 #elif defined(TARGET_SH4)
 		    do_interrupt(env);
+#elif defined(TARGET_ALPHA)
+                    do_interrupt(env);
+#elif defined(TARGET_CRIS)
+                    do_interrupt(env);
+#elif defined(TARGET_M68K)
+                    do_interrupt(0);
 #endif
                 }
                 env->exception_index = -1;
@@ -469,33 +361,71 @@ int cpu_exec(CPUState *env1)
             }
 #endif
 
-            T0 = 0; /* force lookup of first TB */
+            next_tb = 0; /* force lookup of first TB */
             for(;;) {
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                /* g1 can be modified by some libc? functions */
-                tmp_T0 = T0;
-#endif
                 interrupt_request = env->interrupt_request;
-                if (__builtin_expect(interrupt_request, 0)) {
+                if (unlikely(interrupt_request) &&
+                    likely(!(env->singlestep_enabled & SSTEP_NOIRQ))) {
+                    if (interrupt_request & CPU_INTERRUPT_DEBUG) {
+                        env->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
+                        env->exception_index = EXCP_DEBUG;
+                        cpu_loop_exit();
+                    }
+#if defined(TARGET_ARM) || defined(TARGET_SPARC) || defined(TARGET_MIPS) || \
+    defined(TARGET_PPC) || defined(TARGET_ALPHA) || defined(TARGET_CRIS)
+                    if (interrupt_request & CPU_INTERRUPT_HALT) {
+                        env->interrupt_request &= ~CPU_INTERRUPT_HALT;
+                        env->halted = 1;
+                        env->exception_index = EXCP_HLT;
+                        cpu_loop_exit();
+                    }
+#endif
 #if defined(TARGET_I386)
-                    /* if hardware interrupt pending, we execute it */
-                    if ((interrupt_request & CPU_INTERRUPT_HARD) &&
-                        (env->eflags & IF_MASK) &&
-                        !(env->hflags & HF_INHIBIT_IRQ_MASK)) {
-                        int intno;
-                        env->interrupt_request &= ~CPU_INTERRUPT_HARD;
-                        intno = cpu_get_pic_interrupt(env);
-                        if (loglevel & CPU_LOG_TB_IN_ASM) {
-                            fprintf(logfile, "Servicing hardware INT=0x%02x\n", intno);
-                        }
-                        do_interrupt(intno, 0, 0, 0, 1);
-                        /* ensure that no TB jump will be modified as
-                           the program flow was changed */
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                        tmp_T0 = 0;
-#else
-                        T0 = 0;
+                    if (env->hflags2 & HF2_GIF_MASK) {
+                        if ((interrupt_request & CPU_INTERRUPT_SMI) &&
+                            !(env->hflags & HF_SMM_MASK)) {
+                            svm_check_intercept(SVM_EXIT_SMI);
+                            env->interrupt_request &= ~CPU_INTERRUPT_SMI;
+                            do_smm_enter();
+                            next_tb = 0;
+                        } else if ((interrupt_request & CPU_INTERRUPT_NMI) &&
+                                   !(env->hflags2 & HF2_NMI_MASK)) {
+                            env->interrupt_request &= ~CPU_INTERRUPT_NMI;
+                            env->hflags2 |= HF2_NMI_MASK;
+                            do_interrupt(EXCP02_NMI, 0, 0, 0, 1);
+                            next_tb = 0;
+                        } else if ((interrupt_request & CPU_INTERRUPT_HARD) &&
+                                   (((env->hflags2 & HF2_VINTR_MASK) && 
+                                     (env->hflags2 & HF2_HIF_MASK)) ||
+                                    (!(env->hflags2 & HF2_VINTR_MASK) && 
+                                     (env->eflags & IF_MASK && 
+                                      !(env->hflags & HF_INHIBIT_IRQ_MASK))))) {
+                            int intno;
+                            svm_check_intercept(SVM_EXIT_INTR);
+                            env->interrupt_request &= ~(CPU_INTERRUPT_HARD | CPU_INTERRUPT_VIRQ);
+                            intno = cpu_get_pic_interrupt(env);
+                            if (loglevel & CPU_LOG_TB_IN_ASM) {
+                                fprintf(logfile, "Servicing hardware INT=0x%02x\n", intno);
+                            }
+                            do_interrupt(intno, 0, 0, 0, 1);
+                            /* ensure that no TB jump will be modified as
+                               the program flow was changed */
+                            next_tb = 0;
+#if !defined(CONFIG_USER_ONLY)
+                        } else if ((interrupt_request & CPU_INTERRUPT_VIRQ) &&
+                                   (env->eflags & IF_MASK) && 
+                                   !(env->hflags & HF_INHIBIT_IRQ_MASK)) {
+                            int intno;
+                            /* FIXME: this should respect TPR */
+                            svm_check_intercept(SVM_EXIT_VINTR);
+                            env->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
+                            intno = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_vector));
+                            if (loglevel & CPU_LOG_TB_IN_ASM)
+                                fprintf(logfile, "Servicing virtual hardware INT=0x%02x\n", intno);
+                            do_interrupt(intno, 0, 0, 0, 1);
+                            next_tb = 0;
 #endif
+                        }
                     }
 #elif defined(TARGET_PPC)
 #if 0
@@ -503,48 +433,24 @@ int cpu_exec(CPUState *env1)
                         cpu_ppc_reset(env);
                     }
 #endif
-                    if (msr_ee != 0) {
-                        if ((interrupt_request & CPU_INTERRUPT_HARD)) {
-			    /* Raise it */
-			    env->exception_index = EXCP_EXTERNAL;
-			    env->error_code = 0;
-                            do_interrupt(env);
+                    if (interrupt_request & CPU_INTERRUPT_HARD) {
+                        ppc_hw_interrupt(env);
+                        if (env->pending_interrupts == 0)
                             env->interrupt_request &= ~CPU_INTERRUPT_HARD;
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                            tmp_T0 = 0;
-#else
-                            T0 = 0;
-#endif
-                        } else if ((interrupt_request & CPU_INTERRUPT_TIMER)) {
-                            /* Raise it */
-                            env->exception_index = EXCP_DECR;
-                            env->error_code = 0;
-                            do_interrupt(env);
-                            env->interrupt_request &= ~CPU_INTERRUPT_TIMER;
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                            tmp_T0 = 0;
-#else
-                            T0 = 0;
-#endif
-                        }
+                        next_tb = 0;
                     }
 #elif defined(TARGET_MIPS)
                     if ((interrupt_request & CPU_INTERRUPT_HARD) &&
+                        (env->CP0_Status & env->CP0_Cause & CP0Ca_IP_mask) &&
                         (env->CP0_Status & (1 << CP0St_IE)) &&
-                        (env->CP0_Status & env->CP0_Cause & 0x0000FF00) &&
-                        !(env->hflags & MIPS_HFLAG_EXL) &&
-                        !(env->hflags & MIPS_HFLAG_ERL) &&
+                        !(env->CP0_Status & (1 << CP0St_EXL)) &&
+                        !(env->CP0_Status & (1 << CP0St_ERL)) &&
                         !(env->hflags & MIPS_HFLAG_DM)) {
                         /* Raise it */
                         env->exception_index = EXCP_EXT_INTERRUPT;
                         env->error_code = 0;
                         do_interrupt(env);
-                        env->interrupt_request &= ~CPU_INTERRUPT_HARD;
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                        tmp_T0 = 0;
-#else
-                        T0 = 0;
-#endif
+                        next_tb = 0;
                     }
 #elif defined(TARGET_SPARC)
                     if ((interrupt_request & CPU_INTERRUPT_HARD) &&
@@ -556,34 +462,77 @@ int cpu_exec(CPUState *env1)
 			     (pil == 15 || pil > env->psrpil)) ||
 			    type != TT_EXTINT) {
 			    env->interrupt_request &= ~CPU_INTERRUPT_HARD;
-			    do_interrupt(env->interrupt_index);
+                            env->exception_index = env->interrupt_index;
+                            do_interrupt(env);
 			    env->interrupt_index = 0;
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                            tmp_T0 = 0;
-#else
-                            T0 = 0;
+#if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
+                            cpu_check_irqs(env);
 #endif
+                        next_tb = 0;
 			}
 		    } else if (interrupt_request & CPU_INTERRUPT_TIMER) {
 			//do_interrupt(0, 0, 0, 0, 0);
 			env->interrupt_request &= ~CPU_INTERRUPT_TIMER;
-		    } else if (interrupt_request & CPU_INTERRUPT_HALT) {
-                        env1->halted = 1;
-                        return EXCP_HALTED;
-                    }
+		    }
 #elif defined(TARGET_ARM)
                     if (interrupt_request & CPU_INTERRUPT_FIQ
                         && !(env->uncached_cpsr & CPSR_F)) {
                         env->exception_index = EXCP_FIQ;
                         do_interrupt(env);
+                        next_tb = 0;
                     }
+                    /* ARMv7-M interrupt return works by loading a magic value
+                       into the PC.  On real hardware the load causes the
+                       return to occur.  The qemu implementation performs the
+                       jump normally, then does the exception return when the
+                       CPU tries to execute code at the magic address.
+                       This will cause the magic PC value to be pushed to
+                       the stack if an interrupt occured at the wrong time.
+                       We avoid this by disabling interrupts when
+                       pc contains a magic address.  */
                     if (interrupt_request & CPU_INTERRUPT_HARD
-                        && !(env->uncached_cpsr & CPSR_I)) {
+                        && ((IS_M(env) && env->regs[15] < 0xfffffff0)
+                            || !(env->uncached_cpsr & CPSR_I))) {
                         env->exception_index = EXCP_IRQ;
                         do_interrupt(env);
+                        next_tb = 0;
                     }
 #elif defined(TARGET_SH4)
-		    /* XXXXX */
+                    if (interrupt_request & CPU_INTERRUPT_HARD) {
+                        do_interrupt(env);
+                        next_tb = 0;
+                    }
+#elif defined(TARGET_ALPHA)
+                    if (interrupt_request & CPU_INTERRUPT_HARD) {
+                        do_interrupt(env);
+                        next_tb = 0;
+                    }
+#elif defined(TARGET_CRIS)
+                    if (interrupt_request & CPU_INTERRUPT_HARD
+                        && (env->pregs[PR_CCS] & I_FLAG)) {
+                        env->exception_index = EXCP_IRQ;
+                        do_interrupt(env);
+                        next_tb = 0;
+                    }
+                    if (interrupt_request & CPU_INTERRUPT_NMI
+                        && (env->pregs[PR_CCS] & M_FLAG)) {
+                        env->exception_index = EXCP_NMI;
+                        do_interrupt(env);
+                        next_tb = 0;
+                    }
+#elif defined(TARGET_M68K)
+                    if (interrupt_request & CPU_INTERRUPT_HARD
+                        && ((env->sr & SR_I) >> SR_I_SHIFT)
+                            < env->pending_level) {
+                        /* Real hardware gets the interrupt vector via an
+                           IACK cycle at this point.  Current emulated
+                           hardware doesn't rely on this, so we
+                           provide/save the vector when the interrupt is
+                           first signalled.  */
+                        env->exception_index = env->pending_vector;
+                        do_interrupt(1);
+                        next_tb = 0;
+                    }
 #endif
                    /* Don't use the cached interupt_request value,
                       do_interrupt may have updated the EXITTB flag. */
@@ -591,11 +540,7 @@ int cpu_exec(CPUState *env1)
                         env->interrupt_request &= ~CPU_INTERRUPT_EXITTB;
                         /* ensure that no TB jump will be modified as
                            the program flow was changed */
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                        tmp_T0 = 0;
-#else
-                        T0 = 0;
-#endif
+                        next_tb = 0;
                     }
                     if (interrupt_request & CPU_INTERRUPT_EXIT) {
                         env->interrupt_request &= ~CPU_INTERRUPT_EXIT;
@@ -605,53 +550,48 @@ int cpu_exec(CPUState *env1)
                 }
 #ifdef DEBUG_EXEC
                 if ((loglevel & CPU_LOG_TB_CPU)) {
-#if defined(TARGET_I386)
                     /* restore flags in standard format */
-#ifdef reg_EAX
-                    env->regs[R_EAX] = EAX;
-#endif
-#ifdef reg_EBX
-                    env->regs[R_EBX] = EBX;
-#endif
-#ifdef reg_ECX
-                    env->regs[R_ECX] = ECX;
-#endif
-#ifdef reg_EDX
-                    env->regs[R_EDX] = EDX;
-#endif
-#ifdef reg_ESI
-                    env->regs[R_ESI] = ESI;
-#endif
-#ifdef reg_EDI
-                    env->regs[R_EDI] = EDI;
-#endif
-#ifdef reg_EBP
-                    env->regs[R_EBP] = EBP;
-#endif
-#ifdef reg_ESP
-                    env->regs[R_ESP] = ESP;
-#endif
+                    regs_to_env();
+#if defined(TARGET_I386)
                     env->eflags = env->eflags | cc_table[CC_OP].compute_all() | (DF & DF_MASK);
                     cpu_dump_state(env, logfile, fprintf, X86_DUMP_CCOP);
                     env->eflags &= ~(DF_MASK | CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
 #elif defined(TARGET_ARM)
                     cpu_dump_state(env, logfile, fprintf, 0);
 #elif defined(TARGET_SPARC)
-		    REGWPTR = env->regbase + (env->cwp * 16);
-		    env->regwptr = REGWPTR;
                     cpu_dump_state(env, logfile, fprintf, 0);
 #elif defined(TARGET_PPC)
                     cpu_dump_state(env, logfile, fprintf, 0);
+#elif defined(TARGET_M68K)
+                    cpu_m68k_flush_flags(env, env->cc_op);
+                    env->cc_op = CC_OP_FLAGS;
+                    env->sr = (env->sr & 0xffe0)
+                              | env->cc_dest | (env->cc_x << 4);
+                    cpu_dump_state(env, logfile, fprintf, 0);
 #elif defined(TARGET_MIPS)
                     cpu_dump_state(env, logfile, fprintf, 0);
 #elif defined(TARGET_SH4)
 		    cpu_dump_state(env, logfile, fprintf, 0);
+#elif defined(TARGET_ALPHA)
+                    cpu_dump_state(env, logfile, fprintf, 0);
+#elif defined(TARGET_CRIS)
+                    cpu_dump_state(env, logfile, fprintf, 0);
 #else
 #error unsupported target CPU
 #endif
                 }
 #endif
+                spin_lock(&tb_lock);
                 tb = tb_find_fast();
+                /* Note: we do it here to avoid a gcc bug on Mac OS X when
+                   doing it in tb_find_slow */
+                if (tb_invalidated_flag) {
+                    /* as some TB could have been invalidated because
+                       of memory exceptions while generating the code, we
+                       must recompute the hash index here */
+                    next_tb = 0;
+                    tb_invalidated_flag = 0;
+                }
 #ifdef DEBUG_EXEC
                 if ((loglevel & CPU_LOG_EXEC)) {
                     fprintf(logfile, "Trace 0x%08lx [" TARGET_FMT_lx "] %s\n",
@@ -659,157 +599,60 @@ int cpu_exec(CPUState *env1)
                             lookup_symbol(tb->pc));
                 }
 #endif
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-                T0 = tmp_T0;
-#endif
                 /* see if we can patch the calling TB. When the TB
                    spans two pages, we cannot safely do a direct
                    jump. */
                 {
-                    if (T0 != 0 &&
-#if USE_KQEMU
+                    if (next_tb != 0 &&
+#ifdef USE_KQEMU
                         (env->kqemu_enabled != 2) &&
 #endif
-                        tb->page_addr[1] == -1
-#if defined(TARGET_I386) && defined(USE_CODE_COPY)
-                    && (tb->cflags & CF_CODE_COPY) ==
-                    (((TranslationBlock *)(T0 & ~3))->cflags & CF_CODE_COPY)
-#endif
-                    ) {
-                    spin_lock(&tb_lock);
-                    tb_add_jump((TranslationBlock *)(long)(T0 & ~3), T0 & 3, tb);
-#if defined(USE_CODE_COPY)
-                    /* propagates the FP use info */
-                    ((TranslationBlock *)(T0 & ~3))->cflags |=
-                        (tb->cflags & CF_FP_USED);
-#endif
-                    spin_unlock(&tb_lock);
+                        tb->page_addr[1] == -1) {
+                    tb_add_jump((TranslationBlock *)(next_tb & ~3), next_tb & 3, tb);
                 }
                 }
-                tc_ptr = tb->tc_ptr;
+                spin_unlock(&tb_lock);
                 env->current_tb = tb;
+                while (env->current_tb) {
+                    tc_ptr = tb->tc_ptr;
                 /* execute the generated code */
-                gen_func = (void *)tc_ptr;
-#if defined(__sparc__)
-                __asm__ __volatile__("call	%0\n\t"
-                                     "mov	%%o7,%%i0"
-                                     : /* no outputs */
-                                     : "r" (gen_func)
-                                     : "i0", "i1", "i2", "i3", "i4", "i5",
-                                       "l0", "l1", "l2", "l3", "l4", "l5",
-                                       "l6", "l7");
-#elif defined(__arm__)
-                asm volatile ("mov pc, %0\n\t"
-                              ".global exec_loop\n\t"
-                              "exec_loop:\n\t"
-                              : /* no outputs */
-                              : "r" (gen_func)
-                              : "r1", "r2", "r3", "r8", "r9", "r10", "r12", "r14");
-#elif defined(TARGET_X86_64) && defined(__i386__)
-                asm volatile ("push %%ebx\n"
-                              "push %%esi\n"
-                              "push %%edi\n"
-                              "call *%0\n"
-                              "pop %%edi\n"
-                              "pop %%esi\n"
-                              "pop %%ebx\n"
-                              : : "r" (gen_func) : "ebx", "esi", "edi");
-#elif defined(TARGET_I386) && defined(USE_CODE_COPY)
-{
-    if (!(tb->cflags & CF_CODE_COPY)) {
-        if ((tb->cflags & CF_FP_USED) && env->native_fp_regs) {
-            save_native_fp_state(env);
-        }
-        gen_func();
-    } else {
-        if ((tb->cflags & CF_FP_USED) && !env->native_fp_regs) {
-            restore_native_fp_state(env);
-        }
-        /* we work with native eflags */
-        CC_SRC = cc_table[CC_OP].compute_all();
-        CC_OP = CC_OP_EFLAGS;
-        asm(".globl exec_loop\n"
-            "\n"
-            "debug1:\n"
-            "    pushl %%ebp\n"
-            "    fs movl %10, %9\n"
-            "    fs movl %11, %%eax\n"
-            "    andl $0x400, %%eax\n"
-            "    fs orl %8, %%eax\n"
-            "    pushl %%eax\n"
-            "    popf\n"
-            "    fs movl %%esp, %12\n"
-            "    fs movl %0, %%eax\n"
-            "    fs movl %1, %%ecx\n"
-            "    fs movl %2, %%edx\n"
-            "    fs movl %3, %%ebx\n"
-            "    fs movl %4, %%esp\n"
-            "    fs movl %5, %%ebp\n"
-            "    fs movl %6, %%esi\n"
-            "    fs movl %7, %%edi\n"
-            "    fs jmp *%9\n"
-            "exec_loop:\n"
-            "    fs movl %%esp, %4\n"
-            "    fs movl %12, %%esp\n"
-            "    fs movl %%eax, %0\n"
-            "    fs movl %%ecx, %1\n"
-            "    fs movl %%edx, %2\n"
-            "    fs movl %%ebx, %3\n"
-            "    fs movl %%ebp, %5\n"
-            "    fs movl %%esi, %6\n"
-            "    fs movl %%edi, %7\n"
-            "    pushf\n"
-            "    popl %%eax\n"
-            "    movl %%eax, %%ecx\n"
-            "    andl $0x400, %%ecx\n"
-            "    shrl $9, %%ecx\n"
-            "    andl $0x8d5, %%eax\n"
-            "    fs movl %%eax, %8\n"
-            "    movl $1, %%eax\n"
-            "    subl %%ecx, %%eax\n"
-            "    fs movl %%eax, %11\n"
-            "    fs movl %9, %%ebx\n" /* get T0 value */
-            "    popl %%ebp\n"
-            :
-            : "m" (*(uint8_t *)offsetof(CPUState, regs[0])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[1])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[2])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[3])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[4])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[5])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[6])),
-            "m" (*(uint8_t *)offsetof(CPUState, regs[7])),
-            "m" (*(uint8_t *)offsetof(CPUState, cc_src)),
-            "m" (*(uint8_t *)offsetof(CPUState, tmp0)),
-            "a" (gen_func),
-            "m" (*(uint8_t *)offsetof(CPUState, df)),
-            "m" (*(uint8_t *)offsetof(CPUState, saved_esp))
-            : "%ecx", "%edx"
-            );
-    }
-}
-#elif defined(__ia64)
-		struct fptr {
-			void *ip;
-			void *gp;
-		} fp;
-
-		fp.ip = tc_ptr;
-		fp.gp = code_gen_buffer + 2 * (1 << 20);
-		(*(void (*)(void)) &fp)();
-#else
-                gen_func();
-#endif
-                env->current_tb = NULL;
+#if defined(__sparc__) && !defined(HOST_SOLARIS)
+#undef env
+                    env = cpu_single_env;
+#define env cpu_single_env
+#endif
+                    next_tb = tcg_qemu_tb_exec(tc_ptr);
+                    env->current_tb = NULL;
+                    if ((next_tb & 3) == 2) {
+                        /* Instruction counter expired.  */
+                        int insns_left;
+                        tb = (TranslationBlock *)(long)(next_tb & ~3);
+                        /* Restore PC.  */
+                        CPU_PC_FROM_TB(env, tb);
+                        insns_left = env->icount_decr.u32;
+                        if (env->icount_extra && insns_left >= 0) {
+                            /* Refill decrementer and continue execution.  */
+                            env->icount_extra += insns_left;
+                            if (env->icount_extra > 0xffff) {
+                                insns_left = 0xffff;
+                            } else {
+                                insns_left = env->icount_extra;
+                            }
+                            env->icount_extra -= insns_left;
+                            env->icount_decr.u16.low = insns_left;
+                        } else {
+                            if (insns_left > 0) {
+                                /* Execute remaining instructions.  */
+                                cpu_exec_nocache(insns_left, tb);
+                            }
+                            env->exception_index = EXCP_INTERRUPT;
+                            next_tb = 0;
+                            cpu_loop_exit();
+                        }
+                    }
+                }
                 /* reset soft MMU for next block (it can currently
                    only be set by a memory fault) */
-#if defined(TARGET_I386) && !defined(CONFIG_SOFTMMU)
-                if (env->hflags & HF_SOFTMMU_MASK) {
-                    env->hflags &= ~HF_SOFTMMU_MASK;
-                    /* do not allow linking to another block */
-                    T0 = 0;
-                }
-#endif
 #if defined(USE_KQEMU)
 #define MIN_CYCLE_BEFORE_SWITCH (100 * 1000)
                 if (kqemu_is_ok(env) &&
@@ -817,31 +660,7 @@ int cpu_exec(CPUState *env1)
                     cpu_loop_exit();
                 }
 #endif
-
-#if 0 /* digit: implement high-resolution polling */
-                if (qemu_milli_needed) {
-                    static int  counter;
-
-                    if (++counter == 50) {
-                        counter = 0;
-                        if (qemu_milli_check())
-                            qemu_check_interrupts();
-                    }
-                }
-#endif
-/* ANDROID-BEGIN */
-                if (qemu_cpu_delay) {
-                    if (++qemu_cpu_delay_count >= qemu_cpu_delay) {
-                        qemu_cpu_delay_count = 0;
-#ifdef _WIN32
-                        Sleep(1);
-#else
-                        usleep(1000);
-#endif
-                    }
-                }
-/* ANDROID-END */
-            }
+            } /* for(;;) */
         } else {
             env_to_regs();
         }
@@ -849,61 +668,29 @@ int cpu_exec(CPUState *env1)
 
 
 #if defined(TARGET_I386)
-#if defined(USE_CODE_COPY)
-    if (env->native_fp_regs) {
-        save_native_fp_state(env);
-    }
-#endif
     /* restore flags in standard format */
     env->eflags = env->eflags | cc_table[CC_OP].compute_all() | (DF & DF_MASK);
-
-    /* restore global registers */
-#ifdef reg_EAX
-    EAX = saved_EAX;
-#endif
-#ifdef reg_ECX
-    ECX = saved_ECX;
-#endif
-#ifdef reg_EDX
-    EDX = saved_EDX;
-#endif
-#ifdef reg_EBX
-    EBX = saved_EBX;
-#endif
-#ifdef reg_ESP
-    ESP = saved_ESP;
-#endif
-#ifdef reg_EBP
-    EBP = saved_EBP;
-#endif
-#ifdef reg_ESI
-    ESI = saved_ESI;
-#endif
-#ifdef reg_EDI
-    EDI = saved_EDI;
-#endif
 #elif defined(TARGET_ARM)
     /* XXX: Save/restore host fpu exception state?.  */
 #elif defined(TARGET_SPARC)
-#if defined(reg_REGWPTR)
-    REGWPTR = saved_regwptr;
-#endif
 #elif defined(TARGET_PPC)
+#elif defined(TARGET_M68K)
+    cpu_m68k_flush_flags(env, env->cc_op);
+    env->cc_op = CC_OP_FLAGS;
+    env->sr = (env->sr & 0xffe0)
+              | env->cc_dest | (env->cc_x << 4);
 #elif defined(TARGET_MIPS)
 #elif defined(TARGET_SH4)
+#elif defined(TARGET_ALPHA)
+#elif defined(TARGET_CRIS)
     /* XXXXX */
 #else
 #error unsupported target CPU
 #endif
-#if defined(__sparc__) && !defined(HOST_SOLARIS)
-    asm volatile ("mov %0, %%i7" : : "r" (saved_i7));
-#endif
-    T0 = saved_T0;
-    T1 = saved_T1;
-#if defined(reg_T2)
-    T2 = saved_T2;
-#endif
-    env = saved_env;
+
+    /* restore global registers */
+#include "hostregs_helper.h"
+
     /* fail safe : never use cpu_single_env outside cpu_exec() */
     cpu_single_env = NULL;
     return ret;
@@ -935,31 +722,31 @@ void cpu_x86_load_seg(CPUX86State *s, int seg_reg, int selector)
         cpu_x86_load_seg_cache(env, seg_reg, selector,
                                (selector << 4), 0xffff, 0);
     } else {
-        load_seg(seg_reg, selector);
+        helper_load_seg(seg_reg, selector);
     }
     env = saved_env;
 }
 
-void cpu_x86_fsave(CPUX86State *s, uint8_t *ptr, int data32)
+void cpu_x86_fsave(CPUX86State *s, target_ulong ptr, int data32)
 {
     CPUX86State *saved_env;
 
     saved_env = env;
     env = s;
 
-    helper_fsave((target_ulong)ptr, data32);
+    helper_fsave(ptr, data32);
 
     env = saved_env;
 }
 
-void cpu_x86_frstor(CPUX86State *s, uint8_t *ptr, int data32)
+void cpu_x86_frstor(CPUX86State *s, target_ulong ptr, int data32)
 {
     CPUX86State *saved_env;
 
     saved_env = env;
     env = s;
 
-    helper_frstor((target_ulong)ptr, data32);
+    helper_frstor(ptr, data32);
 
     env = saved_env;
 }
@@ -993,8 +780,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     }
 
     /* see if it is an MMU fault */
-    ret = cpu_x86_handle_mmu_fault(env, address, is_write,
-                                   ((env->hflags & HF_CPL_MASK) == 3), 0);
+    ret = cpu_x86_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1043,7 +829,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
         return 1;
     }
     /* see if it is an MMU fault */
-    ret = cpu_arm_handle_mmu_fault(env, address, is_write, 1, 0);
+    ret = cpu_arm_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1059,6 +845,8 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
        do it (XXX: use sigsetjmp) */
     sigprocmask(SIG_SETMASK, old_set, NULL);
     cpu_loop_exit();
+    /* never comes here */
+    return 1;
 }
 #elif defined(TARGET_SPARC)
 static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
@@ -1079,7 +867,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
         return 1;
     }
     /* see if it is an MMU fault */
-    ret = cpu_sparc_handle_mmu_fault(env, address, is_write, 1, 0);
+    ret = cpu_sparc_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1095,6 +883,8 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
        do it (XXX: use sigsetjmp) */
     sigprocmask(SIG_SETMASK, old_set, NULL);
     cpu_loop_exit();
+    /* never comes here */
+    return 1;
 }
 #elif defined (TARGET_PPC)
 static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
@@ -1116,7 +906,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     }
 
     /* see if it is an MMU fault */
-    ret = cpu_ppc_handle_mmu_fault(env, address, is_write, msr_pr, 0);
+    ret = cpu_ppc_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1146,6 +936,45 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     return 1;
 }
 
+#elif defined(TARGET_M68K)
+static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
+                                    int is_write, sigset_t *old_set,
+                                    void *puc)
+{
+    TranslationBlock *tb;
+    int ret;
+
+    if (cpu_single_env)
+        env = cpu_single_env; /* XXX: find a correct solution for multithread */
+#if defined(DEBUG_SIGNAL)
+    printf("qemu: SIGSEGV pc=0x%08lx address=%08lx w=%d oldset=0x%08lx\n",
+           pc, address, is_write, *(unsigned long *)old_set);
+#endif
+    /* XXX: locking issue */
+    if (is_write && page_unprotect(address, pc, puc)) {
+        return 1;
+    }
+    /* see if it is an MMU fault */
+    ret = cpu_m68k_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
+    if (ret < 0)
+        return 0; /* not an MMU fault */
+    if (ret == 0)
+        return 1; /* the MMU fault was handled without causing real CPU fault */
+    /* now we have a real cpu fault */
+    tb = tb_find_pc(pc);
+    if (tb) {
+        /* the PC is inside the translated code. It means that we have
+           a virtual CPU fault */
+        cpu_restore_state(tb, env, pc, puc);
+    }
+    /* we restore the process signal mask as the sigreturn should
+       do it (XXX: use sigsetjmp) */
+    sigprocmask(SIG_SETMASK, old_set, NULL);
+    cpu_loop_exit();
+    /* never comes here */
+    return 1;
+}
+
 #elif defined (TARGET_MIPS)
 static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
                                     int is_write, sigset_t *old_set,
@@ -1166,7 +995,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     }
 
     /* see if it is an MMU fault */
-    ret = cpu_mips_handle_mmu_fault(env, address, is_write, 1, 0);
+    ret = cpu_mips_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1181,8 +1010,8 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     }
     if (ret == 1) {
 #if 0
-        printf("PF exception: NIP=0x%08x error=0x%x %p\n",
-               env->nip, env->error_code, tb);
+        printf("PF exception: PC=0x" TARGET_FMT_lx " error=0x%x %p\n",
+               env->PC, env->error_code, tb);
 #endif
     /* we restore the process signal mask as the sigreturn should
        do it (XXX: use sigsetjmp) */
@@ -1216,7 +1045,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     }
 
     /* see if it is an MMU fault */
-    ret = cpu_sh4_handle_mmu_fault(env, address, is_write, 1, 0);
+    ret = cpu_sh4_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
     if (ret < 0)
         return 0; /* not an MMU fault */
     if (ret == 0)
@@ -1240,35 +1069,114 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
     /* never comes here */
     return 1;
 }
-#else
-#error unsupported target CPU
+
+#elif defined (TARGET_ALPHA)
+static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
+                                    int is_write, sigset_t *old_set,
+                                    void *puc)
+{
+    TranslationBlock *tb;
+    int ret;
+
+    if (cpu_single_env)
+        env = cpu_single_env; /* XXX: find a correct solution for multithread */
+#if defined(DEBUG_SIGNAL)
+    printf("qemu: SIGSEGV pc=0x%08lx address=%08lx w=%d oldset=0x%08lx\n",
+           pc, address, is_write, *(unsigned long *)old_set);
 #endif
+    /* XXX: locking issue */
+    if (is_write && page_unprotect(h2g(address), pc, puc)) {
+        return 1;
+    }
 
-#if defined(__i386__)
+    /* see if it is an MMU fault */
+    ret = cpu_alpha_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
+    if (ret < 0)
+        return 0; /* not an MMU fault */
+    if (ret == 0)
+        return 1; /* the MMU fault was handled without causing real CPU fault */
 
-#if defined(USE_CODE_COPY)
-static void cpu_send_trap(unsigned long pc, int trap,
-                          struct ucontext *uc)
+    /* now we have a real cpu fault */
+    tb = tb_find_pc(pc);
+    if (tb) {
+        /* the PC is inside the translated code. It means that we have
+           a virtual CPU fault */
+        cpu_restore_state(tb, env, pc, puc);
+    }
+#if 0
+        printf("PF exception: NIP=0x%08x error=0x%x %p\n",
+               env->nip, env->error_code, tb);
+#endif
+    /* we restore the process signal mask as the sigreturn should
+       do it (XXX: use sigsetjmp) */
+    sigprocmask(SIG_SETMASK, old_set, NULL);
+    cpu_loop_exit();
+    /* never comes here */
+    return 1;
+}
+#elif defined (TARGET_CRIS)
+static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
+                                    int is_write, sigset_t *old_set,
+                                    void *puc)
 {
     TranslationBlock *tb;
+    int ret;
 
     if (cpu_single_env)
         env = cpu_single_env; /* XXX: find a correct solution for multithread */
+#if defined(DEBUG_SIGNAL)
+    printf("qemu: SIGSEGV pc=0x%08lx address=%08lx w=%d oldset=0x%08lx\n",
+           pc, address, is_write, *(unsigned long *)old_set);
+#endif
+    /* XXX: locking issue */
+    if (is_write && page_unprotect(h2g(address), pc, puc)) {
+        return 1;
+    }
+
+    /* see if it is an MMU fault */
+    ret = cpu_cris_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
+    if (ret < 0)
+        return 0; /* not an MMU fault */
+    if (ret == 0)
+        return 1; /* the MMU fault was handled without causing real CPU fault */
+
     /* now we have a real cpu fault */
     tb = tb_find_pc(pc);
     if (tb) {
         /* the PC is inside the translated code. It means that we have
            a virtual CPU fault */
-        cpu_restore_state(tb, env, pc, uc);
+        cpu_restore_state(tb, env, pc, puc);
     }
-    sigprocmask(SIG_SETMASK, &uc->uc_sigmask, NULL);
-    raise_exception_err(trap, env->error_code);
+    /* we restore the process signal mask as the sigreturn should
+       do it (XXX: use sigsetjmp) */
+    sigprocmask(SIG_SETMASK, old_set, NULL);
+    cpu_loop_exit();
+    /* never comes here */
+    return 1;
 }
+
+#else
+#error unsupported target CPU
+#endif
+
+#if defined(__i386__)
+
+#if defined(__APPLE__)
+# include <sys/ucontext.h>
+
+# define EIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext->ss.eip))
+# define TRAP_sig(context)    ((context)->uc_mcontext->es.trapno)
+# define ERROR_sig(context)   ((context)->uc_mcontext->es.err)
+#else
+# define EIP_sig(context)     ((context)->uc_mcontext.gregs[REG_EIP])
+# define TRAP_sig(context)    ((context)->uc_mcontext.gregs[REG_TRAPNO])
+# define ERROR_sig(context)   ((context)->uc_mcontext.gregs[REG_ERR])
 #endif
 
-int cpu_signal_handler(int host_signum, struct siginfo *info,
+int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
+    siginfo_t *info = pinfo;
     struct ucontext *uc = puc;
     unsigned long pc;
     int trapno;
@@ -1279,26 +1187,20 @@ int cpu_signal_handler(int host_signum, struct siginfo *info,
 #define REG_ERR    ERR
 #define REG_TRAPNO TRAPNO
 #endif
-    pc = uc->uc_mcontext.gregs[REG_EIP];
-    trapno = uc->uc_mcontext.gregs[REG_TRAPNO];
-#if defined(TARGET_I386) && defined(USE_CODE_COPY)
-    if (trapno == 0x00 || trapno == 0x05) {
-        /* send division by zero or bound exception */
-        cpu_send_trap(pc, trapno, uc);
-        return 1;
-    } else
-#endif
-        return handle_cpu_signal(pc, (unsigned long)info->si_addr,
-                                 trapno == 0xe ?
-                                 (uc->uc_mcontext.gregs[REG_ERR] >> 1) & 1 : 0,
-                                 &uc->uc_sigmask, puc);
+    pc = EIP_sig(uc);
+    trapno = TRAP_sig(uc);
+    return handle_cpu_signal(pc, (unsigned long)info->si_addr,
+                             trapno == 0xe ?
+                             (ERROR_sig(uc) >> 1) & 1 : 0,
+                             &uc->uc_sigmask, puc);
 }
 
 #elif defined(__x86_64__)
 
-int cpu_signal_handler(int host_signum, struct siginfo *info,
+int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
+    siginfo_t *info = pinfo;
     struct ucontext *uc = puc;
     unsigned long pc;
 
@@ -1360,9 +1262,10 @@ typedef struct ucontext SIGCONTEXT;
 # define TRAP_sig(context)			EXCEPREG_sig(exception, context) /* number of powerpc exception taken */
 #endif /* __APPLE__ */
 
-int cpu_signal_handler(int host_signum, struct siginfo *info,
+int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
+    siginfo_t *info = pinfo;
     struct ucontext *uc = puc;
     unsigned long pc;
     int is_write;
@@ -1383,9 +1286,10 @@ int cpu_signal_handler(int host_signum, struct siginfo *info,
 
 #elif defined(__alpha__)
 
-int cpu_signal_handler(int host_signum, struct siginfo *info,
+int cpu_signal_handler(int host_signum, void *pinfo,
                            void *puc)
 {
+    siginfo_t *info = pinfo;
     struct ucontext *uc = puc;
     uint32_t *pc = uc->uc_mcontext.sc_pc;
     uint32_t insn = *pc;
@@ -1412,17 +1316,23 @@ int cpu_signal_handler(int host_signum, struct siginfo *info,
 }
 #elif defined(__sparc__)
 
-int cpu_signal_handler(int host_signum, struct siginfo *info,
+int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
-    uint32_t *regs = (uint32_t *)(info + 1);
-    void *sigmask = (regs + 20);
-    unsigned long pc;
+    siginfo_t *info = pinfo;
     int is_write;
     uint32_t insn;
-
+#if !defined(__arch64__) || defined(HOST_SOLARIS)
+    uint32_t *regs = (uint32_t *)(info + 1);
+    void *sigmask = (regs + 20);
     /* XXX: is there a standard glibc define ? */
-    pc = regs[1];
+    unsigned long pc = regs[1];
+#else
+    struct sigcontext *sc = puc;
+    unsigned long pc = sc->sigc_regs.tpc;
+    void *sigmask = (void *)sc->sigc_mask;
+#endif
+
     /* XXX: need kernel patch to get write flag faster */
     is_write = 0;
     insn = *(uint32_t *)pc;
@@ -1445,26 +1355,32 @@ int cpu_signal_handler(int host_signum, struct siginfo *info,
 
 #elif defined(__arm__)
 
-int cpu_signal_handler(int host_signum, struct siginfo *info,
+int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
+    siginfo_t *info = pinfo;
     struct ucontext *uc = puc;
     unsigned long pc;
     int is_write;
 
+#if (__GLIBC__ < 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ <= 3))
     pc = uc->uc_mcontext.gregs[R15];
+#else
+    pc = uc->uc_mcontext.arm_pc;
+#endif
     /* XXX: compute is_write */
     is_write = 0;
     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
                              is_write,
-                             &uc->uc_sigmask);
+                             &uc->uc_sigmask, puc);
 }
 
 #elif defined(__mc68000)
 
-int cpu_signal_handler(int host_signum, struct siginfo *info,
+int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
+    siginfo_t *info = pinfo;
     struct ucontext *uc = puc;
     unsigned long pc;
     int is_write;
@@ -1484,8 +1400,9 @@ int cpu_signal_handler(int host_signum, struct siginfo *info,
 # define __ISR_VALID	1
 #endif
 
-int cpu_signal_handler(int host_signum, struct siginfo *info, void *puc)
+int cpu_signal_handler(int host_signum, void *pinfo, void *puc)
 {
+    siginfo_t *info = pinfo;
     struct ucontext *uc = puc;
     unsigned long ip;
     int is_write = 0;
@@ -1512,9 +1429,10 @@ int cpu_signal_handler(int host_signum, struct siginfo *info, void *puc)
 
 #elif defined(__s390__)
 
-int cpu_signal_handler(int host_signum, struct siginfo *info,
+int cpu_signal_handler(int host_signum, void *pinfo,
                        void *puc)
 {
+    siginfo_t *info = pinfo;
     struct ucontext *uc = puc;
     unsigned long pc;
     int is_write;
@@ -1523,6 +1441,39 @@ int cpu_signal_handler(int host_signum, struct siginfo *info,
     /* XXX: compute is_write */
     is_write = 0;
     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
+                             is_write, &uc->uc_sigmask, puc);
+}
+
+#elif defined(__mips__)
+
+int cpu_signal_handler(int host_signum, void *pinfo,
+                       void *puc)
+{
+    siginfo_t *info = pinfo;
+    struct ucontext *uc = puc;
+    greg_t pc = uc->uc_mcontext.pc;
+    int is_write;
+
+    /* XXX: compute is_write */
+    is_write = 0;
+    return handle_cpu_signal(pc, (unsigned long)info->si_addr,
+                             is_write, &uc->uc_sigmask, puc);
+}
+
+#elif defined(__hppa__)
+
+int cpu_signal_handler(int host_signum, void *pinfo,
+                       void *puc)
+{
+    struct siginfo *info = pinfo;
+    struct ucontext *uc = puc;
+    unsigned long pc;
+    int is_write;
+
+    pc = uc->uc_mcontext.sc_iaoq[0];
+    /* FIXME: compute is_write */
+    is_write = 0;
+    return handle_cpu_signal(pc, (unsigned long)info->si_addr, 
                              is_write,
                              &uc->uc_sigmask, puc);
 }
diff --git a/curses.c b/curses.c
new file mode 100644
index 0000000..96b6e49
--- /dev/null
+++ b/curses.c
@@ -0,0 +1,374 @@
+/*
+ * QEMU curses/ncurses display driver
+ * 
+ * Copyright (c) 2005 Andrzej Zaborowski  <balrog@zabor.org>
+ * 
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu-common.h"
+#include "console.h"
+#include "sysemu.h"
+
+#include <curses.h>
+
+#ifndef _WIN32
+#include <signal.h>
+#include <sys/ioctl.h>
+#include <termios.h>
+#endif
+
+#ifdef __OpenBSD__
+#define resize_term resizeterm
+#endif
+
+#define FONT_HEIGHT 16
+#define FONT_WIDTH 8
+
+static console_ch_t screen[160 * 100];
+static WINDOW *screenpad = NULL;
+static int width, height, gwidth, gheight, invalidate;
+static int px, py, sminx, sminy, smaxx, smaxy;
+
+static void curses_update(DisplayState *ds, int x, int y, int w, int h)
+{
+    chtype *line;
+
+    line = ((chtype *) screen) + y * width;
+    for (h += y; y < h; y ++, line += width)
+        mvwaddchnstr(screenpad, y, 0, line, width);
+
+    pnoutrefresh(screenpad, py, px, sminy, sminx, smaxy - 1, smaxx - 1);
+    refresh();
+}
+
+static void curses_calc_pad(void)
+{
+    if (is_graphic_console()) {
+        width = gwidth;
+        height = gheight;
+    } else {
+        width = COLS;
+        height = LINES;
+    }
+
+    if (screenpad)
+        delwin(screenpad);
+
+    clear();
+    refresh();
+
+    screenpad = newpad(height, width);
+
+    if (width > COLS) {
+        px = (width - COLS) / 2;
+        sminx = 0;
+        smaxx = COLS;
+    } else {
+        px = 0;
+        sminx = (COLS - width) / 2;
+        smaxx = sminx + width;
+    }
+
+    if (height > LINES) {
+        py = (height - LINES) / 2;
+        sminy = 0;
+        smaxy = LINES;
+    } else {
+        py = 0;
+        sminy = (LINES - height) / 2;
+        smaxy = sminy + height;
+    }
+}
+
+static void curses_resize(DisplayState *ds, int w, int h)
+{
+    if (w == gwidth && h == gheight)
+        return;
+
+    gwidth = w;
+    gheight = h;
+
+    curses_calc_pad();
+}
+
+#ifndef _WIN32
+#if defined(SIGWINCH) && defined(KEY_RESIZE)
+static void curses_winch_handler(int signum)
+{
+    struct winsize {
+        unsigned short ws_row;
+        unsigned short ws_col;
+        unsigned short ws_xpixel;   /* unused */
+        unsigned short ws_ypixel;   /* unused */
+    } ws;
+
+    /* terminal size changed */
+    if (ioctl(1, TIOCGWINSZ, &ws) == -1)
+        return;
+
+    resize_term(ws.ws_row, ws.ws_col);
+    curses_calc_pad();
+    invalidate = 1;
+
+    /* some systems require this */
+    signal(SIGWINCH, curses_winch_handler);
+}
+#endif
+#endif
+
+static void curses_cursor_position(DisplayState *ds, int x, int y)
+{
+    if (x >= 0) {
+        x = sminx + x - px;
+        y = sminy + y - py;
+
+        if (x >= 0 && y >= 0 && x < COLS && y < LINES) {
+            move(y, x);
+            curs_set(1);
+            /* it seems that curs_set(1) must always be called before
+             * curs_set(2) for the latter to have effect */
+            if (!is_graphic_console())
+                curs_set(2);
+            return;
+        }
+    }
+
+    curs_set(0);
+}
+
+/* generic keyboard conversion */
+
+#include "curses_keys.h"
+#include "keymaps.c"
+
+static kbd_layout_t *kbd_layout = 0;
+static int keycode2keysym[CURSES_KEYS];
+
+static void curses_refresh(DisplayState *ds)
+{
+    int chr, nextchr, keysym, keycode;
+
+    if (invalidate) {
+        clear();
+        refresh();
+        curses_calc_pad();
+        ds->width = FONT_WIDTH * width;
+        ds->height = FONT_HEIGHT * height;
+        vga_hw_invalidate();
+        invalidate = 0;
+    }
+
+    vga_hw_text_update(screen);
+
+    nextchr = ERR;
+    while (1) {
+        /* while there are any pending key strokes to process */
+        if (nextchr == ERR)
+            chr = getch();
+        else {
+            chr = nextchr;
+            nextchr = ERR;
+        }
+
+        if (chr == ERR)
+            break;
+
+#ifdef KEY_RESIZE
+        /* this shouldn't occur when we use a custom SIGWINCH handler */
+        if (chr == KEY_RESIZE) {
+            clear();
+            refresh();
+            curses_calc_pad();
+            curses_update(ds, 0, 0, width, height);
+            ds->width = FONT_WIDTH * width;
+            ds->height = FONT_HEIGHT * height;
+            continue;
+        }
+#endif
+
+        keycode = curses2keycode[chr];
+        if (keycode == -1)
+            continue;
+
+        /* alt key */
+        if (keycode == 1) {
+            nextchr = getch();
+
+            if (nextchr != ERR) {
+                keycode = curses2keycode[nextchr];
+                nextchr = ERR;
+                if (keycode == -1)
+                    continue;
+
+                keycode |= ALT;
+
+                /* process keys reserved for qemu */
+                if (keycode >= QEMU_KEY_CONSOLE0 &&
+                        keycode < QEMU_KEY_CONSOLE0 + 9) {
+                    erase();
+                    wnoutrefresh(stdscr);
+                    console_select(keycode - QEMU_KEY_CONSOLE0);
+
+                    invalidate = 1;
+                    continue;
+                }
+            }
+        }
+
+        if (kbd_layout && !(keycode & GREY)) {
+            keysym = keycode2keysym[keycode & KEY_MASK];
+            if (keysym == -1)
+                keysym = chr;
+
+            keycode &= ~KEY_MASK;
+            keycode |= keysym2scancode(kbd_layout, keysym);
+        }
+
+        if (is_graphic_console()) {
+            /* since terminals don't know about key press and release
+             * events, we need to emit both for each key received */
+            if (keycode & SHIFT)
+                kbd_put_keycode(SHIFT_CODE);
+            if (keycode & CNTRL)
+                kbd_put_keycode(CNTRL_CODE);
+            if (keycode & ALT)
+                kbd_put_keycode(ALT_CODE);
+            if (keycode & GREY)
+                kbd_put_keycode(GREY_CODE);
+            kbd_put_keycode(keycode & KEY_MASK);
+            if (keycode & GREY)
+                kbd_put_keycode(GREY_CODE);
+            kbd_put_keycode((keycode & KEY_MASK) | KEY_RELEASE);
+            if (keycode & ALT)
+                kbd_put_keycode(ALT_CODE | KEY_RELEASE);
+            if (keycode & CNTRL)
+                kbd_put_keycode(CNTRL_CODE | KEY_RELEASE);
+            if (keycode & SHIFT)
+                kbd_put_keycode(SHIFT_CODE | KEY_RELEASE);
+        } else {
+            keysym = curses2keysym[chr];
+            if (keysym == -1)
+                keysym = chr;
+
+            kbd_put_keysym(keysym);
+        }
+    }
+}
+
+static void curses_cleanup(void *opaque) 
+{
+    endwin();
+}
+
+static void curses_atexit(void)
+{
+    curses_cleanup(NULL);
+}
+
+static void curses_setup(void)
+{
+    int i, colour_default[8] = {
+        COLOR_BLACK, COLOR_BLUE, COLOR_GREEN, COLOR_CYAN,
+        COLOR_RED, COLOR_MAGENTA, COLOR_YELLOW, COLOR_WHITE,
+    };
+
+    /* input as raw as possible, let everything be interpreted
+     * by the guest system */
+    initscr(); noecho(); intrflush(stdscr, FALSE);
+    nodelay(stdscr, TRUE); nonl(); keypad(stdscr, TRUE);
+    start_color(); raw(); scrollok(stdscr, FALSE);
+
+    for (i = 0; i < 64; i ++)
+        init_pair(i, colour_default[i & 7], colour_default[i >> 3]);
+}
+
+static void curses_keyboard_setup(void)
+{
+    int i, keycode, keysym;
+
+#if defined(__APPLE__)
+    /* always use generic keymaps */
+    if (!keyboard_layout)
+        keyboard_layout = "en-us";
+#endif
+    if(keyboard_layout) {
+        kbd_layout = init_keyboard_layout(keyboard_layout);
+        if (!kbd_layout)
+            exit(1);
+    }
+
+    for (i = 0; i < CURSES_KEYS; i ++)
+        keycode2keysym[i] = -1;
+
+    for (i = 0; i < CURSES_KEYS; i ++) {
+        if (curses2keycode[i] == -1)
+            continue;
+
+        keycode = curses2keycode[i] & KEY_MASK;
+        if (keycode2keysym[keycode] >= 0)
+            continue;
+
+        for (keysym = 0; keysym < CURSES_KEYS; keysym ++)
+            if (curses2keycode[keysym] == keycode) {
+                keycode2keysym[keycode] = keysym;
+                break;
+            }
+
+        if (keysym >= CURSES_KEYS)
+            keycode2keysym[keycode] = i;
+    }
+}
+
+void curses_display_init(DisplayState *ds, int full_screen)
+{
+#ifndef _WIN32
+    if (!isatty(1)) {
+        fprintf(stderr, "We need a terminal output\n");
+        exit(1);
+    }
+#endif
+
+    curses_setup();
+    curses_keyboard_setup();
+    atexit(curses_atexit);
+
+#ifndef _WIN32
+#if defined(SIGWINCH) && defined(KEY_RESIZE)
+    /* some curses implementations provide a handler, but we
+     * want to be sure this is handled regardless of the library */
+    signal(SIGWINCH, curses_winch_handler);
+#endif
+#endif
+
+    ds->data = (void *) screen;
+    ds->linesize = 0;
+    ds->depth = 0;
+    ds->width = 640;
+    ds->height = 400;
+    ds->dpy_update = curses_update;
+    ds->dpy_resize = curses_resize;
+    ds->dpy_refresh = curses_refresh;
+    ds->dpy_text_cursor = curses_cursor_position;
+
+    invalidate = 1;
+
+    /* Standard VGA initial text mode dimensions */
+    curses_resize(ds, 80, 25);
+}
diff --git a/curses_keys.h b/curses_keys.h
new file mode 100644
index 0000000..27f9cd8
--- /dev/null
+++ b/curses_keys.h
@@ -0,0 +1,484 @@
+/*
+ * Keycode and keysyms conversion tables for curses
+ * 
+ * Copyright (c) 2005 Andrzej Zaborowski  <balrog@zabor.org>
+ * 
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#define KEY_RELEASE         0x80
+#define KEY_MASK            0x7f
+#define SHIFT_CODE          0x2a
+#define SHIFT               0x0080
+#define GREY_CODE           0xe0
+#define GREY                0x0100
+#define CNTRL_CODE          0x1d
+#define CNTRL               0x0200
+#define ALT_CODE            0x38
+#define ALT                 0x0400
+
+/* curses won't detect a Control + Alt + 1, so use Alt + 1 */
+#define QEMU_KEY_CONSOLE0   (2 | ALT)   /* (curses2keycode['1'] | ALT) */
+
+#define CURSES_KEYS         KEY_MAX     /* KEY_MAX defined in <curses.h> */
+
+int curses2keycode[CURSES_KEYS] = {
+    [0 ... (CURSES_KEYS - 1)] = -1,
+
+    [0x01b] = 1, /* Escape */
+    ['1'] = 2,
+    ['2'] = 3,
+    ['3'] = 4,
+    ['4'] = 5,
+    ['5'] = 6,
+    ['6'] = 7,
+    ['7'] = 8,
+    ['8'] = 9,
+    ['9'] = 10,
+    ['0'] = 11,
+    ['-'] = 12,
+    ['='] = 13,
+    [0x07f] = 14, /* Backspace */
+    [0x107] = 14, /* Backspace */
+
+    ['\t'] = 15, /* Tab */
+    ['q'] = 16,
+    ['w'] = 17,
+    ['e'] = 18,
+    ['r'] = 19,
+    ['t'] = 20,
+    ['y'] = 21,
+    ['u'] = 22,
+    ['i'] = 23,
+    ['o'] = 24,
+    ['p'] = 25,
+    ['['] = 26,
+    [']'] = 27,
+    ['\n'] = 28, /* Return */
+    ['\r'] = 28, /* Return */
+    [0x157] = 28, /* Return */
+
+    ['a'] = 30,
+    ['s'] = 31,
+    ['d'] = 32,
+    ['f'] = 33,
+    ['g'] = 34,
+    ['h'] = 35,
+    ['j'] = 36,
+    ['k'] = 37,
+    ['l'] = 38,
+    [';'] = 39,
+    ['\''] = 40, /* Single quote */
+    ['`'] = 41,
+    ['\\'] = 43, /* Backslash */
+
+    ['z'] = 44,
+    ['x'] = 45,
+    ['c'] = 46,
+    ['v'] = 47,
+    ['b'] = 48,
+    ['n'] = 49,
+    ['m'] = 50,
+    [','] = 51,
+    ['.'] = 52,
+    ['/'] = 53,
+
+    [' '] = 57,
+
+    [0x109] = 59, /* Function Key 1 */
+    [0x10a] = 60, /* Function Key 2 */
+    [0x10b] = 61, /* Function Key 3 */
+    [0x10c] = 62, /* Function Key 4 */
+    [0x10d] = 63, /* Function Key 5 */
+    [0x10e] = 64, /* Function Key 6 */
+    [0x10f] = 65, /* Function Key 7 */
+    [0x110] = 66, /* Function Key 8 */
+    [0x111] = 67, /* Function Key 9 */
+    [0x112] = 68, /* Function Key 10 */
+    [0x113] = 87, /* Function Key 11 */
+    [0x114] = 88, /* Function Key 12 */
+
+    [0x106] = 71 | GREY, /* Home */
+    [0x103] = 72 | GREY, /* Up Arrow */
+    [0x153] = 73 | GREY, /* Page Up */
+    [0x104] = 75 | GREY, /* Left Arrow */
+    [0x105] = 77 | GREY, /* Right Arrow */
+    [0x168] = 79 | GREY, /* End */
+    [0x102] = 80 | GREY, /* Down Arrow */
+    [0x152] = 81 | GREY, /* Page Down */
+    [0x14b] = 82 | GREY, /* Insert */
+    [0x14a] = 83 | GREY, /* Delete */
+
+    ['!'] = 2 | SHIFT,
+    ['@'] = 3 | SHIFT,
+    ['#'] = 4 | SHIFT,
+    ['$'] = 5 | SHIFT,
+    ['%'] = 6 | SHIFT,
+    ['^'] = 7 | SHIFT,
+    ['&'] = 8 | SHIFT,
+    ['*'] = 9 | SHIFT,
+    ['('] = 10 | SHIFT,
+    [')'] = 11 | SHIFT,
+    ['_'] = 12 | SHIFT,
+    ['+'] = 13 | SHIFT,
+
+    [0x161] = 15 | SHIFT, /* Shift + Tab */
+    ['Q'] = 16 | SHIFT,
+    ['W'] = 17 | SHIFT,
+    ['E'] = 18 | SHIFT,
+    ['R'] = 19 | SHIFT,
+    ['T'] = 20 | SHIFT,
+    ['Y'] = 21 | SHIFT,
+    ['U'] = 22 | SHIFT,
+    ['I'] = 23 | SHIFT,
+    ['O'] = 24 | SHIFT,
+    ['P'] = 25 | SHIFT,
+    ['{'] = 26 | SHIFT,
+    ['}'] = 27 | SHIFT,
+
+    ['A'] = 30 | SHIFT,
+    ['S'] = 31 | SHIFT,
+    ['D'] = 32 | SHIFT,
+    ['F'] = 33 | SHIFT,
+    ['G'] = 34 | SHIFT,
+    ['H'] = 35 | SHIFT,
+    ['J'] = 36 | SHIFT,
+    ['K'] = 37 | SHIFT,
+    ['L'] = 38 | SHIFT,
+    [':'] = 39 | SHIFT,
+    ['"'] = 40 | SHIFT,
+    ['~'] = 41 | SHIFT,
+    ['|'] = 43 | SHIFT,
+
+    ['Z'] = 44 | SHIFT,
+    ['X'] = 45 | SHIFT,
+    ['C'] = 46 | SHIFT,
+    ['V'] = 47 | SHIFT,
+    ['B'] = 48 | SHIFT,
+    ['N'] = 49 | SHIFT,
+    ['M'] = 50 | SHIFT,
+    ['<'] = 51 | SHIFT,
+    ['>'] = 52 | SHIFT,
+    ['?'] = 53 | SHIFT,
+
+    [0x115] = 59 | SHIFT, /* Shift + Function Key 1 */
+    [0x116] = 60 | SHIFT, /* Shift + Function Key 2 */
+    [0x117] = 61 | SHIFT, /* Shift + Function Key 3 */
+    [0x118] = 62 | SHIFT, /* Shift + Function Key 4 */
+    [0x119] = 63 | SHIFT, /* Shift + Function Key 5 */
+    [0x11a] = 64 | SHIFT, /* Shift + Function Key 6 */
+    [0x11b] = 65 | SHIFT, /* Shift + Function Key 7 */
+    [0x11c] = 66 | SHIFT, /* Shift + Function Key 8 */
+
+    [0x011] = 16 | CNTRL, /* Control + q */
+    [0x017] = 17 | CNTRL, /* Control + w */
+    [0x005] = 18 | CNTRL, /* Control + e */
+    [0x012] = 19 | CNTRL, /* Control + r */
+    [0x014] = 20 | CNTRL, /* Control + t */
+    [0x019] = 21 | CNTRL, /* Control + y */
+    [0x015] = 22 | CNTRL, /* Control + u */
+    [0x009] = 23 | CNTRL, /* Control + i */
+    [0x00f] = 24 | CNTRL, /* Control + o */
+    [0x010] = 25 | CNTRL, /* Control + p */
+
+    [0x001] = 30 | CNTRL, /* Control + a */
+    [0x013] = 31 | CNTRL, /* Control + s */
+    [0x004] = 32 | CNTRL, /* Control + d */
+    [0x006] = 33 | CNTRL, /* Control + f */
+    [0x007] = 34 | CNTRL, /* Control + g */
+    [0x008] = 35 | CNTRL, /* Control + h */
+    [0x00a] = 36 | CNTRL, /* Control + j */
+    [0x00b] = 37 | CNTRL, /* Control + k */
+    [0x00c] = 38 | CNTRL, /* Control + l */
+
+    [0x01a] = 44 | CNTRL, /* Control + z */
+    [0x018] = 45 | CNTRL, /* Control + x */
+    [0x003] = 46 | CNTRL, /* Control + c */
+    [0x016] = 47 | CNTRL, /* Control + v */
+    [0x002] = 48 | CNTRL, /* Control + b */
+    [0x00e] = 49 | CNTRL, /* Control + n */
+    /* Control + m collides with the keycode for Enter */
+
+};
+
+int curses2keysym[CURSES_KEYS] = {
+    [0 ... (CURSES_KEYS - 1)] = -1,
+
+    ['\n'] = '\n',
+    ['\r'] = '\n',
+
+    [0x07f] = QEMU_KEY_BACKSPACE,
+
+    [0x102] = QEMU_KEY_DOWN,
+    [0x103] = QEMU_KEY_UP,
+    [0x104] = QEMU_KEY_LEFT,
+    [0x105] = QEMU_KEY_RIGHT,
+    [0x106] = QEMU_KEY_HOME,
+    [0x107] = QEMU_KEY_BACKSPACE,
+
+    [0x14a] = QEMU_KEY_DELETE,
+    [0x152] = QEMU_KEY_PAGEDOWN,
+    [0x153] = QEMU_KEY_PAGEUP,
+    [0x157] = '\n',
+    [0x168] = QEMU_KEY_END,
+
+};
+
+typedef struct {
+	const char* name;
+	int keysym;
+} name2keysym_t;
+
+static name2keysym_t name2keysym[] = {
+    /* Plain ASCII */
+    { "space", 0x020 },
+    { "exclam", 0x021 },
+    { "quotedbl", 0x022 },
+    { "numbersign", 0x023 },
+    { "dollar", 0x024 },
+    { "percent", 0x025 },
+    { "ampersand", 0x026 },
+    { "apostrophe", 0x027 },
+    { "parenleft", 0x028 },
+    { "parenright", 0x029 },
+    { "asterisk", 0x02a },
+    { "plus", 0x02b },
+    { "comma", 0x02c },
+    { "minus", 0x02d },
+    { "period", 0x02e },
+    { "slash", 0x02f },
+    { "0", 0x030 },
+    { "1", 0x031 },
+    { "2", 0x032 },
+    { "3", 0x033 },
+    { "4", 0x034 },
+    { "5", 0x035 },
+    { "6", 0x036 },
+    { "7", 0x037 },
+    { "8", 0x038 },
+    { "9", 0x039 },
+    { "colon", 0x03a },
+    { "semicolon", 0x03b },
+    { "less", 0x03c },
+    { "equal", 0x03d },
+    { "greater", 0x03e },
+    { "question", 0x03f },
+    { "at", 0x040 },
+    { "A", 0x041 },
+    { "B", 0x042 },
+    { "C", 0x043 },
+    { "D", 0x044 },
+    { "E", 0x045 },
+    { "F", 0x046 },
+    { "G", 0x047 },
+    { "H", 0x048 },
+    { "I", 0x049 },
+    { "J", 0x04a },
+    { "K", 0x04b },
+    { "L", 0x04c },
+    { "M", 0x04d },
+    { "N", 0x04e },
+    { "O", 0x04f },
+    { "P", 0x050 },
+    { "Q", 0x051 },
+    { "R", 0x052 },
+    { "S", 0x053 },
+    { "T", 0x054 },
+    { "U", 0x055 },
+    { "V", 0x056 },
+    { "W", 0x057 },
+    { "X", 0x058 },
+    { "Y", 0x059 },
+    { "Z", 0x05a },
+    { "bracketleft", 0x05b },
+    { "backslash", 0x05c },
+    { "bracketright", 0x05d },
+    { "asciicircum", 0x05e },
+    { "underscore", 0x05f },
+    { "grave", 0x060 },
+    { "a", 0x061 },
+    { "b", 0x062 },
+    { "c", 0x063 },
+    { "d", 0x064 },
+    { "e", 0x065 },
+    { "f", 0x066 },
+    { "g", 0x067 },
+    { "h", 0x068 },
+    { "i", 0x069 },
+    { "j", 0x06a },
+    { "k", 0x06b },
+    { "l", 0x06c },
+    { "m", 0x06d },
+    { "n", 0x06e },
+    { "o", 0x06f },
+    { "p", 0x070 },
+    { "q", 0x071 },
+    { "r", 0x072 },
+    { "s", 0x073 },
+    { "t", 0x074 },
+    { "u", 0x075 },
+    { "v", 0x076 },
+    { "w", 0x077 },
+    { "x", 0x078 },
+    { "y", 0x079 },
+    { "z", 0x07a },
+    { "braceleft", 0x07b },
+    { "bar", 0x07c },
+    { "braceright", 0x07d },
+    { "asciitilde", 0x07e },
+
+    /* Latin-1 extensions */
+    { "nobreakspace", 0x0a0 },
+    { "exclamdown", 0x0a1 },
+    { "cent", 0x0a2 },
+    { "sterling", 0x0a3 },
+    { "currency", 0x0a4 },
+    { "yen", 0x0a5 },
+    { "brokenbar", 0x0a6 },
+    { "section", 0x0a7 },
+    { "diaeresis", 0x0a8 },
+    { "copyright", 0x0a9 },
+    { "ordfeminine", 0x0aa },
+    { "guillemotleft", 0x0ab },
+    { "notsign", 0x0ac },
+    { "hyphen", 0x0ad },
+    { "registered", 0x0ae },
+    { "macron", 0x0af },
+    { "degree", 0x0b0 },
+    { "plusminus", 0x0b1 },
+    { "twosuperior", 0x0b2 },
+    { "threesuperior", 0x0b3 },
+    { "acute", 0x0b4 },
+    { "mu", 0x0b5 },
+    { "paragraph", 0x0b6 },
+    { "periodcentered", 0x0b7 },
+    { "cedilla", 0x0b8 },
+    { "onesuperior", 0x0b9 },
+    { "masculine", 0x0ba },
+    { "guillemotright", 0x0bb },
+    { "onequarter", 0x0bc },
+    { "onehalf", 0x0bd },
+    { "threequarters", 0x0be },
+    { "questiondown", 0x0bf },
+    { "Agrave", 0x0c0 },
+    { "Aacute", 0x0c1 },
+    { "Acircumflex", 0x0c2 },
+    { "Atilde", 0x0c3 },
+    { "Adiaeresis", 0x0c4 },
+    { "Aring", 0x0c5 },
+    { "AE", 0x0c6 },
+    { "Ccedilla", 0x0c7 },
+    { "Egrave", 0x0c8 },
+    { "Eacute", 0x0c9 },
+    { "Ecircumflex", 0x0ca },
+    { "Ediaeresis", 0x0cb },
+    { "Igrave", 0x0cc },
+    { "Iacute", 0x0cd },
+    { "Icircumflex", 0x0ce },
+    { "Idiaeresis", 0x0cf },
+    { "ETH", 0x0d0 },
+    { "Eth", 0x0d0 },
+    { "Ntilde", 0x0d1 },
+    { "Ograve", 0x0d2 },
+    { "Oacute", 0x0d3 },
+    { "Ocircumflex", 0x0d4 },
+    { "Otilde", 0x0d5 },
+    { "Odiaeresis", 0x0d6 },
+    { "multiply", 0x0d7 },
+    { "Ooblique", 0x0d8 },
+    { "Oslash", 0x0d8 },
+    { "Ugrave", 0x0d9 },
+    { "Uacute", 0x0da },
+    { "Ucircumflex", 0x0db },
+    { "Udiaeresis", 0x0dc },
+    { "Yacute", 0x0dd },
+    { "THORN", 0x0de },
+    { "Thorn", 0x0de },
+    { "ssharp", 0x0df },
+    { "agrave", 0x0e0 },
+    { "aacute", 0x0e1 },
+    { "acircumflex", 0x0e2 },
+    { "atilde", 0x0e3 },
+    { "adiaeresis", 0x0e4 },
+    { "aring", 0x0e5 },
+    { "ae", 0x0e6 },
+    { "ccedilla", 0x0e7 },
+    { "egrave", 0x0e8 },
+    { "eacute", 0x0e9 },
+    { "ecircumflex", 0x0ea },
+    { "ediaeresis", 0x0eb },
+    { "igrave", 0x0ec },
+    { "iacute", 0x0ed },
+    { "icircumflex", 0x0ee },
+    { "idiaeresis", 0x0ef },
+    { "eth", 0x0f0 },
+    { "ntilde", 0x0f1 },
+    { "ograve", 0x0f2 },
+    { "oacute", 0x0f3 },
+    { "ocircumflex", 0x0f4 },
+    { "otilde", 0x0f5 },
+    { "odiaeresis", 0x0f6 },
+    { "division", 0x0f7 },
+    { "oslash", 0x0f8 },
+    { "ooblique", 0x0f8 },
+    { "ugrave", 0x0f9 },
+    { "uacute", 0x0fa },
+    { "ucircumflex", 0x0fb },
+    { "udiaeresis", 0x0fc },
+    { "yacute", 0x0fd },
+    { "thorn", 0x0fe },
+    { "ydiaeresis", 0x0ff },
+
+    /* Special keys */
+    { "BackSpace", 0x07f },
+    { "Tab", '\t' },
+    { "Return", '\r' },
+    { "Right", 0x105 },
+    { "Left", 0x104 },
+    { "Up", 0x103 },
+    { "Down", 0x102 },
+    { "Page_Down", 0x152 },
+    { "Page_Up", 0x153 },
+    { "Insert", 0x14b },
+    { "Delete", 0x14a },
+    { "Home", 0x106 },
+    { "End", 0x168 },
+    { "F1", 0x109 },
+    { "F2", 0x10a },
+    { "F3", 0x10b },
+    { "F4", 0x10c },
+    { "F5", 0x10d },
+    { "F6", 0x10e },
+    { "F7", 0x10f },
+    { "F8", 0x110 },
+    { "F9", 0x111 },
+    { "F10", 0x112 },
+    { "F11", 0x113 },
+    { "F12", 0x114 },
+    { "F13", 0x115 },
+    { "F14", 0x116 },
+    { "F15", 0x117 },
+    { "F16", 0x118 },
+    { "F17", 0x119 },
+    { "F18", 0x11a },
+    { "F19", 0x11b },
+    { "F20", 0x11c },
+    { "Escape", 27 },
+
+    { 0, 0 },
+};
diff --git a/cutils.c b/cutils.c
new file mode 100644
index 0000000..b256286
--- /dev/null
+++ b/cutils.c
@@ -0,0 +1,137 @@
+/*
+ * Simple C functions to supplement the C library
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu-common.h"
+
+void pstrcpy(char *buf, int buf_size, const char *str)
+{
+    int c;
+    char *q = buf;
+
+    if (buf_size <= 0)
+        return;
+
+    for(;;) {
+        c = *str++;
+        if (c == 0 || q >= buf + buf_size - 1)
+            break;
+        *q++ = c;
+    }
+    *q = '\0';
+}
+
+/* strcat and truncate. */
+char *pstrcat(char *buf, int buf_size, const char *s)
+{
+    int len;
+    len = strlen(buf);
+    if (len < buf_size)
+        pstrcpy(buf + len, buf_size - len, s);
+    return buf;
+}
+
+int strstart(const char *str, const char *val, const char **ptr)
+{
+    const char *p, *q;
+    p = str;
+    q = val;
+    while (*q != '\0') {
+        if (*p != *q)
+            return 0;
+        p++;
+        q++;
+    }
+    if (ptr)
+        *ptr = p;
+    return 1;
+}
+
+int stristart(const char *str, const char *val, const char **ptr)
+{
+    const char *p, *q;
+    p = str;
+    q = val;
+    while (*q != '\0') {
+        if (toupper(*p) != toupper(*q))
+            return 0;
+        p++;
+        q++;
+    }
+    if (ptr)
+        *ptr = p;
+    return 1;
+}
+
+time_t mktimegm(struct tm *tm)
+{
+    time_t t;
+    int y = tm->tm_year + 1900, m = tm->tm_mon + 1, d = tm->tm_mday;
+    if (m < 3) {
+        m += 12;
+        y--;
+    }
+    t = 86400 * (d + (153 * m - 457) / 5 + 365 * y + y / 4 - y / 100 + 
+                 y / 400 - 719469);
+    t += 3600 * tm->tm_hour + 60 * tm->tm_min + tm->tm_sec;
+    return t;
+}
+
+void *get_mmap_addr(unsigned long size)
+{
+    return NULL;
+}
+
+void qemu_free(void *ptr)
+{
+    free(ptr);
+}
+
+void *qemu_malloc(size_t size)
+{
+    return malloc(size);
+}
+
+void *qemu_mallocz(size_t size)
+{
+    void *ptr;
+    ptr = qemu_malloc(size);
+    if (!ptr)
+        return NULL;
+    memset(ptr, 0, size);
+    return ptr;
+}
+
+void *qemu_realloc(void*  ptr, size_t size)
+{
+    return realloc(ptr, size);
+}
+
+char *qemu_strdup(const char *str)
+{
+    char *ptr;
+    ptr = qemu_malloc(strlen(str) + 1);
+    if (!ptr)
+        return NULL;
+    strcpy(ptr, str);
+    return ptr;
+}
diff --git a/d3des.c b/d3des.c
new file mode 100644
index 0000000..6e8a02e
--- /dev/null
+++ b/d3des.c
@@ -0,0 +1,434 @@
+/*
+ * This is D3DES (V5.09) by Richard Outerbridge with the double and
+ * triple-length support removed for use in VNC.  Also the bytebit[] array
+ * has been reversed so that the most significant bit in each byte of the
+ * key is ignored, not the least significant.
+ *
+ * These changes are:
+ *  Copyright (C) 1999 AT&T Laboratories Cambridge.  All Rights Reserved.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+/* D3DES (V5.09) -
+ *
+ * A portable, public domain, version of the Data Encryption Standard.
+ *
+ * Written with Symantec's THINK (Lightspeed) C by Richard Outerbridge.
+ * Thanks to: Dan Hoey for his excellent Initial and Inverse permutation
+ * code;  Jim Gillogly & Phil Karn for the DES key schedule code; Dennis
+ * Ferguson, Eric Young and Dana How for comparing notes; and Ray Lau,
+ * for humouring me on.
+ *
+ * Copyright (c) 1988,1989,1990,1991,1992 by Richard Outerbridge.
+ * (GEnie : OUTER; CIS : [71755,204]) Graven Imagery, 1992.
+ */
+
+#include "d3des.h"
+
+static void scrunch(unsigned char *, unsigned long *);
+static void unscrun(unsigned long *, unsigned char *);
+static void desfunc(unsigned long *, unsigned long *);
+static void cookey(unsigned long *);
+
+static unsigned long KnL[32] = { 0L };
+
+static const unsigned short bytebit[8]	= {
+	01, 02, 04, 010, 020, 040, 0100, 0200 };
+
+static const unsigned long bigbyte[24] = {
+	0x800000L,	0x400000L,	0x200000L,	0x100000L,
+	0x80000L,	0x40000L,	0x20000L,	0x10000L,
+	0x8000L,	0x4000L,	0x2000L,	0x1000L,
+	0x800L, 	0x400L, 	0x200L, 	0x100L,
+	0x80L,		0x40L,		0x20L,		0x10L,
+	0x8L,		0x4L,		0x2L,		0x1L	};
+
+/* Use the key schedule specified in the Standard (ANSI X3.92-1981). */
+
+static const unsigned char pc1[56] = {
+	56, 48, 40, 32, 24, 16,  8,	 0, 57, 49, 41, 33, 25, 17,
+	 9,  1, 58, 50, 42, 34, 26,	18, 10,  2, 59, 51, 43, 35,
+	62, 54, 46, 38, 30, 22, 14,	 6, 61, 53, 45, 37, 29, 21,
+	13,  5, 60, 52, 44, 36, 28,	20, 12,  4, 27, 19, 11,  3 };
+
+static const unsigned char totrot[16] = {
+	1,2,4,6,8,10,12,14,15,17,19,21,23,25,27,28 };
+
+static const unsigned char pc2[48] = {
+	13, 16, 10, 23,  0,  4,  2, 27, 14,  5, 20,  9,
+	22, 18, 11,  3, 25,  7, 15,  6, 26, 19, 12,  1,
+	40, 51, 30, 36, 46, 54, 29, 39, 50, 44, 32, 47,
+	43, 48, 38, 55, 33, 52, 45, 41, 49, 35, 28, 31 };
+
+void deskey(key, edf)	/* Thanks to James Gillogly & Phil Karn! */
+unsigned char *key;
+int edf;
+{
+	register int i, j, l, m, n;
+	unsigned char pc1m[56], pcr[56];
+	unsigned long kn[32];
+
+	for ( j = 0; j < 56; j++ ) {
+		l = pc1[j];
+		m = l & 07;
+		pc1m[j] = (key[l >> 3] & bytebit[m]) ? 1 : 0;
+		}
+	for( i = 0; i < 16; i++ ) {
+		if( edf == DE1 ) m = (15 - i) << 1;
+		else m = i << 1;
+		n = m + 1;
+		kn[m] = kn[n] = 0L;
+		for( j = 0; j < 28; j++ ) {
+			l = j + totrot[i];
+			if( l < 28 ) pcr[j] = pc1m[l];
+			else pcr[j] = pc1m[l - 28];
+			}
+		for( j = 28; j < 56; j++ ) {
+		    l = j + totrot[i];
+		    if( l < 56 ) pcr[j] = pc1m[l];
+		    else pcr[j] = pc1m[l - 28];
+		    }
+		for( j = 0; j < 24; j++ ) {
+			if( pcr[pc2[j]] ) kn[m] |= bigbyte[j];
+			if( pcr[pc2[j+24]] ) kn[n] |= bigbyte[j];
+			}
+		}
+	cookey(kn);
+	return;
+	}
+
+static void cookey(raw1)
+register unsigned long *raw1;
+{
+	register unsigned long *cook, *raw0;
+	unsigned long dough[32];
+	register int i;
+
+	cook = dough;
+	for( i = 0; i < 16; i++, raw1++ ) {
+		raw0 = raw1++;
+		*cook	 = (*raw0 & 0x00fc0000L) << 6;
+		*cook	|= (*raw0 & 0x00000fc0L) << 10;
+		*cook	|= (*raw1 & 0x00fc0000L) >> 10;
+		*cook++ |= (*raw1 & 0x00000fc0L) >> 6;
+		*cook	 = (*raw0 & 0x0003f000L) << 12;
+		*cook	|= (*raw0 & 0x0000003fL) << 16;
+		*cook	|= (*raw1 & 0x0003f000L) >> 4;
+		*cook++ |= (*raw1 & 0x0000003fL);
+		}
+	usekey(dough);
+	return;
+	}
+
+void cpkey(into)
+register unsigned long *into;
+{
+	register unsigned long *from, *endp;
+
+	from = KnL, endp = &KnL[32];
+	while( from < endp ) *into++ = *from++;
+	return;
+	}
+
+void usekey(from)
+register unsigned long *from;
+{
+	register unsigned long *to, *endp;
+
+	to = KnL, endp = &KnL[32];
+	while( to < endp ) *to++ = *from++;
+	return;
+	}
+
+void des(inblock, outblock)
+unsigned char *inblock, *outblock;
+{
+	unsigned long work[2];
+
+	scrunch(inblock, work);
+	desfunc(work, KnL);
+	unscrun(work, outblock);
+	return;
+	}
+
+static void scrunch(outof, into)
+register unsigned char *outof;
+register unsigned long *into;
+{
+	*into	 = (*outof++ & 0xffL) << 24;
+	*into	|= (*outof++ & 0xffL) << 16;
+	*into	|= (*outof++ & 0xffL) << 8;
+	*into++ |= (*outof++ & 0xffL);
+	*into	 = (*outof++ & 0xffL) << 24;
+	*into	|= (*outof++ & 0xffL) << 16;
+	*into	|= (*outof++ & 0xffL) << 8;
+	*into	|= (*outof   & 0xffL);
+	return;
+	}
+
+static void unscrun(outof, into)
+register unsigned long *outof;
+register unsigned char *into;
+{
+	*into++ = (unsigned char)((*outof >> 24) & 0xffL);
+	*into++ = (unsigned char)((*outof >> 16) & 0xffL);
+	*into++ = (unsigned char)((*outof >>  8) & 0xffL);
+	*into++ = (unsigned char)(*outof++	 & 0xffL);
+	*into++ = (unsigned char)((*outof >> 24) & 0xffL);
+	*into++ = (unsigned char)((*outof >> 16) & 0xffL);
+	*into++ = (unsigned char)((*outof >>  8) & 0xffL);
+	*into	=  (unsigned char)(*outof	 & 0xffL);
+	return;
+	}
+
+static unsigned long SP1[64] = {
+	0x01010400L, 0x00000000L, 0x00010000L, 0x01010404L,
+	0x01010004L, 0x00010404L, 0x00000004L, 0x00010000L,
+	0x00000400L, 0x01010400L, 0x01010404L, 0x00000400L,
+	0x01000404L, 0x01010004L, 0x01000000L, 0x00000004L,
+	0x00000404L, 0x01000400L, 0x01000400L, 0x00010400L,
+	0x00010400L, 0x01010000L, 0x01010000L, 0x01000404L,
+	0x00010004L, 0x01000004L, 0x01000004L, 0x00010004L,
+	0x00000000L, 0x00000404L, 0x00010404L, 0x01000000L,
+	0x00010000L, 0x01010404L, 0x00000004L, 0x01010000L,
+	0x01010400L, 0x01000000L, 0x01000000L, 0x00000400L,
+	0x01010004L, 0x00010000L, 0x00010400L, 0x01000004L,
+	0x00000400L, 0x00000004L, 0x01000404L, 0x00010404L,
+	0x01010404L, 0x00010004L, 0x01010000L, 0x01000404L,
+	0x01000004L, 0x00000404L, 0x00010404L, 0x01010400L,
+	0x00000404L, 0x01000400L, 0x01000400L, 0x00000000L,
+	0x00010004L, 0x00010400L, 0x00000000L, 0x01010004L };
+
+static unsigned long SP2[64] = {
+	0x80108020L, 0x80008000L, 0x00008000L, 0x00108020L,
+	0x00100000L, 0x00000020L, 0x80100020L, 0x80008020L,
+	0x80000020L, 0x80108020L, 0x80108000L, 0x80000000L,
+	0x80008000L, 0x00100000L, 0x00000020L, 0x80100020L,
+	0x00108000L, 0x00100020L, 0x80008020L, 0x00000000L,
+	0x80000000L, 0x00008000L, 0x00108020L, 0x80100000L,
+	0x00100020L, 0x80000020L, 0x00000000L, 0x00108000L,
+	0x00008020L, 0x80108000L, 0x80100000L, 0x00008020L,
+	0x00000000L, 0x00108020L, 0x80100020L, 0x00100000L,
+	0x80008020L, 0x80100000L, 0x80108000L, 0x00008000L,
+	0x80100000L, 0x80008000L, 0x00000020L, 0x80108020L,
+	0x00108020L, 0x00000020L, 0x00008000L, 0x80000000L,
+	0x00008020L, 0x80108000L, 0x00100000L, 0x80000020L,
+	0x00100020L, 0x80008020L, 0x80000020L, 0x00100020L,
+	0x00108000L, 0x00000000L, 0x80008000L, 0x00008020L,
+	0x80000000L, 0x80100020L, 0x80108020L, 0x00108000L };
+
+static unsigned long SP3[64] = {
+	0x00000208L, 0x08020200L, 0x00000000L, 0x08020008L,
+	0x08000200L, 0x00000000L, 0x00020208L, 0x08000200L,
+	0x00020008L, 0x08000008L, 0x08000008L, 0x00020000L,
+	0x08020208L, 0x00020008L, 0x08020000L, 0x00000208L,
+	0x08000000L, 0x00000008L, 0x08020200L, 0x00000200L,
+	0x00020200L, 0x08020000L, 0x08020008L, 0x00020208L,
+	0x08000208L, 0x00020200L, 0x00020000L, 0x08000208L,
+	0x00000008L, 0x08020208L, 0x00000200L, 0x08000000L,
+	0x08020200L, 0x08000000L, 0x00020008L, 0x00000208L,
+	0x00020000L, 0x08020200L, 0x08000200L, 0x00000000L,
+	0x00000200L, 0x00020008L, 0x08020208L, 0x08000200L,
+	0x08000008L, 0x00000200L, 0x00000000L, 0x08020008L,
+	0x08000208L, 0x00020000L, 0x08000000L, 0x08020208L,
+	0x00000008L, 0x00020208L, 0x00020200L, 0x08000008L,
+	0x08020000L, 0x08000208L, 0x00000208L, 0x08020000L,
+	0x00020208L, 0x00000008L, 0x08020008L, 0x00020200L };
+
+static unsigned long SP4[64] = {
+	0x00802001L, 0x00002081L, 0x00002081L, 0x00000080L,
+	0x00802080L, 0x00800081L, 0x00800001L, 0x00002001L,
+	0x00000000L, 0x00802000L, 0x00802000L, 0x00802081L,
+	0x00000081L, 0x00000000L, 0x00800080L, 0x00800001L,
+	0x00000001L, 0x00002000L, 0x00800000L, 0x00802001L,
+	0x00000080L, 0x00800000L, 0x00002001L, 0x00002080L,
+	0x00800081L, 0x00000001L, 0x00002080L, 0x00800080L,
+	0x00002000L, 0x00802080L, 0x00802081L, 0x00000081L,
+	0x00800080L, 0x00800001L, 0x00802000L, 0x00802081L,
+	0x00000081L, 0x00000000L, 0x00000000L, 0x00802000L,
+	0x00002080L, 0x00800080L, 0x00800081L, 0x00000001L,
+	0x00802001L, 0x00002081L, 0x00002081L, 0x00000080L,
+	0x00802081L, 0x00000081L, 0x00000001L, 0x00002000L,
+	0x00800001L, 0x00002001L, 0x00802080L, 0x00800081L,
+	0x00002001L, 0x00002080L, 0x00800000L, 0x00802001L,
+	0x00000080L, 0x00800000L, 0x00002000L, 0x00802080L };
+
+static unsigned long SP5[64] = {
+	0x00000100L, 0x02080100L, 0x02080000L, 0x42000100L,
+	0x00080000L, 0x00000100L, 0x40000000L, 0x02080000L,
+	0x40080100L, 0x00080000L, 0x02000100L, 0x40080100L,
+	0x42000100L, 0x42080000L, 0x00080100L, 0x40000000L,
+	0x02000000L, 0x40080000L, 0x40080000L, 0x00000000L,
+	0x40000100L, 0x42080100L, 0x42080100L, 0x02000100L,
+	0x42080000L, 0x40000100L, 0x00000000L, 0x42000000L,
+	0x02080100L, 0x02000000L, 0x42000000L, 0x00080100L,
+	0x00080000L, 0x42000100L, 0x00000100L, 0x02000000L,
+	0x40000000L, 0x02080000L, 0x42000100L, 0x40080100L,
+	0x02000100L, 0x40000000L, 0x42080000L, 0x02080100L,
+	0x40080100L, 0x00000100L, 0x02000000L, 0x42080000L,
+	0x42080100L, 0x00080100L, 0x42000000L, 0x42080100L,
+	0x02080000L, 0x00000000L, 0x40080000L, 0x42000000L,
+	0x00080100L, 0x02000100L, 0x40000100L, 0x00080000L,
+	0x00000000L, 0x40080000L, 0x02080100L, 0x40000100L };
+
+static unsigned long SP6[64] = {
+	0x20000010L, 0x20400000L, 0x00004000L, 0x20404010L,
+	0x20400000L, 0x00000010L, 0x20404010L, 0x00400000L,
+	0x20004000L, 0x00404010L, 0x00400000L, 0x20000010L,
+	0x00400010L, 0x20004000L, 0x20000000L, 0x00004010L,
+	0x00000000L, 0x00400010L, 0x20004010L, 0x00004000L,
+	0x00404000L, 0x20004010L, 0x00000010L, 0x20400010L,
+	0x20400010L, 0x00000000L, 0x00404010L, 0x20404000L,
+	0x00004010L, 0x00404000L, 0x20404000L, 0x20000000L,
+	0x20004000L, 0x00000010L, 0x20400010L, 0x00404000L,
+	0x20404010L, 0x00400000L, 0x00004010L, 0x20000010L,
+	0x00400000L, 0x20004000L, 0x20000000L, 0x00004010L,
+	0x20000010L, 0x20404010L, 0x00404000L, 0x20400000L,
+	0x00404010L, 0x20404000L, 0x00000000L, 0x20400010L,
+	0x00000010L, 0x00004000L, 0x20400000L, 0x00404010L,
+	0x00004000L, 0x00400010L, 0x20004010L, 0x00000000L,
+	0x20404000L, 0x20000000L, 0x00400010L, 0x20004010L };
+
+static unsigned long SP7[64] = {
+	0x00200000L, 0x04200002L, 0x04000802L, 0x00000000L,
+	0x00000800L, 0x04000802L, 0x00200802L, 0x04200800L,
+	0x04200802L, 0x00200000L, 0x00000000L, 0x04000002L,
+	0x00000002L, 0x04000000L, 0x04200002L, 0x00000802L,
+	0x04000800L, 0x00200802L, 0x00200002L, 0x04000800L,
+	0x04000002L, 0x04200000L, 0x04200800L, 0x00200002L,
+	0x04200000L, 0x00000800L, 0x00000802L, 0x04200802L,
+	0x00200800L, 0x00000002L, 0x04000000L, 0x00200800L,
+	0x04000000L, 0x00200800L, 0x00200000L, 0x04000802L,
+	0x04000802L, 0x04200002L, 0x04200002L, 0x00000002L,
+	0x00200002L, 0x04000000L, 0x04000800L, 0x00200000L,
+	0x04200800L, 0x00000802L, 0x00200802L, 0x04200800L,
+	0x00000802L, 0x04000002L, 0x04200802L, 0x04200000L,
+	0x00200800L, 0x00000000L, 0x00000002L, 0x04200802L,
+	0x00000000L, 0x00200802L, 0x04200000L, 0x00000800L,
+	0x04000002L, 0x04000800L, 0x00000800L, 0x00200002L };
+
+static unsigned long SP8[64] = {
+	0x10001040L, 0x00001000L, 0x00040000L, 0x10041040L,
+	0x10000000L, 0x10001040L, 0x00000040L, 0x10000000L,
+	0x00040040L, 0x10040000L, 0x10041040L, 0x00041000L,
+	0x10041000L, 0x00041040L, 0x00001000L, 0x00000040L,
+	0x10040000L, 0x10000040L, 0x10001000L, 0x00001040L,
+	0x00041000L, 0x00040040L, 0x10040040L, 0x10041000L,
+	0x00001040L, 0x00000000L, 0x00000000L, 0x10040040L,
+	0x10000040L, 0x10001000L, 0x00041040L, 0x00040000L,
+	0x00041040L, 0x00040000L, 0x10041000L, 0x00001000L,
+	0x00000040L, 0x10040040L, 0x00001000L, 0x00041040L,
+	0x10001000L, 0x00000040L, 0x10000040L, 0x10040000L,
+	0x10040040L, 0x10000000L, 0x00040000L, 0x10001040L,
+	0x00000000L, 0x10041040L, 0x00040040L, 0x10000040L,
+	0x10040000L, 0x10001000L, 0x10001040L, 0x00000000L,
+	0x10041040L, 0x00041000L, 0x00041000L, 0x00001040L,
+	0x00001040L, 0x00040040L, 0x10000000L, 0x10041000L };
+
+static void desfunc(block, keys)
+register unsigned long *block, *keys;
+{
+	register unsigned long fval, work, right, leftt;
+	register int round;
+
+	leftt = block[0];
+	right = block[1];
+	work = ((leftt >> 4) ^ right) & 0x0f0f0f0fL;
+	right ^= work;
+	leftt ^= (work << 4);
+	work = ((leftt >> 16) ^ right) & 0x0000ffffL;
+	right ^= work;
+	leftt ^= (work << 16);
+	work = ((right >> 2) ^ leftt) & 0x33333333L;
+	leftt ^= work;
+	right ^= (work << 2);
+	work = ((right >> 8) ^ leftt) & 0x00ff00ffL;
+	leftt ^= work;
+	right ^= (work << 8);
+	right = ((right << 1) | ((right >> 31) & 1L)) & 0xffffffffL;
+	work = (leftt ^ right) & 0xaaaaaaaaL;
+	leftt ^= work;
+	right ^= work;
+	leftt = ((leftt << 1) | ((leftt >> 31) & 1L)) & 0xffffffffL;
+
+	for( round = 0; round < 8; round++ ) {
+		work  = (right << 28) | (right >> 4);
+		work ^= *keys++;
+		fval  = SP7[ work		 & 0x3fL];
+		fval |= SP5[(work >>  8) & 0x3fL];
+		fval |= SP3[(work >> 16) & 0x3fL];
+		fval |= SP1[(work >> 24) & 0x3fL];
+		work  = right ^ *keys++;
+		fval |= SP8[ work		 & 0x3fL];
+		fval |= SP6[(work >>  8) & 0x3fL];
+		fval |= SP4[(work >> 16) & 0x3fL];
+		fval |= SP2[(work >> 24) & 0x3fL];
+		leftt ^= fval;
+		work  = (leftt << 28) | (leftt >> 4);
+		work ^= *keys++;
+		fval  = SP7[ work		 & 0x3fL];
+		fval |= SP5[(work >>  8) & 0x3fL];
+		fval |= SP3[(work >> 16) & 0x3fL];
+		fval |= SP1[(work >> 24) & 0x3fL];
+		work  = leftt ^ *keys++;
+		fval |= SP8[ work		 & 0x3fL];
+		fval |= SP6[(work >>  8) & 0x3fL];
+		fval |= SP4[(work >> 16) & 0x3fL];
+		fval |= SP2[(work >> 24) & 0x3fL];
+		right ^= fval;
+		}
+
+	right = (right << 31) | (right >> 1);
+	work = (leftt ^ right) & 0xaaaaaaaaL;
+	leftt ^= work;
+	right ^= work;
+	leftt = (leftt << 31) | (leftt >> 1);
+	work = ((leftt >> 8) ^ right) & 0x00ff00ffL;
+	right ^= work;
+	leftt ^= (work << 8);
+	work = ((leftt >> 2) ^ right) & 0x33333333L;
+	right ^= work;
+	leftt ^= (work << 2);
+	work = ((right >> 16) ^ leftt) & 0x0000ffffL;
+	leftt ^= work;
+	right ^= (work << 16);
+	work = ((right >> 4) ^ leftt) & 0x0f0f0f0fL;
+	leftt ^= work;
+	right ^= (work << 4);
+	*block++ = right;
+	*block = leftt;
+	return;
+	}
+
+/* Validation sets:
+ *
+ * Single-length key, single-length plaintext -
+ * Key	  : 0123 4567 89ab cdef
+ * Plain  : 0123 4567 89ab cde7
+ * Cipher : c957 4425 6a5e d31d
+ *
+ * Double-length key, single-length plaintext -
+ * Key	  : 0123 4567 89ab cdef fedc ba98 7654 3210
+ * Plain  : 0123 4567 89ab cde7
+ * Cipher : 7f1d 0a77 826b 8aff
+ *
+ * Double-length key, double-length plaintext -
+ * Key	  : 0123 4567 89ab cdef fedc ba98 7654 3210
+ * Plain  : 0123 4567 89ab cdef 0123 4567 89ab cdff
+ * Cipher : 27a0 8440 406a df60 278f 47cf 42d6 15d7
+ *
+ * Triple-length key, single-length plaintext -
+ * Key	  : 0123 4567 89ab cdef fedc ba98 7654 3210 89ab cdef 0123 4567
+ * Plain  : 0123 4567 89ab cde7
+ * Cipher : de0b 7c06 ae5e 0ed5
+ *
+ * Triple-length key, double-length plaintext -
+ * Key	  : 0123 4567 89ab cdef fedc ba98 7654 3210 89ab cdef 0123 4567
+ * Plain  : 0123 4567 89ab cdef 0123 4567 89ab cdff
+ * Cipher : ad0d 1b30 ac17 cf07 0ed1 1c63 81e4 4de5
+ *
+ * d3des V5.0a rwo 9208.07 18:44 Graven Imagery
+ **********************************************************************/
diff --git a/d3des.h b/d3des.h
new file mode 100644
index 0000000..ea3da44
--- /dev/null
+++ b/d3des.h
@@ -0,0 +1,51 @@
+/*
+ * This is D3DES (V5.09) by Richard Outerbridge with the double and
+ * triple-length support removed for use in VNC.
+ *
+ * These changes are:
+ *  Copyright (C) 1999 AT&T Laboratories Cambridge.  All Rights Reserved.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+/* d3des.h -
+ *
+ *	Headers and defines for d3des.c
+ *	Graven Imagery, 1992.
+ *
+ * Copyright (c) 1988,1989,1990,1991,1992 by Richard Outerbridge
+ *	(GEnie : OUTER; CIS : [71755,204])
+ */
+
+#define EN0	0	/* MODE == encrypt */
+#define DE1	1	/* MODE == decrypt */
+
+extern void deskey(unsigned char *, int);
+/*		      hexkey[8]     MODE
+ * Sets the internal key register according to the hexadecimal
+ * key contained in the 8 bytes of hexkey, according to the DES,
+ * for encryption or decryption according to MODE.
+ */
+
+extern void usekey(unsigned long *);
+/*		    cookedkey[32]
+ * Loads the internal key register with the data in cookedkey.
+ */
+
+extern void cpkey(unsigned long *);
+/*		   cookedkey[32]
+ * Copies the contents of the internal key register into the storage
+ * located at &cookedkey[0].
+ */
+
+extern void des(unsigned char *, unsigned char *);
+/*		    from[8]	      to[8]
+ * Encrypts/Decrypts (according to the key currently loaded in the
+ * internal key register) one block of eight bytes at address 'from'
+ * into the block at address 'to'.  They can be the same.
+ */
+
+/* d3des.h V5.09 rwo 9208.04 15:06 Graven Imagery
+ ********************************************************************/
diff --git a/dcache.c b/dcache.c
index 7a55d0c..56426ee 100644
--- a/dcache.c
+++ b/dcache.c
@@ -20,6 +20,13 @@
 
 extern FILE *ftrace_debug;
 
+int dcache_size = 16 * 1024;
+int dcache_ways = 4;
+int dcache_line_size = 32;
+int dcache_replace_policy = kPolicyRandom;
+int dcache_load_miss_penalty = 30;
+int dcache_store_miss_penalty = 5;
+
 typedef struct Dcache {
   int		size;
   int		ways;
diff --git a/dcache.h b/dcache.h
index 15e249b..8857600 100644
--- a/dcache.h
+++ b/dcache.h
@@ -18,6 +18,13 @@
 #define kPolicyRoundRobin 1
 #define kPolicyRandom 2
 
+extern int dcache_size;
+extern int dcache_ways;
+extern int dcache_line_size;
+extern int dcache_replace_policy;
+extern int dcache_load_miss_penalty;
+extern int dcache_store_miss_penalty;
+
 extern void dcache_init(int size, int ways, int line_size, int replace_policy,
                         int load_miss_penalty, int store_miss_penalty);
 
diff --git a/dis-asm.h b/dis-asm.h
index 73b4380..1ba86dd 100644
--- a/dis-asm.h
+++ b/dis-asm.h
@@ -20,6 +20,7 @@ typedef uint64_t bfd_vma;
 typedef int64_t bfd_signed_vma;
 typedef uint8_t bfd_byte;
 #define sprintf_vma(s,x) sprintf (s, "%0" PRIx64, x)
+#define snprintf_vma(s,ss,x) snprintf (s, ss, "%0" PRIx64, x)
 
 #define BFD64
 
@@ -44,7 +45,7 @@ enum bfd_flavour {
 
 enum bfd_endian { BFD_ENDIAN_BIG, BFD_ENDIAN_LITTLE, BFD_ENDIAN_UNKNOWN };
 
-enum bfd_architecture 
+enum bfd_architecture
 {
   bfd_arch_unknown,    /* File arch not known */
   bfd_arch_obscure,    /* Arch known, not one of these */
@@ -67,14 +68,14 @@ enum bfd_architecture
 #define bfd_mach_mcf5249   16
 #define bfd_mach_mcf547x   17
 #define bfd_mach_mcf548x   18
-  bfd_arch_vax,        /* DEC Vax */   
+  bfd_arch_vax,        /* DEC Vax */
   bfd_arch_i960,       /* Intel 960 */
      /* The order of the following is important.
-       lower number indicates a machine type that 
+       lower number indicates a machine type that
        only accepts a subset of the instructions
        available to machines with higher numbers.
        The exception is the "ca", which is
-       incompatible with all other machines except 
+       incompatible with all other machines except
        "core". */
 
 #define bfd_mach_i960_core      1
@@ -157,6 +158,10 @@ enum bfd_architecture
 #define bfd_mach_ppc_7400      7400
   bfd_arch_rs6000,     /* IBM RS/6000 */
   bfd_arch_hppa,       /* HP PA RISC */
+#define bfd_mach_hppa10        10
+#define bfd_mach_hppa11        11
+#define bfd_mach_hppa20        20
+#define bfd_mach_hppa20w       25
   bfd_arch_d10v,       /* Mitsubishi D10V */
   bfd_arch_z8k,        /* Zilog Z8000 */
 #define bfd_mach_z8001         1
@@ -181,13 +186,22 @@ enum bfd_architecture
 #define bfd_mach_sh4al_dsp  0x4d
 #define bfd_mach_sh5        0x50
   bfd_arch_alpha,      /* Dec Alpha */
+#define bfd_mach_alpha 1
   bfd_arch_arm,        /* Advanced Risc Machines ARM */
-#define bfd_mach_arm_2         1
-#define bfd_mach_arm_2a                2
-#define bfd_mach_arm_3         3
-#define bfd_mach_arm_3M        4
-#define bfd_mach_arm_4                 5
-#define bfd_mach_arm_4T        6
+#define bfd_mach_arm_unknown	0
+#define bfd_mach_arm_2		1
+#define bfd_mach_arm_2a		2
+#define bfd_mach_arm_3		3
+#define bfd_mach_arm_3M 	4
+#define bfd_mach_arm_4 		5
+#define bfd_mach_arm_4T 	6
+#define bfd_mach_arm_5 		7
+#define bfd_mach_arm_5T		8
+#define bfd_mach_arm_5TE	9
+#define bfd_mach_arm_XScale	10
+#define bfd_mach_arm_ep9312	11
+#define bfd_mach_arm_iWMMXt	12
+#define bfd_mach_arm_iWMMXt2	13
   bfd_arch_ns32k,      /* National Semiconductors ns32000 */
   bfd_arch_w65,        /* WDC 65816 */
   bfd_arch_tic30,      /* Texas Instruments TMS320C30 */
@@ -199,8 +213,14 @@ enum bfd_architecture
 #define bfd_mach_m32r          0  /* backwards compatibility */
   bfd_arch_mn10200,    /* Matsushita MN10200 */
   bfd_arch_mn10300,    /* Matsushita MN10300 */
+  bfd_arch_cris,       /* Axis CRIS */
+#define bfd_mach_cris_v0_v10   255
+#define bfd_mach_cris_v32      32
+#define bfd_mach_cris_v10_v32  1032
   bfd_arch_last
   };
+#define bfd_mach_s390_31 31
+#define bfd_mach_s390_64 64
 
 typedef struct symbol_cache_entry
 {
@@ -225,7 +245,7 @@ enum dis_insn_type {
   dis_dref2			/* Two data references in instruction */
 };
 
-/* This struct is passed into the instruction decoding routine, 
+/* This struct is passed into the instruction decoding routine,
    and is passed back out into each callback.  The various fields are used
    for conveying information from your main routine into your callbacks,
    for passing information into the instruction decoders (such as the
@@ -377,6 +397,8 @@ extern int print_insn_d10v		PARAMS ((bfd_vma, disassemble_info*));
 extern int print_insn_v850		PARAMS ((bfd_vma, disassemble_info*));
 extern int print_insn_tic30		PARAMS ((bfd_vma, disassemble_info*));
 extern int print_insn_ppc		PARAMS ((bfd_vma, disassemble_info*));
+extern int print_insn_s390		PARAMS ((bfd_vma, disassemble_info*));
+extern int print_insn_crisv32           PARAMS ((bfd_vma, disassemble_info*));
 
 #if 0
 /* Fetch the disassembler for a given BFD, if that support is available.  */
@@ -419,13 +441,14 @@ extern int generic_symbol_at_address
 /* Call this macro to initialize only the internal variables for the
    disassembler.  Architecture dependent things such as byte order, or machine
    variant are not touched by this macro.  This makes things much easier for
-   GDB which must initialize these things seperatly.  */
+   GDB which must initialize these things separately.  */
 
 #define INIT_DISASSEMBLE_INFO_NO_ARCH(INFO, STREAM, FPRINTF_FUNC) \
   (INFO).fprintf_func = (FPRINTF_FUNC), \
   (INFO).stream = (STREAM), \
   (INFO).symbols = NULL, \
   (INFO).num_symbols = 0, \
+  (INFO).private_data = NULL, \
   (INFO).buffer = NULL, \
   (INFO).buffer_vma = 0, \
   (INFO).buffer_length = 0, \
diff --git a/disas.c b/disas.c
index fd91b92..a8bc8ad 100644
--- a/disas.c
+++ b/disas.c
@@ -134,10 +134,10 @@ print_insn_thumb1(bfd_vma pc, disassemble_info *info)
 }
 #endif
 
-/* Disassemble this for me please... (debugging). 'flags' has teh following
+/* Disassemble this for me please... (debugging). 'flags' has the following
    values:
     i386 - nonzero means 16 bit code
-    arm  - nonzero means thumb code 
+    arm  - nonzero means thumb code
     ppc  - nonzero means little endian
     other targets - unused
  */
@@ -162,7 +162,7 @@ void target_disas(FILE *out, target_ulong code, target_ulong size, int flags)
 #if defined(TARGET_I386)
     if (flags == 2)
         disasm_info.mach = bfd_mach_x86_64;
-    else if (flags == 1) 
+    else if (flags == 1)
         disasm_info.mach = bfd_mach_i386_i8086;
     else
         disasm_info.mach = bfd_mach_i386_i386;
@@ -176,27 +176,38 @@ void target_disas(FILE *out, target_ulong code, target_ulong size, int flags)
     print_insn = print_insn_sparc;
 #ifdef TARGET_SPARC64
     disasm_info.mach = bfd_mach_sparc_v9b;
-#endif    
+#endif
 #elif defined(TARGET_PPC)
-    if (flags)
+    if (flags >> 16)
         disasm_info.endian = BFD_ENDIAN_LITTLE;
+    if (flags & 0xFFFF) {
+        /* If we have a precise definitions of the instructions set, use it */
+        disasm_info.mach = flags & 0xFFFF;
+    } else {
 #ifdef TARGET_PPC64
-    disasm_info.mach = bfd_mach_ppc64;
+        disasm_info.mach = bfd_mach_ppc64;
 #else
-    disasm_info.mach = bfd_mach_ppc;
+        disasm_info.mach = bfd_mach_ppc;
 #endif
+    }
     print_insn = print_insn_ppc;
+#elif defined(TARGET_M68K)
+    print_insn = print_insn_m68k;
 #elif defined(TARGET_MIPS)
 #ifdef TARGET_WORDS_BIGENDIAN
     print_insn = print_insn_big_mips;
 #else
     print_insn = print_insn_little_mips;
 #endif
-#elif defined(TARGET_M68K)
-    print_insn = print_insn_m68k;
 #elif defined(TARGET_SH4)
     disasm_info.mach = bfd_mach_sh4;
     print_insn = print_insn_sh;
+#elif defined(TARGET_ALPHA)
+    disasm_info.mach = bfd_mach_alpha;
+    print_insn = print_insn_alpha;
+#elif defined(TARGET_CRIS)
+    disasm_info.mach = bfd_mach_cris_v32;
+    print_insn = print_insn_crisv32;
 #else
     fprintf(out, "0x" TARGET_FMT_lx
 	    ": Asm output not supported on this arch\n", code);
@@ -255,7 +266,10 @@ void disas(FILE *out, void *code, unsigned long size)
     print_insn = print_insn_alpha;
 #elif defined(__sparc__)
     print_insn = print_insn_sparc;
-#elif defined(__arm__) 
+#if defined(__sparc_v8plus__) || defined(__sparc_v8plusa__) || defined(__sparc_v9__)
+    disasm_info.mach = bfd_mach_sparc_v9b;
+#endif
+#elif defined(__arm__)
     print_insn = print_insn_arm;
 #elif defined(__MIPSEB__)
     print_insn = print_insn_big_mips;
@@ -263,6 +277,10 @@ void disas(FILE *out, void *code, unsigned long size)
     print_insn = print_insn_little_mips;
 #elif defined(__m68k__)
     print_insn = print_insn_m68k;
+#elif defined(__s390__)
+    print_insn = print_insn_s390;
+#elif defined(__hppa__)
+    print_insn = print_insn_hppa;
 #else
     fprintf(out, "0x%lx: Asm output not supported on this arch\n",
 	    (long) code);
@@ -271,11 +289,9 @@ void disas(FILE *out, void *code, unsigned long size)
     for (pc = (unsigned long)code; pc < (unsigned long)code + size; pc += count) {
 	fprintf(out, "0x%08lx:  ", pc);
 #ifdef __arm__
-        /* since data are included in the code, it is better to
+        /* since data is included in the code, it is better to
            display code data too */
-        if (is_host) {
-            fprintf(out, "%08x  ", (int)bfd_getl32((const bfd_byte *)pc));
-        }
+        fprintf(out, "%08x  ", (int)bfd_getl32((const bfd_byte *)pc));
 #endif
 	count = print_insn(pc, &disasm_info);
 	fprintf(out, "\n");
@@ -292,7 +308,7 @@ const char *lookup_symbol(target_ulong orig_addr)
     Elf32_Sym *sym;
     struct syminfo *s;
     target_ulong addr;
-    
+
     for (s = syminfos; s; s = s->next) {
 	sym = s->disas_symtab;
 	for (i = 0; i < s->disas_num_syms; i++) {
@@ -304,8 +320,8 @@ const char *lookup_symbol(target_ulong orig_addr)
 		continue;
 
 	    addr = sym[i].st_value;
-#ifdef TARGET_ARM
-            /* The bottom address bit marks a Thumb symbol.  */
+#if defined(TARGET_ARM) || defined (TARGET_MIPS)
+            /* The bottom address bit marks a Thumb or MIPS16 symbol.  */
             addr &= ~(target_ulong)1;
 #endif
 	    if (orig_addr >= addr
@@ -325,11 +341,8 @@ static int monitor_disas_is_physical;
 static CPUState *monitor_disas_env;
 
 static int
-monitor_read_memory (memaddr, myaddr, length, info)
-     bfd_vma memaddr;
-     bfd_byte *myaddr;
-     int length;
-     struct disassemble_info *info;
+monitor_read_memory (bfd_vma memaddr, bfd_byte *myaddr, int length,
+                     struct disassemble_info *info)
 {
     if (monitor_disas_is_physical) {
         cpu_physical_memory_rw(memaddr, myaddr, length, 0);
@@ -371,15 +384,20 @@ void monitor_disas(CPUState *env,
 #if defined(TARGET_I386)
     if (flags == 2)
         disasm_info.mach = bfd_mach_x86_64;
-    else if (flags == 1) 
+    else if (flags == 1)
         disasm_info.mach = bfd_mach_i386_i8086;
     else
         disasm_info.mach = bfd_mach_i386_i386;
     print_insn = print_insn_i386;
 #elif defined(TARGET_ARM)
     print_insn = print_insn_arm;
+#elif defined(TARGET_ALPHA)
+    print_insn = print_insn_alpha;
 #elif defined(TARGET_SPARC)
     print_insn = print_insn_sparc;
+#ifdef TARGET_SPARC64
+    disasm_info.mach = bfd_mach_sparc_v9b;
+#endif
 #elif defined(TARGET_PPC)
 #ifdef TARGET_PPC64
     disasm_info.mach = bfd_mach_ppc64;
@@ -387,14 +405,14 @@ void monitor_disas(CPUState *env,
     disasm_info.mach = bfd_mach_ppc;
 #endif
     print_insn = print_insn_ppc;
+#elif defined(TARGET_M68K)
+    print_insn = print_insn_m68k;
 #elif defined(TARGET_MIPS)
 #ifdef TARGET_WORDS_BIGENDIAN
     print_insn = print_insn_big_mips;
 #else
     print_insn = print_insn_little_mips;
 #endif
-#elif defined(TARGET_M68K)
-    print_insn = print_insn_m68k;
 #else
     term_printf("0x" TARGET_FMT_lx
 		": Asm output not supported on this arch\n", pc);
diff --git a/distrib/build-emulator.sh b/distrib/build-emulator.sh
index a904fad..b2722cf 100755
--- a/distrib/build-emulator.sh
+++ b/distrib/build-emulator.sh
@@ -32,6 +32,8 @@ if ! (./android-configure --prefix=$LOCAL && make && make install); then
 fi
 
 cd $CURDIR/qemu
-if ! (./android-rebuild.sh --sdl-config=$LOCAL/bin/sdl-config --install=$CURDIR/emulator); then
-    echo "ERROR: could not build SDL library"
+if ! (./android-rebuild.sh --sdl-config=$LOCAL/bin/sdl-config); then
+    echo "ERROR: could not build the emulator, please check the sources"
 fi
+
+cp objs/emulator $CURDIR/emulator
diff --git a/dyngen-exec.h b/dyngen-exec.h
index acb5b55..9260b6f 100644
--- a/dyngen-exec.h
+++ b/dyngen-exec.h
@@ -32,15 +32,21 @@
    host headers do not allow that. */
 #include <stddef.h>
 
+#ifdef __OpenBSD__
+#include <sys/types.h>
+#else
 typedef unsigned char uint8_t;
 typedef unsigned short uint16_t;
 typedef unsigned int uint32_t;
+// Linux/Sparc64 defines uint64_t
+#if !(defined (__sparc_v9__) && defined(__linux__)) && !(defined(__APPLE__) && defined(__x86_64__))
 /* XXX may be done for all 64 bits targets ? */
-#if defined (__x86_64__) || defined(__ia64)
+#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__) || defined(__alpha__) || defined(__powerpc64__)
 typedef unsigned long uint64_t;
 #else
 typedef unsigned long long uint64_t;
 #endif
+#endif
 
 /* if Solaris/__sun__, don't typedef int8_t, as it will be typedef'd
    prior to this and will cause an error in compliation, conflicting
@@ -50,11 +56,18 @@ typedef signed char int8_t;
 #endif
 typedef signed short int16_t;
 typedef signed int int32_t;
-#if defined (__x86_64__) || defined(__ia64)
+// Linux/Sparc64 defines int64_t
+#if !(defined (__sparc_v9__) && defined(__linux__)) && !(defined(__APPLE__) && defined(__x86_64__))
+#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__) || defined(__alpha__) || defined(__powerpc64__)
 typedef signed long int64_t;
 #else
 typedef signed long long int64_t;
 #endif
+#endif
+#endif
+
+/* XXX: This may be wrong for 64-bit ILP32 hosts.  */
+typedef void * host_reg_t;
 
 #define INT8_MIN		(-128)
 #define INT16_MIN		(-32767-1)
@@ -69,27 +82,30 @@ typedef signed long long int64_t;
 #define UINT32_MAX		(4294967295U)
 #define UINT64_MAX		((uint64_t)(18446744073709551615))
 
+#ifdef _BSD
+typedef struct __sFILE FILE;
+#else
 typedef struct FILE FILE;
+#endif
 extern int fprintf(FILE *, const char *, ...);
+extern int fputs(const char *, FILE *);
 extern int printf(const char *, ...);
 #undef NULL
 #define NULL 0
 
-#ifdef __i386__
+#if defined(__i386__)
 #define AREG0 "ebp"
 #define AREG1 "ebx"
 #define AREG2 "esi"
 #define AREG3 "edi"
-#endif
-#ifdef __x86_64__
-#define AREG0 "rbp"
-#define AREG1 "rbx"
+#elif defined(__x86_64__)
+#define AREG0 "r14"
+#define AREG1 "r15"
 #define AREG2 "r12"
 #define AREG3 "r13"
-//#define AREG4 "r14"
-//#define AREG5 "r15"
-#endif
-#ifdef __powerpc__
+//#define AREG4 "rbp"
+//#define AREG5 "rbx"
+#elif defined(__powerpc__)
 #define AREG0 "r27"
 #define AREG1 "r24"
 #define AREG2 "r25"
@@ -105,22 +121,27 @@ extern int printf(const char *, ...);
 #define AREG10 "r22"
 #define AREG11 "r23"
 #endif
-#define USE_INT_TO_FLOAT_HELPERS
-#define BUGGY_GCC_DIV64
-#endif
-#ifdef __arm__
+#elif defined(__arm__)
 #define AREG0 "r7"
 #define AREG1 "r4"
 #define AREG2 "r5"
 #define AREG3 "r6"
-#endif
-#ifdef __mips__
-#define AREG0 "s3"
+#elif defined(__hppa__)
+#define AREG0 "r17"
+#define AREG1 "r14"
+#define AREG2 "r15"
+#define AREG3 "r16"
+#elif defined(__mips__)
+#define AREG0 "fp"
 #define AREG1 "s0"
 #define AREG2 "s1"
 #define AREG3 "s2"
-#endif
-#ifdef __sparc__
+#define AREG4 "s3"
+#define AREG5 "s4"
+#define AREG6 "s5"
+#define AREG7 "s6"
+#define AREG8 "s7"
+#elif defined(__sparc__)
 #ifdef HOST_SOLARIS
 #define AREG0 "g2"
 #define AREG1 "g3"
@@ -128,6 +149,11 @@ extern int printf(const char *, ...);
 #define AREG3 "g5"
 #define AREG4 "g6"
 #else
+#ifdef __sparc_v9__
+#define AREG0 "g5"
+#define AREG1 "g6"
+#define AREG2 "g7"
+#else
 #define AREG0 "g6"
 #define AREG1 "g1"
 #define AREG2 "g2"
@@ -141,15 +167,13 @@ extern int printf(const char *, ...);
 #define AREG10 "l6"
 #define AREG11 "l7"
 #endif
-#define USE_FP_CONVERT
 #endif
-#ifdef __s390__
+#elif defined(__s390__)
 #define AREG0 "r10"
 #define AREG1 "r7"
 #define AREG2 "r8"
 #define AREG3 "r9"
-#endif
-#ifdef __alpha__
+#elif defined(__alpha__)
 /* Note $15 is the frame pointer, so anything in op-i386.c that would
    require a frame pointer, like alloca, would probably loose.  */
 #define AREG0 "$15"
@@ -159,28 +183,23 @@ extern int printf(const char *, ...);
 #define AREG4 "$12"
 #define AREG5 "$13"
 #define AREG6 "$14"
-#endif
-#ifdef __mc68000
+#elif defined(__mc68000)
 #define AREG0 "%a5"
 #define AREG1 "%a4"
 #define AREG2 "%d7"
 #define AREG3 "%d6"
 #define AREG4 "%d5"
-#endif
-#ifdef __ia64__
+#elif defined(__ia64__)
 #define AREG0 "r7"
 #define AREG1 "r4"
 #define AREG2 "r5"
 #define AREG3 "r6"
+#else
+#error unsupported CPU
 #endif
 
 /* force GCC to generate only one epilog at the end of the function */
-#if defined(__i386__) || defined(__x86_64__)
-/* Also add 4 bytes of padding so that we can replace the ret with a jmp.  */
-#define FORCE_RET() asm volatile ("nop;nop;nop;nop");
-#else
-#define FORCE_RET() asm volatile ("");
-#endif
+#define FORCE_RET() __asm__ __volatile__("" : : : "memory");
 
 #ifndef OPPROTO
 #define OPPROTO
@@ -191,11 +210,11 @@ extern int printf(const char *, ...);
 #define stringify(s)	tostring(s)
 #define tostring(s)	#s
 
-#ifdef __alpha__
+#if defined(__alpha__) || defined(__s390__)
 /* the symbols are considered non exported so a br immediate is generated */
 #define __hidden __attribute__((visibility("hidden")))
 #else
-#define __hidden 
+#define __hidden
 #endif
 
 #if defined(__alpha__)
@@ -210,6 +229,13 @@ extern int __op_param3 __hidden;
 #define PARAM1 ({ int _r; asm("" : "=r"(_r) : "0" (&__op_param1)); _r; })
 #define PARAM2 ({ int _r; asm("" : "=r"(_r) : "0" (&__op_param2)); _r; })
 #define PARAM3 ({ int _r; asm("" : "=r"(_r) : "0" (&__op_param3)); _r; })
+#elif defined(__s390__)
+extern int __op_param1 __hidden;
+extern int __op_param2 __hidden;
+extern int __op_param3 __hidden;
+#define PARAM1 ({ int _r; asm("bras %0,8; .long " ASM_NAME(__op_param1) "; l %0,0(%0)" : "=r"(_r) : ); _r; })
+#define PARAM2 ({ int _r; asm("bras %0,8; .long " ASM_NAME(__op_param2) "; l %0,0(%0)" : "=r"(_r) : ); _r; })
+#define PARAM3 ({ int _r; asm("bras %0,8; .long " ASM_NAME(__op_param3) "; l %0,0(%0)" : "=r"(_r) : ); _r; })
 #else
 #if defined(__APPLE__)
 static int __op_param1, __op_param2, __op_param3;
@@ -229,63 +255,51 @@ extern int __op_jmp0, __op_jmp1, __op_jmp2, __op_jmp3;
 #define ASM_NAME(x) #x
 #endif
 
-#ifdef __i386__
-/* Dyngen will replace hlt instructions with a ret instruction.  Inserting a
-   ret directly would confuse dyngen.  */
-#define EXIT_TB() asm volatile ("hlt")
-/* Dyngen will replace cli with 0x9e (jmp). 
-   We generate the offset manually.  */
-#if defined(__APPLE__)
-/* XXX Different relocations are generated for MacOS X for Intel
-   (please as from cctools).  */
-#define GOTO_LABEL_PARAM(n) \
-  asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n)
-#else
-#define GOTO_LABEL_PARAM(n) \
-  asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n " - 1f;1:")
-#endif
-#endif
-#ifdef __x86_64__
-/* The same as i386.  */
-#define EXIT_TB() asm volatile ("hlt")
-#define GOTO_LABEL_PARAM(n) \
-  asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n " - 1f;1:")
-#endif
-#ifdef __powerpc__
+#if defined(__i386__)
+#define EXIT_TB() asm volatile ("ret")
+#define GOTO_LABEL_PARAM(n) asm volatile ("jmp " ASM_NAME(__op_gen_label) #n)
+#elif defined(__x86_64__)
+#define EXIT_TB() asm volatile ("ret")
+#define GOTO_LABEL_PARAM(n) asm volatile ("jmp " ASM_NAME(__op_gen_label) #n)
+#elif defined(__powerpc__)
 #define EXIT_TB() asm volatile ("blr")
 #define GOTO_LABEL_PARAM(n) asm volatile ("b " ASM_NAME(__op_gen_label) #n)
-#endif
-#ifdef __s390__
+#elif defined(__s390__)
 #define EXIT_TB() asm volatile ("br %r14")
-#define GOTO_LABEL_PARAM(n) asm volatile ("b " ASM_NAME(__op_gen_label) #n)
-#endif
-#ifdef __alpha__
+#define GOTO_LABEL_PARAM(n) asm volatile ("larl %r7,12; l %r7,0(%r7); br %r7; .long " ASM_NAME(__op_gen_label) #n)
+#elif defined(__alpha__)
 #define EXIT_TB() asm volatile ("ret")
-#endif
-#ifdef __ia64__
+#elif defined(__ia64__)
 #define EXIT_TB() asm volatile ("br.ret.sptk.many b0;;")
 #define GOTO_LABEL_PARAM(n) asm volatile ("br.sptk.many " \
 					  ASM_NAME(__op_gen_label) #n)
-#endif
-#ifdef __sparc__
+#elif defined(__sparc__)
 #define EXIT_TB() asm volatile ("jmpl %i0 + 8, %g0; nop")
 #define GOTO_LABEL_PARAM(n) asm volatile ("ba " ASM_NAME(__op_gen_label) #n ";nop")
-#endif
-#ifdef __arm__
+#elif defined(__arm__)
 #define EXIT_TB() asm volatile ("b exec_loop")
 #define GOTO_LABEL_PARAM(n) asm volatile ("b " ASM_NAME(__op_gen_label) #n)
-#endif
-#ifdef __mc68000
+#elif defined(__mc68000)
 #define EXIT_TB() asm volatile ("rts")
+#elif defined(__mips__)
+#define EXIT_TB() asm volatile ("jr $ra")
+#define GOTO_LABEL_PARAM(n) asm volatile (".set noat; la $1, " ASM_NAME(__op_gen_label) #n "; jr $1; .set at")
+#elif defined(__hppa__)
+#define GOTO_LABEL_PARAM(n) asm volatile ("b,n " ASM_NAME(__op_gen_label) #n)
+#else
+#error unsupported CPU
 #endif
 
-/* this definition to force inlining of all code that is used by op.c
- * if we don't do that, some functions fail to properly inline with some
- * GCC versions. and this results in erratic crashes that are hard to debug
- *
- * (that's because the non-inlined functions might clobber some "reserved"
- * registers used by the translation block code
- */
-#define  inline  __attribute__((always_inline)) __inline__
+/* The return address may point to the start of the next instruction.
+   Subtracting one gets us the call instruction itself.  */
+#if defined(__s390__)
+# define GETPC() ((void*)(((unsigned long)__builtin_return_address(0) & 0x7fffffffUL) - 1))
+#elif defined(__arm__)
+/* Thumb return addresses have the low bit set, so we need to subtract two.
+   This is still safe in ARM mode because instructions are 4 bytes.  */
+# define GETPC() ((void *)((unsigned long)__builtin_return_address(0) - 2))
+#else
+# define GETPC() ((void *)((unsigned long)__builtin_return_address(0) - 1))
+#endif
 
 #endif /* !defined(__DYNGEN_EXEC_H__) */
diff --git a/dyngen-op.h b/dyngen-op.h
deleted file mode 100644
index f77a475..0000000
--- a/dyngen-op.h
+++ /dev/null
@@ -1,9 +0,0 @@
-static inline int gen_new_label(void)
-{
-    return nb_gen_labels++;
-}
-
-static inline void gen_set_label(int n)
-{
-    gen_labels[n] = gen_opc_ptr - gen_opc_buf;
-}
diff --git a/dyngen.c b/dyngen.c
deleted file mode 100644
index 7425624..0000000
--- a/dyngen.c
+++ /dev/null
@@ -1,3542 +0,0 @@
-/*
- *  Generic Dynamic compiler generator
- *
- *  Copyright (c) 2003 Fabrice Bellard
- *
- *  The COFF object format support was extracted from Kazu's QEMU port
- *  to Win32.
- *
- *  Mach-O Support by Matt Reda and Pierre d'Herbemont
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <stdarg.h>
-#include <inttypes.h>
-#include <unistd.h>
-#include <fcntl.h>
-
-#include "config-host.h"
-
-//#define DEBUG_OP
-
-/* NOTE: we test CONFIG_WIN32 instead of _WIN32 to enabled cross
-   compilation */
-#if defined(CONFIG_WIN32)
-#define CONFIG_FORMAT_COFF
-#elif defined(CONFIG_DARWIN)
-#define CONFIG_FORMAT_MACH
-#else
-#define CONFIG_FORMAT_ELF
-#endif
-
-#ifdef CONFIG_FORMAT_ELF
-
-/* elf format definitions. We use these macros to test the CPU to
-   allow cross compilation (this tool must be ran on the build
-   platform) */
-#if defined(HOST_I386)
-
-#define ELF_CLASS	ELFCLASS32
-#define ELF_ARCH	EM_386
-#define elf_check_arch(x) ( ((x) == EM_386) || ((x) == EM_486) )
-#undef ELF_USES_RELOCA
-
-#elif defined(HOST_X86_64)
-
-#define ELF_CLASS	ELFCLASS64
-#define ELF_ARCH	EM_X86_64
-#define elf_check_arch(x) ((x) == EM_X86_64)
-#define ELF_USES_RELOCA
-
-#elif defined(HOST_PPC)
-
-#define ELF_CLASS	ELFCLASS32
-#define ELF_ARCH	EM_PPC
-#define elf_check_arch(x) ((x) == EM_PPC)
-#define ELF_USES_RELOCA
-
-#elif defined(HOST_S390)
-
-#define ELF_CLASS	ELFCLASS32
-#define ELF_ARCH	EM_S390
-#define elf_check_arch(x) ((x) == EM_S390)
-#define ELF_USES_RELOCA
-
-#elif defined(HOST_ALPHA)
-
-#define ELF_CLASS	ELFCLASS64
-#define ELF_ARCH	EM_ALPHA
-#define elf_check_arch(x) ((x) == EM_ALPHA)
-#define ELF_USES_RELOCA
-
-#elif defined(HOST_IA64)
-
-#define ELF_CLASS	ELFCLASS64
-#define ELF_ARCH	EM_IA_64
-#define elf_check_arch(x) ((x) == EM_IA_64)
-#define ELF_USES_RELOCA
-
-#elif defined(HOST_SPARC)
-
-#define ELF_CLASS	ELFCLASS32
-#define ELF_ARCH	EM_SPARC
-#define elf_check_arch(x) ((x) == EM_SPARC || (x) == EM_SPARC32PLUS)
-#define ELF_USES_RELOCA
-
-#elif defined(HOST_SPARC64)
-
-#define ELF_CLASS	ELFCLASS64
-#define ELF_ARCH	EM_SPARCV9
-#define elf_check_arch(x) ((x) == EM_SPARCV9)
-#define ELF_USES_RELOCA
-
-#elif defined(HOST_ARM)
-
-#define ELF_CLASS	ELFCLASS32
-#define ELF_ARCH	EM_ARM
-#define elf_check_arch(x) ((x) == EM_ARM)
-#define ELF_USES_RELOC
-
-#elif defined(HOST_M68K)
-
-#define ELF_CLASS	ELFCLASS32
-#define ELF_ARCH	EM_68K
-#define elf_check_arch(x) ((x) == EM_68K)
-#define ELF_USES_RELOCA
-
-#else
-#error unsupported CPU - please update the code
-#endif
-
-#include "elf.h"
-
-#if ELF_CLASS == ELFCLASS32
-typedef int32_t host_long;
-typedef uint32_t host_ulong;
-#define swabls(x) swab32s(x)
-#else
-typedef int64_t host_long;
-typedef uint64_t host_ulong;
-#define swabls(x) swab64s(x)
-#endif
-
-#ifdef ELF_USES_RELOCA
-#define SHT_RELOC SHT_RELA
-#else
-#define SHT_RELOC SHT_REL
-#endif
-
-#define EXE_RELOC ELF_RELOC
-#define EXE_SYM ElfW(Sym)
-
-#endif /* CONFIG_FORMAT_ELF */
-
-#ifdef CONFIG_FORMAT_COFF
-
-#include "a.out.h"
-
-typedef int32_t host_long;
-typedef uint32_t host_ulong;
-
-#define FILENAMELEN 256
-
-typedef struct coff_sym {
-    struct external_syment *st_syment;
-    char st_name[FILENAMELEN];
-    uint32_t st_value;
-    int  st_size;
-    uint8_t st_type;
-    uint8_t st_shndx;
-} coff_Sym;
-
-typedef struct coff_rel {
-    struct external_reloc *r_reloc;
-    int  r_offset;
-    uint8_t r_type;
-} coff_Rel;
-
-#define EXE_RELOC struct coff_rel
-#define EXE_SYM struct coff_sym
-
-#endif /* CONFIG_FORMAT_COFF */
-
-#ifdef CONFIG_FORMAT_MACH
-
-#include <mach-o/loader.h>
-#include <mach-o/nlist.h>
-#include <mach-o/reloc.h>
-#include <mach-o/ppc/reloc.h>
-
-#ifdef HOST_PPC
-
-#define MACH_CPU_TYPE CPU_TYPE_POWERPC
-#define mach_check_cputype(x) ((x) == CPU_TYPE_POWERPC)
-
-#elif defined(HOST_I386)
-
-#define MACH_CPU_TYPE CPU_TYPE_I386
-#define mach_check_cputype(x) ((x) == CPU_TYPE_I386)
-
-#else
-#error unsupported CPU - please update the code
-#endif
-
-# define check_mach_header(x) (x.magic == MH_MAGIC)
-typedef int32_t host_long;
-typedef uint32_t host_ulong;
-
-struct nlist_extended
-{
-   union {
-   char *n_name;
-   long  n_strx;
-   } n_un;
-   unsigned char n_type;
-   unsigned char n_sect;
-   short st_desc;
-   unsigned long st_value;
-   unsigned long st_size;
-};
-
-#define EXE_RELOC struct relocation_info
-#define EXE_SYM struct nlist_extended
-
-#endif /* CONFIG_FORMAT_MACH */
-
-#include "bswap.h"
-
-enum {
-    OUT_GEN_OP,
-    OUT_CODE,
-    OUT_INDEX_OP,
-};
-
-/* all dynamically generated functions begin with this code */
-#define OP_PREFIX "op_"
-
-int do_swap;
-
-void __attribute__((noreturn)) __attribute__((format (printf, 1, 2))) error(const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
-    fprintf(stderr, "dyngen: ");
-    vfprintf(stderr, fmt, ap);
-    fprintf(stderr, "\n");
-    va_end(ap);
-    exit(1);
-}
-
-void *load_data(int fd, long offset, unsigned int size)
-{
-    char *data;
-
-    data = malloc(size);
-    if (!data)
-        return NULL;
-    lseek(fd, offset, SEEK_SET);
-    if (read(fd, data, size) != size) {
-        free(data);
-        return NULL;
-    }
-    return data;
-}
-
-int strstart(const char *str, const char *val, const char **ptr)
-{
-    const char *p, *q;
-    p = str;
-    q = val;
-    while (*q != '\0') {
-        if (*p != *q)
-            return 0;
-        p++;
-        q++;
-    }
-    if (ptr)
-        *ptr = p;
-    return 1;
-}
-
-void pstrcpy(char *buf, int buf_size, const char *str)
-{
-    int c;
-    char *q = buf;
-
-    if (buf_size <= 0)
-        return;
-
-    for(;;) {
-        c = *str++;
-        if (c == 0 || q >= buf + buf_size - 1)
-            break;
-        *q++ = c;
-    }
-    *q = '\0';
-}
-
-void swab16s(uint16_t *p)
-{
-    *p = bswap16(*p);
-}
-
-void swab32s(uint32_t *p)
-{
-    *p = bswap32(*p);
-}
-
-void swab64s(uint64_t *p)
-{
-    *p = bswap64(*p);
-}
-
-uint16_t get16(uint16_t *p)
-{
-    uint16_t val;
-    val = *p;
-    if (do_swap)
-        val = bswap16(val);
-    return val;
-}
-
-uint32_t get32(uint32_t *p)
-{
-    uint32_t val;
-    val = *p;
-    if (do_swap)
-        val = bswap32(val);
-    return val;
-}
-
-void put16(uint16_t *p, uint16_t val)
-{
-    if (do_swap)
-        val = bswap16(val);
-    *p = val;
-}
-
-void put32(uint32_t *p, uint32_t val)
-{
-    if (do_swap)
-        val = bswap32(val);
-    *p = val;
-}
-
-/* executable information */
-EXE_SYM *symtab;
-int nb_syms;
-int text_shndx;
-uint8_t *text;
-EXE_RELOC *relocs;
-int nb_relocs;
-
-#ifdef CONFIG_FORMAT_ELF
-
-/* ELF file info */
-struct elf_shdr *shdr;
-uint8_t **sdata;
-struct elfhdr ehdr;
-char *strtab;
-
-int elf_must_swap(struct elfhdr *h)
-{
-  union {
-      uint32_t i;
-      uint8_t b[4];
-  } swaptest;
-
-  swaptest.i = 1;
-  return (h->e_ident[EI_DATA] == ELFDATA2MSB) !=
-      (swaptest.b[0] == 0);
-}
-
-void elf_swap_ehdr(struct elfhdr *h)
-{
-    swab16s(&h->e_type);			/* Object file type */
-    swab16s(&h->	e_machine);		/* Architecture */
-    swab32s(&h->	e_version);		/* Object file version */
-    swabls(&h->	e_entry);		/* Entry point virtual address */
-    swabls(&h->	e_phoff);		/* Program header table file offset */
-    swabls(&h->	e_shoff);		/* Section header table file offset */
-    swab32s(&h->	e_flags);		/* Processor-specific flags */
-    swab16s(&h->	e_ehsize);		/* ELF header size in bytes */
-    swab16s(&h->	e_phentsize);		/* Program header table entry size */
-    swab16s(&h->	e_phnum);		/* Program header table entry count */
-    swab16s(&h->	e_shentsize);		/* Section header table entry size */
-    swab16s(&h->	e_shnum);		/* Section header table entry count */
-    swab16s(&h->	e_shstrndx);		/* Section header string table index */
-}
-
-void elf_swap_shdr(struct elf_shdr *h)
-{
-  swab32s(&h->	sh_name);		/* Section name (string tbl index) */
-  swab32s(&h->	sh_type);		/* Section type */
-  swabls(&h->	sh_flags);		/* Section flags */
-  swabls(&h->	sh_addr);		/* Section virtual addr at execution */
-  swabls(&h->	sh_offset);		/* Section file offset */
-  swabls(&h->	sh_size);		/* Section size in bytes */
-  swab32s(&h->	sh_link);		/* Link to another section */
-  swab32s(&h->	sh_info);		/* Additional section information */
-  swabls(&h->	sh_addralign);		/* Section alignment */
-  swabls(&h->	sh_entsize);		/* Entry size if section holds table */
-}
-
-void elf_swap_phdr(struct elf_phdr *h)
-{
-    swab32s(&h->p_type);			/* Segment type */
-    swabls(&h->p_offset);		/* Segment file offset */
-    swabls(&h->p_vaddr);		/* Segment virtual address */
-    swabls(&h->p_paddr);		/* Segment physical address */
-    swabls(&h->p_filesz);		/* Segment size in file */
-    swabls(&h->p_memsz);		/* Segment size in memory */
-    swab32s(&h->p_flags);		/* Segment flags */
-    swabls(&h->p_align);		/* Segment alignment */
-}
-
-void elf_swap_rel(ELF_RELOC *rel)
-{
-    swabls(&rel->r_offset);
-    swabls(&rel->r_info);
-#ifdef ELF_USES_RELOCA
-    swabls(&rel->r_addend);
-#endif
-}
-
-struct elf_shdr *find_elf_section(struct elf_shdr *shdr, int shnum, const char *shstr,
-                                  const char *name)
-{
-    int i;
-    const char *shname;
-    struct elf_shdr *sec;
-
-    for(i = 0; i < shnum; i++) {
-        sec = &shdr[i];
-        if (!sec->sh_name)
-            continue;
-        shname = shstr + sec->sh_name;
-        if (!strcmp(shname, name))
-            return sec;
-    }
-    return NULL;
-}
-
-int find_reloc(int sh_index)
-{
-    struct elf_shdr *sec;
-    int i;
-
-    for(i = 0; i < ehdr.e_shnum; i++) {
-        sec = &shdr[i];
-        if (sec->sh_type == SHT_RELOC && sec->sh_info == sh_index)
-            return i;
-    }
-    return 0;
-}
-
-static host_ulong get_rel_offset(EXE_RELOC *rel)
-{
-    return rel->r_offset;
-}
-
-static char *get_rel_sym_name(EXE_RELOC *rel)
-{
-    return strtab + symtab[ELFW(R_SYM)(rel->r_info)].st_name;
-}
-
-static char *get_sym_name(EXE_SYM *sym)
-{
-    return strtab + sym->st_name;
-}
-
-/* load an elf object file */
-int load_object(const char *filename)
-{
-    int fd;
-    struct elf_shdr *sec, *symtab_sec, *strtab_sec, *text_sec;
-    int i, j;
-    ElfW(Sym) *sym;
-    char *shstr;
-    ELF_RELOC *rel;
-
-    fd = open(filename, O_RDONLY);
-    if (fd < 0)
-        error("can't open file '%s'", filename);
-
-    /* Read ELF header.  */
-    if (read(fd, &ehdr, sizeof (ehdr)) != sizeof (ehdr))
-        error("unable to read file header");
-
-    /* Check ELF identification.  */
-    if (ehdr.e_ident[EI_MAG0] != ELFMAG0
-     || ehdr.e_ident[EI_MAG1] != ELFMAG1
-     || ehdr.e_ident[EI_MAG2] != ELFMAG2
-     || ehdr.e_ident[EI_MAG3] != ELFMAG3
-     || ehdr.e_ident[EI_VERSION] != EV_CURRENT) {
-        error("bad ELF header");
-    }
-
-    do_swap = elf_must_swap(&ehdr);
-    if (do_swap)
-        elf_swap_ehdr(&ehdr);
-    if (ehdr.e_ident[EI_CLASS] != ELF_CLASS)
-        error("file %s: unsupported ELF class", filename);
-    if (ehdr.e_type != ET_REL)
-        error("file %s: ELF object file expected", filename);
-    if (ehdr.e_version != EV_CURRENT)
-        error("file %s: invalid ELF version", filename);
-    if (!elf_check_arch(ehdr.e_machine))
-        error("file %s: unsupported CPU (e_machine=%d)", filename, ehdr.e_machine);
-
-    /* read section headers */
-    shdr = load_data(fd, ehdr.e_shoff, ehdr.e_shnum * sizeof(struct elf_shdr));
-    if (do_swap) {
-        for(i = 0; i < ehdr.e_shnum; i++) {
-            elf_swap_shdr(&shdr[i]);
-        }
-    }
-
-    /* read all section data */
-    sdata = malloc(sizeof(void *) * ehdr.e_shnum);
-    memset(sdata, 0, sizeof(void *) * ehdr.e_shnum);
-
-    for(i = 0;i < ehdr.e_shnum; i++) {
-        sec = &shdr[i];
-        if (sec->sh_type != SHT_NOBITS)
-            sdata[i] = load_data(fd, sec->sh_offset, sec->sh_size);
-    }
-
-    sec = &shdr[ehdr.e_shstrndx];
-    shstr = (char*) sdata[ehdr.e_shstrndx];
-
-    /* swap relocations */
-    for(i = 0; i < ehdr.e_shnum; i++) {
-        sec = &shdr[i];
-        if (sec->sh_type == SHT_RELOC) {
-            nb_relocs = sec->sh_size / sec->sh_entsize;
-            if (do_swap) {
-                for(j = 0, rel = (ELF_RELOC *)sdata[i]; j < nb_relocs; j++, rel++)
-                    elf_swap_rel(rel);
-            }
-        }
-    }
-    /* text section */
-
-    text_sec = find_elf_section(shdr, ehdr.e_shnum, shstr, ".text");
-    if (!text_sec)
-        error("could not find .text section");
-    text_shndx = text_sec - shdr;
-    text = sdata[text_shndx];
-
-    /* find text relocations, if any */
-    relocs = NULL;
-    nb_relocs = 0;
-    i = find_reloc(text_shndx);
-    if (i != 0) {
-        relocs = (ELF_RELOC *)sdata[i];
-        nb_relocs = shdr[i].sh_size / shdr[i].sh_entsize;
-    }
-
-    symtab_sec = find_elf_section(shdr, ehdr.e_shnum, shstr, ".symtab");
-    if (!symtab_sec)
-        error("could not find .symtab section");
-    strtab_sec = &shdr[symtab_sec->sh_link];
-
-    symtab = (ElfW(Sym) *)sdata[symtab_sec - shdr];
-    strtab = (char*) sdata[symtab_sec->sh_link];
-
-    nb_syms = symtab_sec->sh_size / sizeof(ElfW(Sym));
-    if (do_swap) {
-        for(i = 0, sym = symtab; i < nb_syms; i++, sym++) {
-            swab32s(&sym->st_name);
-            swabls(&sym->st_value);
-            swabls(&sym->st_size);
-            swab16s(&sym->st_shndx);
-        }
-    }
-    close(fd);
-    return 0;
-}
-
-#endif /* CONFIG_FORMAT_ELF */
-
-#ifdef CONFIG_FORMAT_COFF
-
-/* COFF file info */
-struct external_scnhdr *shdr;
-uint8_t **sdata;
-struct external_filehdr fhdr;
-struct external_syment *coff_symtab;
-char *strtab;
-int coff_text_shndx, coff_data_shndx;
-
-int data_shndx;
-
-#define STRTAB_SIZE 4
-
-#define DIR32   0x06
-#define DISP32  0x14
-
-#define T_FUNCTION  0x20
-#define C_EXTERNAL  2
-
-void sym_ent_name(struct external_syment *ext_sym, EXE_SYM *sym)
-{
-    char *q;
-    int c, i, len;
-
-    if (ext_sym->e.e.e_zeroes != 0) {
-        q = sym->st_name;
-        for(i = 0; i < 8; i++) {
-            c = ext_sym->e.e_name[i];
-            if (c == '\0')
-                break;
-            *q++ = c;
-        }
-        *q = '\0';
-    } else {
-        pstrcpy(sym->st_name, sizeof(sym->st_name), strtab + ext_sym->e.e.e_offset);
-    }
-
-    /* now convert the name to a C name (suppress the leading '_') */
-    if (sym->st_name[0] == '_') {
-        len = strlen(sym->st_name);
-        memmove(sym->st_name, sym->st_name + 1, len - 1);
-        sym->st_name[len - 1] = '\0';
-    }
-}
-
-char *name_for_dotdata(struct coff_rel *rel)
-{
-	int i;
-	struct coff_sym *sym;
-	uint32_t text_data;
-
-	text_data = *(uint32_t *)(text + rel->r_offset);
-
-	for (i = 0, sym = symtab; i < nb_syms; i++, sym++) {
-		if (sym->st_syment->e_scnum == data_shndx &&
-                    text_data >= sym->st_value &&
-                    text_data < sym->st_value + sym->st_size) {
-
-                    return sym->st_name;
-
-		}
-	}
-	return NULL;
-}
-
-static char *get_sym_name(EXE_SYM *sym)
-{
-    return sym->st_name;
-}
-
-static char *get_rel_sym_name(EXE_RELOC *rel)
-{
-    char *name;
-    name = get_sym_name(symtab + *(uint32_t *)(rel->r_reloc->r_symndx));
-    if (!strcmp(name, ".data"))
-        name = name_for_dotdata(rel);
-    if (name[0] == '.')
-        return NULL;
-    return name;
-}
-
-static host_ulong get_rel_offset(EXE_RELOC *rel)
-{
-    return rel->r_offset;
-}
-
-struct external_scnhdr *find_coff_section(struct external_scnhdr *shdr, int shnum, const char *name)
-{
-    int i;
-    const char *shname;
-    struct external_scnhdr *sec;
-
-    for(i = 0; i < shnum; i++) {
-        sec = &shdr[i];
-        if (!sec->s_name)
-            continue;
-        shname = sec->s_name;
-        if (!strcmp(shname, name))
-            return sec;
-    }
-    return NULL;
-}
-
-/* load a coff object file */
-int load_object(const char *filename)
-{
-    int fd;
-    struct external_scnhdr *sec, *text_sec, *data_sec;
-    int i;
-    struct external_syment *ext_sym;
-    struct external_reloc *coff_relocs;
-    struct external_reloc *ext_rel;
-    uint32_t *n_strtab;
-    EXE_SYM *sym;
-    EXE_RELOC *rel;
-
-    fd = open(filename, O_RDONLY
-#ifdef _WIN32
-              | O_BINARY
-#endif
-              );
-    if (fd < 0)
-        error("can't open file '%s'", filename);
-
-    /* Read COFF header.  */
-    if (read(fd, &fhdr, sizeof (fhdr)) != sizeof (fhdr))
-        error("unable to read file header");
-
-    /* Check COFF identification.  */
-    if (fhdr.f_magic != I386MAGIC) {
-        error("bad COFF header");
-    }
-    do_swap = 0;
-
-    /* read section headers */
-    shdr = load_data(fd, sizeof(struct external_filehdr) + fhdr.f_opthdr, fhdr.f_nscns * sizeof(struct external_scnhdr));
-
-    /* read all section data */
-    sdata = malloc(sizeof(void *) * fhdr.f_nscns);
-    memset(sdata, 0, sizeof(void *) * fhdr.f_nscns);
-
-    const char *p;
-    for(i = 0;i < fhdr.f_nscns; i++) {
-        sec = &shdr[i];
-        if (!strstart(sec->s_name,  ".bss", &p))
-            sdata[i] = load_data(fd, sec->s_scnptr, sec->s_size);
-    }
-
-
-    /* text section */
-    text_sec = find_coff_section(shdr, fhdr.f_nscns, ".text");
-    if (!text_sec)
-        error("could not find .text section");
-    coff_text_shndx = text_sec - shdr;
-    text = sdata[coff_text_shndx];
-
-    /* data section */
-    data_sec = find_coff_section(shdr, fhdr.f_nscns, ".data");
-    if (!data_sec)
-        error("could not find .data section");
-    coff_data_shndx = data_sec - shdr;
-
-    coff_symtab = load_data(fd, fhdr.f_symptr, fhdr.f_nsyms*SYMESZ);
-    for (i = 0, ext_sym = coff_symtab; i < nb_syms; i++, ext_sym++) {
-        for(i=0;i<8;i++)
-            printf(" %02x", ((uint8_t *)ext_sym->e.e_name)[i]);
-        printf("\n");
-    }
-
-
-    n_strtab = load_data(fd, (fhdr.f_symptr + fhdr.f_nsyms*SYMESZ), STRTAB_SIZE);
-    strtab = load_data(fd, (fhdr.f_symptr + fhdr.f_nsyms*SYMESZ), *n_strtab);
-
-    nb_syms = fhdr.f_nsyms;
-
-    for (i = 0, ext_sym = coff_symtab; i < nb_syms; i++, ext_sym++) {
-      if (strstart(ext_sym->e.e_name, ".text", NULL))
-		  text_shndx = ext_sym->e_scnum;
-	  if (strstart(ext_sym->e.e_name, ".data", NULL))
-		  data_shndx = ext_sym->e_scnum;
-    }
-
-	/* set coff symbol */
-	symtab = malloc(sizeof(struct coff_sym) * nb_syms);
-
-	int aux_size, j;
-	for (i = 0, ext_sym = coff_symtab, sym = symtab; i < nb_syms; i++, ext_sym++, sym++) {
-		memset(sym, 0, sizeof(*sym));
-		sym->st_syment = ext_sym;
-		sym_ent_name(ext_sym, sym);
-		sym->st_value = ext_sym->e_value;
-
-		aux_size = *(int8_t *)ext_sym->e_numaux;
-		if (ext_sym->e_scnum == text_shndx && ext_sym->e_type == T_FUNCTION) {
-			for (j = aux_size + 1; j < nb_syms - i; j++) {
-				if ((ext_sym + j)->e_scnum == text_shndx &&
-					(ext_sym + j)->e_type == T_FUNCTION ){
-					sym->st_size = (ext_sym + j)->e_value - ext_sym->e_value;
-					break;
-				} else if (j == nb_syms - i - 1) {
-					sec = &shdr[coff_text_shndx];
-					sym->st_size = sec->s_size - ext_sym->e_value;
-					break;
-				}
-			}
-		} else if (ext_sym->e_scnum == data_shndx && *(uint8_t *)ext_sym->e_sclass == C_EXTERNAL) {
-			for (j = aux_size + 1; j < nb_syms - i; j++) {
-				if ((ext_sym + j)->e_scnum == data_shndx) {
-					sym->st_size = (ext_sym + j)->e_value - ext_sym->e_value;
-					break;
-				} else if (j == nb_syms - i - 1) {
-					sec = &shdr[coff_data_shndx];
-					sym->st_size = sec->s_size - ext_sym->e_value;
-					break;
-				}
-			}
-		} else {
-			sym->st_size = 0;
-		}
-
-		sym->st_type = ext_sym->e_type;
-		sym->st_shndx = ext_sym->e_scnum;
-	}
-
-
-    /* find text relocations, if any */
-    sec = &shdr[coff_text_shndx];
-    coff_relocs = load_data(fd, sec->s_relptr, sec->s_nreloc*RELSZ);
-    nb_relocs = sec->s_nreloc;
-
-    /* set coff relocation */
-    relocs = malloc(sizeof(struct coff_rel) * nb_relocs);
-    for (i = 0, ext_rel = coff_relocs, rel = relocs; i < nb_relocs;
-         i++, ext_rel++, rel++) {
-        memset(rel, 0, sizeof(*rel));
-        rel->r_reloc = ext_rel;
-        rel->r_offset = *(uint32_t *)ext_rel->r_vaddr;
-        rel->r_type = *(uint16_t *)ext_rel->r_type;
-    }
-    return 0;
-}
-
-#endif /* CONFIG_FORMAT_COFF */
-
-#ifdef CONFIG_FORMAT_MACH
-
-/* File Header */
-struct mach_header 	mach_hdr;
-
-/* commands */
-struct segment_command 	*segment = 0;
-struct dysymtab_command *dysymtabcmd = 0;
-struct symtab_command 	*symtabcmd = 0;
-
-/* section */
-struct section 	*section_hdr;
-struct section *text_sec_hdr;
-uint8_t 	**sdata;
-
-/* relocs */
-struct relocation_info *relocs;
-
-/* symbols */
-EXE_SYM			*symtab;
-struct nlist 	*symtab_std;
-char			*strtab;
-
-/* indirect symbols */
-uint32_t 	*tocdylib;
-
-/* Utility functions */
-
-static inline char *find_str_by_index(int index)
-{
-    return strtab+index;
-}
-
-/* Used by dyngen common code */
-static char *get_sym_name(EXE_SYM *sym)
-{
-	char *name = find_str_by_index(sym->n_un.n_strx);
-
-	if ( sym->n_type & N_STAB ) /* Debug symbols are ignored */
-		return "debug";
-
-	if(!name)
-		return name;
-	if(name[0]=='_')
-		return name + 1;
-	else
-		return name;
-}
-
-/* find a section index given its segname, sectname */
-static int find_mach_sec_index(struct section *section_hdr, int shnum, const char *segname,
-                                  const char *sectname)
-{
-    int i;
-    struct section *sec = section_hdr;
-
-    for(i = 0; i < shnum; i++, sec++) {
-        if (!sec->segname || !sec->sectname)
-            continue;
-        if (!strcmp(sec->sectname, sectname) && !strcmp(sec->segname, segname))
-            return i;
-    }
-    return -1;
-}
-
-/* find a section header given its segname, sectname */
-struct section *find_mach_sec_hdr(struct section *section_hdr, int shnum, const char *segname,
-                                  const char *sectname)
-{
-    int index = find_mach_sec_index(section_hdr, shnum, segname, sectname);
-	if(index == -1)
-		return NULL;
-	return section_hdr+index;
-}
-
-
-static inline void fetch_next_pair_value(struct relocation_info * rel, unsigned int *value)
-{
-    struct scattered_relocation_info * scarel;
-
-    if(R_SCATTERED & rel->r_address) {
-        scarel = (struct scattered_relocation_info*)rel;
-        if(scarel->r_type != PPC_RELOC_PAIR)
-            error("fetch_next_pair_value: looking for a pair which was not found (1)");
-        *value = scarel->r_value;
-    } else {
-		if(rel->r_type != PPC_RELOC_PAIR)
-			error("fetch_next_pair_value: looking for a pair which was not found (2)");
-		*value = rel->r_address;
-	}
-}
-
-/*
- *  Find symbol name given a (virtual) address, and a section which is of type
- *  S_NON_LAZY_SYMBOL_POINTERS or S_LAZY_SYMBOL_POINTERS or S_SYMBOL_STUBS
- */
-static const char * find_reloc_name_in_sec_ptr(int address, struct section * sec_hdr)
-{
-    unsigned int tocindex, symindex, size;
-    const char *name = 0;
-	int section_type;
-
-    /* Sanity check */
-    if(!( address >= sec_hdr->addr && address < (sec_hdr->addr + sec_hdr->size) ) )
-        return (char*)0;
-
-	section_type = sec_hdr->flags & SECTION_TYPE;
-	if( section_type == S_SYMBOL_STUBS ){
-		size = sec_hdr->reserved2;
-		if(size == 0)
-		    error("size = 0");
-	}
-	else if( section_type == S_LAZY_SYMBOL_POINTERS ||
-			 section_type == S_NON_LAZY_SYMBOL_POINTERS)
-		size = sizeof(unsigned long);
-	else
-		return NULL;
-
-    /* Compute our index in toc */
-	tocindex = (address - sec_hdr->addr)/size;
-	symindex = tocdylib[sec_hdr->reserved1 + tocindex];
-
-	name = get_sym_name(&symtab[symindex]);
-
-    return name;
-}
-
-static const char * find_reloc_name_given_its_address(int address)
-{
-    unsigned int i;
-    for(i = 0; i < segment->nsects ; i++)
-    {
-        const char * name = find_reloc_name_in_sec_ptr(address, &section_hdr[i]);
-        if((long)name != 0)
-            return name;
-    }
-    return 0;
-}
-
-/* find a sym name given its value, in a section number */
-static const char * find_sym_with_value_and_sec_number( int value, int sectnum, int * offset )
-{
-	int i, ret = -1;
-
-	for( i = 0 ; i < nb_syms; i++ )
-	{
-	    if( !(symtab[i].n_type & N_STAB) && (symtab[i].n_type & N_SECT) &&
-			 (symtab[i].n_sect ==  sectnum) && (symtab[i].st_value <= value) )
-		{
-			if( (ret<0) || (symtab[i].st_value >= symtab[ret].st_value) )
-				ret = i;
-		}
-	}
-	if( ret < 0 ) {
-                /* look in indirect symbols if not found */
-                struct section*  sec_hdr      = &section_hdr[sectnum-1];
-                int              section_type = sec_hdr->flags & SECTION_TYPE;
-
-                if (section_type == S_NON_LAZY_SYMBOL_POINTERS)
-                {
-                    int          tocindex = (int)(value - sec_hdr->addr)/sizeof(long);
-                    int          symindex = tocdylib[sec_hdr->reserved1 + tocindex];
-                    const char*  name      = get_sym_name(&symtab[symindex]);
-                    *offset = 0;
-                    return name;
-                }
-                error("no symbol match for value=0x%04x in section %d with flags %02x", value, sectnum, sec_hdr->flags);
-		return NULL;
-	} else {
-		*offset = value - symtab[ret].st_value;
-		return get_sym_name(&symtab[ret]);
-	}
-}
-
-
-static int   is_reloc_non_lazy(EXE_RELOC*  rel)
-{
-    return ( rel->r_symbolnum >= 1 && rel->r_symbolnum <= segment->nsects &&
-             (section_hdr[rel->r_symbolnum-1].flags & SECTION_TYPE) == S_NON_LAZY_SYMBOL_POINTERS );
-}
-
-
-static const char * get_reloc_name(EXE_RELOC * rel, int * sslide)
-{
-	char * name = 0;
-	struct scattered_relocation_info * sca_rel = (struct scattered_relocation_info*)rel;
-	int sectnum = rel->r_symbolnum;
-	int sectoffset;
-	int other_half=0;
-
-	/* init the slide value */
-	*sslide = 0;
-
-	if (R_SCATTERED & rel->r_address) {
-        char *name = (char *)find_reloc_name_given_its_address(sca_rel->r_value);
-
-        /* search it in the full symbol list, if not found */
-        if (!name) {
-            int i;
-            for (i = 0; i < nb_syms; i++) {
-                EXE_SYM *sym = &symtab[i];
-                if (sym->st_value == sca_rel->r_value) {
-                    name = get_sym_name(sym);
-                    switch (sca_rel->r_type) {
-                    case GENERIC_RELOC_VANILLA:
-                        *sslide = *(uint32_t *)(text + sca_rel->r_address) - sca_rel->r_value;
-                        break;
-                    }
-                    break;
-                }
-            }
-        }
-        return name;
-    }
-
-	if(rel->r_extern)
-	{
-		/* ignore debug sym */
-		if ( symtab[rel->r_symbolnum].n_type & N_STAB )
-			return 0;
-		return get_sym_name(&symtab[rel->r_symbolnum]);
-	}
-
-	/* Intruction contains an offset to the symbols pointed to, in the rel->r_symbolnum section */
-	sectoffset = *(uint32_t *)(text + rel->r_address) & 0xffff;
-
-	if(sectnum==0xffffff)
-		return 0;
-
-	/* Sanity Check */
-	if(sectnum > segment->nsects)
-		error("sectnum > segment->nsects");
-
-	switch(rel->r_type)
-	{
-		case PPC_RELOC_LO16: fetch_next_pair_value(rel+1, &other_half); sectoffset |= (other_half << 16);
-			break;
-		case PPC_RELOC_HI16: fetch_next_pair_value(rel+1, &other_half); sectoffset = (sectoffset << 16) | (uint16_t)(other_half & 0xffff);
-			break;
-		case PPC_RELOC_HA16: fetch_next_pair_value(rel+1, &other_half); sectoffset = (sectoffset << 16) + (int16_t)(other_half & 0xffff);
-			break;
-		case PPC_RELOC_BR24:
-			sectoffset = ( *(uint32_t *)(text + rel->r_address) & 0x03fffffc );
-			if (sectoffset & 0x02000000) sectoffset |= 0xfc000000;
-			break;
-        case GENERIC_RELOC_VANILLA:
-            sectoffset  = *(uint32_t *)(text + rel->r_address);
-            break;
-		default:
-			error("switch(rel->type=%d) not found", rel->r_type);
-	}
-
-	if(rel->r_pcrel) {
-		sectoffset += rel->r_address;
-#ifdef HOST_I386
-        sectoffset += (1 << rel->r_length);
-#endif
-    }
-
-	if (rel->r_type == PPC_RELOC_BR24 || rel->r_pcrel)
-		name = (char *)find_reloc_name_in_sec_ptr((int)sectoffset, &section_hdr[sectnum-1]);
-
-	/* search it in the full symbol list, if not found */
-	if(!name)
-		name = (char *)find_sym_with_value_and_sec_number(sectoffset, sectnum, sslide);
-
-	return name;
-}
-
-/* Used by dyngen common code */
-static const char * get_rel_sym_name(EXE_RELOC * rel)
-{
-	int sslide;
-	return get_reloc_name( rel, &sslide);
-}
-
-/* Used by dyngen common code */
-static host_ulong get_rel_offset(EXE_RELOC *rel)
-{
-	struct scattered_relocation_info * sca_rel = (struct scattered_relocation_info*)rel;
-    if(R_SCATTERED & rel->r_address)
-		return sca_rel->r_address;
-	else
-		return rel->r_address;
-}
-
-/* load a mach-o object file */
-int load_object(const char *filename)
-{
-	int fd;
-	unsigned int offset_to_segment = 0;
-    unsigned int offset_to_dysymtab = 0;
-    unsigned int offset_to_symtab = 0;
-    struct load_command lc;
-    unsigned int i, j;
-	EXE_SYM *sym;
-	struct nlist *syment;
-
-	fd = open(filename, O_RDONLY);
-    if (fd < 0)
-        error("can't open file '%s'", filename);
-
-    /* Read Mach header.  */
-    if (read(fd, &mach_hdr, sizeof (mach_hdr)) != sizeof (mach_hdr))
-        error("unable to read file header");
-
-    /* Check Mach identification.  */
-    if (!check_mach_header(mach_hdr)) {
-        error("bad Mach header");
-    }
-
-    if (!mach_check_cputype(mach_hdr.cputype))
-        error("Unsupported CPU");
-
-    if (mach_hdr.filetype != MH_OBJECT)
-        error("Unsupported Mach Object");
-
-    /* read segment headers */
-    for(i=0, j=sizeof(mach_hdr); i<mach_hdr.ncmds ; i++)
-    {
-        if(read(fd, &lc, sizeof(struct load_command)) != sizeof(struct load_command))
-            error("unable to read load_command");
-        if(lc.cmd == LC_SEGMENT)
-        {
-            offset_to_segment = j;
-            lseek(fd, offset_to_segment, SEEK_SET);
-            segment = malloc(sizeof(struct segment_command));
-            if(read(fd, segment, sizeof(struct segment_command)) != sizeof(struct segment_command))
-                error("unable to read LC_SEGMENT");
-        }
-        if(lc.cmd == LC_DYSYMTAB)
-        {
-            offset_to_dysymtab = j;
-            lseek(fd, offset_to_dysymtab, SEEK_SET);
-            dysymtabcmd = malloc(sizeof(struct dysymtab_command));
-            if(read(fd, dysymtabcmd, sizeof(struct dysymtab_command)) != sizeof(struct dysymtab_command))
-                error("unable to read LC_DYSYMTAB");
-        }
-        if(lc.cmd == LC_SYMTAB)
-        {
-            offset_to_symtab = j;
-            lseek(fd, offset_to_symtab, SEEK_SET);
-            symtabcmd = malloc(sizeof(struct symtab_command));
-            if(read(fd, symtabcmd, sizeof(struct symtab_command)) != sizeof(struct symtab_command))
-                error("unable to read LC_SYMTAB");
-        }
-        j+=lc.cmdsize;
-
-        lseek(fd, j, SEEK_SET);
-    }
-
-    if(!segment)
-        error("unable to find LC_SEGMENT");
-
-    /* read section headers */
-    section_hdr = load_data(fd, offset_to_segment + sizeof(struct segment_command), segment->nsects * sizeof(struct section));
-
-    /* read all section data */
-    sdata = (uint8_t **)malloc(sizeof(void *) * segment->nsects);
-    memset(sdata, 0, sizeof(void *) * segment->nsects);
-
-	/* Load the data in section data */
-	for(i = 0; i < segment->nsects; i++) {
-        sdata[i] = load_data(fd, section_hdr[i].offset, section_hdr[i].size);
-    }
-
-    /* text section */
-	text_sec_hdr = find_mach_sec_hdr(section_hdr, segment->nsects, SEG_TEXT, SECT_TEXT);
-	i = find_mach_sec_index(section_hdr, segment->nsects, SEG_TEXT, SECT_TEXT);
-	if (i == -1 || !text_sec_hdr)
-        error("could not find __TEXT,__text section");
-    text = sdata[i];
-
-    /* Make sure dysym was loaded */
-    if(!(int)dysymtabcmd)
-        error("could not find __DYSYMTAB segment");
-
-    /* read the table of content of the indirect sym */
-    tocdylib = load_data( fd, dysymtabcmd->indirectsymoff, dysymtabcmd->nindirectsyms * sizeof(uint32_t) );
-
-    /* Make sure symtab was loaded  */
-    if(!(int)symtabcmd)
-        error("could not find __SYMTAB segment");
-    nb_syms = symtabcmd->nsyms;
-
-    symtab_std = load_data(fd, symtabcmd->symoff, symtabcmd->nsyms * sizeof(struct nlist));
-    strtab = load_data(fd, symtabcmd->stroff, symtabcmd->strsize);
-
-	symtab = malloc(sizeof(EXE_SYM) * nb_syms);
-
-	/* Now transform the symtab, to an extended version, with the sym size, and the C name */
-	for(i = 0, sym = symtab, syment = symtab_std; i < nb_syms; i++, sym++, syment++) {
-        struct nlist *sym_follow, *sym_next = 0;
-        unsigned int j;
-		memset(sym, 0, sizeof(*sym));
-
-		if ( syment->n_type & N_STAB ) /* Debug symbols are skipped */
-            continue;
-
-		memcpy(sym, syment, sizeof(*syment));
-
-		/* Find the following symbol in order to get the current symbol size */
-        for(j = 0, sym_follow = symtab_std; j < nb_syms; j++, sym_follow++) {
-            if ( sym_follow->n_sect != 1 || sym_follow->n_type & N_STAB || !(sym_follow->n_value > sym->st_value))
-                continue;
-            if(!sym_next) {
-                sym_next = sym_follow;
-                continue;
-            }
-            if(!(sym_next->n_value > sym_follow->n_value))
-                continue;
-            sym_next = sym_follow;
-        }
-		if(sym_next)
-            sym->st_size = sym_next->n_value - sym->st_value;
-		else
-            sym->st_size = text_sec_hdr->size - sym->st_value;
-	}
-
-    /* Find Reloc */
-    relocs = load_data(fd, text_sec_hdr->reloff, text_sec_hdr->nreloc * sizeof(struct relocation_info));
-    nb_relocs = text_sec_hdr->nreloc;
-
-	close(fd);
-	return 0;
-}
-
-#endif /* CONFIG_FORMAT_MACH */
-
-void get_reloc_expr(char *name, int name_size, const char *sym_name)
-{
-    const char *p;
-
-    if (strstart(sym_name, "__op_param", &p)) {
-        snprintf(name, name_size, "param%s", p);
-    } else if (strstart(sym_name, "__op_gen_label", &p)) {
-        snprintf(name, name_size, "gen_labels[param%s]", p);
-    } else {
-#ifdef HOST_SPARC
-        if (sym_name[0] == '.')
-            snprintf(name, name_size,
-                     "(long)(&__dot_%s)",
-                     sym_name + 1);
-        else
-#endif
-            snprintf(name, name_size, "(long)(&%s)", sym_name);
-    }
-}
-
-#ifdef HOST_IA64
-
-#define PLT_ENTRY_SIZE	16	/* 1 bundle containing "brl" */
-
-struct plt_entry {
-    struct plt_entry *next;
-    const char *name;
-    unsigned long addend;
-} *plt_list;
-
-static int
-get_plt_index (const char *name, unsigned long addend)
-{
-    struct plt_entry *plt, *prev= NULL;
-    int index = 0;
-
-    /* see if we already have an entry for this target: */
-    for (plt = plt_list; plt; ++index, prev = plt, plt = plt->next)
-	if (strcmp(plt->name, name) == 0 && plt->addend == addend)
-	    return index;
-
-    /* nope; create a new PLT entry: */
-
-    plt = malloc(sizeof(*plt));
-    if (!plt) {
-	perror("malloc");
-	exit(1);
-    }
-    memset(plt, 0, sizeof(*plt));
-    plt->name = strdup(name);
-    plt->addend = addend;
-
-    /* append to plt-list: */
-    if (prev)
-	prev->next = plt;
-    else
-	plt_list = plt;
-    return index;
-}
-
-#endif
-
-#ifdef HOST_ARM
-
-int arm_emit_ldr_info(const char *name, unsigned long start_offset,
-                      FILE *outfile, uint8_t *p_start, uint8_t *p_end,
-                      ELF_RELOC *relocs, int nb_relocs)
-{
-    uint8_t *p;
-    uint32_t insn;
-    int offset, min_offset, pc_offset, data_size;
-    uint8_t data_allocated[1024];
-    unsigned int data_index;
-
-    memset(data_allocated, 0, sizeof(data_allocated));
-
-    p = p_start;
-    min_offset = p_end - p_start;
-    while (p < p_start + min_offset) {
-        insn = get32((uint32_t *)p);
-        if ((insn & 0x0d5f0000) == 0x051f0000) {
-            /* ldr reg, [pc, #im] */
-            offset = insn & 0xfff;
-            if (!(insn & 0x00800000))
-                        offset = -offset;
-            if ((offset & 3) !=0)
-                error("%s:%04x: ldr pc offset must be 32 bit aligned",
-                      name, start_offset + p - p_start);
-            pc_offset = p - p_start + offset + 8;
-            if (pc_offset <= (p - p_start) ||
-                pc_offset >= (p_end - p_start))
-                error("%s:%04x: ldr pc offset must point inside the function code",
-                      name, start_offset + p - p_start);
-            if (pc_offset < min_offset)
-                min_offset = pc_offset;
-            if (outfile) {
-                /* ldr position */
-                fprintf(outfile, "    arm_ldr_ptr->ptr = gen_code_ptr + %d;\n",
-                        p - p_start);
-                /* ldr data index */
-                data_index = ((p_end - p_start) - pc_offset - 4) >> 2;
-                fprintf(outfile, "    arm_ldr_ptr->data_ptr = arm_data_ptr + %d;\n",
-                        data_index);
-                fprintf(outfile, "    arm_ldr_ptr++;\n");
-                if (data_index >= sizeof(data_allocated))
-                    error("%s: too many data", name);
-                if (!data_allocated[data_index]) {
-                    ELF_RELOC *rel;
-                    int i, addend, type;
-                    const char *sym_name, *p;
-                    char relname[1024];
-
-                    data_allocated[data_index] = 1;
-
-                    /* data value */
-                    addend = get32((uint32_t *)(p_start + pc_offset));
-                    relname[0] = '\0';
-                    for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-                        if (rel->r_offset == (pc_offset + start_offset)) {
-                            sym_name = get_rel_sym_name(rel);
-                            /* the compiler leave some unnecessary references to the code */
-                            get_reloc_expr(relname, sizeof(relname), sym_name);
-                            type = ELF32_R_TYPE(rel->r_info);
-                            if (type != R_ARM_ABS32)
-                                error("%s: unsupported data relocation", name);
-                            break;
-                        }
-                    }
-                    fprintf(outfile, "    arm_data_ptr[%d] = 0x%x",
-                            data_index, addend);
-                    if (relname[0] != '\0')
-                        fprintf(outfile, " + %s", relname);
-                    fprintf(outfile, ";\n");
-                }
-            }
-        }
-        p += 4;
-    }
-    data_size = (p_end - p_start) - min_offset;
-    if (data_size > 0 && outfile) {
-        fprintf(outfile, "    arm_data_ptr += %d;\n", data_size >> 2);
-    }
-
-    /* the last instruction must be a mov pc, lr */
-    if (p == p_start)
-        goto arm_ret_error;
-    p -= 4;
-    insn = get32((uint32_t *)p);
-    if ((insn & 0xffff0000) != 0xe91b0000) {
-    arm_ret_error:
-        if (!outfile)
-            printf("%s: invalid epilog\n", name);
-    }
-    return p - p_start;
-}
-#endif
-
-
-#if defined(HOST_I386) || defined(HOST_X86_64)
-
-/* This byte is the first byte of an instruction.  */
-#define FLAG_INSN     (1 << 0)
-/* This byte has been processed as part of an instruction.  */
-#define FLAG_SCANNED  (1 << 1)
-/* This instruction is a return instruction.  Gcc cometimes generates prefix
-   bytes, so may be more than one byte long.  */
-#define FLAG_RET      (1 << 2)
-/* This is either the target of a jump, or the preceeding instruction uses
-   a pc-relative offset.  */
-#define FLAG_TARGET   (1 << 3)
-/* This is a magic instruction that needs fixing up.  */
-#define FLAG_EXIT     (1 << 4)
-#define MAX_EXITS     5
-
-static void
-bad_opcode(const char *name, uint32_t op)
-{
-    error("Unsupported opcode %0*x in %s", (op > 0xff) ? 4 : 2, op, name);
-}
-
-/* Mark len bytes as scanned,  Returns insn_size + len.  Reports an error
-   if these bytes have already been scanned.  */
-static int
-eat_bytes(const char *name, char *flags, int insn, int insn_size, int len)
-{
-    while (len > 0) {
-        /* This should never occur in sane code.  */
-        if (flags[insn + insn_size] & FLAG_SCANNED)
-            error ("Overlapping instructions in %s", name);
-        flags[insn + insn_size] |= FLAG_SCANNED;
-        insn_size++;
-        len--;
-    }
-    return insn_size;
-}
-
-static void
-trace_i386_insn (const char *name, uint8_t *start_p, char *flags, int insn,
-                 int len)
-{
-    uint8_t *ptr;
-    uint8_t op;
-    int modrm;
-    int is_prefix;
-    int op_size;
-    int addr_size;
-    int insn_size;
-    int is_ret;
-    int is_condjmp;
-    int is_jmp;
-    int is_exit;
-    int is_pcrel;
-    int immed;
-    int seen_rexw;
-    int32_t disp;
-
-    ptr = start_p + insn;
-    /* nonzero if this insn has a ModR/M byte.  */
-    modrm = 1;
-    /* The size of the immediate value in this instruction.  */
-    immed = 0;
-    /* The operand size.  */
-    op_size = 4;
-    /* The address size */
-    addr_size = 4;
-    /* The total length of this instruction.  */
-    insn_size = 0;
-    is_prefix = 1;
-    is_ret = 0;
-    is_condjmp = 0;
-    is_jmp = 0;
-    is_exit = 0;
-    seen_rexw = 0;
-    is_pcrel = 0;
-
-    while (is_prefix) {
-        op = ptr[insn_size];
-        insn_size = eat_bytes(name, flags, insn, insn_size, 1);
-        is_prefix = 0;
-        switch (op >> 4) {
-        case 0:
-        case 1:
-        case 2:
-        case 3:
-            if (op == 0x0f) {
-                /* two-byte opcode.  */
-                op = ptr[insn_size];
-                insn_size = eat_bytes(name, flags, insn, insn_size, 1);
-                switch (op >> 4) {
-                case 0:
-                    if ((op & 0xf) > 3)
-                      modrm = 0;
-                    break;
-                case 1: /* vector move or prefetch */
-                case 2: /* various moves and vector compares.  */
-                case 4: /* cmov */
-                case 5: /* vector instructions */
-                case 6:
-                case 13:
-                case 14:
-                case 15:
-                    break;
-                case 7: /* mmx */
-                    if (op & 0x77) /* emms */
-                      modrm = 0;
-                    break;
-                case 3: /* wrmsr, rdtsc, rdmsr, rdpmc, sysenter, sysexit */
-                    modrm = 0;
-                    break;
-                case 8: /* long conditional jump */
-                    is_condjmp = 1;
-                    immed = op_size;
-                    modrm = 0;
-                    break;
-                case 9: /* setcc */
-                    break;
-                case 10:
-                    switch (op & 0x7) {
-                    case 0: /* push fs/gs */
-                    case 1: /* pop fs/gs */
-                    case 2: /* cpuid/rsm */
-                        modrm = 0;
-                        break;
-                    case 4: /* shld/shrd immediate */
-                        immed = 1;
-                        break;
-                    default: /* Normal instructions with a ModR/M byte.  */
-                        break;
-                    }
-                    break;
-                case 11:
-                    switch (op & 0xf) {
-                    case 10: /* bt, bts, btr, btc */
-                        immed = 1;
-                        break;
-                    default:
-                        /* cmpxchg, lss, btr, lfs, lgs, movzx, btc, bsf, bsr
-                           undefined, and movsx */
-                        break;
-                    }
-                    break;
-                case 12:
-                    if (op & 8) {
-                        /* bswap */
-                        modrm = 0;
-                    } else {
-                        switch (op & 0x7) {
-                        case 2:
-                        case 4:
-                        case 5:
-                        case 6:
-                            immed = 1;
-                            break;
-                        default:
-                            break;
-                        }
-                    }
-                    break;
-                }
-            } else if ((op & 0x07) <= 0x3) {
-                /* General arithmentic ax.  */
-            } else if ((op & 0x07) <= 0x5) {
-                /* General arithmetic ax, immediate.  */
-                if (op & 0x01)
-                    immed = op_size;
-                else
-                    immed = 1;
-                modrm = 0;
-            } else if ((op & 0x23) == 0x22) {
-                /* Segment prefix.  */
-                is_prefix = 1;
-            } else {
-                /* Segment register push/pop or DAA/AAA/DAS/AAS.  */
-                modrm = 0;
-            }
-            break;
-
-#if defined(HOST_X86_64)
-        case 4: /* rex prefix.  */
-            is_prefix = 1;
-            /* The address/operand size is actually 64-bit, but the immediate
-               values in the instruction are still 32-bit.  */
-            op_size = 4;
-            addr_size = 4;
-            if (op & 8)
-                seen_rexw = 1;
-            break;
-#else
-        case 4: /* inc/dec register.  */
-#endif
-        case 5: /* push/pop general register.  */
-            modrm = 0;
-            break;
-
-        case 6:
-            switch (op & 0x0f) {
-            case 0: /* pusha */
-            case 1: /* popa */
-                modrm = 0;
-                break;
-            case 2: /* bound */
-            case 3: /* arpl */
-                break;
-            case 4: /* FS */
-            case 5: /* GS */
-                is_prefix = 1;
-                break;
-            case 6: /* opcode size prefix.  */
-                op_size = 2;
-                is_prefix = 1;
-                break;
-            case 7: /* Address size prefix.  */
-                addr_size = 2;
-                is_prefix = 1;
-                break;
-            case 8: /* push immediate */
-                immed = op_size;
-                modrm = 0;
-                break;
-            case 10: /* push 8-bit immediate */
-                immed = 1;
-                modrm = 0;
-                break;
-            case 9: /* imul immediate */
-                immed = op_size;
-                break;
-            case 11: /* imul 8-bit immediate */
-                immed = 1;
-                break;
-            case 12: /* insb */
-            case 13: /* insw */
-            case 14: /* outsb */
-            case 15: /* outsw */
-                modrm = 0;
-                break;
-            }
-            break;
-
-        case 7: /* Short conditional jump.  */
-            is_condjmp = 1;
-            immed = 1;
-            modrm = 0;
-            break;
-
-        case 8:
-            if ((op & 0xf) <= 3) {
-                /* arithmetic immediate.  */
-                if ((op & 3) == 1)
-                    immed = op_size;
-                else
-                    immed = 1;
-            }
-            /* else test, xchg, mov, lea or pop general.  */
-            break;
-
-        case 9:
-            /* Various single-byte opcodes with no modrm byte.  */
-            modrm = 0;
-            if (op == 10) {
-                /* Call */
-                immed = 4;
-            }
-            break;
-
-        case 10:
-            switch ((op & 0xe) >> 1) {
-            case 0: /* mov absoliute immediate.  */
-            case 1:
-                if (seen_rexw)
-                    immed = 8;
-                else
-                    immed = addr_size;
-                break;
-            case 4: /* test immediate.  */
-                if (op & 1)
-                    immed = op_size;
-                else
-                    immed = 1;
-                break;
-            default: /* Various string ops.  */
-                break;
-            }
-            modrm = 0;
-            break;
-
-        case 11: /* move immediate to register */
-            if (op & 8) {
-                if (seen_rexw)
-                    immed = 8;
-                else
-                    immed = op_size;
-            } else {
-                immed = 1;
-            }
-            modrm = 0;
-            break;
-
-          case 12:
-            switch (op & 0xf) {
-            case 0: /* shift immediate */
-            case 1:
-                immed = 1;
-                break;
-            case 2: /* ret immediate */
-                immed = 2;
-                modrm = 0;
-                bad_opcode(name, op);
-                break;
-            case 3: /* ret */
-                modrm = 0;
-                is_ret = 1;
-            case 4: /* les */
-            case 5: /* lds */
-                break;
-            case 6: /* mov immediate byte */
-                immed = 1;
-                break;
-            case 7: /* mov immediate */
-                immed = op_size;
-                break;
-            case 8: /* enter */
-                /* TODO: Is this right?  */
-                immed = 3;
-                modrm = 0;
-                break;
-            case 10: /* retf immediate */
-                immed = 2;
-                modrm = 0;
-                bad_opcode(name, op);
-                break;
-            case 13: /* int */
-                immed = 1;
-                modrm = 0;
-                break;
-            case 11: /* retf */
-            case 15: /* iret */
-                modrm = 0;
-                bad_opcode(name, op);
-                break;
-            default: /* leave, int3 or into */
-                modrm = 0;
-                break;
-            }
-            break;
-
-        case 13:
-            if ((op & 0xf) >= 8) {
-                /* Coprocessor escape.  For our purposes this is just a normal
-                   instruction with a ModR/M byte.  */
-            } else if ((op & 0xf) >= 4) {
-                /* AAM, AAD or XLAT */
-                modrm = 0;
-            }
-            /* else shift instruction */
-            break;
-
-        case 14:
-            switch ((op & 0xc) >> 2) {
-            case 0: /* loop or jcxz */
-                is_condjmp = 1;
-                immed = 1;
-                break;
-            case 1: /* in/out immed */
-                immed = 1;
-                break;
-            case 2: /* call or jmp */
-                switch (op & 3) {
-                case 0: /* call */
-                    immed = op_size;
-                    break;
-                case 1: /* long jump */
-                    immed = 4;
-                    is_jmp = 1;
-                    break;
-                case 2: /* far jmp */
-                    bad_opcode(name, op);
-                    break;
-                case 3: /* short jmp */
-                    immed = 1;
-                    is_jmp = 1;
-                    break;
-                }
-                break;
-            case 3: /* in/out register */
-                break;
-            }
-            modrm = 0;
-            break;
-
-        case 15:
-            switch ((op & 0xe) >> 1) {
-            case 0:
-            case 1:
-                is_prefix = 1;
-                break;
-            case 2:
-            case 4:
-            case 5:
-            case 6:
-                modrm = 0;
-                /* Some privileged insns are used as markers.  */
-                switch (op) {
-                case 0xf4: /* hlt: Exit translation block.  */
-                    is_exit = 1;
-                    break;
-                case 0xfa: /* cli: Jump to label.  */
-                    is_exit = 1;
-                    immed = 4;
-                    break;
-                case 0xfb: /* sti: TB patch jump.  */
-                    /* Mark the insn for patching, but continue sscanning.  */
-                    flags[insn] |= FLAG_EXIT;
-                    immed = 4;
-                    break;
-                }
-                break;
-            case 3: /* unary grp3 */
-                if ((ptr[insn_size] & 0x38) == 0) {
-                    if (op == 0xf7)
-                        immed = op_size;
-                    else
-                        immed = 1; /* test immediate */
-                }
-                break;
-            case 7: /* inc/dec grp4/5 */
-                /* TODO: This includes indirect jumps.  We should fail if we
-                   encounter one of these. */
-                break;
-            }
-            break;
-        }
-    }
-
-    if (modrm) {
-        if (addr_size != 4)
-            error("16-bit addressing mode used in %s", name);
-
-        disp = 0;
-        modrm = ptr[insn_size];
-        insn_size = eat_bytes(name, flags, insn, insn_size, 1);
-        modrm &= 0xc7;
-        switch ((modrm & 0xc0) >> 6) {
-        case 0:
-            if (modrm == 5)
-              disp = 4;
-            break;
-        case 1:
-            disp = 1;
-            break;
-        case 2:
-            disp = 4;
-            break;
-        }
-        if ((modrm & 0xc0) != 0xc0 && (modrm & 0x7) == 4) {
-            /* SIB byte */
-            if (modrm == 4 && (ptr[insn_size] & 0x7) == 5) {
-                disp = 4;
-                is_pcrel = 1;
-            }
-            insn_size = eat_bytes(name, flags, insn, insn_size, 1);
-        }
-        insn_size = eat_bytes(name, flags, insn, insn_size, disp);
-    }
-    insn_size = eat_bytes(name, flags, insn, insn_size, immed);
-    if (is_condjmp || is_jmp) {
-        if (immed == 1) {
-            disp = (int8_t)*(ptr + insn_size - 1);
-        } else {
-            disp = (((int32_t)*(ptr + insn_size - 1)) << 24)
-                   | (((int32_t)*(ptr + insn_size - 2)) << 16)
-                   | (((int32_t)*(ptr + insn_size - 3)) << 8)
-                   | *(ptr + insn_size - 4);
-        }
-        disp += insn_size;
-        /* Jumps to external symbols point to the address of the offset
-           before relocation.  */
-        /* ??? These are probably a tailcall.  We could fix them up by
-           replacing them with jmp to EOB + call, but it's easier to just
-           prevent the compiler generating them.  */
-        if (disp == 1)
-            error("Unconditional jump (sibcall?) in %s", name);
-        disp += insn;
-        if (disp < 0 || disp > len)
-            error("Jump outside instruction in %s", name);
-
-        if ((flags[disp] & (FLAG_INSN | FLAG_SCANNED)) == FLAG_SCANNED)
-            error("Overlapping instructions in %s", name);
-
-        flags[disp] |= (FLAG_INSN | FLAG_TARGET);
-        is_pcrel = 1;
-    }
-    if (is_pcrel) {
-        /* Mark the following insn as a jump target.  This will stop
-           this instruction being moved.  */
-        flags[insn + insn_size] |= FLAG_TARGET;
-    }
-    if (is_ret)
-      flags[insn] |= FLAG_RET;
-
-    if (is_exit)
-      flags[insn] |= FLAG_EXIT;
-
-    if (!(is_jmp || is_ret || is_exit))
-      flags[insn + insn_size] |= FLAG_INSN;
-}
-
-/* Scan a function body.  Returns the position of the return sequence.
-   Sets *patch_bytes to the number of bytes that need to be copied from that
-   location.  If no patching is required (ie. the return is the last insn)
-   *patch_bytes will be set to -1.  *plen is the number of code bytes to copy.
- */
-static int trace_i386_op(const char * name, uint8_t *start_p, int *plen,
-                         int *patch_bytes, int *exit_addrs)
-{
-    char *flags;
-    int more;
-    int insn;
-    int retpos;
-    int bytes;
-    int num_exits;
-    int len;
-    int last_insn;
-
-    len = *plen;
-    flags = malloc(len + 1);
-    memset(flags, 0, len + 1);
-    flags[0] |= FLAG_INSN;
-    more = 1;
-    while (more) {
-        more = 0;
-        for (insn = 0; insn < len; insn++) {
-            if ((flags[insn] & (FLAG_INSN | FLAG_SCANNED)) == FLAG_INSN) {
-                trace_i386_insn(name, start_p, flags, insn, len);
-                more = 1;
-            }
-        }
-    }
-
-    /* Strip any unused code at the end of the function.  */
-    while (len > 0 && flags[len - 1] == 0)
-      len--;
-
-    retpos = -1;
-    num_exits = 0;
-    last_insn = 0;
-    for (insn = 0; insn < len; insn++) {
-        if (flags[insn] & FLAG_RET) {
-            /* ??? In theory it should be possible to handle multiple return
-               points.  In practice it's not worth the effort.  */
-            if (retpos != -1)
-                error("Multiple return instructions in %s", name);
-            retpos = insn;
-        }
-        if (flags[insn] & FLAG_EXIT) {
-            if (num_exits == MAX_EXITS)
-                error("Too many block exits in %s", name);
-            exit_addrs[num_exits] = insn;
-            num_exits++;
-        }
-        if (flags[insn] & FLAG_INSN)
-            last_insn = insn;
-    }
-
-    exit_addrs[num_exits] = -1;
-    if (retpos == -1) {
-        if (num_exits == 0) {
-            error ("No return instruction found in %s", name);
-        } else {
-            retpos = len;
-            last_insn = len;
-        }
-    }
-
-    /* If the return instruction is the last instruction we can just
-       remove it.  */
-    if (retpos == last_insn)
-        *patch_bytes = -1;
-    else
-        *patch_bytes = 0;
-
-    /* Back up over any nop instructions.  */
-    while (retpos > 0
-           && (flags[retpos] & FLAG_TARGET) == 0
-           && (flags[retpos - 1] & FLAG_INSN) != 0
-           && start_p[retpos - 1] == 0x90) {
-        retpos--;
-    }
-
-    if (*patch_bytes == -1) {
-        *plen = retpos;
-        free (flags);
-        return retpos;
-    }
-    *plen = len;
-
-    /* The ret is in the middle of the function.  Find four more bytes that
-       so the ret can be replaced by a jmp. */
-    /* ??? Use a short jump where possible. */
-    bytes = 4;
-    insn = retpos + 1;
-    /* We can clobber everything up to the next jump target.  */
-    while (insn < len && bytes > 0 && (flags[insn] & FLAG_TARGET) == 0) {
-        insn++;
-        bytes--;
-    }
-    if (bytes > 0) {
-        /* ???: Strip out nop blocks.  */
-        /* We can't do the replacement without clobbering anything important.
-           Copy preceeding instructions(s) to give us some space.  */
-        while (retpos > 0) {
-            /* If this byte is the target of a jmp we can't move it.  */
-            if (flags[retpos] & FLAG_TARGET)
-                break;
-
-            (*patch_bytes)++;
-            bytes--;
-            retpos--;
-
-            /* Break out of the loop if we have enough space and this is either
-               the first byte of an instruction or a pad byte.  */
-            if ((flags[retpos] & (FLAG_INSN | FLAG_SCANNED)) != FLAG_SCANNED
-                && bytes <= 0) {
-                break;
-            }
-        }
-    }
-
-    if (bytes > 0)
-        error("Unable to replace ret with jmp in %s\n", name);
-
-    free(flags);
-    return retpos;
-}
-
-#endif
-
-#define MAX_ARGS 3
-
-/* generate op code */
-void gen_code(const char *name, host_ulong offset, host_ulong size,
-              FILE *outfile, int gen_switch)
-{
-    int copy_size = 0;
-    uint8_t *p_start, *p_end;
-    host_ulong start_offset;
-    int nb_args, i, n;
-    uint8_t args_present[MAX_ARGS];
-    const char *sym_name, *p;
-    EXE_RELOC *rel;
-
-#if defined(CONFIG_FORMAT_MACH)
-    typedef struct { const char*  name; int nonlazy; } SymRef;
-    int       num_symrefs = 0;
-    int       max_symrefs = 0;
-    SymRef*   symrefs     = NULL;
-#endif
-
-#if defined(HOST_I386) || defined(HOST_X86_64)
-    int patch_bytes;
-    int retpos;
-    int exit_addrs[MAX_EXITS];
-#endif
-
-    /* Compute exact size excluding prologue and epilogue instructions.
-     * Increment start_offset to skip epilogue instructions, then compute
-     * copy_size the indicate the size of the remaining instructions (in
-     * bytes).
-     */
-    p_start = text + offset;
-    p_end = p_start + size;
-    start_offset = offset;
-#if defined(HOST_I386) || defined(HOST_X86_64)
-    {
-        int len;
-        len = p_end - p_start;
-        retpos = trace_i386_op(name, p_start, &len, &patch_bytes, exit_addrs);
-        copy_size = len;
-    }
-#elif defined(HOST_PPC)
-    {
-        uint8_t *p;
-        p = (void *)(p_end - 4);
-	while (p > p_start && get32((uint32_t*)p) == 0x60000000) {
-		p_end = p;
-		p    -= 4;
-	}
-        if (p == p_start)
-            error("empty code for %s", name);
-        if (get32((uint32_t *)p) != 0x4e800020)
-            error("blr expected at the end of %s", name);
-        copy_size = p - p_start;
-    }
-#elif defined(HOST_S390)
-    {
-        uint8_t *p;
-        p = (void *)(p_end - 2);
-        if (p == p_start)
-            error("empty code for %s", name);
-        if (get16((uint16_t *)p) != 0x07fe && get16((uint16_t *)p) != 0x07f4)
-            error("br %%r14 expected at the end of %s", name);
-        copy_size = p - p_start;
-    }
-#elif defined(HOST_ALPHA)
-    {
-        uint8_t *p;
-        p = p_end - 4;
-#if 0
-        /* XXX: check why it occurs */
-        if (p == p_start)
-            error("empty code for %s", name);
-#endif
-        if (get32((uint32_t *)p) != 0x6bfa8001)
-            error("ret expected at the end of %s", name);
-        copy_size = p - p_start;
-    }
-#elif defined(HOST_IA64)
-    {
-        uint8_t *p;
-        p = (void *)(p_end - 4);
-        if (p == p_start)
-            error("empty code for %s", name);
-        /* br.ret.sptk.many b0;; */
-        /* 08 00 84 00 */
-        if (get32((uint32_t *)p) != 0x00840008)
-            error("br.ret.sptk.many b0;; expected at the end of %s", name);
-	copy_size = p_end - p_start;
-    }
-#elif defined(HOST_SPARC)
-    {
-#define INSN_SAVE       0x9de3a000
-#define INSN_RET        0x81c7e008
-#define INSN_RESTORE    0x81e80000
-#define INSN_RETURN     0x81cfe008
-#define INSN_NOP        0x01000000
-
-        uint32_t start_insn, end_insn1, end_insn2;
-        uint8_t *p;
-        p = (void *)(p_end - 8);
-        if (p <= p_start)
-            error("empty code for %s", name);
-        start_insn = get32((uint32_t *)(p_start + 0x0));
-        end_insn1 = get32((uint32_t *)(p + 0x0));
-        end_insn2 = get32((uint32_t *)(p + 0x4));
-        if ((start_insn & ~0x1fff) == INSN_SAVE) {
-            p_start += 0x4;
-            start_offset += 0x4;
-            if ((int)(start_insn | ~0x1fff) < -128)
-                error("Found bogus save at the start of %s", name);
-            if (end_insn1 == INSN_RET && end_insn2 == INSN_RESTORE)
-                /* SPARC v7: ret; restore; */ ;
-            else if (end_insn1 == INSN_RETURN && end_insn2 == INSN_NOP)
-                /* SPARC v9: return; nop; */ ;
-            else
-                error("ret; restore; not found at end of %s", name);
-        } else {
-            error("No save at the beginning of %s", name);
-        }
-#if 0
-        /* Skip a preceeding nop, if present.  */
-        if (p > p_start) {
-            skip_insn = get32((uint32_t *)(p - 0x4));
-            if (skip_insn == INSN_NOP)
-                p -= 4;
-        }
-#endif
-        copy_size = p - p_start;
-    }
-#elif defined(HOST_SPARC64)
-    {
-        uint32_t start_insn, end_insn1, end_insn2, skip_insn;
-        uint8_t *p;
-        p = (void *)(p_end - 8);
-        if (p <= p_start)
-            error("empty code for %s", name);
-        start_insn = get32((uint32_t *)(p_start + 0x0));
-        end_insn1 = get32((uint32_t *)(p + 0x0));
-        end_insn2 = get32((uint32_t *)(p + 0x4));
-        if ((start_insn & ~0x1fff) == 0x9de3a000) {
-            p_start += 0x4;
-            start_offset += 0x4;
-            if ((int)(start_insn | ~0x1fff) < -256)
-                error("Found bogus save at the start of %s", name);
-            if (end_insn1 != 0x81c7e008 || end_insn2 != 0x81e80000)
-                error("ret; restore; not found at end of %s", name);
-        } else {
-            error("No save at the beginning of %s", name);
-        }
-
-        /* Skip a preceeding nop, if present.  */
-        if (p > p_start) {
-            skip_insn = get32((uint32_t *)(p - 0x4));
-            if (skip_insn == 0x01000000)
-                p -= 4;
-        }
-
-        copy_size = p - p_start;
-    }
-#elif defined(HOST_ARM)
-    {
-        if ((p_end - p_start) <= 16)
-            error("%s: function too small", name);
-        if (get32((uint32_t *)p_start) != 0xe1a0c00d ||
-            (get32((uint32_t *)(p_start + 4)) & 0xffff0000) != 0xe92d0000 ||
-            get32((uint32_t *)(p_start + 8)) != 0xe24cb004)
-            error("%s: invalid prolog", name);
-        p_start += 12;
-        start_offset += 12;
-        copy_size = arm_emit_ldr_info(name, start_offset, NULL, p_start, p_end,
-                                      relocs, nb_relocs);
-    }
-#elif defined(HOST_M68K)
-    {
-        uint8_t *p;
-        p = (void *)(p_end - 2);
-        if (p == p_start)
-            error("empty code for %s", name);
-        // remove NOP's, probably added for alignment
-        while ((get16((uint16_t *)p) == 0x4e71) &&
-               (p>p_start))
-            p -= 2;
-        if (get16((uint16_t *)p) != 0x4e75)
-            error("rts expected at the end of %s", name);
-        copy_size = p - p_start;
-    }
-#else
-#error unsupported CPU
-#endif
-
-    /* compute the number of arguments by looking at the relocations */
-    for(i = 0;i < MAX_ARGS; i++)
-        args_present[i] = 0;
-
-    for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-        host_ulong offset = get_rel_offset(rel);
-        if (offset >= start_offset &&
-	    offset < start_offset + (p_end - p_start)) {
-            sym_name = get_rel_sym_name(rel);
-            if(!sym_name)
-                continue;
-            if (strstart(sym_name, "__op_param", &p) ||
-                strstart(sym_name, "__op_gen_label", &p)) {
-                n = strtoul(p, NULL, 10);
-                if (n > MAX_ARGS)
-                    error("too many arguments in %s", name);
-                args_present[n - 1] = 1;
-            }
-        }
-    }
-
-    nb_args = 0;
-    while (nb_args < MAX_ARGS && args_present[nb_args])
-        nb_args++;
-    for(i = nb_args; i < MAX_ARGS; i++) {
-        if (args_present[i])
-            error("inconsistent argument numbering in %s", name);
-    }
-
-    if (gen_switch == 2) {
-#if defined(HOST_I386) || defined(HOST_X86_64)
-        if (patch_bytes != -1)
-            copy_size += patch_bytes;
-#ifdef DEBUG_OP
-        copy_size += 2;
-#endif
-#endif
-        fprintf(outfile, "DEF(%s, %d, %d)\n", name + 3, nb_args, copy_size);
-    } else if (gen_switch == 1) {
-
-        /* output C code */
-        fprintf(outfile, "case INDEX_%s: {\n", name);
-        if (nb_args > 0) {
-            fprintf(outfile, "    long ");
-            for(i = 0; i < nb_args; i++) {
-                if (i != 0)
-                    fprintf(outfile, ", ");
-                fprintf(outfile, "param%d", i + 1);
-            }
-            fprintf(outfile, ";\n");
-        }
-
-#if 1
-        fprintf(outfile, "    static const unsigned char %s[%d] = {\n", name, copy_size);
-        {
-            uint8_t*  code = p_start + (start_offset - offset);
-            int       nn;
-            const char*  comma = "        ";
-
-            for (nn = 0; nn < copy_size; nn++) {
-                fprintf(outfile, "%s0x%02x", comma, code[nn]);
-                comma = ", ";
-                if (((nn+1) & 15) == 0)
-                    comma = ",\n        ";
-            }
-            offset = start_offset;
-        }
-        fprintf(outfile, "\n    };\n" );
-#else  /* 0 */
-#if defined(HOST_IA64)
-        fprintf(outfile, "    extern char %s;\n", name);
-#else
-        fprintf(outfile, "    extern void %s();\n", name);
-#endif
-#endif /* 0 */
-
-        for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-            host_ulong offset = get_rel_offset(rel);
-            if (offset >= start_offset &&
-                offset < start_offset + (p_end - p_start)) {
-                sym_name = get_rel_sym_name(rel);
-                if(!sym_name)
-                    continue;
-                if (*sym_name &&
-                    !strstart(sym_name, "__op_param", NULL) &&
-                    !strstart(sym_name, "__op_jmp", NULL) &&
-                    !strstart(sym_name, "__op_gen_label", NULL)) {
-#if defined(HOST_SPARC)
-		    if (sym_name[0] == '.') {
-			fprintf(outfile,
-				"extern char __dot_%s __asm__(\"%s\");\n",
-				sym_name+1, sym_name);
-			continue;
-		    }
-#elif defined(CONFIG_FORMAT_MACH)
-                    {
-                        int  nn;
-
-                        for (nn = 0; nn < num_symrefs; nn++)
-                            if ( !strcmp(sym_name, symrefs[nn].name) )
-                                break;
-
-                        if (nn >= num_symrefs)
-                        {
-                            if (num_symrefs >= max_symrefs) {
-                                int      new_max   = max_symrefs + 16;
-                                SymRef*  new_refs = realloc( symrefs, new_max*sizeof(SymRef) );
-                                symrefs = new_refs;
-                                max_symrefs = new_max;
-                            }
-
-                            symrefs[nn].name    = sym_name;
-                            symrefs[nn].nonlazy = 0;
-
-                            fprintf(outfile, "    extern char %s __attribute__((unused));\n", sym_name);
-                            num_symrefs++;
-                        }
-
-                        if ( !symrefs[nn].nonlazy && is_reloc_non_lazy(rel) ) {
-                            symrefs[nn].nonlazy = 1;
-                            fprintf(outfile, "    static const void* __to_%s = &%s;\n", sym_name, sym_name );
-                        }
-                    }
-#elif defined(HOST_IA64)
-			if (ELF64_R_TYPE(rel->r_info) != R_IA64_PCREL21B)
-				/*
-				 * PCREL21 br.call targets generally
-				 * are out of range and need to go
-				 * through an "import stub".
-				 */
-				fprintf(outfile, "    extern char %s;\n",
-					sym_name);
-#else
-                    fprintf(outfile, "extern char %s;\n", sym_name);
-#endif
-                }
-            }
-        }
-
-        fprintf(outfile, "    memcpy(gen_code_ptr, (void *)((char *)&%s+%d), %d);\n",
-					name, (int)(start_offset - offset), copy_size);
-
-        /* emit code offset information */
-        {
-            EXE_SYM *sym;
-            const char *sym_name, *p;
-            unsigned long val;
-            int n;
-
-            for(i = 0, sym = symtab; i < nb_syms; i++, sym++) {
-                sym_name = get_sym_name(sym);
-                if (strstart(sym_name, "__op_label", &p)) {
-                    uint8_t *ptr;
-                    unsigned long offset;
-
-                    /* test if the variable refers to a label inside
-                       the code we are generating */
-#ifdef CONFIG_FORMAT_COFF
-                    if (sym->st_shndx == text_shndx) {
-                        ptr = sdata[coff_text_shndx];
-                    } else if (sym->st_shndx == data_shndx) {
-                        ptr = sdata[coff_data_shndx];
-                    } else {
-                        ptr = NULL;
-                    }
-#elif defined(CONFIG_FORMAT_MACH)
-                    if(!sym->n_sect)
-                        continue;
-                    ptr = sdata[sym->n_sect-1];
-#else
-                    ptr = sdata[sym->st_shndx];
-#endif
-                    if (!ptr)
-                        error("__op_labelN in invalid section");
-                    offset = sym->st_value;
-#ifdef CONFIG_FORMAT_MACH
-                    offset -= section_hdr[sym->n_sect-1].addr;
-#endif
-                    val = *(unsigned long *)(ptr + offset);
-#ifdef ELF_USES_RELOCA
-                    {
-                        int reloc_shndx, nb_relocs1, j;
-
-                        /* try to find a matching relocation */
-                        reloc_shndx = find_reloc(sym->st_shndx);
-                        if (reloc_shndx) {
-                            nb_relocs1 = shdr[reloc_shndx].sh_size /
-                                shdr[reloc_shndx].sh_entsize;
-                            rel = (ELF_RELOC *)sdata[reloc_shndx];
-                            for(j = 0; j < nb_relocs1; j++) {
-                                if (rel->r_offset == offset) {
-				    val = rel->r_addend;
-                                    break;
-                                }
-				rel++;
-                            }
-                        }
-                    }
-#endif
-                    if (val >= start_offset && val <= start_offset + copy_size) {
-                        n = strtol(p, NULL, 10);
-                        fprintf(outfile, "    label_offsets[%d] = %ld + (gen_code_ptr - gen_code_buf);\n", n, (long)(val - start_offset));
-                    }
-                }
-            }
-        }
-
-        /* load parameres in variables */
-        for(i = 0; i < nb_args; i++) {
-            fprintf(outfile, "    param%d = *opparam_ptr++;\n", i + 1);
-        }
-
-        /* patch relocations */
-#if defined(HOST_I386)
-            {
-#ifdef CONFIG_FORMAT_MACH
-                struct scattered_relocation_info *scarel;
-                struct relocation_info * rel;
-				char final_sym_name[256];
-				const char *sym_name;
-				const char *p;
-				int slide, sslide;
-				int i;
-
-				for (i = 0, rel = relocs; i < nb_relocs; i++, rel++) {
-					unsigned int offset, length, value = 0;
-					unsigned int type, pcrel, isym = 0;
-					unsigned int usesym = 0;
-
-					if (R_SCATTERED & rel->r_address) {
-						scarel = (struct scattered_relocation_info*)rel;
-						offset = (unsigned int)scarel->r_address;
-						length = scarel->r_length;
-						pcrel = scarel->r_pcrel;
-						type = scarel->r_type;
-						value = scarel->r_value;
-					}
-                    else {
-						value = isym = rel->r_symbolnum;
-						usesym = (rel->r_extern);
-						offset = rel->r_address;
-						length = rel->r_length;
-						pcrel = rel->r_pcrel;
-						type = rel->r_type;
-					}
-
-					slide = offset - start_offset;
-
-					if (!(offset >= start_offset && offset < start_offset + size))
-						continue;  /* not in our range */
-
-					sym_name = get_reloc_name(rel, &sslide);
-
-					if (usesym && symtab[isym].n_type & N_STAB)
-						continue; /* don't handle STAB (debug sym) */
-
-					if (sym_name && strstart(sym_name, "__op_jmp", &p)) {
-						int n;
-						n = strtol(p, NULL, 10);
-						fprintf(outfile, "    jmp_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n", n, slide);
-						continue; /* Nothing more to do */
-					}
-
-					if (!sym_name) {
-						fprintf(outfile, "/* #warning relocation not handled in %s (value 0x%x, %s, offset 0x%x, length 0x%x, %s, type 0x%x) */\n",
-                                name, value, usesym ? "use sym" : "don't use sym", offset, length, pcrel ? "pcrel":"", type);
-						continue; /* dunno how to handle without final_sym_name */
-					}
-
-                    get_reloc_expr(final_sym_name, sizeof(final_sym_name),
-                                   sym_name);
-
-                    if (length != 2)
-                        error("unsupported %d-bit relocation", 8 * (1 << length));
-
-					switch (type) {
-					case GENERIC_RELOC_VANILLA:
-                        if (pcrel || strstart(sym_name,"__op_gen_label",&p)) {
-                            fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s - (long)(gen_code_ptr + %d) - 4;\n",
-                                    slide, final_sym_name, slide);
-                        }
-                        else {
-                            if ( is_reloc_non_lazy(rel) )
-                                fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = (uint32_t)(void*)&__to_%s;\n", slide, sym_name);
-                            else
-                            	fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = (%s + %d);\n",
-                                	slide, final_sym_name, sslide);
-                        }
-                        break;
-                    default:
-                        error("unsupported i386 relocation (%d)", type);
-                    }
-                }
-#else
-                char name[256];
-                int type;
-                int addend;
-                int reloc_offset;
-                for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-                if (rel->r_offset >= start_offset &&
-		    rel->r_offset < start_offset + copy_size) {
-                    sym_name = get_rel_sym_name(rel);
-                    if (!sym_name)
-                        continue;
-                    reloc_offset = rel->r_offset - start_offset;
-                    if (strstart(sym_name, "__op_jmp", &p)) {
-                        int n;
-                        n = strtol(p, NULL, 10);
-                        /* __op_jmp relocations are done at
-                           runtime to do translated block
-                           chaining: the offset of the instruction
-                           needs to be stored */
-                        fprintf(outfile, "    jmp_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n",
-                                n, reloc_offset);
-                        continue;
-                    }
-
-                    get_reloc_expr(name, sizeof(name), sym_name);
-                    addend = get32((uint32_t *)(text + rel->r_offset));
-#ifdef CONFIG_FORMAT_ELF
-                    type = ELF32_R_TYPE(rel->r_info);
-                    switch(type) {
-                    case R_386_32:
-                        fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s + %d;\n",
-                                reloc_offset, name, addend);
-                        break;
-                    case R_386_PC32:
-                        fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s - (long)(gen_code_ptr + %d) + %d;\n",
-                                reloc_offset, name, reloc_offset, addend);
-                        break;
-                    default:
-                        error("unsupported i386 relocation (%d)", type);
-                    }
-#elif defined(CONFIG_FORMAT_COFF)
-                    {
-                        char *temp_name;
-                        int j;
-                        EXE_SYM *sym;
-                        temp_name = get_sym_name(symtab + *(uint32_t *)(rel->r_reloc->r_symndx));
-                        if (!strcmp(temp_name, ".data")) {
-                            for (j = 0, sym = symtab; j < nb_syms; j++, sym++) {
-                                if (strstart(sym->st_name, sym_name, NULL)) {
-                                    addend -= sym->st_value;
-                                }
-                            }
-                        }
-                    }
-                    type = rel->r_type;
-                    switch(type) {
-                    case DIR32:
-                        fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s + %d;\n",
-                                reloc_offset, name, addend);
-                        break;
-                    case DISP32:
-                        fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s - (long)(gen_code_ptr + %d) + %d -4;\n",
-                                reloc_offset, name, reloc_offset, addend);
-                        break;
-                    default:
-                        error("unsupported i386 relocation (%d)", type);
-                    }
-#else
-#error unsupport object format
-#endif
-                }
-                }
-#endif
-                /* Replace the marker instructions with the actual opcodes.  */
-                for (i = 0; exit_addrs[i] != -1; i++) {
-                    int op;
-                    switch (p_start[exit_addrs[i]])
-                      {
-                      case 0xf4: op = 0xc3; break; /* hlt -> ret */
-                      case 0xfa: op = 0xe9; break; /* cli -> jmp */
-                      case 0xfb: op = 0xe9; break; /* sti -> jmp */
-                      default: error("Internal error");
-                      }
-                    fprintf(outfile,
-                            "    *(uint8_t *)(gen_code_ptr + %d) = 0x%x;\n",
-                            exit_addrs[i], op);
-                }
-                /* Fix up the return instruction.  */
-                if (patch_bytes != -1) {
-                    if (patch_bytes) {
-                        fprintf(outfile, "    memcpy(gen_code_ptr + %d,"
-                                "gen_code_ptr + %d, %d);\n",
-                                copy_size, retpos, patch_bytes);
-                    }
-                    fprintf(outfile,
-                            "    *(uint8_t *)(gen_code_ptr + %d) = 0xe9;\n",
-                            retpos);
-                    fprintf(outfile,
-                            "    *(uint32_t *)(gen_code_ptr + %d) = 0x%x;\n",
-                            retpos + 1, copy_size - (retpos + 5));
-
-                    copy_size += patch_bytes;
-                }
-#ifdef DEBUG_OP
-                fprintf(outfile,
-                        "    *(uint16_t *)(gen_code_ptr + %d) = 0x9090;\n",
-                        copy_size);
-                copy_size += 2;
-#endif
-            }
-#elif defined(HOST_X86_64)
-            {
-                char name[256];
-                int type;
-                int addend;
-                int reloc_offset;
-                for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-                if (rel->r_offset >= start_offset &&
-		    rel->r_offset < start_offset + copy_size) {
-                    sym_name = strtab + symtab[ELFW(R_SYM)(rel->r_info)].st_name;
-                    get_reloc_expr(name, sizeof(name), sym_name);
-                    type = ELF32_R_TYPE(rel->r_info);
-                    addend = rel->r_addend;
-                    reloc_offset = rel->r_offset - start_offset;
-                    switch(type) {
-                    case R_X86_64_32:
-                        fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = (uint32_t)%s + %d;\n",
-                                reloc_offset, name, addend);
-                        break;
-                    case R_X86_64_32S:
-                        fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = (int32_t)%s + %d;\n",
-                                reloc_offset, name, addend);
-                        break;
-                    case R_X86_64_PC32:
-                        fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s - (long)(gen_code_ptr + %d) + %d;\n",
-                                reloc_offset, name, reloc_offset, addend);
-                        break;
-                    default:
-                        error("unsupported X86_64 relocation (%d)", type);
-                    }
-                }
-                }
-                /* Replace the marker instructions with the actual opcodes.  */
-                for (i = 0; exit_addrs[i] != -1; i++) {
-                    int op;
-                    switch (p_start[exit_addrs[i]])
-                      {
-                      case 0xf4: op = 0xc3; break; /* hlt -> ret */
-                      case 0xfa: op = 0xe9; break; /* cli -> jmp */
-                      case 0xfb: op = 0xe9; break; /* sti -> jmp */
-                      default: error("Internal error");
-                      }
-                    fprintf(outfile,
-                            "    *(uint8_t *)(gen_code_ptr + %d) = 0x%x;\n",
-                            exit_addrs[i], op);
-                }
-                /* Fix up the return instruction.  */
-                if (patch_bytes != -1) {
-                    if (patch_bytes) {
-                        fprintf(outfile, "    memcpy(gen_code_ptr + %d,"
-                                "gen_code_ptr + %d, %d);\n",
-                                copy_size, retpos, patch_bytes);
-                    }
-                    fprintf(outfile,
-                            "    *(uint8_t *)(gen_code_ptr + %d) = 0xe9;\n",
-                            retpos);
-                    fprintf(outfile,
-                            "    *(uint32_t *)(gen_code_ptr + %d) = 0x%x;\n",
-                            retpos + 1, copy_size - (retpos + 5));
-
-                    copy_size += patch_bytes;
-                }
-#ifdef DEBUG_OP
-                fprintf(outfile,
-                        "    *(uint16_t *)(gen_code_ptr + %d) = 0x9090;\n",
-                        copy_size);
-                copy_size += 2;
-#endif
-            }
-#elif defined(HOST_PPC)
-            {
-#ifdef CONFIG_FORMAT_ELF
-                char name[256];
-                int type;
-                int addend;
-                int reloc_offset;
-                for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-                    if (rel->r_offset >= start_offset &&
-			rel->r_offset < start_offset + copy_size) {
-                        sym_name = strtab + symtab[ELFW(R_SYM)(rel->r_info)].st_name;
-                        reloc_offset = rel->r_offset - start_offset;
-                        if (strstart(sym_name, "__op_jmp", &p)) {
-                            int n;
-                            n = strtol(p, NULL, 10);
-                            /* __op_jmp relocations are done at
-                               runtime to do translated block
-                               chaining: the offset of the instruction
-                               needs to be stored */
-                            fprintf(outfile, "    jmp_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n",
-                                    n, reloc_offset);
-                            continue;
-                        }
-
-                        get_reloc_expr(name, sizeof(name), sym_name);
-                        type = ELF32_R_TYPE(rel->r_info);
-                        addend = rel->r_addend;
-                        switch(type) {
-                        case R_PPC_ADDR32:
-                            fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s + %d;\n",
-                                    reloc_offset, name, addend);
-                            break;
-                        case R_PPC_ADDR16_LO:
-                            fprintf(outfile, "    *(uint16_t *)(gen_code_ptr + %d) = (%s + %d);\n",
-                                    reloc_offset, name, addend);
-                            break;
-                        case R_PPC_ADDR16_HI:
-                            fprintf(outfile, "    *(uint16_t *)(gen_code_ptr + %d) = (%s + %d) >> 16;\n",
-                                    reloc_offset, name, addend);
-                            break;
-                        case R_PPC_ADDR16_HA:
-                            fprintf(outfile, "    *(uint16_t *)(gen_code_ptr + %d) = (%s + %d + 0x8000) >> 16;\n",
-                                    reloc_offset, name, addend);
-                            break;
-                        case R_PPC_REL24:
-                            /* warning: must be at 32 MB distancy */
-                            fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = (*(uint32_t *)(gen_code_ptr + %d) & ~0x03fffffc) | ((%s - (long)(gen_code_ptr + %d) + %d) & 0x03fffffc);\n",
-                                    reloc_offset, reloc_offset, name, reloc_offset, addend);
-                            break;
-                        default:
-                            error("unsupported powerpc relocation (%d)", type);
-                        }
-                    }
-                }
-#elif defined(CONFIG_FORMAT_MACH)
-				struct scattered_relocation_info *scarel;
-				struct relocation_info * rel;
-				char final_sym_name[256];
-				const char *sym_name;
-				const char *p;
-				int slide, sslide;
-				int i;
-
-				for(i = 0, rel = relocs; i < nb_relocs; i++, rel++) {
-					unsigned int offset, length, value = 0;
-					unsigned int type, pcrel, isym = 0;
-					unsigned int usesym = 0;
-
-					if(R_SCATTERED & rel->r_address) {
-						scarel = (struct scattered_relocation_info*)rel;
-						offset = (unsigned int)scarel->r_address;
-						length = scarel->r_length;
-						pcrel = scarel->r_pcrel;
-						type = scarel->r_type;
-						value = scarel->r_value;
-					} else {
-						value = isym = rel->r_symbolnum;
-						usesym = (rel->r_extern);
-						offset = rel->r_address;
-						length = rel->r_length;
-						pcrel = rel->r_pcrel;
-						type = rel->r_type;
-					}
-
-					slide = offset - start_offset;
-
-					if (!(offset >= start_offset && offset < start_offset + size))
-						continue;  /* not in our range */
-
-					sym_name = get_reloc_name(rel, &sslide);
-
-					if(usesym && symtab[isym].n_type & N_STAB)
-						continue; /* don't handle STAB (debug sym) */
-
-					if (sym_name && strstart(sym_name, "__op_jmp", &p)) {
-						int n;
-						n = strtol(p, NULL, 10);
-						fprintf(outfile, "    jmp_offsets[%d] = %d + (gen_code_ptr - gen_code_buf);\n",
-							n, slide);
-						continue; /* Nothing more to do */
-					}
-
-					if(!sym_name)
-					{
-						fprintf(outfile, "/* #warning relocation not handled in %s (value 0x%x, %s, offset 0x%x, length 0x%x, %s, type 0x%x) */\n",
-						           name, value, usesym ? "use sym" : "don't use sym", offset, length, pcrel ? "pcrel":"", type);
-						continue; /* dunno how to handle without final_sym_name */
-					}
-
-                                        get_reloc_expr(final_sym_name, sizeof(final_sym_name),
-                                                       sym_name);
-					switch(type) {
-					case PPC_RELOC_BR24:
-					    if (!strstart(sym_name,"__op_gen_label",&p)) {
-    						fprintf(outfile, "    {\n");
-    						fprintf(outfile, "        uint32_t imm = (uint32_t) & %s;\n", get_rel_sym_name(rel));
-    						fprintf(outfile, "        *(uint32_t *)(gen_code_ptr + %d) = (*(uint32_t *)(gen_code_ptr + %d) & ~0x03fffffc) | ((imm - ((uint32_t)gen_code_ptr + %d)) & 0x03fffffc);\n",
-											slide, slide, slide );
-    						fprintf(outfile, "    }\n");
-    					} else {
-							fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = (*(uint32_t *)(gen_code_ptr + %d) & ~0x03fffffc) | (((long)%s - (long)gen_code_ptr - %d) & 0x03fffffc);\n",
-											slide, slide, final_sym_name, slide);
-    					}
-						break;
-					case PPC_RELOC_HI16:
-						if ( is_reloc_non_lazy(rel) )
-							fprintf(outfile, "    *(uint16_t *)(gen_code_ptr + %d + 2) = ((uint32_t)(void*)&__to_%s + %d) >> 16;\n",
-							slide, sym_name, sslide);
-						else
-							fprintf(outfile, "    *(uint16_t *)(gen_code_ptr + %d + 2) = (%s + %d) >> 16;\n",
-								slide, final_sym_name, sslide);
-						break;
-					case PPC_RELOC_LO16:
-						if ( is_reloc_non_lazy(rel) )
-							fprintf(outfile, "    *(uint16_t *)(gen_code_ptr + %d + 2) = ((uint32_t)(void*)&__to_%s + %d);\n",
-								slide, sym_name, sslide);
-						else
-							fprintf(outfile, "    *(uint16_t *)(gen_code_ptr + %d + 2) = (%s + %d);\n",
-										slide, final_sym_name, sslide);
-                            			break;
-					case PPC_RELOC_HA16:
-						if ( is_reloc_non_lazy(rel) )
-							fprintf(outfile, "    *(uint16_t *)(gen_code_ptr + %d + 2) = ((uint32_t)(void*)&__to_%s + %d + 0x8000) >> 16;\n",
-										slide, sym_name, sslide);
-						else
-							fprintf(outfile, "    *(uint16_t *)(gen_code_ptr + %d + 2) = (%s + %d + 0x8000) >> 16;\n",
-				 						slide, final_sym_name, sslide);
-						break;
-				default:
-					error("unsupported powerpc relocation (%d)", type);
-				}
-			}
-#else
-#error unsupport object format
-#endif
-            }
-#elif defined(HOST_S390)
-            {
-                char name[256];
-                int type;
-                int addend;
-                int reloc_offset;
-                for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-                    if (rel->r_offset >= start_offset &&
-			rel->r_offset < start_offset + copy_size) {
-                        sym_name = strtab + symtab[ELFW(R_SYM)(rel->r_info)].st_name;
-                        get_reloc_expr(name, sizeof(name), sym_name);
-                        type = ELF32_R_TYPE(rel->r_info);
-                        addend = rel->r_addend;
-                        reloc_offset = rel->r_offset - start_offset;
-                        switch(type) {
-                        case R_390_32:
-                            fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s + %d;\n",
-                                    reloc_offset, name, addend);
-                            break;
-                        case R_390_16:
-                            fprintf(outfile, "    *(uint16_t *)(gen_code_ptr + %d) = %s + %d;\n",
-                                    reloc_offset, name, addend);
-                            break;
-                        case R_390_8:
-                            fprintf(outfile, "    *(uint8_t *)(gen_code_ptr + %d) = %s + %d;\n",
-                                    reloc_offset, name, addend);
-                            break;
-                        default:
-                            error("unsupported s390 relocation (%d)", type);
-                        }
-                    }
-                }
-            }
-#elif defined(HOST_ALPHA)
-            {
-                for (i = 0, rel = relocs; i < nb_relocs; i++, rel++) {
-		    if (rel->r_offset >= start_offset && rel->r_offset < start_offset + copy_size) {
-			int type;
-                        long reloc_offset;
-
-			type = ELF64_R_TYPE(rel->r_info);
-			sym_name = strtab + symtab[ELF64_R_SYM(rel->r_info)].st_name;
-                        reloc_offset = rel->r_offset - start_offset;
-			switch (type) {
-			case R_ALPHA_GPDISP:
-			    /* The gp is just 32 bit, and never changes, so it's easiest to emit it
-			       as an immediate instead of constructing it from the pv or ra.  */
-			    fprintf(outfile, "    immediate_ldah(gen_code_ptr + %ld, gp);\n",
-				    reloc_offset);
-			    fprintf(outfile, "    immediate_lda(gen_code_ptr + %ld, gp);\n",
-				    reloc_offset + (int)rel->r_addend);
-			    break;
-			case R_ALPHA_LITUSE:
-			    /* jsr to literal hint. Could be used to optimize to bsr. Ignore for
-			       now, since some called functions (libc) need pv to be set up.  */
-			    break;
-			case R_ALPHA_HINT:
-			    /* Branch target prediction hint. Ignore for now.  Should be already
-			       correct for in-function jumps.  */
-			    break;
-			case R_ALPHA_LITERAL:
-			    /* Load a literal from the GOT relative to the gp.  Since there's only a
-			       single gp, nothing is to be done.  */
-			    break;
-			case R_ALPHA_GPRELHIGH:
-			    /* Handle fake relocations against __op_param symbol.  Need to emit the
-			       high part of the immediate value instead.  Other symbols need no
-			       special treatment.  */
-			    if (strstart(sym_name, "__op_param", &p))
-				fprintf(outfile, "    immediate_ldah(gen_code_ptr + %ld, param%s);\n",
-					reloc_offset, p);
-			    break;
-			case R_ALPHA_GPRELLOW:
-			    if (strstart(sym_name, "__op_param", &p))
-				fprintf(outfile, "    immediate_lda(gen_code_ptr + %ld, param%s);\n",
-					reloc_offset, p);
-			    break;
-			case R_ALPHA_BRSGP:
-			    /* PC-relative jump. Tweak offset to skip the two instructions that try to
-			       set up the gp from the pv.  */
-			    fprintf(outfile, "    fix_bsr(gen_code_ptr + %ld, (uint8_t *) &%s - (gen_code_ptr + %ld + 4) + 8);\n",
-				    reloc_offset, sym_name, reloc_offset);
-			    break;
-			default:
-			    error("unsupported Alpha relocation (%d)", type);
-			}
-		    }
-                }
-            }
-#elif defined(HOST_IA64)
-            {
-		unsigned long sym_idx;
-		long code_offset;
-                char name[256];
-                int type;
-                long addend;
-
-                for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-		    sym_idx = ELF64_R_SYM(rel->r_info);
-                    if (rel->r_offset < start_offset
-			|| rel->r_offset >= start_offset + copy_size)
-			continue;
-		    sym_name = (strtab + symtab[sym_idx].st_name);
-		    code_offset = rel->r_offset - start_offset;
-		    if (strstart(sym_name, "__op_jmp", &p)) {
-			int n;
-			n = strtol(p, NULL, 10);
-			/* __op_jmp relocations are done at
-			   runtime to do translated block
-			   chaining: the offset of the instruction
-			   needs to be stored */
-			fprintf(outfile, "    jmp_offsets[%d] ="
-				"%ld + (gen_code_ptr - gen_code_buf);\n",
-				n, code_offset);
-			continue;
-		    }
-		    get_reloc_expr(name, sizeof(name), sym_name);
-		    type = ELF64_R_TYPE(rel->r_info);
-		    addend = rel->r_addend;
-		    switch(type) {
-		      case R_IA64_IMM64:
-			  fprintf(outfile,
-				  "    ia64_imm64(gen_code_ptr + %ld, "
-				  "%s + %ld);\n",
-				  code_offset, name, addend);
-			  break;
-		      case R_IA64_LTOFF22X:
-		      case R_IA64_LTOFF22:
-			  fprintf(outfile, "    IA64_LTOFF(gen_code_ptr + %ld,"
-				  " %s + %ld, %d);\n",
-				  code_offset, name, addend,
-				  (type == R_IA64_LTOFF22X));
-			  break;
-		      case R_IA64_LDXMOV:
-			  fprintf(outfile,
-				  "    ia64_ldxmov(gen_code_ptr + %ld,"
-				  " %s + %ld);\n", code_offset, name, addend);
-			  break;
-
-		      case R_IA64_PCREL21B:
-			  if (strstart(sym_name, "__op_gen_label", NULL)) {
-			      fprintf(outfile,
-				      "    ia64_imm21b(gen_code_ptr + %ld,"
-				      " (long) (%s + %ld -\n\t\t"
-				      "((long) gen_code_ptr + %ld)) >> 4);\n",
-				      code_offset, name, addend,
-				      code_offset & ~0xfUL);
-			  } else {
-			      fprintf(outfile,
-				      "    IA64_PLT(gen_code_ptr + %ld, "
-				      "%d);\t/* %s + %ld */\n",
-				      code_offset,
-				      get_plt_index(sym_name, addend),
-				      sym_name, addend);
-			  }
-			  break;
-		      default:
-			  error("unsupported ia64 relocation (0x%x)",
-				type);
-		    }
-                }
-		fprintf(outfile, "    ia64_nop_b(gen_code_ptr + %d);\n",
-			copy_size - 16 + 2);
-            }
-#elif defined(HOST_SPARC)
-            {
-                char name[256];
-                int type;
-                int addend;
-                int reloc_offset;
-                for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-                    if (rel->r_offset >= start_offset &&
-			rel->r_offset < start_offset + copy_size) {
-                        sym_name = strtab + symtab[ELF32_R_SYM(rel->r_info)].st_name;
-                        get_reloc_expr(name, sizeof(name), sym_name);
-                        type = ELF32_R_TYPE(rel->r_info);
-                        addend = rel->r_addend;
-                        reloc_offset = rel->r_offset - start_offset;
-                        switch(type) {
-                        case R_SPARC_32:
-                            fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s + %d;\n",
-                                    reloc_offset, name, addend);
-			    break;
-			case R_SPARC_HI22:
-                            fprintf(outfile,
-				    "    *(uint32_t *)(gen_code_ptr + %d) = "
-				    "((*(uint32_t *)(gen_code_ptr + %d)) "
-				    " & ~0x3fffff) "
-				    " | (((%s + %d) >> 10) & 0x3fffff);\n",
-                                    reloc_offset, reloc_offset, name, addend);
-			    break;
-			case R_SPARC_LO10:
-                            fprintf(outfile,
-				    "    *(uint32_t *)(gen_code_ptr + %d) = "
-				    "((*(uint32_t *)(gen_code_ptr + %d)) "
-				    " & ~0x3ff) "
-				    " | ((%s + %d) & 0x3ff);\n",
-                                    reloc_offset, reloc_offset, name, addend);
-			    break;
-			case R_SPARC_WDISP30:
-			    fprintf(outfile,
-				    "    *(uint32_t *)(gen_code_ptr + %d) = "
-				    "((*(uint32_t *)(gen_code_ptr + %d)) "
-				    " & ~0x3fffffff) "
-				    " | ((((%s + %d) - (long)(gen_code_ptr + %d))>>2) "
-				    "    & 0x3fffffff);\n",
-				    reloc_offset, reloc_offset, name, addend,
-				    reloc_offset);
-			    break;
-                        case R_SPARC_WDISP22:
-                            fprintf(outfile,
-                                    "    *(uint32_t *)(gen_code_ptr + %d) = "
-                                    "((*(uint32_t *)(gen_code_ptr + %d)) "
-                                    " & ~0x3fffff) "
-                                    " | ((((%s + %d) - (long)(gen_code_ptr + %d))>>2) "
-                                    "    & 0x3fffff);\n",
-                                    rel->r_offset - start_offset,
-                                    rel->r_offset - start_offset,
-                                    name, addend,
-                                    rel->r_offset - start_offset);
-                            break;
-                        default:
-                            error("unsupported sparc relocation (%d)", type);
-                        }
-                    }
-                }
-            }
-#elif defined(HOST_SPARC64)
-            {
-                char name[256];
-                int type;
-                int addend;
-                int reloc_offset;
-                for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-                    if (rel->r_offset >= start_offset &&
-			rel->r_offset < start_offset + copy_size) {
-                        sym_name = strtab + symtab[ELF64_R_SYM(rel->r_info)].st_name;
-                        get_reloc_expr(name, sizeof(name), sym_name);
-                        type = ELF64_R_TYPE(rel->r_info);
-                        addend = rel->r_addend;
-                        reloc_offset = rel->r_offset - start_offset;
-                        switch(type) {
-                        case R_SPARC_32:
-                            fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s + %d;\n",
-                                    reloc_offset, name, addend);
-			    break;
-			case R_SPARC_HI22:
-                            fprintf(outfile,
-				    "    *(uint32_t *)(gen_code_ptr + %d) = "
-				    "((*(uint32_t *)(gen_code_ptr + %d)) "
-				    " & ~0x3fffff) "
-				    " | (((%s + %d) >> 10) & 0x3fffff);\n",
-                                    reloc_offset, reloc_offset, name, addend);
-			    break;
-			case R_SPARC_LO10:
-                            fprintf(outfile,
-				    "    *(uint32_t *)(gen_code_ptr + %d) = "
-				    "((*(uint32_t *)(gen_code_ptr + %d)) "
-				    " & ~0x3ff) "
-				    " | ((%s + %d) & 0x3ff);\n",
-                                    reloc_offset, reloc_offset, name, addend);
-			    break;
-			case R_SPARC_WDISP30:
-			    fprintf(outfile,
-				    "    *(uint32_t *)(gen_code_ptr + %d) = "
-				    "((*(uint32_t *)(gen_code_ptr + %d)) "
-				    " & ~0x3fffffff) "
-				    " | ((((%s + %d) - (long)(gen_code_ptr + %d))>>2) "
-				    "    & 0x3fffffff);\n",
-				    reloc_offset, reloc_offset, name, addend,
-				    reloc_offset);
-			    break;
-                        default:
-			    error("unsupported sparc64 relocation (%d)", type);
-                        }
-                    }
-                }
-            }
-#elif defined(HOST_ARM)
-            {
-                char name[256];
-                int type;
-                int addend;
-                int reloc_offset;
-
-                arm_emit_ldr_info(name, start_offset, outfile, p_start, p_end,
-                                  relocs, nb_relocs);
-
-                for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-                if (rel->r_offset >= start_offset &&
-		    rel->r_offset < start_offset + copy_size) {
-                    sym_name = strtab + symtab[ELFW(R_SYM)(rel->r_info)].st_name;
-                    /* the compiler leave some unnecessary references to the code */
-                    if (sym_name[0] == '\0')
-                        continue;
-                    get_reloc_expr(name, sizeof(name), sym_name);
-                    type = ELF32_R_TYPE(rel->r_info);
-                    addend = get32((uint32_t *)(text + rel->r_offset));
-                    reloc_offset = rel->r_offset - start_offset;
-                    switch(type) {
-                    case R_ARM_ABS32:
-                        fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s + %d;\n",
-                                reloc_offset, name, addend);
-                        break;
-                    case R_ARM_PC24:
-                        fprintf(outfile, "    arm_reloc_pc24((uint32_t *)(gen_code_ptr + %d), 0x%x, %s);\n",
-                                reloc_offset, addend, name);
-                        break;
-                    default:
-                        error("unsupported arm relocation (%d)", type);
-                    }
-                }
-                }
-            }
-#elif defined(HOST_M68K)
-            {
-                char name[256];
-                int type;
-                int addend;
-                int reloc_offset;
-		Elf32_Sym *sym;
-                for(i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-                if (rel->r_offset >= start_offset &&
-		    rel->r_offset < start_offset + copy_size) {
-		    sym = &(symtab[ELFW(R_SYM)(rel->r_info)]);
-                    sym_name = strtab + symtab[ELFW(R_SYM)(rel->r_info)].st_name;
-                    get_reloc_expr(name, sizeof(name), sym_name);
-                    type = ELF32_R_TYPE(rel->r_info);
-                    addend = get32((uint32_t *)(text + rel->r_offset)) + rel->r_addend;
-                    reloc_offset = rel->r_offset - start_offset;
-                    switch(type) {
-                    case R_68K_32:
-		        fprintf(outfile, "    /* R_68K_32 RELOC, offset %x */\n", rel->r_offset) ;
-                        fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s + %#x;\n",
-                                reloc_offset, name, addend );
-                        break;
-                    case R_68K_PC32:
-		        fprintf(outfile, "    /* R_68K_PC32 RELOC, offset %x */\n", rel->r_offset);
-                        fprintf(outfile, "    *(uint32_t *)(gen_code_ptr + %d) = %s - (long)(gen_code_ptr + %#x) + %#x;\n",
-                                reloc_offset, name, reloc_offset, /*sym->st_value+*/ addend);
-                        break;
-                    default:
-                        error("unsupported m68k relocation (%d)", type);
-                    }
-                }
-                }
-            }
-#else
-#error unsupported CPU
-#endif
-        fprintf(outfile, "    gen_code_ptr += %d;\n", copy_size);
-        fprintf(outfile, "}\n");
-        fprintf(outfile, "break;\n\n");
-    } else {
-        fprintf(outfile, "static inline void gen_%s(", name);
-        if (nb_args == 0) {
-            fprintf(outfile, "void");
-        } else {
-            for(i = 0; i < nb_args; i++) {
-                if (i != 0)
-                    fprintf(outfile, ", ");
-                fprintf(outfile, "long param%d", i + 1);
-            }
-        }
-        fprintf(outfile, ")\n");
-        fprintf(outfile, "{\n");
-        for(i = 0; i < nb_args; i++) {
-            fprintf(outfile, "    *gen_opparam_ptr++ = param%d;\n", i + 1);
-        }
-        fprintf(outfile, "    *gen_opc_ptr++ = INDEX_%s;\n", name);
-        fprintf(outfile, "}\n\n");
-    }
-}
-
-int gen_file(FILE *outfile, int out_type)
-{
-    int i;
-    EXE_SYM *sym;
-
-    if (out_type == OUT_INDEX_OP) {
-        fprintf(outfile, "DEF(end, 0, 0)\n");
-        fprintf(outfile, "DEF(nop, 0, 0)\n");
-        fprintf(outfile, "DEF(nop1, 1, 0)\n");
-        fprintf(outfile, "DEF(nop2, 2, 0)\n");
-        fprintf(outfile, "DEF(nop3, 3, 0)\n");
-        for(i = 0, sym = symtab; i < nb_syms; i++, sym++) {
-            const char *name;
-            name = get_sym_name(sym);
-            if (strstart(name, OP_PREFIX, NULL)) {
-                gen_code(name, sym->st_value, sym->st_size, outfile, 2);
-            }
-        }
-    } else if (out_type == OUT_GEN_OP) {
-        /* generate gen_xxx functions */
-        fprintf(outfile, "#include \"dyngen-op.h\"\n");
-        for(i = 0, sym = symtab; i < nb_syms; i++, sym++) {
-            const char *name;
-            name = get_sym_name(sym);
-            if (strstart(name, OP_PREFIX, NULL)) {
-#if defined(CONFIG_FORMAT_ELF) || defined(CONFIG_FORMAT_COFF)
-                if (sym->st_shndx != text_shndx)
-                    error("invalid section for opcode (0x%x)", sym->st_shndx);
-#endif
-                gen_code(name, sym->st_value, sym->st_size, outfile, 0);
-            }
-        }
-
-    } else {
-        /* generate big code generation switch */
-fprintf(outfile,
-"int dyngen_code(uint8_t *gen_code_buf,\n"
-"                uint16_t *label_offsets, uint16_t *jmp_offsets,\n"
-"                const uint16_t *opc_buf, const uint32_t *opparam_buf, const long *gen_labels)\n"
-"{\n"
-"    uint8_t *gen_code_ptr;\n"
-"    const uint16_t *opc_ptr;\n"
-"    const uint32_t *opparam_ptr;\n");
-
-#ifdef HOST_ARM
-fprintf(outfile,
-"    uint8_t *last_gen_code_ptr = gen_code_buf;\n"
-"    LDREntry *arm_ldr_ptr = arm_ldr_table;\n"
-"    uint32_t *arm_data_ptr = arm_data_table;\n");
-#endif
-
-#if 0 && defined CONFIG_FORMAT_MACH
-    {
-        typedef struct { const char*  name; int  nonlazy; }  SymRef;
-
-        EXE_RELOC*   rel     = relocs;
-        EXE_RELOC*   rel_end = relocs + nb_relocs;
-        SymRef*      symrefs = NULL;
-        int          num_symrefs = 0;
-        int          max_symrefs = 0;
-
-        for ( ; rel < rel_end; rel++ )
-        {
-            const char*  sym_name = get_rel_sym_name(rel);
-            int          nn;
-
-            if(!sym_name)
-                continue;
-
-            if ( !*sym_name ||
-                 strstart(sym_name, "__op_param", NULL) ||
-                 strstart(sym_name, "__op_jmp", NULL)   ||
-                 strstart(sym_name, "__op_gen_label", NULL))
-                continue;
-
-            for (nn = 0; nn < num_symrefs; nn++) {
-                if ( !strcmp( sym_name, symrefs[nn].name ) )
-                    break;
-            }
-
-            if (nn >= num_symrefs)
-            {
-                if (num_symrefs >= max_symrefs) {
-                    int      new_max   = max_symrefs + 16;
-                    SymRef*  new_refs = realloc( symrefs, new_max*sizeof(SymRef) );
-                    if (new_refs == NULL) {
-                        break;
-                    }
-                    symrefs = new_refs;
-                    max_symrefs = new_max;
-                }
-
-                symrefs[nn].name    = sym_name;
-                symrefs[nn].nonlazy = 0;
-
-                fprintf(outfile, "    extern char %s __attribute__((unused));\n", sym_name);
-                num_symrefs++;
-            }
-
-            if ( !symrefs[nn].nonlazy && is_reloc_non_lazy(rel) ) {
-                symrefs[nn].nonlazy = 1;
-                fprintf(outfile, "    static const void* __to_%s = &%s;\n", sym_name, sym_name );
-            }
-        }
-        free( symrefs );
-    }
-#endif
-
-#ifdef HOST_IA64
-    {
-	long addend, not_first = 0;
-	unsigned long sym_idx;
-	int index, max_index;
-	const char *sym_name;
-	EXE_RELOC *rel;
-
-	max_index = -1;
-	for (i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-	    sym_idx = ELF64_R_SYM(rel->r_info);
-	    sym_name = (strtab + symtab[sym_idx].st_name);
-	    if (strstart(sym_name, "__op_gen_label", NULL))
-		continue;
-	    if (ELF64_R_TYPE(rel->r_info) != R_IA64_PCREL21B)
-		continue;
-
-	    addend = rel->r_addend;
-	    index = get_plt_index(sym_name, addend);
-	    if (index <= max_index)
-		continue;
-	    max_index = index;
-	    fprintf(outfile, "    extern void %s(void);\n", sym_name);
-	}
-
-	fprintf(outfile,
-		"    struct ia64_fixup *plt_fixes = NULL, "
-		"*ltoff_fixes = NULL;\n"
-		"    static long plt_target[] = {\n\t");
-
-	max_index = -1;
-	for (i = 0, rel = relocs;i < nb_relocs; i++, rel++) {
-	    sym_idx = ELF64_R_SYM(rel->r_info);
-	    sym_name = (strtab + symtab[sym_idx].st_name);
-	    if (strstart(sym_name, "__op_gen_label", NULL))
-		continue;
-	    if (ELF64_R_TYPE(rel->r_info) != R_IA64_PCREL21B)
-		continue;
-
-	    addend = rel->r_addend;
-	    index = get_plt_index(sym_name, addend);
-	    if (index <= max_index)
-		continue;
-	    max_index = index;
-
-	    if (not_first)
-		fprintf(outfile, ",\n\t");
-	    not_first = 1;
-	    if (addend)
-		fprintf(outfile, "(long) &%s + %ld", sym_name, addend);
-	    else
-		fprintf(outfile, "(long) &%s", sym_name);
-	}
-	fprintf(outfile, "\n    };\n"
-	    "    unsigned int plt_offset[%u] = { 0 };\n", max_index + 1);
-    }
-#endif
-
-fprintf(outfile,
-"\n"
-"    gen_code_ptr = gen_code_buf;\n"
-"    opc_ptr = opc_buf;\n"
-"    opparam_ptr = opparam_buf;\n");
-
-	/* Generate prologue, if needed. */
-
-fprintf(outfile,
-"    for(;;) {\n"
-"        switch(*opc_ptr++) {\n"
-);
-
-        for(i = 0, sym = symtab; i < nb_syms; i++, sym++) {
-            const char *name;
-            name = get_sym_name(sym);
-            if (strstart(name, OP_PREFIX, NULL)) {
-#if 0
-                printf("%4d: %s pos=0x%08x len=%d\n",
-                       i, name, sym->st_value, sym->st_size);
-#endif
-#if defined(CONFIG_FORMAT_ELF) || defined(CONFIG_FORMAT_COFF)
-                if (sym->st_shndx != text_shndx)
-                    error("invalid section for opcode (0x%x)", sym->st_shndx);
-#endif
-                gen_code(name, sym->st_value, sym->st_size, outfile, 1);
-            }
-        }
-
-fprintf(outfile,
-"        case INDEX_op_nop:\n"
-"            break;\n"
-"        case INDEX_op_nop1:\n"
-"            opparam_ptr++;\n"
-"            break;\n"
-"        case INDEX_op_nop2:\n"
-"            opparam_ptr += 2;\n"
-"            break;\n"
-"        case INDEX_op_nop3:\n"
-"            opparam_ptr += 3;\n"
-"            break;\n"
-"        default:\n"
-"            goto the_end;\n"
-"        }\n");
-
-#ifdef HOST_ARM
-/* generate constant table if needed */
-fprintf(outfile,
-"        if ((gen_code_ptr - last_gen_code_ptr) >= (MAX_FRAG_SIZE - MAX_OP_SIZE)) {\n"
-"            gen_code_ptr = arm_flush_ldr(gen_code_ptr, arm_ldr_table, arm_ldr_ptr, arm_data_table, arm_data_ptr, 1);\n"
-"            last_gen_code_ptr = gen_code_ptr;\n"
-"            arm_ldr_ptr = arm_ldr_table;\n"
-"            arm_data_ptr = arm_data_table;\n"
-"        }\n");
-#endif
-
-
-fprintf(outfile,
-"    }\n"
-" the_end:\n"
-);
-#ifdef HOST_IA64
-    fprintf(outfile,
-	    "    {\n"
-	    "      extern char code_gen_buffer[];\n"
-	    "      ia64_apply_fixes(&gen_code_ptr, ltoff_fixes, "
-	    "(uint64_t) code_gen_buffer + 2*(1<<20), plt_fixes,\n\t\t\t"
-	    "sizeof(plt_target)/sizeof(plt_target[0]),\n\t\t\t"
-	    "plt_target, plt_offset);\n    }\n");
-#endif
-
-/* generate some code patching */
-#ifdef HOST_ARM
-fprintf(outfile, "gen_code_ptr = arm_flush_ldr(gen_code_ptr, arm_ldr_table, arm_ldr_ptr, arm_data_table, arm_data_ptr, 0);\n");
-#endif
-    /* flush instruction cache */
-    fprintf(outfile, "flush_icache_range((unsigned long)gen_code_buf, (unsigned long)gen_code_ptr);\n");
-
-    fprintf(outfile, "return gen_code_ptr -  gen_code_buf;\n");
-    fprintf(outfile, "}\n\n");
-
-    }
-
-    return 0;
-}
-
-void usage(void)
-{
-    printf("dyngen (c) 2003 Fabrice Bellard\n"
-           "usage: dyngen [-o outfile] [-c] objfile\n"
-           "Generate a dynamic code generator from an object file\n"
-           "-c     output enum of operations\n"
-           "-g     output gen_op_xx() functions\n"
-           );
-    exit(1);
-}
-
-int main(int argc, char **argv)
-{
-    int c, out_type;
-    const char *filename, *outfilename;
-    FILE *outfile;
-
-    outfilename = "out.c";
-    out_type = OUT_CODE;
-    for(;;) {
-        c = getopt(argc, argv, "ho:cg");
-        if (c == -1)
-            break;
-        switch(c) {
-        case 'h':
-            usage();
-            break;
-        case 'o':
-            outfilename = optarg;
-            break;
-        case 'c':
-            out_type = OUT_INDEX_OP;
-            break;
-        case 'g':
-            out_type = OUT_GEN_OP;
-            break;
-        }
-    }
-    if (optind >= argc)
-        usage();
-    filename = argv[optind];
-    outfile = fopen(outfilename, "w");
-    if (!outfile)
-        error("could not open '%s'", outfilename);
-
-    load_object(filename);
-    gen_file(outfile, out_type);
-    fclose(outfile);
-    return 0;
-}
diff --git a/dynlink.h b/dynlink.h
index c52dae7..f156b37 100644
--- a/dynlink.h
+++ b/dynlink.h
@@ -65,6 +65,9 @@
 #define  DYNLINK_FUNC(ret,name,sig) \
       static ret  (*_dynlink_##name) sig ;
 
+#define  DYNLINK_STR(name)   DYNLINK_STR_(name)
+#define  DYNLINK_STR_(name)  #name
+
 DYNLINK_FUNCTIONS
 #undef DYNLINK_FUNC
 
@@ -81,7 +84,7 @@ DYNLINK_FUNCTIONS_INIT(void*  library)
 {
 #define  DYNLINK_FUNC(ret,name,sig) \
     do { \
-        _dynlink_##name = dlsym( library, STRINGIFY(name) ); \
+        _dynlink_##name = dlsym( library, DYNLINK_STR(name) ); \
         if (_dynlink_##name == NULL) goto Fail; \
     } while (0);
 
diff --git a/elf.h b/elf.h
index 0dc82e7..861f1d3 100644
--- a/elf.h
+++ b/elf.h
@@ -227,6 +227,7 @@ typedef struct {
 
 #define ELF64_R_SYM(i)			((i) >> 32)
 #define ELF64_R_TYPE(i)			((i) & 0xffffffff)
+#define ELF64_R_TYPE_DATA(i)            (((ELF64_R_TYPE(i) >> 8) ^ 0x00800000) - 0x00800000)
 
 #define R_386_NONE	0
 #define R_386_32	1
@@ -326,6 +327,10 @@ typedef struct {
 #define R_SPARC_10		30
 #define R_SPARC_11		31
 #define R_SPARC_64		32
+#define R_SPARC_OLO10           33
+#define R_SPARC_HH22            34
+#define R_SPARC_HM10            35
+#define R_SPARC_LM22            36
 #define R_SPARC_WDISP16		40
 #define R_SPARC_WDISP19		41
 #define R_SPARC_7		43
@@ -500,6 +505,8 @@ typedef struct {
 #define R_ARM_GOTPC		25	/* 32 bit PC relative offset to GOT */
 #define R_ARM_GOT32		26	/* 32 bit GOT entry */
 #define R_ARM_PLT32		27	/* 32 bit PLT address */
+#define R_ARM_CALL              28
+#define R_ARM_JUMP24            29
 #define R_ARM_GNU_VTENTRY	100
 #define R_ARM_GNU_VTINHERIT	101
 #define R_ARM_THM_PC11		102	/* thumb unconditional branch */
@@ -1038,7 +1045,7 @@ typedef struct elf64_phdr {
 #define SHN_COMMON	0xfff2
 #define SHN_HIRESERVE	0xffff
 #define SHN_MIPS_ACCOMON	0xff00
- 
+
 typedef struct elf32_shdr {
   Elf32_Word	sh_name;
   Elf32_Word	sh_type;
@@ -1116,6 +1123,7 @@ typedef struct elf64_note {
   Elf64_Word n_type;	/* Content type */
 } Elf64_Nhdr;
 
+#ifdef ELF_CLASS
 #if ELF_CLASS == ELFCLASS32
 
 #define elfhdr		elf32_hdr
@@ -1123,6 +1131,7 @@ typedef struct elf64_note {
 #define elf_note	elf32_note
 #define elf_shdr	elf32_shdr
 #define elf_sym		elf32_sym
+#define elf_addr_t	Elf32_Off
 
 #ifdef ELF_USES_RELOCA
 # define ELF_RELOC      Elf32_Rela
@@ -1137,6 +1146,7 @@ typedef struct elf64_note {
 #define elf_note	elf64_note
 #define elf_shdr	elf64_shdr
 #define elf_sym		elf64_sym
+#define elf_addr_t	Elf64_Off
 
 #ifdef ELF_USES_RELOCA
 # define ELF_RELOC      Elf64_Rela
@@ -1156,5 +1166,7 @@ typedef struct elf64_note {
 # endif
 #endif
 
+#endif /* ELF_CLASS */
+
 
 #endif /* _QEMU_ELF_H */
diff --git a/elf_ops.h b/elf_ops.h
index 122bf10..6126565 100644
--- a/elf_ops.h
+++ b/elf_ops.h
@@ -49,7 +49,7 @@ static void glue(bswap_sym, SZ)(struct elf_sym *sym)
     bswap16s(&sym->st_shndx);
 }
 
-static struct elf_shdr *glue(find_section, SZ)(struct elf_shdr *shdr_table, 
+static struct elf_shdr *glue(find_section, SZ)(struct elf_shdr *shdr_table,
                                                int n, int type)
 {
     int i;
@@ -71,17 +71,17 @@ static int glue(load_symbols, SZ)(struct elfhdr *ehdr, int fd, int must_swab)
     int nsyms, i;
     char *str = NULL;
 
-    shdr_table = load_at(fd, ehdr->e_shoff, 
+    shdr_table = load_at(fd, ehdr->e_shoff,
                          sizeof(struct elf_shdr) * ehdr->e_shnum);
     if (!shdr_table)
         return -1;
-    
+
     if (must_swab) {
         for (i = 0; i < ehdr->e_shnum; i++) {
             glue(bswap_shdr, SZ)(shdr_table + i);
         }
     }
-        
+
     symtab = glue(find_section, SZ)(shdr_table, ehdr->e_shnum, SHT_SYMTAB);
     if (!symtab)
         goto fail;
@@ -138,13 +138,15 @@ static int glue(load_symbols, SZ)(struct elfhdr *ehdr, int fd, int must_swab)
     return -1;
 }
 
-int glue(load_elf, SZ)(int fd, int64_t virt_to_phys_addend,
-                       int must_swab, uint64_t *pentry)
+static int glue(load_elf, SZ)(int fd, int64_t virt_to_phys_addend,
+                              int must_swab, uint64_t *pentry,
+                              uint64_t *lowaddr, uint64_t *highaddr)
 {
     struct elfhdr ehdr;
     struct elf_phdr *phdr = NULL, *ph;
     int size, i, total_size;
-    elf_word mem_size, addr;
+    elf_word mem_size;
+    uint64_t addr, low = 0, high = 0;
     uint8_t *data = NULL;
 
     if (read(fd, &ehdr, sizeof(ehdr)) != sizeof(ehdr))
@@ -153,8 +155,11 @@ int glue(load_elf, SZ)(int fd, int64_t virt_to_phys_addend,
         glue(bswap_ehdr, SZ)(&ehdr);
     }
 
+    if (ELF_MACHINE != ehdr.e_machine)
+        goto fail;
+
     if (pentry)
-   	*pentry = (uint64_t)ehdr.e_entry;
+   	*pentry = (uint64_t)(elf_sword)ehdr.e_entry;
 
     glue(load_symbols, SZ)(&ehdr, fd, must_swab);
 
@@ -171,7 +176,7 @@ int glue(load_elf, SZ)(int fd, int64_t virt_to_phys_addend,
             glue(bswap_phdr, SZ)(ph);
         }
     }
-    
+
     total_size = 0;
     for(i = 0; i < ehdr.e_phnum; i++) {
         ph = &phdr[i];
@@ -190,16 +195,23 @@ int glue(load_elf, SZ)(int fd, int64_t virt_to_phys_addend,
             cpu_physical_memory_write_rom(addr, data, mem_size);
 
             total_size += mem_size;
+            if (!low || addr < low)
+                low = addr;
+            if (!high || (addr + mem_size) > high)
+                high = addr + mem_size;
 
             qemu_free(data);
             data = NULL;
         }
     }
     qemu_free(phdr);
+    if (lowaddr)
+        *lowaddr = (uint64_t)(elf_sword)low;
+    if (highaddr)
+        *highaddr = (uint64_t)(elf_sword)high;
     return total_size;
  fail:
     qemu_free(data);
     qemu_free(phdr);
     return -1;
 }
-
diff --git a/exec-all.h b/exec-all.h
index 366c972..a223bff 100644
--- a/exec-all.h
+++ b/exec-all.h
@@ -1,6 +1,6 @@
 /*
  * internal execution defines for qemu
- * 
+ *
  *  Copyright (c) 2003 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -21,46 +21,34 @@
 /* allow to see translation results - the slowdown should be negligible, so we leave it */
 #define DEBUG_DISAS
 
-#ifndef glue
-#define xglue(x, y) x ## y
-#define glue(x, y) xglue(x, y)
-#define stringify(s)	tostring(s)
-#define tostring(s)	#s
-#endif
-
-#if __GNUC__ < 3
-#define __builtin_expect(x, n) (x)
-#endif
-
-#ifdef __i386__
-#define REGPARM(n) __attribute((regparm(n)))
-#else
-#define REGPARM(n)
-#endif
-
 /* is_jmp field values */
 #define DISAS_NEXT    0 /* next instruction can be analyzed */
 #define DISAS_JUMP    1 /* only pc was modified dynamically */
 #define DISAS_UPDATE  2 /* cpu state was modified dynamically */
 #define DISAS_TB_JUMP 3 /* only pc was modified statically */
 
-struct TranslationBlock;
+typedef struct TranslationBlock TranslationBlock;
 
 /* XXX: make safe guess about sizes */
-#define MAX_OP_PER_INSTR 32
+#define MAX_OP_PER_INSTR 64
+/* A Call op needs up to 6 + 2N parameters (N = number of arguments).  */
+#define MAX_OPC_PARAM 10
 #define OPC_BUF_SIZE 512
 #define OPC_MAX_SIZE (OPC_BUF_SIZE - MAX_OP_PER_INSTR)
 
-#define OPPARAM_BUF_SIZE (OPC_BUF_SIZE * 3)
+/* Maximum size a TCG op can expand to.  This is complicated because a
+   single op may require several host instructions and regirster reloads.
+   For now take a wild guess at 128 bytes, which should allow at least
+   a couple of fixup instructions per argument.  */
+#define TCG_MAX_OP_SIZE 128
+
+#define OPPARAM_BUF_SIZE (OPC_BUF_SIZE * MAX_OPC_PARAM)
 
-extern uint16_t gen_opc_buf[OPC_BUF_SIZE];
-extern uint32_t gen_opparam_buf[OPPARAM_BUF_SIZE];
-extern long gen_labels[OPC_BUF_SIZE];
-extern int nb_gen_labels;
 extern target_ulong gen_opc_pc[OPC_BUF_SIZE];
 extern target_ulong gen_opc_npc[OPC_BUF_SIZE];
 extern uint8_t gen_opc_cc_op[OPC_BUF_SIZE];
 extern uint8_t gen_opc_instr_start[OPC_BUF_SIZE];
+extern uint16_t gen_opc_icount[OPC_BUF_SIZE];
 extern target_ulong gen_opc_jump_pc[2];
 extern uint32_t gen_opc_hflags[OPC_BUF_SIZE];
 
@@ -68,79 +56,54 @@ typedef void (GenOpFunc)(void);
 typedef void (GenOpFunc1)(long);
 typedef void (GenOpFunc2)(long, long);
 typedef void (GenOpFunc3)(long, long, long);
-                    
-#if defined(TARGET_I386)
-
-void optimize_flags_init(void);
 
-#endif
+#include "qemu-log.h"
 
-extern FILE *logfile;
-extern int loglevel;
+void gen_intermediate_code(CPUState *env, struct TranslationBlock *tb);
+void gen_intermediate_code_pc(CPUState *env, struct TranslationBlock *tb);
+void gen_pc_load(CPUState *env, struct TranslationBlock *tb,
+                 unsigned long searched_pc, int pc_pos, void *puc);
 
-int gen_intermediate_code(CPUState *env, struct TranslationBlock *tb);
-int gen_intermediate_code_pc(CPUState *env, struct TranslationBlock *tb);
-void dump_ops(const uint16_t *opc_buf, const uint32_t *opparam_buf);
+unsigned long code_gen_max_block_size(void);
+void cpu_gen_init(void);
 int cpu_gen_code(CPUState *env, struct TranslationBlock *tb,
-                 int max_code_size, int *gen_code_size_ptr);
-int cpu_restore_state(struct TranslationBlock *tb, 
+                 int *gen_code_size_ptr);
+int cpu_restore_state(struct TranslationBlock *tb,
                       CPUState *env, unsigned long searched_pc,
                       void *puc);
-int cpu_gen_code_copy(CPUState *env, struct TranslationBlock *tb,
-                      int max_code_size, int *gen_code_size_ptr);
-int cpu_restore_state_copy(struct TranslationBlock *tb, 
+int cpu_restore_state_copy(struct TranslationBlock *tb,
                            CPUState *env, unsigned long searched_pc,
                            void *puc);
 void cpu_resume_from_signal(CPUState *env1, void *puc);
+void cpu_io_recompile(CPUState *env, void *retaddr);
+TranslationBlock *tb_gen_code(CPUState *env, 
+                              target_ulong pc, target_ulong cs_base, int flags,
+                              int cflags);
 void cpu_exec_init(CPUState *env);
 int page_unprotect(target_ulong address, unsigned long pc, void *puc);
-void tb_invalidate_phys_page_range(target_ulong start, target_ulong end, 
+void tb_invalidate_phys_page_range(target_phys_addr_t start, target_phys_addr_t end,
                                    int is_cpu_write_access);
 void tb_invalidate_page_range(target_ulong start, target_ulong end);
 void tlb_flush_page(CPUState *env, target_ulong addr);
 void tlb_flush(CPUState *env, int flush_global);
-int tlb_set_page_exec(CPUState *env, target_ulong vaddr, 
-                      target_phys_addr_t paddr, int prot, 
-                      int is_user, int is_softmmu);
-static inline int tlb_set_page(CPUState *env, target_ulong vaddr, 
-                               target_phys_addr_t paddr, int prot, 
-                               int is_user, int is_softmmu)
+int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
+                      target_phys_addr_t paddr, int prot,
+                      int mmu_idx, int is_softmmu);
+static inline int tlb_set_page(CPUState *env1, target_ulong vaddr,
+                               target_phys_addr_t paddr, int prot,
+                               int mmu_idx, int is_softmmu)
 {
     if (prot & PAGE_READ)
         prot |= PAGE_EXEC;
-    return tlb_set_page_exec(env, vaddr, paddr, prot, is_user, is_softmmu);
+    return tlb_set_page_exec(env1, vaddr, paddr, prot, mmu_idx, is_softmmu);
 }
 
-#define CODE_GEN_MAX_SIZE        65536
 #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
 
 #define CODE_GEN_PHYS_HASH_BITS     15
 #define CODE_GEN_PHYS_HASH_SIZE     (1 << CODE_GEN_PHYS_HASH_BITS)
 
-/* maximum total translate dcode allocated */
-
-/* NOTE: the translated code area cannot be too big because on some
-   archs the range of "fast" function calls is limited. Here is a
-   summary of the ranges:
-
-   i386  : signed 32 bits
-   arm   : signed 26 bits
-   ppc   : signed 24 bits
-   sparc : signed 32 bits
-   alpha : signed 23 bits
-*/
-
-#if defined(__alpha__)
-#define CODE_GEN_BUFFER_SIZE     (2 * 1024 * 1024)
-#elif defined(__ia64)
-#define CODE_GEN_BUFFER_SIZE     (4 * 1024 * 1024)	/* range of addl */
-#elif defined(__powerpc__)
-#define CODE_GEN_BUFFER_SIZE     (6 * 1024 * 1024)
-#else
-#define CODE_GEN_BUFFER_SIZE     (16 * 1024 * 1024)
-#endif
-
-//#define CODE_GEN_BUFFER_SIZE     (128 * 1024)
+#define MIN_CODE_GEN_BUFFER_SIZE     (1024 * 1024)
 
 /* estimated block size for TB allocation */
 /* XXX: use a per code average code fragment size and modulate it
@@ -151,34 +114,30 @@ static inline int tlb_set_page(CPUState *env, target_ulong vaddr,
 #define CODE_GEN_AVG_BLOCK_SIZE 64
 #endif
 
-#define CODE_GEN_MAX_BLOCKS    (CODE_GEN_BUFFER_SIZE / CODE_GEN_AVG_BLOCK_SIZE)
-
-#if defined(__powerpc__) 
+#if defined(__powerpc__) || defined(__x86_64__) || defined(__arm__)
 #define USE_DIRECT_JUMP
 #endif
 #if defined(__i386__) && !defined(_WIN32)
 #define USE_DIRECT_JUMP
 #endif
 
-typedef struct TranslationBlock {
+struct TranslationBlock {
     target_ulong pc;   /* simulated PC corresponding to this block (EIP + CS base) */
     target_ulong cs_base; /* CS base for this block */
-    unsigned int flags; /* flags defining in which context the code was generated */
+    uint64_t flags; /* flags defining in which context the code was generated */
     uint16_t size;      /* size of target code for this block (1 <=
                            size <= TARGET_PAGE_SIZE) */
     uint16_t cflags;    /* compile flags */
-#define CF_CODE_COPY   0x0001 /* block was generated in code copy mode */
-#define CF_TB_FP_USED  0x0002 /* fp ops are used in the TB */
-#define CF_FP_USED     0x0004 /* fp ops are used in the TB or in a chained TB */
-#define CF_SINGLE_INSN 0x0008 /* compile only a single instruction */
+#define CF_COUNT_MASK  0x7fff
+#define CF_LAST_IO     0x8000 /* Last insn may be an IO access.  */
 
     uint8_t *tc_ptr;    /* pointer to the translated code */
     /* next matching tb for physical address. */
-    struct TranslationBlock *phys_hash_next; 
+    struct TranslationBlock *phys_hash_next;
     /* first and second physical page containing code. The lower bit
        of the pointer tells the index in page_next[] */
-    struct TranslationBlock *page_next[2]; 
-    target_ulong page_addr[2]; 
+    struct TranslationBlock *page_next[2];
+    target_ulong page_addr[2];
 
     /* the following data are used to directly call another TB from
        the code of this one. */
@@ -186,23 +145,35 @@ typedef struct TranslationBlock {
 #ifdef USE_DIRECT_JUMP
     uint16_t tb_jmp_offset[4]; /* offset of jump instruction */
 #else
-    uint32_t tb_next[2]; /* address of jump generated code */
+    unsigned long tb_next[2]; /* address of jump generated code */
 #endif
     /* list of TBs jumping to this one. This is a circular list using
        the two least significant bits of the pointers to tell what is
        the next pointer: 0 = jmp_next[0], 1 = jmp_next[1], 2 =
        jmp_first */
-    struct TranslationBlock *jmp_next[2]; 
+    struct TranslationBlock *jmp_next[2];
     struct TranslationBlock *jmp_first;
+
 #ifdef CONFIG_TRACE
     struct BBRec *bb_rec;
     uint64_t prev_time;
 #endif
-} TranslationBlock;
+    uint32_t icount;
+};
+
+static inline unsigned int tb_jmp_cache_hash_page(target_ulong pc)
+{
+    target_ulong tmp;
+    tmp = pc ^ (pc >> (TARGET_PAGE_BITS - TB_JMP_PAGE_BITS));
+    return (tmp >> (TARGET_PAGE_BITS - TB_JMP_PAGE_BITS)) & TB_JMP_PAGE_MASK;
+}
 
 static inline unsigned int tb_jmp_cache_hash_func(target_ulong pc)
 {
-    return (pc ^ (pc >> TB_JMP_CACHE_BITS)) & (TB_JMP_CACHE_SIZE - 1);
+    target_ulong tmp;
+    tmp = pc ^ (pc >> (TARGET_PAGE_BITS - TB_JMP_PAGE_BITS));
+    return (((tmp >> (TARGET_PAGE_BITS - TB_JMP_PAGE_BITS)) & TB_JMP_PAGE_MASK)
+	    | (tmp & TB_JMP_ADDR_MASK));
 }
 
 static inline unsigned int tb_phys_hash_func(unsigned long pc)
@@ -211,44 +182,47 @@ static inline unsigned int tb_phys_hash_func(unsigned long pc)
 }
 
 TranslationBlock *tb_alloc(target_ulong pc);
+void tb_free(TranslationBlock *tb);
 void tb_flush(CPUState *env);
-void tb_link_phys(TranslationBlock *tb, 
+void tb_link_phys(TranslationBlock *tb,
                   target_ulong phys_pc, target_ulong phys_page2);
+void tb_phys_invalidate(TranslationBlock *tb, target_ulong page_addr);
 
 extern TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
-
-extern uint8_t code_gen_buffer[CODE_GEN_BUFFER_SIZE];
 extern uint8_t *code_gen_ptr;
+extern int code_gen_max_blocks;
 
 #if defined(USE_DIRECT_JUMP)
 
 #if defined(__powerpc__)
+extern void ppc_tb_set_jmp_target(unsigned long jmp_addr, unsigned long addr);
+#define tb_set_jmp_target1 ppc_tb_set_jmp_target
+#elif defined(__i386__) || defined(__x86_64__)
 static inline void tb_set_jmp_target1(unsigned long jmp_addr, unsigned long addr)
 {
-    uint32_t val, *ptr;
-
     /* patch the branch destination */
-    ptr = (uint32_t *)jmp_addr;
-    val = *ptr;
-    val = (val & ~0x03fffffc) | ((addr - jmp_addr) & 0x03fffffc);
-    *ptr = val;
-    /* flush icache */
-    asm volatile ("dcbst 0,%0" : : "r"(ptr) : "memory");
-    asm volatile ("sync" : : : "memory");
-    asm volatile ("icbi 0,%0" : : "r"(ptr) : "memory");
-    asm volatile ("sync" : : : "memory");
-    asm volatile ("isync" : : : "memory");
+    *(uint32_t *)jmp_addr = addr - (jmp_addr + 4);
+    /* no need to flush icache explicitly */
 }
-#elif defined(__i386__)
+#elif defined(__arm__)
 static inline void tb_set_jmp_target1(unsigned long jmp_addr, unsigned long addr)
 {
-    /* patch the branch destination */
-    *(uint32_t *)jmp_addr = addr - (jmp_addr + 4);
-    /* no need to flush icache explicitely */
+    register unsigned long _beg __asm ("a1");
+    register unsigned long _end __asm ("a2");
+    register unsigned long _flg __asm ("a3");
+
+    /* we could use a ldr pc, [pc, #-4] kind of branch and avoid the flush */
+    *(uint32_t *)jmp_addr |= ((addr - (jmp_addr + 8)) >> 2) & 0xffffff;
+
+    /* flush icache */
+    _beg = jmp_addr;
+    _end = jmp_addr + 4;
+    _flg = 0;
+    __asm __volatile__ ("swi 0x9f0002" : : "r" (_beg), "r" (_end), "r" (_flg));
 }
 #endif
 
-static inline void tb_set_jmp_target(TranslationBlock *tb, 
+static inline void tb_set_jmp_target(TranslationBlock *tb,
                                      int n, unsigned long addr)
 {
     unsigned long offset;
@@ -263,7 +237,7 @@ static inline void tb_set_jmp_target(TranslationBlock *tb,
 #else
 
 /* set the jump target */
-static inline void tb_set_jmp_target(TranslationBlock *tb, 
+static inline void tb_set_jmp_target(TranslationBlock *tb,
                                      int n, unsigned long addr)
 {
     tb->tb_next[n] = addr;
@@ -271,14 +245,14 @@ static inline void tb_set_jmp_target(TranslationBlock *tb,
 
 #endif
 
-static inline void tb_add_jump(TranslationBlock *tb, int n, 
+static inline void tb_add_jump(TranslationBlock *tb, int n,
                                TranslationBlock *tb_next)
 {
     /* NOTE: this test is only needed for thread safety */
     if (!tb->jmp_next[n]) {
         /* patch the native jump address */
         tb_set_jmp_target(tb, n, (unsigned long)tb_next->tc_ptr);
-        
+
         /* add in TB jmp circular list */
         tb->jmp_next[n] = tb_next->jmp_first;
         tb_next->jmp_first = (TranslationBlock *)((long)(tb) | (n));
@@ -287,10 +261,6 @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
 
 TranslationBlock *tb_find_pc(unsigned long pc_ptr);
 
-#ifndef offsetof
-#define offsetof(type, field) ((size_t) &((type *)0)->field)
-#endif
-
 #if defined(_WIN32)
 #define ASM_DATA_SECTION ".section \".data\"\n"
 #define ASM_PREVIOUS_SECTION ".section .text\n"
@@ -305,224 +275,11 @@ TranslationBlock *tb_find_pc(unsigned long pc_ptr);
 #define ASM_OP_LABEL_NAME(n, opname) \
     ASM_NAME(__op_label) #n "." ASM_NAME(opname)
 
-#if defined(__powerpc__)
-
-/* we patch the jump instruction directly */
-#define GOTO_TB(opname, tbparam, n)\
-do {\
-    asm volatile (ASM_DATA_SECTION\
-		  ASM_OP_LABEL_NAME(n, opname) ":\n"\
-		  ".long 1f\n"\
-		  ASM_PREVIOUS_SECTION \
-                  "b " ASM_NAME(__op_jmp) #n "\n"\
-		  "1:\n");\
-} while (0)
-
-#elif defined(__i386__) && defined(USE_DIRECT_JUMP)
-
-/* we patch the jump instruction directly.  Use sti in place of the actual
-   jmp instruction so that dyngen can patch in the correct result.  */
-#if defined(__APPLE__)
-/* XXX Different relocations are generated for MacOS X for Intel
-   (please as from cctools).  */
-#define GOTO_TB(opname, tbparam, n)\
-do {\
-    asm volatile (ASM_DATA_SECTION\
-		  ASM_OP_LABEL_NAME(n, opname) ":\n"\
-		  ".long 1f\n"\
-		  ASM_PREVIOUS_SECTION \
-                  "sti;.long " ASM_NAME(__op_jmp) #n "\n"\
-		  "1:\n");\
-} while (0)
-#else
-#define GOTO_TB(opname, tbparam, n)\
-do {\
-    asm volatile (ASM_DATA_SECTION\
-		  ASM_OP_LABEL_NAME(n, opname) ":\n"\
-		  ".long 1f\n"\
-		  ASM_PREVIOUS_SECTION \
-                  "sti;.long " ASM_NAME(__op_jmp) #n " - 1f\n"\
-		  "1:\n");\
-} while (0)
-#endif
-
-#else
-
-/* jump to next block operations (more portable code, does not need
-   cache flushing, but slower because of indirect jump) */
-#define GOTO_TB(opname, tbparam, n)\
-do {\
-    static void __attribute__((unused)) *dummy ## n = &&dummy_label ## n;\
-    static void __attribute__((unused)) *__op_label ## n \
-        __asm__(ASM_OP_LABEL_NAME(n, opname)) = &&label ## n;\
-    goto *(void *)(((TranslationBlock *)tbparam)->tb_next[n]);\
-label ## n: ;\
-dummy_label ## n: ;\
-} while (0)
-
-#endif
-
 extern CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
 extern CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
 extern void *io_mem_opaque[IO_MEM_NB_ENTRIES];
 
-#ifdef __powerpc__
-static inline int testandset (int *p)
-{
-    int ret;
-    __asm__ __volatile__ (
-                          "0:    lwarx %0,0,%1\n"
-                          "      xor. %0,%3,%0\n"
-                          "      bne 1f\n"
-                          "      stwcx. %2,0,%1\n"
-                          "      bne- 0b\n"
-                          "1:    "
-                          : "=&r" (ret)
-                          : "r" (p), "r" (1), "r" (0)
-                          : "cr0", "memory");
-    return ret;
-}
-#endif
-
-#ifdef __i386__
-static inline int testandset (int *p)
-{
-    long int readval = 0;
-    
-    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
-                          : "+m" (*p), "+a" (readval)
-                          : "r" (1)
-                          : "cc");
-    return readval;
-}
-#endif
-
-#ifdef __x86_64__
-static inline int testandset (int *p)
-{
-    long int readval = 0;
-    
-    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
-                          : "+m" (*p), "+a" (readval)
-                          : "r" (1)
-                          : "cc");
-    return readval;
-}
-#endif
-
-#ifdef __s390__
-static inline int testandset (int *p)
-{
-    int ret;
-
-    __asm__ __volatile__ ("0: cs    %0,%1,0(%2)\n"
-			  "   jl    0b"
-			  : "=&d" (ret)
-			  : "r" (1), "a" (p), "0" (*p) 
-			  : "cc", "memory" );
-    return ret;
-}
-#endif
-
-#ifdef __alpha__
-static inline int testandset (int *p)
-{
-    int ret;
-    unsigned long one;
-
-    __asm__ __volatile__ ("0:	mov 1,%2\n"
-			  "	ldl_l %0,%1\n"
-			  "	stl_c %2,%1\n"
-			  "	beq %2,1f\n"
-			  ".subsection 2\n"
-			  "1:	br 0b\n"
-			  ".previous"
-			  : "=r" (ret), "=m" (*p), "=r" (one)
-			  : "m" (*p));
-    return ret;
-}
-#endif
-
-#ifdef __sparc__
-static inline int testandset (int *p)
-{
-	int ret;
-
-	__asm__ __volatile__("ldstub	[%1], %0"
-			     : "=r" (ret)
-			     : "r" (p)
-			     : "memory");
-
-	return (ret ? 1 : 0);
-}
-#endif
-
-#ifdef __arm__
-static inline int testandset (int *spinlock)
-{
-    register unsigned int ret;
-    __asm__ __volatile__("swp %0, %1, [%2]"
-                         : "=r"(ret)
-                         : "0"(1), "r"(spinlock));
-    
-    return ret;
-}
-#endif
-
-#ifdef __mc68000
-static inline int testandset (int *p)
-{
-    char ret;
-    __asm__ __volatile__("tas %1; sne %0"
-                         : "=r" (ret)
-                         : "m" (p)
-                         : "cc","memory");
-    return ret;
-}
-#endif
-
-#ifdef __ia64
-#include <ia64intrin.h>
-
-static inline int testandset (int *p)
-{
-    return __sync_lock_test_and_set (p, 1);
-}
-#endif
-
-typedef int spinlock_t;
-
-#define SPIN_LOCK_UNLOCKED 0
-
-#if defined(CONFIG_USER_ONLY)
-static inline void spin_lock(spinlock_t *lock)
-{
-    while (testandset(lock));
-}
-
-static inline void spin_unlock(spinlock_t *lock)
-{
-    *lock = 0;
-}
-
-static inline int spin_trylock(spinlock_t *lock)
-{
-    return !testandset(lock);
-}
-#else
-static inline void spin_lock(spinlock_t *lock)
-{
-}
-
-static inline void spin_unlock(spinlock_t *lock)
-{
-}
-
-static inline int spin_trylock(spinlock_t *lock)
-{
-    return 1;
-}
-#endif
+#include "qemu-lock.h"
 
 extern spinlock_t tb_lock;
 
@@ -530,10 +287,12 @@ extern int tb_invalidated_flag;
 
 #if !defined(CONFIG_USER_ONLY)
 
-void tlb_fill(target_ulong addr, int is_write, int is_user, 
+void tlb_fill(target_ulong addr, int is_write, int mmu_idx,
               void *retaddr);
 
-#define ACCESS_TYPE 3
+#include "softmmu_defs.h"
+
+#define ACCESS_TYPE (NB_MMU_MODES + 1)
 #define MEMSUFFIX _code
 #define env cpu_single_env
 
@@ -556,7 +315,7 @@ void tlb_fill(target_ulong addr, int is_write, int is_user,
 #endif
 
 #if defined(CONFIG_USER_ONLY)
-static inline target_ulong get_phys_addr_code(CPUState *env, target_ulong addr)
+static inline target_ulong get_phys_addr_code(CPUState *env1, target_ulong addr)
 {
     return addr;
 }
@@ -564,59 +323,68 @@ static inline target_ulong get_phys_addr_code(CPUState *env, target_ulong addr)
 /* NOTE: this function can trigger an exception */
 /* NOTE2: the returned address is not exactly the physical address: it
    is the offset relative to phys_ram_base */
-static inline target_ulong get_phys_addr_code(CPUState *env, target_ulong addr)
+static inline target_ulong get_phys_addr_code(CPUState *env1, target_ulong addr)
 {
-    int is_user, index, pd;
-
-    index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-#if defined(TARGET_I386)
-    is_user = ((env->hflags & HF_CPL_MASK) == 3);
-#elif defined (TARGET_PPC)
-    is_user = msr_pr;
-#elif defined (TARGET_MIPS)
-    is_user = ((env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM);
-#elif defined (TARGET_SPARC)
-    is_user = (env->psrs == 0);
-#elif defined (TARGET_ARM)
-    is_user = ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR);
-#elif defined (TARGET_SH4)
-    is_user = ((env->sr & SR_MD) == 0);
-#else
-#error unimplemented CPU
-#endif
-    if (__builtin_expect(env->tlb_table[is_user][index].addr_code != 
-                         (addr & TARGET_PAGE_MASK), 0)) {
+    int mmu_idx, page_index, pd;
+
+    page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
+    mmu_idx = cpu_mmu_index(env1);
+    if (unlikely(env1->tlb_table[mmu_idx][page_index].addr_code !=
+                 (addr & TARGET_PAGE_MASK))) {
         ldub_code(addr);
     }
-    pd = env->tlb_table[is_user][index].addr_code & ~TARGET_PAGE_MASK;
+    pd = env1->tlb_table[mmu_idx][page_index].addr_code & ~TARGET_PAGE_MASK;
     if (pd > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
-        cpu_abort(env, "Trying to execute code outside RAM or ROM at 0x%08lx\n", addr);
+#if defined(TARGET_SPARC) || defined(TARGET_MIPS)
+        do_unassigned_access(addr, 0, 1, 0);
+#else
+        cpu_abort(env1, "Trying to execute code outside RAM or ROM at 0x" TARGET_FMT_lx "\n", addr);
+#endif
     }
-    return addr + env->tlb_table[is_user][index].addend - (unsigned long)phys_ram_base;
+    return addr + env1->tlb_table[mmu_idx][page_index].addend - (unsigned long)phys_ram_base;
 }
-#endif
 
+/* Deterministic execution requires that IO only be performed on the last
+   instruction of a TB so that interrupts take effect immediately.  */
+static inline int can_do_io(CPUState *env)
+{
+    if (!use_icount)
+        return 1;
+
+    /* If not executing code then assume we are ok.  */
+    if (!env->current_tb)
+        return 1;
+
+    return env->can_do_io != 0;
+}
+#endif
 
 #ifdef USE_KQEMU
 #define KQEMU_MODIFY_PAGE_MASK (0xff & ~(VGA_DIRTY_FLAG | CODE_DIRTY_FLAG))
 
+#define MSR_QPI_COMMBASE 0xfabe0010
+
 int kqemu_init(CPUState *env);
 int kqemu_cpu_exec(CPUState *env);
 void kqemu_flush_page(CPUState *env, target_ulong addr);
 void kqemu_flush(CPUState *env, int global);
 void kqemu_set_notdirty(CPUState *env, ram_addr_t ram_addr);
 void kqemu_modify_page(CPUState *env, ram_addr_t ram_addr);
+void kqemu_set_phys_mem(uint64_t start_addr, ram_addr_t size, 
+                        ram_addr_t phys_offset);
 void kqemu_cpu_interrupt(CPUState *env);
 void kqemu_record_dump(void);
 
+extern uint32_t kqemu_comm_base;
+
 static inline int kqemu_is_ok(CPUState *env)
 {
     return(env->kqemu_enabled &&
-           (env->cr[0] & CR0_PE_MASK) && 
+           (env->cr[0] & CR0_PE_MASK) &&
            !(env->hflags & HF_INHIBIT_IRQ_MASK) &&
            (env->eflags & IF_MASK) &&
            !(env->eflags & VM_MASK) &&
-           (env->kqemu_enabled == 2 || 
+           (env->kqemu_enabled == 2 ||
             ((env->hflags & HF_CPL_MASK) == 3 &&
              (env->eflags & IOPL_MASK) != IOPL_MASK)));
 }
diff --git a/exec.c b/exec.c
index 88acff0..547801b 100644
--- a/exec.c
+++ b/exec.c
@@ -1,6 +1,6 @@
 /*
  *  virtual page mapping and translated block handling
- * 
+ *
  *  Copyright (c) 2003 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -19,6 +19,7 @@
  */
 #include "config.h"
 #ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 #else
 #include <sys/types.h>
@@ -34,6 +35,9 @@
 
 #include "cpu.h"
 #include "exec-all.h"
+#include "qemu-common.h"
+#include "tcg.h"
+#include "hw/hw.h"
 #if defined(CONFIG_USER_ONLY)
 #include <qemu.h>
 #endif
@@ -41,19 +45,20 @@
 //#define DEBUG_TB_INVALIDATE
 //#define DEBUG_FLUSH
 //#define DEBUG_TLB
+//#define DEBUG_UNASSIGNED
 
 /* make various TB consistency checks */
-//#define DEBUG_TB_CHECK 
-//#define DEBUG_TLB_CHECK 
+//#define DEBUG_TB_CHECK
+//#define DEBUG_TLB_CHECK
+
+//#define DEBUG_IOPORT
+//#define DEBUG_SUBPAGE
 
 #if !defined(CONFIG_USER_ONLY)
 /* TB consistency checks only implemented for usermode emulation.  */
 #undef DEBUG_TB_CHECK
 #endif
 
-/* threshold to flush the translated code buffer */
-#define CODE_GEN_BUFFER_MAX_SIZE (CODE_GEN_BUFFER_SIZE - CODE_GEN_MAX_SIZE)
-
 #define SMC_BITMAP_USE_THRESHOLD 10
 
 #define MMAP_AREA_START        0x00000000
@@ -61,31 +66,67 @@
 
 #if defined(TARGET_SPARC64)
 #define TARGET_PHYS_ADDR_SPACE_BITS 41
+#elif defined(TARGET_SPARC)
+#define TARGET_PHYS_ADDR_SPACE_BITS 36
+#elif defined(TARGET_ALPHA)
+#define TARGET_PHYS_ADDR_SPACE_BITS 42
+#define TARGET_VIRT_ADDR_SPACE_BITS 42
 #elif defined(TARGET_PPC64)
 #define TARGET_PHYS_ADDR_SPACE_BITS 42
+#elif defined(TARGET_X86_64) && !defined(USE_KQEMU)
+#define TARGET_PHYS_ADDR_SPACE_BITS 42
+#elif defined(TARGET_I386) && !defined(USE_KQEMU)
+#define TARGET_PHYS_ADDR_SPACE_BITS 36
 #else
 /* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
 #define TARGET_PHYS_ADDR_SPACE_BITS 32
 #endif
 
-TranslationBlock tbs[CODE_GEN_MAX_BLOCKS];
+TranslationBlock *tbs;
+int code_gen_max_blocks;
 TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
 int nb_tbs;
 /* any access to the tbs or the page table must use this lock */
 spinlock_t tb_lock = SPIN_LOCK_UNLOCKED;
 
-uint8_t code_gen_buffer[CODE_GEN_BUFFER_SIZE] __attribute__((aligned (32)));
+#if defined(__arm__) || defined(__sparc_v9__)
+/* The prologue must be reachable with a direct jump. ARM and Sparc64
+ have limited branch ranges (possibly also PPC) so place it in a
+ section close to code segment. */
+#define code_gen_section                                \
+    __attribute__((__section__(".gen_code")))           \
+    __attribute__((aligned (32)))
+#else
+#define code_gen_section                                \
+    __attribute__((aligned (32)))
+#endif
+
+uint8_t code_gen_prologue[1024] code_gen_section;
+uint8_t *code_gen_buffer;
+unsigned long code_gen_buffer_size;
+/* threshold to flush the translated code buffer */
+unsigned long code_gen_buffer_max_size; 
 uint8_t *code_gen_ptr;
 
-int phys_ram_size;
+#if !defined(CONFIG_USER_ONLY)
+ram_addr_t phys_ram_size;
 int phys_ram_fd;
 uint8_t *phys_ram_base;
 uint8_t *phys_ram_dirty;
+static ram_addr_t phys_ram_alloc_offset = 0;
+#endif
 
 CPUState *first_cpu;
 /* current CPU in the current thread. It is only valid inside
    cpu_exec() */
-CPUState *cpu_single_env; 
+CPUState *cpu_single_env;
+/* 0 = Do not count executed instructions.
+   1 = Precise instruction counting.
+   2 = Adaptive rate instruction counting.  */
+int use_icount = 0;
+/* Current instruction counter.  While executing translated code this may
+   include some instructions that have not yet been executed.  */
+int64_t qemu_icount;
 
 typedef struct PageDesc {
     /* list of TBs intersecting this ram page */
@@ -100,18 +141,24 @@ typedef struct PageDesc {
 } PageDesc;
 
 typedef struct PhysPageDesc {
-    /* offset in host memory of the page + io_index in the low 12 bits */
-    uint32_t phys_offset;
+    /* offset in host memory of the page + io_index in the low bits */
+    ram_addr_t phys_offset;
 } PhysPageDesc;
 
 #define L2_BITS 10
+#if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
+/* XXX: this is a temporary hack for alpha target.
+ *      In the future, this is to be replaced by a multi-level table
+ *      to actually be able to handle the complete 64 bits address space.
+ */
+#define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
+#else
 #define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
+#endif
 
 #define L1_SIZE (1 << L1_BITS)
 #define L2_SIZE (1 << L2_BITS)
 
-static void io_mem_init(void);
-
 unsigned long qemu_real_host_page_size;
 unsigned long qemu_host_page_bits;
 unsigned long qemu_host_page_size;
@@ -121,22 +168,62 @@ unsigned long qemu_host_page_mask;
 static PageDesc *l1_map[L1_SIZE];
 PhysPageDesc **l1_phys_map;
 
+#if !defined(CONFIG_USER_ONLY)
+static void io_mem_init(void);
+
 /* io memory support */
 CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
 CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
 void *io_mem_opaque[IO_MEM_NB_ENTRIES];
 static int io_mem_nb;
+static int io_mem_watch;
+#endif
 
 /* log support */
-char *logfilename = "/tmp/qemu.log";
+const char *logfilename = "/tmp/qemu.log";
 FILE *logfile;
 int loglevel;
+static int log_append = 0;
 
 /* statistics */
 static int tlb_flush_count;
 static int tb_flush_count;
 static int tb_phys_invalidate_count;
 
+#define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
+typedef struct subpage_t {
+    target_phys_addr_t base;
+    CPUReadMemoryFunc **mem_read[TARGET_PAGE_SIZE][4];
+    CPUWriteMemoryFunc **mem_write[TARGET_PAGE_SIZE][4];
+    void *opaque[TARGET_PAGE_SIZE][2][4];
+} subpage_t;
+
+#ifdef _WIN32
+static void map_exec(void *addr, long size)
+{
+    DWORD old_protect;
+    VirtualProtect(addr, size,
+                   PAGE_EXECUTE_READWRITE, &old_protect);
+    
+}
+#else
+static void map_exec(void *addr, long size)
+{
+    unsigned long start, end, page_size;
+    
+    page_size = getpagesize();
+    start = (unsigned long)addr;
+    start &= ~(page_size - 1);
+    
+    end = (unsigned long)addr + size;
+    end += page_size - 1;
+    end &= ~(page_size - 1);
+    
+    mprotect((void *)start, end - start,
+             PROT_READ | PROT_WRITE | PROT_EXEC);
+}
+#endif
+
 static void page_init(void)
 {
     /* NOTE: we can always suppose that qemu_host_page_size >=
@@ -145,30 +232,13 @@ static void page_init(void)
     {
         SYSTEM_INFO system_info;
         DWORD old_protect;
-        
+
         GetSystemInfo(&system_info);
         qemu_real_host_page_size = system_info.dwPageSize;
-        
-        VirtualProtect(code_gen_buffer, sizeof(code_gen_buffer),
-                       PAGE_EXECUTE_READWRITE, &old_protect);
     }
 #else
     qemu_real_host_page_size = getpagesize();
-    {
-        unsigned long start, end;
-
-        start = (unsigned long)code_gen_buffer;
-        start &= ~(qemu_real_host_page_size - 1);
-        
-        end = (unsigned long)code_gen_buffer + sizeof(code_gen_buffer);
-        end += qemu_real_host_page_size - 1;
-        end &= ~(qemu_real_host_page_size - 1);
-        
-        mprotect((void *)start, end - start, 
-                 PROT_READ | PROT_WRITE | PROT_EXEC);
-    }
 #endif
-
     if (qemu_host_page_size == 0)
         qemu_host_page_size = qemu_real_host_page_size;
     if (qemu_host_page_size < TARGET_PAGE_SIZE)
@@ -179,28 +249,86 @@ static void page_init(void)
     qemu_host_page_mask = ~(qemu_host_page_size - 1);
     l1_phys_map = qemu_vmalloc(L1_SIZE * sizeof(void *));
     memset(l1_phys_map, 0, L1_SIZE * sizeof(void *));
+
+#if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
+    {
+        long long startaddr, endaddr;
+        FILE *f;
+        int n;
+
+        mmap_lock();
+        last_brk = (unsigned long)sbrk(0);
+        f = fopen("/proc/self/maps", "r");
+        if (f) {
+            do {
+                n = fscanf (f, "%llx-%llx %*[^\n]\n", &startaddr, &endaddr);
+                if (n == 2) {
+                    startaddr = MIN(startaddr,
+                                    (1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
+                    endaddr = MIN(endaddr,
+                                    (1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
+                    page_set_flags(startaddr & TARGET_PAGE_MASK,
+                                   TARGET_PAGE_ALIGN(endaddr),
+                                   PAGE_RESERVED); 
+                }
+            } while (!feof(f));
+            fclose(f);
+        }
+        mmap_unlock();
+    }
+#endif
+}
+
+static inline PageDesc **page_l1_map(target_ulong index)
+{
+#if TARGET_LONG_BITS > 32
+    /* Host memory outside guest VM.  For 32-bit targets we have already
+       excluded high addresses.  */
+    if (index > ((target_ulong)L2_SIZE * L1_SIZE))
+        return NULL;
+#endif
+    return &l1_map[index >> L2_BITS];
 }
 
-static inline PageDesc *page_find_alloc(unsigned int index)
+static inline PageDesc *page_find_alloc(target_ulong index)
 {
     PageDesc **lp, *p;
+    lp = page_l1_map(index);
+    if (!lp)
+        return NULL;
 
-    lp = &l1_map[index >> L2_BITS];
     p = *lp;
     if (!p) {
         /* allocate if not found */
-        p = qemu_malloc(sizeof(PageDesc) * L2_SIZE);
-        memset(p, 0, sizeof(PageDesc) * L2_SIZE);
+#if defined(CONFIG_USER_ONLY)
+        unsigned long addr;
+        size_t len = sizeof(PageDesc) * L2_SIZE;
+        /* Don't use qemu_malloc because it may recurse.  */
+        p = mmap(0, len, PROT_READ | PROT_WRITE,
+                 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
         *lp = p;
+        addr = h2g(p);
+        if (addr == (target_ulong)addr) {
+            page_set_flags(addr & TARGET_PAGE_MASK,
+                           TARGET_PAGE_ALIGN(addr + len),
+                           PAGE_RESERVED); 
+        }
+#else
+        p = qemu_mallocz(sizeof(PageDesc) * L2_SIZE);
+        *lp = p;
+#endif
     }
     return p + (index & (L2_SIZE - 1));
 }
 
-static inline PageDesc *page_find(unsigned int index)
+static inline PageDesc *page_find(target_ulong index)
 {
-    PageDesc *p;
+    PageDesc **lp, *p;
+    lp = page_l1_map(index);
+    if (!lp)
+        return NULL;
 
-    p = l1_map[index >> L2_BITS];
+    p = *lp;
     if (!p)
         return 0;
     return p + (index & (L2_SIZE - 1));
@@ -250,8 +378,126 @@ static inline PhysPageDesc *phys_page_find(target_phys_addr_t index)
 
 #if !defined(CONFIG_USER_ONLY)
 static void tlb_protect_code(ram_addr_t ram_addr);
-static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr, 
+static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
                                     target_ulong vaddr);
+#define mmap_lock() do { } while(0)
+#define mmap_unlock() do { } while(0)
+#endif
+
+#define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
+
+#if defined(CONFIG_USER_ONLY)
+/* Currently it is not recommanded to allocate big chunks of data in
+   user mode. It will change when a dedicated libc will be used */
+#define USE_STATIC_CODE_GEN_BUFFER
+#endif
+
+#ifdef USE_STATIC_CODE_GEN_BUFFER
+static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE];
+#endif
+
+static void code_gen_alloc(unsigned long tb_size)
+{
+#ifdef USE_STATIC_CODE_GEN_BUFFER
+    code_gen_buffer = static_code_gen_buffer;
+    code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
+    map_exec(code_gen_buffer, code_gen_buffer_size);
+#else
+    code_gen_buffer_size = tb_size;
+    if (code_gen_buffer_size == 0) {
+#if defined(CONFIG_USER_ONLY)
+        /* in user mode, phys_ram_size is not meaningful */
+        code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
+#else
+        /* XXX: needs ajustments */
+        code_gen_buffer_size = (int)(phys_ram_size / 4);
+#endif
+    }
+    if (code_gen_buffer_size < MIN_CODE_GEN_BUFFER_SIZE)
+        code_gen_buffer_size = MIN_CODE_GEN_BUFFER_SIZE;
+    /* The code gen buffer location may have constraints depending on
+       the host cpu and OS */
+#if defined(__linux__) 
+    {
+        int flags;
+        void *start = NULL;
+
+        flags = MAP_PRIVATE | MAP_ANONYMOUS;
+#if defined(__x86_64__)
+        flags |= MAP_32BIT;
+        /* Cannot map more than that */
+        if (code_gen_buffer_size > (800 * 1024 * 1024))
+            code_gen_buffer_size = (800 * 1024 * 1024);
+#elif defined(__sparc_v9__)
+        // Map the buffer below 2G, so we can use direct calls and branches
+        flags |= MAP_FIXED;
+        start = (void *) 0x60000000UL;
+        if (code_gen_buffer_size > (512 * 1024 * 1024))
+            code_gen_buffer_size = (512 * 1024 * 1024);
+#endif
+        code_gen_buffer = mmap(start, code_gen_buffer_size,
+                               PROT_WRITE | PROT_READ | PROT_EXEC,
+                               flags, -1, 0);
+        if (code_gen_buffer == MAP_FAILED) {
+            fprintf(stderr, "Could not allocate dynamic translator buffer\n");
+            exit(1);
+        }
+    }
+#else
+    code_gen_buffer = qemu_malloc(code_gen_buffer_size);
+    if (!code_gen_buffer) {
+        fprintf(stderr, "Could not allocate dynamic translator buffer\n");
+        exit(1);
+    }
+    map_exec(code_gen_buffer, code_gen_buffer_size);
+#endif
+#endif /* !USE_STATIC_CODE_GEN_BUFFER */
+    map_exec(code_gen_prologue, sizeof(code_gen_prologue));
+    code_gen_buffer_max_size = code_gen_buffer_size - 
+        code_gen_max_block_size();
+    code_gen_max_blocks = code_gen_buffer_size / CODE_GEN_AVG_BLOCK_SIZE;
+    tbs = qemu_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
+}
+
+/* Must be called before using the QEMU cpus. 'tb_size' is the size
+   (in bytes) allocated to the translation buffer. Zero means default
+   size. */
+void cpu_exec_init_all(unsigned long tb_size)
+{
+    cpu_gen_init();
+    code_gen_alloc(tb_size);
+    code_gen_ptr = code_gen_buffer;
+    page_init();
+#if !defined(CONFIG_USER_ONLY)
+    io_mem_init();
+#endif
+}
+
+#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
+
+#define CPU_COMMON_SAVE_VERSION 1
+
+static void cpu_common_save(QEMUFile *f, void *opaque)
+{
+    CPUState *env = opaque;
+
+    qemu_put_be32s(f, &env->halted);
+    qemu_put_be32s(f, &env->interrupt_request);
+}
+
+static int cpu_common_load(QEMUFile *f, void *opaque, int version_id)
+{
+    CPUState *env = opaque;
+
+    if (version_id != CPU_COMMON_SAVE_VERSION)
+        return -EINVAL;
+
+    qemu_get_be32s(f, &env->halted);
+    qemu_get_be32s(f, &env->interrupt_request);
+    tlb_flush(env, 1);
+
+    return 0;
+}
 #endif
 
 void cpu_exec_init(CPUState *env)
@@ -259,11 +505,6 @@ void cpu_exec_init(CPUState *env)
     CPUState **penv;
     int cpu_index;
 
-    if (!code_gen_ptr) {
-        code_gen_ptr = code_gen_buffer;
-        page_init();
-        io_mem_init();
-    }
     env->next_cpu = NULL;
     penv = &first_cpu;
     cpu_index = 0;
@@ -272,7 +513,14 @@ void cpu_exec_init(CPUState *env)
         cpu_index++;
     }
     env->cpu_index = cpu_index;
+    env->nb_watchpoints = 0;
     *penv = env;
+#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
+    register_savevm("cpu_common", cpu_index, CPU_COMMON_SAVE_VERSION,
+                    cpu_common_save, cpu_common_load, env);
+    register_savevm("cpu", cpu_index, CPU_SAVE_VERSION,
+                    cpu_save, cpu_load, env);
+#endif
 }
 
 static inline void invalidate_page_bitmap(PageDesc *p)
@@ -308,13 +556,16 @@ void tb_flush(CPUState *env1)
 {
     CPUState *env;
 #if defined(DEBUG_FLUSH)
-    printf("qemu: flush code_size=%d nb_tbs=%d avg_tb_size=%d\n", 
-           code_gen_ptr - code_gen_buffer, 
-           nb_tbs, 
-           nb_tbs > 0 ? (code_gen_ptr - code_gen_buffer) / nb_tbs : 0);
+    printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
+           (unsigned long)(code_gen_ptr - code_gen_buffer),
+           nb_tbs, nb_tbs > 0 ?
+           ((unsigned long)(code_gen_ptr - code_gen_buffer)) / nb_tbs : 0);
 #endif
+    if ((unsigned long)(code_gen_ptr - code_gen_buffer) > code_gen_buffer_size)
+        cpu_abort(env1, "Internal error: code buffer overflow\n");
+
     nb_tbs = 0;
-    
+
     for(env = first_cpu; env != NULL; env = env->next_cpu) {
         memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
     }
@@ -330,7 +581,7 @@ void tb_flush(CPUState *env1)
 
 #ifdef DEBUG_TB_CHECK
 
-static void tb_invalidate_check(unsigned long address)
+static void tb_invalidate_check(target_ulong address)
 {
     TranslationBlock *tb;
     int i;
@@ -351,7 +602,7 @@ static void tb_page_check(void)
 {
     TranslationBlock *tb;
     int i, flags1, flags2;
-    
+
     for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
         for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
             flags1 = page_get_flags(tb->pc);
@@ -453,18 +704,18 @@ static inline void tb_reset_jump(TranslationBlock *tb, int n)
     tb_set_jmp_target(tb, n, (unsigned long)(tb->tc_ptr + tb->tb_next_offset[n]));
 }
 
-static inline void tb_phys_invalidate(TranslationBlock *tb, unsigned int page_addr)
+void tb_phys_invalidate(TranslationBlock *tb, target_ulong page_addr)
 {
     CPUState *env;
     PageDesc *p;
     unsigned int h, n1;
-    target_ulong phys_pc;
+    target_phys_addr_t phys_pc;
     TranslationBlock *tb1, *tb2;
-    
+
     /* remove the TB from the hash list */
     phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
     h = tb_phys_hash_func(phys_pc);
-    tb_remove(&tb_phys_hash[h], tb, 
+    tb_remove(&tb_phys_hash[h], tb,
               offsetof(TranslationBlock, phys_hash_next));
 
     /* remove the TB from the page list */
@@ -540,11 +791,10 @@ static void build_page_bitmap(PageDesc *p)
 {
     int n, tb_start, tb_end;
     TranslationBlock *tb;
-    
-    p->code_bitmap = qemu_malloc(TARGET_PAGE_SIZE / 8);
+
+    p->code_bitmap = qemu_mallocz(TARGET_PAGE_SIZE / 8);
     if (!p->code_bitmap)
         return;
-    memset(p->code_bitmap, 0, TARGET_PAGE_SIZE / 8);
 
     tb = p->first_tb;
     while (tb != NULL) {
@@ -567,11 +817,9 @@ static void build_page_bitmap(PageDesc *p)
     }
 }
 
-#ifdef TARGET_HAS_PRECISE_SMC
-
-static void tb_gen_code(CPUState *env, 
-                        target_ulong pc, target_ulong cs_base, int flags,
-                        int cflags)
+TranslationBlock *tb_gen_code(CPUState *env,
+                              target_ulong pc, target_ulong cs_base,
+                              int flags, int cflags)
 {
     TranslationBlock *tb;
     uint8_t *tc_ptr;
@@ -585,15 +833,21 @@ static void tb_gen_code(CPUState *env,
         tb_flush(env);
         /* cannot fail at this point */
         tb = tb_alloc(pc);
+        /* Don't forget to invalidate previous TB info.  */
+        tb_invalidated_flag = 1;
     }
     tc_ptr = code_gen_ptr;
     tb->tc_ptr = tc_ptr;
     tb->cs_base = cs_base;
     tb->flags = flags;
     tb->cflags = cflags;
-    cpu_gen_code(env, tb, CODE_GEN_MAX_SIZE, &code_gen_size);
+#ifdef CONFIG_TRACE
+    tb->bb_rec = NULL;
+    tb->prev_time = 0;
+#endif
+    cpu_gen_code(env, tb, &code_gen_size);
     code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
-    
+
     /* check next page if needed */
     virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
     phys_page2 = -1;
@@ -601,15 +855,15 @@ static void tb_gen_code(CPUState *env,
         phys_page2 = get_phys_addr_code(env, virt_page2);
     }
     tb_link_phys(tb, phys_pc, phys_page2);
+    return tb;
 }
-#endif
-    
+
 /* invalidate all TBs which intersect with the target physical page
    starting in range [start;end[. NOTE: start and end must refer to
    the same physical page. 'is_cpu_write_access' should be true if called
    from a real cpu write access: the virtual CPU will exit the current
    TB if code is modified inside this TB. */
-void tb_invalidate_phys_page_range(target_ulong start, target_ulong end, 
+void tb_invalidate_phys_page_range(target_phys_addr_t start, target_phys_addr_t end,
                                    int is_cpu_write_access)
 {
     int n, current_tb_modified, current_tb_not_found, current_flags;
@@ -620,9 +874,9 @@ void tb_invalidate_phys_page_range(target_ulong start, target_ulong end,
     target_ulong current_pc, current_cs_base;
 
     p = page_find(start >> TARGET_PAGE_BITS);
-    if (!p) 
+    if (!p)
         return;
-    if (!p->code_bitmap && 
+    if (!p->code_bitmap &&
         ++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD &&
         is_cpu_write_access) {
         /* build code bitmap */
@@ -657,22 +911,22 @@ void tb_invalidate_phys_page_range(target_ulong start, target_ulong end,
             if (current_tb_not_found) {
                 current_tb_not_found = 0;
                 current_tb = NULL;
-                if (env->mem_write_pc) {
+                if (env->mem_io_pc) {
                     /* now we have a real cpu fault */
-                    current_tb = tb_find_pc(env->mem_write_pc);
+                    current_tb = tb_find_pc(env->mem_io_pc);
                 }
             }
             if (current_tb == tb &&
-                !(current_tb->cflags & CF_SINGLE_INSN)) {
+                (current_tb->cflags & CF_COUNT_MASK) != 1) {
                 /* If we are modifying the current TB, we must stop
                 its execution. We could be more precise by checking
                 that the modification is after the current PC, but it
                 would require a specialized function to partially
                 restore the CPU state */
-                
+
                 current_tb_modified = 1;
-                cpu_restore_state(current_tb, env, 
-                                  env->mem_write_pc, NULL);
+                cpu_restore_state(current_tb, env,
+                                  env->mem_io_pc, NULL);
 #if defined(TARGET_I386)
                 current_flags = env->hflags;
                 current_flags |= (env->eflags & (IOPL_MASK | TF_MASK | VM_MASK));
@@ -704,7 +958,7 @@ void tb_invalidate_phys_page_range(target_ulong start, target_ulong end,
     if (!p->first_tb) {
         invalidate_page_bitmap(p);
         if (is_cpu_write_access) {
-            tlb_unprotect_code_phys(env, start, env->mem_write_vaddr);
+            tlb_unprotect_code_phys(env, start, env->mem_io_vaddr);
         }
     }
 #endif
@@ -714,30 +968,29 @@ void tb_invalidate_phys_page_range(target_ulong start, target_ulong end,
            modifying the memory. It will ensure that it cannot modify
            itself */
         env->current_tb = NULL;
-        tb_gen_code(env, current_pc, current_cs_base, current_flags, 
-                    CF_SINGLE_INSN);
+        tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
         cpu_resume_from_signal(env, NULL);
     }
 #endif
 }
 
 /* len must be <= 8 and start must be a multiple of len */
-static inline void tb_invalidate_phys_page_fast(target_ulong start, int len)
+static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
 {
     PageDesc *p;
     int offset, b;
 #if 0
     if (1) {
         if (loglevel) {
-            fprintf(logfile, "modifying code at 0x%x size=%d EIP=%x PC=%08x\n", 
-                   cpu_single_env->mem_write_vaddr, len, 
-                   cpu_single_env->eip, 
+            fprintf(logfile, "modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
+                   cpu_single_env->mem_io_vaddr, len,
+                   cpu_single_env->eip,
                    cpu_single_env->eip + (long)cpu_single_env->segs[R_CS].base);
         }
     }
 #endif
     p = page_find(start >> TARGET_PAGE_BITS);
-    if (!p) 
+    if (!p)
         return;
     if (p->code_bitmap) {
         offset = start & ~TARGET_PAGE_MASK;
@@ -751,7 +1004,7 @@ static inline void tb_invalidate_phys_page_fast(target_ulong start, int len)
 }
 
 #if !defined(CONFIG_SOFTMMU)
-static void tb_invalidate_phys_page(target_ulong addr, 
+static void tb_invalidate_phys_page(target_phys_addr_t addr,
                                     unsigned long pc, void *puc)
 {
     int n, current_flags, current_tb_modified;
@@ -764,7 +1017,7 @@ static void tb_invalidate_phys_page(target_ulong addr,
 
     addr &= TARGET_PAGE_MASK;
     p = page_find(addr >> TARGET_PAGE_BITS);
-    if (!p) 
+    if (!p)
         return;
     tb = p->first_tb;
     current_tb_modified = 0;
@@ -782,13 +1035,13 @@ static void tb_invalidate_phys_page(target_ulong addr,
         tb = (TranslationBlock *)((long)tb & ~3);
 #ifdef TARGET_HAS_PRECISE_SMC
         if (current_tb == tb &&
-            !(current_tb->cflags & CF_SINGLE_INSN)) {
+            (current_tb->cflags & CF_COUNT_MASK) != 1) {
                 /* If we are modifying the current TB, we must stop
                    its execution. We could be more precise by checking
                    that the modification is after the current PC, but it
                    would require a specialized function to partially
                    restore the CPU state */
-            
+
             current_tb_modified = 1;
             cpu_restore_state(current_tb, env, pc, puc);
 #if defined(TARGET_I386)
@@ -811,8 +1064,7 @@ static void tb_invalidate_phys_page(target_ulong addr,
            modifying the memory. It will ensure that it cannot modify
            itself */
         env->current_tb = NULL;
-        tb_gen_code(env, current_pc, current_cs_base, current_flags, 
-                    CF_SINGLE_INSN);
+        tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
         cpu_resume_from_signal(env, puc);
     }
 #endif
@@ -820,7 +1072,7 @@ static void tb_invalidate_phys_page(target_ulong addr,
 #endif
 
 /* add the tb in the target page and protect it if necessary */
-static inline void tb_alloc_page(TranslationBlock *tb, 
+static inline void tb_alloc_page(TranslationBlock *tb,
                                  unsigned int n, target_ulong page_addr)
 {
     PageDesc *p;
@@ -855,10 +1107,10 @@ static inline void tb_alloc_page(TranslationBlock *tb,
             p2->flags &= ~PAGE_WRITE;
             page_get_flags(addr);
           }
-        mprotect(g2h(page_addr), qemu_host_page_size, 
+        mprotect(g2h(page_addr), qemu_host_page_size,
                  (prot & PAGE_BITS) & ~PAGE_WRITE);
 #ifdef DEBUG_TB_INVALIDATE
-        printf("protecting code page: 0x%08lx\n", 
+        printf("protecting code page: 0x" TARGET_FMT_lx "\n",
                page_addr);
 #endif
     }
@@ -880,8 +1132,8 @@ TranslationBlock *tb_alloc(target_ulong pc)
 {
     TranslationBlock *tb;
 
-    if (nb_tbs >= CODE_GEN_MAX_BLOCKS || 
-        (code_gen_ptr - code_gen_buffer) >= CODE_GEN_BUFFER_MAX_SIZE)
+    if (nb_tbs >= code_gen_max_blocks ||
+        (code_gen_ptr - code_gen_buffer) >= code_gen_buffer_max_size)
         return NULL;
     tb = &tbs[nb_tbs++];
     tb->pc = pc;
@@ -889,14 +1141,28 @@ TranslationBlock *tb_alloc(target_ulong pc)
     return tb;
 }
 
+void tb_free(TranslationBlock *tb)
+{
+    /* In practice this is mostly used for single use temporary TB
+       Ignore the hard cases and just back up if this TB happens to
+       be the last one generated.  */
+    if (nb_tbs > 0 && tb == &tbs[nb_tbs - 1]) {
+        code_gen_ptr = tb->tc_ptr;
+        nb_tbs--;
+    }
+}
+
 /* add a new TB and link it to the physical page tables. phys_page2 is
    (-1) to indicate that only one page contains the TB. */
-void tb_link_phys(TranslationBlock *tb, 
+void tb_link_phys(TranslationBlock *tb,
                   target_ulong phys_pc, target_ulong phys_page2)
 {
     unsigned int h;
     TranslationBlock **ptb;
 
+    /* Grab the mmap lock to stop another thread invalidating this TB
+       before we are done.  */
+    mmap_lock();
     /* add in the physical hash table */
     h = tb_phys_hash_func(phys_pc);
     ptb = &tb_phys_hash[h];
@@ -913,11 +1179,6 @@ void tb_link_phys(TranslationBlock *tb,
     tb->jmp_first = (TranslationBlock *)((long)tb | 2);
     tb->jmp_next[0] = NULL;
     tb->jmp_next[1] = NULL;
-#ifdef USE_CODE_COPY
-    tb->cflags &= ~CF_FP_USED;
-    if (tb->cflags & CF_TB_FP_USED)
-        tb->cflags |= CF_FP_USED;
-#endif
 
     /* init original jump addresses */
     if (tb->tb_next_offset[0] != 0xffff)
@@ -928,6 +1189,7 @@ void tb_link_phys(TranslationBlock *tb,
 #ifdef DEBUG_TB_CHECK
     tb_page_check();
 #endif
+    mmap_unlock();
 }
 
 /* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
@@ -957,7 +1219,7 @@ TranslationBlock *tb_find_pc(unsigned long tc_ptr)
         } else {
             m_min = m + 1;
         }
-    } 
+    }
     return &tbs[m_max];
 }
 
@@ -993,7 +1255,7 @@ static inline void tb_reset_jump_recursive2(TranslationBlock *tb, int n)
         }
         *ptb = tb->jmp_next[n];
         tb->jmp_next[n] = NULL;
-        
+
         /* suppress the jump to next tb in generated code */
         tb_reset_jump(tb, n);
 
@@ -1011,7 +1273,8 @@ static void tb_reset_jump_recursive(TranslationBlock *tb)
 #if defined(TARGET_HAS_ICE)
 static void breakpoint_invalidate(CPUState *env, target_ulong pc)
 {
-    target_ulong addr, pd;
+    target_phys_addr_t addr;
+    target_ulong pd;
     ram_addr_t ram_addr;
     PhysPageDesc *p;
 
@@ -1027,13 +1290,62 @@ static void breakpoint_invalidate(CPUState *env, target_ulong pc)
 }
 #endif
 
+/* Add a watchpoint.  */
+int cpu_watchpoint_insert(CPUState *env, target_ulong addr, int type)
+{
+    int i;
+
+    for (i = 0; i < env->nb_watchpoints; i++) {
+        if (addr == env->watchpoint[i].vaddr)
+            return 0;
+    }
+    if (env->nb_watchpoints >= MAX_WATCHPOINTS)
+        return -1;
+
+    i = env->nb_watchpoints++;
+    env->watchpoint[i].vaddr = addr;
+    env->watchpoint[i].type = type;
+    tlb_flush_page(env, addr);
+    /* FIXME: This flush is needed because of the hack to make memory ops
+       terminate the TB.  It can be removed once the proper IO trap and
+       re-execute bits are in.  */
+    tb_flush(env);
+    return i;
+}
+
+/* Remove a watchpoint.  */
+int cpu_watchpoint_remove(CPUState *env, target_ulong addr)
+{
+    int i;
+
+    for (i = 0; i < env->nb_watchpoints; i++) {
+        if (addr == env->watchpoint[i].vaddr) {
+            env->nb_watchpoints--;
+            env->watchpoint[i] = env->watchpoint[env->nb_watchpoints];
+            tlb_flush_page(env, addr);
+            return 0;
+        }
+    }
+    return -1;
+}
+
+/* Remove all watchpoints. */
+void cpu_watchpoint_remove_all(CPUState *env) {
+    int i;
+
+    for (i = 0; i < env->nb_watchpoints; i++) {
+        tlb_flush_page(env, env->watchpoint[i].vaddr);
+    }
+    env->nb_watchpoints = 0;
+}
+
 /* add a breakpoint. EXCP_DEBUG is returned by the CPU loop if a
    breakpoint is reached */
 int cpu_breakpoint_insert(CPUState *env, target_ulong pc)
 {
 #if defined(TARGET_HAS_ICE)
     int i;
-    
+
     for(i = 0; i < env->nb_breakpoints; i++) {
         if (env->breakpoints[i] == pc)
             return 0;
@@ -1042,7 +1354,7 @@ int cpu_breakpoint_insert(CPUState *env, target_ulong pc)
     if (env->nb_breakpoints >= MAX_BREAKPOINTS)
         return -1;
     env->breakpoints[env->nb_breakpoints++] = pc;
-    
+
     breakpoint_invalidate(env, pc);
     return 0;
 #else
@@ -1050,6 +1362,17 @@ int cpu_breakpoint_insert(CPUState *env, target_ulong pc)
 #endif
 }
 
+/* remove all breakpoints */
+void cpu_breakpoint_remove_all(CPUState *env) {
+#if defined(TARGET_HAS_ICE)
+    int i;
+    for(i = 0; i < env->nb_breakpoints; i++) {
+        breakpoint_invalidate(env, env->breakpoints[i]);
+    }
+    env->nb_breakpoints = 0;
+#endif
+}
+
 /* remove a breakpoint */
 int cpu_breakpoint_remove(CPUState *env, target_ulong pc)
 {
@@ -1091,7 +1414,7 @@ void cpu_set_log(int log_flags)
 {
     loglevel = log_flags;
     if (loglevel && !logfile) {
-        logfile = fopen(logfilename, "w");
+        logfile = fopen(logfilename, log_append ? "a" : "w");
         if (!logfile) {
             perror(logfilename);
             _exit(1);
@@ -1105,29 +1428,64 @@ void cpu_set_log(int log_flags)
 #else
         setvbuf(logfile, NULL, _IOLBF, 0);
 #endif
+        log_append = 1;
+    }
+    if (!loglevel && logfile) {
+        fclose(logfile);
+        logfile = NULL;
     }
 }
 
 void cpu_set_log_filename(const char *filename)
 {
     logfilename = strdup(filename);
+    if (logfile) {
+        fclose(logfile);
+        logfile = NULL;
+    }
+    cpu_set_log(loglevel);
 }
 
 /* mask must never be zero, except for A20 change call */
 void cpu_interrupt(CPUState *env, int mask)
 {
+#if !defined(USE_NPTL)
     TranslationBlock *tb;
-    static int interrupt_lock;
+    static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;
+#endif
+    int old_mask;
 
+    old_mask = env->interrupt_request;
+    /* FIXME: This is probably not threadsafe.  A different thread could
+       be in the middle of a read-modify-write operation.  */
     env->interrupt_request |= mask;
-    /* if the cpu is currently executing code, we must unlink it and
-       all the potentially executing TB */
-    tb = env->current_tb;
-    if (tb && !testandset(&interrupt_lock)) {
-        env->current_tb = NULL;
-        tb_reset_jump_recursive(tb);
-        interrupt_lock = 0;
+#if defined(USE_NPTL)
+    /* FIXME: TB unchaining isn't SMP safe.  For now just ignore the
+       problem and hope the cpu will stop of its own accord.  For userspace
+       emulation this often isn't actually as bad as it sounds.  Often
+       signals are used primarily to interrupt blocking syscalls.  */
+#else
+    if (use_icount) {
+        env->icount_decr.u16.high = 0xffff;
+#ifndef CONFIG_USER_ONLY
+        /* CPU_INTERRUPT_EXIT isn't a real interrupt.  It just means
+           an async event happened and we need to process it.  */
+        if (!can_do_io(env)
+            && (mask & ~(old_mask | CPU_INTERRUPT_EXIT)) != 0) {
+            cpu_abort(env, "Raised interrupt while not in I/O function");
+        }
+#endif
+    } else {
+        tb = env->current_tb;
+        /* if the cpu is currently executing code, we must unlink it and
+           all the potentially executing TB */
+        if (tb && !testandset(&interrupt_lock)) {
+            env->current_tb = NULL;
+            tb_reset_jump_recursive(tb);
+            resetlock(&interrupt_lock);
+        }
     }
+#endif
 }
 
 void cpu_reset_interrupt(CPUState *env, int mask)
@@ -1136,22 +1494,24 @@ void cpu_reset_interrupt(CPUState *env, int mask)
 }
 
 CPULogItem cpu_log_items[] = {
-    { CPU_LOG_TB_OUT_ASM, "out_asm", 
+    { CPU_LOG_TB_OUT_ASM, "out_asm",
       "show generated host assembly code for each compiled TB" },
     { CPU_LOG_TB_IN_ASM, "in_asm",
       "show target assembly code for each compiled TB" },
-    { CPU_LOG_TB_OP, "op", 
-      "show micro ops for each compiled TB (only usable if 'in_asm' used)" },
-#ifdef TARGET_I386
+    { CPU_LOG_TB_OP, "op",
+      "show micro ops for each compiled TB" },
     { CPU_LOG_TB_OP_OPT, "op_opt",
-      "show micro ops after optimization for each compiled TB" },
+      "show micro ops "
+#ifdef TARGET_I386
+      "before eflags optimization and "
 #endif
+      "after liveness analysis" },
     { CPU_LOG_INT, "int",
       "show interrupts/exceptions in short format" },
     { CPU_LOG_EXEC, "exec",
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
-      "show CPU state before bloc translation" },
+      "show CPU state before block translation" },
 #ifdef TARGET_I386
     { CPU_LOG_PCALL, "pcall",
       "show protected mode far calls/returns/exceptions" },
@@ -1169,7 +1529,7 @@ static int cmp1(const char *s1, int n, const char *s2)
         return 0;
     return memcmp(s1, s2, n) == 0;
 }
-      
+
 /* takes a comma separated list of log masks. Return 0 if error. */
 int cpu_str_to_log_mask(const char *str)
 {
@@ -1206,8 +1566,10 @@ int cpu_str_to_log_mask(const char *str)
 void cpu_abort(CPUState *env, const char *fmt, ...)
 {
     va_list ap;
+    va_list ap2;
 
     va_start(ap, fmt);
+    va_copy(ap2, ap);
     fprintf(stderr, "qemu: fatal: ");
     vfprintf(stderr, fmt, ap);
     fprintf(stderr, "\n");
@@ -1216,12 +1578,52 @@ void cpu_abort(CPUState *env, const char *fmt, ...)
 #else
     cpu_dump_state(env, stderr, fprintf, 0);
 #endif
+    if (logfile) {
+        fprintf(logfile, "qemu: fatal: ");
+        vfprintf(logfile, fmt, ap2);
+        fprintf(logfile, "\n");
+#ifdef TARGET_I386
+        cpu_dump_state(env, logfile, fprintf, X86_DUMP_FPU | X86_DUMP_CCOP);
+#else
+        cpu_dump_state(env, logfile, fprintf, 0);
+#endif
+        fflush(logfile);
+        fclose(logfile);
+    }
+    va_end(ap2);
     va_end(ap);
     abort();
 }
 
+CPUState *cpu_copy(CPUState *env)
+{
+    CPUState *new_env = cpu_init(env->cpu_model_str);
+    /* preserve chaining and index */
+    CPUState *next_cpu = new_env->next_cpu;
+    int cpu_index = new_env->cpu_index;
+    memcpy(new_env, env, sizeof(CPUState));
+    new_env->next_cpu = next_cpu;
+    new_env->cpu_index = cpu_index;
+    return new_env;
+}
+
 #if !defined(CONFIG_USER_ONLY)
 
+static inline void tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
+{
+    unsigned int i;
+
+    /* Discard jump cache entries for any tb which might potentially
+       overlap the flushed page.  */
+    i = tb_jmp_cache_hash_page(addr - TARGET_PAGE_SIZE);
+    memset (&env->tb_jmp_cache[i], 0, 
+	    TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
+
+    i = tb_jmp_cache_hash_page(addr);
+    memset (&env->tb_jmp_cache[i], 0, 
+	    TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
+}
+
 /* NOTE: if flush_global is true, also flush global entries (not
    implemented yet) */
 void tlb_flush(CPUState *env, int flush_global)
@@ -1242,13 +1644,20 @@ void tlb_flush(CPUState *env, int flush_global)
         env->tlb_table[1][i].addr_read = -1;
         env->tlb_table[1][i].addr_write = -1;
         env->tlb_table[1][i].addr_code = -1;
+#if (NB_MMU_MODES >= 3)
+        env->tlb_table[2][i].addr_read = -1;
+        env->tlb_table[2][i].addr_write = -1;
+        env->tlb_table[2][i].addr_code = -1;
+#if (NB_MMU_MODES == 4)
+        env->tlb_table[3][i].addr_read = -1;
+        env->tlb_table[3][i].addr_write = -1;
+        env->tlb_table[3][i].addr_code = -1;
+#endif
+#endif
     }
 
     memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
 
-#if !defined(CONFIG_SOFTMMU)
-    munmap((void *)MMAP_AREA_START, MMAP_AREA_END - MMAP_AREA_START);
-#endif
 #ifdef USE_KQEMU
     if (env->kqemu_enabled) {
         kqemu_flush(env, flush_global);
@@ -1259,11 +1668,11 @@ void tlb_flush(CPUState *env, int flush_global)
 
 static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
 {
-    if (addr == (tlb_entry->addr_read & 
+    if (addr == (tlb_entry->addr_read &
                  (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
-        addr == (tlb_entry->addr_write & 
+        addr == (tlb_entry->addr_write &
                  (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
-        addr == (tlb_entry->addr_code & 
+        addr == (tlb_entry->addr_code &
                  (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
         tlb_entry->addr_read = -1;
         tlb_entry->addr_write = -1;
@@ -1274,7 +1683,6 @@ static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
 void tlb_flush_page(CPUState *env, target_ulong addr)
 {
     int i;
-    TranslationBlock *tb;
 
 #if defined(DEBUG_TLB)
     printf("tlb_flush_page: " TARGET_FMT_lx "\n", addr);
@@ -1287,20 +1695,15 @@ void tlb_flush_page(CPUState *env, target_ulong addr)
     i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
     tlb_flush_entry(&env->tlb_table[0][i], addr);
     tlb_flush_entry(&env->tlb_table[1][i], addr);
+#if (NB_MMU_MODES >= 3)
+    tlb_flush_entry(&env->tlb_table[2][i], addr);
+#if (NB_MMU_MODES == 4)
+    tlb_flush_entry(&env->tlb_table[3][i], addr);
+#endif
+#endif
 
-    for(i = 0; i < TB_JMP_CACHE_SIZE; i++) {
-        tb = env->tb_jmp_cache[i];
-        if (tb && 
-            ((tb->pc & TARGET_PAGE_MASK) == addr ||
-             ((tb->pc + tb->size - 1) & TARGET_PAGE_MASK) == addr)) {
-            env->tb_jmp_cache[i] = NULL;
-        }
-    }
+    tlb_flush_jmp_cache(env, addr);
 
-#if !defined(CONFIG_SOFTMMU)
-    if (addr < MMAP_AREA_END)
-        munmap((void *)addr, TARGET_PAGE_SIZE);
-#endif
 #ifdef USE_KQEMU
     if (env->kqemu_enabled) {
         kqemu_flush_page(env, addr);
@@ -1312,27 +1715,27 @@ void tlb_flush_page(CPUState *env, target_ulong addr)
    can be detected */
 static void tlb_protect_code(ram_addr_t ram_addr)
 {
-    cpu_physical_memory_reset_dirty(ram_addr, 
+    cpu_physical_memory_reset_dirty(ram_addr,
                                     ram_addr + TARGET_PAGE_SIZE,
                                     CODE_DIRTY_FLAG);
 }
 
 /* update the TLB so that writes in physical page 'phys_addr' are no longer
    tested for self modifying code */
-static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr, 
+static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
                                     target_ulong vaddr)
 {
     phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] |= CODE_DIRTY_FLAG;
 }
 
-static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry, 
+static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
                                          unsigned long start, unsigned long length)
 {
     unsigned long addr;
     if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
         addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
         if ((addr - start) < length) {
-            tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) | IO_MEM_NOTDIRTY;
+            tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) | TLB_NOTDIRTY;
         }
     }
 }
@@ -1377,35 +1780,15 @@ void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
             tlb_reset_dirty_range(&env->tlb_table[0][i], start1, length);
         for(i = 0; i < CPU_TLB_SIZE; i++)
             tlb_reset_dirty_range(&env->tlb_table[1][i], start1, length);
-    }
-
-#if !defined(CONFIG_SOFTMMU)
-    /* XXX: this is expensive */
-    {
-        VirtPageDesc *p;
-        int j;
-        target_ulong addr;
-
-        for(i = 0; i < L1_SIZE; i++) {
-            p = l1_virt_map[i];
-            if (p) {
-                addr = i << (TARGET_PAGE_BITS + L2_BITS);
-                for(j = 0; j < L2_SIZE; j++) {
-                    if (p->valid_tag == virt_valid_tag &&
-                        p->phys_addr >= start && p->phys_addr < end &&
-                        (p->prot & PROT_WRITE)) {
-                        if (addr < MMAP_AREA_END) {
-                            mprotect((void *)addr, TARGET_PAGE_SIZE, 
-                                     p->prot & ~PROT_WRITE);
-                        }
-                    }
-                    addr += TARGET_PAGE_SIZE;
-                    p++;
-                }
-            }
-        }
-    }
+#if (NB_MMU_MODES >= 3)
+        for(i = 0; i < CPU_TLB_SIZE; i++)
+            tlb_reset_dirty_range(&env->tlb_table[2][i], start1, length);
+#if (NB_MMU_MODES == 4)
+        for(i = 0; i < CPU_TLB_SIZE; i++)
+            tlb_reset_dirty_range(&env->tlb_table[3][i], start1, length);
+#endif
 #endif
+    }
 }
 
 static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
@@ -1413,10 +1796,10 @@ static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
     ram_addr_t ram_addr;
 
     if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
-        ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + 
+        ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) +
             tlb_entry->addend - (unsigned long)phys_ram_base;
         if (!cpu_physical_memory_is_dirty(ram_addr)) {
-            tlb_entry->addr_write |= IO_MEM_NOTDIRTY;
+            tlb_entry->addr_write |= TLB_NOTDIRTY;
         }
     }
 }
@@ -1429,48 +1812,58 @@ void cpu_tlb_update_dirty(CPUState *env)
         tlb_update_dirty(&env->tlb_table[0][i]);
     for(i = 0; i < CPU_TLB_SIZE; i++)
         tlb_update_dirty(&env->tlb_table[1][i]);
+#if (NB_MMU_MODES >= 3)
+    for(i = 0; i < CPU_TLB_SIZE; i++)
+        tlb_update_dirty(&env->tlb_table[2][i]);
+#if (NB_MMU_MODES == 4)
+    for(i = 0; i < CPU_TLB_SIZE; i++)
+        tlb_update_dirty(&env->tlb_table[3][i]);
+#endif
+#endif
 }
 
-static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, 
-                                  unsigned long start)
+static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
 {
-    unsigned long addr;
-    if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_NOTDIRTY) {
-        addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
-        if (addr == start) {
-            tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) | IO_MEM_RAM;
-        }
-    }
+    if (tlb_entry->addr_write == (vaddr | TLB_NOTDIRTY))
+        tlb_entry->addr_write = vaddr;
 }
 
-/* update the TLB corresponding to virtual page vaddr and phys addr
-   addr so that it is no longer dirty */
-static inline void tlb_set_dirty(CPUState *env,
-                                 unsigned long addr, target_ulong vaddr)
+/* update the TLB corresponding to virtual page vaddr
+   so that it is no longer dirty */
+static inline void tlb_set_dirty(CPUState *env, target_ulong vaddr)
 {
     int i;
 
-    addr &= TARGET_PAGE_MASK;
+    vaddr &= TARGET_PAGE_MASK;
     i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    tlb_set_dirty1(&env->tlb_table[0][i], addr);
-    tlb_set_dirty1(&env->tlb_table[1][i], addr);
+    tlb_set_dirty1(&env->tlb_table[0][i], vaddr);
+    tlb_set_dirty1(&env->tlb_table[1][i], vaddr);
+#if (NB_MMU_MODES >= 3)
+    tlb_set_dirty1(&env->tlb_table[2][i], vaddr);
+#if (NB_MMU_MODES == 4)
+    tlb_set_dirty1(&env->tlb_table[3][i], vaddr);
+#endif
+#endif
 }
 
 /* add a new TLB entry. At most one entry for a given virtual address
    is permitted. Return 0 if OK or 2 if the page could not be mapped
    (can only happen in non SOFTMMU mode for I/O pages or pages
    conflicting with the host address space). */
-int tlb_set_page_exec(CPUState *env, target_ulong vaddr, 
-                      target_phys_addr_t paddr, int prot, 
-                      int is_user, int is_softmmu)
+int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
+                      target_phys_addr_t paddr, int prot,
+                      int mmu_idx, int is_softmmu)
 {
     PhysPageDesc *p;
     unsigned long pd;
     unsigned int index;
     target_ulong address;
+    target_ulong code_address;
     target_phys_addr_t addend;
     int ret;
     CPUTLBEntry *te;
+    int i;
+    target_phys_addr_t iotlb;
 
     p = phys_page_find(paddr >> TARGET_PAGE_BITS);
     if (!p) {
@@ -1479,141 +1872,78 @@ int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
         pd = p->phys_offset;
     }
 #if defined(DEBUG_TLB)
-    printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x%08x prot=%x u=%d smmu=%d pd=0x%08lx\n",
-           vaddr, (int)paddr, prot, is_user, is_softmmu, pd);
+    printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
+           vaddr, (int)paddr, prot, mmu_idx, is_softmmu, pd);
 #endif
 
     ret = 0;
-#if !defined(CONFIG_SOFTMMU)
-    if (is_softmmu) 
-#endif
-    {
-        if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
-            /* IO memory case */
-            address = vaddr | pd;
-            addend = paddr;
-        } else {
-            /* standard memory */
-            address = vaddr;
-            addend = (unsigned long)phys_ram_base + (pd & TARGET_PAGE_MASK);
-        }
-        
-        index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-        addend -= vaddr;
-        te = &env->tlb_table[is_user][index];
-        te->addend = addend;
-        if (prot & PAGE_READ) {
-            te->addr_read = address;
-        } else {
-            te->addr_read = -1;
-        }
-        if (prot & PAGE_EXEC) {
-            te->addr_code = address;
-        } else {
-            te->addr_code = -1;
-        }
-        if (prot & PAGE_WRITE) {
-            if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_ROM || 
-                (pd & IO_MEM_ROMD)) {
-                /* write access calls the I/O callback */
-                te->addr_write = vaddr | 
-                    (pd & ~(TARGET_PAGE_MASK | IO_MEM_ROMD));
-            } else if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM && 
-                       !cpu_physical_memory_is_dirty(pd)) {
-                te->addr_write = vaddr | IO_MEM_NOTDIRTY;
-            } else {
-                te->addr_write = address;
-            }
-        } else {
-            te->addr_write = -1;
+    address = vaddr;
+    if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
+        /* IO memory case (romd handled later) */
+        address |= TLB_MMIO;
+    }
+    addend = (target_phys_addr_t)phys_ram_base + (pd & TARGET_PAGE_MASK);
+    if ((pd & ~TARGET_PAGE_MASK) <= IO_MEM_ROM) {
+        /* Normal RAM.  */
+        iotlb = pd & TARGET_PAGE_MASK;
+        if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM)
+            iotlb |= IO_MEM_NOTDIRTY;
+        else
+            iotlb |= IO_MEM_ROM;
+    } else {
+        /* IO handlers are currently passed a phsical address.
+           It would be nice to pass an offset from the base address
+           of that region.  This would avoid having to special case RAM,
+           and avoid full address decoding in every device.
+           We can't use the high bits of pd for this because
+           IO_MEM_ROMD uses these as a ram address.  */
+        iotlb = (pd & ~TARGET_PAGE_MASK) + paddr;
+    }
+
+    code_address = address;
+    /* Make accesses to pages with watchpoints go via the
+       watchpoint trap routines.  */
+    for (i = 0; i < env->nb_watchpoints; i++) {
+        if (vaddr == (env->watchpoint[i].vaddr & TARGET_PAGE_MASK)) {
+            iotlb = io_mem_watch + paddr;
+            /* TODO: The memory case can be optimized by not trapping
+               reads of pages with a write breakpoint.  */
+            address |= TLB_MMIO;
         }
     }
-#if !defined(CONFIG_SOFTMMU)
-    else {
-        if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM) {
-            /* IO access: no mapping is done as it will be handled by the
-               soft MMU */
-            if (!(env->hflags & HF_SOFTMMU_MASK))
-                ret = 2;
-        } else {
-            void *map_addr;
 
-            if (vaddr >= MMAP_AREA_END) {
-                ret = 2;
-            } else {
-                if (prot & PROT_WRITE) {
-                    if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_ROM || 
-#if defined(TARGET_HAS_SMC) || 1
-                        first_tb ||
-#endif
-                        ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM && 
-                         !cpu_physical_memory_is_dirty(pd))) {
-                        /* ROM: we do as if code was inside */
-                        /* if code is present, we only map as read only and save the
-                           original mapping */
-                        VirtPageDesc *vp;
-                        
-                        vp = virt_page_find_alloc(vaddr >> TARGET_PAGE_BITS, 1);
-                        vp->phys_addr = pd;
-                        vp->prot = prot;
-                        vp->valid_tag = virt_valid_tag;
-                        prot &= ~PAGE_WRITE;
-                    }
-                }
-                map_addr = mmap((void *)vaddr, TARGET_PAGE_SIZE, prot, 
-                                MAP_SHARED | MAP_FIXED, phys_ram_fd, (pd & TARGET_PAGE_MASK));
-                if (map_addr == MAP_FAILED) {
-                    cpu_abort(env, "mmap failed when mapped physical address 0x%08x to virtual address 0x%08x\n",
-                              paddr, vaddr);
-                }
-            }
+    index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
+    env->iotlb[mmu_idx][index] = iotlb - vaddr;
+    te = &env->tlb_table[mmu_idx][index];
+    te->addend = addend - vaddr;
+    if (prot & PAGE_READ) {
+        te->addr_read = address;
+    } else {
+        te->addr_read = -1;
+    }
+
+    if (prot & PAGE_EXEC) {
+        te->addr_code = code_address;
+    } else {
+        te->addr_code = -1;
+    }
+    if (prot & PAGE_WRITE) {
+        if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_ROM ||
+            (pd & IO_MEM_ROMD)) {
+            /* Write access calls the I/O callback.  */
+            te->addr_write = address | TLB_MMIO;
+        } else if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM &&
+                   !cpu_physical_memory_is_dirty(pd)) {
+            te->addr_write = address | TLB_NOTDIRTY;
+        } else {
+            te->addr_write = address;
         }
+    } else {
+        te->addr_write = -1;
     }
-#endif
     return ret;
 }
 
-/* called from signal handler: invalidate the code and unprotect the
-   page. Return TRUE if the fault was succesfully handled. */
-int page_unprotect(target_ulong addr, unsigned long pc, void *puc)
-{
-#if !defined(CONFIG_SOFTMMU)
-    VirtPageDesc *vp;
-
-#if defined(DEBUG_TLB)
-    printf("page_unprotect: addr=0x%08x\n", addr);
-#endif
-    addr &= TARGET_PAGE_MASK;
-
-    /* if it is not mapped, no need to worry here */
-    if (addr >= MMAP_AREA_END)
-        return 0;
-    vp = virt_page_find(addr >> TARGET_PAGE_BITS);
-    if (!vp)
-        return 0;
-    /* NOTE: in this case, validate_tag is _not_ tested as it
-       validates only the code TLB */
-    if (vp->valid_tag != virt_valid_tag)
-        return 0;
-    if (!(vp->prot & PAGE_WRITE))
-        return 0;
-#if defined(DEBUG_TLB)
-    printf("page_unprotect: addr=0x%08x phys_addr=0x%08x prot=%x\n", 
-           addr, vp->phys_addr, vp->prot);
-#endif
-    if (mprotect((void *)addr, TARGET_PAGE_SIZE, vp->prot) < 0)
-        cpu_abort(cpu_single_env, "error mprotect addr=0x%lx prot=%d\n",
-                  (unsigned long)addr, vp->prot);
-    /* set the dirty bit */
-    phys_ram_dirty[vp->phys_addr >> TARGET_PAGE_BITS] = 0xff;
-    /* flush the code inside */
-    tb_invalidate_phys_page(vp->phys_addr, pc, puc);
-    return 1;
-#else
-    return 0;
-#endif
-}
-
 #else
 
 void tlb_flush(CPUState *env, int flush_global)
@@ -1624,9 +1954,9 @@ void tlb_flush_page(CPUState *env, target_ulong addr)
 {
 }
 
-int tlb_set_page_exec(CPUState *env, target_ulong vaddr, 
-                      target_phys_addr_t paddr, int prot, 
-                      int is_user, int is_softmmu)
+int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
+                      target_phys_addr_t paddr, int prot,
+                      int mmu_idx, int is_softmmu)
 {
     return 0;
 }
@@ -1657,7 +1987,7 @@ void page_dump(FILE *f)
                 end = (i << (32 - L1_BITS)) | (j << TARGET_PAGE_BITS);
                 if (start != -1) {
                     fprintf(f, "%08lx-%08lx %08lx %c%c%c\n",
-                            start, end, end - start, 
+                            start, end, end - start,
                             prot & PAGE_READ ? 'r' : '-',
                             prot & PAGE_WRITE ? 'w' : '-',
                             prot & PAGE_EXEC ? 'x' : '-');
@@ -1692,23 +2022,62 @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
     PageDesc *p;
     target_ulong addr;
 
+    /* mmap_lock should already be held.  */
     start = start & TARGET_PAGE_MASK;
     end = TARGET_PAGE_ALIGN(end);
     if (flags & PAGE_WRITE)
         flags |= PAGE_WRITE_ORG;
-    spin_lock(&tb_lock);
     for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
         p = page_find_alloc(addr >> TARGET_PAGE_BITS);
+        /* We may be called for host regions that are outside guest
+           address space.  */
+        if (!p)
+            return;
         /* if the write protection is set, then we invalidate the code
            inside */
-        if (!(p->flags & PAGE_WRITE) && 
+        if (!(p->flags & PAGE_WRITE) &&
             (flags & PAGE_WRITE) &&
             p->first_tb) {
             tb_invalidate_phys_page(addr, 0, NULL);
         }
         p->flags = flags;
     }
-    spin_unlock(&tb_lock);
+}
+
+int page_check_range(target_ulong start, target_ulong len, int flags)
+{
+    PageDesc *p;
+    target_ulong end;
+    target_ulong addr;
+
+    end = TARGET_PAGE_ALIGN(start+len); /* must do before we loose bits in the next step */
+    start = start & TARGET_PAGE_MASK;
+
+    if( end < start )
+        /* we've wrapped around */
+        return -1;
+    for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
+        p = page_find(addr >> TARGET_PAGE_BITS);
+        if( !p )
+            return -1;
+        if( !(p->flags & PAGE_VALID) )
+            return -1;
+
+        if ((flags & PAGE_READ) && !(p->flags & PAGE_READ))
+            return -1;
+        if (flags & PAGE_WRITE) {
+            if (!(p->flags & PAGE_WRITE_ORG))
+                return -1;
+            /* unprotect the page if it was put read-only because it
+               contains translated code */
+            if (!(p->flags & PAGE_WRITE)) {
+                if (!page_unprotect(addr, 0, NULL))
+                    return -1;
+            }
+            return 0;
+        }
+    }
+    return 0;
 }
 
 /* called from signal handler: invalidate the code and unprotect the
@@ -1719,11 +2088,18 @@ int page_unprotect(target_ulong address, unsigned long pc, void *puc)
     PageDesc *p, *p1;
     target_ulong host_start, host_end, addr;
 
+    /* Technically this isn't safe inside a signal handler.  However we
+       know this only ever happens in a synchronous SEGV handler, so in
+       practice it seems to be ok.  */
+    mmap_lock();
+
     host_start = address & qemu_host_page_mask;
     page_index = host_start >> TARGET_PAGE_BITS;
     p1 = page_find(page_index);
-    if (!p1)
+    if (!p1) {
+        mmap_unlock();
         return 0;
+    }
     host_end = host_start + qemu_host_page_size;
     p = p1;
     prot = 0;
@@ -1736,7 +2112,7 @@ int page_unprotect(target_ulong address, unsigned long pc, void *puc)
     if (prot & PAGE_WRITE_ORG) {
         pindex = (address - host_start) >> TARGET_PAGE_BITS;
         if (!(p1[pindex].flags & PAGE_WRITE)) {
-            mprotect((void *)g2h(host_start), qemu_host_page_size, 
+            mprotect((void *)g2h(host_start), qemu_host_page_size,
                      (prot & PAGE_BITS) | PAGE_WRITE);
             p1[pindex].flags |= PAGE_WRITE;
             /* and since the content will be modified, we must invalidate
@@ -1745,54 +2121,114 @@ int page_unprotect(target_ulong address, unsigned long pc, void *puc)
 #ifdef DEBUG_TB_CHECK
             tb_invalidate_check(address);
 #endif
+            mmap_unlock();
             return 1;
         }
     }
+    mmap_unlock();
     return 0;
 }
 
-/* call this function when system calls directly modify a memory area */
-/* ??? This should be redundant now we have lock_user.  */
-void page_unprotect_range(target_ulong data, target_ulong data_size)
-{
-    target_ulong start, end, addr;
-
-    start = data;
-    end = start + data_size;
-    start &= TARGET_PAGE_MASK;
-    end = TARGET_PAGE_ALIGN(end);
-    for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
-        page_unprotect(addr, 0, NULL);
-    }
-}
-
 static inline void tlb_set_dirty(CPUState *env,
                                  unsigned long addr, target_ulong vaddr)
 {
 }
 #endif /* defined(CONFIG_USER_ONLY) */
 
+#if !defined(CONFIG_USER_ONLY)
+static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
+                             ram_addr_t memory);
+static void *subpage_init (target_phys_addr_t base, ram_addr_t *phys,
+                           ram_addr_t orig_memory);
+#define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
+                      need_subpage)                                     \
+    do {                                                                \
+        if (addr > start_addr)                                          \
+            start_addr2 = 0;                                            \
+        else {                                                          \
+            start_addr2 = start_addr & ~TARGET_PAGE_MASK;               \
+            if (start_addr2 > 0)                                        \
+                need_subpage = 1;                                       \
+        }                                                               \
+                                                                        \
+        if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE)        \
+            end_addr2 = TARGET_PAGE_SIZE - 1;                           \
+        else {                                                          \
+            end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
+            if (end_addr2 < TARGET_PAGE_SIZE - 1)                       \
+                need_subpage = 1;                                       \
+        }                                                               \
+    } while (0)
+
 /* register physical memory. 'size' must be a multiple of the target
    page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
    io memory page */
-void cpu_register_physical_memory(target_phys_addr_t start_addr, 
-                                  unsigned long size,
-                                  unsigned long phys_offset)
+void cpu_register_physical_memory(target_phys_addr_t start_addr,
+                                  ram_addr_t size,
+                                  ram_addr_t phys_offset)
 {
     target_phys_addr_t addr, end_addr;
     PhysPageDesc *p;
     CPUState *env;
+    ram_addr_t orig_size = size;
+    void *subpage;
 
+#ifdef USE_KQEMU
+    /* XXX: should not depend on cpu context */
+    env = first_cpu;
+    if (env->kqemu_enabled) {
+        kqemu_set_phys_mem(start_addr, size, phys_offset);
+    }
+#endif
     size = (size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
-    end_addr = start_addr + size;
+    end_addr = start_addr + (target_phys_addr_t)size;
     for(addr = start_addr; addr != end_addr; addr += TARGET_PAGE_SIZE) {
-        p = phys_page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
-        p->phys_offset = phys_offset;
-        if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM ||
-            (phys_offset & IO_MEM_ROMD))
-            phys_offset += TARGET_PAGE_SIZE;
+        p = phys_page_find(addr >> TARGET_PAGE_BITS);
+        if (p && p->phys_offset != IO_MEM_UNASSIGNED) {
+            ram_addr_t orig_memory = p->phys_offset;
+            target_phys_addr_t start_addr2, end_addr2;
+            int need_subpage = 0;
+
+            CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2,
+                          need_subpage);
+            if (need_subpage || phys_offset & IO_MEM_SUBWIDTH) {
+                if (!(orig_memory & IO_MEM_SUBPAGE)) {
+                    subpage = subpage_init((addr & TARGET_PAGE_MASK),
+                                           &p->phys_offset, orig_memory);
+                } else {
+                    subpage = io_mem_opaque[(orig_memory & ~TARGET_PAGE_MASK)
+                                            >> IO_MEM_SHIFT];
+                }
+                subpage_register(subpage, start_addr2, end_addr2, phys_offset);
+            } else {
+                p->phys_offset = phys_offset;
+                if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM ||
+                    (phys_offset & IO_MEM_ROMD))
+                    phys_offset += TARGET_PAGE_SIZE;
+            }
+        } else {
+            p = phys_page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
+            p->phys_offset = phys_offset;
+            if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM ||
+                (phys_offset & IO_MEM_ROMD))
+                phys_offset += TARGET_PAGE_SIZE;
+            else {
+                target_phys_addr_t start_addr2, end_addr2;
+                int need_subpage = 0;
+
+                CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr,
+                              end_addr2, need_subpage);
+
+                if (need_subpage || phys_offset & IO_MEM_SUBWIDTH) {
+                    subpage = subpage_init((addr & TARGET_PAGE_MASK),
+                                           &p->phys_offset, IO_MEM_UNASSIGNED);
+                    subpage_register(subpage, start_addr2, end_addr2,
+                                     phys_offset);
+                }
+            }
+        }
     }
-    
+
     /* since each CPU stores ram addresses in its TLB cache, we must
        reset the modified entries */
     /* XXX: slow ! */
@@ -1801,13 +2237,58 @@ void cpu_register_physical_memory(target_phys_addr_t start_addr,
     }
 }
 
+/* XXX: temporary until new memory mapping API */
+ram_addr_t cpu_get_physical_page_desc(target_phys_addr_t addr)
+{
+    PhysPageDesc *p;
+
+    p = phys_page_find(addr >> TARGET_PAGE_BITS);
+    if (!p)
+        return IO_MEM_UNASSIGNED;
+    return p->phys_offset;
+}
+
+/* XXX: better than nothing */
+ram_addr_t qemu_ram_alloc(ram_addr_t size)
+{
+    ram_addr_t addr;
+    if ((phys_ram_alloc_offset + size) > phys_ram_size) {
+        fprintf(stderr, "Not enough memory (requested_size = %" PRIu64 ", max memory = %" PRIu64 "\n",
+                (uint64_t)size, (uint64_t)phys_ram_size);
+        abort();
+    }
+    addr = phys_ram_alloc_offset;
+    phys_ram_alloc_offset = TARGET_PAGE_ALIGN(phys_ram_alloc_offset + size);
+    return addr;
+}
+
+void qemu_ram_free(ram_addr_t addr)
+{
+}
+
 static uint32_t unassigned_mem_readb(void *opaque, target_phys_addr_t addr)
 {
+#ifdef DEBUG_UNASSIGNED
+    printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
+#endif
+#ifdef TARGET_SPARC
+    do_unassigned_access(addr, 0, 0, 0);
+#elif defined(TARGET_CRIS)
+    do_unassigned_access(addr, 0, 0, 0);
+#endif
     return 0;
 }
 
 static void unassigned_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
+#ifdef DEBUG_UNASSIGNED
+    printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
+#endif
+#ifdef TARGET_SPARC
+    do_unassigned_access(addr, 1, 0, 0);
+#elif defined(TARGET_CRIS)
+    do_unassigned_access(addr, 1, 0, 0);
+#endif
 }
 
 static CPUReadMemoryFunc *unassigned_mem_read[3] = {
@@ -1822,11 +2303,10 @@ static CPUWriteMemoryFunc *unassigned_mem_write[3] = {
     unassigned_mem_writeb,
 };
 
-static void notdirty_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
+static void notdirty_mem_writeb(void *opaque, target_phys_addr_t ram_addr,
+                                uint32_t val)
 {
-    unsigned long ram_addr;
     int dirty_flags;
-    ram_addr = addr - (unsigned long)phys_ram_base;
     dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
     if (!(dirty_flags & CODE_DIRTY_FLAG)) {
 #if !defined(CONFIG_USER_ONLY)
@@ -1834,7 +2314,7 @@ static void notdirty_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t
         dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
 #endif
     }
-    stb_p((uint8_t *)(long)addr, val);
+    stb_p(phys_ram_base + ram_addr, val);
 #ifdef USE_KQEMU
     if (cpu_single_env->kqemu_enabled &&
         (dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
@@ -1845,14 +2325,13 @@ static void notdirty_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t
     /* we remove the notdirty callback only if the code has been
        flushed */
     if (dirty_flags == 0xff)
-        tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_write_vaddr);
+        tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
 }
 
-static void notdirty_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
+static void notdirty_mem_writew(void *opaque, target_phys_addr_t ram_addr,
+                                uint32_t val)
 {
-    unsigned long ram_addr;
     int dirty_flags;
-    ram_addr = addr - (unsigned long)phys_ram_base;
     dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
     if (!(dirty_flags & CODE_DIRTY_FLAG)) {
 #if !defined(CONFIG_USER_ONLY)
@@ -1860,7 +2339,7 @@ static void notdirty_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t
         dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
 #endif
     }
-    stw_p((uint8_t *)(long)addr, val);
+    stw_p(phys_ram_base + ram_addr, val);
 #ifdef USE_KQEMU
     if (cpu_single_env->kqemu_enabled &&
         (dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
@@ -1871,14 +2350,13 @@ static void notdirty_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t
     /* we remove the notdirty callback only if the code has been
        flushed */
     if (dirty_flags == 0xff)
-        tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_write_vaddr);
+        tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
 }
 
-static void notdirty_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
+static void notdirty_mem_writel(void *opaque, target_phys_addr_t ram_addr,
+                                uint32_t val)
 {
-    unsigned long ram_addr;
     int dirty_flags;
-    ram_addr = addr - (unsigned long)phys_ram_base;
     dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
     if (!(dirty_flags & CODE_DIRTY_FLAG)) {
 #if !defined(CONFIG_USER_ONLY)
@@ -1886,7 +2364,7 @@ static void notdirty_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t
         dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
 #endif
     }
-    stl_p((uint8_t *)(long)addr, val);
+    stl_p(phys_ram_base + ram_addr, val);
 #ifdef USE_KQEMU
     if (cpu_single_env->kqemu_enabled &&
         (dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
@@ -1897,7 +2375,7 @@ static void notdirty_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t
     /* we remove the notdirty callback only if the code has been
        flushed */
     if (dirty_flags == 0xff)
-        tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_write_vaddr);
+        tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
 }
 
 static CPUReadMemoryFunc *error_mem_read[3] = {
@@ -1912,6 +2390,225 @@ static CPUWriteMemoryFunc *notdirty_mem_write[3] = {
     notdirty_mem_writel,
 };
 
+/* Generate a debug exception if a watchpoint has been hit.  */
+static void check_watchpoint(int offset, int flags)
+{
+    CPUState *env = cpu_single_env;
+    target_ulong vaddr;
+    int i;
+
+    vaddr = (env->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
+    for (i = 0; i < env->nb_watchpoints; i++) {
+        if (vaddr == env->watchpoint[i].vaddr
+                && (env->watchpoint[i].type & flags)) {
+            env->watchpoint_hit = i + 1;
+            cpu_interrupt(env, CPU_INTERRUPT_DEBUG);
+            break;
+        }
+    }
+}
+
+/* Watchpoint access routines.  Watchpoints are inserted using TLB tricks,
+   so these check for a hit then pass through to the normal out-of-line
+   phys routines.  */
+static uint32_t watch_mem_readb(void *opaque, target_phys_addr_t addr)
+{
+    check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
+    return ldub_phys(addr);
+}
+
+static uint32_t watch_mem_readw(void *opaque, target_phys_addr_t addr)
+{
+    check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
+    return lduw_phys(addr);
+}
+
+static uint32_t watch_mem_readl(void *opaque, target_phys_addr_t addr)
+{
+    check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
+    return ldl_phys(addr);
+}
+
+static void watch_mem_writeb(void *opaque, target_phys_addr_t addr,
+                             uint32_t val)
+{
+    check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
+    stb_phys(addr, val);
+}
+
+static void watch_mem_writew(void *opaque, target_phys_addr_t addr,
+                             uint32_t val)
+{
+    check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
+    stw_phys(addr, val);
+}
+
+static void watch_mem_writel(void *opaque, target_phys_addr_t addr,
+                             uint32_t val)
+{
+    check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
+    stl_phys(addr, val);
+}
+
+static CPUReadMemoryFunc *watch_mem_read[3] = {
+    watch_mem_readb,
+    watch_mem_readw,
+    watch_mem_readl,
+};
+
+static CPUWriteMemoryFunc *watch_mem_write[3] = {
+    watch_mem_writeb,
+    watch_mem_writew,
+    watch_mem_writel,
+};
+
+static inline uint32_t subpage_readlen (subpage_t *mmio, target_phys_addr_t addr,
+                                 unsigned int len)
+{
+    uint32_t ret;
+    unsigned int idx;
+
+    idx = SUBPAGE_IDX(addr - mmio->base);
+#if defined(DEBUG_SUBPAGE)
+    printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d\n", __func__,
+           mmio, len, addr, idx);
+#endif
+    ret = (**mmio->mem_read[idx][len])(mmio->opaque[idx][0][len], addr);
+
+    return ret;
+}
+
+static inline void subpage_writelen (subpage_t *mmio, target_phys_addr_t addr,
+                              uint32_t value, unsigned int len)
+{
+    unsigned int idx;
+
+    idx = SUBPAGE_IDX(addr - mmio->base);
+#if defined(DEBUG_SUBPAGE)
+    printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d value %08x\n", __func__,
+           mmio, len, addr, idx, value);
+#endif
+    (**mmio->mem_write[idx][len])(mmio->opaque[idx][1][len], addr, value);
+}
+
+static uint32_t subpage_readb (void *opaque, target_phys_addr_t addr)
+{
+#if defined(DEBUG_SUBPAGE)
+    printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
+#endif
+
+    return subpage_readlen(opaque, addr, 0);
+}
+
+static void subpage_writeb (void *opaque, target_phys_addr_t addr,
+                            uint32_t value)
+{
+#if defined(DEBUG_SUBPAGE)
+    printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
+#endif
+    subpage_writelen(opaque, addr, value, 0);
+}
+
+static uint32_t subpage_readw (void *opaque, target_phys_addr_t addr)
+{
+#if defined(DEBUG_SUBPAGE)
+    printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
+#endif
+
+    return subpage_readlen(opaque, addr, 1);
+}
+
+static void subpage_writew (void *opaque, target_phys_addr_t addr,
+                            uint32_t value)
+{
+#if defined(DEBUG_SUBPAGE)
+    printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
+#endif
+    subpage_writelen(opaque, addr, value, 1);
+}
+
+static uint32_t subpage_readl (void *opaque, target_phys_addr_t addr)
+{
+#if defined(DEBUG_SUBPAGE)
+    printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
+#endif
+
+    return subpage_readlen(opaque, addr, 2);
+}
+
+static void subpage_writel (void *opaque,
+                         target_phys_addr_t addr, uint32_t value)
+{
+#if defined(DEBUG_SUBPAGE)
+    printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
+#endif
+    subpage_writelen(opaque, addr, value, 2);
+}
+
+static CPUReadMemoryFunc *subpage_read[] = {
+    &subpage_readb,
+    &subpage_readw,
+    &subpage_readl,
+};
+
+static CPUWriteMemoryFunc *subpage_write[] = {
+    &subpage_writeb,
+    &subpage_writew,
+    &subpage_writel,
+};
+
+static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
+                             ram_addr_t memory)
+{
+    int idx, eidx;
+    unsigned int i;
+
+    if (start >= TARGET_PAGE_SIZE || end >= TARGET_PAGE_SIZE)
+        return -1;
+    idx = SUBPAGE_IDX(start);
+    eidx = SUBPAGE_IDX(end);
+#if defined(DEBUG_SUBPAGE)
+    printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %d\n", __func__,
+           mmio, start, end, idx, eidx, memory);
+#endif
+    memory >>= IO_MEM_SHIFT;
+    for (; idx <= eidx; idx++) {
+        for (i = 0; i < 4; i++) {
+            if (io_mem_read[memory][i]) {
+                mmio->mem_read[idx][i] = &io_mem_read[memory][i];
+                mmio->opaque[idx][0][i] = io_mem_opaque[memory];
+            }
+            if (io_mem_write[memory][i]) {
+                mmio->mem_write[idx][i] = &io_mem_write[memory][i];
+                mmio->opaque[idx][1][i] = io_mem_opaque[memory];
+            }
+        }
+    }
+
+    return 0;
+}
+
+static void *subpage_init (target_phys_addr_t base, ram_addr_t *phys,
+                           ram_addr_t orig_memory)
+{
+    subpage_t *mmio;
+    int subpage_memory;
+
+    mmio = qemu_mallocz(sizeof(subpage_t));
+    if (mmio != NULL) {
+        mmio->base = base;
+        subpage_memory = cpu_register_io_memory(0, subpage_read, subpage_write, mmio);
+#if defined(DEBUG_SUBPAGE)
+        printf("%s: %p base " TARGET_FMT_plx " len %08x %d\n", __func__,
+               mmio, base, TARGET_PAGE_SIZE, subpage_memory);
+#endif
+        *phys = subpage_memory | IO_MEM_SUBPAGE;
+        subpage_register(mmio, 0, TARGET_PAGE_SIZE - 1, orig_memory);
+    }
+
+    return mmio;
+}
+
 static void io_mem_init(void)
 {
     cpu_register_io_memory(IO_MEM_ROM >> IO_MEM_SHIFT, error_mem_read, unassigned_mem_write, NULL);
@@ -1919,6 +2616,8 @@ static void io_mem_init(void)
     cpu_register_io_memory(IO_MEM_NOTDIRTY >> IO_MEM_SHIFT, error_mem_read, notdirty_mem_write, NULL);
     io_mem_nb = 5;
 
+    io_mem_watch = cpu_register_io_memory(0, watch_mem_read,
+                                          watch_mem_write, NULL);
     /* alloc dirty bits array */
     phys_ram_dirty = qemu_vmalloc(phys_ram_size >> TARGET_PAGE_BITS);
     memset(phys_ram_dirty, 0xff, phys_ram_size >> TARGET_PAGE_BITS);
@@ -1926,16 +2625,18 @@ static void io_mem_init(void)
 
 /* mem_read and mem_write are arrays of functions containing the
    function to access byte (index 0), word (index 1) and dword (index
-   2). All functions must be supplied. If io_index is non zero, the
-   corresponding io zone is modified. If it is zero, a new io zone is
-   allocated. The return value can be used with
-   cpu_register_physical_memory(). (-1) is returned if error. */
+   2). Functions can be omitted with a NULL function pointer. The
+   registered functions may be modified dynamically later.
+   If io_index is non zero, the corresponding io zone is
+   modified. If it is zero, a new io zone is allocated. The return
+   value can be used with cpu_register_physical_memory(). (-1) is
+   returned if error. */
 int cpu_register_io_memory(int io_index,
                            CPUReadMemoryFunc **mem_read,
                            CPUWriteMemoryFunc **mem_write,
                            void *opaque)
 {
-    int i;
+    int i, subwidth = 0;
 
     if (io_index <= 0) {
         if (io_mem_nb >= IO_MEM_NB_ENTRIES)
@@ -1947,11 +2648,13 @@ int cpu_register_io_memory(int io_index,
     }
 
     for(i = 0;i < 3; i++) {
+        if (!mem_read[i] || !mem_write[i])
+            subwidth = IO_MEM_SUBWIDTH;
         io_mem_read[io_index][i] = mem_read[i];
         io_mem_write[io_index][i] = mem_write[i];
     }
     io_mem_opaque[io_index] = opaque;
-    return io_index << IO_MEM_SHIFT;
+    return (io_index << IO_MEM_SHIFT) | subwidth;
 }
 
 CPUWriteMemoryFunc **cpu_get_io_memory_write(int io_index)
@@ -1964,9 +2667,11 @@ CPUReadMemoryFunc **cpu_get_io_memory_read(int io_index)
     return io_mem_read[io_index >> IO_MEM_SHIFT];
 }
 
+#endif /* !defined(CONFIG_USER_ONLY) */
+
 /* physical memory access (slow version, mainly for debug) */
 #if defined(CONFIG_USER_ONLY)
-void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf, 
+void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
                             int len, int is_write)
 {
     int l, flags;
@@ -1984,14 +2689,20 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
         if (is_write) {
             if (!(flags & PAGE_WRITE))
                 return;
-            p = lock_user(addr, len, 0);
-            memcpy(p, buf, len);
-            unlock_user(p, addr, len);
+            /* XXX: this code should not depend on lock_user */
+            if (!(p = lock_user(VERIFY_WRITE, addr, l, 0)))
+                /* FIXME - should this return an error rather than just fail? */
+                return;
+            memcpy(p, buf, l);
+            unlock_user(p, addr, l);
         } else {
             if (!(flags & PAGE_READ))
                 return;
-            p = lock_user(addr, len, 1);
-            memcpy(buf, p, len);
+            /* XXX: this code should not depend on lock_user */
+            if (!(p = lock_user(VERIFY_READ, addr, l, 1)))
+                /* FIXME - should this return an error rather than just fail? */
+                return;
+            memcpy(buf, p, l);
             unlock_user(p, addr, 0);
         }
         len -= l;
@@ -2001,7 +2712,7 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
 }
 
 #else
-void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf, 
+void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
                             int len, int is_write)
 {
     int l, io_index;
@@ -2010,7 +2721,7 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
     target_phys_addr_t page;
     unsigned long pd;
     PhysPageDesc *p;
-    
+
     while (len > 0) {
         page = addr & TARGET_PAGE_MASK;
         l = (page + TARGET_PAGE_SIZE) - addr;
@@ -2022,7 +2733,7 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
         } else {
             pd = p->phys_offset;
         }
-        
+
         if (is_write) {
             if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
                 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
@@ -2054,12 +2765,12 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
                     /* invalidate code */
                     tb_invalidate_phys_page_range(addr1, addr1 + l, 0);
                     /* set dirty bit */
-                    phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |= 
+                    phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=
                         (0xff & ~CODE_DIRTY_FLAG);
                 }
             }
         } else {
-            if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && 
+            if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
                 !(pd & IO_MEM_ROMD)) {
                 /* I/O case */
                 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
@@ -2081,7 +2792,7 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
                 }
             } else {
                 /* RAM case */
-                ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) + 
+                ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
                     (addr & ~TARGET_PAGE_MASK);
                 memcpy(buf, ptr, l);
             }
@@ -2093,7 +2804,7 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
 }
 
 /* used for ROM loading : can write in RAM and ROM */
-void cpu_physical_memory_write_rom(target_phys_addr_t addr, 
+void cpu_physical_memory_write_rom(target_phys_addr_t addr,
                                    const uint8_t *buf, int len)
 {
     int l;
@@ -2101,7 +2812,7 @@ void cpu_physical_memory_write_rom(target_phys_addr_t addr,
     target_phys_addr_t page;
     unsigned long pd;
     PhysPageDesc *p;
-    
+
     while (len > 0) {
         page = addr & TARGET_PAGE_MASK;
         l = (page + TARGET_PAGE_SIZE) - addr;
@@ -2113,7 +2824,7 @@ void cpu_physical_memory_write_rom(target_phys_addr_t addr,
         } else {
             pd = p->phys_offset;
         }
-        
+
         if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM &&
             (pd & ~TARGET_PAGE_MASK) != IO_MEM_ROM &&
             !(pd & IO_MEM_ROMD)) {
@@ -2147,15 +2858,15 @@ uint32_t ldl_phys(target_phys_addr_t addr)
     } else {
         pd = p->phys_offset;
     }
-        
-    if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && 
+
+    if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
         !(pd & IO_MEM_ROMD)) {
         /* I/O case */
         io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
         val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
     } else {
         /* RAM case */
-        ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) + 
+        ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
             (addr & ~TARGET_PAGE_MASK);
         val = ldl_p(ptr);
     }
@@ -2177,7 +2888,7 @@ uint64_t ldq_phys(target_phys_addr_t addr)
     } else {
         pd = p->phys_offset;
     }
-        
+
     if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
         !(pd & IO_MEM_ROMD)) {
         /* I/O case */
@@ -2191,7 +2902,7 @@ uint64_t ldq_phys(target_phys_addr_t addr)
 #endif
     } else {
         /* RAM case */
-        ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) + 
+        ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
             (addr & ~TARGET_PAGE_MASK);
         val = ldq_p(ptr);
     }
@@ -2230,17 +2941,47 @@ void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val)
     } else {
         pd = p->phys_offset;
     }
-        
+
     if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
         io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
         io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
     } else {
-        ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) + 
+        ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
             (addr & ~TARGET_PAGE_MASK);
         stl_p(ptr, val);
     }
 }
 
+void stq_phys_notdirty(target_phys_addr_t addr, uint64_t val)
+{
+    int io_index;
+    uint8_t *ptr;
+    unsigned long pd;
+    PhysPageDesc *p;
+
+    p = phys_page_find(addr >> TARGET_PAGE_BITS);
+    if (!p) {
+        pd = IO_MEM_UNASSIGNED;
+    } else {
+        pd = p->phys_offset;
+    }
+
+    if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
+        io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
+#ifdef TARGET_WORDS_BIGENDIAN
+        io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val >> 32);
+        io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val);
+#else
+        io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
+        io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val >> 32);
+#endif
+    } else {
+        ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
+            (addr & ~TARGET_PAGE_MASK);
+        stq_p(ptr, val);
+    }
+}
+
 /* warning: addr must be aligned */
 void stl_phys(target_phys_addr_t addr, uint32_t val)
 {
@@ -2255,7 +2996,7 @@ void stl_phys(target_phys_addr_t addr, uint32_t val)
     } else {
         pd = p->phys_offset;
     }
-        
+
     if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
         io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
         io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
@@ -2299,11 +3040,12 @@ void stq_phys(target_phys_addr_t addr, uint64_t val)
 #endif
 
 /* virtual memory access for debug */
-int cpu_memory_rw_debug(CPUState *env, target_ulong addr, 
+int cpu_memory_rw_debug(CPUState *env, target_ulong addr,
                         uint8_t *buf, int len, int is_write)
 {
     int l;
-    target_ulong page, phys_addr;
+    target_phys_addr_t phys_addr;
+    target_ulong page;
 
     while (len > 0) {
         page = addr & TARGET_PAGE_MASK;
@@ -2314,7 +3056,7 @@ int cpu_memory_rw_debug(CPUState *env, target_ulong addr,
         l = (page + TARGET_PAGE_SIZE) - addr;
         if (l > len)
             l = len;
-        cpu_physical_memory_rw(phys_addr + (addr & ~TARGET_PAGE_MASK), 
+        cpu_physical_memory_rw(phys_addr + (addr & ~TARGET_PAGE_MASK),
                                buf, l, is_write);
         len -= l;
         buf += l;
@@ -2323,13 +3065,72 @@ int cpu_memory_rw_debug(CPUState *env, target_ulong addr,
     return 0;
 }
 
+/* in deterministic execution mode, instructions doing device I/Os
+   must be at the end of the TB */
+void cpu_io_recompile(CPUState *env, void *retaddr)
+{
+    TranslationBlock *tb;
+    uint32_t n, cflags;
+    target_ulong pc, cs_base;
+    uint64_t flags;
+
+    tb = tb_find_pc((unsigned long)retaddr);
+    if (!tb) {
+        cpu_abort(env, "cpu_io_recompile: could not find TB for pc=%p", 
+                  retaddr);
+    }
+    n = env->icount_decr.u16.low + tb->icount;
+    cpu_restore_state(tb, env, (unsigned long)retaddr, NULL);
+    /* Calculate how many instructions had been executed before the fault
+       occurred.  */
+    n = n - env->icount_decr.u16.low;
+    /* Generate a new TB ending on the I/O insn.  */
+    n++;
+    /* On MIPS and SH, delay slot instructions can only be restarted if
+       they were already the first instruction in the TB.  If this is not
+       the first instruction in a TB then re-execute the preceding
+       branch.  */
+#if defined(TARGET_MIPS)
+    if ((env->hflags & MIPS_HFLAG_BMASK) != 0 && n > 1) {
+        env->active_tc.PC -= 4;
+        env->icount_decr.u16.low++;
+        env->hflags &= ~MIPS_HFLAG_BMASK;
+    }
+#elif defined(TARGET_SH4)
+    if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
+            && n > 1) {
+        env->pc -= 2;
+        env->icount_decr.u16.low++;
+        env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
+    }
+#endif
+    /* This should never happen.  */
+    if (n > CF_COUNT_MASK)
+        cpu_abort(env, "TB too big during recompile");
+
+    cflags = n | CF_LAST_IO;
+    pc = tb->pc;
+    cs_base = tb->cs_base;
+    flags = tb->flags;
+    tb_phys_invalidate(tb, -1);
+    /* FIXME: In theory this could raise an exception.  In practice
+       we have already translated the block once so it's probably ok.  */
+    tb_gen_code(env, pc, cs_base, flags, cflags);
+    /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
+       the first in the TB) then we end up generating a whole new TB and
+       repeating the fault, which is horribly inefficient.
+       Better would be to execute just this insn uncached, or generate a
+       second new TB.  */
+    cpu_resume_from_signal(env, NULL);
+}
+
 void dump_exec_info(FILE *f,
                     int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
 {
     int i, target_code_size, max_target_code_size;
     int direct_jmp_count, direct_jmp2_count, cross_page;
     TranslationBlock *tb;
-    
+
     target_code_size = 0;
     max_target_code_size = 0;
     cross_page = 0;
@@ -2350,27 +3151,33 @@ void dump_exec_info(FILE *f,
         }
     }
     /* XXX: avoid using doubles ? */
-    cpu_fprintf(f, "TB count            %d\n", nb_tbs);
-    cpu_fprintf(f, "TB avg target size  %d max=%d bytes\n", 
+    cpu_fprintf(f, "Translation buffer state:\n");
+    cpu_fprintf(f, "gen code size       %ld/%ld\n",
+                code_gen_ptr - code_gen_buffer, code_gen_buffer_max_size);
+    cpu_fprintf(f, "TB count            %d/%d\n", 
+                nb_tbs, code_gen_max_blocks);
+    cpu_fprintf(f, "TB avg target size  %d max=%d bytes\n",
                 nb_tbs ? target_code_size / nb_tbs : 0,
                 max_target_code_size);
-    cpu_fprintf(f, "TB avg host size    %d bytes (expansion ratio: %0.1f)\n", 
+    cpu_fprintf(f, "TB avg host size    %d bytes (expansion ratio: %0.1f)\n",
                 nb_tbs ? (code_gen_ptr - code_gen_buffer) / nb_tbs : 0,
                 target_code_size ? (double) (code_gen_ptr - code_gen_buffer) / target_code_size : 0);
-    cpu_fprintf(f, "cross page TB count %d (%d%%)\n", 
-            cross_page, 
+    cpu_fprintf(f, "cross page TB count %d (%d%%)\n",
+            cross_page,
             nb_tbs ? (cross_page * 100) / nb_tbs : 0);
     cpu_fprintf(f, "direct jump count   %d (%d%%) (2 jumps=%d %d%%)\n",
-                direct_jmp_count, 
+                direct_jmp_count,
                 nb_tbs ? (direct_jmp_count * 100) / nb_tbs : 0,
                 direct_jmp2_count,
                 nb_tbs ? (direct_jmp2_count * 100) / nb_tbs : 0);
+    cpu_fprintf(f, "\nStatistics:\n");
     cpu_fprintf(f, "TB flush count      %d\n", tb_flush_count);
     cpu_fprintf(f, "TB invalidate count %d\n", tb_phys_invalidate_count);
     cpu_fprintf(f, "TLB flush count     %d\n", tlb_flush_count);
+    tcg_dump_info(f, cpu_fprintf);
 }
 
-#if !defined(CONFIG_USER_ONLY) 
+#if !defined(CONFIG_USER_ONLY)
 
 #define MMUSUFFIX _cmmu
 #define GETPC() NULL
diff --git a/fpu/softfloat-native.c b/fpu/softfloat-native.c
index bbdb3d6..e58551f 100644
--- a/fpu/softfloat-native.c
+++ b/fpu/softfloat-native.c
@@ -30,6 +30,25 @@ void set_floatx80_rounding_precision(int val STATUS_PARAM)
 #define sqrtf(f)		((float)sqrt(f))
 #define remainderf(fa, fb)	((float)remainder(fa, fb))
 #define rintf(f)		((float)rint(f))
+#if !defined(__sparc__) && defined(HOST_SOLARIS) && HOST_SOLARIS < 10
+extern long double rintl(long double);
+extern long double scalbnl(long double, int);
+
+long long
+llrintl(long double x) {
+	return ((long long) rintl(x));
+}
+
+long
+lrintl(long double x) {
+	return ((long) rintl(x));
+}
+
+long double
+ldexpl(long double x, int n) {
+	return (scalbnl(x, n));
+}
+#endif
 #endif
 
 #if defined(__powerpc__)
@@ -40,7 +59,7 @@ double qemu_rint(double x)
     double y = 4503599627370496.0;
     if (fabs(x) >= y)
         return x;
-    if (x < 0) 
+    if (x < 0)
         y = -y;
     y = (x + y) - y;
     if (y == 0.0)
@@ -59,11 +78,21 @@ float32 int32_to_float32(int v STATUS_PARAM)
     return (float32)v;
 }
 
+float32 uint32_to_float32(unsigned int v STATUS_PARAM)
+{
+    return (float32)v;
+}
+
 float64 int32_to_float64(int v STATUS_PARAM)
 {
     return (float64)v;
 }
 
+float64 uint32_to_float64(unsigned int v STATUS_PARAM)
+{
+    return (float64)v;
+}
+
 #ifdef FLOATX80
 floatx80 int32_to_floatx80(int v STATUS_PARAM)
 {
@@ -74,10 +103,18 @@ float32 int64_to_float32( int64_t v STATUS_PARAM)
 {
     return (float32)v;
 }
+float32 uint64_to_float32( uint64_t v STATUS_PARAM)
+{
+    return (float32)v;
+}
 float64 int64_to_float64( int64_t v STATUS_PARAM)
 {
     return (float64)v;
 }
+float64 uint64_to_float64( uint64_t v STATUS_PARAM)
+{
+    return (float64)v;
+}
 #ifdef FLOATX80
 floatx80 int64_to_floatx80( int64_t v STATUS_PARAM)
 {
@@ -94,7 +131,7 @@ static inline int long_to_int32(long a)
 #else
 static inline int long_to_int32(long a)
 {
-    if (a != (int32_t)a) 
+    if (a != (int32_t)a)
         a = 0x80000000;
     return a;
 }
@@ -132,6 +169,37 @@ floatx80 float32_to_floatx80( float32 a STATUS_PARAM)
 }
 #endif
 
+unsigned int float32_to_uint32( float32 a STATUS_PARAM)
+{
+    int64_t v;
+    unsigned int res;
+
+    v = llrintf(a);
+    if (v < 0) {
+        res = 0;
+    } else if (v > 0xffffffff) {
+        res = 0xffffffff;
+    } else {
+        res = v;
+    }
+    return res;
+}
+unsigned int float32_to_uint32_round_to_zero( float32 a STATUS_PARAM)
+{
+    int64_t v;
+    unsigned int res;
+
+    v = (int64_t)a;
+    if (v < 0) {
+        res = 0;
+    } else if (v > 0xffffffff) {
+        res = 0xffffffff;
+    } else {
+        res = v;
+    }
+    return res;
+}
+
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE single-precision operations.
 *----------------------------------------------------------------------------*/
@@ -149,7 +217,7 @@ float32 float32_sqrt( float32 a STATUS_PARAM)
 {
     return sqrtf(a);
 }
-char float32_compare( float32 a, float32 b STATUS_PARAM )
+int float32_compare( float32 a, float32 b STATUS_PARAM )
 {
     if (a < b) {
         return -1;
@@ -161,7 +229,7 @@ char float32_compare( float32 a, float32 b STATUS_PARAM )
         return 2;
     }
 }
-char float32_compare_quiet( float32 a, float32 b STATUS_PARAM )
+int float32_compare_quiet( float32 a, float32 b STATUS_PARAM )
 {
     if (isless(a, b)) {
         return -1;
@@ -173,7 +241,7 @@ char float32_compare_quiet( float32 a, float32 b STATUS_PARAM )
         return 2;
     }
 }
-char float32_is_signaling_nan( float32 a1)
+int float32_is_signaling_nan( float32 a1)
 {
     float32u u;
     uint32_t a;
@@ -218,9 +286,67 @@ float128 float64_to_float128( float64 a STATUS_PARAM)
 }
 #endif
 
+unsigned int float64_to_uint32( float64 a STATUS_PARAM)
+{
+    int64_t v;
+    unsigned int res;
+
+    v = llrint(a);
+    if (v < 0) {
+        res = 0;
+    } else if (v > 0xffffffff) {
+        res = 0xffffffff;
+    } else {
+        res = v;
+    }
+    return res;
+}
+unsigned int float64_to_uint32_round_to_zero( float64 a STATUS_PARAM)
+{
+    int64_t v;
+    unsigned int res;
+
+    v = (int64_t)a;
+    if (v < 0) {
+        res = 0;
+    } else if (v > 0xffffffff) {
+        res = 0xffffffff;
+    } else {
+        res = v;
+    }
+    return res;
+}
+uint64_t float64_to_uint64 (float64 a STATUS_PARAM)
+{
+    int64_t v;
+
+    v = llrint(a + (float64)INT64_MIN);
+
+    return v - INT64_MIN;
+}
+uint64_t float64_to_uint64_round_to_zero (float64 a STATUS_PARAM)
+{
+    int64_t v;
+
+    v = (int64_t)(a + (float64)INT64_MIN);
+
+    return v - INT64_MIN;
+}
+
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE double-precision operations.
 *----------------------------------------------------------------------------*/
+#if defined(__sun__) && defined(HOST_SOLARIS) && HOST_SOLARIS < 10
+static inline float64 trunc(float64 x)
+{
+    return x < 0 ? -floor(-x) : floor(x);
+}
+#endif
+float64 float64_trunc_to_int( float64 a STATUS_PARAM )
+{
+    return trunc(a);
+}
+
 float64 float64_round_to_int( float64 a STATUS_PARAM )
 {
 #if defined(__arm__)
@@ -253,7 +379,7 @@ float64 float64_sqrt( float64 a STATUS_PARAM)
 {
     return sqrt(a);
 }
-char float64_compare( float64 a, float64 b STATUS_PARAM )
+int float64_compare( float64 a, float64 b STATUS_PARAM )
 {
     if (a < b) {
         return -1;
@@ -265,7 +391,7 @@ char float64_compare( float64 a, float64 b STATUS_PARAM )
         return 2;
     }
 }
-char float64_compare_quiet( float64 a, float64 b STATUS_PARAM )
+int float64_compare_quiet( float64 a, float64 b STATUS_PARAM )
 {
     if (isless(a, b)) {
         return -1;
@@ -277,7 +403,7 @@ char float64_compare_quiet( float64 a, float64 b STATUS_PARAM )
         return 2;
     }
 }
-char float64_is_signaling_nan( float64 a1)
+int float64_is_signaling_nan( float64 a1)
 {
     float64u u;
     uint64_t a;
@@ -289,6 +415,17 @@ char float64_is_signaling_nan( float64 a1)
 
 }
 
+int float64_is_nan( float64 a1 )
+{
+    float64u u;
+    uint64_t a;
+    u.f = a1;
+    a = u.i;
+
+    return ( LIT64( 0xFFE0000000000000 ) < (bits64) ( a<<1 ) );
+
+}
+
 #ifdef FLOATX80
 
 /*----------------------------------------------------------------------------
@@ -334,7 +471,7 @@ floatx80 floatx80_sqrt( floatx80 a STATUS_PARAM)
 {
     return sqrtl(a);
 }
-char floatx80_compare( floatx80 a, floatx80 b STATUS_PARAM )
+int floatx80_compare( floatx80 a, floatx80 b STATUS_PARAM )
 {
     if (a < b) {
         return -1;
@@ -346,7 +483,7 @@ char floatx80_compare( floatx80 a, floatx80 b STATUS_PARAM )
         return 2;
     }
 }
-char floatx80_compare_quiet( floatx80 a, floatx80 b STATUS_PARAM )
+int floatx80_compare_quiet( floatx80 a, floatx80 b STATUS_PARAM )
 {
     if (isless(a, b)) {
         return -1;
@@ -358,7 +495,7 @@ char floatx80_compare_quiet( floatx80 a, floatx80 b STATUS_PARAM )
         return 2;
     }
 }
-char floatx80_is_signaling_nan( floatx80 a1)
+int floatx80_is_signaling_nan( floatx80 a1)
 {
     floatx80u u;
     u.f = a1;
diff --git a/fpu/softfloat-native.h b/fpu/softfloat-native.h
index e7c08b8..379d49d 100644
--- a/fpu/softfloat-native.h
+++ b/fpu/softfloat-native.h
@@ -8,6 +8,11 @@
 #include <fenv.h>
 #endif
 
+#ifdef __OpenBSD__
+/* Get OpenBSD version number */
+#include <sys/param.h>
+#endif
+
 /*
  * Define some C99-7.12.3 classification macros and
  *        some C99-.12.4 for Solaris systems OS less than 10,
@@ -15,7 +20,9 @@
  *   Solaris 10 with GCC4 does not need these macros as they
  *   are defined in <iso/math_c99.h> with a compiler directive
  */
-#if defined(HOST_SOLARIS) && (( HOST_SOLARIS <= 9 ) || ( ( HOST_SOLARIS >= 10 ) && ( __GNUC__ <= 4) ))
+#if defined(HOST_SOLARIS) && (( HOST_SOLARIS <= 9 ) || ((HOST_SOLARIS >= 10) \
+                                                        && (__GNUC__ <= 4))) \
+    || (defined(__OpenBSD__) && (OpenBSD < 200811))
 /*
  * C99 7.12.3 classification macros
  * and
@@ -24,6 +31,9 @@
  * ... do not work on Solaris 10 using GNU CC 3.4.x.
  * Try to workaround the missing / broken C99 math macros.
  */
+#if defined(__OpenBSD__)
+#define unordered(x, y) (isnan(x) || isnan(y))
+#endif
 
 #define isnormal(x)             (fpclass(x) >= FP_NZERO)
 #define isgreater(x, y)         ((!unordered(x, y)) && ((x) > (y)))
@@ -33,6 +43,29 @@
 #define isunordered(x,y)        unordered(x, y)
 #endif
 
+#if defined(__sun__) && !defined(NEED_LIBSUNMATH)
+
+#ifndef isnan
+# define isnan(x) \
+    (sizeof (x) == sizeof (long double) ? isnan_ld (x) \
+     : sizeof (x) == sizeof (double) ? isnan_d (x) \
+     : isnan_f (x))
+static inline int isnan_f  (float       x) { return x != x; }
+static inline int isnan_d  (double      x) { return x != x; }
+static inline int isnan_ld (long double x) { return x != x; }
+#endif
+
+#ifndef isinf
+# define isinf(x) \
+    (sizeof (x) == sizeof (long double) ? isinf_ld (x) \
+     : sizeof (x) == sizeof (double) ? isinf_d (x) \
+     : isinf_f (x))
+static inline int isinf_f  (float       x) { return isnan (x - x); }
+static inline int isinf_d  (double      x) { return isnan (x - x); }
+static inline int isinf_ld (long double x) { return isnan (x - x); }
+#endif
+#endif
+
 typedef float float32;
 typedef double float64;
 #ifdef FLOATX80
@@ -61,6 +94,11 @@ typedef union {
 | Software IEC/IEEE floating-point rounding mode.
 *----------------------------------------------------------------------------*/
 #if (defined(_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
+#if defined(__OpenBSD__)
+#define FE_RM FP_RM
+#define FE_RP FP_RP
+#define FE_RZ FP_RZ
+#endif
 enum {
     float_round_nearest_even = FP_RN,
     float_round_down         = FP_RM,
@@ -99,7 +137,9 @@ void set_floatx80_rounding_precision(int val STATUS_PARAM);
 | Software IEC/IEEE integer-to-floating-point conversion routines.
 *----------------------------------------------------------------------------*/
 float32 int32_to_float32( int STATUS_PARAM);
+float32 uint32_to_float32( unsigned int STATUS_PARAM);
 float64 int32_to_float64( int STATUS_PARAM);
+float64 uint32_to_float64( unsigned int STATUS_PARAM);
 #ifdef FLOATX80
 floatx80 int32_to_floatx80( int STATUS_PARAM);
 #endif
@@ -107,7 +147,9 @@ floatx80 int32_to_floatx80( int STATUS_PARAM);
 float128 int32_to_float128( int STATUS_PARAM);
 #endif
 float32 int64_to_float32( int64_t STATUS_PARAM);
+float32 uint64_to_float32( uint64_t STATUS_PARAM);
 float64 int64_to_float64( int64_t STATUS_PARAM);
+float64 uint64_to_float64( uint64_t v STATUS_PARAM);
 #ifdef FLOATX80
 floatx80 int64_to_floatx80( int64_t STATUS_PARAM);
 #endif
@@ -120,6 +162,8 @@ float128 int64_to_float128( int64_t STATUS_PARAM);
 *----------------------------------------------------------------------------*/
 int float32_to_int32( float32  STATUS_PARAM);
 int float32_to_int32_round_to_zero( float32  STATUS_PARAM);
+unsigned int float32_to_uint32( float32 a STATUS_PARAM);
+unsigned int float32_to_uint32_round_to_zero( float32 a STATUS_PARAM);
 int64_t float32_to_int64( float32  STATUS_PARAM);
 int64_t float32_to_int64_round_to_zero( float32  STATUS_PARAM);
 float64 float32_to_float64( float32  STATUS_PARAM);
@@ -152,38 +196,38 @@ INLINE float32 float32_div( float32 a, float32 b STATUS_PARAM)
 }
 float32 float32_rem( float32, float32  STATUS_PARAM);
 float32 float32_sqrt( float32  STATUS_PARAM);
-INLINE char float32_eq( float32 a, float32 b STATUS_PARAM)
+INLINE int float32_eq( float32 a, float32 b STATUS_PARAM)
 {
     return a == b;
 }
-INLINE char float32_le( float32 a, float32 b STATUS_PARAM)
+INLINE int float32_le( float32 a, float32 b STATUS_PARAM)
 {
     return a <= b;
 }
-INLINE char float32_lt( float32 a, float32 b STATUS_PARAM)
+INLINE int float32_lt( float32 a, float32 b STATUS_PARAM)
 {
     return a < b;
 }
-INLINE char float32_eq_signaling( float32 a, float32 b STATUS_PARAM)
+INLINE int float32_eq_signaling( float32 a, float32 b STATUS_PARAM)
 {
     return a <= b && a >= b;
 }
-INLINE char float32_le_quiet( float32 a, float32 b STATUS_PARAM)
+INLINE int float32_le_quiet( float32 a, float32 b STATUS_PARAM)
 {
     return islessequal(a, b);
 }
-INLINE char float32_lt_quiet( float32 a, float32 b STATUS_PARAM)
+INLINE int float32_lt_quiet( float32 a, float32 b STATUS_PARAM)
 {
     return isless(a, b);
 }
-INLINE char float32_unordered( float32 a, float32 b STATUS_PARAM)
+INLINE int float32_unordered( float32 a, float32 b STATUS_PARAM)
 {
     return isunordered(a, b);
 
 }
-char float32_compare( float32, float32 STATUS_PARAM );
-char float32_compare_quiet( float32, float32 STATUS_PARAM );
-char float32_is_signaling_nan( float32 );
+int float32_compare( float32, float32 STATUS_PARAM );
+int float32_compare_quiet( float32, float32 STATUS_PARAM );
+int float32_is_signaling_nan( float32 );
 
 INLINE float32 float32_abs(float32 a)
 {
@@ -195,13 +239,22 @@ INLINE float32 float32_chs(float32 a)
     return -a;
 }
 
+INLINE float32 float32_scalbn(float32 a, int n)
+{
+    return scalbnf(a, n);
+}
+
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE double-precision conversion routines.
 *----------------------------------------------------------------------------*/
 int float64_to_int32( float64 STATUS_PARAM );
 int float64_to_int32_round_to_zero( float64 STATUS_PARAM );
+unsigned int float64_to_uint32( float64 STATUS_PARAM );
+unsigned int float64_to_uint32_round_to_zero( float64 STATUS_PARAM );
 int64_t float64_to_int64( float64 STATUS_PARAM );
 int64_t float64_to_int64_round_to_zero( float64 STATUS_PARAM );
+uint64_t float64_to_uint64( float64 STATUS_PARAM );
+uint64_t float64_to_uint64_round_to_zero( float64 STATUS_PARAM );
 float32 float64_to_float32( float64 STATUS_PARAM );
 #ifdef FLOATX80
 floatx80 float64_to_floatx80( float64 STATUS_PARAM );
@@ -214,6 +267,7 @@ float128 float64_to_float128( float64 STATUS_PARAM );
 | Software IEC/IEEE double-precision operations.
 *----------------------------------------------------------------------------*/
 float64 float64_round_to_int( float64 STATUS_PARAM );
+float64 float64_trunc_to_int( float64 STATUS_PARAM );
 INLINE float64 float64_add( float64 a, float64 b STATUS_PARAM)
 {
     return a + b;
@@ -232,39 +286,40 @@ INLINE float64 float64_div( float64 a, float64 b STATUS_PARAM)
 }
 float64 float64_rem( float64, float64 STATUS_PARAM );
 float64 float64_sqrt( float64 STATUS_PARAM );
-INLINE char float64_eq( float64 a, float64 b STATUS_PARAM)
+INLINE int float64_eq( float64 a, float64 b STATUS_PARAM)
 {
     return a == b;
 }
-INLINE char float64_le( float64 a, float64 b STATUS_PARAM)
+INLINE int float64_le( float64 a, float64 b STATUS_PARAM)
 {
     return a <= b;
 }
-INLINE char float64_lt( float64 a, float64 b STATUS_PARAM)
+INLINE int float64_lt( float64 a, float64 b STATUS_PARAM)
 {
     return a < b;
 }
-INLINE char float64_eq_signaling( float64 a, float64 b STATUS_PARAM)
+INLINE int float64_eq_signaling( float64 a, float64 b STATUS_PARAM)
 {
     return a <= b && a >= b;
 }
-INLINE char float64_le_quiet( float64 a, float64 b STATUS_PARAM)
+INLINE int float64_le_quiet( float64 a, float64 b STATUS_PARAM)
 {
     return islessequal(a, b);
 }
-INLINE char float64_lt_quiet( float64 a, float64 b STATUS_PARAM)
+INLINE int float64_lt_quiet( float64 a, float64 b STATUS_PARAM)
 {
     return isless(a, b);
 
 }
-INLINE char float64_unordered( float64 a, float64 b STATUS_PARAM)
+INLINE int float64_unordered( float64 a, float64 b STATUS_PARAM)
 {
     return isunordered(a, b);
 
 }
-char float64_compare( float64, float64 STATUS_PARAM );
-char float64_compare_quiet( float64, float64 STATUS_PARAM );
-char float64_is_signaling_nan( float64 );
+int float64_compare( float64, float64 STATUS_PARAM );
+int float64_compare_quiet( float64, float64 STATUS_PARAM );
+int float64_is_signaling_nan( float64 );
+int float64_is_nan( float64 );
 
 INLINE float64 float64_abs(float64 a)
 {
@@ -276,6 +331,11 @@ INLINE float64 float64_chs(float64 a)
     return -a;
 }
 
+INLINE float64 float64_scalbn(float64 a, int n)
+{
+    return scalbn(a, n);
+}
+
 #ifdef FLOATX80
 
 /*----------------------------------------------------------------------------
@@ -313,39 +373,39 @@ INLINE floatx80 floatx80_div( floatx80 a, floatx80 b STATUS_PARAM)
 }
 floatx80 floatx80_rem( floatx80, floatx80 STATUS_PARAM );
 floatx80 floatx80_sqrt( floatx80 STATUS_PARAM );
-INLINE char floatx80_eq( floatx80 a, floatx80 b STATUS_PARAM)
+INLINE int floatx80_eq( floatx80 a, floatx80 b STATUS_PARAM)
 {
     return a == b;
 }
-INLINE char floatx80_le( floatx80 a, floatx80 b STATUS_PARAM)
+INLINE int floatx80_le( floatx80 a, floatx80 b STATUS_PARAM)
 {
     return a <= b;
 }
-INLINE char floatx80_lt( floatx80 a, floatx80 b STATUS_PARAM)
+INLINE int floatx80_lt( floatx80 a, floatx80 b STATUS_PARAM)
 {
     return a < b;
 }
-INLINE char floatx80_eq_signaling( floatx80 a, floatx80 b STATUS_PARAM)
+INLINE int floatx80_eq_signaling( floatx80 a, floatx80 b STATUS_PARAM)
 {
     return a <= b && a >= b;
 }
-INLINE char floatx80_le_quiet( floatx80 a, floatx80 b STATUS_PARAM)
+INLINE int floatx80_le_quiet( floatx80 a, floatx80 b STATUS_PARAM)
 {
     return islessequal(a, b);
 }
-INLINE char floatx80_lt_quiet( floatx80 a, floatx80 b STATUS_PARAM)
+INLINE int floatx80_lt_quiet( floatx80 a, floatx80 b STATUS_PARAM)
 {
     return isless(a, b);
 
 }
-INLINE char floatx80_unordered( floatx80 a, floatx80 b STATUS_PARAM)
+INLINE int floatx80_unordered( floatx80 a, floatx80 b STATUS_PARAM)
 {
     return isunordered(a, b);
 
 }
-char floatx80_compare( floatx80, floatx80 STATUS_PARAM );
-char floatx80_compare_quiet( floatx80, floatx80 STATUS_PARAM );
-char floatx80_is_signaling_nan( floatx80 );
+int floatx80_compare( floatx80, floatx80 STATUS_PARAM );
+int floatx80_compare_quiet( floatx80, floatx80 STATUS_PARAM );
+int floatx80_is_signaling_nan( floatx80 );
 
 INLINE floatx80 floatx80_abs(floatx80 a)
 {
@@ -356,4 +416,10 @@ INLINE floatx80 floatx80_chs(floatx80 a)
 {
     return -a;
 }
+
+INLINE floatx80 floatx80_scalbn(floatx80 a, int n)
+{
+    return scalbnl(a, n);
+}
+
 #endif
diff --git a/fpu/softfloat-specialize.h b/fpu/softfloat-specialize.h
index d430f58..93fe06e 100644
--- a/fpu/softfloat-specialize.h
+++ b/fpu/softfloat-specialize.h
@@ -30,6 +30,12 @@ these four paragraphs for those parts of this code that are retained.
 
