r3406 - in trunk/src/host/qemu-neo1973: . darwin-user fpu hw linux-user slirp target-alpha target-arm target-cris target-i386 target-m68k target-mips target-ppc target-sh4 target-sparc tests

andrew at sita.openmoko.org andrew at sita.openmoko.org
Tue Nov 13 17:29:52 CET 2007


Author: andrew
Date: 2007-11-13 17:27:39 +0100 (Tue, 13 Nov 2007)
New Revision: 3406

Added:
   trunk/src/host/qemu-neo1973/block.h
   trunk/src/host/qemu-neo1973/hw/armv7m.c
   trunk/src/host/qemu-neo1973/hw/armv7m_nvic.c
   trunk/src/host/qemu-neo1973/hw/dummy_m68k.c
   trunk/src/host/qemu-neo1973/hw/mpcore.c
   trunk/src/host/qemu-neo1973/hw/pl022.c
   trunk/src/host/qemu-neo1973/hw/pl061.c
   trunk/src/host/qemu-neo1973/hw/realview_gic.c
   trunk/src/host/qemu-neo1973/hw/ssd0303.c
   trunk/src/host/qemu-neo1973/hw/ssd0323.c
   trunk/src/host/qemu-neo1973/hw/stellaris.c
   trunk/src/host/qemu-neo1973/linux-user/uaccess.c
   trunk/src/host/qemu-neo1973/qemu-common.h
   trunk/src/host/qemu-neo1973/target-arm/op_addsub.h
   trunk/src/host/qemu-neo1973/target-arm/op_neon.h
Modified:
   trunk/src/host/qemu-neo1973/Changelog
   trunk/src/host/qemu-neo1973/Makefile
   trunk/src/host/qemu-neo1973/Makefile.target
   trunk/src/host/qemu-neo1973/VERSION
   trunk/src/host/qemu-neo1973/aes.c
   trunk/src/host/qemu-neo1973/arm-dis.c
   trunk/src/host/qemu-neo1973/arm-semi.c
   trunk/src/host/qemu-neo1973/block-bochs.c
   trunk/src/host/qemu-neo1973/block-cloop.c
   trunk/src/host/qemu-neo1973/block-cow.c
   trunk/src/host/qemu-neo1973/block-dmg.c
   trunk/src/host/qemu-neo1973/block-parallels.c
   trunk/src/host/qemu-neo1973/block-qcow.c
   trunk/src/host/qemu-neo1973/block-qcow2.c
   trunk/src/host/qemu-neo1973/block-raw.c
   trunk/src/host/qemu-neo1973/block-vmdk.c
   trunk/src/host/qemu-neo1973/block-vpc.c
   trunk/src/host/qemu-neo1973/block-vvfat.c
   trunk/src/host/qemu-neo1973/block.c
   trunk/src/host/qemu-neo1973/block_int.h
   trunk/src/host/qemu-neo1973/configure
   trunk/src/host/qemu-neo1973/cpu-exec.c
   trunk/src/host/qemu-neo1973/cutils.c
   trunk/src/host/qemu-neo1973/darwin-user/main.c
   trunk/src/host/qemu-neo1973/dis-asm.h
   trunk/src/host/qemu-neo1973/exec.c
   trunk/src/host/qemu-neo1973/fpu/softfloat-native.h
   trunk/src/host/qemu-neo1973/fpu/softfloat.c
   trunk/src/host/qemu-neo1973/fpu/softfloat.h
   trunk/src/host/qemu-neo1973/gdbstub.c
   trunk/src/host/qemu-neo1973/hw/an5206.c
   trunk/src/host/qemu-neo1973/hw/arm_boot.c
   trunk/src/host/qemu-neo1973/hw/arm_gic.c
   trunk/src/host/qemu-neo1973/hw/arm_sysctl.c
   trunk/src/host/qemu-neo1973/hw/etraxfs.c
   trunk/src/host/qemu-neo1973/hw/gt64xxx.c
   trunk/src/host/qemu-neo1973/hw/integratorcp.c
   trunk/src/host/qemu-neo1973/hw/mcf5208.c
   trunk/src/host/qemu-neo1973/hw/mips_malta.c
   trunk/src/host/qemu-neo1973/hw/mips_mipssim.c
   trunk/src/host/qemu-neo1973/hw/mips_pica61.c
   trunk/src/host/qemu-neo1973/hw/mips_r4k.c
   trunk/src/host/qemu-neo1973/hw/omap.c
   trunk/src/host/qemu-neo1973/hw/pc.c
   trunk/src/host/qemu-neo1973/hw/pl011.c
   trunk/src/host/qemu-neo1973/hw/pl050.c
   trunk/src/host/qemu-neo1973/hw/pl080.c
   trunk/src/host/qemu-neo1973/hw/pl110.c
   trunk/src/host/qemu-neo1973/hw/pl181.c
   trunk/src/host/qemu-neo1973/hw/pl190.c
   trunk/src/host/qemu-neo1973/hw/ppc4xx_devs.c
   trunk/src/host/qemu-neo1973/hw/ppc_chrp.c
   trunk/src/host/qemu-neo1973/hw/ppc_oldworld.c
   trunk/src/host/qemu-neo1973/hw/ppc_prep.c
   trunk/src/host/qemu-neo1973/hw/pxa.h
   trunk/src/host/qemu-neo1973/hw/pxa2xx.c
   trunk/src/host/qemu-neo1973/hw/pxa2xx_dma.c
   trunk/src/host/qemu-neo1973/hw/r2d.c
   trunk/src/host/qemu-neo1973/hw/realview.c
   trunk/src/host/qemu-neo1973/hw/rtl8139.c
   trunk/src/host/qemu-neo1973/hw/s3c2410.c
   trunk/src/host/qemu-neo1973/hw/sh7750.c
   trunk/src/host/qemu-neo1973/hw/shix.c
   trunk/src/host/qemu-neo1973/hw/slavio_misc.c
   trunk/src/host/qemu-neo1973/hw/slavio_timer.c
   trunk/src/host/qemu-neo1973/hw/smc91c111.c
   trunk/src/host/qemu-neo1973/hw/spitz.c
   trunk/src/host/qemu-neo1973/hw/sun4m.c
   trunk/src/host/qemu-neo1973/hw/sun4u.c
   trunk/src/host/qemu-neo1973/hw/usb-uhci.c
   trunk/src/host/qemu-neo1973/hw/versatilepb.c
   trunk/src/host/qemu-neo1973/linux-user/elfload.c
   trunk/src/host/qemu-neo1973/linux-user/flatload.c
   trunk/src/host/qemu-neo1973/linux-user/linuxload.c
   trunk/src/host/qemu-neo1973/linux-user/m68k-sim.c
   trunk/src/host/qemu-neo1973/linux-user/main.c
   trunk/src/host/qemu-neo1973/linux-user/qemu.h
   trunk/src/host/qemu-neo1973/linux-user/signal.c
   trunk/src/host/qemu-neo1973/linux-user/strace.c
   trunk/src/host/qemu-neo1973/linux-user/syscall.c
   trunk/src/host/qemu-neo1973/linux-user/syscall_defs.h
   trunk/src/host/qemu-neo1973/linux-user/vm86.c
   trunk/src/host/qemu-neo1973/m68k-semi.c
   trunk/src/host/qemu-neo1973/qemu-doc.texi
   trunk/src/host/qemu-neo1973/qemu-img.c
   trunk/src/host/qemu-neo1973/slirp/misc.c
   trunk/src/host/qemu-neo1973/softmmu-semi.h
   trunk/src/host/qemu-neo1973/target-alpha/cpu.h
   trunk/src/host/qemu-neo1973/target-alpha/op_helper.c
   trunk/src/host/qemu-neo1973/target-alpha/op_mem.h
   trunk/src/host/qemu-neo1973/target-alpha/translate.c
   trunk/src/host/qemu-neo1973/target-arm/cpu.h
   trunk/src/host/qemu-neo1973/target-arm/exec.h
   trunk/src/host/qemu-neo1973/target-arm/helper.c
   trunk/src/host/qemu-neo1973/target-arm/op.c
   trunk/src/host/qemu-neo1973/target-arm/op_helper.c
   trunk/src/host/qemu-neo1973/target-arm/op_mem.h
   trunk/src/host/qemu-neo1973/target-arm/translate.c
   trunk/src/host/qemu-neo1973/target-cris/cpu.h
   trunk/src/host/qemu-neo1973/target-cris/op_helper.c
   trunk/src/host/qemu-neo1973/target-cris/translate.c
   trunk/src/host/qemu-neo1973/target-i386/cpu.h
   trunk/src/host/qemu-neo1973/target-i386/exec.h
   trunk/src/host/qemu-neo1973/target-i386/helper2.c
   trunk/src/host/qemu-neo1973/target-m68k/cpu.h
   trunk/src/host/qemu-neo1973/target-m68k/helper.c
   trunk/src/host/qemu-neo1973/target-m68k/op_helper.c
   trunk/src/host/qemu-neo1973/target-m68k/translate.c
   trunk/src/host/qemu-neo1973/target-mips/cpu.h
   trunk/src/host/qemu-neo1973/target-mips/exec.h
   trunk/src/host/qemu-neo1973/target-mips/fop_template.c
   trunk/src/host/qemu-neo1973/target-mips/op.c
   trunk/src/host/qemu-neo1973/target-mips/op_mem.c
   trunk/src/host/qemu-neo1973/target-mips/op_template.c
   trunk/src/host/qemu-neo1973/target-mips/translate.c
   trunk/src/host/qemu-neo1973/target-mips/translate_init.c
   trunk/src/host/qemu-neo1973/target-ppc/cpu.h
   trunk/src/host/qemu-neo1973/target-ppc/helper.c
   trunk/src/host/qemu-neo1973/target-ppc/op.c
   trunk/src/host/qemu-neo1973/target-ppc/op_helper.c
   trunk/src/host/qemu-neo1973/target-ppc/op_helper.h
   trunk/src/host/qemu-neo1973/target-ppc/op_mem.h
   trunk/src/host/qemu-neo1973/target-ppc/op_template.h
   trunk/src/host/qemu-neo1973/target-ppc/translate.c
   trunk/src/host/qemu-neo1973/target-ppc/translate_init.c
   trunk/src/host/qemu-neo1973/target-sh4/cpu.h
   trunk/src/host/qemu-neo1973/target-sh4/translate.c
   trunk/src/host/qemu-neo1973/target-sparc/cpu.h
   trunk/src/host/qemu-neo1973/target-sparc/op_helper.c
   trunk/src/host/qemu-neo1973/target-sparc/translate.c
   trunk/src/host/qemu-neo1973/tests/Makefile
   trunk/src/host/qemu-neo1973/tests/qruncom.c
   trunk/src/host/qemu-neo1973/tests/test-i386.c
   trunk/src/host/qemu-neo1973/thunk.c
   trunk/src/host/qemu-neo1973/translate-all.c
   trunk/src/host/qemu-neo1973/vl.c
   trunk/src/host/qemu-neo1973/vl.h
Log:
Merge ARMv6 and ARMv7 support from mainline.


Modified: trunk/src/host/qemu-neo1973/Changelog
===================================================================
--- trunk/src/host/qemu-neo1973/Changelog	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/Changelog	2007-11-13 16:27:39 UTC (rev 3406)
@@ -14,9 +14,10 @@
   - SVM (x86 virtualization) support (Alexander Graf)
   - CRIS emulation (Edgar E. Iglesias)
   - SPARC32PLUS execution support (Blue Swirl)
-  - MIPS mipssim pequdo machine (Thiemo Seufer)
+  - MIPS mipssim pseudo machine (Thiemo Seufer)
   - Strace for Linux userland emulation (Stuart Anderson, Thayne Harbaugh)
   - OMAP310 MPU emulation plus Palm T|E machine (Andrzej Zaborowski)
+  - ARM v6, v7, NEON SIMD and SMP emulation (Paul Brook/CodeSourcery)
 
 version 0.9.0:
 

Modified: trunk/src/host/qemu-neo1973/Makefile
===================================================================
--- trunk/src/host/qemu-neo1973/Makefile	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/Makefile	2007-11-13 16:27:39 UTC (rev 3406)
@@ -13,7 +13,6 @@
 
 CPPFLAGS += -I. -I$(SRC_PATH) -MMD -MP
 CPPFLAGS += -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
-CPPFLAGS += -DQEMU_TOOL
 LIBS=
 ifdef CONFIG_STATIC
 BASE_LDFLAGS += -static
@@ -27,22 +26,30 @@
 
 LIBS+=$(AIOLIBS)
 
-all: libqemu_common.a $(TOOLS) $(DOCS) recurse-all $(MODEM)
+all: $(TOOLS) $(DOCS) recurse-all $(MODEM)
 
-subdir-%: dyngen$(EXESUF)
+subdir-%: dyngen$(EXESUF) libqemu_common.a
 	$(MAKE) -C $(subst subdir-,,$@) all
 
 recurse-all: $(patsubst %,subdir-%, $(TARGET_DIRS))
 
+#######################################################################
+# BLOCK_OBJS is code used by both qemu system emulation and qemu-img
+
+BLOCK_OBJS=cutils.o
+BLOCK_OBJS+=block-cow.o block-qcow.o aes.o block-vmdk.o block-cloop.o
+BLOCK_OBJS+=block-dmg.o block-bochs.o block-vpc.o block-vvfat.o
+BLOCK_OBJS+=block-qcow2.o block-parallels.o
+
 ######################################################################
-# libqemu_common.a: target indepedent part of system emulation. The
+# libqemu_common.a: Target indepedent part of system emulation. The
 # long term path is to suppress *all* target specific code in case of
 # system emulation, i.e. a single QEMU executable should support all
 # CPUs and machines.
 
-OBJS+=cutils.o readline.o console.o 
-#OBJS+=block.o block-raw.o
-OBJS+=block-cow.o block-qcow.o aes.o block-vmdk.o block-cloop.o block-dmg.o block-bochs.o block-vpc.o block-vvfat.o block-qcow2.o block-parallels.o
+OBJS=$(BLOCK_OBJS)
+OBJS+=readline.o console.o 
+OBJS+=block.o
 
 ifdef CONFIG_WIN32
 OBJS+=tap-win32.o
@@ -106,9 +113,12 @@
 
 ######################################################################
 
-qemu-img$(EXESUF): qemu-img.o block.o block-raw.o libqemu_common.a
+qemu-img$(EXESUF): qemu-img.o qemu-img-block.o qemu-img-block-raw.o $(BLOCK_OBJS)
 	$(CC) $(LDFLAGS) $(BASE_LDFLAGS) -o $@ $^ -lz $(LIBS)
 
+qemu-img-%.o: %.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) -DQEMU_IMG $(BASE_CFLAGS) -c -o $@ $<
+
 %.o: %.c
 	$(CC) $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -c -o $@ $<
 

Modified: trunk/src/host/qemu-neo1973/Makefile.target
===================================================================
--- trunk/src/host/qemu-neo1973/Makefile.target	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/Makefile.target	2007-11-13 16:27:39 UTC (rev 3406)
@@ -24,7 +24,7 @@
 endif
 TARGET_PATH=$(SRC_PATH)/target-$(TARGET_BASE_ARCH)
 VPATH=$(SRC_PATH):$(TARGET_PATH):$(SRC_PATH)/hw
-CPPFLAGS=-I. -I.. -I$(TARGET_PATH) -I$(SRC_PATH) -MMD -MP
+CPPFLAGS=-I. -I.. -I$(TARGET_PATH) -I$(SRC_PATH) -MMD -MP -DNEED_CPU_H
 ifdef CONFIG_DARWIN_USER
 VPATH+=:$(SRC_PATH)/darwin-user
 CPPFLAGS+=-I$(SRC_PATH)/darwin-user -I$(SRC_PATH)/darwin-user/$(TARGET_ARCH)
@@ -260,7 +260,7 @@
 
 ifdef CONFIG_LINUX_USER
 OBJS= main.o syscall.o strace.o mmap.o signal.o path.o osdep.o thunk.o \
-      elfload.o linuxload.o
+      elfload.o linuxload.o uaccess.o
 LIBS+= $(AIOLIBS)
 ifdef TARGET_HAS_BFLT
 OBJS+= flatload.o
@@ -398,7 +398,7 @@
 # must use static linking to avoid leaving stuff in virtual address space
 VL_OBJS=vl.o osdep.o monitor.o pci.o loader.o isa_mmio.o
 # XXX: suppress QEMU_TOOL tests
-VL_OBJS+=block.o block-raw.o
+VL_OBJS+=block-raw.o
 VL_OBJS+=irq.o
 
 ifdef CONFIG_ALSA
@@ -501,7 +501,9 @@
 VL_OBJS+= integratorcp.o versatilepb.o ps2.o smc91c111.o arm_pic.o arm_timer.o
 VL_OBJS+= arm_boot.o pl011.o pl031.o pl050.o pl080.o pl110.o pl181.o pl190.o
 VL_OBJS+= versatile_pci.o sd.o ptimer.o
-VL_OBJS+= arm_gic.o realview.o arm_sysctl.o
+VL_OBJS+= realview_gic.o realview.o arm_sysctl.o mpcore.o
+VL_OBJS+= armv7m.o armv7m_nvic.o stellaris.o ssd0303.o pl022.o
+VL_OBJS+= ssd0323.o pl061.o
 VL_OBJS+= arm-semi.o
 VL_OBJS+= pxa2xx.o pxa2xx_pic.o pxa2xx_gpio.o pxa2xx_timer.o pxa2xx_dma.o
 VL_OBJS+= pxa2xx_lcd.o pxa2xx_mmci.o pxa2xx_pcmcia.o max111x.o max7310.o
@@ -519,7 +521,7 @@
 endif
 ifeq ($(TARGET_BASE_ARCH), m68k)
 VL_OBJS+= an5206.o mcf5206.o ptimer.o mcf_uart.o mcf_intc.o mcf5208.o mcf_fec.o
-VL_OBJS+= m68k-semi.o
+VL_OBJS+= m68k-semi.o dummy_m68k.o
 endif
 ifdef CONFIG_GDBSTUB
 VL_OBJS+=gdbstub.o

Modified: trunk/src/host/qemu-neo1973/VERSION
===================================================================
--- trunk/src/host/qemu-neo1973/VERSION	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/VERSION	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1 +1 @@
-0.9.0
\ No newline at end of file
+0.9.0-cvs
\ No newline at end of file

Modified: trunk/src/host/qemu-neo1973/aes.c
===================================================================
--- trunk/src/host/qemu-neo1973/aes.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/aes.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -27,7 +27,7 @@
  * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
  * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "aes.h"
 
 #define NDEBUG

Modified: trunk/src/host/qemu-neo1973/arm-dis.c
===================================================================
--- trunk/src/host/qemu-neo1973/arm-dis.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/arm-dis.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1,550 +1,1496 @@
 /* Instruction printing code for the ARM
-   Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002
-   Free Software Foundation, Inc.
+   Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004
+   2007, Free Software Foundation, Inc.
    Contributed by Richard Earnshaw (rwe at pegasus.esprit.ec.org)
    Modification by James G. Smith (jsmith at cygnus.co.uk)
 
-This file is part of libopcodes.
+   This file is part of libopcodes.
 
-This program is free software; you can redistribute it and/or modify it under
-the terms of the GNU General Public License as published by the Free
-Software Foundation; either version 2 of the License, or (at your option)
-any later version.
+   This program is free software; you can redistribute it and/or modify it under
+   the terms of the GNU General Public License as published by the Free
+   Software Foundation; either version 2 of the License, or (at your option)
+   any later version.
 
-This program is distributed in the hope that it will be useful, but WITHOUT
-ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-more details.
+   This program is distributed in the hope that it will be useful, but WITHOUT
+   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+   more details.
 
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
-Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA.  */
 
+/* Start of qemu specific additions.  Mostly this is stub definitions
+   for things we don't care about.  */
+
 #include "dis-asm.h"
+#define FALSE 0
+#define TRUE (!FALSE)
+#define ATTRIBUTE_UNUSED __attribute__((unused))
+#define ISSPACE(x) ((x) == ' ' || (x) == '\t' || (x) == '\n')
 
-struct arm_opcode {
-    unsigned long value, mask;	/* recognise instruction if (op&mask)==value */
-    char *assembler;		/* how to disassemble this instruction */
+#define ARM_EXT_V1	 0
+#define ARM_EXT_V2	 0
+#define ARM_EXT_V2S	 0
+#define ARM_EXT_V3	 0
+#define ARM_EXT_V3M	 0
+#define ARM_EXT_V4	 0
+#define ARM_EXT_V4T	 0
+#define ARM_EXT_V5	 0
+#define ARM_EXT_V5T	 0
+#define ARM_EXT_V5ExP	 0
+#define ARM_EXT_V5E	 0
+#define ARM_EXT_V5J	 0
+#define ARM_EXT_V6       0
+#define ARM_EXT_V6K      0
+#define ARM_EXT_V6Z      0
+#define ARM_EXT_V6T2	 0
+#define ARM_EXT_V7	 0
+#define ARM_EXT_DIV	 0
+
+/* Co-processor space extensions.  */
+#define ARM_CEXT_XSCALE   0
+#define ARM_CEXT_MAVERICK 0
+#define ARM_CEXT_IWMMXT   0
+
+#define FPU_FPA_EXT_V1	 0
+#define FPU_FPA_EXT_V2	 0
+#define FPU_VFP_EXT_NONE 0
+#define FPU_VFP_EXT_V1xD 0
+#define FPU_VFP_EXT_V1	 0
+#define FPU_VFP_EXT_V2	 0
+#define FPU_MAVERICK	 0
+#define FPU_VFP_EXT_V3	 0
+#define FPU_NEON_EXT_V1	 0
+
+int floatformat_ieee_single_little;
+/* Assume host uses ieee float.  */
+static void floatformat_to_double (int *ignored, unsigned char *data,
+                                   double *dest)
+{
+    union {
+        uint32_t i;
+        float f;
+    } u;
+    u.i = data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24);
+    *dest = u.f;
+}
+
+/* End of qemu specific additions.  */
+
+/* FIXME: Belongs in global header.  */
+#ifndef strneq
+#define strneq(a,b,n)	(strncmp ((a), (b), (n)) == 0)
+#endif
+
+#ifndef NUM_ELEM
+#define NUM_ELEM(a)     (sizeof (a) / sizeof (a)[0])
+#endif
+
+struct opcode32
+{
+  unsigned long arch;		/* Architecture defining this insn.  */
+  unsigned long value, mask;	/* Recognise insn if (op&mask)==value.  */
+  const char *assembler;	/* How to disassemble this insn.  */
 };
 
-struct thumb_opcode
+struct opcode16
 {
-    unsigned short value, mask;	/* recognise instruction if (op&mask)==value */
-    char * assembler;		/* how to disassemble this instruction */
+  unsigned long arch;		/* Architecture defining this insn.  */
+  unsigned short value, mask;	/* Recognise insn if (op&mask)==value.  */
+  const char *assembler;	/* How to disassemble this insn.  */
 };
 
-/* format of the assembler string :
+/* print_insn_coprocessor recognizes the following format control codes:
 