 =============================================================================*/
 
+#if defined(TARGET_MIPS) || defined(TARGET_HPPA)
+#define SNAN_BIT_IS_ONE		1
+#else
+#define SNAN_BIT_IS_ONE		0
+#endif
+
 /*----------------------------------------------------------------------------
 | Underflow tininess-detection mode, statically initialized to default value.
 | (The declaration in `softfloat.h' must match the `int8' type here.)
@@ -45,9 +51,7 @@ int8 float_detect_tininess = float_tininess_after_rounding;
 
 void float_raise( int8 flags STATUS_PARAM )
 {
-
     STATUS(float_exception_flags) |= flags;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -61,18 +65,31 @@ typedef struct {
 /*----------------------------------------------------------------------------
 | The pattern for a default generated single-precision NaN.
 *----------------------------------------------------------------------------*/
-#define float32_default_nan 0xFFC00000
+#if defined(TARGET_SPARC)
+#define float32_default_nan make_float32(0x7FFFFFFF)
+#elif defined(TARGET_POWERPC)
+#define float32_default_nan make_float32(0x7FC00000)
+#elif defined(TARGET_HPPA)
+#define float32_default_nan make_float32(0x7FA00000)
+#elif SNAN_BIT_IS_ONE
+#define float32_default_nan make_float32(0x7FBFFFFF)
+#else
+#define float32_default_nan make_float32(0xFFC00000)
+#endif
 
 /*----------------------------------------------------------------------------
-| Returns 1 if the single-precision floating-point value `a' is a NaN;
-| otherwise returns 0.
+| Returns 1 if the single-precision floating-point value `a' is a quiet
+| NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-flag float32_is_nan( float32 a )
+int float32_is_nan( float32 a_ )
 {
-
-    return ( 0xFF000000 < (bits32) ( a<<1 ) );
-
+    uint32_t a = float32_val(a_);
+#if SNAN_BIT_IS_ONE
+    return ( ( ( a>>22 ) & 0x1FF ) == 0x1FE ) && ( a & 0x003FFFFF );
+#else
+    return ( 0xFF800000 <= (bits32) ( a<<1 ) );
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -80,11 +97,14 @@ flag float32_is_nan( float32 a )
 | NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-flag float32_is_signaling_nan( float32 a )
+int float32_is_signaling_nan( float32 a_ )
 {
-
+    uint32_t a = float32_val(a_);
+#if SNAN_BIT_IS_ONE
+    return ( 0xFF800000 <= (bits32) ( a<<1 ) );
+#else
     return ( ( ( a>>22 ) & 0x1FF ) == 0x1FE ) && ( a & 0x003FFFFF );
-
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -98,11 +118,10 @@ static commonNaNT float32ToCommonNaN( float32 a STATUS_PARAM )
     commonNaNT z;
 
     if ( float32_is_signaling_nan( a ) ) float_raise( float_flag_invalid STATUS_VAR );
-    z.sign = a>>31;
+    z.sign = float32_val(a)>>31;
     z.low = 0;
-    z.high = ( (bits64) a )<<41;
+    z.high = ( (bits64) float32_val(a) )<<41;
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -112,9 +131,12 @@ static commonNaNT float32ToCommonNaN( float32 a STATUS_PARAM )
 
 static float32 commonNaNToFloat32( commonNaNT a )
 {
-
-    return ( ( (bits32) a.sign )<<31 ) | 0x7FC00000 | ( a.high>>41 );
-
+    bits32 mantissa = a.high>>41;
+    if ( mantissa )
+        return make_float32(
+            ( ( (bits32) a.sign )<<31 ) | 0x7F800000 | ( a.high>>41 ) );
+    else
+        return float32_default_nan;
 }
 
 /*----------------------------------------------------------------------------
@@ -126,46 +148,75 @@ static float32 commonNaNToFloat32( commonNaNT a )
 static float32 propagateFloat32NaN( float32 a, float32 b STATUS_PARAM)
 {
     flag aIsNaN, aIsSignalingNaN, bIsNaN, bIsSignalingNaN;
+    bits32 av, bv, res;
 
     aIsNaN = float32_is_nan( a );
     aIsSignalingNaN = float32_is_signaling_nan( a );
     bIsNaN = float32_is_nan( b );
     bIsSignalingNaN = float32_is_signaling_nan( b );
-    a |= 0x00400000;
-    b |= 0x00400000;
+    av = float32_val(a);
+    bv = float32_val(b);
+#if SNAN_BIT_IS_ONE
+    av &= ~0x00400000;
+    bv &= ~0x00400000;
+#else
+    av |= 0x00400000;
+    bv |= 0x00400000;
+#endif
     if ( aIsSignalingNaN | bIsSignalingNaN ) float_raise( float_flag_invalid STATUS_VAR);
     if ( aIsSignalingNaN ) {
         if ( bIsSignalingNaN ) goto returnLargerSignificand;
-        return bIsNaN ? b : a;
+        res = bIsNaN ? bv : av;
     }
     else if ( aIsNaN ) {
-        if ( bIsSignalingNaN | ! bIsNaN ) return a;
+        if ( bIsSignalingNaN | ! bIsNaN )
+            res = av;
+        else {
  returnLargerSignificand:
-        if ( (bits32) ( a<<1 ) < (bits32) ( b<<1 ) ) return b;
-        if ( (bits32) ( b<<1 ) < (bits32) ( a<<1 ) ) return a;
-        return ( a < b ) ? a : b;
+            if ( (bits32) ( av<<1 ) < (bits32) ( bv<<1 ) )
+                res = bv;
+            else if ( (bits32) ( bv<<1 ) < (bits32) ( av<<1 ) )
+                res = av;
+            else
+                res = ( av < bv ) ? av : bv;
+        }
     }
     else {
-        return b;
+        res = bv;
     }
-
+    return make_float32(res);
 }
 
 /*----------------------------------------------------------------------------
 | The pattern for a default generated double-precision NaN.
 *----------------------------------------------------------------------------*/
-#define float64_default_nan LIT64( 0xFFF8000000000000 )
+#if defined(TARGET_SPARC)
+#define float64_default_nan make_float64(LIT64( 0x7FFFFFFFFFFFFFFF ))
+#elif defined(TARGET_POWERPC)
+#define float64_default_nan make_float64(LIT64( 0x7FF8000000000000 ))
+#elif defined(TARGET_HPPA)
+#define float64_default_nan make_float64(LIT64( 0x7FF4000000000000 ))
+#elif SNAN_BIT_IS_ONE
+#define float64_default_nan make_float64(LIT64( 0x7FF7FFFFFFFFFFFF ))
+#else
+#define float64_default_nan make_float64(LIT64( 0xFFF8000000000000 ))
+#endif
 
 /*----------------------------------------------------------------------------
-| Returns 1 if the double-precision floating-point value `a' is a NaN;
-| otherwise returns 0.
+| Returns 1 if the double-precision floating-point value `a' is a quiet
+| NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-flag float64_is_nan( float64 a )
+int float64_is_nan( float64 a_ )
 {
-
-    return ( LIT64( 0xFFE0000000000000 ) < (bits64) ( a<<1 ) );
-
+    bits64 a = float64_val(a_);
+#if SNAN_BIT_IS_ONE
+    return
+           ( ( ( a>>51 ) & 0xFFF ) == 0xFFE )
+        && ( a & LIT64( 0x0007FFFFFFFFFFFF ) );
+#else
+    return ( LIT64( 0xFFF0000000000000 ) <= (bits64) ( a<<1 ) );
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -173,13 +224,16 @@ flag float64_is_nan( float64 a )
 | NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-flag float64_is_signaling_nan( float64 a )
+int float64_is_signaling_nan( float64 a_ )
 {
-
+    bits64 a = float64_val(a_);
+#if SNAN_BIT_IS_ONE
+    return ( LIT64( 0xFFF0000000000000 ) <= (bits64) ( a<<1 ) );
+#else
     return
            ( ( ( a>>51 ) & 0xFFF ) == 0xFFE )
         && ( a & LIT64( 0x0007FFFFFFFFFFFF ) );
-
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -193,11 +247,10 @@ static commonNaNT float64ToCommonNaN( float64 a STATUS_PARAM)
     commonNaNT z;
 
     if ( float64_is_signaling_nan( a ) ) float_raise( float_flag_invalid STATUS_VAR);
-    z.sign = a>>63;
+    z.sign = float64_val(a)>>63;
     z.low = 0;
-    z.high = a<<12;
+    z.high = float64_val(a)<<12;
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -207,12 +260,15 @@ static commonNaNT float64ToCommonNaN( float64 a STATUS_PARAM)
 
 static float64 commonNaNToFloat64( commonNaNT a )
 {
-
-    return
-          ( ( (bits64) a.sign )<<63 )
-        | LIT64( 0x7FF8000000000000 )
-        | ( a.high>>12 );
-
+    bits64 mantissa = a.high>>12;
+
+    if ( mantissa )
+        return make_float64(
+              ( ( (bits64) a.sign )<<63 )
+            | LIT64( 0x7FF0000000000000 )
+            | ( a.high>>12 ));
+    else
+        return float64_default_nan;
 }
 
 /*----------------------------------------------------------------------------
@@ -224,29 +280,43 @@ static float64 commonNaNToFloat64( commonNaNT a )
 static float64 propagateFloat64NaN( float64 a, float64 b STATUS_PARAM)
 {
     flag aIsNaN, aIsSignalingNaN, bIsNaN, bIsSignalingNaN;
+    bits64 av, bv, res;
 
     aIsNaN = float64_is_nan( a );
     aIsSignalingNaN = float64_is_signaling_nan( a );
     bIsNaN = float64_is_nan( b );
     bIsSignalingNaN = float64_is_signaling_nan( b );
-    a |= LIT64( 0x0008000000000000 );
-    b |= LIT64( 0x0008000000000000 );
+    av = float64_val(a);
+    bv = float64_val(b);
+#if SNAN_BIT_IS_ONE
+    av &= ~LIT64( 0x0008000000000000 );
+    bv &= ~LIT64( 0x0008000000000000 );
+#else
+    av |= LIT64( 0x0008000000000000 );
+    bv |= LIT64( 0x0008000000000000 );
+#endif
     if ( aIsSignalingNaN | bIsSignalingNaN ) float_raise( float_flag_invalid STATUS_VAR);
     if ( aIsSignalingNaN ) {
         if ( bIsSignalingNaN ) goto returnLargerSignificand;
-        return bIsNaN ? b : a;
+        res = bIsNaN ? bv : av;
     }
     else if ( aIsNaN ) {
-        if ( bIsSignalingNaN | ! bIsNaN ) return a;
+        if ( bIsSignalingNaN | ! bIsNaN )
+            res = av;
+        else {
  returnLargerSignificand:
-        if ( (bits64) ( a<<1 ) < (bits64) ( b<<1 ) ) return b;
-        if ( (bits64) ( b<<1 ) < (bits64) ( a<<1 ) ) return a;
-        return ( a < b ) ? a : b;
+            if ( (bits64) ( av<<1 ) < (bits64) ( bv<<1 ) )
+                res = bv;
+            else if ( (bits64) ( bv<<1 ) < (bits64) ( av<<1 ) )
+                res = av;
+            else
+                res = ( av < bv ) ? av : bv;
+        }
     }
     else {
-        return b;
+        res = bv;
     }
-
+    return make_float64(res);
 }
 
 #ifdef FLOATX80
@@ -256,19 +326,32 @@ static float64 propagateFloat64NaN( float64 a, float64 b STATUS_PARAM)
 | `high' and `low' values hold the most- and least-significant bits,
 | respectively.
 *----------------------------------------------------------------------------*/
+#if SNAN_BIT_IS_ONE
+#define floatx80_default_nan_high 0x7FFF
+#define floatx80_default_nan_low  LIT64( 0xBFFFFFFFFFFFFFFF )
+#else
 #define floatx80_default_nan_high 0xFFFF
 #define floatx80_default_nan_low  LIT64( 0xC000000000000000 )
+#endif
 
 /*----------------------------------------------------------------------------
 | Returns 1 if the extended double-precision floating-point value `a' is a
-| NaN; otherwise returns 0.
+| quiet NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-flag floatx80_is_nan( floatx80 a )
+int floatx80_is_nan( floatx80 a )
 {
+#if SNAN_BIT_IS_ONE
+    bits64 aLow;
 
+    aLow = a.low & ~ LIT64( 0x4000000000000000 );
+    return
+           ( ( a.high & 0x7FFF ) == 0x7FFF )
+        && (bits64) ( aLow<<1 )
+        && ( a.low == aLow );
+#else
     return ( ( a.high & 0x7FFF ) == 0x7FFF ) && (bits64) ( a.low<<1 );
-
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -276,8 +359,11 @@ flag floatx80_is_nan( floatx80 a )
 | signaling NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-flag floatx80_is_signaling_nan( floatx80 a )
+int floatx80_is_signaling_nan( floatx80 a )
 {
+#if SNAN_BIT_IS_ONE
+    return ( ( a.high & 0x7FFF ) == 0x7FFF ) && (bits64) ( a.low<<1 );
+#else
     bits64 aLow;
 
     aLow = a.low & ~ LIT64( 0x4000000000000000 );
@@ -285,7 +371,7 @@ flag floatx80_is_signaling_nan( floatx80 a )
            ( ( a.high & 0x7FFF ) == 0x7FFF )
         && (bits64) ( aLow<<1 )
         && ( a.low == aLow );
-
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -301,9 +387,8 @@ static commonNaNT floatx80ToCommonNaN( floatx80 a STATUS_PARAM)
     if ( floatx80_is_signaling_nan( a ) ) float_raise( float_flag_invalid STATUS_VAR);
     z.sign = a.high>>15;
     z.low = 0;
-    z.high = a.low<<1;
+    z.high = a.low;
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -315,10 +400,12 @@ static floatx80 commonNaNToFloatx80( commonNaNT a )
 {
     floatx80 z;
 
-    z.low = LIT64( 0xC000000000000000 ) | ( a.high>>1 );
+    if (a.high)
+        z.low = a.high;
+    else
+        z.low = floatx80_default_nan_low;
     z.high = ( ( (bits16) a.sign )<<15 ) | 0x7FFF;
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -335,8 +422,13 @@ static floatx80 propagateFloatx80NaN( floatx80 a, floatx80 b STATUS_PARAM)
     aIsSignalingNaN = floatx80_is_signaling_nan( a );
     bIsNaN = floatx80_is_nan( b );
     bIsSignalingNaN = floatx80_is_signaling_nan( b );
+#if SNAN_BIT_IS_ONE
+    a.low &= ~LIT64( 0xC000000000000000 );
+    b.low &= ~LIT64( 0xC000000000000000 );
+#else
     a.low |= LIT64( 0xC000000000000000 );
     b.low |= LIT64( 0xC000000000000000 );
+#endif
     if ( aIsSignalingNaN | bIsSignalingNaN ) float_raise( float_flag_invalid STATUS_VAR);
     if ( aIsSignalingNaN ) {
         if ( bIsSignalingNaN ) goto returnLargerSignificand;
@@ -352,7 +444,6 @@ static floatx80 propagateFloatx80NaN( floatx80 a, floatx80 b STATUS_PARAM)
     else {
         return b;
     }
-
 }
 
 #endif
@@ -363,21 +454,30 @@ static floatx80 propagateFloatx80NaN( floatx80 a, floatx80 b STATUS_PARAM)
 | The pattern for a default generated quadruple-precision NaN.  The `high' and
 | `low' values hold the most- and least-significant bits, respectively.
 *----------------------------------------------------------------------------*/
+#if SNAN_BIT_IS_ONE
+#define float128_default_nan_high LIT64( 0x7FFF7FFFFFFFFFFF )
+#define float128_default_nan_low  LIT64( 0xFFFFFFFFFFFFFFFF )
+#else
 #define float128_default_nan_high LIT64( 0xFFFF800000000000 )
 #define float128_default_nan_low  LIT64( 0x0000000000000000 )
+#endif
 
 /*----------------------------------------------------------------------------
-| Returns 1 if the quadruple-precision floating-point value `a' is a NaN;
-| otherwise returns 0.
+| Returns 1 if the quadruple-precision floating-point value `a' is a quiet
+| NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-flag float128_is_nan( float128 a )
+int float128_is_nan( float128 a )
 {
-
+#if SNAN_BIT_IS_ONE
+    return
+           ( ( ( a.high>>47 ) & 0xFFFF ) == 0xFFFE )
+        && ( a.low || ( a.high & LIT64( 0x00007FFFFFFFFFFF ) ) );
+#else
     return
            ( LIT64( 0xFFFE000000000000 ) <= (bits64) ( a.high<<1 ) )
         && ( a.low || ( a.high & LIT64( 0x0000FFFFFFFFFFFF ) ) );
-
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -385,13 +485,17 @@ flag float128_is_nan( float128 a )
 | signaling NaN; otherwise returns 0.
 *----------------------------------------------------------------------------*/
 
-flag float128_is_signaling_nan( float128 a )
+int float128_is_signaling_nan( float128 a )
 {
-
+#if SNAN_BIT_IS_ONE
+    return
+           ( LIT64( 0xFFFE000000000000 ) <= (bits64) ( a.high<<1 ) )
+        && ( a.low || ( a.high & LIT64( 0x0000FFFFFFFFFFFF ) ) );
+#else
     return
            ( ( ( a.high>>47 ) & 0xFFFF ) == 0xFFFE )
         && ( a.low || ( a.high & LIT64( 0x00007FFFFFFFFFFF ) ) );
-
+#endif
 }
 
 /*----------------------------------------------------------------------------
@@ -408,7 +512,6 @@ static commonNaNT float128ToCommonNaN( float128 a STATUS_PARAM)
     z.sign = a.high>>63;
     shortShift128Left( a.high, a.low, 16, &z.high, &z.low );
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -421,9 +524,8 @@ static float128 commonNaNToFloat128( commonNaNT a )
     float128 z;
 
     shift128Right( a.high, a.low, 16, &z.high, &z.low );
-    z.high |= ( ( (bits64) a.sign )<<63 ) | LIT64( 0x7FFF800000000000 );
+    z.high |= ( ( (bits64) a.sign )<<63 ) | LIT64( 0x7FFF000000000000 );
     return z;
-
 }
 
 /*----------------------------------------------------------------------------
@@ -440,8 +542,13 @@ static float128 propagateFloat128NaN( float128 a, float128 b STATUS_PARAM)
     aIsSignalingNaN = float128_is_signaling_nan( a );
     bIsNaN = float128_is_nan( b );
     bIsSignalingNaN = float128_is_signaling_nan( b );
+#if SNAN_BIT_IS_ONE
+    a.high &= ~LIT64( 0x0000800000000000 );
+    b.high &= ~LIT64( 0x0000800000000000 );
+#else
     a.high |= LIT64( 0x0000800000000000 );
     b.high |= LIT64( 0x0000800000000000 );
+#endif
     if ( aIsSignalingNaN | bIsSignalingNaN ) float_raise( float_flag_invalid STATUS_VAR);
     if ( aIsSignalingNaN ) {
         if ( bIsSignalingNaN ) goto returnLargerSignificand;
@@ -457,8 +564,6 @@ static float128 propagateFloat128NaN( float128 a, float128 b STATUS_PARAM)
     else {
         return b;
     }
-
 }
 
 #endif
-
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index 75511c9..3ec1e0d 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -175,7 +175,7 @@ static int64 roundAndPackInt64( flag zSign, bits64 absZ0, bits64 absZ1 STATUS_PA
 INLINE bits32 extractFloat32Frac( float32 a )
 {
 
-    return a & 0x007FFFFF;
+    return float32_val(a) & 0x007FFFFF;
 
 }
 
@@ -186,7 +186,7 @@ INLINE bits32 extractFloat32Frac( float32 a )
 INLINE int16 extractFloat32Exp( float32 a )
 {
 
-    return ( a>>23 ) & 0xFF;
+    return ( float32_val(a)>>23 ) & 0xFF;
 
 }
 
@@ -197,7 +197,7 @@ INLINE int16 extractFloat32Exp( float32 a )
 INLINE flag extractFloat32Sign( float32 a )
 {
 
-    return a>>31;
+    return float32_val(a)>>31;
 
 }
 
@@ -233,7 +233,8 @@ static void
 INLINE float32 packFloat32( flag zSign, int16 zExp, bits32 zSig )
 {
 
-    return ( ( (bits32) zSign )<<31 ) + ( ( (bits32) zExp )<<23 ) + zSig;
+    return make_float32(
+          ( ( (bits32) zSign )<<31 ) + ( ( (bits32) zExp )<<23 ) + zSig);
 
 }
 
@@ -290,7 +291,7 @@ static float32 roundAndPackFloat32( flag zSign, int16 zExp, bits32 zSig STATUS_P
                   && ( (sbits32) ( zSig + roundIncrement ) < 0 ) )
            ) {
             float_raise( float_flag_overflow | float_flag_inexact STATUS_VAR);
-            return packFloat32( zSign, 0xFF, 0 ) - ( roundIncrement == 0 );
+            return packFloat32( zSign, 0xFF, - ( roundIncrement == 0 ));
         }
         if ( zExp < 0 ) {
             isTiny =
@@ -337,7 +338,7 @@ static float32
 INLINE bits64 extractFloat64Frac( float64 a )
 {
 
-    return a & LIT64( 0x000FFFFFFFFFFFFF );
+    return float64_val(a) & LIT64( 0x000FFFFFFFFFFFFF );
 
 }
 
@@ -348,7 +349,7 @@ INLINE bits64 extractFloat64Frac( float64 a )
 INLINE int16 extractFloat64Exp( float64 a )
 {
 
-    return ( a>>52 ) & 0x7FF;
+    return ( float64_val(a)>>52 ) & 0x7FF;
 
 }
 
@@ -359,7 +360,7 @@ INLINE int16 extractFloat64Exp( float64 a )
 INLINE flag extractFloat64Sign( float64 a )
 {
 
-    return a>>63;
+    return float64_val(a)>>63;
 
 }
 
@@ -395,7 +396,8 @@ static void
 INLINE float64 packFloat64( flag zSign, int16 zExp, bits64 zSig )
 {
 
-    return ( ( (bits64) zSign )<<63 ) + ( ( (bits64) zExp )<<52 ) + zSig;
+    return make_float64(
+        ( ( (bits64) zSign )<<63 ) + ( ( (bits64) zExp )<<52 ) + zSig);
 
 }
 
@@ -452,7 +454,7 @@ static float64 roundAndPackFloat64( flag zSign, int16 zExp, bits64 zSig STATUS_P
                   && ( (sbits64) ( zSig + roundIncrement ) < 0 ) )
            ) {
             float_raise( float_flag_overflow | float_flag_inexact STATUS_VAR);
-            return packFloat64( zSign, 0x7FF, 0 ) - ( roundIncrement == 0 );
+            return packFloat64( zSign, 0x7FF, - ( roundIncrement == 0 ));
         }
         if ( zExp < 0 ) {
             isTiny =
@@ -1050,7 +1052,7 @@ float32 int32_to_float32( int32 a STATUS_PARAM )
 {
     flag zSign;
 
-    if ( a == 0 ) return 0;
+    if ( a == 0 ) return float32_zero;
     if ( a == (sbits32) 0x80000000 ) return packFloat32( 1, 0x9E, 0 );
     zSign = ( a < 0 );
     return normalizeRoundAndPackFloat32( zSign, 0x9C, zSign ? - a : a STATUS_VAR );
@@ -1070,7 +1072,7 @@ float64 int32_to_float64( int32 a STATUS_PARAM )
     int8 shiftCount;
     bits64 zSig;
 
-    if ( a == 0 ) return 0;
+    if ( a == 0 ) return float64_zero;
     zSign = ( a < 0 );
     absA = zSign ? - a : a;
     shiftCount = countLeadingZeros32( absA ) + 21;
@@ -1144,7 +1146,7 @@ float32 int64_to_float32( int64 a STATUS_PARAM )
     uint64 absA;
     int8 shiftCount;
 
-    if ( a == 0 ) return 0;
+    if ( a == 0 ) return float32_zero;
     zSign = ( a < 0 );
     absA = zSign ? - a : a;
     shiftCount = countLeadingZeros64( absA ) - 40;
@@ -1164,6 +1166,27 @@ float32 int64_to_float32( int64 a STATUS_PARAM )
 
 }
 
+float32 uint64_to_float32( uint64 a STATUS_PARAM )
+{
+    int8 shiftCount;
+
+    if ( a == 0 ) return float32_zero;
+    shiftCount = countLeadingZeros64( a ) - 40;
+    if ( 0 <= shiftCount ) {
+        return packFloat32( 1 > 0, 0x95 - shiftCount, a<<shiftCount );
+    }
+    else {
+        shiftCount += 7;
+        if ( shiftCount < 0 ) {
+            shift64RightJamming( a, - shiftCount, &a );
+        }
+        else {
+            a <<= shiftCount;
+        }
+        return roundAndPackFloat32( 1 > 0, 0x9C - shiftCount, a STATUS_VAR );
+    }
+}
+
 /*----------------------------------------------------------------------------
 | Returns the result of converting the 64-bit two's complement integer `a'
 | to the double-precision floating-point format.  The conversion is performed
@@ -1174,7 +1197,7 @@ float64 int64_to_float64( int64 a STATUS_PARAM )
 {
     flag zSign;
 
-    if ( a == 0 ) return 0;
+    if ( a == 0 ) return float64_zero;
     if ( a == (sbits64) LIT64( 0x8000000000000000 ) ) {
         return packFloat64( 1, 0x43E, 0 );
     }
@@ -1183,6 +1206,13 @@ float64 int64_to_float64( int64 a STATUS_PARAM )
 
 }
 
+float64 uint64_to_float64( uint64 a STATUS_PARAM )
+{
+    if ( a == 0 ) return float64_zero;
+    return normalizeRoundAndPackFloat64( 0, 0x43C, a STATUS_VAR );
+
+}
+
 #ifdef FLOATX80
 
 /*----------------------------------------------------------------------------
@@ -1297,7 +1327,7 @@ int32 float32_to_int32_round_to_zero( float32 a STATUS_PARAM )
     aSign = extractFloat32Sign( a );
     shiftCount = aExp - 0x9E;
     if ( 0 <= shiftCount ) {
-        if ( a != 0xCF000000 ) {
+        if ( float32_val(a) != 0xCF000000 ) {
             float_raise( float_flag_invalid STATUS_VAR);
             if ( ! aSign || ( ( aExp == 0xFF ) && aSig ) ) return 0x7FFFFFFF;
         }
@@ -1376,7 +1406,7 @@ int64 float32_to_int64_round_to_zero( float32 a STATUS_PARAM )
     aSign = extractFloat32Sign( a );
     shiftCount = aExp - 0xBE;
     if ( 0 <= shiftCount ) {
-        if ( a != 0xDF000000 ) {
+        if ( float32_val(a) != 0xDF000000 ) {
             float_raise( float_flag_invalid STATUS_VAR);
             if ( ! aSign || ( ( aExp == 0xFF ) && aSig ) ) {
                 return LIT64( 0x7FFFFFFFFFFFFFFF );
@@ -1507,7 +1537,7 @@ float32 float32_round_to_int( float32 a STATUS_PARAM)
     int16 aExp;
     bits32 lastBitMask, roundBitsMask;
     int8 roundingMode;
-    float32 z;
+    bits32 z;
 
     aExp = extractFloat32Exp( a );
     if ( 0x96 <= aExp ) {
@@ -1517,7 +1547,7 @@ float32 float32_round_to_int( float32 a STATUS_PARAM)
         return a;
     }
     if ( aExp <= 0x7E ) {
-        if ( (bits32) ( a<<1 ) == 0 ) return a;
+        if ( (bits32) ( float32_val(a)<<1 ) == 0 ) return a;
         STATUS(float_exception_flags) |= float_flag_inexact;
         aSign = extractFloat32Sign( a );
         switch ( STATUS(float_rounding_mode) ) {
@@ -1527,29 +1557,29 @@ float32 float32_round_to_int( float32 a STATUS_PARAM)
             }
             break;
          case float_round_down:
-            return aSign ? 0xBF800000 : 0;
+            return make_float32(aSign ? 0xBF800000 : 0);
          case float_round_up:
-            return aSign ? 0x80000000 : 0x3F800000;
+            return make_float32(aSign ? 0x80000000 : 0x3F800000);
         }
         return packFloat32( aSign, 0, 0 );
     }
     lastBitMask = 1;
     lastBitMask <<= 0x96 - aExp;
     roundBitsMask = lastBitMask - 1;
-    z = a;
+    z = float32_val(a);
     roundingMode = STATUS(float_rounding_mode);
     if ( roundingMode == float_round_nearest_even ) {
         z += lastBitMask>>1;
         if ( ( z & roundBitsMask ) == 0 ) z &= ~ lastBitMask;
     }
     else if ( roundingMode != float_round_to_zero ) {
-        if ( extractFloat32Sign( z ) ^ ( roundingMode == float_round_up ) ) {
+        if ( extractFloat32Sign( make_float32(z) ) ^ ( roundingMode == float_round_up ) ) {
             z += roundBitsMask;
         }
     }
     z &= ~ roundBitsMask;
-    if ( z != a ) STATUS(float_exception_flags) |= float_flag_inexact;
-    return z;
+    if ( z != float32_val(a) ) STATUS(float_exception_flags) |= float_flag_inexact;
+    return make_float32(z);
 
 }
 
@@ -1980,7 +2010,7 @@ float32 float32_sqrt( float32 a STATUS_PARAM )
     aExp = extractFloat32Exp( a );
     aSign = extractFloat32Sign( a );
     if ( aExp == 0xFF ) {
-        if ( aSig ) return propagateFloat32NaN( a, 0 STATUS_VAR );
+        if ( aSig ) return propagateFloat32NaN( a, float32_zero STATUS_VAR );
         if ( ! aSign ) return a;
         float_raise( float_flag_invalid STATUS_VAR);
         return float32_default_nan;
@@ -1991,7 +2021,7 @@ float32 float32_sqrt( float32 a STATUS_PARAM )
         return float32_default_nan;
     }
     if ( aExp == 0 ) {
-        if ( aSig == 0 ) return 0;
+        if ( aSig == 0 ) return float32_zero;
         normalizeFloat32Subnormal( aSig, &aExp, &aSig );
     }
     zExp = ( ( aExp - 0x7F )>>1 ) + 0x7E;
@@ -2023,7 +2053,7 @@ float32 float32_sqrt( float32 a STATUS_PARAM )
 | according to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float32_eq( float32 a, float32 b STATUS_PARAM )
+int float32_eq( float32 a, float32 b STATUS_PARAM )
 {
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
@@ -2034,7 +2064,8 @@ flag float32_eq( float32 a, float32 b STATUS_PARAM )
         }
         return 0;
     }
-    return ( a == b ) || ( (bits32) ( ( a | b )<<1 ) == 0 );
+    return ( float32_val(a) == float32_val(b) ) ||
+            ( (bits32) ( ( float32_val(a) | float32_val(b) )<<1 ) == 0 );
 
 }
 
@@ -2045,9 +2076,10 @@ flag float32_eq( float32 a, float32 b STATUS_PARAM )
 | Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float32_le( float32 a, float32 b STATUS_PARAM )
+int float32_le( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits32 av, bv;
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
          || ( ( extractFloat32Exp( b ) == 0xFF ) && extractFloat32Frac( b ) )
@@ -2057,8 +2089,10 @@ flag float32_le( float32 a, float32 b STATUS_PARAM )
     }
     aSign = extractFloat32Sign( a );
     bSign = extractFloat32Sign( b );
-    if ( aSign != bSign ) return aSign || ( (bits32) ( ( a | b )<<1 ) == 0 );
-    return ( a == b ) || ( aSign ^ ( a < b ) );
+    av = float32_val(a);
+    bv = float32_val(b);
+    if ( aSign != bSign ) return aSign || ( (bits32) ( ( av | bv )<<1 ) == 0 );
+    return ( av == bv ) || ( aSign ^ ( av < bv ) );
 
 }
 
@@ -2068,9 +2102,10 @@ flag float32_le( float32 a, float32 b STATUS_PARAM )
 | according to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float32_lt( float32 a, float32 b STATUS_PARAM )
+int float32_lt( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits32 av, bv;
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
          || ( ( extractFloat32Exp( b ) == 0xFF ) && extractFloat32Frac( b ) )
@@ -2080,8 +2115,10 @@ flag float32_lt( float32 a, float32 b STATUS_PARAM )
     }
     aSign = extractFloat32Sign( a );
     bSign = extractFloat32Sign( b );
-    if ( aSign != bSign ) return aSign && ( (bits32) ( ( a | b )<<1 ) != 0 );
-    return ( a != b ) && ( aSign ^ ( a < b ) );
+    av = float32_val(a);
+    bv = float32_val(b);
+    if ( aSign != bSign ) return aSign && ( (bits32) ( ( av | bv )<<1 ) != 0 );
+    return ( av != bv ) && ( aSign ^ ( av < bv ) );
 
 }
 
@@ -2092,8 +2129,9 @@ flag float32_lt( float32 a, float32 b STATUS_PARAM )
 | according to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float32_eq_signaling( float32 a, float32 b STATUS_PARAM )
+int float32_eq_signaling( float32 a, float32 b STATUS_PARAM )
 {
+    bits32 av, bv;
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
          || ( ( extractFloat32Exp( b ) == 0xFF ) && extractFloat32Frac( b ) )
@@ -2101,7 +2139,9 @@ flag float32_eq_signaling( float32 a, float32 b STATUS_PARAM )
         float_raise( float_flag_invalid STATUS_VAR);
         return 0;
     }
-    return ( a == b ) || ( (bits32) ( ( a | b )<<1 ) == 0 );
+    av = float32_val(a);
+    bv = float32_val(b);
+    return ( av == bv ) || ( (bits32) ( ( av | bv )<<1 ) == 0 );
 
 }
 
@@ -2112,9 +2152,10 @@ flag float32_eq_signaling( float32 a, float32 b STATUS_PARAM )
 | IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float32_le_quiet( float32 a, float32 b STATUS_PARAM )
+int float32_le_quiet( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits32 av, bv;
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
          || ( ( extractFloat32Exp( b ) == 0xFF ) && extractFloat32Frac( b ) )
@@ -2126,8 +2167,10 @@ flag float32_le_quiet( float32 a, float32 b STATUS_PARAM )
     }
     aSign = extractFloat32Sign( a );
     bSign = extractFloat32Sign( b );
-    if ( aSign != bSign ) return aSign || ( (bits32) ( ( a | b )<<1 ) == 0 );
-    return ( a == b ) || ( aSign ^ ( a < b ) );
+    av = float32_val(a);
+    bv = float32_val(b);
+    if ( aSign != bSign ) return aSign || ( (bits32) ( ( av | bv )<<1 ) == 0 );
+    return ( av == bv ) || ( aSign ^ ( av < bv ) );
 
 }
 
@@ -2138,9 +2181,10 @@ flag float32_le_quiet( float32 a, float32 b STATUS_PARAM )
 | Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float32_lt_quiet( float32 a, float32 b STATUS_PARAM )
+int float32_lt_quiet( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits32 av, bv;
 
     if (    ( ( extractFloat32Exp( a ) == 0xFF ) && extractFloat32Frac( a ) )
          || ( ( extractFloat32Exp( b ) == 0xFF ) && extractFloat32Frac( b ) )
@@ -2152,8 +2196,10 @@ flag float32_lt_quiet( float32 a, float32 b STATUS_PARAM )
     }
     aSign = extractFloat32Sign( a );
     bSign = extractFloat32Sign( b );
-    if ( aSign != bSign ) return aSign && ( (bits32) ( ( a | b )<<1 ) != 0 );
-    return ( a != b ) && ( aSign ^ ( a < b ) );
+    av = float32_val(a);
+    bv = float32_val(b);
+    if ( aSign != bSign ) return aSign && ( (bits32) ( ( av | bv )<<1 ) != 0 );
+    return ( av != bv ) && ( aSign ^ ( av < bv ) );
 
 }
 
@@ -2296,7 +2342,7 @@ int64 float64_to_int64_round_to_zero( float64 a STATUS_PARAM )
     shiftCount = aExp - 0x433;
     if ( 0 <= shiftCount ) {
         if ( 0x43E <= aExp ) {
-            if ( a != LIT64( 0xC3E0000000000000 ) ) {
+            if ( float64_val(a) != LIT64( 0xC3E0000000000000 ) ) {
                 float_raise( float_flag_invalid STATUS_VAR);
                 if (    ! aSign
                      || (    ( aExp == 0x7FF )
@@ -2436,7 +2482,7 @@ float64 float64_round_to_int( float64 a STATUS_PARAM )
     int16 aExp;
     bits64 lastBitMask, roundBitsMask;
     int8 roundingMode;
-    float64 z;
+    bits64 z;
 
     aExp = extractFloat64Exp( a );
     if ( 0x433 <= aExp ) {
@@ -2446,7 +2492,7 @@ float64 float64_round_to_int( float64 a STATUS_PARAM )
         return a;
     }
     if ( aExp < 0x3FF ) {
-        if ( (bits64) ( a<<1 ) == 0 ) return a;
+        if ( (bits64) ( float64_val(a)<<1 ) == 0 ) return a;
         STATUS(float_exception_flags) |= float_flag_inexact;
         aSign = extractFloat64Sign( a );
         switch ( STATUS(float_rounding_mode) ) {
@@ -2456,33 +2502,45 @@ float64 float64_round_to_int( float64 a STATUS_PARAM )
             }
             break;
          case float_round_down:
-            return aSign ? LIT64( 0xBFF0000000000000 ) : 0;
+            return make_float64(aSign ? LIT64( 0xBFF0000000000000 ) : 0);
          case float_round_up:
-            return
-            aSign ? LIT64( 0x8000000000000000 ) : LIT64( 0x3FF0000000000000 );
+            return make_float64(
+            aSign ? LIT64( 0x8000000000000000 ) : LIT64( 0x3FF0000000000000 ));
         }
         return packFloat64( aSign, 0, 0 );
     }
     lastBitMask = 1;
     lastBitMask <<= 0x433 - aExp;
     roundBitsMask = lastBitMask - 1;
-    z = a;
+    z = float64_val(a);
     roundingMode = STATUS(float_rounding_mode);
     if ( roundingMode == float_round_nearest_even ) {
         z += lastBitMask>>1;
         if ( ( z & roundBitsMask ) == 0 ) z &= ~ lastBitMask;
     }
     else if ( roundingMode != float_round_to_zero ) {
-        if ( extractFloat64Sign( z ) ^ ( roundingMode == float_round_up ) ) {
+        if ( extractFloat64Sign( make_float64(z) ) ^ ( roundingMode == float_round_up ) ) {
             z += roundBitsMask;
         }
     }
     z &= ~ roundBitsMask;
-    if ( z != a ) STATUS(float_exception_flags) |= float_flag_inexact;
-    return z;
+    if ( z != float64_val(a) )
+        STATUS(float_exception_flags) |= float_flag_inexact;
+    return make_float64(z);
 
 }
 
+float64 float64_trunc_to_int( float64 a STATUS_PARAM)
+{
+    int oldmode;
+    float64 res;
+    oldmode = STATUS(float_rounding_mode);
+    STATUS(float_rounding_mode) = float_round_to_zero;
+    res = float64_round_to_int(a STATUS_VAR);
+    STATUS(float_rounding_mode) = oldmode;
+    return res;
+}
+
 /*----------------------------------------------------------------------------
 | Returns the result of adding the absolute values of the double-precision
 | floating-point values `a' and `b'.  If `zSign' is 1, the sum is negated
@@ -2912,7 +2970,7 @@ float64 float64_sqrt( float64 a STATUS_PARAM )
         return float64_default_nan;
     }
     if ( aExp == 0 ) {
-        if ( aSig == 0 ) return 0;
+        if ( aSig == 0 ) return float64_zero;
         normalizeFloat64Subnormal( aSig, &aExp, &aSig );
     }
     zExp = ( ( aExp - 0x3FF )>>1 ) + 0x3FE;
@@ -2941,8 +2999,9 @@ float64 float64_sqrt( float64 a STATUS_PARAM )
 | according to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float64_eq( float64 a, float64 b STATUS_PARAM )
+int float64_eq( float64 a, float64 b STATUS_PARAM )
 {
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -2952,7 +3011,9 @@ flag float64_eq( float64 a, float64 b STATUS_PARAM )
         }
         return 0;
     }
-    return ( a == b ) || ( (bits64) ( ( a | b )<<1 ) == 0 );
+    av = float64_val(a);
+    bv = float64_val(b);
+    return ( av == bv ) || ( (bits64) ( ( av | bv )<<1 ) == 0 );
 
 }
 
@@ -2963,9 +3024,10 @@ flag float64_eq( float64 a, float64 b STATUS_PARAM )
 | Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float64_le( float64 a, float64 b STATUS_PARAM )
+int float64_le( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -2975,8 +3037,10 @@ flag float64_le( float64 a, float64 b STATUS_PARAM )
     }
     aSign = extractFloat64Sign( a );
     bSign = extractFloat64Sign( b );
-    if ( aSign != bSign ) return aSign || ( (bits64) ( ( a | b )<<1 ) == 0 );
-    return ( a == b ) || ( aSign ^ ( a < b ) );
+    av = float64_val(a);
+    bv = float64_val(b);
+    if ( aSign != bSign ) return aSign || ( (bits64) ( ( av | bv )<<1 ) == 0 );
+    return ( av == bv ) || ( aSign ^ ( av < bv ) );
 
 }
 
@@ -2986,9 +3050,10 @@ flag float64_le( float64 a, float64 b STATUS_PARAM )
 | according to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float64_lt( float64 a, float64 b STATUS_PARAM )
+int float64_lt( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -2998,8 +3063,10 @@ flag float64_lt( float64 a, float64 b STATUS_PARAM )
     }
     aSign = extractFloat64Sign( a );
     bSign = extractFloat64Sign( b );
-    if ( aSign != bSign ) return aSign && ( (bits64) ( ( a | b )<<1 ) != 0 );
-    return ( a != b ) && ( aSign ^ ( a < b ) );
+    av = float64_val(a);
+    bv = float64_val(b);
+    if ( aSign != bSign ) return aSign && ( (bits64) ( ( av | bv )<<1 ) != 0 );
+    return ( av != bv ) && ( aSign ^ ( av < bv ) );
 
 }
 
@@ -3010,8 +3077,9 @@ flag float64_lt( float64 a, float64 b STATUS_PARAM )
 | according to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float64_eq_signaling( float64 a, float64 b STATUS_PARAM )
+int float64_eq_signaling( float64 a, float64 b STATUS_PARAM )
 {
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -3019,7 +3087,9 @@ flag float64_eq_signaling( float64 a, float64 b STATUS_PARAM )
         float_raise( float_flag_invalid STATUS_VAR);
         return 0;
     }
-    return ( a == b ) || ( (bits64) ( ( a | b )<<1 ) == 0 );
+    av = float64_val(a);
+    bv = float64_val(b);
+    return ( av == bv ) || ( (bits64) ( ( av | bv )<<1 ) == 0 );
 
 }
 
@@ -3030,9 +3100,10 @@ flag float64_eq_signaling( float64 a, float64 b STATUS_PARAM )
 | IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float64_le_quiet( float64 a, float64 b STATUS_PARAM )
+int float64_le_quiet( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -3044,8 +3115,10 @@ flag float64_le_quiet( float64 a, float64 b STATUS_PARAM )
     }
     aSign = extractFloat64Sign( a );
     bSign = extractFloat64Sign( b );
-    if ( aSign != bSign ) return aSign || ( (bits64) ( ( a | b )<<1 ) == 0 );
-    return ( a == b ) || ( aSign ^ ( a < b ) );
+    av = float64_val(a);
+    bv = float64_val(b);
+    if ( aSign != bSign ) return aSign || ( (bits64) ( ( av | bv )<<1 ) == 0 );
+    return ( av == bv ) || ( aSign ^ ( av < bv ) );
 
 }
 
@@ -3056,9 +3129,10 @@ flag float64_le_quiet( float64 a, float64 b STATUS_PARAM )
 | Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float64_lt_quiet( float64 a, float64 b STATUS_PARAM )
+int float64_lt_quiet( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, bSign;
+    bits64 av, bv;
 
     if (    ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )
          || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )
@@ -3070,8 +3144,10 @@ flag float64_lt_quiet( float64 a, float64 b STATUS_PARAM )
     }
     aSign = extractFloat64Sign( a );
     bSign = extractFloat64Sign( b );
-    if ( aSign != bSign ) return aSign && ( (bits64) ( ( a | b )<<1 ) != 0 );
-    return ( a != b ) && ( aSign ^ ( a < b ) );
+    av = float64_val(a);
+    bv = float64_val(b);
+    if ( aSign != bSign ) return aSign && ( (bits64) ( ( av | bv )<<1 ) != 0 );
+    return ( av != bv ) && ( aSign ^ ( av < bv ) );
 
 }
 
@@ -3879,7 +3955,7 @@ floatx80 floatx80_sqrt( floatx80 a STATUS_PARAM )
 | Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag floatx80_eq( floatx80 a, floatx80 b STATUS_PARAM )
+int floatx80_eq( floatx80 a, floatx80 b STATUS_PARAM )
 {
 
     if (    (    ( extractFloatx80Exp( a ) == 0x7FFF )
@@ -3909,7 +3985,7 @@ flag floatx80_eq( floatx80 a, floatx80 b STATUS_PARAM )
 | Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag floatx80_le( floatx80 a, floatx80 b STATUS_PARAM )
+int floatx80_le( floatx80 a, floatx80 b STATUS_PARAM )
 {
     flag aSign, bSign;
 
@@ -3942,7 +4018,7 @@ flag floatx80_le( floatx80 a, floatx80 b STATUS_PARAM )
 | Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag floatx80_lt( floatx80 a, floatx80 b STATUS_PARAM )
+int floatx80_lt( floatx80 a, floatx80 b STATUS_PARAM )
 {
     flag aSign, bSign;
 
@@ -3975,7 +4051,7 @@ flag floatx80_lt( floatx80 a, floatx80 b STATUS_PARAM )
 | according to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag floatx80_eq_signaling( floatx80 a, floatx80 b STATUS_PARAM )
+int floatx80_eq_signaling( floatx80 a, floatx80 b STATUS_PARAM )
 {
 
     if (    (    ( extractFloatx80Exp( a ) == 0x7FFF )
@@ -4002,7 +4078,7 @@ flag floatx80_eq_signaling( floatx80 a, floatx80 b STATUS_PARAM )
 | to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag floatx80_le_quiet( floatx80 a, floatx80 b STATUS_PARAM )
+int floatx80_le_quiet( floatx80 a, floatx80 b STATUS_PARAM )
 {
     flag aSign, bSign;
 
@@ -4038,7 +4114,7 @@ flag floatx80_le_quiet( floatx80 a, floatx80 b STATUS_PARAM )
 | IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag floatx80_lt_quiet( floatx80 a, floatx80 b STATUS_PARAM )
+int floatx80_lt_quiet( floatx80 a, floatx80 b STATUS_PARAM )
 {
     flag aSign, bSign;
 
@@ -4911,7 +4987,7 @@ float128 float128_rem( float128 a, float128 b STATUS_PARAM )
         sub128( aSig0, aSig1, bSig0, bSig1, &aSig0, &aSig1 );
     } while ( 0 <= (sbits64) aSig0 );
     add128(
-        aSig0, aSig1, alternateASig0, alternateASig1, (bits64*)&sigMean0, &sigMean1 );
+        aSig0, aSig1, alternateASig0, alternateASig1, &sigMean0, &sigMean1 );
     if (    ( sigMean0 < 0 )
          || ( ( ( sigMean0 | sigMean1 ) == 0 ) && ( q & 1 ) ) ) {
         aSig0 = alternateASig0;
@@ -4999,7 +5075,7 @@ float128 float128_sqrt( float128 a STATUS_PARAM )
 | according to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float128_eq( float128 a, float128 b STATUS_PARAM )
+int float128_eq( float128 a, float128 b STATUS_PARAM )
 {
 
     if (    (    ( extractFloat128Exp( a ) == 0x7FFF )
@@ -5029,7 +5105,7 @@ flag float128_eq( float128 a, float128 b STATUS_PARAM )
 | Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float128_le( float128 a, float128 b STATUS_PARAM )
+int float128_le( float128 a, float128 b STATUS_PARAM )
 {
     flag aSign, bSign;
 
@@ -5061,7 +5137,7 @@ flag float128_le( float128 a, float128 b STATUS_PARAM )
 | according to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float128_lt( float128 a, float128 b STATUS_PARAM )
+int float128_lt( float128 a, float128 b STATUS_PARAM )
 {
     flag aSign, bSign;
 
@@ -5094,7 +5170,7 @@ flag float128_lt( float128 a, float128 b STATUS_PARAM )
 | according to the IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float128_eq_signaling( float128 a, float128 b STATUS_PARAM )
+int float128_eq_signaling( float128 a, float128 b STATUS_PARAM )
 {
 
     if (    (    ( extractFloat128Exp( a ) == 0x7FFF )
@@ -5121,7 +5197,7 @@ flag float128_eq_signaling( float128 a, float128 b STATUS_PARAM )
 | IEC/IEEE Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float128_le_quiet( float128 a, float128 b STATUS_PARAM )
+int float128_le_quiet( float128 a, float128 b STATUS_PARAM )
 {
     flag aSign, bSign;
 
@@ -5157,7 +5233,7 @@ flag float128_le_quiet( float128 a, float128 b STATUS_PARAM )
 | Standard for Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-flag float128_lt_quiet( float128 a, float128 b STATUS_PARAM )
+int float128_lt_quiet( float128 a, float128 b STATUS_PARAM )
 {
     flag aSign, bSign;
 
@@ -5271,11 +5347,35 @@ unsigned int float64_to_uint32_round_to_zero( float64 a STATUS_PARAM )
     return res;
 }
 
+/* FIXME: This looks broken.  */
+uint64_t float64_to_uint64 (float64 a STATUS_PARAM)
+{
+    int64_t v;
+
+    v = float64_val(int64_to_float64(INT64_MIN STATUS_VAR));
+    v += float64_val(a);
+    v = float64_to_int64(make_float64(v) STATUS_VAR);
+
+    return v - INT64_MIN;
+}
+
+uint64_t float64_to_uint64_round_to_zero (float64 a STATUS_PARAM)
+{
+    int64_t v;
+
+    v = float64_val(int64_to_float64(INT64_MIN STATUS_VAR));
+    v += float64_val(a);
+    v = float64_to_int64_round_to_zero(make_float64(v) STATUS_VAR);
+
+    return v - INT64_MIN;
+}
+
 #define COMPARE(s, nan_exp)                                                  \
-INLINE char float ## s ## _compare_internal( float ## s a, float ## s b,     \
+INLINE int float ## s ## _compare_internal( float ## s a, float ## s b,      \
                                       int is_quiet STATUS_PARAM )            \
 {                                                                            \
     flag aSign, bSign;                                                       \
+    bits ## s av, bv;                                                        \
                                                                              \
     if (( ( extractFloat ## s ## Exp( a ) == nan_exp ) &&                    \
          extractFloat ## s ## Frac( a ) ) ||                                 \
@@ -5290,31 +5390,152 @@ INLINE char float ## s ## _compare_internal( float ## s a, float ## s b,     \
     }                                                                        \
     aSign = extractFloat ## s ## Sign( a );                                  \
     bSign = extractFloat ## s ## Sign( b );                                  \
+    av = float ## s ## _val(a);                                              \
+    bv = float ## s ## _val(b);                                              \
     if ( aSign != bSign ) {                                                  \
-        if ( (bits ## s) ( ( a | b )<<1 ) == 0 ) {                           \
+        if ( (bits ## s) ( ( av | bv )<<1 ) == 0 ) {                         \
             /* zero case */                                                  \
             return float_relation_equal;                                     \
         } else {                                                             \
             return 1 - (2 * aSign);                                          \
         }                                                                    \
     } else {                                                                 \
-        if (a == b) {                                                        \
+        if (av == bv) {                                                      \
             return float_relation_equal;                                     \
         } else {                                                             \
-            return 1 - 2 * (aSign ^ ( a < b ));                              \
+            return 1 - 2 * (aSign ^ ( av < bv ));                            \
         }                                                                    \
     }                                                                        \
 }                                                                            \
                                                                              \
-char float ## s ## _compare( float ## s a, float ## s b STATUS_PARAM )       \
+int float ## s ## _compare( float ## s a, float ## s b STATUS_PARAM )        \
 {                                                                            \
     return float ## s ## _compare_internal(a, b, 0 STATUS_VAR);              \
 }                                                                            \
                                                                              \
-char float ## s ## _compare_quiet( float ## s a, float ## s b STATUS_PARAM ) \
+int float ## s ## _compare_quiet( float ## s a, float ## s b STATUS_PARAM )  \
 {                                                                            \
     return float ## s ## _compare_internal(a, b, 1 STATUS_VAR);              \
 }
 
 COMPARE(32, 0xff)
 COMPARE(64, 0x7ff)
+
+INLINE int float128_compare_internal( float128 a, float128 b,
+                                      int is_quiet STATUS_PARAM )
+{
+    flag aSign, bSign;
+
+    if (( ( extractFloat128Exp( a ) == 0x7fff ) &&
+          ( extractFloat128Frac0( a ) | extractFloat128Frac1( a ) ) ) ||
+        ( ( extractFloat128Exp( b ) == 0x7fff ) &&
+          ( extractFloat128Frac0( b ) | extractFloat128Frac1( b ) ) )) {
+        if (!is_quiet ||
+            float128_is_signaling_nan( a ) ||
+            float128_is_signaling_nan( b ) ) {
+            float_raise( float_flag_invalid STATUS_VAR);
+        }
+        return float_relation_unordered;
+    }
+    aSign = extractFloat128Sign( a );
+    bSign = extractFloat128Sign( b );
+    if ( aSign != bSign ) {
+        if ( ( ( ( a.high | b.high )<<1 ) | a.low | b.low ) == 0 ) {
+            /* zero case */
+            return float_relation_equal;
+        } else {
+            return 1 - (2 * aSign);
+        }
+    } else {
+        if (a.low == b.low && a.high == b.high) {
+            return float_relation_equal;
+        } else {
+            return 1 - 2 * (aSign ^ ( lt128( a.high, a.low, b.high, b.low ) ));
+        }
+    }
+}
+
+int float128_compare( float128 a, float128 b STATUS_PARAM )
+{
+    return float128_compare_internal(a, b, 0 STATUS_VAR);
+}
+
+int float128_compare_quiet( float128 a, float128 b STATUS_PARAM )
+{
+    return float128_compare_internal(a, b, 1 STATUS_VAR);
+}
+
+/* Multiply A by 2 raised to the power N.  */
+float32 float32_scalbn( float32 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int16 aExp;
+    bits32 aSig;
+
+    aSig = extractFloat32Frac( a );
+    aExp = extractFloat32Exp( a );
+    aSign = extractFloat32Sign( a );
+
+    if ( aExp == 0xFF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloat32( aSign, aExp, aSig STATUS_VAR );
+}
+
+float64 float64_scalbn( float64 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int16 aExp;
+    bits64 aSig;
+
+    aSig = extractFloat64Frac( a );
+    aExp = extractFloat64Exp( a );
+    aSign = extractFloat64Sign( a );
+
+    if ( aExp == 0x7FF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloat64( aSign, aExp, aSig STATUS_VAR );
+}
+
+#ifdef FLOATX80
+floatx80 floatx80_scalbn( floatx80 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int16 aExp;
+    bits64 aSig;
+
+    aSig = extractFloatx80Frac( a );
+    aExp = extractFloatx80Exp( a );
+    aSign = extractFloatx80Sign( a );
+
+    if ( aExp == 0x7FF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloatx80( STATUS(floatx80_rounding_precision),
+                                 aSign, aExp, aSig, 0 STATUS_VAR );
+}
+#endif
+
+#ifdef FLOAT128
+float128 float128_scalbn( float128 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int32 aExp;
+    bits64 aSig0, aSig1;
+
+    aSig1 = extractFloat128Frac1( a );
+    aSig0 = extractFloat128Frac0( a );
+    aExp = extractFloat128Exp( a );
+    aSign = extractFloat128Sign( a );
+    if ( aExp == 0x7FFF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloat128( aSign, aExp, aSig0, aSig1, 0 STATUS_VAR );
+
+}
+#endif
diff --git a/fpu/softfloat.h b/fpu/softfloat.h
index 44c29f1..5f95d06 100644
--- a/fpu/softfloat.h
+++ b/fpu/softfloat.h
@@ -32,6 +32,10 @@ these four paragraphs for those parts of this code that are retained.
 #ifndef SOFTFLOAT_H
 #define SOFTFLOAT_H
 
+#if defined(HOST_SOLARIS) && defined(NEEDS_LIBSUNMATH)
+#include <sunmath.h>
+#endif
+
 #include <inttypes.h>
 #include "config.h"
 
@@ -43,11 +47,11 @@ these four paragraphs for those parts of this code that are retained.
 | implementations of C, `flag', `uint8', and `int8' should all be `typedef'ed
 | to the same as `int'.
 *----------------------------------------------------------------------------*/
-typedef char flag;
+typedef uint8_t flag;
 typedef uint8_t uint8;
 typedef int8_t int8;
-typedef uint16_t uint16;
-typedef int16_t int16;
+typedef int uint16;
+typedef int int16;
 typedef unsigned int uint32;
 typedef signed int int32;
 typedef uint64_t uint64;
@@ -107,8 +111,31 @@ enum {
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE floating-point types.
 *----------------------------------------------------------------------------*/
+/* Use structures for soft-float types.  This prevents accidentally mixing
+   them with native int/float types.  A sufficiently clever compiler and
+   sane ABI should be able to see though these structs.  However
+   x86/gcc 3.x seems to struggle a bit, so leave them disabled by default.  */
+//#define USE_SOFTFLOAT_STRUCT_TYPES
+#ifdef USE_SOFTFLOAT_STRUCT_TYPES
+typedef struct {
+    uint32_t v;
+} float32;
+/* The cast ensures an error if the wrong type is passed.  */
+#define float32_val(x) (((float32)(x)).v)
+#define make_float32(x) __extension__ ({ float32 f32_val = {x}; f32_val; })
+typedef struct {
+    uint64_t v;
+} float64;
+#define float64_val(x) (((float64)(x)).v)
+#define make_float64(x) __extension__ ({ float64 f64_val = {x}; f64_val; })
+#else
 typedef uint32_t float32;
 typedef uint64_t float64;
+#define float32_val(x) (x)
+#define float64_val(x) (x)
+#define make_float32(x) (x)
+#define make_float64(x) (x)
+#endif
 #ifdef FLOATX80
 typedef struct {
     uint64_t low;
@@ -193,7 +220,9 @@ floatx80 int32_to_floatx80( int STATUS_PARAM );
 float128 int32_to_float128( int STATUS_PARAM );
 #endif
 float32 int64_to_float32( int64_t STATUS_PARAM );
+float32 uint64_to_float32( uint64_t STATUS_PARAM );
 float64 int64_to_float64( int64_t STATUS_PARAM );
+float64 uint64_to_float64( uint64_t STATUS_PARAM );
 #ifdef FLOATX80
 floatx80 int64_to_floatx80( int64_t STATUS_PARAM );
 #endif
@@ -228,26 +257,30 @@ float32 float32_mul( float32, float32 STATUS_PARAM );
 float32 float32_div( float32, float32 STATUS_PARAM );
 float32 float32_rem( float32, float32 STATUS_PARAM );
 float32 float32_sqrt( float32 STATUS_PARAM );
-char float32_eq( float32, float32 STATUS_PARAM );
-char float32_le( float32, float32 STATUS_PARAM );
-char float32_lt( float32, float32 STATUS_PARAM );
-char float32_eq_signaling( float32, float32 STATUS_PARAM );
-char float32_le_quiet( float32, float32 STATUS_PARAM );
-char float32_lt_quiet( float32, float32 STATUS_PARAM );
-char float32_compare( float32, float32 STATUS_PARAM );
-char float32_compare_quiet( float32, float32 STATUS_PARAM );
-char float32_is_signaling_nan( float32 );
+int float32_eq( float32, float32 STATUS_PARAM );
+int float32_le( float32, float32 STATUS_PARAM );
+int float32_lt( float32, float32 STATUS_PARAM );
+int float32_eq_signaling( float32, float32 STATUS_PARAM );
+int float32_le_quiet( float32, float32 STATUS_PARAM );
+int float32_lt_quiet( float32, float32 STATUS_PARAM );
+int float32_compare( float32, float32 STATUS_PARAM );
+int float32_compare_quiet( float32, float32 STATUS_PARAM );
+int float32_is_nan( float32 );
+int float32_is_signaling_nan( float32 );
+float32 float32_scalbn( float32, int STATUS_PARAM );
 
 INLINE float32 float32_abs(float32 a)
 {
-    return a & 0x7fffffff;
+    return make_float32(float32_val(a) & 0x7fffffff);
 }
 
 INLINE float32 float32_chs(float32 a)
 {
-    return a ^ 0x80000000;
+    return make_float32(float32_val(a) ^ 0x80000000);
 }
 
+#define float32_zero make_float32(0)
+
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE double-precision conversion routines.
 *----------------------------------------------------------------------------*/
@@ -257,6 +290,8 @@ unsigned int float64_to_uint32( float64 STATUS_PARAM );
 unsigned int float64_to_uint32_round_to_zero( float64 STATUS_PARAM );
 int64_t float64_to_int64( float64 STATUS_PARAM );
 int64_t float64_to_int64_round_to_zero( float64 STATUS_PARAM );
+uint64_t float64_to_uint64 (float64 a STATUS_PARAM);
+uint64_t float64_to_uint64_round_to_zero (float64 a STATUS_PARAM);
 float32 float64_to_float32( float64 STATUS_PARAM );
 #ifdef FLOATX80
 floatx80 float64_to_floatx80( float64 STATUS_PARAM );
@@ -269,32 +304,37 @@ float128 float64_to_float128( float64 STATUS_PARAM );
 | Software IEC/IEEE double-precision operations.
 *----------------------------------------------------------------------------*/
 float64 float64_round_to_int( float64 STATUS_PARAM );
+float64 float64_trunc_to_int( float64 STATUS_PARAM );
 float64 float64_add( float64, float64 STATUS_PARAM );
 float64 float64_sub( float64, float64 STATUS_PARAM );
 float64 float64_mul( float64, float64 STATUS_PARAM );
 float64 float64_div( float64, float64 STATUS_PARAM );
 float64 float64_rem( float64, float64 STATUS_PARAM );
 float64 float64_sqrt( float64 STATUS_PARAM );
-char float64_eq( float64, float64 STATUS_PARAM );
-char float64_le( float64, float64 STATUS_PARAM );
-char float64_lt( float64, float64 STATUS_PARAM );
-char float64_eq_signaling( float64, float64 STATUS_PARAM );
-char float64_le_quiet( float64, float64 STATUS_PARAM );
-char float64_lt_quiet( float64, float64 STATUS_PARAM );
-char float64_compare( float64, float64 STATUS_PARAM );
-char float64_compare_quiet( float64, float64 STATUS_PARAM );
-char float64_is_signaling_nan( float64 );
+int float64_eq( float64, float64 STATUS_PARAM );
+int float64_le( float64, float64 STATUS_PARAM );
+int float64_lt( float64, float64 STATUS_PARAM );
+int float64_eq_signaling( float64, float64 STATUS_PARAM );
+int float64_le_quiet( float64, float64 STATUS_PARAM );
+int float64_lt_quiet( float64, float64 STATUS_PARAM );
+int float64_compare( float64, float64 STATUS_PARAM );
+int float64_compare_quiet( float64, float64 STATUS_PARAM );
+int float64_is_nan( float64 a );
+int float64_is_signaling_nan( float64 );
+float64 float64_scalbn( float64, int STATUS_PARAM );
 
 INLINE float64 float64_abs(float64 a)
 {
-    return a & 0x7fffffffffffffffLL;
+    return make_float64(float64_val(a) & 0x7fffffffffffffffLL);
 }
 
 INLINE float64 float64_chs(float64 a)
 {
-    return a ^ 0x8000000000000000LL;
+    return make_float64(float64_val(a) ^ 0x8000000000000000LL);
 }
 
+#define float64_zero make_float64(0)
+
 #ifdef FLOATX80
 
 /*----------------------------------------------------------------------------
@@ -320,13 +360,15 @@ floatx80 floatx80_mul( floatx80, floatx80 STATUS_PARAM );
 floatx80 floatx80_div( floatx80, floatx80 STATUS_PARAM );
 floatx80 floatx80_rem( floatx80, floatx80 STATUS_PARAM );
 floatx80 floatx80_sqrt( floatx80 STATUS_PARAM );
-char floatx80_eq( floatx80, floatx80 STATUS_PARAM );
-char floatx80_le( floatx80, floatx80 STATUS_PARAM );
-char floatx80_lt( floatx80, floatx80 STATUS_PARAM );
-char floatx80_eq_signaling( floatx80, floatx80 STATUS_PARAM );
-char floatx80_le_quiet( floatx80, floatx80 STATUS_PARAM );
-char floatx80_lt_quiet( floatx80, floatx80 STATUS_PARAM );
-char floatx80_is_signaling_nan( floatx80 );
+int floatx80_eq( floatx80, floatx80 STATUS_PARAM );
+int floatx80_le( floatx80, floatx80 STATUS_PARAM );
+int floatx80_lt( floatx80, floatx80 STATUS_PARAM );
+int floatx80_eq_signaling( floatx80, floatx80 STATUS_PARAM );
+int floatx80_le_quiet( floatx80, floatx80 STATUS_PARAM );
+int floatx80_lt_quiet( floatx80, floatx80 STATUS_PARAM );
+int floatx80_is_nan( floatx80 );
+int floatx80_is_signaling_nan( floatx80 );
+floatx80 floatx80_scalbn( floatx80, int STATUS_PARAM );
 
 INLINE floatx80 floatx80_abs(floatx80 a)
 {
@@ -367,13 +409,17 @@ float128 float128_mul( float128, float128 STATUS_PARAM );
 float128 float128_div( float128, float128 STATUS_PARAM );
 float128 float128_rem( float128, float128 STATUS_PARAM );
 float128 float128_sqrt( float128 STATUS_PARAM );
-char float128_eq( float128, float128 STATUS_PARAM );
-char float128_le( float128, float128 STATUS_PARAM );
-char float128_lt( float128, float128 STATUS_PARAM );
-char float128_eq_signaling( float128, float128 STATUS_PARAM );
-char float128_le_quiet( float128, float128 STATUS_PARAM );
-char float128_lt_quiet( float128, float128 STATUS_PARAM );
-char float128_is_signaling_nan( float128 );
+int float128_eq( float128, float128 STATUS_PARAM );
+int float128_le( float128, float128 STATUS_PARAM );
+int float128_lt( float128, float128 STATUS_PARAM );
+int float128_eq_signaling( float128, float128 STATUS_PARAM );
+int float128_le_quiet( float128, float128 STATUS_PARAM );
+int float128_lt_quiet( float128, float128 STATUS_PARAM );
+int float128_compare( float128, float128 STATUS_PARAM );
+int float128_compare_quiet( float128, float128 STATUS_PARAM );
+int float128_is_nan( float128 );
+int float128_is_signaling_nan( float128 );
+float128 float128_scalbn( float128, int STATUS_PARAM );
 
 INLINE float128 float128_abs(float128 a)
 {
diff --git a/gdbstub.c b/gdbstub.c
index 564543a..f36e504 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1,6 +1,6 @@
 /*
  * gdb server stub
- * 
+ *
  * Copyright (c) 2003-2005 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -29,10 +29,14 @@
 
 #include "qemu.h"
 #else
-#include "vl.h"
+#include "qemu-common.h"
+#include "qemu-char.h"
+#include "sysemu.h"
+#include "cpu.h"
+#include "gdbstub.h"
 #endif
 
-#include "sockets.h"
+#include "qemu_socket.h"
 #ifdef _WIN32
 /* XXX: these constants may be independent of the host ones even for Unix */
 #ifndef SIGTRAP
@@ -52,26 +56,36 @@ enum RSState {
     RS_GETLINE,
     RS_CHKSUM1,
     RS_CHKSUM2,
+    RS_SYSCALL,
 };
-/* XXX: This is not thread safe.  Do we care?  */
-static int gdbserver_fd = -1;
-
 typedef struct GDBState {
     CPUState *env; /* current CPU */
     enum RSState state; /* parsing state */
-    int fd;
     char line_buf[4096];
     int line_buf_index;
     int line_csum;
+    uint8_t last_packet[4100];
+    int last_packet_len;
+    int signal;
 #ifdef CONFIG_USER_ONLY
+    int fd;
     int running_state;
+#else
+    CharDriverState *chr;
 #endif
 } GDBState;
 
+/* By default use no IRQs and no timers while single stepping so as to
+ * make single stepping like an ICE HW step.
+ */
+static int sstep_flags = SSTEP_ENABLE|SSTEP_NOIRQ|SSTEP_NOTIMER;
+
 #ifdef CONFIG_USER_ONLY
+/* XXX: This is not thread safe.  Do we care?  */
+static int gdbserver_fd = -1;
+
 /* XXX: remove this hack.  */
 static GDBState gdbserver_state;
-#endif
 
 static int get_char(GDBState *s)
 {
@@ -81,9 +95,13 @@ static int get_char(GDBState *s)
     for(;;) {
         ret = socket_recv(s->fd, &ch, 1);
         if (ret < 0) {
+            if (errno == ECONNRESET)
+                s->fd = -1;
             if (errno != EINTR && errno != EAGAIN)
                 return -1;
         } else if (ret == 0) {
+            socket_close(s->fd);
+            s->fd = -1;
             return -1;
         } else {
             break;
@@ -91,9 +109,42 @@ static int get_char(GDBState *s)
     }
     return ch;
 }
+#endif
+
+/* GDB stub state for use by semihosting syscalls.  */
+static GDBState *gdb_syscall_state;
+static gdb_syscall_complete_cb gdb_current_syscall_cb;
+
+enum {
+    GDB_SYS_UNKNOWN,
+    GDB_SYS_ENABLED,
+    GDB_SYS_DISABLED,
+} gdb_syscall_mode;
+
+/* If gdb is connected when the first semihosting syscall occurs then use
+   remote gdb syscalls.  Otherwise use native file IO.  */
+int use_gdb_syscalls(void)
+{
+    if (gdb_syscall_mode == GDB_SYS_UNKNOWN) {
+        gdb_syscall_mode = (gdb_syscall_state ? GDB_SYS_ENABLED
+                                              : GDB_SYS_DISABLED);
+    }
+    return gdb_syscall_mode == GDB_SYS_ENABLED;
+}
+
+/* Resume execution.  */
+static inline void gdb_continue(GDBState *s)
+{
+#ifdef CONFIG_USER_ONLY
+    s->running_state = 1;
+#else
+    vm_start();
+#endif
+}
 
 static void put_buffer(GDBState *s, const uint8_t *buf, int len)
 {
+#ifdef CONFIG_USER_ONLY
     int ret;
 
     while (len > 0) {
@@ -106,6 +157,9 @@ static void put_buffer(GDBState *s, const uint8_t *buf, int len)
             len -= ret;
         }
     }
+#else
+    qemu_chr_write(s->chr, buf, len);
+#endif
 }
 
 static inline int fromhex(int v)
@@ -152,99 +206,213 @@ static void hextomem(uint8_t *mem, const char *buf, int len)
 }
 
 /* return -1 if error, 0 if OK */
-static int put_packet(GDBState *s, char *buf)
+static int put_packet(GDBState *s, const char *buf)
 {
-    char buf1[3];
-    int len, csum, ch, i;
+    int len, csum, i;
+    uint8_t *p;
 
 #ifdef DEBUG_GDB
     printf("reply='%s'\n", buf);
 #endif
 
     for(;;) {
-        buf1[0] = '$';
-        put_buffer(s, buf1, 1);
+        p = s->last_packet;
+        *(p++) = '$';
         len = strlen(buf);
-        put_buffer(s, buf, len);
+        memcpy(p, buf, len);
+        p += len;
         csum = 0;
         for(i = 0; i < len; i++) {
             csum += buf[i];
         }
-        buf1[0] = '#';
-        buf1[1] = tohex((csum >> 4) & 0xf);
-        buf1[2] = tohex((csum) & 0xf);
+        *(p++) = '#';
+        *(p++) = tohex((csum >> 4) & 0xf);
+        *(p++) = tohex((csum) & 0xf);
 
-        put_buffer(s, buf1, 3);
+        s->last_packet_len = p - s->last_packet;
+        put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
 
-        ch = get_char(s);
-        if (ch < 0)
+#ifdef CONFIG_USER_ONLY
+        i = get_char(s);
+        if (i < 0)
             return -1;
-        if (ch == '+')
+        if (i == '+')
             break;
+#else
+        break;
+#endif
     }
     return 0;
 }
 
 #if defined(TARGET_I386)
 
+#ifdef TARGET_X86_64
+static const uint8_t gdb_x86_64_regs[16] = {
+    R_EAX, R_EBX, R_ECX, R_EDX, R_ESI, R_EDI, R_EBP, R_ESP,
+    8, 9, 10, 11, 12, 13, 14, 15,
+};
+#endif
+
 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 {
-    uint32_t *registers = (uint32_t *)mem_buf;
-    int i, fpus;
+    int i, fpus, nb_regs;
+    uint8_t *p;
+
+    p = mem_buf;
+#ifdef TARGET_X86_64
+    if (env->hflags & HF_CS64_MASK) {
+        nb_regs = 16;
+        for(i = 0; i < 16; i++) {
+            *(uint64_t *)p = tswap64(env->regs[gdb_x86_64_regs[i]]);
+            p += 8;
+        }
+        *(uint64_t *)p = tswap64(env->eip);
+        p += 8;
+    } else
+#endif
+    {
+        nb_regs = 8;
+        for(i = 0; i < 8; i++) {
+            *(uint32_t *)p = tswap32(env->regs[i]);
+            p += 4;
+        }
+        *(uint32_t *)p = tswap32(env->eip);
+        p += 4;
+    }
 
+    *(uint32_t *)p = tswap32(env->eflags);
+    p += 4;
+    *(uint32_t *)p = tswap32(env->segs[R_CS].selector);
+    p += 4;
+    *(uint32_t *)p = tswap32(env->segs[R_SS].selector);
+    p += 4;
+    *(uint32_t *)p = tswap32(env->segs[R_DS].selector);
+    p += 4;
+    *(uint32_t *)p = tswap32(env->segs[R_ES].selector);
+    p += 4;
+    *(uint32_t *)p = tswap32(env->segs[R_FS].selector);
+    p += 4;
+    *(uint32_t *)p = tswap32(env->segs[R_GS].selector);
+    p += 4;
     for(i = 0; i < 8; i++) {
-        registers[i] = env->regs[i];
-    }
-    registers[8] = env->eip;
-    registers[9] = env->eflags;
-    registers[10] = env->segs[R_CS].selector;
-    registers[11] = env->segs[R_SS].selector;
-    registers[12] = env->segs[R_DS].selector;
-    registers[13] = env->segs[R_ES].selector;
-    registers[14] = env->segs[R_FS].selector;
-    registers[15] = env->segs[R_GS].selector;
-    /* XXX: convert floats */
-    for(i = 0; i < 8; i++) {
-        memcpy(mem_buf + 16 * 4 + i * 10, &env->fpregs[i], 10);
+        /* XXX: convert floats */
+#ifdef USE_X86LDOUBLE
+        memcpy(p, &env->fpregs[i], 10);
+#else
+        memset(p, 0, 10);
+#endif
+        p += 10;
     }
-    registers[36] = env->fpuc;
+    *(uint32_t *)p = tswap32(env->fpuc); /* fctrl */
+    p += 4;
     fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
-    registers[37] = fpus;
-    registers[38] = 0; /* XXX: convert tags */
-    registers[39] = 0; /* fiseg */
-    registers[40] = 0; /* fioff */
-    registers[41] = 0; /* foseg */
-    registers[42] = 0; /* fooff */
-    registers[43] = 0; /* fop */
-    
-    for(i = 0; i < 16; i++)
-        tswapls(&registers[i]);
-    for(i = 36; i < 44; i++)
-        tswapls(&registers[i]);
-    return 44 * 4;
+    *(uint32_t *)p = tswap32(fpus); /* fstat */
+    p += 4;
+    *(uint32_t *)p = 0; /* ftag */
+    p += 4;
+    *(uint32_t *)p = 0; /* fiseg */
+    p += 4;
+    *(uint32_t *)p = 0; /* fioff */
+    p += 4;
+    *(uint32_t *)p = 0; /* foseg */
+    p += 4;
+    *(uint32_t *)p = 0; /* fooff */
+    p += 4;
+    *(uint32_t *)p = 0; /* fop */
+    p += 4;
+    for(i = 0; i < nb_regs; i++) {
+        *(uint64_t *)p = tswap64(env->xmm_regs[i].XMM_Q(0));
+        p += 8;
+        *(uint64_t *)p = tswap64(env->xmm_regs[i].XMM_Q(1));
+        p += 8;
+    }
+    *(uint32_t *)p = tswap32(env->mxcsr);
+    p += 4;
+    return p - mem_buf;
 }
 
-static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
+static inline void cpu_gdb_load_seg(CPUState *env, const uint8_t **pp, 
+                                    int sreg)
 {
-    uint32_t *registers = (uint32_t *)mem_buf;
-    int i;
+    const uint8_t *p;
+    uint32_t sel;
+    p = *pp;
+    sel = tswap32(*(uint32_t *)p);
+    p += 4;
+    if (sel != env->segs[sreg].selector) {
+#if defined(CONFIG_USER_ONLY)
+        cpu_x86_load_seg(env, sreg, sel);
+#else
+        /* XXX: do it with a debug function which does not raise an
+           exception */
+#endif
+    }
+    *pp = p;
+}
 
-    for(i = 0; i < 8; i++) {
-        env->regs[i] = tswapl(registers[i]);
+static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
+{
+    const uint8_t *p = mem_buf;
+    int i, nb_regs;
+    uint16_t fpus;
+
+#ifdef TARGET_X86_64
+    if (env->hflags & HF_CS64_MASK) {
+        nb_regs = 16;
+        for(i = 0; i < 16; i++) {
+            env->regs[gdb_x86_64_regs[i]] = tswap64(*(uint64_t *)p);
+            p += 8;
+        }
+        env->eip = tswap64(*(uint64_t *)p);
+        p += 8;
+    } else
+#endif
+    {
+        nb_regs = 8;
+        for(i = 0; i < 8; i++) {
+            env->regs[i] = tswap32(*(uint32_t *)p);
+            p += 4;
+        }
+        env->eip = tswap32(*(uint32_t *)p);
+        p += 4;
     }
-    env->eip = tswapl(registers[8]);
-    env->eflags = tswapl(registers[9]);
-#if defined(CONFIG_USER_ONLY)
-#define LOAD_SEG(index, sreg)\
-            if (tswapl(registers[index]) != env->segs[sreg].selector)\
-                cpu_x86_load_seg(env, sreg, tswapl(registers[index]));
-            LOAD_SEG(10, R_CS);
-            LOAD_SEG(11, R_SS);
-            LOAD_SEG(12, R_DS);
-            LOAD_SEG(13, R_ES);
-            LOAD_SEG(14, R_FS);
-            LOAD_SEG(15, R_GS);
+    env->eflags = tswap32(*(uint32_t *)p);
+    p += 4;
+    cpu_gdb_load_seg(env, &p, R_CS);
+    cpu_gdb_load_seg(env, &p, R_SS);
+    cpu_gdb_load_seg(env, &p, R_DS);
+    cpu_gdb_load_seg(env, &p, R_ES);
+    cpu_gdb_load_seg(env, &p, R_FS);
+    cpu_gdb_load_seg(env, &p, R_GS);
+    
+    /* FPU state */
+    for(i = 0; i < 8; i++) {
+        /* XXX: convert floats */
+#ifdef USE_X86LDOUBLE
+        memcpy(&env->fpregs[i], p, 10);
 #endif
+        p += 10;
+    }
+    env->fpuc = tswap32(*(uint32_t *)p); /* fctrl */
+    p += 4;
+    fpus = tswap32(*(uint32_t *)p);
+    p += 4;
+    env->fpstt = (fpus >> 11) & 7;
+    env->fpus = fpus & ~0x3800;
+    p += 4 * 6;
+    
+    if (size >= ((p - mem_buf) + 16 * nb_regs + 4)) {
+        /* SSE state */
+        for(i = 0; i < nb_regs; i++) {
+            env->xmm_regs[i].XMM_Q(0) = tswap64(*(uint64_t *)p);
+            p += 8;
+            env->xmm_regs[i].XMM_Q(1) = tswap64(*(uint64_t *)p);
+            p += 8;
+        }
+        env->mxcsr = tswap32(*(uint32_t *)p);
+        p += 4;
+    }
 }
 
 #elif defined (TARGET_PPC)
@@ -264,14 +432,14 @@ static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
     }
     /* nip, msr, ccr, lnk, ctr, xer, mq */
     registers[96] = tswapl(env->nip);
-    registers[97] = tswapl(do_load_msr(env));
+    registers[97] = tswapl(env->msr);
     tmp = 0;
     for (i = 0; i < 8; i++)
         tmp |= env->crf[i] << (32 - ((i + 1) * 4));
     registers[98] = tswapl(tmp);
     registers[99] = tswapl(env->lr);
     registers[100] = tswapl(env->ctr);
-    registers[101] = tswapl(do_load_xer(env));
+    registers[101] = tswapl(ppc_load_xer(env));
     registers[102] = 0;
 
     return 103 * 4;
@@ -293,61 +461,73 @@ static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
     }
     /* nip, msr, ccr, lnk, ctr, xer, mq */
     env->nip = tswapl(registers[96]);
-    do_store_msr(env, tswapl(registers[97]));
+    ppc_store_msr(env, tswapl(registers[97]));
     registers[98] = tswapl(registers[98]);
     for (i = 0; i < 8; i++)
         env->crf[i] = (registers[98] >> (32 - ((i + 1) * 4))) & 0xF;
     env->lr = tswapl(registers[99]);
     env->ctr = tswapl(registers[100]);
-    do_store_xer(env, tswapl(registers[101]));
+    ppc_store_xer(env, tswapl(registers[101]));
 }
 #elif defined (TARGET_SPARC)
+#ifdef TARGET_ABI32
+#define tswap_abi(val) tswap32(val &0xffffffff)
+#else
+#define tswap_abi(val) tswapl(val)
+#endif
 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 {
+#ifdef TARGET_ABI32
+    abi_ulong *registers = (abi_ulong *)mem_buf;
+#else
     target_ulong *registers = (target_ulong *)mem_buf;
+#endif
     int i;
 
     /* fill in g0..g7 */
     for(i = 0; i < 8; i++) {
-        registers[i] = tswapl(env->gregs[i]);
+        registers[i] = tswap_abi(env->gregs[i]);
     }
     /* fill in register window */
     for(i = 0; i < 24; i++) {
-        registers[i + 8] = tswapl(env->regwptr[i]);
+        registers[i + 8] = tswap_abi(env->regwptr[i]);
     }
-#ifndef TARGET_SPARC64
+#if !defined(TARGET_SPARC64) || defined(TARGET_ABI32)
     /* fill in fprs */
     for (i = 0; i < 32; i++) {
-        registers[i + 32] = tswapl(*((uint32_t *)&env->fpr[i]));
+        registers[i + 32] = tswap_abi(*((uint32_t *)&env->fpr[i]));
     }
     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
-    registers[64] = tswapl(env->y);
+    registers[64] = tswap_abi(env->y);
     {
-	target_ulong tmp;
+        uint32_t tmp;
 
-	tmp = GET_PSR(env);
-	registers[65] = tswapl(tmp);
+        tmp = GET_PSR(env);
+        registers[65] = tswap32(tmp);
     }
-    registers[66] = tswapl(env->wim);
-    registers[67] = tswapl(env->tbr);
-    registers[68] = tswapl(env->pc);
-    registers[69] = tswapl(env->npc);
-    registers[70] = tswapl(env->fsr);
+    registers[66] = tswap_abi(env->wim);
+    registers[67] = tswap_abi(env->tbr);
+    registers[68] = tswap_abi(env->pc);
+    registers[69] = tswap_abi(env->npc);
+    registers[70] = tswap_abi(env->fsr);
     registers[71] = 0; /* csr */
     registers[72] = 0;
-    return 73 * sizeof(target_ulong);
+    return 73 * sizeof(uint32_t);
 #else
     /* fill in fprs */
     for (i = 0; i < 64; i += 2) {
 	uint64_t tmp;
 
-        tmp = (uint64_t)tswap32(*((uint32_t *)&env->fpr[i])) << 32;
-        tmp |= tswap32(*((uint32_t *)&env->fpr[i + 1]));
-        registers[i/2 + 32] = tmp;
+        tmp = ((uint64_t)*(uint32_t *)&env->fpr[i]) << 32;
+        tmp |= *(uint32_t *)&env->fpr[i + 1];
+        registers[i / 2 + 32] = tswap64(tmp);
     }
     registers[64] = tswapl(env->pc);
     registers[65] = tswapl(env->npc);
-    registers[66] = tswapl(env->tstate[env->tl]);
+    registers[66] = tswapl(((uint64_t)GET_CCR(env) << 32) |
+                           ((env->asi & 0xff) << 24) |
+                           ((env->pstate & 0xfff) << 8) |
+                           GET_CWP64(env));
     registers[67] = tswapl(env->fsr);
     registers[68] = tswapl(env->fprs);
     registers[69] = tswapl(env->y);
@@ -357,43 +537,58 @@ static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 
 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 {
+#ifdef TARGET_ABI32
+    abi_ulong *registers = (abi_ulong *)mem_buf;
+#else
     target_ulong *registers = (target_ulong *)mem_buf;
+#endif
     int i;
 
     /* fill in g0..g7 */
     for(i = 0; i < 7; i++) {
-        env->gregs[i] = tswapl(registers[i]);
+        env->gregs[i] = tswap_abi(registers[i]);
     }
     /* fill in register window */
     for(i = 0; i < 24; i++) {
-        env->regwptr[i] = tswapl(registers[i + 8]);
+        env->regwptr[i] = tswap_abi(registers[i + 8]);
     }
-#ifndef TARGET_SPARC64
+#if !defined(TARGET_SPARC64) || defined(TARGET_ABI32)
     /* fill in fprs */
     for (i = 0; i < 32; i++) {
-        *((uint32_t *)&env->fpr[i]) = tswapl(registers[i + 32]);
+        *((uint32_t *)&env->fpr[i]) = tswap_abi(registers[i + 32]);
     }
     /* Y, PSR, WIM, TBR, PC, NPC, FPSR, CPSR */
-    env->y = tswapl(registers[64]);
-    PUT_PSR(env, tswapl(registers[65]));
-    env->wim = tswapl(registers[66]);
-    env->tbr = tswapl(registers[67]);
-    env->pc = tswapl(registers[68]);
-    env->npc = tswapl(registers[69]);
-    env->fsr = tswapl(registers[70]);
+    env->y = tswap_abi(registers[64]);
+    PUT_PSR(env, tswap_abi(registers[65]));
+    env->wim = tswap_abi(registers[66]);
+    env->tbr = tswap_abi(registers[67]);
+    env->pc = tswap_abi(registers[68]);
+    env->npc = tswap_abi(registers[69]);
+    env->fsr = tswap_abi(registers[70]);
 #else
     for (i = 0; i < 64; i += 2) {
-	*((uint32_t *)&env->fpr[i]) = tswap32(registers[i/2 + 32] >> 32);
-	*((uint32_t *)&env->fpr[i + 1]) = tswap32(registers[i/2 + 32] & 0xffffffff);
+        uint64_t tmp;
+
+        tmp = tswap64(registers[i / 2 + 32]);
+	*((uint32_t *)&env->fpr[i]) = tmp >> 32;
+	*((uint32_t *)&env->fpr[i + 1]) = tmp & 0xffffffff;
     }
     env->pc = tswapl(registers[64]);
     env->npc = tswapl(registers[65]);
-    env->tstate[env->tl] = tswapl(registers[66]);
+    {
+        uint64_t tmp = tswapl(registers[66]);
+
+        PUT_CCR(env, tmp >> 32);
+        env->asi = (tmp >> 24) & 0xff;
+        env->pstate = (tmp >> 8) & 0xfff;
+        PUT_CWP64(env, tmp & 0xff);
+    }
     env->fsr = tswapl(registers[67]);
     env->fprs = tswapl(registers[68]);
     env->y = tswapl(registers[69]);
 #endif
 }
+#undef tswap_abi
 #elif defined (TARGET_ARM)
 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 {
@@ -434,6 +629,73 @@ static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
     ptr += 8 * 12 + 4;
     cpsr_write (env, tswapl(*(uint32_t *)ptr), 0xffffffff);
 }
+#elif defined (TARGET_M68K)
+static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
+{
+    int i;
+    uint8_t *ptr;
+    CPU_DoubleU u;
+
+    ptr = mem_buf;
+    /* D0-D7 */
+    for (i = 0; i < 8; i++) {
+        *(uint32_t *)ptr = tswapl(env->dregs[i]);
+        ptr += 4;
+    }
+    /* A0-A7 */
+    for (i = 0; i < 8; i++) {
+        *(uint32_t *)ptr = tswapl(env->aregs[i]);
+        ptr += 4;
+    }
+    *(uint32_t *)ptr = tswapl(env->sr);
+    ptr += 4;
+    *(uint32_t *)ptr = tswapl(env->pc);
+    ptr += 4;
+    /* F0-F7.  The 68881/68040 have 12-bit extended precision registers.
+       ColdFire has 8-bit double precision registers.  */
+    for (i = 0; i < 8; i++) {
+        u.d = env->fregs[i];
+        *(uint32_t *)ptr = tswap32(u.l.upper);
+        *(uint32_t *)ptr = tswap32(u.l.lower);
+    }
+    /* FP control regs (not implemented).  */
+    memset (ptr, 0, 3 * 4);
+    ptr += 3 * 4;
+
+    return ptr - mem_buf;
+}
+
+static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
+{
+    int i;
+    uint8_t *ptr;
+    CPU_DoubleU u;
+
+    ptr = mem_buf;
+    /* D0-D7 */
+    for (i = 0; i < 8; i++) {
+        env->dregs[i] = tswapl(*(uint32_t *)ptr);
+        ptr += 4;
+    }
+    /* A0-A7 */
+    for (i = 0; i < 8; i++) {
+        env->aregs[i] = tswapl(*(uint32_t *)ptr);
+        ptr += 4;
+    }
+    env->sr = tswapl(*(uint32_t *)ptr);
+    ptr += 4;
+    env->pc = tswapl(*(uint32_t *)ptr);
+    ptr += 4;
+    /* F0-F7.  The 68881/68040 have 12-bit extended precision registers.
+       ColdFire has 8-bit double precision registers.  */
+    for (i = 0; i < 8; i++) {
+        u.l.upper = tswap32(*(uint32_t *)ptr);
+        u.l.lower = tswap32(*(uint32_t *)ptr);
+        env->fregs[i] = u.d;
+    }
+    /* FP control regs (not implemented).  */
+    ptr += 3 * 4;
+}
 #elif defined (TARGET_MIPS)
 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 {
@@ -443,33 +705,75 @@ static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
     ptr = mem_buf;
     for (i = 0; i < 32; i++)
       {
-        *(uint32_t *)ptr = tswapl(env->gpr[i]);
-        ptr += 4;
+        *(target_ulong *)ptr = tswapl(env->active_tc.gpr[i]);
+        ptr += sizeof(target_ulong);
       }
 
-    *(uint32_t *)ptr = tswapl(env->CP0_Status);
-    ptr += 4;
+    *(target_ulong *)ptr = (int32_t)tswap32(env->CP0_Status);
+    ptr += sizeof(target_ulong);
 
-    *(uint32_t *)ptr = tswapl(env->LO);
-    ptr += 4;
+    *(target_ulong *)ptr = tswapl(env->active_tc.LO[0]);
+    ptr += sizeof(target_ulong);
 
-    *(uint32_t *)ptr = tswapl(env->HI);
-    ptr += 4;
+    *(target_ulong *)ptr = tswapl(env->active_tc.HI[0]);
+    ptr += sizeof(target_ulong);
 
-    *(uint32_t *)ptr = tswapl(env->CP0_BadVAddr);
-    ptr += 4;
+    *(target_ulong *)ptr = tswapl(env->CP0_BadVAddr);
+    ptr += sizeof(target_ulong);
 
-    *(uint32_t *)ptr = tswapl(env->CP0_Cause);
-    ptr += 4;
+    *(target_ulong *)ptr = (int32_t)tswap32(env->CP0_Cause);
+    ptr += sizeof(target_ulong);
 
-    *(uint32_t *)ptr = tswapl(env->PC);
-    ptr += 4;
+    *(target_ulong *)ptr = tswapl(env->active_tc.PC);
+    ptr += sizeof(target_ulong);
 
-    /* 32 FP registers, fsr, fir, fp.  Not yet implemented.  */
+    if (env->CP0_Config1 & (1 << CP0C1_FP))
+      {
+        for (i = 0; i < 32; i++)
+          {
+            if (env->CP0_Status & (1 << CP0St_FR))
+              *(target_ulong *)ptr = tswapl(env->fpu->fpr[i].d);
+            else
+              *(target_ulong *)ptr = tswap32(env->fpu->fpr[i].w[FP_ENDIAN_IDX]);
+            ptr += sizeof(target_ulong);
+          }
+
+        *(target_ulong *)ptr = (int32_t)tswap32(env->fpu->fcr31);
+        ptr += sizeof(target_ulong);
+
+        *(target_ulong *)ptr = (int32_t)tswap32(env->fpu->fcr0);
+        ptr += sizeof(target_ulong);
+      }
+
+    /* "fp", pseudo frame pointer. Not yet implemented in gdb. */
+    *(target_ulong *)ptr = 0;
+    ptr += sizeof(target_ulong);
+
+    /* Registers for embedded use, we just pad them. */
+    for (i = 0; i < 16; i++)
+      {
+        *(target_ulong *)ptr = 0;
+        ptr += sizeof(target_ulong);
+      }
+
+    /* Processor ID. */
+    *(target_ulong *)ptr = (int32_t)tswap32(env->CP0_PRid);
+    ptr += sizeof(target_ulong);
 
     return ptr - mem_buf;
 }
 
+/* convert MIPS rounding mode in FCR31 to IEEE library */
+static unsigned int ieee_rm[] =
+  {
+    float_round_nearest_even,
+    float_round_to_zero,
+    float_round_up,
+    float_round_down
+  };
+#define RESTORE_ROUNDING_MODE \
+    set_float_rounding_mode(ieee_rm[env->fpu->fcr31 & 3], &env->fpu->fp_status)
+
 static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
 {
     int i;
@@ -478,29 +782,57 @@ static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
     ptr = mem_buf;
     for (i = 0; i < 32; i++)
       {
-        env->gpr[i] = tswapl(*(uint32_t *)ptr);
-        ptr += 4;
+        env->active_tc.gpr[i] = tswapl(*(target_ulong *)ptr);
+        ptr += sizeof(target_ulong);
       }
 
-    env->CP0_Status = tswapl(*(uint32_t *)ptr);
-    ptr += 4;
+    env->CP0_Status = tswapl(*(target_ulong *)ptr);
+    ptr += sizeof(target_ulong);
 
-    env->LO = tswapl(*(uint32_t *)ptr);
-    ptr += 4;
+    env->active_tc.LO[0] = tswapl(*(target_ulong *)ptr);
+    ptr += sizeof(target_ulong);
 
-    env->HI = tswapl(*(uint32_t *)ptr);
-    ptr += 4;
+    env->active_tc.HI[0] = tswapl(*(target_ulong *)ptr);
+    ptr += sizeof(target_ulong);
 
-    env->CP0_BadVAddr = tswapl(*(uint32_t *)ptr);
-    ptr += 4;
+    env->CP0_BadVAddr = tswapl(*(target_ulong *)ptr);
+    ptr += sizeof(target_ulong);
 
-    env->CP0_Cause = tswapl(*(uint32_t *)ptr);
-    ptr += 4;
+    env->CP0_Cause = tswapl(*(target_ulong *)ptr);
+    ptr += sizeof(target_ulong);
 
-    env->PC = tswapl(*(uint32_t *)ptr);
-    ptr += 4;
+    env->active_tc.PC = tswapl(*(target_ulong *)ptr);
+    ptr += sizeof(target_ulong);
+
+    if (env->CP0_Config1 & (1 << CP0C1_FP))
+      {
+        for (i = 0; i < 32; i++)
+          {
+            if (env->CP0_Status & (1 << CP0St_FR))
+              env->fpu->fpr[i].d = tswapl(*(target_ulong *)ptr);
+            else
+              env->fpu->fpr[i].w[FP_ENDIAN_IDX] = tswapl(*(target_ulong *)ptr);
+            ptr += sizeof(target_ulong);
+          }
+
+        env->fpu->fcr31 = tswapl(*(target_ulong *)ptr) & 0xFF83FFFF;
+        ptr += sizeof(target_ulong);
+
+        /* The remaining registers are assumed to be read-only. */
+
+        /* set rounding mode */
+        RESTORE_ROUNDING_MODE;
+
+#ifndef CONFIG_SOFTFLOAT
+        /* no floating point exception for native float */
+        SET_FP_ENABLE(env->fcr31, 0);
+#endif
+      }
 }
 #elif defined (TARGET_SH4)
+
+/* Hint: Use "set architecture sh4" in GDB to see fpu registers */
+
 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
 {
   uint32_t *ptr = (uint32_t *)mem_buf;
@@ -520,12 +852,14 @@ static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
   SAVE (env->mach);
   SAVE (env->macl);
   SAVE (env->sr);
-  SAVE (0); /* TICKS */
-  SAVE (0); /* STALLS */
-  SAVE (0); /* CYCLES */
-  SAVE (0); /* INSTS */
-  SAVE (0); /* PLR */
-
+  SAVE (env->fpul);
+  SAVE (env->fpscr);
+  for (i = 0; i < 16; i++)
+      SAVE(env->fregs[i + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
+  SAVE (env->ssr);
+  SAVE (env->spc);
+  for (i = 0; i < 8; i++) SAVE(env->gregs[i]);
+  for (i = 0; i < 8; i++) SAVE(env->gregs[i + 16]);
   return ((uint8_t *)ptr - mem_buf);
 }
 
@@ -548,6 +882,74 @@ static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
   LOAD (env->mach);
   LOAD (env->macl);
   LOAD (env->sr);
+  LOAD (env->fpul);
+  LOAD (env->fpscr);
+  for (i = 0; i < 16; i++)
+      LOAD(env->fregs[i + ((env->fpscr & FPSCR_FR) ? 16 : 0)]);
+  LOAD (env->ssr);
+  LOAD (env->spc);
+  for (i = 0; i < 8; i++) LOAD(env->gregs[i]);
+  for (i = 0; i < 8; i++) LOAD(env->gregs[i + 16]);
+}
+#elif defined (TARGET_CRIS)
+
+static int cris_save_32 (unsigned char *d, uint32_t value)
+{
+	*d++ = (value);
+	*d++ = (value >>= 8);
+	*d++ = (value >>= 8);
+	*d++ = (value >>= 8);
+	return 4;
+}
+static int cris_save_16 (unsigned char *d, uint32_t value)
+{
+	*d++ = (value);
+	*d++ = (value >>= 8);
+	return 2;
+}
+static int cris_save_8 (unsigned char *d, uint32_t value)
+{
+	*d++ = (value);
+	return 1;
+}
+
+/* FIXME: this will bug on archs not supporting unaligned word accesses.  */
+static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
+{
+  uint8_t *ptr = mem_buf;
+  uint8_t srs;
+  int i;
+
+  for (i = 0; i < 16; i++)
+	  ptr += cris_save_32 (ptr, env->regs[i]);
+
+  srs = env->pregs[PR_SRS];
+
+  ptr += cris_save_8 (ptr, env->pregs[0]);
+  ptr += cris_save_8 (ptr, env->pregs[1]);
+  ptr += cris_save_32 (ptr, env->pregs[2]);
+  ptr += cris_save_8 (ptr, srs);
+  ptr += cris_save_16 (ptr, env->pregs[4]);
+
+  for (i = 5; i < 16; i++)
+	  ptr += cris_save_32 (ptr, env->pregs[i]);
+
+  ptr += cris_save_32 (ptr, env->pc);
+
+  for (i = 0; i < 16; i++)
+	  ptr += cris_save_32 (ptr, env->sregs[srs][i]);
+
+  return ((uint8_t *)ptr - mem_buf);
+}
+
+static void cpu_gdb_write_registers(CPUState *env, uint8_t *mem_buf, int size)
+{
+  uint32_t *ptr = (uint32_t *)mem_buf;
+  int i;
+
+#define LOAD(x) (x)=*ptr++;
+  for (i = 0; i < 16; i++) LOAD(env->regs[i]);
+  LOAD (env->pc);
 }
 #else
 static int cpu_gdb_read_registers(CPUState *env, uint8_t *mem_buf)
@@ -566,10 +968,10 @@ static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
     const char *p;
     int ch, reg_size, type;
     char buf[4096];
-    uint8_t mem_buf[2000];
+    uint8_t mem_buf[4096];
     uint32_t *registers;
     target_ulong addr, len;
-    
+
 #ifdef DEBUG_GDB
     printf("command='%s'\n", line_buf);
 #endif
@@ -580,6 +982,12 @@ static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
         /* TODO: Make this return the correct value for user-mode.  */
         snprintf(buf, sizeof(buf), "S%02x", SIGTRAP);
         put_packet(s, buf);
+        /* Remove all the breakpoints when this query is issued,
+         * because gdb is doing and initial connect and the state
+         * should be cleaned up.
+         */
+        cpu_breakpoint_remove_all(env);
+        cpu_watchpoint_remove_all(env);
         break;
     case 'c':
         if (*p != '\0') {
@@ -594,18 +1002,33 @@ static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
 #elif defined (TARGET_ARM)
             env->regs[15] = addr;
 #elif defined (TARGET_SH4)
-	    env->pc = addr;
+            env->pc = addr;
+#elif defined (TARGET_MIPS)
+            env->active_tc.PC = addr;
+#elif defined (TARGET_CRIS)
+            env->pc = addr;
 #endif
         }
-#ifdef CONFIG_USER_ONLY
-        s->running_state = 1;
-#else
-        vm_start();
-#endif
+        gdb_continue(s);
 	return RS_IDLE;
+    case 'C':
+        s->signal = strtoul(p, (char **)&p, 16);
+        gdb_continue(s);
+        return RS_IDLE;
+    case 'k':
+        /* Kill the target */
+        fprintf(stderr, "\nQEMU: Terminated via GDBstub\n");
+        exit(0);
+    case 'D':
+        /* Detach packet */
+        cpu_breakpoint_remove_all(env);
+        cpu_watchpoint_remove_all(env);
+        gdb_continue(s);
+        put_packet(s, "OK");
+        break;
     case 's':
         if (*p != '\0') {
-            addr = strtoul(p, (char **)&p, 16);
+            addr = strtoull(p, (char **)&p, 16);
 #if defined(TARGET_I386)
             env->eip = addr;
 #elif defined (TARGET_PPC)
@@ -616,16 +1039,40 @@ static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
 #elif defined (TARGET_ARM)
             env->regs[15] = addr;
 #elif defined (TARGET_SH4)
-	    env->pc = addr;
+            env->pc = addr;
+#elif defined (TARGET_MIPS)
+            env->active_tc.PC = addr;
+#elif defined (TARGET_CRIS)
+            env->pc = addr;
 #endif
         }
-        cpu_single_step(env, 1);
-#ifdef CONFIG_USER_ONLY
-        s->running_state = 1;
-#else
-        vm_start();
-#endif
+        cpu_single_step(env, sstep_flags);
+        gdb_continue(s);
 	return RS_IDLE;
+    case 'F':
+        {
+            target_ulong ret;
+            target_ulong err;
+
+            ret = strtoull(p, (char **)&p, 16);
+            if (*p == ',') {
+                p++;
+                err = strtoull(p, (char **)&p, 16);
+            } else {
+                err = 0;
+            }
+            if (*p == ',')
+                p++;
+            type = *p;
+            if (gdb_current_syscall_cb)
+                gdb_current_syscall_cb(s->env, ret, err);
+            if (type == 'C') {
+                put_packet(s, "T02");
+            } else {
+                gdb_continue(s);
+            }
+        }
+        break;
     case 'g':
         reg_size = cpu_gdb_read_registers(env, mem_buf);
         memtohex(buf, mem_buf, reg_size);
@@ -671,15 +1118,37 @@ static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
         if (*p == ',')
             p++;
         len = strtoull(p, (char **)&p, 16);
-        if (type == 0 || type == 1) {
+        switch (type) {
+        case 0:
+        case 1:
             if (cpu_breakpoint_insert(env, addr) < 0)
                 goto breakpoint_error;
             put_packet(s, "OK");
-        } else {
-        breakpoint_error:
-            put_packet(s, "E22");
+            break;
+#ifndef CONFIG_USER_ONLY
+        case 2:
+            type = PAGE_WRITE;
+            goto insert_watchpoint;
+        case 3:
+            type = PAGE_READ;
+            goto insert_watchpoint;
+        case 4:
+            type = PAGE_READ | PAGE_WRITE;
+        insert_watchpoint:
+            if (cpu_watchpoint_insert(env, addr, type) < 0)
+                goto breakpoint_error;
+            put_packet(s, "OK");
+            break;
+#endif
+        default:
+            put_packet(s, "");
+            break;
         }
         break;
+    breakpoint_error:
+        put_packet(s, "E22");
+        break;
+
     case 'z':
         type = strtoul(p, (char **)&p, 16);
         if (*p == ',')
@@ -691,24 +1160,57 @@ static int gdb_handle_packet(GDBState *s, CPUState *env, const char *line_buf)
         if (type == 0 || type == 1) {
             cpu_breakpoint_remove(env, addr);
             put_packet(s, "OK");
+#ifndef CONFIG_USER_ONLY
+        } else if (type >= 2 || type <= 4) {
+            cpu_watchpoint_remove(env, addr);
+            put_packet(s, "OK");
+#endif
         } else {
-            goto breakpoint_error;
+            put_packet(s, "");
         }
         break;
-#ifdef CONFIG_USER_ONLY
     case 'q':
-        if (strncmp(p, "Offsets", 7) == 0) {
+    case 'Q':
+        /* parse any 'q' packets here */
+        if (!strcmp(p,"qemu.sstepbits")) {
+            /* Query Breakpoint bit definitions */
+            snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
+                     SSTEP_ENABLE,
+                     SSTEP_NOIRQ,
+                     SSTEP_NOTIMER);
+            put_packet(s, buf);
+            break;
+        } else if (strncmp(p,"qemu.sstep",10) == 0) {
+            /* Display or change the sstep_flags */
+            p += 10;
+            if (*p != '=') {
+                /* Display current setting */
+                snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
+                put_packet(s, buf);
+                break;
+            }
+            p++;
+            type = strtoul(p, (char **)&p, 16);
+            sstep_flags = type;
+            put_packet(s, "OK");
+            break;
+        }
+#ifdef CONFIG_LINUX_USER
+        else if (strncmp(p, "Offsets", 7) == 0) {
             TaskState *ts = env->opaque;
 
-            sprintf(buf, "Text=%x;Data=%x;Bss=%x", ts->info->code_offset,
-                ts->info->data_offset, ts->info->data_offset);
+            snprintf(buf, sizeof(buf),
+                     "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
+                     ";Bss=" TARGET_ABI_FMT_lx,
+                     ts->info->code_offset,
+                     ts->info->data_offset,
+                     ts->info->data_offset);
             put_packet(s, buf);
             break;
         }
-        /* Fall through.  */
 #endif
+        /* Fall through.  */
     default:
-        //        unknown_command:
         /* put empty packet */
         buf[0] = '\0';
         put_packet(s, buf);
@@ -726,10 +1228,21 @@ static void gdb_vm_stopped(void *opaque, int reason)
     char buf[256];
     int ret;
 
+    if (s->state == RS_SYSCALL)
+        return;
+
     /* disable single step if it was enable */
     cpu_single_step(s->env, 0);
 
     if (reason == EXCP_DEBUG) {
+        if (s->env->watchpoint_hit) {
+            snprintf(buf, sizeof(buf), "T%02xwatch:" TARGET_FMT_lx ";",
+                     SIGTRAP,
+                     s->env->watchpoint[s->env->watchpoint_hit - 1].vaddr);
+            put_packet(s, buf);
+            s->env->watchpoint_hit = 0;
+            return;
+        }
 	tb_flush(s->env);
         ret = SIGTRAP;
     } else if (reason == EXCP_INTERRUPT) {
@@ -742,18 +1255,103 @@ static void gdb_vm_stopped(void *opaque, int reason)
 }
 #endif
 
+/* Send a gdb syscall request.
+   This accepts limited printf-style format specifiers, specifically:
+    %x  - target_ulong argument printed in hex.
+    %lx - 64-bit argument printed in hex.
+    %s  - string pointer (target_ulong) and length (int) pair.  */
+void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
+{
+    va_list va;
+    char buf[256];
+    char *p;
+    target_ulong addr;
+    uint64_t i64;
+    GDBState *s;
+
+    s = gdb_syscall_state;
+    if (!s)
+        return;
+    gdb_current_syscall_cb = cb;
+    s->state = RS_SYSCALL;
+#ifndef CONFIG_USER_ONLY
+    vm_stop(EXCP_DEBUG);
+#endif
+    s->state = RS_IDLE;
+    va_start(va, fmt);
+    p = buf;
+    *(p++) = 'F';
+    while (*fmt) {
+        if (*fmt == '%') {
+            fmt++;
+            switch (*fmt++) {
+            case 'x':
+                addr = va_arg(va, target_ulong);
+                p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
+                break;
+            case 'l':
+                if (*(fmt++) != 'x')
+                    goto bad_format;
+                i64 = va_arg(va, uint64_t);
+                p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
+                break;
+            case 's':
+                addr = va_arg(va, target_ulong);
+                p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
+                              addr, va_arg(va, int));
+                break;
+            default:
+            bad_format:
+                fprintf(stderr, "gdbstub: Bad syscall format string '%s'\n",
+                        fmt - 1);
+                break;
+            }
+        } else {
+            *(p++) = *(fmt++);
+        }
+    }
+    *p = 0;
+    va_end(va);
+    put_packet(s, buf);
+#ifdef CONFIG_USER_ONLY
+    gdb_handlesig(s->env, 0);
+#else
+    cpu_interrupt(s->env, CPU_INTERRUPT_EXIT);
+#endif
+}
+
 static void gdb_read_byte(GDBState *s, int ch)
 {
     CPUState *env = s->env;
     int i, csum;
-    char reply[1];
+    uint8_t reply;
 
 #ifndef CONFIG_USER_ONLY
+    if (s->last_packet_len) {
+        /* Waiting for a response to the last packet.  If we see the start
+           of a new command then abandon the previous response.  */
+        if (ch == '-') {
+#ifdef DEBUG_GDB
+            printf("Got NACK, retransmitting\n");
+#endif
+            put_buffer(s, (uint8_t *)s->last_packet, s->last_packet_len);
+        }
+#ifdef DEBUG_GDB
+        else if (ch == '+')
+            printf("Got ACK\n");
+        else
+            printf("Got '%c' when expecting ACK/NACK\n", ch);
+#endif
+        if (ch == '+' || ch == '$')
+            s->last_packet_len = 0;
+        if (ch != '$')
+            return;
+    }
     if (vm_running) {
         /* when the CPU is running, we cannot do anything except stop
            it when receiving a char */
         vm_stop(EXCP_INTERRUPT);
-    } else 
+    } else
 #endif
     {
         switch(s->state) {
@@ -784,15 +1382,17 @@ static void gdb_read_byte(GDBState *s, int ch)
                 csum += s->line_buf[i];
             }
             if (s->line_csum != (csum & 0xff)) {
-                reply[0] = '-';
-                put_buffer(s, reply, 1);
+                reply = '-';
+                put_buffer(s, &reply, 1);
                 s->state = RS_IDLE;
             } else {
-                reply[0] = '+';
-                put_buffer(s, reply, 1);
+                reply = '+';
+                put_buffer(s, &reply, 1);
                 s->state = gdb_handle_packet(s, env, s->line_buf);
             }
             break;
+        default:
+            abort();
         }
     }
 }
@@ -805,10 +1405,9 @@ gdb_handlesig (CPUState *env, int sig)
   char buf[256];
   int n;
 
-  if (gdbserver_fd < 0)
-    return sig;
-
   s = &gdbserver_state;
+  if (gdbserver_fd < 0 || s->fd < 0)
+    return sig;
 
   /* disable single step if it was enabled */
   cpu_single_step(env, 0);
@@ -819,6 +1418,10 @@ gdb_handlesig (CPUState *env, int sig)
       snprintf(buf, sizeof(buf), "S%02x", sig);
       put_packet(s, buf);
     }
+  /* put_packet() might have detected that the peer terminated the 
+     connection.  */
+  if (s->fd < 0)
+      return sig;
 
   sig = 0;
   s->state = RS_IDLE;
@@ -839,6 +1442,8 @@ gdb_handlesig (CPUState *env, int sig)
           return sig;
         }
   }
+  sig = s->signal;
+  s->signal = 0;
   return sig;
 }
 
@@ -848,38 +1453,14 @@ void gdb_exit(CPUState *env, int code)
   GDBState *s;
   char buf[4];
 
-  if (gdbserver_fd < 0)
-    return;
-
   s = &gdbserver_state;
+  if (gdbserver_fd < 0 || s->fd < 0)
+    return;
 
   snprintf(buf, sizeof(buf), "W%02x", code);
   put_packet(s, buf);
 }
 
-#else
-static void gdb_read(void *opaque)
-{
-    GDBState *s = opaque;
-    int i, size;
-    uint8_t buf[4096];
-
-    size = socket_recv(s->fd, buf, sizeof(buf));
-    if (size < 0)
-        return;
-    if (size == 0) {
-        /* end of connection */
-        qemu_del_vm_stop_handler(gdb_vm_stopped, s);
-        qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
-        qemu_free(s);
-        vm_start();
-    } else {
-        for(i = 0; i < size; i++)
-            gdb_read_byte(s, buf[i]);
-    }
-}
-
-#endif
 
 static void gdb_accept(void *opaque)
 {
@@ -899,37 +1480,20 @@ static void gdb_accept(void *opaque)
     /* set short latency */
     socket_set_lowlatency(fd);
     
-#ifdef CONFIG_USER_ONLY
     s = &gdbserver_state;
     memset (s, 0, sizeof (GDBState));
-#else
-    s = qemu_mallocz(sizeof(GDBState));
-    if (!s) {
-        close(fd);
-        return;
-    }
-#endif
     s->env = first_cpu; /* XXX: allow to change CPU */
     s->fd = fd;
 
-    socket_set_nonblock(fd);
-#ifndef CONFIG_USER_ONLY
-    socket_set_nonblock(fd);
-
-    /* stop the VM */
-    vm_stop(EXCP_INTERRUPT);
+    gdb_syscall_state = s;
 
-    /* start handling I/O */
-    qemu_set_fd_handler(s->fd, gdb_read, NULL, s);
-    /* when the VM is stopped, the following callback is called */
-    qemu_add_vm_stop_handler(gdb_vm_stopped, s);
-#endif
+    socket_set_nonblock(fd);
 }
 
 static int gdbserver_open(int port)
 {
     SockAddress  sockaddr;
-    int fd, ret;
+    int fd, val, ret;
 
     fd = socket_create_inet( SOCKET_STREAM );
     if (fd < 0) {
@@ -952,9 +1516,6 @@ static int gdbserver_open(int port)
         socket_close(fd);
         return -1;
     }
-#ifndef CONFIG_USER_ONLY
-    socket_set_nonblock(fd);
-#endif
     return fd;
 }
 
@@ -964,10 +1525,69 @@ int gdbserver_start(int port)
     if (gdbserver_fd < 0)
         return -1;
     /* accept connections */
-#ifdef CONFIG_USER_ONLY
     gdb_accept (NULL);
+    return 0;
+}
 #else
-    qemu_set_fd_handler(gdbserver_fd, gdb_accept, NULL, NULL);
-#endif
+static int gdb_chr_can_receive(void *opaque)
+{
+  return 1;
+}
+
+static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
+{
+    GDBState *s = opaque;
+    int i;
+
+    for (i = 0; i < size; i++) {
+        gdb_read_byte(s, buf[i]);
+    }
+}
+
+static void gdb_chr_event(void *opaque, int event)
+{
+    switch (event) {
+    case CHR_EVENT_RESET:
+        vm_stop(EXCP_INTERRUPT);
+        gdb_syscall_state = opaque;
+        break;
+    default:
+        break;
+    }
+}
+
+int gdbserver_start(const char *port)
+{
+    GDBState *s;
+    char gdbstub_port_name[128];
+    int port_num;
+    char *p;
+    CharDriverState *chr;
+
+    if (!port || !*port)
+      return -1;
+
+    port_num = strtol(port, &p, 10);
+    if (*p == 0) {
+        /* A numeric value is interpreted as a port number.  */
+        snprintf(gdbstub_port_name, sizeof(gdbstub_port_name),
+                 "tcp::%d,nowait,nodelay,server", port_num);
+        port = gdbstub_port_name;
+    }
+
+    chr = qemu_chr_open(port);
+    if (!chr)
+        return -1;
+
+    s = qemu_mallocz(sizeof(GDBState));
+    if (!s) {
+        return -1;
+    }
+    s->env = first_cpu; /* XXX: allow to change CPU */
+    s->chr = chr;
+    qemu_chr_add_handlers(chr, gdb_chr_can_receive, gdb_chr_receive,
+                          gdb_chr_event, s);
+    qemu_add_vm_stop_handler(gdb_vm_stopped, s);
     return 0;
 }
+#endif
diff --git a/gdbstub.h b/gdbstub.h
index 7b42596..ba65f93 100644
--- a/gdbstub.h
+++ b/gdbstub.h
@@ -1,12 +1,19 @@
 #ifndef GDBSTUB_H
 #define GDBSTUB_H
 
-#define DEFAULT_GDBSTUB_PORT 1234
+#define DEFAULT_GDBSTUB_PORT "1234"
 
+typedef void (*gdb_syscall_complete_cb)(CPUState *env,
+                                        target_ulong ret, target_ulong err);
+
+void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...);
+int use_gdb_syscalls(void);
 #ifdef CONFIG_USER_ONLY
 int gdb_handlesig (CPUState *, int);
 void gdb_exit(CPUState *, int);
-#endif
 int gdbserver_start(int);
+#else
+int gdbserver_start(const char *port);
+#endif
 
 #endif
diff --git a/gen-icount.h b/gen-icount.h
new file mode 100644
index 0000000..61545f1
--- /dev/null
+++ b/gen-icount.h
@@ -0,0 +1,56 @@
+/* Helpers for instruction counting code generation.  */
+
+static TCGArg *icount_arg;
+static int icount_label;
+
+static inline void gen_icount_start(void)
+{
+    TCGv count;
+
+    if (!use_icount)
+        return;
+
+    icount_label = gen_new_label();
+    /* FIXME: This generates lousy code.  We can't use tcg_new_temp because
+       count needs to live over the conditional branch.  To workaround this
+       we allow the target to supply a convenient register temporary.  */
+#ifndef ICOUNT_TEMP
+    count = tcg_temp_local_new(TCG_TYPE_I32);
+#else
+    count = ICOUNT_TEMP;
+#endif
+    tcg_gen_ld_i32(count, cpu_env, offsetof(CPUState, icount_decr.u32));
+    /* This is a horrid hack to allow fixing up the value later.  */
+    icount_arg = gen_opparam_ptr + 1;
+    tcg_gen_subi_i32(count, count, 0xdeadbeef);
+
+    tcg_gen_brcondi_i32(TCG_COND_LT, count, 0, icount_label);
+    tcg_gen_st16_i32(count, cpu_env, offsetof(CPUState, icount_decr.u16.low));
+#ifndef ICOUNT_TEMP
+    tcg_temp_free(count);
+#endif
+}
+
+static void gen_icount_end(TranslationBlock *tb, int num_insns)
+{
+    if (use_icount) {
+        *icount_arg = num_insns;
+        gen_set_label(icount_label);
+        tcg_gen_exit_tb((long)tb + 2);
+    }
+}
+
+static void inline gen_io_start(void)
+{
+    TCGv tmp = tcg_const_i32(1);
+    tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUState, can_do_io));
+    tcg_temp_free(tmp);
+}
+
+static inline void gen_io_end(void)
+{
+    TCGv tmp = tcg_const_i32(0);
+    tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUState, can_do_io));
+    tcg_temp_free(tmp);
+}
+
diff --git a/host-defs.h b/host-defs.h
new file mode 100644
index 0000000..686416a
--- /dev/null
+++ b/host-defs.h
@@ -0,0 +1,18 @@
+#ifndef _HOST_DEFS_H
+#define _HOST_DEFS_H
+
+/* all host-specific definitions should go here */
+
+#include "config-host.h"
+#include <stdint.h>
+
+#if HOST_LONG_BITS == 32
+typedef int32_t   host_long;
+typedef uint32_t  host_ulong;
+#elif HOST_LONG_BITS == 64
+typedef int64_t   host_long;
+typedef uint64_t  host_ulong;
+#endif
+
+#endif /* _HOST_DEFS_H */
+
diff --git a/host-utils.c b/host-utils.c
new file mode 100644
index 0000000..f92c339
--- /dev/null
+++ b/host-utils.c
@@ -0,0 +1,104 @@
+/*
+ * Utility compute operations used by translated code.
+ *
+ * Copyright (c) 2003 Fabrice Bellard
+ * Copyright (c) 2007 Aurelien Jarno
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "exec.h"
+#include "host-utils.h"
+
+//#define DEBUG_MULDIV
+
+/* Long integer helpers */
+#if !defined(__x86_64__)
+static void add128 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
+{
+    *plow += a;
+    /* carry test */
+    if (*plow < a)
+        (*phigh)++;
+    *phigh += b;
+}
+
+static void neg128 (uint64_t *plow, uint64_t *phigh)
+{
+    *plow = ~*plow;
+    *phigh = ~*phigh;
+    add128(plow, phigh, 1, 0);
+}
+
+static void mul64 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
+{
+    uint32_t a0, a1, b0, b1;
+    uint64_t v;
+
+    a0 = a;
+    a1 = a >> 32;
+
+    b0 = b;
+    b1 = b >> 32;
+
+    v = (uint64_t)a0 * (uint64_t)b0;
+    *plow = v;
+    *phigh = 0;
+
+    v = (uint64_t)a0 * (uint64_t)b1;
+    add128(plow, phigh, v << 32, v >> 32);
+
+    v = (uint64_t)a1 * (uint64_t)b0;
+    add128(plow, phigh, v << 32, v >> 32);
+
+    v = (uint64_t)a1 * (uint64_t)b1;
+    *phigh += v;
+}
+
+/* Unsigned 64x64 -> 128 multiplication */
+void mulu64 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
+{
+    mul64(plow, phigh, a, b);
+#if defined(DEBUG_MULDIV)
+    printf("mulu64: 0x%016llx * 0x%016llx = 0x%016llx%016llx\n",
+           a, b, *phigh, *plow);
+#endif
+}
+
+/* Signed 64x64 -> 128 multiplication */
+void muls64 (uint64_t *plow, uint64_t *phigh, int64_t a, int64_t b)
+{
+    int sa, sb;
+
+    sa = (a < 0);
+    if (sa)
+        a = -a;
+    sb = (b < 0);
+    if (sb)
+        b = -b;
+    mul64(plow, phigh, a, b);
+    if (sa ^ sb) {
+        neg128(plow, phigh);
+    }
+#if defined(DEBUG_MULDIV)
+    printf("muls64: 0x%016llx * 0x%016llx = 0x%016llx%016llx\n",
+           a, b, *phigh, *plow);
+#endif
+}
+#endif /* !defined(__x86_64__) */
diff --git a/host-utils.h b/host-utils.h
new file mode 100644
index 0000000..b1e799e
--- /dev/null
+++ b/host-utils.h
@@ -0,0 +1,204 @@
+/*
+ * Utility compute operations used by translated code.
+ *
+ * Copyright (c) 2007 Thiemo Seufer
+ * Copyright (c) 2007 Jocelyn Mayer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "osdep.h"
+
+#if defined(__x86_64__)
+#define __HAVE_FAST_MULU64__
+static always_inline void mulu64 (uint64_t *plow, uint64_t *phigh,
+                                  uint64_t a, uint64_t b)
+{
+    __asm__ ("mul %0\n\t"
+             : "=d" (*phigh), "=a" (*plow)
+             : "a" (a), "0" (b));
+}
+#define __HAVE_FAST_MULS64__
+static always_inline void muls64 (uint64_t *plow, uint64_t *phigh,
+                                  int64_t a, int64_t b)
+{
+    __asm__ ("imul %0\n\t"
+             : "=d" (*phigh), "=a" (*plow)
+             : "a" (a), "0" (b));
+}
+#else
+void muls64(uint64_t *phigh, uint64_t *plow, int64_t a, int64_t b);
+void mulu64(uint64_t *phigh, uint64_t *plow, uint64_t a, uint64_t b);
+#endif
+
+/* Note that some of those functions may end up calling libgcc functions,
+   depending on the host machine. It is up to the target emulation to
+   cope with that. */
+
+/* Binary search for leading zeros.  */
+
+static always_inline int clz32(uint32_t val)
+{
+    int cnt = 0;
+
+    if (!(val & 0xFFFF0000U)) {
+        cnt += 16;
+        val <<= 16;
+    }
+    if (!(val & 0xFF000000U)) {
+        cnt += 8;
+        val <<= 8;
+    }
+    if (!(val & 0xF0000000U)) {
+        cnt += 4;
+        val <<= 4;
+    }
+    if (!(val & 0xC0000000U)) {
+        cnt += 2;
+        val <<= 2;
+    }
+    if (!(val & 0x80000000U)) {
+        cnt++;
+        val <<= 1;
+    }
+    if (!(val & 0x80000000U)) {
+        cnt++;
+    }
+    return cnt;
+}
+
+static always_inline int clo32(uint32_t val)
+{
+    return clz32(~val);
+}
+
+static always_inline int clz64(uint64_t val)
+{
+    int cnt = 0;
+
+    if (!(val >> 32)) {
+        cnt += 32;
+    } else {
+        val >>= 32;
+    }
+
+    return cnt + clz32(val);
+}
+
+static always_inline int clo64(uint64_t val)
+{
+    return clz64(~val);
+}
+
+static always_inline int ctz32 (uint32_t val)
+{
+    int cnt;
+
+    cnt = 0;
+    if (!(val & 0x0000FFFFUL)) {
+         cnt += 16;
+        val >>= 16;
+     }
+    if (!(val & 0x000000FFUL)) {
+         cnt += 8;
+        val >>= 8;
+     }
+    if (!(val & 0x0000000FUL)) {
+         cnt += 4;
+        val >>= 4;
+     }
+    if (!(val & 0x00000003UL)) {
+         cnt += 2;
+        val >>= 2;
+     }
+    if (!(val & 0x00000001UL)) {
+         cnt++;
+        val >>= 1;
+     }
+    if (!(val & 0x00000001UL)) {
+         cnt++;
+     }
+
+     return cnt;
+ }
+ 
+static always_inline int cto32 (uint32_t val)
+ {
+    return ctz32(~val);
+}
+
+static always_inline int ctz64 (uint64_t val)
+{
+    int cnt;
+
+    cnt = 0;
+    if (!((uint32_t)val)) {
+        cnt += 32;
+        val >>= 32;
+    }
+
+    return cnt + ctz32(val);
+}
+
+static always_inline int cto64 (uint64_t val)
+{
+    return ctz64(~val);
+}
+
+static always_inline int ctpop8 (uint8_t val)
+{
+    val = (val & 0x55) + ((val >> 1) & 0x55);
+    val = (val & 0x33) + ((val >> 2) & 0x33);
+    val = (val & 0x0f) + ((val >> 4) & 0x0f);
+
+    return val;
+}
+
+static always_inline int ctpop16 (uint16_t val)
+{
+    val = (val & 0x5555) + ((val >> 1) & 0x5555);
+    val = (val & 0x3333) + ((val >> 2) & 0x3333);
+    val = (val & 0x0f0f) + ((val >> 4) & 0x0f0f);
+    val = (val & 0x00ff) + ((val >> 8) & 0x00ff);
+
+    return val;
+}
+
+static always_inline int ctpop32 (uint32_t val)
+{
+    val = (val & 0x55555555) + ((val >>  1) & 0x55555555);
+    val = (val & 0x33333333) + ((val >>  2) & 0x33333333);
+    val = (val & 0x0f0f0f0f) + ((val >>  4) & 0x0f0f0f0f);
+    val = (val & 0x00ff00ff) + ((val >>  8) & 0x00ff00ff);
+    val = (val & 0x0000ffff) + ((val >> 16) & 0x0000ffff);
+
+    return val;
+}
+
+static always_inline int ctpop64 (uint64_t val)
+{
+    val = (val & 0x5555555555555555ULL) + ((val >>  1) & 0x5555555555555555ULL);
+    val = (val & 0x3333333333333333ULL) + ((val >>  2) & 0x3333333333333333ULL);
+    val = (val & 0x0f0f0f0f0f0f0f0fULL) + ((val >>  4) & 0x0f0f0f0f0f0f0f0fULL);
+    val = (val & 0x00ff00ff00ff00ffULL) + ((val >>  8) & 0x00ff00ff00ff00ffULL);
+    val = (val & 0x0000ffff0000ffffULL) + ((val >> 16) & 0x0000ffff0000ffffULL);
+    val = (val & 0x00000000ffffffffULL) + ((val >> 32) & 0x00000000ffffffffULL);
+
+    return val;
+}
diff --git a/hostregs_helper.h b/hostregs_helper.h
new file mode 100644
index 0000000..4fdf8ad
--- /dev/null
+++ b/hostregs_helper.h
@@ -0,0 +1,98 @@
+/*
+ *  Save/restore host registrs.
+ *
+ *  Copyright (c) 2007 CodeSourcery
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* The GCC global register vairable extension is used to reserve some
+   host registers for use by dyngen.  However only the core parts of the
+   translation engine are compiled with these settings.  We must manually
+   save/restore these registers when called from regular code.
+   It is not sufficient to save/restore T0 et. al. as these may be declared
+   with a datatype smaller than the actual register.  */
+
+#if defined(DECLARE_HOST_REGS)
+
+#define DO_REG(REG)					\
+    register host_reg_t reg_AREG##REG asm(AREG##REG);	\
+    volatile host_reg_t saved_AREG##REG;
+
+#elif defined(SAVE_HOST_REGS)
+
+#define DO_REG(REG)					\
+    __asm__ __volatile__ ("" : "=r" (reg_AREG##REG));	\
+    saved_AREG##REG = reg_AREG##REG;
+
+#else
+
+#define DO_REG(REG)                                     \
+    reg_AREG##REG = saved_AREG##REG;		        \
+    __asm__ __volatile__ ("" : : "r" (reg_AREG##REG));
+
+#endif
+
+#ifdef AREG0
+DO_REG(0)
+#endif
+
+#ifdef AREG1
+DO_REG(1)
+#endif
+
+#ifdef AREG2
+DO_REG(2)
+#endif
+
+#ifdef AREG3
+DO_REG(3)
+#endif
+
+#ifdef AREG4
+DO_REG(4)
+#endif
+
+#ifdef AREG5
+DO_REG(5)
+#endif
+
+#ifdef AREG6
+DO_REG(6)
+#endif
+
+#ifdef AREG7
+DO_REG(7)
+#endif
+
+#ifdef AREG8
+DO_REG(8)
+#endif
+
+#ifdef AREG9
+DO_REG(9)
+#endif
+
+#ifdef AREG10
+DO_REG(10)
+#endif
+
+#ifdef AREG11
+DO_REG(11)
+#endif
+
+#undef SAVE_HOST_REGS
+#undef DECLARE_HOST_REGS
+#undef DO_REG
diff --git a/hw/android_arm.c b/hw/android_arm.c
index 3455054..efc8ba1 100644
--- a/hw/android_arm.c
+++ b/hw/android_arm.c
@@ -9,10 +9,18 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "hw.h"
+#include "boards.h"
+#include "devices.h"
+#include "net.h"
 #include "arm_pic.h"
+#include "sysemu.h"
 #include "goldfish_device.h"
 #include "android/globals.h"
+#include "audio/audio.h"
+#include "arm-misc.h"
+
+#define ARM_CPU_SAVE_VERSION  1
 
 int android_audio_enabled;
 char* audio_input_source = NULL;
@@ -49,18 +57,23 @@ uint32_t switch_test_write(void *opaque, uint32_t state)
 }
 #endif
 
-static void android_arm_init(int ram_size, int vga_ram_size,
-    int boot_device, DisplayState *ds, const char **fd_filename, int snapshot,
-    const char *kernel_filename, const char *kernel_cmdline,
-    const char *initrd_filename)
+static void android_arm_init(ram_addr_t ram_size, int vga_ram_size,
+    const char *boot_device, DisplayState *ds, 
+    const char *kernel_filename, 
+    const char *kernel_cmdline,
+    const char *initrd_filename,
+    const char *cpu_model)
 {
     CPUState *env;
     qemu_irq *cpu_pic;
     qemu_irq *goldfish_pic;
     int i;
+    struct arm_boot_info  info;
+
+    if (!cpu_model)
+        cpu_model = "arm926";
 
-    env = cpu_init();
-    cpu_arm_set_model(env, ARM_CPUID_ARM926);
+    env = cpu_init(cpu_model);
 
     register_savevm( "cpu", 0, ARM_CPU_SAVE_VERSION, cpu_save, cpu_load, env );
 
@@ -108,8 +121,11 @@ static void android_arm_init(int ram_size, int vga_ram_size,
         goldfish_audio_init(0xff004000, 0, audio_input_source);
     }
 #endif
-    if (bs_table[0])
-        goldfish_mmc_init(0xff005000, 0, bs_table[0]);
+    {
+        int  idx = drive_get_index( IF_IDE, 0, 0 );
+        if (idx >= 0)
+            goldfish_mmc_init(0xff005000, 0, drives_table[idx].bdrv);
+    }
 
     goldfish_memlog_init(0xff006000);
 
@@ -140,8 +156,15 @@ static void android_arm_init(int ram_size, int vga_ram_size,
     }
 #endif
 
-    arm_load_kernel(ram_size, kernel_filename, kernel_cmdline,
-                    initrd_filename, 1441);
+    memset(&info, 0, sizeof info);
+    info.ram_size        = ram_size;
+    info.kernel_filename = kernel_filename;
+    info.kernel_cmdline  = kernel_cmdline;
+    info.initrd_filename = initrd_filename;
+    info.nb_cpus         = 1;
+    info.board_id        = 1441;
+
+    arm_load_kernel(env, &info);
 }
 
 QEMUMachine android_arm_machine = {
diff --git a/hw/arm-misc.h b/hw/arm-misc.h
new file mode 100644
index 0000000..707e699
--- /dev/null
+++ b/hw/arm-misc.h
@@ -0,0 +1,49 @@
+/*
+ * Misc ARM declarations
+ *
+ * Copyright (c) 2006 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the LGPL.
+ *
+ */
+
+#ifndef ARM_MISC_H
+#define ARM_MISC_H 1
+
+#include "cpu.h"
+
+/* The CPU is also modeled as an interrupt controller.  */
+#define ARM_PIC_CPU_IRQ 0
+#define ARM_PIC_CPU_FIQ 1
+qemu_irq *arm_pic_init_cpu(CPUState *env);
+
+/* armv7m.c */
+qemu_irq *armv7m_init(int flash_size, int sram_size,
+                      const char *kernel_filename, const char *cpu_model);
+
+/* arm_boot.c */
+struct arm_boot_info {
+    int ram_size;
+    const char *kernel_filename;
+    const char *kernel_cmdline;
+    const char *initrd_filename;
+    target_phys_addr_t loader_start;
+    int nb_cpus;
+    int board_id;
+    int (*atag_board)(struct arm_boot_info *info, void *p);
+};
+void arm_load_kernel(CPUState *env, struct arm_boot_info *info);
+
+/* armv7m_nvic.c */
+
+/* Multiplication factor to convert from system clock ticks to qemu timer
+   ticks.  */
+int system_clock_scale;
+qemu_irq *armv7m_nvic_init(CPUState *env);
+
+/* stellaris_enent.c */
+void stellaris_enet_init(NICInfo *nd, uint32_t base, qemu_irq irq);
+
+#endif /* !ARM_MISC_H */
+
diff --git a/hw/arm_boot.c b/hw/arm_boot.c
index 0e28d4a..5990961 100644
--- a/hw/arm_boot.c
+++ b/hw/arm_boot.c
@@ -1,13 +1,15 @@
-/* 
+/*
  * ARM kernel loader.
  *
- * Copyright (c) 2006 CodeSourcery.
+ * Copyright (c) 2006-2007 CodeSourcery.
  * Written by Paul Brook
  *
  * This code is licenced under the GPL.
  */
 
-#include "vl.h"
+#include "hw.h"
+#include "arm-misc.h"
+#include "sysemu.h"
 
 #define KERNEL_ARGS_ADDR 0x100
 #define KERNEL_LOAD_ADDR 0x00010000
@@ -24,12 +26,39 @@ static uint32_t bootloader[] = {
   0  /* Kernel entry point.  Set by integratorcp_init.  */
 };
 
-static void set_kernel_args(uint32_t ram_size, int initrd_size,
-                            const char *kernel_cmdline)
+/* Entry point for secondary CPUs.  Enable interrupt controller and
+   Issue WFI until start address is written to system controller.  */
+static uint32_t smpboot[] = {
+  0xe3a00201, /* mov     r0, #0x10000000 */
+  0xe3800601, /* orr     r0, r0, #0x001000000 */
+  0xe3a01001, /* mov     r1, #1 */
+  0xe5801100, /* str     r1, [r0, #0x100] */
+  0xe3a00201, /* mov     r0, #0x10000000 */
+  0xe3800030, /* orr     r0, #0x30 */
+  0xe320f003, /* wfi */
+  0xe5901000, /* ldr     r1, [r0] */
+  0xe3110003, /* tst     r1, #3 */
+  0x1afffffb, /* bne     <wfi> */
+  0xe12fff11  /* bx      r1 */
+};
+
+static void main_cpu_reset(void *opaque)
+{
+    CPUState *env = opaque;
+
+    cpu_reset(env);
+    if (env->boot_info)
+        arm_load_kernel(env, env->boot_info);
+
+    /* TODO:  Reset secondary CPUs.  */
+}
+
+static void set_kernel_args(struct arm_boot_info *info,
+                int initrd_size, void *base)
 {
     uint32_t *p;
 
-    p = (uint32_t *)(phys_ram_base + KERNEL_ARGS_ADDR);
+    p = (uint32_t *)(base + KERNEL_ARGS_ADDR);
     /* ATAG_CORE */
     stl_raw(p++, 5);
     stl_raw(p++, 0x54410001);
@@ -37,69 +66,186 @@ static void set_kernel_args(uint32_t ram_size, int initrd_size,
     stl_raw(p++, 0x1000);
     stl_raw(p++, 0);
     /* ATAG_MEM */
+    /* TODO: handle multiple chips on one ATAG list */
     stl_raw(p++, 4);
     stl_raw(p++, 0x54410002);
-    stl_raw(p++, ram_size);
-    stl_raw(p++, 0);
+    stl_raw(p++, info->ram_size);
+    stl_raw(p++, info->loader_start);
     if (initrd_size) {
         /* ATAG_INITRD2 */
         stl_raw(p++, 4);
         stl_raw(p++, 0x54420005);
-        stl_raw(p++, INITRD_LOAD_ADDR);
+        stl_raw(p++, info->loader_start + INITRD_LOAD_ADDR);
         stl_raw(p++, initrd_size);
     }
-    if (kernel_cmdline && *kernel_cmdline) {
+    if (info->kernel_cmdline && *info->kernel_cmdline) {
         /* ATAG_CMDLINE */
         int cmdline_size;
 
-        cmdline_size = strlen(kernel_cmdline);
-        memcpy (p + 2, kernel_cmdline, cmdline_size + 1);
+        cmdline_size = strlen(info->kernel_cmdline);
+        memcpy(p + 2, info->kernel_cmdline, cmdline_size + 1);
         cmdline_size = (cmdline_size >> 2) + 1;
         stl_raw(p++, cmdline_size + 2);
         stl_raw(p++, 0x54410009);
         p += cmdline_size;
     }
+    if (info->atag_board) {
+        /* ATAG_BOARD */
+        int atag_board_len;
+
+        atag_board_len = (info->atag_board(info, p + 2) + 3) >> 2;
+        stl_raw(p++, 2 + atag_board_len);
+        stl_raw(p++, 0x414f4d50);
+        p += atag_board_len;
+    }
     /* ATAG_END */
     stl_raw(p++, 0);
     stl_raw(p++, 0);
 }
 
-void arm_load_kernel(int ram_size, const char *kernel_filename,
-                     const char *kernel_cmdline, const char *initrd_filename,
-                     int board_id)
+static void set_kernel_args_old(struct arm_boot_info *info,
+                int initrd_size, void *base)
+{
+    uint32_t *p;
+    unsigned char *s;
+
+    /* see linux/include/asm-arm/setup.h */
+    p = (uint32_t *)(base + KERNEL_ARGS_ADDR);
+    /* page_size */
+    stl_raw(p++, 4096);
+    /* nr_pages */
+    stl_raw(p++, info->ram_size / 4096);
+    /* ramdisk_size */
+    stl_raw(p++, 0);
+#define FLAG_READONLY	1
+#define FLAG_RDLOAD	4
+#define FLAG_RDPROMPT	8
+    /* flags */
+    stl_raw(p++, FLAG_READONLY | FLAG_RDLOAD | FLAG_RDPROMPT);
+    /* rootdev */
+    stl_raw(p++, (31 << 8) | 0);	/* /dev/mtdblock0 */
+    /* video_num_cols */
+    stl_raw(p++, 0);
+    /* video_num_rows */
+    stl_raw(p++, 0);
+    /* video_x */
+    stl_raw(p++, 0);
+    /* video_y */
+    stl_raw(p++, 0);
+    /* memc_control_reg */
+    stl_raw(p++, 0);
+    /* unsigned char sounddefault */
+    /* unsigned char adfsdrives */
+    /* unsigned char bytes_per_char_h */
+    /* unsigned char bytes_per_char_v */
+    stl_raw(p++, 0);
+    /* pages_in_bank[4] */
+    stl_raw(p++, 0);
+    stl_raw(p++, 0);
+    stl_raw(p++, 0);
+    stl_raw(p++, 0);
+    /* pages_in_vram */
+    stl_raw(p++, 0);
+    /* initrd_start */
+    if (initrd_size)
+        stl_raw(p++, info->loader_start + INITRD_LOAD_ADDR);
+    else
+        stl_raw(p++, 0);
+    /* initrd_size */
+    stl_raw(p++, initrd_size);
+    /* rd_start */
+    stl_raw(p++, 0);
+    /* system_rev */
+    stl_raw(p++, 0);
+    /* system_serial_low */
+    stl_raw(p++, 0);
+    /* system_serial_high */
+    stl_raw(p++, 0);
+    /* mem_fclk_21285 */
+    stl_raw(p++, 0);
+    /* zero unused fields */
+    memset(p, 0, 256 + 1024 -
+           (p - ((uint32_t *)(base + KERNEL_ARGS_ADDR))));
+    s = base + KERNEL_ARGS_ADDR + 256 + 1024;
+    if (info->kernel_cmdline)
+        strcpy (s, info->kernel_cmdline);
+    else
+        stb_raw(s, 0);
+}
+
+void arm_load_kernel(CPUState *env, struct arm_boot_info *info)
 {
     int kernel_size;
     int initrd_size;
     int n;
+    int is_linux = 0;
+    uint64_t elf_entry;
+    target_ulong entry;
+    uint32_t pd;
+    void *loader_phys;
 
     /* Load the kernel.  */
-    if (!kernel_filename) {
+    if (!info->kernel_filename) {
         fprintf(stderr, "Kernel image must be specified\n");
         exit(1);
     }
-    kernel_size = load_image(kernel_filename,
-                             phys_ram_base + KERNEL_LOAD_ADDR);
+
+    if (!env->boot_info) {
+        if (info->nb_cpus == 0)
+            info->nb_cpus = 1;
+        env->boot_info = info;
+        qemu_register_reset(main_cpu_reset, env);
+    }
+
+    pd = cpu_get_physical_page_desc(info->loader_start);
+    loader_phys = phys_ram_base + (pd & TARGET_PAGE_MASK) +
+            (info->loader_start & ~TARGET_PAGE_MASK);
+
+    /* Assume that raw images are linux kernels, and ELF images are not.  */
+    kernel_size = load_elf(info->kernel_filename, 0, &elf_entry, NULL, NULL);
+    entry = elf_entry;
+    if (kernel_size < 0) {
+        kernel_size = load_uboot(info->kernel_filename, &entry, &is_linux);
+    }
     if (kernel_size < 0) {
-        fprintf(stderr, "qemu: could not load kernel '%s'\n", kernel_filename);
+        kernel_size = load_image(info->kernel_filename,
+                                 loader_phys + KERNEL_LOAD_ADDR);
+        entry = info->loader_start + KERNEL_LOAD_ADDR;
+        is_linux = 1;
+    }
+    if (kernel_size < 0) {
+        fprintf(stderr, "qemu: could not load kernel '%s'\n",
+                info->kernel_filename);
         exit(1);
     }
-    if (initrd_filename) {
-        initrd_size = load_image(initrd_filename,
-                                 phys_ram_base + INITRD_LOAD_ADDR);
-        if (initrd_size < 0) {
-            fprintf(stderr, "qemu: could not load initrd '%s'\n",
-                    initrd_filename);
-            exit(1);
-        }
+    if (!is_linux) {
+        /* Jump to the entry point.  */
+        env->regs[15] = entry & 0xfffffffe;
+        env->thumb = entry & 1;
     } else {
-        initrd_size = 0;
+        if (info->initrd_filename) {
+            initrd_size = load_image(info->initrd_filename,
+                                     loader_phys + INITRD_LOAD_ADDR);
+            if (initrd_size < 0) {
+                fprintf(stderr, "qemu: could not load initrd '%s'\n",
+                        info->initrd_filename);
+                exit(1);
+            }
+        } else {
+            initrd_size = 0;
+        }
+        bootloader[1] |= info->board_id & 0xff;
+        bootloader[2] |= (info->board_id >> 8) & 0xff;
+        bootloader[5] = info->loader_start + KERNEL_ARGS_ADDR;
+        bootloader[6] = entry;
+        for (n = 0; n < sizeof(bootloader) / 4; n++)
+            stl_raw(loader_phys + (n * 4), bootloader[n]);
+        if (info->nb_cpus > 1)
+            for (n = 0; n < sizeof(smpboot) / 4; n++)
+                stl_raw(loader_phys + info->ram_size + (n * 4), smpboot[n]);
+        if (old_param)
+            set_kernel_args_old(info, initrd_size, loader_phys);
+        else
+            set_kernel_args(info, initrd_size, loader_phys);
     }
-    bootloader[1] |= board_id & 0xff;
-    bootloader[2] |= (board_id >> 8) & 0xff;
-    bootloader[5] = KERNEL_ARGS_ADDR;
-    bootloader[6] = KERNEL_LOAD_ADDR;
-    for (n = 0; n < sizeof(bootloader) / 4; n++)
-        stl_raw(phys_ram_base + (n * 4), bootloader[n]);
-    set_kernel_args(ram_size, initrd_size, kernel_cmdline);
 }
-
diff --git a/hw/arm_gic.c b/hw/arm_gic.c
new file mode 100644
index 0000000..54e99f4
--- /dev/null
+++ b/hw/arm_gic.c
@@ -0,0 +1,747 @@
+/*
+ * ARM Generic/Distributed Interrupt Controller
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+/* This file contains implementation code for the RealView EB interrupt
+   controller, MPCore distributed interrupt controller and ARMv7-M
+   Nested Vectored Interrupt Controller.  */
+
+//#define DEBUG_GIC
+
+#ifdef DEBUG_GIC
+#define DPRINTF(fmt, args...) \
+do { printf("arm_gic: " fmt , ##args); } while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#endif
+
+#ifdef NVIC
+static const uint8_t gic_id[] =
+{ 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 };
+#define GIC_DIST_OFFSET 0
+/* The NVIC has 16 internal vectors.  However these are not exposed
+   through the normal GIC interface.  */
+#define GIC_BASE_IRQ    32
+#else
+static const uint8_t gic_id[] =
+{ 0x90, 0x13, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
+#define GIC_DIST_OFFSET 0x1000
+#define GIC_BASE_IRQ    0
+#endif
+
+typedef struct gic_irq_state
+{
+    /* ??? The documentation seems to imply the enable bits are global, even
+       for per-cpu interrupts.  This seems strange.  */
+    unsigned enabled:1;
+    unsigned pending:NCPU;
+    unsigned active:NCPU;
+    unsigned level:1;
+    unsigned model:1; /* 0 = N:N, 1 = 1:N */
+    unsigned trigger:1; /* nonzero = edge triggered.  */
+} gic_irq_state;
+
+#define ALL_CPU_MASK ((1 << NCPU) - 1)
+
+#define GIC_SET_ENABLED(irq) s->irq_state[irq].enabled = 1
+#define GIC_CLEAR_ENABLED(irq) s->irq_state[irq].enabled = 0
+#define GIC_TEST_ENABLED(irq) s->irq_state[irq].enabled
+#define GIC_SET_PENDING(irq, cm) s->irq_state[irq].pending |= (cm)
+#define GIC_CLEAR_PENDING(irq, cm) s->irq_state[irq].pending &= ~(cm)
+#define GIC_TEST_PENDING(irq, cm) ((s->irq_state[irq].pending & (cm)) != 0)
+#define GIC_SET_ACTIVE(irq, cm) s->irq_state[irq].active |= (cm)
+#define GIC_CLEAR_ACTIVE(irq, cm) s->irq_state[irq].active &= ~(cm)
+#define GIC_TEST_ACTIVE(irq, cm) ((s->irq_state[irq].active & (cm)) != 0)
+#define GIC_SET_MODEL(irq) s->irq_state[irq].model = 1
+#define GIC_CLEAR_MODEL(irq) s->irq_state[irq].model = 0
+#define GIC_TEST_MODEL(irq) s->irq_state[irq].model
+#define GIC_SET_LEVEL(irq, cm) s->irq_state[irq].level = (cm)
+#define GIC_CLEAR_LEVEL(irq, cm) s->irq_state[irq].level &= ~(cm)
+#define GIC_TEST_LEVEL(irq, cm) ((s->irq_state[irq].level & (cm)) != 0)
+#define GIC_SET_TRIGGER(irq) s->irq_state[irq].trigger = 1
+#define GIC_CLEAR_TRIGGER(irq) s->irq_state[irq].trigger = 0
+#define GIC_TEST_TRIGGER(irq) s->irq_state[irq].trigger
+#define GIC_GET_PRIORITY(irq, cpu) \
+  (((irq) < 32) ? s->priority1[irq][cpu] : s->priority2[(irq) - 32])
+#ifdef NVIC
+#define GIC_TARGET(irq) 1
+#else
+#define GIC_TARGET(irq) s->irq_target[irq]
+#endif
+
+typedef struct gic_state
+{
+    uint32_t base;
+    qemu_irq parent_irq[NCPU];
+    int enabled;
+    int cpu_enabled[NCPU];
+
+    gic_irq_state irq_state[GIC_NIRQ];
+#ifndef NVIC
+    int irq_target[GIC_NIRQ];
+#endif
+    int priority1[32][NCPU];
+    int priority2[GIC_NIRQ - 32];
+    int last_active[GIC_NIRQ][NCPU];
+
+    int priority_mask[NCPU];
+    int running_irq[NCPU];
+    int running_priority[NCPU];
+    int current_pending[NCPU];
+
+    qemu_irq *in;
+#ifdef NVIC
+    void *nvic;
+#endif
+} gic_state;
+
+/* TODO: Many places that call this routine could be optimized.  */
+/* Update interrupt status after enabled or pending bits have been changed.  */
+static void gic_update(gic_state *s)
+{
+    int best_irq;
+    int best_prio;
+    int irq;
+    int level;
+    int cpu;
+    int cm;
+
+    for (cpu = 0; cpu < NCPU; cpu++) {
+        cm = 1 << cpu;
+        s->current_pending[cpu] = 1023;
+        if (!s->enabled || !s->cpu_enabled[cpu]) {
+	    qemu_irq_lower(s->parent_irq[cpu]);
+            return;
+        }
+        best_prio = 0x100;
+        best_irq = 1023;
+        for (irq = 0; irq < GIC_NIRQ; irq++) {
+            if (GIC_TEST_ENABLED(irq) && GIC_TEST_PENDING(irq, cm)) {
+                if (GIC_GET_PRIORITY(irq, cpu) < best_prio) {
+                    best_prio = GIC_GET_PRIORITY(irq, cpu);
+                    best_irq = irq;
+                }
+            }
+        }
+        level = 0;
+        if (best_prio <= s->priority_mask[cpu]) {
+            s->current_pending[cpu] = best_irq;
+            if (best_prio < s->running_priority[cpu]) {
+                DPRINTF("Raised pending IRQ %d\n", best_irq);
+                level = 1;
+            }
+        }
+        qemu_set_irq(s->parent_irq[cpu], level);
+    }
+}
+
+static void __attribute__((unused))
+gic_set_pending_private(gic_state *s, int cpu, int irq)
+{
+    int cm = 1 << cpu;
+
+    if (GIC_TEST_PENDING(irq, cm))
+        return;
+
+    DPRINTF("Set %d pending cpu %d\n", irq, cpu);
+    GIC_SET_PENDING(irq, cm);
+    gic_update(s);
+}
+
+/* Process a change in an external IRQ input.  */
+static void gic_set_irq(void *opaque, int irq, int level)
+{
+    gic_state *s = (gic_state *)opaque;
+    /* The first external input line is internal interrupt 32.  */
+    irq += 32;
+    if (level == GIC_TEST_LEVEL(irq, ALL_CPU_MASK))
+        return;
+
+    if (level) {
+        GIC_SET_LEVEL(irq, ALL_CPU_MASK);
+        if (GIC_TEST_TRIGGER(irq) || GIC_TEST_ENABLED(irq)) {
+            DPRINTF("Set %d pending mask %x\n", irq, GIC_TARGET(irq));
+            GIC_SET_PENDING(irq, GIC_TARGET(irq));
+        }
+    } else {
+        GIC_CLEAR_LEVEL(irq, ALL_CPU_MASK);
+    }
+    gic_update(s);
+}
+
+static void gic_set_running_irq(gic_state *s, int cpu, int irq)
+{
+    s->running_irq[cpu] = irq;
+    if (irq == 1023) {
+        s->running_priority[cpu] = 0x100;
+    } else {
+        s->running_priority[cpu] = GIC_GET_PRIORITY(irq, cpu);
+    }
+    gic_update(s);
+}
+
+static uint32_t gic_acknowledge_irq(gic_state *s, int cpu)
+{
+    int new_irq;
+    int cm = 1 << cpu;
+    new_irq = s->current_pending[cpu];
+    if (new_irq == 1023
+            || GIC_GET_PRIORITY(new_irq, cpu) >= s->running_priority[cpu]) {
+        DPRINTF("ACK no pending IRQ\n");
+        return 1023;
+    }
+    s->last_active[new_irq][cpu] = s->running_irq[cpu];
+    /* Clear pending flags for both level and edge triggered interrupts.
+       Level triggered IRQs will be reasserted once they become inactive.  */
+    GIC_CLEAR_PENDING(new_irq, GIC_TEST_MODEL(new_irq) ? ALL_CPU_MASK : cm);
+    gic_set_running_irq(s, cpu, new_irq);
+    DPRINTF("ACK %d\n", new_irq);
+    return new_irq;
+}
+
+static void gic_complete_irq(gic_state * s, int cpu, int irq)
+{
+    int update = 0;
+    int cm = 1 << cpu;
+    DPRINTF("EOI %d\n", irq);
+    if (s->running_irq[cpu] == 1023)
+        return; /* No active IRQ.  */
+    if (irq != 1023) {
+        /* Mark level triggered interrupts as pending if they are still
+           raised.  */
+        if (!GIC_TEST_TRIGGER(irq) && GIC_TEST_ENABLED(irq)
+                && GIC_TEST_LEVEL(irq, cm) && (GIC_TARGET(irq) & cm) != 0) {
+            DPRINTF("Set %d pending mask %x\n", irq, cm);
+            GIC_SET_PENDING(irq, cm);
+            update = 1;
+        }
+    }
+    if (irq != s->running_irq[cpu]) {
+        /* Complete an IRQ that is not currently running.  */
+        int tmp = s->running_irq[cpu];
+        while (s->last_active[tmp][cpu] != 1023) {
+            if (s->last_active[tmp][cpu] == irq) {
+                s->last_active[tmp][cpu] = s->last_active[irq][cpu];
+                break;
+            }
+            tmp = s->last_active[tmp][cpu];
+        }
+        if (update) {
+            gic_update(s);
+        }
+    } else {
+        /* Complete the current running IRQ.  */
+        gic_set_running_irq(s, cpu, s->last_active[s->running_irq[cpu]][cpu]);
+    }
+}
+
+static uint32_t gic_dist_readb(void *opaque, target_phys_addr_t offset)
+{
+    gic_state *s = (gic_state *)opaque;
+    uint32_t res;
+    int irq;
+    int i;
+    int cpu;
+    int cm;
+    int mask;
+
+    cpu = gic_get_current_cpu();
+    cm = 1 << cpu;
+    offset -= s->base + GIC_DIST_OFFSET;
+    if (offset < 0x100) {
+#ifndef NVIC
+        if (offset == 0)
+            return s->enabled;
+        if (offset == 4)
+            return ((GIC_NIRQ / 32) - 1) | ((NCPU - 1) << 5);
+        if (offset < 0x08)
+            return 0;
+#endif
+        goto bad_reg;
+    } else if (offset < 0x200) {
+        /* Interrupt Set/Clear Enable.  */
+        if (offset < 0x180)
+            irq = (offset - 0x100) * 8;
+        else
+            irq = (offset - 0x180) * 8;
+        irq += GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        res = 0;
+        for (i = 0; i < 8; i++) {
+            if (GIC_TEST_ENABLED(irq + i)) {
+                res |= (1 << i);
+            }
+        }
+    } else if (offset < 0x300) {
+        /* Interrupt Set/Clear Pending.  */
+        if (offset < 0x280)
+            irq = (offset - 0x200) * 8;
+        else
+            irq = (offset - 0x280) * 8;
+        irq += GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        res = 0;
+        mask = (irq < 32) ?  cm : ALL_CPU_MASK;
+        for (i = 0; i < 8; i++) {
+            if (GIC_TEST_PENDING(irq + i, mask)) {
+                res |= (1 << i);
+            }
+        }
+    } else if (offset < 0x400) {
+        /* Interrupt Active.  */
+        irq = (offset - 0x300) * 8 + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        res = 0;
+        mask = (irq < 32) ?  cm : ALL_CPU_MASK;
+        for (i = 0; i < 8; i++) {
+            if (GIC_TEST_ACTIVE(irq + i, mask)) {
+                res |= (1 << i);
+            }
+        }
+    } else if (offset < 0x800) {
+        /* Interrupt Priority.  */
+        irq = (offset - 0x400) + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        res = GIC_GET_PRIORITY(irq, cpu);
+#ifndef NVIC
+    } else if (offset < 0xc00) {
+        /* Interrupt CPU Target.  */
+        irq = (offset - 0x800) + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        if (irq >= 29 && irq <= 31) {
+            res = cm;
+        } else {
+            res = GIC_TARGET(irq);
+        }
+    } else if (offset < 0xf00) {
+        /* Interrupt Configuration.  */
+        irq = (offset - 0xc00) * 2 + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        res = 0;
+        for (i = 0; i < 4; i++) {
+            if (GIC_TEST_MODEL(irq + i))
+                res |= (1 << (i * 2));
+            if (GIC_TEST_TRIGGER(irq + i))
+                res |= (2 << (i * 2));
+        }
+#endif
+    } else if (offset < 0xfe0) {
+        goto bad_reg;
+    } else /* offset >= 0xfe0 */ {
+        if (offset & 3) {
+            res = 0;
+        } else {
+            res = gic_id[(offset - 0xfe0) >> 2];
+        }
+    }
+    return res;
+bad_reg:
+    cpu_abort(cpu_single_env, "gic_dist_readb: Bad offset %x\n", (int)offset);
+    return 0;
+}
+
+static uint32_t gic_dist_readw(void *opaque, target_phys_addr_t offset)
+{
+    uint32_t val;
+    val = gic_dist_readb(opaque, offset);
+    val |= gic_dist_readb(opaque, offset + 1) << 8;
+    return val;
+}
+
+static uint32_t gic_dist_readl(void *opaque, target_phys_addr_t offset)
+{
+    uint32_t val;
+#ifdef NVIC
+    gic_state *s = (gic_state *)opaque;
+    uint32_t addr;
+    addr = offset - s->base;
+    if (addr < 0x100 || addr > 0xd00)
+        return nvic_readl(s->nvic, addr);
+#endif
+    val = gic_dist_readw(opaque, offset);
+    val |= gic_dist_readw(opaque, offset + 2) << 16;
+    return val;
+}
+
+static void gic_dist_writeb(void *opaque, target_phys_addr_t offset,
+                            uint32_t value)
+{
+    gic_state *s = (gic_state *)opaque;
+    int irq;
+    int i;
+    int cpu;
+
+    cpu = gic_get_current_cpu();
+    offset -= s->base + GIC_DIST_OFFSET;
+    if (offset < 0x100) {
+#ifdef NVIC
+        goto bad_reg;
+#else
+        if (offset == 0) {
+            s->enabled = (value & 1);
+            DPRINTF("Distribution %sabled\n", s->enabled ? "En" : "Dis");
+        } else if (offset < 4) {
+            /* ignored.  */
+        } else {
+            goto bad_reg;
+        }
+#endif
+    } else if (offset < 0x180) {
+        /* Interrupt Set Enable.  */
+        irq = (offset - 0x100) * 8 + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        if (irq < 16)
+          value = 0xff;
+        for (i = 0; i < 8; i++) {
+            if (value & (1 << i)) {
+                int mask = (irq < 32) ? (1 << cpu) : GIC_TARGET(irq);
+                if (!GIC_TEST_ENABLED(irq + i))
+                    DPRINTF("Enabled IRQ %d\n", irq + i);
+                GIC_SET_ENABLED(irq + i);
+                /* If a raised level triggered IRQ enabled then mark
+                   is as pending.  */
+                if (GIC_TEST_LEVEL(irq + i, mask)
+                        && !GIC_TEST_TRIGGER(irq + i)) {
+                    DPRINTF("Set %d pending mask %x\n", irq + i, mask);
+                    GIC_SET_PENDING(irq + i, mask);
+                }
+            }
+        }
+    } else if (offset < 0x200) {
+        /* Interrupt Clear Enable.  */
+        irq = (offset - 0x180) * 8 + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        if (irq < 16)
+          value = 0;
+        for (i = 0; i < 8; i++) {
+            if (value & (1 << i)) {
+                if (GIC_TEST_ENABLED(irq + i))
+                    DPRINTF("Disabled IRQ %d\n", irq + i);
+                GIC_CLEAR_ENABLED(irq + i);
+            }
+        }
+    } else if (offset < 0x280) {
+        /* Interrupt Set Pending.  */
+        irq = (offset - 0x200) * 8 + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        if (irq < 16)
+          irq = 0;
+
+        for (i = 0; i < 8; i++) {
+            if (value & (1 << i)) {
+                GIC_SET_PENDING(irq + i, GIC_TARGET(irq));
+            }
+        }
+    } else if (offset < 0x300) {
+        /* Interrupt Clear Pending.  */
+        irq = (offset - 0x280) * 8 + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        for (i = 0; i < 8; i++) {
+            /* ??? This currently clears the pending bit for all CPUs, even
+               for per-CPU interrupts.  It's unclear whether this is the
+               corect behavior.  */
+            if (value & (1 << i)) {
+                GIC_CLEAR_PENDING(irq + i, ALL_CPU_MASK);
+            }
+        }
+    } else if (offset < 0x400) {
+        /* Interrupt Active.  */
+        goto bad_reg;
+    } else if (offset < 0x800) {
+        /* Interrupt Priority.  */
+        irq = (offset - 0x400) + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        if (irq < 32) {
+            s->priority1[irq][cpu] = value;
+        } else {
+            s->priority2[irq - 32] = value;
+        }
+#ifndef NVIC
+    } else if (offset < 0xc00) {
+        /* Interrupt CPU Target.  */
+        irq = (offset - 0x800) + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        if (irq < 29)
+            value = 0;
+        else if (irq < 32)
+            value = ALL_CPU_MASK;
+        s->irq_target[irq] = value & ALL_CPU_MASK;
+    } else if (offset < 0xf00) {
+        /* Interrupt Configuration.  */
+        irq = (offset - 0xc00) * 4 + GIC_BASE_IRQ;
+        if (irq >= GIC_NIRQ)
+            goto bad_reg;
+        if (irq < 32)
+            value |= 0xaa;
+        for (i = 0; i < 4; i++) {
+            if (value & (1 << (i * 2))) {
+                GIC_SET_MODEL(irq + i);
+            } else {
+                GIC_CLEAR_MODEL(irq + i);
+            }
+            if (value & (2 << (i * 2))) {
+                GIC_SET_TRIGGER(irq + i);
+            } else {
+                GIC_CLEAR_TRIGGER(irq + i);
+            }
+        }
+#endif
+    } else {
+        /* 0xf00 is only handled for 32-bit writes.  */
+        goto bad_reg;
+    }
+    gic_update(s);
+    return;
+bad_reg:
+    cpu_abort(cpu_single_env, "gic_dist_writeb: Bad offset %x\n", (int)offset);
+}
+
+static void gic_dist_writew(void *opaque, target_phys_addr_t offset,
+                            uint32_t value)
+{
+    gic_dist_writeb(opaque, offset, value & 0xff);
+    gic_dist_writeb(opaque, offset + 1, value >> 8);
+}
+
+static void gic_dist_writel(void *opaque, target_phys_addr_t offset,
+                            uint32_t value)
+{
+    gic_state *s = (gic_state *)opaque;
+#ifdef NVIC
+    uint32_t addr;
+    addr = offset - s->base;
+    if (addr < 0x100 || (addr > 0xd00 && addr != 0xf00)) {
+        nvic_writel(s->nvic, addr, value);
+        return;
+    }
+#endif
+    if (offset - s->base == GIC_DIST_OFFSET + 0xf00) {
+        int cpu;
+        int irq;
+        int mask;
+
+        cpu = gic_get_current_cpu();
+        irq = value & 0x3ff;
+        switch ((value >> 24) & 3) {
+        case 0:
+            mask = (value >> 16) & ALL_CPU_MASK;
+            break;
+        case 1:
+            mask = 1 << cpu;
+            break;
+        case 2:
+            mask = ALL_CPU_MASK ^ (1 << cpu);
+            break;
+        default:
+            DPRINTF("Bad Soft Int target filter\n");
+            mask = ALL_CPU_MASK;
+            break;
+        }
+        GIC_SET_PENDING(irq, mask);
+        gic_update(s);
+        return;
+    }
+    gic_dist_writew(opaque, offset, value & 0xffff);
+    gic_dist_writew(opaque, offset + 2, value >> 16);
+}
+
+static CPUReadMemoryFunc *gic_dist_readfn[] = {
+   gic_dist_readb,
+   gic_dist_readw,
+   gic_dist_readl
+};
+
+static CPUWriteMemoryFunc *gic_dist_writefn[] = {
+   gic_dist_writeb,
+   gic_dist_writew,
+   gic_dist_writel
+};
+
+#ifndef NVIC
+static uint32_t gic_cpu_read(gic_state *s, int cpu, int offset)
+{
+    switch (offset) {
+    case 0x00: /* Control */
+        return s->cpu_enabled[cpu];
+    case 0x04: /* Priority mask */
+        return s->priority_mask[cpu];
+    case 0x08: /* Binary Point */
+        /* ??? Not implemented.  */
+        return 0;
+    case 0x0c: /* Acknowledge */
+        return gic_acknowledge_irq(s, cpu);
+    case 0x14: /* Runing Priority */
+        return s->running_priority[cpu];
+    case 0x18: /* Highest Pending Interrupt */
+        return s->current_pending[cpu];
+    default:
+        cpu_abort(cpu_single_env, "gic_cpu_read: Bad offset %x\n",
+                  (int)offset);
+        return 0;
+    }
+}
+
+static void gic_cpu_write(gic_state *s, int cpu, int offset, uint32_t value)
+{
+    switch (offset) {
+    case 0x00: /* Control */
+        s->cpu_enabled[cpu] = (value & 1);
+        DPRINTF("CPU %sabled\n", s->cpu_enabled ? "En" : "Dis");
+        break;
+    case 0x04: /* Priority mask */
+        s->priority_mask[cpu] = (value & 0xff);
+        break;
+    case 0x08: /* Binary Point */
+        /* ??? Not implemented.  */
+        break;
+    case 0x10: /* End Of Interrupt */
+        return gic_complete_irq(s, cpu, value & 0x3ff);
+    default:
+        cpu_abort(cpu_single_env, "gic_cpu_write: Bad offset %x\n",
+                  (int)offset);
+        return;
+    }
+    gic_update(s);
+}
+#endif
+
+static void gic_reset(gic_state *s)
+{
+    int i;
+    memset(s->irq_state, 0, GIC_NIRQ * sizeof(gic_irq_state));
+    for (i = 0 ; i < NCPU; i++) {
+        s->priority_mask[i] = 0xf0;
+        s->current_pending[i] = 1023;
+        s->running_irq[i] = 1023;
+        s->running_priority[i] = 0x100;
+#ifdef NVIC
+        /* The NVIC doesn't have per-cpu interfaces, so enable by default.  */
+        s->cpu_enabled[i] = 1;
+#else
+        s->cpu_enabled[i] = 0;
+#endif
+    }
+    for (i = 0; i < 16; i++) {
+        GIC_SET_ENABLED(i);
+        GIC_SET_TRIGGER(i);
+    }
+#ifdef NVIC
+    /* The NVIC is always enabled.  */
+    s->enabled = 1;
+#else
+    s->enabled = 0;
+#endif
+}
+
+static void gic_save(QEMUFile *f, void *opaque)
+{
+    gic_state *s = (gic_state *)opaque;
+    int i;
+    int j;
+
+    qemu_put_be32(f, s->enabled);
+    for (i = 0; i < NCPU; i++) {
+        qemu_put_be32(f, s->cpu_enabled[i]);
+#ifndef NVIC
+        qemu_put_be32(f, s->irq_target[i]);
+#endif
+        for (j = 0; j < 32; j++)
+            qemu_put_be32(f, s->priority1[j][i]);
+        for (j = 0; j < GIC_NIRQ; j++)
+            qemu_put_be32(f, s->last_active[j][i]);
+        qemu_put_be32(f, s->priority_mask[i]);
+        qemu_put_be32(f, s->running_irq[i]);
+        qemu_put_be32(f, s->running_priority[i]);
+        qemu_put_be32(f, s->current_pending[i]);
+    }
+    for (i = 0; i < GIC_NIRQ - 32; i++) {
+        qemu_put_be32(f, s->priority2[i]);
+    }
+    for (i = 0; i < GIC_NIRQ; i++) {
+        qemu_put_byte(f, s->irq_state[i].enabled);
+        qemu_put_byte(f, s->irq_state[i].pending);
+        qemu_put_byte(f, s->irq_state[i].active);
+        qemu_put_byte(f, s->irq_state[i].level);
+        qemu_put_byte(f, s->irq_state[i].model);
+        qemu_put_byte(f, s->irq_state[i].trigger);
+    }
+}
+
+static int gic_load(QEMUFile *f, void *opaque, int version_id)
+{
+    gic_state *s = (gic_state *)opaque;
+    int i;
+    int j;
+
+    if (version_id != 1)
+        return -EINVAL;
+
+    s->enabled = qemu_get_be32(f);
+    for (i = 0; i < NCPU; i++) {
+        s->cpu_enabled[i] = qemu_get_be32(f);
+#ifndef NVIC
+        s->irq_target[i] = qemu_get_be32(f);
+#endif
+        for (j = 0; j < 32; j++)
+            s->priority1[j][i] = qemu_get_be32(f);
+        for (j = 0; j < GIC_NIRQ; j++)
+            s->last_active[j][i] = qemu_get_be32(f);
+        s->priority_mask[i] = qemu_get_be32(f);
+        s->running_irq[i] = qemu_get_be32(f);
+        s->running_priority[i] = qemu_get_be32(f);
+        s->current_pending[i] = qemu_get_be32(f);
+    }
+    for (i = 0; i < GIC_NIRQ - 32; i++) {
+        s->priority2[i] = qemu_get_be32(f);
+    }
+    for (i = 0; i < GIC_NIRQ; i++) {
+        s->irq_state[i].enabled = qemu_get_byte(f);
+        s->irq_state[i].pending = qemu_get_byte(f);
+        s->irq_state[i].active = qemu_get_byte(f);
+        s->irq_state[i].level = qemu_get_byte(f);
+        s->irq_state[i].model = qemu_get_byte(f);
+        s->irq_state[i].trigger = qemu_get_byte(f);
+    }
+
+    return 0;
+}
+
+static gic_state *gic_init(uint32_t base, qemu_irq *parent_irq)
+{
+    gic_state *s;
+    int iomemtype;
+    int i;
+
+    s = (gic_state *)qemu_mallocz(sizeof(gic_state));
+    if (!s)
+        return NULL;
+    s->in = qemu_allocate_irqs(gic_set_irq, s, GIC_NIRQ);
+    for (i = 0; i < NCPU; i++) {
+        s->parent_irq[i] = parent_irq[i];
+    }
+    iomemtype = cpu_register_io_memory(0, gic_dist_readfn,
+                                       gic_dist_writefn, s);
+    cpu_register_physical_memory(base + GIC_DIST_OFFSET, 0x00001000,
+                                 iomemtype);
+    s->base = base;
+    gic_reset(s);
+    register_savevm("arm_gic", -1, 1, gic_save, gic_load, s);
+    return s;
+}
diff --git a/hw/arm_pic.c b/hw/arm_pic.c
index c228c04..1fe55b7 100644
--- a/hw/arm_pic.c
+++ b/hw/arm_pic.c
@@ -1,4 +1,4 @@
-/* 
+/*
  * Generic ARM Programmable Interrupt Controller support.
  *
  * Copyright (c) 2006 CodeSourcery.
@@ -7,8 +7,8 @@
  * This code is licenced under the LGPL
  */
 
-#include "vl.h"
-#include "arm_pic.h"
+#include "hw.h"
+#include "arm-misc.h"
 
 /* Stub functions for hardware that doesn't exist.  */
 void pic_info(void)
@@ -19,7 +19,8 @@ void irq_info(void)
 {
 }
 
-/* Input 0 is IRQ and input 1 is FIQ */
+
+/* Input 0 is IRQ and input 1 is FIQ.  */
 static void arm_pic_cpu_handler(void *opaque, int irq, int level)
 {
     CPUState *env = (CPUState *)opaque;
@@ -37,8 +38,7 @@ static void arm_pic_cpu_handler(void *opaque, int irq, int level)
             cpu_reset_interrupt(env, CPU_INTERRUPT_FIQ);
         break;
     default:
-        cpu_abort(env, "arm_pic_cpu_handler: Bad interrput line %d\n",
-                  irq);
+        cpu_abort(env, "arm_pic_cpu_handler: Bad interrput line %d\n", irq);
     }
 }
 
diff --git a/hw/armv7m.c b/hw/armv7m.c
new file mode 100644
index 0000000..b2bad3c
--- /dev/null
+++ b/hw/armv7m.c
@@ -0,0 +1,206 @@
+/*
+ * ARMV7M System emulation.
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "hw.h"
+#include "arm-misc.h"
+#include "sysemu.h"
+
+/* Bitbanded IO.  Each word corresponds to a single bit.  */
+
+/* Get the byte address of the real memory for a bitband acess.  */
+static inline uint32_t bitband_addr(uint32_t addr)
+{
+    uint32_t res;
+
+    res = addr & 0xe0000000;
+    res |= (addr & 0x1ffffff) >> 5;
+    return res;
+
+}
+
+static uint32_t bitband_readb(void *opaque, target_phys_addr_t offset)
+{
+    uint8_t v;
+    cpu_physical_memory_read(bitband_addr(offset), &v, 1);
+    return (v & (1 << ((offset >> 2) & 7))) != 0;
+}
+
+static void bitband_writeb(void *opaque, target_phys_addr_t offset,
+                           uint32_t value)
+{
+    uint32_t addr;
+    uint8_t mask;
+    uint8_t v;
+    addr = bitband_addr(offset);
+    mask = (1 << ((offset >> 2) & 7));
+    cpu_physical_memory_read(addr, &v, 1);
+    if (value & 1)
+        v |= mask;
+    else
+        v &= ~mask;
+    cpu_physical_memory_write(addr, &v, 1);
+}
+
+static uint32_t bitband_readw(void *opaque, target_phys_addr_t offset)
+{
+    uint32_t addr;
+    uint16_t mask;
+    uint16_t v;
+    addr = bitband_addr(offset) & ~1;
+    mask = (1 << ((offset >> 2) & 15));
+    mask = tswap16(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 2);
+    return (v & mask) != 0;
+}
+
+static void bitband_writew(void *opaque, target_phys_addr_t offset,
+                           uint32_t value)
+{
+    uint32_t addr;
+    uint16_t mask;
+    uint16_t v;
+    addr = bitband_addr(offset) & ~1;
+    mask = (1 << ((offset >> 2) & 15));
+    mask = tswap16(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 2);
+    if (value & 1)
+        v |= mask;
+    else
+        v &= ~mask;
+    cpu_physical_memory_write(addr, (uint8_t *)&v, 2);
+}
+
+static uint32_t bitband_readl(void *opaque, target_phys_addr_t offset)
+{
+    uint32_t addr;
+    uint32_t mask;
+    uint32_t v;
+    addr = bitband_addr(offset) & ~3;
+    mask = (1 << ((offset >> 2) & 31));
+    mask = tswap32(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 4);
+    return (v & mask) != 0;
+}
+
+static void bitband_writel(void *opaque, target_phys_addr_t offset,
+                           uint32_t value)
+{
+    uint32_t addr;
+    uint32_t mask;
+    uint32_t v;
+    addr = bitband_addr(offset) & ~3;
+    mask = (1 << ((offset >> 2) & 31));
+    mask = tswap32(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 4);
+    if (value & 1)
+        v |= mask;
+    else
+        v &= ~mask;
+    cpu_physical_memory_write(addr, (uint8_t *)&v, 4);
+}
+
+static CPUReadMemoryFunc *bitband_readfn[] = {
+   bitband_readb,
+   bitband_readw,
+   bitband_readl
+};
+
+static CPUWriteMemoryFunc *bitband_writefn[] = {
+   bitband_writeb,
+   bitband_writew,
+   bitband_writel
+};
+
+static void armv7m_bitband_init(void)
+{
+    int iomemtype;
+
+    iomemtype = cpu_register_io_memory(0, bitband_readfn, bitband_writefn,
+                                       NULL);
+    cpu_register_physical_memory(0x22000000, 0x02000000, iomemtype);
+    cpu_register_physical_memory(0x42000000, 0x02000000, iomemtype);
+}
+
+/* Board init.  */
+/* Init CPU and memory for a v7-M based board.
+   flash_size and sram_size are in kb.
+   Returns the NVIC array.  */
+
+qemu_irq *armv7m_init(int flash_size, int sram_size,
+                      const char *kernel_filename, const char *cpu_model)
+{
+    CPUState *env;
+    qemu_irq *pic;
+    uint32_t pc;
+    int image_size;
+    uint64_t entry;
+    uint64_t lowaddr;
+
+    flash_size *= 1024;
+    sram_size *= 1024;
+
+    if (!cpu_model)
+	cpu_model = "cortex-m3";
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
+
+#if 0
+    /* > 32Mb SRAM gets complicated because it overlaps the bitband area.
+       We don't have proper commandline options, so allocate half of memory
+       as SRAM, up to a maximum of 32Mb, and the rest as code.  */
+    if (ram_size > (512 + 32) * 1024 * 1024)
+        ram_size = (512 + 32) * 1024 * 1024;
+    sram_size = (ram_size / 2) & TARGET_PAGE_MASK;
+    if (sram_size > 32 * 1024 * 1024)
+        sram_size = 32 * 1024 * 1024;
+    code_size = ram_size - sram_size;
+#endif
+
+    /* Flash programming is done via the SCU, so pretend it is ROM.  */
+    cpu_register_physical_memory(0, flash_size, IO_MEM_ROM);
+    cpu_register_physical_memory(0x20000000, sram_size,
+                                 flash_size + IO_MEM_RAM);
+    armv7m_bitband_init();
+
+    pic = armv7m_nvic_init(env);
+
+    image_size = load_elf(kernel_filename, 0, &entry, &lowaddr, NULL);
+    if (image_size < 0) {
+        image_size = load_image(kernel_filename, phys_ram_base);
+	lowaddr = 0;
+    }
+    if (image_size < 0) {
+        fprintf(stderr, "qemu: could not load kernel '%s'\n",
+                kernel_filename);
+        exit(1);
+    }
+
+    /* If the image was loaded at address zero then assume it is a
+       regular ROM image and perform the normal CPU reset sequence.
+       Otherwise jump directly to the entry point.  */
+    if (lowaddr == 0) {
+	env->regs[13] = tswap32(*(uint32_t *)phys_ram_base);
+	pc = tswap32(*(uint32_t *)(phys_ram_base + 4));
+    } else {
+	pc = entry;
+    }
+    env->thumb = pc & 1;
+    env->regs[15] = pc & ~1;
+
+    /* Hack to map an additional page of ram at the top of the address
+       space.  This stops qemu complaining about executing code outside RAM
+       when returning from an exception.  */
+    cpu_register_physical_memory(0xfffff000, 0x1000, IO_MEM_RAM + ram_size);
+
+    return pic;
+}
+
diff --git a/hw/armv7m_nvic.c b/hw/armv7m_nvic.c
new file mode 100644
index 0000000..c55c958
--- /dev/null
+++ b/hw/armv7m_nvic.c
@@ -0,0 +1,407 @@
+/*
+ * ARM Nested Vectored Interrupt Controller
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ *
+ * The ARMv7M System controller is fairly tightly tied in with the
+ * NVIC.  Much of that is also implemented here.
+ */
+
+#include "hw.h"
+#include "qemu-timer.h"
+#include "arm-misc.h"
+
+/* 32 internal lines (16 used for system exceptions) plus 64 external
+   interrupt lines.  */
+#define GIC_NIRQ 96
+#define NCPU 1
+#define NVIC 1
+
+/* Only a single "CPU" interface is present.  */
+static inline int
+gic_get_current_cpu(void)
+{
+    return 0;
+}
+
+static uint32_t nvic_readl(void *opaque, uint32_t offset);
+static void nvic_writel(void *opaque, uint32_t offset, uint32_t value);
+
+#include "arm_gic.c"
+
+typedef struct {
+    struct {
+        uint32_t control;
+        uint32_t reload;
+        int64_t tick;
+        QEMUTimer *timer;
+    } systick;
+    gic_state *gic;
+} nvic_state;
+
+/* qemu timers run at 1GHz.   We want something closer to 1MHz.  */
+#define SYSTICK_SCALE 1000ULL
+
+#define SYSTICK_ENABLE    (1 << 0)
+#define SYSTICK_TICKINT   (1 << 1)
+#define SYSTICK_CLKSOURCE (1 << 2)
+#define SYSTICK_COUNTFLAG (1 << 16)
+
+/* Conversion factor from qemu timer to SysTick frequencies.  */
+static inline int64_t systick_scale(nvic_state *s)
+{
+    if (s->systick.control & SYSTICK_CLKSOURCE)
+        return system_clock_scale;
+    else
+        return 1000;
+}
+
+static void systick_reload(nvic_state *s, int reset)
+{
+    if (reset)
+        s->systick.tick = qemu_get_clock(vm_clock);
+    s->systick.tick += (s->systick.reload + 1) * systick_scale(s);
+    qemu_mod_timer(s->systick.timer, s->systick.tick);
+}
+
+static void systick_timer_tick(void * opaque)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    s->systick.control |= SYSTICK_COUNTFLAG;
+    if (s->systick.control & SYSTICK_TICKINT) {
+        /* Trigger the interrupt.  */
+        armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK);
+    }
+    if (s->systick.reload == 0) {
+        s->systick.control &= ~SYSTICK_ENABLE;
+    } else {
+        systick_reload(s, 0);
+    }
+}
+
+/* The external routines use the hardware vector numbering, ie. the first
+   IRQ is #16.  The internal GIC routines use #32 as the first IRQ.  */
+void armv7m_nvic_set_pending(void *opaque, int irq)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    if (irq >= 16)
+        irq += 16;
+    gic_set_pending_private(s->gic, 0, irq);
+}
+
+/* Make pending IRQ active.  */
+int armv7m_nvic_acknowledge_irq(void *opaque)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    uint32_t irq;
+
+    irq = gic_acknowledge_irq(s->gic, 0);
+    if (irq == 1023)
+        cpu_abort(cpu_single_env, "Interrupt but no vector\n");
+    if (irq >= 32)
+        irq -= 16;
+    return irq;
+}
+
+void armv7m_nvic_complete_irq(void *opaque, int irq)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    if (irq >= 16)
+        irq += 16;
+    gic_complete_irq(s->gic, 0, irq);
+}
+
+static uint32_t nvic_readl(void *opaque, uint32_t offset)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    uint32_t val;
+    int irq;
+
+    switch (offset) {
+    case 4: /* Interrupt Control Type.  */
+        return (GIC_NIRQ / 32) - 1;
+    case 0x10: /* SysTick Control and Status.  */
+        val = s->systick.control;
+        s->systick.control &= ~SYSTICK_COUNTFLAG;
+        return val;
+    case 0x14: /* SysTick Reload Value.  */
+        return s->systick.reload;
+    case 0x18: /* SysTick Current Value.  */
+        {
+            int64_t t;
+            if ((s->systick.control & SYSTICK_ENABLE) == 0)
+                return 0;
+            t = qemu_get_clock(vm_clock);
+            if (t >= s->systick.tick)
+                return 0;
+            val = ((s->systick.tick - (t + 1)) / systick_scale(s)) + 1;
+            /* The interrupt in triggered when the timer reaches zero.
+               However the counter is not reloaded until the next clock
+               tick.  This is a hack to return zero during the first tick.  */
+            if (val > s->systick.reload)
+                val = 0;
+            return val;
+        }
+    case 0x1c: /* SysTick Calibration Value.  */
+        return 10000;
+    case 0xd00: /* CPUID Base.  */
+        return cpu_single_env->cp15.c0_cpuid;
+    case 0xd04: /* Interrypt Control State.  */
+        /* VECTACTIVE */
+        val = s->gic->running_irq[0];
+        if (val == 1023) {
+            val = 0;
+        } else if (val >= 32) {
+            val -= 16;
+        }
+        /* RETTOBASE */
+        if (s->gic->running_irq[0] == 1023
+                || s->gic->last_active[s->gic->running_irq[0]][0] == 1023) {
+            val |= (1 << 11);
+        }
+        /* VECTPENDING */
+        if (s->gic->current_pending[0] != 1023)
+            val |= (s->gic->current_pending[0] << 12);
+        /* ISRPENDING */
+        for (irq = 32; irq < GIC_NIRQ; irq++) {
+            if (s->gic->irq_state[irq].pending) {
+                val |= (1 << 22);
+                break;
+            }
+        }
+        /* PENDSTSET */
+        if (s->gic->irq_state[ARMV7M_EXCP_SYSTICK].pending)
+            val |= (1 << 26);
+        /* PENDSVSET */
+        if (s->gic->irq_state[ARMV7M_EXCP_PENDSV].pending)
+            val |= (1 << 28);
+        /* NMIPENDSET */
+        if (s->gic->irq_state[ARMV7M_EXCP_NMI].pending)
+            val |= (1 << 31);
+        return val;
+    case 0xd08: /* Vector Table Offset.  */
+        return cpu_single_env->v7m.vecbase;
+    case 0xd0c: /* Application Interrupt/Reset Control.  */
+        return 0xfa05000;
+    case 0xd10: /* System Control.  */
+        /* TODO: Implement SLEEPONEXIT.  */
+        return 0;
+    case 0xd14: /* Configuration Control.  */
+        /* TODO: Implement Configuration Control bits.  */
+        return 0;
+    case 0xd18: case 0xd1c: case 0xd20: /* System Handler Priority.  */
+        irq = offset - 0xd14;
+        val = 0;
+        val = s->gic->priority1[irq++][0];
+        val = s->gic->priority1[irq++][0] << 8;
+        val = s->gic->priority1[irq++][0] << 16;
+        val = s->gic->priority1[irq][0] << 24;
+        return val;
+    case 0xd24: /* System Handler Status.  */
+        val = 0;
+        if (s->gic->irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0);
+        if (s->gic->irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1);
+        if (s->gic->irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3);
+        if (s->gic->irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7);
+        if (s->gic->irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8);
+        if (s->gic->irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10);
+        if (s->gic->irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11);
+        if (s->gic->irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12);
+        if (s->gic->irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13);
+        if (s->gic->irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14);
+        if (s->gic->irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15);
+        if (s->gic->irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16);
+        if (s->gic->irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17);
+        if (s->gic->irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18);
+        return val;
+    case 0xd28: /* Configurable Fault Status.  */
+        /* TODO: Implement Fault Status.  */
+        cpu_abort(cpu_single_env,
+                  "Not implemented: Configurable Fault Status.");
+        return 0;
+    case 0xd2c: /* Hard Fault Status.  */
+    case 0xd30: /* Debug Fault Status.  */
+    case 0xd34: /* Mem Manage Address.  */
+    case 0xd38: /* Bus Fault Address.  */
+    case 0xd3c: /* Aux Fault Status.  */
+        /* TODO: Implement fault status registers.  */
+        goto bad_reg;
+    case 0xd40: /* PFR0.  */
+        return 0x00000030;
+    case 0xd44: /* PRF1.  */
+        return 0x00000200;
+    case 0xd48: /* DFR0.  */
+        return 0x00100000;
+    case 0xd4c: /* AFR0.  */
+        return 0x00000000;
+    case 0xd50: /* MMFR0.  */
+        return 0x00000030;
+    case 0xd54: /* MMFR1.  */
+        return 0x00000000;
+    case 0xd58: /* MMFR2.  */
+        return 0x00000000;
+    case 0xd5c: /* MMFR3.  */
+        return 0x00000000;
+    case 0xd60: /* ISAR0.  */
+        return 0x01141110;
+    case 0xd64: /* ISAR1.  */
+        return 0x02111000;
+    case 0xd68: /* ISAR2.  */
+        return 0x21112231;
+    case 0xd6c: /* ISAR3.  */
+        return 0x01111110;
+    case 0xd70: /* ISAR4.  */
+        return 0x01310102;
+    /* TODO: Implement debug registers.  */
+    default:
+    bad_reg:
+        cpu_abort(cpu_single_env, "NVIC: Bad read offset 0x%x\n", offset);
+    }
+}
+
+static void nvic_writel(void *opaque, uint32_t offset, uint32_t value)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    uint32_t oldval;
+    switch (offset) {
+    case 0x10: /* SysTick Control and Status.  */
+        oldval = s->systick.control;
+        s->systick.control &= 0xfffffff8;
+        s->systick.control |= value & 7;
+        if ((oldval ^ value) & SYSTICK_ENABLE) {
+            int64_t now = qemu_get_clock(vm_clock);
+            if (value & SYSTICK_ENABLE) {
+                if (s->systick.tick) {
+                    s->systick.tick += now;
+                    qemu_mod_timer(s->systick.timer, s->systick.tick);
+                } else {
+                    systick_reload(s, 1);
+                }
+            } else {
+                qemu_del_timer(s->systick.timer);
+                s->systick.tick -= now;
+                if (s->systick.tick < 0)
+                  s->systick.tick = 0;
+            }
+        } else if ((oldval ^ value) & SYSTICK_CLKSOURCE) {
+            /* This is a hack. Force the timer to be reloaded
+               when the reference clock is changed.  */
+            systick_reload(s, 1);
+        }
+        break;
+    case 0x14: /* SysTick Reload Value.  */
+        s->systick.reload = value;
+        break;
+    case 0x18: /* SysTick Current Value.  Writes reload the timer.  */
+        systick_reload(s, 1);
+        s->systick.control &= ~SYSTICK_COUNTFLAG;
+        break;
+    case 0xd04: /* Interrupt Control State.  */
+        if (value & (1 << 31)) {
+            armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI);
+        }
+        if (value & (1 << 28)) {
+            armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV);
+        } else if (value & (1 << 27)) {
+            s->gic->irq_state[ARMV7M_EXCP_PENDSV].pending = 0;
+            gic_update(s->gic);
+        }
+        if (value & (1 << 26)) {
+            armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK);
+        } else if (value & (1 << 25)) {
+            s->gic->irq_state[ARMV7M_EXCP_SYSTICK].pending = 0;
+            gic_update(s->gic);
+        }
+        break;
+    case 0xd08: /* Vector Table Offset.  */
+        cpu_single_env->v7m.vecbase = value & 0xffffff80;
+        break;
+    case 0xd0c: /* Application Interrupt/Reset Control.  */
+        if ((value >> 16) == 0x05fa) {
+            if (value & 2) {
+                cpu_abort(cpu_single_env, "VECTCLRACTIVE not implemented");
+            }
+            if (value & 5) {
+                cpu_abort(cpu_single_env, "System reset");
+            }
+        }
+        break;
+    case 0xd10: /* System Control.  */
+    case 0xd14: /* Configuration Control.  */
+        /* TODO: Implement control registers.  */
+        goto bad_reg;
+    case 0xd18: case 0xd1c: case 0xd20: /* System Handler Priority.  */
+        {
+            int irq;
+            irq = offset - 0xd14;
+            s->gic->priority1[irq++][0] = value & 0xff;
+            s->gic->priority1[irq++][0] = (value >> 8) & 0xff;
+            s->gic->priority1[irq++][0] = (value >> 16) & 0xff;
+            s->gic->priority1[irq][0] = (value >> 24) & 0xff;
+            gic_update(s->gic);
+        }
+        break;
+    case 0xd24: /* System Handler Control.  */
+        /* TODO: Real hardware allows you to set/clear the active bits
+           under some circumstances.  We don't implement this.  */
+        s->gic->irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
+        s->gic->irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
+        s->gic->irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
+        break;
+    case 0xd28: /* Configurable Fault Status.  */
+    case 0xd2c: /* Hard Fault Status.  */
+    case 0xd30: /* Debug Fault Status.  */
+    case 0xd34: /* Mem Manage Address.  */
+    case 0xd38: /* Bus Fault Address.  */
+    case 0xd3c: /* Aux Fault Status.  */
+        goto bad_reg;
+    default:
+    bad_reg:
+        cpu_abort(cpu_single_env, "NVIC: Bad write offset 0x%x\n", offset);
+    }
+}
+
+static void nvic_save(QEMUFile *f, void *opaque)
+{
+    nvic_state *s = (nvic_state *)opaque;
+
+    qemu_put_be32(f, s->systick.control);
+    qemu_put_be32(f, s->systick.reload);
+    qemu_put_be64(f, s->systick.tick);
+    qemu_put_timer(f, s->systick.timer);
+}
+
+static int nvic_load(QEMUFile *f, void *opaque, int version_id)
+{
+    nvic_state *s = (nvic_state *)opaque;
+
+    if (version_id != 1)
+        return -EINVAL;
+
+    s->systick.control = qemu_get_be32(f);
+    s->systick.reload = qemu_get_be32(f);
+    s->systick.tick = qemu_get_be64(f);
+    qemu_get_timer(f, s->systick.timer);
+
+    return 0;
+}
+
+qemu_irq *armv7m_nvic_init(CPUState *env)
+{
+    nvic_state *s;
+    qemu_irq *parent;
+
+    parent = arm_pic_init_cpu(env);
+    s = (nvic_state *)qemu_mallocz(sizeof(nvic_state));
+    s->gic = gic_init(0xe000e000, &parent[ARM_PIC_CPU_IRQ]);
+    s->gic->nvic = s;
+    s->systick.timer = qemu_new_timer(vm_clock, systick_timer_tick, s);
+    if (env->v7m.nvic)
+        cpu_abort(env, "CPU can only have one NVIC\n");
+    env->v7m.nvic = s;
+    register_savevm("armv7m_nvic", -1, 1, nvic_save, nvic_load, s);
+    return s->gic->in;
+}
diff --git a/hw/audiodev.h b/hw/audiodev.h
new file mode 100644
index 0000000..5f4a211
--- /dev/null
+++ b/hw/audiodev.h
@@ -0,0 +1,17 @@
+/* es1370.c */
+int es1370_init (PCIBus *bus, AudioState *s);
+
+/* sb16.c */
+int SB16_init (AudioState *s, qemu_irq *pic);
+
+/* adlib.c */
+int Adlib_init (AudioState *s, qemu_irq *pic);
+
+/* gus.c */
+int GUS_init (AudioState *s, qemu_irq *pic);
+
+/* ac97.c */
+int ac97_init (PCIBus *buf, AudioState *s);
+
+/* cs4231a.c */
+int cs4231a_init (AudioState *s, qemu_irq *pic);
diff --git a/hw/baum.h b/hw/baum.h
new file mode 100644
index 0000000..ac34b30
--- /dev/null
+++ b/hw/baum.h
@@ -0,0 +1,29 @@
+/*
+ * QEMU Baum
+ *
+ * Copyright (c) 2008 Samuel Thibault
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+/* usb device */
+USBDevice *usb_baum_init(void);
+
+/* char device */
+CharDriverState *chr_baum_init(void);
diff --git a/hw/boards.h b/hw/boards.h
new file mode 100644
index 0000000..cfb7c42
--- /dev/null
+++ b/hw/boards.h
@@ -0,0 +1,122 @@
+/* Declarations for use by board files for creating devices.  */
+
+#ifndef HW_BOARDS_H
+#define HW_BOARDS_H
+
+typedef void QEMUMachineInitFunc(ram_addr_t ram_size, int vga_ram_size,
+                                 const char *boot_device, DisplayState *ds,
+                                 const char *kernel_filename,
+                                 const char *kernel_cmdline,
+                                 const char *initrd_filename,
+                                 const char *cpu_model);
+
+typedef struct QEMUMachine {
+    const char *name;
+    const char *desc;
+    QEMUMachineInitFunc *init;
+#define RAMSIZE_FIXED	(1 << 0)
+    ram_addr_t ram_require;
+    int nodisk_ok;
+    struct QEMUMachine *next;
+} QEMUMachine;
+
+int qemu_register_machine(QEMUMachine *m);
+void register_machines(void);
+
+/* Axis ETRAX.  */
+extern QEMUMachine bareetraxfs_machine;
+
+/* pc.c */
+extern QEMUMachine pc_machine;
+extern QEMUMachine isapc_machine;
+
+/* ppc.c */
+extern QEMUMachine prep_machine;
+extern QEMUMachine core99_machine;
+extern QEMUMachine heathrow_machine;
+extern QEMUMachine ref405ep_machine;
+extern QEMUMachine taihu_machine;
+
+/* mips_r4k.c */
+extern QEMUMachine mips_machine;
+
+/* mips_jazz.c */
+extern QEMUMachine mips_magnum_machine;
+extern QEMUMachine mips_pica61_machine;
+
+/* mips_malta.c */
+extern QEMUMachine mips_malta_machine;
+
+/* mips_mipssim.c */
+extern QEMUMachine mips_mipssim_machine;
+
+/* shix.c */
+extern QEMUMachine shix_machine;
+
+/* r2d.c */
+extern QEMUMachine r2d_machine;
+
+/* sun4m.c */
+extern QEMUMachine ss5_machine, ss10_machine, ss600mp_machine, ss20_machine;
+extern QEMUMachine voyager_machine, ss_lx_machine, ss4_machine, scls_machine;
+extern QEMUMachine sbook_machine;
+extern QEMUMachine ss2_machine;
+extern QEMUMachine ss1000_machine, ss2000_machine;
+
+/* sun4u.c */
+extern QEMUMachine sun4u_machine;
+extern QEMUMachine sun4v_machine;
+
+/* integratorcp.c */
+extern QEMUMachine integratorcp_machine;
+
+/* versatilepb.c */
+extern QEMUMachine versatilepb_machine;
+extern QEMUMachine versatileab_machine;
+
+/* realview.c */
+extern QEMUMachine realview_machine;
+
+/* spitz.c */
+extern QEMUMachine akitapda_machine;
+extern QEMUMachine spitzpda_machine;
+extern QEMUMachine borzoipda_machine;
+extern QEMUMachine terrierpda_machine;
+
+/* palm.c */
+extern QEMUMachine palmte_machine;
+
+/* nseries.c */
+extern QEMUMachine n800_machine;
+extern QEMUMachine n810_machine;
+
+/* gumstix.c */
+extern QEMUMachine connex_machine;
+extern QEMUMachine verdex_machine;
+
+/* stellaris.c */
+extern QEMUMachine lm3s811evb_machine;
+extern QEMUMachine lm3s6965evb_machine;
+
+/* an5206.c */
+extern QEMUMachine an5206_machine;
+
+/* mcf5208.c */
+extern QEMUMachine mcf5208evb_machine;
+
+/* dummy_m68k.c */
+extern QEMUMachine dummy_m68k_machine;
+
+/* mainstone.c */
+extern QEMUMachine mainstone2_machine;
+
+/* musicpal.c */
+extern QEMUMachine musicpal_machine;
+
+/* tosa.c */
+extern QEMUMachine tosapda_machine;
+
+/* android_arm.c */
+extern QEMUMachine android_arm_machine;
+
+#endif
diff --git a/hw/cdrom.c b/hw/cdrom.c
index a43b417..2aa4d3b 100644
--- a/hw/cdrom.c
+++ b/hw/cdrom.c
@@ -1,8 +1,8 @@
 /*
  * QEMU ATAPI CD-ROM Emulator
- * 
+ *
  * Copyright (c) 2006 Fabrice Bellard
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -25,7 +25,8 @@
 /* ??? Most of the ATAPI emulation is still in ide.c.  It should be moved
    here.  */
 
-#include <vl.h>
+#include "qemu-common.h"
+#include "scsi-disk.h"
 
 static void lba_to_msf(uint8_t *buf, int lba)
 {
@@ -41,7 +42,7 @@ int cdrom_read_toc(int nb_sectors, uint8_t *buf, int msf, int start_track)
 {
     uint8_t *q;
     int len;
-    
+
     if (start_track > 1 && start_track != 0xaa)
         return -1;
     q = buf + 2;
@@ -85,7 +86,7 @@ int cdrom_read_toc_raw(int nb_sectors, uint8_t *buf, int msf, int session_num)
 {
     uint8_t *q;
     int len;
-    
+
     q = buf + 2;
     *q++ = 1; /* first session */
     *q++ = 1; /* last session */
@@ -101,7 +102,7 @@ int cdrom_read_toc_raw(int nb_sectors, uint8_t *buf, int msf, int session_num)
     *q++ = 1; /* first track */
     *q++ = 0x00; /* disk type */
     *q++ = 0x00;
-    
+
     *q++ = 1; /* session number */
     *q++ = 0x14; /* data track */
     *q++ = 0; /* track number */
@@ -113,7 +114,7 @@ int cdrom_read_toc_raw(int nb_sectors, uint8_t *buf, int msf, int session_num)
     *q++ = 1; /* last track */
     *q++ = 0x00;
     *q++ = 0x00;
-    
+
     *q++ = 1; /* session number */
     *q++ = 0x14; /* data track */
     *q++ = 0; /* track number */
@@ -138,14 +139,14 @@ int cdrom_read_toc_raw(int nb_sectors, uint8_t *buf, int msf, int session_num)
     *q++ = 0; /* sec */
     *q++ = 0; /* frame */
     if (msf) {
-        *q++ = 0; 
+        *q++ = 0;
         lba_to_msf(q, 0);
         q += 3;
     } else {
-        *q++ = 0; 
-        *q++ = 0; 
-        *q++ = 0; 
-        *q++ = 0; 
+        *q++ = 0;
+        *q++ = 0;
+        *q++ = 0;
+        *q++ = 0;
     }
 
     len = q - buf;
diff --git a/hw/devices.h b/hw/devices.h
new file mode 100644
index 0000000..45fead9
--- /dev/null
+++ b/hw/devices.h
@@ -0,0 +1,74 @@
+#ifndef QEMU_DEVICES_H
+#define QEMU_DEVICES_H
+
+/* Devices that have nowhere better to go.  */
+
+/* smc91c111.c */
+void smc91c111_init(NICInfo *, uint32_t, qemu_irq);
+
+/* ssd0323.c */
+int ssd0323_xfer_ssi(void *opaque, int data);
+void *ssd0323_init(DisplayState *ds, qemu_irq *cmd_p);
+
+/* ads7846.c */
+struct ads7846_state_s;
+uint32_t ads7846_read(void *opaque);
+void ads7846_write(void *opaque, uint32_t value);
+struct ads7846_state_s *ads7846_init(qemu_irq penirq);
+
+/* tsc210x.c */
+struct uwire_slave_s;
+struct mouse_transform_info_s;
+struct uwire_slave_s *tsc2102_init(qemu_irq pint, AudioState *audio);
+struct uwire_slave_s *tsc2301_init(qemu_irq penirq, qemu_irq kbirq,
+                qemu_irq dav, AudioState *audio);
+struct i2s_codec_s *tsc210x_codec(struct uwire_slave_s *chip);
+uint32_t tsc210x_txrx(void *opaque, uint32_t value, int len);
+void tsc210x_set_transform(struct uwire_slave_s *chip,
+                struct mouse_transform_info_s *info);
+void tsc210x_key_event(struct uwire_slave_s *chip, int key, int down);
+
+/* tsc2005.c */
+void *tsc2005_init(qemu_irq pintdav);
+uint32_t tsc2005_txrx(void *opaque, uint32_t value, int len);
+void tsc2005_set_transform(void *opaque, struct mouse_transform_info_s *info);
+
+/* stellaris_input.c */
+void stellaris_gamepad_init(int n, qemu_irq *irq, const int *keycode);
+
+/* blizzard.c */
+void *s1d13745_init(qemu_irq gpio_int, DisplayState *ds);
+void s1d13745_write(void *opaque, int dc, uint16_t value);
+void s1d13745_write_block(void *opaque, int dc,
+                void *buf, size_t len, int pitch);
+uint16_t s1d13745_read(void *opaque, int dc);
+
+/* cbus.c */
+struct cbus_s {
+    qemu_irq clk;
+    qemu_irq dat;
+    qemu_irq sel;
+};
+struct cbus_s *cbus_init(qemu_irq dat_out);
+void cbus_attach(struct cbus_s *bus, void *slave_opaque);
+
+void *retu_init(qemu_irq irq, int vilma);
+void *tahvo_init(qemu_irq irq, int betty);
+
+void retu_key_event(void *retu, int state);
+
+/* tusb6010.c */
+struct tusb_s;
+struct tusb_s *tusb6010_init(qemu_irq intr);
+int tusb6010_sync_io(struct tusb_s *s);
+int tusb6010_async_io(struct tusb_s *s);
+void tusb6010_power(struct tusb_s *s, int on);
+
+/* tc6393xb.c */
+struct tc6393xb_s;
+struct tc6393xb_s *tc6393xb_init(uint32_t base, qemu_irq irq);
+void tc6393xb_gpio_out_set(struct tc6393xb_s *s, int line,
+                    qemu_irq handler);
+qemu_irq *tc6393xb_gpio_in_get(struct tc6393xb_s *s);
+
+#endif
diff --git a/hw/dma.c b/hw/dma.c
index ea13eae..00c6332 100644
--- a/hw/dma.c
+++ b/hw/dma.c
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "isa.h"
 
 /* #define DEBUG_DMA */
 
@@ -383,7 +384,7 @@ void DMA_register_channel (int nchan,
 int DMA_read_memory (int nchan, void *buf, int pos, int len)
 {
     struct dma_regs *r = &dma_controllers[nchan > 3].regs[nchan & 3];
-    target_ulong addr = ((r->pageh & 0x7f) << 24) | (r->page << 16) | r->now[ADDR];
+    target_phys_addr_t addr = ((r->pageh & 0x7f) << 24) | (r->page << 16) | r->now[ADDR];
 
     if (r->mode & 0x20) {
         int i;
@@ -405,7 +406,7 @@ int DMA_read_memory (int nchan, void *buf, int pos, int len)
 int DMA_write_memory (int nchan, void *buf, int pos, int len)
 {
     struct dma_regs *r = &dma_controllers[nchan > 3].regs[nchan & 3];
-    target_ulong addr = ((r->pageh & 0x7f) << 24) | (r->page << 16) | r->now[ADDR];
+    target_phys_addr_t addr = ((r->pageh & 0x7f) << 24) | (r->page << 16) | r->now[ADDR];
 
     if (r->mode & 0x20) {
         int i;
@@ -438,11 +439,18 @@ static void dma_reset(void *opaque)
     write_cont (d, (0x0d << d->dshift), 0);
 }
 
+static int dma_phony_handler (void *opaque, int nchan, int dma_pos, int dma_len)
+{
+    dolog ("unregistered DMA channel used nchan=%d dma_pos=%d dma_len=%d\n",
+           nchan, dma_pos, dma_len);
+    return dma_pos;
+}
+
 /* dshift = 0: 8 bit DMA, 1 = 16 bit DMA */
 static void dma_init2(struct dma_cont *d, int base, int dshift,
                       int page_base, int pageh_base)
 {
-    const static int page_port_list[] = { 0x1, 0x2, 0x3, 0x7 };
+    static const int page_port_list[] = { 0x1, 0x2, 0x3, 0x7 };
     int i;
 
     d->dshift = dshift;
@@ -470,6 +478,9 @@ static void dma_init2(struct dma_cont *d, int base, int dshift,
     }
     qemu_register_reset(dma_reset, d);
     dma_reset(d);
+    for (i = 0; i < LENOFA (d->regs); ++i) {
+        d->regs[i].transfer_handler = dma_phony_handler;
+    }
 }
 
 static void dma_save (QEMUFile *f, void *opaque)
@@ -481,12 +492,12 @@ static void dma_save (QEMUFile *f, void *opaque)
     qemu_put_8s (f, &d->command);
     qemu_put_8s (f, &d->mask);
     qemu_put_8s (f, &d->flip_flop);
-    qemu_put_be32s (f, &d->dshift);
+    qemu_put_be32 (f, d->dshift);
 
     for (i = 0; i < 4; ++i) {
         struct dma_regs *r = &d->regs[i];
-        qemu_put_be32s (f, &r->now[0]);
-        qemu_put_be32s (f, &r->now[1]);
+        qemu_put_be32 (f, r->now[0]);
+        qemu_put_be32 (f, r->now[1]);
         qemu_put_be16s (f, &r->base[0]);
         qemu_put_be16s (f, &r->base[1]);
         qemu_put_8s (f, &r->mode);
@@ -509,12 +520,12 @@ static int dma_load (QEMUFile *f, void *opaque, int version_id)
     qemu_get_8s (f, &d->command);
     qemu_get_8s (f, &d->mask);
     qemu_get_8s (f, &d->flip_flop);
-    qemu_get_be32s (f, &d->dshift);
+    d->dshift=qemu_get_be32 (f);
 
     for (i = 0; i < 4; ++i) {
         struct dma_regs *r = &d->regs[i];
-        qemu_get_be32s (f, &r->now[0]);
-        qemu_get_be32s (f, &r->now[1]);
+        r->now[0]=qemu_get_be32 (f);
+        r->now[1]=qemu_get_be32 (f);
         qemu_get_be16s (f, &r->base[0]);
         qemu_get_be16s (f, &r->base[1]);
         qemu_get_8s (f, &r->mode);
diff --git a/hw/goldfish_audio.c b/hw/goldfish_audio.c
index 3472d73..d0a44b5 100644
--- a/hw/goldfish_audio.c
+++ b/hw/goldfish_audio.c
@@ -9,10 +9,10 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "qemu_file.h"
 #include "goldfish_device.h"
 #include "audio/audio.h"
-#include "android_debug.h"
+#include "qemu_debug.h"
 #include "android/globals.h"
 
 #define  DEBUG  1
diff --git a/hw/goldfish_battery.c b/hw/goldfish_battery.c
index f8452db..d9ef785 100644
--- a/hw/goldfish_battery.c
+++ b/hw/goldfish_battery.c
@@ -9,7 +9,7 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "qemu_file.h"
 #include "goldfish_device.h"
 #include "power_supply.h"
 
diff --git a/hw/goldfish_device.c b/hw/goldfish_device.c
index a7d80a6..2c9dd6e 100644
--- a/hw/goldfish_device.c
+++ b/hw/goldfish_device.c
@@ -9,7 +9,7 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "qemu_file.h"
 #include "arm_pic.h"
 #include "goldfish_device.h"
 
diff --git a/hw/goldfish_events_device.c b/hw/goldfish_events_device.c
index 66ac2fc..4cb2904 100644
--- a/hw/goldfish_events_device.c
+++ b/hw/goldfish_events_device.c
@@ -9,8 +9,8 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
-#include "android_events.h"
+#include "qemu_file.h"
+#include "android/hw-events.h"
 #include "irq.h"
 
 #if 0
diff --git a/hw/goldfish_fb.c b/hw/goldfish_fb.c
index db3e25b..71cede2 100644
--- a/hw/goldfish_fb.c
+++ b/hw/goldfish_fb.c
@@ -9,8 +9,8 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
-#include "android.h"
+#include "qemu_file.h"
+#include "android/android.h"
 #include "goldfish_device.h"
 #include "framebuffer.h"
 
diff --git a/hw/goldfish_interrupt.c b/hw/goldfish_interrupt.c
index c89130d..2cba649 100644
--- a/hw/goldfish_interrupt.c
+++ b/hw/goldfish_interrupt.c
@@ -9,7 +9,7 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "qemu_file.h"
 #include "arm_pic.h"
 #include "goldfish_device.h"
 #include "irq.h"
diff --git a/hw/goldfish_memlog.c b/hw/goldfish_memlog.c
index e2a89a6..98fcffc 100644
--- a/hw/goldfish_memlog.c
+++ b/hw/goldfish_memlog.c
@@ -13,7 +13,7 @@
 #include <fcntl.h>
 #include <string.h>
 
-#include "vl.h"
+#include "qemu_file.h"
 #include "goldfish_device.h"
 #include "audio/audio.h"
 
diff --git a/hw/goldfish_mmc.c b/hw/goldfish_mmc.c
index 0daaebd..272f403 100644
--- a/hw/goldfish_mmc.c
+++ b/hw/goldfish_mmc.c
@@ -9,10 +9,11 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "qemu_file.h"
 #include "goldfish_device.h"
 #include "mmc.h"
 #include "sd.h"
+#include "block.h"
 
 enum {
     /* status register */
@@ -190,7 +191,7 @@ static void goldfish_mmc_do_command(struct goldfish_mmc_state *s, uint32_t cmd,
             uint8_t exponent;
             uint32_t m;
 
-            bdrv_get_geometry(s->bs, &sector_count);
+            bdrv_get_geometry(s->bs, (uint64_t*)&sector_count);
             capacity = sector_count * 512;
             if (capacity > 2147483648U) {
                 // if storages is > 2 gig, then emulate SDHC card
diff --git a/hw/goldfish_nand.c b/hw/goldfish_nand.c
index e3042bf..61b075e 100644
--- a/hw/goldfish_nand.c
+++ b/hw/goldfish_nand.c
@@ -9,12 +9,12 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "qemu_file.h"
 #include "goldfish_nand_reg.h"
 #include "goldfish_nand.h"
-#include "android_utils.h"
-#include "android_debug.h"
-#include "android.h"
+#include "android/utils/tempfile.h"
+#include "qemu_debug.h"
+#include "android/android.h"
 
 #define  DEBUG  1
 #if DEBUG
@@ -153,9 +153,6 @@ static int   nand_dev_state_load(QEMUFile*  f, void*  opaque, int  version_id)
 }
 
 
-extern void vmemcpy(target_ulong ptr, char *buf, int size); /* copy memory from the simulated virtual space to a buffer in QEMU */
-extern void pmemcpy(target_ulong ptr, char *buf, int size); /* copy memory from the QEMU buffer to simulated virtual space */
-
 static int  do_read(int  fd, void*  buf, size_t  size)
 {
     int  ret;
diff --git a/hw/goldfish_switch.c b/hw/goldfish_switch.c
index 04fcad7..8a12d66 100644
--- a/hw/goldfish_switch.c
+++ b/hw/goldfish_switch.c
@@ -9,7 +9,7 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "qemu_file.h"
 #include "goldfish_device.h"
 
 enum {
diff --git a/hw/goldfish_timer.c b/hw/goldfish_timer.c
index bb345a5..73f1455 100644
--- a/hw/goldfish_timer.c
+++ b/hw/goldfish_timer.c
@@ -9,7 +9,8 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "qemu-timer.h"
+#include "cpu.h"
 #include "arm_pic.h"
 #include "goldfish_device.h"
 
diff --git a/hw/goldfish_trace.c b/hw/goldfish_trace.c
index 47822b3..ad0eba5 100644
--- a/hw/goldfish_trace.c
+++ b/hw/goldfish_trace.c
@@ -13,8 +13,7 @@
  * Virtual hardware for bridging the FUSE kernel module
  * in the emulated OS and outside file system
  */
-#include "vl.h"
-
+#include "qemu_file.h"
 #include "goldfish_trace.h"
 
 //#define DEBUG   1
diff --git a/hw/goldfish_trace.h b/hw/goldfish_trace.h
index ea627e8..44190ee 100644
--- a/hw/goldfish_trace.h
+++ b/hw/goldfish_trace.h
@@ -51,8 +51,9 @@ typedef struct {
  * interfaces for copy from virtual space
  * from target-arm/op_helper.c
  */
-extern unsigned long v2p(target_ulong ptr, int is_user);
+extern target_phys_addr_t v2p(target_ulong ptr, int is_user);
 extern void vmemcpy(target_ulong ptr, char *buf, int size);
+extern void pmemcpy(target_ulong ptr, const char* buf, int size);
 extern void vstrcpy(target_ulong ptr, char *buf, int max);
 
 /*
diff --git a/hw/goldfish_tty.c b/hw/goldfish_tty.c
index d61712a..aa62d75 100644
--- a/hw/goldfish_tty.c
+++ b/hw/goldfish_tty.c
@@ -9,7 +9,8 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "vl.h"
+#include "qemu_file.h"
+#include "qemu-char.h"
 #include "goldfish_device.h"
 
 enum {
@@ -165,14 +166,14 @@ static void goldfish_tty_write(void *opaque, target_phys_addr_t offset, uint32_t
     }
 }
 
-static int tty_can_recieve(void *opaque)
+static int tty_can_receive(void *opaque)
 {
     struct tty_state *s = opaque;
 
     return (sizeof(s->data) - s->data_count);
 }
 
-static void tty_recieve(void *opaque, const uint8_t *buf, int size)
+static void tty_receive(void *opaque, const uint8_t *buf, int size)
 {
     struct tty_state *s = opaque;
 
@@ -210,7 +211,7 @@ int goldfish_tty_add(CharDriverState *cs, int id, uint32_t base, int irq)
     s->cs = cs;
 
     if(cs) {
-        qemu_chr_add_read_handler(cs, tty_can_recieve, tty_recieve, s);
+        qemu_chr_add_handlers(cs, tty_can_receive, tty_receive, NULL, s);
     }
 
     ret = goldfish_device_add(&s->dev, goldfish_tty_readfn, goldfish_tty_writefn, s);
diff --git a/hw/hw.h b/hw/hw.h
new file mode 100644
index 0000000..06e24cb
--- /dev/null
+++ b/hw/hw.h
@@ -0,0 +1,110 @@
+/* Declarations for use by hardware emulation.  */
+#ifndef QEMU_HW_H
+#define QEMU_HW_H
+
+#include "qemu-common.h"
+#include "irq.h"
+#include "cpu.h"
+
+/* VM Load/Save */
+
+QEMUFile *qemu_fopen(const char *filename, const char *mode);
+void qemu_fflush(QEMUFile *f);
+void qemu_fclose(QEMUFile *f);
+void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, int size);
+void qemu_put_byte(QEMUFile *f, int v);
+void qemu_put_be16(QEMUFile *f, unsigned int v);
+void qemu_put_be32(QEMUFile *f, unsigned int v);
+void qemu_put_be64(QEMUFile *f, uint64_t v);
+int qemu_get_buffer(QEMUFile *f, uint8_t *buf, int size);
+int qemu_get_byte(QEMUFile *f);
+unsigned int qemu_get_be16(QEMUFile *f);
+unsigned int qemu_get_be32(QEMUFile *f);
+uint64_t qemu_get_be64(QEMUFile *f);
+
+static inline void qemu_put_be64s(QEMUFile *f, const uint64_t *pv)
+{
+    qemu_put_be64(f, *pv);
+}
+
+static inline void qemu_put_be32s(QEMUFile *f, const uint32_t *pv)
+{
+    qemu_put_be32(f, *pv);
+}
+
+static inline void qemu_put_be16s(QEMUFile *f, const uint16_t *pv)
+{
+    qemu_put_be16(f, *pv);
+}
+
+static inline void qemu_put_8s(QEMUFile *f, const uint8_t *pv)
+{
+    qemu_put_byte(f, *pv);
+}
+
+static inline void qemu_get_be64s(QEMUFile *f, uint64_t *pv)
+{
+    *pv = qemu_get_be64(f);
+}
+
+static inline void qemu_get_be32s(QEMUFile *f, uint32_t *pv)
+{
+    *pv = qemu_get_be32(f);
+}
+
+static inline void qemu_get_be16s(QEMUFile *f, uint16_t *pv)
+{
+    *pv = qemu_get_be16(f);
+}
+
+static inline void qemu_get_8s(QEMUFile *f, uint8_t *pv)
+{
+    *pv = qemu_get_byte(f);
+}
+
+#ifdef NEED_CPU_H
+#if TARGET_LONG_BITS == 64
+#define qemu_put_betl qemu_put_be64
+#define qemu_get_betl qemu_get_be64
+#define qemu_put_betls qemu_put_be64s
+#define qemu_get_betls qemu_get_be64s
+#else
+#define qemu_put_betl qemu_put_be32
+#define qemu_get_betl qemu_get_be32
+#define qemu_put_betls qemu_put_be32s
+#define qemu_get_betls qemu_get_be32s
+#endif
+#endif
+
+int64_t qemu_ftell(QEMUFile *f);
+int64_t qemu_fseek(QEMUFile *f, int64_t pos, int whence);
+
+typedef void SaveStateHandler(QEMUFile *f, void *opaque);
+typedef int LoadStateHandler(QEMUFile *f, void *opaque, int version_id);
+
+int register_savevm(const char *idstr,
+                    int instance_id,
+                    int version_id,
+                    SaveStateHandler *save_state,
+                    LoadStateHandler *load_state,
+                    void *opaque);
+
+typedef void QEMUResetHandler(void *opaque);
+
+void qemu_register_reset(QEMUResetHandler *func, void *opaque);
+
+/* handler to set the boot_device for a specific type of QEMUMachine */
+/* return 0 if success */
+typedef int QEMUBootSetHandler(const char *boot_device);
+extern QEMUBootSetHandler *qemu_boot_set_handler;
+void qemu_register_boot_set(QEMUBootSetHandler *func);
+
+/* These should really be in isa.h, but are here to make pc.h happy.  */
+typedef void (IOPortWriteFunc)(void *opaque, uint32_t address, uint32_t data);
+typedef uint32_t (IOPortReadFunc)(void *opaque, uint32_t address);
+
+
+/* ANDROID: copy memory from the QEMU buffer to simulated virtual space */
+extern void pmemcpy(target_ulong ptr, const char *buf, int size);
+
+#endif
diff --git a/hw/irq.c b/hw/irq.c
index 3621b8e..eca707d 100644
--- a/hw/irq.c
+++ b/hw/irq.c
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "irq.h"
 
 struct IRQState {
diff --git a/hw/irq.h b/hw/irq.h
index 814511a..0880ad2 100644
--- a/hw/irq.h
+++ b/hw/irq.h
@@ -3,7 +3,9 @@
 
 /* Generic IRQ/GPIO pin infrastructure.  */
 
+/* FIXME: Rmove one of these.  */
 typedef void (*qemu_irq_handler)(void *opaque, int n, int level);
+typedef void SetIRQFunc(void *opaque, int irq_num, int level);
 
 void qemu_set_irq(qemu_irq irq, int level);
 
diff --git a/hw/isa.h b/hw/isa.h
new file mode 100644
index 0000000..222e4f3
--- /dev/null
+++ b/hw/isa.h
@@ -0,0 +1,27 @@
+#ifndef HW_ISA_H
+#define HW_ISA_H
+/* ISA bus */
+
+extern target_phys_addr_t isa_mem_base;
+
+int register_ioport_read(int start, int length, int size,
+                         IOPortReadFunc *func, void *opaque);
+int register_ioport_write(int start, int length, int size,
+                          IOPortWriteFunc *func, void *opaque);
+void isa_unassign_ioport(int start, int length);
+
+void isa_mmio_init(target_phys_addr_t base, target_phys_addr_t size);
+
+/* dma.c */
+int DMA_get_channel_mode (int nchan);
+int DMA_read_memory (int nchan, void *buf, int pos, int size);
+int DMA_write_memory (int nchan, void *buf, int pos, int size);
+void DMA_hold_DREQ (int nchan);
+void DMA_release_DREQ (int nchan);
+void DMA_schedule(int nchan);
+void DMA_run (void);
+void DMA_init (int high_page_enable);
+void DMA_register_channel (int nchan,
+                           DMA_transfer_handler transfer_handler,
+                           void *opaque);
+#endif
diff --git a/hw/pc.h b/hw/pc.h
new file mode 100644
index 0000000..2862849
--- /dev/null
+++ b/hw/pc.h
@@ -0,0 +1,148 @@
+#ifndef HW_PC_H
+#define HW_PC_H
+/* PC-style peripherals (also used by other machines).  */
+
+/* serial.c */
+
+SerialState *serial_init(int base, qemu_irq irq, int baudbase,
+                         CharDriverState *chr);
+SerialState *serial_mm_init (target_phys_addr_t base, int it_shift,
+                             qemu_irq irq, int baudbase,
+                             CharDriverState *chr, int ioregister);
+uint32_t serial_mm_readb (void *opaque, target_phys_addr_t addr);
+void serial_mm_writeb (void *opaque, target_phys_addr_t addr, uint32_t value);
+uint32_t serial_mm_readw (void *opaque, target_phys_addr_t addr);
+void serial_mm_writew (void *opaque, target_phys_addr_t addr, uint32_t value);
+uint32_t serial_mm_readl (void *opaque, target_phys_addr_t addr);
+void serial_mm_writel (void *opaque, target_phys_addr_t addr, uint32_t value);
+
+/* parallel.c */
+
+typedef struct ParallelState ParallelState;
+ParallelState *parallel_init(int base, qemu_irq irq, CharDriverState *chr);
+ParallelState *parallel_mm_init(target_phys_addr_t base, int it_shift, qemu_irq irq, CharDriverState *chr);
+
+/* i8259.c */
+
+typedef struct PicState2 PicState2;
+extern PicState2 *isa_pic;
+void pic_set_irq(int irq, int level);
+void pic_set_irq_new(void *opaque, int irq, int level);
+qemu_irq *i8259_init(qemu_irq parent_irq);
+void pic_set_alt_irq_func(PicState2 *s, SetIRQFunc *alt_irq_func,
+                          void *alt_irq_opaque);
+int pic_read_irq(PicState2 *s);
+void pic_update_irq(PicState2 *s);
+uint32_t pic_intack_read(PicState2 *s);
+void pic_info(void);
+void irq_info(void);
+
+/* APIC */
+typedef struct IOAPICState IOAPICState;
+
+int apic_init(CPUState *env);
+int apic_accept_pic_intr(CPUState *env);
+void apic_deliver_pic_intr(CPUState *env, int level);
+int apic_get_interrupt(CPUState *env);
+IOAPICState *ioapic_init(void);
+void ioapic_set_irq(void *opaque, int vector, int level);
+
+/* i8254.c */
+
+#define PIT_FREQ 1193182
+
+typedef struct PITState PITState;
+
+PITState *pit_init(int base, qemu_irq irq);
+void pit_set_gate(PITState *pit, int channel, int val);
+int pit_get_gate(PITState *pit, int channel);
+int pit_get_initial_count(PITState *pit, int channel);
+int pit_get_mode(PITState *pit, int channel);
+int pit_get_out(PITState *pit, int channel, int64_t current_time);
+
+/* vmport.c */
+void vmport_init(void);
+void vmport_register(unsigned char command, IOPortReadFunc *func, void *opaque);
+
+/* vmmouse.c */
+void *vmmouse_init(void *m);
+
+/* pckbd.c */
+
+void i8042_init(qemu_irq kbd_irq, qemu_irq mouse_irq, uint32_t io_base);
+void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq,
+                   target_phys_addr_t base, int it_shift);
+
+/* mc146818rtc.c */
+
+typedef struct RTCState RTCState;
+
+RTCState *rtc_init(int base, qemu_irq irq);
+RTCState *rtc_mm_init(target_phys_addr_t base, int it_shift, qemu_irq irq);
+void rtc_set_memory(RTCState *s, int addr, int val);
+void rtc_set_date(RTCState *s, const struct tm *tm);
+
+/* pc.c */
+extern int fd_bootchk;
+
+void ioport_set_a20(int enable);
+int ioport_get_a20(void);
+
+/* acpi.c */
+extern int acpi_enabled;
+i2c_bus *piix4_pm_init(PCIBus *bus, int devfn, uint32_t smb_io_base,
+                       qemu_irq sci_irq);
+void piix4_smbus_register_device(SMBusDevice *dev, uint8_t addr);
+void acpi_bios_init(void);
+
+/* pcspk.c */
+void pcspk_init(PITState *);
+int pcspk_audio_init(AudioState *, qemu_irq *pic);
+
+/* piix_pci.c */
+PCIBus *i440fx_init(PCIDevice **pi440fx_state, qemu_irq *pic);
+void i440fx_set_smm(PCIDevice *d, int val);
+int piix3_init(PCIBus *bus, int devfn);
+void i440fx_init_memory_mappings(PCIDevice *d);
+
+int piix4_init(PCIBus *bus, int devfn);
+
+/* vga.c */
+
+#ifndef TARGET_SPARC
+#define VGA_RAM_SIZE (8192 * 1024)
+#else
+#define VGA_RAM_SIZE (9 * 1024 * 1024)
+#endif
+
+int isa_vga_init(DisplayState *ds, uint8_t *vga_ram_base,
+                 unsigned long vga_ram_offset, int vga_ram_size);
+int pci_vga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
+                 unsigned long vga_ram_offset, int vga_ram_size,
+                 unsigned long vga_bios_offset, int vga_bios_size);
+int isa_vga_mm_init(DisplayState *ds, uint8_t *vga_ram_base,
+                    unsigned long vga_ram_offset, int vga_ram_size,
+                    target_phys_addr_t vram_base, target_phys_addr_t ctrl_base,
+                    int it_shift);
+
+/* cirrus_vga.c */
+void pci_cirrus_vga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
+                         unsigned long vga_ram_offset, int vga_ram_size);
+void isa_cirrus_vga_init(DisplayState *ds, uint8_t *vga_ram_base,
+                         unsigned long vga_ram_offset, int vga_ram_size);
+
+/* ide.c */
+void isa_ide_init(int iobase, int iobase2, qemu_irq irq,
+                  BlockDriverState *hd0, BlockDriverState *hd1);
+void pci_cmd646_ide_init(PCIBus *bus, BlockDriverState **hd_table,
+                         int secondary_ide_enabled);
+void pci_piix3_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
+                        qemu_irq *pic);
+void pci_piix4_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
+                        qemu_irq *pic);
+
+/* ne2000.c */
+
+void isa_ne2000_init(int base, qemu_irq irq, NICInfo *nd);
+
+#endif
diff --git a/hw/pci.c b/hw/pci.c
index d8cbc2b..5f7004a 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -21,7 +21,10 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "pci.h"
+#include "console.h"
+#include "net.h"
 
 //#define DEBUG_PCI
 
@@ -29,25 +32,83 @@ struct PCIBus {
     int bus_num;
     int devfn_min;
     pci_set_irq_fn set_irq;
+    pci_map_irq_fn map_irq;
     uint32_t config_reg; /* XXX: suppress */
     /* low level pic */
     SetIRQFunc *low_set_irq;
-    void *irq_opaque;
+    qemu_irq *irq_opaque;
     PCIDevice *devices[256];
+    PCIDevice *parent_dev;
+    PCIBus *next;
+    /* The bus IRQ state is the logical OR of the connected devices.
+       Keep a count of the number of devices with raised IRQs.  */
+    int nirq;
+    int irq_count[];
 };
 
+static void pci_update_mappings(PCIDevice *d);
+static void pci_set_irq(void *opaque, int irq_num, int level);
+
 target_phys_addr_t pci_mem_base;
 static int pci_irq_index;
 static PCIBus *first_bus;
 
-PCIBus *pci_register_bus(pci_set_irq_fn set_irq, void *pic, int devfn_min)
+static void pcibus_save(QEMUFile *f, void *opaque)
+{
+    PCIBus *bus = (PCIBus *)opaque;
+    int i;
+
+    qemu_put_be32(f, bus->nirq);
+    for (i = 0; i < bus->nirq; i++)
+        qemu_put_be32(f, bus->irq_count[i]);
+}
+
+static int  pcibus_load(QEMUFile *f, void *opaque, int version_id)
+{
+    PCIBus *bus = (PCIBus *)opaque;
+    int i, nirq;
+
+    if (version_id != 1)
+        return -EINVAL;
+
+    nirq = qemu_get_be32(f);
+    if (bus->nirq != nirq) {
+        fprintf(stderr, "pcibus_load: nirq mismatch: src=%d dst=%d\n",
+                nirq, bus->nirq);
+        return -EINVAL;
+    }
+
+    for (i = 0; i < nirq; i++)
+        bus->irq_count[i] = qemu_get_be32(f);
+
+    return 0;
+}
+
+PCIBus *pci_register_bus(pci_set_irq_fn set_irq, pci_map_irq_fn map_irq,
+                         qemu_irq *pic, int devfn_min, int nirq)
 {
     PCIBus *bus;
-    bus = qemu_mallocz(sizeof(PCIBus));
+    static int nbus = 0;
+
+    bus = qemu_mallocz(sizeof(PCIBus) + (nirq * sizeof(int)));
     bus->set_irq = set_irq;
+    bus->map_irq = map_irq;
     bus->irq_opaque = pic;
     bus->devfn_min = devfn_min;
+    bus->nirq = nirq;
     first_bus = bus;
+    register_savevm("PCIBUS", nbus++, 1, pcibus_save, pcibus_load, bus);
+    return bus;
+}
+
+static PCIBus *pci_register_secondary_bus(PCIDevice *dev, pci_map_irq_fn map_irq)
+{
+    PCIBus *bus;
+    bus = qemu_mallocz(sizeof(PCIBus));
+    bus->map_irq = map_irq;
+    bus->parent_dev = dev;
+    bus->next = dev->bus->next;
+    dev->bus->next = bus;
     return bus;
 }
 
@@ -56,21 +117,31 @@ int pci_bus_num(PCIBus *s)
     return s->bus_num;
 }
 
-void generic_pci_save(QEMUFile* f, void *opaque)
+void pci_device_save(PCIDevice *s, QEMUFile *f)
 {
-    PCIDevice* s=(PCIDevice*)opaque;
+    int i;
 
+    qemu_put_be32(f, 2); /* PCI device version */
     qemu_put_buffer(f, s->config, 256);
+    for (i = 0; i < 4; i++)
+        qemu_put_be32(f, s->irq_state[i]);
 }
 
-int generic_pci_load(QEMUFile* f, void *opaque, int version_id)
+int pci_device_load(PCIDevice *s, QEMUFile *f)
 {
-    PCIDevice* s=(PCIDevice*)opaque;
+    uint32_t version_id;
+    int i;
 
-    if (version_id != 1)
+    version_id = qemu_get_be32(f);
+    if (version_id > 2)
         return -EINVAL;
-
     qemu_get_buffer(f, s->config, 256);
+    pci_update_mappings(s);
+
+    if (version_id >= 2)
+        for (i = 0; i < 4; i ++)
+            s->irq_state[i] = qemu_get_be32(f);
+
     return 0;
 }
 
@@ -99,6 +170,7 @@ PCIDevice *pci_register_device(PCIBus *bus, const char *name,
     pci_dev->bus = bus;
     pci_dev->devfn = devfn;
     pstrcpy(pci_dev->name, sizeof(pci_dev->name), name);
+    memset(pci_dev->irq_state, 0, sizeof(pci_dev->irq_state));
 
     if (!config_read)
         config_read = pci_default_read_config;
@@ -108,6 +180,7 @@ PCIDevice *pci_register_device(PCIBus *bus, const char *name,
     pci_dev->config_write = config_write;
     pci_dev->irq_index = pci_irq_index++;
     bus->devices[devfn] = pci_dev;
+    pci_dev->irq = qemu_allocate_irqs(pci_set_irq, pci_dev, 4);
     return pci_dev;
 }
 
@@ -133,7 +206,7 @@ void pci_register_io_region(PCIDevice *pci_dev, int region_num,
     *(uint32_t *)(pci_dev->config + addr) = cpu_to_le32(type);
 }
 
-target_phys_addr_t pci_to_cpu_addr(target_phys_addr_t addr)
+static target_phys_addr_t pci_to_cpu_addr(target_phys_addr_t addr)
 {
     return addr + pci_mem_base;
 }
@@ -221,16 +294,23 @@ uint32_t pci_default_read_config(PCIDevice *d,
                                  uint32_t address, int len)
 {
     uint32_t val;
+
     switch(len) {
-    case 1:
-        val = d->config[address];
-        break;
-    case 2:
-        val = le16_to_cpu(*(uint16_t *)(d->config + address));
-        break;
     default:
     case 4:
-        val = le32_to_cpu(*(uint32_t *)(d->config + address));
+	if (address <= 0xfc) {
+	    val = le32_to_cpu(*(uint32_t *)(d->config + address));
+	    break;
+	}
+	/* fall through */
+    case 2:
+        if (address <= 0xfe) {
+	    val = le16_to_cpu(*(uint16_t *)(d->config + address));
+	    break;
+	}
+	/* fall through */
+    case 1:
+        val = d->config[address];
         break;
     }
     return val;
@@ -320,7 +400,8 @@ void pci_default_write_config(PCIDevice *d,
         if (can_write) {
             d->config[addr] = val;
         }
-        addr++;
+        if (++addr > 0xff)
+        	break;
         val >>= 8;
     }
 
@@ -342,7 +423,9 @@ void pci_data_write(void *opaque, uint32_t addr, uint32_t val, int len)
            addr, val, len);
 #endif
     bus_num = (addr >> 16) & 0xff;
-    if (bus_num != 0)
+    while (s && s->bus_num != bus_num)
+        s = s->next;
+    if (!s)
         return;
     pci_dev = s->devices[(addr >> 8) & 0xff];
     if (!pci_dev)
@@ -363,7 +446,9 @@ uint32_t pci_data_read(void *opaque, uint32_t addr, int len)
     uint32_t val;
 
     bus_num = (addr >> 16) & 0xff;
-    if (bus_num != 0)
+    while (s && s->bus_num != bus_num)
+        s= s->next;
+    if (!s)
         goto fail;
     pci_dev = s->devices[(addr >> 8) & 0xff];
     if (!pci_dev) {
@@ -400,10 +485,26 @@ uint32_t pci_data_read(void *opaque, uint32_t addr, int len)
 /* generic PCI irq support */
 
 /* 0 <= irq_num <= 3. level must be 0 or 1 */
-void pci_set_irq(PCIDevice *pci_dev, int irq_num, int level)
+static void pci_set_irq(void *opaque, int irq_num, int level)
 {
-    PCIBus *bus = pci_dev->bus;
-    bus->set_irq(pci_dev, bus->irq_opaque, irq_num, level);
+    PCIDevice *pci_dev = (PCIDevice *)opaque;
+    PCIBus *bus;
+    int change;
+
+    change = level - pci_dev->irq_state[irq_num];
+    if (!change)
+        return;
+
+    pci_dev->irq_state[irq_num] = level;
+    for (;;) {
+        bus = pci_dev->bus;
+        irq_num = bus->map_irq(pci_dev, irq_num);
+        if (bus->set_irq)
+            break;
+        pci_dev = bus->parent_dev;
+    }
+    bus->irq_count[irq_num] += change;
+    bus->set_irq(bus->irq_opaque, irq_num, bus->irq_count[irq_num] != 0);
 }
 
 /***********************************************************/
@@ -416,12 +517,40 @@ typedef struct {
 
 static pci_class_desc pci_class_descriptions[] =
 {
+    { 0x0100, "SCSI controller"},
     { 0x0101, "IDE controller"},
+    { 0x0102, "Floppy controller"},
+    { 0x0103, "IPI controller"},
+    { 0x0104, "RAID controller"},
+    { 0x0106, "SATA controller"},
+    { 0x0107, "SAS controller"},
+    { 0x0180, "Storage controller"},
     { 0x0200, "Ethernet controller"},
+    { 0x0201, "Token Ring controller"},
+    { 0x0202, "FDDI controller"},
+    { 0x0203, "ATM controller"},
+    { 0x0280, "Network controller"},
     { 0x0300, "VGA controller"},
+    { 0x0301, "XGA controller"},
+    { 0x0302, "3D controller"},
+    { 0x0380, "Display controller"},
+    { 0x0400, "Video controller"},
+    { 0x0401, "Audio controller"},
+    { 0x0402, "Phone"},
+    { 0x0480, "Multimedia controller"},
+    { 0x0500, "RAM controller"},
+    { 0x0501, "Flash controller"},
+    { 0x0580, "Memory controller"},
     { 0x0600, "Host bridge"},
     { 0x0601, "ISA bridge"},
+    { 0x0602, "EISA bridge"},
+    { 0x0603, "MC bridge"},
     { 0x0604, "PCI bridge"},
+    { 0x0605, "PCMCIA bridge"},
+    { 0x0606, "NUBUS bridge"},
+    { 0x0607, "CARDBUS bridge"},
+    { 0x0608, "RACEWAY bridge"},
+    { 0x0680, "Bridge"},
     { 0x0c03, "USB controller"},
     { 0, NULL}
 };
@@ -451,6 +580,9 @@ static void pci_info_device(PCIDevice *d)
     if (d->config[PCI_INTERRUPT_PIN] != 0) {
         term_printf("      IRQ %d.\n", d->config[PCI_INTERRUPT_LINE]);
     }
+    if (class == 0x0604) {
+        term_printf("      BUS %d.\n", d->config[0x19]);
+    }
     for(i = 0;i < PCI_NUM_REGIONS; i++) {
         r = &d->io_regions[i];
         if (r->size != 0) {
@@ -464,14 +596,19 @@ static void pci_info_device(PCIDevice *d)
             }
         }
     }
+    if (class == 0x0604 && d->config[0x19] != 0) {
+        pci_for_each_device(d->config[0x19], pci_info_device);
+    }
 }
 
-void pci_for_each_device(void (*fn)(PCIDevice *d))
+void pci_for_each_device(int bus_num, void (*fn)(PCIDevice *d))
 {
     PCIBus *bus = first_bus;
     PCIDevice *d;
     int devfn;
 
+    while (bus && bus->bus_num != bus_num)
+        bus = bus->next;
     if (bus) {
         for(devfn = 0; devfn < 256; devfn++) {
             d = bus->devices[devfn];
@@ -483,25 +620,82 @@ void pci_for_each_device(void (*fn)(PCIDevice *d))
 
 void pci_info(void)
 {
-    pci_for_each_device(pci_info_device);
+    pci_for_each_device(0, pci_info_device);
 }
 
 /* Initialize a PCI NIC.  */
-void pci_nic_init(PCIBus *bus, NICInfo *nd)
+void pci_nic_init(PCIBus *bus, NICInfo *nd, int devfn)
 {
-#if 0 /* ANDROID */
+#if 0
     if (strcmp(nd->model, "ne2k_pci") == 0) {
-        pci_ne2000_init(bus, nd);
+        pci_ne2000_init(bus, nd, devfn);
+    } else if (strcmp(nd->model, "i82551") == 0) {
+        pci_i82551_init(bus, nd, devfn);
+    } else if (strcmp(nd->model, "i82557b") == 0) {
+        pci_i82557b_init(bus, nd, devfn);
+    } else if (strcmp(nd->model, "i82559er") == 0) {
+        pci_i82559er_init(bus, nd, devfn);
     } else if (strcmp(nd->model, "rtl8139") == 0) {
-        pci_rtl8139_init(bus, nd);
+        pci_rtl8139_init(bus, nd, devfn);
+    } else if (strcmp(nd->model, "e1000") == 0) {
+        pci_e1000_init(bus, nd, devfn);
     } else if (strcmp(nd->model, "pcnet") == 0) {
-        pci_pcnet_init(bus, nd);
+        pci_pcnet_init(bus, nd, devfn);
+    } else if (strcmp(nd->model, "?") == 0) {
+        fprintf(stderr, "qemu: Supported PCI NICs: i82551 i82557b i82559er"
+                        " ne2k_pci pcnet rtl8139 e1000\n");
+        exit (1);
     } else {
-#else
-    {
-#endif
         fprintf(stderr, "qemu: Unsupported NIC: %s\n", nd->model);
         exit (1);
     }
+#endif
 }
 
+typedef struct {
+    PCIDevice dev;
+    PCIBus *bus;
+} PCIBridge;
+
+static void pci_bridge_write_config(PCIDevice *d,
+                             uint32_t address, uint32_t val, int len)
+{
+    PCIBridge *s = (PCIBridge *)d;
+
+    if (address == 0x19 || (address == 0x18 && len > 1)) {
+        if (address == 0x19)
+            s->bus->bus_num = val & 0xff;
+        else
+            s->bus->bus_num = (val >> 8) & 0xff;
+#if defined(DEBUG_PCI)
+        printf ("pci-bridge: %s: Assigned bus %d\n", d->name, s->bus->bus_num);
+#endif
+    }
+    pci_default_write_config(d, address, val, len);
+}
+
+PCIBus *pci_bridge_init(PCIBus *bus, int devfn, uint32_t id,
+                        pci_map_irq_fn map_irq, const char *name)
+{
+    PCIBridge *s;
+    s = (PCIBridge *)pci_register_device(bus, name, sizeof(PCIBridge),
+                                         devfn, NULL, pci_bridge_write_config);
+    s->dev.config[0x00] = id >> 16;
+    s->dev.config[0x01] = id >> 24;
+    s->dev.config[0x02] = id; // device_id
+    s->dev.config[0x03] = id >> 8;
+    s->dev.config[0x04] = 0x06; // command = bus master, pci mem
+    s->dev.config[0x05] = 0x00;
+    s->dev.config[0x06] = 0xa0; // status = fast back-to-back, 66MHz, no error
+    s->dev.config[0x07] = 0x00; // status = fast devsel
+    s->dev.config[0x08] = 0x00; // revision
+    s->dev.config[0x09] = 0x00; // programming i/f
+    s->dev.config[0x0A] = 0x04; // class_sub = PCI to PCI bridge
+    s->dev.config[0x0B] = 0x06; // class_base = PCI_bridge
+    s->dev.config[0x0D] = 0x10; // latency_timer
+    s->dev.config[0x0E] = 0x81; // header_type
+    s->dev.config[0x1E] = 0xa0; // secondary status
+
+    s->bus = pci_register_secondary_bus(&s->dev, map_irq);
+    return s->bus;
+}
diff --git a/hw/pci.h b/hw/pci.h
new file mode 100644
index 0000000..e870987
--- /dev/null
+++ b/hw/pci.h
@@ -0,0 +1,142 @@
+#ifndef QEMU_PCI_H
+#define QEMU_PCI_H
+
+/* PCI includes legacy ISA access.  */
+#include "isa.h"
+
+/* PCI bus */
+
+extern target_phys_addr_t pci_mem_base;
+
+typedef void PCIConfigWriteFunc(PCIDevice *pci_dev,
+                                uint32_t address, uint32_t data, int len);
+typedef uint32_t PCIConfigReadFunc(PCIDevice *pci_dev,
+                                   uint32_t address, int len);
+typedef void PCIMapIORegionFunc(PCIDevice *pci_dev, int region_num,
+                                uint32_t addr, uint32_t size, int type);
+
+#define PCI_ADDRESS_SPACE_MEM		0x00
+#define PCI_ADDRESS_SPACE_IO		0x01
+#define PCI_ADDRESS_SPACE_MEM_PREFETCH	0x08
+
+typedef struct PCIIORegion {
+    uint32_t addr; /* current PCI mapping address. -1 means not mapped */
+    uint32_t size;
+    uint8_t type;
+    PCIMapIORegionFunc *map_func;
+} PCIIORegion;
+
+#define PCI_ROM_SLOT 6
+#define PCI_NUM_REGIONS 7
+
+#define PCI_DEVICES_MAX 64
+
+#define PCI_VENDOR_ID		0x00	/* 16 bits */
+#define PCI_DEVICE_ID		0x02	/* 16 bits */
+#define PCI_COMMAND		0x04	/* 16 bits */
+#define  PCI_COMMAND_IO		0x1	/* Enable response in I/O space */
+#define  PCI_COMMAND_MEMORY	0x2	/* Enable response in Memory space */
+#define PCI_CLASS_DEVICE        0x0a    /* Device class */
+#define PCI_INTERRUPT_LINE	0x3c	/* 8 bits */
+#define PCI_INTERRUPT_PIN	0x3d	/* 8 bits */
+#define PCI_MIN_GNT		0x3e	/* 8 bits */
+#define PCI_MAX_LAT		0x3f	/* 8 bits */
+
+struct PCIDevice {
+    /* PCI config space */
+    uint8_t config[256];
+
+    /* the following fields are read only */
+    PCIBus *bus;
+    int devfn;
+    char name[64];
+    PCIIORegion io_regions[PCI_NUM_REGIONS];
+
+    /* do not access the following fields */
+    PCIConfigReadFunc *config_read;
+    PCIConfigWriteFunc *config_write;
+    /* ??? This is a PC-specific hack, and should be removed.  */
+    int irq_index;
+
+    /* IRQ objects for the INTA-INTD pins.  */
+    qemu_irq *irq;
+
+    /* Current IRQ levels.  Used internally by the generic PCI code.  */
+    int irq_state[4];
+};
+
+PCIDevice *pci_register_device(PCIBus *bus, const char *name,
+                               int instance_size, int devfn,
+                               PCIConfigReadFunc *config_read,
+                               PCIConfigWriteFunc *config_write);
+
+void pci_register_io_region(PCIDevice *pci_dev, int region_num,
+                            uint32_t size, int type,
+                            PCIMapIORegionFunc *map_func);
+
+uint32_t pci_default_read_config(PCIDevice *d,
+                                 uint32_t address, int len);
+void pci_default_write_config(PCIDevice *d,
+                              uint32_t address, uint32_t val, int len);
+void pci_device_save(PCIDevice *s, QEMUFile *f);
+int pci_device_load(PCIDevice *s, QEMUFile *f);
+
+typedef void (*pci_set_irq_fn)(qemu_irq *pic, int irq_num, int level);
+typedef int (*pci_map_irq_fn)(PCIDevice *pci_dev, int irq_num);
+PCIBus *pci_register_bus(pci_set_irq_fn set_irq, pci_map_irq_fn map_irq,
+                         qemu_irq *pic, int devfn_min, int nirq);
+
+void pci_nic_init(PCIBus *bus, NICInfo *nd, int devfn);
+void pci_data_write(void *opaque, uint32_t addr, uint32_t val, int len);
+uint32_t pci_data_read(void *opaque, uint32_t addr, int len);
+int pci_bus_num(PCIBus *s);
+void pci_for_each_device(int bus_num, void (*fn)(PCIDevice *d));
+
+void pci_info(void);
+PCIBus *pci_bridge_init(PCIBus *bus, int devfn, uint32_t id,
+                        pci_map_irq_fn map_irq, const char *name);
+
+/* lsi53c895a.c */
+#define LSI_MAX_DEVS 7
+void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id);
+void *lsi_scsi_init(PCIBus *bus, int devfn);
+
+/* vmware_vga.c */
+void pci_vmsvga_init(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
+                     unsigned long vga_ram_offset, int vga_ram_size);
+
+/* usb-uhci.c */
+void usb_uhci_piix3_init(PCIBus *bus, int devfn);
+void usb_uhci_piix4_init(PCIBus *bus, int devfn);
+
+/* usb-ohci.c */
+void usb_ohci_init_pci(struct PCIBus *bus, int num_ports, int devfn);
+
+/* eepro100.c */
+
+void pci_i82551_init(PCIBus *bus, NICInfo *nd, int devfn);
+void pci_i82557b_init(PCIBus *bus, NICInfo *nd, int devfn);
+void pci_i82559er_init(PCIBus *bus, NICInfo *nd, int devfn);
+
+/* ne2000.c */
+
+void pci_ne2000_init(PCIBus *bus, NICInfo *nd, int devfn);
+
+/* rtl8139.c */
+
+void pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn);
+
+/* e1000.c */
+void pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn);
+
+/* pcnet.c */
+void pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn);
+
+/* prep_pci.c */
+PCIBus *pci_prep_init(qemu_irq *pic);
+
+/* apb_pci.c */
+PCIBus *pci_apb_init(target_phys_addr_t special_base, target_phys_addr_t mem_base,
+                     qemu_irq *pic);
+
+#endif
diff --git a/hw/pci_host.h b/hw/pci_host.h
index 708dae2..49a0c59 100644
--- a/hw/pci_host.h
+++ b/hw/pci_host.h
@@ -2,7 +2,7 @@
  * QEMU Common PCI Host bridge configuration data space access routines.
  *
  * Copyright (c) 2006 Fabrice Bellard
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
diff --git a/hw/pcmcia.h b/hw/pcmcia.h
new file mode 100644
index 0000000..bfa23ba
--- /dev/null
+++ b/hw/pcmcia.h
@@ -0,0 +1,50 @@
+/* PCMCIA/Cardbus */
+
+struct pcmcia_socket_s {
+    qemu_irq irq;
+    int attached;
+    const char *slot_string;
+    const char *card_string;
+};
+
+void pcmcia_socket_register(struct pcmcia_socket_s *socket);
+void pcmcia_socket_unregister(struct pcmcia_socket_s *socket);
+void pcmcia_info(void);
+
+struct pcmcia_card_s {
+    void *state;
+    struct pcmcia_socket_s *slot;
+    int (*attach)(void *state);
+    int (*detach)(void *state);
+    const uint8_t *cis;
+    int cis_len;
+
+    /* Only valid if attached */
+    uint8_t (*attr_read)(void *state, uint32_t address);
+    void (*attr_write)(void *state, uint32_t address, uint8_t value);
+    uint16_t (*common_read)(void *state, uint32_t address);
+    void (*common_write)(void *state, uint32_t address, uint16_t value);
+    uint16_t (*io_read)(void *state, uint32_t address);
+    void (*io_write)(void *state, uint32_t address, uint16_t value);
+};
+
+#define CISTPL_DEVICE		0x01	/* 5V Device Information Tuple */
+#define CISTPL_NO_LINK		0x14	/* No Link Tuple */
+#define CISTPL_VERS_1		0x15	/* Level 1 Version Tuple */
+#define CISTPL_JEDEC_C		0x18	/* JEDEC ID Tuple */
+#define CISTPL_JEDEC_A		0x19	/* JEDEC ID Tuple */
+#define CISTPL_CONFIG		0x1a	/* Configuration Tuple */
+#define CISTPL_CFTABLE_ENTRY	0x1b	/* 16-bit PCCard Configuration */
+#define CISTPL_DEVICE_OC	0x1c	/* Additional Device Information */
+#define CISTPL_DEVICE_OA	0x1d	/* Additional Device Information */
+#define CISTPL_DEVICE_GEO	0x1e	/* Additional Device Information */
+#define CISTPL_DEVICE_GEO_A	0x1f	/* Additional Device Information */
+#define CISTPL_MANFID		0x20	/* Manufacture ID Tuple */
+#define CISTPL_FUNCID		0x21	/* Function ID Tuple */
+#define CISTPL_FUNCE		0x22	/* Function Extension Tuple */
+#define CISTPL_END		0xff	/* Tuple End */
+#define CISTPL_ENDMARK		0xff
+
+/* dscm1xxxx.c */
+struct pcmcia_card_s *dscm1xxxx_init(BlockDriverState *bdrv);
+
diff --git a/hw/pxa.h b/hw/pxa.h
new file mode 100644
index 0000000..16a68d9
--- /dev/null
+++ b/hw/pxa.h
@@ -0,0 +1,227 @@
+/*
+ * Intel XScale PXA255/270 processor support.
+ *
+ * Copyright (c) 2006 Openedhand Ltd.
+ * Written by Andrzej Zaborowski <balrog@zabor.org>
+ *
+ * This code is licenced under the GNU GPL v2.
+ */
+#ifndef PXA_H
+# define PXA_H			"pxa.h"
+
+/* Interrupt numbers */
+# define PXA2XX_PIC_SSP3	0
+# define PXA2XX_PIC_USBH2	2
+# define PXA2XX_PIC_USBH1	3
+# define PXA2XX_PIC_KEYPAD	4
+# define PXA2XX_PIC_PWRI2C	6
+# define PXA25X_PIC_HWUART	7
+# define PXA27X_PIC_OST_4_11	7
+# define PXA2XX_PIC_GPIO_0	8
+# define PXA2XX_PIC_GPIO_1	9
+# define PXA2XX_PIC_GPIO_X	10
+# define PXA2XX_PIC_I2S 	13
+# define PXA26X_PIC_ASSP	15
+# define PXA25X_PIC_NSSP	16
+# define PXA27X_PIC_SSP2	16
+# define PXA2XX_PIC_LCD		17
+# define PXA2XX_PIC_I2C		18
+# define PXA2XX_PIC_ICP		19
+# define PXA2XX_PIC_STUART	20
+# define PXA2XX_PIC_BTUART	21
+# define PXA2XX_PIC_FFUART	22
+# define PXA2XX_PIC_MMC		23
+# define PXA2XX_PIC_SSP		24
+# define PXA2XX_PIC_DMA		25
+# define PXA2XX_PIC_OST_0	26
+# define PXA2XX_PIC_RTC1HZ	30
+# define PXA2XX_PIC_RTCALARM	31
+
+/* DMA requests */
+# define PXA2XX_RX_RQ_I2S	2
+# define PXA2XX_TX_RQ_I2S	3
+# define PXA2XX_RX_RQ_BTUART	4
+# define PXA2XX_TX_RQ_BTUART	5
+# define PXA2XX_RX_RQ_FFUART	6
+# define PXA2XX_TX_RQ_FFUART	7
+# define PXA2XX_RX_RQ_SSP1	13
+# define PXA2XX_TX_RQ_SSP1	14
+# define PXA2XX_RX_RQ_SSP2	15
+# define PXA2XX_TX_RQ_SSP2	16
+# define PXA2XX_RX_RQ_ICP	17
+# define PXA2XX_TX_RQ_ICP	18
+# define PXA2XX_RX_RQ_STUART	19
+# define PXA2XX_TX_RQ_STUART	20
+# define PXA2XX_RX_RQ_MMCI	21
+# define PXA2XX_TX_RQ_MMCI	22
+# define PXA2XX_USB_RQ(x)	((x) + 24)
+# define PXA2XX_RX_RQ_SSP3	66
+# define PXA2XX_TX_RQ_SSP3	67
+
+# define PXA2XX_SDRAM_BASE	0xa0000000
+# define PXA2XX_INTERNAL_BASE	0x5c000000
+# define PXA2XX_INTERNAL_SIZE	0x40000
+
+/* pxa2xx_pic.c */
+qemu_irq *pxa2xx_pic_init(target_phys_addr_t base, CPUState *env);
+
+/* pxa2xx_timer.c */
+void pxa25x_timer_init(target_phys_addr_t base, qemu_irq *irqs);
+void pxa27x_timer_init(target_phys_addr_t base, qemu_irq *irqs, qemu_irq irq4);
+
+/* pxa2xx_gpio.c */
+struct pxa2xx_gpio_info_s;
+struct pxa2xx_gpio_info_s *pxa2xx_gpio_init(target_phys_addr_t base,
+                CPUState *env, qemu_irq *pic, int lines);
+qemu_irq *pxa2xx_gpio_in_get(struct pxa2xx_gpio_info_s *s);
+void pxa2xx_gpio_out_set(struct pxa2xx_gpio_info_s *s,
+                int line, qemu_irq handler);
+void pxa2xx_gpio_read_notifier(struct pxa2xx_gpio_info_s *s, qemu_irq handler);
+
+/* pxa2xx_dma.c */
+struct pxa2xx_dma_state_s;
+struct pxa2xx_dma_state_s *pxa255_dma_init(target_phys_addr_t base,
+                qemu_irq irq);
+struct pxa2xx_dma_state_s *pxa27x_dma_init(target_phys_addr_t base,
+                qemu_irq irq);
+void pxa2xx_dma_request(struct pxa2xx_dma_state_s *s, int req_num, int on);
+
+/* pxa2xx_lcd.c */
+struct pxa2xx_lcdc_s;
+struct pxa2xx_lcdc_s *pxa2xx_lcdc_init(target_phys_addr_t base,
+                qemu_irq irq, DisplayState *ds);
+void pxa2xx_lcd_vsync_notifier(struct pxa2xx_lcdc_s *s, qemu_irq handler);
+void pxa2xx_lcdc_oritentation(void *opaque, int angle);
+
+/* pxa2xx_mmci.c */
+struct pxa2xx_mmci_s;
+struct pxa2xx_mmci_s *pxa2xx_mmci_init(target_phys_addr_t base,
+                BlockDriverState *bd, qemu_irq irq, void *dma);
+void pxa2xx_mmci_handlers(struct pxa2xx_mmci_s *s, qemu_irq readonly,
+                qemu_irq coverswitch);
+
+/* pxa2xx_pcmcia.c */
+struct pxa2xx_pcmcia_s;
+struct pxa2xx_pcmcia_s *pxa2xx_pcmcia_init(target_phys_addr_t base);
+int pxa2xx_pcmcia_attach(void *opaque, struct pcmcia_card_s *card);
+int pxa2xx_pcmcia_dettach(void *opaque);
+void pxa2xx_pcmcia_set_irq_cb(void *opaque, qemu_irq irq, qemu_irq cd_irq);
+
+/* pxa2xx_keypad.c */
+struct  keymap {
+    int column;
+    int row;
+};
+struct pxa2xx_keypad_s;
+struct pxa2xx_keypad_s *pxa27x_keypad_init(target_phys_addr_t base,
+                qemu_irq irq);
+void pxa27x_register_keypad(struct pxa2xx_keypad_s *kp, struct keymap *map,
+                int size);
+
+/* pxa2xx.c */
+struct pxa2xx_ssp_s;
+void pxa2xx_ssp_attach(struct pxa2xx_ssp_s *port,
+                uint32_t (*readfn)(void *opaque),
+                void (*writefn)(void *opaque, uint32_t value), void *opaque);
+
+struct pxa2xx_i2c_s;
+struct pxa2xx_i2c_s *pxa2xx_i2c_init(target_phys_addr_t base,
+                qemu_irq irq, uint32_t page_size);
+i2c_bus *pxa2xx_i2c_bus(struct pxa2xx_i2c_s *s);
+
+struct pxa2xx_i2s_s;
+struct pxa2xx_fir_s;
+
+struct pxa2xx_state_s {
+    CPUState *env;
+    qemu_irq *pic;
+    qemu_irq reset;
+    struct pxa2xx_dma_state_s *dma;
+    struct pxa2xx_gpio_info_s *gpio;
+    struct pxa2xx_lcdc_s *lcd;
+    struct pxa2xx_ssp_s **ssp;
+    struct pxa2xx_i2c_s *i2c[2];
+    struct pxa2xx_mmci_s *mmc;
+    struct pxa2xx_pcmcia_s *pcmcia[2];
+    struct pxa2xx_i2s_s *i2s;
+    struct pxa2xx_fir_s *fir;
+    struct pxa2xx_keypad_s *kp;
+
+    /* Power management */
+    target_phys_addr_t pm_base;
+    uint32_t pm_regs[0x40];
+
+    /* Clock management */
+    target_phys_addr_t cm_base;
+    uint32_t cm_regs[4];
+    uint32_t clkcfg;
+
+    /* Memory management */
+    target_phys_addr_t mm_base;
+    uint32_t mm_regs[0x1a];
+
+    /* Performance monitoring */
+    uint32_t pmnc;
+
+    /* Real-Time clock */
+    target_phys_addr_t rtc_base;
+    uint32_t rttr;
+    uint32_t rtsr;
+    uint32_t rtar;
+    uint32_t rdar1;
+    uint32_t rdar2;
+    uint32_t ryar1;
+    uint32_t ryar2;
+    uint32_t swar1;
+    uint32_t swar2;
+    uint32_t piar;
+    uint32_t last_rcnr;
+    uint32_t last_rdcr;
+    uint32_t last_rycr;
+    uint32_t last_swcr;
+    uint32_t last_rtcpicr;
+    int64_t last_hz;
+    int64_t last_sw;
+    int64_t last_pi;
+    QEMUTimer *rtc_hz;
+    QEMUTimer *rtc_rdal1;
+    QEMUTimer *rtc_rdal2;
+    QEMUTimer *rtc_swal1;
+    QEMUTimer *rtc_swal2;
+    QEMUTimer *rtc_pi;
+};
+
+struct pxa2xx_i2s_s {
+    target_phys_addr_t base;
+    qemu_irq irq;
+    struct pxa2xx_dma_state_s *dma;
+    void (*data_req)(void *, int, int);
+
+    uint32_t control[2];
+    uint32_t status;
+    uint32_t mask;
+    uint32_t clk;
+
+    int enable;
+    int rx_len;
+    int tx_len;
+    void (*codec_out)(void *, uint32_t);
+    uint32_t (*codec_in)(void *);
+    void *opaque;
+
+    int fifo_len;
+    uint32_t fifo[16];
+};
+
+# define PA_FMT			"0x%08lx"
+# define REG_FMT		"0x" TARGET_FMT_plx
+
+struct pxa2xx_state_s *pxa270_init(unsigned int sdram_size, DisplayState *ds,
+                const char *revision);
+struct pxa2xx_state_s *pxa255_init(unsigned int sdram_size, DisplayState *ds);
+
+/* usb-ohci.c */
+void usb_ohci_init_pxa(target_phys_addr_t base, int num_ports, int devfn,
+                       qemu_irq irq);
+
+#endif	/* PXA_H */
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index decab1f..16b3215 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -7,6 +7,10 @@
  * Written by Paul Brook
  *
  * This code is licenced under the LGPL.
+ *
+ * Note that this file only handles the SCSI architecture model and device
+ * commands.  Emulation of interface/link layer protocols is handled by
+ * the host adapter emulator.
  */
 
 //#define DEBUG_SCSI
@@ -21,153 +25,255 @@ do { printf("scsi-disk: " fmt , ##args); } while (0)
 #define BADF(fmt, args...) \
 do { fprintf(stderr, "scsi-disk: " fmt , ##args); } while (0)
 
-#include "vl.h"
+#include "qemu-common.h"
+#include "block.h"
+#include "scsi-disk.h"
 
 #define SENSE_NO_SENSE        0
+#define SENSE_NOT_READY       2
+#define SENSE_HARDWARE_ERROR  4
 #define SENSE_ILLEGAL_REQUEST 5
 
-struct SCSIDevice
-{
-    int command;
+#define SCSI_DMA_BUF_SIZE    65536
+
+typedef struct SCSIRequest {
+    SCSIDeviceState *dev;
     uint32_t tag;
-    BlockDriverState *bdrv;
-    /* The qemu block layer uses a fixed 512 byte sector size.
-       This is the number of 512 byte blocks in a single scsi sector.  */
-    int cluster_size;
-    /* When transfering data buf_pos and buf_len contain a partially
-       transferred block of data (or response to a command), and
-       sector/sector_count identify any remaining sectors.
-       Both sector and sector_count are in terms of qemu 512 byte blocks.  */
     /* ??? We should probably keep track of whether the data trasfer is
        a read or a write.  Currently we rely on the host getting it right.  */
+    /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */
     int sector;
     int sector_count;
-    int buf_pos;
+    /* The amounnt of data in the buffer.  */
     int buf_len;
+    uint8_t *dma_buf;
+    BlockDriverAIOCB *aiocb;
+    struct SCSIRequest *next;
+} SCSIRequest;
+
+struct SCSIDeviceState
+{
+    BlockDriverState *bdrv;
+    SCSIRequest *requests;
+    /* The qemu block layer uses a fixed 512 byte sector size.
+       This is the number of 512 byte blocks in a single scsi sector.  */
+    int cluster_size;
     int sense;
-    char buf[512];
+    int tcq;
+    /* Completion functions may be called from either scsi_{read,write}_data
+       or from the AIO completion routines.  */
     scsi_completionfn completion;
     void *opaque;
 };
 
-static void scsi_command_complete(SCSIDevice *s, int sense)
+/* Global pool of SCSIRequest structures.  */
+static SCSIRequest *free_requests = NULL;
+
+static SCSIRequest *scsi_new_request(SCSIDeviceState *s, uint32_t tag)
 {
-    s->sense = sense;
-    s->completion(s->opaque, s->tag, sense);
+    SCSIRequest *r;
+
+    if (free_requests) {
+        r = free_requests;
+        free_requests = r->next;
+    } else {
+        r = qemu_malloc(sizeof(SCSIRequest));
+        r->dma_buf = qemu_memalign(512, SCSI_DMA_BUF_SIZE);
+    }
+    r->dev = s;
+    r->tag = tag;
+    r->sector_count = 0;
+    r->buf_len = 0;
+    r->aiocb = NULL;
+
+    r->next = s->requests;
+    s->requests = r;
+    return r;
 }
 
-/* Read data from a scsi device.  Returns nonzero on failure.  */
-int scsi_read_data(SCSIDevice *s, uint8_t *data, uint32_t len)
+static void scsi_remove_request(SCSIRequest *r)
 {
-    uint32_t n;
-
-    DPRINTF("Read %d (%d/%d)\n", len, s->buf_len, s->sector_count);
-    if (s->buf_len == 0 && s->sector_count == 0)
-        return 1;
+    SCSIRequest *last;
+    SCSIDeviceState *s = r->dev;
 
-    if (s->buf_len) {
-        n = s->buf_len;
-        if (n > len)
-            n = len;
-        memcpy(data, s->buf + s->buf_pos, n);
-        s->buf_pos += n;
-        s->buf_len -= n;
-        data += n;
-        len -= n;
-        if (s->buf_len == 0)
-            s->buf_pos = 0;
+    if (s->requests == r) {
+        s->requests = r->next;
+    } else {
+        last = s->requests;
+        while (last && last->next != r)
+            last = last->next;
+        if (last) {
+            last->next = r->next;
+        } else {
+            BADF("Orphaned request\n");
+        }
     }
+    r->next = free_requests;
+    free_requests = r;
+}
 
-    n = len / 512;
-    if (n > s->sector_count)
-      n = s->sector_count;
+static SCSIRequest *scsi_find_request(SCSIDeviceState *s, uint32_t tag)
+{
+    SCSIRequest *r;
 
-    if (n != 0) {
-        bdrv_read(s->bdrv, s->sector, data, n);
-        data += n * 512;
-        len -= n * 512;
-        s->sector += n;
-        s->sector_count -= n;
-    }
+    r = s->requests;
+    while (r && r->tag != tag)
+        r = r->next;
+
+    return r;
+}
+
+/* Helper function for command completion.  */
+static void scsi_command_complete(SCSIRequest *r, int sense)
+{
+    SCSIDeviceState *s = r->dev;
+    uint32_t tag;
+    DPRINTF("Command complete tag=0x%x sense=%d\n", r->tag, sense);
+    s->sense = sense;
+    tag = r->tag;
+    scsi_remove_request(r);
+    s->completion(s->opaque, SCSI_REASON_DONE, tag, sense);
+}
 
-    if (len && s->sector_count) {
-        bdrv_read(s->bdrv, s->sector, s->buf, 1);
-        s->sector++;
-        s->sector_count--;
-        s->buf_pos = 0;
-        s->buf_len = 512;
-        /* Recurse to complete the partial read.  */
-        return scsi_read_data(s, data, len);
+/* Cancel a pending data transfer.  */
+static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)
+{
+    SCSIDeviceState *s = d->state;
+    SCSIRequest *r;
+    DPRINTF("Cancel tag=0x%x\n", tag);
+    r = scsi_find_request(s, tag);
+    if (r) {
+        if (r->aiocb)
+            bdrv_aio_cancel(r->aiocb);
+        r->aiocb = NULL;
+        scsi_remove_request(r);
     }
+}
 
-    if (len != 0)
-        return 1;
+static void scsi_read_complete(void * opaque, int ret)
+{
+    SCSIRequest *r = (SCSIRequest *)opaque;
+    SCSIDeviceState *s = r->dev;
 
-    if (s->buf_len == 0 && s->sector_count == 0)
-        scsi_command_complete(s, SENSE_NO_SENSE);
+    if (ret) {
+        DPRINTF("IO error\n");
+        scsi_command_complete(r, SENSE_HARDWARE_ERROR);
+        return;
+    }
+    DPRINTF("Data ready tag=0x%x len=%d\n", r->tag, r->buf_len);
 
-    return 0;
+    s->completion(s->opaque, SCSI_REASON_DATA, r->tag, r->buf_len);
 }
 
-/* Read data to a scsi device.  Returns nonzero on failure.  */
-int scsi_write_data(SCSIDevice *s, uint8_t *data, uint32_t len)
+/* Read more data from scsi device into buffer.  */
+static void scsi_read_data(SCSIDevice *d, uint32_t tag)
 {
+    SCSIDeviceState *s = d->state;
+    SCSIRequest *r;
     uint32_t n;
 
-    DPRINTF("Write %d (%d/%d)\n", len, s->buf_len, s->sector_count);
-    if (s->buf_pos != 0) {
-        BADF("Bad state on write\n");
-        return 1;
+    r = scsi_find_request(s, tag);
+    if (!r) {
+        BADF("Bad read tag 0x%x\n", tag);
+        /* ??? This is the wrong error.  */
+        scsi_command_complete(r, SENSE_HARDWARE_ERROR);
+        return;
+    }
+    if (r->sector_count == (uint32_t)-1) {
+        DPRINTF("Read buf_len=%d\n", r->buf_len);
+        r->sector_count = 0;
+        s->completion(s->opaque, SCSI_REASON_DATA, r->tag, r->buf_len);
+        return;
+    }
+    DPRINTF("Read sector_count=%d\n", r->sector_count);
+    if (r->sector_count == 0) {
+        scsi_command_complete(r, SENSE_NO_SENSE);
+        return;
     }
 
-    if (s->sector_count == 0)
-        return 1;
+    n = r->sector_count;
+    if (n > SCSI_DMA_BUF_SIZE / 512)
+        n = SCSI_DMA_BUF_SIZE / 512;
+
+    r->buf_len = n * 512;
+    r->aiocb = bdrv_aio_read(s->bdrv, r->sector, r->dma_buf, n,
+                             scsi_read_complete, r);
+    if (r->aiocb == NULL)
+        scsi_command_complete(r, SENSE_HARDWARE_ERROR);
+    r->sector += n;
+    r->sector_count -= n;
+}
 
-    if (s->buf_len != 0 || len < 512) {
-        n = 512 - s->buf_len;
-        if (n > len)
-            n = len;
-
-        memcpy(s->buf + s->buf_len, data, n);
-        data += n;
-        s->buf_len += n;
-        len -= n;
-        if (s->buf_len == 512) {
-            /* A full sector has been accumulated. Write it to disk.  */
-            bdrv_write(s->bdrv, s->sector, s->buf, 1);
-            s->buf_len = 0;
-            s->sector++;
-            s->sector_count--;
-        }
-    }
+static void scsi_write_complete(void * opaque, int ret)
+{
+    SCSIRequest *r = (SCSIRequest *)opaque;
+    SCSIDeviceState *s = r->dev;
+    uint32_t len;
 
-    n = len / 512;
-    if (n > s->sector_count)
-        n = s->sector_count;
+    if (ret) {
+        fprintf(stderr, "scsi-disc: IO write error\n");
+        exit(1);
+    }
 
-    if (n != 0) {
-        bdrv_write(s->bdrv, s->sector, data, n);
-        data += n * 512;
-        len -= n * 512;
-        s->sector += n;
-        s->sector_count -= n;
+    r->aiocb = NULL;
+    if (r->sector_count == 0) {
+        scsi_command_complete(r, SENSE_NO_SENSE);
+    } else {
+        len = r->sector_count * 512;
+        if (len > SCSI_DMA_BUF_SIZE) {
+            len = SCSI_DMA_BUF_SIZE;
+        }
+        r->buf_len = len;
+        DPRINTF("Write complete tag=0x%x more=%d\n", r->tag, len);
+        s->completion(s->opaque, SCSI_REASON_DATA, r->tag, len);
     }
+}
 
-    if (len >= 512)
-        return 1;
+/* Write data to a scsi device.  Returns nonzero on failure.
+   The transfer may complete asynchronously.  */
+static int scsi_write_data(SCSIDevice *d, uint32_t tag)
+{
+    SCSIDeviceState *s = d->state;
+    SCSIRequest *r;
+    uint32_t n;
 
-    if (len && s->sector_count) {
-        /* Recurse to complete the partial write.  */
-        return scsi_write_data(s, data, len);
+    DPRINTF("Write data tag=0x%x\n", tag);
+    r = scsi_find_request(s, tag);
+    if (!r) {
+        BADF("Bad write tag 0x%x\n", tag);
+        scsi_command_complete(r, SENSE_HARDWARE_ERROR);
+        return 1;
+    }
+    if (r->aiocb)
+        BADF("Data transfer already in progress\n");
+    n = r->buf_len / 512;
+    if (n) {
+        r->aiocb = bdrv_aio_write(s->bdrv, r->sector, r->dma_buf, n,
+                                  scsi_write_complete, r);
+        if (r->aiocb == NULL)
+            scsi_command_complete(r, SENSE_HARDWARE_ERROR);
+        r->sector += n;
+        r->sector_count -= n;
+    } else {
+        /* Invoke completion routine to fetch data from host.  */
+        scsi_write_complete(r, 0);
     }
 
-    if (len != 0)
-        return 1;
+    return 0;
+}
 
-    if (s->sector_count == 0)
-        scsi_command_complete(s, SENSE_NO_SENSE);
+/* Return a pointer to the data buffer.  */
+static uint8_t *scsi_get_buf(SCSIDevice *d, uint32_t tag)
+{
+    SCSIDeviceState *s = d->state;
+    SCSIRequest *r;
 
-    return 0;
+    r = scsi_find_request(s, tag);
+    if (!r) {
+        BADF("Bad buffer tag 0x%x\n", tag);
+        return NULL;
+    }
+    return r->dma_buf;
 }
 
 /* Execute a scsi command.  Returns the length of the data expected by the
@@ -175,22 +281,32 @@ int scsi_write_data(SCSIDevice *s, uint8_t *data, uint32_t len)
    (eg. disk reads), negative for transfers to the device (eg. disk writes),
    and zero if the command does not transfer any data.  */
 
-int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
+static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
+                                 uint8_t *buf, int lun)
 {
-    int64_t nb_sectors;
+    SCSIDeviceState *s = d->state;
+    uint64_t nb_sectors;
     uint32_t lba;
     uint32_t len;
     int cmdlen;
     int is_write;
-
-    s->command = buf[0];
-    s->tag = tag;
-    s->sector_count = 0;
-    s->buf_pos = 0;
-    s->buf_len = 0;
+    uint8_t command;
+    uint8_t *outbuf;
+    SCSIRequest *r;
+
+    command = buf[0];
+    r = scsi_find_request(s, tag);
+    if (r) {
+        BADF("Tag 0x%x already in use\n", tag);
+        scsi_cancel_io(d, tag);
+    }
+    /* ??? Tags are not unique for different luns.  We only implement a
+       single lun, so this should not matter.  */
+    r = scsi_new_request(s, tag);
+    outbuf = r->dma_buf;
     is_write = 0;
-    DPRINTF("Command: 0x%02x", buf[0]);
-    switch (s->command >> 5) {
+    DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
+    switch (command >> 5) {
     case 0:
         lba = buf[3] | (buf[2] << 8) | ((buf[1] & 0x1f) << 16);
         len = buf[4];
@@ -213,7 +329,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
         cmdlen = 12;
         break;
     default:
-        BADF("Unsupported command length, command %x\n", s->command);
+        BADF("Unsupported command length, command %x\n", command);
         goto fail;
     }
 #ifdef DEBUG_SCSI
@@ -230,7 +346,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
         DPRINTF("Unimplemented LUN %d\n", lun ? lun : buf[1] >> 5);
         goto fail;
     }
-    switch (s->command) {
+    switch (command) {
     case 0x0:
 	DPRINTF("Test Unit Ready\n");
 	break;
@@ -238,34 +354,157 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
         DPRINTF("Request Sense (len %d)\n", len);
         if (len < 4)
             goto fail;
-        memset(buf, 0, 4);
-        s->buf[0] = 0xf0;
-        s->buf[1] = 0;
-        s->buf[2] = s->sense;
-        s->buf_len = 4;
+        memset(outbuf, 0, 4);
+        outbuf[0] = 0xf0;
+        outbuf[1] = 0;
+        outbuf[2] = s->sense;
+        r->buf_len = 4;
         break;
     case 0x12:
         DPRINTF("Inquiry (len %d)\n", len);
-        if (len < 36) {
-            BADF("Inquiry buffer too small (%d)\n", len);
+        if (buf[1] & 0x2) {
+            /* Command support data - optional, not implemented */
+            BADF("optional INQUIRY command support request not implemented\n");
+            goto fail;
+        }
+        else if (buf[1] & 0x1) {
+            /* Vital product data */
+            uint8_t page_code = buf[2];
+            if (len < 4) {
+                BADF("Error: Inquiry (EVPD[%02X]) buffer size %d is "
+                     "less than 4\n", page_code, len);
+                goto fail;
+            }
+
+            switch (page_code) {
+                case 0x00:
+                    {
+                        /* Supported page codes, mandatory */
+                        DPRINTF("Inquiry EVPD[Supported pages] "
+                                "buffer size %d\n", len);
+
+                        r->buf_len = 0;
+
+                        if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {
+                            outbuf[r->buf_len++] = 5;
+                        } else {
+                            outbuf[r->buf_len++] = 0;
+                        }
+
+                        outbuf[r->buf_len++] = 0x00; // this page
+                        outbuf[r->buf_len++] = 0x00;
+                        outbuf[r->buf_len++] = 3;    // number of pages
+                        outbuf[r->buf_len++] = 0x00; // list of supported pages (this page)
+                        outbuf[r->buf_len++] = 0x80; // unit serial number
+                        outbuf[r->buf_len++] = 0x83; // device identification
+                    }
+                    break;
+                case 0x80:
+                    {
+                        /* Device serial number, optional */
+                        if (len < 4) {
+                            BADF("Error: EVPD[Serial number] Inquiry buffer "
+                                 "size %d too small, %d needed\n", len, 4);
+                            goto fail;
+                        }
+
+                        DPRINTF("Inquiry EVPD[Serial number] buffer size %d\n", len);
+
+                        r->buf_len = 0;
+
+                        /* Supported page codes */
+                        if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {
+                            outbuf[r->buf_len++] = 5;
+                        } else {
+                            outbuf[r->buf_len++] = 0;
+                        }
+
+                        outbuf[r->buf_len++] = 0x80; // this page
+                        outbuf[r->buf_len++] = 0x00;
+                        outbuf[r->buf_len++] = 0x01; // 1 byte data follow
+
+                        outbuf[r->buf_len++] = '0';  // 1 byte data follow 
+                    }
+
+                    break;
+                case 0x83:
+                    {
+                        /* Device identification page, mandatory */
+                        int max_len = 255 - 8;
+                        int id_len = strlen(bdrv_get_device_name(s->bdrv));
+                        if (id_len > max_len)
+                            id_len = max_len;
+
+                        DPRINTF("Inquiry EVPD[Device identification] "
+                                "buffer size %d\n", len);
+                        r->buf_len = 0;
+                        if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {
+                            outbuf[r->buf_len++] = 5;
+                        } else {
+                            outbuf[r->buf_len++] = 0;
+                        }
+
+                        outbuf[r->buf_len++] = 0x83; // this page
+                        outbuf[r->buf_len++] = 0x00;
+                        outbuf[r->buf_len++] = 3 + id_len;
+
+                        outbuf[r->buf_len++] = 0x2; // ASCII
+                        outbuf[r->buf_len++] = 0;   // not officially assigned
+                        outbuf[r->buf_len++] = 0;   // reserved
+                        outbuf[r->buf_len++] = id_len; // length of data following
+
+                        memcpy(&outbuf[r->buf_len],
+                               bdrv_get_device_name(s->bdrv), id_len);
+                        r->buf_len += id_len;
+                    }
+                    break;
+                default:
+                    BADF("Error: unsupported Inquiry (EVPD[%02X]) "
+                         "buffer size %d\n", page_code, len);
+                    goto fail;
+            }
+            /* done with EVPD */
+            break;
+        }
+        else {
+            /* Standard INQUIRY data */
+            if (buf[2] != 0) {
+                BADF("Error: Inquiry (STANDARD) page or code "
+                     "is non-zero [%02X]\n", buf[2]);
+                goto fail;
+            }
+
+            /* PAGE CODE == 0 */
+            if (len < 5) {
+                BADF("Error: Inquiry (STANDARD) buffer size %d "
+                     "is less than 5\n", len);
+                goto fail;
+            }
+
+            if (len < 36) {
+                BADF("Error: Inquiry (STANDARD) buffer size %d "
+                     "is less than 36 (TODO: only 5 required)\n", len);
+            }
         }
-	memset(s->buf, 0, 36);
+	memset(outbuf, 0, 36);
 	if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {
-	    s->buf[0] = 5;
-            s->buf[1] = 0x80;
-	    memcpy(&s->buf[16], "QEMU CD-ROM    ", 16);
+	    outbuf[0] = 5;
+            outbuf[1] = 0x80;
+	    memcpy(&outbuf[16], "QEMU CD-ROM    ", 16);
 	} else {
-	    s->buf[0] = 0;
-	    memcpy(&s->buf[16], "QEMU HARDDISK  ", 16);
+	    outbuf[0] = 0;
+	    memcpy(&outbuf[16], "QEMU HARDDISK  ", 16);
 	}
-	memcpy(&s->buf[8], "QEMU   ", 8);
-        memcpy(&s->buf[32], QEMU_VERSION, 4);
+	memcpy(&outbuf[8], "QEMU   ", 8);
+        memcpy(&outbuf[32], QEMU_VERSION, 4);
         /* Identify device as SCSI-3 rev 1.
            Some later commands are also implemented. */
-	s->buf[2] = 3;
-	s->buf[3] = 2; /* Format 2 */
-	s->buf[4] = 32;
-	s->buf_len = 36;
+	outbuf[2] = 3;
+	outbuf[3] = 2; /* Format 2 */
+	outbuf[4] = 31;
+        /* Sync data transfer and TCQ.  */
+        outbuf[7] = 0x10 | (s->tcq ? 0x02 : 0);
+	r->buf_len = 36;
 	break;
     case 0x16:
         DPRINTF("Reserve(6)\n");
@@ -280,25 +519,95 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
     case 0x1a:
     case 0x5a:
         {
-            char *p;
+            uint8_t *p;
             int page;
 
             page = buf[2] & 0x3f;
             DPRINTF("Mode Sense (page %d, len %d)\n", page, len);
-            p = s->buf;
+            p = outbuf;
             memset(p, 0, 4);
-            s->buf[1] = 0; /* Default media type.  */
-            s->buf[3] = 0; /* Block descriptor length.  */
+            outbuf[1] = 0; /* Default media type.  */
+            outbuf[3] = 0; /* Block descriptor length.  */
             if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {
-                s->buf[2] = 0x80; /* Readonly.  */
+                outbuf[2] = 0x80; /* Readonly.  */
             }
             p += 4;
-            if ((page == 8 || page == 0x3f)) {
+            if (page == 4) {
+                int cylinders, heads, secs;
+
+                /* Rigid disk device geometry page. */
+                p[0] = 4;
+                p[1] = 0x16;
+                /* if a geometry hint is available, use it */
+                bdrv_get_geometry_hint(s->bdrv, &cylinders, &heads, &secs);
+                p[2] = (cylinders >> 16) & 0xff;
+                p[3] = (cylinders >> 8) & 0xff;
+                p[4] = cylinders & 0xff;
+                p[5] = heads & 0xff;
+                /* Write precomp start cylinder, disabled */
+                p[6] = (cylinders >> 16) & 0xff;
+                p[7] = (cylinders >> 8) & 0xff;
+                p[8] = cylinders & 0xff;
+                /* Reduced current start cylinder, disabled */
+                p[9] = (cylinders >> 16) & 0xff;
+                p[10] = (cylinders >> 8) & 0xff;
+                p[11] = cylinders & 0xff;
+                /* Device step rate [ns], 200ns */
+                p[12] = 0;
+                p[13] = 200;
+                /* Landing zone cylinder */
+                p[14] = 0xff;
+                p[15] =  0xff;
+                p[16] = 0xff;
+                /* Medium rotation rate [rpm], 5400 rpm */
+                p[20] = (5400 >> 8) & 0xff;
+                p[21] = 5400 & 0xff;
+                p += 0x16;
+            } else if (page == 5) {
+                int cylinders, heads, secs;
+
+                /* Flexible disk device geometry page. */
+                p[0] = 5;
+                p[1] = 0x1e;
+                /* Transfer rate [kbit/s], 5Mbit/s */
+                p[2] = 5000 >> 8;
+                p[3] = 5000 & 0xff;
+                /* if a geometry hint is available, use it */
+                bdrv_get_geometry_hint(s->bdrv, &cylinders, &heads, &secs);
+                p[4] = heads & 0xff;
+                p[5] = secs & 0xff;
+                p[6] = s->cluster_size * 2;
+                p[8] = (cylinders >> 8) & 0xff;
+                p[9] = cylinders & 0xff;
+                /* Write precomp start cylinder, disabled */
+                p[10] = (cylinders >> 8) & 0xff;
+                p[11] = cylinders & 0xff;
+                /* Reduced current start cylinder, disabled */
+                p[12] = (cylinders >> 8) & 0xff;
+                p[13] = cylinders & 0xff;
+                /* Device step rate [100us], 100us */
+                p[14] = 0;
+                p[15] = 1;
+                /* Device step pulse width [us], 1us */
+                p[16] = 1;
+                /* Device head settle delay [100us], 100us */
+                p[17] = 0;
+                p[18] = 1;
+                /* Motor on delay [0.1s], 0.1s */
+                p[19] = 1;
+                /* Motor off delay [0.1s], 0.1s */
+                p[20] = 1;
+                /* Medium rotation rate [rpm], 5400 rpm */
+                p[28] = (5400 >> 8) & 0xff;
+                p[29] = 5400 & 0xff;
+                p += 0x1e;
+            } else if ((page == 8 || page == 0x3f)) {
                 /* Caching page.  */
+                memset(p,0,20);
                 p[0] = 8;
                 p[1] = 0x12;
                 p[2] = 4; /* WCE */
-                p += 19;
+                p += 20;
             }
             if ((page == 0x3f || page == 0x2a)
                     && (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM)) {
@@ -328,12 +637,12 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
                 p[19] = (16 * 176) & 0xff;
                 p[20] = (16 * 176) >> 8; // 16x write speed current
                 p[21] = (16 * 176) & 0xff;
-                p += 21;
+                p += 22;
             }
-            s->buf_len = p - s->buf;
-            s->buf[0] = s->buf_len - 4;
-            if (s->buf_len > len)
-                s->buf_len = len;
+            r->buf_len = p - outbuf;
+            outbuf[0] = r->buf_len - 4;
+            if (r->buf_len > len)
+                r->buf_len = len;
         }
         break;
     case 0x1b:
@@ -346,33 +655,40 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
     case 0x25:
 	DPRINTF("Read Capacity\n");
         /* The normal LEN field for this command is zero.  */
-	memset(s->buf, 0, 8);
+	memset(outbuf, 0, 8);
 	bdrv_get_geometry(s->bdrv, &nb_sectors);
-	s->buf[0] = (nb_sectors >> 24) & 0xff;
-	s->buf[1] = (nb_sectors >> 16) & 0xff;
-	s->buf[2] = (nb_sectors >> 8) & 0xff;
-	s->buf[3] = nb_sectors & 0xff;
-	s->buf[4] = 0;
-	s->buf[5] = 0;
-        s->buf[6] = s->cluster_size * 2;
-	s->buf[7] = 0;
-	s->buf_len = 8;
+        /* Returned value is the address of the last sector.  */
+        if (nb_sectors) {
+            nb_sectors--;
+            outbuf[0] = (nb_sectors >> 24) & 0xff;
+            outbuf[1] = (nb_sectors >> 16) & 0xff;
+            outbuf[2] = (nb_sectors >> 8) & 0xff;
+            outbuf[3] = nb_sectors & 0xff;
+            outbuf[4] = 0;
+            outbuf[5] = 0;
+            outbuf[6] = s->cluster_size * 2;
+            outbuf[7] = 0;
+            r->buf_len = 8;
+        } else {
+            scsi_command_complete(r, SENSE_NOT_READY);
+            return 0;
+        }
 	break;
     case 0x08:
     case 0x28:
         DPRINTF("Read (sector %d, count %d)\n", lba, len);
-        s->sector = lba * s->cluster_size;
-        s->sector_count = len * s->cluster_size;
+        r->sector = lba * s->cluster_size;
+        r->sector_count = len * s->cluster_size;
         break;
     case 0x0a:
     case 0x2a:
         DPRINTF("Write (sector %d, count %d)\n", lba, len);
-        s->sector = lba * s->cluster_size;
-        s->sector_count = len * s->cluster_size;
+        r->sector = lba * s->cluster_size;
+        r->sector_count = len * s->cluster_size;
         is_write = 1;
         break;
     case 0x35:
-        DPRINTF("Syncronise cache (sector %d, count %d)\n", lba, len);
+        DPRINTF("Synchronise cache (sector %d, count %d)\n", lba, len);
         bdrv_flush(s->bdrv);
         break;
     case 0x43:
@@ -386,18 +702,18 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
             DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
             switch(format) {
             case 0:
-                toclen = cdrom_read_toc(nb_sectors, s->buf, msf, start_track);
+                toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
                 break;
             case 1:
                 /* multi session : only a single session defined */
                 toclen = 12;
-                memset(s->buf, 0, 12);
-                s->buf[1] = 0x0a;
-                s->buf[2] = 0x01;
-                s->buf[3] = 0x01;
+                memset(outbuf, 0, 12);
+                outbuf[1] = 0x0a;
+                outbuf[2] = 0x01;
+                outbuf[3] = 0x01;
                 break;
             case 2:
-                toclen = cdrom_read_toc_raw(nb_sectors, s->buf, msf, start_track);
+                toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);
                 break;
             default:
                 goto error_cmd;
@@ -405,7 +721,7 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
             if (toclen > 0) {
                 if (len > toclen)
                   len = toclen;
-                s->buf_len = len;
+                r->buf_len = len;
                 break;
             }
         error_cmd:
@@ -414,11 +730,11 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
         }
     case 0x46:
         DPRINTF("Get Configuration (rt %d, maxlen %d)\n", buf[1] & 3, len);
-        memset(s->buf, 0, 8);
-        /* ??? This shoud probably return much more information.  For now
+        memset(outbuf, 0, 8);
+        /* ??? This should probably return much more information.  For now
            just return the basic header indicating the CD-ROM profile.  */
-        s->buf[7] = 8; // CD-ROM
-        s->buf_len = 8;
+        outbuf[7] = 8; // CD-ROM
+        r->buf_len = 8;
         break;
     case 0x56:
         DPRINTF("Reserve(10)\n");
@@ -434,37 +750,44 @@ int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun)
         DPRINTF("Report LUNs (len %d)\n", len);
         if (len < 16)
             goto fail;
-        memset(s->buf, 0, 16);
-        s->buf[3] = 8;
-        s->buf_len = 16;
+        memset(outbuf, 0, 16);
+        outbuf[3] = 8;
+        r->buf_len = 16;
         break;
     default:
 	DPRINTF("Unknown SCSI command (%2.2x)\n", buf[0]);
     fail:
-        scsi_command_complete(s, SENSE_ILLEGAL_REQUEST);
+        scsi_command_complete(r, SENSE_ILLEGAL_REQUEST);
 	return 0;
     }
-    if (s->sector_count == 0 && s->buf_len == 0) {
-        scsi_command_complete(s, SENSE_NO_SENSE);
+    if (r->sector_count == 0 && r->buf_len == 0) {
+        scsi_command_complete(r, SENSE_NO_SENSE);
+    }
+    len = r->sector_count * 512 + r->buf_len;
+    if (is_write) {
+        return -len;
+    } else {
+        if (!r->sector_count)
+            r->sector_count = -1;
+        return len;
     }
-    len = s->sector_count * 512 + s->buf_len;
-    return is_write ? -len : len;
 }
 
-void scsi_disk_destroy(SCSIDevice *s)
+static void scsi_destroy(SCSIDevice *d)
 {
-    bdrv_close(s->bdrv);
-    qemu_free(s);
+    qemu_free(d->state);
+    qemu_free(d);
 }
 
-SCSIDevice *scsi_disk_init(BlockDriverState *bdrv,
-                           scsi_completionfn completion,
-                           void *opaque)
+SCSIDevice *scsi_disk_init(BlockDriverState *bdrv, int tcq,
+                           scsi_completionfn completion, void *opaque)
 {
-    SCSIDevice *s;
+    SCSIDevice *d;
+    SCSIDeviceState *s;
 
-    s = (SCSIDevice *)qemu_mallocz(sizeof(SCSIDevice));
+    s = (SCSIDeviceState *)qemu_mallocz(sizeof(SCSIDeviceState));
     s->bdrv = bdrv;
+    s->tcq = tcq;
     s->completion = completion;
     s->opaque = opaque;
     if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM) {
@@ -473,6 +796,14 @@ SCSIDevice *scsi_disk_init(BlockDriverState *bdrv,
         s->cluster_size = 1;
     }
 
-    return s;
-}
+    d = (SCSIDevice *)qemu_mallocz(sizeof(SCSIDevice));
+    d->state = s;
+    d->destroy = scsi_destroy;
+    d->send_command = scsi_send_command;
+    d->read_data = scsi_read_data;
+    d->write_data = scsi_write_data;
+    d->cancel_io = scsi_cancel_io;
+    d->get_buf = scsi_get_buf;
 
+    return d;
+}
diff --git a/hw/scsi-disk.h b/hw/scsi-disk.h
new file mode 100644
index 0000000..f42212b
--- /dev/null
+++ b/hw/scsi-disk.h
@@ -0,0 +1,36 @@
+#ifndef SCSI_DISK_H
+#define SCSI_DISK_H
+
+/* scsi-disk.c */
+enum scsi_reason {
+    SCSI_REASON_DONE, /* Command complete.  */
+    SCSI_REASON_DATA  /* Transfer complete, more data required.  */
+};
+
+typedef struct SCSIDeviceState SCSIDeviceState;
+typedef struct SCSIDevice SCSIDevice;
+typedef void (*scsi_completionfn)(void *opaque, int reason, uint32_t tag,
+                                  uint32_t arg);
+
+struct SCSIDevice
+{
+    SCSIDeviceState *state;
+    void (*destroy)(SCSIDevice *s);
+    int32_t (*send_command)(SCSIDevice *s, uint32_t tag, uint8_t *buf,
+                            int lun);
+    void (*read_data)(SCSIDevice *s, uint32_t tag);
+    int (*write_data)(SCSIDevice *s, uint32_t tag);
+    void (*cancel_io)(SCSIDevice *s, uint32_t tag);
+    uint8_t *(*get_buf)(SCSIDevice *s, uint32_t tag);
+};
+
+SCSIDevice *scsi_disk_init(BlockDriverState *bdrv, int tcq,
+                           scsi_completionfn completion, void *opaque);
+SCSIDevice *scsi_generic_init(BlockDriverState *bdrv, int tcq,
+                           scsi_completionfn completion, void *opaque);
+
+/* cdrom.c */
+int cdrom_read_toc(int nb_sectors, uint8_t *buf, int msf, int start_track);
+int cdrom_read_toc_raw(int nb_sectors, uint8_t *buf, int msf, int session_num);
+
+#endif
diff --git a/hw/smc91c111.c b/hw/smc91c111.c
index 28b5c5d..410051d 100644
--- a/hw/smc91c111.c
+++ b/hw/smc91c111.c
@@ -1,4 +1,4 @@
-/* 
+/*
  * SMSC 91C111 Ethernet interface emulation
  *
  * Copyright (c) 2005 CodeSourcery, LLC.
@@ -7,8 +7,9 @@
  * This code is licenced under the GPL
  */
 
-#include "vl.h"
-#include "irq.h"
+#include "hw.h"
+#include "net.h"
+#include "devices.h"
 /* For crc32 */
 #include <zlib.h>
 
@@ -191,7 +192,9 @@ static void smc91c111_do_tx(smc91c111_state *s)
            about.  */
         add_crc = (control & 0x10) || (s->tcr & TCR_NOCRC) == 0;
         if (add_crc) {
-            uint32_t crc = crc32(~0, p, len);
+            uint32_t crc;
+
+            crc = crc32(~0, p, len);
             memcpy(p + len, &crc, 4);
             len += 4;
         }
@@ -412,7 +415,7 @@ static void smc91c111_writeb(void *opaque, target_phys_addr_t offset,
         break;
     }
     cpu_abort (cpu_single_env, "smc91c111_write: Bad reg %d:%x\n",
-               s->bank, offset);
+               s->bank, (int)offset);
 }
 
 static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
@@ -444,7 +447,9 @@ static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
         case 7:
             /* Not implemented.  */
             return 0;
-        case 8: /* Free memory available.  */
+        case 8: /* Memory size.  */
+            return NUM_PACKETS;
+        case 9: /* Free memory available.  */
             {
                 int i;
                 int n;
@@ -455,8 +460,6 @@ static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
                 }
                 return n;
             }
-        case 9: /* Memory size.  */
-            return NUM_PACKETS;
         case 10: case 11: /* RPCR */
             /* Not implemented.  */
             return 0;
@@ -554,7 +557,7 @@ static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
         break;
     }
     cpu_abort (cpu_single_env, "smc91c111_read: Bad reg %d:%x\n",
-               s->bank, offset);
+               s->bank, (int)offset);
     return 0;
 }
 
@@ -614,7 +617,7 @@ static void smc91c111_receive(void *opaque, const uint8_t *buf, int size)
 
     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
         return;
-    /* Short packets are padded with zeros.  Recieveing a packet
+    /* Short packets are padded with zeros.  Receiving a packet
        < 64 bytes long is considered an error condition.  */
     if (size < 64)
         packetsize = 64;
@@ -648,7 +651,7 @@ static void smc91c111_receive(void *opaque, const uint8_t *buf, int size)
     /* Pad short packets.  */
     if (size < 64) {
         int pad;
-        
+
         if (size & 1)
             *(p++) = buf[size - 1];
         pad = 64 - size;
diff --git a/hw/usb-hid.c b/hw/usb-hid.c
index 93f46db..406c9ab 100644
--- a/hw/usb-hid.c
+++ b/hw/usb-hid.c
@@ -1,8 +1,9 @@
 /*
  * QEMU USB HID devices
- * 
+ *
  * Copyright (c) 2005 Fabrice Bellard
- * 
+ * Copyright (c) 2007 OpenMoko, Inc.  (andrew@openedhand.com)
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -21,31 +22,58 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw.h"
+#include "console.h"
+#include "usb.h"
 
 /* HID interface requests */
 #define GET_REPORT   0xa101
 #define GET_IDLE     0xa102
 #define GET_PROTOCOL 0xa103
+#define SET_REPORT   0x2109
 #define SET_IDLE     0x210a
 #define SET_PROTOCOL 0x210b
 
-#define USB_MOUSE  1
-#define USB_TABLET 2
+/* HID descriptor types */
+#define USB_DT_HID    0x21
+#define USB_DT_REPORT 0x22
+#define USB_DT_PHY    0x23
+
+#define USB_MOUSE     1
+#define USB_TABLET    2
+#define USB_KEYBOARD  3
 
 typedef struct USBMouseState {
-    USBDevice dev;
     int dx, dy, dz, buttons_state;
     int x, y;
-    int kind;
     int mouse_grabbed;
+    QEMUPutMouseEntry *eh_entry;
 } USBMouseState;
 
+typedef struct USBKeyboardState {
+    uint16_t modifiers;
+    uint8_t leds;
+    uint8_t key[16];
+    int keys;
+} USBKeyboardState;
+
+typedef struct USBHIDState {
+    USBDevice dev;
+    union {
+        USBMouseState ptr;
+        USBKeyboardState kbd;
+    };
+    int kind;
+    int protocol;
+    int idle;
+    int changed;
+} USBHIDState;
+
 /* mostly the same values as the Bochs USB Mouse device */
 static const uint8_t qemu_mouse_dev_descriptor[] = {
 	0x12,       /*  u8 bLength; */
 	0x01,       /*  u8 bDescriptorType; Device */
-	0x10, 0x00, /*  u16 bcdUSB; v1.0 */
+	0x00, 0x01, /*  u16 bcdUSB; v1.0 */
 
 	0x00,	    /*  u8  bDeviceClass; */
 	0x00,	    /*  u8  bDeviceSubClass; */
@@ -70,13 +98,13 @@ static const uint8_t qemu_mouse_config_descriptor[] = {
 	0x01,       /*  u8  bNumInterfaces; (1) */
 	0x01,       /*  u8  bConfigurationValue; */
 	0x04,       /*  u8  iConfiguration; */
-	0xa0,       /*  u8  bmAttributes; 
+	0xa0,       /*  u8  bmAttributes;
 				 Bit 7: must be set,
 				     6: Self-powered,
 				     5: Remote wakeup,
 				     4..0: resvd */
 	50,         /*  u8  MaxPower; */
-      
+
 	/* USB 1.1:
 	 * USB 2.0, single TT organization (mandatory):
 	 *	one interface, protocol 0
@@ -97,8 +125,8 @@ static const uint8_t qemu_mouse_config_descriptor[] = {
 	0x03,       /*  u8  if_bInterfaceClass; */
 	0x01,       /*  u8  if_bInterfaceSubClass; */
 	0x02,       /*  u8  if_bInterfaceProtocol; [usb1.1 or single tt] */
-	0x05,       /*  u8  if_iInterface; */
-     
+	0x07,       /*  u8  if_iInterface; */
+
         /* HID descriptor */
         0x09,        /*  u8  bLength; */
         0x21,        /*  u8 bDescriptorType; */
@@ -106,14 +134,14 @@ static const uint8_t qemu_mouse_config_descriptor[] = {
         0x00,        /*  u8 country_code */
         0x01,        /*  u8 num_descriptors */
         0x22,        /*  u8 type; Report */
-        50, 0,       /*  u16 len */
+        52, 0,       /*  u16 len */
 
 	/* one endpoint (status change endpoint) */
 	0x07,       /*  u8  ep_bLength; */
 	0x05,       /*  u8  ep_bDescriptorType; Endpoint */
 	0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
  	0x03,       /*  u8  ep_bmAttributes; Interrupt */
- 	0x03, 0x00, /*  u16 ep_wMaxPacketSize; */
+ 	0x04, 0x00, /*  u16 ep_wMaxPacketSize; */
 	0x0a,       /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 };
 
@@ -124,14 +152,14 @@ static const uint8_t qemu_tablet_config_descriptor[] = {
 	0x22, 0x00, /*  u16 wTotalLength; */
 	0x01,       /*  u8  bNumInterfaces; (1) */
 	0x01,       /*  u8  bConfigurationValue; */
-	0x04,       /*  u8  iConfiguration; */
-	0xa0,       /*  u8  bmAttributes; 
+	0x05,       /*  u8  iConfiguration; */
+	0xa0,       /*  u8  bmAttributes;
 				 Bit 7: must be set,
 				     6: Self-powered,
 				     5: Remote wakeup,
 				     4..0: resvd */
 	50,         /*  u8  MaxPower; */
-      
+
 	/* USB 1.1:
 	 * USB 2.0, single TT organization (mandatory):
 	 *	one interface, protocol 0
@@ -152,7 +180,7 @@ static const uint8_t qemu_tablet_config_descriptor[] = {
 	0x03,       /*  u8  if_bInterfaceClass; */
 	0x01,       /*  u8  if_bInterfaceSubClass; */
 	0x02,       /*  u8  if_bInterfaceProtocol; [usb1.1 or single tt] */
-	0x05,       /*  u8  if_iInterface; */
+	0x07,       /*  u8  if_iInterface; */
 
         /* HID descriptor */
         0x09,        /*  u8  bLength; */
@@ -169,79 +197,283 @@ static const uint8_t qemu_tablet_config_descriptor[] = {
 	0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
  	0x03,       /*  u8  ep_bmAttributes; Interrupt */
  	0x08, 0x00, /*  u16 ep_wMaxPacketSize; */
-	0x03,       /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+	0x0a,       /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+};
+
+static const uint8_t qemu_keyboard_config_descriptor[] = {
+    /* one configuration */
+    0x09,		/*  u8  bLength; */
+    USB_DT_CONFIG,	/*  u8  bDescriptorType; Configuration */
+    0x22, 0x00,		/*  u16 wTotalLength; */
+    0x01,		/*  u8  bNumInterfaces; (1) */
+    0x01,		/*  u8  bConfigurationValue; */
+    0x06,		/*  u8  iConfiguration; */
+    0xa0,		/*  u8  bmAttributes;
+				Bit 7: must be set,
+				    6: Self-powered,
+				    5: Remote wakeup,
+				    4..0: resvd */
+    0x32,		/*  u8  MaxPower; */
+
+    /* USB 1.1:
+     * USB 2.0, single TT organization (mandatory):
+     *	one interface, protocol 0
+     *
+     * USB 2.0, multiple TT organization (optional):
+     *	two interfaces, protocols 1 (like single TT)
+     *	and 2 (multiple TT mode) ... config is
+     *	sometimes settable
+     *	NOT IMPLEMENTED
+     */
+
+    /* one interface */
+    0x09,		/*  u8  if_bLength; */
+    USB_DT_INTERFACE,	/*  u8  if_bDescriptorType; Interface */
+    0x00,		/*  u8  if_bInterfaceNumber; */
+    0x00,		/*  u8  if_bAlternateSetting; */
+    0x01,		/*  u8  if_bNumEndpoints; */
+    0x03,		/*  u8  if_bInterfaceClass; HID */
+    0x01,		/*  u8  if_bInterfaceSubClass; Boot */
+    0x01,		/*  u8  if_bInterfaceProtocol; Keyboard */
+    0x07,		/*  u8  if_iInterface; */
+
+    /* HID descriptor */
+    0x09,		/*  u8  bLength; */
+    USB_DT_HID,		/*  u8  bDescriptorType; */
+    0x11, 0x01,		/*  u16 HID_class */
+    0x00,		/*  u8  country_code */
+    0x01,		/*  u8  num_descriptors */
+    USB_DT_REPORT,	/*  u8  type; Report */
+    0x3f, 0x00,		/*  u16 len */
+
+    /* one endpoint (status change endpoint) */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; Endpoint */
+    USB_DIR_IN | 0x01,	/*  u8  ep_bEndpointAddress; IN Endpoint 1 */
+    0x03,		/*  u8  ep_bmAttributes; Interrupt */
+    0x08, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x0a,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 };
 
 static const uint8_t qemu_mouse_hid_report_descriptor[] = {
-    0x05, 0x01, 0x09, 0x02, 0xA1, 0x01, 0x09, 0x01, 
-    0xA1, 0x00, 0x05, 0x09, 0x19, 0x01, 0x29, 0x03,
-    0x15, 0x00, 0x25, 0x01, 0x95, 0x03, 0x75, 0x01, 
-    0x81, 0x02, 0x95, 0x01, 0x75, 0x05, 0x81, 0x01,
-    0x05, 0x01, 0x09, 0x30, 0x09, 0x31, 0x15, 0x81, 
-    0x25, 0x7F, 0x75, 0x08, 0x95, 0x02, 0x81, 0x06,
-    0xC0, 0xC0,
+    0x05, 0x01,		/* Usage Page (Generic Desktop) */
+    0x09, 0x02,		/* Usage (Mouse) */
+    0xa1, 0x01,		/* Collection (Application) */
+    0x09, 0x01,		/*   Usage (Pointer) */
+    0xa1, 0x00,		/*   Collection (Physical) */
+    0x05, 0x09,		/*     Usage Page (Button) */
+    0x19, 0x01,		/*     Usage Minimum (1) */
+    0x29, 0x03,		/*     Usage Maximum (3) */
+    0x15, 0x00,		/*     Logical Minimum (0) */
+    0x25, 0x01,		/*     Logical Maximum (1) */
+    0x95, 0x03,		/*     Report Count (3) */
+    0x75, 0x01,		/*     Report Size (1) */
+    0x81, 0x02,		/*     Input (Data, Variable, Absolute) */
+    0x95, 0x01,		/*     Report Count (1) */
+    0x75, 0x05,		/*     Report Size (5) */
+    0x81, 0x01,		/*     Input (Constant) */
+    0x05, 0x01,		/*     Usage Page (Generic Desktop) */
+    0x09, 0x30,		/*     Usage (X) */
+    0x09, 0x31,		/*     Usage (Y) */
+    0x09, 0x38,		/*     Usage (Wheel) */
+    0x15, 0x81,		/*     Logical Minimum (-0x7f) */
+    0x25, 0x7f,		/*     Logical Maximum (0x7f) */
+    0x75, 0x08,		/*     Report Size (8) */
+    0x95, 0x03,		/*     Report Count (3) */
+    0x81, 0x06,		/*     Input (Data, Variable, Relative) */
+    0xc0,		/*   End Collection */
+    0xc0,		/* End Collection */
 };
 
 static const uint8_t qemu_tablet_hid_report_descriptor[] = {
-        0x05, 0x01, /* Usage Page Generic Desktop */
-        0x09, 0x01, /* Usage Mouse */
-        0xA1, 0x01, /* Collection Application */
-        0x09, 0x01, /* Usage Pointer */
-        0xA1, 0x00, /* Collection Physical */
-        0x05, 0x09, /* Usage Page Button */
-        0x19, 0x01, /* Usage Minimum Button 1 */
-        0x29, 0x03, /* Usage Maximum Button 3 */
-        0x15, 0x00, /* Logical Minimum 0 */
-        0x25, 0x01, /* Logical Maximum 1 */
-        0x95, 0x03, /* Report Count 3 */
-        0x75, 0x01, /* Report Size 1 */
-        0x81, 0x02, /* Input (Data, Var, Abs) */
-        0x95, 0x01, /* Report Count 1 */
-        0x75, 0x05, /* Report Size 5 */
-        0x81, 0x01, /* Input (Cnst, Var, Abs) */
-        0x05, 0x01, /* Usage Page Generic Desktop */
-        0x09, 0x30, /* Usage X */
-        0x09, 0x31, /* Usage Y */
-        0x15, 0x00, /* Logical Minimum 0 */
-        0x26, 0xFF, 0x7F, /* Logical Maximum 0x7fff */
-        0x35, 0x00, /* Physical Minimum 0 */
-        0x46, 0xFE, 0x7F, /* Physical Maximum 0x7fff */
-        0x75, 0x10, /* Report Size 16 */
-        0x95, 0x02, /* Report Count 2 */
-        0x81, 0x02, /* Input (Data, Var, Abs) */
-        0x05, 0x01, /* Usage Page Generic Desktop */
-        0x09, 0x38, /* Usage Wheel */
-        0x15, 0x81, /* Logical Minimum -127 */
-        0x25, 0x7F, /* Logical Maximum 127 */
-        0x35, 0x00, /* Physical Minimum 0 (same as logical) */
-        0x45, 0x00, /* Physical Maximum 0 (same as logical) */
-        0x75, 0x08, /* Report Size 8 */
-        0x95, 0x01, /* Report Count 1 */
-        0x81, 0x02, /* Input (Data, Var, Rel) */
-        0xC0,       /* End Collection */
-        0xC0,       /* End Collection */
+    0x05, 0x01,		/* Usage Page (Generic Desktop) */
+    0x09, 0x01,		/* Usage (Pointer) */
+    0xa1, 0x01,		/* Collection (Application) */
+    0x09, 0x01,		/*   Usage (Pointer) */
+    0xa1, 0x00,		/*   Collection (Physical) */
+    0x05, 0x09,		/*     Usage Page (Button) */
+    0x19, 0x01,		/*     Usage Minimum (1) */
+    0x29, 0x03,		/*     Usage Maximum (3) */
+    0x15, 0x00,		/*     Logical Minimum (0) */
+    0x25, 0x01,		/*     Logical Maximum (1) */
+    0x95, 0x03,		/*     Report Count (3) */
+    0x75, 0x01,		/*     Report Size (1) */
+    0x81, 0x02,		/*     Input (Data, Variable, Absolute) */
+    0x95, 0x01,		/*     Report Count (1) */
+    0x75, 0x05,		/*     Report Size (5) */
+    0x81, 0x01,		/*     Input (Constant) */
+    0x05, 0x01,		/*     Usage Page (Generic Desktop) */
+    0x09, 0x30,		/*     Usage (X) */
+    0x09, 0x31,		/*     Usage (Y) */
+    0x15, 0x00,		/*     Logical Minimum (0) */
+    0x26, 0xff, 0x7f,	/*     Logical Maximum (0x7fff) */
+    0x35, 0x00,		/*     Physical Minimum (0) */
+    0x46, 0xff, 0x7f,	/*     Physical Maximum (0x7fff) */
+    0x75, 0x10,		/*     Report Size (16) */
+    0x95, 0x02,		/*     Report Count (2) */
+    0x81, 0x02,		/*     Input (Data, Variable, Absolute) */
+    0x05, 0x01,		/*     Usage Page (Generic Desktop) */
+    0x09, 0x38,		/*     Usage (Wheel) */
+    0x15, 0x81,		/*     Logical Minimum (-0x7f) */
+    0x25, 0x7f,		/*     Logical Maximum (0x7f) */
+    0x35, 0x00,		/*     Physical Minimum (same as logical) */
+    0x45, 0x00,		/*     Physical Maximum (same as logical) */
+    0x75, 0x08,		/*     Report Size (8) */
+    0x95, 0x01,		/*     Report Count (1) */
+    0x81, 0x06,		/*     Input (Data, Variable, Relative) */
+    0xc0,		/*   End Collection */
+    0xc0,		/* End Collection */
+};
+
+static const uint8_t qemu_keyboard_hid_report_descriptor[] = {
+    0x05, 0x01,		/* Usage Page (Generic Desktop) */
+    0x09, 0x06,		/* Usage (Keyboard) */
+    0xa1, 0x01,		/* Collection (Application) */
+    0x75, 0x01,		/*   Report Size (1) */
+    0x95, 0x08,		/*   Report Count (8) */
+    0x05, 0x07,		/*   Usage Page (Key Codes) */
+    0x19, 0xe0,		/*   Usage Minimum (224) */
+    0x29, 0xe7,		/*   Usage Maximum (231) */
+    0x15, 0x00,		/*   Logical Minimum (0) */
+    0x25, 0x01,		/*   Logical Maximum (1) */
+    0x81, 0x02,		/*   Input (Data, Variable, Absolute) */
+    0x95, 0x01,		/*   Report Count (1) */
+    0x75, 0x08,		/*   Report Size (8) */
+    0x81, 0x01,		/*   Input (Constant) */
+    0x95, 0x05,		/*   Report Count (5) */
+    0x75, 0x01,		/*   Report Size (1) */
+    0x05, 0x08,		/*   Usage Page (LEDs) */
+    0x19, 0x01,		/*   Usage Minimum (1) */
+    0x29, 0x05,		/*   Usage Maximum (5) */
+    0x91, 0x02,		/*   Output (Data, Variable, Absolute) */
+    0x95, 0x01,		/*   Report Count (1) */
+    0x75, 0x03,		/*   Report Size (3) */
+    0x91, 0x01,		/*   Output (Constant) */
+    0x95, 0x06,		/*   Report Count (6) */
+    0x75, 0x08,		/*   Report Size (8) */
+    0x15, 0x00,		/*   Logical Minimum (0) */
+    0x25, 0xff,		/*   Logical Maximum (255) */
+    0x05, 0x07,		/*   Usage Page (Key Codes) */
+    0x19, 0x00,		/*   Usage Minimum (0) */
+    0x29, 0xff,		/*   Usage Maximum (255) */
+    0x81, 0x00,		/*   Input (Data, Array) */
+    0xc0,		/* End Collection */
+};
+
+#define USB_HID_USAGE_ERROR_ROLLOVER	0x01
+#define USB_HID_USAGE_POSTFAIL		0x02
+#define USB_HID_USAGE_ERROR_UNDEFINED	0x03
+
+/* Indices are QEMU keycodes, values are from HID Usage Table.  Indices
+ * above 0x80 are for keys that come after 0xe0 or 0xe1+0x1d or 0xe1+0x9d.  */
+static const uint8_t usb_hid_usage_keys[0x100] = {
+    0x00, 0x29, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
+    0x24, 0x25, 0x26, 0x27, 0x2d, 0x2e, 0x2a, 0x2b,
+    0x14, 0x1a, 0x08, 0x15, 0x17, 0x1c, 0x18, 0x0c,
+    0x12, 0x13, 0x2f, 0x30, 0x28, 0xe0, 0x04, 0x16,
+    0x07, 0x09, 0x0a, 0x0b, 0x0d, 0x0e, 0x0f, 0x33,
+    0x34, 0x35, 0xe1, 0x31, 0x1d, 0x1b, 0x06, 0x19,
+    0x05, 0x11, 0x10, 0x36, 0x37, 0x38, 0xe5, 0x55,
+    0xe2, 0x2c, 0x32, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e,
+    0x3f, 0x40, 0x41, 0x42, 0x43, 0x53, 0x47, 0x5f,
+    0x60, 0x61, 0x56, 0x5c, 0x5d, 0x5e, 0x57, 0x59,
+    0x5a, 0x5b, 0x62, 0x63, 0x00, 0x00, 0x00, 0x44,
+    0x45, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
+    0xe8, 0xe9, 0x71, 0x72, 0x73, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x85, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0xe3, 0xe7, 0x65,
+
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x58, 0xe4, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x54, 0x00, 0x46,
+    0xe6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x00, 0x4a,
+    0x52, 0x4b, 0x00, 0x50, 0x00, 0x4f, 0x00, 0x4d,
+    0x51, 0x4e, 0x49, 0x4c, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 };
 
 static void usb_mouse_event(void *opaque,
                             int dx1, int dy1, int dz1, int buttons_state)
 {
-    USBMouseState *s = opaque;
+    USBHIDState *hs = opaque;
+    USBMouseState *s = &hs->ptr;
 
     s->dx += dx1;
     s->dy += dy1;
     s->dz += dz1;
     s->buttons_state = buttons_state;
+    hs->changed = 1;
 }
 
 static void usb_tablet_event(void *opaque,
 			     int x, int y, int dz, int buttons_state)
 {
-    USBMouseState *s = opaque;
+    USBHIDState *hs = opaque;
+    USBMouseState *s = &hs->ptr;
 
     s->x = x;
     s->y = y;
     s->dz += dz;
     s->buttons_state = buttons_state;
+    hs->changed = 1;
+}
+
+static void usb_keyboard_event(void *opaque, int keycode)
+{
+    USBHIDState *hs = opaque;
+    USBKeyboardState *s = &hs->kbd;
+    uint8_t hid_code, key;
+    int i;
+
+    key = keycode & 0x7f;
+    hid_code = usb_hid_usage_keys[key | ((s->modifiers >> 1) & (1 << 7))];
+    s->modifiers &= ~(1 << 8);
+
+    hs->changed = 1;
+
+    switch (hid_code) {
+    case 0x00:
+        return;
+
+    case 0xe0:
+        if (s->modifiers & (1 << 9)) {
+            s->modifiers ^= 3 << 8;
+            return;
+        }
+    case 0xe1 ... 0xe7:
+        if (keycode & (1 << 7)) {
+            s->modifiers &= ~(1 << (hid_code & 0x0f));
+            return;
+        }
+    case 0xe8 ... 0xef:
+        s->modifiers |= 1 << (hid_code & 0x0f);
+        return;
+    }
+
+    if (keycode & (1 << 7)) {
+        for (i = s->keys - 1; i >= 0; i --)
+            if (s->key[i] == hid_code) {
+                s->key[i] = s->key[-- s->keys];
+                s->key[s->keys] = 0x00;
+                return;
+            }
+    } else {
+        for (i = s->keys - 1; i >= 0; i --)
+            if (s->key[i] == hid_code)
+                return;
+        if (s->keys < sizeof(s->key))
+            s->key[s->keys ++] = hid_code;
+    }
 }
 
 static inline int int_clamp(int val, int vmin, int vmax)
@@ -254,23 +486,28 @@ static inline int int_clamp(int val, int vmin, int vmax)
         return val;
 }
 
-static int usb_mouse_poll(USBMouseState *s, uint8_t *buf, int len)
+static int usb_mouse_poll(USBHIDState *hs, uint8_t *buf, int len)
 {
     int dx, dy, dz, b, l;
+    USBMouseState *s = &hs->ptr;
 
     if (!s->mouse_grabbed) {
-	qemu_add_mouse_event_handler(usb_mouse_event, s, 0);
+	s->eh_entry = qemu_add_mouse_event_handler(usb_mouse_event, hs,
+                                                  0, "QEMU USB Mouse");
 	s->mouse_grabbed = 1;
     }
-    
-    dx = int_clamp(s->dx, -128, 127);
-    dy = int_clamp(s->dy, -128, 127);
-    dz = int_clamp(s->dz, -128, 127);
+
+    dx = int_clamp(s->dx, -127, 127);
+    dy = int_clamp(s->dy, -127, 127);
+    dz = int_clamp(s->dz, -127, 127);
 
     s->dx -= dx;
     s->dy -= dy;
     s->dz -= dz;
-    
+
+    /* Appears we have to invert the wheel direction */
+    dz = 0 - dz;
+
     b = 0;
     if (s->buttons_state & MOUSE_EVENT_LBUTTON)
         b |= 0x01;
@@ -278,28 +515,31 @@ static int usb_mouse_poll(USBMouseState *s, uint8_t *buf, int len)
         b |= 0x02;
     if (s->buttons_state & MOUSE_EVENT_MBUTTON)
         b |= 0x04;
-    
-    buf[0] = b;
-    buf[1] = dx;
-    buf[2] = dy;
-    l = 3;
-    if (len >= 4) {
-        buf[3] = dz;
-        l = 4;
-    }
+
+    l = 0;
+    if (len > l)
+        buf[l ++] = b;
+    if (len > l)
+        buf[l ++] = dx;
+    if (len > l)
+        buf[l ++] = dy;
+    if (len > l)
+        buf[l ++] = dz;
     return l;
 }
 
-static int usb_tablet_poll(USBMouseState *s, uint8_t *buf, int len)
+static int usb_tablet_poll(USBHIDState *hs, uint8_t *buf, int len)
 {
     int dz, b, l;
+    USBMouseState *s = &hs->ptr;
 
     if (!s->mouse_grabbed) {
-	qemu_add_mouse_event_handler(usb_tablet_event, s, 1);
+	s->eh_entry = qemu_add_mouse_event_handler(usb_tablet_event, hs,
+                                                  1, "QEMU USB Tablet");
 	s->mouse_grabbed = 1;
     }
-    
-    dz = int_clamp(s->dz, -128, 127);
+
+    dz = int_clamp(s->dz, -127, 127);
     s->dz -= dz;
 
     /* Appears we have to invert the wheel direction */
@@ -323,28 +563,59 @@ static int usb_tablet_poll(USBMouseState *s, uint8_t *buf, int len)
     return l;
 }
 
-static void usb_mouse_handle_reset(USBDevice *dev, int destroy)
+static int usb_keyboard_poll(USBKeyboardState *s, uint8_t *buf, int len)
 {
-    USBMouseState *s = (USBMouseState *)dev;
+    if (len < 2)
+        return 0;
 
-    if (destroy) {
-        qemu_add_mouse_event_handler(NULL, NULL, 0);
-        qemu_free(s);
-        return;
+    buf[0] = s->modifiers & 0xff;
+    buf[1] = 0;
+    if (s->keys > 6)
+        memset(buf + 2, USB_HID_USAGE_ERROR_ROLLOVER, MIN(8, len) - 2);
+    else
+        memcpy(buf + 2, s->key, MIN(8, len) - 2);
+
+    return MIN(8, len);
+}
+
+static int usb_keyboard_write(USBKeyboardState *s, uint8_t *buf, int len)
+{
+    if (len > 0) {
+        /* 0x01: Num Lock LED
+         * 0x02: Caps Lock LED
+         * 0x04: Scroll Lock LED
+         * 0x08: Compose LED
+         * 0x10: Kana LED */
+        s->leds = buf[0];
     }
+    return 0;
+}
+
+static void usb_mouse_handle_reset(USBDevice *dev)
+{
+    USBHIDState *s = (USBHIDState *)dev;
+
+    s->ptr.dx = 0;
+    s->ptr.dy = 0;
+    s->ptr.dz = 0;
+    s->ptr.x = 0;
+    s->ptr.y = 0;
+    s->ptr.buttons_state = 0;
+    s->protocol = 1;
+}
 
-    s->dx = 0;
-    s->dy = 0;
-    s->dz = 0;
-    s->x = 0;
-    s->y = 0;
-    s->buttons_state = 0;
+static void usb_keyboard_handle_reset(USBDevice *dev)
+{
+    USBHIDState *s = (USBHIDState *)dev;
+
+    qemu_add_kbd_event_handler(usb_keyboard_event, s);
+    s->protocol = 1;
 }
 
-static int usb_mouse_handle_control(USBDevice *dev, int request, int value,
+static int usb_hid_handle_control(USBDevice *dev, int request, int value,
                                   int index, int length, uint8_t *data)
 {
-    USBMouseState *s = (USBMouseState *)dev;
+    USBHIDState *s = (USBHIDState *)dev;
     int ret = 0;
 
     switch(request) {
@@ -377,20 +648,24 @@ static int usb_mouse_handle_control(USBDevice *dev, int request, int value,
     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
         switch(value >> 8) {
         case USB_DT_DEVICE:
-            memcpy(data, qemu_mouse_dev_descriptor, 
+            memcpy(data, qemu_mouse_dev_descriptor,
                    sizeof(qemu_mouse_dev_descriptor));
             ret = sizeof(qemu_mouse_dev_descriptor);
             break;
         case USB_DT_CONFIG:
 	    if (s->kind == USB_MOUSE) {
-		memcpy(data, qemu_mouse_config_descriptor, 
+		memcpy(data, qemu_mouse_config_descriptor,
 		       sizeof(qemu_mouse_config_descriptor));
 		ret = sizeof(qemu_mouse_config_descriptor);
 	    } else if (s->kind == USB_TABLET) {
-		memcpy(data, qemu_tablet_config_descriptor, 
+		memcpy(data, qemu_tablet_config_descriptor,
 		       sizeof(qemu_tablet_config_descriptor));
 		ret = sizeof(qemu_tablet_config_descriptor);
-	    }		
+            } else if (s->kind == USB_KEYBOARD) {
+                memcpy(data, qemu_keyboard_config_descriptor,
+                       sizeof(qemu_keyboard_config_descriptor));
+                ret = sizeof(qemu_keyboard_config_descriptor);
+            }
             break;
         case USB_DT_STRING:
             switch(value & 0xff) {
@@ -408,10 +683,7 @@ static int usb_mouse_handle_control(USBDevice *dev, int request, int value,
                 break;
             case 2:
                 /* product description */
-		if (s->kind == USB_MOUSE)
-		    ret = set_usb_string(data, "QEMU USB Mouse");
-		else if (s->kind == USB_TABLET)
-		    ret = set_usb_string(data, "QEMU USB Tablet");
+                ret = set_usb_string(data, s->dev.devname);
                 break;
             case 3:
                 /* vendor description */
@@ -421,6 +693,12 @@ static int usb_mouse_handle_control(USBDevice *dev, int request, int value,
                 ret = set_usb_string(data, "HID Mouse");
                 break;
             case 5:
+                ret = set_usb_string(data, "HID Tablet");
+                break;
+            case 6:
+                ret = set_usb_string(data, "HID Keyboard");
+                break;
+            case 7:
                 ret = set_usb_string(data, "Endpoint1 Interrupt Pipe");
                 break;
             default:
@@ -450,26 +728,55 @@ static int usb_mouse_handle_control(USBDevice *dev, int request, int value,
         switch(value >> 8) {
         case 0x22:
 	    if (s->kind == USB_MOUSE) {
-		memcpy(data, qemu_mouse_hid_report_descriptor, 
+		memcpy(data, qemu_mouse_hid_report_descriptor,
 		       sizeof(qemu_mouse_hid_report_descriptor));
 		ret = sizeof(qemu_mouse_hid_report_descriptor);
 	    } else if (s->kind == USB_TABLET) {
-		memcpy(data, qemu_tablet_hid_report_descriptor, 
+		memcpy(data, qemu_tablet_hid_report_descriptor,
 		       sizeof(qemu_tablet_hid_report_descriptor));
 		ret = sizeof(qemu_tablet_hid_report_descriptor);
-	    }
-	    break;
+            } else if (s->kind == USB_KEYBOARD) {
+                memcpy(data, qemu_keyboard_hid_report_descriptor,
+                       sizeof(qemu_keyboard_hid_report_descriptor));
+                ret = sizeof(qemu_keyboard_hid_report_descriptor);
+            }
+            break;
         default:
             goto fail;
         }
         break;
     case GET_REPORT:
 	if (s->kind == USB_MOUSE)
-	    ret = usb_mouse_poll(s, data, length);
+            ret = usb_mouse_poll(s, data, length);
 	else if (s->kind == USB_TABLET)
-	    ret = usb_tablet_poll(s, data, length);
+            ret = usb_tablet_poll(s, data, length);
+        else if (s->kind == USB_KEYBOARD)
+            ret = usb_keyboard_poll(&s->kbd, data, length);
+        break;
+    case SET_REPORT:
+        if (s->kind == USB_KEYBOARD)
+            ret = usb_keyboard_write(&s->kbd, data, length);
+        else
+            goto fail;
+        break;
+    case GET_PROTOCOL:
+        if (s->kind != USB_KEYBOARD)
+            goto fail;
+        ret = 1;
+        data[0] = s->protocol;
+        break;
+    case SET_PROTOCOL:
+        if (s->kind != USB_KEYBOARD)
+            goto fail;
+        ret = 0;
+        s->protocol = value;
+        break;
+    case GET_IDLE:
+        ret = 1;
+        data[0] = s->idle;
         break;
     case SET_IDLE:
+        s->idle = value;
         ret = 0;
         break;
     default:
@@ -480,19 +787,24 @@ static int usb_mouse_handle_control(USBDevice *dev, int request, int value,
     return ret;
 }
 
-static int usb_mouse_handle_data(USBDevice *dev, int pid, 
-                                 uint8_t devep, uint8_t *data, int len)
+static int usb_hid_handle_data(USBDevice *dev, USBPacket *p)
 {
-    USBMouseState *s = (USBMouseState *)dev;
+    USBHIDState *s = (USBHIDState *)dev;
     int ret = 0;
 
-    switch(pid) {
+    switch(p->pid) {
     case USB_TOKEN_IN:
-        if (devep == 1) {
-	    if (s->kind == USB_MOUSE)
-		ret = usb_mouse_poll(s, data, len);
-	    else if (s->kind == USB_TABLET)
-		ret = usb_tablet_poll(s, data, len);
+        if (p->devep == 1) {
+            /* TODO: Implement finite idle delays.  */
+            if (!(s->changed || s->idle))
+                return USB_RET_NAK;
+            s->changed = 0;
+            if (s->kind == USB_MOUSE)
+                ret = usb_mouse_poll(s, p->data, p->len);
+            else if (s->kind == USB_TABLET)
+                ret = usb_tablet_poll(s, p->data, p->len);
+            else if (s->kind == USB_KEYBOARD)
+                ret = usb_keyboard_poll(&s->kbd, p->data, p->len);
         } else {
             goto fail;
         }
@@ -506,20 +818,33 @@ static int usb_mouse_handle_data(USBDevice *dev, int pid,
     return ret;
 }
 
+static void usb_hid_handle_destroy(USBDevice *dev)
+{
+    USBHIDState *s = (USBHIDState *)dev;
+
+    if (s->kind != USB_KEYBOARD)
+        qemu_remove_mouse_event_handler(s->ptr.eh_entry);
+    /* TODO: else */
+    qemu_free(s);
+}
+
 USBDevice *usb_tablet_init(void)
 {
-    USBMouseState *s;
+    USBHIDState *s;
 
-    s = qemu_mallocz(sizeof(USBMouseState));
+    s = qemu_mallocz(sizeof(USBHIDState));
     if (!s)
         return NULL;
     s->dev.speed = USB_SPEED_FULL;
     s->dev.handle_packet = usb_generic_handle_packet;
 
     s->dev.handle_reset = usb_mouse_handle_reset;
-    s->dev.handle_control = usb_mouse_handle_control;
-    s->dev.handle_data = usb_mouse_handle_data;
+    s->dev.handle_control = usb_hid_handle_control;
+    s->dev.handle_data = usb_hid_handle_data;
+    s->dev.handle_destroy = usb_hid_handle_destroy;
     s->kind = USB_TABLET;
+    /* Force poll routine to be run and grab input the first time.  */
+    s->changed = 1;
 
     pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU USB Tablet");
 
@@ -528,20 +853,44 @@ USBDevice *usb_tablet_init(void)
 
 USBDevice *usb_mouse_init(void)
 {
-    USBMouseState *s;
+    USBHIDState *s;
 
-    s = qemu_mallocz(sizeof(USBMouseState));
+    s = qemu_mallocz(sizeof(USBHIDState));
     if (!s)
         return NULL;
     s->dev.speed = USB_SPEED_FULL;
     s->dev.handle_packet = usb_generic_handle_packet;
 
     s->dev.handle_reset = usb_mouse_handle_reset;
-    s->dev.handle_control = usb_mouse_handle_control;
-    s->dev.handle_data = usb_mouse_handle_data;
+    s->dev.handle_control = usb_hid_handle_control;
+    s->dev.handle_data = usb_hid_handle_data;
+    s->dev.handle_destroy = usb_hid_handle_destroy;
     s->kind = USB_MOUSE;
+    /* Force poll routine to be run and grab input the first time.  */
+    s->changed = 1;
 
     pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU USB Mouse");
 
     return (USBDevice *)s;
 }
+
+USBDevice *usb_keyboard_init(void)
+{
+    USBHIDState *s;
+
+    s = qemu_mallocz(sizeof(USBHIDState));
+    if (!s)
+        return NULL;
+    s->dev.speed = USB_SPEED_FULL;
+    s->dev.handle_packet = usb_generic_handle_packet;
+
+    s->dev.handle_reset = usb_keyboard_handle_reset;
+    s->dev.handle_control = usb_hid_handle_control;
+    s->dev.handle_data = usb_hid_handle_data;
+    s->dev.handle_destroy = usb_hid_handle_destroy;
+    s->kind = USB_KEYBOARD;
+
+    pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU USB Keyboard");
+
+    return (USBDevice *) s;
+}
diff --git a/hw/usb-hub.c b/hw/usb-hub.c
index 2eba905..97c3d05 100644
--- a/hw/usb-hub.c
+++ b/hw/usb-hub.c
@@ -2,7 +2,7 @@
  * QEMU USB HUB emulation
  *
  * Copyright (c) 2005 Fabrice Bellard
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "usb.h"
 
 //#define DEBUG
 
@@ -112,13 +113,13 @@ static const uint8_t qemu_hub_config_descriptor[] = {
 	0x01,       /*  u8  bNumInterfaces; (1) */
 	0x01,       /*  u8  bConfigurationValue; */
 	0x00,       /*  u8  iConfiguration; */
-	0xc0,       /*  u8  bmAttributes; 
+	0xc0,       /*  u8  bmAttributes;
 				 Bit 7: must be set,
 				     6: Self-powered,
 				     5: Remote wakeup,
 				     4..0: resvd */
 	0x00,       /*  u8  MaxPower; */
-      
+
 	/* USB 1.1:
 	 * USB 2.0, single TT organization (mandatory):
 	 *	one interface, protocol 0
@@ -140,7 +141,7 @@ static const uint8_t qemu_hub_config_descriptor[] = {
 	0x00,       /*  u8  if_bInterfaceSubClass; */
 	0x00,       /*  u8  if_bInterfaceProtocol; [usb1.1 or single tt] */
 	0x00,       /*  u8  if_iInterface; */
-     
+
 	/* one endpoint (status change endpoint) */
 	0x07,       /*  u8  ep_bLength; */
 	0x05,       /*  u8  ep_bDescriptorType; Endpoint */
@@ -167,11 +168,11 @@ static void usb_hub_attach(USBPort *port1, USBDevice *dev)
 {
     USBHubState *s = port1->opaque;
     USBHubPort *port = &s->ports[port1->index];
-    
+
     if (dev) {
         if (port->port.dev)
             usb_attach(port1, NULL);
-        
+
         port->wPortStatus |= PORT_STAT_CONNECTION;
         port->wPortChange |= PORT_STAT_C_CONNECTION;
         if (dev->speed == USB_SPEED_LOW)
@@ -180,8 +181,7 @@ static void usb_hub_attach(USBPort *port1, USBDevice *dev)
             port->wPortStatus &= ~PORT_STAT_LOW_SPEED;
         port->port.dev = dev;
         /* send the attach message */
-        dev->handle_packet(dev, 
-                           USB_MSG_ATTACH, 0, 0, NULL, 0);
+        usb_send_msg(dev, USB_MSG_ATTACH);
     } else {
         dev = port->port.dev;
         if (dev) {
@@ -192,18 +192,15 @@ static void usb_hub_attach(USBPort *port1, USBDevice *dev)
                 port->wPortChange |= PORT_STAT_C_ENABLE;
             }
             /* send the detach message */
-            dev->handle_packet(dev, 
-                               USB_MSG_DETACH, 0, 0, NULL, 0);
+            usb_send_msg(dev, USB_MSG_DETACH);
             port->port.dev = NULL;
         }
     }
 }
 
-static void usb_hub_handle_reset(USBDevice *dev, int destroy)
+static void usb_hub_handle_reset(USBDevice *dev)
 {
     /* XXX: do it */
-    if (destroy)
-        qemu_free(dev);
 }
 
 static int usb_hub_handle_control(USBDevice *dev, int request, int value,
@@ -248,12 +245,12 @@ static int usb_hub_handle_control(USBDevice *dev, int request, int value,
     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
         switch(value >> 8) {
         case USB_DT_DEVICE:
-            memcpy(data, qemu_hub_dev_descriptor, 
+            memcpy(data, qemu_hub_dev_descriptor,
                    sizeof(qemu_hub_dev_descriptor));
             ret = sizeof(qemu_hub_dev_descriptor);
             break;
         case USB_DT_CONFIG:
-            memcpy(data, qemu_hub_config_descriptor, 
+            memcpy(data, qemu_hub_config_descriptor,
                    sizeof(qemu_hub_config_descriptor));
 
             /* status change endpoint size based on number
@@ -351,8 +348,7 @@ static int usb_hub_handle_control(USBDevice *dev, int request, int value,
                 break;
             case PORT_RESET:
                 if (dev) {
-                    dev->handle_packet(dev, 
-                                       USB_MSG_RESET, 0, 0, NULL, 0);
+                    usb_send_msg(dev, USB_MSG_RESET);
                     port->wPortChange |= PORT_STAT_C_RESET;
                     /* set enable bit */
                     port->wPortStatus |= PORT_STAT_ENABLE;
@@ -406,7 +402,7 @@ static int usb_hub_handle_control(USBDevice *dev, int request, int value,
     case GetHubDescriptor:
         {
             unsigned int n, limit, var_hub_size = 0;
-            memcpy(data, qemu_hub_hub_descriptor, 
+            memcpy(data, qemu_hub_hub_descriptor,
                    sizeof(qemu_hub_hub_descriptor));
             data[2] = s->nb_ports;
 
@@ -436,22 +432,21 @@ static int usb_hub_handle_control(USBDevice *dev, int request, int value,
     return ret;
 }
 
-static int usb_hub_handle_data(USBDevice *dev, int pid, 
-                               uint8_t devep, uint8_t *data, int len)
+static int usb_hub_handle_data(USBDevice *dev, USBPacket *p)
 {
     USBHubState *s = (USBHubState *)dev;
     int ret;
 
-    switch(pid) {
+    switch(p->pid) {
     case USB_TOKEN_IN:
-        if (devep == 1) {
+        if (p->devep == 1) {
             USBHubPort *port;
             unsigned int status;
             int i, n;
             n = (s->nb_ports + 1 + 7) / 8;
-            if (len == 1) { /* FreeBSD workaround */
+            if (p->len == 1) { /* FreeBSD workaround */
                 n = 1;
-            } else if (n > len) {
+            } else if (n > p->len) {
                 return USB_RET_BABBLE;
             }
             status = 0;
@@ -462,7 +457,7 @@ static int usb_hub_handle_data(USBDevice *dev, int pid,
             }
             if (status != 0) {
                 for(i = 0; i < n; i++) {
-                    data[i] = status >> (8 * i);
+                    p->data[i] = status >> (8 * i);
                 }
                 ret = n;
             } else {
@@ -481,9 +476,7 @@ static int usb_hub_handle_data(USBDevice *dev, int pid,
     return ret;
 }
 
-static int usb_hub_broadcast_packet(USBHubState *s, int pid, 
-                                    uint8_t devaddr, uint8_t devep,
-                                    uint8_t *data, int len)
+static int usb_hub_broadcast_packet(USBHubState *s, USBPacket *p)
 {
     USBHubPort *port;
     USBDevice *dev;
@@ -493,9 +486,7 @@ static int usb_hub_broadcast_packet(USBHubState *s, int pid,
         port = &s->ports[i];
         dev = port->port.dev;
         if (dev && (port->wPortStatus & PORT_STAT_ENABLE)) {
-            ret = dev->handle_packet(dev, pid, 
-                                     devaddr, devep,
-                                     data, len);
+            ret = dev->handle_packet(dev, p);
             if (ret != USB_RET_NODEV) {
                 return ret;
             }
@@ -504,9 +495,7 @@ static int usb_hub_broadcast_packet(USBHubState *s, int pid,
     return USB_RET_NODEV;
 }
 
-static int usb_hub_handle_packet(USBDevice *dev, int pid, 
-                                 uint8_t devaddr, uint8_t devep,
-                                 uint8_t *data, int len)
+static int usb_hub_handle_packet(USBDevice *dev, USBPacket *p)
 {
     USBHubState *s = (USBHubState *)dev;
 
@@ -515,14 +504,21 @@ static int usb_hub_handle_packet(USBDevice *dev, int pid,
 #endif
     if (dev->state == USB_STATE_DEFAULT &&
         dev->addr != 0 &&
-        devaddr != dev->addr &&
-        (pid == USB_TOKEN_SETUP || 
-         pid == USB_TOKEN_OUT || 
-         pid == USB_TOKEN_IN)) {
+        p->devaddr != dev->addr &&
+        (p->pid == USB_TOKEN_SETUP ||
+         p->pid == USB_TOKEN_OUT ||
+         p->pid == USB_TOKEN_IN)) {
         /* broadcast the packet to the devices */
-        return usb_hub_broadcast_packet(s, pid, devaddr, devep, data, len);
+        return usb_hub_broadcast_packet(s, p);
     }
-    return usb_generic_handle_packet(dev, pid, devaddr, devep, data, len);
+    return usb_generic_handle_packet(dev, p);
+}
+
+static void usb_hub_handle_destroy(USBDevice *dev)
+{
+    USBHubState *s = (USBHubState *)dev;
+
+    qemu_free(s);
 }
 
 USBDevice *usb_hub_init(int nb_ports)
@@ -543,6 +539,7 @@ USBDevice *usb_hub_init(int nb_ports)
     s->dev.handle_reset = usb_hub_handle_reset;
     s->dev.handle_control = usb_hub_handle_control;
     s->dev.handle_data = usb_hub_handle_data;
+    s->dev.handle_destroy = usb_hub_handle_destroy;
 
     pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU USB Hub");
 
diff --git a/hw/usb-msd.c b/hw/usb-msd.c
index 3dccfb9..f7ad25e 100644
--- a/hw/usb-msd.c
+++ b/hw/usb-msd.c
@@ -1,4 +1,4 @@
-/* 
+/*
  * USB Mass Storage Device emulation
  *
  * Copyright (c) 2006 CodeSourcery.
@@ -7,7 +7,10 @@
  * This code is licenced under the LGPL.
  */
 
-#include "vl.h"
+#include "qemu-common.h"
+#include "usb.h"
+#include "block.h"
+#include "scsi-disk.h"
 
 //#define DEBUG_MSD
 
@@ -32,16 +35,41 @@ enum USBMSDMode {
 typedef struct {
     USBDevice dev;
     enum USBMSDMode mode;
+    uint32_t scsi_len;
+    uint8_t *scsi_buf;
+    uint32_t usb_len;
+    uint8_t *usb_buf;
     uint32_t data_len;
+    uint32_t residue;
     uint32_t tag;
+    BlockDriverState *bs;
     SCSIDevice *scsi_dev;
     int result;
+    /* For async completion.  */
+    USBPacket *packet;
 } MSDState;
 
+struct usb_msd_cbw {
+    uint32_t sig;
+    uint32_t tag;
+    uint32_t data_len;
+    uint8_t flags;
+    uint8_t lun;
+    uint8_t cmd_len;
+    uint8_t cmd[16];
+};
+
+struct usb_msd_csw {
+    uint32_t sig;
+    uint32_t tag;
+    uint32_t residue;
+    uint8_t status;
+};
+
 static const uint8_t qemu_msd_dev_descriptor[] = {
 	0x12,       /*  u8 bLength; */
 	0x01,       /*  u8 bDescriptorType; Device */
-	0x10, 0x00, /*  u16 bcdUSB; v1.0 */
+	0x00, 0x01, /*  u16 bcdUSB; v1.0 */
 
 	0x00,	    /*  u8  bDeviceClass; */
 	0x00,	    /*  u8  bDeviceSubClass; */
@@ -68,13 +96,13 @@ static const uint8_t qemu_msd_config_descriptor[] = {
 	0x01,       /*  u8  bNumInterfaces; (1) */
 	0x01,       /*  u8  bConfigurationValue; */
 	0x00,       /*  u8  iConfiguration; */
-	0xc0,       /*  u8  bmAttributes; 
+	0xc0,       /*  u8  bmAttributes;
 				 Bit 7: must be set,
 				     6: Self-powered,
 				     5: Remote wakeup,
 				     4..0: resvd */
 	0x00,       /*  u8  MaxPower; */
-      
+
 	/* one interface */
 	0x09,       /*  u8  if_bLength; */
 	0x04,       /*  u8  if_bDescriptorType; Interface */
@@ -85,7 +113,7 @@ static const uint8_t qemu_msd_config_descriptor[] = {
 	0x06,       /*  u8  if_bInterfaceSubClass; SCSI */
 	0x50,       /*  u8  if_bInterfaceProtocol; Bulk Only */
 	0x00,       /*  u8  if_iInterface; */
-     
+
 	/* Bulk-In endpoint */
 	0x07,       /*  u8  ep_bLength; */
 	0x05,       /*  u8  ep_bDescriptorType; Endpoint */
@@ -103,25 +131,99 @@ static const uint8_t qemu_msd_config_descriptor[] = {
 	0x00        /*  u8  ep_bInterval; */
 };
 
-static void usb_msd_command_complete(void *opaque, uint32_t tag, int fail)
+static void usb_msd_copy_data(MSDState *s)
+{
+    uint32_t len;
+    len = s->usb_len;
+    if (len > s->scsi_len)
+        len = s->scsi_len;
+    if (s->mode == USB_MSDM_DATAIN) {
+        memcpy(s->usb_buf, s->scsi_buf, len);
+    } else {
+        memcpy(s->scsi_buf, s->usb_buf, len);
+    }
+    s->usb_len -= len;
+    s->scsi_len -= len;
+    s->usb_buf += len;
+    s->scsi_buf += len;
+    s->data_len -= len;
+    if (s->scsi_len == 0) {
+        if (s->mode == USB_MSDM_DATAIN) {
+            s->scsi_dev->read_data(s->scsi_dev, s->tag);
+        } else if (s->mode == USB_MSDM_DATAOUT) {
+            s->scsi_dev->write_data(s->scsi_dev, s->tag);
+        }
+    }
+}
+
+static void usb_msd_send_status(MSDState *s)
+{
+    struct usb_msd_csw csw;
+
+    csw.sig = cpu_to_le32(0x53425355);
+    csw.tag = cpu_to_le32(s->tag);
+    csw.residue = s->residue;
+    csw.status = s->result;
+    memcpy(s->usb_buf, &csw, 13);
+}
+
+static void usb_msd_command_complete(void *opaque, int reason, uint32_t tag,
+                                     uint32_t arg)
 {
     MSDState *s = (MSDState *)opaque;
+    USBPacket *p = s->packet;
 
-    DPRINTF("Command complete\n");
-    s->result = fail;
-    s->mode = USB_MSDM_CSW;
+    if (tag != s->tag) {
+        fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
+    }
+    if (reason == SCSI_REASON_DONE) {
+        DPRINTF("Command complete %d\n", arg);
+        s->residue = s->data_len;
+        s->result = arg != 0;
+        if (s->packet) {
+            if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
+                /* A deferred packet with no write data remaining must be
+                   the status read packet.  */
+                usb_msd_send_status(s);
+                s->mode = USB_MSDM_CBW;
+            } else {
+                if (s->data_len) {
+                    s->data_len -= s->usb_len;
+                    if (s->mode == USB_MSDM_DATAIN)
+                        memset(s->usb_buf, 0, s->usb_len);
+                    s->usb_len = 0;
+                }
+                if (s->data_len == 0)
+                    s->mode = USB_MSDM_CSW;
+            }
+            s->packet = NULL;
+            usb_packet_complete(p);
+        } else if (s->data_len == 0) {
+            s->mode = USB_MSDM_CSW;
+        }
+        return;
+    }
+    s->scsi_len = arg;
+    s->scsi_buf = s->scsi_dev->get_buf(s->scsi_dev, tag);
+    if (p) {
+        usb_msd_copy_data(s);
+        if (s->usb_len == 0) {
+            /* Set s->packet to NULL before calling usb_packet_complete
+               because annother request may be issued before
+               usb_packet_complete returns.  */
+            DPRINTF("Packet complete %p\n", p);
+            s->packet = NULL;
+            usb_packet_complete(p);
+        }
+    }
 }
 
-static void usb_msd_handle_reset(USBDevice *dev, int destroy)
+static void usb_msd_handle_reset(USBDevice *dev)
 {
     MSDState *s = (MSDState *)dev;
 
     DPRINTF("Reset\n");
     s->mode = USB_MSDM_CBW;
-    if (destroy) {
-        scsi_disk_destroy(s->scsi_dev);
-        qemu_free(s);
-    }
 }
 
 static int usb_msd_handle_control(USBDevice *dev, int request, int value,
@@ -160,12 +262,12 @@ static int usb_msd_handle_control(USBDevice *dev, int request, int value,
     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
         switch(value >> 8) {
         case USB_DT_DEVICE:
-            memcpy(data, qemu_msd_dev_descriptor, 
+            memcpy(data, qemu_msd_dev_descriptor,
                    sizeof(qemu_msd_dev_descriptor));
             ret = sizeof(qemu_msd_dev_descriptor);
             break;
         case USB_DT_CONFIG:
-            memcpy(data, qemu_msd_config_descriptor, 
+            memcpy(data, qemu_msd_config_descriptor,
                    sizeof(qemu_msd_config_descriptor));
             ret = sizeof(qemu_msd_config_descriptor);
             break;
@@ -237,32 +339,24 @@ static int usb_msd_handle_control(USBDevice *dev, int request, int value,
     return ret;
 }
 
-struct usb_msd_cbw {
-    uint32_t sig;
-    uint32_t tag;
-    uint32_t data_len;
-    uint8_t flags;
-    uint8_t lun;
-    uint8_t cmd_len;
-    uint8_t cmd[16];
-};
-
-struct usb_msd_csw {
-    uint32_t sig;
-    uint32_t tag;
-    uint32_t residue;
-    uint8_t status;
-};
+static void usb_msd_cancel_io(USBPacket *p, void *opaque)
+{
+    MSDState *s = opaque;
+    s->scsi_dev->cancel_io(s->scsi_dev, s->tag);
+    s->packet = NULL;
+    s->scsi_len = 0;
+}
 
-static int usb_msd_handle_data(USBDevice *dev, int pid, uint8_t devep,
-                               uint8_t *data, int len)
+static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
 {
     MSDState *s = (MSDState *)dev;
     int ret = 0;
     struct usb_msd_cbw cbw;
-    struct usb_msd_csw csw;
+    uint8_t devep = p->devep;
+    uint8_t *data = p->data;
+    int len = p->len;
 
-    switch (pid) {
+    switch (p->pid) {
     case USB_TOKEN_OUT:
         if (devep != 2)
             goto fail;
@@ -295,7 +389,17 @@ static int usb_msd_handle_data(USBDevice *dev, int pid, uint8_t devep,
             }
             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
                     s->tag, cbw.flags, cbw.cmd_len, s->data_len);
-            scsi_send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
+            s->residue = 0;
+            s->scsi_dev->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
+            /* ??? Should check that USB and SCSI data transfer
+               directions match.  */
+            if (s->residue == 0) {
+                if (s->mode == USB_MSDM_DATAIN) {
+                    s->scsi_dev->read_data(s->scsi_dev, s->tag);
+                } else if (s->mode == USB_MSDM_DATAOUT) {
+                    s->scsi_dev->write_data(s->scsi_dev, s->tag);
+                }
+            }
             ret = len;
             break;
 
@@ -304,13 +408,25 @@ static int usb_msd_handle_data(USBDevice *dev, int pid, uint8_t devep,
             if (len > s->data_len)
                 goto fail;
 
-            if (scsi_write_data(s->scsi_dev, data, len))
-                goto fail;
-
-            s->data_len -= len;
-            if (s->data_len == 0)
-                s->mode = USB_MSDM_CSW;
-            ret = len;
+            s->usb_buf = data;
+            s->usb_len = len;
+            if (s->scsi_len) {
+                usb_msd_copy_data(s);
+            }
+            if (s->residue && s->usb_len) {
+                s->data_len -= s->usb_len;
+                if (s->data_len == 0)
+                    s->mode = USB_MSDM_CSW;
+                s->usb_len = 0;
+            }
+            if (s->usb_len) {
+                DPRINTF("Deferring packet %p\n", p);
+                usb_defer_packet(p, usb_msd_cancel_io, s);
+                s->packet = p;
+                ret = USB_RET_ASYNC;
+            } else {
+                ret = len;
+            }
             break;
 
         default:
@@ -324,33 +440,52 @@ static int usb_msd_handle_data(USBDevice *dev, int pid, uint8_t devep,
             goto fail;
 
         switch (s->mode) {
+        case USB_MSDM_DATAOUT:
+            if (s->data_len != 0 || len < 13)
+                goto fail;
+            /* Waiting for SCSI write to complete.  */
+            usb_defer_packet(p, usb_msd_cancel_io, s);
+            s->packet = p;
+            ret = USB_RET_ASYNC;
+            break;
+
         case USB_MSDM_CSW:
             DPRINTF("Command status %d tag 0x%x, len %d\n",
                     s->result, s->tag, len);
             if (len < 13)
                 goto fail;
 
-            csw.sig = cpu_to_le32(0x53425355);
-            csw.tag = cpu_to_le32(s->tag);
-            csw.residue = 0;
-            csw.status = s->result;
-            memcpy(data, &csw, 13);
-            ret = 13;
+            s->usb_len = len;
+            s->usb_buf = data;
+            usb_msd_send_status(s);
             s->mode = USB_MSDM_CBW;
+            ret = 13;
             break;
 
         case USB_MSDM_DATAIN:
             DPRINTF("Data in %d/%d\n", len, s->data_len);
             if (len > s->data_len)
                 len = s->data_len;
-
-            if (scsi_read_data(s->scsi_dev, data, len))
-                goto fail;
-
-            s->data_len -= len;
-            if (s->data_len == 0)
-                s->mode = USB_MSDM_CSW;
-            ret = len;
+            s->usb_buf = data;
+            s->usb_len = len;
+            if (s->scsi_len) {
+                usb_msd_copy_data(s);
+            }
+            if (s->residue && s->usb_len) {
+                s->data_len -= s->usb_len;
+                memset(s->usb_buf, 0, s->usb_len);
+                if (s->data_len == 0)
+                    s->mode = USB_MSDM_CSW;
+                s->usb_len = 0;
+            }
+            if (s->usb_len) {
+                DPRINTF("Deferring packet %p\n", p);
+                usb_defer_packet(p, usb_msd_cancel_io, s);
+                s->packet = p;
+                ret = USB_RET_ASYNC;
+            } else {
+                ret = len;
+            }
             break;
 
         default:
@@ -369,18 +504,59 @@ static int usb_msd_handle_data(USBDevice *dev, int pid, uint8_t devep,
     return ret;
 }
 
+static void usb_msd_handle_destroy(USBDevice *dev)
+{
+    MSDState *s = (MSDState *)dev;
+
+    s->scsi_dev->destroy(s->scsi_dev);
+    bdrv_delete(s->bs);
+    qemu_free(s);
+}
 
 USBDevice *usb_msd_init(const char *filename)
 {
     MSDState *s;
     BlockDriverState *bdrv;
+    BlockDriver *drv = NULL;
+    const char *p1;
+    char fmt[32];
+
+    p1 = strchr(filename, ':');
+    if (p1++) {
+        const char *p2;
+
+        if (strstart(filename, "format=", &p2)) {
+            int len = MIN(p1 - p2, sizeof(fmt));
+            pstrcpy(fmt, len, p2);
+
+            drv = bdrv_find_format(fmt);
+            if (!drv) {
+                printf("invalid format %s\n", fmt);
+                return NULL;
+            }
+        } else if (*filename != ':') {
+            printf("unrecognized USB mass-storage option %s\n", filename);
+            return NULL;
+        }
+
+        filename = p1;
+    }
+
+    if (!*filename) {
+        printf("block device specification needed\n");
+        return NULL;
+    }
 
     s = qemu_mallocz(sizeof(MSDState));
     if (!s)
         return NULL;
 
     bdrv = bdrv_new("usb");
-    bdrv_open(bdrv, filename, 0);
+    if (bdrv_open2(bdrv, filename, 0, drv) < 0)
+        goto fail;
+    if (qemu_key_check(bdrv, filename))
+        goto fail;
+    s->bs = bdrv;
 
     s->dev.speed = USB_SPEED_FULL;
     s->dev.handle_packet = usb_generic_handle_packet;
@@ -388,11 +564,15 @@ USBDevice *usb_msd_init(const char *filename)
     s->dev.handle_reset = usb_msd_handle_reset;
     s->dev.handle_control = usb_msd_handle_control;
     s->dev.handle_data = usb_msd_handle_data;
+    s->dev.handle_destroy = usb_msd_handle_destroy;
 
     snprintf(s->dev.devname, sizeof(s->dev.devname), "QEMU USB MSD(%.16s)",
              filename);
 
-    s->scsi_dev = scsi_disk_init(bdrv, usb_msd_command_complete, s);
-    usb_msd_handle_reset((USBDevice *)s, 0);
+    s->scsi_dev = scsi_disk_init(bdrv, 0, usb_msd_command_complete, s);
+    usb_msd_handle_reset((USBDevice *)s);
     return (USBDevice *)s;
+ fail:
+    qemu_free(s);
+    return NULL;
 }
diff --git a/hw/usb-ohci.c b/hw/usb-ohci.c
index e87d9da..55cb77b 100644
--- a/hw/usb-ohci.c
+++ b/hw/usb-ohci.c
@@ -2,6 +2,7 @@
  * QEMU USB OHCI Emulation
  * Copyright (c) 2004 Gianni Tedesco
  * Copyright (c) 2006 CodeSourcery
+ * Copyright (c) 2006 Openedhand Ltd.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -26,11 +27,16 @@
  *  o BIOS work to boot from USB storage
 */
 
-#include "vl.h"
+#include "hw.h"
+#include "qemu-timer.h"
+#include "usb.h"
+#include "pci.h"
+#include "pxa.h"
 
 //#define DEBUG_OHCI
 /* Dump packet contents.  */
 //#define DEBUG_PACKET
+//#define DEBUG_ISOCH
 /* This causes frames to occur 1000x slower */
 //#define OHCI_TIME_WARP 1
 
@@ -52,11 +58,18 @@ typedef struct OHCIPort {
     uint32_t ctrl;
 } OHCIPort;
 
+enum ohci_type {
+    OHCI_TYPE_PCI,
+    OHCI_TYPE_PXA
+};
+
 typedef struct {
-    struct PCIDevice pci_dev;
+    qemu_irq irq;
+    enum ohci_type type;
     target_phys_addr_t mem_base;
     int mem;
     int num_ports;
+    const char *name;
 
     QEMUTimer *eof_timer;
     int64_t sof_time;
@@ -89,6 +102,20 @@ typedef struct {
     uint32_t rhdesc_a, rhdesc_b;
     uint32_t rhstatus;
     OHCIPort rhport[OHCI_MAX_PORTS];
+
+    /* PXA27x Non-OHCI events */
+    uint32_t hstatus;
+    uint32_t hmask;
+    uint32_t hreset;
+    uint32_t htest;
+
+    /* Active packets.  */
+    uint32_t old_ctl;
+    USBPacket usb_packet;
+    uint8_t usb_buf[8192];
+    uint32_t async_td;
+    int async_complete;
+
 } OHCIState;
 
 /* Host Controller Communications Area */
@@ -98,6 +125,8 @@ struct ohci_hcca {
     uint32_t done;
 };
 
+static void ohci_bus_stop(OHCIState *ohci);
+
 /* Bitfields for the first word of an Endpoint Desciptor.  */
 #define OHCI_ED_FA_SHIFT  0
 #define OHCI_ED_FA_MASK   (0x7f<<OHCI_ED_FA_SHIFT)
@@ -108,8 +137,8 @@ struct ohci_hcca {
 #define OHCI_ED_S         (1<<13)
 #define OHCI_ED_K         (1<<14)
 #define OHCI_ED_F         (1<<15)
-#define OHCI_ED_MPS_SHIFT 7
-#define OHCI_ED_MPS_MASK  (0xf<<OHCI_ED_FA_SHIFT)
+#define OHCI_ED_MPS_SHIFT 16
+#define OHCI_ED_MPS_MASK  (0x7ff<<OHCI_ED_MPS_SHIFT)
 
 /* Flags in the head field of an Endpoint Desciptor.  */
 #define OHCI_ED_H         1
@@ -128,6 +157,22 @@ struct ohci_hcca {
 #define OHCI_TD_CC_SHIFT  28
 #define OHCI_TD_CC_MASK   (0xf<<OHCI_TD_CC_SHIFT)
 
+/* Bitfields for the first word of an Isochronous Transfer Desciptor.  */
+/* CC & DI - same as in the General Transfer Desciptor */
+#define OHCI_TD_SF_SHIFT  0
+#define OHCI_TD_SF_MASK   (0xffff<<OHCI_TD_SF_SHIFT)
+#define OHCI_TD_FC_SHIFT  24
+#define OHCI_TD_FC_MASK   (7<<OHCI_TD_FC_SHIFT)
+
+/* Isochronous Transfer Desciptor - Offset / PacketStatusWord */
+#define OHCI_TD_PSW_CC_SHIFT 12
+#define OHCI_TD_PSW_CC_MASK  (0xf<<OHCI_TD_PSW_CC_SHIFT)
+#define OHCI_TD_PSW_SIZE_SHIFT 0
+#define OHCI_TD_PSW_SIZE_MASK  (0xfff<<OHCI_TD_PSW_SIZE_SHIFT)
+
+#define OHCI_PAGE_MASK    0xfffff000
+#define OHCI_OFFSET_MASK  0xfff
+
 #define OHCI_DPTR_MASK    0xfffffff0
 
 #define OHCI_BM(val, field) \
@@ -154,6 +199,15 @@ struct ohci_td {
     uint32_t be;
 };
 
+/* Isochronous transfer descriptor */
+struct ohci_iso_td {
+    uint32_t flags;
+    uint32_t bp;
+    uint32_t next;
+    uint32_t be;
+    uint16_t offset[8];
+};
+
 #define USB_HZ                      12000000
 
 /* OHCI Local stuff */
@@ -248,6 +302,8 @@ struct ohci_td {
 #define OHCI_CC_BUFFEROVERRUN       0xc
 #define OHCI_CC_BUFFERUNDERRUN      0xd
 
+#define OHCI_HRESET_FSBIR       (1 << 0)
+
 /* Update IRQ levels */
 static inline void ohci_intr_update(OHCIState *ohci)
 {
@@ -257,7 +313,7 @@ static inline void ohci_intr_update(OHCIState *ohci)
         (ohci->intr_status & ohci->intr))
         level = 1;
 
-    pci_set_irq(&ohci->pci_dev, 0, level);
+    qemu_set_irq(ohci->irq, level);
 }
 
 /* Set an interrupt */
@@ -287,9 +343,13 @@ static void ohci_attach(USBPort *port1, USBDevice *dev)
         else
             port->ctrl &= ~OHCI_PORT_LSDA;
         port->port.dev = dev;
+
+        /* notify of remote-wakeup */
+        if ((s->ctl & OHCI_CTL_HCFS) == OHCI_USB_SUSPEND)
+            ohci_set_interrupt(s, OHCI_INTR_RD);
+
         /* send the attach message */
-        dev->handle_packet(dev, 
-                           USB_MSG_ATTACH, 0, 0, NULL, 0);
+        usb_send_msg(dev, USB_MSG_ATTACH);
         dprintf("usb-ohci: Attached port %d\n", port1->index);
     } else {
         /* set connect status */
@@ -305,8 +365,7 @@ static void ohci_attach(USBPort *port1, USBDevice *dev)
         dev = port->port.dev;
         if (dev) {
             /* send the detach message */
-            dev->handle_packet(dev, 
-                               USB_MSG_DETACH, 0, 0, NULL, 0);
+            usb_send_msg(dev, USB_MSG_DETACH);
         }
         port->port.dev = NULL;
         dprintf("usb-ohci: Detached port %d\n", port1->index);
@@ -317,12 +376,15 @@ static void ohci_attach(USBPort *port1, USBDevice *dev)
 }
 
 /* Reset the controller */
-static void ohci_reset(OHCIState *ohci)
+static void ohci_reset(void *opaque)
 {
+    OHCIState *ohci = opaque;
     OHCIPort *port;
     int i;
 
+    ohci_bus_stop(ohci);
     ohci->ctl = 0;
+    ohci->old_ctl = 0;
     ohci->status = 0;
     ohci->intr_status = 0;
     ohci->intr = OHCI_INTR_MIE;
@@ -356,7 +418,11 @@ static void ohci_reset(OHCIState *ohci)
         if (port->port.dev)
             ohci_attach(&port->port, port->port.dev);
       }
-    dprintf("usb-ohci: Reset %s\n", ohci->pci_dev.name);
+    if (ohci->async_td) {
+        usb_cancel_packet(&ohci->usb_packet);
+        ohci->async_td = 0;
+    }
+    dprintf("usb-ohci: Reset %s\n", ohci->name);
 }
 
 /* Get an array of dwords from main memory */
@@ -385,6 +451,32 @@ static inline int put_dwords(uint32_t addr, uint32_t *buf, int num)
     return 1;
 }
 
+/* Get an array of words from main memory */
+static inline int get_words(uint32_t addr, uint16_t *buf, int num)
+{
+    int i;
+
+    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
+        cpu_physical_memory_rw(addr, (uint8_t *)buf, sizeof(*buf), 0);
+        *buf = le16_to_cpu(*buf);
+    }
+
+    return 1;
+}
+
+/* Put an array of words in to main memory */
+static inline int put_words(uint32_t addr, uint16_t *buf, int num)
+{
+    int i;
+
+    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
+        uint16_t tmp = cpu_to_le16(*buf);
+        cpu_physical_memory_rw(addr, (uint8_t *)&tmp, sizeof(tmp), 1);
+    }
+
+    return 1;
+}
+
 static inline int ohci_read_ed(uint32_t addr, struct ohci_ed *ed)
 {
     return get_dwords(addr, (uint32_t *)ed, sizeof(*ed) >> 2);
@@ -395,6 +487,12 @@ static inline int ohci_read_td(uint32_t addr, struct ohci_td *td)
     return get_dwords(addr, (uint32_t *)td, sizeof(*td) >> 2);
 }
 
+static inline int ohci_read_iso_td(uint32_t addr, struct ohci_iso_td *td)
+{
+    return (get_dwords(addr, (uint32_t *)td, 4) &&
+            get_words(addr + 16, td->offset, 8));
+}
+
 static inline int ohci_put_ed(uint32_t addr, struct ohci_ed *ed)
 {
     return put_dwords(addr, (uint32_t *)ed, sizeof(*ed) >> 2);
@@ -405,6 +503,12 @@ static inline int ohci_put_td(uint32_t addr, struct ohci_td *td)
     return put_dwords(addr, (uint32_t *)td, sizeof(*td) >> 2);
 }
 
+static inline int ohci_put_iso_td(uint32_t addr, struct ohci_iso_td *td)
+{
+    return (put_dwords(addr, (uint32_t *)td, 4) &&
+            put_words(addr + 16, td->offset, 8));
+}
+
 /* Read/Write the contents of a TD from/to main memory.  */
 static void ohci_copy_td(struct ohci_td *td, uint8_t *buf, int len, int write)
 {
@@ -423,6 +527,272 @@ static void ohci_copy_td(struct ohci_td *td, uint8_t *buf, int len, int write)
     cpu_physical_memory_rw(ptr, buf, len - n, write);
 }
 
+/* Read/Write the contents of an ISO TD from/to main memory.  */
+static void ohci_copy_iso_td(uint32_t start_addr, uint32_t end_addr,
+                             uint8_t *buf, int len, int write)
+{
+    uint32_t ptr;
+    uint32_t n;
+
+    ptr = start_addr;
+    n = 0x1000 - (ptr & 0xfff);
+    if (n > len)
+        n = len;
+    cpu_physical_memory_rw(ptr, buf, n, write);
+    if (n == len)
+        return;
+    ptr = end_addr & ~0xfffu;
+    buf += n;
+    cpu_physical_memory_rw(ptr, buf, len - n, write);
+}
+
+static void ohci_process_lists(OHCIState *ohci, int completion);
+
+static void ohci_async_complete_packet(USBPacket *packet, void *opaque)
+{
+    OHCIState *ohci = opaque;
+#ifdef DEBUG_PACKET
+    dprintf("Async packet complete\n");
+#endif
+    ohci->async_complete = 1;
+    ohci_process_lists(ohci, 1);
+}
+
+#define USUB(a, b) ((int16_t)((uint16_t)(a) - (uint16_t)(b)))
+
+static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
+                               int completion)
+{
+    int dir;
+    size_t len = 0;
+    const char *str = NULL;
+    int pid;
+    int ret;
+    int i;
+    USBDevice *dev;
+    struct ohci_iso_td iso_td;
+    uint32_t addr;
+    uint16_t starting_frame;
+    int16_t relative_frame_number;
+    int frame_count;
+    uint32_t start_offset, next_offset, end_offset = 0;
+    uint32_t start_addr, end_addr;
+
+    addr = ed->head & OHCI_DPTR_MASK;
+
+    if (!ohci_read_iso_td(addr, &iso_td)) {
+        printf("usb-ohci: ISO_TD read error at %x\n", addr);
+        return 0;
+    }
+
+    starting_frame = OHCI_BM(iso_td.flags, TD_SF);
+    frame_count = OHCI_BM(iso_td.flags, TD_FC);
+    relative_frame_number = USUB(ohci->frame_number, starting_frame); 
+
+#ifdef DEBUG_ISOCH
+    printf("--- ISO_TD ED head 0x%.8x tailp 0x%.8x\n"
+           "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
+           "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
+           "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
+           "frame_number 0x%.8x starting_frame 0x%.8x\n"
+           "frame_count  0x%.8x relative %d\n"
+           "di 0x%.8x cc 0x%.8x\n",
+           ed->head & OHCI_DPTR_MASK, ed->tail & OHCI_DPTR_MASK,
+           iso_td.flags, iso_td.bp, iso_td.next, iso_td.be,
+           iso_td.offset[0], iso_td.offset[1], iso_td.offset[2], iso_td.offset[3],
+           iso_td.offset[4], iso_td.offset[5], iso_td.offset[6], iso_td.offset[7],
+           ohci->frame_number, starting_frame, 
+           frame_count, relative_frame_number,         
+           OHCI_BM(iso_td.flags, TD_DI), OHCI_BM(iso_td.flags, TD_CC));
+#endif
+
+    if (relative_frame_number < 0) {
+        dprintf("usb-ohci: ISO_TD R=%d < 0\n", relative_frame_number);
+        return 1;
+    } else if (relative_frame_number > frame_count) {
+        /* ISO TD expired - retire the TD to the Done Queue and continue with
+           the next ISO TD of the same ED */
+        dprintf("usb-ohci: ISO_TD R=%d > FC=%d\n", relative_frame_number, 
+               frame_count);
+        OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_DATAOVERRUN);
+        ed->head &= ~OHCI_DPTR_MASK;
+        ed->head |= (iso_td.next & OHCI_DPTR_MASK);
+        iso_td.next = ohci->done;
+        ohci->done = addr;
+        i = OHCI_BM(iso_td.flags, TD_DI);
+        if (i < ohci->done_count)
+            ohci->done_count = i;
+        ohci_put_iso_td(addr, &iso_td);        
+        return 0;
+    }
+
+    dir = OHCI_BM(ed->flags, ED_D);
+    switch (dir) {
+    case OHCI_TD_DIR_IN:
+        str = "in";
+        pid = USB_TOKEN_IN;
+        break;
+    case OHCI_TD_DIR_OUT:
+        str = "out";
+        pid = USB_TOKEN_OUT;
+        break;
+    case OHCI_TD_DIR_SETUP:
+        str = "setup";
+        pid = USB_TOKEN_SETUP;
+        break;
+    default:
+        printf("usb-ohci: Bad direction %d\n", dir);
+        return 1;
+    }
+
+    if (!iso_td.bp || !iso_td.be) {
+        printf("usb-ohci: ISO_TD bp 0x%.8x be 0x%.8x\n", iso_td.bp, iso_td.be);
+        return 1;
+    }
+
+    start_offset = iso_td.offset[relative_frame_number];
+    next_offset = iso_td.offset[relative_frame_number + 1];
+
+    if (!(OHCI_BM(start_offset, TD_PSW_CC) & 0xe) || 
+        ((relative_frame_number < frame_count) && 
+         !(OHCI_BM(next_offset, TD_PSW_CC) & 0xe))) {
+        printf("usb-ohci: ISO_TD cc != not accessed 0x%.8x 0x%.8x\n",
+               start_offset, next_offset);
+        return 1;
+    }
+
+    if ((relative_frame_number < frame_count) && (start_offset > next_offset)) {
+        printf("usb-ohci: ISO_TD start_offset=0x%.8x > next_offset=0x%.8x\n",
+                start_offset, next_offset);
+        return 1;
+    }
+
+    if ((start_offset & 0x1000) == 0) {
+        start_addr = (iso_td.bp & OHCI_PAGE_MASK) |
+            (start_offset & OHCI_OFFSET_MASK);
+    } else {
+        start_addr = (iso_td.be & OHCI_PAGE_MASK) |
+            (start_offset & OHCI_OFFSET_MASK);
+    }
+
+    if (relative_frame_number < frame_count) {
+        end_offset = next_offset - 1;
+        if ((end_offset & 0x1000) == 0) {
+            end_addr = (iso_td.bp & OHCI_PAGE_MASK) |
+                (end_offset & OHCI_OFFSET_MASK);
+        } else {
+            end_addr = (iso_td.be & OHCI_PAGE_MASK) |
+                (end_offset & OHCI_OFFSET_MASK);
+        }
+    } else {
+        /* Last packet in the ISO TD */
+        end_addr = iso_td.be;
+    }
+
+    if ((start_addr & OHCI_PAGE_MASK) != (end_addr & OHCI_PAGE_MASK)) {
+        len = (end_addr & OHCI_OFFSET_MASK) + 0x1001
+            - (start_addr & OHCI_OFFSET_MASK);
+    } else {
+        len = end_addr - start_addr + 1;
+    }
+
+    if (len && dir != OHCI_TD_DIR_IN) {
+        ohci_copy_iso_td(start_addr, end_addr, ohci->usb_buf, len, 0);
+    }
+
+    if (completion) {
+        ret = ohci->usb_packet.len;
+    } else {
+        ret = USB_RET_NODEV;
+        for (i = 0; i < ohci->num_ports; i++) {
+            dev = ohci->rhport[i].port.dev;
+            if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0)
+                continue;
+            ohci->usb_packet.pid = pid;
+            ohci->usb_packet.devaddr = OHCI_BM(ed->flags, ED_FA);
+            ohci->usb_packet.devep = OHCI_BM(ed->flags, ED_EN);
+            ohci->usb_packet.data = ohci->usb_buf;
+            ohci->usb_packet.len = len;
+            ohci->usb_packet.complete_cb = ohci_async_complete_packet;
+            ohci->usb_packet.complete_opaque = ohci;
+            ret = dev->handle_packet(dev, &ohci->usb_packet);
+            if (ret != USB_RET_NODEV)
+                break;
+        }
+    
+        if (ret == USB_RET_ASYNC) {
+            return 1;
+        }
+    }
+
+#ifdef DEBUG_ISOCH
+    printf("so 0x%.8x eo 0x%.8x\nsa 0x%.8x ea 0x%.8x\ndir %s len %zu ret %d\n",
+           start_offset, end_offset, start_addr, end_addr, str, len, ret);
+#endif
+
+    /* Writeback */
+    if (dir == OHCI_TD_DIR_IN && ret >= 0 && ret <= len) {
+        /* IN transfer succeeded */
+        ohci_copy_iso_td(start_addr, end_addr, ohci->usb_buf, ret, 1);
+        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                    OHCI_CC_NOERROR);
+        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, ret);
+    } else if (dir == OHCI_TD_DIR_OUT && ret == len) {
+        /* OUT transfer succeeded */
+        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                    OHCI_CC_NOERROR);
+        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, 0);
+    } else {
+        if (ret > (ssize_t) len) {
+            printf("usb-ohci: DataOverrun %d > %zu\n", ret, len);
+            OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                        OHCI_CC_DATAOVERRUN);
+            OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
+                        len);
+        } else if (ret >= 0) {
+            printf("usb-ohci: DataUnderrun %d\n", ret);
+            OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                        OHCI_CC_DATAUNDERRUN);
+        } else {
+            switch (ret) {
+            case USB_RET_NODEV:
+                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                            OHCI_CC_DEVICENOTRESPONDING);
+                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
+                            0);
+                break;
+            case USB_RET_NAK:
+            case USB_RET_STALL:
+                printf("usb-ohci: got NAK/STALL %d\n", ret);
+                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                            OHCI_CC_STALL);
+                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
+                            0);
+                break;
+            default:
+                printf("usb-ohci: Bad device response %d\n", ret);
+                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
+                            OHCI_CC_UNDEXPETEDPID);
+                break;
+            }
+        }
+    }
+
+    if (relative_frame_number == frame_count) {
+        /* Last data packet of ISO TD - retire the TD to the Done Queue */
+        OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_NOERROR);
+        ed->head &= ~OHCI_DPTR_MASK;
+        ed->head |= (iso_td.next & OHCI_DPTR_MASK);
+        iso_td.next = ohci->done;
+        ohci->done = addr;
+        i = OHCI_BM(iso_td.flags, TD_DI);
+        if (i < ohci->done_count)
+            ohci->done_count = i;
+    }
+    ohci_put_iso_td(addr, &iso_td);
+    return 1;
+}
+
 /* Service a transport descriptor.
    Returns nonzero to terminate processing of this endpoint.  */
 
@@ -430,8 +800,7 @@ static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
 {
     int dir;
     size_t len = 0;
-    uint8_t buf[8192];
-    char *str = NULL;
+    const char *str = NULL;
     int pid;
     int ret;
     int i;
@@ -439,8 +808,17 @@ static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
     struct ohci_td td;
     uint32_t addr;
     int flag_r;
+    int completion;
 
     addr = ed->head & OHCI_DPTR_MASK;
+    /* See if this TD has already been submitted to the device.  */
+    completion = (addr == ohci->async_td);
+    if (completion && !ohci->async_complete) {
+#ifdef DEBUG_PACKET
+        dprintf("Skipping async TD\n");
+#endif
+        return 1;
+    }
     if (!ohci_read_td(addr, &td)) {
         fprintf(stderr, "usb-ohci: TD read error at %x\n", addr);
         return 0;
@@ -481,8 +859,8 @@ static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
             len = (td.be - td.cbp) + 1;
         }
 
-        if (len && dir != OHCI_TD_DIR_IN) {
-            ohci_copy_td(&td, buf, len, 0);
+        if (len && dir != OHCI_TD_DIR_IN && !completion) {
+            ohci_copy_td(&td, ohci->usb_buf, len, 0);
         }
     }
 
@@ -491,34 +869,61 @@ static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
     dprintf(" TD @ 0x%.8x %u bytes %s r=%d cbp=0x%.8x be=0x%.8x\n",
             addr, len, str, flag_r, td.cbp, td.be);
 
-    if (len >= 0 && dir != OHCI_TD_DIR_IN) {
+    if (len > 0 && dir != OHCI_TD_DIR_IN) {
         dprintf("  data:");
         for (i = 0; i < len; i++)
-            printf(" %.2x", buf[i]);
+            printf(" %.2x", ohci->usb_buf[i]);
         dprintf("\n");
     }
 #endif
-    ret = USB_RET_NODEV;
-    for (i = 0; i < ohci->num_ports; i++) {
-        dev = ohci->rhport[i].port.dev;
-        if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0)
-            continue;
-
-        ret = dev->handle_packet(dev, pid, OHCI_BM(ed->flags, ED_FA),
-                                 OHCI_BM(ed->flags, ED_EN), buf, len);
-        if (ret != USB_RET_NODEV)
-            break;
-    }
+    if (completion) {
+        ret = ohci->usb_packet.len;
+        ohci->async_td = 0;
+        ohci->async_complete = 0;
+    } else {
+        ret = USB_RET_NODEV;
+        for (i = 0; i < ohci->num_ports; i++) {
+            dev = ohci->rhport[i].port.dev;
+            if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0)
+                continue;
+
+            if (ohci->async_td) {
+                /* ??? The hardware should allow one active packet per
+                   endpoint.  We only allow one active packet per controller.
+                   This should be sufficient as long as devices respond in a
+                   timely manner.
+                 */
+#ifdef DEBUG_PACKET
+                dprintf("Too many pending packets\n");
+#endif
+                return 1;
+            }
+            ohci->usb_packet.pid = pid;
+            ohci->usb_packet.devaddr = OHCI_BM(ed->flags, ED_FA);
+            ohci->usb_packet.devep = OHCI_BM(ed->flags, ED_EN);
+            ohci->usb_packet.data = ohci->usb_buf;
+            ohci->usb_packet.len = len;
+            ohci->usb_packet.complete_cb = ohci_async_complete_packet;
+            ohci->usb_packet.complete_opaque = ohci;
+            ret = dev->handle_packet(dev, &ohci->usb_packet);
+            if (ret != USB_RET_NODEV)
+                break;
+        }
 #ifdef DEBUG_PACKET
-    dprintf("ret=%d\n", ret);
+        dprintf("ret=%d\n", ret);
 #endif
+        if (ret == USB_RET_ASYNC) {
+            ohci->async_td = addr;
+            return 1;
+        }
+    }
     if (ret >= 0) {
         if (dir == OHCI_TD_DIR_IN) {
-            ohci_copy_td(&td, buf, ret, 1);
+            ohci_copy_td(&td, ohci->usb_buf, ret, 1);
 #ifdef DEBUG_PACKET
             dprintf("  data:");
             for (i = 0; i < ret; i++)
-                printf(" %.2x", buf[i]);
+                printf(" %.2x", ohci->usb_buf[i]);
             dprintf("\n");
 #endif
         } else {
@@ -588,7 +993,7 @@ static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
 }
 
 /* Service an endpoint list.  Returns nonzero if active TD were found.  */
-static int ohci_service_ed_list(OHCIState *ohci, uint32_t head)
+static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion)
 {
     struct ohci_ed ed;
     uint32_t next_ed;
@@ -608,12 +1013,16 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head)
 
         next_ed = ed.next & OHCI_DPTR_MASK;
 
-        if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K))
+        if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) {
+            uint32_t addr;
+            /* Cancel pending packets for ED that have been paused.  */
+            addr = ed.head & OHCI_DPTR_MASK;
+            if (ohci->async_td && addr == ohci->async_td) {
+                usb_cancel_packet(&ohci->usb_packet);
+                ohci->async_td = 0;
+            }
             continue;
-
-        /* Skip isochronous endpoints.  */
-        if (ed.flags & OHCI_ED_F)
-          continue;
+        }
 
         while ((ed.head & OHCI_DPTR_MASK) != ed.tail) {
 #ifdef DEBUG_PACKET
@@ -628,8 +1037,14 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head)
 #endif
             active = 1;
 
-            if (ohci_service_td(ohci, &ed))
-                break;
+            if ((ed.flags & OHCI_ED_F) == 0) {
+                if (ohci_service_td(ohci, &ed))
+                    break;
+            } else {
+                /* Handle isochronous endpoints */
+                if (ohci_service_iso_td(ohci, &ed, completion))
+                    break;
+            }
         }
 
         ohci_put_ed(cur, &ed);
@@ -646,6 +1061,27 @@ static void ohci_sof(OHCIState *ohci)
     ohci_set_interrupt(ohci, OHCI_INTR_SF);
 }
 
+/* Process Control and Bulk lists.  */
+static void ohci_process_lists(OHCIState *ohci, int completion)
+{
+    if ((ohci->ctl & OHCI_CTL_CLE) && (ohci->status & OHCI_STATUS_CLF)) {
+        if (ohci->ctrl_cur && ohci->ctrl_cur != ohci->ctrl_head)
+          dprintf("usb-ohci: head %x, cur %x\n",
+                          ohci->ctrl_head, ohci->ctrl_cur);
+        if (!ohci_service_ed_list(ohci, ohci->ctrl_head, completion)) {
+            ohci->ctrl_cur = 0;
+            ohci->status &= ~OHCI_STATUS_CLF;
+        }
+    }
+
+    if ((ohci->ctl & OHCI_CTL_BLE) && (ohci->status & OHCI_STATUS_BLF)) {
+        if (!ohci_service_ed_list(ohci, ohci->bulk_head, completion)) {
+            ohci->bulk_cur = 0;
+            ohci->status &= ~OHCI_STATUS_BLF;
+        }
+    }
+}
+
 /* Do frame processing on frame boundary */
 static void ohci_frame_boundary(void *opaque)
 {
@@ -659,23 +1095,17 @@ static void ohci_frame_boundary(void *opaque)
         int n;
 
         n = ohci->frame_number & 0x1f;
-        ohci_service_ed_list(ohci, le32_to_cpu(hcca.intr[n]));
-    }
-    if ((ohci->ctl & OHCI_CTL_CLE) && (ohci->status & OHCI_STATUS_CLF)) {
-        if (ohci->ctrl_cur && ohci->ctrl_cur != ohci->ctrl_head)
-          dprintf("usb-ohci: head %x, cur %x\n", ohci->ctrl_head, ohci->ctrl_cur);
-        if (!ohci_service_ed_list(ohci, ohci->ctrl_head)) {
-            ohci->ctrl_cur = 0;
-            ohci->status &= ~OHCI_STATUS_CLF;
-        }
+        ohci_service_ed_list(ohci, le32_to_cpu(hcca.intr[n]), 0);
     }
 
-    if ((ohci->ctl & OHCI_CTL_BLE) && (ohci->status & OHCI_STATUS_BLF)) {
-        if (!ohci_service_ed_list(ohci, ohci->bulk_head)) {
-            ohci->bulk_cur = 0;
-            ohci->status &= ~OHCI_STATUS_BLF;
-        }
+    /* Cancel all pending packets if either of the lists has been disabled.  */
+    if (ohci->async_td &&
+        ohci->old_ctl & (~ohci->ctl) & (OHCI_CTL_BLE | OHCI_CTL_CLE)) {
+        usb_cancel_packet(&ohci->usb_packet);
+        ohci->async_td = 0;
     }
+    ohci->old_ctl = ohci->ctl;
+    ohci_process_lists(ohci, 0);
 
     /* Frame boundary, so do EOF stuf here */
     ohci->frt = ohci->fit;
@@ -715,13 +1145,12 @@ static int ohci_bus_start(OHCIState *ohci)
                     ohci);
 
     if (ohci->eof_timer == NULL) {
-        fprintf(stderr, "usb-ohci: %s: qemu_new_timer failed\n",
-            ohci->pci_dev.name);
+        fprintf(stderr, "usb-ohci: %s: qemu_new_timer failed\n", ohci->name);
         /* TODO: Signal unrecoverable error */
         return 0;
     }
 
-    dprintf("usb-ohci: %s: USB Operational\n", ohci->pci_dev.name);
+    dprintf("usb-ohci: %s: USB Operational\n", ohci->name);
 
     ohci_sof(ohci);
 
@@ -733,6 +1162,7 @@ static void ohci_bus_stop(OHCIState *ohci)
 {
     if (ohci->eof_timer)
         qemu_del_timer(ohci->eof_timer);
+    ohci->eof_timer = NULL;
 }
 
 /* Sets a flag in a port status register but only set it if the port is
@@ -774,7 +1204,7 @@ static void ohci_set_frame_interval(OHCIState *ohci, uint16_t val)
 
     if (val != ohci->fi) {
         dprintf("usb-ohci: %s: FrameInterval = 0x%x (%u)\n",
-            ohci->pci_dev.name, ohci->fi, ohci->fi);
+            ohci->name, ohci->fi, ohci->fi);
     }
 
     ohci->fi = val;
@@ -812,13 +1242,14 @@ static void ohci_set_ctl(OHCIState *ohci, uint32_t val)
         break;
     case OHCI_USB_SUSPEND:
         ohci_bus_stop(ohci);
-        dprintf("usb-ohci: %s: USB Suspended\n", ohci->pci_dev.name);
+        dprintf("usb-ohci: %s: USB Suspended\n", ohci->name);
         break;
     case OHCI_USB_RESUME:
-        dprintf("usb-ohci: %s: USB Resume\n", ohci->pci_dev.name);
+        dprintf("usb-ohci: %s: USB Resume\n", ohci->name);
         break;
     case OHCI_USB_RESET:
-        dprintf("usb-ohci: %s: USB Reset\n", ohci->pci_dev.name);
+        ohci_reset(ohci);
+        dprintf("usb-ohci: %s: USB Reset\n", ohci->name);
         break;
     }
 }
@@ -907,8 +1338,7 @@ static void ohci_port_set_status(OHCIState *ohci, int portnum, uint32_t val)
 
     if (ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PRS)) {
         dprintf("usb-ohci: port %d: RESET\n", portnum);
-        port->port.dev->handle_packet(port->port.dev, USB_MSG_RESET,
-                                      0, 0, NULL, 0);
+        usb_send_msg(port->port.dev, USB_MSG_RESET);
         port->ctrl &= ~OHCI_PORT_PRS;
         /* ??? Should this also set OHCI_PORT_PESC.  */
         port->ctrl |= OHCI_PORT_PES | OHCI_PORT_PRSC;
@@ -1007,6 +1437,19 @@ static uint32_t ohci_mem_read(void *ptr, target_phys_addr_t addr)
     case 20: /* HcRhStatus */
         return ohci->rhstatus;
 
+    /* PXA27x specific registers */
+    case 24: /* HcStatus */
+        return ohci->hstatus & ohci->hmask;
+
+    case 25: /* HcHReset */
+        return ohci->hreset;
+
+    case 26: /* HcHInterruptEnable */
+        return ohci->hmask;
+
+    case 27: /* HcHInterruptTest */
+        return ohci->htest;
+
     default:
         fprintf(stderr, "ohci_read: Bad offset %x\n", (int)addr);
         return 0xffffffff;
@@ -1088,6 +1531,9 @@ static void ohci_mem_write(void *ptr, target_phys_addr_t addr, uint32_t val)
         ohci_set_frame_interval(ohci, val);
         break;
 
+    case 15: /* HcFmNumber */
+        break;
+
     case 16: /* HcPeriodicStart */
         ohci->pstart = val & 0xffff;
         break;
@@ -1108,6 +1554,24 @@ static void ohci_mem_write(void *ptr, target_phys_addr_t addr, uint32_t val)
         ohci_set_hub_status(ohci, val);
         break;
 
+    /* PXA27x specific registers */
+    case 24: /* HcStatus */
+        ohci->hstatus &= ~(val & ohci->hmask);
+
+    case 25: /* HcHReset */
+        ohci->hreset = val & ~OHCI_HRESET_FSBIR;
+        if (val & OHCI_HRESET_FSBIR)
+            ohci_reset(ohci);
+        break;
+
+    case 26: /* HcHInterruptEnable */
+        ohci->hmask = val;
+        break;
+
+    case 27: /* HcHInterruptTest */
+        ohci->htest = val;
+        break;
+
     default:
         fprintf(stderr, "ohci_write: Bad offset %x\n", (int)addr);
         break;
@@ -1128,24 +1592,13 @@ static CPUWriteMemoryFunc *ohci_writefn[3]={
     ohci_mem_write
 };
 
-static void ohci_mapfunc(PCIDevice *pci_dev, int i,
-            uint32_t addr, uint32_t size, int type)
-{
-    OHCIState *ohci = (OHCIState *)pci_dev;
-    ohci->mem_base = addr;
-    cpu_register_physical_memory(addr, size, ohci->mem);
-}
-
-void usb_ohci_init(struct PCIBus *bus, int num_ports, int devfn)
+static void usb_ohci_init(OHCIState *ohci, int num_ports, int devfn,
+            qemu_irq irq, enum ohci_type type, const char *name)
 {
-    OHCIState *ohci;
-    int vid = 0x106b;
-    int did = 0x003f;
     int i;
 
-
     if (usb_frame_time == 0) {
-#if OHCI_TIME_WARP
+#ifdef OHCI_TIME_WARP
         usb_frame_time = ticks_per_sec;
         usb_bit_time = muldiv64(1, ticks_per_sec, USB_HZ/1000);
 #else
@@ -1160,8 +1613,43 @@ void usb_ohci_init(struct PCIBus *bus, int num_ports, int devfn)
                 usb_frame_time, usb_bit_time);
     }
 
-    ohci = (OHCIState *)pci_register_device(bus, "OHCI USB", sizeof(*ohci),
-                                            devfn, NULL, NULL);
+    ohci->mem = cpu_register_io_memory(0, ohci_readfn, ohci_writefn, ohci);
+    ohci->name = name;
+
+    ohci->irq = irq;
+    ohci->type = type;
+
+    ohci->num_ports = num_ports;
+    for (i = 0; i < num_ports; i++) {
+        qemu_register_usb_port(&ohci->rhport[i].port, ohci, i, ohci_attach);
+    }
+
+    ohci->async_td = 0;
+    qemu_register_reset(ohci_reset, ohci);
+    ohci_reset(ohci);
+}
+
+typedef struct {
+    PCIDevice pci_dev;
+    OHCIState state;
+} OHCIPCIState;
+
+static void ohci_mapfunc(PCIDevice *pci_dev, int i,
+            uint32_t addr, uint32_t size, int type)
+{
+    OHCIPCIState *ohci = (OHCIPCIState *)pci_dev;
+    ohci->state.mem_base = addr;
+    cpu_register_physical_memory(addr, size, ohci->state.mem);
+}
+
+void usb_ohci_init_pci(struct PCIBus *bus, int num_ports, int devfn)
+{
+    OHCIPCIState *ohci;
+    int vid = 0x106b;
+    int did = 0x003f;
+
+    ohci = (OHCIPCIState *)pci_register_device(bus, "OHCI USB", sizeof(*ohci),
+                                               devfn, NULL, NULL);
     if (ohci == NULL) {
         fprintf(stderr, "usb-ohci: Failed to register PCI device\n");
         return;
@@ -1176,15 +1664,21 @@ void usb_ohci_init(struct PCIBus *bus, int num_ports, int devfn)
     ohci->pci_dev.config[0x0b] = 0xc;
     ohci->pci_dev.config[0x3d] = 0x01; /* interrupt pin 1 */
 
-    ohci->mem = cpu_register_io_memory(0, ohci_readfn, ohci_writefn, ohci);
+    usb_ohci_init(&ohci->state, num_ports, devfn, ohci->pci_dev.irq[0],
+                  OHCI_TYPE_PCI, ohci->pci_dev.name);
 
     pci_register_io_region((struct PCIDevice *)ohci, 0, 256,
                            PCI_ADDRESS_SPACE_MEM, ohci_mapfunc);
+}
 
-    ohci->num_ports = num_ports;
-    for (i = 0; i < num_ports; i++) {
-        qemu_register_usb_port(&ohci->rhport[i].port, ohci, i, ohci_attach);
-    }
+void usb_ohci_init_pxa(target_phys_addr_t base, int num_ports, int devfn,
+                       qemu_irq irq)
+{
+    OHCIState *ohci = (OHCIState *)qemu_mallocz(sizeof(OHCIState));
 
-    ohci_reset(ohci);
+    usb_ohci_init(ohci, num_ports, devfn, irq,
+                  OHCI_TYPE_PXA, "OHCI USB");
+    ohci->mem_base = base;
+
+    cpu_register_physical_memory(ohci->mem_base, 0x1000, ohci->mem);
 }
diff --git a/hw/usb.c b/hw/usb.c
index a00d945..c17266d 100644
--- a/hw/usb.c
+++ b/hw/usb.c
@@ -2,7 +2,9 @@
  * QEMU USB emulation
  *
  * Copyright (c) 2005 Fabrice Bellard
- * 
+ *
+ * 2008 Generic packet handler rewrite by Max Krasnyansky
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -21,7 +23,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "usb.h"
 
 void usb_attach(USBPort *port, USBDevice *dev)
 {
@@ -29,153 +32,174 @@ void usb_attach(USBPort *port, USBDevice *dev)
 }
 
 /**********************/
+
 /* generic USB device helpers (you are not forced to use them when
    writing your USB device driver, but they help handling the
-   protocol) 
+   protocol)
 */
 
 #define SETUP_STATE_IDLE 0
 #define SETUP_STATE_DATA 1
 #define SETUP_STATE_ACK  2
 
-int usb_generic_handle_packet(USBDevice *s, int pid, 
-                              uint8_t devaddr, uint8_t devep,
-                              uint8_t *data, int len)
+static int do_token_setup(USBDevice *s, USBPacket *p)
+{
+    int request, value, index;
+    int ret = 0;
+
+    if (p->len != 8)
+        return USB_RET_STALL;
+ 
+    memcpy(s->setup_buf, p->data, 8);
+    s->setup_len   = (s->setup_buf[7] << 8) | s->setup_buf[6];
+    s->setup_index = 0;
+
+    request = (s->setup_buf[0] << 8) | s->setup_buf[1];
+    value   = (s->setup_buf[3] << 8) | s->setup_buf[2];
+    index   = (s->setup_buf[5] << 8) | s->setup_buf[4];
+ 
+    if (s->setup_buf[0] & USB_DIR_IN) {
+        ret = s->handle_control(s, request, value, index, 
+                                s->setup_len, s->data_buf);
+        if (ret < 0)
+            return ret;
+
+        if (ret < s->setup_len)
+            s->setup_len = ret;
+        s->setup_state = SETUP_STATE_DATA;
+    } else {
+        if (s->setup_len == 0)
+            s->setup_state = SETUP_STATE_ACK;
+        else
+            s->setup_state = SETUP_STATE_DATA;
+    }
+
+    return ret;
+}
+
+static int do_token_in(USBDevice *s, USBPacket *p)
+{
+    int request, value, index;
+    int ret = 0;
+
+    if (p->devep != 0)
+        return s->handle_data(s, p);
+
+    request = (s->setup_buf[0] << 8) | s->setup_buf[1];
+    value   = (s->setup_buf[3] << 8) | s->setup_buf[2];
+    index   = (s->setup_buf[5] << 8) | s->setup_buf[4];
+ 
+    switch(s->setup_state) {
+    case SETUP_STATE_ACK:
+        if (!(s->setup_buf[0] & USB_DIR_IN)) {
+            s->setup_state = SETUP_STATE_IDLE;
+            ret = s->handle_control(s, request, value, index,
+                                    s->setup_len, s->data_buf);
+            if (ret > 0)
+                return 0;
+            return ret;
+        }
+
+        /* return 0 byte */
+        return 0;
+
+    case SETUP_STATE_DATA:
+        if (s->setup_buf[0] & USB_DIR_IN) {
+            int len = s->setup_len - s->setup_index;
+            if (len > p->len)
+                len = p->len;
+            memcpy(p->data, s->data_buf + s->setup_index, len);
+            s->setup_index += len;
+            if (s->setup_index >= s->setup_len)
+                s->setup_state = SETUP_STATE_ACK;
+            return len;
+        }
+
+        s->setup_state = SETUP_STATE_IDLE;
+        return USB_RET_STALL;
+
+    default:
+        return USB_RET_STALL;
+    }
+}
+
+static int do_token_out(USBDevice *s, USBPacket *p)
 {
-    int l, ret = 0;
+    if (p->devep != 0)
+        return s->handle_data(s, p);
+
+    switch(s->setup_state) {
+    case SETUP_STATE_ACK:
+        if (s->setup_buf[0] & USB_DIR_IN) {
+            s->setup_state = SETUP_STATE_IDLE;
+            /* transfer OK */
+        } else {
+            /* ignore additional output */
+        }
+        return 0;
 
-    switch(pid) {
+    case SETUP_STATE_DATA:
+        if (!(s->setup_buf[0] & USB_DIR_IN)) {
+            int len = s->setup_len - s->setup_index;
+            if (len > p->len)
+                len = p->len;
+            memcpy(s->data_buf + s->setup_index, p->data, len);
+            s->setup_index += len;
+            if (s->setup_index >= s->setup_len)
+                s->setup_state = SETUP_STATE_ACK;
+            return len;
+        }
+
+        s->setup_state = SETUP_STATE_IDLE;
+        return USB_RET_STALL;
+
+    default:
+        return USB_RET_STALL;
+    }
+}
+
+/*
+ * Generic packet handler.
+ * Called by the HC (host controller).
+ *
+ * Returns length of the transaction or one of the USB_RET_XXX codes.
+ */
+int usb_generic_handle_packet(USBDevice *s, USBPacket *p)
+{
+    switch(p->pid) {
     case USB_MSG_ATTACH:
         s->state = USB_STATE_ATTACHED;
-        break;
+        return 0;
+
     case USB_MSG_DETACH:
         s->state = USB_STATE_NOTATTACHED;
-        break;
+        return 0;
+
     case USB_MSG_RESET:
         s->remote_wakeup = 0;
         s->addr = 0;
         s->state = USB_STATE_DEFAULT;
-        s->handle_reset(s, 0);
-        break;
-    case USB_MSG_DESTROY:
-        s->handle_reset(s, 1);
-        break;
+        s->handle_reset(s);
+        return 0;
+    }
+
+    /* Rest of the PIDs must match our address */
+    if (s->state < USB_STATE_DEFAULT || p->devaddr != s->addr)
+        return USB_RET_NODEV;
+
+    switch (p->pid) {
     case USB_TOKEN_SETUP:
-        if (s->state < USB_STATE_DEFAULT || devaddr != s->addr)
-            return USB_RET_NODEV;
-        if (len != 8)
-            goto fail;
-        memcpy(s->setup_buf, data, 8);
-        s->setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6];
-        s->setup_index = 0;
-        if (s->setup_buf[0] & USB_DIR_IN) {
-            ret = s->handle_control(s, 
-                                    (s->setup_buf[0] << 8) | s->setup_buf[1],
-                                    (s->setup_buf[3] << 8) | s->setup_buf[2],
-                                    (s->setup_buf[5] << 8) | s->setup_buf[4],
-                                    s->setup_len,
-                                    s->data_buf);
-            if (ret < 0)
-                return ret;
-            if (ret < s->setup_len)
-                s->setup_len = ret;
-            s->setup_state = SETUP_STATE_DATA;
-        } else {
-            if (s->setup_len == 0)
-                s->setup_state = SETUP_STATE_ACK;
-            else
-                s->setup_state = SETUP_STATE_DATA;
-        }
-        break;
+        return do_token_setup(s, p);
+
     case USB_TOKEN_IN:
-        if (s->state < USB_STATE_DEFAULT || devaddr != s->addr)
-            return USB_RET_NODEV;
-        switch(devep) {
-        case 0:
-            switch(s->setup_state) {
-            case SETUP_STATE_ACK:
-                if (!(s->setup_buf[0] & USB_DIR_IN)) {
-                    s->setup_state = SETUP_STATE_IDLE;
-                    ret = s->handle_control(s, 
-                                      (s->setup_buf[0] << 8) | s->setup_buf[1],
-                                      (s->setup_buf[3] << 8) | s->setup_buf[2],
-                                      (s->setup_buf[5] << 8) | s->setup_buf[4],
-                                      s->setup_len,
-                                      s->data_buf);
-                    if (ret > 0)
-                        ret = 0;
-                } else {
-                    /* return 0 byte */
-                }
-                break;
-            case SETUP_STATE_DATA:
-                if (s->setup_buf[0] & USB_DIR_IN) {
-                    l = s->setup_len - s->setup_index;
-                    if (l > len)
-                        l = len;
-                    memcpy(data, s->data_buf + s->setup_index, l);
-                    s->setup_index += l;
-                    if (s->setup_index >= s->setup_len)
-                        s->setup_state = SETUP_STATE_ACK;
-                    ret = l;
-                } else {
-                    s->setup_state = SETUP_STATE_IDLE;
-                    goto fail;
-                }
-                break;
-            default:
-                goto fail;
-            }
-            break;
-        default:
-            ret = s->handle_data(s, pid, devep, data, len);
-            break;
-        }
-        break;
+        return do_token_in(s, p);
+
     case USB_TOKEN_OUT:
-        if (s->state < USB_STATE_DEFAULT || devaddr != s->addr)
-            return USB_RET_NODEV;
-        switch(devep) {
-        case 0:
-            switch(s->setup_state) {
-            case SETUP_STATE_ACK:
-                if (s->setup_buf[0] & USB_DIR_IN) {
-                    s->setup_state = SETUP_STATE_IDLE;
-                    /* transfer OK */
-                } else {
-                    /* ignore additionnal output */
-                }
-                break;
-            case SETUP_STATE_DATA:
-                if (!(s->setup_buf[0] & USB_DIR_IN)) {
-                    l = s->setup_len - s->setup_index;
-                    if (l > len)
-                        l = len;
-                    memcpy(s->data_buf + s->setup_index, data, l);
-                    s->setup_index += l;
-                    if (s->setup_index >= s->setup_len)
-                        s->setup_state = SETUP_STATE_ACK;
-                    ret = l;
-                } else {
-                    s->setup_state = SETUP_STATE_IDLE;
-                    goto fail;
-                }
-                break;
-            default:
-                goto fail;
-            }
-            break;
-        default:
-            ret = s->handle_data(s, pid, devep, data, len);
-            break;
-        }
-        break;
+        return do_token_out(s, p);
+ 
     default:
-    fail:
-        ret = USB_RET_STALL;
-        break;
+        return USB_RET_STALL;
     }
-    return ret;
 }
 
 /* XXX: fix overflow */
@@ -194,3 +218,14 @@ int set_usb_string(uint8_t *buf, const char *str)
     }
     return q - buf;
 }
+
+/* Send an internal message to a USB device.  */
+void usb_send_msg(USBDevice *dev, int msg)
+{
+    USBPacket p;
+    memset(&p, 0, sizeof(p));
+    p.pid = msg;
+    dev->handle_packet(dev, &p);
+
+    /* This _must_ be synchronous */
+}
diff --git a/hw/usb.h b/hw/usb.h
index b0887d6..1a353bb 100644
--- a/hw/usb.h
+++ b/hw/usb.h
@@ -1,8 +1,8 @@
 /*
  * QEMU USB API
- * 
+ *
  * Copyright (c) 2005 Fabrice Bellard
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -29,12 +29,12 @@
 #define USB_MSG_ATTACH   0x100
 #define USB_MSG_DETACH   0x101
 #define USB_MSG_RESET    0x102
-#define USB_MSG_DESTROY  0x103
 
-#define USB_RET_NODEV  (-1) 
+#define USB_RET_NODEV  (-1)
 #define USB_RET_NAK    (-2)
 #define USB_RET_STALL  (-3)
 #define USB_RET_BABBLE (-4)
+#define USB_RET_ASYNC  (-5)
 
 #define USB_SPEED_LOW   0
 #define USB_SPEED_FULL  1
@@ -108,28 +108,64 @@
 #define USB_DT_INTERFACE		0x04
 #define USB_DT_ENDPOINT			0x05
 
+#define USB_ENDPOINT_XFER_CONTROL	0
+#define USB_ENDPOINT_XFER_ISOC		1
+#define USB_ENDPOINT_XFER_BULK		2
+#define USB_ENDPOINT_XFER_INT		3
+
 typedef struct USBPort USBPort;
 typedef struct USBDevice USBDevice;
+typedef struct USBPacket USBPacket;
 
 /* definition of a USB device */
 struct USBDevice {
     void *opaque;
-    int (*handle_packet)(USBDevice *dev, int pid, 
-                         uint8_t devaddr, uint8_t devep,
-                         uint8_t *data, int len);
+
+    /* 
+     * Process USB packet. 
+     * Called by the HC (Host Controller).
+     *
+     * Returns length of the transaction 
+     * or one of the USB_RET_XXX codes.
+     */ 
+    int (*handle_packet)(USBDevice *dev, USBPacket *p);
+
+    /* 
+     * Called when device is destroyed.
+     */
+    void (*handle_destroy)(USBDevice *dev);
+
     int speed;
-    
+
     /* The following fields are used by the generic USB device
-       layer. They are here just to avoid creating a new structure for
-       them. */
-    void (*handle_reset)(USBDevice *dev, int destroy);
+       layer. They are here just to avoid creating a new structure 
+       for them. */
+
+    /*
+     * Reset the device
+     */  
+    void (*handle_reset)(USBDevice *dev);
+
+    /*
+     * Process control request.
+     * Called from handle_packet().
+     *
+     * Returns length or one of the USB_RET_ codes.
+     */
     int (*handle_control)(USBDevice *dev, int request, int value,
                           int index, int length, uint8_t *data);
-    int (*handle_data)(USBDevice *dev, int pid, uint8_t devep,
-                       uint8_t *data, int len);
+
+    /*
+     * Process data transfers (both BULK and ISOC).
+     * Called from handle_packet().
+     *
+     * Returns length or one of the USB_RET_ codes.
+     */
+    int (*handle_data)(USBDevice *dev, USBPacket *p);
+
     uint8_t addr;
     char devname[32];
-    
+
     int state;
     uint8_t setup_buf[8];
     uint8_t data_buf[1024];
@@ -150,28 +186,106 @@ struct USBPort {
     struct USBPort *next; /* Used internally by qemu.  */
 };
 
+typedef void USBCallback(USBPacket * packet, void *opaque);
+
+/* Structure used to hold information about an active USB packet.  */
+struct USBPacket {
+    /* Data fields for use by the driver.  */
+    int pid;
+    uint8_t devaddr;
+    uint8_t devep;
+    uint8_t *data;
+    int len;
+    /* Internal use by the USB layer.  */
+    USBCallback *complete_cb;
+    void *complete_opaque;
+    USBCallback *cancel_cb;
+    void *cancel_opaque;
+};
+
+/* Defer completion of a USB packet.  The hadle_packet routine should then
+   return USB_RET_ASYNC.  Packets that complete immediately (before
+   handle_packet returns) should not call this method.  */
+static inline void usb_defer_packet(USBPacket *p, USBCallback *cancel,
+                                    void * opaque)
+{
+    p->cancel_cb = cancel;
+    p->cancel_opaque = opaque;
+}
+
+/* Notify the controller that an async packet is complete.  This should only
+   be called for packets previously deferred with usb_defer_packet, and
+   should never be called from within handle_packet.  */
+static inline void usb_packet_complete(USBPacket *p)
+{
+    p->complete_cb(p, p->complete_opaque);
+}
+
+/* Cancel an active packet.  The packed must have been deferred with
+   usb_defer_packet,  and not yet completed.  */
+static inline void usb_cancel_packet(USBPacket * p)
+{
+    p->cancel_cb(p, p->cancel_opaque);
+}
+
+int usb_device_add_dev(USBDevice *dev);
+int usb_device_del_addr(int bus_num, int addr);
 void usb_attach(USBPort *port, USBDevice *dev);
-int usb_generic_handle_packet(USBDevice *s, int pid, 
-                              uint8_t devaddr, uint8_t devep,
-                              uint8_t *data, int len);
+int usb_generic_handle_packet(USBDevice *s, USBPacket *p);
 int set_usb_string(uint8_t *buf, const char *str);
+void usb_send_msg(USBDevice *dev, int msg);
 
 /* usb hub */
 USBDevice *usb_hub_init(int nb_ports);
 
-/* usb-uhci.c */
-void usb_uhci_init(PCIBus *bus, int devfn);
-
-/* usb-ohci.c */
-void usb_ohci_init(struct PCIBus *bus, int num_ports, int devfn);
-
 /* usb-linux.c */
 USBDevice *usb_host_device_open(const char *devname);
+int usb_host_device_close(const char *devname);
 void usb_host_info(void);
 
 /* usb-hid.c */
 USBDevice *usb_mouse_init(void);
 USBDevice *usb_tablet_init(void);
+USBDevice *usb_keyboard_init(void);
 
 /* usb-msd.c */
 USBDevice *usb_msd_init(const char *filename);
+
+/* usb-net.c */
+USBDevice *usb_net_init(NICInfo *nd);
+
+/* usb-wacom.c */
+USBDevice *usb_wacom_init(void);
+
+/* usb-serial.c */
+USBDevice *usb_serial_init(const char *filename);
+
+/* usb ports of the VM */
+
+void qemu_register_usb_port(USBPort *port, void *opaque, int index,
+                            usb_attachfn attach);
+
+#define VM_USB_HUB_SIZE 8
+
+/* usb-musb.c */
+enum musb_irq_source_e {
+    musb_irq_suspend = 0,
+    musb_irq_resume,
+    musb_irq_rst_babble,
+    musb_irq_sof,
+    musb_irq_connect,
+    musb_irq_disconnect,
+    musb_irq_vbus_request,
+    musb_irq_vbus_error,
+    musb_irq_rx,
+    musb_irq_tx,
+    musb_set_vbus,
+    musb_set_session,
+    __musb_irq_max,
+};
+
+struct musb_s;
+struct musb_s *musb_init(qemu_irq *irqs);
+uint32_t musb_core_intr_get(struct musb_s *s);
+void musb_core_intr_clear(struct musb_s *s, uint32_t mask);
+void musb_set_size(struct musb_s *s, int epnum, int size, int is_tx);
diff --git a/i386-dis.c b/i386-dis.c
index 0496e14..7b44179 100644
--- a/i386-dis.c
+++ b/i386-dis.c
@@ -37,6 +37,7 @@ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
 
 #include <stdlib.h>
 #include "dis-asm.h"
+#include "qemu-common.h"
 
 #define MAXLEN 20
 
@@ -59,7 +60,8 @@ static int putop PARAMS ((const char *, int));
 static void oappend PARAMS ((const char *));
 static void append_seg PARAMS ((void));
 static void OP_indirE PARAMS ((int, int));
-static void print_operand_value PARAMS ((char *, int, bfd_vma));
+static void print_operand_value (char *buf, size_t bufsize, int hex,
+                                 bfd_vma disp);
 static void OP_E PARAMS ((int, int));
 static void OP_G PARAMS ((int, int));
 static bfd_vma get64 PARAMS ((void));
@@ -1838,29 +1840,6 @@ static char close_char;
 static char separator_char;
 static char scale_char;
 
-/* Here for backwards compatibility.  When gdb stops using
-   print_insn_i386_att and print_insn_i386_intel these functions can
-   disappear, and print_insn_i386 be merged into print_insn.  */
-int
-print_insn_i386_att (pc, info)
-     bfd_vma pc;
-     disassemble_info *info;
-{
-  intel_syntax = 0;
-
-  return print_insn (pc, info);
-}
-
-int
-print_insn_i386_intel (pc, info)
-     bfd_vma pc;
-     disassemble_info *info;
-{
-  intel_syntax = 1;
-
-  return print_insn (pc, info);
-}
-
 int
 print_insn_i386 (pc, info)
      bfd_vma pc;
@@ -2455,7 +2434,7 @@ static const struct dis386 float_reg[][8] = {
   },
 };
 
-static char *fgrps[][8] = {
+static const char *fgrps[][8] = {
   /* d9_2  0 */
   {
     "fnop","(bad)","(bad)","(bad)","(bad)","(bad)","(bad)","(bad)",
@@ -2535,7 +2514,7 @@ dofloat (sizeflag)
 
       /* Instruction fnstsw is only one with strange arg.  */
       if (floatop == 0xdf && codep[-1] == 0xe0)
-	strcpy (op1out, names16[0]);
+        pstrcpy (op1out, sizeof(op1out), names16[0]);
     }
   else
     {
@@ -2563,7 +2542,7 @@ OP_STi (bytemode, sizeflag)
      int bytemode;
      int sizeflag;
 {
-  sprintf (scratchbuf, "%%st(%d)", rm);
+  snprintf (scratchbuf, sizeof(scratchbuf), "%%st(%d)", rm);
   oappend (scratchbuf + intel_syntax);
 }
 
@@ -2596,7 +2575,7 @@ putop (template, sizeflag)
 		  if (*p == '}')
 		    {
 		      /* Alternative not valid.  */
-		      strcpy (obuf, "(bad)");
+                      pstrcpy (obuf, sizeof(obuf), "(bad)");
 		      obufp = obuf + 5;
 		      return 1;
 		    }
@@ -2897,10 +2876,7 @@ OP_indirE (bytemode, sizeflag)
 }
 
 static void
-print_operand_value (buf, hex, disp)
-  char *buf;
-  int hex;
-  bfd_vma disp;
+print_operand_value (char *buf, size_t bufsize, int hex, bfd_vma disp)
 {
   if (mode_64bit)
     {
@@ -2910,9 +2886,9 @@ print_operand_value (buf, hex, disp)
 	  int i;
 	  buf[0] = '0';
 	  buf[1] = 'x';
-	  sprintf_vma (tmp, disp);
+          snprintf_vma (tmp, sizeof(tmp), disp);
 	  for (i = 0; tmp[i] == '0' && tmp[i + 1]; i++);
-	  strcpy (buf + 2, tmp + i);
+          pstrcpy (buf + 2, bufsize - 2, tmp + i);
 	}
       else
 	{
@@ -2926,13 +2902,13 @@ print_operand_value (buf, hex, disp)
 	      /* Check for possible overflow on 0x8000000000000000.  */
 	      if (v < 0)
 		{
-		  strcpy (buf, "9223372036854775808");
+                  pstrcpy (buf, bufsize, "9223372036854775808");
 		  return;
 		}
 	    }
 	  if (!v)
 	    {
-	      strcpy (buf, "0");
+                pstrcpy (buf, bufsize, "0");
 	      return;
 	    }
 
@@ -2944,15 +2920,15 @@ print_operand_value (buf, hex, disp)
 	      v /= 10;
 	      i++;
 	    }
-	  strcpy (buf, tmp + 29 - i);
+          pstrcpy (buf, bufsize, tmp + 29 - i);
 	}
     }
   else
     {
       if (hex)
-	sprintf (buf, "0x%x", (unsigned int) disp);
+        snprintf (buf, bufsize, "0x%x", (unsigned int) disp);
       else
-	sprintf (buf, "%d", (int) disp);
+        snprintf (buf, bufsize, "%d", (int) disp);
     }
 }
 
@@ -3077,7 +3053,7 @@ OP_E (bytemode, sizeflag)
       if (!intel_syntax)
         if (mod != 0 || (base & 7) == 5)
           {
-	    print_operand_value (scratchbuf, !riprel, disp);
+            print_operand_value (scratchbuf, sizeof(scratchbuf), !riprel, disp);
             oappend (scratchbuf);
 	    if (riprel)
 	      {
@@ -3138,14 +3114,14 @@ OP_E (bytemode, sizeflag)
                           *obufp++ = separator_char;
                           *obufp = '\0';
                         }
-                      sprintf (scratchbuf, "%s",
-			       mode_64bit && (sizeflag & AFLAG)
-			       ? names64[index] : names32[index]);
+                      snprintf (scratchbuf, sizeof(scratchbuf), "%s",
+                                mode_64bit && (sizeflag & AFLAG)
+                                ? names64[index] : names32[index]);
                     }
                   else
-		    sprintf (scratchbuf, ",%s",
-			     mode_64bit && (sizeflag & AFLAG)
-			     ? names64[index] : names32[index]);
+                      snprintf (scratchbuf, sizeof(scratchbuf), ",%s",
+                                mode_64bit && (sizeflag & AFLAG)
+                                ? names64[index] : names32[index]);
 		  oappend (scratchbuf);
 		}
               if (!intel_syntax
@@ -3156,7 +3132,7 @@ OP_E (bytemode, sizeflag)
                 {
                   *obufp++ = scale_char;
                   *obufp = '\0';
-	          sprintf (scratchbuf, "%d", 1 << scale);
+                  snprintf (scratchbuf, sizeof(scratchbuf), "%d", 1 << scale);
 	          oappend (scratchbuf);
                 }
 	    }
@@ -3172,7 +3148,8 @@ OP_E (bytemode, sizeflag)
 			*obufp = '\0';
 		      }
 
-		    print_operand_value (scratchbuf, 0, disp);
+                    print_operand_value (scratchbuf, sizeof(scratchbuf), 0,
+                                         disp);
                     oappend (scratchbuf);
                   }
               }
@@ -3192,7 +3169,7 @@ OP_E (bytemode, sizeflag)
 		  oappend (names_seg[ds_reg - es_reg]);
 		  oappend (":");
 		}
-	      print_operand_value (scratchbuf, 1, disp);
+              print_operand_value (scratchbuf, sizeof(scratchbuf), 1, disp);
               oappend (scratchbuf);
             }
         }
@@ -3225,7 +3202,7 @@ OP_E (bytemode, sizeflag)
       if (!intel_syntax)
         if (mod != 0 || (rm & 7) == 6)
           {
-	    print_operand_value (scratchbuf, 0, disp);
+            print_operand_value (scratchbuf, sizeof(scratchbuf), 0, disp);
             oappend (scratchbuf);
           }
 
@@ -3527,7 +3504,7 @@ OP_I (bytemode, sizeflag)
 
   op &= mask;
   scratchbuf[0] = '$';
-  print_operand_value (scratchbuf + 1, 1, op);
+  print_operand_value (scratchbuf + 1, sizeof(scratchbuf) - 1, 1, op);
   oappend (scratchbuf + intel_syntax);
   scratchbuf[0] = '\0';
 }
@@ -3580,7 +3557,7 @@ OP_I64 (bytemode, sizeflag)
 
   op &= mask;
   scratchbuf[0] = '$';
-  print_operand_value (scratchbuf + 1, 1, op);
+  print_operand_value (scratchbuf + 1, sizeof(scratchbuf) - 1, 1, op);
   oappend (scratchbuf + intel_syntax);
   scratchbuf[0] = '\0';
 }
@@ -3632,7 +3609,7 @@ OP_sI (bytemode, sizeflag)
     }
 
   scratchbuf[0] = '$';
-  print_operand_value (scratchbuf + 1, 1, op);
+  print_operand_value (scratchbuf + 1, sizeof(scratchbuf) - 1, 1, op);
   oappend (scratchbuf + intel_syntax);
 }
 
@@ -3670,7 +3647,7 @@ OP_J (bytemode, sizeflag)
     }
   disp = (start_pc + codep - start_codep + disp) & mask;
   set_op (disp, 0);
-  print_operand_value (scratchbuf, 1, disp);
+  print_operand_value (scratchbuf, sizeof(scratchbuf), 1, disp);
   oappend (scratchbuf);
 }
 
@@ -3701,9 +3678,9 @@ OP_DIR (dummy, sizeflag)
     }
   used_prefixes |= (prefixes & PREFIX_DATA);
   if (intel_syntax)
-    sprintf (scratchbuf, "0x%x,0x%x", seg, offset);
+    snprintf (scratchbuf, sizeof(scratchbuf), "0x%x,0x%x", seg, offset);
   else
-    sprintf (scratchbuf, "$0x%x,$0x%x", seg, offset);
+    snprintf (scratchbuf, sizeof(scratchbuf), "$0x%x,$0x%x", seg, offset);
   oappend (scratchbuf);
 }
 
@@ -3730,7 +3707,7 @@ OP_OFF (bytemode, sizeflag)
 	  oappend (":");
 	}
     }
-  print_operand_value (scratchbuf, 1, off);
+  print_operand_value (scratchbuf, sizeof(scratchbuf), 1, off);
   oappend (scratchbuf);
 }
 
@@ -3760,7 +3737,7 @@ OP_OFF64 (bytemode, sizeflag)
 	  oappend (":");
 	}
     }
-  print_operand_value (scratchbuf, 1, off);
+  print_operand_value (scratchbuf, sizeof(scratchbuf), 1, off);
   oappend (scratchbuf);
 }
 
@@ -3829,7 +3806,7 @@ OP_C (dummy, sizeflag)
   USED_REX (REX_EXTX);
   if (rex & REX_EXTX)
     add = 8;
-  sprintf (scratchbuf, "%%cr%d", reg + add);
+  snprintf (scratchbuf, sizeof(scratchbuf), "%%cr%d", reg + add);
   oappend (scratchbuf + intel_syntax);
 }
 
@@ -3843,9 +3820,9 @@ OP_D (dummy, sizeflag)
   if (rex & REX_EXTX)
     add = 8;
   if (intel_syntax)
-    sprintf (scratchbuf, "db%d", reg + add);
+    snprintf (scratchbuf, sizeof(scratchbuf), "db%d", reg + add);
   else
-    sprintf (scratchbuf, "%%db%d", reg + add);
+    snprintf (scratchbuf, sizeof(scratchbuf), "%%db%d", reg + add);
   oappend (scratchbuf);
 }
 
@@ -3854,7 +3831,7 @@ OP_T (dummy, sizeflag)
      int dummy;
      int sizeflag;
 {
-  sprintf (scratchbuf, "%%tr%d", reg);
+  snprintf (scratchbuf, sizeof(scratchbuf), "%%tr%d", reg);
   oappend (scratchbuf + intel_syntax);
 }
 
@@ -3880,9 +3857,9 @@ OP_MMX (bytemode, sizeflag)
     add = 8;
   used_prefixes |= (prefixes & PREFIX_DATA);
   if (prefixes & PREFIX_DATA)
-    sprintf (scratchbuf, "%%xmm%d", reg + add);
+    snprintf (scratchbuf, sizeof(scratchbuf), "%%xmm%d", reg + add);
   else
-    sprintf (scratchbuf, "%%mm%d", reg + add);
+    snprintf (scratchbuf, sizeof(scratchbuf), "%%mm%d", reg + add);
   oappend (scratchbuf + intel_syntax);
 }
 
@@ -3895,7 +3872,7 @@ OP_XMM (bytemode, sizeflag)
   USED_REX (REX_EXTX);
   if (rex & REX_EXTX)
     add = 8;
-  sprintf (scratchbuf, "%%xmm%d", reg + add);
+  snprintf (scratchbuf, sizeof(scratchbuf), "%%xmm%d", reg + add);
   oappend (scratchbuf + intel_syntax);
 }
 
@@ -3919,9 +3896,9 @@ OP_EM (bytemode, sizeflag)
   codep++;
   used_prefixes |= (prefixes & PREFIX_DATA);
   if (prefixes & PREFIX_DATA)
-    sprintf (scratchbuf, "%%xmm%d", rm + add);
+    snprintf (scratchbuf, sizeof(scratchbuf), "%%xmm%d", rm + add);
   else
-    sprintf (scratchbuf, "%%mm%d", rm + add);
+    snprintf (scratchbuf, sizeof(scratchbuf), "%%mm%d", rm + add);
   oappend (scratchbuf + intel_syntax);
 }
 
@@ -3943,7 +3920,7 @@ OP_EX (bytemode, sizeflag)
   /* Skip mod/rm byte.  */
   MODRM_CHECK;
   codep++;
-  sprintf (scratchbuf, "%%xmm%d", rm + add);
+  snprintf (scratchbuf, sizeof(scratchbuf), "%%xmm%d", rm + add);
   oappend (scratchbuf + intel_syntax);
 }
 
@@ -4102,8 +4079,8 @@ OP_SIMD_Suffix (bytemode, sizeflag)
 		suffix1 = 's', suffix2 = 'd';
 	    }
 	}
-      sprintf (scratchbuf, "cmp%s%c%c",
-	       simd_cmp_op[cmp_type], suffix1, suffix2);
+      snprintf (scratchbuf, sizeof(scratchbuf), "cmp%s%c%c",
+                simd_cmp_op[cmp_type], suffix1, suffix2);
       used_prefixes |= (prefixes & PREFIX_REPZ);
       oappend (scratchbuf);
     }
diff --git a/i386.ld b/i386.ld
index d41c626..9f4cb5b 100644
--- a/i386.ld
+++ b/i386.ld
@@ -69,6 +69,8 @@ SECTIONS
   /* Adjust the address for the data segment.  We want to adjust up to
      the same address within the page on the next page up.  */
   . = ALIGN(0x100000) + (. & (0x100000 - 1));
+  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
+  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
   .data    :
   {
     *(.data)
diff --git a/keymaps.c b/keymaps.c
index bd89328..15c40fa 100644
--- a/keymaps.c
+++ b/keymaps.c
@@ -1,8 +1,8 @@
 /*
  * QEMU keysym to keycode conversion using rdesktop keymaps
- * 
+ *
  * Copyright (c) 2004 Johannes Schindelin
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -32,6 +32,12 @@ static int get_keysym(const char *name)
     return 0;
 }
 
+struct key_range {
+    int start;
+    int end;
+    struct key_range *next;
+};
+
 #define MAX_NORMAL_KEYCODE 512
 #define MAX_EXTRA_COUNT 256
 typedef struct {
@@ -41,8 +47,34 @@ typedef struct {
 	uint16_t keycode;
     } keysym2keycode_extra[MAX_EXTRA_COUNT];
     int extra_count;
+    struct key_range *keypad_range;
+    struct key_range *numlock_range;
 } kbd_layout_t;
 
+static void add_to_key_range(struct key_range **krp, int code) {
+    struct key_range *kr;
+    for (kr = *krp; kr; kr = kr->next) {
+	if (code >= kr->start && code <= kr->end)
+	    break;
+	if (code == kr->start - 1) {
+	    kr->start--;
+	    break;
+	}
+	if (code == kr->end + 1) {
+	    kr->end++;
+	    break;
+	}
+    }
+    if (kr == NULL) {
+	kr = qemu_mallocz(sizeof(*kr));
+	if (kr) {
+	    kr->start = kr->end = code;
+	    kr->next = *krp;
+	    *krp = kr;
+	}
+    }
+}
+
 static kbd_layout_t *parse_keyboard_layout(const char *language,
 					   kbd_layout_t * k)
 {
@@ -87,7 +119,15 @@ static kbd_layout_t *parse_keyboard_layout(const char *language,
                     //		    fprintf(stderr, "Warning: unknown keysym %s\n", line);
 		} else {
 		    const char *rest = end_of_keysym + 1;
-		    int keycode = strtol(rest, NULL, 0);
+		    char *rest2;
+		    int keycode = strtol(rest, &rest2, 0);
+
+		    if (rest && strstr(rest, "numlock")) {
+			add_to_key_range(&k->keypad_range, keycode);
+			add_to_key_range(&k->numlock_range, keysym);
+			//fprintf(stderr, "keypad keysym %04x keycode %d\n", keysym, keycode);
+		    }
+
 		    /* if(keycode&0x80)
 		       keycode=(keycode<<8)^0x80e0; */
 		    if (keysym < MAX_NORMAL_KEYCODE) {
@@ -143,3 +183,25 @@ static int keysym2scancode(void *kbd_layout, int keysym)
     }
     return 0;
 }
+
+static inline int keycode_is_keypad(void *kbd_layout, int keycode)
+{
+    kbd_layout_t *k = kbd_layout;
+    struct key_range *kr;
+
+    for (kr = k->keypad_range; kr; kr = kr->next)
+        if (keycode >= kr->start && keycode <= kr->end)
+            return 1;
+    return 0;
+}
+
+static inline int keysym_is_numlock(void *kbd_layout, int keysym)
+{
+    kbd_layout_t *k = kbd_layout;
+    struct key_range *kr;
+
+    for (kr = k->numlock_range; kr; kr = kr->next)
+        if (keysym >= kr->start && keysym <= kr->end)
+            return 1;
+    return 0;
+}
diff --git a/keymaps/ar b/keymaps/ar
deleted file mode 100644
index c430c03..0000000
--- a/keymaps/ar
+++ /dev/null
@@ -1,98 +0,0 @@
-# generated from XKB map ar
-include common
-map 0x401
-exclam 0x02 shift
-at 0x03 shift
-numbersign 0x04 shift
-dollar 0x05 shift
-percent 0x06 shift
-asciicircum 0x07 shift
-ampersand 0x08 shift
-asterisk 0x09 shift
-parenleft 0x0a shift
-parenright 0x0b shift
-minus 0x0c
-underscore 0x0c shift
-equal 0x0d
-plus 0x0d shift
-Arabic_dad 0x10 altgr
-Arabic_fatha 0x10 shift altgr
-Arabic_sad 0x11 altgr
-Arabic_fathatan 0x11 shift altgr
-Arabic_theh 0x12 altgr
-Arabic_damma 0x12 shift altgr
-Arabic_qaf 0x13 altgr
-Arabic_dammatan 0x13 shift altgr
-Arabic_feh 0x14 altgr
-UFEF9 0x14 shift altgr
-Arabic_ghain 0x15 altgr
-Arabic_hamzaunderalef 0x15 shift altgr
-Arabic_ain 0x16 altgr
-grave 0x16 shift altgr
-Arabic_ha 0x17 altgr
-division 0x17 shift altgr
-Arabic_khah 0x18 altgr
-multiply 0x18 shift altgr
-Arabic_hah 0x19 altgr
-Arabic_semicolon 0x19 shift altgr
-bracketleft 0x1a
-braceleft 0x1a shift
-Arabic_jeem 0x1a altgr
-bracketright 0x1b
-braceright 0x1b shift
-Arabic_dal 0x1b altgr
-Arabic_sheen 0x1e altgr
-backslash 0x1e shift altgr
-Arabic_seen 0x1f altgr
-Arabic_yeh 0x20 altgr
-bracketleft 0x20 shift altgr
-Arabic_beh 0x21 altgr
-bracketright 0x21 shift altgr
-Arabic_lam 0x22 altgr
-UFEF7 0x22 shift altgr
-Arabic_alef 0x23 altgr
-Arabic_hamzaonalef 0x23 shift altgr
-Arabic_teh 0x24 altgr
-Arabic_tatweel 0x24 shift altgr
-Arabic_noon 0x25 altgr
-Arabic_comma 0x25 shift altgr
-Arabic_meem 0x26 altgr
-slash 0x26 shift altgr
-semicolon 0x27
-colon 0x27 shift
-Arabic_kaf 0x27 altgr
-apostrophe 0x28
-quotedbl 0x28 shift
-Arabic_tah 0x28 altgr
-grave 0x29
-asciitilde 0x29 shift
-Arabic_thal 0x29 altgr
-Arabic_shadda 0x29 shift altgr
-backslash 0x2b
-bar 0x2b shift
-less 0x2b altgr
-greater 0x2b shift altgr
-Arabic_hamzaonyeh 0x2c altgr
-asciitilde 0x2c shift altgr
-Arabic_hamza 0x2d altgr
-Arabic_sukun 0x2d shift altgr
-Arabic_hamzaonwaw 0x2e altgr
-Arabic_kasra 0x2e shift altgr
-Arabic_ra 0x2f altgr
-Arabic_kasratan 0x2f shift altgr
-UFEFB 0x30 altgr
-UFEF5 0x30 shift altgr
-Arabic_alefmaksura 0x31 altgr
-Arabic_maddaonalef 0x31 shift altgr
-Arabic_tehmarbuta 0x32 altgr
-apostrophe 0x32 shift altgr
-comma 0x33
-less 0x33 shift
-Arabic_waw 0x33 altgr
-period 0x34
-greater 0x34 shift
-Arabic_zain 0x34 altgr
-slash 0x35
-question 0x35 shift
-Arabic_zah 0x35 altgr
-Arabic_question_mark 0x35 shift altgr
diff --git a/keymaps/common b/keymaps/common
deleted file mode 100644
index 0b53f1c..0000000
--- a/keymaps/common
+++ /dev/null
@@ -1,157 +0,0 @@
-include modifiers
-
-#
-# Top row
-#
-1 0x2
-2 0x3
-3 0x4
-4 0x5
-5 0x6
-6 0x7
-7 0x8
-8 0x9
-9 0xa
-0 0xb
-BackSpace 0xe
-
-#
-# QWERTY first row
-#
-Tab 0xf localstate
-ISO_Left_Tab 0xf shift
-q 0x10 addupper
-w 0x11 addupper
-e 0x12 addupper
-r 0x13 addupper
-t 0x14 addupper
-y 0x15 addupper
-u 0x16 addupper
-i 0x17 addupper
-o 0x18 addupper
-p 0x19 addupper
-
-#
-# QWERTY second row
-#
-a 0x1e addupper
-s 0x1f addupper
-d 0x20 addupper
-f 0x21 addupper
-g 0x22 addupper
-h 0x23 addupper
-j 0x24 addupper
-k 0x25 addupper
-l 0x26 addupper
-Return 0x1c localstate
-
-#
-# QWERTY third row
-#
-z 0x2c addupper
-x 0x2d addupper
-c 0x2e addupper
-v 0x2f addupper
-b 0x30 addupper
-n 0x31 addupper
-m 0x32 addupper
-
-space 0x39 localstate
-
-less 0x56
-greater 0x56 shift
-bar 0x56 altgr
-brokenbar 0x56 shift altgr
-
-#
-# Esc and Function keys
-#
-Escape 0x1 localstate
-F1 0x3b localstate
-F2 0x3c localstate
-F3 0x3d localstate
-F4 0x3e localstate
-F5 0x3f localstate
-F6 0x40 localstate
-F7 0x41 localstate
-F8 0x42 localstate
-F9 0x43 localstate
-F10 0x44 localstate
-F11 0x57 localstate
-F12 0x58 localstate
-
-# Printscreen, Scrollock and Pause
-# Printscreen really requires four scancodes (0xe0, 0x2a, 0xe0, 0x37),
-# but (0xe0, 0x37) seems to work. 
-Print 0xb7 localstate
-Sys_Req 0xb7 localstate
-Execute 0xb7 localstate
-Scroll_Lock 0x46
-
-#
-# Insert - PgDown
-#
-Insert 0xd2 localstate
-Delete 0xd3 localstate
-Home 0xc7 localstate
-End 0xcf localstate
-Page_Up 0xc9 localstate
-Page_Down 0xd1 localstate
-
-#
-# Arrow keys
-#
-Left 0xcb localstate
-Up 0xc8 localstate
-Down 0xd0 localstate
-Right 0xcd localstate
-
-#
-# Numpad
-#
-Num_Lock 0x45
-KP_Divide 0xb5
-KP_Multiply 0x37
-KP_Subtract 0x4a
-KP_Add 0x4e
-KP_Enter 0x9c
-
-KP_Decimal 0x53 numlock
-KP_Separator 0x53 numlock
-KP_Delete 0x53
-
-KP_0 0x52 numlock
-KP_Insert 0x52
-
-KP_1 0x4f numlock
-KP_End 0x4f
-
-KP_2 0x50 numlock
-KP_Down 0x50
-
-KP_3 0x51 numlock
-KP_Next 0x51
-
-KP_4 0x4b numlock
-KP_Left 0x4b
-
-KP_5 0x4c numlock
-KP_Begin 0x4c
-
-KP_6 0x4d numlock
-KP_Right 0x4d
-
-KP_7 0x47 numlock
-KP_Home 0x47
-
-KP_8 0x48 numlock
-KP_Up 0x48
-
-KP_9 0x49 numlock
-KP_Prior 0x49
-
-Caps_Lock 0x3a
-#
-# Inhibited keys
-#
-Multi_key 0x0 inhibit
diff --git a/keymaps/da b/keymaps/da
deleted file mode 100644
index 3884dcf..0000000
--- a/keymaps/da
+++ /dev/null
@@ -1,120 +0,0 @@
-# generated from XKB map dk
-include common
-map 0x406
-exclam 0x02 shift
-exclamdown 0x02 altgr
-onesuperior 0x02 shift altgr
-quotedbl 0x03 shift
-at 0x03 altgr
-twosuperior 0x03 shift altgr
-numbersign 0x04 shift
-sterling 0x04 altgr
-threesuperior 0x04 shift altgr
-currency 0x05 shift
-dollar 0x05 altgr
-onequarter 0x05 shift altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-cent 0x06 shift altgr
-ampersand 0x07 shift
-yen 0x07 altgr
-fiveeighths 0x07 shift altgr
-slash 0x08 shift
-braceleft 0x08 altgr
-division 0x08 shift altgr
-parenleft 0x09 shift
-bracketleft 0x09 altgr
-guillemotleft 0x09 shift altgr
-parenright 0x0a shift
-bracketright 0x0a altgr
-guillemotright 0x0a shift altgr
-equal 0x0b shift
-braceright 0x0b altgr
-degree 0x0b shift altgr
-plus 0x0c
-question 0x0c shift
-plusminus 0x0c altgr
-questiondown 0x0c shift altgr
-dead_acute 0x0d
-dead_grave 0x0d shift
-bar 0x0d altgr
-brokenbar 0x0d shift altgr
-Greek_OMEGA 0x10 shift altgr
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-EuroSign 0x12 altgr
-cent 0x12 shift altgr
-registered 0x13 altgr
-thorn 0x14 altgr
-THORN 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oe 0x18 altgr
-OE 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-aring 0x1a
-Aring 0x1a shift
-dead_diaeresis 0x1a altgr
-dead_abovering 0x1a shift altgr
-dead_diaeresis 0x1b
-dead_circumflex 0x1b shift
-dead_tilde 0x1b altgr
-dead_caron 0x1b shift altgr
-ordfeminine 0x1e altgr
-masculine 0x1e shift altgr
-ssharp 0x1f altgr
-section 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-ae 0x27
-AE 0x27 shift
-oslash 0x28
-Ooblique 0x28 shift
-dead_caron 0x28 shift altgr
-onehalf 0x29
-section 0x29 shift
-threequarters 0x29 altgr
-paragraph 0x29 shift altgr
-apostrophe 0x2b
-asterisk 0x2b shift
-dead_doubleacute 0x2b altgr
-multiply 0x2b shift altgr
-guillemotleft 0x2c altgr
-guillemotright 0x2d altgr
-copyright 0x2e altgr
-leftdoublequotemark 0x2f altgr
-grave 0x2f shift altgr
-rightdoublequotemark 0x30 altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-semicolon 0x33 shift
-dead_cedilla 0x33 altgr
-dead_ogonek 0x33 shift altgr
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-dead_abovedot 0x34 shift altgr
-minus 0x35
-underscore 0x35 shift
-hyphen 0x35 altgr
-macron 0x35 shift altgr
-nobreakspace 0x39 altgr
-less 0x56
-greater 0x56 shift
-backslash 0x56 altgr
-notsign 0x56 shift altgr
diff --git a/keymaps/de b/keymaps/de
deleted file mode 100644
index ed929c7..0000000
--- a/keymaps/de
+++ /dev/null
@@ -1,114 +0,0 @@
-# generated from XKB map de
-include common
-map 0x407
-exclam 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-quotedbl 0x03 shift
-twosuperior 0x03 altgr
-oneeighth 0x03 shift altgr
-section 0x04 shift
-threesuperior 0x04 altgr
-sterling 0x04 shift altgr
-dollar 0x05 shift
-onequarter 0x05 altgr
-currency 0x05 shift altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-ampersand 0x07 shift
-threequarters 0x07 altgr
-fiveeighths 0x07 shift altgr
-slash 0x08 shift
-braceleft 0x08 altgr
-seveneighths 0x08 shift altgr
-parenleft 0x09 shift
-bracketleft 0x09 altgr
-trademark 0x09 shift altgr
-parenright 0x0a shift
-bracketright 0x0a altgr
-plusminus 0x0a shift altgr
-equal 0x0b shift
-braceright 0x0b altgr
-ssharp 0x0c
-question 0x0c shift
-backslash 0x0c altgr
-questiondown 0x0c shift altgr
-acute 0x0d
-dead_acute 0x0d
-grave 0x0d shift
-dead_grave 0x0d shift
-dead_cedilla 0x0d altgr
-dead_ogonek 0x0d shift altgr
-at 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-EuroSign 0x12 altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-z 0x15 addupper
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-udiaeresis 0x1a
-Udiaeresis 0x1a shift
-dead_diaeresis 0x1a altgr
-dead_abovering 0x1a shift altgr
-plus 0x1b
-asterisk 0x1b shift
-asciitilde 0x1b altgr
-dead_tilde 0x1b altgr
-dead_macron 0x1b shift altgr
-ae 0x1e altgr
-AE 0x1e shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-odiaeresis 0x27
-Odiaeresis 0x27 shift
-dead_doubleacute 0x27 altgr
-adiaeresis 0x28
-Adiaeresis 0x28 shift
-dead_caron 0x28 shift altgr
-asciicircum 0x29
-dead_circumflex 0x29
-degree 0x29 shift
-notsign 0x29 altgr
-numbersign 0x2b
-apostrophe 0x2b shift
-dead_breve 0x2b shift altgr
-y 0x2c addupper
-guillemotleft 0x2c altgr
-guillemotright 0x2d altgr
-cent 0x2e altgr
-copyright 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-rightdoublequotemark 0x30 altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-semicolon 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-minus 0x35
-underscore 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
diff --git a/keymaps/de-ch b/keymaps/de-ch
deleted file mode 100644
index f83837b..0000000
--- a/keymaps/de-ch
+++ /dev/null
@@ -1,169 +0,0 @@
-# rdesktop Swiss-German (de-ch) keymap file 
-# 2003-06-03 by noldi@tristar.ch 
-#
-include common
-map 0x00000807
-#
-# Scan Code 1
-section 0x29
-degree 0x29 shift
-notsign 0x29 altgr inhibit
-#
-# Scan Code 2
-plus 0x2 shift
-brokenbar 0x02 altgr
-#
-# Scan Code 3
-quotedbl 0x03 shift
-at 0x03 altgr
-#
-# Scan Code 4
-asterisk 0x04 shift
-numbersign 0x04 altgr
-#
-# Scan Code 5
-ccedilla 0x05 shift
-onequarter 0x05 altgr inhibit
-#
-# Scan Code 6
-percent 0x06 shift
-onehalf 0x06 altgr inhibit
-#
-# Scan Code 7
-ampersand 0x07 shift
-notsign 0x07 altgr
-#
-# Scan Code 8
-slash 0x08 shift
-bar 0x08 altgr
-#
-# Scan Code 9
-parenleft 0x09 shift
-cent 0x09 altgr
-# 
-# Scan Code 10
-parenright 0x0a shift
-#
-# Scan Code 11
-equal 0x0b shift
-braceright 0x0b altgr inhibit
-#
-# Scan Code 12
-apostrophe 0x0c 
-question 0x0c shift
-dead_acute 0x0c altgr
-#
-# Scan Code 13
-dead_circumflex 0x0d
-dead_grave 0x0d shift
-dead_tilde 0x0d altgr
-#
-# Scan Code 19
-EuroSign 0x12 altgr
-#
-# Scan Code 22
-z 0x15 addupper
-#
-# Scan Code 27
-udiaeresis 0x1a
-egrave 0x1a shift
-bracketleft 0x1a altgr
-# 
-# Scan Code 28
-dead_diaeresis 0x1b
-exclam 0x1b shift 
-bracketright 0x1b altgr
-#
-# Scan Code 40
-odiaeresis 0x27
-eacute 0x27 shift
-#
-# Scan Code 41
-adiaeresis 0x28
-agrave 0x28 shift
-braceleft 0x28 altgr
-#
-# Scan Code 42 (only on international keyboards)
-dollar 0x2b
-sterling 0x2b shift
-braceright 0x2b altgr
-#
-# Scan Code 45 (only on international keyboards)
-backslash 0x56 altgr
-#
-# Scan Code 46
-y 0x2c addupper
-# 
-# Scan Code 53
-comma 0x33
-semicolon 0x33 shift
-# 
-# Scan Code 54
-period 0x34
-colon 0x34 shift
-#
-# Scan Code 55
-minus 0x35 
-underscore 0x35 shift
-#
-# Suppress Windows unsupported AltGr keys
-#
-# Scan Code 17
-paragraph 0x10 altgr inhibit
-#
-# Scan Code 21
-tslash 0x14 altgr inhibit
-#
-# Scan Code 22
-leftarrow 0x15 altgr inhibit
-#
-# Scan Code 23
-downarrow 0x16 altgr inhibit
-#
-# Scan Code 24
-rightarrow 0x17 altgr inhibit
-#
-# Scan Code 25
-oslash 0x18 altgr inhibit
-#
-# Scan Code 26
-thorn 0x19 altgr inhibit
-#
-# Scan Code 31
-ae 0x1e altgr inhibit
-#
-# Scan Code 32
-ssharp 0x1f altgr inhibit
-#
-# Scan Code 33
-eth 0x20 altgr inhibit
-#
-# Scan Code 34
-dstroke 0x21 altgr inhibit
-#
-# Scan Code 35
-eng 0x22 altgr inhibit
-#
-# Scan Code 36
-hstroke 0x23 altgr inhibit
-#
-# Scan Code 38
-kra 0x25 altgr inhibit
-#
-# Scan Code 39
-lstroke 0x26 altgr inhibit
-#
-# Scan Code 46
-guillemotleft 0x2c altgr inhibit
-#
-# Scan Code 47
-guillemotright 0x2d altgr inhibit
-#
-# Scan Code 49
-leftdoublequotemark 0x2f altgr inhibit
-#
-# Scan Code 50
-rightdoublequotemark 0x30 altgr inhibit
-#
-# Scan Code 52
-mu 0x32 altgr inhibit
diff --git a/keymaps/en-gb b/keymaps/en-gb
deleted file mode 100644
index b45f06c..0000000
--- a/keymaps/en-gb
+++ /dev/null
@@ -1,119 +0,0 @@
-# generated from XKB map gb
-include common
-map 0x809
-exclam 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-quotedbl 0x03 shift
-twosuperior 0x03 altgr
-oneeighth 0x03 shift altgr
-sterling 0x04 shift
-threesuperior 0x04 altgr
-dollar 0x05 shift
-EuroSign 0x05 altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-asciicircum 0x07 shift
-threequarters 0x07 altgr
-fiveeighths 0x07 shift altgr
-ampersand 0x08 shift
-braceleft 0x08 altgr
-seveneighths 0x08 shift altgr
-asterisk 0x09 shift
-bracketleft 0x09 altgr
-trademark 0x09 shift altgr
-parenleft 0x0a shift
-bracketright 0x0a altgr
-plusminus 0x0a shift altgr
-parenright 0x0b shift
-braceright 0x0b altgr
-degree 0x0b shift altgr
-minus 0x0c
-underscore 0x0c shift
-backslash 0x0c altgr
-questiondown 0x0c shift altgr
-equal 0x0d
-plus 0x0d shift
-dead_cedilla 0x0d altgr
-dead_ogonek 0x0d shift altgr
-at 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-bracketleft 0x1a
-braceleft 0x1a shift
-dead_diaeresis 0x1a altgr
-dead_abovering 0x1a shift altgr
-bracketright 0x1b
-braceright 0x1b shift
-dead_tilde 0x1b altgr
-dead_macron 0x1b shift altgr
-ae 0x1e altgr
-AE 0x1e shift altgr
-ssharp 0x1f altgr
-section 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-semicolon 0x27
-colon 0x27 shift
-dead_acute 0x27 altgr
-dead_doubleacute 0x27 shift altgr
-apostrophe 0x28
-at 0x28 shift
-dead_circumflex 0x28 altgr
-dead_caron 0x28 shift altgr
-grave 0x29
-notsign 0x29 shift
-bar 0x29 altgr
-numbersign 0x2b
-asciitilde 0x2b shift
-dead_grave 0x2b altgr
-dead_breve 0x2b shift altgr
-guillemotleft 0x2c altgr
-less 0x2c shift altgr
-guillemotright 0x2d altgr
-greater 0x2d shift altgr
-cent 0x2e altgr
-copyright 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-rightdoublequotemark 0x30 altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-less 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-period 0x34
-greater 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-slash 0x35
-question 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
-backslash 0x56
-bar 0x56 shift
diff --git a/keymaps/en-us b/keymaps/en-us
deleted file mode 100644
index f5784bb..0000000
--- a/keymaps/en-us
+++ /dev/null
@@ -1,35 +0,0 @@
-# generated from XKB map us
-include common
-map 0x409
-exclam 0x02 shift
-at 0x03 shift
-numbersign 0x04 shift
-dollar 0x05 shift
-percent 0x06 shift
-asciicircum 0x07 shift
-ampersand 0x08 shift
-asterisk 0x09 shift
-parenleft 0x0a shift
-parenright 0x0b shift
-minus 0x0c
-underscore 0x0c shift
-equal 0x0d
-plus 0x0d shift
-bracketleft 0x1a
-braceleft 0x1a shift
-bracketright 0x1b
-braceright 0x1b shift
-semicolon 0x27
-colon 0x27 shift
-apostrophe 0x28
-quotedbl 0x28 shift
-grave 0x29
-asciitilde 0x29 shift
-backslash 0x2b
-bar 0x2b shift
-comma 0x33
-less 0x33 shift
-period 0x34
-greater 0x34 shift
-slash 0x35
-question 0x35 shift
diff --git a/keymaps/es b/keymaps/es
deleted file mode 100644
index 0c29eec..0000000
--- a/keymaps/es
+++ /dev/null
@@ -1,105 +0,0 @@
-# generated from XKB map es
-include common
-map 0x40a
-exclam 0x02 shift
-bar 0x02 altgr
-quotedbl 0x03 shift
-at 0x03 altgr
-oneeighth 0x03 shift altgr
-periodcentered 0x04 shift
-numbersign 0x04 altgr
-sterling 0x04 shift altgr
-dollar 0x05 shift
-asciitilde 0x05 altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-ampersand 0x07 shift
-notsign 0x07 altgr
-fiveeighths 0x07 shift altgr
-slash 0x08 shift
-seveneighths 0x08 shift altgr
-parenleft 0x09 shift
-trademark 0x09 shift altgr
-parenright 0x0a shift
-plusminus 0x0a shift altgr
-equal 0x0b shift
-degree 0x0b shift altgr
-apostrophe 0x0c
-question 0x0c shift
-exclamdown 0x0d
-questiondown 0x0d shift
-Greek_OMEGA 0x10 shift altgr
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-EuroSign 0x12 altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-dead_grave 0x1a
-dead_circumflex 0x1a shift
-bracketleft 0x1a altgr
-dead_abovering 0x1a shift altgr
-plus 0x1b
-asterisk 0x1b shift
-bracketright 0x1b altgr
-dead_macron 0x1b shift altgr
-ae 0x1e altgr
-AE 0x1e shift altgr
-ssharp 0x1f altgr
-section 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-ntilde 0x27
-Ntilde 0x27 shift
-dead_doubleacute 0x27 shift altgr
-dead_acute 0x28
-dead_diaeresis 0x28 shift
-braceleft 0x28 altgr
-masculine 0x29
-ordfeminine 0x29 shift
-backslash 0x29 altgr
-ccedilla 0x2b
-Ccedilla 0x2b shift
-braceright 0x2b altgr
-dead_breve 0x2b shift altgr
-guillemotleft 0x2c altgr
-less 0x56
-greater 0x56 shift
-guillemotright 0x2d altgr
-cent 0x2e altgr
-copyright 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-grave 0x2f shift altgr
-rightdoublequotemark 0x30 altgr
-mu 0x32 altgr
-comma 0x33
-semicolon 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-period 0x34
-colon 0x34 shift
-division 0x34 shift altgr
-minus 0x35
-underscore 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
diff --git a/keymaps/et b/keymaps/et
deleted file mode 100644
index b5a73fe..0000000
--- a/keymaps/et
+++ /dev/null
@@ -1,86 +0,0 @@
-map 0x00000425
-include common
-
-#
-# Top row
-#
-dead_caron 0x29
-dead_tilde 0x29 shift
-
-# 1
-exclam 0x2 shift
-
-# 2
-quotedbl 0x3 shift
-at 0x3 altgr
-
-# 3
-numbersign 0x4 shift
-sterling 0x4 altgr
-# 4
-currency 0x5 shift
-dollar 0x5 altgr
-# 5
-percent 0x6 shift
-# 6
-ampersand 0x7 shift
-# 7
-slash 0x8 shift
-braceleft 0x8 altgr
-# 8
-parenleft 0x9 shift
-bracketleft 0x9 altgr
-# 9
-parenright 0xa shift
-bracketright 0xa altgr
-# 0
-equal 0xb shift
-braceright 0xb altgr
-
-plus 0xc
-question 0xc shift
-backslash 0xc altgr
-
-acute 0xd
-dead_acute 0xd
-grave 0xd shift
-dead_grave 0xd shift
-
-#
-# QWERTY first row
-#
-EuroSign 0x12 altgr
-udiaeresis 0x1a 
-Udiaeresis 0x1a shift
-otilde 0x1b 
-Otilde 0x1b shift
-section 0x1b altgr
-
-#
-# QWERTY second row
-#
-scaron 0x1f altgr
-Scaron 0x1f altgr shift
-odiaeresis 0x27 
-Odiaeresis 0x27 shift
-adiaeresis 0x28 
-Adiaeresis 0x28 shift
-asciicircum 0x28 altgr
-apostrophe 0x2b
-asterisk 0x2b shift
-onehalf 0x2b altgr
-#
-# QWERTY third row
-#
-less 0x56 
-greater 0x56 shift
-bar 0x56 altgr
-zcaron 0x2c altgr
-Zcaron 0x2c altgr shift
-comma 0x33
-semicolon 0x33 shift
-period 0x34
-colon 0x34 shift
-minus 0x35
-underscore 0x35 shift
-
diff --git a/keymaps/fi b/keymaps/fi
deleted file mode 100644
index 2a4e0f0..0000000
--- a/keymaps/fi
+++ /dev/null
@@ -1,124 +0,0 @@
-# generated from XKB map se_FI
-include common
-map 0x40b
-exclam 0x02 shift
-exclamdown 0x02 altgr
-onesuperior 0x02 shift altgr
-quotedbl 0x03 shift
-at 0x03 altgr
-twosuperior 0x03 shift altgr
-numbersign 0x04 shift
-sterling 0x04 altgr
-threesuperior 0x04 shift altgr
-currency 0x05 shift
-dollar 0x05 altgr
-onequarter 0x05 shift altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-cent 0x06 shift altgr
-ampersand 0x07 shift
-yen 0x07 altgr
-fiveeighths 0x07 shift altgr
-slash 0x08 shift
-braceleft 0x08 altgr
-division 0x08 shift altgr
-parenleft 0x09 shift
-bracketleft 0x09 altgr
-guillemotleft 0x09 shift altgr
-parenright 0x0a shift
-bracketright 0x0a altgr
-guillemotright 0x0a shift altgr
-equal 0x0b shift
-braceright 0x0b altgr
-degree 0x0b shift altgr
-plus 0x0c
-question 0x0c shift
-backslash 0x0c altgr
-questiondown 0x0c shift altgr
-dead_acute 0x0d
-dead_grave 0x0d shift
-plusminus 0x0d altgr
-notsign 0x0d shift altgr
-at 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-EuroSign 0x12 altgr
-cent 0x12 shift altgr
-registered 0x13 altgr
-thorn 0x14 altgr
-THORN 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oe 0x18 altgr
-OE 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-aring 0x1a
-Aring 0x1a shift
-dead_diaeresis 0x1a altgr
-dead_abovering 0x1a shift altgr
-dead_diaeresis 0x1b
-dead_circumflex 0x1b shift
-dead_tilde 0x1b altgr
-dead_caron 0x1b shift altgr
-ordfeminine 0x1e altgr
-masculine 0x1e shift altgr
-ssharp 0x1f altgr
-section 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-ampersand 0x25 shift altgr
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-odiaeresis 0x27
-Odiaeresis 0x27 shift
-oslash 0x27 altgr
-Ooblique 0x27 shift altgr
-adiaeresis 0x28
-Adiaeresis 0x28 shift
-ae 0x28 altgr
-AE 0x28 shift altgr
-section 0x29
-onehalf 0x29 shift
-paragraph 0x29 altgr
-threequarters 0x29 shift altgr
-apostrophe 0x2b
-asterisk 0x2b shift
-acute 0x2b altgr
-multiply 0x2b shift altgr
-guillemotleft 0x2c altgr
-less 0x2c shift altgr
-guillemotright 0x2d altgr
-greater 0x2d shift altgr
-copyright 0x2e altgr
-leftdoublequotemark 0x2f altgr
-grave 0x2f shift altgr
-rightdoublequotemark 0x30 altgr
-apostrophe 0x30 shift altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-semicolon 0x33 shift
-dead_cedilla 0x33 altgr
-dead_ogonek 0x33 shift altgr
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-dead_abovedot 0x34 shift altgr
-minus 0x35
-underscore 0x35 shift
-hyphen 0x35 altgr
-macron 0x35 shift altgr
-nobreakspace 0x39 altgr
diff --git a/keymaps/fo b/keymaps/fo
deleted file mode 100644
index 83add42..0000000
--- a/keymaps/fo
+++ /dev/null
@@ -1,77 +0,0 @@
-map 0x438
-include common
-
-#
-# Top row
-#
-onehalf 0x29
-section 0x29 shift
-
-# 1
-exclam 0x2 shift
-
-# 2
-quotedbl 0x3 shift
-at 0x3 altgr
-
-# 3
-numbersign 0x4 shift
-sterling 0x4 altgr
-# 4
-currency 0x5 shift
-dollar 0x5 altgr
-# 5
-percent 0x6 shift
-# 6
-ampersand 0x7 shift
-# 7
-slash 0x8 shift
-braceleft 0x8 altgr
-# 8
-parenleft 0x9 shift
-bracketleft 0x9 altgr
-# 9
-parenright 0xa shift
-bracketright 0xa altgr
-# 0
-equal 0xb shift
-braceright 0xb altgr
-
-plus 0xc
-question 0xc shift
-plusminus 0xc altgr
-
-bar 0xd altgr
-dead_acute 0xd
-
-#
-# QWERTY first row
-#
-EuroSign 0x12 altgr
-aring 0x1a
-Aring 0x1a shift
-eth 0x1b addupper
-asciitilde 0x1b altgr
-
-#
-# QWERTY second row
-#
-ae 0x27 addupper
-oslash 0x28
-Ooblique 0x28 shift
-apostrophe 0x2b
-asterisk 0x2b shift
-
-#
-# QWERTY third row
-#
-less 0x56
-greater 0x56 shift
-backslash 0x56 altgr
-comma 0x33
-semicolon 0x33 shift
-period 0x34
-colon 0x34 shift
-minus 0x35
-underscore 0x35 shift
-
diff --git a/keymaps/fr b/keymaps/fr
deleted file mode 100644
index cbb4591..0000000
--- a/keymaps/fr
+++ /dev/null
@@ -1,181 +0,0 @@
-include common
-map 0x40c
-#
-# Top row
-#
-twosuperior 0x29
-notsign 0x29 altgr
-
-ampersand 0x02
-1 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-
-eacute 0x03
-2 0x03 shift
-asciitilde 0x03 altgr
-oneeighth 0x03 shift altgr
-
-quotedbl 0x04
-3 0x04 shift
-numbersign 0x04 altgr
-
-apostrophe 0x05
-4 0x05 shift
-braceleft 0x05 altgr
-
-parenleft 0x06
-5 0x06 shift
-bracketleft 0x06 altgr
-threeeighths 0x06 shift altgr
-
-minus 0x07
-6 0x07 shift
-bar 0x07 altgr
-fiveeighths 0x07 shift altgr
-
-egrave 0x08
-7 0x08 shift
-grave 0x08 altgr
-seveneighths 0x08 shift altgr
-
-underscore 0x09
-8 0x09 shift
-backslash 0x09 altgr
-trademark 0x09 shift altgr
-
-ccedilla 0x0a
-9 0x0a shift
-asciicircum 0x0a altgr
-plusminus 0x0a shift altgr
-
-agrave 0x0b
-0 0x0b shift
-at 0x0b altgr
-
-parenright 0x0c
-degree 0x0c shift
-bracketright 0x0c altgr
-questiondown 0x0c shift altgr
-
-equal 0x0d
-plus 0x0d shift
-braceright 0x0d altgr
-dead_ogonek 0x0d shift altgr
-
-#
-# AZERTY first row
-#
-
-a 0x10 addupper
-ae 0x10 altgr
-AE 0x10 shift altgr
-
-z 0x11 addupper
-guillemotleft 0x11 altgr
-
-EuroSign 0x12 altgr
-
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-
-dead_circumflex 0x1a 
-dead_diaeresis 0x1a shift
-dead_abovering 0x1a shift altgr
-
-dollar 0x1b
-sterling 0x1b shift
-currency 0x1b altgr
-dead_macron 0x1b shift altgr
-
-#
-# AZERTY second row
-#
-q 0x1e addupper
-Greek_OMEGA 0x1e shift altgr
-
-ssharp 0x1f altgr
-
-eth 0x20 altgr
-ETH 0x20 shift altgr
-
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-
-eng 0x22 altgr
-ENG 0x22 shift altgr
-
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-
-kra 0x25 altgr
-
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-
-m 0x27 addupper
-masculine 0x27 shift altgr
-
-ugrave 0x28
-percent 0x28 shift
-dead_caron 0x28 shift altgr
-
-asterisk 0x2b
-mu 0x2b shift
-dead_grave 0x2b altgr
-dead_breve 0x2b shift altgr
-
-#
-# AZERTY third row
-#
-less 0x56
-greater 0x56 shift
-
-w 0x2c addupper
-
-guillemotright 0x2d altgr
-
-cent 0x2e altgr
-copyright 0x2e shift altgr
-
-leftdoublequotemark 0x2f altgr
-
-rightdoublequotemark 0x30 altgr
-
-comma 0x32
-question 0x32 shift
-dead_acute 0x32 altgr
-dead_doubleacute 0x32 shift altgr
-
-semicolon 0x33
-period 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-
-colon 0x34
-slash 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-
-exclam 0x35
-section 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
diff --git a/keymaps/fr-be b/keymaps/fr-be
deleted file mode 100644
index 92d668e..0000000
--- a/keymaps/fr-be
+++ /dev/null
@@ -1,140 +0,0 @@
-# generated from XKB map be
-include common
-map 0x80c
-ampersand 0x02
-1 0x02 shift
-bar 0x02 altgr
-exclamdown 0x02 shift altgr
-eacute 0x03
-2 0x03 shift
-at 0x03 altgr
-oneeighth 0x03 shift altgr
-quotedbl 0x04
-3 0x04 shift
-numbersign 0x04 altgr
-sterling 0x04 shift altgr
-apostrophe 0x05
-4 0x05 shift
-onequarter 0x05 altgr
-dollar 0x05 shift altgr
-parenleft 0x06
-5 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-section 0x07
-6 0x07 shift
-asciicircum 0x07 altgr
-fiveeighths 0x07 shift altgr
-egrave 0x08
-7 0x08 shift
-braceleft 0x08 altgr
-seveneighths 0x08 shift altgr
-exclam 0x09
-8 0x09 shift
-bracketleft 0x09 altgr
-trademark 0x09 shift altgr
-ccedilla 0x0a
-9 0x0a shift
-braceleft 0x0a altgr
-plusminus 0x0a shift altgr
-agrave 0x0b
-0 0x0b shift
-braceright 0x0b altgr
-degree 0x0b shift altgr
-parenright 0x0c
-degree 0x0c shift
-backslash 0x0c altgr
-questiondown 0x0c shift altgr
-minus 0x0d
-underscore 0x0d shift
-dead_cedilla 0x0d altgr
-dead_ogonek 0x0d shift altgr
-a 0x10 addupper
-at 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-z 0x11 addupper
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-EuroSign 0x12 altgr
-cent 0x12 shift altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-dead_circumflex 0x1a
-dead_diaeresis 0x1a shift
-bracketleft 0x1a altgr
-dead_abovering 0x1a shift altgr
-dollar 0x1b
-asterisk 0x1b shift
-bracketright 0x1b altgr
-dead_macron 0x1b shift altgr
-q 0x1e addupper
-ae 0x1e altgr
-AE 0x1e shift altgr
-ssharp 0x1f altgr
-section 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-ampersand 0x25 shift altgr
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-m 0x27 addupper
-dead_acute 0x27 altgr
-dead_doubleacute 0x27 shift altgr
-ugrave 0x28
-percent 0x28 shift
-dead_acute 0x28 altgr
-dead_caron 0x28 shift altgr
-twosuperior 0x29
-threesuperior 0x29 shift
-notsign 0x29 altgr
-mu 0x2b
-sterling 0x2b shift
-dead_grave 0x2b altgr
-dead_breve 0x2b shift altgr
-w 0x2c addupper
-guillemotleft 0x2c altgr
-less 0x2c shift altgr
-guillemotright 0x2d altgr
-greater 0x2d shift altgr
-cent 0x2e altgr
-copyright 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-grave 0x2f shift altgr
-rightdoublequotemark 0x30 altgr
-apostrophe 0x30 shift altgr
-comma 0x32
-question 0x32 shift
-dead_cedilla 0x32 altgr
-masculine 0x32 shift altgr
-semicolon 0x33
-period 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-colon 0x34
-slash 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-equal 0x35
-plus 0x35 shift
-dead_tilde 0x35 altgr
-dead_abovedot 0x35 shift altgr
-backslash 0x56 altgr
diff --git a/keymaps/fr-ca b/keymaps/fr-ca
deleted file mode 100644
index b645208..0000000
--- a/keymaps/fr-ca
+++ /dev/null
@@ -1,50 +0,0 @@
-# Canadian French
-# By Simon Germain
-include common
-map 0xc0c
-
-backslash 0x29 altgr
-plusminus 0x2 altgr
-at 0x3 altgr
-sterling 0x4 altgr
-cent 0x5 altgr
-currency 0x6 altgr
-notsign 0x7 altgr
-bar 0x29 shift
-twosuperior 0x9 altgr
-threesuperior 0xa altgr
-onequarter 0xb altgr
-onehalf 0xc altgr
-threequarters 0xd altgr
-section 0x18 altgr
-paragraph 0x19 altgr
-bracketleft 0x1a altgr
-bracketright 0x1b altgr
-asciitilde 0x27 altgr
-braceleft 0x28 altgr
-braceright 0x2b altgr
-less 0x2b
-greater 0x2b shift
-guillemotleft 0x56
-guillemotright 0x56 shift
-degree 0x56 altgr
-mu 0x32 altgr
-eacute 0x35
-dead_acute 0x35 altgr
-dead_grave 0x28
-dead_circumflex 0x1a
-dead_circumflex 0x1a shift
-dead_cedilla 0x1b
-dead_diaeresis 0x1b shift
-exclam 0x2 shift
-quotedbl 0x3 shift
-slash 0x4 shift
-dollar 0x5 shift
-percent 0x6 shift
-question 0x7 shift
-ampersand 0x8 shift
-asterisk 0x9 shift
-parenleft 0xa shift
-parenright 0xb shift
-underscore 0xc shift
-plus 0xd shift
diff --git a/keymaps/fr-ch b/keymaps/fr-ch
deleted file mode 100644
index 4620d20..0000000
--- a/keymaps/fr-ch
+++ /dev/null
@@ -1,114 +0,0 @@
-# generated from XKB map fr_CH
-include common
-map 0x100c
-exclam 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-quotedbl 0x03 shift
-twosuperior 0x03 altgr
-oneeighth 0x03 shift altgr
-section 0x04 shift
-threesuperior 0x04 altgr
-sterling 0x04 shift altgr
-dollar 0x05 shift
-onequarter 0x05 altgr
-currency 0x05 shift altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-ampersand 0x07 shift
-threequarters 0x07 altgr
-fiveeighths 0x07 shift altgr
-slash 0x08 shift
-braceleft 0x08 altgr
-seveneighths 0x08 shift altgr
-parenleft 0x09 shift
-bracketleft 0x09 altgr
-trademark 0x09 shift altgr
-parenright 0x0a shift
-bracketright 0x0a altgr
-plusminus 0x0a shift altgr
-equal 0x0b shift
-braceright 0x0b altgr
-ssharp 0x0c
-question 0x0c shift
-backslash 0x0c altgr
-questiondown 0x0c shift altgr
-acute 0x0d
-dead_acute 0x0d
-grave 0x0d shift
-dead_grave 0x0d shift
-dead_cedilla 0x0d altgr
-dead_ogonek 0x0d shift altgr
-at 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-EuroSign 0x12 altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-z 0x15 addupper
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-udiaeresis 0x1a
-Udiaeresis 0x1a shift
-dead_diaeresis 0x1a altgr
-dead_abovering 0x1a shift altgr
-plus 0x1b
-asterisk 0x1b shift
-asciitilde 0x1b altgr
-dead_tilde 0x1b altgr
-dead_macron 0x1b shift altgr
-ae 0x1e altgr
-AE 0x1e shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-odiaeresis 0x27
-Odiaeresis 0x27 shift
-dead_doubleacute 0x27 altgr
-adiaeresis 0x28
-Adiaeresis 0x28 shift
-dead_caron 0x28 shift altgr
-asciicircum 0x29
-dead_circumflex 0x29
-degree 0x29 shift
-notsign 0x29 altgr
-numbersign 0x2b
-apostrophe 0x2b shift
-dead_breve 0x2b shift altgr
-y 0x2c addupper
-guillemotleft 0x2c altgr
-guillemotright 0x2d altgr
-cent 0x2e altgr
-copyright 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-rightdoublequotemark 0x30 altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-semicolon 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-minus 0x35
-underscore 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
diff --git a/keymaps/hr b/keymaps/hr
deleted file mode 100644
index 613aa69..0000000
--- a/keymaps/hr
+++ /dev/null
@@ -1,125 +0,0 @@
-# generated from XKB map hr
-include common
-map 0x41a
-exclam 0x02 shift
-asciitilde 0x02 altgr
-dead_tilde 0x02 shift altgr
-quotedbl 0x03 shift
-dead_caron 0x03 altgr
-caron 0x03 shift altgr
-numbersign 0x04 shift
-asciicircum 0x04 altgr
-dead_circumflex 0x04 shift altgr
-dollar 0x05 shift
-dead_breve 0x05 altgr
-breve 0x05 shift altgr
-percent 0x06 shift
-degree 0x06 altgr
-dead_abovering 0x06 shift altgr
-ampersand 0x07 shift
-dead_ogonek 0x07 altgr
-ogonek 0x07 shift altgr
-slash 0x08 shift
-grave 0x08 altgr
-dead_grave 0x08 shift altgr
-parenleft 0x09 shift
-dead_abovedot 0x09 altgr
-abovedot 0x09 shift altgr
-parenright 0x0a shift
-dead_acute 0x0a altgr
-apostrophe 0x0a shift altgr
-equal 0x0b shift
-dead_doubleacute 0x0b altgr
-doubleacute 0x0b shift altgr
-apostrophe 0x0c
-question 0x0c shift
-dead_diaeresis 0x0c altgr
-diaeresis 0x0c shift altgr
-plus 0x0d
-asterisk 0x0d shift
-dead_cedilla 0x0d altgr
-cedilla 0x0d shift altgr
-backslash 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-bar 0x11 altgr
-Lstroke 0x11 shift altgr
-EuroSign 0x12 altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-z 0x15 addupper
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-scaron 0x1a
-Scaron 0x1a shift
-division 0x1a altgr
-dead_abovering 0x1a shift altgr
-dstroke 0x1b
-Dstroke 0x1b shift
-multiply 0x1b altgr
-dead_macron 0x1b shift altgr
-ae 0x1e altgr
-AE 0x1e shift altgr
-ssharp 0x1f altgr
-section 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-bracketleft 0x21 altgr
-ordfeminine 0x21 shift altgr
-bracketright 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-lstroke 0x25 altgr
-ampersand 0x25 shift altgr
-Lstroke 0x26 altgr
-ccaron 0x27
-Ccaron 0x27 shift
-dead_acute 0x27 altgr
-dead_doubleacute 0x27 shift altgr
-cacute 0x28
-Cacute 0x28 shift
-ssharp 0x28 altgr
-dead_caron 0x28 shift altgr
-dead_cedilla 0x29
-dead_diaeresis 0x29 shift
-notsign 0x29 altgr
-zcaron 0x2b
-Zcaron 0x2b shift
-currency 0x2b altgr
-dead_breve 0x2b shift altgr
-y 0x2c addupper
-guillemotleft 0x2c altgr
-less 0x2c shift altgr
-guillemotright 0x2d altgr
-greater 0x2d shift altgr
-cent 0x2e altgr
-copyright 0x2e shift altgr
-at 0x2f altgr
-grave 0x2f shift altgr
-braceleft 0x30 altgr
-apostrophe 0x30 shift altgr
-braceright 0x31 altgr
-section 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-semicolon 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-minus 0x35
-underscore 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
diff --git a/keymaps/hu b/keymaps/hu
deleted file mode 100644
index 8aba444..0000000
--- a/keymaps/hu
+++ /dev/null
@@ -1,115 +0,0 @@
-# Hungarian keyboard layout (QWERTZ)
-# Created by: The NeverGone <never@delfin.klte.hu>
-
-include common
-map 0x40e
-
-
-# AltGr keys:
-notsign 0x29 altgr
-asciitilde 0x02 altgr
-caron 0x03 altgr
-asciicircum 0x04 altgr
-breve 0x05 altgr
-degree 0x06 altgr
-ogonek 0x07 altgr
-grave 0x08 altgr
-abovedot 0x09 altgr
-acute 0x0a altgr
-doubleacute 0x0b altgr
-diaeresis 0x0c altgr
-cedilla 0x0d altgr
-backslash 0x10 altgr
-bar 0x11 altgr
-EuroSign 0x12 altgr
-Iacute 0x17 altgr
-division 0x1a altgr
-multiply 0x1b altgr
-dstroke 0x1f altgr
-Dstroke 0x20 altgr
-bracketleft 0x21 altgr
-bracketright 0x22 altgr
-iacute 0x24 altgr
-lstroke 0x25 altgr
-Lstroke 0x26 altgr
-dollar 0x27 altgr
-ssharp 0x28 altgr
-currency 0x2b altgr
-less 0x56 altgr
-greater 0x2c altgr
-numbersign 0x2d altgr
-ampersand 0x2e altgr
-at 0x2f altgr
-braceleft 0x30 altgr
-braceright 0x31 altgr
-semicolon 0x33 altgr
-asterisk 0x35 altgr
-
-
-# Shift keys:
-section 0x29 shift
-apostrophe 0x02 shift
-quotedbl 0x03 shift
-plus 0x04 shift
-exclam 0x05 shift
-percent 0x06 shift
-slash 0x07 shift
-equal 0x08 shift
-parenleft 0x09 shift
-parenright 0x0a shift
-Odiaeresis 0x0b shift
-Udiaeresis 0x0c shift
-Oacute 0x0d shift
-Z 0x15 shift
-Odoubleacute 0x1a shift
-Uacute 0x1b shift
-Eacute 0x27 shift
-Aacute 0x28 shift
-Udoubleacute 0x2b shift
-Y 0x2c shift
-question 0x33 shift
-colon 0x34 shift
-underscore 0x35 shift
-F13 0x3b shift
-F14 0x3c shift
-F15 0x3d shift
-F16 0x3e shift
-F17 0x3f shift
-F18 0x40 shift
-F19 0x41 shift
-F20 0x42 shift
-F21 0x43 shift
-F22 0x44 shift
-F23 0x57 shift
-F24 0x58 shift
-
-
-# Ctrl keys:
-F25 0x3b ctrl
-F26 0x3c ctrl
-F27 0x3d ctrl
-F28 0x3e ctrl
-F29 0x3f ctrl
-F30 0x40 ctrl
-F31 0x41 ctrl
-F32 0x42 ctrl
-F33 0x43 ctrl
-F34 0x44 ctrl
-F35 0x57 ctrl
-#NoSymbol 0x58 ctrl
-
-
-0 0x29
-odiaeresis 0x0b
-udiaeresis 0x0c
-oacute 0x0d
-z 0x15
-odoubleacute 0x1a
-uacute 0x1b
-eacute 0x27
-aacute 0x28
-udoubleacute 0x2b
-y 0x2c
-comma 0x33
-period 0x34
-minus 0x35
diff --git a/keymaps/is b/keymaps/is
deleted file mode 100644
index 8fde40f..0000000
--- a/keymaps/is
+++ /dev/null
@@ -1,140 +0,0 @@
-# 2004-03-16 Halldór Guðmundsson and Morten Lange 
-# Keyboard definition file for the Icelandic keyboard
-# to be used in rdesktop 1.3.x ( See rdesktop.org) 
-# generated from XKB map de, and changed manually
-# Location for example /usr/local/share/rdesktop/keymaps/is
-include common
-map 0x40f
-exclam 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-quotedbl 0x03 shift
-twosuperior 0x03 altgr
-oneeighth 0x03 shift altgr
-#section 0x04 shift
-numbersign 0x04 shift
-threesuperior 0x04 altgr
-sterling 0x04 shift altgr
-dollar 0x05 shift
-onequarter 0x05 altgr
-currency 0x05 shift altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-ampersand 0x07 shift
-threequarters 0x07 altgr
-fiveeighths 0x07 shift altgr
-slash 0x08 shift
-braceleft 0x08 altgr
-seveneighths 0x08 shift altgr
-parenleft 0x09 shift
-bracketleft 0x09 altgr
-trademark 0x09 shift altgr
-parenright 0x0a shift
-bracketright 0x0a altgr
-plusminus 0x0a shift altgr
-equal 0x0b shift
-braceright 0x0b altgr
-#ssharp 0x0c
-odiaeresis 0x0c
-#question 0x0c shift
-Odiaeresis 0x0c shift
-backslash 0x0c altgr
-questiondown 0x0c shift altgr
-#acute 0x0d
-minus  0x0d
-#dead_acute 0x0d
-#grave 0x0d shift
-#dead_grave 0x0d shift
-underscore 0x0d shift
-dead_cedilla 0x0d altgr
-dead_ogonek 0x0d shift altgr
-at 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-EuroSign 0x12 altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-#z 0x15 addupper
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-#thorn 0x19 altgr
-#THORN 0x19 shift altgr
-#udiaeresis 0x1a
-#Udiaeresis 0x1a shift
-#dead_diaeresis 0x1a altgr
-#dead_abovering 0x1a shift altgr
-eth 0x1a 
-ETH 0x1a shift 
-apostrophe 0x1b
-question 0x1b shift
-#plus 0x1b
-#asterisk 0x1b shift
-asciitilde 0x1b altgr
-#grave 0x1b altgr
-#dead_tilde 0x1b altgr
-#dead_macron 0x1b shift altgr
-#ae 0x1e altgr
-#AE 0x1e shift altgr
-#eth 0x20 altgr
-#eth 0x20 
-#ETH 0x20 shift altgr
-#ETH 0x20 shift 
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-#adiaeresis 0x27
-#Adiaeresis 0x27 shift
-ae 0x27 
-AE 0x27 shift 
-dead_doubleacute 0x27 altgr
-#adiaeresis 0x28
-#Adiaeresis 0x28 shift
-#dead_caron 0x28 shift altgr
-#asciicircum 0x29
-acute  0x28
-dead_acute 0x28
-#dead_circumflex 0x29
-#degree 0x29 shift
-#notsign 0x29 altgr
-plus 0x2b
-asterisk 0x2b shift
-grave 0x2b altgr
-#numbersign 0x2b
-#apostrophe 0x2b shift
-#dead_breve 0x2b shift altgr
-#y 0x2c addupper
-guillemotleft 0x2c altgr
-guillemotright 0x2d altgr
-cent 0x2e altgr
-copyright 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-rightdoublequotemark 0x30 altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-semicolon 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-#minus 0x35
-#underscore 0x35 shift
-thorn 0x35 
-THORN 0x35 shift 
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
-
diff --git a/keymaps/it b/keymaps/it
deleted file mode 100644
index 00ca73a..0000000
--- a/keymaps/it
+++ /dev/null
@@ -1,115 +0,0 @@
-# generated from XKB map it
-include common
-map 0x410
-exclam 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-quotedbl 0x03 shift
-twosuperior 0x03 altgr
-oneeighth 0x03 shift altgr
-sterling 0x04 shift
-threesuperior 0x04 altgr
-dollar 0x05 shift
-onequarter 0x05 altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-ampersand 0x07 shift
-threequarters 0x07 altgr
-fiveeighths 0x07 shift altgr
-slash 0x08 shift
-braceleft 0x08 altgr
-seveneighths 0x08 shift altgr
-parenleft 0x09 shift
-trademark 0x09 shift altgr
-parenright 0x0a shift
-plusminus 0x0a shift altgr
-equal 0x0b shift
-braceright 0x0b altgr
-degree 0x0b shift altgr
-apostrophe 0x0c
-question 0x0c shift
-grave 0x0c altgr
-questiondown 0x0c shift altgr
-igrave 0x0d
-asciicircum 0x0d shift
-asciitilde 0x0d altgr
-dead_ogonek 0x0d shift altgr
-at 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-EuroSign 0x12 altgr
-cent 0x12 shift altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-egrave 0x1a
-eacute 0x1a shift
-bracketleft 0x1a altgr
-dead_abovering 0x1a shift altgr
-plus 0x1b
-asterisk 0x1b shift
-bracketright 0x1b altgr
-dead_macron 0x1b shift altgr
-ae 0x1e altgr
-AE 0x1e shift altgr
-ssharp 0x1f altgr
-section 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-ograve 0x27
-ccedilla 0x27 shift
-at 0x27 altgr
-dead_doubleacute 0x27 shift altgr
-agrave 0x28
-degree 0x28 shift
-numbersign 0x28 altgr
-backslash 0x29
-bar 0x29 shift
-notsign 0x29 altgr
-ugrave 0x2b
-section 0x2b shift
-dead_grave 0x2b altgr
-dead_breve 0x2b shift altgr
-guillemotleft 0x2c altgr
-guillemotright 0x2d altgr
-cent 0x2e altgr
-copyright 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-grave 0x2f shift altgr
-rightdoublequotemark 0x30 altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-semicolon 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-minus 0x35
-underscore 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
diff --git a/keymaps/ja b/keymaps/ja
deleted file mode 100644
index 8fd0b9e..0000000
--- a/keymaps/ja
+++ /dev/null
@@ -1,104 +0,0 @@
-# generated from XKB map jp106
-include common
-map 0x411
-exclam 0x02 shift
-kana_NU 0x02 altgr
-quotedbl 0x03 shift
-kana_FU 0x03 altgr
-numbersign 0x04 shift
-kana_A 0x04 altgr
-kana_a 0x04 shift altgr
-dollar 0x05 shift
-kana_U 0x05 altgr
-kana_u 0x05 shift altgr
-percent 0x06 shift
-kana_E 0x06 altgr
-kana_e 0x06 shift altgr
-ampersand 0x07 shift
-kana_O 0x07 altgr
-kana_o 0x07 shift altgr
-apostrophe 0x08 shift
-kana_YA 0x08 altgr
-kana_ya 0x08 shift altgr
-parenleft 0x09 shift
-kana_YU 0x09 altgr
-kana_yu 0x09 shift altgr
-parenright 0x0a shift
-kana_YO 0x0a altgr
-kana_yo 0x0a shift altgr
-asciitilde 0x0b shift
-kana_WA 0x0b altgr
-kana_WO 0x0b shift altgr
-minus 0x0c
-equal 0x0c shift
-kana_HO 0x0c altgr
-asciicircum 0x0d
-asciitilde 0x0d shift
-kana_HE 0x0d altgr
-kana_TA 0x10 altgr
-kana_TE 0x11 altgr
-kana_I 0x12 altgr
-kana_i 0x12 shift altgr
-kana_SU 0x13 altgr
-kana_KA 0x14 altgr
-kana_N 0x15 altgr
-kana_NA 0x16 altgr
-kana_NI 0x17 altgr
-kana_RA 0x18 altgr
-kana_SE 0x19 altgr
-at 0x1a
-grave 0x1a shift
-voicedsound 0x1a altgr
-bracketleft 0x1b
-braceleft 0x1b shift
-semivoicedsound 0x1b altgr
-kana_openingbracket 0x1b shift altgr
-kana_CHI 0x1e altgr
-kana_TO 0x1f altgr
-kana_SHI 0x20 altgr
-kana_HA 0x21 altgr
-kana_KI 0x22 altgr
-kana_KU 0x23 altgr
-kana_MA 0x24 altgr
-kana_NO 0x25 altgr
-kana_RI 0x26 altgr
-semicolon 0x27
-plus 0x27 shift
-kana_RE 0x27 altgr
-colon 0x28
-asterisk 0x28 shift
-kana_KE 0x28 altgr
-Zenkaku_Hankaku 0x29
-bracketright 0x2b
-braceright 0x2b shift
-kana_MU 0x2b altgr
-kana_closingbracket 0x2b shift altgr
-kana_TSU 0x2c altgr
-kana_tsu 0x2c shift altgr
-kana_SA 0x2d altgr
-kana_SO 0x2e altgr
-kana_HI 0x2f altgr
-kana_KO 0x30 altgr
-kana_MI 0x31 altgr
-kana_MO 0x32 altgr
-comma 0x33
-less 0x33 shift
-kana_NE 0x33 altgr
-kana_comma 0x33 shift altgr
-period 0x34
-greater 0x34 shift
-kana_RU 0x34 altgr
-kana_fullstop 0x34 shift altgr
-slash 0x35
-question 0x35 shift
-kana_ME 0x35 altgr
-kana_conjunctive 0x35 shift altgr
-Eisu_toggle 0x3a shift
-Execute 0x54 shift
-Kanji 0x70
-backslash 0x73
-bar 0x7d shift
-underscore 0x73 shift
-Henkan_Mode 0x79
-Katakana 0x70
-Muhenkan 0x7b
diff --git a/keymaps/lt b/keymaps/lt
deleted file mode 100644
index 3d9d619..0000000
--- a/keymaps/lt
+++ /dev/null
@@ -1,57 +0,0 @@
-# generated from XKB map lt
-include common
-map 0x427
-exclam 0x02 shift
-aogonek 0x02 altgr
-Aogonek 0x02 shift altgr
-at 0x03 shift
-ccaron 0x03 altgr
-Ccaron 0x03 shift altgr
-numbersign 0x04 shift
-eogonek 0x04 altgr
-Eogonek 0x04 shift altgr
-dollar 0x05 shift
-eabovedot 0x05 altgr
-Eabovedot 0x05 shift altgr
-percent 0x06 shift
-iogonek 0x06 altgr
-Iogonek 0x06 shift altgr
-asciicircum 0x07 shift
-scaron 0x07 altgr
-Scaron 0x07 shift altgr
-ampersand 0x08 shift
-uogonek 0x08 altgr
-Uogonek 0x08 shift altgr
-asterisk 0x09 shift
-umacron 0x09 altgr
-Umacron 0x09 shift altgr
-parenleft 0x0a shift
-doublelowquotemark 0x0a altgr
-parenright 0x0b shift
-leftdoublequotemark 0x0b altgr
-minus 0x0c
-underscore 0x0c shift
-equal 0x0d
-plus 0x0d shift
-zcaron 0x0d altgr
-Zcaron 0x0d shift altgr
-bracketleft 0x1a
-braceleft 0x1a shift
-bracketright 0x1b
-braceright 0x1b shift
-semicolon 0x27
-colon 0x27 shift
-apostrophe 0x28
-quotedbl 0x28 shift
-grave 0x29
-asciitilde 0x29 shift
-backslash 0x2b
-bar 0x2b shift
-comma 0x33
-less 0x33 shift
-period 0x34
-greater 0x34 shift
-slash 0x35
-question 0x35 shift
-endash 0x56
-EuroSign 0x56 shift
diff --git a/keymaps/lv b/keymaps/lv
deleted file mode 100644
index 1d91727..0000000
--- a/keymaps/lv
+++ /dev/null
@@ -1,128 +0,0 @@
-# generated from XKB map lv
-include common
-map 0x426
-exclam 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-at 0x03 shift
-twosuperior 0x03 altgr
-oneeighth 0x03 shift altgr
-numbersign 0x04 shift
-threesuperior 0x04 altgr
-sterling 0x04 shift altgr
-dollar 0x05 shift
-EuroSign 0x05 altgr
-cent 0x05 shift altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-asciicircum 0x07 shift
-threequarters 0x07 altgr
-fiveeighths 0x07 shift altgr
-ampersand 0x08 shift
-braceleft 0x08 altgr
-seveneighths 0x08 shift altgr
-asterisk 0x09 shift
-bracketleft 0x09 altgr
-trademark 0x09 shift altgr
-parenleft 0x0a shift
-bracketright 0x0a altgr
-plusminus 0x0a shift altgr
-parenright 0x0b shift
-braceright 0x0b altgr
-degree 0x0b shift altgr
-minus 0x0c
-underscore 0x0c shift
-backslash 0x0c altgr
-questiondown 0x0c shift altgr
-equal 0x0d
-plus 0x0d shift
-dead_cedilla 0x0d altgr
-dead_ogonek 0x0d shift altgr
-at 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-emacron 0x12 altgr
-Emacron 0x12 shift altgr
-rcedilla 0x13 altgr
-Rcedilla 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-umacron 0x16 altgr
-Umacron 0x16 shift altgr
-imacron 0x17 altgr
-Imacron 0x17 shift altgr
-omacron 0x18 altgr
-Omacron 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-bracketleft 0x1a
-braceleft 0x1a shift
-dead_diaeresis 0x1a altgr
-dead_abovering 0x1a shift altgr
-bracketright 0x1b
-braceright 0x1b shift
-dead_tilde 0x1b altgr
-dead_macron 0x1b shift altgr
-ISO_Next_Group 0x1c shift
-amacron 0x1e altgr
-Amacron 0x1e shift altgr
-scaron 0x1f altgr
-Scaron 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-gcedilla 0x22 altgr
-Gcedilla 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kcedilla 0x25 altgr
-Kcedilla 0x25 shift altgr
-lcedilla 0x26 altgr
-Lcedilla 0x26 shift altgr
-semicolon 0x27
-colon 0x27 shift
-dead_acute 0x27 altgr
-dead_doubleacute 0x27 shift altgr
-apostrophe 0x28
-quotedbl 0x28 shift
-leftdoublequotemark 0x28 altgr
-doublelowquotemark 0x28 shift altgr
-grave 0x29
-asciitilde 0x29 shift
-notsign 0x29 altgr
-backslash 0x2b
-bar 0x2b shift
-dead_grave 0x2b altgr
-dead_breve 0x2b shift altgr
-zcaron 0x2c altgr
-Zcaron 0x2c shift altgr
-guillemotright 0x2d altgr
-greater 0x2d shift altgr
-ccaron 0x2e altgr
-Ccaron 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-grave 0x2f shift altgr
-rightdoublequotemark 0x30 altgr
-apostrophe 0x30 shift altgr
-ncedilla 0x31 altgr
-Ncedilla 0x31 shift altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-less 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-period 0x34
-greater 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-slash 0x35
-question 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
-nobreakspace 0x39 altgr
diff --git a/keymaps/mk b/keymaps/mk
deleted file mode 100644
index 18c1504..0000000
--- a/keymaps/mk
+++ /dev/null
@@ -1,101 +0,0 @@
-# generated from XKB map mk
-include common
-map 0x42f
-exclam 0x02 shift
-at 0x03 shift
-doublelowquotemark 0x03 shift altgr
-numbersign 0x04 shift
-leftdoublequotemark 0x04 shift altgr
-dollar 0x05 shift
-percent 0x06 shift
-asciicircum 0x07 shift
-ampersand 0x08 shift
-asterisk 0x09 shift
-parenleft 0x0a shift
-parenright 0x0b shift
-minus 0x0c
-underscore 0x0c shift
-equal 0x0d
-plus 0x0d shift
-Cyrillic_lje 0x10 altgr
-Cyrillic_LJE 0x10 shift altgr
-Cyrillic_nje 0x11 altgr
-Cyrillic_NJE 0x11 shift altgr
-Cyrillic_ie 0x12 altgr
-Cyrillic_IE 0x12 shift altgr
-Cyrillic_er 0x13 altgr
-Cyrillic_ER 0x13 shift altgr
-Cyrillic_te 0x14 altgr
-Cyrillic_TE 0x14 shift altgr
-Macedonia_dse 0x15 altgr
-Macedonia_DSE 0x15 shift altgr
-Cyrillic_u 0x16 altgr
-Cyrillic_U 0x16 shift altgr
-Cyrillic_i 0x17 altgr
-Cyrillic_I 0x17 shift altgr
-Cyrillic_o 0x18 altgr
-Cyrillic_O 0x18 shift altgr
-Cyrillic_pe 0x19 altgr
-Cyrillic_PE 0x19 shift altgr
-bracketleft 0x1a
-braceleft 0x1a shift
-Cyrillic_sha 0x1a altgr
-Cyrillic_SHA 0x1a shift altgr
-bracketright 0x1b
-braceright 0x1b shift
-Macedonia_gje 0x1b altgr
-Macedonia_GJE 0x1b shift altgr
-Cyrillic_a 0x1e altgr
-Cyrillic_A 0x1e shift altgr
-Cyrillic_es 0x1f altgr
-Cyrillic_ES 0x1f shift altgr
-Cyrillic_de 0x20 altgr
-Cyrillic_DE 0x20 shift altgr
-Cyrillic_ef 0x21 altgr
-Cyrillic_EF 0x21 shift altgr
-Cyrillic_ghe 0x22 altgr
-Cyrillic_GHE 0x22 shift altgr
-Cyrillic_ha 0x23 altgr
-Cyrillic_HA 0x23 shift altgr
-Cyrillic_je 0x24 altgr
-Cyrillic_JE 0x24 shift altgr
-Cyrillic_ka 0x25 altgr
-Cyrillic_KA 0x25 shift altgr
-Cyrillic_el 0x26 altgr
-Cyrillic_EL 0x26 shift altgr
-semicolon 0x27
-colon 0x27 shift
-Cyrillic_che 0x27 altgr
-Cyrillic_CHE 0x27 shift altgr
-apostrophe 0x28
-quotedbl 0x28 shift
-Macedonia_kje 0x28 altgr
-Macedonia_KJE 0x28 shift altgr
-grave 0x29
-asciitilde 0x29 shift
-backslash 0x2b
-bar 0x2b shift
-Cyrillic_zhe 0x2b altgr
-Cyrillic_ZHE 0x2b shift altgr
-Cyrillic_ze 0x2c altgr
-Cyrillic_ZE 0x2c shift altgr
-Cyrillic_dzhe 0x2d altgr
-Cyrillic_DZHE 0x2d shift altgr
-Cyrillic_tse 0x2e altgr
-Cyrillic_TSE 0x2e shift altgr
-Cyrillic_ve 0x2f altgr
-Cyrillic_VE 0x2f shift altgr
-Cyrillic_be 0x30 altgr
-Cyrillic_BE 0x30 shift altgr
-Cyrillic_en 0x31 altgr
-Cyrillic_EN 0x31 shift altgr
-Cyrillic_em 0x32 altgr
-Cyrillic_EM 0x32 shift altgr
-comma 0x33
-less 0x33 shift
-semicolon 0x33 shift altgr
-period 0x34
-greater 0x34 shift
-colon 0x34 shift altgr
-slash 0x35
-question 0x35 shift
diff --git a/keymaps/modifiers b/keymaps/modifiers
deleted file mode 100644
index d8b019f..0000000
--- a/keymaps/modifiers
+++ /dev/null
@@ -1,17 +0,0 @@
-Shift_R 0x36
-Shift_L 0x2a
-
-Alt_R 0xb8
-Mode_switch 0xb8
-Alt_L 0x38
-
-Control_R 0x9d
-Control_L 0x1d
-
-# Translate Super to Windows keys. 
-# This is hardcoded. See documentation for details. 
-Super_R 0xdb
-Super_L 0xdc
-
-# Translate Menu to the Windows Application key. 
-Menu 0xdd
diff --git a/keymaps/nl b/keymaps/nl
deleted file mode 100644
index bc823bd..0000000
--- a/keymaps/nl
+++ /dev/null
@@ -1,60 +0,0 @@
-# Dutch (Netherlands)
-include common
-map 0x413
-
-exclam 0x02 shift
-onesuperior 0x02 altgr
-quotebl 0x03 shift
-twosuperior 0x03 altgr
-numbersign 0x04 shift
-threesuperior 0x04 altgr
-dollar 0x05 shift
-onequarter 0x05 altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-ampersand 0x07 shift
-threequarters 0x07 altgr
-underscore 0x08 shift
-sterling 0x08 altgr
-parenleft 0x09 shift
-braceleft 0x09 altgr
-parenright 0x0a shift
-braceright 0x0a altgr
-apostrophe 0x0b shift
-slash 0x0c
-question 0x0c shift
-backslash 0x0c altgr
-degree 0x0d
-dead_tilde 0x0d shift
-dead_cedilla 0x0d altgr
-EuroSign 0x12 altgr
-paragraph 0x13 altgr
-dead_diaeresis 0x1a
-dead_circumflex 0x1a shift
-asterisk 0x1b
-bar 0x1b shift
-ssharp 0x1f altgr
-plus 0x27
-plusminus 0x27 shift
-dead_acute 0x28
-dead_grave 0x28 shift
-at 0x29
-section 0x29 shift
-notsign 0x29 altgr
-less 0x2b
-greater 0x2b shift
-guillemotleft 0x2c altgr
-guillemotright 0x2d altgr
-copyright 0x2e altgr 
-mu 0x32 altgr
-comma 0x33
-semicolon 0x33 shift
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-hyphen 0x35
-equal 0x35 shift
-bracketright 0x56
-bracketleft 0x56 shift
-brokenbar 0x56 altgr
-
diff --git a/keymaps/nl-be b/keymaps/nl-be
deleted file mode 100644
index 34fc881..0000000
--- a/keymaps/nl-be
+++ /dev/null
@@ -1,3 +0,0 @@
-# Dutch (Belgium)
-map 0x813
-include common
diff --git a/keymaps/no b/keymaps/no
deleted file mode 100644
index 40a6479..0000000
--- a/keymaps/no
+++ /dev/null
@@ -1,119 +0,0 @@
-# generated from XKB map no
-include common
-map 0x414
-exclam 0x02 shift
-exclamdown 0x02 altgr
-onesuperior 0x02 shift altgr
-quotedbl 0x03 shift
-at 0x03 altgr
-twosuperior 0x03 shift altgr
-numbersign 0x04 shift
-sterling 0x04 altgr
-threesuperior 0x04 shift altgr
-currency 0x05 shift
-dollar 0x05 altgr
-onequarter 0x05 shift altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-cent 0x06 shift altgr
-ampersand 0x07 shift
-yen 0x07 altgr
-fiveeighths 0x07 shift altgr
-slash 0x08 shift
-braceleft 0x08 altgr
-division 0x08 shift altgr
-parenleft 0x09 shift
-bracketleft 0x09 altgr
-guillemotleft 0x09 shift altgr
-parenright 0x0a shift
-bracketright 0x0a altgr
-guillemotright 0x0a shift altgr
-equal 0x0b shift
-braceright 0x0b altgr
-degree 0x0b shift altgr
-plus 0x0c
-question 0x0c shift
-plusminus 0x0c altgr
-questiondown 0x0c shift altgr
-backslash 0x0d
-dead_grave 0x0d shift
-dead_acute 0x0d altgr
-notsign 0x0d shift altgr
-Greek_OMEGA 0x10 shift altgr
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-EuroSign 0x12 altgr
-cent 0x12 shift altgr
-registered 0x13 altgr
-thorn 0x14 altgr
-THORN 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oe 0x18 altgr
-OE 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-aring 0x1a
-Aring 0x1a shift
-dead_diaeresis 0x1a altgr
-dead_abovering 0x1a shift altgr
-dead_diaeresis 0x1b
-dead_circumflex 0x1b shift
-asciicircum 0x01b shift
-dead_tilde 0x1b altgr
-asciitilde 0x1b altgr
-dead_caron 0x1b shift altgr
-ordfeminine 0x1e altgr
-masculine 0x1e shift altgr
-ssharp 0x1f altgr
-section 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-oslash 0x27
-Ooblique 0x27 shift
-dead_doubleacute 0x27 shift altgr
-ae 0x28
-AE 0x28 shift
-dead_caron 0x28 shift altgr
-bar 0x29
-section 0x29 shift
-brokenbar 0x29 altgr
-paragraph 0x29 shift altgr
-apostrophe 0x2b
-asterisk 0x2b shift
-multiply 0x2b shift altgr
-guillemotleft 0x2c altgr
-guillemotright 0x2d altgr
-copyright 0x2e altgr
-leftdoublequotemark 0x2f altgr
-rightdoublequotemark 0x30 altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-semicolon 0x33 shift
-dead_cedilla 0x33 altgr
-dead_ogonek 0x33 shift altgr
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-dead_abovedot 0x34 shift altgr
-minus 0x35
-underscore 0x35 shift
-hyphen 0x35 altgr
-macron 0x35 shift altgr
-nobreakspace 0x39 altgr
-onehalf 0x56 altgr
-threequarters 0x56 shift altgr
diff --git a/keymaps/pl b/keymaps/pl
deleted file mode 100644
index 09c600d..0000000
--- a/keymaps/pl
+++ /dev/null
@@ -1,122 +0,0 @@
-# generated from XKB map pl
-include common
-map 0x415
-exclam 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-at 0x03 shift
-twosuperior 0x03 altgr
-oneeighth 0x03 shift altgr
-numbersign 0x04 shift
-threesuperior 0x04 altgr
-sterling 0x04 shift altgr
-dollar 0x05 shift
-onequarter 0x05 altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-asciicircum 0x07 shift
-threequarters 0x07 altgr
-fiveeighths 0x07 shift altgr
-ampersand 0x08 shift
-braceleft 0x08 altgr
-seveneighths 0x08 shift altgr
-asterisk 0x09 shift
-bracketleft 0x09 altgr
-trademark 0x09 shift altgr
-parenleft 0x0a shift
-bracketright 0x0a altgr
-plusminus 0x0a shift altgr
-parenright 0x0b shift
-braceright 0x0b altgr
-degree 0x0b shift altgr
-minus 0x0c
-underscore 0x0c shift
-backslash 0x0c altgr
-questiondown 0x0c shift altgr
-equal 0x0d
-plus 0x0d shift
-dead_cedilla 0x0d altgr
-dead_ogonek 0x0d shift altgr
-Greek_OMEGA 0x10 shift altgr
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-eogonek 0x12 altgr
-Eogonek 0x12 shift altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-EuroSign 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oacute 0x18 altgr
-Oacute 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-bracketleft 0x1a
-braceleft 0x1a shift
-dead_diaeresis 0x1a altgr
-dead_abovering 0x1a shift altgr
-bracketright 0x1b
-braceright 0x1b shift
-dead_tilde 0x1b altgr
-dead_macron 0x1b shift altgr
-aogonek 0x1e altgr
-Aogonek 0x1e shift altgr
-sacute 0x1f altgr
-Sacute 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-semicolon 0x27
-colon 0x27 shift
-dead_acute 0x27 altgr
-dead_doubleacute 0x27 shift altgr
-apostrophe 0x28
-quotedbl 0x28 shift
-dead_circumflex 0x28 altgr
-dead_caron 0x28 shift altgr
-grave 0x29
-asciitilde 0x29 shift
-notsign 0x29 altgr
-backslash 0x2b
-bar 0x2b shift
-dead_grave 0x2b altgr
-dead_breve 0x2b shift altgr
-zabovedot 0x2c altgr
-Zabovedot 0x2c shift altgr
-zacute 0x2d altgr
-Zacute 0x2d shift altgr
-cacute 0x2e altgr
-Cacute 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-grave 0x2f shift altgr
-rightdoublequotemark 0x30 altgr
-nacute 0x31 altgr
-Nacute 0x31 shift altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-less 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-period 0x34
-greater 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-slash 0x35
-question 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
diff --git a/keymaps/pt b/keymaps/pt
deleted file mode 100644
index c6941f6..0000000
--- a/keymaps/pt
+++ /dev/null
@@ -1,113 +0,0 @@
-# generated from XKB map pt
-include common
-map 0x816
-exclam 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-quotedbl 0x03 shift
-at 0x03 altgr
-oneeighth 0x03 shift altgr
-numbersign 0x04 shift
-sterling 0x04 altgr
-dollar 0x05 shift
-section 0x05 altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-ampersand 0x07 shift
-threequarters 0x07 altgr
-fiveeighths 0x07 shift altgr
-slash 0x08 shift
-braceleft 0x08 altgr
-seveneighths 0x08 shift altgr
-parenleft 0x09 shift
-bracketleft 0x09 altgr
-trademark 0x09 shift altgr
-parenright 0x0a shift
-bracketright 0x0a altgr
-plusminus 0x0a shift altgr
-equal 0x0b shift
-braceright 0x0b altgr
-degree 0x0b shift altgr
-apostrophe 0x0c
-question 0x0c shift
-backslash 0x0c altgr
-questiondown 0x0c shift altgr
-guillemotleft 0x0d
-guillemotright 0x0d shift
-dead_cedilla 0x0d altgr
-dead_ogonek 0x0d shift altgr
-Greek_OMEGA 0x10 shift altgr
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-EuroSign 0x12 altgr
-cent 0x12 shift altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-plus 0x1a
-asterisk 0x1a shift
-dead_diaeresis 0x1a altgr
-dead_abovering 0x1a shift altgr
-dead_acute 0x1b
-dead_grave 0x1b shift
-dead_tilde 0x1b altgr
-dead_macron 0x1b shift altgr
-ae 0x1e altgr
-AE 0x1e shift altgr
-ssharp 0x1f altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-ccedilla 0x27
-Ccedilla 0x27 shift
-dead_doubleacute 0x27 shift altgr
-masculine 0x28
-ordfeminine 0x28 shift
-dead_circumflex 0x28 altgr
-dead_caron 0x28 shift altgr
-backslash 0x29
-bar 0x29 shift
-notsign 0x29 altgr
-dead_tilde 0x2b
-dead_circumflex 0x2b shift
-dead_breve 0x2b shift altgr
-less 0x56
-greater 0x56 shift
-cent 0x2e altgr
-copyright 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-grave 0x2f shift altgr
-rightdoublequotemark 0x30 altgr
-mu 0x32 altgr
-comma 0x33
-semicolon 0x33 shift
-horizconnector 0x33 altgr
-multiply 0x33 shift altgr
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-division 0x34 shift altgr
-minus 0x35
-underscore 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
diff --git a/keymaps/pt-br b/keymaps/pt-br
deleted file mode 100644
index 54bafc5..0000000
--- a/keymaps/pt-br
+++ /dev/null
@@ -1,69 +0,0 @@
-# generated from XKB map br
-include common
-map 0x416
-exclam 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-at 0x03 shift
-twosuperior 0x03 altgr
-onehalf 0x03 shift altgr
-numbersign 0x04 shift
-threesuperior 0x04 altgr
-threequarters 0x04 shift altgr
-dollar 0x05 shift
-sterling 0x05 altgr
-onequarter 0x05 shift altgr
-percent 0x06 shift
-cent 0x06 altgr
-dead_diaeresis 0x07 shift
-notsign 0x07 altgr
-diaeresis 0x07 shift altgr
-ampersand 0x08 shift
-braceleft 0x08 altgr
-asterisk 0x09 shift
-bracketleft 0x09 altgr
-parenleft 0x0a shift
-bracketright 0x0a altgr
-parenright 0x0b shift
-braceright 0x0b altgr
-minus 0x0c
-underscore 0x0c shift
-backslash 0x0c altgr
-equal 0x0d
-plus 0x0d shift
-section 0x0d altgr
-EuroSign 0x12 altgr
-registered 0x13 altgr
-dead_acute 0x1a
-dead_grave 0x1a shift
-acute 0x1a altgr
-grave 0x1a shift altgr
-bracketleft 0x1b
-braceleft 0x1b shift
-ordfeminine 0x1b altgr
-ccedilla 0x27
-Ccedilla 0x27 shift
-dead_tilde 0x28
-dead_circumflex 0x28 shift
-asciitilde 0x28 altgr
-asciicircum 0x28 shift altgr
-apostrophe 0x29
-quotedbl 0x29 shift
-bracketright 0x2b
-braceright 0x2b shift
-masculine 0x2b altgr
-copyright 0x2e altgr
-mu 0x32 altgr
-comma 0x33
-less 0x33 shift
-period 0x34
-greater 0x34 shift
-semicolon 0x35
-colon 0x35 shift
-comma 0x53 numlock
-backslash 0x56
-bar 0x56 shift
-slash 0x73
-question 0x73 shift
-degree 0x73 altgr
-KP_Decimal 0x34
diff --git a/keymaps/ru b/keymaps/ru
deleted file mode 100644
index b3e7d24..0000000
--- a/keymaps/ru
+++ /dev/null
@@ -1,109 +0,0 @@
-# generated from XKB map ru
-include common
-map 0x419
-exclam 0x02 shift
-at 0x03 shift
-quotedbl 0x03 shift altgr
-numbersign 0x04 shift
-dollar 0x05 shift
-asterisk 0x05 shift altgr
-percent 0x06 shift
-colon 0x06 shift altgr
-asciicircum 0x07 shift
-comma 0x07 shift altgr
-ampersand 0x08 shift
-period 0x08 shift altgr
-asterisk 0x09 shift
-semicolon 0x09 shift altgr
-parenleft 0x0a shift
-parenright 0x0b shift
-minus 0x0c
-underscore 0x0c shift
-equal 0x0d
-plus 0x0d shift
-Cyrillic_shorti 0x10 altgr
-Cyrillic_SHORTI 0x10 shift altgr
-Cyrillic_tse 0x11 altgr
-Cyrillic_TSE 0x11 shift altgr
-Cyrillic_u 0x12 altgr
-Cyrillic_U 0x12 shift altgr
-Cyrillic_ka 0x13 altgr
-Cyrillic_KA 0x13 shift altgr
-Cyrillic_ie 0x14 altgr
-Cyrillic_IE 0x14 shift altgr
-Cyrillic_en 0x15 altgr
-Cyrillic_EN 0x15 shift altgr
-Cyrillic_ghe 0x16 altgr
-Cyrillic_GHE 0x16 shift altgr
-Cyrillic_sha 0x17 altgr
-Cyrillic_SHA 0x17 shift altgr
-Cyrillic_shcha 0x18 altgr
-Cyrillic_SHCHA 0x18 shift altgr
-Cyrillic_ze 0x19 altgr
-Cyrillic_ZE 0x19 shift altgr
-bracketleft 0x1a
-braceleft 0x1a shift
-Cyrillic_ha 0x1a altgr
-Cyrillic_HA 0x1a shift altgr
-bracketright 0x1b
-braceright 0x1b shift
-Cyrillic_hardsign 0x1b altgr
-Cyrillic_HARDSIGN 0x1b shift altgr
-Cyrillic_ef 0x1e altgr
-Cyrillic_EF 0x1e shift altgr
-Cyrillic_yeru 0x1f altgr
-Cyrillic_YERU 0x1f shift altgr
-Cyrillic_ve 0x20 altgr
-Cyrillic_VE 0x20 shift altgr
-Cyrillic_a 0x21 altgr
-Cyrillic_A 0x21 shift altgr
-Cyrillic_pe 0x22 altgr
-Cyrillic_PE 0x22 shift altgr
-Cyrillic_er 0x23 altgr
-Cyrillic_ER 0x23 shift altgr
-Cyrillic_o 0x24 altgr
-Cyrillic_O 0x24 shift altgr
-Cyrillic_el 0x25 altgr
-Cyrillic_EL 0x25 shift altgr
-Cyrillic_de 0x26 altgr
-Cyrillic_DE 0x26 shift altgr
-semicolon 0x27
-colon 0x27 shift
-Cyrillic_zhe 0x27 altgr
-Cyrillic_ZHE 0x27 shift altgr
-apostrophe 0x28
-quotedbl 0x28 shift
-Cyrillic_e 0x28 altgr
-Cyrillic_E 0x28 shift altgr
-grave 0x29
-asciitilde 0x29 shift
-Cyrillic_io 0x29 altgr
-Cyrillic_IO 0x29 shift altgr
-backslash 0x2b
-bar 0x2b shift
-Cyrillic_ya 0x2c altgr
-Cyrillic_YA 0x2c shift altgr
-Cyrillic_che 0x2d altgr
-Cyrillic_CHE 0x2d shift altgr
-Cyrillic_es 0x2e altgr
-Cyrillic_ES 0x2e shift altgr
-Cyrillic_em 0x2f altgr
-Cyrillic_EM 0x2f shift altgr
-Cyrillic_i 0x30 altgr
-Cyrillic_I 0x30 shift altgr
-Cyrillic_te 0x31 altgr
-Cyrillic_TE 0x31 shift altgr
-Cyrillic_softsign 0x32 altgr
-Cyrillic_SOFTSIGN 0x32 shift altgr
-comma 0x33
-less 0x33 shift
-Cyrillic_be 0x33 altgr
-Cyrillic_BE 0x33 shift altgr
-period 0x34
-greater 0x34 shift
-Cyrillic_yu 0x34 altgr
-Cyrillic_YU 0x34 shift altgr
-slash 0x35
-question 0x35 shift
-slash 0x56 altgr
-bar 0x56 shift altgr
diff --git a/keymaps/sl b/keymaps/sl
deleted file mode 100644
index 56835a9..0000000
--- a/keymaps/sl
+++ /dev/null
@@ -1,110 +0,0 @@
-# generated from XKB map sl
-include common
-map 0x424
-exclam 0x02 shift
-asciitilde 0x02 altgr
-dead_tilde 0x02 shift altgr
-quotedbl 0x03 shift
-dead_caron 0x03 altgr
-caron 0x03 shift altgr
-numbersign 0x04 shift
-asciicircum 0x04 altgr
-dead_circumflex 0x04 shift altgr
-dollar 0x05 shift
-dead_breve 0x05 altgr
-breve 0x05 shift altgr
-percent 0x06 shift
-degree 0x06 altgr
-dead_abovering 0x06 shift altgr
-ampersand 0x07 shift
-dead_ogonek 0x07 altgr
-ogonek 0x07 shift altgr
-slash 0x08 shift
-grave 0x08 altgr
-dead_grave 0x08 shift altgr
-parenleft 0x09 shift
-dead_abovedot 0x09 altgr
-abovedot 0x09 shift altgr
-parenright 0x0a shift
-dead_acute 0x0a altgr
-equal 0x0b shift
-dead_doubleacute 0x0b altgr
-doubleacute 0x0b shift altgr
-apostrophe 0x0c
-question 0x0c shift
-dead_diaeresis 0x0c altgr
-diaeresis 0x0c shift altgr
-plus 0x0d
-asterisk 0x0d shift
-dead_cedilla 0x0d altgr
-cedilla 0x0d shift altgr
-backslash 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-bar 0x11 altgr
-Lstroke 0x11 shift altgr
-EuroSign 0x12 altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-z 0x15 addupper
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-rightarrow 0x17 altgr
-idotless 0x17 shift altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-scaron 0x1a
-Scaron 0x1a shift
-division 0x1a altgr
-dstroke 0x1b
-Dstroke 0x1b shift
-multiply 0x1b altgr
-dead_macron 0x1b shift altgr
-ae 0x1e altgr
-AE 0x1e shift altgr
-ssharp 0x1f altgr
-section 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-bracketleft 0x21 altgr
-ordfeminine 0x21 shift altgr
-bracketright 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-lstroke 0x25 altgr
-Lstroke 0x26 altgr
-ccaron 0x27
-Ccaron 0x27 shift
-cacute 0x28
-Cacute 0x28 shift
-ssharp 0x28 altgr
-dead_cedilla 0x29
-notsign 0x29 altgr
-zcaron 0x2b
-Zcaron 0x2b shift
-currency 0x2b altgr
-y 0x2c addupper
-guillemotleft 0x2c altgr
-guillemotright 0x2d altgr
-cent 0x2e altgr
-copyright 0x2e shift altgr
-at 0x2f altgr
-braceleft 0x30 altgr
-braceright 0x31 altgr
-section 0x32 altgr
-masculine 0x32 shift altgr
-comma 0x33
-semicolon 0x33 shift
-horizconnector 0x33 altgr
-period 0x34
-colon 0x34 shift
-periodcentered 0x34 altgr
-minus 0x35
-underscore 0x35 shift
-dead_belowdot 0x35 altgr
diff --git a/keymaps/sv b/keymaps/sv
deleted file mode 100644
index 736d637..0000000
--- a/keymaps/sv
+++ /dev/null
@@ -1,82 +0,0 @@
-map 0x0000041d
-include common
-
-#
-# Top row
-#
-section 0x29
-onehalf 0x29 shift
-
-# 1
-exclam 0x2 shift
-
-# 2
-quotedbl 0x3 shift
-at 0x3 altgr
-
-# 3
-numbersign 0x4 shift
-sterling 0x4 altgr
-# 4
-currency 0x5 shift
-dollar 0x5 altgr
-# 5
-percent 0x6 shift
-# 6
-ampersand 0x7 shift
-# 7
-slash 0x8 shift
-braceleft 0x8 altgr
-# 8
-parenleft 0x9 shift
-bracketleft 0x9 altgr
-# 9
-parenright 0xa shift
-bracketright 0xa altgr
-# 0
-equal 0xb shift
-braceright 0xb altgr
-
-plus 0xc
-question 0xc shift
-backslash 0xc altgr
-
-acute 0xd
-dead_acute 0xd
-grave 0xd shift
-dead_grave 0xd shift
-
-#
-# QWERTY first row
-#
-EuroSign 0x12 altgr
-aring 0x1a 
-Aring 0x1a shift
-dead_diaeresis 0x1b 
-dead_circumflex 0x1b shift
-dead_tilde 0x1b altgr
-
-#
-# QWERTY second row
-#
-odiaeresis 0x27 
-Odiaeresis 0x27 shift
-adiaeresis 0x28 
-Adiaeresis 0x28 shift
-apostrophe 0x2b
-asterisk 0x2b shift
-
-#
-# QWERTY third row
-#
-less 0x56
-greater 0x56 shift
-bar 0x56 altgr
-mu 0x32 altgr
-comma 0x33
-semicolon 0x33 shift
-period 0x34
-colon 0x34 shift
-minus 0x35
-underscore 0x35 shift
-
diff --git a/keymaps/th b/keymaps/th
deleted file mode 100644
index b65b6da..0000000
--- a/keymaps/th
+++ /dev/null
@@ -1,131 +0,0 @@
-# generated from XKB map th
-include common
-map 0x41e
-exclam 0x02 shift
-Thai_lakkhangyao 0x02 altgr
-plus 0x02 shift altgr
-at 0x03 shift
-slash 0x03 altgr
-Thai_leknung 0x03 shift altgr
-numbersign 0x04 shift
-minus 0x04 altgr
-Thai_leksong 0x04 shift altgr
-dollar 0x05 shift
-Thai_phosamphao 0x05 altgr
-Thai_leksam 0x05 shift altgr
-percent 0x06 shift
-Thai_thothung 0x06 altgr
-Thai_leksi 0x06 shift altgr
-asciicircum 0x07 shift
-Thai_sarau 0x07 altgr
-Thai_sarauu 0x07 shift altgr
-ampersand 0x08 shift
-Thai_saraue 0x08 altgr
-Thai_baht 0x08 shift altgr
-asterisk 0x09 shift
-Thai_khokhwai 0x09 altgr
-Thai_lekha 0x09 shift altgr
-parenleft 0x0a shift
-Thai_totao 0x0a altgr
-Thai_lekhok 0x0a shift altgr
-parenright 0x0b shift
-Thai_chochan 0x0b altgr
-Thai_lekchet 0x0b shift altgr
-minus 0x0c
-underscore 0x0c shift
-Thai_khokhai 0x0c altgr
-Thai_lekpaet 0x0c shift altgr
-equal 0x0d
-plus 0x0d shift
-Thai_chochang 0x0d altgr
-Thai_lekkao 0x0d shift altgr
-Thai_maiyamok 0x10 altgr
-Thai_leksun 0x10 shift altgr
-Thai_saraaimaimalai 0x11 altgr
-quotedbl 0x11 shift altgr
-Thai_saraam 0x12 altgr
-Thai_dochada 0x12 shift altgr
-Thai_phophan 0x13 altgr
-Thai_thonangmontho 0x13 shift altgr
-Thai_saraa 0x14 altgr
-Thai_thothong 0x14 shift altgr
-Thai_maihanakat 0x15 altgr
-Thai_nikhahit 0x15 shift altgr
-Thai_saraii 0x16 altgr
-Thai_maitri 0x16 shift altgr
-Thai_rorua 0x17 altgr
-Thai_nonen 0x17 shift altgr
-Thai_nonu 0x18 altgr
-Thai_paiyannoi 0x18 shift altgr
-Thai_yoyak 0x19 altgr
-Thai_yoying 0x19 shift altgr
-bracketleft 0x1a
-braceleft 0x1a shift
-Thai_bobaimai 0x1a altgr
-Thai_thothan 0x1a shift altgr
-bracketright 0x1b
-braceright 0x1b shift
-Thai_loling 0x1b altgr
-comma 0x1b shift altgr
-Thai_fofan 0x1e altgr
-Thai_ru 0x1e shift altgr
-Thai_hohip 0x1f altgr
-Thai_khorakhang 0x1f shift altgr
-Thai_kokai 0x20 altgr
-Thai_topatak 0x20 shift altgr
-Thai_dodek 0x21 altgr
-Thai_sarao 0x21 shift altgr
-Thai_sarae 0x22 altgr
-Thai_chochoe 0x22 shift altgr
-Thai_maitho 0x23 altgr
-Thai_maitaikhu 0x23 shift altgr
-Thai_maiek 0x24 altgr
-Thai_maichattawa 0x24 shift altgr
-Thai_saraaa 0x25 altgr
-Thai_sorusi 0x25 shift altgr
-Thai_sosua 0x26 altgr
-Thai_sosala 0x26 shift altgr
-semicolon 0x27
-colon 0x27 shift
-Thai_wowaen 0x27 altgr
-Thai_soso 0x27 shift altgr
-apostrophe 0x28
-quotedbl 0x28 shift
-Thai_ngongu 0x28 altgr
-period 0x28 shift altgr
-grave 0x29
-asciitilde 0x29 shift
-underscore 0x29 altgr
-percent 0x29 shift altgr
-ISO_First_Group 0x2a shift
-backslash 0x2b
-bar 0x2b shift
-Thai_khokhuat 0x2b altgr
-Thai_khokhon 0x2b shift altgr
-Thai_phophung 0x2c altgr
-parenleft 0x2c shift altgr
-Thai_popla 0x2d altgr
-parenright 0x2d shift altgr
-Thai_saraae 0x2e altgr
-Thai_choching 0x2e shift altgr
-Thai_oang 0x2f altgr
-Thai_honokhuk 0x2f shift altgr
-Thai_sarai 0x30 altgr
-Thai_phinthu 0x30 shift altgr
-Thai_sarauee 0x31 altgr
-Thai_thanthakhat 0x31 shift altgr
-Thai_thothahan 0x32 altgr
-question 0x32 shift altgr
-comma 0x33
-less 0x33 shift
-Thai_moma 0x33 altgr
-Thai_thophuthao 0x33 shift altgr
-period 0x34
-greater 0x34 shift
-Thai_saraaimaimuan 0x34 altgr
-Thai_lochula 0x34 shift altgr
-slash 0x35
-question 0x35 shift
-Thai_fofa 0x35 altgr
-Thai_lu 0x35 shift altgr
-ISO_Last_Group 0x36 shift
diff --git a/keymaps/tr b/keymaps/tr
deleted file mode 100644
index 5650e1e..0000000
--- a/keymaps/tr
+++ /dev/null
@@ -1,123 +0,0 @@
-# generated from XKB map tr
-include common
-map 0x41f
-exclam 0x02 shift
-onesuperior 0x02 altgr
-exclamdown 0x02 shift altgr
-apostrophe 0x03 shift
-at 0x03 altgr
-oneeighth 0x03 shift altgr
-dead_circumflex 0x04 shift
-numbersign 0x04 altgr
-sterling 0x04 shift altgr
-plus 0x05 shift
-dollar 0x05 altgr
-percent 0x06 shift
-onehalf 0x06 altgr
-threeeighths 0x06 shift altgr
-ampersand 0x07 shift
-asciicircum 0x07 altgr
-fiveeighths 0x07 shift altgr
-slash 0x08 shift
-braceleft 0x08 altgr
-seveneighths 0x08 shift altgr
-parenleft 0x09 shift
-bracketleft 0x09 altgr
-trademark 0x09 shift altgr
-parenright 0x0a shift
-bracketright 0x0a altgr
-plusminus 0x0a shift altgr
-equal 0x0b shift
-braceright 0x0b altgr
-degree 0x0b shift altgr
-asterisk 0x0c
-question 0x0c shift
-backslash 0x0c altgr
-questiondown 0x0c shift altgr
-minus 0x0d
-underscore 0x0d shift
-dead_cedilla 0x0d altgr
-dead_ogonek 0x0d shift altgr
-at 0x10 altgr
-Greek_OMEGA 0x10 shift altgr
-lstroke 0x11 altgr
-Lstroke 0x11 shift altgr
-EuroSign 0x12 altgr
-paragraph 0x13 altgr
-registered 0x13 shift altgr
-tslash 0x14 altgr
-Tslash 0x14 shift altgr
-leftarrow 0x15 altgr
-yen 0x15 shift altgr
-downarrow 0x16 altgr
-uparrow 0x16 shift altgr
-idotless 0x17
-I 0x17 shift
-rightarrow 0x17 altgr
-oslash 0x18 altgr
-Ooblique 0x18 shift altgr
-thorn 0x19 altgr
-THORN 0x19 shift altgr
-gbreve 0x1a
-Gbreve 0x1a shift
-dead_diaeresis 0x1a altgr
-dead_abovering 0x1a shift altgr
-udiaeresis 0x1b
-Udiaeresis 0x1b shift
-asciitilde 0x1b altgr
-dead_macron 0x1b shift altgr
-ae 0x1e altgr
-AE 0x1e shift altgr
-ssharp 0x1f altgr
-section 0x1f shift altgr
-eth 0x20 altgr
-ETH 0x20 shift altgr
-dstroke 0x21 altgr
-ordfeminine 0x21 shift altgr
-eng 0x22 altgr
-ENG 0x22 shift altgr
-hstroke 0x23 altgr
-Hstroke 0x23 shift altgr
-kra 0x25 altgr
-ampersand 0x25 shift altgr
-lstroke 0x26 altgr
-Lstroke 0x26 shift altgr
-scedilla 0x27
-Scedilla 0x27 shift
-dead_acute 0x27 altgr
-dead_doubleacute 0x27 shift altgr
-i 0x28
-Iabovedot 0x28 shift
-dead_circumflex 0x28 altgr
-dead_caron 0x28 shift altgr
-backslash 0x29
-quotedbl 0x29 shift
-asciitilde 0x29 altgr
-comma 0x2b
-semicolon 0x2b shift
-bar 0x2b altgr
-dead_breve 0x2b shift altgr
-guillemotleft 0x2c altgr
-less 0x2c shift altgr
-guillemotright 0x2d altgr
-greater 0x2d shift altgr
-cent 0x2e altgr
-copyright 0x2e shift altgr
-leftdoublequotemark 0x2f altgr
-grave 0x2f shift altgr
-rightdoublequotemark 0x30 altgr
-apostrophe 0x30 shift altgr
-mu 0x32 altgr
-masculine 0x32 shift altgr
-odiaeresis 0x33
-Odiaeresis 0x33 shift
-less 0x33 altgr
-multiply 0x33 shift altgr
-ccedilla 0x34
-Ccedilla 0x34 shift
-greater 0x34 altgr
-division 0x34 shift altgr
-period 0x35
-colon 0x35 shift
-dead_belowdot 0x35 altgr
-dead_abovedot 0x35 shift altgr
diff --git a/kqemu.c b/kqemu.c
index b7a93b0..4783aa2 100644
--- a/kqemu.c
+++ b/kqemu.c
@@ -1,7 +1,7 @@
 /*
  *  KQEMU support
- * 
- *  Copyright (c) 2005 Fabrice Bellard
+ *
+ *  Copyright (c) 2005-2008 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -19,6 +19,7 @@
  */
 #include "config.h"
 #ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 #include <winioctl.h>
 #else
@@ -26,6 +27,9 @@
 #include <sys/mman.h>
 #include <sys/ioctl.h>
 #endif
+#ifdef HOST_SOLARIS
+#include <sys/ioccom.h>
+#endif
 #include <stdlib.h>
 #include <stdio.h>
 #include <stdarg.h>
@@ -36,6 +40,7 @@
 
 #include "cpu.h"
 #include "exec-all.h"
+#include "qemu-common.h"
 
 #ifdef USE_KQEMU
 
@@ -46,24 +51,14 @@
 #include <fcntl.h>
 #include "kqemu.h"
 
-/* compatibility stuff */
-#ifndef KQEMU_RET_SYSCALL
-#define KQEMU_RET_SYSCALL   0x0300 /* syscall insn */
-#endif
-#ifndef KQEMU_MAX_RAM_PAGES_TO_UPDATE
-#define KQEMU_MAX_RAM_PAGES_TO_UPDATE 512
-#define KQEMU_RAM_PAGES_UPDATE_ALL (KQEMU_MAX_RAM_PAGES_TO_UPDATE + 1)
-#endif
-#ifndef KQEMU_MAX_MODIFIED_RAM_PAGES
-#define KQEMU_MAX_MODIFIED_RAM_PAGES 512
-#endif
-
 #ifdef _WIN32
 #define KQEMU_DEVICE "\\\\.\\kqemu"
 #else
 #define KQEMU_DEVICE "/dev/kqemu"
 #endif
 
+static void qpi_init(void);
+
 #ifdef _WIN32
 #define KQEMU_INVALID_FD INVALID_HANDLE_VALUE
 HANDLE kqemu_fd = KQEMU_INVALID_FD;
@@ -79,14 +74,15 @@ int kqemu_fd = KQEMU_INVALID_FD;
    2 = kernel kqemu
 */
 int kqemu_allowed = 1;
-unsigned long *pages_to_flush;
+uint64_t *pages_to_flush;
 unsigned int nb_pages_to_flush;
-unsigned long *ram_pages_to_update;
+uint64_t *ram_pages_to_update;
 unsigned int nb_ram_pages_to_update;
-unsigned long *modified_ram_pages;
+uint64_t *modified_ram_pages;
 unsigned int nb_modified_ram_pages;
 uint8_t *modified_ram_pages_table;
-extern uint32_t **l1_phys_map;
+int qpi_io_memory;
+uint32_t kqemu_comm_base; /* physical address of the QPI communication page */
 
 #define cpuid(index, eax, ebx, ecx, edx) \
   asm volatile ("cpuid" \
@@ -126,9 +122,9 @@ static void kqemu_update_cpuid(CPUState *env)
        target cpus because they are important for user code. Strictly
        speaking, only SSE really matters because the OS must support
        it if the user code uses it. */
-    critical_features_mask = 
-        CPUID_CMOV | CPUID_CX8 | 
-        CPUID_FXSR | CPUID_MMX | CPUID_SSE | 
+    critical_features_mask =
+        CPUID_CMOV | CPUID_CX8 |
+        CPUID_FXSR | CPUID_MMX | CPUID_SSE |
         CPUID_SSE2 | CPUID_SEP;
     ext_features_mask = CPUID_EXT_SSE3 | CPUID_EXT_MONITOR;
     if (!is_cpuid_supported()) {
@@ -156,7 +152,7 @@ static void kqemu_update_cpuid(CPUState *env)
 
 int kqemu_init(CPUState *env)
 {
-    struct kqemu_init init;
+    struct kqemu_init kinit;
     int ret, version;
 #ifdef _WIN32
     DWORD temp;
@@ -170,13 +166,19 @@ int kqemu_init(CPUState *env)
                           FILE_SHARE_READ | FILE_SHARE_WRITE,
                           NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL,
                           NULL);
+    if (kqemu_fd == KQEMU_INVALID_FD) {
+        fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated: %lu\n",
+                KQEMU_DEVICE, GetLastError());
+        return -1;
+    }
 #else
     kqemu_fd = open(KQEMU_DEVICE, O_RDWR);
-#endif
     if (kqemu_fd == KQEMU_INVALID_FD) {
-        fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated\n", KQEMU_DEVICE);
+        fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated: %s\n",
+                KQEMU_DEVICE, strerror(errno));
         return -1;
     }
+#endif
     version = 0;
 #ifdef _WIN32
     DeviceIoControl(kqemu_fd, KQEMU_GET_VERSION, NULL, 0,
@@ -190,40 +192,36 @@ int kqemu_init(CPUState *env)
         goto fail;
     }
 
-    pages_to_flush = qemu_vmalloc(KQEMU_MAX_PAGES_TO_FLUSH * 
-                                  sizeof(unsigned long));
+    pages_to_flush = qemu_vmalloc(KQEMU_MAX_PAGES_TO_FLUSH *
+                                  sizeof(uint64_t));
     if (!pages_to_flush)
         goto fail;
 
-    ram_pages_to_update = qemu_vmalloc(KQEMU_MAX_RAM_PAGES_TO_UPDATE * 
-                                       sizeof(unsigned long));
+    ram_pages_to_update = qemu_vmalloc(KQEMU_MAX_RAM_PAGES_TO_UPDATE *
+                                       sizeof(uint64_t));
     if (!ram_pages_to_update)
         goto fail;
 
-    modified_ram_pages = qemu_vmalloc(KQEMU_MAX_MODIFIED_RAM_PAGES * 
-                                      sizeof(unsigned long));
+    modified_ram_pages = qemu_vmalloc(KQEMU_MAX_MODIFIED_RAM_PAGES *
+                                      sizeof(uint64_t));
     if (!modified_ram_pages)
         goto fail;
     modified_ram_pages_table = qemu_mallocz(phys_ram_size >> TARGET_PAGE_BITS);
     if (!modified_ram_pages_table)
         goto fail;
 
-    init.ram_base = phys_ram_base;
-    init.ram_size = phys_ram_size;
-    init.ram_dirty = phys_ram_dirty;
-    init.phys_to_ram_map = l1_phys_map;
-    init.pages_to_flush = pages_to_flush;
-#if KQEMU_VERSION >= 0x010200
-    init.ram_pages_to_update = ram_pages_to_update;
-#endif
-#if KQEMU_VERSION >= 0x010300
-    init.modified_ram_pages = modified_ram_pages;
-#endif
+    memset(&kinit, 0, sizeof(kinit)); /* set the paddings to zero */
+    kinit.ram_base = phys_ram_base;
+    kinit.ram_size = phys_ram_size;
+    kinit.ram_dirty = phys_ram_dirty;
+    kinit.pages_to_flush = pages_to_flush;
+    kinit.ram_pages_to_update = ram_pages_to_update;
+    kinit.modified_ram_pages = modified_ram_pages;
 #ifdef _WIN32
-    ret = DeviceIoControl(kqemu_fd, KQEMU_INIT, &init, sizeof(init),
+    ret = DeviceIoControl(kqemu_fd, KQEMU_INIT, &kinit, sizeof(kinit),
                           NULL, 0, &temp, NULL) == TRUE ? 0 : -1;
 #else
-    ret = ioctl(kqemu_fd, KQEMU_INIT, &init);
+    ret = ioctl(kqemu_fd, KQEMU_INIT, &kinit);
 #endif
     if (ret < 0) {
         fprintf(stderr, "Error %d while initializing QEMU acceleration layer - disabling it for now\n", ret);
@@ -236,6 +234,8 @@ int kqemu_init(CPUState *env)
     env->kqemu_enabled = kqemu_allowed;
     nb_pages_to_flush = 0;
     nb_ram_pages_to_update = 0;
+
+    qpi_init();
     return 0;
 }
 
@@ -266,7 +266,8 @@ void kqemu_set_notdirty(CPUState *env, ram_addr_t ram_addr)
 {
 #ifdef DEBUG
     if (loglevel & CPU_LOG_INT) {
-        fprintf(logfile, "kqemu_set_notdirty: addr=%08lx\n", ram_addr);
+        fprintf(logfile, "kqemu_set_notdirty: addr=%08lx\n", 
+                (unsigned long)ram_addr);
     }
 #endif
     /* we only track transitions to dirty state */
@@ -282,7 +283,7 @@ static void kqemu_reset_modified_ram_pages(void)
 {
     int i;
     unsigned long page_index;
-    
+
     for(i = 0; i < nb_modified_ram_pages; i++) {
         page_index = modified_ram_pages[i] >> TARGET_PAGE_BITS;
         modified_ram_pages_table[page_index] = 0;
@@ -308,12 +309,12 @@ void kqemu_modify_page(CPUState *env, ram_addr_t ram_addr)
         if (nb_modified_ram_pages >= KQEMU_MAX_MODIFIED_RAM_PAGES) {
             /* flush */
 #ifdef _WIN32
-            ret = DeviceIoControl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES, 
-                                  &nb_modified_ram_pages, 
+            ret = DeviceIoControl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES,
+                                  &nb_modified_ram_pages,
                                   sizeof(nb_modified_ram_pages),
                                   NULL, 0, &temp, NULL);
 #else
-            ret = ioctl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES, 
+            ret = ioctl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES,
                         &nb_modified_ram_pages);
 #endif
             kqemu_reset_modified_ram_pages();
@@ -321,6 +322,51 @@ void kqemu_modify_page(CPUState *env, ram_addr_t ram_addr)
     }
 }
 
+void kqemu_set_phys_mem(uint64_t start_addr, ram_addr_t size, 
+                        ram_addr_t phys_offset)
+{
+    struct kqemu_phys_mem kphys_mem1, *kphys_mem = &kphys_mem1;
+    uint64_t end;
+    int ret, io_index;
+
+    end = (start_addr + size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
+    start_addr &= TARGET_PAGE_MASK;
+    kphys_mem->phys_addr = start_addr;
+    kphys_mem->size = end - start_addr;
+    kphys_mem->ram_addr = phys_offset & TARGET_PAGE_MASK;
+    io_index = phys_offset & ~TARGET_PAGE_MASK;
+    switch(io_index) {
+    case IO_MEM_RAM:
+        kphys_mem->io_index = KQEMU_IO_MEM_RAM;
+        break;
+    case IO_MEM_ROM:
+        kphys_mem->io_index = KQEMU_IO_MEM_ROM;
+        break;
+    default:
+        if (qpi_io_memory == io_index) {
+            kphys_mem->io_index = KQEMU_IO_MEM_COMM;
+        } else {
+            kphys_mem->io_index = KQEMU_IO_MEM_UNASSIGNED;
+        }
+        break;
+    }
+#ifdef _WIN32
+    {
+        DWORD temp;
+        ret = DeviceIoControl(kqemu_fd, KQEMU_SET_PHYS_MEM, 
+                              kphys_mem, sizeof(*kphys_mem),
+                              NULL, 0, &temp, NULL) == TRUE ? 0 : -1;
+    }
+#else
+    ret = ioctl(kqemu_fd, KQEMU_SET_PHYS_MEM, kphys_mem);
+#endif
+    if (ret < 0) {
+        fprintf(stderr, "kqemu: KQEMU_SET_PHYS_PAGE error=%d: start_addr=0x%016" PRIx64 " size=0x%08lx phys_offset=0x%08lx\n",
+                ret, start_addr, 
+                (unsigned long)size, (unsigned long)phys_offset);
+    }
+}
+
 struct fpstate {
     uint16_t fpuc;
     uint16_t dummy1;
@@ -360,7 +406,7 @@ static void restore_native_fp_frstor(CPUState *env)
 {
     int fptag, i, j;
     struct fpstate fp1, *fp = &fp1;
-    
+
     fp->fpuc = env->fpuc;
     fp->fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
     fptag = 0;
@@ -380,7 +426,7 @@ static void restore_native_fp_frstor(CPUState *env)
     }
     asm volatile ("frstor %0" : "=m" (*fp));
 }
- 
+
 static void save_native_fp_fsave(CPUState *env)
 {
     int fptag, i, j;
@@ -466,41 +512,45 @@ static int do_syscall(CPUState *env,
                       struct kqemu_cpu_state *kenv)
 {
     int selector;
-    
+
     selector = (env->star >> 32) & 0xffff;
-#ifdef __x86_64__
+#ifdef TARGET_X86_64
     if (env->hflags & HF_LMA_MASK) {
+        int code64;
+
         env->regs[R_ECX] = kenv->next_eip;
         env->regs[11] = env->eflags;
 
+        code64 = env->hflags & HF_CS64_MASK;
+
         cpu_x86_set_cpl(env, 0);
-        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc, 
-                               0, 0xffffffff, 
-                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
+        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
+                               0, 0xffffffff,
+                               DESC_G_MASK | DESC_P_MASK |
                                DESC_S_MASK |
                                DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
-        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc, 
+        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
                                0, 0xffffffff,
                                DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
                                DESC_S_MASK |
                                DESC_W_MASK | DESC_A_MASK);
         env->eflags &= ~env->fmask;
-        if (env->hflags & HF_CS64_MASK)
+        if (code64)
             env->eip = env->lstar;
         else
             env->eip = env->cstar;
-    } else 
+    } else
 #endif
     {
         env->regs[R_ECX] = (uint32_t)kenv->next_eip;
-        
+
         cpu_x86_set_cpl(env, 0);
-        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc, 
-                           0, 0xffffffff, 
+        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
+                           0, 0xffffffff,
                                DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
                                DESC_S_MASK |
                                DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
-        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc, 
+        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
                                0, 0xffffffff,
                                DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
                                DESC_S_MASK |
@@ -597,7 +647,7 @@ void kqemu_record_dump(void)
         }
     }
     qsort(pr, nb_pc_records, sizeof(PCRecord *), pc_rec_cmp);
-    
+
     f = fopen("/tmp/kqemu.stats", "w");
     if (!f) {
         perror("/tmp/kqemu.stats");
@@ -608,9 +658,9 @@ void kqemu_record_dump(void)
     for(i = 0; i < nb_pc_records; i++) {
         r = pr[i];
         sum += r->count;
-        fprintf(f, "%08lx: %" PRId64 " %0.2f%% %0.2f%%\n", 
-                r->pc, 
-                r->count, 
+        fprintf(f, "%08lx: %" PRId64 " %0.2f%% %0.2f%%\n",
+                r->pc,
+                r->count,
                 (double)r->count / (double)total * 100.0,
                 (double)sum / (double)total * 100.0);
     }
@@ -621,6 +671,24 @@ void kqemu_record_dump(void)
 }
 #endif
 
+static inline void kqemu_load_seg(struct kqemu_segment_cache *ksc,
+                                  const SegmentCache *sc)
+{
+    ksc->selector = sc->selector;
+    ksc->flags = sc->flags;
+    ksc->limit = sc->limit;
+    ksc->base = sc->base;
+}
+
+static inline void kqemu_save_seg(SegmentCache *sc,
+                                  const struct kqemu_segment_cache *ksc)
+{
+    sc->selector = ksc->selector;
+    sc->flags = ksc->flags;
+    sc->limit = ksc->limit;
+    sc->base = ksc->base;
+}
+
 int kqemu_cpu_exec(CPUState *env)
 {
     struct kqemu_cpu_state kcpu_state, *kenv = &kcpu_state;
@@ -628,7 +696,6 @@ int kqemu_cpu_exec(CPUState *env)
 #ifdef CONFIG_PROFILER
     int64_t ti;
 #endif
-
 #ifdef _WIN32
     DWORD temp;
 #endif
@@ -642,35 +709,33 @@ int kqemu_cpu_exec(CPUState *env)
         cpu_dump_state(env, logfile, fprintf, 0);
     }
 #endif
-    memcpy(kenv->regs, env->regs, sizeof(kenv->regs));
+    for(i = 0; i < CPU_NB_REGS; i++)
+        kenv->regs[i] = env->regs[i];
     kenv->eip = env->eip;
     kenv->eflags = env->eflags;
-    memcpy(&kenv->segs, &env->segs, sizeof(env->segs));
-    memcpy(&kenv->ldt, &env->ldt, sizeof(env->ldt));
-    memcpy(&kenv->tr, &env->tr, sizeof(env->tr));
-    memcpy(&kenv->gdt, &env->gdt, sizeof(env->gdt));
-    memcpy(&kenv->idt, &env->idt, sizeof(env->idt));
+    for(i = 0; i < 6; i++)
+        kqemu_load_seg(&kenv->segs[i], &env->segs[i]);
+    kqemu_load_seg(&kenv->ldt, &env->ldt);
+    kqemu_load_seg(&kenv->tr, &env->tr);
+    kqemu_load_seg(&kenv->gdt, &env->gdt);
+    kqemu_load_seg(&kenv->idt, &env->idt);
     kenv->cr0 = env->cr[0];
     kenv->cr2 = env->cr[2];
     kenv->cr3 = env->cr[3];
     kenv->cr4 = env->cr[4];
     kenv->a20_mask = env->a20_mask;
-#if KQEMU_VERSION >= 0x010100
     kenv->efer = env->efer;
-#endif
-#if KQEMU_VERSION >= 0x010300
     kenv->tsc_offset = 0;
     kenv->star = env->star;
     kenv->sysenter_cs = env->sysenter_cs;
     kenv->sysenter_esp = env->sysenter_esp;
     kenv->sysenter_eip = env->sysenter_eip;
-#ifdef __x86_64__
+#ifdef TARGET_X86_64
     kenv->lstar = env->lstar;
     kenv->cstar = env->cstar;
     kenv->fmask = env->fmask;
     kenv->kernelgsbase = env->kernelgsbase;
 #endif
-#endif
     if (env->dr[7] & 0xff) {
         kenv->dr7 = env->dr[7];
         kenv->dr0 = env->dr[0];
@@ -684,15 +749,11 @@ int kqemu_cpu_exec(CPUState *env)
     cpl = (env->hflags & HF_CPL_MASK);
     kenv->cpl = cpl;
     kenv->nb_pages_to_flush = nb_pages_to_flush;
-#if KQEMU_VERSION >= 0x010200
     kenv->user_only = (env->kqemu_enabled == 1);
     kenv->nb_ram_pages_to_update = nb_ram_pages_to_update;
-#endif
     nb_ram_pages_to_update = 0;
-    
-#if KQEMU_VERSION >= 0x010300
     kenv->nb_modified_ram_pages = nb_modified_ram_pages;
-#endif
+
     kqemu_reset_modified_ram_pages();
 
     if (env->cpuid_features & CPUID_FXSR)
@@ -710,41 +771,30 @@ int kqemu_cpu_exec(CPUState *env)
         ret = -1;
     }
 #else
-#if KQEMU_VERSION >= 0x010100
     ioctl(kqemu_fd, KQEMU_EXEC, kenv);
     ret = kenv->retval;
-#else
-    ret = ioctl(kqemu_fd, KQEMU_EXEC, kenv);
-#endif
 #endif
     if (env->cpuid_features & CPUID_FXSR)
         save_native_fp_fxsave(env);
     else
         save_native_fp_fsave(env);
 
-    memcpy(env->regs, kenv->regs, sizeof(env->regs));
+    for(i = 0; i < CPU_NB_REGS; i++)
+        env->regs[i] = kenv->regs[i];
     env->eip = kenv->eip;
     env->eflags = kenv->eflags;
-    memcpy(env->segs, kenv->segs, sizeof(env->segs));
+    for(i = 0; i < 6; i++)
+        kqemu_save_seg(&env->segs[i], &kenv->segs[i]);
     cpu_x86_set_cpl(env, kenv->cpl);
-    memcpy(&env->ldt, &kenv->ldt, sizeof(env->ldt));
-#if 0
-    /* no need to restore that */
-    memcpy(env->tr, kenv->tr, sizeof(env->tr));
-    memcpy(env->gdt, kenv->gdt, sizeof(env->gdt));
-    memcpy(env->idt, kenv->idt, sizeof(env->idt));
-    env->a20_mask = kenv->a20_mask;
-#endif
+    kqemu_save_seg(&env->ldt, &kenv->ldt);
     env->cr[0] = kenv->cr0;
     env->cr[4] = kenv->cr4;
     env->cr[3] = kenv->cr3;
     env->cr[2] = kenv->cr2;
     env->dr[6] = kenv->dr6;
-#if KQEMU_VERSION >= 0x010300
-#ifdef __x86_64__
+#ifdef TARGET_X86_64
     env->kernelgsbase = kenv->kernelgsbase;
 #endif
-#endif
 
     /* flush pages as indicated by kqemu */
     if (kenv->nb_pages_to_flush >= KQEMU_FLUSH_ALL) {
@@ -761,13 +811,10 @@ int kqemu_cpu_exec(CPUState *env)
     kqemu_exec_count++;
 #endif
 
-#if KQEMU_VERSION >= 0x010200
     if (kenv->nb_ram_pages_to_update > 0) {
         cpu_tlb_update_dirty(env);
     }
-#endif
 
-#if KQEMU_VERSION >= 0x010300
     if (kenv->nb_modified_ram_pages > 0) {
         for(i = 0; i < kenv->nb_modified_ram_pages; i++) {
             unsigned long addr;
@@ -775,13 +822,12 @@ int kqemu_cpu_exec(CPUState *env)
             tb_invalidate_phys_page_range(addr, addr + TARGET_PAGE_SIZE, 0);
         }
     }
-#endif
 
     /* restore the hidden flags */
     {
         unsigned int new_hflags;
 #ifdef TARGET_X86_64
-        if ((env->hflags & HF_LMA_MASK) && 
+        if ((env->hflags & HF_LMA_MASK) &&
             (env->segs[R_CS].flags & DESC_L_MASK)) {
             /* long mode */
             new_hflags = HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK;
@@ -793,7 +839,7 @@ int kqemu_cpu_exec(CPUState *env)
                 >> (DESC_B_SHIFT - HF_CS32_SHIFT);
             new_hflags |= (env->segs[R_SS].flags & DESC_B_MASK)
                 >> (DESC_B_SHIFT - HF_SS32_SHIFT);
-            if (!(env->cr[0] & CR0_PE_MASK) || 
+            if (!(env->cr[0] & CR0_PE_MASK) ||
                    (env->eflags & VM_MASK) ||
                    !(env->hflags & HF_CS32_MASK)) {
                 /* XXX: try to avoid this test. The problem comes from the
@@ -803,13 +849,13 @@ int kqemu_cpu_exec(CPUState *env)
                    translate-i386.c. */
                 new_hflags |= HF_ADDSEG_MASK;
             } else {
-                new_hflags |= ((env->segs[R_DS].base | 
+                new_hflags |= ((env->segs[R_DS].base |
                                 env->segs[R_ES].base |
-                                env->segs[R_SS].base) != 0) << 
+                                env->segs[R_SS].base) != 0) <<
                     HF_ADDSEG_SHIFT;
             }
         }
-        env->hflags = (env->hflags & 
+        env->hflags = (env->hflags &
            ~(HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK | HF_ADDSEG_MASK)) |
             new_hflags;
     }
@@ -820,7 +866,7 @@ int kqemu_cpu_exec(CPUState *env)
         env->hflags |= HF_OSFXSR_MASK;
     else
         env->hflags &= ~HF_OSFXSR_MASK;
-        
+
 #ifdef DEBUG
     if (loglevel & CPU_LOG_INT) {
         fprintf(logfile, "kqemu: kqemu_cpu_exec: ret=0x%x\n", ret);
@@ -829,7 +875,7 @@ int kqemu_cpu_exec(CPUState *env)
     if (ret == KQEMU_RET_SYSCALL) {
         /* syscall instruction */
         return do_syscall(env, kenv);
-    } else 
+    } else
     if ((ret & 0xff00) == KQEMU_RET_INT) {
         env->exception_index = ret & 0xff;
         env->error_code = 0;
@@ -840,7 +886,7 @@ int kqemu_cpu_exec(CPUState *env)
 #endif
 #ifdef DEBUG
         if (loglevel & CPU_LOG_INT) {
-            fprintf(logfile, "kqemu: interrupt v=%02x:\n", 
+            fprintf(logfile, "kqemu: interrupt v=%02x:\n",
                     env->exception_index);
             cpu_dump_state(env, logfile, fprintf, 0);
         }
@@ -872,7 +918,7 @@ int kqemu_cpu_exec(CPUState *env)
         }
 #endif
         return 0;
-    } else if (ret == KQEMU_RET_SOFTMMU) { 
+    } else if (ret == KQEMU_RET_SOFTMMU) {
 #ifdef CONFIG_PROFILER
         {
             unsigned long pc = env->eip + env->segs[R_CS].base;
@@ -895,11 +941,85 @@ int kqemu_cpu_exec(CPUState *env)
 
 void kqemu_cpu_interrupt(CPUState *env)
 {
-#if defined(_WIN32) && KQEMU_VERSION >= 0x010101
-    /* cancelling the I/O request causes KQEMU to finish executing the 
+#if defined(_WIN32)
+    /* cancelling the I/O request causes KQEMU to finish executing the
        current block and successfully returning. */
     CancelIo(kqemu_fd);
 #endif
 }
 
+/* 
+   QEMU paravirtualization interface. The current interface only
+   allows to modify the IF and IOPL flags when running in
+   kqemu.
+
+   At this point it is not very satisfactory. I leave it for reference
+   as it adds little complexity.
+*/
+
+#define QPI_COMM_PAGE_PHYS_ADDR 0xff000000
+
+static uint32_t qpi_mem_readb(void *opaque, target_phys_addr_t addr)
+{
+    return 0;
+}
+
+static uint32_t qpi_mem_readw(void *opaque, target_phys_addr_t addr)
+{
+    return 0;
+}
+
+static void qpi_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
+{
+}
+
+static void qpi_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
+{
+}
+
+static uint32_t qpi_mem_readl(void *opaque, target_phys_addr_t addr)
+{
+    CPUState *env;
+
+    env = cpu_single_env;
+    if (!env)
+        return 0;
+    return env->eflags & (IF_MASK | IOPL_MASK);
+}
+
+/* Note: after writing to this address, the guest code must make sure
+   it is exiting the current TB. pushf/popf can be used for that
+   purpose. */
+static void qpi_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
+{
+    CPUState *env;
+
+    env = cpu_single_env;
+    if (!env)
+        return;
+    env->eflags = (env->eflags & ~(IF_MASK | IOPL_MASK)) | 
+        (val & (IF_MASK | IOPL_MASK));
+}
+
+static CPUReadMemoryFunc *qpi_mem_read[3] = {
+    qpi_mem_readb,
+    qpi_mem_readw,
+    qpi_mem_readl,
+};
+
+static CPUWriteMemoryFunc *qpi_mem_write[3] = {
+    qpi_mem_writeb,
+    qpi_mem_writew,
+    qpi_mem_writel,
+};
+
+static void qpi_init(void)
+{
+    kqemu_comm_base = 0xff000000 | 1;
+    qpi_io_memory = cpu_register_io_memory(0, 
+                                           qpi_mem_read, 
+                                           qpi_mem_write, NULL);
+    cpu_register_physical_memory(kqemu_comm_base & ~0xfff, 
+                                 0x1000, qpi_io_memory);
+}
 #endif
diff --git a/kqemu.h b/kqemu.h
index 892e335..ed25c75 100644
--- a/kqemu.h
+++ b/kqemu.h
@@ -1,7 +1,7 @@
 /*
  * KQEMU header
  * 
- * Copyright (c) 2004-2006 Fabrice Bellard
+ * Copyright (c) 2004-2008 Fabrice Bellard
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -24,25 +24,27 @@
 #ifndef KQEMU_H
 #define KQEMU_H
 
-#define KQEMU_VERSION 0x010300
+#if defined(__i386__)
+#define KQEMU_PAD32(x) x
+#else
+#define KQEMU_PAD32(x)
+#endif
+
+#define KQEMU_VERSION 0x010400
 
 struct kqemu_segment_cache {
-    uint32_t selector;
-    unsigned long base;
-    uint32_t limit;
+    uint16_t selector;
+    uint16_t padding1;
     uint32_t flags;
+    uint64_t base;
+    uint32_t limit;
+    uint32_t padding2;
 };
 
 struct kqemu_cpu_state {
-#ifdef __x86_64__
-    unsigned long regs[16];
-#else
-    unsigned long regs[8];
-#endif
-    unsigned long eip;
-    unsigned long eflags;
-
-    uint32_t dummy0, dummy1, dumm2, dummy3, dummy4;
+    uint64_t regs[16];
+    uint64_t eip;
+    uint64_t eflags;
 
     struct kqemu_segment_cache segs[6]; /* selector values */
     struct kqemu_segment_cache ldt;
@@ -50,63 +52,81 @@ struct kqemu_cpu_state {
     struct kqemu_segment_cache gdt; /* only base and limit are used */
     struct kqemu_segment_cache idt; /* only base and limit are used */
 
-    unsigned long cr0;
-    unsigned long dummy5;
-    unsigned long cr2;
-    unsigned long cr3;
-    unsigned long cr4;
-    uint32_t a20_mask;
+    uint64_t cr0;
+    uint64_t cr2;
+    uint64_t cr3;
+    uint64_t cr4;
+    uint64_t a20_mask;
 
     /* sysenter registers */
-    uint32_t sysenter_cs;
-    uint32_t sysenter_esp;
-    uint32_t sysenter_eip;
-    uint64_t efer __attribute__((aligned(8)));
+    uint64_t sysenter_cs;
+    uint64_t sysenter_esp;
+    uint64_t sysenter_eip;
+    uint64_t efer;
     uint64_t star;
-#ifdef __x86_64__
-    unsigned long lstar;
-    unsigned long cstar;
-    unsigned long fmask;
-    unsigned long kernelgsbase;
-#endif
+    
+    uint64_t lstar;
+    uint64_t cstar;
+    uint64_t fmask;
+    uint64_t kernelgsbase;
+
     uint64_t tsc_offset;
 
-    unsigned long dr0;
-    unsigned long dr1;
-    unsigned long dr2;
-    unsigned long dr3;
-    unsigned long dr6;
-    unsigned long dr7;
+    uint64_t dr0;
+    uint64_t dr1;
+    uint64_t dr2;
+    uint64_t dr3;
+    uint64_t dr6;
+    uint64_t dr7;
 
     uint8_t cpl;
     uint8_t user_only;
+    uint16_t padding1;
 
     uint32_t error_code; /* error_code when exiting with an exception */
-    unsigned long next_eip; /* next eip value when exiting with an interrupt */
-    unsigned int nb_pages_to_flush; /* number of pages to flush,
+    uint64_t next_eip; /* next eip value when exiting with an interrupt */
+    uint32_t nb_pages_to_flush; /* number of pages to flush,
                                        KQEMU_FLUSH_ALL means full flush */
 #define KQEMU_MAX_PAGES_TO_FLUSH 512
 #define KQEMU_FLUSH_ALL (KQEMU_MAX_PAGES_TO_FLUSH + 1)
 
-    long retval;
+    int32_t retval;
 
     /* number of ram_dirty entries to update */
-    unsigned int nb_ram_pages_to_update; 
+    uint32_t nb_ram_pages_to_update; 
 #define KQEMU_MAX_RAM_PAGES_TO_UPDATE 512
 #define KQEMU_RAM_PAGES_UPDATE_ALL (KQEMU_MAX_RAM_PAGES_TO_UPDATE + 1)
 
 #define KQEMU_MAX_MODIFIED_RAM_PAGES 512
-    unsigned int nb_modified_ram_pages;
+    uint32_t nb_modified_ram_pages;
 };
 
 struct kqemu_init {
     uint8_t *ram_base; /* must be page aligned */
-    unsigned long ram_size; /* must be multiple of 4 KB */
+    KQEMU_PAD32(uint32_t padding1;)
+    uint64_t ram_size; /* must be multiple of 4 KB */
     uint8_t *ram_dirty; /* must be page aligned */
-    uint32_t **phys_to_ram_map; /* must be page aligned */
-    unsigned long *pages_to_flush; /* must be page aligned */
-    unsigned long *ram_pages_to_update; /* must be page aligned */
-    unsigned long *modified_ram_pages; /* must be page aligned */
+    KQEMU_PAD32(uint32_t padding2;)
+    uint64_t *pages_to_flush; /* must be page aligned */
+    KQEMU_PAD32(uint32_t padding4;)
+    uint64_t *ram_pages_to_update; /* must be page aligned */
+    KQEMU_PAD32(uint32_t padding5;)
+    uint64_t *modified_ram_pages; /* must be page aligned */
+    KQEMU_PAD32(uint32_t padding6;)
+};
+
+#define KQEMU_IO_MEM_RAM        0
+#define KQEMU_IO_MEM_ROM        1
+#define KQEMU_IO_MEM_COMM       2 /* kqemu communication page */
+#define KQEMU_IO_MEM_UNASSIGNED 3 /* any device: return to application */
+
+struct kqemu_phys_mem {
+    uint64_t phys_addr; /* physical address range: phys_addr,
+                           phys_addr + size */
+    uint64_t size;        
+    uint64_t ram_addr;  /* corresponding ram address */
+    uint32_t io_index;  /* memory type: see KQEMU_IO_MEM_xxx */
+    uint32_t padding1;
 };
 
 #define KQEMU_RET_ABORT    (-1)
@@ -122,11 +142,13 @@ struct kqemu_init {
 #define KQEMU_INIT             CTL_CODE(FILE_DEVICE_UNKNOWN, 2, METHOD_BUFFERED, FILE_WRITE_ACCESS)
 #define KQEMU_GET_VERSION      CTL_CODE(FILE_DEVICE_UNKNOWN, 3, METHOD_BUFFERED, FILE_READ_ACCESS)
 #define KQEMU_MODIFY_RAM_PAGES CTL_CODE(FILE_DEVICE_UNKNOWN, 4, METHOD_BUFFERED, FILE_WRITE_ACCESS)
+#define KQEMU_SET_PHYS_MEM     CTL_CODE(FILE_DEVICE_UNKNOWN, 5, METHOD_BUFFERED, FILE_WRITE_ACCESS)
 #else
 #define KQEMU_EXEC             _IOWR('q', 1, struct kqemu_cpu_state)
 #define KQEMU_INIT             _IOW('q', 2, struct kqemu_init)
 #define KQEMU_GET_VERSION      _IOR('q', 3, int)
 #define KQEMU_MODIFY_RAM_PAGES _IOW('q', 4, int)
+#define KQEMU_SET_PHYS_MEM     _IOW('q', 5, struct kqemu_phys_mem)
 #endif
 
 #endif /* KQEMU_H */
diff --git a/loader.c b/loader.c
index 606ca10..84ed123 100644
--- a/loader.c
+++ b/loader.c
@@ -21,14 +21,17 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "cpu.h"
 #include "disas.h"
+#include "sysemu.h"
+#include "uboot_image.h"
 
 /* return the size or -1 if error */
 int get_image_size(const char *filename)
 {
     int fd, size;
-    fd = open(filename, O_BINARY | O_RDONLY | O_BINARY);
+    fd = open(filename, O_RDONLY | O_BINARY);
     if (fd < 0)
         return -1;
     size = lseek(fd, 0, SEEK_END);
@@ -37,6 +40,7 @@ int get_image_size(const char *filename)
 }
 
 /* return the size or -1 if error */
+/* deprecated, because caller does not specify buffer size! */
 int load_image(const char *filename, uint8_t *addr)
 {
     int fd, size;
@@ -53,6 +57,84 @@ int load_image(const char *filename, uint8_t *addr)
     return size;
 }
 
+/* return the amount read, just like fread.  0 may mean error or eof */
+int fread_targphys(target_phys_addr_t dst_addr, size_t nbytes, FILE *f)
+{
+    uint8_t buf[4096];
+    target_phys_addr_t dst_begin = dst_addr;
+    size_t want, did;
+
+    while (nbytes) {
+	want = nbytes > sizeof(buf) ? sizeof(buf) : nbytes;
+	did = fread(buf, 1, want, f);
+	if (did != want) break;
+
+	cpu_physical_memory_write_rom(dst_addr, buf, did);
+	dst_addr += did;
+	nbytes -= did;
+    }
+    return dst_addr - dst_begin;
+}
+
+/* returns 0 on error, 1 if ok */
+int fread_targphys_ok(target_phys_addr_t dst_addr, size_t nbytes, FILE *f)
+{
+    return fread_targphys(dst_addr, nbytes, f) == nbytes;
+}
+
+/* read()-like version */
+int read_targphys(int fd, target_phys_addr_t dst_addr, size_t nbytes)
+{
+    uint8_t buf[4096];
+    target_phys_addr_t dst_begin = dst_addr;
+    size_t want, did;
+
+    while (nbytes) {
+	want = nbytes > sizeof(buf) ? sizeof(buf) : nbytes;
+	did = read(fd, buf, want);
+	if (did != want) break;
+
+	cpu_physical_memory_write_rom(dst_addr, buf, did);
+	dst_addr += did;
+	nbytes -= did;
+    }
+    return dst_addr - dst_begin;
+}
+
+/* return the size or -1 if error */
+int load_image_targphys(const char *filename,
+			target_phys_addr_t addr, int max_sz)
+{
+    FILE *f;
+    size_t got;
+
+    f = fopen(filename, "rb");
+    if (!f) return -1;
+
+    got = fread_targphys(addr, max_sz, f);
+    if (ferror(f)) { fclose(f); return -1; }
+    fclose(f);
+
+    return got;
+}
+
+void pstrcpy_targphys(target_phys_addr_t dest, int buf_size,
+                      const char *source)
+{
+    static const uint8_t nul_byte = 0;
+    const char *nulp;
+
+    if (buf_size <= 0) return;
+    nulp = memchr(source, 0, buf_size);
+    if (nulp) {
+	cpu_physical_memory_write_rom(dest, (uint8_t *)source,
+                                      (nulp - source) + 1);
+    } else {
+	cpu_physical_memory_write_rom(dest, (uint8_t *)source, buf_size - 1);
+	cpu_physical_memory_write_rom(dest, &nul_byte, 1);
+    }
+}
+
 /* A.OUT loader */
 
 struct exec
@@ -103,7 +185,7 @@ static void bswap_ahdr(struct exec *e)
      : (_N_SEGMENT_ROUND (_N_TXTENDADDR(x))))
 
 
-int load_aout(const char *filename, uint8_t *addr)
+int load_aout(const char *filename, target_phys_addr_t addr, int max_sz)
 {
     int fd, size, ret;
     struct exec e;
@@ -124,17 +206,21 @@ int load_aout(const char *filename, uint8_t *addr)
     case ZMAGIC:
     case QMAGIC:
     case OMAGIC:
+        if (e.a_text + e.a_data > max_sz)
+            goto fail;
 	lseek(fd, N_TXTOFF(e), SEEK_SET);
-	size = read(fd, addr, e.a_text + e.a_data);
+	size = read_targphys(fd, addr, e.a_text + e.a_data);
 	if (size < 0)
 	    goto fail;
 	break;
     case NMAGIC:
+        if (N_DATADDR(e) + e.a_data > max_sz)
+            goto fail;
 	lseek(fd, N_TXTOFF(e), SEEK_SET);
-	size = read(fd, addr, e.a_text);
+	size = read_targphys(fd, addr, e.a_text);
 	if (size < 0)
 	    goto fail;
-	ret = read(fd, addr + N_DATADDR(e), e.a_data);
+	ret = read_targphys(fd, addr + N_DATADDR(e), e.a_data);
 	if (ret < 0)
 	    goto fail;
 	size += ret;
@@ -172,6 +258,7 @@ static void *load_at(int fd, int offset, int size)
 
 #define SZ		32
 #define elf_word        uint32_t
+#define elf_sword        int32_t
 #define bswapSZs	bswap32s
 #include "elf_ops.h"
 
@@ -181,6 +268,7 @@ static void *load_at(int fd, int offset, int size)
 #undef elf_sym
 #undef elf_note
 #undef elf_word
+#undef elf_sword
 #undef bswapSZs
 #undef SZ
 #define elfhdr		elf64_hdr
@@ -189,15 +277,16 @@ static void *load_at(int fd, int offset, int size)
 #define elf_shdr	elf64_shdr
 #define elf_sym		elf64_sym
 #define elf_word        uint64_t
+#define elf_sword        int64_t
 #define bswapSZs	bswap64s
 #define SZ		64
 #include "elf_ops.h"
 
 /* return < 0 if error, otherwise the number of bytes loaded in memory */
 int load_elf(const char *filename, int64_t virt_to_phys_addend,
-             uint64_t *pentry)
+             uint64_t *pentry, uint64_t *lowaddr, uint64_t *highaddr)
 {
-    int fd, data_order, must_swab, ret;
+    int fd, data_order, host_data_order, must_swab, ret;
     uint8_t e_ident[EI_NIDENT];
 
     fd = open(filename, O_RDONLY | O_BINARY);
@@ -219,11 +308,21 @@ int load_elf(const char *filename, int64_t virt_to_phys_addend,
 #endif
     must_swab = data_order != e_ident[EI_DATA];
 
+#ifdef TARGET_WORDS_BIGENDIAN
+    host_data_order = ELFDATA2MSB;
+#else
+    host_data_order = ELFDATA2LSB;
+#endif
+    if (host_data_order != e_ident[EI_DATA])
+        return -1;
+
     lseek(fd, 0, SEEK_SET);
     if (e_ident[EI_CLASS] == ELFCLASS64) {
-        ret = load_elf64(fd, virt_to_phys_addend, must_swab, pentry);
+        ret = load_elf64(fd, virt_to_phys_addend, must_swab, pentry,
+                         lowaddr, highaddr);
     } else {
-        ret = load_elf32(fd, virt_to_phys_addend, must_swab, pentry);
+        ret = load_elf32(fd, virt_to_phys_addend, must_swab, pentry,
+                         lowaddr, highaddr);
     }
 
     close(fd);
@@ -233,3 +332,81 @@ int load_elf(const char *filename, int64_t virt_to_phys_addend,
     close(fd);
     return -1;
 }
+
+static void bswap_uboot_header(uboot_image_header_t *hdr)
+{
+#ifndef WORDS_BIGENDIAN
+    bswap32s(&hdr->ih_magic);
+    bswap32s(&hdr->ih_hcrc);
+    bswap32s(&hdr->ih_time);
+    bswap32s(&hdr->ih_size);
+    bswap32s(&hdr->ih_load);
+    bswap32s(&hdr->ih_ep);
+    bswap32s(&hdr->ih_dcrc);
+#endif
+}
+
+/* Load a U-Boot image.  */
+int load_uboot(const char *filename, target_ulong *ep, int *is_linux)
+{
+
+    int fd;
+    int size;
+    uboot_image_header_t h;
+    uboot_image_header_t *hdr = &h;
+    uint8_t *data = NULL;
+
+    fd = open(filename, O_RDONLY | O_BINARY);
+    if (fd < 0)
+        return -1;
+
+    size = read(fd, hdr, sizeof(uboot_image_header_t));
+    if (size < 0)
+        goto fail;
+
+    bswap_uboot_header(hdr);
+
+    if (hdr->ih_magic != IH_MAGIC)
+        goto fail;
+
+    /* TODO: Implement Multi-File images.  */
+    if (hdr->ih_type == IH_TYPE_MULTI) {
+        fprintf(stderr, "Unable to load multi-file u-boot images\n");
+        goto fail;
+    }
+
+    /* TODO: Implement compressed images.  */
+    if (hdr->ih_comp != IH_COMP_NONE) {
+        fprintf(stderr, "Unable to load compressed u-boot images\n");
+        goto fail;
+    }
+
+    /* TODO: Check CPU type.  */
+    if (is_linux) {
+        if (hdr->ih_type == IH_TYPE_KERNEL && hdr->ih_os == IH_OS_LINUX)
+            *is_linux = 1;
+        else
+            *is_linux = 0;
+    }
+
+    *ep = hdr->ih_ep;
+    data = qemu_malloc(hdr->ih_size);
+    if (!data)
+        goto fail;
+
+    if (read(fd, data, hdr->ih_size) != hdr->ih_size) {
+        fprintf(stderr, "Error reading file\n");
+        goto fail;
+    }
+
+    cpu_physical_memory_write_rom(hdr->ih_load, data, hdr->ih_size);
+
+    return hdr->ih_size;
+
+fail:
+    if (data)
+        qemu_free(data);
+    close(fd);
+    return -1;
+}
+
diff --git a/monitor.c b/monitor.c
index 600a173..f0f38a7 100644
--- a/monitor.c
+++ b/monitor.c
@@ -21,9 +21,22 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "hw/hw.h"
+#include "hw/usb.h"
+
+#include "hw/pc.h"
+#include "hw/pci.h"
+#include "gdbstub.h"
+#include "net.h"
+#include "qemu-char.h"
+#include "sysemu.h"
+#include "console.h"
+#include "block.h"
+#include "audio/audio.h"
 #include "disas.h"
+#include "cpu-defs.h"
 #include <dirent.h>
+#include "qemu-timer.h"
 
 //#define DEBUG
 //#define DEBUG_COMPLETION
@@ -49,17 +62,19 @@
 typedef struct term_cmd_t {
     const char *name;
     const char *args_type;
-    void (*handler)();
+    void *handler;
     const char *params;
     const char *help;
 } term_cmd_t;
 
-static CharDriverState *monitor_hd;
+#define MAX_MON 4
+static CharDriverState *monitor_hd[MAX_MON];
+static int hide_banner;
 
 static term_cmd_t term_cmds[];
 static term_cmd_t info_cmds[];
 
-static char term_outbuf[1024];
+static uint8_t term_outbuf[1024];
 static int term_outbuf_index;
 
 static void monitor_start_input(void);
@@ -68,8 +83,11 @@ CPUState *mon_cpu = NULL;
 
 void term_flush(void)
 {
+    int i;
     if (term_outbuf_index > 0) {
-        qemu_chr_write(monitor_hd, (uint8_t*)term_outbuf, term_outbuf_index);
+        for (i = 0; i < MAX_MON; i++)
+            if (monitor_hd[i] && monitor_hd[i]->focus == 0)
+                qemu_chr_write(monitor_hd[i], term_outbuf, term_outbuf_index);
         term_outbuf_index = 0;
     }
 }
@@ -77,7 +95,7 @@ void term_flush(void)
 /* flush at every end of line or if the buffer is full */
 void term_puts(const char *str)
 {
-    int c;
+    char c;
     for(;;) {
         c = *str++;
         if (c == '\0')
@@ -106,6 +124,33 @@ void term_printf(const char *fmt, ...)
     va_end(ap);
 }
 
+void term_print_filename(const char *filename)
+{
+    int i;
+
+    for (i = 0; filename[i]; i++) {
+	switch (filename[i]) {
+	case ' ':
+	case '"':
+	case '\\':
+	    term_printf("\\%c", filename[i]);
+	    break;
+	case '\t':
+	    term_printf("\\t");
+	    break;
+	case '\r':
+	    term_printf("\\r");
+	    break;
+	case '\n':
+	    term_printf("\\n");
+	    break;
+	default:
+	    term_printf("%c", filename[i]);
+	    break;
+	}
+    }
+}
+
 static int monitor_fprintf(FILE *stream, const char *fmt, ...)
 {
     va_list ap;
@@ -167,20 +212,22 @@ static void do_help(const char *name)
     help_cmd(name);
 }
 
-static void do_commit(void)
+static void do_commit(const char *device)
 {
-    int i;
+    int i, all_devices;
 
-    for (i = 0; i < MAX_DISKS; i++) {
-        if (bs_table[i]) {
-            bdrv_commit(bs_table[i]);
-        }
+    all_devices = !strcmp(device, "all");
+    for (i = 0; i < nb_drives; i++) {
+            if (all_devices ||
+                !strcmp(bdrv_get_device_name(drives_table[i].bdrv), device))
+                bdrv_commit(drives_table[i].bdrv);
     }
 }
 
 static void do_info(const char *item)
 {
     term_cmd_t *cmd;
+    void (*handler)(void);
 
     if (!item)
         goto help;
@@ -192,7 +239,8 @@ static void do_info(const char *item)
     help_cmd("info");
     return;
  found:
-    cmd->handler();
+    handler = cmd->handler;
+    handler();
 }
 
 static void do_info_version(void)
@@ -200,13 +248,24 @@ static void do_info_version(void)
   term_printf("%s\n", QEMU_VERSION);
 }
 
+static void do_info_name(void)
+{
+    if (qemu_name)
+        term_printf("%s\n", qemu_name);
+}
+
 static void do_info_block(void)
 {
     bdrv_info();
 }
 
+static void do_info_blockstats(void)
+{
+    bdrv_info_stats();
+}
+
 /* get the current CPU defined by the user */
-int mon_set_cpu(int cpu_index)
+static int mon_set_cpu(int cpu_index)
 {
     CPUState *env;
 
@@ -219,7 +278,7 @@ int mon_set_cpu(int cpu_index)
     return -1;
 }
 
-CPUState *mon_get_cpu(void)
+static CPUState *mon_get_cpu(void)
 {
     if (!mon_cpu) {
         mon_set_cpu(0);
@@ -255,17 +314,15 @@ static void do_info_cpus(void)
                     env->cpu_index);
 #if defined(TARGET_I386)
         term_printf(" pc=0x" TARGET_FMT_lx, env->eip + env->segs[R_CS].base);
-        if (env->hflags & HF_HALTED_MASK)
-            term_printf(" (halted)");
 #elif defined(TARGET_PPC)
         term_printf(" nip=0x" TARGET_FMT_lx, env->nip);
-        if (env->halted)
-            term_printf(" (halted)");
 #elif defined(TARGET_SPARC)
         term_printf(" pc=0x" TARGET_FMT_lx " npc=0x" TARGET_FMT_lx, env->pc, env->npc);
+#elif defined(TARGET_MIPS)
+        term_printf(" PC=0x" TARGET_FMT_lx, env->active_tc.PC);
+#endif
         if (env->halted)
             term_printf(" (halted)");
-#endif
         term_printf("\n");
     }
 }
@@ -296,6 +353,17 @@ static void do_info_history (void)
     }
 }
 
+#if defined(TARGET_PPC)
+/* XXX: not implemented in other targets */
+static void do_info_cpu_stats (void)
+{
+    CPUState *env;
+
+    env = mon_get_cpu();
+    cpu_dump_statistics(env, NULL, &monitor_fprintf, 0);
+}
+#endif
+
 static void do_quit(void)
 {
     exit(0);
@@ -331,28 +399,50 @@ static void do_eject(int force, const char *filename)
     eject_device(bs, force);
 }
 
-static void do_change(const char *device, const char *filename)
+static void do_change_block(const char *device, const char *filename, const char *fmt)
 {
     BlockDriverState *bs;
-    int i;
-    char password[256];
+    BlockDriver *drv = NULL;
 
     bs = bdrv_find(device);
     if (!bs) {
         term_printf("device not found\n");
         return;
     }
+    if (fmt) {
+        drv = bdrv_find_format(fmt);
+        if (!drv) {
+            term_printf("invalid format %s\n", fmt);
+            return;
+        }
+    }
     if (eject_device(bs, 0) < 0)
         return;
-    bdrv_open(bs, filename, 0);
-    if (bdrv_is_encrypted(bs)) {
-        term_printf("%s is encrypted.\n", device);
-        for(i = 0; i < 3; i++) {
-            monitor_readline("Password: ", 1, password, sizeof(password));
-            if (bdrv_set_key(bs, password) == 0)
-                break;
-            term_printf("invalid password\n");
-        }
+    bdrv_open2(bs, filename, 0, drv);
+    qemu_key_check(bs, filename);
+}
+
+static void do_change_vnc(const char *target)
+{
+    if (strcmp(target, "passwd") == 0 ||
+	strcmp(target, "password") == 0) {
+	char password[9];
+	monitor_readline("Password: ", 1, password, sizeof(password)-1);
+	password[sizeof(password)-1] = '\0';
+	if (vnc_display_password(NULL, password) < 0)
+	    term_printf("could not set VNC server password\n");
+    } else {
+	if (vnc_display_open(NULL, target) < 0)
+	    term_printf("could not start VNC server on %s\n", target);
+    }
+}
+
+static void do_change(const char *device, const char *target, const char *fmt)
+{
+    if (strcmp(device, "vnc") == 0) {
+	do_change_vnc(target);
+    } else {
+	do_change_block(device, target, fmt);
     }
 }
 
@@ -361,6 +451,11 @@ static void do_screen_dump(const char *filename)
     vga_hw_screen_dump(filename);
 }
 
+static void do_logfile(const char *filename)
+{
+    cpu_set_log_filename(filename);
+}
+
 static void do_log(const char *items)
 {
     int mask;
@@ -377,18 +472,6 @@ static void do_log(const char *items)
     cpu_set_log(mask);
 }
 
-static void do_savevm(const char *filename)
-{
-    if (qemu_savevm(filename) < 0)
-        term_printf("I/O error when saving VM to '%s'\n", filename);
-}
-
-static void do_loadvm(const char *filename)
-{
-    if (qemu_loadvm(filename) < 0)
-        term_printf("I/O error when loading VM from '%s'\n", filename);
-}
-
 static void do_stop(void)
 {
     vm_stop(EXCP_INTERRUPT);
@@ -400,14 +483,14 @@ static void do_cont(void)
 }
 
 #ifdef CONFIG_GDBSTUB
-static void do_gdbserver(int has_port, int port)
+static void do_gdbserver(const char *port)
 {
-    if (!has_port)
+    if (!port)
         port = DEFAULT_GDBSTUB_PORT;
     if (gdbserver_start(port) < 0) {
-        qemu_printf("Could not open gdbserver socket on port %d\n", port);
+        qemu_printf("Could not open gdbserver socket on port '%s'\n", port);
     } else {
-        qemu_printf("Waiting gdb connection on port %d\n", port);
+        qemu_printf("Waiting gdb connection on port '%s'\n", port);
     }
 }
 #endif
@@ -440,7 +523,7 @@ static void term_printc(int c)
 }
 
 static void memory_dump(int count, int format, int wsize,
-                        target_ulong addr, int is_physical)
+                        target_phys_addr_t addr, int is_physical)
 {
     CPUState *env;
     int nb_per_line, l, line_size, i, max_digits, len;
@@ -503,7 +586,10 @@ static void memory_dump(int count, int format, int wsize,
     }
 
     while (len > 0) {
-        term_printf(TARGET_FMT_lx ":", addr);
+        if (is_physical)
+            term_printf(TARGET_FMT_plx ":", addr);
+        else
+            term_printf(TARGET_FMT_lx ":", (target_ulong)addr);
         l = len;
         if (l > line_size)
             l = line_size;
@@ -513,7 +599,10 @@ static void memory_dump(int count, int format, int wsize,
             env = mon_get_cpu();
             if (!env)
                 break;
-            cpu_memory_rw_debug(env, addr, buf, l, 0);
+            if (cpu_memory_rw_debug(env, addr, buf, l, 0) < 0) {
+                term_printf(" Cannot access memory\n");
+                break;
+            }
         }
         i = 0;
         while (i < l) {
@@ -571,18 +660,24 @@ static void do_memory_dump(int count, int format, int size,
     memory_dump(count, format, size, addr, 0);
 }
 
+#if TARGET_PHYS_ADDR_BITS > 32
+#define GET_TPHYSADDR(h, l) (((uint64_t)(h) << 32) | (l))
+#else
+#define GET_TPHYSADDR(h, l) (l)
+#endif
+
 static void do_physical_memory_dump(int count, int format, int size,
                                     uint32_t addrh, uint32_t addrl)
 
 {
-    target_long addr = GET_TLONG(addrh, addrl);
+    target_phys_addr_t addr = GET_TPHYSADDR(addrh, addrl);
     memory_dump(count, format, size, addr, 1);
 }
 
 static void do_print(int count, int format, int size, unsigned int valh, unsigned int vall)
 {
-    target_long val = GET_TLONG(valh, vall);
-#if TARGET_LONG_BITS == 32
+    target_phys_addr_t val = GET_TPHYSADDR(valh, vall);
+#if TARGET_PHYS_ADDR_BITS == 32
     switch(format) {
     case 'o':
         term_printf("%#o", val);
@@ -624,6 +719,62 @@ static void do_print(int count, int format, int size, unsigned int valh, unsigne
     term_printf("\n");
 }
 
+static void do_memory_save(unsigned int valh, unsigned int vall,
+                           uint32_t size, const char *filename)
+{
+    FILE *f;
+    target_long addr = GET_TLONG(valh, vall);
+    uint32_t l;
+    CPUState *env;
+    uint8_t buf[1024];
+
+    env = mon_get_cpu();
+    if (!env)
+        return;
+
+    f = fopen(filename, "wb");
+    if (!f) {
+        term_printf("could not open '%s'\n", filename);
+        return;
+    }
+    while (size != 0) {
+        l = sizeof(buf);
+        if (l > size)
+            l = size;
+        cpu_memory_rw_debug(env, addr, buf, l, 0);
+        fwrite(buf, 1, l, f);
+        addr += l;
+        size -= l;
+    }
+    fclose(f);
+}
+
+static void do_physical_memory_save(unsigned int valh, unsigned int vall,
+                                    uint32_t size, const char *filename)
+{
+    FILE *f;
+    uint32_t l;
+    uint8_t buf[1024];
+    target_phys_addr_t addr = GET_TPHYSADDR(valh, vall); 
+
+    f = fopen(filename, "wb");
+    if (!f) {
+        term_printf("could not open '%s'\n", filename);
+        return;
+    }
+    while (size != 0) {
+        l = sizeof(buf);
+        if (l > size)
+            l = size;
+        cpu_physical_memory_rw(addr, buf, l, 0);
+        fwrite(buf, 1, l, f);
+        fflush(f);
+        addr += l;
+        size -= l;
+    }
+    fclose(f);
+}
+
 static void do_sum(uint32_t start, uint32_t size)
 {
     uint32_t addr;
@@ -651,6 +802,8 @@ static const KeyDef key_defs[] = {
 
     { 0x38, "alt" },
     { 0xb8, "alt_r" },
+    { 0x64, "altgr" },
+    { 0xe4, "altgr_r" },
     { 0x1d, "ctrl" },
     { 0x9d, "ctrl_r" },
 
@@ -704,6 +857,8 @@ static const KeyDef key_defs[] = {
     { 0x31, "n" },
     { 0x32, "m" },
 
+    { 0x37, "asterisk" },
+
     { 0x39, "spc" },
     { 0x3a, "caps_lock" },
     { 0x3b, "f1" },
@@ -721,10 +876,11 @@ static const KeyDef key_defs[] = {
 
     { 0xb5, "kp_divide" },
     { 0x37, "kp_multiply" },
-    { 0x4a, "kp_substract" },
+    { 0x4a, "kp_subtract" },
     { 0x4e, "kp_add" },
     { 0x9c, "kp_enter" },
     { 0x53, "kp_decimal" },
+    { 0x54, "sysrq" },
 
     { 0x52, "kp_0" },
     { 0x4f, "kp_1" },
@@ -756,6 +912,23 @@ static const KeyDef key_defs[] = {
 
     { 0xd2, "insert" },
     { 0xd3, "delete" },
+#if defined(TARGET_SPARC) && !defined(TARGET_SPARC64)
+    { 0xf0, "stop" },
+    { 0xf1, "again" },
+    { 0xf2, "props" },
+    { 0xf3, "undo" },
+    { 0xf4, "front" },
+    { 0xf5, "copy" },
+    { 0xf6, "open" },
+    { 0xf7, "paste" },
+    { 0xf8, "find" },
+    { 0xf9, "cut" },
+    { 0xfa, "lf" },
+    { 0xfb, "help" },
+    { 0xfc, "meta_l" },
+    { 0xfd, "meta_r" },
+    { 0xfe, "compose" },
+#endif
     { 0, NULL },
 };
 
@@ -777,48 +950,73 @@ static int get_keycode(const char *key)
     return -1;
 }
 
-static void do_send_key(const char *string)
+#define MAX_KEYCODES 16
+static uint8_t keycodes[MAX_KEYCODES];
+static int nb_pending_keycodes;
+static QEMUTimer *key_timer;
+
+static void release_keys(void *opaque)
 {
-    char keybuf[16], *q;
-    uint8_t keycodes[16];
-    const char *p;
-    int nb_keycodes, keycode, i;
-
-    nb_keycodes = 0;
-    p = string;
-    while (*p != '\0') {
-        q = keybuf;
-        while (*p != '\0' && *p != '-') {
-            if ((q - keybuf) < sizeof(keybuf) - 1) {
-                *q++ = *p;
+    int keycode;
+
+    while (nb_pending_keycodes > 0) {
+        nb_pending_keycodes--;
+        keycode = keycodes[nb_pending_keycodes];
+        if (keycode & 0x80)
+            kbd_put_keycode(0xe0);
+        kbd_put_keycode(keycode | 0x80);
+    }
+}
+
+static void do_sendkey(const char *string, int has_hold_time, int hold_time)
+{
+    char keyname_buf[16];
+    char *separator;
+    int keyname_len, keycode, i;
+
+    if (nb_pending_keycodes > 0) {
+        qemu_del_timer(key_timer);
+        release_keys(NULL);
+    }
+    if (!has_hold_time)
+        hold_time = 100;
+    i = 0;
+    while (1) {
+        separator = strchr(string, '-');
+        keyname_len = separator ? separator - string : strlen(string);
+        if (keyname_len > 0) {
+            pstrcpy(keyname_buf, sizeof(keyname_buf), string);
+            if (keyname_len > sizeof(keyname_buf) - 1) {
+                term_printf("invalid key: '%s...'\n", keyname_buf);
+                return;
             }
-            p++;
-        }
-        *q = '\0';
-        keycode = get_keycode(keybuf);
-        if (keycode < 0) {
-            term_printf("unknown key: '%s'\n", keybuf);
-            return;
+            if (i == MAX_KEYCODES) {
+                term_printf("too many keys\n");
+                return;
+            }
+            keyname_buf[keyname_len] = 0;
+            keycode = get_keycode(keyname_buf);
+            if (keycode < 0) {
+                term_printf("unknown key: '%s'\n", keyname_buf);
+                return;
+            }
+            keycodes[i++] = keycode;
         }
-        keycodes[nb_keycodes++] = keycode;
-        if (*p == '\0')
+        if (!separator)
             break;
-        p++;
+        string = separator + 1;
     }
+    nb_pending_keycodes = i;
     /* key down events */
-    for(i = 0; i < nb_keycodes; i++) {
+    for (i = 0; i < nb_pending_keycodes; i++) {
         keycode = keycodes[i];
         if (keycode & 0x80)
             kbd_put_keycode(0xe0);
         kbd_put_keycode(keycode & 0x7f);
     }
-    /* key up events */
-    for(i = nb_keycodes - 1; i >= 0; i--) {
-        keycode = keycodes[i];
-        if (keycode & 0x80)
-            kbd_put_keycode(0xe0);
-        kbd_put_keycode(keycode | 0x80);
-    }
+    /* delayed key up events */
+    qemu_mod_timer(key_timer, qemu_get_clock(vm_clock) +
+                    muldiv64(ticks_per_sec, hold_time, 1000));
 }
 
 static int mouse_button_state;
@@ -1139,8 +1337,8 @@ static void do_wav_capture (const char *path,
 static term_cmd_t term_cmds[] = {
     { "help|?", "s?", do_help,
       "[cmd]", "show the help" },
-    { "commit", "", do_commit,
-      "", "commit changes to the disk images (if -snapshot is used)" },
+    { "commit", "s", do_commit,
+      "device|all", "commit changes to the disk images (if -snapshot is used) or backing files" },
     { "info", "s?", do_info,
       "subcommand", "show various information about the system state" },
     { "q|quit", "", do_quit,
@@ -1153,16 +1351,18 @@ static term_cmd_t term_cmds[] = {
       "filename", "save screen into PPM image 'filename'" },
     { "log", "s", do_log,
       "item1[,...]", "activate logging of the specified items to '/tmp/qemu.log'" },
+#if 0
     { "savevm", "F", do_savevm,
       "filename", "save the whole virtual machine state to 'filename'" },
     { "loadvm", "F", do_loadvm,
       "filename", "restore the whole virtual machine state from 'filename'" },
+#endif
     { "stop", "", do_stop,
       "", "stop emulation", },
     { "c|cont", "", do_cont,
       "", "resume emulation", },
 #ifdef CONFIG_GDBSTUB
-    { "gdbserver", "i?", do_gdbserver,
+    { "gdbserver", "s?", do_gdbserver,
       "[port]", "start gdbserver session (default port=1234)", },
 #endif
     { "x", "/l", do_memory_dump,
@@ -1174,8 +1374,8 @@ static term_cmd_t term_cmds[] = {
     { "i", "/ii.", do_ioport_read,
       "/fmt addr", "I/O port read" },
 
-    { "sendkey", "s", do_send_key,
-      "keys", "send keys to the VM (e.g. 'sendkey ctrl-alt-f1')" },
+    { "sendkey", "si?", do_sendkey,
+      "keys [hold_ms]", "send keys to the VM (e.g. 'sendkey ctrl-alt-f1', default hold time=100 ms)" },
     { "system_reset", "", do_system_reset,
       "", "reset the system" },
     { "system_powerdown", "", do_system_powerdown,
@@ -1289,21 +1489,7 @@ static target_long monitor_get_msr (struct MonitorDef *md, int val)
     CPUState *env = mon_get_cpu();
     if (!env)
         return 0;
-    return (env->msr[MSR_POW] << MSR_POW) |
-        (env->msr[MSR_ILE] << MSR_ILE) |
-        (env->msr[MSR_EE] << MSR_EE) |
-        (env->msr[MSR_PR] << MSR_PR) |
-        (env->msr[MSR_FP] << MSR_FP) |
-        (env->msr[MSR_ME] << MSR_ME) |
-        (env->msr[MSR_FE0] << MSR_FE0) |
-        (env->msr[MSR_SE] << MSR_SE) |
-        (env->msr[MSR_BE] << MSR_BE) |
-        (env->msr[MSR_FE1] << MSR_FE1) |
-        (env->msr[MSR_IP] << MSR_IP) |
-        (env->msr[MSR_IR] << MSR_IR) |
-        (env->msr[MSR_DR] << MSR_DR) |
-        (env->msr[MSR_RI] << MSR_RI) |
-        (env->msr[MSR_LE] << MSR_LE);
+    return env->msr;
 }
 
 static target_long monitor_get_xer (struct MonitorDef *md, int val)
@@ -1311,10 +1497,7 @@ static target_long monitor_get_xer (struct MonitorDef *md, int val)
     CPUState *env = mon_get_cpu();
     if (!env)
         return 0;
-    return (env->xer[XER_SO] << XER_SO) |
-        (env->xer[XER_OV] << XER_OV) |
-        (env->xer[XER_CA] << XER_CA) |
-        (env->xer[XER_BC] << XER_BC);
+    return ppc_load_xer(env);
 }
 
 static target_long monitor_get_decr (struct MonitorDef *md, int val)
@@ -1398,6 +1581,7 @@ static MonitorDef monitor_defs[] = {
     SEG("gs", R_GS)
     { "pc", 0, monitor_get_pc, },
 #elif defined(TARGET_PPC)
+    /* General purpose registers */
     { "r0", offsetof(CPUState, gpr[0]) },
     { "r1", offsetof(CPUState, gpr[1]) },
     { "r2", offsetof(CPUState, gpr[2]) },
@@ -1430,15 +1614,56 @@ static MonitorDef monitor_defs[] = {
     { "r29", offsetof(CPUState, gpr[29]) },
     { "r30", offsetof(CPUState, gpr[30]) },
     { "r31", offsetof(CPUState, gpr[31]) },
+    /* Floating point registers */
+    { "f0", offsetof(CPUState, fpr[0]) },
+    { "f1", offsetof(CPUState, fpr[1]) },
+    { "f2", offsetof(CPUState, fpr[2]) },
+    { "f3", offsetof(CPUState, fpr[3]) },
+    { "f4", offsetof(CPUState, fpr[4]) },
+    { "f5", offsetof(CPUState, fpr[5]) },
+    { "f6", offsetof(CPUState, fpr[6]) },
+    { "f7", offsetof(CPUState, fpr[7]) },
+    { "f8", offsetof(CPUState, fpr[8]) },
+    { "f9", offsetof(CPUState, fpr[9]) },
+    { "f10", offsetof(CPUState, fpr[10]) },
+    { "f11", offsetof(CPUState, fpr[11]) },
+    { "f12", offsetof(CPUState, fpr[12]) },
+    { "f13", offsetof(CPUState, fpr[13]) },
+    { "f14", offsetof(CPUState, fpr[14]) },
+    { "f15", offsetof(CPUState, fpr[15]) },
+    { "f16", offsetof(CPUState, fpr[16]) },
+    { "f17", offsetof(CPUState, fpr[17]) },
+    { "f18", offsetof(CPUState, fpr[18]) },
+    { "f19", offsetof(CPUState, fpr[19]) },
+    { "f20", offsetof(CPUState, fpr[20]) },
+    { "f21", offsetof(CPUState, fpr[21]) },
+    { "f22", offsetof(CPUState, fpr[22]) },
+    { "f23", offsetof(CPUState, fpr[23]) },
+    { "f24", offsetof(CPUState, fpr[24]) },
+    { "f25", offsetof(CPUState, fpr[25]) },
+    { "f26", offsetof(CPUState, fpr[26]) },
+    { "f27", offsetof(CPUState, fpr[27]) },
+    { "f28", offsetof(CPUState, fpr[28]) },
+    { "f29", offsetof(CPUState, fpr[29]) },
+    { "f30", offsetof(CPUState, fpr[30]) },
+    { "f31", offsetof(CPUState, fpr[31]) },
+    { "fpscr", offsetof(CPUState, fpscr) },
+    /* Next instruction pointer */
     { "nip|pc", offsetof(CPUState, nip) },
     { "lr", offsetof(CPUState, lr) },
     { "ctr", offsetof(CPUState, ctr) },
     { "decr", 0, &monitor_get_decr, },
     { "ccr", 0, &monitor_get_ccr, },
+    /* Machine state register */
     { "msr", 0, &monitor_get_msr, },
     { "xer", 0, &monitor_get_xer, },
     { "tbu", 0, &monitor_get_tbu, },
     { "tbl", 0, &monitor_get_tbl, },
+#if defined(TARGET_PPC64)
+    /* Address space register */
+    { "asr", offsetof(CPUState, asr) },
+#endif
+    /* Segment registers */
     { "sdr1", offsetof(CPUState, sdr1) },
     { "sr0", offsetof(CPUState, sr[0]) },
     { "sr1", offsetof(CPUState, sr[1]) },
@@ -1631,11 +1856,11 @@ static void next(void)
     }
 }
 
-static target_long expr_sum(void);
+static int64_t expr_sum(void);
 
-static target_long expr_unary(void)
+static int64_t expr_unary(void)
 {
-    target_long n = 0;
+    int64_t n;
     char *p;
     int ret;
 
@@ -1673,6 +1898,7 @@ static target_long expr_unary(void)
     case '$':
         {
             char buf[128], *q;
+            target_long reg=0;
 
             pch++;
             q = buf;
@@ -1687,11 +1913,12 @@ static target_long expr_unary(void)
             while (isspace(*pch))
                 pch++;
             *q = 0;
-            ret = get_monitor_def(&n, buf);
+            ret = get_monitor_def(&reg, buf);
             if (ret == -1)
                 expr_error("unknown register");
             else if (ret == -2)
                 expr_error("no cpu defined");
+            n = reg;
         }
         break;
     case '\0':
@@ -1699,7 +1926,7 @@ static target_long expr_unary(void)
         n = 0;
         break;
     default:
-#if TARGET_LONG_BITS == 64
+#if TARGET_PHYS_ADDR_BITS > 32
         n = strtoull(pch, &p, 0);
 #else
         n = strtoul(pch, &p, 0);
@@ -1716,9 +1943,9 @@ static target_long expr_unary(void)
 }
 
 
-static target_long expr_prod(void)
+static int64_t expr_prod(void)
 {
-    target_long val, val2;
+    int64_t val, val2;
     int op;
 
     val = expr_unary();
@@ -1747,9 +1974,9 @@ static target_long expr_prod(void)
     return val;
 }
 
-static target_long expr_logic(void)
+static int64_t expr_logic(void)
 {
-    target_long val, val2;
+    int64_t val, val2;
     int op;
 
     val = expr_prod();
@@ -1775,9 +2002,9 @@ static target_long expr_logic(void)
     return val;
 }
 
-static target_long expr_sum(void)
+static int64_t expr_sum(void)
 {
-    target_long val, val2;
+    int64_t val, val2;
     int op;
 
     val = expr_logic();
@@ -1795,7 +2022,7 @@ static target_long expr_sum(void)
     return val;
 }
 
-static int get_expr(target_long *pval, const char **pp)
+static int get_expr(int64_t *pval, const char **pp)
 {
     pch = *pp;
     if (setjmp(expr_env)) {
@@ -1889,6 +2116,17 @@ static void monitor_handle_command(const char *cmdline)
     char buf[1024];
     void *str_allocated[MAX_ARGS];
     void *args[MAX_ARGS];
+    void (*handler_0)(void);
+    void (*handler_1)(void *arg0);
+    void (*handler_2)(void *arg0, void *arg1);
+    void (*handler_3)(void *arg0, void *arg1, void *arg2);
+    void (*handler_4)(void *arg0, void *arg1, void *arg2, void *arg3);
+    void (*handler_5)(void *arg0, void *arg1, void *arg2, void *arg3,
+                      void *arg4);
+    void (*handler_6)(void *arg0, void *arg1, void *arg2, void *arg3,
+                      void *arg4, void *arg5);
+    void (*handler_7)(void *arg0, void *arg1, void *arg2, void *arg3,
+                      void *arg4, void *arg5, void *arg6);
 
 #ifdef DEBUG
     term_printf("command='%s'\n", cmdline);
@@ -1964,7 +2202,7 @@ static void monitor_handle_command(const char *cmdline)
                     goto fail;
                 }
                 str = qemu_malloc(strlen(buf) + 1);
-                strcpy(str, buf);
+                pstrcpy(str, sizeof(buf), buf);
                 str_allocated[nb_args] = str;
             add_str:
                 if (nb_args >= MAX_ARGS) {
@@ -2050,15 +2288,16 @@ static void monitor_handle_command(const char *cmdline)
                 }
                 if (nb_args + 3 > MAX_ARGS)
                     goto error_args;
-                args[nb_args++] = (void*)count;
-                args[nb_args++] = (void*)format;
-                args[nb_args++] = (void*)size;
+                args[nb_args++] = (void*)(long)count;
+                args[nb_args++] = (void*)(long)format;
+                args[nb_args++] = (void*)(long)size;
             }
             break;
         case 'i':
         case 'l':
             {
-                target_long val;
+                int64_t val;
+
                 while (isspace(*p))
                     p++;
                 if (*typestr == '?' || *typestr == '.') {
@@ -2080,7 +2319,7 @@ static void monitor_handle_command(const char *cmdline)
                     typestr++;
                     if (nb_args >= MAX_ARGS)
                         goto error_args;
-                    args[nb_args++] = (void *)has_arg;
+                    args[nb_args++] = (void *)(long)has_arg;
                     if (!has_arg) {
                         if (nb_args >= MAX_ARGS)
                             goto error_args;
@@ -2094,16 +2333,16 @@ static void monitor_handle_command(const char *cmdline)
                 if (c == 'i') {
                     if (nb_args >= MAX_ARGS)
                         goto error_args;
-                    args[nb_args++] = (void *)(int)val;
+                    args[nb_args++] = (void *)(long)val;
                 } else {
                     if ((nb_args + 1) >= MAX_ARGS)
                         goto error_args;
-#if TARGET_LONG_BITS == 64
-                    args[nb_args++] = (void *)(int)((val >> 32) & 0xffffffff);
+#if TARGET_PHYS_ADDR_BITS > 32
+                    args[nb_args++] = (void *)(long)((val >> 32) & 0xffffffff);
 #else
                     args[nb_args++] = (void *)0;
 #endif
-                    args[nb_args++] = (void *)(int)(val & 0xffffffff);
+                    args[nb_args++] = (void *)(long)(val & 0xffffffff);
                 }
             }
             break;
@@ -2130,7 +2369,7 @@ static void monitor_handle_command(const char *cmdline)
                 }
                 if (nb_args >= MAX_ARGS)
                     goto error_args;
-                args[nb_args++] = (void *)has_option;
+                args[nb_args++] = (void *)(long)has_option;
             }
             break;
         default:
@@ -2150,28 +2389,36 @@ static void monitor_handle_command(const char *cmdline)
 
     switch(nb_args) {
     case 0:
-        cmd->handler();
+        handler_0 = cmd->handler;
+        handler_0();
         break;
     case 1:
-        cmd->handler(args[0]);
+        handler_1 = cmd->handler;
+        handler_1(args[0]);
         break;
     case 2:
-        cmd->handler(args[0], args[1]);
+        handler_2 = cmd->handler;
+        handler_2(args[0], args[1]);
         break;
     case 3:
-        cmd->handler(args[0], args[1], args[2]);
+        handler_3 = cmd->handler;
+        handler_3(args[0], args[1], args[2]);
         break;
     case 4:
-        cmd->handler(args[0], args[1], args[2], args[3]);
+        handler_4 = cmd->handler;
+        handler_4(args[0], args[1], args[2], args[3]);
         break;
     case 5:
-        cmd->handler(args[0], args[1], args[2], args[3], args[4]);
+        handler_5 = cmd->handler;
+        handler_5(args[0], args[1], args[2], args[3], args[4]);
         break;
     case 6:
-        cmd->handler(args[0], args[1], args[2], args[3], args[4], args[5]);
+        handler_6 = cmd->handler;
+        handler_6(args[0], args[1], args[2], args[3], args[4], args[5]);
         break;
     case 7:
-        cmd->handler(args[0], args[1], args[2], args[3], args[4], args[5], args[6]);
+        handler_7 = cmd->handler;
+        handler_7(args[0], args[1], args[2], args[3], args[4], args[5], args[6]);
         break;
     default:
         term_printf("unsupported number of arguments: %d\n", nb_args);
@@ -2222,7 +2469,7 @@ static void file_completion(const char *input)
     if (!p) {
         input_path_len = 0;
         pstrcpy(file_prefix, sizeof(file_prefix), input);
-        strcpy(path, ".");
+        pstrcpy(path, sizeof(path), ".");
     } else {
         input_path_len = p - input + 1;
         memcpy(path, input, input_path_len);
@@ -2244,13 +2491,15 @@ static void file_completion(const char *input)
             break;
         if (strstart(d->d_name, file_prefix, NULL)) {
             memcpy(file, input, input_path_len);
-            strcpy(file + input_path_len, d->d_name);
+            if (input_path_len < sizeof(file))
+                pstrcpy(file + input_path_len, sizeof(file) - input_path_len,
+                        d->d_name);
             /* stat the file to find out if it's a directory.
              * In that case add a slash to speed up typing long paths
              */
             stat(file, &sb);
             if(S_ISDIR(sb.st_mode))
-                strcat(file, "/");
+                pstrcat(file, sizeof(file), "/");
             add_completion(file);
         }
     }
@@ -2402,15 +2651,44 @@ static void monitor_start_input(void)
     readline_start("(qemu) ", 0, monitor_handle_command1, NULL);
 }
 
+static void term_event(void *opaque, int event)
+{
+    if (event != CHR_EVENT_RESET)
+	return;
+
+    if (!hide_banner)
+	    term_printf("QEMU %s monitor - type 'help' for more information\n",
+			QEMU_VERSION);
+    monitor_start_input();
+}
+
+static int is_first_init = 1;
+
 void monitor_init(CharDriverState *hd, int show_banner)
 {
-    monitor_hd = hd;
-    if (show_banner) {
-        term_printf("QEMU %s monitor - type 'help' for more information\n",
-                    QEMU_VERSION);
+    int i;
+
+    if (is_first_init) {
+        key_timer = qemu_new_timer(vm_clock, release_keys, NULL);
+        if (!key_timer)
+            return;
+        for (i = 0; i < MAX_MON; i++) {
+            monitor_hd[i] = NULL;
+        }
+        is_first_init = 0;
     }
-    qemu_chr_add_read_handler(hd, term_can_read, term_read, NULL);
-    monitor_start_input();
+    for (i = 0; i < MAX_MON; i++) {
+        if (monitor_hd[i] == NULL) {
+            monitor_hd[i] = hd;
+            break;
+        }
+    }
+
+    hide_banner = !show_banner;
+
+    qemu_chr_add_handlers(hd, term_can_read, term_read, term_event, NULL);
+
+    readline_start("", 0, monitor_handle_command1, NULL);
 }
 
 /* XXX: use threads ? */
@@ -2428,9 +2706,20 @@ static void monitor_readline_cb(void *opaque, const char *input)
 void monitor_readline(const char *prompt, int is_password,
                       char *buf, int buf_size)
 {
+    int i;
+    int old_focus[MAX_MON];
+
     if (is_password) {
-        qemu_chr_send_event(monitor_hd, CHR_EVENT_FOCUS);
+        for (i = 0; i < MAX_MON; i++) {
+            old_focus[i] = 0;
+            if (monitor_hd[i]) {
+                old_focus[i] = monitor_hd[i]->focus;
+                monitor_hd[i]->focus = 0;
+                qemu_chr_send_event(monitor_hd[i], CHR_EVENT_FOCUS);
+            }
+        }
     }
+
     readline_start(prompt, is_password, monitor_readline_cb, NULL);
     monitor_readline_buf = buf;
     monitor_readline_buf_size = buf_size;
@@ -2438,4 +2727,10 @@ void monitor_readline(const char *prompt, int is_password,
     while (monitor_readline_started) {
         main_loop_wait(10);
     }
+    /* restore original focus */
+    if (is_password) {
+        for (i = 0; i < MAX_MON; i++)
+            if (old_focus[i])
+                monitor_hd[i]->focus = old_focus[i];
+    }
 }
diff --git a/net.h b/net.h
new file mode 100644
index 0000000..5212b48
--- /dev/null
+++ b/net.h
@@ -0,0 +1,58 @@
+#ifndef QEMU_NET_H
+#define QEMU_NET_H
+
+/* VLANs support */
+
+typedef struct VLANClientState VLANClientState;
+
+struct VLANClientState {
+    IOReadHandler *fd_read;
+    /* Packets may still be sent if this returns zero.  It's used to
+       rate-limit the slirp code.  */
+    IOCanRWHandler *fd_can_read;
+    void *opaque;
+    struct VLANClientState *next;
+    struct VLANState *vlan;
+    char info_str[256];
+};
+
+struct VLANState {
+    int id;
+    VLANClientState *first_client;
+    struct VLANState *next;
+    unsigned int nb_guest_devs, nb_host_devs;
+};
+
+VLANState *qemu_find_vlan(int id);
+VLANClientState *qemu_new_vlan_client(VLANState *vlan,
+                                      IOReadHandler *fd_read,
+                                      IOCanRWHandler *fd_can_read,
+                                      void *opaque);
+void qemu_del_vlan_client(VLANClientState *vc);
+int qemu_can_send_packet(VLANClientState *vc);
+void qemu_send_packet(VLANClientState *vc, const uint8_t *buf, int size);
+void qemu_handler_true(void *opaque);
+
+void do_info_network(void);
+
+/* NIC info */
+
+#define MAX_NICS 8
+
+struct NICInfo {
+    uint8_t macaddr[6];
+    const char *model;
+    VLANState *vlan;
+};
+
+extern int nb_nics;
+extern NICInfo nd_table[MAX_NICS];
+
+/* checksumming functions (net-checksum.c) */
+uint32_t net_checksum_add(int len, uint8_t *buf);
+uint16_t net_checksum_finish(uint32_t sum);
+uint16_t net_checksum_tcpudp(uint16_t length, uint16_t proto,
+                             uint8_t *addrs, uint8_t *buf);
+void net_checksum_calculate(uint8_t *data, int length);
+
+#endif
diff --git a/osdep.c b/osdep.c
index b623e13..49193e9 100644
--- a/osdep.c
+++ b/osdep.c
@@ -27,256 +27,17 @@
 #include <string.h>
 #include <errno.h>
 #include <unistd.h>
-
-#include "cpu.h"
-#if defined(USE_KQEMU)
-#include "vl.h"
-#endif
-
-#if defined(__i386__) && !defined(CONFIG_SOFTMMU) && !defined(CONFIG_USER_ONLY)
-
-#include <sys/mman.h>
-#include <sys/ipc.h>
-
-/* When not using soft mmu, libc independant functions are needed for
-   the CPU core because it needs to use alternates stacks and
-   libc/thread incompatibles settings */
-
-#include <linux/unistd.h>
-
-#define QEMU_SYSCALL0(name) \
-{ \
-long __res; \
-__asm__ volatile ("int $0x80" \
-	: "=a" (__res) \
-	: "0" (__NR_##name)); \
-return __res; \
-}
-
-#define QEMU_SYSCALL1(name,arg1) \
-{ \
-long __res; \
-__asm__ volatile ("int $0x80" \
-	: "=a" (__res) \
-	: "0" (__NR_##name),"b" ((long)(arg1))); \
-return __res; \
-}
-
-#define QEMU_SYSCALL2(name,arg1,arg2) \
-{ \
-long __res; \
-__asm__ volatile ("int $0x80" \
-	: "=a" (__res) \
-	: "0" (__NR_##name),"b" ((long)(arg1)),"c" ((long)(arg2))); \
-return __res; \
-}
-
-#define QEMU_SYSCALL3(name,arg1,arg2,arg3) \
-{ \
-long __res; \
-__asm__ volatile ("int $0x80" \
-	: "=a" (__res) \
-	: "0" (__NR_##name),"b" ((long)(arg1)),"c" ((long)(arg2)), \
-		  "d" ((long)(arg3))); \
-return __res; \
-}
-
-#define QEMU_SYSCALL4(name,arg1,arg2,arg3,arg4) \
-{ \
-long __res; \
-__asm__ volatile ("int $0x80" \
-	: "=a" (__res) \
-	: "0" (__NR_##name),"b" ((long)(arg1)),"c" ((long)(arg2)), \
-	  "d" ((long)(arg3)),"S" ((long)(arg4))); \
-return __res; \
-}
-
-#define QEMU_SYSCALL5(name,arg1,arg2,arg3,arg4,arg5) \
-{ \
-long __res; \
-__asm__ volatile ("int $0x80" \
-	: "=a" (__res) \
-	: "0" (__NR_##name),"b" ((long)(arg1)),"c" ((long)(arg2)), \
-	  "d" ((long)(arg3)),"S" ((long)(arg4)),"D" ((long)(arg5))); \
-return __res; \
-}
-
-#define QEMU_SYSCALL6(name,arg1,arg2,arg3,arg4,arg5,arg6) \
-{ \
-long __res; \
-__asm__ volatile ("push %%ebp ; movl %%eax,%%ebp ; movl %1,%%eax ; int $0x80 ; pop %%ebp" \
-	: "=a" (__res) \
-	: "i" (__NR_##name),"b" ((long)(arg1)),"c" ((long)(arg2)), \
-	  "d" ((long)(arg3)),"S" ((long)(arg4)),"D" ((long)(arg5)), \
-	  "0" ((long)(arg6))); \
-return __res; \
-}
-
-int qemu_write(int fd, const void *buf, size_t n)
-{
-    QEMU_SYSCALL3(write, fd, buf, n);
-}
-
-
-
-/****************************************************************/
-/* shmat replacement */
-
-int qemu_ipc(int call, unsigned long first,
-            unsigned long second, unsigned long third,
-            void *ptr, unsigned long fifth)
-{
-    QEMU_SYSCALL6(ipc, call, first, second, third, ptr, fifth);
-}
-
-#define SHMAT 21
-
-/* we must define shmat so that a specific address will be used when
-   mapping the X11 ximage */
-void *shmat(int shmid, const void *shmaddr, int shmflg)
-{
-    void *ptr;
-    int ret;
-    /* we give an address in the right memory area */
-    if (!shmaddr)
-        shmaddr = get_mmap_addr(8192 * 1024);
-    ret = qemu_ipc(SHMAT, shmid, shmflg, (unsigned long)&ptr, (void *)shmaddr, 0);
-    if (ret < 0)
-        return NULL;
-    return ptr;
-}
-
-/****************************************************************/
-/* sigaction bypassing the threads */
-
-static int kernel_sigaction(int signum, const struct qemu_sigaction *act,
-                            struct qemu_sigaction *oldact,
-                            int sigsetsize)
-{
-    QEMU_SYSCALL4(rt_sigaction, signum, act, oldact, sigsetsize);
-}
-
-int qemu_sigaction(int signum, const struct qemu_sigaction *act,
-                   struct qemu_sigaction *oldact)
-{
-    return kernel_sigaction(signum, act, oldact, 8);
-}
-
-/****************************************************************/
-/* memory allocation */
-
-//#define DEBUG_MALLOC
-
-#define MALLOC_BASE       0xab000000
-#define PHYS_RAM_BASE     0xac000000
-
-#define MALLOC_ALIGN      16
-#define BLOCK_HEADER_SIZE 16
-
-typedef struct MemoryBlock {
-    struct MemoryBlock *next;
-    unsigned long size; /* size of block, including header */
-} MemoryBlock;
-
-static MemoryBlock *first_free_block;
-static unsigned long malloc_addr = MALLOC_BASE;
-
-static void *malloc_get_space(size_t size)
-{
-    void *ptr;
-    size = TARGET_PAGE_ALIGN(size);
-    ptr = mmap((void *)malloc_addr, size,
-               PROT_WRITE | PROT_READ,
-               MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0);
-    if (ptr == MAP_FAILED)
-        return NULL;
-    malloc_addr += size;
-    return ptr;
-}
-
-void *qemu_malloc(size_t size)
-{
-    MemoryBlock *mb, *mb1, **pmb;
-    void *ptr;
-    size_t size1, area_size;
-
-    if (size == 0)
-        return NULL;
-
-    size = (size + BLOCK_HEADER_SIZE + MALLOC_ALIGN - 1) & ~(MALLOC_ALIGN - 1);
-    pmb = &first_free_block;
-    for(;;) {
-        mb = *pmb;
-        if (mb == NULL)
-            break;
-        if (size <= mb->size)
-            goto found;
-        pmb = &mb->next;
-    }
-    /* no big enough blocks found: get new space */
-    area_size = TARGET_PAGE_ALIGN(size);
-    mb = malloc_get_space(area_size);
-    if (!mb)
-        return NULL;
-    size1 = area_size - size;
-    if (size1 > 0) {
-        /* create a new free block */
-        mb1 = (MemoryBlock *)((uint8_t *)mb + size);
-        mb1->next = NULL;
-        mb1->size = size1;
-        *pmb = mb1;
-    }
-    goto the_end;
- found:
-    /* a free block was found: use it */
-    size1 = mb->size - size;
-    if (size1 > 0) {
-        /* create a new free block */
-        mb1 = (MemoryBlock *)((uint8_t *)mb + size);
-        mb1->next = mb->next;
-        mb1->size = size1;
-        *pmb = mb1;
-    } else {
-        /* suppress the first block */
-        *pmb = mb->next;
-    }
- the_end:
-    mb->size = size;
-    mb->next = NULL;
-    ptr = ((uint8_t *)mb + BLOCK_HEADER_SIZE);
-#ifdef DEBUG_MALLOC
-    qemu_printf("malloc: size=0x%x ptr=0x%lx\n", size, (unsigned long)ptr);
+#include <fcntl.h>
+#ifdef HOST_SOLARIS
+#include <sys/types.h>
+#include <sys/statvfs.h>
 #endif
-    return ptr;
-}
-
-void qemu_free(void *ptr)
-{
-    MemoryBlock *mb;
-
-    if (!ptr)
-        return;
-    mb = (MemoryBlock *)((uint8_t *)ptr - BLOCK_HEADER_SIZE);
-    mb->next = first_free_block;
-    first_free_block = mb;
-}
-
-/****************************************************************/
-/* virtual memory allocation */
-
-unsigned long mmap_addr = PHYS_RAM_BASE;
 
-void *get_mmap_addr(unsigned long size)
-{
-    unsigned long addr;
-    addr = mmap_addr;
-    mmap_addr += ((size + 4095) & ~4095) + 4096;
-    return (void *)addr;
-}
-
-#else
+#include "qemu-common.h"
+#include "sysemu.h"
 
 #ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 #elif defined(_BSD)
 #include <stdlib.h>
@@ -284,33 +45,13 @@ void *get_mmap_addr(unsigned long size)
 #include <malloc.h>
 #endif
 
-int qemu_write(int fd, const void *buf, size_t n)
-{
-    int ret;
-    ret = write(fd, buf, n);
-    if (ret < 0)
-        return -errno;
-    else
-        return ret;
-}
-
-void *get_mmap_addr(unsigned long size)
-{
-    return NULL;
-}
-
-void qemu_free(void *ptr)
-{
-    free(ptr);
-}
 
-void *qemu_malloc(size_t size)
+#if defined(_WIN32)
+void *qemu_memalign(size_t alignment, size_t size)
 {
-    return malloc(size);
+    return VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE);
 }
 
-#if defined(_WIN32)
-
 void *qemu_vmalloc(size_t size)
 {
     /* FIXME: this is not exactly optimal solution since VirtualAlloc
@@ -328,28 +69,48 @@ void qemu_vfree(void *ptr)
 
 #if defined(USE_KQEMU)
 
+#ifdef __OpenBSD__
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/mount.h>
+#else
 #include <sys/vfs.h>
+#endif
+
 #include <sys/mman.h>
 #include <fcntl.h>
 
-void *kqemu_vmalloc(size_t size)
+static void *kqemu_vmalloc(size_t size)
 {
     static int phys_ram_fd = -1;
     static int phys_ram_size = 0;
+    void *ptr;
+
+#ifdef __OpenBSD__ /* no need (?) for a dummy file on OpenBSD */
+    int map_anon = MAP_ANON;
+#else
+    int map_anon = 0;
     const char *tmpdir;
     char phys_ram_file[1024];
-    void *ptr;
+#ifdef HOST_SOLARIS
+    struct statvfs stfs;
+#else
     struct statfs stfs;
+#endif
 
     if (phys_ram_fd < 0) {
         tmpdir = getenv("QEMU_TMPDIR");
         if (!tmpdir)
+#ifdef HOST_SOLARIS
+            tmpdir = "/tmp";
+        if (statvfs(tmpdir, &stfs) == 0) {
+#else
             tmpdir = "/dev/shm";
         if (statfs(tmpdir, &stfs) == 0) {
+#endif
             int64_t free_space;
             int ram_mb;
 
-            extern int ram_size;
             free_space = (int64_t)stfs.f_bavail * stfs.f_bsize;
             if ((ram_size + 8192 * 1024) >= free_space) {
                 ram_mb = (ram_size / (1024 * 1024));
@@ -358,8 +119,7 @@ void *kqemu_vmalloc(size_t size)
                         tmpdir, ram_mb);
                 if (strcmp(tmpdir, "/dev/shm") == 0) {
                     fprintf(stderr, "To have more space available provided you have enough RAM and swap, do as root:\n"
-                            "umount /dev/shm\n"
-                            "mount -t tmpfs -o size=%dm none /dev/shm\n",
+                            "mount -o remount,size=%dm /dev/shm\n",
                             ram_mb + 16);
                 } else {
                     fprintf(stderr,
@@ -373,7 +133,8 @@ void *kqemu_vmalloc(size_t size)
         }
         snprintf(phys_ram_file, sizeof(phys_ram_file), "%s/qemuXXXXXX",
                  tmpdir);
-        if (mkstemp(phys_ram_file) < 0) {
+        phys_ram_fd = mkstemp(phys_ram_file);
+        if (phys_ram_fd < 0) {
             fprintf(stderr,
                     "warning: could not create temporary file in '%s'.\n"
                     "Use QEMU_TMPDIR to select a directory in a tmpfs filesystem.\n"
@@ -381,25 +142,21 @@ void *kqemu_vmalloc(size_t size)
                     tmpdir);
             snprintf(phys_ram_file, sizeof(phys_ram_file), "%s/qemuXXXXXX",
                      "/tmp");
-            if (mkstemp(phys_ram_file) < 0) {
+            phys_ram_fd = mkstemp(phys_ram_file);
+            if (phys_ram_fd < 0) {
                 fprintf(stderr, "Could not create temporary memory file '%s'\n",
                         phys_ram_file);
                 exit(1);
             }
         }
-        phys_ram_fd = open(phys_ram_file, O_CREAT | O_TRUNC | O_RDWR | O_BINARY, 0600);
-        if (phys_ram_fd < 0) {
-            fprintf(stderr, "Could not open temporary memory file '%s'\n",
-                    phys_ram_file);
-            exit(1);
-        }
         unlink(phys_ram_file);
     }
     size = (size + 4095) & ~4095;
     ftruncate(phys_ram_fd, phys_ram_size + size);
+#endif /* !__OpenBSD__ */
     ptr = mmap(NULL,
                size,
-               PROT_WRITE | PROT_READ, MAP_SHARED,
+               PROT_WRITE | PROT_READ, map_anon | MAP_SHARED,
                phys_ram_fd, phys_ram_size);
     if (ptr == MAP_FAILED) {
         fprintf(stderr, "Could not map physical memory\n");
@@ -409,13 +166,29 @@ void *kqemu_vmalloc(size_t size)
     return ptr;
 }
 
-void kqemu_vfree(void *ptr)
+static void kqemu_vfree(void *ptr)
 {
     /* may be useful some day, but currently we do not need to free */
 }
 
 #endif
 
+void *qemu_memalign(size_t alignment, size_t size)
+{
+#if defined(_POSIX_C_SOURCE)
+    int ret;
+    void *ptr;
+    ret = posix_memalign(&ptr, alignment, size);
+    if (ret != 0)
+        return NULL;
+    return ptr;
+#elif defined(_BSD)
+    return valloc(size);
+#else
+    return memalign(alignment, size);
+#endif
+}
+
 /* alloc shared memory pages */
 void *qemu_vmalloc(size_t size)
 {
@@ -441,202 +214,75 @@ void qemu_vfree(void *ptr)
 
 #endif
 
-#endif
-
-void *qemu_mallocz(size_t size)
+int qemu_create_pidfile(const char *filename)
 {
-    void *ptr;
-    ptr = qemu_malloc(size);
-    if (!ptr)
-        return NULL;
-    memset(ptr, 0, size);
-    return ptr;
-}
+    char buffer[128];
+    int len;
+#ifndef _WIN32
+    int fd;
 
-char *qemu_strdup(const char *str)
-{
-    char *ptr;
-    ptr = qemu_malloc(strlen(str) + 1);
-    if (!ptr)
-        return NULL;
-    strcpy(ptr, str);
-    return ptr;
-}
+    fd = open(filename, O_RDWR | O_CREAT, 0600);
+    if (fd == -1)
+        return -1;
 
-/****************************************************************/
-/* printf support */
+    if (lockf(fd, F_TLOCK, 0) == -1)
+        return -1;
 
-static inline int qemu_isdigit(int c)
-{
-    return c >= '0' && c <= '9';
+    len = snprintf(buffer, sizeof(buffer), "%ld\n", (long)getpid());
+    if (write(fd, buffer, len) != len)
+        return -1;
+#else
+    HANDLE file;
+    DWORD flags;
+    OVERLAPPED overlap;
+    BOOL ret;
+
+    /* Open for writing with no sharing. */
+    file = CreateFile(filename, GENERIC_WRITE, 0, NULL,
+		      OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+
+    if (file == INVALID_HANDLE_VALUE)
+      return -1;
+
+    flags = LOCKFILE_EXCLUSIVE_LOCK | LOCKFILE_FAIL_IMMEDIATELY;
+    overlap.hEvent = 0;
+    /* Lock 1 byte. */
+    ret = LockFileEx(file, flags, 0, 0, 1, &overlap);
+    if (ret == 0)
+      return -1;
+
+    /* Write PID to file. */
+    len = snprintf(buffer, sizeof(buffer), "%ld\n", (long)getpid());
+    ret = WriteFileEx(file, (LPCVOID)buffer, (DWORD)len,
+		      &overlap, NULL);
+    if (ret == 0)
+      return -1;
+#endif
+    return 0;
 }
 
-#define OUTCHAR(c)	(buflen > 0? (--buflen, *buf++ = (c)): 0)
+#ifdef _WIN32
+
+/* Offset between 1/1/1601 and 1/1/1970 in 100 nanosec units */
+#define _W32_FT_OFFSET (116444736000000000ULL)
 
-/* from BSD ppp sources */
-int qemu_vsnprintf(char *buf, int buflen, const char *fmt, va_list args)
+int qemu_gettimeofday(qemu_timeval *tp)
 {
-    int c, i, n;
-    int width, prec, fillch;
-    int base, len, neg;
-    unsigned long val = 0;
-    const char *f;
-    char *str, *buf0;
-    char num[32];
-    static const char hexchars[] = "0123456789abcdef";
-
-    buf0 = buf;
-    --buflen;
-    while (buflen > 0) {
-	for (f = fmt; *f != '%' && *f != 0; ++f)
-	    ;
-	if (f > fmt) {
-	    len = f - fmt;
-	    if (len > buflen)
-		len = buflen;
-	    memcpy(buf, fmt, len);
-	    buf += len;
-	    buflen -= len;
-	    fmt = f;
-	}
-	if (*fmt == 0)
-	    break;
-	c = *++fmt;
-	width = prec = 0;
-	fillch = ' ';
-	if (c == '0') {
-	    fillch = '0';
-	    c = *++fmt;
-	}
-	if (c == '*') {
-	    width = va_arg(args, int);
-	    c = *++fmt;
-	} else {
-	    while (qemu_isdigit(c)) {
-		width = width * 10 + c - '0';
-		c = *++fmt;
-	    }
-	}
-	if (c == '.') {
-	    c = *++fmt;
-	    if (c == '*') {
-		prec = va_arg(args, int);
-		c = *++fmt;
-	    } else {
-		while (qemu_isdigit(c)) {
-		    prec = prec * 10 + c - '0';
-		    c = *++fmt;
-		}
-	    }
-	}
-        /* modifiers */
-        switch(c) {
-        case 'l':
-            c = *++fmt;
-            break;
-        default:
-            break;
-        }
-        str = 0;
-	base = 0;
-	neg = 0;
-	++fmt;
-	switch (c) {
-	case 'd':
-	    i = va_arg(args, int);
-	    if (i < 0) {
-		neg = 1;
-		val = -i;
-	    } else
-		val = i;
-	    base = 10;
-	    break;
-	case 'o':
-	    val = va_arg(args, unsigned int);
-	    base = 8;
-	    break;
-	case 'x':
-	case 'X':
-	    val = va_arg(args, unsigned int);
-	    base = 16;
-	    break;
-	case 'p':
-	    val = (unsigned long) va_arg(args, void *);
-	    base = 16;
-	    neg = 2;
-	    break;
-	case 's':
-	    str = va_arg(args, char *);
-	    break;
-	case 'c':
-	    num[0] = va_arg(args, int);
-	    num[1] = 0;
-	    str = num;
-	    break;
-	default:
-	    *buf++ = '%';
-	    if (c != '%')
-		--fmt;		/* so %z outputs %z etc. */
-	    --buflen;
-	    continue;
-	}
-	if (base != 0) {
-	    str = num + sizeof(num);
-	    *--str = 0;
-	    while (str > num + neg) {
-		*--str = hexchars[val % base];
-		val = val / base;
-		if (--prec <= 0 && val == 0)
-		    break;
-	    }
-	    switch (neg) {
-	    case 1:
-		*--str = '-';
-		break;
-	    case 2:
-		*--str = 'x';
-		*--str = '0';
-		break;
-	    }
-	    len = num + sizeof(num) - 1 - str;
-	} else {
-	    len = strlen(str);
-	    if (prec > 0 && len > prec)
-		len = prec;
-	}
-	if (width > 0) {
-	    if (width > buflen)
-		width = buflen;
-	    if ((n = width - len) > 0) {
-		buflen -= n;
-		for (; n > 0; --n)
-		    *buf++ = fillch;
-	    }
-	}
-	if (len > buflen)
-	    len = buflen;
-	memcpy(buf, str, len);
-	buf += len;
-	buflen -= len;
+  union {
+    unsigned long long ns100; /*time since 1 Jan 1601 in 100ns units */
+    FILETIME ft;
+  }  _now;
+
+  if(tp)
+    {
+      GetSystemTimeAsFileTime (&_now.ft);
+      tp->tv_usec=(long)((_now.ns100 / 10ULL) % 1000000ULL );
+      tp->tv_sec= (long)((_now.ns100 - _W32_FT_OFFSET) / 10000000ULL);
     }
-    *buf = 0;
-    return buf - buf0;
+  /* Always return 0 as per Open Group Base Specifications Issue 6.
+     Do not set errno on error.  */
+  return 0;
 }
+#endif /* _WIN32 */
 
-void qemu_vprintf(const char *fmt, va_list ap)
-{
-    char buf[1024];
-    int len;
-
-    len = qemu_vsnprintf(buf, sizeof(buf), fmt, ap);
-    qemu_write(1, buf, len);
-}
-
-void qemu_printf(const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
-    qemu_vprintf(fmt, ap);
-    va_end(ap);
-}
 
diff --git a/osdep.h b/osdep.h
index 7cb86da..626cea1 100644
--- a/osdep.h
+++ b/osdep.h
@@ -2,9 +2,17 @@
 #define QEMU_OSDEP_H
 
 #include <stdarg.h>
-#include <setjmp.h>
-#include <stddef.h>
-#include "config.h"
+#ifdef __OpenBSD__
+#include <sys/types.h>
+#include <sys/signal.h>
+#endif
+
+#ifndef glue
+#define xglue(x, y) x ## y
+#define glue(x, y) xglue(x, y)
+#define stringify(s)	tostring(s)
+#define tostring(s)	#s
+#endif
 
 #ifndef container_of
 #define container_of(ptr, type, member) ({                      \
@@ -12,53 +20,71 @@
         (type *) ((char *) __mptr - offsetof(type, member));})
 #endif
 
-int qemu_vsnprintf(char *buf, int buflen, const char *fmt, va_list args);
-void qemu_vprintf(const char *fmt, va_list ap);
-void qemu_printf(const char *fmt, ...);
+#ifndef likely
+#if __GNUC__ < 3
+#define __builtin_expect(x, n) (x)
+#endif
 
-void *qemu_malloc(size_t size);
-void *qemu_mallocz(size_t size);
-void qemu_free(void *ptr);
-char *qemu_strdup(const char *str);
+#define likely(x)   __builtin_expect(!!(x), 1)
+#define unlikely(x)   __builtin_expect(!!(x), 0)
+#endif
 
-void *qemu_vmalloc(size_t size);
-void qemu_vfree(void *ptr);
+#ifndef offsetof
+#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *) 0)->MEMBER)
+#endif
+#ifndef container_of
+#define container_of(ptr, type, member) ({                      \
+        const typeof(((type *) 0)->member) *__mptr = (ptr);     \
+        (type *) ((char *) __mptr - offsetof(type, member));})
+#endif
 
-void *get_mmap_addr(unsigned long size);
+#ifndef MIN
+#define MIN(a, b) (((a) < (b)) ? (a) : (b))
+#endif
+#ifndef MAX
+#define MAX(a, b) (((a) > (b)) ? (a) : (b))
+#endif
 
-/* specific kludges for OS compatibility (should be moved elsewhere) */
-#if defined(__i386__) && !defined(CONFIG_SOFTMMU) && !defined(CONFIG_USER_ONLY)
+#ifndef ARRAY_SIZE
+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#endif
 
-/* disabled pthread version of longjmp which prevent us from using an
-   alternative signal stack */
-extern void __longjmp(jmp_buf env, int val);
-#define longjmp __longjmp
+#ifndef always_inline
+#if (__GNUC__ < 3) || defined(__APPLE__)
+#define always_inline inline
+#else
+#define always_inline __attribute__ (( always_inline )) __inline__
+#define inline always_inline
+#endif
+#else
+#define inline always_inline
+#endif
 
-#include <signal.h>
+#ifdef __i386__
+#define REGPARM __attribute((regparm(3)))
+#else
+#define REGPARM
+#endif
 
-struct siginfo;
+#define qemu_printf printf
 
-/* NOTE: it works only because the glibc sigset_t is >= kernel sigset_t */
-struct qemu_sigaction {
-    union {
-        void (*_sa_handler)(int);
-        void (*_sa_sigaction)(int, struct siginfo *, void *);
-    } _u;
-    unsigned long sa_flags;
-    void (*sa_restorer)(void);
-    sigset_t sa_mask;		/* mask last for extensibility */
-};
+void *qemu_memalign(size_t alignment, size_t size);
+void *qemu_vmalloc(size_t size);
+void qemu_vfree(void *ptr);
 
-int qemu_sigaction(int signum, const struct qemu_sigaction *act,
-                   struct qemu_sigaction *oldact);
+int qemu_create_pidfile(const char *filename);
 
-#undef sigaction
-#undef sa_handler
-#undef sa_sigaction
-#define sigaction qemu_sigaction
-#define sa_handler	_u._sa_handler
-#define sa_sigaction	_u._sa_sigaction
+#ifdef _WIN32
+int ffs(int i);
 
-#endif
+typedef struct {
+    long tv_sec;
+    long tv_usec;
+} qemu_timeval;
+int qemu_gettimeofday(qemu_timeval *tp);
+#else
+typedef struct timeval qemu_timeval;
+#define qemu_gettimeofday(tp) gettimeofday(tp, NULL);
+#endif /* !_WIN32 */
 
 #endif
diff --git a/pc-bios/Makefile b/pc-bios/Makefile
deleted file mode 100644
index 7ae0ff0..0000000
--- a/pc-bios/Makefile
+++ /dev/null
@@ -1,24 +0,0 @@
-#
-# NOTE: only compilable with x86 cross compile tools
-#
-include ../config-host.mak
-
-DEFINES=
-
-TARGETS=
-ifeq ($(ARCH),i386)
-TARGETS+=linux_boot.bin
-endif
-
-all: $(TARGETS)
-
-linux_boot.bin: linux_boot.o
-	ld --oformat binary -Ttext 0 -o $@ $<
-	chmod a-x $@
-
-%.o: %.S
-	$(CC) $(DEFINES) -c -o $@ $<
-
-clean:
-	rm -f $(TARGETS) *.o *~
-
diff --git a/pc-bios/README b/pc-bios/README
deleted file mode 100644
index fc85eb4..0000000
--- a/pc-bios/README
+++ /dev/null
@@ -1,16 +0,0 @@
-- The PC BIOS comes from the Bochs project
-  (http://bochs.sourceforge.net/). A patch from bios.diff was applied.
-
-- The VGA BIOS and the Cirrus VGA BIOS come from the LGPL VGA bios
-  project (http://www.nongnu.org/vgabios/).
-
-- The PowerPC Open Hack'Ware Open Firmware Compatible BIOS is
-  available at http://perso.magic.fr/l_indien/OpenHackWare/index.htm.
-
-- video.x is a PowerMac NDRV compatible driver for a VGA frame
-  buffer. It comes from the Mac-on-Linux project
-  (http://www.maconlinux.org/).
-
-- OpenBIOS (http://www.openbios.org/) is a free (GPL v2) portable
-  firmware implementation. The goal is to implement a 100% IEEE
-  1275-1994 (referred to as Open Firmware) compliant firmware.
diff --git a/pc-bios/bios.bin b/pc-bios/bios.bin
deleted file mode 100644
index 64be517..0000000
--- a/pc-bios/bios.bin
+++ /dev/null
diff --git a/pc-bios/bios.diff b/pc-bios/bios.diff
deleted file mode 100644
index e875927..0000000
--- a/pc-bios/bios.diff
+++ /dev/null
@@ -1,270 +0,0 @@
-Index: apmbios.S
-===================================================================
-RCS file: /cvsroot/bochs/bochs/bios/apmbios.S,v
-retrieving revision 1.4
-diff -u -w -r1.4 apmbios.S
---- apmbios.S	26 Dec 2005 10:35:51 -0000	1.4
-+++ apmbios.S	3 May 2006 21:22:46 -0000
-@@ -225,6 +225,7 @@
- APMSYM(05):
-   cmp al, #0x05
-   jne APMSYM(07)
-+  sti
-   hlt
-   jmp APMSYM(ok)
- 
-Index: rombios.c
-===================================================================
-RCS file: /cvsroot/bochs/bochs/bios/rombios.c,v
-retrieving revision 1.160
-diff -u -w -r1.160 rombios.c
---- rombios.c	25 Jan 2006 17:51:49 -0000	1.160
-+++ rombios.c	3 May 2006 21:22:48 -0000
-@@ -1816,6 +1816,7 @@
- {
-   printf(BX_APPNAME" BIOS - build: %s\n%s\nOptions: ",
-     BIOS_BUILD_DATE, bios_cvs_version_string);
-+#if 0
-   printf(
- #ifdef BX_APM
-   "apmbios "
-@@ -1827,6 +1828,9 @@
-   "eltorito "
- #endif
-   "\n\n");
-+#else
-+  printf("apmbios pcibios eltorito \n\n");
-+#endif
- }
- 
- //--------------------------------------------------------------------------
-@@ -3999,6 +4003,29 @@
- }
- #endif
- 
-+
-+void set_e820_range(ES, DI, start, end, type)
-+     Bit16u ES; 
-+     Bit16u DI;
-+     Bit32u start;
-+     Bit32u end; 
-+     Bit16u type;
-+{
-+    write_word(ES, DI, start);
-+    write_word(ES, DI+2, start >> 16);
-+    write_word(ES, DI+4, 0x00);
-+    write_word(ES, DI+6, 0x00);
-+    
-+    end -= start;
-+    write_word(ES, DI+8, end);
-+    write_word(ES, DI+10, end >> 16);
-+    write_word(ES, DI+12, 0x0000);
-+    write_word(ES, DI+14, 0x0000);
-+    
-+    write_word(ES, DI+16, type);
-+    write_word(ES, DI+18, 0x0);
-+}
-+
-   void
- int15_function32(regs, ES, DS, FLAGS)
-   pushad_regs_t regs; // REGS pushed via pushad
-@@ -4063,19 +4090,8 @@
-                 switch(regs.u.r16.bx)
-                 {
-                     case 0:
--                        write_word(ES, regs.u.r16.di, 0x00);
--                        write_word(ES, regs.u.r16.di+2, 0x00);
--                        write_word(ES, regs.u.r16.di+4, 0x00);
--                        write_word(ES, regs.u.r16.di+6, 0x00);
--
--                        write_word(ES, regs.u.r16.di+8, 0xFC00);
--                        write_word(ES, regs.u.r16.di+10, 0x0009);
--                        write_word(ES, regs.u.r16.di+12, 0x0000);
--                        write_word(ES, regs.u.r16.di+14, 0x0000);
--
--                        write_word(ES, regs.u.r16.di+16, 0x1);
--                        write_word(ES, regs.u.r16.di+18, 0x0);
--
-+                        set_e820_range(ES, regs.u.r16.di, 
-+                                       0x0000000L, 0x0009fc00L, 1);
-                         regs.u.r32.ebx = 1;
-                         regs.u.r32.eax = 0x534D4150;
-                         regs.u.r32.ecx = 0x14;
-@@ -4083,6 +4099,24 @@
-                         return;
-                         break;
-                     case 1:
-+                        set_e820_range(ES, regs.u.r16.di, 
-+                                       0x0009fc00L, 0x000a0000L, 2);
-+                        regs.u.r32.ebx = 2;
-+                        regs.u.r32.eax = 0x534D4150;
-+                        regs.u.r32.ecx = 0x14;
-+                        CLEAR_CF();
-+                        return;
-+                        break;
-+                    case 2:
-+                        set_e820_range(ES, regs.u.r16.di, 
-+                                       0x000e8000L, 0x00100000L, 2);
-+                        regs.u.r32.ebx = 3;
-+                        regs.u.r32.eax = 0x534D4150;
-+                        regs.u.r32.ecx = 0x14;
-+                        CLEAR_CF();
-+                        return;
-+                        break;
-+                    case 3:
-                         extended_memory_size = inb_cmos(0x35);
-                         extended_memory_size <<= 8;
-                         extended_memory_size |= inb_cmos(0x34);
-@@ -4092,9 +4126,9 @@
-                             extended_memory_size = 0x3bc000; // everything after this is reserved memory until we get to 0x100000000
-                         }
-                         extended_memory_size *= 1024;
--                        extended_memory_size += 15728640; // make up for the 16mb of memory that is chopped off
-+                        extended_memory_size += (16L * 1024 * 1024);
- 
--                        if(extended_memory_size <= 15728640)
-+                        if(extended_memory_size <= (16L * 1024 * 1024))
-                         {
-                             extended_memory_size = inb_cmos(0x31);
-                             extended_memory_size <<= 8;
-@@ -4102,28 +4136,23 @@
-                             extended_memory_size *= 1024;
-                         }
- 
--                        write_word(ES, regs.u.r16.di, 0x0000);
--                        write_word(ES, regs.u.r16.di+2, 0x0010);
--                        write_word(ES, regs.u.r16.di+4, 0x0000);
--                        write_word(ES, regs.u.r16.di+6, 0x0000);
--
--                        write_word(ES, regs.u.r16.di+8, extended_memory_size);
--                        extended_memory_size >>= 16;
--                        write_word(ES, regs.u.r16.di+10, extended_memory_size);
--                        extended_memory_size >>= 16;
--                        write_word(ES, regs.u.r16.di+12, extended_memory_size);
--                        extended_memory_size >>= 16;
--                        write_word(ES, regs.u.r16.di+14, extended_memory_size);
--
--                        write_word(ES, regs.u.r16.di+16, 0x1);
--                        write_word(ES, regs.u.r16.di+18, 0x0);
--
--                        regs.u.r32.ebx = 0;
-+                        set_e820_range(ES, regs.u.r16.di, 
-+                                       0x00100000L, extended_memory_size, 1);
-+                        regs.u.r32.ebx = 4;
-                         regs.u.r32.eax = 0x534D4150;
-                         regs.u.r32.ecx = 0x14;
-                         CLEAR_CF();
-                         return;
-                         break;
-+                    case 4:
-+                        /* 256KB BIOS area at the end of 4 GB */
-+                        set_e820_range(ES, regs.u.r16.di, 
-+                                       0xfffc0000L, 0x00000000L, 2);
-+                        regs.u.r32.ebx = 0;
-+                        regs.u.r32.eax = 0x534D4150;
-+                        regs.u.r32.ecx = 0x14;
-+                        CLEAR_CF();
-+                        return;
-                     default:  /* AX=E820, DX=534D4150, BX unrecognized */
-                         goto int15_unimplemented;
-                         break;
-@@ -8713,6 +8742,7 @@
-   mov al, #0x80
- bios32_end:
-   popf
-+  and dword ptr[esp+4],0xfffffffc ;; reset CS.RPL for kqemu
-   retf
- 
- .align 16
-@@ -8823,17 +8853,17 @@
- pci_pro_fail:
-   pop edi
-   pop esi
--  sti
-   popf
-   stc
-+  and dword ptr[esp+4],0xfffffffc ;; reset CS.RPL for kqemu
-   retf
- pci_pro_ok:
-   xor ah, ah
-   pop edi
-   pop esi
--  sti
-   popf
-   clc
-+  and dword ptr[esp+4],0xfffffffc ;; reset CS.RPL for kqemu
-   retf
- 
- pci_pro_select_reg:
-@@ -8971,7 +9001,7 @@
-   jmp pci_real_ok
- pci_real_f0d: ;; write configuration dword
-   cmp al, #0x0d
--  jne pci_real_unknown
-+  jne pci_real_f0e
-   call pci_real_select_reg
-   push dx
-   mov dx, #0x0cfc
-@@ -8979,6 +9009,46 @@
-   out dx, eax
-   pop dx
-   jmp pci_real_ok
-+pci_real_f0e: ;; get irq routing options
-+  cmp al, #0x0e
-+  jne pci_real_unknown
-+  SEG ES
-+  cmp word ptr [di], #pci_routing_table_structure_end - pci_routing_table_structure_start
-+  jb pci_real_too_small    
-+  SEG ES
-+  mov word ptr [di], #pci_routing_table_structure_end - pci_routing_table_structure_start        
-+  pushf
-+  push ds
-+  push es
-+  push cx
-+  push si
-+  push di
-+  cld
-+  mov si, #pci_routing_table_structure_start
-+  push cs
-+  pop ds
-+  SEG ES
-+  mov cx, [di+2]
-+  SEG ES
-+  mov es, [di+4]
-+  mov di, cx
-+  mov cx, #pci_routing_table_structure_end - pci_routing_table_structure_start
-+  rep 
-+      movsb
-+  pop di
-+  pop si
-+  pop cx
-+  pop es
-+  pop ds
-+  popf
-+  mov bx, #(1 << 9) | (1 << 11)   ;; irq 9 and 11 are used
-+  jmp pci_real_ok
-+pci_real_too_small:
-+  SEG ES
-+  mov word ptr [di], #pci_routing_table_structure_end - pci_routing_table_structure_start        
-+  mov ah, #0x89
-+  jmp pci_real_fail
-+
- pci_real_unknown:
-   mov ah, #0x81
- pci_real_fail:
-@@ -9019,6 +9089,7 @@
-   dw 0,0 ;; Miniport data
-   db 0,0,0,0,0,0,0,0,0,0,0 ;; reserved
-   db 0x07 ;; checksum
-+pci_routing_table_structure_start:
-   ;; first slot entry PCI-to-ISA (embedded)
-   db 0 ;; pci bus number
-   db 0x08 ;; pci device number (bit 7-3)
-@@ -9097,6 +9168,7 @@
-   dw 0xdef8 ;; IRQ bitmap INTD#
-   db 5 ;; physical slot (0 = embedded)
-   db 0 ;; reserved
-+pci_routing_table_structure_end:
- 
- pci_irq_list:
-   db 11, 10, 9, 5;
diff --git a/pc-bios/linux_boot.S b/pc-bios/linux_boot.S
deleted file mode 100644
index 22fcd4b..0000000
--- a/pc-bios/linux_boot.S
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * QEMU Boot sector to launch a preloaded Linux kernel
- * Copyright (c) 2004 Fabrice Bellard
- */
-
-#define LOAD_SEG 0x9000
-        
-.code16	
-.text
-	.globl	_start
-
-_start:
-        cli
-        cld
-        mov $LOAD_SEG, %ax
-        mov %ax, %ds
-        mov %ax, %es
-        mov %ax, %fs
-        mov %ax, %gs
-        mov %ax, %ss
-        mov $0x8ffe, %sp
-        ljmp $LOAD_SEG + 0x20, $0
-
-1:              
-        .fill 510 - (1b - _start), 1, 0
-
-        /* boot sector signature */
-        .byte 0x55
-        .byte 0xaa
diff --git a/pc-bios/linux_boot.bin b/pc-bios/linux_boot.bin
deleted file mode 100644
index 80f7b5f..0000000
--- a/pc-bios/linux_boot.bin
+++ /dev/null
diff --git a/pc-bios/ohw.diff b/pc-bios/ohw.diff
deleted file mode 100644
index 4fb5422..0000000
--- a/pc-bios/ohw.diff
+++ /dev/null
@@ -1,1843 +0,0 @@
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/bios.h OpenHackWare-release-0.4/src/bios.h
---- OpenHackWare-release-0.4.org/src/bios.h	2005-04-06 23:20:22.000000000 +0200
-+++ OpenHackWare-release-0.4/src/bios.h	2005-07-07 01:10:20.000000000 +0200
-@@ -64,6 +64,7 @@
-     ARCH_CHRP,
-     ARCH_MAC99,
-     ARCH_POP,
-+    ARCH_HEATHROW,
- };
- 
- /* Hardware definition(s) */
-@@ -174,6 +175,7 @@
- int bd_ioctl (bloc_device_t *bd, int func, void *args);
- uint32_t bd_seclen (bloc_device_t *bd);
- void bd_close (bloc_device_t *bd);
-+void bd_reset_all(void);
- uint32_t bd_seclen (bloc_device_t *bd);
- uint32_t bd_maxbloc (bloc_device_t *bd);
- void bd_sect2CHS (bloc_device_t *bd, uint32_t secnum,
-@@ -183,12 +185,12 @@
- part_t *bd_probe (int boot_device);
- bloc_device_t *bd_get (int device);
- void bd_put (bloc_device_t *bd);
--void bd_set_boot_part (bloc_device_t *bd, part_t *partition);
-+void bd_set_boot_part (bloc_device_t *bd, part_t *partition, int partnum);
- part_t **_bd_parts (bloc_device_t *bd);
- 
- void ide_pci_pc_register (uint32_t io_base0, uint32_t io_base1,
-                           uint32_t io_base2, uint32_t io_base3,
--                          void *OF_private);
-+                          void *OF_private0, void *OF_private1);
- void ide_pci_pmac_register (uint32_t io_base0, uint32_t io_base1,
-                             void *OF_private);
- 
-@@ -399,17 +401,23 @@
-                               uint16_t min_grant, uint16_t max_latency);
- void OF_finalize_pci_host (void *dev, int first_bus, int nb_busses);
- void OF_finalize_pci_device (void *dev, uint8_t bus, uint8_t devfn,
--                             uint32_t *regions, uint32_t *sizes);
-+                             uint32_t *regions, uint32_t *sizes,
-+                             int irq_line);
- void OF_finalize_pci_macio (void *dev, uint32_t base_address, uint32_t size,
-                             void *private_data);
-+void OF_finalize_pci_ide (void *dev, 
-+                          uint32_t io_base0, uint32_t io_base1,
-+                          uint32_t io_base2, uint32_t io_base3);
- int OF_register_bus (const unsigned char *name, uint32_t address,
-                      const unsigned char *type);
- int OF_register_serial (const unsigned char *bus, const unsigned char *name,
-                         uint32_t io_base, int irq);
- int OF_register_stdio (const unsigned char *dev_in,
-                        const unsigned char *dev_out);
--void OF_vga_register (const unsigned char *name, uint32_t address,
--                      int width, int height, int depth);
-+void OF_vga_register (const unsigned char *name, unused uint32_t address,
-+                      int width, int height, int depth,
-+                      unsigned long vga_bios_addr, 
-+                      unsigned long vga_bios_size);
- void *OF_blockdev_register (void *parent, void *private,
-                             const unsigned char *type,
-                             const unsigned char *name, int devnum,
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/bloc.c OpenHackWare-release-0.4/src/bloc.c
---- OpenHackWare-release-0.4.org/src/bloc.c	2005-04-06 23:21:00.000000000 +0200
-+++ OpenHackWare-release-0.4/src/bloc.c	2005-07-08 00:28:26.000000000 +0200
-@@ -55,6 +55,7 @@
-     /* Partitions */
-     part_t *parts, *bparts;
-     part_t *boot_part;
-+    int bpartnum;
-     /* Chain */
-     bloc_device_t *next;
- };
-@@ -66,6 +67,7 @@
- 
- static int ide_initialize (bloc_device_t *bd, int device);
- static int ide_read_sector (bloc_device_t *bd, void *buffer, int secnum);
-+static int ide_reset (bloc_device_t *bd);
- 
- static int mem_initialize (bloc_device_t *bd, int device);
- static int mem_read_sector (bloc_device_t *bd, void *buffer, int secnum);
-@@ -212,6 +214,17 @@
- {
- }
- 
-+void bd_reset_all(void)
-+{
-+    bloc_device_t *bd;
-+    for (bd = bd_list; bd != NULL; bd = bd->next) {
-+        if (bd->init == &ide_initialize) {
-+            /* reset IDE drive because Darwin wants all IDE devices to be reset */
-+            ide_reset(bd);
-+        }
-+    }
-+}
-+
- uint32_t bd_seclen (bloc_device_t *bd)
- {
-     return bd->seclen;
-@@ -223,10 +236,12 @@
- }
- 
- /* XXX: to be suppressed */
--void bd_set_boot_part (bloc_device_t *bd, part_t *partition)
-+void bd_set_boot_part (bloc_device_t *bd, part_t *partition, int partnum)
- {
-+    dprintf("%s: part %p (%p) %d\n", __func__, partition, bd->boot_part, partnum);
-     if (bd->boot_part == NULL) {
-         bd->boot_part = partition;
-+        bd->bpartnum = partnum;
-     }
- }
- 
-@@ -240,6 +255,13 @@
-     return &bd->bparts;
- }
- 
-+void bd_set_boot_device (bloc_device_t *bd)
-+{
-+#if defined (USE_OPENFIRMWARE)
-+    OF_blockdev_set_boot_device(bd->OF_private, bd->bpartnum, "\\\\ofwboot");
-+#endif
-+}
-+
- part_t *bd_probe (int boot_device)
- {
-     char devices[] = { /*'a', 'b',*/ 'c', 'd', 'e', 'f', 'm', '\0', };
-@@ -272,9 +294,7 @@
-         tmp = part_probe(bd, force_raw);
-         if (boot_device == bd->device) {
-             boot_part = tmp;
--#if defined (USE_OPENFIRMWARE)
--            OF_blockdev_set_boot_device(bd->OF_private, 2, "\\\\ofwboot");
--#endif
-+            bd_set_boot_device(bd);
-         }
-     }
- 
-@@ -717,34 +737,29 @@
- /* IDE PCI access for pc */
- static uint8_t ide_pci_port_read (bloc_device_t *bd, int port)
- {
--    eieio();
--
--    return *(uint8_t *)(bd->io_base + port);
-+    uint8_t value;
-+    value = inb(bd->io_base + port);
-+    return value;
- }
- 
- static void ide_pci_port_write (bloc_device_t *bd, int port, uint8_t value)
- {
--    *(uint8_t *)(bd->io_base + port) = value;
--    eieio();
-+    outb(bd->io_base + port, value);
- }
- 
- static uint32_t ide_pci_data_readl (bloc_device_t *bd)
- {
--    eieio();
--
--    return *((uint32_t *)bd->io_base);
-+    return inl(bd->io_base);
- }
- 
- static void ide_pci_data_writel (bloc_device_t *bd, uint32_t val)
- {
--    *(uint32_t *)(bd->io_base) = val;
--    eieio();
-+    outl(bd->io_base, val);
- }
- 
- static void ide_pci_control_write (bloc_device_t *bd, uint32_t val)
- {
--    *((uint8_t *)bd->tmp) = val;
--    eieio();
-+    outb(bd->tmp + 2, val);
- }
- 
- static ide_ops_t ide_pci_pc_ops = {
-@@ -761,7 +776,7 @@
- 
- void ide_pci_pc_register (uint32_t io_base0, uint32_t io_base1,
-                           uint32_t io_base2, uint32_t io_base3,
--                          unused void *OF_private)
-+                          void *OF_private0, void *OF_private1)
- {
-     if (ide_pci_ops == NULL) {
-         ide_pci_ops = malloc(sizeof(ide_ops_t));
-@@ -770,19 +785,19 @@
-         memcpy(ide_pci_ops, &ide_pci_pc_ops, sizeof(ide_ops_t));
-     }
-     if ((io_base0 != 0 || io_base1 != 0) &&
--        ide_pci_ops->base[0] == 0 && ide_pci_ops->base[1] == 0) {
-+        ide_pci_ops->base[0] == 0 && ide_pci_ops->base[2] == 0) {
-         ide_pci_ops->base[0] = io_base0;
--        ide_pci_ops->base[1] = io_base1;
-+        ide_pci_ops->base[2] = io_base1;
- #ifdef USE_OPENFIRMWARE
--        ide_pci_ops->OF_private[0] = OF_private;
-+        ide_pci_ops->OF_private[0] = OF_private0;
- #endif
-     }
-     if ((io_base2 != 0 || io_base3 != 0) &&
--        ide_pci_ops->base[2] == 0 && ide_pci_ops->base[3] == 0) {
--        ide_pci_ops->base[2] = io_base2;
-+        ide_pci_ops->base[1] == 0 && ide_pci_ops->base[3] == 0) {
-+        ide_pci_ops->base[1] = io_base2;
-         ide_pci_ops->base[3] = io_base3;
- #ifdef USE_OPENFIRMWARE
--        ide_pci_ops->OF_private[1] = OF_private;
-+        ide_pci_ops->OF_private[1] = OF_private1;
- #endif
-     }
- }
-@@ -935,6 +950,8 @@
- }
- 
- static void atapi_pad_req (void *buffer, int len);
-+static void atapi_make_req (bloc_device_t *bd, uint32_t *buffer,
-+                            int maxlen);
- static int atapi_read_sector (bloc_device_t *bd, void *buffer, int secnum);
- 
- static int ide_initialize (bloc_device_t *bd, int device)
-@@ -1035,9 +1052,7 @@
-         DPRINTF("INQUIRY\n");
-         len = spc_inquiry_req(&atapi_buffer, 36);
-         atapi_pad_req(&atapi_buffer, len);
--        ide_port_write(bd, 0x07, 0xA0);
--        for (i = 0; i < 3; i++)
--            ide_data_writel(bd, ldswap32(&atapi_buffer[i]));
-+        atapi_make_req(bd, atapi_buffer, 36);
-         status = ide_port_read(bd, 0x07);
-         if (status != 0x48) {
-             ERROR("ATAPI INQUIRY : status %0x != 0x48\n", status);
-@@ -1053,9 +1068,7 @@
-         DPRINTF("READ_CAPACITY\n");
-         len = mmc_read_capacity_req(&atapi_buffer);
-         atapi_pad_req(&atapi_buffer, len);
--        ide_port_write(bd, 0x07, 0xA0);
--        for (i = 0; i < 3; i++)
--            ide_data_writel(bd, ldswap32(&atapi_buffer[i]));
-+        atapi_make_req(bd, atapi_buffer, 8);
-         status = ide_port_read(bd, 0x07);
-         if (status != 0x48) {
-             ERROR("ATAPI READ_CAPACITY : status %0x != 0x48\n", status);
-@@ -1105,6 +1118,22 @@
-     memset(p + len, 0, 12 - len);
- }
- 
-+static void atapi_make_req (bloc_device_t *bd, uint32_t *buffer,
-+                            int maxlen)
-+{
-+    int i;
-+    /* select drive */
-+    if (bd->drv == 0)
-+        ide_port_write(bd, 0x06, 0x40);
-+    else
-+        ide_port_write(bd, 0x06, 0x50);
-+    ide_port_write(bd, 0x04, maxlen & 0xff);
-+    ide_port_write(bd, 0x05, (maxlen >> 8) & 0xff);
-+    ide_port_write(bd, 0x07, 0xA0);
-+    for (i = 0; i < 3; i++)
-+        ide_data_writel(bd, ldswap32(&buffer[i]));
-+}
-+
- static int atapi_read_sector (bloc_device_t *bd, void *buffer, int secnum)
- {
-     uint32_t atapi_buffer[4];
-@@ -1112,16 +1141,9 @@
-     uint32_t status, value;
-     int i, len;
- 
--    /* select drive */
--    if (bd->drv == 0)
--        ide_port_write(bd, 0x06, 0x40);
--    else
--        ide_port_write(bd, 0x06, 0x50);
-     len = mmc_read12_req(atapi_buffer, secnum, 1);
-     atapi_pad_req(&atapi_buffer, len);
--    ide_port_write(bd, 0x07, 0xA0);
--    for (i = 0; i < 3; i++)
--        ide_data_writel(bd, ldswap32(&atapi_buffer[i]));
-+    atapi_make_req(bd, atapi_buffer, bd->seclen);
-     status = ide_port_read(bd, 0x07);
-     if (status != 0x48) {
-         ERROR("ATAPI READ12 : status %0x != 0x48\n", status);
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/libpart/apple.c OpenHackWare-release-0.4/src/libpart/apple.c
---- OpenHackWare-release-0.4.org/src/libpart/apple.c	2005-03-31 09:23:33.000000000 +0200
-+++ OpenHackWare-release-0.4/src/libpart/apple.c	2005-07-03 16:17:41.000000000 +0200
-@@ -199,14 +199,18 @@
-         if (len == 0) {
-             /* Place holder. Skip it */
-             DPRINTF("%s placeholder part\t%d\n", __func__, i);
-+            part->flags = PART_TYPE_APPLE | PART_FLAG_DUMMY;
-+            part_register(bd, part, name, i);
-         } else if (strncmp("Apple_Void", type, 32) == 0) {
-             /* Void partition. Skip it */
-             DPRINTF("%s Void part\t%d [%s]\n", __func__, i, type);
-+            part->flags = PART_TYPE_APPLE | PART_FLAG_DUMMY;
-+            part_register(bd, part, name, i);
-         } else if (strncmp("Apple_Free", type, 32) == 0) {
-             /* Free space. Skip it */
-             DPRINTF("%s Free part (%d)\n", __func__, i);
-             part->flags = PART_TYPE_APPLE | PART_FLAG_DUMMY;
--            part_register(bd, part, name);
-+            part_register(bd, part, name, i);
-         } else if (strncmp("Apple_partition_map", type, 32) == 0 ||
-                    strncmp("Apple_Partition_Map", type, 32) == 0
- #if 0 // Is this really used or is it just a mistake ?
-@@ -226,7 +230,7 @@
-                  */
-             }
-             part->flags = PART_TYPE_APPLE | PART_FLAG_DUMMY;
--            part_register(bd, part, name);
-+            part_register(bd, part, name, i);
-         } else if (strncmp("Apple_Driver", type, 32) == 0 ||
-                    strncmp("Apple_Driver43", type, 32) == 0 ||
-                    strncmp("Apple_Driver43_CD", type, 32) == 0 ||
-@@ -236,8 +240,12 @@
-                    strncmp("Apple_Driver_IOKit", type, 32) == 0) {
-             /* Drivers. don't care for now */
-             DPRINTF("%s Drivers part\t%d [%s]\n", __func__, i, type);
-+            part->flags = PART_TYPE_APPLE | PART_FLAG_DRIVER;
-+            part_register(bd, part, name, i);
-         } else if (strncmp("Apple_Patches", type, 32) == 0) {
-             /* Patches: don't care for now */
-+            part->flags = PART_TYPE_APPLE | PART_FLAG_PATCH;
-+            part_register(bd, part, name, i);
-             DPRINTF("%s Patches part\t%d [%s]\n", __func__, i, type);
-         } else if (strncmp("Apple_HFS", type, 32) == 0 ||
-                    strncmp("Apple_MFS", type, 32) == 0 ||
-@@ -256,9 +264,8 @@
-             count = partmap->bloc_cnt * HFS_BLOCSIZE;
-             if (partmap->boot_size == 0 || partmap->boot_load == 0) {
-                 printf("Not a bootable partition %d %d (%p %p)\n",
--                       partmap->boot_size, partmap->boot_load,boot_part, part);
--                if (boot_part == NULL)
--                    boot_part = part;
-+                       partmap->boot_size, partmap->boot_load,
-+                       boot_part, part);
-                 part->flags = PART_TYPE_APPLE | PART_FLAG_FS;
-             } else {
-                 part->boot_start.bloc = partmap->boot_start;
-@@ -278,8 +285,8 @@
-                 boot_part = part;
-                 part->flags = PART_TYPE_APPLE | PART_FLAG_FS | PART_FLAG_BOOT;
-             }
--            printf("Partition: %d %s st %0x size %0x",
--                    i, name, partmap->start_bloc, partmap->bloc_cnt);
-+            printf("Partition: %d '%s' '%s' st %0x size %0x",
-+                    i, name, type, partmap->start_bloc, partmap->bloc_cnt);
- #ifndef DEBUG
-             printf("\n");
- #endif
-@@ -290,11 +297,13 @@
-                     part->boot_load, part->boot_entry);
-             DPRINTF("                           load %0x entry %0x %0x\n",
-                     partmap->boot_load2, partmap->boot_entry2, HFS_BLOCSIZE);
--            part_register(bd, part, name);
-+            part_register(bd, part, name, i);
-         } else {
-             memcpy(tmp, type, 32);
-             tmp[32] = '\0';
-             ERROR("Unknown partition type [%s]\n", tmp);
-+            part->flags = PART_TYPE_APPLE | PART_FLAG_DUMMY;
-+            part_register(bd, part, name, i);
-         }
-     }
-  error:
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/libpart/core.c OpenHackWare-release-0.4/src/libpart/core.c
---- OpenHackWare-release-0.4.org/src/libpart/core.c	2005-03-31 09:23:33.000000000 +0200
-+++ OpenHackWare-release-0.4/src/libpart/core.c	2005-07-03 16:17:41.000000000 +0200
-@@ -126,7 +126,7 @@
- }
- 
- int part_register (bloc_device_t *bd, part_t *partition,
--                   const unsigned char *name)
-+                   const unsigned char *name, int partnum)
- {
-     part_t **cur;
- 
-@@ -134,6 +134,7 @@
-     partition->bd = bd;
-     partition->next = NULL;
-     partition->name = strdup(name);
-+    partition->partnum = partnum;
-     for (cur = _bd_parts(bd); *cur != NULL; cur = &(*cur)->next)
-         continue;
-     *cur = partition;
-@@ -141,29 +142,15 @@
-     return 0;
- }
- 
--static inline int set_boot_part (bloc_device_t *bd, int partnum)
--{
--    part_t *cur;
--
--    cur = part_get(bd, partnum);
--    if (cur == NULL)
--        return -1;
--    bd_set_boot_part(bd, cur);
--
--    return 0;
--}
--
- part_t *part_get (bloc_device_t *bd, int partnum)
- {
-     part_t **listp, *cur;
--    int i;
- 
-     listp = _bd_parts(bd);
--    cur = *listp;
--    for (i = 0; i != partnum; i++) {
--        if (cur == NULL)
-+    
-+    for (cur = *listp; cur != NULL; cur = cur->next) {
-+        if (cur->partnum == partnum)
-             break;
--        cur = cur->next;
-     }
-     
-     return cur;
-@@ -192,17 +179,20 @@
-     part_set_blocsize(bd, part, 512);
-     part->bd = bd;
-     part->flags = PART_TYPE_RAW | PART_FLAG_BOOT;
--    part_register(bd, part, "Raw");
-+    part_register(bd, part, "Raw", 0);
- 
-     return part;
- }
- 
-+bloc_device_t *part_get_bd (part_t *part)
-+{
-+    return part->bd;
-+}
-+
- part_t *part_probe (bloc_device_t *bd, int set_raw)
- {
--    part_t *part0, *boot_part, **cur;
-+    part_t *part0 = NULL, *boot_part, **cur;
- 
--    /* Register the 0 partition: raw partition containing the whole disk */
--    part0 = part_get_raw(bd);
-     /* Try to find a valid boot partition */
-     boot_part = Apple_probe_partitions(bd);
-     if (boot_part == NULL) {
-@@ -210,10 +200,13 @@
-         if (boot_part == NULL && arch == ARCH_PREP)
-             boot_part = PREP_find_partition(bd);
-         if (boot_part == NULL && set_raw != 0) {
--            boot_part = part0;
--            set_boot_part(bd, 0);
-+            dprintf("Use bloc device as raw partition\n");
-         }
-     }
-+    if (_bd_parts(bd) == NULL) {
-+        /* Register the 0 partition: raw partition containing the whole disk */
-+        part0 = part_get_raw(bd);
-+    }
-     /* Probe filesystem on each found partition */
-     for (cur = _bd_parts(bd); *cur != NULL; cur = &(*cur)->next) {
-         const unsigned char *map, *type;
-@@ -248,23 +241,28 @@
-             type = "unknown";
-             break;
-         }
--        DPRINTF("Probe filesystem on %s %s partition '%s' %s\n",
-+        dprintf("Probe filesystem on %s %s partition '%s' %s %p\n",
-                 type, map, (*cur)->name,
--                ((*cur)->flags) & PART_FLAG_BOOT ? "(bootable)" : "");
-+                ((*cur)->flags) & PART_FLAG_BOOT ? "(bootable)" : "", *cur);
-         if (((*cur)->flags) & PART_FLAG_FS) {
-             if (((*cur)->flags) & PART_FLAG_BOOT)
-                 (*cur)->fs = fs_probe(*cur, 1);
-             else
-                 (*cur)->fs = fs_probe(*cur, 0);
-+        } else if (((*cur)->flags) & PART_TYPE_RAW) {
-+            (*cur)->fs = fs_probe(*cur, 2);
-         } else {
-             (*cur)->fs = fs_probe(*cur, 2);
-         }
--        if (((*cur)->flags) & PART_FLAG_BOOT) {
--            bd_set_boot_part(bd, *cur);
-             fs_get_bootfile((*cur)->fs);
-+        if (((*cur)->flags) & PART_FLAG_BOOT) {
-+            dprintf("Partition is bootable (%d)\n", (*cur)->partnum);
-+            bd_set_boot_part(bd, *cur, (*cur)->partnum);
-+            if (boot_part == NULL)
-+                boot_part = *cur;
-         }
-     }
--    DPRINTF("Boot partition: %p %p %p %p\n", boot_part, boot_part->fs,
-+    dprintf("Boot partition: %p %p %p %p\n", boot_part, boot_part->fs,
-             part_fs(boot_part), part0);
- 
-     return boot_part;
-@@ -279,6 +277,7 @@
-     part->boot_size.offset = 0;
-     part->boot_load = 0;
-     part->boot_entry = 0;
-+    part->flags |= PART_FLAG_BOOT;
- 
-     return 0;
- }
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/libpart/isofs.c OpenHackWare-release-0.4/src/libpart/isofs.c
---- OpenHackWare-release-0.4.org/src/libpart/isofs.c	2005-03-31 09:23:33.000000000 +0200
-+++ OpenHackWare-release-0.4/src/libpart/isofs.c	2005-07-03 16:17:41.000000000 +0200
-@@ -242,7 +242,7 @@
-                    part->boot_start.bloc, part->boot_size.bloc,
-                    part->boot_load, part->boot_entry);
-             part->flags = PART_TYPE_ISO9660 | PART_FLAG_BOOT;
--            part_register(bd, part, name);
-+            part_register(bd, part, name, i + 1);
-             fs_raw_set_bootfile(part, part->boot_start.bloc,
-                                 part->boot_start.offset,
-                                 part->boot_size.bloc,
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/libpart/libpart.h OpenHackWare-release-0.4/src/libpart/libpart.h
---- OpenHackWare-release-0.4.org/src/libpart/libpart.h	2005-03-31 09:23:33.000000000 +0200
-+++ OpenHackWare-release-0.4/src/libpart/libpart.h	2005-07-03 16:17:41.000000000 +0200
-@@ -30,6 +30,7 @@
- 
- struct part_t {
-     bloc_device_t *bd;
-+    int partnum;
-     uint32_t start;      /* Partition first bloc             */
-     uint32_t size;       /* Partition size, in blocs         */
-     uint32_t spb;
-@@ -54,7 +55,7 @@
- };
- 
- int part_register (bloc_device_t *bd, part_t *partition,
--                   const unsigned char *name);
-+                   const unsigned char *name, int partnum);
- void part_set_blocsize (bloc_device_t *bd, part_t *part, uint32_t blocsize);
- void part_private_set (part_t *part, void *private);
- void *part_private_get (part_t *part);
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/libpart/prep.c OpenHackWare-release-0.4/src/libpart/prep.c
---- OpenHackWare-release-0.4.org/src/libpart/prep.c	2005-03-31 09:23:33.000000000 +0200
-+++ OpenHackWare-release-0.4/src/libpart/prep.c	2005-07-03 16:17:41.000000000 +0200
-@@ -164,7 +164,7 @@
-             part->boot_load = 0;
-             part->boot_entry = boot_offset - part->bloc_size;
-             part->flags = PART_TYPE_PREP | PART_FLAG_BOOT;
--            part_register(bd, part, "PREP boot");
-+            part_register(bd, part, "PREP boot", i);
-             fs_raw_set_bootfile(part, part->boot_start.bloc,
-                                 part->boot_start.offset,
-                                 part->boot_size.bloc,
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/main.c OpenHackWare-release-0.4/src/main.c
---- OpenHackWare-release-0.4.org/src/main.c	2005-03-31 09:23:33.000000000 +0200
-+++ OpenHackWare-release-0.4/src/main.c	2005-06-07 23:48:39.000000000 +0200
-@@ -364,20 +364,24 @@
-     void *load_base, *load_entry, *last_alloc, *load_end;
-     uint32_t memsize, boot_image_size, cmdline_size, ramdisk_size;
-     uint32_t boot_base, boot_nb;
--    int boot_device;
-+    int boot_device, i;
-+    static const uint32_t isa_base_tab[3] = {
-+        0x80000000, /* PREP */
-+        0xFE000000, /* Grackle (Heathrow) */
-+        0xF2000000, /* UniNorth (Mac99)  */
-+    };
- 
-     /* Retrieve NVRAM configuration */
-- nvram_retry:
-+    for(i = 0; i < 3; i++) {
-+        isa_io_base = isa_base_tab[i];
-     nvram = NVRAM_get_config(&memsize, &boot_device,
-                              &boot_image, &boot_image_size,
-                              &cmdline, &cmdline_size,
-                              &ramdisk, &ramdisk_size);
--    if (nvram == NULL) {
--        /* Retry with another isa_io_base */
--        if (isa_io_base == 0x80000000) {
--            isa_io_base = 0xF2000000;
--            goto nvram_retry;
-+        if (nvram)
-+            break;
-         }
-+    if (i == 3) {
-         ERROR("Unable to load configuration from NVRAM. Aborting...\n");
-         return -1;
-     }
-@@ -402,7 +406,7 @@
-         cpu_name = CPU_get_name(pvr);
-         OF_register_cpu(cpu_name, 0, pvr,
-                         200 * 1000 * 1000, 200 * 1000 * 1000,
--                        100 * 1000 * 1000, 10 * 1000 * 1000,
-+                        100 * 1000 * 1000, 100 * 1000 * 1000,
-                         0x0092);
-     }
-     OF_register_memory(memsize, 512 * 1024 /* TOFIX */);
-@@ -433,9 +437,12 @@
-     vga_puts(copyright);
-     vga_puts("\n");
- 
-+#if 0
-     /* QEMU is quite incoherent: d is cdrom, not second drive */
-+    /* XXX: should probe CD-ROM position */
-     if (boot_device == 'd')
-         boot_device = 'e';
-+#endif
-     /* Open boot device */
-     boot_part = bd_probe(boot_device);
-     if (boot_device == 'm') {
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/nvram.c OpenHackWare-release-0.4/src/nvram.c
---- OpenHackWare-release-0.4.org/src/nvram.c	2005-03-31 09:23:33.000000000 +0200
-+++ OpenHackWare-release-0.4/src/nvram.c	2005-06-04 23:44:03.000000000 +0200
-@@ -334,6 +334,7 @@
-         ret = NVRAM_chrp_format(nvram);
-         break;
-     case ARCH_MAC99:
-+    case ARCH_HEATHROW: /* XXX: may be incorrect */
-         ret = NVRAM_mac99_format(nvram);
-         break;
-     case ARCH_POP:
-@@ -409,13 +410,12 @@
-         arch = ARCH_MAC99;
-     } else if (strcmp(sign, "POP") == 0) {
-         arch = ARCH_POP;
-+    } else if (strcmp(sign, "HEATHROW") == 0) {
-+        arch = ARCH_HEATHROW;
-     } else {
-         ERROR("Unknown PPC architecture: '%s'\n", sign);
-         return NULL;
-     }
--    /* HACK */
--    if (arch == ARCH_CHRP)
--        arch = ARCH_MAC99;
-     lword = NVRAM_get_lword(nvram, 0x30);
-     *RAM_size = lword;
-     byte = NVRAM_get_byte(nvram, 0x34);
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/of.c OpenHackWare-release-0.4/src/of.c
---- OpenHackWare-release-0.4.org/src/of.c	2005-04-06 23:17:26.000000000 +0200
-+++ OpenHackWare-release-0.4/src/of.c	2005-07-07 23:30:08.000000000 +0200
-@@ -489,7 +489,7 @@
-         ERROR("%s can't alloc new node '%s' name\n", __func__, name);
-         return NULL;
-     }
--    new->prop_address = OF_prop_int_new(env, new, "address", address);
-+    new->prop_address = OF_prop_int_new(env, new, "unit-address", address);
-     if (new->prop_address == NULL) {
-         free(new->prop_name->value);
-         free(new->prop_name);
-@@ -1017,6 +1017,33 @@
-                            string, strlen(string) + 1);
- }
- 
-+/* convert '\1' char to '\0' */
-+static OF_prop_t *OF_prop_string_new1 (OF_env_t *env, OF_node_t *node,
-+                                       const unsigned char *name,
-+                                       const unsigned char *string)
-+{
-+    int len, i;
-+    OF_prop_t *ret;
-+    unsigned char *str;
-+
-+    if (strchr(string, '\1') == NULL) {
-+        return OF_prop_string_new(env, node, name, string);
-+    } else {
-+        len = strlen(string) + 1;
-+        str = malloc(len);
-+        if (!str)
-+            return NULL;
-+        memcpy(str, string, len);
-+        for(i = 0; i < len; i++)
-+            if (str[i] == '\1')
-+                str[i] = '\0';
-+        ret = OF_property_new(env, node, name,
-+                              str, len);
-+        free(str);
-+        return ret;
-+    }
-+}
-+
- __attribute__ (( section (".OpenFirmware") ))
- static OF_prop_t *OF_prop_int_new (OF_env_t *env, OF_node_t *node,
-                                    const unsigned char *name, uint32_t value)
-@@ -1421,15 +1448,12 @@
- __attribute__ (( section (".OpenFirmware") ))
- int OF_init (void)
- {
--    const unsigned char compat_str[] =
- #if 0
-         "PowerMac3,1\0MacRISC\0Power Macintosh\0";
-         "PowerMac1,2\0MacRISC\0Power Macintosh\0";
-         "AAPL,PowerMac G3\0PowerMac G3\0MacRISC\0Power Macintosh\0";
-         "AAPL,PowerMac3,0\0MacRISC\0Power Macintosh\0";
-         "AAPL,Gossamer\0MacRISC\0Power Macintosh\0";
--#else
--        "AAPL,PowerMac G3\0PowerMac G3\0MacRISC\0Power Macintosh\0";
- #endif
-     OF_env_t *OF_env;
-     OF_node_t *als, *opt, *chs, *pks;
-@@ -1455,15 +1479,21 @@
-         return -1;
-     }
-     OF_prop_string_new(OF_env, OF_node_root, "device_type", "bootrom");
--#if 0
--    OF_prop_string_new(OF_env, OF_node_root,
--                       "model", "PPC Open Hack'Ware " BIOS_VERSION);
--#else
-+    if (arch == ARCH_HEATHROW) {
-+        const unsigned char compat_str[] =
-+            "PowerMac1,1\0MacRISC\0Power Macintosh";
-+        OF_property_new(OF_env, OF_node_root, "compatible",
-+                        compat_str, sizeof(compat_str));
-     OF_prop_string_new(OF_env, OF_node_root,
--                       "model", compat_str);
--#endif
-+                           "model", "Power Macintosh");
-+    } else {
-+        const unsigned char compat_str[] =
-+            "PowerMac3,1\0MacRISC\0Power Macintosh";
-     OF_property_new(OF_env, OF_node_root, "compatible",
-                     compat_str, sizeof(compat_str));
-+        OF_prop_string_new(OF_env, OF_node_root,
-+                           "model", "PowerMac3,1");
-+    }
- #if 0
-     OF_prop_string_new(OF_env, OF_node_root, "copyright", copyright);
- #else
-@@ -1561,14 +1591,15 @@
-         range.size = 0x00800000;
-         OF_property_new(OF_env, rom, "ranges", &range, sizeof(OF_range_t));
-         OF_prop_int_new(OF_env, rom, "#address-cells", 1);
-+
-         /* "/rom/boot-rom@fff00000" node */
--        brom = OF_node_new(OF_env, OF_node_root, "boot-rom", 0xfff00000);
-+        brom = OF_node_new(OF_env, rom, "boot-rom", 0xfff00000);
-         if (brom == NULL) {
-             ERROR("Cannot create 'boot-rom'\n");
-             return -1;
-         }
-         regs.address = 0xFFF00000;
--        regs.size = 0x00010000;
-+        regs.size = 0x00100000;
-         OF_property_new(OF_env, brom, "reg", &regs, sizeof(OF_regprop_t));
-         OF_prop_string_new(OF_env, brom, "write-characteristic", "flash");
-         OF_prop_string_new(OF_env, brom, "BootROM-build-date",
-@@ -1577,7 +1608,7 @@
-         OF_prop_string_new(OF_env, brom, "copyright", copyright);
-         OF_prop_string_new(OF_env, brom, "model", BIOS_str);
-         OF_prop_int_new(OF_env, brom, "result", 0);
--#if 0
-+#if 1
-         {
-             /* Hack taken 'as-is' from PearPC */
-             unsigned char info[] = {
-@@ -1596,7 +1627,9 @@
-         OF_node_put(OF_env, brom);
-         OF_node_put(OF_env, rom);
-     }
-+#if 0
-     /* From here, hardcoded hacks to get a Mac-like machine */
-+    /* XXX: Core99 does not seem to like this NVRAM tree */
-     /* "/nvram@fff04000" node */
-     {
-         OF_regprop_t regs;
-@@ -1617,6 +1650,7 @@
-         OF_prop_int_new(OF_env, chs, "nvram", OF_pack_handle(OF_env, nvr));
-         OF_node_put(OF_env, nvr);
-     }
-+#endif
-     /* "/pseudo-hid" : hid emulation as Apple does */
-     {
-         OF_node_t *hid;
-@@ -1663,7 +1697,27 @@
-         }
-         OF_node_put(OF_env, hid);
-     }
-+    if (arch == ARCH_MAC99) {
-+        OF_node_t *unin;
-+        OF_regprop_t regs;
- 
-+        unin = OF_node_new(OF_env, OF_node_root,
-+                           "uni-n", 0xf8000000);
-+        if (unin == NULL) {
-+            ERROR("Cannot create 'uni-n'\n");
-+            return -1;
-+        }
-+        OF_prop_string_new(OF_env, unin, "device-type", "memory-controller");
-+        OF_prop_string_new(OF_env, unin, "model", "AAPL,UniNorth");
-+        OF_prop_string_new(OF_env, unin, "compatible", "uni-north");
-+        regs.address = 0xf8000000;
-+        regs.size = 0x01000000;
-+        OF_property_new(OF_env, unin, "reg", &regs, sizeof(regs));
-+        OF_prop_int_new(OF_env, unin, "#address-cells", 1);
-+        OF_prop_int_new(OF_env, unin, "#size-cells", 1);
-+        OF_prop_int_new(OF_env, unin, "device-rev", 3);
-+        OF_node_put(OF_env, unin);
-+    }
-     
- #if 1 /* This is mandatory for claim to work
-        * but I don't know where it should really be (in cpu ?)
-@@ -1693,7 +1747,9 @@
- 
-     /* "/options/boot-args" node */
-     {
--        const unsigned char *args = "-v rootdev cdrom";
-+        //        const unsigned char *args = "-v rootdev cdrom";
-+        //const unsigned char *args = "-v io=0xffffffff";
-+        const unsigned char *args = "-v";
-         /* Ask MacOS X to print debug messages */
-         //        OF_prop_string_new(OF_env, chs, "machargs", args);
-         //        OF_prop_string_new(OF_env, opt, "boot-command", args);
-@@ -2013,17 +2069,17 @@
-     OF_prop_int_new(OF_env, node, "min-grant", min_grant);
-     OF_prop_int_new(OF_env, node, "max-latency", max_latency);
-     if (dev->type != NULL)
--        OF_prop_string_new(OF_env, node, "device_type", dev->type);
-+        OF_prop_string_new1(OF_env, node, "device_type", dev->type);
-     if (dev->compat != NULL)
--        OF_prop_string_new(OF_env, node, "compatible", dev->compat);
-+        OF_prop_string_new1(OF_env, node, "compatible", dev->compat);
-     if (dev->model != NULL)
--        OF_prop_string_new(OF_env, node, "model", dev->model);
-+        OF_prop_string_new1(OF_env, node, "model", dev->model);
-     if (dev->acells != 0)
-         OF_prop_int_new(OF_env, node, "#address-cells", dev->acells);
-     if (dev->scells != 0)
--        OF_prop_int_new(OF_env, node, "#interrupt-cells", dev->acells);
-+        OF_prop_int_new(OF_env, node, "#size-cells", dev->scells);
-     if (dev->icells != 0)
--        OF_prop_int_new(OF_env, node, "#size-cells", dev->acells);
-+        OF_prop_int_new(OF_env, node, "#interrupt-cells", dev->icells);
-     dprintf("Done %p %p\n", parent, node);
-     
-     return node;
-@@ -2040,8 +2096,9 @@
-     OF_env_t *OF_env;
-     pci_range_t ranges[3];
-     OF_regprop_t regs[1];
--    OF_node_t *pci_host;
-+    OF_node_t *pci_host, *als;
-     int nranges;
-+    unsigned char buffer[OF_NAMELEN_MAX];
- 
-     OF_env = OF_env_main;
-     dprintf("register PCI host '%s' '%s' '%s' '%s'\n",
-@@ -2052,6 +2109,17 @@
-         ERROR("Cannot create pci host\n");
-         return NULL;
-     }
-+    
-+    als = OF_node_get(OF_env, "aliases");
-+    if (als == NULL) {
-+        ERROR("Cannot get 'aliases'\n");
-+        return NULL;
-+    }
-+    sprintf(buffer, "/%s", dev->name);
-+    OF_prop_string_set(OF_env, als, "pci", buffer);
-+    OF_node_put(OF_env, als);
-+    
-+
-     regs[0].address = cfg_base;
-     regs[0].size = cfg_len;
-     OF_property_new(OF_env, pci_host, "reg", regs, sizeof(OF_regprop_t));
-@@ -2136,6 +2204,11 @@
-     return pci_dev;
- }
- 
-+/* XXX: suppress that, used for interrupt map init */
-+OF_node_t *pci_host_node;
-+uint32_t pci_host_interrupt_map[7 * 32];
-+int pci_host_interrupt_map_len = 0;
-+
- void OF_finalize_pci_host (void *dev, int first_bus, int nb_busses)
- {
-     OF_env_t *OF_env;
-@@ -2145,10 +2218,12 @@
-     regs[0].address = first_bus;
-     regs[0].size = nb_busses;
-     OF_property_new(OF_env, dev, "bus-range", regs, sizeof(OF_regprop_t));
-+    pci_host_node = dev;
- }
- 
- void OF_finalize_pci_device (void *dev, uint8_t bus, uint8_t devfn,
--                             uint32_t *regions, uint32_t *sizes)
-+                             uint32_t *regions, uint32_t *sizes,
-+                             int irq_line)
- {
-     OF_env_t *OF_env;
-     pci_reg_prop_t pregs[6], rregs[6];
-@@ -2156,6 +2231,7 @@
-     int i, j, k;
- 
-     OF_env = OF_env_main;
-+    /* XXX: only useful for VGA card in fact */
-     if (regions[0] != 0x00000000)
-         OF_prop_int_set(OF_env, dev, "address", regions[0] & ~0x0000000F);
-     for (i = 0, j = 0, k = 0; i < 6; i++) {
-@@ -2222,7 +2298,22 @@
-     } else {
-         OF_property_new(OF_env, dev, "assigned-addresses", NULL, 0);
-     }
--#if 0
-+    if (irq_line >= 0) {
-+        int i;
-+        OF_prop_int_new(OF_env, dev, "interrupts", 1);
-+        i = pci_host_interrupt_map_len;
-+        pci_host_interrupt_map[i++] = (devfn << 8) & 0xf800;
-+        pci_host_interrupt_map[i++] = 0;
-+        pci_host_interrupt_map[i++] = 0;
-+        pci_host_interrupt_map[i++] = 0;
-+        pci_host_interrupt_map[i++] = 0; /* pic handle will be patched later */
-+        pci_host_interrupt_map[i++] = irq_line;
-+        if (arch != ARCH_HEATHROW) {
-+            pci_host_interrupt_map[i++] = 1;
-+        }
-+        pci_host_interrupt_map_len = i;
-+    }
-+#if 1
-     {
-         OF_prop_t *prop_name = ((OF_node_t *)dev)->prop_name;
- 
-@@ -2390,6 +2481,54 @@
-     return 0;
- }
- 
-+static void keylargo_ata(OF_node_t *mio, uint32_t base_address,
-+                         uint32_t base, int irq1, int irq2, 
-+                         uint16_t pic_phandle)
-+{
-+    OF_env_t *OF_env = OF_env_main;
-+    OF_node_t *ata;
-+    OF_regprop_t regs[2];
-+
-+    ata = OF_node_new(OF_env, mio, "ata-4", base);
-+    if (ata == NULL) {
-+        ERROR("Cannot create 'ata-4'\n");
-+        return;
-+    }
-+    OF_prop_string_new(OF_env, ata, "device_type", "ata");
-+#if 1
-+    OF_prop_string_new(OF_env, ata, "compatible", "key2largo-ata");
-+    OF_prop_string_new(OF_env, ata, "model", "ata-4");
-+    OF_prop_string_new(OF_env, ata, "cable-type", "80-conductor");
-+#else
-+    OF_prop_string_new(OF_env, ata, "compatible", "cmd646-ata");
-+    OF_prop_string_new(OF_env, ata, "model", "ata-4");
-+#endif
-+    OF_prop_int_new(OF_env, ata, "#address-cells", 1);
-+    OF_prop_int_new(OF_env, ata, "#size-cells", 0);
-+    regs[0].address = base;
-+    regs[0].size = 0x00001000;
-+#if 0 // HACK: Don't set up DMA registers
-+    regs[1].address = 0x00008A00;
-+    regs[1].size = 0x00001000;
-+    OF_property_new(OF_env, ata, "reg",
-+                    regs, 2 * sizeof(OF_regprop_t));
-+#else
-+    OF_property_new(OF_env, ata, "reg",
-+                    regs, sizeof(OF_regprop_t));
-+#endif
-+    OF_prop_int_new(OF_env, ata, "interrupt-parent", pic_phandle);
-+    regs[0].address = irq1;
-+    regs[0].size = 0x00000001;
-+    regs[1].address = irq2;
-+    regs[1].size = 0x00000000;
-+    OF_property_new(OF_env, ata, "interrupts",
-+                    regs, 2 * sizeof(OF_regprop_t));
-+    if (base == 0x1f000)
-+        ide_pci_pmac_register(base_address + base, 0x00000000, ata);
-+    else
-+        ide_pci_pmac_register(0x00000000, base_address + base, ata);
-+}
-+
- void OF_finalize_pci_macio (void *dev, uint32_t base_address, uint32_t size,
-                             void *private_data)
- {
-@@ -2398,6 +2537,8 @@
-     pci_reg_prop_t pregs[2];
-     OF_node_t *mio, *chs, *als;
-     uint16_t pic_phandle;
-+    int rec_len;
-+    OF_prop_t *mio_reg;
- 
-     OF_DPRINTF("mac-io: %p\n", dev);
-     OF_env = OF_env_main;
-@@ -2416,10 +2557,14 @@
-     mio = dev;
-     mio->private_data = private_data;
-     pregs[0].addr.hi = 0x00000000;
--    pregs[0].addr.mid = 0x82013810;
-+    pregs[0].addr.mid = 0x00000000;
-     pregs[0].addr.lo = 0x00000000;
-     pregs[0].size_hi = base_address;
-     pregs[0].size_lo = size;
-+    mio_reg = OF_property_get(OF_env, mio, "reg");
-+    if (mio_reg && mio_reg->vlen >= 5 * 4) {
-+        pregs[0].addr.mid = ((pci_reg_prop_t *)mio_reg->value)->addr.hi;
-+    }
-     OF_property_new(OF_env, mio, "ranges",
-                     &pregs, sizeof(pci_reg_prop_t));
- #if 0
-@@ -2431,8 +2576,32 @@
-     OF_property_new(OF_env, mio, "assigned-addresses",
-                     &pregs, sizeof(pci_reg_prop_t));
- #endif
-+
-+    if (arch == ARCH_HEATHROW) {
-+        /* Heathrow PIC */
-+        OF_regprop_t regs;
-+        OF_node_t *mpic;
-+        const char compat_str[] = "heathrow\0mac-risc";
-+
-+        mpic = OF_node_new(OF_env, mio, "interrupt-controller", 0x10);
-+        if (mpic == NULL) {
-+            ERROR("Cannot create 'mpic'\n");
-+            goto out;
-+        }
-+        OF_prop_string_new(OF_env, mpic, "device_type", "interrupt-controller");
-+        OF_property_new(OF_env, mpic, "compatible", compat_str, sizeof(compat_str));
-+        OF_prop_int_new(OF_env, mpic, "#interrupt-cells", 1);
-+        regs.address = 0x10;
-+        regs.size = 0x20;
-+        OF_property_new(OF_env, mpic, "reg",
-+                        &regs, sizeof(regs));
-+        OF_property_new(OF_env, mpic, "interrupt-controller", NULL, 0);
-+        pic_phandle = OF_pack_handle(OF_env, mpic);
-+        OF_prop_int_new(OF_env, chs, "interrupt-controller", pic_phandle);
-+        OF_node_put(OF_env, mpic);
-+        rec_len = 6;
-+    } else {
-     /* OpenPIC */
--    {
-         OF_regprop_t regs[4];
-         OF_node_t *mpic;
-         mpic = OF_node_new(OF_env, mio, "interrupt-controller", 0x40000);
-@@ -2455,8 +2624,37 @@
-         pic_phandle = OF_pack_handle(OF_env, mpic);
-         OF_prop_int_new(OF_env, chs, "interrupt-controller", pic_phandle);
-         OF_node_put(OF_env, mpic);
-+        rec_len = 7;
-     }
--#if 1
-+
-+    /* patch pci host table */
-+    /* XXX: do it after the PCI init */
-+    {
-+        int i;
-+        uint32_t tab[4];
-+
-+        for(i = 0; i < pci_host_interrupt_map_len; i += rec_len)
-+            pci_host_interrupt_map[i + 4] = pic_phandle;
-+#if 0
-+        dprintf("interrupt-map:\n");
-+        for(i = 0; i < pci_host_interrupt_map_len; i++) {
-+            dprintf(" %08x", pci_host_interrupt_map[i]);
-+            if ((i % rec_len) == (rec_len - 1))
-+                dprintf("\n");
-+        }
-+        dprintf("\n");
-+#endif
-+        OF_property_new(OF_env, pci_host_node, "interrupt-map", 
-+                        pci_host_interrupt_map, 
-+                        pci_host_interrupt_map_len * sizeof(uint32_t));
-+        tab[0] = 0xf800;
-+        tab[1] = 0;
-+        tab[2] = 0;
-+        tab[3] = 0;
-+        OF_property_new(OF_env, pci_host_node, "interrupt-map-mask", 
-+                        tab, 4 * sizeof(uint32_t));
-+    }
-+#if 0
-     /* escc is usefull to get MacOS X debug messages */
-     {
-         OF_regprop_t regs[8];
-@@ -2645,85 +2843,12 @@
-         OF_node_put(OF_env, scc);
-     }
- #endif
--    /* IDE controller */
--    {
--        OF_node_t *ata;
--        OF_regprop_t regs[2];
--        ata = OF_node_new(OF_env, mio, "ata-4", 0x1f000);
--        if (ata == NULL) {
--            ERROR("Cannot create 'ata-4'\n");
--            goto out;
--        }
--        OF_prop_string_new(OF_env, ata, "device_type", "ata");
--#if 1
--        OF_prop_string_new(OF_env, ata, "compatible", "keylargo-ata");
--        OF_prop_string_new(OF_env, ata, "model", "ata-4");
--#else
--        OF_prop_string_new(OF_env, ata, "compatible", "cmd646-ata");
--        OF_prop_string_new(OF_env, ata, "model", "ata-4");
--#endif
--        OF_prop_int_new(OF_env, ata, "#address-cells", 1);
--        OF_prop_int_new(OF_env, ata, "#size-cells", 0);
--        regs[0].address = 0x0001F000;
--        regs[0].size = 0x00001000;
--#if 0 // HACK: Don't set up DMA registers
--        regs[1].address = 0x00008A00;
--        regs[1].size = 0x00001000;
--        OF_property_new(OF_env, ata, "reg",
--                        regs, 2 * sizeof(OF_regprop_t));
--#else
--        OF_property_new(OF_env, ata, "reg",
--                        regs, sizeof(OF_regprop_t));
--#endif
--        OF_prop_int_new(OF_env, ata, "interrupt-parent", pic_phandle);
--        regs[0].address = 0x00000013;
--        regs[0].size = 0x00000001;
--        regs[1].address = 0x0000000B;
--        regs[1].size = 0x00000000;
--        OF_property_new(OF_env, ata, "interrupts",
--                        regs, 2 * sizeof(OF_regprop_t));
--        ide_pci_pmac_register(base_address + 0x1f000, 0x00000000, ata);
--
--    }
--    {
--        OF_node_t *ata;
--        OF_regprop_t regs[2];
--        ata = OF_node_new(OF_env, mio, "ata-4", 0x20000);
--        if (ata == NULL) {
--            ERROR("Cannot create 'ata-4'\n");
--            goto out;
--        }
--        OF_prop_string_new(OF_env, ata, "device_type", "ata");
--#if 1
--        OF_prop_string_new(OF_env, ata, "compatible", "keylargo-ata");
--        OF_prop_string_new(OF_env, ata, "model", "ata-4");
--#else
--        OF_prop_string_new(OF_env, ata, "compatible", "cmd646-ata");
--        OF_prop_string_new(OF_env, ata, "model", "ata-4");
--#endif
--        OF_prop_int_new(OF_env, ata, "#address-cells", 1);
--        OF_prop_int_new(OF_env, ata, "#size-cells", 0);
--        regs[0].address = 0x00020000;
--        regs[0].size = 0x00001000;
--#if 0 // HACK: Don't set up DMA registers
--        regs[1].address = 0x00008A00;
--        regs[1].size = 0x00001000;
--        OF_property_new(OF_env, ata, "reg",
--                        regs, 2 * sizeof(OF_regprop_t));
--#else
--        OF_property_new(OF_env, ata, "reg",
--                        regs, sizeof(OF_regprop_t));
--#endif
--        OF_prop_int_new(OF_env, ata, "interrupt-parent", pic_phandle);
--        regs[0].address = 0x00000014;
--        regs[0].size = 0x00000001;
--        regs[1].address = 0x0000000B;
--        regs[1].size = 0x00000000;
--        OF_property_new(OF_env, ata, "interrupts",
--                        regs, 2 * sizeof(OF_regprop_t));
--        ide_pci_pmac_register(0x00000000, base_address + 0x20000, ata);
--
-+    /* Keylargo IDE controller: need some work (DMA problem ?) */
-+    if (arch == ARCH_MAC99) {
-+        keylargo_ata(mio, base_address, 0x1f000, 0x13, 0xb, pic_phandle);
-+        keylargo_ata(mio, base_address, 0x20000, 0x14, 0xb, pic_phandle);
-     }
-+#if 0
-     /* Timer */
-     {
-         OF_node_t *tmr;
-@@ -2746,10 +2871,11 @@
-                         regs, sizeof(OF_regprop_t));
-         OF_node_put(OF_env, tmr);
-     }
-+#endif
-     /* VIA-PMU */
-     {
-         /* Controls adb, RTC and power-mgt (forget it !) */
--        OF_node_t *via, *adb, *rtc;
-+        OF_node_t *via, *adb;
-         OF_regprop_t regs[1];
- #if 0 // THIS IS A HACK AND IS COMPLETELY ABSURD !
-       // (but needed has Qemu doesn't emulate via-pmu).
-@@ -2773,14 +2899,21 @@
-         regs[0].size = 0x00002000;
-         OF_property_new(OF_env, via, "reg", regs, sizeof(OF_regprop_t));
-         OF_prop_int_new(OF_env, via, "interrupt-parent", pic_phandle);
-+        if (arch == ARCH_HEATHROW) {
-+            OF_prop_int_new(OF_env, via, "interrupts", 0x12);
-+        } else {
-         regs[0].address = 0x00000019;
-         regs[0].size = 0x00000001;
-         OF_property_new(OF_env, via, "interrupts",
-                         regs, sizeof(OF_regprop_t));
-+        }
-+        /* force usage of OF bus speeds */
-+        OF_prop_int_new(OF_env, via, "BusSpeedCorrect", 1);
- #if 0
-         OF_prop_int_new(OF_env, via, "pmu-version", 0x00D0740C);
- #endif
--#if 1
-+        {
-+            OF_node_t *kbd, *mouse;
-         /* ADB pseudo-device */
-         adb = OF_node_new(OF_env, via, "adb", OF_ADDRESS_NONE);
-         if (adb == NULL) {
-@@ -2797,9 +2930,26 @@
-         OF_prop_int_new(OF_env, adb, "#size-cells", 0);
-         OF_pack_get_path(OF_env, tmp, 512, adb);
-         OF_prop_string_new(OF_env, als, "adb", tmp);
--        /* XXX: add "keyboard@2" and "mouse@3" */
--        OF_node_put(OF_env, adb);
--#endif
-+
-+            kbd = OF_node_new(OF_env, adb, "keyboard", 2);
-+            if (kbd == NULL) {
-+                ERROR("Cannot create 'kbd'\n");
-+                goto out;
-+            }
-+            OF_prop_string_new(OF_env, kbd, "device_type", "keyboard");
-+            OF_prop_int_new(OF_env, kbd, "reg", 2);
-+
-+            mouse = OF_node_new(OF_env, adb, "mouse", 3);
-+            if (mouse == NULL) {
-+                ERROR("Cannot create 'mouse'\n");
-+                goto out;
-+            }
-+            OF_prop_string_new(OF_env, mouse, "device_type", "mouse");
-+            OF_prop_int_new(OF_env, mouse, "reg", 3);
-+            OF_prop_int_new(OF_env, mouse, "#buttons", 3);
-+        }
-+        {
-+            OF_node_t *rtc;
-         
-         rtc = OF_node_new(OF_env, via, "rtc", OF_ADDRESS_NONE);
-         if (rtc == NULL) {
-@@ -2813,14 +2963,68 @@
-         OF_prop_string_new(OF_env, rtc, "compatible", "rtc");
- #endif
-         OF_node_put(OF_env, rtc);
--        OF_node_put(OF_env, via);
-     }
-+        //        OF_node_put(OF_env, via);
-+    }
-+    {
-+        OF_node_t *pmgt;
-+        pmgt = OF_node_new(OF_env, mio, "power-mgt", OF_ADDRESS_NONE);
-+        OF_prop_string_new(OF_env, pmgt, "device_type", "power-mgt");
-+        OF_prop_string_new(OF_env, pmgt, "compatible", "cuda");
-+        OF_prop_string_new(OF_env, pmgt, "mgt-kind", "min-consumption-pwm-led");
-+        OF_node_put(OF_env, pmgt);
-+    }
-+
-+    if (arch == ARCH_HEATHROW) {
-+        /* NVRAM */
-+        OF_node_t *nvr;
-+        OF_regprop_t regs;
-+        nvr = OF_node_new(OF_env, mio, "nvram", 0x60000);
-+        OF_prop_string_new(OF_env, nvr, "device_type", "nvram");
-+        regs.address = 0x60000;
-+        regs.size = 0x00020000;
-+        OF_property_new(OF_env, nvr, "reg", &regs, sizeof(regs));
-+        OF_prop_int_new(OF_env, nvr, "#bytes", 0x2000);
-+        OF_node_put(OF_env, nvr);
-+    }
-+
-  out:
-     //    OF_node_put(OF_env, mio);
-     OF_node_put(OF_env, chs);
-     OF_node_put(OF_env, als);
- }
- 
-+void OF_finalize_pci_ide (void *dev, 
-+                          uint32_t io_base0, uint32_t io_base1,
-+                          uint32_t io_base2, uint32_t io_base3)
-+{
-+    OF_env_t *OF_env = OF_env_main;
-+    OF_node_t *pci_ata = dev;
-+    OF_node_t *ata, *atas[2];
-+    int i;
-+
-+    OF_prop_int_new(OF_env, pci_ata, "#address-cells", 1);
-+    OF_prop_int_new(OF_env, pci_ata, "#size-cells", 0);
-+
-+    /* XXX: Darwin handles only one device */
-+    for(i = 0; i < 1; i++) {
-+        ata = OF_node_new(OF_env, pci_ata, "ata-4", i);
-+        if (ata == NULL) {
-+            ERROR("Cannot create 'ata-4'\n");
-+            return;
-+        }
-+        OF_prop_string_new(OF_env, ata, "device_type", "ata");
-+        OF_prop_string_new(OF_env, ata, "compatible", "cmd646-ata");
-+        OF_prop_string_new(OF_env, ata, "model", "ata-4");
-+        OF_prop_int_new(OF_env, ata, "#address-cells", 1);
-+        OF_prop_int_new(OF_env, ata, "#size-cells", 0);
-+        OF_prop_int_new(OF_env, ata, "reg", i);
-+        atas[i] = ata;
-+    }
-+    ide_pci_pc_register(io_base0, io_base1, io_base2, io_base3,
-+                        atas[0], atas[1]);
-+}
-+
- /*****************************************************************************/
- /* Fake package */
- static void OF_method_fake (OF_env_t *OF_env)
-@@ -2862,11 +3066,11 @@
-     /* As we get a 1:1 mapping, do nothing */
-     ihandle = popd(OF_env);
-     args = (void *)popd(OF_env);
--    address = popd(OF_env);
--    virt = popd(OF_env);
--    size = popd(OF_env);
-     popd(OF_env);
--    OF_DPRINTF("Translate address %0x %0x %0x %0x\n", ihandle, address,
-+    size = popd(OF_env);
-+    virt = popd(OF_env);
-+    address = popd(OF_env);
-+    OF_DPRINTF("Map %0x %0x %0x %0x\n", ihandle, address,
-                virt, size);
-     pushd(OF_env, 0);
- }
-@@ -3270,7 +3474,7 @@
-     OF_prop_string_new(OF_env, dsk, "device_type", "block");
-     OF_prop_string_new(OF_env, dsk, "category", type);
-     OF_prop_int_new(OF_env, dsk, "device_id", devnum);
--    OF_prop_int_new(OF_env, dsk, "reg", 0);
-+    OF_prop_int_new(OF_env, dsk, "reg", devnum);
-     OF_method_new(OF_env, dsk, "open", &OF_blockdev_open);
-     OF_method_new(OF_env, dsk, "seek", &OF_blockdev_seek);
-     OF_method_new(OF_env, dsk, "read", &OF_blockdev_read);
-@@ -3432,7 +3636,8 @@
- }
- 
- void OF_vga_register (const unsigned char *name, unused uint32_t address,
--                      int width, int height, int depth)
-+                      int width, int height, int depth,
-+                      unsigned long vga_bios_addr, unsigned long vga_bios_size)
- {
-     OF_env_t *OF_env;
-     unsigned char tmp[OF_NAMELEN_MAX];
-@@ -3504,6 +3709,18 @@
-     OF_prop_string_new(OF_env, als, "display", tmp);
-     OF_node_put(OF_env, als);
-     /* XXX: may also need read-rectangle */
-+
-+    if (vga_bios_size >= 8) {
-+        const uint8_t *p;
-+        int size;
-+        /* check the QEMU VGA BIOS header */
-+        p = (const uint8_t *)vga_bios_addr;
-+        if (p[0] == 'N' && p[1] == 'D' && p[2] == 'R' && p[3] == 'V') {
-+            size = *(uint32_t *)(p + 4);
-+            OF_property_new(OF_env, disp, "driver,AAPL,MacOS,PowerPC", 
-+                            p + 8, size);
-+        }
-+    }
-  out:
-     OF_node_put(OF_env, disp);
- }
-@@ -4451,7 +4668,10 @@
-         break;
-     case 0x233441d3: /* MacOS X 10.2 and OpenDarwin 1.41 */
-         /* Create "memory-map" pseudo device */
--        popd(OF_env);
-+        {
-+            OF_node_t *map;
-+            uint32_t phandle;
-+
-         /* Find "/packages" */
-         chs = OF_pack_find_by_name(OF_env, OF_node_root, "/chosen");
-         if (chs == NULL) {
-@@ -4459,10 +4679,6 @@
-             ERROR("Cannot get '/chosen'\n");
-             break;
-         }
--        {
--#if 1
--            OF_node_t *map;
--            uint32_t phandle;
-             map = OF_node_new(OF_env, chs, "memory-map", OF_ADDRESS_NONE);
-             if (map == NULL) {
-                 pushd(OF_env, -1);
-@@ -4473,11 +4689,8 @@
-             OF_node_put(OF_env, map);
-             OF_node_put(OF_env, chs);
-             pushd(OF_env, phandle);
--        }
--#else
--        pushd(OF_env, 0);
--#endif
-         pushd(OF_env, 0);
-+        }
-         break;
-     case 0x32a2d18e: /* MacOS X 10.2 and OpenDarwin 6.02 */
-         /* Return screen ihandle */
-@@ -4540,9 +4753,10 @@
-     case 0x4ad41f2d:
-         /* Yaboot: wait 10 ms: sure ! */
-         break;
-+
-     default:
-         /* ERROR */
--        printf("Script:\n%s\n", FString);
-+        printf("Script: len=%d\n%s\n", (int)strlen(FString), FString);
-         printf("Call %0x NOT IMPLEMENTED !\n", crc);
-         bug();
-         break;
-@@ -4581,6 +4795,7 @@
- {
-     OF_CHECK_NBARGS(OF_env, 0);
-     /* Should free all OF resources */
-+    bd_reset_all();
- #if defined (DEBUG_BIOS)
-     {
-         uint16_t loglevel = 0x02 | 0x10 | 0x80;
-diff -wruN --exclude '*~' --exclude '*.o' --exclude '*.bin' --exclude '*.out' --exclude mkdiff OpenHackWare-release-0.4.org/src/pci.c OpenHackWare-release-0.4/src/pci.c
---- OpenHackWare-release-0.4.org/src/pci.c	2005-03-31 09:23:33.000000000 +0200
-+++ OpenHackWare-release-0.4/src/pci.c	2005-07-07 23:27:37.000000000 +0200
-@@ -99,8 +99,8 @@
-     uint16_t min_grant;
-     uint16_t max_latency;
-     uint8_t  irq_line;
--    uint32_t regions[6];
--    uint32_t sizes[6];
-+    uint32_t regions[7]; /* the region 6 is the PCI ROM */
-+    uint32_t sizes[7];
-     pci_device_t *next;
- };
- 
-@@ -158,6 +158,7 @@
- 
- /* IRQ numbers assigned to PCI IRQs */
- static uint8_t prep_pci_irqs[4] = { 9, 11, 9, 11 };
-+static uint8_t heathrow_pci_irqs[4] = { 0x15, 0x16, 0x17, 0x18 };
- static uint8_t pmac_pci_irqs[4] = { 8, 9, 10, 11 };
- 
- /* PREP PCI host */
-@@ -399,6 +400,79 @@
-     &uninorth_config_readl, &uninorth_config_writel,
- };
- 
-+/* Grackle PCI host */
-+
-+static uint32_t grackle_cfg_address (pci_bridge_t *bridge,
-+                                     uint8_t bus, uint8_t devfn,
-+                                     uint8_t offset)
-+{
-+    uint32_t addr;
-+    addr = 0x80000000 | (bus << 16) | (devfn << 8) | (offset & 0xfc);
-+    stswap32((uint32_t *)bridge->cfg_addr, addr);
-+    return bridge->cfg_data + (offset & 3);
-+}
-+
-+static uint8_t grackle_config_readb (pci_bridge_t *bridge,
-+                                      uint8_t bus, uint8_t devfn,
-+                                      uint8_t offset)
-+{
-+    uint32_t addr;
-+    addr = grackle_cfg_address(bridge, bus, devfn, offset);
-+    return *((uint8_t *)addr);
-+}
-+
-+static void grackle_config_writeb (pci_bridge_t *bridge,
-+                                    uint8_t bus, uint8_t devfn,
-+                                    uint8_t offset, uint8_t val)
-+{
-+    uint32_t addr;
-+    addr = grackle_cfg_address(bridge, bus, devfn, offset);
-+    *((uint8_t *)addr) = val;
-+}
-+
-+static uint16_t grackle_config_readw (pci_bridge_t *bridge,
-+                                       uint8_t bus, uint8_t devfn,
-+                                       uint8_t offset)
-+{
-+    uint32_t addr;
-+    addr = grackle_cfg_address(bridge, bus, devfn, offset);
-+    return ldswap16((uint16_t *)addr);
-+}
-+
-+static void grackle_config_writew (pci_bridge_t *bridge,
-+                                    uint8_t bus, uint8_t devfn,
-+                                    uint8_t offset, uint16_t val)
-+{
-+    uint32_t addr;
-+    addr = grackle_cfg_address(bridge, bus, devfn, offset);
-+    stswap16((uint16_t *)addr, val);
-+}
-+
-+static uint32_t grackle_config_readl (pci_bridge_t *bridge,
-+                                       uint8_t bus, uint8_t devfn,
-+                                       uint8_t offset)
-+{
-+    uint32_t addr;
-+    addr = grackle_cfg_address(bridge, bus, devfn, offset);
-+    return ldswap32((uint32_t *)addr);
-+}
-+
-+static void grackle_config_writel (pci_bridge_t *bridge,
-+                                    uint8_t bus, uint8_t devfn,
-+                                    uint8_t offset, uint32_t val)
-+{
-+    uint32_t addr;
-+
-+    addr = grackle_cfg_address(bridge, bus, devfn, offset);
-+    stswap32((uint32_t *)addr, val);
-+}
-+
-+static pci_ops_t grackle_pci_ops = {
-+    &grackle_config_readb, &grackle_config_writeb,
-+    &grackle_config_readw, &grackle_config_writew,
-+    &grackle_config_readl, &grackle_config_writel,
-+};
-+
- static inline uint8_t pci_config_readb (pci_bridge_t *bridge,
-                                         uint8_t bus, uint8_t devfn,
-                                         uint8_t offset)
-@@ -466,12 +540,22 @@
-     },
- };
- 
-+static int ide_config_cb2 (pci_device_t *device)
-+{
-+    OF_finalize_pci_ide(device->common.OF_private,
-+                        device->regions[0] & ~0x0000000F,
-+                        device->regions[1] & ~0x0000000F,
-+                        device->regions[2] & ~0x0000000F,
-+                        device->regions[3] & ~0x0000000F);
-+    return 0;
-+}
-+
- static pci_dev_t ide_devices[] = {
-     {
--        0x8086, 0x0100,
--        NULL, "Qemu IDE", "Qemu IDE",    "ide",
-+        0x1095, 0x0646, /* CMD646 IDE controller */
-+        "pci-ide", "pci-ata", NULL, NULL,
-         0, 0, 0,
--        NULL, NULL,
-+        ide_config_cb2, NULL,
-     },
-     {
-         0xFFFF, 0xFFFF,
-@@ -481,7 +565,9 @@
-     },
- };
- 
--static int ide_config_cb (pci_device_t *device)
-+#if 0
-+/* should base it on PCI ID, not on arch */
-+static int ide_config_cb (unused pci_device_t *device)
- {
-     printf("Register IDE controller\n");
-     switch (arch) {
-@@ -491,14 +577,8 @@
-                               device->common.OF_private);
-         break;
-     default:
--        ide_pci_pc_register(device->regions[0] & ~0x0000000F,
--                            device->regions[1] & ~0x0000000F,
--                            device->regions[2] & ~0x0000000F,
--                            device->regions[3] & ~0x0000000F,
--                            device->common.OF_private);
-         break;
-     }
--
-     return 0;
- }
- 
-@@ -512,16 +592,12 @@
-                               device->common.OF_private);
-         break;
-     default:
--        ide_pci_pc_register(device->regions[0] & ~0x0000000F,
--                            device->regions[1] & ~0x0000000F,
--                            device->regions[2] & ~0x0000000F,
--                            device->regions[3] & ~0x0000000F,
--                            device->common.OF_private);
-         break;
-     }
- 
-     return 0;
- }
-+#endif
- 
- static pci_subclass_t mass_subclass[] = {
-     {
-@@ -530,7 +606,7 @@
-     },
-     {
-         0x01, "IDE controller",             "ide", ide_devices, NULL,
--        &ide_config_cb, NULL,
-+        NULL, NULL,
-     },
-     {
-         0x02, "Floppy disk controller",     NULL,  NULL, NULL,
-@@ -546,7 +622,7 @@
-     },
-     {
-         0x05, "ATA controller",             "ata", NULL, NULL,
--        &ata_config_cb, NULL,
-+        NULL, NULL,
-     },
-     {
-         0x80, "misc mass-storage controller", NULL, NULL, NULL,
-@@ -646,7 +722,9 @@
-         /* VGA 640x480x16 */
-         OF_vga_register(device->common.device->name,
-                         device->regions[0] & ~0x0000000F,
--                        vga_width, vga_height, vga_depth);
-+                        vga_width, vga_height, vga_depth,
-+                        device->regions[6] & ~0x0000000F,
-+                        device->sizes[6]);
-     }
-     vga_console_register();
- 
-@@ -750,6 +828,13 @@
-     NULL, &PREP_pci_ops,
- };
- 
-+pci_dev_t grackle_fake_bridge = {
-+    0xFFFF, 0xFFFF,
-+    "pci", "pci-bridge", "DEC,21154", "DEC,21154.pci-bridge",
-+    -1, -1, -1,
-+    NULL, &grackle_pci_ops,
-+};
-+
- static pci_dev_t hbrg_devices[] = {
-     {
-         0x106B, 0x0020, NULL,
-@@ -758,8 +843,8 @@
-         NULL, &uninorth_agp_fake_bridge,
-     },
-     {
--        0x106B, 0x001F,
--        NULL, "pci", "AAPL,UniNorth", "uni-north",
-+        0x106B, 0x001F, NULL, 
-+        "pci", "AAPL,UniNorth", "uni-north",
-         3, 2, 1,
-         NULL, &uninorth_fake_bridge,
-     },
-@@ -770,10 +855,10 @@
-         NULL, &uninorth_fake_bridge,
-     },
-     {
--        0x1011, 0x0026, NULL,
--        "pci-bridge", NULL, NULL,
-+        0x1057, 0x0002, "pci",
-+        "pci", "MOT,MPC106", "grackle",
-         3, 2, 1,
--        NULL, &PREP_pci_ops,
-+        NULL, &grackle_fake_bridge,
-     },
-     {
-         0x1057, 0x4801, NULL,
-@@ -1443,7 +1528,14 @@
- }
- 
- static const pci_dev_t misc_pci[] = {
--    /* Apple Mac-io controller */
-+    /* Paddington Mac I/O */
-+    { 
-+        0x106B, 0x0017,
-+        "mac-io", "mac-io", "AAPL,343S1211", "paddington\1heathrow",
-+        1, 1, 1,
-+        &macio_config_cb, NULL,
-+    },
-+    /* KeyLargo Mac I/O */
-     { 
-         0x106B, 0x0022,
-         "mac-io", "mac-io", "AAPL,Keylargo", "Keylargo",
-@@ -1599,7 +1691,7 @@
-                                       uint8_t min_grant, uint8_t max_latency,
-                                       int irq_line)
- {
--    uint32_t cmd;
-+    uint32_t cmd, addr;
-     int i;
- 
-     device->min_grant = min_grant;
-@@ -1611,22 +1703,28 @@
-         printf("MAP PCI device %d:%d to IRQ %d\n",
-                device->bus, device->devfn, irq_line);
-     }
--    for (i = 0; i < 6; i++) {
-+    for (i = 0; i < 7; i++) {
-         if ((device->regions[i] & ~0xF) != 0x00000000 &&
-             (device->regions[i] & ~0xF) != 0xFFFFFFF0) {
-             printf("Map PCI device %d:%d %d to %0x %0x (%s)\n",
-                    device->bus, device->devfn, i,
-                    device->regions[i], device->sizes[i],
--                   device->regions[i] & 0x00000001 ? "I/O" : "memory");
-+                   (device->regions[i] & 0x00000001) && i != 6 ? "I/O" : 
-+                    "memory");
-+            if (i != 6) {
-             cmd = pci_config_readl(bridge, device->bus, device->devfn, 0x04);
-             if (device->regions[i] & 0x00000001)
-                 cmd |= 0x00000001;
-             else
-                 cmd |= 0x00000002;
-             pci_config_writel(bridge, device->bus, device->devfn, 0x04, cmd);
-+            }
-+            if (i == 6)
-+                addr = 0x30; /* PCI ROM */
-+            else
-+                addr = 0x10 + (i * sizeof(uint32_t));
-             pci_config_writel(bridge, device->bus, device->devfn,
--                              0x10 + (i * sizeof(uint32_t)),
--                              device->regions[i]);
-+                              addr, device->regions[i]);
-         }
-     }
- }
-@@ -1900,7 +1998,7 @@
-         goto out;
-     }
-     ret = (pci_u_t *)newd;
--    max_areas = 6;
-+    max_areas = 7;
-     /* register PCI device in OF tree */
-     if (bridge->dev.common.type == PCI_FAKE_BRIDGE) {
-         newd->common.OF_private =
-@@ -1927,6 +2025,9 @@
-             /* Handle 64 bits memory mapping */
-             continue;
-         }
-+        if (i == 6)
-+            addr = 0x30; /* PCI ROM */
-+        else
-         addr = 0x10 + (i * sizeof(uint32_t));
-         /* Get region size
-          * Note: we assume it's always a power of 2
-@@ -1935,7 +2036,7 @@
-         smask = pci_config_readl(bridge, bus, devfn, addr);
-         if (smask == 0x00000000 || smask == 0xFFFFFFFF)
-             continue;
--        if (smask & 0x00000001) {
-+        if ((smask & 0x00000001) != 0 && i != 6) {
-             /* I/O space */
-             base = io_base;
-             /* Align to a minimum of 256 bytes (arbitrary) */
-@@ -1947,6 +2048,8 @@
-             /* Align to a minimum of 64 kB (arbitrary) */
-             min_align = 1 << 16;
-             amask = 0x0000000F;
-+            if (i == 6)
-+                smask |= 1; /* PCI ROM enable */
-         }
-         omask = smask & amask;
-         smask &= ~amask;
-@@ -1980,7 +2083,10 @@
-     if (irq_pin > 0) {
-         /* assign the IRQ */
-         irq_pin = ((devfn >> 3) + irq_pin - 1) & 3;
--        if (arch == ARCH_PREP) {
-+        /* XXX: should base it on the PCI bridge type, not the arch */
-+        switch(arch) {
-+        case ARCH_PREP:
-+            {
-             int elcr_port, val;
-             irq_line = prep_pci_irqs[irq_pin];
-             /* set the IRQ to level-sensitive */
-@@ -1988,14 +2094,22 @@
-             val = inb(elcr_port);
-             val |= 1 << (irq_line & 7);
-             outb(elcr_port, val);
--        } else {
-+            }
-+            break;
-+        case ARCH_MAC99:
-             irq_line = pmac_pci_irqs[irq_pin];
-+            break;
-+        case ARCH_HEATHROW:
-+            irq_line = heathrow_pci_irqs[irq_pin];
-+            break;
-+        default:
-+            break;
-         }
-     }
-  update_device:
-     pci_update_device(bridge, newd, min_grant, max_latency, irq_line);
-     OF_finalize_pci_device(newd->common.OF_private, bus, devfn,
--                           newd->regions, newd->sizes);
-+                           newd->regions, newd->sizes, irq_line);
-     /* Call special inits if needed */
-     if (dev->config_cb != NULL)
-         (*dev->config_cb)(newd);
-@@ -2049,6 +2163,32 @@
-     case ARCH_CHRP:
-         /* TODO */
-         break;
-+    case ARCH_HEATHROW:
-+        dev = pci_find_device(0x06, 0x00, 0xFF, checkv, checkp);
-+        if (dev == NULL)
-+            return -1;
-+        fake_host = pci_add_host(hostp, dev,
-+                                 (0x06 << 24) | (0x00 << 16) | (0xFF << 8));
-+        if (fake_host == NULL)
-+            return -1;
-+        fake_host->dev.common.type = PCI_FAKE_HOST;
-+        dev = &grackle_fake_bridge;
-+        if (dev == NULL)
-+            goto free_fake_host;
-+        fake_bridge = pci_add_bridge(fake_host, 0, 0, dev,
-+                                     (0x06 << 24) | (0x04 << 16) | (0xFF << 8),
-+                                     cfg_base, cfg_len,
-+                                     cfg_base + 0x7ec00000,
-+                                     cfg_base + 0x7ee00000,
-+                                     mem_base, mem_len,
-+                                     io_base, io_len,
-+                                     rbase, rlen,
-+                                     0,
-+                                     &grackle_pci_ops);
-+        if (fake_bridge == NULL)
-+            goto free_fake_host;
-+        fake_bridge->dev.common.type = PCI_FAKE_BRIDGE;
-+        break;
-     case ARCH_MAC99:
-         dev = pci_find_device(0x06, 0x00, 0xFF, checkv, checkp);
-         if (dev == NULL)
-@@ -2167,6 +2307,30 @@
-     case ARCH_CHRP:
-         /* TODO */
-         break;
-+    case ARCH_HEATHROW:
-+        cfg_base = 0x80000000;
-+        cfg_len  = 0x7f000000;
-+        mem_base = 0x80000000;
-+        mem_len  = 0x01000000;
-+        io_base  = 0xfe000000;
-+        io_len   = 0x00800000;
-+#if 1
-+        rbase    = 0xfd000000;
-+        rlen     = 0x01000000;
-+#else
-+        rbase    = 0x00000000;
-+        rlen     = 0x01000000;
-+#endif
-+        if (pci_check_host(&pci_main, cfg_base, cfg_len,
-+                           mem_base, mem_len, io_base, io_len, rbase, rlen,
-+                           0x1057, 0x0002) == 0) {
-+            isa_io_base = io_base;
-+            busnum++;
-+        }
-+        for (curh = pci_main; curh->next != NULL; curh = curh->next)
-+            continue;
-+        pci_check_devices(curh);
-+        break;
-     case ARCH_MAC99:
-         /* We are supposed to have 3 host bridges:
-          * - the uninorth AGP bridge at 0xF0000000
diff --git a/pc-bios/openbios-sparc32 b/pc-bios/openbios-sparc32
deleted file mode 100644
index 7a729aa..0000000
--- a/pc-bios/openbios-sparc32
+++ /dev/null
diff --git a/pc-bios/ppc_rom.bin b/pc-bios/ppc_rom.bin
deleted file mode 100644
index f7cd8a8..0000000
--- a/pc-bios/ppc_rom.bin
+++ /dev/null
diff --git a/pc-bios/vgabios-cirrus.bin b/pc-bios/vgabios-cirrus.bin
deleted file mode 100644
index 34f9a9f..0000000
--- a/pc-bios/vgabios-cirrus.bin
+++ /dev/null
diff --git a/pc-bios/vgabios.bin b/pc-bios/vgabios.bin
deleted file mode 100644
index 17cb63f..0000000
--- a/pc-bios/vgabios.bin
+++ /dev/null
diff --git a/pc-bios/vgabios.diff b/pc-bios/vgabios.diff
deleted file mode 100644
index 661c032..0000000
--- a/pc-bios/vgabios.diff
+++ /dev/null
@@ -1,896 +0,0 @@
-Index: Makefile
-===================================================================
-RCS file: /sources/vgabios/vgabios/Makefile,v
-retrieving revision 1.17
-diff -u -w -r1.17 Makefile
---- Makefile	6 Mar 2005 13:06:47 -0000	1.17
-+++ Makefile	14 Jun 2006 00:51:06 -0000
-@@ -22,7 +22,7 @@
- cirrus-bios: vgabios-cirrus.bin vgabios-cirrus.debug.bin
- 
- clean:
--	/bin/rm -f  biossums *.o *.s *.ld86 \
-+	/bin/rm -f  biossums vbetables-gen vbetables.h *.o *.s *.ld86 \
-           temp.awk.* vgabios*.orig _vgabios_* _vgabios-debug_* core vgabios*.bin vgabios*.txt $(RELEASE).bin *.bak
- 
- dist-clean: clean
-@@ -79,3 +79,9 @@
- 
- biossums: biossums.c
- 	$(CC) -o biossums biossums.c
-+
-+vbetables-gen: vbetables-gen.c
-+	$(CC) -o vbetables-gen vbetables-gen.c
-+
-+vbetables.h: vbetables-gen
-+	./vbetables-gen > $@
-Index: clext.c
-===================================================================
-RCS file: /sources/vgabios/vgabios/clext.c,v
-retrieving revision 1.10
-diff -u -w -r1.10 clext.c
---- clext.c	25 Mar 2006 10:19:15 -0000	1.10
-+++ clext.c	14 Jun 2006 00:51:06 -0000
-@@ -544,6 +544,13 @@
- cirrus_set_video_mode_extended:
-   call cirrus_switch_mode
-   pop ax ;; mode
-+  test al, #0x80
-+  jnz cirrus_set_video_mode_extended_1
-+  push ax
-+  mov ax, #0xffff ; set to 0xff to keep win 2K happy
-+  call cirrus_clear_vram
-+  pop ax
-+cirrus_set_video_mode_extended_1:
-   and al, #0x7f
- 
-   push ds
-@@ -1011,6 +1018,13 @@
-   jnz cirrus_vesa_02h_3
-   call cirrus_enable_16k_granularity
- cirrus_vesa_02h_3:
-+  test bx, #0x8000 ;; no clear
-+  jnz cirrus_vesa_02h_4
-+  push ax
-+  xor ax,ax
-+  call cirrus_clear_vram
-+  pop ax
-+cirrus_vesa_02h_4:
-   pop ax
-   push ds
- #ifdef CIRRUS_VESA3_PMINFO
-@@ -1479,6 +1493,38 @@
-   pop  bx
-   ret
- 
-+cirrus_clear_vram:
-+  pusha
-+  push es
-+  mov si, ax
-+
-+  call cirrus_enable_16k_granularity
-+  call cirrus_extbios_85h
-+  shl al, #2
-+  mov bl, al
-+  xor ah,ah
-+cirrus_clear_vram_1:
-+  mov al, #0x09
-+  mov dx, #0x3ce
-+  out dx, ax
-+  push ax
-+  mov cx, #0xa000
-+  mov es, cx
-+  xor di, di
-+  mov ax, si
-+  mov cx, #8192
-+  cld
-+  rep 
-+      stosw
-+  pop ax
-+  inc ah
-+  cmp ah, bl
-+  jne cirrus_clear_vram_1
-+
-+  pop es
-+  popa
-+  ret
-+
- cirrus_extbios_handlers:
-   ;; 80h
-   dw cirrus_extbios_80h
-Index: vbe.c
-===================================================================
-RCS file: /sources/vgabios/vgabios/vbe.c,v
-retrieving revision 1.48
-diff -u -w -r1.48 vbe.c
---- vbe.c	26 Dec 2005 19:50:26 -0000	1.48
-+++ vbe.c	14 Jun 2006 00:51:07 -0000
-@@ -118,21 +118,114 @@
- .word VBE_VESA_MODE_END_OF_LIST
- #endif
- 
-+  .align 2
- vesa_pm_start:
-   dw vesa_pm_set_window - vesa_pm_start
--  dw vesa_pm_set_display_strt - vesa_pm_start
-+  dw vesa_pm_set_display_start - vesa_pm_start
-   dw vesa_pm_unimplemented - vesa_pm_start
--  dw 0
-+  dw vesa_pm_io_ports_table - vesa_pm_start
-+vesa_pm_io_ports_table:
-+  dw VBE_DISPI_IOPORT_INDEX
-+  dw VBE_DISPI_IOPORT_INDEX + 1
-+  dw VBE_DISPI_IOPORT_DATA
-+  dw VBE_DISPI_IOPORT_DATA + 1
-+  dw 0xffff
-+  dw 0xffff
- 
-   USE32
- vesa_pm_set_window:
--  mov ax, #0x4f05
--  int #0x10
-+  cmp  bx, #0x00
-+  je  vesa_pm_set_display_window1
-+  mov  ax, #0x0100
-+  ret
-+vesa_pm_set_display_window1:
-+  mov  ax, dx
-+  push dx
-+  push ax
-+  mov  dx, # VBE_DISPI_IOPORT_INDEX
-+  mov  ax, # VBE_DISPI_INDEX_BANK
-+  out  dx, ax
-+  pop  ax
-+  mov  dx, # VBE_DISPI_IOPORT_DATA
-+  out  dx, ax
-+  pop  dx
-+  mov  ax, #0x004f
-   ret
- 
- vesa_pm_set_display_start:
--  mov ax, #0x4f07
--  int #0x10
-+  cmp  bl, #0x80
-+  je   vesa_pm_set_display_start1
-+  cmp  bl, #0x00
-+  je   vesa_pm_set_display_start1
-+  mov  ax, #0x0100
-+  ret
-+vesa_pm_set_display_start1:
-+; convert offset to (X, Y) coordinate 
-+; (would be simpler to change Bochs VBE API...)
-+  push eax
-+  push ecx
-+  push edx
-+  push esi
-+  push edi
-+  shl edx, #16
-+  and ecx, #0xffff
-+  or ecx, edx
-+  shl ecx, #2
-+  mov eax, ecx
-+
-+  push eax
-+  mov  dx, # VBE_DISPI_IOPORT_INDEX
-+  mov  ax, # VBE_DISPI_INDEX_VIRT_WIDTH
-+  out  dx, ax
-+  mov  dx, # VBE_DISPI_IOPORT_DATA
-+  in   ax, dx
-+  movzx ecx, ax
-+
-+  mov  dx, # VBE_DISPI_IOPORT_INDEX
-+  mov  ax, # VBE_DISPI_INDEX_BPP
-+  out  dx, ax
-+  mov  dx, # VBE_DISPI_IOPORT_DATA
-+  in   ax, dx
-+  movzx esi, ax
-+  pop  eax
-+
-+  add esi, #7
-+  shr esi, #3
-+  imul ecx, esi
-+  xor edx, edx
-+  div ecx
-+  mov edi, eax
-+  mov eax, edx
-+  xor edx, edx
-+  div esi
-+
-+  push dx
-+  push ax
-+  mov  dx, # VBE_DISPI_IOPORT_INDEX
-+  mov  ax, # VBE_DISPI_INDEX_X_OFFSET
-+  out  dx, ax
-+  pop  ax
-+  mov  dx, # VBE_DISPI_IOPORT_DATA
-+  out  dx, ax
-+  pop  dx
-+
-+  mov  ax, di
-+  push dx
-+  push ax
-+  mov  dx, # VBE_DISPI_IOPORT_INDEX
-+  mov  ax, # VBE_DISPI_INDEX_Y_OFFSET
-+  out  dx, ax
-+  pop  ax
-+  mov  dx, # VBE_DISPI_IOPORT_DATA
-+  out  dx, ax
-+  pop  dx
-+
-+  pop edi
-+  pop esi
-+  pop edx
-+  pop ecx
-+  pop eax
-+  mov  ax, #0x004f
-   ret
- 
- vesa_pm_unimplemented:
-@@ -835,6 +928,64 @@
- ASM_END
- 
- 
-+Bit16u vbe_biosfn_read_video_state_size()
-+{
-+    return 9 * 2;
-+}
-+
-+void vbe_biosfn_save_video_state(ES, BX)
-+     Bit16u ES; Bit16u BX;
-+{
-+    Bit16u enable, i;
-+
-+    outw(VBE_DISPI_IOPORT_INDEX,VBE_DISPI_INDEX_ENABLE);
-+    enable = inw(VBE_DISPI_IOPORT_DATA);
-+    write_word(ES, BX, enable);
-+    BX += 2;
-+    if (!(enable & VBE_DISPI_ENABLED)) 
-+        return;
-+    for(i = VBE_DISPI_INDEX_XRES; i <= VBE_DISPI_INDEX_Y_OFFSET; i++) {
-+        if (i != VBE_DISPI_INDEX_ENABLE) {
-+            outw(VBE_DISPI_IOPORT_INDEX, i);
-+            write_word(ES, BX, inw(VBE_DISPI_IOPORT_DATA));
-+            BX += 2;
-+        }
-+    }
-+}
-+
-+
-+void vbe_biosfn_restore_video_state(ES, BX)
-+     Bit16u ES; Bit16u BX;
-+{
-+    Bit16u enable, i;
-+
-+    enable = read_word(ES, BX);
-+    BX += 2;
-+    
-+    if (!(enable & VBE_DISPI_ENABLED)) {
-+        outw(VBE_DISPI_IOPORT_INDEX,VBE_DISPI_INDEX_ENABLE);
-+        outw(VBE_DISPI_IOPORT_DATA, enable);
-+    } else {
-+        outw(VBE_DISPI_IOPORT_INDEX, VBE_DISPI_INDEX_XRES);
-+        outw(VBE_DISPI_IOPORT_DATA, read_word(ES, BX));
-+        BX += 2;
-+        outw(VBE_DISPI_IOPORT_INDEX, VBE_DISPI_INDEX_YRES);
-+        outw(VBE_DISPI_IOPORT_DATA, read_word(ES, BX));
-+        BX += 2;
-+        outw(VBE_DISPI_IOPORT_INDEX, VBE_DISPI_INDEX_BPP);
-+        outw(VBE_DISPI_IOPORT_DATA, read_word(ES, BX));
-+        BX += 2;
-+        outw(VBE_DISPI_IOPORT_INDEX,VBE_DISPI_INDEX_ENABLE);
-+        outw(VBE_DISPI_IOPORT_DATA, enable);
-+
-+        for(i = VBE_DISPI_INDEX_BANK; i <= VBE_DISPI_INDEX_Y_OFFSET; i++) {
-+            outw(VBE_DISPI_IOPORT_INDEX, i);
-+            outw(VBE_DISPI_IOPORT_DATA, read_word(ES, BX));
-+            BX += 2;
-+        }
-+    }
-+}
-+
- /** Function 04h - Save/Restore State
-  * 
-  * Input:
-@@ -849,10 +1000,48 @@
-  *              BX      = Number of 64-byte blocks to hold the state buffer (if DL=00h)
-  * 
-  */
--void vbe_biosfn_save_restore_state(AX, DL, CX, ES, BX)
-+void vbe_biosfn_save_restore_state(AX, CX, DX, ES, BX)
-+Bit16u *AX; Bit16u CX; Bit16u DX; Bit16u ES; Bit16u *BX;
- {
--}
-+    Bit16u ss=get_SS();
-+    Bit16u result, val;
- 
-+    result = 0x4f;
-+    switch(GET_DL()) {
-+    case 0x00:
-+        val = biosfn_read_video_state_size2(CX);
-+#ifdef DEBUG
-+        printf("VGA state size=%x\n", val);
-+#endif
-+        if (CX & 8)
-+            val += vbe_biosfn_read_video_state_size();
-+        write_word(ss, BX, val);
-+        break;
-+    case 0x01:
-+        val = read_word(ss, BX);
-+        val = biosfn_save_video_state(CX, ES, val);
-+#ifdef DEBUG
-+        printf("VGA save_state offset=%x\n", val);
-+#endif
-+        if (CX & 8)
-+            vbe_biosfn_save_video_state(ES, val);
-+        break;
-+    case 0x02:
-+        val = read_word(ss, BX);
-+        val = biosfn_restore_video_state(CX, ES, val);
-+#ifdef DEBUG
-+        printf("VGA restore_state offset=%x\n", val);
-+#endif
-+        if (CX & 8)
-+            vbe_biosfn_restore_video_state(ES, val);
-+        break;
-+    default:
-+        // function failed
-+        result = 0x100;
-+        break;
-+    }
-+    write_word(ss, AX, result);
-+}
- 
- /** Function 05h - Display Window Control
-  * 
-@@ -1090,7 +1279,7 @@
-  */
- ASM_START
- vbe_biosfn_return_protected_mode_interface:
--  test bx, bx
-+  test bl, bl
-   jnz _fail
-   mov di, #0xc000
-   mov es, di
-Index: vbe.h
-===================================================================
-RCS file: /sources/vgabios/vgabios/vbe.h,v
-retrieving revision 1.24
-diff -u -w -r1.24 vbe.h
---- vbe.h	9 May 2004 20:31:31 -0000	1.24
-+++ vbe.h	14 Jun 2006 00:51:07 -0000
-@@ -14,7 +14,7 @@
- void vbe_biosfn_return_controller_information(AX, ES, DI);
- void vbe_biosfn_return_mode_information(AX, CX, ES, DI);
- void vbe_biosfn_set_mode(AX, BX, ES, DI);
--void vbe_biosfn_save_restore_state(AX, DL, CX, ES, BX); 
-+void vbe_biosfn_save_restore_state(AX, CX, DX, ES, BX);
- void vbe_biosfn_set_get_palette_data(AX);
- void vbe_biosfn_return_protected_mode_interface(AX);
- 
-@@ -151,6 +151,12 @@
-    Bit8u  Reserved[189];
- } ModeInfoBlock;
- 
-+typedef struct ModeInfoListItem
-+{
-+        Bit16u                  mode;
-+        ModeInfoBlockCompact    info;
-+} ModeInfoListItem;
-+
- // VBE Return Status Info
- // AL
- #define VBE_RETURN_STATUS_SUPPORTED                      0x4F
-@@ -193,6 +199,10 @@
- #define VBE_VESA_MODE_1280X1024X1555                     0x119
- #define VBE_VESA_MODE_1280X1024X565                      0x11A
- #define VBE_VESA_MODE_1280X1024X888                      0x11B
-+#define VBE_VESA_MODE_1600X1200X8                        0x11C
-+#define VBE_VESA_MODE_1600X1200X1555                     0x11D
-+#define VBE_VESA_MODE_1600X1200X565                      0x11E
-+#define VBE_VESA_MODE_1600X1200X888                      0x11F
- 
- // BOCHS/PLEX86 'own' mode numbers
- #define VBE_OWN_MODE_320X200X8888                        0x140
-@@ -202,6 +212,12 @@
- #define VBE_OWN_MODE_1024X768X8888                       0x144
- #define VBE_OWN_MODE_1280X1024X8888                      0x145
- #define VBE_OWN_MODE_320X200X8                           0x146
-+#define VBE_OWN_MODE_1600X1200X8888                      0x147
-+#define VBE_OWN_MODE_1152X864X8                          0x148
-+#define VBE_OWN_MODE_1152X864X1555                       0x149
-+#define VBE_OWN_MODE_1152X864X565                        0x14a
-+#define VBE_OWN_MODE_1152X864X888                        0x14b
-+#define VBE_OWN_MODE_1152X864X8888                       0x14c
- 
- #define VBE_VESA_MODE_END_OF_LIST                        0xFFFF
- 
-@@ -259,7 +275,7 @@
- //        like 0xE0000000
- 
- 
--  #define VBE_DISPI_TOTAL_VIDEO_MEMORY_MB 4
-+  #define VBE_DISPI_TOTAL_VIDEO_MEMORY_MB 8
- 
-   #define VBE_DISPI_BANK_ADDRESS          0xA0000
-   #define VBE_DISPI_BANK_SIZE_KB          64
-Index: vgabios.c
-===================================================================
-RCS file: /sources/vgabios/vgabios/vgabios.c,v
-retrieving revision 1.64
-diff -u -w -r1.64 vgabios.c
---- vgabios.c	25 Mar 2006 10:19:16 -0000	1.64
-+++ vgabios.c	14 Jun 2006 00:51:07 -0000
-@@ -109,8 +109,8 @@
- static void biosfn_write_string();
- static void biosfn_read_state_info();
- static void biosfn_read_video_state_size();
--static void biosfn_save_video_state();
--static void biosfn_restore_video_state();
-+static Bit16u biosfn_save_video_state();
-+static Bit16u biosfn_restore_video_state();
- extern Bit8u video_save_pointer_table[];
- 
- // This is for compiling with gcc2 and gcc3
-@@ -748,12 +748,7 @@
-           vbe_biosfn_set_mode(&AX,BX,ES,DI);
-           break;
-          case 0x04:
--          //FIXME
--#ifdef DEBUG
--          unimplemented();
--#endif
--          // function failed
--          AX=0x100;
-+          vbe_biosfn_save_restore_state(&AX, CX, DX, ES, &BX);
-           break;
-          case 0x09:
-           //FIXME
-@@ -3138,23 +3133,215 @@
- }
- 
- // --------------------------------------------------------------------------------------------
--static void biosfn_read_video_state_size (CX,ES,BX) Bit16u CX;Bit16u ES;Bit16u BX;
-+// --------------------------------------------------------------------------------------------
-+static Bit16u biosfn_read_video_state_size2 (CX) 
-+     Bit16u CX;
- {
--#ifdef DEBUG
-- unimplemented();
--#endif
-+    Bit16u size;
-+    size = 0;
-+    if (CX & 1) {
-+        size += 0x46;
-+    }
-+    if (CX & 2) {
-+        size += (5 + 8 + 5) * 2 + 6;
-+    }
-+    if (CX & 4) {
-+        size += 3 + 256 * 3 + 1;
- }
--static void biosfn_save_video_state (CX,ES,BX) Bit16u CX;Bit16u ES;Bit16u BX;
-+    return size;
-+}
-+
-+static void biosfn_read_video_state_size (CX, BX) 
-+     Bit16u CX; Bit16u *BX;
- {
--#ifdef DEBUG
-- unimplemented();
--#endif
-+    Bit16u ss=get_SS();
-+    write_word(ss, BX, biosfn_read_video_state_size2(CX));
- }
--static void biosfn_restore_video_state (CX,ES,BX) Bit16u CX;Bit16u ES;Bit16u BX;
-+
-+static Bit16u biosfn_save_video_state (CX,ES,BX) 
-+     Bit16u CX;Bit16u ES;Bit16u BX;
- {
--#ifdef DEBUG
-- unimplemented();
--#endif
-+    Bit16u i, v, crtc_addr, ar_index;
-+
-+    crtc_addr = read_word(BIOSMEM_SEG, BIOSMEM_CRTC_ADDRESS);
-+    if (CX & 1) {
-+        write_byte(ES, BX, inb(VGAREG_SEQU_ADDRESS)); BX++;
-+        write_byte(ES, BX, inb(crtc_addr)); BX++;
-+        write_byte(ES, BX, inb(VGAREG_GRDC_ADDRESS)); BX++;
-+        inb(VGAREG_ACTL_RESET);
-+        ar_index = inb(VGAREG_ACTL_ADDRESS);
-+        write_byte(ES, BX, ar_index); BX++;
-+        write_byte(ES, BX, inb(VGAREG_READ_FEATURE_CTL)); BX++;
-+
-+        for(i=1;i<=4;i++){
-+            outb(VGAREG_SEQU_ADDRESS, i);
-+            write_byte(ES, BX, inb(VGAREG_SEQU_DATA)); BX++;
-+        }
-+        outb(VGAREG_SEQU_ADDRESS, 0);
-+        write_byte(ES, BX, inb(VGAREG_SEQU_DATA)); BX++;
-+
-+        for(i=0;i<=0x18;i++) {
-+            outb(crtc_addr,i);
-+            write_byte(ES, BX, inb(crtc_addr+1)); BX++;
-+        }
-+
-+        for(i=0;i<=0x13;i++) {
-+            inb(VGAREG_ACTL_RESET);
-+            outb(VGAREG_ACTL_ADDRESS, i | (ar_index & 0x20));
-+            write_byte(ES, BX, inb(VGAREG_ACTL_READ_DATA)); BX++;
-+        }
-+        inb(VGAREG_ACTL_RESET);
-+
-+        for(i=0;i<=8;i++) {
-+            outb(VGAREG_GRDC_ADDRESS,i);
-+            write_byte(ES, BX, inb(VGAREG_GRDC_DATA)); BX++;
-+        }
-+
-+        write_word(ES, BX, crtc_addr); BX+= 2;
-+
-+        /* XXX: read plane latches */
-+        write_byte(ES, BX, 0); BX++;
-+        write_byte(ES, BX, 0); BX++;
-+        write_byte(ES, BX, 0); BX++;
-+        write_byte(ES, BX, 0); BX++;
-+    }
-+    if (CX & 2) {
-+        write_byte(ES, BX, read_byte(BIOSMEM_SEG,BIOSMEM_CURRENT_MODE)); BX++;
-+        write_word(ES, BX, read_word(BIOSMEM_SEG,BIOSMEM_NB_COLS)); BX += 2;
-+        write_word(ES, BX, read_word(BIOSMEM_SEG,BIOSMEM_PAGE_SIZE)); BX += 2;
-+        write_word(ES, BX, read_word(BIOSMEM_SEG,BIOSMEM_CRTC_ADDRESS)); BX += 2;
-+        write_byte(ES, BX, read_byte(BIOSMEM_SEG,BIOSMEM_NB_ROWS)); BX++;
-+        write_word(ES, BX, read_word(BIOSMEM_SEG,BIOSMEM_CHAR_HEIGHT)); BX += 2;
-+        write_byte(ES, BX, read_byte(BIOSMEM_SEG,BIOSMEM_VIDEO_CTL)); BX++;
-+        write_byte(ES, BX, read_byte(BIOSMEM_SEG,BIOSMEM_SWITCHES)); BX++;
-+        write_byte(ES, BX, read_byte(BIOSMEM_SEG,BIOSMEM_MODESET_CTL)); BX++;
-+        write_word(ES, BX, read_word(BIOSMEM_SEG,BIOSMEM_CURSOR_TYPE)); BX += 2;
-+        for(i=0;i<8;i++) {
-+            write_word(ES, BX, read_word(BIOSMEM_SEG, BIOSMEM_CURSOR_POS+2*i));
-+            BX += 2;
-+        }
-+        write_word(ES, BX, read_word(BIOSMEM_SEG,BIOSMEM_CURRENT_START)); BX += 2;
-+        write_byte(ES, BX, read_byte(BIOSMEM_SEG,BIOSMEM_CURRENT_PAGE)); BX++;
-+        /* current font */
-+        write_word(ES, BX, read_word(0, 0x1f * 4)); BX += 2;
-+        write_word(ES, BX, read_word(0, 0x1f * 4 + 2)); BX += 2;
-+        write_word(ES, BX, read_word(0, 0x43 * 4)); BX += 2;
-+        write_word(ES, BX, read_word(0, 0x43 * 4 + 2)); BX += 2;
-+    }
-+    if (CX & 4) {
-+        /* XXX: check this */
-+        write_byte(ES, BX, inb(VGAREG_DAC_STATE)); BX++; /* read/write mode dac */
-+        write_byte(ES, BX, inb(VGAREG_DAC_WRITE_ADDRESS)); BX++; /* pix address */
-+        write_byte(ES, BX, inb(VGAREG_PEL_MASK)); BX++;
-+        // Set the whole dac always, from 0
-+        outb(VGAREG_DAC_WRITE_ADDRESS,0x00);
-+        for(i=0;i<256*3;i++) {
-+            write_byte(ES, BX, inb(VGAREG_DAC_DATA)); BX++;
-+        }
-+        write_byte(ES, BX, 0); BX++; /* color select register */
-+    }
-+    return BX;
-+}
-+
-+static Bit16u biosfn_restore_video_state (CX,ES,BX) 
-+     Bit16u CX;Bit16u ES;Bit16u BX;
-+{
-+    Bit16u i, crtc_addr, v, addr1, ar_index;
-+
-+    if (CX & 1) {
-+        // Reset Attribute Ctl flip-flop
-+        inb(VGAREG_ACTL_RESET);
-+
-+        crtc_addr = read_word(ES, BX + 0x40);
-+        addr1 = BX;
-+        BX += 5;
-+        
-+        for(i=1;i<=4;i++){
-+            outb(VGAREG_SEQU_ADDRESS, i);
-+            outb(VGAREG_SEQU_DATA, read_byte(ES, BX)); BX++;
-+        }
-+        outb(VGAREG_SEQU_ADDRESS, 0);
-+        outb(VGAREG_SEQU_DATA, read_byte(ES, BX)); BX++;
-+
-+        // Disable CRTC write protection
-+        outw(crtc_addr,0x0011);
-+        // Set CRTC regs
-+        for(i=0;i<=0x18;i++) {
-+            if (i != 0x11) {
-+                outb(crtc_addr,i);
-+                outb(crtc_addr+1, read_byte(ES, BX));
-+            }
-+            BX++;
-+        }
-+        // select crtc base address
-+        v = inb(VGAREG_READ_MISC_OUTPUT) & ~0x01;
-+        if (crtc_addr = 0x3d4)
-+            v |= 0x01;
-+        outb(VGAREG_WRITE_MISC_OUTPUT, v);
-+
-+        // enable write protection if needed
-+        outb(crtc_addr, 0x11);
-+        outb(crtc_addr+1, read_byte(ES, BX - 0x18 + 0x11));
-+        
-+        // Set Attribute Ctl
-+        ar_index = read_byte(ES, addr1 + 0x03);
-+        inb(VGAREG_ACTL_RESET);
-+        for(i=0;i<=0x13;i++) {
-+            outb(VGAREG_ACTL_ADDRESS, i | (ar_index & 0x20));
-+            outb(VGAREG_ACTL_WRITE_DATA, read_byte(ES, BX)); BX++;
-+        }
-+        outb(VGAREG_ACTL_ADDRESS, ar_index);
-+        inb(VGAREG_ACTL_RESET);
-+        
-+        for(i=0;i<=8;i++) {
-+            outb(VGAREG_GRDC_ADDRESS,i);
-+            outb(VGAREG_GRDC_DATA, read_byte(ES, BX)); BX++;
-+        }
-+        BX += 2; /* crtc_addr */
-+        BX += 4; /* plane latches */
-+        
-+        outb(VGAREG_SEQU_ADDRESS, read_byte(ES, addr1)); addr1++;
-+        outb(crtc_addr, read_byte(ES, addr1)); addr1++;
-+        outb(VGAREG_GRDC_ADDRESS, read_byte(ES, addr1)); addr1++;
-+        addr1++;
-+        outb(crtc_addr - 0x4 + 0xa, read_byte(ES, addr1)); addr1++;
-+    }
-+    if (CX & 2) {
-+        write_byte(BIOSMEM_SEG,BIOSMEM_CURRENT_MODE, read_byte(ES, BX)); BX++;
-+        write_word(BIOSMEM_SEG,BIOSMEM_NB_COLS, read_word(ES, BX)); BX += 2;
-+        write_word(BIOSMEM_SEG,BIOSMEM_PAGE_SIZE, read_word(ES, BX)); BX += 2;
-+        write_word(BIOSMEM_SEG,BIOSMEM_CRTC_ADDRESS, read_word(ES, BX)); BX += 2;
-+        write_byte(BIOSMEM_SEG,BIOSMEM_NB_ROWS, read_byte(ES, BX)); BX++;
-+        write_word(BIOSMEM_SEG,BIOSMEM_CHAR_HEIGHT, read_word(ES, BX)); BX += 2;
-+        write_byte(BIOSMEM_SEG,BIOSMEM_VIDEO_CTL, read_byte(ES, BX)); BX++;
-+        write_byte(BIOSMEM_SEG,BIOSMEM_SWITCHES, read_byte(ES, BX)); BX++;
-+        write_byte(BIOSMEM_SEG,BIOSMEM_MODESET_CTL, read_byte(ES, BX)); BX++;
-+        write_word(BIOSMEM_SEG,BIOSMEM_CURSOR_TYPE, read_word(ES, BX)); BX += 2;
-+        for(i=0;i<8;i++) {
-+            write_word(BIOSMEM_SEG, BIOSMEM_CURSOR_POS+2*i, read_word(ES, BX));
-+            BX += 2;
-+        }
-+        write_word(BIOSMEM_SEG,BIOSMEM_CURRENT_START, read_word(ES, BX)); BX += 2;
-+        write_byte(BIOSMEM_SEG,BIOSMEM_CURRENT_PAGE, read_byte(ES, BX)); BX++;
-+        /* current font */
-+        write_word(0, 0x1f * 4, read_word(ES, BX)); BX += 2;
-+        write_word(0, 0x1f * 4 + 2, read_word(ES, BX)); BX += 2;
-+        write_word(0, 0x43 * 4, read_word(ES, BX)); BX += 2;
-+        write_word(0, 0x43 * 4 + 2, read_word(ES, BX)); BX += 2;
-+    }
-+    if (CX & 4) {
-+        BX++;
-+        v = read_byte(ES, BX); BX++;
-+        outb(VGAREG_PEL_MASK, read_byte(ES, BX)); BX++;
-+        // Set the whole dac always, from 0
-+        outb(VGAREG_DAC_WRITE_ADDRESS,0x00);
-+        for(i=0;i<256*3;i++) {
-+            outb(VGAREG_DAC_DATA, read_byte(ES, BX)); BX++;
-+        }
-+        BX++;
-+        outb(VGAREG_DAC_WRITE_ADDRESS, v);
-+    }
-+    return BX;
- }
- 
- // ============================================================================================
-diff -u -w vbetables-gen.c
---- vbetables-gen.c	1970-01-01 01:00:00.000000000 +0100
-+++ vbetables-gen.c	2006-06-14 00:52:18.000000000 +0200
-@@ -0,0 +1,217 @@
-+/* Generate the VGABIOS VBE Tables */
-+#include <stdlib.h>
-+#include <stdio.h>
-+
-+typedef struct {
-+    int width;
-+    int height;
-+    int depth;
-+    int mode;
-+} ModeInfo;
-+
-+ModeInfo modes[] = {
-+    /* standard VESA modes */
-+{ 640, 400, 8                          , 0x100},
-+{ 640, 480, 8                          , 0x101},
-+{ 800, 600, 4                          , 0x102},
-+{ 800, 600, 8                          , 0x103},
-+    //{ 1024, 768, 4                         , 0x104},
-+{ 1024, 768, 8                         , 0x105},
-+    //{ 1280, 1024, 4                        , 0x106},
-+{ 1280, 1024, 8                        , 0x107},
-+{ 320, 200, 15                       , 0x10D},
-+{ 320, 200, 16                        , 0x10E},
-+{ 320, 200, 24                        , 0x10F},
-+{ 640, 480, 15                       , 0x110},
-+{ 640, 480, 16                        , 0x111},
-+{ 640, 480, 24                        , 0x112},
-+{ 800, 600, 15                       , 0x113},
-+{ 800, 600, 16                        , 0x114},
-+{ 800, 600, 24                        , 0x115},
-+{ 1024, 768, 15                      , 0x116},
-+{ 1024, 768, 16                       , 0x117},
-+{ 1024, 768, 24                       , 0x118},
-+{ 1280, 1024, 15                     , 0x119},
-+{ 1280, 1024, 16                      , 0x11A},
-+{ 1280, 1024, 24                      , 0x11B},
-+{ 1600, 1200, 8                        , 0x11C},
-+{ 1600, 1200, 15                     , 0x11D},
-+{ 1600, 1200, 16                      , 0x11E},
-+{ 1600, 1200, 24                      , 0x11F},
-+
-+      /* BOCHS/PLE, 86 'own' mode numbers */
-+{ 320, 200, 32                        , 0x140},
-+{ 640, 400, 32                        , 0x141},
-+{ 640, 480, 32                        , 0x142},
-+{ 800, 600, 32                        , 0x143},
-+{ 1024, 768, 32                       , 0x144},
-+{ 1280, 1024, 32                      , 0x145},
-+{ 320, 200, 8                           , 0x146},
-+{ 1600, 1200, 32                      , 0x147},
-+{ 1152, 864, 8                      , 0x148},
-+{ 1152, 864, 15                      , 0x149},
-+{ 1152, 864, 16                      , 0x14a},
-+{ 1152, 864, 24                      , 0x14b},
-+{ 1152, 864, 32                      , 0x14c},
-+{ 0, },
-+};
-+
-+int main(int argc, char **argv)
-+{
-+    const ModeInfo *pm;
-+    int pitch, r_size, r_pos, g_size, g_pos, b_size, b_pos, a_size, a_pos;
-+    const char *str;
-+
-+    printf("/* THIS FILE IS AUTOMATICALLY GENERATED - DO NOT EDIT */\n");
-+    printf("static ModeInfoListItem mode_info_list[]=\n");
-+    printf("{\n");
-+    for(pm = modes; pm->mode != 0; pm++) {
-+        printf("{ 0x%04x, /* %dx%dx%d */\n", 
-+               pm->mode, pm->width, pm->height, pm->depth);
-+        printf("{ /*Bit16u ModeAttributes*/ %s,\n", 
-+               "VBE_MODE_ATTRIBUTE_SUPPORTED | "
-+               "VBE_MODE_ATTRIBUTE_EXTENDED_INFORMATION_AVAILABLE | "
-+               "VBE_MODE_ATTRIBUTE_COLOR_MODE | "
-+               "VBE_MODE_ATTRIBUTE_LINEAR_FRAME_BUFFER_MODE | "
-+               "VBE_MODE_ATTRIBUTE_GRAPHICS_MODE");
-+           
-+        printf("/*Bit8u  WinAAttributes*/ %s,\n",
-+               "VBE_WINDOW_ATTRIBUTE_RELOCATABLE | "
-+               "VBE_WINDOW_ATTRIBUTE_READABLE | "
-+               "VBE_WINDOW_ATTRIBUTE_WRITEABLE");
-+        
-+        printf("/*Bit8u  WinBAttributes*/ %d,\n", 0);
-+        
-+        printf("/*Bit16u WinGranularity*/ %s,\n", "VBE_DISPI_BANK_SIZE_KB");
-+        
-+        printf("/*Bit16u WinSize*/ %s,\n", "VBE_DISPI_BANK_SIZE_KB");
-+        
-+        printf("/*Bit16u WinASegment*/ %s,\n", "VGAMEM_GRAPH");
-+        
-+        printf("/*Bit16u WinBSegment*/ 0x%04x,\n", 0);
-+        
-+        printf("/*Bit32u WinFuncPtr*/ %d,\n", 0);
-+        
-+        if (pm->depth == 4)
-+            pitch = (pm->width + 7) / 8;
-+        else
-+            pitch = pm->width * ((pm->depth + 7) / 8);
-+        printf("/*Bit16u BytesPerScanLine*/ %d,\n", pitch);
-+
-+        // Mandatory information for VBE 1.2 and above
-+        printf("/*Bit16u XResolution*/ %d,\n", pm->width);
-+        printf("/*Bit16u YResolution*/ %d,\n", pm->height);
-+        printf("/*Bit8u  XCharSize*/ %d,\n", 8);
-+        printf("/*Bit8u  YCharSize*/ %d,\n", 16);
-+        if (pm->depth == 4) {
-+            printf("/*Bit8u  NumberOfPlanes*/ %d,\n", 4);
-+            printf("/*Bit8u  BitsPerPixel*/ %d,\n", pm->depth);
-+        } else {
-+            printf("/*Bit8u  NumberOfPlanes*/ %d,\n", 1);
-+            printf("/*Bit8u  BitsPerPixel*/ %d,\n", pm->depth);
-+        }
-+        printf("/*Bit8u  NumberOfBanks*/ %d,\n", 
-+               (pm->height * pitch + 65535) / 65536);
-+
-+        if (pm->depth == 4)
-+            str = "VBE_MEMORYMODEL_PLANAR";
-+        else if (pm->depth == 8)
-+            str = "VBE_MEMORYMODEL_PACKED_PIXEL";
-+        else
-+            str = "VBE_MEMORYMODEL_DIRECT_COLOR";
-+        printf("/*Bit8u  MemoryModel*/ %s,\n", str);
-+        printf("/*Bit8u  BankSize*/ %d,\n", 0);
-+        /* XXX: check */
-+        printf("/*Bit8u  NumberOfImagePages*/ %d,\n", 0);
-+        printf("/*Bit8u  Reserved_page*/ %d,\n", 0);
-+
-+        // Direct Color fields (required for direct/6 and YUV/7 memory models)
-+        switch(pm->depth) {
-+        case 15:
-+            r_size = 5;
-+            r_pos = 10;
-+            g_size = 5;
-+            g_pos = 5;
-+            b_size = 5;
-+            b_pos = 0;
-+            a_size = 1;
-+            a_pos = 15;
-+            break;
-+        case 16:
-+            r_size = 5;
-+            r_pos = 11;
-+            g_size = 6;
-+            g_pos = 5;
-+            b_size = 5;
-+            b_pos = 0;
-+            a_size = 0;
-+            a_pos = 0;
-+            break;
-+        case 24:
-+            r_size = 8;
-+            r_pos = 16;
-+            g_size = 8;
-+            g_pos = 8;
-+            b_size = 8;
-+            b_pos = 0;
-+            a_size = 0;
-+            a_pos = 0;
-+            break;
-+        case 32:
-+            r_size = 8;
-+            r_pos = 16;
-+            g_size = 8;
-+            g_pos = 8;
-+            b_size = 8;
-+            b_pos = 0;
-+            a_size = 8;
-+            a_pos = 24;
-+            break;
-+        default:
-+            r_size = 0;
-+            r_pos = 0;
-+            g_size = 0;
-+            g_pos = 0;
-+            b_size = 0;
-+            b_pos = 0;
-+            a_size = 0;
-+            a_pos = 0;
-+            break;
-+        }
-+
-+        printf("/*Bit8u  RedMaskSize*/ %d,\n", r_size);               
-+        printf("/*Bit8u  RedFieldPosition*/ %d,\n", r_pos);          
-+        printf("/*Bit8u  GreenMaskSize*/ %d,\n", g_size);             
-+        printf("/*Bit8u  GreenFieldPosition*/ %d,\n", g_pos);        
-+        printf("/*Bit8u  BlueMaskSize*/ %d,\n", b_size);              
-+        printf("/*Bit8u  BlueFieldPosition*/ %d,\n", b_pos);         
-+        printf("/*Bit8u  RsvdMaskSize*/ %d,\n", a_size);              
-+        printf("/*Bit8u  RsvdFieldPosition*/ %d,\n", a_pos);         
-+        printf("/*Bit8u  DirectColorModeInfo*/ %d,\n", 0);       
-+
-+// Mandatory information for VBE 2.0 and above
-+        printf("/*Bit32u PhysBasePtr*/ %s,\n",             
-+               "VBE_DISPI_LFB_PHYSICAL_ADDRESS");
-+        printf("/*Bit32u OffScreenMemOffset*/ %d,\n", 0);
-+        printf("/*Bit16u OffScreenMemSize*/ %d,\n", 0);
-+        // Mandatory information for VBE 3.0 and above
-+        printf("/*Bit16u LinBytesPerScanLine*/ %d,\n", pitch);
-+        printf("/*Bit8u  BnkNumberOfPages*/ %d,\n", 0);
-+        printf("/*Bit8u  LinNumberOfPages*/ %d,\n", 0);
-+        printf("/*Bit8u  LinRedMaskSize*/ %d,\n", r_size);
-+        printf("/*Bit8u  LinRedFieldPosition*/ %d,\n", r_pos);
-+        printf("/*Bit8u  LinGreenMaskSize*/ %d,\n", g_size);
-+        printf("/*Bit8u  LinGreenFieldPosition*/ %d,\n", g_pos);
-+        printf("/*Bit8u  LinBlueMaskSize*/ %d,\n", b_size);
-+        printf("/*Bit8u  LinBlueFieldPosition*/ %d,\n", b_pos);
-+        printf("/*Bit8u  LinRsvdMaskSize*/ %d,\n", a_size);
-+        printf("/*Bit8u  LinRsvdFieldPosition*/ %d,\n", a_pos);
-+        printf("/*Bit32u MaxPixelClock*/ %d,\n", 0);
-+        printf("} },\n");
-+    }
-+    printf("{ VBE_VESA_MODE_END_OF_LIST,\n");
-+    printf("{ 0,\n");
-+    printf("} },\n");
-+    printf("};\n");
-+    return 0;
-+}
diff --git a/pc-bios/video.x b/pc-bios/video.x
deleted file mode 100644
index 761aa0c..0000000
--- a/pc-bios/video.x
+++ /dev/null
diff --git a/ppc-dis.c b/ppc-dis.c
index f6fad88..f9ae53e 100644
--- a/ppc-dis.c
+++ b/ppc-dis.c
@@ -646,7 +646,7 @@ const struct powerpc_operand powerpc_operands[] =
    same.  */
 
 /*ARGSUSED*/
-static unsigned long 
+static unsigned long
 insert_bat (insn, value, errmsg)
      uint32_t insn;
      int32_t value;
@@ -1122,7 +1122,7 @@ insert_ras (insn, value, errmsg)
    extraction function just checks that the fields are the same.  */
 
 /*ARGSUSED*/
-static unsigned long 
+static unsigned long
 insert_rbs (insn, value, errmsg)
      uint32_t insn;
      int32_t value;
diff --git a/ppc.ld b/ppc.ld
index d0a0dcb..1e6bbe9 100644
--- a/ppc.ld
+++ b/ppc.ld
@@ -2,8 +2,8 @@
  * Written by Martin Mares <mj@atrey.karlin.mff.cuni.cz>;
  */
 OUTPUT_FORMAT("elf32-powerpc", "elf32-powerpc", "elf32-powerpc")
-OUTPUT_ARCH(powerpc)
-SEARCH_DIR(/lib); SEARCH_DIR(/usr/lib); SEARCH_DIR(/usr/local/lib); SEARCH_DIR(/usr/alpha-unknown-linux-gnu/lib);
+OUTPUT_ARCH(powerpc:common)
+SEARCH_DIR(/usr/powerpc-linux-gnu/lib); SEARCH_DIR(/usr/local/lib); SEARCH_DIR(/lib); SEARCH_DIR(/usr/lib)
 ENTRY(_start)
 SECTIONS
 {
@@ -16,93 +16,179 @@ SECTIONS
   .gnu.version   : { *(.gnu.version)	}
   .gnu.version_d   : { *(.gnu.version_d)	}
   .gnu.version_r   : { *(.gnu.version_r)	}
-  .rel.text      :
-    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
-  .rela.text     :
-    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
-  .rel.data      :
-    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
-  .rela.data     :
-    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
-  .rel.rodata    :
-    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
-  .rela.rodata   :
-    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
-  .rel.got       : { *(.rel.got)		}
-  .rela.got      : { *(.rela.got)		}
-  .rel.ctors     : { *(.rel.ctors)	}
-  .rela.ctors    : { *(.rela.ctors)	}
-  .rel.dtors     : { *(.rel.dtors)	}
-  .rela.dtors    : { *(.rela.dtors)	}
-  .rel.init      : { *(.rel.init)	}
-  .rela.init     : { *(.rela.init)	}
-  .rel.fini      : { *(.rel.fini)	}
-  .rela.fini     : { *(.rela.fini)	}
-  .rel.bss       : { *(.rel.bss)		}
-  .rela.bss      : { *(.rela.bss)		}
-  .rel.plt       : { *(.rel.plt)		}
-  .rela.plt      : { *(.rela.plt)		}
-  .init          : { *(.init)	} =0x47ff041f
-  .text      :
+  .rel.init       : { *(.rel.init) }
+  .rela.init      : { *(.rela.init) }
+  .rel.text       : { *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*) }
+  .rela.text      : { *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*) }
+  .rel.fini       : { *(.rel.fini) }
+  .rela.fini      : { *(.rela.fini) }
+  .rel.rodata     : { *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*) }
+  .rela.rodata    : { *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*) }
+  .rel.data.rel.ro   : { *(.rel.data.rel.ro* .rel.gnu.linkonce.d.rel.ro.*) }
+  .rela.data.rel.ro   : { *(.rela.data.rel.ro* .rela.gnu.linkonce.d.rel.ro.*) }
+  .rel.data       : { *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*) }
+  .rela.data      : { *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*) }
+  .rel.tdata	  : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
+  .rela.tdata	  : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
+  .rel.tbss	  : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
+  .rela.tbss	  : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
+  .rel.ctors      : { *(.rel.ctors) }
+  .rela.ctors     : { *(.rela.ctors) }
+  .rel.dtors      : { *(.rel.dtors) }
+  .rela.dtors     : { *(.rela.dtors) }
+  .rel.got        : { *(.rel.got) }
+  .rela.got       : { *(.rela.got) }
+  .rela.got1           : { *(.rela.got1) }
+  .rela.got2           : { *(.rela.got2) }
+  .rel.sdata      : { *(.rel.sdata .rel.sdata.* .rel.gnu.linkonce.s.*) }
+  .rela.sdata     : { *(.rela.sdata .rela.sdata.* .rela.gnu.linkonce.s.*) }
+  .rel.sbss       : { *(.rel.sbss .rel.sbss.* .rel.gnu.linkonce.sb.*) }
+  .rela.sbss      : { *(.rela.sbss .rela.sbss.* .rela.gnu.linkonce.sb.*) }
+  .rel.sdata2     : { *(.rel.sdata2 .rel.sdata2.* .rel.gnu.linkonce.s2.*) }
+  .rela.sdata2    : { *(.rela.sdata2 .rela.sdata2.* .rela.gnu.linkonce.s2.*) }
+  .rel.sbss2      : { *(.rel.sbss2 .rel.sbss2.* .rel.gnu.linkonce.sb2.*) }
+  .rela.sbss2     : { *(.rela.sbss2 .rela.sbss2.* .rela.gnu.linkonce.sb2.*) }
+  .rel.bss        : { *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*) }
+  .rela.bss       : { *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*) }
+  .rel.plt        : { *(.rel.plt) }
+  .rela.plt       : { *(.rela.plt) }
+  .init           :
   {
-    *(.text)
+    KEEP (*(.init))
+  } =0
+  .text           :
+  {
+    *(.text .stub .text.* .gnu.linkonce.t.*)
+    KEEP (*(.text.*personality*))
     /* .gnu.warning sections are handled specially by elf32.em.  */
     *(.gnu.warning)
-    *(.gnu.linkonce.t*)
+    *(.glink)
+  } =0x47ff041f
+  .fini           :
+  {
+    KEEP (*(.fini))
   } =0x47ff041f
-  _etext = .;
+  PROVIDE (__etext = .);
+  PROVIDE (_etext = .);
   PROVIDE (etext = .);
-  .fini      : { *(.fini)    } =0x47ff041f
-  . = ALIGN(32 / 8);
-  PROVIDE (__preinit_array_start = .);
-  .preinit_array     : { *(.preinit_array) }
-  PROVIDE (__preinit_array_end = .);
-  PROVIDE (__init_array_start = .);
-  .init_array     : { *(.init_array) }
-  PROVIDE (__init_array_end = .);
-  PROVIDE (__fini_array_start = .);
-  .fini_array     : { *(.fini_array) }
-  PROVIDE (__fini_array_end = .);
-  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
-  .rodata1   : { *(.rodata1) }
-  .reginfo : { *(.reginfo) }
+  .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
+  .rodata1        : { *(.rodata1) }
+  .sdata2         :
+  {
+    PROVIDE (_SDA2_BASE_ = 32768);
+    *(.sdata2 .sdata2.* .gnu.linkonce.s2.*)
+  }
+  .sbss2          : { *(.sbss2 .sbss2.* .gnu.linkonce.sb2.*) }
+  .eh_frame_hdr : { *(.eh_frame_hdr) }
+  .eh_frame       : ONLY_IF_RO { KEEP (*(.eh_frame)) }
+  .gcc_except_table   : ONLY_IF_RO { *(.gcc_except_table .gcc_except_table.*) }
   /* Adjust the address for the data segment.  We want to adjust up to
      the same address within the page on the next page up.  */
-  . = ALIGN(0x100000) + (. & (0x100000 - 1));
-  .data    :
+  . = ALIGN (0x10000) - ((0x10000 - .) & (0x10000 - 1)); . = DATA_SEGMENT_ALIGN (0x10000, 0x1000);
+  /* Exception handling  */
+  .eh_frame       : ONLY_IF_RW { KEEP (*(.eh_frame)) }
+  .gcc_except_table   : ONLY_IF_RW { *(.gcc_except_table .gcc_except_table.*) }
+  /* Thread Local Storage sections  */
+  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
+  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
+  .preinit_array     :
+  {
+    PROVIDE_HIDDEN (__preinit_array_start = .);
+    KEEP (*(.preinit_array))
+    PROVIDE_HIDDEN (__preinit_array_end = .);
+  }
+  .init_array     :
+  {
+     PROVIDE_HIDDEN (__init_array_start = .);
+     KEEP (*(SORT(.init_array.*)))
+     KEEP (*(.init_array))
+     PROVIDE_HIDDEN (__init_array_end = .);
+  }
+  .fini_array     :
+  {
+    PROVIDE_HIDDEN (__fini_array_start = .);
+    KEEP (*(.fini_array))
+    KEEP (*(SORT(.fini_array.*)))
+    PROVIDE_HIDDEN (__fini_array_end = .);
+  }
+  .ctors          :
   {
-    *(.data)
-    *(.gnu.linkonce.d*)
-    CONSTRUCTORS
+    /* gcc uses crtbegin.o to find the start of
+       the constructors, so we make sure it is
+       first.  Because this is a wildcard, it
+       doesn't matter if the user does not
+       actually link against crtbegin.o; the
+       linker won't look for a file to match a
+       wildcard.  The wildcard also means that it
+       doesn't matter which directory crtbegin.o
+       is in.  */
+    KEEP (*crtbegin*.o(.ctors))
+    /* We don't want to include the .ctor section from
+       the crtend.o file until after the sorted ctors.
+       The .ctor section from the crtend file contains the
+       end of ctors marker and it must be last */
+    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .ctors))
+    KEEP (*(SORT(.ctors.*)))
+    KEEP (*(.ctors))
   }
-  .data1   : { *(.data1) }
-  .ctors         :
+  .dtors          :
   {
-    *(.ctors)
+    KEEP (*crtbegin*.o(.dtors))
+    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .dtors))
+    KEEP (*(SORT(.dtors.*)))
+    KEEP (*(.dtors))
   }
-  .dtors         :
+  .jcr            : { KEEP (*(.jcr)) }
+  .data.rel.ro : { *(.data.rel.ro.local* .gnu.linkonce.d.rel.ro.local.*) *(.data.rel.ro* .gnu.linkonce.d.rel.ro.*) }
+  .got1           : { *(.got1) }
+  .got2           : { *(.got2) }
+  .dynamic        : { *(.dynamic) }
+  .got            : SPECIAL { *(.got) }
+  . = DATA_SEGMENT_RELRO_END (0, .);
+  .plt            : SPECIAL { *(.plt) }
+  .data           :
   {
-    *(.dtors)
+    *(.data .data.* .gnu.linkonce.d.*)
+    KEEP (*(.gnu.linkonce.d.*personality*))
+    SORT(CONSTRUCTORS)
   }
-  .plt      : { *(.plt)	}
-  .got           : { *(.got.plt) *(.got) }
-  .dynamic       : { *(.dynamic) }
+  .data1          : { *(.data1) }
+  .got            : SPECIAL { *(.got) }
   /* We want the small data sections together, so single-instruction offsets
      can access them all, and initialized data all before uninitialized, so
      we can shorten the on-disk segment size.  */
-  .sdata     : { *(.sdata) }
-  _edata  =  .;
-  PROVIDE (edata = .);
+  .sdata          :
+  {
+    PROVIDE (_SDA_BASE_ = 32768);
+    *(.sdata .sdata.* .gnu.linkonce.s.*)
+  }
+  _edata = .; PROVIDE (edata = .);
   __bss_start = .;
-  .sbss      : { *(.sbss) *(.scommon) }
-  .bss       :
+  .sbss           :
+  {
+    PROVIDE (__sbss_start = .); PROVIDE (___sbss_start = .);
+    *(.dynsbss)
+    *(.sbss .sbss.* .gnu.linkonce.sb.*)
+    *(.scommon)
+    PROVIDE (__sbss_end = .); PROVIDE (___sbss_end = .);
+  }
+  .plt            : SPECIAL { *(.plt) }
+  .bss            :
   {
    *(.dynbss)
-   *(.bss)
+   *(.bss .bss.* .gnu.linkonce.b.*)
    *(COMMON)
+   /* Align here to ensure that the .bss section occupies space up to
+      _end.  Align after .bss to ensure correct alignment even if the
+      .bss section disappears because there are no input sections.
+      FIXME: Why do we need it? When there is no .bss section, we don't
+      pad the .data section.  */
+   . = ALIGN(. != 0 ? 32 / 8 : 1);
   }
-  _end = . ;
-  PROVIDE (end = .);
+  . = ALIGN(32 / 8);
+  . = ALIGN(32 / 8);
+  _end = .; PROVIDE (end = .);
+  . = DATA_SEGMENT_END (.);
   /* Stabs debugging sections.  */
   .stab 0 : { *(.stab) }
   .stabstr 0 : { *(.stabstr) }
@@ -137,4 +223,6 @@ SECTIONS
   .debug_typenames 0 : { *(.debug_typenames) }
   .debug_varnames  0 : { *(.debug_varnames) }
   /* These must appear regardless of  .  */
+  /DISCARD/    : { *(.fixup) }
+  /DISCARD/ : { *(.note.GNU-stack) }
 }
diff --git a/proxy/proxy_common.c b/proxy/proxy_common.c
index ffe8e22..7794a62 100644
--- a/proxy/proxy_common.c
+++ b/proxy/proxy_common.c
@@ -15,7 +15,9 @@
 #include <stdio.h>
 #include <string.h>
 #include <errno.h>
-#include "vl.h"
+#include "android/utils/misc.h"
+#include "android/utils/system.h"
+#include <stdlib.h>
 
 int  proxy_log = 0;
 
@@ -505,9 +507,7 @@ proxy_resolve_server( SockAddress*   addr,
         servernamelen = strlen(servername);
 
     if (servernamelen >= sizeof(name0)) {
-        name = qemu_malloc(servernamelen+1);
-        if (name == NULL)
-            return -1;
+        AARRAY_NEW(name, servernamelen+1);
     }
 
     memcpy(name, servername, servernamelen);
@@ -524,7 +524,7 @@ proxy_resolve_server( SockAddress*   addr,
 
 Exit:
     if (name != name0)
-        qemu_free(name);
+        AFREE(name);
 
     return result;
 }
diff --git a/proxy/proxy_http.c b/proxy/proxy_http.c
index 5c185ca..f753587 100644
--- a/proxy/proxy_http.c
+++ b/proxy/proxy_http.c
@@ -11,10 +11,10 @@
 */
 #include "proxy_int.h"
 #include "proxy_http_int.h"
+#include "qemu-common.h"
 #include <errno.h>
 #include <stdio.h>
 #include <string.h>
-#include "vl.h"
 
 #define  HTTP_VERSION  "1.1"
 
diff --git a/proxy/proxy_http_connector.c b/proxy/proxy_http_connector.c
index 7bf2f53..6f03d9b 100644
--- a/proxy/proxy_http_connector.c
+++ b/proxy/proxy_http_connector.c
@@ -13,7 +13,7 @@
 #include <errno.h>
 #include <stdio.h>
 #include <string.h>
-#include "vl.h"
+#include "qemu-common.h"
 
 /* A HttpConnector implements a non-HTTP proxied connection
  * through the CONNECT method. Many firewalls are configured
diff --git a/proxy/proxy_http_rewriter.c b/proxy/proxy_http_rewriter.c
index f0bfbbc..812bf9c 100644
--- a/proxy/proxy_http_rewriter.c
+++ b/proxy/proxy_http_rewriter.c
@@ -10,10 +10,10 @@
 ** GNU General Public License for more details.
 */
 #include "proxy_http_int.h"
-#include "android_utils.h"
 #include <stdio.h>
 #include <string.h>
-#include "vl.h"
+#include "qemu-common.h"
+#include "android/utils/system.h"  /* strsep */
 
 /* this implements a transparent HTTP rewriting proxy
  *
diff --git a/proxy/proxy_int.h b/proxy/proxy_int.h
index 9bdac5c..739bb75 100644
--- a/proxy/proxy_int.h
+++ b/proxy/proxy_int.h
@@ -14,7 +14,7 @@
 
 #include "proxy_common.h"
 #include "sockets.h"
-#include "android_utils.h"
+#include "android/utils/stralloc.h"
 
 extern int  proxy_log;
 
diff --git a/qemu-char.h b/qemu-char.h
new file mode 100644
index 0000000..439e2c8
--- /dev/null
+++ b/qemu-char.h
@@ -0,0 +1,90 @@
+#ifndef QEMU_CHAR_H
+#define QEMU_CHAR_H
+
+#include "qemu-common.h"
+
+/* character device */
+
+#define CHR_EVENT_BREAK 0 /* serial break char */
+#define CHR_EVENT_FOCUS 1 /* focus to this terminal (modal input needed) */
+#define CHR_EVENT_RESET 2 /* new connection established */
+
+
+#define CHR_IOCTL_SERIAL_SET_PARAMS   1
+typedef struct {
+    int speed;
+    int parity;
+    int data_bits;
+    int stop_bits;
+} QEMUSerialSetParams;
+
+#define CHR_IOCTL_SERIAL_SET_BREAK    2
+
+#define CHR_IOCTL_PP_READ_DATA        3
+#define CHR_IOCTL_PP_WRITE_DATA       4
+#define CHR_IOCTL_PP_READ_CONTROL     5
+#define CHR_IOCTL_PP_WRITE_CONTROL    6
+#define CHR_IOCTL_PP_READ_STATUS      7
+#define CHR_IOCTL_PP_EPP_READ_ADDR    8
+#define CHR_IOCTL_PP_EPP_READ         9
+#define CHR_IOCTL_PP_EPP_WRITE_ADDR  10
+#define CHR_IOCTL_PP_EPP_WRITE       11
+#define CHR_IOCTL_PP_DATA_DIR        12
+
+#define CHR_IOCTL_SERIAL_SET_TIOCM   13
+#define CHR_IOCTL_SERIAL_GET_TIOCM   14
+
+#define CHR_TIOCM_CTS	0x020
+#define CHR_TIOCM_CAR	0x040
+#define CHR_TIOCM_DSR	0x100
+#define CHR_TIOCM_RI	0x080
+#define CHR_TIOCM_DTR	0x002
+#define CHR_TIOCM_RTS	0x004
+
+typedef void IOEventHandler(void *opaque, int event);
+
+struct CharDriverState {
+    int (*chr_write)(struct CharDriverState *s, const uint8_t *buf, int len);
+    void (*chr_update_read_handler)(struct CharDriverState *s);
+    int (*chr_ioctl)(struct CharDriverState *s, int cmd, void *arg);
+    IOEventHandler *chr_event;
+    IOCanRWHandler *chr_can_read;
+    IOReadHandler *chr_read;
+    void *handler_opaque;
+    void (*chr_send_event)(struct CharDriverState *chr, int event);
+    void (*chr_close)(struct CharDriverState *chr);
+    void (*chr_accept_input)(struct CharDriverState *chr);
+    void *opaque;
+    int focus;
+    QEMUBH *bh;
+};
+
+CharDriverState *qemu_chr_open(const char *filename);
+void qemu_chr_close(CharDriverState *chr);
+void qemu_chr_printf(CharDriverState *s, const char *fmt, ...);
+int qemu_chr_write(CharDriverState *s, const uint8_t *buf, int len);
+void qemu_chr_send_event(CharDriverState *s, int event);
+void qemu_chr_add_handlers(CharDriverState *s,
+                           IOCanRWHandler *fd_can_read,
+                           IOReadHandler *fd_read,
+                           IOEventHandler *fd_event,
+                           void *opaque);
+int qemu_chr_ioctl(CharDriverState *s, int cmd, void *arg);
+void qemu_chr_reset(CharDriverState *s);
+int qemu_chr_can_read(CharDriverState *s);
+void qemu_chr_read(CharDriverState *s, uint8_t *buf, int len);
+void qemu_chr_accept_input(CharDriverState *s);
+
+/* async I/O support */
+
+int qemu_set_fd_handler2(int fd,
+                         IOCanRWHandler *fd_read_poll,
+                         IOHandler *fd_read,
+                         IOHandler *fd_write,
+                         void *opaque);
+int qemu_set_fd_handler(int fd,
+                        IOHandler *fd_read,
+                        IOHandler *fd_write,
+                        void *opaque);
+
+#endif
diff --git a/qemu-common.h b/qemu-common.h
new file mode 100644
index 0000000..391717c
--- /dev/null
+++ b/qemu-common.h
@@ -0,0 +1,142 @@
+/* Common header file that is included by all of qemu.  */
+#ifndef QEMU_COMMON_H
+#define QEMU_COMMON_H
+
+/* we put basic includes here to avoid repeating them in device drivers */
+#include <stdlib.h>
+#include <stdio.h>
+#include <stddef.h>
+#include <stdarg.h>
+#include <string.h>
+#include <inttypes.h>
+#include <limits.h>
+#include <time.h>
+#include <ctype.h>
+#include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+#ifndef O_LARGEFILE
+#define O_LARGEFILE 0
+#endif
+#ifndef O_BINARY
+#define O_BINARY 0
+#endif
+
+#ifndef ENOMEDIUM
+#define ENOMEDIUM ENODEV
+#endif
+
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#define fsync _commit
+#define lseek _lseeki64
+#define ENOTSUP 4096
+extern int qemu_ftruncate64(int, int64_t);
+#define ftruncate qemu_ftruncate64
+
+
+static inline char *realpath(const char *path, char *resolved_path)
+{
+    _fullpath(resolved_path, path, _MAX_PATH);
+    return resolved_path;
+}
+
+#define PRId64 "I64d"
+#define PRIx64 "I64x"
+#define PRIu64 "I64u"
+#define PRIo64 "I64o"
+#endif
+
+/* FIXME: Remove NEED_CPU_H.  */
+#ifndef NEED_CPU_H
+
+#include "config-host.h"
+#include <setjmp.h>
+#include "osdep.h"
+#include "bswap.h"
+
+#else
+
+#include "cpu.h"
+
+#endif /* !defined(NEED_CPU_H) */
+
+/* bottom halves */
+typedef struct QEMUBH QEMUBH;
+
+typedef void QEMUBHFunc(void *opaque);
+
+QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque);
+void qemu_bh_schedule(QEMUBH *bh);
+void qemu_bh_cancel(QEMUBH *bh);
+void qemu_bh_delete(QEMUBH *bh);
+int qemu_bh_poll(void);
+
+uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c);
+
+void qemu_get_timedate(struct tm *tm, int offset);
+int qemu_timedate_diff(struct tm *tm);
+
+/* cutils.c */
+void pstrcpy(char *buf, int buf_size, const char *str);
+char *pstrcat(char *buf, int buf_size, const char *s);
+int strstart(const char *str, const char *val, const char **ptr);
+int stristart(const char *str, const char *val, const char **ptr);
+time_t mktimegm(struct tm *tm);
+
+void *qemu_malloc(size_t size);
+void *qemu_realloc(void *ptr, size_t size);
+void *qemu_mallocz(size_t size);
+void qemu_free(void *ptr);
+char *qemu_strdup(const char *str);
+
+void *get_mmap_addr(unsigned long size);
+
+
+/* Error handling.  */
+
+void hw_error(const char *fmt, ...)
+    __attribute__ ((__format__ (__printf__, 1, 2)))
+    __attribute__ ((__noreturn__));
+
+/* IO callbacks.  */
+typedef void IOReadHandler(void *opaque, const uint8_t *buf, int size);
+typedef int IOCanRWHandler(void *opaque);
+typedef void IOHandler(void *opaque);
+
+struct ParallelIOArg {
+    void *buffer;
+    int count;
+};
+
+typedef int (*DMA_transfer_handler) (void *opaque, int nchan, int pos, int size);
+
+/* A load of opaque types so that device init declarations don't have to
+   pull in all the real definitions.  */
+typedef struct NICInfo NICInfo;
+typedef struct AudioState AudioState;
+typedef struct BlockDriverState BlockDriverState;
+typedef struct DisplayState DisplayState;
+typedef struct TextConsole TextConsole;
+typedef TextConsole QEMUConsole;
+typedef struct CharDriverState CharDriverState;
+typedef struct VLANState VLANState;
+typedef struct QEMUFile QEMUFile;
+typedef struct i2c_bus i2c_bus;
+typedef struct i2c_slave i2c_slave;
+typedef struct SMBusDevice SMBusDevice;
+typedef struct QEMUTimer QEMUTimer;
+typedef struct PCIBus PCIBus;
+typedef struct PCIDevice PCIDevice;
+typedef struct SerialState SerialState;
+typedef struct IRQState *qemu_irq;
+struct pcmcia_card_s;
+
+/* CPU save/load.  */
+void cpu_save(QEMUFile *f, void *opaque);
+int cpu_load(QEMUFile *f, void *opaque, int version_id);
+
+#endif
diff --git a/qemu-img.c b/qemu-img.c
deleted file mode 100644
index c5a8e1a..0000000
--- a/qemu-img.c
+++ /dev/null
@@ -1,716 +0,0 @@
-/*
- * create a COW disk image
- * 
- * Copyright (c) 2003 Fabrice Bellard
- * 
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include "vl.h"
-
-#ifdef _WIN32
-#include <windows.h>
-#endif
-
-void *get_mmap_addr(unsigned long size)
-{
-    return NULL;
-}
-
-void qemu_free(void *ptr)
-{
-    free(ptr);
-}
-
-void *qemu_malloc(size_t size)
-{
-    return malloc(size);
-}
-
-void *qemu_mallocz(size_t size)
-{
-    void *ptr;
-    ptr = qemu_malloc(size);
-    if (!ptr)
-        return NULL;
-    memset(ptr, 0, size);
-    return ptr;
-}
-
-char *qemu_strdup(const char *str)
-{
-    char *ptr;
-    ptr = qemu_malloc(strlen(str) + 1);
-    if (!ptr)
-        return NULL;
-    strcpy(ptr, str);
-    return ptr;
-}
-
-void pstrcpy(char *buf, int buf_size, const char *str)
-{
-    int c;
-    char *q = buf;
-
-    if (buf_size <= 0)
-        return;
-
-    for(;;) {
-        c = *str++;
-        if (c == 0 || q >= buf + buf_size - 1)
-            break;
-        *q++ = c;
-    }
-    *q = '\0';
-}
-
-/* strcat and truncate. */
-char *pstrcat(char *buf, int buf_size, const char *s)
-{
-    int len;
-    len = strlen(buf);
-    if (len < buf_size) 
-        pstrcpy(buf + len, buf_size - len, s);
-    return buf;
-}
-
-int strstart(const char *str, const char *val, const char **ptr)
-{
-    const char *p, *q;
-    p = str;
-    q = val;
-    while (*q != '\0') {
-        if (*p != *q)
-            return 0;
-        p++;
-        q++;
-    }
-    if (ptr)
-        *ptr = p;
-    return 1;
-}
-
-void term_printf(const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
-    vprintf(fmt, ap);
-    va_end(ap);
-}
-
-void __attribute__((noreturn)) error(const char *fmt, ...) 
-{
-    va_list ap;
-    va_start(ap, fmt);
-    fprintf(stderr, "qemu-img: ");
-    vfprintf(stderr, fmt, ap);
-    fprintf(stderr, "\n");
-    exit(1);
-    va_end(ap);
-}
-
-static void format_print(void *opaque, const char *name)
-{
-    printf(" %s", name);
-}
-
-void help(void)
-{
-    printf("qemu-img version " QEMU_VERSION ", Copyright (c) 2004-2005 Fabrice Bellard\n"
-           "usage: qemu-img command [command options]\n"
-           "QEMU disk image utility\n"
-           "\n"
-           "Command syntax:\n"
-           "  create [-e] [-b base_image] [-f fmt] filename [size]\n"
-           "  commit [-f fmt] filename\n"
-           "  convert [-c] [-e] [-f fmt] filename [-O output_fmt] output_filename\n"
-           "  info [-f fmt] filename\n"
-           "\n"
-           "Command parameters:\n"
-           "  'filename' is a disk image filename\n"
-           "  'base_image' is the read-only disk image which is used as base for a copy on\n"
-           "    write image; the copy on write image only stores the modified data\n"
-           "  'fmt' is the disk image format. It is guessed automatically in most cases\n"
-           "  'size' is the disk image size in kilobytes. Optional suffixes 'M' (megabyte)\n"
-           "    and 'G' (gigabyte) are supported\n"
-           "  'output_filename' is the destination disk image filename\n"
-           "  'output_fmt' is the destination format\n"
-           "  '-c' indicates that target image must be compressed (qcow format only)\n"
-           "  '-e' indicates that the target image must be encrypted (qcow format only)\n"
-           );
-    printf("\nSupported format:");
-    bdrv_iterate_format(format_print, NULL);
-    printf("\n");
-    exit(1);
-}
-
-
-#define NB_SUFFIXES 4
-
-static void get_human_readable_size(char *buf, int buf_size, int64_t size)
-{
-    static const char suffixes[NB_SUFFIXES] = "KMGT";
-    int64_t base;
-    int i;
-
-    if (size <= 999) {
-        snprintf(buf, buf_size, "%" PRId64, size);
-    } else {
-        base = 1024;
-        for(i = 0; i < NB_SUFFIXES; i++) {
-            if (size < (10 * base)) {
-                snprintf(buf, buf_size, "%0.1f%c", 
-                         (double)size / base,
-                         suffixes[i]);
-                break;
-            } else if (size < (1000 * base) || i == (NB_SUFFIXES - 1)) {
-                snprintf(buf, buf_size, "%" PRId64 "%c", 
-                         ((size + (base >> 1)) / base),
-                         suffixes[i]);
-                break;
-            }
-            base = base * 1024;
-        }
-    }
-}
-
-#if defined(WIN32)
-/* XXX: put correct support for win32 */
-static int read_password(char *buf, int buf_size)
-{
-    int c, i;
-    printf("Password: ");
-    fflush(stdout);
-    i = 0;
-    for(;;) {
-        c = getchar();
-        if (c == '\n')
-            break;
-        if (i < (buf_size - 1))
-            buf[i++] = c;
-    }
-    buf[i] = '\0';
-    return 0;
-}
-
-#else
-
-#include <termios.h>
-
-static struct termios oldtty;
-
-static void term_exit(void)
-{
-    tcsetattr (0, TCSANOW, &oldtty);
-}
-
-static void term_init(void)
-{
-    struct termios tty;
-
-    tcgetattr (0, &tty);
-    oldtty = tty;
-
-    tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP
-                          |INLCR|IGNCR|ICRNL|IXON);
-    tty.c_oflag |= OPOST;
-    tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN);
-    tty.c_cflag &= ~(CSIZE|PARENB);
-    tty.c_cflag |= CS8;
-    tty.c_cc[VMIN] = 1;
-    tty.c_cc[VTIME] = 0;
-    
-    tcsetattr (0, TCSANOW, &tty);
-
-    atexit(term_exit);
-}
-
-int read_password(char *buf, int buf_size)
-{
-    uint8_t ch;
-    int i, ret;
-
-    printf("password: ");
-    fflush(stdout);
-    term_init();
-    i = 0;
-    for(;;) {
-        ret = read(0, &ch, 1);
-        if (ret == -1) {
-            if (errno == EAGAIN || errno == EINTR) {
-                continue;
-            } else {
-                ret = -1;
-                break;
-            }
-        } else if (ret == 0) {
-            ret = -1;
-            break;
-        } else {
-            if (ch == '\r') {
-                ret = 0;
-                break;
-            }
-            if (i < (buf_size - 1))
-                buf[i++] = ch;
-        }
-    }
-    term_exit();
-    buf[i] = '\0';
-    printf("\n");
-    return ret;
-}
-#endif
-
-static BlockDriverState *bdrv_new_open(const char *filename,
-                                       const char *fmt)
-{
-    BlockDriverState *bs;
-    BlockDriver *drv;
-    char password[256];
-
-    bs = bdrv_new("");
-    if (!bs)
-        error("Not enough memory");
-    if (fmt) {
-        drv = bdrv_find_format(fmt);
-        if (!drv)
-            error("Unknown file format '%s'", fmt);
-    } else {
-        drv = NULL;
-    }
-    if (bdrv_open2(bs, filename, 0, drv) < 0) {
-        error("Could not open '%s'", filename);
-    }
-    if (bdrv_is_encrypted(bs)) {
-        printf("Disk image '%s' is encrypted.\n", filename);
-        if (read_password(password, sizeof(password)) < 0)
-            error("No password given");
-        if (bdrv_set_key(bs, password) < 0)
-            error("invalid password");
-    }
-    return bs;
-}
-
-static int img_create(int argc, char **argv)
-{
-    int c, ret, encrypted;
-    const char *fmt = "raw";
-    const char *filename;
-    const char *base_filename = NULL;
-    int64_t size;
-    const char *p;
-    BlockDriver *drv;
-    
-    encrypted = 0;
-    for(;;) {
-        c = getopt(argc, argv, "b:f:he");
-        if (c == -1)
-            break;
-        switch(c) {
-        case 'h':
-            help();
-            break;
-        case 'b':
-            base_filename = optarg;
-            break;
-        case 'f':
-            fmt = optarg;
-            break;
-        case 'e':
-            encrypted = 1;
-            break;
-        }
-    }
-    if (optind >= argc) 
-        help();
-    filename = argv[optind++];
-    size = 0;
-    if (base_filename) {
-        BlockDriverState *bs;
-        bs = bdrv_new_open(base_filename, NULL);
-        bdrv_get_geometry(bs, &size);
-        size *= 512;
-        bdrv_delete(bs);
-    } else {
-        if (optind >= argc)
-            help();
-        p = argv[optind];
-        size = strtoul(p, (char **)&p, 0);
-        if (*p == 'M') {
-            size *= 1024 * 1024;
-        } else if (*p == 'G') {
-            size *= 1024 * 1024 * 1024;
-        } else if (*p == 'k' || *p == 'K' || *p == '\0') {
-            size *= 1024;
-        } else {
-            help();
-        }
-    }
-    drv = bdrv_find_format(fmt);
-    if (!drv)
-        error("Unknown file format '%s'", fmt);
-    printf("Formating '%s', fmt=%s",
-           filename, fmt);
-    if (encrypted)
-        printf(", encrypted");
-    if (base_filename) {
-        printf(", backing_file=%s",
-               base_filename);
-    }
-    printf(", size=%" PRId64 " kB\n", (int64_t) (size / 1024));
-    ret = bdrv_create(drv, filename, size / 512, base_filename, encrypted);
-    if (ret < 0) {
-        if (ret == -ENOTSUP) {
-            error("Formatting or formatting option not supported for file format '%s'", fmt);
-        } else {
-            error("Error while formatting");
-        }
-    }
-    return 0;
-}
-
-static int img_commit(int argc, char **argv)
-{
-    int c, ret;
-    const char *filename, *fmt;
-    BlockDriver *drv;
-    BlockDriverState *bs;
-
-    fmt = NULL;
-    for(;;) {
-        c = getopt(argc, argv, "f:h");
-        if (c == -1)
-            break;
-        switch(c) {
-        case 'h':
-            help();
-            break;
-        case 'f':
-            fmt = optarg;
-            break;
-        }
-    }
-    if (optind >= argc) 
-        help();
-    filename = argv[optind++];
-
-    bs = bdrv_new("");
-    if (!bs)
-        error("Not enough memory");
-    if (fmt) {
-        drv = bdrv_find_format(fmt);
-        if (!drv)
-            error("Unknown file format '%s'", fmt);
-    } else {
-        drv = NULL;
-    }
-    if (bdrv_open2(bs, filename, 0, drv) < 0) {
-        error("Could not open '%s'", filename);
-    }
-    ret = bdrv_commit(bs);
-    switch(ret) {
-    case 0:
-        printf("Image committed.\n");
-        break;
-    case -ENOENT:
-        error("No disk inserted");
-        break;
-    case -EACCES:
-        error("Image is read-only");
-        break;
-    case -ENOTSUP:
-        error("Image is already committed");
-        break;
-    default:
-        error("Error while committing image");
-        break;
-    }
-
-    bdrv_delete(bs);
-    return 0;
-}
-
-static int is_not_zero(const uint8_t *sector, int len)
-{
-    int i;
-    len >>= 2;
-    for(i = 0;i < len; i++) {
-        if (((uint32_t *)sector)[i] != 0)
-            return 1;
-    }
-    return 0;
-}
-
-static int is_allocated_sectors(const uint8_t *buf, int n, int *pnum)
-{
-    int v, i;
-
-    if (n <= 0) {
-        *pnum = 0;
-        return 0;
-    }
-    v = is_not_zero(buf, 512);
-    for(i = 1; i < n; i++) {
-        buf += 512;
-        if (v != is_not_zero(buf, 512))
-            break;
-    }
-    *pnum = i;
-    return v;
-}
-
-#define IO_BUF_SIZE 65536
-
-static int img_convert(int argc, char **argv)
-{
-    int c, ret, n, n1, compress, cluster_size, cluster_sectors, encrypt;
-    const char *filename, *fmt, *out_fmt, *out_filename;
-    BlockDriver *drv;
-    BlockDriverState *bs, *out_bs;
-    int64_t total_sectors, nb_sectors, sector_num;
-    uint8_t buf[IO_BUF_SIZE];
-    const uint8_t *buf1;
-
-    fmt = NULL;
-    out_fmt = "raw";
-    compress = 0;
-    encrypt = 0;
-    for(;;) {
-        c = getopt(argc, argv, "f:O:hce");
-        if (c == -1)
-            break;
-        switch(c) {
-        case 'h':
-            help();
-            break;
-        case 'f':
-            fmt = optarg;
-            break;
-        case 'O':
-            out_fmt = optarg;
-            break;
-        case 'c':
-            compress = 1;
-            break;
-        case 'e':
-            encrypt = 1;
-            break;
-        }
-    }
-    if (optind >= argc) 
-        help();
-    filename = argv[optind++];
-    if (optind >= argc) 
-        help();
-    out_filename = argv[optind++];
-    
-    bs = bdrv_new_open(filename, fmt);
-
-    drv = bdrv_find_format(out_fmt);
-    if (!drv)
-        error("Unknown file format '%s'", fmt);
-    if (compress && drv != &bdrv_qcow)
-        error("Compression not supported for this file format");
-    if (encrypt && drv != &bdrv_qcow)
-        error("Encryption not supported for this file format");
-    if (compress && encrypt)
-        error("Compression and encryption not supported at the same time");
-    bdrv_get_geometry(bs, &total_sectors);
-    ret = bdrv_create(drv, out_filename, total_sectors, NULL, encrypt);
-    if (ret < 0) {
-        if (ret == -ENOTSUP) {
-            error("Formatting not supported for file format '%s'", fmt);
-        } else {
-            error("Error while formatting '%s'", out_filename);
-        }
-    }
-    
-    out_bs = bdrv_new_open(out_filename, out_fmt);
-
-    if (compress) {
-        cluster_size = qcow_get_cluster_size(out_bs);
-        if (cluster_size <= 0 || cluster_size > IO_BUF_SIZE)
-            error("invalid cluster size");
-        cluster_sectors = cluster_size >> 9;
-        sector_num = 0;
-        for(;;) {
-            nb_sectors = total_sectors - sector_num;
-            if (nb_sectors <= 0)
-                break;
-            if (nb_sectors >= cluster_sectors)
-                n = cluster_sectors;
-            else
-                n = nb_sectors;
-            if (bdrv_read(bs, sector_num, buf, n) < 0) 
-                error("error while reading");
-            if (n < cluster_sectors)
-                memset(buf + n * 512, 0, cluster_size - n * 512);
-            if (is_not_zero(buf, cluster_size)) {
-                if (qcow_compress_cluster(out_bs, sector_num, buf) != 0)
-                    error("error while compressing sector %" PRId64,
-                          sector_num);
-            }
-            sector_num += n;
-        }
-    } else {
-        sector_num = 0;
-        for(;;) {
-            nb_sectors = total_sectors - sector_num;
-            if (nb_sectors <= 0)
-                break;
-            if (nb_sectors >= (IO_BUF_SIZE / 512))
-                n = (IO_BUF_SIZE / 512);
-            else
-                n = nb_sectors;
-            if (bdrv_read(bs, sector_num, buf, n) < 0) 
-                error("error while reading");
-            /* NOTE: at the same time we convert, we do not write zero
-               sectors to have a chance to compress the image. Ideally, we
-               should add a specific call to have the info to go faster */
-            buf1 = buf;
-            while (n > 0) {
-                if (is_allocated_sectors(buf1, n, &n1)) {
-                    if (bdrv_write(out_bs, sector_num, buf1, n1) < 0) 
-                        error("error while writing");
-                }
-                sector_num += n1;
-                n -= n1;
-                buf1 += n1 * 512;
-            }
-        }
-    }
-    bdrv_delete(out_bs);
-    bdrv_delete(bs);
-    return 0;
-}
-
-#ifdef _WIN32
-static int64_t get_allocated_file_size(const char *filename)
-{
-    typedef DWORD (WINAPI * get_compressed_t)(const char *filename, DWORD *high);
-    get_compressed_t get_compressed;
-    struct _stati64 st;
-
-    /* WinNT support GetCompressedFileSize to determine allocate size */
-    get_compressed = (get_compressed_t) GetProcAddress(GetModuleHandle("kernel32"), "GetCompressedFileSizeA");
-    if (get_compressed) {
-    	DWORD high, low;
-    	low = get_compressed(filename, &high);
-    	if (low != 0xFFFFFFFFlu || GetLastError() == NO_ERROR)
-	    return (((int64_t) high) << 32) + low;
-    }
-
-    if (_stati64(filename, &st) < 0) 
-        return -1;
-    return st.st_size;
-}
-#else
-static int64_t get_allocated_file_size(const char *filename)
-{
-    struct stat st;
-    if (stat(filename, &st) < 0) 
-        return -1;
-    return (int64_t)st.st_blocks * 512;
-}
-#endif
-
-static int img_info(int argc, char **argv)
-{
-    int c;
-    const char *filename, *fmt;
-    BlockDriver *drv;
-    BlockDriverState *bs;
-    char fmt_name[128], size_buf[128], dsize_buf[128];
-    int64_t total_sectors, allocated_size;
-
-    fmt = NULL;
-    for(;;) {
-        c = getopt(argc, argv, "f:h");
-        if (c == -1)
-            break;
-        switch(c) {
-        case 'h':
-            help();
-            break;
-        case 'f':
-            fmt = optarg;
-            break;
-        }
-    }
-    if (optind >= argc) 
-        help();
-    filename = argv[optind++];
-
-    bs = bdrv_new("");
-    if (!bs)
-        error("Not enough memory");
-    if (fmt) {
-        drv = bdrv_find_format(fmt);
-        if (!drv)
-            error("Unknown file format '%s'", fmt);
-    } else {
-        drv = NULL;
-    }
-    if (bdrv_open2(bs, filename, 0, drv) < 0) {
-        error("Could not open '%s'", filename);
-    }
-    bdrv_get_format(bs, fmt_name, sizeof(fmt_name));
-    bdrv_get_geometry(bs, &total_sectors);
-    get_human_readable_size(size_buf, sizeof(size_buf), total_sectors * 512);
-    allocated_size = get_allocated_file_size(filename);
-    if (allocated_size < 0)
-	sprintf(dsize_buf, "unavailable");
-    else
-        get_human_readable_size(dsize_buf, sizeof(dsize_buf), 
-                                allocated_size);
-    printf("image: %s\n"
-           "file format: %s\n"
-           "virtual size: %s (%" PRId64 " bytes)\n"
-           "disk size: %s\n",
-           filename, fmt_name, size_buf, 
-           (total_sectors * 512),
-           dsize_buf);
-    if (bdrv_is_encrypted(bs))
-        printf("encrypted: yes\n");
-    bdrv_delete(bs);
-    return 0;
-}
-
-int main(int argc, char **argv)
-{
-    const char *cmd;
-
-    bdrv_init();
-    if (argc < 2)
-        help();
-    cmd = argv[1];
-    optind++;
-    if (!strcmp(cmd, "create")) {
-        img_create(argc, argv);
-    } else if (!strcmp(cmd, "commit")) {
-        img_commit(argc, argv);
-    } else if (!strcmp(cmd, "convert")) {
-        img_convert(argc, argv);
-    } else if (!strcmp(cmd, "info")) {
-        img_info(argc, argv);
-    } else {
-        help();
-    }
-    return 0;
-}
diff --git a/qemu-img.texi b/qemu-img.texi
deleted file mode 100644
index ac7923f..0000000
--- a/qemu-img.texi
+++ /dev/null
@@ -1,126 +0,0 @@
-@example
-@c man begin SYNOPSIS
-usage: qemu-img command [command options]
-@c man end
-@end example
-
-@c man begin OPTIONS
-
-The following commands are supported:
-@table @option
-@item create [-e] [-b @var{base_image}] [-f @var{fmt}] @var{filename} [@var{size}]
-@item commit [-f @var{fmt}] @var{filename}
-@item convert [-c] [-e] [-f @var{fmt}] @var{filename} [-O @var{output_fmt}] @var{output_filename}
-@item info [-f @var{fmt}] @var{filename}
-@end table
-
-Command parameters:
-@table @var
-@item filename
- is a disk image filename
-@item base_image 
-is the read-only disk image which is used as base for a copy on
-    write image; the copy on write image only stores the modified data
-
-@item fmt 
-is the disk image format. It is guessed automatically in most cases. The following formats are supported:
-
-@table @code
-@item raw
-
-Raw disk image format (default). This format has the advantage of
-being simple and easily exportable to all other emulators. If your file
-system supports @emph{holes} (for example in ext2 or ext3 on Linux),
-then only the written sectors will reserve space. Use @code{qemu-img
-info} to know the real size used by the image or @code{ls -ls} on
-Unix/Linux.
-
-@item qcow
-QEMU image format, the most versatile format. Use it to have smaller
-images (useful if your filesystem does not supports holes, for example
-on Windows), optional AES encryption and zlib based compression.
-@item cow
-User Mode Linux Copy On Write image format. Used to be the only growable
-image format in QEMU. It is supported only for compatibility with
-previous versions. It does not work on win32.
-@item vmdk
-VMware 3 and 4 compatible image format.
-@item cloop
-Linux Compressed Loop image, useful only to reuse directly compressed
-CD-ROM images present for example in the Knoppix CD-ROMs.
-@end table
-
-@item size 
-is the disk image size in kilobytes. Optional suffixes @code{M}
-(megabyte) and @code{G} (gigabyte) are supported 
-
-@item output_filename
-is the destination disk image filename 
-
-@item output_fmt
- is the destination format
-
-@item -c
-indicates that target image must be compressed (qcow format only)
-@item -e 
-indicates that the target image must be encrypted (qcow format only)
-@end table
-
-Command description:
-
-@table @option
-@item create [-e] [-b @var{base_image}] [-f @var{fmt}] @var{filename} [@var{size}]
-
-Create the new disk image @var{filename} of size @var{size} and format
-@var{fmt}. 
-
-If @var{base_image} is specified, then the image will record only the
-differences from @var{base_image}. No size needs to be specified in
-this case. @var{base_image} will never be modified unless you use the
-@code{commit} monitor command.
-
-@item commit [-f @var{fmt}] @var{filename}
-
-Commit the changes recorded in @var{filename} in its base image.
-
-@item convert [-c] [-e] [-f @var{fmt}] @var{filename} [-O @var{output_fmt}] @var{output_filename}
-
-Convert the disk image @var{filename} to disk image @var{output_filename}
-using format @var{output_fmt}. It can be optionnaly encrypted
-(@code{-e} option) or compressed (@code{-c} option).
-
-Only the format @code{qcow} supports encryption or compression. The
-compression is read-only. It means that if a compressed sector is
-rewritten, then it is rewritten as uncompressed data.
-
-Encryption uses the AES format which is very secure (128 bit keys). Use
-a long password (16 characters) to get maximum protection.
-
-Image conversion is also useful to get smaller image when using a
-growable format such as @code{qcow} or @code{cow}: the empty sectors
-are detected and suppressed from the destination image.
-
-@item info [-f @var{fmt}] @var{filename}
-
-Give information about the disk image @var{filename}. Use it in
-particular to know the size reserved on disk which can be different
-from the displayed size.
-@end table
-
-@c man end
-
-@ignore
-
-@setfilename qemu-img
-@settitle QEMU disk image utility
-
-@c man begin SEEALSO
-The HTML documentation of QEMU for more precise information and Linux
-user mode emulator invocation.
-@c man end
-
-@c man begin AUTHOR
-Fabrice Bellard
-@c man end
-
-@end ignore
diff --git a/qemu-lock.h b/qemu-lock.h
new file mode 100644
index 0000000..fdd8da9
--- /dev/null
+++ b/qemu-lock.h
@@ -0,0 +1,249 @@
+/*
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* Locking primitives.  Most of this code should be redundant -
+   system emulation doesn't need/use locking, NPTL userspace uses
+   pthread mutexes, and non-NPTL userspace isn't threadsafe anyway.
+   In either case a spinlock is probably the wrong kind of lock.
+   Spinlocks are only good if you know annother CPU has the lock and is
+   likely to release it soon.  In environments where you have more threads
+   than physical CPUs (the extreme case being a single CPU host) a spinlock
+   simply wastes CPU until the OS decides to preempt it.  */
+#if defined(USE_NPTL)
+
+#include <pthread.h>
+#define spin_lock pthread_mutex_lock
+#define spin_unlock pthread_mutex_unlock
+#define spinlock_t pthread_mutex_t
+#define SPIN_LOCK_UNLOCKED PTHREAD_MUTEX_INITIALIZER
+
+#else
+
+#if defined(__hppa__)
+
+typedef int spinlock_t[4];
+
+#define SPIN_LOCK_UNLOCKED { 1, 1, 1, 1 }
+
+static inline void resetlock (spinlock_t *p)
+{
+    (*p)[0] = (*p)[1] = (*p)[2] = (*p)[3] = 1;
+}
+
+#else
+
+typedef int spinlock_t;
+
+#define SPIN_LOCK_UNLOCKED 0
+
+static inline void resetlock (spinlock_t *p)
+{
+    *p = SPIN_LOCK_UNLOCKED;
+}
+
+#endif
+
+#if defined(__powerpc__)
+static inline int testandset (int *p)
+{
+    int ret;
+    __asm__ __volatile__ (
+                          "0:    lwarx %0,0,%1\n"
+                          "      xor. %0,%3,%0\n"
+                          "      bne 1f\n"
+                          "      stwcx. %2,0,%1\n"
+                          "      bne- 0b\n"
+                          "1:    "
+                          : "=&r" (ret)
+                          : "r" (p), "r" (1), "r" (0)
+                          : "cr0", "memory");
+    return ret;
+}
+#elif defined(__i386__)
+static inline int testandset (int *p)
+{
+    long int readval = 0;
+
+    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
+                          : "+m" (*p), "+a" (readval)
+                          : "r" (1)
+                          : "cc");
+    return readval;
+}
+#elif defined(__x86_64__)
+static inline int testandset (int *p)
+{
+    long int readval = 0;
+
+    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
+                          : "+m" (*p), "+a" (readval)
+                          : "r" (1)
+                          : "cc");
+    return readval;
+}
+#elif defined(__s390__)
+static inline int testandset (int *p)
+{
+    int ret;
+
+    __asm__ __volatile__ ("0: cs    %0,%1,0(%2)\n"
+			  "   jl    0b"
+			  : "=&d" (ret)
+			  : "r" (1), "a" (p), "0" (*p)
+			  : "cc", "memory" );
+    return ret;
+}
+#elif defined(__alpha__)
+static inline int testandset (int *p)
+{
+    int ret;
+    unsigned long one;
+
+    __asm__ __volatile__ ("0:	mov 1,%2\n"
+			  "	ldl_l %0,%1\n"
+			  "	stl_c %2,%1\n"
+			  "	beq %2,1f\n"
+			  ".subsection 2\n"
+			  "1:	br 0b\n"
+			  ".previous"
+			  : "=r" (ret), "=m" (*p), "=r" (one)
+			  : "m" (*p));
+    return ret;
+}
+#elif defined(__sparc__)
+static inline int testandset (int *p)
+{
+	int ret;
+
+	__asm__ __volatile__("ldstub	[%1], %0"
+			     : "=r" (ret)
+			     : "r" (p)
+			     : "memory");
+
+	return (ret ? 1 : 0);
+}
+#elif defined(__arm__)
+static inline int testandset (int *spinlock)
+{
+    register unsigned int ret;
+    __asm__ __volatile__("swp %0, %1, [%2]"
+                         : "=r"(ret)
+                         : "0"(1), "r"(spinlock));
+
+    return ret;
+}
+#elif defined(__mc68000)
+static inline int testandset (int *p)
+{
+    char ret;
+    __asm__ __volatile__("tas %1; sne %0"
+                         : "=r" (ret)
+                         : "m" (p)
+                         : "cc","memory");
+    return ret;
+}
+#elif defined(__hppa__)
+
+/* Because malloc only guarantees 8-byte alignment for malloc'd data,
+   and GCC only guarantees 8-byte alignment for stack locals, we can't
+   be assured of 16-byte alignment for atomic lock data even if we
+   specify "__attribute ((aligned(16)))" in the type declaration.  So,
+   we use a struct containing an array of four ints for the atomic lock
+   type and dynamically select the 16-byte aligned int from the array
+   for the semaphore.  */
+#define __PA_LDCW_ALIGNMENT 16
+static inline void *ldcw_align (void *p) {
+    unsigned long a = (unsigned long)p;
+    a = (a + __PA_LDCW_ALIGNMENT - 1) & ~(__PA_LDCW_ALIGNMENT - 1);
+    return (void *)a;
+}
+
+static inline int testandset (spinlock_t *p)
+{
+    unsigned int ret;
+    p = ldcw_align(p);
+    __asm__ __volatile__("ldcw 0(%1),%0"
+                         : "=r" (ret)
+                         : "r" (p)
+                         : "memory" );
+    return !ret;
+}
+
+#elif defined(__ia64)
+
+#include <ia64intrin.h>
+
+static inline int testandset (int *p)
+{
+    return __sync_lock_test_and_set (p, 1);
+}
+#elif defined(__mips__)
+static inline int testandset (int *p)
+{
+    int ret;
+
+    __asm__ __volatile__ (
+	"	.set push		\n"
+	"	.set noat		\n"
+	"	.set mips2		\n"
+	"1:	li	$1, 1		\n"
+	"	ll	%0, %1		\n"
+	"	sc	$1, %1		\n"
+	"	beqz	$1, 1b		\n"
+	"	.set pop		"
+	: "=r" (ret), "+R" (*p)
+	:
+	: "memory");
+
+    return ret;
+}
+#else
+#error unimplemented CPU support
+#endif
+
+#if defined(CONFIG_USER_ONLY)
+static inline void spin_lock(spinlock_t *lock)
+{
+    while (testandset(lock));
+}
+
+static inline void spin_unlock(spinlock_t *lock)
+{
+    resetlock(lock);
+}
+
+static inline int spin_trylock(spinlock_t *lock)
+{
+    return !testandset(lock);
+}
+#else
+static inline void spin_lock(spinlock_t *lock)
+{
+}
+
+static inline void spin_unlock(spinlock_t *lock)
+{
+}
+
+static inline int spin_trylock(spinlock_t *lock)
+{
+    return 1;
+}
+#endif
+
+#endif
diff --git a/qemu-log.h b/qemu-log.h
new file mode 100644
index 0000000..1ebea81
--- /dev/null
+++ b/qemu-log.h
@@ -0,0 +1,7 @@
+#ifndef QEMU_LOG_H
+#define QEMU_LOG_H
+
+extern FILE *logfile;
+extern int loglevel;
+
+#endif
diff --git a/qemu-tech.texi b/qemu-tech.texi
deleted file mode 100644
index 77bda86..0000000
--- a/qemu-tech.texi
+++ /dev/null
@@ -1,595 +0,0 @@
-\input texinfo @c -*- texinfo -*-
-@c %**start of header
-@setfilename qemu-tech.info
-@settitle QEMU Internals
-@exampleindent 0
-@paragraphindent 0
-@c %**end of header
-
-@iftex
-@titlepage
-@sp 7
-@center @titlefont{QEMU Internals}
-@sp 3
-@end titlepage
-@end iftex
-
-@ifnottex
-@node Top
-@top
-
-@menu
-* Introduction::
-* QEMU Internals::
-* Regression Tests::
-* Index::
-@end menu
-@end ifnottex
-
-@contents
-
-@node Introduction
-@chapter Introduction
-
-@menu
-* intro_features::        Features
-* intro_x86_emulation::   x86 emulation
-* intro_arm_emulation::   ARM emulation
-* intro_ppc_emulation::   PowerPC emulation
-* intro_sparc_emulation:: SPARC emulation
-@end menu
-
-@node intro_features
-@section Features
-
-QEMU is a FAST! processor emulator using a portable dynamic
-translator.
-
-QEMU has two operating modes:
-
-@itemize @minus
-
-@item 
-Full system emulation. In this mode, QEMU emulates a full system
-(usually a PC), including a processor and various peripherals. It can
-be used to launch an different Operating System without rebooting the
-PC or to debug system code.
-
-@item 
-User mode emulation (Linux host only). In this mode, QEMU can launch
-Linux processes compiled for one CPU on another CPU. It can be used to
-launch the Wine Windows API emulator (@url{http://www.winehq.org}) or
-to ease cross-compilation and cross-debugging.
-
-@end itemize
-
-As QEMU requires no host kernel driver to run, it is very safe and
-easy to use.
-
-QEMU generic features:
-
-@itemize 
-
-@item User space only or full system emulation.
-
-@item Using dynamic translation to native code for reasonable speed.
-
-@item Working on x86 and PowerPC hosts. Being tested on ARM, Sparc32, Alpha and S390.
-
-@item Self-modifying code support.
-
-@item Precise exceptions support.
-
-@item The virtual CPU is a library (@code{libqemu}) which can be used 
-in other projects (look at @file{qemu/tests/qruncom.c} to have an
-example of user mode @code{libqemu} usage).
-
-@end itemize
-
-QEMU user mode emulation features:
-@itemize 
-@item Generic Linux system call converter, including most ioctls.
-
-@item clone() emulation using native CPU clone() to use Linux scheduler for threads.
-
-@item Accurate signal handling by remapping host signals to target signals. 
-@end itemize
-
-QEMU full system emulation features:
-@itemize 
-@item QEMU can either use a full software MMU for maximum portability or use the host system call mmap() to simulate the target MMU.
-@end itemize
-
-@node intro_x86_emulation
-@section x86 emulation
-
-QEMU x86 target features:
-
-@itemize 
-
-@item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation. 
-LDT/GDT and IDT are emulated. VM86 mode is also supported to run DOSEMU.
-
-@item Support of host page sizes bigger than 4KB in user mode emulation.
-
-@item QEMU can emulate itself on x86.
-
-@item An extensive Linux x86 CPU test program is included @file{tests/test-i386}. 
-It can be used to test other x86 virtual CPUs.
-
-@end itemize
-
-Current QEMU limitations:
-
-@itemize 
-
-@item No SSE/MMX support (yet).
-
-@item No x86-64 support.
-
-@item IPC syscalls are missing.
-
-@item The x86 segment limits and access rights are not tested at every 
-memory access (yet). Hopefully, very few OSes seem to rely on that for
-normal use.
-
-@item On non x86 host CPUs, @code{double}s are used instead of the non standard 
-10 byte @code{long double}s of x86 for floating point emulation to get
-maximum performances.
-
-@end itemize
-
-@node intro_arm_emulation
-@section ARM emulation
-
-@itemize
-
-@item Full ARM 7 user emulation.
-
-@item NWFPE FPU support included in user Linux emulation.
-
-@item Can run most ARM Linux binaries.
-
-@end itemize
-
-@node intro_ppc_emulation
-@section PowerPC emulation
-
-@itemize
-
-@item Full PowerPC 32 bit emulation, including privileged instructions, 
-FPU and MMU.
-
-@item Can run most PowerPC Linux binaries.
-
-@end itemize
-
-@node intro_sparc_emulation
-@section SPARC emulation
-
-@itemize
-
-@item Somewhat complete SPARC V8 emulation, including privileged
-instructions, FPU and MMU. SPARC V9 emulation includes most privileged
-instructions, FPU and I/D MMU, but misses VIS instructions.
-
-@item Can run some 32-bit SPARC Linux binaries.
-
-@end itemize
-
-Current QEMU limitations:
-
-@itemize 
-
-@item Tagged add/subtract instructions are not supported, but they are
-probably not used.
-
-@item IPC syscalls are missing.
-
-@item 128-bit floating point operations are not supported, though none of the
-real CPUs implement them either. FCMPE[SD] are not correctly
-implemented.  Floating point exception support is untested.
-
-@item Alignment is not enforced at all.
-
-@item Atomic instructions are not correctly implemented.
-
-@item Sparc64 emulators are not usable for anything yet.
-
-@end itemize
-
-@node QEMU Internals
-@chapter QEMU Internals
-
-@menu
-* QEMU compared to other emulators::
-* Portable dynamic translation::
-* Register allocation::
-* Condition code optimisations::
-* CPU state optimisations::
-* Translation cache::
-* Direct block chaining::
-* Self-modifying code and translated code invalidation::
-* Exception support::
-* MMU emulation::
-* Hardware interrupts::
-* User emulation specific details::
-* Bibliography::
-@end menu
-
-@node QEMU compared to other emulators
-@section QEMU compared to other emulators
-
-Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than
-bochs as it uses dynamic compilation. Bochs is closely tied to x86 PC
-emulation while QEMU can emulate several processors.
-
-Like Valgrind [2], QEMU does user space emulation and dynamic
-translation. Valgrind is mainly a memory debugger while QEMU has no
-support for it (QEMU could be used to detect out of bound memory
-accesses as Valgrind, but it has no support to track uninitialised data
-as Valgrind does). The Valgrind dynamic translator generates better code
-than QEMU (in particular it does register allocation) but it is closely
-tied to an x86 host and target and has no support for precise exceptions
-and system emulation.
-
-EM86 [4] is the closest project to user space QEMU (and QEMU still uses
-some of its code, in particular the ELF file loader). EM86 was limited
-to an alpha host and used a proprietary and slow interpreter (the
-interpreter part of the FX!32 Digital Win32 code translator [5]).
-
-TWIN [6] is a Windows API emulator like Wine. It is less accurate than
-Wine but includes a protected mode x86 interpreter to launch x86 Windows
-executables. Such an approach has greater potential because most of the
-Windows API is executed natively but it is far more difficult to develop
-because all the data structures and function parameters exchanged
-between the API and the x86 code must be converted.
-
-User mode Linux [7] was the only solution before QEMU to launch a
-Linux kernel as a process while not needing any host kernel
-patches. However, user mode Linux requires heavy kernel patches while
-QEMU accepts unpatched Linux kernels. The price to pay is that QEMU is
-slower.
-
-The new Plex86 [8] PC virtualizer is done in the same spirit as the
-qemu-fast system emulator. It requires a patched Linux kernel to work
-(you cannot launch the same kernel on your PC), but the patches are
-really small. As it is a PC virtualizer (no emulation is done except
-for some priveledged instructions), it has the potential of being
-faster than QEMU. The downside is that a complicated (and potentially
-unsafe) host kernel patch is needed.
-
-The commercial PC Virtualizers (VMWare [9], VirtualPC [10], TwoOStwo
-[11]) are faster than QEMU, but they all need specific, proprietary
-and potentially unsafe host drivers. Moreover, they are unable to
-provide cycle exact simulation as an emulator can.
-
-@node Portable dynamic translation
-@section Portable dynamic translation
-
-QEMU is a dynamic translator. When it first encounters a piece of code,
-it converts it to the host instruction set. Usually dynamic translators
-are very complicated and highly CPU dependent. QEMU uses some tricks
-which make it relatively easily portable and simple while achieving good
-performances.
-
-The basic idea is to split every x86 instruction into fewer simpler
-instructions. Each simple instruction is implemented by a piece of C
-code (see @file{target-i386/op.c}). Then a compile time tool
-(@file{dyngen}) takes the corresponding object file (@file{op.o})
-to generate a dynamic code generator which concatenates the simple
-instructions to build a function (see @file{op.h:dyngen_code()}).
-
-In essence, the process is similar to [1], but more work is done at
-compile time. 
-
-A key idea to get optimal performances is that constant parameters can
-be passed to the simple operations. For that purpose, dummy ELF
-relocations are generated with gcc for each constant parameter. Then,
-the tool (@file{dyngen}) can locate the relocations and generate the
-appriopriate C code to resolve them when building the dynamic code.
-
-That way, QEMU is no more difficult to port than a dynamic linker.
-
-To go even faster, GCC static register variables are used to keep the
-state of the virtual CPU.
-
-@node Register allocation
-@section Register allocation
-
-Since QEMU uses fixed simple instructions, no efficient register
-allocation can be done. However, because RISC CPUs have a lot of
-register, most of the virtual CPU state can be put in registers without
-doing complicated register allocation.
-
-@node Condition code optimisations
-@section Condition code optimisations
-
-Good CPU condition codes emulation (@code{EFLAGS} register on x86) is a
-critical point to get good performances. QEMU uses lazy condition code
-evaluation: instead of computing the condition codes after each x86
-instruction, it just stores one operand (called @code{CC_SRC}), the
-result (called @code{CC_DST}) and the type of operation (called
-@code{CC_OP}).
-
-@code{CC_OP} is almost never explicitely set in the generated code
-because it is known at translation time.
-
-In order to increase performances, a backward pass is performed on the
-generated simple instructions (see
-@code{target-i386/translate.c:optimize_flags()}). When it can be proved that
-the condition codes are not needed by the next instructions, no
-condition codes are computed at all.
-
-@node CPU state optimisations
-@section CPU state optimisations
-
-The x86 CPU has many internal states which change the way it evaluates
-instructions. In order to achieve a good speed, the translation phase
-considers that some state information of the virtual x86 CPU cannot
-change in it. For example, if the SS, DS and ES segments have a zero
-base, then the translator does not even generate an addition for the
-segment base.
-
-[The FPU stack pointer register is not handled that way yet].
-
-@node Translation cache
-@section Translation cache
-
-A 16 MByte cache holds the most recently used translations. For
-simplicity, it is completely flushed when it is full. A translation unit
-contains just a single basic block (a block of x86 instructions
-terminated by a jump or by a virtual CPU state change which the
-translator cannot deduce statically).
-
-@node Direct block chaining
-@section Direct block chaining
-
-After each translated basic block is executed, QEMU uses the simulated
-Program Counter (PC) and other cpu state informations (such as the CS
-segment base value) to find the next basic block.
-
-In order to accelerate the most common cases where the new simulated PC
-is known, QEMU can patch a basic block so that it jumps directly to the
-next one.
-
-The most portable code uses an indirect jump. An indirect jump makes
-it easier to make the jump target modification atomic. On some host
-architectures (such as x86 or PowerPC), the @code{JUMP} opcode is
-directly patched so that the block chaining has no overhead.
-
-@node Self-modifying code and translated code invalidation
-@section Self-modifying code and translated code invalidation
-
-Self-modifying code is a special challenge in x86 emulation because no
-instruction cache invalidation is signaled by the application when code
-is modified.
-
-When translated code is generated for a basic block, the corresponding
-host page is write protected if it is not already read-only (with the
-system call @code{mprotect()}). Then, if a write access is done to the
-page, Linux raises a SEGV signal. QEMU then invalidates all the
-translated code in the page and enables write accesses to the page.
-
-Correct translated code invalidation is done efficiently by maintaining
-a linked list of every translated block contained in a given page. Other
-linked lists are also maintained to undo direct block chaining. 
-
-Although the overhead of doing @code{mprotect()} calls is important,
-most MSDOS programs can be emulated at reasonnable speed with QEMU and
-DOSEMU.
-
-Note that QEMU also invalidates pages of translated code when it detects
-that memory mappings are modified with @code{mmap()} or @code{munmap()}.
-
-When using a software MMU, the code invalidation is more efficient: if
-a given code page is invalidated too often because of write accesses,
-then a bitmap representing all the code inside the page is
-built. Every store into that page checks the bitmap to see if the code
-really needs to be invalidated. It avoids invalidating the code when
-only data is modified in the page.
-
-@node Exception support
-@section Exception support
-
-longjmp() is used when an exception such as division by zero is
-encountered. 
-
-The host SIGSEGV and SIGBUS signal handlers are used to get invalid
-memory accesses. The exact CPU state can be retrieved because all the
-x86 registers are stored in fixed host registers. The simulated program
-counter is found by retranslating the corresponding basic block and by
-looking where the host program counter was at the exception point.
-
-The virtual CPU cannot retrieve the exact @code{EFLAGS} register because
-in some cases it is not computed because of condition code
-optimisations. It is not a big concern because the emulated code can
-still be restarted in any cases.
-
-@node MMU emulation
-@section MMU emulation
-
-For system emulation, QEMU uses the mmap() system call to emulate the
-target CPU MMU. It works as long the emulated OS does not use an area
-reserved by the host OS (such as the area above 0xc0000000 on x86
-Linux).
-
-In order to be able to launch any OS, QEMU also supports a soft
-MMU. In that mode, the MMU virtual to physical address translation is
-done at every memory access. QEMU uses an address translation cache to
-speed up the translation.
-
-In order to avoid flushing the translated code each time the MMU
-mappings change, QEMU uses a physically indexed translation cache. It
-means that each basic block is indexed with its physical address. 
-
-When MMU mappings change, only the chaining of the basic blocks is
-reset (i.e. a basic block can no longer jump directly to another one).
-
-@node Hardware interrupts
-@section Hardware interrupts
-
-In order to be faster, QEMU does not check at every basic block if an
-hardware interrupt is pending. Instead, the user must asynchrously
-call a specific function to tell that an interrupt is pending. This
-function resets the chaining of the currently executing basic
-block. It ensures that the execution will return soon in the main loop
-of the CPU emulator. Then the main loop can test if the interrupt is
-pending and handle it.
-
-@node User emulation specific details
-@section User emulation specific details
-
-@subsection Linux system call translation
-
-QEMU includes a generic system call translator for Linux. It means that
-the parameters of the system calls can be converted to fix the
-endianness and 32/64 bit issues. The IOCTLs are converted with a generic
-type description system (see @file{ioctls.h} and @file{thunk.c}).
-
-QEMU supports host CPUs which have pages bigger than 4KB. It records all
-the mappings the process does and try to emulated the @code{mmap()}
-system calls in cases where the host @code{mmap()} call would fail
-because of bad page alignment.
-
-@subsection Linux signals
-
-Normal and real-time signals are queued along with their information
-(@code{siginfo_t}) as it is done in the Linux kernel. Then an interrupt
-request is done to the virtual CPU. When it is interrupted, one queued
-signal is handled by generating a stack frame in the virtual CPU as the
-Linux kernel does. The @code{sigreturn()} system call is emulated to return
-from the virtual signal handler.
-
-Some signals (such as SIGALRM) directly come from the host. Other
-signals are synthetized from the virtual CPU exceptions such as SIGFPE
-when a division by zero is done (see @code{main.c:cpu_loop()}).
-
-The blocked signal mask is still handled by the host Linux kernel so
-that most signal system calls can be redirected directly to the host
-Linux kernel. Only the @code{sigaction()} and @code{sigreturn()} system
-calls need to be fully emulated (see @file{signal.c}).
-
-@subsection clone() system call and threads
-
-The Linux clone() system call is usually used to create a thread. QEMU
-uses the host clone() system call so that real host threads are created
-for each emulated thread. One virtual CPU instance is created for each
-thread.
-
-The virtual x86 CPU atomic operations are emulated with a global lock so
-that their semantic is preserved.
-
-Note that currently there are still some locking issues in QEMU. In
-particular, the translated cache flush is not protected yet against
-reentrancy.
-
-@subsection Self-virtualization
-
-QEMU was conceived so that ultimately it can emulate itself. Although
-it is not very useful, it is an important test to show the power of the
-emulator.
-
-Achieving self-virtualization is not easy because there may be address
-space conflicts. QEMU solves this problem by being an executable ELF
-shared object as the ld-linux.so ELF interpreter. That way, it can be
-relocated at load time.
-
-@node Bibliography
-@section Bibliography
-
-@table @asis
-
-@item [1] 
-@url{http://citeseer.nj.nec.com/piumarta98optimizing.html}, Optimizing
-direct threaded code by selective inlining (1998) by Ian Piumarta, Fabio
-Riccardi.
-
-@item [2]
-@url{http://developer.kde.org/~sewardj/}, Valgrind, an open-source
-memory debugger for x86-GNU/Linux, by Julian Seward.
-
-@item [3]
-@url{http://bochs.sourceforge.net/}, the Bochs IA-32 Emulator Project,
-by Kevin Lawton et al.
-
-@item [4]
-@url{http://www.cs.rose-hulman.edu/~donaldlf/em86/index.html}, the EM86
-x86 emulator on Alpha-Linux.
-
-@item [5]
-@url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/@/full_papers/chernoff/chernoff.pdf},
-DIGITAL FX!32: Running 32-Bit x86 Applications on Alpha NT, by Anton
-Chernoff and Ray Hookway.
-
-@item [6]
-@url{http://www.willows.com/}, Windows API library emulation from
-Willows Software.
-
-@item [7]
-@url{http://user-mode-linux.sourceforge.net/}, 
-The User-mode Linux Kernel.
-
-@item [8]
-@url{http://www.plex86.org/}, 
-The new Plex86 project.
-
-@item [9]
-@url{http://www.vmware.com/}, 
-The VMWare PC virtualizer.
-
-@item [10]
-@url{http://www.microsoft.com/windowsxp/virtualpc/}, 
-The VirtualPC PC virtualizer.
-
-@item [11]
-@url{http://www.twoostwo.org/}, 
-The TwoOStwo PC virtualizer.
-
-@end table
-
-@node Regression Tests
-@chapter Regression Tests
-
-In the directory @file{tests/}, various interesting testing programs
-are available. There are used for regression testing.
-
-@menu
-* test-i386::
-* linux-test::
-* qruncom.c::
-@end menu
-
-@node test-i386
-@section @file{test-i386}
-
-This program executes most of the 16 bit and 32 bit x86 instructions and
-generates a text output. It can be compared with the output obtained with
-a real CPU or another emulator. The target @code{make test} runs this
-program and a @code{diff} on the generated output.
-
-The Linux system call @code{modify_ldt()} is used to create x86 selectors
-to test some 16 bit addressing and 32 bit with segmentation cases.
-
-The Linux system call @code{vm86()} is used to test vm86 emulation.
-
-Various exceptions are raised to test most of the x86 user space
-exception reporting.
-
-@node linux-test
-@section @file{linux-test}
-
-This program tests various Linux system calls. It is used to verify
-that the system call parameters are correctly converted between target
-and host CPUs.
-
-@node qruncom.c
-@section @file{qruncom.c}
-
-Example of usage of @code{libqemu} to emulate a user mode i386 CPU.
-
-@node Index
-@chapter Index
-@printindex cp
-
-@bye
diff --git a/qemu-timer.h b/qemu-timer.h
new file mode 100644
index 0000000..8264f3e
--- /dev/null
+++ b/qemu-timer.h
@@ -0,0 +1,50 @@
+#ifndef QEMU_TIMER_H
+#define QEMU_TIMER_H
+
+#include "qemu-common.h"
+
+/* timers */
+
+typedef struct QEMUClock QEMUClock;
+typedef void QEMUTimerCB(void *opaque);
+
+/* The real time clock should be used only for stuff which does not
+   change the virtual machine state, as it is run even if the virtual
+   machine is stopped. The real time clock has a frequency of 1000
+   Hz. */
+extern QEMUClock *rt_clock;
+
+/* The virtual clock is only run during the emulation. It is stopped
+   when the virtual machine is stopped. Virtual timers use a high
+   precision clock, usually cpu cycles (use ticks_per_sec). */
+extern QEMUClock *vm_clock;
+
+int64_t qemu_get_clock(QEMUClock *clock);
+
+QEMUTimer *qemu_new_timer(QEMUClock *clock, QEMUTimerCB *cb, void *opaque);
+void qemu_free_timer(QEMUTimer *ts);
+void qemu_del_timer(QEMUTimer *ts);
+void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time);
+int qemu_timer_pending(QEMUTimer *ts);
+
+extern int64_t ticks_per_sec;
+
+void qemu_get_timer(QEMUFile *f, QEMUTimer *ts);
+void qemu_put_timer(QEMUFile *f, QEMUTimer *ts);
+
+/* ptimer.c */
+typedef struct ptimer_state ptimer_state;
+typedef void (*ptimer_cb)(void *opaque);
+
+ptimer_state *ptimer_init(QEMUBH *bh);
+void ptimer_set_period(ptimer_state *s, int64_t period);
+void ptimer_set_freq(ptimer_state *s, uint32_t freq);
+void ptimer_set_limit(ptimer_state *s, uint64_t limit, int reload);
+uint64_t ptimer_get_count(ptimer_state *s);
+void ptimer_set_count(ptimer_state *s, uint64_t count);
+void ptimer_run(ptimer_state *s, int oneshot);
+void ptimer_stop(ptimer_state *s);
+void qemu_put_ptimer(QEMUFile *f, ptimer_state *s);
+void qemu_get_ptimer(QEMUFile *f, ptimer_state *s);
+
+#endif
diff --git a/qemu_debug.h b/qemu_debug.h
new file mode 100644
index 0000000..809a157
--- /dev/null
+++ b/qemu_debug.h
@@ -0,0 +1,5 @@
+/* this is a transitional header. It should only be included
+ * by non-specific source files. Later, a non-Android specific
+ * implementation will be hooked in
+ */
+#include "android/utils/debug.h"
diff --git a/qemu_file.h b/qemu_file.h
index 2172390..682e092 100644
--- a/qemu_file.h
+++ b/qemu_file.h
@@ -1,76 +1,7 @@
 #ifndef _QEMU_FILE_H
 #define _QEMU_FILE_H
 