    %%			%
+
+   %c			print condition code (always bits 28-31 in ARM mode)
+   %q			print shifter argument
+   %u			print condition code (unconditional in ARM mode)
+   %A			print address for ldc/stc/ldf/stf instruction
+   %B			print vstm/vldm register list
+   %C			print vstr/vldr address operand
+   %I                   print cirrus signed shift immediate: bits 0..3|4..6
+   %F			print the COUNT field of a LFM/SFM instruction.
+   %P			print floating point precision in arithmetic insn
+   %Q			print floating point precision in ldf/stf insn
+   %R			print floating point rounding mode
+
+   %<bitfield>r		print as an ARM register
    %<bitfield>d		print the bitfield in decimal
+   %<bitfield>k		print immediate for VFPv3 conversion instruction
    %<bitfield>x		print the bitfield in hex
    %<bitfield>X		print the bitfield as 1 hex digit without leading "0x"
-   %<bitfield>r		print as an ARM register
    %<bitfield>f		print a floating point constant if >7 else a
 			floating point register
-   %<code>y		print a single precision VFP reg.
+   %<bitfield>w         print as an iWMMXt width field - [bhwd]ss/us
+   %<bitfield>g         print as an iWMMXt 64-bit register
+   %<bitfield>G         print as an iWMMXt general purpose or control register
+   %<bitfield>D		print as a NEON D register
+   %<bitfield>Q		print as a NEON Q register
+
+   %y<code>		print a single precision VFP reg.
 			  Codes: 0=>Sm, 1=>Sd, 2=>Sn, 3=>multi-list, 4=>Sm pair
-   %<code>z		print a double precision VFP reg
+   %z<code>		print a double precision VFP reg
 			  Codes: 0=>Dm, 1=>Dd, 2=>Dn, 3=>multi-list
+
+   %<bitfield>'c	print specified char iff bitfield is all ones
+   %<bitfield>`c	print specified char iff bitfield is all zeroes
+   %<bitfield>?ab...    select from array of values in big endian order
+
+   %L			print as an iWMMXt N/M width field.
+   %Z			print the Immediate of a WSHUFH instruction.
+   %l			like 'A' except use byte offsets for 'B' & 'H'
+			versions.
+   %i			print 5-bit immediate in bits 8,3..0
+			(print "32" when 0)
+   %r			print register offset address for wldt/wstr instruction
+*/
+
+/* Common coprocessor opcodes shared between Arm and Thumb-2.  */
+
+static const struct opcode32 coprocessor_opcodes[] =
+{
+  /* XScale instructions.  */
+  {ARM_CEXT_XSCALE, 0x0e200010, 0x0fff0ff0, "mia%c\tacc0, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e280010, 0x0fff0ff0, "miaph%c\tacc0, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e2c0010, 0x0ffc0ff0, "mia%17'T%17`B%16'T%16`B%c\tacc0, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0c400000, 0x0ff00fff, "mar%c\tacc0, %12-15r, %16-19r"},
+  {ARM_CEXT_XSCALE, 0x0c500000, 0x0ff00fff, "mra%c\t%12-15r, %16-19r, acc0"},
+
+  /* Intel Wireless MMX technology instructions.  */
+#define FIRST_IWMMXT_INSN 0x0e130130
+#define IWMMXT_INSN_COUNT 73
+  {ARM_CEXT_IWMMXT, 0x0e130130, 0x0f3f0fff, "tandc%22-23w%c\t%12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e400010, 0x0ff00f3f, "tbcst%6-7w%c\t%16-19g, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e130170, 0x0f3f0ff8, "textrc%22-23w%c\t%12-15r, #%0-2d"},
+  {ARM_CEXT_XSCALE, 0x0e100070, 0x0f300ff0, "textrm%3?su%22-23w%c\t%12-15r, %16-19g, #%0-2d"},
+  {ARM_CEXT_XSCALE, 0x0e600010, 0x0ff00f38, "tinsr%6-7w%c\t%16-19g, %12-15r, #%0-2d"},
+  {ARM_CEXT_XSCALE, 0x0e000110, 0x0ff00fff, "tmcr%c\t%16-19G, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0c400000, 0x0ff00ff0, "tmcrr%c\t%0-3g, %12-15r, %16-19r"},
+  {ARM_CEXT_XSCALE, 0x0e2c0010, 0x0ffc0e10, "tmia%17?tb%16?tb%c\t%5-8g, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e200010, 0x0fff0e10, "tmia%c\t%5-8g, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e280010, 0x0fff0e10, "tmiaph%c\t%5-8g, %0-3r, %12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e100030, 0x0f300fff, "tmovmsk%22-23w%c\t%12-15r, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e100110, 0x0ff00ff0, "tmrc%c\t%12-15r, %16-19G"},
+  {ARM_CEXT_XSCALE, 0x0c500000, 0x0ff00ff0, "tmrrc%c\t%12-15r, %16-19r, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e130150, 0x0f3f0fff, "torc%22-23w%c\t%12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e130190, 0x0f3f0fff, "torvsc%22-23w%c\t%12-15r"},
+  {ARM_CEXT_XSCALE, 0x0e2001c0, 0x0f300fff, "wabs%22-23w%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e0001c0, 0x0f300fff, "wacc%22-23w%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e000180, 0x0f000ff0, "wadd%20-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e2001a0, 0x0f300ff0, "waddbhus%22?ml%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ea001a0, 0x0ff00ff0, "waddsubhx%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000020, 0x0f800ff0, "waligni%c\t%12-15g, %16-19g, %0-3g, #%20-22d"},
+  {ARM_CEXT_XSCALE, 0x0e800020, 0x0fc00ff0, "walignr%20-21d%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e200000, 0x0fe00ff0, "wand%20'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e800000, 0x0fa00ff0, "wavg2%22?hb%20'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e400000, 0x0fe00ff0, "wavg4%20'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000060, 0x0f300ff0, "wcmpeq%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100060, 0x0f100ff0, "wcmpgt%21?su%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0xfc500100, 0xfe500f00, "wldrd\t%12-15g, %r"},
+  {ARM_CEXT_XSCALE, 0xfc100100, 0xfe500f00, "wldrw\t%12-15G, %A"},
+  {ARM_CEXT_XSCALE, 0x0c100000, 0x0e100e00, "wldr%L%c\t%12-15g, %l"},
+  {ARM_CEXT_XSCALE, 0x0e400100, 0x0fc00ff0, "wmac%21?su%20'z%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e800100, 0x0fc00ff0, "wmadd%21?su%20'x%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ec00100, 0x0fd00ff0, "wmadd%21?sun%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000160, 0x0f100ff0, "wmax%21?su%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000080, 0x0f100fe0, "wmerge%c\t%12-15g, %16-19g, %0-3g, #%21-23d"},
+  {ARM_CEXT_XSCALE, 0x0e0000a0, 0x0f800ff0, "wmia%21?tb%20?tb%22'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e800120, 0x0f800ff0, "wmiaw%21?tb%20?tb%22'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100160, 0x0f100ff0, "wmin%21?su%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000100, 0x0fc00ff0, "wmul%21?su%20?ml%23'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ed00100, 0x0fd00ff0, "wmul%21?sumr%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ee000c0, 0x0fe00ff0, "wmulwsm%20`r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ec000c0, 0x0fe00ff0, "wmulwum%20`r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0eb000c0, 0x0ff00ff0, "wmulwl%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e8000a0, 0x0f800ff0, "wqmia%21?tb%20?tb%22'n%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100080, 0x0fd00ff0, "wqmulm%21'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ec000e0, 0x0fd00ff0, "wqmulwm%21'r%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000000, 0x0ff00ff0, "wor%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000080, 0x0f000ff0, "wpack%20-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0xfe300040, 0xff300ef0, "wror%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e300040, 0x0f300ff0, "wror%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e300140, 0x0f300ff0, "wror%22-23wg%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0x0e000120, 0x0fa00ff0, "wsad%22?hb%20'z%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e0001e0, 0x0f000ff0, "wshufh%c\t%12-15g, %16-19g, #%Z"},
+  {ARM_CEXT_XSCALE, 0xfe100040, 0xff300ef0, "wsll%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e100040, 0x0f300ff0, "wsll%22-23w%8'g%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100148, 0x0f300ffc, "wsll%22-23w%8'g%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0xfe000040, 0xff300ef0, "wsra%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e000040, 0x0f300ff0, "wsra%22-23w%8'g%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e000148, 0x0f300ffc, "wsra%22-23w%8'g%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0xfe200040, 0xff300ef0, "wsrl%22-23w\t%12-15g, %16-19g, #%i"},
+  {ARM_CEXT_XSCALE, 0x0e200040, 0x0f300ff0, "wsrl%22-23w%8'g%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e200148, 0x0f300ffc, "wsrl%22-23w%8'g%c\t%12-15g, %16-19g, %0-3G"},
+  {ARM_CEXT_XSCALE, 0xfc400100, 0xfe500f00, "wstrd\t%12-15g, %r"},
+  {ARM_CEXT_XSCALE, 0xfc000100, 0xfe500f00, "wstrw\t%12-15G, %A"},
+  {ARM_CEXT_XSCALE, 0x0c000000, 0x0e100e00, "wstr%L%c\t%12-15g, %l"},
+  {ARM_CEXT_XSCALE, 0x0e0001a0, 0x0f000ff0, "wsub%20-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0ed001c0, 0x0ff00ff0, "wsubaddhx%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e1001c0, 0x0f300ff0, "wabsdiff%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e0000c0, 0x0fd00fff, "wunpckeh%21?sub%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e4000c0, 0x0fd00fff, "wunpckeh%21?suh%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e8000c0, 0x0fd00fff, "wunpckeh%21?suw%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e0000e0, 0x0f100fff, "wunpckel%21?su%22-23w%c\t%12-15g, %16-19g"},
+  {ARM_CEXT_XSCALE, 0x0e1000c0, 0x0f300ff0, "wunpckih%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e1000e0, 0x0f300ff0, "wunpckil%22-23w%c\t%12-15g, %16-19g, %0-3g"},
+  {ARM_CEXT_XSCALE, 0x0e100000, 0x0ff00ff0, "wxor%c\t%12-15g, %16-19g, %0-3g"},
+
+  /* Floating point coprocessor (FPA) instructions */
+  {FPU_FPA_EXT_V1, 0x0e000100, 0x0ff08f10, "adf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e100100, 0x0ff08f10, "muf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e200100, 0x0ff08f10, "suf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e300100, 0x0ff08f10, "rsf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e400100, 0x0ff08f10, "dvf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e500100, 0x0ff08f10, "rdf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e600100, 0x0ff08f10, "pow%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e700100, 0x0ff08f10, "rpw%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e800100, 0x0ff08f10, "rmf%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e900100, 0x0ff08f10, "fml%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ea00100, 0x0ff08f10, "fdv%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0eb00100, 0x0ff08f10, "frd%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ec00100, 0x0ff08f10, "pol%c%P%R\t%12-14f, %16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e008100, 0x0ff08f10, "mvf%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e108100, 0x0ff08f10, "mnf%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e208100, 0x0ff08f10, "abs%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e308100, 0x0ff08f10, "rnd%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e408100, 0x0ff08f10, "sqt%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e508100, 0x0ff08f10, "log%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e608100, 0x0ff08f10, "lgn%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e708100, 0x0ff08f10, "exp%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e808100, 0x0ff08f10, "sin%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e908100, 0x0ff08f10, "cos%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ea08100, 0x0ff08f10, "tan%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0eb08100, 0x0ff08f10, "asn%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ec08100, 0x0ff08f10, "acs%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ed08100, 0x0ff08f10, "atn%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ee08100, 0x0ff08f10, "urd%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ef08100, 0x0ff08f10, "nrm%c%P%R\t%12-14f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0e000110, 0x0ff00f1f, "flt%c%P%R\t%16-18f, %12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e100110, 0x0fff0f98, "fix%c%R\t%12-15r, %0-2f"},
+  {FPU_FPA_EXT_V1, 0x0e200110, 0x0fff0fff, "wfs%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e300110, 0x0fff0fff, "rfs%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e400110, 0x0fff0fff, "wfc%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e500110, 0x0fff0fff, "rfc%c\t%12-15r"},
+  {FPU_FPA_EXT_V1, 0x0e90f110, 0x0ff8fff0, "cmf%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0eb0f110, 0x0ff8fff0, "cnf%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ed0f110, 0x0ff8fff0, "cmfe%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0ef0f110, 0x0ff8fff0, "cnfe%c\t%16-18f, %0-3f"},
+  {FPU_FPA_EXT_V1, 0x0c000100, 0x0e100f00, "stf%c%Q\t%12-14f, %A"},
+  {FPU_FPA_EXT_V1, 0x0c100100, 0x0e100f00, "ldf%c%Q\t%12-14f, %A"},
+  {FPU_FPA_EXT_V2, 0x0c000200, 0x0e100f00, "sfm%c\t%12-14f, %F, %A"},
+  {FPU_FPA_EXT_V2, 0x0c100200, 0x0e100f00, "lfm%c\t%12-14f, %F, %A"},
+
+  /* Register load/store */
+  {FPU_NEON_EXT_V1, 0x0d200b00, 0x0fb00f01, "vstmdb%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0d300b00, 0x0fb00f01, "vldmdb%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0c800b00, 0x0f900f01, "vstmia%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0c900b00, 0x0f900f01, "vldmia%c\t%16-19r%21'!, %B"},
+  {FPU_NEON_EXT_V1, 0x0d000b00, 0x0f300f00, "vstr%c\t%12-15,22D, %C"},
+  {FPU_NEON_EXT_V1, 0x0d100b00, 0x0f300f00, "vldr%c\t%12-15,22D, %C"},
+
+  /* Data transfer between ARM and NEON registers */
+  {FPU_NEON_EXT_V1, 0x0e800b10, 0x0ff00f70, "vdup%c.32\t%16-19,7D, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e800b30, 0x0ff00f70, "vdup%c.16\t%16-19,7D, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ea00b10, 0x0ff00f70, "vdup%c.32\t%16-19,7Q, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ea00b30, 0x0ff00f70, "vdup%c.16\t%16-19,7Q, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ec00b10, 0x0ff00f70, "vdup%c.8\t%16-19,7D, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0ee00b10, 0x0ff00f70, "vdup%c.8\t%16-19,7Q, %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0c400b10, 0x0ff00fd0, "vmov%c\t%0-3,5D, %12-15r, %16-19r"},
+  {FPU_NEON_EXT_V1, 0x0c500b10, 0x0ff00fd0, "vmov%c\t%12-15r, %16-19r, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0x0e000b10, 0x0fd00f70, "vmov%c.32\t%16-19,7D[%21d], %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e100b10, 0x0f500f70, "vmov%c.32\t%12-15r, %16-19,7D[%21d]"},
+  {FPU_NEON_EXT_V1, 0x0e000b30, 0x0fd00f30, "vmov%c.16\t%16-19,7D[%6,21d], %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e100b30, 0x0f500f30, "vmov%c.%23?us16\t%12-15r, %16-19,7D[%6,21d]"},
+  {FPU_NEON_EXT_V1, 0x0e400b10, 0x0fd00f10, "vmov%c.8\t%16-19,7D[%5,6,21d], %12-15r"},
+  {FPU_NEON_EXT_V1, 0x0e500b10, 0x0f500f10, "vmov%c.%23?us8\t%12-15r, %16-19,7D[%5,6,21d]"},
+
+  /* Floating point coprocessor (VFP) instructions */
+  {FPU_VFP_EXT_V1xD, 0x0ef1fa10, 0x0fffffff, "fmstat%c"},
+  {FPU_VFP_EXT_V1xD, 0x0ee00a10, 0x0fff0fff, "fmxr%c\tfpsid, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee10a10, 0x0fff0fff, "fmxr%c\tfpscr, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee60a10, 0x0fff0fff, "fmxr%c\tmvfr1, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee70a10, 0x0fff0fff, "fmxr%c\tmvfr0, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee80a10, 0x0fff0fff, "fmxr%c\tfpexc, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ee90a10, 0x0fff0fff, "fmxr%c\tfpinst, %12-15r\t@ Impl def"},
+  {FPU_VFP_EXT_V1xD, 0x0eea0a10, 0x0fff0fff, "fmxr%c\tfpinst2, %12-15r\t@ Impl def"},
+  {FPU_VFP_EXT_V1xD, 0x0ef00a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpsid"},
+  {FPU_VFP_EXT_V1xD, 0x0ef10a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpscr"},
+  {FPU_VFP_EXT_V1xD, 0x0ef60a10, 0x0fff0fff, "fmrx%c\t%12-15r, mvfr1"},
+  {FPU_VFP_EXT_V1xD, 0x0ef70a10, 0x0fff0fff, "fmrx%c\t%12-15r, mvfr0"},
+  {FPU_VFP_EXT_V1xD, 0x0ef80a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpexc"},
+  {FPU_VFP_EXT_V1xD, 0x0ef90a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst\t@ Impl def"},
+  {FPU_VFP_EXT_V1xD, 0x0efa0a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst2\t@ Impl def"},
+  {FPU_VFP_EXT_V1, 0x0e000b10, 0x0ff00fff, "fmdlr%c\t%z2, %12-15r"},
+  {FPU_VFP_EXT_V1, 0x0e100b10, 0x0ff00fff, "fmrdl%c\t%12-15r, %z2"},
+  {FPU_VFP_EXT_V1, 0x0e200b10, 0x0ff00fff, "fmdhr%c\t%z2, %12-15r"},
+  {FPU_VFP_EXT_V1, 0x0e300b10, 0x0ff00fff, "fmrdh%c\t%12-15r, %z2"},
+  {FPU_VFP_EXT_V1xD, 0x0ee00a10, 0x0ff00fff, "fmxr%c\t<impl def %16-19x>, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0ef00a10, 0x0ff00fff, "fmrx%c\t%12-15r, <impl def %16-19x>"},
+  {FPU_VFP_EXT_V1xD, 0x0e000a10, 0x0ff00f7f, "fmsr%c\t%y2, %12-15r"},
+  {FPU_VFP_EXT_V1xD, 0x0e100a10, 0x0ff00f7f, "fmrs%c\t%12-15r, %y2"},
+  {FPU_VFP_EXT_V1xD, 0x0eb50a40, 0x0fbf0f70, "fcmp%7'ezs%c\t%y1"},
+  {FPU_VFP_EXT_V1, 0x0eb50b40, 0x0fbf0f70, "fcmp%7'ezd%c\t%z1"},
+  {FPU_VFP_EXT_V1xD, 0x0eb00a40, 0x0fbf0fd0, "fcpys%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb00ac0, 0x0fbf0fd0, "fabss%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb00b40, 0x0fbf0fd0, "fcpyd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1, 0x0eb00bc0, 0x0fbf0fd0, "fabsd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb10a40, 0x0fbf0fd0, "fnegs%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb10ac0, 0x0fbf0fd0, "fsqrts%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb10b40, 0x0fbf0fd0, "fnegd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1, 0x0eb10bc0, 0x0fbf0fd0, "fsqrtd%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V1, 0x0eb70ac0, 0x0fbf0fd0, "fcvtds%c\t%z1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb70bc0, 0x0fbf0fd0, "fcvtsd%c\t%y1, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb80a40, 0x0fbf0fd0, "fuitos%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb80ac0, 0x0fbf0fd0, "fsitos%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb80b40, 0x0fbf0fd0, "fuitod%c\t%z1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb80bc0, 0x0fbf0fd0, "fsitod%c\t%z1, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0eb40a40, 0x0fbf0f50, "fcmp%7'es%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0eb40b40, 0x0fbf0f50, "fcmp%7'ed%c\t%z1, %z0"},
+  {FPU_VFP_EXT_V3, 0x0eba0a40, 0x0fbe0f50, "f%16?us%7?lhtos%c\t%y1, #%5,0-3k"},
+  {FPU_VFP_EXT_V3, 0x0eba0b40, 0x0fbe0f50, "f%16?us%7?lhtod%c\t%z1, #%5,0-3k"},
+  {FPU_VFP_EXT_V1xD, 0x0ebc0a40, 0x0fbe0f50, "fto%16?sui%7'zs%c\t%y1, %y0"},
+  {FPU_VFP_EXT_V1, 0x0ebc0b40, 0x0fbe0f50, "fto%16?sui%7'zd%c\t%y1, %z0"},
+  {FPU_VFP_EXT_V3, 0x0ebe0a40, 0x0fbe0f50, "fto%16?us%7?lhs%c\t%y1, #%5,0-3k"},
+  {FPU_VFP_EXT_V3, 0x0ebe0b40, 0x0fbe0f50, "fto%16?us%7?lhd%c\t%z1, #%5,0-3k"},
+  {FPU_VFP_EXT_V1, 0x0c500b10, 0x0fb00ff0, "fmrrd%c\t%12-15r, %16-19r, %z0"},
+  {FPU_VFP_EXT_V3, 0x0eb00a00, 0x0fb00ff0, "fconsts%c\t%y1, #%0-3,16-19d"},
+  {FPU_VFP_EXT_V3, 0x0eb00b00, 0x0fb00ff0, "fconstd%c\t%z1, #%0-3,16-19d"},
+  {FPU_VFP_EXT_V2, 0x0c400a10, 0x0ff00fd0, "fmsrr%c\t%y4, %12-15r, %16-19r"},
+  {FPU_VFP_EXT_V2, 0x0c400b10, 0x0ff00fd0, "fmdrr%c\t%z0, %12-15r, %16-19r"},
+  {FPU_VFP_EXT_V2, 0x0c500a10, 0x0ff00fd0, "fmrrs%c\t%12-15r, %16-19r, %y4"},
+  {FPU_VFP_EXT_V1xD, 0x0e000a00, 0x0fb00f50, "fmacs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e000a40, 0x0fb00f50, "fnmacs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e000b00, 0x0fb00f50, "fmacd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e000b40, 0x0fb00f50, "fnmacd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e100a00, 0x0fb00f50, "fmscs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e100a40, 0x0fb00f50, "fnmscs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e100b00, 0x0fb00f50, "fmscd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e100b40, 0x0fb00f50, "fnmscd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e200a00, 0x0fb00f50, "fmuls%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e200a40, 0x0fb00f50, "fnmuls%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e200b00, 0x0fb00f50, "fmuld%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e200b40, 0x0fb00f50, "fnmuld%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e300a00, 0x0fb00f50, "fadds%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1xD, 0x0e300a40, 0x0fb00f50, "fsubs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e300b00, 0x0fb00f50, "faddd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1, 0x0e300b40, 0x0fb00f50, "fsubd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0e800a00, 0x0fb00f50, "fdivs%c\t%y1, %y2, %y0"},
+  {FPU_VFP_EXT_V1, 0x0e800b00, 0x0fb00f50, "fdivd%c\t%z1, %z2, %z0"},
+  {FPU_VFP_EXT_V1xD, 0x0d200a00, 0x0fb00f00, "fstmdbs%c\t%16-19r!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0d200b00, 0x0fb00f00, "fstmdb%0?xd%c\t%16-19r!, %z3"},
+  {FPU_VFP_EXT_V1xD, 0x0d300a00, 0x0fb00f00, "fldmdbs%c\t%16-19r!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0d300b00, 0x0fb00f00, "fldmdb%0?xd%c\t%16-19r!, %z3"},
+  {FPU_VFP_EXT_V1xD, 0x0d000a00, 0x0f300f00, "fsts%c\t%y1, %A"},
+  {FPU_VFP_EXT_V1, 0x0d000b00, 0x0f300f00, "fstd%c\t%z1, %A"},
+  {FPU_VFP_EXT_V1xD, 0x0d100a00, 0x0f300f00, "flds%c\t%y1, %A"},
+  {FPU_VFP_EXT_V1, 0x0d100b00, 0x0f300f00, "fldd%c\t%z1, %A"},
+  {FPU_VFP_EXT_V1xD, 0x0c800a00, 0x0f900f00, "fstmias%c\t%16-19r%21'!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0c800b00, 0x0f900f00, "fstmia%0?xd%c\t%16-19r%21'!, %z3"},
+  {FPU_VFP_EXT_V1xD, 0x0c900a00, 0x0f900f00, "fldmias%c\t%16-19r%21'!, %y3"},
+  {FPU_VFP_EXT_V1xD, 0x0c900b00, 0x0f900f00, "fldmia%0?xd%c\t%16-19r%21'!, %z3"},
+
+  /* Cirrus coprocessor instructions.  */
+  {ARM_CEXT_MAVERICK, 0x0d100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0d400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0c400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
+  {ARM_CEXT_MAVERICK, 0x0e000450, 0x0ff00ff0, "cfmvsr%c\tmvf%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100450, 0x0ff00ff0, "cfmvrs%c\t%12-15r, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000410, 0x0ff00ff0, "cfmvdlr%c\tmvd%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100410, 0x0ff00ff0, "cfmvrdl%c\t%12-15r, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000430, 0x0ff00ff0, "cfmvdhr%c\tmvd%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100430, 0x0ff00fff, "cfmvrdh%c\t%12-15r, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000510, 0x0ff00fff, "cfmv64lr%c\tmvdx%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100510, 0x0ff00fff, "cfmvr64l%c\t%12-15r, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000530, 0x0ff00fff, "cfmv64hr%c\tmvdx%16-19d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e100530, 0x0ff00fff, "cfmvr64h%c\t%12-15r, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e200440, 0x0ff00fff, "cfmval32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100440, 0x0ff00fff, "cfmv32al%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e200460, 0x0ff00fff, "cfmvam32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100460, 0x0ff00fff, "cfmv32am%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e200480, 0x0ff00fff, "cfmvah32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100480, 0x0ff00fff, "cfmv32ah%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e2004a0, 0x0ff00fff, "cfmva32%c\tmvax%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004a0, 0x0ff00fff, "cfmv32a%c\tmvfx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e2004c0, 0x0ff00fff, "cfmva64%c\tmvax%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004c0, 0x0ff00fff, "cfmv64a%c\tmvdx%12-15d, mvax%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e2004e0, 0x0fff0fff, "cfmvsc32%c\tdspsc, mvdx%12-15d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004e0, 0x0fff0fff, "cfmv32sc%c\tmvdx%12-15d, dspsc"},
+  {ARM_CEXT_MAVERICK, 0x0e000400, 0x0ff00fff, "cfcpys%c\tmvf%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000420, 0x0ff00fff, "cfcpyd%c\tmvd%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000460, 0x0ff00fff, "cfcvtsd%c\tmvd%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000440, 0x0ff00fff, "cfcvtds%c\tmvf%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000480, 0x0ff00fff, "cfcvt32s%c\tmvf%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e0004a0, 0x0ff00fff, "cfcvt32d%c\tmvd%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e0004c0, 0x0ff00fff, "cfcvt64s%c\tmvf%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e0004e0, 0x0ff00fff, "cfcvt64d%c\tmvd%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e100580, 0x0ff00fff, "cfcvts32%c\tmvfx%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005a0, 0x0ff00fff, "cfcvtd32%c\tmvfx%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005c0, 0x0ff00fff, "cftruncs32%c\tmvfx%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005e0, 0x0ff00fff, "cftruncd32%c\tmvfx%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e000550, 0x0ff00ff0, "cfrshl32%c\tmvfx%16-19d, mvfx%0-3d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e000570, 0x0ff00ff0, "cfrshl64%c\tmvdx%16-19d, mvdx%0-3d, %12-15r"},
+  {ARM_CEXT_MAVERICK, 0x0e000500, 0x0ff00f10, "cfsh32%c\tmvfx%12-15d, mvfx%16-19d, #%I"},
+  {ARM_CEXT_MAVERICK, 0x0e200500, 0x0ff00f10, "cfsh64%c\tmvdx%12-15d, mvdx%16-19d, #%I"},
+  {ARM_CEXT_MAVERICK, 0x0e100490, 0x0ff00ff0, "cfcmps%c\t%12-15r, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e1004b0, 0x0ff00ff0, "cfcmpd%c\t%12-15r, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100590, 0x0ff00ff0, "cfcmp32%c\t%12-15r, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e1005b0, 0x0ff00ff0, "cfcmp64%c\t%12-15r, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e300400, 0x0ff00fff, "cfabss%c\tmvf%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300420, 0x0ff00fff, "cfabsd%c\tmvd%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300440, 0x0ff00fff, "cfnegs%c\tmvf%12-15d, mvf%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300460, 0x0ff00fff, "cfnegd%c\tmvd%12-15d, mvd%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300480, 0x0ff00ff0, "cfadds%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3004a0, 0x0ff00ff0, "cfaddd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3004c0, 0x0ff00ff0, "cfsubs%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3004e0, 0x0ff00ff0, "cfsubd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100400, 0x0ff00ff0, "cfmuls%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100420, 0x0ff00ff0, "cfmuld%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e300500, 0x0ff00fff, "cfabs32%c\tmvfx%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300520, 0x0ff00fff, "cfabs64%c\tmvdx%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300540, 0x0ff00fff, "cfneg32%c\tmvfx%12-15d, mvfx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300560, 0x0ff00fff, "cfneg64%c\tmvdx%12-15d, mvdx%16-19d"},
+  {ARM_CEXT_MAVERICK, 0x0e300580, 0x0ff00ff0, "cfadd32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3005a0, 0x0ff00ff0, "cfadd64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3005c0, 0x0ff00ff0, "cfsub32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e3005e0, 0x0ff00ff0, "cfsub64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100500, 0x0ff00ff0, "cfmul32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100520, 0x0ff00ff0, "cfmul64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100540, 0x0ff00ff0, "cfmac32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100560, 0x0ff00ff0, "cfmsc32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e000600, 0x0ff00f10, "cfmadd32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e100600, 0x0ff00f10, "cfmsub32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e200600, 0x0ff00f10, "cfmadda32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_CEXT_MAVERICK, 0x0e300600, 0x0ff00f10, "cfmsuba32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
+
+  /* Generic coprocessor instructions */
+  {ARM_EXT_V2, 0x0c400000, 0x0ff00000, "mcrr%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+  {ARM_EXT_V2, 0x0c500000, 0x0ff00000, "mrrc%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+  {ARM_EXT_V2, 0x0e000000, 0x0f000010, "cdp%c\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V2, 0x0e100010, 0x0f100010, "mrc%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V2, 0x0e000010, 0x0f100010, "mcr%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V2, 0x0c000000, 0x0e100000, "stc%22'l%c\t%8-11d, cr%12-15d, %A"},
+  {ARM_EXT_V2, 0x0c100000, 0x0e100000, "ldc%22'l%c\t%8-11d, cr%12-15d, %A"},
+
+  /* V6 coprocessor instructions */
+  {ARM_EXT_V6, 0xfc500000, 0xfff00000, "mrrc2%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+  {ARM_EXT_V6, 0xfc400000, 0xfff00000, "mcrr2%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+
+  /* V5 coprocessor instructions */
+  {ARM_EXT_V5, 0xfc100000, 0xfe100000, "ldc2%22'l%c\t%8-11d, cr%12-15d, %A"},
+  {ARM_EXT_V5, 0xfc000000, 0xfe100000, "stc2%22'l%c\t%8-11d, cr%12-15d, %A"},
+  {ARM_EXT_V5, 0xfe000000, 0xff000010, "cdp2%c\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V5, 0xfe000010, 0xff100010, "mcr2%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+  {ARM_EXT_V5, 0xfe100010, 0xff100010, "mrc2%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+
+  {0, 0, 0, 0}
+};
+
+/* Neon opcode table:  This does not encode the top byte -- that is
+   checked by the print_insn_neon routine, as it depends on whether we are
+   doing thumb32 or arm32 disassembly.  */
+
+/* print_insn_neon recognizes the following format control codes:
+
+   %%			%
+
+   %c			print condition code
+   %A			print v{st,ld}[1234] operands
+   %B			print v{st,ld}[1234] any one operands
+   %C			print v{st,ld}[1234] single->all operands
+   %D			print scalar
+   %E			print vmov, vmvn, vorr, vbic encoded constant
+   %F			print vtbl,vtbx register list
+
+   %<bitfield>r		print as an ARM register
+   %<bitfield>d		print the bitfield in decimal
+   %<bitfield>e         print the 2^N - bitfield in decimal
+   %<bitfield>D		print as a NEON D register
+   %<bitfield>Q		print as a NEON Q register
+   %<bitfield>R		print as a NEON D or Q register
+   %<bitfield>Sn	print byte scaled width limited by n
+   %<bitfield>Tn	print short scaled width limited by n
+   %<bitfield>Un	print long scaled width limited by n
+
+   %<bitfield>'c	print specified char iff bitfield is all ones
+   %<bitfield>`c	print specified char iff bitfield is all zeroes
+   %<bitfield>?ab...    select from array of values in big endian order  */
+
+static const struct opcode32 neon_opcodes[] =
+{
+  /* Extract */
+  {FPU_NEON_EXT_V1, 0xf2b00840, 0xffb00850, "vext%c.8\t%12-15,22R, %16-19,7R, %0-3,5R, #%8-11d"},
+  {FPU_NEON_EXT_V1, 0xf2b00000, 0xffb00810, "vext%c.8\t%12-15,22R, %16-19,7R, %0-3,5R, #%8-11d"},
+
+  /* Move data element to all lanes */
+  {FPU_NEON_EXT_V1, 0xf3b40c00, 0xffb70f90, "vdup%c.32\t%12-15,22R, %0-3,5D[%19d]"},
+  {FPU_NEON_EXT_V1, 0xf3b20c00, 0xffb30f90, "vdup%c.16\t%12-15,22R, %0-3,5D[%18-19d]"},
+  {FPU_NEON_EXT_V1, 0xf3b10c00, 0xffb10f90, "vdup%c.8\t%12-15,22R, %0-3,5D[%17-19d]"},
+
+  /* Table lookup */
+  {FPU_NEON_EXT_V1, 0xf3b00800, 0xffb00c50, "vtbl%c.8\t%12-15,22D, %F, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf3b00840, 0xffb00c50, "vtbx%c.8\t%12-15,22D, %F, %0-3,5D"},
+
+  /* Two registers, miscellaneous */
+  {FPU_NEON_EXT_V1, 0xf2880a10, 0xfebf0fd0, "vmovl%c.%24?us8\t%12-15,22Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2900a10, 0xfebf0fd0, "vmovl%c.%24?us16\t%12-15,22Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2a00a10, 0xfebf0fd0, "vmovl%c.%24?us32\t%12-15,22Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf3b00500, 0xffbf0f90, "vcnt%c.8\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00580, 0xffbf0f90, "vmvn%c\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20000, 0xffbf0f90, "vswp%c\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20200, 0xffb30fd0, "vmovn%c.i%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b20240, 0xffb30fd0, "vqmovun%c.s%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b20280, 0xffb30fd0, "vqmovn%c.s%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b202c0, 0xffb30fd0, "vqmovn%c.u%18-19T2\t%12-15,22D, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3b20300, 0xffb30fd0, "vshll%c.i%18-19S2\t%12-15,22Q, %0-3,5D, #%18-19S2"},
+  {FPU_NEON_EXT_V1, 0xf3bb0400, 0xffbf0e90, "vrecpe%c.%8?fu%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3bb0480, 0xffbf0e90, "vrsqrte%c.%8?fu%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00000, 0xffb30f90, "vrev64%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00080, 0xffb30f90, "vrev32%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00100, 0xffb30f90, "vrev16%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00400, 0xffb30f90, "vcls%c.s%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00480, 0xffb30f90, "vclz%c.i%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00700, 0xffb30f90, "vqabs%c.s%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00780, 0xffb30f90, "vqneg%c.s%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20080, 0xffb30f90, "vtrn%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20100, 0xffb30f90, "vuzp%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b20180, 0xffb30f90, "vzip%c.%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b10000, 0xffb30b90, "vcgt%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10080, 0xffb30b90, "vcge%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10100, 0xffb30b90, "vceq%c.%10?fi%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10180, 0xffb30b90, "vcle%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10200, 0xffb30b90, "vclt%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R, #0"},
+  {FPU_NEON_EXT_V1, 0xf3b10300, 0xffb30b90, "vabs%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b10380, 0xffb30b90, "vneg%c.%10?fs%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00200, 0xffb30f10, "vpaddl%c.%7?us%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b00600, 0xffb30f10, "vpadal%c.%7?us%18-19S2\t%12-15,22R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3b30600, 0xffb30e10, "vcvt%c.%7-8?usff%18-19Sa.%7-8?ffus%18-19Sa\t%12-15,22R, %0-3,5R"},
+
+  /* Three registers of the same length */
+  {FPU_NEON_EXT_V1, 0xf2000110, 0xffb00f10, "vand%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2100110, 0xffb00f10, "vbic%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200110, 0xffb00f10, "vorr%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2300110, 0xffb00f10, "vorn%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000110, 0xffb00f10, "veor%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3100110, 0xffb00f10, "vbsl%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200110, 0xffb00f10, "vbit%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3300110, 0xffb00f10, "vbif%c\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000d00, 0xffa00f10, "vadd%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000d10, 0xffa00f10, "vmla%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000e00, 0xffa00f10, "vceq%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000f00, 0xffa00f10, "vmax%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000f10, 0xffa00f10, "vrecps%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200d00, 0xffa00f10, "vsub%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200d10, 0xffa00f10, "vmls%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200f00, 0xffa00f10, "vmin%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2200f10, 0xffa00f10, "vrsqrts%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000d00, 0xffa00f10, "vpadd%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000d10, 0xffa00f10, "vmul%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000e00, 0xffa00f10, "vcge%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000e10, 0xffa00f10, "vacge%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000f00, 0xffa00f10, "vpmax%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200d00, 0xffa00f10, "vabd%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200e00, 0xffa00f10, "vcgt%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200e10, 0xffa00f10, "vacgt%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3200f00, 0xffa00f10, "vpmin%c.f%20U0\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000800, 0xff800f10, "vadd%c.i%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000810, 0xff800f10, "vtst%c.%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000900, 0xff800f10, "vmla%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000b00, 0xff800f10, "vqdmulh%c.s%20-21S6\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000b10, 0xff800f10, "vpadd%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000800, 0xff800f10, "vsub%c.i%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000810, 0xff800f10, "vceq%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000900, 0xff800f10, "vmls%c.i%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf3000b00, 0xff800f10, "vqrdmulh%c.s%20-21S6\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000000, 0xfe800f10, "vhadd%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000010, 0xfe800f10, "vqadd%c.%24?us%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000100, 0xfe800f10, "vrhadd%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000200, 0xfe800f10, "vhsub%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000210, 0xfe800f10, "vqsub%c.%24?us%20-21S3\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000300, 0xfe800f10, "vcgt%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000310, 0xfe800f10, "vcge%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000400, 0xfe800f10, "vshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000410, 0xfe800f10, "vqshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000500, 0xfe800f10, "vrshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000510, 0xfe800f10, "vqrshl%c.%24?us%20-21S3\t%12-15,22R, %0-3,5R, %16-19,7R"},
+  {FPU_NEON_EXT_V1, 0xf2000600, 0xfe800f10, "vmax%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000610, 0xfe800f10, "vmin%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000700, 0xfe800f10, "vabd%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000710, 0xfe800f10, "vaba%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000910, 0xfe800f10, "vmul%c.%24?pi%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000a00, 0xfe800f10, "vpmax%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+  {FPU_NEON_EXT_V1, 0xf2000a10, 0xfe800f10, "vpmin%c.%24?us%20-21S2\t%12-15,22R, %16-19,7R, %0-3,5R"},
+
+  /* One register and an immediate value */
+  {FPU_NEON_EXT_V1, 0xf2800e10, 0xfeb80fb0, "vmov%c.i8\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800e30, 0xfeb80fb0, "vmov%c.i64\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800f10, 0xfeb80fb0, "vmov%c.f32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800810, 0xfeb80db0, "vmov%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800830, 0xfeb80db0, "vmvn%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800910, 0xfeb80db0, "vorr%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800930, 0xfeb80db0, "vbic%c.i16\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800c10, 0xfeb80eb0, "vmov%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800c30, 0xfeb80eb0, "vmvn%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800110, 0xfeb809b0, "vorr%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800130, 0xfeb809b0, "vbic%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800010, 0xfeb808b0, "vmov%c.i32\t%12-15,22R, %E"},
+  {FPU_NEON_EXT_V1, 0xf2800030, 0xfeb808b0, "vmvn%c.i32\t%12-15,22R, %E"},
+
+  /* Two registers and a shift amount */
+  {FPU_NEON_EXT_V1, 0xf2880810, 0xffb80fd0, "vshrn%c.i16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880850, 0xffb80fd0, "vrshrn%c.i16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880810, 0xfeb80fd0, "vqshrun%c.s16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880850, 0xfeb80fd0, "vqrshrun%c.s16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880910, 0xfeb80fd0, "vqshrn%c.%24?us16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880950, 0xfeb80fd0, "vqrshrn%c.%24?us16\t%12-15,22D, %0-3,5Q, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880a10, 0xfeb80fd0, "vshll%c.%24?us8\t%12-15,22D, %0-3,5Q, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf2900810, 0xffb00fd0, "vshrn%c.i32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900850, 0xffb00fd0, "vrshrn%c.i32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2880510, 0xffb80f90, "vshl%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf3880410, 0xffb80f90, "vsri%c.8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf3880510, 0xffb80f90, "vsli%c.8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf3880610, 0xffb80f90, "vqshlu%c.s8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf2900810, 0xfeb00fd0, "vqshrun%c.s32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900850, 0xfeb00fd0, "vqrshrun%c.s32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900910, 0xfeb00fd0, "vqshrn%c.%24?us32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900950, 0xfeb00fd0, "vqrshrn%c.%24?us32\t%12-15,22D, %0-3,5Q, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900a10, 0xfeb00fd0, "vshll%c.%24?us16\t%12-15,22D, %0-3,5Q, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf2880010, 0xfeb80f90, "vshr%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880110, 0xfeb80f90, "vsra%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880210, 0xfeb80f90, "vrshr%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880310, 0xfeb80f90, "vrsra%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18e"},
+  {FPU_NEON_EXT_V1, 0xf2880710, 0xfeb80f90, "vqshl%c.%24?us8\t%12-15,22R, %0-3,5R, #%16-18d"},
+  {FPU_NEON_EXT_V1, 0xf2a00810, 0xffa00fd0, "vshrn%c.i64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00850, 0xffa00fd0, "vrshrn%c.i64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2900510, 0xffb00f90, "vshl%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf3900410, 0xffb00f90, "vsri%c.16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf3900510, 0xffb00f90, "vsli%c.16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf3900610, 0xffb00f90, "vqshlu%c.s16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf2a00a10, 0xfea00fd0, "vshll%c.%24?us32\t%12-15,22D, %0-3,5Q, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf2900010, 0xfeb00f90, "vshr%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900110, 0xfeb00f90, "vsra%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900210, 0xfeb00f90, "vrshr%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900310, 0xfeb00f90, "vrsra%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19e"},
+  {FPU_NEON_EXT_V1, 0xf2900710, 0xfeb00f90, "vqshl%c.%24?us16\t%12-15,22R, %0-3,5R, #%16-19d"},
+  {FPU_NEON_EXT_V1, 0xf2800810, 0xfec00fd0, "vqshrun%c.s64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2800850, 0xfec00fd0, "vqrshrun%c.s64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2800910, 0xfec00fd0, "vqshrn%c.%24?us64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2800950, 0xfec00fd0, "vqrshrn%c.%24?us64\t%12-15,22D, %0-3,5Q, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00510, 0xffa00f90, "vshl%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf3a00410, 0xffa00f90, "vsri%c.32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf3a00510, 0xffa00f90, "vsli%c.32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf3a00610, 0xffa00f90, "vqshlu%c.s32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf2a00010, 0xfea00f90, "vshr%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00110, 0xfea00f90, "vsra%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00210, 0xfea00f90, "vrshr%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00310, 0xfea00f90, "vrsra%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20e"},
+  {FPU_NEON_EXT_V1, 0xf2a00710, 0xfea00f90, "vqshl%c.%24?us32\t%12-15,22R, %0-3,5R, #%16-20d"},
+  {FPU_NEON_EXT_V1, 0xf2800590, 0xff800f90, "vshl%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf3800490, 0xff800f90, "vsri%c.64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf3800590, 0xff800f90, "vsli%c.64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf3800690, 0xff800f90, "vqshlu%c.s64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf2800090, 0xfe800f90, "vshr%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800190, 0xfe800f90, "vsra%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800290, 0xfe800f90, "vrshr%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800390, 0xfe800f90, "vrsra%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21e"},
+  {FPU_NEON_EXT_V1, 0xf2800790, 0xfe800f90, "vqshl%c.%24?us64\t%12-15,22R, %0-3,5R, #%16-21d"},
+  {FPU_NEON_EXT_V1, 0xf2a00e10, 0xfea00e90, "vcvt%c.%24,8?usff32.%24,8?ffus32\t%12-15,22R, %0-3,5R, #%16-20e"},
+
+  /* Three registers of different lengths */
+  {FPU_NEON_EXT_V1, 0xf2800e00, 0xfea00f50, "vmull%c.p%20S0\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800400, 0xff800f50, "vaddhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf2800600, 0xff800f50, "vsubhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf2800900, 0xff800f50, "vqdmlal%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800b00, 0xff800f50, "vqdmlsl%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800d00, 0xff800f50, "vqdmull%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf3800400, 0xff800f50, "vraddhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf3800600, 0xff800f50, "vrsubhn%c.i%20-21T2\t%12-15,22D, %16-19,7Q, %0-3,5Q"},
+  {FPU_NEON_EXT_V1, 0xf2800000, 0xfe800f50, "vaddl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800100, 0xfe800f50, "vaddw%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800200, 0xfe800f50, "vsubl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800300, 0xfe800f50, "vsubw%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7Q, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800500, 0xfe800f50, "vabal%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800700, 0xfe800f50, "vabdl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800800, 0xfe800f50, "vmlal%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800a00, 0xfe800f50, "vmlsl%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+  {FPU_NEON_EXT_V1, 0xf2800c00, 0xfe800f50, "vmull%c.%24?us%20-21S2\t%12-15,22Q, %16-19,7D, %0-3,5D"},
+
+  /* Two registers and a scalar */
+  {FPU_NEON_EXT_V1, 0xf2800040, 0xff800f50, "vmla%c.i%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800140, 0xff800f50, "vmla%c.f%20-21Sa\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800340, 0xff800f50, "vqdmlal%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800440, 0xff800f50, "vmls%c.i%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800540, 0xff800f50, "vmls%c.f%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800740, 0xff800f50, "vqdmlsl%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800840, 0xff800f50, "vmul%c.i%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800940, 0xff800f50, "vmul%c.f%20-21Sa\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800b40, 0xff800f50, "vqdmull%c.s%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800c40, 0xff800f50, "vqdmulh%c.s%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800d40, 0xff800f50, "vqrdmulh%c.s%20-21S6\t%12-15,22D, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800040, 0xff800f50, "vmla%c.i%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800140, 0xff800f50, "vmla%c.f%20-21Sa\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800440, 0xff800f50, "vmls%c.i%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800540, 0xff800f50, "vmls%c.f%20-21Sa\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800840, 0xff800f50, "vmul%c.i%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800940, 0xff800f50, "vmul%c.f%20-21Sa\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800c40, 0xff800f50, "vqdmulh%c.s%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf3800d40, 0xff800f50, "vqrdmulh%c.s%20-21S6\t%12-15,22Q, %16-19,7Q, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800240, 0xfe800f50, "vmlal%c.%24?us%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800640, 0xfe800f50, "vmlsl%c.%24?us%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+  {FPU_NEON_EXT_V1, 0xf2800a40, 0xfe800f50, "vmull%c.%24?us%20-21S6\t%12-15,22Q, %16-19,7D, %D"},
+
+  /* Element and structure load/store */
+  {FPU_NEON_EXT_V1, 0xf4a00fc0, 0xffb00fc0, "vld4%c.32\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00c00, 0xffb00f00, "vld1%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00d00, 0xffb00f00, "vld2%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00e00, 0xffb00f00, "vld3%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4a00f00, 0xffb00f00, "vld4%c.%6-7S2\t%C"},
+  {FPU_NEON_EXT_V1, 0xf4000200, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000300, 0xff900f00, "v%21?ls%21?dt2%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000400, 0xff900f00, "v%21?ls%21?dt3%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000500, 0xff900f00, "v%21?ls%21?dt3%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000600, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000700, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000800, 0xff900f00, "v%21?ls%21?dt2%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000900, 0xff900f00, "v%21?ls%21?dt2%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000a00, 0xff900f00, "v%21?ls%21?dt1%c.%6-7S3\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4000000, 0xff900e00, "v%21?ls%21?dt4%c.%6-7S2\t%A"},
+  {FPU_NEON_EXT_V1, 0xf4800000, 0xff900300, "v%21?ls%21?dt1%c.%10-11S2\t%B"},
+  {FPU_NEON_EXT_V1, 0xf4800100, 0xff900300, "v%21?ls%21?dt2%c.%10-11S2\t%B"},
+  {FPU_NEON_EXT_V1, 0xf4800200, 0xff900300, "v%21?ls%21?dt3%c.%10-11S2\t%B"},
+  {FPU_NEON_EXT_V1, 0xf4800300, 0xff900300, "v%21?ls%21?dt4%c.%10-11S2\t%B"},
+
+  {0,0 ,0, 0}
+};
+
+/* Opcode tables: ARM, 16-bit Thumb, 32-bit Thumb.  All three are partially
+   ordered: they must be searched linearly from the top to obtain a correct
+   match.  */
+
+/* print_insn_arm recognizes the following format control codes:
+
+   %%			%
+
+   %a			print address for ldr/str instruction
+   %s                   print address for ldr/str halfword/signextend instruction
+   %b			print branch destination
    %c			print condition code (always bits 28-31)
-   %P			print floating point precision in arithmetic insn
-   %Q			print floating point precision in ldf/stf insn
-   %R			print floating point rounding mode
-   %<bitnum>'c		print specified char iff bit is one
-   %<bitnum>`c		print specified char iff bit is zero
-   %<bitnum>?ab		print a if bit is one else print b
+   %m			print register mask for ldm/stm instruction
+   %o			print operand2 (immediate or register + shift)
    %p			print 'p' iff bits 12-15 are 15
    %t			print 't' iff bit 21 set and bit 24 clear
-   %o			print operand2 (immediate or register + shift)
-   %a			print address for ldr/str instruction
-   %s                   print address for ldr/str halfword/signextend instruction
-   %b			print branch destination
    %B			print arm BLX(1) destination
-   %A			print address for ldc/stc/ldf/stf instruction
-   %m			print register mask for ldm/stm instruction
    %C			print the PSR sub type.
-   %F			print the COUNT field of a LFM/SFM instruction.
-Thumb specific format options:
-   %D                   print Thumb register (bits 0..2 as high number if bit 7 set)
-   %S                   print Thumb register (bits 3..5 as high number if bit 6 set)
-   %<bitfield>I         print bitfield as a signed decimal
-   				(top bit of range being the sign bit)
-   %M                   print Thumb register mask
-   %N                   print Thumb register mask (with LR)
-   %O                   print Thumb register mask (with PC)
-   %T                   print Thumb condition code (always bits 8-11)
-   %I                   print cirrus signed shift immediate: bits 0..3|4..6
-   %<bitfield>B         print Thumb branch destination (signed displacement)
-   %<bitfield>W         print (bitfield * 4) as a decimal
-   %<bitfield>H         print (bitfield * 2) as a decimal
-   %<bitfield>a         print (bitfield * 4) as a pc-rel offset + decoded symbol
-*/
+   %U			print barrier type.
+   %P			print address for pli instruction.
 