-#include <stddef.h>
-
-typedef FILE QEMUFile;
-
-void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, int size);
-void qemu_put_byte(QEMUFile *f, int v);
-void qemu_put_be16(QEMUFile *f, unsigned int v);
-void qemu_put_be32(QEMUFile *f, unsigned int v);
-void qemu_put_be64(QEMUFile *f, uint64_t v);
-
-int qemu_get_buffer(QEMUFile *f, uint8_t *buf, int size);
-int qemu_get_byte(QEMUFile *f);
-unsigned int qemu_get_be16(QEMUFile *f);
-unsigned int qemu_get_be32(QEMUFile *f);
-uint64_t qemu_get_be64(QEMUFile *f);
-
-static inline void qemu_put_be64s(QEMUFile *f, const uint64_t *pv)
-{
-    qemu_put_be64(f, *pv);
-}
-
-static inline void qemu_put_be32s(QEMUFile *f, const uint32_t *pv)
-{
-    qemu_put_be32(f, *pv);
-}
-
-static inline void qemu_put_be16s(QEMUFile *f, const uint16_t *pv)
-{
-    qemu_put_be16(f, *pv);
-}
-
-static inline void qemu_put_8s(QEMUFile *f, const uint8_t *pv)
-{
-    qemu_put_byte(f, *pv);
-}
-
-static inline void qemu_get_be64s(QEMUFile *f, uint64_t *pv)
-{
-    *pv = qemu_get_be64(f);
-}
-
-static inline void qemu_get_be32s(QEMUFile *f, uint32_t *pv)
-{
-    *pv = qemu_get_be32(f);
-}
-
-static inline void qemu_get_be16s(QEMUFile *f, uint16_t *pv)
-{
-    *pv = qemu_get_be16(f);
-}
-
-static inline void qemu_get_8s(QEMUFile *f, uint8_t *pv)
-{
-    *pv = qemu_get_byte(f);
-}
-
-#if TARGET_LONG_BITS == 64
-#define qemu_put_betl qemu_put_be64
-#define qemu_get_betl qemu_get_be64
-#define qemu_put_betls qemu_put_be64s
-#define qemu_get_betls qemu_get_be64s
-#else
-#define qemu_put_betl qemu_put_be32
-#define qemu_get_betl qemu_get_be32
-#define qemu_put_betls qemu_put_be32s
-#define qemu_get_betls qemu_get_be32s
-#endif
-
-int64_t qemu_ftell(QEMUFile *f);
-int64_t qemu_fseek(QEMUFile *f, int64_t pos, int whence);
+#include "hw/hw.h"
 
 typedef enum {
     Q_FIELD_END,          /* mark end of field list */
diff --git a/qemu_socket.h b/qemu_socket.h
new file mode 100644
index 0000000..896a0b5
--- /dev/null
+++ b/qemu_socket.h
@@ -0,0 +1,8 @@
+#ifndef _qemu_socket_h
+#define _qemu_socket_h
+
+#include "sockets.h"
+#define  socket_error()  socket_errno
+#define  closesocket     socket_close
+
+#endif /* _qemu_socket_h */
diff --git a/qemu_timers.c b/qemu_timers.c
deleted file mode 100644
index 2dc0806..0000000
--- a/qemu_timers.c
+++ /dev/null
@@ -1,1103 +0,0 @@
-#include "vl.h"
-
-#include <sys/time.h>
-#include <time.h>
-#include "android_utils.h"
-#include "android.h"
-
-#include <signal.h>
-
-#define  D(...)  VERBOSE_PRINT(init,__VA_ARGS__)
-
-
-#ifdef _WIN32
-#include <sys/timeb.h>
-#else
-#include <sys/ioctl.h>
-#endif
-
-#ifdef __linux__
-#include <linux/rtc.h>
-#include "hpet.h"
-#endif
-
-#define TFR(expr) do { if ((expr) != -1) break; } while (errno == EINTR)
-
-QEMUClock *rt_clock;
-QEMUClock *vm_clock;
-
-/***********************************************************/
-/* real time host monotonic timer */
-
-/* digit: the following two variables are used to implement high-resolution
- * poll-based interrupts. the idea is to be able to generate an emulated
- * interrupt every millisecond, even on non-Linux platforms which don't have
- * a /dev/rtc
- */
-static int64_t  milli_last_ns;
-static int64_t  milli_next_ns;
-
-/* digit: the following global boolean is set when we need to perform
- * high-resolution polling. If not, we'll use host interrupts instead
- */
-int  qemu_milli_needed = 0;
-
-#ifdef WIN32
-
-static int64_t clock_freq;
-
-static void init_get_clock(void)
-{
-    LARGE_INTEGER freq;
-    int ret;
-    ret = QueryPerformanceFrequency(&freq);
-    if (ret == 0) {
-        fprintf(stderr, "Could not calibrate ticks\n");
-        exit(1);
-    }
-    clock_freq = freq.QuadPart;
-
-    {
-        LARGE_INTEGER  ti;
-        QueryPerformanceCounter(&ti);
-        milli_last_ns = muldiv64(ti.QuadPart,QEMU_TIMER_BASE,clock_freq);
-        milli_next_ns = milli_last_ns + 1000000;
-    }
-}
-
-static int64_t get_clock(void)
-{
-    LARGE_INTEGER ti;
-    QueryPerformanceCounter(&ti);
-    return muldiv64(ti.QuadPart, QEMU_TIMER_BASE, clock_freq);
-}
-
-
-
-#elif defined(__APPLE__)
-
-#include <mach/mach_time.h>
-
-static mach_timebase_info_data_t   _mach_timebase_info;
-static int64_t                     _mach_timebase;
-
-static int64_t get_clock(void)
-{
-    int64_t   elapsed    = mach_absolute_time() - _mach_timebase;
-    int64_t   numer      = _mach_timebase_info.numer;
-    int64_t   denom      = _mach_timebase_info.denom;
-
-    /* return elapsed time in nanoseconds */
-    return elapsed * numer / denom;
-}
-
-static void init_get_clock(void)
-{
-    mach_timebase_info( &_mach_timebase_info );
-    _mach_timebase = mach_absolute_time();
-
-    milli_last_ns = get_clock();
-    milli_next_ns = milli_last_ns + 1000000;
-}
-
-
-#else
-
-static int use_rt_clock;
-
-static int64_t get_clock(void)
-{
-#if defined(__linux__)
-    if (use_rt_clock) {
-        struct timespec ts;
-        clock_gettime(CLOCK_MONOTONIC, &ts);
-        return ts.tv_sec * 1000000000LL + ts.tv_nsec;
-    } else
-#endif
-    {
-        /* XXX: using gettimeofday leads to problems if the date
-           changes, so it should be avoided. */
-        struct timeval tv;
-        gettimeofday(&tv, NULL);
-        return tv.tv_sec * 1000000000LL + (tv.tv_usec * 1000);
-    }
-}
-
-static void init_get_clock(void)
-{
-    use_rt_clock = 0;
-#if defined(__linux__)
-    {
-        struct timespec ts;
-        if (clock_gettime(CLOCK_MONOTONIC, &ts) == 0) {
-            use_rt_clock = 1;
-        }
-    }
-#endif
-    milli_last_ns = get_clock();
-    milli_next_ns = milli_last_ns + 1000000;
-}
-
-
-#endif
-
-int64_t  qemu_get_elapsed_ns(void)
-{
-    return get_clock();
-}
-
-void  qemu_polling_enable( void )
-{
-    if (++qemu_milli_needed == 1) {
-      milli_last_ns = get_clock();
-      milli_next_ns = milli_last_ns + 1000000;
-    }
-}
-
-void  qemu_polling_disable( void )
-{
-    --qemu_milli_needed;
-}
-
-int  qemu_milli_check(void)
-{
-    int       result = 0;
-    int64_t   now_ns = get_clock();
-
-    //fprintf(stderr,"MilliCheck: now=%.4fms next=%.4fms\n", (double)now_ns/1000000.0, (double)milli_next_ns/1000000.0);
-    if (now_ns < milli_last_ns) {  /* software suspend ? */
-        milli_last_ns = now_ns;
-        milli_next_ns = now_ns + 1000000;
-        return 1;
-    }
-
-    while (now_ns >= milli_next_ns)
-    {
-        milli_last_ns = milli_next_ns;
-        milli_next_ns = milli_last_ns + 1000000;
-        result  += 1;
-    }
-    return result;
-}
-
-/***********************************************************/
-/* guest cycle counter */
-
-static int64_t cpu_ticks_prev;
-static int64_t cpu_ticks_offset;
-static int64_t cpu_clock_offset;
-static int cpu_ticks_enabled;
-
-/* return the host CPU cycle counter and handle stop/restart */
-int64_t cpu_get_ticks(void)
-{
-    if (!cpu_ticks_enabled) {
-        return cpu_ticks_offset;
-    } else {
-        int64_t ticks;
-        ticks = cpu_get_real_ticks();
-        if (cpu_ticks_prev > ticks) {
-            /* Note: non increasing ticks may happen if the host uses
-               software suspend */
-            cpu_ticks_offset += cpu_ticks_prev - ticks;
-        }
-        cpu_ticks_prev = ticks;
-        return ticks + cpu_ticks_offset;
-    }
-}
-
-/* return the host CPU monotonic timer and handle stop/restart */
-static int64_t cpu_get_clock(void)
-{
-    int64_t ti;
-    if (!cpu_ticks_enabled) {
-        return cpu_clock_offset;
-    } else {
-        ti = get_clock();
-        return ti + cpu_clock_offset;
-    }
-}
-
-/* enable cpu_get_ticks() */
-void cpu_enable_ticks(void)
-{
-    if (!cpu_ticks_enabled) {
-        cpu_ticks_offset -= cpu_get_real_ticks();
-        cpu_clock_offset -= get_clock();
-        cpu_ticks_enabled = 1;
-    }
-}
-
-/* disable cpu_get_ticks() : the clock is stopped. You must not call
-   cpu_get_ticks() after that.  */
-void cpu_disable_ticks(void)
-{
-    if (cpu_ticks_enabled) {
-        cpu_ticks_offset = cpu_get_ticks();
-        cpu_clock_offset = cpu_get_clock();
-        cpu_ticks_enabled = 0;
-    }
-}
-
-/***********************************************************/
-/* timers */
-
-#define QEMU_TIMER_REALTIME 0
-#define QEMU_TIMER_VIRTUAL  1
-
-struct QEMUClock {
-    int type;
-    /* XXX: add frequency */
-};
-
-struct QEMUTimer {
-    QEMUClock *clock;
-    int64_t expire_time;
-    QEMUTimerCB *cb;
-    void *opaque;
-    struct QEMUTimer *next;
-};
-
-struct qemu_alarm_timer {
-    char const *name;
-    unsigned int flags;
-
-    int (*start)(struct qemu_alarm_timer *t);
-    void (*stop)(struct qemu_alarm_timer *t);
-    void (*rearm)(struct qemu_alarm_timer *t);
-    void (*signal)(void);
-    void *priv;
-};
-
-#define ALARM_FLAG_DYNTICKS  0x1
-#define ALARM_FLAG_EXPIRED   0x2
-
-static inline int alarm_timer_has_dynticks(struct qemu_alarm_timer *t)
-{
-    return t && t->flags & ALARM_FLAG_DYNTICKS;
-}
-
-static void alarm_timer_rearm(struct qemu_alarm_timer *t)
-{
-    if (!alarm_timer_has_dynticks(t))
-        return;
-
-    t->rearm(t);
-}
-
-/* TODO: MIN_TIMER_REARM_US should be optimized */
-#define MIN_TIMER_REARM_US 250
-
-static struct qemu_alarm_timer *alarm_timer;
-
-#ifdef _WIN32
-#define  USE_WIN32_TIMER           1
-#define  USE_WIN32_DYNTICKS_TIMER  1
-#else
-#define  USE_UNIX_TIMER   1
-#endif
-
-#ifdef __linux__
-#define  DONT_USE_DYNTICKS_TIMER  1  /* it freezes the Android emulator hard */
-#define  USE_HPET_TIMER      1
-#define  USE_RTC_TIMER       1
-#endif
-
-
-#if defined(USE_WIN32_TIMER) || defined(USE_WIN32_DYNTICKS_TIMER)
-struct qemu_alarm_win32 {
-    MMRESULT timerId;
-    HANDLE host_alarm;
-    unsigned int period;
-} alarm_win32_data = {0, NULL, -1};
-
-static int win32_start_timer(struct qemu_alarm_timer *t);
-static void win32_stop_timer(struct qemu_alarm_timer *t);
-#endif
-
-#ifdef USE_WIN32_DYNTICKS_TIMER
-static void win32_rearm_timer(struct qemu_alarm_timer *t);
-#endif
-
-#ifdef USE_UNIX_TIMER
-static int unix_start_timer(struct qemu_alarm_timer *t);
-static void unix_stop_timer(struct qemu_alarm_timer *t);
-#endif
-
-#ifdef USE_DYNTICKS_TIMER
-static int dynticks_start_timer(struct qemu_alarm_timer *t);
-static void dynticks_stop_timer(struct qemu_alarm_timer *t);
-static void dynticks_rearm_timer(struct qemu_alarm_timer *t);
-#endif
-
-#ifdef USE_HPET_TIMER
-static int hpet_start_timer(struct qemu_alarm_timer *t);
-static void hpet_stop_timer(struct qemu_alarm_timer *t);
-#endif
-
-#ifdef USE_RTC_TIMER
-static int rtc_start_timer(struct qemu_alarm_timer *t);
-static void rtc_stop_timer(struct qemu_alarm_timer *t);
-#endif
-
-
-static struct qemu_alarm_timer alarm_timers[] = {
-#ifdef USE_DYNTICKS_TIMER
-    {"dynticks", ALARM_FLAG_DYNTICKS, dynticks_start_timer,
-     dynticks_stop_timer, dynticks_rearm_timer, NULL, NULL},
-#endif
-#ifdef USE_HPET_TIMER
-    /* HPET - if available - is preferred */
-    {"hpet", 0, hpet_start_timer, hpet_stop_timer, NULL, NULL, NULL},
-#endif
-#ifdef USE_RTC_TIMER
-    /* ...otherwise try RTC */
-    {"rtc", 0, rtc_start_timer, rtc_stop_timer, NULL, NULL, NULL},
-#endif
-#ifdef USE_UNIX_TIMER
-    {"unix", 0, unix_start_timer, unix_stop_timer, NULL, NULL, NULL},
-#endif
-#ifdef USE_WIN32_DYNTICKS_TIMER
-    {"dynticks", ALARM_FLAG_DYNTICKS, win32_start_timer,
-     win32_stop_timer, win32_rearm_timer, NULL, &alarm_win32_data},
-#endif
-#ifdef USE_WIN32_TIMER
-    {"win32", 0, win32_start_timer,
-     win32_stop_timer, NULL, NULL, &alarm_win32_data},
-#endif
-    {NULL, }
-};
-
-static void show_available_alarms()
-{
-    int i;
-
-    printf("Available alarm timers, in order of precedence:\n");
-    for (i = 0; alarm_timers[i].name; i++)
-        printf("%s\n", alarm_timers[i].name);
-}
-
-void qemu_configure_alarms(char const *opt)
-{
-    int i;
-    int cur = 0;
-    int count = (sizeof(alarm_timers) / sizeof(*alarm_timers)) - 1;
-    char *arg;
-    char *name;
-
-    if (!strcmp(opt, "help")) {
-        show_available_alarms();
-        exit(0);
-    }
-
-    arg = strdup(opt);
-
-    /* Reorder the array */
-    name = strtok(arg, ",");
-    while (name) {
-        struct qemu_alarm_timer tmp;
-
-        for (i = 0; i < count && alarm_timers[i].name; i++) {
-            if (!strcmp(alarm_timers[i].name, name))
-                break;
-        }
-
-        if (i == count) {
-            fprintf(stderr, "Unknown clock %s\n", name);
-            goto next;
-        }
-
-        if (i < cur)
-            /* Ignore */
-            goto next;
-
-    /* Swap */
-        tmp = alarm_timers[i];
-        alarm_timers[i] = alarm_timers[cur];
-        alarm_timers[cur] = tmp;
-
-        cur++;
-next:
-        name = strtok(NULL, ",");
-    }
-
-    free(arg);
-
-    if (cur) {
-    /* Disable remaining timers */
-        for (i = cur; i < count; i++)
-            alarm_timers[i].name = NULL;
-    }
-
-    /* debug */
-    show_available_alarms();
-}
-
-QEMUClock *rt_clock;
-QEMUClock *vm_clock;
-
-static QEMUTimer *active_timers[2];
-#if defined(USE_WIN32_TIMER) || defined(USE_WIN32_DYNTICKS_TIMER)
-static MMRESULT timerID;
-static HANDLE host_alarm = NULL;
-static unsigned int period = 1;
-#endif
-
-QEMUClock *qemu_new_clock(int type)
-{
-    QEMUClock *clock;
-    clock = qemu_mallocz(sizeof(QEMUClock));
-    if (!clock)
-        return NULL;
-    clock->type = type;
-    return clock;
-}
-
-QEMUTimer *qemu_new_timer(QEMUClock *clock, QEMUTimerCB *cb, void *opaque)
-{
-    QEMUTimer *ts;
-
-    ts = qemu_mallocz(sizeof(QEMUTimer));
-    ts->clock = clock;
-    ts->cb = cb;
-    ts->opaque = opaque;
-    return ts;
-}
-
-void qemu_free_timer(QEMUTimer *ts)
-{
-    qemu_free(ts);
-}
-
-/* stop a timer, but do not dealloc it */
-void qemu_del_timer(QEMUTimer *ts)
-{
-    QEMUTimer **pt, *t;
-
-    /* NOTE: this code must be signal safe because
-       qemu_timer_expired() can be called from a signal. */
-    pt = &active_timers[ts->clock->type];
-    for(;;) {
-        t = *pt;
-        if (!t)
-            break;
-        if (t == ts) {
-            *pt = t->next;
-            break;
-        }
-        pt = &t->next;
-    }
-}
-
-/* modify the current timer so that it will be fired when current_time
-   >= expire_time. The corresponding callback will be called. */
-void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time)
-{
-    QEMUTimer **pt, *t;
-
-    qemu_del_timer(ts);
-
-    /* add the timer in the sorted list */
-    /* NOTE: this code must be signal safe because
-       qemu_timer_expired() can be called from a signal. */
-    pt = &active_timers[ts->clock->type];
-    for(;;) {
-        t = *pt;
-        if (!t)
-            break;
-        if (t->expire_time > expire_time)
-            break;
-        pt = &t->next;
-    }
-    ts->expire_time = expire_time;
-    ts->next = *pt;
-    *pt = ts;
-
-    /* Rearm if necessary  */
-    if ((alarm_timer->flags & ALARM_FLAG_EXPIRED) == 0 &&
-        pt == &active_timers[ts->clock->type])
-        alarm_timer_rearm(alarm_timer);
-}
-
-int qemu_timer_pending(QEMUTimer *ts)
-{
-    QEMUTimer *t;
-    for(t = active_timers[ts->clock->type]; t != NULL; t = t->next) {
-        if (t == ts)
-            return 1;
-    }
-    return 0;
-}
-
-static inline int qemu_timer_expired(QEMUTimer *timer_head, int64_t current_time)
-{
-    if (!timer_head)
-        return 0;
-    return (timer_head->expire_time <= current_time);
-}
-
-#define  QEMU_TIMER_MAX_TIMEOUT  10
-
-static inline int  qemu_timer_next_timeout(QEMUTimer*  timer_head)
-{
-    int64_t  now, diff;
-
-    if (!timer_head)
-        return QEMU_TIMER_MAX_TIMEOUT;
-
-    now  = qemu_get_clock(timer_head->clock);
-    diff = timer_head->expire_time - now;
-    if (timer_head->clock == vm_clock)
-        diff /= 1000000;
-
-    if (diff > QEMU_TIMER_MAX_TIMEOUT)
-        return QEMU_TIMER_MAX_TIMEOUT;
-    if (diff < 1)
-        diff = 1;
-    return (int) diff;
-}
-
-
-static void qemu_run_timers(QEMUTimer **ptimer_head, int64_t current_time)
-{
-    QEMUTimer *ts;
-
-    for(;;) {
-        ts = *ptimer_head;
-        if (!ts || ts->expire_time > current_time)
-            break;
-        /* remove timer from the list before calling the callback */
-        *ptimer_head = ts->next;
-        ts->next = NULL;
-
-        /* run the callback (the timer list can be modified) */
-        ts->cb(ts->opaque);
-    }
-}
-
-int64_t qemu_get_clock(QEMUClock *clock)
-{
-    switch(clock->type) {
-    case QEMU_TIMER_REALTIME:
-        return get_clock() / 1000000;
-    default:
-    case QEMU_TIMER_VIRTUAL:
-        return cpu_get_clock();
-    }
-}
-
-void init_timers(void)
-{
-    static int inited;
-    if (!inited) {
-        init_get_clock();
-        ticks_per_sec = QEMU_TIMER_BASE;
-        rt_clock = qemu_new_clock(QEMU_TIMER_REALTIME);
-        vm_clock = qemu_new_clock(QEMU_TIMER_VIRTUAL);
-        inited = 1;
-    }
-}
-
-/* save a timer */
-void qemu_put_timer(QEMUFile *f, QEMUTimer *ts)
-{
-    uint64_t expire_time;
-
-    if (qemu_timer_pending(ts)) {
-        expire_time = ts->expire_time;
-    } else {
-        expire_time = -1;
-    }
-    qemu_put_be64(f, expire_time);
-}
-
-void qemu_get_timer(QEMUFile *f, QEMUTimer *ts)
-{
-    uint64_t expire_time;
-
-    expire_time = qemu_get_be64(f);
-    if (expire_time != -1) {
-        qemu_mod_timer(ts, expire_time);
-    } else {
-        qemu_del_timer(ts);
-    }
-}
-
-void timer_save(QEMUFile *f, void *opaque)
-{
-    if (cpu_ticks_enabled) {
-        hw_error("cannot save state if virtual timers are running");
-    }
-    qemu_put_be64s(f, (uint64_t*)&cpu_ticks_offset);
-    qemu_put_be64s(f, (uint64_t*)&ticks_per_sec);
-}
-
-int timer_load(QEMUFile *f, void *opaque, int version_id)
-{
-    if (version_id != 1)
-        return -EINVAL;
-    if (cpu_ticks_enabled) {
-        return -EINVAL;
-    }
-    qemu_get_be64s(f, (uint64_t*)&cpu_ticks_offset);
-    qemu_get_be64s(f, (uint64_t*)&ticks_per_sec);
-    return 0;
-}
-
-#ifdef _WIN32
-void CALLBACK host_alarm_handler(UINT uTimerID, UINT uMsg,
-                                 DWORD_PTR dwUser, DWORD_PTR dw1, DWORD_PTR dw2)
-#else
-static void host_alarm_handler(int host_signum)
-#endif
-{
-#if 0
-    //write( 2, "|", 1 );
-#define DISP_FREQ 1000
-    {
-        static int64_t delta_min = INT64_MAX;
-        static int64_t delta_max, delta_cum, last_clock, delta, ti;
-        static int count;
-        ti = qemu_get_clock(vm_clock);
-        if (last_clock != 0) {
-            delta = ti - last_clock;
-            if (delta < delta_min)
-                delta_min = delta;
-            if (delta > delta_max)
-                delta_max = delta;
-            delta_cum += delta;
-            if (++count == DISP_FREQ) {
-                printf("timer: min=%" PRId64 " us max=%" PRId64 " us avg=%" PRId64 " us avg_freq=%0.3f Hz\n",
-                       muldiv64(delta_min, 1000000, ticks_per_sec),
-                       muldiv64(delta_max, 1000000, ticks_per_sec),
-                       muldiv64(delta_cum, 1000000 / DISP_FREQ, ticks_per_sec),
-                       (double)ticks_per_sec / ((double)delta_cum / DISP_FREQ));
-                count = 0;
-                delta_min = INT64_MAX;
-                delta_max = 0;
-                delta_cum = 0;
-            }
-        }
-        last_clock = ti;
-    }
-#endif
-    if (alarm_timer_has_dynticks(alarm_timer) ||
-        qemu_timer_expired(active_timers[QEMU_TIMER_VIRTUAL],
-                           qemu_get_clock(vm_clock)) ||
-        qemu_timer_expired(active_timers[QEMU_TIMER_REALTIME],
-                           qemu_get_clock(rt_clock))) {
-#ifdef _WIN32
-        struct qemu_alarm_win32 *data = ((struct qemu_alarm_timer*)dwUser)->priv;
-        SetEvent(data->host_alarm);
-#endif
-        alarm_timer->flags |= ALARM_FLAG_EXPIRED;
-
-        if (alarm_timer->signal)
-            alarm_timer->signal();
-    }
-}
-
-static uint64_t qemu_next_deadline(void)
-{
-    int64_t nearest_delta_us = INT64_MAX;
-    int64_t vmdelta_us;
-
-    if (active_timers[QEMU_TIMER_REALTIME])
-        nearest_delta_us = (active_timers[QEMU_TIMER_REALTIME]->expire_time -
-                            qemu_get_clock(rt_clock))*1000;
-
-    if (active_timers[QEMU_TIMER_VIRTUAL]) {
-        /* round up */
-        vmdelta_us = (active_timers[QEMU_TIMER_VIRTUAL]->expire_time -
-                      qemu_get_clock(vm_clock)+999)/1000;
-        if (vmdelta_us < nearest_delta_us)
-            nearest_delta_us = vmdelta_us;
-    }
-
-    /* Avoid arming the timer to negative, zero, or too low values */
-    if (nearest_delta_us <= MIN_TIMER_REARM_US)
-        nearest_delta_us = MIN_TIMER_REARM_US;
-
-    return nearest_delta_us;
-}
-
-#define RTC_FREQ 1024
-
-#if defined(USE_HPET_TIMER) || defined(USE_RTC_TIMER)
-static void enable_sigio_timer(int fd)
-{
-    struct sigaction act;
-
-    /* timer signal */
-    sigfillset(&act.sa_mask);
-    act.sa_flags = 0;
-    act.sa_handler = host_alarm_handler;
-
-    sigaction(SIGIO, &act, NULL);
-    fcntl(fd, F_SETFL, O_ASYNC);
-    fcntl(fd, F_SETOWN, getpid());
-}
-#endif
-
-#ifdef USE_HPET_TIMER
-static int hpet_start_timer(struct qemu_alarm_timer *t)
-{
-    struct hpet_info info;
-    int r, fd;
-
-    fd = open("/dev/hpet", O_RDONLY);
-    if (fd < 0)
-        return -1;
-
-    /* Set frequency */
-    r = ioctl(fd, HPET_IRQFREQ, RTC_FREQ);
-    if (r < 0) {
-        fprintf(stderr, "Could not configure '/dev/hpet' to have a 1024Hz timer. This is not a fatal\n"
-                "error, but for better emulation accuracy type:\n"
-                "'echo 1024 > /proc/sys/dev/hpet/max-user-freq' as root.\n");
-        goto fail;
-    }
-
-    /* Check capabilities */
-    r = ioctl(fd, HPET_INFO, &info);
-    if (r < 0)
-        goto fail;
-
-    /* Enable periodic mode */
-    r = ioctl(fd, HPET_EPI, 0);
-    if (info.hi_flags && (r < 0))
-        goto fail;
-
-    /* Enable interrupt */
-    r = ioctl(fd, HPET_IE_ON, 0);
-    if (r < 0)
-        goto fail;
-
-    enable_sigio_timer(fd);
-    t->priv = (void *)(long)fd;
-
-    return 0;
-fail:
-    close(fd);
-    return -1;
-}
-
-static void hpet_stop_timer(struct qemu_alarm_timer *t)
-{
-    int fd = (long)t->priv;
-
-    close(fd);
-}
-#endif
-
-#ifdef USE_RTC_TIMER
-static int rtc_start_timer(struct qemu_alarm_timer *t)
-{
-    int rtc_fd;
-    unsigned long current_rtc_freq = 0;
-
-    TFR(rtc_fd = open("/dev/rtc", O_RDONLY));
-    if (rtc_fd < 0)
-        return -1;
-    ioctl(rtc_fd, RTC_IRQP_READ, &current_rtc_freq);
-    if (current_rtc_freq != RTC_FREQ &&
-        ioctl(rtc_fd, RTC_IRQP_SET, RTC_FREQ) < 0) {
-        fprintf(stderr, "Could not configure '/dev/rtc' to have a 1024 Hz timer. This is not a fatal\n"
-                "error, but for better emulation accuracy either use a 2.6 host Linux kernel or\n"
-                "type 'echo 1024 > /proc/sys/dev/rtc/max-user-freq' as root.\n");
-        goto fail;
-    }
-    if (ioctl(rtc_fd, RTC_PIE_ON, 0) < 0) {
-    fail:
-        close(rtc_fd);
-        return -1;
-    }
-
-    enable_sigio_timer(rtc_fd);
-
-    t->priv = (void *)(long)rtc_fd;
-
-    return 0;
-}
-
-static void rtc_stop_timer(struct qemu_alarm_timer *t)
-{
-    int rtc_fd = (long)t->priv;
-
-    close(rtc_fd);
-}
-#endif
-
-#ifdef USE_DYNTICKS_TIMER
-static int dynticks_start_timer(struct qemu_alarm_timer *t)
-{
-    struct sigevent ev;
-    timer_t host_timer;
-    struct sigaction act;
-
-    sigfillset(&act.sa_mask);
-    act.sa_flags = 0;
-    act.sa_handler = host_alarm_handler;
-
-    sigaction(SIGALRM, &act, NULL);
-
-    ev.sigev_value.sival_int = 0;
-    ev.sigev_notify = SIGEV_SIGNAL;
-    ev.sigev_signo = SIGALRM;
-
-    if (timer_create(CLOCK_REALTIME, &ev, &host_timer)) {
-        perror("timer_create");
-
-        /* disable dynticks */
-        fprintf(stderr, "Dynamic Ticks disabled\n");
-
-        return -1;
-    }
-
-    t->priv = (void *)host_timer;
-
-    return 0;
-}
-
-static void dynticks_stop_timer(struct qemu_alarm_timer *t)
-{
-    timer_t host_timer = (timer_t)t->priv;
-
-    timer_delete(host_timer);
-}
-
-static void dynticks_rearm_timer(struct qemu_alarm_timer *t)
-{
-    timer_t host_timer = (timer_t)t->priv;
-    struct itimerspec timeout;
-    int64_t nearest_delta_us = INT64_MAX;
-    int64_t current_us;
-
-    if (!active_timers[QEMU_TIMER_REALTIME] &&
-        !active_timers[QEMU_TIMER_VIRTUAL]) {
-        return;
-    }
-    nearest_delta_us = qemu_next_deadline();
-
-    /* check whether a timer is already running */
-    if (timer_gettime(host_timer, &timeout)) {
-        perror("gettime");
-        fprintf(stderr, "Internal timer error: aborting\n");
-        exit(1);
-    }
-    current_us = timeout.it_value.tv_sec * 1000000 + timeout.it_value.tv_nsec/1000;
-    if (current_us && current_us <= nearest_delta_us)
-        return;
-
-    timeout.it_interval.tv_sec = 0;
-    timeout.it_interval.tv_nsec = 0; /* 0 for one-shot timer */
-    timeout.it_value.tv_sec =  nearest_delta_us / 1000000;
-    timeout.it_value.tv_nsec = (nearest_delta_us % 1000000) * 1000;
-    if (timer_settime(host_timer, 0 /* RELATIVE */, &timeout, NULL)) {
-        perror("settime");
-        fprintf(stderr, "Internal timer error: aborting\n");
-        exit(1);
-    }
-}
-#endif /* USE_DYNTICKS_TIMER */
-
-#ifdef USE_UNIX_TIMER
-static int unix_start_timer(struct qemu_alarm_timer *t)
-{
-    struct sigaction act;
-    struct itimerval itv;
-    int err;
-
-    /* timer signal */
-    sigfillset(&act.sa_mask);
-    act.sa_flags = 0;
-    act.sa_handler = host_alarm_handler;
-
-    sigaction(SIGALRM, &act, NULL);
-
-    itv.it_interval.tv_sec = 0;
-    /* for i386 kernel 2.6 to get 1 ms */
-    itv.it_interval.tv_usec = 999;
-    itv.it_value.tv_sec = 0;
-    itv.it_value.tv_usec = 10 * 1000;
-
-    err = setitimer(ITIMER_REAL, &itv, NULL);
-    if (err)
-        return -1;
-
-    return 0;
-}
-
-static void unix_stop_timer(struct qemu_alarm_timer *t)
-{
-    struct itimerval itv;
-
-    memset(&itv, 0, sizeof(itv));
-    setitimer(ITIMER_REAL, &itv, NULL);
-}
-
-#endif /* USE_UNIX_TIMER */
-
-#if defined(USE_WIN32_TIMER) || defined(USE_WIN32_DYNTICKS_TIMER)
-static int win32_start_timer(struct qemu_alarm_timer *t)
-{
-    TIMECAPS tc;
-    struct qemu_alarm_win32 *data = t->priv;
-    UINT flags;
-
-    data->host_alarm = CreateEvent(NULL, FALSE, FALSE, NULL);
-    if (!data->host_alarm) {
-        perror("Failed CreateEvent");
-        return -1;
-    }
-
-    memset(&tc, 0, sizeof(tc));
-    timeGetDevCaps(&tc, sizeof(tc));
-
-    if (data->period < tc.wPeriodMin)
-        data->period = tc.wPeriodMin;
-
-    timeBeginPeriod(data->period);
-
-    flags = TIME_CALLBACK_FUNCTION;
-    if (alarm_timer_has_dynticks(t))
-        flags |= TIME_ONESHOT;
-    else
-        flags |= TIME_PERIODIC;
-
-    data->timerId = timeSetEvent(1,         // interval (ms)
-                        data->period,       // resolution
-                        host_alarm_handler, // function
-                        (DWORD)t,           // parameter
-                        flags);
-
-    if (!data->timerId) {
-        perror("Failed to initialize win32 alarm timer");
-
-        timeEndPeriod(data->period);
-        CloseHandle(data->host_alarm);
-        return -1;
-    }
-
-    qemu_add_wait_object(data->host_alarm, NULL, NULL);
-
-    return 0;
-}
-
-static void win32_stop_timer(struct qemu_alarm_timer *t)
-{
-    struct qemu_alarm_win32 *data = t->priv;
-
-    timeKillEvent(data->timerId);
-    timeEndPeriod(data->period);
-
-    CloseHandle(data->host_alarm);
-}
-#endif /* USE_WIN32_TIMER || USE_WIN32_DYNTICKS_TIMER */
-
-#ifdef USE_WIN32_DYNTICKS_TIMER
-static void win32_rearm_timer(struct qemu_alarm_timer *t)
-{
-    struct qemu_alarm_win32 *data = t->priv;
-    uint64_t nearest_delta_us;
-
-    if (!active_timers[QEMU_TIMER_REALTIME] &&
-                !active_timers[QEMU_TIMER_VIRTUAL])
-        return;
-
-    nearest_delta_us = qemu_next_deadline();
-    nearest_delta_us /= 1000;
-
-    timeKillEvent(data->timerId);
-
-    data->timerId = timeSetEvent(1,
-                        data->period,
-                        host_alarm_handler,
-                        (DWORD)t,
-                        TIME_ONESHOT | TIME_PERIODIC);
-
-    if (!data->timerId) {
-        perror("Failed to re-arm win32 alarm timer");
-
-        timeEndPeriod(data->period);
-        CloseHandle(data->host_alarm);
-        exit(1);
-    }
-}
-#endif /* USE_WIN32_DYNTICKS_TIMER */
-
-void qemu_init_alarm_timer(void (*cb)(void))
-{
-    struct qemu_alarm_timer *t;
-    int i, err = -1;
-
-    /* on UNIX, ensure that SIGALRM is not blocked for some reason */
-#ifndef _WIN32
-    {
-        sigset_t  ss;
-        sigemptyset( &ss );
-        sigaddset( &ss, SIGALRM );
-        sigprocmask( SIG_UNBLOCK, &ss, NULL );
-    }
-#endif
-
-    for (i = 0; alarm_timers[i].name; i++) {
-        t = &alarm_timers[i];
-
-        err = t->start(t);
-        if (!err)
-            break;
-    }
-
-    if (err) {
-        fprintf(stderr, "Unable to find any suitable alarm timer.\n");
-        fprintf(stderr, "Terminating\n");
-        exit(1);
-    }
-
-    t->signal = cb;
-    D( "using '%s' alarm timer", t->name );
-    alarm_timer = t;
-}
-
-#if 0
-static void quit_timers(void)
-{
-    alarm_timer->stop(alarm_timer);
-    alarm_timer = NULL;
-}
-#endif
-
-void
-qemu_run_virtual_timers(void)
-{
-    qemu_run_timers(&active_timers[QEMU_TIMER_VIRTUAL], qemu_get_clock(vm_clock));
-}
-
-void
-qemu_run_realtime_timers(void)
-{
-    qemu_run_timers(&active_timers[QEMU_TIMER_REALTIME], qemu_get_clock(rt_clock));
-}
-
-void
-qemu_start_alarm_timer(void)
-{
-    alarm_timer_rearm(alarm_timer);
-}
-
-
-void
-qemu_rearm_alarm_timer(void)
-{
-    if (alarm_timer->flags & ALARM_FLAG_EXPIRED) {
-        alarm_timer->flags &= ~(ALARM_FLAG_EXPIRED);
-        alarm_timer_rearm(alarm_timer);
-    }
-}
-
-void
-qemu_stop_alarm_timer(void)
-{
-    alarm_timer->stop(alarm_timer);
-}
diff --git a/qemu_timers.h b/qemu_timers.h
index 3ab541e..9642301 100644
--- a/qemu_timers.h
+++ b/qemu_timers.h
@@ -2,61 +2,6 @@
 #define _QEMU_TIMERS_H
 
 #include "qemu_file.h"
-
-#define QEMU_TIMER_BASE 1000000000LL
-
-/* timers */
-
-typedef struct QEMUClock QEMUClock;
-typedef struct QEMUTimer QEMUTimer;
-
-typedef void QEMUTimerCB(void *opaque);
-
-/* The real time clock should be used only for stuff which does not
-   change the virtual machine state, as it is run even if the virtual
-   machine is stopped. The real time clock has a frequency of 1000
-   Hz. */
-extern QEMUClock *rt_clock;
-
-/* The virtual clock is only run during the emulation. It is stopped
-   when the virtual machine is stopped. Virtual timers use a high
-   precision clock, usually cpu cycles (use ticks_per_sec). */
-extern QEMUClock *vm_clock;
-
-/* return the elapsed host time in nanoseconds */
-int64_t qemu_get_elapsed_ns(void);
-
-int64_t qemu_get_clock(QEMUClock *clock);
-
-QEMUTimer *qemu_new_timer(QEMUClock *clock, QEMUTimerCB *cb, void *opaque);
-
-void qemu_free_timer(QEMUTimer *ts);
-void qemu_del_timer(QEMUTimer *ts);
-void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time);
-int  qemu_timer_pending(QEMUTimer *ts);
-
-extern int64_t ticks_per_sec;
-extern int pit_min_timer_count;
-
-int64_t cpu_get_ticks(void);
-void    cpu_enable_ticks(void);
-void    cpu_disable_ticks(void);
-
-void    init_timers(void);
-
-void    init_alarm_timer(void (*cb)(void));
-
-void timer_save(QEMUFile *f, void *opaque);
-int  timer_load(QEMUFile *f, void *opaque, int version_id);
-
-void    qemu_run_virtual_timers(void);
-void    qemu_run_realtime_timers(void);
-
-void    qemu_init_alarm_timer( void(*cb)(void) );
-void    qemu_start_alarm_timer(void);
-void    qemu_rearm_alarm_timer(void);
-void    qemu_stop_alarm_timer(void);
-
-void    qemu_configure_alarms(char const *opt);
+#include "qemu-timer.h"
 
 #endif /* _QEMU_TIMERS_H */
diff --git a/readline.c b/readline.c
index cbe33db..81bc491 100644
--- a/readline.c
+++ b/readline.c
@@ -1,8 +1,8 @@
 /*
  * QEMU readline utility
- * 
+ *
  * Copyright (c) 2003-2004 Fabrice Bellard
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -21,7 +21,8 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
+#include "console.h"
 
 #define TERM_CMD_BUF_SIZE 4095
 #define TERM_MAX_CMDS 64
@@ -156,6 +157,45 @@ static void term_backspace(void)
     }
 }
 
+static void term_backword(void)
+{
+    int start;
+
+    if (term_cmd_buf_index == 0 || term_cmd_buf_index > term_cmd_buf_size) {
+        return;
+    }
+
+    start = term_cmd_buf_index - 1;
+
+    /* find first word (backwards) */
+    while (start > 0) {
+        if (!isspace(term_cmd_buf[start])) {
+            break;
+        }
+
+        --start;
+    }
+
+    /* find first space (backwards) */
+    while (start > 0) {
+        if (isspace(term_cmd_buf[start])) {
+            ++start;
+            break;
+        }
+
+        --start;
+    }
+
+    /* remove word */
+    if (start < term_cmd_buf_index) {
+        memmove(term_cmd_buf + start,
+                term_cmd_buf + term_cmd_buf_index,
+                term_cmd_buf_size - term_cmd_buf_index);
+        term_cmd_buf_size -= term_cmd_buf_index - start;
+        term_cmd_buf_index = start;
+    }
+}
+
 static void term_bol(void)
 {
     term_cmd_buf_index = 0;
@@ -182,7 +222,7 @@ static void term_up_char(void)
     }
     term_hist_entry--;
     if (term_hist_entry >= 0) {
-	pstrcpy(term_cmd_buf, sizeof(term_cmd_buf), 
+	pstrcpy(term_cmd_buf, sizeof(term_cmd_buf),
                 term_history[term_hist_entry]);
 	term_cmd_buf_index = term_cmd_buf_size = strlen(term_cmd_buf);
     }
@@ -227,7 +267,7 @@ static void term_hist_add(const char *cmdline)
 	    new_entry = hist_entry;
 	    /* Put this entry at the end of history */
 	    memmove(&term_history[idx], &term_history[idx + 1],
-		    &term_history[TERM_MAX_CMDS] - &term_history[idx + 1]);
+		    (TERM_MAX_CMDS - idx + 1) * sizeof(char *));
 	    term_history[TERM_MAX_CMDS - 1] = NULL;
 	    for (; idx < TERM_MAX_CMDS; idx++) {
 		if (term_history[idx] == NULL)
@@ -240,7 +280,7 @@ static void term_hist_add(const char *cmdline)
 	/* Need to get one free slot */
 	free(term_history[0]);
 	memcpy(term_history, &term_history[1],
-	       &term_history[TERM_MAX_CMDS] - &term_history[1]);
+	       (TERM_MAX_CMDS - 1) * sizeof(char *));
 	term_history[TERM_MAX_CMDS - 1] = NULL;
 	idx = TERM_MAX_CMDS - 1;
     }
@@ -261,11 +301,11 @@ void add_completion(const char *str)
 
 static void term_completion(void)
 {
-    int len, i, j, max_width, nb_cols;
+    int len, i, j, max_width, nb_cols, max_prefix;
     char *cmdline;
 
     nb_completions = 0;
-    
+
     cmdline = qemu_malloc(term_cmd_buf_index + 1);
     if (!cmdline)
         return;
@@ -288,11 +328,26 @@ static void term_completion(void)
     } else {
         term_printf("\n");
         max_width = 0;
+        max_prefix = 0;	
         for(i = 0; i < nb_completions; i++) {
             len = strlen(completions[i]);
+            if (i==0) {
+                max_prefix = len;
+            } else {
+                if (len < max_prefix)
+                    max_prefix = len;
+                for(j=0; j<max_prefix; j++) {
+                    if (completions[i][j] != completions[0][j])
+                        max_prefix = j;
+                }
+            }
             if (len > max_width)
                 max_width = len;
         }
+        if (max_prefix > 0) 
+            for(i = completion_index; i < max_prefix; i++) {
+                term_insert_char(completions[0][i]);
+            }
         max_width += 2;
         if (max_width < 10)
             max_width = 10;
@@ -335,9 +390,17 @@ void readline_handle_byte(int ch)
             if (!term_is_password)
                 term_hist_add(term_cmd_buf);
             term_printf("\n");
+            term_cmd_buf_index = 0;
+            term_cmd_buf_size = 0;
+            term_last_cmd_buf_index = 0;
+            term_last_cmd_buf_size = 0;
             /* NOTE: readline_start can be called here */
             term_readline_func(term_readline_opaque, term_cmd_buf);
             break;
+        case 23:
+            /* ^W */
+            term_backword();
+            break;
         case 27:
             term_esc_state = IS_ESC;
             break;
diff --git a/sdl.c b/sdl.c
deleted file mode 100644
index d82745d..0000000
--- a/sdl.c
+++ /dev/null
@@ -1,570 +0,0 @@
-/*
- * QEMU SDL display driver
- * 
- * Copyright (c) 2003 Fabrice Bellard
- * 
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include "vl.h"
-
-#include <SDL.h>
-
-#ifndef _WIN32
-#include <signal.h>
-#endif
-
-static SDL_Surface *screen;
-static int gui_grab; /* if true, all keyboard/mouse events are grabbed */
-static int last_vm_running;
-static int gui_saved_grab;
-static int gui_fullscreen;
-static int gui_key_modifier_pressed;
-static int gui_keysym;
-static int gui_fullscreen_initial_grab;
-static int gui_grab_code = KMOD_LALT | KMOD_LCTRL;
-static uint8_t modifiers_state[256];
-static int width, height;
-static SDL_Cursor *sdl_cursor_normal;
-static SDL_Cursor *sdl_cursor_hidden;
-static int absolute_enabled = 0;
-
-static void sdl_update(DisplayState *ds, int x, int y, int w, int h)
-{
-    //    printf("updating x=%d y=%d w=%d h=%d\n", x, y, w, h);
-    SDL_UpdateRect(screen, x, y, w, h);
-}
-
-static void sdl_resize(DisplayState *ds, int w, int h, int  rotation)
-{
-    int flags;
-
-    //    printf("resizing to %d %d\n", w, h);
-
-    flags = SDL_HWSURFACE|SDL_ASYNCBLIT|SDL_HWACCEL;
-    if (gui_fullscreen)
-        flags |= SDL_FULLSCREEN;
-
-    width = w;
-    height = h;
-
- again:
-    screen = SDL_SetVideoMode(w, h, 16, flags);
-    if (!screen) {
-        fprintf(stderr, "Could not open SDL display\n");
-        exit(1);
-    }
-    if (!screen->pixels && (flags & SDL_HWSURFACE) && (flags & SDL_FULLSCREEN)) {
-        flags &= ~SDL_HWSURFACE;
-        goto again;
-    }
-
-    if (!screen->pixels) {
-        fprintf(stderr, "Could not open SDL display\n");
-        exit(1);
-    }
-    ds->data = screen->pixels;
-    ds->linesize = screen->pitch;
-    ds->depth = screen->format->BitsPerPixel;
-    if (ds->depth == 32 && screen->format->Rshift == 0) {
-        ds->bgr = 1;
-    } else {
-        ds->bgr = 0;
-    }
-    ds->width = w;
-    ds->height = h;
-}
-
-/* generic keyboard conversion */
-
-#include "sdl_keysym.h"
-#include "keymaps.c"
-
-static kbd_layout_t *kbd_layout = NULL;
-
-static uint8_t sdl_keyevent_to_keycode_generic(const SDL_KeyboardEvent *ev)
-{
-    int keysym;
-    /* workaround for X11+SDL bug with AltGR */
-    keysym = ev->keysym.sym;
-    if (keysym == 0 && ev->keysym.scancode == 113)
-        keysym = SDLK_MODE;
-    return keysym2scancode(kbd_layout, keysym);
-}
-
-/* specific keyboard conversions from scan codes */
-
-#if defined(_WIN32)
-
-static uint8_t sdl_keyevent_to_keycode(const SDL_KeyboardEvent *ev)
-{
-    return ev->keysym.scancode;
-}
-
-#else
-
-static const uint8_t x_keycode_to_pc_keycode[61] = {
-   0xc7,      /*  97  Home   */
-   0xc8,      /*  98  Up     */
-   0xc9,      /*  99  PgUp   */
-   0xcb,      /* 100  Left   */
-   0x4c,        /* 101  KP-5   */
-   0xcd,      /* 102  Right  */
-   0xcf,      /* 103  End    */
-   0xd0,      /* 104  Down   */
-   0xd1,      /* 105  PgDn   */
-   0xd2,      /* 106  Ins    */
-   0xd3,      /* 107  Del    */
-   0x9c,      /* 108  Enter  */
-   0x9d,      /* 109  Ctrl-R */
-   0x0,       /* 110  Pause  */
-   0xb7,      /* 111  Print  */
-   0xb5,      /* 112  Divide */
-   0xb8,      /* 113  Alt-R  */
-   0xc6,      /* 114  Break  */   
-   0x0,         /* 115 */
-   0x0,         /* 116 */
-   0x0,         /* 117 */
-   0x0,         /* 118 */
-   0x0,         /* 119 */
-   0x70,         /* 120 Hiragana_Katakana */
-   0x0,         /* 121 */
-   0x0,         /* 122 */
-   0x73,         /* 123 backslash */
-   0x0,         /* 124 */
-   0x0,         /* 125 */
-   0x0,         /* 126 */
-   0x0,         /* 127 */
-   0x0,         /* 128 */
-   0x79,         /* 129 Henkan */
-   0x0,         /* 130 */
-   0x7b,         /* 131 Muhenkan */
-   0x0,         /* 132 */
-   0x7d,         /* 133 Yen */
-   0x0,         /* 134 */
-   0x0,         /* 135 */
-   0x47,         /* 136 KP_7 */
-   0x48,         /* 137 KP_8 */
-   0x49,         /* 138 KP_9 */
-   0x4b,         /* 139 KP_4 */
-   0x4c,         /* 140 KP_5 */
-   0x4d,         /* 141 KP_6 */
-   0x4f,         /* 142 KP_1 */
-   0x50,         /* 143 KP_2 */
-   0x51,         /* 144 KP_3 */
-   0x52,         /* 145 KP_0 */
-   0x53,         /* 146 KP_. */
-   0x47,         /* 147 KP_HOME */
-   0x48,         /* 148 KP_UP */
-   0x49,         /* 149 KP_PgUp */
-   0x4b,         /* 150 KP_Left */
-   0x4c,         /* 151 KP_ */
-   0x4d,         /* 152 KP_Right */
-   0x4f,         /* 153 KP_End */
-   0x50,         /* 154 KP_Down */
-   0x51,         /* 155 KP_PgDn */
-   0x52,         /* 156 KP_Ins */
-   0x53,         /* 157 KP_Del */
-};
-
-static uint8_t sdl_keyevent_to_keycode(const SDL_KeyboardEvent *ev)
-{
-    int keycode;
-
-    keycode = ev->keysym.scancode;
-
-    if (keycode < 9) {
-        keycode = 0;
-    } else if (keycode < 97) {
-        keycode -= 8; /* just an offset */
-    } else if (keycode < 158) {
-        /* use conversion table */
-        keycode = x_keycode_to_pc_keycode[keycode - 97];
-    } else {
-        keycode = 0;
-    }
-    return keycode;
-}
-
-#endif
-
-static void reset_keys(void)
-{
-    int i;
-    for(i = 0; i < 256; i++) {
-        if (modifiers_state[i]) {
-            if (i & 0x80)
-                kbd_put_keycode(0xe0);
-            kbd_put_keycode(i | 0x80);
-            modifiers_state[i] = 0;
-        }
-    }
-}
-
-static void sdl_process_key(SDL_KeyboardEvent *ev)
-{
-    int keycode, v;
-
-    if (ev->keysym.sym == SDLK_PAUSE) {
-        /* specific case */
-        v = 0;
-        if (ev->type == SDL_KEYUP)
-            v |= 0x80;
-        kbd_put_keycode(0xe1);
-        kbd_put_keycode(0x1d | v);
-        kbd_put_keycode(0x45 | v);
-        return;
-    }
-
-    if (kbd_layout) {
-        keycode = sdl_keyevent_to_keycode_generic(ev);
-    } else {
-        keycode = sdl_keyevent_to_keycode(ev);
-    }
-
-    switch(keycode) {
-    case 0x00:
-        /* sent when leaving window: reset the modifiers state */
-        reset_keys();
-        return;
-    case 0x2a:                          /* Left Shift */
-    case 0x36:                          /* Right Shift */
-    case 0x1d:                          /* Left CTRL */
-    case 0x9d:                          /* Right CTRL */
-    case 0x38:                          /* Left ALT */
-    case 0xb8:                         /* Right ALT */
-        if (ev->type == SDL_KEYUP)
-            modifiers_state[keycode] = 0;
-        else
-            modifiers_state[keycode] = 1;
-        break;
-    case 0x45: /* num lock */
-    case 0x3a: /* caps lock */
-        /* SDL does not send the key up event, so we generate it */
-        kbd_put_keycode(keycode);
-        kbd_put_keycode(keycode | 0x80);
-        return;
-    }
-
-    /* now send the key code */
-    if (keycode & 0x80)
-        kbd_put_keycode(0xe0);
-    if (ev->type == SDL_KEYUP)
-        kbd_put_keycode(keycode | 0x80);
-    else
-        kbd_put_keycode(keycode & 0x7f);
-}
-
-static void sdl_update_caption(void)
-{
-    char buf[1024];
-    strcpy(buf, "QEMU");
-    if (!vm_running) {
-        strcat(buf, " [Stopped]");
-    }
-    if (gui_grab) {
-        strcat(buf, " - Press Ctrl-Alt to exit grab");
-    }
-    SDL_WM_SetCaption(buf, "QEMU");
-}
-
-static void sdl_hide_cursor(void)
-{
-    if (kbd_mouse_is_absolute()) {
-        SDL_ShowCursor(1);
-        SDL_SetCursor(sdl_cursor_hidden);
-    } else {
-        SDL_ShowCursor(0);
-    }
-}
-
-static void sdl_show_cursor(void)
-{
-    if (!kbd_mouse_is_absolute()) {
-        SDL_ShowCursor(1);
-    }
-}
-
-static void sdl_grab_start(void)
-{
-    sdl_hide_cursor();
-    SDL_WM_GrabInput(SDL_GRAB_ON);
-    /* dummy read to avoid moving the mouse */
-    SDL_GetRelativeMouseState(NULL, NULL);
-    gui_grab = 1;
-    sdl_update_caption();
-}
-
-static void sdl_grab_end(void)
-{
-    SDL_WM_GrabInput(SDL_GRAB_OFF);
-    sdl_show_cursor();
-    gui_grab = 0;
-    sdl_update_caption();
-}
-
-static void sdl_send_mouse_event(int dz)
-{
-    int dx, dy, state, buttons;
-    state = SDL_GetRelativeMouseState(&dx, &dy);
-    buttons = 0;
-    if (state & SDL_BUTTON(SDL_BUTTON_LEFT))
-        buttons |= MOUSE_EVENT_LBUTTON;
-    if (state & SDL_BUTTON(SDL_BUTTON_RIGHT))
-        buttons |= MOUSE_EVENT_RBUTTON;
-    if (state & SDL_BUTTON(SDL_BUTTON_MIDDLE))
-        buttons |= MOUSE_EVENT_MBUTTON;
-
-    if (kbd_mouse_is_absolute()) {
-	if (!absolute_enabled) {
-	    sdl_hide_cursor();
-	    if (gui_grab) {
-		sdl_grab_end();
-	    }
-	    absolute_enabled = 1;
-	}
-
-	SDL_GetMouseState(&dx, &dy);
-	dx = dx * 0x7FFF / width;
-	dy = dy * 0x7FFF / height;
-    }
-
-    kbd_mouse_event(dx, dy, dz, buttons);
-}
-
-static void toggle_full_screen(DisplayState *ds)
-{
-    gui_fullscreen = !gui_fullscreen;
-    sdl_resize(ds, screen->w, screen->h, 0);
-    if (gui_fullscreen) {
-        gui_saved_grab = gui_grab;
-        sdl_grab_start();
-    } else {
-        if (!gui_saved_grab)
-            sdl_grab_end();
-    }
-    vga_hw_invalidate();
-    vga_hw_update();
-}
-
-static void sdl_refresh(DisplayState *ds)
-{
-    SDL_Event ev1, *ev = &ev1;
-    int mod_state;
-                     
-    if (last_vm_running != vm_running) {
-        last_vm_running = vm_running;
-        sdl_update_caption();
-    }
-
-    vga_hw_update();
-
-    while (SDL_PollEvent(ev)) {
-        switch (ev->type) {
-        case SDL_VIDEOEXPOSE:
-            sdl_update(ds, 0, 0, screen->w, screen->h);
-            break;
-        case SDL_KEYDOWN:
-        case SDL_KEYUP:
-            if (ev->type == SDL_KEYDOWN) {
-                mod_state = (SDL_GetModState() & gui_grab_code) ==
-                    gui_grab_code;
-                gui_key_modifier_pressed = mod_state;
-                if (gui_key_modifier_pressed) {
-                    int keycode;
-                    keycode = sdl_keyevent_to_keycode(&ev->key);
-                    switch(keycode) {
-                    case 0x21: /* 'f' key on US keyboard */
-                        toggle_full_screen(ds);
-                        gui_keysym = 1;
-                        break;
-                    case 0x02 ... 0x0a: /* '1' to '9' keys */ 
-                        console_select(keycode - 0x02);
-                        if (!is_graphic_console()) {
-                            /* display grab if going to a text console */
-                            if (gui_grab)
-                                sdl_grab_end();
-                        }
-                        gui_keysym = 1;
-                        break;
-                    default:
-                        break;
-                    }
-                } else if (!is_graphic_console()) {
-                    int keysym;
-                    keysym = 0;
-                    if (ev->key.keysym.mod & (KMOD_LCTRL | KMOD_RCTRL)) {
-                        switch(ev->key.keysym.sym) {
-                        case SDLK_UP: keysym = QEMU_KEY_CTRL_UP; break;
-                        case SDLK_DOWN: keysym = QEMU_KEY_CTRL_DOWN; break;
-                        case SDLK_LEFT: keysym = QEMU_KEY_CTRL_LEFT; break;
-                        case SDLK_RIGHT: keysym = QEMU_KEY_CTRL_RIGHT; break;
-                        case SDLK_HOME: keysym = QEMU_KEY_CTRL_HOME; break;
-                        case SDLK_END: keysym = QEMU_KEY_CTRL_END; break;
-                        case SDLK_PAGEUP: keysym = QEMU_KEY_CTRL_PAGEUP; break;
-                        case SDLK_PAGEDOWN: keysym = QEMU_KEY_CTRL_PAGEDOWN; break;
-                        default: break;
-                        }
-                    } else {
-                        switch(ev->key.keysym.sym) {
-                        case SDLK_UP: keysym = QEMU_KEY_UP; break;
-                        case SDLK_DOWN: keysym = QEMU_KEY_DOWN; break;
-                        case SDLK_LEFT: keysym = QEMU_KEY_LEFT; break;
-                        case SDLK_RIGHT: keysym = QEMU_KEY_RIGHT; break;
-                        case SDLK_HOME: keysym = QEMU_KEY_HOME; break;
-                        case SDLK_END: keysym = QEMU_KEY_END; break;
-                        case SDLK_PAGEUP: keysym = QEMU_KEY_PAGEUP; break;
-                        case SDLK_PAGEDOWN: keysym = QEMU_KEY_PAGEDOWN; break;
-                        case SDLK_BACKSPACE: keysym = QEMU_KEY_BACKSPACE; break;                        case SDLK_DELETE: keysym = QEMU_KEY_DELETE; break;
-                        default: break;
-                        }
-                    }
-                    if (keysym) {
-                        kbd_put_keysym(keysym);
-                    } else if (ev->key.keysym.unicode != 0) {
-                        kbd_put_keysym(ev->key.keysym.unicode);
-                    }
-                }
-            } else if (ev->type == SDL_KEYUP) {
-                mod_state = (ev->key.keysym.mod & gui_grab_code);
-                if (!mod_state) {
-                    if (gui_key_modifier_pressed) {
-                        gui_key_modifier_pressed = 0;
-                        if (gui_keysym == 0) {
-                            /* exit/enter grab if pressing Ctrl-Alt */
-                            if (!gui_grab) {
-                                /* if the application is not active,
-                                   do not try to enter grab state. It
-                                   prevents
-                                   'SDL_WM_GrabInput(SDL_GRAB_ON)'
-                                   from blocking all the application
-                                   (SDL bug). */
-                                if (SDL_GetAppState() & SDL_APPACTIVE)
-                                    sdl_grab_start();
-                            } else {
-                                sdl_grab_end();
-                            }
-                            /* SDL does not send back all the
-                               modifiers key, so we must correct it */
-                            reset_keys();
-                            break;
-                        }
-                        gui_keysym = 0;
-                    }
-                }
-            }
-            if (is_graphic_console()) 
-                sdl_process_key(&ev->key);
-            break;
-        case SDL_QUIT:
-            qemu_system_shutdown_request();
-            break;
-        case SDL_MOUSEMOTION:
-            if (gui_grab || kbd_mouse_is_absolute()) {
-                sdl_send_mouse_event(0);
-            }
-            break;
-        case SDL_MOUSEBUTTONDOWN:
-        case SDL_MOUSEBUTTONUP:
-            {
-                SDL_MouseButtonEvent *bev = &ev->button;
-                if (!gui_grab && !kbd_mouse_is_absolute()) {
-                    if (ev->type == SDL_MOUSEBUTTONDOWN &&
-                        (bev->state & SDL_BUTTON_LMASK)) {
-                        /* start grabbing all events */
-                        sdl_grab_start();
-                    }
-                } else {
-                    int dz;
-                    dz = 0;
-#ifdef SDL_BUTTON_WHEELUP
-                    if (bev->button == SDL_BUTTON_WHEELUP && ev->type == SDL_MOUSEBUTTONDOWN) {
-                        dz = -1;
-                    } else if (bev->button == SDL_BUTTON_WHEELDOWN && ev->type == SDL_MOUSEBUTTONDOWN) {
-                        dz = 1;
-                    }
-#endif               
-                    sdl_send_mouse_event(dz);
-                }
-            }
-            break;
-        case SDL_ACTIVEEVENT:
-            if (gui_grab && ev->active.state == SDL_APPINPUTFOCUS &&
-                !ev->active.gain && !gui_fullscreen_initial_grab) {
-                sdl_grab_end();
-            }
-            break;
-        default:
-            break;
-        }
-    }
-}
-
-static void sdl_cleanup(void) 
-{
-    SDL_Quit();
-}
-
-void sdl_display_init(DisplayState *ds, int full_screen)
-{
-    int flags;
-    uint8_t data = 0;
-
-#if defined(__APPLE__)
-    /* always use generic keymaps */
-    if (!keyboard_layout)
-        keyboard_layout = "en-us";
-#endif
-    if(keyboard_layout) {
-        kbd_layout = init_keyboard_layout(keyboard_layout);
-        if (!kbd_layout)
-            exit(1);
-    }
-
-    flags = SDL_INIT_VIDEO | SDL_INIT_NOPARACHUTE;
-    if (SDL_Init (flags)) {
-        fprintf(stderr, "Could not initialize SDL - exiting\n");
-        exit(1);
-    }
-#ifndef _WIN32
-    /* NOTE: we still want Ctrl-C to work, so we undo the SDL redirections */
-    signal(SIGINT, SIG_DFL);
-    signal(SIGQUIT, SIG_DFL);
-#endif
-
-    ds->dpy_update = sdl_update;
-    ds->dpy_resize = sdl_resize;
-    ds->dpy_refresh = sdl_refresh;
-
-//    sdl_resize(ds, 640, 400, 0);
-    sdl_resize(ds, 240, 320, 0);
-    sdl_update_caption();
-    SDL_EnableKeyRepeat(250, 50);
-    SDL_EnableUNICODE(1);
-    gui_grab = 0;
-
-    sdl_cursor_hidden = SDL_CreateCursor(&data, &data, 8, 1, 0, 0);
-    sdl_cursor_normal = SDL_GetCursor();
-
-    atexit(sdl_cleanup);
-    if (full_screen) {
-        gui_fullscreen = 1;
-        gui_fullscreen_initial_grab = 1;
-        sdl_grab_start();
-    }
-}
diff --git a/shaper.c b/shaper.c
index 2c5492a..a522919 100644
--- a/shaper.c
+++ b/shaper.c
@@ -10,7 +10,8 @@
 ** GNU General Public License for more details.
 */
 #include "shaper.h"
-#include "vl.h"
+#include "qemu-common.h"
+#include "qemu-timer.h"
 #include <stdlib.h>
 
 #define  SHAPER_CLOCK        rt_clock
@@ -163,8 +164,6 @@ netshaper_create( int                do_copy,
 {
     NetShaper  shaper = qemu_malloc(sizeof(*shaper));
 
-    init_timers();
-
     shaper->active = 0;
     shaper->packets = NULL;
     shaper->num_packets = 0;
@@ -462,8 +461,6 @@ netdelay_create( NetShaperSendFunc  send_func )
 {
     NetDelay  delay = qemu_malloc(sizeof(*delay));
 
-    init_timers();
-
     delay->sessions     = NULL;
     delay->num_sessions = 0;
     delay->timer        = qemu_new_timer( SHAPER_CLOCK,
diff --git a/shaper.h b/shaper.h
index 263e19f..45dbd5b 100644
--- a/shaper.h
+++ b/shaper.h
@@ -12,7 +12,7 @@
 #ifndef _SLIRP_SHAPER_H_
 #define _SLIRP_SHAPER_H_
 
-#include "vl.h"
+#include <stddef.h>
 
 /* a NetShaper object is used to limit the throughput of data packets
  * at a fixed rate expressed in bits/seconds
diff --git a/slirp2/ip_input.c b/slirp2/ip_input.c
index 7a9ebf1..fa99a5d 100644
--- a/slirp2/ip_input.c
+++ b/slirp2/ip_input.c
@@ -371,8 +371,7 @@ insert:
 	 * into the new buffer.
 	 */
 	if (m->m_flags & M_EXT) {
-	  int delta;
-	  delta = (char *)ip - m->m_dat;
+	  int delta = (char *)q - m->m_dat;
 	  q = (struct ipasfrag *)(m->m_ext + delta);
 	}
 
diff --git a/slirp2/libslirp.h b/slirp2/libslirp.h
index c9b19a0..e74e71e 100644
--- a/slirp2/libslirp.h
+++ b/slirp2/libslirp.h
@@ -5,7 +5,9 @@
 #include "sockets.h"
 #ifdef _WIN32
 #  define WIN32_LEAN_AND_MEAN
+#  define socket_close  winsock2_socket_close3
 #  include <winsock2.h>
+#  undef socket_close
 #else
 #  include <sys/select.h>
 #endif
diff --git a/slirp2/slirp.c b/slirp2/slirp.c
index 8099aff..23a3e3c 100644
--- a/slirp2/slirp.c
+++ b/slirp2/slirp.c
@@ -1,7 +1,8 @@
 #include "slirp.h"
 #include "proxy_common.h"
-#include "android_utils.h"  /* for dprint */
-#include "android.h"
+#include "android/utils/debug.h"  /* for dprint */
+#include "android/utils/bufprint.h"
+#include "android/android.h"
 #include "sockets.h"
 
 #define  D(...)   VERBOSE_PRINT(slirp,__VA_ARGS__)
diff --git a/slirp2/tcp_subr.c b/slirp2/tcp_subr.c
index fdcb26c..e453877 100644
--- a/slirp2/tcp_subr.c
+++ b/slirp2/tcp_subr.c
@@ -528,7 +528,7 @@ tcp_connect(inso)
 	socket_set_nonblock(s);
 	socket_set_xreuseaddr(s);
 	socket_set_oobinline(s);
-	socket_set_lowlatency(s);
+	socket_set_nodelay(s);
 
 	so->so_faddr_port = sock_address_get_port(&addr);
 	
diff --git a/sockets.c b/sockets.c
index 5c841ba..62c1ee3 100644
--- a/sockets.c
+++ b/sockets.c
@@ -10,12 +10,13 @@
 ** GNU General Public License for more details.
 */
 #include "sockets.h"
-#include "vl.h"
+#include "qemu-common.h"
 #include <fcntl.h>
-#include "android_debug.h"
+#include <stddef.h>
+#include "qemu_debug.h"
 #include <stdlib.h>
 #include <string.h>
-#include "android_utils.h"
+#include "android/utils/path.h"
 
 #ifdef _WIN32
 #  define xxWIN32_LEAN_AND_MEAN
@@ -60,6 +61,7 @@ static int  winsock_error;
     EE(WSA_NOT_ENOUGH_MEMORY,ENOMEM,"not enough memory") \
     EE(WSA_INVALID_PARAMETER,EINVAL,"invalid parameter") \
     EE(WSAEINTR,EINTR,"interrupted function call") \
+	EE(WSAEALREADY,EALREADY,"operation already in progress") \
     EE(WSAEBADF,EBADF,"bad file descriptor") \
     EE(WSAEACCES,EACCES,"permission denied") \
     EE(WSAEFAULT,EFAULT,"bad address") \
@@ -404,6 +406,30 @@ sock_address_get_port( const SockAddress*  a )
     }
 }
 
+void
+sock_address_set_port( SockAddress*  a, uint16_t  port )
+{
+    switch (a->family) {
+    case SOCKET_INET:
+        a->u.inet.port = port;
+        break;
+    case SOCKET_IN6:
+        a->u.in6.port = port;
+        break;
+    default:
+        ;
+    }
+}
+
+const char*
+sock_address_get_path( const SockAddress*  a )
+{
+    if (a->family == SOCKET_UNIX)
+        return a->u._unix.path;
+    else
+        return NULL;
+}
+
 int
 sock_address_get_ip( const SockAddress*  a )
 {
@@ -858,7 +884,7 @@ int socket_set_oobinline(int  fd)
 }
 
 
-int  socket_set_lowlatency(int  fd)
+int  socket_set_nodelay(int  fd)
 {
     return socket_setoption(fd, IPPROTO_TCP, TCP_NODELAY, 1);
 }
diff --git a/sockets.h b/sockets.h
index 7cdc693..274cf32 100644
--- a/sockets.h
+++ b/sockets.h
@@ -41,6 +41,9 @@
 #  ifndef EINPROGRESS
 #    define EINPROGRESS  10036
 #  endif
+#  ifndef EALREADY
+#    define EALREADY     10037
+#  endif
 #  ifndef EDESTADDRREQ
 #    define EDESTADDRREQ 10039
 #  endif
@@ -212,6 +215,12 @@ const char*  sock_address_to_string( const SockAddress*  a );
 /* return the port number of a given socket address, or -1 if it's a Unix one */
 int   sock_address_get_port( const SockAddress*  a );
 
+/* set the port number of a given socket address, don't do anything for Unix ones */
+void  sock_address_set_port( SockAddress*  a, uint16_t  port );
+
+/* return the path of a given Unix socket, returns NULL for non-Unix ones */
+const char*  sock_address_get_path( const SockAddress*  a );
+
 /* return the inet address, or -1 if it's not SOCKET_INET */
 int   sock_address_get_ip( const SockAddress*  a );
 
@@ -257,7 +266,7 @@ int  socket_set_nonblock(int fd);
 int  socket_set_blocking(int fd);
 
 /* disable the TCP Nagle algorithm for lower latency */
-int  socket_set_lowlatency(int fd);
+int  socket_set_nodelay(int fd);
 
 /* send OOB data inline for this socket */
 int  socket_set_oobinline(int  fd);
diff --git a/softmmu-semi.h b/softmmu-semi.h
new file mode 100644
index 0000000..8bf96f4
--- /dev/null
+++ b/softmmu-semi.h
@@ -0,0 +1,70 @@
+/*
+ * Helper routines to provide target memory access for semihosting
+ * syscalls in system emulation mode.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ *
+ * This code is licenced under the GPL
+ */
+
+static inline uint32_t softmmu_tget32(CPUState *env, uint32_t addr)
+{
+    uint32_t val;
+
+    cpu_memory_rw_debug(env, addr, (uint8_t *)&val, 4, 0);
+    return tswap32(val);
+}
+static inline uint32_t softmmu_tget8(CPUState *env, uint32_t addr)
+{
+    uint8_t val;
+
+    cpu_memory_rw_debug(env, addr, &val, 1, 0);
+    return val;
+}
+
+#define get_user_u32(arg, p) ({ arg = softmmu_tget32(env, p) ; 0; })
+#define get_user_u8(arg, p) ({ arg = softmmu_tget8(env, p) ; 0; })
+#define get_user_ual(arg, p) get_user_u32(arg, p)
+
+static inline void softmmu_tput32(CPUState *env, uint32_t addr, uint32_t val)
+{
+    val = tswap32(val);
+    cpu_memory_rw_debug(env, addr, (uint8_t *)&val, 4, 1);
+}
+#define put_user_u32(arg, p) ({ softmmu_tput32(env, p, arg) ; 0; })
+#define put_user_ual(arg, p) put_user_u32(arg, p)
+
+static void *softmmu_lock_user(CPUState *env, uint32_t addr, uint32_t len,
+                               int copy)
+{
+    char *p;
+    /* TODO: Make this something that isn't fixed size.  */
+    p = malloc(len);
+    if (copy)
+        cpu_memory_rw_debug(env, addr, p, len, 0);
+    return p;
+}
+#define lock_user(type, p, len, copy) softmmu_lock_user(env, p, len, copy)
+static char *softmmu_lock_user_string(CPUState *env, uint32_t addr)
+{
+    char *p;
+    char *s;
+    uint8_t c;
+    /* TODO: Make this something that isn't fixed size.  */
+    s = p = malloc(1024);
+    do {
+        cpu_memory_rw_debug(env, addr, &c, 1, 0);
+        addr++;
+        *(p++) = c;
+    } while (c);
+    return s;
+}
+#define lock_user_string(p) softmmu_lock_user_string(env, p)
+static void softmmu_unlock_user(CPUState *env, void *p, target_ulong addr,
+                                target_ulong len)
+{
+    if (len)
+        cpu_memory_rw_debug(env, addr, p, len, 1);
+    free(p);
+}
+#define unlock_user(s, args, len) softmmu_unlock_user(env, s, args, len)
diff --git a/softmmu_defs.h b/softmmu_defs.h
new file mode 100644
index 0000000..e38bb75
--- /dev/null
+++ b/softmmu_defs.h
@@ -0,0 +1,22 @@
+#ifndef SOFTMMU_DEFS_H
+#define SOFTMMU_DEFS_H
+
+uint8_t REGPARM __ldb_mmu(target_ulong addr, int mmu_idx);
+void REGPARM __stb_mmu(target_ulong addr, uint8_t val, int mmu_idx);
+uint16_t REGPARM __ldw_mmu(target_ulong addr, int mmu_idx);
+void REGPARM __stw_mmu(target_ulong addr, uint16_t val, int mmu_idx);
+uint32_t REGPARM __ldl_mmu(target_ulong addr, int mmu_idx);
+void REGPARM __stl_mmu(target_ulong addr, uint32_t val, int mmu_idx);
+uint64_t REGPARM __ldq_mmu(target_ulong addr, int mmu_idx);
+void REGPARM __stq_mmu(target_ulong addr, uint64_t val, int mmu_idx);
+
+uint8_t REGPARM __ldb_cmmu(target_ulong addr, int mmu_idx);
+void REGPARM __stb_cmmu(target_ulong addr, uint8_t val, int mmu_idx);
+uint16_t REGPARM __ldw_cmmu(target_ulong addr, int mmu_idx);
+void REGPARM __stw_cmmu(target_ulong addr, uint16_t val, int mmu_idx);
+uint32_t REGPARM __ldl_cmmu(target_ulong addr, int mmu_idx);
+void REGPARM __stl_cmmu(target_ulong addr, uint32_t val, int mmu_idx);
+uint64_t REGPARM __ldq_cmmu(target_ulong addr, int mmu_idx);
+void REGPARM __stq_cmmu(target_ulong addr, uint64_t val, int mmu_idx);
+
+#endif
diff --git a/softmmu_exec.h b/softmmu_exec.h
index 3b789ee..9cc4535 100644
--- a/softmmu_exec.h
+++ b/softmmu_exec.h
@@ -1,10 +1,18 @@
 /* Common softmmu definitions and inline routines.  */
 
-#define ldul_user ldl_user
-#define ldul_kernel ldl_kernel
+/* XXX: find something cleaner.
+ * Furthermore, this is false for 64 bits targets
+ */
+#define ldul_user       ldl_user
+#define ldul_kernel     ldl_kernel
+#define ldul_hypv       ldl_hypv
+#define ldul_executive  ldl_executive
+#define ldul_supervisor ldl_supervisor
+
+#include "softmmu_defs.h"
 
 #define ACCESS_TYPE 0
-#define MEMSUFFIX _kernel
+#define MEMSUFFIX MMU_MODE0_SUFFIX
 #define DATA_SIZE 1
 #include "softmmu_header.h"
 
@@ -20,7 +28,7 @@
 #undef MEMSUFFIX
 
 #define ACCESS_TYPE 1
-#define MEMSUFFIX _user
+#define MEMSUFFIX MMU_MODE1_SUFFIX
 #define DATA_SIZE 1
 #include "softmmu_header.h"
 
@@ -35,8 +43,50 @@
 #undef ACCESS_TYPE
 #undef MEMSUFFIX
 
-/* these access are slower, they must be as rare as possible */
+#if (NB_MMU_MODES >= 3)
+
 #define ACCESS_TYPE 2
+#define MEMSUFFIX MMU_MODE2_SUFFIX
+#define DATA_SIZE 1
+#include "softmmu_header.h"
+
+#define DATA_SIZE 2
+#include "softmmu_header.h"
+
+#define DATA_SIZE 4
+#include "softmmu_header.h"
+
+#define DATA_SIZE 8
+#include "softmmu_header.h"
+#undef ACCESS_TYPE
+#undef MEMSUFFIX
+
+#if (NB_MMU_MODES >= 4)
+
+#define ACCESS_TYPE 3
+#define MEMSUFFIX MMU_MODE3_SUFFIX
+#define DATA_SIZE 1
+#include "softmmu_header.h"
+
+#define DATA_SIZE 2
+#include "softmmu_header.h"
+
+#define DATA_SIZE 4
+#include "softmmu_header.h"
+
+#define DATA_SIZE 8
+#include "softmmu_header.h"
+#undef ACCESS_TYPE
+#undef MEMSUFFIX
+
+#if (NB_MMU_MODES > 4)
+#error "NB_MMU_MODES > 4 is not supported for now"
+#endif /* (NB_MMU_MODES > 4) */
+#endif /* (NB_MMU_MODES == 4) */
+#endif /* (NB_MMU_MODES >= 3) */
+
+/* these access are slower, they must be as rare as possible */
+#define ACCESS_TYPE (NB_MMU_MODES)
 #define MEMSUFFIX _data
 #define DATA_SIZE 1
 #include "softmmu_header.h"
diff --git a/softmmu_header.h b/softmmu_header.h
index 25062a7..9649717 100644
--- a/softmmu_header.h
+++ b/softmmu_header.h
@@ -1,6 +1,6 @@
 /*
  *  Software MMU support
- * 
+ *
  *  Copyright (c) 2003 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -39,52 +39,19 @@
 #error unsupported data size
 #endif
 
-#if ACCESS_TYPE == 0
+#if ACCESS_TYPE < (NB_MMU_MODES)
 
-#define CPU_MEM_INDEX 0
+#define CPU_MMU_INDEX ACCESS_TYPE
 #define MMUSUFFIX _mmu
 
-#elif ACCESS_TYPE == 1
+#elif ACCESS_TYPE == (NB_MMU_MODES)
 
-#define CPU_MEM_INDEX 1
+#define CPU_MMU_INDEX (cpu_mmu_index(env))
 #define MMUSUFFIX _mmu
 
-#elif ACCESS_TYPE == 2
-
-#ifdef TARGET_I386
-#define CPU_MEM_INDEX ((env->hflags & HF_CPL_MASK) == 3)
-#elif defined (TARGET_PPC)
-#define CPU_MEM_INDEX (msr_pr)
-#elif defined (TARGET_MIPS)
-#define CPU_MEM_INDEX ((env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM)
-#elif defined (TARGET_SPARC)
-#define CPU_MEM_INDEX ((env->psrs) == 0)
-#elif defined (TARGET_ARM)
-#define CPU_MEM_INDEX ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR)
-#elif defined (TARGET_SH4)
-#define CPU_MEM_INDEX ((env->sr & SR_MD) == 0)
-#else
-#error unsupported CPU
-#endif
-#define MMUSUFFIX _mmu
+#elif ACCESS_TYPE == (NB_MMU_MODES + 1)
 
-#elif ACCESS_TYPE == 3
-
-#ifdef TARGET_I386
-#define CPU_MEM_INDEX ((env->hflags & HF_CPL_MASK) == 3)
-#elif defined (TARGET_PPC)
-#define CPU_MEM_INDEX (msr_pr)
-#elif defined (TARGET_MIPS)
-#define CPU_MEM_INDEX ((env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM)
-#elif defined (TARGET_SPARC)
-#define CPU_MEM_INDEX ((env->psrs) == 0)
-#elif defined (TARGET_ARM)
-#define CPU_MEM_INDEX ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR)
-#elif defined (TARGET_SH4)
-#define CPU_MEM_INDEX ((env->sr & SR_MD) == 0)
-#else
-#error unsupported CPU
-#endif
+#define CPU_MMU_INDEX (cpu_mmu_index(env))
 #define MMUSUFFIX _cmmu
 
 #else
@@ -97,20 +64,14 @@
 #define RES_TYPE int
 #endif
 
-#if ACCESS_TYPE == 3
+#if ACCESS_TYPE == (NB_MMU_MODES + 1)
 #define ADDR_READ addr_code
 #else
 #define ADDR_READ addr_read
 #endif
 
-DATA_TYPE REGPARM(1) glue(glue(__ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
-                                                         int is_user);
-void REGPARM(2) glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr, DATA_TYPE v, int is_user);
-
 #if (DATA_SIZE <= 4) && (TARGET_LONG_BITS == 32) && defined(__i386__) && \
-    (ACCESS_TYPE <= 1) && defined(ASM_SOFTMMU) && (__GNUC__ < 4)
-
-#define CPU_TLB_ENTRY_BITS 4
+    (ACCESS_TYPE < NB_MMU_MODES) && defined(ASM_SOFTMMU)
 
 static inline RES_TYPE glue(glue(ld, USUFFIX), MEMSUFFIX)(target_ulong ptr)
 {
@@ -125,9 +86,8 @@ static inline RES_TYPE glue(glue(ld, USUFFIX), MEMSUFFIX)(target_ulong ptr)
                   "cmpl (%%edx), %%eax\n"
                   "movl %1, %%eax\n"
                   "je 1f\n"
-                  "pushl %6\n"
+                  "movl %6, %%edx\n"
                   "call %7\n"
-                  "popl %%edx\n"
                   "movl %%eax, %0\n"
                   "jmp 2f\n"
                   "1:\n"
@@ -143,14 +103,14 @@ static inline RES_TYPE glue(glue(ld, USUFFIX), MEMSUFFIX)(target_ulong ptr)
 #endif
                   "2:\n"
                   : "=r" (res)
-                  : "r" (ptr), 
-                  "i" ((CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS), 
-                  "i" (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS), 
+                  : "r" (ptr),
+                  "i" ((CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS),
+                  "i" (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS),
                   "i" (TARGET_PAGE_MASK | (DATA_SIZE - 1)),
-                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MEM_INDEX][0].addr_read)),
-                  "i" (CPU_MEM_INDEX),
+                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MMU_INDEX][0].addr_read)),
+                  "i" (CPU_MMU_INDEX),
                   "m" (*(uint8_t *)&glue(glue(__ld, SUFFIX), MMUSUFFIX))
-                  : "%eax", "%edx", "memory", "cc");
+                  : "%eax", "%ecx", "%edx", "memory", "cc");
     return res;
 }
 
@@ -168,9 +128,8 @@ static inline int glue(glue(lds, SUFFIX), MEMSUFFIX)(target_ulong ptr)
                   "cmpl (%%edx), %%eax\n"
                   "movl %1, %%eax\n"
                   "je 1f\n"
-                  "pushl %6\n"
+                  "movl %6, %%edx\n"
                   "call %7\n"
-                  "popl %%edx\n"
 #if DATA_SIZE == 1
                   "movsbl %%al, %0\n"
 #elif DATA_SIZE == 2
@@ -190,21 +149,20 @@ static inline int glue(glue(lds, SUFFIX), MEMSUFFIX)(target_ulong ptr)
 #endif
                   "2:\n"
                   : "=r" (res)
-                  : "r" (ptr), 
-                  "i" ((CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS), 
-                  "i" (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS), 
+                  : "r" (ptr),
+                  "i" ((CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS),
+                  "i" (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS),
                   "i" (TARGET_PAGE_MASK | (DATA_SIZE - 1)),
-                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MEM_INDEX][0].addr_read)),
-                  "i" (CPU_MEM_INDEX),
+                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MMU_INDEX][0].addr_read)),
+                  "i" (CPU_MMU_INDEX),
                   "m" (*(uint8_t *)&glue(glue(__ld, SUFFIX), MMUSUFFIX))
-                  : "%eax", "%edx", "memory", "cc");
+                  : "%eax", "%ecx", "%edx", "memory", "cc");
     return res;
 }
 #endif
 
-static inline void glue(glue(st, SUFFIX), MEMSUFFIX)(target_ulong ptr, RES_TYPE val)
+static inline void glue(glue(st, SUFFIX), MEMSUFFIX)(target_ulong ptr, RES_TYPE v)
 {
-    RES_TYPE v = val;
     asm volatile ("movl %0, %%edx\n"
                   "movl %0, %%eax\n"
                   "shrl %3, %%edx\n"
@@ -223,9 +181,8 @@ static inline void glue(glue(st, SUFFIX), MEMSUFFIX)(target_ulong ptr, RES_TYPE
 #else
 #error unsupported size
 #endif
-                  "pushl %6\n"
+                  "movl %6, %%ecx\n"
                   "call %7\n"
-                  "popl %%eax\n"
                   "jmp 2f\n"
                   "1:\n"
                   "addl 8(%%edx), %%eax\n"
@@ -239,16 +196,20 @@ static inline void glue(glue(st, SUFFIX), MEMSUFFIX)(target_ulong ptr, RES_TYPE
 #error unsupported size
 #endif
                   "2:\n"
-                  : 
-                  : "r" (ptr), 
-                  "q" (v), 
-                  "i" ((CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS), 
-                  "i" (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS), 
+                  :
+                  : "r" (ptr),
+#if DATA_SIZE == 1
+                  "q" (v),
+#else
+                  "r" (v),
+#endif
+                  "i" ((CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS),
+                  "i" (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS),
                   "i" (TARGET_PAGE_MASK | (DATA_SIZE - 1)),
-                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MEM_INDEX][0].addr_write)),
-                  "i" (CPU_MEM_INDEX),
+                  "m" (*(uint32_t *)offsetof(CPUState, tlb_table[CPU_MMU_INDEX][0].addr_write)),
+                  "i" (CPU_MMU_INDEX),
                   "m" (*(uint8_t *)&glue(glue(__st, SUFFIX), MMUSUFFIX))
-                  : "%eax", "%edx", "memory", "cc");
+                  : "%eax", "%ecx", "%edx", "memory", "cc");
 }
 
 #else
@@ -257,20 +218,20 @@ static inline void glue(glue(st, SUFFIX), MEMSUFFIX)(target_ulong ptr, RES_TYPE
 
 static inline RES_TYPE glue(glue(ld, USUFFIX), MEMSUFFIX)(target_ulong ptr)
 {
-    int index;
+    int page_index;
     RES_TYPE res;
     target_ulong addr;
     unsigned long physaddr;
-    int is_user;
+    int mmu_idx;
 
     addr = ptr;
-    index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    is_user = CPU_MEM_INDEX;
-    if (__builtin_expect(env->tlb_table[is_user][index].ADDR_READ != 
-                         (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))), 0)) {
-        res = glue(glue(__ld, SUFFIX), MMUSUFFIX)(addr, is_user);
+    page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
+    mmu_idx = CPU_MMU_INDEX;
+    if (unlikely(env->tlb_table[mmu_idx][page_index].ADDR_READ !=
+                 (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))))) {
+        res = glue(glue(__ld, SUFFIX), MMUSUFFIX)(addr, mmu_idx);
     } else {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][page_index].addend;
         res = glue(glue(ld, USUFFIX), _raw)((uint8_t *)physaddr);
     }
     return res;
@@ -279,53 +240,53 @@ static inline RES_TYPE glue(glue(ld, USUFFIX), MEMSUFFIX)(target_ulong ptr)
 #if DATA_SIZE <= 2
 static inline int glue(glue(lds, SUFFIX), MEMSUFFIX)(target_ulong ptr)
 {
-    int res, index;
+    int res, page_index;
     target_ulong addr;
     unsigned long physaddr;
-    int is_user;
+    int mmu_idx;
 
     addr = ptr;
-    index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    is_user = CPU_MEM_INDEX;
-    if (__builtin_expect(env->tlb_table[is_user][index].ADDR_READ != 
-                         (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))), 0)) {
-        res = (DATA_STYPE)glue(glue(__ld, SUFFIX), MMUSUFFIX)(addr, is_user);
+    page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
+    mmu_idx = CPU_MMU_INDEX;
+    if (unlikely(env->tlb_table[mmu_idx][page_index].ADDR_READ !=
+                 (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))))) {
+        res = (DATA_STYPE)glue(glue(__ld, SUFFIX), MMUSUFFIX)(addr, mmu_idx);
     } else {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][page_index].addend;
         res = glue(glue(lds, SUFFIX), _raw)((uint8_t *)physaddr);
     }
     return res;
 }
 #endif
 
-#if ACCESS_TYPE != 3
+#if ACCESS_TYPE != (NB_MMU_MODES + 1)
 
 /* generic store macro */
 
 static inline void glue(glue(st, SUFFIX), MEMSUFFIX)(target_ulong ptr, RES_TYPE v)
 {
-    int index;
+    int page_index;
     target_ulong addr;
     unsigned long physaddr;
-    int is_user;
+    int mmu_idx;
 
     addr = ptr;
-    index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    is_user = CPU_MEM_INDEX;
-    if (__builtin_expect(env->tlb_table[is_user][index].addr_write != 
-                         (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))), 0)) {
-        glue(glue(__st, SUFFIX), MMUSUFFIX)(addr, v, is_user);
+    page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
+    mmu_idx = CPU_MMU_INDEX;
+    if (unlikely(env->tlb_table[mmu_idx][page_index].addr_write !=
+                 (addr & (TARGET_PAGE_MASK | (DATA_SIZE - 1))))) {
+        glue(glue(__st, SUFFIX), MMUSUFFIX)(addr, v, mmu_idx);
     } else {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][page_index].addend;
         glue(glue(st, SUFFIX), _raw)((uint8_t *)physaddr, v);
     }
 }
 
-#endif /* ACCESS_TYPE != 3 */
+#endif /* ACCESS_TYPE != (NB_MMU_MODES + 1) */
 
 #endif /* !asm */
 
-#if ACCESS_TYPE != 3
+#if ACCESS_TYPE != (NB_MMU_MODES + 1)
 
 #if DATA_SIZE == 8
 static inline float64 glue(ldfq, MEMSUFFIX)(target_ulong ptr)
@@ -371,7 +332,7 @@ static inline void glue(stfl, MEMSUFFIX)(target_ulong ptr, float32 v)
 }
 #endif /* DATA_SIZE == 4 */
 
-#endif /* ACCESS_TYPE != 3 */
+#endif /* ACCESS_TYPE != (NB_MMU_MODES + 1) */
 
 #undef RES_TYPE
 #undef DATA_TYPE
@@ -379,6 +340,6 @@ static inline void glue(stfl, MEMSUFFIX)(target_ulong ptr, float32 v)
 #undef SUFFIX
 #undef USUFFIX
 #undef DATA_SIZE
-#undef CPU_MEM_INDEX
+#undef CPU_MMU_INDEX
 #undef MMUSUFFIX
 #undef ADDR_READ
diff --git a/softmmu_template.h b/softmmu_template.h
index 3f0edbf..98dd378 100644
--- a/softmmu_template.h
+++ b/softmmu_template.h
@@ -1,6 +1,6 @@
 /*
  *  Software MMU support
- * 
+ *
  *  Copyright (c) 2003 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -47,16 +47,23 @@
 #define ADDR_READ addr_read
 #endif
 
-static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr, 
-                                                        int is_user,
+static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
+                                                        int mmu_idx,
                                                         void *retaddr);
-static inline DATA_TYPE glue(io_read, SUFFIX)(target_phys_addr_t physaddr, 
-                                              target_ulong tlb_addr)
+static inline DATA_TYPE glue(io_read, SUFFIX)(target_phys_addr_t physaddr,
+                                              target_ulong addr,
+                                              void *retaddr)
 {
     DATA_TYPE res;
     int index;
+    index = (physaddr >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
+    physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
+    env->mem_io_pc = (unsigned long)retaddr;
+    if (index > (IO_MEM_NOTDIRTY >> IO_MEM_SHIFT)
+            && !can_do_io(env)) {
+        cpu_io_recompile(env, retaddr);
+    }
 
-    index = (tlb_addr >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
 #if SHIFT <= 2
     res = io_mem_read[index][SHIFT](io_mem_opaque[index], physaddr);
 #else
@@ -75,95 +82,91 @@ static inline DATA_TYPE glue(io_read, SUFFIX)(target_phys_addr_t physaddr,
 }
 
 /* handle all cases except unaligned access which span two pages */
-DATA_TYPE REGPARM(1) glue(glue(__ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
-                                                         int is_user)
+DATA_TYPE REGPARM glue(glue(__ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
+                                                      int mmu_idx)
 {
     DATA_TYPE res;
     int index;
     target_ulong tlb_addr;
-    target_phys_addr_t physaddr;
+    target_phys_addr_t addend;
     void *retaddr;
-    
+
     /* test if there is match for unaligned or IO access */
     /* XXX: could done more in memory macro in a non portable way */
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
  redo:
-    tlb_addr = env->tlb_table[is_user][index].ADDR_READ;
+    tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
     if ((addr & TARGET_PAGE_MASK) == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
         if (tlb_addr & ~TARGET_PAGE_MASK) {
             /* IO access */
             if ((addr & (DATA_SIZE - 1)) != 0)
-            {
-                retaddr = GETPC();
-#ifdef IO_ALIGNED_ONLY
-                do_unaligned_access(addr, READ_ACCESS_TYPE, is_user, retaddr);
-#endif
-                res = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(addr, is_user, retaddr);
-            }
-            else
-                res = glue(io_read, SUFFIX)(physaddr, tlb_addr);
-        } 
-        else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
+                goto do_unaligned_access;
+            retaddr = GETPC();
+            addend = env->iotlb[mmu_idx][index];
+            res = glue(io_read, SUFFIX)(addend, addr, retaddr);
+        } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
             /* slow unaligned access (it spans two pages or IO) */
+        do_unaligned_access:
             retaddr = GETPC();
 #ifdef ALIGNED_ONLY
-            do_unaligned_access(addr, READ_ACCESS_TYPE, is_user, retaddr);
+            do_unaligned_access(addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
 #endif
-            res = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(addr, 
-                                                         is_user, retaddr);
+            res = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(addr,
+                                                         mmu_idx, retaddr);
         } else {
             /* unaligned/aligned access in the same page */
 #ifdef ALIGNED_ONLY
             if ((addr & (DATA_SIZE - 1)) != 0) {
                 retaddr = GETPC();
-                do_unaligned_access(addr, READ_ACCESS_TYPE, is_user, retaddr);
+                do_unaligned_access(addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
             }
 #endif
-            res = glue(glue(ld, USUFFIX), _raw)((uint8_t *)(long)physaddr);
+            addend = env->tlb_table[mmu_idx][index].addend;
+            res = glue(glue(ld, USUFFIX), _raw)((uint8_t *)(long)(addr+addend));
         }
     } else {
         /* the page is not in the TLB : fill it */
         retaddr = GETPC();
-#ifdef zzALIGNED_ONLY
+#ifdef ALIGNED_ONLY
         if ((addr & (DATA_SIZE - 1)) != 0)
-            do_unaligned_access(addr, READ_ACCESS_TYPE, is_user, retaddr);
+            do_unaligned_access(addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
 #endif
-        tlb_fill(addr, READ_ACCESS_TYPE, is_user, retaddr);
+        tlb_fill(addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
         goto redo;
     }
     return res;
 }
 
 /* handle all unaligned cases */
-static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr, 
-                                                        int is_user,
+static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
+                                                        int mmu_idx,
                                                         void *retaddr)
 {
     DATA_TYPE res, res1, res2;
     int index, shift;
-    target_phys_addr_t physaddr;
+    target_phys_addr_t addend;
     target_ulong tlb_addr, addr1, addr2;
 
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
  redo:
-    tlb_addr = env->tlb_table[is_user][index].ADDR_READ;
+    tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
     if ((addr & TARGET_PAGE_MASK) == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
         if (tlb_addr & ~TARGET_PAGE_MASK) {
             /* IO access */
             if ((addr & (DATA_SIZE - 1)) != 0)
                 goto do_unaligned_access;
-            res = glue(io_read, SUFFIX)(physaddr, tlb_addr);
+            retaddr = GETPC();
+            addend = env->iotlb[mmu_idx][index];
+            res = glue(io_read, SUFFIX)(addend, addr, retaddr);
         } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
         do_unaligned_access:
             /* slow unaligned access (it spans two pages) */
             addr1 = addr & ~(DATA_SIZE - 1);
             addr2 = addr1 + DATA_SIZE;
-            res1 = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(addr1, 
-                                                          is_user, retaddr);
-            res2 = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(addr2, 
-                                                          is_user, retaddr);
+            res1 = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(addr1,
+                                                          mmu_idx, retaddr);
+            res2 = glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(addr2,
+                                                          mmu_idx, retaddr);
             shift = (addr & (DATA_SIZE - 1)) * 8;
 #ifdef TARGET_WORDS_BIGENDIAN
             res = (res1 << shift) | (res2 >> ((DATA_SIZE * 8) - shift));
@@ -173,11 +176,12 @@ static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
             res = (DATA_TYPE)res;
         } else {
             /* unaligned/aligned access in the same page */
-            res = glue(glue(ld, USUFFIX), _raw)((uint8_t *)(long)physaddr);
+            addend = env->tlb_table[mmu_idx][index].addend;
+            res = glue(glue(ld, USUFFIX), _raw)((uint8_t *)(long)(addr+addend));
         }
     } else {
         /* the page is not in the TLB : fill it */
-        tlb_fill(addr, READ_ACCESS_TYPE, is_user, retaddr);
+        tlb_fill(addr, READ_ACCESS_TYPE, mmu_idx, retaddr);
         goto redo;
     }
     return res;
@@ -185,21 +189,26 @@ static DATA_TYPE glue(glue(slow_ld, SUFFIX), MMUSUFFIX)(target_ulong addr,
 
 #ifndef SOFTMMU_CODE_ACCESS
 
-static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(target_ulong addr, 
-                                                   DATA_TYPE val, 
-                                                   int is_user,
+static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(target_ulong addr,
+                                                   DATA_TYPE val,
+                                                   int mmu_idx,
                                                    void *retaddr);
 
-static inline void glue(io_write, SUFFIX)(target_phys_addr_t physaddr, 
+static inline void glue(io_write, SUFFIX)(target_phys_addr_t physaddr,
                                           DATA_TYPE val,
-                                          target_ulong tlb_addr,
+                                          target_ulong addr,
                                           void *retaddr)
 {
     int index;
+    index = (physaddr >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
+    physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
+    if (index > (IO_MEM_NOTDIRTY >> IO_MEM_SHIFT)
+            && !can_do_io(env)) {
+        cpu_io_recompile(env, retaddr);
+    }
 
-    index = (tlb_addr >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
-    env->mem_write_vaddr = tlb_addr;
-    env->mem_write_pc = (unsigned long)retaddr;
+    env->mem_io_vaddr = addr;
+    env->mem_io_pc = (unsigned long)retaddr;
 #if SHIFT <= 2
     io_mem_write[index][SHIFT](io_mem_opaque[index], physaddr, val);
 #else
@@ -216,102 +225,99 @@ static inline void glue(io_write, SUFFIX)(target_phys_addr_t physaddr,
 #endif
 }
 
-void REGPARM(2) glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr, 
-                                                    DATA_TYPE val,
-                                                    int is_user)
+void REGPARM glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr,
+                                                 DATA_TYPE val,
+                                                 int mmu_idx)
 {
-    target_phys_addr_t physaddr;
+    target_phys_addr_t addend;
     target_ulong tlb_addr;
     void *retaddr;
     int index;
-   
-    env->mem_write_vaddr = addr; 
+
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
  redo:
-    tlb_addr = env->tlb_table[is_user][index].addr_write;
+    tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
     if ((addr & TARGET_PAGE_MASK) == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
         if (tlb_addr & ~TARGET_PAGE_MASK) {
             /* IO access */
-            retaddr = GETPC();
             if ((addr & (DATA_SIZE - 1)) != 0)
-            {
-#ifdef IO_ALIGNED_ONLY
-                do_unaligned_acess(addr, 1, is_user, retaddr);
-#endif
-                glue(glue(slow_st, SUFFIX), MMUSUFFIX)(addr, val, is_user, retaddr);
-            }
-            else
-                glue(io_write, SUFFIX)(physaddr, val, tlb_addr, retaddr);
-        }
-        else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
+                goto do_unaligned_access;
+            retaddr = GETPC();
+            addend = env->iotlb[mmu_idx][index];
+            glue(io_write, SUFFIX)(addend, val, addr, retaddr);
+        } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
+        do_unaligned_access:
             retaddr = GETPC();
 #ifdef ALIGNED_ONLY
-            do_unaligned_access(addr, 1, is_user, retaddr);
+            do_unaligned_access(addr, 1, mmu_idx, retaddr);
 #endif
-            glue(glue(slow_st, SUFFIX), MMUSUFFIX)(addr, val, 
-                                                   is_user, retaddr);
+            glue(glue(slow_st, SUFFIX), MMUSUFFIX)(addr, val,
+                                                   mmu_idx, retaddr);
         } else {
             /* aligned/unaligned access in the same page */
 #ifdef ALIGNED_ONLY
             if ((addr & (DATA_SIZE - 1)) != 0) {
                 retaddr = GETPC();
-                do_unaligned_access(addr, 1, is_user, retaddr);
+                do_unaligned_access(addr, 1, mmu_idx, retaddr);
             }
 #endif
-            glue(glue(st, SUFFIX), _raw)((uint8_t *)(long)physaddr, val);
+            addend = env->tlb_table[mmu_idx][index].addend;
+            glue(glue(st, SUFFIX), _raw)((uint8_t *)(long)(addr+addend), val);
         }
     } else {
         /* the page is not in the TLB : fill it */
         retaddr = GETPC();
 #ifdef ALIGNED_ONLY
         if ((addr & (DATA_SIZE - 1)) != 0)
-            do_unaligned_access(addr, 1, is_user, retaddr);
+            do_unaligned_access(addr, 1, mmu_idx, retaddr);
 #endif
-        tlb_fill(addr, 1, is_user, retaddr);
+        tlb_fill(addr, 1, mmu_idx, retaddr);
         goto redo;
     }
 }
 
 /* handles all unaligned cases */
-static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(target_ulong addr, 
+static void glue(glue(slow_st, SUFFIX), MMUSUFFIX)(target_ulong addr,
                                                    DATA_TYPE val,
-                                                   int is_user,
+                                                   int mmu_idx,
                                                    void *retaddr)
 {
-    target_phys_addr_t physaddr;
+    target_phys_addr_t addend;
     target_ulong tlb_addr;
     int index, i;
 
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
  redo:
-    tlb_addr = env->tlb_table[is_user][index].addr_write;
+    tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
     if ((addr & TARGET_PAGE_MASK) == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
         if (tlb_addr & ~TARGET_PAGE_MASK) {
             /* IO access */
             if ((addr & (DATA_SIZE - 1)) != 0)
                 goto do_unaligned_access;
-            glue(io_write, SUFFIX)(physaddr, val, tlb_addr, retaddr);
+            addend = env->iotlb[mmu_idx][index];
+            glue(io_write, SUFFIX)(addend, val, addr, retaddr);
         } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
         do_unaligned_access:
             /* XXX: not efficient, but simple */
-            for(i = 0;i < DATA_SIZE; i++) {
+            /* Note: relies on the fact that tlb_fill() does not remove the
+             * previous page from the TLB cache.  */
+            for(i = DATA_SIZE - 1; i >= 0; i--) {
 #ifdef TARGET_WORDS_BIGENDIAN
-                glue(slow_stb, MMUSUFFIX)(addr + i, val >> (((DATA_SIZE - 1) * 8) - (i * 8)), 
-                                          is_user, retaddr);
+                glue(slow_stb, MMUSUFFIX)(addr + i, val >> (((DATA_SIZE - 1) * 8) - (i * 8)),
+                                          mmu_idx, retaddr);
 #else
-                glue(slow_stb, MMUSUFFIX)(addr + i, val >> (i * 8), 
-                                          is_user, retaddr);
+                glue(slow_stb, MMUSUFFIX)(addr + i, val >> (i * 8),
+                                          mmu_idx, retaddr);
 #endif
             }
         } else {
             /* aligned/unaligned access in the same page */
-            glue(glue(st, SUFFIX), _raw)((uint8_t *)(long)physaddr, val);
+            addend = env->tlb_table[mmu_idx][index].addend;
+            glue(glue(st, SUFFIX), _raw)((uint8_t *)(long)(addr+addend), val);
         }
     } else {
         /* the page is not in the TLB : fill it */
-        tlb_fill(addr, 1, is_user, retaddr);
+        tlb_fill(addr, 1, mmu_idx, retaddr);
         goto redo;
     }
 }
diff --git a/sparc.ld b/sparc.ld
index 6333928..26ab415 100644
--- a/sparc.ld
+++ b/sparc.ld
@@ -1,5 +1,5 @@
 OUTPUT_FORMAT("elf32-sparc", "elf32-sparc",
-	      "elf32-sparc")
+              "elf32-sparc")
 OUTPUT_ARCH(sparc)
 SEARCH_DIR(/lib); SEARCH_DIR(/usr/lib); SEARCH_DIR(/usr/local/lib); SEARCH_DIR(/usr/alpha-unknown-linux-gnu/lib);
 ENTRY(_start)
@@ -7,13 +7,13 @@ SECTIONS
 {
   /* Read-only sections, merged into text segment: */
   . = 0x60000000 + SIZEOF_HEADERS;
-  .interp     : { *(.interp) 	}
-  .hash          : { *(.hash)		}
-  .dynsym        : { *(.dynsym)		}
-  .dynstr        : { *(.dynstr)		}
-  .gnu.version   : { *(.gnu.version)	}
-  .gnu.version_d   : { *(.gnu.version_d)	}
-  .gnu.version_r   : { *(.gnu.version_r)	}
+  .interp     : { *(.interp)    }
+  .hash          : { *(.hash)           }
+  .dynsym        : { *(.dynsym)         }
+  .dynstr        : { *(.dynstr)         }
+  .gnu.version   : { *(.gnu.version)    }
+  .gnu.version_d   : { *(.gnu.version_d)        }
+  .gnu.version_r   : { *(.gnu.version_r)        }
   .rel.text      :
     { *(.rel.text) *(.rel.gnu.linkonce.t*) }
   .rela.text     :
@@ -26,21 +26,21 @@ SECTIONS
     { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
   .rela.rodata   :
     { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
-  .rel.got       : { *(.rel.got)		}
-  .rela.got      : { *(.rela.got)		}
-  .rel.ctors     : { *(.rel.ctors)	}
-  .rela.ctors    : { *(.rela.ctors)	}
-  .rel.dtors     : { *(.rel.dtors)	}
-  .rela.dtors    : { *(.rela.dtors)	}
-  .rel.init      : { *(.rel.init)	}
-  .rela.init     : { *(.rela.init)	}
-  .rel.fini      : { *(.rel.fini)	}
-  .rela.fini     : { *(.rela.fini)	}
-  .rel.bss       : { *(.rel.bss)		}
-  .rela.bss      : { *(.rela.bss)		}
-  .rel.plt       : { *(.rel.plt)		}
-  .rela.plt      : { *(.rela.plt)		}
-  .init          : { *(.init)	} =0x47ff041f
+  .rel.got       : { *(.rel.got)                }
+  .rela.got      : { *(.rela.got)               }
+  .rel.ctors     : { *(.rel.ctors)      }
+  .rela.ctors    : { *(.rela.ctors)     }
+  .rel.dtors     : { *(.rel.dtors)      }
+  .rela.dtors    : { *(.rela.dtors)     }
+  .rel.init      : { *(.rel.init)       }
+  .rela.init     : { *(.rela.init)      }
+  .rel.fini      : { *(.rel.fini)       }
+  .rela.fini     : { *(.rela.fini)      }
+  .rel.bss       : { *(.rel.bss)                }
+  .rela.bss      : { *(.rela.bss)               }
+  .rel.plt       : { *(.rel.plt)                }
+  .rela.plt      : { *(.rela.plt)               }
+  .init          : { *(.init)   } =0x47ff041f
   .text      :
   {
     *(.text)
@@ -64,6 +64,8 @@ SECTIONS
     CONSTRUCTORS
   }
   .data1   : { *(.data1) }
+  .tdata    : { *(.tdata) }
+  .tbss    : { *(.tbss) }
   .ctors         :
   {
     *(.ctors)
@@ -72,7 +74,7 @@ SECTIONS
   {
     *(.dtors)
   }
-  .plt      : { *(.plt)	}
+  .plt      : { *(.plt) }
   .got           : { *(.got.plt) *(.got) }
   .dynamic       : { *(.dynamic) }
   /* We want the small data sections together, so single-instruction offsets
@@ -125,4 +127,5 @@ SECTIONS
   .debug_typenames 0 : { *(.debug_typenames) }
   .debug_varnames  0 : { *(.debug_varnames) }
   /* These must appear regardless of  .  */
+  /DISCARD/ : { *(.note.GNU-stack) *(.note.ABI-tag) }
 }
diff --git a/sysemu.h b/sysemu.h
new file mode 100644
index 0000000..b12fae0
--- /dev/null
+++ b/sysemu.h
@@ -0,0 +1,184 @@
+#ifndef SYSEMU_H
+#define SYSEMU_H
+/* Misc. things related to the system emulator.  */
+
+/* vl.c */
+extern const char *bios_name;
+extern const char *bios_dir;
+
+extern int vm_running;
+extern const char *qemu_name;
+
+typedef struct vm_change_state_entry VMChangeStateEntry;
+typedef void VMChangeStateHandler(void *opaque, int running);
+typedef void VMStopHandler(void *opaque, int reason);
+
+VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb,
+                                                     void *opaque);
+void qemu_del_vm_change_state_handler(VMChangeStateEntry *e);
+
+int qemu_add_vm_stop_handler(VMStopHandler *cb, void *opaque);
+void qemu_del_vm_stop_handler(VMStopHandler *cb, void *opaque);
+
+void vm_start(void);
+void vm_stop(int reason);
+
+int64_t cpu_get_ticks(void);
+void cpu_enable_ticks(void);
+void cpu_disable_ticks(void);
+
+void qemu_system_reset_request(void);
+void qemu_system_shutdown_request(void);
+void qemu_system_powerdown_request(void);
+int qemu_shutdown_requested(void);
+int qemu_reset_requested(void);
+int qemu_powerdown_requested(void);
+#if !defined(TARGET_SPARC) && !defined(TARGET_I386)
+// Please implement a power failure function to signal the OS
+#define qemu_system_powerdown() do{}while(0)
+#else
+void qemu_system_powerdown(void);
+#endif
+void qemu_system_reset(void);
+
+void do_savevm(const char *name);
+void do_loadvm(const char *name);
+void do_delvm(const char *name);
+void do_info_snapshots(void);
+
+void main_loop_wait(int timeout);
+
+/* Polling handling */
+
+/* return TRUE if no sleep should be done afterwards */
+typedef int PollingFunc(void *opaque);
+
+int qemu_add_polling_cb(PollingFunc *func, void *opaque);
+void qemu_del_polling_cb(PollingFunc *func, void *opaque);
+
+#ifdef _WIN32
+/* Wait objects handling */
+typedef void WaitObjectFunc(void *opaque);
+
+int qemu_add_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque);
+void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque);
+#endif
+
+/* TAP win32 */
+int tap_win32_init(VLANState *vlan, const char *ifname);
+
+/* SLIRP */
+void do_info_slirp(void);
+
+extern int bios_size;
+extern int cirrus_vga_enabled;
+extern int vmsvga_enabled;
+extern int graphic_width;
+extern int graphic_height;
+extern int graphic_depth;
+extern const char *keyboard_layout;
+extern int win2k_install_hack;
+extern int alt_grab;
+extern int usb_enabled;
+extern int smp_cpus;
+extern int cursor_hide;
+extern int graphic_rotate;
+extern int no_quit;
+extern int semihosting_enabled;
+extern int autostart;
+extern int old_param;
+extern const char *bootp_filename;
+
+
+#ifdef USE_KQEMU
+extern int kqemu_allowed;
+#endif
+
+#define MAX_OPTION_ROMS 16
+extern const char *option_rom[MAX_OPTION_ROMS];
+extern int nb_option_roms;
+
+#ifdef TARGET_SPARC
+#define MAX_PROM_ENVS 128
+extern const char *prom_envs[MAX_PROM_ENVS];
+extern unsigned int nb_prom_envs;
+#endif
+
+#if defined (TARGET_PPC)
+#define BIOS_SIZE (1024 * 1024)
+#elif defined (TARGET_SPARC64)
+#define BIOS_SIZE ((512 + 32) * 1024)
+#elif defined(TARGET_MIPS)
+#define BIOS_SIZE (4 * 1024 * 1024)
+#endif
+
+typedef enum {
+    IF_IDE, IF_SCSI, IF_FLOPPY, IF_PFLASH, IF_MTD, IF_SD
+} BlockInterfaceType;
+
+typedef struct DriveInfo {
+    BlockDriverState *bdrv;
+    BlockInterfaceType type;
+    int bus;
+    int unit;
+} DriveInfo;
+
+#define MAX_IDE_DEVS	2
+#define MAX_SCSI_DEVS	7
+#define MAX_DRIVES 32
+
+extern int nb_drives;
+extern DriveInfo drives_table[MAX_DRIVES+1];
+
+extern int drive_get_index(BlockInterfaceType type, int bus, int unit);
+extern int drive_get_max_bus(BlockInterfaceType type);
+
+/* serial ports */
+
+#define MAX_SERIAL_PORTS 4
+
+extern CharDriverState *serial_hds[MAX_SERIAL_PORTS];
+
+/* parallel ports */
+
+#define MAX_PARALLEL_PORTS 3
+
+extern CharDriverState *parallel_hds[MAX_PARALLEL_PORTS];
+
+#ifdef NEED_CPU_H
+/* loader.c */
+int get_image_size(const char *filename);
+int load_image(const char *filename, uint8_t *addr); /* deprecated */
+int load_image_targphys(const char *filename, target_phys_addr_t, int max_sz);
+int load_elf(const char *filename, int64_t virt_to_phys_addend,
+             uint64_t *pentry, uint64_t *lowaddr, uint64_t *highaddr);
+int load_aout(const char *filename, target_phys_addr_t addr, int max_sz);
+int load_uboot(const char *filename, target_ulong *ep, int *is_linux);
+
+int fread_targphys(target_phys_addr_t dst_addr, size_t nbytes, FILE *f);
+int fread_targphys_ok(target_phys_addr_t dst_addr, size_t nbytes, FILE *f);
+int read_targphys(int fd, target_phys_addr_t dst_addr, size_t nbytes);
+void pstrcpy_targphys(target_phys_addr_t dest, int buf_size,
+                      const char *source);
+#endif
+
+#ifdef HAS_AUDIO
+struct soundhw {
+    const char *name;
+    const char *descr;
+    int enabled;
+    int isa;
+    union {
+        int (*init_isa) (AudioState *s, qemu_irq *pic);
+        int (*init_pci) (PCIBus *bus, AudioState *s);
+    } init;
+};
+
+extern struct soundhw soundhw[];
+#endif
+
+void do_usb_add(const char *devname);
+void do_usb_del(const char *devname);
+void usb_info(void);
+
+#endif
diff --git a/tap-win32.c b/tap-win32.c
index 6913c55..b4b61d0 100644
--- a/tap-win32.c
+++ b/tap-win32.c
@@ -26,8 +26,8 @@
  *  distribution); if not, write to the Free Software Foundation, Inc.,
  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-#include "vl.h"
 #include <stdio.h>
+#include <stdint.h>
 #include <windows.h>
 
 /* NOTE: PCIBus is redefined in winddk.h */
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index a613b77..ff765f7 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -22,12 +22,12 @@
 
 #define TARGET_LONG_BITS 32
 
+#define ELF_MACHINE	EM_ARM
+
 #include "cpu-defs.h"
 
 #include "softfloat.h"
 
-#define ARM_CPU_SAVE_VERSION  1
-
 #define TARGET_HAS_ICE 1
 
 #define EXCP_UDEF            1   /* undefined instruction */
@@ -37,6 +37,28 @@
 #define EXCP_IRQ             5
 #define EXCP_FIQ             6
 #define EXCP_BKPT            7
+#define EXCP_EXCEPTION_EXIT  8   /* Return from v7M exception.  */
+#define EXCP_KERNEL_TRAP     9   /* Jumped to kernel code page.  */
+
+#define ARMV7M_EXCP_RESET   1
+#define ARMV7M_EXCP_NMI     2
+#define ARMV7M_EXCP_HARD    3
+#define ARMV7M_EXCP_MEM     4
+#define ARMV7M_EXCP_BUS     5
+#define ARMV7M_EXCP_USAGE   6
+#define ARMV7M_EXCP_SVC     11
+#define ARMV7M_EXCP_DEBUG   12
+#define ARMV7M_EXCP_PENDSV  14
+#define ARMV7M_EXCP_SYSTICK 15
+
+typedef void ARMWriteCPFunc(void *opaque, int cp_info,
+                            int srcreg, int operand, uint32_t value);
+typedef uint32_t ARMReadCPFunc(void *opaque, int cp_info,
+                               int dstreg, int operand);
+
+struct arm_boot_info;
+
+#define NB_MMU_MODES 2
 
 /* We currently assume float and double are IEEE single and double
    precision respectively.
@@ -50,7 +72,7 @@ typedef struct CPUARMState {
     /* Regs for current mode.  */
     uint32_t regs[16];
     /* Frequently accessed CPSR bits are stored separately for efficiently.
-       This contains all the other bits.  Use cpsr_{read,write} to accless
+       This contains all the other bits.  Use cpsr_{read,write} to access
        the whole CPSR.  */
     uint32_t uncached_cpsr;
     uint32_t spsr;
@@ -67,53 +89,100 @@ typedef struct CPUARMState {
     /* cpsr flag cache for faster execution */
     uint32_t CF; /* 0 or 1 */
     uint32_t VF; /* V is the bit 31. All other bits are undefined */
-    uint32_t NZF; /* N is bit 31. Z is computed from NZF */
+    uint32_t NF; /* N is bit 31. All other bits are undefined.  */
+    uint32_t ZF; /* Z set if zero.  */
     uint32_t QF; /* 0 or 1 */
-
-    int thumb; /* 0 = arm mode, 1 = thumb mode */
+    uint32_t GE; /* cpsr[19:16] */
+    uint32_t thumb; /* cpsr[5]. 0 = arm mode, 1 = thumb mode. */
+    uint32_t condexec_bits; /* IT bits.  cpsr[15:10,26:25].  */
 
     /* System control coprocessor (cp15) */
     struct {
         uint32_t c0_cpuid;
+        uint32_t c0_cachetype;
+        uint32_t c0_c1[8]; /* Feature registers.  */
+        uint32_t c0_c2[8]; /* Instruction set registers.  */
         uint32_t c1_sys; /* System control register.  */
         uint32_t c1_coproc; /* Coprocessor access register.  */
-        uint32_t c2; /* MMU translation table base.  */
-        uint32_t c3; /* MMU domain access control register.  */
+        uint32_t c1_xscaleauxcr; /* XScale auxiliary control register.  */
+        uint32_t c2_base0; /* MMU translation table base 0.  */
+        uint32_t c2_base1; /* MMU translation table base 1.  */
+        uint32_t c2_mask; /* MMU translation table base mask.  */
+        uint32_t c2_data; /* MPU data cachable bits.  */
+        uint32_t c2_insn; /* MPU instruction cachable bits.  */
+        uint32_t c3; /* MMU domain access control register
+                        MPU write buffer control.  */
         uint32_t c5_insn; /* Fault status registers.  */
         uint32_t c5_data;
+        uint32_t c6_region[8]; /* MPU base/size registers.  */
         uint32_t c6_insn; /* Fault address registers.  */
         uint32_t c6_data;
         uint32_t c9_insn; /* Cache lockdown registers.  */
         uint32_t c9_data;
         uint32_t c13_fcse; /* FCSE PID.  */
         uint32_t c13_context; /* Context ID.  */
+        uint32_t c13_tls1; /* User RW Thread register.  */
+        uint32_t c13_tls2; /* User RO Thread register.  */
+        uint32_t c13_tls3; /* Privileged Thread register.  */
+        uint32_t c15_cpar; /* XScale Coprocessor Access Register */
+        uint32_t c15_ticonfig; /* TI925T configuration byte.  */
+        uint32_t c15_i_max; /* Maximum D-cache dirty line index.  */
+        uint32_t c15_i_min; /* Minimum D-cache dirty line index.  */
+        uint32_t c15_threadid; /* TI debugger thread-ID.  */
     } cp15;
 
+    struct {
+        uint32_t other_sp;
+        uint32_t vecbase;
+        uint32_t basepri;
+        uint32_t control;
+        int current_sp;
+        int exception;
+        int pending_exception;
+        void *nvic;
+    } v7m;
+
+    /* Coprocessor IO used by peripherals */
+    struct {
+        ARMReadCPFunc *cp_read;
+        ARMWriteCPFunc *cp_write;
+        void *opaque;
+    } cp[15];
+
     /* Internal CPU feature flags.  */
     uint32_t features;
 
-    /* exception/interrupt handling */
-    jmp_buf jmp_env;
-    int exception_index;
-    int interrupt_request;
-    int user_mode_only;
-    int halted;
+    /* Callback for vectored interrupt controller.  */
+    int (*get_irq_vector)(struct CPUARMState *);
+    void *irq_opaque;
 
     /* VFP coprocessor state.  */
     struct {
-        float64 regs[16];
+        float64 regs[32];
 
         uint32_t xregs[16];
         /* We store these fpcsr fields separately for convenience.  */
         int vec_len;
         int vec_stride;
 
-        /* Temporary variables if we don't have spare fp regs.  */
-        float32 tmp0s, tmp1s;
-        float64 tmp0d, tmp1d;
+        /* scratch space when Tn are not sufficient.  */
+        uint32_t scratch[8];
 
         float_status fp_status;
     } vfp;
+#if defined(CONFIG_USER_ONLY)
+    struct mmon_state *mmon_entry;
+#else
+    uint32_t mmon_addr;
+#endif
+
+    /* iwMMXt coprocessor state.  */
+    struct {
+        uint64_t regs[16];
+        uint64_t val;
+
+        uint32_t cregs[16];
+    } iwmmxt;
 
 #if defined(CONFIG_USER_ONLY)
     /* For usermode syscall translation.  */
@@ -122,21 +191,31 @@ typedef struct CPUARMState {
 
     CPU_COMMON
 
+    /* These fields after the common ones so they are preserved on reset.  */
+    struct arm_boot_info *boot_info;
 } CPUARMState;
 
-CPUARMState *cpu_arm_init(void);
+CPUARMState *cpu_arm_init(const char *cpu_model);
+void arm_translate_init(void);
 int cpu_arm_exec(CPUARMState *s);
 void cpu_arm_close(CPUARMState *s);
 void do_interrupt(CPUARMState *);
 void switch_mode(CPUARMState *, int);
+uint32_t do_arm_semihosting(CPUARMState *env);
 
 /* you can call this signal handler from your SIGBUS and SIGSEGV
    signal handlers to inform the virtual CPU of exceptions. non zero
    is returned if the signal was handled by the virtual CPU.  */
-struct siginfo;
-int cpu_arm_signal_handler(int host_signum, struct siginfo *info,
+int cpu_arm_signal_handler(int host_signum, void *pinfo,
                            void *puc);
 
+void cpu_lock(void);
+void cpu_unlock(void);
+static inline void cpu_set_tls(CPUARMState *env, target_ulong newtls)
+{
+  env->cp15.c13_tls2 = newtls;
+}
+
 #define CPSR_M (0x1f)
 #define CPSR_T (1 << 5)
 #define CPSR_F (1 << 6)
@@ -144,42 +223,65 @@ int cpu_arm_signal_handler(int host_signum, struct siginfo *info,
 #define CPSR_A (1 << 8)
 #define CPSR_E (1 << 9)
 #define CPSR_IT_2_7 (0xfc00)
-/* Bits 20-23 reserved.  */
+#define CPSR_GE (0xf << 16)
+#define CPSR_RESERVED (0xf << 20)
 #define CPSR_J (1 << 24)
 #define CPSR_IT_0_1 (3 << 25)
 #define CPSR_Q (1 << 27)
-#define CPSR_NZCV (0xf << 28)
+#define CPSR_V (1 << 28)
+#define CPSR_C (1 << 29)
+#define CPSR_Z (1 << 30)
+#define CPSR_N (1 << 31)
+#define CPSR_NZCV (CPSR_N | CPSR_Z | CPSR_C | CPSR_V)
+
+#define CPSR_IT (CPSR_IT_0_1 | CPSR_IT_2_7)
+#define CACHED_CPSR_BITS (CPSR_T | CPSR_GE | CPSR_IT | CPSR_Q | CPSR_NZCV)
+/* Bits writable in user mode.  */
+#define CPSR_USER (CPSR_NZCV | CPSR_Q | CPSR_GE)
+/* Execution state bits.  MRS read as zero, MSR writes ignored.  */
+#define CPSR_EXEC (CPSR_T | CPSR_IT | CPSR_J)
 
-#define CACHED_CPSR_BITS (CPSR_T | CPSR_Q | CPSR_NZCV)
 /* Return the current CPSR value.  */
-static inline uint32_t cpsr_read(CPUARMState *env)
+uint32_t cpsr_read(CPUARMState *env);
+/* Set the CPSR.  Note that some bits of mask must be all-set or all-clear.  */
+void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask);
+
+/* Return the current xPSR value.  */
+static inline uint32_t xpsr_read(CPUARMState *env)
 {
     int ZF;
-    ZF = (env->NZF == 0);
-    return env->uncached_cpsr | (env->NZF & 0x80000000) | (ZF << 30) |
-        (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
-        | (env->thumb << 5);
+    ZF = (env->ZF == 0);
+    return (env->NF & 0x80000000) | (ZF << 30)
+        | (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
+        | (env->thumb << 24) | ((env->condexec_bits & 3) << 25)
+        | ((env->condexec_bits & 0xfc) << 8)
+        | env->v7m.exception;
 }
 
-/* Set the CPSR.  Note that some bits of mask must be all-set or all-clear.  */
-static inline void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+/* Set the xPSR.  Note that some bits of mask must be all-set or all-clear.  */
+static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 {
-    /* NOTE: N = 1 and Z = 1 cannot be stored currently */
     if (mask & CPSR_NZCV) {
-        env->NZF = (val & 0xc0000000) ^ 0x40000000;
+        env->ZF = (~val) & CPSR_Z;
+        env->NF = val;
         env->CF = (val >> 29) & 1;
         env->VF = (val << 3) & 0x80000000;
     }
     if (mask & CPSR_Q)
         env->QF = ((val & CPSR_Q) != 0);
-    if (mask & CPSR_T)
-        env->thumb = ((val & CPSR_T) != 0);
-
-    if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
-        switch_mode(env, val & CPSR_M);
+    if (mask & (1 << 24))
+        env->thumb = ((val & (1 << 24)) != 0);
+    if (mask & CPSR_IT_0_1) {
+        env->condexec_bits &= ~3;
+        env->condexec_bits |= (val >> 25) & 3;
+    }
+    if (mask & CPSR_IT_2_7) {
+        env->condexec_bits &= 3;
+        env->condexec_bits |= (val >> 8) & 0xfc;
+    }
+    if (mask & 0x1ff) {
+        env->v7m.exception = val & 0x1ff;
     }
-    mask &= ~CACHED_CPSR_BITS;
-    env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
 }
 
 enum arm_cpu_mode {
@@ -195,14 +297,37 @@ enum arm_cpu_mode {
 /* VFP system registers.  */
 #define ARM_VFP_FPSID   0
 #define ARM_VFP_FPSCR   1
+#define ARM_VFP_MVFR1   6
+#define ARM_VFP_MVFR0   7
 #define ARM_VFP_FPEXC   8
 #define ARM_VFP_FPINST  9
 #define ARM_VFP_FPINST2 10
 
+/* iwMMXt coprocessor control registers.  */
+#define ARM_IWMMXT_wCID		0
+#define ARM_IWMMXT_wCon		1
+#define ARM_IWMMXT_wCSSF	2
+#define ARM_IWMMXT_wCASF	3
+#define ARM_IWMMXT_wCGR0	8
+#define ARM_IWMMXT_wCGR1	9
+#define ARM_IWMMXT_wCGR2	10
+#define ARM_IWMMXT_wCGR3	11
 
 enum arm_features {
     ARM_FEATURE_VFP,
-    ARM_FEATURE_AUXCR /* ARM1026 Auxiliary control register.  */
+    ARM_FEATURE_AUXCR,  /* ARM1026 Auxiliary control register.  */
+    ARM_FEATURE_XSCALE, /* Intel XScale extensions.  */
+    ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension.  */
+    ARM_FEATURE_V6,
+    ARM_FEATURE_V6K,
+    ARM_FEATURE_V7,
+    ARM_FEATURE_THUMB2,
+    ARM_FEATURE_MPU,    /* Only has Memory Protection Unit, not full MMU.  */
+    ARM_FEATURE_VFP3,
+    ARM_FEATURE_NEON,
+    ARM_FEATURE_DIV,
+    ARM_FEATURE_M, /* Microcontroller profile.  */
+    ARM_FEATURE_OMAPCP  /* OMAP specific CP15 ops handling.  */
 };
 
 static inline int arm_feature(CPUARMState *env, int feature)
@@ -210,19 +335,86 @@ static inline int arm_feature(CPUARMState *env, int feature)
     return (env->features & (1u << feature)) != 0;
 }
 
-void cpu_arm_set_model(CPUARMState *env, uint32_t id);
-
-#define ARM_CPUID_ARM1026 0x4106a262
-#define ARM_CPUID_ARM926  0x41069265
+void arm_cpu_list(FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...));
+
+/* Interface between CPU and Interrupt controller.  */
+void armv7m_nvic_set_pending(void *opaque, int irq);
+int armv7m_nvic_acknowledge_irq(void *opaque);
+void armv7m_nvic_complete_irq(void *opaque, int irq);
+
+void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
+                       ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
+                       void *opaque);
+
+/* Does the core conform to the the "MicroController" profile. e.g. Cortex-M3.
+   Note the M in older cores (eg. ARM7TDMI) stands for Multiply. These are
+   conventional cores (ie. Application or Realtime profile).  */
+
+#define IS_M(env) arm_feature(env, ARM_FEATURE_M)
+#define ARM_CPUID(env) (env->cp15.c0_cpuid)
+
+#define ARM_CPUID_ARM1026     0x4106a262
+#define ARM_CPUID_ARM926      0x41069265
+#define ARM_CPUID_ARM946      0x41059461
+#define ARM_CPUID_TI915T      0x54029152
+#define ARM_CPUID_TI925T      0x54029252
+#define ARM_CPUID_PXA250      0x69052100
+#define ARM_CPUID_PXA255      0x69052d00
+#define ARM_CPUID_PXA260      0x69052903
+#define ARM_CPUID_PXA261      0x69052d05
+#define ARM_CPUID_PXA262      0x69052d06
+#define ARM_CPUID_PXA270      0x69054110
+#define ARM_CPUID_PXA270_A0   0x69054110
+#define ARM_CPUID_PXA270_A1   0x69054111
+#define ARM_CPUID_PXA270_B0   0x69054112
+#define ARM_CPUID_PXA270_B1   0x69054113
+#define ARM_CPUID_PXA270_C0   0x69054114
+#define ARM_CPUID_PXA270_C5   0x69054117
+#define ARM_CPUID_ARM1136     0x4117b363
+#define ARM_CPUID_ARM1136_R2  0x4107b362
+#define ARM_CPUID_ARM11MPCORE 0x410fb022
+#define ARM_CPUID_CORTEXA8    0x410fc080
+#define ARM_CPUID_CORTEXM3    0x410fc231
+#define ARM_CPUID_ANY         0xffffffff
 
 #if defined(CONFIG_USER_ONLY)
 #define TARGET_PAGE_BITS 12
 #else
 /* The ARM MMU allows 1k pages.  */
 /* ??? Linux doesn't actually use these, and they're deprecated in recent
-   architecture revisions.  Maybe an a configure option to disable them.  */
+   architecture revisions.  Maybe a configure option to disable them.  */
 #define TARGET_PAGE_BITS 10
 #endif
+
+#define CPUState CPUARMState
+#define cpu_init cpu_arm_init
+#define cpu_exec cpu_arm_exec
+#define cpu_gen_code cpu_arm_gen_code
+#define cpu_signal_handler cpu_arm_signal_handler
+#define cpu_list arm_cpu_list
+
+#define CPU_SAVE_VERSION 1
+
+/* MMU modes definitions */
+#define MMU_MODE0_SUFFIX _kernel
+#define MMU_MODE1_SUFFIX _user
+#define MMU_USER_IDX 1
+static inline int cpu_mmu_index (CPUState *env)
+{
+    return (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR ? 1 : 0;
+}
+
+#if defined(CONFIG_USER_ONLY)
+static inline void cpu_clone_regs(CPUState *env, target_ulong newsp)
+{
+    if (newsp)
+        env->regs[13] = newsp;
+    env->regs[0] = 0;
+}
+#endif
+
+#define CPU_PC_FROM_TB(env, tb) env->regs[15] = tb->pc
+
 #include "cpu-all.h"
 
 #endif
diff --git a/target-arm/exec.h b/target-arm/exec.h
index 2d2b99a..c543cf4 100644
--- a/target-arm/exec.h
+++ b/target-arm/exec.h
@@ -1,6 +1,6 @@
 /*
  *  ARM execution defines
- * 
+ *
  *  Copyright (c) 2003 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -17,19 +17,14 @@
  * License along with this library; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
+#include "config.h"
 #include "dyngen-exec.h"
 
 register struct CPUARMState *env asm(AREG0);
 register uint32_t T0 asm(AREG1);
 register uint32_t T1 asm(AREG2);
-register uint32_t T2 asm(AREG3);
 
-/* TODO: Put these in FP regs on targets that have such things.  */
-/* It is ok for FT0s and FT0d to overlap.  Likewise FT1s and FT1d.  */
-#define FT0s env->vfp.tmp0s
-#define FT1s env->vfp.tmp1s
-#define FT0d env->vfp.tmp0d
-#define FT1d env->vfp.tmp1d
+#define M0   env->iwmmxt.val
 
 #include "cpu.h"
 #include "exec-all.h"
@@ -43,33 +38,26 @@ static inline void regs_to_env(void)
 }
 
 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int is_user, int is_softmmu);
+                              int mmu_idx, int is_softmmu);
+
+static inline int cpu_halted(CPUState *env) {
+    if (!env->halted)
+        return 0;
+    /* An interrupt wakes the CPU even if the I and F CPSR bits are
+       set.  We use EXITTB to silently wake CPU without causing an
+       actual interrupt.  */
+    if (env->interrupt_request &
+        (CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD | CPU_INTERRUPT_EXITTB)) {
+        env->halted = 0;
+        return 0;
+    }
+    return EXCP_HALTED;
+}
 
 #if !defined(CONFIG_USER_ONLY)
 #include "softmmu_exec.h"
 #endif
 
-/* In op_helper.c */
-
-void cpu_lock(void);
-void cpu_unlock(void);
-void helper_set_cp15(CPUState *, uint32_t, uint32_t);
-uint32_t helper_get_cp15(CPUState *, uint32_t);
-
 void cpu_loop_exit(void);
 
 void raise_exception(int);
-
-void do_vfp_abss(void);
-void do_vfp_absd(void);
-void do_vfp_negs(void);
-void do_vfp_negd(void);
-void do_vfp_sqrts(void);
-void do_vfp_sqrtd(void);
-void do_vfp_cmps(void);
-void do_vfp_cmpd(void);
-void do_vfp_cmpes(void);
-void do_vfp_cmped(void);
-void do_vfp_set_fpscr(void);
-void do_vfp_get_fpscr(void);
-
diff --git a/target-arm/helper.c b/target-arm/helper.c
index b78f7d1..7cc8b0f 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -4,58 +4,254 @@
 
 #include "cpu.h"
 #include "exec-all.h"
-#ifdef CONFIG_TRACE
-#include "trace.h"
-#endif
+#include "gdbstub.h"
+#include "helpers.h"
+#include "qemu-common.h"
+
+static uint32_t cortexa8_cp15_c0_c1[8] =
+{ 0x1031, 0x11, 0x400, 0, 0x31100003, 0x20000000, 0x01202000, 0x11 };
+
+static uint32_t cortexa8_cp15_c0_c2[8] =
+{ 0x00101111, 0x12112111, 0x21232031, 0x11112131, 0x00111142, 0, 0, 0 };
+
+static uint32_t mpcore_cp15_c0_c1[8] =
+{ 0x111, 0x1, 0, 0x2, 0x01100103, 0x10020302, 0x01222000, 0 };
+
+static uint32_t mpcore_cp15_c0_c2[8] =
+{ 0x00100011, 0x12002111, 0x11221011, 0x01102131, 0x141, 0, 0, 0 };
+
+static uint32_t arm1136_cp15_c0_c1[8] =
+{ 0x111, 0x1, 0x2, 0x3, 0x01130003, 0x10030302, 0x01222110, 0 };
+
+static uint32_t arm1136_cp15_c0_c2[8] =
+{ 0x00140011, 0x12002111, 0x11231111, 0x01102131, 0x141, 0, 0, 0 };
+
+static uint32_t cpu_arm_find_by_name(const char *name);
+
+static inline void set_feature(CPUARMState *env, int feature)
+{
+    env->features |= 1u << feature;
+}
+
+static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
+{
+    env->cp15.c0_cpuid = id;
+    switch (id) {
+    case ARM_CPUID_ARM926:
+        set_feature(env, ARM_FEATURE_VFP);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x41011090;
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        env->cp15.c1_sys = 0x00090078;
+        break;
+    case ARM_CPUID_ARM946:
+        set_feature(env, ARM_FEATURE_MPU);
+        env->cp15.c0_cachetype = 0x0f004006;
+        env->cp15.c1_sys = 0x00000078;
+        break;
+    case ARM_CPUID_ARM1026:
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_AUXCR);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410110a0;
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        env->cp15.c1_sys = 0x00090078;
+        break;
+    case ARM_CPUID_ARM1136_R2:
+    case ARM_CPUID_ARM1136:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_AUXCR);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
+        memcpy(env->cp15.c0_c1, arm1136_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c2, arm1136_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        break;
+    case ARM_CPUID_ARM11MPCORE:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_V6K);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_AUXCR);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
+        memcpy(env->cp15.c0_c1, mpcore_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c2, mpcore_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        break;
+    case ARM_CPUID_CORTEXA8:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_V6K);
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_AUXCR);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_VFP3);
+        set_feature(env, ARM_FEATURE_NEON);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410330c0;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x11110222;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x00011100;
+        memcpy(env->cp15.c0_c1, cortexa8_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c2, cortexa8_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        break;
+    case ARM_CPUID_CORTEXM3:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_M);
+        set_feature(env, ARM_FEATURE_DIV);
+        break;
+    case ARM_CPUID_ANY: /* For userspace emulation.  */
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_V6K);
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_VFP3);
+        set_feature(env, ARM_FEATURE_NEON);
+        set_feature(env, ARM_FEATURE_DIV);
+        break;
+    case ARM_CPUID_TI915T:
+    case ARM_CPUID_TI925T:
+        set_feature(env, ARM_FEATURE_OMAPCP);
+        env->cp15.c0_cpuid = ARM_CPUID_TI925T; /* Depends on wiring.  */
+        env->cp15.c0_cachetype = 0x5109149;
+        env->cp15.c1_sys = 0x00000070;
+        env->cp15.c15_i_max = 0x000;
+        env->cp15.c15_i_min = 0xff0;
+        break;
+    case ARM_CPUID_PXA250:
+    case ARM_CPUID_PXA255:
+    case ARM_CPUID_PXA260:
+    case ARM_CPUID_PXA261:
+    case ARM_CPUID_PXA262:
+        set_feature(env, ARM_FEATURE_XSCALE);
+        /* JTAG_ID is ((id << 28) | 0x09265013) */
+        env->cp15.c0_cachetype = 0xd172172;
+        env->cp15.c1_sys = 0x00000078;
+        break;
+    case ARM_CPUID_PXA270_A0:
+    case ARM_CPUID_PXA270_A1:
+    case ARM_CPUID_PXA270_B0:
+    case ARM_CPUID_PXA270_B1:
+    case ARM_CPUID_PXA270_C0:
+    case ARM_CPUID_PXA270_C5:
+        set_feature(env, ARM_FEATURE_XSCALE);
+        /* JTAG_ID is ((id << 28) | 0x09265013) */
+        set_feature(env, ARM_FEATURE_IWMMXT);
+        env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
+        env->cp15.c0_cachetype = 0xd172172;
+        env->cp15.c1_sys = 0x00000078;
+        break;
+    default:
+        cpu_abort(env, "Bad CPU ID: %x\n", id);
+        break;
+    }
+}
 
 void cpu_reset(CPUARMState *env)
 {
+    uint32_t id;
+    id = env->cp15.c0_cpuid;
+    memset(env, 0, offsetof(CPUARMState, breakpoints));
+    if (id)
+        cpu_reset_model_id(env, id);
 #if defined (CONFIG_USER_ONLY)
     env->uncached_cpsr = ARM_CPU_MODE_USR;
     env->vfp.xregs[ARM_VFP_FPEXC] = 1 << 30;
 #else
     /* SVC mode with interrupts disabled.  */
     env->uncached_cpsr = ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
+    /* On ARMv7-M the CPSR_I is the value of the PRIMASK register, and is
+       clear at reset.  */
+    if (IS_M(env))
+        env->uncached_cpsr &= ~CPSR_I;
     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 #endif
     env->regs[15] = 0;
+    tlb_flush(env, 1);
 }
 
-CPUARMState *cpu_arm_init(void)
+CPUARMState *cpu_arm_init(const char *cpu_model)
 {
     CPUARMState *env;
+    uint32_t id;
+    static int inited = 0;
 
+    id = cpu_arm_find_by_name(cpu_model);
+    if (id == 0)
+        return NULL;
     env = qemu_mallocz(sizeof(CPUARMState));
     if (!env)
         return NULL;
     cpu_exec_init(env);
+    if (!inited) {
+        inited = 1;
+        arm_translate_init();
+    }
+
+    env->cpu_model_str = cpu_model;
+    env->cp15.c0_cpuid = id;
     cpu_reset(env);
-    tlb_flush(env, 1);
     return env;
 }
 
-static inline void set_feature(CPUARMState *env, int feature)
+struct arm_cpu_t {
+    uint32_t id;
+    const char *name;
+};
+
+static const struct arm_cpu_t arm_cpu_names[] = {
+    { ARM_CPUID_ARM926, "arm926"},
+    { ARM_CPUID_ARM946, "arm946"},
+    { ARM_CPUID_ARM1026, "arm1026"},
+    { ARM_CPUID_ARM1136, "arm1136"},
+    { ARM_CPUID_ARM1136_R2, "arm1136-r2"},
+    { ARM_CPUID_ARM11MPCORE, "arm11mpcore"},
+    { ARM_CPUID_CORTEXM3, "cortex-m3"},
+    { ARM_CPUID_CORTEXA8, "cortex-a8"},
+    { ARM_CPUID_TI925T, "ti925t" },
+    { ARM_CPUID_PXA250, "pxa250" },
+    { ARM_CPUID_PXA255, "pxa255" },
+    { ARM_CPUID_PXA260, "pxa260" },
+    { ARM_CPUID_PXA261, "pxa261" },
+    { ARM_CPUID_PXA262, "pxa262" },
+    { ARM_CPUID_PXA270, "pxa270" },
+    { ARM_CPUID_PXA270_A0, "pxa270-a0" },
+    { ARM_CPUID_PXA270_A1, "pxa270-a1" },
+    { ARM_CPUID_PXA270_B0, "pxa270-b0" },
+    { ARM_CPUID_PXA270_B1, "pxa270-b1" },
+    { ARM_CPUID_PXA270_C0, "pxa270-c0" },
+    { ARM_CPUID_PXA270_C5, "pxa270-c5" },
+    { ARM_CPUID_ANY, "any"},
+    { 0, NULL}
+};
+
+void arm_cpu_list(FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
 {
-    env->features |= 1u << feature;
+    int i;
+
+    (*cpu_fprintf)(f, "Available CPUs:\n");
+    for (i = 0; arm_cpu_names[i].name; i++) {
+        (*cpu_fprintf)(f, "  %s\n", arm_cpu_names[i].name);
+    }
 }
 
-void cpu_arm_set_model(CPUARMState *env, uint32_t id)
+/* return 0 if not found */
+static uint32_t cpu_arm_find_by_name(const char *name)
 {
-    env->cp15.c0_cpuid = id;
-    switch (id) {
-    case ARM_CPUID_ARM926:
-        set_feature(env, ARM_FEATURE_VFP);
-        env->vfp.xregs[ARM_VFP_FPSID] = 0x41011090;
-        break;
-    case ARM_CPUID_ARM1026:
-        set_feature(env, ARM_FEATURE_VFP);
-        set_feature(env, ARM_FEATURE_AUXCR);
-        env->vfp.xregs[ARM_VFP_FPSID] = 0x410110a0;
-        break;
-    default:
-        cpu_abort(env, "Bad CPU ID: %x\n", id);
-        break;
+    int i;
+    uint32_t id;
+
+    id = 0;
+    for (i = 0; arm_cpu_names[i].name; i++) {
+        if (strcmp(name, arm_cpu_names[i].name) == 0) {
+            id = arm_cpu_names[i].id;
+            break;
+        }
     }
+    return id;
 }
 
 void cpu_arm_close(CPUARMState *env)
@@ -63,6 +259,107 @@ void cpu_arm_close(CPUARMState *env)
     free(env);
 }
 
+uint32_t cpsr_read(CPUARMState *env)
+{
+    int ZF;
+    ZF = (env->ZF == 0);
+    return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
+        (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
+        | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
+        | ((env->condexec_bits & 0xfc) << 8)
+        | (env->GE << 16);
+}
+
+void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+{
+    if (mask & CPSR_NZCV) {
+        env->ZF = (~val) & CPSR_Z;
+        env->NF = val;
+        env->CF = (val >> 29) & 1;
+        env->VF = (val << 3) & 0x80000000;
+    }
+    if (mask & CPSR_Q)
+        env->QF = ((val & CPSR_Q) != 0);
+    if (mask & CPSR_T)
+        env->thumb = ((val & CPSR_T) != 0);
+    if (mask & CPSR_IT_0_1) {
+        env->condexec_bits &= ~3;
+        env->condexec_bits |= (val >> 25) & 3;
+    }
+    if (mask & CPSR_IT_2_7) {
+        env->condexec_bits &= 3;
+        env->condexec_bits |= (val >> 8) & 0xfc;
+    }
+    if (mask & CPSR_GE) {
+        env->GE = (val >> 16) & 0xf;
+    }
+
+    if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
+        switch_mode(env, val & CPSR_M);
+    }
+    mask &= ~CACHED_CPSR_BITS;
+    env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
+}
+
+/* Sign/zero extend */
+uint32_t HELPER(sxtb16)(uint32_t x)
+{
+    uint32_t res;
+    res = (uint16_t)(int8_t)x;
+    res |= (uint32_t)(int8_t)(x >> 16) << 16;
+    return res;
+}
+
+uint32_t HELPER(uxtb16)(uint32_t x)
+{
+    uint32_t res;
+    res = (uint16_t)(uint8_t)x;
+    res |= (uint32_t)(uint8_t)(x >> 16) << 16;
+    return res;
+}
+
+uint32_t HELPER(clz)(uint32_t x)
+{
+    int count;
+    for (count = 32; x; count--)
+        x >>= 1;
+    return count;
+}
+
+int32_t HELPER(sdiv)(int32_t num, int32_t den)
+{
+    if (den == 0)
+      return 0;
+    return num / den;
+}
+
+uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
+{
+    if (den == 0)
+      return 0;
+    return num / den;
+}
+
+uint32_t HELPER(rbit)(uint32_t x)
+{
+    x =  ((x & 0xff000000) >> 24)
+       | ((x & 0x00ff0000) >> 8)
+       | ((x & 0x0000ff00) << 8)
+       | ((x & 0x000000ff) << 24);
+    x =  ((x & 0xf0f0f0f0) >> 4)
+       | ((x & 0x0f0f0f0f) << 4);
+    x =  ((x & 0x88888888) >> 3)
+       | ((x & 0x44444444) >> 1)
+       | ((x & 0x22222222) << 1)
+       | ((x & 0x11111111) << 3);
+    return x;
+}
+
+uint32_t HELPER(abs)(uint32_t x)
+{
+    return ((int32_t)x < 0) ? -x : x;
+}
+
 #if defined(CONFIG_USER_ONLY)
 
 void do_interrupt (CPUState *env)
@@ -70,8 +367,18 @@ void do_interrupt (CPUState *env)
     env->exception_index = -1;
 }
 
+/* Structure used to record exclusive memory locations.  */
+typedef struct mmon_state {
+    struct mmon_state *next;
+    CPUARMState *cpu_env;
+    uint32_t addr;
+} mmon_state;
+
+/* Chain of current locks.  */
+static mmon_state* mmon_head = NULL;
+
 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
-                              int is_user, int is_softmmu)
+                              int mmu_idx, int is_softmmu)
 {
     if (rw == 2) {
         env->exception_index = EXCP_PREFETCH_ABORT;
@@ -83,31 +390,128 @@ int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
     return 1;
 }
 
-target_ulong cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
+static void allocate_mmon_state(CPUState *env)
+{
+    env->mmon_entry = malloc(sizeof (mmon_state));
+    if (!env->mmon_entry)
+        abort();
+    memset (env->mmon_entry, 0, sizeof (mmon_state));
+    env->mmon_entry->cpu_env = env;
+    mmon_head = env->mmon_entry;
+}
+
+/* Flush any monitor locks for the specified address.  */
+static void flush_mmon(uint32_t addr)
+{
+    mmon_state *mon;
+
+    for (mon = mmon_head; mon; mon = mon->next)
+      {
+        if (mon->addr != addr)
+          continue;
+
+        mon->addr = 0;
+        break;
+      }
+}
+
+/* Mark an address for exclusive access.  */
+void HELPER(mark_exclusive)(CPUState *env, uint32_t addr)
+{
+    if (!env->mmon_entry)
+        allocate_mmon_state(env);
+    /* Clear any previous locks.  */
+    flush_mmon(addr);
+    env->mmon_entry->addr = addr;
+}
+
+/* Test if an exclusive address is still exclusive.  Returns zero
+   if the address is still exclusive.   */
+uint32_t HELPER(test_exclusive)(CPUState *env, uint32_t addr)
+{
+    int res;
+
+    if (!env->mmon_entry)
+        return 1;
+    if (env->mmon_entry->addr == addr)
+        res = 0;
+    else
+        res = 1;
+    flush_mmon(addr);
+    return res;
+}
+
+void HELPER(clrex)(CPUState *env)
+{
+    if (!(env->mmon_entry && env->mmon_entry->addr))
+        return;
+    flush_mmon(env->mmon_entry->addr);
+}
+
+target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 {
     return addr;
 }
 
 /* These should probably raise undefined insn exceptions.  */
-void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
+void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
+{
+    int op1 = (insn >> 8) & 0xf;
+    cpu_abort(env, "cp%i insn %08x\n", op1, insn);
+    return;
+}
+
+uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
+{
+    int op1 = (insn >> 8) & 0xf;
+    cpu_abort(env, "cp%i insn %08x\n", op1, insn);
+    return 0;
+}
+
+void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
 {
     cpu_abort(env, "cp15 insn %08x\n", insn);
 }
 
-uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
+uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
 {
     cpu_abort(env, "cp15 insn %08x\n", insn);
     return 0;
 }
 
+/* These should probably raise undefined insn exceptions.  */
+void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
+{
+    cpu_abort(env, "v7m_mrs %d\n", reg);
+}
+
+uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
+{
+    cpu_abort(env, "v7m_mrs %d\n", reg);
+    return 0;
+}
+
 void switch_mode(CPUState *env, int mode)
 {
     if (mode != ARM_CPU_MODE_USR)
         cpu_abort(env, "Tried to switch out of user mode\n");
 }
 
+void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
+{
+    cpu_abort(env, "banked r13 write\n");
+}
+
+uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
+{
+    cpu_abort(env, "banked r13 read\n");
+    return 0;
+}
+
 #else
 
+extern int semihosting_enabled;
+
 /* Map CPU modes onto saved register banks.  */
 static inline int bank_number (int mode)
 {
@@ -158,6 +562,138 @@ void switch_mode(CPUState *env, int mode)
     env->spsr = env->banked_spsr[i];
 }
 
+static void v7m_push(CPUARMState *env, uint32_t val)
+{
+    env->regs[13] -= 4;
+    stl_phys(env->regs[13], val);
+}
+
+static uint32_t v7m_pop(CPUARMState *env)
+{
+    uint32_t val;
+    val = ldl_phys(env->regs[13]);
+    env->regs[13] += 4;
+    return val;
+}
+
+/* Switch to V7M main or process stack pointer.  */
+static void switch_v7m_sp(CPUARMState *env, int process)
+{
+    uint32_t tmp;
+    if (env->v7m.current_sp != process) {
+        tmp = env->v7m.other_sp;
+        env->v7m.other_sp = env->regs[13];
+        env->regs[13] = tmp;
+        env->v7m.current_sp = process;
+    }
+}
+
+static void do_v7m_exception_exit(CPUARMState *env)
+{
+    uint32_t type;
+    uint32_t xpsr;
+
+    type = env->regs[15];
+    if (env->v7m.exception != 0)
+        armv7m_nvic_complete_irq(env->v7m.nvic, env->v7m.exception);
+
+    /* Switch to the target stack.  */
+    switch_v7m_sp(env, (type & 4) != 0);
+    /* Pop registers.  */
+    env->regs[0] = v7m_pop(env);
+    env->regs[1] = v7m_pop(env);
+    env->regs[2] = v7m_pop(env);
+    env->regs[3] = v7m_pop(env);
+    env->regs[12] = v7m_pop(env);
+    env->regs[14] = v7m_pop(env);
+    env->regs[15] = v7m_pop(env);
+    xpsr = v7m_pop(env);
+    xpsr_write(env, xpsr, 0xfffffdff);
+    /* Undo stack alignment.  */
+    if (xpsr & 0x200)
+        env->regs[13] |= 4;
+    /* ??? The exception return type specifies Thread/Handler mode.  However
+       this is also implied by the xPSR value. Not sure what to do
+       if there is a mismatch.  */
+    /* ??? Likewise for mismatches between the CONTROL register and the stack
+       pointer.  */
+}
+
+void do_interrupt_v7m(CPUARMState *env)
+{
+    uint32_t xpsr = xpsr_read(env);
+    uint32_t lr;
+    uint32_t addr;
+
+    lr = 0xfffffff1;
+    if (env->v7m.current_sp)
+        lr |= 4;
+    if (env->v7m.exception == 0)
+        lr |= 8;
+
+    /* For exceptions we just mark as pending on the NVIC, and let that
+       handle it.  */
+    /* TODO: Need to escalate if the current priority is higher than the
+       one we're raising.  */
+    switch (env->exception_index) {
+    case EXCP_UDEF:
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_USAGE);
+        return;
+    case EXCP_SWI:
+        env->regs[15] += 2;
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_SVC);
+        return;
+    case EXCP_PREFETCH_ABORT:
+    case EXCP_DATA_ABORT:
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_MEM);
+        return;
+    case EXCP_BKPT:
+        if (semihosting_enabled) {
+            int nr;
+            nr = lduw_code(env->regs[15]) & 0xff;
+            if (nr == 0xab) {
+                env->regs[15] += 2;
+                env->regs[0] = do_arm_semihosting(env);
+                return;
+            }
+        }
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_DEBUG);
+        return;
+    case EXCP_IRQ:
+        env->v7m.exception = armv7m_nvic_acknowledge_irq(env->v7m.nvic);
+        break;
+    case EXCP_EXCEPTION_EXIT:
+        do_v7m_exception_exit(env);
+        return;
+    default:
+        cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
+        return; /* Never happens.  Keep compiler happy.  */
+    }
+
+    /* Align stack pointer.  */
+    /* ??? Should only do this if Configuration Control Register
+       STACKALIGN bit is set.  */
+    if (env->regs[13] & 4) {
+        env->regs[13] -= 4;
+        xpsr |= 0x200;
+    }
+    /* Switch to the handler mode.  */
+    v7m_push(env, xpsr);
+    v7m_push(env, env->regs[15]);
+    v7m_push(env, env->regs[14]);
+    v7m_push(env, env->regs[12]);
+    v7m_push(env, env->regs[3]);
+    v7m_push(env, env->regs[2]);
+    v7m_push(env, env->regs[1]);
+    v7m_push(env, env->regs[0]);
+    switch_v7m_sp(env, 0);
+    env->uncached_cpsr &= ~CPSR_IT;
+    env->regs[14] = lr;
+    addr = ldl_phys(env->v7m.vecbase + env->v7m.exception * 4);
+    env->regs[15] = addr & 0xfffffffe;
+    env->thumb = addr & 1;
+}
+
 /* Handle a CPU exception.  */
 void do_interrupt(CPUARMState *env)
 {
@@ -166,11 +702,10 @@ void do_interrupt(CPUARMState *env)
     int new_mode;
     uint32_t offset;
 
-#ifdef CONFIG_TRACE
-    if (tracing)
-      trace_exception(env->regs[15]);
-#endif
-
+    if (IS_M(env)) {
+        do_interrupt_v7m(env);
+        return;
+    }
     /* TODO: Vectored interrupt controller.  */
     switch (env->exception_index) {
     case EXCP_UDEF:
@@ -183,14 +718,41 @@ void do_interrupt(CPUARMState *env)
             offset = 4;
         break;
     case EXCP_SWI:
+        if (semihosting_enabled) {
+            /* Check for semihosting interrupt.  */
+            if (env->thumb) {
+                mask = lduw_code(env->regs[15] - 2) & 0xff;
+            } else {
+                mask = ldl_code(env->regs[15] - 4) & 0xffffff;
+            }
+            /* Only intercept calls from privileged modes, to provide some
+               semblance of security.  */
+            if (((mask == 0x123456 && !env->thumb)
+                    || (mask == 0xab && env->thumb))
+                  && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
+                env->regs[0] = do_arm_semihosting(env);
+                return;
+            }
+        }
         new_mode = ARM_CPU_MODE_SVC;
         addr = 0x08;
         mask = CPSR_I;
-        /* The PC already points to the next instructon.  */
+        /* The PC already points to the next instruction.  */
         offset = 0;
         break;
-    case EXCP_PREFETCH_ABORT:
     case EXCP_BKPT:
+        /* See if this is a semihosting syscall.  */
+        if (env->thumb && semihosting_enabled) {
+            mask = lduw_code(env->regs[15]) & 0xff;
+            if (mask == 0xab
+                  && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
+                env->regs[15] += 2;
+                env->regs[0] = do_arm_semihosting(env);
+                return;
+            }
+        }
+        /* Fall through to prefetch abort.  */
+    case EXCP_PREFETCH_ABORT:
         new_mode = ARM_CPU_MODE_ABT;
         addr = 0x0c;
         mask = CPSR_A | CPSR_I;
@@ -226,6 +788,8 @@ void do_interrupt(CPUARMState *env)
     }
     switch_mode (env, new_mode);
     env->spsr = cpsr_read(env);
+    /* Clear IT bits.  */
+    env->condexec_bits = 0;
     /* Switch to the new mode, and switch to Arm mode.  */
     /* ??? Thumb interrupt handlers not implemented.  */
     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
@@ -242,9 +806,16 @@ void do_interrupt(CPUARMState *env)
 static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
                            int is_user)
 {
+  int prot_ro;
+
   if (domain == 3)
     return PAGE_READ | PAGE_WRITE;
 
+  if (access_type == 1)
+      prot_ro = 0;
+  else
+      prot_ro = PAGE_READ;
+
   switch (ap) {
   case 0:
       if (access_type == 1)
@@ -261,18 +832,24 @@ static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
       return is_user ? 0 : PAGE_READ | PAGE_WRITE;
   case 2:
       if (is_user)
-          return (access_type == 1) ? 0 : PAGE_READ;
+          return prot_ro;
       else
           return PAGE_READ | PAGE_WRITE;
   case 3:
       return PAGE_READ | PAGE_WRITE;
+  case 4: case 7: /* Reserved.  */
+      return 0;
+  case 5:
+      return is_user ? 0 : prot_ro;
+  case 6:
+      return prot_ro;
   default:
       abort();
   }
 }
 
-static int get_phys_addr(CPUState *env, uint32_t address, int access_type,
-                         int is_user, uint32_t *phys_ptr, int *prot)
+static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
+			    int is_user, uint32_t *phys_ptr, int *prot)
 {
     int code;
     uint32_t table;
@@ -282,94 +859,273 @@ static int get_phys_addr(CPUState *env, uint32_t address, int access_type,
     int domain;
     uint32_t phys_addr;
 
-    /* Fast Context Switch Extension.  */
-    if (address < 0x02000000)
-        address += env->cp15.c13_fcse;
-
-    if ((env->cp15.c1_sys & 1) == 0) {
-        /* MMU diusabled.  */
-        *phys_ptr = address;
-        *prot = PAGE_READ | PAGE_WRITE;
+    /* Pagetable walk.  */
+    /* Lookup l1 descriptor.  */
+    if (address & env->cp15.c2_mask)
+        table = env->cp15.c2_base1;
+    else
+        table = env->cp15.c2_base0;
+    table = (table & 0xffffc000) | ((address >> 18) & 0x3ffc);
+    desc = ldl_phys(table);
+    type = (desc & 3);
+    domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
+    if (type == 0) {
+        /* Section translation fault.  */
+        code = 5;
+        goto do_fault;
+    }
+    if (domain == 0 || domain == 2) {
+        if (type == 2)
+            code = 9; /* Section domain fault.  */
+        else
+            code = 11; /* Page domain fault.  */
+        goto do_fault;
+    }
+    if (type == 2) {
+        /* 1Mb section.  */
+        phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
+        ap = (desc >> 10) & 3;
+        code = 13;
     } else {
-        /* Pagetable walk.  */
-        /* Lookup l1 descriptor.  */
-        table = (env->cp15.c2 & 0xffffc000) | ((address >> 18) & 0x3ffc);
+        /* Lookup l2 entry.  */
+	if (type == 1) {
+	    /* Coarse pagetable.  */
+	    table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
+	} else {
+	    /* Fine pagetable.  */
+	    table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
+	}
         desc = ldl_phys(table);
-        type = (desc & 3);
-        domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
-        if (type == 0) {
-            /* Secton translation fault.  */
-            code = 5;
-            goto do_fault;
-        }
-        if (domain == 0 || domain == 2) {
-            if (type == 2)
-                code = 9; /* Section domain fault.  */
-            else
-                code = 11; /* Page domain fault.  */
+        switch (desc & 3) {
+        case 0: /* Page translation fault.  */
+            code = 7;
             goto do_fault;
+        case 1: /* 64k page.  */
+            phys_addr = (desc & 0xffff0000) | (address & 0xffff);
+            ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
+            break;
+        case 2: /* 4k page.  */
+            phys_addr = (desc & 0xfffff000) | (address & 0xfff);
+            ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
+            break;
+        case 3: /* 1k page.  */
+	    if (type == 1) {
+		if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+		    phys_addr = (desc & 0xfffff000) | (address & 0xfff);
+		} else {
+		    /* Page translation fault.  */
+		    code = 7;
+		    goto do_fault;
+		}
+	    } else {
+		phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
+	    }
+            ap = (desc >> 4) & 3;
+            break;
+        default:
+            /* Never happens, but compiler isn't smart enough to tell.  */
+            abort();
         }
-        if (type == 2) {
-            /* 1Mb section.  */
-            phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
-            ap = (desc >> 10) & 3;
-            code = 13;
+        code = 15;
+    }
+    *prot = check_ap(env, ap, domain, access_type, is_user);
+    if (!*prot) {
+        /* Access permission fault.  */
+        goto do_fault;
+    }
+    *phys_ptr = phys_addr;
+    return 0;
+do_fault:
+    return code | (domain << 4);
+}
+
+static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
+			    int is_user, uint32_t *phys_ptr, int *prot)
+{
+    int code;
+    uint32_t table;
+    uint32_t desc;
+    uint32_t xn;
+    int type;
+    int ap;
+    int domain;
+    uint32_t phys_addr;
+
+    /* Pagetable walk.  */
+    /* Lookup l1 descriptor.  */
+    if (address & env->cp15.c2_mask)
+        table = env->cp15.c2_base1;
+    else
+        table = env->cp15.c2_base0;
+    table = (table & 0xffffc000) | ((address >> 18) & 0x3ffc);
+    desc = ldl_phys(table);
+    type = (desc & 3);
+    if (type == 0) {
+        /* Section translation fault.  */
+        code = 5;
+        domain = 0;
+        goto do_fault;
+    } else if (type == 2 && (desc & (1 << 18))) {
+        /* Supersection.  */
+        domain = 0;
+    } else {
+        /* Section or page.  */
+        domain = (desc >> 4) & 0x1e;
+    }
+    domain = (env->cp15.c3 >> domain) & 3;
+    if (domain == 0 || domain == 2) {
+        if (type == 2)
+            code = 9; /* Section domain fault.  */
+        else
+            code = 11; /* Page domain fault.  */
+        goto do_fault;
+    }
+    if (type == 2) {
+        if (desc & (1 << 18)) {
+            /* Supersection.  */
+            phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
         } else {
-            /* Lookup l2 entry.  */
-            table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
-            desc = ldl_phys(table);
-            switch (desc & 3) {
-            case 0: /* Page translation fault.  */
-                code = 7;
-                goto do_fault;
-            case 1: /* 64k page.  */
-                phys_addr = (desc & 0xffff0000) | (address & 0xffff);
-                ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
-                break;
-            case 2: /* 4k page.  */
-                phys_addr = (desc & 0xfffff000) | (address & 0xfff);
-                ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
-                break;
-            case 3: /* 1k page.  */
-                if (type == 1) {
-                    /* Page translation fault.  */
-                    code = 7;
-                    goto do_fault;
-                }
-                phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
-                ap = (desc >> 4) & 3;
-                break;
-            default:
-                /* Never happens, but compiler isn't smart enough to tell.  */
-                abort();
-            }
-            code = 15;
+            /* Section.  */
+            phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
         }
-        *prot = check_ap(env, ap, domain, access_type, is_user);
-        if (!*prot) {
-            /* Access permission fault.  */
+        ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
+        xn = desc & (1 << 4);
+        code = 13;
+    } else {
+        /* Lookup l2 entry.  */
+        table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
+        desc = ldl_phys(table);
+        ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
+        switch (desc & 3) {
+        case 0: /* Page translation fault.  */
+            code = 7;
             goto do_fault;
+        case 1: /* 64k page.  */
+            phys_addr = (desc & 0xffff0000) | (address & 0xffff);
+            xn = desc & (1 << 15);
+            break;
+        case 2: case 3: /* 4k page.  */
+            phys_addr = (desc & 0xfffff000) | (address & 0xfff);
+            xn = desc & 1;
+            break;
+        default:
+            /* Never happens, but compiler isn't smart enough to tell.  */
+            abort();
         }
-        *phys_ptr = phys_addr;
+        code = 15;
+    }
+    if (xn && access_type == 2)
+        goto do_fault;
+
+    *prot = check_ap(env, ap, domain, access_type, is_user);
+    if (!*prot) {
+        /* Access permission fault.  */
+        goto do_fault;
     }
+    *phys_ptr = phys_addr;
     return 0;
 do_fault:
     return code | (domain << 4);
 }
 
+static int get_phys_addr_mpu(CPUState *env, uint32_t address, int access_type,
+			     int is_user, uint32_t *phys_ptr, int *prot)
+{
+    int n;
+    uint32_t mask;
+    uint32_t base;
+
+    *phys_ptr = address;
+    for (n = 7; n >= 0; n--) {
+	base = env->cp15.c6_region[n];
+	if ((base & 1) == 0)
+	    continue;
+	mask = 1 << ((base >> 1) & 0x1f);
+	/* Keep this shift separate from the above to avoid an
+	   (undefined) << 32.  */
+	mask = (mask << 1) - 1;
+	if (((base ^ address) & ~mask) == 0)
+	    break;
+    }
+    if (n < 0)
+	return 2;
+
+    if (access_type == 2) {
+	mask = env->cp15.c5_insn;
+    } else {
+	mask = env->cp15.c5_data;
+    }
+    mask = (mask >> (n * 4)) & 0xf;
+    switch (mask) {
+    case 0:
+	return 1;
+    case 1:
+	if (is_user)
+	  return 1;
+	*prot = PAGE_READ | PAGE_WRITE;
+	break;
+    case 2:
+	*prot = PAGE_READ;
+	if (!is_user)
+	    *prot |= PAGE_WRITE;
+	break;
+    case 3:
+	*prot = PAGE_READ | PAGE_WRITE;
+	break;
+    case 5:
+	if (is_user)
+	    return 1;
+	*prot = PAGE_READ;
+	break;
+    case 6:
+	*prot = PAGE_READ;
+	break;
+    default:
+	/* Bad permission.  */
+	return 1;
+    }
+    return 0;
+}
+
+static inline int get_phys_addr(CPUState *env, uint32_t address,
+                                int access_type, int is_user,
+                                uint32_t *phys_ptr, int *prot)
+{
+    /* Fast Context Switch Extension.  */
+    if (address < 0x02000000)
+        address += env->cp15.c13_fcse;
+
+    if ((env->cp15.c1_sys & 1) == 0) {
+        /* MMU/MPU disabled.  */
+        *phys_ptr = address;
+        *prot = PAGE_READ | PAGE_WRITE;
+        return 0;
+    } else if (arm_feature(env, ARM_FEATURE_MPU)) {
+	return get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,
+				 prot);
+    } else if (env->cp15.c1_sys & (1 << 23)) {
+        return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,
+                                prot);
+    } else {
+        return get_phys_addr_v5(env, address, access_type, is_user, phys_ptr,
+                                prot);
+    }
+}
+
 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
-                              int access_type, int is_user, int is_softmmu)
+                              int access_type, int mmu_idx, int is_softmmu)
 {
     uint32_t phys_addr;
     int prot;
-    int ret;
+    int ret, is_user;
 
+    is_user = mmu_idx == MMU_USER_IDX;
     ret = get_phys_addr(env, address, access_type, is_user, &phys_addr, &prot);
     if (ret == 0) {
         /* Map a single [sub]page.  */
         phys_addr &= ~(uint32_t)0x3ff;
         address &= ~(uint32_t)0x3ff;
-        return tlb_set_page (env, address, phys_addr, prot, is_user,
+        return tlb_set_page (env, address, phys_addr, prot, mmu_idx,
                              is_softmmu);
     }
 
@@ -379,13 +1135,15 @@ int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
         env->exception_index = EXCP_PREFETCH_ABORT;
     } else {
         env->cp15.c5_data = ret;
+        if (access_type == 1 && arm_feature(env, ARM_FEATURE_V6))
+            env->cp15.c5_data |= (1 << 11);
         env->cp15.c6_data = address;
         env->exception_index = EXCP_DATA_ABORT;
     }
     return 1;
 }
 
-target_ulong cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
+target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 {
     uint32_t phys_addr;
     int prot;
@@ -399,65 +1157,217 @@ target_ulong cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
     return phys_addr;
 }
 
-void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
+/* Not really implemented.  Need to figure out a sane way of doing this.
+   Maybe add generic watchpoint support and use that.  */
+
+void HELPER(mark_exclusive)(CPUState *env, uint32_t addr)
+{
+    env->mmon_addr = addr;
+}
+
+uint32_t HELPER(test_exclusive)(CPUState *env, uint32_t addr)
+{
+    return (env->mmon_addr != addr);
+}
+
+void HELPER(clrex)(CPUState *env)
 {
-    uint32_t op2;
+    env->mmon_addr = -1;
+}
+
+void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
+{
+    int cp_num = (insn >> 8) & 0xf;
+    int cp_info = (insn >> 5) & 7;
+    int src = (insn >> 16) & 0xf;
+    int operand = insn & 0xf;
+
+    if (env->cp[cp_num].cp_write)
+        env->cp[cp_num].cp_write(env->cp[cp_num].opaque,
+                                 cp_info, src, operand, val);
+}
+
+uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
+{
+    int cp_num = (insn >> 8) & 0xf;
+    int cp_info = (insn >> 5) & 7;
+    int dest = (insn >> 16) & 0xf;
+    int operand = insn & 0xf;
+
+    if (env->cp[cp_num].cp_read)
+        return env->cp[cp_num].cp_read(env->cp[cp_num].opaque,
+                                       cp_info, dest, operand);
+    return 0;
+}
+
+/* Return basic MPU access permission bits.  */
+static uint32_t simple_mpu_ap_bits(uint32_t val)
+{
+    uint32_t ret;
+    uint32_t mask;
+    int i;
+    ret = 0;
+    mask = 3;
+    for (i = 0; i < 16; i += 2) {
+        ret |= (val >> i) & mask;
+        mask <<= 2;
+    }
+    return ret;
+}
+
+/* Pad basic MPU access permission bits to extended format.  */
+static uint32_t extended_mpu_ap_bits(uint32_t val)
+{
+    uint32_t ret;
+    uint32_t mask;
+    int i;
+    ret = 0;
+    mask = 3;
+    for (i = 0; i < 16; i += 2) {
+        ret |= (val & mask) << i;
+        mask <<= 2;
+    }
+    return ret;
+}
 
+void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
+{
+    int op1;
+    int op2;
+    int crm;
+
+    op1 = (insn >> 21) & 7;
     op2 = (insn >> 5) & 7;
+    crm = insn & 0xf;
     switch ((insn >> 16) & 0xf) {
-    case 0: /* ID codes.  */
+    case 0:
+        if (((insn >> 21) & 7) == 2) {
+            /* ??? Select cache level.  Ignore.  */
+            return;
+        }
+        /* ID codes.  */
+        if (arm_feature(env, ARM_FEATURE_XSCALE))
+            break;
+        if (arm_feature(env, ARM_FEATURE_OMAPCP))
+            break;
         goto bad_reg;
     case 1: /* System configuration.  */
+        if (arm_feature(env, ARM_FEATURE_OMAPCP))
+            op2 = 0;
         switch (op2) {
         case 0:
-            env->cp15.c1_sys = val;
+            if (!arm_feature(env, ARM_FEATURE_XSCALE) || crm == 0)
+                env->cp15.c1_sys = val;
             /* ??? Lots of these bits are not implemented.  */
             /* This may enable/disable the MMU, so do a TLB flush.  */
             tlb_flush(env, 1);
             break;
+        case 1: /* Auxiliary cotrol register.  */
+            if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+                env->cp15.c1_xscaleauxcr = val;
+                break;
+            }
+            /* Not implemented.  */
+            break;
         case 2:
+            if (arm_feature(env, ARM_FEATURE_XSCALE))
+                goto bad_reg;
             env->cp15.c1_coproc = val;
             /* ??? Is this safe when called from within a TB?  */
             tb_flush(env);
+            break;
         default:
             goto bad_reg;
         }
         break;
-    case 2: /* MMU Page table control.  */
-        env->cp15.c2 = val;
+    case 2: /* MMU Page table control / MPU cache control.  */
+        if (arm_feature(env, ARM_FEATURE_MPU)) {
+            switch (op2) {
+            case 0:
+                env->cp15.c2_data = val;
+                break;
+            case 1:
+                env->cp15.c2_insn = val;
+                break;
+            default:
+                goto bad_reg;
+            }
+        } else {
+	    switch (op2) {
+	    case 0:
+		env->cp15.c2_base0 = val;
+		break;
+	    case 1:
+		env->cp15.c2_base1 = val;
+		break;
+	    case 2:
+		env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> val);
+		break;
+	    default:
+		goto bad_reg;
+	    }
+        }
         break;
-    case 3: /* MMU Domain access control.  */
+    case 3: /* MMU Domain access control / MPU write buffer control.  */
         env->cp15.c3 = val;
-        tlb_flush(env, 1);
+        tlb_flush(env, 1); /* Flush TLB as domain not tracked in TLB */
         break;
     case 4: /* Reserved.  */
         goto bad_reg;
-    case 5: /* MMU Fault status.  */
+    case 5: /* MMU Fault status / MPU access permission.  */
+        if (arm_feature(env, ARM_FEATURE_OMAPCP))
+            op2 = 0;
         switch (op2) {
         case 0:
+            if (arm_feature(env, ARM_FEATURE_MPU))
+                val = extended_mpu_ap_bits(val);
             env->cp15.c5_data = val;
             break;
         case 1:
+            if (arm_feature(env, ARM_FEATURE_MPU))
+                val = extended_mpu_ap_bits(val);
             env->cp15.c5_insn = val;
             break;
-        default:
-            goto bad_reg;
-        }
-        break;
-    case 6: /* MMU Fault address.  */
-        switch (op2) {
-        case 0:
-            env->cp15.c6_data = val;
+        case 2:
+            if (!arm_feature(env, ARM_FEATURE_MPU))
+                goto bad_reg;
+            env->cp15.c5_data = val;
             break;
-        case 1:
-            env->cp15.c6_insn = val;
+        case 3:
+            if (!arm_feature(env, ARM_FEATURE_MPU))
+                goto bad_reg;
+            env->cp15.c5_insn = val;
             break;
         default:
             goto bad_reg;
         }
         break;
+    case 6: /* MMU Fault address / MPU base/size.  */
+        if (arm_feature(env, ARM_FEATURE_MPU)) {
+            if (crm >= 8)
+                goto bad_reg;
+            env->cp15.c6_region[crm] = val;
+        } else {
+            if (arm_feature(env, ARM_FEATURE_OMAPCP))
+                op2 = 0;
+            switch (op2) {
+            case 0:
+                env->cp15.c6_data = val;
+                break;
+            case 1: /* ??? This is WFAR on armv6 */
+            case 2:
+                env->cp15.c6_insn = val;
+                break;
+            default:
+                goto bad_reg;
+            }
+        }
+        break;
     case 7: /* Cache control.  */
+        env->cp15.c15_i_max = 0x000;
+        env->cp15.c15_i_min = 0xff0;
         /* No cache, so nothing to do.  */
+        /* ??? MPCore has VA to PA translation functions.  */
         break;
     case 8: /* MMU TLB control.  */
         switch (op2) {
@@ -475,21 +1385,48 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
             tlb_flush_page(env, val + 0x800);
             tlb_flush_page(env, val + 0xc00);
 #else
-            //tlb_flush(env, 1);
+            tlb_flush(env, 1);
 #endif
             break;
+        case 2: /* Invalidate on ASID.  */
+            tlb_flush(env, val == 0);
+            break;
+        case 3: /* Invalidate single entry on MVA.  */
+            /* ??? This is like case 1, but ignores ASID.  */
+            tlb_flush(env, 1);
+            break;
         default:
             goto bad_reg;
         }
         break;
-    case 9: /* Cache lockdown.  */
-        switch (op2) {
-        case 0:
-            env->cp15.c9_data = val;
-            break;
-        case 1:
-            env->cp15.c9_insn = val;
+    case 9:
+        if (arm_feature(env, ARM_FEATURE_OMAPCP))
             break;
+        switch (crm) {
+        case 0: /* Cache lockdown.  */
+	    switch (op1) {
+	    case 0: /* L1 cache.  */
+		switch (op2) {
+		case 0:
+		    env->cp15.c9_data = val;
+		    break;
+		case 1:
+		    env->cp15.c9_insn = val;
+		    break;
+		default:
+		    goto bad_reg;
+		}
+		break;
+	    case 1: /* L2 cache.  */
+		/* Ignore writes to L2 lockdown/auxiliary registers.  */
+		break;
+	    default:
+		goto bad_reg;
+	    }
+	    break;
+        case 1: /* TCM memory region registers.  */
+            /* Not implemented.  */
+            goto bad_reg;
         default:
             goto bad_reg;
         }
@@ -497,16 +1434,33 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
     case 10: /* MMU TLB lockdown.  */
         /* ??? TLB lockdown not implemented.  */
         break;
-    case 11: /* TCM DMA control.  */
     case 12: /* Reserved.  */
         goto bad_reg;
     case 13: /* Process ID.  */
         switch (op2) {
         case 0:
-            env->cp15.c9_data = val;
+            /* Unlike real hardware the qemu TLB uses virtual addresses,
+               not modified virtual addresses, so this causes a TLB flush.
+             */
+            if (env->cp15.c13_fcse != val)
+              tlb_flush(env, 1);
+            env->cp15.c13_fcse = val;
             break;
         case 1:
-            env->cp15.c9_insn = val;
+            /* This changes the ASID, so do a TLB flush.  */
+            if (env->cp15.c13_context != val
+                && !arm_feature(env, ARM_FEATURE_MPU))
+              tlb_flush(env, 0);
+            env->cp15.c13_context = val;
+            break;
+        case 2:
+            env->cp15.c13_tls1 = val;
+            break;
+        case 3:
+            env->cp15.c13_tls2 = val;
+            break;
+        case 4:
+            env->cp15.c13_tls3 = val;
             break;
         default:
             goto bad_reg;
@@ -515,83 +1469,254 @@ void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
     case 14: /* Reserved.  */
         goto bad_reg;
     case 15: /* Implementation specific.  */
-        /* ??? Internal registers not implemented.  */
+        if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+            if (op2 == 0 && crm == 1) {
+                if (env->cp15.c15_cpar != (val & 0x3fff)) {
+                    /* Changes cp0 to cp13 behavior, so needs a TB flush.  */
+                    tb_flush(env);
+                    env->cp15.c15_cpar = val & 0x3fff;
+                }
+                break;
+            }
+            goto bad_reg;
+        }
+        if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
+            switch (crm) {
+            case 0:
+                break;
+            case 1: /* Set TI925T configuration.  */
+                env->cp15.c15_ticonfig = val & 0xe7;
+                env->cp15.c0_cpuid = (val & (1 << 5)) ? /* OS_TYPE bit */
+                        ARM_CPUID_TI915T : ARM_CPUID_TI925T;
+                break;
+            case 2: /* Set I_max.  */
+                env->cp15.c15_i_max = val;
+                break;
+            case 3: /* Set I_min.  */
+                env->cp15.c15_i_min = val;
+                break;
+            case 4: /* Set thread-ID.  */
+                env->cp15.c15_threadid = val & 0xffff;
+                break;
+            case 8: /* Wait-for-interrupt (deprecated).  */
+                cpu_interrupt(env, CPU_INTERRUPT_HALT);
+                break;
+            default:
+                goto bad_reg;
+            }
+        }
         break;
     }
     return;
 bad_reg:
     /* ??? For debugging only.  Should raise illegal instruction exception.  */
-    cpu_abort(env, "Unimplemented cp15 register read\n");
+    cpu_abort(env, "Unimplemented cp15 register write (c%d, c%d, {%d, %d})\n",
+              (insn >> 16) & 0xf, crm, op1, op2);
 }
 
-uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
+uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
 {
-    uint32_t op2;
+    int op1;
+    int op2;
+    int crm;
 
+    op1 = (insn >> 21) & 7;
     op2 = (insn >> 5) & 7;
+    crm = insn & 0xf;
     switch ((insn >> 16) & 0xf) {
     case 0: /* ID codes.  */
-        switch (op2) {
-        default: /* Device ID.  */
-            return env->cp15.c0_cpuid;
-        case 1: /* Cache Type.  */
-            return 0x1dd20d2;
-        case 2: /* TCM status.  */
+        switch (op1) {
+        case 0:
+            switch (crm) {
+            case 0:
+                switch (op2) {
+                case 0: /* Device ID.  */
+                    return env->cp15.c0_cpuid;
+                case 1: /* Cache Type.  */
+		    return env->cp15.c0_cachetype;
+                case 2: /* TCM status.  */
+                    return 0;
+                case 3: /* TLB type register.  */
+                    return 0; /* No lockable TLB entries.  */
+                case 5: /* CPU ID */
+                    return env->cpu_index;
+                default:
+                    goto bad_reg;
+                }
+            case 1:
+                if (!arm_feature(env, ARM_FEATURE_V6))
+                    goto bad_reg;
+                return env->cp15.c0_c1[op2];
+            case 2:
+                if (!arm_feature(env, ARM_FEATURE_V6))
+                    goto bad_reg;
+                return env->cp15.c0_c2[op2];
+            case 3: case 4: case 5: case 6: case 7:
+                return 0;
+            default:
+                goto bad_reg;
+            }
+        case 1:
+            /* These registers aren't documented on arm11 cores.  However
+               Linux looks at them anyway.  */
+            if (!arm_feature(env, ARM_FEATURE_V6))
+                goto bad_reg;
+            if (crm != 0)
+                goto bad_reg;
+            if (arm_feature(env, ARM_FEATURE_XSCALE))
+                goto bad_reg;
             return 0;
+        default:
+            goto bad_reg;
         }
     case 1: /* System configuration.  */
+        if (arm_feature(env, ARM_FEATURE_OMAPCP))
+            op2 = 0;
         switch (op2) {
         case 0: /* Control register.  */
             return env->cp15.c1_sys;
         case 1: /* Auxiliary control register.  */
-            if (arm_feature(env, ARM_FEATURE_AUXCR))
+            if (arm_feature(env, ARM_FEATURE_XSCALE))
+                return env->cp15.c1_xscaleauxcr;
+            if (!arm_feature(env, ARM_FEATURE_AUXCR))
+                goto bad_reg;
+            switch (ARM_CPUID(env)) {
+            case ARM_CPUID_ARM1026:
                 return 1;
-            goto bad_reg;
+            case ARM_CPUID_ARM1136:
+            case ARM_CPUID_ARM1136_R2:
+                return 7;
+            case ARM_CPUID_ARM11MPCORE:
+                return 1;
+            case ARM_CPUID_CORTEXA8:
+                return 0;
+            default:
+                goto bad_reg;
+            }
         case 2: /* Coprocessor access register.  */
+            if (arm_feature(env, ARM_FEATURE_XSCALE))
+                goto bad_reg;
             return env->cp15.c1_coproc;
         default:
             goto bad_reg;
         }
-    case 2: /* MMU Page table control.  */
-        return env->cp15.c2;
-    case 3: /* MMU Domain access control.  */
+    case 2: /* MMU Page table control / MPU cache control.  */
+        if (arm_feature(env, ARM_FEATURE_MPU)) {
+            switch (op2) {
+            case 0:
+                return env->cp15.c2_data;
+                break;
+            case 1:
+                return env->cp15.c2_insn;
+                break;
+            default:
+                goto bad_reg;
+            }
+        } else {
+	    switch (op2) {
+	    case 0:
+		return env->cp15.c2_base0;
+	    case 1:
+		return env->cp15.c2_base1;
+	    case 2:
+		{
+		    int n;
+		    uint32_t mask;
+		    n = 0;
+		    mask = env->cp15.c2_mask;
+		    while (mask) {
+			n++;
+			mask <<= 1;
+		    }
+		    return n;
+		}
+	    default:
+		goto bad_reg;
+	    }
+	}
+    case 3: /* MMU Domain access control / MPU write buffer control.  */
         return env->cp15.c3;
     case 4: /* Reserved.  */
         goto bad_reg;
-    case 5: /* MMU Fault status.  */
+    case 5: /* MMU Fault status / MPU access permission.  */
+        if (arm_feature(env, ARM_FEATURE_OMAPCP))
+            op2 = 0;
         switch (op2) {
         case 0:
+            if (arm_feature(env, ARM_FEATURE_MPU))
+                return simple_mpu_ap_bits(env->cp15.c5_data);
             return env->cp15.c5_data;
         case 1:
+            if (arm_feature(env, ARM_FEATURE_MPU))
+                return simple_mpu_ap_bits(env->cp15.c5_data);
+            return env->cp15.c5_insn;
+        case 2:
+            if (!arm_feature(env, ARM_FEATURE_MPU))
+                goto bad_reg;
+            return env->cp15.c5_data;
+        case 3:
+            if (!arm_feature(env, ARM_FEATURE_MPU))
+                goto bad_reg;
             return env->cp15.c5_insn;
         default:
             goto bad_reg;
         }
     case 6: /* MMU Fault address.  */
-        switch (op2) {
-        case 0:
-            return env->cp15.c6_data;
-        case 1:
-            /* Arm9 doesn't have an IFAR, but implementing it anyway shouldn't
-               do any harm.  */
-            return env->cp15.c6_insn;
-        default:
-            goto bad_reg;
+        if (arm_feature(env, ARM_FEATURE_MPU)) {
+            if (crm >= 8)
+                goto bad_reg;
+            return env->cp15.c6_region[crm];
+        } else {
+            if (arm_feature(env, ARM_FEATURE_OMAPCP))
+                op2 = 0;
+	    switch (op2) {
+	    case 0:
+		return env->cp15.c6_data;
+	    case 1:
+		if (arm_feature(env, ARM_FEATURE_V6)) {
+		    /* Watchpoint Fault Adrress.  */
+		    return 0; /* Not implemented.  */
+		} else {
+		    /* Instruction Fault Adrress.  */
+		    /* Arm9 doesn't have an IFAR, but implementing it anyway
+		       shouldn't do any harm.  */
+		    return env->cp15.c6_insn;
+		}
+	    case 2:
+		if (arm_feature(env, ARM_FEATURE_V6)) {
+		    /* Instruction Fault Adrress.  */
+		    return env->cp15.c6_insn;
+		} else {
+		    goto bad_reg;
+		}
+	    default:
+		goto bad_reg;
+	    }
         }
     case 7: /* Cache control.  */
-        /* ??? This is for test, clean and invaidate operations that set the
-           Z flag.  We can't represent N = Z = 1, so it also clears clears
-           the N flag.  Oh well.  */
-        env->NZF = 0;
+        /* FIXME: Should only clear Z flag if destination is r15.  */
+        env->ZF = 0;
         return 0;
     case 8: /* MMU TLB control.  */
         goto bad_reg;
     case 9: /* Cache lockdown.  */
-        switch (op2) {
-        case 0:
-            return env->cp15.c9_data;
-        case 1:
-            return env->cp15.c9_insn;
+        switch (op1) {
+        case 0: /* L1 cache.  */
+	    if (arm_feature(env, ARM_FEATURE_OMAPCP))
+		return 0;
+            switch (op2) {
+            case 0:
+                return env->cp15.c9_data;
+            case 1:
+                return env->cp15.c9_insn;
+            default:
+                goto bad_reg;
+            }
+        case 1: /* L2 cache */
+            if (crm != 0)
+                goto bad_reg;
+            /* L2 Lockdown and Auxiliary control.  */
+            return 0;
         default:
             goto bad_reg;
         }
@@ -607,19 +1732,822 @@ uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
             return env->cp15.c13_fcse;
         case 1:
             return env->cp15.c13_context;
+        case 2:
+            return env->cp15.c13_tls1;
+        case 3:
+            return env->cp15.c13_tls2;
+        case 4:
+            return env->cp15.c13_tls3;
         default:
             goto bad_reg;
         }
     case 14: /* Reserved.  */
         goto bad_reg;
     case 15: /* Implementation specific.  */
-        /* ??? Internal registers not implemented.  */
+        if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+            if (op2 == 0 && crm == 1)
+                return env->cp15.c15_cpar;
+
+            goto bad_reg;
+        }
+        if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
+            switch (crm) {
+            case 0:
+                return 0;
+            case 1: /* Read TI925T configuration.  */
+                return env->cp15.c15_ticonfig;
+            case 2: /* Read I_max.  */
+                return env->cp15.c15_i_max;
+            case 3: /* Read I_min.  */
+                return env->cp15.c15_i_min;
+            case 4: /* Read thread-ID.  */
+                return env->cp15.c15_threadid;
+            case 8: /* TI925T_status */
+                return 0;
+            }
+            /* TODO: Peripheral port remap register:
+             * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt
+             * controller base address at $rn & ~0xfff and map size of
+             * 0x200 << ($rn & 0xfff), when MMU is off.  */
+            goto bad_reg;
+        }
         return 0;
     }
 bad_reg:
     /* ??? For debugging only.  Should raise illegal instruction exception.  */
-    cpu_abort(env, "Unimplemented cp15 register read\n");
+    cpu_abort(env, "Unimplemented cp15 register read (c%d, c%d, {%d, %d})\n",
+              (insn >> 16) & 0xf, crm, op1, op2);
     return 0;
 }
 
+void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
+{
+    env->banked_r13[bank_number(mode)] = val;
+}
+
+uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
+{
+    return env->banked_r13[bank_number(mode)];
+}
+
+uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
+{
+    switch (reg) {
+    case 0: /* APSR */
+        return xpsr_read(env) & 0xf8000000;
+    case 1: /* IAPSR */
+        return xpsr_read(env) & 0xf80001ff;
+    case 2: /* EAPSR */
+        return xpsr_read(env) & 0xff00fc00;
+    case 3: /* xPSR */
+        return xpsr_read(env) & 0xff00fdff;
+    case 5: /* IPSR */
+        return xpsr_read(env) & 0x000001ff;
+    case 6: /* EPSR */
+        return xpsr_read(env) & 0x0700fc00;
+    case 7: /* IEPSR */
+        return xpsr_read(env) & 0x0700edff;
+    case 8: /* MSP */
+        return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
+    case 9: /* PSP */
+        return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
+    case 16: /* PRIMASK */
+        return (env->uncached_cpsr & CPSR_I) != 0;
+    case 17: /* FAULTMASK */
+        return (env->uncached_cpsr & CPSR_F) != 0;
+    case 18: /* BASEPRI */
+    case 19: /* BASEPRI_MAX */
+        return env->v7m.basepri;
+    case 20: /* CONTROL */
+        return env->v7m.control;
+    default:
+        /* ??? For debugging only.  */
+        cpu_abort(env, "Unimplemented system register read (%d)\n", reg);
+        return 0;
+    }
+}
+
+void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
+{
+    switch (reg) {
+    case 0: /* APSR */
+        xpsr_write(env, val, 0xf8000000);
+        break;
+    case 1: /* IAPSR */
+        xpsr_write(env, val, 0xf8000000);
+        break;
+    case 2: /* EAPSR */
+        xpsr_write(env, val, 0xfe00fc00);
+        break;
+    case 3: /* xPSR */
+        xpsr_write(env, val, 0xfe00fc00);
+        break;
+    case 5: /* IPSR */
+        /* IPSR bits are readonly.  */
+        break;
+    case 6: /* EPSR */
+        xpsr_write(env, val, 0x0600fc00);
+        break;
+    case 7: /* IEPSR */
+        xpsr_write(env, val, 0x0600fc00);
+        break;
+    case 8: /* MSP */
+        if (env->v7m.current_sp)
+            env->v7m.other_sp = val;
+        else
+            env->regs[13] = val;
+        break;
+    case 9: /* PSP */
+        if (env->v7m.current_sp)
+            env->regs[13] = val;
+        else
+            env->v7m.other_sp = val;
+        break;
+    case 16: /* PRIMASK */
+        if (val & 1)
+            env->uncached_cpsr |= CPSR_I;
+        else
+            env->uncached_cpsr &= ~CPSR_I;
+        break;
+    case 17: /* FAULTMASK */
+        if (val & 1)
+            env->uncached_cpsr |= CPSR_F;
+        else
+            env->uncached_cpsr &= ~CPSR_F;
+        break;
+    case 18: /* BASEPRI */
+        env->v7m.basepri = val & 0xff;
+        break;
+    case 19: /* BASEPRI_MAX */
+        val &= 0xff;
+        if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
+            env->v7m.basepri = val;
+        break;
+    case 20: /* CONTROL */
+        env->v7m.control = val & 3;
+        switch_v7m_sp(env, (val & 2) != 0);
+        break;
+    default:
+        /* ??? For debugging only.  */
+        cpu_abort(env, "Unimplemented system register write (%d)\n", reg);
+        return;
+    }
+}
+
+void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
+                ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
+                void *opaque)
+{
+    if (cpnum < 0 || cpnum > 14) {
+        cpu_abort(env, "Bad coprocessor number: %i\n", cpnum);
+        return;
+    }
+
+    env->cp[cpnum].cp_read = cp_read;
+    env->cp[cpnum].cp_write = cp_write;
+    env->cp[cpnum].opaque = opaque;
+}
+
+#endif
+
+/* Note that signed overflow is undefined in C.  The following routines are
+   careful to use unsigned types where modulo arithmetic is required.
+   Failure to do so _will_ break on newer gcc.  */
+
+/* Signed saturating arithmetic.  */
+
+/* Perform 16-bit signed saturating addition.  */
+static inline uint16_t add16_sat(uint16_t a, uint16_t b)
+{
+    uint16_t res;
+
+    res = a + b;
+    if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
+        if (a & 0x8000)
+            res = 0x8000;
+        else
+            res = 0x7fff;
+    }
+    return res;
+}
+
+/* Perform 8-bit signed saturating addition.  */
+static inline uint8_t add8_sat(uint8_t a, uint8_t b)
+{
+    uint8_t res;
+
+    res = a + b;
+    if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
+        if (a & 0x80)
+            res = 0x80;
+        else
+            res = 0x7f;
+    }
+    return res;
+}
+
+/* Perform 16-bit signed saturating subtraction.  */
+static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
+{
+    uint16_t res;
+
+    res = a - b;
+    if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
+        if (a & 0x8000)
+            res = 0x8000;
+        else
+            res = 0x7fff;
+    }
+    return res;
+}
+
+/* Perform 8-bit signed saturating subtraction.  */
+static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
+{
+    uint8_t res;
+
+    res = a - b;
+    if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
+        if (a & 0x80)
+            res = 0x80;
+        else
+            res = 0x7f;
+    }
+    return res;
+}
+
+#define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
+#define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
+#define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
+#define SUB8(a, b, n)  RESULT(sub8_sat(a, b), n, 8);
+#define PFX q
+
+#include "op_addsub.h"
+
+/* Unsigned saturating arithmetic.  */
+static inline uint16_t add16_usat(uint16_t a, uint16_t b)
+{
+    uint16_t res;
+    res = a + b;
+    if (res < a)
+        res = 0xffff;
+    return res;
+}
+
+static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
+{
+    if (a < b)
+        return a - b;
+    else
+        return 0;
+}
+
+static inline uint8_t add8_usat(uint8_t a, uint8_t b)
+{
+    uint8_t res;
+    res = a + b;
+    if (res < a)
+        res = 0xff;
+    return res;
+}
+
+static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
+{
+    if (a < b)
+        return a - b;
+    else
+        return 0;
+}
+
+#define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
+#define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
+#define ADD8(a, b, n)  RESULT(add8_usat(a, b), n, 8);
+#define SUB8(a, b, n)  RESULT(sub8_usat(a, b), n, 8);
+#define PFX uq
+
+#include "op_addsub.h"
+
+/* Signed modulo arithmetic.  */
+#define SARITH16(a, b, n, op) do { \
+    int32_t sum; \
+    sum = (int16_t)((uint16_t)(a) op (uint16_t)(b)); \
+    RESULT(sum, n, 16); \
+    if (sum >= 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define SARITH8(a, b, n, op) do { \
+    int32_t sum; \
+    sum = (int8_t)((uint8_t)(a) op (uint8_t)(b)); \
+    RESULT(sum, n, 8); \
+    if (sum >= 0) \
+        ge |= 1 << n; \
+    } while(0)
+
+
+#define ADD16(a, b, n) SARITH16(a, b, n, +)
+#define SUB16(a, b, n) SARITH16(a, b, n, -)
+#define ADD8(a, b, n)  SARITH8(a, b, n, +)
+#define SUB8(a, b, n)  SARITH8(a, b, n, -)
+#define PFX s
+#define ARITH_GE
+
+#include "op_addsub.h"
+
+/* Unsigned modulo arithmetic.  */
+#define ADD16(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
+    RESULT(sum, n, 16); \
+    if ((sum >> 16) == 1) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define ADD8(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
+    RESULT(sum, n, 8); \
+    if ((sum >> 8) == 1) \
+        ge |= 1 << n; \
+    } while(0)
+
+#define SUB16(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
+    RESULT(sum, n, 16); \
+    if ((sum >> 16) == 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define SUB8(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
+    RESULT(sum, n, 8); \
+    if ((sum >> 8) == 0) \
+        ge |= 1 << n; \
+    } while(0)
+
+#define PFX u
+#define ARITH_GE
+
+#include "op_addsub.h"
+
+/* Halved signed arithmetic.  */
+#define ADD16(a, b, n) \
+  RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
+#define SUB16(a, b, n) \
+  RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
+#define ADD8(a, b, n) \
+  RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
+#define SUB8(a, b, n) \
+  RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
+#define PFX sh
+
+#include "op_addsub.h"
+
+/* Halved unsigned arithmetic.  */
+#define ADD16(a, b, n) \
+  RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
+#define SUB16(a, b, n) \
+  RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
+#define ADD8(a, b, n) \
+  RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
+#define SUB8(a, b, n) \
+  RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
+#define PFX uh
+
+#include "op_addsub.h"
+
+static inline uint8_t do_usad(uint8_t a, uint8_t b)
+{
+    if (a > b)
+        return a - b;
+    else
+        return b - a;
+}
+
+/* Unsigned sum of absolute byte differences.  */
+uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
+{
+    uint32_t sum;
+    sum = do_usad(a, b);
+    sum += do_usad(a >> 8, b >> 8);
+    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 24, b >> 24);
+    return sum;
+}
+
+/* For ARMv6 SEL instruction.  */
+uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
+{
+    uint32_t mask;
+
+    mask = 0;
+    if (flags & 1)
+        mask |= 0xff;
+    if (flags & 2)
+        mask |= 0xff00;
+    if (flags & 4)
+        mask |= 0xff0000;
+    if (flags & 8)
+        mask |= 0xff000000;
+    return (a & mask) | (b & ~mask);
+}
+
+uint32_t HELPER(logicq_cc)(uint64_t val)
+{
+    return (val >> 32) | (val != 0);
+}
+
+/* VFP support.  We follow the convention used for VFP instrunctions:
+   Single precition routines have a "s" suffix, double precision a
+   "d" suffix.  */
+
+/* Convert host exception flags to vfp form.  */
+static inline int vfp_exceptbits_from_host(int host_bits)
+{
+    int target_bits = 0;
+
+    if (host_bits & float_flag_invalid)
+        target_bits |= 1;
+    if (host_bits & float_flag_divbyzero)
+        target_bits |= 2;
+    if (host_bits & float_flag_overflow)
+        target_bits |= 4;
+    if (host_bits & float_flag_underflow)
+        target_bits |= 8;
+    if (host_bits & float_flag_inexact)
+        target_bits |= 0x10;
+    return target_bits;
+}
+
+uint32_t HELPER(vfp_get_fpscr)(CPUState *env)
+{
+    int i;
+    uint32_t fpscr;
+
+    fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
+            | (env->vfp.vec_len << 16)
+            | (env->vfp.vec_stride << 20);
+    i = get_float_exception_flags(&env->vfp.fp_status);
+    fpscr |= vfp_exceptbits_from_host(i);
+    return fpscr;
+}
+
+/* Convert vfp exception flags to target form.  */
+static inline int vfp_exceptbits_to_host(int target_bits)
+{
+    int host_bits = 0;
+
+    if (target_bits & 1)
+        host_bits |= float_flag_invalid;
+    if (target_bits & 2)
+        host_bits |= float_flag_divbyzero;
+    if (target_bits & 4)
+        host_bits |= float_flag_overflow;
+    if (target_bits & 8)
+        host_bits |= float_flag_underflow;
+    if (target_bits & 0x10)
+        host_bits |= float_flag_inexact;
+    return host_bits;
+}
+
+void HELPER(vfp_set_fpscr)(CPUState *env, uint32_t val)
+{
+    int i;
+    uint32_t changed;
+
+    changed = env->vfp.xregs[ARM_VFP_FPSCR];
+    env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
+    env->vfp.vec_len = (val >> 16) & 7;
+    env->vfp.vec_stride = (val >> 20) & 3;
+
+    changed ^= val;
+    if (changed & (3 << 22)) {
+        i = (val >> 22) & 3;
+        switch (i) {
+        case 0:
+            i = float_round_nearest_even;
+            break;
+        case 1:
+            i = float_round_up;
+            break;
+        case 2:
+            i = float_round_down;
+            break;
+        case 3:
+            i = float_round_to_zero;
+            break;
+        }
+        set_float_rounding_mode(i, &env->vfp.fp_status);
+    }
+
+    i = vfp_exceptbits_to_host((val >> 8) & 0x1f);
+    set_float_exception_flags(i, &env->vfp.fp_status);
+    /* XXX: FZ and DN are not implemented.  */
+}
+
+#define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
+
+#define VFP_BINOP(name) \
+float32 VFP_HELPER(name, s)(float32 a, float32 b, CPUState *env) \
+{ \
+    return float32_ ## name (a, b, &env->vfp.fp_status); \
+} \
+float64 VFP_HELPER(name, d)(float64 a, float64 b, CPUState *env) \
+{ \
+    return float64_ ## name (a, b, &env->vfp.fp_status); \
+}
+VFP_BINOP(add)
+VFP_BINOP(sub)
+VFP_BINOP(mul)
+VFP_BINOP(div)
+#undef VFP_BINOP
+
+float32 VFP_HELPER(neg, s)(float32 a)
+{
+    return float32_chs(a);
+}
+
+float64 VFP_HELPER(neg, d)(float64 a)
+{
+    return float64_chs(a);
+}
+
+float32 VFP_HELPER(abs, s)(float32 a)
+{
+    return float32_abs(a);
+}
+
+float64 VFP_HELPER(abs, d)(float64 a)
+{
+    return float64_abs(a);
+}
+
+float32 VFP_HELPER(sqrt, s)(float32 a, CPUState *env)
+{
+    return float32_sqrt(a, &env->vfp.fp_status);
+}
+
+float64 VFP_HELPER(sqrt, d)(float64 a, CPUState *env)
+{
+    return float64_sqrt(a, &env->vfp.fp_status);
+}
+
+/* XXX: check quiet/signaling case */
+#define DO_VFP_cmp(p, type) \
+void VFP_HELPER(cmp, p)(type a, type b, CPUState *env)  \
+{ \
+    uint32_t flags; \
+    switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
+    case 0: flags = 0x6; break; \
+    case -1: flags = 0x8; break; \
+    case 1: flags = 0x2; break; \
+    default: case 2: flags = 0x3; break; \
+    } \
+    env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
+        | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
+} \
+void VFP_HELPER(cmpe, p)(type a, type b, CPUState *env) \
+{ \
+    uint32_t flags; \
+    switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
+    case 0: flags = 0x6; break; \
+    case -1: flags = 0x8; break; \
+    case 1: flags = 0x2; break; \
+    default: case 2: flags = 0x3; break; \
+    } \
+    env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
+        | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
+}
+DO_VFP_cmp(s, float32)
+DO_VFP_cmp(d, float64)
+#undef DO_VFP_cmp
+
+/* Helper routines to perform bitwise copies between float and int.  */
+static inline float32 vfp_itos(uint32_t i)
+{
+    union {
+        uint32_t i;
+        float32 s;
+    } v;
+
+    v.i = i;
+    return v.s;
+}
+
+static inline uint32_t vfp_stoi(float32 s)
+{
+    union {
+        uint32_t i;
+        float32 s;
+    } v;
+
+    v.s = s;
+    return v.i;
+}
+
+static inline float64 vfp_itod(uint64_t i)
+{
+    union {
+        uint64_t i;
+        float64 d;
+    } v;
+
+    v.i = i;
+    return v.d;
+}
+
+static inline uint64_t vfp_dtoi(float64 d)
+{
+    union {
+        uint64_t i;
+        float64 d;
+    } v;
+
+    v.d = d;
+    return v.i;
+}
+
+/* Integer to float conversion.  */
+float32 VFP_HELPER(uito, s)(float32 x, CPUState *env)
+{
+    return uint32_to_float32(vfp_stoi(x), &env->vfp.fp_status);
+}
+
+float64 VFP_HELPER(uito, d)(float32 x, CPUState *env)
+{
+    return uint32_to_float64(vfp_stoi(x), &env->vfp.fp_status);
+}
+
+float32 VFP_HELPER(sito, s)(float32 x, CPUState *env)
+{
+    return int32_to_float32(vfp_stoi(x), &env->vfp.fp_status);
+}
+
+float64 VFP_HELPER(sito, d)(float32 x, CPUState *env)
+{
+    return int32_to_float64(vfp_stoi(x), &env->vfp.fp_status);
+}
+
+/* Float to integer conversion.  */
+float32 VFP_HELPER(toui, s)(float32 x, CPUState *env)
+{
+    return vfp_itos(float32_to_uint32(x, &env->vfp.fp_status));
+}
+
+float32 VFP_HELPER(toui, d)(float64 x, CPUState *env)
+{
+    return vfp_itos(float64_to_uint32(x, &env->vfp.fp_status));
+}
+
+float32 VFP_HELPER(tosi, s)(float32 x, CPUState *env)
+{
+    return vfp_itos(float32_to_int32(x, &env->vfp.fp_status));
+}
+
+float32 VFP_HELPER(tosi, d)(float64 x, CPUState *env)
+{
+    return vfp_itos(float64_to_int32(x, &env->vfp.fp_status));
+}
+
+float32 VFP_HELPER(touiz, s)(float32 x, CPUState *env)
+{
+    return vfp_itos(float32_to_uint32_round_to_zero(x, &env->vfp.fp_status));
+}
+
+float32 VFP_HELPER(touiz, d)(float64 x, CPUState *env)
+{
+    return vfp_itos(float64_to_uint32_round_to_zero(x, &env->vfp.fp_status));
+}
+
+float32 VFP_HELPER(tosiz, s)(float32 x, CPUState *env)
+{
+    return vfp_itos(float32_to_int32_round_to_zero(x, &env->vfp.fp_status));
+}
+
+float32 VFP_HELPER(tosiz, d)(float64 x, CPUState *env)
+{
+    return vfp_itos(float64_to_int32_round_to_zero(x, &env->vfp.fp_status));
+}
+
+/* floating point conversion */
+float64 VFP_HELPER(fcvtd, s)(float32 x, CPUState *env)
+{
+    return float32_to_float64(x, &env->vfp.fp_status);
+}
+
+float32 VFP_HELPER(fcvts, d)(float64 x, CPUState *env)
+{
+    return float64_to_float32(x, &env->vfp.fp_status);
+}
+
+/* VFP3 fixed point conversion.  */
+#define VFP_CONV_FIX(name, p, ftype, itype, sign) \
+ftype VFP_HELPER(name##to, p)(ftype x, uint32_t shift, CPUState *env) \
+{ \
+    ftype tmp; \
+    tmp = sign##int32_to_##ftype ((itype)vfp_##p##toi(x), \
+                                  &env->vfp.fp_status); \
+    return ftype##_scalbn(tmp, shift, &env->vfp.fp_status); \
+} \
+ftype VFP_HELPER(to##name, p)(ftype x, uint32_t shift, CPUState *env) \
+{ \
+    ftype tmp; \
+    tmp = ftype##_scalbn(x, shift, &env->vfp.fp_status); \
+    return vfp_ito##p((itype)ftype##_to_##sign##int32_round_to_zero(tmp, \
+        &env->vfp.fp_status)); \
+}
+
+VFP_CONV_FIX(sh, d, float64, int16, )
+VFP_CONV_FIX(sl, d, float64, int32, )
+VFP_CONV_FIX(uh, d, float64, uint16, u)
+VFP_CONV_FIX(ul, d, float64, uint32, u)
+VFP_CONV_FIX(sh, s, float32, int16, )
+VFP_CONV_FIX(sl, s, float32, int32, )
+VFP_CONV_FIX(uh, s, float32, uint16, u)
+VFP_CONV_FIX(ul, s, float32, uint32, u)
+#undef VFP_CONV_FIX
+
+float32 HELPER(recps_f32)(float32 a, float32 b, CPUState *env)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 two = int32_to_float32(2, s);
+    return float32_sub(two, float32_mul(a, b, s), s);
+}
+
+float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUState *env)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 three = int32_to_float32(3, s);
+    return float32_sub(three, float32_mul(a, b, s), s);
+}
+
+/* NEON helpers.  */
+
+/* TODO: The architecture specifies the value that the estimate functions
+   should return.  We return the exact reciprocal/root instead.  */
+float32 HELPER(recpe_f32)(float32 a, CPUState *env)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 one = int32_to_float32(1, s);
+    return float32_div(one, a, s);
+}
+
+float32 HELPER(rsqrte_f32)(float32 a, CPUState *env)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 one = int32_to_float32(1, s);
+    return float32_div(one, float32_sqrt(a, s), s);
+}
+
+uint32_t HELPER(recpe_u32)(uint32_t a, CPUState *env)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 tmp;
+    tmp = int32_to_float32(a, s);
+    tmp = float32_scalbn(tmp, -32, s);
+    tmp = helper_recpe_f32(tmp, env);
+    tmp = float32_scalbn(tmp, 31, s);
+    return float32_to_int32(tmp, s);
+}
+
+uint32_t HELPER(rsqrte_u32)(uint32_t a, CPUState *env)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 tmp;
+    tmp = int32_to_float32(a, s);
+    tmp = float32_scalbn(tmp, -32, s);
+    tmp = helper_rsqrte_f32(tmp, env);
+    tmp = float32_scalbn(tmp, 31, s);
+    return float32_to_int32(tmp, s);
+}
+
+#ifdef CONFIG_TRACE
+#include "trace.h"
+void  HELPER(traceTicks)(uint32_t  ticks)
+{
+    sim_time += ticks;
+}
+
+void  HELPER(traceInsn)(void)
+{
+    trace_insn_helper();
+}
+
+#if HOST_LONG_BITS == 32
+void HELPER(traceBB32)(uint32_t  hi, uint32_t  lo, uint32_t  tb)
+{
+    uint64_t  bb_num = ((uint64_t)hi << 32) | lo;
+    trace_bb_helper(bb_num, (void*)tb);
+}
 #endif
+
+#if HOST_LONG_BITS == 64
+void HELPER(traceBB64)(uint64_t  bb_num, uint64_t  tb)
+{
+    trace_bb_helper(bb_num, (void*)tb);
+}
+#endif
+
+#endif /* CONFIG_TRACE */
diff --git a/target-arm/helpers.h b/target-arm/helpers.h
new file mode 100644
index 0000000..cef53be
--- /dev/null
+++ b/target-arm/helpers.h
@@ -0,0 +1,548 @@
+#define DEF_HELPER(name, ret, args) ret glue(helper_,name) args;
+
+#ifdef GEN_HELPER
+#define DEF_HELPER_0_0(name, ret, args) \
+DEF_HELPER(name, ret, args) \
+static inline void gen_helper_##name(void) \
+{ \
+    tcg_gen_helper_0_0(helper_##name); \
+}
+#define DEF_HELPER_0_1(name, ret, args) \
+DEF_HELPER(name, ret, args) \
+static inline void gen_helper_##name(TCGv arg1) \
+{ \
+    tcg_gen_helper_0_1(helper_##name, arg1); \
+}
+#define DEF_HELPER_0_2(name, ret, args) \
+DEF_HELPER(name, ret, args) \
+static inline void gen_helper_##name(TCGv arg1, TCGv arg2) \
+{ \
+    tcg_gen_helper_0_2(helper_##name, arg1, arg2); \
+}
+#define DEF_HELPER_0_3(name, ret, args) \
+DEF_HELPER(name, ret, args) \
+static inline void gen_helper_##name( \
+    TCGv arg1, TCGv arg2, TCGv arg3) \
+{ \
+    tcg_gen_helper_0_3(helper_##name, arg1, arg2, arg3); \
+}
+#define DEF_HELPER_1_0(name, ret, args) \
+DEF_HELPER(name, ret, args) \
+static inline void gen_helper_##name(TCGv ret) \
+{ \
+    tcg_gen_helper_1_0(helper_##name, ret); \
+}
+#define DEF_HELPER_1_1(name, ret, args) \
+DEF_HELPER(name, ret, args) \
+static inline void gen_helper_##name(TCGv ret, TCGv arg1) \
+{ \
+    tcg_gen_helper_1_1(helper_##name, ret, arg1); \
+}
+#define DEF_HELPER_1_2(name, ret, args) \
+DEF_HELPER(name, ret, args) \
+static inline void gen_helper_##name(TCGv ret, TCGv arg1, TCGv arg2) \
+{ \
+    tcg_gen_helper_1_2(helper_##name, ret, arg1, arg2); \
+}
+#define DEF_HELPER_1_3(name, ret, args) \
+DEF_HELPER(name, ret, args) \
+static inline void gen_helper_##name(TCGv ret, \
+    TCGv arg1, TCGv arg2, TCGv arg3) \
+{ \
+    tcg_gen_helper_1_3(helper_##name, ret, arg1, arg2, arg3); \
+}
+#define DEF_HELPER_1_4(name, ret, args) \
+DEF_HELPER(name, ret, args) \
+static inline void gen_helper_##name(TCGv ret, \
+    TCGv arg1, TCGv arg2, TCGv arg3, TCGv arg4) \
+{ \
+    tcg_gen_helper_1_4(helper_##name, ret, arg1, arg2, arg3, arg4); \
+}
+#else /* !GEN_HELPER */
+#define DEF_HELPER_0_0 DEF_HELPER
+#define DEF_HELPER_0_1 DEF_HELPER
+#define DEF_HELPER_0_2 DEF_HELPER
+#define DEF_HELPER_0_3 DEF_HELPER
+#define DEF_HELPER_1_0 DEF_HELPER
+#define DEF_HELPER_1_1 DEF_HELPER
+#define DEF_HELPER_1_2 DEF_HELPER
+#define DEF_HELPER_1_3 DEF_HELPER
+#define DEF_HELPER_1_4 DEF_HELPER
+#define HELPER(x) glue(helper_,x)
+#endif
+
+DEF_HELPER_1_1(clz, uint32_t, (uint32_t))
+DEF_HELPER_1_1(sxtb16, uint32_t, (uint32_t))
+DEF_HELPER_1_1(uxtb16, uint32_t, (uint32_t))
+
+DEF_HELPER_1_2(add_setq, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(add_saturate, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(sub_saturate, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(add_usaturate, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(sub_usaturate, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_1(double_saturate, uint32_t, (int32_t))
+DEF_HELPER_1_2(sdiv, int32_t, (int32_t, int32_t))
+DEF_HELPER_1_2(udiv, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_1(rbit, uint32_t, (uint32_t))
+DEF_HELPER_1_1(abs, uint32_t, (uint32_t))
+
+#ifdef CONFIG_TRACE
+DEF_HELPER_0_1(traceTicks,void,(uint32_t))
+DEF_HELPER_0_0(traceInsn,void,(void))
+DEF_HELPER_0_3(traceBB32,void,(uint32_t,uint32_t,uint32_t))
+DEF_HELPER_0_2(traceBB64,void,(uint64_t,uint64_t))
+#endif
+
+#define PAS_OP(pfx)  \
+    DEF_HELPER_1_3(pfx ## add8, uint32_t, (uint32_t, uint32_t, uint32_t *)) \
+    DEF_HELPER_1_3(pfx ## sub8, uint32_t, (uint32_t, uint32_t, uint32_t *)) \
+    DEF_HELPER_1_3(pfx ## sub16, uint32_t, (uint32_t, uint32_t, uint32_t *)) \
+    DEF_HELPER_1_3(pfx ## add16, uint32_t, (uint32_t, uint32_t, uint32_t *)) \
+    DEF_HELPER_1_3(pfx ## addsubx, uint32_t, (uint32_t, uint32_t, uint32_t *)) \
+    DEF_HELPER_1_3(pfx ## subaddx, uint32_t, (uint32_t, uint32_t, uint32_t *))
+
+PAS_OP(s)
+PAS_OP(u)
+#undef PAS_OP
+
+#define PAS_OP(pfx)  \
+    DEF_HELPER_1_2(pfx ## add8, uint32_t, (uint32_t, uint32_t)) \
+    DEF_HELPER_1_2(pfx ## sub8, uint32_t, (uint32_t, uint32_t)) \
+    DEF_HELPER_1_2(pfx ## sub16, uint32_t, (uint32_t, uint32_t)) \
+    DEF_HELPER_1_2(pfx ## add16, uint32_t, (uint32_t, uint32_t)) \
+    DEF_HELPER_1_2(pfx ## addsubx, uint32_t, (uint32_t, uint32_t)) \
+    DEF_HELPER_1_2(pfx ## subaddx, uint32_t, (uint32_t, uint32_t))
+PAS_OP(q)
+PAS_OP(sh)
+PAS_OP(uq)
+PAS_OP(uh)
+#undef PAS_OP
+
+DEF_HELPER_1_2(ssat, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(usat, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(ssat16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(usat16, uint32_t, (uint32_t, uint32_t))
+
+DEF_HELPER_1_2(usad8, uint32_t, (uint32_t, uint32_t))
+
+DEF_HELPER_1_1(logicq_cc, uint32_t, (uint64_t))
+
+DEF_HELPER_1_3(sel_flags, uint32_t, (uint32_t, uint32_t, uint32_t))
+DEF_HELPER_0_1(exception, void, (uint32_t))
+DEF_HELPER_0_0(wfi, void, (void))
+
+DEF_HELPER_0_2(cpsr_write, void, (uint32_t, uint32_t))
+DEF_HELPER_1_0(cpsr_read, uint32_t, (void))
+
+DEF_HELPER_0_3(v7m_msr, void, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_2(v7m_mrs, uint32_t, (CPUState *, uint32_t))
+
+DEF_HELPER_0_3(set_cp15, void, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_2(get_cp15, uint32_t, (CPUState *, uint32_t))
+
+DEF_HELPER_0_3(set_cp, void, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_2(get_cp, uint32_t, (CPUState *, uint32_t))
+
+DEF_HELPER_1_2(get_r13_banked, uint32_t, (CPUState *, uint32_t))
+DEF_HELPER_0_3(set_r13_banked, void, (CPUState *, uint32_t, uint32_t))
+
+DEF_HELPER_0_2(mark_exclusive, void, (CPUState *, uint32_t))
+DEF_HELPER_1_2(test_exclusive, uint32_t, (CPUState *, uint32_t))
+DEF_HELPER_0_1(clrex, void, (CPUState *))
+
+DEF_HELPER_1_1(get_user_reg, uint32_t, (uint32_t))
+DEF_HELPER_0_2(set_user_reg, void, (uint32_t, uint32_t))
+
+DEF_HELPER_1_1(vfp_get_fpscr, uint32_t, (CPUState *))
+DEF_HELPER_0_2(vfp_set_fpscr, void, (CPUState *, uint32_t))
+
+DEF_HELPER_1_3(vfp_adds, float32, (float32, float32, CPUState *))
+DEF_HELPER_1_3(vfp_addd, float64, (float64, float64, CPUState *))
+DEF_HELPER_1_3(vfp_subs, float32, (float32, float32, CPUState *))
+DEF_HELPER_1_3(vfp_subd, float64, (float64, float64, CPUState *))
+DEF_HELPER_1_3(vfp_muls, float32, (float32, float32, CPUState *))
+DEF_HELPER_1_3(vfp_muld, float64, (float64, float64, CPUState *))
+DEF_HELPER_1_3(vfp_divs, float32, (float32, float32, CPUState *))
+DEF_HELPER_1_3(vfp_divd, float64, (float64, float64, CPUState *))
+DEF_HELPER_1_1(vfp_negs, float32, (float32))
+DEF_HELPER_1_1(vfp_negd, float64, (float64))
+DEF_HELPER_1_1(vfp_abss, float32, (float32))
+DEF_HELPER_1_1(vfp_absd, float64, (float64))
+DEF_HELPER_1_2(vfp_sqrts, float32, (float32, CPUState *))
+DEF_HELPER_1_2(vfp_sqrtd, float64, (float64, CPUState *))
+DEF_HELPER_0_3(vfp_cmps, void, (float32, float32, CPUState *))
+DEF_HELPER_0_3(vfp_cmpd, void, (float64, float64, CPUState *))
+DEF_HELPER_0_3(vfp_cmpes, void, (float32, float32, CPUState *))
+DEF_HELPER_0_3(vfp_cmped, void, (float64, float64, CPUState *))
+
+DEF_HELPER_1_2(vfp_fcvtds, float64, (float32, CPUState *))
+DEF_HELPER_1_2(vfp_fcvtsd, float32, (float64, CPUState *))
+
+DEF_HELPER_1_2(vfp_uitos, float32, (float32, CPUState *))
+DEF_HELPER_1_2(vfp_uitod, float64, (float32, CPUState *))
+DEF_HELPER_1_2(vfp_sitos, float32, (float32, CPUState *))
+DEF_HELPER_1_2(vfp_sitod, float64, (float32, CPUState *))
+
+DEF_HELPER_1_2(vfp_touis, float32, (float32, CPUState *))
+DEF_HELPER_1_2(vfp_touid, float32, (float64, CPUState *))
+DEF_HELPER_1_2(vfp_touizs, float32, (float32, CPUState *))
+DEF_HELPER_1_2(vfp_touizd, float32, (float64, CPUState *))
+DEF_HELPER_1_2(vfp_tosis, float32, (float32, CPUState *))
+DEF_HELPER_1_2(vfp_tosid, float32, (float64, CPUState *))
+DEF_HELPER_1_2(vfp_tosizs, float32, (float32, CPUState *))
+DEF_HELPER_1_2(vfp_tosizd, float32, (float64, CPUState *))
+
+DEF_HELPER_1_3(vfp_toshs, float32, (float32, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_tosls, float32, (float32, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_touhs, float32, (float32, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_touls, float32, (float32, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_toshd, float64, (float64, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_tosld, float64, (float64, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_touhd, float64, (float64, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_tould, float64, (float64, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_shtos, float32, (float32, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_sltos, float32, (float32, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_uhtos, float32, (float32, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_ultos, float32, (float32, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_shtod, float64, (float64, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_sltod, float64, (float64, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_uhtod, float64, (float64, uint32_t, CPUState *))
+DEF_HELPER_1_3(vfp_ultod, float64, (float64, uint32_t, CPUState *))
+
+DEF_HELPER_1_3(recps_f32, float32, (float32, float32, CPUState *))
+DEF_HELPER_1_3(rsqrts_f32, float32, (float32, float32, CPUState *))
+DEF_HELPER_1_2(recpe_f32, float32, (float32, CPUState *))
+DEF_HELPER_1_2(rsqrte_f32, float32, (float32, CPUState *))
+DEF_HELPER_1_2(recpe_u32, uint32_t, (uint32_t, CPUState *))
+DEF_HELPER_1_2(rsqrte_u32, uint32_t, (uint32_t, CPUState *))
+DEF_HELPER_1_4(neon_tbl, uint32_t, (uint32_t, uint32_t, uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_add_saturate_u64, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_add_saturate_s64, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_sub_saturate_u64, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_sub_saturate_s64, uint64_t, (uint64_t, uint64_t))
+
+DEF_HELPER_1_2(add_cc, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(adc_cc, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(sub_cc, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(sbc_cc, uint32_t, (uint32_t, uint32_t))
+
+DEF_HELPER_1_2(shl, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(shr, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(sar, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(ror, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(shl_cc, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(shr_cc, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(sar_cc, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(ror_cc, uint32_t, (uint32_t, uint32_t))
+
+/* neon_helper.c */
+DEF_HELPER_1_3(neon_qadd_u8, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qadd_s8, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qadd_u16, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qadd_s16, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qsub_u8, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qsub_s8, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qsub_u16, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qsub_s16, uint32_t, (CPUState *, uint32_t, uint32_t))
+
+DEF_HELPER_1_2(neon_hadd_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_hadd_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_hadd_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_hadd_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_hadd_s32, int32_t, (int32_t, int32_t))
+DEF_HELPER_1_2(neon_hadd_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rhadd_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rhadd_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rhadd_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rhadd_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rhadd_s32, int32_t, (int32_t, int32_t))
+DEF_HELPER_1_2(neon_rhadd_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_hsub_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_hsub_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_hsub_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_hsub_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_hsub_s32, int32_t, (int32_t, int32_t))
+DEF_HELPER_1_2(neon_hsub_u32, uint32_t, (uint32_t, uint32_t))
+
+DEF_HELPER_1_2(neon_cgt_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cgt_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cgt_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cgt_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cgt_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cgt_s32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cge_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cge_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cge_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cge_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cge_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cge_s32, uint32_t, (uint32_t, uint32_t))
+
+DEF_HELPER_1_2(neon_min_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_min_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_min_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_min_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_min_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_min_s32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_max_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_max_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_max_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_max_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_max_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_max_s32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmin_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmin_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmin_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmin_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmin_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmin_s32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmax_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmax_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmax_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmax_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmax_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_pmax_s32, uint32_t, (uint32_t, uint32_t))
+
+DEF_HELPER_1_2(neon_abd_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abd_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abd_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abd_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abd_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abd_s32, uint32_t, (uint32_t, uint32_t))
+
+DEF_HELPER_1_2(neon_shl_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_shl_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_shl_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_shl_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_shl_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_shl_s32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_shl_u64, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_shl_s64, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_rshl_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rshl_s8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rshl_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rshl_s16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rshl_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rshl_s32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_rshl_u64, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_rshl_s64, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_3(neon_qshl_u8, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qshl_s8, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qshl_u16, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qshl_s16, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qshl_u32, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qshl_s32, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qshl_u64, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(neon_qshl_s64, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(neon_qrshl_u8, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qrshl_s8, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qrshl_u16, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qrshl_s16, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qrshl_u32, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qrshl_s32, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qrshl_u64, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(neon_qrshl_s64, uint64_t, (CPUState *, uint64_t, uint64_t))
+
+DEF_HELPER_1_2(neon_add_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_add_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_padd_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_padd_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_sub_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_sub_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_mul_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_mul_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_mul_p8, uint32_t, (uint32_t, uint32_t))
+
+DEF_HELPER_1_2(neon_tst_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_tst_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_tst_u32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_ceq_u8, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_ceq_u16, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_ceq_u32, uint32_t, (uint32_t, uint32_t))
+
+DEF_HELPER_1_1(neon_abs_s8, uint32_t, (uint32_t))
+DEF_HELPER_1_1(neon_abs_s16, uint32_t, (uint32_t))
+DEF_HELPER_1_1(neon_clz_u8, uint32_t, (uint32_t))
+DEF_HELPER_1_1(neon_clz_u16, uint32_t, (uint32_t))
+DEF_HELPER_1_1(neon_cls_s8, uint32_t, (uint32_t))
+DEF_HELPER_1_1(neon_cls_s16, uint32_t, (uint32_t))
+DEF_HELPER_1_1(neon_cls_s32, uint32_t, (uint32_t))
+DEF_HELPER_1_1(neon_cnt_u8, uint32_t, (uint32_t))
+
+DEF_HELPER_1_3(neon_qdmulh_s16, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qrdmulh_s16, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qdmulh_s32, uint32_t, (CPUState *, uint32_t, uint32_t))
+DEF_HELPER_1_3(neon_qrdmulh_s32, uint32_t, (CPUState *, uint32_t, uint32_t))
+
+DEF_HELPER_1_1(neon_narrow_u8, uint32_t, (uint64_t))
+DEF_HELPER_1_1(neon_narrow_u16, uint32_t, (uint64_t))
+DEF_HELPER_1_2(neon_narrow_sat_u8, uint32_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(neon_narrow_sat_s8, uint32_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(neon_narrow_sat_u16, uint32_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(neon_narrow_sat_s16, uint32_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(neon_narrow_sat_u32, uint32_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(neon_narrow_sat_s32, uint32_t, (CPUState *, uint64_t))
+DEF_HELPER_1_1(neon_narrow_high_u8, uint32_t, (uint64_t))
+DEF_HELPER_1_1(neon_narrow_high_u16, uint32_t, (uint64_t))
+DEF_HELPER_1_1(neon_narrow_round_high_u8, uint32_t, (uint64_t))
+DEF_HELPER_1_1(neon_narrow_round_high_u16, uint32_t, (uint64_t))
+DEF_HELPER_1_1(neon_widen_u8, uint64_t, (uint32_t))
+DEF_HELPER_1_1(neon_widen_s8, uint64_t, (uint32_t))
+DEF_HELPER_1_1(neon_widen_u16, uint64_t, (uint32_t))
+DEF_HELPER_1_1(neon_widen_s16, uint64_t, (uint32_t))
+
+DEF_HELPER_1_2(neon_addl_u16, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_addl_u32, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_paddl_u16, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_paddl_u32, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_subl_u16, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_subl_u32, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_3(neon_addl_saturate_s32, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(neon_addl_saturate_s64, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_2(neon_abdl_u16, uint64_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abdl_s16, uint64_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abdl_u32, uint64_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abdl_s32, uint64_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abdl_u64, uint64_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abdl_s64, uint64_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_mull_u8, uint64_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_mull_s8, uint64_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_mull_u16, uint64_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_mull_s16, uint64_t, (uint32_t, uint32_t))
+
+DEF_HELPER_1_1(neon_negl_u16, uint64_t, (uint64_t))
+DEF_HELPER_1_1(neon_negl_u32, uint64_t, (uint64_t))
+DEF_HELPER_1_1(neon_negl_u64, uint64_t, (uint64_t))
+
+DEF_HELPER_1_2(neon_qabs_s8, uint32_t, (CPUState *, uint32_t))
+DEF_HELPER_1_2(neon_qabs_s16, uint32_t, (CPUState *, uint32_t))
+DEF_HELPER_1_2(neon_qabs_s32, uint32_t, (CPUState *, uint32_t))
+DEF_HELPER_1_2(neon_qneg_s8, uint32_t, (CPUState *, uint32_t))
+DEF_HELPER_1_2(neon_qneg_s16, uint32_t, (CPUState *, uint32_t))
+DEF_HELPER_1_2(neon_qneg_s32, uint32_t, (CPUState *, uint32_t))
+
+DEF_HELPER_0_0(neon_trn_u8, void, (void))
+DEF_HELPER_0_0(neon_trn_u16, void, (void))
+DEF_HELPER_0_0(neon_unzip_u8, void, (void))
+DEF_HELPER_0_0(neon_zip_u8, void, (void))
+DEF_HELPER_0_0(neon_zip_u16, void, (void))
+
+DEF_HELPER_1_2(neon_min_f32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_max_f32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_abd_f32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_add_f32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_sub_f32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_mul_f32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_ceq_f32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cge_f32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_cgt_f32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_acge_f32, uint32_t, (uint32_t, uint32_t))
+DEF_HELPER_1_2(neon_acgt_f32, uint32_t, (uint32_t, uint32_t))
+
+/* iwmmxt_helper.c */
+DEF_HELPER_1_2(iwmmxt_maddsq, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(iwmmxt_madduq, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(iwmmxt_sadb, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(iwmmxt_sadw, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(iwmmxt_mulslw, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(iwmmxt_mulshw, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(iwmmxt_mululw, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(iwmmxt_muluhw, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(iwmmxt_macsw, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_2(iwmmxt_macuw, uint64_t, (uint64_t, uint64_t))
+DEF_HELPER_1_1(iwmmxt_setpsr_nz, uint32_t, (uint64_t))
+
+#define DEF_IWMMXT_HELPER_SIZE_ENV(name) \
+DEF_HELPER_1_3(iwmmxt_##name##b, uint64_t, (CPUState *, uint64_t, uint64_t)) \
+DEF_HELPER_1_3(iwmmxt_##name##w, uint64_t, (CPUState *, uint64_t, uint64_t)) \
+DEF_HELPER_1_3(iwmmxt_##name##l, uint64_t, (CPUState *, uint64_t, uint64_t)) \
+
+DEF_IWMMXT_HELPER_SIZE_ENV(unpackl)
+DEF_IWMMXT_HELPER_SIZE_ENV(unpackh)
+
+DEF_HELPER_1_2(iwmmxt_unpacklub, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpackluw, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpacklul, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpackhub, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpackhuw, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpackhul, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpacklsb, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpacklsw, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpacklsl, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpackhsb, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpackhsw, uint64_t, (CPUState *, uint64_t))
+DEF_HELPER_1_2(iwmmxt_unpackhsl, uint64_t, (CPUState *, uint64_t))
+
+DEF_IWMMXT_HELPER_SIZE_ENV(cmpeq)
+DEF_IWMMXT_HELPER_SIZE_ENV(cmpgtu)
+DEF_IWMMXT_HELPER_SIZE_ENV(cmpgts)
+
+DEF_IWMMXT_HELPER_SIZE_ENV(mins)
+DEF_IWMMXT_HELPER_SIZE_ENV(minu)
+DEF_IWMMXT_HELPER_SIZE_ENV(maxs)
+DEF_IWMMXT_HELPER_SIZE_ENV(maxu)
+
+DEF_IWMMXT_HELPER_SIZE_ENV(subn)
+DEF_IWMMXT_HELPER_SIZE_ENV(addn)
+DEF_IWMMXT_HELPER_SIZE_ENV(subu)
+DEF_IWMMXT_HELPER_SIZE_ENV(addu)
+DEF_IWMMXT_HELPER_SIZE_ENV(subs)
+DEF_IWMMXT_HELPER_SIZE_ENV(adds)
+
+DEF_HELPER_1_3(iwmmxt_avgb0, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(iwmmxt_avgb1, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(iwmmxt_avgw0, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(iwmmxt_avgw1, uint64_t, (CPUState *, uint64_t, uint64_t))
+
+DEF_HELPER_1_2(iwmmxt_msadb, uint64_t, (uint64_t, uint64_t))
+
+DEF_HELPER_1_3(iwmmxt_align, uint64_t, (uint64_t, uint64_t, uint32_t))
+DEF_HELPER_1_4(iwmmxt_insr, uint64_t, (uint64_t, uint32_t, uint32_t, uint32_t))
+
+DEF_HELPER_1_1(iwmmxt_bcstb, uint64_t, (uint32_t))
+DEF_HELPER_1_1(iwmmxt_bcstw, uint64_t, (uint32_t))
+DEF_HELPER_1_1(iwmmxt_bcstl, uint64_t, (uint32_t))
+
+DEF_HELPER_1_1(iwmmxt_addcb, uint64_t, (uint64_t))
+DEF_HELPER_1_1(iwmmxt_addcw, uint64_t, (uint64_t))
+DEF_HELPER_1_1(iwmmxt_addcl, uint64_t, (uint64_t))
+
+DEF_HELPER_1_1(iwmmxt_msbb, uint32_t, (uint64_t))
+DEF_HELPER_1_1(iwmmxt_msbw, uint32_t, (uint64_t))
+DEF_HELPER_1_1(iwmmxt_msbl, uint32_t, (uint64_t))
+
+DEF_HELPER_1_3(iwmmxt_srlw, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_srll, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_srlq, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_sllw, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_slll, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_sllq, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_sraw, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_sral, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_sraq, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_rorw, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_rorl, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_rorq, uint64_t, (CPUState *, uint64_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_shufh, uint64_t, (CPUState *, uint64_t, uint32_t))
+
+DEF_HELPER_1_3(iwmmxt_packuw, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(iwmmxt_packul, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(iwmmxt_packuq, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(iwmmxt_packsw, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(iwmmxt_packsl, uint64_t, (CPUState *, uint64_t, uint64_t))
+DEF_HELPER_1_3(iwmmxt_packsq, uint64_t, (CPUState *, uint64_t, uint64_t))
+
+DEF_HELPER_1_3(iwmmxt_muladdsl, uint64_t, (uint64_t, uint32_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_muladdsw, uint64_t, (uint64_t, uint32_t, uint32_t))
+DEF_HELPER_1_3(iwmmxt_muladdswl, uint64_t, (uint64_t, uint32_t, uint32_t))
+
+#undef DEF_HELPER
+#undef DEF_HELPER_0_0
+#undef DEF_HELPER_0_1
+#undef DEF_HELPER_0_2
+#undef DEF_HELPER_0_3
+#undef DEF_HELPER_1_0
+#undef DEF_HELPER_1_1
+#undef DEF_HELPER_1_2
+#undef DEF_HELPER_1_3
+#undef DEF_HELPER_1_4
+#undef GEN_HELPER
diff --git a/target-arm/iwmmxt_helper.c b/target-arm/iwmmxt_helper.c
new file mode 100644
index 0000000..6e801c8
--- /dev/null
+++ b/target-arm/iwmmxt_helper.c
@@ -0,0 +1,682 @@
+/*
+ * iwMMXt micro operations for XScale.
+ *
+ * Copyright (c) 2007 OpenedHand, Ltd.
+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
+ * Copyright (c) 2008 CodeSourcery
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+
+#include "cpu.h"
+#include "exec-all.h"
+#include "helpers.h"
+
+/* iwMMXt macros extracted from GNU gdb.  */
+
+/* Set the SIMD wCASF flags for 8, 16, 32 or 64-bit operations.  */
+#define SIMD8_SET( v, n, b)	((v != 0) << ((((b) + 1) * 4) + (n)))
+#define SIMD16_SET(v, n, h)	((v != 0) << ((((h) + 1) * 8) + (n)))
+#define SIMD32_SET(v, n, w)	((v != 0) << ((((w) + 1) * 16) + (n)))
+#define SIMD64_SET(v, n)	((v != 0) << (32 + (n)))
+/* Flags to pass as "n" above.  */
+#define SIMD_NBIT	-1
+#define SIMD_ZBIT	-2
+#define SIMD_CBIT	-3
+#define SIMD_VBIT	-4
+/* Various status bit macros.  */
+#define NBIT8(x)	((x) & 0x80)
+#define NBIT16(x)	((x) & 0x8000)
+#define NBIT32(x)	((x) & 0x80000000)
+#define NBIT64(x)	((x) & 0x8000000000000000ULL)
+#define ZBIT8(x)	(((x) & 0xff) == 0)
+#define ZBIT16(x)	(((x) & 0xffff) == 0)
+#define ZBIT32(x)	(((x) & 0xffffffff) == 0)
+#define ZBIT64(x)	(x == 0)
+/* Sign extension macros.  */
+#define EXTEND8H(a)	((uint16_t) (int8_t) (a))
+#define EXTEND8(a)	((uint32_t) (int8_t) (a))
+#define EXTEND16(a)	((uint32_t) (int16_t) (a))
+#define EXTEND16S(a)	((int32_t) (int16_t) (a))
+#define EXTEND32(a)	((uint64_t) (int32_t) (a))
+
+uint64_t HELPER(iwmmxt_maddsq)(uint64_t a, uint64_t b)
+{
+    a = ((
+            EXTEND16S((a >> 0) & 0xffff) * EXTEND16S((b >> 0) & 0xffff) +
+            EXTEND16S((a >> 16) & 0xffff) * EXTEND16S((b >> 16) & 0xffff)
+        ) & 0xffffffff) | ((uint64_t) (
+            EXTEND16S((a >> 32) & 0xffff) * EXTEND16S((b >> 32) & 0xffff) +
+            EXTEND16S((a >> 48) & 0xffff) * EXTEND16S((b >> 48) & 0xffff)
+        ) << 32);
+    return a;
+}
+
+uint64_t HELPER(iwmmxt_madduq)(uint64_t a, uint64_t b)
+{
+    a = ((
+            ((a >> 0) & 0xffff) * ((b >> 0) & 0xffff) +
+            ((a >> 16) & 0xffff) * ((b >> 16) & 0xffff)
+        ) & 0xffffffff) | ((
+            ((a >> 32) & 0xffff) * ((b >> 32) & 0xffff) +
+            ((a >> 48) & 0xffff) * ((b >> 48) & 0xffff)
+        ) << 32);
+    return a;
+}
+
+uint64_t HELPER(iwmmxt_sadb)(uint64_t a, uint64_t b)
+{
+#define abs(x) (((x) >= 0) ? x : -x)
+#define SADB(SHR) abs((int) ((a >> SHR) & 0xff) - (int) ((b >> SHR) & 0xff))
+    return
+        SADB(0) + SADB(8) + SADB(16) + SADB(24) +
+        SADB(32) + SADB(40) + SADB(48) + SADB(56);
+#undef SADB
+}
+
+uint64_t HELPER(iwmmxt_sadw)(uint64_t a, uint64_t b)
+{
+#define SADW(SHR) \
+    abs((int) ((a >> SHR) & 0xffff) - (int) ((b >> SHR) & 0xffff))
+    return SADW(0) + SADW(16) + SADW(32) + SADW(48);
+#undef SADW
+}
+
+uint64_t HELPER(iwmmxt_mulslw)(uint64_t a, uint64_t b)
+{
+#define MULS(SHR) ((uint64_t) ((( \
+        EXTEND16S((a >> SHR) & 0xffff) * EXTEND16S((b >> SHR) & 0xffff) \
+    ) >> 0) & 0xffff) << SHR)
+    return MULS(0) | MULS(16) | MULS(32) | MULS(48);
+#undef MULS
+}
+
+uint64_t HELPER(iwmmxt_mulshw)(uint64_t a, uint64_t b)
+{
+#define MULS(SHR) ((uint64_t) ((( \
+        EXTEND16S((a >> SHR) & 0xffff) * EXTEND16S((b >> SHR) & 0xffff) \
+    ) >> 16) & 0xffff) << SHR)
+    return MULS(0) | MULS(16) | MULS(32) | MULS(48);
+#undef MULS
+}
+
+uint64_t HELPER(iwmmxt_mululw)(uint64_t a, uint64_t b)
+{
+#define MULU(SHR) ((uint64_t) ((( \
+        ((a >> SHR) & 0xffff) * ((b >> SHR) & 0xffff) \
+    ) >> 0) & 0xffff) << SHR)
+    return MULU(0) | MULU(16) | MULU(32) | MULU(48);
+#undef MULU
+}
+
+uint64_t HELPER(iwmmxt_muluhw)(uint64_t a, uint64_t b)
+{
+#define MULU(SHR) ((uint64_t) ((( \
+        ((a >> SHR) & 0xffff) * ((b >> SHR) & 0xffff) \
+    ) >> 16) & 0xffff) << SHR)
+    return MULU(0) | MULU(16) | MULU(32) | MULU(48);
+#undef MULU
+}
+
+uint64_t HELPER(iwmmxt_macsw)(uint64_t a, uint64_t b)
+{
+#define MACS(SHR) ( \
+        EXTEND16((a >> SHR) & 0xffff) * EXTEND16S((b >> SHR) & 0xffff))
+    return (int64_t) (MACS(0) + MACS(16) + MACS(32) + MACS(48));
+#undef MACS
+}
+
+uint64_t HELPER(iwmmxt_macuw)(uint64_t a, uint64_t b)
+{
+#define MACU(SHR) ( \
+        (uint32_t) ((a >> SHR) & 0xffff) * \
+        (uint32_t) ((b >> SHR) & 0xffff))
+    return MACU(0) + MACU(16) + MACU(32) + MACU(48);
+#undef MACU
+}
+
+#define NZBIT8(x, i) \
+    SIMD8_SET(NBIT8((x) & 0xff), SIMD_NBIT, i) | \
+    SIMD8_SET(ZBIT8((x) & 0xff), SIMD_ZBIT, i)
+#define NZBIT16(x, i) \
+    SIMD16_SET(NBIT16((x) & 0xffff), SIMD_NBIT, i) | \
+    SIMD16_SET(ZBIT16((x) & 0xffff), SIMD_ZBIT, i)
+#define NZBIT32(x, i) \
+    SIMD32_SET(NBIT32((x) & 0xffffffff), SIMD_NBIT, i) | \
+    SIMD32_SET(ZBIT32((x) & 0xffffffff), SIMD_ZBIT, i)
+#define NZBIT64(x) \
+    SIMD64_SET(NBIT64(x), SIMD_NBIT) | \
+    SIMD64_SET(ZBIT64(x), SIMD_ZBIT)
+#define IWMMXT_OP_UNPACK(S, SH0, SH1, SH2, SH3)			\
+uint64_t HELPER(glue(iwmmxt_unpack, glue(S, b)))(CPUState *env, \
+                                                 uint64_t a, uint64_t b) \
+{								\
+    a =							        \
+        (((a >> SH0) & 0xff) << 0) | (((b >> SH0) & 0xff) << 8) |	\
+        (((a >> SH1) & 0xff) << 16) | (((b >> SH1) & 0xff) << 24) |	\
+        (((a >> SH2) & 0xff) << 32) | (((b >> SH2) & 0xff) << 40) |	\
+        (((a >> SH3) & 0xff) << 48) | (((b >> SH3) & 0xff) << 56);	\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =			\
+        NZBIT8(a >> 0, 0) | NZBIT8(a >> 8, 1) |		        \
+        NZBIT8(a >> 16, 2) | NZBIT8(a >> 24, 3) |		\
+        NZBIT8(a >> 32, 4) | NZBIT8(a >> 40, 5) |		\
+        NZBIT8(a >> 48, 6) | NZBIT8(a >> 56, 7);		\
+    return a;                                                   \
+}								\
+uint64_t HELPER(glue(iwmmxt_unpack, glue(S, w)))(CPUState *env, \
+                                        uint64_t a, uint64_t b) \
+{								\
+    a =							        \
+        (((a >> SH0) & 0xffff) << 0) |				\
+        (((b >> SH0) & 0xffff) << 16) |			        \
+        (((a >> SH2) & 0xffff) << 32) |			        \
+        (((b >> SH2) & 0xffff) << 48);				\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =			\
+        NZBIT8(a >> 0, 0) | NZBIT8(a >> 16, 1) |		\
+        NZBIT8(a >> 32, 2) | NZBIT8(a >> 48, 3);		\
+    return a;                                                   \
+}								\
+uint64_t HELPER(glue(iwmmxt_unpack, glue(S, l)))(CPUState *env, \
+                                        uint64_t a, uint64_t b) \
+{								\
+    a =							        \
+        (((a >> SH0) & 0xffffffff) << 0) |			\
+        (((b >> SH0) & 0xffffffff) << 32);			\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =			\
+        NZBIT32(a >> 0, 0) | NZBIT32(a >> 32, 1);		\
+    return a;                                                   \
+}								\
+uint64_t HELPER(glue(iwmmxt_unpack, glue(S, ub)))(CPUState *env, \
+                                                  uint64_t x)   \
+{								\
+    x =							        \
+        (((x >> SH0) & 0xff) << 0) |				\
+        (((x >> SH1) & 0xff) << 16) |				\
+        (((x >> SH2) & 0xff) << 32) |				\
+        (((x >> SH3) & 0xff) << 48);				\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =			\
+        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |		\
+        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);		\
+    return x;                                                   \
+}								\
+uint64_t HELPER(glue(iwmmxt_unpack, glue(S, uw)))(CPUState *env, \
+                                                  uint64_t x)   \
+{								\
+    x =							        \
+        (((x >> SH0) & 0xffff) << 0) |				\
+        (((x >> SH2) & 0xffff) << 32);				\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =			\
+        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);		\
+    return x;                                                   \
+}								\
+uint64_t HELPER(glue(iwmmxt_unpack, glue(S, ul)))(CPUState *env, \
+                                                  uint64_t x)   \
+{								\
+    x = (((x >> SH0) & 0xffffffff) << 0);			\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x >> 0);	\
+    return x;                                                   \
+}								\
+uint64_t HELPER(glue(iwmmxt_unpack, glue(S, sb)))(CPUState *env, \
+                                                  uint64_t x)   \
+{								\
+    x =							        \
+        ((uint64_t) EXTEND8H((x >> SH0) & 0xff) << 0) |	        \
+        ((uint64_t) EXTEND8H((x >> SH1) & 0xff) << 16) |	\
+        ((uint64_t) EXTEND8H((x >> SH2) & 0xff) << 32) |	\
+        ((uint64_t) EXTEND8H((x >> SH3) & 0xff) << 48);	        \
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =			\
+        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |		\
+        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);		\
+    return x;                                                   \
+}								\
+uint64_t HELPER(glue(iwmmxt_unpack, glue(S, sw)))(CPUState *env, \
+                                                  uint64_t x)   \
+{								\
+    x =							        \
+        ((uint64_t) EXTEND16((x >> SH0) & 0xffff) << 0) |	\
+        ((uint64_t) EXTEND16((x >> SH2) & 0xffff) << 32);	\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =			\
+        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);		\
+    return x;                                                   \
+}								\
+uint64_t HELPER(glue(iwmmxt_unpack, glue(S, sl)))(CPUState *env, \
+                                                  uint64_t x)   \
+{								\
+    x = EXTEND32((x >> SH0) & 0xffffffff);			\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x >> 0);	\
+    return x;                                                   \
+}
+IWMMXT_OP_UNPACK(l, 0, 8, 16, 24)
+IWMMXT_OP_UNPACK(h, 32, 40, 48, 56)
+
+#define IWMMXT_OP_CMP(SUFF, Tb, Tw, Tl, O)			\
+uint64_t HELPER(glue(iwmmxt_, glue(SUFF, b)))(CPUState *env,    \
+                                        uint64_t a, uint64_t b) \
+{								\
+    a =							        \
+        CMP(0, Tb, O, 0xff) | CMP(8, Tb, O, 0xff) |		\
+        CMP(16, Tb, O, 0xff) | CMP(24, Tb, O, 0xff) |		\
+        CMP(32, Tb, O, 0xff) | CMP(40, Tb, O, 0xff) |		\
+        CMP(48, Tb, O, 0xff) | CMP(56, Tb, O, 0xff);		\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =			\
+        NZBIT8(a >> 0, 0) | NZBIT8(a >> 8, 1) |		        \
+        NZBIT8(a >> 16, 2) | NZBIT8(a >> 24, 3) |		\
+        NZBIT8(a >> 32, 4) | NZBIT8(a >> 40, 5) |		\
+        NZBIT8(a >> 48, 6) | NZBIT8(a >> 56, 7);		\
+    return a;                                                   \
+}								\
+uint64_t HELPER(glue(iwmmxt_, glue(SUFF, w)))(CPUState *env,    \
+                                        uint64_t a, uint64_t b) \
+{								\
+    a = CMP(0, Tw, O, 0xffff) | CMP(16, Tw, O, 0xffff) |	\
+        CMP(32, Tw, O, 0xffff) | CMP(48, Tw, O, 0xffff);	\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =			\
+        NZBIT16(a >> 0, 0) | NZBIT16(a >> 16, 1) |		\
+        NZBIT16(a >> 32, 2) | NZBIT16(a >> 48, 3);		\
+    return a;                                                   \
+}								\
+uint64_t HELPER(glue(iwmmxt_, glue(SUFF, l)))(CPUState *env,    \
+                                        uint64_t a, uint64_t b) \
+{								\
+    a = CMP(0, Tl, O, 0xffffffff) |				\
+        CMP(32, Tl, O, 0xffffffff);				\
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =			\
+        NZBIT32(a >> 0, 0) | NZBIT32(a >> 32, 1);		\
+    return a;                                                   \
+}
+#define CMP(SHR, TYPE, OPER, MASK) ((((TYPE) ((a >> SHR) & MASK) OPER \
+            (TYPE) ((b >> SHR) & MASK)) ? (uint64_t) MASK : 0) << SHR)
+IWMMXT_OP_CMP(cmpeq, uint8_t, uint16_t, uint32_t, ==)
+IWMMXT_OP_CMP(cmpgts, int8_t, int16_t, int32_t, >)
+IWMMXT_OP_CMP(cmpgtu, uint8_t, uint16_t, uint32_t, >)
+#undef CMP
+#define CMP(SHR, TYPE, OPER, MASK) ((((TYPE) ((a >> SHR) & MASK) OPER \
+            (TYPE) ((b >> SHR) & MASK)) ? a : b) & ((uint64_t) MASK << SHR))
+IWMMXT_OP_CMP(mins, int8_t, int16_t, int32_t, <)
+IWMMXT_OP_CMP(minu, uint8_t, uint16_t, uint32_t, <)
+IWMMXT_OP_CMP(maxs, int8_t, int16_t, int32_t, >)
+IWMMXT_OP_CMP(maxu, uint8_t, uint16_t, uint32_t, >)
+#undef CMP
+#define CMP(SHR, TYPE, OPER, MASK) ((uint64_t) (((TYPE) ((a >> SHR) & MASK) \
+            OPER (TYPE) ((b >> SHR) & MASK)) & MASK) << SHR)
+IWMMXT_OP_CMP(subn, uint8_t, uint16_t, uint32_t, -)
+IWMMXT_OP_CMP(addn, uint8_t, uint16_t, uint32_t, +)
+#undef CMP
+/* TODO Signed- and Unsigned-Saturation */
+#define CMP(SHR, TYPE, OPER, MASK) ((uint64_t) (((TYPE) ((a >> SHR) & MASK) \
+            OPER (TYPE) ((b >> SHR) & MASK)) & MASK) << SHR)
+IWMMXT_OP_CMP(subu, uint8_t, uint16_t, uint32_t, -)
+IWMMXT_OP_CMP(addu, uint8_t, uint16_t, uint32_t, +)
+IWMMXT_OP_CMP(subs, int8_t, int16_t, int32_t, -)
+IWMMXT_OP_CMP(adds, int8_t, int16_t, int32_t, +)
+#undef CMP
+#undef IWMMXT_OP_CMP
+
+#define AVGB(SHR) ((( \
+        ((a >> SHR) & 0xff) + ((b >> SHR) & 0xff) + round) >> 1) << SHR)
+#define IWMMXT_OP_AVGB(r)                                                 \
+uint64_t HELPER(iwmmxt_avgb##r)(CPUState *env, uint64_t a, uint64_t b)    \
+{                                                                         \
+    const int round = r;                                                  \
+    a = AVGB(0) | AVGB(8) | AVGB(16) | AVGB(24) |                         \
+        AVGB(32) | AVGB(40) | AVGB(48) | AVGB(56);                        \
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                                 \
+        SIMD8_SET(ZBIT8((a >> 0) & 0xff), SIMD_ZBIT, 0) |                 \
+        SIMD8_SET(ZBIT8((a >> 8) & 0xff), SIMD_ZBIT, 1) |                 \
+        SIMD8_SET(ZBIT8((a >> 16) & 0xff), SIMD_ZBIT, 2) |                \
+        SIMD8_SET(ZBIT8((a >> 24) & 0xff), SIMD_ZBIT, 3) |                \
+        SIMD8_SET(ZBIT8((a >> 32) & 0xff), SIMD_ZBIT, 4) |                \
+        SIMD8_SET(ZBIT8((a >> 40) & 0xff), SIMD_ZBIT, 5) |                \
+        SIMD8_SET(ZBIT8((a >> 48) & 0xff), SIMD_ZBIT, 6) |                \
+        SIMD8_SET(ZBIT8((a >> 56) & 0xff), SIMD_ZBIT, 7);                 \
+    return a;                                                             \
+}
+IWMMXT_OP_AVGB(0)
+IWMMXT_OP_AVGB(1)
+#undef IWMMXT_OP_AVGB
+#undef AVGB
+
+#define AVGW(SHR) ((( \
+        ((a >> SHR) & 0xffff) + ((b >> SHR) & 0xffff) + round) >> 1) << SHR)
+#define IWMMXT_OP_AVGW(r)                                               \
+uint64_t HELPER(iwmmxt_avgw##r)(CPUState *env, uint64_t a, uint64_t b)  \
+{                                                                       \
+    const int round = r;                                                \
+    a = AVGW(0) | AVGW(16) | AVGW(32) | AVGW(48);                       \
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                               \
+        SIMD16_SET(ZBIT16((a >> 0) & 0xffff), SIMD_ZBIT, 0) |           \
+        SIMD16_SET(ZBIT16((a >> 16) & 0xffff), SIMD_ZBIT, 1) |          \
+        SIMD16_SET(ZBIT16((a >> 32) & 0xffff), SIMD_ZBIT, 2) |          \
+        SIMD16_SET(ZBIT16((a >> 48) & 0xffff), SIMD_ZBIT, 3);           \
+    return a;                                                           \
+}
+IWMMXT_OP_AVGW(0)
+IWMMXT_OP_AVGW(1)
+#undef IWMMXT_OP_AVGW
+#undef AVGW
+
+uint64_t HELPER(iwmmxt_msadb)(uint64_t a, uint64_t b)
+{
+    a =  ((((a >> 0 ) & 0xffff) * ((b >> 0) & 0xffff) +
+           ((a >> 16) & 0xffff) * ((b >> 16) & 0xffff)) & 0xffffffff) |
+         ((((a >> 32) & 0xffff) * ((b >> 32) & 0xffff) +
+           ((a >> 48) & 0xffff) * ((b >> 48) & 0xffff)) << 32);
+    return a;
+}
+
+uint64_t HELPER(iwmmxt_align)(uint64_t a, uint64_t b, uint32_t n)
+{
+    a >>= n << 3;
+    a |= b << (64 - (n << 3));
+    return a;
+}
+
+uint64_t HELPER(iwmmxt_insr)(uint64_t x, uint32_t a, uint32_t b, uint32_t n)
+{
+    x &= ~((uint64_t) b << n);
+    x |= (uint64_t) (a & b) << n;
+    return x;
+}
+
+uint32_t HELPER(iwmmxt_setpsr_nz)(uint64_t x)
+{
+    return SIMD64_SET((x == 0), SIMD_ZBIT) |
+           SIMD64_SET((x & (1ULL << 63)), SIMD_NBIT);
+}
+
+uint64_t HELPER(iwmmxt_bcstb)(uint32_t arg)
+{
+    arg &= 0xff;
+    return
+        ((uint64_t) arg << 0 ) | ((uint64_t) arg << 8 ) |
+        ((uint64_t) arg << 16) | ((uint64_t) arg << 24) |
+        ((uint64_t) arg << 32) | ((uint64_t) arg << 40) |
+        ((uint64_t) arg << 48) | ((uint64_t) arg << 56);
+}
+
+uint64_t HELPER(iwmmxt_bcstw)(uint32_t arg)
+{
+    arg &= 0xffff;
+    return
+        ((uint64_t) arg << 0 ) | ((uint64_t) arg << 16) |
+        ((uint64_t) arg << 32) | ((uint64_t) arg << 48);
+}
+
+uint64_t HELPER(iwmmxt_bcstl)(uint32_t arg)
+{
+    return arg | ((uint64_t) arg << 32);
+}
+
+uint64_t HELPER(iwmmxt_addcb)(uint64_t x)
+{
+    return
+        ((x >> 0) & 0xff) + ((x >> 8) & 0xff) +
+        ((x >> 16) & 0xff) + ((x >> 24) & 0xff) +
+        ((x >> 32) & 0xff) + ((x >> 40) & 0xff) +
+        ((x >> 48) & 0xff) + ((x >> 56) & 0xff);
+}
+
+uint64_t HELPER(iwmmxt_addcw)(uint64_t x)
+{
+    return
+        ((x >> 0) & 0xffff) + ((x >> 16) & 0xffff) +
+        ((x >> 32) & 0xffff) + ((x >> 48) & 0xffff);
+}
+
+uint64_t HELPER(iwmmxt_addcl)(uint64_t x)
+{
+    return (x & 0xffffffff) + (x >> 32);
+}
+
+uint32_t HELPER(iwmmxt_msbb)(uint64_t x)
+{
+    return
+        ((x >> 7) & 0x01) | ((x >> 14) & 0x02) |
+        ((x >> 21) & 0x04) | ((x >> 28) & 0x08) |
+        ((x >> 35) & 0x10) | ((x >> 42) & 0x20) |
+        ((x >> 49) & 0x40) | ((x >> 56) & 0x80);
+}
+
+uint32_t HELPER(iwmmxt_msbw)(uint64_t x)
+{
+    return
+        ((x >> 15) & 0x01) | ((x >> 30) & 0x02) |
+        ((x >> 45) & 0x04) | ((x >> 52) & 0x08);
+}
+
+uint32_t HELPER(iwmmxt_msbl)(uint64_t x)
+{
+    return ((x >> 31) & 0x01) | ((x >> 62) & 0x02);
+}
+
+/* FIXME: Split wCASF setting into a separate op to avoid env use.  */
+uint64_t HELPER(iwmmxt_srlw)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = (((x & (0xffffll << 0)) >> n) & (0xffffll << 0)) |
+        (((x & (0xffffll << 16)) >> n) & (0xffffll << 16)) |
+        (((x & (0xffffll << 32)) >> n) & (0xffffll << 32)) |
+        (((x & (0xffffll << 48)) >> n) & (0xffffll << 48));
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |
+        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_srll)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = ((x & (0xffffffffll << 0)) >> n) |
+        ((x >> n) & (0xffffffffll << 32));
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_srlq)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x >>= n;
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_sllw)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = (((x & (0xffffll << 0)) << n) & (0xffffll << 0)) |
+        (((x & (0xffffll << 16)) << n) & (0xffffll << 16)) |
+        (((x & (0xffffll << 32)) << n) & (0xffffll << 32)) |
+        (((x & (0xffffll << 48)) << n) & (0xffffll << 48));
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |
+        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_slll)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = ((x << n) & (0xffffffffll << 0)) |
+        ((x & (0xffffffffll << 32)) << n);
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_sllq)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x <<= n;
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_sraw)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = ((uint64_t) ((EXTEND16(x >> 0) >> n) & 0xffff) << 0) |
+        ((uint64_t) ((EXTEND16(x >> 16) >> n) & 0xffff) << 16) |
+        ((uint64_t) ((EXTEND16(x >> 32) >> n) & 0xffff) << 32) |
+        ((uint64_t) ((EXTEND16(x >> 48) >> n) & 0xffff) << 48);
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |
+        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_sral)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = (((EXTEND32(x >> 0) >> n) & 0xffffffff) << 0) |
+        (((EXTEND32(x >> 32) >> n) & 0xffffffff) << 32);
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_sraq)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = (int64_t) x >> n;
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_rorw)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = ((((x & (0xffffll << 0)) >> n) |
+          ((x & (0xffffll << 0)) << (16 - n))) & (0xffffll << 0)) |
+        ((((x & (0xffffll << 16)) >> n) |
+          ((x & (0xffffll << 16)) << (16 - n))) & (0xffffll << 16)) |
+        ((((x & (0xffffll << 32)) >> n) |
+          ((x & (0xffffll << 32)) << (16 - n))) & (0xffffll << 32)) |
+        ((((x & (0xffffll << 48)) >> n) |
+          ((x & (0xffffll << 48)) << (16 - n))) & (0xffffll << 48));
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |
+        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_rorl)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = ((x & (0xffffffffll << 0)) >> n) |
+        ((x >> n) & (0xffffffffll << 32)) |
+        ((x << (32 - n)) & (0xffffffffll << 0)) |
+        ((x & (0xffffffffll << 32)) << (32 - n));
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_rorq)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = (x >> n) | (x << (64 - n));
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x);
+    return x;
+}
+
+uint64_t HELPER(iwmmxt_shufh)(CPUState *env, uint64_t x, uint32_t n)
+{
+    x = (((x >> ((n << 4) & 0x30)) & 0xffff) << 0) |
+        (((x >> ((n << 2) & 0x30)) & 0xffff) << 16) |
+        (((x >> ((n << 0) & 0x30)) & 0xffff) << 32) |
+        (((x >> ((n >> 2) & 0x30)) & 0xffff) << 48);
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |
+        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);
+    return x;
+}
+
+/* TODO: Unsigned-Saturation */
+uint64_t HELPER(iwmmxt_packuw)(CPUState *env, uint64_t a, uint64_t b)
+{
+    a = (((a >> 0) & 0xff) << 0) | (((a >> 16) & 0xff) << 8) |
+        (((a >> 32) & 0xff) << 16) | (((a >> 48) & 0xff) << 24) |
+        (((b >> 0) & 0xff) << 32) | (((b >> 16) & 0xff) << 40) |
+        (((b >> 32) & 0xff) << 48) | (((b >> 48) & 0xff) << 56);
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT8(a >> 0, 0) | NZBIT8(a >> 8, 1) |
+        NZBIT8(a >> 16, 2) | NZBIT8(a >> 24, 3) |
+        NZBIT8(a >> 32, 4) | NZBIT8(a >> 40, 5) |
+        NZBIT8(a >> 48, 6) | NZBIT8(a >> 56, 7);
+    return a;
+}
+
+uint64_t HELPER(iwmmxt_packul)(CPUState *env, uint64_t a, uint64_t b)
+{
+    a = (((a >> 0) & 0xffff) << 0) | (((a >> 32) & 0xffff) << 16) |
+        (((b >> 0) & 0xffff) << 32) | (((b >> 32) & 0xffff) << 48);
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT16(a >> 0, 0) | NZBIT16(a >> 16, 1) |
+        NZBIT16(a >> 32, 2) | NZBIT16(a >> 48, 3);
+    return a;
+}
+
+uint64_t HELPER(iwmmxt_packuq)(CPUState *env, uint64_t a, uint64_t b)
+{
+    a = (a & 0xffffffff) | ((b & 0xffffffff) << 32);
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT32(a >> 0, 0) | NZBIT32(a >> 32, 1);
+    return a;
+}
+
+/* TODO: Signed-Saturation */
+uint64_t HELPER(iwmmxt_packsw)(CPUState *env, uint64_t a, uint64_t b)
+{
+    a = (((a >> 0) & 0xff) << 0) | (((a >> 16) & 0xff) << 8) |
+        (((a >> 32) & 0xff) << 16) | (((a >> 48) & 0xff) << 24) |
+        (((b >> 0) & 0xff) << 32) | (((b >> 16) & 0xff) << 40) |
+        (((b >> 32) & 0xff) << 48) | (((b >> 48) & 0xff) << 56);
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT8(a >> 0, 0) | NZBIT8(a >> 8, 1) |
+        NZBIT8(a >> 16, 2) | NZBIT8(a >> 24, 3) |
+        NZBIT8(a >> 32, 4) | NZBIT8(a >> 40, 5) |
+        NZBIT8(a >> 48, 6) | NZBIT8(a >> 56, 7);
+    return a;
+}
+
+uint64_t HELPER(iwmmxt_packsl)(CPUState *env, uint64_t a, uint64_t b)
+{
+    a = (((a >> 0) & 0xffff) << 0) | (((a >> 32) & 0xffff) << 16) |
+        (((b >> 0) & 0xffff) << 32) | (((b >> 32) & 0xffff) << 48);
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT16(a >> 0, 0) | NZBIT16(a >> 16, 1) |
+        NZBIT16(a >> 32, 2) | NZBIT16(a >> 48, 3);
+    return a;
+}
+
+uint64_t HELPER(iwmmxt_packsq)(CPUState *env, uint64_t a, uint64_t b)
+{
+    a = (a & 0xffffffff) | ((b & 0xffffffff) << 32);
+    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
+        NZBIT32(a >> 0, 0) | NZBIT32(a >> 32, 1);
+    return a;
+}
+
+uint64_t HELPER(iwmmxt_muladdsl)(uint64_t c, uint32_t a, uint32_t b)
+{
+    return c + ((int32_t) EXTEND32(a) * (int32_t) EXTEND32(b));
+}
+
+uint64_t HELPER(iwmmxt_muladdsw)(uint64_t c, uint32_t a, uint32_t b)
+{
+    c += EXTEND32(EXTEND16S((a >> 0) & 0xffff) *
+                  EXTEND16S((b >> 0) & 0xffff));
+    c += EXTEND32(EXTEND16S((a >> 16) & 0xffff) *
+                  EXTEND16S((b >> 16) & 0xffff));
+    return c;
+}
+
+uint64_t HELPER(iwmmxt_muladdswl)(uint64_t c, uint32_t a, uint32_t b)
+{
+    return c + (EXTEND32(EXTEND16S(a & 0xffff) *
+                         EXTEND16S(b & 0xffff)));
+}
diff --git a/target-arm/machine.c b/target-arm/machine.c
new file mode 100644
index 0000000..3368741
--- /dev/null
+++ b/target-arm/machine.c
@@ -0,0 +1,218 @@
+#include "hw/hw.h"
+#include "hw/boards.h"
+
+void register_machines(void)
+{
+#if 0  /* ANDROID */
+    qemu_register_machine(&integratorcp_machine);
+    qemu_register_machine(&versatilepb_machine);
+    qemu_register_machine(&versatileab_machine);
+    qemu_register_machine(&realview_machine);
+    qemu_register_machine(&akitapda_machine);
+    qemu_register_machine(&spitzpda_machine);
+    qemu_register_machine(&borzoipda_machine);
+    qemu_register_machine(&terrierpda_machine);
+    qemu_register_machine(&palmte_machine);
+    qemu_register_machine(&n800_machine);
+    qemu_register_machine(&n810_machine);
+    qemu_register_machine(&lm3s811evb_machine);
+    qemu_register_machine(&lm3s6965evb_machine);
+    qemu_register_machine(&connex_machine);
+    qemu_register_machine(&verdex_machine);
+    qemu_register_machine(&mainstone2_machine);
+    qemu_register_machine(&musicpal_machine);
+    qemu_register_machine(&tosapda_machine);
+#endif
+    qemu_register_machine(&android_arm_machine);
+}
+
+void cpu_save(QEMUFile *f, void *opaque)
+{
+    int i;
+    CPUARMState *env = (CPUARMState *)opaque;
+
+    for (i = 0; i < 16; i++) {
+        qemu_put_be32(f, env->regs[i]);
+    }
+    qemu_put_be32(f, cpsr_read(env));
+    qemu_put_be32(f, env->spsr);
+    for (i = 0; i < 6; i++) {
+        qemu_put_be32(f, env->banked_spsr[i]);
+        qemu_put_be32(f, env->banked_r13[i]);
+        qemu_put_be32(f, env->banked_r14[i]);
+    }
+    for (i = 0; i < 5; i++) {
+        qemu_put_be32(f, env->usr_regs[i]);
+        qemu_put_be32(f, env->fiq_regs[i]);
+    }
+    qemu_put_be32(f, env->cp15.c0_cpuid);
+    qemu_put_be32(f, env->cp15.c0_cachetype);
+    qemu_put_be32(f, env->cp15.c1_sys);
+    qemu_put_be32(f, env->cp15.c1_coproc);
+    qemu_put_be32(f, env->cp15.c1_xscaleauxcr);
+    qemu_put_be32(f, env->cp15.c2_base0);
+    qemu_put_be32(f, env->cp15.c2_base1);
+    qemu_put_be32(f, env->cp15.c2_mask);
+    qemu_put_be32(f, env->cp15.c2_data);
+    qemu_put_be32(f, env->cp15.c2_insn);
+    qemu_put_be32(f, env->cp15.c3);
+    qemu_put_be32(f, env->cp15.c5_insn);
+    qemu_put_be32(f, env->cp15.c5_data);
+    for (i = 0; i < 8; i++) {
+        qemu_put_be32(f, env->cp15.c6_region[i]);
+    }
+    qemu_put_be32(f, env->cp15.c6_insn);
+    qemu_put_be32(f, env->cp15.c6_data);
+    qemu_put_be32(f, env->cp15.c9_insn);
+    qemu_put_be32(f, env->cp15.c9_data);
+    qemu_put_be32(f, env->cp15.c13_fcse);
+    qemu_put_be32(f, env->cp15.c13_context);
+    qemu_put_be32(f, env->cp15.c13_tls1);
+    qemu_put_be32(f, env->cp15.c13_tls2);
+    qemu_put_be32(f, env->cp15.c13_tls3);
+    qemu_put_be32(f, env->cp15.c15_cpar);
+
+    qemu_put_be32(f, env->features);
+
+    if (arm_feature(env, ARM_FEATURE_VFP)) {
+        for (i = 0;  i < 16; i++) {
+            CPU_DoubleU u;
+            u.d = env->vfp.regs[i];
+            qemu_put_be32(f, u.l.upper);
+            qemu_put_be32(f, u.l.lower);
+        }
+        for (i = 0; i < 16; i++) {
+            qemu_put_be32(f, env->vfp.xregs[i]);
+        }
+
+        /* TODO: Should use proper FPSCR access functions.  */
+        qemu_put_be32(f, env->vfp.vec_len);
+        qemu_put_be32(f, env->vfp.vec_stride);
+
+        if (arm_feature(env, ARM_FEATURE_VFP3)) {
+            for (i = 16;  i < 32; i++) {
+                CPU_DoubleU u;
+                u.d = env->vfp.regs[i];
+                qemu_put_be32(f, u.l.upper);
+                qemu_put_be32(f, u.l.lower);
+            }
+        }
+    }
+
+    if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
+        for (i = 0; i < 16; i++) {
+            qemu_put_be64(f, env->iwmmxt.regs[i]);
+        }
+        for (i = 0; i < 16; i++) {
+            qemu_put_be32(f, env->iwmmxt.cregs[i]);
+        }
+    }
+
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        qemu_put_be32(f, env->v7m.other_sp);
+        qemu_put_be32(f, env->v7m.vecbase);
+        qemu_put_be32(f, env->v7m.basepri);
+        qemu_put_be32(f, env->v7m.control);
+        qemu_put_be32(f, env->v7m.current_sp);
+        qemu_put_be32(f, env->v7m.exception);
+    }
+}
+
+int cpu_load(QEMUFile *f, void *opaque, int version_id)
+{
+    CPUARMState *env = (CPUARMState *)opaque;
+    int i;
+
+    if (version_id != CPU_SAVE_VERSION)
+        return -EINVAL;
+
+    for (i = 0; i < 16; i++) {
+        env->regs[i] = qemu_get_be32(f);
+    }
+    cpsr_write(env, qemu_get_be32(f), 0xffffffff);
+    env->spsr = qemu_get_be32(f);
+    for (i = 0; i < 6; i++) {
+        env->banked_spsr[i] = qemu_get_be32(f);
+        env->banked_r13[i] = qemu_get_be32(f);
+        env->banked_r14[i] = qemu_get_be32(f);
+    }
+    for (i = 0; i < 5; i++) {
+        env->usr_regs[i] = qemu_get_be32(f);
+        env->fiq_regs[i] = qemu_get_be32(f);
+    }
+    env->cp15.c0_cpuid = qemu_get_be32(f);
+    env->cp15.c0_cachetype = qemu_get_be32(f);
+    env->cp15.c1_sys = qemu_get_be32(f);
+    env->cp15.c1_coproc = qemu_get_be32(f);
+    env->cp15.c1_xscaleauxcr = qemu_get_be32(f);
+    env->cp15.c2_base0 = qemu_get_be32(f);
+    env->cp15.c2_base1 = qemu_get_be32(f);
+    env->cp15.c2_mask = qemu_get_be32(f);
+    env->cp15.c2_data = qemu_get_be32(f);
+    env->cp15.c2_insn = qemu_get_be32(f);
+    env->cp15.c3 = qemu_get_be32(f);
+    env->cp15.c5_insn = qemu_get_be32(f);
+    env->cp15.c5_data = qemu_get_be32(f);
+    for (i = 0; i < 8; i++) {
+        env->cp15.c6_region[i] = qemu_get_be32(f);
+    }
+    env->cp15.c6_insn = qemu_get_be32(f);
+    env->cp15.c6_data = qemu_get_be32(f);
+    env->cp15.c9_insn = qemu_get_be32(f);
+    env->cp15.c9_data = qemu_get_be32(f);
+    env->cp15.c13_fcse = qemu_get_be32(f);
+    env->cp15.c13_context = qemu_get_be32(f);
+    env->cp15.c13_tls1 = qemu_get_be32(f);
+    env->cp15.c13_tls2 = qemu_get_be32(f);
+    env->cp15.c13_tls3 = qemu_get_be32(f);
+    env->cp15.c15_cpar = qemu_get_be32(f);
+
+    env->features = qemu_get_be32(f);
+
+    if (arm_feature(env, ARM_FEATURE_VFP)) {
+        for (i = 0;  i < 16; i++) {
+            CPU_DoubleU u;
+            u.l.upper = qemu_get_be32(f);
+            u.l.lower = qemu_get_be32(f);
+            env->vfp.regs[i] = u.d;
+        }
+        for (i = 0; i < 16; i++) {
+            env->vfp.xregs[i] = qemu_get_be32(f);
+        }
+
+        /* TODO: Should use proper FPSCR access functions.  */
+        env->vfp.vec_len = qemu_get_be32(f);
+        env->vfp.vec_stride = qemu_get_be32(f);
+
+        if (arm_feature(env, ARM_FEATURE_VFP3)) {
+            for (i = 0;  i < 16; i++) {
+                CPU_DoubleU u;
+                u.l.upper = qemu_get_be32(f);
+                u.l.lower = qemu_get_be32(f);
+                env->vfp.regs[i] = u.d;
+            }
+        }
+    }
+
+    if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
+        for (i = 0; i < 16; i++) {
+            env->iwmmxt.regs[i] = qemu_get_be64(f);
+        }
+        for (i = 0; i < 16; i++) {
+            env->iwmmxt.cregs[i] = qemu_get_be32(f);
+        }
+    }
+
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        env->v7m.other_sp = qemu_get_be32(f);
+        env->v7m.vecbase = qemu_get_be32(f);
+        env->v7m.basepri = qemu_get_be32(f);
+        env->v7m.control = qemu_get_be32(f);
+        env->v7m.current_sp = qemu_get_be32(f);
+        env->v7m.exception = qemu_get_be32(f);
+    }
+
+    return 0;
+}
+
+
diff --git a/target-arm/neon_helper.c b/target-arm/neon_helper.c
new file mode 100644
index 0000000..4ee5658
--- /dev/null
+++ b/target-arm/neon_helper.c
@@ -0,0 +1,1457 @@
+/*
+ * ARM NEON vector operations.
+ *
+ * Copyright (c) 2007, 2008 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GNU GPL v2.
+ */
+#include <stdlib.h>
+#include <stdio.h>
+
+#include "cpu.h"
+#include "exec-all.h"
+#include "helpers.h"
+
+#define SIGNBIT (uint32_t)0x80000000
+#define SIGNBIT64 ((uint64_t)1 << 63)
+
+#define SET_QC() env->vfp.xregs[ARM_VFP_FPSCR] = CPSR_Q
+
+static float_status neon_float_status;
+#define NFS &neon_float_status
+
+/* Helper routines to perform bitwise copies between float and int.  */
+static inline float32 vfp_itos(uint32_t i)
+{
+    union {
+        uint32_t i;
+        float32 s;
+    } v;
+
+    v.i = i;
+    return v.s;
+}
+
+static inline uint32_t vfp_stoi(float32 s)
+{
+    union {
+        uint32_t i;
+        float32 s;
+    } v;
+
+    v.s = s;
+    return v.i;
+}
+
+#define NEON_TYPE1(name, type) \
+typedef struct \
+{ \
+    type v1; \
+} neon_##name;
+#ifdef WORDS_BIGENDIAN
+#define NEON_TYPE2(name, type) \
+typedef struct \
+{ \
+    type v2; \
+    type v1; \
+} neon_##name;
+#define NEON_TYPE4(name, type) \
+typedef struct \
+{ \
+    type v4; \
+    type v3; \
+    type v2; \
+    type v1; \
+} neon_##name;
+#else
+#define NEON_TYPE2(name, type) \
+typedef struct \
+{ \
+    type v1; \
+    type v2; \
+} neon_##name;
+#define NEON_TYPE4(name, type) \
+typedef struct \
+{ \
+    type v1; \
+    type v2; \
+    type v3; \
+    type v4; \
+} neon_##name;
+#endif
+
+NEON_TYPE4(s8, int8_t)
+NEON_TYPE4(u8, uint8_t)
+NEON_TYPE2(s16, int16_t)
+NEON_TYPE2(u16, uint16_t)
+NEON_TYPE1(s32, int32_t)
+NEON_TYPE1(u32, uint32_t)
+#undef NEON_TYPE4
+#undef NEON_TYPE2
+#undef NEON_TYPE1
+
+/* Copy from a uint32_t to a vector structure type.  */
+#define NEON_UNPACK(vtype, dest, val) do { \
+    union { \
+        vtype v; \
+        uint32_t i; \
+    } conv_u; \
+    conv_u.i = (val); \
+    dest = conv_u.v; \
+    } while(0)
+
+/* Copy from a vector structure type to a uint32_t.  */
+#define NEON_PACK(vtype, dest, val) do { \
+    union { \
+        vtype v; \
+        uint32_t i; \
+    } conv_u; \
+    conv_u.v = (val); \
+    dest = conv_u.i; \
+    } while(0)
+
+#define NEON_DO1 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc2.v1);
+#define NEON_DO2 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc2.v1); \
+    NEON_FN(vdest.v2, vsrc1.v2, vsrc2.v2);
+#define NEON_DO4 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc2.v1); \
+    NEON_FN(vdest.v2, vsrc1.v2, vsrc2.v2); \
+    NEON_FN(vdest.v3, vsrc1.v3, vsrc2.v3); \
+    NEON_FN(vdest.v4, vsrc1.v4, vsrc2.v4);
+
+#define NEON_VOP_BODY(vtype, n) \
+{ \
+    uint32_t res; \
+    vtype vsrc1; \
+    vtype vsrc2; \
+    vtype vdest; \
+    NEON_UNPACK(vtype, vsrc1, arg1); \
+    NEON_UNPACK(vtype, vsrc2, arg2); \
+    NEON_DO##n; \
+    NEON_PACK(vtype, res, vdest); \
+    return res; \
+}
+
+#define NEON_VOP(name, vtype, n) \
+uint32_t HELPER(glue(neon_,name))(uint32_t arg1, uint32_t arg2) \
+NEON_VOP_BODY(vtype, n)
+
+#define NEON_VOP_ENV(name, vtype, n) \
+uint32_t HELPER(glue(neon_,name))(CPUState *env, uint32_t arg1, uint32_t arg2) \
+NEON_VOP_BODY(vtype, n)
+
+/* Pairwise operations.  */
+/* For 32-bit elements each segment only contains a single element, so
+   the elementwise and pairwise operations are the same.  */
+#define NEON_PDO2 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc1.v2); \
+    NEON_FN(vdest.v2, vsrc2.v1, vsrc2.v2);
+#define NEON_PDO4 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc1.v2); \
+    NEON_FN(vdest.v2, vsrc1.v3, vsrc1.v4); \
+    NEON_FN(vdest.v3, vsrc2.v1, vsrc2.v2); \
+    NEON_FN(vdest.v4, vsrc2.v3, vsrc2.v4); \
+
+#define NEON_POP(name, vtype, n) \
+uint32_t HELPER(glue(neon_,name))(uint32_t arg1, uint32_t arg2) \
+{ \
+    uint32_t res; \
+    vtype vsrc1; \
+    vtype vsrc2; \
+    vtype vdest; \
+    NEON_UNPACK(vtype, vsrc1, arg1); \
+    NEON_UNPACK(vtype, vsrc2, arg2); \
+    NEON_PDO##n; \
+    NEON_PACK(vtype, res, vdest); \
+    return res; \
+}
+
+/* Unary operators.  */
+#define NEON_VOP1(name, vtype, n) \
+uint32_t HELPER(glue(neon_,name))(uint32_t arg) \
+{ \
+    vtype vsrc1; \
+    vtype vdest; \
+    NEON_UNPACK(vtype, vsrc1, arg); \
+    NEON_DO##n; \
+    NEON_PACK(vtype, arg, vdest); \
+    return arg; \
+}
+
+
+#define NEON_USAT(dest, src1, src2, type) do { \
+    uint32_t tmp = (uint32_t)src1 + (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        SET_QC(); \
+        dest = ~0; \
+    } else { \
+        dest = tmp; \
+    }} while(0)
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint8_t)
+NEON_VOP_ENV(qadd_u8, neon_u8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint16_t)
+NEON_VOP_ENV(qadd_u16, neon_u16, 2)
+#undef NEON_FN
+#undef NEON_USAT
+
+#define NEON_SSAT(dest, src1, src2, type) do { \
+    int32_t tmp = (uint32_t)src1 + (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        SET_QC(); \
+        if (src2 > 0) { \
+            tmp = (1 << (sizeof(type) * 8 - 1)) - 1; \
+        } else { \
+            tmp = 1 << (sizeof(type) * 8 - 1); \
+        } \
+    } \
+    dest = tmp; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int8_t)
+NEON_VOP_ENV(qadd_s8, neon_s8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int16_t)
+NEON_VOP_ENV(qadd_s16, neon_s16, 2)
+#undef NEON_FN
+#undef NEON_SSAT
+
+#define NEON_USAT(dest, src1, src2, type) do { \
+    uint32_t tmp = (uint32_t)src1 - (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        SET_QC(); \
+        dest = 0; \
+    } else { \
+        dest = tmp; \
+    }} while(0)
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint8_t)
+NEON_VOP_ENV(qsub_u8, neon_u8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint16_t)
+NEON_VOP_ENV(qsub_u16, neon_u16, 2)
+#undef NEON_FN
+#undef NEON_USAT
+
+#define NEON_SSAT(dest, src1, src2, type) do { \
+    int32_t tmp = (uint32_t)src1 - (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        SET_QC(); \
+        if (src2 < 0) { \
+            tmp = (1 << (sizeof(type) * 8 - 1)) - 1; \
+        } else { \
+            tmp = 1 << (sizeof(type) * 8 - 1); \
+        } \
+    } \
+    dest = tmp; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int8_t)
+NEON_VOP_ENV(qsub_s8, neon_s8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int16_t)
+NEON_VOP_ENV(qsub_s16, neon_s16, 2)
+#undef NEON_FN
+#undef NEON_SSAT
+
+#define NEON_FN(dest, src1, src2) dest = (src1 + src2) >> 1
+NEON_VOP(hadd_s8, neon_s8, 4)
+NEON_VOP(hadd_u8, neon_u8, 4)
+NEON_VOP(hadd_s16, neon_s16, 2)
+NEON_VOP(hadd_u16, neon_u16, 2)
+#undef NEON_FN
+
+int32_t HELPER(neon_hadd_s32)(int32_t src1, int32_t src2)
+{
+    int32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if (src1 & src2 & 1)
+        dest++;
+    return dest;
+}
+
+uint32_t HELPER(neon_hadd_u32)(uint32_t src1, uint32_t src2)
+{
+    uint32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if (src1 & src2 & 1)
+        dest++;
+    return dest;
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 + src2 + 1) >> 1
+NEON_VOP(rhadd_s8, neon_s8, 4)
+NEON_VOP(rhadd_u8, neon_u8, 4)
+NEON_VOP(rhadd_s16, neon_s16, 2)
+NEON_VOP(rhadd_u16, neon_u16, 2)
+#undef NEON_FN
+
+int32_t HELPER(neon_rhadd_s32)(int32_t src1, int32_t src2)
+{
+    int32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if ((src1 | src2) & 1)
+        dest++;
+    return dest;
+}
+
+uint32_t HELPER(neon_rhadd_u32)(uint32_t src1, uint32_t src2)
+{
+    uint32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if ((src1 | src2) & 1)
+        dest++;
+    return dest;
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 - src2) >> 1
+NEON_VOP(hsub_s8, neon_s8, 4)
+NEON_VOP(hsub_u8, neon_u8, 4)
+NEON_VOP(hsub_s16, neon_s16, 2)
+NEON_VOP(hsub_u16, neon_u16, 2)
+#undef NEON_FN
+
+int32_t HELPER(neon_hsub_s32)(int32_t src1, int32_t src2)
+{
+    int32_t dest;
+
+    dest = (src1 >> 1) - (src2 >> 1);
+    if ((~src1) & src2 & 1)
+        dest--;
+    return dest;
+}
+
+uint32_t HELPER(neon_hsub_u32)(uint32_t src1, uint32_t src2)
+{
+    uint32_t dest;
+
+    dest = (src1 >> 1) - (src2 >> 1);
+    if ((~src1) & src2 & 1)
+        dest--;
+    return dest;
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 > src2) ? ~0 : 0
+NEON_VOP(cgt_s8, neon_s8, 4)
+NEON_VOP(cgt_u8, neon_u8, 4)
+NEON_VOP(cgt_s16, neon_s16, 2)
+NEON_VOP(cgt_u16, neon_u16, 2)
+NEON_VOP(cgt_s32, neon_s32, 1)
+NEON_VOP(cgt_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = (src1 >= src2) ? ~0 : 0
+NEON_VOP(cge_s8, neon_s8, 4)
+NEON_VOP(cge_u8, neon_u8, 4)
+NEON_VOP(cge_s16, neon_s16, 2)
+NEON_VOP(cge_u16, neon_u16, 2)
+NEON_VOP(cge_s32, neon_s32, 1)
+NEON_VOP(cge_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = (src1 < src2) ? src1 : src2
+NEON_VOP(min_s8, neon_s8, 4)
+NEON_VOP(min_u8, neon_u8, 4)
+NEON_VOP(min_s16, neon_s16, 2)
+NEON_VOP(min_u16, neon_u16, 2)
+NEON_VOP(min_s32, neon_s32, 1)
+NEON_VOP(min_u32, neon_u32, 1)
+NEON_POP(pmin_s8, neon_s8, 4)
+NEON_POP(pmin_u8, neon_u8, 4)
+NEON_POP(pmin_s16, neon_s16, 2)
+NEON_POP(pmin_u16, neon_u16, 2)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = (src1 > src2) ? src1 : src2
+NEON_VOP(max_s8, neon_s8, 4)
+NEON_VOP(max_u8, neon_u8, 4)
+NEON_VOP(max_s16, neon_s16, 2)
+NEON_VOP(max_u16, neon_u16, 2)
+NEON_VOP(max_s32, neon_s32, 1)
+NEON_VOP(max_u32, neon_u32, 1)
+NEON_POP(pmax_s8, neon_s8, 4)
+NEON_POP(pmax_u8, neon_u8, 4)
+NEON_POP(pmax_s16, neon_s16, 2)
+NEON_POP(pmax_u16, neon_u16, 2)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) \
+    dest = (src1 > src2) ? (src1 - src2) : (src2 - src1)
+NEON_VOP(abd_s8, neon_s8, 4)
+NEON_VOP(abd_u8, neon_u8, 4)
+NEON_VOP(abd_s16, neon_s16, 2)
+NEON_VOP(abd_u16, neon_u16, 2)
+NEON_VOP(abd_s32, neon_s32, 1)
+NEON_VOP(abd_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src2; \
+    if (tmp >= sizeof(src1) * 8 || tmp <= -sizeof(src1) * 8) { \
+        dest = 0; \
+    } else if (tmp < 0) { \
+        dest = src1 >> -tmp; \
+    } else { \
+        dest = src1 << tmp; \
+    }} while (0)
+NEON_VOP(shl_u8, neon_u8, 4)
+NEON_VOP(shl_u16, neon_u16, 2)
+NEON_VOP(shl_u32, neon_u32, 1)
+#undef NEON_FN
+
+uint64_t HELPER(neon_shl_u64)(uint64_t val, uint64_t shiftop)
+{
+    int8_t shift = (int8_t)shiftop;
+    if (shift >= 64 || shift <= -64) {
+        val = 0;
+    } else if (shift < 0) {
+        val >>= -shift;
+    } else {
+        val <<= shift;
+    }
+    return val;
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src2; \
+    if (tmp >= sizeof(src1) * 8) { \
+        dest = 0; \
+    } else if (tmp <= -sizeof(src1) * 8) { \
+        dest = src1 >> (sizeof(src1) * 8 - 1); \
+    } else if (tmp < 0) { \
+        dest = src1 >> -tmp; \
+    } else { \
+        dest = src1 << tmp; \
+    }} while (0)
+NEON_VOP(shl_s8, neon_s8, 4)
+NEON_VOP(shl_s16, neon_s16, 2)
+NEON_VOP(shl_s32, neon_s32, 1)
+#undef NEON_FN
+
+uint64_t HELPER(neon_shl_s64)(uint64_t valop, uint64_t shiftop)
+{
+    int8_t shift = (int8_t)shiftop;
+    int64_t val = valop;
+    if (shift >= 64) {
+        val = 0;
+    } else if (shift <= -64) {
+        val >>= 63;
+    } else if (shift < 0) {
+        val >>= -shift;
+    } else {
+        val <<= shift;
+    }
+    return val;
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src2; \
+    if (tmp >= sizeof(src1) * 8) { \
+        dest = 0; \
+    } else if (tmp < -sizeof(src1) * 8) { \
+        dest >>= sizeof(src1) * 8 - 1; \
+    } else if (tmp == -sizeof(src1) * 8) { \
+        dest = src1 >> (tmp - 1); \
+        dest++; \
+        src2 >>= 1; \
+    } else if (tmp < 0) { \
+        dest = (src1 + (1 << (-1 - tmp))) >> -tmp; \
+    } else { \
+        dest = src1 << tmp; \
+    }} while (0)
+NEON_VOP(rshl_s8, neon_s8, 4)
+NEON_VOP(rshl_s16, neon_s16, 2)
+NEON_VOP(rshl_s32, neon_s32, 1)
+#undef NEON_FN
+
+uint64_t HELPER(neon_rshl_s64)(uint64_t valop, uint64_t shiftop)
+{
+    int8_t shift = (int8_t)shiftop;
+    int64_t val = valop;
+    if (shift >= 64) {
+        val = 0;
+    } else if (shift < -64) {
+        val >>= 63;
+    } else if (shift == -63) {
+        val >>= 63;
+        val++;
+        val >>= 1;
+    } else if (shift < 0) {
+        val = (val + ((int64_t)1 << (-1 - shift))) >> -shift;
+    } else {
+        val <<= shift;
+    }
+    return val;
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src2; \
+    if (tmp >= sizeof(src1) * 8 || tmp < -sizeof(src1) * 8) { \
+        dest = 0; \
+    } else if (tmp == -sizeof(src1) * 8) { \
+        dest = src1 >> (tmp - 1); \
+    } else if (tmp < 0) { \
+        dest = (src1 + (1 << (-1 - tmp))) >> -tmp; \
+    } else { \
+        dest = src1 << tmp; \
+    }} while (0)
+NEON_VOP(rshl_u8, neon_u8, 4)
+NEON_VOP(rshl_u16, neon_u16, 2)
+NEON_VOP(rshl_u32, neon_u32, 1)
+#undef NEON_FN
+
+uint64_t HELPER(neon_rshl_u64)(uint64_t val, uint64_t shiftop)
+{
+    int8_t shift = (uint8_t)shiftop;
+    if (shift >= 64 || shift < 64) {
+        val = 0;
+    } else if (shift == -64) {
+        /* Rounding a 1-bit result just preserves that bit.  */
+        val >>= 63;
+    } if (shift < 0) {
+        val = (val + ((uint64_t)1 << (-1 - shift))) >> -shift;
+        val >>= -shift;
+    } else {
+        val <<= shift;
+    }
+    return val;
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src2; \
+    if (tmp >= sizeof(src1) * 8) { \
+        if (src1) { \
+            SET_QC(); \
+            dest = ~0; \
+        } else { \
+            dest = 0; \
+        } \
+    } else if (tmp <= -sizeof(src1) * 8) { \
+        dest = 0; \
+    } else if (tmp < 0) { \
+        dest = src1 >> -tmp; \
+    } else { \
+        dest = src1 << tmp; \
+        if ((dest >> tmp) != src1) { \
+            SET_QC(); \
+            dest = ~0; \
+        } \
+    }} while (0)
+NEON_VOP_ENV(qshl_u8, neon_u8, 4)
+NEON_VOP_ENV(qshl_u16, neon_u16, 2)
+NEON_VOP_ENV(qshl_u32, neon_u32, 1)
+#undef NEON_FN
+
+uint64_t HELPER(neon_qshl_u64)(CPUState *env, uint64_t val, uint64_t shiftop)
+{
+    int8_t shift = (int8_t)shiftop;
+    if (shift >= 64) {
+        if (val) {
+            val = ~(uint64_t)0;
+            SET_QC();
+        } else {
+            val = 0;
+        }
+    } else if (shift <= -64) {
+        val = 0;
+    } else if (shift < 0) {
+        val >>= -shift;
+    } else {
+        uint64_t tmp = val;
+        val <<= shift;
+        if ((val >> shift) != tmp) {
+            SET_QC();
+            val = ~(uint64_t)0;
+        }
+    }
+    return val;
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src2; \
+    if (tmp >= sizeof(src1) * 8) { \
+        if (src1) \
+            SET_QC(); \
+        dest = src1 >> 31; \
+    } else if (tmp <= -sizeof(src1) * 8) { \
+        dest = src1 >> 31; \
+    } else if (tmp < 0) { \
+        dest = src1 >> -tmp; \
+    } else { \
+        dest = src1 << tmp; \
+        if ((dest >> tmp) != src1) { \
+            SET_QC(); \
+            dest = src2 >> 31; \
+        } \
+    }} while (0)
+NEON_VOP_ENV(qshl_s8, neon_s8, 4)
+NEON_VOP_ENV(qshl_s16, neon_s16, 2)
+NEON_VOP_ENV(qshl_s32, neon_s32, 1)
+#undef NEON_FN
+
+uint64_t HELPER(neon_qshl_s64)(CPUState *env, uint64_t valop, uint64_t shiftop)
+{
+    int8_t shift = (uint8_t)shiftop;
+    int64_t val = valop;
+    if (shift >= 64) {
+        if (val) {
+            SET_QC();
+            val = (val >> 63) & ~SIGNBIT64;
+        }
+    } else if (shift <= 64) {
+        val >>= 63;
+    } else if (shift < 0) {
+        val >>= -shift;
+    } else {
+        int64_t tmp = val;
+        val <<= shift;
+        if ((val >> shift) != tmp) {
+            SET_QC();
+            val = (tmp >> 63) ^ ~SIGNBIT64;
+        }
+    }
+    return val;
+}
+
+
+/* FIXME: This is wrong.  */
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src2; \
+    if (tmp < 0) { \
+        dest = (src1 + (1 << (-1 - tmp))) >> -tmp; \
+    } else { \
+        dest = src1 << tmp; \
+        if ((dest >> tmp) != src1) { \
+            SET_QC(); \
+            dest = ~0; \
+        } \
+    }} while (0)
+NEON_VOP_ENV(qrshl_u8, neon_u8, 4)
+NEON_VOP_ENV(qrshl_u16, neon_u16, 2)
+NEON_VOP_ENV(qrshl_u32, neon_u32, 1)
+#undef NEON_FN
+
+uint64_t HELPER(neon_qrshl_u64)(CPUState *env, uint64_t val, uint64_t shiftop)
+{
+    int8_t shift = (int8_t)shiftop;
+    if (shift < 0) {
+        val = (val + (1 << (-1 - shift))) >> -shift;
+    } else { \
+        uint64_t tmp = val;
+        val <<= shift;
+        if ((val >> shift) != tmp) {
+            SET_QC();
+            val = ~0;
+        }
+    }
+    return val;
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src2; \
+    if (tmp < 0) { \
+        dest = (src1 + (1 << (-1 - tmp))) >> -tmp; \
+    } else { \
+        dest = src1 << tmp; \
+        if ((dest >> tmp) != src1) { \
+            SET_QC(); \
+            dest = src1 >> 31; \
+        } \
+    }} while (0)
+NEON_VOP_ENV(qrshl_s8, neon_s8, 4)
+NEON_VOP_ENV(qrshl_s16, neon_s16, 2)
+NEON_VOP_ENV(qrshl_s32, neon_s32, 1)
+#undef NEON_FN
+
+uint64_t HELPER(neon_qrshl_s64)(CPUState *env, uint64_t valop, uint64_t shiftop)
+{
+    int8_t shift = (uint8_t)shiftop;
+    int64_t val = valop;
+
+    if (shift < 0) {
+        val = (val + (1 << (-1 - shift))) >> -shift;
+    } else {
+        int64_t tmp = val;;
+        val <<= shift;
+        if ((val >> shift) != tmp) {
+            SET_QC();
+            val = tmp >> 31;
+        }
+    }
+    return val;
+}
+
+uint32_t HELPER(neon_add_u8)(uint32_t a, uint32_t b)
+{
+    uint32_t mask;
+    mask = (a ^ b) & 0x80808080u;
+    a &= ~0x80808080u;
+    b &= ~0x80808080u;
+    return (a + b) ^ mask;
+}
+
+uint32_t HELPER(neon_add_u16)(uint32_t a, uint32_t b)
+{
+    uint32_t mask;
+    mask = (a ^ b) & 0x80008000u;
+    a &= ~0x80008000u;
+    b &= ~0x80008000u;
+    return (a + b) ^ mask;
+}
+
+#define NEON_FN(dest, src1, src2) dest = src1 + src2
+NEON_POP(padd_u8, neon_u8, 4)
+NEON_POP(padd_u16, neon_u16, 2)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = src1 - src2
+NEON_VOP(sub_u8, neon_u8, 4)
+NEON_VOP(sub_u16, neon_u16, 2)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = src1 * src2
+NEON_VOP(mul_u8, neon_u8, 4)
+NEON_VOP(mul_u16, neon_u16, 2)
+#undef NEON_FN
+
+/* Polynomial multiplication is like integer multiplication except the
+   partial products are XORed, not added.  */
+uint32_t HELPER(neon_mul_p8)(uint32_t op1, uint32_t op2)
+{
+    uint32_t mask;
+    uint32_t result;
+    result = 0;
+    while (op1) {
+        mask = 0;
+        if (op1 & 1)
+            mask |= 0xff;
+        if (op1 & (1 << 8))
+            mask |= (0xff << 8);
+        if (op1 & (1 << 16))
+            mask |= (0xff << 16);
+        if (op1 & (1 << 24))
+            mask |= (0xff << 24);
+        result ^= op2 & mask;
+        op1 = (op1 >> 1) & 0x7f7f7f7f;
+        op2 = (op2 << 1) & 0xfefefefe;
+    }
+    return result;
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 & src2) ? -1 : 0
+NEON_VOP(tst_u8, neon_u8, 4)
+NEON_VOP(tst_u16, neon_u16, 2)
+NEON_VOP(tst_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = (src1 == src2) ? -1 : 0
+NEON_VOP(ceq_u8, neon_u8, 4)
+NEON_VOP(ceq_u16, neon_u16, 2)
+NEON_VOP(ceq_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src, dummy) dest = (src < 0) ? -src : src
+NEON_VOP1(abs_s8, neon_s8, 4)
+NEON_VOP1(abs_s16, neon_s16, 2)
+#undef NEON_FN
+
+/* Count Leading Sign/Zero Bits.  */
+static inline int do_clz8(uint8_t x)
+{
+    int n;
+    for (n = 8; x; n--)
+        x >>= 1;
+    return n;
+}
+
+static inline int do_clz16(uint16_t x)
+{
+    int n;
+    for (n = 16; x; n--)
+        x >>= 1;
+    return n;
+}
+
+#define NEON_FN(dest, src, dummy) dest = do_clz8(src)
+NEON_VOP1(clz_u8, neon_u8, 4)
+#undef NEON_FN
+
+#define NEON_FN(dest, src, dummy) dest = do_clz16(src)
+NEON_VOP1(clz_u16, neon_u16, 2)
+#undef NEON_FN
+
+#define NEON_FN(dest, src, dummy) dest = do_clz8((src < 0) ? ~src : src) - 1
+NEON_VOP1(cls_s8, neon_s8, 4)
+#undef NEON_FN
+
+#define NEON_FN(dest, src, dummy) dest = do_clz16((src < 0) ? ~src : src) - 1
+NEON_VOP1(cls_s16, neon_s16, 2)
+#undef NEON_FN
+
+uint32_t HELPER(neon_cls_s32)(uint32_t x)
+{
+    int count;
+    if ((int32_t)x < 0)
+        x = ~x;
+    for (count = 32; x; count--)
+        x = x >> 1;
+    return count - 1;
+}
+
+/* Bit count.  */
+uint32_t HELPER(neon_cnt_u8)(uint32_t x)
+{
+    x = (x & 0x55555555) + ((x >>  1) & 0x55555555);
+    x = (x & 0x33333333) + ((x >>  2) & 0x33333333);
+    x = (x & 0x0f0f0f0f) + ((x >>  4) & 0x0f0f0f0f);
+    return x;
+}
+
+#define NEON_QDMULH16(dest, src1, src2, round) do { \
+    uint32_t tmp = (int32_t)(int16_t) src1 * (int16_t) src2; \
+    if ((tmp ^ (tmp << 1)) & SIGNBIT) { \
+        SET_QC(); \
+        tmp = (tmp >> 31) ^ ~SIGNBIT; \
+    } \
+    tmp <<= 1; \
+    if (round) { \
+        int32_t old = tmp; \
+        tmp += 1 << 15; \
+        if ((int32_t)tmp < old) { \
+            SET_QC(); \
+            tmp = SIGNBIT - 1; \
+        } \
+    } \
+    dest = tmp >> 16; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_QDMULH16(dest, src1, src2, 0)
+NEON_VOP_ENV(qdmulh_s16, neon_s16, 2)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_QDMULH16(dest, src1, src2, 1)
+NEON_VOP_ENV(qrdmulh_s16, neon_s16, 2)
+#undef NEON_FN
+#undef NEON_QDMULH16
+
+#define NEON_QDMULH32(dest, src1, src2, round) do { \
+    uint64_t tmp = (int64_t)(int32_t) src1 * (int32_t) src2; \
+    if ((tmp ^ (tmp << 1)) & SIGNBIT64) { \
+        SET_QC(); \
+        tmp = (tmp >> 63) ^ ~SIGNBIT64; \
+    } else { \
+        tmp <<= 1; \
+    } \
+    if (round) { \
+        int64_t old = tmp; \
+        tmp += (int64_t)1 << 31; \
+        if ((int64_t)tmp < old) { \
+            SET_QC(); \
+            tmp = SIGNBIT64 - 1; \
+        } \
+    } \
+    dest = tmp >> 32; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_QDMULH32(dest, src1, src2, 0)
+NEON_VOP_ENV(qdmulh_s32, neon_s32, 1)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_QDMULH32(dest, src1, src2, 1)
+NEON_VOP_ENV(qrdmulh_s32, neon_s32, 1)
+#undef NEON_FN
+#undef NEON_QDMULH32
+
+uint32_t HELPER(neon_narrow_u8)(uint64_t x)
+{
+    return (x & 0xffu) | ((x >> 8) & 0xff00u) | ((x >> 16) & 0xff0000u)
+           | ((x >> 24) & 0xff000000u);
+}
+
+uint32_t HELPER(neon_narrow_u16)(uint64_t x)
+{
+    return (x & 0xffffu) | ((x >> 16) & 0xffff0000u);
+}
+
+uint32_t HELPER(neon_narrow_high_u8)(uint64_t x)
+{
+    return ((x >> 8) & 0xff) | ((x >> 16) & 0xff00)
+            | ((x >> 24) & 0xff0000) | ((x >> 32) & 0xff000000);
+}
+
+uint32_t HELPER(neon_narrow_high_u16)(uint64_t x)
+{
+    return ((x >> 16) & 0xffff) | ((x >> 32) & 0xffff0000);
+}
+
+uint32_t HELPER(neon_narrow_round_high_u8)(uint64_t x)
+{
+    x &= 0xff80ff80ff80ff80ull;
+    x += 0x0080008000800080ull;
+    return ((x >> 8) & 0xff) | ((x >> 16) & 0xff00)
+            | ((x >> 24) & 0xff0000) | ((x >> 32) & 0xff000000);
+}
+
+uint32_t HELPER(neon_narrow_round_high_u16)(uint64_t x)
+{
+    x &= 0xffff8000ffff8000ull;
+    x += 0x0000800000008000ull;
+    return ((x >> 16) & 0xffff) | ((x >> 32) & 0xffff0000);
+}
+
+uint32_t HELPER(neon_narrow_sat_u8)(CPUState *env, uint64_t x)
+{
+    uint16_t s;
+    uint8_t d;
+    uint32_t res = 0;
+#define SAT8(n) \
+    s = x >> n; \
+    if (s > 0xff) { \
+        d = 0xff; \
+        SET_QC(); \
+    } else  { \
+        d = s; \
+    } \
+    res |= (uint32_t)d << (n / 2);
+
+    SAT8(0);
+    SAT8(16);
+    SAT8(32);
+    SAT8(48);
+#undef SAT8
+    return res;
+}
+
+uint32_t HELPER(neon_narrow_sat_s8)(CPUState *env, uint64_t x)
+{
+    int16_t s;
+    uint8_t d;
+    uint32_t res = 0;
+#define SAT8(n) \
+    s = x >> n; \
+    if (s != (int8_t)s) { \
+        d = (s >> 15) ^ 0x7f; \
+        SET_QC(); \
+    } else  { \
+        d = s; \
+    } \
+    res |= (uint32_t)d << (n / 2);
+
+    SAT8(0);
+    SAT8(16);
+    SAT8(32);
+    SAT8(48);
+#undef SAT8
+    return res;
+}
+
+uint32_t HELPER(neon_narrow_sat_u16)(CPUState *env, uint64_t x)
+{
+    uint32_t high;
+    uint32_t low;
+    low = x;
+    if (low > 0xffff) {
+        low = 0xffff;
+        SET_QC();
+    }
+    high = x >> 32;
+    if (high > 0xffff) {
+        high = 0xffff;
+        SET_QC();
+    }
+    return low | (high << 16);
+}
+
+uint32_t HELPER(neon_narrow_sat_s16)(CPUState *env, uint64_t x)
+{
+    int32_t low;
+    int32_t high;
+    low = x;
+    if (low != (int16_t)low) {
+        low = (low >> 31) ^ 0x7fff;
+        SET_QC();
+    }
+    high = x >> 32;
+    if (high != (int16_t)high) {
+        high = (high >> 31) ^ 0x7fff;
+        SET_QC();
+    }
+    return (uint16_t)low | (high << 16);
+}
+
+uint32_t HELPER(neon_narrow_sat_u32)(CPUState *env, uint64_t x)
+{
+    if (x > 0xffffffffu) {
+        SET_QC();
+        return 0xffffffffu;
+    }
+    return x;
+}
+
+uint32_t HELPER(neon_narrow_sat_s32)(CPUState *env, uint64_t x)
+{
+    if ((int64_t)x != (int32_t)x) {
+        SET_QC();
+        return (x >> 63) ^ 0x7fffffff;
+    }
+    return x;
+}
+
+uint64_t HELPER(neon_widen_u8)(uint32_t x)
+{
+    uint64_t tmp;
+    uint64_t ret;
+    ret = (uint8_t)x;
+    tmp = (uint8_t)(x >> 8);
+    ret |= tmp << 16;
+    tmp = (uint8_t)(x >> 16);
+    ret |= tmp << 32;
+    tmp = (uint8_t)(x >> 24);
+    ret |= tmp << 48;
+    return ret;
+}
+
+uint64_t HELPER(neon_widen_s8)(uint32_t x)
+{
+    uint64_t tmp;
+    uint64_t ret;
+    ret = (uint16_t)(int8_t)x;
+    tmp = (uint16_t)(int8_t)(x >> 8);
+    ret |= tmp << 16;
+    tmp = (uint16_t)(int8_t)(x >> 16);
+    ret |= tmp << 32;
+    tmp = (uint16_t)(int8_t)(x >> 24);
+    ret |= tmp << 48;
+    return ret;
+}
+
+uint64_t HELPER(neon_widen_u16)(uint32_t x)
+{
+    uint64_t high = (uint16_t)(x >> 16);
+    return ((uint16_t)x) | (high << 32);
+}
+
+uint64_t HELPER(neon_widen_s16)(uint32_t x)
+{
+    uint64_t high = (int16_t)(x >> 16);
+    return ((uint32_t)(int16_t)x) | (high << 32);
+}
+
+uint64_t HELPER(neon_addl_u16)(uint64_t a, uint64_t b)
+{
+    uint64_t mask;
+    mask = (a ^ b) & 0x8000800080008000ull;
+    a &= ~0x8000800080008000ull;
+    b &= ~0x8000800080008000ull;
+    return (a + b) ^ mask;
+}
+
+uint64_t HELPER(neon_addl_u32)(uint64_t a, uint64_t b)
+{
+    uint64_t mask;
+    mask = (a ^ b) & 0x8000000080000000ull;
+    a &= ~0x8000000080000000ull;
+    b &= ~0x8000000080000000ull;
+    return (a + b) ^ mask;
+}
+
+uint64_t HELPER(neon_paddl_u16)(uint64_t a, uint64_t b)
+{
+    uint64_t tmp;
+    uint64_t tmp2;
+
+    tmp = a & 0x0000ffff0000ffffull;
+    tmp += (a >> 16) & 0x0000ffff0000ffffull;
+    tmp2 = b & 0xffff0000ffff0000ull;
+    tmp2 += (b << 16) & 0xffff0000ffff0000ull;
+    return    ( tmp         & 0xffff)
+            | ((tmp  >> 16) & 0xffff0000ull)
+            | ((tmp2 << 16) & 0xffff00000000ull)
+            | ( tmp2        & 0xffff000000000000ull);
+}
+
+uint64_t HELPER(neon_paddl_u32)(uint64_t a, uint64_t b)
+{
+    uint32_t low = a + (a >> 32);
+    uint32_t high = b + (b >> 32);
+    return low + ((uint64_t)high << 32);
+}
+
+uint64_t HELPER(neon_subl_u16)(uint64_t a, uint64_t b)
+{
+    uint64_t mask;
+    mask = (a ^ ~b) & 0x8000800080008000ull;
+    a |= 0x8000800080008000ull;
+    b &= ~0x8000800080008000ull;
+    return (a - b) ^ mask;
+}
+
+uint64_t HELPER(neon_subl_u32)(uint64_t a, uint64_t b)
+{
+    uint64_t mask;
+    mask = (a ^ ~b) & 0x8000000080000000ull;
+    a |= 0x8000000080000000ull;
+    b &= ~0x8000000080000000ull;
+    return (a - b) ^ mask;
+}
+
+uint64_t HELPER(neon_addl_saturate_s32)(CPUState *env, uint64_t a, uint64_t b)
+{
+    uint32_t x, y;
+    uint32_t low, high;
+
+    x = a;
+    y = b;
+    low = x + y;
+    if (((low ^ x) & SIGNBIT) && !((x ^ y) & SIGNBIT)) {
+        SET_QC();
+        low = ((int32_t)x >> 31) ^ ~SIGNBIT;
+    }
+    x = a >> 32;
+    y = b >> 32;
+    high = x + y;
+    if (((high ^ x) & SIGNBIT) && !((x ^ y) & SIGNBIT)) {
+        SET_QC();
+        high = ((int32_t)x >> 31) ^ ~SIGNBIT;
+    }
+    return low | ((uint64_t)high << 32);
+}
+
+uint64_t HELPER(neon_addl_saturate_s64)(CPUState *env, uint64_t a, uint64_t b)
+{
+    uint64_t result;
+
+    result = a + b;
+    if (((result ^ a) & SIGNBIT64) && !((a ^ b) & SIGNBIT64)) {
+        SET_QC();
+        result = ((int64_t)a >> 63) ^ ~SIGNBIT64;
+    }
+    return result;
+}
+
+#define DO_ABD(dest, x, y, type) do { \
+    type tmp_x = x; \
+    type tmp_y = y; \
+    dest = ((tmp_x > tmp_y) ? tmp_x - tmp_y : tmp_y - tmp_x); \
+    } while(0)
+
+uint64_t HELPER(neon_abdl_u16)(uint32_t a, uint32_t b)
+{
+    uint64_t tmp;
+    uint64_t result;
+    DO_ABD(result, a, b, uint8_t);
+    DO_ABD(tmp, a >> 8, b >> 8, uint8_t);
+    result |= tmp << 16;
+    DO_ABD(tmp, a >> 16, b >> 16, uint8_t);
+    result |= tmp << 32;
+    DO_ABD(tmp, a >> 24, b >> 24, uint8_t);
+    result |= tmp << 48;
+    return result;
+}
+
+uint64_t HELPER(neon_abdl_s16)(uint32_t a, uint32_t b)
+{
+    uint64_t tmp;
+    uint64_t result;
+    DO_ABD(result, a, b, int8_t);
+    DO_ABD(tmp, a >> 8, b >> 8, int8_t);
+    result |= tmp << 16;
+    DO_ABD(tmp, a >> 16, b >> 16, int8_t);
+    result |= tmp << 32;
+    DO_ABD(tmp, a >> 24, b >> 24, int8_t);
+    result |= tmp << 48;
+    return result;
+}
+
+uint64_t HELPER(neon_abdl_u32)(uint32_t a, uint32_t b)
+{
+    uint64_t tmp;
+    uint64_t result;
+    DO_ABD(result, a, b, uint16_t);
+    DO_ABD(tmp, a >> 16, b >> 16, uint16_t);
+    return result | (tmp << 32);
+}
+
+uint64_t HELPER(neon_abdl_s32)(uint32_t a, uint32_t b)
+{
+    uint64_t tmp;
+    uint64_t result;
+    DO_ABD(result, a, b, int16_t);
+    DO_ABD(tmp, a >> 16, b >> 16, int16_t);
+    return result | (tmp << 32);
+}
+
+uint64_t HELPER(neon_abdl_u64)(uint32_t a, uint32_t b)
+{
+    uint64_t result;
+    DO_ABD(result, a, b, uint32_t);
+    return result;
+}
+
+uint64_t HELPER(neon_abdl_s64)(uint32_t a, uint32_t b)
+{
+    uint64_t result;
+    DO_ABD(result, a, b, int32_t);
+    return result;
+}
+#undef DO_ABD
+
+/* Widening multiply. Named type is the source type.  */
+#define DO_MULL(dest, x, y, type1, type2) do { \
+    type1 tmp_x = x; \
+    type1 tmp_y = y; \
+    dest = (type2)((type2)tmp_x * (type2)tmp_y); \
+    } while(0)
+
+uint64_t HELPER(neon_mull_u8)(uint32_t a, uint32_t b)
+{
+    uint64_t tmp;
+    uint64_t result;
+
+    DO_MULL(result, a, b, uint8_t, uint16_t);
+    DO_MULL(tmp, a >> 8, b >> 8, uint8_t, uint16_t);
+    result |= tmp << 16;
+    DO_MULL(tmp, a >> 16, b >> 16, uint8_t, uint16_t);
+    result |= tmp << 32;
+    DO_MULL(tmp, a >> 24, b >> 24, uint8_t, uint16_t);
+    result |= tmp << 48;
+    return result;
+}
+
+uint64_t HELPER(neon_mull_s8)(uint32_t a, uint32_t b)
+{
+    uint64_t tmp;
+    uint64_t result;
+
+    DO_MULL(result, a, b, int8_t, uint16_t);
+    DO_MULL(tmp, a >> 8, b >> 8, int8_t, uint16_t);
+    result |= tmp << 16;
+    DO_MULL(tmp, a >> 16, b >> 16, int8_t, uint16_t);
+    result |= tmp << 32;
+    DO_MULL(tmp, a >> 24, b >> 24, int8_t, uint16_t);
+    result |= tmp << 48;
+    return result;
+}
+
+uint64_t HELPER(neon_mull_u16)(uint32_t a, uint32_t b)
+{
+    uint64_t tmp;
+    uint64_t result;
+
+    DO_MULL(result, a, b, uint16_t, uint32_t);
+    DO_MULL(tmp, a >> 16, b >> 16, uint16_t, uint32_t);
+    return result | (tmp << 32);
+}
+
+uint64_t HELPER(neon_mull_s16)(uint32_t a, uint32_t b)
+{
+    uint64_t tmp;
+    uint64_t result;
+
+    DO_MULL(result, a, b, int16_t, uint32_t);
+    DO_MULL(tmp, a >> 16, b >> 16, int16_t, uint32_t);
+    return result | (tmp << 32);
+}
+
+uint64_t HELPER(neon_negl_u16)(uint64_t x)
+{
+    uint16_t tmp;
+    uint64_t result;
+    result = (uint16_t)-x;
+    tmp = -(x >> 16);
+    result |= (uint64_t)tmp << 16;
+    tmp = -(x >> 32);
+    result |= (uint64_t)tmp << 32;
+    tmp = -(x >> 48);
+    result |= (uint64_t)tmp << 48;
+    return result;
+}
+
+#include <stdio.h>
+uint64_t HELPER(neon_negl_u32)(uint64_t x)
+{
+    uint32_t low = -x;
+    uint32_t high = -(x >> 32);
+    return low | ((uint64_t)high << 32);
+}
+
+/* FIXME:  There should be a native op for this.  */
+uint64_t HELPER(neon_negl_u64)(uint64_t x)
+{
+    return -x;
+}
+
+/* Saturnating sign manuipulation.  */
+/* ??? Make these use NEON_VOP1 */
+#define DO_QABS8(x) do { \
+    if (x == (int8_t)0x80) { \
+        x = 0x7f; \
+        SET_QC(); \
+    } else if (x < 0) { \
+        x = -x; \
+    }} while (0)
+uint32_t HELPER(neon_qabs_s8)(CPUState *env, uint32_t x)
+{
+    neon_s8 vec;
+    NEON_UNPACK(neon_s8, vec, x);
+    DO_QABS8(vec.v1);
+    DO_QABS8(vec.v2);
+    DO_QABS8(vec.v3);
+    DO_QABS8(vec.v4);
+    NEON_PACK(neon_s8, x, vec);
+    return x;
+}
+#undef DO_QABS8
+
+#define DO_QNEG8(x) do { \
+    if (x == (int8_t)0x80) { \
+        x = 0x7f; \
+        SET_QC(); \
+    } else { \
+        x = -x; \
+    }} while (0)
+uint32_t HELPER(neon_qneg_s8)(CPUState *env, uint32_t x)
+{
+    neon_s8 vec;
+    NEON_UNPACK(neon_s8, vec, x);
+    DO_QNEG8(vec.v1);
+    DO_QNEG8(vec.v2);
+    DO_QNEG8(vec.v3);
+    DO_QNEG8(vec.v4);
+    NEON_PACK(neon_s8, x, vec);
+    return x;
+}
+#undef DO_QNEG8
+
+#define DO_QABS16(x) do { \
+    if (x == (int16_t)0x8000) { \
+        x = 0x7fff; \
+        SET_QC(); \
+    } else if (x < 0) { \
+        x = -x; \
+    }} while (0)
+uint32_t HELPER(neon_qabs_s16)(CPUState *env, uint32_t x)
+{
+    neon_s16 vec;
+    NEON_UNPACK(neon_s16, vec, x);
+    DO_QABS16(vec.v1);
+    DO_QABS16(vec.v2);
+    NEON_PACK(neon_s16, x, vec);
+    return x;
+}
+#undef DO_QABS16
+
+#define DO_QNEG16(x) do { \
+    if (x == (int16_t)0x8000) { \
+        x = 0x7fff; \
+        SET_QC(); \
+    } else { \
+        x = -x; \
+    }} while (0)
+uint32_t HELPER(neon_qneg_s16)(CPUState *env, uint32_t x)
+{
+    neon_s16 vec;
+    NEON_UNPACK(neon_s16, vec, x);
+    DO_QNEG16(vec.v1);
+    DO_QNEG16(vec.v2);
+    NEON_PACK(neon_s16, x, vec);
+    return x;
+}
+#undef DO_QNEG16
+
+uint32_t HELPER(neon_qabs_s32)(CPUState *env, uint32_t x)
+{
+    if (x == SIGNBIT) {
+        SET_QC();
+        x = ~SIGNBIT;
+    } else if ((int32_t)x < 0) {
+        x = -x;
+    }
+    return x;
+}
+
+uint32_t HELPER(neon_qneg_s32)(CPUState *env, uint32_t x)
+{
+    if (x == SIGNBIT) {
+        SET_QC();
+        x = ~SIGNBIT;
+    } else {
+        x = -x;
+    }
+    return x;
+}
+
+/* NEON Float helpers.  */
+uint32_t HELPER(neon_min_f32)(uint32_t a, uint32_t b)
+{
+    float32 f0 = vfp_itos(a);
+    float32 f1 = vfp_itos(b);
+    return (float32_compare_quiet(f0, f1, NFS) == -1) ? a : b;
+}
+
+uint32_t HELPER(neon_max_f32)(uint32_t a, uint32_t b)
+{
+    float32 f0 = vfp_itos(a);
+    float32 f1 = vfp_itos(b);
+    return (float32_compare_quiet(f0, f1, NFS) == 1) ? a : b;
+}
+
+uint32_t HELPER(neon_abd_f32)(uint32_t a, uint32_t b)
+{
+    float32 f0 = vfp_itos(a);
+    float32 f1 = vfp_itos(b);
+    return vfp_stoi((float32_compare_quiet(f0, f1, NFS) == 1)
+                    ? float32_sub(f0, f1, NFS)
+                    : float32_sub(f1, f0, NFS));
+}
+
+uint32_t HELPER(neon_add_f32)(uint32_t a, uint32_t b)
+{
+    return vfp_stoi(float32_add(vfp_itos(a), vfp_itos(b), NFS));
+}
+
+uint32_t HELPER(neon_sub_f32)(uint32_t a, uint32_t b)
+{
+    return vfp_stoi(float32_sub(vfp_itos(a), vfp_itos(b), NFS));
+}
+
+uint32_t HELPER(neon_mul_f32)(uint32_t a, uint32_t b)
+{
+    return vfp_stoi(float32_mul(vfp_itos(a), vfp_itos(b), NFS));
+}
+
+/* Floating point comparisons produce an integer result.  */
+#define NEON_VOP_FCMP(name, cmp) \
+uint32_t HELPER(neon_##name)(uint32_t a, uint32_t b) \
+{ \
+    if (float32_compare_quiet(vfp_itos(a), vfp_itos(b), NFS) cmp 0) \
+        return ~0; \
+    else \
+        return 0; \
+}
+
+NEON_VOP_FCMP(ceq_f32, ==)
+NEON_VOP_FCMP(cge_f32, >=)
+NEON_VOP_FCMP(cgt_f32, >)
+
+uint32_t HELPER(neon_acge_f32)(uint32_t a, uint32_t b)
+{
+    float32 f0 = float32_abs(vfp_itos(a));
+    float32 f1 = float32_abs(vfp_itos(b));
+    return (float32_compare_quiet(f0, f1,NFS) >= 0) ? ~0 : 0;
+}
+
+uint32_t HELPER(neon_acgt_f32)(uint32_t a, uint32_t b)
+{
+    float32 f0 = float32_abs(vfp_itos(a));
+    float32 f1 = float32_abs(vfp_itos(b));
+    return (float32_compare_quiet(f0, f1, NFS) > 0) ? ~0 : 0;
+}
diff --git a/target-arm/nwfpe/double_cpdo.c b/target-arm/nwfpe/double_cpdo.c
deleted file mode 100644
index 944083a..0000000
--- a/target-arm/nwfpe/double_cpdo.c
+++ /dev/null
@@ -1,296 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.COM, 1998,1999
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "fpa11.h"
-#include "softfloat.h"
-#include "fpopcode.h"
-
-float64 float64_exp(float64 Fm);
-float64 float64_ln(float64 Fm);
-float64 float64_sin(float64 rFm);
-float64 float64_cos(float64 rFm);
-float64 float64_arcsin(float64 rFm);
-float64 float64_arctan(float64 rFm);
-float64 float64_log(float64 rFm);
-float64 float64_tan(float64 rFm);
-float64 float64_arccos(float64 rFm);
-float64 float64_pow(float64 rFn,float64 rFm);
-float64 float64_pol(float64 rFn,float64 rFm);
-
-unsigned int DoubleCPDO(const unsigned int opcode)
-{
-   FPA11 *fpa11 = GET_FPA11();
-   float64 rFm, rFn = 0;
-   unsigned int Fd, Fm, Fn, nRc = 1;
-
-   //printk("DoubleCPDO(0x%08x)\n",opcode);
-   
-   Fm = getFm(opcode);
-   if (CONSTANT_FM(opcode))
-   {
-     rFm = getDoubleConstant(Fm);
-   }
-   else
-   {  
-     switch (fpa11->fType[Fm])
-     {
-        case typeSingle:
-          rFm = float32_to_float64(fpa11->fpreg[Fm].fSingle, &fpa11->fp_status);
-        break;
-
-        case typeDouble:
-          rFm = fpa11->fpreg[Fm].fDouble;
-          break;
-
-        case typeExtended:
-            // !! patb
-	    //printk("not implemented! why not?\n");
-            //!! ScottB
-            // should never get here, if extended involved
-            // then other operand should be promoted then
-            // ExtendedCPDO called.
-            break;
-
-        default: return 0;
-     }
-   }
-
-   if (!MONADIC_INSTRUCTION(opcode))
-   {
-      Fn = getFn(opcode);
-      switch (fpa11->fType[Fn])
-      {
-        case typeSingle:
-          rFn = float32_to_float64(fpa11->fpreg[Fn].fSingle, &fpa11->fp_status);
-        break;
-
-        case typeDouble:
-          rFn = fpa11->fpreg[Fn].fDouble;
-        break;
-        
-        default: return 0;
-      }
-   }
-
-   Fd = getFd(opcode);
-   /* !! this switch isn't optimized; better (opcode & MASK_ARITHMETIC_OPCODE)>>24, sort of */
-   switch (opcode & MASK_ARITHMETIC_OPCODE)
-   {
-      /* dyadic opcodes */
-      case ADF_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_add(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case MUF_CODE:
-      case FML_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_mul(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case SUF_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_sub(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case RSF_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_sub(rFm,rFn, &fpa11->fp_status);
-      break;
-
-      case DVF_CODE:
-      case FDV_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_div(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case RDF_CODE:
-      case FRD_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_div(rFm,rFn, &fpa11->fp_status);
-      break;
-
-#if 0
-      case POW_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_pow(rFn,rFm);
-      break;
-
-      case RPW_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_pow(rFm,rFn);
-      break;
-#endif
-
-      case RMF_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_rem(rFn,rFm, &fpa11->fp_status);
-      break;
-
-#if 0
-      case POL_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_pol(rFn,rFm);
-      break;
-#endif
-
-      /* monadic opcodes */
-      case MVF_CODE:
-         fpa11->fpreg[Fd].fDouble = rFm;
-      break;
-
-      case MNF_CODE:
-      {
-         unsigned int *p = (unsigned int*)&rFm;
-#ifdef WORDS_BIGENDIAN
-         p[0] ^= 0x80000000;
-#else
-         p[1] ^= 0x80000000;
-#endif
-         fpa11->fpreg[Fd].fDouble = rFm;
-      }
-      break;
-
-      case ABS_CODE:
-      {
-         unsigned int *p = (unsigned int*)&rFm;
-#ifdef WORDS_BIGENDIAN
-         p[0] &= 0x7fffffff;
-#else
-         p[1] &= 0x7fffffff;
-#endif
-         fpa11->fpreg[Fd].fDouble = rFm;
-      }
-      break;
-
-      case RND_CODE:
-      case URD_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_round_to_int(rFm, &fpa11->fp_status);
-      break;
-
-      case SQT_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_sqrt(rFm, &fpa11->fp_status);
-      break;
-
-#if 0
-      case LOG_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_log(rFm);
-      break;
-
-      case LGN_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_ln(rFm);
-      break;
-
-      case EXP_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_exp(rFm);
-      break;
-
-      case SIN_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_sin(rFm);
-      break;
-
-      case COS_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_cos(rFm);
-      break;
-
-      case TAN_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_tan(rFm);
-      break;
-
-      case ASN_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_arcsin(rFm);
-      break;
-
-      case ACS_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_arccos(rFm);
-      break;
-
-      case ATN_CODE:
-         fpa11->fpreg[Fd].fDouble = float64_arctan(rFm);
-      break;
-#endif
-
-      case NRM_CODE:
-      break;
-      
-      default:
-      {
-        nRc = 0;
-      }
-   }
-
-   if (0 != nRc) fpa11->fType[Fd] = typeDouble;
-   return nRc;
-}
-
-#if 0
-float64 float64_exp(float64 rFm)
-{
-  return rFm;
-//series
-}
-
-float64 float64_ln(float64 rFm)
-{
-  return rFm;
-//series
-}
-
-float64 float64_sin(float64 rFm)
-{
-  return rFm;
-//series
-}
-
-float64 float64_cos(float64 rFm)
-{
-   return rFm;
-   //series
-}
-
-#if 0
-float64 float64_arcsin(float64 rFm)
-{
-//series
-}
-
-float64 float64_arctan(float64 rFm)
-{
-  //series
-}
-#endif
-
-float64 float64_log(float64 rFm)
-{
-  return float64_div(float64_ln(rFm),getDoubleConstant(7));
-}
-
-float64 float64_tan(float64 rFm)
-{
-  return float64_div(float64_sin(rFm),float64_cos(rFm));
-}
-
-float64 float64_arccos(float64 rFm)
-{
-return rFm;
-   //return float64_sub(halfPi,float64_arcsin(rFm));
-}
-
-float64 float64_pow(float64 rFn,float64 rFm)
-{
-  return float64_exp(float64_mul(rFm,float64_ln(rFn))); 
-}
-
-float64 float64_pol(float64 rFn,float64 rFm)
-{
-  return float64_arctan(float64_div(rFn,rFm)); 
-}
-#endif
diff --git a/target-arm/nwfpe/extended_cpdo.c b/target-arm/nwfpe/extended_cpdo.c
deleted file mode 100644
index f5ef623..0000000
--- a/target-arm/nwfpe/extended_cpdo.c
+++ /dev/null
@@ -1,273 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.COM, 1998,1999
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "fpa11.h"
-#include "softfloat.h"
-#include "fpopcode.h"
-
-floatx80 floatx80_exp(floatx80 Fm);
-floatx80 floatx80_ln(floatx80 Fm);
-floatx80 floatx80_sin(floatx80 rFm);
-floatx80 floatx80_cos(floatx80 rFm);
-floatx80 floatx80_arcsin(floatx80 rFm);
-floatx80 floatx80_arctan(floatx80 rFm);
-floatx80 floatx80_log(floatx80 rFm);
-floatx80 floatx80_tan(floatx80 rFm);
-floatx80 floatx80_arccos(floatx80 rFm);
-floatx80 floatx80_pow(floatx80 rFn,floatx80 rFm);
-floatx80 floatx80_pol(floatx80 rFn,floatx80 rFm);
-
-unsigned int ExtendedCPDO(const unsigned int opcode)
-{
-   FPA11 *fpa11 = GET_FPA11();
-   floatx80 rFm, rFn;
-   unsigned int Fd, Fm, Fn, nRc = 1;
-
-   //printk("ExtendedCPDO(0x%08x)\n",opcode);
-   
-   Fm = getFm(opcode);
-   if (CONSTANT_FM(opcode))
-   {
-     rFm = getExtendedConstant(Fm);
-   }
-   else
-   {  
-     switch (fpa11->fType[Fm])
-     {
-        case typeSingle:
-          rFm = float32_to_floatx80(fpa11->fpreg[Fm].fSingle, &fpa11->fp_status);
-        break;
-
-        case typeDouble:
-          rFm = float64_to_floatx80(fpa11->fpreg[Fm].fDouble, &fpa11->fp_status);
-        break;
-        
-        case typeExtended:
-          rFm = fpa11->fpreg[Fm].fExtended;
-        break;
-        
-        default: return 0;
-     }
-   }
-   
-   if (!MONADIC_INSTRUCTION(opcode))
-   {
-      Fn = getFn(opcode);
-      switch (fpa11->fType[Fn])
-      {
-        case typeSingle:
-          rFn = float32_to_floatx80(fpa11->fpreg[Fn].fSingle, &fpa11->fp_status);
-        break;
-
-        case typeDouble:
-          rFn = float64_to_floatx80(fpa11->fpreg[Fn].fDouble, &fpa11->fp_status);
-        break;
-        
-        case typeExtended:
-          rFn = fpa11->fpreg[Fn].fExtended;
-        break;
-        
-        default: return 0;
-      }
-   }
-
-   Fd = getFd(opcode);
-   switch (opcode & MASK_ARITHMETIC_OPCODE)
-   {
-      /* dyadic opcodes */
-      case ADF_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_add(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case MUF_CODE:
-      case FML_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_mul(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case SUF_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_sub(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case RSF_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_sub(rFm,rFn, &fpa11->fp_status);
-      break;
-
-      case DVF_CODE:
-      case FDV_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_div(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case RDF_CODE:
-      case FRD_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_div(rFm,rFn, &fpa11->fp_status);
-      break;
-
-#if 0
-      case POW_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_pow(rFn,rFm);
-      break;
-
-      case RPW_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_pow(rFm,rFn);
-      break;
-#endif
-
-      case RMF_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_rem(rFn,rFm, &fpa11->fp_status);
-      break;
-
-#if 0
-      case POL_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_pol(rFn,rFm);
-      break;
-#endif
-
-      /* monadic opcodes */
-      case MVF_CODE:
-         fpa11->fpreg[Fd].fExtended = rFm;
-      break;
-
-      case MNF_CODE:
-         rFm.high ^= 0x8000;
-         fpa11->fpreg[Fd].fExtended = rFm;
-      break;
-
-      case ABS_CODE:
-         rFm.high &= 0x7fff;
-         fpa11->fpreg[Fd].fExtended = rFm;
-      break;
-
-      case RND_CODE:
-      case URD_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_round_to_int(rFm, &fpa11->fp_status);
-      break;
-
-      case SQT_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_sqrt(rFm, &fpa11->fp_status);
-      break;
-
-#if 0
-      case LOG_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_log(rFm);
-      break;
-
-      case LGN_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_ln(rFm);
-      break;
-
-      case EXP_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_exp(rFm);
-      break;
-
-      case SIN_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_sin(rFm);
-      break;
-
-      case COS_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_cos(rFm);
-      break;
-
-      case TAN_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_tan(rFm);
-      break;
-
-      case ASN_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_arcsin(rFm);
-      break;
-
-      case ACS_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_arccos(rFm);
-      break;
-
-      case ATN_CODE:
-         fpa11->fpreg[Fd].fExtended = floatx80_arctan(rFm);
-      break;
-#endif
-
-      case NRM_CODE:
-      break;
-      
-      default:
-      {
-        nRc = 0;
-      }
-   }
-   
-   if (0 != nRc) fpa11->fType[Fd] = typeExtended;
-   return nRc;
-}
-
-#if 0
-floatx80 floatx80_exp(floatx80 Fm)
-{
-//series
-}
-
-floatx80 floatx80_ln(floatx80 Fm)
-{
-//series
-}
-
-floatx80 floatx80_sin(floatx80 rFm)
-{
-//series
-}
-
-floatx80 floatx80_cos(floatx80 rFm)
-{
-//series
-}
-
-floatx80 floatx80_arcsin(floatx80 rFm)
-{
-//series
-}
-
-floatx80 floatx80_arctan(floatx80 rFm)
-{
-  //series
-}
-
-floatx80 floatx80_log(floatx80 rFm)
-{
-  return floatx80_div(floatx80_ln(rFm),getExtendedConstant(7));
-}
-
-floatx80 floatx80_tan(floatx80 rFm)
-{
-  return floatx80_div(floatx80_sin(rFm),floatx80_cos(rFm));
-}
-
-floatx80 floatx80_arccos(floatx80 rFm)
-{
-   //return floatx80_sub(halfPi,floatx80_arcsin(rFm));
-}
-
-floatx80 floatx80_pow(floatx80 rFn,floatx80 rFm)
-{
-  return floatx80_exp(floatx80_mul(rFm,floatx80_ln(rFn))); 
-}
-
-floatx80 floatx80_pol(floatx80 rFn,floatx80 rFm)
-{
-  return floatx80_arctan(floatx80_div(rFn,rFm)); 
-}
-#endif
diff --git a/target-arm/nwfpe/fpa11.c b/target-arm/nwfpe/fpa11.c
deleted file mode 100644
index a8141e7..0000000
--- a/target-arm/nwfpe/fpa11.c
+++ /dev/null
@@ -1,237 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.COM, 1998,1999
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "fpa11.h"
-
-#include "fpopcode.h"
-
-//#include "fpmodule.h"
-//#include "fpmodule.inl"
-
-//#include <asm/system.h>
-
-#include <stdio.h>
-
-/* forward declarations */
-unsigned int EmulateCPDO(const unsigned int);
-unsigned int EmulateCPDT(const unsigned int);
-unsigned int EmulateCPRT(const unsigned int);
-
-FPA11* qemufpa=0;
-CPUARMState* user_registers;
-
-/* Reset the FPA11 chip.  Called to initialize and reset the emulator. */
-void resetFPA11(void)
-{
-  int i;
-  FPA11 *fpa11 = GET_FPA11();
-  
-  /* initialize the register type array */
-  for (i=0;i<=7;i++)
-  {
-    fpa11->fType[i] = typeNone;
-  }
-  
-  /* FPSR: set system id to FP_EMULATOR, set AC, clear all other bits */
-  fpa11->fpsr = FP_EMULATOR | BIT_AC;
-  
-  /* FPCR: set SB, AB and DA bits, clear all others */
-#if MAINTAIN_FPCR
-  fpa11->fpcr = MASK_RESET;
-#endif
-}
-
-void SetRoundingMode(const unsigned int opcode)
-{
-    int rounding_mode;
-   FPA11 *fpa11 = GET_FPA11();
-
-#if MAINTAIN_FPCR
-   fpa11->fpcr &= ~MASK_ROUNDING_MODE;
-#endif   
-   switch (opcode & MASK_ROUNDING_MODE)
-   {
-      default:
-      case ROUND_TO_NEAREST:
-         rounding_mode = float_round_nearest_even;
-#if MAINTAIN_FPCR         
-         fpa11->fpcr |= ROUND_TO_NEAREST;
-#endif         
-      break;
-      
-      case ROUND_TO_PLUS_INFINITY:
-         rounding_mode = float_round_up;
-#if MAINTAIN_FPCR         
-         fpa11->fpcr |= ROUND_TO_PLUS_INFINITY;
-#endif         
-      break;
-      
-      case ROUND_TO_MINUS_INFINITY:
-         rounding_mode = float_round_down;
-#if MAINTAIN_FPCR         
-         fpa11->fpcr |= ROUND_TO_MINUS_INFINITY;
-#endif         
-      break;
-      
-      case ROUND_TO_ZERO:
-         rounding_mode = float_round_to_zero;
-#if MAINTAIN_FPCR         
-         fpa11->fpcr |= ROUND_TO_ZERO;
-#endif         
-      break;
-  }
-   set_float_rounding_mode(rounding_mode, &fpa11->fp_status);
-}
-
-void SetRoundingPrecision(const unsigned int opcode)
-{
-    int rounding_precision;
-   FPA11 *fpa11 = GET_FPA11();
-#if MAINTAIN_FPCR
-   fpa11->fpcr &= ~MASK_ROUNDING_PRECISION;
-#endif   
-   switch (opcode & MASK_ROUNDING_PRECISION)
-   {
-      case ROUND_SINGLE:
-         rounding_precision = 32;
-#if MAINTAIN_FPCR         
-         fpa11->fpcr |= ROUND_SINGLE;
-#endif         
-      break;
-      
-      case ROUND_DOUBLE:
-         rounding_precision = 64;
-#if MAINTAIN_FPCR         
-         fpa11->fpcr |= ROUND_DOUBLE;
-#endif         
-      break;
-      
-      case ROUND_EXTENDED:
-         rounding_precision = 80;
-#if MAINTAIN_FPCR         
-         fpa11->fpcr |= ROUND_EXTENDED;
-#endif         
-      break;
-      
-      default: rounding_precision = 80;
-  }
-   set_floatx80_rounding_precision(rounding_precision, &fpa11->fp_status);
-}
-
-/* Emulate the instruction in the opcode. */
-/* ??? This is not thread safe.  */
-unsigned int EmulateAll(unsigned int opcode, FPA11* qfpa, CPUARMState* qregs)
-{
-  unsigned int nRc = 0;
-//  unsigned long flags;
-  FPA11 *fpa11; 
-//  save_flags(flags); sti();
-
-  qemufpa=qfpa;
-  user_registers=qregs;
-  
-#if 0
-  fprintf(stderr,"emulating FP insn 0x%08x, PC=0x%08x\n",
-          opcode, qregs[REG_PC]);
-#endif
-  fpa11 = GET_FPA11();
-
-  if (fpa11->initflag == 0)		/* good place for __builtin_expect */
-  {
-    resetFPA11();
-    SetRoundingMode(ROUND_TO_NEAREST);
-    SetRoundingPrecision(ROUND_EXTENDED);
-    fpa11->initflag = 1;
-  }
-
-  if (TEST_OPCODE(opcode,MASK_CPRT))
-  {
-    //fprintf(stderr,"emulating CPRT\n");
-    /* Emulate conversion opcodes. */
-    /* Emulate register transfer opcodes. */
-    /* Emulate comparison opcodes. */
-    nRc = EmulateCPRT(opcode);
-  }
-  else if (TEST_OPCODE(opcode,MASK_CPDO))
-  {
-    //fprintf(stderr,"emulating CPDO\n");
-    /* Emulate monadic arithmetic opcodes. */
-    /* Emulate dyadic arithmetic opcodes. */
-    nRc = EmulateCPDO(opcode);
-  }
-  else if (TEST_OPCODE(opcode,MASK_CPDT))
-  {
-    //fprintf(stderr,"emulating CPDT\n");
-    /* Emulate load/store opcodes. */
-    /* Emulate load/store multiple opcodes. */
-    nRc = EmulateCPDT(opcode);
-  }
-  else
-  {
-    /* Invalid instruction detected.  Return FALSE. */
-    nRc = 0;
-  }
-
-//  restore_flags(flags);
-
-  //printf("returning %d\n",nRc);
-  return(nRc);
-}
-
-#if 0
-unsigned int EmulateAll1(unsigned int opcode)
-{
-  switch ((opcode >> 24) & 0xf)
-  {
-     case 0xc:
-     case 0xd:
-       if ((opcode >> 20) & 0x1)
-       {
-          switch ((opcode >> 8) & 0xf)
-          {
-             case 0x1: return PerformLDF(opcode); break;
-             case 0x2: return PerformLFM(opcode); break;
-             default: return 0;
-          }
-       }
-       else
-       {
-          switch ((opcode >> 8) & 0xf)
-          {
-             case 0x1: return PerformSTF(opcode); break;
-             case 0x2: return PerformSFM(opcode); break;
-             default: return 0;
-          }
-      }
-     break;
-     
-     case 0xe: 
-       if (opcode & 0x10)
-         return EmulateCPDO(opcode);
-       else
-         return EmulateCPRT(opcode);
-     break;
-  
-     default: return 0;
-  }
-}
-#endif
-
diff --git a/target-arm/nwfpe/fpa11.h b/target-arm/nwfpe/fpa11.h
deleted file mode 100644
index 8751696..0000000
--- a/target-arm/nwfpe/fpa11.h
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.com, 1998-1999
-    
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#ifndef __FPA11_H__
-#define __FPA11_H__
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <errno.h>
-
-#include <cpu.h>
-
-#define GET_FPA11() (qemufpa)
-
-/*
- * The processes registers are always at the very top of the 8K
- * stack+task struct.  Use the same method as 'current' uses to
- * reach them.
- */
-extern CPUARMState *user_registers;
-
-#define GET_USERREG() (user_registers)
-
-/* Need task_struct */
-//#include <linux/sched.h>
-
-/* includes */
-#include "fpsr.h"		/* FP control and status register definitions */
-#include "softfloat.h"
-
-#define		typeNone		0x00
-#define		typeSingle		0x01
-#define		typeDouble		0x02
-#define		typeExtended		0x03
-
-/*
- * This must be no more and no less than 12 bytes.
- */
-typedef union tagFPREG {
-   floatx80 fExtended;
-   float64  fDouble;
-   float32  fSingle;
-} FPREG;
-
-/*
- * FPA11 device model.
- *
- * This structure is exported to user space.  Do not re-order.
- * Only add new stuff to the end, and do not change the size of
- * any element.  Elements of this structure are used by user
- * space, and must match struct user_fp in include/asm-arm/user.h.
- * We include the byte offsets below for documentation purposes.
- *
- * The size of this structure and FPREG are checked by fpmodule.c
- * on initialisation.  If the rules have been broken, NWFPE will
- * not initialise.
- */
-typedef struct tagFPA11 {
-/*   0 */  FPREG fpreg[8];		/* 8 floating point registers */
-/*  96 */  FPSR fpsr;			/* floating point status register */
-/* 100 */  FPCR fpcr;			/* floating point control register */
-/* 104 */  unsigned char fType[8];	/* type of floating point value held in
-					   floating point registers.  One of none
-					   single, double or extended. */
-/* 112 */  int initflag;		/* this is special.  The kernel guarantees
-					   to set it to 0 when a thread is launched,
-					   so we can use it to detect whether this
-					   instance of the emulator needs to be
-					   initialised. */
-    float_status fp_status;      /* QEMU float emulator status */
-} FPA11;
-
-extern FPA11* qemufpa;
-
-extern void resetFPA11(void);
-extern void SetRoundingMode(const unsigned int);
-extern void SetRoundingPrecision(const unsigned int);
-
-static inline unsigned int readRegister(unsigned int reg)
-{
-    return (user_registers->regs[(reg)]);
-}
-
-static inline void writeRegister(unsigned int x, unsigned int y)
-{
-#if 0
-	printf("writing %d to r%d\n",y,x);
-#endif
-        user_registers->regs[(x)]=(y);
-}
-
-static inline void writeConditionCodes(unsigned int x)
-{
-        cpsr_write(user_registers,x,CPSR_NZCV);
-}
-
-#define REG_PC 15
-
-unsigned int EmulateAll(unsigned int opcode, FPA11* qfpa, CPUARMState* qregs);
-
-/* included only for get_user/put_user macros */
-#include "qemu.h"
-
-#endif
diff --git a/target-arm/nwfpe/fpa11.inl b/target-arm/nwfpe/fpa11.inl
deleted file mode 100644
index 7183ec9..0000000
--- a/target-arm/nwfpe/fpa11.inl
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.COM, 1998,1999
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "fpa11.h"
-
-/* Read and write floating point status register */
-static inline unsigned int readFPSR(void)
-{
-  FPA11 *fpa11 = GET_FPA11();
-  return(fpa11->fpsr);
-}
-
-static inline void writeFPSR(FPSR reg)
-{
-  FPA11 *fpa11 = GET_FPA11();
-  /* the sysid byte in the status register is readonly */
-  fpa11->fpsr = (fpa11->fpsr & MASK_SYSID) | (reg & ~MASK_SYSID);
-}
-
-/* Read and write floating point control register */
-static inline FPCR readFPCR(void)
-{
-  FPA11 *fpa11 = GET_FPA11();
-  /* clear SB, AB and DA bits before returning FPCR */
-  return(fpa11->fpcr & ~MASK_RFC);
-}
-
-static inline void writeFPCR(FPCR reg)
-{
-  FPA11 *fpa11 = GET_FPA11();
-  fpa11->fpcr &= ~MASK_WFC;		/* clear SB, AB and DA bits */
-  fpa11->fpcr |= (reg & MASK_WFC);	/* write SB, AB and DA bits */
-}
diff --git a/target-arm/nwfpe/fpa11_cpdo.c b/target-arm/nwfpe/fpa11_cpdo.c
deleted file mode 100644
index cc8aa87..0000000
--- a/target-arm/nwfpe/fpa11_cpdo.c
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.COM, 1998,1999
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "fpa11.h"
-#include "fpopcode.h"
-
-unsigned int SingleCPDO(const unsigned int opcode);
-unsigned int DoubleCPDO(const unsigned int opcode);
-unsigned int ExtendedCPDO(const unsigned int opcode);
-
-unsigned int EmulateCPDO(const unsigned int opcode)
-{
-   FPA11 *fpa11 = GET_FPA11();
-   unsigned int Fd, nType, nDest, nRc = 1;
-   
-   //printk("EmulateCPDO(0x%08x)\n",opcode);
-
-   /* Get the destination size.  If not valid let Linux perform
-      an invalid instruction trap. */
-   nDest = getDestinationSize(opcode);
-   if (typeNone == nDest) return 0;
-   
-   SetRoundingMode(opcode);
-     
-   /* Compare the size of the operands in Fn and Fm.
-      Choose the largest size and perform operations in that size,
-      in order to make use of all the precision of the operands. 
-      If Fm is a constant, we just grab a constant of a size 
-      matching the size of the operand in Fn. */
-   if (MONADIC_INSTRUCTION(opcode))
-     nType = nDest;
-   else
-     nType = fpa11->fType[getFn(opcode)];
-   
-   if (!CONSTANT_FM(opcode))
-   {
-     register unsigned int Fm = getFm(opcode);
-     if (nType < fpa11->fType[Fm])
-     {
-        nType = fpa11->fType[Fm];
-     }
-   }
-
-   switch (nType)
-   {
-      case typeSingle   : nRc = SingleCPDO(opcode);   break;
-      case typeDouble   : nRc = DoubleCPDO(opcode);   break;
-      case typeExtended : nRc = ExtendedCPDO(opcode); break;
-      default           : nRc = 0;
-   }
-
-   /* If the operation succeeded, check to see if the result in the
-      destination register is the correct size.  If not force it
-      to be. */
-   Fd = getFd(opcode);
-   nType = fpa11->fType[Fd];
-   if ((0 != nRc) && (nDest != nType))
-   {
-     switch (nDest)
-     {
-       case typeSingle:
-       {
-         if (typeDouble == nType)
-           fpa11->fpreg[Fd].fSingle = 
-              float64_to_float32(fpa11->fpreg[Fd].fDouble, &fpa11->fp_status);
-         else
-           fpa11->fpreg[Fd].fSingle = 
-              floatx80_to_float32(fpa11->fpreg[Fd].fExtended, &fpa11->fp_status);
-       }
-       break;
-          
-       case typeDouble:
-       {
-         if (typeSingle == nType)
-           fpa11->fpreg[Fd].fDouble = 
-              float32_to_float64(fpa11->fpreg[Fd].fSingle, &fpa11->fp_status);
-         else
-           fpa11->fpreg[Fd].fDouble = 
-              floatx80_to_float64(fpa11->fpreg[Fd].fExtended, &fpa11->fp_status);
-       }
-       break;
-          
-       case typeExtended:
-       {
-         if (typeSingle == nType)
-           fpa11->fpreg[Fd].fExtended = 
-              float32_to_floatx80(fpa11->fpreg[Fd].fSingle, &fpa11->fp_status);
-         else
-           fpa11->fpreg[Fd].fExtended = 
-              float64_to_floatx80(fpa11->fpreg[Fd].fDouble, &fpa11->fp_status);
-       }
-       break;
-     }
-     
-     fpa11->fType[Fd] = nDest;
-   }
-   
-   return nRc;
-}
diff --git a/target-arm/nwfpe/fpa11_cpdt.c b/target-arm/nwfpe/fpa11_cpdt.c
deleted file mode 100644
index 914a86f..0000000
--- a/target-arm/nwfpe/fpa11_cpdt.c
+++ /dev/null
@@ -1,376 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.com, 1998-1999
-    (c) Philip Blundell, 1998
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "fpa11.h"
-#include "softfloat.h"
-#include "fpopcode.h"
-//#include "fpmodule.h"
-//#include "fpmodule.inl"
-
-//#include <asm/uaccess.h>
-
-static inline
-void loadSingle(const unsigned int Fn,const unsigned int *pMem)
-{
-   target_ulong addr = (target_ulong)(long)pMem;
-   FPA11 *fpa11 = GET_FPA11();
-   fpa11->fType[Fn] = typeSingle;
-   fpa11->fpreg[Fn].fSingle = tget32(addr);
-}
-
-static inline
-void loadDouble(const unsigned int Fn,const unsigned int *pMem)
-{
-   target_ulong addr = (target_ulong)(long)pMem;
-   FPA11 *fpa11 = GET_FPA11();
-   unsigned int *p;
-   p = (unsigned int*)&fpa11->fpreg[Fn].fDouble;
-   fpa11->fType[Fn] = typeDouble;
-#ifdef WORDS_BIGENDIAN
-   p[0] = tget32(addr); /* sign & exponent */
-   p[1] = tget32(addr + 4);
-#else
-   p[0] = tget32(addr + 4);
-   p[1] = tget32(addr); /* sign & exponent */
-#endif
-}   
-
-static inline
-void loadExtended(const unsigned int Fn,const unsigned int *pMem)
-{
-   target_ulong addr = (target_ulong)(long)pMem;
-   FPA11 *fpa11 = GET_FPA11();
-   unsigned int *p;
-   p = (unsigned int*)&fpa11->fpreg[Fn].fExtended;
-   fpa11->fType[Fn] = typeExtended;
-   p[0] = tget32(addr);  /* sign & exponent */
-   p[1] = tget32(addr + 8);  /* ls bits */
-   p[2] = tget32(addr + 4);  /* ms bits */
-}   
-
-static inline
-void loadMultiple(const unsigned int Fn,const unsigned int *pMem)
-{
-   target_ulong addr = (target_ulong)(long)pMem;
-   FPA11 *fpa11 = GET_FPA11();
-   register unsigned int *p;
-   unsigned long x;
-
-   p = (unsigned int*)&(fpa11->fpreg[Fn]);
-   x = tget32(addr);
-   fpa11->fType[Fn] = (x >> 14) & 0x00000003;
-   
-   switch (fpa11->fType[Fn])
-   {
-      case typeSingle:
-      case typeDouble:
-      {
-         p[0] = tget32(addr + 8);  /* Single */
-         p[1] = tget32(addr + 4);  /* double msw */
-         p[2] = 0;        /* empty */
-      }
-      break; 
-   
-      case typeExtended:
-      {
-         p[1] = tget32(addr + 8);
-         p[2] = tget32(addr + 4);  /* msw */
-         p[0] = (x & 0x80003fff);      
-      }
-      break;
-   }
-}
-
-static inline
-void storeSingle(const unsigned int Fn,unsigned int *pMem)
-{
-   target_ulong addr = (target_ulong)(long)pMem;
-   FPA11 *fpa11 = GET_FPA11();
-   float32 val;
-   register unsigned int *p = (unsigned int*)&val;
-   
-   switch (fpa11->fType[Fn])
-   {
-      case typeDouble: 
-         val = float64_to_float32(fpa11->fpreg[Fn].fDouble, &fpa11->fp_status);
-      break;
-
-      case typeExtended: 
-         val = floatx80_to_float32(fpa11->fpreg[Fn].fExtended, &fpa11->fp_status);
-      break;
-
-      default: val = fpa11->fpreg[Fn].fSingle;
-   }
-  
-   tput32(addr, p[0]);
-}   
-
-static inline
-void storeDouble(const unsigned int Fn,unsigned int *pMem)
-{
-   target_ulong addr = (target_ulong)(long)pMem;
-   FPA11 *fpa11 = GET_FPA11();
-   float64 val;
-   register unsigned int *p = (unsigned int*)&val;
-
-   switch (fpa11->fType[Fn])
-   {
-      case typeSingle: 
-         val = float32_to_float64(fpa11->fpreg[Fn].fSingle, &fpa11->fp_status);
-      break;
-
-      case typeExtended:
-         val = floatx80_to_float64(fpa11->fpreg[Fn].fExtended, &fpa11->fp_status);
-      break;
-
-      default: val = fpa11->fpreg[Fn].fDouble;
-   }
-#ifdef WORDS_BIGENDIAN
-   tput32(addr, p[0]);	/* msw */
-   tput32(addr + 4, p[1]);	/* lsw */
-#else
-   tput32(addr, p[1]);	/* msw */
-   tput32(addr + 4, p[0]);	/* lsw */
-#endif
-}   
-
-static inline
-void storeExtended(const unsigned int Fn,unsigned int *pMem)
-{
-   target_ulong addr = (target_ulong)(long)pMem;
-   FPA11 *fpa11 = GET_FPA11();
-   floatx80 val;
-   register unsigned int *p = (unsigned int*)&val;
-   
-   switch (fpa11->fType[Fn])
-   {
-      case typeSingle: 
-         val = float32_to_floatx80(fpa11->fpreg[Fn].fSingle, &fpa11->fp_status);
-      break;
-
-      case typeDouble: 
-         val = float64_to_floatx80(fpa11->fpreg[Fn].fDouble, &fpa11->fp_status);
-      break;
-
-      default: val = fpa11->fpreg[Fn].fExtended;
-   }
-   
-   tput32(addr, p[0]); /* sign & exp */
-   tput32(addr + 8, p[1]);
-   tput32(addr + 4, p[2]); /* msw */
-}   
-
-static inline
-void storeMultiple(const unsigned int Fn,unsigned int *pMem)
-{
-   target_ulong addr = (target_ulong)(long)pMem;
-   FPA11 *fpa11 = GET_FPA11();
-   register unsigned int nType, *p;
-   
-   p = (unsigned int*)&(fpa11->fpreg[Fn]);
-   nType = fpa11->fType[Fn];
-   
-   switch (nType)
-   {
-      case typeSingle:
-      case typeDouble:
-      {
-	 tput32(addr + 8, p[0]); /* single */
-	 tput32(addr + 4, p[1]); /* double msw */
-	 tput32(addr, nType << 14);
-      }
-      break; 
-   
-      case typeExtended:
-      {
-	 tput32(addr + 4, p[2]); /* msw */
-	 tput32(addr + 8, p[1]);
-	 tput32(addr, (p[0] & 0x80003fff) | (nType << 14));
-      }
-      break;
-   }
-}
-
-unsigned int PerformLDF(const unsigned int opcode)
-{
-   unsigned int *pBase, *pAddress, *pFinal, nRc = 1,
-     write_back = WRITE_BACK(opcode);
-
-   //printk("PerformLDF(0x%08x), Fd = 0x%08x\n",opcode,getFd(opcode));
-
-   pBase = (unsigned int*)readRegister(getRn(opcode));
-   if (REG_PC == getRn(opcode))
-   {
-     pBase += 2;
-     write_back = 0;
-   }
-
-   pFinal = pBase;
-   if (BIT_UP_SET(opcode))
-     pFinal += getOffset(opcode);
-   else
-     pFinal -= getOffset(opcode);
-
-   if (PREINDEXED(opcode)) pAddress = pFinal; else pAddress = pBase;
-
-   switch (opcode & MASK_TRANSFER_LENGTH)
-   {
-      case TRANSFER_SINGLE  : loadSingle(getFd(opcode),pAddress);   break;
-      case TRANSFER_DOUBLE  : loadDouble(getFd(opcode),pAddress);   break;
-      case TRANSFER_EXTENDED: loadExtended(getFd(opcode),pAddress); break;
-      default: nRc = 0;
-   }
-   
-   if (write_back) writeRegister(getRn(opcode),(unsigned int)pFinal);
-   return nRc;
-}
-
-unsigned int PerformSTF(const unsigned int opcode)
-{
-   unsigned int *pBase, *pAddress, *pFinal, nRc = 1,
-     write_back = WRITE_BACK(opcode);
-   
-   //printk("PerformSTF(0x%08x), Fd = 0x%08x\n",opcode,getFd(opcode));
-   SetRoundingMode(ROUND_TO_NEAREST);
-   
-   pBase = (unsigned int*)readRegister(getRn(opcode));
-   if (REG_PC == getRn(opcode))
-   {
-     pBase += 2;
-     write_back = 0;
-   }
-
-   pFinal = pBase;
-   if (BIT_UP_SET(opcode))
-     pFinal += getOffset(opcode);
-   else
-     pFinal -= getOffset(opcode);
-
-   if (PREINDEXED(opcode)) pAddress = pFinal; else pAddress = pBase;
-
-   switch (opcode & MASK_TRANSFER_LENGTH)
-   {
-      case TRANSFER_SINGLE  : storeSingle(getFd(opcode),pAddress);   break;
-      case TRANSFER_DOUBLE  : storeDouble(getFd(opcode),pAddress);   break;
-      case TRANSFER_EXTENDED: storeExtended(getFd(opcode),pAddress); break;
-      default: nRc = 0;
-   }
-   
-   if (write_back) writeRegister(getRn(opcode),(unsigned int)pFinal);
-   return nRc;
-}
-
-unsigned int PerformLFM(const unsigned int opcode)
-{
-   unsigned int i, Fd, *pBase, *pAddress, *pFinal,
-     write_back = WRITE_BACK(opcode);
-
-   pBase = (unsigned int*)readRegister(getRn(opcode));
-   if (REG_PC == getRn(opcode))
-   {
-     pBase += 2;
-     write_back = 0;
-   }
-
-   pFinal = pBase;
-   if (BIT_UP_SET(opcode))
-     pFinal += getOffset(opcode);
-   else
-     pFinal -= getOffset(opcode);
-
-   if (PREINDEXED(opcode)) pAddress = pFinal; else pAddress = pBase;
-
-   Fd = getFd(opcode);
-   for (i=getRegisterCount(opcode);i>0;i--)
-   {
-     loadMultiple(Fd,pAddress);
-     pAddress += 3; Fd++;
-     if (Fd == 8) Fd = 0;
-   }
-
-   if (write_back) writeRegister(getRn(opcode),(unsigned int)pFinal);
-   return 1;
-}
-
-unsigned int PerformSFM(const unsigned int opcode)
-{
-   unsigned int i, Fd, *pBase, *pAddress, *pFinal,
-     write_back = WRITE_BACK(opcode);
-   
-   pBase = (unsigned int*)readRegister(getRn(opcode));
-   if (REG_PC == getRn(opcode))
-   {
-     pBase += 2;
-     write_back = 0;
-   }
-   
-   pFinal = pBase;
-   if (BIT_UP_SET(opcode))
-     pFinal += getOffset(opcode);
-   else
-     pFinal -= getOffset(opcode);
-
-   if (PREINDEXED(opcode)) pAddress = pFinal; else pAddress = pBase;
-
-   Fd = getFd(opcode);
-   for (i=getRegisterCount(opcode);i>0;i--)
-   {
-     storeMultiple(Fd,pAddress);
-     pAddress += 3; Fd++;
-     if (Fd == 8) Fd = 0;
-   }
-
-   if (write_back) writeRegister(getRn(opcode),(unsigned int)pFinal);
-   return 1;
-}
-
-#if 1
-unsigned int EmulateCPDT(const unsigned int opcode)
-{
-  unsigned int nRc = 0;
-
-  //printk("EmulateCPDT(0x%08x)\n",opcode);
-  
-  if (LDF_OP(opcode))
-  {
-    nRc = PerformLDF(opcode);
-  }
-  else if (LFM_OP(opcode))
-  {
-    nRc = PerformLFM(opcode);
-  }
-  else if (STF_OP(opcode))
-  {
-    nRc = PerformSTF(opcode);
-  } 
-  else if (SFM_OP(opcode))
-  {
-    nRc = PerformSFM(opcode);
-  }
-  else
-  {
-    nRc = 0;
-  }
-  
-  return nRc;
-}
-#endif
diff --git a/target-arm/nwfpe/fpa11_cprt.c b/target-arm/nwfpe/fpa11_cprt.c
deleted file mode 100644
index 91f2d80..0000000
--- a/target-arm/nwfpe/fpa11_cprt.c
+++ /dev/null
@@ -1,290 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.COM, 1998,1999
-    (c) Philip Blundell, 1999
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "fpa11.h"
-#include "softfloat.h"
-#include "fpopcode.h"
-#include "fpa11.inl"
-//#include "fpmodule.h"
-//#include "fpmodule.inl"
-
-extern flag floatx80_is_nan(floatx80);
-extern flag float64_is_nan( float64);
-extern flag float32_is_nan( float32);
-
-void SetRoundingMode(const unsigned int opcode);
-
-unsigned int PerformFLT(const unsigned int opcode);
-unsigned int PerformFIX(const unsigned int opcode);
-
-static unsigned int
-PerformComparison(const unsigned int opcode);
-
-unsigned int EmulateCPRT(const unsigned int opcode)
-{
-  unsigned int nRc = 1;
-
-  //printk("EmulateCPRT(0x%08x)\n",opcode);
-
-  if (opcode & 0x800000)
-  {
-     /* This is some variant of a comparison (PerformComparison will
-	sort out which one).  Since most of the other CPRT
-	instructions are oddball cases of some sort or other it makes
-	sense to pull this out into a fast path.  */
-     return PerformComparison(opcode);
-  }
-
-  /* Hint to GCC that we'd like a jump table rather than a load of CMPs */
-  switch ((opcode & 0x700000) >> 20)
-  {
-    case  FLT_CODE >> 20: nRc = PerformFLT(opcode); break;
-    case  FIX_CODE >> 20: nRc = PerformFIX(opcode); break;
-    
-    case  WFS_CODE >> 20: writeFPSR(readRegister(getRd(opcode))); break;
-    case  RFS_CODE >> 20: writeRegister(getRd(opcode),readFPSR()); break;
-
-#if 0    /* We currently have no use for the FPCR, so there's no point
-	    in emulating it. */
-    case  WFC_CODE >> 20: writeFPCR(readRegister(getRd(opcode)));
-    case  RFC_CODE >> 20: writeRegister(getRd(opcode),readFPCR()); break;
-#endif
-
-    default: nRc = 0;
-  }
-  
-  return nRc;
-}
-
-unsigned int PerformFLT(const unsigned int opcode)
-{
-   FPA11 *fpa11 = GET_FPA11();
-   
-   unsigned int nRc = 1;
-   SetRoundingMode(opcode);
-
-   switch (opcode & MASK_ROUNDING_PRECISION)
-   {
-      case ROUND_SINGLE:
-      {
-        fpa11->fType[getFn(opcode)] = typeSingle;
-        fpa11->fpreg[getFn(opcode)].fSingle =
-	   int32_to_float32(readRegister(getRd(opcode)), &fpa11->fp_status);
-      }
-      break;
-
-      case ROUND_DOUBLE:
-      {
-        fpa11->fType[getFn(opcode)] = typeDouble;
-        fpa11->fpreg[getFn(opcode)].fDouble =
-            int32_to_float64(readRegister(getRd(opcode)), &fpa11->fp_status);
-      }
-      break;
-        
-      case ROUND_EXTENDED:
-      {
-        fpa11->fType[getFn(opcode)] = typeExtended;
-        fpa11->fpreg[getFn(opcode)].fExtended =
-	   int32_to_floatx80(readRegister(getRd(opcode)), &fpa11->fp_status);
-      }
-      break;
-      
-      default: nRc = 0;
-  }
-  
-  return nRc;
-}
-
-unsigned int PerformFIX(const unsigned int opcode)
-{
-   FPA11 *fpa11 = GET_FPA11();
-   unsigned int nRc = 1;
-   unsigned int Fn = getFm(opcode);
-   
-   SetRoundingMode(opcode);
-
-   switch (fpa11->fType[Fn])
-   {
-      case typeSingle:
-      {
-         writeRegister(getRd(opcode),
-	               float32_to_int32(fpa11->fpreg[Fn].fSingle, &fpa11->fp_status));
-      }
-      break;
-
-      case typeDouble:
-      {
-         //printf("F%d is 0x%" PRIx64 "\n",Fn,fpa11->fpreg[Fn].fDouble);
-         writeRegister(getRd(opcode),
-	               float64_to_int32(fpa11->fpreg[Fn].fDouble, &fpa11->fp_status));
-      }
-      break;
-      	               
-      case typeExtended:
-      {
-         writeRegister(getRd(opcode),
-	               floatx80_to_int32(fpa11->fpreg[Fn].fExtended, &fpa11->fp_status));
-      }
-      break;
-      
-      default: nRc = 0;
-  }
-  
-  return nRc;
-}
-
-   
-static unsigned int __inline__
-PerformComparisonOperation(floatx80 Fn, floatx80 Fm)
-{
-   FPA11 *fpa11 = GET_FPA11();
-   unsigned int flags = 0;
-
-   /* test for less than condition */
-   if (floatx80_lt(Fn,Fm, &fpa11->fp_status))
-   {
-      flags |= CC_NEGATIVE;
-   }
-  
-   /* test for equal condition */
-   if (floatx80_eq(Fn,Fm, &fpa11->fp_status))
-   {
-      flags |= CC_ZERO;
-   }
-
-   /* test for greater than or equal condition */
-   if (floatx80_lt(Fm,Fn, &fpa11->fp_status))
-   {
-      flags |= CC_CARRY;
-   }
-   
-   writeConditionCodes(flags);
-   return 1;
-}
-
-/* This instruction sets the flags N, Z, C, V in the FPSR. */
-   
-static unsigned int PerformComparison(const unsigned int opcode)
-{
-   FPA11 *fpa11 = GET_FPA11();
-   unsigned int Fn, Fm;
-   floatx80 rFn, rFm;
-   int e_flag = opcode & 0x400000;	/* 1 if CxFE */
-   int n_flag = opcode & 0x200000;	/* 1 if CNxx */
-   unsigned int flags = 0;
-
-   //printk("PerformComparison(0x%08x)\n",opcode);
-
-   Fn = getFn(opcode);
-   Fm = getFm(opcode);
-
-   /* Check for unordered condition and convert all operands to 80-bit
-      format.
-      ?? Might be some mileage in avoiding this conversion if possible.
-      Eg, if both operands are 32-bit, detect this and do a 32-bit
-      comparison (cheaper than an 80-bit one).  */
-   switch (fpa11->fType[Fn])
-   {
-      case typeSingle: 
-        //printk("single.\n");
-	if (float32_is_nan(fpa11->fpreg[Fn].fSingle))
-	   goto unordered;
-        rFn = float32_to_floatx80(fpa11->fpreg[Fn].fSingle, &fpa11->fp_status);
-      break;
-
-      case typeDouble: 
-        //printk("double.\n");
-	if (float64_is_nan(fpa11->fpreg[Fn].fDouble))
-	   goto unordered;
-        rFn = float64_to_floatx80(fpa11->fpreg[Fn].fDouble, &fpa11->fp_status);
-      break;
-      
-      case typeExtended: 
-        //printk("extended.\n");
-	if (floatx80_is_nan(fpa11->fpreg[Fn].fExtended))
-	   goto unordered;
-        rFn = fpa11->fpreg[Fn].fExtended;
-      break;
-      
-      default: return 0;
-   }
-
-   if (CONSTANT_FM(opcode))
-   {
-     //printk("Fm is a constant: #%d.\n",Fm);
-     rFm = getExtendedConstant(Fm);
-     if (floatx80_is_nan(rFm))
-        goto unordered;
-   }
-   else
-   {
-     //printk("Fm = r%d which contains a ",Fm);
-      switch (fpa11->fType[Fm])
-      {
-         case typeSingle: 
-           //printk("single.\n");
-	   if (float32_is_nan(fpa11->fpreg[Fm].fSingle))
-	      goto unordered;
-           rFm = float32_to_floatx80(fpa11->fpreg[Fm].fSingle, &fpa11->fp_status);
-         break;
-
-         case typeDouble: 
-           //printk("double.\n");
-	   if (float64_is_nan(fpa11->fpreg[Fm].fDouble))
-	      goto unordered;
-           rFm = float64_to_floatx80(fpa11->fpreg[Fm].fDouble, &fpa11->fp_status);
-         break;
-      
-         case typeExtended: 
-           //printk("extended.\n");
-	   if (floatx80_is_nan(fpa11->fpreg[Fm].fExtended))
-	      goto unordered;
-           rFm = fpa11->fpreg[Fm].fExtended;
-         break;
-      
-         default: return 0;
-      }
-   }
-
-   if (n_flag)
-   {
-      rFm.high ^= 0x8000;
-   }
-
-   return PerformComparisonOperation(rFn,rFm);
-
- unordered:
-   /* ?? The FPA data sheet is pretty vague about this, in particular
-      about whether the non-E comparisons can ever raise exceptions.
-      This implementation is based on a combination of what it says in
-      the data sheet, observation of how the Acorn emulator actually
-      behaves (and how programs expect it to) and guesswork.  */
-   flags |= CC_OVERFLOW;
-   flags &= ~(CC_ZERO | CC_NEGATIVE);
-
-   if (BIT_AC & readFPSR()) flags |= CC_CARRY;
-
-   if (e_flag) float_raise(float_flag_invalid, &fpa11->fp_status);
-
-   writeConditionCodes(flags);
-   return 1;
-}
diff --git a/target-arm/nwfpe/fpopcode.c b/target-arm/nwfpe/fpopcode.c
deleted file mode 100644
index d29e913..0000000
--- a/target-arm/nwfpe/fpopcode.c
+++ /dev/null
@@ -1,148 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.COM, 1998,1999
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "fpa11.h"
-#include "softfloat.h"
-#include "fpopcode.h"
-#include "fpsr.h"
-//#include "fpmodule.h"
-//#include "fpmodule.inl"
-
-const floatx80 floatx80Constant[] = {
-  { 0x0000000000000000ULL, 0x0000},	/* extended 0.0 */
-  { 0x8000000000000000ULL, 0x3fff},	/* extended 1.0 */
-  { 0x8000000000000000ULL, 0x4000},	/* extended 2.0 */
-  { 0xc000000000000000ULL, 0x4000},	/* extended 3.0 */
-  { 0x8000000000000000ULL, 0x4001},	/* extended 4.0 */
-  { 0xa000000000000000ULL, 0x4001},	/* extended 5.0 */
-  { 0x8000000000000000ULL, 0x3ffe},	/* extended 0.5 */
-  { 0xa000000000000000ULL, 0x4002}	/* extended 10.0 */
-};  
-
-const float64 float64Constant[] = {
-  0x0000000000000000ULL,		/* double 0.0 */
-  0x3ff0000000000000ULL,		/* double 1.0 */
-  0x4000000000000000ULL,		/* double 2.0 */
-  0x4008000000000000ULL,		/* double 3.0 */
-  0x4010000000000000ULL,		/* double 4.0 */
-  0x4014000000000000ULL,		/* double 5.0 */
-  0x3fe0000000000000ULL,		/* double 0.5 */
-  0x4024000000000000ULL			/* double 10.0 */
-};  
-
-const float32 float32Constant[] = {
-  0x00000000,				/* single 0.0 */
-  0x3f800000,				/* single 1.0 */
-  0x40000000,				/* single 2.0 */
-  0x40400000,				/* single 3.0 */
-  0x40800000,				/* single 4.0 */
-  0x40a00000,				/* single 5.0 */
-  0x3f000000,				/* single 0.5 */
-  0x41200000				/* single 10.0 */
-};  
-
-unsigned int getTransferLength(const unsigned int opcode)
-{
-  unsigned int nRc;
-  
-  switch (opcode & MASK_TRANSFER_LENGTH)
-  {
-    case 0x00000000: nRc = 1; break; /* single precision */
-    case 0x00008000: nRc = 2; break; /* double precision */
-    case 0x00400000: nRc = 3; break; /* extended precision */
-    default: nRc = 0;
-  }
-  
-  return(nRc);
-}
-
-unsigned int getRegisterCount(const unsigned int opcode)
-{
-  unsigned int nRc;
-  
-  switch (opcode & MASK_REGISTER_COUNT)
-  {
-    case 0x00000000: nRc = 4; break;
-    case 0x00008000: nRc = 1; break;
-    case 0x00400000: nRc = 2; break;
-    case 0x00408000: nRc = 3; break;
-    default: nRc = 0;
-  }
-  
-  return(nRc);
-}
-
-unsigned int getRoundingPrecision(const unsigned int opcode)
-{
-  unsigned int nRc;
-  
-  switch (opcode & MASK_ROUNDING_PRECISION)
-  {
-    case 0x00000000: nRc = 1; break;
-    case 0x00000080: nRc = 2; break;
-    case 0x00080000: nRc = 3; break;
-    default: nRc = 0;
-  }
-  
-  return(nRc);
-}
-
-unsigned int getDestinationSize(const unsigned int opcode)
-{
-  unsigned int nRc;
-  
-  switch (opcode & MASK_DESTINATION_SIZE)
-  {
-    case 0x00000000: nRc = typeSingle; break;
-    case 0x00000080: nRc = typeDouble; break;
-    case 0x00080000: nRc = typeExtended; break;
-    default: nRc = typeNone;
-  }
-  
-  return(nRc);
-}
-
-/* condition code lookup table
- index into the table is test code: EQ, NE, ... LT, GT, AL, NV
- bit position in short is condition code: NZCV */
-static const unsigned short aCC[16] = {
-    0xF0F0, // EQ == Z set
-    0x0F0F, // NE
-    0xCCCC, // CS == C set
-    0x3333, // CC
-    0xFF00, // MI == N set
-    0x00FF, // PL
-    0xAAAA, // VS == V set
-    0x5555, // VC
-    0x0C0C, // HI == C set && Z clear
-    0xF3F3, // LS == C clear || Z set
-    0xAA55, // GE == (N==V)
-    0x55AA, // LT == (N!=V)
-    0x0A05, // GT == (!Z && (N==V))
-    0xF5FA, // LE == (Z || (N!=V))
-    0xFFFF, // AL always
-    0 // NV
-};
-
-unsigned int checkCondition(const unsigned int opcode, const unsigned int ccodes)
-{
-  return (aCC[opcode>>28] >> (ccodes>>28)) & 1;
-}
diff --git a/target-arm/nwfpe/fpopcode.h b/target-arm/nwfpe/fpopcode.h
deleted file mode 100644
index 13c7419..0000000
--- a/target-arm/nwfpe/fpopcode.h
+++ /dev/null
@@ -1,390 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.COM, 1998,1999
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#ifndef __FPOPCODE_H__
-#define __FPOPCODE_H__
-
-/*
-ARM Floating Point Instruction Classes
-| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 
-|c o n d|1 1 0 P|U|u|W|L|   Rn  |v|  Fd |0|0|0|1|  o f f s e t  | CPDT
-|c o n d|1 1 0 P|U|w|W|L|   Rn  |x|  Fd |0|0|0|1|  o f f s e t  | CPDT
-| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 
-|c o n d|1 1 1 0|a|b|c|d|e|  Fn |j|  Fd |0|0|0|1|f|g|h|0|i|  Fm | CPDO
-|c o n d|1 1 1 0|a|b|c|L|e|  Fn |   Rd  |0|0|0|1|f|g|h|1|i|  Fm | CPRT
-|c o n d|1 1 1 0|a|b|c|1|e|  Fn |1|1|1|1|0|0|0|1|f|g|h|1|i|  Fm | comparisons
-| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 
-
-CPDT		data transfer instructions
-		LDF, STF, LFM, SFM
-		
-CPDO		dyadic arithmetic instructions
-		ADF, MUF, SUF, RSF, DVF, RDF,
-		POW, RPW, RMF, FML, FDV, FRD, POL
-
-CPDO		monadic arithmetic instructions
-		MVF, MNF, ABS, RND, SQT, LOG, LGN, EXP,
-		SIN, COS, TAN, ASN, ACS, ATN, URD, NRM
-		
-CPRT		joint arithmetic/data transfer instructions
-		FIX (arithmetic followed by load/store)
-		FLT (load/store followed by arithmetic)
-		CMF, CNF CMFE, CNFE (comparisons)
-		WFS, RFS (write/read floating point status register)
-		WFC, RFC (write/read floating point control register)
-
-cond		condition codes
-P		pre/post index bit: 0 = postindex, 1 = preindex
-U		up/down bit: 0 = stack grows down, 1 = stack grows up
-W		write back bit: 1 = update base register (Rn)
-L		load/store bit: 0 = store, 1 = load
-Rn		base register
-Rd		destination/source register		
-Fd		floating point destination register
-Fn		floating point source register
-Fm		floating point source register or floating point constant
-
-uv		transfer length (TABLE 1)
-wx		register count (TABLE 2)
-abcd		arithmetic opcode (TABLES 3 & 4)
-ef		destination size (rounding precision) (TABLE 5)
-gh		rounding mode (TABLE 6)
-j		dyadic/monadic bit: 0 = dyadic, 1 = monadic
-i 		constant bit: 1 = constant (TABLE 6)
-*/
-
-/*
-TABLE 1
-+-------------------------+---+---+---------+---------+
-|  Precision              | u | v | FPSR.EP | length  |
-+-------------------------+---+---+---------+---------+
-| Single                  | 0 ü 0 |    x    | 1 words |
-| Double                  | 1 ü 1 |    x    | 2 words |
-| Extended                | 1 ü 1 |    x    | 3 words |
-| Packed decimal          | 1 ü 1 |    0    | 3 words |
-| Expanded packed decimal | 1 ü 1 |    1    | 4 words |
-+-------------------------+---+---+---------+---------+
-Note: x = don't care
-*/
-
-/*
-TABLE 2
-+---+---+---------------------------------+
-| w | x | Number of registers to transfer |
-+---+---+---------------------------------+
-| 0 ü 1 |  1                              |
-| 1 ü 0 |  2                              |
-| 1 ü 1 |  3                              |
-| 0 ü 0 |  4                              |
-+---+---+---------------------------------+
-*/
-
-/*
-TABLE 3: Dyadic Floating Point Opcodes
-+---+---+---+---+----------+-----------------------+-----------------------+
-| a | b | c | d | Mnemonic | Description           | Operation             |
-+---+---+---+---+----------+-----------------------+-----------------------+
-| 0 | 0 | 0 | 0 | ADF      | Add                   | Fd := Fn + Fm         |
-| 0 | 0 | 0 | 1 | MUF      | Multiply              | Fd := Fn * Fm         |
-| 0 | 0 | 1 | 0 | SUF      | Subtract              | Fd := Fn - Fm         |
-| 0 | 0 | 1 | 1 | RSF      | Reverse subtract      | Fd := Fm - Fn         |
-| 0 | 1 | 0 | 0 | DVF      | Divide                | Fd := Fn / Fm         |
-| 0 | 1 | 0 | 1 | RDF      | Reverse divide        | Fd := Fm / Fn         |
-| 0 | 1 | 1 | 0 | POW      | Power                 | Fd := Fn ^ Fm         |
-| 0 | 1 | 1 | 1 | RPW      | Reverse power         | Fd := Fm ^ Fn         |
-| 1 | 0 | 0 | 0 | RMF      | Remainder             | Fd := IEEE rem(Fn/Fm) |
-| 1 | 0 | 0 | 1 | FML      | Fast Multiply         | Fd := Fn * Fm         |
-| 1 | 0 | 1 | 0 | FDV      | Fast Divide           | Fd := Fn / Fm         |
-| 1 | 0 | 1 | 1 | FRD      | Fast reverse divide   | Fd := Fm / Fn         |
-| 1 | 1 | 0 | 0 | POL      | Polar angle (ArcTan2) | Fd := arctan2(Fn,Fm)  |
-| 1 | 1 | 0 | 1 |          | undefined instruction | trap                  |
-| 1 | 1 | 1 | 0 |          | undefined instruction | trap                  |
-| 1 | 1 | 1 | 1 |          | undefined instruction | trap                  |
-+---+---+---+---+----------+-----------------------+-----------------------+
-Note: POW, RPW, POL are deprecated, and are available for backwards
-      compatibility only.
-*/
-
-/*
-TABLE 4: Monadic Floating Point Opcodes
-+---+---+---+---+----------+-----------------------+-----------------------+
-| a | b | c | d | Mnemonic | Description           | Operation             |
-+---+---+---+---+----------+-----------------------+-----------------------+
-| 0 | 0 | 0 | 0 | MVF      | Move                  | Fd := Fm              |
-| 0 | 0 | 0 | 1 | MNF      | Move negated          | Fd := - Fm            |
-| 0 | 0 | 1 | 0 | ABS      | Absolute value        | Fd := abs(Fm)         |
-| 0 | 0 | 1 | 1 | RND      | Round to integer      | Fd := int(Fm)         |
-| 0 | 1 | 0 | 0 | SQT      | Square root           | Fd := sqrt(Fm)        |
-| 0 | 1 | 0 | 1 | LOG      | Log base 10           | Fd := log10(Fm)       |
-| 0 | 1 | 1 | 0 | LGN      | Log base e            | Fd := ln(Fm)          |
-| 0 | 1 | 1 | 1 | EXP      | Exponent              | Fd := e ^ Fm          |
-| 1 | 0 | 0 | 0 | SIN      | Sine                  | Fd := sin(Fm)         |
-| 1 | 0 | 0 | 1 | COS      | Cosine                | Fd := cos(Fm)         |
-| 1 | 0 | 1 | 0 | TAN      | Tangent               | Fd := tan(Fm)         |
-| 1 | 0 | 1 | 1 | ASN      | Arc Sine              | Fd := arcsin(Fm)      |
-| 1 | 1 | 0 | 0 | ACS      | Arc Cosine            | Fd := arccos(Fm)      |
-| 1 | 1 | 0 | 1 | ATN      | Arc Tangent           | Fd := arctan(Fm)      |
-| 1 | 1 | 1 | 0 | URD      | Unnormalized round    | Fd := int(Fm)         |
-| 1 | 1 | 1 | 1 | NRM      | Normalize             | Fd := norm(Fm)        |
-+---+---+---+---+----------+-----------------------+-----------------------+
-Note: LOG, LGN, EXP, SIN, COS, TAN, ASN, ACS, ATN are deprecated, and are
-      available for backwards compatibility only.
-*/
-
-/*
-TABLE 5
-+-------------------------+---+---+
-|  Rounding Precision     | e | f |
-+-------------------------+---+---+
-| IEEE Single precision   | 0 ü 0 |
-| IEEE Double precision   | 0 ü 1 |
-| IEEE Extended precision | 1 ü 0 |
-| undefined (trap)        | 1 ü 1 |
-+-------------------------+---+---+
-*/
-
-/*
-TABLE 5
-+---------------------------------+---+---+
-|  Rounding Mode                  | g | h |
-+---------------------------------+---+---+
-| Round to nearest (default)      | 0 ü 0 |
-| Round toward plus infinity      | 0 ü 1 |
-| Round toward negative infinity  | 1 ü 0 |
-| Round toward zero               | 1 ü 1 |
-+---------------------------------+---+---+
-*/
-
-/*
-===
-=== Definitions for load and store instructions
-===
-*/
-
-/* bit masks */
-#define BIT_PREINDEX	0x01000000
-#define BIT_UP		0x00800000
-#define BIT_WRITE_BACK	0x00200000
-#define BIT_LOAD	0x00100000
-
-/* masks for load/store */
-#define MASK_CPDT		0x0c000000  /* data processing opcode */
-#define MASK_OFFSET		0x000000ff
-#define MASK_TRANSFER_LENGTH	0x00408000
-#define MASK_REGISTER_COUNT	MASK_TRANSFER_LENGTH
-#define MASK_COPROCESSOR	0x00000f00
-
-/* Tests for transfer length */
-#define TRANSFER_SINGLE		0x00000000
-#define TRANSFER_DOUBLE		0x00008000
-#define TRANSFER_EXTENDED	0x00400000
-#define TRANSFER_PACKED		MASK_TRANSFER_LENGTH
-
-/* Get the coprocessor number from the opcode. */
-#define getCoprocessorNumber(opcode)	((opcode & MASK_COPROCESSOR) >> 8)
-
-/* Get the offset from the opcode. */
-#define getOffset(opcode)		(opcode & MASK_OFFSET)
-
-/* Tests for specific data transfer load/store opcodes. */
-#define TEST_OPCODE(opcode,mask)	(((opcode) & (mask)) == (mask))
-
-#define LOAD_OP(opcode)   TEST_OPCODE((opcode),MASK_CPDT | BIT_LOAD)
-#define STORE_OP(opcode)  ((opcode & (MASK_CPDT | BIT_LOAD)) == MASK_CPDT)
-
-#define LDF_OP(opcode)	(LOAD_OP(opcode) && (getCoprocessorNumber(opcode) == 1))
-#define LFM_OP(opcode)	(LOAD_OP(opcode) && (getCoprocessorNumber(opcode) == 2))
-#define STF_OP(opcode)	(STORE_OP(opcode) && (getCoprocessorNumber(opcode) == 1))
-#define SFM_OP(opcode)	(STORE_OP(opcode) && (getCoprocessorNumber(opcode) == 2))
-
-#define PREINDEXED(opcode)		((opcode & BIT_PREINDEX) != 0)
-#define POSTINDEXED(opcode)		((opcode & BIT_PREINDEX) == 0)
-#define BIT_UP_SET(opcode)		((opcode & BIT_UP) != 0)
-#define BIT_UP_CLEAR(opcode)		((opcode & BIT_DOWN) == 0)
-#define WRITE_BACK(opcode)		((opcode & BIT_WRITE_BACK) != 0)
-#define LOAD(opcode)			((opcode & BIT_LOAD) != 0)
-#define STORE(opcode)			((opcode & BIT_LOAD) == 0)
-
-/*
-===
-=== Definitions for arithmetic instructions
-===
-*/
-/* bit masks */
-#define BIT_MONADIC	0x00008000
-#define BIT_CONSTANT	0x00000008
-
-#define CONSTANT_FM(opcode)		((opcode & BIT_CONSTANT) != 0)
-#define MONADIC_INSTRUCTION(opcode)	((opcode & BIT_MONADIC) != 0)
-
-/* instruction identification masks */
-#define MASK_CPDO		0x0e000000  /* arithmetic opcode */
-#define MASK_ARITHMETIC_OPCODE	0x00f08000
-#define MASK_DESTINATION_SIZE	0x00080080
-
-/* dyadic arithmetic opcodes. */
-#define ADF_CODE	0x00000000
-#define MUF_CODE	0x00100000
-#define SUF_CODE	0x00200000
-#define RSF_CODE	0x00300000
-#define DVF_CODE	0x00400000
-#define RDF_CODE	0x00500000
-#define POW_CODE	0x00600000
-#define RPW_CODE	0x00700000
-#define RMF_CODE	0x00800000
-#define FML_CODE	0x00900000
-#define FDV_CODE	0x00a00000
-#define FRD_CODE	0x00b00000
-#define POL_CODE	0x00c00000
-/* 0x00d00000 is an invalid dyadic arithmetic opcode */
-/* 0x00e00000 is an invalid dyadic arithmetic opcode */
-/* 0x00f00000 is an invalid dyadic arithmetic opcode */
-
-/* monadic arithmetic opcodes. */
-#define MVF_CODE	0x00008000
-#define MNF_CODE	0x00108000
-#define ABS_CODE	0x00208000
-#define RND_CODE	0x00308000
-#define SQT_CODE	0x00408000
-#define LOG_CODE	0x00508000
-#define LGN_CODE	0x00608000
-#define EXP_CODE	0x00708000
-#define SIN_CODE	0x00808000
-#define COS_CODE	0x00908000
-#define TAN_CODE	0x00a08000
-#define ASN_CODE	0x00b08000
-#define ACS_CODE	0x00c08000
-#define ATN_CODE	0x00d08000
-#define URD_CODE	0x00e08000
-#define NRM_CODE	0x00f08000
-
-/*
-===
-=== Definitions for register transfer and comparison instructions
-===
-*/
-
-#define MASK_CPRT		0x0e000010  /* register transfer opcode */
-#define MASK_CPRT_CODE		0x00f00000
-#define FLT_CODE		0x00000000
-#define FIX_CODE		0x00100000
-#define WFS_CODE		0x00200000
-#define RFS_CODE		0x00300000
-#define WFC_CODE		0x00400000
-#define RFC_CODE		0x00500000
-#define CMF_CODE		0x00900000
-#define CNF_CODE		0x00b00000
-#define CMFE_CODE		0x00d00000
-#define CNFE_CODE		0x00f00000
-
-/*
-===
-=== Common definitions
-===
-*/
-
-/* register masks */
-#define MASK_Rd		0x0000f000
-#define MASK_Rn		0x000f0000
-#define MASK_Fd		0x00007000
-#define MASK_Fm		0x00000007
-#define MASK_Fn		0x00070000
-
-/* condition code masks */
-#define CC_MASK		0xf0000000
-#define CC_NEGATIVE	0x80000000
-#define CC_ZERO		0x40000000
-#define CC_CARRY	0x20000000
-#define CC_OVERFLOW	0x10000000
-#define CC_EQ		0x00000000
-#define CC_NE		0x10000000
-#define CC_CS		0x20000000
-#define CC_HS		CC_CS
-#define CC_CC		0x30000000
-#define CC_LO		CC_CC
-#define CC_MI		0x40000000
-#define CC_PL		0x50000000
-#define CC_VS		0x60000000
-#define CC_VC		0x70000000
-#define CC_HI		0x80000000
-#define CC_LS		0x90000000
-#define CC_GE		0xa0000000
-#define CC_LT		0xb0000000
-#define CC_GT		0xc0000000
-#define CC_LE		0xd0000000
-#define CC_AL		0xe0000000
-#define CC_NV		0xf0000000
-
-/* rounding masks/values */
-#define MASK_ROUNDING_MODE	0x00000060
-#define ROUND_TO_NEAREST	0x00000000
-#define ROUND_TO_PLUS_INFINITY	0x00000020
-#define ROUND_TO_MINUS_INFINITY	0x00000040
-#define ROUND_TO_ZERO		0x00000060
-
-#define MASK_ROUNDING_PRECISION	0x00080080
-#define ROUND_SINGLE		0x00000000
-#define ROUND_DOUBLE		0x00000080
-#define ROUND_EXTENDED		0x00080000
-
-/* Get the condition code from the opcode. */
-#define getCondition(opcode)		(opcode >> 28)
-
-/* Get the source register from the opcode. */
-#define getRn(opcode)			((opcode & MASK_Rn) >> 16)
-
-/* Get the destination floating point register from the opcode. */
-#define getFd(opcode)			((opcode & MASK_Fd) >> 12)
-
-/* Get the first source floating point register from the opcode. */
-#define getFn(opcode)		((opcode & MASK_Fn) >> 16)
-
-/* Get the second source floating point register from the opcode. */
-#define getFm(opcode)		(opcode & MASK_Fm)
-
-/* Get the destination register from the opcode. */
-#define getRd(opcode)		((opcode & MASK_Rd) >> 12)
-
-/* Get the rounding mode from the opcode. */
-#define getRoundingMode(opcode)		((opcode & MASK_ROUNDING_MODE) >> 5)
-
-static inline const floatx80 getExtendedConstant(const unsigned int nIndex)
-{
-   extern const floatx80 floatx80Constant[];
-   return floatx80Constant[nIndex];
-} 
-
-static inline const float64 getDoubleConstant(const unsigned int nIndex)
-{
-   extern const float64 float64Constant[];
-   return float64Constant[nIndex];
-} 
-
-static inline const float32 getSingleConstant(const unsigned int nIndex)
-{
-   extern const float32 float32Constant[];
-   return float32Constant[nIndex];
-} 
-
-extern unsigned int getRegisterCount(const unsigned int opcode);
-extern unsigned int getDestinationSize(const unsigned int opcode);
-
-#endif
diff --git a/target-arm/nwfpe/fpsr.h b/target-arm/nwfpe/fpsr.h
deleted file mode 100644
index 6dafb0f..0000000
--- a/target-arm/nwfpe/fpsr.h
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.com, 1998-1999
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#ifndef __FPSR_H__
-#define __FPSR_H__
-
-/*
-The FPSR is a 32 bit register consisting of 4 parts, each exactly
-one byte.
-
-	SYSTEM ID
-	EXCEPTION TRAP ENABLE BYTE
-	SYSTEM CONTROL BYTE
-	CUMULATIVE EXCEPTION FLAGS BYTE
-	
-The FPCR is a 32 bit register consisting of bit flags.
-*/
-
-/* SYSTEM ID
-------------
-Note: the system id byte is read only  */
-
-typedef unsigned int FPSR;  /* type for floating point status register */
-typedef unsigned int FPCR;  /* type for floating point control register */
-
-#define MASK_SYSID		0xff000000
-#define BIT_HARDWARE		0x80000000
-#define FP_EMULATOR		0x01000000	/* System ID for emulator */ 
-#define FP_ACCELERATOR		0x81000000	/* System ID for FPA11 */
-
-/* EXCEPTION TRAP ENABLE BYTE
------------------------------ */
-
-#define MASK_TRAP_ENABLE	0x00ff0000
-#define MASK_TRAP_ENABLE_STRICT	0x001f0000
-#define BIT_IXE		0x00100000   /* inexact exception enable */
-#define BIT_UFE		0x00080000   /* underflow exception enable */
-#define BIT_OFE		0x00040000   /* overflow exception enable */
-#define BIT_DZE		0x00020000   /* divide by zero exception enable */
-#define BIT_IOE		0x00010000   /* invalid operation exception enable */
-
-/* SYSTEM CONTROL BYTE
----------------------- */
-
-#define MASK_SYSTEM_CONTROL	0x0000ff00
-#define MASK_TRAP_STRICT	0x00001f00
-
-#define BIT_AC	0x00001000	/* use alternative C-flag definition
-				   for compares */
-#define BIT_EP	0x00000800	/* use expanded packed decimal format */
-#define BIT_SO	0x00000400	/* select synchronous operation of FPA */
-#define BIT_NE	0x00000200	/* NaN exception bit */
-#define BIT_ND	0x00000100	/* no denormalized numbers bit */
-
-/* CUMULATIVE EXCEPTION FLAGS BYTE
----------------------------------- */
-
-#define MASK_EXCEPTION_FLAGS		0x000000ff
-#define MASK_EXCEPTION_FLAGS_STRICT	0x0000001f
-
-#define BIT_IXC		0x00000010	/* inexact exception flag */
-#define BIT_UFC		0x00000008	/* underflow exception flag */
-#define BIT_OFC		0x00000004	/* overfloat exception flag */
-#define BIT_DZC		0x00000002	/* divide by zero exception flag */
-#define BIT_IOC		0x00000001	/* invalid operation exception flag */
-
-/* Floating Point Control Register
-----------------------------------*/
-
-#define BIT_RU		0x80000000	/* rounded up bit */
-#define BIT_IE		0x10000000	/* inexact bit */
-#define BIT_MO		0x08000000	/* mantissa overflow bit */
-#define BIT_EO		0x04000000	/* exponent overflow bit */
-#define BIT_SB		0x00000800	/* store bounce */
-#define BIT_AB		0x00000400	/* arithmetic bounce */
-#define BIT_RE		0x00000200	/* rounding exception */
-#define BIT_DA		0x00000100	/* disable FPA */
-
-#define MASK_OP		0x00f08010	/* AU operation code */
-#define MASK_PR		0x00080080	/* AU precision */
-#define MASK_S1		0x00070000	/* AU source register 1 */
-#define MASK_S2		0x00000007	/* AU source register 2 */
-#define MASK_DS		0x00007000	/* AU destination register */
-#define MASK_RM		0x00000060	/* AU rounding mode */
-#define MASK_ALU	0x9cfff2ff	/* only ALU can write these bits */
-#define MASK_RESET	0x00000d00	/* bits set on reset, all others cleared */
-#define MASK_WFC	MASK_RESET
-#define MASK_RFC	~MASK_RESET
-
-#endif
diff --git a/target-arm/nwfpe/single_cpdo.c b/target-arm/nwfpe/single_cpdo.c
deleted file mode 100644
index 7dd2620..0000000
--- a/target-arm/nwfpe/single_cpdo.c
+++ /dev/null
@@ -1,255 +0,0 @@
-/*
-    NetWinder Floating Point Emulator
-    (c) Rebel.COM, 1998,1999
-
-    Direct questions, comments to Scott Bambrough <scottb@netwinder.org>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "fpa11.h"
-#include "softfloat.h"
-#include "fpopcode.h"
-
-float32 float32_exp(float32 Fm);
-float32 float32_ln(float32 Fm);
-float32 float32_sin(float32 rFm);
-float32 float32_cos(float32 rFm);
-float32 float32_arcsin(float32 rFm);
-float32 float32_arctan(float32 rFm);
-float32 float32_log(float32 rFm);
-float32 float32_tan(float32 rFm);
-float32 float32_arccos(float32 rFm);
-float32 float32_pow(float32 rFn,float32 rFm);
-float32 float32_pol(float32 rFn,float32 rFm);
-
-unsigned int SingleCPDO(const unsigned int opcode)
-{
-   FPA11 *fpa11 = GET_FPA11();
-   float32 rFm, rFn = 0;
-   unsigned int Fd, Fm, Fn, nRc = 1;
-
-   Fm = getFm(opcode);
-   if (CONSTANT_FM(opcode))
-   {
-     rFm = getSingleConstant(Fm);
-   }
-   else
-   {  
-     switch (fpa11->fType[Fm])
-     {
-        case typeSingle:
-          rFm = fpa11->fpreg[Fm].fSingle;
-        break;
-        
-        default: return 0;
-     }
-   }
-
-   if (!MONADIC_INSTRUCTION(opcode))
-   {
-      Fn = getFn(opcode);
-      switch (fpa11->fType[Fn])
-      {
-        case typeSingle:
-          rFn = fpa11->fpreg[Fn].fSingle;
-        break;
-
-        default: return 0;
-      }
-   }
-
-   Fd = getFd(opcode);
-   switch (opcode & MASK_ARITHMETIC_OPCODE)
-   {
-      /* dyadic opcodes */
-      case ADF_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_add(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case MUF_CODE:
-      case FML_CODE:
-        fpa11->fpreg[Fd].fSingle = float32_mul(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case SUF_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_sub(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case RSF_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_sub(rFm,rFn, &fpa11->fp_status);
-      break;
-
-      case DVF_CODE:
-      case FDV_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_div(rFn,rFm, &fpa11->fp_status);
-      break;
-
-      case RDF_CODE:
-      case FRD_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_div(rFm,rFn, &fpa11->fp_status);
-      break;
-
-#if 0
-      case POW_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_pow(rFn,rFm);
-      break;
-
-      case RPW_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_pow(rFm,rFn);
-      break;
-#endif
-
-      case RMF_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_rem(rFn,rFm, &fpa11->fp_status);
-      break;
-
-#if 0
-      case POL_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_pol(rFn,rFm);
-      break;
-#endif
-
-      /* monadic opcodes */
-      case MVF_CODE:
-         fpa11->fpreg[Fd].fSingle = rFm;
-      break;
-
-      case MNF_CODE:
-         rFm ^= 0x80000000;
-         fpa11->fpreg[Fd].fSingle = rFm;
-      break;
-
-      case ABS_CODE:
-         rFm &= 0x7fffffff;
-         fpa11->fpreg[Fd].fSingle = rFm;
-      break;
-
-      case RND_CODE:
-      case URD_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_round_to_int(rFm, &fpa11->fp_status);
-      break;
-
-      case SQT_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_sqrt(rFm, &fpa11->fp_status);
-      break;
-
-#if 0
-      case LOG_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_log(rFm);
-      break;
-
-      case LGN_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_ln(rFm);
-      break;
-
-      case EXP_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_exp(rFm);
-      break;
-
-      case SIN_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_sin(rFm);
-      break;
-
-      case COS_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_cos(rFm);
-      break;
-
-      case TAN_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_tan(rFm);
-      break;
-
-      case ASN_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_arcsin(rFm);
-      break;
-
-      case ACS_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_arccos(rFm);
-      break;
-
-      case ATN_CODE:
-         fpa11->fpreg[Fd].fSingle = float32_arctan(rFm);
-      break;
-#endif
-
-      case NRM_CODE:
-      break;
-      
-      default:
-      {
-        nRc = 0;
-      }
-   }
-
-   if (0 != nRc) fpa11->fType[Fd] = typeSingle;
-   return nRc;
-}
-
-#if 0
-float32 float32_exp(float32 Fm)
-{
-//series
-}
-
-float32 float32_ln(float32 Fm)
-{
-//series
-}
-
-float32 float32_sin(float32 rFm)
-{
-//series
-}
-
-float32 float32_cos(float32 rFm)
-{
-//series
-}
-
-float32 float32_arcsin(float32 rFm)
-{
-//series
-}
-
-float32 float32_arctan(float32 rFm)
-{
-  //series
-}
-
-float32 float32_arccos(float32 rFm)
-{
-   //return float32_sub(halfPi,float32_arcsin(rFm));
-}
-
-float32 float32_log(float32 rFm)
-{
-  return float32_div(float32_ln(rFm),getSingleConstant(7));
-}
-
-float32 float32_tan(float32 rFm)
-{
-  return float32_div(float32_sin(rFm),float32_cos(rFm));
-}
-
-float32 float32_pow(float32 rFn,float32 rFm)
-{
-  return float32_exp(float32_mul(rFm,float32_ln(rFn))); 
-}
-
-float32 float32_pol(float32 rFn,float32 rFm)
-{
-  return float32_arctan(float32_div(rFn,rFm)); 
-}
-#endif
diff --git a/target-arm/op.c b/target-arm/op.c
deleted file mode 100644
index 48a81de..0000000
--- a/target-arm/op.c
+++ /dev/null
@@ -1,1230 +0,0 @@
-/*
- *  ARM micro operations
- * 
- *  Copyright (c) 2003 Fabrice Bellard
- *  Copyright (c) 2005 CodeSourcery, LLC
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-#include "exec.h"
-#ifdef GEN_TRACE
-#include "trace.h"
-#endif
-
-#define REGNAME r0
-#define REG (env->regs[0])
-#include "op_template.h"
-
-#define REGNAME r1
-#define REG (env->regs[1])
-#include "op_template.h"
-
-#define REGNAME r2
-#define REG (env->regs[2])
-#include "op_template.h"
-
-#define REGNAME r3
-#define REG (env->regs[3])
-#include "op_template.h"
-
-#define REGNAME r4
-#define REG (env->regs[4])
-#include "op_template.h"
-
-#define REGNAME r5
-#define REG (env->regs[5])
-#include "op_template.h"
-
-#define REGNAME r6
-#define REG (env->regs[6])
-#include "op_template.h"
-
-#define REGNAME r7
-#define REG (env->regs[7])
-#include "op_template.h"
-
-#define REGNAME r8
-#define REG (env->regs[8])
-#include "op_template.h"
-
-#define REGNAME r9
-#define REG (env->regs[9])
-#include "op_template.h"
-
-#define REGNAME r10
-#define REG (env->regs[10])
-#include "op_template.h"
-
-#define REGNAME r11
-#define REG (env->regs[11])
-#include "op_template.h"
-
-#define REGNAME r12
-#define REG (env->regs[12])
-#include "op_template.h"
-
-#define REGNAME r13
-#define REG (env->regs[13])
-#include "op_template.h"
-
-#define REGNAME r14
-#define REG (env->regs[14])
-#include "op_template.h"
-
-#define REGNAME r15
-#define REG (env->regs[15])
-#define SET_REG(x) REG = x & ~(uint32_t)1
-#include "op_template.h"
-
-#ifdef GEN_TRACE
-void OPPROTO op_shutdown(void)
-{
-  extern void qemu_system_shutdown_request(void);
-  qemu_system_shutdown_request();
-  EXIT_TB();
-}
-
-void OPPROTO op_trace_bb(void)
-{
-  trace_bb_helper(PARAM1, (TranslationBlock *)PARAM2);
-}
-
-void OPPROTO op_trace_insn(void)
-{
-  trace_insn_helper();
-}
-
-void OPPROTO op_add_to_sim_time(void)
-{
-  sim_time += PARAM1;
-}
-#endif
-
-void OPPROTO op_bx_T0(void)
-{
-  env->regs[15] = T0 & ~(uint32_t)1;
-  env->thumb = (T0 & 1) != 0;
-}
-
-void OPPROTO op_movl_T0_0(void)
-{
-    T0 = 0;
-}
-
-void OPPROTO op_movl_T0_im(void)
-{
-    T0 = PARAM1;
-}
-
-void OPPROTO op_movl_T0_T1(void)
-{
-    T0 = T1;
-}
-
-void OPPROTO op_movl_T1_im(void)
-{
-    T1 = PARAM1;
-}
-
-void OPPROTO op_mov_CF_T1(void)
-{
-    env->CF = ((uint32_t)T1) >> 31;
-}
-
-void OPPROTO op_movl_T2_im(void)
-{
-    T2 = PARAM1;
-}
-
-void OPPROTO op_addl_T1_im(void)
-{
-    T1 += PARAM1;
-}
-
-void OPPROTO op_addl_T1_T2(void)
-{
-    T1 += T2;
-}
-
-void OPPROTO op_subl_T1_T2(void)
-{
-    T1 -= T2;
-}
-
-void OPPROTO op_addl_T0_T1(void)
-{
-    T0 += T1;
-}
-
-void OPPROTO op_addl_T0_T1_cc(void)
-{
-    unsigned int src1;
-    src1 = T0;
-    T0 += T1;
-    env->NZF = T0;
-    env->CF = T0 < src1;
-    env->VF = (src1 ^ T1 ^ -1) & (src1 ^ T0);
-}
-
-void OPPROTO op_adcl_T0_T1(void)
-{
-    T0 += T1 + env->CF;
-}
-
-void OPPROTO op_adcl_T0_T1_cc(void)
-{
-    unsigned int src1;
-    src1 = T0;
-    if (!env->CF) {
-        T0 += T1;
-        env->CF = T0 < src1;
-    } else {
-        T0 += T1 + 1;
-        env->CF = T0 <= src1;
-    }
-    env->VF = (src1 ^ T1 ^ -1) & (src1 ^ T0);
-    env->NZF = T0;
-    FORCE_RET();
-}
-
-#define OPSUB(sub, sbc, res, T0, T1)            \
-                                                \
-void OPPROTO op_ ## sub ## l_T0_T1(void)        \
-{                                               \
-    res = T0 - T1;                              \
-}                                               \
-                                                \
-void OPPROTO op_ ## sub ## l_T0_T1_cc(void)     \
-{                                               \
-    unsigned int src1;                          \
-    src1 = T0;                                  \
-    T0 -= T1;                                   \
-    env->NZF = T0;                              \
-    env->CF = src1 >= T1;                       \
-    env->VF = (src1 ^ T1) & (src1 ^ T0);        \
-    res = T0;                                   \
-}                                               \
-                                                \
-void OPPROTO op_ ## sbc ## l_T0_T1(void)        \
-{                                               \
-    res = T0 - T1 + env->CF - 1;                \
-}                                               \
-                                                \
-void OPPROTO op_ ## sbc ## l_T0_T1_cc(void)     \
-{                                               \
-    unsigned int src1;                          \
-    src1 = T0;                                  \
-    if (!env->CF) {                             \
-        T0 = T0 - T1 - 1;                       \
-        env->CF = src1 > T1;                    \
-    } else {                                    \
-        T0 = T0 - T1;                           \
-        env->CF = src1 >= T1;                   \
-    }                                           \
-    env->VF = (src1 ^ T1) & (src1 ^ T0);        \
-    env->NZF = T0;                              \
-    res = T0;                                   \
-    FORCE_RET();                                \
-}
-
-OPSUB(sub, sbc, T0, T0, T1)
-
-OPSUB(rsb, rsc, T0, T1, T0)
-
-void OPPROTO op_andl_T0_T1(void)
-{
-    T0 &= T1;
-}
-
-void OPPROTO op_xorl_T0_T1(void)
-{
-    T0 ^= T1;
-}
-
-void OPPROTO op_orl_T0_T1(void)
-{
-    T0 |= T1;
-}
-
-void OPPROTO op_bicl_T0_T1(void)
-{
-    T0 &= ~T1;
-}
-
-void OPPROTO op_notl_T1(void)
-{
-    T1 = ~T1;
-}
-
-void OPPROTO op_logic_T0_cc(void)
-{
-    env->NZF = T0;
-}
-
-void OPPROTO op_logic_T1_cc(void)
-{
-    env->NZF = T1;
-}
-
-#define EIP (env->regs[15])
-
-void OPPROTO op_test_eq(void)
-{
-    if (env->NZF == 0)
-        GOTO_LABEL_PARAM(1);;
-    FORCE_RET();
-}
-
-void OPPROTO op_test_ne(void)
-{
-    if (env->NZF != 0)
-        GOTO_LABEL_PARAM(1);;
-    FORCE_RET();
-}
-
-void OPPROTO op_test_cs(void)
-{
-    if (env->CF != 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_cc(void)
-{
-    if (env->CF == 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_mi(void)
-{
-    if ((env->NZF & 0x80000000) != 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_pl(void)
-{
-    if ((env->NZF & 0x80000000) == 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_vs(void)
-{
-    if ((env->VF & 0x80000000) != 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_vc(void)
-{
-    if ((env->VF & 0x80000000) == 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_hi(void)
-{
-    if (env->CF != 0 && env->NZF != 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_ls(void)
-{
-    if (env->CF == 0 || env->NZF == 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_ge(void)
-{
-    if (((env->VF ^ env->NZF) & 0x80000000) == 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_lt(void)
-{
-    if (((env->VF ^ env->NZF) & 0x80000000) != 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_gt(void)
-{
-    if (env->NZF != 0 && ((env->VF ^ env->NZF) & 0x80000000) == 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_test_le(void)
-{
-    if (env->NZF == 0 || ((env->VF ^ env->NZF) & 0x80000000) != 0)
-        GOTO_LABEL_PARAM(1);
-    FORCE_RET();
-}
-
-void OPPROTO op_goto_tb0(void)
-{
-    GOTO_TB(op_goto_tb0, PARAM1, 0);
-}
-
-void OPPROTO op_goto_tb1(void)
-{
-    GOTO_TB(op_goto_tb1, PARAM1, 1);
-}
-
-void OPPROTO op_exit_tb(void)
-{
-    EXIT_TB();
-}
-
-void OPPROTO op_movl_T0_cpsr(void)
-{
-    T0 = cpsr_read(env);
-    FORCE_RET();
-}
-
-void OPPROTO op_movl_T0_spsr(void)
-{
-    T0 = env->spsr;
-}
-
-void OPPROTO op_movl_spsr_T0(void)
-{
-    uint32_t mask = PARAM1;
-    env->spsr = (env->spsr & ~mask) | (T0 & mask);
-}
-
-void OPPROTO op_movl_cpsr_T0(void)
-{
-    cpsr_write(env, T0, PARAM1);
-    FORCE_RET();
-}
-
-void OPPROTO op_mul_T0_T1(void)
-{
-    T0 = T0 * T1;
-}
-
-/* 64 bit unsigned mul */
-void OPPROTO op_mull_T0_T1(void)
-{
-    uint64_t res;
-    res = (uint64_t)T0 * (uint64_t)T1;
-    T1 = res >> 32;
-    T0 = res;
-}
-
-/* 64 bit signed mul */
-void OPPROTO op_imull_T0_T1(void)
-{
-    uint64_t res;
-    res = (int64_t)((int32_t)T0) * (int64_t)((int32_t)T1);
-    T1 = res >> 32;
-    T0 = res;
-}
-
-/* 48 bit signed mul, top 32 bits */
-void OPPROTO op_imulw_T0_T1(void)
-{
-  uint64_t res;
-  res = (int64_t)((int32_t)T0) * (int64_t)((int32_t)T1);
-  T0 = res >> 16;
-}
-
-void OPPROTO op_addq_T0_T1(void)
-{
-    uint64_t res;
-    res = ((uint64_t)T1 << 32) | T0;
-    res += ((uint64_t)(env->regs[PARAM2]) << 32) | (env->regs[PARAM1]);
-    T1 = res >> 32;
-    T0 = res;
-}
-
-void OPPROTO op_addq_lo_T0_T1(void)
-{
-    uint64_t res;
-    res = ((uint64_t)T1 << 32) | T0;
-    res += (uint64_t)(env->regs[PARAM1]);
-    T1 = res >> 32;
-    T0 = res;
-}
-
-void OPPROTO op_logicq_cc(void)
-{
-    env->NZF = (T1 & 0x80000000) | ((T0 | T1) != 0);
-}
-
-/* memory access */
-
-#define MEMSUFFIX _raw
-#include "op_mem.h"
-
-#if !defined(CONFIG_USER_ONLY)
-#define MEMSUFFIX _user
-#include "op_mem.h"
-#define MEMSUFFIX _kernel
-#include "op_mem.h"
-#endif
-
-/* shifts */
-
-/* T1 based */
-
-void OPPROTO op_shll_T1_im(void)
-{
-    T1 = T1 << PARAM1;
-}
-
-void OPPROTO op_shrl_T1_im(void)
-{
-    T1 = (uint32_t)T1 >> PARAM1;
-}
-
-void OPPROTO op_shrl_T1_0(void)
-{
-    T1 = 0;
-}
-
-void OPPROTO op_sarl_T1_im(void)
-{
-    T1 = (int32_t)T1 >> PARAM1;
-}
-
-void OPPROTO op_sarl_T1_0(void)
-{
-    T1 = (int32_t)T1 >> 31;
-}
-
-void OPPROTO op_rorl_T1_im(void)
-{
-    int shift;
-    shift = PARAM1;
-    T1 = ((uint32_t)T1 >> shift) | (T1 << (32 - shift));
-}
-
-void OPPROTO op_rrxl_T1(void)
-{
-    T1 = ((uint32_t)T1 >> 1) | ((uint32_t)env->CF << 31);
-}
-
-/* T1 based, set C flag */
-void OPPROTO op_shll_T1_im_cc(void)
-{
-    env->CF = (T1 >> (32 - PARAM1)) & 1;
-    T1 = T1 << PARAM1;
-}
-
-void OPPROTO op_shrl_T1_im_cc(void)
-{
-    env->CF = (T1 >> (PARAM1 - 1)) & 1;
-    T1 = (uint32_t)T1 >> PARAM1;
-}
-
-void OPPROTO op_shrl_T1_0_cc(void)
-{
-    env->CF = (T1 >> 31) & 1;
-    T1 = 0;
-}
-
-void OPPROTO op_sarl_T1_im_cc(void)
-{
-    env->CF = (T1 >> (PARAM1 - 1)) & 1;
-    T1 = (int32_t)T1 >> PARAM1;
-}
-
-void OPPROTO op_sarl_T1_0_cc(void)
-{
-    env->CF = (T1 >> 31) & 1;
-    T1 = (int32_t)T1 >> 31;
-}
-
-void OPPROTO op_rorl_T1_im_cc(void)
-{
-    int shift;
-    shift = PARAM1;
-    env->CF = (T1 >> (shift - 1)) & 1;
-    T1 = ((uint32_t)T1 >> shift) | (T1 << (32 - shift));
-}
-
-void OPPROTO op_rrxl_T1_cc(void)
-{
-    uint32_t c;
-    c = T1 & 1;
-    T1 = ((uint32_t)T1 >> 1) | ((uint32_t)env->CF << 31);
-    env->CF = c;
-}
-
-/* T2 based */
-void OPPROTO op_shll_T2_im(void)
-{
-    T2 = T2 << PARAM1;
-}
-
-void OPPROTO op_shrl_T2_im(void)
-{
-    T2 = (uint32_t)T2 >> PARAM1;
-}
-
-void OPPROTO op_shrl_T2_0(void)
-{
-    T2 = 0;
-}
-
-void OPPROTO op_sarl_T2_im(void)
-{
-    T2 = (int32_t)T2 >> PARAM1;
-}
-
-void OPPROTO op_sarl_T2_0(void)
-{
-    T2 = (int32_t)T2 >> 31;
-}
-
-void OPPROTO op_rorl_T2_im(void)
-{
-    int shift;
-    shift = PARAM1;
-    T2 = ((uint32_t)T2 >> shift) | (T2 << (32 - shift));
-}
-
-void OPPROTO op_rrxl_T2(void)
-{
-    T2 = ((uint32_t)T2 >> 1) | ((uint32_t)env->CF << 31);
-}
-
-/* T1 based, use T0 as shift count */
-
-void OPPROTO op_shll_T1_T0(void)
-{
-    int shift;
-    shift = T0 & 0xff;
-    if (shift >= 32)
-        T1 = 0;
-    else
-        T1 = T1 << shift;
-    FORCE_RET();
-}
-
-void OPPROTO op_shrl_T1_T0(void)
-{
-    int shift;
-    shift = T0 & 0xff;
-    if (shift >= 32)
-        T1 = 0;
-    else
-        T1 = (uint32_t)T1 >> shift;
-    FORCE_RET();
-}
-
-void OPPROTO op_sarl_T1_T0(void)
-{
-    int shift;
-    shift = T0 & 0xff;
-    if (shift >= 32)
-        shift = 31;
-    T1 = (int32_t)T1 >> shift;
-}
-
-void OPPROTO op_rorl_T1_T0(void)
-{
-    int shift;
-    shift = T0 & 0x1f;
-    if (shift) {
-        T1 = ((uint32_t)T1 >> shift) | (T1 << (32 - shift));
-    }
-    FORCE_RET();
-}
-
-/* T1 based, use T0 as shift count and compute CF */
-
-void OPPROTO op_shll_T1_T0_cc(void)
-{
-    int shift;
-    shift = T0 & 0xff;
-    if (shift >= 32) {
-        if (shift == 32)
-            env->CF = T1 & 1;
-        else
-            env->CF = 0;
-        T1 = 0;
-    } else if (shift != 0) {
-        env->CF = (T1 >> (32 - shift)) & 1;
-        T1 = T1 << shift;
-    }
-    FORCE_RET();
-}
-
-void OPPROTO op_shrl_T1_T0_cc(void)
-{
-    int shift;
-    shift = T0 & 0xff;
-    if (shift >= 32) {
-        if (shift == 32)
-            env->CF = (T1 >> 31) & 1;
-        else
-            env->CF = 0;
-        T1 = 0;
-    } else if (shift != 0) {
-        env->CF = (T1 >> (shift - 1)) & 1;
-        T1 = (uint32_t)T1 >> shift;
-    }
-    FORCE_RET();
-}
-
-void OPPROTO op_sarl_T1_T0_cc(void)
-{
-    int shift;
-    shift = T0 & 0xff;
-    if (shift >= 32) {
-        env->CF = (T1 >> 31) & 1;
-        T1 = (int32_t)T1 >> 31;
-    } else {
-        env->CF = (T1 >> (shift - 1)) & 1;
-        T1 = (int32_t)T1 >> shift;
-    }
-    FORCE_RET();
-}
-
-void OPPROTO op_rorl_T1_T0_cc(void)
-{
-    int shift1, shift;
-    shift1 = T0 & 0xff;
-    shift = shift1 & 0x1f;
-    if (shift == 0) {
-        if (shift1 != 0)
-            env->CF = (T1 >> 31) & 1;
-    } else {
-        env->CF = (T1 >> (shift - 1)) & 1;
-        T1 = ((uint32_t)T1 >> shift) | (T1 << (32 - shift));
-    }
-    FORCE_RET();
-}
-
-/* misc */
-void OPPROTO op_clz_T0(void)
-{
-    int count;
-    for (count = 32; T0 > 0; count--)
-        T0 = T0 >> 1;
-    T0 = count;
-    FORCE_RET();
-}
-
-void OPPROTO op_sarl_T0_im(void)
-{
-    T0 = (int32_t)T0 >> PARAM1;
-}
-
-/* Sign/zero extend */
-void OPPROTO op_sxth_T0(void)
-{
-  T0 = (int16_t)T0;
-}
-
-void OPPROTO op_sxth_T1(void)
-{
-  T1 = (int16_t)T1;
-}
-
-void OPPROTO op_sxtb_T1(void)
-{
-    T1 = (int8_t)T1;
-}
-
-void OPPROTO op_uxtb_T1(void)
-{
-    T1 = (uint8_t)T1;
-}
-
-void OPPROTO op_uxth_T1(void)
-{
-    T1 = (uint16_t)T1;
-}
-
-void OPPROTO op_sxtb16_T1(void)
-{
-    uint32_t res;
-    res = (uint16_t)(int8_t)T1;
-    res |= (uint32_t)(int8_t)(T1 >> 16) << 16;
-    T1 = res;
-}
-
-void OPPROTO op_uxtb16_T1(void)
-{
-    uint32_t res;
-    res = (uint16_t)(uint8_t)T1;
-    res |= (uint32_t)(uint8_t)(T1 >> 16) << 16;
-    T1 = res;
-}
-
-#define SIGNBIT (uint32_t)0x80000000
-/* saturating arithmetic  */
-void OPPROTO op_addl_T0_T1_setq(void)
-{
-  uint32_t res;
-
-  res = T0 + T1;
-  if (((res ^ T0) & SIGNBIT) && !((T0 ^ T1) & SIGNBIT))
-      env->QF = 1;
-
-  T0 = res;
-  FORCE_RET();
-}
-
-void OPPROTO op_addl_T0_T1_saturate(void)
-{
-  uint32_t res;
-
-  res = T0 + T1;
-  if (((res ^ T0) & SIGNBIT) && !((T0 ^ T1) & SIGNBIT)) {
-      env->QF = 1;
-      if (T0 & SIGNBIT)
-          T0 = 0x80000000;
-      else
-          T0 = 0x7fffffff;
-  }
-  else
-    T0 = res;
-  
-  FORCE_RET();
-}
-
-void OPPROTO op_subl_T0_T1_saturate(void)
-{
-  uint32_t res;
-
-  res = T0 - T1;
-  if (((res ^ T0) & SIGNBIT) && ((T0 ^ T1) & SIGNBIT)) {
-      env->QF = 1;
-      if (T0 & SIGNBIT)
-          T0 = 0x80000000;
-      else
-          T0 = 0x7fffffff;
-  }
-  else
-    T0 = res;
-  
-  FORCE_RET();
-}
-
-void OPPROTO op_double_T1_saturate(void)
-{
-  int32_t val;
-
-  val = T1;
-  if (val >= 0x40000000) {
-      T1 = 0x7fffffff;
-      env->QF = 1;
-  } else if (val <= (int32_t)0xc0000000) {
-      T1 = 0x80000000;
-      env->QF = 1;
-  } else {
-      T1 = val << 1;
-  }
-  FORCE_RET();
-}
-
-/* thumb shift by immediate */
-void OPPROTO op_shll_T0_im_thumb(void)
-{
-    int shift;
-    shift = PARAM1;
-    if (shift != 0) {
-	env->CF = (T1 >> (32 - shift)) & 1;
-	T0 = T0 << shift;
-    }
-    env->NZF = T0;
-    FORCE_RET();
-}
-
-void OPPROTO op_shrl_T0_im_thumb(void)
-{
-    int shift;
-
-    shift = PARAM1;
-    if (shift == 0) {
-	env->CF = ((uint32_t)shift) >> 31;
-	T0 = 0;
-    } else {
-	env->CF = (T0 >> (shift - 1)) & 1;
-	T0 = T0 >> shift;
-    }
-    env->NZF = T0;
-    FORCE_RET();
-}
-
-void OPPROTO op_sarl_T0_im_thumb(void)
-{
-    int shift;
-
-    shift = PARAM1;
-    if (shift == 0) {
-	T0 = ((int32_t)T0) >> 31;
-	env->CF = T0 & 1;
-    } else {
-	env->CF = (T0 >> (shift - 1)) & 1;
-	T0 = ((int32_t)T0) >> shift;
-    }
-    env->NZF = T0;
-    FORCE_RET();
-}
-
-/* exceptions */
-
-void OPPROTO op_swi(void)
-{
-    env->exception_index = EXCP_SWI;
-    cpu_loop_exit();
-}
-
-void OPPROTO op_undef_insn(void)
-{
-    env->exception_index = EXCP_UDEF;
-    cpu_loop_exit();
-}
-
-void OPPROTO op_debug(void)
-{
-    env->exception_index = EXCP_DEBUG;
-    cpu_loop_exit();
-}
-
-void OPPROTO op_wfi(void)
-{
-    env->exception_index = EXCP_HLT;
-    env->halted = 1;
-    cpu_loop_exit();
-}
-
-void OPPROTO op_bkpt(void)
-{
-    env->exception_index = EXCP_BKPT;
-    cpu_loop_exit();
-}
-
-/* VFP support.  We follow the convention used for VFP instrunctions:
-   Single precition routines have a "s" suffix, double precision a
-   "d" suffix.  */
-
-#define VFP_OP(name, p) void OPPROTO op_vfp_##name##p(void)
-
-#define VFP_BINOP(name) \
-VFP_OP(name, s)             \
-{                           \
-    FT0s = float32_ ## name (FT0s, FT1s, &env->vfp.fp_status);    \
-}                           \
-VFP_OP(name, d)             \
-{                           \
-    FT0d = float64_ ## name (FT0d, FT1d, &env->vfp.fp_status);    \
-}
-VFP_BINOP(add)
-VFP_BINOP(sub)
-VFP_BINOP(mul)
-VFP_BINOP(div)
-#undef VFP_BINOP
-
-#define VFP_HELPER(name)  \
-VFP_OP(name, s)           \
-{                         \
-    do_vfp_##name##s();    \
-}                         \
-VFP_OP(name, d)           \
-{                         \
-    do_vfp_##name##d();    \
-}
-VFP_HELPER(abs)
-VFP_HELPER(sqrt)
-VFP_HELPER(cmp)
-VFP_HELPER(cmpe)
-#undef VFP_HELPER
-
-/* XXX: Will this do the right thing for NANs.  Should invert the signbit
-   without looking at the rest of the value.  */
-VFP_OP(neg, s)
-{
-    FT0s = float32_chs(FT0s);
-}
-
-VFP_OP(neg, d)
-{
-    FT0d = float64_chs(FT0d);
-}
-
-VFP_OP(F1_ld0, s)
-{
-    union {
-        uint32_t i;
-        float32 s;
-    } v;
-    v.i = 0;
-    FT1s = v.s;
-}
-
-VFP_OP(F1_ld0, d)
-{
-    union {
-        uint64_t i;
-        float64 d;
-    } v;
-    v.i = 0;
-    FT1d = v.d;
-}
-
-/* Helper routines to perform bitwise copies between float and int.  */
-static inline float32 vfp_itos(uint32_t i)
-{
-    union {
-        uint32_t i;
-        float32 s;
-    } v;
-
-    v.i = i;
-    return v.s;
-}
-
-static inline uint32_t vfp_stoi(float32 s)
-{
-    union {
-        uint32_t i;
-        float32 s;
-    } v;
-
-    v.s = s;
-    return v.i;
-}
-
-/* Integer to float conversion.  */
-VFP_OP(uito, s)
-{
-    FT0s = uint32_to_float32(vfp_stoi(FT0s), &env->vfp.fp_status);
-}
-
-VFP_OP(uito, d)
-{
-    FT0d = uint32_to_float64(vfp_stoi(FT0s), &env->vfp.fp_status);
-}
-
-VFP_OP(sito, s)
-{
-    FT0s = int32_to_float32(vfp_stoi(FT0s), &env->vfp.fp_status);
-}
-
-VFP_OP(sito, d)
-{
-    FT0d = int32_to_float64(vfp_stoi(FT0s), &env->vfp.fp_status);
-}
-
-/* Float to integer conversion.  */
-VFP_OP(toui, s)
-{
-    FT0s = vfp_itos(float32_to_uint32(FT0s, &env->vfp.fp_status));
-}
-
-VFP_OP(toui, d)
-{
-    FT0s = vfp_itos(float64_to_uint32(FT0d, &env->vfp.fp_status));
-}
-
-VFP_OP(tosi, s)
-{
-    FT0s = vfp_itos(float32_to_int32(FT0s, &env->vfp.fp_status));
-}
-
-VFP_OP(tosi, d)
-{
-    FT0s = vfp_itos(float64_to_int32(FT0d, &env->vfp.fp_status));
-}
-
-/* TODO: Set rounding mode properly.  */
-VFP_OP(touiz, s)
-{
-    FT0s = vfp_itos(float32_to_uint32_round_to_zero(FT0s, &env->vfp.fp_status));
-}
-
-VFP_OP(touiz, d)
-{
-    FT0s = vfp_itos(float64_to_uint32_round_to_zero(FT0d, &env->vfp.fp_status));
-}
-
-VFP_OP(tosiz, s)
-{
-    FT0s = vfp_itos(float32_to_int32_round_to_zero(FT0s, &env->vfp.fp_status));
-}
-
-VFP_OP(tosiz, d)
-{
-    FT0s = vfp_itos(float64_to_int32_round_to_zero(FT0d, &env->vfp.fp_status));
-}
-
-/* floating point conversion */
-VFP_OP(fcvtd, s)
-{
-    FT0d = float32_to_float64(FT0s, &env->vfp.fp_status);
-}
-
-VFP_OP(fcvts, d)
-{
-    FT0s = float64_to_float32(FT0d, &env->vfp.fp_status);
-}
-
-/* Get and Put values from registers.  */
-VFP_OP(getreg_F0, d)
-{
-  FT0d = *(float64 *)((char *) env + PARAM1);
-}
-
-VFP_OP(getreg_F0, s)
-{
-  FT0s = *(float32 *)((char *) env + PARAM1);
-}
-
-VFP_OP(getreg_F1, d)
-{
-  FT1d = *(float64 *)((char *) env + PARAM1);
-}
-
-VFP_OP(getreg_F1, s)
-{
-  FT1s = *(float32 *)((char *) env + PARAM1);
-}
-
-VFP_OP(setreg_F0, d)
-{
-  *(float64 *)((char *) env + PARAM1) = FT0d;
-}
-
-VFP_OP(setreg_F0, s)
-{
-  *(float32 *)((char *) env + PARAM1) = FT0s;
-}
-
-void OPPROTO op_vfp_movl_T0_fpscr(void)
-{
-    do_vfp_get_fpscr ();
-}
-
-void OPPROTO op_vfp_movl_T0_fpscr_flags(void)
-{
-    T0 = env->vfp.xregs[ARM_VFP_FPSCR] & (0xf << 28);
-}
-
-void OPPROTO op_vfp_movl_fpscr_T0(void)
-{
-    do_vfp_set_fpscr();
-}
-
-void OPPROTO op_vfp_movl_T0_xreg(void)
-{
-    T0 = env->vfp.xregs[PARAM1];
-}
-
-void OPPROTO op_vfp_movl_xreg_T0(void)
-{
-    env->vfp.xregs[PARAM1] = T0;
-}
-
-/* Move between FT0s to T0  */
-void OPPROTO op_vfp_mrs(void)
-{
-    T0 = vfp_stoi(FT0s);
-}
-
-void OPPROTO op_vfp_msr(void)
-{
-    FT0s = vfp_itos(T0);
-}
-
-/* Move between FT0d and {T0,T1} */
-void OPPROTO op_vfp_mrrd(void)
-{
-    CPU_DoubleU u;
-    
-    u.d = FT0d;
-    T0 = u.l.lower;
-    T1 = u.l.upper;
-}
-
-void OPPROTO op_vfp_mdrr(void)
-{
-    CPU_DoubleU u;
-    
-    u.l.lower = T0;
-    u.l.upper = T1;
-    FT0d = u.d;
-}
-
-/* Copy the most significant bit to T0 to all bits of T1.  */
-void OPPROTO op_signbit_T1_T0(void)
-{
-    T1 = (int32_t)T0 >> 31;
-}
-
-void OPPROTO op_movl_cp15_T0(void)
-{
-    helper_set_cp15(env, PARAM1, T0);
-    FORCE_RET();
-}
-
-void OPPROTO op_movl_T0_cp15(void)
-{
-    T0 = helper_get_cp15(env, PARAM1);
-    FORCE_RET();
-}
-
-/* Access to user mode registers from privileged modes.  */
-void OPPROTO op_movl_T0_user(void)
-{
-    int regno = PARAM1;
-    if (regno == 13) {
-        T0 = env->banked_r13[0];
-    } else if (regno == 14) {
-        T0 = env->banked_r14[0];
-    } else if ((env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
-        T0 = env->usr_regs[regno - 8];
-    } else {
-        T0 = env->regs[regno];
-    }
-    FORCE_RET();
-}
-
-
-void OPPROTO op_movl_user_T0(void)
-{
-    int regno = PARAM1;
-    if (regno == 13) {
-        env->banked_r13[0] = T0;
-    } else if (regno == 14) {
-        env->banked_r14[0] = T0;
-    } else if ((env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
-        env->usr_regs[regno - 8] = T0;
-    } else {
-        env->regs[regno] = T0;
-    }
-    FORCE_RET();
-}
-
-void OPPROTO op_movl_T2_T0(void)
-{
-    T2 = T0;
-}
-
-void OPPROTO op_movl_T0_T2(void)
-{
-    T0 = T2;
-}
diff --git a/target-arm/op_addsub.h b/target-arm/op_addsub.h
new file mode 100644
index 0000000..376ee27
--- /dev/null
+++ b/target-arm/op_addsub.h
@@ -0,0 +1,103 @@
+/*
+ * ARMv6 integer SIMD operations.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#ifdef ARITH_GE
+#define GE_ARG , uint32_t *gep
+#define DECLARE_GE uint32_t ge = 0
+#define SET_GE *gep = ge
+#else
+#define GE_ARG
+#define DECLARE_GE do{}while(0)
+#define SET_GE do{}while(0)
+#endif
+
+#define RESULT(val, n, width) \
+    res |= ((uint32_t)(glue(glue(uint,width),_t))(val)) << (n * width)
+
+uint32_t HELPER(glue(PFX,add16))(uint32_t a, uint32_t b GE_ARG)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    ADD16(a, b, 0);
+    ADD16(a >> 16, b >> 16, 1);
+    SET_GE;
+    return res;
+}
+
+uint32_t HELPER(glue(PFX,add8))(uint32_t a, uint32_t b GE_ARG)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    ADD8(a, b, 0);
+    ADD8(a >> 8, b >> 8, 1);
+    ADD8(a >> 16, b >> 16, 2);
+    ADD8(a >> 24, b >> 24, 3);
+    SET_GE;
+    return res;
+}
+
+uint32_t HELPER(glue(PFX,sub16))(uint32_t a, uint32_t b GE_ARG)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    SUB16(a, b, 0);
+    SUB16(a >> 16, b >> 16, 1);
+    SET_GE;
+    return res;
+}
+
+uint32_t HELPER(glue(PFX,sub8))(uint32_t a, uint32_t b GE_ARG)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    SUB8(a, b, 0);
+    SUB8(a >> 8, b >> 8, 1);
+    SUB8(a >> 16, b >> 16, 2);
+    SUB8(a >> 24, b >> 24, 3);
+    SET_GE;
+    return res;
+}
+
+uint32_t HELPER(glue(PFX,subaddx))(uint32_t a, uint32_t b GE_ARG)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    ADD16(a, b, 0);
+    SUB16(a >> 16, b >> 16, 1);
+    SET_GE;
+    return res;
+}
+
+uint32_t HELPER(glue(PFX,addsubx))(uint32_t a, uint32_t b GE_ARG)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    SUB16(a, b, 0);
+    ADD16(a >> 16, b >> 16, 1);
+    SET_GE;
+    return res;
+}
+
+#undef GE_ARG
+#undef DECLARE_GE
+#undef SET_GE
+#undef RESULT
+
+#undef ARITH_GE
+#undef PFX
+#undef ADD16
+#undef SUB16
+#undef ADD8
+#undef SUB8
diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
index acc83ba..36de55b 100644
--- a/target-arm/op_helper.c
+++ b/target-arm/op_helper.c
@@ -1,7 +1,7 @@
 /*
  *  ARM helper routines
- * 
- *  Copyright (c) 2005 CodeSourcery, LLC
+ *
+ *  Copyright (c) 2005-2007 CodeSourcery, LLC
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -18,6 +18,10 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 #include "exec.h"
+#include "helpers.h"
+
+#define SIGNBIT (uint32_t)0x80000000
+#define SIGNBIT64 ((uint64_t)1 << 63)
 
 void raise_exception(int tt)
 {
@@ -39,140 +43,26 @@ void cpu_unlock(void)
     spin_unlock(&global_cpu_lock);
 }
 
-/* VFP support.  */
-
-void do_vfp_abss(void)
-{
-    FT0s = float32_abs(FT0s);
-}
-
-void do_vfp_absd(void)
+uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def,
+                          uint32_t rn, uint32_t maxindex)
 {
-    FT0d = float64_abs(FT0d);
-}
-
-void do_vfp_sqrts(void)
-{
-    FT0s = float32_sqrt(FT0s, &env->vfp.fp_status);
-}
-
-void do_vfp_sqrtd(void)
-{
-    FT0d = float64_sqrt(FT0d, &env->vfp.fp_status);
-}
-
-/* XXX: check quiet/signaling case */
-#define DO_VFP_cmp(p, size)               \
-void do_vfp_cmp##p(void)                  \
-{                                         \
-    uint32_t flags;                       \
-    switch(float ## size ## _compare_quiet(FT0##p, FT1##p, &env->vfp.fp_status)) {\
-    case 0: flags = 0x6; break;\
-    case -1: flags = 0x8; break;\
-    case 1: flags = 0x2; break;\
-    default: case 2: flags = 0x3; break;\
-    }\
-    env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28)\
-        | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
-    FORCE_RET();                          \
-}\
-\
-void do_vfp_cmpe##p(void)                   \
-{                                           \
-    uint32_t flags;                       \
-    switch(float ## size ## _compare(FT0##p, FT1##p, &env->vfp.fp_status)) {\
-    case 0: flags = 0x6; break;\
-    case -1: flags = 0x8; break;\
-    case 1: flags = 0x2; break;\
-    default: case 2: flags = 0x3; break;\
-    }\
-    env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28)\
-        | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
-    FORCE_RET();                          \
-}
-DO_VFP_cmp(s, 32)
-DO_VFP_cmp(d, 64)
-#undef DO_VFP_cmp
-
-/* Convert host exception flags to vfp form.  */
-static inline int vfp_exceptbits_from_host(int host_bits)
-{
-    int target_bits = 0;
-
-    if (host_bits & float_flag_invalid)
-        target_bits |= 1;
-    if (host_bits & float_flag_divbyzero)
-        target_bits |= 2;
-    if (host_bits & float_flag_overflow)
-        target_bits |= 4;
-    if (host_bits & float_flag_underflow)
-        target_bits |= 8;
-    if (host_bits & float_flag_inexact)
-        target_bits |= 0x10;
-    return target_bits;
-}
-
-/* Convert vfp exception flags to target form.  */
-static inline int vfp_exceptbits_to_host(int target_bits)
-{
-    int host_bits = 0;
-
-    if (target_bits & 1)
-        host_bits |= float_flag_invalid;
-    if (target_bits & 2)
-        host_bits |= float_flag_divbyzero;
-    if (target_bits & 4)
-        host_bits |= float_flag_overflow;
-    if (target_bits & 8)
-        host_bits |= float_flag_underflow;
-    if (target_bits & 0x10)
-        host_bits |= float_flag_inexact;
-    return host_bits;
-}
-
-void do_vfp_set_fpscr(void)
-{
-    int i;
-    uint32_t changed;
-
-    changed = env->vfp.xregs[ARM_VFP_FPSCR];
-    env->vfp.xregs[ARM_VFP_FPSCR] = (T0 & 0xffc8ffff);
-    env->vfp.vec_len = (T0 >> 16) & 7;
-    env->vfp.vec_stride = (T0 >> 20) & 3;
-
-    changed ^= T0;
-    if (changed & (3 << 22)) {
-        i = (T0 >> 22) & 3;
-        switch (i) {
-        case 0:
-            i = float_round_nearest_even;
-            break;
-        case 1:
-            i = float_round_up;
-            break;
-        case 2:
-            i = float_round_down;
-            break;
-        case 3:
-            i = float_round_to_zero;
-            break;
+    uint32_t val;
+    uint32_t tmp;
+    int index;
+    int shift;
+    uint64_t *table;
+    table = (uint64_t *)&env->vfp.regs[rn];
+    val = 0;
+    for (shift = 0; shift < 32; shift += 8) {
+        index = (ireg >> shift) & 0xff;
+        if (index < maxindex) {
+            tmp = (table[index >> 3] >> (index & 7)) & 0xff;
+            val |= tmp << shift;
+        } else {
+            val |= def & (0xff << shift);
         }
-        set_float_rounding_mode(i, &env->vfp.fp_status);
     }
-
-    i = vfp_exceptbits_to_host((T0 >> 8) & 0x1f);
-    set_float_exception_flags(i, &env->vfp.fp_status);
-    /* XXX: FZ and DN are not implemented.  */
-}
-
-void do_vfp_get_fpscr(void)
-{
-    int i;
-
-    T0 = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff) | (env->vfp.vec_len << 16)
-          | (env->vfp.vec_stride << 20);
-    i = get_float_exception_flags(&env->vfp.fp_status);
-    T0 |= vfp_exceptbits_from_host(i);
+    return val;
 }
 
 #if !defined(CONFIG_USER_ONLY)
@@ -180,7 +70,6 @@ void do_vfp_get_fpscr(void)
 static void do_unaligned_access (target_ulong addr, int is_write, int is_user, void *retaddr);
 
 #define MMUSUFFIX _mmu
-#define GETPC() (__builtin_return_address(0))
 #define ALIGNED_ONLY  1
 
 #define SHIFT 0
@@ -195,10 +84,10 @@ static void do_unaligned_access (target_ulong addr, int is_write, int is_user, v
 #define SHIFT 3
 #include "softmmu_template.h"
 
-static void do_unaligned_access (target_ulong addr, int is_write, int is_user, void *retaddr)
+static void do_unaligned_access (target_ulong addr, int is_write, int mmu_idx, void *retaddr)
 {
     //printf("::UNALIGNED:: addr=%lx is_write=%d is_user=%d retaddr=%p\n", addr, is_write, is_user, retaddr);
-    if (is_user)
+    if (mmu_idx)
     {
         env = cpu_single_env;
         env->cp15.c5_data = 0x00000001;  /* corresponds to an alignment fault */
@@ -212,22 +101,22 @@ static void do_unaligned_access (target_ulong addr, int is_write, int is_user, v
    NULL, it means that the function was called in C code (i.e. not
    from generated code or from helper.c) */
 /* XXX: fix it to restore all registers */
-void tlb_fill (target_ulong addr, int is_write, int is_user, void *retaddr)
+void tlb_fill (target_ulong addr, int is_write, int mmu_idx, void *retaddr)
 {
     TranslationBlock *tb;
     CPUState *saved_env;
-    target_phys_addr_t pc;
+    unsigned long pc;
     int ret;
 
     /* XXX: hack to restore env in all cases, even if not called from
        generated code */
     saved_env = env;
     env = cpu_single_env;
-    ret = cpu_arm_handle_mmu_fault(env, addr, is_write, is_user, 1);
-    if (__builtin_expect(ret, 0)) {
+    ret = cpu_arm_handle_mmu_fault(env, addr, is_write, mmu_idx, 1);
+    if (unlikely(ret)) {
         if (retaddr) {
             /* now we have a real cpu fault */
-            pc = (target_phys_addr_t)retaddr;
+            pc = (unsigned long)retaddr;
             tb = tb_find_pc(pc);
             if (tb) {
                 /* the PC is inside the translated code. It means that we have
@@ -246,7 +135,7 @@ void tlb_fill (target_ulong addr, int is_write, int is_user, void *retaddr)
  * The following functions are address translation helper functions 
  * for fast memory access in QEMU. 
  */
-static unsigned long v2p_mmu(target_ulong addr, int is_user)
+static target_phys_addr_t v2p_mmu(target_ulong addr, int mmu_idx)
 {
     int index;
     target_ulong tlb_addr;
@@ -255,13 +144,13 @@ static unsigned long v2p_mmu(target_ulong addr, int is_user)
 
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
 redo:
-    tlb_addr = env->tlb_table[is_user][index].addr_read;
+    tlb_addr = env->tlb_table[mmu_idx][index].addr_read;
     if ((addr & TARGET_PAGE_MASK) == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = addr + env->tlb_table[mmu_idx][index].addend;
     } else {
         /* the page is not in the TLB : fill it */
         retaddr = GETPC();
-        tlb_fill(addr, 0, is_user, retaddr);
+        tlb_fill(addr, 0, mmu_idx, retaddr);
         goto redo;
     }
     return physaddr;
@@ -272,22 +161,23 @@ redo:
  * to the address of simulation host (not the physical 
  * address of simulated OS.
  */
-unsigned long v2p(target_ulong ptr, int is_user)
+target_phys_addr_t v2p(target_ulong ptr, int mmu_idx)
 {
     CPUState *saved_env;
     int index;
     target_ulong addr;
-    unsigned long physaddr;
+    target_phys_addr_t physaddr;
 
     saved_env = env;
     env = cpu_single_env;
     addr = ptr;
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    if (__builtin_expect(env->tlb_table[is_user][index].addr_read != 
-                (addr & TARGET_PAGE_MASK), 0)) {
-        return v2p_mmu(addr, is_user);
+    if (__builtin_expect(env->tlb_table[mmu_idx][index].addr_read != 
+                (addr & TARGET_PAGE_MASK), 0)) 
+    {
+        physaddr = v2p_mmu(addr, mmu_idx);
     } else {
-        physaddr = addr + env->tlb_table[is_user][index].addend;
+        physaddr = (target_phys_addr_t)addr + env->tlb_table[mmu_idx][index].addend;
     }
     env = saved_env;
     return physaddr;
@@ -311,7 +201,7 @@ void vmemcpy(target_ulong ptr, char *buf, int size)
 }
 
 /* copy memory from the QEMU buffer to simulated virtual space */
-void pmemcpy(target_ulong ptr, char *buf, int size)
+void pmemcpy(target_ulong ptr, const char *buf, int size)
 {
     if (buf == NULL) return;
     while (size) {
@@ -349,5 +239,450 @@ void vstrcpy(target_ulong ptr, char *buf, int max)
     }
 }
 #endif
-
 #endif
+
+/* FIXME: Pass an axplicit pointer to QF to CPUState, and move saturating
+   instructions into helper.c  */
+uint32_t HELPER(add_setq)(uint32_t a, uint32_t b)
+{
+    uint32_t res = a + b;
+    if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
+        env->QF = 1;
+    return res;
+}
+
+uint32_t HELPER(add_saturate)(uint32_t a, uint32_t b)
+{
+    uint32_t res = a + b;
+    if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
+        env->QF = 1;
+        res = ~(((int32_t)a >> 31) ^ SIGNBIT);
+    }
+    return res;
+}
+
+uint32_t HELPER(sub_saturate)(uint32_t a, uint32_t b)
+{
+    uint32_t res = a - b;
+    if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
+        env->QF = 1;
+        res = ~(((int32_t)a >> 31) ^ SIGNBIT);
+    }
+    return res;
+}
+
+uint32_t HELPER(double_saturate)(int32_t val)
+{
+    uint32_t res;
+    if (val >= 0x40000000) {
+        res = ~SIGNBIT;
+        env->QF = 1;
+    } else if (val <= (int32_t)0xc0000000) {
+        res = SIGNBIT;
+        env->QF = 1;
+    } else {
+        res = val << 1;
+    }
+    return res;
+}
+
+uint32_t HELPER(add_usaturate)(uint32_t a, uint32_t b)
+{
+    uint32_t res = a + b;
+    if (res < a) {
+        env->QF = 1;
+        res = ~0;
+    }
+    return res;
+}
+
+uint32_t HELPER(sub_usaturate)(uint32_t a, uint32_t b)
+{
+    uint32_t res = a - b;
+    if (res > a) {
+        env->QF = 1;
+        res = 0;
+    }
+    return res;
+}
+
+/* Signed saturation.  */
+static inline uint32_t do_ssat(int32_t val, int shift)
+{
+    int32_t top;
+    uint32_t mask;
+
+    top = val >> shift;
+    mask = (1u << shift) - 1;
+    if (top > 0) {
+        env->QF = 1;
+        return mask;
+    } else if (top < -1) {
+        env->QF = 1;
+        return ~mask;
+    }
+    return val;
+}
+
+/* Unsigned saturation.  */
+static inline uint32_t do_usat(int32_t val, int shift)
+{
+    uint32_t max;
+
+    max = (1u << shift) - 1;
+    if (val < 0) {
+        env->QF = 1;
+        return 0;
+    } else if (val > max) {
+        env->QF = 1;
+        return max;
+    }
+    return val;
+}
+
+/* Signed saturate.  */
+uint32_t HELPER(ssat)(uint32_t x, uint32_t shift)
+{
+    return do_ssat(x, shift);
+}
+
+/* Dual halfword signed saturate.  */
+uint32_t HELPER(ssat16)(uint32_t x, uint32_t shift)
+{
+    uint32_t res;
+
+    res = (uint16_t)do_ssat((int16_t)x, shift);
+    res |= do_ssat(((int32_t)x) >> 16, shift) << 16;
+    return res;
+}
+
+/* Unsigned saturate.  */
+uint32_t HELPER(usat)(uint32_t x, uint32_t shift)
+{
+    return do_usat(x, shift);
+}
+
+/* Dual halfword unsigned saturate.  */
+uint32_t HELPER(usat16)(uint32_t x, uint32_t shift)
+{
+    uint32_t res;
+
+    res = (uint16_t)do_usat((int16_t)x, shift);
+    res |= do_usat(((int32_t)x) >> 16, shift) << 16;
+    return res;
+}
+
+void HELPER(wfi)(void)
+{
+    env->exception_index = EXCP_HLT;
+    env->halted = 1;
+    cpu_loop_exit();
+}
+
+void HELPER(exception)(uint32_t excp)
+{
+    env->exception_index = excp;
+    cpu_loop_exit();
+}
+
+uint32_t HELPER(cpsr_read)(void)
+{
+    return cpsr_read(env) & ~CPSR_EXEC;
+}
+
+void HELPER(cpsr_write)(uint32_t val, uint32_t mask)
+{
+    cpsr_write(env, val, mask);
+}
+
+/* Access to user mode registers from privileged modes.  */
+uint32_t HELPER(get_user_reg)(uint32_t regno)
+{
+    uint32_t val;
+
+    if (regno == 13) {
+        val = env->banked_r13[0];
+    } else if (regno == 14) {
+        val = env->banked_r14[0];
+    } else if (regno >= 8
+               && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
+        val = env->usr_regs[regno - 8];
+    } else {
+        val = env->regs[regno];
+    }
+    return val;
+}
+
+void HELPER(set_user_reg)(uint32_t regno, uint32_t val)
+{
+    if (regno == 13) {
+        env->banked_r13[0] = val;
+    } else if (regno == 14) {
+        env->banked_r14[0] = val;
+    } else if (regno >= 8
+               && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
+        env->usr_regs[regno - 8] = val;
+    } else {
+        env->regs[regno] = val;
+    }
+}
+
+/* ??? Flag setting arithmetic is awkward because we need to do comparisons.
+   The only way to do that in TCG is a conditional branch, which clobbers
+   all our temporaries.  For now implement these as helper functions.  */
+
+uint32_t HELPER (add_cc)(uint32_t a, uint32_t b)
+{
+    uint32_t result;
+    result = T0 + T1;
+    env->NF = env->ZF = result;
+    env->CF = result < a;
+    env->VF = (a ^ b ^ -1) & (a ^ result);
+    return result;
+}
+
+uint32_t HELPER(adc_cc)(uint32_t a, uint32_t b)
+{
+    uint32_t result;
+    if (!env->CF) {
+        result = a + b;
+        env->CF = result < a;
+    } else {
+        result = a + b + 1;
+        env->CF = result <= a;
+    }
+    env->VF = (a ^ b ^ -1) & (a ^ result);
+    env->NF = env->ZF = result;
+    return result;
+}
+
+uint32_t HELPER(sub_cc)(uint32_t a, uint32_t b)
+{
+    uint32_t result;
+    result = a - b;
+    env->NF = env->ZF = result;
+    env->CF = a >= b;
+    env->VF = (a ^ b) & (a ^ result);
+    return result;
+}
+
+uint32_t HELPER(sbc_cc)(uint32_t a, uint32_t b)
+{
+    uint32_t result;
+    if (!env->CF) {
+        result = a - b - 1;
+        env->CF = a > b;
+    } else {
+        result = a - b;
+        env->CF = a >= b;
+    }
+    env->VF = (a ^ b) & (a ^ result);
+    env->NF = env->ZF = result;
+    return result;
+}
+
+/* Similarly for variable shift instructions.  */
+
+uint32_t HELPER(shl)(uint32_t x, uint32_t i)
+{
+    int shift = i & 0xff;
+    if (shift >= 32)
+        return 0;
+    return x << shift;
+}
+
+uint32_t HELPER(shr)(uint32_t x, uint32_t i)
+{
+    int shift = i & 0xff;
+    if (shift >= 32)
+        return 0;
+    return (uint32_t)x >> shift;
+}
+
+uint32_t HELPER(sar)(uint32_t x, uint32_t i)
+{
+    int shift = i & 0xff;
+    if (shift >= 32)
+        shift = 31;
+    return (int32_t)x >> shift;
+}
+
+uint32_t HELPER(ror)(uint32_t x, uint32_t i)
+{
+    int shift = i & 0xff;
+    if (shift == 0)
+        return x;
+    return (x >> shift) | (x << (32 - shift));
+}
+
+uint32_t HELPER(shl_cc)(uint32_t x, uint32_t i)
+{
+    int shift = i & 0xff;
+    if (shift >= 32) {
+        if (shift == 32)
+            env->CF = x & 1;
+        else
+            env->CF = 0;
+        return 0;
+    } else if (shift != 0) {
+        env->CF = (x >> (32 - shift)) & 1;
+        return x << shift;
+    }
+    return x;
+}
+
+uint32_t HELPER(shr_cc)(uint32_t x, uint32_t i)
+{
+    int shift = i & 0xff;
+    if (shift >= 32) {
+        if (shift == 32)
+            env->CF = (x >> 31) & 1;
+        else
+            env->CF = 0;
+        return 0;
+    } else if (shift != 0) {
+        env->CF = (x >> (shift - 1)) & 1;
+        return x >> shift;
+    }
+    return x;
+}
+
+uint32_t HELPER(sar_cc)(uint32_t x, uint32_t i)
+{
+    int shift = i & 0xff;
+    if (shift >= 32) {
+        env->CF = (x >> 31) & 1;
+        return (int32_t)x >> 31;
+    } else if (shift != 0) {
+        env->CF = (x >> (shift - 1)) & 1;
+        return (int32_t)x >> shift;
+    }
+    return x;
+}
+
+uint32_t HELPER(ror_cc)(uint32_t x, uint32_t i)
+{
+    int shift1, shift;
+    shift1 = i & 0xff;
+    shift = shift1 & 0x1f;
+    if (shift == 0) {
+        if (shift1 != 0)
+            env->CF = (x >> 31) & 1;
+        return x;
+    } else {
+        env->CF = (x >> (shift - 1)) & 1;
+        return ((uint32_t)x >> shift) | (x << (32 - shift));
+    }
+}
+
+uint64_t HELPER(neon_add_saturate_s64)(uint64_t src1, uint64_t src2)
+{
+    uint64_t res;
+
+    res = src1 + src2;
+    if (((res ^ src1) & SIGNBIT64) && !((src1 ^ src2) & SIGNBIT64)) {
+        env->QF = 1;
+        res = ((int64_t)src1 >> 63) ^ ~SIGNBIT64;
+    }
+    return res;
+}
+
+uint64_t HELPER(neon_add_saturate_u64)(uint64_t src1, uint64_t src2)
+{
+    uint64_t res;
+
+    res = src1 + src2;
+    if (res < src1) {
+        env->QF = 1;
+        res = ~(uint64_t)0;
+    }
+    return res;
+}
+
+uint64_t HELPER(neon_sub_saturate_s64)(uint64_t src1, uint64_t src2)
+{
+    uint64_t res;
+
+    res = src1 - src2;
+    if (((res ^ src1) & SIGNBIT64) && ((src1 ^ src2) & SIGNBIT64)) {
+        env->QF = 1;
+        res = ((int64_t)src1 >> 63) ^ ~SIGNBIT64;
+    }
+    return res;
+}
+
+uint64_t HELPER(neon_sub_saturate_u64)(uint64_t src1, uint64_t src2)
+{
+    uint64_t res;
+
+    if (src1 < src2) {
+        env->QF = 1;
+        res = 0;
+    } else {
+        res = src1 - src2;
+    }
+    return res;
+}
+
+/* These need to return a pair of value, so still use T0/T1.  */
+/* Transpose.  Argument order is rather strange to avoid special casing
+   the tranlation code.
+   On input T0 = rm, T1 = rd.  On output T0 = rd, T1 = rm  */
+void HELPER(neon_trn_u8)(void)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = ((T0 & 0x00ff00ff) << 8) | (T1 & 0x00ff00ff);
+    rm = ((T1 & 0xff00ff00) >> 8) | (T0 & 0xff00ff00);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+void HELPER(neon_trn_u16)(void)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = (T0 << 16) | (T1 & 0xffff);
+    rm = (T1 >> 16) | (T0 & 0xffff0000);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+/* Worker routines for zip and unzip.  */
+void HELPER(neon_unzip_u8)(void)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = (T0 & 0xff) | ((T0 >> 8) & 0xff00)
+         | ((T1 << 16) & 0xff0000) | ((T1 << 8) & 0xff000000);
+    rm = ((T0 >> 8) & 0xff) | ((T0 >> 16) & 0xff00)
+         | ((T1 << 8) & 0xff0000) | (T1 & 0xff000000);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+void HELPER(neon_zip_u8)(void)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = (T0 & 0xff) | ((T1 << 8) & 0xff00)
+         | ((T0 << 16) & 0xff0000) | ((T1 << 24) & 0xff000000);
+    rm = ((T0 >> 16) & 0xff) | ((T1 >> 8) & 0xff00)
+         | ((T0 >> 8) & 0xff0000) | (T1 & 0xff000000);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+void HELPER(neon_zip_u16)(void)
+{
+    uint32_t tmp;
+
+    tmp = (T0 & 0xffff) | (T1 << 16);
+    T1 = (T1 & 0xffff0000) | (T0 >> 16);
+    T0 = tmp;
+    FORCE_RET();
+}
diff --git a/target-arm/op_mem.h b/target-arm/op_mem.h
deleted file mode 100644
index 9d4d5c0..0000000
--- a/target-arm/op_mem.h
+++ /dev/null
@@ -1,118 +0,0 @@
-/* ARM memory operations.  */
-
-#ifdef GEN_TRACE
-/* Load from address T1 into T0.  */
-#define MEM_LD_OP(name) \
-void OPPROTO glue(op_ld##name,MEMSUFFIX)(void) \
-{ \
-    extern int tracing; \
-    extern void dcache_load(uint32_t addr); \
-    if (tracing) \
-      dcache_load(T1); \
-    T0 = glue(ld##name,MEMSUFFIX)(T1); \
-    FORCE_RET(); \
-}
-#else
-/* Load from address T1 into T0.  */
-#define MEM_LD_OP(name) \
-void OPPROTO glue(op_ld##name,MEMSUFFIX)(void) \
-{ \
-    T0 = glue(ld##name,MEMSUFFIX)(T1); \
-    FORCE_RET(); \
-}
-#endif
-
-MEM_LD_OP(ub)
-MEM_LD_OP(sb)
-MEM_LD_OP(uw)
-MEM_LD_OP(sw)
-MEM_LD_OP(l)
-
-#undef MEM_LD_OP
-
-#ifdef GEN_TRACE
-/* Store T0 to address T1.  */
-#define MEM_ST_OP(name) \
-void OPPROTO glue(op_st##name,MEMSUFFIX)(void) \
-{ \
-    extern int tracing; \
-    extern void dcache_store(uint32_t addr, uint32_t val); \
-    if (tracing) \
-      dcache_store(T1, T0); \
-    glue(st##name,MEMSUFFIX)(T1, T0); \
-    FORCE_RET(); \
-}
-#else
-/* Store T0 to address T1.  */
-#define MEM_ST_OP(name) \
-void OPPROTO glue(op_st##name,MEMSUFFIX)(void) \
-{ \
-    glue(st##name,MEMSUFFIX)(T1, T0); \
-    FORCE_RET(); \
-}
-#endif
-
-MEM_ST_OP(b)
-MEM_ST_OP(w)
-MEM_ST_OP(l)
-
-#undef MEM_ST_OP
-
-#ifdef GEN_TRACE
-/* Swap T0 with memory at address T1.  */
-/* ??? Is this exception safe?  */
-#define MEM_SWP_OP(name, lname) \
-void OPPROTO glue(op_swp##name,MEMSUFFIX)(void) \
-{ \
-    extern int tracing; \
-    extern void dcache_swp(uint32_t addr); \
-    uint32_t tmp; \
-    cpu_lock(); \
-    if (tracing) \
-      dcache_swp(T1); \
-    tmp = glue(ld##lname,MEMSUFFIX)(T1); \
-    glue(st##name,MEMSUFFIX)(T1, T0); \
-    T0 = tmp; \
-    cpu_unlock(); \
-    FORCE_RET(); \
-}
-#else
-/* Swap T0 with memory at address T1.  */
-/* ??? Is this exception safe?  */
-#define MEM_SWP_OP(name, lname) \
-void OPPROTO glue(op_swp##name,MEMSUFFIX)(void) \
-{ \
-    uint32_t tmp; \
-    cpu_lock(); \
-    tmp = glue(ld##lname,MEMSUFFIX)(T1); \
-    glue(st##name,MEMSUFFIX)(T1, T0); \
-    T0 = tmp; \
-    cpu_unlock(); \
-    FORCE_RET(); \
-}
-#endif
-
-MEM_SWP_OP(b, ub)
-MEM_SWP_OP(l, l)
-
-#undef MEM_SWP_OP
-
-/* Floating point load/store.  Address is in T1 */
-#define VFP_MEM_OP(p, w) \
-void OPPROTO glue(op_vfp_ld##p,MEMSUFFIX)(void) \
-{ \
-    FT0##p = glue(ldf##w,MEMSUFFIX)(T1); \
-    FORCE_RET(); \
-} \
-void OPPROTO glue(op_vfp_st##p,MEMSUFFIX)(void) \
-{ \
-    glue(stf##w,MEMSUFFIX)(T1, FT0##p); \
-    FORCE_RET(); \
-}
-
-VFP_MEM_OP(s,l)
-VFP_MEM_OP(d,q)
-
-#undef VFP_MEM_OP
-
-#undef MEMSUFFIX
diff --git a/target-arm/op_template.h b/target-arm/op_template.h
deleted file mode 100644
index fb2add1..0000000
--- a/target-arm/op_template.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- *  ARM micro operations (templates for various register related
- *  operations)
- * 
- *  Copyright (c) 2003 Fabrice Bellard
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#ifndef SET_REG
-#define SET_REG(x) REG = x
-#endif
-
-void OPPROTO glue(op_movl_T0_, REGNAME)(void)
-{
-    T0 = REG;
-}
-
-void OPPROTO glue(op_movl_T1_, REGNAME)(void)
-{
-    T1 = REG;
-}
-
-void OPPROTO glue(op_movl_T2_, REGNAME)(void)
-{
-    T2 = REG;
-}
-
-void OPPROTO glue(glue(op_movl_, REGNAME), _T0)(void)
-{
-    SET_REG (T0);
-}
-
-void OPPROTO glue(glue(op_movl_, REGNAME), _T1)(void)
-{
-    SET_REG (T1);
-}
-
-#undef REG
-#undef REGNAME
-#undef SET_REG
diff --git a/target-arm/translate.c b/target-arm/translate.c
index 663a730..ff27d28 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -2,7 +2,8 @@
  *  ARM translation
  *
  *  Copyright (c) 2003 Fabrice Bellard
- *  Copyright (c) 2005 CodeSourcery, LLC
+ *  Copyright (c) 2005-2007 CodeSourcery
+ *  Copyright (c) 2007 OpenedHand, Ltd.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -27,18 +28,21 @@
 #include "cpu.h"
 #include "exec-all.h"
 #include "disas.h"
-#ifdef GEN_TRACE
+#include "tcg-op.h"
+#include "qemu-log.h"
+
+#ifdef CONFIG_TRACE
 #include "trace.h"
 #endif
 
-typedef int  (*gen_intermediate_code_func)(CPUState  *env, struct TranslationBlock  *tb);
-
-extern gen_intermediate_code_func   _gen_intermediate_code;
-extern gen_intermediate_code_func   _gen_intermediate_code_pc;
+#define GEN_HELPER 1
+#include "helpers.h"
 
-#define ENABLE_ARCH_5J  0
-#define ENABLE_ARCH_6   1
-#define ENABLE_ARCH_6T2 1
+#define ENABLE_ARCH_5J    0
+#define ENABLE_ARCH_6     arm_feature(env, ARM_FEATURE_V6)
+#define ENABLE_ARCH_6K   arm_feature(env, ARM_FEATURE_V6K)
+#define ENABLE_ARCH_6T2   arm_feature(env, ARM_FEATURE_THUMB2)
+#define ENABLE_ARCH_7     arm_feature(env, ARM_FEATURE_V7)
 
 #define ARCH(x) if (!ENABLE_ARCH_##x) goto illegal_op;
 
@@ -50,9 +54,13 @@ typedef struct DisasContext {
     int condjmp;
     /* The label that will be jumped to when the instruction is skipped.  */
     int condlabel;
+    /* Thumb-2 condtional execution bits.  */
+    int condexec_mask;
+    int condexec_cond;
     struct TranslationBlock *tb;
     int singlestep_enabled;
     int thumb;
+    int is_mem;
 #if !defined(CONFIG_USER_ONLY)
     int user;
 #endif
@@ -64,55 +72,731 @@ typedef struct DisasContext {
 #define IS_USER(s) (s->user)
 #endif
 
-#define DISAS_JUMP_NEXT 4
-
-#ifdef USE_DIRECT_JUMP
-#define TBPARAM(x)
-#else
-#define TBPARAM(x) (long)(x)
+#ifdef CONFIG_TRACE
+#include "helpers.h"
 #endif
 
-/* XXX: move that elsewhere */
-static uint16_t *gen_opc_ptr;
-static uint32_t *gen_opparam_ptr;
-extern FILE *logfile;
-extern int loglevel;
+/* These instructions trap after executing, so defer them until after the
+   conditional executions state has been updated.  */
+#define DISAS_WFI 4
+#define DISAS_SWI 5
 
-enum {
-#define DEF(s, n, copy_size) INDEX_op_ ## s,
-#ifdef GEN_TRACE
-#include "opc-trace.h"
-#else
-#include "opc.h"
-#endif
-#undef DEF
-    NB_OPS,
-};
+static TCGv cpu_env;
+/* We reuse the same 64-bit temporaries for efficiency.  */
+static TCGv cpu_V0, cpu_V1, cpu_M0;
+
+/* FIXME:  These should be removed.  */
+static TCGv cpu_T[2];
+static TCGv cpu_F0s, cpu_F1s, cpu_F0d, cpu_F1d;
+
+#define ICOUNT_TEMP cpu_T[0]
+#include "gen-icount.h"
+
+/* initialize TCG globals.  */
+void arm_translate_init(void)
+{
+    cpu_env = tcg_global_reg_new(TCG_TYPE_PTR, TCG_AREG0, "env");
+
+    cpu_T[0] = tcg_global_reg_new(TCG_TYPE_I32, TCG_AREG1, "T0");
+    cpu_T[1] = tcg_global_reg_new(TCG_TYPE_I32, TCG_AREG2, "T1");
+}
+
+/* The code generator doesn't like lots of temporaries, so maintain our own
+   cache for reuse within a function.  */
+#define MAX_TEMPS 8
+static int num_temps;
+static TCGv temps[MAX_TEMPS];
+
+/* Allocate a temporary variable.  */
+static TCGv new_tmp(void)
+{
+    TCGv tmp;
+    if (num_temps == MAX_TEMPS)
+        abort();
+
+    if (GET_TCGV(temps[num_temps]))
+      return temps[num_temps++];
+
+    tmp = tcg_temp_new(TCG_TYPE_I32);
+    temps[num_temps++] = tmp;
+    return tmp;
+}
+
+/* Release a temporary variable.  */
+static void dead_tmp(TCGv tmp)
+{
+    int i;
+    num_temps--;
+    i = num_temps;
+    if (GET_TCGV(temps[i]) == GET_TCGV(tmp))
+        return;
+
+    /* Shuffle this temp to the last slot.  */
+    while (GET_TCGV(temps[i]) != GET_TCGV(tmp))
+        i--;
+    while (i < num_temps) {
+        temps[i] = temps[i + 1];
+        i++;
+    }
+    temps[i] = tmp;
+}
+
+static inline TCGv load_cpu_offset(int offset)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_ld_i32(tmp, cpu_env, offset);
+    return tmp;
+}
 
-#ifdef GEN_TRACE
-#include "gen-op-trace.h"
+#define load_cpu_field(name) load_cpu_offset(offsetof(CPUState, name))
+
+static inline void store_cpu_offset(TCGv var, int offset)
+{
+    tcg_gen_st_i32(var, cpu_env, offset);
+    dead_tmp(var);
+}
+
+#define store_cpu_field(var, name) \
+    store_cpu_offset(var, offsetof(CPUState, name))
+
+/* Set a variable to the value of a CPU register.  */
+static void load_reg_var(DisasContext *s, TCGv var, int reg)
+{
+    if (reg == 15) {
+        uint32_t addr;
+        /* normaly, since we updated PC, we need only to add one insn */
+        if (s->thumb)
+            addr = (long)s->pc + 2;
+        else
+            addr = (long)s->pc + 4;
+        tcg_gen_movi_i32(var, addr);
+    } else {
+        tcg_gen_ld_i32(var, cpu_env, offsetof(CPUState, regs[reg]));
+    }
+}
+
+/* Create a new temporary and set it to the value of a CPU register.  */
+static inline TCGv load_reg(DisasContext *s, int reg)
+{
+    TCGv tmp = new_tmp();
+    load_reg_var(s, tmp, reg);
+    return tmp;
+}
+
+/* Set a CPU register.  The source must be a temporary and will be
+   marked as dead.  */
+static void store_reg(DisasContext *s, int reg, TCGv var)
+{
+    if (reg == 15) {
+        tcg_gen_andi_i32(var, var, ~1);
+        s->is_jmp = DISAS_JUMP;
+    }
+    tcg_gen_st_i32(var, cpu_env, offsetof(CPUState, regs[reg]));
+    dead_tmp(var);
+}
+
+
+/* Basic operations.  */
+#define gen_op_movl_T0_T1() tcg_gen_mov_i32(cpu_T[0], cpu_T[1])
+#define gen_op_movl_T1_T0() tcg_gen_mov_i32(cpu_T[1], cpu_T[0])
+#define gen_op_movl_T0_im(im) tcg_gen_movi_i32(cpu_T[0], im)
+#define gen_op_movl_T1_im(im) tcg_gen_movi_i32(cpu_T[1], im)
+
+#define gen_op_addl_T1_im(im) tcg_gen_addi_i32(cpu_T[1], cpu_T[1], im)
+#define gen_op_addl_T0_T1() tcg_gen_add_i32(cpu_T[0], cpu_T[0], cpu_T[1])
+#define gen_op_subl_T0_T1() tcg_gen_sub_i32(cpu_T[0], cpu_T[0], cpu_T[1])
+#define gen_op_rsbl_T0_T1() tcg_gen_sub_i32(cpu_T[0], cpu_T[1], cpu_T[0])
+
+#define gen_op_addl_T0_T1_cc() gen_helper_add_cc(cpu_T[0], cpu_T[0], cpu_T[1])
+#define gen_op_adcl_T0_T1_cc() gen_helper_adc_cc(cpu_T[0], cpu_T[0], cpu_T[1])
+#define gen_op_subl_T0_T1_cc() gen_helper_sub_cc(cpu_T[0], cpu_T[0], cpu_T[1])
+#define gen_op_sbcl_T0_T1_cc() gen_helper_sbc_cc(cpu_T[0], cpu_T[0], cpu_T[1])
+#define gen_op_rsbl_T0_T1_cc() gen_helper_sub_cc(cpu_T[0], cpu_T[1], cpu_T[0])
+#define gen_op_rscl_T0_T1_cc() gen_helper_sbc_cc(cpu_T[0], cpu_T[1], cpu_T[0])
+
+#define gen_op_andl_T0_T1() tcg_gen_and_i32(cpu_T[0], cpu_T[0], cpu_T[1])
+#define gen_op_xorl_T0_T1() tcg_gen_xor_i32(cpu_T[0], cpu_T[0], cpu_T[1])
+#define gen_op_orl_T0_T1() tcg_gen_or_i32(cpu_T[0], cpu_T[0], cpu_T[1])
+#define gen_op_notl_T0() tcg_gen_not_i32(cpu_T[0], cpu_T[0])
+#define gen_op_notl_T1() tcg_gen_not_i32(cpu_T[1], cpu_T[1])
+#define gen_op_logic_T0_cc() gen_logic_CC(cpu_T[0]);
+#define gen_op_logic_T1_cc() gen_logic_CC(cpu_T[1]);
+
+#define gen_op_shll_T0_im(im) tcg_gen_shli_i32(cpu_T[0], cpu_T[0], im)
+#define gen_op_shll_T1_im(im) tcg_gen_shli_i32(cpu_T[1], cpu_T[1], im)
+#define gen_op_shrl_T1_im(im) tcg_gen_shri_i32(cpu_T[1], cpu_T[1], im)
+#define gen_op_sarl_T1_im(im) tcg_gen_sari_i32(cpu_T[1], cpu_T[1], im)
+#define gen_op_rorl_T1_im(im) tcg_gen_rori_i32(cpu_T[1], cpu_T[1], im)
+
+/* Value extensions.  */
+#define gen_uxtb(var) tcg_gen_ext8u_i32(var, var)
+#define gen_uxth(var) tcg_gen_ext16u_i32(var, var)
+#define gen_sxtb(var) tcg_gen_ext8s_i32(var, var)
+#define gen_sxth(var) tcg_gen_ext16s_i32(var, var)
+
+#define gen_sxtb16(var) gen_helper_sxtb16(var, var)
+#define gen_uxtb16(var) gen_helper_uxtb16(var, var)
+
+#define gen_op_mul_T0_T1() tcg_gen_mul_i32(cpu_T[0], cpu_T[0], cpu_T[1])
+
+#define gen_set_cpsr(var, mask) gen_helper_cpsr_write(var, tcg_const_i32(mask))
+/* Set NZCV flags from the high 4 bits of var.  */
+#define gen_set_nzcv(var) gen_set_cpsr(var, CPSR_NZCV)
+
+#ifdef CONFIG_TRACE
+static void  gen_traceTicks(int  count)
+{
+    TCGv  t0 = new_tmp();
+    tcg_gen_movi_i32(t0, count);
+    gen_helper_traceTicks(t0);
+    dead_tmp(t0);
+}
+
+static void gen_traceBB(uint64_t  bb_num, target_phys_addr_t  tb)
+{
+#if HOST_LONG_BITS ==64
+    TCGv  t0 = tcg_const_i64(bb_num);
+    TCGv  t1 = tcg_const_i64(tb);
+    gen_helper_traceBB64(t0, t1);
+    tcg_temp_free(t1);
+    tcg_temp_free(t0);
 #else
-#include "gen-op.h"
+    TCGv  t0 = new_tmp();
+    TCGv  t1 = new_tmp();
+    TCGv  t2 = new_tmp();
+    tcg_gen_movi_i32(t0, (int32_t)(bb_num >> 32));
+    tcg_gen_movi_i32(t1, (int32_t)(bb_num));
+    tcg_gen_movi_i32(t2, (int32_t)tb);
+    gen_helper_traceBB32(t0, t1, t2);
+    dead_tmp(t2);
+    dead_tmp(t1);
+    dead_tmp(t0);
 #endif
+}
+#endif /* CONFIG_TRACE */
+
+static void gen_exception(int excp)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_movi_i32(tmp, excp);
+    gen_helper_exception(tmp);
+    dead_tmp(tmp);
+}
+
+static void gen_smul_dual(TCGv a, TCGv b)
+{
+    TCGv tmp1 = new_tmp();
+    TCGv tmp2 = new_tmp();
+    tcg_gen_ext16s_i32(tmp1, a);
+    tcg_gen_ext16s_i32(tmp2, b);
+    tcg_gen_mul_i32(tmp1, tmp1, tmp2);
+    dead_tmp(tmp2);
+    tcg_gen_sari_i32(a, a, 16);
+    tcg_gen_sari_i32(b, b, 16);
+    tcg_gen_mul_i32(b, b, a);
+    tcg_gen_mov_i32(a, tmp1);
+    dead_tmp(tmp1);
+}
+
+/* Byteswap each halfword.  */
+static void gen_rev16(TCGv var)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_shri_i32(tmp, var, 8);
+    tcg_gen_andi_i32(tmp, tmp, 0x00ff00ff);
+    tcg_gen_shli_i32(var, var, 8);
+    tcg_gen_andi_i32(var, var, 0xff00ff00);
+    tcg_gen_or_i32(var, var, tmp);
+    dead_tmp(tmp);
+}
+
+/* Byteswap low halfword and sign extend.  */
+static void gen_revsh(TCGv var)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_shri_i32(tmp, var, 8);
+    tcg_gen_andi_i32(tmp, tmp, 0x00ff);
+    tcg_gen_shli_i32(var, var, 8);
+    tcg_gen_ext8s_i32(var, var);
+    tcg_gen_or_i32(var, var, tmp);
+    dead_tmp(tmp);
+}
+
+/* Unsigned bitfield extract.  */
+static void gen_ubfx(TCGv var, int shift, uint32_t mask)
+{
+    if (shift)
+        tcg_gen_shri_i32(var, var, shift);
+    tcg_gen_andi_i32(var, var, mask);
+}
 
-static GenOpFunc1 *gen_test_cc[14] = {
-    gen_op_test_eq,
-    gen_op_test_ne,
-    gen_op_test_cs,
-    gen_op_test_cc,
-    gen_op_test_mi,
-    gen_op_test_pl,
-    gen_op_test_vs,
-    gen_op_test_vc,
-    gen_op_test_hi,
-    gen_op_test_ls,
-    gen_op_test_ge,
-    gen_op_test_lt,
-    gen_op_test_gt,
-    gen_op_test_le,
+/* Signed bitfield extract.  */
+static void gen_sbfx(TCGv var, int shift, int width)
+{
+    uint32_t signbit;
+
+    if (shift)
+        tcg_gen_sari_i32(var, var, shift);
+    if (shift + width < 32) {
+        signbit = 1u << (width - 1);
+        tcg_gen_andi_i32(var, var, (1u << width) - 1);
+        tcg_gen_xori_i32(var, var, signbit);
+        tcg_gen_subi_i32(var, var, signbit);
+    }
+}
+
+/* Bitfield insertion.  Insert val into base.  Clobbers base and val.  */
+static void gen_bfi(TCGv dest, TCGv base, TCGv val, int shift, uint32_t mask)
+{
+    tcg_gen_andi_i32(val, val, mask);
+    tcg_gen_shli_i32(val, val, shift);
+    tcg_gen_andi_i32(base, base, ~(mask << shift));
+    tcg_gen_or_i32(dest, base, val);
+}
+
+/* Round the top 32 bits of a 64-bit value.  */
+static void gen_roundqd(TCGv a, TCGv b)
+{
+    tcg_gen_shri_i32(a, a, 31);
+    tcg_gen_add_i32(a, a, b);
+}
+
+/* FIXME: Most targets have native widening multiplication.
+   It would be good to use that instead of a full wide multiply.  */
+/* 32x32->64 multiply.  Marks inputs as dead.  */
+static TCGv gen_mulu_i64_i32(TCGv a, TCGv b)
+{
+    TCGv tmp1 = tcg_temp_new(TCG_TYPE_I64);
+    TCGv tmp2 = tcg_temp_new(TCG_TYPE_I64);
+
+    tcg_gen_extu_i32_i64(tmp1, a);
+    dead_tmp(a);
+    tcg_gen_extu_i32_i64(tmp2, b);
+    dead_tmp(b);
+    tcg_gen_mul_i64(tmp1, tmp1, tmp2);
+    return tmp1;
+}
+
+static TCGv gen_muls_i64_i32(TCGv a, TCGv b)
+{
+    TCGv tmp1 = tcg_temp_new(TCG_TYPE_I64);
+    TCGv tmp2 = tcg_temp_new(TCG_TYPE_I64);
+
+    tcg_gen_ext_i32_i64(tmp1, a);
+    dead_tmp(a);
+    tcg_gen_ext_i32_i64(tmp2, b);
+    dead_tmp(b);
+    tcg_gen_mul_i64(tmp1, tmp1, tmp2);
+    return tmp1;
+}
+
+/* Unsigned 32x32->64 multiply.  */
+static void gen_op_mull_T0_T1(void)
+{
+    TCGv tmp1 = tcg_temp_new(TCG_TYPE_I64);
+    TCGv tmp2 = tcg_temp_new(TCG_TYPE_I64);
+
+    tcg_gen_extu_i32_i64(tmp1, cpu_T[0]);
+    tcg_gen_extu_i32_i64(tmp2, cpu_T[1]);
+    tcg_gen_mul_i64(tmp1, tmp1, tmp2);
+    tcg_gen_trunc_i64_i32(cpu_T[0], tmp1);
+    tcg_gen_shri_i64(tmp1, tmp1, 32);
+    tcg_gen_trunc_i64_i32(cpu_T[1], tmp1);
+}
+
+/* Signed 32x32->64 multiply.  */
+static void gen_imull(TCGv a, TCGv b)
+{
+    TCGv tmp1 = tcg_temp_new(TCG_TYPE_I64);
+    TCGv tmp2 = tcg_temp_new(TCG_TYPE_I64);
+
+    tcg_gen_ext_i32_i64(tmp1, a);
+    tcg_gen_ext_i32_i64(tmp2, b);
+    tcg_gen_mul_i64(tmp1, tmp1, tmp2);
+    tcg_gen_trunc_i64_i32(a, tmp1);
+    tcg_gen_shri_i64(tmp1, tmp1, 32);
+    tcg_gen_trunc_i64_i32(b, tmp1);
+}
+#define gen_op_imull_T0_T1() gen_imull(cpu_T[0], cpu_T[1])
+
+/* Swap low and high halfwords.  */
+static void gen_swap_half(TCGv var)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_shri_i32(tmp, var, 16);
+    tcg_gen_shli_i32(var, var, 16);
+    tcg_gen_or_i32(var, var, tmp);
+    dead_tmp(tmp);
+}
+
+/* Dual 16-bit add.  Result placed in t0 and t1 is marked as dead.
+    tmp = (t0 ^ t1) & 0x8000;
+    t0 &= ~0x8000;
+    t1 &= ~0x8000;
+    t0 = (t0 + t1) ^ tmp;
+ */
+
+static void gen_add16(TCGv t0, TCGv t1)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_xor_i32(tmp, t0, t1);
+    tcg_gen_andi_i32(tmp, tmp, 0x8000);
+    tcg_gen_andi_i32(t0, t0, ~0x8000);
+    tcg_gen_andi_i32(t1, t1, ~0x8000);
+    tcg_gen_add_i32(t0, t0, t1);
+    tcg_gen_xor_i32(t0, t0, tmp);
+    dead_tmp(tmp);
+    dead_tmp(t1);
+}
+
+#define gen_set_CF(var) tcg_gen_st_i32(var, cpu_env, offsetof(CPUState, CF))
+
+/* Set CF to the top bit of var.  */
+static void gen_set_CF_bit31(TCGv var)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_shri_i32(tmp, var, 31);
+    gen_set_CF(var);
+    dead_tmp(tmp);
+}
+
+/* Set N and Z flags from var.  */
+static inline void gen_logic_CC(TCGv var)
+{
+    tcg_gen_st_i32(var, cpu_env, offsetof(CPUState, NF));
+    tcg_gen_st_i32(var, cpu_env, offsetof(CPUState, ZF));
+}
+
+/* T0 += T1 + CF.  */
+static void gen_adc_T0_T1(void)
+{
+    TCGv tmp;
+    gen_op_addl_T0_T1();
+    tmp = load_cpu_field(CF);
+    tcg_gen_add_i32(cpu_T[0], cpu_T[0], tmp);
+    dead_tmp(tmp);
+}
+
+/* dest = T0 - T1 + CF - 1.  */
+static void gen_sub_carry(TCGv dest, TCGv t0, TCGv t1)
+{
+    TCGv tmp;
+    tcg_gen_sub_i32(dest, t0, t1);
+    tmp = load_cpu_field(CF);
+    tcg_gen_add_i32(dest, dest, tmp);
+    tcg_gen_subi_i32(dest, dest, 1);
+    dead_tmp(tmp);
+}
+
+#define gen_sbc_T0_T1() gen_sub_carry(cpu_T[0], cpu_T[0], cpu_T[1])
+#define gen_rsc_T0_T1() gen_sub_carry(cpu_T[0], cpu_T[1], cpu_T[0])
+
+/* T0 &= ~T1.  Clobbers T1.  */
+/* FIXME: Implement bic natively.  */
+static inline void tcg_gen_bic_i32(TCGv dest, TCGv t0, TCGv t1)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_not_i32(tmp, t1);
+    tcg_gen_and_i32(dest, t0, tmp);
+    dead_tmp(tmp);
+}
+static inline void gen_op_bicl_T0_T1(void)
+{
+    gen_op_notl_T1();
+    gen_op_andl_T0_T1();
+}
+
+/* FIXME:  Implement this natively.  */
+#define tcg_gen_abs_i32(t0, t1) gen_helper_abs(t0, t1)
+
+/* FIXME:  Implement this natively.  */
+static void tcg_gen_rori_i32(TCGv t0, TCGv t1, int i)
+{
+    TCGv tmp;
+
+    if (i == 0)
+        return;
+
+    tmp = new_tmp();
+    tcg_gen_shri_i32(tmp, t1, i);
+    tcg_gen_shli_i32(t1, t1, 32 - i);
+    tcg_gen_or_i32(t0, t1, tmp);
+    dead_tmp(tmp);
+}
+
+static void shifter_out_im(TCGv var, int shift)
+{
+    TCGv tmp = new_tmp();
+    if (shift == 0) {
+        tcg_gen_andi_i32(tmp, var, 1);
+    } else {
+        tcg_gen_shri_i32(tmp, var, shift);
+        if (shift != 31);
+            tcg_gen_andi_i32(tmp, tmp, 1);
+    }
+    gen_set_CF(tmp);
+    dead_tmp(tmp);
+}
+
+/* Shift by immediate.  Includes special handling for shift == 0.  */
+static inline void gen_arm_shift_im(TCGv var, int shiftop, int shift, int flags)
+{
+    switch (shiftop) {
+    case 0: /* LSL */
+        if (shift != 0) {
+            if (flags)
+                shifter_out_im(var, 32 - shift);
+            tcg_gen_shli_i32(var, var, shift);
+        }
+        break;
+    case 1: /* LSR */
+        if (shift == 0) {
+            if (flags) {
+                tcg_gen_shri_i32(var, var, 31);
+                gen_set_CF(var);
+            }
+            tcg_gen_movi_i32(var, 0);
+        } else {
+            if (flags)
+                shifter_out_im(var, shift - 1);
+            tcg_gen_shri_i32(var, var, shift);
+        }
+        break;
+    case 2: /* ASR */
+        if (shift == 0)
+            shift = 32;
+        if (flags)
+            shifter_out_im(var, shift - 1);
+        if (shift == 32)
+          shift = 31;
+        tcg_gen_sari_i32(var, var, shift);
+        break;
+    case 3: /* ROR/RRX */
+        if (shift != 0) {
+            if (flags)
+                shifter_out_im(var, shift - 1);
+            tcg_gen_rori_i32(var, var, shift); break;
+        } else {
+            TCGv tmp = load_cpu_field(CF);
+            if (flags)
+                shifter_out_im(var, 0);
+            tcg_gen_shri_i32(var, var, 1);
+            tcg_gen_shli_i32(tmp, tmp, 31);
+            tcg_gen_or_i32(var, var, tmp);
+            dead_tmp(tmp);
+        }
+    }
 };
 
-static const uint8_t table_logic_cc[16] = {
+static inline void gen_arm_shift_reg(TCGv var, int shiftop,
+                                     TCGv shift, int flags)
+{
+    if (flags) {
+        switch (shiftop) {
+        case 0: gen_helper_shl_cc(var, var, shift); break;
+        case 1: gen_helper_shr_cc(var, var, shift); break;
+        case 2: gen_helper_sar_cc(var, var, shift); break;
+        case 3: gen_helper_ror_cc(var, var, shift); break;
+        }
+    } else {
+        switch (shiftop) {
+        case 0: gen_helper_shl(var, var, shift); break;
+        case 1: gen_helper_shr(var, var, shift); break;
+        case 2: gen_helper_sar(var, var, shift); break;
+        case 3: gen_helper_ror(var, var, shift); break;
+        }
+    }
+    dead_tmp(shift);
+}
+
+#define PAS_OP(pfx) \
+    switch (op2) {  \
+    case 0: gen_pas_helper(glue(pfx,add16)); break; \
+    case 1: gen_pas_helper(glue(pfx,addsubx)); break; \
+    case 2: gen_pas_helper(glue(pfx,subaddx)); break; \
+    case 3: gen_pas_helper(glue(pfx,sub16)); break; \
+    case 4: gen_pas_helper(glue(pfx,add8)); break; \
+    case 7: gen_pas_helper(glue(pfx,sub8)); break; \
+    }
+static void gen_arm_parallel_addsub(int op1, int op2, TCGv a, TCGv b)
+{
+    TCGv tmp;
+
+    switch (op1) {
+#define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b, tmp)
+    case 1:
+        tmp = tcg_temp_new(TCG_TYPE_PTR);
+        tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUState, GE));
+        PAS_OP(s)
+        break;
+    case 5:
+        tmp = tcg_temp_new(TCG_TYPE_PTR);
+        tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUState, GE));
+        PAS_OP(u)
+        break;
+#undef gen_pas_helper
+#define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b)
+    case 2:
+        PAS_OP(q);
+        break;
+    case 3:
+        PAS_OP(sh);
+        break;
+    case 6:
+        PAS_OP(uq);
+        break;
+    case 7:
+        PAS_OP(uh);
+        break;
+#undef gen_pas_helper
+    }
+}
+#undef PAS_OP
+
+/* For unknown reasons Arm and Thumb-2 use arbitrarily different encodings.  */
+#define PAS_OP(pfx) \
+    switch (op2) {  \
+    case 0: gen_pas_helper(glue(pfx,add8)); break; \
+    case 1: gen_pas_helper(glue(pfx,add16)); break; \
+    case 2: gen_pas_helper(glue(pfx,addsubx)); break; \
+    case 4: gen_pas_helper(glue(pfx,sub8)); break; \
+    case 5: gen_pas_helper(glue(pfx,sub16)); break; \
+    case 6: gen_pas_helper(glue(pfx,subaddx)); break; \
+    }
+static void gen_thumb2_parallel_addsub(int op1, int op2, TCGv a, TCGv b)
+{
+    TCGv tmp;
+
+    switch (op1) {
+#define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b, tmp)
+    case 0:
+        tmp = tcg_temp_new(TCG_TYPE_PTR);
+        tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUState, GE));
+        PAS_OP(s)
+        break;
+    case 4:
+        tmp = tcg_temp_new(TCG_TYPE_PTR);
+        tcg_gen_addi_ptr(tmp, cpu_env, offsetof(CPUState, GE));
+        PAS_OP(u)
+        break;
+#undef gen_pas_helper
+#define gen_pas_helper(name) glue(gen_helper_,name)(a, a, b)
+    case 1:
+        PAS_OP(q);
+        break;
+    case 2:
+        PAS_OP(sh);
+        break;
+    case 5:
+        PAS_OP(uq);
+        break;
+    case 6:
+        PAS_OP(uh);
+        break;
+#undef gen_pas_helper
+    }
+}
+#undef PAS_OP
+
+static void gen_test_cc(int cc, int label)
+{
+    TCGv tmp;
+    TCGv tmp2;
+    int inv;
+
+    switch (cc) {
+    case 0: /* eq: Z */
+        tmp = load_cpu_field(ZF);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, label);
+        break;
+    case 1: /* ne: !Z */
+        tmp = load_cpu_field(ZF);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, label);
+        break;
+    case 2: /* cs: C */
+        tmp = load_cpu_field(CF);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, label);
+        break;
+    case 3: /* cc: !C */
+        tmp = load_cpu_field(CF);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, label);
+        break;
+    case 4: /* mi: N */
+        tmp = load_cpu_field(NF);
+        tcg_gen_brcondi_i32(TCG_COND_LT, tmp, 0, label);
+        break;
+    case 5: /* pl: !N */
+        tmp = load_cpu_field(NF);
+        tcg_gen_brcondi_i32(TCG_COND_GE, tmp, 0, label);
+        break;
+    case 6: /* vs: V */
+        tmp = load_cpu_field(VF);
+        tcg_gen_brcondi_i32(TCG_COND_LT, tmp, 0, label);
+        break;
+    case 7: /* vc: !V */
+        tmp = load_cpu_field(VF);
+        tcg_gen_brcondi_i32(TCG_COND_GE, tmp, 0, label);
+        break;
+    case 8: /* hi: C && !Z */
+        inv = gen_new_label();
+        tmp = load_cpu_field(CF);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, inv);
+        dead_tmp(tmp);
+        tmp = load_cpu_field(ZF);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, label);
+        gen_set_label(inv);
+        break;
+    case 9: /* ls: !C || Z */
+        tmp = load_cpu_field(CF);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, label);
+        dead_tmp(tmp);
+        tmp = load_cpu_field(ZF);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, label);
+        break;
+    case 10: /* ge: N == V -> N ^ V == 0 */
+        tmp = load_cpu_field(VF);
+        tmp2 = load_cpu_field(NF);
+        tcg_gen_xor_i32(tmp, tmp, tmp2);
+        dead_tmp(tmp2);
+        tcg_gen_brcondi_i32(TCG_COND_GE, tmp, 0, label);
+        break;
+    case 11: /* lt: N != V -> N ^ V != 0 */
+        tmp = load_cpu_field(VF);
+        tmp2 = load_cpu_field(NF);
+        tcg_gen_xor_i32(tmp, tmp, tmp2);
+        dead_tmp(tmp2);
+        tcg_gen_brcondi_i32(TCG_COND_LT, tmp, 0, label);
+        break;
+    case 12: /* gt: !Z && N == V */
+        inv = gen_new_label();
+        tmp = load_cpu_field(ZF);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, inv);
+        dead_tmp(tmp);
+        tmp = load_cpu_field(VF);
+        tmp2 = load_cpu_field(NF);
+        tcg_gen_xor_i32(tmp, tmp, tmp2);
+        dead_tmp(tmp2);
+        tcg_gen_brcondi_i32(TCG_COND_GE, tmp, 0, label);
+        gen_set_label(inv);
+        break;
+    case 13: /* le: Z || N != V */
+        tmp = load_cpu_field(ZF);
+        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, label);
+        dead_tmp(tmp);
+        tmp = load_cpu_field(VF);
+        tmp2 = load_cpu_field(NF);
+        tcg_gen_xor_i32(tmp, tmp, tmp2);
+        dead_tmp(tmp2);
+        tcg_gen_brcondi_i32(TCG_COND_LT, tmp, 0, label);
+        break;
+    default:
+        fprintf(stderr, "Bad condition code 0x%x\n", cc);
+        abort();
+    }
+    dead_tmp(tmp);
+}
+
+const uint8_t table_logic_cc[16] = {
     1, /* and */
     1, /* xor */
     0, /* sub */
@@ -131,223 +815,134 @@ static const uint8_t table_logic_cc[16] = {
     1, /* mvn */
 };
 
-static GenOpFunc1 *gen_shift_T1_im[4] = {
-    gen_op_shll_T1_im,
-    gen_op_shrl_T1_im,
-    gen_op_sarl_T1_im,
-    gen_op_rorl_T1_im,
-};
-
-static GenOpFunc *gen_shift_T1_0[4] = {
-    NULL,
-    gen_op_shrl_T1_0,
-    gen_op_sarl_T1_0,
-    gen_op_rrxl_T1,
-};
-
-static GenOpFunc1 *gen_shift_T2_im[4] = {
-    gen_op_shll_T2_im,
-    gen_op_shrl_T2_im,
-    gen_op_sarl_T2_im,
-    gen_op_rorl_T2_im,
-};
-
-static GenOpFunc *gen_shift_T2_0[4] = {
-    NULL,
-    gen_op_shrl_T2_0,
-    gen_op_sarl_T2_0,
-    gen_op_rrxl_T2,
-};
-
-static GenOpFunc1 *gen_shift_T1_im_cc[4] = {
-    gen_op_shll_T1_im_cc,
-    gen_op_shrl_T1_im_cc,
-    gen_op_sarl_T1_im_cc,
-    gen_op_rorl_T1_im_cc,
-};
-
-static GenOpFunc *gen_shift_T1_0_cc[4] = {
-    NULL,
-    gen_op_shrl_T1_0_cc,
-    gen_op_sarl_T1_0_cc,
-    gen_op_rrxl_T1_cc,
-};
-
-static GenOpFunc *gen_shift_T1_T0[4] = {
-    gen_op_shll_T1_T0,
-    gen_op_shrl_T1_T0,
-    gen_op_sarl_T1_T0,
-    gen_op_rorl_T1_T0,
-};
-
-static GenOpFunc *gen_shift_T1_T0_cc[4] = {
-    gen_op_shll_T1_T0_cc,
-    gen_op_shrl_T1_T0_cc,
-    gen_op_sarl_T1_T0_cc,
-    gen_op_rorl_T1_T0_cc,
-};
-
-static GenOpFunc *gen_op_movl_TN_reg[3][16] = {
-    {
-        gen_op_movl_T0_r0,
-        gen_op_movl_T0_r1,
-        gen_op_movl_T0_r2,
-        gen_op_movl_T0_r3,
-        gen_op_movl_T0_r4,
-        gen_op_movl_T0_r5,
-        gen_op_movl_T0_r6,
-        gen_op_movl_T0_r7,
-        gen_op_movl_T0_r8,
-        gen_op_movl_T0_r9,
-        gen_op_movl_T0_r10,
-        gen_op_movl_T0_r11,
-        gen_op_movl_T0_r12,
-        gen_op_movl_T0_r13,
-        gen_op_movl_T0_r14,
-        gen_op_movl_T0_r15,
-    },
-    {
-        gen_op_movl_T1_r0,
-        gen_op_movl_T1_r1,
-        gen_op_movl_T1_r2,
-        gen_op_movl_T1_r3,
-        gen_op_movl_T1_r4,
-        gen_op_movl_T1_r5,
-        gen_op_movl_T1_r6,
-        gen_op_movl_T1_r7,
-        gen_op_movl_T1_r8,
-        gen_op_movl_T1_r9,
-        gen_op_movl_T1_r10,
-        gen_op_movl_T1_r11,
-        gen_op_movl_T1_r12,
-        gen_op_movl_T1_r13,
-        gen_op_movl_T1_r14,
-        gen_op_movl_T1_r15,
-    },
-    {
-        gen_op_movl_T2_r0,
-        gen_op_movl_T2_r1,
-        gen_op_movl_T2_r2,
-        gen_op_movl_T2_r3,
-        gen_op_movl_T2_r4,
-        gen_op_movl_T2_r5,
-        gen_op_movl_T2_r6,
-        gen_op_movl_T2_r7,
-        gen_op_movl_T2_r8,
-        gen_op_movl_T2_r9,
-        gen_op_movl_T2_r10,
-        gen_op_movl_T2_r11,
-        gen_op_movl_T2_r12,
-        gen_op_movl_T2_r13,
-        gen_op_movl_T2_r14,
-        gen_op_movl_T2_r15,
-    },
-};
+/* Set PC and Thumb state from an immediate address.  */
+static inline void gen_bx_im(DisasContext *s, uint32_t addr)
+{
+    TCGv tmp;
 
-static GenOpFunc *gen_op_movl_reg_TN[2][16] = {
-    {
-        gen_op_movl_r0_T0,
-        gen_op_movl_r1_T0,
-        gen_op_movl_r2_T0,
-        gen_op_movl_r3_T0,
-        gen_op_movl_r4_T0,
-        gen_op_movl_r5_T0,
-        gen_op_movl_r6_T0,
-        gen_op_movl_r7_T0,
-        gen_op_movl_r8_T0,
-        gen_op_movl_r9_T0,
-        gen_op_movl_r10_T0,
-        gen_op_movl_r11_T0,
-        gen_op_movl_r12_T0,
-        gen_op_movl_r13_T0,
-        gen_op_movl_r14_T0,
-        gen_op_movl_r15_T0,
-    },
-    {
-        gen_op_movl_r0_T1,
-        gen_op_movl_r1_T1,
-        gen_op_movl_r2_T1,
-        gen_op_movl_r3_T1,
-        gen_op_movl_r4_T1,
-        gen_op_movl_r5_T1,
-        gen_op_movl_r6_T1,
-        gen_op_movl_r7_T1,
-        gen_op_movl_r8_T1,
-        gen_op_movl_r9_T1,
-        gen_op_movl_r10_T1,
-        gen_op_movl_r11_T1,
-        gen_op_movl_r12_T1,
-        gen_op_movl_r13_T1,
-        gen_op_movl_r14_T1,
-        gen_op_movl_r15_T1,
-    },
-};
+    s->is_jmp = DISAS_UPDATE;
+    tmp = new_tmp();
+    if (s->thumb != (addr & 1)) {
+        tcg_gen_movi_i32(tmp, addr & 1);
+        tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUState, thumb));
+    }
+    tcg_gen_movi_i32(tmp, addr & ~1);
+    tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUState, regs[15]));
+    dead_tmp(tmp);
+}
 
-static GenOpFunc1 *gen_op_movl_TN_im[3] = {
-    gen_op_movl_T0_im,
-    gen_op_movl_T1_im,
-    gen_op_movl_T2_im,
-};
+/* Set PC and Thumb state from var.  var is marked as dead.  */
+static inline void gen_bx(DisasContext *s, TCGv var)
+{
+    TCGv tmp;
 
-static GenOpFunc1 *gen_shift_T0_im_thumb[3] = {
-    gen_op_shll_T0_im_thumb,
-    gen_op_shrl_T0_im_thumb,
-    gen_op_sarl_T0_im_thumb,
-};
+    s->is_jmp = DISAS_UPDATE;
+    tmp = new_tmp();
+    tcg_gen_andi_i32(tmp, var, 1);
+    store_cpu_field(tmp, thumb);
+    tcg_gen_andi_i32(var, var, ~1);
+    store_cpu_field(var, regs[15]);
+}
 
-static inline void gen_bx(DisasContext *s)
+/* TODO: This should be removed.  Use gen_bx instead.  */
+static inline void gen_bx_T0(DisasContext *s)
 {
-  s->is_jmp = DISAS_UPDATE;
-  gen_op_bx_T0();
+    TCGv tmp = new_tmp();
+    tcg_gen_mov_i32(tmp, cpu_T[0]);
+    gen_bx(s, tmp);
 }
 
-
 #if defined(CONFIG_USER_ONLY)
 #define gen_ldst(name, s) gen_op_##name##_raw()
 #else
 #define gen_ldst(name, s) do { \
+    s->is_mem = 1; \
     if (IS_USER(s)) \
         gen_op_##name##_user(); \
     else \
         gen_op_##name##_kernel(); \
     } while (0)
 #endif
-
-static inline void gen_movl_TN_reg(DisasContext *s, int reg, int t)
+static inline TCGv gen_ld8s(TCGv addr, int index)
 {
-    int val;
-
-    if (reg == 15) {
-        /* normaly, since we updated PC, we need only to add one insn */
-        if (s->thumb)
-            val = (long)s->pc + 2;
-        else
-            val = (long)s->pc + 4;
-        gen_op_movl_TN_im[t](val);
-    } else {
-        gen_op_movl_TN_reg[t][reg]();
-    }
+    TCGv tmp = new_tmp();
+    tcg_gen_qemu_ld8s(tmp, addr, index);
+    return tmp;
+}
+static inline TCGv gen_ld8u(TCGv addr, int index)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_qemu_ld8u(tmp, addr, index);
+    return tmp;
+}
+static inline TCGv gen_ld16s(TCGv addr, int index)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_qemu_ld16s(tmp, addr, index);
+    return tmp;
+}
+static inline TCGv gen_ld16u(TCGv addr, int index)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_qemu_ld16u(tmp, addr, index);
+    return tmp;
+}
+static inline TCGv gen_ld32(TCGv addr, int index)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_qemu_ld32u(tmp, addr, index);
+    return tmp;
+}
+static inline void gen_st8(TCGv val, TCGv addr, int index)
+{
+    tcg_gen_qemu_st8(val, addr, index);
+    dead_tmp(val);
+}
+static inline void gen_st16(TCGv val, TCGv addr, int index)
+{
+    tcg_gen_qemu_st16(val, addr, index);
+    dead_tmp(val);
+}
+static inline void gen_st32(TCGv val, TCGv addr, int index)
+{
+    tcg_gen_qemu_st32(val, addr, index);
+    dead_tmp(val);
 }
 
 static inline void gen_movl_T0_reg(DisasContext *s, int reg)
 {
-    gen_movl_TN_reg(s, reg, 0);
+    load_reg_var(s, cpu_T[0], reg);
 }
 
 static inline void gen_movl_T1_reg(DisasContext *s, int reg)
 {
-    gen_movl_TN_reg(s, reg, 1);
+    load_reg_var(s, cpu_T[1], reg);
 }
 
 static inline void gen_movl_T2_reg(DisasContext *s, int reg)
 {
-    gen_movl_TN_reg(s, reg, 2);
+    load_reg_var(s, cpu_T[2], reg);
+}
+
+static inline void gen_set_pc_im(uint32_t val)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_movi_i32(tmp, val);
+    store_cpu_field(tmp, regs[15]);
 }
 
 static inline void gen_movl_reg_TN(DisasContext *s, int reg, int t)
 {
-    gen_op_movl_reg_TN[t][reg]();
+    TCGv tmp;
     if (reg == 15) {
+        tmp = new_tmp();
+        tcg_gen_andi_i32(tmp, cpu_T[t], ~1);
+    } else {
+        tmp = cpu_T[t];
+    }
+    tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUState, regs[reg]));
+    if (reg == 15) {
+        dead_tmp(tmp);
         s->is_jmp = DISAS_JUMP;
     }
 }
@@ -370,9 +965,11 @@ static inline void gen_lookup_tb(DisasContext *s)
     s->is_jmp = DISAS_UPDATE;
 }
 
-static inline void gen_add_data_offset(DisasContext *s, unsigned int insn)
+static inline void gen_add_data_offset(DisasContext *s, unsigned int insn,
+                                       TCGv var)
 {
     int val, rm, shift, shiftop;
+    TCGv offset;
 
     if (!(insn & (1 << 25))) {
         /* immediate */
@@ -380,29 +977,27 @@ static inline void gen_add_data_offset(DisasContext *s, unsigned int insn)
         if (!(insn & (1 << 23)))
             val = -val;
         if (val != 0)
-            gen_op_addl_T1_im(val);
+            tcg_gen_addi_i32(var, var, val);
     } else {
         /* shift/register */
         rm = (insn) & 0xf;
         shift = (insn >> 7) & 0x1f;
-        gen_movl_T2_reg(s, rm);
         shiftop = (insn >> 5) & 3;
-        if (shift != 0) {
-            gen_shift_T2_im[shiftop](shift);
-        } else if (shiftop != 0) {
-            gen_shift_T2_0[shiftop]();
-        }
+        offset = load_reg(s, rm);
+        gen_arm_shift_im(offset, shiftop, shift, 0);
         if (!(insn & (1 << 23)))
-            gen_op_subl_T1_T2();
+            tcg_gen_sub_i32(var, var, offset);
         else
-            gen_op_addl_T1_T2();
+            tcg_gen_add_i32(var, var, offset);
+        dead_tmp(offset);
     }
 }
 
 static inline void gen_add_datah_offset(DisasContext *s, unsigned int insn,
-                                        int extra)
+                                        int extra, TCGv var)
 {
     int val, rm;
+    TCGv offset;
 
     if (insn & (1 << 22)) {
         /* immediate */
@@ -411,62 +1006,174 @@ static inline void gen_add_datah_offset(DisasContext *s, unsigned int insn,
             val = -val;
         val += extra;
         if (val != 0)
-            gen_op_addl_T1_im(val);
+            tcg_gen_addi_i32(var, var, val);
     } else {
         /* register */
         if (extra)
-            gen_op_addl_T1_im(extra);
+            tcg_gen_addi_i32(var, var, extra);
         rm = (insn) & 0xf;
-        gen_movl_T2_reg(s, rm);
+        offset = load_reg(s, rm);
         if (!(insn & (1 << 23)))
-            gen_op_subl_T1_T2();
+            tcg_gen_sub_i32(var, var, offset);
         else
-            gen_op_addl_T1_T2();
-    }
-}
-
-#define VFP_OP(name)                      \
-static inline void gen_vfp_##name(int dp) \
-{                                         \
-    if (dp)                               \
-        gen_op_vfp_##name##d();           \
-    else                                  \
-        gen_op_vfp_##name##s();           \
-}
-
-VFP_OP(add)
-VFP_OP(sub)
-VFP_OP(mul)
-VFP_OP(div)
-VFP_OP(neg)
-VFP_OP(abs)
-VFP_OP(sqrt)
-VFP_OP(cmp)
-VFP_OP(cmpe)
-VFP_OP(F1_ld0)
-VFP_OP(uito)
-VFP_OP(sito)
-VFP_OP(toui)
-VFP_OP(touiz)
-VFP_OP(tosi)
-VFP_OP(tosiz)
-
-#undef VFP_OP
+            tcg_gen_add_i32(var, var, offset);
+        dead_tmp(offset);
+    }
+}
+
+#define VFP_OP2(name)                                                 \
+static inline void gen_vfp_##name(int dp)                             \
+{                                                                     \
+    if (dp)                                                           \
+        gen_helper_vfp_##name##d(cpu_F0d, cpu_F0d, cpu_F1d, cpu_env); \
+    else                                                              \
+        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, cpu_F1s, cpu_env); \
+}
+
+#define VFP_OP1(name)                               \
+static inline void gen_vfp_##name(int dp, int arg)  \
+{                                                   \
+    if (dp)                                         \
+        gen_op_vfp_##name##d(arg);                  \
+    else                                            \
+        gen_op_vfp_##name##s(arg);                  \
+}
+
+VFP_OP2(add)
+VFP_OP2(sub)
+VFP_OP2(mul)
+VFP_OP2(div)
+
+#undef VFP_OP2
+
+static inline void gen_vfp_abs(int dp)
+{
+    if (dp)
+        gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
+    else
+        gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
+}
+
+static inline void gen_vfp_neg(int dp)
+{
+    if (dp)
+        gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
+    else
+        gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
+}
+
+static inline void gen_vfp_sqrt(int dp)
+{
+    if (dp)
+        gen_helper_vfp_sqrtd(cpu_F0d, cpu_F0d, cpu_env);
+    else
+        gen_helper_vfp_sqrts(cpu_F0s, cpu_F0s, cpu_env);
+}
+
+static inline void gen_vfp_cmp(int dp)
+{
+    if (dp)
+        gen_helper_vfp_cmpd(cpu_F0d, cpu_F1d, cpu_env);
+    else
+        gen_helper_vfp_cmps(cpu_F0s, cpu_F1s, cpu_env);
+}
+
+static inline void gen_vfp_cmpe(int dp)
+{
+    if (dp)
+        gen_helper_vfp_cmped(cpu_F0d, cpu_F1d, cpu_env);
+    else
+        gen_helper_vfp_cmpes(cpu_F0s, cpu_F1s, cpu_env);
+}
+
+static inline void gen_vfp_F1_ld0(int dp)
+{
+    if (dp)
+        tcg_gen_movi_i64(cpu_F1d, 0);
+    else
+        tcg_gen_movi_i32(cpu_F1s, 0);
+}
+
+static inline void gen_vfp_uito(int dp)
+{
+    if (dp)
+        gen_helper_vfp_uitod(cpu_F0d, cpu_F0s, cpu_env);
+    else
+        gen_helper_vfp_uitos(cpu_F0s, cpu_F0s, cpu_env);
+}
+
+static inline void gen_vfp_sito(int dp)
+{
+    if (dp)
+        gen_helper_vfp_sitod(cpu_F0d, cpu_F0s, cpu_env);
+    else
+        gen_helper_vfp_sitos(cpu_F0s, cpu_F0s, cpu_env);
+}
+
+static inline void gen_vfp_toui(int dp)
+{
+    if (dp)
+        gen_helper_vfp_touid(cpu_F0s, cpu_F0d, cpu_env);
+    else
+        gen_helper_vfp_touis(cpu_F0s, cpu_F0s, cpu_env);
+}
+
+static inline void gen_vfp_touiz(int dp)
+{
+    if (dp)
+        gen_helper_vfp_touizd(cpu_F0s, cpu_F0d, cpu_env);
+    else
+        gen_helper_vfp_touizs(cpu_F0s, cpu_F0s, cpu_env);
+}
+
+static inline void gen_vfp_tosi(int dp)
+{
+    if (dp)
+        gen_helper_vfp_tosid(cpu_F0s, cpu_F0d, cpu_env);
+    else
+        gen_helper_vfp_tosis(cpu_F0s, cpu_F0s, cpu_env);
+}
+
+static inline void gen_vfp_tosiz(int dp)
+{
+    if (dp)
+        gen_helper_vfp_tosizd(cpu_F0s, cpu_F0d, cpu_env);
+    else
+        gen_helper_vfp_tosizs(cpu_F0s, cpu_F0s, cpu_env);
+}
+
+#define VFP_GEN_FIX(name) \
+static inline void gen_vfp_##name(int dp, int shift) \
+{ \
+    if (dp) \
+        gen_helper_vfp_##name##d(cpu_F0d, cpu_F0d, tcg_const_i32(shift), cpu_env);\
+    else \
+        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, tcg_const_i32(shift), cpu_env);\
+}
+VFP_GEN_FIX(tosh)
+VFP_GEN_FIX(tosl)
+VFP_GEN_FIX(touh)
+VFP_GEN_FIX(toul)
+VFP_GEN_FIX(shto)
+VFP_GEN_FIX(slto)
+VFP_GEN_FIX(uhto)
+VFP_GEN_FIX(ulto)
+#undef VFP_GEN_FIX
 
 static inline void gen_vfp_ld(DisasContext *s, int dp)
 {
     if (dp)
-        gen_ldst(vfp_ldd, s);
+        tcg_gen_qemu_ld64(cpu_F0d, cpu_T[1], IS_USER(s));
     else
-        gen_ldst(vfp_lds, s);
+        tcg_gen_qemu_ld32u(cpu_F0s, cpu_T[1], IS_USER(s));
 }
 
 static inline void gen_vfp_st(DisasContext *s, int dp)
 {
     if (dp)
-        gen_ldst(vfp_std, s);
+        tcg_gen_qemu_st64(cpu_F0d, cpu_T[1], IS_USER(s));
     else
-        gen_ldst(vfp_sts, s);
+        tcg_gen_qemu_st32(cpu_F0s, cpu_T[1], IS_USER(s));
 }
 
 static inline long
@@ -482,79 +1189,1593 @@ vfp_reg_offset (int dp, int reg)
           + offsetof(CPU_DoubleU, l.lower);
     }
 }
+
+/* Return the offset of a 32-bit piece of a NEON register.
+   zero is the least significant end of the register.  */
+static inline long
+neon_reg_offset (int reg, int n)
+{
+    int sreg;
+    sreg = reg * 2 + n;
+    return vfp_reg_offset(0, sreg);
+}
+
+/* FIXME: Remove these.  */
+#define neon_T0 cpu_T[0]
+#define neon_T1 cpu_T[1]
+#define NEON_GET_REG(T, reg, n) \
+  tcg_gen_ld_i32(neon_##T, cpu_env, neon_reg_offset(reg, n))
+#define NEON_SET_REG(T, reg, n) \
+  tcg_gen_st_i32(neon_##T, cpu_env, neon_reg_offset(reg, n))
+
+static TCGv neon_load_reg(int reg, int pass)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_ld_i32(tmp, cpu_env, neon_reg_offset(reg, pass));
+    return tmp;
+}
+
+static void neon_store_reg(int reg, int pass, TCGv var)
+{
+    tcg_gen_st_i32(var, cpu_env, neon_reg_offset(reg, pass));
+    dead_tmp(var);
+}
+
+static inline void neon_load_reg64(TCGv var, int reg)
+{
+    tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(1, reg));
+}
+
+static inline void neon_store_reg64(TCGv var, int reg)
+{
+    tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(1, reg));
+}
+
+#define tcg_gen_ld_f32 tcg_gen_ld_i32
+#define tcg_gen_ld_f64 tcg_gen_ld_i64
+#define tcg_gen_st_f32 tcg_gen_st_i32
+#define tcg_gen_st_f64 tcg_gen_st_i64
+
 static inline void gen_mov_F0_vreg(int dp, int reg)
 {
     if (dp)
-        gen_op_vfp_getreg_F0d(vfp_reg_offset(dp, reg));
+        tcg_gen_ld_f64(cpu_F0d, cpu_env, vfp_reg_offset(dp, reg));
     else
-        gen_op_vfp_getreg_F0s(vfp_reg_offset(dp, reg));
+        tcg_gen_ld_f32(cpu_F0s, cpu_env, vfp_reg_offset(dp, reg));
 }
 
 static inline void gen_mov_F1_vreg(int dp, int reg)
 {
     if (dp)
-        gen_op_vfp_getreg_F1d(vfp_reg_offset(dp, reg));
+        tcg_gen_ld_f64(cpu_F1d, cpu_env, vfp_reg_offset(dp, reg));
     else
-        gen_op_vfp_getreg_F1s(vfp_reg_offset(dp, reg));
+        tcg_gen_ld_f32(cpu_F1s, cpu_env, vfp_reg_offset(dp, reg));
 }
 
 static inline void gen_mov_vreg_F0(int dp, int reg)
 {
     if (dp)
-        gen_op_vfp_setreg_F0d(vfp_reg_offset(dp, reg));
+        tcg_gen_st_f64(cpu_F0d, cpu_env, vfp_reg_offset(dp, reg));
     else
-        gen_op_vfp_setreg_F0s(vfp_reg_offset(dp, reg));
+        tcg_gen_st_f32(cpu_F0s, cpu_env, vfp_reg_offset(dp, reg));
+}
+
+#define ARM_CP_RW_BIT	(1 << 20)
+
+static inline void iwmmxt_load_reg(TCGv var, int reg)
+{
+    tcg_gen_ld_i64(var, cpu_env, offsetof(CPUState, iwmmxt.regs[reg]));
+}
+
+static inline void iwmmxt_store_reg(TCGv var, int reg)
+{
+    tcg_gen_st_i64(var, cpu_env, offsetof(CPUState, iwmmxt.regs[reg]));
+}
+
+static inline void gen_op_iwmmxt_movl_wCx_T0(int reg)
+{
+    tcg_gen_st_i32(cpu_T[0], cpu_env, offsetof(CPUState, iwmmxt.cregs[reg]));
+}
+
+static inline void gen_op_iwmmxt_movl_T0_wCx(int reg)
+{
+    tcg_gen_ld_i32(cpu_T[0], cpu_env, offsetof(CPUState, iwmmxt.cregs[reg]));
+}
+
+static inline void gen_op_iwmmxt_movl_T1_wCx(int reg)
+{
+    tcg_gen_ld_i32(cpu_T[1], cpu_env, offsetof(CPUState, iwmmxt.cregs[reg]));
+}
+
+static inline void gen_op_iwmmxt_movq_wRn_M0(int rn)
+{
+    iwmmxt_store_reg(cpu_M0, rn);
+}
+
+static inline void gen_op_iwmmxt_movq_M0_wRn(int rn)
+{
+    iwmmxt_load_reg(cpu_M0, rn);
+}
+
+static inline void gen_op_iwmmxt_orq_M0_wRn(int rn)
+{
+    iwmmxt_load_reg(cpu_V1, rn);
+    tcg_gen_or_i64(cpu_M0, cpu_M0, cpu_V1);
+}
+
+static inline void gen_op_iwmmxt_andq_M0_wRn(int rn)
+{
+    iwmmxt_load_reg(cpu_V1, rn);
+    tcg_gen_and_i64(cpu_M0, cpu_M0, cpu_V1);
+}
+
+static inline void gen_op_iwmmxt_xorq_M0_wRn(int rn)
+{
+    iwmmxt_load_reg(cpu_V1, rn);
+    tcg_gen_xor_i64(cpu_M0, cpu_M0, cpu_V1);
+}
+
+#define IWMMXT_OP(name) \
+static inline void gen_op_iwmmxt_##name##_M0_wRn(int rn) \
+{ \
+    iwmmxt_load_reg(cpu_V1, rn); \
+    gen_helper_iwmmxt_##name(cpu_M0, cpu_M0, cpu_V1); \
+}
+
+#define IWMMXT_OP_ENV(name) \
+static inline void gen_op_iwmmxt_##name##_M0_wRn(int rn) \
+{ \
+    iwmmxt_load_reg(cpu_V1, rn); \
+    gen_helper_iwmmxt_##name(cpu_M0, cpu_env, cpu_M0, cpu_V1); \
+}
+
+#define IWMMXT_OP_ENV_SIZE(name) \
+IWMMXT_OP_ENV(name##b) \
+IWMMXT_OP_ENV(name##w) \
+IWMMXT_OP_ENV(name##l)
+
+#define IWMMXT_OP_ENV1(name) \
+static inline void gen_op_iwmmxt_##name##_M0(void) \
+{ \
+    gen_helper_iwmmxt_##name(cpu_M0, cpu_env, cpu_M0); \
+}
+
+IWMMXT_OP(maddsq)
+IWMMXT_OP(madduq)
+IWMMXT_OP(sadb)
+IWMMXT_OP(sadw)
+IWMMXT_OP(mulslw)
+IWMMXT_OP(mulshw)
+IWMMXT_OP(mululw)
+IWMMXT_OP(muluhw)
+IWMMXT_OP(macsw)
+IWMMXT_OP(macuw)
+
+IWMMXT_OP_ENV_SIZE(unpackl)
+IWMMXT_OP_ENV_SIZE(unpackh)
+
+IWMMXT_OP_ENV1(unpacklub)
+IWMMXT_OP_ENV1(unpackluw)
+IWMMXT_OP_ENV1(unpacklul)
+IWMMXT_OP_ENV1(unpackhub)
+IWMMXT_OP_ENV1(unpackhuw)
+IWMMXT_OP_ENV1(unpackhul)
+IWMMXT_OP_ENV1(unpacklsb)
+IWMMXT_OP_ENV1(unpacklsw)
+IWMMXT_OP_ENV1(unpacklsl)
+IWMMXT_OP_ENV1(unpackhsb)
+IWMMXT_OP_ENV1(unpackhsw)
+IWMMXT_OP_ENV1(unpackhsl)
+
+IWMMXT_OP_ENV_SIZE(cmpeq)
+IWMMXT_OP_ENV_SIZE(cmpgtu)
+IWMMXT_OP_ENV_SIZE(cmpgts)
+
+IWMMXT_OP_ENV_SIZE(mins)
+IWMMXT_OP_ENV_SIZE(minu)
+IWMMXT_OP_ENV_SIZE(maxs)
+IWMMXT_OP_ENV_SIZE(maxu)
+
+IWMMXT_OP_ENV_SIZE(subn)
+IWMMXT_OP_ENV_SIZE(addn)
+IWMMXT_OP_ENV_SIZE(subu)
+IWMMXT_OP_ENV_SIZE(addu)
+IWMMXT_OP_ENV_SIZE(subs)
+IWMMXT_OP_ENV_SIZE(adds)
+
+IWMMXT_OP_ENV(avgb0)
+IWMMXT_OP_ENV(avgb1)
+IWMMXT_OP_ENV(avgw0)
+IWMMXT_OP_ENV(avgw1)
+
+IWMMXT_OP(msadb)
+
+IWMMXT_OP_ENV(packuw)
+IWMMXT_OP_ENV(packul)
+IWMMXT_OP_ENV(packuq)
+IWMMXT_OP_ENV(packsw)
+IWMMXT_OP_ENV(packsl)
+IWMMXT_OP_ENV(packsq)
+
+static inline void gen_op_iwmmxt_muladdsl_M0_T0_T1(void)
+{
+    gen_helper_iwmmxt_muladdsl(cpu_M0, cpu_M0, cpu_T[0], cpu_T[1]);
+}
+
+static inline void gen_op_iwmmxt_muladdsw_M0_T0_T1(void)
+{
+    gen_helper_iwmmxt_muladdsw(cpu_M0, cpu_M0, cpu_T[0], cpu_T[1]);
+}
+
+static inline void gen_op_iwmmxt_muladdswl_M0_T0_T1(void)
+{
+    gen_helper_iwmmxt_muladdswl(cpu_M0, cpu_M0, cpu_T[0], cpu_T[1]);
+}
+
+static inline void gen_op_iwmmxt_align_M0_T0_wRn(int rn)
+{
+    iwmmxt_load_reg(cpu_V1, rn);
+    gen_helper_iwmmxt_align(cpu_M0, cpu_M0, cpu_V1, cpu_T[0]);
+}
+
+static inline void gen_op_iwmmxt_insr_M0_T0_T1(int shift)
+{
+    TCGv tmp = tcg_const_i32(shift);
+    gen_helper_iwmmxt_insr(cpu_M0, cpu_M0, cpu_T[0], cpu_T[1], tmp);
+}
+
+static inline void gen_op_iwmmxt_extrsb_T0_M0(int shift)
+{
+    tcg_gen_shri_i64(cpu_M0, cpu_M0, shift);
+    tcg_gen_trunc_i64_i32(cpu_T[0], cpu_M0);
+    tcg_gen_ext8s_i32(cpu_T[0], cpu_T[0]);
+}
+
+static inline void gen_op_iwmmxt_extrsw_T0_M0(int shift)
+{
+    tcg_gen_shri_i64(cpu_M0, cpu_M0, shift);
+    tcg_gen_trunc_i64_i32(cpu_T[0], cpu_M0);
+    tcg_gen_ext16s_i32(cpu_T[0], cpu_T[0]);
+}
+
+static inline void gen_op_iwmmxt_extru_T0_M0(int shift, uint32_t mask)
+{
+    tcg_gen_shri_i64(cpu_M0, cpu_M0, shift);
+    tcg_gen_trunc_i64_i32(cpu_T[0], cpu_M0);
+    if (mask != ~0u)
+        tcg_gen_andi_i32(cpu_T[0], cpu_T[0], mask);
+}
+
+static void gen_op_iwmmxt_set_mup(void)
+{
+    TCGv tmp;
+    tmp = load_cpu_field(iwmmxt.cregs[ARM_IWMMXT_wCon]);
+    tcg_gen_ori_i32(tmp, tmp, 2);
+    store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCon]);
+}
+
+static void gen_op_iwmmxt_set_cup(void)
+{
+    TCGv tmp;
+    tmp = load_cpu_field(iwmmxt.cregs[ARM_IWMMXT_wCon]);
+    tcg_gen_ori_i32(tmp, tmp, 1);
+    store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCon]);
+}
+
+static void gen_op_iwmmxt_setpsr_nz(void)
+{
+    TCGv tmp = new_tmp();
+    gen_helper_iwmmxt_setpsr_nz(tmp, cpu_M0);
+    store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCASF]);
+}
+
+static inline void gen_op_iwmmxt_addl_M0_wRn(int rn)
+{
+    iwmmxt_load_reg(cpu_V1, rn);
+    tcg_gen_ext32u_i64(cpu_V1, cpu_V1);
+    tcg_gen_add_i64(cpu_M0, cpu_M0, cpu_V1);
+}
+
+
+static void gen_iwmmxt_movl_T0_T1_wRn(int rn)
+{
+    iwmmxt_load_reg(cpu_V0, rn);
+    tcg_gen_trunc_i64_i32(cpu_T[0], cpu_V0);
+    tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
+    tcg_gen_trunc_i64_i32(cpu_T[1], cpu_V0);
+}
+
+static void gen_iwmmxt_movl_wRn_T0_T1(int rn)
+{
+    tcg_gen_extu_i32_i64(cpu_V0, cpu_T[0]);
+    tcg_gen_extu_i32_i64(cpu_V1, cpu_T[0]);
+    tcg_gen_shli_i64(cpu_V1, cpu_V1, 32);
+    tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
+    iwmmxt_store_reg(cpu_V0, rn);
+}
+
+static inline int gen_iwmmxt_address(DisasContext *s, uint32_t insn)
+{
+    int rd;
+    uint32_t offset;
+
+    rd = (insn >> 16) & 0xf;
+    gen_movl_T1_reg(s, rd);
+
+    offset = (insn & 0xff) << ((insn >> 7) & 2);
+    if (insn & (1 << 24)) {
+        /* Pre indexed */
+        if (insn & (1 << 23))
+            gen_op_addl_T1_im(offset);
+        else
+            gen_op_addl_T1_im(-offset);
+
+        if (insn & (1 << 21))
+            gen_movl_reg_T1(s, rd);
+    } else if (insn & (1 << 21)) {
+        /* Post indexed */
+        if (insn & (1 << 23))
+            gen_op_movl_T0_im(offset);
+        else
+            gen_op_movl_T0_im(- offset);
+        gen_op_addl_T0_T1();
+        gen_movl_reg_T0(s, rd);
+    } else if (!(insn & (1 << 23)))
+        return 1;
+    return 0;
+}
+
+static inline int gen_iwmmxt_shift(uint32_t insn, uint32_t mask)
+{
+    int rd = (insn >> 0) & 0xf;
+
+    if (insn & (1 << 8))
+        if (rd < ARM_IWMMXT_wCGR0 || rd > ARM_IWMMXT_wCGR3)
+            return 1;
+        else
+            gen_op_iwmmxt_movl_T0_wCx(rd);
+    else
+        gen_iwmmxt_movl_T0_T1_wRn(rd);
+
+    gen_op_movl_T1_im(mask);
+    gen_op_andl_T0_T1();
+    return 0;
+}
+
+/* Disassemble an iwMMXt instruction.  Returns nonzero if an error occured
+   (ie. an undefined instruction).  */
+static int disas_iwmmxt_insn(CPUState *env, DisasContext *s, uint32_t insn)
+{
+    int rd, wrd;
+    int rdhi, rdlo, rd0, rd1, i;
+    TCGv tmp;
+
+    if ((insn & 0x0e000e00) == 0x0c000000) {
+        if ((insn & 0x0fe00ff0) == 0x0c400000) {
+            wrd = insn & 0xf;
+            rdlo = (insn >> 12) & 0xf;
+            rdhi = (insn >> 16) & 0xf;
+            if (insn & ARM_CP_RW_BIT) {			/* TMRRC */
+                gen_iwmmxt_movl_T0_T1_wRn(wrd);
+                gen_movl_reg_T0(s, rdlo);
+                gen_movl_reg_T1(s, rdhi);
+            } else {					/* TMCRR */
+                gen_movl_T0_reg(s, rdlo);
+                gen_movl_T1_reg(s, rdhi);
+                gen_iwmmxt_movl_wRn_T0_T1(wrd);
+                gen_op_iwmmxt_set_mup();
+            }
+            return 0;
+        }
+
+        wrd = (insn >> 12) & 0xf;
+        if (gen_iwmmxt_address(s, insn))
+            return 1;
+        if (insn & ARM_CP_RW_BIT) {
+            if ((insn >> 28) == 0xf) {			/* WLDRW wCx */
+                tmp = gen_ld32(cpu_T[1], IS_USER(s));
+                tcg_gen_mov_i32(cpu_T[0], tmp);
+                dead_tmp(tmp);
+                gen_op_iwmmxt_movl_wCx_T0(wrd);
+            } else {
+                i = 1;
+                if (insn & (1 << 8)) {
+                    if (insn & (1 << 22)) {		/* WLDRD */
+                        tcg_gen_qemu_ld64(cpu_M0, cpu_T[1], IS_USER(s));
+                        i = 0;
+                    } else {				/* WLDRW wRd */
+                        tmp = gen_ld32(cpu_T[1], IS_USER(s));
+                    }
+                } else {
+                    if (insn & (1 << 22)) {		/* WLDRH */
+                        tmp = gen_ld16u(cpu_T[1], IS_USER(s));
+                    } else {				/* WLDRB */
+                        tmp = gen_ld8u(cpu_T[1], IS_USER(s));
+                    }
+                }
+                if (i) {
+                    tcg_gen_extu_i32_i64(cpu_M0, tmp);
+                    dead_tmp(tmp);
+                }
+                gen_op_iwmmxt_movq_wRn_M0(wrd);
+            }
+        } else {
+            if ((insn >> 28) == 0xf) {			/* WSTRW wCx */
+                gen_op_iwmmxt_movl_T0_wCx(wrd);
+                tmp = new_tmp();
+                tcg_gen_mov_i32(tmp, cpu_T[0]);
+                gen_st32(tmp, cpu_T[1], IS_USER(s));
+            } else {
+                gen_op_iwmmxt_movq_M0_wRn(wrd);
+                tmp = new_tmp();
+                if (insn & (1 << 8)) {
+                    if (insn & (1 << 22)) {		/* WSTRD */
+                        dead_tmp(tmp);
+                        tcg_gen_qemu_st64(cpu_M0, cpu_T[1], IS_USER(s));
+                    } else {				/* WSTRW wRd */
+                        tcg_gen_trunc_i64_i32(tmp, cpu_M0);
+                        gen_st32(tmp, cpu_T[1], IS_USER(s));
+                    }
+                } else {
+                    if (insn & (1 << 22)) {		/* WSTRH */
+                        tcg_gen_trunc_i64_i32(tmp, cpu_M0);
+                        gen_st16(tmp, cpu_T[1], IS_USER(s));
+                    } else {				/* WSTRB */
+                        tcg_gen_trunc_i64_i32(tmp, cpu_M0);
+                        gen_st8(tmp, cpu_T[1], IS_USER(s));
+                    }
+                }
+            }
+        }
+        return 0;
+    }
+
+    if ((insn & 0x0f000000) != 0x0e000000)
+        return 1;
+
+    switch (((insn >> 12) & 0xf00) | ((insn >> 4) & 0xff)) {
+    case 0x000:						/* WOR */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 0) & 0xf;
+        rd1 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        gen_op_iwmmxt_orq_M0_wRn(rd1);
+        gen_op_iwmmxt_setpsr_nz();
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x011:						/* TMCR */
+        if (insn & 0xf)
+            return 1;
+        rd = (insn >> 12) & 0xf;
+        wrd = (insn >> 16) & 0xf;
+        switch (wrd) {
+        case ARM_IWMMXT_wCID:
+        case ARM_IWMMXT_wCASF:
+            break;
+        case ARM_IWMMXT_wCon:
+            gen_op_iwmmxt_set_cup();
+            /* Fall through.  */
+        case ARM_IWMMXT_wCSSF:
+            gen_op_iwmmxt_movl_T0_wCx(wrd);
+            gen_movl_T1_reg(s, rd);
+            gen_op_bicl_T0_T1();
+            gen_op_iwmmxt_movl_wCx_T0(wrd);
+            break;
+        case ARM_IWMMXT_wCGR0:
+        case ARM_IWMMXT_wCGR1:
+        case ARM_IWMMXT_wCGR2:
+        case ARM_IWMMXT_wCGR3:
+            gen_op_iwmmxt_set_cup();
+            gen_movl_reg_T0(s, rd);
+            gen_op_iwmmxt_movl_wCx_T0(wrd);
+            break;
+        default:
+            return 1;
+        }
+        break;
+    case 0x100:						/* WXOR */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 0) & 0xf;
+        rd1 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        gen_op_iwmmxt_xorq_M0_wRn(rd1);
+        gen_op_iwmmxt_setpsr_nz();
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x111:						/* TMRC */
+        if (insn & 0xf)
+            return 1;
+        rd = (insn >> 12) & 0xf;
+        wrd = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movl_T0_wCx(wrd);
+        gen_movl_reg_T0(s, rd);
+        break;
+    case 0x300:						/* WANDN */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 0) & 0xf;
+        rd1 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        tcg_gen_neg_i64(cpu_M0, cpu_M0);
+        gen_op_iwmmxt_andq_M0_wRn(rd1);
+        gen_op_iwmmxt_setpsr_nz();
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x200:						/* WAND */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 0) & 0xf;
+        rd1 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        gen_op_iwmmxt_andq_M0_wRn(rd1);
+        gen_op_iwmmxt_setpsr_nz();
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x810: case 0xa10:				/* WMADD */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 0) & 0xf;
+        rd1 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        if (insn & (1 << 21))
+            gen_op_iwmmxt_maddsq_M0_wRn(rd1);
+        else
+            gen_op_iwmmxt_madduq_M0_wRn(rd1);
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x10e: case 0x50e: case 0x90e: case 0xd0e:	/* WUNPCKIL */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            gen_op_iwmmxt_unpacklb_M0_wRn(rd1);
+            break;
+        case 1:
+            gen_op_iwmmxt_unpacklw_M0_wRn(rd1);
+            break;
+        case 2:
+            gen_op_iwmmxt_unpackll_M0_wRn(rd1);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x10c: case 0x50c: case 0x90c: case 0xd0c:	/* WUNPCKIH */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            gen_op_iwmmxt_unpackhb_M0_wRn(rd1);
+            break;
+        case 1:
+            gen_op_iwmmxt_unpackhw_M0_wRn(rd1);
+            break;
+        case 2:
+            gen_op_iwmmxt_unpackhl_M0_wRn(rd1);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x012: case 0x112: case 0x412: case 0x512:	/* WSAD */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        if (insn & (1 << 22))
+            gen_op_iwmmxt_sadw_M0_wRn(rd1);
+        else
+            gen_op_iwmmxt_sadb_M0_wRn(rd1);
+        if (!(insn & (1 << 20)))
+            gen_op_iwmmxt_addl_M0_wRn(wrd);
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x010: case 0x110: case 0x210: case 0x310:	/* WMUL */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        if (insn & (1 << 21)) {
+            if (insn & (1 << 20))
+                gen_op_iwmmxt_mulshw_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_mulslw_M0_wRn(rd1);
+        } else {
+            if (insn & (1 << 20))
+                gen_op_iwmmxt_muluhw_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_mululw_M0_wRn(rd1);
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x410: case 0x510: case 0x610: case 0x710:	/* WMAC */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        if (insn & (1 << 21))
+            gen_op_iwmmxt_macsw_M0_wRn(rd1);
+        else
+            gen_op_iwmmxt_macuw_M0_wRn(rd1);
+        if (!(insn & (1 << 20))) {
+            iwmmxt_load_reg(cpu_V1, wrd);
+            tcg_gen_add_i64(cpu_M0, cpu_M0, cpu_V1);
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x006: case 0x406: case 0x806: case 0xc06:	/* WCMPEQ */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            gen_op_iwmmxt_cmpeqb_M0_wRn(rd1);
+            break;
+        case 1:
+            gen_op_iwmmxt_cmpeqw_M0_wRn(rd1);
+            break;
+        case 2:
+            gen_op_iwmmxt_cmpeql_M0_wRn(rd1);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x800: case 0x900: case 0xc00: case 0xd00:	/* WAVG2 */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        if (insn & (1 << 22)) {
+            if (insn & (1 << 20))
+                gen_op_iwmmxt_avgw1_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_avgw0_M0_wRn(rd1);
+        } else {
+            if (insn & (1 << 20))
+                gen_op_iwmmxt_avgb1_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_avgb0_M0_wRn(rd1);
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x802: case 0x902: case 0xa02: case 0xb02:	/* WALIGNR */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        gen_op_iwmmxt_movl_T0_wCx(ARM_IWMMXT_wCGR0 + ((insn >> 20) & 3));
+        gen_op_movl_T1_im(7);
+        gen_op_andl_T0_T1();
+        gen_op_iwmmxt_align_M0_T0_wRn(rd1);
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x601: case 0x605: case 0x609: case 0x60d:	/* TINSR */
+        rd = (insn >> 12) & 0xf;
+        wrd = (insn >> 16) & 0xf;
+        gen_movl_T0_reg(s, rd);
+        gen_op_iwmmxt_movq_M0_wRn(wrd);
+        switch ((insn >> 6) & 3) {
+        case 0:
+            gen_op_movl_T1_im(0xff);
+            gen_op_iwmmxt_insr_M0_T0_T1((insn & 7) << 3);
+            break;
+        case 1:
+            gen_op_movl_T1_im(0xffff);
+            gen_op_iwmmxt_insr_M0_T0_T1((insn & 3) << 4);
+            break;
+        case 2:
+            gen_op_movl_T1_im(0xffffffff);
+            gen_op_iwmmxt_insr_M0_T0_T1((insn & 1) << 5);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x107: case 0x507: case 0x907: case 0xd07:	/* TEXTRM */
+        rd = (insn >> 12) & 0xf;
+        wrd = (insn >> 16) & 0xf;
+        if (rd == 15)
+            return 1;
+        gen_op_iwmmxt_movq_M0_wRn(wrd);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            if (insn & 8)
+                gen_op_iwmmxt_extrsb_T0_M0((insn & 7) << 3);
+            else {
+                gen_op_iwmmxt_extru_T0_M0((insn & 7) << 3, 0xff);
+            }
+            break;
+        case 1:
+            if (insn & 8)
+                gen_op_iwmmxt_extrsw_T0_M0((insn & 3) << 4);
+            else {
+                gen_op_iwmmxt_extru_T0_M0((insn & 3) << 4, 0xffff);
+            }
+            break;
+        case 2:
+            gen_op_iwmmxt_extru_T0_M0((insn & 1) << 5, ~0u);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_movl_reg_T0(s, rd);
+        break;
+    case 0x117: case 0x517: case 0x917: case 0xd17:	/* TEXTRC */
+        if ((insn & 0x000ff008) != 0x0003f000)
+            return 1;
+        gen_op_iwmmxt_movl_T1_wCx(ARM_IWMMXT_wCASF);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            gen_op_shrl_T1_im(((insn & 7) << 2) + 0);
+            break;
+        case 1:
+            gen_op_shrl_T1_im(((insn & 3) << 3) + 4);
+            break;
+        case 2:
+            gen_op_shrl_T1_im(((insn & 1) << 4) + 12);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_shll_T1_im(28);
+        gen_set_nzcv(cpu_T[1]);
+        break;
+    case 0x401: case 0x405: case 0x409: case 0x40d:	/* TBCST */
+        rd = (insn >> 12) & 0xf;
+        wrd = (insn >> 16) & 0xf;
+        gen_movl_T0_reg(s, rd);
+        switch ((insn >> 6) & 3) {
+        case 0:
+            gen_helper_iwmmxt_bcstb(cpu_M0, cpu_T[0]);
+            break;
+        case 1:
+            gen_helper_iwmmxt_bcstw(cpu_M0, cpu_T[0]);
+            break;
+        case 2:
+            gen_helper_iwmmxt_bcstl(cpu_M0, cpu_T[0]);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x113: case 0x513: case 0x913: case 0xd13:	/* TANDC */
+        if ((insn & 0x000ff00f) != 0x0003f000)
+            return 1;
+        gen_op_iwmmxt_movl_T1_wCx(ARM_IWMMXT_wCASF);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            for (i = 0; i < 7; i ++) {
+                gen_op_shll_T1_im(4);
+                gen_op_andl_T0_T1();
+            }
+            break;
+        case 1:
+            for (i = 0; i < 3; i ++) {
+                gen_op_shll_T1_im(8);
+                gen_op_andl_T0_T1();
+            }
+            break;
+        case 2:
+            gen_op_shll_T1_im(16);
+            gen_op_andl_T0_T1();
+            break;
+        case 3:
+            return 1;
+        }
+        gen_set_nzcv(cpu_T[0]);
+        break;
+    case 0x01c: case 0x41c: case 0x81c: case 0xc1c:	/* WACC */
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            gen_helper_iwmmxt_addcb(cpu_M0, cpu_M0);
+            break;
+        case 1:
+            gen_helper_iwmmxt_addcw(cpu_M0, cpu_M0);
+            break;
+        case 2:
+            gen_helper_iwmmxt_addcl(cpu_M0, cpu_M0);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x115: case 0x515: case 0x915: case 0xd15:	/* TORC */
+        if ((insn & 0x000ff00f) != 0x0003f000)
+            return 1;
+        gen_op_iwmmxt_movl_T1_wCx(ARM_IWMMXT_wCASF);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            for (i = 0; i < 7; i ++) {
+                gen_op_shll_T1_im(4);
+                gen_op_orl_T0_T1();
+            }
+            break;
+        case 1:
+            for (i = 0; i < 3; i ++) {
+                gen_op_shll_T1_im(8);
+                gen_op_orl_T0_T1();
+            }
+            break;
+        case 2:
+            gen_op_shll_T1_im(16);
+            gen_op_orl_T0_T1();
+            break;
+        case 3:
+            return 1;
+        }
+        gen_set_nzcv(cpu_T[0]);
+        break;
+    case 0x103: case 0x503: case 0x903: case 0xd03:	/* TMOVMSK */
+        rd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        if ((insn & 0xf) != 0)
+            return 1;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            gen_helper_iwmmxt_msbb(cpu_T[0], cpu_M0);
+            break;
+        case 1:
+            gen_helper_iwmmxt_msbw(cpu_T[0], cpu_M0);
+            break;
+        case 2:
+            gen_helper_iwmmxt_msbl(cpu_T[0], cpu_M0);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_movl_reg_T0(s, rd);
+        break;
+    case 0x106: case 0x306: case 0x506: case 0x706:	/* WCMPGT */
+    case 0x906: case 0xb06: case 0xd06: case 0xf06:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_cmpgtsb_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_cmpgtub_M0_wRn(rd1);
+            break;
+        case 1:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_cmpgtsw_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_cmpgtuw_M0_wRn(rd1);
+            break;
+        case 2:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_cmpgtsl_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_cmpgtul_M0_wRn(rd1);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x00e: case 0x20e: case 0x40e: case 0x60e:	/* WUNPCKEL */
+    case 0x80e: case 0xa0e: case 0xc0e: case 0xe0e:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_unpacklsb_M0();
+            else
+                gen_op_iwmmxt_unpacklub_M0();
+            break;
+        case 1:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_unpacklsw_M0();
+            else
+                gen_op_iwmmxt_unpackluw_M0();
+            break;
+        case 2:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_unpacklsl_M0();
+            else
+                gen_op_iwmmxt_unpacklul_M0();
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x00c: case 0x20c: case 0x40c: case 0x60c:	/* WUNPCKEH */
+    case 0x80c: case 0xa0c: case 0xc0c: case 0xe0c:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_unpackhsb_M0();
+            else
+                gen_op_iwmmxt_unpackhub_M0();
+            break;
+        case 1:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_unpackhsw_M0();
+            else
+                gen_op_iwmmxt_unpackhuw_M0();
+            break;
+        case 2:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_unpackhsl_M0();
+            else
+                gen_op_iwmmxt_unpackhul_M0();
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x204: case 0x604: case 0xa04: case 0xe04:	/* WSRL */
+    case 0x214: case 0x614: case 0xa14: case 0xe14:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        if (gen_iwmmxt_shift(insn, 0xff))
+            return 1;
+        switch ((insn >> 22) & 3) {
+        case 0:
+            return 1;
+        case 1:
+            gen_helper_iwmmxt_srlw(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        case 2:
+            gen_helper_iwmmxt_srll(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        case 3:
+            gen_helper_iwmmxt_srlq(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x004: case 0x404: case 0x804: case 0xc04:	/* WSRA */
+    case 0x014: case 0x414: case 0x814: case 0xc14:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        if (gen_iwmmxt_shift(insn, 0xff))
+            return 1;
+        switch ((insn >> 22) & 3) {
+        case 0:
+            return 1;
+        case 1:
+            gen_helper_iwmmxt_sraw(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        case 2:
+            gen_helper_iwmmxt_sral(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        case 3:
+            gen_helper_iwmmxt_sraq(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x104: case 0x504: case 0x904: case 0xd04:	/* WSLL */
+    case 0x114: case 0x514: case 0x914: case 0xd14:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        if (gen_iwmmxt_shift(insn, 0xff))
+            return 1;
+        switch ((insn >> 22) & 3) {
+        case 0:
+            return 1;
+        case 1:
+            gen_helper_iwmmxt_sllw(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        case 2:
+            gen_helper_iwmmxt_slll(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        case 3:
+            gen_helper_iwmmxt_sllq(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x304: case 0x704: case 0xb04: case 0xf04:	/* WROR */
+    case 0x314: case 0x714: case 0xb14: case 0xf14:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            return 1;
+        case 1:
+            if (gen_iwmmxt_shift(insn, 0xf))
+                return 1;
+            gen_helper_iwmmxt_rorw(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        case 2:
+            if (gen_iwmmxt_shift(insn, 0x1f))
+                return 1;
+            gen_helper_iwmmxt_rorl(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        case 3:
+            if (gen_iwmmxt_shift(insn, 0x3f))
+                return 1;
+            gen_helper_iwmmxt_rorq(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+            break;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x116: case 0x316: case 0x516: case 0x716:	/* WMIN */
+    case 0x916: case 0xb16: case 0xd16: case 0xf16:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_minsb_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_minub_M0_wRn(rd1);
+            break;
+        case 1:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_minsw_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_minuw_M0_wRn(rd1);
+            break;
+        case 2:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_minsl_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_minul_M0_wRn(rd1);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x016: case 0x216: case 0x416: case 0x616:	/* WMAX */
+    case 0x816: case 0xa16: case 0xc16: case 0xe16:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 22) & 3) {
+        case 0:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_maxsb_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_maxub_M0_wRn(rd1);
+            break;
+        case 1:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_maxsw_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_maxuw_M0_wRn(rd1);
+            break;
+        case 2:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_maxsl_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_maxul_M0_wRn(rd1);
+            break;
+        case 3:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x002: case 0x102: case 0x202: case 0x302:	/* WALIGNI */
+    case 0x402: case 0x502: case 0x602: case 0x702:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        gen_op_movl_T0_im((insn >> 20) & 3);
+        gen_op_iwmmxt_align_M0_T0_wRn(rd1);
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    case 0x01a: case 0x11a: case 0x21a: case 0x31a:	/* WSUB */
+    case 0x41a: case 0x51a: case 0x61a: case 0x71a:
+    case 0x81a: case 0x91a: case 0xa1a: case 0xb1a:
+    case 0xc1a: case 0xd1a: case 0xe1a: case 0xf1a:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 20) & 0xf) {
+        case 0x0:
+            gen_op_iwmmxt_subnb_M0_wRn(rd1);
+            break;
+        case 0x1:
+            gen_op_iwmmxt_subub_M0_wRn(rd1);
+            break;
+        case 0x3:
+            gen_op_iwmmxt_subsb_M0_wRn(rd1);
+            break;
+        case 0x4:
+            gen_op_iwmmxt_subnw_M0_wRn(rd1);
+            break;
+        case 0x5:
+            gen_op_iwmmxt_subuw_M0_wRn(rd1);
+            break;
+        case 0x7:
+            gen_op_iwmmxt_subsw_M0_wRn(rd1);
+            break;
+        case 0x8:
+            gen_op_iwmmxt_subnl_M0_wRn(rd1);
+            break;
+        case 0x9:
+            gen_op_iwmmxt_subul_M0_wRn(rd1);
+            break;
+        case 0xb:
+            gen_op_iwmmxt_subsl_M0_wRn(rd1);
+            break;
+        default:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x01e: case 0x11e: case 0x21e: case 0x31e:	/* WSHUFH */
+    case 0x41e: case 0x51e: case 0x61e: case 0x71e:
+    case 0x81e: case 0x91e: case 0xa1e: case 0xb1e:
+    case 0xc1e: case 0xd1e: case 0xe1e: case 0xf1e:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        gen_op_movl_T0_im(((insn >> 16) & 0xf0) | (insn & 0x0f));
+        gen_helper_iwmmxt_shufh(cpu_M0, cpu_env, cpu_M0, cpu_T[0]);
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x018: case 0x118: case 0x218: case 0x318:	/* WADD */
+    case 0x418: case 0x518: case 0x618: case 0x718:
+    case 0x818: case 0x918: case 0xa18: case 0xb18:
+    case 0xc18: case 0xd18: case 0xe18: case 0xf18:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        switch ((insn >> 20) & 0xf) {
+        case 0x0:
+            gen_op_iwmmxt_addnb_M0_wRn(rd1);
+            break;
+        case 0x1:
+            gen_op_iwmmxt_addub_M0_wRn(rd1);
+            break;
+        case 0x3:
+            gen_op_iwmmxt_addsb_M0_wRn(rd1);
+            break;
+        case 0x4:
+            gen_op_iwmmxt_addnw_M0_wRn(rd1);
+            break;
+        case 0x5:
+            gen_op_iwmmxt_adduw_M0_wRn(rd1);
+            break;
+        case 0x7:
+            gen_op_iwmmxt_addsw_M0_wRn(rd1);
+            break;
+        case 0x8:
+            gen_op_iwmmxt_addnl_M0_wRn(rd1);
+            break;
+        case 0x9:
+            gen_op_iwmmxt_addul_M0_wRn(rd1);
+            break;
+        case 0xb:
+            gen_op_iwmmxt_addsl_M0_wRn(rd1);
+            break;
+        default:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x008: case 0x108: case 0x208: case 0x308:	/* WPACK */
+    case 0x408: case 0x508: case 0x608: case 0x708:
+    case 0x808: case 0x908: case 0xa08: case 0xb08:
+    case 0xc08: case 0xd08: case 0xe08: case 0xf08:
+        wrd = (insn >> 12) & 0xf;
+        rd0 = (insn >> 16) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        gen_op_iwmmxt_movq_M0_wRn(rd0);
+        if (!(insn & (1 << 20)))
+            return 1;
+        switch ((insn >> 22) & 3) {
+        case 0:
+            return 1;
+        case 1:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_packsw_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_packuw_M0_wRn(rd1);
+            break;
+        case 2:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_packsl_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_packul_M0_wRn(rd1);
+            break;
+        case 3:
+            if (insn & (1 << 21))
+                gen_op_iwmmxt_packsq_M0_wRn(rd1);
+            else
+                gen_op_iwmmxt_packuq_M0_wRn(rd1);
+            break;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        gen_op_iwmmxt_set_cup();
+        break;
+    case 0x201: case 0x203: case 0x205: case 0x207:
+    case 0x209: case 0x20b: case 0x20d: case 0x20f:
+    case 0x211: case 0x213: case 0x215: case 0x217:
+    case 0x219: case 0x21b: case 0x21d: case 0x21f:
+        wrd = (insn >> 5) & 0xf;
+        rd0 = (insn >> 12) & 0xf;
+        rd1 = (insn >> 0) & 0xf;
+        if (rd0 == 0xf || rd1 == 0xf)
+            return 1;
+        gen_op_iwmmxt_movq_M0_wRn(wrd);
+        switch ((insn >> 16) & 0xf) {
+        case 0x0:					/* TMIA */
+            gen_movl_T0_reg(s, rd0);
+            gen_movl_T1_reg(s, rd1);
+            gen_op_iwmmxt_muladdsl_M0_T0_T1();
+            break;
+        case 0x8:					/* TMIAPH */
+            gen_movl_T0_reg(s, rd0);
+            gen_movl_T1_reg(s, rd1);
+            gen_op_iwmmxt_muladdsw_M0_T0_T1();
+            break;
+        case 0xc: case 0xd: case 0xe: case 0xf:		/* TMIAxy */
+            gen_movl_T1_reg(s, rd0);
+            if (insn & (1 << 16))
+                gen_op_shrl_T1_im(16);
+            gen_op_movl_T0_T1();
+            gen_movl_T1_reg(s, rd1);
+            if (insn & (1 << 17))
+                gen_op_shrl_T1_im(16);
+            gen_op_iwmmxt_muladdswl_M0_T0_T1();
+            break;
+        default:
+            return 1;
+        }
+        gen_op_iwmmxt_movq_wRn_M0(wrd);
+        gen_op_iwmmxt_set_mup();
+        break;
+    default:
+        return 1;
+    }
+
+    return 0;
+}
+
+/* Disassemble an XScale DSP instruction.  Returns nonzero if an error occured
+   (ie. an undefined instruction).  */
+static int disas_dsp_insn(CPUState *env, DisasContext *s, uint32_t insn)
+{
+    int acc, rd0, rd1, rdhi, rdlo;
+
+    if ((insn & 0x0ff00f10) == 0x0e200010) {
+        /* Multiply with Internal Accumulate Format */
+        rd0 = (insn >> 12) & 0xf;
+        rd1 = insn & 0xf;
+        acc = (insn >> 5) & 7;
+
+        if (acc != 0)
+            return 1;
+
+        switch ((insn >> 16) & 0xf) {
+        case 0x0:					/* MIA */
+            gen_movl_T0_reg(s, rd0);
+            gen_movl_T1_reg(s, rd1);
+            gen_op_iwmmxt_muladdsl_M0_T0_T1();
+            break;
+        case 0x8:					/* MIAPH */
+            gen_movl_T0_reg(s, rd0);
+            gen_movl_T1_reg(s, rd1);
+            gen_op_iwmmxt_muladdsw_M0_T0_T1();
+            break;
+        case 0xc:					/* MIABB */
+        case 0xd:					/* MIABT */
+        case 0xe:					/* MIATB */
+        case 0xf:					/* MIATT */
+            gen_movl_T1_reg(s, rd0);
+            if (insn & (1 << 16))
+                gen_op_shrl_T1_im(16);
+            gen_op_movl_T0_T1();
+            gen_movl_T1_reg(s, rd1);
+            if (insn & (1 << 17))
+                gen_op_shrl_T1_im(16);
+            gen_op_iwmmxt_muladdswl_M0_T0_T1();
+            break;
+        default:
+            return 1;
+        }
+
+        gen_op_iwmmxt_movq_wRn_M0(acc);
+        return 0;
+    }
+
+    if ((insn & 0x0fe00ff8) == 0x0c400000) {
+        /* Internal Accumulator Access Format */
+        rdhi = (insn >> 16) & 0xf;
+        rdlo = (insn >> 12) & 0xf;
+        acc = insn & 7;
+
+        if (acc != 0)
+            return 1;
+
+        if (insn & ARM_CP_RW_BIT) {			/* MRA */
+            gen_iwmmxt_movl_T0_T1_wRn(acc);
+            gen_movl_reg_T0(s, rdlo);
+            gen_op_movl_T0_im((1 << (40 - 32)) - 1);
+            gen_op_andl_T0_T1();
+            gen_movl_reg_T0(s, rdhi);
+        } else {					/* MAR */
+            gen_movl_T0_reg(s, rdlo);
+            gen_movl_T1_reg(s, rdhi);
+            gen_iwmmxt_movl_wRn_T0_T1(acc);
+        }
+        return 0;
+    }
+
+    return 1;
+}
+
+/* Disassemble system coprocessor instruction.  Return nonzero if
+   instruction is not defined.  */
+static int disas_cp_insn(CPUState *env, DisasContext *s, uint32_t insn)
+{
+    TCGv tmp;
+    uint32_t rd = (insn >> 12) & 0xf;
+    uint32_t cp = (insn >> 8) & 0xf;
+    if (IS_USER(s)) {
+        return 1;
+    }
+
+    if (insn & ARM_CP_RW_BIT) {
+        if (!env->cp[cp].cp_read)
+            return 1;
+        gen_set_pc_im(s->pc);
+        tmp = new_tmp();
+        gen_helper_get_cp(tmp, cpu_env, tcg_const_i32(insn));
+        store_reg(s, rd, tmp);
+    } else {
+        if (!env->cp[cp].cp_write)
+            return 1;
+        gen_set_pc_im(s->pc);
+        tmp = load_reg(s, rd);
+        gen_helper_set_cp(cpu_env, tcg_const_i32(insn), tmp);
+        dead_tmp(tmp);
+    }
+    return 0;
+}
+
+static int cp15_user_ok(uint32_t insn)
+{
+    int cpn = (insn >> 16) & 0xf;
+    int cpm = insn & 0xf;
+    int op = ((insn >> 5) & 7) | ((insn >> 18) & 0x38);
+
+    if (cpn == 13 && cpm == 0) {
+        /* TLS register.  */
+        if (op == 2 || (op == 3 && (insn & ARM_CP_RW_BIT)))
+            return 1;
+    }
+    if (cpn == 7) {
+        /* ISB, DSB, DMB.  */
+        if ((cpm == 5 && op == 4)
+                || (cpm == 10 && (op == 4 || op == 5)))
+            return 1;
+    }
+    return 0;
 }
 
 /* Disassemble system coprocessor (cp15) instruction.  Return nonzero if
    instruction is not defined.  */
-static int disas_cp15_insn(DisasContext *s, uint32_t insn)
+static int disas_cp15_insn(CPUState *env, DisasContext *s, uint32_t insn)
 {
     uint32_t rd;
+    TCGv tmp;
 
-    /* ??? Some cp15 registers are accessible from userspace.  */
-    if (IS_USER(s)) {
+    /* M profile cores use memory mapped registers instead of cp15.  */
+    if (arm_feature(env, ARM_FEATURE_M))
+	return 1;
+
+    if ((insn & (1 << 25)) == 0) {
+        if (insn & (1 << 20)) {
+            /* mrrc */
+            return 1;
+        }
+        /* mcrr.  Used for block cache operations, so implement as no-op.  */
+        return 0;
+    }
+    if ((insn & (1 << 4)) == 0) {
+        /* cdp */
+        return 1;
+    }
+    if (IS_USER(s) && !cp15_user_ok(insn)) {
         return 1;
     }
     if ((insn & 0x0fff0fff) == 0x0e070f90
         || (insn & 0x0fff0fff) == 0x0e070f58) {
         /* Wait for interrupt.  */
-        gen_op_movl_T0_im((long)s->pc);
-        gen_op_movl_reg_TN[0][15]();
-        gen_op_wfi();
-        s->is_jmp = DISAS_JUMP;
+        gen_set_pc_im(s->pc);
+        s->is_jmp = DISAS_WFI;
         return 0;
     }
     rd = (insn >> 12) & 0xf;
-    if (insn & (1 << 20)) {
-        gen_op_movl_T0_cp15(insn);
+    if (insn & ARM_CP_RW_BIT) {
+        tmp = new_tmp();
+        gen_helper_get_cp15(tmp, cpu_env, tcg_const_i32(insn));
         /* If the destination register is r15 then sets condition codes.  */
         if (rd != 15)
-            gen_movl_reg_T0(s, rd);
+            store_reg(s, rd, tmp);
+        else
+            dead_tmp(tmp);
     } else {
-        gen_movl_T0_reg(s, rd);
-        gen_op_movl_cp15_T0(insn);
+        tmp = load_reg(s, rd);
+        gen_helper_set_cp15(cpu_env, tcg_const_i32(insn), tmp);
+        dead_tmp(tmp);
+        /* Normally we would always end the TB here, but Linux
+         * arch/arm/mach-pxa/sleep.S expects two instructions following
+         * an MMU enable to execute from cache.  Imitate this behaviour.  */
+        if (!arm_feature(env, ARM_FEATURE_XSCALE) ||
+                (insn & 0x0fff0fff) != 0x0e010f10)
+            gen_lookup_tb(s);
     }
-    gen_lookup_tb(s);
     return 0;
 }
 
+#define VFP_REG_SHR(x, n) (((n) > 0) ? (x) >> (n) : (x) << -(n))
+#define VFP_SREG(insn, bigbit, smallbit) \
+  ((VFP_REG_SHR(insn, bigbit - 1) & 0x1e) | (((insn) >> (smallbit)) & 1))
+#define VFP_DREG(reg, insn, bigbit, smallbit) do { \
+    if (arm_feature(env, ARM_FEATURE_VFP3)) { \
+        reg = (((insn) >> (bigbit)) & 0x0f) \
+              | (((insn) >> ((smallbit) - 4)) & 0x10); \
+    } else { \
+        if (insn & (1 << (smallbit))) \
+            return 1; \
+        reg = ((insn) >> (bigbit)) & 0x0f; \
+    }} while (0)
+
+#define VFP_SREG_D(insn) VFP_SREG(insn, 12, 22)
+#define VFP_DREG_D(reg, insn) VFP_DREG(reg, insn, 12, 22)
+#define VFP_SREG_N(insn) VFP_SREG(insn, 16,  7)
+#define VFP_DREG_N(reg, insn) VFP_DREG(reg, insn, 16,  7)
+#define VFP_SREG_M(insn) VFP_SREG(insn,  0,  5)
+#define VFP_DREG_M(reg, insn) VFP_DREG(reg, insn,  0,  5)
+
+/* Move between integer and VFP cores.  */
+static TCGv gen_vfp_mrs(void)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_mov_i32(tmp, cpu_F0s);
+    return tmp;
+}
+
+static void gen_vfp_msr(TCGv tmp)
+{
+    tcg_gen_mov_i32(cpu_F0s, tmp);
+    dead_tmp(tmp);
+}
+
+static inline int
+vfp_enabled(CPUState * env)
+{
+    return ((env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) != 0);
+}
+
+static void gen_neon_dup_u8(TCGv var, int shift)
+{
+    TCGv tmp = new_tmp();
+    if (shift)
+        tcg_gen_shri_i32(var, var, shift);
+    tcg_gen_ext8u_i32(var, var);
+    tcg_gen_shli_i32(tmp, var, 8);
+    tcg_gen_or_i32(var, var, tmp);
+    tcg_gen_shli_i32(tmp, var, 16);
+    tcg_gen_or_i32(var, var, tmp);
+    dead_tmp(tmp);
+}
+
+static void gen_neon_dup_low16(TCGv var)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_ext16u_i32(var, var);
+    tcg_gen_shli_i32(tmp, var, 16);
+    tcg_gen_or_i32(var, var, tmp);
+    dead_tmp(tmp);
+}
+
+static void gen_neon_dup_high16(TCGv var)
+{
+    TCGv tmp = new_tmp();
+    tcg_gen_andi_i32(var, var, 0xffff0000);
+    tcg_gen_shri_i32(tmp, var, 16);
+    tcg_gen_or_i32(var, var, tmp);
+    dead_tmp(tmp);
+}
+
 /* Disassemble a VFP instruction.  Returns nonzero if an error occured
    (ie. an undefined instruction).  */
 static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
 {
     uint32_t rd, rn, rm, op, i, n, offset, delta_d, delta_m, bank_mask;
     int dp, veclen;
+    TCGv tmp;
+    TCGv tmp2;
 
     if (!arm_feature(env, ARM_FEATURE_VFP))
         return 1;
 
-    if ((env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) == 0) {
-        /* VFP disabled.  Only allow fmxr/fmrx to/from fpexc and fpsid.  */
+    if (!vfp_enabled(env)) {
+        /* VFP disabled.  Only allow fmxr/fmrx to/from some control regs.  */
         if ((insn & 0x0fe00fff) != 0x0ee00a10)
             return 1;
         rn = (insn >> 16) & 0xf;
-        if (rn != 0 && rn != 8)
+        if (rn != ARM_VFP_FPSID && rn != ARM_VFP_FPEXC
+            && rn != ARM_VFP_MVFR1 && rn != ARM_VFP_MVFR0)
             return 1;
     }
     dp = ((insn & 0xf00) == 0xb00);
@@ -562,91 +2783,188 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
     case 0xe:
         if (insn & (1 << 4)) {
             /* single register transfer */
-            if ((insn & 0x6f) != 0x00)
-                return 1;
             rd = (insn >> 12) & 0xf;
             if (dp) {
-                if (insn & 0x80)
+                int size;
+                int pass;
+
+                VFP_DREG_N(rn, insn);
+                if (insn & 0xf)
                     return 1;
-                rn = (insn >> 16) & 0xf;
-                /* Get the existing value even for arm->vfp moves because
-                   we only set half the register.  */
-                gen_mov_F0_vreg(1, rn);
-                gen_op_vfp_mrrd();
-                if (insn & (1 << 20)) {
+                if (insn & 0x00c00060
+                    && !arm_feature(env, ARM_FEATURE_NEON))
+                    return 1;
+
+                pass = (insn >> 21) & 1;
+                if (insn & (1 << 22)) {
+                    size = 0;
+                    offset = ((insn >> 5) & 3) * 8;
+                } else if (insn & (1 << 5)) {
+                    size = 1;
+                    offset = (insn & (1 << 6)) ? 16 : 0;
+                } else {
+                    size = 2;
+                    offset = 0;
+                }
+                if (insn & ARM_CP_RW_BIT) {
                     /* vfp->arm */
-                    if (insn & (1 << 21))
-                        gen_movl_reg_T1(s, rd);
-                    else
-                        gen_movl_reg_T0(s, rd);
+                    tmp = neon_load_reg(rn, pass);
+                    switch (size) {
+                    case 0:
+                        if (offset)
+                            tcg_gen_shri_i32(tmp, tmp, offset);
+                        if (insn & (1 << 23))
+                            gen_uxtb(tmp);
+                        else
+                            gen_sxtb(tmp);
+                        break;
+                    case 1:
+                        if (insn & (1 << 23)) {
+                            if (offset) {
+                                tcg_gen_shri_i32(tmp, tmp, 16);
+                            } else {
+                                gen_uxth(tmp);
+                            }
+                        } else {
+                            if (offset) {
+                                tcg_gen_sari_i32(tmp, tmp, 16);
+                            } else {
+                                gen_sxth(tmp);
+                            }
+                        }
+                        break;
+                    case 2:
+                        break;
+                    }
+                    store_reg(s, rd, tmp);
                 } else {
                     /* arm->vfp */
-                    if (insn & (1 << 21))
-                        gen_movl_T1_reg(s, rd);
-                    else
-                        gen_movl_T0_reg(s, rd);
-                    gen_op_vfp_mdrr();
-                    gen_mov_vreg_F0(dp, rn);
+                    tmp = load_reg(s, rd);
+                    if (insn & (1 << 23)) {
+                        /* VDUP */
+                        if (size == 0) {
+                            gen_neon_dup_u8(tmp, 0);
+                        } else if (size == 1) {
+                            gen_neon_dup_low16(tmp);
+                        }
+                        tmp2 = new_tmp();
+                        tcg_gen_mov_i32(tmp2, tmp);
+                        neon_store_reg(rn, 0, tmp2);
+                        neon_store_reg(rn, 0, tmp);
+                    } else {
+                        /* VMOV */
+                        switch (size) {
+                        case 0:
+                            tmp2 = neon_load_reg(rn, pass);
+                            gen_bfi(tmp, tmp2, tmp, offset, 0xff);
+                            dead_tmp(tmp2);
+                            break;
+                        case 1:
+                            tmp2 = neon_load_reg(rn, pass);
+                            gen_bfi(tmp, tmp2, tmp, offset, 0xffff);
+                            dead_tmp(tmp2);
+                            break;
+                        case 2:
+                            break;
+                        }
+                        neon_store_reg(rn, pass, tmp);
+                    }
                 }
-            } else {
-                rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
-                if (insn & (1 << 20)) {
+            } else { /* !dp */
+                if ((insn & 0x6f) != 0x00)
+                    return 1;
+                rn = VFP_SREG_N(insn);
+                if (insn & ARM_CP_RW_BIT) {
                     /* vfp->arm */
                     if (insn & (1 << 21)) {
                         /* system register */
                         rn >>= 1;
+
                         switch (rn) {
                         case ARM_VFP_FPSID:
+                            /* VFP2 allows access to FSID from userspace.
+                               VFP3 restricts all id registers to privileged
+                               accesses.  */
+                            if (IS_USER(s)
+                                && arm_feature(env, ARM_FEATURE_VFP3))
+                                return 1;
+                            tmp = load_cpu_field(vfp.xregs[rn]);
+                            break;
                         case ARM_VFP_FPEXC:
+                            if (IS_USER(s))
+                                return 1;
+                            tmp = load_cpu_field(vfp.xregs[rn]);
+                            break;
                         case ARM_VFP_FPINST:
                         case ARM_VFP_FPINST2:
-                            gen_op_vfp_movl_T0_xreg(rn);
+                            /* Not present in VFP3.  */
+                            if (IS_USER(s)
+                                || arm_feature(env, ARM_FEATURE_VFP3))
+                                return 1;
+                            tmp = load_cpu_field(vfp.xregs[rn]);
                             break;
                         case ARM_VFP_FPSCR:
-			    if (rd == 15)
-				gen_op_vfp_movl_T0_fpscr_flags();
-			    else
-				gen_op_vfp_movl_T0_fpscr();
+                            if (rd == 15) {
+                                tmp = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
+                                tcg_gen_andi_i32(tmp, tmp, 0xf0000000);
+                            } else {
+                                tmp = new_tmp();
+                                gen_helper_vfp_get_fpscr(tmp, cpu_env);
+                            }
+                            break;
+                        case ARM_VFP_MVFR0:
+                        case ARM_VFP_MVFR1:
+                            if (IS_USER(s)
+                                || !arm_feature(env, ARM_FEATURE_VFP3))
+                                return 1;
+                            tmp = load_cpu_field(vfp.xregs[rn]);
                             break;
                         default:
                             return 1;
                         }
                     } else {
                         gen_mov_F0_vreg(0, rn);
-                        gen_op_vfp_mrs();
+                        tmp = gen_vfp_mrs();
                     }
                     if (rd == 15) {
                         /* Set the 4 flag bits in the CPSR.  */
-                        gen_op_movl_cpsr_T0(0xf0000000);
-                    } else
-                        gen_movl_reg_T0(s, rd);
+                        gen_set_nzcv(tmp);
+                        dead_tmp(tmp);
+                    } else {
+                        store_reg(s, rd, tmp);
+                    }
                 } else {
                     /* arm->vfp */
-                    gen_movl_T0_reg(s, rd);
+                    tmp = load_reg(s, rd);
                     if (insn & (1 << 21)) {
                         rn >>= 1;
                         /* system register */
                         switch (rn) {
                         case ARM_VFP_FPSID:
+                        case ARM_VFP_MVFR0:
+                        case ARM_VFP_MVFR1:
                             /* Writes are ignored.  */
                             break;
                         case ARM_VFP_FPSCR:
-                            gen_op_vfp_movl_fpscr_T0();
+                            gen_helper_vfp_set_fpscr(cpu_env, tmp);
+                            dead_tmp(tmp);
                             gen_lookup_tb(s);
                             break;
                         case ARM_VFP_FPEXC:
-                            gen_op_vfp_movl_xreg_T0(rn);
+                            if (IS_USER(s))
+                                return 1;
+                            store_cpu_field(tmp, vfp.xregs[rn]);
                             gen_lookup_tb(s);
                             break;
                         case ARM_VFP_FPINST:
                         case ARM_VFP_FPINST2:
-                            gen_op_vfp_movl_xreg_T0(rn);
+                            store_cpu_field(tmp, vfp.xregs[rn]);
                             break;
                         default:
                             return 1;
                         }
                     } else {
-                        gen_op_vfp_msr();
+                        gen_vfp_msr(tmp);
                         gen_mov_vreg_F0(0, rn);
                     }
                 }
@@ -661,38 +2979,31 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                     rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
                 } else {
                     /* rn is register number */
-                    if (insn & (1 << 7))
-                        return 1;
-                    rn = (insn >> 16) & 0xf;
+                    VFP_DREG_N(rn, insn);
                 }
 
                 if (op == 15 && (rn == 15 || rn > 17)) {
                     /* Integer or single precision destination.  */
-                    rd = ((insn >> 11) & 0x1e) | ((insn >> 22) & 1);
+                    rd = VFP_SREG_D(insn);
                 } else {
-                    if (insn & (1 << 22))
-                        return 1;
-                    rd = (insn >> 12) & 0xf;
+                    VFP_DREG_D(rd, insn);
                 }
 
                 if (op == 15 && (rn == 16 || rn == 17)) {
                     /* Integer source.  */
                     rm = ((insn << 1) & 0x1e) | ((insn >> 5) & 1);
                 } else {
-                    if (insn & (1 << 5))
-                        return 1;
-                    rm = insn & 0xf;
+                    VFP_DREG_M(rm, insn);
                 }
             } else {
-                rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
+                rn = VFP_SREG_N(insn);
                 if (op == 15 && rn == 15) {
                     /* Double precision destination.  */
-                    if (insn & (1 << 22))
-                        return 1;
-                    rd = (insn >> 12) & 0xf;
-                } else
-                    rd = ((insn >> 11) & 0x1e) | ((insn >> 22) & 1);
-                rm = ((insn << 1) & 0x1e) | ((insn >> 5) & 1);
+                    VFP_DREG_D(rd, insn);
+                } else {
+                    rd = VFP_SREG_D(insn);
+                }
+                rm = VFP_SREG_M(insn);
             }
 
             veclen = env->vfp.vec_len;
@@ -750,9 +3061,17 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                     gen_mov_F0_vreg(dp, rd);
                     gen_vfp_F1_ld0(dp);
                     break;
+                case 20:
+                case 21:
+                case 22:
+                case 23:
+                    /* Source and destination the same.  */
+                    gen_mov_F0_vreg(dp, rd);
+                    break;
                 default:
                     /* One source operand.  */
                     gen_mov_F0_vreg(dp, rm);
+                    break;
                 }
             } else {
                 /* Two source operands.  */
@@ -801,6 +3120,28 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                 case 8: /* div: fn / fm */
                     gen_vfp_div(dp);
                     break;
+                case 14: /* fconst */
+                    if (!arm_feature(env, ARM_FEATURE_VFP3))
+                      return 1;
+
+                    n = (insn << 12) & 0x80000000;
+                    i = ((insn >> 12) & 0x70) | (insn & 0xf);
+                    if (dp) {
+                        if (i & 0x40)
+                            i |= 0x3f80;
+                        else
+                            i |= 0x4000;
+                        n |= i << 16;
+                        tcg_gen_movi_i64(cpu_F0d, ((uint64_t)n) << 32);
+                    } else {
+                        if (i & 0x40)
+                            i |= 0x780;
+                        else
+                            i |= 0x800;
+                        n |= i << 19;
+                        tcg_gen_movi_i32(cpu_F0s, n);
+                    }
+                    break;
                 case 15: /* extension space */
                     switch (rn) {
                     case 0: /* cpy */
@@ -830,9 +3171,9 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                         break;
                     case 15: /* single<->double conversion */
                         if (dp)
-                            gen_op_vfp_fcvtsd();
+                            gen_helper_vfp_fcvtsd(cpu_F0s, cpu_F0d, cpu_env);
                         else
-                            gen_op_vfp_fcvtds();
+                            gen_helper_vfp_fcvtds(cpu_F0d, cpu_F0s, cpu_env);
                         break;
                     case 16: /* fuito */
                         gen_vfp_uito(dp);
@@ -840,6 +3181,26 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                     case 17: /* fsito */
                         gen_vfp_sito(dp);
                         break;
+                    case 20: /* fshto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_shto(dp, rm);
+                        break;
+                    case 21: /* fslto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_slto(dp, rm);
+                        break;
+                    case 22: /* fuhto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_uhto(dp, rm);
+                        break;
+                    case 23: /* fulto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_ulto(dp, rm);
+                        break;
                     case 24: /* ftoui */
                         gen_vfp_toui(dp);
                         break;
@@ -852,6 +3213,26 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                     case 27: /* ftosiz */
                         gen_vfp_tosiz(dp);
                         break;
+                    case 28: /* ftosh */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_tosh(dp, rm);
+                        break;
+                    case 29: /* ftosl */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_tosl(dp, rm);
+                        break;
+                    case 30: /* ftouh */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_touh(dp, rm);
+                        break;
+                    case 31: /* ftoul */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_toul(dp, rm);
+                        break;
                     default: /* undefined */
                         printf ("rn:%d\n", rn);
                         return 1;
@@ -913,45 +3294,48 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
         break;
     case 0xc:
     case 0xd:
-        if (dp && (insn & (1 << 22))) {
+        if (dp && (insn & 0x03e00000) == 0x00400000) {
             /* two-register transfer */
             rn = (insn >> 16) & 0xf;
             rd = (insn >> 12) & 0xf;
             if (dp) {
-                if (insn & (1 << 5))
-                    return 1;
-                rm = insn & 0xf;
-            } else
-                rm = ((insn << 1) & 0x1e) | ((insn >> 5) & 1);
+                VFP_DREG_M(rm, insn);
+            } else {
+                rm = VFP_SREG_M(insn);
+            }
 
-            if (insn & (1 << 20)) {
+            if (insn & ARM_CP_RW_BIT) {
                 /* vfp->arm */
                 if (dp) {
-                    gen_mov_F0_vreg(1, rm);
-                    gen_op_vfp_mrrd();
-                    gen_movl_reg_T0(s, rd);
-                    gen_movl_reg_T1(s, rn);
+                    gen_mov_F0_vreg(0, rm * 2);
+                    tmp = gen_vfp_mrs();
+                    store_reg(s, rd, tmp);
+                    gen_mov_F0_vreg(0, rm * 2 + 1);
+                    tmp = gen_vfp_mrs();
+                    store_reg(s, rn, tmp);
                 } else {
                     gen_mov_F0_vreg(0, rm);
-                    gen_op_vfp_mrs();
-                    gen_movl_reg_T0(s, rn);
+                    tmp = gen_vfp_mrs();
+                    store_reg(s, rn, tmp);
                     gen_mov_F0_vreg(0, rm + 1);
-                    gen_op_vfp_mrs();
-                    gen_movl_reg_T0(s, rd);
+                    tmp = gen_vfp_mrs();
+                    store_reg(s, rd, tmp);
                 }
             } else {
                 /* arm->vfp */
                 if (dp) {
-                    gen_movl_T0_reg(s, rd);
-                    gen_movl_T1_reg(s, rn);
-                    gen_op_vfp_mdrr();
-                    gen_mov_vreg_F0(1, rm);
+                    tmp = load_reg(s, rd);
+                    gen_vfp_msr(tmp);
+                    gen_mov_vreg_F0(0, rm * 2);
+                    tmp = load_reg(s, rn);
+                    gen_vfp_msr(tmp);
+                    gen_mov_vreg_F0(0, rm * 2 + 1);
                 } else {
-                    gen_movl_T0_reg(s, rn);
-                    gen_op_vfp_msr();
+                    tmp = load_reg(s, rn);
+                    gen_vfp_msr(tmp);
                     gen_mov_vreg_F0(0, rm);
-                    gen_movl_T0_reg(s, rd);
-                    gen_op_vfp_msr();
+                    tmp = load_reg(s, rd);
+                    gen_vfp_msr(tmp);
                     gen_mov_vreg_F0(0, rm + 1);
                 }
             }
@@ -959,10 +3343,14 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
             /* Load/store */
             rn = (insn >> 16) & 0xf;
             if (dp)
-                rd = (insn >> 12) & 0xf;
+                VFP_DREG_D(rd, insn);
             else
-                rd = ((insn >> 11) & 0x1e) | ((insn >> 22) & 1);
-            gen_movl_T1_reg(s, rn);
+                rd = VFP_SREG_D(insn);
+            if (s->thumb && rn == 15) {
+                gen_op_movl_T1_im(s->pc & ~2);
+            } else {
+                gen_movl_T1_reg(s, rn);
+            }
             if ((insn & 0x01200000) == 0x01000000) {
                 /* Single load/store */
                 offset = (insn & 0xff) << 2;
@@ -991,7 +3379,7 @@ static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
                 else
                     offset = 4;
                 for (i = 0; i < n; i++) {
-                    if (insn & (1 << 20)) {
+                    if (insn & ARM_CP_RW_BIT) {
                         /* load */
                         gen_vfp_ld(s, dp);
                         gen_mov_vreg_F0(dp, rd + i);
@@ -1031,51 +3419,43 @@ static inline void gen_goto_tb(DisasContext *s, int n, uint32_t dest)
 
     tb = s->tb;
     if ((tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK)) {
-        if (n == 0)
-            gen_op_goto_tb0(TBPARAM(tb));
-        else
-            gen_op_goto_tb1(TBPARAM(tb));
-        gen_op_movl_T0_im(dest);
-        gen_op_movl_r15_T0();
-        gen_op_movl_T0_im((long)tb + n);
-        gen_op_exit_tb();
+        tcg_gen_goto_tb(n);
+        gen_set_pc_im(dest);
+        tcg_gen_exit_tb((long)tb + n);
     } else {
-        gen_op_movl_T0_im(dest);
-        gen_op_movl_r15_T0();
-        gen_op_movl_T0_0();
-        gen_op_exit_tb();
+        gen_set_pc_im(dest);
+        tcg_gen_exit_tb(0);
     }
 }
 
 static inline void gen_jmp (DisasContext *s, uint32_t dest)
 {
-    if (__builtin_expect(s->singlestep_enabled, 0)) {
+    if (unlikely(s->singlestep_enabled)) {
         /* An indirect jump so that we still trigger the debug exception.  */
         if (s->thumb)
-          dest |= 1;
-        gen_op_movl_T0_im(dest);
-        gen_bx(s);
+            dest |= 1;
+        gen_bx_im(s, dest);
     } else {
         gen_goto_tb(s, 0, dest);
         s->is_jmp = DISAS_TB_JUMP;
     }
 }
 
-static inline void gen_mulxy(int x, int y)
+static inline void gen_mulxy(TCGv t0, TCGv t1, int x, int y)
 {
     if (x)
-        gen_op_sarl_T0_im(16);
+        tcg_gen_sari_i32(t0, t0, 16);
     else
-        gen_op_sxth_T0();
+        gen_sxth(t0);
     if (y)
-        gen_op_sarl_T1_im(16);
+        tcg_gen_sari_i32(t1, t1, 16);
     else
-        gen_op_sxth_T1();
-    gen_op_mul_T0_T1();
+        gen_sxth(t1);
+    tcg_gen_mul_i32(t0, t0, t1);
 }
 
 /* Return the mask of PSR bits set by a MSR instruction.  */
-static uint32_t msr_mask(DisasContext *s, int flags, int spsr) {
+static uint32_t msr_mask(CPUState *env, DisasContext *s, int flags, int spsr) {
     uint32_t mask;
 
     mask = 0;
@@ -1087,130 +3467,2486 @@ static uint32_t msr_mask(DisasContext *s, int flags, int spsr) {
         mask |= 0xff0000;
     if (flags & (1 << 3))
         mask |= 0xff000000;
+
     /* Mask out undefined bits.  */
-    mask &= 0xf90f03ff;
-    /* Mask out state bits.  */
+    mask &= ~CPSR_RESERVED;
+    if (!arm_feature(env, ARM_FEATURE_V6))
+        mask &= ~(CPSR_E | CPSR_GE);
+    if (!arm_feature(env, ARM_FEATURE_THUMB2))
+        mask &= ~CPSR_IT;
+    /* Mask out execution state bits.  */
     if (!spsr)
-        mask &= ~0x01000020;
+        mask &= ~CPSR_EXEC;
     /* Mask out privileged bits.  */
     if (IS_USER(s))
-        mask &= 0xf80f0200;
+        mask &= CPSR_USER;
     return mask;
 }
 
 /* Returns nonzero if access to the PSR is not permitted.  */
 static int gen_set_psr_T0(DisasContext *s, uint32_t mask, int spsr)
 {
+    TCGv tmp;
     if (spsr) {
         /* ??? This is also undefined in system mode.  */
         if (IS_USER(s))
             return 1;
-        gen_op_movl_spsr_T0(mask);
+
+        tmp = load_cpu_field(spsr);
+        tcg_gen_andi_i32(tmp, tmp, ~mask);
+        tcg_gen_andi_i32(cpu_T[0], cpu_T[0], mask);
+        tcg_gen_or_i32(tmp, tmp, cpu_T[0]);
+        store_cpu_field(tmp, spsr);
     } else {
-        gen_op_movl_cpsr_T0(mask);
+        gen_set_cpsr(cpu_T[0], mask);
     }
     gen_lookup_tb(s);
     return 0;
 }
 
+/* Generate an old-style exception return.  */
 static void gen_exception_return(DisasContext *s)
 {
-    gen_op_movl_reg_TN[0][15]();
-    gen_op_movl_T0_spsr();
-    gen_op_movl_cpsr_T0(0xffffffff);
+    TCGv tmp;
+    gen_movl_reg_T0(s, 15);
+    tmp = load_cpu_field(spsr);
+    gen_set_cpsr(tmp, 0xffffffff);
+    dead_tmp(tmp);
     s->is_jmp = DISAS_UPDATE;
 }
 
+/* Generate a v6 exception return.  Marks both values as dead.  */
+static void gen_rfe(DisasContext *s, TCGv pc, TCGv cpsr)
+{
+    gen_set_cpsr(cpsr, 0xffffffff);
+    dead_tmp(cpsr);
+    store_reg(s, 15, pc);
+    s->is_jmp = DISAS_UPDATE;
+}
+
+static inline void
+gen_set_condexec (DisasContext *s)
+{
+    if (s->condexec_mask) {
+        uint32_t val = (s->condexec_cond << 4) | (s->condexec_mask >> 1);
+        TCGv tmp = new_tmp();
+        tcg_gen_movi_i32(tmp, val);
+        store_cpu_field(tmp, condexec_bits);
+    }
+}
+
+static void gen_nop_hint(DisasContext *s, int val)
+{
+    switch (val) {
+    case 3: /* wfi */
+        gen_set_pc_im(s->pc);
+        s->is_jmp = DISAS_WFI;
+        break;
+    case 2: /* wfe */
+    case 4: /* sev */
+        /* TODO: Implement SEV and WFE.  May help SMP performance.  */
+    default: /* nop */
+        break;
+    }
+}
+
+/* These macros help make the code more readable when migrating from the
+   old dyngen helpers.  They should probably be removed when
+   T0/T1 are removed.  */
+#define CPU_T001 cpu_T[0], cpu_T[0], cpu_T[1]
+#define CPU_T0E01 cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]
+
+#define CPU_V001 cpu_V0, cpu_V0, cpu_V1
+
+static inline int gen_neon_add(int size)
+{
+    switch (size) {
+    case 0: gen_helper_neon_add_u8(CPU_T001); break;
+    case 1: gen_helper_neon_add_u16(CPU_T001); break;
+    case 2: gen_op_addl_T0_T1(); break;
+    default: return 1;
+    }
+    return 0;
+}
+
+static inline void gen_neon_rsb(int size)
+{
+    switch (size) {
+    case 0: gen_helper_neon_sub_u8(cpu_T[0], cpu_T[1], cpu_T[0]); break;
+    case 1: gen_helper_neon_sub_u16(cpu_T[0], cpu_T[1], cpu_T[0]); break;
+    case 2: gen_op_rsbl_T0_T1(); break;
+    default: return;
+    }
+}
+
+/* 32-bit pairwise ops end up the same as the elementwise versions.  */
+#define gen_helper_neon_pmax_s32  gen_helper_neon_max_s32
+#define gen_helper_neon_pmax_u32  gen_helper_neon_max_u32
+#define gen_helper_neon_pmin_s32  gen_helper_neon_min_s32
+#define gen_helper_neon_pmin_u32  gen_helper_neon_min_u32
+
+/* FIXME: This is wrong.  They set the wrong overflow bit.  */
+#define gen_helper_neon_qadd_s32(a, e, b, c) gen_helper_add_saturate(a, b, c)
+#define gen_helper_neon_qadd_u32(a, e, b, c) gen_helper_add_usaturate(a, b, c)
+#define gen_helper_neon_qsub_s32(a, e, b, c) gen_helper_sub_saturate(a, b, c)
+#define gen_helper_neon_qsub_u32(a, e, b, c) gen_helper_sub_usaturate(a, b, c)
+
+#define GEN_NEON_INTEGER_OP_ENV(name) do { \
+    switch ((size << 1) | u) { \
+    case 0: \
+        gen_helper_neon_##name##_s8(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]); \
+        break; \
+    case 1: \
+        gen_helper_neon_##name##_u8(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]); \
+        break; \
+    case 2: \
+        gen_helper_neon_##name##_s16(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]); \
+        break; \
+    case 3: \
+        gen_helper_neon_##name##_u16(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]); \
+        break; \
+    case 4: \
+        gen_helper_neon_##name##_s32(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]); \
+        break; \
+    case 5: \
+        gen_helper_neon_##name##_u32(cpu_T[0], cpu_env, cpu_T[0], cpu_T[1]); \
+        break; \
+    default: return 1; \
+    }} while (0)
+
+#define GEN_NEON_INTEGER_OP(name) do { \
+    switch ((size << 1) | u) { \
+    case 0: \
+        gen_helper_neon_##name##_s8(cpu_T[0], cpu_T[0], cpu_T[1]); \
+        break; \
+    case 1: \
+        gen_helper_neon_##name##_u8(cpu_T[0], cpu_T[0], cpu_T[1]); \
+        break; \
+    case 2: \
+        gen_helper_neon_##name##_s16(cpu_T[0], cpu_T[0], cpu_T[1]); \
+        break; \
+    case 3: \
+        gen_helper_neon_##name##_u16(cpu_T[0], cpu_T[0], cpu_T[1]); \
+        break; \
+    case 4: \
+        gen_helper_neon_##name##_s32(cpu_T[0], cpu_T[0], cpu_T[1]); \
+        break; \
+    case 5: \
+        gen_helper_neon_##name##_u32(cpu_T[0], cpu_T[0], cpu_T[1]); \
+        break; \
+    default: return 1; \
+    }} while (0)
+
+static inline void
+gen_neon_movl_scratch_T0(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  tcg_gen_st_i32(cpu_T[0], cpu_env, offset);
+}
+
+static inline void
+gen_neon_movl_scratch_T1(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  tcg_gen_st_i32(cpu_T[1], cpu_env, offset);
+}
+
+static inline void
+gen_neon_movl_T0_scratch(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  tcg_gen_ld_i32(cpu_T[0], cpu_env, offset);
+}
+
+static inline void
+gen_neon_movl_T1_scratch(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  tcg_gen_ld_i32(cpu_T[1], cpu_env, offset);
+}
+
+static inline void gen_neon_get_scalar(int size, int reg)
+{
+    if (size == 1) {
+        NEON_GET_REG(T0, reg >> 1, reg & 1);
+    } else {
+        NEON_GET_REG(T0, reg >> 2, (reg >> 1) & 1);
+        if (reg & 1)
+            gen_neon_dup_low16(cpu_T[0]);
+        else
+            gen_neon_dup_high16(cpu_T[0]);
+    }
+}
+
+static void gen_neon_unzip(int reg, int q, int tmp, int size)
+{
+    int n;
+
+    for (n = 0; n < q + 1; n += 2) {
+        NEON_GET_REG(T0, reg, n);
+        NEON_GET_REG(T0, reg, n + n);
+        switch (size) {
+        case 0: gen_helper_neon_unzip_u8(); break;
+        case 1: gen_helper_neon_zip_u16(); break; /* zip and unzip are the same.  */
+        case 2: /* no-op */; break;
+        default: abort();
+        }
+        gen_neon_movl_scratch_T0(tmp + n);
+        gen_neon_movl_scratch_T1(tmp + n + 1);
+    }
+}
+
+static struct {
+    int nregs;
+    int interleave;
+    int spacing;
+} neon_ls_element_type[11] = {
+    {4, 4, 1},
+    {4, 4, 2},
+    {4, 1, 1},
+    {4, 2, 1},
+    {3, 3, 1},
+    {3, 3, 2},
+    {3, 1, 1},
+    {1, 1, 1},
+    {2, 2, 1},
+    {2, 2, 2},
+    {2, 1, 1}
+};
+
+/* Translate a NEON load/store element instruction.  Return nonzero if the
+   instruction is invalid.  */
+static int disas_neon_ls_insn(CPUState * env, DisasContext *s, uint32_t insn)
+{
+    int rd, rn, rm;
+    int op;
+    int nregs;
+    int interleave;
+    int stride;
+    int size;
+    int reg;
+    int pass;
+    int load;
+    int shift;
+    int n;
+    TCGv tmp;
+    TCGv tmp2;
+
+    if (!vfp_enabled(env))
+      return 1;
+    VFP_DREG_D(rd, insn);
+    rn = (insn >> 16) & 0xf;
+    rm = insn & 0xf;
+    load = (insn & (1 << 21)) != 0;
+    if ((insn & (1 << 23)) == 0) {
+        /* Load store all elements.  */
+        op = (insn >> 8) & 0xf;
+        size = (insn >> 6) & 3;
+        if (op > 10 || size == 3)
+            return 1;
+        nregs = neon_ls_element_type[op].nregs;
+        interleave = neon_ls_element_type[op].interleave;
+        gen_movl_T1_reg(s, rn);
+        stride = (1 << size) * interleave;
+        for (reg = 0; reg < nregs; reg++) {
+            if (interleave > 2 || (interleave == 2 && nregs == 2)) {
+                gen_movl_T1_reg(s, rn);
+                gen_op_addl_T1_im((1 << size) * reg);
+            } else if (interleave == 2 && nregs == 4 && reg == 2) {
+                gen_movl_T1_reg(s, rn);
+                gen_op_addl_T1_im(1 << size);
+            }
+            for (pass = 0; pass < 2; pass++) {
+                if (size == 2) {
+                    if (load) {
+                        tmp = gen_ld32(cpu_T[1], IS_USER(s));
+                        neon_store_reg(rd, pass, tmp);
+                    } else {
+                        tmp = neon_load_reg(rd, pass);
+                        gen_st32(tmp, cpu_T[1], IS_USER(s));
+                    }
+                    gen_op_addl_T1_im(stride);
+                } else if (size == 1) {
+                    if (load) {
+                        tmp = gen_ld16u(cpu_T[1], IS_USER(s));
+                        gen_op_addl_T1_im(stride);
+                        tmp2 = gen_ld16u(cpu_T[1], IS_USER(s));
+                        gen_op_addl_T1_im(stride);
+                        gen_bfi(tmp, tmp, tmp2, 16, 0xffff);
+                        dead_tmp(tmp2);
+                        neon_store_reg(rd, pass, tmp);
+                    } else {
+                        tmp = neon_load_reg(rd, pass);
+                        tmp2 = new_tmp();
+                        tcg_gen_shri_i32(tmp2, tmp, 16);
+                        gen_st16(tmp, cpu_T[1], IS_USER(s));
+                        gen_op_addl_T1_im(stride);
+                        gen_st16(tmp2, cpu_T[1], IS_USER(s));
+                        gen_op_addl_T1_im(stride);
+                    }
+                } else /* size == 0 */ {
+                    if (load) {
+                        TCGV_UNUSED(tmp2);
+                        for (n = 0; n < 4; n++) {
+                            tmp = gen_ld8u(cpu_T[1], IS_USER(s));
+                            gen_op_addl_T1_im(stride);
+                            if (n == 0) {
+                                tmp2 = tmp;
+                            } else {
+                                gen_bfi(tmp2, tmp2, tmp, n * 8, 0xff);
+                                dead_tmp(tmp);
+                            }
+                        }
+                        neon_store_reg(rd, pass, tmp2);
+                    } else {
+                        tmp2 = neon_load_reg(rd, pass);
+                        for (n = 0; n < 4; n++) {
+                            tmp = new_tmp();
+                            if (n == 0) {
+                                tcg_gen_mov_i32(tmp, tmp2);
+                            } else {
+                                tcg_gen_shri_i32(tmp, tmp2, n * 8);
+                            }
+                            gen_st8(tmp, cpu_T[1], IS_USER(s));
+                            gen_op_addl_T1_im(stride);
+                        }
+                        dead_tmp(tmp2);
+                    }
+                }
+            }
+            rd += neon_ls_element_type[op].spacing;
+        }
+        stride = nregs * 8;
+    } else {
+        size = (insn >> 10) & 3;
+        if (size == 3) {
+            /* Load single element to all lanes.  */
+            if (!load)
+                return 1;
+            size = (insn >> 6) & 3;
+            nregs = ((insn >> 8) & 3) + 1;
+            stride = (insn & (1 << 5)) ? 2 : 1;
+            gen_movl_T1_reg(s, rn);
+            for (reg = 0; reg < nregs; reg++) {
+                switch (size) {
+                case 0:
+                    tmp = gen_ld8u(cpu_T[1], IS_USER(s));
+                    gen_neon_dup_u8(tmp, 0);
+                    break;
+                case 1:
+                    tmp = gen_ld16u(cpu_T[1], IS_USER(s));
+                    gen_neon_dup_low16(tmp);
+                    break;
+                case 2:
+                    tmp = gen_ld32(cpu_T[0], IS_USER(s));
+                    break;
+                case 3:
+                    return 1;
+                default: /* Avoid compiler warnings.  */
+                    abort();
+                }
+                gen_op_addl_T1_im(1 << size);
+                tmp2 = new_tmp();
+                tcg_gen_mov_i32(tmp2, tmp);
+                neon_store_reg(rd, 0, tmp2);
+                neon_store_reg(rd, 0, tmp);
+                rd += stride;
+            }
+            stride = (1 << size) * nregs;
+        } else {
+            /* Single element.  */
+            pass = (insn >> 7) & 1;
+            switch (size) {
+            case 0:
+                shift = ((insn >> 5) & 3) * 8;
+                stride = 1;
+                break;
+            case 1:
+                shift = ((insn >> 6) & 1) * 16;
+                stride = (insn & (1 << 5)) ? 2 : 1;
+                break;
+            case 2:
+                shift = 0;
+                stride = (insn & (1 << 6)) ? 2 : 1;
+                break;
+            default:
+                abort();
+            }
+            nregs = ((insn >> 8) & 3) + 1;
+            gen_movl_T1_reg(s, rn);
+            for (reg = 0; reg < nregs; reg++) {
+                if (load) {
+                    switch (size) {
+                    case 0:
+                        tmp = gen_ld8u(cpu_T[1], IS_USER(s));
+                        break;
+                    case 1:
+                        tmp = gen_ld16u(cpu_T[1], IS_USER(s));
+                        break;
+                    case 2:
+                        tmp = gen_ld32(cpu_T[1], IS_USER(s));
+                        break;
+                    default: /* Avoid compiler warnings.  */
+                        abort();
+                    }
+                    if (size != 2) {
+                        tmp2 = neon_load_reg(rd, pass);
+                        gen_bfi(tmp, tmp2, tmp, shift, size ? 0xffff : 0xff);
+                        dead_tmp(tmp2);
+                    }
+                    neon_store_reg(rd, pass, tmp);
+                } else { /* Store */
+                    tmp = neon_load_reg(rd, pass);
+                    if (shift)
+                        tcg_gen_shri_i32(tmp, tmp, shift);
+                    switch (size) {
+                    case 0:
+                        gen_st8(tmp, cpu_T[1], IS_USER(s));
+                        break;
+                    case 1:
+                        gen_st16(tmp, cpu_T[1], IS_USER(s));
+                        break;
+                    case 2:
+                        gen_st32(tmp, cpu_T[1], IS_USER(s));
+                        break;
+                    }
+                }
+                rd += stride;
+                gen_op_addl_T1_im(1 << size);
+            }
+            stride = nregs * (1 << size);
+        }
+    }
+    if (rm != 15) {
+        TCGv base;
+
+        base = load_reg(s, rn);
+        if (rm == 13) {
+            tcg_gen_addi_i32(base, base, stride);
+        } else {
+            TCGv index;
+            index = load_reg(s, rm);
+            tcg_gen_add_i32(base, base, index);
+            dead_tmp(index);
+        }
+        store_reg(s, rn, base);
+    }
+    return 0;
+}
+
+/* Bitwise select.  dest = c ? t : f.  Clobbers T and F.  */
+static void gen_neon_bsl(TCGv dest, TCGv t, TCGv f, TCGv c)
+{
+    tcg_gen_and_i32(t, t, c);
+    tcg_gen_bic_i32(f, f, c);
+    tcg_gen_or_i32(dest, t, f);
+}
+
+static inline void gen_neon_narrow(int size, TCGv dest, TCGv src)
+{
+    switch (size) {
+    case 0: gen_helper_neon_narrow_u8(dest, src); break;
+    case 1: gen_helper_neon_narrow_u16(dest, src); break;
+    case 2: tcg_gen_trunc_i64_i32(dest, src); break;
+    default: abort();
+    }
+}
+
+static inline void gen_neon_narrow_sats(int size, TCGv dest, TCGv src)
+{
+    switch (size) {
+    case 0: gen_helper_neon_narrow_sat_s8(dest, cpu_env, src); break;
+    case 1: gen_helper_neon_narrow_sat_s16(dest, cpu_env, src); break;
+    case 2: gen_helper_neon_narrow_sat_s32(dest, cpu_env, src); break;
+    default: abort();
+    }
+}
+
+static inline void gen_neon_narrow_satu(int size, TCGv dest, TCGv src)
+{
+    switch (size) {
+    case 0: gen_helper_neon_narrow_sat_u8(dest, cpu_env, src); break;
+    case 1: gen_helper_neon_narrow_sat_u16(dest, cpu_env, src); break;
+    case 2: gen_helper_neon_narrow_sat_u32(dest, cpu_env, src); break;
+    default: abort();
+    }
+}
+
+static inline void gen_neon_shift_narrow(int size, TCGv var, TCGv shift,
+                                         int q, int u)
+{
+    if (q) {
+        if (u) {
+            switch (size) {
+            case 1: gen_helper_neon_rshl_u16(var, var, shift); break;
+            case 2: gen_helper_neon_rshl_u32(var, var, shift); break;
+            default: abort();
+            }
+        } else {
+            switch (size) {
+            case 1: gen_helper_neon_rshl_s16(var, var, shift); break;
+            case 2: gen_helper_neon_rshl_s32(var, var, shift); break;
+            default: abort();
+            }
+        }
+    } else {
+        if (u) {
+            switch (size) {
+            case 1: gen_helper_neon_rshl_u16(var, var, shift); break;
+            case 2: gen_helper_neon_rshl_u32(var, var, shift); break;
+            default: abort();
+            }
+        } else {
+            switch (size) {
+            case 1: gen_helper_neon_shl_s16(var, var, shift); break;
+            case 2: gen_helper_neon_shl_s32(var, var, shift); break;
+            default: abort();
+            }
+        }
+    }
+}
+
+static inline void gen_neon_widen(TCGv dest, TCGv src, int size, int u)
+{
+    if (u) {
+        switch (size) {
+        case 0: gen_helper_neon_widen_u8(dest, src); break;
+        case 1: gen_helper_neon_widen_u16(dest, src); break;
+        case 2: tcg_gen_extu_i32_i64(dest, src); break;
+        default: abort();
+        }
+    } else {
+        switch (size) {
+        case 0: gen_helper_neon_widen_s8(dest, src); break;
+        case 1: gen_helper_neon_widen_s16(dest, src); break;
+        case 2: tcg_gen_ext_i32_i64(dest, src); break;
+        default: abort();
+        }
+    }
+    dead_tmp(src);
+}
+
+static inline void gen_neon_addl(int size)
+{
+    switch (size) {
+    case 0: gen_helper_neon_addl_u16(CPU_V001); break;
+    case 1: gen_helper_neon_addl_u32(CPU_V001); break;
+    case 2: tcg_gen_add_i64(CPU_V001); break;
+    default: abort();
+    }
+}
+
+static inline void gen_neon_subl(int size)
+{
+    switch (size) {
+    case 0: gen_helper_neon_subl_u16(CPU_V001); break;
+    case 1: gen_helper_neon_subl_u32(CPU_V001); break;
+    case 2: tcg_gen_sub_i64(CPU_V001); break;
+    default: abort();
+    }
+}
+
+static inline void gen_neon_negl(TCGv var, int size)
+{
+    switch (size) {
+    case 0: gen_helper_neon_negl_u16(var, var); break;
+    case 1: gen_helper_neon_negl_u32(var, var); break;
+    case 2: gen_helper_neon_negl_u64(var, var); break;
+    default: abort();
+    }
+}
+
+static inline void gen_neon_addl_saturate(TCGv op0, TCGv op1, int size)
+{
+    switch (size) {
+    case 1: gen_helper_neon_addl_saturate_s32(op0, cpu_env, op0, op1); break;
+    case 2: gen_helper_neon_addl_saturate_s64(op0, cpu_env, op0, op1); break;
+    default: abort();
+    }
+}
+
+static inline void gen_neon_mull(TCGv dest, TCGv a, TCGv b, int size, int u)
+{
+    TCGv tmp;
+
+    switch ((size << 1) | u) {
+    case 0: gen_helper_neon_mull_s8(dest, a, b); break;
+    case 1: gen_helper_neon_mull_u8(dest, a, b); break;
+    case 2: gen_helper_neon_mull_s16(dest, a, b); break;
+    case 3: gen_helper_neon_mull_u16(dest, a, b); break;
+    case 4:
+        tmp = gen_muls_i64_i32(a, b);
+        tcg_gen_mov_i64(dest, tmp);
+        break;
+    case 5:
+        tmp = gen_mulu_i64_i32(a, b);
+        tcg_gen_mov_i64(dest, tmp);
+        break;
+    default: abort();
+    }
+    if (size < 2) {
+        dead_tmp(b);
+        dead_tmp(a);
+    }
+}
+
+/* Translate a NEON data processing instruction.  Return nonzero if the
+   instruction is invalid.
+   We process data in a mixture of 32-bit and 64-bit chunks.
+   Mostly we use 32-bit chunks so we can use normal scalar instructions.  */
+
+static int disas_neon_data_insn(CPUState * env, DisasContext *s, uint32_t insn)
+{
+    int op;
+    int q;
+    int rd, rn, rm;
+    int size;
+    int shift;
+    int pass;
+    int count;
+    int pairwise;
+    int u;
+    int n;
+    uint32_t imm;
+    TCGv tmp;
+    TCGv tmp2;
+    TCGv tmp3;
+
+    if (!vfp_enabled(env))
+      return 1;
+    q = (insn & (1 << 6)) != 0;
+    u = (insn >> 24) & 1;
+    VFP_DREG_D(rd, insn);
+    VFP_DREG_N(rn, insn);
+    VFP_DREG_M(rm, insn);
+    size = (insn >> 20) & 3;
+    if ((insn & (1 << 23)) == 0) {
+        /* Three register same length.  */
+        op = ((insn >> 7) & 0x1e) | ((insn >> 4) & 1);
+        if (size == 3 && (op == 1 || op == 5 || op == 8 || op == 9
+                          || op == 10 || op  == 11 || op == 16)) {
+            /* 64-bit element instructions.  */
+            for (pass = 0; pass < (q ? 2 : 1); pass++) {
+                neon_load_reg64(cpu_V0, rn + pass);
+                neon_load_reg64(cpu_V1, rm + pass);
+                switch (op) {
+                case 1: /* VQADD */
+                    if (u) {
+                        gen_helper_neon_add_saturate_u64(CPU_V001);
+                    } else {
+                        gen_helper_neon_add_saturate_s64(CPU_V001);
+                    }
+                    break;
+                case 5: /* VQSUB */
+                    if (u) {
+                        gen_helper_neon_sub_saturate_u64(CPU_V001);
+                    } else {
+                        gen_helper_neon_sub_saturate_s64(CPU_V001);
+                    }
+                    break;
+                case 8: /* VSHL */
+                    if (u) {
+                        gen_helper_neon_shl_u64(cpu_V0, cpu_V1, cpu_V0);
+                    } else {
+                        gen_helper_neon_shl_s64(cpu_V0, cpu_V1, cpu_V0);
+                    }
+                    break;
+                case 9: /* VQSHL */
+                    if (u) {
+                        gen_helper_neon_qshl_u64(cpu_V0, cpu_env,
+                                                 cpu_V0, cpu_V0);
+                    } else {
+                        gen_helper_neon_qshl_s64(cpu_V1, cpu_env,
+                                                 cpu_V1, cpu_V0);
+                    }
+                    break;
+                case 10: /* VRSHL */
+                    if (u) {
+                        gen_helper_neon_rshl_u64(cpu_V0, cpu_V1, cpu_V0);
+                    } else {
+                        gen_helper_neon_rshl_s64(cpu_V0, cpu_V1, cpu_V0);
+                    }
+                    break;
+                case 11: /* VQRSHL */
+                    if (u) {
+                        gen_helper_neon_qrshl_u64(cpu_V0, cpu_env,
+                                                  cpu_V1, cpu_V0);
+                    } else {
+                        gen_helper_neon_qrshl_s64(cpu_V0, cpu_env,
+                                                  cpu_V1, cpu_V0);
+                    }
+                    break;
+                case 16:
+                    if (u) {
+                        tcg_gen_sub_i64(CPU_V001);
+                    } else {
+                        tcg_gen_add_i64(CPU_V001);
+                    }
+                    break;
+                default:
+                    abort();
+                }
+                neon_store_reg64(cpu_V0, rd + pass);
+            }
+            return 0;
+        }
+        switch (op) {
+        case 8: /* VSHL */
+        case 9: /* VQSHL */
+        case 10: /* VRSHL */
+        case 11: /* VQRSHL */
+            {
+                int rtmp;
+                /* Shift instruction operands are reversed.  */
+                rtmp = rn;
+                rn = rm;
+                rm = rtmp;
+                pairwise = 0;
+            }
+            break;
+        case 20: /* VPMAX */
+        case 21: /* VPMIN */
+        case 23: /* VPADD */
+            pairwise = 1;
+            break;
+        case 26: /* VPADD (float) */
+            pairwise = (u && size < 2);
+            break;
+        case 30: /* VPMIN/VPMAX (float) */
+            pairwise = u;
+            break;
+        default:
+            pairwise = 0;
+            break;
+        }
+        for (pass = 0; pass < (q ? 4 : 2); pass++) {
+
+        if (pairwise) {
+            /* Pairwise.  */
+            if (q)
+                n = (pass & 1) * 2;
+            else
+                n = 0;
+            if (pass < q + 1) {
+                NEON_GET_REG(T0, rn, n);
+                NEON_GET_REG(T1, rn, n + 1);
+            } else {
+                NEON_GET_REG(T0, rm, n);
+                NEON_GET_REG(T1, rm, n + 1);
+            }
+        } else {
+            /* Elementwise.  */
+            NEON_GET_REG(T0, rn, pass);
+            NEON_GET_REG(T1, rm, pass);
+        }
+        switch (op) {
+        case 0: /* VHADD */
+            GEN_NEON_INTEGER_OP(hadd);
+            break;
+        case 1: /* VQADD */
+            GEN_NEON_INTEGER_OP_ENV(qadd);
+            break;
+        case 2: /* VRHADD */
+            GEN_NEON_INTEGER_OP(rhadd);
+            break;
+        case 3: /* Logic ops.  */
+            switch ((u << 2) | size) {
+            case 0: /* VAND */
+                gen_op_andl_T0_T1();
+                break;
+            case 1: /* BIC */
+                gen_op_bicl_T0_T1();
+                break;
+            case 2: /* VORR */
+                gen_op_orl_T0_T1();
+                break;
+            case 3: /* VORN */
+                gen_op_notl_T1();
+                gen_op_orl_T0_T1();
+                break;
+            case 4: /* VEOR */
+                gen_op_xorl_T0_T1();
+                break;
+            case 5: /* VBSL */
+                tmp = neon_load_reg(rd, pass);
+                gen_neon_bsl(cpu_T[0], cpu_T[0], cpu_T[1], tmp);
+                dead_tmp(tmp);
+                break;
+            case 6: /* VBIT */
+                tmp = neon_load_reg(rd, pass);
+                gen_neon_bsl(cpu_T[0], cpu_T[0], tmp, cpu_T[1]);
+                dead_tmp(tmp);
+                break;
+            case 7: /* VBIF */
+                tmp = neon_load_reg(rd, pass);
+                gen_neon_bsl(cpu_T[0], tmp, cpu_T[0], cpu_T[1]);
+                dead_tmp(tmp);
+                break;
+            }
+            break;
+        case 4: /* VHSUB */
+            GEN_NEON_INTEGER_OP(hsub);
+            break;
+        case 5: /* VQSUB */
+            GEN_NEON_INTEGER_OP_ENV(qsub);
+            break;
+        case 6: /* VCGT */
+            GEN_NEON_INTEGER_OP(cgt);
+            break;
+        case 7: /* VCGE */
+            GEN_NEON_INTEGER_OP(cge);
+            break;
+        case 8: /* VSHL */
+            GEN_NEON_INTEGER_OP(shl);
+            break;
+        case 9: /* VQSHL */
+            GEN_NEON_INTEGER_OP_ENV(qshl);
+            break;
+        case 10: /* VRSHL */
+            GEN_NEON_INTEGER_OP(rshl);
+            break;
+        case 11: /* VQRSHL */
+            GEN_NEON_INTEGER_OP_ENV(qrshl);
+            break;
+        case 12: /* VMAX */
+            GEN_NEON_INTEGER_OP(max);
+            break;
+        case 13: /* VMIN */
+            GEN_NEON_INTEGER_OP(min);
+            break;
+        case 14: /* VABD */
+            GEN_NEON_INTEGER_OP(abd);
+            break;
+        case 15: /* VABA */
+            GEN_NEON_INTEGER_OP(abd);
+            NEON_GET_REG(T1, rd, pass);
+            gen_neon_add(size);
+            break;
+        case 16:
+            if (!u) { /* VADD */
+                if (gen_neon_add(size))
+                    return 1;
+            } else { /* VSUB */
+                switch (size) {
+                case 0: gen_helper_neon_sub_u8(CPU_T001); break;
+                case 1: gen_helper_neon_sub_u16(CPU_T001); break;
+                case 2: gen_op_subl_T0_T1(); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 17:
+            if (!u) { /* VTST */
+                switch (size) {
+                case 0: gen_helper_neon_tst_u8(CPU_T001); break;
+                case 1: gen_helper_neon_tst_u16(CPU_T001); break;
+                case 2: gen_helper_neon_tst_u32(CPU_T001); break;
+                default: return 1;
+                }
+            } else { /* VCEQ */
+                switch (size) {
+                case 0: gen_helper_neon_ceq_u8(CPU_T001); break;
+                case 1: gen_helper_neon_ceq_u16(CPU_T001); break;
+                case 2: gen_helper_neon_ceq_u32(CPU_T001); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 18: /* Multiply.  */
+            switch (size) {
+            case 0: gen_helper_neon_mul_u8(CPU_T001); break;
+            case 1: gen_helper_neon_mul_u16(CPU_T001); break;
+            case 2: gen_op_mul_T0_T1(); break;
+            default: return 1;
+            }
+            NEON_GET_REG(T1, rd, pass);
+            if (u) { /* VMLS */
+                gen_neon_rsb(size);
+            } else { /* VMLA */
+                gen_neon_add(size);
+            }
+            break;
+        case 19: /* VMUL */
+            if (u) { /* polynomial */
+                gen_helper_neon_mul_p8(CPU_T001);
+            } else { /* Integer */
+                switch (size) {
+                case 0: gen_helper_neon_mul_u8(CPU_T001); break;
+                case 1: gen_helper_neon_mul_u16(CPU_T001); break;
+                case 2: gen_op_mul_T0_T1(); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 20: /* VPMAX */
+            GEN_NEON_INTEGER_OP(pmax);
+            break;
+        case 21: /* VPMIN */
+            GEN_NEON_INTEGER_OP(pmin);
+            break;
+        case 22: /* Hultiply high.  */
+            if (!u) { /* VQDMULH */
+                switch (size) {
+                case 1: gen_helper_neon_qdmulh_s16(CPU_T0E01); break;
+                case 2: gen_helper_neon_qdmulh_s32(CPU_T0E01); break;
+                default: return 1;
+                }
+            } else { /* VQRDHMUL */
+                switch (size) {
+                case 1: gen_helper_neon_qrdmulh_s16(CPU_T0E01); break;
+                case 2: gen_helper_neon_qrdmulh_s32(CPU_T0E01); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 23: /* VPADD */
+            if (u)
+                return 1;
+            switch (size) {
+            case 0: gen_helper_neon_padd_u8(CPU_T001); break;
+            case 1: gen_helper_neon_padd_u16(CPU_T001); break;
+            case 2: gen_op_addl_T0_T1(); break;
+            default: return 1;
+            }
+            break;
+        case 26: /* Floating point arithnetic.  */
+            switch ((u << 2) | size) {
+            case 0: /* VADD */
+                gen_helper_neon_add_f32(CPU_T001);
+                break;
+            case 2: /* VSUB */
+                gen_helper_neon_sub_f32(CPU_T001);
+                break;
+            case 4: /* VPADD */
+                gen_helper_neon_add_f32(CPU_T001);
+                break;
+            case 6: /* VABD */
+                gen_helper_neon_abd_f32(CPU_T001);
+                break;
+            default:
+                return 1;
+            }
+            break;
+        case 27: /* Float multiply.  */
+            gen_helper_neon_mul_f32(CPU_T001);
+            if (!u) {
+                NEON_GET_REG(T1, rd, pass);
+                if (size == 0) {
+                    gen_helper_neon_add_f32(CPU_T001);
+                } else {
+                    gen_helper_neon_sub_f32(cpu_T[0], cpu_T[1], cpu_T[0]);
+                }
+            }
+            break;
+        case 28: /* Float compare.  */
+            if (!u) {
+                gen_helper_neon_ceq_f32(CPU_T001);
+            } else {
+                if (size == 0)
+                    gen_helper_neon_cge_f32(CPU_T001);
+                else
+                    gen_helper_neon_cgt_f32(CPU_T001);
+            }
+            break;
+        case 29: /* Float compare absolute.  */
+            if (!u)
+                return 1;
+            if (size == 0)
+                gen_helper_neon_acge_f32(CPU_T001);
+            else
+                gen_helper_neon_acgt_f32(CPU_T001);
+            break;
+        case 30: /* Float min/max.  */
+            if (size == 0)
+                gen_helper_neon_max_f32(CPU_T001);
+            else
+                gen_helper_neon_min_f32(CPU_T001);
+            break;
+        case 31:
+            if (size == 0)
+                gen_helper_recps_f32(cpu_T[0], cpu_T[0], cpu_T[1], cpu_env);
+            else
+                gen_helper_rsqrts_f32(cpu_T[0], cpu_T[0], cpu_T[1], cpu_env);
+            break;
+        default:
+            abort();
+        }
+        /* Save the result.  For elementwise operations we can put it
+           straight into the destination register.  For pairwise operations
+           we have to be careful to avoid clobbering the source operands.  */
+        if (pairwise && rd == rm) {
+            gen_neon_movl_scratch_T0(pass);
+        } else {
+            NEON_SET_REG(T0, rd, pass);
+        }
+
+        } /* for pass */
+        if (pairwise && rd == rm) {
+            for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                gen_neon_movl_T0_scratch(pass);
+                NEON_SET_REG(T0, rd, pass);
+            }
+        }
+        /* End of 3 register same size operations.  */
+    } else if (insn & (1 << 4)) {
+        if ((insn & 0x00380080) != 0) {
+            /* Two registers and shift.  */
+            op = (insn >> 8) & 0xf;
+            if (insn & (1 << 7)) {
+                /* 64-bit shift.   */
+                size = 3;
+            } else {
+                size = 2;
+                while ((insn & (1 << (size + 19))) == 0)
+                    size--;
+            }
+            shift = (insn >> 16) & ((1 << (3 + size)) - 1);
+            /* To avoid excessive dumplication of ops we implement shift
+               by immediate using the variable shift operations.  */
+            if (op < 8) {
+                /* Shift by immediate:
+                   VSHR, VSRA, VRSHR, VRSRA, VSRI, VSHL, VQSHL, VQSHLU.  */
+                /* Right shifts are encoded as N - shift, where N is the
+                   element size in bits.  */
+                if (op <= 4)
+                    shift = shift - (1 << (size + 3));
+                if (size == 3) {
+                    count = q + 1;
+                } else {
+                    count = q ? 4: 2;
+                }
+                switch (size) {
+                case 0:
+                    imm = (uint8_t) shift;
+                    imm |= imm << 8;
+                    imm |= imm << 16;
+                    break;
+                case 1:
+                    imm = (uint16_t) shift;
+                    imm |= imm << 16;
+                    break;
+                case 2:
+                case 3:
+                    imm = shift;
+                    break;
+                default:
+                    abort();
+                }
+
+                for (pass = 0; pass < count; pass++) {
+                    if (size == 3) {
+                        neon_load_reg64(cpu_V0, rm + pass);
+                        tcg_gen_movi_i64(cpu_V1, imm);
+                        switch (op) {
+                        case 0:  /* VSHR */
+                        case 1:  /* VSRA */
+                            if (u)
+                                gen_helper_neon_shl_u64(cpu_V0, cpu_V0, cpu_V1);
+                            else
+                                gen_helper_neon_shl_s64(cpu_V0, cpu_V0, cpu_V1);
+                            break;
+                        case 2: /* VRSHR */
+                        case 3: /* VRSRA */
+                            if (u)
+                                gen_helper_neon_rshl_u64(cpu_V0, cpu_V0, cpu_V1);
+                            else
+                                gen_helper_neon_rshl_s64(cpu_V0, cpu_V0, cpu_V1);
+                            break;
+                        case 4: /* VSRI */
+                            if (!u)
+                                return 1;
+                            gen_helper_neon_shl_u64(cpu_V0, cpu_V0, cpu_V1);
+                            break;
+                        case 5: /* VSHL, VSLI */
+                            gen_helper_neon_shl_u64(cpu_V0, cpu_V0, cpu_V1);
+                            break;
+                        case 6: /* VQSHL */
+                            if (u)
+                                gen_helper_neon_qshl_u64(cpu_V0, cpu_env, cpu_V0, cpu_V1);
+                            else
+                                gen_helper_neon_qshl_s64(cpu_V0, cpu_env, cpu_V0, cpu_V1);
+                            break;
+                        case 7: /* VQSHLU */
+                            gen_helper_neon_qshl_u64(cpu_V0, cpu_env, cpu_V0, cpu_V1);
+                            break;
+                        }
+                        if (op == 1 || op == 3) {
+                            /* Accumulate.  */
+                            neon_load_reg64(cpu_V0, rd + pass);
+                            tcg_gen_add_i64(cpu_V0, cpu_V0, cpu_V1);
+                        } else if (op == 4 || (op == 5 && u)) {
+                            /* Insert */
+                            cpu_abort(env, "VS[LR]I.64 not implemented");
+                        }
+                        neon_store_reg64(cpu_V0, rd + pass);
+                    } else { /* size < 3 */
+                        /* Operands in T0 and T1.  */
+                        gen_op_movl_T1_im(imm);
+                        NEON_GET_REG(T0, rm, pass);
+                        switch (op) {
+                        case 0:  /* VSHR */
+                        case 1:  /* VSRA */
+                            GEN_NEON_INTEGER_OP(shl);
+                            break;
+                        case 2: /* VRSHR */
+                        case 3: /* VRSRA */
+                            GEN_NEON_INTEGER_OP(rshl);
+                            break;
+                        case 4: /* VSRI */
+                            if (!u)
+                                return 1;
+                            GEN_NEON_INTEGER_OP(shl);
+                            break;
+                        case 5: /* VSHL, VSLI */
+                            switch (size) {
+                            case 0: gen_helper_neon_shl_u8(CPU_T001); break;
+                            case 1: gen_helper_neon_shl_u16(CPU_T001); break;
+                            case 2: gen_helper_neon_shl_u32(CPU_T001); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 6: /* VQSHL */
+                            GEN_NEON_INTEGER_OP_ENV(qshl);
+                            break;
+                        case 7: /* VQSHLU */
+                            switch (size) {
+                            case 0: gen_helper_neon_qshl_u8(CPU_T0E01); break;
+                            case 1: gen_helper_neon_qshl_u16(CPU_T0E01); break;
+                            case 2: gen_helper_neon_qshl_u32(CPU_T0E01); break;
+                            default: return 1;
+                            }
+                            break;
+                        }
+
+                        if (op == 1 || op == 3) {
+                            /* Accumulate.  */
+                            NEON_GET_REG(T1, rd, pass);
+                            gen_neon_add(size);
+                        } else if (op == 4 || (op == 5 && u)) {
+                            /* Insert */
+                            switch (size) {
+                            case 0:
+                                if (op == 4)
+                                    imm = 0xff >> -shift;
+                                else
+                                    imm = (uint8_t)(0xff << shift);
+                                imm |= imm << 8;
+                                imm |= imm << 16;
+                                break;
+                            case 1:
+                                if (op == 4)
+                                    imm = 0xffff >> -shift;
+                                else
+                                    imm = (uint16_t)(0xffff << shift);
+                                imm |= imm << 16;
+                                break;
+                            case 2:
+                                if (op == 4)
+                                    imm = 0xffffffffu >> -shift;
+                                else
+                                    imm = 0xffffffffu << shift;
+                                break;
+                            default:
+                                abort();
+                            }
+                            tmp = neon_load_reg(rd, pass);
+                            tcg_gen_andi_i32(cpu_T[0], cpu_T[0], imm);
+                            tcg_gen_andi_i32(tmp, tmp, ~imm);
+                            tcg_gen_or_i32(cpu_T[0], cpu_T[0], tmp);
+                        }
+                        NEON_SET_REG(T0, rd, pass);
+                    }
+                } /* for pass */
+            } else if (op < 10) {
+                /* Shift by immediate and narrow:
+                   VSHRN, VRSHRN, VQSHRN, VQRSHRN.  */
+                shift = shift - (1 << (size + 3));
+                size++;
+                switch (size) {
+                case 1:
+                    imm = (uint16_t)shift;
+                    imm |= imm << 16;
+                    tmp2 = tcg_const_i32(imm);
+                    break;
+                case 2:
+                    imm = (uint32_t)shift;
+                    tmp2 = tcg_const_i32(imm);
+                case 3:
+                    tmp2 = tcg_const_i64(shift);
+                    break;
+                default:
+                    abort();
+                }
+
+                for (pass = 0; pass < 2; pass++) {
+                    if (size == 3) {
+                        neon_load_reg64(cpu_V0, rm + pass);
+                        if (q) {
+                          if (u)
+                            gen_helper_neon_rshl_u64(cpu_V0, cpu_V0, tmp2);
+                          else
+                            gen_helper_neon_rshl_s64(cpu_V0, cpu_V0, tmp2);
+                        } else {
+                          if (u)
+                            gen_helper_neon_shl_u64(cpu_V0, cpu_V0, tmp2);
+                          else
+                            gen_helper_neon_shl_s64(cpu_V0, cpu_V0, tmp2);
+                        }
+                    } else {
+                        tmp = neon_load_reg(rm + pass, 0);
+                        gen_neon_shift_narrow(size, tmp, tmp2, q, u);
+                        tcg_gen_extu_i32_i64(cpu_V0, tmp);
+                        dead_tmp(tmp);
+                        tmp = neon_load_reg(rm + pass, 1);
+                        gen_neon_shift_narrow(size, tmp, tmp2, q, u);
+                        tcg_gen_extu_i32_i64(cpu_V1, tmp);
+                        dead_tmp(tmp);
+                        tcg_gen_shli_i64(cpu_V1, cpu_V1, 32);
+                        tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
+                    }
+                    tmp = new_tmp();
+                    if (op == 8 && !u) {
+                        gen_neon_narrow(size - 1, tmp, cpu_V0);
+                    } else {
+                        if (op == 8)
+                            gen_neon_narrow_sats(size - 1, tmp, cpu_V0);
+                        else
+                            gen_neon_narrow_satu(size - 1, tmp, cpu_V0);
+                    }
+                    if (pass == 0) {
+                        tmp2 = tmp;
+                    } else {
+                        neon_store_reg(rd, 0, tmp2);
+                        neon_store_reg(rd, 1, tmp);
+                    }
+                } /* for pass */
+            } else if (op == 10) {
+                /* VSHLL */
+                if (q || size == 3)
+                    return 1;
+                tmp = neon_load_reg(rm, 0);
+                tmp2 = neon_load_reg(rm, 1);
+                for (pass = 0; pass < 2; pass++) {
+                    if (pass == 1)
+                        tmp = tmp2;
+
+                    gen_neon_widen(cpu_V0, tmp, size, u);
+
+                    if (shift != 0) {
+                        /* The shift is less than the width of the source
+                           type, so we can just shift the whole register.  */
+                        tcg_gen_shli_i64(cpu_V0, cpu_V0, shift);
+                        if (size < 2 || !u) {
+                            uint64_t imm64;
+                            if (size == 0) {
+                                imm = (0xffu >> (8 - shift));
+                                imm |= imm << 16;
+                            } else {
+                                imm = 0xffff >> (16 - shift);
+                            }
+                            imm64 = imm | (((uint64_t)imm) << 32);
+                            tcg_gen_andi_i64(cpu_V0, cpu_V0, imm64);
+                        }
+                    }
+                    neon_store_reg64(cpu_V0, rd + pass);
+                }
+            } else if (op == 15 || op == 16) {
+                /* VCVT fixed-point.  */
+                for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
+                    if (op & 1) {
+                        if (u)
+                            gen_vfp_ulto(0, shift);
+                        else
+                            gen_vfp_slto(0, shift);
+                    } else {
+                        if (u)
+                            gen_vfp_toul(0, shift);
+                        else
+                            gen_vfp_tosl(0, shift);
+                    }
+                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
+                }
+            } else {
+                return 1;
+            }
+        } else { /* (insn & 0x00380080) == 0 */
+            int invert;
+
+            op = (insn >> 8) & 0xf;
+            /* One register and immediate.  */
+            imm = (u << 7) | ((insn >> 12) & 0x70) | (insn & 0xf);
+            invert = (insn & (1 << 5)) != 0;
+            switch (op) {
+            case 0: case 1:
+                /* no-op */
+                break;
+            case 2: case 3:
+                imm <<= 8;
+                break;
+            case 4: case 5:
+                imm <<= 16;
+                break;
+            case 6: case 7:
+                imm <<= 24;
+                break;
+            case 8: case 9:
+                imm |= imm << 16;
+                break;
+            case 10: case 11:
+                imm = (imm << 8) | (imm << 24);
+                break;
+            case 12:
+                imm = (imm < 8) | 0xff;
+                break;
+            case 13:
+                imm = (imm << 16) | 0xffff;
+                break;
+            case 14:
+                imm |= (imm << 8) | (imm << 16) | (imm << 24);
+                if (invert)
+                    imm = ~imm;
+                break;
+            case 15:
+                imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
+                      | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
+                break;
+            }
+            if (invert)
+                imm = ~imm;
+
+            if (op != 14 || !invert)
+                gen_op_movl_T1_im(imm);
+
+            for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                if (op & 1 && op < 12) {
+                    tmp = neon_load_reg(rd, pass);
+                    if (invert) {
+                        /* The immediate value has already been inverted, so
+                           BIC becomes AND.  */
+                        tcg_gen_andi_i32(tmp, tmp, imm);
+                    } else {
+                        tcg_gen_ori_i32(tmp, tmp, imm);
+                    }
+                } else {
+                    /* VMOV, VMVN.  */
+                    tmp = new_tmp();
+                    if (op == 14 && invert) {
+                        uint32_t val;
+                        val = 0;
+                        for (n = 0; n < 4; n++) {
+                            if (imm & (1 << (n + (pass & 1) * 4)))
+                                val |= 0xff << (n * 8);
+                        }
+                        tcg_gen_movi_i32(tmp, val);
+                    } else {
+                        tcg_gen_movi_i32(tmp, imm);
+                    }
+                }
+                neon_store_reg(rd, pass, tmp);
+            }
+        }
+    } else { /* (insn & 0x00800010 == 0x00800010) */
+        if (size != 3) {
+            op = (insn >> 8) & 0xf;
+            if ((insn & (1 << 6)) == 0) {
+                /* Three registers of different lengths.  */
+                int src1_wide;
+                int src2_wide;
+                int prewiden;
+                /* prewiden, src1_wide, src2_wide */
+                static const int neon_3reg_wide[16][3] = {
+                    {1, 0, 0}, /* VADDL */
+                    {1, 1, 0}, /* VADDW */
+                    {1, 0, 0}, /* VSUBL */
+                    {1, 1, 0}, /* VSUBW */
+                    {0, 1, 1}, /* VADDHN */
+                    {0, 0, 0}, /* VABAL */
+                    {0, 1, 1}, /* VSUBHN */
+                    {0, 0, 0}, /* VABDL */
+                    {0, 0, 0}, /* VMLAL */
+                    {0, 0, 0}, /* VQDMLAL */
+                    {0, 0, 0}, /* VMLSL */
+                    {0, 0, 0}, /* VQDMLSL */
+                    {0, 0, 0}, /* Integer VMULL */
+                    {0, 0, 0}, /* VQDMULL */
+                    {0, 0, 0}  /* Polynomial VMULL */
+                };
+
+                prewiden = neon_3reg_wide[op][0];
+                src1_wide = neon_3reg_wide[op][1];
+                src2_wide = neon_3reg_wide[op][2];
+
+                if (size == 0 && (op == 9 || op == 11 || op == 13))
+                    return 1;
+
+                /* Avoid overlapping operands.  Wide source operands are
+                   always aligned so will never overlap with wide
+                   destinations in problematic ways.  */
+                if (rd == rm && !src2_wide) {
+                    NEON_GET_REG(T0, rm, 1);
+                    gen_neon_movl_scratch_T0(2);
+                } else if (rd == rn && !src1_wide) {
+                    NEON_GET_REG(T0, rn, 1);
+                    gen_neon_movl_scratch_T0(2);
+                }
+                TCGV_UNUSED(tmp3);
+                for (pass = 0; pass < 2; pass++) {
+                    if (src1_wide) {
+                        neon_load_reg64(cpu_V0, rn + pass);
+                        TCGV_UNUSED(tmp);
+                    } else {
+                        if (pass == 1 && rd == rn) {
+                            gen_neon_movl_T0_scratch(2);
+                            tmp = new_tmp();
+                            tcg_gen_mov_i32(tmp, cpu_T[0]);
+                        } else {
+                            tmp = neon_load_reg(rn, pass);
+                        }
+                        if (prewiden) {
+                            gen_neon_widen(cpu_V0, tmp, size, u);
+                        }
+                    }
+                    if (src2_wide) {
+                        neon_load_reg64(cpu_V1, rm + pass);
+                        TCGV_UNUSED(tmp2);
+                    } else {
+                        if (pass == 1 && rd == rm) {
+                            gen_neon_movl_T0_scratch(2);
+                            tmp2 = new_tmp();
+                            tcg_gen_mov_i32(tmp2, cpu_T[0]);
+                        } else {
+                            tmp2 = neon_load_reg(rm, pass);
+                        }
+                        if (prewiden) {
+                            gen_neon_widen(cpu_V1, tmp2, size, u);
+                        }
+                    }
+                    switch (op) {
+                    case 0: case 1: case 4: /* VADDL, VADDW, VADDHN, VRADDHN */
+                        gen_neon_addl(size);
+                        break;
+                    case 2: case 3: case 6: /* VSUBL, VSUBW, VSUBHL, VRSUBHL */
+                        gen_neon_subl(size);
+                        break;
+                    case 5: case 7: /* VABAL, VABDL */
+                        switch ((size << 1) | u) {
+                        case 0:
+                            gen_helper_neon_abdl_s16(cpu_V0, tmp, tmp2);
+                            break;
+                        case 1:
+                            gen_helper_neon_abdl_u16(cpu_V0, tmp, tmp2);
+                            break;
+                        case 2:
+                            gen_helper_neon_abdl_s32(cpu_V0, tmp, tmp2);
+                            break;
+                        case 3:
+                            gen_helper_neon_abdl_u32(cpu_V0, tmp, tmp2);
+                            break;
+                        case 4:
+                            gen_helper_neon_abdl_s64(cpu_V0, tmp, tmp2);
+                            break;
+                        case 5:
+                            gen_helper_neon_abdl_u64(cpu_V0, tmp, tmp2);
+                            break;
+                        default: abort();
+                        }
+                        dead_tmp(tmp2);
+                        dead_tmp(tmp);
+                        break;
+                    case 8: case 9: case 10: case 11: case 12: case 13:
+                        /* VMLAL, VQDMLAL, VMLSL, VQDMLSL, VMULL, VQDMULL */
+                        gen_neon_mull(cpu_V0, tmp, tmp2, size, u);
+                        break;
+                    case 14: /* Polynomial VMULL */
+                        cpu_abort(env, "Polynomial VMULL not implemented");
+
+                    default: /* 15 is RESERVED.  */
+                        return 1;
+                    }
+                    if (op == 5 || op == 13 || (op >= 8 && op <= 11)) {
+                        /* Accumulate.  */
+                        if (op == 10 || op == 11) {
+                            gen_neon_negl(cpu_V0, size);
+                        }
+
+                        if (op != 13) {
+                            neon_load_reg64(cpu_V1, rd + pass);
+                        }
+
+                        switch (op) {
+                        case 5: case 8: case 10: /* VABAL, VMLAL, VMLSL */
+                            gen_neon_addl(size);
+                            break;
+                        case 9: case 11: /* VQDMLAL, VQDMLSL */
+                            gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
+                            gen_neon_addl_saturate(cpu_V0, cpu_V1, size);
+                            break;
+                            /* Fall through.  */
+                        case 13: /* VQDMULL */
+                            gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
+                            break;
+                        default:
+                            abort();
+                        }
+                        neon_store_reg64(cpu_V0, rd + pass);
+                    } else if (op == 4 || op == 6) {
+                        /* Narrowing operation.  */
+                        tmp = new_tmp();
+                        if (u) {
+                            switch (size) {
+                            case 0:
+                                gen_helper_neon_narrow_high_u8(tmp, cpu_V0);
+                                break;
+                            case 1:
+                                gen_helper_neon_narrow_high_u16(tmp, cpu_V0);
+                                break;
+                            case 2:
+                                tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
+                                tcg_gen_trunc_i64_i32(tmp, cpu_V0);
+                                break;
+                            default: abort();
+                            }
+                        } else {
+                            switch (size) {
+                            case 0:
+                                gen_helper_neon_narrow_round_high_u8(tmp, cpu_V0);
+                                break;
+                            case 1:
+                                gen_helper_neon_narrow_round_high_u16(tmp, cpu_V0);
+                                break;
+                            case 2:
+                                tcg_gen_addi_i64(cpu_V0, cpu_V0, 1u << 31);
+                                tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
+                                tcg_gen_trunc_i64_i32(tmp, cpu_V0);
+                                break;
+                            default: abort();
+                            }
+                        }
+                        if (pass == 0) {
+                            tmp3 = tmp;
+                        } else {
+                            neon_store_reg(rd, 0, tmp3);
+                            neon_store_reg(rd, 1, tmp);
+                        }
+                    } else {
+                        /* Write back the result.  */
+                        neon_store_reg64(cpu_V0, rd + pass);
+                    }
+                }
+            } else {
+                /* Two registers and a scalar.  */
+                switch (op) {
+                case 0: /* Integer VMLA scalar */
+                case 1: /* Float VMLA scalar */
+                case 4: /* Integer VMLS scalar */
+                case 5: /* Floating point VMLS scalar */
+                case 8: /* Integer VMUL scalar */
+                case 9: /* Floating point VMUL scalar */
+                case 12: /* VQDMULH scalar */
+                case 13: /* VQRDMULH scalar */
+                    gen_neon_get_scalar(size, rm);
+                    gen_neon_movl_scratch_T0(0);
+                    for (pass = 0; pass < (u ? 4 : 2); pass++) {
+                        if (pass != 0)
+                            gen_neon_movl_T0_scratch(0);
+                        NEON_GET_REG(T1, rn, pass);
+                        if (op == 12) {
+                            if (size == 1) {
+                                gen_helper_neon_qdmulh_s16(CPU_T0E01);
+                            } else {
+                                gen_helper_neon_qdmulh_s32(CPU_T0E01);
+                            }
+                        } else if (op == 13) {
+                            if (size == 1) {
+                                gen_helper_neon_qrdmulh_s16(CPU_T0E01);
+                            } else {
+                                gen_helper_neon_qrdmulh_s32(CPU_T0E01);
+                            }
+                        } else if (op & 1) {
+                            gen_helper_neon_mul_f32(CPU_T001);
+                        } else {
+                            switch (size) {
+                            case 0: gen_helper_neon_mul_u8(CPU_T001); break;
+                            case 1: gen_helper_neon_mul_u16(CPU_T001); break;
+                            case 2: gen_op_mul_T0_T1(); break;
+                            default: return 1;
+                            }
+                        }
+                        if (op < 8) {
+                            /* Accumulate.  */
+                            NEON_GET_REG(T1, rd, pass);
+                            switch (op) {
+                            case 0:
+                                gen_neon_add(size);
+                                break;
+                            case 1:
+                                gen_helper_neon_add_f32(CPU_T001);
+                                break;
+                            case 4:
+                                gen_neon_rsb(size);
+                                break;
+                            case 5:
+                                gen_helper_neon_sub_f32(cpu_T[0], cpu_T[1], cpu_T[0]);
+                                break;
+                            default:
+                                abort();
+                            }
+                        }
+                        NEON_SET_REG(T0, rd, pass);
+                    }
+                    break;
+                case 2: /* VMLAL sclar */
+                case 3: /* VQDMLAL scalar */
+                case 6: /* VMLSL scalar */
+                case 7: /* VQDMLSL scalar */
+                case 10: /* VMULL scalar */
+                case 11: /* VQDMULL scalar */
+                    if (size == 0 && (op == 3 || op == 7 || op == 11))
+                        return 1;
+
+                    gen_neon_get_scalar(size, rm);
+                    NEON_GET_REG(T1, rn, 1);
+
+                    for (pass = 0; pass < 2; pass++) {
+                        if (pass == 0) {
+                            tmp = neon_load_reg(rn, 0);
+                        } else {
+                            tmp = new_tmp();
+                            tcg_gen_mov_i32(tmp, cpu_T[1]);
+                        }
+                        tmp2 = new_tmp();
+                        tcg_gen_mov_i32(tmp2, cpu_T[0]);
+                        gen_neon_mull(cpu_V0, tmp, tmp2, size, u);
+                        if (op == 6 || op == 7) {
+                            gen_neon_negl(cpu_V0, size);
+                        }
+                        if (op != 11) {
+                            neon_load_reg64(cpu_V1, rd + pass);
+                        }
+                        switch (op) {
+                        case 2: case 6:
+                            gen_neon_addl(size);
+                            break;
+                        case 3: case 7:
+                            gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
+                            gen_neon_addl_saturate(cpu_V0, cpu_V1, size);
+                            break;
+                        case 10:
+                            /* no-op */
+                            break;
+                        case 11:
+                            gen_neon_addl_saturate(cpu_V0, cpu_V0, size);
+                            break;
+                        default:
+                            abort();
+                        }
+                        neon_store_reg64(cpu_V0, rd + pass);
+                    }
+                    break;
+                default: /* 14 and 15 are RESERVED */
+                    return 1;
+                }
+            }
+        } else { /* size == 3 */
+            if (!u) {
+                /* Extract.  */
+                imm = (insn >> 8) & 0xf;
+                count = q + 1;
+
+                if (imm > 7 && !q)
+                    return 1;
+
+                if (imm == 0) {
+                    neon_load_reg64(cpu_V0, rn);
+                    if (q) {
+                        neon_load_reg64(cpu_V1, rn + 1);
+                    }
+                } else if (imm == 8) {
+                    neon_load_reg64(cpu_V0, rn + 1);
+                    if (q) {
+                        neon_load_reg64(cpu_V1, rm);
+                    }
+                } else if (q) {
+                    tmp = tcg_temp_new(TCG_TYPE_I64);
+                    if (imm < 8) {
+                        neon_load_reg64(cpu_V0, rn);
+                        neon_load_reg64(tmp, rn + 1);
+                    } else {
+                        neon_load_reg64(cpu_V0, rn + 1);
+                        neon_load_reg64(tmp, rm);
+                    }
+                    tcg_gen_shri_i64(cpu_V0, cpu_V0, (imm & 7) * 8);
+                    tcg_gen_shli_i64(cpu_V1, tmp, 64 - ((imm & 7) * 8));
+                    tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
+                    if (imm < 8) {
+                        neon_load_reg64(cpu_V1, rm);
+                    } else {
+                        neon_load_reg64(cpu_V1, rm + 1);
+                        imm -= 8;
+                    }
+                    tcg_gen_shli_i64(cpu_V1, cpu_V1, 64 - (imm * 8));
+                    tcg_gen_shri_i64(tmp, tmp, imm * 8);
+                    tcg_gen_or_i64(cpu_V1, cpu_V1, tmp);
+                } else {
+                    neon_load_reg64(cpu_V0, rn);
+                    tcg_gen_shri_i32(cpu_V0, cpu_V0, imm * 8);
+                    neon_load_reg64(cpu_V1, rm);
+                    tcg_gen_shli_i32(cpu_V1, cpu_V1, 64 - (imm * 8));
+                    tcg_gen_or_i64(cpu_V0, cpu_V0, cpu_V1);
+                }
+                neon_store_reg64(cpu_V0, rd);
+                if (q) {
+                    neon_store_reg64(cpu_V1, rd + 1);
+                }
+            } else if ((insn & (1 << 11)) == 0) {
+                /* Two register misc.  */
+                op = ((insn >> 12) & 0x30) | ((insn >> 7) & 0xf);
+                size = (insn >> 18) & 3;
+                switch (op) {
+                case 0: /* VREV64 */
+                    if (size == 3)
+                        return 1;
+                    for (pass = 0; pass < (q ? 2 : 1); pass++) {
+                        NEON_GET_REG(T0, rm, pass * 2);
+                        NEON_GET_REG(T1, rm, pass * 2 + 1);
+                        switch (size) {
+                        case 0: tcg_gen_bswap_i32(cpu_T[0], cpu_T[0]); break;
+                        case 1: gen_swap_half(cpu_T[0]); break;
+                        case 2: /* no-op */ break;
+                        default: abort();
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2 + 1);
+                        if (size == 2) {
+                            NEON_SET_REG(T1, rd, pass * 2);
+                        } else {
+                            gen_op_movl_T0_T1();
+                            switch (size) {
+                            case 0: tcg_gen_bswap_i32(cpu_T[0], cpu_T[0]); break;
+                            case 1: gen_swap_half(cpu_T[0]); break;
+                            default: abort();
+                            }
+                            NEON_SET_REG(T0, rd, pass * 2);
+                        }
+                    }
+                    break;
+                case 4: case 5: /* VPADDL */
+                case 12: case 13: /* VPADAL */
+                    if (size == 3)
+                        return 1;
+                    for (pass = 0; pass < q + 1; pass++) {
+                        tmp = neon_load_reg(rm, pass * 2);
+                        gen_neon_widen(cpu_V0, tmp, size, op & 1);
+                        tmp = neon_load_reg(rm, pass * 2 + 1);
+                        gen_neon_widen(cpu_V1, tmp, size, op & 1);
+                        switch (size) {
+                        case 0: gen_helper_neon_paddl_u16(CPU_V001); break;
+                        case 1: gen_helper_neon_paddl_u32(CPU_V001); break;
+                        case 2: tcg_gen_add_i64(CPU_V001); break;
+                        default: abort();
+                        }
+                        if (op >= 12) {
+                            /* Accumulate.  */
+                            neon_load_reg64(cpu_V1, rd + pass);
+                            gen_neon_addl(size);
+                        }
+                        neon_store_reg64(cpu_V0, rd + pass);
+                    }
+                    break;
+                case 33: /* VTRN */
+                    if (size == 2) {
+                        for (n = 0; n < (q ? 4 : 2); n += 2) {
+                            NEON_GET_REG(T0, rm, n);
+                            NEON_GET_REG(T1, rd, n + 1);
+                            NEON_SET_REG(T1, rm, n);
+                            NEON_SET_REG(T0, rd, n + 1);
+                        }
+                    } else {
+                        goto elementwise;
+                    }
+                    break;
+                case 34: /* VUZP */
+                    /* Reg  Before       After
+                       Rd   A3 A2 A1 A0  B2 B0 A2 A0
+                       Rm   B3 B2 B1 B0  B3 B1 A3 A1
+                     */
+                    if (size == 3)
+                        return 1;
+                    gen_neon_unzip(rd, q, 0, size);
+                    gen_neon_unzip(rm, q, 4, size);
+                    if (q) {
+                        static int unzip_order_q[8] =
+                            {0, 2, 4, 6, 1, 3, 5, 7};
+                        for (n = 0; n < 8; n++) {
+                            int reg = (n < 4) ? rd : rm;
+                            gen_neon_movl_T0_scratch(unzip_order_q[n]);
+                            NEON_SET_REG(T0, reg, n % 4);
+                        }
+                    } else {
+                        static int unzip_order[4] =
+                            {0, 4, 1, 5};
+                        for (n = 0; n < 4; n++) {
+                            int reg = (n < 2) ? rd : rm;
+                            gen_neon_movl_T0_scratch(unzip_order[n]);
+                            NEON_SET_REG(T0, reg, n % 2);
+                        }
+                    }
+                    break;
+                case 35: /* VZIP */
+                    /* Reg  Before       After
+                       Rd   A3 A2 A1 A0  B1 A1 B0 A0
+                       Rm   B3 B2 B1 B0  B3 A3 B2 A2
+                     */
+                    if (size == 3)
+                        return 1;
+                    count = (q ? 4 : 2);
+                    for (n = 0; n < count; n++) {
+                        NEON_GET_REG(T0, rd, n);
+                        NEON_GET_REG(T1, rd, n);
+                        switch (size) {
+                        case 0: gen_helper_neon_zip_u8(); break;
+                        case 1: gen_helper_neon_zip_u16(); break;
+                        case 2: /* no-op */; break;
+                        default: abort();
+                        }
+                        gen_neon_movl_scratch_T0(n * 2);
+                        gen_neon_movl_scratch_T1(n * 2 + 1);
+                    }
+                    for (n = 0; n < count * 2; n++) {
+                        int reg = (n < count) ? rd : rm;
+                        gen_neon_movl_T0_scratch(n);
+                        NEON_SET_REG(T0, reg, n % count);
+                    }
+                    break;
+                case 36: case 37: /* VMOVN, VQMOVUN, VQMOVN */
+                    if (size == 3)
+                        return 1;
+                    TCGV_UNUSED(tmp2);
+                    for (pass = 0; pass < 2; pass++) {
+                        neon_load_reg64(cpu_V0, rm + pass);
+                        tmp = new_tmp();
+                        if (op == 36 && q == 0) {
+                            gen_neon_narrow(size, tmp, cpu_V0);
+                        } else if (q) {
+                            gen_neon_narrow_satu(size, tmp, cpu_V0);
+                        } else {
+                            gen_neon_narrow_sats(size, tmp, cpu_V0);
+                        }
+                        if (pass == 0) {
+                            tmp2 = tmp;
+                        } else {
+                            neon_store_reg(rd, 0, tmp2);
+                            neon_store_reg(rd, 1, tmp);
+                        }
+                    }
+                    break;
+                case 38: /* VSHLL */
+                    if (q || size == 3)
+                        return 1;
+                    tmp = neon_load_reg(rm, 0);
+                    tmp2 = neon_load_reg(rm, 1);
+                    for (pass = 0; pass < 2; pass++) {
+                        if (pass == 1)
+                            tmp = tmp2;
+                        gen_neon_widen(cpu_V0, tmp, size, 1);
+                        neon_store_reg64(cpu_V0, rd + pass);
+                    }
+                    break;
+                default:
+                elementwise:
+                    for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                        if (op == 30 || op == 31 || op >= 58) {
+                            tcg_gen_ld_f32(cpu_F0s, cpu_env,
+                                           neon_reg_offset(rm, pass));
+                        } else {
+                            NEON_GET_REG(T0, rm, pass);
+                        }
+                        switch (op) {
+                        case 1: /* VREV32 */
+                            switch (size) {
+                            case 0: tcg_gen_bswap_i32(cpu_T[0], cpu_T[0]); break;
+                            case 1: gen_swap_half(cpu_T[0]); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 2: /* VREV16 */
+                            if (size != 0)
+                                return 1;
+                            gen_rev16(cpu_T[0]);
+                            break;
+                        case 8: /* CLS */
+                            switch (size) {
+                            case 0: gen_helper_neon_cls_s8(cpu_T[0], cpu_T[0]); break;
+                            case 1: gen_helper_neon_cls_s16(cpu_T[0], cpu_T[0]); break;
+                            case 2: gen_helper_neon_cls_s32(cpu_T[0], cpu_T[0]); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 9: /* CLZ */
+                            switch (size) {
+                            case 0: gen_helper_neon_clz_u8(cpu_T[0], cpu_T[0]); break;
+                            case 1: gen_helper_neon_clz_u16(cpu_T[0], cpu_T[0]); break;
+                            case 2: gen_helper_clz(cpu_T[0], cpu_T[0]); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 10: /* CNT */
+                            if (size != 0)
+                                return 1;
+                            gen_helper_neon_cnt_u8(cpu_T[0], cpu_T[0]);
+                            break;
+                        case 11: /* VNOT */
+                            if (size != 0)
+                                return 1;
+                            gen_op_notl_T0();
+                            break;
+                        case 14: /* VQABS */
+                            switch (size) {
+                            case 0: gen_helper_neon_qabs_s8(cpu_T[0], cpu_env, cpu_T[0]); break;
+                            case 1: gen_helper_neon_qabs_s16(cpu_T[0], cpu_env, cpu_T[0]); break;
+                            case 2: gen_helper_neon_qabs_s32(cpu_T[0], cpu_env, cpu_T[0]); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 15: /* VQNEG */
+                            switch (size) {
+                            case 0: gen_helper_neon_qneg_s8(cpu_T[0], cpu_env, cpu_T[0]); break;
+                            case 1: gen_helper_neon_qneg_s16(cpu_T[0], cpu_env, cpu_T[0]); break;
+                            case 2: gen_helper_neon_qneg_s32(cpu_T[0], cpu_env, cpu_T[0]); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 16: case 19: /* VCGT #0, VCLE #0 */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_helper_neon_cgt_s8(CPU_T001); break;
+                            case 1: gen_helper_neon_cgt_s16(CPU_T001); break;
+                            case 2: gen_helper_neon_cgt_s32(CPU_T001); break;
+                            default: return 1;
+                            }
+                            if (op == 19)
+                                gen_op_notl_T0();
+                            break;
+                        case 17: case 20: /* VCGE #0, VCLT #0 */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_helper_neon_cge_s8(CPU_T001); break;
+                            case 1: gen_helper_neon_cge_s16(CPU_T001); break;
+                            case 2: gen_helper_neon_cge_s32(CPU_T001); break;
+                            default: return 1;
+                            }
+                            if (op == 20)
+                                gen_op_notl_T0();
+                            break;
+                        case 18: /* VCEQ #0 */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_helper_neon_ceq_u8(CPU_T001); break;
+                            case 1: gen_helper_neon_ceq_u16(CPU_T001); break;
+                            case 2: gen_helper_neon_ceq_u32(CPU_T001); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 22: /* VABS */
+                            switch(size) {
+                            case 0: gen_helper_neon_abs_s8(cpu_T[0], cpu_T[0]); break;
+                            case 1: gen_helper_neon_abs_s16(cpu_T[0], cpu_T[0]); break;
+                            case 2: tcg_gen_abs_i32(cpu_T[0], cpu_T[0]); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 23: /* VNEG */
+                            gen_op_movl_T1_im(0);
+                            if (size == 3)
+                                return 1;
+                            gen_neon_rsb(size);
+                            break;
+                        case 24: case 27: /* Float VCGT #0, Float VCLE #0 */
+                            gen_op_movl_T1_im(0);
+                            gen_helper_neon_cgt_f32(CPU_T001);
+                            if (op == 27)
+                                gen_op_notl_T0();
+                            break;
+                        case 25: case 28: /* Float VCGE #0, Float VCLT #0 */
+                            gen_op_movl_T1_im(0);
+                            gen_helper_neon_cge_f32(CPU_T001);
+                            if (op == 28)
+                                gen_op_notl_T0();
+                            break;
+                        case 26: /* Float VCEQ #0 */
+                            gen_op_movl_T1_im(0);
+                            gen_helper_neon_ceq_f32(CPU_T001);
+                            break;
+                        case 30: /* Float VABS */
+                            gen_vfp_abs(0);
+                            break;
+                        case 31: /* Float VNEG */
+                            gen_vfp_neg(0);
+                            break;
+                        case 32: /* VSWP */
+                            NEON_GET_REG(T1, rd, pass);
+                            NEON_SET_REG(T1, rm, pass);
+                            break;
+                        case 33: /* VTRN */
+                            NEON_GET_REG(T1, rd, pass);
+                            switch (size) {
+                            case 0: gen_helper_neon_trn_u8(); break;
+                            case 1: gen_helper_neon_trn_u16(); break;
+                            case 2: abort();
+                            default: return 1;
+                            }
+                            NEON_SET_REG(T1, rm, pass);
+                            break;
+                        case 56: /* Integer VRECPE */
+                            gen_helper_recpe_u32(cpu_T[0], cpu_T[0], cpu_env);
+                            break;
+                        case 57: /* Integer VRSQRTE */
+                            gen_helper_rsqrte_u32(cpu_T[0], cpu_T[0], cpu_env);
+                            break;
+                        case 58: /* Float VRECPE */
+                            gen_helper_recpe_f32(cpu_F0s, cpu_F0s, cpu_env);
+                            break;
+                        case 59: /* Float VRSQRTE */
+                            gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, cpu_env);
+                            break;
+                        case 60: /* VCVT.F32.S32 */
+                            gen_vfp_tosiz(0);
+                            break;
+                        case 61: /* VCVT.F32.U32 */
+                            gen_vfp_touiz(0);
+                            break;
+                        case 62: /* VCVT.S32.F32 */
+                            gen_vfp_sito(0);
+                            break;
+                        case 63: /* VCVT.U32.F32 */
+                            gen_vfp_uito(0);
+                            break;
+                        default:
+                            /* Reserved: 21, 29, 39-56 */
+                            return 1;
+                        }
+                        if (op == 30 || op == 31 || op >= 58) {
+                            tcg_gen_st_f32(cpu_F0s, cpu_env,
+                                           neon_reg_offset(rd, pass));
+                        } else {
+                            NEON_SET_REG(T0, rd, pass);
+                        }
+                    }
+                    break;
+                }
+            } else if ((insn & (1 << 10)) == 0) {
+                /* VTBL, VTBX.  */
+                n = (insn >> 5) & 0x18;
+                if (insn & (1 << 6)) {
+                    tmp = neon_load_reg(rd, 0);
+                } else {
+                    tmp = new_tmp();
+                    tcg_gen_movi_i32(tmp, 0);
+                }
+                tmp2 = neon_load_reg(rm, 0);
+                gen_helper_neon_tbl(tmp2, tmp2, tmp, tcg_const_i32(rn),
+                                    tcg_const_i32(n));
+                if (insn & (1 << 6)) {
+                    tmp = neon_load_reg(rd, 1);
+                } else {
+                    tmp = new_tmp();
+                    tcg_gen_movi_i32(tmp, 0);
+                }
+                tmp3 = neon_load_reg(rm, 1);
+                gen_helper_neon_tbl(tmp3, tmp3, tmp, tcg_const_i32(rn),
+                                    tcg_const_i32(n));
+                neon_store_reg(rd, 0, tmp2);
+                neon_store_reg(rd, 1, tmp2);
+            } else if ((insn & 0x380) == 0) {
+                /* VDUP */
+                if (insn & (1 << 19)) {
+                    NEON_SET_REG(T0, rm, 1);
+                } else {
+                    NEON_SET_REG(T0, rm, 0);
+                }
+                if (insn & (1 << 16)) {
+                    gen_neon_dup_u8(cpu_T[0], ((insn >> 17) & 3) * 8);
+                } else if (insn & (1 << 17)) {
+                    if ((insn >> 18) & 1)
+                        gen_neon_dup_high16(cpu_T[0]);
+                    else
+                        gen_neon_dup_low16(cpu_T[0]);
+                }
+                for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                    NEON_SET_REG(T0, rd, pass);
+                }
+            } else {
+                return 1;
+            }
+        }
+    }
+    return 0;
+}
+
+static int disas_coproc_insn(CPUState * env, DisasContext *s, uint32_t insn)
+{
+    int cpnum;
+
+    cpnum = (insn >> 8) & 0xf;
+    if (arm_feature(env, ARM_FEATURE_XSCALE)
+	    && ((env->cp15.c15_cpar ^ 0x3fff) & (1 << cpnum)))
+	return 1;
+
+    switch (cpnum) {
+      case 0:
+      case 1:
+	if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
+	    return disas_iwmmxt_insn(env, s, insn);
+	} else if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+	    return disas_dsp_insn(env, s, insn);
+	}
+	return 1;
+    case 10:
+    case 11:
+	return disas_vfp_insn (env, s, insn);
+    case 15:
+	return disas_cp15_insn (env, s, insn);
+    default:
+	/* Unknown coprocessor.  See if the board has hooked it.  */
+	return disas_cp_insn (env, s, insn);
+    }
+}
+
+
+/* Store a 64-bit value to a register pair.  Clobbers val.  */
+static void gen_storeq_reg(DisasContext *s, int rlow, int rhigh, TCGv val)
+{
+    TCGv tmp;
+    tmp = new_tmp();
+    tcg_gen_trunc_i64_i32(tmp, val);
+    store_reg(s, rlow, tmp);
+    tmp = new_tmp();
+    tcg_gen_shri_i64(val, val, 32);
+    tcg_gen_trunc_i64_i32(tmp, val);
+    store_reg(s, rhigh, tmp);
+}
+
+/* load a 32-bit value from a register and perform a 64-bit accumulate.  */
+static void gen_addq_lo(DisasContext *s, TCGv val, int rlow)
+{
+    TCGv tmp;
+    TCGv tmp2;
+
+    /* Load 64-bit value rd:rn.  */
+    tmp = tcg_temp_new(TCG_TYPE_I64);
+    tmp2 = load_reg(s, rlow);
+    tcg_gen_extu_i32_i64(tmp, tmp2);
+    dead_tmp(tmp2);
+    tcg_gen_add_i64(val, val, tmp);
+}
+
+/* load and add a 64-bit value from a register pair.  */
+static void gen_addq(DisasContext *s, TCGv val, int rlow, int rhigh)
+{
+    TCGv tmp;
+    TCGv tmp2;
+
+    /* Load 64-bit value rd:rn.  */
+    tmp = tcg_temp_new(TCG_TYPE_I64);
+    tmp2 = load_reg(s, rhigh);
+    tcg_gen_extu_i32_i64(tmp, tmp2);
+    dead_tmp(tmp2);
+    tcg_gen_shli_i64(tmp, tmp, 32);
+    tcg_gen_add_i64(val, val, tmp);
+
+    tmp2 = load_reg(s, rlow);
+    tcg_gen_extu_i32_i64(tmp, tmp2);
+    dead_tmp(tmp2);
+    tcg_gen_add_i64(val, val, tmp);
+}
+
+/* Set N and Z flags from a 64-bit value.  */
+static void gen_logicq_cc(TCGv val)
+{
+    TCGv tmp = new_tmp();
+    gen_helper_logicq_cc(tmp, val);
+    gen_logic_CC(tmp);
+    dead_tmp(tmp);
+}
+
 static void disas_arm_insn(CPUState * env, DisasContext *s)
 {
     unsigned int cond, insn, val, op1, i, shift, rm, rs, rn, rd, sh;
-#ifdef GEN_TRACE
-    int          insn_ticks = 0;
+    TCGv tmp;
+    TCGv tmp2;
+    TCGv tmp3;
+    TCGv addr;
+#ifdef CONFIG_TRACE
+    int  ticks = 0;
 #endif
 
     insn = ldl_code(s->pc);
-#ifdef GEN_TRACE
+#ifdef CONFIG_TRACE
     if (tracing) {
-        trace_add_insn(insn, 0 /* not thumb */);
-        insn_ticks = get_insn_ticks(insn);
-        gen_op_trace_insn();
+        trace_add_insn(insn);
+        ticks = get_insn_ticks_arm(insn);
+        gen_helper_traceInsn();
     }
 #endif
     s->pc += 4;
 
+    /* M variants do not implement ARM mode.  */
+    if (IS_M(env))
+        goto illegal_op;
     cond = insn >> 28;
     if (cond == 0xf){
-#ifdef GEN_TRACE
-        if (tracing)
-            gen_op_add_to_sim_time(insn_ticks);
+#ifdef CONFIG_TRACE
+        if (tracing) {
+            gen_traceTicks(ticks);
+        }
 #endif
         /* Unconditional instructions.  */
+        if (((insn >> 25) & 7) == 1) {
+            /* NEON Data processing.  */
+            if (!arm_feature(env, ARM_FEATURE_NEON))
+                goto illegal_op;
+
+            if (disas_neon_data_insn(env, s, insn))
+                goto illegal_op;
+            return;
+        }
+        if ((insn & 0x0f100000) == 0x04000000) {
+            /* NEON load/store.  */
+            if (!arm_feature(env, ARM_FEATURE_NEON))
+                goto illegal_op;
+
+            if (disas_neon_ls_insn(env, s, insn))
+                goto illegal_op;
+            return;
+        }
         if ((insn & 0x0d70f000) == 0x0550f000)
             return; /* PLD */
-        else if ((insn & 0x0e000000) == 0x0a000000) {
+        else if ((insn & 0x0ffffdff) == 0x01010000) {
+            ARCH(6);
+            /* setend */
+            if (insn & (1 << 9)) {
+                /* BE8 mode not implemented.  */
+                goto illegal_op;
+            }
+            return;
+        } else if ((insn & 0x0fffff00) == 0x057ff000) {
+            switch ((insn >> 4) & 0xf) {
+            case 1: /* clrex */
+                ARCH(6K);
+                gen_helper_clrex(cpu_env);
+                return;
+            case 4: /* dsb */
+            case 5: /* dmb */
+            case 6: /* isb */
+                ARCH(7);
+                /* We don't emulate caches so these are a no-op.  */
+                return;
+            default:
+                goto illegal_op;
+            }
+        } else if ((insn & 0x0e5fffe0) == 0x084d0500) {
+            /* srs */
+            uint32_t offset;
+            if (IS_USER(s))
+                goto illegal_op;
+            ARCH(6);
+            op1 = (insn & 0x1f);
+            if (op1 == (env->uncached_cpsr & CPSR_M)) {
+                addr = load_reg(s, 13);
+            } else {
+                addr = new_tmp();
+                gen_helper_get_r13_banked(addr, cpu_env, tcg_const_i32(op1));
+            }
+            i = (insn >> 23) & 3;
+            switch (i) {
+            case 0: offset = -4; break; /* DA */
+            case 1: offset = -8; break; /* DB */
+            case 2: offset = 0; break; /* IA */
+            case 3: offset = 4; break; /* IB */
+            default: abort();
+            }
+            if (offset)
+                tcg_gen_addi_i32(addr, addr, offset);
+            tmp = load_reg(s, 14);
+            gen_st32(tmp, addr, 0);
+            tmp = new_tmp();
+            gen_helper_cpsr_read(tmp);
+            tcg_gen_addi_i32(addr, addr, 4);
+            gen_st32(tmp, addr, 0);
+            if (insn & (1 << 21)) {
+                /* Base writeback.  */
+                switch (i) {
+                case 0: offset = -8; break;
+                case 1: offset = -4; break;
+                case 2: offset = 4; break;
+                case 3: offset = 0; break;
+                default: abort();
+                }
+                if (offset)
+                    tcg_gen_addi_i32(addr, tmp, offset);
+                if (op1 == (env->uncached_cpsr & CPSR_M)) {
+                    gen_movl_reg_T1(s, 13);
+                } else {
+                    gen_helper_set_r13_banked(cpu_env, tcg_const_i32(op1), cpu_T[1]);
+                }
+            } else {
+                dead_tmp(addr);
+            }
+        } else if ((insn & 0x0e5fffe0) == 0x081d0a00) {
+            /* rfe */
+            uint32_t offset;
+            if (IS_USER(s))
+                goto illegal_op;
+            ARCH(6);
+            rn = (insn >> 16) & 0xf;
+            addr = load_reg(s, rn);
+            i = (insn >> 23) & 3;
+            switch (i) {
+            case 0: offset = -4; break; /* DA */
+            case 1: offset = -8; break; /* DB */
+            case 2: offset = 0; break; /* IA */
+            case 3: offset = 4; break; /* IB */
+            default: abort();
+            }
+            if (offset)
+                tcg_gen_addi_i32(addr, addr, offset);
+            /* Load PC into tmp and CPSR into tmp2.  */
+            tmp = gen_ld32(addr, 0);
+            tcg_gen_addi_i32(addr, addr, 4);
+            tmp2 = gen_ld32(addr, 0);
+            if (insn & (1 << 21)) {
+                /* Base writeback.  */
+                switch (i) {
+                case 0: offset = -8; break;
+                case 1: offset = -4; break;
+                case 2: offset = 4; break;
+                case 3: offset = 0; break;
+                default: abort();
+                }
+                if (offset)
+                    tcg_gen_addi_i32(addr, addr, offset);
+                store_reg(s, rn, addr);
+            } else {
+                dead_tmp(addr);
+            }
+            gen_rfe(s, tmp, tmp2);
+        } else if ((insn & 0x0e000000) == 0x0a000000) {
             /* branch link and change to thumb (blx <offset>) */
             int32_t offset;
 
             val = (uint32_t)s->pc;
-            gen_op_movl_T0_im(val);
-            gen_movl_reg_T0(s, 14);
+            tmp = new_tmp();
+            tcg_gen_movi_i32(tmp, val);
+            store_reg(s, 14, tmp);
             /* Sign-extend the 24-bit offset */
             offset = (((int32_t)insn) << 8) >> 8;
             /* offset * 4 + bit24 * 2 + (thumb bit) */
             val += (offset << 2) | ((insn >> 23) & 2) | 1;
             /* pipeline offset */
             val += 4;
-            gen_op_movl_T0_im(val);
-            gen_bx(s);
+            gen_bx_im(s, val);
             return;
+        } else if ((insn & 0x0e000f00) == 0x0c000100) {
+            if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
+                /* iWMMXt register transfer.  */
+                if (env->cp15.c15_cpar & (1 << 1))
+                    if (!disas_iwmmxt_insn(env, s, insn))
+                        return;
+            }
         } else if ((insn & 0x0fe00000) == 0x0c400000) {
             /* Coprocessor double register transfer.  */
         } else if ((insn & 0x0f000010) == 0x0e000010) {
             /* Additional coprocessor register transfer.  */
-        } else if ((insn & 0x0ff10010) == 0x01000000) {
+        } else if ((insn & 0x0ff10020) == 0x01000000) {
+            uint32_t mask;
+            uint32_t val;
             /* cps (privileged) */
-        } else if ((insn & 0x0ffffdff) == 0x01010000) {
-            /* setend */
-            if (insn & (1 << 9)) {
-                /* BE8 mode not implemented.  */
-                goto illegal_op;
+            if (IS_USER(s))
+                return;
+            mask = val = 0;
+            if (insn & (1 << 19)) {
+                if (insn & (1 << 8))
+                    mask |= CPSR_A;
+                if (insn & (1 << 7))
+                    mask |= CPSR_I;
+                if (insn & (1 << 6))
+                    mask |= CPSR_F;
+                if (insn & (1 << 18))
+                    val |= mask;
+            }
+            if (insn & (1 << 17)) {
+                mask |= CPSR_M;
+                val |= (insn & 0x1f);
+            }
+            if (mask) {
+                gen_op_movl_T0_im(val);
+                gen_set_psr_T0(s, mask, 0);
             }
             return;
         }
         goto illegal_op;
     }
     if (cond != 0xe) {
-#ifdef GEN_TRACE
+#ifdef CONFIG_TRACE
         if (tracing) {
-            /* a non-executed conditional instruction takes only 1 cycle */
-            gen_op_add_to_sim_time(1);
-            insn_ticks -= 1;
+            /* a non-executed conditional instruction takes */
+            /* only 1 cycle */
+            gen_traceTicks(1);
+            ticks -= 1;
         }
 #endif
         /* if not always execute, we generate a conditional jump to
            next instruction */
         s->condlabel = gen_new_label();
-        gen_test_cc[cond ^ 1](s->condlabel);
+        gen_test_cc(cond ^ 1, s->condlabel);
         s->condjmp = 1;
-        //gen_test_cc[cond ^ 1]((long)s->tb, (long)s->pc);
-        //s->is_jmp = DISAS_JUMP_NEXT;
     }
-#ifdef GEN_TRACE
-    if (tracing)
-        gen_op_add_to_sim_time(insn_ticks);
+#ifdef CONFIG_TRACE
+    if (tracing && ticks > 0) {
+        gen_traceTicks(ticks);
+    }
 #endif
     if ((insn & 0x0f900000) == 0x03000000) {
-        if ((insn & 0x0fb0f000) != 0x0320f000)
-            goto illegal_op;
-        /* CPSR = immediate */
-        val = insn & 0xff;
-        shift = ((insn >> 8) & 0xf) * 2;
-        if (shift)
-            val = (val >> shift) | (val << (32 - shift));
-        gen_op_movl_T0_im(val);
-        i = ((insn & (1 << 22)) != 0);
-        if (gen_set_psr_T0(s, msr_mask(s, (insn >> 16) & 0xf, i), i))
-            goto illegal_op;
+        if ((insn & (1 << 21)) == 0) {
+            ARCH(6T2);
+            rd = (insn >> 12) & 0xf;
+            val = ((insn >> 4) & 0xf000) | (insn & 0xfff);
+            if ((insn & (1 << 22)) == 0) {
+                /* MOVW */
+                tmp = new_tmp();
+                tcg_gen_movi_i32(tmp, val);
+            } else {
+                /* MOVT */
+                tmp = load_reg(s, rd);
+                tcg_gen_ext16u_i32(tmp, tmp);
+                tcg_gen_ori_i32(tmp, tmp, val << 16);
+            }
+            store_reg(s, rd, tmp);
+        } else {
+            if (((insn >> 12) & 0xf) != 0xf)
+                goto illegal_op;
+            if (((insn >> 16) & 0xf) == 0) {
+                gen_nop_hint(s, insn & 0xff);
+            } else {
+                /* CPSR = immediate */
+                val = insn & 0xff;
+                shift = ((insn >> 8) & 0xf) * 2;
+                if (shift)
+                    val = (val >> shift) | (val << (32 - shift));
+                gen_op_movl_T0_im(val);
+                i = ((insn & (1 << 22)) != 0);
+                if (gen_set_psr_T0(s, msr_mask(env, s, (insn >> 16) & 0xf, i), i))
+                    goto illegal_op;
+            }
+        }
     } else if ((insn & 0x0f900000) == 0x01000000
                && (insn & 0x00000090) != 0x00000090) {
         /* miscellaneous instructions */
@@ -1223,7 +5959,7 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                 /* PSR = reg */
                 gen_movl_T0_reg(s, rm);
                 i = ((op1 & 2) != 0);
-                if (gen_set_psr_T0(s, msr_mask(s, (insn >> 16) & 0xf, i), i))
+                if (gen_set_psr_T0(s, msr_mask(env, s, (insn >> 16) & 0xf, i), i))
                     goto illegal_op;
             } else {
                 /* reg = PSR */
@@ -1231,24 +5967,25 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                 if (op1 & 2) {
                     if (IS_USER(s))
                         goto illegal_op;
-                    gen_op_movl_T0_spsr();
+                    tmp = load_cpu_field(spsr);
                 } else {
-                    gen_op_movl_T0_cpsr();
+                    tmp = new_tmp();
+                    gen_helper_cpsr_read(tmp);
                 }
-                gen_movl_reg_T0(s, rd);
+                store_reg(s, rd, tmp);
             }
             break;
         case 0x1:
             if (op1 == 1) {
                 /* branch/exchange thumb (bx).  */
-                gen_movl_T0_reg(s, rm);
-                gen_bx(s);
+                tmp = load_reg(s, rm);
+                gen_bx(s, tmp);
             } else if (op1 == 3) {
                 /* clz */
                 rd = (insn >> 12) & 0xf;
-                gen_movl_T0_reg(s, rm);
-                gen_op_clz_T0();
-                gen_movl_reg_T0(s, rd);
+                tmp = load_reg(s, rm);
+                gen_helper_clz(tmp, tmp);
+                store_reg(s, rd, tmp);
             } else {
                 goto illegal_op;
             }
@@ -1257,8 +5994,8 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
             if (op1 == 1) {
                 ARCH(5J); /* bxj */
                 /* Trivial implementation equivalent to bx.  */
-                gen_movl_T0_reg(s, rm);
-                gen_bx(s);
+                tmp = load_reg(s, rm);
+                gen_bx(s, tmp);
             } else {
                 goto illegal_op;
             }
@@ -1268,29 +6005,30 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
               goto illegal_op;
 
             /* branch link/exchange thumb (blx) */
-            val = (uint32_t)s->pc;
-            gen_op_movl_T0_im(val);
-            gen_movl_reg_T0(s, 14);
-            gen_movl_T0_reg(s, rm);
-            gen_bx(s);
+            tmp = load_reg(s, rm);
+            tmp2 = new_tmp();
+            tcg_gen_movi_i32(tmp2, s->pc);
+            store_reg(s, 14, tmp2);
+            gen_bx(s, tmp);
             break;
         case 0x5: /* saturating add/subtract */
             rd = (insn >> 12) & 0xf;
             rn = (insn >> 16) & 0xf;
-            gen_movl_T0_reg(s, rm);
-            gen_movl_T1_reg(s, rn);
+            tmp = load_reg(s, rn);
+            tmp2 = load_reg(s, rn);
             if (op1 & 2)
-                gen_op_double_T1_saturate();
+                gen_helper_double_saturate(tmp2, tmp2);
             if (op1 & 1)
-                gen_op_subl_T0_T1_saturate();
+                gen_helper_sub_saturate(tmp, tmp, tmp2);
             else
-                gen_op_addl_T0_T1_saturate();
-            gen_movl_reg_T0(s, rd);
+                gen_helper_add_saturate(tmp, tmp, tmp2);
+            dead_tmp(tmp2);
+            store_reg(s, rd, tmp);
             break;
         case 7: /* bkpt */
-            gen_op_movl_T0_im((long)s->pc - 4);
-            gen_op_movl_reg_TN[0][15]();
-            gen_op_bkpt();
+            gen_set_condexec(s);
+            gen_set_pc_im(s->pc - 4);
+            gen_exception(EXCP_BKPT);
             s->is_jmp = DISAS_JUMP;
             break;
         case 0x8: /* signed multiply */
@@ -1302,34 +6040,41 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
             rd = (insn >> 16) & 0xf;
             if (op1 == 1) {
                 /* (32 * 16) >> 16 */
-                gen_movl_T0_reg(s, rm);
-                gen_movl_T1_reg(s, rs);
+                tmp = load_reg(s, rm);
+                tmp2 = load_reg(s, rs);
                 if (sh & 4)
-                    gen_op_sarl_T1_im(16);
+                    tcg_gen_sari_i32(tmp2, tmp2, 16);
                 else
-                    gen_op_sxth_T1();
-                gen_op_imulw_T0_T1();
+                    gen_sxth(tmp2);
+                tmp2 = gen_muls_i64_i32(tmp, tmp2);
+                tcg_gen_shri_i64(tmp2, tmp2, 16);
+                tmp = new_tmp();
+                tcg_gen_trunc_i64_i32(tmp, tmp2);
                 if ((sh & 2) == 0) {
-                    gen_movl_T1_reg(s, rn);
-                    gen_op_addl_T0_T1_setq();
+                    tmp2 = load_reg(s, rn);
+                    gen_helper_add_setq(tmp, tmp, tmp2);
+                    dead_tmp(tmp2);
                 }
-                gen_movl_reg_T0(s, rd);
+                store_reg(s, rd, tmp);
             } else {
                 /* 16 * 16 */
-                gen_movl_T0_reg(s, rm);
-                gen_movl_T1_reg(s, rs);
-                gen_mulxy(sh & 2, sh & 4);
+                tmp = load_reg(s, rm);
+                tmp2 = load_reg(s, rs);
+                gen_mulxy(tmp, tmp2, sh & 2, sh & 4);
+                dead_tmp(tmp2);
                 if (op1 == 2) {
-                    gen_op_signbit_T1_T0();
-                    gen_op_addq_T0_T1(rn, rd);
-                    gen_movl_reg_T0(s, rn);
-                    gen_movl_reg_T1(s, rd);
+                    tmp2 = tcg_temp_new(TCG_TYPE_I64);
+                    tcg_gen_ext_i32_i64(tmp2, tmp);
+                    dead_tmp(tmp);
+                    gen_addq(s, tmp2, rn, rd);
+                    gen_storeq_reg(s, rn, rd, tmp2);
                 } else {
                     if (op1 == 0) {
-                        gen_movl_T1_reg(s, rn);
-                        gen_op_addl_T0_T1_setq();
+                        tmp2 = load_reg(s, rn);
+                        gen_helper_add_setq(tmp, tmp, tmp2);
+                        dead_tmp(tmp2);
                     }
-                    gen_movl_reg_T0(s, rd);
+                    store_reg(s, rd, tmp);
                 }
             }
             break;
@@ -1354,7 +6099,7 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                 val = (val >> shift) | (val << (32 - shift));
             gen_op_movl_T1_im(val);
             if (logic_cc && shift)
-                gen_op_mov_CF_T1();
+                gen_set_CF_bit31(cpu_T[1]);
         } else {
             /* register */
             rm = (insn) & 0xf;
@@ -1362,27 +6107,11 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
             shiftop = (insn >> 5) & 3;
             if (!(insn & (1 << 4))) {
                 shift = (insn >> 7) & 0x1f;
-                if (shift != 0) {
-                    if (logic_cc) {
-                        gen_shift_T1_im_cc[shiftop](shift);
-                    } else {
-                        gen_shift_T1_im[shiftop](shift);
-                    }
-                } else if (shiftop != 0) {
-                    if (logic_cc) {
-                        gen_shift_T1_0_cc[shiftop]();
-                    } else {
-                        gen_shift_T1_0[shiftop]();
-                    }
-                }
+                gen_arm_shift_im(cpu_T[1], shiftop, shift, logic_cc);
             } else {
                 rs = (insn >> 8) & 0xf;
-                gen_movl_T0_reg(s, rs);
-                if (logic_cc) {
-                    gen_shift_T1_T0_cc[shiftop]();
-                } else {
-                    gen_shift_T1_T0[shiftop]();
-                }
+                tmp = load_reg(s, rs);
+                gen_arm_shift_reg(cpu_T[1], shiftop, tmp, logic_cc);
             }
         }
         if (op1 != 0x0f && op1 != 0x0d) {
@@ -1436,21 +6165,21 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
             if (set_cc)
                 gen_op_adcl_T0_T1_cc();
             else
-                gen_op_adcl_T0_T1();
+                gen_adc_T0_T1();
             gen_movl_reg_T0(s, rd);
             break;
         case 0x06:
             if (set_cc)
                 gen_op_sbcl_T0_T1_cc();
             else
-                gen_op_sbcl_T0_T1();
+                gen_sbc_T0_T1();
             gen_movl_reg_T0(s, rd);
             break;
         case 0x07:
             if (set_cc)
                 gen_op_rscl_T0_T1_cc();
             else
-                gen_op_rscl_T0_T1();
+                gen_rsc_T0_T1();
             gen_movl_reg_T0(s, rd);
             break;
         case 0x08:
@@ -1522,131 +6251,408 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                     rn = (insn >> 12) & 0xf;
                     rs = (insn >> 8) & 0xf;
                     rm = (insn) & 0xf;
-                    if (((insn >> 22) & 3) == 0) {
+                    op1 = (insn >> 20) & 0xf;
+                    switch (op1) {
+                    case 0: case 1: case 2: case 3: case 6:
                         /* 32 bit mul */
-                        gen_movl_T0_reg(s, rs);
-                        gen_movl_T1_reg(s, rm);
-                        gen_op_mul_T0_T1();
-                        if (insn & (1 << 21)) {
-                            gen_movl_T1_reg(s, rn);
-                            gen_op_addl_T0_T1();
+                        tmp = load_reg(s, rs);
+                        tmp2 = load_reg(s, rm);
+                        tcg_gen_mul_i32(tmp, tmp, tmp2);
+                        dead_tmp(tmp2);
+                        if (insn & (1 << 22)) {
+                            /* Subtract (mls) */
+                            ARCH(6T2);
+                            tmp2 = load_reg(s, rn);
+                            tcg_gen_sub_i32(tmp, tmp2, tmp);
+                            dead_tmp(tmp2);
+                        } else if (insn & (1 << 21)) {
+                            /* Add */
+                            tmp2 = load_reg(s, rn);
+                            tcg_gen_add_i32(tmp, tmp, tmp2);
+                            dead_tmp(tmp2);
                         }
                         if (insn & (1 << 20))
-                            gen_op_logic_T0_cc();
-                        gen_movl_reg_T0(s, rd);
-                    } else {
+                            gen_logic_CC(tmp);
+                        store_reg(s, rd, tmp);
+                        break;
+                    default:
                         /* 64 bit mul */
-                        gen_movl_T0_reg(s, rs);
-                        gen_movl_T1_reg(s, rm);
+                        tmp = load_reg(s, rs);
+                        tmp2 = load_reg(s, rm);
                         if (insn & (1 << 22))
-                            gen_op_imull_T0_T1();
+                            tmp = gen_muls_i64_i32(tmp, tmp2);
                         else
-                            gen_op_mull_T0_T1();
+                            tmp = gen_mulu_i64_i32(tmp, tmp2);
                         if (insn & (1 << 21)) /* mult accumulate */
-                            gen_op_addq_T0_T1(rn, rd);
+                            gen_addq(s, tmp, rn, rd);
                         if (!(insn & (1 << 23))) { /* double accumulate */
                             ARCH(6);
-                            gen_op_addq_lo_T0_T1(rn);
-                            gen_op_addq_lo_T0_T1(rd);
+                            gen_addq_lo(s, tmp, rn);
+                            gen_addq_lo(s, tmp, rd);
                         }
                         if (insn & (1 << 20))
-                            gen_op_logicq_cc();
-                        gen_movl_reg_T0(s, rn);
-                        gen_movl_reg_T1(s, rd);
+                            gen_logicq_cc(tmp);
+                        gen_storeq_reg(s, rn, rd, tmp);
+                        break;
                     }
                 } else {
                     rn = (insn >> 16) & 0xf;
                     rd = (insn >> 12) & 0xf;
                     if (insn & (1 << 23)) {
                         /* load/store exclusive */
-                        goto illegal_op;
+                        gen_movl_T1_reg(s, rn);
+                        addr = cpu_T[1];
+                        if (insn & (1 << 20)) {
+                            gen_helper_mark_exclusive(cpu_env, cpu_T[1]);
+                            tmp = gen_ld32(addr, IS_USER(s));
+                            store_reg(s, rd, tmp);
+                        } else {
+                            int label = gen_new_label();
+                            rm = insn & 0xf;
+                            gen_helper_test_exclusive(cpu_T[0], cpu_env, addr);
+                            tcg_gen_brcondi_i32(TCG_COND_NE, cpu_T[0],
+                                                0, label);
+                            tmp = load_reg(s,rm);
+                            gen_st32(tmp, cpu_T[1], IS_USER(s));
+                            gen_set_label(label);
+                            gen_movl_reg_T0(s, rd);
+                        }
                     } else {
                         /* SWP instruction */
                         rm = (insn) & 0xf;
 
-                        gen_movl_T0_reg(s, rm);
-                        gen_movl_T1_reg(s, rn);
+                        /* ??? This is not really atomic.  However we know
+                           we never have multiple CPUs running in parallel,
+                           so it is good enough.  */
+                        addr = load_reg(s, rn);
+                        tmp = load_reg(s, rm);
                         if (insn & (1 << 22)) {
-                            gen_ldst(swpb, s);
+                            tmp2 = gen_ld8u(addr, IS_USER(s));
+                            gen_st8(tmp, addr, IS_USER(s));
                         } else {
-                            gen_ldst(swpl, s);
+                            tmp2 = gen_ld32(addr, IS_USER(s));
+                            gen_st32(tmp, addr, IS_USER(s));
                         }
-                        gen_movl_reg_T0(s, rd);
+                        dead_tmp(addr);
+                        store_reg(s, rd, tmp2);
                     }
                 }
             } else {
                 int address_offset;
+                int load;
                 /* Misc load/store */
                 rn = (insn >> 16) & 0xf;
                 rd = (insn >> 12) & 0xf;
-                gen_movl_T1_reg(s, rn);
+                addr = load_reg(s, rn);
                 if (insn & (1 << 24))
-                    gen_add_datah_offset(s, insn, 0);
+                    gen_add_datah_offset(s, insn, 0, addr);
                 address_offset = 0;
                 if (insn & (1 << 20)) {
                     /* load */
                     switch(sh) {
                     case 1:
-                        gen_ldst(lduw, s);
+                        tmp = gen_ld16u(addr, IS_USER(s));
                         break;
                     case 2:
-                        gen_ldst(ldsb, s);
+                        tmp = gen_ld8s(addr, IS_USER(s));
                         break;
                     default:
                     case 3:
-                        gen_ldst(ldsw, s);
+                        tmp = gen_ld16s(addr, IS_USER(s));
                         break;
                     }
-                    gen_movl_reg_T0(s, rd);
+                    load = 1;
                 } else if (sh & 2) {
                     /* doubleword */
                     if (sh & 1) {
                         /* store */
-                        gen_movl_T0_reg(s, rd);
-                        gen_ldst(stl, s);
-                        gen_op_addl_T1_im(4);
-                        gen_movl_T0_reg(s, rd + 1);
-                        gen_ldst(stl, s);
+                        tmp = load_reg(s, rd);
+                        gen_st32(tmp, addr, IS_USER(s));
+                        tcg_gen_addi_i32(addr, addr, 4);
+                        tmp = load_reg(s, rd + 1);
+                        gen_st32(tmp, addr, IS_USER(s));
+                        load = 0;
                     } else {
                         /* load */
-                        gen_ldst(ldl, s);
-                        gen_movl_reg_T0(s, rd);
-                        gen_op_addl_T1_im(4);
-                        gen_ldst(ldl, s);
-                        gen_movl_reg_T0(s, rd + 1);
+                        tmp = gen_ld32(addr, IS_USER(s));
+                        store_reg(s, rd, tmp);
+                        tcg_gen_addi_i32(addr, addr, 4);
+                        tmp = gen_ld32(addr, IS_USER(s));
+                        rd++;
+                        load = 1;
                     }
                     address_offset = -4;
                 } else {
                     /* store */
-                    gen_movl_T0_reg(s, rd);
-                    gen_ldst(stw, s);
+                    tmp = load_reg(s, rd);
+                    gen_st16(tmp, addr, IS_USER(s));
+                    load = 0;
                 }
+                /* Perform base writeback before the loaded value to
+                   ensure correct behavior with overlapping index registers.
+                   ldrd with base writeback is is undefined if the
+                   destination and index registers overlap.  */
                 if (!(insn & (1 << 24))) {
-                    gen_add_datah_offset(s, insn, address_offset);
-                    gen_movl_reg_T1(s, rn);
+                    gen_add_datah_offset(s, insn, address_offset, addr);
+                    store_reg(s, rn, addr);
                 } else if (insn & (1 << 21)) {
                     if (address_offset)
-                        gen_op_addl_T1_im(address_offset);
-                    gen_movl_reg_T1(s, rn);
+                        tcg_gen_addi_i32(addr, addr, address_offset);
+                    store_reg(s, rn, addr);
+                } else {
+                    dead_tmp(addr);
+                }
+                if (load) {
+                    /* Complete the load.  */
+                    store_reg(s, rd, tmp);
                 }
             }
             break;
         case 0x4:
         case 0x5:
+            goto do_ldst;
         case 0x6:
         case 0x7:
-#ifdef GEN_TRACE
-            /* Added a special undefined instruction to cause the
-            * simulator to exit.  This allows us to write short assembly
-            * language tests that can exit the simulator.
-            */
-#define EXIT_SIMULATION 0xe6c00110
-            if (insn == EXIT_SIMULATION) {
-                gen_op_shutdown();
+            if (insn & (1 << 4)) {
+                ARCH(6);
+                /* Armv6 Media instructions.  */
+                rm = insn & 0xf;
+                rn = (insn >> 16) & 0xf;
+                rd = (insn >> 12) & 0xf;
+                rs = (insn >> 8) & 0xf;
+                switch ((insn >> 23) & 3) {
+                case 0: /* Parallel add/subtract.  */
+                    op1 = (insn >> 20) & 7;
+                    tmp = load_reg(s, rn);
+                    tmp2 = load_reg(s, rm);
+                    sh = (insn >> 5) & 7;
+                    if ((op1 & 3) == 0 || sh == 5 || sh == 6)
+                        goto illegal_op;
+                    gen_arm_parallel_addsub(op1, sh, tmp, tmp2);
+                    dead_tmp(tmp2);
+                    store_reg(s, rd, tmp);
+                    break;
+                case 1:
+                    if ((insn & 0x00700020) == 0) {
+                        /* Halfword pack.  */
+                        tmp = load_reg(s, rn);
+                        tmp2 = load_reg(s, rm);
+                        shift = (insn >> 7) & 0x1f;
+                        if (insn & (1 << 6)) {
+                            /* pkhtb */
+                            if (shift == 0)
+                                shift = 31;
+                            tcg_gen_sari_i32(tmp2, tmp2, shift);
+                            tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
+                            tcg_gen_ext16u_i32(tmp2, tmp2);
+                        } else {
+                            /* pkhbt */
+                            if (shift)
+                                tcg_gen_shli_i32(tmp2, tmp2, shift);
+                            tcg_gen_ext16u_i32(tmp, tmp);
+                            tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
+                        }
+                        tcg_gen_or_i32(tmp, tmp, tmp2);
+                        dead_tmp(tmp2);
+                        store_reg(s, rd, tmp);
+                    } else if ((insn & 0x00200020) == 0x00200000) {
+                        /* [us]sat */
+                        tmp = load_reg(s, rm);
+                        shift = (insn >> 7) & 0x1f;
+                        if (insn & (1 << 6)) {
+                            if (shift == 0)
+                                shift = 31;
+                            tcg_gen_sari_i32(tmp, tmp, shift);
+                        } else {
+                            tcg_gen_shli_i32(tmp, tmp, shift);
+                        }
+                        sh = (insn >> 16) & 0x1f;
+                        if (sh != 0) {
+                            if (insn & (1 << 22))
+                                gen_helper_usat(tmp, tmp, tcg_const_i32(sh));
+                            else
+                                gen_helper_ssat(tmp, tmp, tcg_const_i32(sh));
+                        }
+                        store_reg(s, rd, tmp);
+                    } else if ((insn & 0x00300fe0) == 0x00200f20) {
+                        /* [us]sat16 */
+                        tmp = load_reg(s, rm);
+                        sh = (insn >> 16) & 0x1f;
+                        if (sh != 0) {
+                            if (insn & (1 << 22))
+                                gen_helper_usat16(tmp, tmp, tcg_const_i32(sh));
+                            else
+                                gen_helper_ssat16(tmp, tmp, tcg_const_i32(sh));
+                        }
+                        store_reg(s, rd, tmp);
+                    } else if ((insn & 0x00700fe0) == 0x00000fa0) {
+                        /* Select bytes.  */
+                        tmp = load_reg(s, rn);
+                        tmp2 = load_reg(s, rm);
+                        tmp3 = new_tmp();
+                        tcg_gen_ld_i32(tmp3, cpu_env, offsetof(CPUState, GE));
+                        gen_helper_sel_flags(tmp, tmp3, tmp, tmp2);
+                        dead_tmp(tmp3);
+                        dead_tmp(tmp2);
+                        store_reg(s, rd, tmp);
+                    } else if ((insn & 0x000003e0) == 0x00000060) {
+                        tmp = load_reg(s, rm);
+                        shift = (insn >> 10) & 3;
+                        /* ??? In many cases it's not neccessary to do a
+                           rotate, a shift is sufficient.  */
+                        if (shift != 0)
+                            tcg_gen_rori_i32(tmp, tmp, shift * 8);
+                        op1 = (insn >> 20) & 7;
+                        switch (op1) {
+                        case 0: gen_sxtb16(tmp);  break;
+                        case 2: gen_sxtb(tmp);    break;
+                        case 3: gen_sxth(tmp);    break;
+                        case 4: gen_uxtb16(tmp);  break;
+                        case 6: gen_uxtb(tmp);    break;
+                        case 7: gen_uxth(tmp);    break;
+                        default: goto illegal_op;
+                        }
+                        if (rn != 15) {
+                            tmp2 = load_reg(s, rn);
+                            if ((op1 & 3) == 0) {
+                                gen_add16(tmp, tmp2);
+                            } else {
+                                tcg_gen_add_i32(tmp, tmp, tmp2);
+                                dead_tmp(tmp2);
+                            }
+                        }
+                        store_reg(s, rd, tmp);
+                    } else if ((insn & 0x003f0f60) == 0x003f0f20) {
+                        /* rev */
+                        tmp = load_reg(s, rm);
+                        if (insn & (1 << 22)) {
+                            if (insn & (1 << 7)) {
+                                gen_revsh(tmp);
+                            } else {
+                                ARCH(6T2);
+                                gen_helper_rbit(tmp, tmp);
+                            }
+                        } else {
+                            if (insn & (1 << 7))
+                                gen_rev16(tmp);
+                            else
+                                tcg_gen_bswap_i32(tmp, tmp);
+                        }
+                        store_reg(s, rd, tmp);
+                    } else {
+                        goto illegal_op;
+                    }
+                    break;
+                case 2: /* Multiplies (Type 3).  */
+                    tmp = load_reg(s, rm);
+                    tmp2 = load_reg(s, rs);
+                    if (insn & (1 << 20)) {
+                        /* Signed multiply most significant [accumulate].  */
+                        tmp2 = gen_muls_i64_i32(tmp, tmp2);
+                        if (insn & (1 << 5))
+                            tcg_gen_addi_i64(tmp2, tmp2, 0x80000000u);
+                        tcg_gen_shri_i64(tmp2, tmp2, 32);
+                        tmp = new_tmp();
+                        tcg_gen_trunc_i64_i32(tmp, tmp2);
+                        if (rn != 15) {
+                            tmp2 = load_reg(s, rn);
+                            if (insn & (1 << 6)) {
+                                tcg_gen_sub_i32(tmp, tmp, tmp2);
+                            } else {
+                                tcg_gen_add_i32(tmp, tmp, tmp2);
+                            }
+                            dead_tmp(tmp2);
+                        }
+                        store_reg(s, rd, tmp);
+                    } else {
+                        if (insn & (1 << 5))
+                            gen_swap_half(tmp2);
+                        gen_smul_dual(tmp, tmp2);
+                        /* This addition cannot overflow.  */
+                        if (insn & (1 << 6)) {
+                            tcg_gen_sub_i32(tmp, tmp, tmp2);
+                        } else {
+                            tcg_gen_add_i32(tmp, tmp, tmp2);
+                        }
+                        dead_tmp(tmp2);
+                        if (insn & (1 << 22)) {
+                            /* smlald, smlsld */
+                            tmp2 = tcg_temp_new(TCG_TYPE_I64);
+                            tcg_gen_ext_i32_i64(tmp2, tmp);
+                            dead_tmp(tmp);
+                            gen_addq(s, tmp2, rd, rn);
+                            gen_storeq_reg(s, rd, rn, tmp2);
+                        } else {
+                            /* smuad, smusd, smlad, smlsd */
+                            if (rd != 15)
+                              {
+                                tmp2 = load_reg(s, rd);
+                                gen_helper_add_setq(tmp, tmp, tmp2);
+                                dead_tmp(tmp2);
+                              }
+                            store_reg(s, rn, tmp);
+                        }
+                    }
+                    break;
+                case 3:
+                    op1 = ((insn >> 17) & 0x38) | ((insn >> 5) & 7);
+                    switch (op1) {
+                    case 0: /* Unsigned sum of absolute differences.  */
+                        ARCH(6);
+                        tmp = load_reg(s, rm);
+                        tmp2 = load_reg(s, rs);
+                        gen_helper_usad8(tmp, tmp, tmp2);
+                        dead_tmp(tmp2);
+                        if (rn != 15) {
+                            tmp2 = load_reg(s, rn);
+                            tcg_gen_add_i32(tmp, tmp, tmp2);
+                            dead_tmp(tmp2);
+                        }
+                        store_reg(s, rd, tmp);
+                        break;
+                    case 0x20: case 0x24: case 0x28: case 0x2c:
+                        /* Bitfield insert/clear.  */
+                        ARCH(6T2);
+                        shift = (insn >> 7) & 0x1f;
+                        i = (insn >> 16) & 0x1f;
+                        i = i + 1 - shift;
+                        if (rm == 15) {
+                            tmp = new_tmp();
+                            tcg_gen_movi_i32(tmp, 0);
+                        } else {
+                            tmp = load_reg(s, rm);
+                        }
+                        if (i != 32) {
+                            tmp2 = load_reg(s, rd);
+                            gen_bfi(tmp, tmp2, tmp, shift, (1u << i) - 1);
+                            dead_tmp(tmp2);
+                        }
+                        store_reg(s, rd, tmp);
+                        break;
+                    case 0x12: case 0x16: case 0x1a: case 0x1e: /* sbfx */
+                    case 0x32: case 0x36: case 0x3a: case 0x3e: /* ubfx */
+                        tmp = load_reg(s, rm);
+                        shift = (insn >> 7) & 0x1f;
+                        i = ((insn >> 16) & 0x1f) + 1;
+                        if (shift + i > 32)
+                            goto illegal_op;
+                        if (i < 32) {
+                            if (op1 & 0x20) {
+                                gen_ubfx(tmp, shift, (1u << i) - 1);
+                            } else {
+                                gen_sbfx(tmp, shift, i);
+                            }
+                        }
+                        store_reg(s, rd, tmp);
+                        break;
+                    default:
+                        goto illegal_op;
+                    }
+                    break;
+                }
                 break;
             }
-#endif
-
+        do_ldst:
             /* Check for undefined extension instructions
              * per the ARM Bible IE:
              * xxxx 0111 1111 xxxx  xxxx xxxx 1111 xxxx
@@ -1659,67 +6665,47 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
             /* load/store byte/word */
             rn = (insn >> 16) & 0xf;
             rd = (insn >> 12) & 0xf;
-            gen_movl_T1_reg(s, rn);
+            tmp2 = load_reg(s, rn);
             i = (IS_USER(s) || (insn & 0x01200000) == 0x00200000);
             if (insn & (1 << 24))
-                gen_add_data_offset(s, insn);
+                gen_add_data_offset(s, insn, tmp2);
             if (insn & (1 << 20)) {
                 /* load */
-#if defined(CONFIG_USER_ONLY)
-                if (insn & (1 << 22))
-                    gen_op_ldub_raw();
-                else
-                    gen_op_ldl_raw();
-#else
+                s->is_mem = 1;
                 if (insn & (1 << 22)) {
-                    if (i)
-                        gen_op_ldub_user();
-                    else
-                        gen_op_ldub_kernel();
+                    tmp = gen_ld8u(tmp2, i);
                 } else {
-                    if (i)
-                        gen_op_ldl_user();
-                    else
-                        gen_op_ldl_kernel();
+                    tmp = gen_ld32(tmp2, i);
                 }
-#endif
-                if (rd == 15)
-                    gen_bx(s);
-                else
-                    gen_movl_reg_T0(s, rd);
             } else {
                 /* store */
-                gen_movl_T0_reg(s, rd);
-#if defined(CONFIG_USER_ONLY)
+                tmp = load_reg(s, rd);
                 if (insn & (1 << 22))
-                    gen_op_stb_raw();
+                    gen_st8(tmp, tmp2, i);
                 else
-                    gen_op_stl_raw();
-#else
-                if (insn & (1 << 22)) {
-                    if (i)
-                        gen_op_stb_user();
-                    else
-                        gen_op_stb_kernel();
-                } else {
-                    if (i)
-                        gen_op_stl_user();
-                    else
-                        gen_op_stl_kernel();
-                }
-#endif
+                    gen_st32(tmp, tmp2, i);
             }
             if (!(insn & (1 << 24))) {
-                gen_add_data_offset(s, insn);
-                gen_movl_reg_T1(s, rn);
-            } else if (insn & (1 << 21))
-                gen_movl_reg_T1(s, rn); {
+                gen_add_data_offset(s, insn, tmp2);
+                store_reg(s, rn, tmp2);
+            } else if (insn & (1 << 21)) {
+                store_reg(s, rn, tmp2);
+            } else {
+                dead_tmp(tmp2);
+            }
+            if (insn & (1 << 20)) {
+                /* Complete the load.  */
+                if (rd == 15)
+                    gen_bx(s, tmp);
+                else
+                    store_reg(s, rd, tmp);
             }
             break;
         case 0x08:
         case 0x09:
             {
                 int j, n, user, loaded_base;
+                TCGv loaded_var;
                 /* load/store multiple words */
                 /* XXX: store correct base if write back */
                 user = 0;
@@ -1731,10 +6717,11 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                         user = 1;
                 }
                 rn = (insn >> 16) & 0xf;
-                gen_movl_T1_reg(s, rn);
+                addr = load_reg(s, rn);
 
                 /* compute total size */
                 loaded_base = 0;
+                TCGV_UNUSED(loaded_var);
                 n = 0;
                 for(i=0;i<16;i++) {
                     if (insn & (1 << i))
@@ -1744,18 +6731,18 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                 if (insn & (1 << 23)) {
                     if (insn & (1 << 24)) {
                         /* pre increment */
-                        gen_op_addl_T1_im(4);
+                        tcg_gen_addi_i32(addr, addr, 4);
                     } else {
                         /* post increment */
                     }
                 } else {
                     if (insn & (1 << 24)) {
                         /* pre decrement */
-                        gen_op_addl_T1_im(-(n * 4));
+                        tcg_gen_addi_i32(addr, addr, -(n * 4));
                     } else {
                         /* post decrement */
                         if (n != 1)
-                            gen_op_addl_T1_im(-((n - 1) * 4));
+                        tcg_gen_addi_i32(addr, addr, -((n - 1) * 4));
                     }
                 }
                 j = 0;
@@ -1763,34 +6750,37 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                     if (insn & (1 << i)) {
                         if (insn & (1 << 20)) {
                             /* load */
-                            gen_ldst(ldl, s);
+                            tmp = gen_ld32(addr, IS_USER(s));
                             if (i == 15) {
-                                gen_bx(s);
+                                gen_bx(s, tmp);
                             } else if (user) {
-                                gen_op_movl_user_T0(i);
+                                gen_helper_set_user_reg(tcg_const_i32(i), tmp);
+                                dead_tmp(tmp);
                             } else if (i == rn) {
-                                gen_op_movl_T2_T0();
+                                loaded_var = tmp;
                                 loaded_base = 1;
                             } else {
-                                gen_movl_reg_T0(s, i);
+                                store_reg(s, i, tmp);
                             }
                         } else {
                             /* store */
                             if (i == 15) {
-                                /* special case: r15 = PC + 8  (was 12) */
+                                /* special case: r15 = PC + 8 */
                                 val = (long)s->pc + 4;
-                                gen_op_movl_TN_im[0](val);
+                                tmp = new_tmp();
+                                tcg_gen_movi_i32(tmp, val);
                             } else if (user) {
-                                gen_op_movl_T0_user(i);
+                                tmp = new_tmp();
+                                gen_helper_get_user_reg(tmp, tcg_const_i32(i));
                             } else {
-                                gen_movl_T0_reg(s, i);
+                                tmp = load_reg(s, i);
                             }
-                            gen_ldst(stl, s);
+                            gen_st32(tmp, addr, IS_USER(s));
                         }
                         j++;
                         /* no need to add after the last transfer */
                         if (j != n)
-                            gen_op_addl_T1_im(4);
+                            tcg_gen_addi_i32(addr, addr, 4);
                     }
                 }
                 if (insn & (1 << 21)) {
@@ -1800,28 +6790,30 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                             /* pre increment */
                         } else {
                             /* post increment */
-                            gen_op_addl_T1_im(4);
+                            tcg_gen_addi_i32(addr, addr, 4);
                         }
                     } else {
                         if (insn & (1 << 24)) {
                             /* pre decrement */
                             if (n != 1)
-                                gen_op_addl_T1_im(-((n - 1) * 4));
+                                tcg_gen_addi_i32(addr, addr, -((n - 1) * 4));
                         } else {
                             /* post decrement */
-                            gen_op_addl_T1_im(-(n * 4));
+                            tcg_gen_addi_i32(addr, addr, -(n * 4));
                         }
                     }
-                    gen_movl_reg_T1(s, rn);
+                    store_reg(s, rn, addr);
+                } else {
+                    dead_tmp(addr);
                 }
                 if (loaded_base) {
-                    gen_op_movl_T0_T2();
-                    gen_movl_reg_T0(s, rn);
+                    store_reg(s, rn, loaded_var);
                 }
                 if ((insn & (1 << 22)) && !user) {
                     /* Restore CPSR from SPSR.  */
-                    gen_op_movl_T0_spsr();
-                    gen_op_movl_cpsr_T0(0xffffffff);
+                    tmp = load_cpu_field(spsr);
+                    gen_set_cpsr(tmp, 0xffffffff);
+                    dead_tmp(tmp);
                     s->is_jmp = DISAS_UPDATE;
                 }
             }
@@ -1834,8 +6826,9 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
                 /* branch (and link) */
                 val = (int32_t)s->pc;
                 if (insn & (1 << 24)) {
-                    gen_op_movl_T0_im(val);
-                    gen_op_movl_reg_TN[0][14]();
+                    tmp = new_tmp();
+                    tcg_gen_movi_i32(tmp, val);
+                    store_reg(s, 14, tmp);
                 }
                 offset = (((int32_t)insn << 8) >> 8);
                 val += (offset << 2) + 4;
@@ -1846,55 +6839,1156 @@ static void disas_arm_insn(CPUState * env, DisasContext *s)
         case 0xd:
         case 0xe:
             /* Coprocessor.  */
-            op1 = (insn >> 8) & 0xf;
-            switch (op1) {
-            case 10:
-            case 11:
-                if (disas_vfp_insn (env, s, insn))
-                    goto illegal_op;
-                break;
-            case 15:
-                if (disas_cp15_insn (s, insn))
-                    goto illegal_op;
-                break;
-            default:
-                /* unknown coprocessor.  */
+            if (disas_coproc_insn(env, s, insn))
                 goto illegal_op;
-            }
             break;
         case 0xf:
             /* swi */
-            gen_op_movl_T0_im((long)s->pc);
-            gen_op_movl_reg_TN[0][15]();
-            gen_op_swi();
-            s->is_jmp = DISAS_JUMP;
+            gen_set_pc_im(s->pc);
+            s->is_jmp = DISAS_SWI;
             break;
         default:
         illegal_op:
-            gen_op_movl_T0_im((long)s->pc - 4);
-            gen_op_movl_reg_TN[0][15]();
-            gen_op_undef_insn();
+            gen_set_condexec(s);
+            gen_set_pc_im(s->pc - 4);
+            gen_exception(EXCP_UDEF);
             s->is_jmp = DISAS_JUMP;
             break;
         }
     }
 }
 
-static void disas_thumb_insn(DisasContext *s)
+/* Return true if this is a Thumb-2 logical op.  */
+static int
+thumb2_logic_op(int op)
+{
+    return (op < 8);
+}
+
+/* Generate code for a Thumb-2 data processing operation.  If CONDS is nonzero
+   then set condition code flags based on the result of the operation.
+   If SHIFTER_OUT is nonzero then set the carry flag for logical operations
+   to the high bit of T1.
+   Returns zero if the opcode is valid.  */
+
+static int
+gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out)
+{
+    int logic_cc;
+
+    logic_cc = 0;
+    switch (op) {
+    case 0: /* and */
+        gen_op_andl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 1: /* bic */
+        gen_op_bicl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 2: /* orr */
+        gen_op_orl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 3: /* orn */
+        gen_op_notl_T1();
+        gen_op_orl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 4: /* eor */
+        gen_op_xorl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 8: /* add */
+        if (conds)
+            gen_op_addl_T0_T1_cc();
+        else
+            gen_op_addl_T0_T1();
+        break;
+    case 10: /* adc */
+        if (conds)
+            gen_op_adcl_T0_T1_cc();
+        else
+            gen_adc_T0_T1();
+        break;
+    case 11: /* sbc */
+        if (conds)
+            gen_op_sbcl_T0_T1_cc();
+        else
+            gen_sbc_T0_T1();
+        break;
+    case 13: /* sub */
+        if (conds)
+            gen_op_subl_T0_T1_cc();
+        else
+            gen_op_subl_T0_T1();
+        break;
+    case 14: /* rsb */
+        if (conds)
+            gen_op_rsbl_T0_T1_cc();
+        else
+            gen_op_rsbl_T0_T1();
+        break;
+    default: /* 5, 6, 7, 9, 12, 15. */
+        return 1;
+    }
+    if (logic_cc) {
+        gen_op_logic_T0_cc();
+        if (shifter_out)
+            gen_set_CF_bit31(cpu_T[1]);
+    }
+    return 0;
+}
+
+/* Translate a 32-bit thumb instruction.  Returns nonzero if the instruction
+   is not legal.  */
+static int disas_thumb2_insn(CPUState *env, DisasContext *s, uint16_t insn_hw1)
+{
+    uint32_t insn, imm, shift, offset;
+    uint32_t rd, rn, rm, rs;
+    TCGv tmp;
+    TCGv tmp2;
+    TCGv tmp3;
+    TCGv addr;
+    int op;
+    int shiftop;
+    int conds;
+    int logic_cc;
+
+    if (!(arm_feature(env, ARM_FEATURE_THUMB2)
+          || arm_feature (env, ARM_FEATURE_M))) {
+        /* Thumb-1 cores may need to treat bl and blx as a pair of
+           16-bit instructions to get correct prefetch abort behavior.  */
+        insn = insn_hw1;
+        if ((insn & (1 << 12)) == 0) {
+            /* Second half of blx.  */
+            offset = ((insn & 0x7ff) << 1);
+            tmp = load_reg(s, 14);
+            tcg_gen_addi_i32(tmp, tmp, offset);
+            tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
+
+            tmp2 = new_tmp();
+            tcg_gen_movi_i32(tmp2, s->pc | 1);
+            store_reg(s, 14, tmp2);
+            gen_bx(s, tmp);
+            return 0;
+        }
+        if (insn & (1 << 11)) {
+            /* Second half of bl.  */
+            offset = ((insn & 0x7ff) << 1) | 1;
+            tmp = load_reg(s, 14);
+            tcg_gen_addi_i32(tmp, tmp, offset);
+
+            tmp2 = new_tmp();
+            tcg_gen_movi_i32(tmp2, s->pc | 1);
+            store_reg(s, 14, tmp2);
+            gen_bx(s, tmp);
+            return 0;
+        }
+        if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
+            /* Instruction spans a page boundary.  Implement it as two
+               16-bit instructions in case the second half causes an
+               prefetch abort.  */
+            offset = ((int32_t)insn << 21) >> 9;
+            gen_op_movl_T0_im(s->pc + 2 + offset);
+            gen_movl_reg_T0(s, 14);
+            return 0;
+        }
+        /* Fall through to 32-bit decode.  */
+    }
+
+    insn = lduw_code(s->pc);
+#ifdef CONFIG_TRACE
+    if (tracing) {
+        int  ticks = get_insn_ticks_thumb(insn);
+        trace_add_insn( insn_wrap_thumb(insn), 1 );
+        gen_helper_traceInsn();
+        gen_traceTicks(ticks);
+    }
+#endif
+    s->pc += 2;
+    insn |= (uint32_t)insn_hw1 << 16;
+
+    if ((insn & 0xf800e800) != 0xf000e800) {
+        ARCH(6T2);
+    }
+
+    rn = (insn >> 16) & 0xf;
+    rs = (insn >> 12) & 0xf;
+    rd = (insn >> 8) & 0xf;
+    rm = insn & 0xf;
+    switch ((insn >> 25) & 0xf) {
+    case 0: case 1: case 2: case 3:
+        /* 16-bit instructions.  Should never happen.  */
+        abort();
+    case 4:
+        if (insn & (1 << 22)) {
+            /* Other load/store, table branch.  */
+            if (insn & 0x01200000) {
+                /* Load/store doubleword.  */
+                if (rn == 15) {
+                    addr = new_tmp();
+                    tcg_gen_movi_i32(addr, s->pc & ~3);
+                } else {
+                    addr = load_reg(s, rn);
+                }
+                offset = (insn & 0xff) * 4;
+                if ((insn & (1 << 23)) == 0)
+                    offset = -offset;
+                if (insn & (1 << 24)) {
+                    tcg_gen_addi_i32(addr, addr, offset);
+                    offset = 0;
+                }
+                if (insn & (1 << 20)) {
+                    /* ldrd */
+                    tmp = gen_ld32(addr, IS_USER(s));
+                    store_reg(s, rs, tmp);
+                    tcg_gen_addi_i32(addr, addr, 4);
+                    tmp = gen_ld32(addr, IS_USER(s));
+                    store_reg(s, rd, tmp);
+                } else {
+                    /* strd */
+                    tmp = load_reg(s, rs);
+                    gen_st32(tmp, addr, IS_USER(s));
+                    tcg_gen_addi_i32(addr, addr, 4);
+                    tmp = load_reg(s, rd);
+                    gen_st32(tmp, addr, IS_USER(s));
+                }
+                if (insn & (1 << 21)) {
+                    /* Base writeback.  */
+                    if (rn == 15)
+                        goto illegal_op;
+                    tcg_gen_addi_i32(addr, addr, offset - 4);
+                    store_reg(s, rn, addr);
+                } else {
+                    dead_tmp(addr);
+                }
+            } else if ((insn & (1 << 23)) == 0) {
+                /* Load/store exclusive word.  */
+                gen_movl_T1_reg(s, rn);
+                addr = cpu_T[1];
+                if (insn & (1 << 20)) {
+                    gen_helper_mark_exclusive(cpu_env, cpu_T[1]);
+                    tmp = gen_ld32(addr, IS_USER(s));
+                    store_reg(s, rd, tmp);
+                } else {
+                    int label = gen_new_label();
+                    gen_helper_test_exclusive(cpu_T[0], cpu_env, addr);
+                    tcg_gen_brcondi_i32(TCG_COND_NE, cpu_T[0],
+                                        0, label);
+                    tmp = load_reg(s, rs);
+                    gen_st32(tmp, cpu_T[1], IS_USER(s));
+                    gen_set_label(label);
+                    gen_movl_reg_T0(s, rd);
+                }
+            } else if ((insn & (1 << 6)) == 0) {
+                /* Table Branch.  */
+                if (rn == 15) {
+                    addr = new_tmp();
+                    tcg_gen_movi_i32(addr, s->pc);
+                } else {
+                    addr = load_reg(s, rn);
+                }
+                tmp = load_reg(s, rm);
+                tcg_gen_add_i32(addr, addr, tmp);
+                if (insn & (1 << 4)) {
+                    /* tbh */
+                    tcg_gen_add_i32(addr, addr, tmp);
+                    dead_tmp(tmp);
+                    tmp = gen_ld16u(addr, IS_USER(s));
+                } else { /* tbb */
+                    dead_tmp(tmp);
+                    tmp = gen_ld8u(addr, IS_USER(s));
+                }
+                dead_tmp(addr);
+                tcg_gen_shli_i32(tmp, tmp, 1);
+                tcg_gen_addi_i32(tmp, tmp, s->pc);
+                store_reg(s, 15, tmp);
+            } else {
+                /* Load/store exclusive byte/halfword/doubleword.  */
+                /* ??? These are not really atomic.  However we know
+                   we never have multiple CPUs running in parallel,
+                   so it is good enough.  */
+                op = (insn >> 4) & 0x3;
+                /* Must use a global reg for the address because we have
+                   a conditional branch in the store instruction.  */
+                gen_movl_T1_reg(s, rn);
+                addr = cpu_T[1];
+                if (insn & (1 << 20)) {
+                    gen_helper_mark_exclusive(cpu_env, addr);
+                    switch (op) {
+                    case 0:
+                        tmp = gen_ld8u(addr, IS_USER(s));
+                        break;
+                    case 1:
+                        tmp = gen_ld16u(addr, IS_USER(s));
+                        break;
+                    case 3:
+                        tmp = gen_ld32(addr, IS_USER(s));
+                        tcg_gen_addi_i32(addr, addr, 4);
+                        tmp2 = gen_ld32(addr, IS_USER(s));
+                        store_reg(s, rd, tmp2);
+                        break;
+                    default:
+                        goto illegal_op;
+                    }
+                    store_reg(s, rs, tmp);
+                } else {
+                    int label = gen_new_label();
+                    /* Must use a global that is not killed by the branch.  */
+                    gen_helper_test_exclusive(cpu_T[0], cpu_env, addr);
+                    tcg_gen_brcondi_i32(TCG_COND_NE, cpu_T[0], 0, label);
+                    tmp = load_reg(s, rs);
+                    switch (op) {
+                    case 0:
+                        gen_st8(tmp, addr, IS_USER(s));
+                        break;
+                    case 1:
+                        gen_st16(tmp, addr, IS_USER(s));
+                        break;
+                    case 3:
+                        gen_st32(tmp, addr, IS_USER(s));
+                        tcg_gen_addi_i32(addr, addr, 4);
+                        tmp = load_reg(s, rd);
+                        gen_st32(tmp, addr, IS_USER(s));
+                        break;
+                    default:
+                        goto illegal_op;
+                    }
+                    gen_set_label(label);
+                    gen_movl_reg_T0(s, rm);
+                }
+            }
+        } else {
+            /* Load/store multiple, RFE, SRS.  */
+            if (((insn >> 23) & 1) == ((insn >> 24) & 1)) {
+                /* Not available in user mode.  */
+                if (IS_USER(s))
+                    goto illegal_op;
+                if (insn & (1 << 20)) {
+                    /* rfe */
+                    addr = load_reg(s, rn);
+                    if ((insn & (1 << 24)) == 0)
+                        tcg_gen_addi_i32(addr, addr, -8);
+                    /* Load PC into tmp and CPSR into tmp2.  */
+                    tmp = gen_ld32(addr, 0);
+                    tcg_gen_addi_i32(addr, addr, 4);
+                    tmp2 = gen_ld32(addr, 0);
+                    if (insn & (1 << 21)) {
+                        /* Base writeback.  */
+                        if (insn & (1 << 24)) {
+                            tcg_gen_addi_i32(addr, addr, 4);
+                        } else {
+                            tcg_gen_addi_i32(addr, addr, -4);
+                        }
+                        store_reg(s, rn, addr);
+                    } else {
+                        dead_tmp(addr);
+                    }
+                    gen_rfe(s, tmp, tmp2);
+                } else {
+                    /* srs */
+                    op = (insn & 0x1f);
+                    if (op == (env->uncached_cpsr & CPSR_M)) {
+                        addr = load_reg(s, 13);
+                    } else {
+                        addr = new_tmp();
+                        gen_helper_get_r13_banked(addr, cpu_env, tcg_const_i32(op));
+                    }
+                    if ((insn & (1 << 24)) == 0) {
+                        tcg_gen_addi_i32(addr, addr, -8);
+                    }
+                    tmp = load_reg(s, 14);
+                    gen_st32(tmp, addr, 0);
+                    tcg_gen_addi_i32(addr, addr, 4);
+                    tmp = new_tmp();
+                    gen_helper_cpsr_read(tmp);
+                    gen_st32(tmp, addr, 0);
+                    if (insn & (1 << 21)) {
+                        if ((insn & (1 << 24)) == 0) {
+                            tcg_gen_addi_i32(addr, addr, -4);
+                        } else {
+                            tcg_gen_addi_i32(addr, addr, 4);
+                        }
+                        if (op == (env->uncached_cpsr & CPSR_M)) {
+                            store_reg(s, 13, addr);
+                        } else {
+                            gen_helper_set_r13_banked(cpu_env,
+                                tcg_const_i32(op), addr);
+                        }
+                    } else {
+                        dead_tmp(addr);
+                    }
+                }
+            } else {
+                int i;
+                /* Load/store multiple.  */
+                addr = load_reg(s, rn);
+                offset = 0;
+                for (i = 0; i < 16; i++) {
+                    if (insn & (1 << i))
+                        offset += 4;
+                }
+                if (insn & (1 << 24)) {
+                    tcg_gen_addi_i32(addr, addr, -offset);
+                }
+
+                for (i = 0; i < 16; i++) {
+                    if ((insn & (1 << i)) == 0)
+                        continue;
+                    if (insn & (1 << 20)) {
+                        /* Load.  */
+                        tmp = gen_ld32(addr, IS_USER(s));
+                        if (i == 15) {
+                            gen_bx(s, tmp);
+                        } else {
+                            store_reg(s, i, tmp);
+                        }
+                    } else {
+                        /* Store.  */
+                        tmp = load_reg(s, i);
+                        gen_st32(tmp, addr, IS_USER(s));
+                    }
+                    tcg_gen_addi_i32(addr, addr, 4);
+                }
+                if (insn & (1 << 21)) {
+                    /* Base register writeback.  */
+                    if (insn & (1 << 24)) {
+                        tcg_gen_addi_i32(addr, addr, -offset);
+                    }
+                    /* Fault if writeback register is in register list.  */
+                    if (insn & (1 << rn))
+                        goto illegal_op;
+                    store_reg(s, rn, addr);
+                } else {
+                    dead_tmp(addr);
+                }
+            }
+        }
+        break;
+    case 5: /* Data processing register constant shift.  */
+        if (rn == 15)
+            gen_op_movl_T0_im(0);
+        else
+            gen_movl_T0_reg(s, rn);
+        gen_movl_T1_reg(s, rm);
+        op = (insn >> 21) & 0xf;
+        shiftop = (insn >> 4) & 3;
+        shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
+        conds = (insn & (1 << 20)) != 0;
+        logic_cc = (conds && thumb2_logic_op(op));
+        gen_arm_shift_im(cpu_T[1], shiftop, shift, logic_cc);
+        if (gen_thumb2_data_op(s, op, conds, 0))
+            goto illegal_op;
+        if (rd != 15)
+            gen_movl_reg_T0(s, rd);
+        break;
+    case 13: /* Misc data processing.  */
+        op = ((insn >> 22) & 6) | ((insn >> 7) & 1);
+        if (op < 4 && (insn & 0xf000) != 0xf000)
+            goto illegal_op;
+        switch (op) {
+        case 0: /* Register controlled shift.  */
+            tmp = load_reg(s, rn);
+            tmp2 = load_reg(s, rm);
+            if ((insn & 0x70) != 0)
+                goto illegal_op;
+            op = (insn >> 21) & 3;
+            logic_cc = (insn & (1 << 20)) != 0;
+            gen_arm_shift_reg(tmp, op, tmp2, logic_cc);
+            if (logic_cc)
+                gen_logic_CC(tmp);
+            store_reg(s, rd, tmp);
+            break;
+        case 1: /* Sign/zero extend.  */
+            tmp = load_reg(s, rm);
+            shift = (insn >> 4) & 3;
+            /* ??? In many cases it's not neccessary to do a
+               rotate, a shift is sufficient.  */
+            if (shift != 0)
+                tcg_gen_rori_i32(tmp, tmp, shift * 8);
+            op = (insn >> 20) & 7;
+            switch (op) {
+            case 0: gen_sxth(tmp);   break;
+            case 1: gen_uxth(tmp);   break;
+            case 2: gen_sxtb16(tmp); break;
+            case 3: gen_uxtb16(tmp); break;
+            case 4: gen_sxtb(tmp);   break;
+            case 5: gen_uxtb(tmp);   break;
+            default: goto illegal_op;
+            }
+            if (rn != 15) {
+                tmp2 = load_reg(s, rn);
+                if ((op >> 1) == 1) {
+                    gen_add16(tmp, tmp2);
+                } else {
+                    tcg_gen_add_i32(tmp, tmp, tmp2);
+                    dead_tmp(tmp2);
+                }
+            }
+            store_reg(s, rd, tmp);
+            break;
+        case 2: /* SIMD add/subtract.  */
+            op = (insn >> 20) & 7;
+            shift = (insn >> 4) & 7;
+            if ((op & 3) == 3 || (shift & 3) == 3)
+                goto illegal_op;
+            tmp = load_reg(s, rn);
+            tmp2 = load_reg(s, rm);
+            gen_thumb2_parallel_addsub(op, shift, tmp, tmp2);
+            dead_tmp(tmp2);
+            store_reg(s, rd, tmp);
+            break;
+        case 3: /* Other data processing.  */
+            op = ((insn >> 17) & 0x38) | ((insn >> 4) & 7);
+            if (op < 4) {
+                /* Saturating add/subtract.  */
+                tmp = load_reg(s, rn);
+                tmp2 = load_reg(s, rm);
+                if (op & 2)
+                    gen_helper_double_saturate(tmp, tmp);
+                if (op & 1)
+                    gen_helper_sub_saturate(tmp, tmp2, tmp);
+                else
+                    gen_helper_add_saturate(tmp, tmp, tmp2);
+                dead_tmp(tmp2);
+            } else {
+                tmp = load_reg(s, rn);
+                switch (op) {
+                case 0x0a: /* rbit */
+                    gen_helper_rbit(tmp, tmp);
+                    break;
+                case 0x08: /* rev */
+                    tcg_gen_bswap_i32(tmp, tmp);
+                    break;
+                case 0x09: /* rev16 */
+                    gen_rev16(tmp);
+                    break;
+                case 0x0b: /* revsh */
+                    gen_revsh(tmp);
+                    break;
+                case 0x10: /* sel */
+                    tmp2 = load_reg(s, rm);
+                    tmp3 = new_tmp();
+                    tcg_gen_ld_i32(tmp3, cpu_env, offsetof(CPUState, GE));
+                    gen_helper_sel_flags(tmp, tmp3, tmp, tmp2);
+                    dead_tmp(tmp3);
+                    dead_tmp(tmp2);
+                    break;
+                case 0x18: /* clz */
+                    gen_helper_clz(tmp, tmp);
+                    break;
+                default:
+                    goto illegal_op;
+                }
+            }
+            store_reg(s, rd, tmp);
+            break;
+        case 4: case 5: /* 32-bit multiply.  Sum of absolute differences.  */
+            op = (insn >> 4) & 0xf;
+            tmp = load_reg(s, rn);
+            tmp2 = load_reg(s, rm);
+            switch ((insn >> 20) & 7) {
+            case 0: /* 32 x 32 -> 32 */
+                tcg_gen_mul_i32(tmp, tmp, tmp2);
+                dead_tmp(tmp2);
+                if (rs != 15) {
+                    tmp2 = load_reg(s, rs);
+                    if (op)
+                        tcg_gen_sub_i32(tmp, tmp2, tmp);
+                    else
+                        tcg_gen_add_i32(tmp, tmp, tmp2);
+                    dead_tmp(tmp2);
+                }
+                break;
+            case 1: /* 16 x 16 -> 32 */
+                gen_mulxy(tmp, tmp2, op & 2, op & 1);
+                dead_tmp(tmp2);
+                if (rs != 15) {
+                    tmp2 = load_reg(s, rs);
+                    gen_helper_add_setq(tmp, tmp, tmp2);
+                    dead_tmp(tmp2);
+                }
+                break;
+            case 2: /* Dual multiply add.  */
+            case 4: /* Dual multiply subtract.  */
+                if (op)
+                    gen_swap_half(tmp2);
+                gen_smul_dual(tmp, tmp2);
+                /* This addition cannot overflow.  */
+                if (insn & (1 << 22)) {
+                    tcg_gen_sub_i32(tmp, tmp, tmp2);
+                } else {
+                    tcg_gen_add_i32(tmp, tmp, tmp2);
+                }
+                dead_tmp(tmp2);
+                if (rs != 15)
+                  {
+                    tmp2 = load_reg(s, rs);
+                    gen_helper_add_setq(tmp, tmp, tmp2);
+                    dead_tmp(tmp2);
+                  }
+                break;
+            case 3: /* 32 * 16 -> 32msb */
+                if (op)
+                    tcg_gen_sari_i32(tmp2, tmp2, 16);
+                else
+                    gen_sxth(tmp2);
+                tmp2 = gen_muls_i64_i32(tmp, tmp2);
+                tcg_gen_shri_i64(tmp2, tmp2, 16);
+                tmp = new_tmp();
+                tcg_gen_trunc_i64_i32(tmp, tmp2);
+                if (rs != 15)
+                  {
+                    tmp2 = load_reg(s, rs);
+                    gen_helper_add_setq(tmp, tmp, tmp2);
+                    dead_tmp(tmp2);
+                  }
+                break;
+            case 5: case 6: /* 32 * 32 -> 32msb */
+                gen_imull(tmp, tmp2);
+                if (insn & (1 << 5)) {
+                    gen_roundqd(tmp, tmp2);
+                    dead_tmp(tmp2);
+                } else {
+                    dead_tmp(tmp);
+                    tmp = tmp2;
+                }
+                if (rs != 15) {
+                    tmp2 = load_reg(s, rs);
+                    if (insn & (1 << 21)) {
+                        tcg_gen_add_i32(tmp, tmp, tmp2);
+                    } else {
+                        tcg_gen_sub_i32(tmp, tmp2, tmp);
+                    }
+                    dead_tmp(tmp2);
+                }
+                break;
+            case 7: /* Unsigned sum of absolute differences.  */
+                gen_helper_usad8(tmp, tmp, tmp2);
+                dead_tmp(tmp2);
+                if (rs != 15) {
+                    tmp2 = load_reg(s, rs);
+                    tcg_gen_add_i32(tmp, tmp, tmp2);
+                    dead_tmp(tmp2);
+                }
+                break;
+            }
+            store_reg(s, rd, tmp);
+            break;
+        case 6: case 7: /* 64-bit multiply, Divide.  */
+            op = ((insn >> 4) & 0xf) | ((insn >> 16) & 0x70);
+            tmp = load_reg(s, rn);
+            tmp2 = load_reg(s, rm);
+            if ((op & 0x50) == 0x10) {
+                /* sdiv, udiv */
+                if (!arm_feature(env, ARM_FEATURE_DIV))
+                    goto illegal_op;
+                if (op & 0x20)
+                    gen_helper_udiv(tmp, tmp, tmp2);
+                else
+                    gen_helper_sdiv(tmp, tmp, tmp2);
+                dead_tmp(tmp2);
+                store_reg(s, rd, tmp);
+            } else if ((op & 0xe) == 0xc) {
+                /* Dual multiply accumulate long.  */
+                if (op & 1)
+                    gen_swap_half(tmp2);
+                gen_smul_dual(tmp, tmp2);
+                if (op & 0x10) {
+                    tcg_gen_sub_i32(tmp, tmp, tmp2);
+                } else {
+                    tcg_gen_add_i32(tmp, tmp, tmp2);
+                }
+                dead_tmp(tmp2);
+                tmp2 = tcg_temp_new(TCG_TYPE_I64);
+                gen_addq(s, tmp, rs, rd);
+                gen_storeq_reg(s, rs, rd, tmp);
+            } else {
+                if (op & 0x20) {
+                    /* Unsigned 64-bit multiply  */
+                    tmp = gen_mulu_i64_i32(tmp, tmp2);
+                } else {
+                    if (op & 8) {
+                        /* smlalxy */
+                        gen_mulxy(tmp, tmp2, op & 2, op & 1);
+                        dead_tmp(tmp2);
+                        tmp2 = tcg_temp_new(TCG_TYPE_I64);
+                        tcg_gen_ext_i32_i64(tmp2, tmp);
+                        dead_tmp(tmp);
+                        tmp = tmp2;
+                    } else {
+                        /* Signed 64-bit multiply  */
+                        tmp = gen_muls_i64_i32(tmp, tmp2);
+                    }
+                }
+                if (op & 4) {
+                    /* umaal */
+                    gen_addq_lo(s, tmp, rs);
+                    gen_addq_lo(s, tmp, rd);
+                } else if (op & 0x40) {
+                    /* 64-bit accumulate.  */
+                    gen_addq(s, tmp, rs, rd);
+                }
+                gen_storeq_reg(s, rs, rd, tmp);
+            }
+            break;
+        }
+        break;
+    case 6: case 7: case 14: case 15:
+        /* Coprocessor.  */
+        if (((insn >> 24) & 3) == 3) {
+            /* Translate into the equivalent ARM encoding.  */
+            insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4);
+            if (disas_neon_data_insn(env, s, insn))
+                goto illegal_op;
+        } else {
+            if (insn & (1 << 28))
+                goto illegal_op;
+            if (disas_coproc_insn (env, s, insn))
+                goto illegal_op;
+        }
+        break;
+    case 8: case 9: case 10: case 11:
+        if (insn & (1 << 15)) {
+            /* Branches, misc control.  */
+            if (insn & 0x5000) {
+                /* Unconditional branch.  */
+                /* signextend(hw1[10:0]) -> offset[:12].  */
+                offset = ((int32_t)insn << 5) >> 9 & ~(int32_t)0xfff;
+                /* hw1[10:0] -> offset[11:1].  */
+                offset |= (insn & 0x7ff) << 1;
+                /* (~hw2[13, 11] ^ offset[24]) -> offset[23,22]
+                   offset[24:22] already have the same value because of the
+                   sign extension above.  */
+                offset ^= ((~insn) & (1 << 13)) << 10;
+                offset ^= ((~insn) & (1 << 11)) << 11;
+
+                if (insn & (1 << 14)) {
+                    /* Branch and link.  */
+                    gen_op_movl_T1_im(s->pc | 1);
+                    gen_movl_reg_T1(s, 14);
+                }
+
+                offset += s->pc;
+                if (insn & (1 << 12)) {
+                    /* b/bl */
+                    gen_jmp(s, offset);
+                } else {
+                    /* blx */
+                    offset &= ~(uint32_t)2;
+                    gen_bx_im(s, offset);
+                }
+            } else if (((insn >> 23) & 7) == 7) {
+                /* Misc control */
+                if (insn & (1 << 13))
+                    goto illegal_op;
+
+                if (insn & (1 << 26)) {
+                    /* Secure monitor call (v6Z) */
+                    goto illegal_op; /* not implemented.  */
+                } else {
+                    op = (insn >> 20) & 7;
+                    switch (op) {
+                    case 0: /* msr cpsr.  */
+                        if (IS_M(env)) {
+                            tmp = load_reg(s, rn);
+                            addr = tcg_const_i32(insn & 0xff);
+                            gen_helper_v7m_msr(cpu_env, addr, tmp);
+                            gen_lookup_tb(s);
+                            break;
+                        }
+                        /* fall through */
+                    case 1: /* msr spsr.  */
+                        if (IS_M(env))
+                            goto illegal_op;
+                        gen_movl_T0_reg(s, rn);
+                        if (gen_set_psr_T0(s,
+                              msr_mask(env, s, (insn >> 8) & 0xf, op == 1),
+                              op == 1))
+                            goto illegal_op;
+                        break;
+                    case 2: /* cps, nop-hint.  */
+                        if (((insn >> 8) & 7) == 0) {
+                            gen_nop_hint(s, insn & 0xff);
+                        }
+                        /* Implemented as NOP in user mode.  */
+                        if (IS_USER(s))
+                            break;
+                        offset = 0;
+                        imm = 0;
+                        if (insn & (1 << 10)) {
+                            if (insn & (1 << 7))
+                                offset |= CPSR_A;
+                            if (insn & (1 << 6))
+                                offset |= CPSR_I;
+                            if (insn & (1 << 5))
+                                offset |= CPSR_F;
+                            if (insn & (1 << 9))
+                                imm = CPSR_A | CPSR_I | CPSR_F;
+                        }
+                        if (insn & (1 << 8)) {
+                            offset |= 0x1f;
+                            imm |= (insn & 0x1f);
+                        }
+                        if (offset) {
+                            gen_op_movl_T0_im(imm);
+                            gen_set_psr_T0(s, offset, 0);
+                        }
+                        break;
+                    case 3: /* Special control operations.  */
+                        op = (insn >> 4) & 0xf;
+                        switch (op) {
+                        case 2: /* clrex */
+                            gen_helper_clrex(cpu_env);
+                            break;
+                        case 4: /* dsb */
+                        case 5: /* dmb */
+                        case 6: /* isb */
+                            /* These execute as NOPs.  */
+                            ARCH(7);
+                            break;
+                        default:
+                            goto illegal_op;
+                        }
+                        break;
+                    case 4: /* bxj */
+                        /* Trivial implementation equivalent to bx.  */
+                        tmp = load_reg(s, rn);
+                        gen_bx(s, tmp);
+                        break;
+                    case 5: /* Exception return.  */
+                        /* Unpredictable in user mode.  */
+                        goto illegal_op;
+                    case 6: /* mrs cpsr.  */
+                        tmp = new_tmp();
+                        if (IS_M(env)) {
+                            addr = tcg_const_i32(insn & 0xff);
+                            gen_helper_v7m_mrs(tmp, cpu_env, addr);
+                        } else {
+                            gen_helper_cpsr_read(tmp);
+                        }
+                        store_reg(s, rd, tmp);
+                        break;
+                    case 7: /* mrs spsr.  */
+                        /* Not accessible in user mode.  */
+                        if (IS_USER(s) || IS_M(env))
+                            goto illegal_op;
+                        tmp = load_cpu_field(spsr);
+                        store_reg(s, rd, tmp);
+                        break;
+                    }
+                }
+            } else {
+                /* Conditional branch.  */
+                op = (insn >> 22) & 0xf;
+                /* Generate a conditional jump to next instruction.  */
+                s->condlabel = gen_new_label();
+                gen_test_cc(op ^ 1, s->condlabel);
+                s->condjmp = 1;
+
+                /* offset[11:1] = insn[10:0] */
+                offset = (insn & 0x7ff) << 1;
+                /* offset[17:12] = insn[21:16].  */
+                offset |= (insn & 0x003f0000) >> 4;
+                /* offset[31:20] = insn[26].  */
+                offset |= ((int32_t)((insn << 5) & 0x80000000)) >> 11;
+                /* offset[18] = insn[13].  */
+                offset |= (insn & (1 << 13)) << 5;
+                /* offset[19] = insn[11].  */
+                offset |= (insn & (1 << 11)) << 8;
+
+                /* jump to the offset */
+                gen_jmp(s, s->pc + offset);
+            }
+        } else {
+            /* Data processing immediate.  */
+            if (insn & (1 << 25)) {
+                if (insn & (1 << 24)) {
+                    if (insn & (1 << 20))
+                        goto illegal_op;
+                    /* Bitfield/Saturate.  */
+                    op = (insn >> 21) & 7;
+                    imm = insn & 0x1f;
+                    shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
+                    if (rn == 15) {
+                        tmp = new_tmp();
+                        tcg_gen_movi_i32(tmp, 0);
+                    } else {
+                        tmp = load_reg(s, rn);
+                    }
+                    switch (op) {
+                    case 2: /* Signed bitfield extract.  */
+                        imm++;
+                        if (shift + imm > 32)
+                            goto illegal_op;
+                        if (imm < 32)
+                            gen_sbfx(tmp, shift, imm);
+                        break;
+                    case 6: /* Unsigned bitfield extract.  */
+                        imm++;
+                        if (shift + imm > 32)
+                            goto illegal_op;
+                        if (imm < 32)
+                            gen_ubfx(tmp, shift, (1u << imm) - 1);
+                        break;
+                    case 3: /* Bitfield insert/clear.  */
+                        if (imm < shift)
+                            goto illegal_op;
+                        imm = imm + 1 - shift;
+                        if (imm != 32) {
+                            tmp2 = load_reg(s, rd);
+                            gen_bfi(tmp, tmp2, tmp, shift, (1u << imm) - 1);
+                            dead_tmp(tmp2);
+                        }
+                        break;
+                    case 7:
+                        goto illegal_op;
+                    default: /* Saturate.  */
+                        if (shift) {
+                            if (op & 1)
+                                tcg_gen_sari_i32(tmp, tmp, shift);
+                            else
+                                tcg_gen_shli_i32(tmp, tmp, shift);
+                        }
+                        tmp2 = tcg_const_i32(imm);
+                        if (op & 4) {
+                            /* Unsigned.  */
+                            if ((op & 1) && shift == 0)
+                                gen_helper_usat16(tmp, tmp, tmp2);
+                            else
+                                gen_helper_usat(tmp, tmp, tmp2);
+                        } else {
+                            /* Signed.  */
+                            if ((op & 1) && shift == 0)
+                                gen_helper_ssat16(tmp, tmp, tmp2);
+                            else
+                                gen_helper_ssat(tmp, tmp, tmp2);
+                        }
+                        break;
+                    }
+                    store_reg(s, rd, tmp);
+                } else {
+                    imm = ((insn & 0x04000000) >> 15)
+                          | ((insn & 0x7000) >> 4) | (insn & 0xff);
+                    if (insn & (1 << 22)) {
+                        /* 16-bit immediate.  */
+                        imm |= (insn >> 4) & 0xf000;
+                        if (insn & (1 << 23)) {
+                            /* movt */
+                            tmp = load_reg(s, rd);
+                            tcg_gen_ext16u_i32(tmp, tmp);
+                            tcg_gen_ori_i32(tmp, tmp, imm << 16);
+                        } else {
+                            /* movw */
+                            tmp = new_tmp();
+                            tcg_gen_movi_i32(tmp, imm);
+                        }
+                    } else {
+                        /* Add/sub 12-bit immediate.  */
+                        if (rn == 15) {
+                            offset = s->pc & ~(uint32_t)3;
+                            if (insn & (1 << 23))
+                                offset -= imm;
+                            else
+                                offset += imm;
+                            tmp = new_tmp();
+                            tcg_gen_movi_i32(tmp, offset);
+                        } else {
+                            tmp = load_reg(s, rn);
+                            if (insn & (1 << 23))
+                                tcg_gen_subi_i32(tmp, tmp, imm);
+                            else
+                                tcg_gen_addi_i32(tmp, tmp, imm);
+                        }
+                    }
+                    store_reg(s, rd, tmp);
+                }
+            } else {
+                int shifter_out = 0;
+                /* modified 12-bit immediate.  */
+                shift = ((insn & 0x04000000) >> 23) | ((insn & 0x7000) >> 12);
+                imm = (insn & 0xff);
+                switch (shift) {
+                case 0: /* XY */
+                    /* Nothing to do.  */
+                    break;
+                case 1: /* 00XY00XY */
+                    imm |= imm << 16;
+                    break;
+                case 2: /* XY00XY00 */
+                    imm |= imm << 16;
+                    imm <<= 8;
+                    break;
+                case 3: /* XYXYXYXY */
+                    imm |= imm << 16;
+                    imm |= imm << 8;
+                    break;
+                default: /* Rotated constant.  */
+                    shift = (shift << 1) | (imm >> 7);
+                    imm |= 0x80;
+                    imm = imm << (32 - shift);
+                    shifter_out = 1;
+                    break;
+                }
+                gen_op_movl_T1_im(imm);
+                rn = (insn >> 16) & 0xf;
+                if (rn == 15)
+                    gen_op_movl_T0_im(0);
+                else
+                    gen_movl_T0_reg(s, rn);
+                op = (insn >> 21) & 0xf;
+                if (gen_thumb2_data_op(s, op, (insn & (1 << 20)) != 0,
+                                       shifter_out))
+                    goto illegal_op;
+                rd = (insn >> 8) & 0xf;
+                if (rd != 15) {
+                    gen_movl_reg_T0(s, rd);
+                }
+            }
+        }
+        break;
+    case 12: /* Load/store single data item.  */
+        {
+        int postinc = 0;
+        int writeback = 0;
+        int user;
+        if ((insn & 0x01100000) == 0x01000000) {
+            if (disas_neon_ls_insn(env, s, insn))
+                goto illegal_op;
+            break;
+        }
+        user = IS_USER(s);
+        if (rn == 15) {
+            addr = new_tmp();
+            /* PC relative.  */
+            /* s->pc has already been incremented by 4.  */
+            imm = s->pc & 0xfffffffc;
+            if (insn & (1 << 23))
+                imm += insn & 0xfff;
+            else
+                imm -= insn & 0xfff;
+            tcg_gen_movi_i32(addr, imm);
+        } else {
+            addr = load_reg(s, rn);
+            if (insn & (1 << 23)) {
+                /* Positive offset.  */
+                imm = insn & 0xfff;
+                tcg_gen_addi_i32(addr, addr, imm);
+            } else {
+                op = (insn >> 8) & 7;
+                imm = insn & 0xff;
+                switch (op) {
+                case 0: case 8: /* Shifted Register.  */
+                    shift = (insn >> 4) & 0xf;
+                    if (shift > 3)
+                        goto illegal_op;
+                    tmp = load_reg(s, rm);
+                    if (shift)
+                        tcg_gen_shli_i32(tmp, tmp, shift);
+                    tcg_gen_add_i32(addr, addr, tmp);
+                    dead_tmp(tmp);
+                    break;
+                case 4: /* Negative offset.  */
+                    tcg_gen_addi_i32(addr, addr, -imm);
+                    break;
+                case 6: /* User privilege.  */
+                    tcg_gen_addi_i32(addr, addr, imm);
+                    user = 1;
+                    break;
+                case 1: /* Post-decrement.  */
+                    imm = -imm;
+                    /* Fall through.  */
+                case 3: /* Post-increment.  */
+                    postinc = 1;
+                    writeback = 1;
+                    break;
+                case 5: /* Pre-decrement.  */
+                    imm = -imm;
+                    /* Fall through.  */
+                case 7: /* Pre-increment.  */
+                    tcg_gen_addi_i32(addr, addr, imm);
+                    writeback = 1;
+                    break;
+                default:
+                    goto illegal_op;
+                }
+            }
+        }
+        op = ((insn >> 21) & 3) | ((insn >> 22) & 4);
+        if (insn & (1 << 20)) {
+            /* Load.  */
+            if (rs == 15 && op != 2) {
+                if (op & 2)
+                    goto illegal_op;
+                /* Memory hint.  Implemented as NOP.  */
+            } else {
+                switch (op) {
+                case 0: tmp = gen_ld8u(addr, user); break;
+                case 4: tmp = gen_ld8s(addr, user); break;
+                case 1: tmp = gen_ld16u(addr, user); break;
+                case 5: tmp = gen_ld16s(addr, user); break;
+                case 2: tmp = gen_ld32(addr, user); break;
+                default: goto illegal_op;
+                }
+                if (rs == 15) {
+                    gen_bx(s, tmp);
+                } else {
+                    store_reg(s, rs, tmp);
+                }
+            }
+        } else {
+            /* Store.  */
+            if (rs == 15)
+                goto illegal_op;
+            tmp = load_reg(s, rs);
+            switch (op) {
+            case 0: gen_st8(tmp, addr, user); break;
+            case 1: gen_st16(tmp, addr, user); break;
+            case 2: gen_st32(tmp, addr, user); break;
+            default: goto illegal_op;
+            }
+        }
+        if (postinc)
+            tcg_gen_addi_i32(addr, addr, imm);
+        if (writeback) {
+            store_reg(s, rn, addr);
+        } else {
+            dead_tmp(addr);
+        }
+        }
+        break;
+    default:
+        goto illegal_op;
+    }
+    return 0;
+illegal_op:
+    return 1;
+}
+
+static void disas_thumb_insn(CPUState *env, DisasContext *s)
 {
     uint32_t val, insn, op, rm, rn, rd, shift, cond;
     int32_t offset;
     int i;
+    TCGv tmp;
+    TCGv tmp2;
+    TCGv addr;
+
+    if (s->condexec_mask) {
+        cond = s->condexec_cond;
+        s->condlabel = gen_new_label();
+        gen_test_cc(cond ^ 1, s->condlabel);
+        s->condjmp = 1;
+    }
 
     insn = lduw_code(s->pc);
-#ifdef GEN_TRACE
+#ifdef CONFIG_TRACE
     if (tracing) {
-        int insn_ticks;
-
-        trace_add_insn( insn_wrap_thumb(insn), 1 /* thumb insn */ );
-        insn_ticks = get_insn_ticks_thumb(insn);
-        gen_op_trace_insn();
-        gen_op_add_to_sim_time(insn_ticks);
+        int  ticks = get_insn_ticks_thumb(insn);
+        trace_add_insn( insn_wrap_thumb(insn), 1 );
+        gen_helper_traceInsn();
+        gen_traceTicks(ticks);
     }
 #endif
     s->pc += 2;
@@ -1915,18 +8009,27 @@ static void disas_thumb_insn(DisasContext *s)
                 rm = (insn >> 6) & 7;
                 gen_movl_T1_reg(s, rm);
             }
-            if (insn & (1 << 9))
-                gen_op_subl_T0_T1_cc();
-            else
-                gen_op_addl_T0_T1_cc();
+            if (insn & (1 << 9)) {
+                if (s->condexec_mask)
+                    gen_op_subl_T0_T1();
+                else
+                    gen_op_subl_T0_T1_cc();
+            } else {
+                if (s->condexec_mask)
+                    gen_op_addl_T0_T1();
+                else
+                    gen_op_addl_T0_T1_cc();
+            }
             gen_movl_reg_T0(s, rd);
         } else {
             /* shift immediate */
             rm = (insn >> 3) & 7;
             shift = (insn >> 6) & 0x1f;
-            gen_movl_T0_reg(s, rm);
-            gen_shift_T0_im_thumb[op](shift);
-            gen_movl_reg_T0(s, rd);
+            tmp = load_reg(s, rm);
+            gen_arm_shift_im(tmp, op, shift, s->condexec_mask == 0);
+            if (!s->condexec_mask)
+                gen_logic_CC(tmp);
+            store_reg(s, rd, tmp);
         }
         break;
     case 2: case 3:
@@ -1941,16 +8044,23 @@ static void disas_thumb_insn(DisasContext *s)
         }
         switch (op) {
         case 0: /* mov */
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 1: /* cmp */
             gen_op_subl_T0_T1_cc();
             break;
         case 2: /* add */
-            gen_op_addl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_addl_T0_T1();
+            else
+                gen_op_addl_T0_T1_cc();
             break;
         case 3: /* sub */
-            gen_op_subl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_subl_T0_T1();
+            else
+                gen_op_subl_T0_T1_cc();
             break;
         }
         if (op != 1)
@@ -1962,9 +8072,11 @@ static void disas_thumb_insn(DisasContext *s)
             /* load pc-relative.  Bit 1 of PC is ignored.  */
             val = s->pc + 2 + ((insn & 0xff) * 4);
             val &= ~(uint32_t)2;
-            gen_op_movl_T1_im(val);
-            gen_ldst(ldl, s);
-            gen_movl_reg_T0(s, rd);
+            addr = new_tmp();
+            tcg_gen_movi_i32(addr, val);
+            tmp = gen_ld32(addr, IS_USER(s));
+            dead_tmp(addr);
+            store_reg(s, rd, tmp);
             break;
         }
         if (insn & (1 << 10)) {
@@ -1989,13 +8101,14 @@ static void disas_thumb_insn(DisasContext *s)
                 gen_movl_reg_T0(s, rd);
                 break;
             case 3:/* branch [and link] exchange thumb register */
+                tmp = load_reg(s, rm);
                 if (insn & (1 << 7)) {
                     val = (uint32_t)s->pc | 1;
-                    gen_op_movl_T1_im(val);
-                    gen_movl_reg_T1(s, 14);
+                    tmp2 = new_tmp();
+                    tcg_gen_movi_i32(tmp2, val);
+                    store_reg(s, 14, tmp2);
                 }
-                gen_movl_T0_reg(s, rm);
-                gen_bx(s);
+                gen_bx(s, tmp);
                 break;
             }
             break;
@@ -2024,33 +8137,57 @@ static void disas_thumb_insn(DisasContext *s)
         switch (op) {
         case 0x0: /* and */
             gen_op_andl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0x1: /* eor */
             gen_op_xorl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0x2: /* lsl */
-            gen_op_shll_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_helper_shl(cpu_T[1], cpu_T[1], cpu_T[0]);
+            } else {
+                gen_helper_shl_cc(cpu_T[1], cpu_T[1], cpu_T[0]);
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x3: /* lsr */
-            gen_op_shrl_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_helper_shr(cpu_T[1], cpu_T[1], cpu_T[0]);
+            } else {
+                gen_helper_shr_cc(cpu_T[1], cpu_T[1], cpu_T[0]);
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x4: /* asr */
-            gen_op_sarl_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_helper_sar(cpu_T[1], cpu_T[1], cpu_T[0]);
+            } else {
+                gen_helper_sar_cc(cpu_T[1], cpu_T[1], cpu_T[0]);
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x5: /* adc */
-            gen_op_adcl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_adc_T0_T1();
+            else
+                gen_op_adcl_T0_T1_cc();
             break;
         case 0x6: /* sbc */
-            gen_op_sbcl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_sbc_T0_T1();
+            else
+                gen_op_sbcl_T0_T1_cc();
             break;
         case 0x7: /* ror */
-            gen_op_rorl_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_helper_ror(cpu_T[1], cpu_T[1], cpu_T[0]);
+            } else {
+                gen_helper_ror_cc(cpu_T[1], cpu_T[1], cpu_T[0]);
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x8: /* tst */
             gen_op_andl_T0_T1();
@@ -2058,7 +8195,10 @@ static void disas_thumb_insn(DisasContext *s)
             rd = 16;
             break;
         case 0x9: /* neg */
-            gen_op_subl_T0_T1_cc();
+            if (s->condexec_mask)
+                tcg_gen_neg_i32(cpu_T[0], cpu_T[1]);
+            else
+                gen_op_subl_T0_T1_cc();
             break;
         case 0xa: /* cmp */
             gen_op_subl_T0_T1_cc();
@@ -2070,19 +8210,23 @@ static void disas_thumb_insn(DisasContext *s)
             break;
         case 0xc: /* orr */
             gen_op_orl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0xd: /* mul */
             gen_op_mull_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0xe: /* bic */
             gen_op_bicl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0xf: /* mvn */
             gen_op_notl_T1();
-            gen_op_logic_T1_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T1_cc();
             val = 1;
             rm = rd;
             break;
@@ -2101,120 +8245,122 @@ static void disas_thumb_insn(DisasContext *s)
         rn = (insn >> 3) & 7;
         rm = (insn >> 6) & 7;
         op = (insn >> 9) & 7;
-        gen_movl_T1_reg(s, rn);
-        gen_movl_T2_reg(s, rm);
-        gen_op_addl_T1_T2();
+        addr = load_reg(s, rn);
+        tmp = load_reg(s, rm);
+        tcg_gen_add_i32(addr, addr, tmp);
+        dead_tmp(tmp);
 
         if (op < 3) /* store */
-            gen_movl_T0_reg(s, rd);
+            tmp = load_reg(s, rd);
 
         switch (op) {
         case 0: /* str */
-            gen_ldst(stl, s);
+            gen_st32(tmp, addr, IS_USER(s));
             break;
         case 1: /* strh */
-            gen_ldst(stw, s);
+            gen_st16(tmp, addr, IS_USER(s));
             break;
         case 2: /* strb */
-            gen_ldst(stb, s);
+            gen_st8(tmp, addr, IS_USER(s));
             break;
         case 3: /* ldrsb */
-            gen_ldst(ldsb, s);
+            tmp = gen_ld8s(addr, IS_USER(s));
             break;
         case 4: /* ldr */
-            gen_ldst(ldl, s);
+            tmp = gen_ld32(addr, IS_USER(s));
             break;
         case 5: /* ldrh */
-            gen_ldst(lduw, s);
+            tmp = gen_ld16u(addr, IS_USER(s));
             break;
         case 6: /* ldrb */
-            gen_ldst(ldub, s);
+            tmp = gen_ld8u(addr, IS_USER(s));
             break;
         case 7: /* ldrsh */
-            gen_ldst(ldsw, s);
+            tmp = gen_ld16s(addr, IS_USER(s));
             break;
         }
         if (op >= 3) /* load */
-            gen_movl_reg_T0(s, rd);
+            store_reg(s, rd, tmp);
+        dead_tmp(addr);
         break;
 
     case 6:
         /* load/store word immediate offset */
         rd = insn & 7;
         rn = (insn >> 3) & 7;
-        gen_movl_T1_reg(s, rn);
+        addr = load_reg(s, rn);
         val = (insn >> 4) & 0x7c;
-        gen_op_movl_T2_im(val);
-        gen_op_addl_T1_T2();
+        tcg_gen_addi_i32(addr, addr, val);
 
         if (insn & (1 << 11)) {
             /* load */
-            gen_ldst(ldl, s);
-            gen_movl_reg_T0(s, rd);
+            tmp = gen_ld32(addr, IS_USER(s));
+            store_reg(s, rd, tmp);
         } else {
             /* store */
-            gen_movl_T0_reg(s, rd);
-            gen_ldst(stl, s);
+            tmp = load_reg(s, rd);
+            gen_st32(tmp, addr, IS_USER(s));
         }
+        dead_tmp(addr);
         break;
 
     case 7:
         /* load/store byte immediate offset */
         rd = insn & 7;
         rn = (insn >> 3) & 7;
-        gen_movl_T1_reg(s, rn);
+        addr = load_reg(s, rn);
         val = (insn >> 6) & 0x1f;
-        gen_op_movl_T2_im(val);
-        gen_op_addl_T1_T2();
+        tcg_gen_addi_i32(addr, addr, val);
 
         if (insn & (1 << 11)) {
             /* load */
-            gen_ldst(ldub, s);
-            gen_movl_reg_T0(s, rd);
+            tmp = gen_ld8u(addr, IS_USER(s));
+            store_reg(s, rd, tmp);
         } else {
             /* store */
-            gen_movl_T0_reg(s, rd);
-            gen_ldst(stb, s);
+            tmp = load_reg(s, rd);
+            gen_st8(tmp, addr, IS_USER(s));
         }
+        dead_tmp(addr);
         break;
 
     case 8:
         /* load/store halfword immediate offset */
         rd = insn & 7;
         rn = (insn >> 3) & 7;
-        gen_movl_T1_reg(s, rn);
+        addr = load_reg(s, rn);
         val = (insn >> 5) & 0x3e;
-        gen_op_movl_T2_im(val);
-        gen_op_addl_T1_T2();
+        tcg_gen_addi_i32(addr, addr, val);
 
         if (insn & (1 << 11)) {
             /* load */
-            gen_ldst(lduw, s);
-            gen_movl_reg_T0(s, rd);
+            tmp = gen_ld16u(addr, IS_USER(s));
+            store_reg(s, rd, tmp);
         } else {
             /* store */
-            gen_movl_T0_reg(s, rd);
-            gen_ldst(stw, s);
+            tmp = load_reg(s, rd);
+            gen_st16(tmp, addr, IS_USER(s));
         }
+        dead_tmp(addr);
         break;
 
     case 9:
         /* load/store from stack */
         rd = (insn >> 8) & 7;
-        gen_movl_T1_reg(s, 13);
+        addr = load_reg(s, 13);
         val = (insn & 0xff) * 4;
-        gen_op_movl_T2_im(val);
-        gen_op_addl_T1_T2();
+        tcg_gen_addi_i32(addr, addr, val);
 
         if (insn & (1 << 11)) {
             /* load */
-            gen_ldst(ldl, s);
-            gen_movl_reg_T0(s, rd);
+            tmp = gen_ld32(addr, IS_USER(s));
+            store_reg(s, rd, tmp);
         } else {
             /* store */
-            gen_movl_T0_reg(s, rd);
-            gen_ldst(stl, s);
+            tmp = load_reg(s, rd);
+            gen_st32(tmp, addr, IS_USER(s));
         }
+        dead_tmp(addr);
         break;
 
     case 10:
@@ -2222,15 +8368,15 @@ static void disas_thumb_insn(DisasContext *s)
         rd = (insn >> 8) & 7;
         if (insn & (1 << 11)) {
             /* SP */
-            gen_movl_T0_reg(s, 13);
+            tmp = load_reg(s, 13);
         } else {
             /* PC. bit 1 is ignored.  */
-            gen_op_movl_T0_im((s->pc + 2) & ~(uint32_t)2);
+            tmp = new_tmp();
+            tcg_gen_movi_i32(tmp, (s->pc + 2) & ~(uint32_t)2);
         }
         val = (insn & 0xff) * 4;
-        gen_op_movl_T1_im(val);
-        gen_op_addl_T0_T1();
-        gen_movl_reg_T0(s, rd);
+        tcg_gen_addi_i32(tmp, tmp, val);
+        store_reg(s, rd, tmp);
         break;
 
     case 11:
@@ -2239,18 +8385,30 @@ static void disas_thumb_insn(DisasContext *s)
         switch (op) {
         case 0:
             /* adjust stack pointer */
-            gen_movl_T1_reg(s, 13);
+            tmp = load_reg(s, 13);
             val = (insn & 0x7f) * 4;
             if (insn & (1 << 7))
-              val = -(int32_t)val;
-            gen_op_movl_T2_im(val);
-            gen_op_addl_T1_T2();
-            gen_movl_reg_T1(s, 13);
+                val = -(int32_t)val;
+            tcg_gen_addi_i32(tmp, tmp, val);
+            store_reg(s, 13, tmp);
             break;
 
+        case 2: /* sign/zero extend.  */
+            ARCH(6);
+            rd = insn & 7;
+            rm = (insn >> 3) & 7;
+            tmp = load_reg(s, rm);
+            switch ((insn >> 6) & 3) {
+            case 0: gen_sxth(tmp); break;
+            case 1: gen_sxtb(tmp); break;
+            case 2: gen_uxth(tmp); break;
+            case 3: gen_uxtb(tmp); break;
+            }
+            store_reg(s, rd, tmp);
+            break;
         case 4: case 5: case 0xc: case 0xd:
             /* push/pop */
-            gen_movl_T1_reg(s, 13);
+            addr = load_reg(s, 13);
             if (insn & (1 << 8))
                 offset = 4;
             else
@@ -2260,56 +8418,124 @@ static void disas_thumb_insn(DisasContext *s)
                     offset += 4;
             }
             if ((insn & (1 << 11)) == 0) {
-                gen_op_movl_T2_im(-offset);
-                gen_op_addl_T1_T2();
+                tcg_gen_addi_i32(addr, addr, -offset);
             }
-            gen_op_movl_T2_im(4);
             for (i = 0; i < 8; i++) {
                 if (insn & (1 << i)) {
                     if (insn & (1 << 11)) {
                         /* pop */
-                        gen_ldst(ldl, s);
-                        gen_movl_reg_T0(s, i);
+                        tmp = gen_ld32(addr, IS_USER(s));
+                        store_reg(s, i, tmp);
                     } else {
                         /* push */
-                        gen_movl_T0_reg(s, i);
-                        gen_ldst(stl, s);
+                        tmp = load_reg(s, i);
+                        gen_st32(tmp, addr, IS_USER(s));
                     }
                     /* advance to the next address.  */
-                    gen_op_addl_T1_T2();
+                    tcg_gen_addi_i32(addr, addr, 4);
                 }
             }
+            TCGV_UNUSED(tmp);
             if (insn & (1 << 8)) {
                 if (insn & (1 << 11)) {
                     /* pop pc */
-                    gen_ldst(ldl, s);
+                    tmp = gen_ld32(addr, IS_USER(s));
                     /* don't set the pc until the rest of the instruction
                        has completed */
                 } else {
                     /* push lr */
-                    gen_movl_T0_reg(s, 14);
-                    gen_ldst(stl, s);
+                    tmp = load_reg(s, 14);
+                    gen_st32(tmp, addr, IS_USER(s));
                 }
-                gen_op_addl_T1_T2();
+                tcg_gen_addi_i32(addr, addr, 4);
             }
             if ((insn & (1 << 11)) == 0) {
-                gen_op_movl_T2_im(-offset);
-                gen_op_addl_T1_T2();
+                tcg_gen_addi_i32(addr, addr, -offset);
             }
             /* write back the new stack pointer */
-            gen_movl_reg_T1(s, 13);
+            store_reg(s, 13, addr);
             /* set the new PC value */
             if ((insn & 0x0900) == 0x0900)
-                gen_bx(s);
+                gen_bx(s, tmp);
+            break;
+
+        case 1: case 3: case 9: case 11: /* czb */
+            rm = insn & 7;
+            tmp = load_reg(s, rm);
+            s->condlabel = gen_new_label();
+            s->condjmp = 1;
+            if (insn & (1 << 11))
+                tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, s->condlabel);
+            else
+                tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, s->condlabel);
+            dead_tmp(tmp);
+            offset = ((insn & 0xf8) >> 2) | (insn & 0x200) >> 3;
+            val = (uint32_t)s->pc + 2;
+            val += offset;
+            gen_jmp(s, val);
+            break;
+
+        case 15: /* IT, nop-hint.  */
+            if ((insn & 0xf) == 0) {
+                gen_nop_hint(s, (insn >> 4) & 0xf);
+                break;
+            }
+            /* If Then.  */
+            s->condexec_cond = (insn >> 4) & 0xe;
+            s->condexec_mask = insn & 0x1f;
+            /* No actual code generated for this insn, just setup state.  */
             break;
 
         case 0xe: /* bkpt */
-            gen_op_movl_T0_im((long)s->pc - 2);
-            gen_op_movl_reg_TN[0][15]();
-            gen_op_bkpt();
+            gen_set_condexec(s);
+            gen_set_pc_im(s->pc - 2);
+            gen_exception(EXCP_BKPT);
             s->is_jmp = DISAS_JUMP;
             break;
 
+        case 0xa: /* rev */
+            ARCH(6);
+            rn = (insn >> 3) & 0x7;
+            rd = insn & 0x7;
+            tmp = load_reg(s, rn);
+            switch ((insn >> 6) & 3) {
+            case 0: tcg_gen_bswap_i32(tmp, tmp); break;
+            case 1: gen_rev16(tmp); break;
+            case 3: gen_revsh(tmp); break;
+            default: goto illegal_op;
+            }
+            store_reg(s, rd, tmp);
+            break;
+
+        case 6: /* cps */
+            ARCH(6);
+            if (IS_USER(s))
+                break;
+            if (IS_M(env)) {
+                tmp = tcg_const_i32((insn & (1 << 4)) != 0);
+                /* PRIMASK */
+                if (insn & 1) {
+                    addr = tcg_const_i32(16);
+                    gen_helper_v7m_msr(cpu_env, addr, tmp);
+                }
+                /* FAULTMASK */
+                if (insn & 2) {
+                    addr = tcg_const_i32(17);
+                    gen_helper_v7m_msr(cpu_env, addr, tmp);
+                }
+                gen_lookup_tb(s);
+            } else {
+                if (insn & (1 << 4))
+                    shift = CPSR_A | CPSR_I | CPSR_F;
+                else
+                    shift = 0;
+
+                val = ((insn & 7) << 6) & shift;
+                gen_op_movl_T0_im(val);
+                gen_set_psr_T0(s, shift, 0);
+            }
+            break;
+
         default:
             goto undef;
         }
@@ -2318,26 +8544,28 @@ static void disas_thumb_insn(DisasContext *s)
     case 12:
         /* load/store multiple */
         rn = (insn >> 8) & 0x7;
-        gen_movl_T1_reg(s, rn);
-        gen_op_movl_T2_im(4);
+        addr = load_reg(s, rn);
         for (i = 0; i < 8; i++) {
             if (insn & (1 << i)) {
                 if (insn & (1 << 11)) {
                     /* load */
-                    gen_ldst(ldl, s);
-                    gen_movl_reg_T0(s, i);
+                    tmp = gen_ld32(addr, IS_USER(s));
+                    store_reg(s, i, tmp);
                 } else {
                     /* store */
-                    gen_movl_T0_reg(s, i);
-                    gen_ldst(stl, s);
+                    tmp = load_reg(s, i);
+                    gen_st32(tmp, addr, IS_USER(s));
                 }
                 /* advance to the next address */
-                gen_op_addl_T1_T2();
+                tcg_gen_addi_i32(addr, addr, 4);
             }
         }
         /* Base register writeback.  */
-        if ((insn & (1 << rn)) == 0)
-            gen_movl_reg_T1(s, rn);
+        if ((insn & (1 << rn)) == 0) {
+            store_reg(s, rn, addr);
+        } else {
+            dead_tmp(addr);
+        }
         break;
 
     case 13:
@@ -2348,19 +8576,15 @@ static void disas_thumb_insn(DisasContext *s)
 
         if (cond == 0xf) {
             /* swi */
-            gen_op_movl_T0_im((long)s->pc | 1);
-            /* Don't set r15.  */
-            gen_op_movl_reg_TN[0][15]();
-            gen_op_swi();
-            s->is_jmp = DISAS_JUMP;
+            gen_set_condexec(s);
+            gen_set_pc_im(s->pc);
+            s->is_jmp = DISAS_SWI;
             break;
         }
         /* generate a conditional jump to next instruction */
         s->condlabel = gen_new_label();
-        gen_test_cc[cond ^ 1](s->condlabel);
+        gen_test_cc(cond ^ 1, s->condlabel);
         s->condjmp = 1;
-        //gen_test_cc[cond ^ 1]((long)s->tb, (long)s->pc);
-        //s->is_jmp = DISAS_JUMP_NEXT;
         gen_movl_T1_reg(s, 15);
 
         /* jump to the offset */
@@ -2371,22 +8595,12 @@ static void disas_thumb_insn(DisasContext *s)
         break;
 
     case 14:
-        /* unconditional branch */
         if (insn & (1 << 11)) {
-            /* Second half of blx.  */
-            offset = ((insn & 0x7ff) << 1);
-            gen_movl_T0_reg(s, 14);
-            gen_op_movl_T1_im(offset);
-            gen_op_addl_T0_T1();
-            gen_op_movl_T1_im(0xfffffffc);
-            gen_op_andl_T0_T1();
-
-            val = (uint32_t)s->pc;
-            gen_op_movl_T1_im(val | 1);
-            gen_movl_reg_T1(s, 14);
-            gen_bx(s);
+            if (disas_thumb2_insn(env, s, insn))
+              goto undef32;
             break;
         }
+        /* unconditional branch */
         val = (uint32_t)s->pc;
         offset = ((int32_t)insn << 21) >> 21;
         val += (offset << 1) + 2;
@@ -2394,114 +8608,127 @@ static void disas_thumb_insn(DisasContext *s)
         break;
 
     case 15:
-        /* branch and link [and switch to arm] */
-        if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
-            /* Instruction spans a page boundary.  Implement it as two
-               16-bit instructions in case the second half causes an
-               prefetch abort.  */
-            offset = ((int32_t)insn << 21) >> 9;
-            val = s->pc + 2 + offset;
-            gen_op_movl_T0_im(val);
-            gen_movl_reg_T0(s, 14);
-            break;
-        }
-        if (insn & (1 << 11)) {
-            /* Second half of bl.  */
-            offset = ((insn & 0x7ff) << 1) | 1;
-            gen_movl_T0_reg(s, 14);
-            gen_op_movl_T1_im(offset);
-            gen_op_addl_T0_T1();
-
-            val = (uint32_t)s->pc;
-            gen_op_movl_T1_im(val | 1);
-            gen_movl_reg_T1(s, 14);
-            gen_bx(s);
-            break;
-        }
-        offset = ((int32_t)insn << 21) >> 10;
-        insn = lduw_code(s->pc);
-#ifdef GEN_TRACE
-        if (tracing) {
-            int insn_ticks;
-
-            trace_add_insn( insn_wrap_thumb(insn), 1 /* thumb insn */ );
-            insn_ticks = get_insn_ticks_thumb(insn);
-            gen_op_trace_insn();
-            gen_op_add_to_sim_time(insn_ticks);
-        }
-#endif
-        offset |= insn & 0x7ff;
-
-        val = (uint32_t)s->pc + 2;
-        gen_op_movl_T1_im(val | 1);
-        gen_movl_reg_T1(s, 14);
-
-        val += offset << 1;
-        if (insn & (1 << 12)) {
-            /* bl */
-            gen_jmp(s, val);
-        } else {
-            /* blx */
-            val &= ~(uint32_t)2;
-            gen_op_movl_T0_im(val);
-            gen_bx(s);
-        }
+        if (disas_thumb2_insn(env, s, insn))
+            goto undef32;
+        break;
     }
     return;
+undef32:
+    gen_set_condexec(s);
+    gen_set_pc_im(s->pc - 4);
+    gen_exception(EXCP_UDEF);
+    s->is_jmp = DISAS_JUMP;
+    return;
+illegal_op:
 undef:
-    gen_op_movl_T0_im((long)s->pc - 2);
-    gen_op_movl_reg_TN[0][15]();
-    gen_op_undef_insn();
+    gen_set_condexec(s);
+    gen_set_pc_im(s->pc - 2);
+    gen_exception(EXCP_UDEF);
     s->is_jmp = DISAS_JUMP;
 }
 
 /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
    basic block 'tb'. If search_pc is TRUE, also generate PC
    information for each intermediate instruction. */
-static inline int gen_intermediate_code_internal(CPUState *env,
-                                                 TranslationBlock *tb,
-                                                 int search_pc)
+static inline void gen_intermediate_code_internal(CPUState *env,
+                                                  TranslationBlock *tb,
+                                                  int search_pc)
 {
     DisasContext dc1, *dc = &dc1;
     uint16_t *gen_opc_end;
     int j, lj;
     target_ulong pc_start;
     uint32_t next_page_start;
+    int num_insns;
+    int max_insns;
 
     /* generate intermediate code */
+    num_temps = 0;
+    memset(temps, 0, sizeof(temps));
+
     pc_start = tb->pc;
 
     dc->tb = tb;
 
-    gen_opc_ptr = gen_opc_buf;
     gen_opc_end = gen_opc_buf + OPC_MAX_SIZE;
-    gen_opparam_ptr = gen_opparam_buf;
 
     dc->is_jmp = DISAS_NEXT;
     dc->pc = pc_start;
     dc->singlestep_enabled = env->singlestep_enabled;
     dc->condjmp = 0;
     dc->thumb = env->thumb;
+    dc->condexec_mask = (env->condexec_bits & 0xf) << 1;
+    dc->condexec_cond = env->condexec_bits >> 4;
+    dc->is_mem = 0;
 #if !defined(CONFIG_USER_ONLY)
-    dc->user = (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_USR;
+    if (IS_M(env)) {
+        dc->user = ((env->v7m.exception == 0) && (env->v7m.control & 1));
+    } else {
+        dc->user = (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_USR;
+    }
 #endif
+    cpu_F0s = tcg_temp_new(TCG_TYPE_I32);
+    cpu_F1s = tcg_temp_new(TCG_TYPE_I32);
+    cpu_F0d = tcg_temp_new(TCG_TYPE_I64);
+    cpu_F1d = tcg_temp_new(TCG_TYPE_I64);
+    cpu_V0 = cpu_F0d;
+    cpu_V1 = cpu_F1d;
+    /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
+    cpu_M0 = tcg_temp_new(TCG_TYPE_I64);
     next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
-    nb_gen_labels = 0;
     lj = -1;
-#ifdef GEN_TRACE
+    num_insns = 0;
+    max_insns = tb->cflags & CF_COUNT_MASK;
+    if (max_insns == 0)
+        max_insns = CF_COUNT_MASK;
+
+    gen_icount_start();
+    /* Reset the conditional execution bits immediately. This avoids
+       complications trying to do it at the end of the block.  */
+    if (env->condexec_bits)
+      {
+        TCGv tmp = new_tmp();
+        tcg_gen_movi_i32(tmp, 0);
+        store_cpu_field(tmp, condexec_bits);
+      }
+#ifdef CONFIG_TRACE
     if (tracing) {
-        gen_op_trace_bb(trace_static.bb_num, (long) tb);
+        gen_traceBB(trace_static.bb_num, (target_phys_addr_t)tb );
         trace_bb_start(dc->pc);
     }
 #endif
+
     do {
+#ifdef CONFIG_USER_ONLY
+        /* Intercept jump to the magic kernel page.  */
+        if (dc->pc >= 0xffff0000) {
+            /* We always get here via a jump, so know we are not in a
+               conditional execution block.  */
+            gen_exception(EXCP_KERNEL_TRAP);
+            dc->is_jmp = DISAS_UPDATE;
+            break;
+        }
+#else
+        if (dc->pc >= 0xfffffff0 && IS_M(env)) {
+            /* We always get here via a jump, so know we are not in a
+               conditional execution block.  */
+            gen_exception(EXCP_EXCEPTION_EXIT);
+            dc->is_jmp = DISAS_UPDATE;
+            break;
+        }
+#endif
+
         if (env->nb_breakpoints > 0) {
             for(j = 0; j < env->nb_breakpoints; j++) {
                 if (env->breakpoints[j] == dc->pc) {
-                    gen_op_movl_T0_im((long)dc->pc);
-                    gen_op_movl_reg_TN[0][15]();
-                    gen_op_debug();
+                    gen_set_condexec(dc);
+                    gen_set_pc_im(dc->pc);
+                    gen_exception(EXCP_DEBUG);
                     dc->is_jmp = DISAS_JUMP;
+                    /* Advance PC so that clearing the breakpoint will
+                       invalidate this TB.  */
+                    dc->pc += 2;
+                    goto done_generating;
                     break;
                 }
             }
@@ -2515,46 +8742,101 @@ static inline int gen_intermediate_code_internal(CPUState *env,
             }
             gen_opc_pc[lj] = dc->pc;
             gen_opc_instr_start[lj] = 1;
+            gen_opc_icount[lj] = num_insns;
         }
 
-        if (env->thumb)
-          disas_thumb_insn(dc);
-        else
-          disas_arm_insn(env, dc);
+        if (num_insns + 1 == max_insns && (tb->cflags & CF_LAST_IO))
+            gen_io_start();
+
+        if (env->thumb) {
+            disas_thumb_insn(env, dc);
+            if (dc->condexec_mask) {
+                dc->condexec_cond = (dc->condexec_cond & 0xe)
+                                   | ((dc->condexec_mask >> 4) & 1);
+                dc->condexec_mask = (dc->condexec_mask << 1) & 0x1f;
+                if (dc->condexec_mask == 0) {
+                    dc->condexec_cond = 0;
+                }
+            }
+        } else {
+            disas_arm_insn(env, dc);
+        }
+        if (num_temps) {
+            fprintf(stderr, "Internal resource leak before %08x\n", dc->pc);
+            num_temps = 0;
+        }
 
         if (dc->condjmp && !dc->is_jmp) {
             gen_set_label(dc->condlabel);
             dc->condjmp = 0;
         }
+        /* Terminate the TB on memory ops if watchpoints are present.  */
+        /* FIXME: This should be replacd by the deterministic execution
+         * IRQ raising bits.  */
+        if (dc->is_mem && env->nb_watchpoints)
+            break;
+
         /* Translation stops when a conditional branch is enoutered.
          * Otherwise the subsequent code could get translated several times.
          * Also stop translation when a page boundary is reached.  This
-         * ensures prefech aborts occur at the right place.  */
+         * ensures prefetch aborts occur at the right place.  */
+        num_insns ++;
     } while (!dc->is_jmp && gen_opc_ptr < gen_opc_end &&
              !env->singlestep_enabled &&
-             dc->pc < next_page_start);
-#ifdef GEN_TRACE
+             dc->pc < next_page_start &&
+             num_insns < max_insns);
+
+#ifdef CONFIG_TRACE
     if (tracing) {
         trace_bb_end();
     }
 #endif
 
+    if (tb->cflags & CF_LAST_IO) {
+        if (dc->condjmp) {
+            /* FIXME:  This can theoretically happen with self-modifying
+               code.  */
+            cpu_abort(env, "IO on conditional branch instruction");
+        }
+        gen_io_end();
+    }
+
     /* At this stage dc->condjmp will only be set when the skipped
-     * instruction was a conditional branch, and the PC has already been
-     * written.  */
-    if (__builtin_expect(env->singlestep_enabled, 0)) {
+       instruction was a conditional branch or trap, and the PC has
+       already been written.  */
+    if (unlikely(env->singlestep_enabled)) {
         /* Make sure the pc is updated, and raise a debug exception.  */
         if (dc->condjmp) {
-            gen_op_debug();
+            gen_set_condexec(dc);
+            if (dc->is_jmp == DISAS_SWI) {
+                gen_exception(EXCP_SWI);
+            } else {
+                gen_exception(EXCP_DEBUG);
+            }
             gen_set_label(dc->condlabel);
         }
         if (dc->condjmp || !dc->is_jmp) {
-            gen_op_movl_T0_im((long)dc->pc);
-            gen_op_movl_reg_TN[0][15]();
+            gen_set_pc_im(dc->pc);
             dc->condjmp = 0;
         }
-        gen_op_debug();
+        gen_set_condexec(dc);
+        if (dc->is_jmp == DISAS_SWI && !dc->condjmp) {
+            gen_exception(EXCP_SWI);
+        } else {
+            /* FIXME: Single stepping a WFI insn will not halt
+               the CPU.  */
+            gen_exception(EXCP_DEBUG);
+        }
     } else {
+        /* While branches must always occur at the end of an IT block,
+           there are a few other things that can cause us to terminate
+           the TB in the middel of an IT block:
+            - Exception generating instructions (bkpt, swi, undefined).
+            - Page boundaries.
+            - Hardware watchpoints.
+           Hardware breakpoints have already been handled and skip this code.
+         */
+        gen_set_condexec(dc);
         switch(dc->is_jmp) {
         case DISAS_NEXT:
             gen_goto_tb(dc, 1, dc->pc);
@@ -2563,19 +8845,28 @@ static inline int gen_intermediate_code_internal(CPUState *env,
         case DISAS_JUMP:
         case DISAS_UPDATE:
             /* indicate that the hash table must be used to find the next TB */
-            gen_op_movl_T0_0();
-            gen_op_exit_tb();
+            tcg_gen_exit_tb(0);
             break;
         case DISAS_TB_JUMP:
             /* nothing more to generate */
             break;
+        case DISAS_WFI:
+            gen_helper_wfi();
+            break;
+        case DISAS_SWI:
+            gen_exception(EXCP_SWI);
+            break;
         }
         if (dc->condjmp) {
             gen_set_label(dc->condlabel);
+            gen_set_condexec(dc);
             gen_goto_tb(dc, 1, dc->pc);
             dc->condjmp = 0;
         }
     }
+
+done_generating:
+    gen_icount_end(tb, num_insns);
     *gen_opc_ptr = INDEX_op_end;
 