-/* Note: There is a partial ordering in this table - it must be searched from
-   the top to obtain a correct match. */
+   %<bitfield>r		print as an ARM register
+   %<bitfield>d		print the bitfield in decimal
+   %<bitfield>W         print the bitfield plus one in decimal
+   %<bitfield>x		print the bitfield in hex
+   %<bitfield>X		print the bitfield as 1 hex digit without leading "0x"
 
-static struct arm_opcode arm_opcodes[] =
+   %<bitfield>'c	print specified char iff bitfield is all ones
+   %<bitfield>`c	print specified char iff bitfield is all zeroes
+   %<bitfield>?ab...    select from array of values in big endian order
+
+   %e                   print arm SMI operand (bits 0..7,8..19).
+   %E			print the LSB and WIDTH fields of a BFI or BFC instruction.
+   %V                   print the 16-bit immediate field of a MOVT or MOVW instruction.  */
+
+static const struct opcode32 arm_opcodes[] =
 {
-    /* ARM instructions.  */
-    {0xe1a00000, 0xffffffff, "nop\t\t\t(mov r0,r0)"},
-    {0x012FFF10, 0x0ffffff0, "bx%c\t%0-3r"},
-    {0x00000090, 0x0fe000f0, "mul%c%20's\t%16-19r, %0-3r, %8-11r"},
-    {0x00200090, 0x0fe000f0, "mla%c%20's\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x01000090, 0x0fb00ff0, "swp%c%22'b\t%12-15r, %0-3r, [%16-19r]"},
-    {0x00800090, 0x0fa000f0, "%22?sumull%c%20's\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x00a00090, 0x0fa000f0, "%22?sumlal%c%20's\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  /* ARM instructions.  */
+  {ARM_EXT_V1, 0xe1a00000, 0xffffffff, "nop\t\t\t(mov r0,r0)"},
+  {ARM_EXT_V4T | ARM_EXT_V5, 0x012FFF10, 0x0ffffff0, "bx%c\t%0-3r"},
+  {ARM_EXT_V2, 0x00000090, 0x0fe000f0, "mul%20's%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V2, 0x00200090, 0x0fe000f0, "mla%20's%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V2S, 0x01000090, 0x0fb00ff0, "swp%22'b%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V3M, 0x00800090, 0x0fa000f0, "%22?sumull%20's%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V3M, 0x00a00090, 0x0fa000f0, "%22?sumlal%20's%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
 
-    /* V5J instruction.  */
-    {0x012fff20, 0x0ffffff0, "bxj%c\t%0-3r"},
+  /* V7 instructions.  */
+  {ARM_EXT_V7, 0xf450f000, 0xfd70f000, "pli\t%P"},
+  {ARM_EXT_V7, 0x0320f0f0, 0x0ffffff0, "dbg%c\t#%0-3d"},
+  {ARM_EXT_V7, 0xf57ff050, 0xfffffff0, "dmb\t%U"},
+  {ARM_EXT_V7, 0xf57ff040, 0xfffffff0, "dsb\t%U"},
+  {ARM_EXT_V7, 0xf57ff060, 0xfffffff0, "isb\t%U"},
 
-    /* XScale instructions.  */
-    {0x0e200010, 0x0fff0ff0, "mia%c\tacc0, %0-3r, %12-15r"},
-    {0x0e280010, 0x0fff0ff0, "miaph%c\tacc0, %0-3r, %12-15r"},
-    {0x0e2c0010, 0x0ffc0ff0, "mia%17'T%17`B%16'T%16`B%c\tacc0, %0-3r, %12-15r"},
-    {0x0c400000, 0x0ff00fff, "mar%c\tacc0, %12-15r, %16-19r"},
-    {0x0c500000, 0x0ff00fff, "mra%c\t%12-15r, %16-19r, acc0"},
-    {0xf450f000, 0xfc70f000, "pld\t%a"},
+  /* ARM V6T2 instructions.  */
+  {ARM_EXT_V6T2, 0x07c0001f, 0x0fe0007f, "bfc%c\t%12-15r, %E"},
+  {ARM_EXT_V6T2, 0x07c00010, 0x0fe00070, "bfi%c\t%12-15r, %0-3r, %E"},
+  {ARM_EXT_V6T2, 0x00600090, 0x0ff000f0, "mls%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6T2, 0x006000b0, 0x0f7000f0, "strht%c\t%12-15r, %s"},
+  {ARM_EXT_V6T2, 0x00300090, 0x0f300090, "ldr%6's%5?hbt%c\t%12-15r, %s"},
+  {ARM_EXT_V6T2, 0x03000000, 0x0ff00000, "movw%c\t%12-15r, %V"},
+  {ARM_EXT_V6T2, 0x03400000, 0x0ff00000, "movt%c\t%12-15r, %V"},
+  {ARM_EXT_V6T2, 0x06ff0f30, 0x0fff0ff0, "rbit%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6T2, 0x07a00050, 0x0fa00070, "%22?usbfx%c\t%12-15r, %0-3r, #%7-11d, #%16-20W"},
 
-    /* V5 Instructions.  */
-    {0xe1200070, 0xfff000f0, "bkpt\t0x%16-19X%12-15X%8-11X%0-3X"},
-    {0xfa000000, 0xfe000000, "blx\t%B"},
-    {0x012fff30, 0x0ffffff0, "blx%c\t%0-3r"},
-    {0x016f0f10, 0x0fff0ff0, "clz%c\t%12-15r, %0-3r"},
-    {0xfc100000, 0xfe100000, "ldc2%22'l\t%8-11d, cr%12-15d, %A"},
-    {0xfc000000, 0xfe100000, "stc2%22'l\t%8-11d, cr%12-15d, %A"},
-    {0xfe000000, 0xff000010, "cdp2\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0xfe000010, 0xff100010, "mcr2\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0xfe100010, 0xff100010, "mrc2\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
+  /* ARM V6Z instructions.  */
+  {ARM_EXT_V6Z, 0x01600070, 0x0ff000f0, "smc%c\t%e"},
 
-    /* V5E "El Segundo" Instructions.  */
-    {0x000000d0, 0x0e1000f0, "ldr%cd\t%12-15r, %s"},
-    {0x000000f0, 0x0e1000f0, "str%cd\t%12-15r, %s"},
-    {0x01000080, 0x0ff000f0, "smlabb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x010000a0, 0x0ff000f0, "smlatb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x010000c0, 0x0ff000f0, "smlabt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x010000e0, 0x0ff000f0, "smlatt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  /* ARM V6K instructions.  */
+  {ARM_EXT_V6K, 0xf57ff01f, 0xffffffff, "clrex"},
+  {ARM_EXT_V6K, 0x01d00f9f, 0x0ff00fff, "ldrexb%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01b00f9f, 0x0ff00fff, "ldrexd%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01f00f9f, 0x0ff00fff, "ldrexh%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01c00f90, 0x0ff00ff0, "strexb%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01a00f90, 0x0ff00ff0, "strexd%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V6K, 0x01e00f90, 0x0ff00ff0, "strexh%c\t%12-15r, %0-3r, [%16-19r]"},
 
-    {0x01200080, 0x0ff000f0, "smlawb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
-    {0x012000c0, 0x0ff000f0, "smlawt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  /* ARM V6K NOP hints.  */
+  {ARM_EXT_V6K, 0x0320f001, 0x0fffffff, "yield%c"},
+  {ARM_EXT_V6K, 0x0320f002, 0x0fffffff, "wfe%c"},
+  {ARM_EXT_V6K, 0x0320f003, 0x0fffffff, "wfi%c"},
+  {ARM_EXT_V6K, 0x0320f004, 0x0fffffff, "sev%c"},
+  {ARM_EXT_V6K, 0x0320f000, 0x0fffff00, "nop%c\t{%0-7d}"},
 
-    {0x01400080, 0x0ff000f0, "smlalbb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x014000a0, 0x0ff000f0, "smlaltb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x014000c0, 0x0ff000f0, "smlalbt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
-    {0x014000e0, 0x0ff000f0, "smlaltt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  /* ARM V6 instructions. */
+  {ARM_EXT_V6, 0xf1080000, 0xfffffe3f, "cpsie\t%8'a%7'i%6'f"},
+  {ARM_EXT_V6, 0xf10a0000, 0xfffffe20, "cpsie\t%8'a%7'i%6'f,#%0-4d"},
+  {ARM_EXT_V6, 0xf10C0000, 0xfffffe3f, "cpsid\t%8'a%7'i%6'f"},
+  {ARM_EXT_V6, 0xf10e0000, 0xfffffe20, "cpsid\t%8'a%7'i%6'f,#%0-4d"},
+  {ARM_EXT_V6, 0xf1000000, 0xfff1fe20, "cps\t#%0-4d"},
+  {ARM_EXT_V6, 0x06800010, 0x0ff00ff0, "pkhbt%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06800010, 0x0ff00070, "pkhbt%c\t%12-15r, %16-19r, %0-3r, lsl #%7-11d"},
+  {ARM_EXT_V6, 0x06800050, 0x0ff00ff0, "pkhtb%c\t%12-15r, %16-19r, %0-3r, asr #32"},
+  {ARM_EXT_V6, 0x06800050, 0x0ff00070, "pkhtb%c\t%12-15r, %16-19r, %0-3r, asr #%7-11d"},
+  {ARM_EXT_V6, 0x01900f9f, 0x0ff00fff, "ldrex%c\tr%12-15d, [%16-19r]"},
+  {ARM_EXT_V6, 0x06200f10, 0x0ff00ff0, "qadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f90, 0x0ff00ff0, "qadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f30, 0x0ff00ff0, "qaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f70, 0x0ff00ff0, "qsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200ff0, 0x0ff00ff0, "qsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06200f50, 0x0ff00ff0, "qsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f10, 0x0ff00ff0, "sadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f90, 0x0ff00ff0, "sadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f30, 0x0ff00ff0, "saddaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f10, 0x0ff00ff0, "shadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f90, 0x0ff00ff0, "shadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f30, 0x0ff00ff0, "shaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f70, 0x0ff00ff0, "shsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300ff0, 0x0ff00ff0, "shsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06300f50, 0x0ff00ff0, "shsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f70, 0x0ff00ff0, "ssub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100ff0, 0x0ff00ff0, "ssub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06100f50, 0x0ff00ff0, "ssubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f10, 0x0ff00ff0, "uadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f90, 0x0ff00ff0, "uadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f30, 0x0ff00ff0, "uaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f10, 0x0ff00ff0, "uhadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f90, 0x0ff00ff0, "uhadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f30, 0x0ff00ff0, "uhaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f70, 0x0ff00ff0, "uhsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700ff0, 0x0ff00ff0, "uhsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06700f50, 0x0ff00ff0, "uhsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f10, 0x0ff00ff0, "uqadd16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f90, 0x0ff00ff0, "uqadd8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f30, 0x0ff00ff0, "uqaddsubx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f70, 0x0ff00ff0, "uqsub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600ff0, 0x0ff00ff0, "uqsub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06600f50, 0x0ff00ff0, "uqsubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f70, 0x0ff00ff0, "usub16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500ff0, 0x0ff00ff0, "usub8%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06500f50, 0x0ff00ff0, "usubaddx%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06bf0f30, 0x0fff0ff0, "rev%c\t\%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06bf0fb0, 0x0fff0ff0, "rev16%c\t\%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06ff0fb0, 0x0fff0ff0, "revsh%c\t\%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0xf8100a00, 0xfe50ffff, "rfe%23?id%24?ba\t\%16-19r%21'!"},
+  {ARM_EXT_V6, 0x06bf0070, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06bf0470, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06bf0870, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06bf0c70, 0x0fff0ff0, "sxth%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x068f0070, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x068f0470, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x068f0870, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x068f0c70, 0x0fff0ff0, "sxtb16%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06af0070, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06af0470, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06af0870, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06af0c70, 0x0fff0ff0, "sxtb%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06ff0070, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06ff0470, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06ff0870, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06ff0c70, 0x0fff0ff0, "uxth%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06cf0070, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06cf0470, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06cf0870, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06cf0c70, 0x0fff0ff0, "uxtb16%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06ef0070, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V6, 0x06ef0470, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06ef0870, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06ef0c70, 0x0fff0ff0, "uxtb%c\t%12-15r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06b00070, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06b00470, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06b00870, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06b00c70, 0x0ff00ff0, "sxtah%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06800070, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06800470, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06800870, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06800c70, 0x0ff00ff0, "sxtab16%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06a00070, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06a00470, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06a00870, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06a00c70, 0x0ff00ff0, "sxtab%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06f00070, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06f00470, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06f00870, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06f00c70, 0x0ff00ff0, "uxtah%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06c00070, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06c00470, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06c00870, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06c00c70, 0x0ff00ff0, "uxtab16%c\t%12-15r, %16-19r, %0-3r, ROR #24"},
+  {ARM_EXT_V6, 0x06e00070, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0x06e00470, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r, ror #8"},
+  {ARM_EXT_V6, 0x06e00870, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r, ror #16"},
+  {ARM_EXT_V6, 0x06e00c70, 0x0ff00ff0, "uxtab%c\t%12-15r, %16-19r, %0-3r, ror #24"},
+  {ARM_EXT_V6, 0x06800fb0, 0x0ff00ff0, "sel%c\t%12-15r, %16-19r, %0-3r"},
+  {ARM_EXT_V6, 0xf1010000, 0xfffffc00, "setend\t%9?ble"},
+  {ARM_EXT_V6, 0x0700f010, 0x0ff0f0d0, "smuad%5'x%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x0700f050, 0x0ff0f0d0, "smusd%5'x%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07000010, 0x0ff000d0, "smlad%5'x%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x07400010, 0x0ff000d0, "smlald%5'x%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07000050, 0x0ff000d0, "smlsd%5'x%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x07400050, 0x0ff000d0, "smlsld%5'x%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x0750f010, 0x0ff0f0d0, "smmul%5'r%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07500010, 0x0ff000d0, "smmla%5'r%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x075000d0, 0x0ff000d0, "smmls%5'r%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0xf84d0500, 0xfe5fffe0, "srs%23?id%24?ba\t%16-19r%21'!, #%0-4d"},
+  {ARM_EXT_V6, 0x06a00010, 0x0fe00ff0, "ssat%c\t%12-15r, #%16-20W, %0-3r"},
+  {ARM_EXT_V6, 0x06a00010, 0x0fe00070, "ssat%c\t%12-15r, #%16-20W, %0-3r, lsl #%7-11d"},
+  {ARM_EXT_V6, 0x06a00050, 0x0fe00070, "ssat%c\t%12-15r, #%16-20W, %0-3r, asr #%7-11d"},
+  {ARM_EXT_V6, 0x06a00f30, 0x0ff00ff0, "ssat16%c\t%12-15r, #%16-19W, %0-3r"},
+  {ARM_EXT_V6, 0x01800f90, 0x0ff00ff0, "strex%c\t%12-15r, %0-3r, [%16-19r]"},
+  {ARM_EXT_V6, 0x00400090, 0x0ff000f0, "umaal%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x0780f010, 0x0ff0f0f0, "usad8%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V6, 0x07800010, 0x0ff000f0, "usada8%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V6, 0x06e00010, 0x0fe00ff0, "usat%c\t%12-15r, #%16-20d, %0-3r"},
+  {ARM_EXT_V6, 0x06e00010, 0x0fe00070, "usat%c\t%12-15r, #%16-20d, %0-3r, lsl #%7-11d"},
+  {ARM_EXT_V6, 0x06e00050, 0x0fe00070, "usat%c\t%12-15r, #%16-20d, %0-3r, asr #%7-11d"},
+  {ARM_EXT_V6, 0x06e00f30, 0x0ff00ff0, "usat16%c\t%12-15r, #%16-19d, %0-3r"},
 
-    {0x01600080, 0x0ff0f0f0, "smulbb%c\t%16-19r, %0-3r, %8-11r"},
-    {0x016000a0, 0x0ff0f0f0, "smultb%c\t%16-19r, %0-3r, %8-11r"},
-    {0x016000c0, 0x0ff0f0f0, "smulbt%c\t%16-19r, %0-3r, %8-11r"},
-    {0x016000e0, 0x0ff0f0f0, "smultt%c\t%16-19r, %0-3r, %8-11r"},
+  /* V5J instruction.  */
+  {ARM_EXT_V5J, 0x012fff20, 0x0ffffff0, "bxj%c\t%0-3r"},
 
-    {0x012000a0, 0x0ff0f0f0, "smulwb%c\t%16-19r, %0-3r, %8-11r"},
-    {0x012000e0, 0x0ff0f0f0, "smulwt%c\t%16-19r, %0-3r, %8-11r"},
+  /* V5 Instructions.  */
+  {ARM_EXT_V5, 0xe1200070, 0xfff000f0, "bkpt\t0x%16-19X%12-15X%8-11X%0-3X"},
+  {ARM_EXT_V5, 0xfa000000, 0xfe000000, "blx\t%B"},
+  {ARM_EXT_V5, 0x012fff30, 0x0ffffff0, "blx%c\t%0-3r"},
+  {ARM_EXT_V5, 0x016f0f10, 0x0fff0ff0, "clz%c\t%12-15r, %0-3r"},
 