 #ifdef DEBUG_DISAS
@@ -2584,11 +8875,6 @@ static inline int gen_intermediate_code_internal(CPUState *env,
         fprintf(logfile, "IN: %s\n", lookup_symbol(pc_start));
         target_disas(logfile, pc_start, dc->pc - pc_start, env->thumb);
         fprintf(logfile, "\n");
-        if (loglevel & (CPU_LOG_TB_OP)) {
-            fprintf(logfile, "OP:\n");
-            dump_ops(gen_opc_buf, gen_opparam_buf);
-            fprintf(logfile, "\n");
-        }
     }
 #endif
     if (search_pc) {
@@ -2596,74 +8882,45 @@ static inline int gen_intermediate_code_internal(CPUState *env,
         lj++;
         while (lj <= j)
             gen_opc_instr_start[lj++] = 0;
-        tb->size = 0;
     } else {
         tb->size = dc->pc - pc_start;
+        tb->icount = num_insns;
     }
-    return 0;
-}
-
-#if defined(GEN_TRACE)
-static int trace_gen_intermediate_code(CPUState *env, TranslationBlock *tb)
-{
-    return gen_intermediate_code_internal(env, tb, 0);
-}
-
-static int trace_gen_intermediate_code_pc(CPUState *env, TranslationBlock *tb)
-{
-    return gen_intermediate_code_internal(env, tb, 1);
 }
 
-void  qemu_trace_enable(void)
-{
-    _gen_intermediate_code    = trace_gen_intermediate_code;
-    _gen_intermediate_code_pc = trace_gen_intermediate_code_pc;
-}
-#else
-
-static int default_gen_intermediate_code(CPUState *env, TranslationBlock *tb)
+void gen_intermediate_code(CPUState *env, TranslationBlock *tb)
 {
-    return gen_intermediate_code_internal(env, tb, 0);
+    gen_intermediate_code_internal(env, tb, 0);
 }
 
-static int default_gen_intermediate_code_pc(CPUState *env, TranslationBlock *tb)
+void gen_intermediate_code_pc(CPUState *env, TranslationBlock *tb)
 {
-    return gen_intermediate_code_internal(env, tb, 1);
+    gen_intermediate_code_internal(env, tb, 1);
 }
 
-gen_intermediate_code_func   _gen_intermediate_code    = default_gen_intermediate_code;
-gen_intermediate_code_func   _gen_intermediate_code_pc = default_gen_intermediate_code_pc;
-
-int gen_intermediate_code(CPUState *env, TranslationBlock *tb)
-{
-    return (*_gen_intermediate_code)(env, tb);
-}
-
-int gen_intermediate_code_pc(CPUState *env, TranslationBlock *tb)
-{
-    return (*_gen_intermediate_code_pc)(env, tb);
-}
-
-void  qemu_trace_disable( void )
-{
-    _gen_intermediate_code    = default_gen_intermediate_code;
-    _gen_intermediate_code_pc = default_gen_intermediate_code_pc;
-}
-
-static const char * const cpu_mode_names[16] = {
+static const char *cpu_mode_names[16] = {
   "usr", "fiq", "irq", "svc", "???", "???", "???", "abt",
   "???", "???", "???", "und", "???", "???", "???", "sys"
 };
+
 void cpu_dump_state(CPUState *env, FILE *f,
                     int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
                     int flags)
 {
     int i;
+#if 0
     union {
         uint32_t i;
         float s;
     } s0, s1;
     CPU_DoubleU d;
+    /* ??? This assumes float64 and double have the same layout.
+       Oh well, it's only debug dumps.  */
+    union {
+        float64 f64;
+        double d;
+    } d0;
+#endif
     uint32_t psr;
 
     for(i=0;i<16;i++) {
@@ -2674,7 +8931,7 @@ void cpu_dump_state(CPUState *env, FILE *f,
             cpu_fprintf(f, " ");
     }
     psr = cpsr_read(env);
-    cpu_fprintf(f, "PSR=%08x %c%c%c%c %c %s%d %x\n",
+    cpu_fprintf(f, "PSR=%08x %c%c%c%c %c %s%d\n",
                 psr,
                 psr & (1 << 31) ? 'N' : '-',
                 psr & (1 << 30) ? 'Z' : '-',
@@ -2683,17 +8940,24 @@ void cpu_dump_state(CPUState *env, FILE *f,
                 psr & CPSR_T ? 'T' : 'A',
                 cpu_mode_names[psr & 0xf], (psr & 0x10) ? 32 : 26);
 
+#if 0
     for (i = 0; i < 16; i++) {
         d.d = env->vfp.regs[i];
         s0.i = d.l.lower;
         s1.i = d.l.upper;
-        cpu_fprintf(f, "s%02d=%08x(%8f) s%02d=%08x(%8f) d%02d=%08x%08x(%8f)\n",
+        d0.f64 = d.d;
+        cpu_fprintf(f, "s%02d=%08x(%8g) s%02d=%08x(%8g) d%02d=%08x%08x(%8g)\n",
                     i * 2, (int)s0.i, s0.s,
-                    i * 2 + 1, (int)s0.i, s0.s,
+                    i * 2 + 1, (int)s1.i, s1.s,
                     i, (int)(uint32_t)d.l.upper, (int)(uint32_t)d.l.lower,
-                    d.d);
+                    d0.d);
     }
     cpu_fprintf(f, "FPSCR: %08x\n", (int)env->vfp.xregs[ARM_VFP_FPSCR]);
+#endif
 }
 
-#endif
+void gen_pc_load(CPUState *env, TranslationBlock *tb,
+                unsigned long searched_pc, int pc_pos, void *puc)
+{
+    env->regs[15] = gen_opc_pc[pc_pos];
+}
diff --git a/tcg/LICENSE b/tcg/LICENSE
new file mode 100644
index 0000000..be817fa
--- /dev/null
+++ b/tcg/LICENSE
@@ -0,0 +1,3 @@
+All the files in this directory and subdirectories are released under
+a BSD like license (see header in each file). No other license is
+accepted.
diff --git a/tcg/README b/tcg/README
new file mode 100644
index 0000000..b03432e
--- /dev/null
+++ b/tcg/README
@@ -0,0 +1,425 @@
+Tiny Code Generator - Fabrice Bellard.
+
+1) Introduction
+
+TCG (Tiny Code Generator) began as a generic backend for a C
+compiler. It was simplified to be used in QEMU. It also has its roots
+in the QOP code generator written by Paul Brook. 
+
+2) Definitions
+
+The TCG "target" is the architecture for which we generate the
+code. It is of course not the same as the "target" of QEMU which is
+the emulated architecture. As TCG started as a generic C backend used
+for cross compiling, it is assumed that the TCG target is different
+from the host, although it is never the case for QEMU.
+
+A TCG "function" corresponds to a QEMU Translated Block (TB).
+
+A TCG "temporary" is a variable only live in a basic
+block. Temporaries are allocated explicitly in each function.
+
+A TCG "local temporary" is a variable only live in a function. Local
+temporaries are allocated explicitly in each function.
+
+A TCG "global" is a variable which is live in all the functions
+(equivalent of a C global variable). They are defined before the
+functions defined. A TCG global can be a memory location (e.g. a QEMU
+CPU register), a fixed host register (e.g. the QEMU CPU state pointer)
+or a memory location which is stored in a register outside QEMU TBs
+(not implemented yet).
+
+A TCG "basic block" corresponds to a list of instructions terminated
+by a branch instruction. 
+
+3) Intermediate representation
+
+3.1) Introduction
+
+TCG instructions operate on variables which are temporaries, local
+temporaries or globals. TCG instructions and variables are strongly
+typed. Two types are supported: 32 bit integers and 64 bit
+integers. Pointers are defined as an alias to 32 bit or 64 bit
+integers depending on the TCG target word size.
+
+Each instruction has a fixed number of output variable operands, input
+variable operands and always constant operands.
+
+The notable exception is the call instruction which has a variable
+number of outputs and inputs.
+
+In the textual form, output operands usually come first, followed by
+input operands, followed by constant operands. The output type is
+included in the instruction name. Constants are prefixed with a '$'.
+
+add_i32 t0, t1, t2  (t0 <- t1 + t2)
+
+3.2) Assumptions
+
+* Basic blocks
+
+- Basic blocks end after branches (e.g. brcond_i32 instruction),
+  goto_tb and exit_tb instructions.
+- Basic blocks end before legacy dyngen operations.
+- Basic blocks start after the end of a previous basic block, at a
+  set_label instruction or after a legacy dyngen operation.
+
+After the end of a basic block, the content of temporaries is
+destroyed, but local temporaries and globals are preserved.
+
+* Floating point types are not supported yet
+
+* Pointers: depending on the TCG target, pointer size is 32 bit or 64
+  bit. The type TCG_TYPE_PTR is an alias to TCG_TYPE_I32 or
+  TCG_TYPE_I64.
+
+* Helpers:
+
+Using the tcg_gen_helper_x_y it is possible to call any function
+taking i32, i64 or pointer types. Before calling an helper, all
+globals are stored at their canonical location and it is assumed that
+the function can modify them. In the future, function modifiers will
+be allowed to tell that the helper does not read or write some globals.
+
+On some TCG targets (e.g. x86), several calling conventions are
+supported.
+
+* Branches:
+
+Use the instruction 'br' to jump to a label. Use 'jmp' to jump to an
+explicit address. Conditional branches can only jump to labels.
+
+3.3) Code Optimizations
+
+When generating instructions, you can count on at least the following
+optimizations:
+
+- Single instructions are simplified, e.g.
+
+   and_i32 t0, t0, $0xffffffff
+    
+  is suppressed.
+
+- A liveness analysis is done at the basic block level. The
+  information is used to suppress moves from a dead variable to
+  another one. It is also used to remove instructions which compute
+  dead results. The later is especially useful for condition code
+  optimization in QEMU.
+
+  In the following example:
+
+  add_i32 t0, t1, t2
+  add_i32 t0, t0, $1
+  mov_i32 t0, $1
+
+  only the last instruction is kept.
+
+3.4) Instruction Reference
+
+********* Function call
+
+* call <ret> <params> ptr
+
+call function 'ptr' (pointer type)
+
+<ret> optional 32 bit or 64 bit return value
+<params> optional 32 bit or 64 bit parameters
+
+********* Jumps/Labels
+
+* jmp t0
+
+Absolute jump to address t0 (pointer type).
+
+* set_label $label
+
+Define label 'label' at the current program point.
+
+* br $label
+
+Jump to label.
+
+* brcond_i32/i64 cond, t0, t1, label
+
+Conditional jump if t0 cond t1 is true. cond can be:
+    TCG_COND_EQ
+    TCG_COND_NE
+    TCG_COND_LT /* signed */
+    TCG_COND_GE /* signed */
+    TCG_COND_LE /* signed */
+    TCG_COND_GT /* signed */
+    TCG_COND_LTU /* unsigned */
+    TCG_COND_GEU /* unsigned */
+    TCG_COND_LEU /* unsigned */
+    TCG_COND_GTU /* unsigned */
+
+********* Arithmetic
+
+* add_i32/i64 t0, t1, t2
+
+t0=t1+t2
+
+* sub_i32/i64 t0, t1, t2
+
+t0=t1-t2
+
+* neg_i32/i64 t0, t1
+
+t0=-t1 (two's complement)
+
+* mul_i32/i64 t0, t1, t2
+
+t0=t1*t2
+
+* div_i32/i64 t0, t1, t2
+
+t0=t1/t2 (signed). Undefined behavior if division by zero or overflow.
+
+* divu_i32/i64 t0, t1, t2
+
+t0=t1/t2 (unsigned). Undefined behavior if division by zero.
+
+* rem_i32/i64 t0, t1, t2
+
+t0=t1%t2 (signed). Undefined behavior if division by zero or overflow.
+
+* remu_i32/i64 t0, t1, t2
+
+t0=t1%t2 (unsigned). Undefined behavior if division by zero.
+
+********* Logical
+
+* and_i32/i64 t0, t1, t2
+
+t0=t1&t2
+
+* or_i32/i64 t0, t1, t2
+
+t0=t1|t2
+
+* xor_i32/i64 t0, t1, t2
+
+t0=t1^t2
+
+* not_i32/i64 t0, t1
+
+t0=~t1
+
+********* Shifts
+
+* shl_i32/i64 t0, t1, t2
+
+t0=t1 << t2. Undefined behavior if t2 < 0 or t2 >= 32 (resp 64)
+
+* shr_i32/i64 t0, t1, t2
+
+t0=t1 >> t2 (unsigned). Undefined behavior if t2 < 0 or t2 >= 32 (resp 64)
+
+* sar_i32/i64 t0, t1, t2
+
+t0=t1 >> t2 (signed). Undefined behavior if t2 < 0 or t2 >= 32 (resp 64)
+
+********* Misc
+
+* mov_i32/i64 t0, t1
+
+t0 = t1
+
+Move t1 to t0 (both operands must have the same type).
+
+* ext8s_i32/i64 t0, t1
+ext8u_i32/i64 t0, t1
+ext16s_i32/i64 t0, t1
+ext16u_i32/i64 t0, t1
+ext32s_i64 t0, t1
+ext32u_i64 t0, t1
+
+8, 16 or 32 bit sign/zero extension (both operands must have the same type)
+
+* bswap16_i32 t0, t1
+
+16 bit byte swap on a 32 bit value. The two high order bytes must be set
+to zero.
+
+* bswap_i32 t0, t1
+
+32 bit byte swap
+
+* bswap_i64 t0, t1
+
+64 bit byte swap
+
+* discard_i32/i64 t0
+
+Indicate that the value of t0 won't be used later. It is useful to
+force dead code elimination.
+
+********* Type conversions
+
+* ext_i32_i64 t0, t1
+Convert t1 (32 bit) to t0 (64 bit) and does sign extension
+
+* extu_i32_i64 t0, t1
+Convert t1 (32 bit) to t0 (64 bit) and does zero extension
+
+* trunc_i64_i32 t0, t1
+Truncate t1 (64 bit) to t0 (32 bit)
+
+********* Load/Store
+
+* ld_i32/i64 t0, t1, offset
+ld8s_i32/i64 t0, t1, offset
+ld8u_i32/i64 t0, t1, offset
+ld16s_i32/i64 t0, t1, offset
+ld16u_i32/i64 t0, t1, offset
+ld32s_i64 t0, t1, offset
+ld32u_i64 t0, t1, offset
+
+t0 = read(t1 + offset)
+Load 8, 16, 32 or 64 bits with or without sign extension from host memory. 
+offset must be a constant.
+
+* st_i32/i64 t0, t1, offset
+st8_i32/i64 t0, t1, offset
+st16_i32/i64 t0, t1, offset
+st32_i64 t0, t1, offset
+
+write(t0, t1 + offset)
+Write 8, 16, 32 or 64 bits to host memory.
+
+********* QEMU specific operations
+
+* tb_exit t0
+
+Exit the current TB and return the value t0 (word type).
+
+* goto_tb index
+
+Exit the current TB and jump to the TB index 'index' (constant) if the
+current TB was linked to this TB. Otherwise execute the next
+instructions.
+
+* qemu_ld_i32/i64 t0, t1, flags
+qemu_ld8u_i32/i64 t0, t1, flags
+qemu_ld8s_i32/i64 t0, t1, flags
+qemu_ld16u_i32/i64 t0, t1, flags
+qemu_ld16s_i32/i64 t0, t1, flags
+qemu_ld32u_i64 t0, t1, flags
+qemu_ld32s_i64 t0, t1, flags
+
+Load data at the QEMU CPU address t1 into t0. t1 has the QEMU CPU
+address type. 'flags' contains the QEMU memory index (selects user or
+kernel access) for example.
+
+* qemu_st_i32/i64 t0, t1, flags
+qemu_st8_i32/i64 t0, t1, flags
+qemu_st16_i32/i64 t0, t1, flags
+qemu_st32_i64 t0, t1, flags
+
+Store the data t0 at the QEMU CPU Address t1. t1 has the QEMU CPU
+address type. 'flags' contains the QEMU memory index (selects user or
+kernel access) for example.
+
+Note 1: Some shortcuts are defined when the last operand is known to be
+a constant (e.g. addi for add, movi for mov).
+
+Note 2: When using TCG, the opcodes must never be generated directly
+as some of them may not be available as "real" opcodes. Always use the
+function tcg_gen_xxx(args).
+
+4) Backend
+
+tcg-target.h contains the target specific definitions. tcg-target.c
+contains the target specific code.
+
+4.1) Assumptions
+
+The target word size (TCG_TARGET_REG_BITS) is expected to be 32 bit or
+64 bit. It is expected that the pointer has the same size as the word.
+
+On a 32 bit target, all 64 bit operations are converted to 32 bits. A
+few specific operations must be implemented to allow it (see add2_i32,
+sub2_i32, brcond2_i32).
+
+Floating point operations are not supported in this version. A
+previous incarnation of the code generator had full support of them,
+but it is better to concentrate on integer operations first.
+
+On a 64 bit target, no assumption is made in TCG about the storage of
+the 32 bit values in 64 bit registers.
+
+4.2) Constraints
+
+GCC like constraints are used to define the constraints of every
+instruction. Memory constraints are not supported in this
+version. Aliases are specified in the input operands as for GCC.
+
+A target can define specific register or constant constraints. If an
+operation uses a constant input constraint which does not allow all
+constants, it must also accept registers in order to have a fallback.
+
+The movi_i32 and movi_i64 operations must accept any constants.
+
+The mov_i32 and mov_i64 operations must accept any registers of the
+same type.
+
+The ld/st instructions must accept signed 32 bit constant offsets. It
+can be implemented by reserving a specific register to compute the
+address if the offset is too big.
+
+The ld/st instructions must accept any destination (ld) or source (st)
+register.
+
+4.3) Function call assumptions
+
+- The only supported types for parameters and return value are: 32 and
+  64 bit integers and pointer.
+- The stack grows downwards.
+- The first N parameters are passed in registers.
+- The next parameters are passed on the stack by storing them as words.
+- Some registers are clobbered during the call. 
+- The function can return 0 or 1 value in registers. On a 32 bit
+  target, functions must be able to return 2 values in registers for
+  64 bit return type.
+
+5) Migration from dyngen to TCG
+
+TCG is backward compatible with QEMU "dyngen" operations. It means
+that TCG instructions can be freely mixed with dyngen operations. It
+is expected that QEMU targets will be progressively fully converted to
+TCG. Once a target is fully converted to TCG, it will be possible
+to apply more optimizations because more registers will be free for
+the generated code.
+
+The exception model is the same as the dyngen one.
+
+6) Recommended coding rules for best performance
+
+- Use globals to represent the parts of the QEMU CPU state which are
+  often modified, e.g. the integer registers and the condition
+  codes. TCG will be able to use host registers to store them.
+
+- Avoid globals stored in fixed registers. They must be used only to
+  store the pointer to the CPU state and possibly to store a pointer
+  to a register window. The other uses are to ensure backward
+  compatibility with dyngen during the porting a new target to TCG.
+
+- Use temporaries. Use local temporaries only when really needed,
+  e.g. when you need to use a value after a jump. Local temporaries
+  introduce a performance hit in the current TCG implementation: their
+  content is saved to memory at end of each basic block.
+
+- Free temporaries and local temporaries when they are no longer used
+  (tcg_temp_free). Since tcg_const_x() also creates a temporary, you
+  should free it after it is used. Freeing temporaries does not yield
+  a better generated code, but it reduces the memory usage of TCG and
+  the speed of the translation.
+
+- Don't hesitate to use helpers for complicated or seldom used target
+  intructions. There is little performance advantage in using TCG to
+  implement target instructions taking more than about twenty TCG
+  instructions.
+
+- Use the 'discard' instruction if you know that TCG won't be able to
+  prove that a given global is "dead" at a given program point. The
+  x86 target uses it to improve the condition codes optimisation.
diff --git a/tcg/TODO b/tcg/TODO
new file mode 100644
index 0000000..5ca35e9
--- /dev/null
+++ b/tcg/TODO
@@ -0,0 +1,15 @@
+- Add new instructions such as: andnot, ror, rol, setcond, clz, ctz,
+  popcnt.
+
+- See if it is worth exporting mul2, mulu2, div2, divu2. 
+
+- Support of globals saved in fixed registers between TBs.
+
+Ideas:
+
+- Move the slow part of the qemu_ld/st ops after the end of the TB.
+
+- Change exception syntax to get closer to QOP system (exception
+  parameters given with a specific instruction).
+
+- Add float and vector support.
diff --git a/tcg/arm/tcg-target.c b/tcg/arm/tcg-target.c
new file mode 100644
index 0000000..dee1ebc
--- /dev/null
+++ b/tcg/arm/tcg-target.c
@@ -0,0 +1,1584 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Andrzej Zaborowski
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+const char *tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+    "%r0",
+    "%r1",
+    "%r2",
+    "%r3",
+    "%r4",
+    "%r5",
+    "%r6",
+    "%r7",
+    "%r8",
+    "%r9",
+    "%r10",
+    "%r11",
+    "%r12",
+    "%r13",
+    "%r14",
+};
+
+int tcg_target_reg_alloc_order[] = {
+    TCG_REG_R0,
+    TCG_REG_R1,
+    TCG_REG_R2,
+    TCG_REG_R3,
+    TCG_REG_R4,
+    TCG_REG_R5,
+    TCG_REG_R6,
+    TCG_REG_R7,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10,
+    TCG_REG_R11,
+    TCG_REG_R12,
+    TCG_REG_R13,
+    TCG_REG_R14,
+};
+
+const int tcg_target_call_iarg_regs[4] = {
+    TCG_REG_R0, TCG_REG_R1, TCG_REG_R2, TCG_REG_R3
+};
+const int tcg_target_call_oarg_regs[2] = {
+    TCG_REG_R0, TCG_REG_R1
+};
+
+static void patch_reloc(uint8_t *code_ptr, int type,
+                tcg_target_long value, tcg_target_long addend)
+{
+    switch (type) {
+    case R_ARM_ABS32:
+        *(uint32_t *) code_ptr = value;
+        break;
+
+    case R_ARM_CALL:
+    case R_ARM_JUMP24:
+    default:
+        tcg_abort();
+
+    case R_ARM_PC24:
+        *(uint32_t *) code_ptr = ((*(uint32_t *) code_ptr) & 0xff000000) |
+                (((value - ((tcg_target_long) code_ptr + 8)) >> 2) & 0xffffff);
+        break;
+    }
+}
+
+/* maximum number of register used for input function arguments */
+static inline int tcg_target_get_call_iarg_regs_count(int flags)
+{
+    return 4;
+}
+
+/* parse target specific constraints */
+int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+{
+    const char *ct_str;
+
+    ct_str = *pct_str;
+    switch (ct_str[0]) {
+    case 'r':
+#ifndef CONFIG_SOFTMMU
+    case 'd':
+    case 'D':
+    case 'x':
+    case 'X':
+#endif
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, (1 << TCG_TARGET_NB_REGS) - 1);
+        break;
+
+#ifdef CONFIG_SOFTMMU
+    /* qemu_ld/st inputs (unless 'X', 'd' or 'D') */
+    case 'x':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, (1 << TCG_TARGET_NB_REGS) - 1);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+        break;
+
+    /* qemu_ld64 data_reg */
+    case 'd':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, (1 << TCG_TARGET_NB_REGS) - 1);
+        /* r1 is still needed to load data_reg2, so don't use it.  */
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+        break;
+
+    /* qemu_ld/st64 data_reg2 */
+    case 'D':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, (1 << TCG_TARGET_NB_REGS) - 1);
+        /* r0, r1 and optionally r2 will be overwritten by the address
+         * and the low word of data, so don't use these.  */
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+# if TARGET_LONG_BITS == 64
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R2);
+# endif
+        break;
+
+# if TARGET_LONG_BITS == 64
+    /* qemu_ld/st addr_reg2 */
+    case 'X':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, (1 << TCG_TARGET_NB_REGS) - 1);
+        /* r0 will be overwritten by the low word of base, so don't use it.  */
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+        break;
+# endif
+#endif
+
+    case '1':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, (1 << TCG_TARGET_NB_REGS) - 1);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
+        break;
+
+    case '2':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, (1 << TCG_TARGET_NB_REGS) - 1);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R0);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R1);
+        break;
+
+    default:
+        return -1;
+    }
+    ct_str++;
+    *pct_str = ct_str;
+
+    return 0;
+}
+
+/* Test if a constant matches the constraint.
+ * TODO: define constraints for:
+ *
+ * ldr/str offset:   between -0xfff and 0xfff
+ * ldrh/strh offset: between -0xff and 0xff
+ * mov operand2:     values represented with x << (2 * y), x < 0x100
+ * add, sub, eor...: ditto
+ */
+static inline int tcg_target_const_match(tcg_target_long val,
+                const TCGArgConstraint *arg_ct)
+{
+    int ct;
+    ct = arg_ct->ct;
+    if (ct & TCG_CT_CONST)
+        return 1;
+    else
+        return 0;
+}
+
+enum arm_data_opc_e {
+    ARITH_AND = 0x0,
+    ARITH_EOR = 0x1,
+    ARITH_SUB = 0x2,
+    ARITH_RSB = 0x3,
+    ARITH_ADD = 0x4,
+    ARITH_ADC = 0x5,
+    ARITH_SBC = 0x6,
+    ARITH_RSC = 0x7,
+    ARITH_TST = 0x8,
+    ARITH_CMP = 0xa,
+    ARITH_CMN = 0xb,
+    ARITH_ORR = 0xc,
+    ARITH_MOV = 0xd,
+    ARITH_BIC = 0xe,
+    ARITH_MVN = 0xf,
+};
+
+#define TO_CPSR(opc) \
+  ((opc == ARITH_CMP || opc == ARITH_CMN || opc == ARITH_TST) << 20)
+
+#define SHIFT_IMM_LSL(im)	(((im) << 7) | 0x00)
+#define SHIFT_IMM_LSR(im)	(((im) << 7) | 0x20)
+#define SHIFT_IMM_ASR(im)	(((im) << 7) | 0x40)
+#define SHIFT_IMM_ROR(im)	(((im) << 7) | 0x60)
+#define SHIFT_REG_LSL(rs)	(((rs) << 8) | 0x10)
+#define SHIFT_REG_LSR(rs)	(((rs) << 8) | 0x30)
+#define SHIFT_REG_ASR(rs)	(((rs) << 8) | 0x50)
+#define SHIFT_REG_ROR(rs)	(((rs) << 8) | 0x70)
+
+enum arm_cond_code_e {
+    COND_EQ = 0x0,
+    COND_NE = 0x1,
+    COND_CS = 0x2,	/* Unsigned greater or equal */
+    COND_CC = 0x3,	/* Unsigned less than */
+    COND_MI = 0x4,	/* Negative */
+    COND_PL = 0x5,	/* Zero or greater */
+    COND_VS = 0x6,	/* Overflow */
+    COND_VC = 0x7,	/* No overflow */
+    COND_HI = 0x8,	/* Unsigned greater than */
+    COND_LS = 0x9,	/* Unsigned less or equal */
+    COND_GE = 0xa,
+    COND_LT = 0xb,
+    COND_GT = 0xc,
+    COND_LE = 0xd,
+    COND_AL = 0xe,
+};
+
+static const uint8_t tcg_cond_to_arm_cond[10] = {
+    [TCG_COND_EQ] = COND_EQ,
+    [TCG_COND_NE] = COND_NE,
+    [TCG_COND_LT] = COND_LT,
+    [TCG_COND_GE] = COND_GE,
+    [TCG_COND_LE] = COND_LE,
+    [TCG_COND_GT] = COND_GT,
+    /* unsigned */
+    [TCG_COND_LTU] = COND_CC,
+    [TCG_COND_GEU] = COND_CS,
+    [TCG_COND_LEU] = COND_LS,
+    [TCG_COND_GTU] = COND_HI,
+};
+
+static inline void tcg_out_bx(TCGContext *s, int cond, int rn)
+{
+    tcg_out32(s, (cond << 28) | 0x012fff10 | rn);
+}
+
+static inline void tcg_out_b(TCGContext *s, int cond, int32_t offset)
+{
+    tcg_out32(s, (cond << 28) | 0x0a000000 |
+                    (((offset - 8) >> 2) & 0x00ffffff));
+}
+
+static inline void tcg_out_b_noaddr(TCGContext *s, int cond)
+{
+#ifdef WORDS_BIGENDIAN
+    tcg_out8(s, (cond << 4) | 0x0a);
+    s->code_ptr += 3;
+#else
+    s->code_ptr += 3;
+    tcg_out8(s, (cond << 4) | 0x0a);
+#endif
+}
+
+static inline void tcg_out_bl(TCGContext *s, int cond, int32_t offset)
+{
+    tcg_out32(s, (cond << 28) | 0x0b000000 |
+                    (((offset - 8) >> 2) & 0x00ffffff));
+}
+
+static inline void tcg_out_dat_reg(TCGContext *s,
+                int cond, int opc, int rd, int rn, int rm, int shift)
+{
+    tcg_out32(s, (cond << 28) | (0 << 25) | (opc << 21) | TO_CPSR(opc) |
+                    (rn << 16) | (rd << 12) | shift | rm);
+}
+
+static inline void tcg_out_dat_reg2(TCGContext *s,
+                int cond, int opc0, int opc1, int rd0, int rd1,
+                int rn0, int rn1, int rm0, int rm1, int shift)
+{
+    tcg_out32(s, (cond << 28) | (0 << 25) | (opc0 << 21) | (1 << 20) |
+                    (rn0 << 16) | (rd0 << 12) | shift | rm0);
+    tcg_out32(s, (cond << 28) | (0 << 25) | (opc1 << 21) |
+                    (rn1 << 16) | (rd1 << 12) | shift | rm1);
+}
+
+static inline void tcg_out_dat_imm(TCGContext *s,
+                int cond, int opc, int rd, int rn, int im)
+{
+    tcg_out32(s, (cond << 28) | (1 << 25) | (opc << 21) | TO_CPSR(opc) |
+                    (rn << 16) | (rd << 12) | im);
+}
+
+static inline void tcg_out_movi32(TCGContext *s,
+                int cond, int rd, int32_t arg)
+{
+    int offset = (uint32_t) arg - ((uint32_t) s->code_ptr + 8);
+
+    /* TODO: This is very suboptimal, we can easily have a constant
+     * pool somewhere after all the instructions.  */
+
+    if (arg < 0 && arg > -0x100)
+        return tcg_out_dat_imm(s, cond, ARITH_MVN, rd, 0, (~arg) & 0xff);
+
+    if (offset < 0x100 && offset > -0x100)
+        return offset >= 0 ?
+                tcg_out_dat_imm(s, cond, ARITH_ADD, rd, 15, offset) :
+                tcg_out_dat_imm(s, cond, ARITH_SUB, rd, 15, -offset);
+
+    tcg_out_dat_imm(s, cond, ARITH_MOV, rd, 0, arg & 0xff);
+    if (arg & 0x0000ff00)
+        tcg_out_dat_imm(s, cond, ARITH_ORR, rd, rd,
+                        ((arg >>  8) & 0xff) | 0xc00);
+    if (arg & 0x00ff0000)
+        tcg_out_dat_imm(s, cond, ARITH_ORR, rd, rd,
+                        ((arg >> 16) & 0xff) | 0x800);
+    if (arg & 0xff000000)
+        tcg_out_dat_imm(s, cond, ARITH_ORR, rd, rd,
+                        ((arg >> 24) & 0xff) | 0x400);
+}
+
+static inline void tcg_out_mul32(TCGContext *s,
+                int cond, int rd, int rs, int rm)
+{
+    if (rd != rm)
+        tcg_out32(s, (cond << 28) | (rd << 16) | (0 << 12) |
+                        (rs << 8) | 0x90 | rm);
+    else if (rd != rs)
+        tcg_out32(s, (cond << 28) | (rd << 16) | (0 << 12) |
+                        (rm << 8) | 0x90 | rs);
+    else {
+        tcg_out32(s, (cond << 28) | ( 8 << 16) | (0 << 12) |
+                        (rs << 8) | 0x90 | rm);
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        rd, 0, 8, SHIFT_IMM_LSL(0));
+    }
+}
+
+static inline void tcg_out_umull32(TCGContext *s,
+                int cond, int rd0, int rd1, int rs, int rm)
+{
+    if (rd0 != rm && rd1 != rm)
+        tcg_out32(s, (cond << 28) | 0x800090 |
+                        (rd1 << 16) | (rd0 << 12) | (rs << 8) | rm);
+    else if (rd0 != rs && rd1 != rs)
+        tcg_out32(s, (cond << 28) | 0x800090 |
+                        (rd1 << 16) | (rd0 << 12) | (rm << 8) | rs);
+    else {
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        TCG_REG_R8, 0, rm, SHIFT_IMM_LSL(0));
+        tcg_out32(s, (cond << 28) | 0x800098 |
+                        (rd1 << 16) | (rd0 << 12) | (rs << 8));
+    }
+}
+
+static inline void tcg_out_smull32(TCGContext *s,
+                int cond, int rd0, int rd1, int rs, int rm)
+{
+    if (rd0 != rm && rd1 != rm)
+        tcg_out32(s, (cond << 28) | 0xc00090 |
+                        (rd1 << 16) | (rd0 << 12) | (rs << 8) | rm);
+    else if (rd0 != rs && rd1 != rs)
+        tcg_out32(s, (cond << 28) | 0xc00090 |
+                        (rd1 << 16) | (rd0 << 12) | (rm << 8) | rs);
+    else {
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        TCG_REG_R8, 0, rm, SHIFT_IMM_LSL(0));
+        tcg_out32(s, (cond << 28) | 0xc00098 |
+                        (rd1 << 16) | (rd0 << 12) | (rs << 8));
+    }
+}
+
+static inline void tcg_out_ld32_12(TCGContext *s, int cond,
+                int rd, int rn, tcg_target_long im)
+{
+    if (im >= 0)
+        tcg_out32(s, (cond << 28) | 0x05900000 |
+                        (rn << 16) | (rd << 12) | (im & 0xfff));
+    else
+        tcg_out32(s, (cond << 28) | 0x05100000 |
+                        (rn << 16) | (rd << 12) | ((-im) & 0xfff));
+}
+
+static inline void tcg_out_st32_12(TCGContext *s, int cond,
+                int rd, int rn, tcg_target_long im)
+{
+    if (im >= 0)
+        tcg_out32(s, (cond << 28) | 0x05800000 |
+                        (rn << 16) | (rd << 12) | (im & 0xfff));
+    else
+        tcg_out32(s, (cond << 28) | 0x05000000 |
+                        (rn << 16) | (rd << 12) | ((-im) & 0xfff));
+}
+
+static inline void tcg_out_ld32_r(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x07900000 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_st32_r(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x07800000 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+/* Register pre-increment with base writeback.  */
+static inline void tcg_out_ld32_rwb(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x07b00000 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_st32_rwb(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x07a00000 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_ld16u_8(TCGContext *s, int cond,
+                int rd, int rn, tcg_target_long im)
+{
+    if (im >= 0)
+        tcg_out32(s, (cond << 28) | 0x01d000b0 |
+                        (rn << 16) | (rd << 12) |
+                        ((im & 0xf0) << 4) | (im & 0xf));
+    else
+        tcg_out32(s, (cond << 28) | 0x015000b0 |
+                        (rn << 16) | (rd << 12) |
+                        (((-im) & 0xf0) << 4) | ((-im) & 0xf));
+}
+
+static inline void tcg_out_st16u_8(TCGContext *s, int cond,
+                int rd, int rn, tcg_target_long im)
+{
+    if (im >= 0)
+        tcg_out32(s, (cond << 28) | 0x01c000b0 |
+                        (rn << 16) | (rd << 12) |
+                        ((im & 0xf0) << 4) | (im & 0xf));
+    else
+        tcg_out32(s, (cond << 28) | 0x014000b0 |
+                        (rn << 16) | (rd << 12) |
+                        (((-im) & 0xf0) << 4) | ((-im) & 0xf));
+}
+
+static inline void tcg_out_ld16u_r(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x019000b0 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_st16u_r(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x018000b0 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_ld16s_8(TCGContext *s, int cond,
+                int rd, int rn, tcg_target_long im)
+{
+    if (im >= 0)
+        tcg_out32(s, (cond << 28) | 0x01d000f0 |
+                        (rn << 16) | (rd << 12) |
+                        ((im & 0xf0) << 4) | (im & 0xf));
+    else
+        tcg_out32(s, (cond << 28) | 0x015000f0 |
+                        (rn << 16) | (rd << 12) |
+                        (((-im) & 0xf0) << 4) | ((-im) & 0xf));
+}
+
+static inline void tcg_out_st16s_8(TCGContext *s, int cond,
+                int rd, int rn, tcg_target_long im)
+{
+    if (im >= 0)
+        tcg_out32(s, (cond << 28) | 0x01c000f0 |
+                        (rn << 16) | (rd << 12) |
+                        ((im & 0xf0) << 4) | (im & 0xf));
+    else
+        tcg_out32(s, (cond << 28) | 0x014000f0 |
+                        (rn << 16) | (rd << 12) |
+                        (((-im) & 0xf0) << 4) | ((-im) & 0xf));
+}
+
+static inline void tcg_out_ld16s_r(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x019000f0 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_st16s_r(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x018000f0 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_ld8_12(TCGContext *s, int cond,
+                int rd, int rn, tcg_target_long im)
+{
+    if (im >= 0)
+        tcg_out32(s, (cond << 28) | 0x05d00000 |
+                        (rn << 16) | (rd << 12) | (im & 0xfff));
+    else
+        tcg_out32(s, (cond << 28) | 0x05500000 |
+                        (rn << 16) | (rd << 12) | ((-im) & 0xfff));
+}
+
+static inline void tcg_out_st8_12(TCGContext *s, int cond,
+                int rd, int rn, tcg_target_long im)
+{
+    if (im >= 0)
+        tcg_out32(s, (cond << 28) | 0x05c00000 |
+                        (rn << 16) | (rd << 12) | (im & 0xfff));
+    else
+        tcg_out32(s, (cond << 28) | 0x05400000 |
+                        (rn << 16) | (rd << 12) | ((-im) & 0xfff));
+}
+
+static inline void tcg_out_ld8_r(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x07d00000 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_st8_r(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x07c00000 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_ld8s_8(TCGContext *s, int cond,
+                int rd, int rn, tcg_target_long im)
+{
+    if (im >= 0)
+        tcg_out32(s, (cond << 28) | 0x01d000d0 |
+                        (rn << 16) | (rd << 12) |
+                        ((im & 0xf0) << 4) | (im & 0xf));
+    else
+        tcg_out32(s, (cond << 28) | 0x015000d0 |
+                        (rn << 16) | (rd << 12) |
+                        (((-im) & 0xf0) << 4) | ((-im) & 0xf));
+}
+
+static inline void tcg_out_st8s_8(TCGContext *s, int cond,
+                int rd, int rn, tcg_target_long im)
+{
+    if (im >= 0)
+        tcg_out32(s, (cond << 28) | 0x01c000d0 |
+                        (rn << 16) | (rd << 12) |
+                        ((im & 0xf0) << 4) | (im & 0xf));
+    else
+        tcg_out32(s, (cond << 28) | 0x014000d0 |
+                        (rn << 16) | (rd << 12) |
+                        (((-im) & 0xf0) << 4) | ((-im) & 0xf));
+}
+
+static inline void tcg_out_ld8s_r(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x019000d0 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_st8s_r(TCGContext *s, int cond,
+                int rd, int rn, int rm)
+{
+    tcg_out32(s, (cond << 28) | 0x018000d0 |
+                    (rn << 16) | (rd << 12) | rm);
+}
+
+static inline void tcg_out_ld32u(TCGContext *s, int cond,
+                int rd, int rn, int32_t offset)
+{
+    if (offset > 0xfff || offset < -0xfff) {
+        tcg_out_movi32(s, cond, TCG_REG_R8, offset);
+        tcg_out_ld32_r(s, cond, rd, rn, TCG_REG_R8);
+    } else
+        tcg_out_ld32_12(s, cond, rd, rn, offset);
+}
+
+static inline void tcg_out_st32(TCGContext *s, int cond,
+                int rd, int rn, int32_t offset)
+{
+    if (offset > 0xfff || offset < -0xfff) {
+        tcg_out_movi32(s, cond, TCG_REG_R8, offset);
+        tcg_out_st32_r(s, cond, rd, rn, TCG_REG_R8);
+    } else
+        tcg_out_st32_12(s, cond, rd, rn, offset);
+}
+
+static inline void tcg_out_ld16u(TCGContext *s, int cond,
+                int rd, int rn, int32_t offset)
+{
+    if (offset > 0xff || offset < -0xff) {
+        tcg_out_movi32(s, cond, TCG_REG_R8, offset);
+        tcg_out_ld16u_r(s, cond, rd, rn, TCG_REG_R8);
+    } else
+        tcg_out_ld16u_8(s, cond, rd, rn, offset);
+}
+
+static inline void tcg_out_ld16s(TCGContext *s, int cond,
+                int rd, int rn, int32_t offset)
+{
+    if (offset > 0xff || offset < -0xff) {
+        tcg_out_movi32(s, cond, TCG_REG_R8, offset);
+        tcg_out_ld16s_r(s, cond, rd, rn, TCG_REG_R8);
+    } else
+        tcg_out_ld16s_8(s, cond, rd, rn, offset);
+}
+
+static inline void tcg_out_st16u(TCGContext *s, int cond,
+                int rd, int rn, int32_t offset)
+{
+    if (offset > 0xff || offset < -0xff) {
+        tcg_out_movi32(s, cond, TCG_REG_R8, offset);
+        tcg_out_st16u_r(s, cond, rd, rn, TCG_REG_R8);
+    } else
+        tcg_out_st16u_8(s, cond, rd, rn, offset);
+}
+
+static inline void tcg_out_ld8u(TCGContext *s, int cond,
+                int rd, int rn, int32_t offset)
+{
+    if (offset > 0xfff || offset < -0xfff) {
+        tcg_out_movi32(s, cond, TCG_REG_R8, offset);
+        tcg_out_ld8_r(s, cond, rd, rn, TCG_REG_R8);
+    } else
+        tcg_out_ld8_12(s, cond, rd, rn, offset);
+}
+
+static inline void tcg_out_ld8s(TCGContext *s, int cond,
+                int rd, int rn, int32_t offset)
+{
+    if (offset > 0xff || offset < -0xff) {
+        tcg_out_movi32(s, cond, TCG_REG_R8, offset);
+        tcg_out_ld8s_r(s, cond, rd, rn, TCG_REG_R8);
+    } else
+        tcg_out_ld8s_8(s, cond, rd, rn, offset);
+}
+
+static inline void tcg_out_st8u(TCGContext *s, int cond,
+                int rd, int rn, int32_t offset)
+{
+    if (offset > 0xfff || offset < -0xfff) {
+        tcg_out_movi32(s, cond, TCG_REG_R8, offset);
+        tcg_out_st8_r(s, cond, rd, rn, TCG_REG_R8);
+    } else
+        tcg_out_st8_12(s, cond, rd, rn, offset);
+}
+
+static inline void tcg_out_goto(TCGContext *s, int cond, uint32_t addr)
+{
+    int32_t val;
+
+    val = addr - (tcg_target_long) s->code_ptr;
+    if (val - 8 < 0x01fffffd && val - 8 > -0x01fffffd)
+        tcg_out_b(s, cond, val);
+    else {
+#if 1
+        tcg_abort();
+#else
+        if (cond == COND_AL) {
+            tcg_out_ld32_12(s, COND_AL, 15, 15, -4);
+            tcg_out32(s, addr); /* XXX: This is l->u.value, can we use it? */
+        } else {
+            tcg_out_movi32(s, cond, TCG_REG_R8, val - 8);
+            tcg_out_dat_reg(s, cond, ARITH_ADD,
+                            15, 15, TCG_REG_R8, SHIFT_IMM_LSL(0));
+        }
+#endif
+    }
+}
+
+static inline void tcg_out_call(TCGContext *s, int cond, uint32_t addr)
+{
+    int32_t val;
+
+#ifdef SAVE_LR
+    tcg_out_dat_reg(s, cond, ARITH_MOV, TCG_REG_R8, 0, 14, SHIFT_IMM_LSL(0));
+#endif
+
+    val = addr - (tcg_target_long) s->code_ptr;
+    if (val < 0x01fffffd && val > -0x01fffffd)
+        tcg_out_bl(s, cond, val);
+    else {
+#if 1
+        tcg_abort();
+#else
+        if (cond == COND_AL) {
+            tcg_out_dat_imm(s, cond, ARITH_ADD, 14, 15, 4);
+            tcg_out_ld32_12(s, COND_AL, 15, 15, -4);
+            tcg_out32(s, addr); /* XXX: This is l->u.value, can we use it? */
+        } else {
+            tcg_out_movi32(s, cond, TCG_REG_R9, addr);
+            tcg_out_dat_imm(s, cond, ARITH_MOV, 14, 0, 15);
+            tcg_out_bx(s, cond, TCG_REG_R9);
+        }
+#endif
+    }
+
+#ifdef SAVE_LR
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 14, 0, TCG_REG_R8, SHIFT_IMM_LSL(0));
+#endif
+}
+
+static inline void tcg_out_callr(TCGContext *s, int cond, int arg)
+{
+#ifdef SAVE_LR
+    tcg_out_dat_reg(s, cond, ARITH_MOV, TCG_REG_R8, 0, 14, SHIFT_IMM_LSL(0));
+#endif
+    /* TODO: on ARMv5 and ARMv6 replace with tcg_out_blx(s, cond, arg);  */
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 14, 0, 15, SHIFT_IMM_LSL(0));
+    tcg_out_bx(s, cond, arg);
+#ifdef SAVE_LR
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 14, 0, TCG_REG_R8, SHIFT_IMM_LSL(0));
+#endif
+}
+
+static inline void tcg_out_goto_label(TCGContext *s, int cond, int label_index)
+{
+    TCGLabel *l = &s->labels[label_index];
+
+    if (l->has_value)
+        tcg_out_goto(s, cond, l->u.value);
+    else if (cond == COND_AL) {
+        tcg_out_ld32_12(s, COND_AL, 15, 15, -4);
+        tcg_out_reloc(s, s->code_ptr, R_ARM_ABS32, label_index, 31337);
+        s->code_ptr += 4;
+    } else {
+        /* Probably this should be preferred even for COND_AL... */
+        tcg_out_reloc(s, s->code_ptr, R_ARM_PC24, label_index, 31337);
+        tcg_out_b_noaddr(s, cond);
+    }
+}
+
+static void tcg_out_div_helper(TCGContext *s, int cond, const TCGArg *args,
+                void *helper_div, void *helper_rem, int shift)
+{
+    int div_reg = args[0];
+    int rem_reg = args[1];
+
+    /* stmdb sp!, { r0 - r3, ip, lr } */
+    /* (Note that we need an even number of registers as per EABI) */
+    tcg_out32(s, (cond << 28) | 0x092d500f);
+
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 0, 0, args[2], SHIFT_IMM_LSL(0));
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 1, 0, args[3], SHIFT_IMM_LSL(0));
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 2, 0, args[4], SHIFT_IMM_LSL(0));
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 3, 0, 2, shift);
+
+    tcg_out_call(s, cond, (uint32_t) helper_div);
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 8, 0, 0, SHIFT_IMM_LSL(0));
+
+    /* ldmia sp, { r0 - r3, fp, lr } */
+    tcg_out32(s, (cond << 28) | 0x089d500f);
+
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 0, 0, args[2], SHIFT_IMM_LSL(0));
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 1, 0, args[3], SHIFT_IMM_LSL(0));
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 2, 0, args[4], SHIFT_IMM_LSL(0));
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 3, 0, 2, shift);
+
+    tcg_out_call(s, cond, (uint32_t) helper_rem);
+
+    tcg_out_dat_reg(s, cond, ARITH_MOV, rem_reg, 0, 0, SHIFT_IMM_LSL(0));
+    tcg_out_dat_reg(s, cond, ARITH_MOV, div_reg, 0, 8, SHIFT_IMM_LSL(0));
+
+    /* ldr r0, [sp], #4 */
+    if (rem_reg != 0 && div_reg != 0)
+        tcg_out32(s, (cond << 28) | 0x04bd0004);
+    /* ldr r1, [sp], #4 */
+    if (rem_reg != 1 && div_reg != 1)
+        tcg_out32(s, (cond << 28) | 0x04bd1004);
+    /* ldr r2, [sp], #4 */
+    if (rem_reg != 2 && div_reg != 2)
+        tcg_out32(s, (cond << 28) | 0x04bd2004);
+    /* ldr r3, [sp], #4 */
+    if (rem_reg != 3 && div_reg != 3)
+        tcg_out32(s, (cond << 28) | 0x04bd3004);
+    /* ldr ip, [sp], #4 */
+    if (rem_reg != 12 && div_reg != 12)
+        tcg_out32(s, (cond << 28) | 0x04bdc004);
+    /* ldr lr, [sp], #4 */
+    if (rem_reg != 14 && div_reg != 14)
+        tcg_out32(s, (cond << 28) | 0x04bde004);
+}
+
+#ifdef CONFIG_SOFTMMU
+
+#include "../../softmmu_defs.h"
+
+static void *qemu_ld_helpers[4] = {
+    __ldb_mmu,
+    __ldw_mmu,
+    __ldl_mmu,
+    __ldq_mmu,
+};
+
+static void *qemu_st_helpers[4] = {
+    __stb_mmu,
+    __stw_mmu,
+    __stl_mmu,
+    __stq_mmu,
+};
+#endif
+
+#define TLB_SHIFT	(CPU_TLB_ENTRY_BITS + CPU_TLB_BITS)
+
+static inline void tcg_out_qemu_ld(TCGContext *s, int cond,
+                const TCGArg *args, int opc)
+{
+    int addr_reg, data_reg, data_reg2;
+#ifdef CONFIG_SOFTMMU
+    int mem_index, s_bits;
+# if TARGET_LONG_BITS == 64
+    int addr_reg2;
+# endif
+    uint32_t *label_ptr;
+#endif
+
+    data_reg = *args++;
+    if (opc == 3)
+        data_reg2 = *args++;
+    else
+        data_reg2 = 0; /* surpress warning */
+    addr_reg = *args++;
+#if TARGET_LONG_BITS == 64
+    addr_reg2 = *args++;
+#endif
+#ifdef CONFIG_SOFTMMU
+    mem_index = *args;
+    s_bits = opc & 3;
+
+    /* Should generate something like the following:
+     *  shr r8, addr_reg, #TARGET_PAGE_BITS
+     *  and r0, r8, #(CPU_TLB_SIZE - 1)   @ Assumption: CPU_TLB_BITS <= 8
+     *  add r0, env, r0 lsl #CPU_TLB_ENTRY_BITS
+     */
+#  if CPU_TLB_BITS > 8
+#   error
+#  endif
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV,
+                    8, 0, addr_reg, SHIFT_IMM_LSR(TARGET_PAGE_BITS));
+    tcg_out_dat_imm(s, COND_AL, ARITH_AND,
+                    0, 8, CPU_TLB_SIZE - 1);
+    tcg_out_dat_reg(s, COND_AL, ARITH_ADD,
+                    0, TCG_AREG0, 0, SHIFT_IMM_LSL(CPU_TLB_ENTRY_BITS));
+    /* In the
+     *  ldr r1 [r0, #(offsetof(CPUState, tlb_table[mem_index][0].addr_read))]
+     * below, the offset is likely to exceed 12 bits if mem_index != 0 and
+     * not exceed otherwise, so use an
+     *  add r0, r0, #(mem_index * sizeof *CPUState.tlb_table)
+     * before.
+     */
+    if (mem_index)
+        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, 0, 0,
+                        (mem_index << (TLB_SHIFT & 1)) |
+                        ((16 - (TLB_SHIFT >> 1)) << 8));
+    tcg_out_ld32_12(s, COND_AL, 1, 0,
+                    offsetof(CPUState, tlb_table[0][0].addr_read));
+    tcg_out_dat_reg(s, COND_AL, ARITH_CMP,
+                    0, 1, 8, SHIFT_IMM_LSL(TARGET_PAGE_BITS));
+    /* Check alignment.  */
+    if (s_bits)
+        tcg_out_dat_imm(s, COND_EQ, ARITH_TST,
+                        0, addr_reg, (1 << s_bits) - 1);
+#  if TARGET_LONG_BITS == 64
+    /* XXX: possibly we could use a block data load or writeback in
+     * the first access.  */
+    tcg_out_ld32_12(s, COND_EQ, 1, 0,
+                    offsetof(CPUState, tlb_table[0][0].addr_read) + 4);
+    tcg_out_dat_reg(s, COND_EQ, ARITH_CMP,
+                    0, 1, addr_reg2, SHIFT_IMM_LSL(0));
+#  endif
+    tcg_out_ld32_12(s, COND_EQ, 1, 0,
+                    offsetof(CPUState, tlb_table[0][0].addend));
+
+    switch (opc) {
+    case 0:
+        tcg_out_ld8_r(s, COND_EQ, data_reg, addr_reg, 1);
+        break;
+    case 0 | 4:
+        tcg_out_ld8s_r(s, COND_EQ, data_reg, addr_reg, 1);
+        break;
+    case 1:
+        tcg_out_ld16u_r(s, COND_EQ, data_reg, addr_reg, 1);
+        break;
+    case 1 | 4:
+        tcg_out_ld16s_r(s, COND_EQ, data_reg, addr_reg, 1);
+        break;
+    case 2:
+    default:
+        tcg_out_ld32_r(s, COND_EQ, data_reg, addr_reg, 1);
+        break;
+    case 3:
+        tcg_out_ld32_rwb(s, COND_EQ, data_reg, 1, addr_reg);
+        tcg_out_ld32_12(s, COND_EQ, data_reg2, 1, 4);
+        break;
+    }
+
+    label_ptr = (void *) s->code_ptr;
+    tcg_out_b(s, COND_EQ, 8);
+
+# ifdef SAVE_LR
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 8, 0, 14, SHIFT_IMM_LSL(0));
+# endif
+
+    /* TODO: move this code to where the constants pool will be */
+    if (addr_reg)
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        0, 0, addr_reg, SHIFT_IMM_LSL(0));
+# if TARGET_LONG_BITS == 32
+    tcg_out_dat_imm(s, cond, ARITH_MOV, 1, 0, mem_index);
+# else
+    if (addr_reg2 != 1)
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        1, 0, addr_reg2, SHIFT_IMM_LSL(0));
+    tcg_out_dat_imm(s, cond, ARITH_MOV, 2, 0, mem_index);
+# endif
+    tcg_out_bl(s, cond, (tcg_target_long) qemu_ld_helpers[s_bits] -
+                    (tcg_target_long) s->code_ptr);
+
+    switch (opc) {
+    case 0 | 4:
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        0, 0, 0, SHIFT_IMM_LSL(24));
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        data_reg, 0, 0, SHIFT_IMM_ASR(24));
+        break;
+    case 1 | 4:
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        0, 0, 0, SHIFT_IMM_LSL(16));
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        data_reg, 0, 0, SHIFT_IMM_ASR(16));
+        break;
+    case 0:
+    case 1:
+    case 2:
+    default:
+        if (data_reg)
+            tcg_out_dat_reg(s, cond, ARITH_MOV,
+                            data_reg, 0, 0, SHIFT_IMM_LSL(0));
+        break;
+    case 3:
+        if (data_reg != 0)
+            tcg_out_dat_reg(s, cond, ARITH_MOV,
+                            data_reg, 0, 0, SHIFT_IMM_LSL(0));
+        if (data_reg2 != 1)
+            tcg_out_dat_reg(s, cond, ARITH_MOV,
+                            data_reg2, 0, 1, SHIFT_IMM_LSL(0));
+        break;
+    }
+
+# ifdef SAVE_LR
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 14, 0, 8, SHIFT_IMM_LSL(0));
+# endif
+
+    *label_ptr += ((void *) s->code_ptr - (void *) label_ptr - 8) >> 2;
+#else
+    switch (opc) {
+    case 0:
+        tcg_out_ld8_12(s, COND_AL, data_reg, addr_reg, 0);
+        break;
+    case 0 | 4:
+        tcg_out_ld8s_8(s, COND_AL, data_reg, addr_reg, 0);
+        break;
+    case 1:
+        tcg_out_ld16u_8(s, COND_AL, data_reg, addr_reg, 0);
+        break;
+    case 1 | 4:
+        tcg_out_ld16s_8(s, COND_AL, data_reg, addr_reg, 0);
+        break;
+    case 2:
+    default:
+        tcg_out_ld32_12(s, COND_AL, data_reg, addr_reg, 0);
+        break;
+    case 3:
+        /* TODO: use block load -
+         * check that data_reg2 > data_reg or the other way */
+        tcg_out_ld32_12(s, COND_AL, data_reg, addr_reg, 0);
+        tcg_out_ld32_12(s, COND_AL, data_reg2, addr_reg, 4);
+        break;
+    }
+#endif
+}
+
+static inline void tcg_out_qemu_st(TCGContext *s, int cond,
+                const TCGArg *args, int opc)
+{
+    int addr_reg, data_reg, data_reg2;
+#ifdef CONFIG_SOFTMMU
+    int mem_index, s_bits;
+# if TARGET_LONG_BITS == 64
+    int addr_reg2;
+# endif
+    uint32_t *label_ptr;
+#endif
+
+    data_reg = *args++;
+    if (opc == 3)
+        data_reg2 = *args++;
+    else
+        data_reg2 = 0; /* surpress warning */
+    addr_reg = *args++;
+#if TARGET_LONG_BITS == 64
+    addr_reg2 = *args++;
+#endif
+#ifdef CONFIG_SOFTMMU
+    mem_index = *args;
+    s_bits = opc & 3;
+
+    /* Should generate something like the following:
+     *  shr r8, addr_reg, #TARGET_PAGE_BITS
+     *  and r0, r8, #(CPU_TLB_SIZE - 1)   @ Assumption: CPU_TLB_BITS <= 8
+     *  add r0, env, r0 lsl #CPU_TLB_ENTRY_BITS
+     */
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV,
+                    8, 0, addr_reg, SHIFT_IMM_LSR(TARGET_PAGE_BITS));
+    tcg_out_dat_imm(s, COND_AL, ARITH_AND,
+                    0, 8, CPU_TLB_SIZE - 1);
+    tcg_out_dat_reg(s, COND_AL, ARITH_ADD,
+                    0, TCG_AREG0, 0, SHIFT_IMM_LSL(CPU_TLB_ENTRY_BITS));
+    /* In the
+     *  ldr r1 [r0, #(offsetof(CPUState, tlb_table[mem_index][0].addr_write))]
+     * below, the offset is likely to exceed 12 bits if mem_index != 0 and
+     * not exceed otherwise, so use an
+     *  add r0, r0, #(mem_index * sizeof *CPUState.tlb_table)
+     * before.
+     */
+    if (mem_index)
+        tcg_out_dat_imm(s, COND_AL, ARITH_ADD, 0, 0,
+                        (mem_index << (TLB_SHIFT & 1)) |
+                        ((16 - (TLB_SHIFT >> 1)) << 8));
+    tcg_out_ld32_12(s, COND_AL, 1, 0,
+                    offsetof(CPUState, tlb_table[0][0].addr_write));
+    tcg_out_dat_reg(s, COND_AL, ARITH_CMP,
+                    0, 1, 8, SHIFT_IMM_LSL(TARGET_PAGE_BITS));
+    /* Check alignment.  */
+    if (s_bits)
+        tcg_out_dat_imm(s, COND_EQ, ARITH_TST,
+                        0, addr_reg, (1 << s_bits) - 1);
+#  if TARGET_LONG_BITS == 64
+    /* XXX: possibly we could use a block data load or writeback in
+     * the first access.  */
+    tcg_out_ld32_12(s, COND_EQ, 1, 0,
+                    offsetof(CPUState, tlb_table[0][0].addr_write)
+                    + 4);
+    tcg_out_dat_reg(s, COND_EQ, ARITH_CMP,
+                    0, 1, addr_reg2, SHIFT_IMM_LSL(0));
+#  endif
+    tcg_out_ld32_12(s, COND_EQ, 1, 0,
+                    offsetof(CPUState, tlb_table[0][0].addend));
+
+    switch (opc) {
+    case 0:
+        tcg_out_st8_r(s, COND_EQ, data_reg, addr_reg, 1);
+        break;
+    case 0 | 4:
+        tcg_out_st8s_r(s, COND_EQ, data_reg, addr_reg, 1);
+        break;
+    case 1:
+        tcg_out_st16u_r(s, COND_EQ, data_reg, addr_reg, 1);
+        break;
+    case 1 | 4:
+        tcg_out_st16s_r(s, COND_EQ, data_reg, addr_reg, 1);
+        break;
+    case 2:
+    default:
+        tcg_out_st32_r(s, COND_EQ, data_reg, addr_reg, 1);
+        break;
+    case 3:
+        tcg_out_st32_rwb(s, COND_EQ, data_reg, 1, addr_reg);
+        tcg_out_st32_12(s, COND_EQ, data_reg2, 1, 4);
+        break;
+    }
+
+    label_ptr = (void *) s->code_ptr;
+    tcg_out_b(s, COND_EQ, 8);
+
+    /* TODO: move this code to where the constants pool will be */
+    if (addr_reg)
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        0, 0, addr_reg, SHIFT_IMM_LSL(0));
+# if TARGET_LONG_BITS == 32
+    switch (opc) {
+    case 0:
+        tcg_out_dat_imm(s, cond, ARITH_AND, 1, data_reg, 0xff);
+        tcg_out_dat_imm(s, cond, ARITH_MOV, 2, 0, mem_index);
+        break;
+    case 1:
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        1, 0, data_reg, SHIFT_IMM_LSL(16));
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        1, 0, 1, SHIFT_IMM_LSR(16));
+        tcg_out_dat_imm(s, cond, ARITH_MOV, 2, 0, mem_index);
+        break;
+    case 2:
+        if (data_reg != 1)
+            tcg_out_dat_reg(s, cond, ARITH_MOV,
+                            1, 0, data_reg, SHIFT_IMM_LSL(0));
+        tcg_out_dat_imm(s, cond, ARITH_MOV, 2, 0, mem_index);
+        break;
+    case 3:
+        if (data_reg != 1)
+            tcg_out_dat_reg(s, cond, ARITH_MOV,
+                            1, 0, data_reg, SHIFT_IMM_LSL(0));
+        if (data_reg2 != 2)
+            tcg_out_dat_reg(s, cond, ARITH_MOV,
+                            2, 0, data_reg2, SHIFT_IMM_LSL(0));
+        tcg_out_dat_imm(s, cond, ARITH_MOV, 3, 0, mem_index);
+        break;
+    }
+# else
+    if (addr_reg2 != 1)
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        1, 0, addr_reg2, SHIFT_IMM_LSL(0));
+    switch (opc) {
+    case 0:
+        tcg_out_dat_imm(s, cond, ARITH_AND, 2, data_reg, 0xff);
+        tcg_out_dat_imm(s, cond, ARITH_MOV, 3, 0, mem_index);
+        break;
+    case 1:
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        2, 0, data_reg, SHIFT_IMM_LSL(16));
+        tcg_out_dat_reg(s, cond, ARITH_MOV,
+                        2, 0, 2, SHIFT_IMM_LSR(16));
+        tcg_out_dat_imm(s, cond, ARITH_MOV, 3, 0, mem_index);
+        break;
+    case 2:
+        if (data_reg != 2)
+            tcg_out_dat_reg(s, cond, ARITH_MOV,
+                            2, 0, data_reg, SHIFT_IMM_LSL(0));
+        tcg_out_dat_imm(s, cond, ARITH_MOV, 3, 0, mem_index);
+        break;
+    case 3:
+        tcg_out_dat_imm(s, cond, ARITH_MOV, 8, 0, mem_index);
+        tcg_out32(s, (cond << 28) | 0x052d8010); /* str r8, [sp, #-0x10]! */
+        if (data_reg != 2)
+            tcg_out_dat_reg(s, cond, ARITH_MOV,
+                            2, 0, data_reg, SHIFT_IMM_LSL(0));
+        if (data_reg2 != 3)
+            tcg_out_dat_reg(s, cond, ARITH_MOV,
+                            3, 0, data_reg2, SHIFT_IMM_LSL(0));
+        break;
+    }
+# endif
+
+# ifdef SAVE_LR
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 8, 0, 14, SHIFT_IMM_LSL(0));
+# endif
+
+    tcg_out_bl(s, cond, (tcg_target_long) qemu_st_helpers[s_bits] -
+                    (tcg_target_long) s->code_ptr);
+# if TARGET_LONG_BITS == 64
+    if (opc == 3)
+        tcg_out_dat_imm(s, cond, ARITH_ADD, 13, 13, 0x10);
+# endif
+
+# ifdef SAVE_LR
+    tcg_out_dat_reg(s, cond, ARITH_MOV, 14, 0, 8, SHIFT_IMM_LSL(0));
+# endif
+
+    *label_ptr += ((void *) s->code_ptr - (void *) label_ptr - 8) >> 2;
+#else
+    switch (opc) {
+    case 0:
+        tcg_out_st8_12(s, COND_AL, data_reg, addr_reg, 0);
+        break;
+    case 0 | 4:
+        tcg_out_st8s_8(s, COND_AL, data_reg, addr_reg, 0);
+        break;
+    case 1:
+        tcg_out_st16u_8(s, COND_AL, data_reg, addr_reg, 0);
+        break;
+    case 1 | 4:
+        tcg_out_st16s_8(s, COND_AL, data_reg, addr_reg, 0);
+        break;
+    case 2:
+    default:
+        tcg_out_st32_12(s, COND_AL, data_reg, addr_reg, 0);
+        break;
+    case 3:
+        /* TODO: use block store -
+         * check that data_reg2 > data_reg or the other way */
+        tcg_out_st32_12(s, COND_AL, data_reg, addr_reg, 0);
+        tcg_out_st32_12(s, COND_AL, data_reg2, addr_reg, 4);
+        break;
+    }
+#endif
+}
+
+static uint8_t *tb_ret_addr;
+
+static inline void tcg_out_op(TCGContext *s, int opc,
+                const TCGArg *args, const int *const_args)
+{
+    int c;
+
+    switch (opc) {
+    case INDEX_op_exit_tb:
+#ifdef SAVE_LR
+        if (args[0] >> 8)
+            tcg_out_ld32_12(s, COND_AL, TCG_REG_R0, 15, 0);
+        else
+            tcg_out_dat_imm(s, COND_AL, ARITH_MOV, TCG_REG_R0, 0, args[0]);
+        tcg_out_dat_reg(s, COND_AL, ARITH_MOV, 15, 0, 14, SHIFT_IMM_LSL(0));
+        if (args[0] >> 8)
+            tcg_out32(s, args[0]);
+#else
+        if (args[0] >> 8)
+            tcg_out_ld32_12(s, COND_AL, 0, 15, 0);
+        else
+            tcg_out_dat_imm(s, COND_AL, ARITH_MOV, 0, 0, args[0]);
+        tcg_out_goto(s, COND_AL, (tcg_target_ulong) tb_ret_addr);
+        if (args[0] >> 8)
+            tcg_out32(s, args[0]);
+#endif
+        break;
+    case INDEX_op_goto_tb:
+        if (s->tb_jmp_offset) {
+            /* Direct jump method */
+#if 1
+            s->tb_jmp_offset[args[0]] = s->code_ptr - s->code_buf;
+            tcg_out_b(s, COND_AL, 8);
+#else
+            tcg_out_ld32_12(s, COND_AL, 15, 15, -4);
+            s->tb_jmp_offset[args[0]] = s->code_ptr - s->code_buf;
+            tcg_out32(s, 0);
+#endif
+        } else {
+            /* Indirect jump method */
+#if 1
+            c = (int) (s->tb_next + args[0]) - ((int) s->code_ptr + 8);
+            if (c > 0xfff || c < -0xfff) {
+                tcg_out_movi32(s, COND_AL, TCG_REG_R0,
+                                (tcg_target_long) (s->tb_next + args[0]));
+                tcg_out_ld32_12(s, COND_AL, 15, TCG_REG_R0, 0);
+            } else
+                tcg_out_ld32_12(s, COND_AL, 15, 15, c);
+#else
+            tcg_out_ld32_12(s, COND_AL, TCG_REG_R0, 15, 0);
+            tcg_out_ld32_12(s, COND_AL, 15, TCG_REG_R0, 0);
+            tcg_out32(s, (tcg_target_long) (s->tb_next + args[0]));
+#endif
+        }
+        s->tb_next_offset[args[0]] = s->code_ptr - s->code_buf;
+        break;
+    case INDEX_op_call:
+        if (const_args[0])
+            tcg_out_call(s, COND_AL, args[0]);
+        else
+            tcg_out_callr(s, COND_AL, args[0]);
+        break;
+    case INDEX_op_jmp:
+        if (const_args[0])
+            tcg_out_goto(s, COND_AL, args[0]);
+        else
+            tcg_out_bx(s, COND_AL, args[0]);
+        break;
+    case INDEX_op_br:
+        tcg_out_goto_label(s, COND_AL, args[0]);
+        break;
+
+    case INDEX_op_ld8u_i32:
+        tcg_out_ld8u(s, COND_AL, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld8s_i32:
+        tcg_out_ld8s(s, COND_AL, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld16u_i32:
+        tcg_out_ld16u(s, COND_AL, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld16s_i32:
+        tcg_out_ld16s(s, COND_AL, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld_i32:
+        tcg_out_ld32u(s, COND_AL, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_st8_i32:
+        tcg_out_st8u(s, COND_AL, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_st16_i32:
+        tcg_out_st16u(s, COND_AL, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_st_i32:
+        tcg_out_st32(s, COND_AL, args[0], args[1], args[2]);
+        break;
+
+    case INDEX_op_mov_i32:
+        tcg_out_dat_reg(s, COND_AL, ARITH_MOV,
+                        args[0], 0, args[1], SHIFT_IMM_LSL(0));
+        break;
+    case INDEX_op_movi_i32:
+        tcg_out_movi32(s, COND_AL, args[0], args[1]);
+        break;
+    case INDEX_op_add_i32:
+        c = ARITH_ADD;
+        goto gen_arith;
+    case INDEX_op_sub_i32:
+        c = ARITH_SUB;
+        goto gen_arith;
+    case INDEX_op_and_i32:
+        c = ARITH_AND;
+        goto gen_arith;
+    case INDEX_op_or_i32:
+        c = ARITH_ORR;
+        goto gen_arith;
+    case INDEX_op_xor_i32:
+        c = ARITH_EOR;
+        /* Fall through.  */
+    gen_arith:
+        tcg_out_dat_reg(s, COND_AL, c,
+                        args[0], args[1], args[2], SHIFT_IMM_LSL(0));
+        break;
+    case INDEX_op_add2_i32:
+        tcg_out_dat_reg2(s, COND_AL, ARITH_ADD, ARITH_ADC,
+                        args[0], args[1], args[2], args[3],
+                        args[4], args[5], SHIFT_IMM_LSL(0));
+        break;
+    case INDEX_op_sub2_i32:
+        tcg_out_dat_reg2(s, COND_AL, ARITH_SUB, ARITH_SBC,
+                        args[0], args[1], args[2], args[3],
+                        args[4], args[5], SHIFT_IMM_LSL(0));
+        break;
+    case INDEX_op_neg_i32:
+        tcg_out_dat_imm(s, COND_AL, ARITH_RSB, args[0], args[1], 0);
+        break;
+    case INDEX_op_mul_i32:
+        tcg_out_mul32(s, COND_AL, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_mulu2_i32:
+        tcg_out_umull32(s, COND_AL, args[0], args[1], args[2], args[3]);
+        break;
+    case INDEX_op_div2_i32:
+        tcg_out_div_helper(s, COND_AL, args,
+                        tcg_helper_div_i64, tcg_helper_rem_i64,
+                        SHIFT_IMM_ASR(31));
+        break;
+    case INDEX_op_divu2_i32:
+        tcg_out_div_helper(s, COND_AL, args,
+                        tcg_helper_divu_i64, tcg_helper_remu_i64,
+                        SHIFT_IMM_LSR(31));
+        break;
+    /* XXX: Perhaps args[2] & 0x1f is wrong */
+    case INDEX_op_shl_i32:
+        c = const_args[2] ?
+                SHIFT_IMM_LSL(args[2] & 0x1f) : SHIFT_REG_LSL(args[2]);
+        goto gen_shift32;
+    case INDEX_op_shr_i32:
+        c = const_args[2] ? (args[2] & 0x1f) ? SHIFT_IMM_LSR(args[2] & 0x1f) :
+                SHIFT_IMM_LSL(0) : SHIFT_REG_LSR(args[2]);
+        goto gen_shift32;
+    case INDEX_op_sar_i32:
+        c = const_args[2] ? (args[2] & 0x1f) ? SHIFT_IMM_ASR(args[2] & 0x1f) :
+                SHIFT_IMM_LSL(0) : SHIFT_REG_ASR(args[2]);
+        /* Fall through.  */
+    gen_shift32:
+        tcg_out_dat_reg(s, COND_AL, ARITH_MOV, args[0], 0, args[1], c);
+        break;
+
+    case INDEX_op_brcond_i32:
+        tcg_out_dat_reg(s, COND_AL, ARITH_CMP, 0,
+                        args[0], args[1], SHIFT_IMM_LSL(0));
+        tcg_out_goto_label(s, tcg_cond_to_arm_cond[args[2]], args[3]);
+        break;
+    case INDEX_op_brcond2_i32:
+        /* The resulting conditions are:
+         * TCG_COND_EQ    -->  a0 == a2 && a1 == a3,
+         * TCG_COND_NE    --> (a0 != a2 && a1 == a3) ||  a1 != a3,
+         * TCG_COND_LT(U) --> (a0 <  a2 && a1 == a3) ||  a1 <  a3,
+         * TCG_COND_GE(U) --> (a0 >= a2 && a1 == a3) || (a1 >= a3 && a1 != a3),
+         * TCG_COND_LE(U) --> (a0 <= a2 && a1 == a3) || (a1 <= a3 && a1 != a3),
+         * TCG_COND_GT(U) --> (a0 >  a2 && a1 == a3) ||  a1 >  a3,
+         */
+        tcg_out_dat_reg(s, COND_AL, ARITH_CMP, 0,
+                        args[1], args[3], SHIFT_IMM_LSL(0));
+        tcg_out_dat_reg(s, COND_EQ, ARITH_CMP, 0,
+                        args[0], args[2], SHIFT_IMM_LSL(0));
+        tcg_out_goto_label(s, tcg_cond_to_arm_cond[args[4]], args[5]);
+        break;
+
+    case INDEX_op_qemu_ld8u:
+        tcg_out_qemu_ld(s, COND_AL, args, 0);
+        break;
+    case INDEX_op_qemu_ld8s:
+        tcg_out_qemu_ld(s, COND_AL, args, 0 | 4);
+        break;
+    case INDEX_op_qemu_ld16u:
+        tcg_out_qemu_ld(s, COND_AL, args, 1);
+        break;
+    case INDEX_op_qemu_ld16s:
+        tcg_out_qemu_ld(s, COND_AL, args, 1 | 4);
+        break;
+    case INDEX_op_qemu_ld32u:
+        tcg_out_qemu_ld(s, COND_AL, args, 2);
+        break;
+    case INDEX_op_qemu_ld64:
+        tcg_out_qemu_ld(s, COND_AL, args, 3);
+        break;
+
+    case INDEX_op_qemu_st8:
+        tcg_out_qemu_st(s, COND_AL, args, 0);
+        break;
+    case INDEX_op_qemu_st16:
+        tcg_out_qemu_st(s, COND_AL, args, 1);
+        break;
+    case INDEX_op_qemu_st32:
+        tcg_out_qemu_st(s, COND_AL, args, 2);
+        break;
+    case INDEX_op_qemu_st64:
+        tcg_out_qemu_st(s, COND_AL, args, 3);
+        break;
+
+    case INDEX_op_ext8s_i32:
+        tcg_out_dat_reg(s, COND_AL, ARITH_MOV,
+                        args[0], 0, args[1], SHIFT_IMM_LSL(24));
+        tcg_out_dat_reg(s, COND_AL, ARITH_MOV,
+                        args[0], 0, args[0], SHIFT_IMM_ASR(24));
+        break;
+    case INDEX_op_ext16s_i32:
+        tcg_out_dat_reg(s, COND_AL, ARITH_MOV,
+                        args[0], 0, args[1], SHIFT_IMM_LSL(16));
+        tcg_out_dat_reg(s, COND_AL, ARITH_MOV,
+                        args[0], 0, args[0], SHIFT_IMM_ASR(16));
+        break;
+
+    default:
+        tcg_abort();
+    }
+}
+
+static const TCGTargetOpDef arm_op_defs[] = {
+    { INDEX_op_exit_tb, { } },
+    { INDEX_op_goto_tb, { } },
+    { INDEX_op_call, { "ri" } },
+    { INDEX_op_jmp, { "ri" } },
+    { INDEX_op_br, { } },
+
+    { INDEX_op_mov_i32, { "r", "r" } },
+    { INDEX_op_movi_i32, { "r" } },
+
+    { INDEX_op_ld8u_i32, { "r", "r" } },
+    { INDEX_op_ld8s_i32, { "r", "r" } },
+    { INDEX_op_ld16u_i32, { "r", "r" } },
+    { INDEX_op_ld16s_i32, { "r", "r" } },
+    { INDEX_op_ld_i32, { "r", "r" } },
+    { INDEX_op_st8_i32, { "r", "r" } },
+    { INDEX_op_st16_i32, { "r", "r" } },
+    { INDEX_op_st_i32, { "r", "r" } },
+
+    /* TODO: "r", "r", "ri" */
+    { INDEX_op_add_i32, { "r", "r", "r" } },
+    { INDEX_op_sub_i32, { "r", "r", "r" } },
+    { INDEX_op_mul_i32, { "r", "r", "r" } },
+    { INDEX_op_mulu2_i32, { "r", "r", "r", "r" } },
+    { INDEX_op_div2_i32, { "r", "r", "r", "1", "2" } },
+    { INDEX_op_divu2_i32, { "r", "r", "r", "1", "2" } },
+    { INDEX_op_and_i32, { "r", "r", "r" } },
+    { INDEX_op_or_i32, { "r", "r", "r" } },
+    { INDEX_op_xor_i32, { "r", "r", "r" } },
+    { INDEX_op_neg_i32, { "r", "r" } },
+
+    { INDEX_op_shl_i32, { "r", "r", "ri" } },
+    { INDEX_op_shr_i32, { "r", "r", "ri" } },
+    { INDEX_op_sar_i32, { "r", "r", "ri" } },
+
+    { INDEX_op_brcond_i32, { "r", "r" } },
+
+    /* TODO: "r", "r", "r", "r", "ri", "ri" */
+    { INDEX_op_add2_i32, { "r", "r", "r", "r", "r", "r" } },
+    { INDEX_op_sub2_i32, { "r", "r", "r", "r", "r", "r" } },
+    { INDEX_op_brcond2_i32, { "r", "r", "r", "r" } },
+
+    { INDEX_op_qemu_ld8u, { "r", "x", "X" } },
+    { INDEX_op_qemu_ld8s, { "r", "x", "X" } },
+    { INDEX_op_qemu_ld16u, { "r", "x", "X" } },
+    { INDEX_op_qemu_ld16s, { "r", "x", "X" } },
+    { INDEX_op_qemu_ld32u, { "r", "x", "X" } },
+    { INDEX_op_qemu_ld64, { "d", "r", "x", "X" } },
+
+    { INDEX_op_qemu_st8, { "x", "x", "X" } },
+    { INDEX_op_qemu_st16, { "x", "x", "X" } },
+    { INDEX_op_qemu_st32, { "x", "x", "X" } },
+    { INDEX_op_qemu_st64, { "x", "D", "x", "X" } },
+
+    { INDEX_op_ext8s_i32, { "r", "r" } },
+    { INDEX_op_ext16s_i32, { "r", "r" } },
+
+    { -1 },
+};
+
+void tcg_target_init(TCGContext *s)
+{
+    /* fail safe */
+    if ((1 << CPU_TLB_ENTRY_BITS) != sizeof(CPUTLBEntry))
+        tcg_abort();
+
+    tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I32], 0,
+                    ((2 << TCG_REG_R14) - 1) & ~(1 << TCG_REG_R8));
+    tcg_regset_set32(tcg_target_call_clobber_regs, 0,
+                    ((2 << TCG_REG_R3) - 1) |
+                    (1 << TCG_REG_R12) | (1 << TCG_REG_R14));
+
+    tcg_regset_clear(s->reserved_regs);
+#ifdef SAVE_LR
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R14);
+#endif
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_CALL_STACK);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R8);
+
+    tcg_add_target_add_op_defs(arm_op_defs);
+}
+
+static inline void tcg_out_ld(TCGContext *s, TCGType type, int arg,
+                int arg1, tcg_target_long arg2)
+{
+    tcg_out_ld32u(s, COND_AL, arg, arg1, arg2);
+}
+
+static inline void tcg_out_st(TCGContext *s, TCGType type, int arg,
+                int arg1, tcg_target_long arg2)
+{
+    tcg_out_st32(s, COND_AL, arg, arg1, arg2);
+}
+
+void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
+{
+    if (val > 0)
+        if (val < 0x100)
+            tcg_out_dat_imm(s, COND_AL, ARITH_ADD, reg, reg, val);
+        else
+            tcg_abort();
+    else if (val < 0) {
+        if (val > -0x100)
+            tcg_out_dat_imm(s, COND_AL, ARITH_SUB, reg, reg, -val);
+        else
+            tcg_abort();
+    }
+}
+
+static inline void tcg_out_mov(TCGContext *s, int ret, int arg)
+{
+    tcg_out_dat_reg(s, COND_AL, ARITH_MOV, ret, 0, arg, SHIFT_IMM_LSL(0));
+}
+
+static inline void tcg_out_movi(TCGContext *s, TCGType type,
+                int ret, tcg_target_long arg)
+{
+    tcg_out_movi32(s, COND_AL, ret, arg);
+}
+
+void tcg_target_qemu_prologue(TCGContext *s)
+{
+    /* stmdb sp!, { r9 - r11, lr } */
+    tcg_out32(s, (COND_AL << 28) | 0x092d4e00);
+
+    tcg_out_bx(s, COND_AL, TCG_REG_R0);
+    tb_ret_addr = s->code_ptr;
+
+    /* ldmia sp!, { r9 - r11, pc } */
+    tcg_out32(s, (COND_AL << 28) | 0x08bd8e00);
+}
diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
new file mode 100644
index 0000000..6c180af
--- /dev/null
+++ b/tcg/arm/tcg-target.h
@@ -0,0 +1,76 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ * Copyright (c) 2008 Andrzej Zaborowski
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#define TCG_TARGET_ARM 1
+
+#define TCG_TARGET_REG_BITS 32
+#undef TCG_TARGET_WORDS_BIGENDIAN
+#undef TCG_TARGET_HAS_div_i32
+#undef TCG_TARGET_HAS_div_i64
+#undef TCG_TARGET_HAS_bswap_i32
+#define TCG_TARGET_HAS_ext8s_i32
+#define TCG_TARGET_HAS_ext16s_i32
+#define TCG_TARGET_HAS_neg_i32
+#undef TCG_TARGET_HAS_neg_i64
+#undef TCG_TARGET_STACK_GROWSUP
+
+enum {
+    TCG_REG_R0 = 0,
+    TCG_REG_R1,
+    TCG_REG_R2,
+    TCG_REG_R3,
+    TCG_REG_R4,
+    TCG_REG_R5,
+    TCG_REG_R6,
+    TCG_REG_R7,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10,
+    TCG_REG_R11,
+    TCG_REG_R12,
+    TCG_REG_R13,
+    TCG_REG_R14,
+    TCG_TARGET_NB_REGS
+};
+
+/* used for function call generation */
+#define TCG_REG_CALL_STACK		TCG_REG_R13
+#define TCG_TARGET_STACK_ALIGN		8
+#define TCG_TARGET_CALL_STACK_OFFSET	0
+
+enum {
+    /* Note: must be synced with dyngen-exec.h */
+    TCG_AREG0 = TCG_REG_R7,
+    TCG_AREG1 = TCG_REG_R4,
+    TCG_AREG2 = TCG_REG_R5,
+    TCG_AREG3 = TCG_REG_R6,
+};
+
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
+{
+    register unsigned long _beg __asm ("a1") = start;
+    register unsigned long _end __asm ("a2") = stop;
+    register unsigned long _flg __asm ("a3") = 0;
+    __asm __volatile__ ("swi 0x9f0002" : : "r" (_beg), "r" (_end), "r" (_flg));
+}
diff --git a/tcg/hppa/tcg-target.c b/tcg/hppa/tcg-target.c
new file mode 100644
index 0000000..3affd26
--- /dev/null
+++ b/tcg/hppa/tcg-target.c
@@ -0,0 +1,973 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+    "%r0",
+    "%r1",
+    "%rp",
+    "%r3",
+    "%r4",
+    "%r5",
+    "%r6",
+    "%r7",
+    "%r8",
+    "%r9",
+    "%r10",
+    "%r11",
+    "%r12",
+    "%r13",
+    "%r14",
+    "%r15",
+    "%r16",
+    "%r17",
+    "%r18",
+    "%r19",
+    "%r20",
+    "%r21",
+    "%r22",
+    "%r23",
+    "%r24",
+    "%r25",
+    "%r26",
+    "%dp",
+    "%ret0",
+    "%ret1",
+    "%sp",
+    "%r31",
+};
+
+static const int tcg_target_reg_alloc_order[] = {
+    TCG_REG_R4,
+    TCG_REG_R5,
+    TCG_REG_R6,
+    TCG_REG_R7,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10,
+    TCG_REG_R11,
+    TCG_REG_R12,
+    TCG_REG_R13,
+
+    TCG_REG_R17,
+    TCG_REG_R14,
+    TCG_REG_R15,
+    TCG_REG_R16,
+};
+
+static const int tcg_target_call_iarg_regs[4] = {
+    TCG_REG_R26,
+    TCG_REG_R25,
+    TCG_REG_R24,
+    TCG_REG_R23,
+};
+
+static const int tcg_target_call_oarg_regs[2] = {
+    TCG_REG_RET0,
+    TCG_REG_RET1,
+};
+
+static void patch_reloc(uint8_t *code_ptr, int type,
+                        tcg_target_long value, tcg_target_long addend)
+{
+    switch (type) {
+    case R_PARISC_PCREL17F:
+        hppa_patch17f((uint32_t *)code_ptr, value, addend);
+        break;
+    default:
+        tcg_abort();
+    }
+}
+
+/* maximum number of register used for input function arguments */
+static inline int tcg_target_get_call_iarg_regs_count(int flags)
+{
+    return 4;
+}
+
+/* parse target specific constraints */
+int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+{
+    const char *ct_str;
+
+    ct_str = *pct_str;
+    switch (ct_str[0]) {
+    case 'r':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffffffff);
+        break;
+    case 'L': /* qemu_ld/st constraint */
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffffffff);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R26);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R25);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R24);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R23);
+        break;
+    default:
+        return -1;
+    }
+    ct_str++;
+    *pct_str = ct_str;
+    return 0;
+}
+
+/* test if a constant matches the constraint */
+static inline int tcg_target_const_match(tcg_target_long val,
+                                         const TCGArgConstraint *arg_ct)
+{
+    int ct;
+
+    ct = arg_ct->ct;
+
+    /* TODO */
+
+    return 0;
+}
+
+#define INSN_OP(x)       ((x) << 26)
+#define INSN_EXT3BR(x)   ((x) << 13)
+#define INSN_EXT3SH(x)   ((x) << 10)
+#define INSN_EXT4(x)     ((x) << 6)
+#define INSN_EXT5(x)     (x)
+#define INSN_EXT6(x)     ((x) << 6)
+#define INSN_EXT7(x)     ((x) << 6)
+#define INSN_EXT8A(x)    ((x) << 6)
+#define INSN_EXT8B(x)    ((x) << 5)
+#define INSN_T(x)        (x)
+#define INSN_R1(x)       ((x) << 16)
+#define INSN_R2(x)       ((x) << 21)
+#define INSN_DEP_LEN(x)  (32 - (x))
+#define INSN_SHDEP_CP(x) ((31 - (x)) << 5)
+#define INSN_SHDEP_P(x)  ((x) << 5)
+#define INSN_COND(x)     ((x) << 13)
+
+#define COND_NEVER 0
+#define COND_EQUAL 1
+#define COND_LT    2
+#define COND_LTEQ  3
+#define COND_LTU   4
+#define COND_LTUEQ 5
+#define COND_SV    6
+#define COND_OD    7
+
+
+/* Logical ADD */
+#define ARITH_ADD  (INSN_OP(0x02) | INSN_EXT6(0x28))
+#define ARITH_AND  (INSN_OP(0x02) | INSN_EXT6(0x08))
+#define ARITH_OR   (INSN_OP(0x02) | INSN_EXT6(0x09))
+#define ARITH_XOR  (INSN_OP(0x02) | INSN_EXT6(0x0a))
+#define ARITH_SUB  (INSN_OP(0x02) | INSN_EXT6(0x10))
+
+#define SHD        (INSN_OP(0x34) | INSN_EXT3SH(2))
+#define VSHD       (INSN_OP(0x34) | INSN_EXT3SH(0))
+#define DEP        (INSN_OP(0x35) | INSN_EXT3SH(3))
+#define ZDEP       (INSN_OP(0x35) | INSN_EXT3SH(2))
+#define ZVDEP      (INSN_OP(0x35) | INSN_EXT3SH(0))
+#define EXTRU      (INSN_OP(0x34) | INSN_EXT3SH(6))
+#define EXTRS      (INSN_OP(0x34) | INSN_EXT3SH(7))
+#define VEXTRS     (INSN_OP(0x34) | INSN_EXT3SH(5))
+
+#define SUBI       (INSN_OP(0x25))
+#define MTCTL      (INSN_OP(0x00) | INSN_EXT8B(0xc2))
+
+#define BL         (INSN_OP(0x3a) | INSN_EXT3BR(0))
+#define BLE_SR4    (INSN_OP(0x39) | (1 << 13))
+#define BV         (INSN_OP(0x3a) | INSN_EXT3BR(6))
+#define BV_N       (INSN_OP(0x3a) | INSN_EXT3BR(6) | 2)
+#define LDIL       (INSN_OP(0x08))
+#define LDO        (INSN_OP(0x0d))
+
+#define LDB        (INSN_OP(0x10))
+#define LDH        (INSN_OP(0x11))
+#define LDW        (INSN_OP(0x12))
+#define LDWM       (INSN_OP(0x13))
+
+#define STB        (INSN_OP(0x18))
+#define STH        (INSN_OP(0x19))
+#define STW        (INSN_OP(0x1a))
+#define STWM       (INSN_OP(0x1b))
+
+#define COMBT      (INSN_OP(0x20))
+#define COMBF      (INSN_OP(0x22))
+
+static int lowsignext(uint32_t val, int start, int length)
+{
+    return (((val << 1) & ~(~0 << length)) |
+            ((val >> (length - 1)) & 1)) << start;
+}
+
+static inline void tcg_out_mov(TCGContext *s, int ret, int arg)
+{
+    /* PA1.1 defines COPY as OR r,0,t */
+    tcg_out32(s, ARITH_OR | INSN_T(ret) | INSN_R1(arg) | INSN_R2(TCG_REG_R0));
+
+    /* PA2.0 defines COPY as LDO 0(r),t
+     * but hppa-dis.c is unaware of this definition */
+    /* tcg_out32(s, LDO | INSN_R1(ret) | INSN_R2(arg) | reassemble_14(0)); */
+}
+
+static inline void tcg_out_movi(TCGContext *s, TCGType type,
+                                int ret, tcg_target_long arg)
+{
+    if (arg == (arg & 0x1fff)) {
+        tcg_out32(s, LDO | INSN_R1(ret) | INSN_R2(TCG_REG_R0) |
+                     reassemble_14(arg));
+    } else {
+        tcg_out32(s, LDIL | INSN_R2(ret) |
+                     reassemble_21(lrsel((uint32_t)arg, 0)));
+        if (arg & 0x7ff)
+            tcg_out32(s, LDO | INSN_R1(ret) | INSN_R2(ret) |
+                         reassemble_14(rrsel((uint32_t)arg, 0)));
+    }
+}
+
+static inline void tcg_out_ld_raw(TCGContext *s, int ret,
+                                  tcg_target_long arg)
+{
+    tcg_out32(s, LDIL | INSN_R2(ret) |
+                 reassemble_21(lrsel((uint32_t)arg, 0)));
+    tcg_out32(s, LDW | INSN_R1(ret) | INSN_R2(ret) |
+                 reassemble_14(rrsel((uint32_t)arg, 0)));
+}
+
+static inline void tcg_out_ld_ptr(TCGContext *s, int ret,
+                                  tcg_target_long arg)
+{
+    tcg_out_ld_raw(s, ret, arg);
+}
+
+static inline void tcg_out_ldst(TCGContext *s, int ret, int addr, int offset,
+                                int op)
+{
+    if (offset == (offset & 0xfff))
+        tcg_out32(s, op | INSN_R1(ret) | INSN_R2(addr) |
+                 reassemble_14(offset));
+    else {
+        fprintf(stderr, "unimplemented %s with offset %d\n", __func__, offset);
+        tcg_abort();
+    }
+}
+
+static inline void tcg_out_ld(TCGContext *s, TCGType type, int ret,
+                              int arg1, tcg_target_long arg2)
+{
+    fprintf(stderr, "unimplemented %s\n", __func__);
+    tcg_abort();
+}
+
+static inline void tcg_out_st(TCGContext *s, TCGType type, int ret,
+                              int arg1, tcg_target_long arg2)
+{
+    fprintf(stderr, "unimplemented %s\n", __func__);
+    tcg_abort();
+}
+
+static inline void tcg_out_arith(TCGContext *s, int t, int r1, int r2, int op)
+{
+    tcg_out32(s, op | INSN_T(t) | INSN_R1(r1) | INSN_R2(r2));
+}
+
+static inline void tcg_out_arithi(TCGContext *s, int t, int r1,
+                                  tcg_target_long val, int op)
+{
+    tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_R20, val);
+    tcg_out_arith(s, t, r1, TCG_REG_R20, op);
+}
+
+static inline void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
+{
+    tcg_out_arithi(s, reg, reg, val, ARITH_ADD);
+}
+
+static inline void tcg_out_nop(TCGContext *s)
+{
+    tcg_out32(s, ARITH_OR | INSN_T(TCG_REG_R0) | INSN_R1(TCG_REG_R0) |
+                 INSN_R2(TCG_REG_R0));
+}
+
+static inline void tcg_out_ext8s(TCGContext *s, int ret, int arg) {
+    tcg_out32(s, EXTRS | INSN_R1(ret) | INSN_R2(arg) |
+                 INSN_SHDEP_P(31) | INSN_DEP_LEN(8));
+}
+
+static inline void tcg_out_ext16s(TCGContext *s, int ret, int arg) {
+    tcg_out32(s, EXTRS | INSN_R1(ret) | INSN_R2(arg) |
+                 INSN_SHDEP_P(31) | INSN_DEP_LEN(16));
+}
+
+static inline void tcg_out_bswap16(TCGContext *s, int ret, int arg) {
+    if(ret != arg)
+        tcg_out_mov(s, ret, arg);
+    tcg_out32(s, DEP | INSN_R2(ret) | INSN_R1(ret) |
+                 INSN_SHDEP_CP(15) | INSN_DEP_LEN(8));
+    tcg_out32(s, SHD | INSN_T(ret) | INSN_R1(TCG_REG_R0) |
+                 INSN_R2(ret) | INSN_SHDEP_CP(8));
+}
+
+static inline void tcg_out_bswap32(TCGContext *s, int ret, int arg, int temp) {
+    tcg_out32(s, SHD | INSN_T(temp) | INSN_R1(arg) |
+                 INSN_R2(arg) | INSN_SHDEP_CP(16));
+    tcg_out32(s, DEP | INSN_R2(temp) | INSN_R1(temp) |
+                 INSN_SHDEP_CP(15) | INSN_DEP_LEN(8));
+    tcg_out32(s, SHD | INSN_T(ret) | INSN_R1(arg) |
+                 INSN_R2(temp) | INSN_SHDEP_CP(8));
+}
+
+static inline void tcg_out_call(TCGContext *s, void *func)
+{
+    uint32_t val = (uint32_t)__canonicalize_funcptr_for_compare(func);
+    tcg_out32(s, LDIL | INSN_R2(TCG_REG_R20) |
+                 reassemble_21(lrsel(val, 0)));
+    tcg_out32(s, BLE_SR4 | INSN_R2(TCG_REG_R20) |
+                 reassemble_17(rrsel(val, 0) >> 2));
+    tcg_out_mov(s, TCG_REG_RP, TCG_REG_R31);
+}
+
+#if defined(CONFIG_SOFTMMU)
+
+#include "../../softmmu_defs.h"
+
+static void *qemu_ld_helpers[4] = {
+    __ldb_mmu,
+    __ldw_mmu,
+    __ldl_mmu,
+    __ldq_mmu,
+};
+
+static void *qemu_st_helpers[4] = {
+    __stb_mmu,
+    __stw_mmu,
+    __stl_mmu,
+    __stq_mmu,
+};
+#endif
+
+static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+{
+    int addr_reg, data_reg, data_reg2, r0, r1, mem_index, s_bits, bswap;
+#if defined(CONFIG_SOFTMMU)
+    uint32_t *label1_ptr, *label2_ptr;
+#endif
+#if TARGET_LONG_BITS == 64
+#if defined(CONFIG_SOFTMMU)
+    uint32_t *label3_ptr;
+#endif
+    int addr_reg2;
+#endif
+
+    data_reg = *args++;
+    if (opc == 3)
+        data_reg2 = *args++;
+    else
+        data_reg2 = 0; /* surpress warning */
+    addr_reg = *args++;
+#if TARGET_LONG_BITS == 64
+    addr_reg2 = *args++;
+#endif
+    mem_index = *args;
+    s_bits = opc & 3;
+
+    r0 = TCG_REG_R26;
+    r1 = TCG_REG_R25;
+
+#if defined(CONFIG_SOFTMMU)
+    tcg_out_mov(s, r1, addr_reg);
+
+    tcg_out_mov(s, r0, addr_reg);
+
+    tcg_out32(s, SHD | INSN_T(r1) | INSN_R1(TCG_REG_R0) | INSN_R2(r1) |
+                 INSN_SHDEP_CP(TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS));
+
+    tcg_out_arithi(s, r0, r0, TARGET_PAGE_MASK | ((1 << s_bits) - 1),
+                   ARITH_AND);
+
+    tcg_out_arithi(s, r1, r1, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS,
+                   ARITH_AND);
+
+    tcg_out_arith(s, r1, r1, TCG_AREG0, ARITH_ADD);
+    tcg_out_arithi(s, r1, r1,
+                   offsetof(CPUState, tlb_table[mem_index][0].addr_read),
+                   ARITH_ADD);
+
+    tcg_out_ldst(s, TCG_REG_R20, r1, 0, LDW);
+
+#if TARGET_LONG_BITS == 32
+    /* if equal, jump to label1 */
+    label1_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, COMBT | INSN_R1(TCG_REG_R20) | INSN_R2(r0) |
+                 INSN_COND(COND_EQUAL));
+    tcg_out_mov(s, r0, addr_reg); /* delay slot */
+#else
+    /* if not equal, jump to label3 */
+    label3_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, COMBF | INSN_R1(TCG_REG_R20) | INSN_R2(r0) |
+                 INSN_COND(COND_EQUAL));
+    tcg_out_mov(s, r0, addr_reg); /* delay slot */
+
+    tcg_out_ldst(s, TCG_REG_R20, r1, 4, LDW);
+
+    /* if equal, jump to label1 */
+    label1_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, COMBT | INSN_R1(TCG_REG_R20) | INSN_R2(addr_reg2) |
+                 INSN_COND(COND_EQUAL));
+    tcg_out_nop(s); /* delay slot */
+
+    /* label3: */
+    *label3_ptr |= reassemble_12((uint32_t *)s->code_ptr - label3_ptr - 2);
+#endif
+
+#if TARGET_LONG_BITS == 32
+    tcg_out_mov(s, TCG_REG_R26, addr_reg);
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R25, mem_index);
+#else
+    tcg_out_mov(s, TCG_REG_R26, addr_reg);
+    tcg_out_mov(s, TCG_REG_R25, addr_reg2);
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R24, mem_index);
+#endif
+
+    tcg_out_call(s, qemu_ld_helpers[s_bits]);
+
+    switch(opc) {
+        case 0 | 4:
+            tcg_out_ext8s(s, data_reg, TCG_REG_RET0);
+            break;
+        case 1 | 4:
+            tcg_out_ext16s(s, data_reg, TCG_REG_RET0);
+            break;
+        case 0:
+        case 1:
+        case 2:
+        default:
+            tcg_out_mov(s, data_reg, TCG_REG_RET0);
+            break;
+        case 3:
+            tcg_abort();
+            tcg_out_mov(s, data_reg, TCG_REG_RET0);
+            tcg_out_mov(s, data_reg2, TCG_REG_RET1);
+            break;
+    }
+
+    /* jump to label2 */
+    label2_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, BL | INSN_R2(TCG_REG_R0) | 2);
+
+    /* label1: */
+    *label1_ptr |= reassemble_12((uint32_t *)s->code_ptr - label1_ptr - 2);
+
+    tcg_out_arithi(s, TCG_REG_R20, r1,
+                   offsetof(CPUTLBEntry, addend) - offsetof(CPUTLBEntry, addr_read),
+                   ARITH_ADD);
+    tcg_out_ldst(s, TCG_REG_R20, TCG_REG_R20, 0, LDW);
+    tcg_out_arith(s, r0, r0, TCG_REG_R20, ARITH_ADD);
+#else
+    r0 = addr_reg;
+#endif
+
+#ifdef TARGET_WORDS_BIGENDIAN
+    bswap = 0;
+#else
+    bswap = 1;
+#endif
+    switch (opc) {
+        case 0:
+            tcg_out_ldst(s, data_reg, r0, 0, LDB);
+            break;
+        case 0 | 4:
+            tcg_out_ldst(s, data_reg, r0, 0, LDB);
+            tcg_out_ext8s(s, data_reg, data_reg);
+            break;
+        case 1:
+            tcg_out_ldst(s, data_reg, r0, 0, LDH);
+            if (bswap)
+                tcg_out_bswap16(s, data_reg, data_reg);
+            break;
+        case 1 | 4:
+            tcg_out_ldst(s, data_reg, r0, 0, LDH);
+            if (bswap)
+                tcg_out_bswap16(s, data_reg, data_reg);
+            tcg_out_ext16s(s, data_reg, data_reg);
+            break;
+        case 2:
+            tcg_out_ldst(s, data_reg, r0, 0, LDW);
+            if (bswap)
+                tcg_out_bswap32(s, data_reg, data_reg, TCG_REG_R20);
+            break;
+        case 3:
+            tcg_abort();
+            if (!bswap) {
+                tcg_out_ldst(s, data_reg, r0, 0, LDW);
+                tcg_out_ldst(s, data_reg2, r0, 4, LDW);
+            } else {
+                tcg_out_ldst(s, data_reg, r0, 4, LDW);
+                tcg_out_bswap32(s, data_reg, data_reg, TCG_REG_R20);
+                tcg_out_ldst(s, data_reg2, r0, 0, LDW);
+                tcg_out_bswap32(s, data_reg2, data_reg2, TCG_REG_R20);
+            }
+            break;
+        default:
+            tcg_abort();
+    }
+
+#if defined(CONFIG_SOFTMMU)
+    /* label2: */
+    *label2_ptr |= reassemble_17((uint32_t *)s->code_ptr - label2_ptr - 2);
+#endif
+}
+
+static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+{
+    int addr_reg, data_reg, data_reg2, r0, r1, mem_index, s_bits, bswap;
+#if defined(CONFIG_SOFTMMU)
+    uint32_t *label1_ptr, *label2_ptr;
+#endif
+#if TARGET_LONG_BITS == 64
+#if defined(CONFIG_SOFTMMU)
+    uint32_t *label3_ptr;
+#endif
+    int addr_reg2;
+#endif
+
+    data_reg = *args++;
+    if (opc == 3)
+        data_reg2 = *args++;
+    else
+        data_reg2 = 0; /* surpress warning */
+    addr_reg = *args++;
+#if TARGET_LONG_BITS == 64
+    addr_reg2 = *args++;
+#endif
+    mem_index = *args;
+
+    s_bits = opc;
+
+    r0 = TCG_REG_R26;
+    r1 = TCG_REG_R25;
+
+#if defined(CONFIG_SOFTMMU)
+    tcg_out_mov(s, r1, addr_reg);
+
+    tcg_out_mov(s, r0, addr_reg);
+
+    tcg_out32(s, SHD | INSN_T(r1) | INSN_R1(TCG_REG_R0) | INSN_R2(r1) |
+                 INSN_SHDEP_CP(TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS));
+
+    tcg_out_arithi(s, r0, r0, TARGET_PAGE_MASK | ((1 << s_bits) - 1),
+                   ARITH_AND);
+
+    tcg_out_arithi(s, r1, r1, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS,
+                   ARITH_AND);
+
+    tcg_out_arith(s, r1, r1, TCG_AREG0, ARITH_ADD);
+    tcg_out_arithi(s, r1, r1,
+                   offsetof(CPUState, tlb_table[mem_index][0].addr_write),
+                   ARITH_ADD);
+
+    tcg_out_ldst(s, TCG_REG_R20, r1, 0, LDW);
+
+#if TARGET_LONG_BITS == 32
+    /* if equal, jump to label1 */
+    label1_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, COMBT | INSN_R1(TCG_REG_R20) | INSN_R2(r0) |
+                 INSN_COND(COND_EQUAL));
+    tcg_out_mov(s, r0, addr_reg); /* delay slot */
+#else
+    /* if not equal, jump to label3 */
+    label3_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, COMBF | INSN_R1(TCG_REG_R20) | INSN_R2(r0) |
+                 INSN_COND(COND_EQUAL));
+    tcg_out_mov(s, r0, addr_reg); /* delay slot */
+
+    tcg_out_ldst(s, TCG_REG_R20, r1, 4, LDW);
+
+    /* if equal, jump to label1 */
+    label1_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, COMBT | INSN_R1(TCG_REG_R20) | INSN_R2(addr_reg2) |
+                 INSN_COND(COND_EQUAL));
+    tcg_out_nop(s); /* delay slot */
+
+    /* label3: */
+    *label3_ptr |= reassemble_12((uint32_t *)s->code_ptr - label3_ptr - 2);
+#endif
+
+    tcg_out_mov(s, TCG_REG_R26, addr_reg);
+#if TARGET_LONG_BITS == 64
+    tcg_out_mov(s, TCG_REG_R25, addr_reg2);
+    if (opc == 3) {
+        tcg_abort();
+        tcg_out_mov(s, TCG_REG_R24, data_reg);
+        tcg_out_mov(s, TCG_REG_R23, data_reg2);
+        /* TODO: push mem_index */
+        tcg_abort();
+    } else {
+        switch(opc) {
+        case 0:
+            tcg_out32(s, EXTRU | INSN_R1(TCG_REG_R24) | INSN_R2(data_reg) |
+                         INSN_SHDEP_P(31) | INSN_DEP_LEN(8));
+            break;
+        case 1:
+            tcg_out32(s, EXTRU | INSN_R1(TCG_REG_R24) | INSN_R2(data_reg) |
+                         INSN_SHDEP_P(31) | INSN_DEP_LEN(16));
+            break;
+        case 2:
+            tcg_out_mov(s, TCG_REG_R24, data_reg);
+            break;
+        }
+        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R23, mem_index);
+    }
+#else
+    if (opc == 3) {
+        tcg_abort();
+        tcg_out_mov(s, TCG_REG_R25, data_reg);
+        tcg_out_mov(s, TCG_REG_R24, data_reg2);
+        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R23, mem_index);
+    } else {
+        switch(opc) {
+        case 0:
+            tcg_out32(s, EXTRU | INSN_R1(TCG_REG_R25) | INSN_R2(data_reg) |
+                         INSN_SHDEP_P(31) | INSN_DEP_LEN(8));
+            break;
+        case 1:
+            tcg_out32(s, EXTRU | INSN_R1(TCG_REG_R25) | INSN_R2(data_reg) |
+                         INSN_SHDEP_P(31) | INSN_DEP_LEN(16));
+            break;
+        case 2:
+            tcg_out_mov(s, TCG_REG_R25, data_reg);
+            break;
+        }
+        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_R24, mem_index);
+    }
+#endif
+    tcg_out_call(s, qemu_st_helpers[s_bits]);
+
+    /* jump to label2 */
+    label2_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, BL | INSN_R2(TCG_REG_R0) | 2);
+
+    /* label1: */
+    *label1_ptr |= reassemble_12((uint32_t *)s->code_ptr - label1_ptr - 2);
+
+    tcg_out_arithi(s, TCG_REG_R20, r1,
+                   offsetof(CPUTLBEntry, addend) - offsetof(CPUTLBEntry, addr_write),
+                   ARITH_ADD);
+    tcg_out_ldst(s, TCG_REG_R20, TCG_REG_R20, 0, LDW);
+    tcg_out_arith(s, r0, r0, TCG_REG_R20, ARITH_ADD);
+#else
+    r0 = addr_reg;
+#endif
+
+#ifdef TARGET_WORDS_BIGENDIAN
+    bswap = 0;
+#else
+    bswap = 1;
+#endif
+    switch (opc) {
+    case 0:
+        tcg_out_ldst(s, data_reg, r0, 0, STB);
+        break;
+    case 1:
+        if (bswap) {
+            tcg_out_bswap16(s, TCG_REG_R20, data_reg);
+            data_reg = TCG_REG_R20;
+        }
+        tcg_out_ldst(s, data_reg, r0, 0, STH);
+        break;
+    case 2:
+        if (bswap) {
+            tcg_out_bswap32(s, TCG_REG_R20, data_reg, TCG_REG_R20);
+            data_reg = TCG_REG_R20;
+        }
+        tcg_out_ldst(s, data_reg, r0, 0, STW);
+        break;
+    case 3:
+        tcg_abort();
+        if (!bswap) {
+            tcg_out_ldst(s, data_reg, r0, 0, STW);
+            tcg_out_ldst(s, data_reg2, r0, 4, STW);
+        } else {
+            tcg_out_bswap32(s, TCG_REG_R20, data_reg, TCG_REG_R20);
+            tcg_out_ldst(s, TCG_REG_R20, r0, 4, STW);
+            tcg_out_bswap32(s, TCG_REG_R20, data_reg2, TCG_REG_R20);
+            tcg_out_ldst(s, TCG_REG_R20, r0, 0, STW);
+        }
+        break;
+    default:
+        tcg_abort();
+    }
+
+#if defined(CONFIG_SOFTMMU)
+    /* label2: */
+    *label2_ptr |= reassemble_17((uint32_t *)s->code_ptr - label2_ptr - 2);
+#endif
+}
+
+static inline void tcg_out_op(TCGContext *s, int opc, const TCGArg *args,
+                              const int *const_args)
+{
+    int c;
+
+    switch (opc) {
+    case INDEX_op_exit_tb:
+        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_RET0, args[0]);
+        tcg_out32(s, BV_N | INSN_R2(TCG_REG_R18));
+        break;
+    case INDEX_op_goto_tb:
+        if (s->tb_jmp_offset) {
+            /* direct jump method */
+            fprintf(stderr, "goto_tb direct\n");
+            tcg_abort();
+            tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_R20, args[0]);
+            tcg_out32(s, BV_N | INSN_R2(TCG_REG_R20));
+            s->tb_jmp_offset[args[0]] = s->code_ptr - s->code_buf;
+        } else {
+            /* indirect jump method */
+            tcg_out_ld_ptr(s, TCG_REG_R20,
+                           (tcg_target_long)(s->tb_next + args[0]));
+            tcg_out32(s, BV_N | INSN_R2(TCG_REG_R20));
+        }
+        s->tb_next_offset[args[0]] = s->code_ptr - s->code_buf;
+        break;
+    case INDEX_op_call:
+        tcg_out32(s, BLE_SR4 | INSN_R2(args[0]));
+        tcg_out_mov(s, TCG_REG_RP, TCG_REG_R31);
+        break;
+    case INDEX_op_jmp:
+        fprintf(stderr, "unimplemented jmp\n");
+        tcg_abort();
+        break;
+    case INDEX_op_br:
+        fprintf(stderr, "unimplemented br\n");
+        tcg_abort();
+        break;
+    case INDEX_op_movi_i32:
+        tcg_out_movi(s, TCG_TYPE_I32, args[0], (uint32_t)args[1]);
+        break;
+
+    case INDEX_op_ld8u_i32:
+        tcg_out_ldst(s, args[0], args[1], args[2], LDB);
+        break;
+    case INDEX_op_ld8s_i32:
+        tcg_out_ldst(s, args[0], args[1], args[2], LDB);
+        tcg_out_ext8s(s, args[0], args[0]);
+        break;
+    case INDEX_op_ld16u_i32:
+        tcg_out_ldst(s, args[0], args[1], args[2], LDH);
+        break;
+    case INDEX_op_ld16s_i32:
+        tcg_out_ldst(s, args[0], args[1], args[2], LDH);
+        tcg_out_ext16s(s, args[0], args[0]);
+        break;
+    case INDEX_op_ld_i32:
+        tcg_out_ldst(s, args[0], args[1], args[2], LDW);
+        break;
+
+    case INDEX_op_st8_i32:
+        tcg_out_ldst(s, args[0], args[1], args[2], STB);
+        break;
+    case INDEX_op_st16_i32:
+        tcg_out_ldst(s, args[0], args[1], args[2], STH);
+        break;
+    case INDEX_op_st_i32:
+        tcg_out_ldst(s, args[0], args[1], args[2], STW);
+        break;
+
+    case INDEX_op_sub_i32:
+        c = ARITH_SUB;
+        goto gen_arith;
+    case INDEX_op_and_i32:
+        c = ARITH_AND;
+        goto gen_arith;
+    case INDEX_op_or_i32:
+        c = ARITH_OR;
+        goto gen_arith;
+    case INDEX_op_xor_i32:
+        c = ARITH_XOR;
+        goto gen_arith;
+    case INDEX_op_add_i32:
+        c = ARITH_ADD;
+        goto gen_arith;
+
+    case INDEX_op_shl_i32:
+        tcg_out32(s, SUBI | INSN_R1(TCG_REG_R20) | INSN_R2(args[2]) |
+                     lowsignext(0x1f, 0, 11));
+        tcg_out32(s, MTCTL | INSN_R2(11) | INSN_R1(TCG_REG_R20));
+        tcg_out32(s, ZVDEP | INSN_R2(args[0]) | INSN_R1(args[1]) |
+                     INSN_DEP_LEN(32));
+        break;
+    case INDEX_op_shr_i32:
+        tcg_out32(s, MTCTL | INSN_R2(11) | INSN_R1(args[2]));
+        tcg_out32(s, VSHD | INSN_T(args[0]) | INSN_R1(TCG_REG_R0) |
+                     INSN_R2(args[1]));
+        break;
+    case INDEX_op_sar_i32:
+        tcg_out32(s, SUBI | INSN_R1(TCG_REG_R20) | INSN_R2(args[2]) |
+                     lowsignext(0x1f, 0, 11));
+        tcg_out32(s, MTCTL | INSN_R2(11) | INSN_R1(TCG_REG_R20));
+        tcg_out32(s, VEXTRS | INSN_R1(args[0]) | INSN_R2(args[1]) |
+                     INSN_DEP_LEN(32));
+        break;
+
+    case INDEX_op_mul_i32:
+        fprintf(stderr, "unimplemented mul\n");
+        tcg_abort();
+        break;
+    case INDEX_op_mulu2_i32:
+        fprintf(stderr, "unimplemented mulu2\n");
+        tcg_abort();
+        break;
+    case INDEX_op_div2_i32:
+        fprintf(stderr, "unimplemented div2\n");
+        tcg_abort();
+        break;
+    case INDEX_op_divu2_i32:
+        fprintf(stderr, "unimplemented divu2\n");
+        tcg_abort();
+        break;
+
+    case INDEX_op_brcond_i32:
+        fprintf(stderr, "unimplemented brcond\n");
+        tcg_abort();
+        break;
+
+    case INDEX_op_qemu_ld8u:
+        tcg_out_qemu_ld(s, args, 0);
+        break;
+    case INDEX_op_qemu_ld8s:
+        tcg_out_qemu_ld(s, args, 0 | 4);
+        break;
+    case INDEX_op_qemu_ld16u:
+        tcg_out_qemu_ld(s, args, 1);
+        break;
+    case INDEX_op_qemu_ld16s:
+        tcg_out_qemu_ld(s, args, 1 | 4);
+        break;
+    case INDEX_op_qemu_ld32u:
+        tcg_out_qemu_ld(s, args, 2);
+        break;
+
+    case INDEX_op_qemu_st8:
+        tcg_out_qemu_st(s, args, 0);
+        break;
+    case INDEX_op_qemu_st16:
+        tcg_out_qemu_st(s, args, 1);
+        break;
+    case INDEX_op_qemu_st32:
+        tcg_out_qemu_st(s, args, 2);
+        break;
+
+    default:
+        fprintf(stderr, "unknown opcode 0x%x\n", opc);
+        tcg_abort();
+    }
+    return;
+
+gen_arith:
+    tcg_out_arith(s, args[0], args[1], args[2], c);
+}
+
+static const TCGTargetOpDef hppa_op_defs[] = {
+    { INDEX_op_exit_tb, { } },
+    { INDEX_op_goto_tb, { } },
+
+    { INDEX_op_call, { "r" } },
+    { INDEX_op_jmp, { "r" } },
+    { INDEX_op_br, { } },
+
+    { INDEX_op_mov_i32, { "r", "r" } },
+    { INDEX_op_movi_i32, { "r" } },
+    { INDEX_op_ld8u_i32, { "r", "r" } },
+    { INDEX_op_ld8s_i32, { "r", "r" } },
+    { INDEX_op_ld16u_i32, { "r", "r" } },
+    { INDEX_op_ld16s_i32, { "r", "r" } },
+    { INDEX_op_ld_i32, { "r", "r" } },
+    { INDEX_op_st8_i32, { "r", "r" } },
+    { INDEX_op_st16_i32, { "r", "r" } },
+    { INDEX_op_st_i32, { "r", "r" } },
+
+    { INDEX_op_add_i32, { "r", "r", "r" } },
+    { INDEX_op_sub_i32, { "r", "r", "r" } },
+    { INDEX_op_and_i32, { "r", "r", "r" } },
+    { INDEX_op_or_i32, { "r", "r", "r" } },
+    { INDEX_op_xor_i32, { "r", "r", "r" } },
+
+    { INDEX_op_shl_i32, { "r", "r", "r" } },
+    { INDEX_op_shr_i32, { "r", "r", "r" } },
+    { INDEX_op_sar_i32, { "r", "r", "r" } },
+
+    { INDEX_op_brcond_i32, { "r", "r" } },
+
+#if TARGET_LONG_BITS == 32
+    { INDEX_op_qemu_ld8u, { "r", "L" } },
+    { INDEX_op_qemu_ld8s, { "r", "L" } },
+    { INDEX_op_qemu_ld16u, { "r", "L" } },
+    { INDEX_op_qemu_ld16s, { "r", "L" } },
+    { INDEX_op_qemu_ld32u, { "r", "L" } },
+    { INDEX_op_qemu_ld64, { "r", "r", "L" } },
+
+    { INDEX_op_qemu_st8, { "L", "L" } },
+    { INDEX_op_qemu_st16, { "L", "L" } },
+    { INDEX_op_qemu_st32, { "L", "L" } },
+    { INDEX_op_qemu_st64, { "L", "L", "L" } },
+#else
+    { INDEX_op_qemu_ld8u, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld8s, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld16u, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld16s, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld32u, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld32s, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld64, { "r", "r", "L", "L" } },
+
+    { INDEX_op_qemu_st8, { "L", "L", "L" } },
+    { INDEX_op_qemu_st16, { "L", "L", "L" } },
+    { INDEX_op_qemu_st32, { "L", "L", "L" } },
+    { INDEX_op_qemu_st64, { "L", "L", "L", "L" } },
+#endif
+    { -1 },
+};
+
+void tcg_target_init(TCGContext *s)
+{
+    tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I32], 0, 0xffffffff);
+    tcg_regset_set32(tcg_target_call_clobber_regs, 0,
+                     (1 << TCG_REG_R20) |
+                     (1 << TCG_REG_R21) |
+                     (1 << TCG_REG_R22) |
+                     (1 << TCG_REG_R23) |
+                     (1 << TCG_REG_R24) |
+                     (1 << TCG_REG_R25) |
+                     (1 << TCG_REG_R26));
+
+    tcg_regset_clear(s->reserved_regs);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R0);  /* hardwired to zero */
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R1);  /* addil target */
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_RP);  /* link register */
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R3);  /* frame pointer */
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R18); /* return pointer */
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R19); /* clobbered w/o pic */
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R20); /* reserved */
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_DP);  /* data pointer */
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_SP);  /* stack pointer */
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R31); /* ble link reg */
+
+    tcg_add_target_add_op_defs(hppa_op_defs);
+}
diff --git a/tcg/hppa/tcg-target.h b/tcg/hppa/tcg-target.h
new file mode 100644
index 0000000..8e2693d
--- /dev/null
+++ b/tcg/hppa/tcg-target.h
@@ -0,0 +1,204 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#define TCG_TARGET_HPPA 1
+
+#if defined(_PA_RISC1_1)
+#define TCG_TARGET_REG_BITS 32
+#else
+#error unsupported
+#endif
+
+#define TCG_TARGET_WORDS_BIGENDIAN
+
+#define TCG_TARGET_NB_REGS 32
+
+enum {
+    TCG_REG_R0 = 0,
+    TCG_REG_R1,
+    TCG_REG_RP,
+    TCG_REG_R3,
+    TCG_REG_R4,
+    TCG_REG_R5,
+    TCG_REG_R6,
+    TCG_REG_R7,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10,
+    TCG_REG_R11,
+    TCG_REG_R12,
+    TCG_REG_R13,
+    TCG_REG_R14,
+    TCG_REG_R15,
+    TCG_REG_R16,
+    TCG_REG_R17,
+    TCG_REG_R18,
+    TCG_REG_R19,
+    TCG_REG_R20,
+    TCG_REG_R21,
+    TCG_REG_R22,
+    TCG_REG_R23,
+    TCG_REG_R24,
+    TCG_REG_R25,
+    TCG_REG_R26,
+    TCG_REG_DP,
+    TCG_REG_RET0,
+    TCG_REG_RET1,
+    TCG_REG_SP,
+    TCG_REG_R31,
+};
+
+/* used for function call generation */
+#define TCG_REG_CALL_STACK TCG_REG_SP
+#define TCG_TARGET_STACK_ALIGN 16
+#define TCG_TARGET_STACK_GROWSUP
+
+/* optional instructions */
+//#define TCG_TARGET_HAS_ext8s_i32
+//#define TCG_TARGET_HAS_ext16s_i32
+//#define TCG_TARGET_HAS_bswap16_i32
+//#define TCG_TARGET_HAS_bswap_i32
+
+/* Note: must be synced with dyngen-exec.h */
+#define TCG_AREG0 TCG_REG_R17
+#define TCG_AREG1 TCG_REG_R14
+#define TCG_AREG2 TCG_REG_R15
+#define TCG_AREG3 TCG_REG_R16
+
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
+{
+    start &= ~31;
+    while (start <= stop)
+    {
+        asm volatile ("fdc 0(%0)\n"
+                      "sync\n"
+                      "fic 0(%%sr4, %0)\n"
+                      "sync\n"
+                      : : "r"(start) : "memory");
+        start += 32;
+    }
+}
+
+/* supplied by libgcc */
+extern void *__canonicalize_funcptr_for_compare(void *);
+
+/* Field selection types defined by hppa */
+#define rnd(x)                  (((x)+0x1000)&~0x1fff)
+/* lsel: select left 21 bits */
+#define lsel(v,a)               (((v)+(a))>>11)
+/* rsel: select right 11 bits */
+#define rsel(v,a)               (((v)+(a))&0x7ff)
+/* lrsel with rounding of addend to nearest 8k */
+#define lrsel(v,a)              (((v)+rnd(a))>>11)
+/* rrsel with rounding of addend to nearest 8k */
+#define rrsel(v,a)              ((((v)+rnd(a))&0x7ff)+((a)-rnd(a)))
+
+#define mask(x,sz)              ((x) & ~((1<<(sz))-1))
+
+static inline int reassemble_12(int as12)
+{
+    return (((as12 & 0x800) >> 11) |
+            ((as12 & 0x400) >> 8) |
+            ((as12 & 0x3ff) << 3));
+}
+
+static inline int reassemble_14(int as14)
+{
+    return (((as14 & 0x1fff) << 1) |
+            ((as14 & 0x2000) >> 13));
+}
+
+static inline int reassemble_17(int as17)
+{
+    return (((as17 & 0x10000) >> 16) |
+            ((as17 & 0x0f800) << 5) |
+            ((as17 & 0x00400) >> 8) |
+            ((as17 & 0x003ff) << 3));
+}
+
+static inline int reassemble_21(int as21)
+{
+    return (((as21 & 0x100000) >> 20) |
+            ((as21 & 0x0ffe00) >> 8) |
+            ((as21 & 0x000180) << 7) |
+            ((as21 & 0x00007c) << 14) |
+            ((as21 & 0x000003) << 12));
+}
+
+static inline void hppa_patch21l(uint32_t *insn, int val, int addend)
+{
+    val = lrsel(val, addend);
+    *insn = mask(*insn, 21) | reassemble_21(val);
+}
+
+static inline void hppa_patch14r(uint32_t *insn, int val, int addend)
+{
+    val = rrsel(val, addend);
+    *insn = mask(*insn, 14) | reassemble_14(val);
+}
+
+static inline void hppa_patch17r(uint32_t *insn, int val, int addend)
+{
+    val = rrsel(val, addend);
+    *insn = (*insn & ~0x1f1ffd) | reassemble_17(val);
+}
+
+
+static inline void hppa_patch21l_dprel(uint32_t *insn, int val, int addend)
+{
+    register unsigned int dp asm("r27");
+    hppa_patch21l(insn, val - dp, addend);
+}
+
+static inline void hppa_patch14r_dprel(uint32_t *insn, int val, int addend)
+{
+    register unsigned int dp asm("r27");
+    hppa_patch14r(insn, val - dp, addend);
+}
+
+static inline void hppa_patch17f(uint32_t *insn, int val, int addend)
+{
+    int dot = (int)insn & ~0x3;
+    int v = ((val + addend) - dot - 8) / 4;
+    if (v > (1 << 16) || v < -(1 << 16)) {
+        printf("cannot fit branch to offset %d [%08x->%08x]\n", v, dot, val);
+        abort();
+    }
+    *insn = (*insn & ~0x1f1ffd) | reassemble_17(v);
+}
+
+static inline void hppa_load_imm21l(uint32_t *insn, int val, int addend)
+{
+    /* Transform addil L'sym(%dp) to ldil L'val, %r1 */
+    *insn = 0x20200000 | reassemble_21(lrsel(val, 0));
+}
+
+static inline void hppa_load_imm14r(uint32_t *insn, int val, int addend)
+{
+    /* Transform ldw R'sym(%r1), %rN to ldo R'sym(%r1), %rN */
+    hppa_patch14r(insn, val, addend);
+    /* HACK */
+    if (addend == 0)
+        *insn = (*insn & ~0xfc000000) | (0x0d << 26);
+}
diff --git a/tcg/i386/tcg-target.c b/tcg/i386/tcg-target.c
new file mode 100644
index 0000000..08bb783
--- /dev/null
+++ b/tcg/i386/tcg-target.c
@@ -0,0 +1,1185 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+const char *tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+    "%eax",
+    "%ecx",
+    "%edx",
+    "%ebx",
+    "%esp",
+    "%ebp",
+    "%esi",
+    "%edi",
+};
+
+int tcg_target_reg_alloc_order[] = {
+    TCG_REG_EAX,
+    TCG_REG_EDX,
+    TCG_REG_ECX,
+    TCG_REG_EBX,
+    TCG_REG_ESI,
+    TCG_REG_EDI,
+    TCG_REG_EBP,
+};
+
+const int tcg_target_call_iarg_regs[3] = { TCG_REG_EAX, TCG_REG_EDX, TCG_REG_ECX };
+const int tcg_target_call_oarg_regs[2] = { TCG_REG_EAX, TCG_REG_EDX };
+
+static uint8_t *tb_ret_addr;
+
+static void patch_reloc(uint8_t *code_ptr, int type, 
+                        tcg_target_long value, tcg_target_long addend)
+{
+    value += addend;
+    switch(type) {
+    case R_386_32:
+        *(uint32_t *)code_ptr = value;
+        break;
+    case R_386_PC32:
+        *(uint32_t *)code_ptr = value - (long)code_ptr;
+        break;
+    default:
+        tcg_abort();
+    }
+}
+
+/* maximum number of register used for input function arguments */
+static inline int tcg_target_get_call_iarg_regs_count(int flags)
+{
+    flags &= TCG_CALL_TYPE_MASK;
+    switch(flags) {
+    case TCG_CALL_TYPE_STD:
+        return 0;
+    case TCG_CALL_TYPE_REGPARM_1:
+    case TCG_CALL_TYPE_REGPARM_2:
+    case TCG_CALL_TYPE_REGPARM:
+        return flags - TCG_CALL_TYPE_REGPARM_1 + 1;
+    default:
+        tcg_abort();
+    }
+}
+
+/* parse target specific constraints */
+int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+{
+    const char *ct_str;
+
+    ct_str = *pct_str;
+    switch(ct_str[0]) {
+    case 'a':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_EAX);
+        break;
+    case 'b':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_EBX);
+        break;
+    case 'c':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_ECX);
+        break;
+    case 'd':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDX);
+        break;
+    case 'S':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_ESI);
+        break;
+    case 'D':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_EDI);
+        break;
+    case 'q':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xf);
+        break;
+    case 'r':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xff);
+        break;
+
+        /* qemu_ld/st address constraint */
+    case 'L':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xff);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_EAX);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_EDX);
+        break;
+    default:
+        return -1;
+    }
+    ct_str++;
+    *pct_str = ct_str;
+    return 0;
+}
+
+/* test if a constant matches the constraint */
+static inline int tcg_target_const_match(tcg_target_long val,
+                                         const TCGArgConstraint *arg_ct)
+{
+    int ct;
+    ct = arg_ct->ct;
+    if (ct & TCG_CT_CONST)
+        return 1;
+    else
+        return 0;
+}
+
+#define ARITH_ADD 0
+#define ARITH_OR  1
+#define ARITH_ADC 2
+#define ARITH_SBB 3
+#define ARITH_AND 4
+#define ARITH_SUB 5
+#define ARITH_XOR 6
+#define ARITH_CMP 7
+
+#define SHIFT_SHL 4
+#define SHIFT_SHR 5
+#define SHIFT_SAR 7
+
+#define JCC_JMP (-1)
+#define JCC_JO  0x0
+#define JCC_JNO 0x1
+#define JCC_JB  0x2
+#define JCC_JAE 0x3
+#define JCC_JE  0x4
+#define JCC_JNE 0x5
+#define JCC_JBE 0x6
+#define JCC_JA  0x7
+#define JCC_JS  0x8
+#define JCC_JNS 0x9
+#define JCC_JP  0xa
+#define JCC_JNP 0xb
+#define JCC_JL  0xc
+#define JCC_JGE 0xd
+#define JCC_JLE 0xe
+#define JCC_JG  0xf
+
+#define P_EXT   0x100 /* 0x0f opcode prefix */
+
+static const uint8_t tcg_cond_to_jcc[10] = {
+    [TCG_COND_EQ] = JCC_JE,
+    [TCG_COND_NE] = JCC_JNE,
+    [TCG_COND_LT] = JCC_JL,
+    [TCG_COND_GE] = JCC_JGE,
+    [TCG_COND_LE] = JCC_JLE,
+    [TCG_COND_GT] = JCC_JG,
+    [TCG_COND_LTU] = JCC_JB,
+    [TCG_COND_GEU] = JCC_JAE,
+    [TCG_COND_LEU] = JCC_JBE,
+    [TCG_COND_GTU] = JCC_JA,
+};
+
+static inline void tcg_out_opc(TCGContext *s, int opc)
+{
+    if (opc & P_EXT)
+        tcg_out8(s, 0x0f);
+    tcg_out8(s, opc);
+}
+
+static inline void tcg_out_modrm(TCGContext *s, int opc, int r, int rm)
+{
+    tcg_out_opc(s, opc);
+    tcg_out8(s, 0xc0 | (r << 3) | rm);
+}
+
+/* rm == -1 means no register index */
+static inline void tcg_out_modrm_offset(TCGContext *s, int opc, int r, int rm, 
+                                        int32_t offset)
+{
+    tcg_out_opc(s, opc);
+    if (rm == -1) {
+        tcg_out8(s, 0x05 | (r << 3));
+        tcg_out32(s, offset);
+    } else if (offset == 0 && rm != TCG_REG_EBP) {
+        if (rm == TCG_REG_ESP) {
+            tcg_out8(s, 0x04 | (r << 3));
+            tcg_out8(s, 0x24);
+        } else {
+            tcg_out8(s, 0x00 | (r << 3) | rm);
+        }
+    } else if ((int8_t)offset == offset) {
+        if (rm == TCG_REG_ESP) {
+            tcg_out8(s, 0x44 | (r << 3));
+            tcg_out8(s, 0x24);
+        } else {
+            tcg_out8(s, 0x40 | (r << 3) | rm);
+        }
+        tcg_out8(s, offset);
+    } else {
+        if (rm == TCG_REG_ESP) {
+            tcg_out8(s, 0x84 | (r << 3));
+            tcg_out8(s, 0x24);
+        } else {
+            tcg_out8(s, 0x80 | (r << 3) | rm);
+        }
+        tcg_out32(s, offset);
+    }
+}
+
+static inline void tcg_out_mov(TCGContext *s, int ret, int arg)
+{
+    if (arg != ret)
+        tcg_out_modrm(s, 0x8b, ret, arg);
+}
+
+static inline void tcg_out_movi(TCGContext *s, TCGType type,
+                                int ret, int32_t arg)
+{
+    if (arg == 0) {
+        /* xor r0,r0 */
+        tcg_out_modrm(s, 0x01 | (ARITH_XOR << 3), ret, ret);
+    } else {
+        tcg_out8(s, 0xb8 + ret);
+        tcg_out32(s, arg);
+    }
+}
+
+static inline void tcg_out_ld(TCGContext *s, TCGType type, int ret,
+                              int arg1, tcg_target_long arg2)
+{
+    /* movl */
+    tcg_out_modrm_offset(s, 0x8b, ret, arg1, arg2);
+}
+
+static inline void tcg_out_st(TCGContext *s, TCGType type, int arg,
+                              int arg1, tcg_target_long arg2)
+{
+    /* movl */
+    tcg_out_modrm_offset(s, 0x89, arg, arg1, arg2);
+}
+
+static inline void tgen_arithi(TCGContext *s, int c, int r0, int32_t val)
+{
+    if (val == (int8_t)val) {
+        tcg_out_modrm(s, 0x83, c, r0);
+        tcg_out8(s, val);
+    } else {
+        tcg_out_modrm(s, 0x81, c, r0);
+        tcg_out32(s, val);
+    }
+}
+
+void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
+{
+    if (val != 0)
+        tgen_arithi(s, ARITH_ADD, reg, val);
+}
+
+static void tcg_out_jxx(TCGContext *s, int opc, int label_index)
+{
+    int32_t val, val1;
+    TCGLabel *l = &s->labels[label_index];
+    
+    if (l->has_value) {
+        val = l->u.value - (tcg_target_long)s->code_ptr;
+        val1 = val - 2;
+        if ((int8_t)val1 == val1) {
+            if (opc == -1)
+                tcg_out8(s, 0xeb);
+            else
+                tcg_out8(s, 0x70 + opc);
+            tcg_out8(s, val1);
+        } else {
+            if (opc == -1) {
+                tcg_out8(s, 0xe9);
+                tcg_out32(s, val - 5);
+            } else {
+                tcg_out8(s, 0x0f);
+                tcg_out8(s, 0x80 + opc);
+                tcg_out32(s, val - 6);
+            }
+        }
+    } else {
+        if (opc == -1) {
+            tcg_out8(s, 0xe9);
+        } else {
+            tcg_out8(s, 0x0f);
+            tcg_out8(s, 0x80 + opc);
+        }
+        tcg_out_reloc(s, s->code_ptr, R_386_PC32, label_index, -4);
+        s->code_ptr += 4;
+    }
+}
+
+static void tcg_out_brcond(TCGContext *s, int cond, 
+                           TCGArg arg1, TCGArg arg2, int const_arg2,
+                           int label_index)
+{
+    if (const_arg2) {
+        if (arg2 == 0) {
+            /* test r, r */
+            tcg_out_modrm(s, 0x85, arg1, arg1);
+        } else {
+            tgen_arithi(s, ARITH_CMP, arg1, arg2);
+        }
+    } else {
+        tcg_out_modrm(s, 0x01 | (ARITH_CMP << 3), arg2, arg1);
+    }
+    tcg_out_jxx(s, tcg_cond_to_jcc[cond], label_index);
+}
+
+/* XXX: we implement it at the target level to avoid having to
+   handle cross basic blocks temporaries */
+static void tcg_out_brcond2(TCGContext *s,
+                            const TCGArg *args, const int *const_args)
+{
+    int label_next;
+    label_next = gen_new_label();
+    switch(args[4]) {
+    case TCG_COND_EQ:
+        tcg_out_brcond(s, TCG_COND_NE, args[0], args[2], const_args[2], label_next);
+        tcg_out_brcond(s, TCG_COND_EQ, args[1], args[3], const_args[3], args[5]);
+        break;
+    case TCG_COND_NE:
+        tcg_out_brcond(s, TCG_COND_NE, args[0], args[2], const_args[2], args[5]);
+        tcg_out_brcond(s, TCG_COND_NE, args[1], args[3], const_args[3], args[5]);
+        break;
+    case TCG_COND_LT:
+        tcg_out_brcond(s, TCG_COND_LT, args[1], args[3], const_args[3], args[5]);
+        tcg_out_jxx(s, JCC_JNE, label_next);
+        tcg_out_brcond(s, TCG_COND_LTU, args[0], args[2], const_args[2], args[5]);
+        break;
+    case TCG_COND_LE:
+        tcg_out_brcond(s, TCG_COND_LT, args[1], args[3], const_args[3], args[5]);
+        tcg_out_jxx(s, JCC_JNE, label_next);
+        tcg_out_brcond(s, TCG_COND_LEU, args[0], args[2], const_args[2], args[5]);
+        break;
+    case TCG_COND_GT:
+        tcg_out_brcond(s, TCG_COND_GT, args[1], args[3], const_args[3], args[5]);
+        tcg_out_jxx(s, JCC_JNE, label_next);
+        tcg_out_brcond(s, TCG_COND_GTU, args[0], args[2], const_args[2], args[5]);
+        break;
+    case TCG_COND_GE:
+        tcg_out_brcond(s, TCG_COND_GT, args[1], args[3], const_args[3], args[5]);
+        tcg_out_jxx(s, JCC_JNE, label_next);
+        tcg_out_brcond(s, TCG_COND_GEU, args[0], args[2], const_args[2], args[5]);
+        break;
+    case TCG_COND_LTU:
+        tcg_out_brcond(s, TCG_COND_LTU, args[1], args[3], const_args[3], args[5]);
+        tcg_out_jxx(s, JCC_JNE, label_next);
+        tcg_out_brcond(s, TCG_COND_LTU, args[0], args[2], const_args[2], args[5]);
+        break;
+    case TCG_COND_LEU:
+        tcg_out_brcond(s, TCG_COND_LTU, args[1], args[3], const_args[3], args[5]);
+        tcg_out_jxx(s, JCC_JNE, label_next);
+        tcg_out_brcond(s, TCG_COND_LEU, args[0], args[2], const_args[2], args[5]);
+        break;
+    case TCG_COND_GTU:
+        tcg_out_brcond(s, TCG_COND_GTU, args[1], args[3], const_args[3], args[5]);
+        tcg_out_jxx(s, JCC_JNE, label_next);
+        tcg_out_brcond(s, TCG_COND_GTU, args[0], args[2], const_args[2], args[5]);
+        break;
+    case TCG_COND_GEU:
+        tcg_out_brcond(s, TCG_COND_GTU, args[1], args[3], const_args[3], args[5]);
+        tcg_out_jxx(s, JCC_JNE, label_next);
+        tcg_out_brcond(s, TCG_COND_GEU, args[0], args[2], const_args[2], args[5]);
+        break;
+    default:
+        tcg_abort();
+    }
+    tcg_out_label(s, label_next, (tcg_target_long)s->code_ptr);
+}
+
+#if defined(CONFIG_SOFTMMU)
+
+#include "../../softmmu_defs.h"
+
+static void *qemu_ld_helpers[4] = {
+    __ldb_mmu,
+    __ldw_mmu,
+    __ldl_mmu,
+    __ldq_mmu,
+};
+
+static void *qemu_st_helpers[4] = {
+    __stb_mmu,
+    __stw_mmu,
+    __stl_mmu,
+    __stq_mmu,
+};
+#endif
+
+/* XXX: qemu_ld and qemu_st could be modified to clobber only EDX and
+   EAX. It will be useful once fixed registers globals are less
+   common. */
+static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+                            int opc)
+{
+    int addr_reg, data_reg, data_reg2, r0, r1, mem_index, s_bits, bswap;
+#if defined(CONFIG_SOFTMMU)
+    uint8_t *label1_ptr, *label2_ptr;
+#endif
+#if TARGET_LONG_BITS == 64
+#if defined(CONFIG_SOFTMMU)
+    uint8_t *label3_ptr;
+#endif
+    int addr_reg2;
+#endif
+
+    data_reg = *args++;
+    if (opc == 3)
+        data_reg2 = *args++;
+    else
+        data_reg2 = 0;
+    addr_reg = *args++;
+#if TARGET_LONG_BITS == 64
+    addr_reg2 = *args++;
+#endif
+    mem_index = *args;
+    s_bits = opc & 3;
+
+    r0 = TCG_REG_EAX;
+    r1 = TCG_REG_EDX;
+
+#if defined(CONFIG_SOFTMMU)
+    tcg_out_mov(s, r1, addr_reg); 
+
+    tcg_out_mov(s, r0, addr_reg); 
+ 
+    tcg_out_modrm(s, 0xc1, 5, r1); /* shr $x, r1 */
+    tcg_out8(s, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS); 
+    
+    tcg_out_modrm(s, 0x81, 4, r0); /* andl $x, r0 */
+    tcg_out32(s, TARGET_PAGE_MASK | ((1 << s_bits) - 1));
+    
+    tcg_out_modrm(s, 0x81, 4, r1); /* andl $x, r1 */
+    tcg_out32(s, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS);
+
+    tcg_out_opc(s, 0x8d); /* lea offset(r1, %ebp), r1 */
+    tcg_out8(s, 0x80 | (r1 << 3) | 0x04);
+    tcg_out8(s, (5 << 3) | r1);
+    tcg_out32(s, offsetof(CPUState, tlb_table[mem_index][0].addr_read));
+
+    /* cmp 0(r1), r0 */
+    tcg_out_modrm_offset(s, 0x3b, r0, r1, 0);
+    
+    tcg_out_mov(s, r0, addr_reg);
+    
+#if TARGET_LONG_BITS == 32
+    /* je label1 */
+    tcg_out8(s, 0x70 + JCC_JE);
+    label1_ptr = s->code_ptr;
+    s->code_ptr++;
+#else
+    /* jne label3 */
+    tcg_out8(s, 0x70 + JCC_JNE);
+    label3_ptr = s->code_ptr;
+    s->code_ptr++;
+    
+    /* cmp 4(r1), addr_reg2 */
+    tcg_out_modrm_offset(s, 0x3b, addr_reg2, r1, 4);
+
+    /* je label1 */
+    tcg_out8(s, 0x70 + JCC_JE);
+    label1_ptr = s->code_ptr;
+    s->code_ptr++;
+    
+    /* label3: */
+    *label3_ptr = s->code_ptr - label3_ptr - 1;
+#endif
+
+    /* XXX: move that code at the end of the TB */
+#if TARGET_LONG_BITS == 32
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_EDX, mem_index);
+#else
+    tcg_out_mov(s, TCG_REG_EDX, addr_reg2);
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_ECX, mem_index);
+#endif
+    tcg_out8(s, 0xe8);
+    tcg_out32(s, (tcg_target_long)qemu_ld_helpers[s_bits] - 
+              (tcg_target_long)s->code_ptr - 4);
+
+    switch(opc) {
+    case 0 | 4:
+        /* movsbl */
+        tcg_out_modrm(s, 0xbe | P_EXT, data_reg, TCG_REG_EAX);
+        break;
+    case 1 | 4:
+        /* movswl */
+        tcg_out_modrm(s, 0xbf | P_EXT, data_reg, TCG_REG_EAX);
+        break;
+    case 0:
+    case 1:
+    case 2:
+    default:
+        tcg_out_mov(s, data_reg, TCG_REG_EAX);
+        break;
+    case 3:
+        if (data_reg == TCG_REG_EDX) {
+            tcg_out_opc(s, 0x90 + TCG_REG_EDX); /* xchg %edx, %eax */
+            tcg_out_mov(s, data_reg2, TCG_REG_EAX);
+        } else {
+            tcg_out_mov(s, data_reg, TCG_REG_EAX);
+            tcg_out_mov(s, data_reg2, TCG_REG_EDX);
+        }
+        break;
+    }
+
+    /* jmp label2 */
+    tcg_out8(s, 0xeb);
+    label2_ptr = s->code_ptr;
+    s->code_ptr++;
+    
+    /* label1: */
+    *label1_ptr = s->code_ptr - label1_ptr - 1;
+
+    /* add x(r1), r0 */
+    tcg_out_modrm_offset(s, 0x03, r0, r1, offsetof(CPUTLBEntry, addend) - 
+                         offsetof(CPUTLBEntry, addr_read));
+#else
+    r0 = addr_reg;
+#endif
+
+#ifdef TARGET_WORDS_BIGENDIAN
+    bswap = 1;
+#else
+    bswap = 0;
+#endif
+    switch(opc) {
+    case 0:
+        /* movzbl */
+        tcg_out_modrm_offset(s, 0xb6 | P_EXT, data_reg, r0, 0);
+        break;
+    case 0 | 4:
+        /* movsbl */
+        tcg_out_modrm_offset(s, 0xbe | P_EXT, data_reg, r0, 0);
+        break;
+    case 1:
+        /* movzwl */
+        tcg_out_modrm_offset(s, 0xb7 | P_EXT, data_reg, r0, 0);
+        if (bswap) {
+            /* rolw $8, data_reg */
+            tcg_out8(s, 0x66); 
+            tcg_out_modrm(s, 0xc1, 0, data_reg);
+            tcg_out8(s, 8);
+        }
+        break;
+    case 1 | 4:
+        /* movswl */
+        tcg_out_modrm_offset(s, 0xbf | P_EXT, data_reg, r0, 0);
+        if (bswap) {
+            /* rolw $8, data_reg */
+            tcg_out8(s, 0x66); 
+            tcg_out_modrm(s, 0xc1, 0, data_reg);
+            tcg_out8(s, 8);
+
+            /* movswl data_reg, data_reg */
+            tcg_out_modrm(s, 0xbf | P_EXT, data_reg, data_reg);
+        }
+        break;
+    case 2:
+        /* movl (r0), data_reg */
+        tcg_out_modrm_offset(s, 0x8b, data_reg, r0, 0);
+        if (bswap) {
+            /* bswap */
+            tcg_out_opc(s, (0xc8 + data_reg) | P_EXT);
+        }
+        break;
+    case 3:
+        /* XXX: could be nicer */
+        if (r0 == data_reg) {
+            r1 = TCG_REG_EDX;
+            if (r1 == data_reg)
+                r1 = TCG_REG_EAX;
+            tcg_out_mov(s, r1, r0);
+            r0 = r1;
+        }
+        if (!bswap) {
+            tcg_out_modrm_offset(s, 0x8b, data_reg, r0, 0);
+            tcg_out_modrm_offset(s, 0x8b, data_reg2, r0, 4);
+        } else {
+            tcg_out_modrm_offset(s, 0x8b, data_reg, r0, 4);
+            tcg_out_opc(s, (0xc8 + data_reg) | P_EXT);
+
+            tcg_out_modrm_offset(s, 0x8b, data_reg2, r0, 0);
+            /* bswap */
+            tcg_out_opc(s, (0xc8 + data_reg2) | P_EXT);
+        }
+        break;
+    default:
+        tcg_abort();
+    }
+
+#if defined(CONFIG_SOFTMMU)
+    /* label2: */
+    *label2_ptr = s->code_ptr - label2_ptr - 1;
+#endif
+}
+
+
+static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+                            int opc)
+{
+    int addr_reg, data_reg, data_reg2, r0, r1, mem_index, s_bits, bswap;
+#if defined(CONFIG_SOFTMMU)
+    uint8_t *label1_ptr, *label2_ptr;
+#endif
+#if TARGET_LONG_BITS == 64
+#if defined(CONFIG_SOFTMMU)
+    uint8_t *label3_ptr;
+#endif
+    int addr_reg2;
+#endif
+
+    data_reg = *args++;
+    if (opc == 3)
+        data_reg2 = *args++;
+    else
+        data_reg2 = 0;
+    addr_reg = *args++;
+#if TARGET_LONG_BITS == 64
+    addr_reg2 = *args++;
+#endif
+    mem_index = *args;
+
+    s_bits = opc;
+
+    r0 = TCG_REG_EAX;
+    r1 = TCG_REG_EDX;
+
+#if defined(CONFIG_SOFTMMU)
+    tcg_out_mov(s, r1, addr_reg); 
+
+    tcg_out_mov(s, r0, addr_reg); 
+ 
+    tcg_out_modrm(s, 0xc1, 5, r1); /* shr $x, r1 */
+    tcg_out8(s, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS); 
+    
+    tcg_out_modrm(s, 0x81, 4, r0); /* andl $x, r0 */
+    tcg_out32(s, TARGET_PAGE_MASK | ((1 << s_bits) - 1));
+    
+    tcg_out_modrm(s, 0x81, 4, r1); /* andl $x, r1 */
+    tcg_out32(s, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS);
+
+    tcg_out_opc(s, 0x8d); /* lea offset(r1, %ebp), r1 */
+    tcg_out8(s, 0x80 | (r1 << 3) | 0x04);
+    tcg_out8(s, (5 << 3) | r1);
+    tcg_out32(s, offsetof(CPUState, tlb_table[mem_index][0].addr_write));
+
+    /* cmp 0(r1), r0 */
+    tcg_out_modrm_offset(s, 0x3b, r0, r1, 0);
+    
+    tcg_out_mov(s, r0, addr_reg);
+    
+#if TARGET_LONG_BITS == 32
+    /* je label1 */
+    tcg_out8(s, 0x70 + JCC_JE);
+    label1_ptr = s->code_ptr;
+    s->code_ptr++;
+#else
+    /* jne label3 */
+    tcg_out8(s, 0x70 + JCC_JNE);
+    label3_ptr = s->code_ptr;
+    s->code_ptr++;
+    
+    /* cmp 4(r1), addr_reg2 */
+    tcg_out_modrm_offset(s, 0x3b, addr_reg2, r1, 4);
+
+    /* je label1 */
+    tcg_out8(s, 0x70 + JCC_JE);
+    label1_ptr = s->code_ptr;
+    s->code_ptr++;
+    
+    /* label3: */
+    *label3_ptr = s->code_ptr - label3_ptr - 1;
+#endif
+
+    /* XXX: move that code at the end of the TB */
+#if TARGET_LONG_BITS == 32
+    if (opc == 3) {
+        tcg_out_mov(s, TCG_REG_EDX, data_reg);
+        tcg_out_mov(s, TCG_REG_ECX, data_reg2);
+        tcg_out8(s, 0x6a); /* push Ib */
+        tcg_out8(s, mem_index);
+        tcg_out8(s, 0xe8);
+        tcg_out32(s, (tcg_target_long)qemu_st_helpers[s_bits] - 
+                  (tcg_target_long)s->code_ptr - 4);
+        tcg_out_addi(s, TCG_REG_ESP, 4);
+    } else {
+        switch(opc) {
+        case 0:
+            /* movzbl */
+            tcg_out_modrm(s, 0xb6 | P_EXT, TCG_REG_EDX, data_reg);
+            break;
+        case 1:
+            /* movzwl */
+            tcg_out_modrm(s, 0xb7 | P_EXT, TCG_REG_EDX, data_reg);
+            break;
+        case 2:
+            tcg_out_mov(s, TCG_REG_EDX, data_reg);
+            break;
+        }
+        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_ECX, mem_index);
+        tcg_out8(s, 0xe8);
+        tcg_out32(s, (tcg_target_long)qemu_st_helpers[s_bits] - 
+                  (tcg_target_long)s->code_ptr - 4);
+    }
+#else
+    if (opc == 3) {
+        tcg_out_mov(s, TCG_REG_EDX, addr_reg2);
+        tcg_out8(s, 0x6a); /* push Ib */
+        tcg_out8(s, mem_index);
+        tcg_out_opc(s, 0x50 + data_reg2); /* push */
+        tcg_out_opc(s, 0x50 + data_reg); /* push */
+        tcg_out8(s, 0xe8);
+        tcg_out32(s, (tcg_target_long)qemu_st_helpers[s_bits] - 
+                  (tcg_target_long)s->code_ptr - 4);
+        tcg_out_addi(s, TCG_REG_ESP, 12);
+    } else {
+        tcg_out_mov(s, TCG_REG_EDX, addr_reg2);
+        switch(opc) {
+        case 0:
+            /* movzbl */
+            tcg_out_modrm(s, 0xb6 | P_EXT, TCG_REG_ECX, data_reg);
+            break;
+        case 1:
+            /* movzwl */
+            tcg_out_modrm(s, 0xb7 | P_EXT, TCG_REG_ECX, data_reg);
+            break;
+        case 2:
+            tcg_out_mov(s, TCG_REG_ECX, data_reg);
+            break;
+        }
+        tcg_out8(s, 0x6a); /* push Ib */
+        tcg_out8(s, mem_index);
+        tcg_out8(s, 0xe8);
+        tcg_out32(s, (tcg_target_long)qemu_st_helpers[s_bits] - 
+                  (tcg_target_long)s->code_ptr - 4);
+        tcg_out_addi(s, TCG_REG_ESP, 4);
+    }
+#endif
+    
+    /* jmp label2 */
+    tcg_out8(s, 0xeb);
+    label2_ptr = s->code_ptr;
+    s->code_ptr++;
+    
+    /* label1: */
+    *label1_ptr = s->code_ptr - label1_ptr - 1;
+
+    /* add x(r1), r0 */
+    tcg_out_modrm_offset(s, 0x03, r0, r1, offsetof(CPUTLBEntry, addend) - 
+                         offsetof(CPUTLBEntry, addr_write));
+#else
+    r0 = addr_reg;
+#endif
+
+#ifdef TARGET_WORDS_BIGENDIAN
+    bswap = 1;
+#else
+    bswap = 0;
+#endif
+    switch(opc) {
+    case 0:
+        /* movb */
+        tcg_out_modrm_offset(s, 0x88, data_reg, r0, 0);
+        break;
+    case 1:
+        if (bswap) {
+            tcg_out_mov(s, r1, data_reg);
+            tcg_out8(s, 0x66); /* rolw $8, %ecx */
+            tcg_out_modrm(s, 0xc1, 0, r1);
+            tcg_out8(s, 8);
+            data_reg = r1;
+        }
+        /* movw */
+        tcg_out8(s, 0x66);
+        tcg_out_modrm_offset(s, 0x89, data_reg, r0, 0);
+        break;
+    case 2:
+        if (bswap) {
+            tcg_out_mov(s, r1, data_reg);
+            /* bswap data_reg */
+            tcg_out_opc(s, (0xc8 + r1) | P_EXT);
+            data_reg = r1;
+        }
+        /* movl */
+        tcg_out_modrm_offset(s, 0x89, data_reg, r0, 0);
+        break;
+    case 3:
+        if (bswap) {
+            tcg_out_mov(s, r1, data_reg2);
+            /* bswap data_reg */
+            tcg_out_opc(s, (0xc8 + r1) | P_EXT);
+            tcg_out_modrm_offset(s, 0x89, r1, r0, 0);
+            tcg_out_mov(s, r1, data_reg);
+            /* bswap data_reg */
+            tcg_out_opc(s, (0xc8 + r1) | P_EXT);
+            tcg_out_modrm_offset(s, 0x89, r1, r0, 4);
+        } else {
+            tcg_out_modrm_offset(s, 0x89, data_reg, r0, 0);
+            tcg_out_modrm_offset(s, 0x89, data_reg2, r0, 4);
+        }
+        break;
+    default:
+        tcg_abort();
+    }
+
+#if defined(CONFIG_SOFTMMU)
+    /* label2: */
+    *label2_ptr = s->code_ptr - label2_ptr - 1;
+#endif
+}
+
+static inline void tcg_out_op(TCGContext *s, int opc, 
+                              const TCGArg *args, const int *const_args)
+{
+    int c;
+    
+    switch(opc) {
+    case INDEX_op_exit_tb:
+        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_EAX, args[0]);
+        tcg_out8(s, 0xe9); /* jmp tb_ret_addr */
+        tcg_out32(s, tb_ret_addr - s->code_ptr - 4);
+        break;
+    case INDEX_op_goto_tb:
+        if (s->tb_jmp_offset) {
+            /* direct jump method */
+            tcg_out8(s, 0xe9); /* jmp im */
+            s->tb_jmp_offset[args[0]] = s->code_ptr - s->code_buf;
+            tcg_out32(s, 0);
+        } else {
+            /* indirect jump method */
+            /* jmp Ev */
+            tcg_out_modrm_offset(s, 0xff, 4, -1, 
+                                 (tcg_target_long)(s->tb_next + args[0]));
+        }
+        s->tb_next_offset[args[0]] = s->code_ptr - s->code_buf;
+        break;
+    case INDEX_op_call:
+        if (const_args[0]) {
+            tcg_out8(s, 0xe8);
+            tcg_out32(s, args[0] - (tcg_target_long)s->code_ptr - 4);
+        } else {
+            tcg_out_modrm(s, 0xff, 2, args[0]);
+        }
+        break;
+    case INDEX_op_jmp:
+        if (const_args[0]) {
+            tcg_out8(s, 0xe9);
+            tcg_out32(s, args[0] - (tcg_target_long)s->code_ptr - 4);
+        } else {
+            tcg_out_modrm(s, 0xff, 4, args[0]);
+        }
+        break;
+    case INDEX_op_br:
+        tcg_out_jxx(s, JCC_JMP, args[0]);
+        break;
+    case INDEX_op_movi_i32:
+        tcg_out_movi(s, TCG_TYPE_I32, args[0], args[1]);
+        break;
+    case INDEX_op_ld8u_i32:
+        /* movzbl */
+        tcg_out_modrm_offset(s, 0xb6 | P_EXT, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld8s_i32:
+        /* movsbl */
+        tcg_out_modrm_offset(s, 0xbe | P_EXT, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld16u_i32:
+        /* movzwl */
+        tcg_out_modrm_offset(s, 0xb7 | P_EXT, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld16s_i32:
+        /* movswl */
+        tcg_out_modrm_offset(s, 0xbf | P_EXT, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld_i32:
+        /* movl */
+        tcg_out_modrm_offset(s, 0x8b, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_st8_i32:
+        /* movb */
+        tcg_out_modrm_offset(s, 0x88, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_st16_i32:
+        /* movw */
+        tcg_out8(s, 0x66);
+        tcg_out_modrm_offset(s, 0x89, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_st_i32:
+        /* movl */
+        tcg_out_modrm_offset(s, 0x89, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_sub_i32:
+        c = ARITH_SUB;
+        goto gen_arith;
+    case INDEX_op_and_i32:
+        c = ARITH_AND;
+        goto gen_arith;
+    case INDEX_op_or_i32:
+        c = ARITH_OR;
+        goto gen_arith;
+    case INDEX_op_xor_i32:
+        c = ARITH_XOR;
+        goto gen_arith;
+    case INDEX_op_add_i32:
+        c = ARITH_ADD;
+    gen_arith:
+        if (const_args[2]) {
+            tgen_arithi(s, c, args[0], args[2]);
+        } else {
+            tcg_out_modrm(s, 0x01 | (c << 3), args[2], args[0]);
+        }
+        break;
+    case INDEX_op_mul_i32:
+        if (const_args[2]) {
+            int32_t val;
+            val = args[2];
+            if (val == (int8_t)val) {
+                tcg_out_modrm(s, 0x6b, args[0], args[0]);
+                tcg_out8(s, val);
+            } else {
+                tcg_out_modrm(s, 0x69, args[0], args[0]);
+                tcg_out32(s, val);
+            }
+        } else {
+            tcg_out_modrm(s, 0xaf | P_EXT, args[0], args[2]);
+        }
+        break;
+    case INDEX_op_mulu2_i32:
+        tcg_out_modrm(s, 0xf7, 4, args[3]);
+        break;
+    case INDEX_op_div2_i32:
+        tcg_out_modrm(s, 0xf7, 7, args[4]);
+        break;
+    case INDEX_op_divu2_i32:
+        tcg_out_modrm(s, 0xf7, 6, args[4]);
+        break;
+    case INDEX_op_shl_i32:
+        c = SHIFT_SHL;
+    gen_shift32:
+        if (const_args[2]) {
+            if (args[2] == 1) {
+                tcg_out_modrm(s, 0xd1, c, args[0]);
+            } else {
+                tcg_out_modrm(s, 0xc1, c, args[0]);
+                tcg_out8(s, args[2]);
+            }
+        } else {
+            tcg_out_modrm(s, 0xd3, c, args[0]);
+        }
+        break;
+    case INDEX_op_shr_i32:
+        c = SHIFT_SHR;
+        goto gen_shift32;
+    case INDEX_op_sar_i32:
+        c = SHIFT_SAR;
+        goto gen_shift32;
+        
+    case INDEX_op_add2_i32:
+        if (const_args[4]) 
+            tgen_arithi(s, ARITH_ADD, args[0], args[4]);
+        else
+            tcg_out_modrm(s, 0x01 | (ARITH_ADD << 3), args[4], args[0]);
+        if (const_args[5]) 
+            tgen_arithi(s, ARITH_ADC, args[1], args[5]);
+        else
+            tcg_out_modrm(s, 0x01 | (ARITH_ADC << 3), args[5], args[1]);
+        break;
+    case INDEX_op_sub2_i32:
+        if (const_args[4]) 
+            tgen_arithi(s, ARITH_SUB, args[0], args[4]);
+        else
+            tcg_out_modrm(s, 0x01 | (ARITH_SUB << 3), args[4], args[0]);
+        if (const_args[5]) 
+            tgen_arithi(s, ARITH_SBB, args[1], args[5]);
+        else
+            tcg_out_modrm(s, 0x01 | (ARITH_SBB << 3), args[5], args[1]);
+        break;
+    case INDEX_op_brcond_i32:
+        tcg_out_brcond(s, args[2], args[0], args[1], const_args[1], args[3]);
+        break;
+    case INDEX_op_brcond2_i32:
+        tcg_out_brcond2(s, args, const_args);
+        break;
+
+    case INDEX_op_qemu_ld8u:
+        tcg_out_qemu_ld(s, args, 0);
+        break;
+    case INDEX_op_qemu_ld8s:
+        tcg_out_qemu_ld(s, args, 0 | 4);
+        break;
+    case INDEX_op_qemu_ld16u:
+        tcg_out_qemu_ld(s, args, 1);
+        break;
+    case INDEX_op_qemu_ld16s:
+        tcg_out_qemu_ld(s, args, 1 | 4);
+        break;
+    case INDEX_op_qemu_ld32u:
+        tcg_out_qemu_ld(s, args, 2);
+        break;
+    case INDEX_op_qemu_ld64:
+        tcg_out_qemu_ld(s, args, 3);
+        break;
+        
+    case INDEX_op_qemu_st8:
+        tcg_out_qemu_st(s, args, 0);
+        break;
+    case INDEX_op_qemu_st16:
+        tcg_out_qemu_st(s, args, 1);
+        break;
+    case INDEX_op_qemu_st32:
+        tcg_out_qemu_st(s, args, 2);
+        break;
+    case INDEX_op_qemu_st64:
+        tcg_out_qemu_st(s, args, 3);
+        break;
+
+    default:
+        tcg_abort();
+    }
+}
+
+static const TCGTargetOpDef x86_op_defs[] = {
+    { INDEX_op_exit_tb, { } },
+    { INDEX_op_goto_tb, { } },
+    { INDEX_op_call, { "ri" } },
+    { INDEX_op_jmp, { "ri" } },
+    { INDEX_op_br, { } },
+    { INDEX_op_mov_i32, { "r", "r" } },
+    { INDEX_op_movi_i32, { "r" } },
+    { INDEX_op_ld8u_i32, { "r", "r" } },
+    { INDEX_op_ld8s_i32, { "r", "r" } },
+    { INDEX_op_ld16u_i32, { "r", "r" } },
+    { INDEX_op_ld16s_i32, { "r", "r" } },
+    { INDEX_op_ld_i32, { "r", "r" } },
+    { INDEX_op_st8_i32, { "q", "r" } },
+    { INDEX_op_st16_i32, { "r", "r" } },
+    { INDEX_op_st_i32, { "r", "r" } },
+
+    { INDEX_op_add_i32, { "r", "0", "ri" } },
+    { INDEX_op_sub_i32, { "r", "0", "ri" } },
+    { INDEX_op_mul_i32, { "r", "0", "ri" } },
+    { INDEX_op_mulu2_i32, { "a", "d", "a", "r" } },
+    { INDEX_op_div2_i32, { "a", "d", "0", "1", "r" } },
+    { INDEX_op_divu2_i32, { "a", "d", "0", "1", "r" } },
+    { INDEX_op_and_i32, { "r", "0", "ri" } },
+    { INDEX_op_or_i32, { "r", "0", "ri" } },
+    { INDEX_op_xor_i32, { "r", "0", "ri" } },
+
+    { INDEX_op_shl_i32, { "r", "0", "ci" } },
+    { INDEX_op_shr_i32, { "r", "0", "ci" } },
+    { INDEX_op_sar_i32, { "r", "0", "ci" } },
+
+    { INDEX_op_brcond_i32, { "r", "ri" } },
+
+    { INDEX_op_add2_i32, { "r", "r", "0", "1", "ri", "ri" } },
+    { INDEX_op_sub2_i32, { "r", "r", "0", "1", "ri", "ri" } },
+    { INDEX_op_brcond2_i32, { "r", "r", "ri", "ri" } },
+
+#if TARGET_LONG_BITS == 32
+    { INDEX_op_qemu_ld8u, { "r", "L" } },
+    { INDEX_op_qemu_ld8s, { "r", "L" } },
+    { INDEX_op_qemu_ld16u, { "r", "L" } },
+    { INDEX_op_qemu_ld16s, { "r", "L" } },
+    { INDEX_op_qemu_ld32u, { "r", "L" } },
+    { INDEX_op_qemu_ld64, { "r", "r", "L" } },
+
+    { INDEX_op_qemu_st8, { "cb", "L" } },
+    { INDEX_op_qemu_st16, { "L", "L" } },
+    { INDEX_op_qemu_st32, { "L", "L" } },
+    { INDEX_op_qemu_st64, { "L", "L", "L" } },
+#else
+    { INDEX_op_qemu_ld8u, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld8s, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld16u, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld16s, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld32u, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld64, { "r", "r", "L", "L" } },
+
+    { INDEX_op_qemu_st8, { "cb", "L", "L" } },
+    { INDEX_op_qemu_st16, { "L", "L", "L" } },
+    { INDEX_op_qemu_st32, { "L", "L", "L" } },
+    { INDEX_op_qemu_st64, { "L", "L", "L", "L" } },
+#endif
+    { -1 },
+};
+
+static int tcg_target_callee_save_regs[] = {
+    /*    TCG_REG_EBP, */ /* currently used for the global env, so no
+                             need to save */
+    TCG_REG_EBX,
+    TCG_REG_ESI,
+    TCG_REG_EDI,
+};
+
+static inline void tcg_out_push(TCGContext *s, int reg)
+{
+    tcg_out_opc(s, 0x50 + reg);
+}
+
+static inline void tcg_out_pop(TCGContext *s, int reg)
+{
+    tcg_out_opc(s, 0x58 + reg);
+}
+
+/* Generate global QEMU prologue and epilogue code */
+void tcg_target_qemu_prologue(TCGContext *s)
+{
+    int i, frame_size, push_size, stack_addend;
+    
+    /* TB prologue */
+    /* save all callee saved registers */
+    for(i = 0; i < ARRAY_SIZE(tcg_target_callee_save_regs); i++) {
+        tcg_out_push(s, tcg_target_callee_save_regs[i]);
+    }
+    /* reserve some stack space */
+    push_size = 4 + ARRAY_SIZE(tcg_target_callee_save_regs) * 4;
+    frame_size = push_size + TCG_STATIC_CALL_ARGS_SIZE;
+    frame_size = (frame_size + TCG_TARGET_STACK_ALIGN - 1) & 
+        ~(TCG_TARGET_STACK_ALIGN - 1);
+    stack_addend = frame_size - push_size;
+    tcg_out_addi(s, TCG_REG_ESP, -stack_addend);
+
+    tcg_out_modrm(s, 0xff, 4, TCG_REG_EAX); /* jmp *%eax */
+    
+    /* TB epilogue */
+    tb_ret_addr = s->code_ptr;
+    tcg_out_addi(s, TCG_REG_ESP, stack_addend);
+    for(i = ARRAY_SIZE(tcg_target_callee_save_regs) - 1; i >= 0; i--) {
+        tcg_out_pop(s, tcg_target_callee_save_regs[i]);
+    }
+    tcg_out8(s, 0xc3); /* ret */
+}
+
+void tcg_target_init(TCGContext *s)
+{
+    /* fail safe */
+    if ((1 << CPU_TLB_ENTRY_BITS) != sizeof(CPUTLBEntry))
+        tcg_abort();
+
+    tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I32], 0, 0xff);
+    tcg_regset_set32(tcg_target_call_clobber_regs, 0,
+                     (1 << TCG_REG_EAX) | 
+                     (1 << TCG_REG_EDX) | 
+                     (1 << TCG_REG_ECX));
+    
+    tcg_regset_clear(s->reserved_regs);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_ESP);
+
+    tcg_add_target_add_op_defs(x86_op_defs);
+}
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
new file mode 100644
index 0000000..37fdaa5
--- /dev/null
+++ b/tcg/i386/tcg-target.h
@@ -0,0 +1,55 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#define TCG_TARGET_I386 1
+
+#define TCG_TARGET_REG_BITS 32
+//#define TCG_TARGET_WORDS_BIGENDIAN
+
+#define TCG_TARGET_NB_REGS 8
+
+enum {
+    TCG_REG_EAX = 0,
+    TCG_REG_ECX,
+    TCG_REG_EDX,
+    TCG_REG_EBX,
+    TCG_REG_ESP,
+    TCG_REG_EBP,
+    TCG_REG_ESI,
+    TCG_REG_EDI,
+};
+
+/* used for function call generation */
+#define TCG_REG_CALL_STACK TCG_REG_ESP 
+#define TCG_TARGET_STACK_ALIGN 16
+#define TCG_TARGET_CALL_STACK_OFFSET 0
+
+/* Note: must be synced with dyngen-exec.h */
+#define TCG_AREG0 TCG_REG_EBP
+#define TCG_AREG1 TCG_REG_EBX
+#define TCG_AREG2 TCG_REG_ESI
+#define TCG_AREG3 TCG_REG_EDI
+
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
+{
+}
diff --git a/tcg/ppc/tcg-target.c b/tcg/ppc/tcg-target.c
new file mode 100644
index 0000000..ad17468
--- /dev/null
+++ b/tcg/ppc/tcg-target.c
@@ -0,0 +1,1492 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+static uint8_t *tb_ret_addr;
+
+#ifdef __APPLE__
+#define LINKAGE_AREA_SIZE 24
+#define BACK_CHAIN_OFFSET 8
+#else
+#define LINKAGE_AREA_SIZE 8
+#define BACK_CHAIN_OFFSET 4
+#endif
+
+#define FAST_PATH
+#if TARGET_PHYS_ADDR_BITS <= 32
+#define ADDEND_OFFSET 0
+#else
+#define ADDEND_OFFSET 4
+#endif
+
+static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+    "r0",
+    "r1",
+    "rp",
+    "r3",
+    "r4",
+    "r5",
+    "r6",
+    "r7",
+    "r8",
+    "r9",
+    "r10",
+    "r11",
+    "r12",
+    "r13",
+    "r14",
+    "r15",
+    "r16",
+    "r17",
+    "r18",
+    "r19",
+    "r20",
+    "r21",
+    "r22",
+    "r23",
+    "r24",
+    "r25",
+    "r26",
+    "r27",
+    "r28",
+    "r29",
+    "r30",
+    "r31"
+};
+
+static const int tcg_target_reg_alloc_order[] = {
+    TCG_REG_R14,
+    TCG_REG_R15,
+    TCG_REG_R16,
+    TCG_REG_R17,
+    TCG_REG_R18,
+    TCG_REG_R19,
+    TCG_REG_R20,
+    TCG_REG_R21,
+    TCG_REG_R22,
+    TCG_REG_R23,
+    TCG_REG_R28,
+    TCG_REG_R29,
+    TCG_REG_R30,
+    TCG_REG_R31,
+#ifdef __APPLE__
+    TCG_REG_R2,
+#endif
+    TCG_REG_R3,
+    TCG_REG_R4,
+    TCG_REG_R5,
+    TCG_REG_R6,
+    TCG_REG_R7,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10,
+#ifndef __APPLE__
+    TCG_REG_R11,
+#endif
+    TCG_REG_R12,
+    TCG_REG_R13,
+    TCG_REG_R0,
+    TCG_REG_R1,
+    TCG_REG_R2,
+    TCG_REG_R24,
+    TCG_REG_R25,
+    TCG_REG_R26,
+    TCG_REG_R27
+};
+
+static const int tcg_target_call_iarg_regs[] = {
+    TCG_REG_R3,
+    TCG_REG_R4,
+    TCG_REG_R5,
+    TCG_REG_R6,
+    TCG_REG_R7,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10
+};
+
+static const int tcg_target_call_oarg_regs[2] = {
+    TCG_REG_R3,
+    TCG_REG_R4
+};
+
+static const int tcg_target_callee_save_regs[] = {
+#ifdef __APPLE__
+    TCG_REG_R11,
+    TCG_REG_R13,
+#endif
+    TCG_REG_R14,
+    TCG_REG_R15,
+    TCG_REG_R16,
+    TCG_REG_R17,
+    TCG_REG_R18,
+    TCG_REG_R19,
+    TCG_REG_R20,
+    TCG_REG_R21,
+    TCG_REG_R22,
+    TCG_REG_R23,
+    TCG_REG_R28,
+    TCG_REG_R29,
+    TCG_REG_R30,
+    TCG_REG_R31
+};
+
+static uint32_t reloc_pc24_val (void *pc, tcg_target_long target)
+{
+    tcg_target_long disp;
+
+    disp = target - (tcg_target_long) pc;
+    if ((disp << 6) >> 6 != disp)
+        tcg_abort ();
+
+    return disp & 0x3fffffc;
+}
+
+static void reloc_pc24 (void *pc, tcg_target_long target)
+{
+    *(uint32_t *) pc = (*(uint32_t *) pc & ~0x3fffffc)
+        | reloc_pc24_val (pc, target);
+}
+
+static uint16_t reloc_pc14_val (void *pc, tcg_target_long target)
+{
+    tcg_target_long disp;
+
+    disp = target - (tcg_target_long) pc;
+    if (disp != (int16_t) disp)
+        tcg_abort ();
+
+    return disp & 0xfffc;
+}
+
+static void reloc_pc14 (void *pc, tcg_target_long target)
+{
+    *(uint32_t *) pc = (*(uint32_t *) pc & ~0xfffc)
+        | reloc_pc14_val (pc, target);
+}
+
+static void patch_reloc(uint8_t *code_ptr, int type,
+                        tcg_target_long value, tcg_target_long addend)
+{
+    value += addend;
+    switch (type) {
+    case R_PPC_REL14:
+        reloc_pc14 (code_ptr, value);
+        break;
+    case R_PPC_REL24:
+        reloc_pc24 (code_ptr, value);
+        break;
+    default:
+        tcg_abort();
+    }
+}
+
+/* maximum number of register used for input function arguments */
+static int tcg_target_get_call_iarg_regs_count(int flags)
+{
+    return sizeof (tcg_target_call_iarg_regs) / sizeof (tcg_target_call_iarg_regs[0]);
+}
+
+/* parse target specific constraints */
+static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+{
+    const char *ct_str;
+
+    ct_str = *pct_str;
+    switch (ct_str[0]) {
+    case 'A': case 'B': case 'C': case 'D':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, 3 + ct_str[0] - 'A');
+        break;
+    case 'r':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffffffff);
+        break;
+#ifdef CONFIG_SOFTMMU
+    case 'L':                   /* qemu_ld constraint */
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffffffff);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
+        break;
+    case 'K':                   /* qemu_st[8..32] constraint */
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffffffff);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
+#if TARGET_LONG_BITS == 64
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
+#endif
+        break;
+    case 'M':                   /* qemu_st64 constraint */
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffffffff);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R4);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R5);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R6);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R7);
+        break;
+#else
+    case 'L':
+    case 'K':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffffffff);
+        break;
+    case 'M':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffffffff);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_R3);
+        break;
+#endif
+    default:
+        return -1;
+    }
+    ct_str++;
+    *pct_str = ct_str;
+    return 0;
+}
+
+/* test if a constant matches the constraint */
+static int tcg_target_const_match(tcg_target_long val,
+                                  const TCGArgConstraint *arg_ct)
+{
+    int ct;
+
+    ct = arg_ct->ct;
+    if (ct & TCG_CT_CONST)
+        return 1;
+    return 0;
+}
+
+#define OPCD(opc) ((opc)<<26)
+#define XO31(opc) (OPCD(31)|((opc)<<1))
+#define XO19(opc) (OPCD(19)|((opc)<<1))
+
+#define B      OPCD(18)
+#define BC     OPCD(16)
+#define LBZ    OPCD(34)
+#define LHZ    OPCD(40)
+#define LHA    OPCD(42)
+#define LWZ    OPCD(32)
+#define STB    OPCD(38)
+#define STH    OPCD(44)
+#define STW    OPCD(36)
+
+#define ADDI   OPCD(14)
+#define ADDIS  OPCD(15)
+#define ORI    OPCD(24)
+#define ORIS   OPCD(25)
+#define XORI   OPCD(26)
+#define XORIS  OPCD(27)
+#define ANDI   OPCD(28)
+#define ANDIS  OPCD(29)
+#define MULLI  OPCD( 7)
+#define CMPLI  OPCD(10)
+#define CMPI   OPCD(11)
+
+#define LWZU   OPCD(33)
+#define STWU   OPCD(37)
+
+#define RLWINM OPCD(21)
+
+#define BCLR   XO19( 16)
+#define BCCTR  XO19(528)
+#define CRAND  XO19(257)
+#define CRANDC XO19(129)
+#define CRNAND XO19(225)
+#define CROR   XO19(449)
+
+#define EXTSB  XO31(954)
+#define EXTSH  XO31(922)
+#define ADD    XO31(266)
+#define ADDE   XO31(138)
+#define ADDC   XO31( 10)
+#define AND    XO31( 28)
+#define SUBF   XO31( 40)
+#define SUBFC  XO31(  8)
+#define SUBFE  XO31(136)
+#define OR     XO31(444)
+#define XOR    XO31(316)
+#define MULLW  XO31(235)
+#define MULHWU XO31( 11)
+#define DIVW   XO31(491)
+#define DIVWU  XO31(459)
+#define CMP    XO31(  0)
+#define CMPL   XO31( 32)
+#define LHBRX  XO31(790)
+#define LWBRX  XO31(534)
+#define STHBRX XO31(918)
+#define STWBRX XO31(662)
+#define MFSPR  XO31(339)
+#define MTSPR  XO31(467)
+#define SRAWI  XO31(824)
+#define NEG    XO31(104)
+
+#define LBZX   XO31( 87)
+#define LHZX   XO31(276)
+#define LHAX   XO31(343)
+#define LWZX   XO31( 23)
+#define STBX   XO31(215)
+#define STHX   XO31(407)
+#define STWX   XO31(151)
+
+#define SPR(a,b) ((((a)<<5)|(b))<<11)
+#define LR     SPR(8, 0)
+#define CTR    SPR(9, 0)
+
+#define SLW    XO31( 24)
+#define SRW    XO31(536)
+#define SRAW   XO31(792)
+
+#define LMW    OPCD(46)
+#define STMW   OPCD(47)
+
+#define TW     XO31(4)
+#define TRAP   (TW | TO (31))
+
+#define RT(r) ((r)<<21)
+#define RS(r) ((r)<<21)
+#define RA(r) ((r)<<16)
+#define RB(r) ((r)<<11)
+#define TO(t) ((t)<<21)
+#define SH(s) ((s)<<11)
+#define MB(b) ((b)<<6)
+#define ME(e) ((e)<<1)
+#define BO(o) ((o)<<21)
+
+#define LK    1
+
+#define TAB(t,a,b) (RT(t) | RA(a) | RB(b))
+#define SAB(s,a,b) (RS(s) | RA(a) | RB(b))
+
+#define BF(n)    ((n)<<23)
+#define BI(n, c) (((c)+((n)*4))<<16)
+#define BT(n, c) (((c)+((n)*4))<<21)
+#define BA(n, c) (((c)+((n)*4))<<16)
+#define BB(n, c) (((c)+((n)*4))<<11)
+
+#define BO_COND_TRUE  BO (12)
+#define BO_COND_FALSE BO (4)
+#define BO_ALWAYS     BO (20)
+
+enum {
+    CR_LT,
+    CR_GT,
+    CR_EQ,
+    CR_SO
+};
+
+static const uint32_t tcg_to_bc[10] = {
+    [TCG_COND_EQ]  = BC | BI (7, CR_EQ) | BO_COND_TRUE,
+    [TCG_COND_NE]  = BC | BI (7, CR_EQ) | BO_COND_FALSE,
+    [TCG_COND_LT]  = BC | BI (7, CR_LT) | BO_COND_TRUE,
+    [TCG_COND_GE]  = BC | BI (7, CR_LT) | BO_COND_FALSE,
+    [TCG_COND_LE]  = BC | BI (7, CR_GT) | BO_COND_FALSE,
+    [TCG_COND_GT]  = BC | BI (7, CR_GT) | BO_COND_TRUE,
+    [TCG_COND_LTU] = BC | BI (7, CR_LT) | BO_COND_TRUE,
+    [TCG_COND_GEU] = BC | BI (7, CR_LT) | BO_COND_FALSE,
+    [TCG_COND_LEU] = BC | BI (7, CR_GT) | BO_COND_FALSE,
+    [TCG_COND_GTU] = BC | BI (7, CR_GT) | BO_COND_TRUE,
+};
+
+static void tcg_out_mov(TCGContext *s, int ret, int arg)
+{
+    tcg_out32 (s, OR | SAB (arg, ret, arg));
+}
+
+static void tcg_out_movi(TCGContext *s, TCGType type,
+                         int ret, tcg_target_long arg)
+{
+    if (arg == (int16_t) arg)
+        tcg_out32 (s, ADDI | RT (ret) | RA (0) | (arg & 0xffff));
+    else {
+        tcg_out32 (s, ADDIS | RT (ret) | RA (0) | ((arg >> 16) & 0xffff));
+        if (arg & 0xffff)
+            tcg_out32 (s, ORI | RS (ret) | RA (ret) | (arg & 0xffff));
+    }
+}
+
+static void tcg_out_ldst (TCGContext *s, int ret, int addr,
+                          int offset, int op1, int op2)
+{
+    if (offset == (int16_t) offset)
+        tcg_out32 (s, op1 | RT (ret) | RA (addr) | (offset & 0xffff));
+    else {
+        tcg_out_movi (s, TCG_TYPE_I32, 0, offset);
+        tcg_out32 (s, op2 | RT (ret) | RA (addr) | RB (0));
+    }
+}
+
+static void tcg_out_b (TCGContext *s, int mask, tcg_target_long target)
+{
+    tcg_target_long disp;
+
+    disp = target - (tcg_target_long) s->code_ptr;
+    if ((disp << 6) >> 6 == disp)
+        tcg_out32 (s, B | (disp & 0x3fffffc) | mask);
+    else {
+        tcg_out_movi (s, TCG_TYPE_I32, 0, (tcg_target_long) target);
+        tcg_out32 (s, MTSPR | RS (0) | CTR);
+        tcg_out32 (s, BCCTR | BO_ALWAYS | mask);
+    }
+}
+
+#if defined(CONFIG_SOFTMMU)
+
+#include "../../softmmu_defs.h"
+
+static void *qemu_ld_helpers[4] = {
+    __ldb_mmu,
+    __ldw_mmu,
+    __ldl_mmu,
+    __ldq_mmu,
+};
+
+static void *qemu_st_helpers[4] = {
+    __stb_mmu,
+    __stw_mmu,
+    __stl_mmu,
+    __stq_mmu,
+};
+#endif
+
+static void tcg_out_qemu_ld (TCGContext *s, const TCGArg *args, int opc)
+{
+    int addr_reg, data_reg, data_reg2, r0, mem_index, s_bits, bswap;
+#ifdef CONFIG_SOFTMMU
+    int r1, r2;
+    void *label1_ptr, *label2_ptr;
+#endif
+#if TARGET_LONG_BITS == 64
+    int addr_reg2;
+#endif
+
+    data_reg = *args++;
+    if (opc == 3)
+        data_reg2 = *args++;
+    else
+        data_reg2 = 0;
+    addr_reg = *args++;
+#if TARGET_LONG_BITS == 64
+    addr_reg2 = *args++;
+#endif
+    mem_index = *args;
+    s_bits = opc & 3;
+
+#ifdef CONFIG_SOFTMMU
+    r0 = 3;
+    r1 = 4;
+    r2 = 0;
+
+    tcg_out32 (s, (RLWINM
+                   | RA (r0)
+                   | RS (addr_reg)
+                   | SH (32 - (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS))
+                   | MB (32 - (CPU_TLB_BITS + CPU_TLB_ENTRY_BITS))
+                   | ME (31 - CPU_TLB_ENTRY_BITS)
+                   )
+        );
+    tcg_out32 (s, ADD | RT (r0) | RA (r0) | RB (TCG_AREG0));
+    tcg_out32 (s, (LWZU
+                   | RT (r1)
+                   | RA (r0)
+                   | offsetof (CPUState, tlb_table[mem_index][0].addr_read)
+                   )
+        );
+    tcg_out32 (s, (RLWINM
+                   | RA (r2)
+                   | RS (addr_reg)
+                   | SH (0)
+                   | MB ((32 - s_bits) & 31)
+                   | ME (31 - TARGET_PAGE_BITS)
+                   )
+        );
+
+    tcg_out32 (s, CMP | BF (7) | RA (r2) | RB (r1));
+#if TARGET_LONG_BITS == 64
+    tcg_out32 (s, LWZ | RT (r1) | RA (r0) | 4);
+    tcg_out32 (s, CMP | BF (6) | RA (addr_reg2) | RB (r1));
+    tcg_out32 (s, CRAND | BT (7, CR_EQ) | BA (6, CR_EQ) | BB (7, CR_EQ));
+#endif
+
+    label1_ptr = s->code_ptr;
+#ifdef FAST_PATH
+    tcg_out32 (s, BC | BI (7, CR_EQ) | BO_COND_TRUE);
+#endif
+
+    /* slow path */
+#if TARGET_LONG_BITS == 32
+    tcg_out_mov (s, 3, addr_reg);
+    tcg_out_movi (s, TCG_TYPE_I32, 4, mem_index);
+#else
+    tcg_out_mov (s, 3, addr_reg2);
+    tcg_out_mov (s, 4, addr_reg);
+    tcg_out_movi (s, TCG_TYPE_I32, 5, mem_index);
+#endif
+
+    tcg_out_b (s, LK, (tcg_target_long) qemu_ld_helpers[s_bits]);
+    switch (opc) {
+    case 0|4:
+        tcg_out32 (s, EXTSB | RA (data_reg) | RS (3));
+        break;
+    case 1|4:
+        tcg_out32 (s, EXTSH | RA (data_reg) | RS (3));
+        break;
+    case 0:
+    case 1:
+    case 2:
+        if (data_reg != 3)
+            tcg_out_mov (s, data_reg, 3);
+        break;
+    case 3:
+        if (data_reg == 3) {
+            if (data_reg2 == 4) {
+                tcg_out_mov (s, 0, 4);
+                tcg_out_mov (s, 4, 3);
+                tcg_out_mov (s, 3, 0);
+            }
+            else {
+                tcg_out_mov (s, data_reg2, 3);
+                tcg_out_mov (s, 3, 4);
+            }
+        }
+        else {
+            if (data_reg != 4) tcg_out_mov (s, data_reg, 4);
+            if (data_reg2 != 3) tcg_out_mov (s, data_reg2, 3);
+        }
+        break;
+    }
+    label2_ptr = s->code_ptr;
+    tcg_out32 (s, B);
+
+    /* label1: fast path */
+#ifdef FAST_PATH
+    reloc_pc14 (label1_ptr, (tcg_target_long) s->code_ptr);
+#endif
+
+    /* r0 now contains &env->tlb_table[mem_index][index].addr_read */
+    tcg_out32 (s, (LWZ
+                   | RT (r0)
+                   | RA (r0)
+                   | (ADDEND_OFFSET + offsetof (CPUTLBEntry, addend)
+                      - offsetof (CPUTLBEntry, addr_read))
+                   ));
+    /* r0 = env->tlb_table[mem_index][index].addend */
+    tcg_out32 (s, ADD | RT (r0) | RA (r0) | RB (addr_reg));
+    /* r0 = env->tlb_table[mem_index][index].addend + addr */
+
+#else  /* !CONFIG_SOFTMMU */
+    r0 = addr_reg;
+#endif
+
+#ifdef TARGET_WORDS_BIGENDIAN
+    bswap = 0;
+#else
+    bswap = 1;
+#endif
+    switch (opc) {
+    default:
+    case 0:
+        tcg_out32 (s, LBZ | RT (data_reg) | RA (r0));
+        break;
+    case 0|4:
+        tcg_out32 (s, LBZ | RT (data_reg) | RA (r0));
+        tcg_out32 (s, EXTSB | RA (data_reg) | RS (data_reg));
+        break;
+    case 1:
+        if (bswap) tcg_out32 (s, LHBRX | RT (data_reg) | RB (r0));
+        else tcg_out32 (s, LHZ | RT (data_reg) | RA (r0));
+        break;
+    case 1|4:
+        if (bswap) {
+            tcg_out32 (s, LHBRX | RT (data_reg) | RB (r0));
+            tcg_out32 (s, EXTSH | RA (data_reg) | RS (data_reg));
+        }
+        else tcg_out32 (s, LHA | RT (data_reg) | RA (r0));
+        break;
+    case 2:
+        if (bswap) tcg_out32 (s, LWBRX | RT (data_reg) | RB (r0));
+        else tcg_out32 (s, LWZ | RT (data_reg)| RA (r0));
+        break;
+    case 3:
+        if (bswap) {
+            if (r0 == data_reg) {
+                tcg_out32 (s, LWBRX | RT (0) | RB (r0));
+                tcg_out32 (s, ADDI | RT (r0) | RA (r0) |  4);
+                tcg_out32 (s, LWBRX | RT (data_reg2) | RB (r0));
+                tcg_out_mov (s, data_reg, 0);
+            }
+            else {
+                tcg_out32 (s, LWBRX | RT (data_reg) | RB (r0));
+                tcg_out32 (s, ADDI | RT (r0) | RA (r0) |  4);
+                tcg_out32 (s, LWBRX | RT (data_reg2) | RB (r0));
+            }
+        }
+        else {
+            if (r0 == data_reg2) {
+                tcg_out32 (s, LWZ | RT (0) | RA (r0));
+                tcg_out32 (s, LWZ | RT (data_reg) | RA (r0) | 4);
+                tcg_out_mov (s, data_reg2, 0);
+            }
+            else {
+                tcg_out32 (s, LWZ | RT (data_reg2) | RA (r0));
+                tcg_out32 (s, LWZ | RT (data_reg) | RA (r0) | 4);
+            }
+        }
+        break;
+    }
+
+#ifdef CONFIG_SOFTMMU
+    reloc_pc24 (label2_ptr, (tcg_target_long) s->code_ptr);
+#endif
+}
+
+static void tcg_out_qemu_st (TCGContext *s, const TCGArg *args, int opc)
+{
+    int addr_reg, r0, r1, data_reg, data_reg2, mem_index, bswap;
+#ifdef CONFIG_SOFTMMU
+    int r2, ir;
+    void *label1_ptr, *label2_ptr;
+#endif
+#if TARGET_LONG_BITS == 64
+    int addr_reg2;
+#endif
+
+    data_reg = *args++;
+    if (opc == 3)
+        data_reg2 = *args++;
+    else
+        data_reg2 = 0;
+    addr_reg = *args++;
+#if TARGET_LONG_BITS == 64
+    addr_reg2 = *args++;
+#endif
+    mem_index = *args;
+
+#ifdef CONFIG_SOFTMMU
+    r0 = 3;
+    r1 = 4;
+    r2 = 0;
+
+    tcg_out32 (s, (RLWINM
+                   | RA (r0)
+                   | RS (addr_reg)
+                   | SH (32 - (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS))
+                   | MB (32 - (CPU_TLB_ENTRY_BITS + CPU_TLB_BITS))
+                   | ME (31 - CPU_TLB_ENTRY_BITS)
+                   )
+        );
+    tcg_out32 (s, ADD | RT (r0) | RA (r0) | RB (TCG_AREG0));
+    tcg_out32 (s, (LWZU
+                   | RT (r1)
+                   | RA (r0)
+                   | offsetof (CPUState, tlb_table[mem_index][0].addr_write)
+                   )
+        );
+    tcg_out32 (s, (RLWINM
+                   | RA (r2)
+                   | RS (addr_reg)
+                   | SH (0)
+                   | MB ((32 - opc) & 31)
+                   | ME (31 - TARGET_PAGE_BITS)
+                   )
+        );
+
+    tcg_out32 (s, CMP | (7 << 23) | RA (r2) | RB (r1));
+#if TARGET_LONG_BITS == 64
+    tcg_out32 (s, LWZ | RT (r1) | RA (r0) | 4);
+    tcg_out32 (s, CMP | BF (6) | RA (addr_reg2) | RB (r1));
+    tcg_out32 (s, CRAND | BT (7, CR_EQ) | BA (6, CR_EQ) | BB (7, CR_EQ));
+#endif
+
+    label1_ptr = s->code_ptr;
+#ifdef FAST_PATH
+    tcg_out32 (s, BC | BI (7, CR_EQ) | BO_COND_TRUE);
+#endif
+
+    /* slow path */
+#if TARGET_LONG_BITS == 32
+    tcg_out_mov (s, 3, addr_reg);
+    ir = 4;
+#else
+    tcg_out_mov (s, 3, addr_reg2);
+    tcg_out_mov (s, 4, addr_reg);
+#ifdef TCG_TARGET_CALL_ALIGN_ARGS
+    ir = 5;
+#else
+    ir = 4;
+#endif
+#endif
+
+    switch (opc) {
+    case 0:
+        tcg_out32 (s, (RLWINM
+                       | RA (ir)
+                       | RS (data_reg)
+                       | SH (0)
+                       | MB (24)
+                       | ME (31)));
+        break;
+    case 1:
+        tcg_out32 (s, (RLWINM
+                       | RA (ir)
+                       | RS (data_reg)
+                       | SH (0)
+                       | MB (16)
+                       | ME (31)));
+        break;
+    case 2:
+        tcg_out_mov (s, ir, data_reg);
+        break;
+    case 3:
+#ifdef TCG_TARGET_CALL_ALIGN_ARGS
+        ir = 5;
+#endif
+        tcg_out_mov (s, ir++, data_reg2);
+        tcg_out_mov (s, ir, data_reg);
+        break;
+    }
+    ir++;
+
+    tcg_out_movi (s, TCG_TYPE_I32, ir, mem_index);
+    tcg_out_b (s, LK, (tcg_target_long) qemu_st_helpers[opc]);
+    label2_ptr = s->code_ptr;
+    tcg_out32 (s, B);
+
+    /* label1: fast path */
+#ifdef FAST_PATH
+    reloc_pc14 (label1_ptr, (tcg_target_long) s->code_ptr);
+#endif
+
+    tcg_out32 (s, (LWZ
+                   | RT (r0)
+                   | RA (r0)
+                   | (ADDEND_OFFSET + offsetof (CPUTLBEntry, addend)
+                      - offsetof (CPUTLBEntry, addr_write))
+                   ));
+    /* r0 = env->tlb_table[mem_index][index].addend */
+    tcg_out32 (s, ADD | RT (r0) | RA (r0) | RB (addr_reg));
+    /* r0 = env->tlb_table[mem_index][index].addend + addr */
+
+#else  /* !CONFIG_SOFTMMU */
+    r1 = 3;
+    r0 = addr_reg;
+#endif
+
+#ifdef TARGET_WORDS_BIGENDIAN
+    bswap = 0;
+#else
+    bswap = 1;
+#endif
+    switch (opc) {
+    case 0:
+        tcg_out32 (s, STB | RS (data_reg) | RA (r0));
+        break;
+    case 1:
+        if (bswap) tcg_out32 (s, STHBRX | RS (data_reg) | RA (0) | RB (r0));
+        else tcg_out32 (s, STH | RS (data_reg) | RA (r0));
+        break;
+    case 2:
+        if (bswap) tcg_out32 (s, STWBRX | RS (data_reg) | RA (0) | RB (r0));
+        else tcg_out32 (s, STW | RS (data_reg) | RA (r0));
+        break;
+    case 3:
+        if (bswap) {
+            tcg_out32 (s, ADDI | RT (r1) | RA (r0) | 4);
+            tcg_out32 (s, STWBRX | RS (data_reg) | RA (0) | RB (r0));
+            tcg_out32 (s, STWBRX | RS (data_reg2) | RA (0) | RB (r1));
+        }
+        else {
+            tcg_out32 (s, STW | RS (data_reg2) | RA (r0));
+            tcg_out32 (s, STW | RS (data_reg) | RA (r0) | 4);
+        }
+        break;
+    }
+
+#ifdef CONFIG_SOFTMMU
+    reloc_pc24 (label2_ptr, (tcg_target_long) s->code_ptr);
+#endif
+}
+
+void tcg_target_qemu_prologue (TCGContext *s)
+{
+    int i, frame_size;
+
+    frame_size = 0
+        + LINKAGE_AREA_SIZE
+        + TCG_STATIC_CALL_ARGS_SIZE
+        + ARRAY_SIZE (tcg_target_callee_save_regs) * 4
+        ;
+    frame_size = (frame_size + 15) & ~15;
+
+    tcg_out32 (s, MFSPR | RT (0) | LR);
+    tcg_out32 (s, STWU | RS (1) | RA (1) | (-frame_size & 0xffff));
+    for (i = 0; i < ARRAY_SIZE (tcg_target_callee_save_regs); ++i)
+        tcg_out32 (s, (STW
+                       | RS (tcg_target_callee_save_regs[i])
+                       | RA (1)
+                       | (i * 4 + LINKAGE_AREA_SIZE + TCG_STATIC_CALL_ARGS_SIZE)
+                       )
+            );
+    tcg_out32 (s, STW | RS (0) | RA (1) | (frame_size + BACK_CHAIN_OFFSET));
+
+    tcg_out32 (s, MTSPR | RS (3) | CTR);
+    tcg_out32 (s, BCCTR | BO_ALWAYS);
+    tb_ret_addr = s->code_ptr;
+
+    for (i = 0; i < ARRAY_SIZE (tcg_target_callee_save_regs); ++i)
+        tcg_out32 (s, (LWZ
+                       | RT (tcg_target_callee_save_regs[i])
+                       | RA (1)
+                       | (i * 4 + LINKAGE_AREA_SIZE + TCG_STATIC_CALL_ARGS_SIZE)
+                       )
+            );
+    tcg_out32 (s, LWZ | RT (0) | RA (1) | (frame_size + BACK_CHAIN_OFFSET));
+    tcg_out32 (s, MTSPR | RS (0) | LR);
+    tcg_out32 (s, ADDI | RT (1) | RA (1) | frame_size);
+    tcg_out32 (s, BCLR | BO_ALWAYS);
+}
+
+static void tcg_out_ld (TCGContext *s, TCGType type, int ret, int arg1,
+                        tcg_target_long arg2)
+{
+    tcg_out_ldst (s, ret, arg1, arg2, LWZ, LWZX);
+}
+
+static void tcg_out_st (TCGContext *s, TCGType type, int arg, int arg1,
+                        tcg_target_long arg2)
+{
+    tcg_out_ldst (s, arg, arg1, arg2, STW, STWX);
+}
+
+static void ppc_addi (TCGContext *s, int rt, int ra, tcg_target_long si)
+{
+    if (!si && rt == ra)
+        return;
+
+    if (si == (int16_t) si)
+        tcg_out32 (s, ADDI | RT (rt) | RA (ra) | (si & 0xffff));
+    else {
+        uint16_t h = ((si >> 16) & 0xffff) + ((uint16_t) si >> 15);
+        tcg_out32 (s, ADDIS | RT (rt) | RA (ra) | h);
+        tcg_out32 (s, ADDI | RT (rt) | RA (rt) | (si & 0xffff));
+    }
+}
+
+static void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
+{
+    ppc_addi (s, reg, reg, val);
+}
+
+static void tcg_out_cmp (TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
+                         int const_arg2, int cr)
+{
+    int imm;
+    uint32_t op;
+
+    switch (cond) {
+    case TCG_COND_EQ:
+    case TCG_COND_NE:
+        if (const_arg2) {
+            if ((int16_t) arg2 == arg2) {
+                op = CMPI;
+                imm = 1;
+                break;
+            }
+            else if ((uint16_t) arg2 == arg2) {
+                op = CMPLI;
+                imm = 1;
+                break;
+            }
+        }
+        op = CMPL;
+        imm = 0;
+        break;
+
+    case TCG_COND_LT:
+    case TCG_COND_GE:
+    case TCG_COND_LE:
+    case TCG_COND_GT:
+        if (const_arg2) {
+            if ((int16_t) arg2 == arg2) {
+                op = CMPI;
+                imm = 1;
+                break;
+            }
+        }
+        op = CMP;
+        imm = 0;
+        break;
+
+    case TCG_COND_LTU:
+    case TCG_COND_GEU:
+    case TCG_COND_LEU:
+    case TCG_COND_GTU:
+        if (const_arg2) {
+            if ((uint16_t) arg2 == arg2) {
+                op = CMPLI;
+                imm = 1;
+                break;
+            }
+        }
+        op = CMPL;
+        imm = 0;
+        break;
+
+    default:
+        tcg_abort ();
+    }
+    op |= BF (cr);
+
+    if (imm)
+        tcg_out32 (s, op | RA (arg1) | (arg2 & 0xffff));
+    else {
+        if (const_arg2) {
+            tcg_out_movi (s, TCG_TYPE_I32, 0, arg2);
+            tcg_out32 (s, op | RA (arg1) | RB (0));
+        }
+        else
+            tcg_out32 (s, op | RA (arg1) | RB (arg2));
+    }
+
+}
+
+static void tcg_out_bc (TCGContext *s, int bc, int label_index)
+{
+    TCGLabel *l = &s->labels[label_index];
+
+    if (l->has_value)
+        tcg_out32 (s, bc | reloc_pc14_val (s->code_ptr, l->u.value));
+    else {
+        uint16_t val = *(uint16_t *) &s->code_ptr[2];
+
+        /* Thanks to Andrzej Zaborowski */
+        tcg_out32 (s, bc | (val & 0xfffc));
+        tcg_out_reloc (s, s->code_ptr - 4, R_PPC_REL14, label_index, 0);
+    }
+}
+
+static void tcg_out_brcond (TCGContext *s, int cond,
+                            TCGArg arg1, TCGArg arg2, int const_arg2,
+                            int label_index)
+{
+    tcg_out_cmp (s, cond, arg1, arg2, const_arg2, 7);
+    tcg_out_bc (s, tcg_to_bc[cond], label_index);
+}
+
+/* XXX: we implement it at the target level to avoid having to
+   handle cross basic blocks temporaries */
+static void tcg_out_brcond2 (TCGContext *s, const TCGArg *args,
+                             const int *const_args)
+{
+    int cond = args[4], label_index = args[5], op;
+    struct { int bit1; int bit2; int cond2; } bits[] = {
+        [TCG_COND_LT ] = { CR_LT, CR_LT, TCG_COND_LT  },
+        [TCG_COND_LE ] = { CR_LT, CR_GT, TCG_COND_LT  },
+        [TCG_COND_GT ] = { CR_GT, CR_GT, TCG_COND_GT  },
+        [TCG_COND_GE ] = { CR_GT, CR_LT, TCG_COND_GT  },
+        [TCG_COND_LTU] = { CR_LT, CR_LT, TCG_COND_LTU },
+        [TCG_COND_LEU] = { CR_LT, CR_GT, TCG_COND_LTU },
+        [TCG_COND_GTU] = { CR_GT, CR_GT, TCG_COND_GTU },
+        [TCG_COND_GEU] = { CR_GT, CR_LT, TCG_COND_GTU },
+    }, *b = &bits[cond];
+
+    switch (cond) {
+    case TCG_COND_EQ:
+    case TCG_COND_NE:
+        op = (cond == TCG_COND_EQ) ? CRAND : CRNAND;
+        tcg_out_cmp (s, cond, args[0], args[2], const_args[2], 6);
+        tcg_out_cmp (s, cond, args[1], args[3], const_args[3], 7);
+        tcg_out32 (s, op | BT (7, CR_EQ) | BA (6, CR_EQ) | BB (7, CR_EQ));
+        break;
+    case TCG_COND_LT:
+    case TCG_COND_LE:
+    case TCG_COND_GT:
+    case TCG_COND_GE:
+    case TCG_COND_LTU:
+    case TCG_COND_LEU:
+    case TCG_COND_GTU:
+    case TCG_COND_GEU:
+        op = (b->bit1 != b->bit2) ? CRANDC : CRAND;
+        tcg_out_cmp (s, b->cond2, args[1], args[3], const_args[3], 5);
+        tcg_out_cmp (s, TCG_COND_EQ, args[1], args[3], const_args[3], 6);
+        tcg_out_cmp (s, cond, args[0], args[2], const_args[2], 7);
+        tcg_out32 (s, op | BT (7, CR_EQ) | BA (6, CR_EQ) | BB (7, b->bit2));
+        tcg_out32 (s, CROR | BT (7, CR_EQ) | BA (5, b->bit1) | BB (7, CR_EQ));
+        break;
+    default:
+        tcg_abort();
+    }
+
+    tcg_out_bc (s, (BC | BI (7, CR_EQ) | BO_COND_TRUE), label_index);
+}
+
+void ppc_tb_set_jmp_target (unsigned long jmp_addr, unsigned long addr)
+{
+    uint32_t *ptr;
+    long disp = addr - jmp_addr;
+    unsigned long patch_size;
+
+    ptr = (uint32_t *)jmp_addr;
+
+    if ((disp << 6) >> 6 != disp) {
+        ptr[0] = 0x3c000000 | (addr >> 16);    /* lis 0,addr@ha */
+        ptr[1] = 0x60000000 | (addr & 0xffff); /* la  0,addr@l(0) */
+        ptr[2] = 0x7c0903a6;                   /* mtctr 0 */
+        ptr[3] = 0x4e800420;                   /* brctr */
+        patch_size = 16;
+    } else {
+        /* patch the branch destination */
+        if (disp != 16) {
+            *ptr = 0x48000000 | (disp & 0x03fffffc); /* b disp */
+            patch_size = 4;
+        } else {
+            ptr[0] = 0x60000000; /* nop */
+            ptr[1] = 0x60000000;
+            ptr[2] = 0x60000000;
+            ptr[3] = 0x60000000;
+            patch_size = 16;
+        }
+    }
+    /* flush icache */
+    flush_icache_range(jmp_addr, jmp_addr + patch_size);
+}
+
+static void tcg_out_op(TCGContext *s, int opc, const TCGArg *args,
+                       const int *const_args)
+{
+    switch (opc) {
+    case INDEX_op_exit_tb:
+        tcg_out_movi (s, TCG_TYPE_I32, TCG_REG_R3, args[0]);
+        tcg_out_b (s, 0, (tcg_target_long) tb_ret_addr);
+        break;
+    case INDEX_op_goto_tb:
+        if (s->tb_jmp_offset) {
+            /* direct jump method */
+
+            s->tb_jmp_offset[args[0]] = s->code_ptr - s->code_buf;
+            s->code_ptr += 16;
+        }
+        else {
+            tcg_abort ();
+        }
+        s->tb_next_offset[args[0]] = s->code_ptr - s->code_buf;
+        break;
+    case INDEX_op_br:
+        {
+            TCGLabel *l = &s->labels[args[0]];
+
+            if (l->has_value) {
+                tcg_out_b (s, 0, l->u.value);
+            }
+            else {
+                uint32_t val = *(uint32_t *) s->code_ptr;
+
+                /* Thanks to Andrzej Zaborowski */
+                tcg_out32 (s, B | (val & 0x3fffffc));
+                tcg_out_reloc (s, s->code_ptr - 4, R_PPC_REL24, args[0], 0);
+            }
+        }
+        break;
+    case INDEX_op_call:
+        if (const_args[0]) {
+            tcg_out_b (s, LK, args[0]);
+        }
+        else {
+            tcg_out32 (s, MTSPR | RS (args[0]) | LR);
+            tcg_out32 (s, BCLR | BO_ALWAYS | LK);
+        }
+        break;
+    case INDEX_op_jmp:
+        if (const_args[0]) {
+            tcg_out_b (s, 0, args[0]);
+        }
+        else {
+            tcg_out32 (s, MTSPR | RS (args[0]) | CTR);
+            tcg_out32 (s, BCCTR | BO_ALWAYS);
+        }
+        break;
+    case INDEX_op_movi_i32:
+        tcg_out_movi(s, TCG_TYPE_I32, args[0], args[1]);
+        break;
+    case INDEX_op_ld8u_i32:
+        tcg_out_ldst (s, args[0], args[1], args[2], LBZ, LBZX);
+        break;
+    case INDEX_op_ld8s_i32:
+        tcg_out_ldst (s, args[0], args[1], args[2], LBZ, LBZX);
+        tcg_out32 (s, EXTSB | RS (args[0]) | RA (args[0]));
+        break;
+    case INDEX_op_ld16u_i32:
+        tcg_out_ldst (s, args[0], args[1], args[2], LHZ, LHZX);
+        break;
+    case INDEX_op_ld16s_i32:
+        tcg_out_ldst (s, args[0], args[1], args[2], LHA, LHAX);
+        break;
+    case INDEX_op_ld_i32:
+        tcg_out_ldst (s, args[0], args[1], args[2], LWZ, LWZX);
+        break;
+    case INDEX_op_st8_i32:
+        tcg_out_ldst (s, args[0], args[1], args[2], STB, STBX);
+        break;
+    case INDEX_op_st16_i32:
+        tcg_out_ldst (s, args[0], args[1], args[2], STH, STHX);
+        break;
+    case INDEX_op_st_i32:
+        tcg_out_ldst (s, args[0], args[1], args[2], STW, STWX);
+        break;
+
+    case INDEX_op_add_i32:
+        if (const_args[2])
+            ppc_addi (s, args[0], args[1], args[2]);
+        else
+            tcg_out32 (s, ADD | TAB (args[0], args[1], args[2]));
+        break;
+    case INDEX_op_sub_i32:
+        if (const_args[2])
+            ppc_addi (s, args[0], args[1], -args[2]);
+        else
+            tcg_out32 (s, SUBF | TAB (args[0], args[2], args[1]));
+        break;
+
+    case INDEX_op_and_i32:
+        if (const_args[2]) {
+            if ((args[2] & 0xffff) == args[2])
+                tcg_out32 (s, ANDI | RS (args[1]) | RA (args[0]) | args[2]);
+            else if ((args[2] & 0xffff0000) == args[2])
+                tcg_out32 (s, ANDIS | RS (args[1]) | RA (args[0])
+                           | ((args[2] >> 16) & 0xffff));
+            else {
+                tcg_out_movi (s, TCG_TYPE_I32, 0, args[2]);
+                tcg_out32 (s, AND | SAB (args[1], args[0], 0));
+            }
+        }
+        else
+            tcg_out32 (s, AND | SAB (args[1], args[0], args[2]));
+        break;
+    case INDEX_op_or_i32:
+        if (const_args[2]) {
+            if (args[2] & 0xffff) {
+                tcg_out32 (s, ORI | RS (args[1])  | RA (args[0])
+                           | (args[2] & 0xffff));
+                if (args[2] >> 16)
+                    tcg_out32 (s, ORIS | RS (args[0])  | RA (args[0])
+                               | ((args[2] >> 16) & 0xffff));
+            }
+            else {
+                tcg_out32 (s, ORIS | RS (args[1])  | RA (args[0])
+                           | ((args[2] >> 16) & 0xffff));
+            }
+        }
+        else
+            tcg_out32 (s, OR | SAB (args[1], args[0], args[2]));
+        break;
+    case INDEX_op_xor_i32:
+        if (const_args[2]) {
+            if ((args[2] & 0xffff) == args[2])
+                tcg_out32 (s, XORI | RS (args[1])  | RA (args[0])
+                           | (args[2] & 0xffff));
+            else if ((args[2] & 0xffff0000) == args[2])
+                tcg_out32 (s, XORIS | RS (args[1])  | RA (args[0])
+                           | ((args[2] >> 16) & 0xffff));
+            else {
+                tcg_out_movi (s, TCG_TYPE_I32, 0, args[2]);
+                tcg_out32 (s, XOR | SAB (args[1], args[0], 0));
+            }
+        }
+        else
+            tcg_out32 (s, XOR | SAB (args[1], args[0], args[2]));
+        break;
+
+    case INDEX_op_mul_i32:
+        if (const_args[2]) {
+            if (args[2] == (int16_t) args[2])
+                tcg_out32 (s, MULLI | RT (args[0]) | RA (args[1])
+                           | (args[2] & 0xffff));
+            else {
+                tcg_out_movi (s, TCG_TYPE_I32, 0, args[2]);
+                tcg_out32 (s, MULLW | TAB (args[0], args[1], 0));
+            }
+        }
+        else
+            tcg_out32 (s, MULLW | TAB (args[0], args[1], args[2]));
+        break;
+
+    case INDEX_op_div_i32:
+        tcg_out32 (s, DIVW | TAB (args[0], args[1], args[2]));
+        break;
+
+    case INDEX_op_divu_i32:
+        tcg_out32 (s, DIVWU | TAB (args[0], args[1], args[2]));
+        break;
+
+    case INDEX_op_rem_i32:
+        tcg_out32 (s, DIVW | TAB (0, args[1], args[2]));
+        tcg_out32 (s, MULLW | TAB (0, 0, args[2]));
+        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
+        break;
+
+    case INDEX_op_remu_i32:
+        tcg_out32 (s, DIVWU | TAB (0, args[1], args[2]));
+        tcg_out32 (s, MULLW | TAB (0, 0, args[2]));
+        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
+        break;
+
+    case INDEX_op_mulu2_i32:
+        if (args[0] == args[2] || args[0] == args[3]) {
+            tcg_out32 (s, MULLW | TAB (0, args[2], args[3]));
+            tcg_out32 (s, MULHWU | TAB (args[1], args[2], args[3]));
+            tcg_out_mov (s, args[0], 0);
+        }
+        else {
+            tcg_out32 (s, MULLW | TAB (args[0], args[2], args[3]));
+            tcg_out32 (s, MULHWU | TAB (args[1], args[2], args[3]));
+        }
+        break;
+
+    case INDEX_op_shl_i32:
+        if (const_args[2]) {
+            tcg_out32 (s, (RLWINM
+                           | RA (args[0])
+                           | RS (args[1])
+                           | SH (args[2])
+                           | MB (0)
+                           | ME (31 - args[2])
+                           )
+                );
+        }
+        else
+            tcg_out32 (s, SLW | SAB (args[1], args[0], args[2]));
+        break;
+    case INDEX_op_shr_i32:
+        if (const_args[2]) {
+            tcg_out32 (s, (RLWINM
+                           | RA (args[0])
+                           | RS (args[1])
+                           | SH (32 - args[2])
+                           | MB (args[2])
+                           | ME (31)
+                           )
+                );
+        }
+        else
+            tcg_out32 (s, SRW | SAB (args[1], args[0], args[2]));
+        break;
+    case INDEX_op_sar_i32:
+        if (const_args[2])
+            tcg_out32 (s, SRAWI | RS (args[1]) | RA (args[0]) | SH (args[2]));
+        else
+            tcg_out32 (s, SRAW | SAB (args[1], args[0], args[2]));
+        break;
+
+    case INDEX_op_add2_i32:
+        if (args[0] == args[3] || args[0] == args[5]) {
+            tcg_out32 (s, ADDC | TAB (0, args[2], args[4]));
+            tcg_out32 (s, ADDE | TAB (args[1], args[3], args[5]));
+            tcg_out_mov (s, args[0], 0);
+        }
+        else {
+            tcg_out32 (s, ADDC | TAB (args[0], args[2], args[4]));
+            tcg_out32 (s, ADDE | TAB (args[1], args[3], args[5]));
+        }
+        break;
+    case INDEX_op_sub2_i32:
+        if (args[0] == args[3] || args[0] == args[5]) {
+            tcg_out32 (s, SUBFC | TAB (0, args[4], args[2]));
+            tcg_out32 (s, SUBFE | TAB (args[1], args[5], args[3]));
+            tcg_out_mov (s, args[0], 0);
+        }
+        else {
+            tcg_out32 (s, SUBFC | TAB (args[0], args[4], args[2]));
+            tcg_out32 (s, SUBFE | TAB (args[1], args[5], args[3]));
+        }
+        break;
+
+    case INDEX_op_brcond_i32:
+        /*
+          args[0] = r0
+          args[1] = r1
+          args[2] = cond
+          args[3] = r1 is const
+          args[4] = label_index
+        */
+        tcg_out_brcond (s, args[2], args[0], args[1], const_args[1], args[3]);
+        break;
+    case INDEX_op_brcond2_i32:
+        tcg_out_brcond2(s, args, const_args);
+        break;
+
+    case INDEX_op_neg_i32:
+        tcg_out32 (s, NEG | RT (args[0]) | RA (args[1]));
+        break;
+
+    case INDEX_op_qemu_ld8u:
+        tcg_out_qemu_ld(s, args, 0);
+        break;
+    case INDEX_op_qemu_ld8s:
+        tcg_out_qemu_ld(s, args, 0 | 4);
+        break;
+    case INDEX_op_qemu_ld16u:
+        tcg_out_qemu_ld(s, args, 1);
+        break;
+    case INDEX_op_qemu_ld16s:
+        tcg_out_qemu_ld(s, args, 1 | 4);
+        break;
+    case INDEX_op_qemu_ld32u:
+        tcg_out_qemu_ld(s, args, 2);
+        break;
+    case INDEX_op_qemu_ld64:
+        tcg_out_qemu_ld(s, args, 3);
+        break;
+    case INDEX_op_qemu_st8:
+        tcg_out_qemu_st(s, args, 0);
+        break;
+    case INDEX_op_qemu_st16:
+        tcg_out_qemu_st(s, args, 1);
+        break;
+    case INDEX_op_qemu_st32:
+        tcg_out_qemu_st(s, args, 2);
+        break;
+    case INDEX_op_qemu_st64:
+        tcg_out_qemu_st(s, args, 3);
+        break;
+
+    case INDEX_op_ext8s_i32:
+        tcg_out32 (s, EXTSB | RS (args[1]) | RA (args[0]));
+        break;
+    case INDEX_op_ext16s_i32:
+        tcg_out32 (s, EXTSH | RS (args[1]) | RA (args[0]));
+        break;
+
+    default:
+        tcg_dump_ops (s, stderr);
+        tcg_abort ();
+    }
+}
+
+static const TCGTargetOpDef ppc_op_defs[] = {
+    { INDEX_op_exit_tb, { } },
+    { INDEX_op_goto_tb, { } },
+    { INDEX_op_call, { "ri" } },
+    { INDEX_op_jmp, { "ri" } },
+    { INDEX_op_br, { } },
+
+    { INDEX_op_mov_i32, { "r", "r" } },
+    { INDEX_op_movi_i32, { "r" } },
+    { INDEX_op_ld8u_i32, { "r", "r" } },
+    { INDEX_op_ld8s_i32, { "r", "r" } },
+    { INDEX_op_ld16u_i32, { "r", "r" } },
+    { INDEX_op_ld16s_i32, { "r", "r" } },
+    { INDEX_op_ld_i32, { "r", "r" } },
+    { INDEX_op_st8_i32, { "r", "r" } },
+    { INDEX_op_st16_i32, { "r", "r" } },
+    { INDEX_op_st_i32, { "r", "r" } },
+
+    { INDEX_op_add_i32, { "r", "r", "ri" } },
+    { INDEX_op_mul_i32, { "r", "r", "ri" } },
+    { INDEX_op_div_i32, { "r", "r", "r" } },
+    { INDEX_op_divu_i32, { "r", "r", "r" } },
+    { INDEX_op_rem_i32, { "r", "r", "r" } },
+    { INDEX_op_remu_i32, { "r", "r", "r" } },
+    { INDEX_op_mulu2_i32, { "r", "r", "r", "r" } },
+    { INDEX_op_sub_i32, { "r", "r", "ri" } },
+    { INDEX_op_and_i32, { "r", "r", "ri" } },
+    { INDEX_op_or_i32, { "r", "r", "ri" } },
+    { INDEX_op_xor_i32, { "r", "r", "ri" } },
+
+    { INDEX_op_shl_i32, { "r", "r", "ri" } },
+    { INDEX_op_shr_i32, { "r", "r", "ri" } },
+    { INDEX_op_sar_i32, { "r", "r", "ri" } },
+
+    { INDEX_op_brcond_i32, { "r", "ri" } },
+
+    { INDEX_op_add2_i32, { "r", "r", "r", "r", "r", "r" } },
+    { INDEX_op_sub2_i32, { "r", "r", "r", "r", "r", "r" } },
+    { INDEX_op_brcond2_i32, { "r", "r", "r", "r" } },
+
+    { INDEX_op_neg_i32, { "r", "r" } },
+
+#if TARGET_LONG_BITS == 32
+    { INDEX_op_qemu_ld8u, { "r", "L" } },
+    { INDEX_op_qemu_ld8s, { "r", "L" } },
+    { INDEX_op_qemu_ld16u, { "r", "L" } },
+    { INDEX_op_qemu_ld16s, { "r", "L" } },
+    { INDEX_op_qemu_ld32u, { "r", "L" } },
+    { INDEX_op_qemu_ld32s, { "r", "L" } },
+    { INDEX_op_qemu_ld64, { "r", "r", "L" } },
+
+    { INDEX_op_qemu_st8, { "K", "K" } },
+    { INDEX_op_qemu_st16, { "K", "K" } },
+    { INDEX_op_qemu_st32, { "K", "K" } },
+    { INDEX_op_qemu_st64, { "M", "M", "M" } },
+#else
+    { INDEX_op_qemu_ld8u, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld8s, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld16u, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld16s, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld32u, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld32s, { "r", "L", "L" } },
+    { INDEX_op_qemu_ld64, { "r", "L", "L", "L" } },
+
+    { INDEX_op_qemu_st8, { "K", "K", "K" } },
+    { INDEX_op_qemu_st16, { "K", "K", "K" } },
+    { INDEX_op_qemu_st32, { "K", "K", "K" } },
+    { INDEX_op_qemu_st64, { "M", "M", "M", "M" } },
+#endif
+
+    { INDEX_op_ext8s_i32, { "r", "r" } },
+    { INDEX_op_ext16s_i32, { "r", "r" } },
+
+    { -1 },
+};
+
+void tcg_target_init(TCGContext *s)
+{
+    tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I32], 0, 0xffffffff);
+    tcg_regset_set32(tcg_target_call_clobber_regs, 0,
+                     (1 << TCG_REG_R0) |
+#ifdef __APPLE__
+                     (1 << TCG_REG_R2) |
+#endif
+                     (1 << TCG_REG_R3) |
+                     (1 << TCG_REG_R4) |
+                     (1 << TCG_REG_R5) |
+                     (1 << TCG_REG_R6) |
+                     (1 << TCG_REG_R7) |
+                     (1 << TCG_REG_R8) |
+                     (1 << TCG_REG_R9) |
+                     (1 << TCG_REG_R10) |
+                     (1 << TCG_REG_R11) |
+                     (1 << TCG_REG_R12)
+        );
+
+    tcg_regset_clear(s->reserved_regs);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R0);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R1);
+#ifndef __APPLE__
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R2);
+#endif
+
+    tcg_add_target_add_op_defs(ppc_op_defs);
+}
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
new file mode 100644
index 0000000..d46c19d
--- /dev/null
+++ b/tcg/ppc/tcg-target.h
@@ -0,0 +1,105 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#define TCG_TARGET_PPC 1
+
+#define TCG_TARGET_REG_BITS 32
+#define TCG_TARGET_WORDS_BIGENDIAN
+#define TCG_TARGET_NB_REGS 32
+
+enum {
+    TCG_REG_R0 = 0,
+    TCG_REG_R1,
+    TCG_REG_R2,
+    TCG_REG_R3,
+    TCG_REG_R4,
+    TCG_REG_R5,
+    TCG_REG_R6,
+    TCG_REG_R7,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10,
+    TCG_REG_R11,
+    TCG_REG_R12,
+    TCG_REG_R13,
+    TCG_REG_R14,
+    TCG_REG_R15,
+    TCG_REG_R16,
+    TCG_REG_R17,
+    TCG_REG_R18,
+    TCG_REG_R19,
+    TCG_REG_R20,
+    TCG_REG_R21,
+    TCG_REG_R22,
+    TCG_REG_R23,
+    TCG_REG_R24,
+    TCG_REG_R25,
+    TCG_REG_R26,
+    TCG_REG_R27,
+    TCG_REG_R28,
+    TCG_REG_R29,
+    TCG_REG_R30,
+    TCG_REG_R31
+};
+
+/* used for function call generation */
+#define TCG_REG_CALL_STACK TCG_REG_R1
+#define TCG_TARGET_STACK_ALIGN 16
+#ifdef __APPLE__
+#define TCG_TARGET_CALL_STACK_OFFSET 24
+#else
+#define TCG_TARGET_CALL_ALIGN_ARGS 1
+#define TCG_TARGET_CALL_STACK_OFFSET 8
+#endif
+
+/* optional instructions */
+#define TCG_TARGET_HAS_neg_i32
+#define TCG_TARGET_HAS_div_i32
+#define TCG_TARGET_HAS_ext8s_i32
+#define TCG_TARGET_HAS_ext16s_i32
+
+#define TCG_AREG0 TCG_REG_R27
+#define TCG_AREG1 TCG_REG_R24
+#define TCG_AREG2 TCG_REG_R25
+#define TCG_AREG3 TCG_REG_R26
+
+/* taken directly from tcg-dyngen.c */
+#define MIN_CACHE_LINE_SIZE 8 /* conservative value */
+
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
+{
+    unsigned long p;
+
+    start &= ~(MIN_CACHE_LINE_SIZE - 1);
+    stop = (stop + MIN_CACHE_LINE_SIZE - 1) & ~(MIN_CACHE_LINE_SIZE - 1);
+
+    for (p = start; p < stop; p += MIN_CACHE_LINE_SIZE) {
+        asm volatile ("dcbst 0,%0" : : "r"(p) : "memory");
+    }
+    asm volatile ("sync" : : : "memory");
+    for (p = start; p < stop; p += MIN_CACHE_LINE_SIZE) {
+        asm volatile ("icbi 0,%0" : : "r"(p) : "memory");
+    }
+    asm volatile ("sync" : : : "memory");
+    asm volatile ("isync" : : : "memory");
+}
diff --git a/tcg/ppc64/tcg-target.c b/tcg/ppc64/tcg-target.c
new file mode 100644
index 0000000..6b16efa
--- /dev/null
+++ b/tcg/ppc64/tcg-target.c
@@ -0,0 +1,1491 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#define TCG_CT_CONST_U32 0x100
+
+static uint8_t *tb_ret_addr;
+
+#define FAST_PATH
+
+#if TARGET_PHYS_ADDR_BITS == 32
+#define LD_ADDEND LWZ
+#else
+#define LD_ADDEND LD
+#endif
+
+#if TARGET_LONG_BITS == 32
+#define LD_ADDR LWZU
+#define CMP_L 0
+#else
+#define LD_ADDR LDU
+#define CMP_L (1<<21)
+#endif
+
+static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+    "r0",
+    "r1",
+    "rp",
+    "r3",
+    "r4",
+    "r5",
+    "r6",
+    "r7",
+    "r8",
+    "r9",
+    "r10",
+    "r11",
+    "r12",
+    "r13",
+    "r14",
+    "r15",
+    "r16",
+    "r17",
+    "r18",
+    "r19",
+    "r20",
+    "r21",
+    "r22",
+    "r23",
+    "r24",
+    "r25",
+    "r26",
+    "r27",
+    "r28",
+    "r29",
+    "r30",
+    "r31"
+};
+
+static const int tcg_target_reg_alloc_order[] = {
+    TCG_REG_R14,
+    TCG_REG_R15,
+    TCG_REG_R16,
+    TCG_REG_R17,
+    TCG_REG_R18,
+    TCG_REG_R19,
+    TCG_REG_R20,
+    TCG_REG_R21,
+    TCG_REG_R22,
+    TCG_REG_R23,
+    TCG_REG_R28,
+    TCG_REG_R29,
+    TCG_REG_R30,
+    TCG_REG_R31,
+    TCG_REG_R3,
+    TCG_REG_R4,
+    TCG_REG_R5,
+    TCG_REG_R6,
+    TCG_REG_R7,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10,
+    TCG_REG_R11,
+    TCG_REG_R12,
+    TCG_REG_R13,
+    TCG_REG_R0,
+    TCG_REG_R1,
+    TCG_REG_R2,
+    TCG_REG_R24,
+    TCG_REG_R25,
+    TCG_REG_R26,
+    TCG_REG_R27
+};
+
+static const int tcg_target_call_iarg_regs[] = {
+    TCG_REG_R3,
+    TCG_REG_R4,
+    TCG_REG_R5,
+    TCG_REG_R6,
+    TCG_REG_R7,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10
+};
+
+static const int tcg_target_call_oarg_regs[2] = {
+    TCG_REG_R3
+};
+
+static const int tcg_target_callee_save_regs[] = {
+    TCG_REG_R14,
+    TCG_REG_R15,
+    TCG_REG_R16,
+    TCG_REG_R17,
+    TCG_REG_R18,
+    TCG_REG_R19,
+    TCG_REG_R20,
+    TCG_REG_R21,
+    TCG_REG_R22,
+    TCG_REG_R23,
+    TCG_REG_R28,
+    TCG_REG_R29,
+    TCG_REG_R30,
+    TCG_REG_R31
+};
+
+static uint32_t reloc_pc24_val (void *pc, tcg_target_long target)
+{
+    tcg_target_long disp;
+
+    disp = target - (tcg_target_long) pc;
+    if ((disp << 38) >> 38 != disp)
+        tcg_abort ();
+
+    return disp & 0x3fffffc;
+}
+
+static void reloc_pc24 (void *pc, tcg_target_long target)
+{
+    *(uint32_t *) pc = (*(uint32_t *) pc & ~0x3fffffc)
+        | reloc_pc24_val (pc, target);
+}
+
+static uint16_t reloc_pc14_val (void *pc, tcg_target_long target)
+{
+    tcg_target_long disp;
+
+    disp = target - (tcg_target_long) pc;
+    if (disp != (int16_t) disp)
+        tcg_abort ();
+
+    return disp & 0xfffc;
+}
+
+static void reloc_pc14 (void *pc, tcg_target_long target)
+{
+    *(uint32_t *) pc = (*(uint32_t *) pc & ~0xfffc)
+        | reloc_pc14_val (pc, target);
+}
+
+static void patch_reloc (uint8_t *code_ptr, int type,
+                         tcg_target_long value, tcg_target_long addend)
+{
+    value += addend;
+    switch (type) {
+    case R_PPC_REL14:
+        reloc_pc14 (code_ptr, value);
+        break;
+    case R_PPC_REL24:
+        reloc_pc24 (code_ptr, value);
+        break;
+    default:
+        tcg_abort ();
+    }
+}
+
+/* maximum number of register used for input function arguments */
+static int tcg_target_get_call_iarg_regs_count (int flags)
+{
+    return sizeof (tcg_target_call_iarg_regs) / sizeof (tcg_target_call_iarg_regs[0]);
+}
+
+/* parse target specific constraints */
+static int target_parse_constraint (TCGArgConstraint *ct, const char **pct_str)
+{
+    const char *ct_str;
+
+    ct_str = *pct_str;
+    switch (ct_str[0]) {
+    case 'A': case 'B': case 'C': case 'D':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg (ct->u.regs, 3 + ct_str[0] - 'A');
+        break;
+    case 'r':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32 (ct->u.regs, 0, 0xffffffff);
+        break;
+    case 'L':                   /* qemu_ld constraint */
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32 (ct->u.regs, 0, 0xffffffff);
+        tcg_regset_reset_reg (ct->u.regs, TCG_REG_R3);
+#ifdef CONFIG_SOFTMMU
+        tcg_regset_reset_reg (ct->u.regs, TCG_REG_R4);
+#endif
+        break;
+    case 'S':                   /* qemu_st constraint */
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32 (ct->u.regs, 0, 0xffffffff);
+        tcg_regset_reset_reg (ct->u.regs, TCG_REG_R3);
+#ifdef CONFIG_SOFTMMU
+        tcg_regset_reset_reg (ct->u.regs, TCG_REG_R4);
+        tcg_regset_reset_reg (ct->u.regs, TCG_REG_R5);
+#endif
+        break;
+    case 'Z':
+        ct->ct |= TCG_CT_CONST_U32;
+        break;
+    default:
+        return -1;
+    }
+    ct_str++;
+    *pct_str = ct_str;
+    return 0;
+}
+
+/* test if a constant matches the constraint */
+static int tcg_target_const_match (tcg_target_long val,
+                                   const TCGArgConstraint *arg_ct)
+{
+    int ct;
+
+    ct = arg_ct->ct;
+    if (ct & TCG_CT_CONST)
+        return 1;
+    else if ((ct & TCG_CT_CONST_U32) && (val == (uint32_t) val))
+        return 1;
+    return 0;
+}
+
+#define OPCD(opc) ((opc)<<26)
+#define XO19(opc) (OPCD(19)|((opc)<<1))
+#define XO30(opc) (OPCD(30)|((opc)<<2))
+#define XO31(opc) (OPCD(31)|((opc)<<1))
+#define XO58(opc) (OPCD(58)|(opc))
+#define XO62(opc) (OPCD(62)|(opc))
+
+#define B      OPCD( 18)
+#define BC     OPCD( 16)
+#define LBZ    OPCD( 34)
+#define LHZ    OPCD( 40)
+#define LHA    OPCD( 42)
+#define LWZ    OPCD( 32)
+#define STB    OPCD( 38)
+#define STH    OPCD( 44)
+#define STW    OPCD( 36)
+
+#define STD    XO62(  0)
+#define STDU   XO62(  1)
+#define STDX   XO31(149)
+
+#define LD     XO58(  0)
+#define LDX    XO31( 21)
+#define LDU    XO58(  1)
+#define LWA    XO58(  2)
+#define LWAX   XO31(341)
+
+#define ADDI   OPCD( 14)
+#define ADDIS  OPCD( 15)
+#define ORI    OPCD( 24)
+#define ORIS   OPCD( 25)
+#define XORI   OPCD( 26)
+#define XORIS  OPCD( 27)
+#define ANDI   OPCD( 28)
+#define ANDIS  OPCD( 29)
+#define MULLI  OPCD(  7)
+#define CMPLI  OPCD( 10)
+#define CMPI   OPCD( 11)
+
+#define LWZU   OPCD( 33)
+#define STWU   OPCD( 37)
+
+#define RLWINM OPCD( 21)
+
+#define RLDICL XO30(  0)
+#define RLDICR XO30(  1)
+
+#define BCLR   XO19( 16)
+#define BCCTR  XO19(528)
+#define CRAND  XO19(257)
+#define CRANDC XO19(129)
+#define CRNAND XO19(225)
+#define CROR   XO19(449)
+
+#define EXTSB  XO31(954)
+#define EXTSH  XO31(922)
+#define EXTSW  XO31(986)
+#define ADD    XO31(266)
+#define ADDE   XO31(138)
+#define ADDC   XO31( 10)
+#define AND    XO31( 28)
+#define SUBF   XO31( 40)
+#define SUBFC  XO31(  8)
+#define SUBFE  XO31(136)
+#define OR     XO31(444)
+#define XOR    XO31(316)
+#define MULLW  XO31(235)
+#define MULHWU XO31( 11)
+#define DIVW   XO31(491)
+#define DIVWU  XO31(459)
+#define CMP    XO31(  0)
+#define CMPL   XO31( 32)
+#define LHBRX  XO31(790)
+#define LWBRX  XO31(534)
+#define STHBRX XO31(918)
+#define STWBRX XO31(662)
+#define MFSPR  XO31(339)
+#define MTSPR  XO31(467)
+#define SRAWI  XO31(824)
+#define NEG    XO31(104)
+
+#define MULLD  XO31(233)
+#define MULHD  XO31( 73)
+#define MULHDU XO31(  9)
+#define DIVD   XO31(489)
+#define DIVDU  XO31(457)
+
+#define LBZX   XO31( 87)
+#define LHZX   XO31(276)
+#define LHAX   XO31(343)
+#define LWZX   XO31( 23)
+#define STBX   XO31(215)
+#define STHX   XO31(407)
+#define STWX   XO31(151)
+
+#define SPR(a,b) ((((a)<<5)|(b))<<11)
+#define LR     SPR(8, 0)
+#define CTR    SPR(9, 0)
+
+#define SLW    XO31( 24)
+#define SRW    XO31(536)
+#define SRAW   XO31(792)
+
+#define SLD    XO31( 27)
+#define SRD    XO31(539)
+#define SRAD   XO31(794)
+#define SRADI  XO31(413<<1)
+
+#define LMW    OPCD( 46)
+#define STMW   OPCD( 47)
+
+#define TW     XO31( 4)
+#define TRAP   (TW | TO (31))
+
+#define RT(r) ((r)<<21)
+#define RS(r) ((r)<<21)
+#define RA(r) ((r)<<16)
+#define RB(r) ((r)<<11)
+#define TO(t) ((t)<<21)
+#define SH(s) ((s)<<11)
+#define MB(b) ((b)<<6)
+#define ME(e) ((e)<<1)
+#define BO(o) ((o)<<21)
+#define MB64(b) ((b)<<5)
+
+#define LK    1
+
+#define TAB(t,a,b) (RT(t) | RA(a) | RB(b))
+#define SAB(s,a,b) (RS(s) | RA(a) | RB(b))
+
+#define BF(n)    ((n)<<23)
+#define BI(n, c) (((c)+((n)*4))<<16)
+#define BT(n, c) (((c)+((n)*4))<<21)
+#define BA(n, c) (((c)+((n)*4))<<16)
+#define BB(n, c) (((c)+((n)*4))<<11)
+
+#define BO_COND_TRUE  BO (12)
+#define BO_COND_FALSE BO ( 4)
+#define BO_ALWAYS     BO (20)
+
+enum {
+    CR_LT,
+    CR_GT,
+    CR_EQ,
+    CR_SO
+};
+
+static const uint32_t tcg_to_bc[10] = {
+    [TCG_COND_EQ]  = BC | BI (7, CR_EQ) | BO_COND_TRUE,
+    [TCG_COND_NE]  = BC | BI (7, CR_EQ) | BO_COND_FALSE,
+    [TCG_COND_LT]  = BC | BI (7, CR_LT) | BO_COND_TRUE,
+    [TCG_COND_GE]  = BC | BI (7, CR_LT) | BO_COND_FALSE,
+    [TCG_COND_LE]  = BC | BI (7, CR_GT) | BO_COND_FALSE,
+    [TCG_COND_GT]  = BC | BI (7, CR_GT) | BO_COND_TRUE,
+    [TCG_COND_LTU] = BC | BI (7, CR_LT) | BO_COND_TRUE,
+    [TCG_COND_GEU] = BC | BI (7, CR_LT) | BO_COND_FALSE,
+    [TCG_COND_LEU] = BC | BI (7, CR_GT) | BO_COND_FALSE,
+    [TCG_COND_GTU] = BC | BI (7, CR_GT) | BO_COND_TRUE,
+};
+
+static void tcg_out_mov (TCGContext *s, int ret, int arg)
+{
+    tcg_out32 (s, OR | SAB (arg, ret, arg));
+}
+
+static void tcg_out_rld (TCGContext *s, int op, int ra, int rs, int sh, int mb)
+{
+    sh = SH (sh & 0x1f) | (((sh >> 5) & 1) << 1);
+    mb = MB64 ((mb >> 5) | ((mb << 1) & 0x3f));
+    tcg_out32 (s, op | RA (ra) | RS (rs) | sh | mb);
+}
+
+static void tcg_out_movi32 (TCGContext *s, int ret, int32_t arg)
+{
+    if (arg == (int16_t) arg)
+        tcg_out32 (s, ADDI | RT (ret) | RA (0) | (arg & 0xffff));
+    else {
+        tcg_out32 (s, ADDIS | RT (ret) | RA (0) | ((arg >> 16) & 0xffff));
+        if (arg & 0xffff)
+            tcg_out32 (s, ORI | RS (ret) | RA (ret) | (arg & 0xffff));
+    }
+}
+
+static void tcg_out_movi (TCGContext *s, TCGType type,
+                          int ret, tcg_target_long arg)
+{
+    int32_t arg32 = arg;
+
+    if (type == TCG_TYPE_I32 || arg == arg32) {
+        tcg_out_movi32 (s, ret, arg32);
+    }
+    else {
+        if ((uint64_t) arg >> 32) {
+            uint16_t h16 = arg >> 16;
+            uint16_t l16 = arg;
+
+            tcg_out_movi32 (s, ret, arg >> 32);
+            tcg_out_rld (s, RLDICR, ret, ret, 32, 31);
+            if (h16) tcg_out32 (s, ORIS | RS (ret) | RA (ret) | h16);
+            if (l16) tcg_out32 (s, ORI | RS (ret) | RA (ret) | l16);
+        }
+        else {
+            tcg_out_movi32 (s, ret, arg32);
+            if (arg32 < 0)
+                tcg_out_rld (s, RLDICL, ret, ret, 0, 32);
+        }
+    }
+}
+
+static void tcg_out_call (TCGContext *s, tcg_target_long arg, int const_arg)
+{
+    int reg;
+
+    if (const_arg) {
+        reg = 2;
+        tcg_out_movi (s, TCG_TYPE_I64, reg, arg);
+    }
+    else reg = arg;
+
+    tcg_out32 (s, LD | RT (0) | RA (reg));
+    tcg_out32 (s, MTSPR | RA (0) | CTR);
+    tcg_out32 (s, LD | RT (11) | RA (reg) | 16);
+    tcg_out32 (s, LD | RT (2) | RA (reg) | 8);
+    tcg_out32 (s, BCCTR | BO_ALWAYS | LK);
+}
+
+static void tcg_out_ldst (TCGContext *s, int ret, int addr,
+                          int offset, int op1, int op2)
+{
+    if (offset == (int16_t) offset)
+        tcg_out32 (s, op1 | RT (ret) | RA (addr) | (offset & 0xffff));
+    else {
+        tcg_out_movi (s, TCG_TYPE_I64, 0, offset);
+        tcg_out32 (s, op2 | RT (ret) | RA (addr) | RB (0));
+    }
+}
+
+static void tcg_out_b (TCGContext *s, int mask, tcg_target_long target)
+{
+    tcg_target_long disp;
+
+    disp = target - (tcg_target_long) s->code_ptr;
+    if ((disp << 38) >> 38 == disp)
+        tcg_out32 (s, B | (disp & 0x3fffffc) | mask);
+    else {
+        tcg_out_movi (s, TCG_TYPE_I64, 0, (tcg_target_long) target);
+        tcg_out32 (s, MTSPR | RS (0) | CTR);
+        tcg_out32 (s, BCCTR | BO_ALWAYS | mask);
+    }
+}
+
+#if defined (CONFIG_SOFTMMU)
+
+#include "../../softmmu_defs.h"
+
+static void *qemu_ld_helpers[4] = {
+    __ldb_mmu,
+    __ldw_mmu,
+    __ldl_mmu,
+    __ldq_mmu,
+};
+
+static void *qemu_st_helpers[4] = {
+    __stb_mmu,
+    __stw_mmu,
+    __stl_mmu,
+    __stq_mmu,
+};
+
+static void tcg_out_tlb_read (TCGContext *s, int r0, int r1, int r2,
+                              int addr_reg, int s_bits, int offset)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_out_rld (s, RLDICL, addr_reg, addr_reg, 0, 32);
+
+    tcg_out32 (s, (RLWINM
+                   | RA (r0)
+                   | RS (addr_reg)
+                   | SH (32 - (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS))
+                   | MB (32 - (CPU_TLB_BITS + CPU_TLB_ENTRY_BITS))
+                   | ME (31 - CPU_TLB_ENTRY_BITS)
+                   )
+        );
+    tcg_out32 (s, ADD | RT (r0) | RA (r0) | RB (TCG_AREG0));
+    tcg_out32 (s, (LWZU | RT (r1) | RA (r0) | offset));
+    tcg_out32 (s, (RLWINM
+                   | RA (r2)
+                   | RS (addr_reg)
+                   | SH (0)
+                   | MB ((32 - s_bits) & 31)
+                   | ME (31 - TARGET_PAGE_BITS)
+                   )
+        );
+#else
+    tcg_out_rld (s, RLDICL, r0, addr_reg,
+                 64 - TARGET_PAGE_BITS,
+                 64 - CPU_TLB_BITS);
+    tcg_out_rld (s, RLDICR, r0, r0,
+                 CPU_TLB_ENTRY_BITS,
+                 63 - CPU_TLB_ENTRY_BITS);
+
+    tcg_out32 (s, ADD | TAB (r0, r0, TCG_AREG0));
+    tcg_out32 (s, LD_ADDR | RT (r1) | RA (r0) | offset);
+
+    if (!s_bits) {
+        tcg_out_rld (s, RLDICR, r2, addr_reg, 0, 63 - TARGET_PAGE_BITS);
+    }
+    else {
+        tcg_out_rld (s, RLDICL, r2, addr_reg,
+                     64 - TARGET_PAGE_BITS,
+                     TARGET_PAGE_BITS - s_bits);
+        tcg_out_rld (s, RLDICL, r2, r2, TARGET_PAGE_BITS, 0);
+    }
+#endif
+}
+#endif
+
+static void tcg_out_qemu_ld (TCGContext *s, const TCGArg *args, int opc)
+{
+    int addr_reg, data_reg, r0, r1, mem_index, s_bits, bswap;
+#ifdef CONFIG_SOFTMMU
+    int r2;
+    void *label1_ptr, *label2_ptr;
+#endif
+
+    data_reg = *args++;
+    addr_reg = *args++;
+    mem_index = *args;
+    s_bits = opc & 3;
+
+#ifdef CONFIG_SOFTMMU
+    r0 = 3;
+    r1 = 4;
+    r2 = 0;
+
+    tcg_out_tlb_read (s, r0, r1, r2, addr_reg, s_bits,
+                      offsetof (CPUState, tlb_table[mem_index][0].addr_read));
+
+    tcg_out32 (s, CMP | BF (7) | RA (r2) | RB (r1) | CMP_L);
+
+    label1_ptr = s->code_ptr;
+#ifdef FAST_PATH
+    tcg_out32 (s, BC | BI (7, CR_EQ) | BO_COND_TRUE);
+#endif
+
+    /* slow path */
+    tcg_out_mov (s, 3, addr_reg);
+    tcg_out_movi (s, TCG_TYPE_I64, 4, mem_index);
+
+    tcg_out_call (s, (tcg_target_long) qemu_ld_helpers[s_bits], 1);
+
+    switch (opc) {
+    case 0|4:
+        tcg_out32 (s, EXTSB | RA (data_reg) | RS (3));
+        break;
+    case 1|4:
+        tcg_out32 (s, EXTSH | RA (data_reg) | RS (3));
+        break;
+    case 2|4:
+        tcg_out32 (s, EXTSW | RA (data_reg) | RS (3));
+        break;
+    case 0:
+    case 1:
+    case 2:
+    case 3:
+        if (data_reg != 3)
+            tcg_out_mov (s, data_reg, 3);
+        break;
+    }
+    label2_ptr = s->code_ptr;
+    tcg_out32 (s, B);
+
+    /* label1: fast path */
+#ifdef FAST_PATH
+    reloc_pc14 (label1_ptr, (tcg_target_long) s->code_ptr);
+#endif
+
+    /* r0 now contains &env->tlb_table[mem_index][index].addr_read */
+    tcg_out32 (s, (LD_ADDEND
+                   | RT (r0)
+                   | RA (r0)
+                   | (offsetof (CPUTLBEntry, addend)
+                      - offsetof (CPUTLBEntry, addr_read))
+                   ));
+    /* r0 = env->tlb_table[mem_index][index].addend */
+    tcg_out32 (s, ADD | RT (r0) | RA (r0) | RB (addr_reg));
+    /* r0 = env->tlb_table[mem_index][index].addend + addr */
+
+#else  /* !CONFIG_SOFTMMU */
+#if TARGET_LONG_BITS == 32
+    tcg_out_rld (s, RLDICL, addr_reg, addr_reg, 0, 32);
+#endif
+    r0 = addr_reg;
+    r1 = 3;
+#endif
+
+#ifdef TARGET_WORDS_BIGENDIAN
+    bswap = 0;
+#else
+    bswap = 1;
+#endif
+    switch (opc) {
+    default:
+    case 0:
+        tcg_out32 (s, LBZ | RT (data_reg) | RA (r0));
+        break;
+    case 0|4:
+        tcg_out32 (s, LBZ | RT (data_reg) | RA (r0));
+        tcg_out32 (s, EXTSB | RA (data_reg) | RS (data_reg));
+        break;
+    case 1:
+        if (bswap) tcg_out32 (s, LHBRX | RT (data_reg) | RB (r0));
+        else tcg_out32 (s, LHZ | RT (data_reg) | RA (r0));
+        break;
+    case 1|4:
+        if (bswap) {
+            tcg_out32 (s, LHBRX | RT (data_reg) | RB (r0));
+            tcg_out32 (s, EXTSH | RA (data_reg) | RS (data_reg));
+        }
+        else tcg_out32 (s, LHA | RT (data_reg) | RA (r0));
+        break;
+    case 2:
+        if (bswap) tcg_out32 (s, LWBRX | RT (data_reg) | RB (r0));
+        else tcg_out32 (s, LWZ | RT (data_reg)| RA (r0));
+        break;
+    case 2|4:
+        if (bswap) {
+            tcg_out32 (s, LWBRX | RT (data_reg) | RB (r0));
+            tcg_out32 (s, EXTSW | RA (data_reg) | RS (data_reg));
+        }
+        else tcg_out32 (s, LWA | RT (data_reg)| RA (r0));
+        break;
+    case 3:
+        if (bswap) {
+            tcg_out32 (s, LWBRX | RT (0) | RB (r0));
+            tcg_out32 (s, ADDI | RT (r1) | RA (r0) | 4);
+            tcg_out32 (s, LWBRX | RT (data_reg) | RB (r1));
+            tcg_out_rld (s, RLDICR, data_reg, data_reg, 32, 31);
+            tcg_out32 (s, OR | SAB (0, data_reg, data_reg));
+        }
+        else tcg_out32 (s, LD | RT (data_reg) | RA (r0));
+        break;
+    }
+
+#ifdef CONFIG_SOFTMMU
+    reloc_pc24 (label2_ptr, (tcg_target_long) s->code_ptr);
+#endif
+}
+
+static void tcg_out_qemu_st (TCGContext *s, const TCGArg *args, int opc)
+{
+    int addr_reg, r0, r1, data_reg, mem_index, bswap;
+#ifdef CONFIG_SOFTMMU
+    int r2;
+    void *label1_ptr, *label2_ptr;
+#endif
+
+    data_reg = *args++;
+    addr_reg = *args++;
+    mem_index = *args;
+
+#ifdef CONFIG_SOFTMMU
+    r0 = 3;
+    r1 = 4;
+    r2 = 0;
+
+    tcg_out_tlb_read (s, r0, r1, r2, addr_reg, opc,
+                      offsetof (CPUState, tlb_table[mem_index][0].addr_write));
+
+    tcg_out32 (s, CMP | BF (7) | RA (r2) | RB (r1) | CMP_L);
+
+    label1_ptr = s->code_ptr;
+#ifdef FAST_PATH
+    tcg_out32 (s, BC | BI (7, CR_EQ) | BO_COND_TRUE);
+#endif
+
+    /* slow path */
+    tcg_out_mov (s, 3, addr_reg);
+    tcg_out_rld (s, RLDICL, 4, data_reg, 0, 64 - (1 << (3 + opc)));
+    tcg_out_movi (s, TCG_TYPE_I64, 5, mem_index);
+
+    tcg_out_call (s, (tcg_target_long) qemu_st_helpers[opc], 1);
+
+    label2_ptr = s->code_ptr;
+    tcg_out32 (s, B);
+
+    /* label1: fast path */
+#ifdef FAST_PATH
+    reloc_pc14 (label1_ptr, (tcg_target_long) s->code_ptr);
+#endif
+
+    tcg_out32 (s, (LD_ADDEND
+                   | RT (r0)
+                   | RA (r0)
+                   | (offsetof (CPUTLBEntry, addend)
+                      - offsetof (CPUTLBEntry, addr_write))
+                   ));
+    /* r0 = env->tlb_table[mem_index][index].addend */
+    tcg_out32 (s, ADD | RT (r0) | RA (r0) | RB (addr_reg));
+    /* r0 = env->tlb_table[mem_index][index].addend + addr */
+
+#else  /* !CONFIG_SOFTMMU */
+#if TARGET_LONG_BITS == 32
+    tcg_out_rld (s, RLDICL, addr_reg, addr_reg, 0, 32);
+#endif
+    r1 = 3;
+    r0 = addr_reg;
+#endif
+
+#ifdef TARGET_WORDS_BIGENDIAN
+    bswap = 0;
+#else
+    bswap = 1;
+#endif
+    switch (opc) {
+    case 0:
+        tcg_out32 (s, STB | RS (data_reg) | RA (r0));
+        break;
+    case 1:
+        if (bswap) tcg_out32 (s, STHBRX | RS (data_reg) | RA (0) | RB (r0));
+        else tcg_out32 (s, STH | RS (data_reg) | RA (r0));
+        break;
+    case 2:
+        if (bswap) tcg_out32 (s, STWBRX | RS (data_reg) | RA (0) | RB (r0));
+        else tcg_out32 (s, STW | RS (data_reg) | RA (r0));
+        break;
+    case 3:
+        if (bswap) {
+            tcg_out32 (s, STWBRX | RS (data_reg) | RA (0) | RB (r0));
+            tcg_out32 (s, ADDI | RT (r1) | RA (r0) | 4);
+            tcg_out_rld (s, RLDICL, 0, data_reg, 32, 0);
+            tcg_out32 (s, STWBRX | RS (0) | RA (0) | RB (r1));
+        }
+        else tcg_out32 (s, STD | RS (data_reg) | RA (r0));
+        break;
+    }
+
+#ifdef CONFIG_SOFTMMU
+    reloc_pc24 (label2_ptr, (tcg_target_long) s->code_ptr);
+#endif
+}
+
+void tcg_target_qemu_prologue (TCGContext *s)
+{
+    int i, frame_size;
+    uint64_t addr;
+
+    frame_size = 0
+        + 8                     /* back chain */
+        + 8                     /* CR */
+        + 8                     /* LR */
+        + 8                     /* compiler doubleword */
+        + 8                     /* link editor doubleword */
+        + 8                     /* TOC save area */
+        + TCG_STATIC_CALL_ARGS_SIZE
+        + ARRAY_SIZE (tcg_target_callee_save_regs) * 8
+        ;
+    frame_size = (frame_size + 15) & ~15;
+
+    /* First emit adhoc function descriptor */
+    addr = (uint64_t) s->code_ptr + 24;
+    tcg_out32 (s, addr >> 32); tcg_out32 (s, addr); /* entry point */
+    s->code_ptr += 16;          /* skip TOC and environment pointer */
+
+    /* Prologue */
+    tcg_out32 (s, MFSPR | RT (0) | LR);
+    tcg_out32 (s, STDU | RS (1) | RA (1) | (-frame_size & 0xffff));
+    for (i = 0; i < ARRAY_SIZE (tcg_target_callee_save_regs); ++i)
+        tcg_out32 (s, (STD
+                       | RS (tcg_target_callee_save_regs[i])
+                       | RA (1)
+                       | (i * 8 + 48 + TCG_STATIC_CALL_ARGS_SIZE)
+                       )
+            );
+    tcg_out32 (s, STD | RS (0) | RA (1) | (frame_size + 16));
+
+    tcg_out32 (s, MTSPR | RS (3) | CTR);
+    tcg_out32 (s, BCCTR | BO_ALWAYS);
+
+    /* Epilogue */
+    tb_ret_addr = s->code_ptr;
+
+    for (i = 0; i < ARRAY_SIZE (tcg_target_callee_save_regs); ++i)
+        tcg_out32 (s, (LD
+                       | RT (tcg_target_callee_save_regs[i])
+                       | RA (1)
+                       | (i * 8 + 48 + TCG_STATIC_CALL_ARGS_SIZE)
+                       )
+            );
+    tcg_out32 (s, LD | RT (0) | RA (1) | (frame_size + 16));
+    tcg_out32 (s, MTSPR | RS (0) | LR);
+    tcg_out32 (s, ADDI | RT (1) | RA (1) | frame_size);
+    tcg_out32 (s, BCLR | BO_ALWAYS);
+}
+
+static void tcg_out_ld (TCGContext *s, TCGType type, int ret, int arg1,
+                        tcg_target_long arg2)
+{
+    if (type == TCG_TYPE_I32)
+        tcg_out_ldst (s, ret, arg1, arg2, LWZ, LWZX);
+    else
+        tcg_out_ldst (s, ret, arg1, arg2, LD, LDX);
+}
+
+static void tcg_out_st (TCGContext *s, TCGType type, int arg, int arg1,
+                        tcg_target_long arg2)
+{
+    if (type == TCG_TYPE_I32)
+        tcg_out_ldst (s, arg, arg1, arg2, STW, STWX);
+    else
+        tcg_out_ldst (s, arg, arg1, arg2, STD, STDX);
+}
+
+static void ppc_addi32 (TCGContext *s, int rt, int ra, tcg_target_long si)
+{
+    if (!si && rt == ra)
+        return;
+
+    if (si == (int16_t) si)
+        tcg_out32 (s, ADDI | RT (rt) | RA (ra) | (si & 0xffff));
+    else {
+        uint16_t h = ((si >> 16) & 0xffff) + ((uint16_t) si >> 15);
+        tcg_out32 (s, ADDIS | RT (rt) | RA (ra) | h);
+        tcg_out32 (s, ADDI | RT (rt) | RA (rt) | (si & 0xffff));
+    }
+}
+
+static void ppc_addi64 (TCGContext *s, int rt, int ra, tcg_target_long si)
+{
+    /* XXX: suboptimal */
+    if (si == (int16_t) si
+        || (((uint64_t) si >> 31) == 0) && (si & 0x8000) == 0)
+        ppc_addi32 (s, rt, ra, si);
+    else {
+        tcg_out_movi (s, TCG_TYPE_I64, 0, si);
+        tcg_out32 (s, ADD | RT (rt) | RA (ra));
+    }
+}
+
+static void tcg_out_addi (TCGContext *s, int reg, tcg_target_long val)
+{
+    ppc_addi64 (s, reg, reg, val);
+}
+
+static void tcg_out_cmp (TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
+                         int const_arg2, int cr, int arch64)
+{
+    int imm;
+    uint32_t op;
+
+    switch (cond) {
+    case TCG_COND_EQ:
+    case TCG_COND_NE:
+        if (const_arg2) {
+            if ((int16_t) arg2 == arg2) {
+                op = CMPI;
+                imm = 1;
+                break;
+            }
+            else if ((uint16_t) arg2 == arg2) {
+                op = CMPLI;
+                imm = 1;
+                break;
+            }
+        }
+        op = CMPL;
+        imm = 0;
+        break;
+
+    case TCG_COND_LT:
+    case TCG_COND_GE:
+    case TCG_COND_LE:
+    case TCG_COND_GT:
+        if (const_arg2) {
+            if ((int16_t) arg2 == arg2) {
+                op = CMPI;
+                imm = 1;
+                break;
+            }
+        }
+        op = CMP;
+        imm = 0;
+        break;
+
+    case TCG_COND_LTU:
+    case TCG_COND_GEU:
+    case TCG_COND_LEU:
+    case TCG_COND_GTU:
+        if (const_arg2) {
+            if ((uint16_t) arg2 == arg2) {
+                op = CMPLI;
+                imm = 1;
+                break;
+            }
+        }
+        op = CMPL;
+        imm = 0;
+        break;
+
+    default:
+        tcg_abort ();
+    }
+    op |= BF (cr) | (arch64 << 21);
+
+    if (imm)
+        tcg_out32 (s, op | RA (arg1) | (arg2 & 0xffff));
+    else {
+        if (const_arg2) {
+            tcg_out_movi (s, TCG_TYPE_I64, 0, arg2);
+            tcg_out32 (s, op | RA (arg1) | RB (0));
+        }
+        else
+            tcg_out32 (s, op | RA (arg1) | RB (arg2));
+    }
+
+}
+
+static void tcg_out_bc (TCGContext *s, int bc, int label_index)
+{
+    TCGLabel *l = &s->labels[label_index];
+
+    if (l->has_value)
+        tcg_out32 (s, bc | reloc_pc14_val (s->code_ptr, l->u.value));
+    else {
+        uint16_t val = *(uint16_t *) &s->code_ptr[2];
+
+        /* Thanks to Andrzej Zaborowski */
+        tcg_out32 (s, bc | (val & 0xfffc));
+        tcg_out_reloc (s, s->code_ptr - 4, R_PPC_REL14, label_index, 0);
+    }
+}
+
+static void tcg_out_brcond (TCGContext *s, int cond,
+                            TCGArg arg1, TCGArg arg2, int const_arg2,
+                            int label_index, int arch64)
+{
+    tcg_out_cmp (s, cond, arg1, arg2, const_arg2, 7, arch64);
+    tcg_out_bc (s, tcg_to_bc[cond], label_index);
+}
+
+void ppc_tb_set_jmp_target (unsigned long jmp_addr, unsigned long addr)
+{
+    TCGContext s;
+    unsigned long patch_size;
+
+    s.code_ptr = (uint8_t *) jmp_addr;
+    tcg_out_b (&s, 0, addr);
+    patch_size = s.code_ptr - (uint8_t *) jmp_addr;
+    flush_icache_range (jmp_addr, jmp_addr + patch_size);
+}
+
+static void tcg_out_op (TCGContext *s, int opc, const TCGArg *args,
+                        const int *const_args)
+{
+    int c;
+
+    switch (opc) {
+    case INDEX_op_exit_tb:
+        tcg_out_movi (s, TCG_TYPE_I64, TCG_REG_R3, args[0]);
+        tcg_out_b (s, 0, (tcg_target_long) tb_ret_addr);
+        break;
+    case INDEX_op_goto_tb:
+        if (s->tb_jmp_offset) {
+            /* direct jump method */
+
+            s->tb_jmp_offset[args[0]] = s->code_ptr - s->code_buf;
+            s->code_ptr += 28;
+        }
+        else {
+            tcg_abort ();
+        }
+        s->tb_next_offset[args[0]] = s->code_ptr - s->code_buf;
+        break;
+    case INDEX_op_br:
+        {
+            TCGLabel *l = &s->labels[args[0]];
+
+            if (l->has_value) {
+                tcg_out_b (s, 0, l->u.value);
+            }
+            else {
+                uint32_t val = *(uint32_t *) s->code_ptr;
+
+                /* Thanks to Andrzej Zaborowski */
+                tcg_out32 (s, B | (val & 0x3fffffc));
+                tcg_out_reloc (s, s->code_ptr - 4, R_PPC_REL24, args[0], 0);
+            }
+        }
+        break;
+    case INDEX_op_call:
+        tcg_out_call (s, args[0], const_args[0]);
+        break;
+    case INDEX_op_jmp:
+        if (const_args[0]) {
+            tcg_out_b (s, 0, args[0]);
+        }
+        else {
+            tcg_out32 (s, MTSPR | RS (args[0]) | CTR);
+            tcg_out32 (s, BCCTR | BO_ALWAYS);
+        }
+        break;
+    case INDEX_op_movi_i32:
+        tcg_out_movi (s, TCG_TYPE_I32, args[0], args[1]);
+        break;
+    case INDEX_op_movi_i64:
+        tcg_out_movi (s, TCG_TYPE_I64, args[0], args[1]);
+        break;
+    case INDEX_op_ld8u_i32:
+    case INDEX_op_ld8u_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], LBZ, LBZX);
+        break;
+    case INDEX_op_ld8s_i32:
+    case INDEX_op_ld8s_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], LBZ, LBZX);
+        tcg_out32 (s, EXTSB | RS (args[0]) | RA (args[0]));
+        break;
+    case INDEX_op_ld16u_i32:
+    case INDEX_op_ld16u_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], LHZ, LHZX);
+        break;
+    case INDEX_op_ld16s_i32:
+    case INDEX_op_ld16s_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], LHA, LHAX);
+        break;
+    case INDEX_op_ld_i32:
+    case INDEX_op_ld32u_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], LWZ, LWZX);
+        break;
+    case INDEX_op_ld32s_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], LWA, LWAX);
+        break;
+    case INDEX_op_ld_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], LD, LDX);
+        break;
+    case INDEX_op_st8_i32:
+    case INDEX_op_st8_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], STB, STBX);
+        break;
+    case INDEX_op_st16_i32:
+    case INDEX_op_st16_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], STH, STHX);
+        break;
+    case INDEX_op_st_i32:
+    case INDEX_op_st32_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], STW, STWX);
+        break;
+    case INDEX_op_st_i64:
+        tcg_out_ldst (s, args[0], args[1], args[2], STD, STDX);
+        break;
+
+    case INDEX_op_add_i32:
+        if (const_args[2])
+            ppc_addi32 (s, args[0], args[1], args[2]);
+        else
+            tcg_out32 (s, ADD | TAB (args[0], args[1], args[2]));
+        break;
+    case INDEX_op_sub_i32:
+        if (const_args[2])
+            ppc_addi32 (s, args[0], args[1], -args[2]);
+        else
+            tcg_out32 (s, SUBF | TAB (args[0], args[2], args[1]));
+        break;
+
+    case INDEX_op_and_i64:
+    case INDEX_op_and_i32:
+        if (const_args[2]) {
+            if ((args[2] & 0xffff) == args[2])
+                tcg_out32 (s, ANDI | RS (args[1]) | RA (args[0]) | args[2]);
+            else if ((args[2] & 0xffff0000) == args[2])
+                tcg_out32 (s, ANDIS | RS (args[1]) | RA (args[0])
+                           | ((args[2] >> 16) & 0xffff));
+            else {
+                tcg_out_movi (s, (opc == INDEX_op_and_i32
+                                  ? TCG_TYPE_I32
+                                  : TCG_TYPE_I64),
+                              0, args[2]);
+                tcg_out32 (s, AND | SAB (args[1], args[0], 0));
+            }
+        }
+        else
+            tcg_out32 (s, AND | SAB (args[1], args[0], args[2]));
+        break;
+    case INDEX_op_or_i64:
+    case INDEX_op_or_i32:
+        if (const_args[2]) {
+            if (args[2] & 0xffff) {
+                tcg_out32 (s, ORI | RS (args[1]) | RA (args[0])
+                           | (args[2] & 0xffff));
+                if (args[2] >> 16)
+                    tcg_out32 (s, ORIS | RS (args[0])  | RA (args[0])
+                               | ((args[2] >> 16) & 0xffff));
+            }
+            else {
+                tcg_out32 (s, ORIS | RS (args[1])  | RA (args[0])
+                           | ((args[2] >> 16) & 0xffff));
+            }
+        }
+        else
+            tcg_out32 (s, OR | SAB (args[1], args[0], args[2]));
+        break;
+    case INDEX_op_xor_i64:
+    case INDEX_op_xor_i32:
+        if (const_args[2]) {
+            if ((args[2] & 0xffff) == args[2])
+                tcg_out32 (s, XORI | RS (args[1])  | RA (args[0])
+                           | (args[2] & 0xffff));
+            else if ((args[2] & 0xffff0000) == args[2])
+                tcg_out32 (s, XORIS | RS (args[1])  | RA (args[0])
+                           | ((args[2] >> 16) & 0xffff));
+            else {
+                tcg_out_movi (s, (opc == INDEX_op_and_i32
+                                  ? TCG_TYPE_I32
+                                  : TCG_TYPE_I64),
+                              0, args[2]);
+                tcg_out32 (s, XOR | SAB (args[1], args[0], 0));
+            }
+        }
+        else
+            tcg_out32 (s, XOR | SAB (args[1], args[0], args[2]));
+        break;
+
+    case INDEX_op_mul_i32:
+        if (const_args[2]) {
+            if (args[2] == (int16_t) args[2])
+                tcg_out32 (s, MULLI | RT (args[0]) | RA (args[1])
+                           | (args[2] & 0xffff));
+            else {
+                tcg_out_movi (s, TCG_TYPE_I32, 0, args[2]);
+                tcg_out32 (s, MULLW | TAB (args[0], args[1], 0));
+            }
+        }
+        else
+            tcg_out32 (s, MULLW | TAB (args[0], args[1], args[2]));
+        break;
+
+    case INDEX_op_div_i32:
+        tcg_out32 (s, DIVW | TAB (args[0], args[1], args[2]));
+        break;
+
+    case INDEX_op_divu_i32:
+        tcg_out32 (s, DIVWU | TAB (args[0], args[1], args[2]));
+        break;
+
+    case INDEX_op_rem_i32:
+        tcg_out32 (s, DIVW | TAB (0, args[1], args[2]));
+        tcg_out32 (s, MULLW | TAB (0, 0, args[2]));
+        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
+        break;
+
+    case INDEX_op_remu_i32:
+        tcg_out32 (s, DIVWU | TAB (0, args[1], args[2]));
+        tcg_out32 (s, MULLW | TAB (0, 0, args[2]));
+        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
+        break;
+
+    case INDEX_op_shl_i32:
+        if (const_args[2]) {
+            tcg_out32 (s, (RLWINM
+                           | RA (args[0])
+                           | RS (args[1])
+                           | SH (args[2])
+                           | MB (0)
+                           | ME (31 - args[2])
+                           )
+                );
+        }
+        else
+            tcg_out32 (s, SLW | SAB (args[1], args[0], args[2]));
+        break;
+    case INDEX_op_shr_i32:
+        if (const_args[2]) {
+            tcg_out32 (s, (RLWINM
+                           | RA (args[0])
+                           | RS (args[1])
+                           | SH (32 - args[2])
+                           | MB (args[2])
+                           | ME (31)
+                           )
+                );
+        }
+        else
+            tcg_out32 (s, SRW | SAB (args[1], args[0], args[2]));
+        break;
+    case INDEX_op_sar_i32:
+        if (const_args[2])
+            tcg_out32 (s, SRAWI | RS (args[1]) | RA (args[0]) | SH (args[2]));
+        else
+            tcg_out32 (s, SRAW | SAB (args[1], args[0], args[2]));
+        break;
+
+    case INDEX_op_brcond_i32:
+        tcg_out_brcond (s, args[2], args[0], args[1], const_args[1], args[3], 0);
+        break;
+
+    case INDEX_op_brcond_i64:
+        tcg_out_brcond (s, args[2], args[0], args[1], const_args[1], args[3], 1);
+        break;
+
+    case INDEX_op_neg_i32:
+    case INDEX_op_neg_i64:
+        tcg_out32 (s, NEG | RT (args[0]) | RA (args[1]));
+        break;
+
+    case INDEX_op_add_i64:
+        if (const_args[2])
+            ppc_addi64 (s, args[0], args[1], args[2]);
+        else
+            tcg_out32 (s, ADD | TAB (args[0], args[1], args[2]));
+        break;
+    case INDEX_op_sub_i64:
+        if (const_args[2])
+            ppc_addi64 (s, args[0], args[1], -args[2]);
+        else
+            tcg_out32 (s, SUBF | TAB (args[0], args[2], args[1]));
+        break;
+
+    case INDEX_op_shl_i64:
+        if (const_args[2])
+            tcg_out_rld (s, RLDICR, args[0], args[1], args[2], 63 - args[2]);
+        else
+            tcg_out32 (s, SLD | SAB (args[1], args[0], args[2]));
+        break;
+    case INDEX_op_shr_i64:
+        if (const_args[2])
+            tcg_out_rld (s, RLDICL, args[0], args[1], 64 - args[2], args[2]);
+        else
+            tcg_out32 (s, SRD | SAB (args[1], args[0], args[2]));
+        break;
+    case INDEX_op_sar_i64:
+        if (const_args[2]) {
+            int sh = SH (args[2] & 0x1f) | (((args[2] >> 5) & 1) << 1);
+            tcg_out32 (s, SRADI | RA (args[0]) | RS (args[1]) | sh);
+        }
+        else
+            tcg_out32 (s, SRAD | SAB (args[1], args[0], args[2]));
+        break;
+
+    case INDEX_op_mul_i64:
+        tcg_out32 (s, MULLD | TAB (args[0], args[1], args[2]));
+        break;
+    case INDEX_op_div_i64:
+        tcg_out32 (s, DIVD | TAB (args[0], args[1], args[2]));
+        break;
+    case INDEX_op_divu_i64:
+        tcg_out32 (s, DIVDU | TAB (args[0], args[1], args[2]));
+        break;
+    case INDEX_op_rem_i64:
+        tcg_out32 (s, DIVD | TAB (0, args[1], args[2]));
+        tcg_out32 (s, MULLD | TAB (0, 0, args[2]));
+        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
+        break;
+    case INDEX_op_remu_i64:
+        tcg_out32 (s, DIVDU | TAB (0, args[1], args[2]));
+        tcg_out32 (s, MULLD | TAB (0, 0, args[2]));
+        tcg_out32 (s, SUBF | TAB (args[0], 0, args[1]));
+        break;
+
+    case INDEX_op_qemu_ld8u:
+        tcg_out_qemu_ld (s, args, 0);
+        break;
+    case INDEX_op_qemu_ld8s:
+        tcg_out_qemu_ld (s, args, 0 | 4);
+        break;
+    case INDEX_op_qemu_ld16u:
+        tcg_out_qemu_ld (s, args, 1);
+        break;
+    case INDEX_op_qemu_ld16s:
+        tcg_out_qemu_ld (s, args, 1 | 4);
+        break;
+    case INDEX_op_qemu_ld32u:
+        tcg_out_qemu_ld (s, args, 2);
+        break;
+    case INDEX_op_qemu_ld32s:
+        tcg_out_qemu_ld (s, args, 2 | 4);
+        break;
+    case INDEX_op_qemu_ld64:
+        tcg_out_qemu_ld (s, args, 3);
+        break;
+    case INDEX_op_qemu_st8:
+        tcg_out_qemu_st (s, args, 0);
+        break;
+    case INDEX_op_qemu_st16:
+        tcg_out_qemu_st (s, args, 1);
+        break;
+    case INDEX_op_qemu_st32:
+        tcg_out_qemu_st (s, args, 2);
+        break;
+    case INDEX_op_qemu_st64:
+        tcg_out_qemu_st (s, args, 3);
+        break;
+
+    case INDEX_op_ext8s_i32:
+    case INDEX_op_ext8s_i64:
+        c = EXTSB;
+        goto gen_ext;
+    case INDEX_op_ext16s_i32:
+    case INDEX_op_ext16s_i64:
+        c = EXTSH;
+        goto gen_ext;
+    case INDEX_op_ext32s_i64:
+        c = EXTSW;
+        goto gen_ext;
+    gen_ext:
+        tcg_out32 (s, c | RS (args[1]) | RA (args[0]));
+        break;
+
+    default:
+        tcg_dump_ops (s, stderr);
+        tcg_abort ();
+    }
+}
+
+static const TCGTargetOpDef ppc_op_defs[] = {
+    { INDEX_op_exit_tb, { } },
+    { INDEX_op_goto_tb, { } },
+    { INDEX_op_call, { "ri" } },
+    { INDEX_op_jmp, { "ri" } },
+    { INDEX_op_br, { } },
+
+    { INDEX_op_mov_i32, { "r", "r" } },
+    { INDEX_op_mov_i64, { "r", "r" } },
+    { INDEX_op_movi_i32, { "r" } },
+    { INDEX_op_movi_i64, { "r" } },
+
+    { INDEX_op_ld8u_i32, { "r", "r" } },
+    { INDEX_op_ld8s_i32, { "r", "r" } },
+    { INDEX_op_ld16u_i32, { "r", "r" } },
+    { INDEX_op_ld16s_i32, { "r", "r" } },
+    { INDEX_op_ld_i32, { "r", "r" } },
+    { INDEX_op_ld_i64, { "r", "r" } },
+    { INDEX_op_st8_i32, { "r", "r" } },
+    { INDEX_op_st8_i64, { "r", "r" } },
+    { INDEX_op_st16_i32, { "r", "r" } },
+    { INDEX_op_st16_i64, { "r", "r" } },
+    { INDEX_op_st_i32, { "r", "r" } },
+    { INDEX_op_st_i64, { "r", "r" } },
+    { INDEX_op_st32_i64, { "r", "r" } },
+
+    { INDEX_op_ld8u_i64, { "r", "r" } },
+    { INDEX_op_ld8s_i64, { "r", "r" } },
+    { INDEX_op_ld16u_i64, { "r", "r" } },
+    { INDEX_op_ld16s_i64, { "r", "r" } },
+    { INDEX_op_ld32u_i64, { "r", "r" } },
+    { INDEX_op_ld32s_i64, { "r", "r" } },
+    { INDEX_op_ld_i64, { "r", "r" } },
+
+    { INDEX_op_add_i32, { "r", "r", "ri" } },
+    { INDEX_op_mul_i32, { "r", "r", "ri" } },
+    { INDEX_op_div_i32, { "r", "r", "r" } },
+    { INDEX_op_divu_i32, { "r", "r", "r" } },
+    { INDEX_op_rem_i32, { "r", "r", "r" } },
+    { INDEX_op_remu_i32, { "r", "r", "r" } },
+    { INDEX_op_sub_i32, { "r", "r", "ri" } },
+    { INDEX_op_and_i32, { "r", "r", "ri" } },
+    { INDEX_op_or_i32, { "r", "r", "ri" } },
+    { INDEX_op_xor_i32, { "r", "r", "ri" } },
+
+    { INDEX_op_shl_i32, { "r", "r", "ri" } },
+    { INDEX_op_shr_i32, { "r", "r", "ri" } },
+    { INDEX_op_sar_i32, { "r", "r", "ri" } },
+
+    { INDEX_op_brcond_i32, { "r", "ri" } },
+    { INDEX_op_brcond_i64, { "r", "ri" } },
+
+    { INDEX_op_neg_i32, { "r", "r" } },
+
+    { INDEX_op_add_i64, { "r", "r", "ri" } },
+    { INDEX_op_sub_i64, { "r", "r", "ri" } },
+    { INDEX_op_and_i64, { "r", "r", "rZ" } },
+    { INDEX_op_or_i64, { "r", "r", "rZ" } },
+    { INDEX_op_xor_i64, { "r", "r", "rZ" } },
+
+    { INDEX_op_shl_i64, { "r", "r", "ri" } },
+    { INDEX_op_shr_i64, { "r", "r", "ri" } },
+    { INDEX_op_sar_i64, { "r", "r", "ri" } },
+
+    { INDEX_op_mul_i64, { "r", "r", "r" } },
+    { INDEX_op_div_i64, { "r", "r", "r" } },
+    { INDEX_op_divu_i64, { "r", "r", "r" } },
+    { INDEX_op_rem_i64, { "r", "r", "r" } },
+    { INDEX_op_remu_i64, { "r", "r", "r" } },
+
+    { INDEX_op_neg_i64, { "r", "r" } },
+
+    { INDEX_op_qemu_ld8u, { "r", "L" } },
+    { INDEX_op_qemu_ld8s, { "r", "L" } },
+    { INDEX_op_qemu_ld16u, { "r", "L" } },
+    { INDEX_op_qemu_ld16s, { "r", "L" } },
+    { INDEX_op_qemu_ld32u, { "r", "L" } },
+    { INDEX_op_qemu_ld32s, { "r", "L" } },
+    { INDEX_op_qemu_ld64, { "r", "L" } },
+
+    { INDEX_op_qemu_st8, { "S", "S" } },
+    { INDEX_op_qemu_st16, { "S", "S" } },
+    { INDEX_op_qemu_st32, { "S", "S" } },
+    { INDEX_op_qemu_st64, { "S", "S", "S" } },
+
+    { INDEX_op_ext8s_i32, { "r", "r" } },
+    { INDEX_op_ext16s_i32, { "r", "r" } },
+    { INDEX_op_ext8s_i64, { "r", "r" } },
+    { INDEX_op_ext16s_i64, { "r", "r" } },
+    { INDEX_op_ext32s_i64, { "r", "r" } },
+
+    { -1 },
+};
+
+void tcg_target_init (TCGContext *s)
+{
+    tcg_regset_set32 (tcg_target_available_regs[TCG_TYPE_I32], 0, 0xffffffff);
+    tcg_regset_set32 (tcg_target_available_regs[TCG_TYPE_I64], 0, 0xffffffff);
+    tcg_regset_set32 (tcg_target_call_clobber_regs, 0,
+                     (1 << TCG_REG_R0) |
+                     (1 << TCG_REG_R3) |
+                     (1 << TCG_REG_R4) |
+                     (1 << TCG_REG_R5) |
+                     (1 << TCG_REG_R6) |
+                     (1 << TCG_REG_R7) |
+                     (1 << TCG_REG_R8) |
+                     (1 << TCG_REG_R9) |
+                     (1 << TCG_REG_R10) |
+                     (1 << TCG_REG_R11) |
+                     (1 << TCG_REG_R12)
+        );
+
+    tcg_regset_clear (s->reserved_regs);
+    tcg_regset_set_reg (s->reserved_regs, TCG_REG_R0);
+    tcg_regset_set_reg (s->reserved_regs, TCG_REG_R1);
+    tcg_regset_set_reg (s->reserved_regs, TCG_REG_R2);
+    tcg_regset_set_reg (s->reserved_regs, TCG_REG_R13);
+
+    tcg_add_target_add_op_defs (ppc_op_defs);
+}
diff --git a/tcg/ppc64/tcg-target.h b/tcg/ppc64/tcg-target.h
new file mode 100644
index 0000000..2174db2
--- /dev/null
+++ b/tcg/ppc64/tcg-target.h
@@ -0,0 +1,105 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#define TCG_TARGET_PPC64 1
+
+#define TCG_TARGET_REG_BITS 64
+#define TCG_TARGET_WORDS_BIGENDIAN
+#define TCG_TARGET_NB_REGS 32
+
+enum {
+    TCG_REG_R0 = 0,
+    TCG_REG_R1,
+    TCG_REG_R2,
+    TCG_REG_R3,
+    TCG_REG_R4,
+    TCG_REG_R5,
+    TCG_REG_R6,
+    TCG_REG_R7,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10,
+    TCG_REG_R11,
+    TCG_REG_R12,
+    TCG_REG_R13,
+    TCG_REG_R14,
+    TCG_REG_R15,
+    TCG_REG_R16,
+    TCG_REG_R17,
+    TCG_REG_R18,
+    TCG_REG_R19,
+    TCG_REG_R20,
+    TCG_REG_R21,
+    TCG_REG_R22,
+    TCG_REG_R23,
+    TCG_REG_R24,
+    TCG_REG_R25,
+    TCG_REG_R26,
+    TCG_REG_R27,
+    TCG_REG_R28,
+    TCG_REG_R29,
+    TCG_REG_R30,
+    TCG_REG_R31
+};
+
+/* used for function call generation */
+#define TCG_REG_CALL_STACK TCG_REG_R1
+#define TCG_TARGET_STACK_ALIGN 16
+#define TCG_TARGET_CALL_STACK_OFFSET 48
+
+/* optional instructions */
+#define TCG_TARGET_HAS_neg_i32
+#define TCG_TARGET_HAS_div_i32
+#define TCG_TARGET_HAS_neg_i64
+#define TCG_TARGET_HAS_div_i64
+#define TCG_TARGET_HAS_ext8s_i32
+#define TCG_TARGET_HAS_ext16s_i32
+#define TCG_TARGET_HAS_ext8s_i64
+#define TCG_TARGET_HAS_ext16s_i64
+#define TCG_TARGET_HAS_ext32s_i64
+
+#define TCG_AREG0 TCG_REG_R27
+#define TCG_AREG1 TCG_REG_R24
+#define TCG_AREG2 TCG_REG_R25
+#define TCG_AREG3 TCG_REG_R26
+
+/* taken directly from tcg-dyngen.c */
+#define MIN_CACHE_LINE_SIZE 8 /* conservative value */
+
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
+{
+    unsigned long p;
+
+    start &= ~(MIN_CACHE_LINE_SIZE - 1);
+    stop = (stop + MIN_CACHE_LINE_SIZE - 1) & ~(MIN_CACHE_LINE_SIZE - 1);
+
+    for (p = start; p < stop; p += MIN_CACHE_LINE_SIZE) {
+        asm volatile ("dcbst 0,%0" : : "r"(p) : "memory");
+    }
+    asm volatile ("sync" : : : "memory");
+    for (p = start; p < stop; p += MIN_CACHE_LINE_SIZE) {
+        asm volatile ("icbi 0,%0" : : "r"(p) : "memory");
+    }
+    asm volatile ("sync" : : : "memory");
+    asm volatile ("isync" : : : "memory");
+}
diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.c
new file mode 100644
index 0000000..f36796d
--- /dev/null
+++ b/tcg/sparc/tcg-target.c
@@ -0,0 +1,1206 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+    "%g0",
+    "%g1",
+    "%g2",
+    "%g3",
+    "%g4",
+    "%g5",
+    "%g6",
+    "%g7",
+    "%o0",
+    "%o1",
+    "%o2",
+    "%o3",
+    "%o4",
+    "%o5",
+    "%o6",
+    "%o7",
+    "%l0",
+    "%l1",
+    "%l2",
+    "%l3",
+    "%l4",
+    "%l5",
+    "%l6",
+    "%l7",
+    "%i0",
+    "%i1",
+    "%i2",
+    "%i3",
+    "%i4",
+    "%i5",
+    "%i6",
+    "%i7",
+};
+
+static const int tcg_target_reg_alloc_order[] = {
+    TCG_REG_L0,
+    TCG_REG_L1,
+    TCG_REG_L2,
+    TCG_REG_L3,
+    TCG_REG_L4,
+    TCG_REG_L5,
+    TCG_REG_L6,
+    TCG_REG_L7,
+    TCG_REG_I0,
+    TCG_REG_I1,
+    TCG_REG_I2,
+    TCG_REG_I3,
+    TCG_REG_I4,
+};
+
+static const int tcg_target_call_iarg_regs[6] = {
+    TCG_REG_O0,
+    TCG_REG_O1,
+    TCG_REG_O2,
+    TCG_REG_O3,
+    TCG_REG_O4,
+    TCG_REG_O5,
+};
+
+static const int tcg_target_call_oarg_regs[2] = {
+    TCG_REG_O0,
+    TCG_REG_O1,
+};
+
+static inline int check_fit_tl(tcg_target_long val, unsigned int bits)
+{
+    return (val << ((sizeof(tcg_target_long) * 8 - bits))
+            >> (sizeof(tcg_target_long) * 8 - bits)) == val;
+}
+
+static inline int check_fit_i32(uint32_t val, unsigned int bits)
+{
+    return ((val << (32 - bits)) >> (32 - bits)) == val;
+}
+
+static void patch_reloc(uint8_t *code_ptr, int type,
+                        tcg_target_long value, tcg_target_long addend)
+{
+    value += addend;
+    switch (type) {
+    case R_SPARC_32:
+        if (value != (uint32_t)value)
+            tcg_abort();
+        *(uint32_t *)code_ptr = value;
+        break;
+    case R_SPARC_WDISP22:
+        value -= (long)code_ptr;
+        value >>= 2;
+        if (!check_fit_tl(value, 22))
+            tcg_abort();
+        *(uint32_t *)code_ptr = ((*(uint32_t *)code_ptr) & ~0x3fffff) | value;
+        break;
+    default:
+        tcg_abort();
+    }
+}
+
+/* maximum number of register used for input function arguments */
+static inline int tcg_target_get_call_iarg_regs_count(int flags)
+{
+    return 6;
+}
+
+/* parse target specific constraints */
+static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+{
+    const char *ct_str;
+
+    ct_str = *pct_str;
+    switch (ct_str[0]) {
+    case 'r':
+    case 'L': /* qemu_ld/st constraint */
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffffffff);
+        // Helper args
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O0);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O1);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_O2);
+        break;
+    case 'I':
+        ct->ct |= TCG_CT_CONST_S11;
+        break;
+    case 'J':
+        ct->ct |= TCG_CT_CONST_S13;
+        break;
+    default:
+        return -1;
+    }
+    ct_str++;
+    *pct_str = ct_str;
+    return 0;
+}
+
+/* test if a constant matches the constraint */
+static inline int tcg_target_const_match(tcg_target_long val,
+                                         const TCGArgConstraint *arg_ct)
+{
+    int ct;
+
+    ct = arg_ct->ct;
+    if (ct & TCG_CT_CONST)
+        return 1;
+    else if ((ct & TCG_CT_CONST_S11) && check_fit_tl(val, 11))
+        return 1;
+    else if ((ct & TCG_CT_CONST_S13) && check_fit_tl(val, 13))
+        return 1;
+    else
+        return 0;
+}
+
+#define INSN_OP(x)  ((x) << 30)
+#define INSN_OP2(x) ((x) << 22)
+#define INSN_OP3(x) ((x) << 19)
+#define INSN_OPF(x) ((x) << 5)
+#define INSN_RD(x)  ((x) << 25)
+#define INSN_RS1(x) ((x) << 14)
+#define INSN_RS2(x) (x)
+#define INSN_ASI(x) ((x) << 5)
+
+#define INSN_IMM13(x) ((1 << 13) | ((x) & 0x1fff))
+#define INSN_OFF22(x) (((x) >> 2) & 0x3fffff)
+
+#define INSN_COND(x, a) (((x) << 25) | ((a) << 29))
+#define COND_N     0x0
+#define COND_E     0x1
+#define COND_LE    0x2
+#define COND_L     0x3
+#define COND_LEU   0x4
+#define COND_CS    0x5
+#define COND_NEG   0x6
+#define COND_VS    0x7
+#define COND_A     0x8
+#define COND_NE    0x9
+#define COND_G     0xa
+#define COND_GE    0xb
+#define COND_GU    0xc
+#define COND_CC    0xd
+#define COND_POS   0xe
+#define COND_VC    0xf
+#define BA         (INSN_OP(0) | INSN_COND(COND_A, 0) | INSN_OP2(0x2))
+
+#define ARITH_ADD  (INSN_OP(2) | INSN_OP3(0x00))
+#define ARITH_AND  (INSN_OP(2) | INSN_OP3(0x01))
+#define ARITH_OR   (INSN_OP(2) | INSN_OP3(0x02))
+#define ARITH_ORCC (INSN_OP(2) | INSN_OP3(0x12))
+#define ARITH_XOR  (INSN_OP(2) | INSN_OP3(0x03))
+#define ARITH_SUB  (INSN_OP(2) | INSN_OP3(0x04))
+#define ARITH_SUBCC (INSN_OP(2) | INSN_OP3(0x14))
+#define ARITH_ADDX (INSN_OP(2) | INSN_OP3(0x10))
+#define ARITH_SUBX (INSN_OP(2) | INSN_OP3(0x0c))
+#define ARITH_UMUL (INSN_OP(2) | INSN_OP3(0x0a))
+#define ARITH_UDIV (INSN_OP(2) | INSN_OP3(0x0e))
+#define ARITH_SDIV (INSN_OP(2) | INSN_OP3(0x0f))
+#define ARITH_MULX (INSN_OP(2) | INSN_OP3(0x09))
+#define ARITH_UDIVX (INSN_OP(2) | INSN_OP3(0x0d))
+#define ARITH_SDIVX (INSN_OP(2) | INSN_OP3(0x2d))
+
+#define SHIFT_SLL  (INSN_OP(2) | INSN_OP3(0x25))
+#define SHIFT_SRL  (INSN_OP(2) | INSN_OP3(0x26))
+#define SHIFT_SRA  (INSN_OP(2) | INSN_OP3(0x27))
+
+#define SHIFT_SLLX (INSN_OP(2) | INSN_OP3(0x25) | (1 << 12))
+#define SHIFT_SRLX (INSN_OP(2) | INSN_OP3(0x26) | (1 << 12))
+#define SHIFT_SRAX (INSN_OP(2) | INSN_OP3(0x27) | (1 << 12))
+
+#define WRY        (INSN_OP(2) | INSN_OP3(0x30))
+#define JMPL       (INSN_OP(2) | INSN_OP3(0x38))
+#define SAVE       (INSN_OP(2) | INSN_OP3(0x3c))
+#define RESTORE    (INSN_OP(2) | INSN_OP3(0x3d))
+#define SETHI      (INSN_OP(0) | INSN_OP2(0x4))
+#define CALL       INSN_OP(1)
+#define LDUB       (INSN_OP(3) | INSN_OP3(0x01))
+#define LDSB       (INSN_OP(3) | INSN_OP3(0x09))
+#define LDUH       (INSN_OP(3) | INSN_OP3(0x02))
+#define LDSH       (INSN_OP(3) | INSN_OP3(0x0a))
+#define LDUW       (INSN_OP(3) | INSN_OP3(0x00))
+#define LDSW       (INSN_OP(3) | INSN_OP3(0x08))
+#define LDX        (INSN_OP(3) | INSN_OP3(0x0b))
+#define STB        (INSN_OP(3) | INSN_OP3(0x05))
+#define STH        (INSN_OP(3) | INSN_OP3(0x06))
+#define STW        (INSN_OP(3) | INSN_OP3(0x04))
+#define STX        (INSN_OP(3) | INSN_OP3(0x0e))
+#define LDUBA      (INSN_OP(3) | INSN_OP3(0x11))
+#define LDSBA      (INSN_OP(3) | INSN_OP3(0x19))
+#define LDUHA      (INSN_OP(3) | INSN_OP3(0x12))
+#define LDSHA      (INSN_OP(3) | INSN_OP3(0x1a))
+#define LDUWA      (INSN_OP(3) | INSN_OP3(0x10))
+#define LDSWA      (INSN_OP(3) | INSN_OP3(0x18))
+#define LDXA       (INSN_OP(3) | INSN_OP3(0x1b))
+#define STBA       (INSN_OP(3) | INSN_OP3(0x15))
+#define STHA       (INSN_OP(3) | INSN_OP3(0x16))
+#define STWA       (INSN_OP(3) | INSN_OP3(0x14))
+#define STXA       (INSN_OP(3) | INSN_OP3(0x1e))
+
+#ifndef ASI_PRIMARY_LITTLE
+#define ASI_PRIMARY_LITTLE 0x88
+#endif
+
+static inline void tcg_out_arith(TCGContext *s, int rd, int rs1, int rs2,
+                                 int op)
+{
+    tcg_out32(s, op | INSN_RD(rd) | INSN_RS1(rs1) |
+              INSN_RS2(rs2));
+}
+
+static inline void tcg_out_arithi(TCGContext *s, int rd, int rs1,
+                                  uint32_t offset, int op)
+{
+    tcg_out32(s, op | INSN_RD(rd) | INSN_RS1(rs1) |
+              INSN_IMM13(offset));
+}
+
+static inline void tcg_out_mov(TCGContext *s, int ret, int arg)
+{
+    tcg_out_arith(s, ret, arg, TCG_REG_G0, ARITH_OR);
+}
+
+static inline void tcg_out_sethi(TCGContext *s, int ret, uint32_t arg)
+{
+    tcg_out32(s, SETHI | INSN_RD(ret) | ((arg & 0xfffffc00) >> 10));
+}
+
+static inline void tcg_out_movi_imm13(TCGContext *s, int ret, uint32_t arg)
+{
+    tcg_out_arithi(s, ret, TCG_REG_G0, arg, ARITH_OR);
+}
+
+static inline void tcg_out_movi_imm32(TCGContext *s, int ret, uint32_t arg)
+{
+    if (check_fit_tl(arg, 12))
+        tcg_out_movi_imm13(s, ret, arg);
+    else {
+        tcg_out_sethi(s, ret, arg);
+        if (arg & 0x3ff)
+            tcg_out_arithi(s, ret, ret, arg & 0x3ff, ARITH_OR);
+    }
+}
+
+static inline void tcg_out_movi(TCGContext *s, TCGType type,
+                                int ret, tcg_target_long arg)
+{
+#if defined(__sparc_v9__) && !defined(__sparc_v8plus__)
+    if (!check_fit_tl(arg, 32) && (arg & ~0xffffffffULL) != 0) {
+        tcg_out_movi_imm32(s, TCG_REG_I4, arg >> 32);
+        tcg_out_arithi(s, TCG_REG_I4, TCG_REG_I4, 32, SHIFT_SLLX);
+        tcg_out_movi_imm32(s, ret, arg);
+        tcg_out_arith(s, ret, ret, TCG_REG_I4, ARITH_OR);
+    } else if (check_fit_tl(arg, 12))
+        tcg_out_movi_imm13(s, ret, arg);
+    else {
+        tcg_out_sethi(s, ret, arg);
+        if (arg & 0x3ff)
+            tcg_out_arithi(s, ret, ret, arg & 0x3ff, ARITH_OR);
+    }
+#else
+    tcg_out_movi_imm32(s, ret, arg);
+#endif
+}
+
+static inline void tcg_out_ld_raw(TCGContext *s, int ret,
+                                  tcg_target_long arg)
+{
+    tcg_out_sethi(s, ret, arg);
+    tcg_out32(s, LDUW | INSN_RD(ret) | INSN_RS1(ret) |
+              INSN_IMM13(arg & 0x3ff));
+}
+
+static inline void tcg_out_ld_ptr(TCGContext *s, int ret,
+                                  tcg_target_long arg)
+{
+    if (!check_fit_tl(arg, 10))
+        tcg_out_movi(s, TCG_TYPE_PTR, ret, arg & ~0x3ffULL);
+#if defined(__sparc_v9__) && !defined(__sparc_v8plus__)
+    tcg_out32(s, LDX | INSN_RD(ret) | INSN_RS1(ret) |
+              INSN_IMM13(arg & 0x3ff));
+#else
+    tcg_out32(s, LDUW | INSN_RD(ret) | INSN_RS1(ret) |
+              INSN_IMM13(arg & 0x3ff));
+#endif
+}
+
+static inline void tcg_out_ldst(TCGContext *s, int ret, int addr, int offset, int op)
+{
+    if (check_fit_tl(offset, 13))
+        tcg_out32(s, op | INSN_RD(ret) | INSN_RS1(addr) |
+                  INSN_IMM13(offset));
+    else {
+        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_I5, offset);
+        tcg_out32(s, op | INSN_RD(ret) | INSN_RS1(TCG_REG_I5) |
+                  INSN_RS2(addr));
+    }
+}
+
+static inline void tcg_out_ldst_asi(TCGContext *s, int ret, int addr,
+                                    int offset, int op, int asi)
+{
+    tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_I5, offset);
+    tcg_out32(s, op | INSN_RD(ret) | INSN_RS1(TCG_REG_I5) |
+              INSN_ASI(asi) | INSN_RS2(addr));
+}
+
+static inline void tcg_out_ld(TCGContext *s, TCGType type, int ret,
+                              int arg1, tcg_target_long arg2)
+{
+    if (type == TCG_TYPE_I32)
+        tcg_out_ldst(s, ret, arg1, arg2, LDUW);
+    else
+        tcg_out_ldst(s, ret, arg1, arg2, LDX);
+}
+
+static inline void tcg_out_st(TCGContext *s, TCGType type, int arg,
+                              int arg1, tcg_target_long arg2)
+{
+    if (type == TCG_TYPE_I32)
+        tcg_out_ldst(s, arg, arg1, arg2, STW);
+    else
+        tcg_out_ldst(s, arg, arg1, arg2, STX);
+}
+
+static inline void tcg_out_sety(TCGContext *s, tcg_target_long val)
+{
+    if (val == 0 || val == -1)
+        tcg_out32(s, WRY | INSN_IMM13(val));
+    else
+        fprintf(stderr, "unimplemented sety %ld\n", (long)val);
+}
+
+static inline void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
+{
+    if (val != 0) {
+        if (check_fit_tl(val, 13))
+            tcg_out_arithi(s, reg, reg, val, ARITH_ADD);
+        else {
+            tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_I5, val);
+            tcg_out_arith(s, reg, reg, TCG_REG_I5, ARITH_ADD);
+        }
+    }
+}
+
+static inline void tcg_out_andi(TCGContext *s, int reg, tcg_target_long val)
+{
+    if (val != 0) {
+        if (check_fit_tl(val, 13))
+            tcg_out_arithi(s, reg, reg, val, ARITH_AND);
+        else {
+            tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_I5, val);
+            tcg_out_arith(s, reg, reg, TCG_REG_I5, ARITH_AND);
+        }
+    }
+}
+
+static inline void tcg_out_nop(TCGContext *s)
+{
+    tcg_out_sethi(s, TCG_REG_G0, 0);
+}
+
+static void tcg_out_branch(TCGContext *s, int opc, int label_index)
+{
+    int32_t val;
+    TCGLabel *l = &s->labels[label_index];
+
+    if (l->has_value) {
+        val = l->u.value - (tcg_target_long)s->code_ptr;
+        tcg_out32(s, (INSN_OP(0) | INSN_COND(opc, 0) | INSN_OP2(0x2)
+                      | INSN_OFF22(l->u.value - (unsigned long)s->code_ptr)));
+    } else {
+        tcg_out_reloc(s, s->code_ptr, R_SPARC_WDISP22, label_index, 0);
+        tcg_out32(s, (INSN_OP(0) | INSN_COND(opc, 0) | INSN_OP2(0x2) | 0));
+    }
+}
+
+static const uint8_t tcg_cond_to_bcond[10] = {
+    [TCG_COND_EQ] = COND_E,
+    [TCG_COND_NE] = COND_NE,
+    [TCG_COND_LT] = COND_L,
+    [TCG_COND_GE] = COND_GE,
+    [TCG_COND_LE] = COND_LE,
+    [TCG_COND_GT] = COND_G,
+    [TCG_COND_LTU] = COND_CS,
+    [TCG_COND_GEU] = COND_CC,
+    [TCG_COND_LEU] = COND_LEU,
+    [TCG_COND_GTU] = COND_GU,
+};
+
+static void tcg_out_brcond(TCGContext *s, int cond,
+                           TCGArg arg1, TCGArg arg2, int const_arg2,
+                           int label_index)
+{
+    if (const_arg2 && arg2 == 0)
+        /* orcc %g0, r, %g0 */
+        tcg_out_arith(s, TCG_REG_G0, TCG_REG_G0, arg1, ARITH_ORCC);
+    else
+        /* subcc r1, r2, %g0 */
+        tcg_out_arith(s, TCG_REG_G0, arg1, arg2, ARITH_SUBCC);
+    tcg_out_branch(s, tcg_cond_to_bcond[cond], label_index);
+    tcg_out_nop(s);
+}
+
+/* Generate global QEMU prologue and epilogue code */
+void tcg_target_qemu_prologue(TCGContext *s)
+{
+    tcg_out32(s, SAVE | INSN_RD(TCG_REG_O6) | INSN_RS1(TCG_REG_O6) |
+              INSN_IMM13(-TCG_TARGET_STACK_MINFRAME));
+    tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_I0) |
+              INSN_RS2(TCG_REG_G0));
+    tcg_out_nop(s);
+}
+
+#if defined(CONFIG_SOFTMMU)
+
+#include "../../softmmu_defs.h"
+
+static const void * const qemu_ld_helpers[4] = {
+    __ldb_mmu,
+    __ldw_mmu,
+    __ldl_mmu,
+    __ldq_mmu,
+};
+
+static const void * const qemu_st_helpers[4] = {
+    __stb_mmu,
+    __stw_mmu,
+    __stl_mmu,
+    __stq_mmu,
+};
+#endif
+
+#if TARGET_LONG_BITS == 32
+#define TARGET_LD_OP LDUW
+#else
+#define TARGET_LD_OP LDX
+#endif
+
+#if TARGET_PHYS_ADDR_BITS == 32
+#define TARGET_ADDEND_LD_OP LDUW
+#else
+#define TARGET_ADDEND_LD_OP LDX
+#endif
+
+#ifdef __arch64__
+#define HOST_LD_OP LDX
+#define HOST_ST_OP STX
+#define HOST_SLL_OP SHIFT_SLLX
+#define HOST_SRA_OP SHIFT_SRAX
+#else
+#define HOST_LD_OP LDUW
+#define HOST_ST_OP STW
+#define HOST_SLL_OP SHIFT_SLL
+#define HOST_SRA_OP SHIFT_SRA
+#endif
+
+static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+                            int opc)
+{
+    int addr_reg, data_reg, arg0, arg1, arg2, mem_index, s_bits;
+#if defined(CONFIG_SOFTMMU)
+    uint32_t *label1_ptr, *label2_ptr;
+#endif
+
+    data_reg = *args++;
+    addr_reg = *args++;
+    mem_index = *args;
+    s_bits = opc & 3;
+
+    arg0 = TCG_REG_O0;
+    arg1 = TCG_REG_O1;
+    arg2 = TCG_REG_O2;
+
+#if defined(CONFIG_SOFTMMU)
+    /* srl addr_reg, x, arg1 */
+    tcg_out_arithi(s, arg1, addr_reg, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS,
+                   SHIFT_SRL);
+    /* and addr_reg, x, arg0 */
+    tcg_out_arithi(s, arg0, addr_reg, TARGET_PAGE_MASK | ((1 << s_bits) - 1),
+                   ARITH_AND);
+
+    /* and arg1, x, arg1 */
+    tcg_out_andi(s, arg1, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS);
+
+    /* add arg1, x, arg1 */
+    tcg_out_addi(s, arg1, offsetof(CPUState,
+                                   tlb_table[mem_index][0].addr_read));
+
+    /* add env, arg1, arg1 */
+    tcg_out_arith(s, arg1, TCG_AREG0, arg1, ARITH_ADD);
+
+    /* ld [arg1], arg2 */
+    tcg_out32(s, TARGET_LD_OP | INSN_RD(arg2) | INSN_RS1(arg1) |
+              INSN_RS2(TCG_REG_G0));
+
+    /* subcc arg0, arg2, %g0 */
+    tcg_out_arith(s, TCG_REG_G0, arg0, arg2, ARITH_SUBCC);
+
+    /* will become:
+       be label1 */
+    label1_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, 0);
+
+    /* mov (delay slot) */
+    tcg_out_mov(s, arg0, addr_reg);
+
+    /* mov */
+    tcg_out_movi(s, TCG_TYPE_I32, arg1, mem_index);
+
+    /* XXX: move that code at the end of the TB */
+    /* qemu_ld_helper[s_bits](arg0, arg1) */
+    tcg_out32(s, CALL | ((((tcg_target_ulong)qemu_ld_helpers[s_bits]
+                           - (tcg_target_ulong)s->code_ptr) >> 2)
+                         & 0x3fffffff));
+    /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
+       global registers */
+    // delay slot
+    tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+                 TCG_TARGET_CALL_STACK_OFFSET - sizeof(long), HOST_ST_OP);
+    tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+                 TCG_TARGET_CALL_STACK_OFFSET - sizeof(long), HOST_LD_OP);
+
+    /* data_reg = sign_extend(arg0) */
+    switch(opc) {
+    case 0 | 4:
+        /* sll arg0, 24/56, data_reg */
+        tcg_out_arithi(s, data_reg, arg0, (int)sizeof(tcg_target_long) * 8 - 8,
+                       HOST_SLL_OP);
+        /* sra data_reg, 24/56, data_reg */
+        tcg_out_arithi(s, data_reg, data_reg,
+                       (int)sizeof(tcg_target_long) * 8 - 8, HOST_SRA_OP);
+        break;
+    case 1 | 4:
+        /* sll arg0, 16/48, data_reg */
+        tcg_out_arithi(s, data_reg, arg0,
+                       (int)sizeof(tcg_target_long) * 8 - 16, HOST_SLL_OP);
+        /* sra data_reg, 16/48, data_reg */
+        tcg_out_arithi(s, data_reg, data_reg,
+                       (int)sizeof(tcg_target_long) * 8 - 16, HOST_SRA_OP);
+        break;
+    case 2 | 4:
+        /* sll arg0, 32, data_reg */
+        tcg_out_arithi(s, data_reg, arg0, 32, HOST_SLL_OP);
+        /* sra data_reg, 32, data_reg */
+        tcg_out_arithi(s, data_reg, data_reg, 32, HOST_SRA_OP);
+        break;
+    case 0:
+    case 1:
+    case 2:
+    case 3:
+    default:
+        /* mov */
+        tcg_out_mov(s, data_reg, arg0);
+        break;
+    }
+
+    /* will become:
+       ba label2 */
+    label2_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, 0);
+
+    /* nop (delay slot */
+    tcg_out_nop(s);
+
+    /* label1: */
+    *label1_ptr = (INSN_OP(0) | INSN_COND(COND_E, 0) | INSN_OP2(0x2) |
+                   INSN_OFF22((unsigned long)s->code_ptr -
+                              (unsigned long)label1_ptr));
+
+    /* ld [arg1 + x], arg1 */
+    tcg_out_ldst(s, arg1, arg1, offsetof(CPUTLBEntry, addend) -
+                 offsetof(CPUTLBEntry, addr_read), TARGET_ADDEND_LD_OP);
+
+#if TARGET_LONG_BITS == 32
+    /* and addr_reg, x, arg0 */
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_I5, 0xffffffff);
+    tcg_out_arith(s, arg0, addr_reg, TCG_REG_I5, ARITH_AND);
+    /* add arg0, arg1, arg0 */
+    tcg_out_arith(s, arg0, arg0, arg1, ARITH_ADD);
+#else
+    /* add addr_reg, arg1, arg0 */
+    tcg_out_arith(s, arg0, addr_reg, arg1, ARITH_ADD);
+#endif
+
+#else
+    arg0 = addr_reg;
+#endif
+
+    switch(opc) {
+    case 0:
+        /* ldub [arg0], data_reg */
+        tcg_out_ldst(s, data_reg, arg0, 0, LDUB);
+        break;
+    case 0 | 4:
+        /* ldsb [arg0], data_reg */
+        tcg_out_ldst(s, data_reg, arg0, 0, LDSB);
+        break;
+    case 1:
+#ifdef TARGET_WORDS_BIGENDIAN
+        /* lduh [arg0], data_reg */
+        tcg_out_ldst(s, data_reg, arg0, 0, LDUH);
+#else
+        /* lduha [arg0] ASI_PRIMARY_LITTLE, data_reg */
+        tcg_out_ldst_asi(s, data_reg, arg0, 0, LDUHA, ASI_PRIMARY_LITTLE);
+#endif
+        break;
+    case 1 | 4:
+#ifdef TARGET_WORDS_BIGENDIAN
+        /* ldsh [arg0], data_reg */
+        tcg_out_ldst(s, data_reg, arg0, 0, LDSH);
+#else
+        /* ldsha [arg0] ASI_PRIMARY_LITTLE, data_reg */
+        tcg_out_ldst_asi(s, data_reg, arg0, 0, LDSHA, ASI_PRIMARY_LITTLE);
+#endif
+        break;
+    case 2:
+#ifdef TARGET_WORDS_BIGENDIAN
+        /* lduw [arg0], data_reg */
+        tcg_out_ldst(s, data_reg, arg0, 0, LDUW);
+#else
+        /* lduwa [arg0] ASI_PRIMARY_LITTLE, data_reg */
+        tcg_out_ldst_asi(s, data_reg, arg0, 0, LDUWA, ASI_PRIMARY_LITTLE);
+#endif
+        break;
+    case 2 | 4:
+#ifdef TARGET_WORDS_BIGENDIAN
+        /* ldsw [arg0], data_reg */
+        tcg_out_ldst(s, data_reg, arg0, 0, LDSW);
+#else
+        /* ldswa [arg0] ASI_PRIMARY_LITTLE, data_reg */
+        tcg_out_ldst_asi(s, data_reg, arg0, 0, LDSWA, ASI_PRIMARY_LITTLE);
+#endif
+        break;
+    case 3:
+#ifdef TARGET_WORDS_BIGENDIAN
+        /* ldx [arg0], data_reg */
+        tcg_out_ldst(s, data_reg, arg0, 0, LDX);
+#else
+        /* ldxa [arg0] ASI_PRIMARY_LITTLE, data_reg */
+        tcg_out_ldst_asi(s, data_reg, arg0, 0, LDXA, ASI_PRIMARY_LITTLE);
+#endif
+        break;
+    default:
+        tcg_abort();
+    }
+
+#if defined(CONFIG_SOFTMMU)
+    /* label2: */
+    *label2_ptr = (INSN_OP(0) | INSN_COND(COND_A, 0) | INSN_OP2(0x2) |
+                   INSN_OFF22((unsigned long)s->code_ptr -
+                              (unsigned long)label2_ptr));
+#endif
+}
+
+static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+                            int opc)
+{
+    int addr_reg, data_reg, arg0, arg1, arg2, mem_index, s_bits;
+#if defined(CONFIG_SOFTMMU)
+    uint32_t *label1_ptr, *label2_ptr;
+#endif
+
+    data_reg = *args++;
+    addr_reg = *args++;
+    mem_index = *args;
+
+    s_bits = opc;
+
+    arg0 = TCG_REG_O0;
+    arg1 = TCG_REG_O1;
+    arg2 = TCG_REG_O2;
+
+#if defined(CONFIG_SOFTMMU)
+    /* srl addr_reg, x, arg1 */
+    tcg_out_arithi(s, arg1, addr_reg, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS,
+                   SHIFT_SRL);
+
+    /* and addr_reg, x, arg0 */
+    tcg_out_arithi(s, arg0, addr_reg, TARGET_PAGE_MASK | ((1 << s_bits) - 1),
+                   ARITH_AND);
+
+    /* and arg1, x, arg1 */
+    tcg_out_andi(s, arg1, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS);
+
+    /* add arg1, x, arg1 */
+    tcg_out_addi(s, arg1, offsetof(CPUState,
+                                   tlb_table[mem_index][0].addr_write));
+
+    /* add env, arg1, arg1 */
+    tcg_out_arith(s, arg1, TCG_AREG0, arg1, ARITH_ADD);
+
+    /* ld [arg1], arg2 */
+    tcg_out32(s, TARGET_LD_OP | INSN_RD(arg2) | INSN_RS1(arg1) |
+              INSN_RS2(TCG_REG_G0));
+
+    /* subcc arg0, arg2, %g0 */
+    tcg_out_arith(s, TCG_REG_G0, arg0, arg2, ARITH_SUBCC);
+
+    /* will become:
+       be label1 */
+    label1_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, 0);
+
+    /* mov (delay slot) */
+    tcg_out_mov(s, arg0, addr_reg);
+
+    /* mov */
+    tcg_out_mov(s, arg1, data_reg);
+
+    /* mov */
+    tcg_out_movi(s, TCG_TYPE_I32, arg2, mem_index);
+
+    /* XXX: move that code at the end of the TB */
+    /* qemu_st_helper[s_bits](arg0, arg1, arg2) */
+    tcg_out32(s, CALL | ((((tcg_target_ulong)qemu_st_helpers[s_bits]
+                           - (tcg_target_ulong)s->code_ptr) >> 2)
+                         & 0x3fffffff));
+    /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
+       global registers */
+    // delay slot
+    tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+                 TCG_TARGET_CALL_STACK_OFFSET - sizeof(long), HOST_ST_OP);
+    tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+                 TCG_TARGET_CALL_STACK_OFFSET - sizeof(long), HOST_LD_OP);
+
+    /* will become:
+       ba label2 */
+    label2_ptr = (uint32_t *)s->code_ptr;
+    tcg_out32(s, 0);
+
+    /* nop (delay slot) */
+    tcg_out_nop(s);
+
+    /* label1: */
+    *label1_ptr = (INSN_OP(0) | INSN_COND(COND_E, 0) | INSN_OP2(0x2) |
+                   INSN_OFF22((unsigned long)s->code_ptr -
+                              (unsigned long)label1_ptr));
+
+    /* ld [arg1 + x], arg1 */
+    tcg_out_ldst(s, arg1, arg1, offsetof(CPUTLBEntry, addend) -
+                 offsetof(CPUTLBEntry, addr_write), TARGET_ADDEND_LD_OP);
+
+#if TARGET_LONG_BITS == 32
+    /* and addr_reg, x, arg0 */
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_I5, 0xffffffff);
+    tcg_out_arith(s, arg0, addr_reg, TCG_REG_I5, ARITH_AND);
+    /* add arg0, arg1, arg0 */
+    tcg_out_arith(s, arg0, arg0, arg1, ARITH_ADD);
+#else
+    /* add addr_reg, arg1, arg0 */
+    tcg_out_arith(s, arg0, addr_reg, arg1, ARITH_ADD);
+#endif
+
+#else
+    arg0 = addr_reg;
+#endif
+
+    switch(opc) {
+    case 0:
+        /* stb data_reg, [arg0] */
+        tcg_out_ldst(s, data_reg, arg0, 0, STB);
+        break;
+    case 1:
+#ifdef TARGET_WORDS_BIGENDIAN
+        /* sth data_reg, [arg0] */
+        tcg_out_ldst(s, data_reg, arg0, 0, STH);
+#else
+        /* stha data_reg, [arg0] ASI_PRIMARY_LITTLE */
+        tcg_out_ldst_asi(s, data_reg, arg0, 0, STHA, ASI_PRIMARY_LITTLE);
+#endif
+        break;
+    case 2:
+#ifdef TARGET_WORDS_BIGENDIAN
+        /* stw data_reg, [arg0] */
+        tcg_out_ldst(s, data_reg, arg0, 0, STW);
+#else
+        /* stwa data_reg, [arg0] ASI_PRIMARY_LITTLE */
+        tcg_out_ldst_asi(s, data_reg, arg0, 0, STWA, ASI_PRIMARY_LITTLE);
+#endif
+        break;
+    case 3:
+#ifdef TARGET_WORDS_BIGENDIAN
+        /* stx data_reg, [arg0] */
+        tcg_out_ldst(s, data_reg, arg0, 0, STX);
+#else
+        /* stxa data_reg, [arg0] ASI_PRIMARY_LITTLE */
+        tcg_out_ldst_asi(s, data_reg, arg0, 0, STXA, ASI_PRIMARY_LITTLE);
+#endif
+        break;
+    default:
+        tcg_abort();
+    }
+
+#if defined(CONFIG_SOFTMMU)
+    /* label2: */
+    *label2_ptr = (INSN_OP(0) | INSN_COND(COND_A, 0) | INSN_OP2(0x2) |
+                   INSN_OFF22((unsigned long)s->code_ptr -
+                              (unsigned long)label2_ptr));
+#endif
+}
+
+static inline void tcg_out_op(TCGContext *s, int opc, const TCGArg *args,
+                              const int *const_args)
+{
+    int c;
+
+    switch (opc) {
+    case INDEX_op_exit_tb:
+        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_I0, args[0]);
+        tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_I7) |
+                  INSN_IMM13(8));
+        tcg_out32(s, RESTORE | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_G0) |
+                      INSN_RS2(TCG_REG_G0));
+        break;
+    case INDEX_op_goto_tb:
+        if (s->tb_jmp_offset) {
+            /* direct jump method */
+            tcg_out_sethi(s, TCG_REG_I5, args[0] & 0xffffe000);
+            tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_I5) |
+                      INSN_IMM13((args[0] & 0x1fff)));
+            s->tb_jmp_offset[args[0]] = s->code_ptr - s->code_buf;
+        } else {
+            /* indirect jump method */
+            tcg_out_ld_ptr(s, TCG_REG_I5, (tcg_target_long)(s->tb_next + args[0]));
+            tcg_out32(s, JMPL | INSN_RD(TCG_REG_G0) | INSN_RS1(TCG_REG_I5) |
+                      INSN_RS2(TCG_REG_G0));
+        }
+        tcg_out_nop(s);
+        s->tb_next_offset[args[0]] = s->code_ptr - s->code_buf;
+        break;
+    case INDEX_op_call:
+        if (const_args[0])
+            tcg_out32(s, CALL | ((((tcg_target_ulong)args[0]
+                                   - (tcg_target_ulong)s->code_ptr) >> 2)
+                                 & 0x3fffffff));
+        else {
+            tcg_out_ld_ptr(s, TCG_REG_I5,
+                           (tcg_target_long)(s->tb_next + args[0]));
+            tcg_out32(s, JMPL | INSN_RD(TCG_REG_O7) | INSN_RS1(TCG_REG_I5) |
+                      INSN_RS2(TCG_REG_G0));
+        }
+        /* Store AREG0 in stack to avoid ugly glibc bugs that mangle
+           global registers */
+        // delay slot
+        tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+                     TCG_TARGET_CALL_STACK_OFFSET - sizeof(long), HOST_ST_OP);
+        tcg_out_ldst(s, TCG_AREG0, TCG_REG_CALL_STACK,
+                     TCG_TARGET_CALL_STACK_OFFSET - sizeof(long), HOST_LD_OP);
+        break;
+    case INDEX_op_jmp:
+    case INDEX_op_br:
+        tcg_out_branch(s, COND_A, args[0]);
+        tcg_out_nop(s);
+        break;
+    case INDEX_op_movi_i32:
+        tcg_out_movi(s, TCG_TYPE_I32, args[0], (uint32_t)args[1]);
+        break;
+
+#if defined(__sparc_v9__) && !defined(__sparc_v8plus__)
+#define OP_32_64(x)                             \
+        glue(glue(case INDEX_op_, x), _i32:)    \
+        glue(glue(case INDEX_op_, x), _i64:)
+#else
+#define OP_32_64(x)                             \
+        glue(glue(case INDEX_op_, x), _i32:)
+#endif
+        OP_32_64(ld8u);
+        tcg_out_ldst(s, args[0], args[1], args[2], LDUB);
+        break;
+        OP_32_64(ld8s);
+        tcg_out_ldst(s, args[0], args[1], args[2], LDSB);
+        break;
+        OP_32_64(ld16u);
+        tcg_out_ldst(s, args[0], args[1], args[2], LDUH);
+        break;
+        OP_32_64(ld16s);
+        tcg_out_ldst(s, args[0], args[1], args[2], LDSH);
+        break;
+    case INDEX_op_ld_i32:
+#if defined(__sparc_v9__) && !defined(__sparc_v8plus__)
+    case INDEX_op_ld32u_i64:
+#endif
+        tcg_out_ldst(s, args[0], args[1], args[2], LDUW);
+        break;
+        OP_32_64(st8);
+        tcg_out_ldst(s, args[0], args[1], args[2], STB);
+        break;
+        OP_32_64(st16);
+        tcg_out_ldst(s, args[0], args[1], args[2], STH);
+        break;
+    case INDEX_op_st_i32:
+#if defined(__sparc_v9__) && !defined(__sparc_v8plus__)
+    case INDEX_op_st32_i64:
+#endif
+        tcg_out_ldst(s, args[0], args[1], args[2], STW);
+        break;
+        OP_32_64(add);
+        c = ARITH_ADD;
+        goto gen_arith32;
+        OP_32_64(sub);
+        c = ARITH_SUB;
+        goto gen_arith32;
+        OP_32_64(and);
+        c = ARITH_AND;
+        goto gen_arith32;
+        OP_32_64(or);
+        c = ARITH_OR;
+        goto gen_arith32;
+        OP_32_64(xor);
+        c = ARITH_XOR;
+        goto gen_arith32;
+    case INDEX_op_shl_i32:
+        c = SHIFT_SLL;
+        goto gen_arith32;
+    case INDEX_op_shr_i32:
+        c = SHIFT_SRL;
+        goto gen_arith32;
+    case INDEX_op_sar_i32:
+        c = SHIFT_SRA;
+        goto gen_arith32;
+    case INDEX_op_mul_i32:
+        c = ARITH_UMUL;
+        goto gen_arith32;
+    case INDEX_op_div2_i32:
+#if defined(__sparc_v9__) || defined(__sparc_v8plus__)
+        c = ARITH_SDIVX;
+        goto gen_arith32;
+#else
+        tcg_out_sety(s, 0);
+        c = ARITH_SDIV;
+        goto gen_arith32;
+#endif
+    case INDEX_op_divu2_i32:
+#if defined(__sparc_v9__) || defined(__sparc_v8plus__)
+        c = ARITH_UDIVX;
+        goto gen_arith32;
+#else
+        tcg_out_sety(s, 0);
+        c = ARITH_UDIV;
+        goto gen_arith32;
+#endif
+
+    case INDEX_op_brcond_i32:
+        tcg_out_brcond(s, args[2], args[0], args[1], const_args[1],
+                       args[3]);
+        break;
+
+    case INDEX_op_qemu_ld8u:
+        tcg_out_qemu_ld(s, args, 0);
+        break;
+    case INDEX_op_qemu_ld8s:
+        tcg_out_qemu_ld(s, args, 0 | 4);
+        break;
+    case INDEX_op_qemu_ld16u:
+        tcg_out_qemu_ld(s, args, 1);
+        break;
+    case INDEX_op_qemu_ld16s:
+        tcg_out_qemu_ld(s, args, 1 | 4);
+        break;
+    case INDEX_op_qemu_ld32u:
+        tcg_out_qemu_ld(s, args, 2);
+        break;
+    case INDEX_op_qemu_ld32s:
+        tcg_out_qemu_ld(s, args, 2 | 4);
+        break;
+    case INDEX_op_qemu_st8:
+        tcg_out_qemu_st(s, args, 0);
+        break;
+    case INDEX_op_qemu_st16:
+        tcg_out_qemu_st(s, args, 1);
+        break;
+    case INDEX_op_qemu_st32:
+        tcg_out_qemu_st(s, args, 2);
+        break;
+
+#if defined(__sparc_v9__) && !defined(__sparc_v8plus__)
+    case INDEX_op_movi_i64:
+        tcg_out_movi(s, TCG_TYPE_I64, args[0], args[1]);
+        break;
+    case INDEX_op_ld32s_i64:
+        tcg_out_ldst(s, args[0], args[1], args[2], LDSW);
+        break;
+    case INDEX_op_ld_i64:
+        tcg_out_ldst(s, args[0], args[1], args[2], LDX);
+        break;
+    case INDEX_op_st_i64:
+        tcg_out_ldst(s, args[0], args[1], args[2], STX);
+        break;
+    case INDEX_op_shl_i64:
+        c = SHIFT_SLLX;
+        goto gen_arith32;
+    case INDEX_op_shr_i64:
+        c = SHIFT_SRLX;
+        goto gen_arith32;
+    case INDEX_op_sar_i64:
+        c = SHIFT_SRAX;
+        goto gen_arith32;
+    case INDEX_op_mul_i64:
+        c = ARITH_MULX;
+        goto gen_arith32;
+    case INDEX_op_div2_i64:
+        c = ARITH_SDIVX;
+        goto gen_arith32;
+    case INDEX_op_divu2_i64:
+        c = ARITH_UDIVX;
+        goto gen_arith32;
+
+    case INDEX_op_brcond_i64:
+        tcg_out_brcond(s, args[2], args[0], args[1], const_args[1],
+                       args[3]);
+        break;
+    case INDEX_op_qemu_ld64:
+        tcg_out_qemu_ld(s, args, 3);
+        break;
+    case INDEX_op_qemu_st64:
+        tcg_out_qemu_st(s, args, 3);
+        break;
+
+#endif
+    gen_arith32:
+        if (const_args[2]) {
+            tcg_out_arithi(s, args[0], args[1], args[2], c);
+        } else {
+            tcg_out_arith(s, args[0], args[1], args[2], c);
+        }
+        break;
+
+    default:
+        fprintf(stderr, "unknown opcode 0x%x\n", opc);
+        tcg_abort();
+    }
+}
+
+static const TCGTargetOpDef sparc_op_defs[] = {
+    { INDEX_op_exit_tb, { } },
+    { INDEX_op_goto_tb, { } },
+    { INDEX_op_call, { "ri" } },
+    { INDEX_op_jmp, { "ri" } },
+    { INDEX_op_br, { } },
+
+    { INDEX_op_mov_i32, { "r", "r" } },
+    { INDEX_op_movi_i32, { "r" } },
+    { INDEX_op_ld8u_i32, { "r", "r" } },
+    { INDEX_op_ld8s_i32, { "r", "r" } },
+    { INDEX_op_ld16u_i32, { "r", "r" } },
+    { INDEX_op_ld16s_i32, { "r", "r" } },
+    { INDEX_op_ld_i32, { "r", "r" } },
+    { INDEX_op_st8_i32, { "r", "r" } },
+    { INDEX_op_st16_i32, { "r", "r" } },
+    { INDEX_op_st_i32, { "r", "r" } },
+
+    { INDEX_op_add_i32, { "r", "r", "rJ" } },
+    { INDEX_op_mul_i32, { "r", "r", "rJ" } },
+    { INDEX_op_div2_i32, { "r", "r", "0", "1", "r" } },
+    { INDEX_op_divu2_i32, { "r", "r", "0", "1", "r" } },
+    { INDEX_op_sub_i32, { "r", "r", "rJ" } },
+    { INDEX_op_and_i32, { "r", "r", "rJ" } },
+    { INDEX_op_or_i32, { "r", "r", "rJ" } },
+    { INDEX_op_xor_i32, { "r", "r", "rJ" } },
+
+    { INDEX_op_shl_i32, { "r", "r", "rJ" } },
+    { INDEX_op_shr_i32, { "r", "r", "rJ" } },
+    { INDEX_op_sar_i32, { "r", "r", "rJ" } },
+
+    { INDEX_op_brcond_i32, { "r", "ri" } },
+
+    { INDEX_op_qemu_ld8u, { "r", "L" } },
+    { INDEX_op_qemu_ld8s, { "r", "L" } },
+    { INDEX_op_qemu_ld16u, { "r", "L" } },
+    { INDEX_op_qemu_ld16s, { "r", "L" } },
+    { INDEX_op_qemu_ld32u, { "r", "L" } },
+    { INDEX_op_qemu_ld32s, { "r", "L" } },
+
+    { INDEX_op_qemu_st8, { "L", "L" } },
+    { INDEX_op_qemu_st16, { "L", "L" } },
+    { INDEX_op_qemu_st32, { "L", "L" } },
+
+#if defined(__sparc_v9__) && !defined(__sparc_v8plus__)
+    { INDEX_op_mov_i64, { "r", "r" } },
+    { INDEX_op_movi_i64, { "r" } },
+    { INDEX_op_ld8u_i64, { "r", "r" } },
+    { INDEX_op_ld8s_i64, { "r", "r" } },
+    { INDEX_op_ld16u_i64, { "r", "r" } },
+    { INDEX_op_ld16s_i64, { "r", "r" } },
+    { INDEX_op_ld32u_i64, { "r", "r" } },
+    { INDEX_op_ld32s_i64, { "r", "r" } },
+    { INDEX_op_ld_i64, { "r", "r" } },
+    { INDEX_op_st8_i64, { "r", "r" } },
+    { INDEX_op_st16_i64, { "r", "r" } },
+    { INDEX_op_st32_i64, { "r", "r" } },
+    { INDEX_op_st_i64, { "r", "r" } },
+    { INDEX_op_qemu_ld64, { "L", "L" } },
+    { INDEX_op_qemu_st64, { "L", "L" } },
+
+    { INDEX_op_add_i64, { "r", "r", "rJ" } },
+    { INDEX_op_mul_i64, { "r", "r", "rJ" } },
+    { INDEX_op_div2_i64, { "r", "r", "0", "1", "r" } },
+    { INDEX_op_divu2_i64, { "r", "r", "0", "1", "r" } },
+    { INDEX_op_sub_i64, { "r", "r", "rJ" } },
+    { INDEX_op_and_i64, { "r", "r", "rJ" } },
+    { INDEX_op_or_i64, { "r", "r", "rJ" } },
+    { INDEX_op_xor_i64, { "r", "r", "rJ" } },
+
+    { INDEX_op_shl_i64, { "r", "r", "rJ" } },
+    { INDEX_op_shr_i64, { "r", "r", "rJ" } },
+    { INDEX_op_sar_i64, { "r", "r", "rJ" } },
+
+    { INDEX_op_brcond_i64, { "r", "ri" } },
+#endif
+    { -1 },
+};
+
+void tcg_target_init(TCGContext *s)
+{
+    tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I32], 0, 0xffffffff);
+#if defined(__sparc_v9__) && !defined(__sparc_v8plus__)
+    tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I64], 0, 0xffffffff);
+#endif
+    tcg_regset_set32(tcg_target_call_clobber_regs, 0,
+                     (1 << TCG_REG_G1) |
+                     (1 << TCG_REG_G2) |
+                     (1 << TCG_REG_G3) |
+                     (1 << TCG_REG_G4) |
+                     (1 << TCG_REG_G5) |
+                     (1 << TCG_REG_G6) |
+                     (1 << TCG_REG_G7) |
+                     (1 << TCG_REG_O0) |
+                     (1 << TCG_REG_O1) |
+                     (1 << TCG_REG_O2) |
+                     (1 << TCG_REG_O3) |
+                     (1 << TCG_REG_O4) |
+                     (1 << TCG_REG_O5) |
+                     (1 << TCG_REG_O7));
+
+    tcg_regset_clear(s->reserved_regs);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_G0);
+#if defined(__sparc_v9__) && !defined(__sparc_v8plus__)
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_I4); // for internal use
+#endif
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_I5); // for internal use
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_I6);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_I7);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_O6);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_O7);
+    tcg_add_target_add_op_defs(sparc_op_defs);
+}
diff --git a/tcg/sparc/tcg-target.h b/tcg/sparc/tcg-target.h
new file mode 100644
index 0000000..8dc07d3
--- /dev/null
+++ b/tcg/sparc/tcg-target.h
@@ -0,0 +1,122 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#define TCG_TARGET_SPARC 1
+
+#if defined(__sparc_v9__) && !defined(__sparc_v8plus__)
+#define TCG_TARGET_REG_BITS 64
+#else
+#define TCG_TARGET_REG_BITS 32
+#endif
+
+#define TCG_TARGET_WORDS_BIGENDIAN
+
+#define TCG_TARGET_NB_REGS 32
+
+enum {
+    TCG_REG_G0 = 0,
+    TCG_REG_G1,
+    TCG_REG_G2,
+    TCG_REG_G3,
+    TCG_REG_G4,
+    TCG_REG_G5,
+    TCG_REG_G6,
+    TCG_REG_G7,
+    TCG_REG_O0,
+    TCG_REG_O1,
+    TCG_REG_O2,
+    TCG_REG_O3,
+    TCG_REG_O4,
+    TCG_REG_O5,
+    TCG_REG_O6,
+    TCG_REG_O7,
+    TCG_REG_L0,
+    TCG_REG_L1,
+    TCG_REG_L2,
+    TCG_REG_L3,
+    TCG_REG_L4,
+    TCG_REG_L5,
+    TCG_REG_L6,
+    TCG_REG_L7,
+    TCG_REG_I0,
+    TCG_REG_I1,
+    TCG_REG_I2,
+    TCG_REG_I3,
+    TCG_REG_I4,
+    TCG_REG_I5,
+    TCG_REG_I6,
+    TCG_REG_I7,
+};
+
+#define TCG_CT_CONST_S11 0x100
+#define TCG_CT_CONST_S13 0x200
+
+/* used for function call generation */
+#define TCG_REG_CALL_STACK TCG_REG_I6
+#ifdef __arch64__
+// Reserve space for AREG0
+#define TCG_TARGET_STACK_MINFRAME (176 + 2 * (int)sizeof(long))
+#define TCG_TARGET_CALL_STACK_OFFSET (2047 + TCG_TARGET_STACK_MINFRAME)
+#define TCG_TARGET_STACK_ALIGN 16
+#else
+// AREG0 + one word for alignment
+#define TCG_TARGET_STACK_MINFRAME (92 + (2 + 1) * (int)sizeof(long))
+#define TCG_TARGET_CALL_STACK_OFFSET TCG_TARGET_STACK_MINFRAME
+#define TCG_TARGET_STACK_ALIGN 8
+#endif
+
+/* optional instructions */
+//#define TCG_TARGET_HAS_bswap_i32
+//#define TCG_TARGET_HAS_bswap_i64
+//#define TCG_TARGET_HAS_neg_i32
+//#define TCG_TARGET_HAS_neg_i64
+
+
+/* Note: must be synced with dyngen-exec.h and Makefile.target */
+#ifdef HOST_SOLARIS
+#define TCG_AREG0 TCG_REG_G2
+#define TCG_AREG1 TCG_REG_G3
+#define TCG_AREG2 TCG_REG_G4
+#define TCG_AREG3 TCG_REG_G5
+#define TCG_AREG4 TCG_REG_G6
+#elif defined(__sparc_v9__)
+#define TCG_AREG0 TCG_REG_G5
+#define TCG_AREG1 TCG_REG_G6
+#define TCG_AREG2 TCG_REG_G7
+#else
+#define TCG_AREG0 TCG_REG_G6
+#define TCG_AREG1 TCG_REG_G1
+#define TCG_AREG2 TCG_REG_G2
+#define TCG_AREG3 TCG_REG_G3
+#endif
+
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
+{
+    unsigned long p;
+
+    p = start & ~(8UL - 1UL);
+    stop = (stop + (8UL - 1UL)) & ~(8UL - 1UL);
+
+    for (; p < stop; p += 8)
+        __asm__ __volatile__("flush\t%0" : : "r" (p));
+}
diff --git a/dyngen.h b/tcg/tcg-dyngen.c
index fe0a936..b4ceb5e 100644
--- a/dyngen.h
+++ b/tcg/tcg-dyngen.c
@@ -1,25 +1,40 @@
 /*
- * dyngen helpers
- * 
- *  Copyright (c) 2003 Fabrice Bellard
+ * Tiny Code Generator for QEMU
  *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * Copyright (c) 2008 Fabrice Bellard
  *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
  *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
  */
+#include <assert.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+
+#include "config.h"
+#include "osdep.h"
+
+#include "tcg.h"
 
 int __op_param1, __op_param2, __op_param3;
-#ifdef __sparc__
+#if defined(__sparc__) || defined(__arm__)
   void __op_gen_label1(){}
   void __op_gen_label2(){}
   void __op_gen_label3(){}
@@ -28,25 +43,12 @@ int __op_param1, __op_param2, __op_param3;
 #endif
 int __op_jmp0, __op_jmp1, __op_jmp2, __op_jmp3;
 
-#ifdef __i386__
-static inline void flush_icache_range(unsigned long start, unsigned long stop)
-{
-}
-#endif
-
-#ifdef __x86_64__
-static inline void flush_icache_range(unsigned long start, unsigned long stop)
-{
-}
-#endif
-
-#ifdef __s390__
+#if 0
+#if defined(__s390__)
 static inline void flush_icache_range(unsigned long start, unsigned long stop)
 {
 }
-#endif
-
-#ifdef __ia64__
+#elif defined(__ia64__)
 static inline void flush_icache_range(unsigned long start, unsigned long stop)
 {
     while (start < stop) {
@@ -55,19 +57,17 @@ static inline void flush_icache_range(unsigned long start, unsigned long stop)
     }
     asm volatile (";;sync.i;;srlz.i;;");
 }
-#endif
-
-#ifdef __powerpc__
+#elif defined(__powerpc__)
 
 #define MIN_CACHE_LINE_SIZE 8 /* conservative value */
 
-static void inline flush_icache_range(unsigned long start, unsigned long stop)
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
 {
     unsigned long p;
 
     start &= ~(MIN_CACHE_LINE_SIZE - 1);
     stop = (stop + MIN_CACHE_LINE_SIZE - 1) & ~(MIN_CACHE_LINE_SIZE - 1);
-    
+
     for (p = start; p < stop; p += MIN_CACHE_LINE_SIZE) {
         asm volatile ("dcbst 0,%0" : : "r"(p) : "memory");
     }
@@ -78,18 +78,13 @@ static void inline flush_icache_range(unsigned long start, unsigned long stop)
     asm volatile ("sync" : : : "memory");
     asm volatile ("isync" : : : "memory");
 }
-#endif
-
-#ifdef __alpha__
+#elif defined(__alpha__)
 static inline void flush_icache_range(unsigned long start, unsigned long stop)
 {
     asm ("imb");
 }
-#endif
-
-#ifdef __sparc__
-
-static void inline flush_icache_range(unsigned long start, unsigned long stop)
+#elif defined(__sparc__)
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
 {
 	unsigned long p;
 
@@ -99,10 +94,7 @@ static void inline flush_icache_range(unsigned long start, unsigned long stop)
 	for (; p < stop; p += 8)
 		__asm__ __volatile__("flush\t%0" : : "r" (p));
 }
-
-#endif
-
-#ifdef __arm__
+#elif defined(__arm__)
 static inline void flush_icache_range(unsigned long start, unsigned long stop)
 {
     register unsigned long _beg __asm ("a1") = start;
@@ -110,14 +102,22 @@ static inline void flush_icache_range(unsigned long start, unsigned long stop)
     register unsigned long _flg __asm ("a3") = 0;
     __asm __volatile__ ("swi 0x9f0002" : : "r" (_beg), "r" (_end), "r" (_flg));
 }
-#endif
+#elif defined(__mc68000)
 
-#ifdef __mc68000
-#include <asm/cachectl.h>
+# include <asm/cachectl.h>
 static inline void flush_icache_range(unsigned long start, unsigned long stop)
 {
     cacheflush(start,FLUSH_SCOPE_LINE,FLUSH_CACHE_BOTH,stop-start+16);
 }
+#elif defined(__mips__)
+
+#include <sys/cachectl.h>
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
+{
+    _flush_cache ((void *)start, stop - start, BCACHE);
+}
+#else
+#error unsupported CPU
 #endif
 
 #ifdef __alpha__
@@ -143,82 +143,8 @@ void fix_bsr(void *p, int offset) {
 
 #endif /* __alpha__ */
 
-#ifdef __arm__
-
-#define MAX_OP_SIZE    (128 * 4) /* in bytes */
-/* max size of the code that can be generated without calling arm_flush_ldr */
-#define MAX_FRAG_SIZE  (1024 * 4) 
-//#define MAX_FRAG_SIZE  (135 * 4) /* for testing */ 
-
-typedef struct LDREntry {
-    uint8_t *ptr;
-    uint32_t *data_ptr;
-} LDREntry;
-
-static LDREntry arm_ldr_table[1024];
-static uint32_t arm_data_table[1024];
-
-extern char exec_loop;
-
-static inline void arm_reloc_pc24(uint32_t *ptr, uint32_t insn, int val)
-{
-    *ptr = (insn & ~0xffffff) | ((insn + ((val - (int)ptr) >> 2)) & 0xffffff);
-}
-
-static uint8_t *arm_flush_ldr(uint8_t *gen_code_ptr,
-                              LDREntry *ldr_start, LDREntry *ldr_end, 
-                              uint32_t *data_start, uint32_t *data_end, 
-                              int gen_jmp)
-{
-    LDREntry *le;
-    uint32_t *ptr;
-    int offset, data_size, target;
-    uint8_t *data_ptr;
-    uint32_t insn;
- 
-    data_size = (uint8_t *)data_end - (uint8_t *)data_start;
-
-    if (gen_jmp) {
-        /* generate branch to skip the data */
-        if (data_size == 0)
-            return gen_code_ptr;
-        target = (long)gen_code_ptr + data_size + 4;
-        arm_reloc_pc24((uint32_t *)gen_code_ptr, 0xeafffffe, target);
-        gen_code_ptr += 4;
-    }
-   
-    /* copy the data */
-    data_ptr = gen_code_ptr;
-    memcpy(gen_code_ptr, data_start, data_size);
-    gen_code_ptr += data_size;
-    
-    /* patch the ldr to point to the data */
-    for(le = ldr_start; le < ldr_end; le++) {
-        ptr = (uint32_t *)le->ptr;
-        offset = ((unsigned long)(le->data_ptr) - (unsigned long)data_start) + 
-            (unsigned long)data_ptr - 
-            (unsigned long)ptr - 8;
-        insn = *ptr & ~(0xfff | 0x00800000);
-        if (offset < 0) {
-            offset = - offset;
-        } else {
-            insn |= 0x00800000;
-        }
-        if (offset > 0xfff) {
-            fprintf(stderr, "Error ldr offset\n");
-            abort();
-        }
-        insn |= offset;
-        *ptr = insn;
-    }
-    return gen_code_ptr;
-}
-
-#endif /* __arm__ */
-
 #ifdef __ia64
 
-
 /* Patch instruction with "val" where "mask" has 1 bits. */
 static inline void ia64_patch (uint64_t insn_addr, uint64_t mask, uint64_t val)
 {
@@ -379,7 +305,8 @@ static inline void ia64_apply_fixes (uint8_t **gen_code_pp,
 	0x05, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,	/* nop 0; brl IP */
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0
     };
-    uint8_t *gen_code_ptr = *gen_code_pp, *plt_start, *got_start, *vp;
+    uint8_t *gen_code_ptr = *gen_code_pp, *plt_start, *got_start;
+    uint64_t *vp;
     struct ia64_fixup *fixup;
     unsigned int offset = 0;
     struct fdesc {
@@ -416,12 +343,12 @@ static inline void ia64_apply_fixes (uint8_t **gen_code_pp,
     /* First, create the GOT: */
     for (fixup = ltoff_fixes; fixup; fixup = fixup->next) {
 	/* first check if we already have this value in the GOT: */
-	for (vp = got_start; vp < gen_code_ptr; ++vp)
-	    if (*(uint64_t *) vp == fixup->value)
+	for (vp = (uint64_t *) got_start; vp < (uint64_t *) gen_code_ptr; ++vp)
+	    if (*vp == fixup->value)
 		break;
-	if (vp == gen_code_ptr) {
+	if (vp == (uint64_t *) gen_code_ptr) {
 	    /* Nope, we need to put the value in the GOT: */
-	    *(uint64_t *) vp = fixup->value;
+	    *vp = fixup->value;
 	    gen_code_ptr += 8;
 	}
 	ia64_imm22(fixup->addr, (long) vp - gp);
@@ -431,5 +358,74 @@ static inline void ia64_apply_fixes (uint8_t **gen_code_pp,
 	gen_code_ptr += 8;
     *gen_code_pp = gen_code_ptr;
 }
+#endif
+#endif
+
+#ifdef CONFIG_DYNGEN_OP
+
+#if defined __hppa__
+struct hppa_branch_stub {
+    uint32_t *location;
+    long target;
+    struct hppa_branch_stub *next;
+};
+
+#define HPPA_RECORD_BRANCH(LIST, LOC, TARGET) \
+do { \
+    struct hppa_branch_stub *stub = alloca(sizeof(struct hppa_branch_stub)); \
+    stub->location = LOC; \
+    stub->target = TARGET; \
+    stub->next = LIST; \
+    LIST = stub; \
+} while (0)
+
+static inline void hppa_process_stubs(struct hppa_branch_stub *stub,
+                                      uint8_t **gen_code_pp)
+{
+    uint32_t *s = (uint32_t *)*gen_code_pp;
+    uint32_t *p = s + 1;
+
+    if (!stub) return;
+
+    for (; stub != NULL; stub = stub->next) {
+        unsigned long l = (unsigned long)p;
+        /* stub:
+         * ldil L'target, %r1
+         * be,n R'target(%sr4,%r1)
+         */
+        *p++ = 0x20200000 | reassemble_21(lrsel(stub->target, 0));
+        *p++ = 0xe0202002 | (reassemble_17(rrsel(stub->target, 0) >> 2));
+        hppa_patch17f(stub->location, l, 0);
+    }
+    /* b,l,n stub,%r0 */
+    *s = 0xe8000002 | reassemble_17((p - s) - 2);
+    *gen_code_pp = (uint8_t *)p;
+}
+#endif /* __hppa__ */
+
+const TCGArg *dyngen_op(TCGContext *s, int opc, const TCGArg *opparam_ptr)
+{
+    uint8_t *gen_code_ptr;
 
+#ifdef __hppa__
+    struct hppa_branch_stub *hppa_stubs = NULL;
+#endif
+
+    gen_code_ptr = s->code_ptr;
+    switch(opc) {
+
+/* op.h is dynamically generated by dyngen.c from op.c */
+#include "op.h"
+
+    default:
+        tcg_abort();
+    }
+
+#ifdef __hppa__
+    hppa_process_stubs(hppa_stubs, &gen_code_ptr);
+#endif
+
+    s->code_ptr = gen_code_ptr;
+    return opparam_ptr;
+}
 #endif
diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
new file mode 100644
index 0000000..bc6be85
--- /dev/null
+++ b/tcg/tcg-op.h
@@ -0,0 +1,1713 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "tcg.h"
+
+#ifdef CONFIG_DYNGEN_OP
+/* legacy dyngen operations */
+#include "gen-op.h"
+#endif
+
+int gen_new_label(void);
+
+static inline void tcg_gen_op1(int opc, TCGv arg1)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+}
+
+static inline void tcg_gen_op1i(int opc, TCGArg arg1)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = arg1;
+}
+
+static inline void tcg_gen_op2(int opc, TCGv arg1, TCGv arg2)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = GET_TCGV(arg2);
+}
+
+static inline void tcg_gen_op2i(int opc, TCGv arg1, TCGArg arg2)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = arg2;
+}
+
+static inline void tcg_gen_op2ii(int opc, TCGArg arg1, TCGArg arg2)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = arg1;
+    *gen_opparam_ptr++ = arg2;
+}
+
+static inline void tcg_gen_op3(int opc, TCGv arg1, TCGv arg2, TCGv arg3)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = GET_TCGV(arg2);
+    *gen_opparam_ptr++ = GET_TCGV(arg3);
+}
+
+static inline void tcg_gen_op3i(int opc, TCGv arg1, TCGv arg2, TCGArg arg3)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = GET_TCGV(arg2);
+    *gen_opparam_ptr++ = arg3;
+}
+
+static inline void tcg_gen_op4(int opc, TCGv arg1, TCGv arg2, TCGv arg3, 
+                               TCGv arg4)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = GET_TCGV(arg2);
+    *gen_opparam_ptr++ = GET_TCGV(arg3);
+    *gen_opparam_ptr++ = GET_TCGV(arg4);
+}
+
+static inline void tcg_gen_op4i(int opc, TCGv arg1, TCGv arg2, TCGv arg3, 
+                                TCGArg arg4)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = GET_TCGV(arg2);
+    *gen_opparam_ptr++ = GET_TCGV(arg3);
+    *gen_opparam_ptr++ = arg4;
+}
+
+static inline void tcg_gen_op4ii(int opc, TCGv arg1, TCGv arg2, TCGArg arg3, 
+                                 TCGArg arg4)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = GET_TCGV(arg2);
+    *gen_opparam_ptr++ = arg3;
+    *gen_opparam_ptr++ = arg4;
+}
+
+static inline void tcg_gen_op5(int opc, TCGv arg1, TCGv arg2, 
+                               TCGv arg3, TCGv arg4,
+                               TCGv arg5)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = GET_TCGV(arg2);
+    *gen_opparam_ptr++ = GET_TCGV(arg3);
+    *gen_opparam_ptr++ = GET_TCGV(arg4);
+    *gen_opparam_ptr++ = GET_TCGV(arg5);
+}
+
+static inline void tcg_gen_op5i(int opc, TCGv arg1, TCGv arg2, 
+                                TCGv arg3, TCGv arg4,
+                                TCGArg arg5)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = GET_TCGV(arg2);
+    *gen_opparam_ptr++ = GET_TCGV(arg3);
+    *gen_opparam_ptr++ = GET_TCGV(arg4);
+    *gen_opparam_ptr++ = arg5;
+}
+
+static inline void tcg_gen_op6(int opc, TCGv arg1, TCGv arg2, 
+                               TCGv arg3, TCGv arg4,
+                               TCGv arg5, TCGv arg6)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = GET_TCGV(arg2);
+    *gen_opparam_ptr++ = GET_TCGV(arg3);
+    *gen_opparam_ptr++ = GET_TCGV(arg4);
+    *gen_opparam_ptr++ = GET_TCGV(arg5);
+    *gen_opparam_ptr++ = GET_TCGV(arg6);
+}
+
+static inline void tcg_gen_op6ii(int opc, TCGv arg1, TCGv arg2, 
+                                 TCGv arg3, TCGv arg4,
+                                 TCGArg arg5, TCGArg arg6)
+{
+    *gen_opc_ptr++ = opc;
+    *gen_opparam_ptr++ = GET_TCGV(arg1);
+    *gen_opparam_ptr++ = GET_TCGV(arg2);
+    *gen_opparam_ptr++ = GET_TCGV(arg3);
+    *gen_opparam_ptr++ = GET_TCGV(arg4);
+    *gen_opparam_ptr++ = arg5;
+    *gen_opparam_ptr++ = arg6;
+}
+
+static inline void gen_set_label(int n)
+{
+    tcg_gen_op1i(INDEX_op_set_label, n);
+}
+
+static inline void tcg_gen_br(int label)
+{
+    tcg_gen_op1i(INDEX_op_br, label);
+}
+
+static inline void tcg_gen_mov_i32(TCGv ret, TCGv arg)
+{
+    if (GET_TCGV(ret) != GET_TCGV(arg))
+        tcg_gen_op2(INDEX_op_mov_i32, ret, arg);
+}
+
+static inline void tcg_gen_movi_i32(TCGv ret, int32_t arg)
+{
+    tcg_gen_op2i(INDEX_op_movi_i32, ret, arg);
+}
+
+/* helper calls */
+#define TCG_HELPER_CALL_FLAGS 0
+
+static inline void tcg_gen_helper_0_0(void *func)
+{
+    TCGv t0;
+    t0 = tcg_const_ptr((tcg_target_long)func);
+    tcg_gen_call(&tcg_ctx, 
+                 t0, TCG_HELPER_CALL_FLAGS,
+                 0, NULL, 0, NULL);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_helper_0_1(void *func, TCGv arg)
+{
+    TCGv t0;
+    t0 = tcg_const_ptr((tcg_target_long)func);
+    tcg_gen_call(&tcg_ctx,
+                 t0, TCG_HELPER_CALL_FLAGS,
+                 0, NULL, 1, &arg);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_helper_0_2(void *func, TCGv arg1, TCGv arg2)
+{
+    TCGv args[2];
+    TCGv t0;
+    args[0] = arg1;
+    args[1] = arg2;
+    t0 = tcg_const_ptr((tcg_target_long)func);
+    tcg_gen_call(&tcg_ctx, 
+                 t0, TCG_HELPER_CALL_FLAGS,
+                 0, NULL, 2, args);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_helper_0_3(void *func,
+                                      TCGv arg1, TCGv arg2, TCGv arg3)
+{
+    TCGv args[3];
+    TCGv t0;
+    args[0] = arg1;
+    args[1] = arg2;
+    args[2] = arg3;
+    t0 = tcg_const_ptr((tcg_target_long)func);
+    tcg_gen_call(&tcg_ctx,
+                 t0, TCG_HELPER_CALL_FLAGS,
+                 0, NULL, 3, args);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_helper_0_4(void *func, TCGv arg1, TCGv arg2,
+                                      TCGv arg3, TCGv arg4)
+{
+    TCGv args[4];
+    TCGv t0;
+    args[0] = arg1;
+    args[1] = arg2;
+    args[2] = arg3;
+    args[3] = arg4;
+    t0 = tcg_const_ptr((tcg_target_long)func);
+    tcg_gen_call(&tcg_ctx,
+                 t0, TCG_HELPER_CALL_FLAGS,
+                 0, NULL, 4, args);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_helper_1_0(void *func, TCGv ret)
+{
+    TCGv t0;
+    t0 = tcg_const_ptr((tcg_target_long)func);
+    tcg_gen_call(&tcg_ctx,
+                 t0, TCG_HELPER_CALL_FLAGS,
+                 1, &ret, 0, NULL);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_helper_1_1(void *func, TCGv ret, TCGv arg1)
+{
+    TCGv t0;
+    t0 = tcg_const_ptr((tcg_target_long)func);
+    tcg_gen_call(&tcg_ctx,
+                 t0, TCG_HELPER_CALL_FLAGS,
+                 1, &ret, 1, &arg1);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_helper_1_2(void *func, TCGv ret, 
+                                      TCGv arg1, TCGv arg2)
+{
+    TCGv args[2];
+    TCGv t0;
+    args[0] = arg1;
+    args[1] = arg2;
+    t0 = tcg_const_ptr((tcg_target_long)func);
+    tcg_gen_call(&tcg_ctx, 
+                 t0, TCG_HELPER_CALL_FLAGS,
+                 1, &ret, 2, args);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_helper_1_3(void *func, TCGv ret,
+                                      TCGv arg1, TCGv arg2, TCGv arg3)
+{
+    TCGv args[3];
+    TCGv t0;
+    args[0] = arg1;
+    args[1] = arg2;
+    args[2] = arg3;
+    t0 = tcg_const_ptr((tcg_target_long)func);
+    tcg_gen_call(&tcg_ctx,
+                 t0, TCG_HELPER_CALL_FLAGS,
+                 1, &ret, 3, args);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_helper_1_4(void *func, TCGv ret,
+                                      TCGv arg1, TCGv arg2, TCGv arg3,
+                                      TCGv arg4)
+{
+    TCGv args[4];
+    TCGv t0;
+    args[0] = arg1;
+    args[1] = arg2;
+    args[2] = arg3;
+    args[3] = arg4;
+    t0 = tcg_const_ptr((tcg_target_long)func);
+    tcg_gen_call(&tcg_ctx,
+                 t0, TCG_HELPER_CALL_FLAGS,
+                 1, &ret, 4, args);
+    tcg_temp_free(t0);
+}
+
+/* 32 bit ops */
+
+static inline void tcg_gen_ld8u_i32(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld8u_i32, ret, arg2, offset);
+}
+
+static inline void tcg_gen_ld8s_i32(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld8s_i32, ret, arg2, offset);
+}
+
+static inline void tcg_gen_ld16u_i32(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld16u_i32, ret, arg2, offset);
+}
+
+static inline void tcg_gen_ld16s_i32(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld16s_i32, ret, arg2, offset);
+}
+
+static inline void tcg_gen_ld_i32(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld_i32, ret, arg2, offset);
+}
+
+static inline void tcg_gen_st8_i32(TCGv arg1, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_st8_i32, arg1, arg2, offset);
+}
+
+static inline void tcg_gen_st16_i32(TCGv arg1, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_st16_i32, arg1, arg2, offset);
+}
+
+static inline void tcg_gen_st_i32(TCGv arg1, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_st_i32, arg1, arg2, offset);
+}
+
+static inline void tcg_gen_add_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_add_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_addi_i32(TCGv ret, TCGv arg1, int32_t arg2)
+{
+    /* some cases can be optimized here */
+    if (arg2 == 0) {
+        tcg_gen_mov_i32(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i32(arg2);
+        tcg_gen_add_i32(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_sub_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_sub_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_subi_i32(TCGv ret, TCGv arg1, int32_t arg2)
+{
+    /* some cases can be optimized here */
+    if (arg2 == 0) {
+        tcg_gen_mov_i32(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i32(arg2);
+        tcg_gen_sub_i32(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_and_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_and_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_andi_i32(TCGv ret, TCGv arg1, int32_t arg2)
+{
+    /* some cases can be optimized here */
+    if (arg2 == 0) {
+        tcg_gen_movi_i32(ret, 0);
+    } else if (arg2 == 0xffffffff) {
+        tcg_gen_mov_i32(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i32(arg2);
+        tcg_gen_and_i32(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_or_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_or_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_ori_i32(TCGv ret, TCGv arg1, int32_t arg2)
+{
+    /* some cases can be optimized here */
+    if (arg2 == 0xffffffff) {
+        tcg_gen_movi_i32(ret, 0xffffffff);
+    } else if (arg2 == 0) {
+        tcg_gen_mov_i32(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i32(arg2);
+        tcg_gen_or_i32(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_xor_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_xor_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_xori_i32(TCGv ret, TCGv arg1, int32_t arg2)
+{
+    /* some cases can be optimized here */
+    if (arg2 == 0) {
+        tcg_gen_mov_i32(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i32(arg2);
+        tcg_gen_xor_i32(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_shl_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_shl_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_shli_i32(TCGv ret, TCGv arg1, int32_t arg2)
+{
+    if (arg2 == 0) {
+        tcg_gen_mov_i32(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i32(arg2);
+        tcg_gen_shl_i32(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_shr_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_shr_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_shri_i32(TCGv ret, TCGv arg1, int32_t arg2)
+{
+    if (arg2 == 0) {
+        tcg_gen_mov_i32(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i32(arg2);
+        tcg_gen_shr_i32(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_sar_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_sar_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_sari_i32(TCGv ret, TCGv arg1, int32_t arg2)
+{
+    if (arg2 == 0) {
+        tcg_gen_mov_i32(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i32(arg2);
+        tcg_gen_sar_i32(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_brcond_i32(int cond, TCGv arg1, TCGv arg2, 
+                                      int label_index)
+{
+    tcg_gen_op4ii(INDEX_op_brcond_i32, arg1, arg2, cond, label_index);
+}
+
+static inline void tcg_gen_brcondi_i32(int cond, TCGv arg1, int32_t arg2, 
+                                       int label_index)
+{
+    TCGv t0 = tcg_const_i32(arg2);
+    tcg_gen_brcond_i32(cond, arg1, t0, label_index);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_mul_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_mul_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_muli_i32(TCGv ret, TCGv arg1, int32_t arg2)
+{
+    TCGv t0 = tcg_const_i32(arg2);
+    tcg_gen_mul_i32(ret, arg1, t0);
+    tcg_temp_free(t0);
+}
+
+#ifdef TCG_TARGET_HAS_div_i32
+static inline void tcg_gen_div_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_div_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_rem_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_rem_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_divu_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_divu_i32, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_remu_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_remu_i32, ret, arg1, arg2);
+}
+#else
+static inline void tcg_gen_div_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    TCGv t0;
+    t0 = tcg_temp_new(TCG_TYPE_I32);
+    tcg_gen_sari_i32(t0, arg1, 31);
+    tcg_gen_op5(INDEX_op_div2_i32, ret, t0, arg1, t0, arg2);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_rem_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    TCGv t0;
+    t0 = tcg_temp_new(TCG_TYPE_I32);
+    tcg_gen_sari_i32(t0, arg1, 31);
+    tcg_gen_op5(INDEX_op_div2_i32, t0, ret, arg1, t0, arg2);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_divu_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    TCGv t0;
+    t0 = tcg_temp_new(TCG_TYPE_I32);
+    tcg_gen_movi_i32(t0, 0);
+    tcg_gen_op5(INDEX_op_divu2_i32, ret, t0, arg1, t0, arg2);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_remu_i32(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    TCGv t0;
+    t0 = tcg_temp_new(TCG_TYPE_I32);
+    tcg_gen_movi_i32(t0, 0);
+    tcg_gen_op5(INDEX_op_divu2_i32, t0, ret, arg1, t0, arg2);
+    tcg_temp_free(t0);
+}
+#endif
+
+#if TCG_TARGET_REG_BITS == 32
+
+static inline void tcg_gen_mov_i64(TCGv ret, TCGv arg)
+{
+    if (GET_TCGV(ret) != GET_TCGV(arg)) {
+        tcg_gen_mov_i32(ret, arg);
+        tcg_gen_mov_i32(TCGV_HIGH(ret), TCGV_HIGH(arg));
+    }
+}
+
+static inline void tcg_gen_movi_i64(TCGv ret, int64_t arg)
+{
+    tcg_gen_movi_i32(ret, arg);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), arg >> 32);
+}
+
+static inline void tcg_gen_ld8u_i64(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_ld8u_i32(ret, arg2, offset);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+}
+
+static inline void tcg_gen_ld8s_i64(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_ld8s_i32(ret, arg2, offset);
+    tcg_gen_sari_i32(TCGV_HIGH(ret), ret, 31);
+}
+
+static inline void tcg_gen_ld16u_i64(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_ld16u_i32(ret, arg2, offset);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+}
+
+static inline void tcg_gen_ld16s_i64(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_ld16s_i32(ret, arg2, offset);
+    tcg_gen_sari_i32(TCGV_HIGH(ret), ret, 31);
+}
+
+static inline void tcg_gen_ld32u_i64(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_ld_i32(ret, arg2, offset);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+}
+
+static inline void tcg_gen_ld32s_i64(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_ld_i32(ret, arg2, offset);
+    tcg_gen_sari_i32(TCGV_HIGH(ret), ret, 31);
+}
+
+static inline void tcg_gen_ld_i64(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    /* since arg2 and ret have different types, they cannot be the
+       same temporary */
+#ifdef TCG_TARGET_WORDS_BIGENDIAN
+    tcg_gen_ld_i32(TCGV_HIGH(ret), arg2, offset);
+    tcg_gen_ld_i32(ret, arg2, offset + 4);
+#else
+    tcg_gen_ld_i32(ret, arg2, offset);
+    tcg_gen_ld_i32(TCGV_HIGH(ret), arg2, offset + 4);
+#endif
+}
+
+static inline void tcg_gen_st8_i64(TCGv arg1, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_st8_i32(arg1, arg2, offset);
+}
+
+static inline void tcg_gen_st16_i64(TCGv arg1, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_st16_i32(arg1, arg2, offset);
+}
+
+static inline void tcg_gen_st32_i64(TCGv arg1, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_st_i32(arg1, arg2, offset);
+}
+
+static inline void tcg_gen_st_i64(TCGv arg1, TCGv arg2, tcg_target_long offset)
+{
+#ifdef TCG_TARGET_WORDS_BIGENDIAN
+    tcg_gen_st_i32(TCGV_HIGH(arg1), arg2, offset);
+    tcg_gen_st_i32(arg1, arg2, offset + 4);
+#else
+    tcg_gen_st_i32(arg1, arg2, offset);
+    tcg_gen_st_i32(TCGV_HIGH(arg1), arg2, offset + 4);
+#endif
+}
+
+static inline void tcg_gen_add_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op6(INDEX_op_add2_i32, ret, TCGV_HIGH(ret), 
+                arg1, TCGV_HIGH(arg1), arg2, TCGV_HIGH(arg2));
+}
+
+static inline void tcg_gen_addi_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    TCGv t0 = tcg_const_i64(arg2);
+    tcg_gen_add_i64(ret, arg1, t0);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_sub_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op6(INDEX_op_sub2_i32, ret, TCGV_HIGH(ret), 
+                arg1, TCGV_HIGH(arg1), arg2, TCGV_HIGH(arg2));
+}
+
+static inline void tcg_gen_subi_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    TCGv t0 = tcg_const_i64(arg2);
+    tcg_gen_sub_i64(ret, arg1, t0);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_and_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_and_i32(ret, arg1, arg2);
+    tcg_gen_and_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
+}
+
+static inline void tcg_gen_andi_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    tcg_gen_andi_i32(ret, arg1, arg2);
+    tcg_gen_andi_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), arg2 >> 32);
+}
+
+static inline void tcg_gen_or_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_or_i32(ret, arg1, arg2);
+    tcg_gen_or_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
+}
+
+static inline void tcg_gen_ori_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    tcg_gen_ori_i32(ret, arg1, arg2);
+    tcg_gen_ori_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), arg2 >> 32);
+}
+
+static inline void tcg_gen_xor_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_xor_i32(ret, arg1, arg2);
+    tcg_gen_xor_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), TCGV_HIGH(arg2));
+}
+
+static inline void tcg_gen_xori_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    tcg_gen_xori_i32(ret, arg1, arg2);
+    tcg_gen_xori_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), arg2 >> 32);
+}
+
+/* XXX: use generic code when basic block handling is OK or CPU
+   specific code (x86) */
+static inline void tcg_gen_shl_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_helper_1_2(tcg_helper_shl_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_shli_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    tcg_gen_shifti_i64(ret, arg1, arg2, 0, 0);
+}
+
+static inline void tcg_gen_shr_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_helper_1_2(tcg_helper_shr_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_shri_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    tcg_gen_shifti_i64(ret, arg1, arg2, 1, 0);
+}
+
+static inline void tcg_gen_sar_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_helper_1_2(tcg_helper_sar_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_sari_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    tcg_gen_shifti_i64(ret, arg1, arg2, 1, 1);
+}
+
+static inline void tcg_gen_brcond_i64(int cond, TCGv arg1, TCGv arg2, 
+                                      int label_index)
+{
+    tcg_gen_op6ii(INDEX_op_brcond2_i32, 
+                  arg1, TCGV_HIGH(arg1), arg2, TCGV_HIGH(arg2),
+                  cond, label_index);
+}
+
+static inline void tcg_gen_mul_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    TCGv t0, t1;
+    
+    t0 = tcg_temp_new(TCG_TYPE_I64);
+    t1 = tcg_temp_new(TCG_TYPE_I32);
+
+    tcg_gen_op4(INDEX_op_mulu2_i32, t0, TCGV_HIGH(t0), arg1, arg2);
+    
+    tcg_gen_mul_i32(t1, arg1, TCGV_HIGH(arg2));
+    tcg_gen_add_i32(TCGV_HIGH(t0), TCGV_HIGH(t0), t1);
+    tcg_gen_mul_i32(t1, TCGV_HIGH(arg1), arg2);
+    tcg_gen_add_i32(TCGV_HIGH(t0), TCGV_HIGH(t0), t1);
+    
+    tcg_gen_mov_i64(ret, t0);
+    tcg_temp_free(t0);
+    tcg_temp_free(t1);
+}
+
+static inline void tcg_gen_muli_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    TCGv t0 = tcg_const_i64(arg2);
+    tcg_gen_mul_i64(ret, arg1, t0);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_div_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_helper_1_2(tcg_helper_div_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_rem_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_helper_1_2(tcg_helper_rem_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_divu_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_helper_1_2(tcg_helper_divu_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_remu_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_helper_1_2(tcg_helper_remu_i64, ret, arg1, arg2);
+}
+
+#else
+
+static inline void tcg_gen_mov_i64(TCGv ret, TCGv arg)
+{
+    if (GET_TCGV(ret) != GET_TCGV(arg))
+        tcg_gen_op2(INDEX_op_mov_i64, ret, arg);
+}
+
+static inline void tcg_gen_movi_i64(TCGv ret, int64_t arg)
+{
+    tcg_gen_op2i(INDEX_op_movi_i64, ret, arg);
+}
+
+static inline void tcg_gen_ld8u_i64(TCGv ret, TCGv arg2,
+                                    tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld8u_i64, ret, arg2, offset);
+}
+
+static inline void tcg_gen_ld8s_i64(TCGv ret, TCGv arg2,
+                                    tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld8s_i64, ret, arg2, offset);
+}
+
+static inline void tcg_gen_ld16u_i64(TCGv ret, TCGv arg2,
+                                     tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld16u_i64, ret, arg2, offset);
+}
+
+static inline void tcg_gen_ld16s_i64(TCGv ret, TCGv arg2,
+                                     tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld16s_i64, ret, arg2, offset);
+}
+
+static inline void tcg_gen_ld32u_i64(TCGv ret, TCGv arg2,
+                                     tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld32u_i64, ret, arg2, offset);
+}
+
+static inline void tcg_gen_ld32s_i64(TCGv ret, TCGv arg2,
+                                     tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld32s_i64, ret, arg2, offset);
+}
+
+static inline void tcg_gen_ld_i64(TCGv ret, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_ld_i64, ret, arg2, offset);
+}
+
+static inline void tcg_gen_st8_i64(TCGv arg1, TCGv arg2,
+                                   tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_st8_i64, arg1, arg2, offset);
+}
+
+static inline void tcg_gen_st16_i64(TCGv arg1, TCGv arg2,
+                                    tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_st16_i64, arg1, arg2, offset);
+}
+
+static inline void tcg_gen_st32_i64(TCGv arg1, TCGv arg2,
+                                    tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_st32_i64, arg1, arg2, offset);
+}
+
+static inline void tcg_gen_st_i64(TCGv arg1, TCGv arg2, tcg_target_long offset)
+{
+    tcg_gen_op3i(INDEX_op_st_i64, arg1, arg2, offset);
+}
+
+static inline void tcg_gen_add_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_add_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_addi_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    TCGv t0 = tcg_const_i64(arg2);
+    tcg_gen_add_i64(ret, arg1, t0);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_sub_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_sub_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_subi_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    TCGv t0 = tcg_const_i64(arg2);
+    tcg_gen_sub_i64(ret, arg1, t0);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_and_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_and_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_andi_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    TCGv t0 = tcg_const_i64(arg2);
+    tcg_gen_and_i64(ret, arg1, t0);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_or_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_or_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_ori_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    TCGv t0 = tcg_const_i64(arg2);
+    tcg_gen_or_i64(ret, arg1, t0);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_xor_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_xor_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_xori_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    TCGv t0 = tcg_const_i64(arg2);
+    tcg_gen_xor_i64(ret, arg1, t0);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_shl_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_shl_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_shli_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    if (arg2 == 0) {
+        tcg_gen_mov_i64(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i64(arg2);
+        tcg_gen_shl_i64(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_shr_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_shr_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_shri_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    if (arg2 == 0) {
+        tcg_gen_mov_i64(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i64(arg2);
+        tcg_gen_shr_i64(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_sar_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_sar_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_sari_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    if (arg2 == 0) {
+        tcg_gen_mov_i64(ret, arg1);
+    } else {
+        TCGv t0 = tcg_const_i64(arg2);
+        tcg_gen_sar_i64(ret, arg1, t0);
+        tcg_temp_free(t0);
+    }
+}
+
+static inline void tcg_gen_brcond_i64(int cond, TCGv arg1, TCGv arg2, 
+                                      int label_index)
+{
+    tcg_gen_op4ii(INDEX_op_brcond_i64, arg1, arg2, cond, label_index);
+}
+
+static inline void tcg_gen_mul_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_mul_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_muli_i64(TCGv ret, TCGv arg1, int64_t arg2)
+{
+    TCGv t0 = tcg_const_i64(arg2);
+    tcg_gen_mul_i64(ret, arg1, t0);
+    tcg_temp_free(t0);
+}
+
+#ifdef TCG_TARGET_HAS_div_i64
+static inline void tcg_gen_div_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_div_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_rem_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_rem_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_divu_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_divu_i64, ret, arg1, arg2);
+}
+
+static inline void tcg_gen_remu_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_op3(INDEX_op_remu_i64, ret, arg1, arg2);
+}
+#else
+static inline void tcg_gen_div_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    TCGv t0;
+    t0 = tcg_temp_new(TCG_TYPE_I64);
+    tcg_gen_sari_i64(t0, arg1, 63);
+    tcg_gen_op5(INDEX_op_div2_i64, ret, t0, arg1, t0, arg2);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_rem_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    TCGv t0;
+    t0 = tcg_temp_new(TCG_TYPE_I64);
+    tcg_gen_sari_i64(t0, arg1, 63);
+    tcg_gen_op5(INDEX_op_div2_i64, t0, ret, arg1, t0, arg2);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_divu_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    TCGv t0;
+    t0 = tcg_temp_new(TCG_TYPE_I64);
+    tcg_gen_movi_i64(t0, 0);
+    tcg_gen_op5(INDEX_op_divu2_i64, ret, t0, arg1, t0, arg2);
+    tcg_temp_free(t0);
+}
+
+static inline void tcg_gen_remu_i64(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    TCGv t0;
+    t0 = tcg_temp_new(TCG_TYPE_I64);
+    tcg_gen_movi_i64(t0, 0);
+    tcg_gen_op5(INDEX_op_divu2_i64, t0, ret, arg1, t0, arg2);
+    tcg_temp_free(t0);
+}
+#endif
+
+#endif
+
+static inline void tcg_gen_brcondi_i64(int cond, TCGv arg1, int64_t arg2, 
+                                       int label_index)
+{
+    TCGv t0 = tcg_const_i64(arg2);
+    tcg_gen_brcond_i64(cond, arg1, t0, label_index);
+    tcg_temp_free(t0);
+}
+
+/***************************************/
+/* optional operations */
+
+static inline void tcg_gen_ext8s_i32(TCGv ret, TCGv arg)
+{
+#ifdef TCG_TARGET_HAS_ext8s_i32
+    tcg_gen_op2(INDEX_op_ext8s_i32, ret, arg);
+#else
+    tcg_gen_shli_i32(ret, arg, 24);
+    tcg_gen_sari_i32(ret, ret, 24);
+#endif
+}
+
+static inline void tcg_gen_ext16s_i32(TCGv ret, TCGv arg)
+{
+#ifdef TCG_TARGET_HAS_ext16s_i32
+    tcg_gen_op2(INDEX_op_ext16s_i32, ret, arg);
+#else
+    tcg_gen_shli_i32(ret, arg, 16);
+    tcg_gen_sari_i32(ret, ret, 16);
+#endif
+}
+
+/* These are currently just for convenience.
+   We assume a target will recognise these automatically .  */
+static inline void tcg_gen_ext8u_i32(TCGv ret, TCGv arg)
+{
+    tcg_gen_andi_i32(ret, arg, 0xffu);
+}
+
+static inline void tcg_gen_ext16u_i32(TCGv ret, TCGv arg)
+{
+    tcg_gen_andi_i32(ret, arg, 0xffffu);
+}
+
+/* Note: we assume the two high bytes are set to zero */
+static inline void tcg_gen_bswap16_i32(TCGv ret, TCGv arg)
+{
+#ifdef TCG_TARGET_HAS_bswap16_i32
+    tcg_gen_op2(INDEX_op_bswap16_i32, ret, arg);
+#else
+    TCGv t0, t1;
+    t0 = tcg_temp_new(TCG_TYPE_I32);
+    t1 = tcg_temp_new(TCG_TYPE_I32);
+    
+    tcg_gen_shri_i32(t0, arg, 8);
+    tcg_gen_andi_i32(t1, arg, 0x000000ff);
+    tcg_gen_shli_i32(t1, t1, 8);
+    tcg_gen_or_i32(ret, t0, t1);
+    tcg_temp_free(t0);
+    tcg_temp_free(t1);
+#endif
+}
+
+static inline void tcg_gen_bswap_i32(TCGv ret, TCGv arg)
+{
+#ifdef TCG_TARGET_HAS_bswap_i32
+    tcg_gen_op2(INDEX_op_bswap_i32, ret, arg);
+#else
+    TCGv t0, t1;
+    t0 = tcg_temp_new(TCG_TYPE_I32);
+    t1 = tcg_temp_new(TCG_TYPE_I32);
+    
+    tcg_gen_shli_i32(t0, arg, 24);
+    
+    tcg_gen_andi_i32(t1, arg, 0x0000ff00);
+    tcg_gen_shli_i32(t1, t1, 8);
+    tcg_gen_or_i32(t0, t0, t1);
+    
+    tcg_gen_shri_i32(t1, arg, 8);
+    tcg_gen_andi_i32(t1, t1, 0x0000ff00);
+    tcg_gen_or_i32(t0, t0, t1);
+    
+    tcg_gen_shri_i32(t1, arg, 24);
+    tcg_gen_or_i32(ret, t0, t1);
+    tcg_temp_free(t0);
+    tcg_temp_free(t1);
+#endif
+}
+
+#if TCG_TARGET_REG_BITS == 32
+static inline void tcg_gen_ext8s_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_ext8s_i32(ret, arg);
+    tcg_gen_sari_i32(TCGV_HIGH(ret), ret, 31);
+}
+
+static inline void tcg_gen_ext16s_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_ext16s_i32(ret, arg);
+    tcg_gen_sari_i32(TCGV_HIGH(ret), ret, 31);
+}
+
+static inline void tcg_gen_ext32s_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_mov_i32(ret, arg);
+    tcg_gen_sari_i32(TCGV_HIGH(ret), ret, 31);
+}
+
+static inline void tcg_gen_ext8u_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_ext8u_i32(ret, arg);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+}
+
+static inline void tcg_gen_ext16u_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_ext16u_i32(ret, arg);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+}
+
+static inline void tcg_gen_ext32u_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_mov_i32(ret, arg);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+}
+
+static inline void tcg_gen_trunc_i64_i32(TCGv ret, TCGv arg)
+{
+    tcg_gen_mov_i32(ret, arg);
+}
+
+static inline void tcg_gen_extu_i32_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_mov_i32(ret, arg);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+}
+
+static inline void tcg_gen_ext_i32_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_mov_i32(ret, arg);
+    tcg_gen_sari_i32(TCGV_HIGH(ret), ret, 31);
+}
+
+static inline void tcg_gen_bswap_i64(TCGv ret, TCGv arg)
+{
+    TCGv t0, t1;
+    t0 = tcg_temp_new(TCG_TYPE_I32);
+    t1 = tcg_temp_new(TCG_TYPE_I32);
+
+    tcg_gen_bswap_i32(t0, arg);
+    tcg_gen_bswap_i32(t1, TCGV_HIGH(arg));
+    tcg_gen_mov_i32(ret, t1);
+    tcg_gen_mov_i32(TCGV_HIGH(ret), t0);
+    tcg_temp_free(t0);
+    tcg_temp_free(t1);
+}
+#else
+
+static inline void tcg_gen_ext8s_i64(TCGv ret, TCGv arg)
+{
+#ifdef TCG_TARGET_HAS_ext8s_i64
+    tcg_gen_op2(INDEX_op_ext8s_i64, ret, arg);
+#else
+    tcg_gen_shli_i64(ret, arg, 56);
+    tcg_gen_sari_i64(ret, ret, 56);
+#endif
+}
+
+static inline void tcg_gen_ext16s_i64(TCGv ret, TCGv arg)
+{
+#ifdef TCG_TARGET_HAS_ext16s_i64
+    tcg_gen_op2(INDEX_op_ext16s_i64, ret, arg);
+#else
+    tcg_gen_shli_i64(ret, arg, 48);
+    tcg_gen_sari_i64(ret, ret, 48);
+#endif
+}
+
+static inline void tcg_gen_ext32s_i64(TCGv ret, TCGv arg)
+{
+#ifdef TCG_TARGET_HAS_ext32s_i64
+    tcg_gen_op2(INDEX_op_ext32s_i64, ret, arg);
+#else
+    tcg_gen_shli_i64(ret, arg, 32);
+    tcg_gen_sari_i64(ret, ret, 32);
+#endif
+}
+
+static inline void tcg_gen_ext8u_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_andi_i64(ret, arg, 0xffu);
+}
+
+static inline void tcg_gen_ext16u_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_andi_i64(ret, arg, 0xffffu);
+}
+
+static inline void tcg_gen_ext32u_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_andi_i64(ret, arg, 0xffffffffu);
+}
+
+/* Note: we assume the target supports move between 32 and 64 bit
+   registers.  This will probably break MIPS64 targets.  */
+static inline void tcg_gen_trunc_i64_i32(TCGv ret, TCGv arg)
+{
+    tcg_gen_mov_i32(ret, arg);
+}
+
+/* Note: we assume the target supports move between 32 and 64 bit
+   registers */
+static inline void tcg_gen_extu_i32_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_andi_i64(ret, arg, 0xffffffffu);
+}
+
+/* Note: we assume the target supports move between 32 and 64 bit
+   registers */
+static inline void tcg_gen_ext_i32_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_ext32s_i64(ret, arg);
+}
+
+static inline void tcg_gen_bswap_i64(TCGv ret, TCGv arg)
+{
+#ifdef TCG_TARGET_HAS_bswap_i64
+    tcg_gen_op2(INDEX_op_bswap_i64, ret, arg);
+#else
+    TCGv t0, t1;
+    t0 = tcg_temp_new(TCG_TYPE_I32);
+    t1 = tcg_temp_new(TCG_TYPE_I32);
+    
+    tcg_gen_shli_i64(t0, arg, 56);
+    
+    tcg_gen_andi_i64(t1, arg, 0x0000ff00);
+    tcg_gen_shli_i64(t1, t1, 40);
+    tcg_gen_or_i64(t0, t0, t1);
+    
+    tcg_gen_andi_i64(t1, arg, 0x00ff0000);
+    tcg_gen_shli_i64(t1, t1, 24);
+    tcg_gen_or_i64(t0, t0, t1);
+
+    tcg_gen_andi_i64(t1, arg, 0xff000000);
+    tcg_gen_shli_i64(t1, t1, 8);
+    tcg_gen_or_i64(t0, t0, t1);
+
+    tcg_gen_shri_i64(t1, arg, 8);
+    tcg_gen_andi_i64(t1, t1, 0xff000000);
+    tcg_gen_or_i64(t0, t0, t1);
+    
+    tcg_gen_shri_i64(t1, arg, 24);
+    tcg_gen_andi_i64(t1, t1, 0x00ff0000);
+    tcg_gen_or_i64(t0, t0, t1);
+
+    tcg_gen_shri_i64(t1, arg, 40);
+    tcg_gen_andi_i64(t1, t1, 0x0000ff00);
+    tcg_gen_or_i64(t0, t0, t1);
+
+    tcg_gen_shri_i64(t1, arg, 56);
+    tcg_gen_or_i64(ret, t0, t1);
+    tcg_temp_free(t0);
+    tcg_temp_free(t1);
+#endif
+}
+
+#endif
+
+static inline void tcg_gen_neg_i32(TCGv ret, TCGv arg)
+{
+#ifdef TCG_TARGET_HAS_neg_i32
+    tcg_gen_op2(INDEX_op_neg_i32, ret, arg);
+#else
+    TCGv t0 = tcg_const_i32(0);
+    tcg_gen_sub_i32(ret, t0, arg);
+    tcg_temp_free(t0);
+#endif
+}
+
+static inline void tcg_gen_neg_i64(TCGv ret, TCGv arg)
+{
+#ifdef TCG_TARGET_HAS_neg_i64
+    tcg_gen_op2(INDEX_op_neg_i64, ret, arg);
+#else
+    TCGv t0 = tcg_const_i64(0);
+    tcg_gen_sub_i64(ret, t0, arg);
+    tcg_temp_free(t0);
+#endif
+}
+
+static inline void tcg_gen_not_i32(TCGv ret, TCGv arg)
+{
+    tcg_gen_xori_i32(ret, arg, -1);
+}
+
+static inline void tcg_gen_not_i64(TCGv ret, TCGv arg)
+{
+    tcg_gen_xori_i64(ret, arg, -1);
+}
+
+static inline void tcg_gen_discard_i32(TCGv arg)
+{
+    tcg_gen_op1(INDEX_op_discard, arg);
+}
+
+#if TCG_TARGET_REG_BITS == 32
+static inline void tcg_gen_discard_i64(TCGv arg)
+{
+    tcg_gen_discard_i32(arg);
+    tcg_gen_discard_i32(TCGV_HIGH(arg));
+}
+#else
+static inline void tcg_gen_discard_i64(TCGv arg)
+{
+    tcg_gen_op1(INDEX_op_discard, arg);
+}
+#endif
+
+/***************************************/
+/* QEMU specific operations. Their type depend on the QEMU CPU
+   type. */
+#ifndef TARGET_LONG_BITS
+#error must include QEMU headers
+#endif
+
+/* debug info: write the PC of the corresponding QEMU CPU instruction */
+static inline void tcg_gen_debug_insn_start(uint64_t pc)
+{
+    /* XXX: must really use a 32 bit size for TCGArg in all cases */
+#if TARGET_LONG_BITS > TCG_TARGET_REG_BITS
+    tcg_gen_op2ii(INDEX_op_debug_insn_start, 
+                  (uint32_t)(pc), (uint32_t)(pc >> 32));
+#else
+    tcg_gen_op1i(INDEX_op_debug_insn_start, pc);
+#endif
+}
+
+static inline void tcg_gen_exit_tb(tcg_target_long val)
+{
+    tcg_gen_op1i(INDEX_op_exit_tb, val);
+}
+
+static inline void tcg_gen_goto_tb(int idx)
+{
+    tcg_gen_op1i(INDEX_op_goto_tb, idx);
+}
+
+#if TCG_TARGET_REG_BITS == 32
+static inline void tcg_gen_qemu_ld8u(TCGv ret, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op3i(INDEX_op_qemu_ld8u, ret, addr, mem_index);
+#else
+    tcg_gen_op4i(INDEX_op_qemu_ld8u, ret, addr, TCGV_HIGH(addr), mem_index);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+#endif
+}
+
+static inline void tcg_gen_qemu_ld8s(TCGv ret, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op3i(INDEX_op_qemu_ld8s, ret, addr, mem_index);
+#else
+    tcg_gen_op4i(INDEX_op_qemu_ld8s, ret, addr, TCGV_HIGH(addr), mem_index);
+    tcg_gen_sari_i32(TCGV_HIGH(ret), ret, 31);
+#endif
+}
+
+static inline void tcg_gen_qemu_ld16u(TCGv ret, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op3i(INDEX_op_qemu_ld16u, ret, addr, mem_index);
+#else
+    tcg_gen_op4i(INDEX_op_qemu_ld16u, ret, addr, TCGV_HIGH(addr), mem_index);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+#endif
+}
+
+static inline void tcg_gen_qemu_ld16s(TCGv ret, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op3i(INDEX_op_qemu_ld16s, ret, addr, mem_index);
+#else
+    tcg_gen_op4i(INDEX_op_qemu_ld16s, ret, addr, TCGV_HIGH(addr), mem_index);
+    tcg_gen_sari_i32(TCGV_HIGH(ret), ret, 31);
+#endif
+}
+
+static inline void tcg_gen_qemu_ld32u(TCGv ret, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op3i(INDEX_op_qemu_ld32u, ret, addr, mem_index);
+#else
+    tcg_gen_op4i(INDEX_op_qemu_ld32u, ret, addr, TCGV_HIGH(addr), mem_index);
+    tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+#endif
+}
+
+static inline void tcg_gen_qemu_ld32s(TCGv ret, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op3i(INDEX_op_qemu_ld32u, ret, addr, mem_index);
+#else
+    tcg_gen_op4i(INDEX_op_qemu_ld32u, ret, addr, TCGV_HIGH(addr), mem_index);
+    tcg_gen_sari_i32(TCGV_HIGH(ret), ret, 31);
+#endif
+}
+
+static inline void tcg_gen_qemu_ld64(TCGv ret, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op4i(INDEX_op_qemu_ld64, ret, TCGV_HIGH(ret), addr, mem_index);
+#else
+    tcg_gen_op5i(INDEX_op_qemu_ld64, ret, TCGV_HIGH(ret),
+                 addr, TCGV_HIGH(addr), mem_index);
+#endif
+}
+
+static inline void tcg_gen_qemu_st8(TCGv arg, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op3i(INDEX_op_qemu_st8, arg, addr, mem_index);
+#else
+    tcg_gen_op4i(INDEX_op_qemu_st8, arg, addr, TCGV_HIGH(addr), mem_index);
+#endif
+}
+
+static inline void tcg_gen_qemu_st16(TCGv arg, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op3i(INDEX_op_qemu_st16, arg, addr, mem_index);
+#else
+    tcg_gen_op4i(INDEX_op_qemu_st16, arg, addr, TCGV_HIGH(addr), mem_index);
+#endif
+}
+
+static inline void tcg_gen_qemu_st32(TCGv arg, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op3i(INDEX_op_qemu_st32, arg, addr, mem_index);
+#else
+    tcg_gen_op4i(INDEX_op_qemu_st32, arg, addr, TCGV_HIGH(addr), mem_index);
+#endif
+}
+
+static inline void tcg_gen_qemu_st64(TCGv arg, TCGv addr, int mem_index)
+{
+#if TARGET_LONG_BITS == 32
+    tcg_gen_op4i(INDEX_op_qemu_st64, arg, TCGV_HIGH(arg), addr, mem_index);
+#else
+    tcg_gen_op5i(INDEX_op_qemu_st64, arg, TCGV_HIGH(arg),
+                 addr, TCGV_HIGH(addr), mem_index);
+#endif
+}
+
+#define tcg_gen_ld_ptr tcg_gen_ld_i32
+#define tcg_gen_discard_ptr tcg_gen_discard_i32
+
+#else /* TCG_TARGET_REG_BITS == 32 */
+
+static inline void tcg_gen_qemu_ld8u(TCGv ret, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_ld8u, ret, addr, mem_index);
+}
+
+static inline void tcg_gen_qemu_ld8s(TCGv ret, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_ld8s, ret, addr, mem_index);
+}
+
+static inline void tcg_gen_qemu_ld16u(TCGv ret, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_ld16u, ret, addr, mem_index);
+}
+
+static inline void tcg_gen_qemu_ld16s(TCGv ret, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_ld16s, ret, addr, mem_index);
+}
+
+static inline void tcg_gen_qemu_ld32u(TCGv ret, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_ld32u, ret, addr, mem_index);
+}
+
+static inline void tcg_gen_qemu_ld32s(TCGv ret, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_ld32s, ret, addr, mem_index);
+}
+
+static inline void tcg_gen_qemu_ld64(TCGv ret, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_ld64, ret, addr, mem_index);
+}
+
+static inline void tcg_gen_qemu_st8(TCGv arg, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_st8, arg, addr, mem_index);
+}
+
+static inline void tcg_gen_qemu_st16(TCGv arg, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_st16, arg, addr, mem_index);
+}
+
+static inline void tcg_gen_qemu_st32(TCGv arg, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_st32, arg, addr, mem_index);
+}
+
+static inline void tcg_gen_qemu_st64(TCGv arg, TCGv addr, int mem_index)
+{
+    tcg_gen_op3i(INDEX_op_qemu_st64, arg, addr, mem_index);
+}
+
+#define tcg_gen_ld_ptr tcg_gen_ld_i64
+#define tcg_gen_discard_ptr tcg_gen_discard_i64
+
+#endif /* TCG_TARGET_REG_BITS != 32 */
+
+#if TARGET_LONG_BITS == 64
+#define TCG_TYPE_TL TCG_TYPE_I64
+#define tcg_gen_movi_tl tcg_gen_movi_i64
+#define tcg_gen_mov_tl tcg_gen_mov_i64
+#define tcg_gen_ld8u_tl tcg_gen_ld8u_i64
+#define tcg_gen_ld8s_tl tcg_gen_ld8s_i64
+#define tcg_gen_ld16u_tl tcg_gen_ld16u_i64
+#define tcg_gen_ld16s_tl tcg_gen_ld16s_i64
+#define tcg_gen_ld32u_tl tcg_gen_ld32u_i64
+#define tcg_gen_ld32s_tl tcg_gen_ld32s_i64
+#define tcg_gen_ld_tl tcg_gen_ld_i64
+#define tcg_gen_st8_tl tcg_gen_st8_i64
+#define tcg_gen_st16_tl tcg_gen_st16_i64
+#define tcg_gen_st32_tl tcg_gen_st32_i64
+#define tcg_gen_st_tl tcg_gen_st_i64
+#define tcg_gen_add_tl tcg_gen_add_i64
+#define tcg_gen_addi_tl tcg_gen_addi_i64
+#define tcg_gen_sub_tl tcg_gen_sub_i64
+#define tcg_gen_neg_tl tcg_gen_neg_i64
+#define tcg_gen_subi_tl tcg_gen_subi_i64
+#define tcg_gen_and_tl tcg_gen_and_i64
+#define tcg_gen_andi_tl tcg_gen_andi_i64
+#define tcg_gen_or_tl tcg_gen_or_i64
+#define tcg_gen_ori_tl tcg_gen_ori_i64
+#define tcg_gen_xor_tl tcg_gen_xor_i64
+#define tcg_gen_xori_tl tcg_gen_xori_i64
+#define tcg_gen_not_tl tcg_gen_not_i64
+#define tcg_gen_shl_tl tcg_gen_shl_i64
+#define tcg_gen_shli_tl tcg_gen_shli_i64
+#define tcg_gen_shr_tl tcg_gen_shr_i64
+#define tcg_gen_shri_tl tcg_gen_shri_i64
+#define tcg_gen_sar_tl tcg_gen_sar_i64
+#define tcg_gen_sari_tl tcg_gen_sari_i64
+#define tcg_gen_brcond_tl tcg_gen_brcond_i64
+#define tcg_gen_brcondi_tl tcg_gen_brcondi_i64
+#define tcg_gen_mul_tl tcg_gen_mul_i64
+#define tcg_gen_muli_tl tcg_gen_muli_i64
+#define tcg_gen_discard_tl tcg_gen_discard_i64
+#define tcg_gen_trunc_tl_i32 tcg_gen_trunc_i64_i32
+#define tcg_gen_trunc_i64_tl tcg_gen_mov_i64
+#define tcg_gen_extu_i32_tl tcg_gen_extu_i32_i64
+#define tcg_gen_ext_i32_tl tcg_gen_ext_i32_i64
+#define tcg_gen_extu_tl_i64 tcg_gen_mov_i64
+#define tcg_gen_ext_tl_i64 tcg_gen_mov_i64
+#define tcg_gen_ext8u_tl tcg_gen_ext8u_i64
+#define tcg_gen_ext8s_tl tcg_gen_ext8s_i64
+#define tcg_gen_ext16u_tl tcg_gen_ext16u_i64
+#define tcg_gen_ext16s_tl tcg_gen_ext16s_i64
+#define tcg_gen_ext32u_tl tcg_gen_ext32u_i64
+#define tcg_gen_ext32s_tl tcg_gen_ext32s_i64
+#define tcg_const_tl tcg_const_i64
+#else
+#define TCG_TYPE_TL TCG_TYPE_I32
+#define tcg_gen_movi_tl tcg_gen_movi_i32
+#define tcg_gen_mov_tl tcg_gen_mov_i32
+#define tcg_gen_ld8u_tl tcg_gen_ld8u_i32
+#define tcg_gen_ld8s_tl tcg_gen_ld8s_i32
+#define tcg_gen_ld16u_tl tcg_gen_ld16u_i32
+#define tcg_gen_ld16s_tl tcg_gen_ld16s_i32
+#define tcg_gen_ld32u_tl tcg_gen_ld_i32
+#define tcg_gen_ld32s_tl tcg_gen_ld_i32
+#define tcg_gen_ld_tl tcg_gen_ld_i32
+#define tcg_gen_st8_tl tcg_gen_st8_i32
+#define tcg_gen_st16_tl tcg_gen_st16_i32
+#define tcg_gen_st32_tl tcg_gen_st_i32
+#define tcg_gen_st_tl tcg_gen_st_i32
+#define tcg_gen_add_tl tcg_gen_add_i32
+#define tcg_gen_addi_tl tcg_gen_addi_i32
+#define tcg_gen_sub_tl tcg_gen_sub_i32
+#define tcg_gen_neg_tl tcg_gen_neg_i32
+#define tcg_gen_subi_tl tcg_gen_subi_i32
+#define tcg_gen_and_tl tcg_gen_and_i32
+#define tcg_gen_andi_tl tcg_gen_andi_i32
+#define tcg_gen_or_tl tcg_gen_or_i32
+#define tcg_gen_ori_tl tcg_gen_ori_i32
+#define tcg_gen_xor_tl tcg_gen_xor_i32
+#define tcg_gen_xori_tl tcg_gen_xori_i32
+#define tcg_gen_not_tl tcg_gen_not_i32
+#define tcg_gen_shl_tl tcg_gen_shl_i32
+#define tcg_gen_shli_tl tcg_gen_shli_i32
+#define tcg_gen_shr_tl tcg_gen_shr_i32
+#define tcg_gen_shri_tl tcg_gen_shri_i32
+#define tcg_gen_sar_tl tcg_gen_sar_i32
+#define tcg_gen_sari_tl tcg_gen_sari_i32
+#define tcg_gen_brcond_tl tcg_gen_brcond_i32
+#define tcg_gen_brcondi_tl tcg_gen_brcondi_i32
+#define tcg_gen_mul_tl tcg_gen_mul_i32
+#define tcg_gen_muli_tl tcg_gen_muli_i32
+#define tcg_gen_discard_tl tcg_gen_discard_i32
+#define tcg_gen_trunc_tl_i32 tcg_gen_mov_i32
+#define tcg_gen_trunc_i64_tl tcg_gen_trunc_i64_i32
+#define tcg_gen_extu_i32_tl tcg_gen_mov_i32
+#define tcg_gen_ext_i32_tl tcg_gen_mov_i32
+#define tcg_gen_extu_tl_i64 tcg_gen_extu_i32_i64
+#define tcg_gen_ext_tl_i64 tcg_gen_ext_i32_i64
+#define tcg_gen_ext8u_tl tcg_gen_ext8u_i32
+#define tcg_gen_ext8s_tl tcg_gen_ext8s_i32
+#define tcg_gen_ext16u_tl tcg_gen_ext16u_i32
+#define tcg_gen_ext16s_tl tcg_gen_ext16s_i32
+#define tcg_gen_ext32u_tl tcg_gen_mov_i32
+#define tcg_gen_ext32s_tl tcg_gen_mov_i32
+#define tcg_const_tl tcg_const_i32
+#endif
+
+#if TCG_TARGET_REG_BITS == 32
+#define tcg_gen_add_ptr tcg_gen_add_i32
+#define tcg_gen_addi_ptr tcg_gen_addi_i32
+#define tcg_gen_ext_i32_ptr tcg_gen_mov_i32
+#else /* TCG_TARGET_REG_BITS == 32 */
+#define tcg_gen_add_ptr tcg_gen_add_i64
+#define tcg_gen_addi_ptr tcg_gen_addi_i64
+#define tcg_gen_ext_i32_ptr tcg_gen_ext_i32_i64
+#endif /* TCG_TARGET_REG_BITS != 32 */
+
diff --git a/tcg/tcg-opc.h b/tcg/tcg-opc.h
new file mode 100644
index 0000000..31ae550
--- /dev/null
+++ b/tcg/tcg-opc.h
@@ -0,0 +1,238 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#ifdef CONFIG_DYNGEN_OP
+#include "dyngen-opc.h"
+#endif
+
+#ifndef DEF2
+#define DEF2(name, oargs, iargs, cargs, flags) DEF(name, oargs + iargs + cargs, 0)
+#endif
+
+/* predefined ops */
+DEF2(end, 0, 0, 0, 0) /* must be kept first */
+DEF2(nop, 0, 0, 0, 0)
+DEF2(nop1, 0, 0, 1, 0)
+DEF2(nop2, 0, 0, 2, 0)
+DEF2(nop3, 0, 0, 3, 0)
+DEF2(nopn, 0, 0, 1, 0) /* variable number of parameters */
+
+DEF2(discard, 1, 0, 0, 0)
+
+DEF2(set_label, 0, 0, 1, 0)
+DEF2(call, 0, 1, 2, TCG_OPF_SIDE_EFFECTS) /* variable number of parameters */
+DEF2(jmp, 0, 1, 0, TCG_OPF_BB_END | TCG_OPF_SIDE_EFFECTS)
+DEF2(br, 0, 0, 1, TCG_OPF_BB_END | TCG_OPF_SIDE_EFFECTS)
+
+DEF2(mov_i32, 1, 1, 0, 0)
+DEF2(movi_i32, 1, 0, 1, 0)
+/* load/store */
+DEF2(ld8u_i32, 1, 1, 1, 0)
+DEF2(ld8s_i32, 1, 1, 1, 0)
+DEF2(ld16u_i32, 1, 1, 1, 0)
+DEF2(ld16s_i32, 1, 1, 1, 0)
+DEF2(ld_i32, 1, 1, 1, 0)
+DEF2(st8_i32, 0, 2, 1, TCG_OPF_SIDE_EFFECTS)
+DEF2(st16_i32, 0, 2, 1, TCG_OPF_SIDE_EFFECTS)
+DEF2(st_i32, 0, 2, 1, TCG_OPF_SIDE_EFFECTS)
+/* arith */
+DEF2(add_i32, 1, 2, 0, 0)
+DEF2(sub_i32, 1, 2, 0, 0)
+DEF2(mul_i32, 1, 2, 0, 0)
+#ifdef TCG_TARGET_HAS_div_i32
+DEF2(div_i32, 1, 2, 0, 0)
+DEF2(divu_i32, 1, 2, 0, 0)
+DEF2(rem_i32, 1, 2, 0, 0)
+DEF2(remu_i32, 1, 2, 0, 0)
+#else
+DEF2(div2_i32, 2, 3, 0, 0)
+DEF2(divu2_i32, 2, 3, 0, 0)
+#endif
+DEF2(and_i32, 1, 2, 0, 0)
+DEF2(or_i32, 1, 2, 0, 0)
+DEF2(xor_i32, 1, 2, 0, 0)
+/* shifts */
+DEF2(shl_i32, 1, 2, 0, 0)
+DEF2(shr_i32, 1, 2, 0, 0)
+DEF2(sar_i32, 1, 2, 0, 0)
+
+DEF2(brcond_i32, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_SIDE_EFFECTS)
+#if TCG_TARGET_REG_BITS == 32
+DEF2(add2_i32, 2, 4, 0, 0)
+DEF2(sub2_i32, 2, 4, 0, 0)
+DEF2(brcond2_i32, 0, 4, 2, TCG_OPF_BB_END | TCG_OPF_SIDE_EFFECTS)
+DEF2(mulu2_i32, 2, 2, 0, 0)
+#endif
+#ifdef TCG_TARGET_HAS_ext8s_i32
+DEF2(ext8s_i32, 1, 1, 0, 0)
+#endif
+#ifdef TCG_TARGET_HAS_ext16s_i32
+DEF2(ext16s_i32, 1, 1, 0, 0)
+#endif
+#ifdef TCG_TARGET_HAS_bswap_i32
+DEF2(bswap_i32, 1, 1, 0, 0)
+#endif
+
+#if TCG_TARGET_REG_BITS == 64
+DEF2(mov_i64, 1, 1, 0, 0)
+DEF2(movi_i64, 1, 0, 1, 0)
+/* load/store */
+DEF2(ld8u_i64, 1, 1, 1, 0)
+DEF2(ld8s_i64, 1, 1, 1, 0)
+DEF2(ld16u_i64, 1, 1, 1, 0)
+DEF2(ld16s_i64, 1, 1, 1, 0)
+DEF2(ld32u_i64, 1, 1, 1, 0)
+DEF2(ld32s_i64, 1, 1, 1, 0)
+DEF2(ld_i64, 1, 1, 1, 0)
+DEF2(st8_i64, 0, 2, 1, TCG_OPF_SIDE_EFFECTS)
+DEF2(st16_i64, 0, 2, 1, TCG_OPF_SIDE_EFFECTS)
+DEF2(st32_i64, 0, 2, 1, TCG_OPF_SIDE_EFFECTS)
+DEF2(st_i64, 0, 2, 1, TCG_OPF_SIDE_EFFECTS)
+/* arith */
+DEF2(add_i64, 1, 2, 0, 0)
+DEF2(sub_i64, 1, 2, 0, 0)
+DEF2(mul_i64, 1, 2, 0, 0)
+#ifdef TCG_TARGET_HAS_div_i64
+DEF2(div_i64, 1, 2, 0, 0)
+DEF2(divu_i64, 1, 2, 0, 0)
+DEF2(rem_i64, 1, 2, 0, 0)
+DEF2(remu_i64, 1, 2, 0, 0)
+#else
+DEF2(div2_i64, 2, 3, 0, 0)
+DEF2(divu2_i64, 2, 3, 0, 0)
+#endif
+DEF2(and_i64, 1, 2, 0, 0)
+DEF2(or_i64, 1, 2, 0, 0)
+DEF2(xor_i64, 1, 2, 0, 0)
+/* shifts */
+DEF2(shl_i64, 1, 2, 0, 0)
+DEF2(shr_i64, 1, 2, 0, 0)
+DEF2(sar_i64, 1, 2, 0, 0)
+
+DEF2(brcond_i64, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_SIDE_EFFECTS)
+#ifdef TCG_TARGET_HAS_ext8s_i64
+DEF2(ext8s_i64, 1, 1, 0, 0)
+#endif
+#ifdef TCG_TARGET_HAS_ext16s_i64
+DEF2(ext16s_i64, 1, 1, 0, 0)
+#endif
+#ifdef TCG_TARGET_HAS_ext32s_i64
+DEF2(ext32s_i64, 1, 1, 0, 0)
+#endif
+#ifdef TCG_TARGET_HAS_bswap_i64
+DEF2(bswap_i64, 1, 1, 0, 0)
+#endif
+#endif
+#ifdef TCG_TARGET_HAS_neg_i32
+DEF2(neg_i32, 1, 1, 0, 0)
+#endif
+#ifdef TCG_TARGET_HAS_neg_i64
+DEF2(neg_i64, 1, 1, 0, 0)
+#endif
+
+/* QEMU specific */
+#if TARGET_LONG_BITS > TCG_TARGET_REG_BITS
+DEF2(debug_insn_start, 0, 0, 2, 0)
+#else
+DEF2(debug_insn_start, 0, 0, 1, 0)
+#endif
+DEF2(exit_tb, 0, 0, 1, TCG_OPF_BB_END | TCG_OPF_SIDE_EFFECTS)
+DEF2(goto_tb, 0, 0, 1, TCG_OPF_BB_END | TCG_OPF_SIDE_EFFECTS)
+/* Note: even if TARGET_LONG_BITS is not defined, the INDEX_op
+   constants must be defined */
+#if TCG_TARGET_REG_BITS == 32
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_ld8u, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_ld8u, 1, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_ld8s, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_ld8s, 1, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_ld16u, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_ld16u, 1, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_ld16s, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_ld16s, 1, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_ld32u, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_ld32u, 1, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_ld32s, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_ld32s, 1, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_ld64, 2, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_ld64, 2, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_st8, 0, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_st8, 0, 3, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_st16, 0, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_st16, 0, 3, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_st32, 0, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_st32, 0, 3, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+#if TARGET_LONG_BITS == 32
+DEF2(qemu_st64, 0, 3, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#else
+DEF2(qemu_st64, 0, 4, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+#endif
+
+#else /* TCG_TARGET_REG_BITS == 32 */
+
+DEF2(qemu_ld8u, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+DEF2(qemu_ld8s, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+DEF2(qemu_ld16u, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+DEF2(qemu_ld16s, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+DEF2(qemu_ld32u, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+DEF2(qemu_ld32s, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+DEF2(qemu_ld64, 1, 1, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+
+DEF2(qemu_st8, 0, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+DEF2(qemu_st16, 0, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+DEF2(qemu_st32, 0, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+DEF2(qemu_st64, 0, 2, 1, TCG_OPF_CALL_CLOBBER | TCG_OPF_SIDE_EFFECTS)
+
+#endif /* TCG_TARGET_REG_BITS != 32 */
+
+#undef DEF2
diff --git a/tcg/tcg-runtime.c b/tcg/tcg-runtime.c
new file mode 100644
index 0000000..575da43
--- /dev/null
+++ b/tcg/tcg-runtime.c
@@ -0,0 +1,68 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+
+#include "config.h"
+#include "osdep.h"
+#include "tcg.h"
+
+int64_t tcg_helper_shl_i64(int64_t arg1, int64_t arg2)
+{
+    return arg1 << arg2;
+}
+
+int64_t tcg_helper_shr_i64(int64_t arg1, int64_t arg2)
+{
+    return (uint64_t)arg1 >> arg2;
+}
+
+int64_t tcg_helper_sar_i64(int64_t arg1, int64_t arg2)
+{
+    return arg1 >> arg2;
+}
+
+int64_t tcg_helper_div_i64(int64_t arg1, int64_t arg2)
+{
+    return arg1 / arg2;
+}
+
+int64_t tcg_helper_rem_i64(int64_t arg1, int64_t arg2)
+{
+    return arg1 % arg2;
+}
+
+uint64_t tcg_helper_divu_i64(uint64_t arg1, uint64_t arg2)
+{
+    return arg1 / arg2;
+}
+
+uint64_t tcg_helper_remu_i64(uint64_t arg1, uint64_t arg2)
+{
+    return arg1 % arg2;
+}
+
diff --git a/tcg/tcg.c b/tcg/tcg.c
new file mode 100644
index 0000000..1b7bf5c
--- /dev/null
+++ b/tcg/tcg.c
@@ -0,0 +1,2081 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+/* define it to suppress various consistency checks (faster) */
+#define NDEBUG
+
+/* define it to use liveness analysis (better code) */
+#define USE_LIVENESS_ANALYSIS
+
+#include <assert.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+#ifdef _WIN32
+#include <malloc.h>
+#endif
+
+#include "config.h"
+#include "qemu-common.h"
+
+/* Note: the long term plan is to reduce the dependancies on the QEMU
+   CPU definitions. Currently they are used for qemu_ld/st
+   instructions */
+#define NO_CPU_IO_DEFS
+#include "cpu.h"
+#include "exec-all.h"
+
+#include "tcg-op.h"
+#include "elf.h"
+
+
+static void patch_reloc(uint8_t *code_ptr, int type, 
+                        tcg_target_long value, tcg_target_long addend);
+
+TCGOpDef tcg_op_defs[] = {
+#define DEF(s, n, copy_size) { #s, 0, 0, n, n, 0, copy_size },
+#define DEF2(s, iargs, oargs, cargs, flags) { #s, iargs, oargs, cargs, iargs + oargs + cargs, flags, 0 },
+#include "tcg-opc.h"
+#undef DEF
+#undef DEF2
+};
+
+TCGRegSet tcg_target_available_regs[2];
+TCGRegSet tcg_target_call_clobber_regs;
+
+/* XXX: move that inside the context */
+uint16_t *gen_opc_ptr;
+TCGArg *gen_opparam_ptr;
+
+static inline void tcg_out8(TCGContext *s, uint8_t v)
+{
+    *s->code_ptr++ = v;
+}
+
+static inline void tcg_out16(TCGContext *s, uint16_t v)
+{
+    *(uint16_t *)s->code_ptr = v;
+    s->code_ptr += 2;
+}
+
+static inline void tcg_out32(TCGContext *s, uint32_t v)
+{
+    *(uint32_t *)s->code_ptr = v;
+    s->code_ptr += 4;
+}
+
+/* label relocation processing */
+
+void tcg_out_reloc(TCGContext *s, uint8_t *code_ptr, int type, 
+                   int label_index, long addend)
+{
+    TCGLabel *l;
+    TCGRelocation *r;
+
+    l = &s->labels[label_index];
+    if (l->has_value) {
+        /* FIXME: This may break relocations on RISC targets that
+           modify instruction fields in place.  The caller may not have 
+           written the initial value.  */
+        patch_reloc(code_ptr, type, l->u.value, addend);
+    } else {
+        /* add a new relocation entry */
+        r = tcg_malloc(sizeof(TCGRelocation));
+        r->type = type;
+        r->ptr = code_ptr;
+        r->addend = addend;
+        r->next = l->u.first_reloc;
+        l->u.first_reloc = r;
+    }
+}
+
+static void tcg_out_label(TCGContext *s, int label_index, 
+                          tcg_target_long value)
+{
+    TCGLabel *l;
+    TCGRelocation *r;
+
+    l = &s->labels[label_index];
+    if (l->has_value)
+        tcg_abort();
+    r = l->u.first_reloc;
+    while (r != NULL) {
+        patch_reloc(r->ptr, r->type, value, r->addend);
+        r = r->next;
+    }
+    l->has_value = 1;
+    l->u.value = value;
+}
+
+int gen_new_label(void)
+{
+    TCGContext *s = &tcg_ctx;
+    int idx;
+    TCGLabel *l;
+
+    if (s->nb_labels >= TCG_MAX_LABELS)
+        tcg_abort();
+    idx = s->nb_labels++;
+    l = &s->labels[idx];
+    l->has_value = 0;
+    l->u.first_reloc = NULL;
+    return idx;
+}
+
+#include "tcg-target.c"
+
+/* pool based memory allocation */
+void *tcg_malloc_internal(TCGContext *s, int size)
+{
+    TCGPool *p;
+    int pool_size;
+    
+    if (size > TCG_POOL_CHUNK_SIZE) {
+        /* big malloc: insert a new pool (XXX: could optimize) */
+        p = qemu_malloc(sizeof(TCGPool) + size);
+        p->size = size;
+        if (s->pool_current)
+            s->pool_current->next = p;
+        else
+            s->pool_first = p;
+        p->next = s->pool_current;
+    } else {
+        p = s->pool_current;
+        if (!p) {
+            p = s->pool_first;
+            if (!p)
+                goto new_pool;
+        } else {
+            if (!p->next) {
+            new_pool:
+                pool_size = TCG_POOL_CHUNK_SIZE;
+                p = qemu_malloc(sizeof(TCGPool) + pool_size);
+                p->size = pool_size;
+                p->next = NULL;
+                if (s->pool_current) 
+                    s->pool_current->next = p;
+                else
+                    s->pool_first = p;
+            } else {
+                p = p->next;
+            }
+        }
+    }
+    s->pool_current = p;
+    s->pool_cur = p->data + size;
+    s->pool_end = p->data + p->size;
+    return p->data;
+}
+
+void tcg_pool_reset(TCGContext *s)
+{
+    s->pool_cur = s->pool_end = NULL;
+    s->pool_current = NULL;
+}
+
+void tcg_context_init(TCGContext *s)
+{
+    int op, total_args, n;
+    TCGOpDef *def;
+    TCGArgConstraint *args_ct;
+    int *sorted_args;
+
+    memset(s, 0, sizeof(*s));
+    s->temps = s->static_temps;
+    s->nb_globals = 0;
+    
+    /* Count total number of arguments and allocate the corresponding
+       space */
+    total_args = 0;
+    for(op = 0; op < NB_OPS; op++) {
+        def = &tcg_op_defs[op];
+        n = def->nb_iargs + def->nb_oargs;
+        total_args += n;
+    }
+
+    args_ct = qemu_malloc(sizeof(TCGArgConstraint) * total_args);
+    sorted_args = qemu_malloc(sizeof(int) * total_args);
+
+    for(op = 0; op < NB_OPS; op++) {
+        def = &tcg_op_defs[op];
+        def->args_ct = args_ct;
+        def->sorted_args = sorted_args;
+        n = def->nb_iargs + def->nb_oargs;
+        sorted_args += n;
+        args_ct += n;
+    }
+    
+    tcg_target_init(s);
+
+    /* init global prologue and epilogue */
+    s->code_buf = code_gen_prologue;
+    s->code_ptr = s->code_buf;
+    tcg_target_qemu_prologue(s);
+    flush_icache_range((unsigned long)s->code_buf, 
+                       (unsigned long)s->code_ptr);
+}
+
+void tcg_set_frame(TCGContext *s, int reg,
+                   tcg_target_long start, tcg_target_long size)
+{
+    s->frame_start = start;
+    s->frame_end = start + size;
+    s->frame_reg = reg;
+}
+
+void tcg_func_start(TCGContext *s)
+{
+    int i;
+    tcg_pool_reset(s);
+    s->nb_temps = s->nb_globals;
+    for(i = 0; i < (TCG_TYPE_COUNT * 2); i++)
+        s->first_free_temp[i] = -1;
+    s->labels = tcg_malloc(sizeof(TCGLabel) * TCG_MAX_LABELS);
+    s->nb_labels = 0;
+    s->current_frame_offset = s->frame_start;
+
+    gen_opc_ptr = gen_opc_buf;
+    gen_opparam_ptr = gen_opparam_buf;
+}
+
+static inline void tcg_temp_alloc(TCGContext *s, int n)
+{
+    if (n > TCG_MAX_TEMPS)
+        tcg_abort();
+}
+
+TCGv tcg_global_reg_new(TCGType type, int reg, const char *name)
+{
+    TCGContext *s = &tcg_ctx;
+    TCGTemp *ts;
+    int idx;
+
+#if TCG_TARGET_REG_BITS == 32
+    if (type != TCG_TYPE_I32)
+        tcg_abort();
+#endif
+    if (tcg_regset_test_reg(s->reserved_regs, reg))
+        tcg_abort();
+    idx = s->nb_globals;
+    tcg_temp_alloc(s, s->nb_globals + 1);
+    ts = &s->temps[s->nb_globals];
+    ts->base_type = type;
+    ts->type = type;
+    ts->fixed_reg = 1;
+    ts->reg = reg;
+    ts->name = name;
+    s->nb_globals++;
+    tcg_regset_set_reg(s->reserved_regs, reg);
+    return MAKE_TCGV(idx);
+}
+
+#if TCG_TARGET_REG_BITS == 32
+/* temporary hack to avoid register shortage for tcg_qemu_st64() */
+TCGv tcg_global_reg2_new_hack(TCGType type, int reg1, int reg2, 
+                              const char *name)
+{
+    TCGContext *s = &tcg_ctx;
+    TCGTemp *ts;
+    int idx;
+    char buf[64];
+
+    if (type != TCG_TYPE_I64)
+        tcg_abort();
+    idx = s->nb_globals;
+    tcg_temp_alloc(s, s->nb_globals + 2);
+    ts = &s->temps[s->nb_globals];
+    ts->base_type = type;
+    ts->type = TCG_TYPE_I32;
+    ts->fixed_reg = 1;
+    ts->reg = reg1;
+    pstrcpy(buf, sizeof(buf), name);
+    pstrcat(buf, sizeof(buf), "_0");
+    ts->name = strdup(buf);
+
+    ts++;
+    ts->base_type = type;
+    ts->type = TCG_TYPE_I32;
+    ts->fixed_reg = 1;
+    ts->reg = reg2;
+    pstrcpy(buf, sizeof(buf), name);
+    pstrcat(buf, sizeof(buf), "_1");
+    ts->name = strdup(buf);
+
+    s->nb_globals += 2;
+    return MAKE_TCGV(idx);
+}
+#endif
+
+TCGv tcg_global_mem_new(TCGType type, int reg, tcg_target_long offset,
+                        const char *name)
+{
+    TCGContext *s = &tcg_ctx;
+    TCGTemp *ts;
+    int idx;
+
+    idx = s->nb_globals;
+#if TCG_TARGET_REG_BITS == 32
+    if (type == TCG_TYPE_I64) {
+        char buf[64];
+        tcg_temp_alloc(s, s->nb_globals + 2);
+        ts = &s->temps[s->nb_globals];
+        ts->base_type = type;
+        ts->type = TCG_TYPE_I32;
+        ts->fixed_reg = 0;
+        ts->mem_allocated = 1;
+        ts->mem_reg = reg;
+#ifdef TCG_TARGET_WORDS_BIGENDIAN
+        ts->mem_offset = offset + 4;
+#else
+        ts->mem_offset = offset;
+#endif
+        pstrcpy(buf, sizeof(buf), name);
+        pstrcat(buf, sizeof(buf), "_0");
+        ts->name = strdup(buf);
+        ts++;
+
+        ts->base_type = type;
+        ts->type = TCG_TYPE_I32;
+        ts->fixed_reg = 0;
+        ts->mem_allocated = 1;
+        ts->mem_reg = reg;
+#ifdef TCG_TARGET_WORDS_BIGENDIAN
+        ts->mem_offset = offset;
+#else
+        ts->mem_offset = offset + 4;
+#endif
+        pstrcpy(buf, sizeof(buf), name);
+        pstrcat(buf, sizeof(buf), "_1");
+        ts->name = strdup(buf);
+
+        s->nb_globals += 2;
+    } else
+#endif
+    {
+        tcg_temp_alloc(s, s->nb_globals + 1);
+        ts = &s->temps[s->nb_globals];
+        ts->base_type = type;
+        ts->type = type;
+        ts->fixed_reg = 0;
+        ts->mem_allocated = 1;
+        ts->mem_reg = reg;
+        ts->mem_offset = offset;
+        ts->name = name;
+        s->nb_globals++;
+    }
+    return MAKE_TCGV(idx);
+}
+
+TCGv tcg_temp_new_internal(TCGType type, int temp_local)
+{
+    TCGContext *s = &tcg_ctx;
+    TCGTemp *ts;
+    int idx, k;
+
+    k = type;
+    if (temp_local)
+        k += TCG_TYPE_COUNT;
+    idx = s->first_free_temp[k];
+    if (idx != -1) {
+        /* There is already an available temp with the
+           right type */
+        ts = &s->temps[idx];
+        s->first_free_temp[k] = ts->next_free_temp;
+        ts->temp_allocated = 1;
+        assert(ts->temp_local == temp_local);
+    } else {
+        idx = s->nb_temps;
+#if TCG_TARGET_REG_BITS == 32
+        if (type == TCG_TYPE_I64) {
+            tcg_temp_alloc(s, s->nb_temps + 2);
+            ts = &s->temps[s->nb_temps];
+            ts->base_type = type;
+            ts->type = TCG_TYPE_I32;
+            ts->temp_allocated = 1;
+            ts->temp_local = temp_local;
+            ts->name = NULL;
+            ts++;
+            ts->base_type = TCG_TYPE_I32;
+            ts->type = TCG_TYPE_I32;
+            ts->temp_allocated = 1;
+            ts->temp_local = temp_local;
+            ts->name = NULL;
+            s->nb_temps += 2;
+        } else
+#endif
+        {
+            tcg_temp_alloc(s, s->nb_temps + 1);
+            ts = &s->temps[s->nb_temps];
+            ts->base_type = type;
+            ts->type = type;
+            ts->temp_allocated = 1;
+            ts->temp_local = temp_local;
+            ts->name = NULL;
+            s->nb_temps++;
+        }
+    }
+    return MAKE_TCGV(idx);
+}
+
+void tcg_temp_free(TCGv arg)
+{
+    TCGContext *s = &tcg_ctx;
+    TCGTemp *ts;
+    int idx = GET_TCGV(arg);
+    int k;
+
+    assert(idx >= s->nb_globals && idx < s->nb_temps);
+    ts = &s->temps[idx];
+    assert(ts->temp_allocated != 0);
+    ts->temp_allocated = 0;
+    k = ts->base_type;
+    if (ts->temp_local)
+        k += TCG_TYPE_COUNT;
+    ts->next_free_temp = s->first_free_temp[k];
+    s->first_free_temp[k] = idx;
+}
+
+
+TCGv tcg_const_i32(int32_t val)
+{
+    TCGv t0;
+    t0 = tcg_temp_new(TCG_TYPE_I32);
+    tcg_gen_movi_i32(t0, val);
+    return t0;
+}
+
+TCGv tcg_const_i64(int64_t val)
+{
+    TCGv t0;
+    t0 = tcg_temp_new(TCG_TYPE_I64);
+    tcg_gen_movi_i64(t0, val);
+    return t0;
+}
+
+void tcg_register_helper(void *func, const char *name)
+{
+    TCGContext *s = &tcg_ctx;
+    int n;
+    if ((s->nb_helpers + 1) > s->allocated_helpers) {
+        n = s->allocated_helpers;
+        if (n == 0) {
+            n = 4;
+        } else {
+            n *= 2;
+        }
+        s->helpers = realloc(s->helpers, n * sizeof(TCGHelperInfo));
+        s->allocated_helpers = n;
+    }
+    s->helpers[s->nb_helpers].func = (tcg_target_ulong)func;
+    s->helpers[s->nb_helpers].name = name;
+    s->nb_helpers++;
+}
+
+static inline TCGType tcg_get_base_type(TCGContext *s, TCGv arg)
+{
+    return s->temps[GET_TCGV(arg)].base_type;
+}
+
+static void tcg_gen_call_internal(TCGContext *s, TCGv func, 
+                                  unsigned int flags,
+                                  unsigned int nb_rets, const TCGv *rets,
+                                  unsigned int nb_params, const TCGv *params)
+{
+    int i;
+    *gen_opc_ptr++ = INDEX_op_call;
+    *gen_opparam_ptr++ = (nb_rets << 16) | (nb_params + 1);
+    for(i = 0; i < nb_rets; i++) {
+        *gen_opparam_ptr++ = GET_TCGV(rets[i]);
+    }
+    for(i = 0; i < nb_params; i++) {
+        *gen_opparam_ptr++ = GET_TCGV(params[i]);
+    }
+    *gen_opparam_ptr++ = GET_TCGV(func);
+
+    *gen_opparam_ptr++ = flags;
+    /* total parameters, needed to go backward in the instruction stream */
+    *gen_opparam_ptr++ = 1 + nb_rets + nb_params + 3;
+}
+
+
+#if TCG_TARGET_REG_BITS < 64
+/* Note: we convert the 64 bit args to 32 bit and do some alignment
+   and endian swap. Maybe it would be better to do the alignment
+   and endian swap in tcg_reg_alloc_call(). */
+void tcg_gen_call(TCGContext *s, TCGv func, unsigned int flags,
+                  unsigned int nb_rets, const TCGv *rets,
+                  unsigned int nb_params, const TCGv *args1)
+{
+    TCGv ret, *args2, rets_2[2], arg;
+    int j, i, call_type;
+
+    if (nb_rets == 1) {
+        ret = rets[0];
+        if (tcg_get_base_type(s, ret) == TCG_TYPE_I64) {
+            nb_rets = 2;
+#ifdef TCG_TARGET_WORDS_BIGENDIAN
+            rets_2[0] = TCGV_HIGH(ret);
+            rets_2[1] = ret;
+#else
+            rets_2[0] = ret;
+            rets_2[1] = TCGV_HIGH(ret);
+#endif
+            rets = rets_2;
+        }
+    }
+    args2 = alloca((nb_params * 3) * sizeof(TCGv));
+    j = 0;
+    call_type = (flags & TCG_CALL_TYPE_MASK);
+    for(i = 0; i < nb_params; i++) {
+        arg = args1[i];
+        if (tcg_get_base_type(s, arg) == TCG_TYPE_I64) {
+#ifdef TCG_TARGET_I386
+            /* REGPARM case: if the third parameter is 64 bit, it is
+               allocated on the stack */
+            if (j == 2 && call_type == TCG_CALL_TYPE_REGPARM) {
+                call_type = TCG_CALL_TYPE_REGPARM_2;
+                flags = (flags & ~TCG_CALL_TYPE_MASK) | call_type;
+            }
+            args2[j++] = arg;
+            args2[j++] = TCGV_HIGH(arg);
+#else
+#ifdef TCG_TARGET_CALL_ALIGN_ARGS
+            /* some targets want aligned 64 bit args */
+            if (j & 1) {
+                args2[j++] = TCG_CALL_DUMMY_ARG;
+            }
+#endif
+#ifdef TCG_TARGET_WORDS_BIGENDIAN
+            args2[j++] = TCGV_HIGH(arg);
+            args2[j++] = arg;
+#else
+            args2[j++] = arg;
+            args2[j++] = TCGV_HIGH(arg);
+#endif
+#endif
+        } else {
+            args2[j++] = arg;
+        }
+    }
+    tcg_gen_call_internal(s, func, flags, 
+                          nb_rets, rets, j, args2);
+}
+#else
+void tcg_gen_call(TCGContext *s, TCGv func, unsigned int flags,
+                  unsigned int nb_rets, const TCGv *rets,
+                  unsigned int nb_params, const TCGv *args1)
+{
+    tcg_gen_call_internal(s, func, flags, 
+                          nb_rets, rets, nb_params, args1);
+}
+#endif
+
+#if TCG_TARGET_REG_BITS == 32
+void tcg_gen_shifti_i64(TCGv ret, TCGv arg1, 
+                        int c, int right, int arith)
+{
+    if (c == 0) {
+        tcg_gen_mov_i32(ret, arg1);
+        tcg_gen_mov_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1));
+    } else if (c >= 32) {
+        c -= 32;
+        if (right) {
+            if (arith) {
+                tcg_gen_sari_i32(ret, TCGV_HIGH(arg1), c);
+                tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), 31);
+            } else {
+                tcg_gen_shri_i32(ret, TCGV_HIGH(arg1), c);
+                tcg_gen_movi_i32(TCGV_HIGH(ret), 0);
+            }
+        } else {
+            tcg_gen_shli_i32(TCGV_HIGH(ret), arg1, c);
+            tcg_gen_movi_i32(ret, 0);
+        }
+    } else {
+        TCGv t0, t1;
+
+        t0 = tcg_temp_new(TCG_TYPE_I32);
+        t1 = tcg_temp_new(TCG_TYPE_I32);
+        if (right) {
+            tcg_gen_shli_i32(t0, TCGV_HIGH(arg1), 32 - c);
+            if (arith)
+                tcg_gen_sari_i32(t1, TCGV_HIGH(arg1), c);
+            else 
+                tcg_gen_shri_i32(t1, TCGV_HIGH(arg1), c);
+            tcg_gen_shri_i32(ret, arg1, c); 
+            tcg_gen_or_i32(ret, ret, t0);
+            tcg_gen_mov_i32(TCGV_HIGH(ret), t1);
+        } else {
+            tcg_gen_shri_i32(t0, arg1, 32 - c);
+            /* Note: ret can be the same as arg1, so we use t1 */
+            tcg_gen_shli_i32(t1, arg1, c); 
+            tcg_gen_shli_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
+            tcg_gen_or_i32(TCGV_HIGH(ret), TCGV_HIGH(ret), t0);
+            tcg_gen_mov_i32(ret, t1);
+        }
+        tcg_temp_free(t0);
+        tcg_temp_free(t1);
+    }
+}
+#endif
+
+static void tcg_reg_alloc_start(TCGContext *s)
+{
+    int i;
+    TCGTemp *ts;
+    for(i = 0; i < s->nb_globals; i++) {
+        ts = &s->temps[i];
+        if (ts->fixed_reg) {
+            ts->val_type = TEMP_VAL_REG;
+        } else {
+            ts->val_type = TEMP_VAL_MEM;
+        }
+    }
+    for(i = s->nb_globals; i < s->nb_temps; i++) {
+        ts = &s->temps[i];
+        ts->val_type = TEMP_VAL_DEAD;
+        ts->mem_allocated = 0;
+        ts->fixed_reg = 0;
+    }
+    for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
+        s->reg_to_temp[i] = -1;
+    }
+}
+
+static char *tcg_get_arg_str_idx(TCGContext *s, char *buf, int buf_size,
+                                 int idx)
+{
+    TCGTemp *ts;
+
+    ts = &s->temps[idx];
+    if (idx < s->nb_globals) {
+        pstrcpy(buf, buf_size, ts->name);
+    } else {
+        if (ts->temp_local) 
+            snprintf(buf, buf_size, "loc%d", idx - s->nb_globals);
+        else
+            snprintf(buf, buf_size, "tmp%d", idx - s->nb_globals);
+    }
+    return buf;
+}
+
+char *tcg_get_arg_str(TCGContext *s, char *buf, int buf_size, TCGv arg)
+{
+    return tcg_get_arg_str_idx(s, buf, buf_size, GET_TCGV(arg));
+}
+
+static int helper_cmp(const void *p1, const void *p2)
+{
+    const TCGHelperInfo *th1 = p1;
+    const TCGHelperInfo *th2 = p2;
+    if (th1->func < th2->func)
+        return -1;
+    else if (th1->func == th2->func)
+        return 0;
+    else
+        return 1;
+}
+
+/* find helper definition (Note: A hash table would be better) */
+static TCGHelperInfo *tcg_find_helper(TCGContext *s, tcg_target_ulong val)
+{
+    int m, m_min, m_max;
+    TCGHelperInfo *th;
+    tcg_target_ulong v;
+
+    if (unlikely(!s->helpers_sorted)) {
+        qsort(s->helpers, s->nb_helpers, sizeof(TCGHelperInfo), 
+              helper_cmp);
+        s->helpers_sorted = 1;
+    }
+
+    /* binary search */
+    m_min = 0;
+    m_max = s->nb_helpers - 1;
+    while (m_min <= m_max) {
+        m = (m_min + m_max) >> 1;
+        th = &s->helpers[m];
+        v = th->func;
+        if (v == val)
+            return th;
+        else if (val < v) {
+            m_max = m - 1;
+        } else {
+            m_min = m + 1;
+        }
+    }
+    return NULL;
+}
+
+static const char * const cond_name[] =
+{
+    [TCG_COND_EQ] = "eq",
+    [TCG_COND_NE] = "ne",
+    [TCG_COND_LT] = "lt",
+    [TCG_COND_GE] = "ge",
+    [TCG_COND_LE] = "le",
+    [TCG_COND_GT] = "gt",
+    [TCG_COND_LTU] = "ltu",
+    [TCG_COND_GEU] = "geu",
+    [TCG_COND_LEU] = "leu",
+    [TCG_COND_GTU] = "gtu"
+};
+
+void tcg_dump_ops(TCGContext *s, FILE *outfile)
+{
+    const uint16_t *opc_ptr;
+    const TCGArg *args;
+    TCGArg arg;
+    int c, i, k, nb_oargs, nb_iargs, nb_cargs, first_insn;
+    const TCGOpDef *def;
+    char buf[128];
+
+    first_insn = 1;
+    opc_ptr = gen_opc_buf;
+    args = gen_opparam_buf;
+    while (opc_ptr < gen_opc_ptr) {
+        c = *opc_ptr++;
+        def = &tcg_op_defs[c];
+        if (c == INDEX_op_debug_insn_start) {
+            uint64_t pc;
+#if TARGET_LONG_BITS > TCG_TARGET_REG_BITS
+            pc = ((uint64_t)args[1] << 32) | args[0];
+#else
+            pc = args[0];
+#endif
+            if (!first_insn) 
+                fprintf(outfile, "\n");
+            fprintf(outfile, " ---- 0x%" PRIx64, pc);
+            first_insn = 0;
+            nb_oargs = def->nb_oargs;
+            nb_iargs = def->nb_iargs;
+            nb_cargs = def->nb_cargs;
+        } else if (c == INDEX_op_call) {
+            TCGArg arg;
+
+            /* variable number of arguments */
+            arg = *args++;
+            nb_oargs = arg >> 16;
+            nb_iargs = arg & 0xffff;
+            nb_cargs = def->nb_cargs;
+
+            fprintf(outfile, " %s ", def->name);
+
+            /* function name */
+            fprintf(outfile, "%s",
+                    tcg_get_arg_str_idx(s, buf, sizeof(buf), args[nb_oargs + nb_iargs - 1]));
+            /* flags */
+            fprintf(outfile, ",$0x%" TCG_PRIlx,
+                    args[nb_oargs + nb_iargs]);
+            /* nb out args */
+            fprintf(outfile, ",$%d", nb_oargs);
+            for(i = 0; i < nb_oargs; i++) {
+                fprintf(outfile, ",");
+                fprintf(outfile, "%s",
+                        tcg_get_arg_str_idx(s, buf, sizeof(buf), args[i]));
+            }
+            for(i = 0; i < (nb_iargs - 1); i++) {
+                fprintf(outfile, ",");
+                if (args[nb_oargs + i] == TCG_CALL_DUMMY_ARG) {
+                    fprintf(outfile, "<dummy>");
+                } else {
+                    fprintf(outfile, "%s",
+                            tcg_get_arg_str_idx(s, buf, sizeof(buf), args[nb_oargs + i]));
+                }
+            }
+        } else if (c == INDEX_op_movi_i32 
+#if TCG_TARGET_REG_BITS == 64
+                   || c == INDEX_op_movi_i64
+#endif
+                   ) {
+            tcg_target_ulong val;
+            TCGHelperInfo *th;
+
+            nb_oargs = def->nb_oargs;
+            nb_iargs = def->nb_iargs;
+            nb_cargs = def->nb_cargs;
+            fprintf(outfile, " %s %s,$", def->name, 
+                    tcg_get_arg_str_idx(s, buf, sizeof(buf), args[0]));
+            val = args[1];
+            th = tcg_find_helper(s, val);
+            if (th) {
+                fprintf(outfile, th->name);
+            } else {
+                if (c == INDEX_op_movi_i32)
+                    fprintf(outfile, "0x%x", (uint32_t)val);
+                else
+                    fprintf(outfile, "0x%" PRIx64 , (uint64_t)val);
+            }
+        } else {
+            fprintf(outfile, " %s ", def->name);
+            if (c == INDEX_op_nopn) {
+                /* variable number of arguments */
+                nb_cargs = *args;
+                nb_oargs = 0;
+                nb_iargs = 0;
+            } else {
+                nb_oargs = def->nb_oargs;
+                nb_iargs = def->nb_iargs;
+                nb_cargs = def->nb_cargs;
+            }
+            
+            k = 0;
+            for(i = 0; i < nb_oargs; i++) {
+                if (k != 0)
+                    fprintf(outfile, ",");
+                fprintf(outfile, "%s",
+                        tcg_get_arg_str_idx(s, buf, sizeof(buf), args[k++]));
+            }
+            for(i = 0; i < nb_iargs; i++) {
+                if (k != 0)
+                    fprintf(outfile, ",");
+                fprintf(outfile, "%s",
+                        tcg_get_arg_str_idx(s, buf, sizeof(buf), args[k++]));
+            }
+            if (c == INDEX_op_brcond_i32
+#if TCG_TARGET_REG_BITS == 32
+                || c == INDEX_op_brcond2_i32
+#elif TCG_TARGET_REG_BITS == 64
+                || c == INDEX_op_brcond_i64
+#endif
+                ) {
+                if (args[k] < ARRAY_SIZE(cond_name) && cond_name[args[k]])
+                    fprintf(outfile, ",%s", cond_name[args[k++]]);
+                else
+                    fprintf(outfile, ",$0x%" TCG_PRIlx, args[k++]);
+                i = 1;
+            }
+            else
+                i = 0;
+            for(; i < nb_cargs; i++) {
+                if (k != 0)
+                    fprintf(outfile, ",");
+                arg = args[k++];
+                fprintf(outfile, "$0x%" TCG_PRIlx, arg);
+            }
+        }
+        fprintf(outfile, "\n");
+        args += nb_iargs + nb_oargs + nb_cargs;
+    }
+}
+
+/* we give more priority to constraints with less registers */
+static int get_constraint_priority(const TCGOpDef *def, int k)
+{
+    const TCGArgConstraint *arg_ct;
+
+    int i, n;
+    arg_ct = &def->args_ct[k];
+    if (arg_ct->ct & TCG_CT_ALIAS) {
+        /* an alias is equivalent to a single register */
+        n = 1;
+    } else {
+        if (!(arg_ct->ct & TCG_CT_REG))
+            return 0;
+        n = 0;
+        for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
+            if (tcg_regset_test_reg(arg_ct->u.regs, i))
+                n++;
+        }
+    }
+    return TCG_TARGET_NB_REGS - n + 1;
+}
+
+/* sort from highest priority to lowest */
+static void sort_constraints(TCGOpDef *def, int start, int n)
+{
+    int i, j, p1, p2, tmp;
+
+    for(i = 0; i < n; i++)
+        def->sorted_args[start + i] = start + i;
+    if (n <= 1)
+        return;
+    for(i = 0; i < n - 1; i++) {
+        for(j = i + 1; j < n; j++) {
+            p1 = get_constraint_priority(def, def->sorted_args[start + i]);
+            p2 = get_constraint_priority(def, def->sorted_args[start + j]);
+            if (p1 < p2) {
+                tmp = def->sorted_args[start + i];
+                def->sorted_args[start + i] = def->sorted_args[start + j];
+                def->sorted_args[start + j] = tmp;
+            }
+        }
+    }
+}
+
+void tcg_add_target_add_op_defs(const TCGTargetOpDef *tdefs)
+{
+    int op;
+    TCGOpDef *def;
+    const char *ct_str;
+    int i, nb_args;
+
+    for(;;) {
+        if (tdefs->op < 0)
+            break;
+        op = tdefs->op;
+        assert(op >= 0 && op < NB_OPS);
+        def = &tcg_op_defs[op];
+        nb_args = def->nb_iargs + def->nb_oargs;
+        for(i = 0; i < nb_args; i++) {
+            ct_str = tdefs->args_ct_str[i];
+            tcg_regset_clear(def->args_ct[i].u.regs);
+            def->args_ct[i].ct = 0;
+            if (ct_str[0] >= '0' && ct_str[0] <= '9') {
+                int oarg;
+                oarg = ct_str[0] - '0';
+                assert(oarg < def->nb_oargs);
+                assert(def->args_ct[oarg].ct & TCG_CT_REG);
+                /* TCG_CT_ALIAS is for the output arguments. The input
+                   argument is tagged with TCG_CT_IALIAS. */
+                def->args_ct[i] = def->args_ct[oarg];
+                def->args_ct[oarg].ct = TCG_CT_ALIAS;
+                def->args_ct[oarg].alias_index = i;
+                def->args_ct[i].ct |= TCG_CT_IALIAS;
+                def->args_ct[i].alias_index = oarg;
+            } else {
+                for(;;) {
+                    if (*ct_str == '\0')
+                        break;
+                    switch(*ct_str) {
+                    case 'i':
+                        def->args_ct[i].ct |= TCG_CT_CONST;
+                        ct_str++;
+                        break;
+                    default:
+                        if (target_parse_constraint(&def->args_ct[i], &ct_str) < 0) {
+                            fprintf(stderr, "Invalid constraint '%s' for arg %d of operation '%s'\n",
+                                    ct_str, i, def->name);
+                            exit(1);
+                        }
+                    }
+                }
+            }
+        }
+
+        /* sort the constraints (XXX: this is just an heuristic) */
+        sort_constraints(def, 0, def->nb_oargs);
+        sort_constraints(def, def->nb_oargs, def->nb_iargs);
+
+#if 0
+        {
+            int i;
+
+            printf("%s: sorted=", def->name);
+            for(i = 0; i < def->nb_oargs + def->nb_iargs; i++)
+                printf(" %d", def->sorted_args[i]);
+            printf("\n");
+        }
+#endif
+        tdefs++;
+    }
+
+}
+
+#ifdef USE_LIVENESS_ANALYSIS
+
+/* set a nop for an operation using 'nb_args' */
+static inline void tcg_set_nop(TCGContext *s, uint16_t *opc_ptr, 
+                               TCGArg *args, int nb_args)
+{
+    if (nb_args == 0) {
+        *opc_ptr = INDEX_op_nop;
+    } else {
+        *opc_ptr = INDEX_op_nopn;
+        args[0] = nb_args;
+        args[nb_args - 1] = nb_args;
+    }
+}
+
+/* liveness analysis: end of function: globals are live, temps are
+   dead. */
+/* XXX: at this stage, not used as there would be little gains because
+   most TBs end with a conditional jump. */
+static inline void tcg_la_func_end(TCGContext *s, uint8_t *dead_temps)
+{
+    memset(dead_temps, 0, s->nb_globals);
+    memset(dead_temps + s->nb_globals, 1, s->nb_temps - s->nb_globals);
+}
+
+/* liveness analysis: end of basic block: globals are live, temps are
+   dead, local temps are live. */
+static inline void tcg_la_bb_end(TCGContext *s, uint8_t *dead_temps)
+{
+    int i;
+    TCGTemp *ts;
+
+    memset(dead_temps, 0, s->nb_globals);
+    ts = &s->temps[s->nb_globals];
+    for(i = s->nb_globals; i < s->nb_temps; i++) {
+        if (ts->temp_local)
+            dead_temps[i] = 0;
+        else
+            dead_temps[i] = 1;
+        ts++;
+    }
+}
+
+/* Liveness analysis : update the opc_dead_iargs array to tell if a
+   given input arguments is dead. Instructions updating dead
+   temporaries are removed. */
+static void tcg_liveness_analysis(TCGContext *s)
+{
+    int i, op_index, op, nb_args, nb_iargs, nb_oargs, arg, nb_ops;
+    TCGArg *args;
+    const TCGOpDef *def;
+    uint8_t *dead_temps;
+    unsigned int dead_iargs;
+    
+    gen_opc_ptr++; /* skip end */
+
+    nb_ops = gen_opc_ptr - gen_opc_buf;
+
+    /* XXX: make it really dynamic */
+    s->op_dead_iargs = tcg_malloc(OPC_BUF_SIZE * sizeof(uint16_t));
+    
+    dead_temps = tcg_malloc(s->nb_temps);
+    memset(dead_temps, 1, s->nb_temps);
+
+    args = gen_opparam_ptr;
+    op_index = nb_ops - 1;
+    while (op_index >= 0) {
+        op = gen_opc_buf[op_index];
+        def = &tcg_op_defs[op];
+        switch(op) {
+        case INDEX_op_call:
+            {
+                int call_flags;
+
+                nb_args = args[-1];
+                args -= nb_args;
+                nb_iargs = args[0] & 0xffff;
+                nb_oargs = args[0] >> 16;
+                args++;
+                call_flags = args[nb_oargs + nb_iargs];
+
+                /* pure functions can be removed if their result is not
+                   used */
+                if (call_flags & TCG_CALL_PURE) {
+                    for(i = 0; i < nb_oargs; i++) {
+                        arg = args[i];
+                        if (!dead_temps[arg])
+                            goto do_not_remove_call;
+                    }
+                    tcg_set_nop(s, gen_opc_buf + op_index, 
+                                args - 1, nb_args);
+                } else {
+                do_not_remove_call:
+
+                    /* output args are dead */
+                    for(i = 0; i < nb_oargs; i++) {
+                        arg = args[i];
+                        dead_temps[arg] = 1;
+                    }
+                    
+                    /* globals are live (they may be used by the call) */
+                    memset(dead_temps, 0, s->nb_globals);
+                    
+                    /* input args are live */
+                    dead_iargs = 0;
+                    for(i = 0; i < nb_iargs; i++) {
+                        arg = args[i + nb_oargs];
+                        if (arg != TCG_CALL_DUMMY_ARG) {
+                            if (dead_temps[arg]) {
+                                dead_iargs |= (1 << i);
+                            }
+                            dead_temps[arg] = 0;
+                        }
+                    }
+                    s->op_dead_iargs[op_index] = dead_iargs;
+                }
+                args--;
+            }
+            break;
+        case INDEX_op_set_label:
+            args--;
+            /* mark end of basic block */
+            tcg_la_bb_end(s, dead_temps);
+            break;
+        case INDEX_op_debug_insn_start:
+            args -= def->nb_args;
+            break;
+        case INDEX_op_nopn:
+            nb_args = args[-1];
+            args -= nb_args;
+            break;
+        case INDEX_op_discard:
+            args--;
+            /* mark the temporary as dead */
+            dead_temps[args[0]] = 1;
+            break;
+        case INDEX_op_end:
+            break;
+            /* XXX: optimize by hardcoding common cases (e.g. triadic ops) */
+        default:
+            if (op > INDEX_op_end) {
+                args -= def->nb_args;
+                nb_iargs = def->nb_iargs;
+                nb_oargs = def->nb_oargs;
+
+                /* Test if the operation can be removed because all
+                   its outputs are dead. We assume that nb_oargs == 0
+                   implies side effects */
+                if (!(def->flags & TCG_OPF_SIDE_EFFECTS) && nb_oargs != 0) {
+                    for(i = 0; i < nb_oargs; i++) {
+                        arg = args[i];
+                        if (!dead_temps[arg])
+                            goto do_not_remove;
+                    }
+                    tcg_set_nop(s, gen_opc_buf + op_index, args, def->nb_args);
+#ifdef CONFIG_PROFILER
+                    s->del_op_count++;
+#endif
+                } else {
+                do_not_remove:
+
+                    /* output args are dead */
+                    for(i = 0; i < nb_oargs; i++) {
+                        arg = args[i];
+                        dead_temps[arg] = 1;
+                    }
+                    
+                    /* if end of basic block, update */
+                    if (def->flags & TCG_OPF_BB_END) {
+                        tcg_la_bb_end(s, dead_temps);
+                    } else if (def->flags & TCG_OPF_CALL_CLOBBER) {
+                        /* globals are live */
+                        memset(dead_temps, 0, s->nb_globals);
+                    }
+                    
+                    /* input args are live */
+                    dead_iargs = 0;
+                    for(i = 0; i < nb_iargs; i++) {
+                        arg = args[i + nb_oargs];
+                        if (dead_temps[arg]) {
+                            dead_iargs |= (1 << i);
+                        }
+                        dead_temps[arg] = 0;
+                    }
+                    s->op_dead_iargs[op_index] = dead_iargs;
+                }
+            } else {
+                /* legacy dyngen operations */
+                args -= def->nb_args;
+                /* mark end of basic block */
+                tcg_la_bb_end(s, dead_temps);
+            }
+            break;
+        }
+        op_index--;
+    }
+
+    if (args != gen_opparam_buf)
+        tcg_abort();
+}
+#else
+/* dummy liveness analysis */
+void tcg_liveness_analysis(TCGContext *s)
+{
+    int nb_ops;
+    nb_ops = gen_opc_ptr - gen_opc_buf;
+
+    s->op_dead_iargs = tcg_malloc(nb_ops * sizeof(uint16_t));
+    memset(s->op_dead_iargs, 0, nb_ops * sizeof(uint16_t));
+}
+#endif
+
+#ifndef NDEBUG
+static void dump_regs(TCGContext *s)
+{
+    TCGTemp *ts;
+    int i;
+    char buf[64];
+
+    for(i = 0; i < s->nb_temps; i++) {
+        ts = &s->temps[i];
+        printf("  %10s: ", tcg_get_arg_str_idx(s, buf, sizeof(buf), i));
+        switch(ts->val_type) {
+        case TEMP_VAL_REG:
+            printf("%s", tcg_target_reg_names[ts->reg]);
+            break;
+        case TEMP_VAL_MEM:
+            printf("%d(%s)", (int)ts->mem_offset, tcg_target_reg_names[ts->mem_reg]);
+            break;
+        case TEMP_VAL_CONST:
+            printf("$0x%" TCG_PRIlx, ts->val);
+            break;
+        case TEMP_VAL_DEAD:
+            printf("D");
+            break;
+        default:
+            printf("???");
+            break;
+        }
+        printf("\n");
+    }
+
+    for(i = 0; i < TCG_TARGET_NB_REGS; i++) {
+        if (s->reg_to_temp[i] >= 0) {
+            printf("%s: %s\n", 
+                   tcg_target_reg_names[i], 
+                   tcg_get_arg_str_idx(s, buf, sizeof(buf), s->reg_to_temp[i]));
+        }
+    }
+}
+
+static void check_regs(TCGContext *s)
+{
+    int reg, k;
+    TCGTemp *ts;
+    char buf[64];
+
+    for(reg = 0; reg < TCG_TARGET_NB_REGS; reg++) {
+        k = s->reg_to_temp[reg];
+        if (k >= 0) {
+            ts = &s->temps[k];
+            if (ts->val_type != TEMP_VAL_REG ||
+                ts->reg != reg) {
+                printf("Inconsistency for register %s:\n", 
+                       tcg_target_reg_names[reg]);
+                goto fail;
+            }
+        }
+    }
+    for(k = 0; k < s->nb_temps; k++) {
+        ts = &s->temps[k];
+        if (ts->val_type == TEMP_VAL_REG &&
+            !ts->fixed_reg &&
+            s->reg_to_temp[ts->reg] != k) {
+                printf("Inconsistency for temp %s:\n", 
+                       tcg_get_arg_str_idx(s, buf, sizeof(buf), k));
+        fail:
+                printf("reg state:\n");
+                dump_regs(s);
+                tcg_abort();
+        }
+    }
+}
+#endif
+
+static void temp_allocate_frame(TCGContext *s, int temp)
+{
+    TCGTemp *ts;
+    ts = &s->temps[temp];
+    s->current_frame_offset = (s->current_frame_offset + sizeof(tcg_target_long) - 1) & ~(sizeof(tcg_target_long) - 1);
+    if (s->current_frame_offset + sizeof(tcg_target_long) > s->frame_end)
+        tcg_abort();
+    ts->mem_offset = s->current_frame_offset;
+    ts->mem_reg = s->frame_reg;
+    ts->mem_allocated = 1;
+    s->current_frame_offset += sizeof(tcg_target_long);
+}
+
+/* free register 'reg' by spilling the corresponding temporary if necessary */
+static void tcg_reg_free(TCGContext *s, int reg)
+{
+    TCGTemp *ts;
+    int temp;
+
+    temp = s->reg_to_temp[reg];
+    if (temp != -1) {
+        ts = &s->temps[temp];
+        assert(ts->val_type == TEMP_VAL_REG);
+        if (!ts->mem_coherent) {
+            if (!ts->mem_allocated) 
+                temp_allocate_frame(s, temp);
+            tcg_out_st(s, ts->type, reg, ts->mem_reg, ts->mem_offset);
+        }
+        ts->val_type = TEMP_VAL_MEM;
+        s->reg_to_temp[reg] = -1;
+    }
+}
+
+/* Allocate a register belonging to reg1 & ~reg2 */
+static int tcg_reg_alloc(TCGContext *s, TCGRegSet reg1, TCGRegSet reg2)
+{
+    int i, reg;
+    TCGRegSet reg_ct;
+
+    tcg_regset_andnot(reg_ct, reg1, reg2);
+
+    /* first try free registers */
+    for(i = 0; i < ARRAY_SIZE(tcg_target_reg_alloc_order); i++) {
+        reg = tcg_target_reg_alloc_order[i];
+        if (tcg_regset_test_reg(reg_ct, reg) && s->reg_to_temp[reg] == -1)
+            return reg;
+    }
+
+    /* XXX: do better spill choice */
+    for(i = 0; i < ARRAY_SIZE(tcg_target_reg_alloc_order); i++) {
+        reg = tcg_target_reg_alloc_order[i];
+        if (tcg_regset_test_reg(reg_ct, reg)) {
+            tcg_reg_free(s, reg);
+            return reg;
+        }
+    }
+
+    tcg_abort();
+}
+
+/* save a temporary to memory. 'allocated_regs' is used in case a
+   temporary registers needs to be allocated to store a constant. */
+static void temp_save(TCGContext *s, int temp, TCGRegSet allocated_regs)
+{
+    TCGTemp *ts;
+    int reg;
+
+    ts = &s->temps[temp];
+    if (!ts->fixed_reg) {
+        switch(ts->val_type) {
+        case TEMP_VAL_REG:
+            tcg_reg_free(s, ts->reg);
+            break;
+        case TEMP_VAL_DEAD:
+            ts->val_type = TEMP_VAL_MEM;
+            break;
+        case TEMP_VAL_CONST:
+            reg = tcg_reg_alloc(s, tcg_target_available_regs[ts->type], 
+                                allocated_regs);
+            if (!ts->mem_allocated) 
+                temp_allocate_frame(s, temp);
+            tcg_out_movi(s, ts->type, reg, ts->val);
+            tcg_out_st(s, ts->type, reg, ts->mem_reg, ts->mem_offset);
+            ts->val_type = TEMP_VAL_MEM;
+            break;
+        case TEMP_VAL_MEM:
+            break;
+        default:
+            tcg_abort();
+        }
+    }
+}
+
+/* save globals to their cannonical location and assume they can be
+   modified be the following code. 'allocated_regs' is used in case a
+   temporary registers needs to be allocated to store a constant. */
+static void save_globals(TCGContext *s, TCGRegSet allocated_regs)
+{
+    int i;
+
+    for(i = 0; i < s->nb_globals; i++) {
+        temp_save(s, i, allocated_regs);
+    }
+}
+
+/* at the end of a basic block, we assume all temporaries are dead and
+   all globals are stored at their canonical location. */
+static void tcg_reg_alloc_bb_end(TCGContext *s, TCGRegSet allocated_regs)
+{
+    TCGTemp *ts;
+    int i;
+
+    for(i = s->nb_globals; i < s->nb_temps; i++) {
+        ts = &s->temps[i];
+        if (ts->temp_local) {
+            temp_save(s, i, allocated_regs);
+        } else {
+            if (ts->val_type == TEMP_VAL_REG) {
+                s->reg_to_temp[ts->reg] = -1;
+            }
+            ts->val_type = TEMP_VAL_DEAD;
+        }
+    }
+
+    save_globals(s, allocated_regs);
+}
+
+#define IS_DEAD_IARG(n) ((dead_iargs >> (n)) & 1)
+
+static void tcg_reg_alloc_movi(TCGContext *s, const TCGArg *args)
+{
+    TCGTemp *ots;
+    tcg_target_ulong val;
+
+    ots = &s->temps[args[0]];
+    val = args[1];
+
+    if (ots->fixed_reg) {
+        /* for fixed registers, we do not do any constant
+           propagation */
+        tcg_out_movi(s, ots->type, ots->reg, val);
+    } else {
+        /* The movi is not explicitly generated here */
+        if (ots->val_type == TEMP_VAL_REG)
+            s->reg_to_temp[ots->reg] = -1;
+        ots->val_type = TEMP_VAL_CONST;
+        ots->val = val;
+    }
+}
+
+static void tcg_reg_alloc_mov(TCGContext *s, const TCGOpDef *def,
+                              const TCGArg *args,
+                              unsigned int dead_iargs)
+{
+    TCGTemp *ts, *ots;
+    int reg;
+    const TCGArgConstraint *arg_ct;
+
+    ots = &s->temps[args[0]];
+    ts = &s->temps[args[1]];
+    arg_ct = &def->args_ct[0];
+
+    /* XXX: always mark arg dead if IS_DEAD_IARG(0) */
+    if (ts->val_type == TEMP_VAL_REG) {
+        if (IS_DEAD_IARG(0) && !ts->fixed_reg && !ots->fixed_reg) {
+            /* the mov can be suppressed */
+            if (ots->val_type == TEMP_VAL_REG)
+                s->reg_to_temp[ots->reg] = -1;
+            reg = ts->reg;
+            s->reg_to_temp[reg] = -1;
+            ts->val_type = TEMP_VAL_DEAD;
+        } else {
+            if (ots->val_type == TEMP_VAL_REG) {
+                reg = ots->reg;
+            } else {
+                reg = tcg_reg_alloc(s, arg_ct->u.regs, s->reserved_regs);
+            }
+            if (ts->reg != reg) {
+                tcg_out_mov(s, reg, ts->reg);
+            }
+        }
+    } else if (ts->val_type == TEMP_VAL_MEM) {
+        if (ots->val_type == TEMP_VAL_REG) {
+            reg = ots->reg;
+        } else {
+            reg = tcg_reg_alloc(s, arg_ct->u.regs, s->reserved_regs);
+        }
+        tcg_out_ld(s, ts->type, reg, ts->mem_reg, ts->mem_offset);
+    } else if (ts->val_type == TEMP_VAL_CONST) {
+        if (ots->fixed_reg) {
+            reg = ots->reg;
+            tcg_out_movi(s, ots->type, reg, ts->val);
+        } else {
+            /* propagate constant */
+            if (ots->val_type == TEMP_VAL_REG)
+                s->reg_to_temp[ots->reg] = -1;
+            ots->val_type = TEMP_VAL_CONST;
+            ots->val = ts->val;
+            return;
+        }
+    } else {
+        tcg_abort();
+    }
+    s->reg_to_temp[reg] = args[0];
+    ots->reg = reg;
+    ots->val_type = TEMP_VAL_REG;
+    ots->mem_coherent = 0;
+}
+
+static void tcg_reg_alloc_op(TCGContext *s, 
+                             const TCGOpDef *def, int opc,
+                             const TCGArg *args,
+                             unsigned int dead_iargs)
+{
+    TCGRegSet allocated_regs;
+    int i, k, nb_iargs, nb_oargs, reg;
+    TCGArg arg;
+    const TCGArgConstraint *arg_ct;
+    TCGTemp *ts;
+    TCGArg new_args[TCG_MAX_OP_ARGS];
+    int const_args[TCG_MAX_OP_ARGS];
+
+    nb_oargs = def->nb_oargs;
+    nb_iargs = def->nb_iargs;
+
+    /* copy constants */
+    memcpy(new_args + nb_oargs + nb_iargs, 
+           args + nb_oargs + nb_iargs, 
+           sizeof(TCGArg) * def->nb_cargs);
+
+    /* satisfy input constraints */ 
+    tcg_regset_set(allocated_regs, s->reserved_regs);
+    for(k = 0; k < nb_iargs; k++) {
+        i = def->sorted_args[nb_oargs + k];
+        arg = args[i];
+        arg_ct = &def->args_ct[i];
+        ts = &s->temps[arg];
+        if (ts->val_type == TEMP_VAL_MEM) {
+            reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs);
+            tcg_out_ld(s, ts->type, reg, ts->mem_reg, ts->mem_offset);
+            ts->val_type = TEMP_VAL_REG;
+            ts->reg = reg;
+            ts->mem_coherent = 1;
+            s->reg_to_temp[reg] = arg;
+        } else if (ts->val_type == TEMP_VAL_CONST) {
+            if (tcg_target_const_match(ts->val, arg_ct)) {
+                /* constant is OK for instruction */
+                const_args[i] = 1;
+                new_args[i] = ts->val;
+                goto iarg_end;
+            } else {
+                /* need to move to a register */
+                reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs);
+                tcg_out_movi(s, ts->type, reg, ts->val);
+                ts->val_type = TEMP_VAL_REG;
+                ts->reg = reg;
+                ts->mem_coherent = 0;
+                s->reg_to_temp[reg] = arg;
+            }
+        }
+        assert(ts->val_type == TEMP_VAL_REG);
+        if (arg_ct->ct & TCG_CT_IALIAS) {
+            if (ts->fixed_reg) {
+                /* if fixed register, we must allocate a new register
+                   if the alias is not the same register */
+                if (arg != args[arg_ct->alias_index])
+                    goto allocate_in_reg;
+            } else {
+                /* if the input is aliased to an output and if it is
+                   not dead after the instruction, we must allocate
+                   a new register and move it */
+                if (!IS_DEAD_IARG(i - nb_oargs)) 
+                    goto allocate_in_reg;
+            }
+        }
+        reg = ts->reg;
+        if (tcg_regset_test_reg(arg_ct->u.regs, reg)) {
+            /* nothing to do : the constraint is satisfied */
+        } else {
+        allocate_in_reg:
+            /* allocate a new register matching the constraint 
+               and move the temporary register into it */
+            reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs);
+            tcg_out_mov(s, reg, ts->reg);
+        }
+        new_args[i] = reg;
+        const_args[i] = 0;
+        tcg_regset_set_reg(allocated_regs, reg);
+    iarg_end: ;
+    }
+    
+    if (def->flags & TCG_OPF_BB_END) {
+        tcg_reg_alloc_bb_end(s, allocated_regs);
+    } else {
+        /* mark dead temporaries and free the associated registers */
+        for(i = 0; i < nb_iargs; i++) {
+            arg = args[nb_oargs + i];
+            if (IS_DEAD_IARG(i)) {
+                ts = &s->temps[arg];
+                if (!ts->fixed_reg) {
+                    if (ts->val_type == TEMP_VAL_REG)
+                        s->reg_to_temp[ts->reg] = -1;
+                    ts->val_type = TEMP_VAL_DEAD;
+                }
+            }
+        }
+        
+        if (def->flags & TCG_OPF_CALL_CLOBBER) {
+            /* XXX: permit generic clobber register list ? */ 
+            for(reg = 0; reg < TCG_TARGET_NB_REGS; reg++) {
+                if (tcg_regset_test_reg(tcg_target_call_clobber_regs, reg)) {
+                    tcg_reg_free(s, reg);
+                }
+            }
+            /* XXX: for load/store we could do that only for the slow path
+               (i.e. when a memory callback is called) */
+            
+            /* store globals and free associated registers (we assume the insn
+               can modify any global. */
+            save_globals(s, allocated_regs);
+        }
+        
+        /* satisfy the output constraints */
+        tcg_regset_set(allocated_regs, s->reserved_regs);
+        for(k = 0; k < nb_oargs; k++) {
+            i = def->sorted_args[k];
+            arg = args[i];
+            arg_ct = &def->args_ct[i];
+            ts = &s->temps[arg];
+            if (arg_ct->ct & TCG_CT_ALIAS) {
+                reg = new_args[arg_ct->alias_index];
+            } else {
+                /* if fixed register, we try to use it */
+                reg = ts->reg;
+                if (ts->fixed_reg &&
+                    tcg_regset_test_reg(arg_ct->u.regs, reg)) {
+                    goto oarg_end;
+                }
+                reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs);
+            }
+            tcg_regset_set_reg(allocated_regs, reg);
+            /* if a fixed register is used, then a move will be done afterwards */
+            if (!ts->fixed_reg) {
+                if (ts->val_type == TEMP_VAL_REG)
+                    s->reg_to_temp[ts->reg] = -1;
+                ts->val_type = TEMP_VAL_REG;
+                ts->reg = reg;
+                /* temp value is modified, so the value kept in memory is
+                   potentially not the same */
+                ts->mem_coherent = 0; 
+                s->reg_to_temp[reg] = arg;
+            }
+        oarg_end:
+            new_args[i] = reg;
+        }
+    }
+
+    /* emit instruction */
+    tcg_out_op(s, opc, new_args, const_args);
+    
+    /* move the outputs in the correct register if needed */
+    for(i = 0; i < nb_oargs; i++) {
+        ts = &s->temps[args[i]];
+        reg = new_args[i];
+        if (ts->fixed_reg && ts->reg != reg) {
+            tcg_out_mov(s, ts->reg, reg);
+        }
+    }
+}
+
+#ifdef TCG_TARGET_STACK_GROWSUP
+#define STACK_DIR(x) (-(x))
+#else
+#define STACK_DIR(x) (x)
+#endif
+
+static int tcg_reg_alloc_call(TCGContext *s, const TCGOpDef *def,
+                              int opc, const TCGArg *args,
+                              unsigned int dead_iargs)
+{
+    int nb_iargs, nb_oargs, flags, nb_regs, i, reg, nb_params;
+    TCGArg arg, func_arg;
+    TCGTemp *ts;
+    tcg_target_long stack_offset, call_stack_size, func_addr;
+    int const_func_arg, allocate_args;
+    TCGRegSet allocated_regs;
+    const TCGArgConstraint *arg_ct;
+
+    arg = *args++;
+
+    nb_oargs = arg >> 16;
+    nb_iargs = arg & 0xffff;
+    nb_params = nb_iargs - 1;
+
+    flags = args[nb_oargs + nb_iargs];
+
+    nb_regs = tcg_target_get_call_iarg_regs_count(flags);
+    if (nb_regs > nb_params)
+        nb_regs = nb_params;
+
+    /* assign stack slots first */
+    /* XXX: preallocate call stack */
+    call_stack_size = (nb_params - nb_regs) * sizeof(tcg_target_long);
+    call_stack_size = (call_stack_size + TCG_TARGET_STACK_ALIGN - 1) & 
+        ~(TCG_TARGET_STACK_ALIGN - 1);
+    allocate_args = (call_stack_size > TCG_STATIC_CALL_ARGS_SIZE);
+    if (allocate_args) {
+        tcg_out_addi(s, TCG_REG_CALL_STACK, -STACK_DIR(call_stack_size));
+    }
+
+    stack_offset = TCG_TARGET_CALL_STACK_OFFSET;
+    for(i = nb_regs; i < nb_params; i++) {
+        arg = args[nb_oargs + i];
+#ifdef TCG_TARGET_STACK_GROWSUP
+        stack_offset -= sizeof(tcg_target_long);
+#endif
+        if (arg != TCG_CALL_DUMMY_ARG) {
+            ts = &s->temps[arg];
+            if (ts->val_type == TEMP_VAL_REG) {
+                tcg_out_st(s, ts->type, ts->reg, TCG_REG_CALL_STACK, stack_offset);
+            } else if (ts->val_type == TEMP_VAL_MEM) {
+                reg = tcg_reg_alloc(s, tcg_target_available_regs[ts->type], 
+                                    s->reserved_regs);
+                /* XXX: not correct if reading values from the stack */
+                tcg_out_ld(s, ts->type, reg, ts->mem_reg, ts->mem_offset);
+                tcg_out_st(s, ts->type, reg, TCG_REG_CALL_STACK, stack_offset);
+            } else if (ts->val_type == TEMP_VAL_CONST) {
+                reg = tcg_reg_alloc(s, tcg_target_available_regs[ts->type], 
+                                    s->reserved_regs);
+                /* XXX: sign extend may be needed on some targets */
+                tcg_out_movi(s, ts->type, reg, ts->val);
+                tcg_out_st(s, ts->type, reg, TCG_REG_CALL_STACK, stack_offset);
+            } else {
+                tcg_abort();
+            }
+        }
+#ifndef TCG_TARGET_STACK_GROWSUP
+        stack_offset += sizeof(tcg_target_long);
+#endif
+    }
+    
+    /* assign input registers */
+    tcg_regset_set(allocated_regs, s->reserved_regs);
+    for(i = 0; i < nb_regs; i++) {
+        arg = args[nb_oargs + i];
+        if (arg != TCG_CALL_DUMMY_ARG) {
+            ts = &s->temps[arg];
+            reg = tcg_target_call_iarg_regs[i];
+            tcg_reg_free(s, reg);
+            if (ts->val_type == TEMP_VAL_REG) {
+                if (ts->reg != reg) {
+                    tcg_out_mov(s, reg, ts->reg);
+                }
+            } else if (ts->val_type == TEMP_VAL_MEM) {
+                tcg_out_ld(s, ts->type, reg, ts->mem_reg, ts->mem_offset);
+            } else if (ts->val_type == TEMP_VAL_CONST) {
+                /* XXX: sign extend ? */
+                tcg_out_movi(s, ts->type, reg, ts->val);
+            } else {
+                tcg_abort();
+            }
+            tcg_regset_set_reg(allocated_regs, reg);
+        }
+    }
+    
+    /* assign function address */
+    func_arg = args[nb_oargs + nb_iargs - 1];
+    arg_ct = &def->args_ct[0];
+    ts = &s->temps[func_arg];
+    func_addr = ts->val;
+    const_func_arg = 0;
+    if (ts->val_type == TEMP_VAL_MEM) {
+        reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs);
+        tcg_out_ld(s, ts->type, reg, ts->mem_reg, ts->mem_offset);
+        func_arg = reg;
+        tcg_regset_set_reg(allocated_regs, reg);
+    } else if (ts->val_type == TEMP_VAL_REG) {
+        reg = ts->reg;
+        if (!tcg_regset_test_reg(arg_ct->u.regs, reg)) {
+            reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs);
+            tcg_out_mov(s, reg, ts->reg);
+        }
+        func_arg = reg;
+        tcg_regset_set_reg(allocated_regs, reg);
+    } else if (ts->val_type == TEMP_VAL_CONST) {
+        if (tcg_target_const_match(func_addr, arg_ct)) {
+            const_func_arg = 1;
+            func_arg = func_addr;
+        } else {
+            reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs);
+            tcg_out_movi(s, ts->type, reg, func_addr);
+            func_arg = reg;
+            tcg_regset_set_reg(allocated_regs, reg);
+        }
+    } else {
+        tcg_abort();
+    }
+        
+    
+    /* mark dead temporaries and free the associated registers */
+    for(i = 0; i < nb_iargs; i++) {
+        arg = args[nb_oargs + i];
+        if (IS_DEAD_IARG(i)) {
+            ts = &s->temps[arg];
+            if (!ts->fixed_reg) {
+                if (ts->val_type == TEMP_VAL_REG)
+                    s->reg_to_temp[ts->reg] = -1;
+                ts->val_type = TEMP_VAL_DEAD;
+            }
+        }
+    }
+    
+    /* clobber call registers */
+    for(reg = 0; reg < TCG_TARGET_NB_REGS; reg++) {
+        if (tcg_regset_test_reg(tcg_target_call_clobber_regs, reg)) {
+            tcg_reg_free(s, reg);
+        }
+    }
+    
+    /* store globals and free associated registers (we assume the call
+       can modify any global. */
+    save_globals(s, allocated_regs);
+
+    tcg_out_op(s, opc, &func_arg, &const_func_arg);
+    
+    if (allocate_args) {
+        tcg_out_addi(s, TCG_REG_CALL_STACK, STACK_DIR(call_stack_size));
+    }
+
+    /* assign output registers and emit moves if needed */
+    for(i = 0; i < nb_oargs; i++) {
+        arg = args[i];
+        ts = &s->temps[arg];
+        reg = tcg_target_call_oarg_regs[i];
+        assert(s->reg_to_temp[reg] == -1);
+        if (ts->fixed_reg) {
+            if (ts->reg != reg) {
+                tcg_out_mov(s, ts->reg, reg);
+            }
+        } else {
+            if (ts->val_type == TEMP_VAL_REG)
+                s->reg_to_temp[ts->reg] = -1;
+            ts->val_type = TEMP_VAL_REG;
+            ts->reg = reg;
+            ts->mem_coherent = 0; 
+            s->reg_to_temp[reg] = arg;
+        }
+    }
+    
+    return nb_iargs + nb_oargs + def->nb_cargs + 1;
+}
+
+#ifdef CONFIG_PROFILER
+
+static int64_t dyngen_table_op_count[NB_OPS];
+
+void dump_op_count(void)
+{
+    int i;
+    FILE *f;
+    f = fopen("/tmp/op1.log", "w");
+    for(i = 0; i < INDEX_op_end; i++) {
+        fprintf(f, "%s %" PRId64 "\n", tcg_op_defs[i].name, dyngen_table_op_count[i]);
+    }
+    fclose(f);
+    f = fopen("/tmp/op2.log", "w");
+    for(i = INDEX_op_end; i < NB_OPS; i++) {
+        fprintf(f, "%s %" PRId64 "\n", tcg_op_defs[i].name, dyngen_table_op_count[i]);
+    }
+    fclose(f);
+}
+#endif
+
+
+static inline int tcg_gen_code_common(TCGContext *s, uint8_t *gen_code_buf,
+                                      long search_pc)
+{
+    int opc, op_index;
+    const TCGOpDef *def;
+    unsigned int dead_iargs;
+    const TCGArg *args;
+
+#ifdef DEBUG_DISAS
+    if (unlikely(loglevel & CPU_LOG_TB_OP)) {
+        fprintf(logfile, "OP:\n");
+        tcg_dump_ops(s, logfile);
+        fprintf(logfile, "\n");
+    }
+#endif
+
+#ifdef CONFIG_PROFILER
+    s->la_time -= profile_getclock();
+#endif
+    tcg_liveness_analysis(s);
+#ifdef CONFIG_PROFILER
+    s->la_time += profile_getclock();
+#endif
+
+#ifdef DEBUG_DISAS
+    if (unlikely(loglevel & CPU_LOG_TB_OP_OPT)) {
+        fprintf(logfile, "OP after la:\n");
+        tcg_dump_ops(s, logfile);
+        fprintf(logfile, "\n");
+    }
+#endif
+
+    tcg_reg_alloc_start(s);
+
+    s->code_buf = gen_code_buf;
+    s->code_ptr = gen_code_buf;
+
+    args = gen_opparam_buf;
+    op_index = 0;
+
+    for(;;) {
+        opc = gen_opc_buf[op_index];
+#ifdef CONFIG_PROFILER
+        dyngen_table_op_count[opc]++;
+#endif
+        def = &tcg_op_defs[opc];
+#if 0
+        printf("%s: %d %d %d\n", def->name,
+               def->nb_oargs, def->nb_iargs, def->nb_cargs);
+        //        dump_regs(s);
+#endif
+        switch(opc) {
+        case INDEX_op_mov_i32:
+#if TCG_TARGET_REG_BITS == 64
+        case INDEX_op_mov_i64:
+#endif
+            dead_iargs = s->op_dead_iargs[op_index];
+            tcg_reg_alloc_mov(s, def, args, dead_iargs);
+            break;
+        case INDEX_op_movi_i32:
+#if TCG_TARGET_REG_BITS == 64
+        case INDEX_op_movi_i64:
+#endif
+            tcg_reg_alloc_movi(s, args);
+            break;
+        case INDEX_op_debug_insn_start:
+            /* debug instruction */
+            break;
+        case INDEX_op_nop:
+        case INDEX_op_nop1:
+        case INDEX_op_nop2:
+        case INDEX_op_nop3:
+            break;
+        case INDEX_op_nopn:
+            args += args[0];
+            goto next;
+        case INDEX_op_discard:
+            {
+                TCGTemp *ts;
+                ts = &s->temps[args[0]];
+                /* mark the temporary as dead */
+                if (!ts->fixed_reg) {
+                    if (ts->val_type == TEMP_VAL_REG)
+                        s->reg_to_temp[ts->reg] = -1;
+                    ts->val_type = TEMP_VAL_DEAD;
+                }
+            }
+            break;
+        case INDEX_op_set_label:
+            tcg_reg_alloc_bb_end(s, s->reserved_regs);
+            tcg_out_label(s, args[0], (long)s->code_ptr);
+            break;
+        case INDEX_op_call:
+            dead_iargs = s->op_dead_iargs[op_index];
+            args += tcg_reg_alloc_call(s, def, opc, args, dead_iargs);
+            goto next;
+        case INDEX_op_end:
+            goto the_end;
+
+#ifdef CONFIG_DYNGEN_OP
+        case 0 ... INDEX_op_end - 1:
+            /* legacy dyngen ops */
+#ifdef CONFIG_PROFILER
+            s->old_op_count++;
+#endif
+            tcg_reg_alloc_bb_end(s, s->reserved_regs);
+            if (search_pc >= 0) {
+                s->code_ptr += def->copy_size;
+                args += def->nb_args;
+            } else {
+                args = dyngen_op(s, opc, args);
+            }
+            goto next;
+#endif
+        default:
+            /* Note: in order to speed up the code, it would be much
+               faster to have specialized register allocator functions for
+               some common argument patterns */
+            dead_iargs = s->op_dead_iargs[op_index];
+            tcg_reg_alloc_op(s, def, opc, args, dead_iargs);
+            break;
+        }
+        args += def->nb_args;
+    next:
+        if (search_pc >= 0 && search_pc < s->code_ptr - gen_code_buf) {
+            return op_index;
+        }
+        op_index++;
+#ifndef NDEBUG
+        check_regs(s);
+#endif
+    }
+ the_end:
+    return -1;
+}
+
+int dyngen_code(TCGContext *s, uint8_t *gen_code_buf)
+{
+#ifdef CONFIG_PROFILER
+    {
+        int n;
+        n = (gen_opc_ptr - gen_opc_buf);
+        s->op_count += n;
+        if (n > s->op_count_max)
+            s->op_count_max = n;
+
+        s->temp_count += s->nb_temps;
+        if (s->nb_temps > s->temp_count_max)
+            s->temp_count_max = s->nb_temps;
+    }
+#endif
+
+    tcg_gen_code_common(s, gen_code_buf, -1);
+
+    /* flush instruction cache */
+    flush_icache_range((unsigned long)gen_code_buf, 
+                       (unsigned long)s->code_ptr);
+    return s->code_ptr -  gen_code_buf;
+}
+
+/* Return the index of the micro operation such as the pc after is <
+   offset bytes from the start of the TB.  The contents of gen_code_buf must
+   not be changed, though writing the same values is ok.
+   Return -1 if not found. */
+int dyngen_code_search_pc(TCGContext *s, uint8_t *gen_code_buf, long offset)
+{
+    return tcg_gen_code_common(s, gen_code_buf, offset);
+}
+
+#ifdef CONFIG_PROFILER
+void tcg_dump_info(FILE *f,
+                   int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
+{
+    TCGContext *s = &tcg_ctx;
+    int64_t tot;
+
+    tot = s->interm_time + s->code_time;
+    cpu_fprintf(f, "JIT cycles          %" PRId64 " (%0.3f s at 2.4 GHz)\n",
+                tot, tot / 2.4e9);
+    cpu_fprintf(f, "translated TBs      %" PRId64 " (aborted=%" PRId64 " %0.1f%%)\n", 
+                s->tb_count, 
+                s->tb_count1 - s->tb_count,
+                s->tb_count1 ? (double)(s->tb_count1 - s->tb_count) / s->tb_count1 * 100.0 : 0);
+    cpu_fprintf(f, "avg ops/TB          %0.1f max=%d\n", 
+                s->tb_count ? (double)s->op_count / s->tb_count : 0, s->op_count_max);
+    cpu_fprintf(f, "old ops/total ops   %0.1f%%\n", 
+                s->op_count ? (double)s->old_op_count / s->op_count * 100.0 : 0);
+    cpu_fprintf(f, "deleted ops/TB      %0.2f\n",
+                s->tb_count ? 
+                (double)s->del_op_count / s->tb_count : 0);
+    cpu_fprintf(f, "avg temps/TB        %0.2f max=%d\n",
+                s->tb_count ? 
+                (double)s->temp_count / s->tb_count : 0,
+                s->temp_count_max);
+    
+    cpu_fprintf(f, "cycles/op           %0.1f\n", 
+                s->op_count ? (double)tot / s->op_count : 0);
+    cpu_fprintf(f, "cycles/in byte      %0.1f\n", 
+                s->code_in_len ? (double)tot / s->code_in_len : 0);
+    cpu_fprintf(f, "cycles/out byte     %0.1f\n", 
+                s->code_out_len ? (double)tot / s->code_out_len : 0);
+    if (tot == 0)
+        tot = 1;
+    cpu_fprintf(f, "  gen_interm time   %0.1f%%\n", 
+                (double)s->interm_time / tot * 100.0);
+    cpu_fprintf(f, "  gen_code time     %0.1f%%\n", 
+                (double)s->code_time / tot * 100.0);
+    cpu_fprintf(f, "liveness/code time  %0.1f%%\n", 
+                (double)s->la_time / (s->code_time ? s->code_time : 1) * 100.0);
+    cpu_fprintf(f, "cpu_restore count   %" PRId64 "\n",
+                s->restore_count);
+    cpu_fprintf(f, "  avg cycles        %0.1f\n",
+                s->restore_count ? (double)s->restore_time / s->restore_count : 0);
+    {
+        extern void dump_op_count(void);
+        dump_op_count();
+    }
+}
+#else
+void tcg_dump_info(FILE *f,
+                   int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
+{
+    cpu_fprintf(f, "[TCG profiler not compiled]\n");
+}
+#endif
diff --git a/tcg/tcg.h b/tcg/tcg.h
new file mode 100644
index 0000000..bc5b902
--- /dev/null
+++ b/tcg/tcg.h
@@ -0,0 +1,421 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "tcg-target.h"
+
+#if TCG_TARGET_REG_BITS == 32
+typedef int32_t tcg_target_long;
+typedef uint32_t tcg_target_ulong;
+#define TCG_PRIlx PRIx32
+#define TCG_PRIld PRId32
+#elif TCG_TARGET_REG_BITS == 64
+typedef int64_t tcg_target_long;
+typedef uint64_t tcg_target_ulong;
+#define TCG_PRIlx PRIx64
+#define TCG_PRIld PRId64
+#else
+#error unsupported
+#endif
+
+#if TCG_TARGET_NB_REGS <= 32
+typedef uint32_t TCGRegSet;
+#elif TCG_TARGET_NB_REGS <= 64
+typedef uint64_t TCGRegSet;
+#else
+#error unsupported
+#endif
+
+enum {
+#define DEF(s, n, copy_size) INDEX_op_ ## s,
+#include "tcg-opc.h"
+#undef DEF
+    NB_OPS,
+};
+
+#define tcg_regset_clear(d) (d) = 0
+#define tcg_regset_set(d, s) (d) = (s)
+#define tcg_regset_set32(d, reg, val32) (d) |= (val32) << (reg)
+#define tcg_regset_set_reg(d, r) (d) |= 1 << (r)
+#define tcg_regset_reset_reg(d, r) (d) &= ~(1 << (r))
+#define tcg_regset_test_reg(d, r) (((d) >> (r)) & 1)
+#define tcg_regset_or(d, a, b) (d) = (a) | (b)
+#define tcg_regset_and(d, a, b) (d) = (a) & (b)
+#define tcg_regset_andnot(d, a, b) (d) = (a) & ~(b)
+#define tcg_regset_not(d, a) (d) = ~(a)
+
+typedef struct TCGRelocation {
+    struct TCGRelocation *next;
+    int type;
+    uint8_t *ptr;
+    tcg_target_long addend;
+} TCGRelocation; 
+
+typedef struct TCGLabel {
+    int has_value;
+    union {
+        tcg_target_ulong value;
+        TCGRelocation *first_reloc;
+    } u;
+} TCGLabel;
+
+typedef struct TCGPool {
+    struct TCGPool *next;
+    int size;
+    uint8_t data[0] __attribute__ ((aligned));
+} TCGPool;
+
+#define TCG_POOL_CHUNK_SIZE 32768
+
+#define TCG_MAX_LABELS 512
+
+#define TCG_MAX_TEMPS 512
+
+/* when the size of the arguments of a called function is smaller than
+   this value, they are statically allocated in the TB stack frame */
+#define TCG_STATIC_CALL_ARGS_SIZE 128
+
+typedef int TCGType;
+
+#define TCG_TYPE_I32 0
+#define TCG_TYPE_I64 1
+#define TCG_TYPE_COUNT 2 /* number of different types */
+
+#if TCG_TARGET_REG_BITS == 32
+#define TCG_TYPE_PTR TCG_TYPE_I32
+#else
+#define TCG_TYPE_PTR TCG_TYPE_I64
+#endif
+
+typedef tcg_target_ulong TCGArg;
+
+/* Define a type and accessor macros for varables.  Using a struct is
+   nice because it gives some level of type safely.  Ideally the compiler
+   be able to see through all this.  However in practice this is not true,
+   expecially on targets with braindamaged ABIs (e.g. i386).
+   We use plain int by default to avoid this runtime overhead.
+   Users of tcg_gen_* don't need to know about any of this, and should
+   treat TCGv as an opaque type.  */
+
+//#define DEBUG_TCGV 1
+
+#ifdef DEBUG_TCGV
+
+typedef struct
+{
+    int n;
+} TCGv;
+
+#define MAKE_TCGV(i) __extension__ \
+  ({ TCGv make_tcgv_tmp = {i}; make_tcgv_tmp;})
+#define GET_TCGV(t) ((t).n)
+#if TCG_TARGET_REG_BITS == 32
+#define TCGV_HIGH(t) MAKE_TCGV(GET_TCGV(t) + 1)
+#endif
+
+#else /* !DEBUG_TCGV */
+
+typedef int TCGv;
+#define MAKE_TCGV(x) (x)
+#define GET_TCGV(t) (t)
+#if TCG_TARGET_REG_BITS == 32
+#define TCGV_HIGH(t) ((t) + 1)
+#endif
+
+#endif /* DEBUG_TCGV */
+
+/* Dummy definition to avoid compiler warnings.  */
+#define TCGV_UNUSED(x) x = MAKE_TCGV(-1)
+
+/* call flags */
+#define TCG_CALL_TYPE_MASK      0x000f
+#define TCG_CALL_TYPE_STD       0x0000 /* standard C call */
+#define TCG_CALL_TYPE_REGPARM_1 0x0001 /* i386 style regparm call (1 reg) */
+#define TCG_CALL_TYPE_REGPARM_2 0x0002 /* i386 style regparm call (2 regs) */
+#define TCG_CALL_TYPE_REGPARM   0x0003 /* i386 style regparm call (3 regs) */
+/* A pure function only reads its arguments and globals variables and
+   cannot raise exceptions. Hence a call to a pure function can be
+   safely suppressed if the return value is not used. */
+#define TCG_CALL_PURE           0x0010 
+
+/* used to align parameters */
+#define TCG_CALL_DUMMY_TCGV     MAKE_TCGV(-1)
+#define TCG_CALL_DUMMY_ARG      ((TCGArg)(-1))
+
+typedef enum {
+    TCG_COND_EQ,
+    TCG_COND_NE,
+    TCG_COND_LT,
+    TCG_COND_GE,
+    TCG_COND_LE,
+    TCG_COND_GT,
+    /* unsigned */
+    TCG_COND_LTU,
+    TCG_COND_GEU,
+    TCG_COND_LEU,
+    TCG_COND_GTU,
+} TCGCond;
+
+#define TEMP_VAL_DEAD  0
+#define TEMP_VAL_REG   1
+#define TEMP_VAL_MEM   2
+#define TEMP_VAL_CONST 3
+
+/* XXX: optimize memory layout */
+typedef struct TCGTemp {
+    TCGType base_type;
+    TCGType type;
+    int val_type;
+    int reg;
+    tcg_target_long val;
+    int mem_reg;
+    tcg_target_long mem_offset;
+    unsigned int fixed_reg:1;
+    unsigned int mem_coherent:1;
+    unsigned int mem_allocated:1;
+    unsigned int temp_local:1; /* If true, the temp is saved accross
+                                  basic blocks. Otherwise, it is not
+                                  preserved accross basic blocks. */
+    unsigned int temp_allocated:1; /* never used for code gen */
+    /* index of next free temp of same base type, -1 if end */
+    int next_free_temp;
+    const char *name;
+} TCGTemp;
+
+typedef struct TCGHelperInfo {
+    tcg_target_ulong func;
+    const char *name;
+} TCGHelperInfo;
+
+typedef struct TCGContext TCGContext;
+
+struct TCGContext {
+    uint8_t *pool_cur, *pool_end;
+    TCGPool *pool_first, *pool_current;
+    TCGLabel *labels;
+    int nb_labels;
+    TCGTemp *temps; /* globals first, temps after */
+    int nb_globals;
+    int nb_temps;
+    /* index of free temps, -1 if none */
+    int first_free_temp[TCG_TYPE_COUNT * 2]; 
+
+    /* goto_tb support */
+    uint8_t *code_buf;
+    unsigned long *tb_next;
+    uint16_t *tb_next_offset;
+    uint16_t *tb_jmp_offset; /* != NULL if USE_DIRECT_JUMP */
+
+    /* liveness analysis */
+    uint16_t *op_dead_iargs; /* for each operation, each bit tells if the
+                                corresponding input argument is dead */
+    
+    /* tells in which temporary a given register is. It does not take
+       into account fixed registers */
+    int reg_to_temp[TCG_TARGET_NB_REGS];
+    TCGRegSet reserved_regs;
+    tcg_target_long current_frame_offset;
+    tcg_target_long frame_start;
+    tcg_target_long frame_end;
+    int frame_reg;
+
+    uint8_t *code_ptr;
+    TCGTemp static_temps[TCG_MAX_TEMPS];
+
+    TCGHelperInfo *helpers;
+    int nb_helpers;
+    int allocated_helpers;
+    int helpers_sorted;
+
+#ifdef CONFIG_PROFILER
+    /* profiling info */
+    int64_t tb_count1;
+    int64_t tb_count;
+    int64_t op_count; /* total insn count */
+    int op_count_max; /* max insn per TB */
+    int64_t temp_count;
+    int temp_count_max;
+    int64_t old_op_count;
+    int64_t del_op_count;
+    int64_t code_in_len;
+    int64_t code_out_len;
+    int64_t interm_time;
+    int64_t code_time;
+    int64_t la_time;
+    int64_t restore_count;
+    int64_t restore_time;
+#endif
+};
+
+extern TCGContext tcg_ctx;
+extern uint16_t *gen_opc_ptr;
+extern TCGArg *gen_opparam_ptr;
+extern uint16_t gen_opc_buf[];
+extern TCGArg gen_opparam_buf[];
+
+/* pool based memory allocation */
+
+void *tcg_malloc_internal(TCGContext *s, int size);
+void tcg_pool_reset(TCGContext *s);
+void tcg_pool_delete(TCGContext *s);
+
+static inline void *tcg_malloc(int size)
+{
+    TCGContext *s = &tcg_ctx;
+    uint8_t *ptr, *ptr_end;
+    size = (size + sizeof(long) - 1) & ~(sizeof(long) - 1);
+    ptr = s->pool_cur;
+    ptr_end = ptr + size;
+    if (unlikely(ptr_end > s->pool_end)) {
+        return tcg_malloc_internal(&tcg_ctx, size);
+    } else {
+        s->pool_cur = ptr_end;
+        return ptr;
+    }
+}
+
+void tcg_context_init(TCGContext *s);
+void tcg_func_start(TCGContext *s);
+
+int dyngen_code(TCGContext *s, uint8_t *gen_code_buf);
+int dyngen_code_search_pc(TCGContext *s, uint8_t *gen_code_buf, long offset);
+
+void tcg_set_frame(TCGContext *s, int reg,
+                   tcg_target_long start, tcg_target_long size);
+TCGv tcg_global_reg_new(TCGType type, int reg, const char *name);
+TCGv tcg_global_reg2_new_hack(TCGType type, int reg1, int reg2, 
+                              const char *name);
+TCGv tcg_global_mem_new(TCGType type, int reg, tcg_target_long offset,
+                        const char *name);
+TCGv tcg_temp_new_internal(TCGType type, int temp_local);
+static inline TCGv tcg_temp_new(TCGType type)
+{
+    return tcg_temp_new_internal(type, 0);
+}
+static inline TCGv tcg_temp_local_new(TCGType type)
+{
+    return tcg_temp_new_internal(type, 1);
+}
+void tcg_temp_free(TCGv arg);
+char *tcg_get_arg_str(TCGContext *s, char *buf, int buf_size, TCGv arg);
+void tcg_dump_info(FILE *f,
+                   int (*cpu_fprintf)(FILE *f, const char *fmt, ...));
+
+#define TCG_CT_ALIAS  0x80
+#define TCG_CT_IALIAS 0x40
+#define TCG_CT_REG    0x01
+#define TCG_CT_CONST  0x02 /* any constant of register size */
+
+typedef struct TCGArgConstraint {
+    uint16_t ct;
+    uint8_t alias_index;
+    union {
+        TCGRegSet regs;
+    } u;
+} TCGArgConstraint;
+
+#define TCG_MAX_OP_ARGS 16
+
+#define TCG_OPF_BB_END     0x01 /* instruction defines the end of a basic
+                                   block */
+#define TCG_OPF_CALL_CLOBBER 0x02 /* instruction clobbers call registers 
+                                   and potentially update globals. */
+#define TCG_OPF_SIDE_EFFECTS 0x04 /* instruction has side effects : it
+                                     cannot be removed if its output
+                                     are not used */
+
+typedef struct TCGOpDef {
+    const char *name;
+    uint8_t nb_oargs, nb_iargs, nb_cargs, nb_args;
+    uint8_t flags;
+    uint16_t copy_size;
+    TCGArgConstraint *args_ct;
+    int *sorted_args;
+} TCGOpDef;
+        
+typedef struct TCGTargetOpDef {
+    int op;
+    const char *args_ct_str[TCG_MAX_OP_ARGS];
+} TCGTargetOpDef;
+
+extern TCGOpDef tcg_op_defs[];
+
+void tcg_target_init(TCGContext *s);
+void tcg_target_qemu_prologue(TCGContext *s);
+
+#define tcg_abort() \
+do {\
+    fprintf(stderr, "%s:%d: tcg fatal error\n", __FILE__, __LINE__);\
+    abort();\
+} while (0)
+
+void tcg_add_target_add_op_defs(const TCGTargetOpDef *tdefs);
+
+void tcg_gen_call(TCGContext *s, TCGv func, unsigned int flags,
+                  unsigned int nb_rets, const TCGv *rets,
+                  unsigned int nb_params, const TCGv *args1);
+void tcg_gen_shifti_i64(TCGv ret, TCGv arg1, 
+                        int c, int right, int arith);
+
+/* only used for debugging purposes */
+void tcg_register_helper(void *func, const char *name);
+#define TCG_HELPER(func) tcg_register_helper(func, #func)
+const char *tcg_helper_get_name(TCGContext *s, void *func);
+void tcg_dump_ops(TCGContext *s, FILE *outfile);
+
+void dump_ops(const uint16_t *opc_buf, const TCGArg *opparam_buf);
+TCGv tcg_const_i32(int32_t val);
+TCGv tcg_const_i64(int64_t val);
+
+#if TCG_TARGET_REG_BITS == 32
+#define tcg_const_ptr tcg_const_i32
+#define tcg_add_ptr tcg_add_i32
+#define tcg_sub_ptr tcg_sub_i32
+#else
+#define tcg_const_ptr tcg_const_i64
+#define tcg_add_ptr tcg_add_i64
+#define tcg_sub_ptr tcg_sub_i64
+#endif
+
+void tcg_out_reloc(TCGContext *s, uint8_t *code_ptr, int type, 
+                   int label_index, long addend);
+const TCGArg *tcg_gen_code_op(TCGContext *s, int opc, const TCGArg *args1,
+                              unsigned int dead_iargs);
+
+const TCGArg *dyngen_op(TCGContext *s, int opc, const TCGArg *opparam_ptr);
+
+/* tcg-runtime.c */
+int64_t tcg_helper_shl_i64(int64_t arg1, int64_t arg2);
+int64_t tcg_helper_shr_i64(int64_t arg1, int64_t arg2);
+int64_t tcg_helper_sar_i64(int64_t arg1, int64_t arg2);
+int64_t tcg_helper_div_i64(int64_t arg1, int64_t arg2);
+int64_t tcg_helper_rem_i64(int64_t arg1, int64_t arg2);
+uint64_t tcg_helper_divu_i64(uint64_t arg1, uint64_t arg2);
+uint64_t tcg_helper_remu_i64(uint64_t arg1, uint64_t arg2);
+
+extern uint8_t code_gen_prologue[];
+#if defined(__powerpc__) && !defined(__powerpc64__)
+#define tcg_qemu_tb_exec(tb_ptr) \
+    ((long REGPARM __attribute__ ((longcall)) (*)(void *))code_gen_prologue)(tb_ptr)
+#else
+#define tcg_qemu_tb_exec(tb_ptr) ((long REGPARM (*)(void *))code_gen_prologue)(tb_ptr)
+#endif
diff --git a/tcg/x86_64/tcg-target.c b/tcg/x86_64/tcg-target.c
new file mode 100644
index 0000000..304a0c3
--- /dev/null
+++ b/tcg/x86_64/tcg-target.c
@@ -0,0 +1,1307 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+const char *tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
+    "%rax",
+    "%rcx",
+    "%rdx",
+    "%rbx",
+    "%rsp",
+    "%rbp",
+    "%rsi",
+    "%rdi",
+    "%r8",
+    "%r9",
+    "%r10",
+    "%r11",
+    "%r12",
+    "%r13",
+    "%r14",
+    "%r15",
+};
+
+int tcg_target_reg_alloc_order[] = {
+    TCG_REG_RDI,
+    TCG_REG_RSI,
+    TCG_REG_RDX,
+    TCG_REG_RCX,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_RAX,
+    TCG_REG_R10,
+    TCG_REG_R11,
+
+    TCG_REG_RBP,
+    TCG_REG_RBX,
+    TCG_REG_R12,
+    TCG_REG_R13,
+    TCG_REG_R14,
+    TCG_REG_R15,
+};
+
+const int tcg_target_call_iarg_regs[6] = { 
+    TCG_REG_RDI,
+    TCG_REG_RSI,
+    TCG_REG_RDX,
+    TCG_REG_RCX,
+    TCG_REG_R8,
+    TCG_REG_R9,
+};
+
+const int tcg_target_call_oarg_regs[2] = { 
+    TCG_REG_RAX, 
+    TCG_REG_RDX 
+};
+
+static uint8_t *tb_ret_addr;
+
+static void patch_reloc(uint8_t *code_ptr, int type, 
+                        tcg_target_long value, tcg_target_long addend)
+{
+    value += addend;
+    switch(type) {
+    case R_X86_64_32:
+        if (value != (uint32_t)value)
+            tcg_abort();
+        *(uint32_t *)code_ptr = value;
+        break;
+    case R_X86_64_32S:
+        if (value != (int32_t)value)
+            tcg_abort();
+        *(uint32_t *)code_ptr = value;
+        break;
+    case R_386_PC32:
+        value -= (long)code_ptr;
+        if (value != (int32_t)value)
+            tcg_abort();
+        *(uint32_t *)code_ptr = value;
+        break;
+    default:
+        tcg_abort();
+    }
+}
+
+/* maximum number of register used for input function arguments */
+static inline int tcg_target_get_call_iarg_regs_count(int flags)
+{
+    return 6;
+}
+
+/* parse target specific constraints */
+static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str)
+{
+    const char *ct_str;
+
+    ct_str = *pct_str;
+    switch(ct_str[0]) {
+    case 'a':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_RAX);
+        break;
+    case 'b':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_RBX);
+        break;
+    case 'c':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_RCX);
+        break;
+    case 'd':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_RDX);
+        break;
+    case 'S':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_RSI);
+        break;
+    case 'D':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set_reg(ct->u.regs, TCG_REG_RDI);
+        break;
+    case 'q':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xf);
+        break;
+    case 'r':
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffff);
+        break;
+    case 'L': /* qemu_ld/st constraint */
+        ct->ct |= TCG_CT_REG;
+        tcg_regset_set32(ct->u.regs, 0, 0xffff);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_RSI);
+        tcg_regset_reset_reg(ct->u.regs, TCG_REG_RDI);
+        break;
+    case 'e':
+        ct->ct |= TCG_CT_CONST_S32;
+        break;
+    case 'Z':
+        ct->ct |= TCG_CT_CONST_U32;
+        break;
+    default:
+        return -1;
+    }
+    ct_str++;
+    *pct_str = ct_str;
+    return 0;
+}
+
+/* test if a constant matches the constraint */
+static inline int tcg_target_const_match(tcg_target_long val,
+                                         const TCGArgConstraint *arg_ct)
+{
+    int ct;
+    ct = arg_ct->ct;
+    if (ct & TCG_CT_CONST)
+        return 1;
+    else if ((ct & TCG_CT_CONST_S32) && val == (int32_t)val)
+        return 1;
+    else if ((ct & TCG_CT_CONST_U32) && val == (uint32_t)val)
+        return 1;
+    else
+        return 0;
+}
+
+#define ARITH_ADD 0
+#define ARITH_OR  1
+#define ARITH_ADC 2
+#define ARITH_SBB 3
+#define ARITH_AND 4
+#define ARITH_SUB 5
+#define ARITH_XOR 6
+#define ARITH_CMP 7
+
+#define SHIFT_SHL 4
+#define SHIFT_SHR 5
+#define SHIFT_SAR 7
+
+#define JCC_JMP (-1)
+#define JCC_JO  0x0
+#define JCC_JNO 0x1
+#define JCC_JB  0x2
+#define JCC_JAE 0x3
+#define JCC_JE  0x4
+#define JCC_JNE 0x5
+#define JCC_JBE 0x6
+#define JCC_JA  0x7
+#define JCC_JS  0x8
+#define JCC_JNS 0x9
+#define JCC_JP  0xa
+#define JCC_JNP 0xb
+#define JCC_JL  0xc
+#define JCC_JGE 0xd
+#define JCC_JLE 0xe
+#define JCC_JG  0xf
+
+#define P_EXT   0x100 /* 0x0f opcode prefix */
+#define P_REXW  0x200 /* set rex.w = 1 */
+#define P_REXB  0x400 /* force rex use for byte registers */
+                                  
+static const uint8_t tcg_cond_to_jcc[10] = {
+    [TCG_COND_EQ] = JCC_JE,
+    [TCG_COND_NE] = JCC_JNE,
+    [TCG_COND_LT] = JCC_JL,
+    [TCG_COND_GE] = JCC_JGE,
+    [TCG_COND_LE] = JCC_JLE,
+    [TCG_COND_GT] = JCC_JG,
+    [TCG_COND_LTU] = JCC_JB,
+    [TCG_COND_GEU] = JCC_JAE,
+    [TCG_COND_LEU] = JCC_JBE,
+    [TCG_COND_GTU] = JCC_JA,
+};
+
+static inline void tcg_out_opc(TCGContext *s, int opc, int r, int rm, int x)
+{
+    int rex;
+    rex = ((opc >> 6) & 0x8) | ((r >> 1) & 0x4) | 
+        ((x >> 2) & 2) | ((rm >> 3) & 1);
+    if (rex || (opc & P_REXB)) {
+        tcg_out8(s, rex | 0x40);
+    }
+    if (opc & P_EXT)
+        tcg_out8(s, 0x0f);
+    tcg_out8(s, opc);
+}
+
+static inline void tcg_out_modrm(TCGContext *s, int opc, int r, int rm)
+{
+    tcg_out_opc(s, opc, r, rm, 0);
+    tcg_out8(s, 0xc0 | ((r & 7) << 3) | (rm & 7));
+}
+
+/* rm < 0 means no register index plus (-rm - 1 immediate bytes) */
+static inline void tcg_out_modrm_offset(TCGContext *s, int opc, int r, int rm, 
+                                        tcg_target_long offset)
+{
+    if (rm < 0) {
+        tcg_target_long val;
+        tcg_out_opc(s, opc, r, 0, 0);
+        val = offset - ((tcg_target_long)s->code_ptr + 5 + (-rm - 1));
+        if (val == (int32_t)val) {
+            /* eip relative */
+            tcg_out8(s, 0x05 | ((r & 7) << 3));
+            tcg_out32(s, val);
+        } else if (offset == (int32_t)offset) {
+            tcg_out8(s, 0x04 | ((r & 7) << 3));
+            tcg_out8(s, 0x25); /* sib */
+            tcg_out32(s, offset);
+        } else {
+            tcg_abort();
+        }
+    } else if (offset == 0 && (rm & 7) != TCG_REG_RBP) {
+        tcg_out_opc(s, opc, r, rm, 0);
+        if ((rm & 7) == TCG_REG_RSP) {
+            tcg_out8(s, 0x04 | ((r & 7) << 3));
+            tcg_out8(s, 0x24);
+        } else {
+            tcg_out8(s, 0x00 | ((r & 7) << 3) | (rm & 7));
+        }
+    } else if ((int8_t)offset == offset) {
+        tcg_out_opc(s, opc, r, rm, 0);
+        if ((rm & 7) == TCG_REG_RSP) {
+            tcg_out8(s, 0x44 | ((r & 7) << 3));
+            tcg_out8(s, 0x24);
+        } else {
+            tcg_out8(s, 0x40 | ((r & 7) << 3) | (rm & 7));
+        }
+        tcg_out8(s, offset);
+    } else {
+        tcg_out_opc(s, opc, r, rm, 0);
+        if ((rm & 7) == TCG_REG_RSP) {
+            tcg_out8(s, 0x84 | ((r & 7) << 3));
+            tcg_out8(s, 0x24);
+        } else {
+            tcg_out8(s, 0x80 | ((r & 7) << 3) | (rm & 7));
+        }
+        tcg_out32(s, offset);
+    }
+}
+
+#if defined(CONFIG_SOFTMMU)
+/* XXX: incomplete. index must be different from ESP */
+static void tcg_out_modrm_offset2(TCGContext *s, int opc, int r, int rm, 
+                                  int index, int shift,
+                                  tcg_target_long offset)
+{
+    int mod;
+    if (rm == -1)
+        tcg_abort();
+    if (offset == 0 && (rm & 7) != TCG_REG_RBP) {
+        mod = 0;
+    } else if (offset == (int8_t)offset) {
+        mod = 0x40;
+    } else if (offset == (int32_t)offset) {
+        mod = 0x80;
+    } else {
+        tcg_abort();
+    }
+    if (index == -1) {
+        tcg_out_opc(s, opc, r, rm, 0);
+        if ((rm & 7) == TCG_REG_RSP) {
+            tcg_out8(s, mod | ((r & 7) << 3) | 0x04);
+            tcg_out8(s, 0x04 | (rm & 7));
+        } else {
+            tcg_out8(s, mod | ((r & 7) << 3) | (rm & 7));
+        }
+    } else {
+        tcg_out_opc(s, opc, r, rm, index);
+        tcg_out8(s, mod | ((r & 7) << 3) | 0x04);
+        tcg_out8(s, (shift << 6) | ((index & 7) << 3) | (rm & 7));
+    }
+    if (mod == 0x40) {
+        tcg_out8(s, offset);
+    } else if (mod == 0x80) {
+        tcg_out32(s, offset);
+    }
+}
+#endif
+
+static inline void tcg_out_mov(TCGContext *s, int ret, int arg)
+{
+    tcg_out_modrm(s, 0x8b | P_REXW, ret, arg);
+}
+
+static inline void tcg_out_movi(TCGContext *s, TCGType type, 
+                                int ret, tcg_target_long arg)
+{
+    if (arg == 0) {
+        tcg_out_modrm(s, 0x01 | (ARITH_XOR << 3), ret, ret); /* xor r0,r0 */
+    } else if (arg == (uint32_t)arg || type == TCG_TYPE_I32) {
+        tcg_out_opc(s, 0xb8 + (ret & 7), 0, ret, 0);
+        tcg_out32(s, arg);
+    } else if (arg == (int32_t)arg) {
+        tcg_out_modrm(s, 0xc7 | P_REXW, 0, ret);
+        tcg_out32(s, arg);
+    } else {
+        tcg_out_opc(s, (0xb8 + (ret & 7)) | P_REXW, 0, ret, 0);
+        tcg_out32(s, arg);
+        tcg_out32(s, arg >> 32);
+    }
+}
+
+static inline void tcg_out_ld(TCGContext *s, TCGType type, int ret,
+                              int arg1, tcg_target_long arg2)
+{
+    if (type == TCG_TYPE_I32)
+        tcg_out_modrm_offset(s, 0x8b, ret, arg1, arg2); /* movl */
+    else
+        tcg_out_modrm_offset(s, 0x8b | P_REXW, ret, arg1, arg2); /* movq */
+}
+
+static inline void tcg_out_st(TCGContext *s, TCGType type, int arg,
+                              int arg1, tcg_target_long arg2)
+{
+    if (type == TCG_TYPE_I32)
+        tcg_out_modrm_offset(s, 0x89, arg, arg1, arg2); /* movl */
+    else
+        tcg_out_modrm_offset(s, 0x89 | P_REXW, arg, arg1, arg2); /* movq */
+}
+
+static inline void tgen_arithi32(TCGContext *s, int c, int r0, int32_t val)
+{
+    if (val == (int8_t)val) {
+        tcg_out_modrm(s, 0x83, c, r0);
+        tcg_out8(s, val);
+    } else if (c == ARITH_AND && val == 0xffu) {
+        /* movzbl */
+        tcg_out_modrm(s, 0xb6 | P_EXT | P_REXB, r0, r0);
+    } else if (c == ARITH_AND && val == 0xffffu) {
+        /* movzwl */
+        tcg_out_modrm(s, 0xb7 | P_EXT, r0, r0);
+    } else {
+        tcg_out_modrm(s, 0x81, c, r0);
+        tcg_out32(s, val);
+    }
+}
+
+static inline void tgen_arithi64(TCGContext *s, int c, int r0, int64_t val)
+{
+    if (val == (int8_t)val) {
+        tcg_out_modrm(s, 0x83 | P_REXW, c, r0);
+        tcg_out8(s, val);
+    } else if (c == ARITH_AND && val == 0xffu) {
+        /* movzbl */
+        tcg_out_modrm(s, 0xb6 | P_EXT | P_REXW, r0, r0);
+    } else if (c == ARITH_AND && val == 0xffffu) {
+        /* movzwl */
+        tcg_out_modrm(s, 0xb7 | P_EXT | P_REXW, r0, r0);
+    } else if (c == ARITH_AND && val == 0xffffffffu) {
+        /* 32-bit mov zero extends */
+        tcg_out_modrm(s, 0x8b, r0, r0);
+    } else if (val == (int32_t)val) {
+        tcg_out_modrm(s, 0x81 | P_REXW, c, r0);
+        tcg_out32(s, val);
+    } else if (c == ARITH_AND && val == (uint32_t)val) {
+        tcg_out_modrm(s, 0x81, c, r0);
+        tcg_out32(s, val);
+    } else {
+        tcg_abort();
+    }
+}
+
+static void tcg_out_addi(TCGContext *s, int reg, tcg_target_long val)
+{
+    if (val != 0)
+        tgen_arithi64(s, ARITH_ADD, reg, val);
+}
+
+static void tcg_out_jxx(TCGContext *s, int opc, int label_index)
+{
+    int32_t val, val1;
+    TCGLabel *l = &s->labels[label_index];
+    
+    if (l->has_value) {
+        val = l->u.value - (tcg_target_long)s->code_ptr;
+        val1 = val - 2;
+        if ((int8_t)val1 == val1) {
+            if (opc == -1)
+                tcg_out8(s, 0xeb);
+            else
+                tcg_out8(s, 0x70 + opc);
+            tcg_out8(s, val1);
+        } else {
+            if (opc == -1) {
+                tcg_out8(s, 0xe9);
+                tcg_out32(s, val - 5);
+            } else {
+                tcg_out8(s, 0x0f);
+                tcg_out8(s, 0x80 + opc);
+                tcg_out32(s, val - 6);
+            }
+        }
+    } else {
+        if (opc == -1) {
+            tcg_out8(s, 0xe9);
+        } else {
+            tcg_out8(s, 0x0f);
+            tcg_out8(s, 0x80 + opc);
+        }
+        tcg_out_reloc(s, s->code_ptr, R_386_PC32, label_index, -4);
+        s->code_ptr += 4;
+    }
+}
+
+static void tcg_out_brcond(TCGContext *s, int cond, 
+                           TCGArg arg1, TCGArg arg2, int const_arg2,
+                           int label_index, int rexw)
+{
+    if (const_arg2) {
+        if (arg2 == 0) {
+            /* test r, r */
+            tcg_out_modrm(s, 0x85 | rexw, arg1, arg1);
+        } else {
+            if (rexw)
+                tgen_arithi64(s, ARITH_CMP, arg1, arg2);
+            else
+                tgen_arithi32(s, ARITH_CMP, arg1, arg2);
+        }
+    } else {
+        tcg_out_modrm(s, 0x01 | (ARITH_CMP << 3) | rexw, arg2, arg1);
+    }
+    tcg_out_jxx(s, tcg_cond_to_jcc[cond], label_index);
+}
+
+#if defined(CONFIG_SOFTMMU)
+
+#include "../../softmmu_defs.h"
+
+static void *qemu_ld_helpers[4] = {
+    __ldb_mmu,
+    __ldw_mmu,
+    __ldl_mmu,
+    __ldq_mmu,
+};
+
+static void *qemu_st_helpers[4] = {
+    __stb_mmu,
+    __stw_mmu,
+    __stl_mmu,
+    __stq_mmu,
+};
+#endif
+
+static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+                            int opc)
+{
+    int addr_reg, data_reg, r0, r1, mem_index, s_bits, bswap, rexw;
+#if defined(CONFIG_SOFTMMU)
+    uint8_t *label1_ptr, *label2_ptr;
+#endif
+
+    data_reg = *args++;
+    addr_reg = *args++;
+    mem_index = *args;
+    s_bits = opc & 3;
+
+    r0 = TCG_REG_RDI;
+    r1 = TCG_REG_RSI;
+
+#if TARGET_LONG_BITS == 32
+    rexw = 0;
+#else
+    rexw = P_REXW;
+#endif
+#if defined(CONFIG_SOFTMMU)
+    /* mov */
+    tcg_out_modrm(s, 0x8b | rexw, r1, addr_reg);
+
+    /* mov */
+    tcg_out_modrm(s, 0x8b | rexw, r0, addr_reg);
+ 
+    tcg_out_modrm(s, 0xc1 | rexw, 5, r1); /* shr $x, r1 */
+    tcg_out8(s, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS); 
+    
+    tcg_out_modrm(s, 0x81 | rexw, 4, r0); /* andl $x, r0 */
+    tcg_out32(s, TARGET_PAGE_MASK | ((1 << s_bits) - 1));
+    
+    tcg_out_modrm(s, 0x81, 4, r1); /* andl $x, r1 */
+    tcg_out32(s, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS);
+
+    /* lea offset(r1, env), r1 */
+    tcg_out_modrm_offset2(s, 0x8d | P_REXW, r1, r1, TCG_AREG0, 0,
+                          offsetof(CPUState, tlb_table[mem_index][0].addr_read));
+
+    /* cmp 0(r1), r0 */
+    tcg_out_modrm_offset(s, 0x3b | rexw, r0, r1, 0);
+    
+    /* mov */
+    tcg_out_modrm(s, 0x8b | rexw, r0, addr_reg);
+    
+    /* je label1 */
+    tcg_out8(s, 0x70 + JCC_JE);
+    label1_ptr = s->code_ptr;
+    s->code_ptr++;
+
+    /* XXX: move that code at the end of the TB */
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_RSI, mem_index);
+    tcg_out8(s, 0xe8);
+    tcg_out32(s, (tcg_target_long)qemu_ld_helpers[s_bits] - 
+              (tcg_target_long)s->code_ptr - 4);
+
+    switch(opc) {
+    case 0 | 4:
+        /* movsbq */
+        tcg_out_modrm(s, 0xbe | P_EXT | P_REXW, data_reg, TCG_REG_RAX);
+        break;
+    case 1 | 4:
+        /* movswq */
+        tcg_out_modrm(s, 0xbf | P_EXT | P_REXW, data_reg, TCG_REG_RAX);
+        break;
+    case 2 | 4:
+        /* movslq */
+        tcg_out_modrm(s, 0x63 | P_REXW, data_reg, TCG_REG_RAX);
+        break;
+    case 0:
+    case 1:
+    case 2:
+    default:
+        /* movl */
+        tcg_out_modrm(s, 0x8b, data_reg, TCG_REG_RAX);
+        break;
+    case 3:
+        tcg_out_mov(s, data_reg, TCG_REG_RAX);
+        break;
+    }
+
+    /* jmp label2 */
+    tcg_out8(s, 0xeb);
+    label2_ptr = s->code_ptr;
+    s->code_ptr++;
+    
+    /* label1: */
+    *label1_ptr = s->code_ptr - label1_ptr - 1;
+
+    /* add x(r1), r0 */
+    tcg_out_modrm_offset(s, 0x03 | P_REXW, r0, r1, offsetof(CPUTLBEntry, addend) - 
+                         offsetof(CPUTLBEntry, addr_read));
+#else
+    r0 = addr_reg;
+#endif    
+
+#ifdef TARGET_WORDS_BIGENDIAN
+    bswap = 1;
+#else
+    bswap = 0;
+#endif
+    switch(opc) {
+    case 0:
+        /* movzbl */
+        tcg_out_modrm_offset(s, 0xb6 | P_EXT, data_reg, r0, 0);
+        break;
+    case 0 | 4:
+        /* movsbX */
+        tcg_out_modrm_offset(s, 0xbe | P_EXT | rexw, data_reg, r0, 0);
+        break;
+    case 1:
+        /* movzwl */
+        tcg_out_modrm_offset(s, 0xb7 | P_EXT, data_reg, r0, 0);
+        if (bswap) {
+            /* rolw $8, data_reg */
+            tcg_out8(s, 0x66); 
+            tcg_out_modrm(s, 0xc1, 0, data_reg);
+            tcg_out8(s, 8);
+        }
+        break;
+    case 1 | 4:
+        if (bswap) {
+            /* movzwl */
+            tcg_out_modrm_offset(s, 0xb7 | P_EXT, data_reg, r0, 0);
+            /* rolw $8, data_reg */
+            tcg_out8(s, 0x66); 
+            tcg_out_modrm(s, 0xc1, 0, data_reg);
+            tcg_out8(s, 8);
+
+            /* movswX data_reg, data_reg */
+            tcg_out_modrm(s, 0xbf | P_EXT | rexw, data_reg, data_reg);
+        } else {
+            /* movswX */
+            tcg_out_modrm_offset(s, 0xbf | P_EXT | rexw, data_reg, r0, 0);
+        }
+        break;
+    case 2:
+        /* movl (r0), data_reg */
+        tcg_out_modrm_offset(s, 0x8b, data_reg, r0, 0);
+        if (bswap) {
+            /* bswap */
+            tcg_out_opc(s, (0xc8 + (data_reg & 7)) | P_EXT, 0, data_reg, 0);
+        }
+        break;
+    case 2 | 4:
+        if (bswap) {
+            /* movl (r0), data_reg */
+            tcg_out_modrm_offset(s, 0x8b, data_reg, r0, 0);
+            /* bswap */
+            tcg_out_opc(s, (0xc8 + (data_reg & 7)) | P_EXT, 0, data_reg, 0);
+            /* movslq */
+            tcg_out_modrm(s, 0x63 | P_REXW, data_reg, data_reg);
+        } else {
+            /* movslq */
+            tcg_out_modrm_offset(s, 0x63 | P_REXW, data_reg, r0, 0);
+        }
+        break;
+    case 3:
+        /* movq (r0), data_reg */
+        tcg_out_modrm_offset(s, 0x8b | P_REXW, data_reg, r0, 0);
+        if (bswap) {
+            /* bswap */
+            tcg_out_opc(s, (0xc8 + (data_reg & 7)) | P_EXT | P_REXW, 0, data_reg, 0);
+        }
+        break;
+    default:
+        tcg_abort();
+    }
+
+#if defined(CONFIG_SOFTMMU)
+    /* label2: */
+    *label2_ptr = s->code_ptr - label2_ptr - 1;
+#endif
+}
+
+static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+                            int opc)
+{
+    int addr_reg, data_reg, r0, r1, mem_index, s_bits, bswap, rexw;
+#if defined(CONFIG_SOFTMMU)
+    uint8_t *label1_ptr, *label2_ptr;
+#endif
+
+    data_reg = *args++;
+    addr_reg = *args++;
+    mem_index = *args;
+
+    s_bits = opc;
+
+    r0 = TCG_REG_RDI;
+    r1 = TCG_REG_RSI;
+
+#if TARGET_LONG_BITS == 32
+    rexw = 0;
+#else
+    rexw = P_REXW;
+#endif
+#if defined(CONFIG_SOFTMMU)
+    /* mov */
+    tcg_out_modrm(s, 0x8b | rexw, r1, addr_reg);
+
+    /* mov */
+    tcg_out_modrm(s, 0x8b | rexw, r0, addr_reg);
+ 
+    tcg_out_modrm(s, 0xc1 | rexw, 5, r1); /* shr $x, r1 */
+    tcg_out8(s, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS); 
+    
+    tcg_out_modrm(s, 0x81 | rexw, 4, r0); /* andl $x, r0 */
+    tcg_out32(s, TARGET_PAGE_MASK | ((1 << s_bits) - 1));
+    
+    tcg_out_modrm(s, 0x81, 4, r1); /* andl $x, r1 */
+    tcg_out32(s, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS);
+
+    /* lea offset(r1, env), r1 */
+    tcg_out_modrm_offset2(s, 0x8d | P_REXW, r1, r1, TCG_AREG0, 0,
+                          offsetof(CPUState, tlb_table[mem_index][0].addr_write));
+
+    /* cmp 0(r1), r0 */
+    tcg_out_modrm_offset(s, 0x3b | rexw, r0, r1, 0);
+    
+    /* mov */
+    tcg_out_modrm(s, 0x8b | rexw, r0, addr_reg);
+    
+    /* je label1 */
+    tcg_out8(s, 0x70 + JCC_JE);
+    label1_ptr = s->code_ptr;
+    s->code_ptr++;
+
+    /* XXX: move that code at the end of the TB */
+    switch(opc) {
+    case 0:
+        /* movzbl */
+        tcg_out_modrm(s, 0xb6 | P_EXT | P_REXB, TCG_REG_RSI, data_reg);
+        break;
+    case 1:
+        /* movzwl */
+        tcg_out_modrm(s, 0xb7 | P_EXT, TCG_REG_RSI, data_reg);
+        break;
+    case 2:
+        /* movl */
+        tcg_out_modrm(s, 0x8b, TCG_REG_RSI, data_reg);
+        break;
+    default:
+    case 3:
+        tcg_out_mov(s, TCG_REG_RSI, data_reg);
+        break;
+    }
+    tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_RDX, mem_index);
+    tcg_out8(s, 0xe8);
+    tcg_out32(s, (tcg_target_long)qemu_st_helpers[s_bits] - 
+              (tcg_target_long)s->code_ptr - 4);
+
+    /* jmp label2 */
+    tcg_out8(s, 0xeb);
+    label2_ptr = s->code_ptr;
+    s->code_ptr++;
+    
+    /* label1: */
+    *label1_ptr = s->code_ptr - label1_ptr - 1;
+
+    /* add x(r1), r0 */
+    tcg_out_modrm_offset(s, 0x03 | P_REXW, r0, r1, offsetof(CPUTLBEntry, addend) - 
+                         offsetof(CPUTLBEntry, addr_write));
+#else
+    r0 = addr_reg;
+#endif
+
+#ifdef TARGET_WORDS_BIGENDIAN
+    bswap = 1;
+#else
+    bswap = 0;
+#endif
+    switch(opc) {
+    case 0:
+        /* movb */
+        tcg_out_modrm_offset(s, 0x88 | P_REXB, data_reg, r0, 0);
+        break;
+    case 1:
+        if (bswap) {
+            tcg_out_modrm(s, 0x8b, r1, data_reg); /* movl */
+            tcg_out8(s, 0x66); /* rolw $8, %ecx */
+            tcg_out_modrm(s, 0xc1, 0, r1);
+            tcg_out8(s, 8);
+            data_reg = r1;
+        }
+        /* movw */
+        tcg_out8(s, 0x66);
+        tcg_out_modrm_offset(s, 0x89, data_reg, r0, 0);
+        break;
+    case 2:
+        if (bswap) {
+            tcg_out_modrm(s, 0x8b, r1, data_reg); /* movl */
+            /* bswap data_reg */
+            tcg_out_opc(s, (0xc8 + r1) | P_EXT, 0, r1, 0);
+            data_reg = r1;
+        }
+        /* movl */
+        tcg_out_modrm_offset(s, 0x89, data_reg, r0, 0);
+        break;
+    case 3:
+        if (bswap) {
+            tcg_out_mov(s, r1, data_reg);
+            /* bswap data_reg */
+            tcg_out_opc(s, (0xc8 + r1) | P_EXT | P_REXW, 0, r1, 0);
+            data_reg = r1;
+        }
+        /* movq */
+        tcg_out_modrm_offset(s, 0x89 | P_REXW, data_reg, r0, 0);
+        break;
+    default:
+        tcg_abort();
+    }
+
+#if defined(CONFIG_SOFTMMU)
+    /* label2: */
+    *label2_ptr = s->code_ptr - label2_ptr - 1;
+#endif
+}
+
+static inline void tcg_out_op(TCGContext *s, int opc, const TCGArg *args,
+                              const int *const_args)
+{
+    int c;
+    
+    switch(opc) {
+    case INDEX_op_exit_tb:
+        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_RAX, args[0]);
+        tcg_out8(s, 0xe9); /* jmp tb_ret_addr */
+        tcg_out32(s, tb_ret_addr - s->code_ptr - 4);
+        break;
+    case INDEX_op_goto_tb:
+        if (s->tb_jmp_offset) {
+            /* direct jump method */
+            tcg_out8(s, 0xe9); /* jmp im */
+            s->tb_jmp_offset[args[0]] = s->code_ptr - s->code_buf;
+            tcg_out32(s, 0);
+        } else {
+            /* indirect jump method */
+            /* jmp Ev */
+            tcg_out_modrm_offset(s, 0xff, 4, -1, 
+                                 (tcg_target_long)(s->tb_next + 
+                                                   args[0]));
+        }
+        s->tb_next_offset[args[0]] = s->code_ptr - s->code_buf;
+        break;
+    case INDEX_op_call:
+        if (const_args[0]) {
+            tcg_out8(s, 0xe8);
+            tcg_out32(s, args[0] - (tcg_target_long)s->code_ptr - 4);
+        } else {
+            tcg_out_modrm(s, 0xff, 2, args[0]);
+        }
+        break;
+    case INDEX_op_jmp:
+        if (const_args[0]) {
+            tcg_out8(s, 0xe9);
+            tcg_out32(s, args[0] - (tcg_target_long)s->code_ptr - 4);
+        } else {
+            tcg_out_modrm(s, 0xff, 4, args[0]);
+        }
+        break;
+    case INDEX_op_br:
+        tcg_out_jxx(s, JCC_JMP, args[0]);
+        break;
+    case INDEX_op_movi_i32:
+        tcg_out_movi(s, TCG_TYPE_I32, args[0], (uint32_t)args[1]);
+        break;
+    case INDEX_op_movi_i64:
+        tcg_out_movi(s, TCG_TYPE_I64, args[0], args[1]);
+        break;
+    case INDEX_op_ld8u_i32:
+    case INDEX_op_ld8u_i64:
+        /* movzbl */
+        tcg_out_modrm_offset(s, 0xb6 | P_EXT, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld8s_i32:
+        /* movsbl */
+        tcg_out_modrm_offset(s, 0xbe | P_EXT, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld8s_i64:
+        /* movsbq */
+        tcg_out_modrm_offset(s, 0xbe | P_EXT | P_REXW, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld16u_i32:
+    case INDEX_op_ld16u_i64:
+        /* movzwl */
+        tcg_out_modrm_offset(s, 0xb7 | P_EXT, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld16s_i32:
+        /* movswl */
+        tcg_out_modrm_offset(s, 0xbf | P_EXT, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld16s_i64:
+        /* movswq */
+        tcg_out_modrm_offset(s, 0xbf | P_EXT | P_REXW, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld_i32:
+    case INDEX_op_ld32u_i64:
+        /* movl */
+        tcg_out_modrm_offset(s, 0x8b, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld32s_i64:
+        /* movslq */
+        tcg_out_modrm_offset(s, 0x63 | P_REXW, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_ld_i64:
+        /* movq */
+        tcg_out_modrm_offset(s, 0x8b | P_REXW, args[0], args[1], args[2]);
+        break;
+        
+    case INDEX_op_st8_i32:
+    case INDEX_op_st8_i64:
+        /* movb */
+        tcg_out_modrm_offset(s, 0x88 | P_REXB, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_st16_i32:
+    case INDEX_op_st16_i64:
+        /* movw */
+        tcg_out8(s, 0x66);
+        tcg_out_modrm_offset(s, 0x89, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_st_i32:
+    case INDEX_op_st32_i64:
+        /* movl */
+        tcg_out_modrm_offset(s, 0x89, args[0], args[1], args[2]);
+        break;
+    case INDEX_op_st_i64:
+        /* movq */
+        tcg_out_modrm_offset(s, 0x89 | P_REXW, args[0], args[1], args[2]);
+        break;
+
+    case INDEX_op_sub_i32:
+        c = ARITH_SUB;
+        goto gen_arith32;
+    case INDEX_op_and_i32:
+        c = ARITH_AND;
+        goto gen_arith32;
+    case INDEX_op_or_i32:
+        c = ARITH_OR;
+        goto gen_arith32;
+    case INDEX_op_xor_i32:
+        c = ARITH_XOR;
+        goto gen_arith32;
+    case INDEX_op_add_i32:
+        c = ARITH_ADD;
+    gen_arith32:
+        if (const_args[2]) {
+            tgen_arithi32(s, c, args[0], args[2]);
+        } else {
+            tcg_out_modrm(s, 0x01 | (c << 3), args[2], args[0]);
+        }
+        break;
+
+    case INDEX_op_sub_i64:
+        c = ARITH_SUB;
+        goto gen_arith64;
+    case INDEX_op_and_i64:
+        c = ARITH_AND;
+        goto gen_arith64;
+    case INDEX_op_or_i64:
+        c = ARITH_OR;
+        goto gen_arith64;
+    case INDEX_op_xor_i64:
+        c = ARITH_XOR;
+        goto gen_arith64;
+    case INDEX_op_add_i64:
+        c = ARITH_ADD;
+    gen_arith64:
+        if (const_args[2]) {
+            tgen_arithi64(s, c, args[0], args[2]);
+        } else {
+            tcg_out_modrm(s, 0x01 | (c << 3) | P_REXW, args[2], args[0]);
+        }
+        break;
+
+    case INDEX_op_mul_i32:
+        if (const_args[2]) {
+            int32_t val;
+            val = args[2];
+            if (val == (int8_t)val) {
+                tcg_out_modrm(s, 0x6b, args[0], args[0]);
+                tcg_out8(s, val);
+            } else {
+                tcg_out_modrm(s, 0x69, args[0], args[0]);
+                tcg_out32(s, val);
+            }
+        } else {
+            tcg_out_modrm(s, 0xaf | P_EXT, args[0], args[2]);
+        }
+        break;
+    case INDEX_op_mul_i64:
+        if (const_args[2]) {
+            int32_t val;
+            val = args[2];
+            if (val == (int8_t)val) {
+                tcg_out_modrm(s, 0x6b | P_REXW, args[0], args[0]);
+                tcg_out8(s, val);
+            } else {
+                tcg_out_modrm(s, 0x69 | P_REXW, args[0], args[0]);
+                tcg_out32(s, val);
+            }
+        } else {
+            tcg_out_modrm(s, 0xaf | P_EXT | P_REXW, args[0], args[2]);
+        }
+        break;
+    case INDEX_op_div2_i32:
+        tcg_out_modrm(s, 0xf7, 7, args[4]);
+        break;
+    case INDEX_op_divu2_i32:
+        tcg_out_modrm(s, 0xf7, 6, args[4]);
+        break;
+    case INDEX_op_div2_i64:
+        tcg_out_modrm(s, 0xf7 | P_REXW, 7, args[4]);
+        break;
+    case INDEX_op_divu2_i64:
+        tcg_out_modrm(s, 0xf7 | P_REXW, 6, args[4]);
+        break;
+
+    case INDEX_op_shl_i32:
+        c = SHIFT_SHL;
+    gen_shift32:
+        if (const_args[2]) {
+            if (args[2] == 1) {
+                tcg_out_modrm(s, 0xd1, c, args[0]);
+            } else {
+                tcg_out_modrm(s, 0xc1, c, args[0]);
+                tcg_out8(s, args[2]);
+            }
+        } else {
+            tcg_out_modrm(s, 0xd3, c, args[0]);
+        }
+        break;
+    case INDEX_op_shr_i32:
+        c = SHIFT_SHR;
+        goto gen_shift32;
+    case INDEX_op_sar_i32:
+        c = SHIFT_SAR;
+        goto gen_shift32;
+        
+    case INDEX_op_shl_i64:
+        c = SHIFT_SHL;
+    gen_shift64:
+        if (const_args[2]) {
+            if (args[2] == 1) {
+                tcg_out_modrm(s, 0xd1 | P_REXW, c, args[0]);
+            } else {
+                tcg_out_modrm(s, 0xc1 | P_REXW, c, args[0]);
+                tcg_out8(s, args[2]);
+            }
+        } else {
+            tcg_out_modrm(s, 0xd3 | P_REXW, c, args[0]);
+        }
+        break;
+    case INDEX_op_shr_i64:
+        c = SHIFT_SHR;
+        goto gen_shift64;
+    case INDEX_op_sar_i64:
+        c = SHIFT_SAR;
+        goto gen_shift64;
+        
+    case INDEX_op_brcond_i32:
+        tcg_out_brcond(s, args[2], args[0], args[1], const_args[1], 
+                       args[3], 0);
+        break;
+    case INDEX_op_brcond_i64:
+        tcg_out_brcond(s, args[2], args[0], args[1], const_args[1], 
+                       args[3], P_REXW);
+        break;
+
+    case INDEX_op_bswap_i32:
+        tcg_out_opc(s, (0xc8 + (args[0] & 7)) | P_EXT, 0, args[0], 0);
+        break;
+    case INDEX_op_bswap_i64:
+        tcg_out_opc(s, (0xc8 + (args[0] & 7)) | P_EXT | P_REXW, 0, args[0], 0);
+        break;
+
+    case INDEX_op_neg_i32:
+        tcg_out_modrm(s, 0xf7, 3, args[0]);
+        break;
+    case INDEX_op_neg_i64:
+        tcg_out_modrm(s, 0xf7 | P_REXW, 3, args[0]);
+        break;
+
+    case INDEX_op_ext8s_i32:
+        tcg_out_modrm(s, 0xbe | P_EXT | P_REXB, args[0], args[1]);
+        break;
+    case INDEX_op_ext16s_i32:
+        tcg_out_modrm(s, 0xbf | P_EXT, args[0], args[1]);
+        break;
+    case INDEX_op_ext8s_i64:
+        tcg_out_modrm(s, 0xbe | P_EXT | P_REXW, args[0], args[1]);
+        break;
+    case INDEX_op_ext16s_i64:
+        tcg_out_modrm(s, 0xbf | P_EXT | P_REXW, args[0], args[1]);
+        break;
+    case INDEX_op_ext32s_i64:
+        tcg_out_modrm(s, 0x63 | P_REXW, args[0], args[1]);
+        break;
+
+    case INDEX_op_qemu_ld8u:
+        tcg_out_qemu_ld(s, args, 0);
+        break;
+    case INDEX_op_qemu_ld8s:
+        tcg_out_qemu_ld(s, args, 0 | 4);
+        break;
+    case INDEX_op_qemu_ld16u:
+        tcg_out_qemu_ld(s, args, 1);
+        break;
+    case INDEX_op_qemu_ld16s:
+        tcg_out_qemu_ld(s, args, 1 | 4);
+        break;
+    case INDEX_op_qemu_ld32u:
+        tcg_out_qemu_ld(s, args, 2);
+        break;
+    case INDEX_op_qemu_ld32s:
+        tcg_out_qemu_ld(s, args, 2 | 4);
+        break;
+    case INDEX_op_qemu_ld64:
+        tcg_out_qemu_ld(s, args, 3);
+        break;
+        
+    case INDEX_op_qemu_st8:
+        tcg_out_qemu_st(s, args, 0);
+        break;
+    case INDEX_op_qemu_st16:
+        tcg_out_qemu_st(s, args, 1);
+        break;
+    case INDEX_op_qemu_st32:
+        tcg_out_qemu_st(s, args, 2);
+        break;
+    case INDEX_op_qemu_st64:
+        tcg_out_qemu_st(s, args, 3);
+        break;
+
+    default:
+        tcg_abort();
+    }
+}
+
+static int tcg_target_callee_save_regs[] = {
+    TCG_REG_RBP,
+    TCG_REG_RBX,
+    TCG_REG_R12,
+    TCG_REG_R13,
+    /*    TCG_REG_R14, */ /* currently used for the global env, so no
+                             need to save */
+    TCG_REG_R15,
+};
+
+static inline void tcg_out_push(TCGContext *s, int reg)
+{
+    tcg_out_opc(s, (0x50 + (reg & 7)), 0, reg, 0);
+}
+
+static inline void tcg_out_pop(TCGContext *s, int reg)
+{
+    tcg_out_opc(s, (0x58 + (reg & 7)), 0, reg, 0);
+}
+
+/* Generate global QEMU prologue and epilogue code */
+void tcg_target_qemu_prologue(TCGContext *s)
+{
+    int i, frame_size, push_size, stack_addend;
+
+    /* TB prologue */
+    /* save all callee saved registers */
+    for(i = 0; i < ARRAY_SIZE(tcg_target_callee_save_regs); i++) {
+        tcg_out_push(s, tcg_target_callee_save_regs[i]);
+
+    }
+    /* reserve some stack space */
+    push_size = 8 + ARRAY_SIZE(tcg_target_callee_save_regs) * 8;
+    frame_size = push_size + TCG_STATIC_CALL_ARGS_SIZE;
+    frame_size = (frame_size + TCG_TARGET_STACK_ALIGN - 1) & 
+        ~(TCG_TARGET_STACK_ALIGN - 1);
+    stack_addend = frame_size - push_size;
+    tcg_out_addi(s, TCG_REG_RSP, -stack_addend);
+
+    tcg_out_modrm(s, 0xff, 4, TCG_REG_RDI); /* jmp *%rdi */
+    
+    /* TB epilogue */
+    tb_ret_addr = s->code_ptr;
+    tcg_out_addi(s, TCG_REG_RSP, stack_addend);
+    for(i = ARRAY_SIZE(tcg_target_callee_save_regs) - 1; i >= 0; i--) {
+        tcg_out_pop(s, tcg_target_callee_save_regs[i]);
+    }
+    tcg_out8(s, 0xc3); /* ret */
+}
+
+static const TCGTargetOpDef x86_64_op_defs[] = {
+    { INDEX_op_exit_tb, { } },
+    { INDEX_op_goto_tb, { } },
+    { INDEX_op_call, { "ri" } }, /* XXX: might need a specific constant constraint */
+    { INDEX_op_jmp, { "ri" } }, /* XXX: might need a specific constant constraint */
+    { INDEX_op_br, { } },
+
+    { INDEX_op_mov_i32, { "r", "r" } },
+    { INDEX_op_movi_i32, { "r" } },
+    { INDEX_op_ld8u_i32, { "r", "r" } },
+    { INDEX_op_ld8s_i32, { "r", "r" } },
+    { INDEX_op_ld16u_i32, { "r", "r" } },
+    { INDEX_op_ld16s_i32, { "r", "r" } },
+    { INDEX_op_ld_i32, { "r", "r" } },
+    { INDEX_op_st8_i32, { "r", "r" } },
+    { INDEX_op_st16_i32, { "r", "r" } },
+    { INDEX_op_st_i32, { "r", "r" } },
+
+    { INDEX_op_add_i32, { "r", "0", "ri" } },
+    { INDEX_op_mul_i32, { "r", "0", "ri" } },
+    { INDEX_op_div2_i32, { "a", "d", "0", "1", "r" } },
+    { INDEX_op_divu2_i32, { "a", "d", "0", "1", "r" } },
+    { INDEX_op_sub_i32, { "r", "0", "ri" } },
+    { INDEX_op_and_i32, { "r", "0", "ri" } },
+    { INDEX_op_or_i32, { "r", "0", "ri" } },
+    { INDEX_op_xor_i32, { "r", "0", "ri" } },
+
+    { INDEX_op_shl_i32, { "r", "0", "ci" } },
+    { INDEX_op_shr_i32, { "r", "0", "ci" } },
+    { INDEX_op_sar_i32, { "r", "0", "ci" } },
+
+    { INDEX_op_brcond_i32, { "r", "ri" } },
+
+    { INDEX_op_mov_i64, { "r", "r" } },
+    { INDEX_op_movi_i64, { "r" } },
+    { INDEX_op_ld8u_i64, { "r", "r" } },
+    { INDEX_op_ld8s_i64, { "r", "r" } },
+    { INDEX_op_ld16u_i64, { "r", "r" } },
+    { INDEX_op_ld16s_i64, { "r", "r" } },
+    { INDEX_op_ld32u_i64, { "r", "r" } },
+    { INDEX_op_ld32s_i64, { "r", "r" } },
+    { INDEX_op_ld_i64, { "r", "r" } },
+    { INDEX_op_st8_i64, { "r", "r" } },
+    { INDEX_op_st16_i64, { "r", "r" } },
+    { INDEX_op_st32_i64, { "r", "r" } },
+    { INDEX_op_st_i64, { "r", "r" } },
+
+    { INDEX_op_add_i64, { "r", "0", "re" } },
+    { INDEX_op_mul_i64, { "r", "0", "re" } },
+    { INDEX_op_div2_i64, { "a", "d", "0", "1", "r" } },
+    { INDEX_op_divu2_i64, { "a", "d", "0", "1", "r" } },
+    { INDEX_op_sub_i64, { "r", "0", "re" } },
+    { INDEX_op_and_i64, { "r", "0", "reZ" } },
+    { INDEX_op_or_i64, { "r", "0", "re" } },
+    { INDEX_op_xor_i64, { "r", "0", "re" } },
+
+    { INDEX_op_shl_i64, { "r", "0", "ci" } },
+    { INDEX_op_shr_i64, { "r", "0", "ci" } },
+    { INDEX_op_sar_i64, { "r", "0", "ci" } },
+
+    { INDEX_op_brcond_i64, { "r", "re" } },
+
+    { INDEX_op_bswap_i32, { "r", "0" } },
+    { INDEX_op_bswap_i64, { "r", "0" } },
+
+    { INDEX_op_neg_i32, { "r", "0" } },
+    { INDEX_op_neg_i64, { "r", "0" } },
+
+    { INDEX_op_ext8s_i32, { "r", "r"} },
+    { INDEX_op_ext16s_i32, { "r", "r"} },
+    { INDEX_op_ext8s_i64, { "r", "r"} },
+    { INDEX_op_ext16s_i64, { "r", "r"} },
+    { INDEX_op_ext32s_i64, { "r", "r"} },
+
+    { INDEX_op_qemu_ld8u, { "r", "L" } },
+    { INDEX_op_qemu_ld8s, { "r", "L" } },
+    { INDEX_op_qemu_ld16u, { "r", "L" } },
+    { INDEX_op_qemu_ld16s, { "r", "L" } },
+    { INDEX_op_qemu_ld32u, { "r", "L" } },
+    { INDEX_op_qemu_ld32s, { "r", "L" } },
+    { INDEX_op_qemu_ld64, { "r", "L" } },
+
+    { INDEX_op_qemu_st8, { "L", "L" } },
+    { INDEX_op_qemu_st16, { "L", "L" } },
+    { INDEX_op_qemu_st32, { "L", "L" } },
+    { INDEX_op_qemu_st64, { "L", "L", "L" } },
+
+    { -1 },
+};
+
+void tcg_target_init(TCGContext *s)
+{
+    /* fail safe */
+    if ((1 << CPU_TLB_ENTRY_BITS) != sizeof(CPUTLBEntry))
+        tcg_abort();
+
+    tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I32], 0, 0xffff);
+    tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I64], 0, 0xffff);
+    tcg_regset_set32(tcg_target_call_clobber_regs, 0,
+                     (1 << TCG_REG_RDI) | 
+                     (1 << TCG_REG_RSI) | 
+                     (1 << TCG_REG_RDX) |
+                     (1 << TCG_REG_RCX) |
+                     (1 << TCG_REG_R8) |
+                     (1 << TCG_REG_R9) |
+                     (1 << TCG_REG_RAX) |
+                     (1 << TCG_REG_R10) |
+                     (1 << TCG_REG_R11));
+    
+    tcg_regset_clear(s->reserved_regs);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_RSP);
+
+    tcg_add_target_add_op_defs(x86_64_op_defs);
+}
diff --git a/tcg/x86_64/tcg-target.h b/tcg/x86_64/tcg-target.h
new file mode 100644
index 0000000..9a0cca0
--- /dev/null
+++ b/tcg/x86_64/tcg-target.h
@@ -0,0 +1,77 @@
+/*
+ * Tiny Code Generator for QEMU
+ *
+ * Copyright (c) 2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#define TCG_TARGET_X86_64 1
+
+#define TCG_TARGET_REG_BITS 64
+//#define TCG_TARGET_WORDS_BIGENDIAN
+
+#define TCG_TARGET_NB_REGS 16
+
+enum {
+    TCG_REG_RAX = 0,
+    TCG_REG_RCX,
+    TCG_REG_RDX,
+    TCG_REG_RBX,
+    TCG_REG_RSP,
+    TCG_REG_RBP,
+    TCG_REG_RSI,
+    TCG_REG_RDI,
+    TCG_REG_R8,
+    TCG_REG_R9,
+    TCG_REG_R10,
+    TCG_REG_R11,
+    TCG_REG_R12,
+    TCG_REG_R13,
+    TCG_REG_R14,
+    TCG_REG_R15,
+};
+
+#define TCG_CT_CONST_S32 0x100
+#define TCG_CT_CONST_U32 0x200
+
+/* used for function call generation */
+#define TCG_REG_CALL_STACK TCG_REG_RSP 
+#define TCG_TARGET_STACK_ALIGN 16
+#define TCG_TARGET_CALL_STACK_OFFSET 0
+
+/* optional instructions */
+#define TCG_TARGET_HAS_bswap_i32
+#define TCG_TARGET_HAS_bswap_i64
+#define TCG_TARGET_HAS_neg_i32
+#define TCG_TARGET_HAS_neg_i64
+#define TCG_TARGET_HAS_ext8s_i32
+#define TCG_TARGET_HAS_ext16s_i32
+#define TCG_TARGET_HAS_ext8s_i64
+#define TCG_TARGET_HAS_ext16s_i64
+#define TCG_TARGET_HAS_ext32s_i64
+
+/* Note: must be synced with dyngen-exec.h */
+#define TCG_AREG0 TCG_REG_R14
+#define TCG_AREG1 TCG_REG_R15
+#define TCG_AREG2 TCG_REG_R12
+#define TCG_AREG3 TCG_REG_R13
+
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
+{
+}
diff --git a/telephony/android_modem.c b/telephony/android_modem.c
index 2321c87..79e93b2 100644
--- a/telephony/android_modem.c
+++ b/telephony/android_modem.c
@@ -9,9 +9,11 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "android.h"
+#include "android/android.h"
 #include "android_modem.h"
-#include "android_timezone.h"
+#include "android/utils/debug.h"
+#include "android/utils/timezone.h"
+#include "android/utils/system.h"
 #include "sim_card.h"
 #include "sysdeps.h"
 #include <memory.h>
@@ -21,7 +23,6 @@
 #include <stdio.h>
 #include "sms.h"
 #include "remote_call.h"
-#include "vl.h"
 
 #define  DEBUG  1
 
diff --git a/telephony/modem_driver.c b/telephony/modem_driver.c
index 7de475f..99bbe6c 100644
--- a/telephony/modem_driver.c
+++ b/telephony/modem_driver.c
@@ -14,6 +14,7 @@
  * on the emulated device.
  */
 #include "modem_driver.h"
+#include "qemu-char.h"
 
 #define  xxDEBUG
 
@@ -107,7 +108,7 @@ modem_driver_read( void*  _md, const uint8_t*  src, int  len )
                     md->in_sms = 1;
 
                 qemu_chr_write(md->cs, (const uint8_t*)answer, len);
-                qemu_chr_write(md->cs, "\r", 1);
+                qemu_chr_write(md->cs, (const uint8_t*)"\r", 1);
             } else
                 D( "%s: -- NO ANSWER\n", __FUNCTION__ );
 
@@ -132,7 +133,7 @@ modem_driver_init( int  base_port, ModemDriver*  dm, CharDriverState*  cs )
     dm->in_sms = 0;
     dm->modem  = amodem_create( base_port, modem_driver_unsol, dm );
 
-    qemu_chr_add_read_handler( cs, modem_driver_can_read, modem_driver_read, dm );
+    qemu_chr_add_handlers( cs, modem_driver_can_read, modem_driver_read, NULL, dm );
 }
 
 
diff --git a/telephony/modem_driver.h b/telephony/modem_driver.h
index 9acf23f..d03010f 100644
--- a/telephony/modem_driver.h
+++ b/telephony/modem_driver.h
@@ -13,7 +13,7 @@
 #define _modem_driver_h
 
 #include "android_modem.h"
-#include "vl.h"
+#include "qemu-common.h"
 
 /** in telephony/modem_driver.c */
 /* this is the internal character driver used to communicate with the
diff --git a/telephony/remote_call.c b/telephony/remote_call.c
index 2bd5fa8..927e11d 100644
--- a/telephony/remote_call.c
+++ b/telephony/remote_call.c
@@ -10,10 +10,11 @@
 ** GNU General Public License for more details.
 */
 #include "remote_call.h"
-#include "android_utils.h"
+#include "android/utils/bufprint.h"
+#include "android/utils/debug.h"
 #include "sysdeps.h"
 #include "gsm.h"
-#include "android.h"
+#include "android/android.h"
 #include "sockets.h"
 #include <stdlib.h>
 
diff --git a/telephony/sms.c b/telephony/sms.c
index 7a394d4..448eab4 100644
--- a/telephony/sms.c
+++ b/telephony/sms.c
@@ -18,7 +18,7 @@
 #define  DEBUG  1
 
 #if 1
-#  include "android_debug.h"
+#  include "android/utils/debug.h"
 #  define  D_ACTIVE  VERBOSE_CHECK(modem)
 #else
 #  define  D_ACTIVE  DEBUG
diff --git a/telephony/sysdeps_qemu.c b/telephony/sysdeps_qemu.c
index 39d966e..ec0b3f5 100644
--- a/telephony/sysdeps_qemu.c
+++ b/telephony/sysdeps_qemu.c
@@ -11,7 +11,17 @@
 */
 #include "sockets.h"
 #include "sysdeps.h"
-#include "vl.h"
+#include "qemu-timer.h"
+#ifdef _WIN32
+#include <winsock2.h>
+#else
+#include <sys/socket.h>
+#include <sys/select.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <netdb.h>
+#endif
 
 #define  DEBUG  1
 
@@ -337,7 +347,7 @@ sys_channel_create_tcp_handler( SysChannel  server_channel )
     }
 
     /* disable Nagle algorithm */
-    socket_set_lowlatency( channel->fd );
+    socket_set_nodelay( channel->fd );
 
     D( "%s: handler %p:%d created from server %p:%d\n", __FUNCTION__,
         server_channel, server_channel->fd, channel, channel->fd );
@@ -359,7 +369,7 @@ sys_channel_create_tcp_client( const char*  hostname, int  port )
 
     /* set to non-blocking and disable Nagle algorithm */
     socket_set_nonblock( channel->fd );
-    socket_set_lowlatency( channel->fd );
+    socket_set_nodelay( channel->fd );
 
     return channel;
 }
diff --git a/tests/Makefile b/tests/Makefile
deleted file mode 100644
index d7abae6..0000000
--- a/tests/Makefile
+++ /dev/null
@@ -1,93 +0,0 @@
--include ../config-host.mak
-
-CFLAGS=-Wall -O2 -g
-#CFLAGS+=-msse2
-LDFLAGS=
-
-ifeq ($(ARCH),i386)
-TESTS=linux-test testthread sha1-i386 test-i386 runcom
-endif
-ifeq ($(ARCH),x86_64)
-TESTS=test-x86_64
-endif
-TESTS+=sha1# test_path
-#TESTS+=test_path
-
-QEMU=../i386-user/qemu-i386
-
-all: $(TESTS)
-
-hello-i386: hello-i386.c
-	$(CC) -nostdlib $(CFLAGS) -static $(LDFLAGS) -o $@ $<
-	strip $@
-
-testthread: testthread.c
-	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< -lpthread
-
-test_path: test_path.c
-	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $<
-	./$@ || { rm $@; exit 1; }
-
-# i386/x86_64 emulation test (test various opcodes) */
-test-i386: test-i386.c test-i386-code16.S test-i386-vm86.S \
-           test-i386.h test-i386-shift.h test-i386-muldiv.h
-	$(CC) $(CFLAGS) $(LDFLAGS) -static -o $@ \
-              test-i386.c test-i386-code16.S test-i386-vm86.S -lm
-
-test-x86_64: test-i386.c \
-           test-i386.h test-i386-shift.h test-i386-muldiv.h
-	$(CC) $(CFLAGS) $(LDFLAGS) -static -o $@ test-i386.c -lm
-
-ifeq ($(ARCH),i386)
-test: test-i386
-	./test-i386 > test-i386.ref
-else
-test:
-endif
-	$(QEMU) test-i386 > test-i386.out
-	@if diff -u test-i386.ref test-i386.out ; then echo "Auto Test OK"; fi
-ifeq ($(ARCH),i386)
-	$(QEMU) -no-code-copy test-i386 > test-i386.out
-	@if diff -u test-i386.ref test-i386.out ; then echo "Auto Test OK (no code copy)"; fi
-endif
-
-# generic Linux and CPU test
-linux-test: linux-test.c
-	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< -lm
-
-# speed test
-sha1-i386: sha1.c
-	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $<
-
-sha1: sha1.c
-	$(HOST_CC) $(CFLAGS) $(LDFLAGS) -o $@ $<
-
-speed: sha1 sha1-i386
-	time ./sha1
-	time $(QEMU) ./sha1-i386
-
-# vm86 test
-runcom: runcom.c
-	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $<
-
-# NOTE: -fomit-frame-pointer is currently needed : this is a bug in libqemu
-qruncom: qruncom.c ../i386-user/libqemu.a
-	$(CC) $(CFLAGS) -fomit-frame-pointer $(LDFLAGS) -I../target-i386 -I.. -I../i386-user -I../fpu \
-              -o $@ $< -L../i386-user -lqemu -lm
-
-# arm test
-hello-arm: hello-arm.o
-	arm-linux-ld -o $@ $<
-
-hello-arm.o: hello-arm.c
-	arm-linux-gcc -Wall -g -O2 -c -o $@ $<
-
-# XXX: find a way to compile easily a test for each arch
-test2:
-	@for arch in i386 arm armeb sparc ppc mips mipsel; do \
-           ../$${arch}-user/qemu-$${arch} $${arch}/ls -l linux-test.c ; \
-        done
-
-clean:
-	rm -f *~ *.o test-i386.out test-i386.ref \
-           test-x86_64.log test-x86_64.ref qruncom $(TESTS)
diff --git a/tests/hello-arm.c b/tests/hello-arm.c
deleted file mode 100644
index f84e6cb..0000000
--- a/tests/hello-arm.c
+++ /dev/null
@@ -1,113 +0,0 @@
-#define __NR_SYSCALL_BASE	0x900000
-#define __NR_exit1			(__NR_SYSCALL_BASE+  1)
-#define __NR_write			(__NR_SYSCALL_BASE+  4)
-
-#define __sys2(x) #x
-#define __sys1(x) __sys2(x)
-
-#ifndef __syscall
-#define __syscall(name) "swi\t" __sys1(__NR_##name) "\n\t"
-#endif
-
-#define __syscall_return(type, res)					\
-do {									\
-	return (type) (res);						\
-} while (0)
-
-#define _syscall0(type,name)						\
-type name(void) {							\
-  long __res;								\
-  __asm__ __volatile__ (						\
-  __syscall(name)							\
-  "mov %0,r0"								\
-  :"=r" (__res) : : "r0","lr");						\
-  __syscall_return(type,__res);						\
-}
-
-#define _syscall1(type,name,type1,arg1)					\
-type name(type1 arg1) {							\
-  long __res;								\
-  __asm__ __volatile__ (						\
-  "mov\tr0,%1\n\t"							\
-  __syscall(name)							\
-  "mov %0,r0"								\
-        : "=r" (__res)							\
-        : "r" ((long)(arg1))						\
-	: "r0","lr");							\
-  __syscall_return(type,__res);						\
-}
-
-#define _syscall2(type,name,type1,arg1,type2,arg2)			\
-type name(type1 arg1,type2 arg2) {					\
-  long __res;								\
-  __asm__ __volatile__ (						\
-  "mov\tr0,%1\n\t"							\
-  "mov\tr1,%2\n\t"							\
-  __syscall(name)							\
-  "mov\t%0,r0"								\
-        : "=r" (__res)							\
-        : "r" ((long)(arg1)),"r" ((long)(arg2))				\
-	: "r0","r1","lr");						\
-  __syscall_return(type,__res);						\
-}
-
-
-#define _syscall3(type,name,type1,arg1,type2,arg2,type3,arg3)		\
-type name(type1 arg1,type2 arg2,type3 arg3) {				\
-  long __res;								\
-  __asm__ __volatile__ (						\
-  "mov\tr0,%1\n\t"							\
-  "mov\tr1,%2\n\t"							\
-  "mov\tr2,%3\n\t"							\
-  __syscall(name)							\
-  "mov\t%0,r0"								\
-        : "=r" (__res)							\
-        : "r" ((long)(arg1)),"r" ((long)(arg2)),"r" ((long)(arg3))	\
-        : "r0","r1","r2","lr");						\
-  __syscall_return(type,__res);						\
-}
-
-
-#define _syscall4(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4)		\
-type name(type1 arg1, type2 arg2, type3 arg3, type4 arg4) {				\
-  long __res;										\
-  __asm__ __volatile__ (								\
-  "mov\tr0,%1\n\t"									\
-  "mov\tr1,%2\n\t"									\
-  "mov\tr2,%3\n\t"									\
-  "mov\tr3,%4\n\t"									\
-  __syscall(name)									\
-  "mov\t%0,r0"										\
-  	: "=r" (__res)									\
-  	: "r" ((long)(arg1)),"r" ((long)(arg2)),"r" ((long)(arg3)),"r" ((long)(arg4))	\
-  	: "r0","r1","r2","r3","lr");							\
-  __syscall_return(type,__res);								\
-}
-  
-
-#define _syscall5(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,type5,arg5)	\
-type name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, type5 arg5) {			\
-  long __res;										\
-  __asm__ __volatile__ (								\
-  "mov\tr0,%1\n\t"									\
-  "mov\tr1,%2\n\t"									\
-  "mov\tr2,%3\n\t"									\
-  "mov\tr3,%4\n\t"									\
-  "mov\tr4,%5\n\t"									\
-  __syscall(name)									\
-  "mov\t%0,r0"										\
-  	: "=r" (__res)									\
-  	: "r" ((long)(arg1)),"r" ((long)(arg2)),"r" ((long)(arg3)),"r" ((long)(arg4)),	\
-	  "r" ((long)(arg5))								\
-	: "r0","r1","r2","r3","r4","lr");						\
-  __syscall_return(type,__res);								\
-}
-
-_syscall1(int,exit1,int,status);
-_syscall3(int,write,int,fd,const char *,buf, int, len);
-
-void _start(void)
-{
-    write(1, "Hello World\n", 12);
-    exit1(0);
-}
diff --git a/tests/hello-i386.c b/tests/hello-i386.c
deleted file mode 100644
index e00245d..0000000
--- a/tests/hello-i386.c
+++ /dev/null
@@ -1,26 +0,0 @@
-#include <asm/unistd.h>
-
-extern inline volatile void exit(int status)
-{
-  int __res;
-  __asm__ volatile ("movl %%ecx,%%ebx\n"\
-		    "int $0x80" \
-		    :  "=a" (__res) : "0" (__NR_exit),"c" ((long)(status)));
-}
-
-extern inline int write(int fd, const char * buf, int len)
-{
-  int status;
-  __asm__ volatile ("pushl %%ebx\n"\
-		    "movl %%esi,%%ebx\n"\
-		    "int $0x80\n" \
-		    "popl %%ebx\n"\
-		    : "=a" (status) \
-		    : "0" (__NR_write),"S" ((long)(fd)),"c" ((long)(buf)),"d" ((long)(len)));
-}
-
-void _start(void)
-{
-    write(1, "Hello World\n", 12);
-    exit(0);
-}
diff --git a/tests/linux-test.c b/tests/linux-test.c
deleted file mode 100644
index 6ca9029..0000000
--- a/tests/linux-test.c
+++ /dev/null
@@ -1,536 +0,0 @@
-/*
- *  linux and CPU test
- * 
- *  Copyright (c) 2003 Fabrice Bellard
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-#include <stdarg.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <inttypes.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/wait.h>
-#include <errno.h>
-#include <utime.h>
-#include <time.h>
-#include <sys/time.h>
-#include <sys/uio.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <sched.h>
-#include <dirent.h>
-#include <setjmp.h>
-#include <sys/shm.h>
-
-#define TESTPATH "/tmp/linux-test.tmp"
-#define TESTPORT 7654
-#define STACK_SIZE 16384
-
-void error1(const char *filename, int line, const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
-    fprintf(stderr, "%s:%d: ", filename, line);
-    vfprintf(stderr, fmt, ap);
-    fprintf(stderr, "\n");
-    va_end(ap);
-    exit(1);
-}
-
-int __chk_error(const char *filename, int line, int ret)
-{
-    if (ret < 0) {
-        error1(filename, line, "%m (ret=%d, errno=%d)", 
-               ret, errno);
-    }
-    return ret;
-}
-
-#define error(fmt, args...) error1(__FILE__, __LINE__, fmt, ##args)
-
-#define chk_error(ret) __chk_error(__FILE__, __LINE__, (ret))
-
-/*******************************************************/
-
-#define FILE_BUF_SIZE 300
-
-void test_file(void)
-{
-    int fd, i, len, ret;
-    uint8_t buf[FILE_BUF_SIZE];
-    uint8_t buf2[FILE_BUF_SIZE];
-    uint8_t buf3[FILE_BUF_SIZE];
-    char cur_dir[1024];
-    struct stat st;
-    struct utimbuf tbuf;
-    struct iovec vecs[2];
-    DIR *dir;
-    struct dirent *de;
-
-    /* clean up, just in case */
-    unlink(TESTPATH "/file1");
-    unlink(TESTPATH "/file2");
-    unlink(TESTPATH "/file3");
-    rmdir(TESTPATH);
-
-    if (getcwd(cur_dir, sizeof(cur_dir)) == NULL)
-        error("getcwd");
-    
-    chk_error(mkdir(TESTPATH, 0755));
-    
-    chk_error(chdir(TESTPATH));
-    
-    /* open/read/write/close/readv/writev/lseek */
-
-    fd = chk_error(open("file1", O_WRONLY | O_TRUNC | O_CREAT, 0644));
-    for(i=0;i < FILE_BUF_SIZE; i++)
-        buf[i] = i;
-    len = chk_error(write(fd, buf, FILE_BUF_SIZE / 2));
-    if (len != (FILE_BUF_SIZE / 2))
-        error("write");
-    vecs[0].iov_base = buf + (FILE_BUF_SIZE / 2);
-    vecs[0].iov_len = 16;
-    vecs[1].iov_base = buf + (FILE_BUF_SIZE / 2) + 16;
-    vecs[1].iov_len = (FILE_BUF_SIZE / 2) - 16;
-    len = chk_error(writev(fd, vecs, 2));
-    if (len != (FILE_BUF_SIZE / 2))
-     error("writev");
-    chk_error(close(fd));
-
-    chk_error(rename("file1", "file2"));
-
-    fd = chk_error(open("file2", O_RDONLY));
-
-    len = chk_error(read(fd, buf2, FILE_BUF_SIZE));
-    if (len != FILE_BUF_SIZE)
-        error("read");
-    if (memcmp(buf, buf2, FILE_BUF_SIZE) != 0)
-        error("memcmp");
-    
-#define FOFFSET 16
-    ret = chk_error(lseek(fd, FOFFSET, SEEK_SET));
-    if (ret != 16)
-        error("lseek");
-    vecs[0].iov_base = buf3;
-    vecs[0].iov_len = 32;
-    vecs[1].iov_base = buf3 + 32;
-    vecs[1].iov_len = FILE_BUF_SIZE - FOFFSET - 32;
-    len = chk_error(readv(fd, vecs, 2));
-    if (len != FILE_BUF_SIZE - FOFFSET)
-        error("readv");
-    if (memcmp(buf + FOFFSET, buf3, FILE_BUF_SIZE - FOFFSET) != 0)
-        error("memcmp");
-    
-    chk_error(close(fd));
-
-    /* access */
-    chk_error(access("file2", R_OK));
-
-    /* stat/chmod/utime/truncate */
-
-    chk_error(chmod("file2", 0600));
-    tbuf.actime = 1001;
-    tbuf.modtime = 1000;
-    chk_error(truncate("file2", 100));
-    chk_error(utime("file2", &tbuf));
-    chk_error(stat("file2", &st));
-    if (st.st_size != 100)
-        error("stat size");
-    if (!S_ISREG(st.st_mode))
-        error("stat mode");
-    if ((st.st_mode & 0777) != 0600)
-        error("stat mode2");
-    if (st.st_atime != 1001 ||
-        st.st_mtime != 1000)
-        error("stat time");
-
-    chk_error(stat(TESTPATH, &st));
-    if (!S_ISDIR(st.st_mode))
-        error("stat mode");
-
-    /* fstat */
-    fd = chk_error(open("file2", O_RDWR));
-    chk_error(ftruncate(fd, 50));
-    chk_error(fstat(fd, &st));
-    chk_error(close(fd));
-    
-    if (st.st_size != 50)
-        error("stat size");
-    if (!S_ISREG(st.st_mode))
-        error("stat mode");
-    
-    /* symlink/lstat */
-    chk_error(symlink("file2", "file3"));
-    chk_error(lstat("file3", &st));
-    if (!S_ISLNK(st.st_mode))
-        error("stat mode");
-    
-    /* getdents */
-    dir = opendir(TESTPATH);
-    if (!dir)
-        error("opendir");
-    len = 0;
-    for(;;) {
-        de = readdir(dir);
-        if (!de)
-            break;
-        if (strcmp(de->d_name, ".") != 0 &&
-            strcmp(de->d_name, "..") != 0 &&
-            strcmp(de->d_name, "file2") != 0 &&
-            strcmp(de->d_name, "file3") != 0)
-            error("readdir");
-        len++;
-    }
-    closedir(dir);
-    if (len != 4)
-        error("readdir");
-
-    chk_error(unlink("file3"));
-    chk_error(unlink("file2"));
-    chk_error(chdir(cur_dir));
-    chk_error(rmdir(TESTPATH));
-}
-
-void test_fork(void)
-{
-    int pid, status;
-
-    pid = chk_error(fork());
-    if (pid == 0) {
-        /* child */
-        exit(2);
-    }
-    chk_error(waitpid(pid, &status, 0));
-    if (!WIFEXITED(status) || WEXITSTATUS(status) != 2)
-        error("waitpid status=0x%x", status);
-}
-
-void test_time(void)
-{
-    struct timeval tv, tv2;
-    struct timespec ts, rem;
-    struct rusage rusg1, rusg2;
-    int ti, i;
-
-    chk_error(gettimeofday(&tv, NULL));
-    rem.tv_sec = 1;
-    ts.tv_sec = 0;
-    ts.tv_nsec = 20 * 1000000;
-    chk_error(nanosleep(&ts, &rem));
-    if (rem.tv_sec != 1)
-        error("nanosleep");
-    chk_error(gettimeofday(&tv2, NULL));
-    ti = tv2.tv_sec - tv.tv_sec;
-    if (ti >= 2)
-        error("gettimeofday");
-    
-    chk_error(getrusage(RUSAGE_SELF, &rusg1));
-    for(i = 0;i < 10000; i++);
-    chk_error(getrusage(RUSAGE_SELF, &rusg2));
-    if ((rusg2.ru_utime.tv_sec - rusg1.ru_utime.tv_sec) < 0 ||
-        (rusg2.ru_stime.tv_sec - rusg1.ru_stime.tv_sec) < 0)
-        error("getrusage");
-}
-
-void pstrcpy(char *buf, int buf_size, const char *str)
-{
-    int c;
-    char *q = buf;
-
-    if (buf_size <= 0)
-        return;
-
-    for(;;) {
-        c = *str++;
-        if (c == 0 || q >= buf + buf_size - 1)
-            break;
-        *q++ = c;
-    }
-    *q = '\0';
-}
-
-/* strcat and truncate. */
-char *pstrcat(char *buf, int buf_size, const char *s)
-{
-    int len;
-    len = strlen(buf);
-    if (len < buf_size) 
-        pstrcpy(buf + len, buf_size - len, s);
-    return buf;
-}
-
-int server_socket(void)
-{
-    int val, fd;
-    struct sockaddr_in sockaddr;
-
-    /* server socket */
-    fd = chk_error(socket(PF_INET, SOCK_STREAM, 0));
-
-    val = 1;
-    chk_error(setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val)));
-
-    sockaddr.sin_family = AF_INET;
-    sockaddr.sin_port = htons(TESTPORT);
-    sockaddr.sin_addr.s_addr = 0;
-    chk_error(bind(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr)));
-    chk_error(listen(fd, 0));
-    return fd;
-
-}
-
-int client_socket(void)
-{
-    int fd;
-    struct sockaddr_in sockaddr;
-
-    /* server socket */
-    fd = chk_error(socket(PF_INET, SOCK_STREAM, 0));
-    sockaddr.sin_family = AF_INET;
-    sockaddr.sin_port = htons(TESTPORT);
-    inet_aton("127.0.0.1", &sockaddr.sin_addr);
-    chk_error(connect(fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr)));
-    return fd;
-}
-
-const char socket_msg[] = "hello socket\n";
-
-void test_socket(void)
-{
-    int server_fd, client_fd, fd, pid, ret, val;
-    struct sockaddr_in sockaddr;
-    socklen_t len;
-    char buf[512];
-
-    server_fd = server_socket();
-
-    /* test a few socket options */
-    len = sizeof(val);
-    chk_error(getsockopt(server_fd, SOL_SOCKET, SO_TYPE, &val, &len));
-    if (val != SOCK_STREAM)
-        error("getsockopt");
-    
-    pid = chk_error(fork());
-    if (pid == 0) {
-        client_fd = client_socket();
-        send(client_fd, socket_msg, sizeof(socket_msg), 0);
-        close(client_fd);
-        exit(0);
-    }
-    len = sizeof(sockaddr);
-    fd = chk_error(accept(server_fd, (struct sockaddr *)&sockaddr, &len));
-
-    ret = chk_error(recv(fd, buf, sizeof(buf), 0));
-    if (ret != sizeof(socket_msg))
-        error("recv");
-    if (memcmp(buf, socket_msg, sizeof(socket_msg)) != 0)
-        error("socket_msg");
-    chk_error(close(fd));
-    chk_error(close(server_fd));
-}
-
-#define WCOUNT_MAX 512
-
-void test_pipe(void)
-{
-    fd_set rfds, wfds;
-    int fds[2], fd_max, ret;
-    uint8_t ch;
-    int wcount, rcount;
-
-    chk_error(pipe(fds));
-    chk_error(fcntl(fds[0], F_SETFL, O_NONBLOCK));
-    chk_error(fcntl(fds[1], F_SETFL, O_NONBLOCK));
-    wcount = 0;
-    rcount = 0;
-    for(;;) {
-        FD_ZERO(&rfds);
-        fd_max = fds[0];
-        FD_SET(fds[0], &rfds);
-
-        FD_ZERO(&wfds);
-        FD_SET(fds[1], &wfds);
-        if (fds[1] > fd_max)
-            fd_max = fds[1];
-
-        ret = chk_error(select(fd_max + 1, &rfds, &wfds, NULL, NULL));
-        if (ret > 0) {
-            if (FD_ISSET(fds[0], &rfds)) {
-                chk_error(read(fds[0], &ch, 1));
-                rcount++;
-                if (rcount >= WCOUNT_MAX)
-                    break;
-            }
-            if (FD_ISSET(fds[1], &wfds)) {
-                ch = 'a';
-                chk_error(write(fds[0], &ch, 1));
-                wcount++;
-            }
-        }
-    }
-    chk_error(close(fds[0]));
-    chk_error(close(fds[1]));
-}
-
-int thread1_res;
-int thread2_res;
-
-int thread1_func(void *arg)
-{
-    int i;
-    for(i=0;i<5;i++) {
-        thread1_res++;
-        usleep(10 * 1000);
-    }
-    return 0;
-}
-
-int thread2_func(void *arg)
-{
-    int i;
-    for(i=0;i<6;i++) {
-        thread2_res++;
-        usleep(10 * 1000);
-    }
-    return 0;
-}
-
-void test_clone(void)
-{
-    uint8_t *stack1, *stack2;
-    int pid1, pid2, status1, status2;
-
-    stack1 = malloc(STACK_SIZE);
-    pid1 = chk_error(clone(thread1_func, stack1 + STACK_SIZE, 
-                           CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, "hello1"));
-
-    stack2 = malloc(STACK_SIZE);
-    pid2 = chk_error(clone(thread2_func, stack2 + STACK_SIZE, 
-                           CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, "hello2"));
-
-    while (waitpid(pid1, &status1, 0) != pid1);
-    while (waitpid(pid2, &status2, 0) != pid2);
-    if (thread1_res != 5 ||
-        thread2_res != 6)
-        error("clone");
-}
-
-/***********************************/
-
-volatile int alarm_count;
-jmp_buf jmp_env;
-
-void sig_alarm(int sig)
-{
-    if (sig != SIGALRM)
-        error("signal");
-    alarm_count++;
-}
-
-void sig_segv(int sig, siginfo_t *info, void *puc)
-{
-    if (sig != SIGSEGV)
-        error("signal");
-    longjmp(jmp_env, 1);
-}
-
-void test_signal(void)
-{
-    struct sigaction act;
-    struct itimerval it, oit;
-
-    /* timer test */
-
-    alarm_count = 0;
-
-    act.sa_handler = sig_alarm;
-    sigemptyset(&act.sa_mask);
-    act.sa_flags = 0;
-    chk_error(sigaction(SIGALRM, &act, NULL));
-    
-    it.it_interval.tv_sec = 0;
-    it.it_interval.tv_usec = 10 * 1000;
-    it.it_value.tv_sec = 0;
-    it.it_value.tv_usec = 10 * 1000;
-    chk_error(setitimer(ITIMER_REAL, &it, NULL));
-    chk_error(getitimer(ITIMER_REAL, &oit));
-    if (oit.it_value.tv_sec != it.it_value.tv_sec ||
-        oit.it_value.tv_usec != it.it_value.tv_usec)
-        error("itimer");
-    
-    while (alarm_count < 5) {
-        usleep(10 * 1000);
-    }
-
-    it.it_interval.tv_sec = 0;
-    it.it_interval.tv_usec = 0;
-    it.it_value.tv_sec = 0;
-    it.it_value.tv_usec = 0;
-    memset(&oit, 0xff, sizeof(oit));
-    chk_error(setitimer(ITIMER_REAL, &it, &oit));
-    if (oit.it_value.tv_sec != 0 ||
-        oit.it_value.tv_usec != 10 * 1000)
-        error("setitimer");
-
-    /* SIGSEGV test */
-    act.sa_sigaction = sig_segv;
-    sigemptyset(&act.sa_mask);
-    act.sa_flags = SA_SIGINFO;
-    chk_error(sigaction(SIGSEGV, &act, NULL));
-    if (setjmp(jmp_env) == 0) {
-        *(uint8_t *)0 = 0;
-    }
-    
-    act.sa_handler = SIG_DFL;
-    sigemptyset(&act.sa_mask);
-    act.sa_flags = 0;
-    chk_error(sigaction(SIGSEGV, &act, NULL));
-}
-
-#define SHM_SIZE 32768
-
-void test_shm(void)
-{
-    void *ptr;
-    int shmid;
-
-    shmid = chk_error(shmget(IPC_PRIVATE, SHM_SIZE, IPC_CREAT | 0777));
-    ptr = shmat(shmid, NULL, 0);
-    if (!ptr)
-        error("shmat");
-
-    memset(ptr, 0, SHM_SIZE);
-
-    chk_error(shmctl(shmid, IPC_RMID, 0));
-    chk_error(shmdt(ptr));
-}
-
-int main(int argc, char **argv)
-{
-    test_file();
-    test_fork();
-    test_time();
-    test_socket();
-    //    test_clone();
-    test_signal();
-    test_shm();
-    return 0;
-}
diff --git a/tests/pi_10.com b/tests/pi_10.com
deleted file mode 100644
index 8993ba1..0000000
--- a/tests/pi_10.com
+++ /dev/null
diff --git a/tests/qruncom.c b/tests/qruncom.c
deleted file mode 100644
index 8130a81..0000000
--- a/tests/qruncom.c
+++ /dev/null
@@ -1,327 +0,0 @@
-/*
- * Example of use of user mode libqemu: launch a basic .com DOS
- * executable
- */
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <inttypes.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <sys/mman.h>
-#include <signal.h>
-#include <malloc.h>
-
-#include "cpu.h"
-
-//#define SIGTEST
-
-void cpu_outb(CPUState *env, int addr, int val)
-{
-    fprintf(stderr, "outb: port=0x%04x, data=%02x\n", addr, val);
-}
-
-void cpu_outw(CPUState *env, int addr, int val)
-{
-    fprintf(stderr, "outw: port=0x%04x, data=%04x\n", addr, val);
-}
-
-void cpu_outl(CPUState *env, int addr, int val)
-{
-    fprintf(stderr, "outl: port=0x%04x, data=%08x\n", addr, val);
-}
-
-int cpu_inb(CPUState *env, int addr)
-{
-    fprintf(stderr, "inb: port=0x%04x\n", addr);
-    return 0;
-}
-
-int cpu_inw(CPUState *env, int addr)
-{
-    fprintf(stderr, "inw: port=0x%04x\n", addr);
-    return 0;
-}
-
-int cpu_inl(CPUState *env, int addr)
-{
-    fprintf(stderr, "inl: port=0x%04x\n", addr);
-    return 0;
-}
-
-int cpu_get_pic_interrupt(CPUState *env)
-{
-    return -1;
-}
-
-uint64_t cpu_get_tsc(CPUState *env)
-{
-    return 0;
-}
-
-static void set_gate(void *ptr, unsigned int type, unsigned int dpl,
-                     unsigned long addr, unsigned int sel)
-{
-    unsigned int e1, e2;
-    e1 = (addr & 0xffff) | (sel << 16);
-    e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);
-    stl((uint8_t *)ptr, e1);
-    stl((uint8_t *)ptr + 4, e2);
-}
-
-uint64_t idt_table[256];
-
-/* only dpl matters as we do only user space emulation */
-static void set_idt(int n, unsigned int dpl)
-{
-    set_gate(idt_table + n, 0, dpl, 0, 0);
-}
-
-void qemu_free(void *ptr)
-{
-    free(ptr);
-}
-
-void *qemu_malloc(size_t size)
-{
-    return malloc(size);
-}
-
-void *qemu_mallocz(size_t size)
-{
-    void *ptr;
-    ptr = qemu_malloc(size);
-    if (!ptr)
-        return NULL;
-    memset(ptr, 0, size);
-    return ptr;
-}
-
-void *qemu_vmalloc(size_t size)
-{
-    return memalign(4096, size);
-}
-
-void qemu_vfree(void *ptr)
-{
-    free(ptr);
-}
-
-void qemu_printf(const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
-    vprintf(fmt, ap);
-    va_end(ap);
-}
-
-/* XXX: this is a bug in helper2.c */
-int errno;
-
-/**********************************************/
-
-#define COM_BASE_ADDR    0x10100
-
-void usage(void)
-{
-    printf("qruncom version 0.1 (c) 2003 Fabrice Bellard\n"
-           "usage: qruncom file.com\n"
-           "user mode libqemu demo: run simple .com DOS executables\n");
-    exit(1);
-}
-
-static inline uint8_t *seg_to_linear(unsigned int seg, unsigned int reg)
-{
-    return (uint8_t *)((seg << 4) + (reg & 0xffff));
-}
-
-static inline void pushw(CPUState *env, int val)
-{
-    env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | ((env->regs[R_ESP] - 2) & 0xffff);
-    *(uint16_t *)seg_to_linear(env->segs[R_SS].selector, env->regs[R_ESP]) = val;
-}
-
-static void host_segv_handler(int host_signum, siginfo_t *info,
-                              void *puc)
-{
-    if (cpu_signal_handler(host_signum, info, puc)) {
-        return;
-    }
-    abort();
-}
-
-int main(int argc, char **argv)
-{
-    uint8_t *vm86_mem;
-    const char *filename;
-    int fd, ret, seg;
-    CPUState *env;
-
-    if (argc != 2)
-        usage();
-    filename = argv[1];
-
-    vm86_mem = mmap((void *)0x00000000, 0x110000,
-                    PROT_WRITE | PROT_READ | PROT_EXEC,
-                    MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0);
-    if (vm86_mem == MAP_FAILED) {
-        perror("mmap");
-        exit(1);
-    }
-
-    /* load the MSDOS .com executable */
-    fd = open(filename, O_BINARY | O_RDONLY);
-    if (fd < 0) {
-        perror(filename);
-        exit(1);
-    }
-    ret = read(fd, vm86_mem + COM_BASE_ADDR, 65536 - 256);
-    if (ret < 0) {
-        perror("read");
-        exit(1);
-    }
-    close(fd);
-
-    /* install exception handler for CPU emulator */
-    {
-        struct sigaction act;
-
-        sigfillset(&act.sa_mask);
-        act.sa_flags = SA_SIGINFO;
-        //        act.sa_flags |= SA_ONSTACK;
-
-        act.sa_sigaction = host_segv_handler;
-        sigaction(SIGSEGV, &act, NULL);
-        sigaction(SIGBUS, &act, NULL);
-#if defined (TARGET_I386) && defined(USE_CODE_COPY)
-        sigaction(SIGFPE, &act, NULL);
-#endif
-    }
-
-    //    cpu_set_log(CPU_LOG_TB_IN_ASM | CPU_LOG_TB_OUT_ASM | CPU_LOG_EXEC);
-
-    env = cpu_init();
-
-    /* disable code copy to simplify debugging */
-    code_copy_enabled = 0;
-
-    /* set user mode state (XXX: should be done automatically by
-       cpu_init ?) */
-    env->user_mode_only = 1;
-
-    cpu_x86_set_cpl(env, 3);
-
-    env->cr[0] = CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK;
-    /* NOTE: hflags duplicates some of the virtual CPU state */
-    env->hflags |= HF_PE_MASK | VM_MASK;
-
-    /* flags setup : we activate the IRQs by default as in user
-       mode. We also activate the VM86 flag to run DOS code */
-    env->eflags |= IF_MASK | VM_MASK;
-
-    /* init basic registers */
-    env->eip = 0x100;
-    env->regs[R_ESP] = 0xfffe;
-    seg = (COM_BASE_ADDR - 0x100) >> 4;
-
-    cpu_x86_load_seg_cache(env, R_CS, seg,
-                           (seg << 4), 0xffff, 0);
-    cpu_x86_load_seg_cache(env, R_SS, seg,
-                           (seg << 4), 0xffff, 0);
-    cpu_x86_load_seg_cache(env, R_DS, seg,
-                           (seg << 4), 0xffff, 0);
-    cpu_x86_load_seg_cache(env, R_ES, seg,
-                           (seg << 4), 0xffff, 0);
-    cpu_x86_load_seg_cache(env, R_FS, seg,
-                           (seg << 4), 0xffff, 0);
-    cpu_x86_load_seg_cache(env, R_GS, seg,
-                           (seg << 4), 0xffff, 0);
-
-    /* exception support */
-    env->idt.base = (unsigned long)idt_table;
-    env->idt.limit = sizeof(idt_table) - 1;
-    set_idt(0, 0);
-    set_idt(1, 0);
-    set_idt(2, 0);
-    set_idt(3, 3);
-    set_idt(4, 3);
-    set_idt(5, 3);
-    set_idt(6, 0);
-    set_idt(7, 0);
-    set_idt(8, 0);
-    set_idt(9, 0);
-    set_idt(10, 0);
-    set_idt(11, 0);
-    set_idt(12, 0);
-    set_idt(13, 0);
-    set_idt(14, 0);
-    set_idt(15, 0);
-    set_idt(16, 0);
-    set_idt(17, 0);
-    set_idt(18, 0);
-    set_idt(19, 0);
-
-    /* put return code */
-    *seg_to_linear(env->segs[R_CS].selector, 0) = 0xb4; /* mov ah, $0 */
-    *seg_to_linear(env->segs[R_CS].selector, 1) = 0x00;
-    *seg_to_linear(env->segs[R_CS].selector, 2) = 0xcd; /* int $0x21 */
-    *seg_to_linear(env->segs[R_CS].selector, 3) = 0x21;
-    pushw(env, 0x0000);
-
-    /* the value of these registers seem to be assumed by pi_10.com */
-    env->regs[R_ESI] = 0x100;
-    env->regs[R_ECX] = 0xff;
-    env->regs[R_EBP] = 0x0900;
-    env->regs[R_EDI] = 0xfffe;
-
-    /* inform the emulator of the mmaped memory */
-    page_set_flags(0x00000000, 0x110000,
-                   PAGE_WRITE | PAGE_READ | PAGE_EXEC | PAGE_VALID);
-
-    for(;;) {
-        ret = cpu_x86_exec(env);
-        switch(ret) {
-        case EXCP0D_GPF:
-            {
-                int int_num, ah;
-                int_num = *(uint8_t *)(env->segs[R_CS].base + env->eip + 1);
-                if (int_num != 0x21)
-                    goto unknown_int;
-                ah = (env->regs[R_EAX] >> 8) & 0xff;
-                switch(ah) {
-                case 0x00: /* exit */
-                    exit(0);
-                case 0x02: /* write char */
-                    {
-                        uint8_t c = env->regs[R_EDX];
-                        write(1, &c, 1);
-                    }
-                    break;
-                case 0x09: /* write string */
-                    {
-                        uint8_t c;
-                        for(;;) {
-                            c = *seg_to_linear(env->segs[R_DS].selector, env->regs[R_EAX]);
-                            if (c == '$')
-                                break;
-                            write(1, &c, 1);
-                        }
-                        env->regs[R_EAX] = (env->regs[R_EAX] & ~0xff) | '$';
-                    }
-                    break;
-                default:
-                unknown_int:
-                    fprintf(stderr, "unsupported int 0x%02x\n", int_num);
-                    cpu_dump_state(env, stderr, fprintf, 0);
-                    //                    exit(1);
-                }
-                env->eip += 2;
-            }
-            break;
-        default:
-            fprintf(stderr, "unhandled cpu_exec return code (0x%x)\n", ret);
-            cpu_dump_state(env, stderr, fprintf, 0);
-            exit(1);
-        }
-    }
-}
diff --git a/tests/runcom.c b/tests/runcom.c
deleted file mode 100644
index f2781ce..0000000
--- a/tests/runcom.c
+++ /dev/null
@@ -1,195 +0,0 @@
-/*
- * Simple example of use of vm86: launch a basic .com DOS executable
- */
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <inttypes.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <sys/mman.h>
-#include <signal.h>
-
-#include <linux/unistd.h>
-#include <asm/vm86.h>
-
-//#define SIGTEST
-
-#undef __syscall_return
-#define __syscall_return(type, res) \
-do { \
-	return (type) (res); \
-} while (0)
-
-_syscall2(int, vm86, int, func, struct vm86plus_struct *, v86)
-
-#define COM_BASE_ADDR    0x10100
-
-void usage(void)
-{
-    printf("runcom version 0.1 (c) 2003 Fabrice Bellard\n"
-           "usage: runcom file.com\n"
-           "VM86 Run simple .com DOS executables (linux vm86 test mode)\n");
-    exit(1);
-}
-
-static inline void set_bit(uint8_t *a, unsigned int bit)
-{
-    a[bit / 8] |= (1 << (bit % 8));
-}
-
-static inline uint8_t *seg_to_linear(unsigned int seg, unsigned int reg)
-{
-    return (uint8_t *)((seg << 4) + (reg & 0xffff));
-}
-
-static inline void pushw(struct vm86_regs *r, int val)
-{
-    r->esp = (r->esp & ~0xffff) | ((r->esp - 2) & 0xffff);
-    *(uint16_t *)seg_to_linear(r->ss, r->esp) = val;
-}
-
-void dump_regs(struct vm86_regs *r)
-{
-    fprintf(stderr,
-            "EAX=%08lx EBX=%08lx ECX=%08lx EDX=%08lx\n"
-            "ESI=%08lx EDI=%08lx EBP=%08lx ESP=%08lx\n"
-            "EIP=%08lx EFL=%08lx\n"
-            "CS=%04x DS=%04x ES=%04x SS=%04x FS=%04x GS=%04x\n",
-            r->eax, r->ebx, r->ecx, r->edx, r->esi, r->edi, r->ebp, r->esp,
-            r->eip, r->eflags,
-            r->cs, r->ds, r->es, r->ss, r->fs, r->gs);
-}
-
-#ifdef SIGTEST
-void alarm_handler(int sig)
-{
-    fprintf(stderr, "alarm signal=%d\n", sig);
-    alarm(1);
-}
-#endif
-
-int main(int argc, char **argv)
-{
-    uint8_t *vm86_mem;
-    const char *filename;
-    int fd, ret, seg;
-    struct vm86plus_struct ctx;
-    struct vm86_regs *r;
-
-    if (argc != 2)
-        usage();
-    filename = argv[1];
-
-    vm86_mem = mmap((void *)0x00000000, 0x110000,
-                    PROT_WRITE | PROT_READ | PROT_EXEC,
-                    MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0);
-    if (vm86_mem == MAP_FAILED) {
-        perror("mmap");
-        exit(1);
-    }
-#ifdef SIGTEST
-    {
-        struct sigaction act;
-
-        act.sa_handler = alarm_handler;
-        sigemptyset(&act.sa_mask);
-        act.sa_flags = 0;
-        sigaction(SIGALRM, &act, NULL);
-        alarm(1);
-    }
-#endif
-
-    /* load the MSDOS .com executable */
-    fd = open(filename, O_BINARY | O_RDONLY);
-    if (fd < 0) {
-        perror(filename);
-        exit(1);
-    }
-    ret = read(fd, vm86_mem + COM_BASE_ADDR, 65536 - 256);
-    if (ret < 0) {
-        perror("read");
-        exit(1);
-    }
-    close(fd);
-
-    memset(&ctx, 0, sizeof(ctx));
-    /* init basic registers */
-    r = &ctx.regs;
-    r->eip = 0x100;
-    r->esp = 0xfffe;
-    seg = (COM_BASE_ADDR - 0x100) >> 4;
-    r->cs = seg;
-    r->ss = seg;
-    r->ds = seg;
-    r->es = seg;
-    r->fs = seg;
-    r->gs = seg;
-    r->eflags = VIF_MASK;
-
-    /* put return code */
-    set_bit((uint8_t *)&ctx.int_revectored, 0x21);
-    *seg_to_linear(r->cs, 0) = 0xb4; /* mov ah, $0 */
-    *seg_to_linear(r->cs, 1) = 0x00;
-    *seg_to_linear(r->cs, 2) = 0xcd; /* int $0x21 */
-    *seg_to_linear(r->cs, 3) = 0x21;
-    pushw(&ctx.regs, 0x0000);
-
-    /* the value of these registers seem to be assumed by pi_10.com */
-    r->esi = 0x100;
-    r->ecx = 0xff;
-    r->ebp = 0x0900;
-    r->edi = 0xfffe;
-
-    for(;;) {
-        ret = vm86(VM86_ENTER, &ctx);
-        switch(VM86_TYPE(ret)) {
-        case VM86_INTx:
-            {
-                int int_num, ah;
-
-                int_num = VM86_ARG(ret);
-                if (int_num != 0x21)
-                    goto unknown_int;
-                ah = (r->eax >> 8) & 0xff;
-                switch(ah) {
-                case 0x00: /* exit */
-                    exit(0);
-                case 0x02: /* write char */
-                    {
-                        uint8_t c = r->edx;
-                        write(1, &c, 1);
-                    }
-                    break;
-                case 0x09: /* write string */
-                    {
-                        uint8_t c;
-                        for(;;) {
-                            c = *seg_to_linear(r->ds, r->edx);
-                            if (c == '$')
-                                break;
-                            write(1, &c, 1);
-                        }
-                        r->eax = (r->eax & ~0xff) | '$';
-                    }
-                    break;
-                default:
-                unknown_int:
-                    fprintf(stderr, "unsupported int 0x%02x\n", int_num);
-                    dump_regs(&ctx.regs);
-                    //                    exit(1);
-                }
-            }
-            break;
-        case VM86_SIGNAL:
-            /* a signal came, we just ignore that */
-            break;
-        case VM86_STI:
-            break;
-        default:
-            fprintf(stderr, "unhandled vm86 return code (0x%x)\n", ret);
-            dump_regs(&ctx.regs);
-            exit(1);
-        }
-    }
-}
diff --git a/tests/sha1.c b/tests/sha1.c
deleted file mode 100644
index 31b0019..0000000
--- a/tests/sha1.c
+++ /dev/null
@@ -1,242 +0,0 @@
-
-/* from valgrind tests */
-
-/* ================ sha1.c ================ */
-/*
-SHA-1 in C
-By Steve Reid <steve@edmweb.com>
-100% Public Domain
-
-Test Vectors (from FIPS PUB 180-1)
-"abc"
-  A9993E36 4706816A BA3E2571 7850C26C 9CD0D89D
-"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
-  84983E44 1C3BD26E BAAE4AA1 F95129E5 E54670F1
-A million repetitions of "a"
-  34AA973C D4C4DAA4 F61EEB2B DBAD2731 6534016F
-*/
-
-/* #define LITTLE_ENDIAN * This should be #define'd already, if true. */
-/* #define SHA1HANDSOFF * Copies data before messing with it. */
-
-#define SHA1HANDSOFF
-
-#include <stdio.h>
-#include <string.h>
-#include <sys/types.h>	/* for u_int*_t */
-
-/* ================ sha1.h ================ */
-/*
-SHA-1 in C
-By Steve Reid <steve@edmweb.com>
-100% Public Domain
-*/
-
-typedef struct {
-    u_int32_t state[5];
-    u_int32_t count[2];
-    unsigned char buffer[64];
-} SHA1_CTX;
-
-void SHA1Transform(u_int32_t state[5], const unsigned char buffer[64]);
-void SHA1Init(SHA1_CTX* context);
-void SHA1Update(SHA1_CTX* context, const unsigned char* data, u_int32_t len);
-void SHA1Final(unsigned char digest[20], SHA1_CTX* context);
-/* ================ end of sha1.h ================ */
-#include <endian.h>
-
-#define rol(value, bits) (((value) << (bits)) | ((value) >> (32 - (bits))))
-
-/* blk0() and blk() perform the initial expand. */
-/* I got the idea of expanding during the round function from SSLeay */
-#if BYTE_ORDER == LITTLE_ENDIAN
-#define blk0(i) (block->l[i] = (rol(block->l[i],24)&0xFF00FF00) \
-    |(rol(block->l[i],8)&0x00FF00FF))
-#elif BYTE_ORDER == BIG_ENDIAN
-#define blk0(i) block->l[i]
-#else
-#error "Endianness not defined!"
-#endif
-#define blk(i) (block->l[i&15] = rol(block->l[(i+13)&15]^block->l[(i+8)&15] \
-    ^block->l[(i+2)&15]^block->l[i&15],1))
-
-/* (R0+R1), R2, R3, R4 are the different operations used in SHA1 */
-#define R0(v,w,x,y,z,i) z+=((w&(x^y))^y)+blk0(i)+0x5A827999+rol(v,5);w=rol(w,30);
-#define R1(v,w,x,y,z,i) z+=((w&(x^y))^y)+blk(i)+0x5A827999+rol(v,5);w=rol(w,30);
-#define R2(v,w,x,y,z,i) z+=(w^x^y)+blk(i)+0x6ED9EBA1+rol(v,5);w=rol(w,30);
-#define R3(v,w,x,y,z,i) z+=(((w|x)&y)|(w&x))+blk(i)+0x8F1BBCDC+rol(v,5);w=rol(w,30);
-#define R4(v,w,x,y,z,i) z+=(w^x^y)+blk(i)+0xCA62C1D6+rol(v,5);w=rol(w,30);
-
-
-/* Hash a single 512-bit block. This is the core of the algorithm. */
-
-void SHA1Transform(u_int32_t state[5], const unsigned char buffer[64])
-{
-u_int32_t a, b, c, d, e;
-typedef union {
-    unsigned char c[64];
-    u_int32_t l[16];
-} CHAR64LONG16;
-#ifdef SHA1HANDSOFF
-CHAR64LONG16 block[1];  /* use array to appear as a pointer */
-    memcpy(block, buffer, 64);
-#else
-    /* The following had better never be used because it causes the
-     * pointer-to-const buffer to be cast into a pointer to non-const.
-     * And the result is written through.  I threw a "const" in, hoping
-     * this will cause a diagnostic.
-     */
-CHAR64LONG16* block = (const CHAR64LONG16*)buffer;
-#endif
-    /* Copy context->state[] to working vars */
-    a = state[0];
-    b = state[1];
-    c = state[2];
-    d = state[3];
-    e = state[4];
-    /* 4 rounds of 20 operations each. Loop unrolled. */
-    R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
-    R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
-    R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
-    R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
-    R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
-    R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
-    R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
-    R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
-    R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
-    R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
-    R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
-    R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
-    R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
-    R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
-    R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
-    R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
-    R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
-    R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
-    R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
-    R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
-    /* Add the working vars back into context.state[] */
-    state[0] += a;
-    state[1] += b;
-    state[2] += c;
-    state[3] += d;
-    state[4] += e;
-    /* Wipe variables */
-    a = b = c = d = e = 0;
-#ifdef SHA1HANDSOFF
-    memset(block, '\0', sizeof(block));
-#endif
-}
-
-
-/* SHA1Init - Initialize new context */
-
-void SHA1Init(SHA1_CTX* context)
-{
-    /* SHA1 initialization constants */
-    context->state[0] = 0x67452301;
-    context->state[1] = 0xEFCDAB89;
-    context->state[2] = 0x98BADCFE;
-    context->state[3] = 0x10325476;
-    context->state[4] = 0xC3D2E1F0;
-    context->count[0] = context->count[1] = 0;
-}
-
-
-/* Run your data through this. */
-
-void SHA1Update(SHA1_CTX* context, const unsigned char* data, u_int32_t len)
-{
-u_int32_t i;
-u_int32_t j;
-
-    j = context->count[0];
-    if ((context->count[0] += len << 3) < j)
-	context->count[1]++;
-    context->count[1] += (len>>29);
-    j = (j >> 3) & 63;
-    if ((j + len) > 63) {
-        memcpy(&context->buffer[j], data, (i = 64-j));
-        SHA1Transform(context->state, context->buffer);
-        for ( ; i + 63 < len; i += 64) {
-            SHA1Transform(context->state, &data[i]);
-        }
-        j = 0;
-    }
-    else i = 0;
-    memcpy(&context->buffer[j], &data[i], len - i);
-}
-
-
-/* Add padding and return the message digest. */
-
-void SHA1Final(unsigned char digest[20], SHA1_CTX* context)
-{
-unsigned i;
-unsigned char finalcount[8];
-unsigned char c;
-
-#if 0	/* untested "improvement" by DHR */
-    /* Convert context->count to a sequence of bytes
-     * in finalcount.  Second element first, but
-     * big-endian order within element.
-     * But we do it all backwards.
-     */
-    unsigned char *fcp = &finalcount[8];
-
-    for (i = 0; i < 2; i++)
-    {
-	u_int32_t t = context->count[i];
-	int j;
-
-	for (j = 0; j < 4; t >>= 8, j++)
-	    *--fcp = (unsigned char) t
-    }
-#else
-    for (i = 0; i < 8; i++) {
-        finalcount[i] = (unsigned char)((context->count[(i >= 4 ? 0 : 1)]
-         >> ((3-(i & 3)) * 8) ) & 255);  /* Endian independent */
-    }
-#endif
-    c = 0200;
-    SHA1Update(context, &c, 1);
-    while ((context->count[0] & 504) != 448) {
-	c = 0000;
-        SHA1Update(context, &c, 1);
-    }
-    SHA1Update(context, finalcount, 8);  /* Should cause a SHA1Transform() */
-    for (i = 0; i < 20; i++) {
-        digest[i] = (unsigned char)
-         ((context->state[i>>2] >> ((3-(i & 3)) * 8) ) & 255);
-    }
-    /* Wipe variables */
-    memset(context, '\0', sizeof(*context));
-    memset(&finalcount, '\0', sizeof(finalcount));
-}
-/* ================ end of sha1.c ================ */
-
-#define BUFSIZE 4096
-
-int
-main(int argc, char **argv)
-{
-    SHA1_CTX ctx;
-    unsigned char hash[20], buf[BUFSIZE];
-    int i;
-
-    for(i=0;i<BUFSIZE;i++)
-        buf[i] = i;
-
-    SHA1Init(&ctx);
-    for(i=0;i<1000;i++)
-        SHA1Update(&ctx, buf, BUFSIZE);
-    SHA1Final(hash, &ctx);
-
-    printf("SHA1=");
-    for(i=0;i<20;i++)
-        printf("%02x", hash[i]);
-    printf("\n");
-    return 0;
-}
-
-
diff --git a/tests/test-i386-code16.S b/tests/test-i386-code16.S
deleted file mode 100644
index e400e73..0000000
--- a/tests/test-i386-code16.S
+++ /dev/null
@@ -1,79 +0,0 @@
-        .code16
-        .globl code16_start
-        .globl code16_end
-
-CS_SEG = 0xf
-
-code16_start:
-
-        .globl code16_func1
-        
-        /* basic test */
-code16_func1 = . - code16_start
-        mov $1, %eax
-        data32 lret
-
-/* test push/pop in 16 bit mode */
-        .globl code16_func2
-code16_func2 = . - code16_start
-        xor %eax, %eax
-        mov $0x12345678, %ebx
-        movl %esp, %ecx
-        push %bx
-        subl %esp, %ecx
-        pop %ax
-        data32 lret
-
-/* test various jmp opcodes */        
-        .globl code16_func3
-code16_func3 = . - code16_start
-        jmp 1f
-        nop
-1:
-        mov $4, %eax
-        mov $0x12345678, %ebx
-        xor %bx, %bx
-        jz 2f
-        add $2, %ax
-2:
-        
-        call myfunc
-        
-        lcall $CS_SEG, $(myfunc2 - code16_start)
-
-        ljmp $CS_SEG, $(myjmp1 - code16_start)
-myjmp1_next:
-
-        cs lcall myfunc2_addr - code16_start
-
-        cs ljmp myjmp2_addr - code16_start
-myjmp2_next:
-
-        data32 lret
-        
-myfunc2_addr:
-        .short myfunc2 - code16_start
-        .short CS_SEG
-
-myjmp2_addr:
-        .short myjmp2 - code16_start
-        .short CS_SEG
-
-myjmp1:
-        add $8, %ax
-        jmp myjmp1_next
-
-myjmp2:
-        add $16, %ax
-        jmp myjmp2_next
-
-myfunc:
-        add $1, %ax
-        ret
-
-myfunc2:
-        add $4, %ax
-        lret
-
-
-code16_end:
diff --git a/tests/test-i386-muldiv.h b/tests/test-i386-muldiv.h
deleted file mode 100644
index fd0d991..0000000
--- a/tests/test-i386-muldiv.h
+++ /dev/null
@@ -1,76 +0,0 @@
-
-void glue(glue(test_, OP), b)(long op0, long op1) 
-{
-    long res, s1, s0, flags;
-    s0 = op0;
-    s1 = op1;
-    res = s0;
-    flags = 0;
-    asm ("push %4\n\t"
-         "popf\n\t"
-         stringify(OP)"b %b2\n\t" 
-         "pushf\n\t"
-         "pop %1\n\t"
-         : "=a" (res), "=g" (flags)
-         : "q" (s1), "0" (res), "1" (flags));
-    printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CC=%04lx\n",
-           stringify(OP) "b", s0, s1, res, flags & CC_MASK);
-}
-
-void glue(glue(test_, OP), w)(long op0h, long op0, long op1) 
-{
-    long res, s1, flags, resh;
-    s1 = op1;
-    resh = op0h;
-    res = op0;
-    flags = 0;
-    asm ("push %5\n\t"
-         "popf\n\t"
-         stringify(OP) "w %w3\n\t" 
-         "pushf\n\t"
-         "pop %1\n\t"
-         : "=a" (res), "=g" (flags), "=d" (resh)
-         : "q" (s1), "0" (res), "1" (flags), "2" (resh));
-    printf("%-10s AH=" FMTLX " AL=" FMTLX " B=" FMTLX " RH=" FMTLX " RL=" FMTLX " CC=%04lx\n",
-           stringify(OP) "w", op0h, op0, s1, resh, res, flags & CC_MASK);
-}
-
-void glue(glue(test_, OP), l)(long op0h, long op0, long op1) 
-{
-    long res, s1, flags, resh;
-    s1 = op1;
-    resh = op0h;
-    res = op0;
-    flags = 0;
-    asm ("push %5\n\t"
-         "popf\n\t"
-         stringify(OP) "l %k3\n\t" 
-         "pushf\n\t"
-         "pop %1\n\t"
-         : "=a" (res), "=g" (flags), "=d" (resh)
-         : "q" (s1), "0" (res), "1" (flags), "2" (resh));
-    printf("%-10s AH=" FMTLX " AL=" FMTLX " B=" FMTLX " RH=" FMTLX " RL=" FMTLX " CC=%04lx\n",
-           stringify(OP) "l", op0h, op0, s1, resh, res, flags & CC_MASK);
-}
-
-#if defined(__x86_64__)
-void glue(glue(test_, OP), q)(long op0h, long op0, long op1) 
-{
-    long res, s1, flags, resh;
-    s1 = op1;
-    resh = op0h;
-    res = op0;
-    flags = 0;
-    asm ("push %5\n\t"
-         "popf\n\t"
-         stringify(OP) "q %3\n\t" 
-         "pushf\n\t"
-         "pop %1\n\t"
-         : "=a" (res), "=g" (flags), "=d" (resh)
-         : "q" (s1), "0" (res), "1" (flags), "2" (resh));
-    printf("%-10s AH=" FMTLX " AL=" FMTLX " B=" FMTLX " RH=" FMTLX " RL=" FMTLX " CC=%04lx\n",
-           stringify(OP) "q", op0h, op0, s1, resh, res, flags & CC_MASK);
-}
-#endif
-
-#undef OP
diff --git a/tests/test-i386-shift.h b/tests/test-i386-shift.h
deleted file mode 100644
index c1ed489..0000000
--- a/tests/test-i386-shift.h
+++ /dev/null
@@ -1,187 +0,0 @@
-
-#define exec_op glue(exec_, OP)
-#define exec_opq glue(glue(exec_, OP), q)
-#define exec_opl glue(glue(exec_, OP), l)
-#define exec_opw glue(glue(exec_, OP), w)
-#define exec_opb glue(glue(exec_, OP), b)
-
-#ifndef OP_SHIFTD
-
-#ifdef OP_NOBYTE
-#define EXECSHIFT(size, rsize, res, s1, s2, flags) \
-    asm ("push %4\n\t"\
-         "popf\n\t"\
-         stringify(OP) size " %" rsize "2, %" rsize "0\n\t" \
-         "pushf\n\t"\
-         "pop %1\n\t"\
-         : "=g" (res), "=g" (flags)\
-         : "r" (s1), "0" (res), "1" (flags));
-#else
-#define EXECSHIFT(size, rsize, res, s1, s2, flags) \
-    asm ("push %4\n\t"\
-         "popf\n\t"\
-         stringify(OP) size " %%cl, %" rsize "0\n\t" \
-         "pushf\n\t"\
-         "pop %1\n\t"\
-         : "=q" (res), "=g" (flags)\
-         : "c" (s1), "0" (res), "1" (flags));
-#endif
-
-#if defined(__x86_64__)
-void exec_opq(long s2, long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECSHIFT("q", "", res, s1, s2, flags);
-    /* overflow is undefined if count != 1 */
-    if (s1 != 1)
-      flags &= ~CC_O;
-    printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CCIN=%04lx CC=%04lx\n",
-           stringify(OP) "q", s0, s1, res, iflags, flags & CC_MASK);
-}
-#endif
-
-void exec_opl(long s2, long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECSHIFT("l", "k", res, s1, s2, flags);
-    /* overflow is undefined if count != 1 */
-    if (s1 != 1)
-      flags &= ~CC_O;
-    printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CCIN=%04lx CC=%04lx\n",
-           stringify(OP) "l", s0, s1, res, iflags, flags & CC_MASK);
-}
-
-void exec_opw(long s2, long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECSHIFT("w", "w", res, s1, s2, flags);
-    /* overflow is undefined if count != 1 */
-    if (s1 != 1)
-      flags &= ~CC_O;
-    printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CCIN=%04lx CC=%04lx\n",
-           stringify(OP) "w", s0, s1, res, iflags, flags & CC_MASK);
-}
-
-#else
-#define EXECSHIFT(size, rsize, res, s1, s2, flags) \
-    asm ("push %4\n\t"\
-         "popf\n\t"\
-         stringify(OP) size " %%cl, %" rsize "5, %" rsize "0\n\t" \
-         "pushf\n\t"\
-         "pop %1\n\t"\
-         : "=g" (res), "=g" (flags)\
-         : "c" (s1), "0" (res), "1" (flags), "r" (s2));
-
-#if defined(__x86_64__)
-void exec_opq(long s2, long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECSHIFT("q", "", res, s1, s2, flags);
-    /* overflow is undefined if count != 1 */
-    if (s1 != 1)
-      flags &= ~CC_O;
-    printf("%-10s A=" FMTLX " B=" FMTLX " C=" FMTLX " R=" FMTLX " CCIN=%04lx CC=%04lx\n",
-           stringify(OP) "q", s0, s2, s1, res, iflags, flags & CC_MASK);
-}
-#endif
-
-void exec_opl(long s2, long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECSHIFT("l", "k", res, s1, s2, flags);
-    /* overflow is undefined if count != 1 */
-    if (s1 != 1)
-      flags &= ~CC_O;
-    printf("%-10s A=" FMTLX " B=" FMTLX " C=" FMTLX " R=" FMTLX " CCIN=%04lx CC=%04lx\n",
-           stringify(OP) "l", s0, s2, s1, res, iflags, flags & CC_MASK);
-}
-
-void exec_opw(long s2, long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECSHIFT("w", "w", res, s1, s2, flags);
-    /* overflow is undefined if count != 1 */
-    if (s1 != 1)
-      flags &= ~CC_O;
-    printf("%-10s A=" FMTLX " B=" FMTLX " C=" FMTLX " R=" FMTLX " CCIN=%04lx CC=%04lx\n",
-           stringify(OP) "w", s0, s2, s1, res, iflags, flags & CC_MASK);
-}
-
-#endif
-
-#ifndef OP_NOBYTE
-void exec_opb(long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECSHIFT("b", "b", res, s1, 0, flags);
-    /* overflow is undefined if count != 1 */
-    if (s1 != 1)
-      flags &= ~CC_O;
-    printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CCIN=%04lx CC=%04lx\n",
-           stringify(OP) "b", s0, s1, res, iflags, flags & CC_MASK);
-}
-#endif
-
-void exec_op(long s2, long s0, long s1)
-{
-    s2 = i2l(s2);
-    s0 = i2l(s0);
-#if defined(__x86_64__)
-    exec_opq(s2, s0, s1, 0);
-#endif
-    exec_opl(s2, s0, s1, 0);
-#ifdef OP_SHIFTD
-    if (s1 <= 15)
-        exec_opw(s2, s0, s1, 0);
-#else
-    exec_opw(s2, s0, s1, 0);
-#endif
-#ifndef OP_NOBYTE
-    exec_opb(s0, s1, 0);
-#endif
-#ifdef OP_CC
-#if defined(__x86_64__)
-    exec_opq(s2, s0, s1, CC_C);
-#endif
-    exec_opl(s2, s0, s1, CC_C);
-    exec_opw(s2, s0, s1, CC_C);
-    exec_opb(s0, s1, CC_C);
-#endif
-}
-
-void glue(test_, OP)(void)
-{
-    int i, n;
-#if defined(__x86_64__)
-    n = 64;
-#else
-    n = 32;
-#endif
-    for(i = 0; i < n; i++)
-        exec_op(0x21ad3d34, 0x12345678, i);
-    for(i = 0; i < n; i++)
-        exec_op(0x813f3421, 0x82345679, i);
-}
-
-void *glue(_test_, OP) __init_call = glue(test_, OP);
-
-#undef OP
-#undef OP_CC
-#undef OP_SHIFTD
-#undef OP_NOBYTE
-#undef EXECSHIFT
-
diff --git a/tests/test-i386-vm86.S b/tests/test-i386-vm86.S
deleted file mode 100644
index a972f1b..0000000
--- a/tests/test-i386-vm86.S
+++ /dev/null
@@ -1,104 +0,0 @@
-        .code16
-        .globl vm86_code_start
-        .globl vm86_code_end
-
-#define GET_OFFSET(x) ((x) - vm86_code_start + 0x100)
-
-vm86_code_start:
-        movw $GET_OFFSET(hello_world), %dx
-        movb $0x09, %ah
-        int $0x21
-
-        /* prepare int 0x90 vector */
-        xorw %ax, %ax
-        movw %ax, %es
-        es movw $GET_OFFSET(int90_test), 0x90 * 4
-        es movw %cs, 0x90 * 4 + 2
-        
-        /* launch int 0x90 */
-
-        int $0x90
-
-        /* test IF support */
-        movw $GET_OFFSET(IF_msg), %dx
-        movb $0x09, %ah
-        int $0x21
-
-        pushf 
-        popw %dx
-        movb $0xff, %ah
-        int $0x21
-
-        cli
-        pushf 
-        popw %dx
-        movb $0xff, %ah
-        int $0x21
-
-        sti        
-        pushfl 
-        popl %edx
-        movb $0xff, %ah
-        int $0x21
-        
-#if 0
-        movw $GET_OFFSET(IF_msg1), %dx
-        movb $0x09, %ah
-        int $0x21
-
-        pushf
-        movw %sp, %bx
-        andw $~0x200, (%bx)
-        popf
-#else
-        cli
-#endif
-
-        pushf 
-        popw %dx
-        movb $0xff, %ah
-        int $0x21
-        
-        pushfl
-        movw %sp, %bx
-        orw $0x200, (%bx)
-        popfl
-
-        pushfl
-        popl %edx
-        movb $0xff, %ah
-        int $0x21
-
-        movb $0x00, %ah
-        int $0x21
-
-int90_test:
-        pushf 
-        pop %dx
-        movb $0xff, %ah
-        int $0x21
-
-        movw %sp, %bx
-        movw 4(%bx), %dx
-        movb $0xff, %ah
-        int $0x21
-        
-        movw $GET_OFFSET(int90_msg), %dx
-        movb $0x09, %ah
-        int $0x21
-        iret
-                    
-int90_msg:
-        .string "INT90 started\n$"
- 
-hello_world:
-        .string "Hello VM86 world\n$"
-
-IF_msg:
-        .string "VM86 IF test\n$"
-
-IF_msg1:
-        .string "If you see a diff here, your Linux kernel is buggy, please update to 2.4.20 kernel\n$"
-
-vm86_code_end:
-        
\ No newline at end of file
diff --git a/tests/test-i386.c b/tests/test-i386.c
deleted file mode 100644
index 4a25d03..0000000
--- a/tests/test-i386.c
+++ /dev/null
@@ -1,2629 +0,0 @@
-/*
- *  x86 CPU test
- * 
- *  Copyright (c) 2003 Fabrice Bellard
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-#define _GNU_SOURCE
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <inttypes.h>
-#include <math.h>
-#include <signal.h>
-#include <setjmp.h>
-#include <errno.h>
-#include <sys/ucontext.h>
-#include <sys/mman.h>
-
-#if !defined(__x86_64__)
-#define TEST_VM86
-#define TEST_SEGS
-#endif
-//#define LINUX_VM86_IOPL_FIX
-//#define TEST_P4_FLAGS
-#if defined(__x86_64__)
-#define TEST_SSE
-#define TEST_CMOV  1
-#define TEST_FCOMI 1
-#else
-//#define TEST_SSE
-#define TEST_CMOV  0
-#define TEST_FCOMI 0
-#endif
-
-#if defined(__x86_64__)
-#define FMT64X "%016lx"
-#define FMTLX "%016lx"
-#define X86_64_ONLY(x) x
-#else
-#define FMT64X "%016" PRIx64
-#define FMTLX "%08lx"
-#define X86_64_ONLY(x)
-#endif
-
-#ifdef TEST_VM86
-#include <asm/vm86.h>
-#endif
-
-#define xglue(x, y) x ## y
-#define glue(x, y) xglue(x, y)
-#define stringify(s)	tostring(s)
-#define tostring(s)	#s
-
-#define CC_C   	0x0001
-#define CC_P 	0x0004
-#define CC_A	0x0010
-#define CC_Z	0x0040
-#define CC_S    0x0080
-#define CC_O    0x0800
-
-#define __init_call	__attribute__ ((unused,__section__ ("initcall")))
-
-#define CC_MASK (CC_C | CC_P | CC_Z | CC_S | CC_O | CC_A)
-
-#if defined(__x86_64__)
-static inline long i2l(long v)
-{
-    return v | ((v ^ 0xabcd) << 32);
-}
-#else
-static inline long i2l(long v)
-{
-    return v;
-}
-#endif
-
-#define OP add
-#include "test-i386.h"
-
-#define OP sub
-#include "test-i386.h"
-
-#define OP xor
-#include "test-i386.h"
-
-#define OP and
-#include "test-i386.h"
-
-#define OP or
-#include "test-i386.h"
-
-#define OP cmp
-#include "test-i386.h"
-
-#define OP adc
-#define OP_CC
-#include "test-i386.h"
-
-#define OP sbb
-#define OP_CC
-#include "test-i386.h"
-
-#define OP inc
-#define OP_CC
-#define OP1
-#include "test-i386.h"
-
-#define OP dec
-#define OP_CC
-#define OP1
-#include "test-i386.h"
-
-#define OP neg
-#define OP_CC
-#define OP1
-#include "test-i386.h"
-
-#define OP not
-#define OP_CC
-#define OP1
-#include "test-i386.h"
-
-#undef CC_MASK
-#define CC_MASK (CC_C | CC_P | CC_Z | CC_S | CC_O)
-
-#define OP shl
-#include "test-i386-shift.h"
-
-#define OP shr
-#include "test-i386-shift.h"
-
-#define OP sar
-#include "test-i386-shift.h"
-
-#define OP rol
-#include "test-i386-shift.h"
-
-#define OP ror
-#include "test-i386-shift.h"
-
-#define OP rcr
-#define OP_CC
-#include "test-i386-shift.h"
-
-#define OP rcl
-#define OP_CC
-#include "test-i386-shift.h"
-
-#define OP shld
-#define OP_SHIFTD
-#define OP_NOBYTE
-#include "test-i386-shift.h"
-
-#define OP shrd
-#define OP_SHIFTD
-#define OP_NOBYTE
-#include "test-i386-shift.h"
-
-/* XXX: should be more precise ? */
-#undef CC_MASK
-#define CC_MASK (CC_C)
-
-#define OP bt
-#define OP_NOBYTE
-#include "test-i386-shift.h"
-
-#define OP bts
-#define OP_NOBYTE
-#include "test-i386-shift.h"
-
-#define OP btr
-#define OP_NOBYTE
-#include "test-i386-shift.h"
-
-#define OP btc
-#define OP_NOBYTE
-#include "test-i386-shift.h"
-
-/* lea test (modrm support) */
-#define TEST_LEAQ(STR)\
-{\
-    asm("lea " STR ", %0"\
-        : "=r" (res)\
-        : "a" (eax), "b" (ebx), "c" (ecx), "d" (edx), "S" (esi), "D" (edi));\
-    printf("lea %s = " FMTLX "\n", STR, res);\
-}
-
-#define TEST_LEA(STR)\
-{\
-    asm("lea " STR ", %0"\
-        : "=r" (res)\
-        : "a" (eax), "b" (ebx), "c" (ecx), "d" (edx), "S" (esi), "D" (edi));\
-    printf("lea %s = " FMTLX "\n", STR, res);\
-}
-
-#define TEST_LEA16(STR)\
-{\
-    asm(".code16 ; .byte 0x67 ; leal " STR ", %0 ; .code32"\
-        : "=wq" (res)\
-        : "a" (eax), "b" (ebx), "c" (ecx), "d" (edx), "S" (esi), "D" (edi));\
-    printf("lea %s = %08lx\n", STR, res);\
-}
-
-
-void test_lea(void)
-{
-    long eax, ebx, ecx, edx, esi, edi, res;
-    eax = i2l(0x0001);
-    ebx = i2l(0x0002);
-    ecx = i2l(0x0004);
-    edx = i2l(0x0008);
-    esi = i2l(0x0010);
-    edi = i2l(0x0020);
-
-    TEST_LEA("0x4000");
-
-    TEST_LEA("(%%eax)");
-    TEST_LEA("(%%ebx)");
-    TEST_LEA("(%%ecx)");
-    TEST_LEA("(%%edx)");
-    TEST_LEA("(%%esi)");
-    TEST_LEA("(%%edi)");
-
-    TEST_LEA("0x40(%%eax)");
-    TEST_LEA("0x40(%%ebx)");
-    TEST_LEA("0x40(%%ecx)");
-    TEST_LEA("0x40(%%edx)");
-    TEST_LEA("0x40(%%esi)");
-    TEST_LEA("0x40(%%edi)");
-
-    TEST_LEA("0x4000(%%eax)");
-    TEST_LEA("0x4000(%%ebx)");
-    TEST_LEA("0x4000(%%ecx)");
-    TEST_LEA("0x4000(%%edx)");
-    TEST_LEA("0x4000(%%esi)");
-    TEST_LEA("0x4000(%%edi)");
-
-    TEST_LEA("(%%eax, %%ecx)");
-    TEST_LEA("(%%ebx, %%edx)");
-    TEST_LEA("(%%ecx, %%ecx)");
-    TEST_LEA("(%%edx, %%ecx)");
-    TEST_LEA("(%%esi, %%ecx)");
-    TEST_LEA("(%%edi, %%ecx)");
-
-    TEST_LEA("0x40(%%eax, %%ecx)");
-    TEST_LEA("0x4000(%%ebx, %%edx)");
-
-    TEST_LEA("(%%ecx, %%ecx, 2)");
-    TEST_LEA("(%%edx, %%ecx, 4)");
-    TEST_LEA("(%%esi, %%ecx, 8)");
-
-    TEST_LEA("(,%%eax, 2)");
-    TEST_LEA("(,%%ebx, 4)");
-    TEST_LEA("(,%%ecx, 8)");
-
-    TEST_LEA("0x40(,%%eax, 2)");
-    TEST_LEA("0x40(,%%ebx, 4)");
-    TEST_LEA("0x40(,%%ecx, 8)");
-
-
-    TEST_LEA("-10(%%ecx, %%ecx, 2)");
-    TEST_LEA("-10(%%edx, %%ecx, 4)");
-    TEST_LEA("-10(%%esi, %%ecx, 8)");
-
-    TEST_LEA("0x4000(%%ecx, %%ecx, 2)");
-    TEST_LEA("0x4000(%%edx, %%ecx, 4)");
-    TEST_LEA("0x4000(%%esi, %%ecx, 8)");
-
-#if defined(__x86_64__)
-    TEST_LEAQ("0x4000");
-    TEST_LEAQ("0x4000(%%rip)");
-
-    TEST_LEAQ("(%%rax)");
-    TEST_LEAQ("(%%rbx)");
-    TEST_LEAQ("(%%rcx)");
-    TEST_LEAQ("(%%rdx)");
-    TEST_LEAQ("(%%rsi)");
-    TEST_LEAQ("(%%rdi)");
-
-    TEST_LEAQ("0x40(%%rax)");
-    TEST_LEAQ("0x40(%%rbx)");
-    TEST_LEAQ("0x40(%%rcx)");
-    TEST_LEAQ("0x40(%%rdx)");
-    TEST_LEAQ("0x40(%%rsi)");
-    TEST_LEAQ("0x40(%%rdi)");
-
-    TEST_LEAQ("0x4000(%%rax)");
-    TEST_LEAQ("0x4000(%%rbx)");
-    TEST_LEAQ("0x4000(%%rcx)");
-    TEST_LEAQ("0x4000(%%rdx)");
-    TEST_LEAQ("0x4000(%%rsi)");
-    TEST_LEAQ("0x4000(%%rdi)");
-
-    TEST_LEAQ("(%%rax, %%rcx)");
-    TEST_LEAQ("(%%rbx, %%rdx)");
-    TEST_LEAQ("(%%rcx, %%rcx)");
-    TEST_LEAQ("(%%rdx, %%rcx)");
-    TEST_LEAQ("(%%rsi, %%rcx)");
-    TEST_LEAQ("(%%rdi, %%rcx)");
-
-    TEST_LEAQ("0x40(%%rax, %%rcx)");
-    TEST_LEAQ("0x4000(%%rbx, %%rdx)");
-
-    TEST_LEAQ("(%%rcx, %%rcx, 2)");
-    TEST_LEAQ("(%%rdx, %%rcx, 4)");
-    TEST_LEAQ("(%%rsi, %%rcx, 8)");
-
-    TEST_LEAQ("(,%%rax, 2)");
-    TEST_LEAQ("(,%%rbx, 4)");
-    TEST_LEAQ("(,%%rcx, 8)");
-
-    TEST_LEAQ("0x40(,%%rax, 2)");
-    TEST_LEAQ("0x40(,%%rbx, 4)");
-    TEST_LEAQ("0x40(,%%rcx, 8)");
-
-
-    TEST_LEAQ("-10(%%rcx, %%rcx, 2)");
-    TEST_LEAQ("-10(%%rdx, %%rcx, 4)");
-    TEST_LEAQ("-10(%%rsi, %%rcx, 8)");
-
-    TEST_LEAQ("0x4000(%%rcx, %%rcx, 2)");
-    TEST_LEAQ("0x4000(%%rdx, %%rcx, 4)");
-    TEST_LEAQ("0x4000(%%rsi, %%rcx, 8)");
-#else
-    /* limited 16 bit addressing test */
-    TEST_LEA16("0x4000");
-    TEST_LEA16("(%%bx)");
-    TEST_LEA16("(%%si)");
-    TEST_LEA16("(%%di)");
-    TEST_LEA16("0x40(%%bx)");
-    TEST_LEA16("0x40(%%si)");
-    TEST_LEA16("0x40(%%di)");
-    TEST_LEA16("0x4000(%%bx)");
-    TEST_LEA16("0x4000(%%si)");
-    TEST_LEA16("(%%bx,%%si)");
-    TEST_LEA16("(%%bx,%%di)");
-    TEST_LEA16("0x40(%%bx,%%si)");
-    TEST_LEA16("0x40(%%bx,%%di)");
-    TEST_LEA16("0x4000(%%bx,%%si)");
-    TEST_LEA16("0x4000(%%bx,%%di)");
-#endif
-}
-
-#define TEST_JCC(JCC, v1, v2)\
-{\
-    int res;\
-    asm("movl $1, %0\n\t"\
-        "cmpl %2, %1\n\t"\
-        "j" JCC " 1f\n\t"\
-        "movl $0, %0\n\t"\
-        "1:\n\t"\
-        : "=r" (res)\
-        : "r" (v1), "r" (v2));\
-    printf("%-10s %d\n", "j" JCC, res);\
-\
-    asm("movl $0, %0\n\t"\
-        "cmpl %2, %1\n\t"\
-        "set" JCC " %b0\n\t"\
-        : "=r" (res)\
-        : "r" (v1), "r" (v2));\
-    printf("%-10s %d\n", "set" JCC, res);\
- if (TEST_CMOV) {\
-    long val = i2l(1);\
-    long res = i2l(0x12345678);\
-X86_64_ONLY(\
-    asm("cmpl %2, %1\n\t"\
-        "cmov" JCC "q %3, %0\n\t"\
-        : "=r" (res)\
-        : "r" (v1), "r" (v2), "m" (val), "0" (res));\
-        printf("%-10s R=" FMTLX "\n", "cmov" JCC "q", res);)\
-    asm("cmpl %2, %1\n\t"\
-        "cmov" JCC "l %k3, %k0\n\t"\
-        : "=r" (res)\
-        : "r" (v1), "r" (v2), "m" (val), "0" (res));\
-        printf("%-10s R=" FMTLX "\n", "cmov" JCC "l", res);\
-    asm("cmpl %2, %1\n\t"\
-        "cmov" JCC "w %w3, %w0\n\t"\
-        : "=r" (res)\
-        : "r" (v1), "r" (v2), "r" (1), "0" (res));\
-        printf("%-10s R=" FMTLX "\n", "cmov" JCC "w", res);\
- } \
-}
-
-/* various jump tests */
-void test_jcc(void)
-{
-    TEST_JCC("ne", 1, 1);
-    TEST_JCC("ne", 1, 0);
-
-    TEST_JCC("e", 1, 1);
-    TEST_JCC("e", 1, 0);
-
-    TEST_JCC("l", 1, 1);
-    TEST_JCC("l", 1, 0);
-    TEST_JCC("l", 1, -1);
-
-    TEST_JCC("le", 1, 1);
-    TEST_JCC("le", 1, 0);
-    TEST_JCC("le", 1, -1);
-
-    TEST_JCC("ge", 1, 1);
-    TEST_JCC("ge", 1, 0);
-    TEST_JCC("ge", -1, 1);
-
-    TEST_JCC("g", 1, 1);
-    TEST_JCC("g", 1, 0);
-    TEST_JCC("g", 1, -1);
-
-    TEST_JCC("b", 1, 1);
-    TEST_JCC("b", 1, 0);
-    TEST_JCC("b", 1, -1);
-
-    TEST_JCC("be", 1, 1);
-    TEST_JCC("be", 1, 0);
-    TEST_JCC("be", 1, -1);
-
-    TEST_JCC("ae", 1, 1);
-    TEST_JCC("ae", 1, 0);
-    TEST_JCC("ae", 1, -1);
-
-    TEST_JCC("a", 1, 1);
-    TEST_JCC("a", 1, 0);
-    TEST_JCC("a", 1, -1);
-
-
-    TEST_JCC("p", 1, 1);
-    TEST_JCC("p", 1, 0);
-
-    TEST_JCC("np", 1, 1);
-    TEST_JCC("np", 1, 0);
-
-    TEST_JCC("o", 0x7fffffff, 0);
-    TEST_JCC("o", 0x7fffffff, -1);
-
-    TEST_JCC("no", 0x7fffffff, 0);
-    TEST_JCC("no", 0x7fffffff, -1);
-
-    TEST_JCC("s", 0, 1);
-    TEST_JCC("s", 0, -1);
-    TEST_JCC("s", 0, 0);
-
-    TEST_JCC("ns", 0, 1);
-    TEST_JCC("ns", 0, -1);
-    TEST_JCC("ns", 0, 0);
-}
-
-#undef CC_MASK
-#ifdef TEST_P4_FLAGS
-#define CC_MASK (CC_C | CC_P | CC_Z | CC_S | CC_O | CC_A)
-#else
-#define CC_MASK (CC_O | CC_C)
-#endif
-
-#define OP mul
-#include "test-i386-muldiv.h"
-
-#define OP imul
-#include "test-i386-muldiv.h"
-
-void test_imulw2(long op0, long op1) 
-{
-    long res, s1, s0, flags;
-    s0 = op0;
-    s1 = op1;
-    res = s0;
-    flags = 0;
-    asm volatile ("push %4\n\t"
-         "popf\n\t"
-         "imulw %w2, %w0\n\t" 
-         "pushf\n\t"
-         "pop %1\n\t"
-         : "=q" (res), "=g" (flags)
-         : "q" (s1), "0" (res), "1" (flags));
-    printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CC=%04lx\n",
-           "imulw", s0, s1, res, flags & CC_MASK);
-}
-
-void test_imull2(long op0, long op1) 
-{
-    long res, s1, s0, flags;
-    s0 = op0;
-    s1 = op1;
-    res = s0;
-    flags = 0;
-    asm volatile ("push %4\n\t"
-         "popf\n\t"
-         "imull %k2, %k0\n\t" 
-         "pushf\n\t"
-         "pop %1\n\t"
-         : "=q" (res), "=g" (flags)
-         : "q" (s1), "0" (res), "1" (flags));
-    printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CC=%04lx\n",
-           "imull", s0, s1, res, flags & CC_MASK);
-}
-
-#if defined(__x86_64__)
-void test_imulq2(long op0, long op1) 
-{
-    long res, s1, s0, flags;
-    s0 = op0;
-    s1 = op1;
-    res = s0;
-    flags = 0;
-    asm volatile ("push %4\n\t"
-         "popf\n\t"
-         "imulq %2, %0\n\t" 
-         "pushf\n\t"
-         "pop %1\n\t"
-         : "=q" (res), "=g" (flags)
-         : "q" (s1), "0" (res), "1" (flags));
-    printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CC=%04lx\n",
-           "imulq", s0, s1, res, flags & CC_MASK);
-}
-#endif
-
-#define TEST_IMUL_IM(size, rsize, op0, op1)\
-{\
-    long res, flags, s1;\
-    flags = 0;\
-    res = 0;\
-    s1 = op1;\
-    asm volatile ("push %3\n\t"\
-         "popf\n\t"\
-         "imul" size " $" #op0 ", %" rsize "2, %" rsize "0\n\t" \
-         "pushf\n\t"\
-         "pop %1\n\t"\
-         : "=r" (res), "=g" (flags)\
-         : "r" (s1), "1" (flags), "0" (res));\
-    printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CC=%04lx\n",\
-           "imul" size " im", (long)op0, (long)op1, res, flags & CC_MASK);\
-}
-
-
-#undef CC_MASK
-#define CC_MASK (0)
-
-#define OP div
-#include "test-i386-muldiv.h"
-
-#define OP idiv
-#include "test-i386-muldiv.h"
-
-void test_mul(void)
-{
-    test_imulb(0x1234561d, 4);
-    test_imulb(3, -4);
-    test_imulb(0x80, 0x80);
-    test_imulb(0x10, 0x10);
-
-    test_imulw(0, 0x1234001d, 45);
-    test_imulw(0, 23, -45);
-    test_imulw(0, 0x8000, 0x8000);
-    test_imulw(0, 0x100, 0x100);
-
-    test_imull(0, 0x1234001d, 45);
-    test_imull(0, 23, -45);
-    test_imull(0, 0x80000000, 0x80000000);
-    test_imull(0, 0x10000, 0x10000);
-
-    test_mulb(0x1234561d, 4);
-    test_mulb(3, -4);
-    test_mulb(0x80, 0x80);
-    test_mulb(0x10, 0x10);
-
-    test_mulw(0, 0x1234001d, 45);
-    test_mulw(0, 23, -45);
-    test_mulw(0, 0x8000, 0x8000);
-    test_mulw(0, 0x100, 0x100);
-
-    test_mull(0, 0x1234001d, 45);
-    test_mull(0, 23, -45);
-    test_mull(0, 0x80000000, 0x80000000);
-    test_mull(0, 0x10000, 0x10000);
-
-    test_imulw2(0x1234001d, 45);
-    test_imulw2(23, -45);
-    test_imulw2(0x8000, 0x8000);
-    test_imulw2(0x100, 0x100);
-
-    test_imull2(0x1234001d, 45);
-    test_imull2(23, -45);
-    test_imull2(0x80000000, 0x80000000);
-    test_imull2(0x10000, 0x10000);
-
-    TEST_IMUL_IM("w", "w", 45, 0x1234);
-    TEST_IMUL_IM("w", "w", -45, 23);
-    TEST_IMUL_IM("w", "w", 0x8000, 0x80000000);
-    TEST_IMUL_IM("w", "w", 0x7fff, 0x1000);
-
-    TEST_IMUL_IM("l", "k", 45, 0x1234);
-    TEST_IMUL_IM("l", "k", -45, 23);
-    TEST_IMUL_IM("l", "k", 0x8000, 0x80000000);
-    TEST_IMUL_IM("l", "k", 0x7fff, 0x1000);
-
-    test_idivb(0x12341678, 0x127e);
-    test_idivb(0x43210123, -5);
-    test_idivb(0x12340004, -1);
-
-    test_idivw(0, 0x12345678, 12347);
-    test_idivw(0, -23223, -45);
-    test_idivw(0, 0x12348000, -1);
-    test_idivw(0x12343, 0x12345678, 0x81238567);
-
-    test_idivl(0, 0x12345678, 12347);
-    test_idivl(0, -233223, -45);
-    test_idivl(0, 0x80000000, -1);
-    test_idivl(0x12343, 0x12345678, 0x81234567);
-
-    test_divb(0x12341678, 0x127e);
-    test_divb(0x43210123, -5);
-    test_divb(0x12340004, -1);
-
-    test_divw(0, 0x12345678, 12347);
-    test_divw(0, -23223, -45);
-    test_divw(0, 0x12348000, -1);
-    test_divw(0x12343, 0x12345678, 0x81238567);
-
-    test_divl(0, 0x12345678, 12347);
-    test_divl(0, -233223, -45);
-    test_divl(0, 0x80000000, -1);
-    test_divl(0x12343, 0x12345678, 0x81234567);
-
-#if defined(__x86_64__)
-    test_imulq(0, 0x1234001d1234001d, 45);
-    test_imulq(0, 23, -45);
-    test_imulq(0, 0x8000000000000000, 0x8000000000000000);
-    test_imulq(0, 0x100000000, 0x100000000);
-
-    test_mulq(0, 0x1234001d1234001d, 45);
-    test_mulq(0, 23, -45);
-    test_mulq(0, 0x8000000000000000, 0x8000000000000000);
-    test_mulq(0, 0x100000000, 0x100000000);
-
-    test_imulq2(0x1234001d1234001d, 45);
-    test_imulq2(23, -45);
-    test_imulq2(0x8000000000000000, 0x8000000000000000);
-    test_imulq2(0x100000000, 0x100000000);
-
-    TEST_IMUL_IM("q", "", 45, 0x12341234);
-    TEST_IMUL_IM("q", "", -45, 23);
-    TEST_IMUL_IM("q", "", 0x8000, 0x8000000000000000);
-    TEST_IMUL_IM("q", "", 0x7fff, 0x10000000);
-
-    test_idivq(0, 0x12345678abcdef, 12347);
-    test_idivq(0, -233223, -45);
-    test_idivq(0, 0x8000000000000000, -1);
-    test_idivq(0x12343, 0x12345678, 0x81234567);
-
-    test_divq(0, 0x12345678abcdef, 12347);
-    test_divq(0, -233223, -45);
-    test_divq(0, 0x8000000000000000, -1);
-    test_divq(0x12343, 0x12345678, 0x81234567);
-#endif
-}
-
-#define TEST_BSX(op, size, op0)\
-{\
-    long res, val, resz;\
-    val = op0;\
-    asm("xor %1, %1\n"\
-        "mov $0x12345678, %0\n"\
-        #op " %" size "2, %" size "0 ; setz %b1" \
-        : "=r" (res), "=q" (resz)\
-        : "g" (val));\
-    printf("%-10s A=" FMTLX " R=" FMTLX " %ld\n", #op, val, res, resz);\
-}
-
-void test_bsx(void)
-{
-    TEST_BSX(bsrw, "w", 0);
-    TEST_BSX(bsrw, "w", 0x12340128);
-    TEST_BSX(bsfw, "w", 0);
-    TEST_BSX(bsfw, "w", 0x12340128);
-    TEST_BSX(bsrl, "k", 0);
-    TEST_BSX(bsrl, "k", 0x00340128);
-    TEST_BSX(bsfl, "k", 0);
-    TEST_BSX(bsfl, "k", 0x00340128);
-#if defined(__x86_64__)
-    TEST_BSX(bsrq, "", 0);
-    TEST_BSX(bsrq, "", 0x003401281234);
-    TEST_BSX(bsfq, "", 0);
-    TEST_BSX(bsfq, "", 0x003401281234);
-#endif
-}
-
-/**********************************************/
-
-union float64u {
-    double d;
-    uint64_t l;
-};
-
-union float64u q_nan = { .l = 0xFFF8000000000000 };
-union float64u s_nan = { .l = 0xFFF0000000000000 };
-
-void test_fops(double a, double b)
-{
-    printf("a=%f b=%f a+b=%f\n", a, b, a + b);
-    printf("a=%f b=%f a-b=%f\n", a, b, a - b);
-    printf("a=%f b=%f a*b=%f\n", a, b, a * b);
-    printf("a=%f b=%f a/b=%f\n", a, b, a / b);
-    printf("a=%f b=%f fmod(a, b)=%f\n", a, b, fmod(a, b));
-    printf("a=%f sqrt(a)=%f\n", a, sqrt(a));
-    printf("a=%f sin(a)=%f\n", a, sin(a));
-    printf("a=%f cos(a)=%f\n", a, cos(a));
-    printf("a=%f tan(a)=%f\n", a, tan(a));
-    printf("a=%f log(a)=%f\n", a, log(a));
-    printf("a=%f exp(a)=%f\n", a, exp(a));
-    printf("a=%f b=%f atan2(a, b)=%f\n", a, b, atan2(a, b));
-    /* just to test some op combining */
-    printf("a=%f asin(sin(a))=%f\n", a, asin(sin(a)));
-    printf("a=%f acos(cos(a))=%f\n", a, acos(cos(a)));
-    printf("a=%f atan(tan(a))=%f\n", a, atan(tan(a)));
-
-}
-
-void fpu_clear_exceptions(void)
-{
-    struct __attribute__((packed)) {
-        uint16_t fpuc;
-        uint16_t dummy1;
-        uint16_t fpus;
-        uint16_t dummy2;
-        uint16_t fptag;
-        uint16_t dummy3;
-        uint32_t ignored[4];
-        long double fpregs[8];
-    } float_env32;
-    
-    asm volatile ("fnstenv %0\n" : : "m" (float_env32));
-    float_env32.fpus &= ~0x7f;
-    asm volatile ("fldenv %0\n" : : "m" (float_env32));
-}
-
-/* XXX: display exception bits when supported */
-#define FPUS_EMASK 0x0000
-//#define FPUS_EMASK 0x007f
-
-void test_fcmp(double a, double b)
-{
-    long eflags, fpus;
-
-    fpu_clear_exceptions();
-    asm("fcom %2\n"
-        "fstsw %%ax\n"
-        : "=a" (fpus)
-        : "t" (a), "u" (b));
-    printf("fcom(%f %f)=%04lx \n", 
-           a, b, fpus & (0x4500 | FPUS_EMASK));
-    fpu_clear_exceptions();
-    asm("fucom %2\n"
-        "fstsw %%ax\n"
-        : "=a" (fpus)
-        : "t" (a), "u" (b));
-    printf("fucom(%f %f)=%04lx\n", 
-           a, b, fpus & (0x4500 | FPUS_EMASK));
-    if (TEST_FCOMI) {
-        /* test f(u)comi instruction */
-        fpu_clear_exceptions();
-        asm("fcomi %3, %2\n"
-            "fstsw %%ax\n"
-            "pushf\n"
-            "pop %0\n"
-            : "=r" (eflags), "=a" (fpus)
-            : "t" (a), "u" (b));
-        printf("fcomi(%f %f)=%04lx %02lx\n", 
-               a, b, fpus & FPUS_EMASK, eflags & (CC_Z | CC_P | CC_C));
-        fpu_clear_exceptions();
-        asm("fucomi %3, %2\n"
-            "fstsw %%ax\n"
-            "pushf\n"
-            "pop %0\n"
-            : "=r" (eflags), "=a" (fpus)
-            : "t" (a), "u" (b));
-        printf("fucomi(%f %f)=%04lx %02lx\n", 
-               a, b, fpus & FPUS_EMASK, eflags & (CC_Z | CC_P | CC_C));
-    }
-    fpu_clear_exceptions();
-    asm volatile("fxam\n"
-                 "fstsw %%ax\n"
-                 : "=a" (fpus)
-                 : "t" (a));
-    printf("fxam(%f)=%04lx\n", a, fpus & 0x4700);
-    fpu_clear_exceptions();
-}
-
-void test_fcvt(double a)
-{
-    float fa;
-    long double la;
-    int16_t fpuc;
-    int i;
-    int64_t lla;
-    int ia;
-    int16_t wa;
-    double ra;
-
-    fa = a;
-    la = a;
-    printf("(float)%f = %f\n", a, fa);
-    printf("(long double)%f = %Lf\n", a, la);
-    printf("a=" FMT64X "\n", *(uint64_t *)&a);
-    printf("la=" FMT64X " %04x\n", *(uint64_t *)&la, 
-           *(unsigned short *)((char *)(&la) + 8));
-
-    /* test all roundings */
-    asm volatile ("fstcw %0" : "=m" (fpuc));
-    for(i=0;i<4;i++) {
-        asm volatile ("fldcw %0" : : "m" ((fpuc & ~0x0c00) | (i << 10)));
-        asm volatile ("fist %0" : "=m" (wa) : "t" (a));
-        asm volatile ("fistl %0" : "=m" (ia) : "t" (a));
-        asm volatile ("fistpll %0" : "=m" (lla) : "t" (a) : "st");
-        asm volatile ("frndint ; fstl %0" : "=m" (ra) : "t" (a));
-        asm volatile ("fldcw %0" : : "m" (fpuc));
-        printf("(short)a = %d\n", wa);
-        printf("(int)a = %d\n", ia);
-        printf("(int64_t)a = " FMT64X "\n", lla);
-        printf("rint(a) = %f\n", ra);
-    }
-}
-
-#define TEST(N) \
-    asm("fld" #N : "=t" (a)); \
-    printf("fld" #N "= %f\n", a);
-
-void test_fconst(void)
-{
-    double a;
-    TEST(1);
-    TEST(l2t);
-    TEST(l2e);
-    TEST(pi);
-    TEST(lg2);
-    TEST(ln2);
-    TEST(z);
-}
-
-void test_fbcd(double a)
-{
-    unsigned short bcd[5];
-    double b;
-
-    asm("fbstp %0" : "=m" (bcd[0]) : "t" (a) : "st");
-    asm("fbld %1" : "=t" (b) : "m" (bcd[0]));
-    printf("a=%f bcd=%04x%04x%04x%04x%04x b=%f\n", 
-           a, bcd[4], bcd[3], bcd[2], bcd[1], bcd[0], b);
-}
-
-#define TEST_ENV(env, save, restore)\
-{\
-    memset((env), 0xaa, sizeof(*(env)));\
-    for(i=0;i<5;i++)\
-        asm volatile ("fldl %0" : : "m" (dtab[i]));\
-    asm volatile (save " %0\n" : : "m" (*(env)));\
-    asm volatile (restore " %0\n": : "m" (*(env)));\
-    for(i=0;i<5;i++)\
-        asm volatile ("fstpl %0" : "=m" (rtab[i]));\
-    for(i=0;i<5;i++)\
-        printf("res[%d]=%f\n", i, rtab[i]);\
-    printf("fpuc=%04x fpus=%04x fptag=%04x\n",\
-           (env)->fpuc,\
-           (env)->fpus & 0xff00,\
-           (env)->fptag);\
-}
-
-void test_fenv(void)
-{
-    struct __attribute__((packed)) {
-        uint16_t fpuc;
-        uint16_t dummy1;
-        uint16_t fpus;
-        uint16_t dummy2;
-        uint16_t fptag;
-        uint16_t dummy3;
-        uint32_t ignored[4];
-        long double fpregs[8];
-    } float_env32;
-    struct __attribute__((packed)) {
-        uint16_t fpuc;
-        uint16_t fpus;
-        uint16_t fptag;
-        uint16_t ignored[4];
-        long double fpregs[8];
-    } float_env16;
-    double dtab[8];
-    double rtab[8];
-    int i;
-
-    for(i=0;i<8;i++)
-        dtab[i] = i + 1;
-
-    TEST_ENV(&float_env16, "data16 fnstenv", "data16 fldenv");
-    TEST_ENV(&float_env16, "data16 fnsave", "data16 frstor");
-    TEST_ENV(&float_env32, "fnstenv", "fldenv");
-    TEST_ENV(&float_env32, "fnsave", "frstor");
-
-    /* test for ffree */
-    for(i=0;i<5;i++)
-        asm volatile ("fldl %0" : : "m" (dtab[i]));
-    asm volatile("ffree %st(2)");
-    asm volatile ("fnstenv %0\n" : : "m" (float_env32));
-    asm volatile ("fninit");
-    printf("fptag=%04x\n", float_env32.fptag);
-}
-
-
-#define TEST_FCMOV(a, b, eflags, CC)\
-{\
-    double res;\
-    asm("push %3\n"\
-        "popf\n"\
-        "fcmov" CC " %2, %0\n"\
-        : "=t" (res)\
-        : "0" (a), "u" (b), "g" (eflags));\
-    printf("fcmov%s eflags=0x%04lx-> %f\n", \
-           CC, (long)eflags, res);\
-}
-
-void test_fcmov(void)
-{
-    double a, b;
-    long eflags, i;
-
-    a = 1.0;
-    b = 2.0;
-    for(i = 0; i < 4; i++) {
-        eflags = 0;
-        if (i & 1)
-            eflags |= CC_C;
-        if (i & 2)
-            eflags |= CC_Z;
-        TEST_FCMOV(a, b, eflags, "b");
-        TEST_FCMOV(a, b, eflags, "e");
-        TEST_FCMOV(a, b, eflags, "be");
-        TEST_FCMOV(a, b, eflags, "nb");
-        TEST_FCMOV(a, b, eflags, "ne");
-        TEST_FCMOV(a, b, eflags, "nbe");
-    }
-    TEST_FCMOV(a, b, 0, "u");
-    TEST_FCMOV(a, b, CC_P, "u");
-    TEST_FCMOV(a, b, 0, "nu");
-    TEST_FCMOV(a, b, CC_P, "nu");
-}
-
-void test_floats(void)
-{
-    test_fops(2, 3);
-    test_fops(1.4, -5);
-    test_fcmp(2, -1);
-    test_fcmp(2, 2);
-    test_fcmp(2, 3);
-    test_fcmp(2, q_nan.d);
-    test_fcmp(q_nan.d, -1);
-    test_fcmp(-1.0/0.0, -1);
-    test_fcmp(1.0/0.0, -1);
-    test_fcvt(0.5);
-    test_fcvt(-0.5);
-    test_fcvt(1.0/7.0);
-    test_fcvt(-1.0/9.0);
-    test_fcvt(32768);
-    test_fcvt(-1e20);
-    test_fcvt(-1.0/0.0);
-    test_fcvt(1.0/0.0);
-    test_fcvt(q_nan.d);
-    test_fconst();
-    test_fbcd(1234567890123456);
-    test_fbcd(-123451234567890);
-    test_fenv();
-    if (TEST_CMOV) {
-        test_fcmov();
-    }
-}
-
-/**********************************************/
-#if !defined(__x86_64__)
-
-#define TEST_BCD(op, op0, cc_in, cc_mask)\
-{\
-    int res, flags;\
-    res = op0;\
-    flags = cc_in;\
-    asm ("push %3\n\t"\
-         "popf\n\t"\
-         #op "\n\t"\
-         "pushf\n\t"\
-         "pop %1\n\t"\
-        : "=a" (res), "=g" (flags)\
-        : "0" (res), "1" (flags));\
-    printf("%-10s A=%08x R=%08x CCIN=%04x CC=%04x\n",\
-           #op, op0, res, cc_in, flags & cc_mask);\
-}
-
-void test_bcd(void)
-{
-    TEST_BCD(daa, 0x12340503, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x12340506, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x12340507, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x12340559, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x12340560, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x1234059f, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x123405a0, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x12340503, 0, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x12340506, 0, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x12340503, CC_C, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x12340506, CC_C, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x12340503, CC_C | CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(daa, 0x12340506, CC_C | CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-
-    TEST_BCD(das, 0x12340503, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x12340506, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x12340507, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x12340559, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x12340560, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x1234059f, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x123405a0, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x12340503, 0, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x12340506, 0, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x12340503, CC_C, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x12340506, CC_C, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x12340503, CC_C | CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-    TEST_BCD(das, 0x12340506, CC_C | CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_A));
-
-    TEST_BCD(aaa, 0x12340205, CC_A, (CC_C | CC_A));
-    TEST_BCD(aaa, 0x12340306, CC_A, (CC_C | CC_A));
-    TEST_BCD(aaa, 0x1234040a, CC_A, (CC_C | CC_A));
-    TEST_BCD(aaa, 0x123405fa, CC_A, (CC_C | CC_A));
-    TEST_BCD(aaa, 0x12340205, 0, (CC_C | CC_A));
-    TEST_BCD(aaa, 0x12340306, 0, (CC_C | CC_A));
-    TEST_BCD(aaa, 0x1234040a, 0, (CC_C | CC_A));
-    TEST_BCD(aaa, 0x123405fa, 0, (CC_C | CC_A));
-    
-    TEST_BCD(aas, 0x12340205, CC_A, (CC_C | CC_A));
-    TEST_BCD(aas, 0x12340306, CC_A, (CC_C | CC_A));
-    TEST_BCD(aas, 0x1234040a, CC_A, (CC_C | CC_A));
-    TEST_BCD(aas, 0x123405fa, CC_A, (CC_C | CC_A));
-    TEST_BCD(aas, 0x12340205, 0, (CC_C | CC_A));
-    TEST_BCD(aas, 0x12340306, 0, (CC_C | CC_A));
-    TEST_BCD(aas, 0x1234040a, 0, (CC_C | CC_A));
-    TEST_BCD(aas, 0x123405fa, 0, (CC_C | CC_A));
-
-    TEST_BCD(aam, 0x12340547, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_O | CC_A));
-    TEST_BCD(aad, 0x12340407, CC_A, (CC_C | CC_P | CC_Z | CC_S | CC_O | CC_A));
-}
-#endif
-
-#define TEST_XCHG(op, size, opconst)\
-{\
-    long op0, op1;\
-    op0 = i2l(0x12345678);\
-    op1 = i2l(0xfbca7654);\
-    asm(#op " %" size "0, %" size "1" \
-        : "=q" (op0), opconst (op1) \
-        : "0" (op0), "1" (op1));\
-    printf("%-10s A=" FMTLX " B=" FMTLX "\n",\
-           #op, op0, op1);\
-}
-
-#define TEST_CMPXCHG(op, size, opconst, eax)\
-{\
-    long op0, op1, op2;\
-    op0 = i2l(0x12345678);\
-    op1 = i2l(0xfbca7654);\
-    op2 = i2l(eax);\
-    asm(#op " %" size "0, %" size "1" \
-        : "=q" (op0), opconst (op1) \
-        : "0" (op0), "1" (op1), "a" (op2));\
-    printf("%-10s EAX=" FMTLX " A=" FMTLX " C=" FMTLX "\n",\
-           #op, op2, op0, op1);\
-}
-
-void test_xchg(void)
-{
-#if defined(__x86_64__)
-    TEST_XCHG(xchgq, "", "=q");
-#endif
-    TEST_XCHG(xchgl, "k", "=q");
-    TEST_XCHG(xchgw, "w", "=q");
-    TEST_XCHG(xchgb, "b", "=q");
-
-#if defined(__x86_64__)
-    TEST_XCHG(xchgq, "", "=m");
-#endif
-    TEST_XCHG(xchgl, "k", "=m");
-    TEST_XCHG(xchgw, "w", "=m");
-    TEST_XCHG(xchgb, "b", "=m");
-
-#if defined(__x86_64__)
-    TEST_XCHG(xaddq, "", "=q");
-#endif
-    TEST_XCHG(xaddl, "k", "=q");
-    TEST_XCHG(xaddw, "w", "=q");
-    TEST_XCHG(xaddb, "b", "=q");
-
-    {
-        int res;
-        res = 0x12345678;
-        asm("xaddl %1, %0" : "=r" (res) : "0" (res));
-        printf("xaddl same res=%08x\n", res);
-    }
-
-#if defined(__x86_64__)
-    TEST_XCHG(xaddq, "", "=m");
-#endif
-    TEST_XCHG(xaddl, "k", "=m");
-    TEST_XCHG(xaddw, "w", "=m");
-    TEST_XCHG(xaddb, "b", "=m");
-
-#if defined(__x86_64__)
-    TEST_CMPXCHG(cmpxchgq, "", "=q", 0xfbca7654);
-#endif
-    TEST_CMPXCHG(cmpxchgl, "k", "=q", 0xfbca7654);
-    TEST_CMPXCHG(cmpxchgw, "w", "=q", 0xfbca7654);
-    TEST_CMPXCHG(cmpxchgb, "b", "=q", 0xfbca7654);
-
-#if defined(__x86_64__)
-    TEST_CMPXCHG(cmpxchgq, "", "=q", 0xfffefdfc);
-#endif
-    TEST_CMPXCHG(cmpxchgl, "k", "=q", 0xfffefdfc);
-    TEST_CMPXCHG(cmpxchgw, "w", "=q", 0xfffefdfc);
-    TEST_CMPXCHG(cmpxchgb, "b", "=q", 0xfffefdfc);
-
-#if defined(__x86_64__)
-    TEST_CMPXCHG(cmpxchgq, "", "=m", 0xfbca7654);
-#endif
-    TEST_CMPXCHG(cmpxchgl, "k", "=m", 0xfbca7654);
-    TEST_CMPXCHG(cmpxchgw, "w", "=m", 0xfbca7654);
-    TEST_CMPXCHG(cmpxchgb, "b", "=m", 0xfbca7654);
-
-#if defined(__x86_64__)
-    TEST_CMPXCHG(cmpxchgq, "", "=m", 0xfffefdfc);
-#endif
-    TEST_CMPXCHG(cmpxchgl, "k", "=m", 0xfffefdfc);
-    TEST_CMPXCHG(cmpxchgw, "w", "=m", 0xfffefdfc);
-    TEST_CMPXCHG(cmpxchgb, "b", "=m", 0xfffefdfc);
-
-    {
-        uint64_t op0, op1, op2;
-        long i, eflags;
-
-        for(i = 0; i < 2; i++) {
-            op0 = 0x123456789abcd;
-            if (i == 0)
-                op1 = 0xfbca765423456;
-            else
-                op1 = op0;
-            op2 = 0x6532432432434;
-            asm("cmpxchg8b %1\n" 
-                "pushf\n"
-                "pop %2\n"
-                : "=A" (op0), "=m" (op1), "=g" (eflags)
-                : "0" (op0), "m" (op1), "b" ((int)op2), "c" ((int)(op2 >> 32)));
-            printf("cmpxchg8b: op0=" FMT64X " op1=" FMT64X " CC=%02lx\n", 
-                    op0, op1, eflags & CC_Z);
-        }
-    }
-}
-
-#ifdef TEST_SEGS
-/**********************************************/
-/* segmentation tests */
-
-#include <asm/ldt.h>
-#include <linux/unistd.h>
-#include <linux/version.h>
-
-_syscall3(int, modify_ldt, int, func, void *, ptr, unsigned long, bytecount)
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 66)
-#define modify_ldt_ldt_s user_desc
-#endif
-
-#define MK_SEL(n) (((n) << 3) | 7)
-
-uint8_t seg_data1[4096];
-uint8_t seg_data2[4096];
-
-#define TEST_LR(op, size, seg, mask)\
-{\
-    int res, res2;\
-    res = 0x12345678;\
-    asm (op " %" size "2, %" size "0\n" \
-         "movl $0, %1\n"\
-         "jnz 1f\n"\
-         "movl $1, %1\n"\
-         "1:\n"\
-         : "=r" (res), "=r" (res2) : "m" (seg), "0" (res));\
-    printf(op ": Z=%d %08x\n", res2, res & ~(mask));\
-}
-
-/* NOTE: we use Linux modify_ldt syscall */
-void test_segs(void)
-{
-    struct modify_ldt_ldt_s ldt;
-    long long ldt_table[3];
-    int res, res2;
-    char tmp;
-    struct {
-        uint32_t offset;
-        uint16_t seg;
-    } __attribute__((packed)) segoff;
-
-    ldt.entry_number = 1;
-    ldt.base_addr = (unsigned long)&seg_data1;
-    ldt.limit = (sizeof(seg_data1) + 0xfff) >> 12;
-    ldt.seg_32bit = 1;
-    ldt.contents = MODIFY_LDT_CONTENTS_DATA;
-    ldt.read_exec_only = 0;
-    ldt.limit_in_pages = 1;
-    ldt.seg_not_present = 0;
-    ldt.useable = 1;
-    modify_ldt(1, &ldt, sizeof(ldt)); /* write ldt entry */
-
-    ldt.entry_number = 2;
-    ldt.base_addr = (unsigned long)&seg_data2;
-    ldt.limit = (sizeof(seg_data2) + 0xfff) >> 12;
-    ldt.seg_32bit = 1;
-    ldt.contents = MODIFY_LDT_CONTENTS_DATA;
-    ldt.read_exec_only = 0;
-    ldt.limit_in_pages = 1;
-    ldt.seg_not_present = 0;
-    ldt.useable = 1;
-    modify_ldt(1, &ldt, sizeof(ldt)); /* write ldt entry */
-
-    modify_ldt(0, &ldt_table, sizeof(ldt_table)); /* read ldt entries */
-#if 0
-    {
-        int i;
-        for(i=0;i<3;i++)
-            printf("%d: %016Lx\n", i, ldt_table[i]);
-    }
-#endif
-    /* do some tests with fs or gs */
-    asm volatile ("movl %0, %%fs" : : "r" (MK_SEL(1)));
-
-    seg_data1[1] = 0xaa;
-    seg_data2[1] = 0x55;
-
-    asm volatile ("fs movzbl 0x1, %0" : "=r" (res));
-    printf("FS[1] = %02x\n", res);
-
-    asm volatile ("pushl %%gs\n"
-                  "movl %1, %%gs\n"
-                  "gs movzbl 0x1, %0\n"
-                  "popl %%gs\n"
-                  : "=r" (res)
-                  : "r" (MK_SEL(2)));
-    printf("GS[1] = %02x\n", res);
-
-    /* tests with ds/ss (implicit segment case) */
-    tmp = 0xa5;
-    asm volatile ("pushl %%ebp\n\t"
-                  "pushl %%ds\n\t"
-                  "movl %2, %%ds\n\t"
-                  "movl %3, %%ebp\n\t"
-                  "movzbl 0x1, %0\n\t"
-                  "movzbl (%%ebp), %1\n\t"
-                  "popl %%ds\n\t"
-                  "popl %%ebp\n\t"
-                  : "=r" (res), "=r" (res2)
-                  : "r" (MK_SEL(1)), "r" (&tmp));
-    printf("DS[1] = %02x\n", res);
-    printf("SS[tmp] = %02x\n", res2);
-
-    segoff.seg = MK_SEL(2);
-    segoff.offset = 0xabcdef12;
-    asm volatile("lfs %2, %0\n\t" 
-                 "movl %%fs, %1\n\t"
-                 : "=r" (res), "=g" (res2) 
-                 : "m" (segoff));
-    printf("FS:reg = %04x:%08x\n", res2, res);
-
-    TEST_LR("larw", "w", MK_SEL(2), 0x0100);
-    TEST_LR("larl", "", MK_SEL(2), 0x0100);
-    TEST_LR("lslw", "w", MK_SEL(2), 0);
-    TEST_LR("lsll", "", MK_SEL(2), 0);
-
-    TEST_LR("larw", "w", 0xfff8, 0);
-    TEST_LR("larl", "", 0xfff8, 0);
-    TEST_LR("lslw", "w", 0xfff8, 0);
-    TEST_LR("lsll", "", 0xfff8, 0);
-}
-
-/* 16 bit code test */
-extern char code16_start, code16_end;
-extern char code16_func1;
-extern char code16_func2;
-extern char code16_func3;
-
-void test_code16(void)
-{
-    struct modify_ldt_ldt_s ldt;
-    int res, res2;
-
-    /* build a code segment */
-    ldt.entry_number = 1;
-    ldt.base_addr = (unsigned long)&code16_start;
-    ldt.limit = &code16_end - &code16_start;
-    ldt.seg_32bit = 0;
-    ldt.contents = MODIFY_LDT_CONTENTS_CODE;
-    ldt.read_exec_only = 0;
-    ldt.limit_in_pages = 0;
-    ldt.seg_not_present = 0;
-    ldt.useable = 1;
-    modify_ldt(1, &ldt, sizeof(ldt)); /* write ldt entry */
-
-    /* call the first function */
-    asm volatile ("lcall %1, %2" 
-                  : "=a" (res)
-                  : "i" (MK_SEL(1)), "i" (&code16_func1): "memory", "cc");
-    printf("func1() = 0x%08x\n", res);
-    asm volatile ("lcall %2, %3" 
-                  : "=a" (res), "=c" (res2)
-                  : "i" (MK_SEL(1)), "i" (&code16_func2): "memory", "cc");
-    printf("func2() = 0x%08x spdec=%d\n", res, res2);
-    asm volatile ("lcall %1, %2" 
-                  : "=a" (res)
-                  : "i" (MK_SEL(1)), "i" (&code16_func3): "memory", "cc");
-    printf("func3() = 0x%08x\n", res);
-}
-#endif
-
-#if defined(__x86_64__)
-asm(".globl func_lret\n"
-    "func_lret:\n"
-    "movl $0x87654641, %eax\n"
-    "lretq\n");
-#else
-asm(".globl func_lret\n"
-    "func_lret:\n"
-    "movl $0x87654321, %eax\n"
-    "lret\n"
-
-    ".globl func_iret\n"
-    "func_iret:\n"
-    "movl $0xabcd4321, %eax\n"
-    "iret\n");
-#endif
-
-extern char func_lret;
-extern char func_iret;
-
-void test_misc(void)
-{
-    char table[256];
-    long res, i;
-
-    for(i=0;i<256;i++) table[i] = 256 - i;
-    res = 0x12345678;
-    asm ("xlat" : "=a" (res) : "b" (table), "0" (res));
-    printf("xlat: EAX=" FMTLX "\n", res);
-
-#if defined(__x86_64__)
-    {
-        static struct __attribute__((packed)) {
-            uint32_t offset;
-            uint16_t seg;
-        } desc;
-        long cs_sel;
-
-        asm volatile ("mov %%cs, %0" : "=r" (cs_sel));
-
-        asm volatile ("push %1\n"
-                      "call func_lret\n" 
-                      : "=a" (res)
-                      : "r" (cs_sel) : "memory", "cc");
-        printf("func_lret=" FMTLX "\n", res);
-
-        /* NOTE: we assume that &func_lret < 4GB */
-        desc.offset = (long)&func_lret;
-        desc.seg = cs_sel;
-        
-        asm volatile ("xor %%rax, %%rax\n"
-                      "rex64 lcall %1\n"
-                      : "=a" (res)
-                      : "m" (desc) 
-                      : "memory", "cc");
-        printf("func_lret2=" FMTLX "\n", res);
-
-        asm volatile ("push %2\n"
-                      "mov $ 1f, %%rax\n"
-                      "push %%rax\n"
-                      "ljmp %1\n"
-                      "1:\n"
-                      : "=a" (res)
-                      : "m" (desc), "b" (cs_sel)
-                      : "memory", "cc");
-        printf("func_lret3=" FMTLX "\n", res);
-    }
-#else
-    asm volatile ("push %%cs ; call %1" 
-                  : "=a" (res)
-                  : "m" (func_lret): "memory", "cc");
-    printf("func_lret=" FMTLX "\n", res);
-
-    asm volatile ("pushf ; push %%cs ; call %1" 
-                  : "=a" (res)
-                  : "m" (func_iret): "memory", "cc");
-    printf("func_iret=" FMTLX "\n", res);
-#endif
-
-#if defined(__x86_64__)
-    /* specific popl test */
-    asm volatile ("push $12345432 ; push $0x9abcdef ; pop (%%rsp) ; pop %0"
-                  : "=g" (res));
-    printf("popl esp=" FMTLX "\n", res);
-#else
-    /* specific popl test */
-    asm volatile ("pushl $12345432 ; pushl $0x9abcdef ; popl (%%esp) ; popl %0"
-                  : "=g" (res));
-    printf("popl esp=" FMTLX "\n", res);
-
-    /* specific popw test */
-    asm volatile ("pushl $12345432 ; pushl $0x9abcdef ; popw (%%esp) ; addl $2, %%esp ; popl %0"
-                  : "=g" (res));
-    printf("popw esp=" FMTLX "\n", res);
-#endif
-}
-
-uint8_t str_buffer[4096];
-
-#define TEST_STRING1(OP, size, DF, REP)\
-{\
-    long esi, edi, eax, ecx, eflags;\
-\
-    esi = (long)(str_buffer + sizeof(str_buffer) / 2);\
-    edi = (long)(str_buffer + sizeof(str_buffer) / 2) + 16;\
-    eax = i2l(0x12345678);\
-    ecx = 17;\
-\
-    asm volatile ("push $0\n\t"\
-                  "popf\n\t"\
-                  DF "\n\t"\
-                  REP #OP size "\n\t"\
-                  "cld\n\t"\
-                  "pushf\n\t"\
-                  "pop %4\n\t"\
-                  : "=S" (esi), "=D" (edi), "=a" (eax), "=c" (ecx), "=g" (eflags)\
-                  : "0" (esi), "1" (edi), "2" (eax), "3" (ecx));\
-    printf("%-10s ESI=" FMTLX " EDI=" FMTLX " EAX=" FMTLX " ECX=" FMTLX " EFL=%04x\n",\
-           REP #OP size, esi, edi, eax, ecx,\
-           (int)(eflags & (CC_C | CC_P | CC_Z | CC_S | CC_O | CC_A)));\
-}
-
-#define TEST_STRING(OP, REP)\
-    TEST_STRING1(OP, "b", "", REP);\
-    TEST_STRING1(OP, "w", "", REP);\
-    TEST_STRING1(OP, "l", "", REP);\
-    X86_64_ONLY(TEST_STRING1(OP, "q", "", REP));\
-    TEST_STRING1(OP, "b", "std", REP);\
-    TEST_STRING1(OP, "w", "std", REP);\
-    TEST_STRING1(OP, "l", "std", REP);\
-    X86_64_ONLY(TEST_STRING1(OP, "q", "std", REP))
-
-void test_string(void)
-{
-    int i;
-    for(i = 0;i < sizeof(str_buffer); i++)
-        str_buffer[i] = i + 0x56;
-   TEST_STRING(stos, "");
-   TEST_STRING(stos, "rep ");
-   TEST_STRING(lods, ""); /* to verify stos */
-   TEST_STRING(lods, "rep "); 
-   TEST_STRING(movs, "");
-   TEST_STRING(movs, "rep ");
-   TEST_STRING(lods, ""); /* to verify stos */
-
-   /* XXX: better tests */
-   TEST_STRING(scas, "");
-   TEST_STRING(scas, "repz ");
-   TEST_STRING(scas, "repnz ");
-   TEST_STRING(cmps, "");
-   TEST_STRING(cmps, "repz ");
-   TEST_STRING(cmps, "repnz ");
-}
-
-#ifdef TEST_VM86
-/* VM86 test */
-
-static inline void set_bit(uint8_t *a, unsigned int bit)
-{
-    a[bit / 8] |= (1 << (bit % 8));
-}
-
-static inline uint8_t *seg_to_linear(unsigned int seg, unsigned int reg)
-{
-    return (uint8_t *)((seg << 4) + (reg & 0xffff));
-}
-
-static inline void pushw(struct vm86_regs *r, int val)
-{
-    r->esp = (r->esp & ~0xffff) | ((r->esp - 2) & 0xffff);
-    *(uint16_t *)seg_to_linear(r->ss, r->esp) = val;
-}
-
-#undef __syscall_return
-#define __syscall_return(type, res) \
-do { \
-	return (type) (res); \
-} while (0)
-
-_syscall2(int, vm86, int, func, struct vm86plus_struct *, v86)
-
-extern char vm86_code_start;
-extern char vm86_code_end;
-
-#define VM86_CODE_CS 0x100
-#define VM86_CODE_IP 0x100
-
-void test_vm86(void)
-{
-    struct vm86plus_struct ctx;
-    struct vm86_regs *r;
-    uint8_t *vm86_mem;
-    int seg, ret;
-
-    vm86_mem = mmap((void *)0x00000000, 0x110000, 
-                    PROT_WRITE | PROT_READ | PROT_EXEC, 
-                    MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0);
-    if (vm86_mem == MAP_FAILED) {
-        printf("ERROR: could not map vm86 memory");
-        return;
-    }
-    memset(&ctx, 0, sizeof(ctx));
-
-    /* init basic registers */
-    r = &ctx.regs;
-    r->eip = VM86_CODE_IP;
-    r->esp = 0xfffe;
-    seg = VM86_CODE_CS;
-    r->cs = seg;
-    r->ss = seg;
-    r->ds = seg;
-    r->es = seg;
-    r->fs = seg;
-    r->gs = seg;
-    r->eflags = VIF_MASK;
-
-    /* move code to proper address. We use the same layout as a .com
-       dos program. */
-    memcpy(vm86_mem + (VM86_CODE_CS << 4) + VM86_CODE_IP, 
-           &vm86_code_start, &vm86_code_end - &vm86_code_start);
-
-    /* mark int 0x21 as being emulated */
-    set_bit((uint8_t *)&ctx.int_revectored, 0x21);
-
-    for(;;) {
-        ret = vm86(VM86_ENTER, &ctx);
-        switch(VM86_TYPE(ret)) {
-        case VM86_INTx:
-            {
-                int int_num, ah, v;
-                
-                int_num = VM86_ARG(ret);
-                if (int_num != 0x21)
-                    goto unknown_int;
-                ah = (r->eax >> 8) & 0xff;
-                switch(ah) {
-                case 0x00: /* exit */
-                    goto the_end;
-                case 0x02: /* write char */
-                    {
-                        uint8_t c = r->edx;
-                        putchar(c);
-                    }
-                    break;
-                case 0x09: /* write string */
-                    {
-                        uint8_t c, *ptr;
-                        ptr = seg_to_linear(r->ds, r->edx);
-                        for(;;) {
-                            c = *ptr++;
-                            if (c == '$')
-                                break;
-                            putchar(c);
-                        }
-                        r->eax = (r->eax & ~0xff) | '$';
-                    }
-                    break;
-                case 0xff: /* extension: write eflags number in edx */
-                    v = (int)r->edx;
-#ifndef LINUX_VM86_IOPL_FIX
-                    v &= ~0x3000;
-#endif
-                    printf("%08x\n", v);
-                    break;
-                default:
-                unknown_int:
-                    printf("unsupported int 0x%02x\n", int_num);
-                    goto the_end;
-                }
-            }
-            break;
-        case VM86_SIGNAL:
-            /* a signal came, we just ignore that */
-            break;
-        case VM86_STI:
-            break;
-        default:
-            printf("ERROR: unhandled vm86 return code (0x%x)\n", ret);
-            goto the_end;
-        }
-    }
- the_end:
-    printf("VM86 end\n");
-    munmap(vm86_mem, 0x110000);
-}
-#endif
-
-/* exception tests */
-#if defined(__i386__) && !defined(REG_EAX)
-#define REG_EAX EAX
-#define REG_EBX EBX
-#define REG_ECX ECX
-#define REG_EDX EDX
-#define REG_ESI ESI
-#define REG_EDI EDI
-#define REG_EBP EBP
-#define REG_ESP ESP
-#define REG_EIP EIP
-#define REG_EFL EFL
-#define REG_TRAPNO TRAPNO
-#define REG_ERR ERR
-#endif
-
-#if defined(__x86_64__)
-#define REG_EIP REG_RIP
-#endif
-
-jmp_buf jmp_env;
-int v1;
-int tab[2];
-
-void sig_handler(int sig, siginfo_t *info, void *puc)
-{
-    struct ucontext *uc = puc;
-
-    printf("si_signo=%d si_errno=%d si_code=%d",
-           info->si_signo, info->si_errno, info->si_code);
-    printf(" si_addr=0x%08lx",
-           (unsigned long)info->si_addr);
-    printf("\n");
-
-    printf("trapno=" FMTLX " err=" FMTLX,
-           (long)uc->uc_mcontext.gregs[REG_TRAPNO],
-           (long)uc->uc_mcontext.gregs[REG_ERR]);
-    printf(" EIP=" FMTLX, (long)uc->uc_mcontext.gregs[REG_EIP]);
-    printf("\n");
-    longjmp(jmp_env, 1);
-}
-
-void test_exceptions(void)
-{
-    struct sigaction act;
-    volatile int val;
-    
-    act.sa_sigaction = sig_handler;
-    sigemptyset(&act.sa_mask);
-    act.sa_flags = SA_SIGINFO | SA_NODEFER;
-    sigaction(SIGFPE, &act, NULL);
-    sigaction(SIGILL, &act, NULL);
-    sigaction(SIGSEGV, &act, NULL);
-    sigaction(SIGBUS, &act, NULL);
-    sigaction(SIGTRAP, &act, NULL);
-
-    /* test division by zero reporting */
-    printf("DIVZ exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        /* now divide by zero */
-        v1 = 0;
-        v1 = 2 / v1;
-    }
-
-#if !defined(__x86_64__)
-    printf("BOUND exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        /* bound exception */
-        tab[0] = 1;
-        tab[1] = 10;
-        asm volatile ("bound %0, %1" : : "r" (11), "m" (tab[0]));
-    }
-#endif
-
-#ifdef TEST_SEGS
-    printf("segment exceptions:\n");
-    if (setjmp(jmp_env) == 0) {
-        /* load an invalid segment */
-        asm volatile ("movl %0, %%fs" : : "r" ((0x1234 << 3) | 1));
-    }
-    if (setjmp(jmp_env) == 0) {
-        /* null data segment is valid */
-        asm volatile ("movl %0, %%fs" : : "r" (3));
-        /* null stack segment */
-        asm volatile ("movl %0, %%ss" : : "r" (3));
-    }
-
-    {
-        struct modify_ldt_ldt_s ldt;
-        ldt.entry_number = 1;
-        ldt.base_addr = (unsigned long)&seg_data1;
-        ldt.limit = (sizeof(seg_data1) + 0xfff) >> 12;
-        ldt.seg_32bit = 1;
-        ldt.contents = MODIFY_LDT_CONTENTS_DATA;
-        ldt.read_exec_only = 0;
-        ldt.limit_in_pages = 1;
-        ldt.seg_not_present = 1;
-        ldt.useable = 1;
-        modify_ldt(1, &ldt, sizeof(ldt)); /* write ldt entry */
-        
-        if (setjmp(jmp_env) == 0) {
-            /* segment not present */
-            asm volatile ("movl %0, %%fs" : : "r" (MK_SEL(1)));
-        }
-    }
-#endif
-
-    /* test SEGV reporting */
-    printf("PF exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        val = 1;
-        /* we add a nop to test a weird PC retrieval case */
-        asm volatile ("nop");
-        /* now store in an invalid address */
-        *(char *)0x1234 = 1;
-    }
-
-    /* test SEGV reporting */
-    printf("PF exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        val = 1;
-        /* read from an invalid address */
-        v1 = *(char *)0x1234;
-    }
-    
-    /* test illegal instruction reporting */
-    printf("UD2 exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        /* now execute an invalid instruction */
-        asm volatile("ud2");
-    }
-    printf("lock nop exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        /* now execute an invalid instruction */
-        asm volatile("lock nop");
-    }
-    
-    printf("INT exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("int $0xfd");
-    }
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("int $0x01");
-    }
-    if (setjmp(jmp_env) == 0) {
-        asm volatile (".byte 0xcd, 0x03");
-    }
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("int $0x04");
-    }
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("int $0x05");
-    }
-
-    printf("INT3 exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("int3");
-    }
-
-    printf("CLI exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("cli");
-    }
-
-    printf("STI exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("cli");
-    }
-
-#if !defined(__x86_64__)
-    printf("INTO exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        /* overflow exception */
-        asm volatile ("addl $1, %0 ; into" : : "r" (0x7fffffff));
-    }
-#endif
-
-    printf("OUTB exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("outb %%al, %%dx" : : "d" (0x4321), "a" (0));
-    }
-
-    printf("INB exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("inb %%dx, %%al" : "=a" (val) : "d" (0x4321));
-    }
-
-    printf("REP OUTSB exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("rep outsb" : : "d" (0x4321), "S" (tab), "c" (1));
-    }
-
-    printf("REP INSB exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("rep insb" : : "d" (0x4321), "D" (tab), "c" (1));
-    }
-
-    printf("HLT exception:\n");
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("hlt");
-    }
-
-    printf("single step exception:\n");
-    val = 0;
-    if (setjmp(jmp_env) == 0) {
-        asm volatile ("pushf\n"
-                      "orl $0x00100, (%%esp)\n"
-                      "popf\n"
-                      "movl $0xabcd, %0\n" 
-                      "movl $0x0, %0\n" : "=m" (val) : : "cc", "memory");
-    }
-    printf("val=0x%x\n", val);
-}
-
-#if !defined(__x86_64__)
-/* specific precise single step test */
-void sig_trap_handler(int sig, siginfo_t *info, void *puc)
-{
-    struct ucontext *uc = puc;
-    printf("EIP=" FMTLX "\n", (long)uc->uc_mcontext.gregs[REG_EIP]);
-}
-
-const uint8_t sstep_buf1[4] = { 1, 2, 3, 4};
-uint8_t sstep_buf2[4];
-
-void test_single_step(void)
-{
-    struct sigaction act;
-    volatile int val;
-    int i;
-
-    val = 0;
-    act.sa_sigaction = sig_trap_handler;
-    sigemptyset(&act.sa_mask);
-    act.sa_flags = SA_SIGINFO;
-    sigaction(SIGTRAP, &act, NULL);
-    asm volatile ("pushf\n"
-                  "orl $0x00100, (%%esp)\n"
-                  "popf\n"
-                  "movl $0xabcd, %0\n" 
-
-                  /* jmp test */
-                  "movl $3, %%ecx\n"
-                  "1:\n"
-                  "addl $1, %0\n"
-                  "decl %%ecx\n"
-                  "jnz 1b\n"
-
-                  /* movsb: the single step should stop at each movsb iteration */
-                  "movl $sstep_buf1, %%esi\n"
-                  "movl $sstep_buf2, %%edi\n"
-                  "movl $0, %%ecx\n"
-                  "rep movsb\n"
-                  "movl $3, %%ecx\n"
-                  "rep movsb\n"
-                  "movl $1, %%ecx\n"
-                  "rep movsb\n"
-
-                  /* cmpsb: the single step should stop at each cmpsb iteration */
-                  "movl $sstep_buf1, %%esi\n"
-                  "movl $sstep_buf2, %%edi\n"
-                  "movl $0, %%ecx\n"
-                  "rep cmpsb\n"
-                  "movl $4, %%ecx\n"
-                  "rep cmpsb\n"
-                  
-                  /* getpid() syscall: single step should skip one
-                     instruction */
-                  "movl $20, %%eax\n"
-                  "int $0x80\n"
-                  "movl $0, %%eax\n"
-                  
-                  /* when modifying SS, trace is not done on the next
-                     instruction */
-                  "movl %%ss, %%ecx\n"
-                  "movl %%ecx, %%ss\n"
-                  "addl $1, %0\n"
-                  "movl $1, %%eax\n"
-                  "movl %%ecx, %%ss\n"
-                  "jmp 1f\n"
-                  "addl $1, %0\n"
-                  "1:\n"
-                  "movl $1, %%eax\n"
-                  "pushl %%ecx\n"
-                  "popl %%ss\n"
-                  "addl $1, %0\n"
-                  "movl $1, %%eax\n"
-                  
-                  "pushf\n"
-                  "andl $~0x00100, (%%esp)\n"
-                  "popf\n"
-                  : "=m" (val) 
-                  : 
-                  : "cc", "memory", "eax", "ecx", "esi", "edi");
-    printf("val=%d\n", val);
-    for(i = 0; i < 4; i++)
-        printf("sstep_buf2[%d] = %d\n", i, sstep_buf2[i]);
-}
-
-/* self modifying code test */
-uint8_t code[] = {
-    0xb8, 0x1, 0x00, 0x00, 0x00, /* movl $1, %eax */
-    0xc3, /* ret */
-};
-
-asm("smc_code2:\n"
-    "movl 4(%esp), %eax\n"
-    "movl %eax, smc_patch_addr2 + 1\n"
-    "nop\n"
-    "nop\n"
-    "nop\n"
-    "nop\n"
-    "nop\n"
-    "nop\n"
-    "nop\n"
-    "nop\n"
-    "smc_patch_addr2:\n"
-    "movl $1, %eax\n"
-    "ret\n");
-
-typedef int FuncType(void);
-extern int smc_code2(int);
-void test_self_modifying_code(void)
-{
-    int i;
-
-    printf("self modifying code:\n");
-    printf("func1 = 0x%x\n", ((FuncType *)code)());
-    for(i = 2; i <= 4; i++) {
-        code[1] = i;
-        printf("func%d = 0x%x\n", i, ((FuncType *)code)());
-    }
-
-    /* more difficult test : the modified code is just after the
-       modifying instruction. It is forbidden in Intel specs, but it
-       is used by old DOS programs */
-    for(i = 2; i <= 4; i++) {
-        printf("smc_code2(%d) = %d\n", i, smc_code2(i));
-    }
-}
-#endif
-
-long enter_stack[4096];
-
-#if defined(__x86_64__)
-#define RSP "%%rsp"
-#define RBP "%%rbp"
-#else
-#define RSP "%%esp"
-#define RBP "%%ebp"
-#endif
-
-#define TEST_ENTER(size, stack_type, level)\
-{\
-    long esp_save, esp_val, ebp_val, ebp_save, i;\
-    stack_type *ptr, *stack_end, *stack_ptr;\
-    memset(enter_stack, 0, sizeof(enter_stack));\
-    stack_end = stack_ptr = (stack_type *)(enter_stack + 4096);\
-    ebp_val = (long)stack_ptr;\
-    for(i=1;i<=32;i++)\
-       *--stack_ptr = i;\
-    esp_val = (long)stack_ptr;\
-    asm("mov " RSP ", %[esp_save]\n"\
-        "mov " RBP ", %[ebp_save]\n"\
-        "mov %[esp_val], " RSP "\n"\
-        "mov %[ebp_val], " RBP "\n"\
-        "enter" size " $8, $" #level "\n"\
-        "mov " RSP ", %[esp_val]\n"\
-        "mov " RBP ", %[ebp_val]\n"\
-        "mov %[esp_save], " RSP "\n"\
-        "mov %[ebp_save], " RBP "\n"\
-        : [esp_save] "=r" (esp_save),\
-        [ebp_save] "=r" (ebp_save),\
-        [esp_val] "=r" (esp_val),\
-        [ebp_val] "=r" (ebp_val)\
-        :  "[esp_val]" (esp_val),\
-        "[ebp_val]" (ebp_val));\
-    printf("level=%d:\n", level);\
-    printf("esp_val=" FMTLX "\n", esp_val - (long)stack_end);\
-    printf("ebp_val=" FMTLX "\n", ebp_val - (long)stack_end);\
-    for(ptr = (stack_type *)esp_val; ptr < stack_end; ptr++)\
-        printf(FMTLX "\n", (long)ptr[0]);\
-}
-
-static void test_enter(void)
-{
-#if defined(__x86_64__)
-    TEST_ENTER("q", uint64_t, 0);
-    TEST_ENTER("q", uint64_t, 1);
-    TEST_ENTER("q", uint64_t, 2);
-    TEST_ENTER("q", uint64_t, 31);
-#else
-    TEST_ENTER("l", uint32_t, 0);
-    TEST_ENTER("l", uint32_t, 1);
-    TEST_ENTER("l", uint32_t, 2);
-    TEST_ENTER("l", uint32_t, 31);
-#endif
-
-    TEST_ENTER("w", uint16_t, 0);
-    TEST_ENTER("w", uint16_t, 1);
-    TEST_ENTER("w", uint16_t, 2);
-    TEST_ENTER("w", uint16_t, 31);
-}
-
-#ifdef TEST_SSE
-
-typedef int __m64 __attribute__ ((__mode__ (__V2SI__)));
-typedef int __m128 __attribute__ ((__mode__(__V4SF__)));
-
-typedef union {
-    double d[2];
-    float s[4];
-    uint32_t l[4];
-    uint64_t q[2];
-    __m128 dq;
-} XMMReg;
-
-static uint64_t __attribute__((aligned(16))) test_values[4][2] = {
-    { 0x456723c698694873, 0xdc515cff944a58ec },
-    { 0x1f297ccd58bad7ab, 0x41f21efba9e3e146 },
-    { 0x007c62c2085427f8, 0x231be9e8cde7438d },
-    { 0x0f76255a085427f8, 0xc233e9e8c4c9439a },
-};
-
-#define SSE_OP(op)\
-{\
-    asm volatile (#op " %2, %0" : "=x" (r.dq) : "0" (a.dq), "x" (b.dq));\
-    printf("%-9s: a=" FMT64X "" FMT64X " b=" FMT64X "" FMT64X " r=" FMT64X "" FMT64X "\n",\
-           #op,\
-           a.q[1], a.q[0],\
-           b.q[1], b.q[0],\
-           r.q[1], r.q[0]);\
-}
-
-#define SSE_OP2(op)\
-{\
-    int i;\
-    for(i=0;i<2;i++) {\
-    a.q[0] = test_values[2*i][0];\
-    a.q[1] = test_values[2*i][1];\
-    b.q[0] = test_values[2*i+1][0];\
-    b.q[1] = test_values[2*i+1][1];\
-    SSE_OP(op);\
-    }\
-}
-
-#define MMX_OP2(op)\
-{\
-    int i;\
-    for(i=0;i<2;i++) {\
-    a.q[0] = test_values[2*i][0];\
-    b.q[0] = test_values[2*i+1][0];\
-    asm volatile (#op " %2, %0" : "=y" (r.q[0]) : "0" (a.q[0]), "y" (b.q[0]));\
-    printf("%-9s: a=" FMT64X " b=" FMT64X " r=" FMT64X "\n",\
-           #op,\
-           a.q[0],\
-           b.q[0],\
-           r.q[0]);\
-    }\
-    SSE_OP2(op);\
-}
-
-#define SHUF_OP(op, ib)\
-{\
-    a.q[0] = test_values[0][0];\
-    a.q[1] = test_values[0][1];\
-    b.q[0] = test_values[1][0];\
-    b.q[1] = test_values[1][1];\
-    asm volatile (#op " $" #ib ", %2, %0" : "=x" (r.dq) : "0" (a.dq), "x" (b.dq));\
-    printf("%-9s: a=" FMT64X "" FMT64X " b=" FMT64X "" FMT64X " ib=%02x r=" FMT64X "" FMT64X "\n",\
-           #op,\
-           a.q[1], a.q[0],\
-           b.q[1], b.q[0],\
-           ib,\
-           r.q[1], r.q[0]);\
-}
-
-#define PSHUF_OP(op, ib)\
-{\
-    int i;\
-    for(i=0;i<2;i++) {\
-    a.q[0] = test_values[2*i][0];\
-    a.q[1] = test_values[2*i][1];\
-    asm volatile (#op " $" #ib ", %1, %0" : "=x" (r.dq) : "x" (a.dq));\
-    printf("%-9s: a=" FMT64X "" FMT64X " ib=%02x r=" FMT64X "" FMT64X "\n",\
-           #op,\
-           a.q[1], a.q[0],\
-           ib,\
-           r.q[1], r.q[0]);\
-    }\
-}
-
-#define SHIFT_IM(op, ib)\
-{\
-    int i;\
-    for(i=0;i<2;i++) {\
-    a.q[0] = test_values[2*i][0];\
-    a.q[1] = test_values[2*i][1];\
-    asm volatile (#op " $" #ib ", %0" : "=x" (r.dq) : "0" (a.dq));\
-    printf("%-9s: a=" FMT64X "" FMT64X " ib=%02x r=" FMT64X "" FMT64X "\n",\
-           #op,\
-           a.q[1], a.q[0],\
-           ib,\
-           r.q[1], r.q[0]);\
-    }\
-}
-
-#define SHIFT_OP(op, ib)\
-{\
-    int i;\
-    SHIFT_IM(op, ib);\
-    for(i=0;i<2;i++) {\
-    a.q[0] = test_values[2*i][0];\
-    a.q[1] = test_values[2*i][1];\
-    b.q[0] = ib;\
-    b.q[1] = 0;\
-    asm volatile (#op " %2, %0" : "=x" (r.dq) : "0" (a.dq), "x" (b.dq));\
-    printf("%-9s: a=" FMT64X "" FMT64X " b=" FMT64X "" FMT64X " r=" FMT64X "" FMT64X "\n",\
-           #op,\
-           a.q[1], a.q[0],\
-           b.q[1], b.q[0],\
-           r.q[1], r.q[0]);\
-    }\
-}
-
-#define MOVMSK(op)\
-{\
-    int i, reg;\
-    for(i=0;i<2;i++) {\
-    a.q[0] = test_values[2*i][0];\
-    a.q[1] = test_values[2*i][1];\
-    asm volatile (#op " %1, %0" : "=r" (reg) : "x" (a.dq));\
-    printf("%-9s: a=" FMT64X "" FMT64X " r=%08x\n",\
-           #op,\
-           a.q[1], a.q[0],\
-           reg);\
-    }\
-}
-
-#define SSE_OPS(a) \
-SSE_OP(a ## ps);\
-SSE_OP(a ## ss);
-
-#define SSE_OPD(a) \
-SSE_OP(a ## pd);\
-SSE_OP(a ## sd);
-
-#define SSE_COMI(op, field)\
-{\
-    unsigned int eflags;\
-    XMMReg a, b;\
-    a.field[0] = a1;\
-    b.field[0] = b1;\
-    asm volatile (#op " %2, %1\n"\
-        "pushf\n"\
-        "pop %0\n"\
-        : "=m" (eflags)\
-        : "x" (a.dq), "x" (b.dq));\
-    printf("%-9s: a=%f b=%f cc=%04x\n",\
-           #op, a1, b1,\
-           eflags & (CC_C | CC_P | CC_Z | CC_S | CC_O | CC_A));\
-}
-
-void test_sse_comi(double a1, double b1)
-{
-    SSE_COMI(ucomiss, s);
-    SSE_COMI(ucomisd, d);
-    SSE_COMI(comiss, s);
-    SSE_COMI(comisd, d);
-}
-
-#define CVT_OP_XMM(op)\
-{\
-    asm volatile (#op " %1, %0" : "=x" (r.dq) : "x" (a.dq));\
-    printf("%-9s: a=" FMT64X "" FMT64X " r=" FMT64X "" FMT64X "\n",\
-           #op,\
-           a.q[1], a.q[0],\
-           r.q[1], r.q[0]);\
-}
-
-/* Force %xmm0 usage to avoid the case where both register index are 0
-   to test intruction decoding more extensively */
-#define CVT_OP_XMM2MMX(op)\
-{\
-    asm volatile (#op " %1, %0" : "=y" (r.q[0]) : "x" (a.dq) \
-                  : "%xmm0");\
-    printf("%-9s: a=" FMT64X "" FMT64X " r=" FMT64X "\n",\
-           #op,\
-           a.q[1], a.q[0],\
-           r.q[0]);\
-}
-
-#define CVT_OP_MMX2XMM(op)\
-{\
-    asm volatile (#op " %1, %0" : "=x" (r.dq) : "y" (a.q[0]));\
-    printf("%-9s: a=" FMT64X " r=" FMT64X "" FMT64X "\n",\
-           #op,\
-           a.q[0],\
-           r.q[1], r.q[0]);\
-}
-
-#define CVT_OP_REG2XMM(op)\
-{\
-    asm volatile (#op " %1, %0" : "=x" (r.dq) : "r" (a.l[0]));\
-    printf("%-9s: a=%08x r=" FMT64X "" FMT64X "\n",\
-           #op,\
-           a.l[0],\
-           r.q[1], r.q[0]);\
-}
-
-#define CVT_OP_XMM2REG(op)\
-{\
-    asm volatile (#op " %1, %0" : "=r" (r.l[0]) : "x" (a.dq));\
-    printf("%-9s: a=" FMT64X "" FMT64X " r=%08x\n",\
-           #op,\
-           a.q[1], a.q[0],\
-           r.l[0]);\
-}
-
-struct fpxstate {
-    uint16_t fpuc;
-    uint16_t fpus;
-    uint16_t fptag;
-    uint16_t fop;
-    uint32_t fpuip;
-    uint16_t cs_sel;
-    uint16_t dummy0;
-    uint32_t fpudp;
-    uint16_t ds_sel;
-    uint16_t dummy1;
-    uint32_t mxcsr;
-    uint32_t mxcsr_mask;
-    uint8_t fpregs1[8 * 16];
-    uint8_t xmm_regs[8 * 16];
-    uint8_t dummy2[224];
-};
-
-static struct fpxstate fpx_state __attribute__((aligned(16)));
-static struct fpxstate fpx_state2 __attribute__((aligned(16)));
-
-void test_fxsave(void)
-{
-    struct fpxstate *fp = &fpx_state;
-    struct fpxstate *fp2 = &fpx_state2;
-    int i, nb_xmm;
-    XMMReg a, b;
-    a.q[0] = test_values[0][0];
-    a.q[1] = test_values[0][1];
-    b.q[0] = test_values[1][0];
-    b.q[1] = test_values[1][1];
-
-    asm("movdqa %2, %%xmm0\n"
-        "movdqa %3, %%xmm7\n"
-#if defined(__x86_64__)
-        "movdqa %2, %%xmm15\n"
-#endif
-        " fld1\n"
-        " fldpi\n"
-        " fldln2\n"
-        " fxsave %0\n"
-        " fxrstor %0\n"
-        " fxsave %1\n"
-        " fninit\n"
-        : "=m" (*(uint32_t *)fp2), "=m" (*(uint32_t *)fp) 
-        : "m" (a), "m" (b));
-    printf("fpuc=%04x\n", fp->fpuc);
-    printf("fpus=%04x\n", fp->fpus);
-    printf("fptag=%04x\n", fp->fptag);
-    for(i = 0; i < 3; i++) {
-        printf("ST%d: " FMT64X " %04x\n",
-               i, 
-               *(uint64_t *)&fp->fpregs1[i * 16],
-               *(uint16_t *)&fp->fpregs1[i * 16 + 8]);
-    }
-    printf("mxcsr=%08x\n", fp->mxcsr & 0x1f80);
-#if defined(__x86_64__)
-    nb_xmm = 16;
-#else
-    nb_xmm = 8;
-#endif
-    for(i = 0; i < nb_xmm; i++) {
-        printf("xmm%d: " FMT64X "" FMT64X "\n",
-               i, 
-               *(uint64_t *)&fp->xmm_regs[i * 16],
-               *(uint64_t *)&fp->xmm_regs[i * 16 + 8]);
-    }
-}
-
-void test_sse(void)
-{
-    XMMReg r, a, b;
-    int i;
-
-    MMX_OP2(punpcklbw);
-    MMX_OP2(punpcklwd);
-    MMX_OP2(punpckldq);
-    MMX_OP2(packsswb);
-    MMX_OP2(pcmpgtb);
-    MMX_OP2(pcmpgtw);
-    MMX_OP2(pcmpgtd);
-    MMX_OP2(packuswb);
-    MMX_OP2(punpckhbw);
-    MMX_OP2(punpckhwd);
-    MMX_OP2(punpckhdq);
-    MMX_OP2(packssdw);
-    MMX_OP2(pcmpeqb);
-    MMX_OP2(pcmpeqw);
-    MMX_OP2(pcmpeqd);
-
-    MMX_OP2(paddq);
-    MMX_OP2(pmullw);
-    MMX_OP2(psubusb);
-    MMX_OP2(psubusw);
-    MMX_OP2(pminub);
-    MMX_OP2(pand);
-    MMX_OP2(paddusb);
-    MMX_OP2(paddusw);
-    MMX_OP2(pmaxub);
-    MMX_OP2(pandn);
-
-    MMX_OP2(pmulhuw);
-    MMX_OP2(pmulhw);
-    
-    MMX_OP2(psubsb);
-    MMX_OP2(psubsw);
-    MMX_OP2(pminsw);
-    MMX_OP2(por);
-    MMX_OP2(paddsb);
-    MMX_OP2(paddsw);
-    MMX_OP2(pmaxsw);
-    MMX_OP2(pxor);
-    MMX_OP2(pmuludq);
-    MMX_OP2(pmaddwd);
-    MMX_OP2(psadbw);
-    MMX_OP2(psubb);
-    MMX_OP2(psubw);
-    MMX_OP2(psubd);
-    MMX_OP2(psubq);
-    MMX_OP2(paddb);
-    MMX_OP2(paddw);
-    MMX_OP2(paddd);
-
-    MMX_OP2(pavgb);
-    MMX_OP2(pavgw);
-
-    asm volatile ("pinsrw $1, %1, %0" : "=y" (r.q[0]) : "r" (0x12345678));
-    printf("%-9s: r=" FMT64X "\n", "pinsrw", r.q[0]);
-
-    asm volatile ("pinsrw $5, %1, %0" : "=x" (r.dq) : "r" (0x12345678));
-    printf("%-9s: r=" FMT64X "" FMT64X "\n", "pinsrw", r.q[1], r.q[0]);
-
-    a.q[0] = test_values[0][0];
-    a.q[1] = test_values[0][1];
-    asm volatile ("pextrw $1, %1, %0" : "=r" (r.l[0]) : "y" (a.q[0]));
-    printf("%-9s: r=%08x\n", "pextrw", r.l[0]);
-
-    asm volatile ("pextrw $5, %1, %0" : "=r" (r.l[0]) : "x" (a.dq));
-    printf("%-9s: r=%08x\n", "pextrw", r.l[0]);
-
-    asm volatile ("pmovmskb %1, %0" : "=r" (r.l[0]) : "y" (a.q[0]));
-    printf("%-9s: r=%08x\n", "pmovmskb", r.l[0]);
-    
-    asm volatile ("pmovmskb %1, %0" : "=r" (r.l[0]) : "x" (a.dq));
-    printf("%-9s: r=%08x\n", "pmovmskb", r.l[0]);
-
-    {
-        r.q[0] = -1;
-        r.q[1] = -1;
-
-        a.q[0] = test_values[0][0];
-        a.q[1] = test_values[0][1];
-        b.q[0] = test_values[1][0];
-        b.q[1] = test_values[1][1];
-        asm volatile("maskmovq %1, %0" : 
-                     : "y" (a.q[0]), "y" (b.q[0]), "D" (&r)
-                     : "memory"); 
-        printf("%-9s: r=" FMT64X " a=" FMT64X " b=" FMT64X "\n", 
-               "maskmov", 
-               r.q[0], 
-               a.q[0], 
-               b.q[0]);
-        asm volatile("maskmovdqu %1, %0" : 
-                     : "x" (a.dq), "x" (b.dq), "D" (&r)
-                     : "memory"); 
-        printf("%-9s: r=" FMT64X "" FMT64X " a=" FMT64X "" FMT64X " b=" FMT64X "" FMT64X "\n", 
-               "maskmov", 
-               r.q[1], r.q[0], 
-               a.q[1], a.q[0], 
-               b.q[1], b.q[0]);
-    }
-
-    asm volatile ("emms");
-
-    SSE_OP2(punpcklqdq);
-    SSE_OP2(punpckhqdq);
-    SSE_OP2(andps);
-    SSE_OP2(andpd);
-    SSE_OP2(andnps);
-    SSE_OP2(andnpd);
-    SSE_OP2(orps);
-    SSE_OP2(orpd);
-    SSE_OP2(xorps);
-    SSE_OP2(xorpd);
-
-    SSE_OP2(unpcklps);
-    SSE_OP2(unpcklpd);
-    SSE_OP2(unpckhps);
-    SSE_OP2(unpckhpd);
-
-    SHUF_OP(shufps, 0x78);
-    SHUF_OP(shufpd, 0x02);
-
-    PSHUF_OP(pshufd, 0x78);
-    PSHUF_OP(pshuflw, 0x78);
-    PSHUF_OP(pshufhw, 0x78);
-
-    SHIFT_OP(psrlw, 7);
-    SHIFT_OP(psrlw, 16);
-    SHIFT_OP(psraw, 7);
-    SHIFT_OP(psraw, 16);
-    SHIFT_OP(psllw, 7);
-    SHIFT_OP(psllw, 16);
-
-    SHIFT_OP(psrld, 7);
-    SHIFT_OP(psrld, 32);
-    SHIFT_OP(psrad, 7);
-    SHIFT_OP(psrad, 32);
-    SHIFT_OP(pslld, 7);
-    SHIFT_OP(pslld, 32);
-
-    SHIFT_OP(psrlq, 7);
-    SHIFT_OP(psrlq, 32);
-    SHIFT_OP(psllq, 7);
-    SHIFT_OP(psllq, 32);
-
-    SHIFT_IM(psrldq, 16);
-    SHIFT_IM(psrldq, 7);
-    SHIFT_IM(pslldq, 16);
-    SHIFT_IM(pslldq, 7);
-
-    MOVMSK(movmskps);
-    MOVMSK(movmskpd);
-
-    /* FPU specific ops */
-
-    {
-        uint32_t mxcsr;
-        asm volatile("stmxcsr %0" : "=m" (mxcsr));
-        printf("mxcsr=%08x\n", mxcsr & 0x1f80);
-        asm volatile("ldmxcsr %0" : : "m" (mxcsr));
-    }
-
-    test_sse_comi(2, -1);
-    test_sse_comi(2, 2);
-    test_sse_comi(2, 3);
-    test_sse_comi(2, q_nan.d);
-    test_sse_comi(q_nan.d, -1);
-
-    for(i = 0; i < 2; i++) {
-        a.s[0] = 2.7;
-        a.s[1] = 3.4;
-        a.s[2] = 4;
-        a.s[3] = -6.3;
-        b.s[0] = 45.7;
-        b.s[1] = 353.4;
-        b.s[2] = 4;
-        b.s[3] = 56.3;
-        if (i == 1) {
-            a.s[0] = q_nan.d;
-            b.s[3] = q_nan.d;
-        }
-
-        SSE_OPS(add);
-        SSE_OPS(mul);
-        SSE_OPS(sub);
-        SSE_OPS(min);
-        SSE_OPS(div);
-        SSE_OPS(max);
-        SSE_OPS(sqrt);
-        SSE_OPS(cmpeq);
-        SSE_OPS(cmplt);
-        SSE_OPS(cmple);
-        SSE_OPS(cmpunord);
-        SSE_OPS(cmpneq);
-        SSE_OPS(cmpnlt);
-        SSE_OPS(cmpnle);
-        SSE_OPS(cmpord);
-        
-        
-        a.d[0] = 2.7;
-        a.d[1] = -3.4;
-        b.d[0] = 45.7;
-        b.d[1] = -53.4;
-        if (i == 1) {
-            a.d[0] = q_nan.d;
-            b.d[1] = q_nan.d;
-        }
-        SSE_OPD(add);
-        SSE_OPD(mul);
-        SSE_OPD(sub);
-        SSE_OPD(min);
-        SSE_OPD(div);
-        SSE_OPD(max);
-        SSE_OPD(sqrt);
-        SSE_OPD(cmpeq);
-        SSE_OPD(cmplt);
-        SSE_OPD(cmple);
-        SSE_OPD(cmpunord);
-        SSE_OPD(cmpneq);
-        SSE_OPD(cmpnlt);
-        SSE_OPD(cmpnle);
-        SSE_OPD(cmpord);
-    }
-
-    /* float to float/int */
-    a.s[0] = 2.7;
-    a.s[1] = 3.4;
-    a.s[2] = 4;
-    a.s[3] = -6.3;
-    CVT_OP_XMM(cvtps2pd);
-    CVT_OP_XMM(cvtss2sd);
-    CVT_OP_XMM2MMX(cvtps2pi);
-    CVT_OP_XMM2MMX(cvttps2pi);
-    CVT_OP_XMM2REG(cvtss2si);
-    CVT_OP_XMM2REG(cvttss2si);
-    CVT_OP_XMM(cvtps2dq);
-    CVT_OP_XMM(cvttps2dq);
-
-    a.d[0] = 2.6;
-    a.d[1] = -3.4;
-    CVT_OP_XMM(cvtpd2ps);
-    CVT_OP_XMM(cvtsd2ss);
-    CVT_OP_XMM2MMX(cvtpd2pi);
-    CVT_OP_XMM2MMX(cvttpd2pi);
-    CVT_OP_XMM2REG(cvtsd2si);
-    CVT_OP_XMM2REG(cvttsd2si);
-    CVT_OP_XMM(cvtpd2dq);
-    CVT_OP_XMM(cvttpd2dq);
-
-    /* sse/mmx moves */
-    CVT_OP_XMM2MMX(movdq2q);
-    CVT_OP_MMX2XMM(movq2dq);
-
-    /* int to float */
-    a.l[0] = -6;
-    a.l[1] = 2;
-    a.l[2] = 100;
-    a.l[3] = -60000;
-    CVT_OP_MMX2XMM(cvtpi2ps);
-    CVT_OP_MMX2XMM(cvtpi2pd);
-    CVT_OP_REG2XMM(cvtsi2ss);
-    CVT_OP_REG2XMM(cvtsi2sd);
-    CVT_OP_XMM(cvtdq2ps);
-    CVT_OP_XMM(cvtdq2pd);
-
-    /* XXX: test PNI insns */
-#if 0
-    SSE_OP2(movshdup);
-#endif
-    asm volatile ("emms");
-}
-
-#endif
-
-extern void *__start_initcall;
-extern void *__stop_initcall;
-
-
-int main(int argc, char **argv)
-{
-    void **ptr;
-    void (*func)(void);
-
-    ptr = &__start_initcall;
-    while (ptr != &__stop_initcall) {
-        func = *ptr++;
-        func();
-    }
-    test_bsx();
-    test_mul();
-    test_jcc();
-    test_floats();
-#if !defined(__x86_64__)
-    test_bcd();
-#endif
-    test_xchg();
-    test_string();
-    test_misc();
-    test_lea();
-#ifdef TEST_SEGS
-    test_segs();
-    test_code16();
-#endif
-#ifdef TEST_VM86
-    test_vm86();
-#endif
-    test_exceptions();
-#if !defined(__x86_64__)
-    test_self_modifying_code();
-    test_single_step();
-#endif
-    test_enter();
-#ifdef TEST_SSE
-    test_sse();
-    test_fxsave();
-#endif
-    return 0;
-}
diff --git a/tests/test-i386.h b/tests/test-i386.h
deleted file mode 100644
index 75106b8..0000000
--- a/tests/test-i386.h
+++ /dev/null
@@ -1,152 +0,0 @@
-
-#define exec_op glue(exec_, OP)
-#define exec_opq glue(glue(exec_, OP), q)
-#define exec_opl glue(glue(exec_, OP), l)
-#define exec_opw glue(glue(exec_, OP), w)
-#define exec_opb glue(glue(exec_, OP), b)
-
-#define EXECOP2(size, rsize, res, s1, flags) \
-    asm ("push %4\n\t"\
-         "popf\n\t"\
-         stringify(OP) size " %" rsize "2, %" rsize "0\n\t" \
-         "pushf\n\t"\
-         "pop %1\n\t"\
-         : "=q" (res), "=g" (flags)\
-         : "q" (s1), "0" (res), "1" (flags)); \
-    printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CCIN=%04lx CC=%04lx\n", \
-           stringify(OP) size, s0, s1, res, iflags, flags & CC_MASK);
-
-#define EXECOP1(size, rsize, res, flags) \
-    asm ("push %3\n\t"\
-         "popf\n\t"\
-         stringify(OP) size " %" rsize "0\n\t" \
-         "pushf\n\t"\
-         "pop %1\n\t"\
-         : "=q" (res), "=g" (flags)\
-         : "0" (res), "1" (flags)); \
-    printf("%-10s A=" FMTLX " R=" FMTLX " CCIN=%04lx CC=%04lx\n", \
-           stringify(OP) size, s0, res, iflags, flags & CC_MASK);
-
-#ifdef OP1
-#if defined(__x86_64__)
-void exec_opq(long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECOP1("q", "", res, flags);
-}
-#endif
-
-void exec_opl(long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECOP1("l", "k", res, flags);
-}
-
-void exec_opw(long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECOP1("w", "w", res, flags);
-}
-
-void exec_opb(long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECOP1("b", "b", res, flags);
-}
-#else
-#if defined(__x86_64__)
-void exec_opq(long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECOP2("q", "", res, s1, flags);
-}
-#endif
-
-void exec_opl(long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECOP2("l", "k", res, s1, flags);
-}
-
-void exec_opw(long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECOP2("w", "w", res, s1, flags);
-}
-
-void exec_opb(long s0, long s1, long iflags)
-{
-    long res, flags;
-    res = s0;
-    flags = iflags;
-    EXECOP2("b", "b", res, s1, flags);
-}
-#endif
-
-void exec_op(long s0, long s1)
-{
-    s0 = i2l(s0);
-    s1 = i2l(s1);
-#if defined(__x86_64__)
-    exec_opq(s0, s1, 0);
-#endif
-    exec_opl(s0, s1, 0);
-    exec_opw(s0, s1, 0);
-    exec_opb(s0, s1, 0);
-#ifdef OP_CC
-#if defined(__x86_64__)
-    exec_opq(s0, s1, CC_C);
-#endif
-    exec_opl(s0, s1, CC_C);
-    exec_opw(s0, s1, CC_C);
-    exec_opb(s0, s1, CC_C);
-#endif
-}
-
-void glue(test_, OP)(void)
-{
-    exec_op(0x12345678, 0x812FADA);
-    exec_op(0x12341, 0x12341);
-    exec_op(0x12341, -0x12341);
-    exec_op(0xffffffff, 0);
-    exec_op(0xffffffff, -1);
-    exec_op(0xffffffff, 1);
-    exec_op(0xffffffff, 2);
-    exec_op(0x7fffffff, 0);
-    exec_op(0x7fffffff, 1);
-    exec_op(0x7fffffff, -1);
-    exec_op(0x80000000, -1);
-    exec_op(0x80000000, 1);
-    exec_op(0x80000000, -2);
-    exec_op(0x12347fff, 0);
-    exec_op(0x12347fff, 1);
-    exec_op(0x12347fff, -1);
-    exec_op(0x12348000, -1);
-    exec_op(0x12348000, 1);
-    exec_op(0x12348000, -2);
-    exec_op(0x12347f7f, 0);
-    exec_op(0x12347f7f, 1);
-    exec_op(0x12347f7f, -1);
-    exec_op(0x12348080, -1);
-    exec_op(0x12348080, 1);
-    exec_op(0x12348080, -2);
-}
-
-void *glue(_test_, OP) __init_call = glue(test_, OP);
-
-#undef OP
-#undef OP_CC
diff --git a/tests/test_path.c b/tests/test_path.c
deleted file mode 100644
index a9b52de..0000000
--- a/tests/test_path.c
+++ /dev/null
@@ -1,152 +0,0 @@
-/* Test path override code */
-#define _GNU_SOURCE
-#include "../path.c"
-#include <stdarg.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-
-/* Any log message kills the test. */
-void gemu_log(const char *fmt, ...)
-{
-    va_list ap;
-
-    fprintf(stderr, "FATAL: ");
-    va_start(ap, fmt);
-    vfprintf(stderr, fmt, ap);
-    va_end(ap);
-    exit(1);
-}
-
-#define NO_CHANGE(_path)						\
-	do {								\
-	    if (strcmp(path(_path), _path) != 0) return __LINE__;	\
-	} while(0)
-
-#define CHANGE_TO(_path, _newpath)					\
-	do {								\
-	    if (strcmp(path(_path), _newpath) != 0) return __LINE__;	\
-	} while(0)
-
-static void cleanup(void)
-{
-    unlink("/tmp/qemu-test_path/DIR1/DIR2/FILE");
-    unlink("/tmp/qemu-test_path/DIR1/DIR2/FILE2");
-    unlink("/tmp/qemu-test_path/DIR1/DIR2/FILE3");
-    unlink("/tmp/qemu-test_path/DIR1/DIR2/FILE4");
-    unlink("/tmp/qemu-test_path/DIR1/DIR2/FILE5");
-    rmdir("/tmp/qemu-test_path/DIR1/DIR2");
-    rmdir("/tmp/qemu-test_path/DIR1/DIR3");
-    rmdir("/tmp/qemu-test_path/DIR1");
-    rmdir("/tmp/qemu-test_path");
-}
-
-static unsigned int do_test(void)
-{
-    if (mkdir("/tmp/qemu-test_path", 0700) != 0)
-	return __LINE__;
-
-    if (mkdir("/tmp/qemu-test_path/DIR1", 0700) != 0)
-	return __LINE__;
-
-    if (mkdir("/tmp/qemu-test_path/DIR1/DIR2", 0700) != 0)
-	return __LINE__;
-
-    if (mkdir("/tmp/qemu-test_path/DIR1/DIR3", 0700) != 0)
-	return __LINE__;
-
-    if (close(creat("/tmp/qemu-test_path/DIR1/DIR2/FILE", 0600)) != 0)
-	return __LINE__;
-
-    if (close(creat("/tmp/qemu-test_path/DIR1/DIR2/FILE2", 0600)) != 0)
-	return __LINE__;
-
-    if (close(creat("/tmp/qemu-test_path/DIR1/DIR2/FILE3", 0600)) != 0)
-	return __LINE__;
-
-    if (close(creat("/tmp/qemu-test_path/DIR1/DIR2/FILE4", 0600)) != 0)
-	return __LINE__;
-
-    if (close(creat("/tmp/qemu-test_path/DIR1/DIR2/FILE5", 0600)) != 0)
-	return __LINE__;
-
-    init_paths("/tmp/qemu-test_path");
-
-    NO_CHANGE("/tmp");
-    NO_CHANGE("/tmp/");
-    NO_CHANGE("/tmp/qemu-test_path");
-    NO_CHANGE("/tmp/qemu-test_path/");
-    NO_CHANGE("/tmp/qemu-test_path/D");
-    NO_CHANGE("/tmp/qemu-test_path/DI");
-    NO_CHANGE("/tmp/qemu-test_path/DIR");
-    NO_CHANGE("/tmp/qemu-test_path/DIR1");
-    NO_CHANGE("/tmp/qemu-test_path/DIR1/");
-
-    NO_CHANGE("/D");
-    NO_CHANGE("/DI");
-    NO_CHANGE("/DIR");
-    NO_CHANGE("/DIR2");
-    NO_CHANGE("/DIR1.");
-
-    CHANGE_TO("/DIR1", "/tmp/qemu-test_path/DIR1");
-    CHANGE_TO("/DIR1/", "/tmp/qemu-test_path/DIR1");
-
-    NO_CHANGE("/DIR1/D");
-    NO_CHANGE("/DIR1/DI");
-    NO_CHANGE("/DIR1/DIR");
-    NO_CHANGE("/DIR1/DIR1");
-
-    CHANGE_TO("/DIR1/DIR2", "/tmp/qemu-test_path/DIR1/DIR2");
-    CHANGE_TO("/DIR1/DIR2/", "/tmp/qemu-test_path/DIR1/DIR2");
-
-    CHANGE_TO("/DIR1/DIR3", "/tmp/qemu-test_path/DIR1/DIR3");
-    CHANGE_TO("/DIR1/DIR3/", "/tmp/qemu-test_path/DIR1/DIR3");
-
-    NO_CHANGE("/DIR1/DIR2/F");
-    NO_CHANGE("/DIR1/DIR2/FI");
-    NO_CHANGE("/DIR1/DIR2/FIL");
-    NO_CHANGE("/DIR1/DIR2/FIL.");
-
-    CHANGE_TO("/DIR1/DIR2/FILE", "/tmp/qemu-test_path/DIR1/DIR2/FILE");
-    CHANGE_TO("/DIR1/DIR2/FILE2", "/tmp/qemu-test_path/DIR1/DIR2/FILE2");
-    CHANGE_TO("/DIR1/DIR2/FILE3", "/tmp/qemu-test_path/DIR1/DIR2/FILE3");
-    CHANGE_TO("/DIR1/DIR2/FILE4", "/tmp/qemu-test_path/DIR1/DIR2/FILE4");
-    CHANGE_TO("/DIR1/DIR2/FILE5", "/tmp/qemu-test_path/DIR1/DIR2/FILE5");
-
-    NO_CHANGE("/DIR1/DIR2/FILE6");
-    NO_CHANGE("/DIR1/DIR2/FILE/X");
-
-    CHANGE_TO("/DIR1/../DIR1", "/tmp/qemu-test_path/DIR1");
-    CHANGE_TO("/DIR1/../DIR1/", "/tmp/qemu-test_path/DIR1");
-    CHANGE_TO("/../DIR1", "/tmp/qemu-test_path/DIR1");
-    CHANGE_TO("/../DIR1/", "/tmp/qemu-test_path/DIR1");
-    CHANGE_TO("/DIR1/DIR2/../DIR2", "/tmp/qemu-test_path/DIR1/DIR2");
-    CHANGE_TO("/DIR1/DIR2/../DIR2/../../DIR1/DIR2/FILE", "/tmp/qemu-test_path/DIR1/DIR2/FILE");
-    CHANGE_TO("/DIR1/DIR2/../DIR2/FILE", "/tmp/qemu-test_path/DIR1/DIR2/FILE");
-
-    NO_CHANGE("/DIR1/DIR2/../DIR1");
-    NO_CHANGE("/DIR1/DIR2/../FILE");
-
-    CHANGE_TO("/./DIR1/DIR2/FILE", "/tmp/qemu-test_path/DIR1/DIR2/FILE");
-    CHANGE_TO("/././DIR1/DIR2/FILE", "/tmp/qemu-test_path/DIR1/DIR2/FILE");
-    CHANGE_TO("/DIR1/./DIR2/FILE", "/tmp/qemu-test_path/DIR1/DIR2/FILE");
-    CHANGE_TO("/DIR1/././DIR2/FILE", "/tmp/qemu-test_path/DIR1/DIR2/FILE");
-    CHANGE_TO("/DIR1/DIR2/./FILE", "/tmp/qemu-test_path/DIR1/DIR2/FILE");
-    CHANGE_TO("/DIR1/DIR2/././FILE", "/tmp/qemu-test_path/DIR1/DIR2/FILE");
-    CHANGE_TO("/./DIR1/./DIR2/./FILE", "/tmp/qemu-test_path/DIR1/DIR2/FILE");
-
-    return 0;
-}
-
-int main(int argc, char *argv[])
-{
-    int ret;
-
-    ret = do_test();
-    cleanup();
-    if (ret) {
-	fprintf(stderr, "test_path: failed on line %i\n", ret);
-	return 1;
-    }
-    return 0;
-}
-	
diff --git a/tests/testthread.c b/tests/testthread.c
deleted file mode 100644
index 27e4825..0000000
--- a/tests/testthread.c
+++ /dev/null
@@ -1,51 +0,0 @@
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <signal.h>
-#include <unistd.h>
-#include <inttypes.h>
-#include <pthread.h>
-#include <sys/wait.h>
-#include <sched.h>
-
-void *thread1_func(void *arg)
-{
-    int i;
-    char buf[512];
-
-    for(i=0;i<10;i++) {
-        snprintf(buf, sizeof(buf), "thread1: %d %s\n", i, (char *)arg);
-        write(1, buf, strlen(buf));
-        usleep(100 * 1000);
-    }
-    return NULL;
-}
-
-void *thread2_func(void *arg)
-{
-    int i;
-    char buf[512];
-    for(i=0;i<20;i++) {
-        snprintf(buf, sizeof(buf), "thread2: %d %s\n", i, (char *)arg);
-        write(1, buf, strlen(buf));
-        usleep(150 * 1000);
-    }
-    return NULL;
-}
-
-void test_pthread(void)
-{
-    pthread_t tid1, tid2;
-
-    pthread_create(&tid1, NULL, thread1_func, "hello1");
-    pthread_create(&tid2, NULL, thread2_func, "hello2");
-    pthread_join(tid1, NULL);
-    pthread_join(tid2, NULL);
-    printf("End of pthread test.\n");
-}
-
-int main(int argc, char **argv)
-{
-    test_pthread();
-    return 0;
-}
diff --git a/thunk.c b/thunk.c
index bc9bd28..7331aeb 100644
--- a/thunk.c
+++ b/thunk.c
@@ -1,6 +1,6 @@
 /*
  *  Generic thunking code to convert data between host and target CPU
- * 
+ *
  *  Copyright (c) 2003 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -31,6 +31,8 @@
 /* XXX: make it dynamic */
 StructEntry struct_entries[MAX_STRUCTS];
 
+static const argtype *thunk_type_next_ptr(const argtype *type_ptr);
+
 static inline const argtype *thunk_type_next(const argtype *type_ptr)
 {
     int type;
@@ -47,9 +49,9 @@ static inline const argtype *thunk_type_next(const argtype *type_ptr)
     case TYPE_PTRVOID:
         return type_ptr;
     case TYPE_PTR:
-        return thunk_type_next(type_ptr);
+        return thunk_type_next_ptr(type_ptr);
     case TYPE_ARRAY:
-        return thunk_type_next(type_ptr + 1);
+        return thunk_type_next_ptr(type_ptr + 1);
     case TYPE_STRUCT:
         return type_ptr + 1;
     default:
@@ -57,6 +59,11 @@ static inline const argtype *thunk_type_next(const argtype *type_ptr)
     }
 }
 
+static const argtype *thunk_type_next_ptr(const argtype *type_ptr)
+{
+    return thunk_type_next(type_ptr);
+}
+
 void thunk_register_struct(int id, const char *name, const argtype *types)
 {
     const argtype *type_ptr;
@@ -64,7 +71,7 @@ void thunk_register_struct(int id, const char *name, const argtype *types)
     int nb_fields, offset, max_align, align, size, i, j;
 
     se = struct_entries + id;
-    
+
     /* first we count the number of fields */
     type_ptr = types;
     nb_fields = 0;
@@ -76,7 +83,7 @@ void thunk_register_struct(int id, const char *name, const argtype *types)
     se->nb_fields = nb_fields;
     se->name = name;
 #ifdef DEBUG
-    printf("struct %s: id=%d nb_fields=%d\n", 
+    printf("struct %s: id=%d nb_fields=%d\n",
            se->name, id, se->nb_fields);
 #endif
     /* now we can alloc the data */
@@ -100,7 +107,7 @@ void thunk_register_struct(int id, const char *name, const argtype *types)
         se->size[i] = offset;
         se->align[i] = max_align;
 #ifdef DEBUG
-        printf("%s: size=%d align=%d\n", 
+        printf("%s: size=%d align=%d\n",
                i == THUNK_HOST ? "host" : "target", offset, max_align);
 #endif
     }
@@ -116,7 +123,7 @@ void thunk_register_struct_direct(int id, const char *name, StructEntry *se1)
 
 
 /* now we can define the main conversion functions */
-const argtype *thunk_convert(void *dst, const void *src, 
+const argtype *thunk_convert(void *dst, const void *src,
                              const argtype *type_ptr, int to_host)
 {
     int type;
@@ -136,22 +143,48 @@ const argtype *thunk_convert(void *dst, const void *src,
     case TYPE_ULONGLONG:
         *(uint64_t *)dst = tswap64(*(uint64_t *)src);
         break;
-#if HOST_LONG_BITS == 32 && TARGET_LONG_BITS == 32
+#if HOST_LONG_BITS == 32 && TARGET_ABI_BITS == 32
     case TYPE_LONG:
     case TYPE_ULONG:
     case TYPE_PTRVOID:
         *(uint32_t *)dst = tswap32(*(uint32_t *)src);
         break;
-#elif HOST_LONG_BITS == 64 && TARGET_LONG_BITS == 32
+#elif HOST_LONG_BITS == 64 && TARGET_ABI_BITS == 32
     case TYPE_LONG:
     case TYPE_ULONG:
     case TYPE_PTRVOID:
         if (to_host) {
-            *(uint64_t *)dst = tswap32(*(uint32_t *)src);
+            if (type == TYPE_LONG) {
+                /* sign extension */
+                *(uint64_t *)dst = (int32_t)tswap32(*(uint32_t *)src);
+            } else {
+                *(uint64_t *)dst = tswap32(*(uint32_t *)src);
+            }
         } else {
             *(uint32_t *)dst = tswap32(*(uint64_t *)src & 0xffffffff);
         }
         break;
+#elif HOST_LONG_BITS == 64 && TARGET_ABI_BITS == 64
+    case TYPE_LONG:
+    case TYPE_ULONG:
+    case TYPE_PTRVOID:
+        *(uint64_t *)dst = tswap64(*(uint64_t *)src);
+        break;
+#elif HOST_LONG_BITS == 32 && TARGET_ABI_BITS == 64
+    case TYPE_LONG:
+    case TYPE_ULONG:
+    case TYPE_PTRVOID:
+        if (to_host) {
+            *(uint32_t *)dst = tswap64(*(uint64_t *)src);
+        } else {
+            if (type == TYPE_LONG) {
+                /* sign extension */
+                *(uint64_t *)dst = tswap64(*(int32_t *)src);
+            } else {
+                *(uint64_t *)dst = tswap64(*(uint32_t *)src);
+            }
+        }
+        break;
 #else
 #warning unsupported conversion
 #endif
@@ -182,7 +215,7 @@ const argtype *thunk_convert(void *dst, const void *src,
             uint8_t  *d;
             const argtype *field_types;
             const int *dst_offsets, *src_offsets;
-            
+
             se = struct_entries + *type_ptr++;
             if (se->convert[0] != NULL) {
                 /* specific conversion is needed */
@@ -195,8 +228,8 @@ const argtype *thunk_convert(void *dst, const void *src,
                 d = dst;
                 s = src;
                 for(i = 0;i < se->nb_fields; i++) {
-                    field_types = thunk_convert(d + dst_offsets[i], 
-                                                s + src_offsets[i], 
+                    field_types = thunk_convert(d + dst_offsets[i],
+                                                s + src_offsets[i],
                                                 field_types, to_host);
                 }
             }
@@ -214,7 +247,7 @@ const argtype *thunk_convert(void *dst, const void *src,
 /* Utility function: Table-driven functions to translate bitmasks
  * between X86 and Alpha formats...
  */
-unsigned int target_to_host_bitmask(unsigned int x86_mask, 
+unsigned int target_to_host_bitmask(unsigned int x86_mask,
                                     bitmask_transtbl * trans_tbl)
 {
     bitmask_transtbl *	btp;
@@ -228,7 +261,7 @@ unsigned int target_to_host_bitmask(unsigned int x86_mask,
     return(alpha_mask);
 }
 
-unsigned int host_to_target_bitmask(unsigned int alpha_mask, 
+unsigned int host_to_target_bitmask(unsigned int alpha_mask,
                                     bitmask_transtbl * trans_tbl)
 {
     bitmask_transtbl *	btp;
@@ -241,3 +274,15 @@ unsigned int host_to_target_bitmask(unsigned int alpha_mask,
     }
     return(x86_mask);
 }
+
+#ifndef NO_THUNK_TYPE_SIZE
+int thunk_type_size_array(const argtype *type_ptr, int is_host)
+{
+    return thunk_type_size(type_ptr, is_host);
+}
+
+int thunk_type_align_array(const argtype *type_ptr, int is_host)
+{
+    return thunk_type_align(type_ptr, is_host);
+}
+#endif /* ndef NO_THUNK_TYPE_SIZE */
diff --git a/thunk.h b/thunk.h
index 42fd96f..d650fa4 100644
--- a/thunk.h
+++ b/thunk.h
@@ -1,6 +1,6 @@
 /*
  *  Generic thunking code to convert data between host and target CPU
- * 
+ *
  *  Copyright (c) 2003 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -69,12 +69,15 @@ typedef struct bitmask_transtbl {
 
 void thunk_register_struct(int id, const char *name, const argtype *types);
 void thunk_register_struct_direct(int id, const char *name, StructEntry *se1);
-const argtype *thunk_convert(void *dst, const void *src, 
+const argtype *thunk_convert(void *dst, const void *src,
                              const argtype *type_ptr, int to_host);
 #ifndef NO_THUNK_TYPE_SIZE
 
 extern StructEntry struct_entries[];
 
+int thunk_type_size_array(const argtype *type_ptr, int is_host);
+int thunk_type_align_array(const argtype *type_ptr, int is_host);
+
 static inline int thunk_type_size(const argtype *type_ptr, int is_host)
 {
     int type, size;
@@ -98,12 +101,12 @@ static inline int thunk_type_size(const argtype *type_ptr, int is_host)
         if (is_host) {
             return HOST_LONG_SIZE;
         } else {
-            return TARGET_LONG_SIZE;
+            return TARGET_ABI_BITS / 8;
         }
         break;
     case TYPE_ARRAY:
         size = type_ptr[1];
-        return size * thunk_type_size(type_ptr + 2, is_host);
+        return size * thunk_type_size_array(type_ptr + 2, is_host);
     case TYPE_STRUCT:
         se = struct_entries + type_ptr[1];
         return se->size[is_host];
@@ -135,11 +138,11 @@ static inline int thunk_type_align(const argtype *type_ptr, int is_host)
         if (is_host) {
             return HOST_LONG_SIZE;
         } else {
-            return TARGET_LONG_SIZE;
+            return TARGET_ABI_BITS / 8;
         }
         break;
     case TYPE_ARRAY:
-        return thunk_type_align(type_ptr + 2, is_host);
+        return thunk_type_align_array(type_ptr + 2, is_host);
     case TYPE_STRUCT:
         se = struct_entries + type_ptr[1];
         return se->align[is_host];
@@ -150,9 +153,9 @@ static inline int thunk_type_align(const argtype *type_ptr, int is_host)
 
 #endif /* NO_THUNK_TYPE_SIZE */
 
-unsigned int target_to_host_bitmask(unsigned int x86_mask, 
+unsigned int target_to_host_bitmask(unsigned int x86_mask,
                                     bitmask_transtbl * trans_tbl);
-unsigned int host_to_target_bitmask(unsigned int alpha_mask, 
+unsigned int host_to_target_bitmask(unsigned int alpha_mask,
                                     bitmask_transtbl * trans_tbl);
 
 #endif
diff --git a/trace.c b/trace.c
index 6cff83c..a96f87f 100644
--- a/trace.c
+++ b/trace.c
@@ -24,7 +24,6 @@
 #include "exec-all.h"
 #include "trace.h"
 #include "varint.h"
-#include "android_utils.h"
 
 TraceBB trace_bb;
 TraceInsn trace_insn;
@@ -36,6 +35,11 @@ TracePid trace_pid;
 TraceMethod trace_method;
 static TraceHeader header;
 
+const char *trace_filename;
+int tracing;
+int trace_cache_miss;
+int trace_all_addr;
+
 // The simulation time in cpu clock cycles
 uint64_t sim_time = 1;
 
@@ -438,11 +442,11 @@ void trace_init(const char *filename)
 }
 
 /* the following array is used to deal with def-use register interlocks, which we
- * can compute statically, very fortunately.
+ * can compute statically (ignoring conditions), very fortunately.
  *
  * the idea is that interlock_base contains the number of cycles "executed" from
  * the start of a basic block. It is set to 0 in trace_bb_start, and incremented
- * in each call to get_insn_ticks.
+ * in each call to get_insn_ticks_arm.
  *
  * interlocks[N] correspond to the value of interlock_base after which a register N
  * can be used by another operation, it is set each time an instruction writes to
@@ -761,7 +765,7 @@ void trace_cleanup()
 // not including any I-cache or D-cache misses.  This function
 // is called for each instruction in a basic block when that
 // block is being translated.
-int get_insn_ticks(uint32_t insn)
+int get_insn_ticks_arm(uint32_t insn)
 {
 #if 1
     int   result   =  1;   /* by default, use 1 cycle */
diff --git a/trace.h b/trace.h
index 026dfaf..ebb0e8c 100644
--- a/trace.h
+++ b/trace.h
@@ -140,10 +140,10 @@ extern void start_tracing();
 extern void stop_tracing();
 extern void trace_init(const char *filename);
 extern void trace_bb_start(uint32_t bb_addr);
-extern void trace_add_insn(uint32_t insn, int is_thumb);
+extern void trace_add_insn_arm(uint32_t insn, int is_thumb);
 extern void trace_bb_end();
 
-extern int get_insn_ticks(uint32_t insn);
+extern int get_insn_ticks_arm(uint32_t insn);
 extern int get_insn_ticks_thumb(uint32_t  insn);
 
 extern void trace_exception(uint32 pc);
@@ -154,4 +154,9 @@ extern void sim_dcache_store(uint32_t addr, uint32_t val);
 extern void sim_dcache_swp(uint32_t addr);
 extern void trace_interpreted_method(uint32_t addr, int call_type);
 
+extern const char *trace_filename;
+extern int tracing;
+extern int trace_cache_miss;
+extern int trace_all_addr;
+
 #endif /* TRACE_H */
diff --git a/translate-all.c b/translate-all.c
index fbcfeb8..1c27fd3 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -1,6 +1,6 @@
 /*
  *  Host code generation
- * 
+ *
  *  Copyright (c) 2003 Fabrice Bellard
  *
  * This library is free software; you can redistribute it and/or
@@ -29,185 +29,103 @@
 #include "cpu.h"
 #include "exec-all.h"
 #include "disas.h"
+#include "tcg.h"
 
-typedef int (*cpu_gen_code_func)(CPUState*          env,
-                                 TranslationBlock*  tb,
-                                 int                max_code_size,
-                                 int*               gen_code_size_ptr);
-
-typedef int (*cpu_restore_state_func)(TranslationBlock*  tb,
-                                      CPUState*          env,
-                                      unsigned long      searched_pc,
-                                      void*              puc);
-
-typedef void (*dump_ops_func)(const uint16_t *opc_buf, const uint32_t *opparam_buf);
-
-extern cpu_gen_code_func       _cpu_gen_code;
-extern cpu_restore_state_func  _cpu_restore_state;
-extern dump_ops_func           _dump_ops;
-
-
-#ifdef GEN_TRACE
-#define  OPC_H  "opc-trace.h"
-#define  CPU_GEN_CODE       trace_cpu_gen_code
-#define  CPU_RESTORE_STATE  trace_cpu_restore_state
-#define  DUMP_OPS           trace_dump_ops
-#else
-#define OPC_H  "opc.h"
-#define  CPU_GEN_CODE       default_cpu_gen_code
-#define  CPU_RESTORE_STATE  default_cpu_restore_state
-#define  DUMP_OPS           default_dump_ops
-#endif
-
-
-
-
-extern int dyngen_code(uint8_t *gen_code_buf,
-                       uint16_t *label_offsets, uint16_t *jmp_offsets,
-                       const uint16_t *opc_buf, const uint32_t *opparam_buf, const long *gen_labels);
-
-enum {
-#define DEF(s, n, copy_size) INDEX_op_ ## s,
-#include OPC_H
-#undef DEF
-    NB_OPS,
-};
+/* code generation context */
+TCGContext tcg_ctx;
 
 uint16_t gen_opc_buf[OPC_BUF_SIZE];
-uint32_t gen_opparam_buf[OPPARAM_BUF_SIZE];
-long gen_labels[OPC_BUF_SIZE];
-int nb_gen_labels;
+TCGArg gen_opparam_buf[OPPARAM_BUF_SIZE];
 
 target_ulong gen_opc_pc[OPC_BUF_SIZE];
+uint16_t gen_opc_icount[OPC_BUF_SIZE];
 uint8_t gen_opc_instr_start[OPC_BUF_SIZE];
 #if defined(TARGET_I386)
 uint8_t gen_opc_cc_op[OPC_BUF_SIZE];
 #elif defined(TARGET_SPARC)
 target_ulong gen_opc_npc[OPC_BUF_SIZE];
 target_ulong gen_opc_jump_pc[2];
-#elif defined(TARGET_MIPS)
+#elif defined(TARGET_MIPS) || defined(TARGET_SH4)
 uint32_t gen_opc_hflags[OPC_BUF_SIZE];
 #endif
 
-#ifndef GEN_TRACE
-int code_copy_enabled = 1;
-#endif
-
-#ifdef DEBUG_DISAS
-static const char *op_str[] = {
-#define DEF(s, n, copy_size) #s,
-#include OPC_H
-#undef DEF
-};
-
-static uint8_t op_nb_args[] = {
-#define DEF(s, n, copy_size) n,
-#include OPC_H
-#undef DEF
-};
-
-static const unsigned short opc_copy_size[] = {
-#define DEF(s, n, copy_size) copy_size,
-#include OPC_H
-#undef DEF
-};
-
-void DUMP_OPS(const uint16_t *opc_buf, const uint32_t *opparam_buf)
+/* XXX: suppress that */
+unsigned long code_gen_max_block_size(void)
 {
-    const uint16_t *opc_ptr;
-    const uint32_t *opparam_ptr;
-    int c, n, i;
+    static unsigned long max;
 
-    opc_ptr = opc_buf;
-    opparam_ptr = opparam_buf;
-    for(;;) {
-        c = *opc_ptr++;
-        n = op_nb_args[c];
-        fprintf(logfile, "0x%04x: %s", 
-                (int)(opc_ptr - opc_buf - 1), op_str[c]);
-        for(i = 0; i < n; i++) {
-            fprintf(logfile, " 0x%x", opparam_ptr[i]);
-        }
-        fprintf(logfile, "\n");
-        if (c == INDEX_op_end)
-            break;
-        opparam_ptr += n;
+    if (max == 0) {
+        max = TCG_MAX_OP_SIZE;
+#define DEF(s, n, copy_size) max = copy_size > max? copy_size : max;
+#include "tcg-opc.h"
+#undef DEF
+        max *= OPC_MAX_SIZE;
     }
-}
 
-#endif
+    return max;
+}
 
-/* compute label info */
-static void dyngen_labels(long *gen_labels, int nb_gen_labels,
-                          uint8_t *gen_code_buf, const uint16_t *opc_buf)
+void cpu_gen_init(void)
 {
-    uint8_t *gen_code_ptr;
-    int c, i;
-    unsigned long gen_code_addr[OPC_BUF_SIZE];
-    
-    if (nb_gen_labels == 0)
-        return;
-    /* compute the address of each op code */
-    
-    gen_code_ptr = gen_code_buf;
-    i = 0;
-    for(;;) {
-        c = opc_buf[i];
-        gen_code_addr[i] =(unsigned long)gen_code_ptr;
-        if (c == INDEX_op_end)
-            break;
-        gen_code_ptr += opc_copy_size[c];
-        i++;
-    }
-    
-    /* compute the address of each label */
-    for(i = 0; i < nb_gen_labels; i++) {
-        gen_labels[i] = gen_code_addr[gen_labels[i]];
-    }
+    tcg_context_init(&tcg_ctx); 
+    tcg_set_frame(&tcg_ctx, TCG_AREG0, offsetof(CPUState, temp_buf),
+                  CPU_TEMP_BUF_NLONGS * sizeof(long));
 }
 
 /* return non zero if the very first instruction is invalid so that
-   the virtual CPU can trigger an exception. 
+   the virtual CPU can trigger an exception.
 
    '*gen_code_size_ptr' contains the size of the generated code (host
    code).
 */
-static int CPU_GEN_CODE(CPUState *env, TranslationBlock *tb,
-                 int max_code_size, int *gen_code_size_ptr)
+int cpu_gen_code(CPUState *env, TranslationBlock *tb, int *gen_code_size_ptr)
 {
+    TCGContext *s = &tcg_ctx;
     uint8_t *gen_code_buf;
     int gen_code_size;
-
-#ifdef USE_CODE_COPY
-    if (code_copy_enabled &&
-        cpu_gen_code_copy(env, tb, max_code_size, &gen_code_size) == 0) {
-        /* nothing more to do */
-    } else
+#ifdef CONFIG_PROFILER
+    int64_t ti;
 #endif
-    {
-        if (gen_intermediate_code(env, tb) < 0)
-            return -1;
 
-        /* generate machine code */
-        tb->tb_next_offset[0] = 0xffff;
-        tb->tb_next_offset[1] = 0xffff;
-        gen_code_buf = tb->tc_ptr;
-#ifdef USE_DIRECT_JUMP
-        /* the following two entries are optional (only used for string ops) */
-        tb->tb_jmp_offset[2] = 0xffff;
-        tb->tb_jmp_offset[3] = 0xffff;
+#ifdef CONFIG_PROFILER
+    s->tb_count1++; /* includes aborted translations because of
+                       exceptions */
+    ti = profile_getclock();
 #endif
-        dyngen_labels(gen_labels, nb_gen_labels, gen_code_buf, gen_opc_buf);
+    tcg_func_start(s);
+
+    gen_intermediate_code(env, tb);
 
-        gen_code_size = dyngen_code(gen_code_buf, tb->tb_next_offset,
+    /* generate machine code */
+    gen_code_buf = tb->tc_ptr;
+    tb->tb_next_offset[0] = 0xffff;
+    tb->tb_next_offset[1] = 0xffff;
+    s->tb_next_offset = tb->tb_next_offset;
 #ifdef USE_DIRECT_JUMP
-                                    tb->tb_jmp_offset,
+    s->tb_jmp_offset = tb->tb_jmp_offset;
+    s->tb_next = NULL;
+    /* the following two entries are optional (only used for string ops) */
+    /* XXX: not used ? */
+    tb->tb_jmp_offset[2] = 0xffff;
+    tb->tb_jmp_offset[3] = 0xffff;
 #else
-                                    NULL,
+    s->tb_jmp_offset = NULL;
+    s->tb_next = tb->tb_next;
 #endif
-                                    gen_opc_buf, gen_opparam_buf, gen_labels);
-    }
+
+#ifdef CONFIG_PROFILER
+    s->tb_count++;
+    s->interm_time += profile_getclock() - ti;
+    s->code_time -= profile_getclock();
+#endif
+    gen_code_size = dyngen_code(s, gen_code_buf);
     *gen_code_size_ptr = gen_code_size;
+#ifdef CONFIG_PROFILER
+    s->code_time += profile_getclock();
+    s->code_in_len += tb->size;
+    s->code_out_len += gen_code_size;
+#endif
+
 #ifdef DEBUG_DISAS
     if (loglevel & CPU_LOG_TB_OUT_ASM) {
         fprintf(logfile, "OUT: [size=%d]\n", *gen_code_size_ptr);
@@ -219,170 +137,59 @@ static int CPU_GEN_CODE(CPUState *env, TranslationBlock *tb,
     return 0;
 }
 
-/* The cpu state corresponding to 'searched_pc' is restored. 
+/* The cpu state corresponding to 'searched_pc' is restored.
  */
-static int CPU_RESTORE_STATE(TranslationBlock *tb,
+int cpu_restore_state(TranslationBlock *tb,
                       CPUState *env, unsigned long searched_pc,
                       void *puc)
 {
-    int j, c;
+    TCGContext *s = &tcg_ctx;
+    int j;
     unsigned long tc_ptr;
-    uint16_t *opc_ptr;
+#ifdef CONFIG_PROFILER
+    int64_t ti;
+#endif
 
-#ifdef USE_CODE_COPY
-    if (tb->cflags & CF_CODE_COPY) {
-        return cpu_restore_state_copy(tb, env, searched_pc, puc);
-    }
+#ifdef CONFIG_PROFILER
+    ti = profile_getclock();
 #endif
-    if (gen_intermediate_code_pc(env, tb) < 0)
-        return -1;
-    
+    tcg_func_start(s);
+
+    gen_intermediate_code_pc(env, tb);
+
+    if (use_icount) {
+        /* Reset the cycle counter to the start of the block.  */
+        env->icount_decr.u16.low += tb->icount;
+        /* Clear the IO flag.  */
+        env->can_do_io = 0;
+    }
+
     /* find opc index corresponding to search_pc */
     tc_ptr = (unsigned long)tb->tc_ptr;
     if (searched_pc < tc_ptr)
         return -1;
-    j = 0;
-    opc_ptr = gen_opc_buf;
-    for(;;) {
-        c = *opc_ptr;
-        if (c == INDEX_op_end)
-            return -1;
-        tc_ptr += opc_copy_size[c];
-        if (searched_pc < tc_ptr)
-            break;
-        opc_ptr++;
-    }
-    j = opc_ptr - gen_opc_buf;
+
+    s->tb_next_offset = tb->tb_next_offset;
+#ifdef USE_DIRECT_JUMP
+    s->tb_jmp_offset = tb->tb_jmp_offset;
+    s->tb_next = NULL;
+#else
+    s->tb_jmp_offset = NULL;
+    s->tb_next = tb->tb_next;
+#endif
+    j = dyngen_code_search_pc(s, (uint8_t *)tc_ptr, searched_pc - tc_ptr);
+    if (j < 0)
+        return -1;
     /* now find start of instruction before */
     while (gen_opc_instr_start[j] == 0)
         j--;
-#if defined(TARGET_I386)
-    {
-        int cc_op;
-#ifdef DEBUG_DISAS
-        if (loglevel & CPU_LOG_TB_OP) {
-            int i;
-            fprintf(logfile, "RESTORE:\n");
-            for(i=0;i<=j; i++) {
-                if (gen_opc_instr_start[i]) {
-                    fprintf(logfile, "0x%04x: " TARGET_FMT_lx "\n", i, gen_opc_pc[i]);
-                }
-            }
-            fprintf(logfile, "spc=0x%08lx j=0x%x eip=" TARGET_FMT_lx " cs_base=%x\n", 
-                    searched_pc, j, gen_opc_pc[j] - tb->cs_base, 
-                    (uint32_t)tb->cs_base);
-        }
-#endif
-        env->eip = gen_opc_pc[j] - tb->cs_base;
-        cc_op = gen_opc_cc_op[j];
-        if (cc_op != CC_OP_DYNAMIC)
-            env->cc_op = cc_op;
-    }
-#elif defined(TARGET_ARM)
-    env->regs[15] = gen_opc_pc[j];
-#elif defined(TARGET_SPARC)
-    {
-        target_ulong npc;
-        env->pc = gen_opc_pc[j];
-        npc = gen_opc_npc[j];
-        if (npc == 1) {
-            /* dynamic NPC: already stored */
-        } else if (npc == 2) {
-            target_ulong t2 = (target_ulong)puc;
-            /* jump PC: use T2 and the jump targets of the translation */
-            if (t2) 
-                env->npc = gen_opc_jump_pc[0];
-            else
-                env->npc = gen_opc_jump_pc[1];
-        } else {
-            env->npc = npc;
-        }
-    }
-#elif defined(TARGET_PPC)
-    {
-        int type;
-        /* for PPC, we need to look at the micro operation to get the
-           access type */
-        env->nip = gen_opc_pc[j];
-        switch(c) {
-#if defined(CONFIG_USER_ONLY)
-#define CASE3(op)\
-        case INDEX_op_ ## op ## _raw
-#else
-#define CASE3(op)\
-        case INDEX_op_ ## op ## _user:\
-        case INDEX_op_ ## op ## _kernel
-#endif
-            
-        CASE3(stfd):
-        CASE3(stfs):
-        CASE3(lfd):
-        CASE3(lfs):
-            type = ACCESS_FLOAT;
-            break;
-        CASE3(lwarx):
-            type = ACCESS_RES;
-            break;
-        CASE3(stwcx):
-            type = ACCESS_RES;
-            break;
-        CASE3(eciwx):
-        CASE3(ecowx):
-            type = ACCESS_EXT;
-            break;
-        default:
-            type = ACCESS_INT;
-            break;
-        }
-        env->access_type = type;
-    }
-#elif defined(TARGET_MIPS)
-    env->PC = gen_opc_pc[j];
-    env->hflags &= ~MIPS_HFLAG_BMASK;
-    env->hflags |= gen_opc_hflags[j];
-#endif
-    return 0;
-}
-
-
-#ifdef GEN_TRACE
+    env->icount_decr.u16.low -= gen_opc_icount[j];
 
-void  qemu_trace_enable_gencode( void )
-{
-    _cpu_gen_code      = CPU_GEN_CODE;
-    _cpu_restore_state = CPU_RESTORE_STATE;
-    _dump_ops          = DUMP_OPS;
-}
-
-#else
-
-cpu_gen_code_func       _cpu_gen_code      = CPU_GEN_CODE;
-cpu_restore_state_func  _cpu_restore_state = CPU_RESTORE_STATE;
-dump_ops_func           _dump_ops          = DUMP_OPS;
-
-void  qemu_trace_disable_gencode( void )
-{
-    _cpu_gen_code      = CPU_GEN_CODE;
-    _cpu_restore_state = CPU_RESTORE_STATE;
-    _dump_ops          = DUMP_OPS;
-}
-
-int cpu_gen_code(CPUState *env, TranslationBlock *tb,
-                 int max_code_size, int *gen_code_size_ptr)
-{
-  return (*_cpu_gen_code)(env, tb, max_code_size, gen_code_size_ptr);
-}
-
-int cpu_restore_state(TranslationBlock *tb,
-                      CPUState *env, unsigned long searched_pc,
-                      void *puc)
-{
-  return (*_cpu_restore_state)(tb, env, searched_pc, puc);
-}
-
-void dump_ops(const uint16_t *opc_buf, const uint32_t *opparam_buf)
-{
-  (*_dump_ops)(opc_buf, opparam_buf);
-}
+    gen_pc_load(env, tb, searched_pc, j, puc);
 
+#ifdef CONFIG_PROFILER
+    s->restore_time += profile_getclock() - ti;
+    s->restore_count++;
 #endif
+    return 0;
+}
diff --git a/uboot_image.h b/uboot_image.h
new file mode 100644
index 0000000..d5a5b30
--- /dev/null
+++ b/uboot_image.h
@@ -0,0 +1,160 @@
+/*
+ * (C) Copyright 2000-2005
+ * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
+ *
+ * See file CREDITS for list of people who contributed to this
+ * project.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	 See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ *
+ ********************************************************************
+ * NOTE: This header file defines an interface to U-Boot. Including
+ * this (unmodified) header file in another file is considered normal
+ * use of U-Boot, and does *not* fall under the heading of "derived
+ * work".
+ ********************************************************************
+ */
+
+#ifndef __UBOOT_IMAGE_H__
+#define __UBOOT_IMAGE_H__
+
+/*
+ * Operating System Codes
+ */
+#define IH_OS_INVALID		0	/* Invalid OS	*/
+#define IH_OS_OPENBSD		1	/* OpenBSD	*/
+#define IH_OS_NETBSD		2	/* NetBSD	*/
+#define IH_OS_FREEBSD		3	/* FreeBSD	*/
+#define IH_OS_4_4BSD		4	/* 4.4BSD	*/
+#define IH_OS_LINUX		5	/* Linux	*/
+#define IH_OS_SVR4		6	/* SVR4		*/
+#define IH_OS_ESIX		7	/* Esix		*/
+#define IH_OS_SOLARIS		8	/* Solaris	*/
+#define IH_OS_IRIX		9	/* Irix		*/
+#define IH_OS_SCO		10	/* SCO		*/
+#define IH_OS_DELL		11	/* Dell		*/
+#define IH_OS_NCR		12	/* NCR		*/
+#define IH_OS_LYNXOS		13	/* LynxOS	*/
+#define IH_OS_VXWORKS		14	/* VxWorks	*/
+#define IH_OS_PSOS		15	/* pSOS		*/
+#define IH_OS_QNX		16	/* QNX		*/
+#define IH_OS_U_BOOT		17	/* Firmware	*/
+#define IH_OS_RTEMS		18	/* RTEMS	*/
+#define IH_OS_ARTOS		19	/* ARTOS	*/
+#define IH_OS_UNITY		20	/* Unity OS	*/
+
+/*
+ * CPU Architecture Codes (supported by Linux)
+ */
+#define IH_CPU_INVALID		0	/* Invalid CPU	*/
+#define IH_CPU_ALPHA		1	/* Alpha	*/
+#define IH_CPU_ARM		2	/* ARM		*/
+#define IH_CPU_I386		3	/* Intel x86	*/
+#define IH_CPU_IA64		4	/* IA64		*/
+#define IH_CPU_MIPS		5	/* MIPS		*/
+#define IH_CPU_MIPS64		6	/* MIPS	 64 Bit */
+#define IH_CPU_PPC		7	/* PowerPC	*/
+#define IH_CPU_S390		8	/* IBM S390	*/
+#define IH_CPU_SH		9	/* SuperH	*/
+#define IH_CPU_SPARC		10	/* Sparc	*/
+#define IH_CPU_SPARC64		11	/* Sparc 64 Bit */
+#define IH_CPU_M68K		12	/* M68K		*/
+#define IH_CPU_NIOS		13	/* Nios-32	*/
+#define IH_CPU_MICROBLAZE	14	/* MicroBlaze   */
+#define IH_CPU_NIOS2		15	/* Nios-II	*/
+#define IH_CPU_BLACKFIN		16	/* Blackfin	*/
+#define IH_CPU_AVR32		17	/* AVR32	*/
+
+/*
+ * Image Types
+ *
+ * "Standalone Programs" are directly runnable in the environment
+ *	provided by U-Boot; it is expected that (if they behave
+ *	well) you can continue to work in U-Boot after return from
+ *	the Standalone Program.
+ * "OS Kernel Images" are usually images of some Embedded OS which
+ *	will take over control completely. Usually these programs
+ *	will install their own set of exception handlers, device
+ *	drivers, set up the MMU, etc. - this means, that you cannot
+ *	expect to re-enter U-Boot except by resetting the CPU.
+ * "RAMDisk Images" are more or less just data blocks, and their
+ *	parameters (address, size) are passed to an OS kernel that is
+ *	being started.
+ * "Multi-File Images" contain several images, typically an OS
+ *	(Linux) kernel image and one or more data images like
+ *	RAMDisks. This construct is useful for instance when you want
+ *	to boot over the network using BOOTP etc., where the boot
+ *	server provides just a single image file, but you want to get
+ *	for instance an OS kernel and a RAMDisk image.
+ *
+ *	"Multi-File Images" start with a list of image sizes, each
+ *	image size (in bytes) specified by an "uint32_t" in network
+ *	byte order. This list is terminated by an "(uint32_t)0".
+ *	Immediately after the terminating 0 follow the images, one by
+ *	one, all aligned on "uint32_t" boundaries (size rounded up to
+ *	a multiple of 4 bytes - except for the last file).
+ *
+ * "Firmware Images" are binary images containing firmware (like
+ *	U-Boot or FPGA images) which usually will be programmed to
+ *	flash memory.
+ *
+ * "Script files" are command sequences that will be executed by
+ *	U-Boot's command interpreter; this feature is especially
+ *	useful when you configure U-Boot to use a real shell (hush)
+ *	as command interpreter (=> Shell Scripts).
+ */
+
+#define IH_TYPE_INVALID		0	/* Invalid Image		*/
+#define IH_TYPE_STANDALONE	1	/* Standalone Program		*/
+#define IH_TYPE_KERNEL		2	/* OS Kernel Image		*/
+#define IH_TYPE_RAMDISK		3	/* RAMDisk Image		*/
+#define IH_TYPE_MULTI		4	/* Multi-File Image		*/
+#define IH_TYPE_FIRMWARE	5	/* Firmware Image		*/
+#define IH_TYPE_SCRIPT		6	/* Script file			*/
+#define IH_TYPE_FILESYSTEM	7	/* Filesystem Image (any type)	*/
+#define IH_TYPE_FLATDT		8	/* Binary Flat Device Tree Blob	*/
+
+/*
+ * Compression Types
+ */
+#define IH_COMP_NONE		0	/*  No	 Compression Used	*/
+#define IH_COMP_GZIP		1	/* gzip	 Compression Used	*/
+#define IH_COMP_BZIP2		2	/* bzip2 Compression Used	*/
+
+#define IH_MAGIC	0x27051956	/* Image Magic Number		*/
+#define IH_NMLEN		32	/* Image Name Length		*/
+
+/*
+ * all data in network byte order (aka natural aka bigendian)
+ */
+
+typedef struct uboot_image_header {
+	uint32_t	ih_magic;	/* Image Header Magic Number	*/
+	uint32_t	ih_hcrc;	/* Image Header CRC Checksum	*/
+	uint32_t	ih_time;	/* Image Creation Timestamp	*/
+	uint32_t	ih_size;	/* Image Data Size		*/
+	uint32_t	ih_load;	/* Data	 Load  Address		*/
+	uint32_t	ih_ep;		/* Entry Point Address		*/
+	uint32_t	ih_dcrc;	/* Image Data CRC Checksum	*/
+	uint8_t		ih_os;		/* Operating System		*/
+	uint8_t		ih_arch;	/* CPU architecture		*/
+	uint8_t		ih_type;	/* Image Type			*/
+	uint8_t		ih_comp;	/* Compression Type		*/
+	uint8_t		ih_name[IH_NMLEN];	/* Image Name		*/
+} uboot_image_header_t;
+
+
+#endif	/* __IMAGE_H__ */
diff --git a/usb-linux.c b/usb-linux.c
index aa1ded2..91acccd 100644
--- a/usb-linux.c
+++ b/usb-linux.c
@@ -2,7 +2,11 @@
  * Linux host USB redirector
  *
  * Copyright (c) 2005 Fabrice Bellard
- * 
+ *
+ * Copyright (c) 2008 Max Krasnyansky
+ *      Support for host device auto connect & disconnect
+ *      Major rewrite to support fully async operation
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -21,13 +25,19 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+
+#include "qemu-common.h"
+#include "qemu-timer.h"
+#include "console.h"
 
 #if defined(__linux__)
 #include <dirent.h>
 #include <sys/ioctl.h>
+#include <signal.h>
+
 #include <linux/usbdevice_fs.h>
 #include <linux/version.h>
+#include "hw/usb.h"
 
 /* We redefine it to avoid version problems */
 struct usb_ctrltransfer {
@@ -40,214 +50,974 @@ struct usb_ctrltransfer {
     void *data;
 };
 
+struct usb_ctrlrequest {
+    uint8_t bRequestType;
+    uint8_t bRequest;
+    uint16_t wValue;
+    uint16_t wIndex;
+    uint16_t wLength;
+};
+
 typedef int USBScanFunc(void *opaque, int bus_num, int addr, int class_id,
-                        int vendor_id, int product_id, 
+                        int vendor_id, int product_id,
                         const char *product_name, int speed);
-static int usb_host_find_device(int *pbus_num, int *paddr, 
+static int usb_host_find_device(int *pbus_num, int *paddr,
                                 char *product_name, int product_name_size,
                                 const char *devname);
-
 //#define DEBUG
 
+#ifdef DEBUG
+#define dprintf printf
+#else
+#define dprintf(...)
+#endif
+
 #define USBDEVFS_PATH "/proc/bus/usb"
 #define PRODUCT_NAME_SZ 32
+#define MAX_ENDPOINTS 16
+
+/* endpoint association data */
+struct endp_data {
+    uint8_t type;
+    uint8_t halted;
+};
+
+enum {
+    CTRL_STATE_IDLE = 0,
+    CTRL_STATE_SETUP,
+    CTRL_STATE_DATA,
+    CTRL_STATE_ACK
+};
+
+/*
+ * Control transfer state.
+ * Note that 'buffer' _must_ follow 'req' field because 
+ * we need contigious buffer when we submit control URB.
+ */ 
+struct ctrl_struct {
+    uint16_t len;
+    uint16_t offset;
+    uint8_t  state;
+    struct   usb_ctrlrequest req;
+    uint8_t  buffer[1024];
+};
 
 typedef struct USBHostDevice {
     USBDevice dev;
-    int fd;
+    int       fd;
+
+    uint8_t   descr[1024];
+    int       descr_len;
+    int       configuration;
+    int       ninterfaces;
+    int       closing;
+
+    struct ctrl_struct ctrl;
+    struct endp_data endp_table[MAX_ENDPOINTS];
+
+    /* Host side address */
+    int bus_num;
+    int addr;
+
+    struct USBHostDevice *next;
 } USBHostDevice;
 
-static void usb_host_handle_reset(USBDevice *dev, int destroy)
+static int is_isoc(USBHostDevice *s, int ep)
 {
-#if 0
-    USBHostDevice *s = (USBHostDevice *)dev;
-    /* USBDEVFS_RESET, but not the first time as it has already be
-       done by the host OS */
-    ioctl(s->fd, USBDEVFS_RESET);
+    return s->endp_table[ep - 1].type == USBDEVFS_URB_TYPE_ISO;
+}
+
+static int is_halted(USBHostDevice *s, int ep)
+{
+    return s->endp_table[ep - 1].halted;
+}
+
+static void clear_halt(USBHostDevice *s, int ep)
+{
+    s->endp_table[ep - 1].halted = 0;
+}
+
+static void set_halt(USBHostDevice *s, int ep)
+{
+    s->endp_table[ep - 1].halted = 1;
+}
+
+static USBHostDevice *hostdev_list;
+
+static void hostdev_link(USBHostDevice *dev)
+{
+    dev->next = hostdev_list;
+    hostdev_list = dev;
+}
+
+static void hostdev_unlink(USBHostDevice *dev)
+{
+    USBHostDevice *pdev = hostdev_list;
+    USBHostDevice **prev = &hostdev_list;
+
+    while (pdev) {
+	if (pdev == dev) {
+            *prev = dev->next;
+            return;
+        }
+
+        prev = &pdev->next;
+        pdev = pdev->next;
+    }
+}
+
+static USBHostDevice *hostdev_find(int bus_num, int addr)
+{
+    USBHostDevice *s = hostdev_list;
+    while (s) {
+        if (s->bus_num == bus_num && s->addr == addr)
+            return s;
+        s = s->next;
+    }
+    return NULL;
+}
+
+/* 
+ * Async URB state.
+ * We always allocate one isoc descriptor even for bulk transfers
+ * to simplify allocation and casts. 
+ */
+typedef struct AsyncURB
+{
+    struct usbdevfs_urb urb;
+    struct usbdevfs_iso_packet_desc isocpd;
+
+    USBPacket     *packet;
+    USBHostDevice *hdev;
+} AsyncURB;
+
+static AsyncURB *async_alloc(void)
+{
+    return (AsyncURB *) qemu_mallocz(sizeof(AsyncURB));
+}
+
+static void async_free(AsyncURB *aurb)
+{
+    qemu_free(aurb);
+}
+
+static void async_complete_ctrl(USBHostDevice *s, USBPacket *p)
+{
+    switch(s->ctrl.state) {
+    case CTRL_STATE_SETUP:
+        if (p->len < s->ctrl.len)
+            s->ctrl.len = p->len;
+        s->ctrl.state = CTRL_STATE_DATA;
+        p->len = 8;
+        break;
+
+    case CTRL_STATE_ACK:
+        s->ctrl.state = CTRL_STATE_IDLE;
+        p->len = 0;
+        break;
+
+    default:
+        break;
+    }
+}
+
+static void async_complete(void *opaque)
+{
+    USBHostDevice *s = opaque;
+    AsyncURB *aurb;
+
+    while (1) {
+    	USBPacket *p;
+
+	int r = ioctl(s->fd, USBDEVFS_REAPURBNDELAY, &aurb);
+        if (r < 0) {
+            if (errno == EAGAIN)
+                return;
+
+            if (errno == ENODEV && !s->closing) {
+                printf("husb: device %d.%d disconnected\n", s->bus_num, s->addr);
+	        usb_device_del_addr(0, s->dev.addr);
+                return;
+            }
+
+            dprintf("husb: async. reap urb failed errno %d\n", errno);
+            return;
+        }
+
+        p = aurb->packet;
+
+	dprintf("husb: async completed. aurb %p status %d alen %d\n", 
+                aurb, aurb->urb.status, aurb->urb.actual_length);
+
+	if (p) {
+            switch (aurb->urb.status) {
+            case 0:
+                p->len = aurb->urb.actual_length;
+                if (aurb->urb.type == USBDEVFS_URB_TYPE_CONTROL)
+                    async_complete_ctrl(s, p);
+                break;
+
+            case -EPIPE:
+                set_halt(s, p->devep);
+                /* fall through */
+            default:
+                p->len = USB_RET_NAK;
+                break;
+            }
+
+            usb_packet_complete(p);
+	}
+
+        async_free(aurb);
+    }
+}
+
+static void async_cancel(USBPacket *unused, void *opaque)
+{
+    AsyncURB *aurb = opaque;
+    USBHostDevice *s = aurb->hdev;
+
+    dprintf("husb: async cancel. aurb %p\n", aurb);
+
+    /* Mark it as dead (see async_complete above) */
+    aurb->packet = NULL;
+
+    int r = ioctl(s->fd, USBDEVFS_DISCARDURB, aurb);
+    if (r < 0) {
+        dprintf("husb: async. discard urb failed errno %d\n", errno);
+    }
+}
+
+static int usb_host_claim_interfaces(USBHostDevice *dev, int configuration)
+{
+    int dev_descr_len, config_descr_len;
+    int interface, nb_interfaces, nb_configurations;
+    int ret, i;
+
+    if (configuration == 0) /* address state - ignore */
+        return 1;
+
+    dprintf("husb: claiming interfaces. config %d\n", configuration);
+
+    i = 0;
+    dev_descr_len = dev->descr[0];
+    if (dev_descr_len > dev->descr_len)
+        goto fail;
+    nb_configurations = dev->descr[17];
+
+    i += dev_descr_len;
+    while (i < dev->descr_len) {
+        dprintf("husb: i is %d, descr_len is %d, dl %d, dt %d\n", i, dev->descr_len,
+               dev->descr[i], dev->descr[i+1]);
+
+        if (dev->descr[i+1] != USB_DT_CONFIG) {
+            i += dev->descr[i];
+            continue;
+        }
+        config_descr_len = dev->descr[i];
+
+	printf("husb: config #%d need %d\n", dev->descr[i + 5], configuration); 
+
+        if (configuration < 0 || configuration == dev->descr[i + 5]) {
+            configuration = dev->descr[i + 5];
+            break;
+        }
+
+        i += config_descr_len;
+    }
+
+    if (i >= dev->descr_len) {
+        fprintf(stderr, "husb: update iface failed. no matching configuration\n");
+        goto fail;
+    }
+    nb_interfaces = dev->descr[i + 4];
+
+#ifdef USBDEVFS_DISCONNECT
+    /* earlier Linux 2.4 do not support that */
+    {
+        struct usbdevfs_ioctl ctrl;
+        for (interface = 0; interface < nb_interfaces; interface++) {
+            ctrl.ioctl_code = USBDEVFS_DISCONNECT;
+            ctrl.ifno = interface;
+            ret = ioctl(dev->fd, USBDEVFS_IOCTL, &ctrl);
+            if (ret < 0 && errno != ENODATA) {
+                perror("USBDEVFS_DISCONNECT");
+                goto fail;
+            }
+        }
+    }
 #endif
-} 
 
-static int usb_host_handle_control(USBDevice *dev,
-                                   int request,
-                                   int value,
-                                   int index,
-                                   int length,
-                                   uint8_t *data)
+    /* XXX: only grab if all interfaces are free */
+    for (interface = 0; interface < nb_interfaces; interface++) {
+        ret = ioctl(dev->fd, USBDEVFS_CLAIMINTERFACE, &interface);
+        if (ret < 0) {
+            if (errno == EBUSY) {
+                printf("husb: update iface. device already grabbed\n");
+            } else {
+                perror("husb: failed to claim interface");
+            }
+        fail:
+            return 0;
+        }
+    }
+
+    printf("husb: %d interfaces claimed for configuration %d\n",
+           nb_interfaces, configuration);
+
+    dev->ninterfaces   = nb_interfaces;
+    dev->configuration = configuration;
+    return 1;
+}
+
+static int usb_host_release_interfaces(USBHostDevice *s)
+{
+    int ret, i;
+
+    dprintf("husb: releasing interfaces\n");
+
+    for (i = 0; i < s->ninterfaces; i++) {
+        ret = ioctl(s->fd, USBDEVFS_RELEASEINTERFACE, &i);
+        if (ret < 0) {
+            perror("husb: failed to release interface");
+            return 0;
+        }
+    }
+
+    return 1;
+}
+
+static void usb_host_handle_reset(USBDevice *dev)
+{
+    USBHostDevice *s = (USBHostDevice *) dev;
+
+    dprintf("husb: reset device %u.%u\n", s->bus_num, s->addr);
+
+    ioctl(s->fd, USBDEVFS_RESET);
+
+    usb_host_claim_interfaces(s, s->configuration);
+}
+
+static void usb_host_handle_destroy(USBDevice *dev)
 {
     USBHostDevice *s = (USBHostDevice *)dev;
-    struct usb_ctrltransfer ct;
+
+    s->closing = 1;
+
+    qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
+
+    hostdev_unlink(s);
+
+    async_complete(s);
+
+    if (s->fd >= 0)
+        close(s->fd);
+
+    qemu_free(s);
+}
+
+static int usb_linux_update_endp_table(USBHostDevice *s);
+
+static int usb_host_handle_data(USBHostDevice *s, USBPacket *p)
+{
+    struct usbdevfs_urb *urb;
+    AsyncURB *aurb;
     int ret;
 
-    if (request == (DeviceOutRequest | USB_REQ_SET_ADDRESS)) {
-        /* specific SET_ADDRESS support */
-        dev->addr = value;
-        return 0;
-    } else {
-        ct.bRequestType = request >> 8;
-        ct.bRequest = request;
-        ct.wValue = value;
-        ct.wIndex = index;
-        ct.wLength = length;
-        ct.timeout = 50;
-        ct.data = data;
-        ret = ioctl(s->fd, USBDEVFS_CONTROL, &ct);
+    aurb = async_alloc();
+    if (!aurb) {
+        dprintf("husb: async malloc failed\n");
+        return USB_RET_NAK;
+    }
+    aurb->hdev   = s;
+    aurb->packet = p;
+
+    urb = &aurb->urb;
+
+    if (p->pid == USB_TOKEN_IN)
+    	urb->endpoint = p->devep | 0x80;
+    else
+    	urb->endpoint = p->devep;
+
+    if (is_halted(s, p->devep)) {
+	ret = ioctl(s->fd, USBDEVFS_CLEAR_HALT, &urb->endpoint);
         if (ret < 0) {
-            switch(errno) {
-            case ETIMEDOUT:
-                return USB_RET_NAK;
-            default:
-                return USB_RET_STALL;
-            }
-        } else {
-            return ret;
+            dprintf("husb: failed to clear halt. ep 0x%x errno %d\n", 
+                   urb->endpoint, errno);
+            return USB_RET_NAK;
         }
-   }
+        clear_halt(s, p->devep);
+    }
+
+    urb->buffer        = p->data;
+    urb->buffer_length = p->len;
+
+    if (is_isoc(s, p->devep)) {
+        /* Setup ISOC transfer */
+        urb->type     = USBDEVFS_URB_TYPE_ISO;
+        urb->flags    = USBDEVFS_URB_ISO_ASAP;
+        urb->number_of_packets = 1;
+        urb->iso_frame_desc[0].length = p->len;
+    } else {
+        /* Setup bulk transfer */
+        urb->type     = USBDEVFS_URB_TYPE_BULK;
+    }
+
+    urb->usercontext = s;
+
+    ret = ioctl(s->fd, USBDEVFS_SUBMITURB, urb);
+
+    dprintf("husb: data submit. ep 0x%x len %u aurb %p\n", urb->endpoint, p->len, aurb);
+
+    if (ret < 0) {
+        dprintf("husb: submit failed. errno %d\n", errno);
+        async_free(aurb);
+
+        switch(errno) {
+        case ETIMEDOUT:
+            return USB_RET_NAK;
+        case EPIPE:
+        default:
+            return USB_RET_STALL;
+        }
+    }
+
+    usb_defer_packet(p, async_cancel, aurb);
+    return USB_RET_ASYNC;
 }
 
-static int usb_host_handle_data(USBDevice *dev, int pid, 
-                                uint8_t devep,
-                                uint8_t *data, int len)
+static int ctrl_error(void)
 {
-    USBHostDevice *s = (USBHostDevice *)dev;
-    struct usbdevfs_bulktransfer bt;
+    if (errno == ETIMEDOUT)
+        return USB_RET_NAK;
+    else 
+        return USB_RET_STALL;
+}
+
+static int usb_host_set_address(USBHostDevice *s, int addr)
+{
+    dprintf("husb: ctrl set addr %u\n", addr);
+    s->dev.addr = addr;
+    return 0;
+}
+
+static int usb_host_set_config(USBHostDevice *s, int config)
+{
+    usb_host_release_interfaces(s);
+
+    int ret = ioctl(s->fd, USBDEVFS_SETCONFIGURATION, &config);
+ 
+    dprintf("husb: ctrl set config %d ret %d errno %d\n", config, ret, errno);
+    
+    if (ret < 0)
+        return ctrl_error();
+ 
+    usb_host_claim_interfaces(s, config);
+    return 0;
+}
+
+static int usb_host_set_interface(USBHostDevice *s, int iface, int alt)
+{
+    struct usbdevfs_setinterface si;
     int ret;
 
-    /* XXX: optimize and handle all data types by looking at the
-       config descriptor */
-    if (pid == USB_TOKEN_IN)
-        devep |= 0x80;
-    bt.ep = devep;
-    bt.len = len;
-    bt.timeout = 50;
-    bt.data = data;
-    ret = ioctl(s->fd, USBDEVFS_BULK, &bt);
+    si.interface  = iface;
+    si.altsetting = alt;
+    ret = ioctl(s->fd, USBDEVFS_SETINTERFACE, &si);
+    
+    dprintf("husb: ctrl set iface %d altset %d ret %d errno %d\n", 
+    	iface, alt, ret, errno);
+    
+    if (ret < 0)
+        return ctrl_error();
+
+    usb_linux_update_endp_table(s);
+    return 0;
+}
+
+static int usb_host_handle_control(USBHostDevice *s, USBPacket *p)
+{
+    struct usbdevfs_urb *urb;
+    AsyncURB *aurb;
+    int ret, value, index;
+
+    /* 
+     * Process certain standard device requests.
+     * These are infrequent and are processed synchronously.
+     */
+    value = le16_to_cpu(s->ctrl.req.wValue);
+    index = le16_to_cpu(s->ctrl.req.wIndex);
+
+    dprintf("husb: ctrl type 0x%x req 0x%x val 0x%x index %u len %u\n",
+        s->ctrl.req.bRequestType, s->ctrl.req.bRequest, value, index, 
+        s->ctrl.len);
+
+    if (s->ctrl.req.bRequestType == 0) {
+        switch (s->ctrl.req.bRequest) {
+        case USB_REQ_SET_ADDRESS:
+            return usb_host_set_address(s, value);
+
+        case USB_REQ_SET_CONFIGURATION:
+            return usb_host_set_config(s, value & 0xff);
+        }
+    }
+
+    if (s->ctrl.req.bRequestType == 1 &&
+                  s->ctrl.req.bRequest == USB_REQ_SET_INTERFACE)
+        return usb_host_set_interface(s, index, value);
+
+    /* The rest are asynchronous */
+
+    aurb = async_alloc();
+    if (!aurb) {
+        dprintf("husb: async malloc failed\n");
+        return USB_RET_NAK;
+    }
+    aurb->hdev   = s;
+    aurb->packet = p;
+
+    /* 
+     * Setup ctrl transfer.
+     *
+     * s->ctrl is layed out such that data buffer immediately follows
+     * 'req' struct which is exactly what usbdevfs expects.
+     */ 
+    urb = &aurb->urb;
+
+    urb->type     = USBDEVFS_URB_TYPE_CONTROL;
+    urb->endpoint = p->devep;
+
+    urb->buffer        = &s->ctrl.req;
+    urb->buffer_length = 8 + s->ctrl.len;
+
+    urb->usercontext = s;
+
+    ret = ioctl(s->fd, USBDEVFS_SUBMITURB, urb);
+
+    dprintf("husb: submit ctrl. len %u aurb %p\n", urb->buffer_length, aurb);
+
     if (ret < 0) {
+        dprintf("husb: submit failed. errno %d\n", errno);
+        async_free(aurb);
+
         switch(errno) {
         case ETIMEDOUT:
             return USB_RET_NAK;
         case EPIPE:
         default:
-#ifdef DEBUG
-            printf("handle_data: errno=%d\n", errno);
-#endif
             return USB_RET_STALL;
         }
+    }
+
+    usb_defer_packet(p, async_cancel, aurb);
+    return USB_RET_ASYNC;
+}
+
+static int do_token_setup(USBDevice *dev, USBPacket *p)
+{
+    USBHostDevice *s = (USBHostDevice *) dev;
+    int ret = 0;
+
+    if (p->len != 8)
+        return USB_RET_STALL;
+ 
+    memcpy(&s->ctrl.req, p->data, 8);
+    s->ctrl.len    = le16_to_cpu(s->ctrl.req.wLength);
+    s->ctrl.offset = 0;
+    s->ctrl.state  = CTRL_STATE_SETUP;
+
+    if (s->ctrl.req.bRequestType & USB_DIR_IN) {
+        ret = usb_host_handle_control(s, p);
+        if (ret < 0)
+            return ret;
+
+        if (ret < s->ctrl.len)
+            s->ctrl.len = ret;
+        s->ctrl.state = CTRL_STATE_DATA;
     } else {
-        return ret;
+        if (s->ctrl.len == 0)
+            s->ctrl.state = CTRL_STATE_ACK;
+        else
+            s->ctrl.state = CTRL_STATE_DATA;
     }
+
+    return ret;
 }
 
-/* XXX: exclude high speed devices or implement EHCI */
-USBDevice *usb_host_device_open(const char *devname)
+static int do_token_in(USBDevice *dev, USBPacket *p)
 {
-    int fd, interface, ret, i;
-    USBHostDevice *dev;
+    USBHostDevice *s = (USBHostDevice *) dev;
+    int ret = 0;
+
+    if (p->devep != 0)
+        return usb_host_handle_data(s, p);
+
+    switch(s->ctrl.state) {
+    case CTRL_STATE_ACK:
+        if (!(s->ctrl.req.bRequestType & USB_DIR_IN)) {
+            ret = usb_host_handle_control(s, p);
+            if (ret == USB_RET_ASYNC)
+                return USB_RET_ASYNC;
+
+            s->ctrl.state = CTRL_STATE_IDLE;
+            return ret > 0 ? 0 : ret;
+        }
+
+        return 0;
+
+    case CTRL_STATE_DATA:
+        if (s->ctrl.req.bRequestType & USB_DIR_IN) {
+            int len = s->ctrl.len - s->ctrl.offset;
+            if (len > p->len)
+                len = p->len;
+            memcpy(p->data, s->ctrl.buffer + s->ctrl.offset, len);
+            s->ctrl.offset += len;
+            if (s->ctrl.offset >= s->ctrl.len)
+                s->ctrl.state = CTRL_STATE_ACK;
+            return len;
+        }
+
+        s->ctrl.state = CTRL_STATE_IDLE;
+        return USB_RET_STALL;
+
+    default:
+        return USB_RET_STALL;
+    }
+}
+
+static int do_token_out(USBDevice *dev, USBPacket *p)
+{
+    USBHostDevice *s = (USBHostDevice *) dev;
+
+    if (p->devep != 0)
+        return usb_host_handle_data(s, p);
+
+    switch(s->ctrl.state) {
+    case CTRL_STATE_ACK:
+        if (s->ctrl.req.bRequestType & USB_DIR_IN) {
+            s->ctrl.state = CTRL_STATE_IDLE;
+            /* transfer OK */
+        } else {
+            /* ignore additional output */
+        }
+        return 0;
+
+    case CTRL_STATE_DATA:
+        if (!(s->ctrl.req.bRequestType & USB_DIR_IN)) {
+            int len = s->ctrl.len - s->ctrl.offset;
+            if (len > p->len)
+                len = p->len;
+            memcpy(s->ctrl.buffer + s->ctrl.offset, p->data, len);
+            s->ctrl.offset += len;
+            if (s->ctrl.offset >= s->ctrl.len)
+                s->ctrl.state = CTRL_STATE_ACK;
+            return len;
+        }
+
+        s->ctrl.state = CTRL_STATE_IDLE;
+        return USB_RET_STALL;
+
+    default:
+        return USB_RET_STALL;
+    }
+}
+
+/*
+ * Packet handler.
+ * Called by the HC (host controller).
+ *
+ * Returns length of the transaction or one of the USB_RET_XXX codes.
+ */
+static int usb_host_handle_packet(USBDevice *s, USBPacket *p)
+{
+    switch(p->pid) {
+    case USB_MSG_ATTACH:
+        s->state = USB_STATE_ATTACHED;
+        return 0;
+
+    case USB_MSG_DETACH:
+        s->state = USB_STATE_NOTATTACHED;
+        return 0;
+
+    case USB_MSG_RESET:
+        s->remote_wakeup = 0;
+        s->addr = 0;
+        s->state = USB_STATE_DEFAULT;
+        s->handle_reset(s);
+        return 0;
+    }
+
+    /* Rest of the PIDs must match our address */
+    if (s->state < USB_STATE_DEFAULT || p->devaddr != s->addr)
+        return USB_RET_NODEV;
+
+    switch (p->pid) {
+    case USB_TOKEN_SETUP:
+        return do_token_setup(s, p);
+
+    case USB_TOKEN_IN:
+        return do_token_in(s, p);
+
+    case USB_TOKEN_OUT:
+        return do_token_out(s, p);
+ 
+    default:
+        return USB_RET_STALL;
+    }
+}
+
+/* returns 1 on problem encountered or 0 for success */
+static int usb_linux_update_endp_table(USBHostDevice *s)
+{
+    uint8_t *descriptors;
+    uint8_t devep, type, configuration, alt_interface;
+    struct usbdevfs_ctrltransfer ct;
+    int interface, ret, length, i;
+
+    ct.bRequestType = USB_DIR_IN;
+    ct.bRequest = USB_REQ_GET_CONFIGURATION;
+    ct.wValue = 0;
+    ct.wIndex = 0;
+    ct.wLength = 1;
+    ct.data = &configuration;
+    ct.timeout = 50;
+
+    ret = ioctl(s->fd, USBDEVFS_CONTROL, &ct);
+    if (ret < 0) {
+        perror("usb_linux_update_endp_table");
+        return 1;
+    }
+
+    /* in address state */
+    if (configuration == 0)
+        return 1;
+
+    /* get the desired configuration, interface, and endpoint descriptors
+     * from device description */
+    descriptors = &s->descr[18];
+    length = s->descr_len - 18;
+    i = 0;
+
+    if (descriptors[i + 1] != USB_DT_CONFIG ||
+        descriptors[i + 5] != configuration) {
+        dprintf("invalid descriptor data - configuration\n");
+        return 1;
+    }
+    i += descriptors[i];
+
+    while (i < length) {
+        if (descriptors[i + 1] != USB_DT_INTERFACE ||
+            (descriptors[i + 1] == USB_DT_INTERFACE &&
+             descriptors[i + 4] == 0)) {
+            i += descriptors[i];
+            continue;
+        }
+
+        interface = descriptors[i + 2];
+
+        ct.bRequestType = USB_DIR_IN | USB_RECIP_INTERFACE;
+        ct.bRequest = USB_REQ_GET_INTERFACE;
+        ct.wValue = 0;
+        ct.wIndex = interface;
+        ct.wLength = 1;
+        ct.data = &alt_interface;
+        ct.timeout = 50;
+
+        ret = ioctl(s->fd, USBDEVFS_CONTROL, &ct);
+        if (ret < 0) {
+            perror("usb_linux_update_endp_table");
+            return 1;
+        }
+
+        /* the current interface descriptor is the active interface
+         * and has endpoints */
+        if (descriptors[i + 3] != alt_interface) {
+            i += descriptors[i];
+            continue;
+        }
+
+        /* advance to the endpoints */
+        while (i < length && descriptors[i +1] != USB_DT_ENDPOINT)
+            i += descriptors[i];
+
+        if (i >= length)
+            break;
+
+        while (i < length) {
+            if (descriptors[i + 1] != USB_DT_ENDPOINT)
+                break;
+
+            devep = descriptors[i + 2];
+            switch (descriptors[i + 3] & 0x3) {
+            case 0x00:
+                type = USBDEVFS_URB_TYPE_CONTROL;
+                break;
+            case 0x01:
+                type = USBDEVFS_URB_TYPE_ISO;
+                break;
+            case 0x02:
+                type = USBDEVFS_URB_TYPE_BULK;
+                break;
+            case 0x03:
+                type = USBDEVFS_URB_TYPE_INTERRUPT;
+                break;
+            default:
+                dprintf("usb_host: malformed endpoint type\n");
+                type = USBDEVFS_URB_TYPE_BULK;
+            }
+            s->endp_table[(devep & 0xf) - 1].type = type;
+            s->endp_table[(devep & 0xf) - 1].halted = 0;
+
+            i += descriptors[i];
+        }
+    }
+    return 0;
+}
+
+static USBDevice *usb_host_device_open_addr(int bus_num, int addr, const char *prod_name)
+{
+    int fd = -1, ret;
+    USBHostDevice *dev = NULL;
     struct usbdevfs_connectinfo ci;
-    uint8_t descr[1024];
     char buf[1024];
-    int descr_len, dev_descr_len, config_descr_len, nb_interfaces;
-    int bus_num, addr;
-    char product_name[PRODUCT_NAME_SZ];
 
-    if (usb_host_find_device(&bus_num, &addr, 
-                             product_name, sizeof(product_name),
-                             devname) < 0) 
-        return NULL;
-    
-    snprintf(buf, sizeof(buf), USBDEVFS_PATH "/%03d/%03d", 
+    dev = qemu_mallocz(sizeof(USBHostDevice));
+    if (!dev)
+        goto fail;
+
+    dev->bus_num = bus_num;
+    dev->addr = addr;
+
+    printf("husb: open device %d.%d\n", bus_num, addr);
+
+    snprintf(buf, sizeof(buf), USBDEVFS_PATH "/%03d/%03d",
              bus_num, addr);
-    fd = open(buf, O_RDWR);
+    fd = open(buf, O_RDWR | O_NONBLOCK);
     if (fd < 0) {
         perror(buf);
-        return NULL;
-    }
-
-    /* read the config description */
-    descr_len = read(fd, descr, sizeof(descr));
-    if (descr_len <= 0) {
-        perror("read descr");
         goto fail;
     }
-    
-    i = 0;
-    dev_descr_len = descr[0];
-    if (dev_descr_len > descr_len)
-        goto fail;
-    i += dev_descr_len;
-    config_descr_len = descr[i];
-    if (i + config_descr_len > descr_len)
-        goto fail;
-    nb_interfaces = descr[i + 4];
-    if (nb_interfaces != 1) {
-        /* NOTE: currently we grab only one interface */
-        fprintf(stderr, "usb_host: only one interface supported\n");
+
+    /* read the device description */
+    dev->descr_len = read(fd, dev->descr, sizeof(dev->descr));
+    if (dev->descr_len <= 0) {
+        perror("husb: reading device data failed");
         goto fail;
     }
 
-#ifdef USBDEVFS_DISCONNECT
-    /* earlier Linux 2.4 do not support that */
+#ifdef DEBUG
     {
-        struct usbdevfs_ioctl ctrl;
-        ctrl.ioctl_code = USBDEVFS_DISCONNECT;
-        ctrl.ifno = 0;
-        ret = ioctl(fd, USBDEVFS_IOCTL, &ctrl);
-        if (ret < 0 && errno != ENODATA) {
-            perror("USBDEVFS_DISCONNECT");
-            goto fail;
-        }
+        int x;
+        printf("=== begin dumping device descriptor data ===\n");
+        for (x = 0; x < dev->descr_len; x++)
+            printf("%02x ", dev->descr[x]);
+        printf("\n=== end dumping device descriptor data ===\n");
     }
 #endif
 
-    /* XXX: only grab if all interfaces are free */
-    interface = 0;
-    ret = ioctl(fd, USBDEVFS_CLAIMINTERFACE, &interface);
-    if (ret < 0) {
-        if (errno == EBUSY) {
-            fprintf(stderr, "usb_host: device already grabbed\n");
-        } else {
-            perror("USBDEVFS_CLAIMINTERFACE");
-        }
-    fail:
-        close(fd);
-        return NULL;
-    }
+    dev->fd = fd;
+
+    /* 
+     * Initial configuration is -1 which makes us claim first 
+     * available config. We used to start with 1, which does not
+     * always work. I've seen devices where first config starts 
+     * with 2.
+     */
+    if (!usb_host_claim_interfaces(dev, -1))
+        goto fail;
 
     ret = ioctl(fd, USBDEVFS_CONNECTINFO, &ci);
     if (ret < 0) {
-        perror("USBDEVFS_CONNECTINFO");
+        perror("usb_host_device_open: USBDEVFS_CONNECTINFO");
         goto fail;
     }
 
-#ifdef DEBUG
-    printf("host USB device %d.%d grabbed\n", bus_num, addr);
-#endif    
+    printf("husb: grabbed usb device %d.%d\n", bus_num, addr);
 
-    dev = qemu_mallocz(sizeof(USBHostDevice));
-    if (!dev)
+    ret = usb_linux_update_endp_table(dev);
+    if (ret)
         goto fail;
-    dev->fd = fd;
+
     if (ci.slow)
         dev->dev.speed = USB_SPEED_LOW;
     else
         dev->dev.speed = USB_SPEED_HIGH;
-    dev->dev.handle_packet = usb_generic_handle_packet;
 
-    dev->dev.handle_reset = usb_host_handle_reset;
-    dev->dev.handle_control = usb_host_handle_control;
-    dev->dev.handle_data = usb_host_handle_data;
+    dev->dev.handle_packet  = usb_host_handle_packet;
+    dev->dev.handle_reset   = usb_host_handle_reset;
+    dev->dev.handle_destroy = usb_host_handle_destroy;
 
-    if (product_name[0] == '\0')
+    if (!prod_name || prod_name[0] == '\0')
         snprintf(dev->dev.devname, sizeof(dev->dev.devname),
-                 "host:%s", devname);
+                 "host:%d.%d", bus_num, addr);
     else
         pstrcpy(dev->dev.devname, sizeof(dev->dev.devname),
-                product_name);
+                prod_name);
+
+    /* USB devio uses 'write' flag to check for async completions */
+    qemu_set_fd_handler(dev->fd, NULL, async_complete, dev);
+
+    hostdev_link(dev);
+
+    return (USBDevice *) dev;
+
+fail:
+    if (dev)
+        qemu_free(dev);
+
+    close(fd);
+    return NULL;
+}
+
+static int usb_host_auto_add(const char *spec);
+static int usb_host_auto_del(const char *spec);
+
+USBDevice *usb_host_device_open(const char *devname)
+{
+    int bus_num, addr;
+    char product_name[PRODUCT_NAME_SZ];
 
-    return (USBDevice *)dev;
+    if (strstr(devname, "auto:")) {
+        usb_host_auto_add(devname);
+        return NULL;
+    }
+
+    if (usb_host_find_device(&bus_num, &addr, product_name, sizeof(product_name),
+                             devname) < 0)
+        return NULL;
+
+    if (hostdev_find(bus_num, addr)) {
+       term_printf("husb: host usb device %d.%d is already open\n", bus_num, addr);
+       return NULL;
+    }
+
+    return usb_host_device_open_addr(bus_num, addr, product_name);
 }
 
+int usb_host_device_close(const char *devname)
+{
+    char product_name[PRODUCT_NAME_SZ];
+    int bus_num, addr;
+    USBHostDevice *s;
+
+    if (strstr(devname, "auto:"))
+        return usb_host_auto_del(devname);
+
+    if (usb_host_find_device(&bus_num, &addr, product_name, sizeof(product_name),
+                             devname) < 0)
+        return -1;
+ 
+    s = hostdev_find(bus_num, addr);
+    if (s) {
+        usb_device_del_addr(0, s->dev.addr);
+        return 0;
+    }
+
+    return -1;
+}
+ 
 static int get_tag_value(char *buf, int buf_size,
-                         const char *str, const char *tag, 
+                         const char *str, const char *tag,
                          const char *stopchars)
 {
     const char *p;
@@ -276,10 +1046,10 @@ static int usb_host_scan(void *opaque, USBScanFunc *func)
     int bus_num, addr, speed, device_count, class_id, product_id, vendor_id;
     int ret;
     char product_name[512];
-    
+
     f = fopen(USBDEVFS_PATH "/devices", "r");
     if (!f) {
-        term_printf("Could not open %s\n", USBDEVFS_PATH "/devices");
+        term_printf("husb: could not open %s\n", USBDEVFS_PATH "/devices");
         return 0;
     }
     device_count = 0;
@@ -293,7 +1063,7 @@ static int usb_host_scan(void *opaque, USBScanFunc *func)
         if (line[0] == 'T' && line[1] == ':') {
             if (device_count && (vendor_id || product_id)) {
                 /* New device.  Add the previously discovered device.  */
-                ret = func(opaque, bus_num, addr, class_id, vendor_id, 
+                ret = func(opaque, bus_num, addr, class_id, vendor_id,
                            product_id, product_name, speed);
                 if (ret)
                     goto the_end;
@@ -337,7 +1107,7 @@ static int usb_host_scan(void *opaque, USBScanFunc *func)
     }
     if (device_count && (vendor_id || product_id)) {
         /* Add the last device.  */
-        ret = func(opaque, bus_num, addr, class_id, vendor_id, 
+        ret = func(opaque, bus_num, addr, class_id, vendor_id,
                    product_id, product_name, speed);
     }
  the_end:
@@ -345,6 +1115,194 @@ static int usb_host_scan(void *opaque, USBScanFunc *func)
     return ret;
 }
 
+struct USBAutoFilter {
+    struct USBAutoFilter *next;
+    int bus_num;
+    int addr;
+    int vendor_id;
+    int product_id;
+};
+
+static QEMUTimer *usb_auto_timer;
+static struct USBAutoFilter *usb_auto_filter;
+
+static int usb_host_auto_scan(void *opaque, int bus_num, int addr,
+                     int class_id, int vendor_id, int product_id,
+                     const char *product_name, int speed)
+{
+    struct USBAutoFilter *f;
+    struct USBDevice *dev;
+
+    /* Ignore hubs */
+    if (class_id == 9)
+        return 0;
+
+    for (f = usb_auto_filter; f; f = f->next) {
+	if (f->bus_num >= 0 && f->bus_num != bus_num)
+            continue;
+
+	if (f->addr >= 0 && f->addr != addr)
+            continue;
+
+	if (f->vendor_id >= 0 && f->vendor_id != vendor_id)
+            continue;
+
+	if (f->product_id >= 0 && f->product_id != product_id)
+            continue;
+
+        /* We got a match */
+
+        /* Allredy attached ? */
+        if (hostdev_find(bus_num, addr))
+            return 0;
+
+        dprintf("husb: auto open: bus_num %d addr %d\n", bus_num, addr);
+
+	dev = usb_host_device_open_addr(bus_num, addr, product_name);
+	if (dev)
+	    usb_device_add_dev(dev);
+    }
+
+    return 0;
+}
+
+static void usb_host_auto_timer(void *unused)
+{
+    usb_host_scan(NULL, usb_host_auto_scan);
+    qemu_mod_timer(usb_auto_timer, qemu_get_clock(rt_clock) + 2000);
+}
+
+/*
+ * Autoconnect filter
+ * Format:
+ *    auto:bus:dev[:vid:pid]
+ *    auto:bus.dev[:vid:pid]
+ *
+ *    bus  - bus number    (dec, * means any)
+ *    dev  - device number (dec, * means any)
+ *    vid  - vendor id     (hex, * means any)
+ *    pid  - product id    (hex, * means any)
+ *
+ *    See 'lsusb' output.
+ */
+static int parse_filter(const char *spec, struct USBAutoFilter *f)
+{
+    enum { BUS, DEV, VID, PID, DONE };
+    const char *p = spec;
+    int i;
+
+    f->bus_num    = -1;
+    f->addr       = -1;
+    f->vendor_id  = -1;
+    f->product_id = -1;
+
+    for (i = BUS; i < DONE; i++) {
+    	p = strpbrk(p, ":.");
+    	if (!p) break;
+        p++;
+ 
+    	if (*p == '*')
+            continue;
+
+        switch(i) {
+        case BUS: f->bus_num = strtol(p, NULL, 10);    break;
+        case DEV: f->addr    = strtol(p, NULL, 10);    break;
+        case VID: f->vendor_id  = strtol(p, NULL, 16); break;
+        case PID: f->product_id = strtol(p, NULL, 16); break;
+        }
+    }
+
+    if (i < DEV) {
+        fprintf(stderr, "husb: invalid auto filter spec %s\n", spec);
+        return -1;
+    }
+
+    return 0;
+}
+
+static int match_filter(const struct USBAutoFilter *f1, 
+                        const struct USBAutoFilter *f2)
+{
+    return f1->bus_num    == f2->bus_num &&
+           f1->addr       == f2->addr &&
+           f1->vendor_id  == f2->vendor_id &&
+           f1->product_id == f2->product_id;
+}
+
+static int usb_host_auto_add(const char *spec)
+{
+    struct USBAutoFilter filter, *f;
+
+    if (parse_filter(spec, &filter) < 0)
+        return -1;
+
+    f = qemu_mallocz(sizeof(*f));
+    if (!f) {
+        fprintf(stderr, "husb: failed to allocate auto filter\n");
+        return -1;
+    }
+
+    *f = filter; 
+
+    if (!usb_auto_filter) {
+        /*
+         * First entry. Init and start the monitor.
+         * Right now we're using timer to check for new devices.
+         * If this turns out to be too expensive we can move that into a 
+         * separate thread.
+         */
+	usb_auto_timer = qemu_new_timer(rt_clock, usb_host_auto_timer, NULL);
+	if (!usb_auto_timer) {
+            fprintf(stderr, "husb: failed to allocate auto scan timer\n");
+            qemu_free(f);
+            return -1;
+        }
+
+        /* Check for new devices every two seconds */
+        qemu_mod_timer(usb_auto_timer, qemu_get_clock(rt_clock) + 2000);
+    }
+
+    dprintf("husb: added auto filter: bus_num %d addr %d vid %d pid %d\n",
+	f->bus_num, f->addr, f->vendor_id, f->product_id);
+
+    f->next = usb_auto_filter;
+    usb_auto_filter = f;
+
+    return 0;
+}
+
+static int usb_host_auto_del(const char *spec)
+{
+    struct USBAutoFilter *pf = usb_auto_filter;
+    struct USBAutoFilter **prev = &usb_auto_filter;
+    struct USBAutoFilter filter;
+
+    if (parse_filter(spec, &filter) < 0)
+        return -1;
+
+    while (pf) {
+        if (match_filter(pf, &filter)) {
+            dprintf("husb: removed auto filter: bus_num %d addr %d vid %d pid %d\n",
+	             pf->bus_num, pf->addr, pf->vendor_id, pf->product_id);
+
+            *prev = pf->next;
+
+	    if (!usb_auto_filter) {
+                /* No more filters. Stop scanning. */
+                qemu_del_timer(usb_auto_timer);
+                qemu_free_timer(usb_auto_timer);
+            }
+
+            return 0;
+        }
+
+        prev = &pf->next;
+        pf   = pf->next;
+    }
+
+    return -1;
+}
+
 typedef struct FindDeviceState {
     int vendor_id;
     int product_id;
@@ -353,9 +1311,9 @@ typedef struct FindDeviceState {
     char product_name[PRODUCT_NAME_SZ];
 } FindDeviceState;
 
-static int usb_host_find_device_scan(void *opaque, int bus_num, int addr, 
+static int usb_host_find_device_scan(void *opaque, int bus_num, int addr,
                                      int class_id,
-                                     int vendor_id, int product_id, 
+                                     int vendor_id, int product_id,
                                      const char *product_name, int speed)
 {
     FindDeviceState *s = opaque;
@@ -372,10 +1330,10 @@ static int usb_host_find_device_scan(void *opaque, int bus_num, int addr,
     }
 }
 
-/* the syntax is : 
-   'bus.addr' (decimal numbers) or 
+/* the syntax is :
+   'bus.addr' (decimal numbers) or
    'vendor_id:product_id' (hexa numbers) */
-static int usb_host_find_device(int *pbus_num, int *paddr, 
+static int usb_host_find_device(int *pbus_num, int *paddr,
                                 char *product_name, int product_name_size,
                                 const char *devname)
 {
@@ -394,6 +1352,7 @@ static int usb_host_find_device(int *pbus_num, int *paddr,
             pstrcpy(product_name, product_name_size, fs.product_name);
         return 0;
     }
+
     p = strchr(devname, ':');
     if (p) {
         fs.vendor_id = strtoul(devname, NULL, 16);
@@ -429,7 +1388,7 @@ static const struct usb_class_info usb_class_info[] = {
     { USB_CLASS_APP_SPEC, "Application Specific" },
     { USB_CLASS_VENDOR_SPEC, "Vendor Specific" },
     { USB_CLASS_STILL_IMAGE, "Still Image" },
-    { USB_CLASS_CSCID, 	"Smart Card" },
+    { USB_CLASS_CSCID, "Smart Card" },
     { USB_CLASS_CONTENT_SEC, "Content Security" },
     { -1, NULL }
 };
@@ -444,32 +1403,32 @@ static const char *usb_class_str(uint8_t class)
     return p->class_name;
 }
 
-void usb_info_device(int bus_num, int addr, int class_id,
-                     int vendor_id, int product_id, 
-                     const char *product_name,
-                     int speed)
+static void usb_info_device(int bus_num, int addr, int class_id,
+                            int vendor_id, int product_id,
+                            const char *product_name,
+                            int speed)
 {
     const char *class_str, *speed_str;
 
     switch(speed) {
-    case USB_SPEED_LOW: 
-        speed_str = "1.5"; 
+    case USB_SPEED_LOW:
+        speed_str = "1.5";
         break;
-    case USB_SPEED_FULL: 
-        speed_str = "12"; 
+    case USB_SPEED_FULL:
+        speed_str = "12";
         break;
-    case USB_SPEED_HIGH: 
-        speed_str = "480"; 
+    case USB_SPEED_HIGH:
+        speed_str = "480";
         break;
     default:
-        speed_str = "?"; 
+        speed_str = "?";
         break;
     }
 
-    term_printf("  Device %d.%d, speed %s Mb/s\n", 
+    term_printf("  Device %d.%d, speed %s Mb/s\n",
                 bus_num, addr, speed_str);
     class_str = usb_class_str(class_id);
-    if (class_str) 
+    if (class_str)
         term_printf("    %s:", class_str);
     else
         term_printf("    Class %02x:", class_id);
@@ -479,9 +1438,9 @@ void usb_info_device(int bus_num, int addr, int class_id,
     term_printf("\n");
 }
 
-static int usb_host_info_device(void *opaque, int bus_num, int addr, 
+static int usb_host_info_device(void *opaque, int bus_num, int addr,
                                 int class_id,
-                                int vendor_id, int product_id, 
+                                int vendor_id, int product_id,
                                 const char *product_name,
                                 int speed)
 {
@@ -490,13 +1449,44 @@ static int usb_host_info_device(void *opaque, int bus_num, int addr,
     return 0;
 }
 
+static void dec2str(int val, char *str)
+{
+    if (val == -1)
+        strcpy(str, "*");
+    else
+        sprintf(str, "%d", val); 
+}
+
+static void hex2str(int val, char *str)
+{
+    if (val == -1)
+        strcpy(str, "*");
+    else
+        sprintf(str, "%x", val);
+}
+
 void usb_host_info(void)
 {
+    struct USBAutoFilter *f;
+
     usb_host_scan(NULL, usb_host_info_device);
+
+    if (usb_auto_filter)
+        term_printf("  Auto filters:\n");
+    for (f = usb_auto_filter; f; f = f->next) {
+        char bus[10], addr[10], vid[10], pid[10];
+        dec2str(f->bus_num, bus);
+        dec2str(f->addr, addr);
+        hex2str(f->vendor_id, vid);
+        hex2str(f->product_id, pid);
+    	term_printf("    Device %s.%s ID %s:%s\n", bus, addr, vid, pid);
+    }
 }
 
 #else
 
+#include "hw/usb.h"
+
 void usb_host_info(void)
 {
     term_printf("USB host devices not supported\n");
@@ -508,4 +1498,9 @@ USBDevice *usb_host_device_open(const char *devname)
     return NULL;
 }
 
+int usb_host_device_close(const char *devname)
+{
+    return 0;
+}
+
 #endif
diff --git a/vgafont.h b/vgafont.h
index bb75796..3606dd7 100644
--- a/vgafont.h
+++ b/vgafont.h
@@ -1,4 +1,4 @@
-static uint8_t vgafont16[256 * 16] = {
+static const uint8_t vgafont16[256 * 16] = {
 
 	/* 0 0x00 '^@' */
 	0x00, /* 00000000 */
diff --git a/vl.c b/vl.c
index ee2362a..99c49bf 100644
--- a/vl.c
+++ b/vl.c
@@ -1,7 +1,7 @@
 /*
  * QEMU System Emulator
  *
- * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2003-2008 Fabrice Bellard
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -21,15 +21,38 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
 
-#include "android.h"
+/* the following is needed on Linux to define ptsname() in stdlib.h */
+#if defined(__linux__)
+#define _GNU_SOURCE 1
+#endif
+
+#include "qemu-common.h"
+#include "hw/hw.h"
+#include "hw/boards.h"
+#include "hw/usb.h"
+#include "hw/pcmcia.h"
+#include "hw/pc.h"
+#include "hw/audiodev.h"
+#include "hw/isa.h"
+#include "hw/baum.h"
+#include "net.h"
+#include "console.h"
+#include "sysemu.h"
+#include "gdbstub.h"
+#include "qemu-timer.h"
+#include "qemu-char.h"
+#include "block.h"
+#include "audio/audio.h"
+
+#include "qemu_file.h"
+#include "android/android.h"
 #include "charpipe.h"
 #include "shaper.h"
 #include "modem_driver.h"
-#include "android_gps.h"
-#include "android_qemud.h"
-#include "android_kmsg.h"
+#include "android/gps.h"
+#include "android/qemud.h"
+#include "android/hw-kmsg.h"
 #include "tcpdump.h"
 
 #include <unistd.h>
@@ -38,6 +61,7 @@
 #include <time.h>
 #include <errno.h>
 #include <sys/time.h>
+#include <zlib.h>
 
 #ifndef _WIN32
 #include <sys/times.h>
@@ -50,39 +74,73 @@
 #include <netinet/in.h>
 #include <dirent.h>
 #include <netdb.h>
+#include <sys/select.h>
+#include <arpa/inet.h>
 #ifdef _BSD
 #include <sys/stat.h>
-#ifndef __APPLE__
+#if !defined(__APPLE__) && !defined(__OpenBSD__)
 #include <libutil.h>
 #endif
+#ifdef __OpenBSD__
+#include <net/if.h>
+#endif
+#elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
+#include <freebsd/stdlib.h>
 #else
 #ifndef __sun__
 #include <linux/if.h>
 #include <linux/if_tun.h>
 #include <pty.h>
 #include <malloc.h>
+#include <linux/rtc.h>
+
+/* For the benefit of older linux systems which don't supply it,
+   we use a local copy of hpet.h. */
+/* #include <linux/hpet.h> */
+#include "hpet.h"
+
 #include <linux/ppdev.h>
+#include <linux/parport.h>
+#else
+#include <sys/stat.h>
+#include <sys/ethernet.h>
+#include <sys/sockio.h>
+#include <netinet/arp.h>
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/ip_icmp.h> // must come after ip.h
+#include <netinet/udp.h>
+#include <netinet/tcp.h>
+#include <net/if.h>
+#include <syslog.h>
+#include <stropts.h>
 #endif
 #endif
 #endif
 
+#include "qemu_socket.h"
+
 #if defined(CONFIG_SLIRP)
 #include "libslirp.h"
-const char *bootp_filename;
+#endif
+
+#if defined(__OpenBSD__)
+#include <util.h>
+#endif
+
+#if defined(CONFIG_VDE)
+#include <libvdeplug.h>
 #endif
 
 #ifdef _WIN32
 #include <malloc.h>
 #include <sys/timeb.h>
-#include <windows.h>
+#include <mmsystem.h>
 #define getopt_long_only getopt_long
 #define memalign(align, size) malloc(size)
 #endif
 
-#include "sockets.h"
-
-extern void  android_emulation_setup( void );
-extern void  android_emulation_teardown( void );
 
 #ifdef CONFIG_COCOA
 #undef main
@@ -108,19 +166,21 @@ extern void  android_emulation_teardown( void );
 #endif
 
 #define DEFAULT_NETWORK_SCRIPT "/etc/qemu-ifup"
+#define DEFAULT_NETWORK_DOWN_SCRIPT "/etc/qemu-ifdown"
+#ifdef __sun__
+#define SMBD_COMMAND "/usr/sfw/sbin/smbd"
+#else
+#define SMBD_COMMAND "/usr/sbin/smbd"
+#endif
 
 //#define DEBUG_UNUSED_IOPORT
 //#define DEBUG_IOPORT
 
-#define PHYS_RAM_MAX_SIZE (2047 * 1024 * 1024)
-
 #ifdef TARGET_PPC
 #define DEFAULT_RAM_SIZE 144
 #else
 #define DEFAULT_RAM_SIZE 128
 #endif
-/* in ms */
-#define GUI_REFRESH_INTERVAL (1000/60)
 
 /* Max number of USB devices that can be specified on the commandline.  */
 #define MAX_USB_CMDLINE 8
@@ -129,34 +189,43 @@ extern void  android_emulation_teardown( void );
 #define MAX_IOPORTS 65536
 
 const char *bios_dir = CONFIG_QEMU_SHAREDIR;
-char phys_ram_file[1024];
+const char *bios_name = NULL;
 void *ioport_opaque[MAX_IOPORTS];
 IOPortReadFunc *ioport_read_table[3][MAX_IOPORTS];
 IOPortWriteFunc *ioport_write_table[3][MAX_IOPORTS];
-BlockDriverState *bs_table[MAX_DISKS], *fd_table[MAX_FD];
+/* Note: drives_table[MAX_DRIVES] is a dummy block driver if none available
+   to store the VM snapshots */
+DriveInfo drives_table[MAX_DRIVES+1];
+int nb_drives;
+/* point to the block driver where the snapshots are managed */
+BlockDriverState *bs_snapshots;
 int vga_ram_size;
-int bios_size;
 static DisplayState display_state;
 int nographic;
+int curses;
 const char* keyboard_layout = NULL;
 int64_t ticks_per_sec;
-int boot_device = 'c';
-int ram_size;
+ram_addr_t ram_size;
 int pit_min_timer_count = 0;
 int nb_nics;
 NICInfo nd_table[MAX_NICS];
-QEMUTimer *gui_timer;
 int vm_running;
-int rtc_utc = 1;
+static int rtc_utc = 1;
+static int rtc_date_offset = -1; /* -1 means no change */
+int cirrus_vga_enabled = 1;
+int vmsvga_enabled = 0;
 #ifdef TARGET_SPARC
 int graphic_width = 1024;
 int graphic_height = 768;
+int graphic_depth = 8;
 #else
 int graphic_width = 800;
 int graphic_height = 600;
-#endif
 int graphic_depth = 15;
+#endif
 int full_screen = 0;
+int no_frame = 0;
+int no_quit = 0;
 CharDriverState *serial_hds[MAX_SERIAL_PORTS];
 CharDriverState *parallel_hds[MAX_PARALLEL_PORTS];
 #ifdef TARGET_I386
@@ -165,7 +234,7 @@ int win2k_install_hack = 0;
 int usb_enabled = 0;
 static VLANState *first_vlan;
 int smp_cpus = 1;
-int vnc_display = -1;
+const char *vnc_display;
 #if defined(TARGET_SPARC)
 #define MAX_CPUS 16
 #elif defined(TARGET_I386)
@@ -175,25 +244,46 @@ int vnc_display = -1;
 #endif
 int acpi_enabled = 1;
 int fd_bootchk = 1;
+int no_reboot = 0;
+int no_shutdown = 0;
+int cursor_hide = 1;
+int graphic_rotate = 0;
+int daemonize = 0;
+const char *option_rom[MAX_OPTION_ROMS];
+int nb_option_roms;
+int semihosting_enabled = 0;
+int autostart = 1;
+#ifdef TARGET_ARM
+int old_param = 0;
+#endif
+const char *qemu_name;
+int alt_grab = 0;
+#ifdef TARGET_SPARC
+unsigned int nb_prom_envs = 0;
+const char *prom_envs[MAX_PROM_ENVS];
+#endif
+int nb_drives_opt;
+struct drive_opt {
+    const char *file;
+    char opt[1024];
+} drives_opt[MAX_DRIVES];
 
 static CPUState *cur_cpu;
+static CPUState *next_cpu;
 static int event_pending = 1;
+/* Conversion factor from emulated instructions to virtual clock ticks.  */
+static int icount_time_shift;
+/* Arbitrarily pick 1MIPS as the minimum allowable speed.  */
+#define MAX_ICOUNT_SHIFT 10
+/* Compensate for varying guest execution speed.  */
+static int64_t qemu_icount_bias;
+QEMUTimer *icount_rt_timer;
+QEMUTimer *icount_vm_timer;
 
-#ifdef CONFIG_TRACE
-const char *trace_filename;
-int tracing;
-int trace_cache_miss;
-int trace_all_addr;
-
-int dcache_size = 16 * 1024;
-int dcache_ways = 4;
-int dcache_line_size = 32;
-int dcache_replace_policy = kPolicyRandom;
-int dcache_load_miss_penalty = 30;
-int dcache_store_miss_penalty = 5;
-#endif
 
 extern int   qemu_cpu_delay;
+extern int   android_audio_enabled;
+extern char* audio_input_source;
 
 extern void  dprint( const char* format, ... );
 
@@ -205,67 +295,82 @@ extern void  dprint( const char* format, ... );
 target_phys_addr_t isa_mem_base = 0;
 PicState2 *isa_pic;
 