-    {0x01000050, 0x0ff00ff0,  "qadd%c\t%12-15r, %0-3r, %16-19r"},
-    {0x01400050, 0x0ff00ff0, "qdadd%c\t%12-15r, %0-3r, %16-19r"},
-    {0x01200050, 0x0ff00ff0,  "qsub%c\t%12-15r, %0-3r, %16-19r"},
-    {0x01600050, 0x0ff00ff0, "qdsub%c\t%12-15r, %0-3r, %16-19r"},
+  /* V5E "El Segundo" Instructions.  */
+  {ARM_EXT_V5E, 0x000000d0, 0x0e1000f0, "ldrd%c\t%12-15r, %s"},
+  {ARM_EXT_V5E, 0x000000f0, 0x0e1000f0, "strd%c\t%12-15r, %s"},
+  {ARM_EXT_V5E, 0xf450f000, 0xfc70f000, "pld\t%a"},
+  {ARM_EXT_V5ExP, 0x01000080, 0x0ff000f0, "smlabb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x010000a0, 0x0ff000f0, "smlatb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x010000c0, 0x0ff000f0, "smlabt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x010000e0, 0x0ff000f0, "smlatt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
 
-    {0x0c400000, 0x0ff00000, "mcrr%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
-    {0x0c500000, 0x0ff00000, "mrrc%c\t%8-11d, %4-7d, %12-15r, %16-19r, cr%0-3d"},
+  {ARM_EXT_V5ExP, 0x01200080, 0x0ff000f0, "smlawb%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
+  {ARM_EXT_V5ExP, 0x012000c0, 0x0ff000f0, "smlawt%c\t%16-19r, %0-3r, %8-11r, %12-15r"},
 
-    /* ARM Instructions.  */
-    {0x00000090, 0x0e100090, "str%c%6's%5?hb\t%12-15r, %s"},
-    {0x00100090, 0x0e100090, "ldr%c%6's%5?hb\t%12-15r, %s"},
-    {0x00000000, 0x0de00000, "and%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00200000, 0x0de00000, "eor%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00400000, 0x0de00000, "sub%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00600000, 0x0de00000, "rsb%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00800000, 0x0de00000, "add%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00a00000, 0x0de00000, "adc%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00c00000, 0x0de00000, "sbc%c%20's\t%12-15r, %16-19r, %o"},
-    {0x00e00000, 0x0de00000, "rsc%c%20's\t%12-15r, %16-19r, %o"},
-    {0x0120f000, 0x0db0f000, "msr%c\t%22?SCPSR%C, %o"},
-    {0x010f0000, 0x0fbf0fff, "mrs%c\t%12-15r, %22?SCPSR"},
-    {0x01000000, 0x0de00000, "tst%c%p\t%16-19r, %o"},
-    {0x01200000, 0x0de00000, "teq%c%p\t%16-19r, %o"},
-    {0x01400000, 0x0de00000, "cmp%c%p\t%16-19r, %o"},
-    {0x01600000, 0x0de00000, "cmn%c%p\t%16-19r, %o"},
-    {0x01800000, 0x0de00000, "orr%c%20's\t%12-15r, %16-19r, %o"},
-    {0x01a00000, 0x0de00000, "mov%c%20's\t%12-15r, %o"},
-    {0x01c00000, 0x0de00000, "bic%c%20's\t%12-15r, %16-19r, %o"},
-    {0x01e00000, 0x0de00000, "mvn%c%20's\t%12-15r, %o"},
-    {0x04000000, 0x0e100000, "str%c%22'b%t\t%12-15r, %a"},
-    {0x06000000, 0x0e100ff0, "str%c%22'b%t\t%12-15r, %a"},
-    {0x04000000, 0x0c100010, "str%c%22'b%t\t%12-15r, %a"},
-    {0x06000010, 0x0e000010, "undefined"},
-    {0x04100000, 0x0c100000, "ldr%c%22'b%t\t%12-15r, %a"},
-    {0x08000000, 0x0e100000, "stm%c%23?id%24?ba\t%16-19r%21'!, %m%22'^"},
-    {0x08100000, 0x0e100000, "ldm%c%23?id%24?ba\t%16-19r%21'!, %m%22'^"},
-    {0x0a000000, 0x0e000000, "b%24'l%c\t%b"},
-    {0x0f000000, 0x0f000000, "swi%c\t%0-23x"},
+  {ARM_EXT_V5ExP, 0x01400080, 0x0ff000f0, "smlalbb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x014000a0, 0x0ff000f0, "smlaltb%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x014000c0, 0x0ff000f0, "smlalbt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x014000e0, 0x0ff000f0, "smlaltt%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
 
-    /* Floating point coprocessor (FPA) instructions */
-    {0x0e000100, 0x0ff08f10, "adf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e100100, 0x0ff08f10, "muf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e200100, 0x0ff08f10, "suf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e300100, 0x0ff08f10, "rsf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e400100, 0x0ff08f10, "dvf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e500100, 0x0ff08f10, "rdf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e600100, 0x0ff08f10, "pow%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e700100, 0x0ff08f10, "rpw%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e800100, 0x0ff08f10, "rmf%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e900100, 0x0ff08f10, "fml%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0ea00100, 0x0ff08f10, "fdv%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0eb00100, 0x0ff08f10, "frd%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0ec00100, 0x0ff08f10, "pol%c%P%R\t%12-14f, %16-18f, %0-3f"},
-    {0x0e008100, 0x0ff08f10, "mvf%c%P%R\t%12-14f, %0-3f"},
-    {0x0e108100, 0x0ff08f10, "mnf%c%P%R\t%12-14f, %0-3f"},
-    {0x0e208100, 0x0ff08f10, "abs%c%P%R\t%12-14f, %0-3f"},
-    {0x0e308100, 0x0ff08f10, "rnd%c%P%R\t%12-14f, %0-3f"},
-    {0x0e408100, 0x0ff08f10, "sqt%c%P%R\t%12-14f, %0-3f"},
-    {0x0e508100, 0x0ff08f10, "log%c%P%R\t%12-14f, %0-3f"},
-    {0x0e608100, 0x0ff08f10, "lgn%c%P%R\t%12-14f, %0-3f"},
-    {0x0e708100, 0x0ff08f10, "exp%c%P%R\t%12-14f, %0-3f"},
-    {0x0e808100, 0x0ff08f10, "sin%c%P%R\t%12-14f, %0-3f"},
-    {0x0e908100, 0x0ff08f10, "cos%c%P%R\t%12-14f, %0-3f"},
-    {0x0ea08100, 0x0ff08f10, "tan%c%P%R\t%12-14f, %0-3f"},
-    {0x0eb08100, 0x0ff08f10, "asn%c%P%R\t%12-14f, %0-3f"},
-    {0x0ec08100, 0x0ff08f10, "acs%c%P%R\t%12-14f, %0-3f"},
-    {0x0ed08100, 0x0ff08f10, "atn%c%P%R\t%12-14f, %0-3f"},
-    {0x0ee08100, 0x0ff08f10, "urd%c%P%R\t%12-14f, %0-3f"},
-    {0x0ef08100, 0x0ff08f10, "nrm%c%P%R\t%12-14f, %0-3f"},
-    {0x0e000110, 0x0ff00f1f, "flt%c%P%R\t%16-18f, %12-15r"},
-    {0x0e100110, 0x0fff0f98, "fix%c%R\t%12-15r, %0-2f"},
-    {0x0e200110, 0x0fff0fff, "wfs%c\t%12-15r"},
-    {0x0e300110, 0x0fff0fff, "rfs%c\t%12-15r"},
-    {0x0e400110, 0x0fff0fff, "wfc%c\t%12-15r"},
-    {0x0e500110, 0x0fff0fff, "rfc%c\t%12-15r"},
-    {0x0e90f110, 0x0ff8fff0, "cmf%c\t%16-18f, %0-3f"},
-    {0x0eb0f110, 0x0ff8fff0, "cnf%c\t%16-18f, %0-3f"},
-    {0x0ed0f110, 0x0ff8fff0, "cmfe%c\t%16-18f, %0-3f"},
-    {0x0ef0f110, 0x0ff8fff0, "cnfe%c\t%16-18f, %0-3f"},
-    {0x0c000100, 0x0e100f00, "stf%c%Q\t%12-14f, %A"},
-    {0x0c100100, 0x0e100f00, "ldf%c%Q\t%12-14f, %A"},
-    {0x0c000200, 0x0e100f00, "sfm%c\t%12-14f, %F, %A"},
-    {0x0c100200, 0x0e100f00, "lfm%c\t%12-14f, %F, %A"},
+  {ARM_EXT_V5ExP, 0x01600080, 0x0ff0f0f0, "smulbb%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x016000a0, 0x0ff0f0f0, "smultb%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x016000c0, 0x0ff0f0f0, "smulbt%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x016000e0, 0x0ff0f0f0, "smultt%c\t%16-19r, %0-3r, %8-11r"},
 
-    /* Floating point coprocessor (VFP) instructions */
-    {0x0eb00bc0, 0x0fff0ff0, "fabsd%c\t%1z, %0z"},
-    {0x0eb00ac0, 0x0fbf0fd0, "fabss%c\t%1y, %0y"},
-    {0x0e300b00, 0x0ff00ff0, "faddd%c\t%1z, %2z, %0z"},
-    {0x0e300a00, 0x0fb00f50, "fadds%c\t%1y, %2y, %1y"},
-    {0x0eb40b40, 0x0fff0f70, "fcmp%7'ed%c\t%1z, %0z"},
-    {0x0eb40a40, 0x0fbf0f50, "fcmp%7'es%c\t%1y, %0y"},
-    {0x0eb50b40, 0x0fff0f70, "fcmp%7'ezd%c\t%1z"},
-    {0x0eb50a40, 0x0fbf0f70, "fcmp%7'ezs%c\t%1y"},
-    {0x0eb00b40, 0x0fff0ff0, "fcpyd%c\t%1z, %0z"},
-    {0x0eb00a40, 0x0fbf0fd0, "fcpys%c\t%1y, %0y"},
-    {0x0eb70ac0, 0x0fff0fd0, "fcvtds%c\t%1z, %0y"},
-    {0x0eb70bc0, 0x0fbf0ff0, "fcvtsd%c\t%1y, %0z"},
-    {0x0e800b00, 0x0ff00ff0, "fdivd%c\t%1z, %2z, %0z"},
-    {0x0e800a00, 0x0fb00f50, "fdivs%c\t%1y, %2y, %0y"},
-    {0x0d100b00, 0x0f700f00, "fldd%c\t%1z, %A"},
-    {0x0c900b00, 0x0fd00f00, "fldmia%0?xd%c\t%16-19r%21'!, %3z"},
-    {0x0d300b00, 0x0ff00f00, "fldmdb%0?xd%c\t%16-19r!, %3z"},
-    {0x0d100a00, 0x0f300f00, "flds%c\t%1y, %A"},
-    {0x0c900a00, 0x0f900f00, "fldmias%c\t%16-19r%21'!, %3y"},
-    {0x0d300a00, 0x0fb00f00, "fldmdbs%c\t%16-19r!, %3y"},
-    {0x0e000b00, 0x0ff00ff0, "fmacd%c\t%1z, %2z, %0z"},
-    {0x0e000a00, 0x0fb00f50, "fmacs%c\t%1y, %2y, %0y"},
-    {0x0e200b10, 0x0ff00fff, "fmdhr%c\t%2z, %12-15r"},
-    {0x0e000b10, 0x0ff00fff, "fmdlr%c\t%2z, %12-15r"},
-    {0x0c400b10, 0x0ff00ff0, "fmdrr%c\t%0z, %12-15r, %16-19r"},
-    {0x0e300b10, 0x0ff00fff, "fmrdh%c\t%12-15r, %2z"},
-    {0x0e100b10, 0x0ff00fff, "fmrdl%c\t%12-15r, %2z"},
-    {0x0c500b10, 0x0ff00ff0, "fmrrd%c\t%12-15r, %16-19r, %0z"},
-    {0x0c500a10, 0x0ff00fd0, "fmrrs%c\t%12-15r, %16-19r, %4y"},
-    {0x0e100a10, 0x0ff00f7f, "fmrs%c\t%12-15r, %2y"},
-    {0x0ef1fa10, 0x0fffffff, "fmstat%c"},
-    {0x0ef00a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpsid"},
-    {0x0ef10a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpscr"},
-    {0x0ef80a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpexc"},
-    {0x0ef90a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst\t@ Impl def"},
-    {0x0efa0a10, 0x0fff0fff, "fmrx%c\t%12-15r, fpinst2\t@ Impl def"},
-    {0x0ef00a10, 0x0ff00fff, "fmrx%c\t%12-15r, <impl def 0x%16-19x>"},
-    {0x0e100b00, 0x0ff00ff0, "fmscd%c\t%1z, %2z, %0z"},
-    {0x0e100a00, 0x0fb00f50, "fmscs%c\t%1y, %2y, %0y"},
-    {0x0e000a10, 0x0ff00f7f, "fmsr%c\t%2y, %12-15r"},
-    {0x0c400a10, 0x0ff00fd0, "fmsrr%c\t%12-15r, %16-19r, %4y"},
-    {0x0e200b00, 0x0ff00ff0, "fmuld%c\t%1z, %2z, %0z"},
-    {0x0e200a00, 0x0fb00f50, "fmuls%c\t%1y, %2y, %0y"},
-    {0x0ee00a10, 0x0fff0fff, "fmxr%c\tfpsid, %12-15r"},
-    {0x0ee10a10, 0x0fff0fff, "fmxr%c\tfpscr, %12-15r"},
-    {0x0ee80a10, 0x0fff0fff, "fmxr%c\tfpexc, %12-15r"},
-    {0x0ee90a10, 0x0fff0fff, "fmxr%c\tfpinst, %12-15r\t@ Impl def"},
-    {0x0eea0a10, 0x0fff0fff, "fmxr%c\tfpinst2, %12-15r\t@ Impl def"},
-    {0x0ee00a10, 0x0ff00fff, "fmxr%c\t<impl def 0x%16-19x>, %12-15r"},
-    {0x0eb10b40, 0x0fff0ff0, "fnegd%c\t%1z, %0z"},
-    {0x0eb10a40, 0x0fbf0fd0, "fnegs%c\t%1y, %0y"},
-    {0x0e000b40, 0x0ff00ff0, "fnmacd%c\t%1z, %2z, %0z"},
-    {0x0e000a40, 0x0fb00f50, "fnmacs%c\t%1y, %2y, %0y"},
-    {0x0e100b40, 0x0ff00ff0, "fnmscd%c\t%1z, %2z, %0z"},
-    {0x0e100a40, 0x0fb00f50, "fnmscs%c\t%1y, %2y, %0y"},
-    {0x0e200b40, 0x0ff00ff0, "fnmuld%c\t%1z, %2z, %0z"},
-    {0x0e200a40, 0x0fb00f50, "fnmuls%c\t%1y, %2y, %0y"},
-    {0x0eb80bc0, 0x0fff0fd0, "fsitod%c\t%1z, %0y"},
-    {0x0eb80ac0, 0x0fbf0fd0, "fsitos%c\t%1y, %0y"},
-    {0x0eb10bc0, 0x0fff0ff0, "fsqrtd%c\t%1z, %0z"},
-    {0x0eb10ac0, 0x0fbf0fd0, "fsqrts%c\t%1y, %0y"},
-    {0x0d000b00, 0x0f700f00, "fstd%c\t%1z, %A"},
-    {0x0c800b00, 0x0fd00f00, "fstmia%0?xd%c\t%16-19r%21'!, %3z"},
-    {0x0d200b00, 0x0ff00f00, "fstmdb%0?xd%c\t%16-19r!, %3z"},
-    {0x0d000a00, 0x0f300f00, "fsts%c\t%1y, %A"},
-    {0x0c800a00, 0x0f900f00, "fstmias%c\t%16-19r%21'!, %3y"},
-    {0x0d200a00, 0x0fb00f00, "fstmdbs%c\t%16-19r!, %3y"},
-    {0x0e300b40, 0x0ff00ff0, "fsubd%c\t%1z, %2z, %0z"},
-    {0x0e300a40, 0x0fb00f50, "fsubs%c\t%1y, %2y, %0y"},
-    {0x0ebc0b40, 0x0fbe0f70, "fto%16?sui%7'zd%c\t%1y, %0z"},
-    {0x0ebc0a40, 0x0fbe0f50, "fto%16?sui%7'zs%c\t%1y, %0y"},
-    {0x0eb80b40, 0x0fff0fd0, "fuitod%c\t%1z, %0y"},
-    {0x0eb80a40, 0x0fbf0fd0, "fuitos%c\t%1y, %0y"},
+  {ARM_EXT_V5ExP, 0x012000a0, 0x0ff0f0f0, "smulwb%c\t%16-19r, %0-3r, %8-11r"},
+  {ARM_EXT_V5ExP, 0x012000e0, 0x0ff0f0f0, "smulwt%c\t%16-19r, %0-3r, %8-11r"},
 
-    /* Cirrus coprocessor instructions.  */
-    {0x0d100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
-    {0x0c100400, 0x0f500f00, "cfldrs%c\tmvf%12-15d, %A"},
-    {0x0d500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
-    {0x0c500400, 0x0f500f00, "cfldrd%c\tmvd%12-15d, %A"},
-    {0x0d100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
-    {0x0c100500, 0x0f500f00, "cfldr32%c\tmvfx%12-15d, %A"},
-    {0x0d500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
-    {0x0c500500, 0x0f500f00, "cfldr64%c\tmvdx%12-15d, %A"},
-    {0x0d000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
-    {0x0c000400, 0x0f500f00, "cfstrs%c\tmvf%12-15d, %A"},
-    {0x0d400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
-    {0x0c400400, 0x0f500f00, "cfstrd%c\tmvd%12-15d, %A"},
-    {0x0d000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
-    {0x0c000500, 0x0f500f00, "cfstr32%c\tmvfx%12-15d, %A"},
-    {0x0d400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
-    {0x0c400500, 0x0f500f00, "cfstr64%c\tmvdx%12-15d, %A"},
-    {0x0e000450, 0x0ff00ff0, "cfmvsr%c\tmvf%16-19d, %12-15r"},
-    {0x0e100450, 0x0ff00ff0, "cfmvrs%c\t%12-15r, mvf%16-19d"},
-    {0x0e000410, 0x0ff00ff0, "cfmvdlr%c\tmvd%16-19d, %12-15r"},
-    {0x0e100410, 0x0ff00ff0, "cfmvrdl%c\t%12-15r, mvd%16-19d"},
-    {0x0e000430, 0x0ff00ff0, "cfmvdhr%c\tmvd%16-19d, %12-15r"},
-    {0x0e100430, 0x0ff00fff, "cfmvrdh%c\t%12-15r, mvd%16-19d"},
-    {0x0e000510, 0x0ff00fff, "cfmv64lr%c\tmvdx%16-19d, %12-15r"},
-    {0x0e100510, 0x0ff00fff, "cfmvr64l%c\t%12-15r, mvdx%16-19d"},
-    {0x0e000530, 0x0ff00fff, "cfmv64hr%c\tmvdx%16-19d, %12-15r"},
-    {0x0e100530, 0x0ff00fff, "cfmvr64h%c\t%12-15r, mvdx%16-19d"},
-    {0x0e100610, 0x0ff0fff0, "cfmval32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000610, 0x0ff0fff0, "cfmv32al%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e100630, 0x0ff0fff0, "cfmvam32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000630, 0x0ff0fff0, "cfmv32am%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e100650, 0x0ff0fff0, "cfmvah32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000650, 0x0ff0fff0, "cfmv32ah%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e000670, 0x0ff0fff0, "cfmv32a%c\tmvfx%0-3d, mvax%16-19d"},
-    {0x0e100670, 0x0ff0fff0, "cfmva32%c\tmvax%0-3d, mvfx%16-19d"},
-    {0x0e000690, 0x0ff0fff0, "cfmv64a%c\tmvdx%0-3d, mvax%16-19d"},
-    {0x0e100690, 0x0ff0fff0, "cfmva64%c\tmvax%0-3d, mvdx%16-19d"},
-    {0x0e1006b0, 0x0ff0fff0, "cfmvsc32%c\tdspsc, mvfx%16-19d"},
-    {0x0e0006b0, 0x0ff0fff0, "cfmv32sc%c\tmvfx%0-3d, dspsc"},
-    {0x0e000400, 0x0ff00fff, "cfcpys%c\tmvf%12-15d, mvf%16-19d"},
-    {0x0e000420, 0x0ff00fff, "cfcpyd%c\tmvd%12-15d, mvd%16-19d"},
-    {0x0e000460, 0x0ff00fff, "cfcvtsd%c\tmvd%12-15d, mvf%16-19d"},
-    {0x0e000440, 0x0ff00fff, "cfcvtds%c\tmvf%12-15d, mvd%16-19d"},
-    {0x0e000480, 0x0ff00fff, "cfcvt32s%c\tmvf%12-15d, mvfx%16-19d"},
-    {0x0e0004a0, 0x0ff00fff, "cfcvt32d%c\tmvd%12-15d, mvfx%16-19d"},
-    {0x0e0004c0, 0x0ff00fff, "cfcvt64s%c\tmvf%12-15d, mvdx%16-19d"},
-    {0x0e0004e0, 0x0ff00fff, "cfcvt64d%c\tmvd%12-15d, mvdx%16-19d"},
-    {0x0e100580, 0x0ff00fff, "cfcvts32%c\tmvfx%12-15d, mvf%16-19d"},
-    {0x0e1005a0, 0x0ff00fff, "cfcvtd32%c\tmvfx%12-15d, mvd%16-19d"},
-    {0x0e1005c0, 0x0ff00fff, "cftruncs32%c\tmvfx%12-15d, mvf%16-19d"},
-    {0x0e1005e0, 0x0ff00fff, "cftruncd32%c\tmvfx%12-15d, mvd%16-19d"},
-    {0x0e000550, 0x0ff00ff0, "cfrshl32%c\tmvfx%16-19d, mvfx%0-3d, %12-15r"},
-    {0x0e000570, 0x0ff00ff0, "cfrshl64%c\tmvdx%16-19d, mvdx%0-3d, %12-15r"},
-    {0x0e000500, 0x0ff00f00, "cfsh32%c\tmvfx%12-15d, mvfx%16-19d, #%I"},
-    {0x0e200500, 0x0ff00f00, "cfsh64%c\tmvdx%12-15d, mvdx%16-19d, #%I"},
-    {0x0e100490, 0x0ff00ff0, "cfcmps%c\t%12-15r, mvf%16-19d, mvf%0-3d"},
-    {0x0e1004b0, 0x0ff00ff0, "cfcmpd%c\t%12-15r, mvd%16-19d, mvd%0-3d"},
-    {0x0e100590, 0x0ff00ff0, "cfcmp32%c\t%12-15r, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e1005b0, 0x0ff00ff0, "cfcmp64%c\t%12-15r, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e300400, 0x0ff00fff, "cfabss%c\tmvf%12-15d, mvf%16-19d"},
-    {0x0e300420, 0x0ff00fff, "cfabsd%c\tmvd%12-15d, mvd%16-19d"},
-    {0x0e300440, 0x0ff00fff, "cfnegs%c\tmvf%12-15d, mvf%16-19d"},
-    {0x0e300460, 0x0ff00fff, "cfnegd%c\tmvd%12-15d, mvd%16-19d"},
-    {0x0e300480, 0x0ff00ff0, "cfadds%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
-    {0x0e3004a0, 0x0ff00ff0, "cfaddd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
-    {0x0e3004c0, 0x0ff00ff0, "cfsubs%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
-    {0x0e3004e0, 0x0ff00ff0, "cfsubd%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
-    {0x0e100400, 0x0ff00ff0, "cfmuls%c\tmvf%12-15d, mvf%16-19d, mvf%0-3d"},
-    {0x0e100420, 0x0ff00ff0, "cfmuld%c\tmvd%12-15d, mvd%16-19d, mvd%0-3d"},
-    {0x0e300500, 0x0ff00fff, "cfabs32%c\tmvfx%12-15d, mvfx%16-19d"},
-    {0x0e300520, 0x0ff00fff, "cfabs64%c\tmvdx%12-15d, mvdx%16-19d"},
-    {0x0e300540, 0x0ff00fff, "cfneg32%c\tmvfx%12-15d, mvfx%16-19d"},
-    {0x0e300560, 0x0ff00fff, "cfneg64%c\tmvdx%12-15d, mvdx%16-19d"},
-    {0x0e300580, 0x0ff00ff0, "cfadd32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e3005a0, 0x0ff00ff0, "cfadd64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e3005c0, 0x0ff00ff0, "cfsub32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e3005e0, 0x0ff00ff0, "cfsub64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e100500, 0x0ff00ff0, "cfmul32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e100520, 0x0ff00ff0, "cfmul64%c\tmvdx%12-15d, mvdx%16-19d, mvdx%0-3d"},
-    {0x0e100540, 0x0ff00ff0, "cfmac32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e100560, 0x0ff00ff0, "cfmsc32%c\tmvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e000600, 0x0ff00f00, "cfmadd32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e100600, 0x0ff00f00, "cfmsub32%c\tmvax%5-7d, mvfx%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e200600, 0x0ff00f00, "cfmadda32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
-    {0x0e300600, 0x0ff00f00, "cfmsuba32%c\tmvax%5-7d, mvax%12-15d, mvfx%16-19d, mvfx%0-3d"},
+  {ARM_EXT_V5ExP, 0x01000050, 0x0ff00ff0,  "qadd%c\t%12-15r, %0-3r, %16-19r"},
+  {ARM_EXT_V5ExP, 0x01400050, 0x0ff00ff0, "qdadd%c\t%12-15r, %0-3r, %16-19r"},
+  {ARM_EXT_V5ExP, 0x01200050, 0x0ff00ff0,  "qsub%c\t%12-15r, %0-3r, %16-19r"},
+  {ARM_EXT_V5ExP, 0x01600050, 0x0ff00ff0, "qdsub%c\t%12-15r, %0-3r, %16-19r"},
 
-    /* Generic coprocessor instructions */
-    {0x0e000000, 0x0f000010, "cdp%c\t%8-11d, %20-23d, cr%12-15d, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0x0e100010, 0x0f100010, "mrc%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0x0e000010, 0x0f100010, "mcr%c\t%8-11d, %21-23d, %12-15r, cr%16-19d, cr%0-3d, {%5-7d}"},
-    {0x0c000000, 0x0e100000, "stc%c%22'l\t%8-11d, cr%12-15d, %A"},
-    {0x0c100000, 0x0e100000, "ldc%c%22'l\t%8-11d, cr%12-15d, %A"},
+  /* ARM Instructions.  */
+  {ARM_EXT_V1, 0x00000090, 0x0e100090, "str%6's%5?hb%c\t%12-15r, %s"},
+  {ARM_EXT_V1, 0x00100090, 0x0e100090, "ldr%6's%5?hb%c\t%12-15r, %s"},
+  {ARM_EXT_V1, 0x00000000, 0x0de00000, "and%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00200000, 0x0de00000, "eor%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00400000, 0x0de00000, "sub%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00600000, 0x0de00000, "rsb%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00800000, 0x0de00000, "add%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00a00000, 0x0de00000, "adc%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00c00000, 0x0de00000, "sbc%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x00e00000, 0x0de00000, "rsc%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V3, 0x0120f000, 0x0db0f000, "msr%c\t%22?SCPSR%C, %o"},
+  {ARM_EXT_V3, 0x010f0000, 0x0fbf0fff, "mrs%c\t%12-15r, %22?SCPSR"},
+  {ARM_EXT_V1, 0x01000000, 0x0de00000, "tst%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01200000, 0x0de00000, "teq%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01400000, 0x0de00000, "cmp%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01600000, 0x0de00000, "cmn%p%c\t%16-19r, %o"},
+  {ARM_EXT_V1, 0x01800000, 0x0de00000, "orr%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x03a00000, 0x0fef0000, "mov%20's%c\t%12-15r, %o"},
+  {ARM_EXT_V1, 0x01a00000, 0x0def0ff0, "mov%20's%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V1, 0x01a00000, 0x0def0060, "lsl%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01a00020, 0x0def0060, "lsr%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01a00040, 0x0def0060, "asr%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01a00060, 0x0def0ff0, "rrx%20's%c\t%12-15r, %0-3r"},
+  {ARM_EXT_V1, 0x01a00060, 0x0def0060, "ror%20's%c\t%12-15r, %q"},
+  {ARM_EXT_V1, 0x01c00000, 0x0de00000, "bic%20's%c\t%12-15r, %16-19r, %o"},
+  {ARM_EXT_V1, 0x01e00000, 0x0de00000, "mvn%20's%c\t%12-15r, %o"},
+  {ARM_EXT_V1, 0x052d0004, 0x0fff0fff, "push%c\t{%12-15r}\t\t; (str%c %12-15r, %a)"},
+  {ARM_EXT_V1, 0x04000000, 0x0e100000, "str%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x06000000, 0x0e100ff0, "str%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x04000000, 0x0c100010, "str%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x06000010, 0x0e000010, "undefined"},
+  {ARM_EXT_V1, 0x049d0004, 0x0fff0fff, "pop%c\t{%12-15r}\t\t; (ldr%c %12-15r, %a)"},
+  {ARM_EXT_V1, 0x04100000, 0x0c100000, "ldr%22'b%t%c\t%12-15r, %a"},
+  {ARM_EXT_V1, 0x092d0000, 0x0fff0000, "push%c\t%m"},
+  {ARM_EXT_V1, 0x08800000, 0x0ff00000, "stm%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x08000000, 0x0e100000, "stm%23?id%24?ba%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x08bd0000, 0x0fff0000, "pop%c\t%m"},
+  {ARM_EXT_V1, 0x08900000, 0x0f900000, "ldm%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x08100000, 0x0e100000, "ldm%23?id%24?ba%c\t%16-19r%21'!, %m%22'^"},
+  {ARM_EXT_V1, 0x0a000000, 0x0e000000, "b%24'l%c\t%b"},
+  {ARM_EXT_V1, 0x0f000000, 0x0f000000, "svc%c\t%0-23x"},
 
-    /* The rest.  */
-    {0x00000000, 0x00000000, "undefined instruction %0-31x"},
-    {0x00000000, 0x00000000, 0}
+  /* The rest.  */
+  {ARM_EXT_V1, 0x00000000, 0x00000000, "undefined instruction %0-31x"},
+  {0, 0x00000000, 0x00000000, 0}
 };
 
-#define BDISP(x) ((((x) & 0xffffff) ^ 0x800000) - 0x800000) /* 26 bit */
+/* print_insn_thumb16 recognizes the following format control codes:
 
-static struct thumb_opcode thumb_opcodes[] =
+   %S                   print Thumb register (bits 3..5 as high number if bit 6 set)
+   %D                   print Thumb register (bits 0..2 as high number if bit 7 set)
+   %<bitfield>I         print bitfield as a signed decimal
+   				(top bit of range being the sign bit)
+   %N                   print Thumb register mask (with LR)
+   %O                   print Thumb register mask (with PC)
+   %M                   print Thumb register mask
+   %b			print CZB's 6-bit unsigned branch destination
+   %s			print Thumb right-shift immediate (6..10; 0 == 32).
+   %c			print the condition code
+   %C			print the condition code, or "s" if not conditional
+   %x			print warning if conditional an not at end of IT block"
+   %X			print "\t; unpredictable <IT:code>" if conditional
+   %I			print IT instruction suffix and operands
+   %<bitfield>r		print bitfield as an ARM register
+   %<bitfield>d		print bitfield as a decimal
+   %<bitfield>H         print (bitfield * 2) as a decimal
+   %<bitfield>W         print (bitfield * 4) as a decimal
+   %<bitfield>a         print (bitfield * 4) as a pc-rel offset + decoded symbol
+   %<bitfield>B         print Thumb branch destination (signed displacement)
+   %<bitfield>c         print bitfield as a condition code
+   %<bitnum>'c		print specified char iff bit is one
+   %<bitnum>?ab		print a if bit is one else print b.  */
+
+static const struct opcode16 thumb_opcodes[] =
 {
   /* Thumb instructions.  */
 
+  /* ARM V6K no-argument instructions.  */
+  {ARM_EXT_V6K, 0xbf00, 0xffff, "nop%c"},
+  {ARM_EXT_V6K, 0xbf10, 0xffff, "yield%c"},
+  {ARM_EXT_V6K, 0xbf20, 0xffff, "wfe%c"},
+  {ARM_EXT_V6K, 0xbf30, 0xffff, "wfi%c"},
+  {ARM_EXT_V6K, 0xbf40, 0xffff, "sev%c"},
+  {ARM_EXT_V6K, 0xbf00, 0xff0f, "nop%c\t{%4-7d}"},
+
+  /* ARM V6T2 instructions.  */
+  {ARM_EXT_V6T2, 0xb900, 0xfd00, "cbnz\t%0-2r, %b%X"},
+  {ARM_EXT_V6T2, 0xb100, 0xfd00, "cbz\t%0-2r, %b%X"},
+  {ARM_EXT_V6T2, 0xbf00, 0xff00, "it%I%X"},
+
+  /* ARM V6.  */
+  {ARM_EXT_V6, 0xb660, 0xfff8, "cpsie\t%2'a%1'i%0'f%X"},
+  {ARM_EXT_V6, 0xb670, 0xfff8, "cpsid\t%2'a%1'i%0'f%X"},
+  {ARM_EXT_V6, 0x4600, 0xffc0, "mov%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xba00, 0xffc0, "rev%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xba40, 0xffc0, "rev16%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xbac0, 0xffc0, "revsh%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb650, 0xfff7, "setend\t%3?ble%X"},
+  {ARM_EXT_V6, 0xb200, 0xffc0, "sxth%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb240, 0xffc0, "sxtb%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb280, 0xffc0, "uxth%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V6, 0xb2c0, 0xffc0, "uxtb%c\t%0-2r, %3-5r"},
+
   /* ARM V5 ISA extends Thumb.  */
-  {0xbe00, 0xff00, "bkpt\t%0-7x"},
-  {0x4780, 0xff87, "blx\t%3-6r"},	/* note: 4 bit register number.  */
-  /* Note: this is BLX(2).  BLX(1) is done in arm-dis.c/print_insn_thumb()
-     as an extension of the special processing there for Thumb BL.
-     BL and BLX(1) involve 2 successive 16-bit instructions, which must
-     always appear together in the correct order.  So, the empty
-     string is put in this table, and the string interpreter takes <empty>
-     to mean it has a pair of BL-ish instructions.  */
-  {0x46C0, 0xFFFF, "nop\t\t\t(mov r8, r8)"},
-  /* Format 5 instructions do not update the PSR.  */
-  {0x1C00, 0xFFC0, "mov\t%0-2r, %3-5r\t\t(add %0-2r, %3-5r, #%6-8d)"},
+  {ARM_EXT_V5T, 0xbe00, 0xff00, "bkpt\t%0-7x"}, /* Is always unconditional.  */
+  /* This is BLX(2).  BLX(1) is a 32-bit instruction.  */
+  {ARM_EXT_V5T, 0x4780, 0xff87, "blx%c\t%3-6r%x"},	/* note: 4 bit register number.  */
+  /* ARM V4T ISA (Thumb v1).  */
+  {ARM_EXT_V4T, 0x46C0, 0xFFFF, "nop%c\t\t\t(mov r8, r8)"},
   /* Format 4.  */
-  {0x4000, 0xFFC0, "and\t%0-2r, %3-5r"},
-  {0x4040, 0xFFC0, "eor\t%0-2r, %3-5r"},
-  {0x4080, 0xFFC0, "lsl\t%0-2r, %3-5r"},
-  {0x40C0, 0xFFC0, "lsr\t%0-2r, %3-5r"},
-  {0x4100, 0xFFC0, "asr\t%0-2r, %3-5r"},
-  {0x4140, 0xFFC0, "adc\t%0-2r, %3-5r"},
-  {0x4180, 0xFFC0, "sbc\t%0-2r, %3-5r"},
-  {0x41C0, 0xFFC0, "ror\t%0-2r, %3-5r"},
-  {0x4200, 0xFFC0, "tst\t%0-2r, %3-5r"},
-  {0x4240, 0xFFC0, "neg\t%0-2r, %3-5r"},
-  {0x4280, 0xFFC0, "cmp\t%0-2r, %3-5r"},
-  {0x42C0, 0xFFC0, "cmn\t%0-2r, %3-5r"},
-  {0x4300, 0xFFC0, "orr\t%0-2r, %3-5r"},
-  {0x4340, 0xFFC0, "mul\t%0-2r, %3-5r"},
-  {0x4380, 0xFFC0, "bic\t%0-2r, %3-5r"},
-  {0x43C0, 0xFFC0, "mvn\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4000, 0xFFC0, "and%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4040, 0xFFC0, "eor%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4080, 0xFFC0, "lsl%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x40C0, 0xFFC0, "lsr%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4100, 0xFFC0, "asr%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4140, 0xFFC0, "adc%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4180, 0xFFC0, "sbc%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x41C0, 0xFFC0, "ror%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4200, 0xFFC0, "tst%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4240, 0xFFC0, "neg%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4280, 0xFFC0, "cmp%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x42C0, 0xFFC0, "cmn%c\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4300, 0xFFC0, "orr%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4340, 0xFFC0, "mul%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x4380, 0xFFC0, "bic%C\t%0-2r, %3-5r"},
+  {ARM_EXT_V4T, 0x43C0, 0xFFC0, "mvn%C\t%0-2r, %3-5r"},
   /* format 13 */
-  {0xB000, 0xFF80, "add\tsp, #%0-6W"},
-  {0xB080, 0xFF80, "sub\tsp, #%0-6W"},
+  {ARM_EXT_V4T, 0xB000, 0xFF80, "add%c\tsp, #%0-6W"},
+  {ARM_EXT_V4T, 0xB080, 0xFF80, "sub%c\tsp, #%0-6W"},
   /* format 5 */
-  {0x4700, 0xFF80, "bx\t%S"},
-  {0x4400, 0xFF00, "add\t%D, %S"},
-  {0x4500, 0xFF00, "cmp\t%D, %S"},
-  {0x4600, 0xFF00, "mov\t%D, %S"},
+  {ARM_EXT_V4T, 0x4700, 0xFF80, "bx%c\t%S%x"},
+  {ARM_EXT_V4T, 0x4400, 0xFF00, "add%c\t%D, %S"},
+  {ARM_EXT_V4T, 0x4500, 0xFF00, "cmp%c\t%D, %S"},
+  {ARM_EXT_V4T, 0x4600, 0xFF00, "mov%c\t%D, %S"},
   /* format 14 */
-  {0xB400, 0xFE00, "push\t%N"},
-  {0xBC00, 0xFE00, "pop\t%O"},
+  {ARM_EXT_V4T, 0xB400, 0xFE00, "push%c\t%N"},
+  {ARM_EXT_V4T, 0xBC00, 0xFE00, "pop%c\t%O"},
   /* format 2 */
-  {0x1800, 0xFE00, "add\t%0-2r, %3-5r, %6-8r"},
-  {0x1A00, 0xFE00, "sub\t%0-2r, %3-5r, %6-8r"},
-  {0x1C00, 0xFE00, "add\t%0-2r, %3-5r, #%6-8d"},
-  {0x1E00, 0xFE00, "sub\t%0-2r, %3-5r, #%6-8d"},
+  {ARM_EXT_V4T, 0x1800, 0xFE00, "add%C\t%0-2r, %3-5r, %6-8r"},
+  {ARM_EXT_V4T, 0x1A00, 0xFE00, "sub%C\t%0-2r, %3-5r, %6-8r"},
+  {ARM_EXT_V4T, 0x1C00, 0xFE00, "add%C\t%0-2r, %3-5r, #%6-8d"},
+  {ARM_EXT_V4T, 0x1E00, 0xFE00, "sub%C\t%0-2r, %3-5r, #%6-8d"},
   /* format 8 */
-  {0x5200, 0xFE00, "strh\t%0-2r, [%3-5r, %6-8r]"},
-  {0x5A00, 0xFE00, "ldrh\t%0-2r, [%3-5r, %6-8r]"},
-  {0x5600, 0xF600, "ldrs%11?hb\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5200, 0xFE00, "strh%c\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5A00, 0xFE00, "ldrh%c\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5600, 0xF600, "ldrs%11?hb%c\t%0-2r, [%3-5r, %6-8r]"},
   /* format 7 */
-  {0x5000, 0xFA00, "str%10'b\t%0-2r, [%3-5r, %6-8r]"},
-  {0x5800, 0xFA00, "ldr%10'b\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5000, 0xFA00, "str%10'b%c\t%0-2r, [%3-5r, %6-8r]"},
+  {ARM_EXT_V4T, 0x5800, 0xFA00, "ldr%10'b%c\t%0-2r, [%3-5r, %6-8r]"},
   /* format 1 */
-  {0x0000, 0xF800, "lsl\t%0-2r, %3-5r, #%6-10d"},
-  {0x0800, 0xF800, "lsr\t%0-2r, %3-5r, #%6-10d"},
-  {0x1000, 0xF800, "asr\t%0-2r, %3-5r, #%6-10d"},
+  {ARM_EXT_V4T, 0x0000, 0xF800, "lsl%C\t%0-2r, %3-5r, #%6-10d"},
+  {ARM_EXT_V4T, 0x0800, 0xF800, "lsr%C\t%0-2r, %3-5r, %s"},
+  {ARM_EXT_V4T, 0x1000, 0xF800, "asr%C\t%0-2r, %3-5r, %s"},
   /* format 3 */
-  {0x2000, 0xF800, "mov\t%8-10r, #%0-7d"},
-  {0x2800, 0xF800, "cmp\t%8-10r, #%0-7d"},
-  {0x3000, 0xF800, "add\t%8-10r, #%0-7d"},
-  {0x3800, 0xF800, "sub\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x2000, 0xF800, "mov%C\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x2800, 0xF800, "cmp%c\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x3000, 0xF800, "add%C\t%8-10r, #%0-7d"},
+  {ARM_EXT_V4T, 0x3800, 0xF800, "sub%C\t%8-10r, #%0-7d"},
   /* format 6 */
-  {0x4800, 0xF800, "ldr\t%8-10r, [pc, #%0-7W]\t(%0-7a)"},  /* TODO: Disassemble PC relative "LDR rD,=<symbolic>" */
+  {ARM_EXT_V4T, 0x4800, 0xF800, "ldr%c\t%8-10r, [pc, #%0-7W]\t(%0-7a)"},  /* TODO: Disassemble PC relative "LDR rD,=<symbolic>" */
   /* format 9 */
-  {0x6000, 0xF800, "str\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x6800, 0xF800, "ldr\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x7000, 0xF800, "strb\t%0-2r, [%3-5r, #%6-10d]"},
-  {0x7800, 0xF800, "ldrb\t%0-2r, [%3-5r, #%6-10d]"},
+  {ARM_EXT_V4T, 0x6000, 0xF800, "str%c\t%0-2r, [%3-5r, #%6-10W]"},
+  {ARM_EXT_V4T, 0x6800, 0xF800, "ldr%c\t%0-2r, [%3-5r, #%6-10W]"},
+  {ARM_EXT_V4T, 0x7000, 0xF800, "strb%c\t%0-2r, [%3-5r, #%6-10d]"},
+  {ARM_EXT_V4T, 0x7800, 0xF800, "ldrb%c\t%0-2r, [%3-5r, #%6-10d]"},
   /* format 10 */
-  {0x8000, 0xF800, "strh\t%0-2r, [%3-5r, #%6-10H]"},
-  {0x8800, 0xF800, "ldrh\t%0-2r, [%3-5r, #%6-10H]"},
+  {ARM_EXT_V4T, 0x8000, 0xF800, "strh%c\t%0-2r, [%3-5r, #%6-10H]"},
+  {ARM_EXT_V4T, 0x8800, 0xF800, "ldrh%c\t%0-2r, [%3-5r, #%6-10H]"},
   /* format 11 */
-  {0x9000, 0xF800, "str\t%8-10r, [sp, #%0-7W]"},
-  {0x9800, 0xF800, "ldr\t%8-10r, [sp, #%0-7W]"},
+  {ARM_EXT_V4T, 0x9000, 0xF800, "str%c\t%8-10r, [sp, #%0-7W]"},
+  {ARM_EXT_V4T, 0x9800, 0xF800, "ldr%c\t%8-10r, [sp, #%0-7W]"},
   /* format 12 */
-  {0xA000, 0xF800, "add\t%8-10r, pc, #%0-7W\t(adr %8-10r,%0-7a)"},
-  {0xA800, 0xF800, "add\t%8-10r, sp, #%0-7W"},
+  {ARM_EXT_V4T, 0xA000, 0xF800, "add%c\t%8-10r, pc, #%0-7W\t(adr %8-10r, %0-7a)"},
+  {ARM_EXT_V4T, 0xA800, 0xF800, "add%c\t%8-10r, sp, #%0-7W"},
   /* format 15 */
-  {0xC000, 0xF800, "stmia\t%8-10r!,%M"},
-  {0xC800, 0xF800, "ldmia\t%8-10r!,%M"},
+  {ARM_EXT_V4T, 0xC000, 0xF800, "stmia%c\t%8-10r!, %M"},
+  {ARM_EXT_V4T, 0xC800, 0xF800, "ldmia%c\t%8-10r!, %M"},
+  /* format 17 */
+  {ARM_EXT_V4T, 0xDF00, 0xFF00, "svc%c\t%0-7d"},
+  /* format 16 */
+  {ARM_EXT_V4T, 0xDE00, 0xFE00, "undefined"},
+  {ARM_EXT_V4T, 0xD000, 0xF000, "b%8-11c.n\t%0-7B%X"},
   /* format 18 */
-  {0xE000, 0xF800, "b\t%0-10B"},
-  {0xE800, 0xF800, "undefined"},
-  /* format 19 */
-  {0xF000, 0xF800, ""}, /* special processing required in disassembler */
-  {0xF800, 0xF800, "second half of BL instruction %0-15x"},
-  /* format 16 */
-  {0xD000, 0xFF00, "beq\t%0-7B"},
-  {0xD100, 0xFF00, "bne\t%0-7B"},
-  {0xD200, 0xFF00, "bcs\t%0-7B"},
-  {0xD300, 0xFF00, "bcc\t%0-7B"},
-  {0xD400, 0xFF00, "bmi\t%0-7B"},
-  {0xD500, 0xFF00, "bpl\t%0-7B"},
-  {0xD600, 0xFF00, "bvs\t%0-7B"},
-  {0xD700, 0xFF00, "bvc\t%0-7B"},
-  {0xD800, 0xFF00, "bhi\t%0-7B"},
-  {0xD900, 0xFF00, "bls\t%0-7B"},
-  {0xDA00, 0xFF00, "bge\t%0-7B"},
-  {0xDB00, 0xFF00, "blt\t%0-7B"},
-  {0xDC00, 0xFF00, "bgt\t%0-7B"},
-  {0xDD00, 0xFF00, "ble\t%0-7B"},
-  /* format 17 */
-  {0xDE00, 0xFF00, "bal\t%0-7B"},
-  {0xDF00, 0xFF00, "swi\t%0-7d"},
-  /* format 9 */
-  {0x6000, 0xF800, "str\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x6800, 0xF800, "ldr\t%0-2r, [%3-5r, #%6-10W]"},
-  {0x7000, 0xF800, "strb\t%0-2r, [%3-5r, #%6-10d]"},
-  {0x7800, 0xF800, "ldrb\t%0-2r, [%3-5r, #%6-10d]"},
-  /* the rest */
-  {0x0000, 0x0000, "undefined instruction %0-15x"},
-  {0x0000, 0x0000, 0}
+  {ARM_EXT_V4T, 0xE000, 0xF800, "b%c.n\t%0-10B%x"},
+
+  /* The E800 .. FFFF range is unconditionally redirected to the
+     32-bit table, because even in pre-V6T2 ISAs, BL and BLX(1) pairs
+     are processed via that table.  Thus, we can never encounter a
+     bare "second half of BL/BLX(1)" instruction here.  */
+  {ARM_EXT_V1,  0x0000, 0x0000, "undefined"},
+  {0, 0, 0, 0}
 };
 
-#define BDISP23(x) ((((((x) & 0x07ff) << 11) | (((x) & 0x07ff0000) >> 16)) \
-                     ^ 0x200000) - 0x200000) /* 23bit */
+/* Thumb32 opcodes use the same table structure as the ARM opcodes.
+   We adopt the convention that hw1 is the high 16 bits of .value and
+   .mask, hw2 the low 16 bits.
 
-#ifndef streq
-#define streq(a,b)	(strcmp ((a), (b)) == 0)
-#endif
+   print_insn_thumb32 recognizes the following format control codes:
 
-#ifndef strneq
-#define strneq(a,b,n)	(strncmp ((a), (b), (n)) == 0)
-#endif
+       %%		%
 
-#ifndef NUM_ELEM
-#define NUM_ELEM(a)     (sizeof (a) / sizeof (a)[0])
-#endif
+       %I		print a 12-bit immediate from hw1[10],hw2[14:12,7:0]
+       %M		print a modified 12-bit immediate (same location)
+       %J		print a 16-bit immediate from hw1[3:0,10],hw2[14:12,7:0]
+       %K		print a 16-bit immediate from hw2[3:0],hw1[3:0],hw2[11:4]
+       %S		print a possibly-shifted Rm
 
-static char * arm_conditional[] =
+       %a		print the address of a plain load/store
+       %w		print the width and signedness of a core load/store
+       %m		print register mask for ldm/stm
+
+       %E		print the lsb and width fields of a bfc/bfi instruction
+       %F		print the lsb and width fields of a sbfx/ubfx instruction
+       %b		print a conditional branch offset
+       %B		print an unconditional branch offset
+       %s		print the shift field of an SSAT instruction
+       %R		print the rotation field of an SXT instruction
+       %U		print barrier type.
+       %P		print address for pli instruction.
+       %c		print the condition code
+       %x		print warning if conditional an not at end of IT block"
+       %X		print "\t; unpredictable <IT:code>" if conditional
+
+       %<bitfield>d	print bitfield in decimal
+       %<bitfield>W	print bitfield*4 in decimal
+       %<bitfield>r	print bitfield as an ARM register
+       %<bitfield>c	print bitfield as a condition code
+
+       %<bitfield>'c	print specified char iff bitfield is all ones
+       %<bitfield>`c	print specified char iff bitfield is all zeroes
+       %<bitfield>?ab... select from array of values in big endian order
+
+   With one exception at the bottom (done because BL and BLX(1) need
+   to come dead last), this table was machine-sorted first in
+   decreasing order of number of bits set in the mask, then in
+   increasing numeric order of mask, then in increasing numeric order
+   of opcode.  This order is not the clearest for a human reader, but
+   is guaranteed never to catch a special-case bit pattern with a more
+   general mask, which is important, because this instruction encoding
+   makes heavy use of special-case bit patterns.  */
+static const struct opcode32 thumb32_opcodes[] =
+{
+  /* V7 instructions.  */
+  {ARM_EXT_V7, 0xf910f000, 0xff70f000, "pli%c\t%a"},
+  {ARM_EXT_V7, 0xf3af80f0, 0xfffffff0, "dbg%c\t#%0-3d"},
+  {ARM_EXT_V7, 0xf3bf8f50, 0xfffffff0, "dmb%c\t%U"},
+  {ARM_EXT_V7, 0xf3bf8f40, 0xfffffff0, "dsb%c\t%U"},
+  {ARM_EXT_V7, 0xf3bf8f60, 0xfffffff0, "isb%c\t%U"},
+  {ARM_EXT_DIV, 0xfb90f0f0, 0xfff0f0f0, "sdiv%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_DIV, 0xfbb0f0f0, 0xfff0f0f0, "udiv%c\t%8-11r, %16-19r, %0-3r"},
+
+  /* Instructions defined in the basic V6T2 set.  */
+  {ARM_EXT_V6T2, 0xf3af8000, 0xffffffff, "nop%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8001, 0xffffffff, "yield%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8002, 0xffffffff, "wfe%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8003, 0xffffffff, "wfi%c.w"},
+  {ARM_EXT_V6T2, 0xf3af9004, 0xffffffff, "sev%c.w"},
+  {ARM_EXT_V6T2, 0xf3af8000, 0xffffff00, "nop%c.w\t{%0-7d}"},
+
+  {ARM_EXT_V6T2, 0xf3bf8f2f, 0xffffffff, "clrex%c"},
+  {ARM_EXT_V6T2, 0xf3af8400, 0xffffff1f, "cpsie.w\t%7'a%6'i%5'f%X"},
+  {ARM_EXT_V6T2, 0xf3af8600, 0xffffff1f, "cpsid.w\t%7'a%6'i%5'f%X"},
+  {ARM_EXT_V6T2, 0xf3c08f00, 0xfff0ffff, "bxj%c\t%16-19r%x"},
+  {ARM_EXT_V6T2, 0xe810c000, 0xffd0ffff, "rfedb%c\t%16-19r%21'!"},
+  {ARM_EXT_V6T2, 0xe990c000, 0xffd0ffff, "rfeia%c\t%16-19r%21'!"},
+  {ARM_EXT_V6T2, 0xf3ef8000, 0xffeff000, "mrs%c\t%8-11r, %D"},
+  {ARM_EXT_V6T2, 0xf3af8100, 0xffffffe0, "cps\t#%0-4d%X"},
+  {ARM_EXT_V6T2, 0xe8d0f000, 0xfff0fff0, "tbb%c\t[%16-19r, %0-3r]%x"},
+  {ARM_EXT_V6T2, 0xe8d0f010, 0xfff0fff0, "tbh%c\t[%16-19r, %0-3r, lsl #1]%x"},
+  {ARM_EXT_V6T2, 0xf3af8500, 0xffffff00, "cpsie\t%7'a%6'i%5'f, #%0-4d%X"},
+  {ARM_EXT_V6T2, 0xf3af8700, 0xffffff00, "cpsid\t%7'a%6'i%5'f, #%0-4d%X"},
+  {ARM_EXT_V6T2, 0xf3de8f00, 0xffffff00, "subs%c\tpc, lr, #%0-7d"},
+  {ARM_EXT_V6T2, 0xf3808000, 0xffe0f000, "msr%c\t%C, %16-19r"},
+  {ARM_EXT_V6T2, 0xe8500f00, 0xfff00fff, "ldrex%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe8d00f4f, 0xfff00fef, "ldrex%4?hb%c\t%12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe800c000, 0xffd0ffe0, "srsdb%c\t%16-19r%21'!, #%0-4d"},
+  {ARM_EXT_V6T2, 0xe980c000, 0xffd0ffe0, "srsia%c\t%16-19r%21'!, #%0-4d"},
+  {ARM_EXT_V6T2, 0xfa0ff080, 0xfffff0c0, "sxth%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa1ff080, 0xfffff0c0, "uxth%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa2ff080, 0xfffff0c0, "sxtb16%c\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa3ff080, 0xfffff0c0, "uxtb16%c\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa4ff080, 0xfffff0c0, "sxtb%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa5ff080, 0xfffff0c0, "uxtb%c.w\t%8-11r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xe8400000, 0xfff000ff, "strex%c\t%8-11r, %12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe8d0007f, 0xfff000ff, "ldrexd%c\t%12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xfa80f000, 0xfff0f0f0, "sadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f010, 0xfff0f0f0, "qadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f020, 0xfff0f0f0, "shadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f040, 0xfff0f0f0, "uadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f050, 0xfff0f0f0, "uqadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f060, 0xfff0f0f0, "uhadd8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa80f080, 0xfff0f0f0, "qadd%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa80f090, 0xfff0f0f0, "qdadd%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa80f0a0, 0xfff0f0f0, "qsub%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa80f0b0, 0xfff0f0f0, "qdsub%c\t%8-11r, %0-3r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f000, 0xfff0f0f0, "sadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f010, 0xfff0f0f0, "qadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f020, 0xfff0f0f0, "shadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f040, 0xfff0f0f0, "uadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f050, 0xfff0f0f0, "uqadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f060, 0xfff0f0f0, "uhadd16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa90f080, 0xfff0f0f0, "rev%c.w\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f090, 0xfff0f0f0, "rev16%c.w\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f0a0, 0xfff0f0f0, "rbit%c\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfa90f0b0, 0xfff0f0f0, "revsh%c.w\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfaa0f000, 0xfff0f0f0, "saddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f010, 0xfff0f0f0, "qaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f020, 0xfff0f0f0, "shaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f040, 0xfff0f0f0, "uaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f050, 0xfff0f0f0, "uqaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f060, 0xfff0f0f0, "uhaddsubx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfaa0f080, 0xfff0f0f0, "sel%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfab0f080, 0xfff0f0f0, "clz%c\t%8-11r, %16-19r"},
+  {ARM_EXT_V6T2, 0xfac0f000, 0xfff0f0f0, "ssub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f010, 0xfff0f0f0, "qsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f020, 0xfff0f0f0, "shsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f040, 0xfff0f0f0, "usub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f050, 0xfff0f0f0, "uqsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfac0f060, 0xfff0f0f0, "uhsub8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f000, 0xfff0f0f0, "ssub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f010, 0xfff0f0f0, "qsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f020, 0xfff0f0f0, "shsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f040, 0xfff0f0f0, "usub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f050, 0xfff0f0f0, "uqsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfad0f060, 0xfff0f0f0, "uhsub16%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f000, 0xfff0f0f0, "ssubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f010, 0xfff0f0f0, "qsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f020, 0xfff0f0f0, "shsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f040, 0xfff0f0f0, "usubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f050, 0xfff0f0f0, "uqsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfae0f060, 0xfff0f0f0, "uhsubaddx%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb00f000, 0xfff0f0f0, "mul%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb70f000, 0xfff0f0f0, "usad8%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa00f000, 0xffe0f0f0, "lsl%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa20f000, 0xffe0f0f0, "lsr%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa40f000, 0xffe0f0f0, "asr%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa60f000, 0xffe0f0f0, "ror%20's%c.w\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xe8c00f40, 0xfff00fe0, "strex%4?hb%c\t%0-3r, %12-15r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xf3200000, 0xfff0f0e0, "ssat16%c\t%8-11r, #%0-4d, %16-19r"},
+  {ARM_EXT_V6T2, 0xf3a00000, 0xfff0f0e0, "usat16%c\t%8-11r, #%0-4d, %16-19r"},
+  {ARM_EXT_V6T2, 0xfb20f000, 0xfff0f0e0, "smuad%4'x%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb30f000, 0xfff0f0e0, "smulw%4?tb%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb40f000, 0xfff0f0e0, "smusd%4'x%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfb50f000, 0xfff0f0e0, "smmul%4'r%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfa00f080, 0xfff0f0c0, "sxtah%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa10f080, 0xfff0f0c0, "uxtah%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa20f080, 0xfff0f0c0, "sxtab16%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa30f080, 0xfff0f0c0, "uxtab16%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa40f080, 0xfff0f0c0, "sxtab%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfa50f080, 0xfff0f0c0, "uxtab%c\t%8-11r, %16-19r, %0-3r%R"},
+  {ARM_EXT_V6T2, 0xfb10f000, 0xfff0f0c0, "smul%5?tb%4?tb%c\t%8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xf36f0000, 0xffff8020, "bfc%c\t%8-11r, %E"},
+  {ARM_EXT_V6T2, 0xea100f00, 0xfff08f00, "tst%c.w\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea900f00, 0xfff08f00, "teq%c\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb100f00, 0xfff08f00, "cmn%c.w\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xebb00f00, 0xfff08f00, "cmp%c.w\t%16-19r, %S"},
+  {ARM_EXT_V6T2, 0xf0100f00, 0xfbf08f00, "tst%c.w\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0900f00, 0xfbf08f00, "teq%c\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1100f00, 0xfbf08f00, "cmn%c.w\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1b00f00, 0xfbf08f00, "cmp%c.w\t%16-19r, %M"},
+  {ARM_EXT_V6T2, 0xea4f0000, 0xffef8000, "mov%20's%c.w\t%8-11r, %S"},
+  {ARM_EXT_V6T2, 0xea6f0000, 0xffef8000, "mvn%20's%c.w\t%8-11r, %S"},
+  {ARM_EXT_V6T2, 0xe8c00070, 0xfff000f0, "strexd%c\t%0-3r, %12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xfb000000, 0xfff000f0, "mla%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb000010, 0xfff000f0, "mls%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb700000, 0xfff000f0, "usada8%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb800000, 0xfff000f0, "smull%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfba00000, 0xfff000f0, "umull%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbc00000, 0xfff000f0, "smlal%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbe00000, 0xfff000f0, "umlal%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbe00060, 0xfff000f0, "umaal%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xe8500f00, 0xfff00f00, "ldrex%c\t%12-15r, [%16-19r, #%0-7W]"},
+  {ARM_EXT_V6T2, 0xf7f08000, 0xfff0f000, "smc%c\t%K"},
+  {ARM_EXT_V6T2, 0xf04f0000, 0xfbef8000, "mov%20's%c.w\t%8-11r, %M"},
+  {ARM_EXT_V6T2, 0xf06f0000, 0xfbef8000, "mvn%20's%c.w\t%8-11r, %M"},
+  {ARM_EXT_V6T2, 0xf810f000, 0xff70f000, "pld%c\t%a"},
+  {ARM_EXT_V6T2, 0xfb200000, 0xfff000e0, "smlad%4'x%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb300000, 0xfff000e0, "smlaw%4?tb%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb400000, 0xfff000e0, "smlsd%4'x%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb500000, 0xfff000e0, "smmla%4'r%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfb600000, 0xfff000e0, "smmls%4'r%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfbc000c0, 0xfff000e0, "smlald%4'x%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xfbd000c0, 0xfff000e0, "smlsld%4'x%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xeac00000, 0xfff08030, "pkhbt%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeac00020, 0xfff08030, "pkhtb%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xf3400000, 0xfff08020, "sbfx%c\t%8-11r, %16-19r, %F"},
+  {ARM_EXT_V6T2, 0xf3c00000, 0xfff08020, "ubfx%c\t%8-11r, %16-19r, %F"},
+  {ARM_EXT_V6T2, 0xf8000e00, 0xff900f00, "str%wt%c\t%12-15r, %a"},
+  {ARM_EXT_V6T2, 0xfb100000, 0xfff000c0, "smla%5?tb%4?tb%c\t%8-11r, %16-19r, %0-3r, %12-15r"},
+  {ARM_EXT_V6T2, 0xfbc00080, 0xfff000c0, "smlal%5?tb%4?tb%c\t%12-15r, %8-11r, %16-19r, %0-3r"},
+  {ARM_EXT_V6T2, 0xf3600000, 0xfff08020, "bfi%c\t%8-11r, %16-19r, %E"},
+  {ARM_EXT_V6T2, 0xf8100e00, 0xfe900f00, "ldr%wt%c\t%12-15r, %a"},
+  {ARM_EXT_V6T2, 0xf3000000, 0xffd08020, "ssat%c\t%8-11r, #%0-4d, %16-19r%s"},
+  {ARM_EXT_V6T2, 0xf3800000, 0xffd08020, "usat%c\t%8-11r, #%0-4d, %16-19r%s"},
+  {ARM_EXT_V6T2, 0xf2000000, 0xfbf08000, "addw%c\t%8-11r, %16-19r, %I"},
+  {ARM_EXT_V6T2, 0xf2400000, 0xfbf08000, "movw%c\t%8-11r, %J"},
+  {ARM_EXT_V6T2, 0xf2a00000, 0xfbf08000, "subw%c\t%8-11r, %16-19r, %I"},
+  {ARM_EXT_V6T2, 0xf2c00000, 0xfbf08000, "movt%c\t%8-11r, %J"},
+  {ARM_EXT_V6T2, 0xea000000, 0xffe08000, "and%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea200000, 0xffe08000, "bic%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea400000, 0xffe08000, "orr%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea600000, 0xffe08000, "orn%20's%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xea800000, 0xffe08000, "eor%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb000000, 0xffe08000, "add%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb400000, 0xffe08000, "adc%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeb600000, 0xffe08000, "sbc%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xeba00000, 0xffe08000, "sub%20's%c.w\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xebc00000, 0xffe08000, "rsb%20's%c\t%8-11r, %16-19r, %S"},
+  {ARM_EXT_V6T2, 0xe8400000, 0xfff00000, "strex%c\t%8-11r, %12-15r, [%16-19r, #%0-7W]"},
+  {ARM_EXT_V6T2, 0xf0000000, 0xfbe08000, "and%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0200000, 0xfbe08000, "bic%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0400000, 0xfbe08000, "orr%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0600000, 0xfbe08000, "orn%20's%c\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf0800000, 0xfbe08000, "eor%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1000000, 0xfbe08000, "add%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1400000, 0xfbe08000, "adc%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1600000, 0xfbe08000, "sbc%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1a00000, 0xfbe08000, "sub%20's%c.w\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xf1c00000, 0xfbe08000, "rsb%20's%c\t%8-11r, %16-19r, %M"},
+  {ARM_EXT_V6T2, 0xe8800000, 0xffd00000, "stmia%c.w\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe8900000, 0xffd00000, "ldmia%c.w\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe9000000, 0xffd00000, "stmdb%c\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe9100000, 0xffd00000, "ldmdb%c\t%16-19r%21'!, %m"},
+  {ARM_EXT_V6T2, 0xe9c00000, 0xffd000ff, "strd%c\t%12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe9d00000, 0xffd000ff, "ldrd%c\t%12-15r, %8-11r, [%16-19r]"},
+  {ARM_EXT_V6T2, 0xe9400000, 0xff500000, "strd%c\t%12-15r, %8-11r, [%16-19r, #%23`-%0-7W]%21'!"},
+  {ARM_EXT_V6T2, 0xe9500000, 0xff500000, "ldrd%c\t%12-15r, %8-11r, [%16-19r, #%23`-%0-7W]%21'!"},
+  {ARM_EXT_V6T2, 0xe8600000, 0xff700000, "strd%c\t%12-15r, %8-11r, [%16-19r], #%23`-%0-7W"},
+  {ARM_EXT_V6T2, 0xe8700000, 0xff700000, "ldrd%c\t%12-15r, %8-11r, [%16-19r], #%23`-%0-7W"},
+  {ARM_EXT_V6T2, 0xf8000000, 0xff100000, "str%w%c.w\t%12-15r, %a"},
+  {ARM_EXT_V6T2, 0xf8100000, 0xfe100000, "ldr%w%c.w\t%12-15r, %a"},
+
+  /* Filter out Bcc with cond=E or F, which are used for other instructions.  */
+  {ARM_EXT_V6T2, 0xf3c08000, 0xfbc0d000, "undefined (bcc, cond=0xF)"},
+  {ARM_EXT_V6T2, 0xf3808000, 0xfbc0d000, "undefined (bcc, cond=0xE)"},
+  {ARM_EXT_V6T2, 0xf0008000, 0xf800d000, "b%22-25c.w\t%b%X"},
+  {ARM_EXT_V6T2, 0xf0009000, 0xf800d000, "b%c.w\t%B%x"},
+
+  /* These have been 32-bit since the invention of Thumb.  */
+  {ARM_EXT_V4T,  0xf000c000, 0xf800d000, "blx%c\t%B%x"},
+  {ARM_EXT_V4T,  0xf000d000, 0xf800d000, "bl%c\t%B%x"},
+
+  /* Fallback.  */
+  {ARM_EXT_V1,   0x00000000, 0x00000000, "undefined"},
+  {0, 0, 0, 0}
+};
+
+static const char *const arm_conditional[] =
 {"eq", "ne", "cs", "cc", "mi", "pl", "vs", "vc",
- "hi", "ls", "ge", "lt", "gt", "le", "", "nv"};
+ "hi", "ls", "ge", "lt", "gt", "le", "al", "<und>", ""};
 