-uint32_t default_ioport_readb(void *opaque, uint32_t address)
+static IOPortReadFunc default_ioport_readb, default_ioport_readw, default_ioport_readl;
+static IOPortWriteFunc default_ioport_writeb, default_ioport_writew, default_ioport_writel;
+
+static uint32_t ioport_read(int index, uint32_t address)
+{
+    static IOPortReadFunc *default_func[3] = {
+        default_ioport_readb,
+        default_ioport_readw,
+        default_ioport_readl
+    };
+    IOPortReadFunc *func = ioport_read_table[index][address];
+    if (!func)
+        func = default_func[index];
+    return func(ioport_opaque[address], address);
+}
+
+static void ioport_write(int index, uint32_t address, uint32_t data)
+{
+    static IOPortWriteFunc *default_func[3] = {
+        default_ioport_writeb,
+        default_ioport_writew,
+        default_ioport_writel
+    };
+    IOPortWriteFunc *func = ioport_write_table[index][address];
+    if (!func)
+        func = default_func[index];
+    func(ioport_opaque[address], address, data);
+}
+
+static uint32_t default_ioport_readb(void *opaque, uint32_t address)
 {
 #ifdef DEBUG_UNUSED_IOPORT
-    fprintf(stderr, "inb: port=0x%04x\n", address);
+    fprintf(stderr, "unused inb: port=0x%04x\n", address);
 #endif
     return 0xff;
 }
 
-void default_ioport_writeb(void *opaque, uint32_t address, uint32_t data)
+static void default_ioport_writeb(void *opaque, uint32_t address, uint32_t data)
 {
 #ifdef DEBUG_UNUSED_IOPORT
-    fprintf(stderr, "outb: port=0x%04x data=0x%02x\n", address, data);
+    fprintf(stderr, "unused outb: port=0x%04x data=0x%02x\n", address, data);
 #endif
 }
 
 /* default is to make two byte accesses */
-uint32_t default_ioport_readw(void *opaque, uint32_t address)
+static uint32_t default_ioport_readw(void *opaque, uint32_t address)
 {
     uint32_t data;
-    data = ioport_read_table[0][address](ioport_opaque[address], address);
+    data = ioport_read(0, address);
     address = (address + 1) & (MAX_IOPORTS - 1);
-    data |= ioport_read_table[0][address](ioport_opaque[address], address) << 8;
+    data |= ioport_read(0, address) << 8;
     return data;
 }
 
-void default_ioport_writew(void *opaque, uint32_t address, uint32_t data)
+static void default_ioport_writew(void *opaque, uint32_t address, uint32_t data)
 {
-    ioport_write_table[0][address](ioport_opaque[address], address, data & 0xff);
+    ioport_write(0, address, data & 0xff);
     address = (address + 1) & (MAX_IOPORTS - 1);
-    ioport_write_table[0][address](ioport_opaque[address], address, (data >> 8) & 0xff);
+    ioport_write(0, address, (data >> 8) & 0xff);
 }
 
-uint32_t default_ioport_readl(void *opaque, uint32_t address)
+static uint32_t default_ioport_readl(void *opaque, uint32_t address)
 {
 #ifdef DEBUG_UNUSED_IOPORT
-    fprintf(stderr, "inl: port=0x%04x\n", address);
+    fprintf(stderr, "unused inl: port=0x%04x\n", address);
 #endif
     return 0xffffffff;
 }
 
-void default_ioport_writel(void *opaque, uint32_t address, uint32_t data)
+static void default_ioport_writel(void *opaque, uint32_t address, uint32_t data)
 {
 #ifdef DEBUG_UNUSED_IOPORT
-    fprintf(stderr, "outl: port=0x%04x data=0x%02x\n", address, data);
+    fprintf(stderr, "unused outl: port=0x%04x data=0x%02x\n", address, data);
 #endif
 }
 
-void init_ioports(void)
-{
-    int i;
-
-    for(i = 0; i < MAX_IOPORTS; i++) {
-        ioport_read_table[0][i] = default_ioport_readb;
-        ioport_write_table[0][i] = default_ioport_writeb;
-        ioport_read_table[1][i] = default_ioport_readw;
-        ioport_write_table[1][i] = default_ioport_writew;
-        ioport_read_table[2][i] = default_ioport_readl;
-        ioport_write_table[2][i] = default_ioport_writel;
-    }
-}
-
 /* size is the word size in byte */
 int register_ioport_read(int start, int length, int size,
                          IOPortReadFunc *func, void *opaque)
@@ -310,7 +415,7 @@ int register_ioport_write(int start, int length, int size,
     for(i = start; i < start + length; i += size) {
         ioport_write_table[bsize][i] = func;
         if (ioport_opaque[i] != NULL && ioport_opaque[i] != opaque)
-            hw_error("register_ioport_read: invalid opaque");
+            hw_error("register_ioport_write: invalid opaque");
         ioport_opaque[i] = opaque;
     }
     return 0;
@@ -333,56 +438,13 @@ void isa_unassign_ioport(int start, int length)
 
 /***********************************************************/
 
-void pstrcpy(char *buf, int buf_size, const char *str)
-{
-    int c;
-    char *q = buf;
-
-    if (buf_size <= 0)
-        return;
-
-    for(;;) {
-        c = *str++;
-        if (c == 0 || q >= buf + buf_size - 1)
-            break;
-        *q++ = c;
-    }
-    *q = '\0';
-}
-
-/* strcat and truncate. */
-char *pstrcat(char *buf, int buf_size, const char *s)
-{
-    int len;
-    len = strlen(buf);
-    if (len < buf_size)
-        pstrcpy(buf + len, buf_size - len, s);
-    return buf;
-}
-
-int strstart(const char *str, const char *val, const char **ptr)
-{
-    const char *p, *q;
-    p = str;
-    q = val;
-    while (*q != '\0') {
-        if (*p != *q)
-            return 0;
-        p++;
-        q++;
-    }
-    if (ptr)
-        *ptr = p;
-    return 1;
-}
-
 void cpu_outb(CPUState *env, int addr, int val)
 {
 #ifdef DEBUG_IOPORT
     if (loglevel & CPU_LOG_IOPORT)
         fprintf(logfile, "outb: %04x %02x\n", addr, val);
 #endif
-    ioport_write_table[0][addr](ioport_opaque[addr], addr, val);
+    ioport_write(0, addr, val);
 #ifdef USE_KQEMU
     if (env)
         env->last_io_time = cpu_get_time_fast();
@@ -395,7 +457,7 @@ void cpu_outw(CPUState *env, int addr, int val)
     if (loglevel & CPU_LOG_IOPORT)
         fprintf(logfile, "outw: %04x %04x\n", addr, val);
 #endif
-    ioport_write_table[1][addr](ioport_opaque[addr], addr, val);
+    ioport_write(1, addr, val);
 #ifdef USE_KQEMU
     if (env)
         env->last_io_time = cpu_get_time_fast();
@@ -408,7 +470,7 @@ void cpu_outl(CPUState *env, int addr, int val)
     if (loglevel & CPU_LOG_IOPORT)
         fprintf(logfile, "outl: %04x %08x\n", addr, val);
 #endif
-    ioport_write_table[2][addr](ioport_opaque[addr], addr, val);
+    ioport_write(2, addr, val);
 #ifdef USE_KQEMU
     if (env)
         env->last_io_time = cpu_get_time_fast();
@@ -418,7 +480,7 @@ void cpu_outl(CPUState *env, int addr, int val)
 int cpu_inb(CPUState *env, int addr)
 {
     int val;
-    val = ioport_read_table[0][addr](ioport_opaque[addr], addr);
+    val = ioport_read(0, addr);
 #ifdef DEBUG_IOPORT
     if (loglevel & CPU_LOG_IOPORT)
         fprintf(logfile, "inb : %04x %02x\n", addr, val);
@@ -433,7 +495,7 @@ int cpu_inb(CPUState *env, int addr)
 int cpu_inw(CPUState *env, int addr)
 {
     int val;
-    val = ioport_read_table[1][addr](ioport_opaque[addr], addr);
+    val = ioport_read(1, addr);
 #ifdef DEBUG_IOPORT
     if (loglevel & CPU_LOG_IOPORT)
         fprintf(logfile, "inw : %04x %04x\n", addr, val);
@@ -448,7 +510,7 @@ int cpu_inw(CPUState *env, int addr)
 int cpu_inl(CPUState *env, int addr)
 {
     int val;
-    val = ioport_read_table[2][addr](ioport_opaque[addr], addr);
+    val = ioport_read(2, addr);
 #ifdef DEBUG_IOPORT
     if (loglevel & CPU_LOG_IOPORT)
         fprintf(logfile, "inl : %04x %08x\n", addr, val);
@@ -492,13 +554,11 @@ static QEMUPutKBDEventN*  qemu_put_kbd_event_n;
 static void*              qemu_put_kbd_event_n_opaque;
 
 
-static QEMUPutMouseEvent*  qemu_put_mouse_event;
-static void*               qemu_put_mouse_event_opaque;
-
 static QEMUPutGenericEvent*  qemu_put_generic_event;
 static void*                 qemu_put_generic_event_opaque;
 
-static int qemu_put_mouse_event_absolute;
+static QEMUPutMouseEntry *qemu_put_mouse_event_head;
+static QEMUPutMouseEntry *qemu_put_mouse_event_current;
 
 void qemu_add_kbd_event_handler(QEMUPutKBDEvent *func, void *opaque)
 {
@@ -512,12 +572,78 @@ void qemu_add_kbd_event_n_handler(QEMUPutKBDEventN *func, void *opaque)
     qemu_put_kbd_event_n = func;
 }
 
+#if 0
 void qemu_add_mouse_event_handler(QEMUPutMouseEvent *func, void *opaque, int absolute)
 {
     qemu_put_mouse_event_opaque = opaque;
     qemu_put_mouse_event = func;
     qemu_put_mouse_event_absolute = absolute;
 }
+#else
+QEMUPutMouseEntry *qemu_add_mouse_event_handler(QEMUPutMouseEvent *func,
+                                                void *opaque, int absolute,
+                                                const char *name)
+{
+    QEMUPutMouseEntry *s, *cursor;
+
+    s = qemu_mallocz(sizeof(QEMUPutMouseEntry));
+    if (!s)
+        return NULL;
+
+    s->qemu_put_mouse_event = func;
+    s->qemu_put_mouse_event_opaque = opaque;
+    s->qemu_put_mouse_event_absolute = absolute;
+    s->qemu_put_mouse_event_name = qemu_strdup(name);
+    s->next = NULL;
+
+    if (!qemu_put_mouse_event_head) {
+        qemu_put_mouse_event_head = qemu_put_mouse_event_current = s;
+        return s;
+    }
+
+    cursor = qemu_put_mouse_event_head;
+    while (cursor->next != NULL)
+        cursor = cursor->next;
+
+    cursor->next = s;
+    qemu_put_mouse_event_current = s;
+
+    return s;
+}
+
+void qemu_remove_mouse_event_handler(QEMUPutMouseEntry *entry)
+{
+    QEMUPutMouseEntry *prev = NULL, *cursor;
+
+    if (!qemu_put_mouse_event_head || entry == NULL)
+        return;
+
+    cursor = qemu_put_mouse_event_head;
+    while (cursor != NULL && cursor != entry) {
+        prev = cursor;
+        cursor = cursor->next;
+    }
+
+    if (cursor == NULL) // does not exist or list empty
+        return;
+    else if (prev == NULL) { // entry is head
+        qemu_put_mouse_event_head = cursor->next;
+        if (qemu_put_mouse_event_current == entry)
+            qemu_put_mouse_event_current = cursor->next;
+        qemu_free(entry->qemu_put_mouse_event_name);
+        qemu_free(entry);
+        return;
+    }
+
+    prev->next = entry->next;
+
+    if (qemu_put_mouse_event_current == entry)
+        qemu_put_mouse_event_current = prev;
+
+    qemu_free(entry->qemu_put_mouse_event_name);
+    qemu_free(entry);
+}
+#endif
 
 void qemu_add_generic_event_handler(QEMUPutGenericEvent *func, void*  opaque)
 {
@@ -548,24 +674,91 @@ void kbd_put_keycodes(int*  keycodes, int  count)
 }
 
 
+void  kbd_generic_event(int  type, int code, int  value)
+{
+    if (qemu_put_generic_event)
+        qemu_put_generic_event(qemu_put_generic_event_opaque, type, code, value);
+}
+
 
 void kbd_mouse_event(int dx, int dy, int dz, int buttons_state)
 {
-    if (qemu_put_mouse_event) {
-        qemu_put_mouse_event(qemu_put_mouse_event_opaque,
-                             dx, dy, dz, buttons_state);
+    QEMUPutMouseEvent *mouse_event;
+    void *mouse_event_opaque;
+    int width;
+
+    if (!qemu_put_mouse_event_current) {
+        return;
+    }
+
+    mouse_event =
+        qemu_put_mouse_event_current->qemu_put_mouse_event;
+    mouse_event_opaque =
+        qemu_put_mouse_event_current->qemu_put_mouse_event_opaque;
+
+    if (mouse_event) {
+        if (graphic_rotate) {
+            if (qemu_put_mouse_event_current->qemu_put_mouse_event_absolute)
+                width = 0x7fff;
+            else
+                width = graphic_width - 1;
+            mouse_event(mouse_event_opaque,
+                                 width - dy, dx, dz, buttons_state);
+        } else
+            mouse_event(mouse_event_opaque,
+                                 dx, dy, dz, buttons_state);
     }
 }
 
 int kbd_mouse_is_absolute(void)
 {
-    return qemu_put_mouse_event_absolute;
+    if (!qemu_put_mouse_event_current)
+        return 0;
+
+    return qemu_put_mouse_event_current->qemu_put_mouse_event_absolute;
 }
 
-void  kbd_generic_event(int  type, int code, int  value)
+void do_info_mice(void)
 {
-    if (qemu_put_generic_event)
-        qemu_put_generic_event(qemu_put_generic_event_opaque, type, code, value);
+    QEMUPutMouseEntry *cursor;
+    int index = 0;
+
+    if (!qemu_put_mouse_event_head) {
+        term_printf("No mouse devices connected\n");
+        return;
+    }
+
+    term_printf("Mouse devices available:\n");
+    cursor = qemu_put_mouse_event_head;
+    while (cursor != NULL) {
+        term_printf("%c Mouse #%d: %s\n",
+                    (cursor == qemu_put_mouse_event_current ? '*' : ' '),
+                    index, cursor->qemu_put_mouse_event_name);
+        index++;
+        cursor = cursor->next;
+    }
+}
+
+void do_mouse_set(int index)
+{
+    QEMUPutMouseEntry *cursor;
+    int i = 0;
+
+    if (!qemu_put_mouse_event_head) {
+        term_printf("No mouse devices connected\n");
+        return;
+    }
+
+    cursor = qemu_put_mouse_event_head;
+    while (cursor != NULL && index != i) {
+        i++;
+        cursor = cursor->next;
+    }
+
+    if (cursor != NULL)
+        qemu_put_mouse_event_current = cursor;
+    else
+        term_printf("Mouse at given index not found\n");
 }
 
 /* compute with 96 bit intermediate result: (a*b)/c */
@@ -592,41 +785,1050 @@ uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c)
     return res.ll;
 }
 
+/***********************************************************/
+/* real time host monotonic timer */
+
+#define QEMU_TIMER_BASE 1000000000LL
+
+#ifdef WIN32
+
+static int64_t clock_freq;
+
+static void init_get_clock(void)
+{
+    LARGE_INTEGER freq;
+    int ret;
+    ret = QueryPerformanceFrequency(&freq);
+    if (ret == 0) {
+        fprintf(stderr, "Could not calibrate ticks\n");
+        exit(1);
+    }
+    clock_freq = freq.QuadPart;
+}
+
+static int64_t get_clock(void)
+{
+    LARGE_INTEGER ti;
+    QueryPerformanceCounter(&ti);
+    return muldiv64(ti.QuadPart, QEMU_TIMER_BASE, clock_freq);
+}
 
-/* this function is called each time the alarm timer is signaled */
-static void
-cpu_signal_alarm( void )
+#else
+
+static int use_rt_clock;
+
+static void init_get_clock(void)
+{
+    use_rt_clock = 0;
+#if defined(__linux__)
+    {
+        struct timespec ts;
+        if (clock_gettime(CLOCK_MONOTONIC, &ts) == 0) {
+            use_rt_clock = 1;
+        }
+    }
+#endif
+}
+
+static int64_t get_clock(void)
 {
-    CPUState *env = cur_cpu;
+#if defined(__linux__)
+    if (use_rt_clock) {
+        struct timespec ts;
+        clock_gettime(CLOCK_MONOTONIC, &ts);
+        return ts.tv_sec * 1000000000LL + ts.tv_nsec;
+    } else
+#endif
+    {
+        /* XXX: using gettimeofday leads to problems if the date
+           changes, so it should be avoided. */
+        struct timeval tv;
+        gettimeofday(&tv, NULL);
+        return tv.tv_sec * 1000000000LL + (tv.tv_usec * 1000);
+    }
+}
+#endif
 
+/* Return the virtual CPU time, based on the instruction counter.  */
+static int64_t cpu_get_icount(void)
+{
+    int64_t icount;
+    CPUState *env = cpu_single_env;;
+    icount = qemu_icount;
     if (env) {
-        /* stop the currently executing cpu because a timer occured */
-        cpu_interrupt(env, CPU_INTERRUPT_EXIT);
+        if (!can_do_io(env))
+            fprintf(stderr, "Bad clock read\n");
+        icount -= (env->icount_decr.u16.low + env->icount_extra);
+    }
+    return qemu_icount_bias + (icount << icount_time_shift);
+}
+
+/***********************************************************/
+/* guest cycle counter */
+
+static int64_t cpu_ticks_prev;
+static int64_t cpu_ticks_offset;
+static int64_t cpu_clock_offset;
+static int cpu_ticks_enabled;
+
+/* return the host CPU cycle counter and handle stop/restart */
+int64_t cpu_get_ticks(void)
+{
+    if (use_icount) {
+        return cpu_get_icount();
+    }
+    if (!cpu_ticks_enabled) {
+        return cpu_ticks_offset;
+    } else {
+        int64_t ticks;
+        ticks = cpu_get_real_ticks();
+        if (cpu_ticks_prev > ticks) {
+            /* Note: non increasing ticks may happen if the host uses
+               software suspend */
+            cpu_ticks_offset += cpu_ticks_prev - ticks;
+        }
+        cpu_ticks_prev = ticks;
+        return ticks + cpu_ticks_offset;
+    }
+}
+
+/* return the host CPU monotonic timer and handle stop/restart */
+static int64_t cpu_get_clock(void)
+{
+    int64_t ti;
+    if (!cpu_ticks_enabled) {
+        return cpu_clock_offset;
+    } else {
+        ti = get_clock();
+        return ti + cpu_clock_offset;
+    }
+}
+
+/* enable cpu_get_ticks() */
+void cpu_enable_ticks(void)
+{
+    if (!cpu_ticks_enabled) {
+        cpu_ticks_offset -= cpu_get_real_ticks();
+        cpu_clock_offset -= get_clock();
+        cpu_ticks_enabled = 1;
+    }
+}
+
+/* disable cpu_get_ticks() : the clock is stopped. You must not call
+   cpu_get_ticks() after that.  */
+void cpu_disable_ticks(void)
+{
+    if (cpu_ticks_enabled) {
+        cpu_ticks_offset = cpu_get_ticks();
+        cpu_clock_offset = cpu_get_clock();
+        cpu_ticks_enabled = 0;
+    }
+}
+
+/***********************************************************/
+/* timers */
+
+#define QEMU_TIMER_REALTIME 0
+#define QEMU_TIMER_VIRTUAL  1
+
+struct QEMUClock {
+    int type;
+    /* XXX: add frequency */
+};
+
+struct QEMUTimer {
+    QEMUClock *clock;
+    int64_t expire_time;
+    QEMUTimerCB *cb;
+    void *opaque;
+    struct QEMUTimer *next;
+};
+
+struct qemu_alarm_timer {
+    char const *name;
+    unsigned int flags;
+
+    int (*start)(struct qemu_alarm_timer *t);
+    void (*stop)(struct qemu_alarm_timer *t);
+    void (*rearm)(struct qemu_alarm_timer *t);
+    void *priv;
+};
+
+#define ALARM_FLAG_DYNTICKS  0x1
+#define ALARM_FLAG_EXPIRED   0x2
+
+static inline int alarm_has_dynticks(struct qemu_alarm_timer *t)
+{
+    return t->flags & ALARM_FLAG_DYNTICKS;
+}
+
+static void qemu_rearm_alarm_timer(struct qemu_alarm_timer *t)
+{
+    if (!alarm_has_dynticks(t))
+        return;
+
+    t->rearm(t);
+}
+
+/* TODO: MIN_TIMER_REARM_US should be optimized */
+#define MIN_TIMER_REARM_US 250
+
+static struct qemu_alarm_timer *alarm_timer;
+
+#ifdef _WIN32
+
+struct qemu_alarm_win32 {
+    MMRESULT timerId;
+    HANDLE host_alarm;
+    unsigned int period;
+} alarm_win32_data = {0, NULL, -1};
+
+static int win32_start_timer(struct qemu_alarm_timer *t);
+static void win32_stop_timer(struct qemu_alarm_timer *t);
+static void win32_rearm_timer(struct qemu_alarm_timer *t);
+
+#else
+
+static int unix_start_timer(struct qemu_alarm_timer *t);
+static void unix_stop_timer(struct qemu_alarm_timer *t);
+
+#ifdef __linux__
+
+static int dynticks_start_timer(struct qemu_alarm_timer *t);
+static void dynticks_stop_timer(struct qemu_alarm_timer *t);
+static void dynticks_rearm_timer(struct qemu_alarm_timer *t);
+
+static int hpet_start_timer(struct qemu_alarm_timer *t);
+static void hpet_stop_timer(struct qemu_alarm_timer *t);
+
+static int rtc_start_timer(struct qemu_alarm_timer *t);
+static void rtc_stop_timer(struct qemu_alarm_timer *t);
+
+#endif /* __linux__ */
+
+#endif /* _WIN32 */
+
+/* Correlation between real and virtual time is always going to be
+   fairly approximate, so ignore small variation.
+   When the guest is idle real and virtual time will be aligned in
+   the IO wait loop.  */
+#define ICOUNT_WOBBLE (QEMU_TIMER_BASE / 10)
+
+static void icount_adjust(void)
+{
+    int64_t cur_time;
+    int64_t cur_icount;
+    int64_t delta;
+    static int64_t last_delta;
+    /* If the VM is not running, then do nothing.  */
+    if (!vm_running)
+        return;
+
+    cur_time = cpu_get_clock();
+    cur_icount = qemu_get_clock(vm_clock);
+    delta = cur_icount - cur_time;
+    /* FIXME: This is a very crude algorithm, somewhat prone to oscillation.  */
+    if (delta > 0
+        && last_delta + ICOUNT_WOBBLE < delta * 2
+        && icount_time_shift > 0) {
+        /* The guest is getting too far ahead.  Slow time down.  */
+        icount_time_shift--;
+    }
+    if (delta < 0
+        && last_delta - ICOUNT_WOBBLE > delta * 2
+        && icount_time_shift < MAX_ICOUNT_SHIFT) {
+        /* The guest is getting too far behind.  Speed time up.  */
+        icount_time_shift++;
+    }
+    last_delta = delta;
+    qemu_icount_bias = cur_icount - (qemu_icount << icount_time_shift);
+}
+
+static void icount_adjust_rt(void * opaque)
+{
+    qemu_mod_timer(icount_rt_timer,
+                   qemu_get_clock(rt_clock) + 1000);
+    icount_adjust();
+}
+
+static void icount_adjust_vm(void * opaque)
+{
+    qemu_mod_timer(icount_vm_timer,
+                   qemu_get_clock(vm_clock) + QEMU_TIMER_BASE / 10);
+    icount_adjust();
+}
+
+static void init_icount_adjust(void)
+{
+    /* Have both realtime and virtual time triggers for speed adjustment.
+       The realtime trigger catches emulated time passing too slowly,
+       the virtual time trigger catches emulated time passing too fast.
+       Realtime triggers occur even when idle, so use them less frequently
+       than VM triggers.  */
+    icount_rt_timer = qemu_new_timer(rt_clock, icount_adjust_rt, NULL);
+    qemu_mod_timer(icount_rt_timer,
+                   qemu_get_clock(rt_clock) + 1000);
+    icount_vm_timer = qemu_new_timer(vm_clock, icount_adjust_vm, NULL);
+    qemu_mod_timer(icount_vm_timer,
+                   qemu_get_clock(vm_clock) + QEMU_TIMER_BASE / 10);
+}
+
+static struct qemu_alarm_timer alarm_timers[] = {
+#ifndef _WIN32
+#ifdef __linux__
+    {"dynticks", ALARM_FLAG_DYNTICKS, dynticks_start_timer,
+     dynticks_stop_timer, dynticks_rearm_timer, NULL},
+    /* HPET - if available - is preferred */
+    {"hpet", 0, hpet_start_timer, hpet_stop_timer, NULL, NULL},
+    /* ...otherwise try RTC */
+    {"rtc", 0, rtc_start_timer, rtc_stop_timer, NULL, NULL},
+#endif
+    {"unix", 0, unix_start_timer, unix_stop_timer, NULL, NULL},
+#else
+    {"dynticks", ALARM_FLAG_DYNTICKS, win32_start_timer,
+     win32_stop_timer, win32_rearm_timer, &alarm_win32_data},
+    {"win32", 0, win32_start_timer,
+     win32_stop_timer, NULL, &alarm_win32_data},
+#endif
+    {NULL, 0, NULL, NULL, NULL, NULL}
+};
+
+static void show_available_alarms(void)
+{
+    int i;
+
+    printf("Available alarm timers, in order of precedence:\n");
+    for (i = 0; alarm_timers[i].name; i++)
+        printf("%s\n", alarm_timers[i].name);
+}
+
+static void configure_alarms(char const *opt)
+{
+    int i;
+    int cur = 0;
+    int count = (sizeof(alarm_timers) / sizeof(*alarm_timers)) - 1;
+    char *arg;
+    char *name;
+    struct qemu_alarm_timer tmp;
+
+    if (!strcmp(opt, "?")) {
+        show_available_alarms();
+        exit(0);
+    }
+
+    arg = strdup(opt);
+
+    /* Reorder the array */
+    name = strtok(arg, ",");
+    while (name) {
+        for (i = 0; i < count && alarm_timers[i].name; i++) {
+            if (!strcmp(alarm_timers[i].name, name))
+                break;
+        }
+
+        if (i == count) {
+            fprintf(stderr, "Unknown clock %s\n", name);
+            goto next;
+        }
+
+        if (i < cur)
+            /* Ignore */
+            goto next;
+
+	/* Swap */
+        tmp = alarm_timers[i];
+        alarm_timers[i] = alarm_timers[cur];
+        alarm_timers[cur] = tmp;
+
+        cur++;
+next:
+        name = strtok(NULL, ",");
+    }
+
+    free(arg);
+
+    if (cur) {
+        /* Disable remaining timers */
+        for (i = cur; i < count; i++)
+            alarm_timers[i].name = NULL;
+    } else {
+        show_available_alarms();
+        exit(1);
+    }
+}
+
+QEMUClock *rt_clock;
+QEMUClock *vm_clock;
+
+static QEMUTimer *active_timers[2];
+
+static QEMUClock *qemu_new_clock(int type)
+{
+    QEMUClock *clock;
+    clock = qemu_mallocz(sizeof(QEMUClock));
+    if (!clock)
+        return NULL;
+    clock->type = type;
+    return clock;
+}
+
+QEMUTimer *qemu_new_timer(QEMUClock *clock, QEMUTimerCB *cb, void *opaque)
+{
+    QEMUTimer *ts;
+
+    ts = qemu_mallocz(sizeof(QEMUTimer));
+    ts->clock = clock;
+    ts->cb = cb;
+    ts->opaque = opaque;
+    return ts;
+}
+
+void qemu_free_timer(QEMUTimer *ts)
+{
+    qemu_free(ts);
+}
+
+/* stop a timer, but do not dealloc it */
+void qemu_del_timer(QEMUTimer *ts)
+{
+    QEMUTimer **pt, *t;
+
+    /* NOTE: this code must be signal safe because
+       qemu_timer_expired() can be called from a signal. */
+    pt = &active_timers[ts->clock->type];
+    for(;;) {
+        t = *pt;
+        if (!t)
+            break;
+        if (t == ts) {
+            *pt = t->next;
+            break;
+        }
+        pt = &t->next;
+    }
+}
+
+/* modify the current timer so that it will be fired when current_time
+   >= expire_time. The corresponding callback will be called. */
+void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time)
+{
+    QEMUTimer **pt, *t;
+
+    qemu_del_timer(ts);
+
+    /* add the timer in the sorted list */
+    /* NOTE: this code must be signal safe because
+       qemu_timer_expired() can be called from a signal. */
+    pt = &active_timers[ts->clock->type];
+    for(;;) {
+        t = *pt;
+        if (!t)
+            break;
+        if (t->expire_time > expire_time)
+            break;
+        pt = &t->next;
+    }
+    ts->expire_time = expire_time;
+    ts->next = *pt;
+    *pt = ts;
+
+    /* Rearm if necessary  */
+    if (pt == &active_timers[ts->clock->type]) {
+        if ((alarm_timer->flags & ALARM_FLAG_EXPIRED) == 0) {
+            qemu_rearm_alarm_timer(alarm_timer);
+        }
+        /* Interrupt execution to force deadline recalculation.  */
+        if (use_icount && cpu_single_env) {
+            cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
+        }
+    }
+}
+
+int qemu_timer_pending(QEMUTimer *ts)
+{
+    QEMUTimer *t;
+    for(t = active_timers[ts->clock->type]; t != NULL; t = t->next) {
+        if (t == ts)
+            return 1;
+    }
+    return 0;
+}
+
+static inline int qemu_timer_expired(QEMUTimer *timer_head, int64_t current_time)
+{
+    if (!timer_head)
+        return 0;
+    return (timer_head->expire_time <= current_time);
+}
+
+static void qemu_run_timers(QEMUTimer **ptimer_head, int64_t current_time)
+{
+    QEMUTimer *ts;
+
+    for(;;) {
+        ts = *ptimer_head;
+        if (!ts || ts->expire_time > current_time)
+            break;
+        /* remove timer from the list before calling the callback */
+        *ptimer_head = ts->next;
+        ts->next = NULL;
+
+        /* run the callback (the timer list can be modified) */
+        ts->cb(ts->opaque);
+    }
+}
+
+int64_t qemu_get_clock(QEMUClock *clock)
+{
+    switch(clock->type) {
+    case QEMU_TIMER_REALTIME:
+        return get_clock() / 1000000;
+    default:
+    case QEMU_TIMER_VIRTUAL:
+        if (use_icount) {
+            return cpu_get_icount();
+        } else {
+            return cpu_get_clock();
+        }
+    }
+}
+
+static void init_timers(void)
+{
+    init_get_clock();
+    ticks_per_sec = QEMU_TIMER_BASE;
+    rt_clock = qemu_new_clock(QEMU_TIMER_REALTIME);
+    vm_clock = qemu_new_clock(QEMU_TIMER_VIRTUAL);
+}
+
+/* save a timer */
+void qemu_put_timer(QEMUFile *f, QEMUTimer *ts)
+{
+    uint64_t expire_time;
+
+    if (qemu_timer_pending(ts)) {
+        expire_time = ts->expire_time;
+    } else {
+        expire_time = -1;
+    }
+    qemu_put_be64(f, expire_time);
+}
+
+void qemu_get_timer(QEMUFile *f, QEMUTimer *ts)
+{
+    uint64_t expire_time;
+
+    expire_time = qemu_get_be64(f);
+    if (expire_time != -1) {
+        qemu_mod_timer(ts, expire_time);
+    } else {
+        qemu_del_timer(ts);
+    }
+}
+
+static void timer_save(QEMUFile *f, void *opaque)
+{
+    if (cpu_ticks_enabled) {
+        hw_error("cannot save state if virtual timers are running");
+    }
+    qemu_put_be64(f, cpu_ticks_offset);
+    qemu_put_be64(f, ticks_per_sec);
+    qemu_put_be64(f, cpu_clock_offset);
+}
+
+static int timer_load(QEMUFile *f, void *opaque, int version_id)
+{
+    if (version_id != 1 && version_id != 2)
+        return -EINVAL;
+    if (cpu_ticks_enabled) {
+        return -EINVAL;
+    }
+    cpu_ticks_offset=qemu_get_be64(f);
+    ticks_per_sec=qemu_get_be64(f);
+    if (version_id == 2) {
+        cpu_clock_offset=qemu_get_be64(f);
+    }
+    return 0;
+}
+
+#ifdef _WIN32
+void CALLBACK host_alarm_handler(UINT uTimerID, UINT uMsg,
+                                 DWORD_PTR dwUser, DWORD_PTR dw1, DWORD_PTR dw2)
+#else
+static void host_alarm_handler(int host_signum)
+#endif
+{
+#if 0
+#define DISP_FREQ 1000
+    {
+        static int64_t delta_min = INT64_MAX;
+        static int64_t delta_max, delta_cum, last_clock, delta, ti;
+        static int count;
+        ti = qemu_get_clock(vm_clock);
+        if (last_clock != 0) {
+            delta = ti - last_clock;
+            if (delta < delta_min)
+                delta_min = delta;
+            if (delta > delta_max)
+                delta_max = delta;
+            delta_cum += delta;
+            if (++count == DISP_FREQ) {
+                printf("timer: min=%" PRId64 " us max=%" PRId64 " us avg=%" PRId64 " us avg_freq=%0.3f Hz\n",
+                       muldiv64(delta_min, 1000000, ticks_per_sec),
+                       muldiv64(delta_max, 1000000, ticks_per_sec),
+                       muldiv64(delta_cum, 1000000 / DISP_FREQ, ticks_per_sec),
+                       (double)ticks_per_sec / ((double)delta_cum / DISP_FREQ));
+                count = 0;
+                delta_min = INT64_MAX;
+                delta_max = 0;
+                delta_cum = 0;
+            }
+        }
+        last_clock = ti;
+    }
+#endif
+    if (alarm_has_dynticks(alarm_timer) ||
+        (!use_icount &&
+            qemu_timer_expired(active_timers[QEMU_TIMER_VIRTUAL],
+                               qemu_get_clock(vm_clock))) ||
+        qemu_timer_expired(active_timers[QEMU_TIMER_REALTIME],
+                           qemu_get_clock(rt_clock))) {
+#ifdef _WIN32
+        struct qemu_alarm_win32 *data = ((struct qemu_alarm_timer*)dwUser)->priv;
+        SetEvent(data->host_alarm);
+#endif
+        CPUState *env = next_cpu;
+
+        alarm_timer->flags |= ALARM_FLAG_EXPIRED;
+
+        if (env) {
+            /* stop the currently executing cpu because a timer occured */
+            cpu_interrupt(env, CPU_INTERRUPT_EXIT);
 #ifdef USE_KQEMU
-        if (env->kqemu_enabled) {
-            kqemu_cpu_interrupt(env);
+            if (env->kqemu_enabled) {
+                kqemu_cpu_interrupt(env);
+            }
+#endif
         }
+        event_pending = 1;
+    }
+}
+
+static int64_t qemu_next_deadline(void)
+{
+    int64_t delta;
+
+    if (active_timers[QEMU_TIMER_VIRTUAL]) {
+        delta = active_timers[QEMU_TIMER_VIRTUAL]->expire_time -
+                     qemu_get_clock(vm_clock);
+    } else {
+        /* To avoid problems with overflow limit this to 2^32.  */
+        delta = INT32_MAX;
+    }
+
+    if (delta < 0)
+        delta = 0;
+
+    return delta;
+}
+
+#if defined(__linux__) || defined(_WIN32)
+static uint64_t qemu_next_deadline_dyntick(void)
+{
+    int64_t delta;
+    int64_t rtdelta;
+
+    if (use_icount)
+        delta = INT32_MAX;
+    else
+        delta = (qemu_next_deadline() + 999) / 1000;
+
+    if (active_timers[QEMU_TIMER_REALTIME]) {
+        rtdelta = (active_timers[QEMU_TIMER_REALTIME]->expire_time -
+                 qemu_get_clock(rt_clock))*1000;
+        if (rtdelta < delta)
+            delta = rtdelta;
+    }
+
+    if (delta < MIN_TIMER_REARM_US)
+        delta = MIN_TIMER_REARM_US;
+
+    return delta;
+}
 #endif
+
+#ifndef _WIN32
+
+#if defined(__linux__)
+
+#define RTC_FREQ 1024
+
+static void enable_sigio_timer(int fd)
+{
+    struct sigaction act;
+
+    /* timer signal */
+    sigfillset(&act.sa_mask);
+    act.sa_flags = 0;
+    act.sa_handler = host_alarm_handler;
+
+    sigaction(SIGIO, &act, NULL);
+    fcntl(fd, F_SETFL, O_ASYNC);
+    fcntl(fd, F_SETOWN, getpid());
+}
+
+static int hpet_start_timer(struct qemu_alarm_timer *t)
+{
+    struct hpet_info info;
+    int r, fd;
+
+    fd = open("/dev/hpet", O_RDONLY);
+    if (fd < 0)
+        return -1;
+
+    /* Set frequency */
+    r = ioctl(fd, HPET_IRQFREQ, RTC_FREQ);
+    if (r < 0) {
+        fprintf(stderr, "Could not configure '/dev/hpet' to have a 1024Hz timer. This is not a fatal\n"
+                "error, but for better emulation accuracy type:\n"
+                "'echo 1024 > /proc/sys/dev/hpet/max-user-freq' as root.\n");
+        goto fail;
+    }
+
+    /* Check capabilities */
+    r = ioctl(fd, HPET_INFO, &info);
+    if (r < 0)
+        goto fail;
+
+    /* Enable periodic mode */
+    r = ioctl(fd, HPET_EPI, 0);
+    if (info.hi_flags && (r < 0))
+        goto fail;
+
+    /* Enable interrupt */
+    r = ioctl(fd, HPET_IE_ON, 0);
+    if (r < 0)
+        goto fail;
+
+    enable_sigio_timer(fd);
+    t->priv = (void *)(long)fd;
+
+    return 0;
+fail:
+    close(fd);
+    return -1;
+}
+
+static void hpet_stop_timer(struct qemu_alarm_timer *t)
+{
+    int fd = (long)t->priv;
+
+    close(fd);
+}
+
+static int rtc_start_timer(struct qemu_alarm_timer *t)
+{
+    int rtc_fd;
+    unsigned long current_rtc_freq = 0;
+
+    TFR(rtc_fd = open("/dev/rtc", O_RDONLY));
+    if (rtc_fd < 0)
+        return -1;
+    ioctl(rtc_fd, RTC_IRQP_READ, &current_rtc_freq);
+    if (current_rtc_freq != RTC_FREQ &&
+        ioctl(rtc_fd, RTC_IRQP_SET, RTC_FREQ) < 0) {
+        fprintf(stderr, "Could not configure '/dev/rtc' to have a 1024 Hz timer. This is not a fatal\n"
+                "error, but for better emulation accuracy either use a 2.6 host Linux kernel or\n"
+                "type 'echo 1024 > /proc/sys/dev/rtc/max-user-freq' as root.\n");
+        goto fail;
+    }
+    if (ioctl(rtc_fd, RTC_PIE_ON, 0) < 0) {
+    fail:
+        close(rtc_fd);
+        return -1;
+    }
+
+    enable_sigio_timer(rtc_fd);
+
+    t->priv = (void *)(long)rtc_fd;
+
+    return 0;
+}
+
+static void rtc_stop_timer(struct qemu_alarm_timer *t)
+{
+    int rtc_fd = (long)t->priv;
+
+    close(rtc_fd);
+}
+
+static int dynticks_start_timer(struct qemu_alarm_timer *t)
+{
+    struct sigevent ev;
+    timer_t host_timer;
+    struct sigaction act;
+
+    sigfillset(&act.sa_mask);
+    act.sa_flags = 0;
+    act.sa_handler = host_alarm_handler;
+
+    sigaction(SIGALRM, &act, NULL);
+
+    ev.sigev_value.sival_int = 0;
+    ev.sigev_notify = SIGEV_SIGNAL;
+    ev.sigev_signo = SIGALRM;
+
+    if (timer_create(CLOCK_REALTIME, &ev, &host_timer)) {
+        perror("timer_create");
+
+        /* disable dynticks */
+        fprintf(stderr, "Dynamic Ticks disabled\n");
+
+        return -1;
+    }
+
+    t->priv = (void *)host_timer;
+
+    return 0;
+}
+
+static void dynticks_stop_timer(struct qemu_alarm_timer *t)
+{
+    timer_t host_timer = (timer_t)t->priv;
+
+    timer_delete(host_timer);
+}
+
+static void dynticks_rearm_timer(struct qemu_alarm_timer *t)
+{
+    timer_t host_timer = (timer_t)t->priv;
+    struct itimerspec timeout;
+    int64_t nearest_delta_us = INT64_MAX;
+    int64_t current_us;
+
+    if (!active_timers[QEMU_TIMER_REALTIME] &&
+                !active_timers[QEMU_TIMER_VIRTUAL])
+        return;
+
+    nearest_delta_us = qemu_next_deadline_dyntick();
+
+    /* check whether a timer is already running */
+    if (timer_gettime(host_timer, &timeout)) {
+        perror("gettime");
+        fprintf(stderr, "Internal timer error: aborting\n");
+        exit(1);
+    }
+    current_us = timeout.it_value.tv_sec * 1000000 + timeout.it_value.tv_nsec/1000;
+    if (current_us && current_us <= nearest_delta_us)
+        return;
+
+    timeout.it_interval.tv_sec = 0;
+    timeout.it_interval.tv_nsec = 0; /* 0 for one-shot timer */
+    timeout.it_value.tv_sec =  nearest_delta_us / 1000000;
+    timeout.it_value.tv_nsec = (nearest_delta_us % 1000000) * 1000;
+    if (timer_settime(host_timer, 0 /* RELATIVE */, &timeout, NULL)) {
+        perror("settime");
+        fprintf(stderr, "Internal timer error: aborting\n");
+        exit(1);
+    }
+}
+
+#endif /* defined(__linux__) */
+
+static int unix_start_timer(struct qemu_alarm_timer *t)
+{
+    struct sigaction act;
+    struct itimerval itv;
+    int err;
+
+    /* timer signal */
+    sigfillset(&act.sa_mask);
+    act.sa_flags = 0;
+    act.sa_handler = host_alarm_handler;
+
+    sigaction(SIGALRM, &act, NULL);
+
+    itv.it_interval.tv_sec = 0;
+    /* for i386 kernel 2.6 to get 1 ms */
+    itv.it_interval.tv_usec = 999;
+    itv.it_value.tv_sec = 0;
+    itv.it_value.tv_usec = 10 * 1000;
+
+    err = setitimer(ITIMER_REAL, &itv, NULL);
+    if (err)
+        return -1;
+
+    return 0;
+}
+
+static void unix_stop_timer(struct qemu_alarm_timer *t)
+{
+    struct itimerval itv;
+
+    memset(&itv, 0, sizeof(itv));
+    setitimer(ITIMER_REAL, &itv, NULL);
+}
+
+#endif /* !defined(_WIN32) */
+
+#ifdef _WIN32
+
+static int win32_start_timer(struct qemu_alarm_timer *t)
+{
+    TIMECAPS tc;
+    struct qemu_alarm_win32 *data = t->priv;
+    UINT flags;
+
+    data->host_alarm = CreateEvent(NULL, FALSE, FALSE, NULL);
+    if (!data->host_alarm) {
+        perror("Failed CreateEvent");
+        return -1;
+    }
+
+    memset(&tc, 0, sizeof(tc));
+    timeGetDevCaps(&tc, sizeof(tc));
+
+    if (data->period < tc.wPeriodMin)
+        data->period = tc.wPeriodMin;
+
+    timeBeginPeriod(data->period);
+
+    flags = TIME_CALLBACK_FUNCTION;
+    if (alarm_has_dynticks(t))
+        flags |= TIME_ONESHOT;
+    else
+        flags |= TIME_PERIODIC;
+
+    data->timerId = timeSetEvent(1,         // interval (ms)
+                        data->period,       // resolution
+                        host_alarm_handler, // function
+                        (DWORD)t,           // parameter
+                        flags);
+
+    if (!data->timerId) {
+        perror("Failed to initialize win32 alarm timer");
+
+        timeEndPeriod(data->period);
+        CloseHandle(data->host_alarm);
+        return -1;
+    }
+
+    qemu_add_wait_object(data->host_alarm, NULL, NULL);
+
+    return 0;
+}
+
+static void win32_stop_timer(struct qemu_alarm_timer *t)
+{
+    struct qemu_alarm_win32 *data = t->priv;
+
+    timeKillEvent(data->timerId);
+    timeEndPeriod(data->period);
+
+    CloseHandle(data->host_alarm);
+}
+
+static void win32_rearm_timer(struct qemu_alarm_timer *t)
+{
+    struct qemu_alarm_win32 *data = t->priv;
+    uint64_t nearest_delta_us;
+
+    if (!active_timers[QEMU_TIMER_REALTIME] &&
+                !active_timers[QEMU_TIMER_VIRTUAL])
+        return;
+
+    nearest_delta_us = qemu_next_deadline_dyntick();
+    nearest_delta_us /= 1000;
+
+    timeKillEvent(data->timerId);
+
+    data->timerId = timeSetEvent(1,
+                        data->period,
+                        host_alarm_handler,
+                        (DWORD)t,
+                        TIME_ONESHOT | TIME_PERIODIC);
+
+    if (!data->timerId) {
+        perror("Failed to re-arm win32 alarm timer");
+
+        timeEndPeriod(data->period);
+        CloseHandle(data->host_alarm);
+        exit(1);
     }
-    event_pending = 1;
 }
 
+#endif /* _WIN32 */
 
+static void init_timer_alarm(void)
+{
+    struct qemu_alarm_timer *t;
+    int i, err = -1;
+
+    for (i = 0; alarm_timers[i].name; i++) {
+        t = &alarm_timers[i];
+
+        err = t->start(t);
+        if (!err)
+            break;
+    }
+
+    if (err) {
+        fprintf(stderr, "Unable to find any suitable alarm timer.\n");
+        fprintf(stderr, "Terminating\n");
+        exit(1);
+    }
+
+    alarm_timer = t;
+}
 
+static void quit_timers(void)
+{
+    alarm_timer->stop(alarm_timer);
+    alarm_timer = NULL;
+}
+
+/***********************************************************/
+/* host time/date access */
+void qemu_get_timedate(struct tm *tm, int offset)
+{
+    time_t ti;
+    struct tm *ret;
+
+    time(&ti);
+    ti += offset;
+    if (rtc_date_offset == -1) {
+        if (rtc_utc)
+            ret = gmtime(&ti);
+        else
+            ret = localtime(&ti);
+    } else {
+        ti -= rtc_date_offset;
+        ret = gmtime(&ti);
+    }
+
+    memcpy(tm, ret, sizeof(struct tm));
+}
+
+int qemu_timedate_diff(struct tm *tm)
+{
+    time_t seconds;
+
+    if (rtc_date_offset == -1)
+        if (rtc_utc)
+            seconds = mktimegm(tm);
+        else
+            seconds = mktime(tm);
+    else
+        seconds = mktimegm(tm) + rtc_date_offset;
+
+    return seconds - time(NULL);
+}
 
-#define  get_clock()  qemu_get_elapsed_ns()
 
 #ifdef CONFIG_TRACE
 static int tbflush_requested;
 static int exit_requested;
 
-extern void  qemu_trace_enable();
-extern void  qemu_trace_enable_gencode();
-extern void  qemu_trace_enable_dyngen();
-extern void  qemu_trace_disable();
-extern void  qemu_trace_disable_gencode();
-extern void  qemu_trace_disable_dyngen();
-
 void start_tracing()
 {
   if (trace_filename == NULL)
@@ -637,7 +1839,6 @@ void start_tracing()
   }
   tracing = 1;
   tbflush_requested = 1;
-  qemu_polling_enable();
   if (cpu_single_env)
     cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
 }
@@ -653,7 +1854,6 @@ void stop_tracing()
   }
   tracing = 0;
   tbflush_requested = 1;
-  qemu_polling_disable();
   if (cpu_single_env)
     cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
 }
@@ -671,8 +1871,6 @@ void sigusr_handler(int sig)
 }
 #endif
 
-#endif /* CONFIG_TRACE */
-
 /* This is the handler to catch control-C so that we can exit cleanly.
  * This is needed when tracing to flush the buffers to disk.
  */
@@ -682,10 +1880,35 @@ void sigint_handler(int sig)
   if (cpu_single_env)
     cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
 }
+#endif /* CONFIG_TRACE */
+
 
 /***********************************************************/
 /* character device */
 
+static void qemu_chr_event(CharDriverState *s, int event)
+{
+    if (!s->chr_event)
+        return;
+    s->chr_event(s->handler_opaque, event);
+}
+
+static void qemu_chr_reset_bh(void *opaque)
+{
+    CharDriverState *s = opaque;
+    qemu_chr_event(s, CHR_EVENT_RESET);
+    qemu_bh_delete(s->bh);
+    s->bh = NULL;
+}
+
+void qemu_chr_reset(CharDriverState *s)
+{
+    if (s->bh == NULL) {
+	s->bh = qemu_bh_new(qemu_chr_reset_bh, s);
+	qemu_bh_schedule(s->bh);
+    }
+}
+
 int qemu_chr_write(CharDriverState *s, const uint8_t *buf, int len)
 {
     return s->chr_write(s, buf, len);
@@ -698,13 +1921,31 @@ int qemu_chr_ioctl(CharDriverState *s, int cmd, void *arg)
     return s->chr_ioctl(s, cmd, arg);
 }
 
+int qemu_chr_can_read(CharDriverState *s)
+{
+    if (!s->chr_can_read)
+        return 0;
+    return s->chr_can_read(s->handler_opaque);
+}
+
+void qemu_chr_read(CharDriverState *s, uint8_t *buf, int len)
+{
+    s->chr_read(s->handler_opaque, buf, len);
+}
+
+void qemu_chr_accept_input(CharDriverState *s)
+{
+    if (s->chr_accept_input)
+        s->chr_accept_input(s);
+}
+
 void qemu_chr_printf(CharDriverState *s, const char *fmt, ...)
 {
     char buf[4096];
     va_list ap;
     va_start(ap, fmt);
     vsnprintf(buf, sizeof(buf), fmt, ap);
-    qemu_chr_write(s, (const uint8_t*)buf, strlen(buf));
+    qemu_chr_write(s, (uint8_t *)buf, strlen(buf));
     va_end(ap);
 }
 
@@ -714,41 +1955,280 @@ void qemu_chr_send_event(CharDriverState *s, int event)
         s->chr_send_event(s, event);
 }
 
-void qemu_chr_add_read_handler(CharDriverState *s,
-                               IOCanRWHandler *fd_can_read,
-                               IOReadHandler *fd_read, void *opaque)
+void qemu_chr_add_handlers(CharDriverState *s,
+                           IOCanRWHandler *fd_can_read,
+                           IOReadHandler *fd_read,
+                           IOEventHandler *fd_event,
+                           void *opaque)
 {
-    s->chr_add_read_handler(s, fd_can_read, fd_read, opaque);
+    s->chr_can_read = fd_can_read;
+    s->chr_read = fd_read;
+    s->chr_event = fd_event;
+    s->handler_opaque = opaque;
+    if (s->chr_update_read_handler)
+        s->chr_update_read_handler(s);
 }
 
-void qemu_chr_add_event_handler(CharDriverState *s, IOEventHandler *chr_event)
+static int null_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
 {
-    s->chr_event = chr_event;
+    return len;
 }
 
-static int null_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static CharDriverState *qemu_chr_open_null(void)
 {
-    return len;
+    CharDriverState *chr;
+
+    chr = qemu_mallocz(sizeof(CharDriverState));
+    if (!chr)
+        return NULL;
+    chr->chr_write = null_chr_write;
+    return chr;
+}
+
+/* MUX driver for serial I/O splitting */
+static int term_timestamps;
+static int64_t term_timestamps_start;
+#define MAX_MUX 4
+#define MUX_BUFFER_SIZE 32	/* Must be a power of 2.  */
+#define MUX_BUFFER_MASK (MUX_BUFFER_SIZE - 1)
+typedef struct {
+    IOCanRWHandler *chr_can_read[MAX_MUX];
+    IOReadHandler *chr_read[MAX_MUX];
+    IOEventHandler *chr_event[MAX_MUX];
+    void *ext_opaque[MAX_MUX];
+    CharDriverState *drv;
+    unsigned char buffer[MUX_BUFFER_SIZE];
+    int prod;
+    int cons;
+    int mux_cnt;
+    int term_got_escape;
+    int max_size;
+} MuxDriver;
+
+
+static int mux_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+{
+    MuxDriver *d = chr->opaque;
+    int ret;
+    if (!term_timestamps) {
+        ret = d->drv->chr_write(d->drv, buf, len);
+    } else {
+        int i;
+
+        ret = 0;
+        for(i = 0; i < len; i++) {
+            ret += d->drv->chr_write(d->drv, buf+i, 1);
+            if (buf[i] == '\n') {
+                char buf1[64];
+                int64_t ti;
+                int secs;
+
+                ti = get_clock();
+                if (term_timestamps_start == -1)
+                    term_timestamps_start = ti;
+                ti -= term_timestamps_start;
+                secs = ti / 1000000000;
+                snprintf(buf1, sizeof(buf1),
+                         "[%02d:%02d:%02d.%03d] ",
+                         secs / 3600,
+                         (secs / 60) % 60,
+                         secs % 60,
+                         (int)((ti / 1000000) % 1000));
+                d->drv->chr_write(d->drv, (uint8_t *)buf1, strlen(buf1));
+            }
+        }
+    }
+    return ret;
+}
+
+static const char * const mux_help[] = {
+    "% h    print this help\n\r",
+    "% x    exit emulator\n\r",
+    "% s    save disk data back to file (if -snapshot)\n\r",
+    "% t    toggle console timestamps\n\r"
+    "% b    send break (magic sysrq)\n\r",
+    "% c    switch between console and monitor\n\r",
+    "% %  sends %\n\r",
+    NULL
+};
+
+static int term_escape_char = 0x01; /* ctrl-a is used for escape */
+static void mux_print_help(CharDriverState *chr)
+{
+    int i, j;
+    char ebuf[15] = "Escape-Char";
+    char cbuf[50] = "\n\r";
+
+    if (term_escape_char > 0 && term_escape_char < 26) {
+        snprintf(cbuf, sizeof(cbuf), "\n\r");
+        snprintf(ebuf, sizeof(ebuf), "C-%c", term_escape_char - 1 + 'a');
+    } else {
+        snprintf(cbuf, sizeof(cbuf),
+                 "\n\rEscape-Char set to Ascii: 0x%02x\n\r\n\r",
+                 term_escape_char);
+    }
+    chr->chr_write(chr, (uint8_t *)cbuf, strlen(cbuf));
+    for (i = 0; mux_help[i] != NULL; i++) {
+        for (j=0; mux_help[i][j] != '\0'; j++) {
+            if (mux_help[i][j] == '%')
+                chr->chr_write(chr, (uint8_t *)ebuf, strlen(ebuf));
+            else
+                chr->chr_write(chr, (uint8_t *)&mux_help[i][j], 1);
+        }
+    }
+}
+
+static int mux_proc_byte(CharDriverState *chr, MuxDriver *d, int ch)
+{
+    if (d->term_got_escape) {
+        d->term_got_escape = 0;
+        if (ch == term_escape_char)
+            goto send_char;
+        switch(ch) {
+        case '?':
+        case 'h':
+            mux_print_help(chr);
+            break;
+        case 'x':
+            {
+                 const char *term =  "QEMU: Terminated\n\r";
+                 chr->chr_write(chr,(uint8_t *)term,strlen(term));
+                 exit(0);
+                 break;
+            }
+        case 's':
+            {
+                int i;
+                for (i = 0; i < nb_drives; i++) {
+                        bdrv_commit(drives_table[i].bdrv);
+                }
+            }
+            break;
+        case 'b':
+            qemu_chr_event(chr, CHR_EVENT_BREAK);
+            break;
+        case 'c':
+            /* Switch to the next registered device */
+            chr->focus++;
+            if (chr->focus >= d->mux_cnt)
+                chr->focus = 0;
+            break;
+       case 't':
+           term_timestamps = !term_timestamps;
+           term_timestamps_start = -1;
+           break;
+        }
+    } else if (ch == term_escape_char) {
+        d->term_got_escape = 1;
+    } else {
+    send_char:
+        return 1;
+    }
+    return 0;
 }
 
-static void null_chr_add_read_handler(CharDriverState *chr,
-                                    IOCanRWHandler *fd_can_read,
-                                    IOReadHandler *fd_read, void *opaque)
+static void mux_chr_accept_input(CharDriverState *chr)
 {
+    int m = chr->focus;
+    MuxDriver *d = chr->opaque;
+
+    while (d->prod != d->cons &&
+           d->chr_can_read[m] &&
+           d->chr_can_read[m](d->ext_opaque[m])) {
+        d->chr_read[m](d->ext_opaque[m],
+                       &d->buffer[d->cons++ & MUX_BUFFER_MASK], 1);
+    }
+}
+
+static int mux_chr_can_read(void *opaque)
+{
+    CharDriverState *chr = opaque;
+    MuxDriver *d = chr->opaque;
+
+    if ((d->prod - d->cons) < MUX_BUFFER_SIZE)
+        return 1;
+    if (d->chr_can_read[chr->focus])
+        return d->chr_can_read[chr->focus](d->ext_opaque[chr->focus]);
+    return 0;
 }
 
-CharDriverState *qemu_chr_open_null(void)
+static void mux_chr_read(void *opaque, const uint8_t *buf, int size)
+{
+    CharDriverState *chr = opaque;
+    MuxDriver *d = chr->opaque;
+    int m = chr->focus;
+    int i;
+
+    mux_chr_accept_input (opaque);
+
+    for(i = 0; i < size; i++)
+        if (mux_proc_byte(chr, d, buf[i])) {
+            if (d->prod == d->cons &&
+                d->chr_can_read[m] &&
+                d->chr_can_read[m](d->ext_opaque[m]))
+                d->chr_read[m](d->ext_opaque[m], &buf[i], 1);
+            else
+                d->buffer[d->prod++ & MUX_BUFFER_MASK] = buf[i];
+        }
+}
+
+static void mux_chr_event(void *opaque, int event)
+{
+    CharDriverState *chr = opaque;
+    MuxDriver *d = chr->opaque;
+    int i;
+
+    /* Send the event to all registered listeners */
+    for (i = 0; i < d->mux_cnt; i++)
+        if (d->chr_event[i])
+            d->chr_event[i](d->ext_opaque[i], event);
+}
+
+static void mux_chr_update_read_handler(CharDriverState *chr)
+{
+    MuxDriver *d = chr->opaque;
+
+    if (d->mux_cnt >= MAX_MUX) {
+        fprintf(stderr, "Cannot add I/O handlers, MUX array is full\n");
+        return;
+    }
+    d->ext_opaque[d->mux_cnt] = chr->handler_opaque;
+    d->chr_can_read[d->mux_cnt] = chr->chr_can_read;
+    d->chr_read[d->mux_cnt] = chr->chr_read;
+    d->chr_event[d->mux_cnt] = chr->chr_event;
+    /* Fix up the real driver with mux routines */
+    if (d->mux_cnt == 0) {
+        qemu_chr_add_handlers(d->drv, mux_chr_can_read, mux_chr_read,
+                              mux_chr_event, chr);
+    }
+    chr->focus = d->mux_cnt;
+    d->mux_cnt++;
+}
+
+static CharDriverState *qemu_chr_open_mux(CharDriverState *drv)
 {
     CharDriverState *chr;
+    MuxDriver *d;
 
     chr = qemu_mallocz(sizeof(CharDriverState));
     if (!chr)
         return NULL;
-    chr->chr_write = null_chr_write;
-    chr->chr_add_read_handler = null_chr_add_read_handler;
+    d = qemu_mallocz(sizeof(MuxDriver));
+    if (!d) {
+        free(chr);
+        return NULL;
+    }
+
+    chr->opaque = d;
+    d->drv = drv;
+    chr->focus = -1;
+    chr->chr_write = mux_chr_write;
+    chr->chr_update_read_handler = mux_chr_update_read_handler;
+    chr->chr_accept_input = mux_chr_accept_input;
     return chr;
 }
 
+
 #ifdef _WIN32
 
 static int send_all(int fd, const uint8_t *buf, int len1)
@@ -798,23 +2278,17 @@ static inline int send_all(int fd, const uint8_t *buf, int len1)
 {
     return unix_write(fd, buf, len1);
 }
-
 #endif /* !_WIN32 */
 
 #ifndef _WIN32
 
 typedef struct {
     int fd_in, fd_out;
-    IOCanRWHandler *fd_can_read;
-    IOReadHandler *fd_read;
-    void *fd_opaque;
     int max_size;
 } FDCharDriver;
 
-#define STDIO_MAX_CLIENTS 2
-
-static int stdio_nb_clients;
-static CharDriverState *stdio_clients[STDIO_MAX_CLIENTS];
+#define STDIO_MAX_CLIENTS 1
+static int stdio_nb_clients = 0;
 
 static int fd_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
 {
@@ -827,7 +2301,7 @@ static int fd_chr_read_poll(void *opaque)
     CharDriverState *chr = opaque;
     FDCharDriver *s = chr->opaque;
 
-    s->max_size = s->fd_can_read(s->fd_opaque);
+    s->max_size = qemu_chr_can_read(chr);
     return s->max_size;
 }
 
@@ -844,21 +2318,21 @@ static void fd_chr_read(void *opaque)
     if (len == 0)
         return;
     size = read(s->fd_in, buf, len);
+    if (size == 0) {
+        /* FD has been closed. Remove it from the active list.  */
+        qemu_set_fd_handler2(s->fd_in, NULL, NULL, NULL, NULL);
+        return;
+    }
     if (size > 0) {
-        s->fd_read(s->fd_opaque, buf, size);
+        qemu_chr_read(chr, buf, size);
     }
 }
 
-static void fd_chr_add_read_handler(CharDriverState *chr,
-                                    IOCanRWHandler *fd_can_read,
-                                    IOReadHandler *fd_read, void *opaque)
+static void fd_chr_update_read_handler(CharDriverState *chr)
 {
     FDCharDriver *s = chr->opaque;
 
     if (s->fd_in >= 0) {
-        s->fd_can_read = fd_can_read;
-        s->fd_read = fd_read;
-        s->fd_opaque = opaque;
         if (nographic && s->fd_in == 0) {
         } else {
             qemu_set_fd_handler2(s->fd_in, fd_chr_read_poll,
@@ -867,8 +2341,22 @@ static void fd_chr_add_read_handler(CharDriverState *chr,
     }
 }
 
+static void fd_chr_close(struct CharDriverState *chr)
+{
+    FDCharDriver *s = chr->opaque;
+
+    if (s->fd_in >= 0) {
+        if (nographic && s->fd_in == 0) {
+        } else {
+            qemu_set_fd_handler2(s->fd_in, NULL, NULL, NULL, NULL);
+        }
+    }
+
+    qemu_free(s);
+}
+
 /* open a character device to a unix fd */
-CharDriverState *qemu_chr_open_fd(int fd_in, int fd_out)
+static CharDriverState *qemu_chr_open_fd(int fd_in, int fd_out)
 {
     CharDriverState *chr;
     FDCharDriver *s;
@@ -885,28 +2373,43 @@ CharDriverState *qemu_chr_open_fd(int fd_in, int fd_out)
     s->fd_out = fd_out;
     chr->opaque = s;
     chr->chr_write = fd_chr_write;
-    chr->chr_add_read_handler = fd_chr_add_read_handler;
+    chr->chr_update_read_handler = fd_chr_update_read_handler;
+    chr->chr_close = fd_chr_close;
+
+    qemu_chr_reset(chr);
+
     return chr;
 }
 
-CharDriverState *qemu_chr_open_file_out(const char *file_out)
+static CharDriverState *qemu_chr_open_file_out(const char *file_out)
 {
     int fd_out;
 
-    fd_out = open(file_out, O_WRONLY | O_TRUNC | O_CREAT | O_BINARY, 0666);
+    TFR(fd_out = open(file_out, O_WRONLY | O_TRUNC | O_CREAT | O_BINARY, 0666));
     if (fd_out < 0)
         return NULL;
     return qemu_chr_open_fd(-1, fd_out);
 }
 
-CharDriverState *qemu_chr_open_pipe(const char *filename)
+static CharDriverState *qemu_chr_open_pipe(const char *filename)
 {
-    int fd;
-
-    fd = open(filename, O_RDWR | O_BINARY);
-    if (fd < 0)
-        return NULL;
-    return qemu_chr_open_fd(fd, fd);
+    int fd_in, fd_out;
+    char filename_in[256], filename_out[256];
+
+    snprintf(filename_in, 256, "%s.in", filename);
+    snprintf(filename_out, 256, "%s.out", filename);
+    TFR(fd_in = open(filename_in, O_RDWR | O_BINARY));
+    TFR(fd_out = open(filename_out, O_RDWR | O_BINARY));
+    if (fd_in < 0 || fd_out < 0) {
+	if (fd_in >= 0)
+	    close(fd_in);
+	if (fd_out >= 0)
+	    close(fd_out);
+        TFR(fd_in = fd_out = open(filename, O_RDWR | O_BINARY));
+        if (fd_in < 0)
+            return NULL;
+    }
+    return qemu_chr_open_fd(fd_in, fd_out);
 }
 
 CharDriverState *qemu_chr_open_fdpair(const char *fd_pair)
@@ -934,167 +2437,52 @@ CharDriverState *qemu_chr_open_fdpair(const char *fd_pair)
 /* for STDIO, we handle the case where several clients use it
    (nographic mode) */
 
-#define TERM_ESCAPE 0x01 /* ctrl-a is used for escape */
-
 #define TERM_FIFO_MAX_SIZE 1
 
-static int term_got_escape, client_index;
 static uint8_t term_fifo[TERM_FIFO_MAX_SIZE];
 static int term_fifo_size;
-static int term_timestamps;
-static int64_t term_timestamps_start;
-
-void term_print_help(void)
-{
-    printf("\n"
-           "C-a h    print this help\n"
-           "C-a x    exit emulator\n"
-           "C-a s    save disk data back to file (if -snapshot)\n"
-           "C-a b    send break (magic sysrq)\n"
-           "C-a t    toggle console timestamps\n"
-           "C-a c    switch between console and monitor\n"
-           "C-a C-a  send C-a\n"
-           );
-}
-
-/* called when a char is received */
-static void stdio_received_byte(int ch)
-{
-    if (term_got_escape) {
-        term_got_escape = 0;
-        switch(ch) {
-        case 'h':
-            term_print_help();
-            break;
-        case 'x':
-            exit(0);
-            break;
-        case 's':
-            {
-                int i;
-                for (i = 0; i < MAX_DISKS; i++) {
-                    if (bs_table[i])
-                        bdrv_commit(bs_table[i]);
-                }
-            }
-            break;
-        case 'b':
-            if (client_index < stdio_nb_clients) {
-                CharDriverState *chr;
-                FDCharDriver *s;
-
-                chr = stdio_clients[client_index];
-                s = chr->opaque;
-                chr->chr_event(s->fd_opaque, CHR_EVENT_BREAK);
-            }
-            break;
-        case 'c':
-            client_index++;
-            if (client_index >= stdio_nb_clients)
-                client_index = 0;
-            if (client_index == 0) {
-                /* send a new line in the monitor to get the prompt */
-                ch = '\r';
-                goto send_char;
-            }
-            break;
-        case 't':
-            term_timestamps = !term_timestamps;
-            term_timestamps_start = -1;
-            break;
-        case TERM_ESCAPE:
-            goto send_char;
-        }
-    } else if (ch == TERM_ESCAPE) {
-        term_got_escape = 1;
-    } else {
-    send_char:
-        if (client_index < stdio_nb_clients) {
-            uint8_t buf[1];
-            CharDriverState *chr;
-            FDCharDriver *s;
-
-            chr = stdio_clients[client_index];
-            s = chr->opaque;
-            if (s->fd_can_read(s->fd_opaque) > 0) {
-                buf[0] = ch;
-                s->fd_read(s->fd_opaque, buf, 1);
-            } else if (term_fifo_size == 0) {
-                term_fifo[term_fifo_size++] = ch;
-            }
-        }
-    }
-}
 
 static int stdio_read_poll(void *opaque)
 {
-    CharDriverState *chr;
-    FDCharDriver *s;
+    CharDriverState *chr = opaque;
 
-    if (client_index < stdio_nb_clients) {
-        chr = stdio_clients[client_index];
-        s = chr->opaque;
-        /* try to flush the queue if needed */
-        if (term_fifo_size != 0 && s->fd_can_read(s->fd_opaque) > 0) {
-            s->fd_read(s->fd_opaque, term_fifo, 1);
-            term_fifo_size = 0;
-        }
-        /* see if we can absorb more chars */
-        if (term_fifo_size == 0)
-            return 1;
-        else
-            return 0;
-    } else {
-        return 1;
+    /* try to flush the queue if needed */
+    if (term_fifo_size != 0 && qemu_chr_can_read(chr) > 0) {
+        qemu_chr_read(chr, term_fifo, 1);
+        term_fifo_size = 0;
     }
+    /* see if we can absorb more chars */
+    if (term_fifo_size == 0)
+        return 1;
+    else
+        return 0;
 }
 
 static void stdio_read(void *opaque)
 {
     int size;
     uint8_t buf[1];
+    CharDriverState *chr = opaque;
 
     size = read(0, buf, 1);
-    if (size > 0)
-        stdio_received_byte(buf[0]);
-}
-
-static int stdio_write(CharDriverState *chr, const uint8_t *buf, int len)
-{
-    FDCharDriver *s = chr->opaque;
-    if (!term_timestamps) {
-        return unix_write(s->fd_out, buf, len);
-    } else {
-        int i;
-        char buf1[64];
-
-        for(i = 0; i < len; i++) {
-            unix_write(s->fd_out, buf + i, 1);
-            if (buf[i] == '\n') {
-                int64_t ti;
-                int secs;
-
-                ti = get_clock();
-                if (term_timestamps_start == -1)
-                    term_timestamps_start = ti;
-                ti -= term_timestamps_start;
-                secs = ti / 1000000000;
-                snprintf(buf1, sizeof(buf1),
-                         "[%02d:%02d:%02d.%03d] ",
-                         secs / 3600,
-                         (secs / 60) % 60,
-                         secs % 60,
-                         (int)((ti / 1000000) % 1000));
-                unix_write(s->fd_out, (const uint8_t*)buf1, strlen(buf1));
-            }
+    if (size == 0) {
+        /* stdin has been closed. Remove it from the active list.  */
+        qemu_set_fd_handler2(0, NULL, NULL, NULL, NULL);
+        return;
+    }
+    if (size > 0) {
+        if (qemu_chr_can_read(chr) > 0) {
+            qemu_chr_read(chr, buf, 1);
+        } else if (term_fifo_size == 0) {
+            term_fifo[term_fifo_size++] = buf[0];
         }
-        return len;
     }
 }
 
 /* init terminal so that we can grab keys */
 static struct termios oldtty;
 static int old_fd0_flags;
+static int term_atexit_done;
 
 static void term_exit(void)
 {
@@ -1124,59 +2512,259 @@ static void term_init(void)
 
     tcsetattr (0, TCSANOW, &tty);
 
-    atexit(term_exit);
+    if (!term_atexit_done++)
+        atexit(term_exit);
 
     fcntl(0, F_SETFL, O_NONBLOCK);
 }
 
-CharDriverState *qemu_chr_open_stdio(void)
+static void qemu_chr_close_stdio(struct CharDriverState *chr)
+{
+    term_exit();
+    stdio_nb_clients--;
+    qemu_set_fd_handler2(0, NULL, NULL, NULL, NULL);
+    fd_chr_close(chr);
+}
+
+static CharDriverState *qemu_chr_open_stdio(void)
 {
     CharDriverState *chr;
 
-    if (nographic) {
-        if (stdio_nb_clients >= STDIO_MAX_CLIENTS)
-            return NULL;
-        chr = qemu_chr_open_fd(0, 1);
-        chr->chr_write = stdio_write;
-        if (stdio_nb_clients == 0)
-            qemu_set_fd_handler2(0, stdio_read_poll, stdio_read, NULL, NULL);
-        client_index = stdio_nb_clients;
+    if (stdio_nb_clients >= STDIO_MAX_CLIENTS)
+        return NULL;
+    chr = qemu_chr_open_fd(0, 1);
+    chr->chr_close = qemu_chr_close_stdio;
+    qemu_set_fd_handler2(0, stdio_read_poll, stdio_read, NULL, chr);
+    stdio_nb_clients++;
+    term_init();
+
+    return chr;
+}
+
+#ifdef __sun__
+/* Once Solaris has openpty(), this is going to be removed. */
+int openpty(int *amaster, int *aslave, char *name,
+            struct termios *termp, struct winsize *winp)
+{
+        const char *slave;
+        int mfd = -1, sfd = -1;
+
+        *amaster = *aslave = -1;
+
+        mfd = open("/dev/ptmx", O_RDWR | O_NOCTTY);
+        if (mfd < 0)
+                goto err;
+
+        if (grantpt(mfd) == -1 || unlockpt(mfd) == -1)
+                goto err;
+
+        if ((slave = ptsname(mfd)) == NULL)
+                goto err;
+
+        if ((sfd = open(slave, O_RDONLY | O_NOCTTY)) == -1)
+                goto err;
+
+        if (ioctl(sfd, I_PUSH, "ptem") == -1 ||
+            (termp != NULL && tcgetattr(sfd, termp) < 0))
+                goto err;
+
+        if (amaster)
+                *amaster = mfd;
+        if (aslave)
+                *aslave = sfd;
+        if (winp)
+                ioctl(sfd, TIOCSWINSZ, winp);
+
+        return 0;
+
+err:
+        if (sfd != -1)
+                close(sfd);
+        close(mfd);
+        return -1;
+}
+
+void cfmakeraw (struct termios *termios_p)
+{
+        termios_p->c_iflag &=
+                ~(IGNBRK|BRKINT|PARMRK|ISTRIP|INLCR|IGNCR|ICRNL|IXON);
+        termios_p->c_oflag &= ~OPOST;
+        termios_p->c_lflag &= ~(ECHO|ECHONL|ICANON|ISIG|IEXTEN);
+        termios_p->c_cflag &= ~(CSIZE|PARENB);
+        termios_p->c_cflag |= CS8;
+
+        termios_p->c_cc[VMIN] = 0;
+        termios_p->c_cc[VTIME] = 0;
+}
+#endif  /* __sun__ */
+
+#if defined(__linux__) || defined(__sun__) || defined(__FreeBSD__) \
+    || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__APPLE__)
+
+typedef struct {
+    int fd;
+    int connected;
+    int polling;
+    int read_bytes;
+    QEMUTimer *timer;
+} PtyCharDriver;
+
+static void pty_chr_update_read_handler(CharDriverState *chr);
+static void pty_chr_state(CharDriverState *chr, int connected);
+
+static int pty_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+{
+    PtyCharDriver *s = chr->opaque;
+
+    if (!s->connected) {
+        /* guest sends data, check for (re-)connect */
+        pty_chr_update_read_handler(chr);
+        return 0;
+    }
+    return unix_write(s->fd, buf, len);
+}
+
+static int pty_chr_read_poll(void *opaque)
+{
+    CharDriverState *chr = opaque;
+    PtyCharDriver *s = chr->opaque;
+
+    s->read_bytes = qemu_chr_can_read(chr);
+    return s->read_bytes;
+}
+
+static void pty_chr_read(void *opaque)
+{
+    CharDriverState *chr = opaque;
+    PtyCharDriver *s = chr->opaque;
+    int size, len;
+    uint8_t buf[1024];
+
+    len = sizeof(buf);
+    if (len > s->read_bytes)
+        len = s->read_bytes;
+    if (len == 0)
+        return;
+    size = read(s->fd, buf, len);
+    if ((size == -1 && errno == EIO) ||
+        (size == 0)) {
+        pty_chr_state(chr, 0);
+        return;
+    }
+    if (size > 0) {
+        pty_chr_state(chr, 1);
+        qemu_chr_read(chr, buf, size);
+    }
+}
+
+static void pty_chr_update_read_handler(CharDriverState *chr)
+{
+    PtyCharDriver *s = chr->opaque;
+
+    qemu_set_fd_handler2(s->fd, pty_chr_read_poll,
+                         pty_chr_read, NULL, chr);
+    s->polling = 1;
+    /*
+     * Short timeout here: just need wait long enougth that qemu makes
+     * it through the poll loop once.  When reconnected we want a
+     * short timeout so we notice it almost instantly.  Otherwise
+     * read() gives us -EIO instantly, making pty_chr_state() reset the
+     * timeout to the normal (much longer) poll interval before the
+     * timer triggers.
+     */
+    qemu_mod_timer(s->timer, qemu_get_clock(rt_clock) + 10);
+}
+
+static void pty_chr_state(CharDriverState *chr, int connected)
+{
+    PtyCharDriver *s = chr->opaque;
+
+    if (!connected) {
+        qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
+        s->connected = 0;
+        s->polling = 0;
+        /* (re-)connect poll interval for idle guests: once per second.
+         * We check more frequently in case the guests sends data to
+         * the virtual device linked to our pty. */
+        qemu_mod_timer(s->timer, qemu_get_clock(rt_clock) + 1000);
     } else {
-        if (stdio_nb_clients != 0)
-            return NULL;
-        chr = qemu_chr_open_fd(0, 1);
+        if (!s->connected)
+            qemu_chr_reset(chr);
+        s->connected = 1;
     }
-    stdio_clients[stdio_nb_clients++] = chr;
-    if (stdio_nb_clients == 1) {
-        /* set the terminal in raw mode */
-        term_init();
+}
+
+static void pty_chr_timer(void *opaque)
+{
+    struct CharDriverState *chr = opaque;
+    PtyCharDriver *s = chr->opaque;
+
+    if (s->connected)
+        return;
+    if (s->polling) {
+        /* If we arrive here without polling being cleared due
+         * read returning -EIO, then we are (re-)connected */
+        pty_chr_state(chr, 1);
+        return;
     }
-    return chr;
+
+    /* Next poll ... */
+    pty_chr_update_read_handler(chr);
 }
 
-#if defined(__linux__)
-CharDriverState *qemu_chr_open_pty(void)
+static void pty_chr_close(struct CharDriverState *chr)
 {
+    PtyCharDriver *s = chr->opaque;
+
+    qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
+    close(s->fd);
+    qemu_free(s);
+}
+
+static CharDriverState *qemu_chr_open_pty(void)
+{
+    CharDriverState *chr;
+    PtyCharDriver *s;
     struct termios tty;
-    char slave_name[1024];
-    int master_fd, slave_fd;
+    int slave_fd;
+#if defined(__OpenBSD__)
+    char pty_name[PATH_MAX];
+#define q_ptsname(x) pty_name
+#else
+    char *pty_name = NULL;
+#define q_ptsname(x) ptsname(x)
+#endif
 
-    /* Not satisfying */
-    if (openpty(&master_fd, &slave_fd, slave_name, NULL, NULL) < 0) {
+    chr = qemu_mallocz(sizeof(CharDriverState));
+    if (!chr)
+        return NULL;
+    s = qemu_mallocz(sizeof(PtyCharDriver));
+    if (!s) {
+        qemu_free(chr);
         return NULL;
     }
 
-    /* Disabling local echo and line-buffered output */
-    tcgetattr (master_fd, &tty);
-    tty.c_lflag &= ~(ECHO|ICANON|ISIG);
-    tty.c_cc[VMIN] = 1;
-    tty.c_cc[VTIME] = 0;
-    tcsetattr (master_fd, TCSAFLUSH, &tty);
+    if (openpty(&s->fd, &slave_fd, pty_name, NULL, NULL) < 0) {
+        return NULL;
+    }
+
+    /* Set raw attributes on the pty. */
+    cfmakeraw(&tty);
+    tcsetattr(slave_fd, TCSAFLUSH, &tty);
+    close(slave_fd);
 
-    fprintf(stderr, "char device redirected to %s\n", slave_name);
-    return qemu_chr_open_fd(master_fd, master_fd);
+    fprintf(stderr, "char device redirected to %s\n", q_ptsname(s->fd));
+
+    chr->opaque = s;
+    chr->chr_write = pty_chr_write;
+    chr->chr_update_read_handler = pty_chr_update_read_handler;
+    chr->chr_close = pty_chr_close;
+
+    s->timer = qemu_new_timer(rt_clock, pty_chr_timer, chr);
+
+    return chr;
 }
-#endif
+#endif /* __linux__ || __sun__ || __xxxBSD__ */
 
 static void tty_serial_init(int fd, int speed,
                             int parity, int data_bits, int stop_bits)
@@ -1190,45 +2778,33 @@ static void tty_serial_init(int fd, int speed,
 #endif
     tcgetattr (fd, &tty);
 
-    switch(speed) {
-    case 50:
+#define MARGIN 1.1
+    if (speed <= 50 * MARGIN)
         spd = B50;
-        break;
-    case 75:
+    else if (speed <= 75 * MARGIN)
         spd = B75;
-        break;
-    case 300:
+    else if (speed <= 300 * MARGIN)
         spd = B300;
-        break;
-    case 600:
+    else if (speed <= 600 * MARGIN)
         spd = B600;
-        break;
-    case 1200:
+    else if (speed <= 1200 * MARGIN)
         spd = B1200;
-        break;
-    case 2400:
+    else if (speed <= 2400 * MARGIN)
         spd = B2400;
-        break;
-    case 4800:
+    else if (speed <= 4800 * MARGIN)
         spd = B4800;
-        break;
-    case 9600:
+    else if (speed <= 9600 * MARGIN)
         spd = B9600;
-        break;
-    case 19200:
+    else if (speed <= 19200 * MARGIN)
         spd = B19200;
-        break;
-    case 38400:
+    else if (speed <= 38400 * MARGIN)
         spd = B38400;
-        break;
-    case 57600:
+    else if (speed <= 57600 * MARGIN)
         spd = B57600;
-        break;
-    default:
-    case 115200:
+    else if (speed <= 115200 * MARGIN)
+        spd = B115200;
+    else
         spd = B115200;
-        break;
-    }
 
     cfsetispeed(&tty, spd);
     cfsetospeed(&tty, spd);
@@ -1237,7 +2813,7 @@ static void tty_serial_init(int fd, int speed,
                           |INLCR|IGNCR|ICRNL|IXON);
     tty.c_oflag |= OPOST;
     tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN|ISIG);
-    tty.c_cflag &= ~(CSIZE|PARENB|PARODD|CRTSCTS);
+    tty.c_cflag &= ~(CSIZE|PARENB|PARODD|CRTSCTS|CSTOPB);
     switch(data_bits) {
     default:
     case 8:
@@ -1264,6 +2840,8 @@ static void tty_serial_init(int fd, int speed,
         tty.c_cflag |= PARENB | PARODD;
         break;
     }
+    if (stop_bits == 2)
+        tty.c_cflag |= CSTOPB;
 
     tcsetattr (fd, TCSANOW, &tty);
 }
@@ -1287,33 +2865,81 @@ static int tty_serial_ioctl(CharDriverState *chr, int cmd, void *arg)
                 tcsendbreak(s->fd_in, 1);
         }
         break;
+    case CHR_IOCTL_SERIAL_GET_TIOCM:
+        {
+            int sarg = 0;
+            int *targ = (int *)arg;
+            ioctl(s->fd_in, TIOCMGET, &sarg);
+            *targ = 0;
+            if (sarg | TIOCM_CTS)
+                *targ |= CHR_TIOCM_CTS;
+            if (sarg | TIOCM_CAR)
+                *targ |= CHR_TIOCM_CAR;
+            if (sarg | TIOCM_DSR)
+                *targ |= CHR_TIOCM_DSR;
+            if (sarg | TIOCM_RI)
+                *targ |= CHR_TIOCM_RI;
+            if (sarg | TIOCM_DTR)
+                *targ |= CHR_TIOCM_DTR;
+            if (sarg | TIOCM_RTS)
+                *targ |= CHR_TIOCM_RTS;
+        }
+        break;
+    case CHR_IOCTL_SERIAL_SET_TIOCM:
+        {
+            int sarg = *(int *)arg;
+            int targ = 0;
+            if (sarg | CHR_TIOCM_DTR)
+                targ |= TIOCM_DTR;
+            if (sarg | CHR_TIOCM_RTS)
+                targ |= TIOCM_RTS;
+            ioctl(s->fd_in, TIOCMSET, &targ);
+        }
+        break;
     default:
         return -ENOTSUP;
     }
     return 0;
 }
 
-CharDriverState *qemu_chr_open_tty(const char *filename)
+static CharDriverState *qemu_chr_open_tty(const char *filename)
 {
     CharDriverState *chr;
     int fd;
 
-    fd = open(filename, O_RDWR | O_NONBLOCK | O_BINARY);
-    if (fd < 0)
-        return NULL;
-    fcntl(fd, F_SETFL, O_NONBLOCK);
+    TFR(fd = open(filename, O_RDWR | O_NONBLOCK));
     tty_serial_init(fd, 115200, 'N', 8, 1);
     chr = qemu_chr_open_fd(fd, fd);
-    if (!chr)
+    if (!chr) {
+        close(fd);
         return NULL;
+    }
     chr->chr_ioctl = tty_serial_ioctl;
+    qemu_chr_reset(chr);
     return chr;
 }
 
 #if defined(__linux__)
+typedef struct {
+    int fd;
+    int mode;
+} ParallelCharDriver;
+
+static int pp_hw_mode(ParallelCharDriver *s, uint16_t mode)
+{
+    if (s->mode != mode) {
+	int m = mode;
+        if (ioctl(s->fd, PPSETMODE, &m) < 0)
+            return 0;
+	s->mode = mode;
+    }
+    return 1;
+}
+
 static int pp_ioctl(CharDriverState *chr, int cmd, void *arg)
 {
-    int fd = (int)chr->opaque;
+    ParallelCharDriver *drv = chr->opaque;
+    int fd = drv->fd;
     uint8_t b;
 
     switch(cmd) {
@@ -1330,7 +2956,10 @@ static int pp_ioctl(CharDriverState *chr, int cmd, void *arg)
     case CHR_IOCTL_PP_READ_CONTROL:
         if (ioctl(fd, PPRCONTROL, &b) < 0)
             return -ENOTSUP;
-        *(uint8_t *)arg = b;
+	/* Linux gives only the lowest bits, and no way to know data
+	   direction! For better compatibility set the fixed upper
+	   bits. */
+        *(uint8_t *)arg = b | 0xc0;
         break;
     case CHR_IOCTL_PP_WRITE_CONTROL:
         b = *(uint8_t *)arg;
@@ -1342,18 +2971,70 @@ static int pp_ioctl(CharDriverState *chr, int cmd, void *arg)
             return -ENOTSUP;
         *(uint8_t *)arg = b;
         break;
+    case CHR_IOCTL_PP_DATA_DIR:
+        if (ioctl(fd, PPDATADIR, (int *)arg) < 0)
+            return -ENOTSUP;
+        break;
+    case CHR_IOCTL_PP_EPP_READ_ADDR:
+	if (pp_hw_mode(drv, IEEE1284_MODE_EPP|IEEE1284_ADDR)) {
+	    struct ParallelIOArg *parg = arg;
+	    int n = read(fd, parg->buffer, parg->count);
+	    if (n != parg->count) {
+		return -EIO;
+	    }
+	}
+        break;
+    case CHR_IOCTL_PP_EPP_READ:
+	if (pp_hw_mode(drv, IEEE1284_MODE_EPP)) {
+	    struct ParallelIOArg *parg = arg;
+	    int n = read(fd, parg->buffer, parg->count);
+	    if (n != parg->count) {
+		return -EIO;
+	    }
+	}
+        break;
+    case CHR_IOCTL_PP_EPP_WRITE_ADDR:
+	if (pp_hw_mode(drv, IEEE1284_MODE_EPP|IEEE1284_ADDR)) {
+	    struct ParallelIOArg *parg = arg;
+	    int n = write(fd, parg->buffer, parg->count);
+	    if (n != parg->count) {
+		return -EIO;
+	    }
+	}
+        break;
+    case CHR_IOCTL_PP_EPP_WRITE:
+	if (pp_hw_mode(drv, IEEE1284_MODE_EPP)) {
+	    struct ParallelIOArg *parg = arg;
+	    int n = write(fd, parg->buffer, parg->count);
+	    if (n != parg->count) {
+		return -EIO;
+	    }
+	}
+        break;
     default:
         return -ENOTSUP;
     }
     return 0;
 }
 
-CharDriverState *qemu_chr_open_pp(const char *filename)
+static void pp_close(CharDriverState *chr)
+{
+    ParallelCharDriver *drv = chr->opaque;
+    int fd = drv->fd;
+
+    pp_hw_mode(drv, IEEE1284_MODE_COMPAT);
+    ioctl(fd, PPRELEASE);
+    close(fd);
+    qemu_free(drv);
+}
+
+static CharDriverState *qemu_chr_open_pp(const char *filename)
 {
     CharDriverState *chr;
+    ParallelCharDriver *drv;
     int fd;
 
-    fd = open(filename, O_RDWR);
+    TFR(fd = open(filename, O_RDWR));
     if (fd < 0)
         return NULL;
 
@@ -1362,40 +3043,39 @@ CharDriverState *qemu_chr_open_pp(const char *filename)
         return NULL;
     }
 
+    drv = qemu_mallocz(sizeof(ParallelCharDriver));
+    if (!drv) {
+        close(fd);
+        return NULL;
+    }
+    drv->fd = fd;
+    drv->mode = IEEE1284_MODE_COMPAT;
+
     chr = qemu_mallocz(sizeof(CharDriverState));
     if (!chr) {
+	qemu_free(drv);
         close(fd);
         return NULL;
     }
-    chr->opaque = (void *)fd;
     chr->chr_write = null_chr_write;
-    chr->chr_add_read_handler = null_chr_add_read_handler;
     chr->chr_ioctl = pp_ioctl;
-    return chr;
-}
-#else
-CharDriverState *qemu_chr_open_pty(void)
-{
-    return NULL;
-}
-#endif
+    chr->chr_close = pp_close;
+    chr->opaque = drv;
 
-#endif /* !defined(_WIN32) */
+    qemu_chr_reset(chr);
 
-#ifdef _WIN32
+    return chr;
+}
+#endif /* __linux__ */
 
-typedef int  (*WinPollFunc)(void*  opaque);
+#else /* _WIN32 */
 
 typedef struct {
-    IOCanRWHandler *fd_can_read;
-    IOReadHandler *fd_read;
-    void *win_opaque;
     int max_size;
-    HANDLE hcom, rcom, hrecv, hsend;
+    HANDLE hcom, hrecv, hsend;
     OVERLAPPED orecv, osend;
     BOOL fpipe;
     DWORD len;
-    WinPollFunc  poll_func;
 } WinCharState;
 
 #define NSENDBUF 2048
@@ -1406,8 +3086,10 @@ typedef struct {
 static int win_chr_poll(void *opaque);
 static int win_chr_pipe_poll(void *opaque);
 
-static void win_chr_close2(WinCharState *s)
+static void win_chr_close(CharDriverState *chr)
 {
+    WinCharState *s = chr->opaque;
+
     if (s->hsend) {
         CloseHandle(s->hsend);
         s->hsend = NULL;
@@ -1416,26 +3098,19 @@ static void win_chr_close2(WinCharState *s)
         CloseHandle(s->hrecv);
         s->hrecv = NULL;
     }
-    if (s->rcom && s->rcom != s->hcom) {
-        CloseHandle(s->rcom);
-        s->rcom = NULL;
-    }
     if (s->hcom) {
         CloseHandle(s->hcom);
         s->hcom = NULL;
     }
-    if (s->poll_func)
-        qemu_del_polling_cb(s->poll_func, s);
+    if (s->fpipe)
+        qemu_del_polling_cb(win_chr_pipe_poll, chr);
+    else
+        qemu_del_polling_cb(win_chr_poll, chr);
 }
 
-static void win_chr_close(CharDriverState *chr)
+static int win_chr_init(CharDriverState *chr, const char *filename)
 {
     WinCharState *s = chr->opaque;
-    win_chr_close2(s);
-}
-
-static int win_chr_init(WinCharState *s, const char *filename)
-{
     COMMCONFIG comcfg;
     COMMTIMEOUTS cto = { 0, 0, 0, 0, 0};
     COMSTAT comstat;
@@ -1460,7 +3135,6 @@ static int win_chr_init(WinCharState *s, const char *filename)
         s->hcom = NULL;
         goto fail;
     }
-    s->rcom = s->hcom;
 
     if (!SetupComm(s->hcom, NRECVBUF, NSENDBUF)) {
         fprintf(stderr, "Failed SetupComm\n");
@@ -1493,12 +3167,11 @@ static int win_chr_init(WinCharState *s, const char *filename)
         fprintf(stderr, "Failed ClearCommError\n");
         goto fail;
     }
-    s->poll_func = win_chr_poll;
-    qemu_add_polling_cb(s->poll_func, s);
+    qemu_add_polling_cb(win_chr_poll, chr);
     return 0;
 
  fail:
-    win_chr_close2(s);
+    win_chr_close(chr);
     return -1;
 }
 
@@ -1536,71 +3209,66 @@ static int win_chr_write(CharDriverState *chr, const uint8_t *buf, int len1)
     return len1 - len;
 }
 
-static int win_chr_read_poll(WinCharState *s)
+static int win_chr_read_poll(CharDriverState *chr)
 {
-    s->max_size = s->fd_can_read(s->win_opaque);
+    WinCharState *s = chr->opaque;
+
+    s->max_size = qemu_chr_can_read(chr);
     return s->max_size;
 }
 
-static void win_chr_readfile(WinCharState *s)
+static void win_chr_readfile(CharDriverState *chr)
 {
+    WinCharState *s = chr->opaque;
     int ret, err;
     uint8_t buf[1024];
     DWORD size;
 
     ZeroMemory(&s->orecv, sizeof(s->orecv));
     s->orecv.hEvent = s->hrecv;
-    ret = ReadFile(s->rcom, buf, s->len, &size, &s->orecv);
+    ret = ReadFile(s->hcom, buf, s->len, &size, &s->orecv);
     if (!ret) {
         err = GetLastError();
         if (err == ERROR_IO_PENDING) {
-            ret = GetOverlappedResult(s->rcom, &s->orecv, &size, TRUE);
+            ret = GetOverlappedResult(s->hcom, &s->orecv, &size, TRUE);
         }
     }
 
     if (size > 0) {
-        s->fd_read(s->win_opaque, buf, size);
+        qemu_chr_read(chr, buf, size);
     }
 }
 
-static void win_chr_read(WinCharState *s)
+static void win_chr_read(CharDriverState *chr)
 {
+    WinCharState *s = chr->opaque;
+
     if (s->len > s->max_size)
         s->len = s->max_size;
     if (s->len == 0)
         return;
 
-    win_chr_readfile(s);
+    win_chr_readfile(chr);
 }
 
 static int win_chr_poll(void *opaque)
 {
-    WinCharState *s = opaque;
+    CharDriverState *chr = opaque;
+    WinCharState *s = chr->opaque;
     COMSTAT status;
     DWORD comerr;
 
-    ClearCommError(s->rcom, &comerr, &status);
+    ClearCommError(s->hcom, &comerr, &status);
     if (status.cbInQue > 0) {
         s->len = status.cbInQue;
-        win_chr_read_poll(s);
-        win_chr_read(s);
+        win_chr_read_poll(chr);
+        win_chr_read(chr);
         return 1;
     }
     return 0;
 }
 
-static void win_chr_add_read_handler(CharDriverState *chr,
-                                    IOCanRWHandler *fd_can_read,
-                                    IOReadHandler *fd_read, void *opaque)
-{
-    WinCharState *s = chr->opaque;
-
-    s->fd_can_read = fd_can_read;
-    s->fd_read = fd_read;
-    s->win_opaque = opaque;
-}
-
-CharDriverState *qemu_chr_open_win(const char *filename)
+static CharDriverState *qemu_chr_open_win(const char *filename)
 {
     CharDriverState *chr;
     WinCharState *s;
@@ -1615,34 +3283,36 @@ CharDriverState *qemu_chr_open_win(const char *filename)
     }
     chr->opaque = s;
     chr->chr_write = win_chr_write;
-    chr->chr_add_read_handler = win_chr_add_read_handler;
     chr->chr_close = win_chr_close;
 
-    if (win_chr_init(s, filename) < 0) {
+    if (win_chr_init(chr, filename) < 0) {
         free(s);
         free(chr);
         return NULL;
     }
+    qemu_chr_reset(chr);
     return chr;
 }
 
 static int win_chr_pipe_poll(void *opaque)
 {
-    WinCharState *s = opaque;
+    CharDriverState *chr = opaque;
+    WinCharState *s = chr->opaque;
     DWORD size;
 
     PeekNamedPipe(s->hcom, NULL, 0, NULL, &size, NULL);
     if (size > 0) {
         s->len = size;
-        win_chr_read_poll(s);
-        win_chr_read(s);
+        win_chr_read_poll(chr);
+        win_chr_read(chr);
         return 1;
     }
     return 0;
 }
 
-static int win_chr_pipe_init(WinCharState *s, const char *filename)
+static int win_chr_pipe_init(CharDriverState *chr, const char *filename)
 {
+    WinCharState *s = chr->opaque;
     OVERLAPPED ov;
     int ret;
     DWORD size;
@@ -1671,7 +3341,6 @@ static int win_chr_pipe_init(WinCharState *s, const char *filename)
         s->hcom = NULL;
         goto fail;
     }
-    s->rcom = s->hcom;
 
     ZeroMemory(&ov, sizeof(ov));
     ov.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
@@ -1695,17 +3364,16 @@ static int win_chr_pipe_init(WinCharState *s, const char *filename)
         CloseHandle(ov.hEvent);
         ov.hEvent = NULL;
     }
-    s->poll_func = win_chr_pipe_poll;
-    qemu_add_polling_cb(s->poll_func, s);
+    qemu_add_polling_cb(win_chr_pipe_poll, chr);
     return 0;
 
  fail:
-    win_chr_close2(s);
+    win_chr_close(chr);
     return -1;
 }
 
 
-CharDriverState *qemu_chr_open_win_pipe(const char *filename)
+static CharDriverState *qemu_chr_open_win_pipe(const char *filename)
 {
     CharDriverState *chr;
     WinCharState *s;
@@ -1720,18 +3388,18 @@ CharDriverState *qemu_chr_open_win_pipe(const char *filename)
     }
     chr->opaque = s;
     chr->chr_write = win_chr_write;
-    chr->chr_add_read_handler = win_chr_add_read_handler;
     chr->chr_close = win_chr_close;
 
-    if (win_chr_pipe_init(s, filename) < 0) {
+    if (win_chr_pipe_init(chr, filename) < 0) {
         free(s);
         free(chr);
         return NULL;
     }
+    qemu_chr_reset(chr);
     return chr;
 }
 
-CharDriverState *qemu_chr_open_win_file(HANDLE fd_out)
+static CharDriverState *qemu_chr_open_win_file(HANDLE fd_out)
 {
     CharDriverState *chr;
     WinCharState *s;
@@ -1745,67 +3413,18 @@ CharDriverState *qemu_chr_open_win_file(HANDLE fd_out)
         return NULL;
     }
     s->hcom = fd_out;
-    s->rcom = fd_out;
     chr->opaque = s;
     chr->chr_write = win_chr_write;
-    chr->chr_add_read_handler = win_chr_add_read_handler;
+    qemu_chr_reset(chr);
     return chr;
 }
 
-static int win_chr_stdio_poll(void *opaque)
+static CharDriverState *qemu_chr_open_win_con(const char *filename)
 {
-    WinCharState *s      = opaque;
-    int           result = 0;
-
-    for (;;) {
-        INPUT_RECORD  rec;
-        DWORD         count;
-
-        if ( !PeekConsoleInput(s->rcom, &rec, 1, &count) || count == 0 )
-            break;
-
-        ReadConsoleInput(s->rcom, &rec, 1, &count);
-
-        if (rec.EventType == KEY_EVENT)
-        {
-            if (rec.Event.KeyEvent.bKeyDown       &&
-                rec.Event.KeyEvent.uChar.AsciiChar)
-            {
-                char  c = rec.Event.KeyEvent.uChar.AsciiChar;
-                s->len = 1;
-                win_chr_read_poll(s);
-                s->fd_read( s->win_opaque, &c, 1);
-                result = 1;
-            }
-        }
-    }
-    return  result;
+    return qemu_chr_open_win_file(GetStdHandle(STD_OUTPUT_HANDLE));
 }
 
-CharDriverState *qemu_chr_open_win_stdio(void)
-{
-    CharDriverState *chr;
-    WinCharState *s;
-
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    if (!chr)
-        return NULL;
-    s = qemu_mallocz(sizeof(WinCharState));
-    if (!s) {
-        free(chr);
-        return NULL;
-    }
-    s->hcom = GetStdHandle( STD_OUTPUT_HANDLE );
-    s->rcom = GetStdHandle( STD_INPUT_HANDLE );
-    chr->opaque = s;
-    chr->chr_write = win_chr_write;
-    chr->chr_add_read_handler = win_chr_add_read_handler;
-    s->poll_func = win_chr_stdio_poll;
-    qemu_add_polling_cb(s->poll_func, s);
-    return chr;
-}
-
-CharDriverState *qemu_chr_open_win_file_out(const char *file_out)
+static CharDriverState *qemu_chr_open_win_file_out(const char *file_out)
 {
     HANDLE fd_out;
 
@@ -1816,18 +3435,15 @@ CharDriverState *qemu_chr_open_win_file_out(const char *file_out)
 
     return qemu_chr_open_win_file(fd_out);
 }
-#endif
+#endif /* !_WIN32 */
 
 /***********************************************************/
 /* UDP Net console */
 
 typedef struct {
-    IOCanRWHandler *fd_can_read;
-    IOReadHandler *fd_read;
-    void *fd_opaque;
     int fd;
     SockAddress daddr;
-    char buf[1024];
+    uint8_t buf[1024];
     int bufcnt;
     int bufptr;
     int max_size;
@@ -1845,15 +3461,15 @@ static int udp_chr_read_poll(void *opaque)
     CharDriverState *chr = opaque;
     NetCharDriver *s = chr->opaque;
 
-    s->max_size = s->fd_can_read(s->fd_opaque);
+    s->max_size = qemu_chr_can_read(chr);
 
     /* If there were any stray characters in the queue process them
      * first
      */
     while (s->max_size > 0 && s->bufptr < s->bufcnt) {
-        s->fd_read(s->fd_opaque, (uint8_t*)&s->buf[s->bufptr], 1);
+        qemu_chr_read(chr, &s->buf[s->bufptr], 1);
         s->bufptr++;
-        s->max_size = s->fd_can_read(s->fd_opaque);
+        s->max_size = qemu_chr_can_read(chr);
     }
     return s->max_size;
 }
@@ -1872,22 +3488,17 @@ static void udp_chr_read(void *opaque)
 
     s->bufptr = 0;
     while (s->max_size > 0 && s->bufptr < s->bufcnt) {
-        s->fd_read(s->fd_opaque, (uint8_t*)&s->buf[s->bufptr], 1);
+        qemu_chr_read(chr, &s->buf[s->bufptr], 1);
         s->bufptr++;
-        s->max_size = s->fd_can_read(s->fd_opaque);
+        s->max_size = qemu_chr_can_read(chr);
     }
 }
 
-static void udp_chr_add_read_handler(CharDriverState *chr,
-                                    IOCanRWHandler *fd_can_read,
-                                    IOReadHandler *fd_read, void *opaque)
+static void udp_chr_update_read_handler(CharDriverState *chr)
 {
     NetCharDriver *s = chr->opaque;
 
     if (s->fd >= 0) {
-        s->fd_can_read = fd_can_read;
-        s->fd_read = fd_read;
-        s->fd_opaque = opaque;
         qemu_set_fd_handler2(s->fd, udp_chr_read_poll,
                              udp_chr_read, NULL, chr);
     }
@@ -1897,8 +3508,11 @@ int parse_host_port(SockAddress *saddr, const char *str);
 int parse_host_src_port(SockAddress *haddr,
                         SockAddress *saddr,
                         const char *str);
+#ifndef _WIN32
+static int parse_unix_path(SockAddress  *uaddr, const char*  str);
+#endif
 
-CharDriverState *qemu_chr_open_udp(const char *def)
+static CharDriverState *qemu_chr_open_udp(const char *def)
 {
     CharDriverState *chr = NULL;
     NetCharDriver *s = NULL;
@@ -1934,7 +3548,7 @@ CharDriverState *qemu_chr_open_udp(const char *def)
     s->bufptr = 0;
     chr->opaque = s;
     chr->chr_write = udp_chr_write;
-    chr->chr_add_read_handler = udp_chr_add_read_handler;
+    chr->chr_update_read_handler = udp_chr_update_read_handler;
     return chr;
 
 return_err:
@@ -1943,7 +3557,7 @@ return_err:
     if (s)
         free(s);
     if (fd >= 0)
-        socket_close(fd);
+        closesocket(fd);
     return NULL;
 }
 
@@ -1951,13 +3565,12 @@ return_err:
 /* TCP Net console */
 
 typedef struct {
-    IOCanRWHandler *fd_can_read;
-    IOReadHandler *fd_read;
-    void *fd_opaque;
     int fd, listen_fd;
     int connected;
     int max_size;
     int do_telnetopt;
+    int do_nodelay;
+    int is_unix;
 } TCPCharDriver;
 
 static void tcp_chr_accept(void *opaque);
@@ -1979,7 +3592,7 @@ static int tcp_chr_read_poll(void *opaque)
     TCPCharDriver *s = chr->opaque;
     if (!s->connected)
         return 0;
-    s->max_size = s->fd_can_read(s->fd_opaque);
+    s->max_size = qemu_chr_can_read(chr);
     return s->max_size;
 }
 
@@ -1987,7 +3600,7 @@ static int tcp_chr_read_poll(void *opaque)
 #define IAC_BREAK 243
 static void tcp_chr_process_IAC_bytes(CharDriverState *chr,
                                       TCPCharDriver *s,
-                                      char *buf, int *size)
+                                      uint8_t *buf, int *size)
 {
     /* Handle any telnet client's basic IAC options to satisfy char by
      * char mode with no echo.  All IAC options will be removed from
@@ -2012,7 +3625,7 @@ static void tcp_chr_process_IAC_bytes(CharDriverState *chr,
             } else {
                 if ((unsigned char)buf[i] == IAC_BREAK && s->do_telnetopt == 2) {
                     /* Handle IAC break commands by sending a serial break */
-                    chr->chr_event(s->fd_opaque, CHR_EVENT_BREAK);
+                    qemu_chr_event(chr, CHR_EVENT_BREAK);
                     s->do_telnetopt++;
                 }
                 s->do_telnetopt++;
@@ -2057,23 +3670,12 @@ static void tcp_chr_read(void *opaque)
         s->fd = -1;
     } else if (size > 0) {
         if (s->do_telnetopt)
-            tcp_chr_process_IAC_bytes(chr, s, (char*)buf, &size);
+            tcp_chr_process_IAC_bytes(chr, s, buf, &size);
         if (size > 0)
-            s->fd_read(s->fd_opaque, buf, size);
+            qemu_chr_read(chr, buf, size);
     }
 }
 
-static void tcp_chr_add_read_handler(CharDriverState *chr,
-                                     IOCanRWHandler *fd_can_read,
-                                    IOReadHandler *fd_read, void *opaque)
-{
-    TCPCharDriver *s = chr->opaque;
-
-    s->fd_can_read = fd_can_read;
-    s->fd_read = fd_read;
-    s->fd_opaque = opaque;
-}
-
 static void tcp_chr_connect(void *opaque)
 {
     CharDriverState *chr = opaque;
@@ -2082,6 +3684,7 @@ static void tcp_chr_connect(void *opaque)
     s->connected = 1;
     qemu_set_fd_handler2(s->fd, tcp_chr_read_poll,
                          tcp_chr_read, NULL, chr);
+    qemu_chr_reset(chr);
 }
 
 #define IACSET(x,a,b,c) x[0] = a; x[1] = b; x[2] = c;
@@ -2107,7 +3710,7 @@ static void tcp_chr_accept(void *opaque)
 
     for(;;) {
         fd = socket_accept(s->listen_fd, NULL);
-        if (fd < 0 && errno != EINTR) {
+        if (fd < 0) {
             return;
         } else if (fd >= 0) {
             if (s->do_telnetopt)
@@ -2116,6 +3719,8 @@ static void tcp_chr_accept(void *opaque)
         }
     }
     socket_set_nonblock(fd);
+    if (s->do_nodelay)
+        socket_set_nodelay(fd);
     s->fd = fd;
     qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
     tcp_chr_connect(chr);
@@ -2125,25 +3730,35 @@ static void tcp_chr_close(CharDriverState *chr)
 {
     TCPCharDriver *s = chr->opaque;
     if (s->fd >= 0)
-        socket_close(s->fd);
+        closesocket(s->fd);
     if (s->listen_fd >= 0)
-        socket_close(s->listen_fd);
+        closesocket(s->listen_fd);
     qemu_free(s);
 }
 
 static CharDriverState *qemu_chr_open_tcp(const char *host_str,
-                                          int is_telnet)
+                                          int is_telnet,
+					  int is_unix)
 {
     CharDriverState *chr = NULL;
     TCPCharDriver *s = NULL;
     int fd = -1, ret, err;
     int is_listen = 0;
     int is_waitconnect = 1;
+    int do_nodelay = 0;
     const char *ptr;
     SockAddress saddr;
 
-    if (parse_host_port(&saddr, host_str) < 0)
-        goto fail;
+#ifndef _WIN32
+    if (is_unix) {
+	if (parse_unix_path(&saddr, host_str) < 0)
+	    goto fail;
+    } else
+#endif
+    {
+	if (parse_host_port(&saddr, host_str) < 0)
+	    goto fail;
+    }
 
     ptr = host_str;
     while((ptr = strchr(ptr,','))) {
@@ -2152,6 +3767,8 @@ static CharDriverState *qemu_chr_open_tcp(const char *host_str,
             is_listen = 1;
         } else if (!strncmp(ptr,"nowait",6)) {
             is_waitconnect = 0;
+        } else if (!strncmp(ptr,"nodelay",6)) {
+            do_nodelay = 1;
         } else {
             printf("Unknown option: %s\n", ptr);
             goto fail;
@@ -2167,7 +3784,13 @@ static CharDriverState *qemu_chr_open_tcp(const char *host_str,
     if (!s)
         goto fail;
 
-    fd = socket_create_inet( SOCKET_STREAM );
+#ifndef _WIN32
+    if (is_unix)
+        fd = socket_create( SOCKET_UNIX, SOCKET_STREAM );
+    else
+#endif
+        fd = socket_create_inet( SOCKET_STREAM );
+
     if (fd < 0)
         goto fail;
 
@@ -2177,8 +3800,20 @@ static CharDriverState *qemu_chr_open_tcp(const char *host_str,
     s->connected = 0;
     s->fd = -1;
     s->listen_fd = -1;
+    s->is_unix = is_unix;
+    s->do_nodelay = do_nodelay && !is_unix;
+
+    chr->opaque = s;
+    chr->chr_write = tcp_chr_write;
+    chr->chr_close = tcp_chr_close;
+
     if (is_listen) {
         /* allow fast reuse */
+#ifndef _WIN32
+    if (is_unix) {
+        unlink( sock_address_get_path(&saddr) );
+    } else
+#endif
         socket_set_xreuseaddr(fd);
 
         if (socket_bind(fd, &saddr) < 0 ||
@@ -2197,6 +3832,10 @@ static CharDriverState *qemu_chr_open_tcp(const char *host_str,
                 if (err == EINTR || err == EWOULDBLOCK) {
                 } else if (err == EINPROGRESS) {
                     break;
+#ifdef _WIN32
+                } else if (err == EALREADY) {
+                    break;
+#endif
                 } else {
                     goto fail;
                 }
@@ -2206,16 +3845,13 @@ static CharDriverState *qemu_chr_open_tcp(const char *host_str,
             }
         }
         s->fd = fd;
+        socket_set_nodelay(fd);
         if (s->connected)
             tcp_chr_connect(chr);
         else
             qemu_set_fd_handler(s->fd, NULL, tcp_chr_connect, chr);
     }
 
-    chr->opaque = s;
-    chr->chr_write = tcp_chr_write;
-    chr->chr_add_read_handler = tcp_chr_add_read_handler;
-    chr->chr_close = tcp_chr_close;
     if (is_listen && is_waitconnect) {
         printf("QEMU waiting for connection on: %s\n", host_str);
         tcp_chr_accept(chr);
@@ -2236,21 +3872,35 @@ CharDriverState *qemu_chr_open(const char *filename)
     const char *p;
 
     if (!strcmp(filename, "vc")) {
-        return text_console_init(&display_state);
+        return text_console_init(&display_state, 0);
+    } else if (strstart(filename, "vc:", &p)) {
+        return text_console_init(&display_state, p);
     } else if (!strcmp(filename, "null")) {
         return qemu_chr_open_null();
     } else
     if (strstart(filename, "tcp:", &p)) {
-        return qemu_chr_open_tcp(p, 0);
+        return qemu_chr_open_tcp(p, 0, 0);
     } else
     if (strstart(filename, "telnet:", &p)) {
-        return qemu_chr_open_tcp(p, 1);
+        return qemu_chr_open_tcp(p, 1, 0);
     } else
     if (strstart(filename, "udp:", &p)) {
         return qemu_chr_open_udp(p);
     } else
+    if (strstart(filename, "mon:", &p)) {
+        CharDriverState *drv = qemu_chr_open(p);
+        if (drv) {
+            drv = qemu_chr_open_mux(drv);
+            monitor_init(drv, !nographic);
+            return drv;
+        }
+        printf("Unable to open driver: %s\n", p);
+        return 0;
+    } else
 #ifndef _WIN32
-    if (strstart(filename, "file:", &p)) {
+    if (strstart(filename, "unix:", &p)) {
+	return qemu_chr_open_tcp(p, 0, 1);
+    } else if (strstart(filename, "file:", &p)) {
         return qemu_chr_open_file_out(p);
     } else if (strstart(filename, "pipe:", &p)) {
         return qemu_chr_open_pipe(p);
@@ -2285,6 +3935,17 @@ CharDriverState *qemu_chr_open(const char *filename)
     } else if (!strcmp(filename, "android-qemud")) {
         return android_qemud_get_cs();
     } else
+#if defined(__linux__)
+    if (strstart(filename, "/dev/parport", NULL)) {
+        return qemu_chr_open_pp(filename);
+    } else
+#endif
+#if defined(__linux__) || defined(__sun__) || defined(__FreeBSD__) \
+    || defined(__NetBSD__) || defined(__OpenBSD__)
+    if (strstart(filename, "/dev/", NULL)) {
+        return qemu_chr_open_tty(filename);
+    } else
+#endif
 #ifdef _WIN32
     if (strstart(filename, "COM", NULL)) {
         return qemu_chr_open_win(filename);
@@ -2292,12 +3953,17 @@ CharDriverState *qemu_chr_open(const char *filename)
     if (strstart(filename, "pipe:", &p)) {
         return qemu_chr_open_win_pipe(p);
     } else
+    if (strstart(filename, "con:", NULL)) {
+        return qemu_chr_open_win_con(filename);
+    } else
     if (strstart(filename, "file:", &p)) {
         return qemu_chr_open_win_file_out(p);
     } else
-    if (!strcmp(filename, "stdio")) {
-        return qemu_chr_open_win_stdio();
-    }
+#endif
+#ifdef CONFIG_BRLAPI
+    if (!strcmp(filename, "braille")) {
+        return chr_baum_init();
+    } else
 #endif
     {
         return NULL;
@@ -2308,12 +3974,14 @@ void qemu_chr_close(CharDriverState *chr)
 {
     if (chr->chr_close)
         chr->chr_close(chr);
+    qemu_free(chr);
 }
 
 /***********************************************************/
 /* network device redirectors */
 
-void hex_dump(FILE *f, const uint8_t *buf, int size)
+__attribute__ (( unused ))
+static void hex_dump(FILE *f, const uint8_t *buf, int size)
 {
     int len, i, j, c;
 
@@ -2342,18 +4010,33 @@ void hex_dump(FILE *f, const uint8_t *buf, int size)
 static int parse_macaddr(uint8_t *macaddr, const char *p)
 {
     int i;
-    for(i = 0; i < 6; i++) {
-        macaddr[i] = strtol(p, (char **)&p, 16);
-        if (i == 5) {
-            if (*p != '\0')
-                return -1;
-        } else {
-            if (*p != ':')
-                return -1;
-            p++;
+    char *last_char;
+    long int offset;
+
+    errno = 0;
+    offset = strtol(p, &last_char, 0);    
+    if (0 == errno && '\0' == *last_char &&
+            offset >= 0 && offset <= 0xFFFFFF) {
+        macaddr[3] = (offset & 0xFF0000) >> 16;
+        macaddr[4] = (offset & 0xFF00) >> 8;
+        macaddr[5] = offset & 0xFF;
+        return 0;
+    } else {
+        for(i = 0; i < 6; i++) {
+            macaddr[i] = strtol(p, (char **)&p, 16);
+            if (i == 5) {
+                if (*p != '\0')
+                    return -1;
+            } else {
+                if (*p != ':' && *p != '-')
+                    return -1;
+                p++;
+            }
         }
+        return 0;    
     }
-    return 0;
+
+    return -1;
 }
 
 static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
@@ -2383,6 +4066,7 @@ int parse_host_src_port(SockAddress *haddr,
     char *str = strdup(input_str);
     char *host_str = str;
     char *src_str;
+    const char *src_str2;
     char *ptr;
 
     /*
@@ -2401,10 +4085,11 @@ int parse_host_src_port(SockAddress *haddr,
     if (parse_host_port(haddr, host_str) < 0)
         goto fail;
 
+    src_str2 = src_str;
     if (!src_str || *src_str == '\0')
-        src_str = ":0";
+        src_str2 = ":0";
 
-    if (parse_host_port(saddr, src_str) < 0)
+    if (parse_host_port(saddr, src_str2) < 0)
         goto fail;
 
     free(str);
@@ -2438,6 +4123,27 @@ int parse_host_port(SockAddress  *saddr, const char *str)
     return 0;
 }
 
+#ifndef _WIN32
+static int
+parse_unix_path(SockAddress*  uaddr, const char *str)
+{
+    char  temp[109];
+    const char *p;
+    int len;
+
+    len = MIN(108, strlen(str));
+    p = strchr(str, ',');
+    if (p)
+        len = MIN(len, p - str);
+
+    memcpy(temp, str, len);
+    temp[len] = 0;
+
+    sock_address_init_unix( uaddr, temp );
+    return 0;
+}
+#endif
+
 /* find or alloc a new VLAN */
 VLANState *qemu_find_vlan(int id)
 {
@@ -2472,16 +4178,6 @@ VLANClientState *qemu_new_vlan_client(VLANState *vlan,
     vc->opaque = opaque;
     vc->vlan = vlan;
 
-    vc->tx_packets = 0;
-    vc->rx_packets = 0;
-    vc->tx_bytes   = 0;
-    vc->rx_bytes   = 0;
-    vc->tx_max_byte_rate = 0;
-    vc->rx_max_byte_rate = 0;
-    vc->tx_max_packet_rate = 0;
-    vc->rx_max_packet_rate = 0;
-    vc->clock_last = vc->clock_start = clock();
-
     vc->next = NULL;
     pvc = &vlan->first_client;
     while (*pvc != NULL)
@@ -2490,198 +4186,19 @@ VLANClientState *qemu_new_vlan_client(VLANState *vlan,
     return vc;
 }
 
-
-//static void tap_receive(void *opaque, const uint8_t *buf, int size);
-static void net_socket_receive_dgram(void *opaque, const uint8_t *buf, int size);
-static void net_socket_receive(void *opaque, const uint8_t *buf, int size);
-static void slirp_receive(void *opaque, const uint8_t *buf, int size);
-
-#if 0
-static char*
-vlan_client_get_name( VLANClientState  *vc,
-                      char*             tmp_name )
-{
-    char*  name = NULL;
-
-    extern IOReadHandler  ne2000_receive;
-    extern IOReadHandler  pcnet_receive;
-    extern IOReadHandler  lance_receive;
-    extern IOReadHandler  rtl8139_receive;
-    extern IOReadHandler  smc91c111_receive;
-
-    /* hackish, but should work */
-    if (vc->fd_read == tap_receive)
-        name = "tap";
-    else if (vc->fd_read == net_socket_receive_dgram)
-        name = "socket-dgram";
-    else if (vc->fd_read == net_socket_receive)
-        name = "socket";
-    else if (vc->fd_read == slirp_receive) {
-        name = "slirp";
-        name = "upload";
-    }
-    else
-    {
-        sprintf( tmp_name, "<%p>", vc );
-        name = tmp_name;
-        name = "download";
-    }
-    return name;
-}
-#endif
-
-static uint64_t           vc_clock_start;
-static uint64_t           vc_clock_last;
-static VLANClientState*   vc_upload;
-static VLANClientState*   vc_download;
-
-static void
-vlan_dump_stats( void )
-{
-    long     upload_bytes     = 0;
-    long     upload_packets   = 0;
-    long     download_bytes   = 0;
-    long     download_packets = 0;
-    int      sec, msec, usec;
-    double   nowf;
-
-    uint64_t  now  = get_clock();
-    int64_t   diff;
-
-    if (vc_clock_start == 0) {
-        vc_clock_start = now;
-        vc_clock_last  = now;
-    }
-
-    diff  = now - vc_clock_last;
-
-    if (vc_upload != NULL) {
-        upload_bytes   = vc_upload->rx_bytes;
-        upload_packets = vc_upload->rx_packets;
-
-        vc_upload->rx_bytes   = 0;
-        vc_upload->rx_packets = 0;
-    }
-    if (vc_download != NULL) {
-        download_bytes   = vc_download->rx_bytes;
-        download_packets = vc_download->rx_packets;
-
-        vc_download->rx_bytes   = 0;
-        vc_download->rx_packets = 0;
-    }
-
-    nowf  = (now - vc_clock_start)*(1.0/QEMU_TIMER_BASE);
-    sec   = (int)nowf;
-    nowf  = (nowf - sec)*1000;
-    msec  = (int)nowf;
-    nowf  = (nowf - msec)*1000;
-    usec  = (int)nowf;
-    if (usec >= 500) {
-        msec += 1;
-        if (msec >= 1000) {
-            msec = 0;
-            sec += 1;
-        }
-    }
-
-    printf( "%03d.%03d: ", sec, msec );
-
-    nowf = diff*(1.0/QEMU_TIMER_BASE);
-    sec  = (int)nowf;
-    nowf = (nowf - sec)*1e3;
-    msec = (int)nowf;
-    nowf = (nowf - msec)*1e3;
-    usec = (int)nowf;
-    if (usec >= 500) {
-        msec += 1;
-        if (msec >= 1000) {
-            msec = 0;
-            sec += 1;
-        }
-    }
-    printf( "%03d.%03d: ", sec, msec );
-
-    printf( "download: %6ld bytes, %4ld packets (%5.1f KB/s)",
-            download_bytes, download_packets, diff > 0 ? (download_bytes*(QEMU_TIMER_BASE/1024.)/diff) : 0. );
-    printf( " | " );
-    printf( "upload:   %6ld bytes, %4ld packets (%5.1f KB/s)",
-            upload_bytes, upload_packets, diff > 0 ? (upload_bytes*(QEMU_TIMER_BASE/1024.)/diff) : 0. );
-    printf( "\n" );
-    fflush(stdout);
-
-    vc_clock_last = now;
-}
-
-
-static void
-vlan_client_update_rx( VLANClientState  *vc,
-                       unsigned long     bytes )
+void qemu_del_vlan_client(VLANClientState *vc)
 {
-    static int  debug_vlan;
-
-    if ( !vc_upload && vc->fd_read == slirp_receive )
-        vc_upload = vc;
-
-    if ( !vc_download && vc->fd_read != slirp_receive )
-        vc_download = vc;
-
-    vc->rx_bytes   += bytes;
-    vc->rx_packets += 1;
-
-   /* if the environment variable QEMU_NETWORK_STATS is defined and not 0,
-    * we dump network statistics
-    */
-    if ( !debug_vlan )
-    {
-        const char*  env;
-        debug_vlan = 1;
-        env = getenv( "QEMU_NETWORK_STATS" );
-        if (env != NULL && env[0] != 0)
-        {
-            int  val = atoi(env);
+    VLANClientState **pvc = &vc->vlan->first_client;
 
-            if (val != 0)
-                debug_vlan = 2;
-        }
-    }
-
-    if (debug_vlan > 1)
-    {
-        uint64_t   now    = get_clock();
-
-        if (now - vc_clock_last > (QEMU_TIMER_BASE*0.25) || vc->rx_packets > 100) {
-#if 1
-            vlan_dump_stats();
-#else
-            clock_t period      = now - vc->clock_start;
-            double  byte_rate   = vc->rx_bytes*1e6/period;
-            double  packet_rate = vc->rx_packets*1e6/period;
-            char    tmp[14];
-
-            if ( byte_rate > vc->rx_max_byte_rate )
-                vc->rx_max_byte_rate = byte_rate;
-
-            if ( packet_rate > vc->rx_max_packet_rate )
-                vc->rx_max_packet_rate = packet_rate;
-
-            if (debug_vlan > 1)
-                fprintf( stderr, ">>>> %14s  %6.1f KB/s  %6.1f packet/s  (max %6.1f KB/s, bytes %ld, packets %ld)\n",
-                                 vlan_client_get_name(vc, tmp),
-                                 byte_rate/1024., packet_rate, vc->rx_max_byte_rate/1024.,
-                                 vc->rx_bytes, vc->rx_packets );
-            if (vc->rx_packets > 100 || now - vc->clock_start > (CLOCKS_PER_SEC*0.5))
-            {
-                vc->rx_packets  = 0;
-                vc->rx_bytes    = 0;
-                vc->clock_start = now;
-            }
-            vc->clock_last = now;
-#endif
-        }
-    }
+    while (*pvc != NULL)
+        if (*pvc == vc) {
+            *pvc = vc->next;
+            free(vc);
+            break;
+        } else
+            pvc = &(*pvc)->next;
 }
 
-
 int qemu_can_send_packet(VLANClientState *vc1)
 {
     VLANState *vlan = vc1->vlan;
@@ -2689,11 +4206,11 @@ int qemu_can_send_packet(VLANClientState *vc1)
 
     for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
         if (vc != vc1) {
-            if (vc->fd_can_read && !vc->fd_can_read(vc->opaque))
-                return 0;
+            if (vc->fd_can_read && vc->fd_can_read(vc->opaque))
+                return 1;
         }
     }
-    return 1;
+    return 0;
 }
 
 void qemu_send_packet(VLANClientState *vc1, const uint8_t *buf, int size)
@@ -2708,7 +4225,6 @@ void qemu_send_packet(VLANClientState *vc1, const uint8_t *buf, int size)
     for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
         if (vc != vc1) {
             vc->fd_read(vc->opaque, buf, size);
-            vlan_client_update_rx( vc, size );
         }
     }
 }
@@ -2891,7 +4407,7 @@ static int net_slirp_init(VLANState *vlan)
     return 0;
 }
 
-static int net_slirp_redir(const char *redir_str)
+static void net_slirp_redir(const char *redir_str)
 {
     int is_udp;
     char buf[256], *r;
@@ -2934,45 +4450,52 @@ static int net_slirp_redir(const char *redir_str)
         goto fail;
 
     if (slirp_redir(is_udp, host_port, guest_ip, guest_port) < 0) {
-        return -1;
+        fprintf(stderr, "qemu: could not set up redirection\n");
+        exit(1);
     }
-
-    return 0;
+    return;
  fail:
     fprintf(stderr, "qemu: syntax: -redir [tcp|udp]:host-port:[guest-host]:guest-port\n");
     exit(1);
-    return -1;
 }
 
 #if 0  /* ANDROID disabled */
 
 char smb_dir[1024];
 
-static void smb_exit(void)
+static void erase_dir(char *dir_name)
 {
     DIR *d;
     struct dirent *de;
     char filename[1024];
 
     /* erase all the files in the directory */
-    d = opendir(smb_dir);
-    for(;;) {
-        de = readdir(d);
-        if (!de)
-            break;
-        if (strcmp(de->d_name, ".") != 0 &&
-            strcmp(de->d_name, "..") != 0) {
-            snprintf(filename, sizeof(filename), "%s/%s",
-                     smb_dir, de->d_name);
-            unlink(filename);
+    if ((d = opendir(dir_name)) != 0) {
+        for(;;) {
+            de = readdir(d);
+            if (!de)
+                break;
+            if (strcmp(de->d_name, ".") != 0 &&
+                strcmp(de->d_name, "..") != 0) {
+                snprintf(filename, sizeof(filename), "%s/%s",
+                         smb_dir, de->d_name);
+                if (unlink(filename) != 0)  /* is it a directory? */
+                    erase_dir(filename);
+            }
         }
+        closedir(d);
+        rmdir(dir_name);
     }
-    closedir(d);
-    rmdir(smb_dir);
 }
 
 /* automatic user mode samba server configuration */
-void net_slirp_smb(const char *exported_dir)
+static void smb_exit(void)
+{
+    erase_dir(smb_dir);
+}
+
+/* automatic user mode samba server configuration */
+static void net_slirp_smb(const char *exported_dir)
 {
     char smb_conf[1024];
     char smb_cmdline[1024];
@@ -3020,8 +4543,8 @@ void net_slirp_smb(const char *exported_dir)
     fclose(f);
     atexit(smb_exit);
 
-    snprintf(smb_cmdline, sizeof(smb_cmdline), "/usr/sbin/smbd -s %s",
-             smb_conf);
+    snprintf(smb_cmdline, sizeof(smb_cmdline), "%s -s %s",
+             SMBD_COMMAND, smb_conf);
 
     slirp_add_exec(0, smb_cmdline, 4, 139);
 }
@@ -3035,6 +4558,7 @@ void net_slirp_smb(const char *exported_dir)
 typedef struct TAPState {
     VLANClientState *vc;
     int fd;
+    char down_script[1024];
 } TAPState;
 
 static void tap_receive(void *opaque, const uint8_t *buf, int size)
@@ -3056,7 +4580,15 @@ static void tap_send(void *opaque)
     uint8_t buf[4096];
     int size;
 
+#ifdef __sun__
+    struct strbuf sbuf;
+    int f = 0;
+    sbuf.maxlen = sizeof(buf);
+    sbuf.buf = buf;
+    size = getmsg(s->fd, NULL, &sbuf, &f) >=0 ? sbuf.len : -1;
+#else
     size = read(s->fd, buf, sizeof(buf));
+#endif
     if (size > 0) {
         qemu_send_packet(s->vc, buf, size);
     }
@@ -3078,14 +4610,14 @@ static TAPState *net_tap_fd_init(VLANState *vlan, int fd)
     return s;
 }
 
-#ifdef _BSD
+#if defined (_BSD) || defined (__FreeBSD_kernel__)
 static int tap_open(char *ifname, int ifname_size)
 {
     int fd;
     char *dev;
     struct stat s;
 
-    fd = open("/dev/tap", O_RDWR);
+    TFR(fd = open("/dev/tap", O_RDWR));
     if (fd < 0) {
         fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
         return -1;
@@ -3099,10 +4631,139 @@ static int tap_open(char *ifname, int ifname_size)
     return fd;
 }
 #elif defined(__sun__)
+#define TUNNEWPPA       (('T'<<16) | 0x0001)
+/*
+ * Allocate TAP device, returns opened fd.
+ * Stores dev name in the first arg(must be large enough).
+ */
+int tap_alloc(char *dev, size_t dev_size)
+{
+    int tap_fd, if_fd, ppa = -1;
+    static int ip_fd = 0;
+    char *ptr;
+
+    static int arp_fd = 0;
+    int ip_muxid, arp_muxid;
+    struct strioctl  strioc_if, strioc_ppa;
+    int link_type = I_PLINK;;
+    struct lifreq ifr;
+    char actual_name[32] = "";
+
+    memset(&ifr, 0x0, sizeof(ifr));
+
+    if( *dev ){
+       ptr = dev;
+       while( *ptr && !isdigit((int)*ptr) ) ptr++;
+       ppa = atoi(ptr);
+    }
+
+    /* Check if IP device was opened */
+    if( ip_fd )
+       close(ip_fd);
+
+    TFR(ip_fd = open("/dev/udp", O_RDWR, 0));
+    if (ip_fd < 0) {
+       syslog(LOG_ERR, "Can't open /dev/ip (actually /dev/udp)");
+       return -1;
+    }
+
+    TFR(tap_fd = open("/dev/tap", O_RDWR, 0));
+    if (tap_fd < 0) {
+       syslog(LOG_ERR, "Can't open /dev/tap");
+       return -1;
+    }
+
+    /* Assign a new PPA and get its unit number. */
+    strioc_ppa.ic_cmd = TUNNEWPPA;
+    strioc_ppa.ic_timout = 0;
+    strioc_ppa.ic_len = sizeof(ppa);
+    strioc_ppa.ic_dp = (char *)&ppa;
+    if ((ppa = ioctl (tap_fd, I_STR, &strioc_ppa)) < 0)
+       syslog (LOG_ERR, "Can't assign new interface");
+
+    TFR(if_fd = open("/dev/tap", O_RDWR, 0));
+    if (if_fd < 0) {
+       syslog(LOG_ERR, "Can't open /dev/tap (2)");
+       return -1;
+    }
+    if(ioctl(if_fd, I_PUSH, "ip") < 0){
+       syslog(LOG_ERR, "Can't push IP module");
+       return -1;
+    }
+
+    if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
+	syslog(LOG_ERR, "Can't get flags\n");
+
+    snprintf (actual_name, 32, "tap%d", ppa);
+    strncpy (ifr.lifr_name, actual_name, sizeof (ifr.lifr_name));
+
+    ifr.lifr_ppa = ppa;
+    /* Assign ppa according to the unit number returned by tun device */
+
+    if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
+        syslog (LOG_ERR, "Can't set PPA %d", ppa);
+    if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
+        syslog (LOG_ERR, "Can't get flags\n");
+    /* Push arp module to if_fd */
+    if (ioctl (if_fd, I_PUSH, "arp") < 0)
+        syslog (LOG_ERR, "Can't push ARP module (2)");
+
+    /* Push arp module to ip_fd */
+    if (ioctl (ip_fd, I_POP, NULL) < 0)
+        syslog (LOG_ERR, "I_POP failed\n");
+    if (ioctl (ip_fd, I_PUSH, "arp") < 0)
+        syslog (LOG_ERR, "Can't push ARP module (3)\n");
+    /* Open arp_fd */
+    TFR(arp_fd = open ("/dev/tap", O_RDWR, 0));
+    if (arp_fd < 0)
+       syslog (LOG_ERR, "Can't open %s\n", "/dev/tap");
+
+    /* Set ifname to arp */
+    strioc_if.ic_cmd = SIOCSLIFNAME;
+    strioc_if.ic_timout = 0;
+    strioc_if.ic_len = sizeof(ifr);
+    strioc_if.ic_dp = (char *)&ifr;
+    if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
+        syslog (LOG_ERR, "Can't set ifname to arp\n");
+    }
+
+    if((ip_muxid = ioctl(ip_fd, I_LINK, if_fd)) < 0){
+       syslog(LOG_ERR, "Can't link TAP device to IP");
+       return -1;
+    }
+
+    if ((arp_muxid = ioctl (ip_fd, link_type, arp_fd)) < 0)
+        syslog (LOG_ERR, "Can't link TAP device to ARP");
+
+    close (if_fd);
+
+    memset(&ifr, 0x0, sizeof(ifr));
+    strncpy (ifr.lifr_name, actual_name, sizeof (ifr.lifr_name));
+    ifr.lifr_ip_muxid  = ip_muxid;
+    ifr.lifr_arp_muxid = arp_muxid;
+
+    if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0)
+    {
+      ioctl (ip_fd, I_PUNLINK , arp_muxid);
+      ioctl (ip_fd, I_PUNLINK, ip_muxid);
+      syslog (LOG_ERR, "Can't set multiplexor id");
+    }
+
+    snprintf(dev, dev_size, "tap%d", ppa);
+    return tap_fd;
+}
+
 static int tap_open(char *ifname, int ifname_size)
 {
-    fprintf(stderr, "warning: tap_open not yet implemented\n");
-    return -1;
+    char  dev[10]="";
+    int fd;
+    if( (fd = tap_alloc(dev, sizeof(dev))) < 0 ){
+       fprintf(stderr, "Cannot allocate TAP device\n");
+       return -1;
+    }
+    pstrcpy(ifname, ifname_size, dev);
+    fcntl(fd, F_SETFL, O_NONBLOCK);
+    return fd;
 }
 #else
 static int tap_open(char *ifname, int ifname_size)
@@ -3110,7 +4771,7 @@ static int tap_open(char *ifname, int ifname_size)
     struct ifreq ifr;
     int fd, ret;
 
-    fd = open("/dev/net/tun", O_RDWR);
+    TFR(fd = open("/dev/net/tun", O_RDWR));
     if (fd < 0) {
         fprintf(stderr, "warning: could not open /dev/net/tun: no virtual network emulation\n");
         return -1;
@@ -3133,33 +4794,27 @@ static int tap_open(char *ifname, int ifname_size)
 }
 #endif
 
-static int net_tap_init(VLANState *vlan, const char *ifname1,
-                        const char *setup_script)
+static int launch_script(const char *setup_script, const char *ifname, int fd)
 {
-    TAPState *s;
-    int pid, status, fd;
+    int pid, status;
     char *args[3];
     char **parg;
-    char ifname[128];
-
-    if (ifname1 != NULL)
-        pstrcpy(ifname, sizeof(ifname), ifname1);
-    else
-        ifname[0] = '\0';
-    fd = tap_open(ifname, sizeof(ifname));
-    if (fd < 0)
-        return -1;
 
-    if (!setup_script)
-        setup_script = "";
-    if (setup_script[0] != '\0') {
-        /* try to launch network init script */
+        /* try to launch network script */
         pid = fork();
         if (pid >= 0) {
             if (pid == 0) {
+                int open_max = sysconf (_SC_OPEN_MAX), i;
+                for (i = 0; i < open_max; i++)
+                    if (i != STDIN_FILENO &&
+                        i != STDOUT_FILENO &&
+                        i != STDERR_FILENO &&
+                        i != fd)
+                        close(i);
+
                 parg = args;
                 *parg++ = (char *)setup_script;
-                *parg++ = ifname;
+                *parg++ = (char *)ifname;
                 *parg++ = NULL;
                 execv(setup_script, args);
                 _exit(1);
@@ -3172,17 +4827,102 @@ static int net_tap_init(VLANState *vlan, const char *ifname1,
                 return -1;
             }
         }
+    return 0;
+}
+
+static int net_tap_init(VLANState *vlan, const char *ifname1,
+                        const char *setup_script, const char *down_script)
+{
+    TAPState *s;
+    int fd;
+    char ifname[128];
+
+    if (ifname1 != NULL)
+        pstrcpy(ifname, sizeof(ifname), ifname1);
+    else
+        ifname[0] = '\0';
+    TFR(fd = tap_open(ifname, sizeof(ifname)));
+    if (fd < 0)
+        return -1;
+
+    if (!setup_script || !strcmp(setup_script, "no"))
+        setup_script = "";
+    if (setup_script[0] != '\0') {
+	if (launch_script(setup_script, ifname, fd))
+	    return -1;
     }
     s = net_tap_fd_init(vlan, fd);
     if (!s)
         return -1;
     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
              "tap: ifname=%s setup_script=%s", ifname, setup_script);
+    if (down_script && strcmp(down_script, "no"))
+        snprintf(s->down_script, sizeof(s->down_script), "%s", down_script);
     return 0;
 }
 
 #endif /* !_WIN32 */
 
+#if defined(CONFIG_VDE)
+typedef struct VDEState {
+    VLANClientState *vc;
+    VDECONN *vde;
+} VDEState;
+
+static void vde_to_qemu(void *opaque)
+{
+    VDEState *s = opaque;
+    uint8_t buf[4096];
+    int size;
+
+    size = vde_recv(s->vde, buf, sizeof(buf), 0);
+    if (size > 0) {
+        qemu_send_packet(s->vc, buf, size);
+    }
+}
+
+static void vde_from_qemu(void *opaque, const uint8_t *buf, int size)
+{
+    VDEState *s = opaque;
+    int ret;
+    for(;;) {
+        ret = vde_send(s->vde, buf, size, 0);
+        if (ret < 0 && errno == EINTR) {
+        } else {
+            break;
+        }
+    }
+}
+
+static int net_vde_init(VLANState *vlan, const char *sock, int port,
+                        const char *group, int mode)
+{
+    VDEState *s;
+    char *init_group = strlen(group) ? (char *)group : NULL;
+    char *init_sock = strlen(sock) ? (char *)sock : NULL;
+
+    struct vde_open_args args = {
+        .port = port,
+        .group = init_group,
+        .mode = mode,
+    };
+
+    s = qemu_mallocz(sizeof(VDEState));
+    if (!s)
+        return -1;
+    s->vde = vde_open(init_sock, "QEMU", &args);
+    if (!s->vde){
+        free(s);
+        return -1;
+    }
+    s->vc = qemu_new_vlan_client(vlan, vde_from_qemu, NULL, s);
+    qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
+    snprintf(s->vc->info_str, sizeof(s->vc->info_str), "vde: sock=%s fd=%d",
+             sock, vde_datafd(s->vde));
+    return 0;
+}
+#endif
+
 /* network connection */
 typedef struct NetSocketState {
     VLANClientState *vc;
@@ -3292,7 +5032,7 @@ static int net_socket_mcast_create(SockAddress*  mcastaddr)
 {
     uint32_t   mcast_ip = (uint32_t) sock_address_get_ip(mcastaddr);
 
-    int fd;
+    int fd, ret;
 
     if (!IN_MULTICAST(mcast_ip)) {
         fprintf(stderr, "qemu: error: specified mcastaddr \"%s\" does not contain a multicast address\n",
@@ -3306,9 +5046,16 @@ static int net_socket_mcast_create(SockAddress*  mcastaddr)
         return -1;
     }
 
-    if (socket_set_xreuseaddr(fd) < 0) {
-        perror("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
-        goto fail;
+#if 0
+    val = 1;
+    ret=setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
+                   (const char *)&val, sizeof(val));
+#else
+    ret=socket_set_xreuseaddr(fd);
+#endif
+    if (ret < 0) {
+	perror("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
+	goto fail;
     }
 
     if (socket_bind(fd, mcastaddr) < 0) {
@@ -3332,7 +5079,7 @@ static int net_socket_mcast_create(SockAddress*  mcastaddr)
     return fd;
 fail:
     if (fd >= 0)
-        socket_close(fd);
+        closesocket(fd);
     return -1;
 }
 
@@ -3450,7 +5197,7 @@ static void net_socket_accept(void *opaque)
 
     s1 = net_socket_fd_init(s->vlan, fd, 1);
     if (!s1) {
-        socket_close(fd);
+        closesocket(fd);
     } else {
         snprintf(s1->vc->info_str, sizeof(s1->vc->info_str),
                  "socket: connection from %s",
@@ -3478,7 +5225,13 @@ static int net_socket_listen_init(VLANState *vlan, const char *host_str)
         return -1;
     }
     socket_set_nonblock(fd);
+#if 0
+    /* allow fast reuse */
+    val = 1;
+    setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));
+#else
     socket_set_xreuseaddr(fd);
+#endif
 
     ret = socket_bind(fd, &saddr);
     if (ret < 0) {
@@ -3522,6 +5275,10 @@ static int net_socket_connect_init(VLANState *vlan, const char *host_str)
             if (err == EINTR || err == EWOULDBLOCK) {
             } else if (err == EINPROGRESS) {
                 break;
+#ifdef _WIN32
+            } else if (err == EALREADY) {
+                break;
+#endif
             } else {
                 perror("connect");
                 socket_close(fd);
@@ -3567,38 +5324,60 @@ static int net_socket_mcast_init(VLANState *vlan, const char *host_str)
 
 }
 
+static const char *get_opt_name(char *buf, int buf_size, const char *p)
+{
+    char *q;
+
+    q = buf;
+    while (*p != '\0' && *p != '=') {
+        if (q && (q - buf) < buf_size - 1)
+            *q++ = *p;
+        p++;
+    }
+    if (q)
+        *q = '\0';
+
+    return p;
+}
+
+static const char *get_opt_value(char *buf, int buf_size, const char *p)
+{
+    char *q;
+
+    q = buf;
+    while (*p != '\0') {
+        if (*p == ',') {
+            if (*(p + 1) != ',')
+                break;
+            p++;
+        }
+        if (q && (q - buf) < buf_size - 1)
+            *q++ = *p;
+        p++;
+    }
+    if (q)
+        *q = '\0';
+
+    return p;
+}
+
 static int get_param_value(char *buf, int buf_size,
                            const char *tag, const char *str)
 {
     const char *p;
-    char *q;
     char option[128];
 
     p = str;
     for(;;) {
-        q = option;
-        while (*p != '\0' && *p != '=') {
-            if ((q - option) < sizeof(option) - 1)
-                *q++ = *p;
-            p++;
-        }
-        *q = '\0';
+        p = get_opt_name(option, sizeof(option), p);
         if (*p != '=')
             break;
         p++;
         if (!strcmp(tag, option)) {
-            q = buf;
-            while (*p != '\0' && *p != ',') {
-                if ((q - buf) < buf_size - 1)
-                    *q++ = *p;
-                p++;
-            }
-            *q = '\0';
-            return q - buf;
+            (void)get_opt_value(buf, buf_size, p);
+            return strlen(buf);
         } else {
-            while (*p != '\0' && *p != ',') {
-                p++;
-            }
+            p = get_opt_value(NULL, 0, p);
         }
         if (*p != ',')
             break;
@@ -3607,25 +5386,37 @@ static int get_param_value(char *buf, int buf_size,
     return 0;
 }
 
-int net_client_init(const char *str)
+static int check_params(char *buf, int buf_size,
+                        const char * const *params, const char *str)
 {
     const char *p;
-    char *q;
-    char device[64];
-    char buf[1024];
-    int vlan_id, ret;
-    VLANState *vlan;
+    int i;
 
     p = str;
-    q = device;
-    while (*p != '\0' && *p != ',') {
-        if ((q - device) < sizeof(device) - 1)
-            *q++ = *p;
+    for(;;) {
+        p = get_opt_name(buf, buf_size, p);
+        if (*p != '=')
+            return -1;
         p++;
-    }
-    *q = '\0';
-    if (*p == ',')
+        for(i = 0; params[i] != NULL; i++)
+            if (!strcmp(params[i], buf))
+                break;
+        if (params[i] == NULL)
+            return -1;
+        p = get_opt_value(NULL, 0, p);
+        if (*p != ',')
+            break;
         p++;
+    }
+    return 0;
+}
+
+static int net_client_init(const char *device, const char *p)
+{
+    char buf[1024];
+    int vlan_id, ret;
+    VLANState *vlan;
+
     vlan_id = 0;
     if (get_param_value(buf, sizeof(buf), "vlan", p)) {
         vlan_id = strtol(buf, NULL, 0);
@@ -3663,6 +5454,7 @@ int net_client_init(const char *str)
         }
         nd->vlan = vlan;
         nb_nics++;
+        vlan->nb_guest_devs++;
         ret = 0;
     } else
     if (!strcmp(device, "none")) {
@@ -3680,34 +5472,45 @@ int net_client_init(const char *str)
         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
             pstrcpy(slirp_hostname, sizeof(slirp_hostname), buf);
         }
+        vlan->nb_host_devs++;
         ret = net_slirp_init(vlan);
     } else
 #endif
 #ifdef _WIN32
+#if 0
     if (!strcmp(device, "tap")) {
         char ifname[64];
         if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
             fprintf(stderr, "tap: no interface name\n");
             return -1;
         }
+        vlan->nb_host_devs++;
         ret = tap_win32_init(vlan, ifname);
     } else
+#endif
 #else
     if (!strcmp(device, "tap")) {
         char ifname[64];
-        char setup_script[1024];
+        char setup_script[1024], down_script[1024];
         int fd;
+        vlan->nb_host_devs++;
         if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
             fd = strtol(buf, NULL, 0);
+            socket_set_nonblock(fd);
             ret = -1;
             if (net_tap_fd_init(vlan, fd))
                 ret = 0;
         } else {
-            get_param_value(ifname, sizeof(ifname), "ifname", p);
+            if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
+                ifname[0] = '\0';
+            }
             if (get_param_value(setup_script, sizeof(setup_script), "script", p) == 0) {
                 pstrcpy(setup_script, sizeof(setup_script), DEFAULT_NETWORK_SCRIPT);
             }
-            ret = net_tap_init(vlan, ifname, setup_script);
+            if (get_param_value(down_script, sizeof(down_script), "downscript", p) == 0) {
+                pstrcpy(down_script, sizeof(down_script), DEFAULT_NETWORK_DOWN_SCRIPT);
+            }
+            ret = net_tap_init(vlan, ifname, setup_script, down_script);
         }
     } else
 #endif
@@ -3728,7 +5531,32 @@ int net_client_init(const char *str)
             fprintf(stderr, "Unknown socket options: %s\n", p);
             return -1;
         }
+        vlan->nb_host_devs++;
     } else
+#ifdef CONFIG_VDE
+    if (!strcmp(device, "vde")) {
+        char vde_sock[1024], vde_group[512];
+	int vde_port, vde_mode;
+        vlan->nb_host_devs++;
+        if (get_param_value(vde_sock, sizeof(vde_sock), "sock", p) <= 0) {
+	    vde_sock[0] = '\0';
+	}
+	if (get_param_value(buf, sizeof(buf), "port", p) > 0) {
+	    vde_port = strtol(buf, NULL, 10);
+	} else {
+	    vde_port = 0;
+	}
+	if (get_param_value(vde_group, sizeof(vde_group), "group", p) <= 0) {
+	    vde_group[0] = '\0';
+	}
+	if (get_param_value(buf, sizeof(buf), "mode", p) > 0) {
+	    vde_mode = strtol(buf, NULL, 8);
+	} else {
+	    vde_mode = 0700;
+	}
+	ret = net_vde_init(vlan, vde_sock, vde_port, vde_group, vde_mode);
+    } else
+#endif
     {
         fprintf(stderr, "Unknown network device: %s\n", device);
         return -1;
@@ -3740,6 +5568,26 @@ int net_client_init(const char *str)
     return ret;
 }
 
+static int net_client_parse(const char *str)
+{
+    const char *p;
+    char *q;
+    char device[64];
+
+    p = str;
+    q = device;
+    while (*p != '\0' && *p != ',') {
+        if ((q - device) < sizeof(device) - 1)
+            *q++ = *p;
+        p++;
+    }
+    *q = '\0';
+    if (*p == ',')
+        p++;
+
+    return net_client_init(device, p);
+}
+
 void do_info_network(void)
 {
     VLANState *vlan;
@@ -3752,6 +5600,382 @@ void do_info_network(void)
     }
 }
 
+#define HD_ALIAS "index=%d,media=disk"
+#ifdef TARGET_PPC
+#define CDROM_ALIAS "index=1,media=cdrom"
+#else
+#define CDROM_ALIAS "index=2,media=cdrom"
+#endif
+#define FD_ALIAS "index=%d,if=floppy"
+#define PFLASH_ALIAS "if=pflash"
+#define MTD_ALIAS "if=mtd"
+#define SD_ALIAS "index=0,if=sd"
+
+static int drive_add(const char *file, const char *fmt, ...)
+{
+    va_list ap;
+
+    if (nb_drives_opt >= MAX_DRIVES) {
+        fprintf(stderr, "qemu: too many drives\n");
+        exit(1);
+    }
+
+    drives_opt[nb_drives_opt].file = file;
+    va_start(ap, fmt);
+    vsnprintf(drives_opt[nb_drives_opt].opt,
+              sizeof(drives_opt[0].opt), fmt, ap);
+    va_end(ap);
+
+    return nb_drives_opt++;
+}
+
+int drive_get_index(BlockInterfaceType type, int bus, int unit)
+{
+    int index;
+
+    /* seek interface, bus and unit */
+
+    for (index = 0; index < nb_drives; index++)
+        if (drives_table[index].type == type &&
+	    drives_table[index].bus == bus &&
+	    drives_table[index].unit == unit)
+        return index;
+
+    return -1;
+}
+
+int drive_get_max_bus(BlockInterfaceType type)
+{
+    int max_bus;
+    int index;
+
+    max_bus = -1;
+    for (index = 0; index < nb_drives; index++) {
+        if(drives_table[index].type == type &&
+           drives_table[index].bus > max_bus)
+            max_bus = drives_table[index].bus;
+    }
+    return max_bus;
+}
+
+static void bdrv_format_print(void *opaque, const char *name)
+{
+    fprintf(stderr, " %s", name);
+}
+
+static int drive_init(struct drive_opt *arg, int snapshot,
+                      QEMUMachine *machine)
+{
+    char buf[128];
+    char file[1024];
+    char devname[128];
+    const char *mediastr = "";
+    BlockInterfaceType type;
+    enum { MEDIA_DISK, MEDIA_CDROM } media;
+    int bus_id, unit_id;
+    int cyls, heads, secs, translation;
+    BlockDriverState *bdrv;
+    BlockDriver *drv = NULL;
+    int max_devs;
+    int index;
+    int cache;
+    int bdrv_flags;
+    char *str = arg->opt;
+    static const char * const params[] = { "bus", "unit", "if", "index",
+                                           "cyls", "heads", "secs", "trans",
+                                           "media", "snapshot", "file",
+                                           "cache", "format", NULL };
+
+    if (check_params(buf, sizeof(buf), params, str) < 0) {
+         fprintf(stderr, "qemu: unknown parameter '%s' in '%s'\n",
+                         buf, str);
+         return -1;
+    }
+
+    file[0] = 0;
+    cyls = heads = secs = 0;
+    bus_id = 0;
+    unit_id = -1;
+    translation = BIOS_ATA_TRANSLATION_AUTO;
+    index = -1;
+    cache = 1;
+
+    if (!strcmp(machine->name, "realview") ||
+        !strcmp(machine->name, "SS-5") ||
+        !strcmp(machine->name, "SS-10") ||
+        !strcmp(machine->name, "SS-600MP") ||
+        !strcmp(machine->name, "versatilepb") ||
+        !strcmp(machine->name, "versatileab")) {
+        type = IF_SCSI;
+        max_devs = MAX_SCSI_DEVS;
+        pstrcpy(devname, sizeof(devname), "scsi");
+    } else {
+        type = IF_IDE;
+        max_devs = MAX_IDE_DEVS;
+        pstrcpy(devname, sizeof(devname), "ide");
+    }
+    media = MEDIA_DISK;
+
+    /* extract parameters */
+
+    if (get_param_value(buf, sizeof(buf), "bus", str)) {
+        bus_id = strtol(buf, NULL, 0);
+	if (bus_id < 0) {
+	    fprintf(stderr, "qemu: '%s' invalid bus id\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "unit", str)) {
+        unit_id = strtol(buf, NULL, 0);
+	if (unit_id < 0) {
+	    fprintf(stderr, "qemu: '%s' invalid unit id\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "if", str)) {
+        pstrcpy(devname, sizeof(devname), buf);
+        if (!strcmp(buf, "ide")) {
+	    type = IF_IDE;
+            max_devs = MAX_IDE_DEVS;
+        } else if (!strcmp(buf, "scsi")) {
+	    type = IF_SCSI;
+            max_devs = MAX_SCSI_DEVS;
+        } else if (!strcmp(buf, "floppy")) {
+	    type = IF_FLOPPY;
+            max_devs = 0;
+        } else if (!strcmp(buf, "pflash")) {
+	    type = IF_PFLASH;
+            max_devs = 0;
+	} else if (!strcmp(buf, "mtd")) {
+	    type = IF_MTD;
+            max_devs = 0;
+	} else if (!strcmp(buf, "sd")) {
+	    type = IF_SD;
+            max_devs = 0;
+	} else {
+            fprintf(stderr, "qemu: '%s' unsupported bus type '%s'\n", str, buf);
+            return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "index", str)) {
+        index = strtol(buf, NULL, 0);
+	if (index < 0) {
+	    fprintf(stderr, "qemu: '%s' invalid index\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "cyls", str)) {
+        cyls = strtol(buf, NULL, 0);
+    }
+
+    if (get_param_value(buf, sizeof(buf), "heads", str)) {
+        heads = strtol(buf, NULL, 0);
+    }
+
+    if (get_param_value(buf, sizeof(buf), "secs", str)) {
+        secs = strtol(buf, NULL, 0);
+    }
+
+    if (cyls || heads || secs) {
+        if (cyls < 1 || cyls > 16383) {
+            fprintf(stderr, "qemu: '%s' invalid physical cyls number\n", str);
+	    return -1;
+	}
+        if (heads < 1 || heads > 16) {
+            fprintf(stderr, "qemu: '%s' invalid physical heads number\n", str);
+	    return -1;
+	}
+        if (secs < 1 || secs > 63) {
+            fprintf(stderr, "qemu: '%s' invalid physical secs number\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "trans", str)) {
+        if (!cyls) {
+            fprintf(stderr,
+                    "qemu: '%s' trans must be used with cyls,heads and secs\n",
+                    str);
+            return -1;
+        }
+        if (!strcmp(buf, "none"))
+            translation = BIOS_ATA_TRANSLATION_NONE;
+        else if (!strcmp(buf, "lba"))
+            translation = BIOS_ATA_TRANSLATION_LBA;
+        else if (!strcmp(buf, "auto"))
+            translation = BIOS_ATA_TRANSLATION_AUTO;
+	else {
+            fprintf(stderr, "qemu: '%s' invalid translation type\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "media", str)) {
+        if (!strcmp(buf, "disk")) {
+	    media = MEDIA_DISK;
+	} else if (!strcmp(buf, "cdrom")) {
+            if (cyls || secs || heads) {
+                fprintf(stderr,
+                        "qemu: '%s' invalid physical CHS format\n", str);
+	        return -1;
+            }
+	    media = MEDIA_CDROM;
+	} else {
+	    fprintf(stderr, "qemu: '%s' invalid media\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "snapshot", str)) {
+        if (!strcmp(buf, "on"))
+	    snapshot = 1;
+        else if (!strcmp(buf, "off"))
+	    snapshot = 0;
+	else {
+	    fprintf(stderr, "qemu: '%s' invalid snapshot option\n", str);
+	    return -1;
+	}
+    }
+
+    if (get_param_value(buf, sizeof(buf), "cache", str)) {
+        if (!strcmp(buf, "off"))
+            cache = 0;
+        else if (!strcmp(buf, "on"))
+            cache = 1;
+        else {
+           fprintf(stderr, "qemu: invalid cache option\n");
+           return -1;
+        }
+    }
+
+    if (get_param_value(buf, sizeof(buf), "format", str)) {
+       if (strcmp(buf, "?") == 0) {
+            fprintf(stderr, "qemu: Supported formats:");
+            bdrv_iterate_format(bdrv_format_print, NULL);
+            fprintf(stderr, "\n");
+	    return -1;
+        }
+        drv = bdrv_find_format(buf);
+        if (!drv) {
+            fprintf(stderr, "qemu: '%s' invalid format\n", buf);
+            return -1;
+        }
+    }
+
+    if (arg->file == NULL)
+        get_param_value(file, sizeof(file), "file", str);
+    else
+        pstrcpy(file, sizeof(file), arg->file);
+
+    /* compute bus and unit according index */
+
+    if (index != -1) {
+        if (bus_id != 0 || unit_id != -1) {
+            fprintf(stderr,
+                    "qemu: '%s' index cannot be used with bus and unit\n", str);
+            return -1;
+        }
+        if (max_devs == 0)
+        {
+            unit_id = index;
+            bus_id = 0;
+        } else {
+            unit_id = index % max_devs;
+            bus_id = index / max_devs;
+        }
+    }
+
+    /* if user doesn't specify a unit_id,
+     * try to find the first free
+     */
+
+    if (unit_id == -1) {
+       unit_id = 0;
+       while (drive_get_index(type, bus_id, unit_id) != -1) {
+           unit_id++;
+           if (max_devs && unit_id >= max_devs) {
+               unit_id -= max_devs;
+               bus_id++;
+           }
+       }
+    }
+
+    /* check unit id */
+
+    if (max_devs && unit_id >= max_devs) {
+        fprintf(stderr, "qemu: '%s' unit %d too big (max is %d)\n",
+                        str, unit_id, max_devs - 1);
+        return -1;
+    }
+
+    /*
+     * ignore multiple definitions
+     */
+
+    if (drive_get_index(type, bus_id, unit_id) != -1)
+        return 0;
+
+    /* init */
+
+    if (type == IF_IDE || type == IF_SCSI)
+        mediastr = (media == MEDIA_CDROM) ? "-cd" : "-hd";
+    if (max_devs)
+        snprintf(buf, sizeof(buf), "%s%i%s%i",
+                 devname, bus_id, mediastr, unit_id);
+    else
+        snprintf(buf, sizeof(buf), "%s%s%i",
+                 devname, mediastr, unit_id);
+    bdrv = bdrv_new(buf);
+    drives_table[nb_drives].bdrv = bdrv;
+    drives_table[nb_drives].type = type;
+    drives_table[nb_drives].bus = bus_id;
+    drives_table[nb_drives].unit = unit_id;
+    nb_drives++;
+
+    switch(type) {
+    case IF_IDE:
+    case IF_SCSI:
+        switch(media) {
+	case MEDIA_DISK:
+            if (cyls != 0) {
+                bdrv_set_geometry_hint(bdrv, cyls, heads, secs);
+                bdrv_set_translation_hint(bdrv, translation);
+            }
+	    break;
+	case MEDIA_CDROM:
+            bdrv_set_type_hint(bdrv, BDRV_TYPE_CDROM);
+	    break;
+	}
+        break;
+    case IF_SD:
+        /* FIXME: This isn't really a floppy, but it's a reasonable
+           approximation.  */
+    case IF_FLOPPY:
+        bdrv_set_type_hint(bdrv, BDRV_TYPE_FLOPPY);
+        break;
+    case IF_PFLASH:
+    case IF_MTD:
+        break;
+    }
+    if (!file[0])
+        return 0;
+    bdrv_flags = 0;
+    if (snapshot)
+        bdrv_flags |= BDRV_O_SNAPSHOT;
+    if (!cache)
+        bdrv_flags |= BDRV_O_DIRECT;
+    if (bdrv_open2(bdrv, file, bdrv_flags, drv) < 0 || qemu_key_check(bdrv, file)) {
+        fprintf(stderr, "qemu: could not open disk image %s\n",
+                        file);
+        return -1;
+    }
+    return 0;
+}
+
 /***********************************************************/
 /* USB devices */
 
@@ -3769,29 +5993,10 @@ void qemu_register_usb_port(USBPort *port, void *opaque, int index,
     free_usb_ports = port;
 }
 
-static int usb_device_add(const char *devname)
+int usb_device_add_dev(USBDevice *dev)
 {
-    const char *p;
-    USBDevice *dev;
     USBPort *port;
 
-    if (!free_usb_ports)
-        return -1;
-
-    if (strstart(devname, "host:", &p)) {
-        dev = usb_host_device_open(p);
-    } else if (!strcmp(devname, "mouse")) {
-        dev = usb_mouse_init();
-    } else if (!strcmp(devname, "tablet")) {
-	dev = usb_tablet_init();
-    } else if (strstart(devname, "disk:", &p)) {
-        dev = usb_msd_init(p);
-    } else {
-        return -1;
-    }
-    if (!dev)
-        return -1;
-
     /* Find a USB port to add the device to.  */
     port = free_usb_ports;
     if (!port->next) {
@@ -3814,21 +6019,59 @@ static int usb_device_add(const char *devname)
     return 0;
 }
 
-static int usb_device_del(const char *devname)
+static int usb_device_add(const char *devname)
+{
+    const char *p;
+    USBDevice *dev;
+
+    if (!free_usb_ports)
+        return -1;
+
+    if (strstart(devname, "host:", &p)) {
+        dev = usb_host_device_open(p);
+    } else if (!strcmp(devname, "mouse")) {
+        dev = usb_mouse_init();
+    } else if (!strcmp(devname, "tablet")) {
+        dev = usb_tablet_init();
+    } else if (!strcmp(devname, "keyboard")) {
+        dev = usb_keyboard_init();
+    } else if (strstart(devname, "disk:", &p)) {
+        dev = usb_msd_init(p);
+#if 0
+    } else if (!strcmp(devname, "wacom-tablet")) {
+        dev = usb_wacom_init();
+    } else if (strstart(devname, "serial:", &p)) {
+        dev = usb_serial_init(p);
+#ifdef CONFIG_BRLAPI
+    } else if (!strcmp(devname, "braille")) {
+        dev = usb_baum_init();
+#endif
+    } else if (strstart(devname, "net:", &p)) {
+        int nic = nb_nics;
+
+        if (net_client_init("nic", p) < 0)
+            return -1;
+        nd_table[nic].model = "usb";
+        dev = usb_net_init(&nd_table[nic]);
+#endif
+    } else {
+        return -1;
+    }
+    if (!dev)
+        return -1;
+
+    return usb_device_add_dev(dev);
+}
+
+int usb_device_del_addr(int bus_num, int addr)
 {
     USBPort *port;
     USBPort **lastp;
-    int bus_num, addr;
-    const char *p;
+    USBDevice *dev;
 
     if (!used_usb_ports)
         return -1;
 
-    p = strchr(devname, '.');
-    if (!p)
-        return -1;
-    bus_num = strtoul(devname, NULL, 0);
-    addr = strtoul(p + 1, NULL, 0);
     if (bus_num != 0)
         return -1;
 
@@ -3842,27 +6085,43 @@ static int usb_device_del(const char *devname)
     if (!port)
         return -1;
 
+    dev = port->dev;
     *lastp = port->next;
     usb_attach(port, NULL);
+    dev->handle_destroy(dev);
     port->next = free_usb_ports;
     free_usb_ports = port;
     return 0;
 }
 
+static int usb_device_del(const char *devname)
+{
+    int bus_num, addr;
+    const char *p;
+
+    if (strstart(devname, "host:", &p))
+        return usb_host_device_close(p);
+
+    if (!used_usb_ports)
+        return -1;
+
+    p = strchr(devname, '.');
+    if (!p)
+        return -1;
+    bus_num = strtoul(devname, NULL, 0);
+    addr = strtoul(p + 1, NULL, 0);
+
+    return usb_device_del_addr(bus_num, addr);
+}
+
 void do_usb_add(const char *devname)
 {
-    int ret;
-    ret = usb_device_add(devname);
-    if (ret < 0)
-        term_printf("Could not add USB device '%s'\n", devname);
+    usb_device_add(devname);
 }
 
 void do_usb_del(const char *devname)
 {
-    int ret;
-    ret = usb_device_del(devname);
-    if (ret < 0)
-        term_printf("Could not remove USB device '%s'\n", devname);
+    usb_device_del(devname);
 }
 
 void usb_info(void)
@@ -3946,16 +6205,18 @@ static void dumb_update(DisplayState *ds, int x, int y, int w, int h)
 {
 }
 
-static void dumb_resize(DisplayState *ds, int w, int h, int rotation)
+static void dumb_resize(DisplayState *ds, int w, int h)
 {
 }
 
 static void dumb_refresh(DisplayState *ds)
 {
+#if defined(CONFIG_SDL)
     vga_hw_update();
+#endif
 }
 
-void dumb_display_init(DisplayState *ds)
+static void dumb_display_init(DisplayState *ds)
 {
     ds->data = NULL;
     ds->linesize = 0;
@@ -3963,6 +6224,8 @@ void dumb_display_init(DisplayState *ds)
     ds->dpy_update = dumb_update;
     ds->dpy_resize = dumb_resize;
     ds->dpy_refresh = dumb_refresh;
+    ds->gui_timer_interval = 500;
+    ds->idle = 1;
 }
 
 /***********************************************************/
@@ -3975,18 +6238,13 @@ typedef struct IOHandlerRecord {
     IOCanRWHandler *fd_read_poll;
     IOHandler *fd_read;
     IOHandler *fd_write;
+    int deleted;
     void *opaque;
-    unsigned state;
     /* temporary data */
     struct pollfd *ufd;
     struct IOHandlerRecord *next;
 } IOHandlerRecord;
 
-typedef enum {
-    IOH_STATE_PENDING = (1 << 0),
-    IOH_STATE_CLOSED  = (1 << 1)
-} IOHandlerState;
-
 static IOHandlerRecord *first_io_handler;
 
 /* XXX: fd_read_poll should be suppressed, but an API change is
@@ -4006,16 +6264,7 @@ int qemu_set_fd_handler2(int fd,
             if (ioh == NULL)
                 break;
             if (ioh->fd == fd) {
-                *pioh = ioh->next;
-
-                if (ioh->state == IOH_STATE_PENDING) {
-                    /* do not delete this ioh immediately if we're currently
-                     * processing it.
-                     */
-                    ioh->state = IOH_STATE_CLOSED;
-                } else {
-                    qemu_free(ioh);
-                }
+                ioh->deleted = 1;
                 break;
             }
             pioh = &ioh->next;
@@ -4036,6 +6285,7 @@ int qemu_set_fd_handler2(int fd,
         ioh->fd_read = fd_read;
         ioh->fd_write = fd_write;
         ioh->opaque = opaque;
+        ioh->deleted = 0;
     }
     return 0;
 }
@@ -4052,9 +6302,9 @@ int qemu_set_fd_handler(int fd,
 /* Polling handling */
 
 typedef struct PollingEntry {
-    PollingFunc*          func;
-    void*                 opaque;
-    struct PollingEntry*  next;
+    PollingFunc *func;
+    void *opaque;
+    struct PollingEntry *next;
 } PollingEntry;
 
 static PollingEntry *first_polling_entry;
@@ -4133,14 +6383,190 @@ void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque)
 /***********************************************************/
 /* savevm/loadvm support */
 
+#define IO_BUF_SIZE 32768
+
+struct QEMUFile {
+    FILE *outfile;
+    BlockDriverState *bs;
+    int is_file;
+    int is_writable;
+    int64_t base_offset;
+    int64_t buf_offset; /* start of buffer when writing, end of buffer
+                           when reading */
+    int buf_index;
+    int buf_size; /* 0 when writing */
+    uint8_t buf[IO_BUF_SIZE];
+};
+
+QEMUFile *qemu_fopen(const char *filename, const char *mode)
+{
+    QEMUFile *f;
+
+    f = qemu_mallocz(sizeof(QEMUFile));
+    if (!f)
+        return NULL;
+    if (!strcmp(mode, "wb")) {
+        f->is_writable = 1;
+    } else if (!strcmp(mode, "rb")) {
+        f->is_writable = 0;
+    } else {
+        goto fail;
+    }
+    f->outfile = fopen(filename, mode);
+    if (!f->outfile)
+        goto fail;
+    f->is_file = 1;
+    return f;
+ fail:
+    if (f->outfile)
+        fclose(f->outfile);
+    qemu_free(f);
+    return NULL;
+}
+
+static QEMUFile *qemu_fopen_bdrv(BlockDriverState *bs, int64_t offset, int is_writable)
+{
+    QEMUFile *f;
+
+    f = qemu_mallocz(sizeof(QEMUFile));
+    if (!f)
+        return NULL;
+    f->is_file = 0;
+    f->bs = bs;
+    f->is_writable = is_writable;
+    f->base_offset = offset;
+    return f;
+}
+
+void qemu_fflush(QEMUFile *f)
+{
+    if (!f->is_writable)
+        return;
+    if (f->buf_index > 0) {
+        if (f->is_file) {
+            fseek(f->outfile, f->buf_offset, SEEK_SET);
+            fwrite(f->buf, 1, f->buf_index, f->outfile);
+        } else {
+            bdrv_pwrite(f->bs, f->base_offset + f->buf_offset,
+                        f->buf, f->buf_index);
+        }
+        f->buf_offset += f->buf_index;
+        f->buf_index = 0;
+    }
+}
+
+static void qemu_fill_buffer(QEMUFile *f)
+{
+    int len;
+
+    if (f->is_writable)
+        return;
+    if (f->is_file) {
+        fseek(f->outfile, f->buf_offset, SEEK_SET);
+        len = fread(f->buf, 1, IO_BUF_SIZE, f->outfile);
+        if (len < 0)
+            len = 0;
+    } else {
+        len = bdrv_pread(f->bs, f->base_offset + f->buf_offset,
+                         f->buf, IO_BUF_SIZE);
+        if (len < 0)
+            len = 0;
+    }
+    f->buf_index = 0;
+    f->buf_size = len;
+    f->buf_offset += len;
+}
+
+void qemu_fclose(QEMUFile *f)
+{
+    if (f->is_writable)
+        qemu_fflush(f);
+    if (f->is_file) {
+        fclose(f->outfile);
+    }
+    qemu_free(f);
+}
+
 void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, int size)
 {
-    fwrite(buf, 1, size, f);
+    int l;
+    while (size > 0) {
+        l = IO_BUF_SIZE - f->buf_index;
+        if (l > size)
+            l = size;
+        memcpy(f->buf + f->buf_index, buf, l);
+        f->buf_index += l;
+        buf += l;
+        size -= l;
+        if (f->buf_index >= IO_BUF_SIZE)
+            qemu_fflush(f);
+    }
 }
 
 void qemu_put_byte(QEMUFile *f, int v)
 {
-    fputc(v, f);
+    f->buf[f->buf_index++] = v;
+    if (f->buf_index >= IO_BUF_SIZE)
+        qemu_fflush(f);
+}
+
+int qemu_get_buffer(QEMUFile *f, uint8_t *buf, int size1)
+{
+    int size, l;
+
+    size = size1;
+    while (size > 0) {
+        l = f->buf_size - f->buf_index;
+        if (l == 0) {
+            qemu_fill_buffer(f);
+            l = f->buf_size - f->buf_index;
+            if (l == 0)
+                break;
+        }
+        if (l > size)
+            l = size;
+        memcpy(buf, f->buf + f->buf_index, l);
+        f->buf_index += l;
+        buf += l;
+        size -= l;
+    }
+    return size1 - size;
+}
+
+int qemu_get_byte(QEMUFile *f)
+{
+    if (f->buf_index >= f->buf_size) {
+        qemu_fill_buffer(f);
+        if (f->buf_index >= f->buf_size)
+            return 0;
+    }
+    return f->buf[f->buf_index++];
+}
+
+int64_t qemu_ftell(QEMUFile *f)
+{
+    return f->buf_offset - f->buf_size + f->buf_index;
+}
+
+int64_t qemu_fseek(QEMUFile *f, int64_t pos, int whence)
+{
+    if (whence == SEEK_SET) {
+        /* nothing to do */
+    } else if (whence == SEEK_CUR) {
+        pos += qemu_ftell(f);
+    } else {
+        /* SEEK_END not supported */
+        return -1;
+    }
+    if (f->is_writable) {
+        qemu_fflush(f);
+        f->buf_offset = pos;
+    } else {
+        f->buf_offset = pos;
+        f->buf_index = 0;
+        f->buf_size = 0;
+    }
+    return pos;
 }
 
 void qemu_put_be16(QEMUFile *f, unsigned int v)
@@ -4163,21 +6589,6 @@ void qemu_put_be64(QEMUFile *f, uint64_t v)
     qemu_put_be32(f, v);
 }
 
-int qemu_get_buffer(QEMUFile *f, uint8_t *buf, int size)
-{
-    return fread(buf, 1, size, f);
-}
-
-int qemu_get_byte(QEMUFile *f)
-{
-    int v;
-    v = fgetc(f);
-    if (v == EOF)
-        return 0;
-    else
-        return v;
-}
-
 unsigned int qemu_get_be16(QEMUFile *f)
 {
     unsigned int v;
@@ -4204,18 +6615,6 @@ uint64_t qemu_get_be64(QEMUFile *f)
     return v;
 }
 
-int64_t qemu_ftell(QEMUFile *f)
-{
-    return ftell(f);
-}
-
-int64_t qemu_fseek(QEMUFile *f, int64_t pos, int whence)
-{
-    if (fseek(f, pos, whence) < 0)
-        return -1;
-    return ftell(f);
-}
-
 void  qemu_put_struct(QEMUFile*  f, const QField*  fields, const void*  s)
 {
     const QField*  qf = fields;
@@ -4325,6 +6724,10 @@ typedef struct SaveStateEntry {
 
 static SaveStateEntry *first_se;
 
+/* TODO: Individual devices generally have very little idea about the rest
+   of the system, so instance_id should be removed/replaced.
+   Meanwhile pass -1 as instance_id if you do not already have a clearly
+   distinguishing id for all instances of your device class. */
 int register_savevm(const char *idstr,
                     int instance_id,
                     int version_id,
@@ -4338,7 +6741,7 @@ int register_savevm(const char *idstr,
     if (!se)
         return -1;
     pstrcpy(se->idstr, sizeof(se->idstr), idstr);
-    se->instance_id = instance_id;
+    se->instance_id = (instance_id == -1) ? 0 : instance_id;
     se->version_id = version_id;
     se->save_state = save_state;
     se->load_state = load_state;
@@ -4347,61 +6750,62 @@ int register_savevm(const char *idstr,
 
     /* add at the end of list */
     pse = &first_se;
-    while (*pse != NULL)
+    while (*pse != NULL) {
+        if (instance_id == -1
+                && strcmp(se->idstr, (*pse)->idstr) == 0
+                && se->instance_id <= (*pse)->instance_id)
+            se->instance_id = (*pse)->instance_id + 1;
         pse = &(*pse)->next;
+    }
     *pse = se;
     return 0;
 }
 
 #define QEMU_VM_FILE_MAGIC   0x5145564d
-#define QEMU_VM_FILE_VERSION 0x00000001
+#define QEMU_VM_FILE_VERSION 0x00000002
 
-int qemu_savevm(const char *filename)
+static int qemu_savevm_state(QEMUFile *f)
 {
     SaveStateEntry *se;
-    QEMUFile *f;
-    int len, len_pos, cur_pos, saved_vm_running, ret;
-
-    saved_vm_running = vm_running;
-    vm_stop(0);
-
-    f = fopen(filename, "wb");
-    if (!f) {
-        ret = -1;
-        goto the_end;
-    }
+    int len, ret;
+    int64_t cur_pos, len_pos, total_len_pos;
 
     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
+    total_len_pos = qemu_ftell(f);
+    qemu_put_be64(f, 0); /* total size */
 
     for(se = first_se; se != NULL; se = se->next) {
+	if (se->save_state == NULL)
+	    /* this one has a loader only, for backwards compatibility */
+	    continue;
+
         /* ID string */
         len = strlen(se->idstr);
         qemu_put_byte(f, len);
-        qemu_put_buffer(f, (uint8_t*)se->idstr, len);
+        qemu_put_buffer(f, (uint8_t *)se->idstr, len);
 
         qemu_put_be32(f, se->instance_id);
         qemu_put_be32(f, se->version_id);
 
         /* record size: filled later */
-        len_pos = ftell(f);
+        len_pos = qemu_ftell(f);
         qemu_put_be32(f, 0);
-
         se->save_state(f, se->opaque);
 
         /* fill record size */
-        cur_pos = ftell(f);
-        len = ftell(f) - len_pos - 4;
-        fseek(f, len_pos, SEEK_SET);
+        cur_pos = qemu_ftell(f);
+        len = cur_pos - len_pos - 4;
+        qemu_fseek(f, len_pos, SEEK_SET);
         qemu_put_be32(f, len);
-        fseek(f, cur_pos, SEEK_SET);
+        qemu_fseek(f, cur_pos, SEEK_SET);
     }
+    cur_pos = qemu_ftell(f);
+    qemu_fseek(f, total_len_pos, SEEK_SET);
+    qemu_put_be64(f, cur_pos - total_len_pos - 8);
+    qemu_fseek(f, cur_pos, SEEK_SET);
 
-    fclose(f);
     ret = 0;
- the_end:
-    if (saved_vm_running)
-        vm_start();
     return ret;
 }
 
@@ -4417,39 +6821,30 @@ static SaveStateEntry *find_se(const char *idstr, int instance_id)
     return NULL;
 }
 
-int qemu_loadvm(const char *filename)
+static int qemu_loadvm_state(QEMUFile *f)
 {
     SaveStateEntry *se;
-    QEMUFile *f;
-    int len, cur_pos, ret, instance_id, record_len, version_id;
-    int saved_vm_running;
+    int len, ret, instance_id, record_len, version_id;
+    int64_t total_len, end_pos, cur_pos;
     unsigned int v;
     char idstr[256];
 
-    saved_vm_running = vm_running;
-    vm_stop(0);
-
-    f = fopen(filename, "rb");
-    if (!f) {
-        ret = -1;
-        goto the_end;
-    }
-
     v = qemu_get_be32(f);
     if (v != QEMU_VM_FILE_MAGIC)
         goto fail;
     v = qemu_get_be32(f);
     if (v != QEMU_VM_FILE_VERSION) {
     fail:
-        fclose(f);
         ret = -1;
         goto the_end;
     }
+    total_len = qemu_get_be64(f);
+    end_pos = total_len + qemu_ftell(f);
     for(;;) {
-        len = qemu_get_byte(f);
-        if (feof(f))
+        if (qemu_ftell(f) >= end_pos)
             break;
-        qemu_get_buffer(f, (uint8_t*)idstr, len);
+        len = qemu_get_byte(f);
+        qemu_get_buffer(f, (uint8_t *)idstr, len);
         idstr[len] = '\0';
         instance_id = qemu_get_be32(f);
         version_id = qemu_get_be32(f);
@@ -4458,7 +6853,7 @@ int qemu_loadvm(const char *filename)
         printf("idstr=%s instance=0x%x version=%d len=%d\n",
                idstr, instance_id, version_id, record_len);
 #endif
-        cur_pos = ftell(f);
+        cur_pos = qemu_ftell(f);
         se = find_se(idstr, instance_id);
         if (!se) {
             fprintf(stderr, "qemu: warning: instance 0x%x of device '%s' not present in current VM\n",
@@ -4473,487 +6868,301 @@ int qemu_loadvm(const char *filename)
         /* always seek to exact end of record */
         qemu_fseek(f, cur_pos + record_len, SEEK_SET);
     }
-    fclose(f);
     ret = 0;
  the_end:
-    if (saved_vm_running)
-        vm_start();
     return ret;
 }
 
-/***********************************************************/
-/* cpu save/restore */
-
-#if defined(TARGET_I386)
-
-static void cpu_put_seg(QEMUFile *f, SegmentCache *dt)
+/* device can contain snapshots */
+static int bdrv_can_snapshot(BlockDriverState *bs)
 {
-    qemu_put_be32(f, dt->selector);
-    qemu_put_betl(f, dt->base);
-    qemu_put_be32(f, dt->limit);
-    qemu_put_be32(f, dt->flags);
+    return (bs &&
+            !bdrv_is_removable(bs) &&
+            !bdrv_is_read_only(bs));
 }
 
-static void cpu_get_seg(QEMUFile *f, SegmentCache *dt)
+/* device must be snapshots in order to have a reliable snapshot */
+static int bdrv_has_snapshot(BlockDriverState *bs)
 {
-    dt->selector = qemu_get_be32(f);
-    dt->base = qemu_get_betl(f);
-    dt->limit = qemu_get_be32(f);
-    dt->flags = qemu_get_be32(f);
+    return (bs &&
+            !bdrv_is_removable(bs) &&
+            !bdrv_is_read_only(bs));
 }
 
-void cpu_save(QEMUFile *f, void *opaque)
+static BlockDriverState *get_bs_snapshots(void)
 {
-    CPUState *env = opaque;
-    uint16_t fptag, fpus, fpuc, fpregs_format;
-    uint32_t hflags;
+    BlockDriverState *bs;
     int i;
 
-    for(i = 0; i < CPU_NB_REGS; i++)
-        qemu_put_betls(f, &env->regs[i]);
-    qemu_put_betls(f, &env->eip);
-    qemu_put_betls(f, &env->eflags);
-    hflags = env->hflags; /* XXX: suppress most of the redundant hflags */
-    qemu_put_be32s(f, &hflags);
-
-    /* FPU */
-    fpuc = env->fpuc;
-    fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
-    fptag = 0;
-    for(i = 0; i < 8; i++) {
-        fptag |= ((!env->fptags[i]) << i);
+    if (bs_snapshots)
+        return bs_snapshots;
+    for(i = 0; i <= nb_drives; i++) {
+        bs = drives_table[i].bdrv;
+        if (bdrv_can_snapshot(bs))
+            goto ok;
     }
+    return NULL;
+ ok:
+    bs_snapshots = bs;
+    return bs;
+}
 
-    qemu_put_be16s(f, &fpuc);
-    qemu_put_be16s(f, &fpus);
-    qemu_put_be16s(f, &fptag);
-
-#ifdef USE_X86LDOUBLE
-    fpregs_format = 0;
-#else
-    fpregs_format = 1;
-#endif
-    qemu_put_be16s(f, &fpregs_format);
+static int bdrv_snapshot_find(BlockDriverState *bs, QEMUSnapshotInfo *sn_info,
+                              const char *name)
+{
+    QEMUSnapshotInfo *sn_tab, *sn;
+    int nb_sns, i, ret;
 
-    for(i = 0; i < 8; i++) {
-#ifdef USE_X86LDOUBLE
-        {
-            uint64_t mant;
-            uint16_t exp;
-            /* we save the real CPU data (in case of MMX usage only 'mant'
-               contains the MMX register */
-            cpu_get_fp80(&mant, &exp, env->fpregs[i].d);
-            qemu_put_be64(f, mant);
-            qemu_put_be16(f, exp);
+    ret = -ENOENT;
+    nb_sns = bdrv_snapshot_list(bs, &sn_tab);
+    if (nb_sns < 0)
+        return ret;
+    for(i = 0; i < nb_sns; i++) {
+        sn = &sn_tab[i];
+        if (!strcmp(sn->id_str, name) || !strcmp(sn->name, name)) {
+            *sn_info = *sn;
+            ret = 0;
+            break;
         }
-#else
-        /* if we use doubles for float emulation, we save the doubles to
-           avoid losing information in case of MMX usage. It can give
-           problems if the image is restored on a CPU where long
-           doubles are used instead. */
-        qemu_put_be64(f, env->fpregs[i].mmx.MMX_Q(0));
-#endif
-    }
-
-    for(i = 0; i < 6; i++)
-        cpu_put_seg(f, &env->segs[i]);
-    cpu_put_seg(f, &env->ldt);
-    cpu_put_seg(f, &env->tr);
-    cpu_put_seg(f, &env->gdt);
-    cpu_put_seg(f, &env->idt);
-
-    qemu_put_be32s(f, &env->sysenter_cs);
-    qemu_put_be32s(f, &env->sysenter_esp);
-    qemu_put_be32s(f, &env->sysenter_eip);
-
-    qemu_put_betls(f, &env->cr[0]);
-    qemu_put_betls(f, &env->cr[2]);
-    qemu_put_betls(f, &env->cr[3]);
-    qemu_put_betls(f, &env->cr[4]);
-
-    for(i = 0; i < 8; i++)
-        qemu_put_betls(f, &env->dr[i]);
-
-    /* MMU */
-    qemu_put_be32s(f, &env->a20_mask);
-
-    /* XMM */
-    qemu_put_be32s(f, &env->mxcsr);
-    for(i = 0; i < CPU_NB_REGS; i++) {
-        qemu_put_be64s(f, &env->xmm_regs[i].XMM_Q(0));
-        qemu_put_be64s(f, &env->xmm_regs[i].XMM_Q(1));
     }
-
-#ifdef TARGET_X86_64
-    qemu_put_be64s(f, &env->efer);
-    qemu_put_be64s(f, &env->star);
-    qemu_put_be64s(f, &env->lstar);
-    qemu_put_be64s(f, &env->cstar);
-    qemu_put_be64s(f, &env->fmask);
-    qemu_put_be64s(f, &env->kernelgsbase);
-#endif
-}
-
-#ifdef USE_X86LDOUBLE
-/* XXX: add that in a FPU generic layer */
-union x86_longdouble {
-    uint64_t mant;
-    uint16_t exp;
-};
-
-#define MANTD1(fp)	(fp & ((1LL << 52) - 1))
-#define EXPBIAS1 1023
-#define EXPD1(fp)	((fp >> 52) & 0x7FF)
-#define SIGND1(fp)	((fp >> 32) & 0x80000000)
-
-static void fp64_to_fp80(union x86_longdouble *p, uint64_t temp)
-{
-    int e;
-    /* mantissa */
-    p->mant = (MANTD1(temp) << 11) | (1LL << 63);
-    /* exponent + sign */
-    e = EXPD1(temp) - EXPBIAS1 + 16383;
-    e |= SIGND1(temp) >> 16;
-    p->exp = e;
+    qemu_free(sn_tab);
+    return ret;
 }
-#endif
 
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
+void do_savevm(const char *name)
 {
-    CPUState *env = opaque;
-    int i, guess_mmx;
-    uint32_t hflags;
-    uint16_t fpus, fpuc, fptag, fpregs_format;
-
-    if (version_id != 3)
-        return -EINVAL;
-    for(i = 0; i < CPU_NB_REGS; i++)
-        qemu_get_betls(f, &env->regs[i]);
-    qemu_get_betls(f, &env->eip);
-    qemu_get_betls(f, &env->eflags);
-    qemu_get_be32s(f, &hflags);
-
-    qemu_get_be16s(f, &fpuc);
-    qemu_get_be16s(f, &fpus);
-    qemu_get_be16s(f, &fptag);
-    qemu_get_be16s(f, &fpregs_format);
-
-    /* NOTE: we cannot always restore the FPU state if the image come
-       from a host with a different 'USE_X86LDOUBLE' define. We guess
-       if we are in an MMX state to restore correctly in that case. */
-    guess_mmx = ((fptag == 0xff) && (fpus & 0x3800) == 0);
-    for(i = 0; i < 8; i++) {
-        uint64_t mant;
-        uint16_t exp;
-
-        switch(fpregs_format) {
-        case 0:
-            mant = qemu_get_be64(f);
-            exp = qemu_get_be16(f);
-#ifdef USE_X86LDOUBLE
-            env->fpregs[i].d = cpu_set_fp80(mant, exp);
-#else
-            /* difficult case */
-            if (guess_mmx)
-                env->fpregs[i].mmx.MMX_Q(0) = mant;
-            else
-                env->fpregs[i].d = cpu_set_fp80(mant, exp);
-#endif
-            break;
-        case 1:
-            mant = qemu_get_be64(f);
-#ifdef USE_X86LDOUBLE
-            {
-                union x86_longdouble *p;
-                /* difficult case */
-                p = (void *)&env->fpregs[i];
-                if (guess_mmx) {
-                    p->mant = mant;
-                    p->exp = 0xffff;
-                } else {
-                    fp64_to_fp80(p, mant);
-                }
-            }
+    BlockDriverState *bs, *bs1;
+    QEMUSnapshotInfo sn1, *sn = &sn1, old_sn1, *old_sn = &old_sn1;
+    int must_delete, ret, i;
+    BlockDriverInfo bdi1, *bdi = &bdi1;
+    QEMUFile *f;
+    int saved_vm_running;
+#ifdef _WIN32
+    struct _timeb tb;
 #else
-            env->fpregs[i].mmx.MMX_Q(0) = mant;
+    struct timeval tv;
 #endif
-            break;
-        default:
-            return -EINVAL;
-        }
-    }
 
-    env->fpuc = fpuc;
-    /* XXX: restore FPU round state */
-    env->fpstt = (fpus >> 11) & 7;
-    env->fpus = fpus & ~0x3800;
-    fptag ^= 0xff;
-    for(i = 0; i < 8; i++) {
-        env->fptags[i] = (fptag >> i) & 1;
+    bs = get_bs_snapshots();
+    if (!bs) {
+        term_printf("No block device can accept snapshots\n");
+        return;
     }
 
-    for(i = 0; i < 6; i++)
-        cpu_get_seg(f, &env->segs[i]);
-    cpu_get_seg(f, &env->ldt);
-    cpu_get_seg(f, &env->tr);
-    cpu_get_seg(f, &env->gdt);
-    cpu_get_seg(f, &env->idt);
+    /* ??? Should this occur after vm_stop?  */
+    qemu_aio_flush();
 
-    qemu_get_be32s(f, &env->sysenter_cs);
-    qemu_get_be32s(f, &env->sysenter_esp);
-    qemu_get_be32s(f, &env->sysenter_eip);
+    saved_vm_running = vm_running;
+    vm_stop(0);
 
-    qemu_get_betls(f, &env->cr[0]);
-    qemu_get_betls(f, &env->cr[2]);
-    qemu_get_betls(f, &env->cr[3]);
-    qemu_get_betls(f, &env->cr[4]);
+    must_delete = 0;
+    if (name) {
+        ret = bdrv_snapshot_find(bs, old_sn, name);
+        if (ret >= 0) {
+            must_delete = 1;
+        }
+    }
+    memset(sn, 0, sizeof(*sn));
+    if (must_delete) {
+        pstrcpy(sn->name, sizeof(sn->name), old_sn->name);
+        pstrcpy(sn->id_str, sizeof(sn->id_str), old_sn->id_str);
+    } else {
+        if (name)
+            pstrcpy(sn->name, sizeof(sn->name), name);
+    }
 
-    for(i = 0; i < 8; i++)
-        qemu_get_betls(f, &env->dr[i]);
+    /* fill auxiliary fields */
+#ifdef _WIN32
+    _ftime(&tb);
+    sn->date_sec = tb.time;
+    sn->date_nsec = tb.millitm * 1000000;
+#else
+    gettimeofday(&tv, NULL);
+    sn->date_sec = tv.tv_sec;
+    sn->date_nsec = tv.tv_usec * 1000;
+#endif
+    sn->vm_clock_nsec = qemu_get_clock(vm_clock);
 
-    /* MMU */
-    qemu_get_be32s(f, &env->a20_mask);
+    if (bdrv_get_info(bs, bdi) < 0 || bdi->vm_state_offset <= 0) {
+        term_printf("Device %s does not support VM state snapshots\n",
+                    bdrv_get_device_name(bs));
+        goto the_end;
+    }
 
-    qemu_get_be32s(f, &env->mxcsr);
-    for(i = 0; i < CPU_NB_REGS; i++) {
-        qemu_get_be64s(f, &env->xmm_regs[i].XMM_Q(0));
-        qemu_get_be64s(f, &env->xmm_regs[i].XMM_Q(1));
+    /* save the VM state */
+    f = qemu_fopen_bdrv(bs, bdi->vm_state_offset, 1);
+    if (!f) {
+        term_printf("Could not open VM state file\n");
+        goto the_end;
+    }
+    ret = qemu_savevm_state(f);
+    sn->vm_state_size = qemu_ftell(f);
+    qemu_fclose(f);
+    if (ret < 0) {
+        term_printf("Error %d while writing VM\n", ret);
+        goto the_end;
     }
 
-#ifdef TARGET_X86_64
-    qemu_get_be64s(f, &env->efer);
-    qemu_get_be64s(f, &env->star);
-    qemu_get_be64s(f, &env->lstar);
-    qemu_get_be64s(f, &env->cstar);
-    qemu_get_be64s(f, &env->fmask);
-    qemu_get_be64s(f, &env->kernelgsbase);
-#endif
+    /* create the snapshots */
 
-    /* XXX: compute hflags from scratch, except for CPL and IIF */
-    env->hflags = hflags;
-    tlb_flush(env, 1);
-    return 0;
-}
+    for(i = 0; i < nb_drives; i++) {
+        bs1 = drives_table[i].bdrv;
+        if (bdrv_has_snapshot(bs1)) {
+            if (must_delete) {
+                ret = bdrv_snapshot_delete(bs1, old_sn->id_str);
+                if (ret < 0) {
+                    term_printf("Error while deleting snapshot on '%s'\n",
+                                bdrv_get_device_name(bs1));
+                }
+            }
+            ret = bdrv_snapshot_create(bs1, sn);
+            if (ret < 0) {
+                term_printf("Error while creating snapshot on '%s'\n",
+                            bdrv_get_device_name(bs1));
+            }
+        }
+    }
 
-#elif defined(TARGET_PPC)
-void cpu_save(QEMUFile *f, void *opaque)
-{
+ the_end:
+    if (saved_vm_running)
+        vm_start();
 }
 
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
+void do_loadvm(const char *name)
 {
-    return 0;
-}
+    BlockDriverState *bs, *bs1;
+    BlockDriverInfo bdi1, *bdi = &bdi1;
+    QEMUFile *f;
+    int i, ret;
+    int saved_vm_running;
 
-#elif defined(TARGET_MIPS)
-void cpu_save(QEMUFile *f, void *opaque)
-{
-}
+    bs = get_bs_snapshots();
+    if (!bs) {
+        term_printf("No block device supports snapshots\n");
+        return;
+    }
 
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-    return 0;
-}
+    /* Flush all IO requests so they don't interfere with the new state.  */
+    qemu_aio_flush();
 
-#elif defined(TARGET_SPARC)
-void cpu_save(QEMUFile *f, void *opaque)
-{
-    CPUState *env = opaque;
-    int i;
-    uint32_t tmp;
+    saved_vm_running = vm_running;
+    vm_stop(0);
 
-    for(i = 0; i < 8; i++)
-        qemu_put_betls(f, &env->gregs[i]);
-    for(i = 0; i < NWINDOWS * 16; i++)
-        qemu_put_betls(f, &env->regbase[i]);
+    for(i = 0; i <= nb_drives; i++) {
+        bs1 = drives_table[i].bdrv;
+        if (bdrv_has_snapshot(bs1)) {
+            ret = bdrv_snapshot_goto(bs1, name);
+            if (ret < 0) {
+                if (bs != bs1)
+                    term_printf("Warning: ");
+                switch(ret) {
+                case -ENOTSUP:
+                    term_printf("Snapshots not supported on device '%s'\n",
+                                bdrv_get_device_name(bs1));
+                    break;
+                case -ENOENT:
+                    term_printf("Could not find snapshot '%s' on device '%s'\n",
+                                name, bdrv_get_device_name(bs1));
+                    break;
+                default:
+                    term_printf("Error %d while activating snapshot on '%s'\n",
+                                ret, bdrv_get_device_name(bs1));
+                    break;
+                }
+                /* fatal on snapshot block device */
+                if (bs == bs1)
+                    goto the_end;
+            }
+        }
+    }
 
-    /* FPU */
-    for(i = 0; i < TARGET_FPREGS; i++) {
-        union {
-            float32 f;
-            uint32_t i;
-        } u;
-        u.f = env->fpr[i];
-        qemu_put_be32(f, u.i);
+    if (bdrv_get_info(bs, bdi) < 0 || bdi->vm_state_offset <= 0) {
+        term_printf("Device %s does not support VM state snapshots\n",
+                    bdrv_get_device_name(bs));
+        return;
     }
 
-    qemu_put_betls(f, &env->pc);
-    qemu_put_betls(f, &env->npc);
-    qemu_put_betls(f, &env->y);
-    tmp = GET_PSR(env);
-    qemu_put_be32(f, tmp);
-    qemu_put_betls(f, &env->fsr);
-    qemu_put_betls(f, &env->tbr);
-#ifndef TARGET_SPARC64
-    qemu_put_be32s(f, &env->wim);
-    /* MMU */
-    for(i = 0; i < 16; i++)
-        qemu_put_be32s(f, &env->mmuregs[i]);
-#endif
+    /* restore the VM state */
+    f = qemu_fopen_bdrv(bs, bdi->vm_state_offset, 0);
+    if (!f) {
+        term_printf("Could not open VM state file\n");
+        goto the_end;
+    }
+    ret = qemu_loadvm_state(f);
+    qemu_fclose(f);
+    if (ret < 0) {
+        term_printf("Error %d while loading VM state\n", ret);
+    }
+ the_end:
+    if (saved_vm_running)
+        vm_start();
 }
 
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
+void do_delvm(const char *name)
 {
-    CPUState *env = opaque;
-    int i;
-    uint32_t tmp;
-
-    for(i = 0; i < 8; i++)
-        qemu_get_betls(f, &env->gregs[i]);
-    for(i = 0; i < NWINDOWS * 16; i++)
-        qemu_get_betls(f, &env->regbase[i]);
-
-    /* FPU */
-    for(i = 0; i < TARGET_FPREGS; i++) {
-        union {
-            float32 f;
-            uint32_t i;
-        } u;
-        u.i = qemu_get_be32(f);
-        env->fpr[i] = u.f;
-    }
-
-    qemu_get_betls(f, &env->pc);
-    qemu_get_betls(f, &env->npc);
-    qemu_get_betls(f, &env->y);
-    tmp = qemu_get_be32(f);
-    env->cwp = 0; /* needed to ensure that the wrapping registers are
-                     correctly updated */
-    PUT_PSR(env, tmp);
-    qemu_get_betls(f, &env->fsr);
-    qemu_get_betls(f, &env->tbr);
-#ifndef TARGET_SPARC64
-    qemu_get_be32s(f, &env->wim);
-    /* MMU */
-    for(i = 0; i < 16; i++)
-        qemu_get_be32s(f, &env->mmuregs[i]);
-#endif
-    tlb_flush(env, 1);
-    return 0;
-}
+    BlockDriverState *bs, *bs1;
+    int i, ret;
 
-#elif defined(TARGET_ARM)
+    bs = get_bs_snapshots();
+    if (!bs) {
+        term_printf("No block device supports snapshots\n");
+        return;
+    }
 
-/* ??? Need to implement these.  */
-void cpu_save(QEMUFile *f, void *opaque)
-{
-    int i;
-    CPUARMState *env = (CPUARMState *)opaque;
-
-    for (i = 0; i < 16; i++) {
-        qemu_put_be32(f, env->regs[i]);
-    }
-    qemu_put_be32(f, cpsr_read(env));
-    qemu_put_be32(f, env->spsr);
-    for (i = 0; i < 6; i++) {
-        qemu_put_be32(f, env->banked_spsr[i]);
-        qemu_put_be32(f, env->banked_r13[i]);
-        qemu_put_be32(f, env->banked_r14[i]);
-    }
-    for (i = 0; i < 5; i++) {
-        qemu_put_be32(f, env->usr_regs[i]);
-        qemu_put_be32(f, env->fiq_regs[i]);
-    }
-
-    qemu_put_be32(f, env->cp15.c0_cpuid);
-    qemu_put_be32(f, env->cp15.c1_sys);
-    qemu_put_be32(f, env->cp15.c1_coproc);
-    qemu_put_be32(f, env->cp15.c2);
-    qemu_put_be32(f, env->cp15.c3);
-    qemu_put_be32(f, env->cp15.c5_insn);
-    qemu_put_be32(f, env->cp15.c5_data);
-    qemu_put_be32(f, env->cp15.c6_insn);
-    qemu_put_be32(f, env->cp15.c6_data);
-    qemu_put_be32(f, env->cp15.c9_insn);
-    qemu_put_be32(f, env->cp15.c9_data);
-    qemu_put_be32(f, env->cp15.c13_fcse);
-    qemu_put_be32(f, env->cp15.c13_context);
-
-    qemu_put_be32(f, env->features);
-
-    if (arm_feature(env, ARM_FEATURE_VFP)) {
-        for (i = 0;  i < 16; i++) {
-            CPU_DoubleU u;
-            u.d = env->vfp.regs[i];
-            qemu_put_be32(f, u.l.upper);
-            qemu_put_be32(f, u.l.lower);
-        }
-        for (i = 0; i < 16; i++) {
-            qemu_put_be32(f, env->vfp.xregs[i]);
+    for(i = 0; i <= nb_drives; i++) {
+        bs1 = drives_table[i].bdrv;
+        if (bdrv_has_snapshot(bs1)) {
+            ret = bdrv_snapshot_delete(bs1, name);
+            if (ret < 0) {
+                if (ret == -ENOTSUP)
+                    term_printf("Snapshots not supported on device '%s'\n",
+                                bdrv_get_device_name(bs1));
+                else
+                    term_printf("Error %d while deleting snapshot on '%s'\n",
+                                ret, bdrv_get_device_name(bs1));
+            }
         }
-
-        /* TODO: Should use proper FPSCR access functions.  */
-        qemu_put_be32(f, env->vfp.vec_len);
-        qemu_put_be32(f, env->vfp.vec_stride);
     }
 }
 
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
+void do_info_snapshots(void)
 {
-    CPUARMState *env = (CPUARMState *)opaque;
-    int i;
+    BlockDriverState *bs, *bs1;
+    QEMUSnapshotInfo *sn_tab, *sn;
+    int nb_sns, i;
+    char buf[256];
 
-    if (version_id != ARM_CPU_SAVE_VERSION)
-        return -EINVAL;
-
-    for (i = 0; i < 16; i++) {
-        env->regs[i] = qemu_get_be32(f);
-    }
-    cpsr_write(env, qemu_get_be32(f), 0xffffffff);
-    env->spsr = qemu_get_be32(f);
-    for (i = 0; i < 6; i++) {
-        env->banked_spsr[i] = qemu_get_be32(f);
-        env->banked_r13[i] = qemu_get_be32(f);
-        env->banked_r14[i] = qemu_get_be32(f);
-    }
-    for (i = 0; i < 5; i++) {
-        env->usr_regs[i] = qemu_get_be32(f);
-        env->fiq_regs[i] = qemu_get_be32(f);
-    }
-    env->cp15.c0_cpuid    = qemu_get_be32(f);
-    env->cp15.c1_sys      = qemu_get_be32(f);
-    env->cp15.c1_coproc   = qemu_get_be32(f);
-    env->cp15.c2          = qemu_get_be32(f);
-    env->cp15.c3          = qemu_get_be32(f);
-    env->cp15.c5_insn     = qemu_get_be32(f);
-    env->cp15.c5_data     = qemu_get_be32(f);
-    env->cp15.c6_insn     = qemu_get_be32(f);
-    env->cp15.c6_data     = qemu_get_be32(f);
-    env->cp15.c9_insn     = qemu_get_be32(f);
-    env->cp15.c9_data     = qemu_get_be32(f);
-    env->cp15.c13_fcse    = qemu_get_be32(f);
-    env->cp15.c13_context = qemu_get_be32(f);
-
-    env->features = qemu_get_be32(f);
-
-    if (arm_feature(env, ARM_FEATURE_VFP)) {
-        for (i = 0;  i < 16; i++) {
-            CPU_DoubleU u;
-            u.l.upper = qemu_get_be32(f);
-            u.l.lower = qemu_get_be32(f);
-            env->vfp.regs[i] = u.d;
-        }
-        for (i = 0; i < 16; i++) {
-            env->vfp.xregs[i] = qemu_get_be32(f);
+    bs = get_bs_snapshots();
+    if (!bs) {
+        term_printf("No available block device supports snapshots\n");
+        return;
+    }
+    term_printf("Snapshot devices:");
+    for(i = 0; i <= nb_drives; i++) {
+        bs1 = drives_table[i].bdrv;
+        if (bdrv_has_snapshot(bs1)) {
+            if (bs == bs1)
+                term_printf(" %s", bdrv_get_device_name(bs1));
         }
-
-        /* TODO: Should use proper FPSCR access functions.  */
-        env->vfp.vec_len = qemu_get_be32(f);
-        env->vfp.vec_stride = qemu_get_be32(f);
     }
+    term_printf("\n");
 
-    return 0;
+    nb_sns = bdrv_snapshot_list(bs, &sn_tab);
+    if (nb_sns < 0) {
+        term_printf("bdrv_snapshot_list: error %d\n", nb_sns);
+        return;
+    }
+    term_printf("Snapshot list (from %s):\n", bdrv_get_device_name(bs));
+    term_printf("%s\n", bdrv_snapshot_dump(buf, sizeof(buf), NULL));
+    for(i = 0; i < nb_sns; i++) {
+        sn = &sn_tab[i];
+        term_printf("%s\n", bdrv_snapshot_dump(buf, sizeof(buf), sn));
+    }
+    qemu_free(sn_tab);
 }
 
-#else
-
-#warning No CPU save/restore functions
-
-#endif
-
 /***********************************************************/
 /* ram save/restore */
-
 /* we just avoid storing empty pages */
 static void ram_put_page(QEMUFile *f, const uint8_t *buf, int len)
 {
@@ -4992,32 +7201,318 @@ static int ram_get_page(QEMUFile *f, uint8_t *buf, int len)
     return 0;
 }
 
+static int ram_load_v1(QEMUFile *f, void *opaque)
+{
+    int ret;
+    ram_addr_t i;
+
+    if (qemu_get_be32(f) != phys_ram_size)
+        return -EINVAL;
+    for(i = 0; i < phys_ram_size; i+= TARGET_PAGE_SIZE) {
+        ret = ram_get_page(f, phys_ram_base + i, TARGET_PAGE_SIZE);
+        if (ret)
+            return ret;
+    }
+    return 0;
+}
+
+#define BDRV_HASH_BLOCK_SIZE 1024
+#define IOBUF_SIZE 4096
+#define RAM_CBLOCK_MAGIC 0xfabe
+
+typedef struct RamCompressState {
+    z_stream zstream;
+    QEMUFile *f;
+    uint8_t buf[IOBUF_SIZE];
+} RamCompressState;
+
+static int ram_compress_open(RamCompressState *s, QEMUFile *f)
+{
+    int ret;
+    memset(s, 0, sizeof(*s));
+    s->f = f;
+    ret = deflateInit2(&s->zstream, 1,
+                       Z_DEFLATED, 15,
+                       9, Z_DEFAULT_STRATEGY);
+    if (ret != Z_OK)
+        return -1;
+    s->zstream.avail_out = IOBUF_SIZE;
+    s->zstream.next_out = s->buf;
+    return 0;
+}
+
+static void ram_put_cblock(RamCompressState *s, const uint8_t *buf, int len)
+{
+    qemu_put_be16(s->f, RAM_CBLOCK_MAGIC);
+    qemu_put_be16(s->f, len);
+    qemu_put_buffer(s->f, buf, len);
+}
+
+static int ram_compress_buf(RamCompressState *s, const uint8_t *buf, int len)
+{
+    int ret;
+
+    s->zstream.avail_in = len;
+    s->zstream.next_in = (uint8_t *)buf;
+    while (s->zstream.avail_in > 0) {
+        ret = deflate(&s->zstream, Z_NO_FLUSH);
+        if (ret != Z_OK)
+            return -1;
+        if (s->zstream.avail_out == 0) {
+            ram_put_cblock(s, s->buf, IOBUF_SIZE);
+            s->zstream.avail_out = IOBUF_SIZE;
+            s->zstream.next_out = s->buf;
+        }
+    }
+    return 0;
+}
+
+static void ram_compress_close(RamCompressState *s)
+{
+    int len, ret;
+
+    /* compress last bytes */
+    for(;;) {
+        ret = deflate(&s->zstream, Z_FINISH);
+        if (ret == Z_OK || ret == Z_STREAM_END) {
+            len = IOBUF_SIZE - s->zstream.avail_out;
+            if (len > 0) {
+                ram_put_cblock(s, s->buf, len);
+            }
+            s->zstream.avail_out = IOBUF_SIZE;
+            s->zstream.next_out = s->buf;
+            if (ret == Z_STREAM_END)
+                break;
+        } else {
+            goto fail;
+        }
+    }
+fail:
+    deflateEnd(&s->zstream);
+}
+
+typedef struct RamDecompressState {
+    z_stream zstream;
+    QEMUFile *f;
+    uint8_t buf[IOBUF_SIZE];
+} RamDecompressState;
+
+static int ram_decompress_open(RamDecompressState *s, QEMUFile *f)
+{
+    int ret;
+    memset(s, 0, sizeof(*s));
+    s->f = f;
+    ret = inflateInit(&s->zstream);
+    if (ret != Z_OK)
+        return -1;
+    return 0;
+}
+
+static int ram_decompress_buf(RamDecompressState *s, uint8_t *buf, int len)
+{
+    int ret, clen;
+
+    s->zstream.avail_out = len;
+    s->zstream.next_out = buf;
+    while (s->zstream.avail_out > 0) {
+        if (s->zstream.avail_in == 0) {
+            if (qemu_get_be16(s->f) != RAM_CBLOCK_MAGIC)
+                return -1;
+            clen = qemu_get_be16(s->f);
+            if (clen > IOBUF_SIZE)
+                return -1;
+            qemu_get_buffer(s->f, s->buf, clen);
+            s->zstream.avail_in = clen;
+            s->zstream.next_in = s->buf;
+        }
+        ret = inflate(&s->zstream, Z_PARTIAL_FLUSH);
+        if (ret != Z_OK && ret != Z_STREAM_END) {
+            return -1;
+        }
+    }
+    return 0;
+}
+
+static void ram_decompress_close(RamDecompressState *s)
+{
+    inflateEnd(&s->zstream);
+}
+
 static void ram_save(QEMUFile *f, void *opaque)
 {
-    int i;
+    ram_addr_t i;
+    RamCompressState s1, *s = &s1;
+    uint8_t buf[10];
+
     qemu_put_be32(f, phys_ram_size);
-    for(i = 0; i < phys_ram_size; i+= TARGET_PAGE_SIZE) {
-        ram_put_page(f, phys_ram_base + i, TARGET_PAGE_SIZE);
+    if (ram_compress_open(s, f) < 0)
+        return;
+    for(i = 0; i < phys_ram_size; i+= BDRV_HASH_BLOCK_SIZE) {
+#if 0
+        if (tight_savevm_enabled) {
+            int64_t sector_num;
+            int j;
+
+            /* find if the memory block is available on a virtual
+               block device */
+            sector_num = -1;
+            for(j = 0; j < nb_drives; j++) {
+                sector_num = bdrv_hash_find(drives_table[j].bdrv,
+                                            phys_ram_base + i,
+					    BDRV_HASH_BLOCK_SIZE);
+                if (sector_num >= 0)
+                    break;
+            }
+            if (j == nb_drives)
+                goto normal_compress;
+            buf[0] = 1;
+            buf[1] = j;
+            cpu_to_be64wu((uint64_t *)(buf + 2), sector_num);
+            ram_compress_buf(s, buf, 10);
+        } else
+#endif
+        {
+            //        normal_compress:
+            buf[0] = 0;
+            ram_compress_buf(s, buf, 1);
+            ram_compress_buf(s, phys_ram_base + i, BDRV_HASH_BLOCK_SIZE);
+        }
     }
+    ram_compress_close(s);
 }
 
 static int ram_load(QEMUFile *f, void *opaque, int version_id)
 {
-    int i, ret;
+    RamDecompressState s1, *s = &s1;
+    uint8_t buf[10];
+    ram_addr_t i;
 
-    if (version_id != 1)
+    if (version_id == 1)
+        return ram_load_v1(f, opaque);
+    if (version_id != 2)
         return -EINVAL;
     if (qemu_get_be32(f) != phys_ram_size)
         return -EINVAL;
-    for(i = 0; i < phys_ram_size; i+= TARGET_PAGE_SIZE) {
-        ret = ram_get_page(f, phys_ram_base + i, TARGET_PAGE_SIZE);
-        if (ret)
-            return ret;
+    if (ram_decompress_open(s, f) < 0)
+        return -EINVAL;
+    for(i = 0; i < phys_ram_size; i+= BDRV_HASH_BLOCK_SIZE) {
+        if (ram_decompress_buf(s, buf, 1) < 0) {
+            fprintf(stderr, "Error while reading ram block header\n");
+            goto error;
+        }
+        if (buf[0] == 0) {
+            if (ram_decompress_buf(s, phys_ram_base + i, BDRV_HASH_BLOCK_SIZE) < 0) {
+                fprintf(stderr, "Error while reading ram block address=0x%08" PRIx64, (uint64_t)i);
+                goto error;
+            }
+        } else
+#if 0
+        if (buf[0] == 1) {
+            int bs_index;
+            int64_t sector_num;
+
+            ram_decompress_buf(s, buf + 1, 9);
+            bs_index = buf[1];
+            sector_num = be64_to_cpupu((const uint64_t *)(buf + 2));
+            if (bs_index >= nb_drives) {
+                fprintf(stderr, "Invalid block device index %d\n", bs_index);
+                goto error;
+            }
+            if (bdrv_read(drives_table[bs_index].bdrv, sector_num,
+	                  phys_ram_base + i,
+                          BDRV_HASH_BLOCK_SIZE / 512) < 0) {
+                fprintf(stderr, "Error while reading sector %d:%" PRId64 "\n",
+                        bs_index, sector_num);
+                goto error;
+            }
+        } else
+#endif
+        {
+        error:
+            printf("Error block header\n");
+            return -EINVAL;
+        }
     }
+    ram_decompress_close(s);
     return 0;
 }
 
 /***********************************************************/
+/* bottom halves (can be seen as timers which expire ASAP) */
+
+struct QEMUBH {
+    QEMUBHFunc *cb;
+    void *opaque;
+    int scheduled;
+    QEMUBH *next;
+};
+
+static QEMUBH *first_bh = NULL;
+
+QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
+{
+    QEMUBH *bh;
+    bh = qemu_mallocz(sizeof(QEMUBH));
+    if (!bh)
+        return NULL;
+    bh->cb = cb;
+    bh->opaque = opaque;
+    return bh;
+}
+
+int qemu_bh_poll(void)
+{
+    QEMUBH *bh, **pbh;
+    int ret;
+
+    ret = 0;
+    for(;;) {
+        pbh = &first_bh;
+        bh = *pbh;
+        if (!bh)
+            break;
+        ret = 1;
+        *pbh = bh->next;
+        bh->scheduled = 0;
+        bh->cb(bh->opaque);
+    }
+    return ret;
+}
+
+void qemu_bh_schedule(QEMUBH *bh)
+{
+    CPUState *env = cpu_single_env;
+    if (bh->scheduled)
+        return;
+    bh->scheduled = 1;
+    bh->next = first_bh;
+    first_bh = bh;
+
+    /* stop the currently executing CPU to execute the BH ASAP */
+    if (env) {
+        cpu_interrupt(env, CPU_INTERRUPT_EXIT);
+    }
+}
+
+void qemu_bh_cancel(QEMUBH *bh)
+{
+    QEMUBH **pbh;
+    if (bh->scheduled) {
+        pbh = &first_bh;
+        while (*pbh != bh)
+            pbh = &(*pbh)->next;
+        *pbh = bh->next;
+        bh->scheduled = 0;
+    }
+}
+
+void qemu_bh_delete(QEMUBH *bh)
+{
+    qemu_bh_cancel(bh);
+    qemu_free(bh);
+}
+
+/***********************************************************/
 /* machine registration */
 
 QEMUMachine *first_machine = NULL;
@@ -5033,7 +7528,7 @@ int qemu_register_machine(QEMUMachine *m)
     return 0;
 }
 
-QEMUMachine *find_machine(const char *name)
+static QEMUMachine *find_machine(const char *name)
 {
     QEMUMachine *m;
 
@@ -5047,10 +7542,15 @@ QEMUMachine *find_machine(const char *name)
 /***********************************************************/
 /* main execution loop */
 
-void gui_update(void *opaque)
+static void gui_update(void *opaque)
 {
-    display_state.dpy_refresh(&display_state);
-    qemu_mod_timer(gui_timer, GUI_REFRESH_INTERVAL + qemu_get_clock(rt_clock));
+    DisplayState *ds = opaque;
+    ds->dpy_refresh(ds);
+    qemu_mod_timer(ds->gui_timer,
+        (ds->gui_timer_interval ?
+	    ds->gui_timer_interval :
+	    GUI_REFRESH_INTERVAL)
+	+ qemu_get_clock(rt_clock));
 }
 
 struct vm_change_state_entry {
@@ -5113,6 +7613,7 @@ void vm_start(void)
         cpu_enable_ticks();
         vm_running = 1;
         vm_state_notify(1);
+        qemu_rearm_alarm_timer(alarm_timer);
     }
 }
 
@@ -5143,6 +7644,27 @@ static int reset_requested;
 static int shutdown_requested;
 static int powerdown_requested;
 
+int qemu_shutdown_requested(void)
+{
+    int r = shutdown_requested;
+    shutdown_requested = 0;
+    return r;
+}
+
+int qemu_reset_requested(void)
+{
+    int r = reset_requested;
+    reset_requested = 0;
+    return r;
+}
+
+int qemu_powerdown_requested(void)
+{
+    int r = powerdown_requested;
+    powerdown_requested = 0;
+    return r;
+}
+
 void qemu_register_reset(QEMUResetHandler *func, void *opaque)
 {
     QEMUResetEntry **pre, *re;
@@ -5169,7 +7691,11 @@ void qemu_system_reset(void)
 
 void qemu_system_reset_request(void)
 {
-    reset_requested = 1;
+    if (no_reboot) {
+        shutdown_requested = 1;
+    } else {
+        reset_requested = 1;
+    }
     if (cpu_single_env)
         cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
 }
@@ -5180,18 +7706,7 @@ extern void  AUD_cleanup();
 
 void qemu_system_shutdown_request(void)
 {
-    int i;
     shutdown_requested = 1;
-
-    for (i = 0; i < MAX_DISKS; i++) {
-        if (bs_table[i])
-            bdrv_close(bs_table[i]);
-    }
-
-#ifdef HAS_AUDIO
-    // this is necessary to avoid a deadlock in SDL when quitting
-    AUD_cleanup();
-#endif
     if (cpu_single_env)
         cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
 }
@@ -5245,9 +7760,12 @@ static MainLoopStats   main_loop_stats;
 
 void main_loop_wait(int timeout)
 {
-    IOHandlerRecord *ioh, *ioh_next;
+    IOHandlerRecord *ioh;
     fd_set rfds, wfds, xfds;
     int ret, nfds;
+#ifdef _WIN32
+    int ret2, i;
+#endif
     struct timeval tv;
     PollingEntry *pe;
 
@@ -5256,12 +7774,6 @@ void main_loop_wait(int timeout)
 	int64   time_after_select;
 #endif
 
-#if 0
-    /* disable timeout when we're in polling mode */
-	if (qemu_milli_needed > 0)
-		timeout = 0;
-#endif
-
     /* XXX: need to suppress polling by better using win32 events */
     ret = 0;
     for(pe = first_polling_entry; pe != NULL; pe = pe->next) {
@@ -5274,12 +7786,14 @@ void main_loop_wait(int timeout)
 
         ret = WaitForMultipleObjects(w->num, w->events, FALSE, timeout);
         if (WAIT_OBJECT_0 + 0 <= ret && ret <= WAIT_OBJECT_0 + w->num - 1) {
+            if (w->func[ret - WAIT_OBJECT_0])
+                w->func[ret - WAIT_OBJECT_0](w->opaque[ret - WAIT_OBJECT_0]);
+
             /* Check for additional signaled events */
-            int  i;
             for(i = (ret - WAIT_OBJECT_0 + 1); i < w->num; i++) {
 
                 /* Check if event is signaled */
-                int  ret2 = WaitForSingleObject(w->events[i], 0);
+                ret2 = WaitForSingleObject(w->events[i], 0);
                 if(ret2 == WAIT_OBJECT_0) {
                     if (w->func[i])
                         w->func[i](w->opaque[i]);
@@ -5292,7 +7806,7 @@ void main_loop_wait(int timeout)
         } else if (ret == WAIT_TIMEOUT) {
         } else {
             err = GetLastError();
-            fprintf(stderr, "Wait error %d %d\n", ret, err);
+            fprintf(stderr, "WaitForMultipleObjects error %d %d\n", ret, err);
         }
     }
 #endif
@@ -5303,6 +7817,8 @@ void main_loop_wait(int timeout)
     FD_ZERO(&wfds);
     FD_ZERO(&xfds);
     for(ioh = first_io_handler; ioh != NULL; ioh = ioh->next) {
+        if (ioh->deleted)
+            continue;
         if (ioh->fd_read &&
             (!ioh->fd_read_poll ||
              ioh->fd_read_poll(ioh->opaque) != 0)) {
@@ -5333,35 +7849,28 @@ void main_loop_wait(int timeout)
 	time_after_select = mainloopstats_now();
 #endif
     if (ret > 0) {
-        for(ioh = first_io_handler; ioh != NULL; ioh = ioh_next) {
-            ioh_next = ioh->next;
+        IOHandlerRecord **pioh;
 
-            ioh->state = IOH_STATE_PENDING;
-
-            if (FD_ISSET(ioh->fd, &rfds)) {
+        for(ioh = first_io_handler; ioh != NULL; ioh = ioh->next) {
+            if (!ioh->deleted && ioh->fd_read && FD_ISSET(ioh->fd, &rfds)) {
                 ioh->fd_read(ioh->opaque);
-                if (ioh->state == IOH_STATE_CLOSED) {
-                    qemu_free(ioh);
-                    continue;
-                }
             }
-            if (FD_ISSET(ioh->fd, &wfds)) {
+            if (!ioh->deleted && ioh->fd_write && FD_ISSET(ioh->fd, &wfds)) {
                 ioh->fd_write(ioh->opaque);
-                if (ioh->state == IOH_STATE_CLOSED) {
-                    qemu_free(ioh);
-                    continue;
-                }
             }
+        }
 
-            ioh->state = 0;
+	/* remove deleted IO handlers */
+	pioh = &first_io_handler;
+	while (*pioh) {
+            ioh = *pioh;
+            if (ioh->deleted) {
+                *pioh = ioh->next;
+                qemu_free(ioh);
+            } else
+                pioh = &ioh->next;
         }
     }
-
-#if 0
-    if (qemu_milli_needed && qemu_milli_check())
-        _check_timers();
-#endif
-
 #if defined(CONFIG_SLIRP)
     if (slirp_inited) {
         if (ret < 0) {
@@ -5372,19 +7881,28 @@ void main_loop_wait(int timeout)
         slirp_select_poll(&rfds, &wfds, &xfds);
     }
 #endif
-#ifdef _WIN32
-    tap_win32_poll();
-#endif
     charpipe_poll();
 
     if (vm_running) {
-        qemu_run_virtual_timers();
+        if (likely(!(cur_cpu->singlestep_enabled & SSTEP_NOTIMER)))
+        qemu_run_timers(&active_timers[QEMU_TIMER_VIRTUAL],
+                        qemu_get_clock(vm_clock));
         /* run dma transfers, if any */
         DMA_run();
     }
 
-    qemu_run_realtime_timers();
-    qemu_rearm_alarm_timer();
+    /* real time timers */
+    qemu_run_timers(&active_timers[QEMU_TIMER_REALTIME],
+                    qemu_get_clock(rt_clock));
+
+    if (alarm_timer->flags & ALARM_FLAG_EXPIRED) {
+        alarm_timer->flags &= ~(ALARM_FLAG_EXPIRED);
+        qemu_rearm_alarm_timer(alarm_timer);
+    }
+
+    /* Check bottom-halves last in case any of the earlier events triggered
+       them.  */
+    qemu_bh_poll();
 
 #if MAIN_LOOP_STATS
 	{
@@ -5420,7 +7938,7 @@ void main_loop_wait(int timeout)
 #endif  /* MAIN_LOOP_STATS */
 }
 
-int main_loop(void)
+static int main_loop(void)
 {
     int ret, timeout;
 #ifdef CONFIG_PROFILER
@@ -5429,34 +7947,59 @@ int main_loop(void)
     CPUState *env;
 
     cur_cpu = first_cpu;
+    next_cpu = cur_cpu->next_cpu ?: first_cpu;
     for(;;) {
         if (vm_running) {
 
-            env = cur_cpu;
             for(;;) {
                 /* get next cpu */
-                env = env->next_cpu;
-                if (!env)
-                    env = first_cpu;
+                env = next_cpu;
 #ifdef CONFIG_PROFILER
                 ti = profile_getclock();
 #endif
+                if (use_icount) {
+                    int64_t count;
+                    int decr;
+                    qemu_icount -= (env->icount_decr.u16.low + env->icount_extra);
+                    env->icount_decr.u16.low = 0;
+                    env->icount_extra = 0;
+                    count = qemu_next_deadline();
+                    count = (count + (1 << icount_time_shift) - 1)
+                            >> icount_time_shift;
+                    qemu_icount += count;
+                    decr = (count > 0xffff) ? 0xffff : count;
+                    count -= decr;
+                    env->icount_decr.u16.low = decr;
+                    env->icount_extra = count;
+                }
                 ret = cpu_exec(env);
 #ifdef CONFIG_PROFILER
                 qemu_time += profile_getclock() - ti;
 #endif
-                if (event_pending) {
+                if (use_icount) {
+                    /* Fold pending instructions back into the
+                       instruction counter, and clear the interrupt flag.  */
+                    qemu_icount -= (env->icount_decr.u16.low
+                                    + env->icount_extra);
+                    env->icount_decr.u32 = 0;
+                    env->icount_extra = 0;
+                }
+                next_cpu = env->next_cpu ?: first_cpu;
+                if (event_pending && likely(ret != EXCP_DEBUG)) {
                     ret = EXCP_INTERRUPT;
                     event_pending = 0;
                     break;
                 }
+                if (ret == EXCP_HLT) {
+                    /* Give the next CPU a chance to run.  */
+                    cur_cpu = env;
+                    continue;
+                }
                 if (ret != EXCP_HALTED)
                     break;
                 /* all CPUs are halted ? */
-                if (env == cur_cpu) {
-                    ret = EXCP_HLT;
+                if (env == cur_cpu)
                     break;
-                }
             }
             cur_cpu = env;
 
@@ -5471,7 +8014,12 @@ int main_loop(void)
 
             if (shutdown_requested) {
                 ret = EXCP_INTERRUPT;
-                break;
+                if (no_shutdown) {
+                    vm_stop(0);
+                    no_shutdown = 0;
+                }
+                else
+                    break;
             }
             if (reset_requested) {
                 reset_requested = 0;
@@ -5480,22 +8028,57 @@ int main_loop(void)
             }
             if (powerdown_requested) {
                 powerdown_requested = 0;
-                qemu_system_powerdown();
+		qemu_system_powerdown();
                 ret = EXCP_INTERRUPT;
             }
-            if (ret == EXCP_DEBUG) {
+            if (unlikely(ret == EXCP_DEBUG)) {
                 vm_stop(EXCP_DEBUG);
             }
-            /* if hlt instruction, we wait until the next IRQ */
-            if (ret == EXCP_HLT) {
-                timeout = 10 /* _get_timers_timeout() */;
-                //write(2,"%",1);
-            }
-            else {
+            /* If all cpus are halted then wait until the next IRQ */
+            /* XXX: use timeout computed from timers */
+            if (ret == EXCP_HALTED) {
+                if (use_icount) {
+                    int64_t add;
+                    int64_t delta;
+                    /* Advance virtual time to the next event.  */
+                    if (use_icount == 1) {
+                        /* When not using an adaptive execution frequency
+                           we tend to get badly out of sync with real time,
+                           so just delay for a reasonable amount of time.  */
+                        delta = 0;
+                    } else {
+                        delta = cpu_get_icount() - cpu_get_clock();
+                    }
+                    if (delta > 0) {
+                        /* If virtual time is ahead of real time then just
+                           wait for IO.  */
+                        timeout = (delta / 1000000) + 1;
+                    } else {
+                        /* Wait for either IO to occur or the next
+                           timer event.  */
+                        add = qemu_next_deadline();
+                        /* We advance the timer before checking for IO.
+                           Limit the amount we advance so that early IO
+                           activity won't get the guest too far ahead.  */
+                        if (add > 10000000)
+                            add = 10000000;
+                        delta += add;
+                        add = (add + (1 << icount_time_shift) - 1)
+                              >> icount_time_shift;
+                        qemu_icount += add;
+                        timeout = delta / 1000000;
+                        if (timeout < 0)
+                            timeout = 0;
+                    }
+                } else {
+                    timeout = 10;
+                }
+            } else {
                 timeout = 0;
-                //write(2,"&",1);
             }
         } else {
+            if (shutdown_requested)
+                break;
             timeout = 10;
         }
 #ifdef CONFIG_PROFILER
@@ -5519,29 +8102,43 @@ ExitRequested:
 #endif
 }
 
-void help(void)
+static void help(int exitcode)
 {
-    printf("QEMU PC emulator version " QEMU_VERSION ", Copyright (c) 2003-2005 Fabrice Bellard\n"
+    printf("QEMU PC emulator version " QEMU_VERSION ", Copyright (c) 2003-2008 Fabrice Bellard\n"
            "usage: %s [options] [disk_image]\n"
            "\n"
            "'disk_image' is a raw hard image image for IDE hard disk 0\n"
            "\n"
            "Standard options:\n"
            "-M machine      select emulated machine (-M ? for list)\n"
+           "-cpu cpu        select CPU (-cpu ? for list)\n"
            "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n"
            "-hda/-hdb file  use 'file' as IDE hard disk 0/1 image\n"
            "-hdc/-hdd file  use 'file' as IDE hard disk 2/3 image\n"
            "-cdrom file     use 'file' as IDE cdrom image (cdrom is ide1 master)\n"
-           "-boot [a|c|d]   boot on floppy (a), hard disk (c) or CD-ROM (d)\n"
-	   "-snapshot       write to temporary files instead of disk image files\n"
+	   "-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]\n"
+           "       [,cyls=c,heads=h,secs=s[,trans=t]][,snapshot=on|off]\n"
+           "       [,cache=on|off][,format=f]\n"
+	   "                use 'file' as a drive image\n"
+           "-mtdblock file  use 'file' as on-board Flash memory image\n"
+           "-sd file        use 'file' as SecureDigital card image\n"
+           "-pflash file    use 'file' as a parallel flash image\n"
+           "-boot [a|c|d|n] boot on floppy (a), hard disk (c), CD-ROM (d), or network (n)\n"
+           "-snapshot       write to temporary files instead of disk image files\n"
+#ifdef CONFIG_SDL
+           "-no-frame       open SDL window without a frame and window decorations\n"
+           "-alt-grab       use Ctrl-Alt-Shift to grab mouse (instead of Ctrl-Alt)\n"
+           "-no-quit        disable SDL window close capability\n"
+#endif
 #ifdef TARGET_I386
            "-no-fd-bootchk  disable boot signature checking for floppy disks\n"
 #endif
            "-m megs         set virtual RAM size to megs MB [default=%d]\n"
            "-smp n          set the number of CPUs to 'n' [default=1]\n"
            "-nographic      disable graphical output and redirect serial I/Os to console\n"
+           "-portrait       rotate graphical output 90 deg left (only PXA LCD)\n"
 #ifndef _WIN32
-	   "-k language     use keyboard layout (for example \"fr\" for French)\n"
+           "-k language     use keyboard layout (for example \"fr\" for French)\n"
 #endif
 #ifdef HAS_AUDIO
            "-audio-help     print list of audio drivers and their options\n"
@@ -5560,6 +8157,7 @@ void help(void)
 #if defined(TARGET_PPC) || defined(TARGET_SPARC)
            "-g WxH[xDEPTH]  Set the initial graphical resolution and depth\n"
 #endif
+           "-name string    set the name of the guest\n"
            "\n"
            "Network options:\n"
            "-net nic[,vlan=n][,macaddr=addr][,model=type]\n"
@@ -5573,9 +8171,11 @@ void help(void)
            "-net tap[,vlan=n],ifname=name\n"
            "                connect the host TAP network interface to VLAN 'n'\n"
 #else
-           "-net tap[,vlan=n][,fd=h][,ifname=name][,script=file]\n"
-           "                connect the host TAP network interface to VLAN 'n' and use\n"
-           "                the network script 'file' (default=%s);\n"
+           "-net tap[,vlan=n][,fd=h][,ifname=name][,script=file][,downscript=dfile]\n"
+           "                connect the host TAP network interface to VLAN 'n' and use the\n"
+           "                network scripts 'file' (default=%s)\n"
+           "                and 'dfile' (default=%s);\n"
+           "                use '[down]script=no' to disable script execution;\n"
            "                use 'fd=h' to connect to an already opened TAP interface\n"
 #endif
            "-net socket[,vlan=n][,fd=h][,listen=[host]:port][,connect=host:port]\n"
@@ -5586,7 +8186,7 @@ void help(void)
            "                is provided, the default is '-net nic -net user'\n"
            "\n"
 #ifdef CONFIG_SLIRP
-           "-tftp prefix    allow tftp access to files starting with prefix [-net user]\n"
+           "-tftp dir       allow tftp access to files in dir [-net user]\n"
            "-bootp file     advertise file in BOOTP replies\n"
 #ifndef _WIN32
            "-smb dir        allow SMB access to files in 'dir' [-net user]\n"
@@ -5606,25 +8206,27 @@ void help(void)
            "-parallel dev   redirect the parallel port to char device 'dev'\n"
            "-pidfile file   Write PID to 'file'\n"
            "-S              freeze CPU at startup (use 'c' to start execution)\n"
-           "-s              wait gdb connection to port %d\n"
-           "-p port         change gdb connection port\n"
+           "-s              wait gdb connection to port\n"
+           "-p port         set gdb connection port [default=%s]\n"
            "-d item1,...    output log to %s (use -d ? for a list of log items)\n"
            "-hdachs c,h,s[,t]  force hard disk 0 physical geometry and the optional BIOS\n"
            "                translation (t=none or lba) (usually qemu can guess them)\n"
-           "-L path         set the directory for the BIOS and VGA BIOS\n"
+           "-L path         set the directory for the BIOS, VGA BIOS and keymaps\n"
 #ifdef USE_KQEMU
            "-kernel-kqemu   enable KQEMU full virtualization (default is user mode only)\n"
            "-no-kqemu       disable KQEMU kernel module usage\n"
 #endif
-#ifdef USE_CODE_COPY
-           "-no-code-copy   disable code copy acceleration\n"
-#endif
 #ifdef TARGET_I386
            "-std-vga        simulate a standard VGA card with VESA Bochs Extensions\n"
            "                (default is CL-GD5446 PCI VGA)\n"
            "-no-acpi        disable ACPI\n"
 #endif
-           "-loadvm file    start right away with a saved state (loadvm in monitor)\n"
+#ifdef CONFIG_CURSES
+           "-curses         use a curses/ncurses interface instead of SDL\n"
+#endif
+           "-no-reboot      exit instead of rebooting\n"
+           "-no-shutdown    stop before shutdown\n"
+           "-loadvm [tag|id]  start right away with a saved state (loadvm in monitor)\n"
 	   "-vnc display    start a VNC server on display\n"
 #ifdef CONFIG_TRACE
 	   "-trace file     create an execution trace in 'file' (implies -tracing on)\n"
@@ -5639,6 +8241,18 @@ void help(void)
 #ifdef CONFIG_NAND
            "-nand name[,readonly][,size=size][,pagesize=size][,extrasize=size][,erasepages=pages][,initfile=file][,file=file]"
 #endif
+#ifndef _WIN32
+	   "-daemonize      daemonize QEMU after initializing\n"
+#endif
+	   "-option-rom rom load a file, rom, into the option ROM space\n"
+#ifdef TARGET_SPARC
+           "-prom-env variable=value  set OpenBIOS nvram variables\n"
+#endif
+           "-clock          force the use of the given methods for timer alarm.\n"
+           "                To see what timers are available use -clock ?\n"
+           "-startdate      select initial date of the clock\n"
+           "-icount [N|auto]\n"
+           "                Enable virtual instruction counter with 2^N clock ticks per instruction\n"
            "\n"
            "During emulation, the following keys are useful:\n"
            "ctrl-alt-f      toggle full screen\n"
@@ -5651,10 +8265,11 @@ void help(void)
            DEFAULT_RAM_SIZE,
 #ifndef _WIN32
            DEFAULT_NETWORK_SCRIPT,
+           DEFAULT_NETWORK_DOWN_SCRIPT,
 #endif
            DEFAULT_GDBSTUB_PORT,
            "/tmp/qemu.log");
-    exit(1);
+    exit(exitcode);
 }
 
 #define HAS_ARG 0x0001
@@ -5663,13 +8278,18 @@ enum {
     QEMU_OPTION_h,
 
     QEMU_OPTION_M,
+    QEMU_OPTION_cpu,
     QEMU_OPTION_fda,
     QEMU_OPTION_fdb,
     QEMU_OPTION_hda,
     QEMU_OPTION_hdb,
     QEMU_OPTION_hdc,
     QEMU_OPTION_hdd,
+    QEMU_OPTION_drive,
     QEMU_OPTION_cdrom,
+    QEMU_OPTION_mtdblock,
+    QEMU_OPTION_sd,
+    QEMU_OPTION_pflash,
     QEMU_OPTION_boot,
     QEMU_OPTION_snapshot,
 #ifdef TARGET_I386
@@ -5677,6 +8297,7 @@ enum {
 #endif
     QEMU_OPTION_m,
     QEMU_OPTION_nographic,
+    QEMU_OPTION_portrait,
 #ifdef HAS_AUDIO
     QEMU_OPTION_audio_help,
     QEMU_OPTION_soundhw,
@@ -5698,15 +8319,22 @@ enum {
     QEMU_OPTION_d,
     QEMU_OPTION_hdachs,
     QEMU_OPTION_L,
-    QEMU_OPTION_no_code_copy,
+    QEMU_OPTION_bios,
     QEMU_OPTION_k,
     QEMU_OPTION_localtime,
+    QEMU_OPTION_cirrusvga,
+    QEMU_OPTION_vmsvga,
     QEMU_OPTION_g,
+    QEMU_OPTION_std_vga,
+    QEMU_OPTION_echr,
     QEMU_OPTION_monitor,
     QEMU_OPTION_serial,
     QEMU_OPTION_parallel,
     QEMU_OPTION_loadvm,
     QEMU_OPTION_full_screen,
+    QEMU_OPTION_no_frame,
+    QEMU_OPTION_alt_grab,
+    QEMU_OPTION_no_quit,
     QEMU_OPTION_pidfile,
     QEMU_OPTION_no_kqemu,
     QEMU_OPTION_kernel_kqemu,
@@ -5716,6 +8344,16 @@ enum {
     QEMU_OPTION_smp,
     QEMU_OPTION_vnc,
     QEMU_OPTION_no_acpi,
+    QEMU_OPTION_curses,
+    QEMU_OPTION_no_reboot,
+    QEMU_OPTION_no_shutdown,
+    QEMU_OPTION_show_cursor,
+    QEMU_OPTION_daemonize,
+    QEMU_OPTION_option_rom,
+    QEMU_OPTION_semihosting,
+    QEMU_OPTION_name,
+    QEMU_OPTION_prom_env,
+    QEMU_OPTION_old_param,
     QEMU_OPTION_noaudio,
     QEMU_OPTION_mic,
 #ifdef CONFIG_TRACE
@@ -5730,6 +8368,9 @@ enum {
     QEMU_OPTION_nand,
 #endif
     QEMU_OPTION_clock,
+    QEMU_OPTION_startdate,
+    QEMU_OPTION_tb_size,
+    QEMU_OPTION_icount,
 };
 
 typedef struct QEMUOption {
@@ -5740,15 +8381,21 @@ typedef struct QEMUOption {
 
 const QEMUOption qemu_options[] = {
     { "h", 0, QEMU_OPTION_h },
+    { "help", 0, QEMU_OPTION_h },
 
     { "M", HAS_ARG, QEMU_OPTION_M },
+    { "cpu", HAS_ARG, QEMU_OPTION_cpu },
     { "fda", HAS_ARG, QEMU_OPTION_fda },
     { "fdb", HAS_ARG, QEMU_OPTION_fdb },
     { "hda", HAS_ARG, QEMU_OPTION_hda },
     { "hdb", HAS_ARG, QEMU_OPTION_hdb },
     { "hdc", HAS_ARG, QEMU_OPTION_hdc },
     { "hdd", HAS_ARG, QEMU_OPTION_hdd },
+    { "drive", HAS_ARG, QEMU_OPTION_drive },
     { "cdrom", HAS_ARG, QEMU_OPTION_cdrom },
+    { "mtdblock", HAS_ARG, QEMU_OPTION_mtdblock },
+    { "sd", HAS_ARG, QEMU_OPTION_sd },
+    { "pflash", HAS_ARG, QEMU_OPTION_pflash },
     { "boot", HAS_ARG, QEMU_OPTION_boot },
     { "snapshot", 0, QEMU_OPTION_snapshot },
 #ifdef TARGET_I386
@@ -5756,6 +8403,7 @@ const QEMUOption qemu_options[] = {
 #endif
     { "m", HAS_ARG, QEMU_OPTION_m },
     { "nographic", 0, QEMU_OPTION_nographic },
+    { "portrait", 0, QEMU_OPTION_portrait },
     { "k", HAS_ARG, QEMU_OPTION_k },
 #ifdef HAS_AUDIO
     { "audio-help", 0, QEMU_OPTION_audio_help },
@@ -5782,7 +8430,7 @@ const QEMUOption qemu_options[] = {
     { "d", HAS_ARG, QEMU_OPTION_d },
     { "hdachs", HAS_ARG, QEMU_OPTION_hdachs },
     { "L", HAS_ARG, QEMU_OPTION_L },
-    { "no-code-copy", 0, QEMU_OPTION_no_code_copy },
+    { "bios", HAS_ARG, QEMU_OPTION_bios },
 #ifdef USE_KQEMU
     { "no-kqemu", 0, QEMU_OPTION_no_kqemu },
     { "kernel-kqemu", 0, QEMU_OPTION_kernel_kqemu },
@@ -5791,20 +8439,47 @@ const QEMUOption qemu_options[] = {
     { "g", HAS_ARG, QEMU_OPTION_g },
 #endif
     { "localtime", 0, QEMU_OPTION_localtime },
+    { "std-vga", 0, QEMU_OPTION_std_vga },
+    { "echr", HAS_ARG, QEMU_OPTION_echr },
     { "monitor", HAS_ARG, QEMU_OPTION_monitor },
     { "serial", HAS_ARG, QEMU_OPTION_serial },
     { "parallel", HAS_ARG, QEMU_OPTION_parallel },
     { "loadvm", HAS_ARG, QEMU_OPTION_loadvm },
     { "full-screen", 0, QEMU_OPTION_full_screen },
+#ifdef CONFIG_SDL
+    { "no-frame", 0, QEMU_OPTION_no_frame },
+    { "alt-grab", 0, QEMU_OPTION_alt_grab },
+    { "no-quit", 0, QEMU_OPTION_no_quit },
+#endif
     { "pidfile", HAS_ARG, QEMU_OPTION_pidfile },
     { "win2k-hack", 0, QEMU_OPTION_win2k_hack },
     { "usbdevice", HAS_ARG, QEMU_OPTION_usbdevice },
     { "smp", HAS_ARG, QEMU_OPTION_smp },
     { "vnc", HAS_ARG, QEMU_OPTION_vnc },
+#ifdef CONFIG_CURSES
+    { "curses", 0, QEMU_OPTION_curses },
+#endif
 
     /* temporary options */
     { "usb", 0, QEMU_OPTION_usb },
+    { "cirrusvga", 0, QEMU_OPTION_cirrusvga },
+    { "vmwarevga", 0, QEMU_OPTION_vmsvga },
     { "no-acpi", 0, QEMU_OPTION_no_acpi },
+    { "no-reboot", 0, QEMU_OPTION_no_reboot },
+    { "no-shutdown", 0, QEMU_OPTION_no_shutdown },
+    { "show-cursor", 0, QEMU_OPTION_show_cursor },
+    { "daemonize", 0, QEMU_OPTION_daemonize },
+    { "option-rom", HAS_ARG, QEMU_OPTION_option_rom },
+#if defined(TARGET_ARM) || defined(TARGET_M68K)
+    { "semihosting", 0, QEMU_OPTION_semihosting },
+#endif
+    { "name", HAS_ARG, QEMU_OPTION_name },
+#if defined(TARGET_SPARC)
+    { "prom-env", HAS_ARG, QEMU_OPTION_prom_env },
+#endif
+#if defined(TARGET_ARM)
+    { "old-param", 0, QEMU_OPTION_old_param },
+#endif
 
     /* android stuff */
     { "noaudio", 0, QEMU_OPTION_noaudio },
@@ -5824,85 +8499,45 @@ const QEMUOption qemu_options[] = {
     { NULL, 0, 0 },
 };
 
-#if defined (TARGET_I386) && defined(USE_CODE_COPY)
-
-/* this stack is only used during signal handling */
-#define SIGNAL_STACK_SIZE 32768
+/* password input */
 
-static uint8_t *signal_stack;
+int qemu_key_check(BlockDriverState *bs, const char *name)
+{
+    char password[256];
+    int i;
 
-#endif
+    if (!bdrv_is_encrypted(bs))
+        return 0;
 
-/* password input */
+    term_printf("%s is encrypted.\n", name);
+    for(i = 0; i < 3; i++) {
+        monitor_readline("Password: ", 1, password, sizeof(password));
+        if (bdrv_set_key(bs, password) == 0)
+            return 0;
+        term_printf("invalid password\n");
+    }
+    return -EPERM;
+}
 
 static BlockDriverState *get_bdrv(int index)
 {
-    BlockDriverState *bs;
-
-    if (index < 4) {
-        bs = bs_table[index];
-    } else if (index < 6) {
-        bs = fd_table[index - 4];
-    } else {
-        bs = NULL;
-    }
-    return bs;
+    if (index > nb_drives)
+        return NULL;
+    return drives_table[index].bdrv;
 }
 
 static void read_passwords(void)
 {
     BlockDriverState *bs;
-    int i, j;
-    char password[256];
+    int i;
 
     for(i = 0; i < 6; i++) {
         bs = get_bdrv(i);
-        if (bs && bdrv_is_encrypted(bs)) {
-            term_printf("%s is encrypted.\n", bdrv_get_device_name(bs));
-            for(j = 0; j < 3; j++) {
-                monitor_readline("Password: ",
-                                 1, password, sizeof(password));
-                if (bdrv_set_key(bs, password) == 0)
-                    break;
-                term_printf("invalid password\n");
-            }
-        }
+        if (bs)
+            qemu_key_check(bs, bdrv_get_device_name(bs));
     }
 }
 
-/* XXX: currently we cannot use simultaneously different CPUs */
-void register_machines(void)
-{
-#if defined(TARGET_I386)
-    qemu_register_machine(&pc_machine);
-    qemu_register_machine(&isapc_machine);
-#elif defined(TARGET_PPC)
-    qemu_register_machine(&heathrow_machine);
-    qemu_register_machine(&core99_machine);
-    qemu_register_machine(&prep_machine);
-#elif defined(TARGET_MIPS)
-    qemu_register_machine(&mips_machine);
-#elif defined(TARGET_SPARC)
-#ifdef TARGET_SPARC64
-    qemu_register_machine(&sun4u_machine);
-#else
-    qemu_register_machine(&sun4m_machine);
-#endif
-#elif defined(TARGET_ARM)
-    qemu_register_machine(&android_arm_machine);
-#if 0
-    qemu_register_machine(&integratorcp926_machine);
-    qemu_register_machine(&integratorcp1026_machine);
-    qemu_register_machine(&versatilepb_machine);
-    qemu_register_machine(&versatileab_machine);
-#endif
-#elif defined(TARGET_SH4)
-    qemu_register_machine(&shix_machine);
-#else
-#error unsupported CPU
-#endif
-}
-
 #ifdef HAS_AUDIO
 struct soundhw soundhw[] = {
 #if 0  /* ANDROID */
@@ -5923,6 +8558,16 @@ struct soundhw soundhw[] = {
         { .init_isa = SB16_init }
     },
 
+#ifdef CONFIG_CS4231A
+    {
+        "cs4231a",
+        "CS4231A",
+        0,
+        1,
+        { .init_isa = cs4231a_init }
+    },
+#endif
+
 #ifdef CONFIG_ADLIB
     {
         "adlib",
@@ -5947,6 +8592,16 @@ struct soundhw soundhw[] = {
     },
 #endif
 
+#ifdef CONFIG_AC97
+    {
+        "ac97",
+        "Intel 82801AA AC97 Audio",
+        0,
+        0,
+        { .init_pci = ac97_init }
+    },
+#endif
+
     {
         "es1370",
         "ENSONIQ AudioPCI ES1370",
@@ -5955,6 +8610,7 @@ struct soundhw soundhw[] = {
         { .init_pci = es1370_init }
     },
 #endif /* ANDROID */
+
     { NULL, NULL, 0, 0, { NULL } }
 };
 
@@ -6020,7 +8676,6 @@ static void select_soundhw (const char *optarg)
 #ifdef _WIN32
 static BOOL WINAPI qemu_ctrl_handler(DWORD type)
 {
-	//qemu_del_wait_object(host_alarm,NULL,NULL);
     exit(STATUS_CONTROL_C_EXIT);
     return TRUE;
 }
@@ -6028,33 +8683,60 @@ static BOOL WINAPI qemu_ctrl_handler(DWORD type)
 
 #define MAX_NET_CLIENTS 32
 
+#ifndef _WIN32
+
+static void termsig_handler(int signal)
+{
+    qemu_system_shutdown_request();
+}
+
+static void termsig_setup(void)
+{
+    struct sigaction act;
+
+    memset(&act, 0, sizeof(act));
+    act.sa_handler = termsig_handler;
+    sigaction(SIGINT,  &act, NULL);
+    sigaction(SIGHUP,  &act, NULL);
+    sigaction(SIGTERM, &act, NULL);
+}
+
+#endif
+
 int main(int argc, char **argv)
 {
 #ifdef CONFIG_GDBSTUB
-    int use_gdbstub, gdbstub_port;
+    int use_gdbstub;
+    const char *gdbstub_port;
 #endif
-    int i, cdrom_index;
-    int snapshot, linux_boot;
+    uint32_t boot_devices_bitmap = 0;
+    int i;
+    int snapshot, linux_boot, net_boot;
     const char *initrd_filename;
-    const char *hd_filename[MAX_DISKS], *fd_filename[MAX_FD];
     const char *kernel_filename, *kernel_cmdline;
+    const char *boot_devices = "";
     DisplayState *ds = &display_state;
     int cyls, heads, secs, translation;
-    int start_emulation = 1;
-    char net_clients[MAX_NET_CLIENTS][256];
+    const char *net_clients[MAX_NET_CLIENTS];
     int nb_net_clients;
+    int hda_index;
     int optind;
     const char *r, *optarg;
     CharDriverState *monitor_hd;
-    char monitor_device[128];
-    char serial_devices[MAX_SERIAL_PORTS][128];
+    const char *monitor_device;
+    const char *serial_devices[MAX_SERIAL_PORTS];
     int serial_device_index;
-    char parallel_devices[MAX_PARALLEL_PORTS][128];
+    const char *parallel_devices[MAX_PARALLEL_PORTS];
     int parallel_device_index;
     const char *loadvm = NULL;
     QEMUMachine *machine;
-    char usb_devices[MAX_USB_CMDLINE][128];
+    const char *cpu_model;
+    const char *usb_devices[MAX_USB_CMDLINE];
     int usb_devices_index;
+    int fds[2];
+    int tb_size;
+    const char *pid_file = NULL;
+    VLANState *vlan;
 
     LIST_INIT (&vm_change_state_head);
 #ifndef _WIN32
@@ -6089,49 +8771,44 @@ int main(int argc, char **argv)
 
     register_machines();
     machine = first_machine;
+    cpu_model = NULL;
     initrd_filename = NULL;
-    for(i = 0; i < MAX_FD; i++)
-        fd_filename[i] = NULL;
-    for(i = 0; i < MAX_DISKS; i++)
-        hd_filename[i] = NULL;
-    ram_size = DEFAULT_RAM_SIZE * 1024 * 1024;
+    ram_size = 0;
     vga_ram_size = VGA_RAM_SIZE;
-    bios_size = BIOS_SIZE;
 #ifdef CONFIG_GDBSTUB
     use_gdbstub = 0;
     gdbstub_port = DEFAULT_GDBSTUB_PORT;
 #endif
     snapshot = 0;
     nographic = 0;
+    curses = 0;
     kernel_filename = NULL;
     kernel_cmdline = "";
-#ifdef TARGET_PPC
-    cdrom_index = 1;
-#else
-    cdrom_index = 2;
-#endif
     cyls = heads = secs = 0;
     translation = BIOS_ATA_TRANSLATION_AUTO;
-    pstrcpy(monitor_device, sizeof(monitor_device), "vc");
+    monitor_device = "vc";
 
-    pstrcpy(serial_devices[0], sizeof(serial_devices[0]), "vc");
+    serial_devices[0] = "vc:80Cx24C";
     for(i = 1; i < MAX_SERIAL_PORTS; i++)
-        serial_devices[i][0] = '\0';
+        serial_devices[i] = NULL;
     serial_device_index = 0;
 
-    pstrcpy(parallel_devices[0], sizeof(parallel_devices[0]), "vc");
+    parallel_devices[0] = "vc:640x480";
     for(i = 1; i < MAX_PARALLEL_PORTS; i++)
-        parallel_devices[i][0] = '\0';
+        parallel_devices[i] = NULL;
     parallel_device_index = 0;
 
     usb_devices_index = 0;
 
     nb_net_clients = 0;
+    nb_drives = 0;
+    nb_drives_opt = 0;
+    hda_index = -1;
 
     nb_nics = 0;
-    /* default mac address of the first network interface */
 
-    android_audio_enabled = 1;
+    tb_size = 0;
+	android_audio_enabled = 1;
 
     optind = 1;
     for(;;) {
@@ -6139,11 +8816,14 @@ int main(int argc, char **argv)
             break;
         r = argv[optind];
         if (r[0] != '-') {
-            hd_filename[0] = argv[optind++];
+	    hda_index = drive_add(argv[optind++], HD_ALIAS, 0);
         } else {
             const QEMUOption *popt;
 
             optind++;
+            /* Treat --foo the same as -foo.  */
+            if (r[1] == '-')
+                r++;
             popt = qemu_options;
             for(;;) {
                 if (!popt->name) {
@@ -6177,23 +8857,52 @@ int main(int argc, char **argv)
                                m->name, m->desc,
                                m == first_machine ? " (default)" : "");
                     }
-                    exit(1);
+                    exit(*optarg != '?');
+                }
+                break;
+            case QEMU_OPTION_cpu:
+                /* hw initialization will check this */
+                if (*optarg == '?') {
+/* XXX: implement xxx_cpu_list for targets that still miss it */
+#if defined(cpu_list)
+                    cpu_list(stdout, &fprintf);
+#endif
+                    exit(0);
+                } else {
+                    cpu_model = optarg;
                 }
                 break;
             case QEMU_OPTION_initrd:
                 initrd_filename = optarg;
                 break;
             case QEMU_OPTION_hda:
+                if (cyls == 0)
+                    hda_index = drive_add(optarg, HD_ALIAS, 0);
+                else
+                    hda_index = drive_add(optarg, HD_ALIAS
+			     ",cyls=%d,heads=%d,secs=%d%s",
+                             0, cyls, heads, secs,
+                             translation == BIOS_ATA_TRANSLATION_LBA ?
+                                 ",trans=lba" :
+                             translation == BIOS_ATA_TRANSLATION_NONE ?
+                                 ",trans=none" : "");
+                 break;
             case QEMU_OPTION_hdb:
             case QEMU_OPTION_hdc:
             case QEMU_OPTION_hdd:
-                {
-                    int hd_index;
-                    hd_index = popt->index - QEMU_OPTION_hda;
-                    hd_filename[hd_index] = optarg;
-                    if (hd_index == cdrom_index)
-                        cdrom_index = -1;
-                }
+                drive_add(optarg, HD_ALIAS, popt->index - QEMU_OPTION_hda);
+                break;
+            case QEMU_OPTION_drive:
+                drive_add(NULL, "%s", optarg);
+	        break;
+            case QEMU_OPTION_mtdblock:
+                drive_add(optarg, MTD_ALIAS);
+                break;
+            case QEMU_OPTION_sd:
+                drive_add(optarg, SD_ALIAS);
+                break;
+            case QEMU_OPTION_pflash:
+                drive_add(optarg, PFLASH_ALIAS);
                 break;
             case QEMU_OPTION_snapshot:
                 snapshot = 1;
@@ -6232,13 +8941,28 @@ int main(int argc, char **argv)
                         fprintf(stderr, "qemu: invalid physical CHS format\n");
                         exit(1);
                     }
+		    if (hda_index != -1)
+                        snprintf(drives_opt[hda_index].opt,
+                                 sizeof(drives_opt[hda_index].opt),
+                                 HD_ALIAS ",cyls=%d,heads=%d,secs=%d%s",
+                                 0, cyls, heads, secs,
+			         translation == BIOS_ATA_TRANSLATION_LBA ?
+			     	    ",trans=lba" :
+			         translation == BIOS_ATA_TRANSLATION_NONE ?
+			             ",trans=none" : "");
                 }
                 break;
             case QEMU_OPTION_nographic:
-                pstrcpy(monitor_device, sizeof(monitor_device), "stdio");
-                pstrcpy(serial_devices[0], sizeof(serial_devices[0]), "stdio");
                 nographic = 1;
                 break;
+#ifdef CONFIG_CURSES
+            case QEMU_OPTION_curses:
+                curses = 1;
+                break;
+#endif
+            case QEMU_OPTION_portrait:
+                graphic_rotate = 1;
+                break;
             case QEMU_OPTION_kernel:
                 kernel_filename = optarg;
                 break;
@@ -6246,44 +8970,54 @@ int main(int argc, char **argv)
                 kernel_cmdline = optarg;
                 break;
             case QEMU_OPTION_cdrom:
-                if (cdrom_index >= 0) {
-                    hd_filename[cdrom_index] = optarg;
-                }
+                drive_add(optarg, CDROM_ALIAS);
                 break;
             case QEMU_OPTION_boot:
-                boot_device = optarg[0];
-                if (boot_device != 'a' &&
-#ifdef TARGET_SPARC
-		    // Network boot
-		    boot_device != 'n' &&
-#endif
-                    boot_device != 'c' && boot_device != 'd') {
-                    fprintf(stderr, "qemu: invalid boot device '%c'\n", boot_device);
-                    exit(1);
+                boot_devices = optarg;
+                /* We just do some generic consistency checks */
+                {
+                    /* Could easily be extended to 64 devices if needed */
+                    const char *p;
+                    
+                    boot_devices_bitmap = 0;
+                    for (p = boot_devices; *p != '\0'; p++) {
+                        /* Allowed boot devices are:
+                         * a b     : floppy disk drives
+                         * c ... f : IDE disk drives
+                         * g ... m : machine implementation dependant drives
+                         * n ... p : network devices
+                         * It's up to each machine implementation to check
+                         * if the given boot devices match the actual hardware
+                         * implementation and firmware features.
+                         */
+                        if (*p < 'a' || *p > 'q') {
+                            fprintf(stderr, "Invalid boot device '%c'\n", *p);
+                            exit(1);
+                        }
+                        if (boot_devices_bitmap & (1 << (*p - 'a'))) {
+                            fprintf(stderr,
+                                    "Boot device '%c' was given twice\n",*p);
+                            exit(1);
+                        }
+                        boot_devices_bitmap |= 1 << (*p - 'a');
+                    }
                 }
                 break;
             case QEMU_OPTION_fda:
-                fd_filename[0] = optarg;
-                break;
             case QEMU_OPTION_fdb:
-                fd_filename[1] = optarg;
+                drive_add(optarg, FD_ALIAS, popt->index - QEMU_OPTION_fda);
                 break;
 #ifdef TARGET_I386
             case QEMU_OPTION_no_fd_bootchk:
                 fd_bootchk = 0;
                 break;
 #endif
-            case QEMU_OPTION_no_code_copy:
-                code_copy_enabled = 0;
-                break;
             case QEMU_OPTION_net:
                 if (nb_net_clients >= MAX_NET_CLIENTS) {
                     fprintf(stderr, "qemu: too many network clients\n");
                     exit(1);
                 }
-                pstrcpy(net_clients[nb_net_clients],
-                        sizeof(net_clients[0]),
-                        optarg);
+                net_clients[nb_net_clients] = optarg;
                 nb_net_clients++;
                 break;
 #ifdef CONFIG_SLIRP
@@ -6299,9 +9033,7 @@ int main(int argc, char **argv)
                 break;
 #endif
             case QEMU_OPTION_redir:
-                if ( net_slirp_redir(optarg) < 0 ) {
-                    fprintf(stderr, "qemu: could not set up redirection '%s'\n", optarg);
-                }
+                net_slirp_redir(optarg);
                 break;
 #endif
 #ifdef HAS_AUDIO
@@ -6314,21 +9046,41 @@ int main(int argc, char **argv)
                 break;
 #endif
             case QEMU_OPTION_h:
-                fprintf(stderr, "qemu: -h option used\n");
-                help();
+                help(0);
                 break;
-            case QEMU_OPTION_m:
-                ram_size = atoi(optarg) * 1024 * 1024;
-                if (ram_size <= 0) {
-                    fprintf(stderr, "qemu: invalid RAM size '%s'\n", optarg);
-                    help();
+            case QEMU_OPTION_m: {
+                uint64_t value;
+                char *ptr;
+
+                value = strtoul(optarg, &ptr, 10);
+                switch (*ptr) {
+                case 0: case 'M': case 'm':
+                    value <<= 20;
+                    break;
+                case 'G': case 'g':
+                    value <<= 30;
+                    break;
+                default:
+                    fprintf(stderr, "qemu: invalid ram size: %s\n", optarg);
+                    exit(1);
+                }
+
+                /* On 32-bit hosts, QEMU is limited by virtual address space */
+                if (value > (2047 << 20)
+#ifndef USE_KQEMU
+                    && HOST_LONG_BITS == 32
+#endif
+                    ) {
+                    fprintf(stderr, "qemu: at most 2047 MB RAM can be simulated\n");
+                    exit(1);
                 }
-                if (ram_size > PHYS_RAM_MAX_SIZE) {
-                    fprintf(stderr, "qemu: at most %d MB RAM can be simulated\n",
-                            PHYS_RAM_MAX_SIZE / (1024 * 1024));
+                if (value != (uint64_t)(ram_addr_t)value) {
+                    fprintf(stderr, "qemu: ram size too large\n");
                     exit(1);
                 }
+                ram_size = value;
                 break;
+            }
             case QEMU_OPTION_d:
                 {
                     int mask;
@@ -6350,7 +9102,7 @@ int main(int argc, char **argv)
                 use_gdbstub = 1;
                 break;
             case QEMU_OPTION_p:
-                gdbstub_port = atoi(optarg);
+                gdbstub_port = optarg;
                 break;
 #endif
             case QEMU_OPTION_L:
@@ -6361,7 +9113,7 @@ int main(int argc, char **argv)
                 fprintf(stderr, "Sorry, stopped launch is not supported in the Android emulator\n" );
                 exit(1);
 #else
-                start_emulation = 0;
+                autostart = 0;
                 break;
 #endif
 	    case QEMU_OPTION_k:
@@ -6370,6 +9122,18 @@ int main(int argc, char **argv)
             case QEMU_OPTION_localtime:
                 rtc_utc = 0;
                 break;
+            case QEMU_OPTION_cirrusvga:
+                cirrus_vga_enabled = 1;
+                vmsvga_enabled = 0;
+                break;
+            case QEMU_OPTION_vmsvga:
+                cirrus_vga_enabled = 0;
+                vmsvga_enabled = 1;
+                break;
+            case QEMU_OPTION_std_vga:
+                cirrus_vga_enabled = 0;
+                vmsvga_enabled = 0;
+                break;
             case QEMU_OPTION_g:
                 {
                     const char *p;
@@ -6404,16 +9168,23 @@ int main(int argc, char **argv)
                     graphic_depth = depth;
                 }
                 break;
+            case QEMU_OPTION_echr:
+                {
+                    char *r;
+                    term_escape_char = strtol(optarg, &r, 0);
+                    if (r == optarg)
+                        printf("Bad argument to echr\n");
+                    break;
+                }
             case QEMU_OPTION_monitor:
-                pstrcpy(monitor_device, sizeof(monitor_device), optarg);
+                monitor_device = optarg;
                 break;
             case QEMU_OPTION_serial:
                 if (serial_device_index >= MAX_SERIAL_PORTS) {
                     fprintf(stderr, "qemu: too many serial ports\n");
                     exit(1);
                 }
-                pstrcpy(serial_devices[serial_device_index],
-                        sizeof(serial_devices[0]), optarg);
+                serial_devices[serial_device_index] = optarg;
                 serial_device_index++;
                 break;
             case QEMU_OPTION_parallel:
@@ -6421,8 +9192,7 @@ int main(int argc, char **argv)
                     fprintf(stderr, "qemu: too many parallel ports\n");
                     exit(1);
                 }
-                pstrcpy(parallel_devices[parallel_device_index],
-                        sizeof(parallel_devices[0]), optarg);
+                parallel_devices[parallel_device_index] = optarg;
                 parallel_device_index++;
                 break;
 	    case QEMU_OPTION_loadvm:
@@ -6431,8 +9201,19 @@ int main(int argc, char **argv)
             case QEMU_OPTION_full_screen:
                 full_screen = 1;
                 break;
+#ifdef CONFIG_SDL
+            case QEMU_OPTION_no_frame:
+                no_frame = 1;
+                break;
+            case QEMU_OPTION_alt_grab:
+                alt_grab = 1;
+                break;
+            case QEMU_OPTION_no_quit:
+                no_quit = 1;
+                break;
+#endif
             case QEMU_OPTION_pidfile:
-                create_pidfile(optarg);
+                pid_file = optarg;
                 break;
 #ifdef TARGET_I386
             case QEMU_OPTION_win2k_hack:
@@ -6456,9 +9237,7 @@ int main(int argc, char **argv)
                     fprintf(stderr, "Too many USB devices\n");
                     exit(1);
                 }
-                pstrcpy(usb_devices[usb_devices_index],
-                        sizeof(usb_devices[usb_devices_index]),
-                        optarg);
+                usb_devices[usb_devices_index] = optarg;
                 usb_devices_index++;
                 break;
             case QEMU_OPTION_smp:
@@ -6469,18 +9248,107 @@ int main(int argc, char **argv)
                 }
                 break;
 	    case QEMU_OPTION_vnc:
-		vnc_display = atoi(optarg);
-		if (vnc_display < 0) {
-		    fprintf(stderr, "Invalid VNC display\n");
-		    exit(1);
-		}
+		vnc_display = optarg;
 		break;
             case QEMU_OPTION_no_acpi:
                 acpi_enabled = 0;
                 break;
+            case QEMU_OPTION_no_reboot:
+                no_reboot = 1;
+                break;
+            case QEMU_OPTION_no_shutdown:
+                no_shutdown = 1;
+                break;
+            case QEMU_OPTION_show_cursor:
+                cursor_hide = 0;
+                break;
+	    case QEMU_OPTION_daemonize:
+		daemonize = 1;
+		break;
+	    case QEMU_OPTION_option_rom:
+		if (nb_option_roms >= MAX_OPTION_ROMS) {
+		    fprintf(stderr, "Too many option ROMs\n");
+		    exit(1);
+		}
+		option_rom[nb_option_roms] = optarg;
+		nb_option_roms++;
+		break;
+            case QEMU_OPTION_semihosting:
+                semihosting_enabled = 1;
+                break;
+            case QEMU_OPTION_name:
+                qemu_name = optarg;
+                break;
+#ifdef TARGET_SPARC
+            case QEMU_OPTION_prom_env:
+                if (nb_prom_envs >= MAX_PROM_ENVS) {
+                    fprintf(stderr, "Too many prom variables\n");
+                    exit(1);
+                }
+                prom_envs[nb_prom_envs] = optarg;
+                nb_prom_envs++;
+                break;
+#endif
+#ifdef TARGET_ARM
+            case QEMU_OPTION_old_param:
+                old_param = 1;
+                break;
+#endif
             case QEMU_OPTION_clock:
-                qemu_configure_alarms(optarg);
+                configure_alarms(optarg);
+                break;
+            case QEMU_OPTION_startdate:
+                {
+                    struct tm tm;
+                    time_t rtc_start_date;
+                    if (!strcmp(optarg, "now")) {
+                        rtc_date_offset = -1;
+                    } else {
+                        if (sscanf(optarg, "%d-%d-%dT%d:%d:%d",
+                               &tm.tm_year,
+                               &tm.tm_mon,
+                               &tm.tm_mday,
+                               &tm.tm_hour,
+                               &tm.tm_min,
+                               &tm.tm_sec) == 6) {
+                            /* OK */
+                        } else if (sscanf(optarg, "%d-%d-%d",
+                                          &tm.tm_year,
+                                          &tm.tm_mon,
+                                          &tm.tm_mday) == 3) {
+                            tm.tm_hour = 0;
+                            tm.tm_min = 0;
+                            tm.tm_sec = 0;
+                        } else {
+                            goto date_fail;
+                        }
+                        tm.tm_year -= 1900;
+                        tm.tm_mon--;
+                        rtc_start_date = mktimegm(&tm);
+                        if (rtc_start_date == -1) {
+                        date_fail:
+                            fprintf(stderr, "Invalid date format. Valid format are:\n"
+                                    "'now' or '2006-06-17T16:01:21' or '2006-06-17'\n");
+                            exit(1);
+                        }
+                        rtc_date_offset = time(NULL) - rtc_start_date;
+                    }
+                }
                 break;
+            case QEMU_OPTION_tb_size:
+                tb_size = strtol(optarg, NULL, 0);
+                if (tb_size < 0)
+                    tb_size = 0;
+                break;
+            case QEMU_OPTION_icount:
+                use_icount = 1;
+                if (strcmp(optarg, "auto") == 0) {
+                    icount_time_shift = -1;
+                } else {
+                    icount_time_shift = strtol(optarg, NULL, 0);
+                }
+                break;
+
             case QEMU_OPTION_noaudio:
                 android_audio_enabled = 0;
                 break;
@@ -6525,66 +9393,184 @@ int main(int argc, char **argv)
         }
     }
 
+    if (nographic) {
+       if (serial_device_index == 0)
+           serial_devices[0] = "stdio";
+       if (parallel_device_index == 0)
+           parallel_devices[0] = "null";
+       if (strncmp(monitor_device, "vc", 2) == 0)
+           monitor_device = "stdio";
+    }
+
+#ifndef _WIN32
+    if (daemonize) {
+	pid_t pid;
+
+	if (pipe(fds) == -1)
+	    exit(1);
+
+	pid = fork();
+	if (pid > 0) {
+	    uint8_t status;
+	    ssize_t len;
+
+	    close(fds[1]);
+
+	again:
+            len = read(fds[0], &status, 1);
+            if (len == -1 && (errno == EINTR))
+                goto again;
+
+            if (len != 1)
+                exit(1);
+            else if (status == 1) {
+                fprintf(stderr, "Could not acquire pidfile\n");
+                exit(1);
+            } else
+                exit(0);
+	} else if (pid < 0)
+            exit(1);
+
+	setsid();
+
+	pid = fork();
+	if (pid > 0)
+	    exit(0);
+	else if (pid < 0)
+	    exit(1);
+
+	umask(027);
+
+        signal(SIGTSTP, SIG_IGN);
+        signal(SIGTTOU, SIG_IGN);
+        signal(SIGTTIN, SIG_IGN);
+    }
+#endif
+
+    if (pid_file && qemu_create_pidfile(pid_file) != 0) {
+        if (daemonize) {
+            uint8_t status = 1;
+            write(fds[1], &status, 1);
+        } else
+            fprintf(stderr, "Could not acquire pid file\n");
+        exit(1);
+    }
+
 #ifdef USE_KQEMU
     if (smp_cpus > 1)
         kqemu_allowed = 0;
 #endif
     linux_boot = (kernel_filename != NULL);
+    net_boot = (boot_devices_bitmap >> ('n' - 'a')) & 0xF;
 
-    if (!linux_boot &&
-        hd_filename[0] == '\0' &&
-        (cdrom_index >= 0 && hd_filename[cdrom_index] == '\0') &&
-        fd_filename[0] == '\0') {
-        fprintf(stderr, "qemu: no kernel and no disk image specified\n");
-        help();
-    }
-    /* boot to cd by default if no hard disk */
-    if (hd_filename[0] == '\0' && boot_device == 'c') {
-        if (fd_filename[0] != '\0')
-            boot_device = 'a';
-        else
-            boot_device = 'd';
+    if (!linux_boot && net_boot == 0 &&
+        !machine->nodisk_ok && nb_drives_opt == 0)
+        help(1);
+
+    if (!linux_boot && *kernel_cmdline != '\0') {
+        fprintf(stderr, "-append only allowed with -kernel option\n");
+        exit(1);
     }
 
+    if (!linux_boot && initrd_filename != NULL) {
+        fprintf(stderr, "-initrd only allowed with -kernel option\n");
+        exit(1);
+    }
+
+    /* boot to floppy or the default cd if no hard disk defined yet */
+    if (!boot_devices[0]) {
+        boot_devices = "cad";
+    }
     setvbuf(stdout, NULL, _IOLBF, 0);
 
     init_timers();
-    qemu_init_alarm_timer( cpu_signal_alarm );
-
-#ifndef _WIN32
-    /* setup sigint handler */
-    {
-        struct sigaction user_act;
-
-        sigfillset(&user_act.sa_mask);
-        user_act.sa_flags = 0;
-#if defined (TARGET_I386) && defined(USE_CODE_COPY)
-        user_act.sa_flags |= SA_ONSTACK;
-#endif
-        user_act.sa_handler = sigint_handler;
-        sigaction(SIGINT, &user_act, NULL);
+    init_timer_alarm();
+    qemu_aio_init();
+    if (use_icount && icount_time_shift < 0) {
+        use_icount = 2;
+        /* 125MIPS seems a reasonable initial guess at the guest speed.
+           It will be corrected fairly quickly anyway.  */
+        icount_time_shift = 3;
+        init_icount_adjust();
     }
-#endif
 
+#ifdef _WIN32
     socket_init();
+#endif
 
     /* init network clients */
     if (nb_net_clients == 0) {
         /* if no clients, we use a default config */
-        pstrcpy(net_clients[0], sizeof(net_clients[0]),
-                "nic");
-        pstrcpy(net_clients[1], sizeof(net_clients[0]),
-                "user");
-        nb_net_clients = 2;
+        net_clients[nb_net_clients++] = "nic";
+#ifdef CONFIG_SLIRP
+        net_clients[nb_net_clients++] = "user";
+#endif
     }
 
     for(i = 0;i < nb_net_clients; i++) {
-        if (net_client_init(net_clients[i]) < 0)
+        if (net_client_parse(net_clients[i]) < 0)
             exit(1);
     }
+    for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
+        if (vlan->nb_guest_devs == 0 && vlan->nb_host_devs == 0)
+            continue;
+        if (vlan->nb_guest_devs == 0)
+            fprintf(stderr, "Warning: vlan %d with no nics\n", vlan->id);
+        if (vlan->nb_host_devs == 0)
+            fprintf(stderr,
+                    "Warning: vlan %d is not connected to host network\n",
+                    vlan->id);
+    }
+
+#ifdef TARGET_I386
+    /* XXX: this should be moved in the PC machine instantiation code */
+    if (net_boot != 0) {
+        int netroms = 0;
+	for (i = 0; i < nb_nics && i < 4; i++) {
+	    const char *model = nd_table[i].model;
+	    char buf[1024];
+            if (net_boot & (1 << i)) {
+                if (model == NULL)
+                    model = "ne2k_pci";
+                snprintf(buf, sizeof(buf), "%s/pxe-%s.bin", bios_dir, model);
+                if (get_image_size(buf) > 0) {
+                    if (nb_option_roms >= MAX_OPTION_ROMS) {
+                        fprintf(stderr, "Too many option ROMs\n");
+                        exit(1);
+                    }
+                    option_rom[nb_option_roms] = strdup(buf);
+                    nb_option_roms++;
+                    netroms++;
+                }
+            }
+	}
+	if (netroms == 0) {
+	    fprintf(stderr, "No valid PXE rom found for network device\n");
+	    exit(1);
+	}
+    }
+#endif
 
     /* init the memory */
-    phys_ram_size = ram_size + vga_ram_size + bios_size;
+    phys_ram_size = machine->ram_require & ~RAMSIZE_FIXED;
+
+    if (machine->ram_require & RAMSIZE_FIXED) {
+        if (ram_size > 0) {
+            if (ram_size < phys_ram_size) {
+                fprintf(stderr, "Machine `%s' requires %llu bytes of memory\n",
+                                machine->name, (unsigned long long) phys_ram_size);
+                exit(-1);
+            }
+
+            phys_ram_size = ram_size;
+        } else
+            ram_size = phys_ram_size;
+    } else {
+        if (ram_size == 0)
+            ram_size = DEFAULT_RAM_SIZE * 1024 * 1024;
+
+        phys_ram_size += ram_size;
+    }
 
     phys_ram_base = qemu_vmalloc(phys_ram_size);
     if (!phys_ram_base) {
@@ -6592,68 +9578,57 @@ int main(int argc, char **argv)
         exit(1);
     }
 
-    /* we always create the cdrom drive, even if no disk is there */
+    /* init the dynamic translator */
+    cpu_exec_init_all(tb_size * 1024 * 1024);
+
     bdrv_init();
-    if (cdrom_index >= 0) {
-        bs_table[cdrom_index] = bdrv_new("cdrom");
-        bdrv_set_type_hint(bs_table[cdrom_index], BDRV_TYPE_CDROM);
-    }
 
-    /* open the virtual block devices */
-    for(i = 0; i < MAX_DISKS; i++) {
-        if (hd_filename[i]) {
-            if (!bs_table[i]) {
-                char buf[64];
-                snprintf(buf, sizeof(buf), "hd%c", i + 'a');
-                bs_table[i] = bdrv_new(buf);
-            }
-            if (bdrv_open(bs_table[i], hd_filename[i], snapshot) < 0) {
-                fprintf(stderr, "qemu: could not open hard disk image '%s'\n",
-                        hd_filename[i]);
-                exit(1);
-            }
-            if (i == 0 && cyls != 0) {
-                bdrv_set_geometry_hint(bs_table[i], cyls, heads, secs);
-                bdrv_set_translation_hint(bs_table[i], translation);
-            }
-        }
-    }
+    /* we always create the cdrom drive, even if no disk is there */
 
-    /* we always create at least one floppy disk */
-    fd_table[0] = bdrv_new("fda");
-    bdrv_set_type_hint(fd_table[0], BDRV_TYPE_FLOPPY);
+    if (nb_drives_opt < MAX_DRIVES)
+        drive_add(NULL, CDROM_ALIAS);
 
-    for(i = 0; i < MAX_FD; i++) {
-        if (fd_filename[i]) {
-            if (!fd_table[i]) {
-                char buf[64];
-                snprintf(buf, sizeof(buf), "fd%c", i + 'a');
-                fd_table[i] = bdrv_new(buf);
-                bdrv_set_type_hint(fd_table[i], BDRV_TYPE_FLOPPY);
-            }
-            if (fd_filename[i] != '\0') {
-                if (bdrv_open(fd_table[i], fd_filename[i], snapshot) < 0) {
-                    fprintf(stderr, "qemu: could not open floppy disk image '%s'\n",
-                            fd_filename[i]);
-                    exit(1);
-                }
-            }
-        }
-    }
+    /* we always create at least one floppy */
+
+    if (nb_drives_opt < MAX_DRIVES)
+        drive_add(NULL, FD_ALIAS, 0);
+
+    /* we always create one sd slot, even if no card is in it */
 
-    register_savevm("timer", 0, 1, timer_save, timer_load, NULL);
-    register_savevm("ram", 0, 1, ram_save, ram_load, NULL);
+    if (nb_drives_opt < MAX_DRIVES)
+        drive_add(NULL, SD_ALIAS);
 
-    init_ioports();
+    /* open the virtual block devices */
+
+    for(i = 0; i < nb_drives_opt; i++)
+        if (drive_init(&drives_opt[i], snapshot, machine) == -1)
+	    exit(1);
+
+    register_savevm("timer", 0, 2, timer_save, timer_load, NULL);
+    register_savevm("ram", 0, 2, ram_save, ram_load, NULL);
 
     /* terminal init */
+    memset(&display_state, 0, sizeof(display_state));
     if (nographic) {
+        if (curses) {
+            fprintf(stderr, "fatal: -nographic can't be used with -curses\n");
+            exit(1);
+        }
+        /* nearly nothing to do */
         dumb_display_init(ds);
-    } else if (vnc_display != -1) {
-	vnc_display_init(ds, vnc_display);
-    } else {
+    } else if (vnc_display != NULL) {
+        vnc_display_init(ds);
+        if (vnc_display_open(ds, vnc_display) < 0)
+            exit(1);
+    } else
+#if defined(CONFIG_CURSES)
+    if (curses) {
+        curses_display_init(ds, full_screen);
+    } else
+#endif
+    {
 #if defined(CONFIG_SDL)
-        sdl_display_init(ds, full_screen);
+        sdl_display_init(ds, full_screen, no_frame);
 #elif defined(CONFIG_COCOA)
         cocoa_display_init(ds, full_screen);
 #else
@@ -6661,35 +9636,58 @@ int main(int argc, char **argv)
 #endif
     }
 
-    monitor_hd = qemu_chr_open(monitor_device);
-    if (!monitor_hd) {
-        fprintf(stderr, "qemu: could not open monitor device '%s'\n", monitor_device);
-        exit(1);
+#ifndef _WIN32
+    /* must be after terminal init, SDL library changes signal handlers */
+    termsig_setup();
+#endif
+
+    /* Maintain compatibility with multiple stdio monitors */
+    if (!strcmp(monitor_device,"stdio")) {
+        for (i = 0; i < MAX_SERIAL_PORTS; i++) {
+            const char *devname = serial_devices[i];
+            if (devname && !strcmp(devname,"mon:stdio")) {
+                monitor_device = NULL;
+                break;
+            } else if (devname && !strcmp(devname,"stdio")) {
+                monitor_device = NULL;
+                serial_devices[i] = "mon:stdio";
+                break;
+            }
+        }
+    }
+    if (monitor_device) {
+        monitor_hd = qemu_chr_open(monitor_device);
+        if (!monitor_hd) {
+            fprintf(stderr, "qemu: could not open monitor device '%s'\n", monitor_device);
+            exit(1);
+        }
+        monitor_init(monitor_hd, !nographic);
     }
-    monitor_init(monitor_hd, !nographic);
 
     for(i = 0; i < MAX_SERIAL_PORTS; i++) {
-        if (serial_devices[i][0] != '\0') {
-            serial_hds[i] = qemu_chr_open(serial_devices[i]);
+        const char *devname = serial_devices[i];
+        if (devname && strcmp(devname, "none")) {
+            serial_hds[i] = qemu_chr_open(devname);
             if (!serial_hds[i]) {
                 fprintf(stderr, "qemu: could not open serial device '%s'\n",
-                        serial_devices[i]);
+                        devname);
                 exit(1);
             }
-            if (!strcmp(serial_devices[i], "vc"))
+            if (strstart(devname, "vc", 0))
                 qemu_chr_printf(serial_hds[i], "serial%d console\r\n", i);
         }
     }
 
     for(i = 0; i < MAX_PARALLEL_PORTS; i++) {
-        if (parallel_devices[i][0] != '\0') {
-            parallel_hds[i] = qemu_chr_open(parallel_devices[i]);
+        const char *devname = parallel_devices[i];
+        if (devname && strcmp(devname, "none")) {
+            parallel_hds[i] = qemu_chr_open(devname);
             if (!parallel_hds[i]) {
                 fprintf(stderr, "qemu: could not open parallel device '%s'\n",
-                        parallel_devices[i]);
+                        devname);
                 exit(1);
             }
-            if (!strcmp(parallel_devices[i], "vc"))
+            if (strstart(devname, "vc", 0))
                 qemu_chr_printf(parallel_hds[i], "parallel%d console\r\n", i);
         }
     }
@@ -6697,9 +9695,6 @@ int main(int argc, char **argv)
 #ifdef CONFIG_TRACE
     if (trace_filename) {
         trace_init(trace_filename);
-        qemu_trace_enable();
-        qemu_trace_enable_gencode();
-        qemu_trace_enable_dyngen();
         dcache_init(dcache_size, dcache_ways, dcache_line_size,
                     dcache_replace_policy, dcache_load_miss_penalty,
                     dcache_store_miss_penalty);
@@ -6707,9 +9702,8 @@ int main(int argc, char **argv)
     }
 #endif
 
-    machine->init(ram_size, vga_ram_size, boot_device,
-                  ds, fd_filename, snapshot,
-                  kernel_filename, kernel_cmdline, initrd_filename);
+    machine->init(ram_size, vga_ram_size, boot_devices, ds,
+                  kernel_filename, kernel_cmdline, initrd_filename, cpu_model);
 
     /* init USB devices */
     if (usb_enabled) {
@@ -6721,37 +9715,88 @@ int main(int argc, char **argv)
         }
     }
 
-    gui_timer = qemu_new_timer(rt_clock, gui_update, NULL);
-    qemu_mod_timer(gui_timer, qemu_get_clock(rt_clock));
+    if (display_state.dpy_refresh) {
+        display_state.gui_timer = qemu_new_timer(rt_clock, gui_update, &display_state);
+        qemu_mod_timer(display_state.gui_timer, qemu_get_clock(rt_clock));
+    }
 
 #ifdef CONFIG_GDBSTUB
     if (use_gdbstub) {
+        /* XXX: use standard host:port notation and modify options
+           accordingly. */
         if (gdbserver_start(gdbstub_port) < 0) {
-            fprintf(stderr, "Could not open gdbserver socket on port %d\n",
+            fprintf(stderr, "qemu: could not open gdbstub device on port '%s'\n",
                     gdbstub_port);
             exit(1);
-        } else {
-            printf("Waiting gdb connection on port %d\n", gdbstub_port);
         }
-    } else
+    }
 #endif
+
     if (loadvm)
-        qemu_loadvm(loadvm);
+        do_loadvm(loadvm);
 
     /* call android-specific setup function */
     android_emulation_setup();
-    qemu_start_alarm_timer();
 
     {
         /* XXX: simplify init */
         read_passwords();
-        if (start_emulation) {
+        if (autostart) {
             vm_start();
         }
     }
 
+    if (daemonize) {
+	uint8_t status = 0;
+	ssize_t len;
+	int fd;
+
+    again1:
+	len = write(fds[1], &status, 1);
+	if (len == -1 && (errno == EINTR))
+	    goto again1;
+
+	if (len != 1)
+	    exit(1);
+
+	chdir("/");
+	TFR(fd = open("/dev/null", O_RDWR));
+	if (fd == -1)
+	    exit(1);
+
+	dup2(fd, 0);
+	dup2(fd, 1);
+	dup2(fd, 2);
+
+	close(fd);
+    }
+
     main_loop();
-    qemu_stop_alarm_timer();
+    quit_timers();
+
+#if !defined(_WIN32)
+    /* close network clients */
+    for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
+        VLANClientState *vc;
+
+        for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
+            if (vc->fd_read == tap_receive) {
+                char ifname[64];
+                TAPState *s = vc->opaque;
+
+                if (sscanf(vc->info_str, "tap: ifname=%63s ", ifname) == 1 &&
+                    s->down_script[0])
+                    launch_script(s->down_script, ifname, s->fd);
+            }
+#if defined(CONFIG_VDE)
+            if (vc->fd_read == vde_from_qemu) {
+                VDEState *s = vc->opaque;
+                vde_close(s->vde);
+            }
+#endif
+        }
+    }
+#endif
 
     android_emulation_teardown();
     return 0;
diff --git a/vl.h b/vl.h
deleted file mode 100644
index ff954e2..0000000
--- a/vl.h
+++ /dev/null
@@ -1,1032 +0,0 @@
-/*
- * QEMU System Emulator header
- *
- * Copyright (c) 2003 Fabrice Bellard
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#ifndef VL_H
-#define VL_H
-
-/* we put basic includes here to avoid repeating them in device drivers */
-#include <stdlib.h>
-#include <stdio.h>
-#include <stdarg.h>
-#include <string.h>
-#include <inttypes.h>
-#include <limits.h>
-#include <time.h>
-#include <ctype.h>
-#include <errno.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <sys/stat.h>
-
-#include "qemu_file.h"
-#include "qemu_timers.h"
-
-#ifndef O_LARGEFILE
-#define O_LARGEFILE 0
-#endif
-#ifndef O_BINARY
-#define O_BINARY 0
-#endif
-
-#ifdef _WIN32
-#include <windows.h>
-#define fsync _commit
-#define lseek _lseeki64
-#define ENOTSUP 4096
-extern int qemu_ftruncate64(int, int64_t);
-#define ftruncate qemu_ftruncate64
-
-
-static inline char *realpath(const char *path, char *resolved_path)
-{
-    _fullpath(resolved_path, path, _MAX_PATH);
-    return resolved_path;
-}
-
-#define PRId64 "I64d"
-#define PRIx64 "I64x"
-#define PRIu64 "I64u"
-#define PRIo64 "I64o"
-#endif
-
-#ifdef QEMU_TOOL
-
-/* we use QEMU_TOOL in the command line tools which do not depend on
-   the target CPU type */
-#include "config-host.h"
-#include <setjmp.h>
-#include "osdep.h"
-#include "bswap.h"
-
-#else
-
-#include "audio/audio.h"
-#include "cpu.h"
-#include "gdbstub.h"
-
-#endif /* !defined(QEMU_TOOL) */
-
-#ifndef glue
-#define xglue(x, y) x ## y
-#define glue(x, y) xglue(x, y)
-#define stringify(s)	tostring(s)
-#define tostring(s)	#s
-#endif
-
-#ifndef MIN
-#define MIN(a, b) (((a) < (b)) ? (a) : (b))
-#endif
-#ifndef MAX
-#define MAX(a, b) (((a) > (b)) ? (a) : (b))
-#endif
-
-/* vl.c */
-uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c);
-
-void hw_error(const char *fmt, ...);
-
-extern const char *bios_dir;
-
-void pstrcpy(char *buf, int buf_size, const char *str);
-char *pstrcat(char *buf, int buf_size, const char *s);
-int strstart(const char *str, const char *val, const char **ptr);
-
-extern int vm_running;
-
-typedef struct vm_change_state_entry VMChangeStateEntry;
-typedef void VMChangeStateHandler(void *opaque, int running);
-typedef void VMStopHandler(void *opaque, int reason);
-
-VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb,
-                                                     void *opaque);
-void qemu_del_vm_change_state_handler(VMChangeStateEntry *e);
-
-int qemu_add_vm_stop_handler(VMStopHandler *cb, void *opaque);
-void qemu_del_vm_stop_handler(VMStopHandler *cb, void *opaque);
-
-void vm_start(void);
-void vm_stop(int reason);
-
-typedef void QEMUResetHandler(void *opaque);
-
-void qemu_register_reset(QEMUResetHandler *func, void *opaque);
-void qemu_system_reset_request(void);
-void qemu_system_shutdown_request(void);
-void qemu_system_powerdown_request(void);
-#if !defined(TARGET_SPARC)
-// Please implement a power failure function to signal the OS
-#define qemu_system_powerdown() do{}while(0)
-#else
-void qemu_system_powerdown(void);
-#endif
-
-void main_loop_wait(int timeout);
-
-extern int ram_size;
-extern int bios_size;
-extern int rtc_utc;
-extern int graphic_width;
-extern int graphic_height;
-extern int graphic_depth;
-extern const char *keyboard_layout;
-extern int kqemu_allowed;
-extern int win2k_install_hack;
-extern int usb_enabled;
-extern int smp_cpus;
-
-/* XXX: make it dynamic */
-#if defined (TARGET_PPC) || defined (TARGET_SPARC64)
-#define BIOS_SIZE ((512 + 32) * 1024)
-#elif defined(TARGET_MIPS)
-#define BIOS_SIZE (128 * 1024)
-#else
-#define BIOS_SIZE ((256 + 64) * 1024)
-#endif
-
-/* keyboard/mouse support */
-
-#define MOUSE_EVENT_LBUTTON 0x01
-#define MOUSE_EVENT_RBUTTON 0x02
-#define MOUSE_EVENT_MBUTTON 0x04
-
-typedef void QEMUPutKBDEvent(void *opaque, int keycode);
-typedef void QEMUPutKBDEventN(void *opaque, int*  keycodes, int  count);
-typedef void QEMUPutMouseEvent(void *opaque, int dx, int dy, int dz, int buttons_state);
-typedef void QEMUPutGenericEvent(void*  opaque, int  type, int  code, int  value);
-
-void qemu_add_kbd_event_handler(QEMUPutKBDEvent *func, void *opaque);
-void qemu_add_kbd_event_n_handler(QEMUPutKBDEventN  *func, void  *opaque);
-void qemu_add_mouse_event_handler(QEMUPutMouseEvent *func, void *opaque, int absolute);
-void qemu_add_generic_event_handler(QEMUPutGenericEvent *func, void*  opaque);
-
-void kbd_put_keycode(int keycode);
-void kbd_put_keycodes(int* keycodes, int  count);
-void kbd_mouse_event(int dx, int dy, int dz, int buttons_state);
-int kbd_mouse_is_absolute(void);
-void kbd_generic_event(int  type, int  code, int  value);
-
-/* keysym is a unicode code except for special keys (see QEMU_KEY_xxx
-   constants) */
-#define QEMU_KEY_ESC1(c) ((c) | 0xe100)
-#define QEMU_KEY_BACKSPACE  0x007f
-#define QEMU_KEY_UP         QEMU_KEY_ESC1('A')
-#define QEMU_KEY_DOWN       QEMU_KEY_ESC1('B')
-#define QEMU_KEY_RIGHT      QEMU_KEY_ESC1('C')
-#define QEMU_KEY_LEFT       QEMU_KEY_ESC1('D')
-#define QEMU_KEY_HOME       QEMU_KEY_ESC1(1)
-#define QEMU_KEY_END        QEMU_KEY_ESC1(4)
-#define QEMU_KEY_PAGEUP     QEMU_KEY_ESC1(5)
-#define QEMU_KEY_PAGEDOWN   QEMU_KEY_ESC1(6)
-#define QEMU_KEY_DELETE     QEMU_KEY_ESC1(3)
-
-#define QEMU_KEY_CTRL_UP         0xe400
-#define QEMU_KEY_CTRL_DOWN       0xe401
-#define QEMU_KEY_CTRL_LEFT       0xe402
-#define QEMU_KEY_CTRL_RIGHT      0xe403
-#define QEMU_KEY_CTRL_HOME       0xe404
-#define QEMU_KEY_CTRL_END        0xe405
-#define QEMU_KEY_CTRL_PAGEUP     0xe406
-#define QEMU_KEY_CTRL_PAGEDOWN   0xe407
-
-void kbd_put_keysym(int keysym);
-
-/* async I/O support */
-
-typedef void IOReadHandler(void *opaque, const uint8_t *buf, int size);
-typedef int IOCanRWHandler(void *opaque);
-typedef void IOHandler(void *opaque);
-
-int qemu_set_fd_handler2(int fd,
-                         IOCanRWHandler *fd_read_poll,
-                         IOHandler *fd_read,
-                         IOHandler *fd_write,
-                         void *opaque);
-int qemu_set_fd_handler(int fd,
-                        IOHandler *fd_read,
-                        IOHandler *fd_write,
-                        void *opaque);
-
-/* Polling handling */
-
-/* return TRUE if no sleep should be done afterwards */
-typedef int PollingFunc(void *opaque);
-
-int qemu_add_polling_cb(PollingFunc *func, void *opaque);
-void qemu_del_polling_cb(PollingFunc *func, void *opaque);
-
-#ifdef _WIN32
-/* Wait objects handling */
-typedef void WaitObjectFunc(void *opaque);
-
-int qemu_add_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque);
-void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque);
-#endif
-
-/* character device */
-
-#define CHR_EVENT_BREAK 0 /* serial break char */
-#define CHR_EVENT_FOCUS 1 /* focus to this terminal (modal input needed) */
-
-
-
-#define CHR_IOCTL_SERIAL_SET_PARAMS   1
-typedef struct {
-    int speed;
-    int parity;
-    int data_bits;
-    int stop_bits;
-} QEMUSerialSetParams;
-
-#define CHR_IOCTL_SERIAL_SET_BREAK    2
-
-#define CHR_IOCTL_PP_READ_DATA        3
-#define CHR_IOCTL_PP_WRITE_DATA       4
-#define CHR_IOCTL_PP_READ_CONTROL     5
-#define CHR_IOCTL_PP_WRITE_CONTROL    6
-#define CHR_IOCTL_PP_READ_STATUS      7
-
-typedef void IOEventHandler(void *opaque, int event);
-
-typedef struct CharDriverState {
-    int (*chr_write)(struct CharDriverState *s, const uint8_t *buf, int len);
-    void (*chr_add_read_handler)(struct CharDriverState *s,
-                                 IOCanRWHandler *fd_can_read,
-                                 IOReadHandler *fd_read, void *opaque);
-    int (*chr_ioctl)(struct CharDriverState *s, int cmd, void *arg);
-    IOEventHandler *chr_event;
-    void (*chr_send_event)(struct CharDriverState *chr, int event);
-    void (*chr_close)(struct CharDriverState *chr);
-    void *opaque;
-} CharDriverState;
-
-void qemu_chr_printf(CharDriverState *s, const char *fmt, ...);
-int qemu_chr_write(CharDriverState *s, const uint8_t *buf, int len);
-void qemu_chr_send_event(CharDriverState *s, int event);
-void qemu_chr_add_read_handler(CharDriverState *s,
-                               IOCanRWHandler *fd_can_read,
-                               IOReadHandler *fd_read, void *opaque);
-void qemu_chr_add_event_handler(CharDriverState *s, IOEventHandler *chr_event);
-int qemu_chr_ioctl(CharDriverState *s, int cmd, void *arg);
-
-CharDriverState *qemu_chr_open(const char *filename);
-
-/* consoles */
-
-typedef struct DisplayState DisplayState;
-typedef struct TextConsole TextConsole;
-
-typedef void (*vga_hw_update_ptr)(void *);
-typedef void (*vga_hw_invalidate_ptr)(void *);
-typedef void (*vga_hw_screen_dump_ptr)(void *, const char *);
-
-TextConsole *graphic_console_init(DisplayState*          ds,
-                                  vga_hw_update_ptr      update,
-                                  vga_hw_invalidate_ptr  invalidate,
-                                  vga_hw_screen_dump_ptr screen_dump,
-                                  void*                  opaque);
-void vga_hw_update(void);
-void vga_hw_invalidate(void);
-void vga_hw_screen_dump(const char *filename);
-
-int is_graphic_console(void);
-CharDriverState *text_console_init(DisplayState *ds);
-void console_select(unsigned int index);
-
-/* serial ports */
-
-#define MAX_SERIAL_PORTS 4
-
-extern CharDriverState *serial_hds[MAX_SERIAL_PORTS];
-
-/* parallel ports */
-
-#define MAX_PARALLEL_PORTS 3
-
-extern CharDriverState *parallel_hds[MAX_PARALLEL_PORTS];
-
-/* VLANs support */
-
-typedef struct VLANClientState VLANClientState;
-
-struct VLANClientState {
-    IOReadHandler *fd_read;
-    /* Packets may still be sent if this returns zero.  It's used to
-       rate-limit the slirp code.  */
-    IOCanRWHandler *fd_can_read;
-    void *opaque;
-    struct VLANClientState *next;
-    struct VLANState *vlan;
-    char info_str[256];
-
-    /* statistics */
-    unsigned long  tx_packets;
-    unsigned long  rx_packets;
-    unsigned long  tx_bytes;
-    unsigned long  rx_bytes;
-    clock_t        clock_start;
-    clock_t        clock_last;
-    double         tx_max_packet_rate;
-    double         rx_max_packet_rate;
-    double         tx_max_byte_rate;
-    double         rx_max_byte_rate;
-};
-
-typedef struct VLANState {
-    int id;
-    VLANClientState *first_client;
-    struct VLANState *next;
-} VLANState;
-
-VLANState *qemu_find_vlan(int id);
-VLANClientState *qemu_new_vlan_client(VLANState *vlan,
-                                      IOReadHandler *fd_read,
-                                      IOCanRWHandler *fd_can_read,
-                                      void *opaque);
-int qemu_can_send_packet(VLANClientState *vc);
-void qemu_send_packet(VLANClientState *vc, const uint8_t *buf, int size);
-void qemu_handler_true(void *opaque);
-
-void do_info_network(void);
-
-/* TAP win32 */
-int tap_win32_init(VLANState *vlan, const char *ifname);
-void tap_win32_poll(void);
-
-void charpipe_win32_poll(void);
-
-/* NIC info */
-
-#define MAX_NICS 8
-
-typedef struct NICInfo {
-    uint8_t macaddr[6];
-    const char *model;
-    VLANState *vlan;
-} NICInfo;
-
-extern int nb_nics;
-extern NICInfo nd_table[MAX_NICS];
-
-/* VM Load/Save */
-
-typedef void SaveStateHandler(QEMUFile *f, void *opaque);
-typedef int LoadStateHandler(QEMUFile *f, void *opaque, int version_id);
-
-int qemu_loadvm(const char *filename);
-int qemu_savevm(const char *filename);
-int register_savevm(const char *idstr,
-                    int instance_id,
-                    int version_id,
-                    SaveStateHandler *save_state,
-                    LoadStateHandler *load_state,
-                    void *opaque);
-void qemu_get_timer(QEMUFile *f, QEMUTimer *ts);
-void qemu_put_timer(QEMUFile *f, QEMUTimer *ts);
-
-void cpu_save(QEMUFile *f, void *opaque);
-int cpu_load(QEMUFile *f, void *opaque, int version_id);
-
-/* block.c */
-typedef struct BlockDriverState BlockDriverState;
-typedef struct BlockDriver BlockDriver;
-
-extern BlockDriver bdrv_raw;
-extern BlockDriver bdrv_cow;
-extern BlockDriver bdrv_qcow;
-extern BlockDriver bdrv_vmdk;
-extern BlockDriver bdrv_cloop;
-extern BlockDriver bdrv_dmg;
-extern BlockDriver bdrv_bochs;
-extern BlockDriver bdrv_vpc;
-extern BlockDriver bdrv_vvfat;
-
-void bdrv_init(void);
-BlockDriver *bdrv_find_format(const char *format_name);
-int bdrv_create(BlockDriver *drv,
-                const char *filename, int64_t size_in_sectors,
-                const char *backing_file, int flags);
-BlockDriverState *bdrv_new(const char *device_name);
-void bdrv_delete(BlockDriverState *bs);
-int bdrv_open(BlockDriverState *bs, const char *filename, int snapshot);
-int bdrv_open2(BlockDriverState *bs, const char *filename, int snapshot,
-               BlockDriver *drv);
-void bdrv_close(BlockDriverState *bs);
-int bdrv_read(BlockDriverState *bs, int64_t sector_num,
-              uint8_t *buf, int nb_sectors);
-int bdrv_write(BlockDriverState *bs, int64_t sector_num,
-               const uint8_t *buf, int nb_sectors);
-void bdrv_get_geometry(BlockDriverState *bs, int64_t *nb_sectors_ptr);
-int bdrv_commit(BlockDriverState *bs);
-void bdrv_set_boot_sector(BlockDriverState *bs, const uint8_t *data, int size);
-/* Ensure contents are flushed to disk.  */
-void bdrv_flush(BlockDriverState *bs);
-
-#define BDRV_TYPE_HD     0
-#define BDRV_TYPE_CDROM  1
-#define BDRV_TYPE_FLOPPY 2
-#define BIOS_ATA_TRANSLATION_AUTO 0
-#define BIOS_ATA_TRANSLATION_NONE 1
-#define BIOS_ATA_TRANSLATION_LBA  2
-
-void bdrv_set_geometry_hint(BlockDriverState *bs,
-                            int cyls, int heads, int secs);
-void bdrv_set_type_hint(BlockDriverState *bs, int type);
-void bdrv_set_translation_hint(BlockDriverState *bs, int translation);
-void bdrv_get_geometry_hint(BlockDriverState *bs,
-                            int *pcyls, int *pheads, int *psecs);
-int bdrv_get_type_hint(BlockDriverState *bs);
-int bdrv_get_translation_hint(BlockDriverState *bs);
-int bdrv_is_removable(BlockDriverState *bs);
-int bdrv_is_read_only(BlockDriverState *bs);
-int bdrv_is_inserted(BlockDriverState *bs);
-int bdrv_is_locked(BlockDriverState *bs);
-void bdrv_set_locked(BlockDriverState *bs, int locked);
-void bdrv_set_change_cb(BlockDriverState *bs,
-                        void (*change_cb)(void *opaque), void *opaque);
-void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
-void bdrv_info(void);
-BlockDriverState *bdrv_find(const char *name);
-void bdrv_iterate(void (*it)(void *opaque, const char *name), void *opaque);
-int bdrv_is_encrypted(BlockDriverState *bs);
-int bdrv_set_key(BlockDriverState *bs, const char *key);
-void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
-                         void *opaque);
-const char *bdrv_get_device_name(BlockDriverState *bs);
-
-int qcow_get_cluster_size(BlockDriverState *bs);
-int qcow_compress_cluster(BlockDriverState *bs, int64_t sector_num,
-                          const uint8_t *buf);
-
-#ifndef QEMU_TOOL
-
-typedef void QEMUMachineInitFunc(int ram_size, int vga_ram_size,
-                                 int boot_device,
-             DisplayState *ds, const char **fd_filename, int snapshot,
-             const char *kernel_filename, const char *kernel_cmdline,
-             const char *initrd_filename);
-
-typedef struct QEMUMachine {
-    const char *name;
-    const char *desc;
-    QEMUMachineInitFunc *init;
-    struct QEMUMachine *next;
-} QEMUMachine;
-
-int qemu_register_machine(QEMUMachine *m);
-
-typedef void SetIRQFunc(void *opaque, int irq_num, int level);
-typedef void IRQRequestFunc(void *opaque, int level);
-
-/* ISA bus */
-
-extern target_phys_addr_t isa_mem_base;
-
-typedef void (IOPortWriteFunc)(void *opaque, uint32_t address, uint32_t data);
-typedef uint32_t (IOPortReadFunc)(void *opaque, uint32_t address);
-
-int register_ioport_read(int start, int length, int size,
-                         IOPortReadFunc *func, void *opaque);
-int register_ioport_write(int start, int length, int size,
-                          IOPortWriteFunc *func, void *opaque);
-void isa_unassign_ioport(int start, int length);
-
-/* PCI bus */
-
-extern target_phys_addr_t pci_mem_base;
-
-typedef struct PCIBus PCIBus;
-typedef struct PCIDevice PCIDevice;
-
-typedef void PCIConfigWriteFunc(PCIDevice *pci_dev,
-                                uint32_t address, uint32_t data, int len);
-typedef uint32_t PCIConfigReadFunc(PCIDevice *pci_dev,
-                                   uint32_t address, int len);
-typedef void PCIMapIORegionFunc(PCIDevice *pci_dev, int region_num,
-                                uint32_t addr, uint32_t size, int type);
-
-#define PCI_ADDRESS_SPACE_MEM		0x00
-#define PCI_ADDRESS_SPACE_IO		0x01
-#define PCI_ADDRESS_SPACE_MEM_PREFETCH	0x08
-
-typedef struct PCIIORegion {
-    uint32_t addr; /* current PCI mapping address. -1 means not mapped */
-    uint32_t size;
-    uint8_t type;
-    PCIMapIORegionFunc *map_func;
-} PCIIORegion;
-
-#define PCI_ROM_SLOT 6
-#define PCI_NUM_REGIONS 7
-
-#define PCI_DEVICES_MAX 64
-
-#define PCI_VENDOR_ID		0x00	/* 16 bits */
-#define PCI_DEVICE_ID		0x02	/* 16 bits */
-#define PCI_COMMAND		0x04	/* 16 bits */
-#define  PCI_COMMAND_IO		0x1	/* Enable response in I/O space */
-#define  PCI_COMMAND_MEMORY	0x2	/* Enable response in Memory space */
-#define PCI_CLASS_DEVICE        0x0a    /* Device class */
-#define PCI_INTERRUPT_LINE	0x3c	/* 8 bits */
-#define PCI_INTERRUPT_PIN	0x3d	/* 8 bits */
-#define PCI_MIN_GNT		0x3e	/* 8 bits */
-#define PCI_MAX_LAT		0x3f	/* 8 bits */
-
-struct PCIDevice {
-    /* PCI config space */
-    uint8_t config[256];
-
-    /* the following fields are read only */
-    PCIBus *bus;
-    int devfn;
-    char name[64];
-    PCIIORegion io_regions[PCI_NUM_REGIONS];
-
-    /* do not access the following fields */
-    PCIConfigReadFunc *config_read;
-    PCIConfigWriteFunc *config_write;
-    /* ??? This is a PC-specific hack, and should be removed.  */
-    int irq_index;
-};
-
-PCIDevice *pci_register_device(PCIBus *bus, const char *name,
-                               int instance_size, int devfn,
-                               PCIConfigReadFunc *config_read,
-                               PCIConfigWriteFunc *config_write);
-
-void pci_register_io_region(PCIDevice *pci_dev, int region_num,
-                            uint32_t size, int type,
-                            PCIMapIORegionFunc *map_func);
-
-void pci_set_irq(PCIDevice *pci_dev, int irq_num, int level);
-
-uint32_t pci_default_read_config(PCIDevice *d,
-                                 uint32_t address, int len);
-void pci_default_write_config(PCIDevice *d,
-                              uint32_t address, uint32_t val, int len);
-void generic_pci_save(QEMUFile* f, void *opaque);
-int generic_pci_load(QEMUFile* f, void *opaque, int version_id);
-
-typedef void (*pci_set_irq_fn)(PCIDevice *pci_dev, void *pic,
-                               int irq_num, int level);
-PCIBus *pci_register_bus(pci_set_irq_fn set_irq, void *pic, int devfn_min);
-
-void pci_nic_init(PCIBus *bus, NICInfo *nd);
-void pci_data_write(void *opaque, uint32_t addr, uint32_t val, int len);
-uint32_t pci_data_read(void *opaque, uint32_t addr, int len);
-int pci_bus_num(PCIBus *s);
-void pci_for_each_device(void (*fn)(PCIDevice *d));
-
-void pci_info(void);
-
-/* prep_pci.c */
-PCIBus *pci_prep_init(void);
-
-/* grackle_pci.c */
-PCIBus *pci_grackle_init(uint32_t base, void *pic);
-
-/* unin_pci.c */
-PCIBus *pci_pmac_init(void *pic);
-
-/* apb_pci.c */
-PCIBus *pci_apb_init(target_ulong special_base, target_ulong mem_base,
-                     void *pic);
-
-PCIBus *pci_vpb_init(void *pic);
-
-/* piix_pci.c */
-PCIBus *i440fx_init(void);
-int piix3_init(PCIBus *bus);
-void pci_bios_init(void);
-
-/* openpic.c */
-typedef struct openpic_t openpic_t;
-void openpic_set_irq(void *opaque, int n_IRQ, int level);
-openpic_t *openpic_init (PCIBus *bus, int *pmem_index, int nb_cpus,
-                         CPUState **envp);
-
-/* heathrow_pic.c */
-typedef struct HeathrowPICS HeathrowPICS;
-void heathrow_pic_set_irq(void *opaque, int num, int level);
-HeathrowPICS *heathrow_pic_init(int *pmem_index);
-
-#ifdef HAS_AUDIO
-struct soundhw {
-    const char *name;
-    const char *descr;
-    int enabled;
-    int isa;
-    union {
-        int (*init_isa) (AudioState *s);
-        int (*init_pci) (PCIBus *bus, AudioState *s);
-    } init;
-};
-
-extern struct soundhw soundhw[];
-#endif
-
-/* vga.c */
-
-#define VGA_RAM_SIZE (8192 * 1024)
-
-struct DisplayState {
-    uint8_t*  data;
-    int       linesize;
-    int       depth;
-    int       bgr; /* BGR color order instead of RGB. Only valid for depth == 32 */
-    int       width;
-    int       height;
-    void*     opaque;
-    int       rotation;  /* 0, 1, 2 or 3 */
-
-    void (*dpy_update)(struct DisplayState *s, int x, int y, int w, int h);
-    void (*dpy_resize)(struct DisplayState *s, int w, int h, int  rotation);
-    void (*dpy_refresh)(struct DisplayState *s);
-    void (*dpy_copy)(struct DisplayState *s, int src_x, int src_y, int dst_x, int dst_y, int w, int h);
-};
-
-static inline void dpy_update(DisplayState *s, int x, int y, int w, int h)
-{
-    s->dpy_update(s, x, y, w, h);
-}
-
-static inline void dpy_resize(DisplayState *s, int w, int h, int rot)
-{
-    s->dpy_resize(s, w, h, rot);
-}
-
-int vga_initialize(PCIBus *bus, DisplayState *ds, uint8_t *vga_ram_base,
-                   unsigned long vga_ram_offset, int vga_ram_size,
-                   unsigned long vga_bios_offset, int vga_bios_size);
-
-/* irq.h */
-typedef struct IRQState *qemu_irq;
-
-/* sdl.c */
-void sdl_display_init(DisplayState *ds, int full_screen);
-
-/* cocoa.m */
-void cocoa_display_init(DisplayState *ds, int full_screen);
-
-/* vnc.c */
-void vnc_display_init(DisplayState *ds, int display);
-
-/* ide.c */
-#define MAX_DISKS 4
-
-extern BlockDriverState *bs_table[MAX_DISKS];
-
-void isa_ide_init(int iobase, int iobase2, int irq,
-                  BlockDriverState *hd0, BlockDriverState *hd1);
-void pci_cmd646_ide_init(PCIBus *bus, BlockDriverState **hd_table,
-                         int secondary_ide_enabled);
-void pci_piix3_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn);
-int pmac_ide_init (BlockDriverState **hd_table,
-                   SetIRQFunc *set_irq, void *irq_opaque, int irq);
-
-/* cdrom.c */
-int cdrom_read_toc(int nb_sectors, uint8_t *buf, int msf, int start_track);
-int cdrom_read_toc_raw(int nb_sectors, uint8_t *buf, int msf, int session_num);
-
-/* es1370.c */
-int es1370_init (PCIBus *bus, AudioState *s);
-
-/* sb16.c */
-int SB16_init (AudioState *s);
-
-/* adlib.c */
-int Adlib_init (AudioState *s);
-
-/* gus.c */
-int GUS_init (AudioState *s);
-
-/* dma.c */
-typedef int (*DMA_transfer_handler) (void *opaque, int nchan, int pos, int size);
-int DMA_get_channel_mode (int nchan);
-int DMA_read_memory (int nchan, void *buf, int pos, int size);
-int DMA_write_memory (int nchan, void *buf, int pos, int size);
-void DMA_hold_DREQ (int nchan);
-void DMA_release_DREQ (int nchan);
-void DMA_schedule(int nchan);
-void DMA_run (void);
-void DMA_init (int high_page_enable);
-void DMA_register_channel (int nchan,
-                           DMA_transfer_handler transfer_handler,
-                           void *opaque);
-/* fdc.c */
-#define MAX_FD 2
-extern BlockDriverState *fd_table[MAX_FD];
-
-typedef struct fdctrl_t fdctrl_t;
-
-fdctrl_t *fdctrl_init (int irq_lvl, int dma_chann, int mem_mapped,
-                       uint32_t io_base,
-                       BlockDriverState **fds);
-int fdctrl_get_drive_type(fdctrl_t *fdctrl, int drive_num);
-
-/* ne2000.c */
-
-void isa_ne2000_init(int base, int irq, NICInfo *nd);
-void pci_ne2000_init(PCIBus *bus, NICInfo *nd);
-
-/* rtl8139.c */
-
-void pci_rtl8139_init(PCIBus *bus, NICInfo *nd);
-
-/* pcnet.c */
-
-void pci_pcnet_init(PCIBus *bus, NICInfo *nd);
-
-/* pckbd.c */
-
-void kbd_init(void);
-
-/* mc146818rtc.c */
-
-typedef struct RTCState RTCState;
-
-RTCState *rtc_init(int base, int irq);
-void rtc_set_memory(RTCState *s, int addr, int val);
-void rtc_set_date(RTCState *s, const struct tm *tm);
-
-/* serial.c */
-
-typedef struct SerialState SerialState;
-SerialState *serial_init(SetIRQFunc *set_irq, void *opaque,
-                         int base, int irq, CharDriverState *chr);
-SerialState *serial_mm_init (SetIRQFunc *set_irq, void *opaque,
-                             target_ulong base, int it_shift,
-                             int irq, CharDriverState *chr);
-
-/* parallel.c */
-
-typedef struct ParallelState ParallelState;
-ParallelState *parallel_init(int base, int irq, CharDriverState *chr);
-
-/* i8259.c */
-
-typedef struct PicState2 PicState2;
-extern PicState2 *isa_pic;
-void pic_set_irq(int irq, int level);
-void pic_set_irq_new(void *opaque, int irq, int level);
-PicState2 *pic_init(IRQRequestFunc *irq_request, void *irq_request_opaque);
-void pic_set_alt_irq_func(PicState2 *s, SetIRQFunc *alt_irq_func,
-                          void *alt_irq_opaque);
-int pic_read_irq(PicState2 *s);
-void pic_update_irq(PicState2 *s);
-uint32_t pic_intack_read(PicState2 *s);
-void pic_info(void);
-void irq_info(void);
-
-/* APIC */
-typedef struct IOAPICState IOAPICState;
-
-int apic_init(CPUState *env);
-int apic_get_interrupt(CPUState *env);
-IOAPICState *ioapic_init(void);
-void ioapic_set_irq(void *opaque, int vector, int level);
-
-/* i8254.c */
-
-#define PIT_FREQ 1193182
-
-typedef struct PITState PITState;
-
-PITState *pit_init(int base, int irq);
-void pit_set_gate(PITState *pit, int channel, int val);
-int pit_get_gate(PITState *pit, int channel);
-int pit_get_initial_count(PITState *pit, int channel);
-int pit_get_mode(PITState *pit, int channel);
-int pit_get_out(PITState *pit, int channel, int64_t current_time);
-
-/* pcspk.c */
-void pcspk_init(PITState *);
-int pcspk_audio_init(AudioState *);
-
-/* acpi.c */
-extern int acpi_enabled;
-void piix4_pm_init(PCIBus *bus, int devfn);
-void acpi_bios_init(void);
-
-/* pc.c */
-extern QEMUMachine pc_machine;
-extern QEMUMachine isapc_machine;
-extern int fd_bootchk;
-
-void ioport_set_a20(int enable);
-int ioport_get_a20(void);
-
-/* ppc.c */
-extern QEMUMachine prep_machine;
-extern QEMUMachine core99_machine;
-extern QEMUMachine heathrow_machine;
-
-/* mips_r4k.c */
-extern QEMUMachine mips_machine;
-
-/* shix.c */
-extern QEMUMachine shix_machine;
-
-#ifdef TARGET_PPC
-ppc_tb_t *cpu_ppc_tb_init (CPUState *env, uint32_t freq);
-#endif
-void PREP_debug_write (void *opaque, uint32_t addr, uint32_t val);
-
-extern CPUWriteMemoryFunc *PPC_io_write[];
-extern CPUReadMemoryFunc *PPC_io_read[];
-void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val);
-
-/* sun4m.c */
-extern QEMUMachine sun4m_machine;
-uint32_t iommu_translate(uint32_t addr);
-void pic_set_irq_cpu(int irq, int level, unsigned int cpu);
-
-/* iommu.c */
-void *iommu_init(uint32_t addr);
-uint32_t iommu_translate_local(void *opaque, uint32_t addr);
-
-/* lance.c */
-void lance_init(NICInfo *nd, int irq, uint32_t leaddr, uint32_t ledaddr);
-
-/* tcx.c */
-void tcx_init(DisplayState *ds, uint32_t addr, uint8_t *vram_base,
-	       unsigned long vram_offset, int vram_size, int width, int height);
-
-/* slavio_intctl.c */
-void *slavio_intctl_init();
-void slavio_intctl_set_cpu(void *opaque, unsigned int cpu, CPUState *env);
-void slavio_pic_info(void *opaque);
-void slavio_irq_info(void *opaque);
-void slavio_pic_set_irq(void *opaque, int irq, int level);
-void slavio_pic_set_irq_cpu(void *opaque, int irq, int level, unsigned int cpu);
-
-/* loader.c */
-int get_image_size(const char *filename);
-int load_image(const char *filename, uint8_t *addr);
-int load_elf(const char *filename, int64_t virt_to_phys_addend, uint64_t *pentry);
-int load_aout(const char *filename, uint8_t *addr);
-
-/* slavio_timer.c */
-void slavio_timer_init(uint32_t addr, int irq, int mode, unsigned int cpu);
-
-/* slavio_serial.c */
-SerialState *slavio_serial_init(int base, int irq, CharDriverState *chr1, CharDriverState *chr2);
-void slavio_serial_ms_kbd_init(int base, int irq);
-
-/* slavio_misc.c */
-void *slavio_misc_init(uint32_t base, int irq);
-void slavio_set_power_fail(void *opaque, int power_failing);
-
-/* esp.c */
-void esp_init(BlockDriverState **bd, int irq, uint32_t espaddr, uint32_t espdaddr);
-
-/* sun4u.c */
-extern QEMUMachine sun4u_machine;
-
-/* adb.c */
-
-#define MAX_ADB_DEVICES 16
-
-#define ADB_MAX_OUT_LEN 16
-
-typedef struct ADBDevice ADBDevice;
-
-/* buf = NULL means polling */
-typedef int ADBDeviceRequest(ADBDevice *d, uint8_t *buf_out,
-                              const uint8_t *buf, int len);
-typedef int ADBDeviceReset(ADBDevice *d);
-
-struct ADBDevice {
-    struct ADBBusState *bus;
-    int devaddr;
-    int handler;
-    ADBDeviceRequest *devreq;
-    ADBDeviceReset *devreset;
-    void *opaque;
-};
-
-typedef struct ADBBusState {
-    ADBDevice devices[MAX_ADB_DEVICES];
-    int nb_devices;
-    int poll_index;
-} ADBBusState;
-
-int adb_request(ADBBusState *s, uint8_t *buf_out,
-                const uint8_t *buf, int len);
-int adb_poll(ADBBusState *s, uint8_t *buf_out);
-
-ADBDevice *adb_register_device(ADBBusState *s, int devaddr,
-                               ADBDeviceRequest *devreq,
-                               ADBDeviceReset *devreset,
-                               void *opaque);
-void adb_kbd_init(ADBBusState *bus);
-void adb_mouse_init(ADBBusState *bus);
-
-/* cuda.c */
-
-extern ADBBusState adb_bus;
-int cuda_init(SetIRQFunc *set_irq, void *irq_opaque, int irq);
-
-#include "hw/usb.h"
-
-/* usb ports of the VM */
-
-void qemu_register_usb_port(USBPort *port, void *opaque, int index,
-                            usb_attachfn attach);
-
-#define VM_USB_HUB_SIZE 8
-
-void do_usb_add(const char *devname);
-void do_usb_del(const char *devname);
-void usb_info(void);
-
-/* scsi-disk.c */
-typedef struct SCSIDevice SCSIDevice;
-typedef void (*scsi_completionfn)(void *, uint32_t, int);
-
-SCSIDevice *scsi_disk_init(BlockDriverState *bdrv,
-                           scsi_completionfn completion,
-                           void *opaque);
-void scsi_disk_destroy(SCSIDevice *s);
-
-int32_t scsi_send_command(SCSIDevice *s, uint32_t tag, uint8_t *buf, int lun);
-int scsi_read_data(SCSIDevice *s, uint8_t *data, uint32_t len);
-int scsi_write_data(SCSIDevice *s, uint8_t *data, uint32_t len);
-
-/* versatilepb.c */
-extern QEMUMachine versatilepb_machine;
-extern QEMUMachine versatileab_machine;
-
-/* android_arm */
-extern QEMUMachine android_arm_machine;
-extern int android_audio_enabled;
-extern char* audio_input_source;
-
-
-/* smc91c111.c */
-void smc91c111_init(NICInfo *, uint32_t, qemu_irq);
-
-/* arm-timer.c */
-void sp804_init(uint32_t base, qemu_irq  irq);
-void icp_pit_init(uint32_t base, qemu_irq*  pic, int  irq);
-
-/* arm_boot.c */
-
-void arm_load_kernel(int ram_size, const char *kernel_filename,
-                     const char *kernel_cmdline, const char *initrd_filename,
-                     int board_id);
-
-/* NOR flash devices */
-typedef struct pflash_t pflash_t;
-
-pflash_t *pflash_register (target_ulong base, ram_addr_t off,
-                           BlockDriverState *bs,
-                           target_ulong sector_len, int nb_blocs, int width,
-                           uint16_t id0, uint16_t id1,
-                           uint16_t id2, uint16_t id3);
-
-#endif /* defined(QEMU_TOOL) */
-
-/* monitor.c */
-void monitor_init(CharDriverState *hd, int show_banner);
-void term_puts(const char *str);
-void term_vprintf(const char *fmt, va_list ap);
-void term_printf(const char *fmt, ...) __attribute__ ((__format__ (__printf__, 1, 2)));
-void term_flush(void);
-void term_print_help(void);
-void monitor_readline(const char *prompt, int is_password,
-                      char *buf, int buf_size);
-
-/* readline.c */
-typedef void ReadLineFunc(void *opaque, const char *str);
-
-extern int completion_index;
-void add_completion(const char *str);
-void readline_handle_byte(int ch);
-void readline_find_completion(const char *cmdline);
-const char *readline_get_history(unsigned int index);
-void readline_start(const char *prompt, int is_password,
-                    ReadLineFunc *readline_func, void *opaque);
-
-void kqemu_record_dump(void);
-
-#endif /* VL_H */
diff --git a/vnc.c b/vnc.c
index f832283..8b7d19f 100644
--- a/vnc.c
+++ b/vnc.c
@@ -1,9 +1,9 @@
 /*
  * QEMU VNC display driver
- * 
+ *
  * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
  * Copyright (C) 2006 Fabrice Bellard
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
@@ -23,37 +23,99 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
-#include "sockets.h"
+#include "qemu-common.h"
+#include "console.h"
+#include "sysemu.h"
+#include "qemu_socket.h"
+#include "qemu-timer.h"
 
 #define VNC_REFRESH_INTERVAL (1000 / 30)
 
 #include "vnc_keysym.h"
 #include "keymaps.c"
+#include "d3des.h"
+
+#ifdef CONFIG_VNC_TLS
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#endif /* CONFIG_VNC_TLS */
+
+// #define _VNC_DEBUG 1
+
+#ifdef _VNC_DEBUG
+#define VNC_DEBUG(fmt, ...) do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
+
+#if CONFIG_VNC_TLS && _VNC_DEBUG >= 2
+/* Very verbose, so only enabled for _VNC_DEBUG >= 2 */
+static void vnc_debug_gnutls_log(int level, const char* str) {
+    VNC_DEBUG("%d %s", level, str);
+}
+#endif /* CONFIG_VNC_TLS && _VNC_DEBUG */
+#else
+#define VNC_DEBUG(fmt, ...) do { } while (0)
+#endif
+
 
 typedef struct Buffer
 {
     size_t capacity;
     size_t offset;
-    char *buffer;
+    uint8_t *buffer;
 } Buffer;
 
 typedef struct VncState VncState;
 
-typedef int VncReadEvent(VncState *vs, char *data, size_t len);
+typedef int VncReadEvent(VncState *vs, uint8_t *data, size_t len);
 
 typedef void VncWritePixels(VncState *vs, void *data, int size);
 
 typedef void VncSendHextileTile(VncState *vs,
                                 int x, int y, int w, int h,
-                                uint32_t *last_bg, 
-                                uint32_t *last_fg,
+                                void *last_bg,
+                                void *last_fg,
                                 int *has_bg, int *has_fg);
 
 #define VNC_MAX_WIDTH 2048
 #define VNC_MAX_HEIGHT 2048
 #define VNC_DIRTY_WORDS (VNC_MAX_WIDTH / (16 * 32))
 
+#define VNC_AUTH_CHALLENGE_SIZE 16
+
+enum {
+    VNC_AUTH_INVALID = 0,
+    VNC_AUTH_NONE = 1,
+    VNC_AUTH_VNC = 2,
+    VNC_AUTH_RA2 = 5,
+    VNC_AUTH_RA2NE = 6,
+    VNC_AUTH_TIGHT = 16,
+    VNC_AUTH_ULTRA = 17,
+    VNC_AUTH_TLS = 18,
+    VNC_AUTH_VENCRYPT = 19
+};
+
+#ifdef CONFIG_VNC_TLS
+enum {
+    VNC_WIREMODE_CLEAR,
+    VNC_WIREMODE_TLS,
+};
+
+enum {
+    VNC_AUTH_VENCRYPT_PLAIN = 256,
+    VNC_AUTH_VENCRYPT_TLSNONE = 257,
+    VNC_AUTH_VENCRYPT_TLSVNC = 258,
+    VNC_AUTH_VENCRYPT_TLSPLAIN = 259,
+    VNC_AUTH_VENCRYPT_X509NONE = 260,
+    VNC_AUTH_VENCRYPT_X509VNC = 261,
+    VNC_AUTH_VENCRYPT_X509PLAIN = 262,
+};
+
+#define X509_CA_CERT_FILE "ca-cert.pem"
+#define X509_CA_CRL_FILE "ca-crl.pem"
+#define X509_SERVER_KEY_FILE "server-key.pem"
+#define X509_SERVER_CERT_FILE "server-cert.pem"
+
+#endif /* CONFIG_VNC_TLS */
+
 struct VncState
 {
     QEMUTimer *timer;
@@ -68,6 +130,34 @@ struct VncState
     int depth; /* internal VNC frame buffer byte per pixel */
     int has_resize;
     int has_hextile;
+    int has_pointer_type_change;
+    int has_WMVi;
+    int absolute;
+    int last_x;
+    int last_y;
+
+    int major;
+    int minor;
+
+    char *display;
+    char *password;
+    int auth;
+#ifdef CONFIG_VNC_TLS
+    int subauth;
+    int x509verify;
+
+    char *x509cacert;
+    char *x509cacrl;
+    char *x509cert;
+    char *x509key;
+#endif
+    char challenge[VNC_AUTH_CHALLENGE_SIZE];
+
+#ifdef CONFIG_VNC_TLS
+    int wiremode;
+    gnutls_session_t tls_session;
+#endif
+
     Buffer output;
     Buffer input;
     kbd_layout_t *kbd_layout;
@@ -75,14 +165,34 @@ struct VncState
     VncWritePixels *write_pixels;
     VncSendHextileTile *send_hextile_tile;
     int pix_bpp, pix_big_endian;
-    int red_shift, red_max, red_shift1;
-    int green_shift, green_max, green_shift1;
-    int blue_shift, blue_max, blue_shift1;
+    int client_red_shift, client_red_max, server_red_shift, server_red_max;
+    int client_green_shift, client_green_max, server_green_shift, server_green_max;
+    int client_blue_shift, client_blue_max, server_blue_shift, server_blue_max;
 
     VncReadEvent *read_handler;
     size_t read_handler_expect;
+    /* input */
+    uint8_t modifiers_state[256];
 };
 
+static VncState *vnc_state; /* needed for info vnc */
+
+void do_info_vnc(void)
+{
+    if (vnc_state == NULL)
+	term_printf("VNC server disabled\n");
+    else {
+	term_printf("VNC server active on: ");
+	term_print_filename(vnc_state->display);
+	term_printf("\n");
+
+	if (vnc_state->csock == -1)
+	    term_printf("No client connected\n");
+	else
+	    term_printf("Client connected\n");
+    }
+}
+
 /* TODO
    1) Get the queue working for IO.
    2) there is some weirdness when using the -S option (the screen is grey
@@ -99,6 +209,8 @@ static void vnc_flush(VncState *vs);
 static void vnc_update_client(void *opaque);
 static void vnc_client_read(void *opaque);
 
+static void vnc_colordepth(DisplayState *ds, int depth);
+
 static inline void vnc_set_bit(uint32_t *d, int k)
 {
     d[k >> 5] |= 1 << (k & 0x1f);
@@ -118,7 +230,7 @@ static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
         d[j++] = -1;
         n -= 32;
     }
-    if (n > 0) 
+    if (n > 0)
         d[j++] = (1 << n) - 1;
     while (j < nb_words)
         d[j++] = 0;
@@ -129,7 +241,7 @@ static inline int vnc_get_bit(const uint32_t *d, int k)
     return (d[k >> 5] >> (k & 0x1f)) & 1;
 }
 
-static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2, 
+static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
                                int nb_words)
 {
     int i;
@@ -147,6 +259,18 @@ static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
 
     h += y;
 
+    /* round x down to ensure the loop only spans one 16-pixel block per,
+       iteration.  otherwise, if (x % 16) != 0, the last iteration may span
+       two 16-pixel blocks but we only mark the first as dirty
+    */
+    w += (x % 16);
+    x -= (x % 16);
+
+    x = MIN(x, vs->width);
+    y = MIN(y, vs->height);
+    w = MIN(x + w, vs->width) - x;
+    h = MIN(h, vs->height);
+
     for (; y < h; y++)
 	for (i = 0; i < w; i += 16)
 	    vnc_set_bit(vs->dirty_row[y], (x + i) / 16);
@@ -163,31 +287,41 @@ static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
     vnc_write_s32(vs, encoding);
 }
 
-static void vnc_dpy_resize(DisplayState *ds, int w, int h, int rotation)
+static void vnc_dpy_resize(DisplayState *ds, int w, int h)
 {
+    int size_changed;
     VncState *vs = ds->opaque;
 
-    ds->data = realloc(ds->data, w * h * vs->depth);
-    vs->old_data = realloc(vs->old_data, w * h * vs->depth);
+    ds->data = qemu_realloc(ds->data, w * h * vs->depth);
+    vs->old_data = qemu_realloc(vs->old_data, w * h * vs->depth);
 
     if (ds->data == NULL || vs->old_data == NULL) {
 	fprintf(stderr, "vnc: memory allocation failed\n");
 	exit(1);
     }
 
-    ds->depth = vs->depth * 8;
+    if (ds->depth != vs->depth * 8) {
+        ds->depth = vs->depth * 8;
+        console_color_init(ds);
+    }
+    size_changed = ds->width != w || ds->height != h;
     ds->width = w;
     ds->height = h;
     ds->linesize = w * vs->depth;
-    if (vs->csock != -1 && vs->has_resize) {
-	vnc_write_u8(vs, 0);  /* msg id */
-	vnc_write_u8(vs, 0);
-	vnc_write_u16(vs, 1); /* number of rects */
-	vnc_framebuffer_update(vs, 0, 0, ds->width, ds->height, -223);
-	vnc_flush(vs);
-	vs->width = ds->width;
-	vs->height = ds->height;
+    if (size_changed) {
+        vs->width = ds->width;
+        vs->height = ds->height;
+        if (vs->csock != -1 && vs->has_resize) {
+            vnc_write_u8(vs, 0);  /* msg id */
+            vnc_write_u8(vs, 0);
+            vnc_write_u16(vs, 1); /* number of rects */
+            vnc_framebuffer_update(vs, 0, 0, ds->width, ds->height, -223);
+            vnc_flush(vs);
+        }
     }
+
+    memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
+    memset(vs->old_data, 42, vs->ds->linesize * vs->ds->height);
 }
 
 /* fastest code */
@@ -199,14 +333,17 @@ static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
 /* slowest but generic code. */
 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
 {
-    unsigned int r, g, b;
-
-    r = (v >> vs->red_shift1) & vs->red_max;
-    g = (v >> vs->green_shift1) & vs->green_max;
-    b = (v >> vs->blue_shift1) & vs->blue_max;
-    v = (r << vs->red_shift) | 
-        (g << vs->green_shift) | 
-        (b << vs->blue_shift);
+    uint8_t r, g, b;
+
+    r = ((v >> vs->server_red_shift) & vs->server_red_max) * (vs->client_red_max + 1) /
+        (vs->server_red_max + 1);
+    g = ((v >> vs->server_green_shift) & vs->server_green_max) * (vs->client_green_max + 1) /
+        (vs->server_green_max + 1);
+    b = ((v >> vs->server_blue_shift) & vs->server_blue_max) * (vs->client_blue_max + 1) /
+        (vs->server_blue_max + 1);
+    v = (r << vs->client_red_shift) |
+        (g << vs->client_green_shift) |
+        (b << vs->client_blue_shift);
     switch(vs->pix_bpp) {
     case 1:
         buf[0] = v;
@@ -239,21 +376,41 @@ static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
 
 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
 {
-    uint32_t *pixels = pixels1;
     uint8_t buf[4];
-    int n, i;
 
-    n = size >> 2;
-    for(i = 0; i < n; i++) {
-        vnc_convert_pixel(vs, buf, pixels[i]);
-        vnc_write(vs, buf, vs->pix_bpp);
+    if (vs->depth == 4) {
+        uint32_t *pixels = pixels1;
+        int n, i;
+        n = size >> 2;
+        for(i = 0; i < n; i++) {
+            vnc_convert_pixel(vs, buf, pixels[i]);
+            vnc_write(vs, buf, vs->pix_bpp);
+        }
+    } else if (vs->depth == 2) {
+        uint16_t *pixels = pixels1;
+        int n, i;
+        n = size >> 1;
+        for(i = 0; i < n; i++) {
+            vnc_convert_pixel(vs, buf, pixels[i]);
+            vnc_write(vs, buf, vs->pix_bpp);
+        }
+    } else if (vs->depth == 1) {
+        uint8_t *pixels = pixels1;
+        int n, i;
+        n = size;
+        for(i = 0; i < n; i++) {
+            vnc_convert_pixel(vs, buf, pixels[i]);
+            vnc_write(vs, buf, vs->pix_bpp);
+        }
+    } else {
+        fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
     }
 }
 
 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
 {
     int i;
-    char *row;
+    uint8_t *row;
 
     vnc_framebuffer_update(vs, x, y, w, h, 0);
 
@@ -283,6 +440,18 @@ static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
 #undef BPP
 
 #define GENERIC
+#define BPP 8
+#include "vnchextile.h"
+#undef BPP
+#undef GENERIC
+
+#define GENERIC
+#define BPP 16
+#include "vnchextile.h"
+#undef BPP
+#undef GENERIC
+
+#define GENERIC
 #define BPP 32
 #include "vnchextile.h"
 #undef BPP
@@ -292,18 +461,23 @@ static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, i
 {
     int i, j;
     int has_fg, has_bg;
-    uint32_t last_fg32, last_bg32;
+    uint8_t *last_fg, *last_bg;
 
     vnc_framebuffer_update(vs, x, y, w, h, 5);
 
+    last_fg = (uint8_t *) malloc(vs->depth);
+    last_bg = (uint8_t *) malloc(vs->depth);
     has_fg = has_bg = 0;
     for (j = y; j < (y + h); j += 16) {
 	for (i = x; i < (x + w); i += 16) {
-            vs->send_hextile_tile(vs, i, j, 
+            vs->send_hextile_tile(vs, i, j,
                                   MIN(16, x + w - i), MIN(16, y + h - j),
-                                  &last_bg32, &last_fg32, &has_bg, &has_fg);
+                                  last_bg, last_fg, &has_bg, &has_fg);
 	}
     }
+    free(last_fg);
+    free(last_bg);
+
 }
 
 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
@@ -317,8 +491,8 @@ static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
 static void vnc_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
 {
     int src, dst;
-    char *src_row;
-    char *dst_row;
+    uint8_t *src_row;
+    uint8_t *dst_row;
     char *old_row;
     int y = 0;
     int pitch = ds->linesize;
@@ -376,13 +550,15 @@ static void vnc_update_client(void *opaque)
 
     if (vs->need_update && vs->csock != -1) {
 	int y;
-	char *row;
+	uint8_t *row;
 	char *old_row;
 	uint32_t width_mask[VNC_DIRTY_WORDS];
 	int n_rectangles;
 	int saved_offset;
 	int has_dirty = 0;
 
+        vga_hw_update();
+
         vnc_set_bits(width_mask, (vs->width / 16), VNC_DIRTY_WORDS);
 
 	/* Walk through the dirty map and eliminate tiles that
@@ -393,10 +569,11 @@ static void vnc_update_client(void *opaque)
 	for (y = 0; y < vs->height; y++) {
 	    if (vnc_and_bits(vs->dirty_row[y], width_mask, VNC_DIRTY_WORDS)) {
 		int x;
-		char *ptr, *old_ptr;
+		uint8_t *ptr;
+		char *old_ptr;
 
 		ptr = row;
-		old_ptr = old_row;
+		old_ptr = (char*)old_row;
 
 		for (x = 0; x < vs->ds->width; x += 16) {
 		    if (memcmp(old_ptr, ptr, 16 * vs->depth) == 0) {
@@ -456,22 +633,11 @@ static void vnc_update_client(void *opaque)
 	vnc_flush(vs);
 
     }
-    qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
-}
 
-static void vnc_timer_init(VncState *vs)
-{
-    if (vs->timer == NULL) {
-	vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
-	qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock));
+    if (vs->csock != -1) {
+        qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
     }
-}
 
-static void vnc_dpy_refresh(DisplayState *ds)
-{
-    VncState *vs = ds->opaque;
-    vnc_timer_init(vs);
-    vga_hw_update();
 }
 
 static int vnc_listen_poll(void *opaque)
@@ -486,7 +652,7 @@ static void buffer_reserve(Buffer *buffer, size_t len)
 {
     if ((buffer->capacity - buffer->offset) < len) {
 	buffer->capacity += (len + 1024);
-	buffer->buffer = realloc(buffer->buffer, buffer->capacity);
+	buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
 	if (buffer->buffer == NULL) {
 	    fprintf(stderr, "vnc: out of memory\n");
 	    exit(1);
@@ -499,7 +665,7 @@ static int buffer_empty(Buffer *buffer)
     return buffer->offset == 0;
 }
 
-static char *buffer_end(Buffer *buffer)
+static uint8_t *buffer_end(Buffer *buffer)
 {
     return buffer->buffer + buffer->offset;
 }
@@ -518,15 +684,34 @@ static void buffer_append(Buffer *buffer, const void *data, size_t len)
 static int vnc_client_io_error(VncState *vs, int ret, int last_errno)
 {
     if (ret == 0 || ret == -1) {
-	if (ret == -1 && (last_errno == EINTR || last_errno == EAGAIN))
-	    return 0;
+        if (ret == -1) {
+            switch (last_errno) {
+                case EINTR:
+                case EAGAIN:
+#ifdef _WIN32
+                case EWOULDBLOCK:
+#endif
+                    return 0;
+                default:
+                    break;
+            }
+        }
 
+	VNC_DEBUG("Closing down client sock %d %d\n", ret, ret < 0 ? last_errno : 0);
 	qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
 	socket_close(vs->csock);
 	vs->csock = -1;
+	vs->ds->idle = 1;
 	buffer_reset(&vs->input);
 	buffer_reset(&vs->output);
 	vs->need_update = 0;
+#ifdef CONFIG_VNC_TLS
+	if (vs->tls_session) {
+	    gnutls_deinit(vs->tls_session);
+	    vs->tls_session = NULL;
+	}
+	vs->wiremode = VNC_WIREMODE_CLEAR;
+#endif /* CONFIG_VNC_TLS */
 	return 0;
     }
     return ret;
@@ -542,8 +727,20 @@ static void vnc_client_write(void *opaque)
     long ret;
     VncState *vs = opaque;
 
-    ret = socket_send(vs->csock, vs->output.buffer, vs->output.offset);
-    ret = vnc_client_io_error(vs, ret, errno);
+#ifdef CONFIG_VNC_TLS
+    if (vs->tls_session) {
+	ret = gnutls_write(vs->tls_session, vs->output.buffer, vs->output.offset);
+	if (ret < 0) {
+	    if (ret == GNUTLS_E_AGAIN)
+		errno = EAGAIN;
+	    else
+		errno = EIO;
+	    ret = -1;
+	}
+    } else
+#endif /* CONFIG_VNC_TLS */
+	ret = socket_send(vs->csock, vs->output.buffer, vs->output.offset);
+    ret = vnc_client_io_error(vs, ret, errno_str);
     if (!ret)
 	return;
 
@@ -568,8 +765,20 @@ static void vnc_client_read(void *opaque)
 
     buffer_reserve(&vs->input, 4096);
 
-    ret = socket_recv(vs->csock, buffer_end(&vs->input), 4096);
-    ret = vnc_client_io_error(vs, ret, errno);
+#ifdef CONFIG_VNC_TLS
+    if (vs->tls_session) {
+	ret = gnutls_read(vs->tls_session, buffer_end(&vs->input), 4096);
+	if (ret < 0) {
+	    if (ret == GNUTLS_E_AGAIN)
+		errno = EAGAIN;
+	    else
+		errno = EIO;
+	    ret = -1;
+	}
+    } else
+#endif /* CONFIG_VNC_TLS */
+	ret = socket_recv(vs->csock, buffer_end(&vs->input), 4096);
+    ret = vnc_client_io_error(vs, ret, errno_str);
     if (!ret)
 	return;
 
@@ -622,7 +831,7 @@ static void vnc_write_u32(VncState *vs, uint32_t value)
 
 static void vnc_write_u16(VncState *vs, uint16_t value)
 {
-    char buf[2];
+    uint8_t buf[2];
 
     buf[0] = (value >> 8) & 0xFF;
     buf[1] = value & 0xFF;
@@ -641,30 +850,62 @@ static void vnc_flush(VncState *vs)
 	vnc_client_write(vs);
 }
 
-static uint8_t read_u8(char *data, size_t offset)
+static uint8_t read_u8(uint8_t *data, size_t offset)
 {
     return data[offset];
 }
 
-static uint16_t read_u16(char *data, size_t offset)
+static uint16_t read_u16(uint8_t *data, size_t offset)
 {
     return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
 }
 
-static int32_t read_s32(char *data, size_t offset)
+static int32_t read_s32(uint8_t *data, size_t offset)
 {
     return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
 		     (data[offset + 2] << 8) | data[offset + 3]);
 }
 
-static uint32_t read_u32(char *data, size_t offset)
+static uint32_t read_u32(uint8_t *data, size_t offset)
 {
     return ((data[offset] << 24) | (data[offset + 1] << 16) |
 	    (data[offset + 2] << 8) | data[offset + 3]);
 }
 
-static void client_cut_text(VncState *vs, size_t len, char *text)
+#ifdef CONFIG_VNC_TLS
+static ssize_t vnc_tls_push(gnutls_transport_ptr_t transport,
+                            const void *data,
+                            size_t len) {
+    struct VncState *vs = (struct VncState *)transport;
+
+    return socket_send(vs->csock, data, len);
+}
+
+
+static ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,
+                            void *data,
+                            size_t len) {
+    struct VncState *vs = (struct VncState *)transport;
+
+    return socket_recv(vs->csock, data, len);
+}
+#endif /* CONFIG_VNC_TLS */
+
+static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
+{
+}
+
+static void check_pointer_type_change(VncState *vs, int absolute)
 {
+    if (vs->has_pointer_type_change && vs->absolute != absolute) {
+	vnc_write_u8(vs, 0);
+	vnc_write_u8(vs, 0);
+	vnc_write_u16(vs, 1);
+	vnc_framebuffer_update(vs, absolute, 0,
+			       vs->ds->width, vs->ds->height, -257);
+	vnc_flush(vs);
+    }
+    vs->absolute = absolute;
 }
 
 static void pointer_event(VncState *vs, int button_mask, int x, int y)
@@ -682,55 +923,189 @@ static void pointer_event(VncState *vs, int button_mask, int x, int y)
 	dz = -1;
     if (button_mask & 0x10)
 	dz = 1;
-	    
-    if (kbd_mouse_is_absolute()) {
-	kbd_mouse_event(x * 0x7FFF / vs->ds->width,
-			y * 0x7FFF / vs->ds->height,
+
+    if (vs->absolute) {
+	kbd_mouse_event(x * 0x7FFF / (vs->ds->width - 1),
+			y * 0x7FFF / (vs->ds->height - 1),
 			dz, buttons);
+    } else if (vs->has_pointer_type_change) {
+	x -= 0x7FFF;
+	y -= 0x7FFF;
+
+	kbd_mouse_event(x, y, dz, buttons);
     } else {
-	static int last_x = -1;
-	static int last_y = -1;
+	if (vs->last_x != -1)
+	    kbd_mouse_event(x - vs->last_x,
+			    y - vs->last_y,
+			    dz, buttons);
+	vs->last_x = x;
+	vs->last_y = y;
+    }
 
-	if (last_x != -1)
-	    kbd_mouse_event(x - last_x, y - last_y, dz, buttons);
+    check_pointer_type_change(vs, kbd_mouse_is_absolute());
+}
 
-	last_x = x;
-	last_y = y;
+static void reset_keys(VncState *vs)
+{
+    int i;
+    for(i = 0; i < 256; i++) {
+        if (vs->modifiers_state[i]) {
+            if (i & 0x80)
+                kbd_put_keycode(0xe0);
+            kbd_put_keycode(i | 0x80);
+            vs->modifiers_state[i] = 0;
+        }
     }
 }
 
-static void do_key_event(VncState *vs, int down, uint32_t sym)
+static void press_key(VncState *vs, int keysym)
 {
-    int keycode;
+    kbd_put_keycode(keysym2scancode(vs->kbd_layout, keysym) & 0x7f);
+    kbd_put_keycode(keysym2scancode(vs->kbd_layout, keysym) | 0x80);
+}
 
-    keycode = keysym2scancode(vs->kbd_layout, sym & 0xFFFF);
+static void do_key_event(VncState *vs, int down, int keycode, int sym)
+{
+    /* QEMU console switch */
+    switch(keycode) {
+    case 0x2a:                          /* Left Shift */
+    case 0x36:                          /* Right Shift */
+    case 0x1d:                          /* Left CTRL */
+    case 0x9d:                          /* Right CTRL */
+    case 0x38:                          /* Left ALT */
+    case 0xb8:                          /* Right ALT */
+        if (down)
+            vs->modifiers_state[keycode] = 1;
+        else
+            vs->modifiers_state[keycode] = 0;
+        break;
+    case 0x02 ... 0x0a: /* '1' to '9' keys */
+        if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
+            /* Reset the modifiers sent to the current console */
+            reset_keys(vs);
+            console_select(keycode - 0x02);
+            return;
+        }
+        break;
+    case 0x3a:			/* CapsLock */
+    case 0x45:			/* NumLock */
+        if (!down)
+            vs->modifiers_state[keycode] ^= 1;
+        break;
+    }
 
-    if (keycode & 0x80)
-	kbd_put_keycode(0xe0);
-    if (down)
-	kbd_put_keycode(keycode & 0x7f);
-    else
-	kbd_put_keycode(keycode | 0x80);
+    if (keycode_is_keypad(vs->kbd_layout, keycode)) {
+        /* If the numlock state needs to change then simulate an additional
+           keypress before sending this one.  This will happen if the user
+           toggles numlock away from the VNC window.
+        */
+        if (keysym_is_numlock(vs->kbd_layout, sym & 0xFFFF)) {
+            if (!vs->modifiers_state[0x45]) {
+                vs->modifiers_state[0x45] = 1;
+                press_key(vs, 0xff7f);
+            }
+        } else {
+            if (vs->modifiers_state[0x45]) {
+                vs->modifiers_state[0x45] = 0;
+                press_key(vs, 0xff7f);
+            }
+        }
+    }
+
+    if (is_graphic_console()) {
+        if (keycode & 0x80)
+            kbd_put_keycode(0xe0);
+        if (down)
+            kbd_put_keycode(keycode & 0x7f);
+        else
+            kbd_put_keycode(keycode | 0x80);
+    } else {
+        /* QEMU console emulation */
+        if (down) {
+            switch (keycode) {
+            case 0x2a:                          /* Left Shift */
+            case 0x36:                          /* Right Shift */
+            case 0x1d:                          /* Left CTRL */
+            case 0x9d:                          /* Right CTRL */
+            case 0x38:                          /* Left ALT */
+            case 0xb8:                          /* Right ALT */
+                break;
+            case 0xc8:
+                kbd_put_keysym(QEMU_KEY_UP);
+                break;
+            case 0xd0:
+                kbd_put_keysym(QEMU_KEY_DOWN);
+                break;
+            case 0xcb:
+                kbd_put_keysym(QEMU_KEY_LEFT);
+                break;
+            case 0xcd:
+                kbd_put_keysym(QEMU_KEY_RIGHT);
+                break;
+            case 0xd3:
+                kbd_put_keysym(QEMU_KEY_DELETE);
+                break;
+            case 0xc7:
+                kbd_put_keysym(QEMU_KEY_HOME);
+                break;
+            case 0xcf:
+                kbd_put_keysym(QEMU_KEY_END);
+                break;
+            case 0xc9:
+                kbd_put_keysym(QEMU_KEY_PAGEUP);
+                break;
+            case 0xd1:
+                kbd_put_keysym(QEMU_KEY_PAGEDOWN);
+                break;
+            default:
+                kbd_put_keysym(sym);
+                break;
+            }
+        }
+    }
 }
 
 static void key_event(VncState *vs, int down, uint32_t sym)
 {
-    if (sym >= 'A' && sym <= 'Z')
+    int keycode;
+
+    if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
 	sym = sym - 'A' + 'a';
-    do_key_event(vs, down, sym);
+
+    keycode = keysym2scancode(vs->kbd_layout, sym & 0xFFFF);
+    do_key_event(vs, down, keycode, sym);
+}
+
+static void ext_key_event(VncState *vs, int down,
+                          uint32_t sym, uint16_t keycode)
+{
+    /* if the user specifies a keyboard layout, always use it */
+    if (keyboard_layout)
+        key_event(vs, down, sym);
+    else
+        do_key_event(vs, down, keycode, sym);
 }
 
 static void framebuffer_update_request(VncState *vs, int incremental,
 				       int x_position, int y_position,
 				       int w, int h)
 {
+    if (x_position > vs->ds->width)
+        x_position = vs->ds->width;
+    if (y_position > vs->ds->height)
+        y_position = vs->ds->height;
+    if (x_position + w >= vs->ds->width)
+        w = vs->ds->width  - x_position;
+    if (y_position + h >= vs->ds->height)
+        h = vs->ds->height - y_position;
+
     int i;
     vs->need_update = 1;
     if (!incremental) {
 	char *old_row = vs->old_data + y_position * vs->ds->linesize;
 
 	for (i = 0; i < h; i++) {
-            vnc_set_bits(vs->dirty_row[y_position + i], 
+            vnc_set_bits(vs->dirty_row[y_position + i],
                          (vs->ds->width / 16), VNC_DIRTY_WORDS);
 	    memset(old_row, 42, vs->ds->width * vs->depth);
 	    old_row += vs->ds->linesize;
@@ -738,12 +1113,24 @@ static void framebuffer_update_request(VncState *vs, int incremental,
     }
 }
 
+static void send_ext_key_event_ack(VncState *vs)
+{
+    vnc_write_u8(vs, 0);
+    vnc_write_u8(vs, 0);
+    vnc_write_u16(vs, 1);
+    vnc_framebuffer_update(vs, 0, 0, vs->ds->width, vs->ds->height, -258);
+    vnc_flush(vs);
+}
+
 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
 {
     int i;
 
     vs->has_hextile = 0;
     vs->has_resize = 0;
+    vs->has_pointer_type_change = 0;
+    vs->has_WMVi = 0;
+    vs->absolute = -1;
     vs->ds->dpy_copy = NULL;
 
     for (i = n_encodings - 1; i >= 0; i--) {
@@ -760,21 +1147,21 @@ static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
 	case -223: /* DesktopResize */
 	    vs->has_resize = 1;
 	    break;
+	case -257:
+	    vs->has_pointer_type_change = 1;
+	    break;
+        case -258:
+            send_ext_key_event_ack(vs);
+            break;
+        case 0x574D5669:
+            vs->has_WMVi = 1;
+            break;
 	default:
 	    break;
 	}
     }
-}
 
-static int compute_nbits(unsigned int val)
-{
-    int n;
-    n = 0;
-    while (val != 0) {
-        n++;
-        val >>= 1;
-    }
-    return n;
+    check_pointer_type_change(vs, kbd_mouse_is_absolute());
 }
 
 static void set_pixel_format(VncState *vs,
@@ -795,60 +1182,210 @@ static void set_pixel_format(VncState *vs,
 	vnc_client_error(vs);
         return;
     }
-    if (bits_per_pixel == 32 && 
+    if (bits_per_pixel == 32 &&
+        bits_per_pixel == vs->depth * 8 &&
         host_big_endian_flag == big_endian_flag &&
         red_max == 0xff && green_max == 0xff && blue_max == 0xff &&
         red_shift == 16 && green_shift == 8 && blue_shift == 0) {
         vs->depth = 4;
         vs->write_pixels = vnc_write_pixels_copy;
         vs->send_hextile_tile = send_hextile_tile_32;
-    } else 
-    if (bits_per_pixel == 16 && 
+    } else
+    if (bits_per_pixel == 16 &&
+        bits_per_pixel == vs->depth * 8 && 
         host_big_endian_flag == big_endian_flag &&
         red_max == 31 && green_max == 63 && blue_max == 31 &&
         red_shift == 11 && green_shift == 5 && blue_shift == 0) {
         vs->depth = 2;
         vs->write_pixels = vnc_write_pixels_copy;
         vs->send_hextile_tile = send_hextile_tile_16;
-    } else 
-    if (bits_per_pixel == 8 && 
+    } else
+    if (bits_per_pixel == 8 &&
+        bits_per_pixel == vs->depth * 8 &&
         red_max == 7 && green_max == 7 && blue_max == 3 &&
         red_shift == 5 && green_shift == 2 && blue_shift == 0) {
         vs->depth = 1;
         vs->write_pixels = vnc_write_pixels_copy;
         vs->send_hextile_tile = send_hextile_tile_8;
-    } else 
+    } else
     {
         /* generic and slower case */
         if (bits_per_pixel != 8 &&
             bits_per_pixel != 16 &&
             bits_per_pixel != 32)
             goto fail;
-        vs->depth = 4;
-        vs->red_shift = red_shift;
-        vs->red_max = red_max;
-        vs->red_shift1 = 24 - compute_nbits(red_max);
-        vs->green_shift = green_shift;
-        vs->green_max = green_max;
-        vs->green_shift1 = 16 - compute_nbits(green_max);
-        vs->blue_shift = blue_shift;
-        vs->blue_max = blue_max;
-        vs->blue_shift1 = 8 - compute_nbits(blue_max);
-        vs->pix_bpp = bits_per_pixel / 8;
+        if (vs->depth == 4) {
+            vs->send_hextile_tile = send_hextile_tile_generic_32;
+        } else if (vs->depth == 2) {
+           vs->send_hextile_tile = send_hextile_tile_generic_16;
+        } else {
+            vs->send_hextile_tile = send_hextile_tile_generic_8;
+        }
+
         vs->pix_big_endian = big_endian_flag;
         vs->write_pixels = vnc_write_pixels_generic;
-        vs->send_hextile_tile = send_hextile_tile_generic;
     }
 
-    vnc_dpy_resize(vs->ds, vs->ds->width, vs->ds->height, 0);
-    memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
-    memset(vs->old_data, 42, vs->ds->linesize * vs->ds->height);
+    vs->client_red_shift = red_shift;
+    vs->client_red_max = red_max;
+    vs->client_green_shift = green_shift;
+    vs->client_green_max = green_max;
+    vs->client_blue_shift = blue_shift;
+    vs->client_blue_max = blue_max;
+    vs->pix_bpp = bits_per_pixel / 8;
 
     vga_hw_invalidate();
     vga_hw_update();
 }
 
-static int protocol_client_msg(VncState *vs, char *data, size_t len)
+static void pixel_format_message (VncState *vs) {
+    char pad[3] = { 0, 0, 0 };
+
+    vnc_write_u8(vs, vs->depth * 8); /* bits-per-pixel */
+    if (vs->depth == 4) vnc_write_u8(vs, 24); /* depth */
+    else vnc_write_u8(vs, vs->depth * 8); /* depth */
+
+#ifdef WORDS_BIGENDIAN
+    vnc_write_u8(vs, 1);             /* big-endian-flag */
+#else
+    vnc_write_u8(vs, 0);             /* big-endian-flag */
+#endif
+    vnc_write_u8(vs, 1);             /* true-color-flag */
+    if (vs->depth == 4) {
+        vnc_write_u16(vs, 0xFF);     /* red-max */
+        vnc_write_u16(vs, 0xFF);     /* green-max */
+        vnc_write_u16(vs, 0xFF);     /* blue-max */
+        vnc_write_u8(vs, 16);        /* red-shift */
+        vnc_write_u8(vs, 8);         /* green-shift */
+        vnc_write_u8(vs, 0);         /* blue-shift */
+        vs->send_hextile_tile = send_hextile_tile_32;
+    } else if (vs->depth == 2) {
+        vnc_write_u16(vs, 31);       /* red-max */
+        vnc_write_u16(vs, 63);       /* green-max */
+        vnc_write_u16(vs, 31);       /* blue-max */
+        vnc_write_u8(vs, 11);        /* red-shift */
+        vnc_write_u8(vs, 5);         /* green-shift */
+        vnc_write_u8(vs, 0);         /* blue-shift */
+        vs->send_hextile_tile = send_hextile_tile_16;
+    } else if (vs->depth == 1) {
+        /* XXX: change QEMU pixel 8 bit pixel format to match the VNC one ? */
+        vnc_write_u16(vs, 7);        /* red-max */
+        vnc_write_u16(vs, 7);        /* green-max */
+        vnc_write_u16(vs, 3);        /* blue-max */
+        vnc_write_u8(vs, 5);         /* red-shift */
+        vnc_write_u8(vs, 2);         /* green-shift */
+        vnc_write_u8(vs, 0);         /* blue-shift */
+        vs->send_hextile_tile = send_hextile_tile_8;
+    }
+    vs->client_red_max = vs->server_red_max;
+    vs->client_green_max = vs->server_green_max;
+    vs->client_blue_max = vs->server_blue_max;
+    vs->client_red_shift = vs->server_red_shift;
+    vs->client_green_shift = vs->server_green_shift;
+    vs->client_blue_shift = vs->server_blue_shift;
+    vs->pix_bpp = vs->depth * 8;
+    vs->write_pixels = vnc_write_pixels_copy;
+
+    vnc_write(vs, pad, 3);           /* padding */
+}
+
+static void vnc_colordepth(DisplayState *ds, int depth)
+{
+    int host_big_endian_flag;
+    struct VncState *vs = ds->opaque;
+
+    switch (depth) {
+        case 24:
+            if (ds->depth == 32) return;
+            depth = 32;
+            break;
+        case 15:
+        case 8:
+        case 0:
+            return;
+        default:
+            break;
+    }
+
+#ifdef WORDS_BIGENDIAN
+    host_big_endian_flag = 1;
+#else
+    host_big_endian_flag = 0;
+#endif   
+    
+    switch (depth) {
+        case 8:
+            vs->depth = depth / 8;
+            vs->server_red_max = 7;
+            vs->server_green_max = 7;
+            vs->server_blue_max = 3;
+            vs->server_red_shift = 5;
+            vs->server_green_shift = 2;
+            vs->server_blue_shift = 0;
+            break;
+        case 16:
+            vs->depth = depth / 8;
+            vs->server_red_max = 31;
+            vs->server_green_max = 63;
+            vs->server_blue_max = 31;
+            vs->server_red_shift = 11;
+            vs->server_green_shift = 5;
+            vs->server_blue_shift = 0;
+            break;
+        case 32:
+            vs->depth = 4;
+            vs->server_red_max = 255;
+            vs->server_green_max = 255;
+            vs->server_blue_max = 255;
+            vs->server_red_shift = 16;
+            vs->server_green_shift = 8;
+            vs->server_blue_shift = 0;
+            break;
+        default:
+            return;
+    }
+
+    if (vs->csock != -1 && vs->has_WMVi) {
+        /* Sending a WMVi message to notify the client*/
+        vnc_write_u8(vs, 0);  /* msg id */
+        vnc_write_u8(vs, 0);
+        vnc_write_u16(vs, 1); /* number of rects */
+        vnc_framebuffer_update(vs, 0, 0, ds->width, ds->height, 0x574D5669);
+        pixel_format_message(vs);
+        vnc_flush(vs);
+    } else {
+        if (vs->pix_bpp == 4 && vs->depth == 4 &&
+                host_big_endian_flag == vs->pix_big_endian &&
+                vs->client_red_max == 0xff && vs->client_green_max == 0xff && vs->client_blue_max == 0xff &&
+                vs->client_red_shift == 16 && vs->client_green_shift == 8 && vs->client_blue_shift == 0) {
+            vs->write_pixels = vnc_write_pixels_copy;
+            vs->send_hextile_tile = send_hextile_tile_32;
+        } else if (vs->pix_bpp == 2 && vs->depth == 2 &&
+                host_big_endian_flag == vs->pix_big_endian &&
+                vs->client_red_max == 31 && vs->client_green_max == 63 && vs->client_blue_max == 31 &&
+                vs->client_red_shift == 11 && vs->client_green_shift == 5 && vs->client_blue_shift == 0) {
+            vs->write_pixels = vnc_write_pixels_copy;
+            vs->send_hextile_tile = send_hextile_tile_16;
+        } else if (vs->pix_bpp == 1 && vs->depth == 1 &&
+                host_big_endian_flag == vs->pix_big_endian &&
+                vs->client_red_max == 7 && vs->client_green_max == 7 && vs->client_blue_max == 3 &&
+                vs->client_red_shift == 5 && vs->client_green_shift == 2 && vs->client_blue_shift == 0) {
+            vs->write_pixels = vnc_write_pixels_copy;
+            vs->send_hextile_tile = send_hextile_tile_8;
+        } else {
+            if (vs->depth == 4) {
+                vs->send_hextile_tile = send_hextile_tile_generic_32;
+            } else if (vs->depth == 2) {
+                vs->send_hextile_tile = send_hextile_tile_generic_16;
+            } else {
+                vs->send_hextile_tile = send_hextile_tile_generic_8;
+            }
+            vs->write_pixels = vnc_write_pixels_generic;
+        }
+    }
+}
+
+static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
 {
     int i;
     uint16_t limit;
@@ -903,70 +1440,61 @@ static int protocol_client_msg(VncState *vs, char *data, size_t len)
 	if (len == 1)
 	    return 8;
 
-	if (len == 8)
-	    return 8 + read_u32(data, 4);
+	if (len == 8) {
+            uint32_t dlen = read_u32(data, 4);
+            if (dlen > 0)
+                return 8 + dlen;
+        }
 
 	client_cut_text(vs, read_u32(data, 4), data + 8);
 	break;
+    case 255:
+        if (len == 1)
+            return 2;
+
+        switch (read_u8(data, 1)) {
+        case 0:
+            if (len == 2)
+                return 12;
+
+            ext_key_event(vs, read_u16(data, 2),
+                          read_u32(data, 4), read_u32(data, 8));
+            break;
+        default:
+            printf("Msg: %d\n", read_u16(data, 0));
+            vnc_client_error(vs);
+            break;
+        }
+        break;
     default:
 	printf("Msg: %d\n", data[0]);
 	vnc_client_error(vs);
 	break;
     }
-	
+
     vnc_read_when(vs, protocol_client_msg, 1);
     return 0;
 }
 
-static int protocol_client_init(VncState *vs, char *data, size_t len)
+static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
 {
-    char pad[3] = { 0, 0, 0 };
+    char buf[1024];
+    int size;
 
     vs->width = vs->ds->width;
     vs->height = vs->ds->height;
     vnc_write_u16(vs, vs->ds->width);
     vnc_write_u16(vs, vs->ds->height);
 
-    vnc_write_u8(vs, vs->depth * 8); /* bits-per-pixel */
-    vnc_write_u8(vs, vs->depth * 8); /* depth */
-#ifdef WORDS_BIGENDIAN
-    vnc_write_u8(vs, 1);             /* big-endian-flag */
-#else
-    vnc_write_u8(vs, 0);             /* big-endian-flag */
-#endif
-    vnc_write_u8(vs, 1);             /* true-color-flag */
-    if (vs->depth == 4) {
-	vnc_write_u16(vs, 0xFF);     /* red-max */
-	vnc_write_u16(vs, 0xFF);     /* green-max */
-	vnc_write_u16(vs, 0xFF);     /* blue-max */
-	vnc_write_u8(vs, 16);        /* red-shift */
-	vnc_write_u8(vs, 8);         /* green-shift */
-	vnc_write_u8(vs, 0);         /* blue-shift */
-        vs->send_hextile_tile = send_hextile_tile_32;
-    } else if (vs->depth == 2) {
-	vnc_write_u16(vs, 31);       /* red-max */
-	vnc_write_u16(vs, 63);       /* green-max */
-	vnc_write_u16(vs, 31);       /* blue-max */
-	vnc_write_u8(vs, 11);        /* red-shift */
-	vnc_write_u8(vs, 5);         /* green-shift */
-	vnc_write_u8(vs, 0);         /* blue-shift */
-        vs->send_hextile_tile = send_hextile_tile_16;
-    } else if (vs->depth == 1) {
-        /* XXX: change QEMU pixel 8 bit pixel format to match the VNC one ? */
-	vnc_write_u16(vs, 7);        /* red-max */
-	vnc_write_u16(vs, 7);        /* green-max */
-	vnc_write_u16(vs, 3);        /* blue-max */
-	vnc_write_u8(vs, 5);         /* red-shift */
-	vnc_write_u8(vs, 2);         /* green-shift */
-	vnc_write_u8(vs, 0);         /* blue-shift */
-        vs->send_hextile_tile = send_hextile_tile_8;
-    }
-    vs->write_pixels = vnc_write_pixels_copy;
-	
-    vnc_write(vs, pad, 3);           /* padding */
+    pixel_format_message(vs);
+
+    if (qemu_name)
+        size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
+    else
+        size = snprintf(buf, sizeof(buf), "QEMU");
 
-    vnc_write_u32(vs, 4);        
-    vnc_write(vs, "QEMU", 4);
+    vnc_write_u32(vs, size);
+    vnc_write(vs, buf, size);
     vnc_flush(vs);
 
     vnc_read_when(vs, protocol_client_msg, 1);
@@ -974,50 +1502,629 @@ static int protocol_client_init(VncState *vs, char *data, size_t len)
     return 0;
 }
 
-static int protocol_version(VncState *vs, char *version, size_t len)
+static void make_challenge(VncState *vs)
 {
-    char local[13];
-    int maj, min;
+    int i;
 
-    memcpy(local, version, 12);
-    local[12] = 0;
+    srand(time(NULL)+getpid()+getpid()*987654+rand());
 
-    if (sscanf(local, "RFB %03d.%03d\n", &maj, &min) != 2) {
+    for (i = 0 ; i < sizeof(vs->challenge) ; i++)
+        vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
+}
+
+static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
+{
+    unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
+    int i, j, pwlen;
+    unsigned char key[8];
+
+    if (!vs->password || !vs->password[0]) {
+	VNC_DEBUG("No password configured on server");
+	vnc_write_u32(vs, 1); /* Reject auth */
+	if (vs->minor >= 8) {
+	    static const char err[] = "Authentication failed";
+	    vnc_write_u32(vs, sizeof(err));
+	    vnc_write(vs, err, sizeof(err));
+	}
+	vnc_flush(vs);
 	vnc_client_error(vs);
 	return 0;
     }
 
-    vnc_write_u32(vs, 1); /* None */
+    memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
+
+    /* Calculate the expected challenge response */
+    pwlen = strlen(vs->password);
+    for (i=0; i<sizeof(key); i++)
+        key[i] = i<pwlen ? vs->password[i] : 0;
+    deskey(key, EN0);
+    for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
+        des(response+j, response+j);
+
+    /* Compare expected vs actual challenge response */
+    if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
+	VNC_DEBUG("Client challenge reponse did not match\n");
+	vnc_write_u32(vs, 1); /* Reject auth */
+	if (vs->minor >= 8) {
+	    static const char err[] = "Authentication failed";
+	    vnc_write_u32(vs, sizeof(err));
+	    vnc_write(vs, err, sizeof(err));
+	}
+	vnc_flush(vs);
+	vnc_client_error(vs);
+    } else {
+	VNC_DEBUG("Accepting VNC challenge response\n");
+	vnc_write_u32(vs, 0); /* Accept auth */
+	vnc_flush(vs);
+
+	vnc_read_when(vs, protocol_client_init, 1);
+    }
+    return 0;
+}
+
+static int start_auth_vnc(VncState *vs)
+{
+    make_challenge(vs);
+    /* Send client a 'random' challenge */
+    vnc_write(vs, vs->challenge, sizeof(vs->challenge));
     vnc_flush(vs);
 
-    vnc_read_when(vs, protocol_client_init, 1);
+    vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
+    return 0;
+}
+
+
+#ifdef CONFIG_VNC_TLS
+#define DH_BITS 1024
+static gnutls_dh_params_t dh_params;
+
+static int vnc_tls_initialize(void)
+{
+    static int tlsinitialized = 0;
+
+    if (tlsinitialized)
+	return 1;
+
+    if (gnutls_global_init () < 0)
+	return 0;
+
+    /* XXX ought to re-generate diffie-hellmen params periodically */
+    if (gnutls_dh_params_init (&dh_params) < 0)
+	return 0;
+    if (gnutls_dh_params_generate2 (dh_params, DH_BITS) < 0)
+	return 0;
+
+#if _VNC_DEBUG == 2
+    gnutls_global_set_log_level(10);
+    gnutls_global_set_log_function(vnc_debug_gnutls_log);
+#endif
+
+    tlsinitialized = 1;
+
+    return 1;
+}
+
+static gnutls_anon_server_credentials vnc_tls_initialize_anon_cred(void)
+{
+    gnutls_anon_server_credentials anon_cred;
+    int ret;
+
+    if ((ret = gnutls_anon_allocate_server_credentials(&anon_cred)) < 0) {
+	VNC_DEBUG("Cannot allocate credentials %s\n", gnutls_strerror(ret));
+	return NULL;
+    }
+
+    gnutls_anon_set_server_dh_params(anon_cred, dh_params);
+
+    return anon_cred;
+}
+
+
+static gnutls_certificate_credentials_t vnc_tls_initialize_x509_cred(VncState *vs)
+{
+    gnutls_certificate_credentials_t x509_cred;
+    int ret;
+
+    if (!vs->x509cacert) {
+	VNC_DEBUG("No CA x509 certificate specified\n");
+	return NULL;
+    }
+    if (!vs->x509cert) {
+	VNC_DEBUG("No server x509 certificate specified\n");
+	return NULL;
+    }
+    if (!vs->x509key) {
+	VNC_DEBUG("No server private key specified\n");
+	return NULL;
+    }
+
+    if ((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0) {
+	VNC_DEBUG("Cannot allocate credentials %s\n", gnutls_strerror(ret));
+	return NULL;
+    }
+    if ((ret = gnutls_certificate_set_x509_trust_file(x509_cred,
+						      vs->x509cacert,
+						      GNUTLS_X509_FMT_PEM)) < 0) {
+	VNC_DEBUG("Cannot load CA certificate %s\n", gnutls_strerror(ret));
+	gnutls_certificate_free_credentials(x509_cred);
+	return NULL;
+    }
+
+    if ((ret = gnutls_certificate_set_x509_key_file (x509_cred,
+						     vs->x509cert,
+						     vs->x509key,
+						     GNUTLS_X509_FMT_PEM)) < 0) {
+	VNC_DEBUG("Cannot load certificate & key %s\n", gnutls_strerror(ret));
+	gnutls_certificate_free_credentials(x509_cred);
+	return NULL;
+    }
+
+    if (vs->x509cacrl) {
+	if ((ret = gnutls_certificate_set_x509_crl_file(x509_cred,
+							vs->x509cacrl,
+							GNUTLS_X509_FMT_PEM)) < 0) {
+	    VNC_DEBUG("Cannot load CRL %s\n", gnutls_strerror(ret));
+	    gnutls_certificate_free_credentials(x509_cred);
+	    return NULL;
+	}
+    }
+
+    gnutls_certificate_set_dh_params (x509_cred, dh_params);
+
+    return x509_cred;
+}
+
+static int vnc_validate_certificate(struct VncState *vs)
+{
+    int ret;
+    unsigned int status;
+    const gnutls_datum_t *certs;
+    unsigned int nCerts, i;
+    time_t now;
+
+    VNC_DEBUG("Validating client certificate\n");
+    if ((ret = gnutls_certificate_verify_peers2 (vs->tls_session, &status)) < 0) {
+	VNC_DEBUG("Verify failed %s\n", gnutls_strerror(ret));
+	return -1;
+    }
+
+    if ((now = time(NULL)) == ((time_t)-1)) {
+	return -1;
+    }
+
+    if (status != 0) {
+	if (status & GNUTLS_CERT_INVALID)
+	    VNC_DEBUG("The certificate is not trusted.\n");
+
+	if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
+	    VNC_DEBUG("The certificate hasn't got a known issuer.\n");
+
+	if (status & GNUTLS_CERT_REVOKED)
+	    VNC_DEBUG("The certificate has been revoked.\n");
+
+	if (status & GNUTLS_CERT_INSECURE_ALGORITHM)
+	    VNC_DEBUG("The certificate uses an insecure algorithm\n");
+
+	return -1;
+    } else {
+	VNC_DEBUG("Certificate is valid!\n");
+    }
+
+    /* Only support x509 for now */
+    if (gnutls_certificate_type_get(vs->tls_session) != GNUTLS_CRT_X509)
+	return -1;
+
+    if (!(certs = gnutls_certificate_get_peers(vs->tls_session, &nCerts)))
+	return -1;
+
+    for (i = 0 ; i < nCerts ; i++) {
+	gnutls_x509_crt_t cert;
+	VNC_DEBUG ("Checking certificate chain %d\n", i);
+	if (gnutls_x509_crt_init (&cert) < 0)
+	    return -1;
+
+	if (gnutls_x509_crt_import(cert, &certs[i], GNUTLS_X509_FMT_DER) < 0) {
+	    gnutls_x509_crt_deinit (cert);
+	    return -1;
+	}
+
+	if (gnutls_x509_crt_get_expiration_time (cert) < now) {
+	    VNC_DEBUG("The certificate has expired\n");
+	    gnutls_x509_crt_deinit (cert);
+	    return -1;
+	}
+
+	if (gnutls_x509_crt_get_activation_time (cert) > now) {
+	    VNC_DEBUG("The certificate is not yet activated\n");
+	    gnutls_x509_crt_deinit (cert);
+	    return -1;
+	}
+
+	if (gnutls_x509_crt_get_activation_time (cert) > now) {
+	    VNC_DEBUG("The certificate is not yet activated\n");
+	    gnutls_x509_crt_deinit (cert);
+	    return -1;
+	}
+
+	gnutls_x509_crt_deinit (cert);
+    }
+
+    return 0;
+}
+
+
+static int start_auth_vencrypt_subauth(VncState *vs)
+{
+    switch (vs->subauth) {
+    case VNC_AUTH_VENCRYPT_TLSNONE:
+    case VNC_AUTH_VENCRYPT_X509NONE:
+       VNC_DEBUG("Accept TLS auth none\n");
+       vnc_write_u32(vs, 0); /* Accept auth completion */
+       vnc_read_when(vs, protocol_client_init, 1);
+       break;
+
+    case VNC_AUTH_VENCRYPT_TLSVNC:
+    case VNC_AUTH_VENCRYPT_X509VNC:
+       VNC_DEBUG("Start TLS auth VNC\n");
+       return start_auth_vnc(vs);
+
+    default: /* Should not be possible, but just in case */
+       VNC_DEBUG("Reject auth %d\n", vs->auth);
+       vnc_write_u8(vs, 1);
+       if (vs->minor >= 8) {
+           static const char err[] = "Unsupported authentication type";
+           vnc_write_u32(vs, sizeof(err));
+           vnc_write(vs, err, sizeof(err));
+       }
+       vnc_client_error(vs);
+    }
+
+    return 0;
+}
+
+static void vnc_handshake_io(void *opaque);
+
+static int vnc_continue_handshake(struct VncState *vs) {
+    int ret;
+
+    if ((ret = gnutls_handshake(vs->tls_session)) < 0) {
+       if (!gnutls_error_is_fatal(ret)) {
+           VNC_DEBUG("Handshake interrupted (blocking)\n");
+           if (!gnutls_record_get_direction(vs->tls_session))
+               qemu_set_fd_handler(vs->csock, vnc_handshake_io, NULL, vs);
+           else
+               qemu_set_fd_handler(vs->csock, NULL, vnc_handshake_io, vs);
+           return 0;
+       }
+       VNC_DEBUG("Handshake failed %s\n", gnutls_strerror(ret));
+       vnc_client_error(vs);
+       return -1;
+    }
+
+    if (vs->x509verify) {
+	if (vnc_validate_certificate(vs) < 0) {
+	    VNC_DEBUG("Client verification failed\n");
+	    vnc_client_error(vs);
+	    return -1;
+	} else {
+	    VNC_DEBUG("Client verification passed\n");
+	}
+    }
+
+    VNC_DEBUG("Handshake done, switching to TLS data mode\n");
+    vs->wiremode = VNC_WIREMODE_TLS;
+    qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
+
+    return start_auth_vencrypt_subauth(vs);
+}
+
+static void vnc_handshake_io(void *opaque) {
+    struct VncState *vs = (struct VncState *)opaque;
+
+    VNC_DEBUG("Handshake IO continue\n");
+    vnc_continue_handshake(vs);
+}
+
+#define NEED_X509_AUTH(vs)			      \
+    ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE ||   \
+     (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC ||    \
+     (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN)
+
+
+static int vnc_start_tls(struct VncState *vs) {
+    static const int cert_type_priority[] = { GNUTLS_CRT_X509, 0 };
+    static const int protocol_priority[]= { GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0 };
+    static const int kx_anon[] = {GNUTLS_KX_ANON_DH, 0};
+    static const int kx_x509[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0};
+
+    VNC_DEBUG("Do TLS setup\n");
+    if (vnc_tls_initialize() < 0) {
+	VNC_DEBUG("Failed to init TLS\n");
+	vnc_client_error(vs);
+	return -1;
+    }
+    if (vs->tls_session == NULL) {
+	if (gnutls_init(&vs->tls_session, GNUTLS_SERVER) < 0) {
+	    vnc_client_error(vs);
+	    return -1;
+	}
+
+	if (gnutls_set_default_priority(vs->tls_session) < 0) {
+	    gnutls_deinit(vs->tls_session);
+	    vs->tls_session = NULL;
+	    vnc_client_error(vs);
+	    return -1;
+	}
+
+	if (gnutls_kx_set_priority(vs->tls_session, NEED_X509_AUTH(vs) ? kx_x509 : kx_anon) < 0) {
+	    gnutls_deinit(vs->tls_session);
+	    vs->tls_session = NULL;
+	    vnc_client_error(vs);
+	    return -1;
+	}
+
+	if (gnutls_certificate_type_set_priority(vs->tls_session, cert_type_priority) < 0) {
+	    gnutls_deinit(vs->tls_session);
+	    vs->tls_session = NULL;
+	    vnc_client_error(vs);
+	    return -1;
+	}
+
+	if (gnutls_protocol_set_priority(vs->tls_session, protocol_priority) < 0) {
+	    gnutls_deinit(vs->tls_session);
+	    vs->tls_session = NULL;
+	    vnc_client_error(vs);
+	    return -1;
+	}
+
+	if (NEED_X509_AUTH(vs)) {
+	    gnutls_certificate_server_credentials x509_cred = vnc_tls_initialize_x509_cred(vs);
+	    if (!x509_cred) {
+		gnutls_deinit(vs->tls_session);
+		vs->tls_session = NULL;
+		vnc_client_error(vs);
+		return -1;
+	    }
+	    if (gnutls_credentials_set(vs->tls_session, GNUTLS_CRD_CERTIFICATE, x509_cred) < 0) {
+		gnutls_deinit(vs->tls_session);
+		vs->tls_session = NULL;
+		gnutls_certificate_free_credentials(x509_cred);
+		vnc_client_error(vs);
+		return -1;
+	    }
+	    if (vs->x509verify) {
+		VNC_DEBUG("Requesting a client certificate\n");
+		gnutls_certificate_server_set_request (vs->tls_session, GNUTLS_CERT_REQUEST);
+	    }
+
+	} else {
+	    gnutls_anon_server_credentials anon_cred = vnc_tls_initialize_anon_cred();
+	    if (!anon_cred) {
+		gnutls_deinit(vs->tls_session);
+		vs->tls_session = NULL;
+		vnc_client_error(vs);
+		return -1;
+	    }
+	    if (gnutls_credentials_set(vs->tls_session, GNUTLS_CRD_ANON, anon_cred) < 0) {
+		gnutls_deinit(vs->tls_session);
+		vs->tls_session = NULL;
+		gnutls_anon_free_server_credentials(anon_cred);
+		vnc_client_error(vs);
+		return -1;
+	    }
+	}
+
+	gnutls_transport_set_ptr(vs->tls_session, (gnutls_transport_ptr_t)vs);
+	gnutls_transport_set_push_function(vs->tls_session, vnc_tls_push);
+	gnutls_transport_set_pull_function(vs->tls_session, vnc_tls_pull);
+    }
+
+    VNC_DEBUG("Start TLS handshake process\n");
+    return vnc_continue_handshake(vs);
+}
+
+static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len)
+{
+    int auth = read_u32(data, 0);
+
+    if (auth != vs->subauth) {
+	VNC_DEBUG("Rejecting auth %d\n", auth);
+	vnc_write_u8(vs, 0); /* Reject auth */
+	vnc_flush(vs);
+	vnc_client_error(vs);
+    } else {
+	VNC_DEBUG("Accepting auth %d, starting handshake\n", auth);
+	vnc_write_u8(vs, 1); /* Accept auth */
+	vnc_flush(vs);
+
+	if (vnc_start_tls(vs) < 0) {
+	    VNC_DEBUG("Failed to complete TLS\n");
+	    return 0;
+	}
+
+	if (vs->wiremode == VNC_WIREMODE_TLS) {
+	    VNC_DEBUG("Starting VeNCrypt subauth\n");
+	    return start_auth_vencrypt_subauth(vs);
+	} else {
+	    VNC_DEBUG("TLS handshake blocked\n");
+	    return 0;
+	}
+    }
+    return 0;
+}
+
+static int protocol_client_vencrypt_init(VncState *vs, uint8_t *data, size_t len)
+{
+    if (data[0] != 0 ||
+	data[1] != 2) {
+	VNC_DEBUG("Unsupported VeNCrypt protocol %d.%d\n", (int)data[0], (int)data[1]);
+	vnc_write_u8(vs, 1); /* Reject version */
+	vnc_flush(vs);
+	vnc_client_error(vs);
+    } else {
+	VNC_DEBUG("Sending allowed auth %d\n", vs->subauth);
+	vnc_write_u8(vs, 0); /* Accept version */
+	vnc_write_u8(vs, 1); /* Number of sub-auths */
+	vnc_write_u32(vs, vs->subauth); /* The supported auth */
+	vnc_flush(vs);
+	vnc_read_when(vs, protocol_client_vencrypt_auth, 4);
+    }
+    return 0;
+}
+
+static int start_auth_vencrypt(VncState *vs)
+{
+    /* Send VeNCrypt version 0.2 */
+    vnc_write_u8(vs, 0);
+    vnc_write_u8(vs, 2);
+
+    vnc_read_when(vs, protocol_client_vencrypt_init, 2);
+    return 0;
+}
+#endif /* CONFIG_VNC_TLS */
+
+static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
+{
+    /* We only advertise 1 auth scheme at a time, so client
+     * must pick the one we sent. Verify this */
+    if (data[0] != vs->auth) { /* Reject auth */
+       VNC_DEBUG("Reject auth %d\n", (int)data[0]);
+       vnc_write_u32(vs, 1);
+       if (vs->minor >= 8) {
+           static const char err[] = "Authentication failed";
+           vnc_write_u32(vs, sizeof(err));
+           vnc_write(vs, err, sizeof(err));
+       }
+       vnc_client_error(vs);
+    } else { /* Accept requested auth */
+       VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
+       switch (vs->auth) {
+       case VNC_AUTH_NONE:
+           VNC_DEBUG("Accept auth none\n");
+           if (vs->minor >= 8) {
+               vnc_write_u32(vs, 0); /* Accept auth completion */
+               vnc_flush(vs);
+           }
+           vnc_read_when(vs, protocol_client_init, 1);
+           break;
+
+       case VNC_AUTH_VNC:
+           VNC_DEBUG("Start VNC auth\n");
+           return start_auth_vnc(vs);
+
+#ifdef CONFIG_VNC_TLS
+       case VNC_AUTH_VENCRYPT:
+           VNC_DEBUG("Accept VeNCrypt auth\n");;
+           return start_auth_vencrypt(vs);
+#endif /* CONFIG_VNC_TLS */
+
+       default: /* Should not be possible, but just in case */
+           VNC_DEBUG("Reject auth %d\n", vs->auth);
+           vnc_write_u8(vs, 1);
+           if (vs->minor >= 8) {
+               static const char err[] = "Authentication failed";
+               vnc_write_u32(vs, sizeof(err));
+               vnc_write(vs, err, sizeof(err));
+           }
+           vnc_client_error(vs);
+       }
+    }
+    return 0;
+}
+
+static int protocol_version(VncState *vs, uint8_t *version, size_t len)
+{
+    char local[13];
+
+    memcpy(local, version, 12);
+    local[12] = 0;
+
+    if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
+	VNC_DEBUG("Malformed protocol version %s\n", local);
+	vnc_client_error(vs);
+	return 0;
+    }
+    VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
+    if (vs->major != 3 ||
+	(vs->minor != 3 &&
+	 vs->minor != 4 &&
+	 vs->minor != 5 &&
+	 vs->minor != 7 &&
+	 vs->minor != 8)) {
+	VNC_DEBUG("Unsupported client version\n");
+	vnc_write_u32(vs, VNC_AUTH_INVALID);
+	vnc_flush(vs);
+	vnc_client_error(vs);
+	return 0;
+    }
+    /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
+     * as equivalent to v3.3 by servers
+     */
+    if (vs->minor == 4 || vs->minor == 5)
+	vs->minor = 3;
+
+    if (vs->minor == 3) {
+	if (vs->auth == VNC_AUTH_NONE) {
+            VNC_DEBUG("Tell client auth none\n");
+            vnc_write_u32(vs, vs->auth);
+            vnc_flush(vs);
+            vnc_read_when(vs, protocol_client_init, 1);
+       } else if (vs->auth == VNC_AUTH_VNC) {
+            VNC_DEBUG("Tell client VNC auth\n");
+            vnc_write_u32(vs, vs->auth);
+            vnc_flush(vs);
+            start_auth_vnc(vs);
+       } else {
+            VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
+            vnc_write_u32(vs, VNC_AUTH_INVALID);
+            vnc_flush(vs);
+            vnc_client_error(vs);
+       }
+    } else {
+	VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
+	vnc_write_u8(vs, 1); /* num auth */
+	vnc_write_u8(vs, vs->auth);
+	vnc_read_when(vs, protocol_client_auth, 1);
+	vnc_flush(vs);
+    }
 
     return 0;
 }
 
+static void vnc_connect(VncState *vs)
+{
+    VNC_DEBUG("New client on socket %d\n", vs->csock);
+    vs->ds->idle = 0;
+    socket_set_nonblock(vs->csock);
+    qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
+    vnc_write(vs, "RFB 003.008\n", 12);
+    vnc_flush(vs);
+    vnc_read_when(vs, protocol_version, 12);
+    memset(vs->old_data, 0, vs->ds->linesize * vs->ds->height);
+    memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
+    vs->has_resize = 0;
+    vs->has_hextile = 0;
+    vs->ds->dpy_copy = NULL;
+    vnc_update_client(vs);
+}
+
 static void vnc_listen_read(void *opaque)
 {
     VncState *vs = opaque;
 
+    /* Catch-up */
+    vga_hw_update();
+
     vs->csock = socket_accept(vs->lsock, NULL);
     if (vs->csock != -1) {
-        socket_set_nonblock(vs->csock);
-	qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, opaque);
-	vnc_write(vs, "RFB 003.003\n", 12);
-	vnc_flush(vs);
-	vnc_read_when(vs, protocol_version, 12);
-	memset(vs->old_data, 0, vs->ds->linesize * vs->ds->height);
-	memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
-	vs->has_resize = 0;
-	vs->has_hextile = 0;
-	vs->ds->dpy_copy = NULL;
+        vnc_connect(vs);
     }
 }
 
-void vnc_display_init(DisplayState *ds, int display)
+extern int parse_host_port(SockAddress* saddr, const char *str);
+
+void vnc_display_init(DisplayState *ds)
 {
-    SockAddress addr;
-    int ret;
     VncState *vs;
 
     vs = qemu_mallocz(sizeof(VncState));
@@ -1025,55 +2132,315 @@ void vnc_display_init(DisplayState *ds, int display)
 	exit(1);
 
     ds->opaque = vs;
+    ds->idle = 1;
+    vnc_state = vs;
+    vs->display = NULL;
+    vs->password = NULL;
 
     vs->lsock = -1;
     vs->csock = -1;
-    vs->depth = 4;
+    vs->last_x = -1;
+    vs->last_y = -1;
 
     vs->ds = ds;
 
-    if (!keyboard_layout)
-	keyboard_layout = "en-us";
+    if (keyboard_layout)
+        vs->kbd_layout = init_keyboard_layout(keyboard_layout);
+    else
+        vs->kbd_layout = init_keyboard_layout("en-us");
 
-    vs->kbd_layout = init_keyboard_layout(keyboard_layout);
     if (!vs->kbd_layout)
 	exit(1);
 
-    vs->lsock = socket_create_inet( SOCKET_STREAM );
-    if (vs->lsock == -1) {
-	fprintf(stderr, "Could not create socket\n");
-	exit(1);
+    vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
+
+    vs->ds->data = NULL;
+    vs->ds->dpy_update = vnc_dpy_update;
+    vs->ds->dpy_resize = vnc_dpy_resize;
+    vs->ds->dpy_refresh = NULL;
+
+    vnc_colordepth(vs->ds, 32);
+    vnc_dpy_resize(vs->ds, 640, 400);
+}
+
+#ifdef CONFIG_VNC_TLS
+static int vnc_set_x509_credential(VncState *vs,
+				   const char *certdir,
+				   const char *filename,
+				   char **cred,
+				   int ignoreMissing)
+{
+    struct stat sb;
+
+    if (*cred) {
+	qemu_free(*cred);
+	*cred = NULL;
     }
 
-    sock_address_init_inet( &addr, SOCK_ADDRESS_INET_ANY, 5900+display );
+    if (!(*cred = qemu_malloc(strlen(certdir) + strlen(filename) + 2)))
+	return -1;
 
-    ret = socket_set_xreuseaddr(vs->lsock);
-    if (ret == -1) {
-	fprintf(stderr, "setsockopt() failed\n");
-	exit(1);
+    strcpy(*cred, certdir);
+    strcat(*cred, "/");
+    strcat(*cred, filename);
+
+    VNC_DEBUG("Check %s\n", *cred);
+    if (stat(*cred, &sb) < 0) {
+	qemu_free(*cred);
+	*cred = NULL;
+	if (ignoreMissing && errno == ENOENT)
+	    return 0;
+	return -1;
+    }
+
+    return 0;
+}
+
+static int vnc_set_x509_credential_dir(VncState *vs,
+				       const char *certdir)
+{
+    if (vnc_set_x509_credential(vs, certdir, X509_CA_CERT_FILE, &vs->x509cacert, 0) < 0)
+	goto cleanup;
+    if (vnc_set_x509_credential(vs, certdir, X509_CA_CRL_FILE, &vs->x509cacrl, 1) < 0)
+	goto cleanup;
+    if (vnc_set_x509_credential(vs, certdir, X509_SERVER_CERT_FILE, &vs->x509cert, 0) < 0)
+	goto cleanup;
+    if (vnc_set_x509_credential(vs, certdir, X509_SERVER_KEY_FILE, &vs->x509key, 0) < 0)
+	goto cleanup;
+
+    return 0;
+
+ cleanup:
+    qemu_free(vs->x509cacert);
+    qemu_free(vs->x509cacrl);
+    qemu_free(vs->x509cert);
+    qemu_free(vs->x509key);
+    vs->x509cacert = vs->x509cacrl = vs->x509cert = vs->x509key = NULL;
+    return -1;
+}
+#endif /* CONFIG_VNC_TLS */
+
+void vnc_display_close(DisplayState *ds)
+{
+    VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
+
+    if (vs->display) {
+	qemu_free(vs->display);
+	vs->display = NULL;
+    }
+    if (vs->lsock != -1) {
+	qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
+	close(vs->lsock);
+	vs->lsock = -1;
+    }
+    if (vs->csock != -1) {
+	qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
+	socket_close(vs->csock);
+	vs->csock = -1;
+	buffer_reset(&vs->input);
+	buffer_reset(&vs->output);
+	vs->need_update = 0;
+#ifdef CONFIG_VNC_TLS
+	if (vs->tls_session) {
+	    gnutls_deinit(vs->tls_session);
+	    vs->tls_session = NULL;
+	}
+	vs->wiremode = VNC_WIREMODE_CLEAR;
+#endif /* CONFIG_VNC_TLS */
+    }
+    vs->auth = VNC_AUTH_INVALID;
+#ifdef CONFIG_VNC_TLS
+    vs->subauth = VNC_AUTH_INVALID;
+    vs->x509verify = 0;
+#endif
+}
+
+int vnc_display_password(DisplayState *ds, const char *password)
+{
+    VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
+
+    if (vs->password) {
+	qemu_free(vs->password);
+	vs->password = NULL;
+    }
+    if (password && password[0]) {
+	if (!(vs->password = qemu_strdup(password)))
+	    return -1;
+    }
+
+    return 0;
+}
+
+int vnc_display_open(DisplayState *ds, const char *display)
+{
+    SockAddress  addr;
+#ifndef _WIN32
+    const char *p;
+#endif
+    int ret;
+    VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
+    const char *options;
+    int password = 0;
+    int reverse = 0;
+#ifdef CONFIG_VNC_TLS
+    int tls = 0, x509 = 0;
+#endif
+
+    sock_address_init_inet( &addr, SOCK_ADDRESS_INET_ANY, 0 );
+    vs->lsock = -1;
+
+    vnc_display_close(ds);
+    if (strcmp(display, "none") == 0)
+	return 0;
+
+    if (!(vs->display = strdup(display)))
+	return -1;
+
+    options = display;
+    while ((options = strchr(options, ','))) {
+	options++;
+	if (strncmp(options, "password", 8) == 0) {
+	    password = 1; /* Require password auth */
+	} else if (strncmp(options, "reverse", 7) == 0) {
+	    reverse = 1;
+#ifdef CONFIG_VNC_TLS
+	} else if (strncmp(options, "tls", 3) == 0) {
+	    tls = 1; /* Require TLS */
+	} else if (strncmp(options, "x509", 4) == 0) {
+	    char *start, *end;
+	    x509 = 1; /* Require x509 certificates */
+	    if (strncmp(options, "x509verify", 10) == 0)
+	        vs->x509verify = 1; /* ...and verify client certs */
+
+	    /* Now check for 'x509=/some/path' postfix
+	     * and use that to setup x509 certificate/key paths */
+	    start = strchr(options, '=');
+	    end = strchr(options, ',');
+	    if (start && (!end || (start < end))) {
+		int len = end ? end-(start+1) : strlen(start+1);
+		char *path = qemu_malloc(len+1);
+		strncpy(path, start+1, len);
+		path[len] = '\0';
+		VNC_DEBUG("Trying certificate path '%s'\n", path);
+		ret = vnc_set_x509_credential_dir(vs, path);
+                qemu_free(path);
+                if (ret < 0) {
+		    fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
+		    goto FAIL;
+		}
+	    } else {
+		fprintf(stderr, "No certificate path provided\n");
+		goto FAIL;
+	    }
+#endif
+	}
+    }
+
+    if (password) {
+#ifdef CONFIG_VNC_TLS
+	if (tls) {
+	    vs->auth = VNC_AUTH_VENCRYPT;
+	    if (x509) {
+		VNC_DEBUG("Initializing VNC server with x509 password auth\n");
+		vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
+	    } else {
+		VNC_DEBUG("Initializing VNC server with TLS password auth\n");
+		vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
+	    }
+	} else {
+#endif
+	    VNC_DEBUG("Initializing VNC server with password auth\n");
+	    vs->auth = VNC_AUTH_VNC;
+#ifdef CONFIG_VNC_TLS
+	    vs->subauth = VNC_AUTH_INVALID;
+	}
+#endif
+    } else {
+#ifdef CONFIG_VNC_TLS
+	if (tls) {
+	    vs->auth = VNC_AUTH_VENCRYPT;
+	    if (x509) {
+		VNC_DEBUG("Initializing VNC server with x509 no auth\n");
+		vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
+	    } else {
+		VNC_DEBUG("Initializing VNC server with TLS no auth\n");
+		vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
+	    }
+	} else {
+#endif
+	    VNC_DEBUG("Initializing VNC server with no auth\n");
+	    vs->auth = VNC_AUTH_NONE;
+#ifdef CONFIG_VNC_TLS
+	    vs->subauth = VNC_AUTH_INVALID;
+	}
+#endif
+    }
+#ifndef _WIN32
+    if (strstart(display, "unix:", &p)) {
+	sock_address_init_unix( &addr, p);
+	vs->lsock = socket_create( SOCKET_UNIX, SOCKET_STREAM );
+	if (vs->lsock == -1) {
+	    fprintf(stderr, "Could not create socket\n");
+	    goto FAIL;
+	}
+
+	if (!reverse) {
+	    unlink(p);
+	}
+    } else
+#endif
+    {
+	if (parse_host_port(&addr, display) < 0) {
+	    fprintf(stderr, "Could not parse VNC address\n");
+	    goto FAIL;
+	}
+
+	sock_address_set_port(&addr, reverse ? 0 : 5900);
+
+	vs->lsock = socket_create_inet( SOCKET_STREAM );
+	if (vs->lsock == -1) {
+	    fprintf(stderr, "Could not create socket\n");
+	    goto FAIL;
+	}
+
+	ret = socket_set_xreuseaddr(vs->lsock);
+	if (ret == -1) {
+	    fprintf(stderr, "setsockopt() failed\n");
+	    goto FAIL;
+	}
+    }
+
+    if (reverse) {
+        if (socket_connect(vs->lsock, &addr) == -1) {
+            fprintf(stderr, "Connection to VNC client failed\n");
+            goto FAIL;
+        }
+        vs->csock = vs->lsock;
+        vs->lsock = -1;
+        vnc_connect(vs);
+        return 0;
     }
 
-    if (socket_bind(vs->lsock, &addr) < 0) {
+    if (socket_bind(vs->lsock, &addr) == -1) {
 	fprintf(stderr, "bind() failed\n");
-	exit(1);
+	goto FAIL;
     }
 
     if (socket_listen(vs->lsock, 1) == -1) {
 	fprintf(stderr, "listen() failed\n");
-	exit(1);
+	goto FAIL;
     }
 
-    ret = qemu_set_fd_handler2(vs->lsock, vnc_listen_poll, vnc_listen_read, NULL, vs);
-    if (ret == -1) {
-	exit(1);
-    }
-
-    vs->ds->data = NULL;
-    vs->ds->dpy_update = vnc_dpy_update;
-    vs->ds->dpy_resize = vnc_dpy_resize;
-    vs->ds->dpy_refresh = vnc_dpy_refresh;
+    return qemu_set_fd_handler2(vs->lsock, vnc_listen_poll, vnc_listen_read, NULL, vs);
 
-    memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
+FAIL:
+    sock_address_done(&addr);
 
-    vnc_dpy_resize(vs->ds, 640, 400, 0);
+    if (vs->lsock >= 0) {
+        socket_close(vs->lsock);
+        vs->lsock = -1;
+    }
+    free(vs->display);
+    vs->display = NULL;
+    return -1;
 }
diff --git a/vnc_keysym.h b/vnc_keysym.h
index a4ac688..b6a172d 100644
--- a/vnc_keysym.h
+++ b/vnc_keysym.h
@@ -231,6 +231,19 @@ static name2keysym_t name2keysym[]={
 {"Home", 0xff50},      /* XK_Home */
 {"End", 0xff57},       /* XK_End */
 {"Scroll_Lock", 0xff14}, /* XK_Scroll_Lock */
+{"KP_Home", 0xff95},
+{"KP_Left", 0xff96},
+{"KP_Up", 0xff97},
+{"KP_Right", 0xff98},
+{"KP_Down", 0xff99},
+{"KP_Prior", 0xff9a},
+{"KP_Page_Up", 0xff9a},
+{"KP_Next", 0xff9b},
+{"KP_Page_Down", 0xff9b},
+{"KP_End", 0xff9c},
+{"KP_Begin", 0xff9d},
+{"KP_Insert", 0xff9e},
+{"KP_Delete", 0xff9f},
 {"F1", 0xffbe},        /* XK_F1 */
 {"F2", 0xffbf},        /* XK_F2 */
 {"F3", 0xffc0},        /* XK_F3 */
@@ -258,6 +271,7 @@ static name2keysym_t name2keysym[]={
 {"KP_8", 0xffb8},      /* XK_KP_8 */
 {"KP_9", 0xffb9},      /* XK_KP_9 */
 {"KP_Add", 0xffab},    /* XK_KP_Add */
+{"KP_Separator", 0xffac},/* XK_KP_Separator */
 {"KP_Decimal", 0xffae},  /* XK_KP_Decimal */
 {"KP_Divide", 0xffaf},   /* XK_KP_Divide */
 {"KP_Enter", 0xff8d},    /* XK_KP_Enter */
@@ -271,5 +285,18 @@ static name2keysym_t name2keysym[]={
 {"Num_Lock", 0xff7f},    /* XK_Num_Lock */
 {"Pause", 0xff13},       /* XK_Pause */
 {"Escape", 0xff1b},      /* XK_Escape */
+
+    /* localized keys */
+{"BackApostrophe", 0xff21},
+{"Muhenkan", 0xff22},
+{"Katakana", 0xff27},
+{"Hankaku", 0xff29},
+{"Zenkaku_Hankaku", 0xff2a},
+{"Henkan_Mode_Real", 0xff23},
+{"Henkan_Mode_Ultra", 0xff3e},
+{"backslash_ja", 0xffa5},
+{"Katakana_Real", 0xff25},
+{"Eisu_toggle", 0xff30},
+
 {0,0},
 };
diff --git a/vnchextile.h b/vnchextile.h
index 16a354d..eb05feb 100644
--- a/vnchextile.h
+++ b/vnchextile.h
@@ -2,29 +2,29 @@
 #define CONCAT(a, b) CONCAT_I(a, b)
 #define pixel_t CONCAT(uint, CONCAT(BPP, _t))
 #ifdef GENERIC
-#define NAME generic
+#define NAME CONCAT(generic_, BPP)
 #else
 #define NAME BPP
 #endif
 
 static void CONCAT(send_hextile_tile_, NAME)(VncState *vs,
                                              int x, int y, int w, int h,
-                                             uint32_t *last_bg32, 
-                                             uint32_t *last_fg32,
+                                             void *last_bg_,
+                                             void *last_fg_,
                                              int *has_bg, int *has_fg)
 {
-    char *row = (vs->ds->data + y * vs->ds->linesize + x * vs->depth);
+    uint8_t *row = (vs->ds->data + y * vs->ds->linesize + x * vs->depth);
     pixel_t *irow = (pixel_t *)row;
     int j, i;
-    pixel_t *last_bg = (pixel_t *)last_bg32;
-    pixel_t *last_fg = (pixel_t *)last_fg32;
+    pixel_t *last_bg = (pixel_t *)last_bg_;
+    pixel_t *last_fg = (pixel_t *)last_fg_;
     pixel_t bg = 0;
     pixel_t fg = 0;
     int n_colors = 0;
     int bg_count = 0;
     int fg_count = 0;
     int flags = 0;
-    uint8_t data[(sizeof(pixel_t) + 2) * 16 * 16];
+    uint8_t data[(vs->pix_bpp + 2) * 16 * 16];
     int n_data = 0;
     int n_subtiles = 0;
 
@@ -86,7 +86,7 @@ static void CONCAT(send_hextile_tile_, NAME)(VncState *vs,
 	flags |= 0x08;
 
 	irow = (pixel_t *)row;
-	
+
 	for (j = 0; j < h; j++) {
 	    int min_x = -1;
 	    for (i = 0; i < w; i++) {
@@ -119,7 +119,7 @@ static void CONCAT(send_hextile_tile_, NAME)(VncState *vs,
 	for (j = 0; j < h; j++) {
 	    int has_color = 0;
 	    int min_x = -1;
-	    pixel_t color;
+	    pixel_t color = 0; /* shut up gcc */
 
 	    for (i = 0; i < w; i++) {
 		if (!has_color) {