+static const char *const arm_fp_const[] =
+{"0.0", "1.0", "2.0", "3.0", "4.0", "5.0", "0.5", "10.0"};
+
+static const char *const arm_shift[] =
+{"lsl", "lsr", "asr", "ror"};
+
 typedef struct
 {
-  const char * name;
-  const char * description;
-  const char * reg_names[16];
+  const char *name;
+  const char *description;
+  const char *reg_names[16];
 }
 arm_regname;
 
-static arm_regname regnames[] =
+static const arm_regname regnames[] =
 {
   { "raw" , "Select raw register names",
     { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"}},
@@ -557,44 +1503,67 @@
   { "atpcs", "Select register names used in the ATPCS",
     { "a1", "a2", "a3", "a4", "v1", "v2", "v3", "v4", "v5", "v6", "v7",  "v8",  "IP",  "SP",  "LR",  "PC" }},
   { "special-atpcs", "Select special register names used in the ATPCS",
-    { "a1", "a2", "a3", "a4", "v1", "v2", "v3", "WR", "v5", "SB", "SL",  "FP",  "IP",  "SP",  "LR",  "PC" }}
+    { "a1", "a2", "a3", "a4", "v1", "v2", "v3", "WR", "v5", "SB", "SL",  "FP",  "IP",  "SP",  "LR",  "PC" }},
 };
 
-/* Default to STD register name set.  */
-static unsigned int regname_selected = 2;
+static const char *const iwmmxt_wwnames[] =
+{"b", "h", "w", "d"};
 
+static const char *const iwmmxt_wwssnames[] =
+{"b", "bus", "bc", "bss",
+ "h", "hus", "hc", "hss",
+ "w", "wus", "wc", "wss",
+ "d", "dus", "dc", "dss"
+};
+
+static const char *const iwmmxt_regnames[] =
+{ "wr0", "wr1", "wr2", "wr3", "wr4", "wr5", "wr6", "wr7",
+  "wr8", "wr9", "wr10", "wr11", "wr12", "wr13", "wr14", "wr15"
+};
+
+static const char *const iwmmxt_cregnames[] =
+{ "wcid", "wcon", "wcssf", "wcasf", "reserved", "reserved", "reserved", "reserved",
+  "wcgr0", "wcgr1", "wcgr2", "wcgr3", "reserved", "reserved", "reserved", "reserved"
+};
+
+/* Default to GCC register name set.  */
+static unsigned int regname_selected = 1;
+
 #define NUM_ARM_REGNAMES  NUM_ELEM (regnames)
 #define arm_regnames      regnames[regname_selected].reg_names
 
-static boolean force_thumb = false;
+static bfd_boolean force_thumb = FALSE;
 
-static char * arm_fp_const[] =
-{"0.0", "1.0", "2.0", "3.0", "4.0", "5.0", "0.5", "10.0"};
+/* Current IT instruction state.  This contains the same state as the IT
+   bits in the CPSR.  */
+static unsigned int ifthen_state;
+/* IT state for the next instruction.  */
+static unsigned int ifthen_next_state;
+/* The address of the insn for which the IT state is valid.  */
+static bfd_vma ifthen_address;
+#define IFTHEN_COND ((ifthen_state >> 4) & 0xf)
 
-static char * arm_shift[] =
-{"lsl", "lsr", "asr", "ror"};
+/* Cached mapping symbol state.  */
+enum map_type {
+  MAP_ARM,
+  MAP_THUMB,
+  MAP_DATA
+};
+
+enum map_type last_type;
+int last_mapping_sym = -1;
+bfd_vma last_mapping_addr = 0;
+
 
-/* Forward declarations.  */
-static void arm_decode_shift PARAMS ((long, fprintf_ftype, void *));
-static int  print_insn_arm1 PARAMS ((bfd_vma, struct disassemble_info *, long));
-static int  print_insn_thumb PARAMS ((bfd_vma, struct disassemble_info *, long));
-static void parse_disassembler_options PARAMS ((char *));
-int get_arm_regname_num_options (void);
-int set_arm_regname_option (int option);
-int get_arm_regnames (int option, const char **setname,
-		      const char **setdescription,
-		      const char ***register_names);
-
 /* Functions.  */
 int
-get_arm_regname_num_options ()
+get_arm_regname_num_options (void)
 {
   return NUM_ARM_REGNAMES;
 }
 
 int
-set_arm_regname_option (option)
-     int option;
+set_arm_regname_option (int option)
 {
   int old = regname_selected;
   regname_selected = option;
@@ -602,11 +1571,8 @@
 }
 
 int
-get_arm_regnames (option, setname, setdescription, register_names)
-     int option;
-     const char **setname;
-     const char **setdescription;
-     const char ***register_names;
+get_arm_regnames (int option, const char **setname, const char **setdescription,
+		  const char *const **register_names)
 {
   *setname = regnames[option].name;
   *setdescription = regnames[option].description;
@@ -614,11 +1580,46 @@
   return 16;
 }
 
+/* Decode a bitfield of the form matching regexp (N(-N)?,)*N(-N)?.
+   Returns pointer to following character of the format string and
+   fills in *VALUEP and *WIDTHP with the extracted value and number of
+   bits extracted.  WIDTHP can be NULL. */
+
+static const char *
+arm_decode_bitfield (const char *ptr, unsigned long insn,
+		     unsigned long *valuep, int *widthp)
+{
+  unsigned long value = 0;
+  int width = 0;
+
+  do
+    {
+      int start, end;
+      int bits;
+
+      for (start = 0; *ptr >= '0' && *ptr <= '9'; ptr++)
+	start = start * 10 + *ptr - '0';
+      if (*ptr == '-')
+	for (end = 0, ptr++; *ptr >= '0' && *ptr <= '9'; ptr++)
+	  end = end * 10 + *ptr - '0';
+      else
+	end = start;
+      bits = end - start;
+      if (bits < 0)
+	abort ();
+      value |= ((insn >> start) & ((2ul << bits) - 1)) << width;
+      width += bits + 1;
+    }
+  while (*ptr++ == ',');
+  *valuep = value;
+  if (widthp)
+    *widthp = width;
+  return ptr - 1;
+}
+
 static void
-arm_decode_shift (given, func, stream)
-     long given;
-     fprintf_ftype func;
-     void * stream;
+arm_decode_shift (long given, fprintf_ftype func, void *stream,
+		  int print_shift)
 {
   func (stream, "%s", arm_regnames[given & 0xf]);
 
@@ -640,32 +1641,75 @@
 	      amount = 32;
 	    }
 
-	  func (stream, ", %s #%d", arm_shift[shift], amount);
+	  if (print_shift)
+	    func (stream, ", %s #%d", arm_shift[shift], amount);
+	  else
+	    func (stream, ", #%d", amount);
 	}
-      else
+      else if (print_shift)
 	func (stream, ", %s %s", arm_shift[(given & 0x60) >> 5],
 	      arm_regnames[(given & 0xf00) >> 8]);
+      else
+	func (stream, ", %s", arm_regnames[(given & 0xf00) >> 8]);
     }
 }
 
-/* Print one instruction from PC on INFO->STREAM.
-   Return the size of the instruction (always 4 on ARM). */
+/* Print one coprocessor instruction on INFO->STREAM.
+   Return TRUE if the instuction matched, FALSE if this is not a
+   recognised coprocessor instruction.  */
 
-static int
-print_insn_arm1 (pc, info, given)
-     bfd_vma                   pc;
-     struct disassemble_info * info;
-     long                      given;
+static bfd_boolean
+print_insn_coprocessor (bfd_vma pc, struct disassemble_info *info, long given,
+			bfd_boolean thumb)
 {
-  struct arm_opcode *  insn;
-  void *               stream = info->stream;
-  fprintf_ftype        func   = info->fprintf_func;
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+  unsigned long mask;
+  unsigned long value;
+  int cond;
 
-  for (insn = arm_opcodes; insn->assembler; insn++)
+  for (insn = coprocessor_opcodes; insn->assembler; insn++)
     {
-      if ((given & insn->mask) == insn->value)
+      if (insn->value == FIRST_IWMMXT_INSN
+	  && info->mach != bfd_mach_arm_XScale
+	  && info->mach != bfd_mach_arm_iWMMXt
+	  && info->mach != bfd_mach_arm_iWMMXt2)
+	insn = insn + IWMMXT_INSN_COUNT;
+
+      mask = insn->mask;
+      value = insn->value;
+      if (thumb)
 	{
-	  char * c;
+	  /* The high 4 bits are 0xe for Arm conditional instructions, and
+	     0xe for arm unconditional instructions.  The rest of the
+	     encoding is the same.  */
+	  mask |= 0xf0000000;
+	  value |= 0xe0000000;
+	  if (ifthen_state)
+	    cond = IFTHEN_COND;
+	  else
+	    cond = 16;
+	}
+      else
+	{
+	  /* Only match unconditional instuctions against unconditional
+	     patterns.  */
+	  if ((given & 0xf0000000) == 0xf0000000)
+	    {
+	      mask |= 0xf0000000;
+	      cond = 16;
+	    }
+	  else
+	    {
+	      cond = (given >> 28) & 0xf;
+	      if (cond == 0xe)
+		cond = 16;
+	    }
+	}
+      if ((given & mask) == value)
+	{
+	  const char *c;
 
 	  for (c = insn->assembler; *c; c++)
 	    {
@@ -677,91 +1721,1040 @@
 		      func (stream, "%%");
 		      break;
 
-		    case 'a':
-		      if (((given & 0x000f0000) == 0x000f0000)
-			  && ((given & 0x02000000) == 0))
+		    case 'A':
+		      func (stream, "[%s", arm_regnames [(given >> 16) & 0xf]);
+
+		      if ((given & (1 << 24)) != 0)
 			{
-			  int offset = given & 0xfff;
+			  int offset = given & 0xff;
 
-			  func (stream, "[pc");
+			  if (offset)
+			    func (stream, ", #%s%d]%s",
+				  ((given & 0x00800000) == 0 ? "-" : ""),
+				  offset * 4,
+				  ((given & 0x00200000) != 0 ? "!" : ""));
+			  else
+			    func (stream, "]");
+			}
+		      else
+			{
+			  int offset = given & 0xff;
 
-			  if (given & 0x01000000)
+			  func (stream, "]");
+
+			  if (given & (1 << 21))
 			    {
-			      if ((given & 0x00800000) == 0)
-				offset = - offset;
+			      if (offset)
+				func (stream, ", #%s%d",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * 4);
+			    }
+			  else
+			    func (stream, ", {%d}", offset);
+			}
+		      break;
 
-			      /* Pre-indexed.  */
-			      func (stream, ", #%d]", offset);
+		    case 'B':
+		      {
+			int regno = ((given >> 12) & 0xf) | ((given >> (22 - 4)) & 0x10);
+			int offset = (given >> 1) & 0x3f;
 
-			      offset += pc + 8;
+			if (offset == 1)
+			  func (stream, "{d%d}", regno);
+			else if (regno + offset > 32)
+			  func (stream, "{d%d-<overflow reg d%d>}", regno, regno + offset - 1);
+			else
+			  func (stream, "{d%d-d%d}", regno, regno + offset - 1);
+		      }
+		      break;
 
-			      /* Cope with the possibility of write-back
-				 being used.  Probably a very dangerous thing
-				 for the programmer to do, but who are we to
-				 argue ?  */
-			      if (given & 0x00200000)
-				func (stream, "!");
-			    }
-			  else
-			    {
-			      /* Post indexed.  */
-			      func (stream, "], #%d", offset);
+		    case 'C':
+		      {
+			int rn = (given >> 16) & 0xf;
+			int offset = (given & 0xff) * 4;
+			int add = (given >> 23) & 1;
 
-			      /* ie ignore the offset.  */
-			      offset = pc + 8;
-			    }
+			func (stream, "[%s", arm_regnames[rn]);
 
-			  func (stream, "\t; ");
-			  info->print_address_func (offset, info);
+			if (offset)
+			  {
+			    if (!add)
+			      offset = -offset;
+			    func (stream, ", #%d", offset);
+			  }
+			func (stream, "]");
+			if (rn == 15)
+			  {
+			    func (stream, "\t; ");
+                            /* FIXME: Unsure if info->bytes_per_chunk is the
+                               right thing to use here.  */
+			    info->print_address_func (offset + pc
+                              + info->bytes_per_chunk * 2, info);
+			  }
+		      }
+		      break;
+
+		    case 'c':
+		      func (stream, "%s", arm_conditional[cond]);
+		      break;
+
+		    case 'I':
+		      /* Print a Cirrus/DSP shift immediate.  */
+		      /* Immediates are 7bit signed ints with bits 0..3 in
+			 bits 0..3 of opcode and bits 4..6 in bits 5..7
+			 of opcode.  */
+		      {
+			int imm;
+
+			imm = (given & 0xf) | ((given & 0xe0) >> 1);
+
+			/* Is ``imm'' a negative number?  */
+			if (imm & 0x40)
+			  imm |= (-1 << 7);
+
+			func (stream, "%d", imm);
+		      }
+
+		      break;
+
+		    case 'F':
+		      switch (given & 0x00408000)
+			{
+			case 0:
+			  func (stream, "4");
+			  break;
+			case 0x8000:
+			  func (stream, "1");
+			  break;
+			case 0x00400000:
+			  func (stream, "2");
+			  break;
+			default:
+			  func (stream, "3");
 			}
-		      else
+		      break;
+
+		    case 'P':
+		      switch (given & 0x00080080)
 			{
-			  func (stream, "[%s",
-				arm_regnames[(given >> 16) & 0xf]);
-			  if ((given & 0x01000000) != 0)
+			case 0:
+			  func (stream, "s");
+			  break;
+			case 0x80:
+			  func (stream, "d");
+			  break;
+			case 0x00080000:
+			  func (stream, "e");
+			  break;
+			default:
+			  func (stream, _("<illegal precision>"));
+			  break;
+			}
+		      break;
+		    case 'Q':
+		      switch (given & 0x00408000)
+			{
+			case 0:
+			  func (stream, "s");
+			  break;
+			case 0x8000:
+			  func (stream, "d");
+			  break;
+			case 0x00400000:
+			  func (stream, "e");
+			  break;
+			default:
+			  func (stream, "p");
+			  break;
+			}
+		      break;
+		    case 'R':
+		      switch (given & 0x60)
+			{
+			case 0:
+			  break;
+			case 0x20:
+			  func (stream, "p");
+			  break;
+			case 0x40:
+			  func (stream, "m");
+			  break;
+			default:
+			  func (stream, "z");
+			  break;
+			}
+		      break;
+
+		    case '0': case '1': case '2': case '3': case '4':
+		    case '5': case '6': case '7': case '8': case '9':
+		      {
+			int width;
+			unsigned long value;
+
+			c = arm_decode_bitfield (c, given, &value, &width);
+
+			switch (*c)
+			  {
+			  case 'r':
+			    func (stream, "%s", arm_regnames[value]);
+			    break;
+			  case 'D':
+			    func (stream, "d%ld", value);
+			    break;
+			  case 'Q':
+			    if (value & 1)
+			      func (stream, "<illegal reg q%ld.5>", value >> 1);
+			    else
+			      func (stream, "q%ld", value >> 1);
+			    break;
+			  case 'd':
+			    func (stream, "%ld", value);
+			    break;
+                          case 'k':
+                            {
+                              int from = (given & (1 << 7)) ? 32 : 16;
+                              func (stream, "%ld", from - value);
+                            }
+                            break;
+
+			  case 'f':
+			    if (value > 7)
+			      func (stream, "#%s", arm_fp_const[value & 7]);
+			    else
+			      func (stream, "f%ld", value);
+			    break;
+
+			  case 'w':
+			    if (width == 2)
+			      func (stream, "%s", iwmmxt_wwnames[value]);
+			    else
+			      func (stream, "%s", iwmmxt_wwssnames[value]);
+			    break;
+
+			  case 'g':
+			    func (stream, "%s", iwmmxt_regnames[value]);
+			    break;
+			  case 'G':
+			    func (stream, "%s", iwmmxt_cregnames[value]);
+			    break;
+
+			  case 'x':
+			    func (stream, "0x%lx", value);
+			    break;
+
+			  case '`':
+			    c++;
+			    if (value == 0)
+			      func (stream, "%c", *c);
+			    break;
+			  case '\'':
+			    c++;
+			    if (value == ((1ul << width) - 1))
+			      func (stream, "%c", *c);
+			    break;
+			  case '?':
+			    func (stream, "%c", c[(1 << width) - (int)value]);
+			    c += 1 << width;
+			    break;
+			  default:
+			    abort ();
+			  }
+			break;
+
+		      case 'y':
+		      case 'z':
+			{
+			  int single = *c++ == 'y';
+			  int regno;
+
+			  switch (*c)
 			    {
-			      if ((given & 0x02000000) == 0)
+			    case '4': /* Sm pair */
+			      func (stream, "{");
+			      /* Fall through.  */
+			    case '0': /* Sm, Dm */
+			      regno = given & 0x0000000f;
+			      if (single)
 				{
-				  int offset = given & 0xfff;
-				  if (offset)
-				    func (stream, ", %s#%d",
-					  (((given & 0x00800000) == 0)
-					   ? "-" : ""), offset);
+				  regno <<= 1;
+				  regno += (given >> 5) & 1;
 				}
-			      else
+                              else
+                                regno += ((given >> 5) & 1) << 4;
+			      break;
+
+			    case '1': /* Sd, Dd */
+			      regno = (given >> 12) & 0x0000000f;
+			      if (single)
 				{
-				  func (stream, ", %s",
-					(((given & 0x00800000) == 0)
-					 ? "-" : ""));
-				  arm_decode_shift (given, func, stream);
+				  regno <<= 1;
+				  regno += (given >> 22) & 1;
 				}
+                              else
+                                regno += ((given >> 22) & 1) << 4;
+			      break;
 
-			      func (stream, "]%s",
-				    ((given & 0x00200000) != 0) ? "!" : "");
+			    case '2': /* Sn, Dn */
+			      regno = (given >> 16) & 0x0000000f;
+			      if (single)
+				{
+				  regno <<= 1;
+				  regno += (given >> 7) & 1;
+				}
+                              else
+                                regno += ((given >> 7) & 1) << 4;
+			      break;
+
+			    case '3': /* List */
+			      func (stream, "{");
+			      regno = (given >> 12) & 0x0000000f;
+			      if (single)
+				{
+				  regno <<= 1;
+				  regno += (given >> 22) & 1;
+				}
+                              else
+                                regno += ((given >> 22) & 1) << 4;
+			      break;
+
+			    default:
+			      abort ();
 			    }
-			  else
+
+			  func (stream, "%c%d", single ? 's' : 'd', regno);
+
+			  if (*c == '3')
 			    {
-			      if ((given & 0x02000000) == 0)
+			      int count = given & 0xff;
+
+			      if (single == 0)
+				count >>= 1;
+
+			      if (--count)
 				{
-				  int offset = given & 0xfff;
-				  if (offset)
-				    func (stream, "], %s#%d",
-					  (((given & 0x00800000) == 0)
-					   ? "-" : ""), offset);
-				  else
-				    func (stream, "]");
+				  func (stream, "-%c%d",
+					single ? 's' : 'd',
+					regno + count);
 				}
+
+			      func (stream, "}");
+			    }
+			  else if (*c == '4')
+			    func (stream, ", %c%d}", single ? 's' : 'd',
+				  regno + 1);
+			}
+			break;
+
+		      case 'L':
+			switch (given & 0x00400100)
+			  {
+			  case 0x00000000: func (stream, "b"); break;
+			  case 0x00400000: func (stream, "h"); break;
+			  case 0x00000100: func (stream, "w"); break;
+			  case 0x00400100: func (stream, "d"); break;
+			  default:
+			    break;
+			  }
+			break;
+
+		      case 'Z':
+			{
+			  int value;
+			  /* given (20, 23) | given (0, 3) */
+			  value = ((given >> 16) & 0xf0) | (given & 0xf);
+			  func (stream, "%d", value);
+			}
+			break;
+
+		      case 'l':
+			/* This is like the 'A' operator, except that if
+			   the width field "M" is zero, then the offset is
+			   *not* multiplied by four.  */
+			{
+			  int offset = given & 0xff;
+			  int multiplier = (given & 0x00000100) ? 4 : 1;
+
+			  func (stream, "[%s", arm_regnames [(given >> 16) & 0xf]);
+
+			  if (offset)
+			    {
+			      if ((given & 0x01000000) != 0)
+				func (stream, ", #%s%d]%s",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * multiplier,
+				      ((given & 0x00200000) != 0 ? "!" : ""));
 			      else
-				{
-				  func (stream, "], %s",
-					(((given & 0x00800000) == 0)
-					 ? "-" : ""));
-				  arm_decode_shift (given, func, stream);
-				}
+				func (stream, "], #%s%d",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * multiplier);
 			    }
+			  else
+			    func (stream, "]");
 			}
+			break;
+
+		      case 'r':
+			{
+			  int imm4 = (given >> 4) & 0xf;
+			  int puw_bits = ((given >> 22) & 6) | ((given >> 21) & 1);
+			  int ubit = (given >> 23) & 1;
+			  const char *rm = arm_regnames [given & 0xf];
+			  const char *rn = arm_regnames [(given >> 16) & 0xf];
+
+			  switch (puw_bits)
+			    {
+			    case 1:
+			      /* fall through */
+			    case 3:
+			      func (stream, "[%s], %c%s", rn, ubit ? '+' : '-', rm);
+			      if (imm4)
+				func (stream, ", lsl #%d", imm4);
+			      break;
+
+			    case 4:
+			      /* fall through */
+			    case 5:
+			      /* fall through */
+			    case 6:
+			      /* fall through */
+			    case 7:
+			      func (stream, "[%s, %c%s", rn, ubit ? '+' : '-', rm);
+			      if (imm4 > 0)
+				func (stream, ", lsl #%d", imm4);
+			      func (stream, "]");
+			      if (puw_bits == 5 || puw_bits == 7)
+				func (stream, "!");
+			      break;
+
+			    default:
+			      func (stream, "INVALID");
+			    }
+			}
+			break;
+
+		      case 'i':
+			{
+			  long imm5;
+			  imm5 = ((given & 0x100) >> 4) | (given & 0xf);
+			  func (stream, "%ld", (imm5 == 0) ? 32 : imm5);
+			}
+			break;
+
+		      default:
+			abort ();
+		      }
+		    }
+		}
+	      else
+		func (stream, "%c", *c);
+	    }
+	  return TRUE;
+	}
+    }
+  return FALSE;
+}
+
+static void
+print_arm_address (bfd_vma pc, struct disassemble_info *info, long given)
+{
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+
+  if (((given & 0x000f0000) == 0x000f0000)
+      && ((given & 0x02000000) == 0))
+    {
+      int offset = given & 0xfff;
+
+      func (stream, "[pc");
+
+      if (given & 0x01000000)
+	{
+	  if ((given & 0x00800000) == 0)
+	    offset = - offset;
+
+	  /* Pre-indexed.  */
+	  func (stream, ", #%d]", offset);
+
+	  offset += pc + 8;
+
+	  /* Cope with the possibility of write-back
+	     being used.  Probably a very dangerous thing
+	     for the programmer to do, but who are we to
+	     argue ?  */
+	  if (given & 0x00200000)
+	    func (stream, "!");
+	}
+      else
+	{
+	  /* Post indexed.  */
+	  func (stream, "], #%d", offset);
+
+	  /* ie ignore the offset.  */
+	  offset = pc + 8;
+	}
+
+      func (stream, "\t; ");
+      info->print_address_func (offset, info);
+    }
+  else
+    {
+      func (stream, "[%s",
+	    arm_regnames[(given >> 16) & 0xf]);
+      if ((given & 0x01000000) != 0)
+	{
+	  if ((given & 0x02000000) == 0)
+	    {
+	      int offset = given & 0xfff;
+	      if (offset)
+		func (stream, ", #%s%d",
+		      (((given & 0x00800000) == 0)
+		       ? "-" : ""), offset);
+	    }
+	  else
+	    {
+	      func (stream, ", %s",
+		    (((given & 0x00800000) == 0)
+		     ? "-" : ""));
+	      arm_decode_shift (given, func, stream, 1);
+	    }
+
+	  func (stream, "]%s",
+		((given & 0x00200000) != 0) ? "!" : "");
+	}
+      else
+	{
+	  if ((given & 0x02000000) == 0)
+	    {
+	      int offset = given & 0xfff;
+	      if (offset)
+		func (stream, "], #%s%d",
+		      (((given & 0x00800000) == 0)
+		       ? "-" : ""), offset);
+	      else
+		func (stream, "]");
+	    }
+	  else
+	    {
+	      func (stream, "], %s",
+		    (((given & 0x00800000) == 0)
+		     ? "-" : ""));
+	      arm_decode_shift (given, func, stream, 1);
+	    }
+	}
+    }
+}
+
+/* Print one neon instruction on INFO->STREAM.
+   Return TRUE if the instuction matched, FALSE if this is not a
+   recognised neon instruction.  */
+
+static bfd_boolean
+print_insn_neon (struct disassemble_info *info, long given, bfd_boolean thumb)
+{
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+
+  if (thumb)
+    {
+      if ((given & 0xef000000) == 0xef000000)
+	{
+	  /* move bit 28 to bit 24 to translate Thumb2 to ARM encoding.  */
+	  unsigned long bit28 = given & (1 << 28);
+
+	  given &= 0x00ffffff;
+	  if (bit28)
+            given |= 0xf3000000;
+          else
+	    given |= 0xf2000000;
+	}
+      else if ((given & 0xff000000) == 0xf9000000)
+	given ^= 0xf9000000 ^ 0xf4000000;
+      else
+	return FALSE;
+    }
+
+  for (insn = neon_opcodes; insn->assembler; insn++)
+    {
+      if ((given & insn->mask) == insn->value)
+	{
+	  const char *c;
+
+	  for (c = insn->assembler; *c; c++)
+	    {
+	      if (*c == '%')
+		{
+		  switch (*++c)
+		    {
+		    case '%':
+		      func (stream, "%%");
 		      break;
 
+		    case 'c':
+		      if (thumb && ifthen_state)
+			func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		      break;
+
+		    case 'A':
+		      {
+			static const unsigned char enc[16] =
+			{
+			  0x4, 0x14, /* st4 0,1 */
+			  0x4, /* st1 2 */
+			  0x4, /* st2 3 */
+			  0x3, /* st3 4 */
+			  0x13, /* st3 5 */
+			  0x3, /* st1 6 */
+			  0x1, /* st1 7 */
+			  0x2, /* st2 8 */
+			  0x12, /* st2 9 */
+			  0x2, /* st1 10 */
+			  0, 0, 0, 0, 0
+			};
+			int rd = ((given >> 12) & 0xf) | (((given >> 22) & 1) << 4);
+			int rn = ((given >> 16) & 0xf);
+			int rm = ((given >> 0) & 0xf);
+			int align = ((given >> 4) & 0x3);
+			int type = ((given >> 8) & 0xf);
+			int n = enc[type] & 0xf;
+			int stride = (enc[type] >> 4) + 1;
+			int ix;
+
+			func (stream, "{");
+			if (stride > 1)
+			  for (ix = 0; ix != n; ix++)
+			    func (stream, "%sd%d", ix ? "," : "", rd + ix * stride);
+			else if (n == 1)
+			  func (stream, "d%d", rd);
+			else
+			  func (stream, "d%d-d%d", rd, rd + n - 1);
+			func (stream, "}, [%s", arm_regnames[rn]);
+			if (align)
+			  func (stream, ", :%d", 32 << align);
+			func (stream, "]");
+			if (rm == 0xd)
+			  func (stream, "!");
+			else if (rm != 0xf)
+			  func (stream, ", %s", arm_regnames[rm]);
+		      }
+		      break;
+
+		    case 'B':
+		      {
+			int rd = ((given >> 12) & 0xf) | (((given >> 22) & 1) << 4);
+			int rn = ((given >> 16) & 0xf);
+			int rm = ((given >> 0) & 0xf);
+			int idx_align = ((given >> 4) & 0xf);
+                        int align = 0;
+			int size = ((given >> 10) & 0x3);
+			int idx = idx_align >> (size + 1);
+                        int length = ((given >> 8) & 3) + 1;
+                        int stride = 1;
+                        int i;
+
+                        if (length > 1 && size > 0)
+                          stride = (idx_align & (1 << size)) ? 2 : 1;
+
+                        switch (length)
+                          {
+                          case 1:
+                            {
+                              int amask = (1 << size) - 1;
+                              if ((idx_align & (1 << size)) != 0)
+                                return FALSE;
+                              if (size > 0)
+                                {
+                                  if ((idx_align & amask) == amask)
+                                    align = 8 << size;
+                                  else if ((idx_align & amask) != 0)
+                                    return FALSE;
+                                }
+                              }
+                            break;
+
+                          case 2:
+                            if (size == 2 && (idx_align & 2) != 0)
+                              return FALSE;
+                            align = (idx_align & 1) ? 16 << size : 0;
+                            break;
+
+                          case 3:
+                            if ((size == 2 && (idx_align & 3) != 0)
+                                || (idx_align & 1) != 0)
+                              return FALSE;
+                            break;
+
+                          case 4:
+                            if (size == 2)
+                              {
+                                if ((idx_align & 3) == 3)
+                                  return FALSE;
+                                align = (idx_align & 3) * 64;
+                              }
+                            else
+                              align = (idx_align & 1) ? 32 << size : 0;
+                            break;
+
+                          default:
+                            abort ();
+                          }
+
+			func (stream, "{");
+                        for (i = 0; i < length; i++)
+                          func (stream, "%sd%d[%d]", (i == 0) ? "" : ",",
+                            rd + i * stride, idx);
+                        func (stream, "}, [%s", arm_regnames[rn]);
+			if (align)
+			  func (stream, ", :%d", align);
+			func (stream, "]");
+			if (rm == 0xd)
+			  func (stream, "!");
+			else if (rm != 0xf)
+			  func (stream, ", %s", arm_regnames[rm]);
+		      }
+		      break;
+
+		    case 'C':
+		      {
+			int rd = ((given >> 12) & 0xf) | (((given >> 22) & 1) << 4);
+			int rn = ((given >> 16) & 0xf);
+			int rm = ((given >> 0) & 0xf);
+			int align = ((given >> 4) & 0x1);
+			int size = ((given >> 6) & 0x3);
+			int type = ((given >> 8) & 0x3);
+			int n = type + 1;
+			int stride = ((given >> 5) & 0x1);
+			int ix;
+
+			if (stride && (n == 1))
+			  n++;
+			else
+			  stride++;
+
+			func (stream, "{");
+			if (stride > 1)
+			  for (ix = 0; ix != n; ix++)
+			    func (stream, "%sd%d[]", ix ? "," : "", rd + ix * stride);
+			else if (n == 1)
+			  func (stream, "d%d[]", rd);
+			else
+			  func (stream, "d%d[]-d%d[]", rd, rd + n - 1);
+			func (stream, "}, [%s", arm_regnames[rn]);
+			if (align)
+			  {
+                            int align = (8 * (type + 1)) << size;
+                            if (type == 3)
+                              align = (size > 1) ? align >> 1 : align;
+			    if (type == 2 || (type == 0 && !size))
+			      func (stream, ", :<bad align %d>", align);
+			    else
+			      func (stream, ", :%d", align);
+			  }
+			func (stream, "]");
+			if (rm == 0xd)
+			  func (stream, "!");
+			else if (rm != 0xf)
+			  func (stream, ", %s", arm_regnames[rm]);
+		      }
+		      break;
+
+		    case 'D':
+		      {
+			int raw_reg = (given & 0xf) | ((given >> 1) & 0x10);
+			int size = (given >> 20) & 3;
+			int reg = raw_reg & ((4 << size) - 1);
+			int ix = raw_reg >> size >> 2;
+
+			func (stream, "d%d[%d]", reg, ix);
+		      }
+		      break;
+
+		    case 'E':
+		      /* Neon encoded constant for mov, mvn, vorr, vbic */
+		      {
+			int bits = 0;
+			int cmode = (given >> 8) & 0xf;
+			int op = (given >> 5) & 0x1;
+			unsigned long value = 0, hival = 0;
+			unsigned shift;
+                        int size = 0;
+                        int isfloat = 0;
+
+			bits |= ((given >> 24) & 1) << 7;
+			bits |= ((given >> 16) & 7) << 4;
+			bits |= ((given >> 0) & 15) << 0;
+
+			if (cmode < 8)
+			  {
+			    shift = (cmode >> 1) & 3;
+			    value = (unsigned long)bits << (8 * shift);
+                            size = 32;
+			  }
+			else if (cmode < 12)
+			  {
+			    shift = (cmode >> 1) & 1;
+			    value = (unsigned long)bits << (8 * shift);
+                            size = 16;
+			  }
+			else if (cmode < 14)
+			  {
+			    shift = (cmode & 1) + 1;
+			    value = (unsigned long)bits << (8 * shift);
+			    value |= (1ul << (8 * shift)) - 1;
+                            size = 32;
+			  }
+			else if (cmode == 14)
+			  {
+			    if (op)
+			      {
+				/* bit replication into bytes */
+				int ix;
+				unsigned long mask;
+
+				value = 0;
+                                hival = 0;
+				for (ix = 7; ix >= 0; ix--)
+				  {
+				    mask = ((bits >> ix) & 1) ? 0xff : 0;
+                                    if (ix <= 3)
+				      value = (value << 8) | mask;
+                                    else
+                                      hival = (hival << 8) | mask;
+				  }
+                                size = 64;
+			      }
+                            else
+                              {
+                                /* byte replication */
+                                value = (unsigned long)bits;
+                                size = 8;
+                              }
+			  }
+			else if (!op)
+			  {
+			    /* floating point encoding */
+			    int tmp;
+
+			    value = (unsigned long)(bits & 0x7f) << 19;
+			    value |= (unsigned long)(bits & 0x80) << 24;
+			    tmp = bits & 0x40 ? 0x3c : 0x40;
+			    value |= (unsigned long)tmp << 24;
+                            size = 32;
+                            isfloat = 1;
+			  }
+			else
+			  {
+			    func (stream, "<illegal constant %.8x:%x:%x>",
+                                  bits, cmode, op);
+                            size = 32;
+			    break;
+			  }
+                        switch (size)
+                          {
+                          case 8:
+			    func (stream, "#%ld\t; 0x%.2lx", value, value);
+                            break;
+
+                          case 16:
+                            func (stream, "#%ld\t; 0x%.4lx", value, value);
+                            break;
+
+                          case 32:
+                            if (isfloat)
+                              {
+                                unsigned char valbytes[4];
+                                double fvalue;
+
+                                /* Do this a byte at a time so we don't have to
+                                   worry about the host's endianness.  */
+                                valbytes[0] = value & 0xff;
+                                valbytes[1] = (value >> 8) & 0xff;
+                                valbytes[2] = (value >> 16) & 0xff;
+                                valbytes[3] = (value >> 24) & 0xff;
+
+                                floatformat_to_double
+                                  (&floatformat_ieee_single_little, valbytes,
+                                  &fvalue);
+
+                                func (stream, "#%.7g\t; 0x%.8lx", fvalue,
+                                      value);
+                              }
+                            else
+                              func (stream, "#%ld\t; 0x%.8lx",
+				(long) ((value & 0x80000000)
+					? value | ~0xffffffffl : value), value);
+                            break;
+
+                          case 64:
+                            func (stream, "#0x%.8lx%.8lx", hival, value);
+                            break;
+
+                          default:
+                            abort ();
+                          }
+		      }
+		      break;
+
+		    case 'F':
+		      {
+			int regno = ((given >> 16) & 0xf) | ((given >> (7 - 4)) & 0x10);
+			int num = (given >> 8) & 0x3;
+
+			if (!num)
+			  func (stream, "{d%d}", regno);
+			else if (num + regno >= 32)
+			  func (stream, "{d%d-<overflow reg d%d}", regno, regno + num);
+			else
+			  func (stream, "{d%d-d%d}", regno, regno + num);
+		      }
+		      break;
+
+
+		    case '0': case '1': case '2': case '3': case '4':
+		    case '5': case '6': case '7': case '8': case '9':
+		      {
+			int width;
+			unsigned long value;
+
+			c = arm_decode_bitfield (c, given, &value, &width);
+
+			switch (*c)
+			  {
+			  case 'r':
+			    func (stream, "%s", arm_regnames[value]);
+			    break;
+			  case 'd':
+			    func (stream, "%ld", value);
+			    break;
+			  case 'e':
+			    func (stream, "%ld", (1ul << width) - value);
+			    break;
+
+			  case 'S':
+			  case 'T':
+			  case 'U':
+			    /* various width encodings */
+			    {
+			      int base = 8 << (*c - 'S'); /* 8,16 or 32 */
+			      int limit;
+			      unsigned low, high;
+
+			      c++;
+			      if (*c >= '0' && *c <= '9')
+				limit = *c - '0';
+			      else if (*c >= 'a' && *c <= 'f')
+				limit = *c - 'a' + 10;
+			      else
+				abort ();
+			      low = limit >> 2;
+			      high = limit & 3;
+
+			      if (value < low || value > high)
+				func (stream, "<illegal width %d>", base << value);
+			      else
+				func (stream, "%d", base << value);
+			    }
+			    break;
+			  case 'R':
+			    if (given & (1 << 6))
+			      goto Q;
+			    /* FALLTHROUGH */
+			  case 'D':
+			    func (stream, "d%ld", value);
+			    break;
+			  case 'Q':
+			  Q:
+			    if (value & 1)
+			      func (stream, "<illegal reg q%ld.5>", value >> 1);
+			    else
+			      func (stream, "q%ld", value >> 1);
+			    break;
+
+			  case '`':
+			    c++;
+			    if (value == 0)
+			      func (stream, "%c", *c);
+			    break;
+			  case '\'':
+			    c++;
+			    if (value == ((1ul << width) - 1))
+			      func (stream, "%c", *c);
+			    break;
+			  case '?':
+			    func (stream, "%c", c[(1 << width) - (int)value]);
+			    c += 1 << width;
+			    break;
+			  default:
+			    abort ();
+			  }
+			break;
+
+		      default:
+			abort ();
+		      }
+		    }
+		}
+	      else
+		func (stream, "%c", *c);
+	    }
+	  return TRUE;
+	}
+    }
+  return FALSE;
+}
+
+/* Print one ARM instruction from PC on INFO->STREAM.  */
+
+static void
+print_insn_arm_internal (bfd_vma pc, struct disassemble_info *info, long given)
+{
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
+
+  if (print_insn_coprocessor (pc, info, given, FALSE))
+    return;
+
+  if (print_insn_neon (info, given, FALSE))
+    return;
+
+  for (insn = arm_opcodes; insn->assembler; insn++)
+    {
+      if (insn->value == FIRST_IWMMXT_INSN
+	  && info->mach != bfd_mach_arm_XScale
+	  && info->mach != bfd_mach_arm_iWMMXt)
+	insn = insn + IWMMXT_INSN_COUNT;
+
+      if ((given & insn->mask) == insn->value
+	  /* Special case: an instruction with all bits set in the condition field
+	     (0xFnnn_nnnn) is only matched if all those bits are set in insn->mask,
+	     or by the catchall at the end of the table.  */
+	  && ((given & 0xF0000000) != 0xF0000000
+	      || (insn->mask & 0xF0000000) == 0xF0000000
+	      || (insn->mask == 0 && insn->value == 0)))
+	{
+	  const char *c;
+
+	  for (c = insn->assembler; *c; c++)
+	    {
+	      if (*c == '%')
+		{
+		  switch (*++c)
+		    {
+		    case '%':
+		      func (stream, "%%");
+		      break;
+
+		    case 'a':
+		      print_arm_address (pc, info, given);
+		      break;
+
+		    case 'P':
+		      /* Set P address bit and use normal address
+			 printing routine.  */
+		      print_arm_address (pc, info, given | (1 << 24));
+		      break;
+
 		    case 's':
                       if ((given & 0x004f0000) == 0x004f0000)
 			{
@@ -772,9 +2765,7 @@
 			    offset = -offset;
 
 			  func (stream, "[pc, #%d]\t; ", offset);
-
-			  (*info->print_address_func)
-			    (offset + pc + 8, info);
+			  info->print_address_func (offset + pc + 8, info);
 			}
 		      else
 			{
@@ -788,7 +2779,7 @@
                                   /* Immediate.  */
                                   int offset = ((given & 0xf00) >> 4) | (given & 0xf);
 				  if (offset)
-				    func (stream, ", %s#%d",
+				    func (stream, ", #%s%d",
 					  (((given & 0x00800000) == 0)
 					   ? "-" : ""), offset);
 				}
@@ -812,7 +2803,7 @@
                                   /* Immediate.  */
                                   int offset = ((given & 0xf00) >> 4) | (given & 0xf);
 				  if (offset)
-				    func (stream, "], %s#%d",
+				    func (stream, "], #%s%d",
 					  (((given & 0x00800000) == 0)
 					   ? "-" : ""), offset);
 				  else
@@ -831,13 +2822,16 @@
 		      break;
 
 		    case 'b':
-		      (*info->print_address_func)
-			(BDISP (given) * 4 + pc + 8, info);
+		      {
+			int disp = (((given & 0xffffff) ^ 0x800000) - 0x800000);
+			info->print_address_func (disp*4 + pc + 8, info);
+		      }
 		      break;
 
 		    case 'c':
-		      func (stream, "%s",
-			    arm_conditional [(given >> 28) & 0xf]);
+		      if (((given >> 28) & 0xf) != 0xe)
+			func (stream, "%s",
+			      arm_conditional [(given >> 28) & 0xf]);
 		      break;
 
 		    case 'm':
@@ -858,6 +2852,10 @@
 		      }
 		      break;
 
+		    case 'q':
+		      arm_decode_shift (given, func, stream, 0);
+		      break;
+
 		    case 'o':
 		      if ((given & 0x02000000) != 0)
 			{
@@ -868,7 +2866,7 @@
 			  func (stream, "#%d\t; 0x%x", immed, immed);
 			}
 		      else
-			arm_decode_shift (given, func, stream);
+			arm_decode_shift (given, func, stream, 1);
 		      break;
 
 		    case 'p':
@@ -883,11 +2881,13 @@
 
 		    case 'A':
 		      func (stream, "[%s", arm_regnames [(given >> 16) & 0xf]);
-		      if ((given & 0x01000000) != 0)
+
+		      if ((given & (1 << 24)) != 0)
 			{
 			  int offset = given & 0xff;
+
 			  if (offset)
-			    func (stream, ", %s#%d]%s",
+			    func (stream, ", #%s%d]%s",
 				  ((given & 0x00800000) == 0 ? "-" : ""),
 				  offset * 4,
 				  ((given & 0x00200000) != 0 ? "!" : ""));
@@ -897,12 +2897,18 @@
 		      else
 			{
 			  int offset = given & 0xff;
-			  if (offset)
-			    func (stream, "], %s#%d",
-				  ((given & 0x00800000) == 0 ? "-" : ""),
-				  offset * 4);
+
+			  func (stream, "]");
+
+			  if (given & (1 << 21))
+			    {
+			      if (offset)
+				func (stream, ", #%s%d",
+				      ((given & 0x00800000) == 0 ? "-" : ""),
+				      offset * 4);
+			    }
 			  else
-			    func (stream, "]");
+			    func (stream, ", {%d}", offset);
 			}
 		      break;
 
@@ -929,25 +2935,6 @@
 		      }
 		      break;
 
-		    case 'I':
-		      /* Print a Cirrus/DSP shift immediate.  */
-		      /* Immediates are 7bit signed ints with bits 0..3 in
-			 bits 0..3 of opcode and bits 4..6 in bits 5..7
-			 of opcode.  */
-		      {
-			int imm;
-
-			imm = (given & 0xf) | ((given & 0xe0) >> 1);
-
-			/* Is ``imm'' a negative number?  */
-			if (imm & 0x40)
-			  imm |= (-1 << 7);
-
-			func (stream, "%d", imm);
-		      }
-
-		      break;
-
 		    case 'C':
 		      func (stream, "_");
 		      if (given & 0x80000)
@@ -960,592 +2947,969 @@
 			func (stream, "c");
 		      break;
 
-		    case 'F':
-		      switch (given & 0x00408000)
+		    case 'U':
+		      switch (given & 0xf)
 			{
-			case 0:
-			  func (stream, "4");
-			  break;
-			case 0x8000:
-			  func (stream, "1");
-			  break;
-			case 0x00400000:
-			  func (stream, "2");
-			  break;
+			case 0xf: func(stream, "sy"); break;
+			case 0x7: func(stream, "un"); break;
+			case 0xe: func(stream, "st"); break;
+			case 0x6: func(stream, "unst"); break;
 			default:
-			  func (stream, "3");
-			}
-		      break;
-
-		    case 'P':
-		      switch (given & 0x00080080)
-			{
-			case 0:
-			  func (stream, "s");
+			  func(stream, "#%d", (int)given & 0xf);
 			  break;
-			case 0x80:
-			  func (stream, "d");
-			  break;
-			case 0x00080000:
-			  func (stream, "e");
-			  break;
-			default:
-			  func (stream, _("<illegal precision>"));
-			  break;
 			}
 		      break;
-		    case 'Q':
-		      switch (given & 0x00408000)
-			{
-			case 0:
-			  func (stream, "s");
-			  break;
-			case 0x8000:
-			  func (stream, "d");
-			  break;
-			case 0x00400000:
-			  func (stream, "e");
-			  break;
-			default:
-			  func (stream, "p");
-			  break;
-			}
-		      break;
-		    case 'R':
-		      switch (given & 0x60)
-			{
-			case 0:
-			  break;
-			case 0x20:
-			  func (stream, "p");
-			  break;
-			case 0x40:
-			  func (stream, "m");
-			  break;
-			default:
-			  func (stream, "z");
-			  break;
-			}
-		      break;
 
 		    case '0': case '1': case '2': case '3': case '4':
 		    case '5': case '6': case '7': case '8': case '9':
 		      {
-			int bitstart = *c++ - '0';
-			int bitend = 0;
-			while (*c >= '0' && *c <= '9')
-			  bitstart = (bitstart * 10) + *c++ - '0';
+			int width;
+			unsigned long value;
 
+			c = arm_decode_bitfield (c, given, &value, &width);
+
 			switch (*c)
 			  {
-			  case '-':
+			  case 'r':
+			    func (stream, "%s", arm_regnames[value]);
+			    break;
+			  case 'd':
+			    func (stream, "%ld", value);
+			    break;
+			  case 'b':
+			    func (stream, "%ld", value * 8);
+			    break;
+			  case 'W':
+			    func (stream, "%ld", value + 1);
+			    break;
+			  case 'x':
+			    func (stream, "0x%08lx", value);
+
+			    /* Some SWI instructions have special
+			       meanings.  */
+			    if ((given & 0x0fffffff) == 0x0FF00000)
+			      func (stream, "\t; IMB");
+			    else if ((given & 0x0fffffff) == 0x0FF00001)
+			      func (stream, "\t; IMBRange");
+			    break;
+			  case 'X':
+			    func (stream, "%01lx", value & 0xf);
+			    break;
+			  case '`':
 			    c++;
+			    if (value == 0)
+			      func (stream, "%c", *c);
+			    break;
+			  case '\'':
+			    c++;
+			    if (value == ((1ul << width) - 1))
+			      func (stream, "%c", *c);
+			    break;
+			  case '?':
+			    func (stream, "%c", c[(1 << width) - (int)value]);
+			    c += 1 << width;
+			    break;
+			  default:
+			    abort ();
+			  }
+			break;
 
-			    while (*c >= '0' && *c <= '9')
-			      bitend = (bitend * 10) + *c++ - '0';
+		      case 'e':
+			{
+			  int imm;
 
-			    if (!bitend)
-			      abort ();
+			  imm = (given & 0xf) | ((given & 0xfff00) >> 4);
+			  func (stream, "%d", imm);
+			}
+			break;
 
-			    switch (*c)
-			      {
-			      case 'r':
-				{
-				  long reg;
+		      case 'E':
+			/* LSB and WIDTH fields of BFI or BFC.  The machine-
+			   language instruction encodes LSB and MSB.  */
+			{
+			  long msb = (given & 0x001f0000) >> 16;
+			  long lsb = (given & 0x00000f80) >> 7;
 
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
+			  long width = msb - lsb + 1;
+			  if (width > 0)
+			    func (stream, "#%lu, #%lu", lsb, width);
+			  else
+			    func (stream, "(invalid: %lu:%lu)", lsb, msb);
+			}
+			break;
 
-				  func (stream, "%s", arm_regnames[reg]);
-				}
-				break;
-			      case 'd':
-				{
-				  long reg;
+		      case 'V':
+			/* 16-bit unsigned immediate from a MOVT or MOVW
+			   instruction, encoded in bits 0:11 and 15:19.  */
+			{
+			  long hi = (given & 0x000f0000) >> 4;
+			  long lo = (given & 0x00000fff);
+			  long imm16 = hi | lo;
+			  func (stream, "#%lu\t; 0x%lx", imm16, imm16);
+			}
+			break;
 
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
+		      default:
+			abort ();
+		      }
+		    }
+		}
+	      else
+		func (stream, "%c", *c);
+	    }
+	  return;
+	}
+    }
+  abort ();
+}
 
-				  func (stream, "%d", reg);
-				}
-				break;
-			      case 'x':
-				{
-				  long reg;
+/* Print one 16-bit Thumb instruction from PC on INFO->STREAM.  */
 
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
+static void
+print_insn_thumb16 (bfd_vma pc, struct disassemble_info *info, long given)
+{
+  const struct opcode16 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
 
-				  func (stream, "0x%08x", reg);
+  for (insn = thumb_opcodes; insn->assembler; insn++)
+    if ((given & insn->mask) == insn->value)
+      {
+	const char *c = insn->assembler;
+	for (; *c; c++)
+	  {
+	    int domaskpc = 0;
+	    int domasklr = 0;
 
-				  /* Some SWI instructions have special
-				     meanings.  */
-				  if ((given & 0x0fffffff) == 0x0FF00000)
-				    func (stream, "\t; IMB");
-				  else if ((given & 0x0fffffff) == 0x0FF00001)
-				    func (stream, "\t; IMBRange");
-				}
-				break;
-			      case 'X':
-				{
-				  long reg;
+	    if (*c != '%')
+	      {
+		func (stream, "%c", *c);
+		continue;
+	      }
 
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
+	    switch (*++c)
+	      {
+	      case '%':
+		func (stream, "%%");
+		break;
 
-				  func (stream, "%01x", reg & 0xf);
-				}
-				break;
-			      case 'f':
-				{
-				  long reg;
+	      case 'c':
+		if (ifthen_state)
+		  func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		break;
 
-				  reg = given >> bitstart;
-				  reg &= (2 << (bitend - bitstart)) - 1;
+	      case 'C':
+		if (ifthen_state)
+		  func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		else
+		  func (stream, "s");
+		break;
 
-				  if (reg > 7)
-				    func (stream, "#%s",
-					  arm_fp_const[reg & 7]);
-				  else
-				    func (stream, "f%d", reg);
-				}
-				break;
-			      default:
-				abort ();
-			      }
-			    break;
+	      case 'I':
+		{
+		  unsigned int tmp;
 
-			  case 'y':
-			  case 'z':
-			    {
-			      int single = *c == 'y';
-			      int regno;
+		  ifthen_next_state = given & 0xff;
+		  for (tmp = given << 1; tmp & 0xf; tmp <<= 1)
+		    func (stream, ((given ^ tmp) & 0x10) ? "e" : "t");
+		  func (stream, "\t%s", arm_conditional[(given >> 4) & 0xf]);
+		}
+		break;
 
-			      switch (bitstart)
-				{
-				case 4: /* Sm pair */
-				  func (stream, "{");
-				  /* Fall through.  */
-				case 0: /* Sm, Dm */
-				  regno = given & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 5) & 1;
-				    }
-				  break;
+	      case 'x':
+		if (ifthen_next_state)
+		  func (stream, "\t; unpredictable branch in IT block\n");
+		break;
 
-				case 1: /* Sd, Dd */
-				  regno = (given >> 12) & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 22) & 1;
-				    }
-				  break;
+	      case 'X':
+		if (ifthen_state)
+		  func (stream, "\t; unpredictable <IT:%s>",
+			arm_conditional[IFTHEN_COND]);
+		break;
 
-				case 2: /* Sn, Dn */
-				  regno = (given >> 16) & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 7) & 1;
-				    }
-				  break;
+	      case 'S':
+		{
+		  long reg;
 
-				case 3: /* List */
-				  func (stream, "{");
-				  regno = (given >> 12) & 0x0000000f;
-				  if (single)
-				    {
-				      regno <<= 1;
-				      regno += (given >> 22) & 1;
-				    }
-				  break;
+		  reg = (given >> 3) & 0x7;
+		  if (given & (1 << 6))
+		    reg += 8;
 
+		  func (stream, "%s", arm_regnames[reg]);
+		}
+		break;
 
-				default:
-				  abort ();
-				}
+	      case 'D':
+		{
+		  long reg;
 
-			      func (stream, "%c%d", single ? 's' : 'd', regno);
+		  reg = given & 0x7;
+		  if (given & (1 << 7))
+		    reg += 8;
 
-			      if (bitstart == 3)
-				{
-				  int count = given & 0xff;
+		  func (stream, "%s", arm_regnames[reg]);
+		}
+		break;
 
-				  if (single == 0)
-				    count >>= 1;
+	      case 'N':
+		if (given & (1 << 8))
+		  domasklr = 1;
+		/* Fall through.  */
+	      case 'O':
+		if (*c == 'O' && (given & (1 << 8)))
+		  domaskpc = 1;
+		/* Fall through.  */
+	      case 'M':
+		{
+		  int started = 0;
+		  int reg;
 
-				  if (--count)
-				    {
-				      func (stream, "-%c%d",
-					    single ? 's' : 'd',
-					    regno + count);
-				    }
+		  func (stream, "{");
 
-				  func (stream, "}");
-				}
-			      else if (bitstart == 4)
-				func (stream, ", %c%d}", single ? 's' : 'd',
-				      regno + 1);
+		  /* It would be nice if we could spot
+		     ranges, and generate the rS-rE format: */
+		  for (reg = 0; (reg < 8); reg++)
+		    if ((given & (1 << reg)) != 0)
+		      {
+			if (started)
+			  func (stream, ", ");
+			started = 1;
+			func (stream, "%s", arm_regnames[reg]);
+		      }
 
-			      break;
-			    }
+		  if (domasklr)
+		    {
+		      if (started)
+			func (stream, ", ");
+		      started = 1;
+		      func (stream, arm_regnames[14] /* "lr" */);
+		    }
 
-			  case '`':
-			    c++;
-			    if ((given & (1 << bitstart)) == 0)
-			      func (stream, "%c", *c);
+		  if (domaskpc)
+		    {
+		      if (started)
+			func (stream, ", ");
+		      func (stream, arm_regnames[15] /* "pc" */);
+		    }
+
+		  func (stream, "}");
+		}
+		break;
+
+	      case 'b':
+		/* Print ARM V6T2 CZB address: pc+4+6 bits.  */
+		{
+		  bfd_vma address = (pc + 4
+				     + ((given & 0x00f8) >> 2)
+				     + ((given & 0x0200) >> 3));
+		  info->print_address_func (address, info);
+		}
+		break;
+
+	      case 's':
+		/* Right shift immediate -- bits 6..10; 1-31 print
+		   as themselves, 0 prints as 32.  */
+		{
+		  long imm = (given & 0x07c0) >> 6;
+		  if (imm == 0)
+		    imm = 32;
+		  func (stream, "#%ld", imm);
+		}
+		break;
+
+	      case '0': case '1': case '2': case '3': case '4':
+	      case '5': case '6': case '7': case '8': case '9':
+		{
+		  int bitstart = *c++ - '0';
+		  int bitend = 0;
+
+		  while (*c >= '0' && *c <= '9')
+		    bitstart = (bitstart * 10) + *c++ - '0';
+
+		  switch (*c)
+		    {
+		    case '-':
+		      {
+			long reg;
+
+			c++;
+			while (*c >= '0' && *c <= '9')
+			  bitend = (bitend * 10) + *c++ - '0';
+			if (!bitend)
+			  abort ();
+			reg = given >> bitstart;
+			reg &= (2 << (bitend - bitstart)) - 1;
+			switch (*c)
+			  {
+			  case 'r':
+			    func (stream, "%s", arm_regnames[reg]);
 			    break;
-			  case '\'':
-			    c++;
-			    if ((given & (1 << bitstart)) != 0)
-			      func (stream, "%c", *c);
+
+			  case 'd':
+			    func (stream, "%ld", reg);
 			    break;
-			  case '?':
-			    ++c;
-			    if ((given & (1 << bitstart)) != 0)
-			      func (stream, "%c", *c++);
-			    else
-			      func (stream, "%c", *++c);
+
+			  case 'H':
+			    func (stream, "%ld", reg << 1);
 			    break;
+
+			  case 'W':
+			    func (stream, "%ld", reg << 2);
+			    break;
+
+			  case 'a':
+			    /* PC-relative address -- the bottom two
+			       bits of the address are dropped
+			       before the calculation.  */
+			    info->print_address_func
+			      (((pc + 4) & ~3) + (reg << 2), info);
+			    break;
+
+			  case 'x':
+			    func (stream, "0x%04lx", reg);
+			    break;
+
+			  case 'B':
+			    reg = ((reg ^ (1 << bitend)) - (1 << bitend));
+			    info->print_address_func (reg * 2 + pc + 4, info);
+			    break;
+
+			  case 'c':
+			    func (stream, "%s", arm_conditional [reg]);
+			    break;
+
 			  default:
 			    abort ();
 			  }
-			break;
+		      }
+		      break;
 
-		      default:
-			abort ();
-		      }
+		    case '\'':
+		      c++;
+		      if ((given & (1 << bitstart)) != 0)
+			func (stream, "%c", *c);
+		      break;
+
+		    case '?':
+		      ++c;
+		      if ((given & (1 << bitstart)) != 0)
+			func (stream, "%c", *c++);
+		      else
+			func (stream, "%c", *++c);
+		      break;
+
+		    default:
+		      abort ();
 		    }
 		}
-	      else
-		func (stream, "%c", *c);
-	    }
-	  return 4;
-	}
-    }
+		break;
+
+	      default:
+		abort ();
+	      }
+	  }
+	return;
+      }
+
+  /* No match.  */
   abort ();
 }
 
-/* Print one instruction from PC on INFO->STREAM.
-   Return the size of the instruction. */
+/* Return the name of an V7M special register.  */
+static const char *
+psr_name (int regno)
+{
+  switch (regno)
+    {
+    case 0: return "APSR";
+    case 1: return "IAPSR";
+    case 2: return "EAPSR";
+    case 3: return "PSR";
+    case 5: return "IPSR";
+    case 6: return "EPSR";
+    case 7: return "IEPSR";
+    case 8: return "MSP";
+    case 9: return "PSP";
+    case 16: return "PRIMASK";
+    case 17: return "BASEPRI";
+    case 18: return "BASEPRI_MASK";
+    case 19: return "FAULTMASK";
+    case 20: return "CONTROL";
+    default: return "<unknown>";
+    }
+}
 
-static int
-print_insn_thumb (pc, info, given)
-     bfd_vma                   pc;
-     struct disassemble_info * info;
-     long                      given;
+/* Print one 32-bit Thumb instruction from PC on INFO->STREAM.  */
+
+static void
+print_insn_thumb32 (bfd_vma pc, struct disassemble_info *info, long given)
 {
-  struct thumb_opcode * insn;
-  void *                stream = info->stream;
-  fprintf_ftype         func = info->fprintf_func;
+  const struct opcode32 *insn;
+  void *stream = info->stream;
+  fprintf_ftype func = info->fprintf_func;
 
-  for (insn = thumb_opcodes; insn->assembler; insn++)
-    {
-      if ((given & insn->mask) == insn->value)
-        {
-          char * c = insn->assembler;
+  if (print_insn_coprocessor (pc, info, given, TRUE))
+    return;
 
-          /* Special processing for Thumb 2 instruction BL sequence:  */
-          if (!*c) /* Check for empty (not NULL) assembler string.  */
-            {
-	      long offset;
+  if (print_insn_neon (info, given, TRUE))
+    return;
 
-	      info->bytes_per_chunk = 4;
-	      info->bytes_per_line  = 4;
+  for (insn = thumb32_opcodes; insn->assembler; insn++)
+    if ((given & insn->mask) == insn->value)
+      {
+	const char *c = insn->assembler;
+	for (; *c; c++)
+	  {
+	    if (*c != '%')
+	      {
+		func (stream, "%c", *c);
+		continue;
+	      }
 
-	      offset = BDISP23 (given);
-	      offset = offset * 2 + pc + 4;
+	    switch (*++c)
+	      {
+	      case '%':
+		func (stream, "%%");
+		break;
 
-	      if ((given & 0x10000000) == 0)
+	      case 'c':
+		if (ifthen_state)
+		  func (stream, "%s", arm_conditional[IFTHEN_COND]);
+		break;
+
+	      case 'x':
+		if (ifthen_next_state)
+		  func (stream, "\t; unpredictable branch in IT block\n");
+		break;
+
+	      case 'X':
+		if (ifthen_state)
+		  func (stream, "\t; unpredictable <IT:%s>",
+			arm_conditional[IFTHEN_COND]);
+		break;
+
+	      case 'I':
 		{
-		  func (stream, "blx\t");
-		  offset &= 0xfffffffc;
+		  unsigned int imm12 = 0;
+		  imm12 |= (given & 0x000000ffu);
+		  imm12 |= (given & 0x00007000u) >> 4;
+		  imm12 |= (given & 0x04000000u) >> 15;
+		  func (stream, "#%u\t; 0x%x", imm12, imm12);
 		}
-	      else
-		func (stream, "bl\t");
+		break;
 
-	      info->print_address_func (offset, info);
-              return 4;
-            }
-          else
-            {
-	      info->bytes_per_chunk = 2;
-	      info->bytes_per_line  = 4;
+	      case 'M':
+		{
+		  unsigned int bits = 0, imm, imm8, mod;
+		  bits |= (given & 0x000000ffu);
+		  bits |= (given & 0x00007000u) >> 4;
+		  bits |= (given & 0x04000000u) >> 15;
+		  imm8 = (bits & 0x0ff);
+		  mod = (bits & 0xf00) >> 8;
+		  switch (mod)
+		    {
+		    case 0: imm = imm8; break;
+		    case 1: imm = ((imm8<<16) | imm8); break;
+		    case 2: imm = ((imm8<<24) | (imm8 << 8)); break;
+		    case 3: imm = ((imm8<<24) | (imm8 << 16) | (imm8 << 8) | imm8); break;
+		    default:
+		      mod  = (bits & 0xf80) >> 7;
+		      imm8 = (bits & 0x07f) | 0x80;
+		      imm  = (((imm8 << (32 - mod)) | (imm8 >> mod)) & 0xffffffff);
+		    }
+		  func (stream, "#%u\t; 0x%x", imm, imm);
+		}
+		break;
 
-              given &= 0xffff;
+	      case 'J':
+		{
+		  unsigned int imm = 0;
+		  imm |= (given & 0x000000ffu);
+		  imm |= (given & 0x00007000u) >> 4;
+		  imm |= (given & 0x04000000u) >> 15;
+		  imm |= (given & 0x000f0000u) >> 4;
+		  func (stream, "#%u\t; 0x%x", imm, imm);
+		}
+		break;
 
-              for (; *c; c++)
-                {
-                  if (*c == '%')
-                    {
-                      int domaskpc = 0;
-                      int domasklr = 0;
+	      case 'K':
+		{
+		  unsigned int imm = 0;
+		  imm |= (given & 0x000f0000u) >> 16;
+		  imm |= (given & 0x00000ff0u) >> 0;
+		  imm |= (given & 0x0000000fu) << 12;
+		  func (stream, "#%u\t; 0x%x", imm, imm);
+		}
+		break;
 
-                      switch (*++c)
-                        {
-                        case '%':
-                          func (stream, "%%");
-                          break;
+	      case 'S':
+		{
+		  unsigned int reg = (given & 0x0000000fu);
+		  unsigned int stp = (given & 0x00000030u) >> 4;
+		  unsigned int imm = 0;
+		  imm |= (given & 0x000000c0u) >> 6;
+		  imm |= (given & 0x00007000u) >> 10;
 
-                        case 'S':
-                          {
-                            long reg;
+		  func (stream, "%s", arm_regnames[reg]);
+		  switch (stp)
+		    {
+		    case 0:
+		      if (imm > 0)
+			func (stream, ", lsl #%u", imm);
+		      break;
 
-                            reg = (given >> 3) & 0x7;
-                            if (given & (1 << 6))
-                              reg += 8;
+		    case 1:
+		      if (imm == 0)
+			imm = 32;
+		      func (stream, ", lsr #%u", imm);
+		      break;
 
-                            func (stream, "%s", arm_regnames[reg]);
-                          }
-                          break;
+		    case 2:
+		      if (imm == 0)
+			imm = 32;
+		      func (stream, ", asr #%u", imm);
+		      break;
 
-                        case 'D':
-                          {
-                            long reg;
+		    case 3:
+		      if (imm == 0)
+			func (stream, ", rrx");
+		      else
+			func (stream, ", ror #%u", imm);
+		    }
+		}
+		break;
 
-                            reg = given & 0x7;
-                            if (given & (1 << 7))
-                             reg += 8;
+	      case 'a':
+		{
+		  unsigned int Rn  = (given & 0x000f0000) >> 16;
+		  unsigned int U   = (given & 0x00800000) >> 23;
+		  unsigned int op  = (given & 0x00000f00) >> 8;
+		  unsigned int i12 = (given & 0x00000fff);
+		  unsigned int i8  = (given & 0x000000ff);
+		  bfd_boolean writeback = FALSE, postind = FALSE;
+		  int offset = 0;
 
-                            func (stream, "%s", arm_regnames[reg]);
-                          }
-                          break;
+		  func (stream, "[%s", arm_regnames[Rn]);
+		  if (U) /* 12-bit positive immediate offset */
+		    offset = i12;
+		  else if (Rn == 15) /* 12-bit negative immediate offset */
+		    offset = -(int)i12;
+		  else if (op == 0x0) /* shifted register offset */
+		    {
+		      unsigned int Rm = (i8 & 0x0f);
+		      unsigned int sh = (i8 & 0x30) >> 4;
+		      func (stream, ", %s", arm_regnames[Rm]);
+		      if (sh)
+			func (stream, ", lsl #%u", sh);
+		      func (stream, "]");
+		      break;
+		    }
+		  else switch (op)
+		    {
+		    case 0xE:  /* 8-bit positive immediate offset */
+		      offset = i8;
+		      break;
 
-                        case 'T':
-                          func (stream, "%s",
-                                arm_conditional [(given >> 8) & 0xf]);
-                          break;
+		    case 0xC:  /* 8-bit negative immediate offset */
+		      offset = -i8;
+		      break;
 
-                        case 'N':
-                          if (given & (1 << 8))
-                            domasklr = 1;
-                          /* Fall through.  */
-                        case 'O':
-                          if (*c == 'O' && (given & (1 << 8)))
-                            domaskpc = 1;
-                          /* Fall through.  */
-                        case 'M':
-                          {
-                            int started = 0;
-                            int reg;
+		    case 0xF:  /* 8-bit + preindex with wb */
+		      offset = i8;
+		      writeback = TRUE;
+		      break;
 
-                            func (stream, "{");
+		    case 0xD:  /* 8-bit - preindex with wb */
+		      offset = -i8;
+		      writeback = TRUE;
+		      break;
 
-                            /* It would be nice if we could spot
-                               ranges, and generate the rS-rE format: */
-                            for (reg = 0; (reg < 8); reg++)
-                              if ((given & (1 << reg)) != 0)
-                                {
-                                  if (started)
-                                    func (stream, ", ");
-                                  started = 1;
-                                  func (stream, "%s", arm_regnames[reg]);
-                                }
+		    case 0xB:  /* 8-bit + postindex */
+		      offset = i8;
+		      postind = TRUE;
+		      break;
 
-                            if (domasklr)
-                              {
-                                if (started)
-                                  func (stream, ", ");
-                                started = 1;
-                                func (stream, arm_regnames[14] /* "lr" */);
-                              }
+		    case 0x9:  /* 8-bit - postindex */
+		      offset = -i8;
+		      postind = TRUE;
+		      break;
 
-                            if (domaskpc)
-                              {
-                                if (started)
-                                  func (stream, ", ");
-                                func (stream, arm_regnames[15] /* "pc" */);
-                              }
+		    default:
+		      func (stream, ", <undefined>]");
+		      goto skip;
+		    }
 
-                            func (stream, "}");
-                          }
-                          break;
+		  if (postind)
+		    func (stream, "], #%d", offset);
+		  else
+		    {
+		      if (offset)
+			func (stream, ", #%d", offset);
+		      func (stream, writeback ? "]!" : "]");
+		    }
 
+		  if (Rn == 15)
+		    {
+		      func (stream, "\t; ");
+		      info->print_address_func (((pc + 4) & ~3) + offset, info);
+		    }
+		}
+	      skip:
+		break;
 
-                        case '0': case '1': case '2': case '3': case '4':
-                        case '5': case '6': case '7': case '8': case '9':
-                          {
-                            int bitstart = *c++ - '0';
-                            int bitend = 0;
+	      case 'A':
+		{
+		  unsigned int P   = (given & 0x01000000) >> 24;
+		  unsigned int U   = (given & 0x00800000) >> 23;
+		  unsigned int W   = (given & 0x00400000) >> 21;
+		  unsigned int Rn  = (given & 0x000f0000) >> 16;
+		  unsigned int off = (given & 0x000000ff);
 
-                            while (*c >= '0' && *c <= '9')
-                              bitstart = (bitstart * 10) + *c++ - '0';
+		  func (stream, "[%s", arm_regnames[Rn]);
+		  if (P)
+		    {
+		      if (off || !U)
+			func (stream, ", #%c%u", U ? '+' : '-', off * 4);
+		      func (stream, "]");
+		      if (W)
+			func (stream, "!");
+		    }
+		  else
+		    {
+		      func (stream, "], ");
+		      if (W)
+			func (stream, "#%c%u", U ? '+' : '-', off * 4);
+		      else
+			func (stream, "{%u}", off);
+		    }
+		}
+		break;
 
-                            switch (*c)
-                              {
-                              case '-':
-                                {
-                                  long reg;
+	      case 'w':
+		{
+		  unsigned int Sbit = (given & 0x01000000) >> 24;
+		  unsigned int type = (given & 0x00600000) >> 21;
+		  switch (type)
+		    {
+		    case 0: func (stream, Sbit ? "sb" : "b"); break;
+		    case 1: func (stream, Sbit ? "sh" : "h"); break;
+		    case 2:
+		      if (Sbit)
+			func (stream, "??");
+		      break;
+		    case 3:
+		      func (stream, "??");
+		      break;
+		    }
+		}
+		break;
 
-                                  c++;
-                                  while (*c >= '0' && *c <= '9')
-                                    bitend = (bitend * 10) + *c++ - '0';
-                                  if (!bitend)
-                                    abort ();
-                                  reg = given >> bitstart;
-                                  reg &= (2 << (bitend - bitstart)) - 1;
-                                  switch (*c)
-                                    {
-                                    case 'r':
-                                      func (stream, "%s", arm_regnames[reg]);
-                                      break;
+	      case 'm':
+		{
+		  int started = 0;
+		  int reg;
 
-                                    case 'd':
-                                      func (stream, "%d", reg);
-                                      break;
+		  func (stream, "{");
+		  for (reg = 0; reg < 16; reg++)
+		    if ((given & (1 << reg)) != 0)
+		      {
+			if (started)
+			  func (stream, ", ");
+			started = 1;
+			func (stream, "%s", arm_regnames[reg]);
+		      }
+		  func (stream, "}");
+		}
+		break;
 
-                                    case 'H':
-                                      func (stream, "%d", reg << 1);
-                                      break;
+	      case 'E':
+		{
+		  unsigned int msb = (given & 0x0000001f);
+		  unsigned int lsb = 0;
+		  lsb |= (given & 0x000000c0u) >> 6;
+		  lsb |= (given & 0x00007000u) >> 10;
+		  func (stream, "#%u, #%u", lsb, msb - lsb + 1);
+		}
+		break;
 
-                                    case 'W':
-                                      func (stream, "%d", reg << 2);
-                                      break;
+	      case 'F':
+		{
+		  unsigned int width = (given & 0x0000001f) + 1;
+		  unsigned int lsb = 0;
+		  lsb |= (given & 0x000000c0u) >> 6;
+		  lsb |= (given & 0x00007000u) >> 10;
+		  func (stream, "#%u, #%u", lsb, width);
+		}
+		break;
 
-                                    case 'a':
-				      /* PC-relative address -- the bottom two
-					 bits of the address are dropped
-					 before the calculation.  */
-                                      info->print_address_func
-					(((pc + 4) & ~3) + (reg << 2), info);
-                                      break;
+	      case 'b':
+		{
+		  unsigned int S = (given & 0x04000000u) >> 26;
+		  unsigned int J1 = (given & 0x00002000u) >> 13;
+		  unsigned int J2 = (given & 0x00000800u) >> 11;
+		  int offset = 0;
 
-                                    case 'x':
-                                      func (stream, "0x%04x", reg);
-                                      break;
+		  offset |= !S << 20;
+		  offset |= J2 << 19;
+		  offset |= J1 << 18;
+		  offset |= (given & 0x003f0000) >> 4;
+		  offset |= (given & 0x000007ff) << 1;
+		  offset -= (1 << 20);
 
-                                    case 'I':
-                                      reg = ((reg ^ (1 << bitend)) - (1 << bitend));
-                                      func (stream, "%d", reg);
-                                      break;
+		  info->print_address_func (pc + 4 + offset, info);
+		}
+		break;
 
-                                    case 'B':
-                                      reg = ((reg ^ (1 << bitend)) - (1 << bitend));
-                                      (*info->print_address_func)
-                                        (reg * 2 + pc + 4, info);
-                                      break;
+	      case 'B':
+		{
+		  unsigned int S = (given & 0x04000000u) >> 26;
+		  unsigned int I1 = (given & 0x00002000u) >> 13;
+		  unsigned int I2 = (given & 0x00000800u) >> 11;
+		  int offset = 0;
 
-                                    default:
-                                      abort ();
-                                    }
-                                }
-                                break;
+		  offset |= !S << 24;
+		  offset |= !(I1 ^ S) << 23;
+		  offset |= !(I2 ^ S) << 22;
+		  offset |= (given & 0x03ff0000u) >> 4;
+		  offset |= (given & 0x000007ffu) << 1;
+		  offset -= (1 << 24);
+		  offset += pc + 4;
 
-                              case '\'':
-                                c++;
-                                if ((given & (1 << bitstart)) != 0)
-                                  func (stream, "%c", *c);
-                                break;
+		  /* BLX target addresses are always word aligned.  */
+		  if ((given & 0x00001000u) == 0)
+		      offset &= ~2u;
 
-                              case '?':
-                                ++c;
-                                if ((given & (1 << bitstart)) != 0)
-                                  func (stream, "%c", *c++);
-                                else
-                                  func (stream, "%c", *++c);
-                                break;
+		  info->print_address_func (offset, info);
+		}
+		break;
 
-                              default:
-                                 abort ();
-                              }
-                          }
-                          break;
+	      case 's':
+		{
+		  unsigned int shift = 0;
+		  shift |= (given & 0x000000c0u) >> 6;
+		  shift |= (given & 0x00007000u) >> 10;
+		  if (given & 0x00200000u)
+		    func (stream, ", asr #%u", shift);
+		  else if (shift)
+		    func (stream, ", lsl #%u", shift);
+		  /* else print nothing - lsl #0 */
+		}
+		break;
 
-                        default:
-                          abort ();
-                        }
-                    }
-                  else
-                    func (stream, "%c", *c);
-                }
-             }
-          return 2;
-       }
-    }
+	      case 'R':
+		{
+		  unsigned int rot = (given & 0x00000030) >> 4;
+		  if (rot)
+		    func (stream, ", ror #%u", rot * 8);
+		}
+		break;
 
-  /* No match.  */
-  abort ();
-}
+	      case 'U':
+		switch (given & 0xf)
+		  {
+		  case 0xf: func(stream, "sy"); break;
+		  case 0x7: func(stream, "un"); break;
+		  case 0xe: func(stream, "st"); break;
+		  case 0x6: func(stream, "unst"); break;
+		  default:
+		    func(stream, "#%d", (int)given & 0xf);
+		    break;
+		  }
+		break;
 
-/* Parse an individual disassembler option.  */
+	      case 'C':
+		if ((given & 0xff) == 0)
+		  {
+		    func (stream, "%cPSR_", (given & 0x100000) ? 'S' : 'C');
+		    if (given & 0x800)
+		      func (stream, "f");
+		    if (given & 0x400)
+		      func (stream, "s");
+		    if (given & 0x200)
+		      func (stream, "x");
+		    if (given & 0x100)
+		      func (stream, "c");
+		  }
+		else
+		  {
+		    func (stream, psr_name (given & 0xff));
+		  }
+		break;
 
-void
-parse_arm_disassembler_option (option)
-     char * option;
-{
-  if (option == NULL)
-    return;
+	      case 'D':
+		if ((given & 0xff) == 0)
+		  func (stream, "%cPSR", (given & 0x100000) ? 'S' : 'C');
+		else
+		  func (stream, psr_name (given & 0xff));
+		break;
 
-  if (strneq (option, "reg-names-", 10))
-    {
-      int i;
+	      case '0': case '1': case '2': case '3': case '4':
+	      case '5': case '6': case '7': case '8': case '9':
+		{
+		  int width;
+		  unsigned long val;
 
-      option += 10;
+		  c = arm_decode_bitfield (c, given, &val, &width);
 
-      for (i = NUM_ARM_REGNAMES; i--;)
-	if (streq (option, regnames[i].name))
-	  {
-	    regname_selected = i;
-	    break;
+		  switch (*c)
+		    {
+		    case 'd': func (stream, "%lu", val); break;
+		    case 'W': func (stream, "%lu", val * 4); break;
+		    case 'r': func (stream, "%s", arm_regnames[val]); break;
+
+		    case 'c':
+		      func (stream, "%s", arm_conditional[val]);
+		      break;
+
+		    case '\'':
+		      c++;
+		      if (val == ((1ul << width) - 1))
+			func (stream, "%c", *c);
+		      break;
+
+		    case '`':
+		      c++;
+		      if (val == 0)
+			func (stream, "%c", *c);
+		      break;
+
+		    case '?':
+		      func (stream, "%c", c[(1 << width) - (int)val]);
+		      c += 1 << width;
+		      break;
+
+		    default:
+		      abort ();
+		    }
+		}
+		break;
+
+	      default:
+		abort ();
+	      }
 	  }
+	return;
+      }
 
-      if (i < 0)
-	fprintf (stderr, _("Unrecognised register name set: %s\n"), option);
-    }
-  else if (streq (option, "force-thumb"))
-    force_thumb = 1;
-  else if (streq (option, "no-force-thumb"))
-    force_thumb = 0;
-  else
-    fprintf (stderr, _("Unrecognised disassembler option: %s\n"), option);
-
-  return;
+  /* No match.  */
+  abort ();
 }
 
-/* Parse the string of disassembler options, spliting it at whitespaces.  */
+/* Print data bytes on INFO->STREAM.  */
 
 static void
-parse_disassembler_options (options)
-     char * options;
+print_insn_data (bfd_vma pc ATTRIBUTE_UNUSED, struct disassemble_info *info,
+		 long given)
 {
-  char * space;
+  switch (info->bytes_per_chunk)
+    {
+    case 1:
+      info->fprintf_func (info->stream, ".byte\t0x%02lx", given);
+      break;
+    case 2:
+      info->fprintf_func (info->stream, ".short\t0x%04lx", given);
+      break;
+    case 4:
+      info->fprintf_func (info->stream, ".word\t0x%08lx", given);
+      break;
+    default:
+      abort ();
+    }
+}
 
-  if (options == NULL)
-    return;
+/* Search back through the insn stream to determine if this instruction is
+   conditionally executed.  */
+static void
+find_ifthen_state (bfd_vma pc, struct disassemble_info *info,
+		   bfd_boolean little)
+{
+  unsigned char b[2];
+  unsigned int insn;
+  int status;
+  /* COUNT is twice the number of instructions seen.  It will be odd if we
+     just crossed an instruction boundary.  */
+  int count;
+  int it_count;
+  unsigned int seen_it;
+  bfd_vma addr;
 
-  do
+  ifthen_address = pc;
+  ifthen_state = 0;
+
+  addr = pc;
+  count = 1;
+  it_count = 0;
+  seen_it = 0;
+  /* Scan backwards looking for IT instructions, keeping track of where
+     instruction boundaries are.  We don't know if something is actually an
+     IT instruction until we find a definite instruction boundary.  */
+  for (;;)
     {
-      space = strchr (options, ' ');
+      if (addr == 0 || info->symbol_at_address_func(addr, info))
+	{
+	  /* A symbol must be on an instruction boundary, and will not
+	     be within an IT block.  */
+	  if (seen_it && (count & 1))
+	    break;
 
-      if (space)
+	  return;
+	}
+      addr -= 2;
+      status = info->read_memory_func (addr, (bfd_byte *)b, 2, info);
+      if (status)
+	return;
+
+      if (little)
+	insn = (b[0]) | (b[1] << 8);
+      else
+	insn = (b[1]) | (b[0] << 8);
+      if (seen_it)
 	{
-	  * space = '\0';
-	  parse_arm_disassembler_option (options);
-	  * space = ' ';
-	  options = space + 1;
+	  if ((insn & 0xf800) < 0xe800)
+	    {
+	      /* Addr + 2 is an instruction boundary.  See if this matches
+	         the expected boundary based on the position of the last
+		 IT candidate.  */
+	      if (count & 1)
+		break;
+	      seen_it = 0;
+	    }
 	}
+      if ((insn & 0xff00) == 0xbf00 && (insn & 0xf) != 0)
+	{
+	  /* This could be an IT instruction.  */
+	  seen_it = insn;
+	  it_count = count >> 1;
+	}
+      if ((insn & 0xf800) >= 0xe800)
+	count++;
       else
-	parse_arm_disassembler_option (options);
+	count = (count + 2) | 1;
+      /* IT blocks contain at most 4 instructions.  */
+      if (count >= 8 && !seen_it)
+	return;
     }
-  while (space);
+  /* We found an IT instruction.  */
+  ifthen_state = (seen_it & 0xe0) | ((seen_it << it_count) & 0x1f);
+  if ((ifthen_state & 0xf) == 0)
+    ifthen_state = 0;
 }
 
 /* NOTE: There are no checks in these routines that
    the relevant number of data bytes exist.  */
 
 int
-print_insn_arm (pc, info)
-     bfd_vma pc;
-     struct disassemble_info * info;
+print_insn_arm (bfd_vma pc, struct disassemble_info *info)
 {
-  unsigned char      b[4];
-  long               given;
-  int                status;
-  int                is_thumb;
-  int little;
+  unsigned char b[4];
+  long		given;
+  int           status;
+  int           is_thumb = FALSE;
+  int           is_data = FALSE;
+  unsigned int	size = 4;
+  void	 	(*printer) (bfd_vma, struct disassemble_info *, long);
+#if 0
+  bfd_boolean   found = FALSE;
 
   if (info->disassembler_options)
     {
@@ -1555,15 +3919,91 @@
       info->disassembler_options = NULL;
     }
 
-  is_thumb = force_thumb;
-  if (pc & 1)
+  /* First check the full symtab for a mapping symbol, even if there
+     are no usable non-mapping symbols for this address.  */
+  if (info->symtab != NULL
+      && bfd_asymbol_flavour (*info->symtab) == bfd_target_elf_flavour)
     {
-      is_thumb = 1;
-      pc &= ~(bfd_vma) 1;
+      bfd_vma addr;
+      int n;
+      int last_sym = -1;
+      enum map_type type = MAP_ARM;
+
+      if (pc <= last_mapping_addr)
+	last_mapping_sym = -1;
+      is_thumb = (last_type == MAP_THUMB);
+      found = FALSE;
+      /* Start scanning at the start of the function, or wherever
+	 we finished last time.  */
+      n = info->symtab_pos + 1;
+      if (n < last_mapping_sym)
+	n = last_mapping_sym;
+
+      /* Scan up to the location being disassembled.  */
+      for (; n < info->symtab_size; n++)
+	{
+	  addr = bfd_asymbol_value (info->symtab[n]);
+	  if (addr > pc)
+	    break;
+	  if ((info->section == NULL
+	       || info->section == info->symtab[n]->section)
+	      && get_sym_code_type (info, n, &type))
+	    {
+	      last_sym = n;
+	      found = TRUE;
+	    }
+	}
+
+      if (!found)
+	{
+	  n = info->symtab_pos;
+	  if (n < last_mapping_sym - 1)
+	    n = last_mapping_sym - 1;
+
+	  /* No mapping symbol found at this address.  Look backwards
+	     for a preceeding one.  */
+	  for (; n >= 0; n--)
+	    {
+	      if (get_sym_code_type (info, n, &type))
+		{
+		  last_sym = n;
+		  found = TRUE;
+		  break;
+		}
+	    }
+	}
+
+      last_mapping_sym = last_sym;
+      last_type = type;
+      is_thumb = (last_type == MAP_THUMB);
+      is_data = (last_type == MAP_DATA);
+
+      /* Look a little bit ahead to see if we should print out
+	 two or four bytes of data.  If there's a symbol,
+	 mapping or otherwise, after two bytes then don't
+	 print more.  */
+      if (is_data)
+	{
+	  size = 4 - (pc & 3);
+	  for (n = last_sym + 1; n < info->symtab_size; n++)
+	    {
+	      addr = bfd_asymbol_value (info->symtab[n]);
+	      if (addr > pc)
+		{
+		  if (addr - pc < size)
+		    size = addr - pc;
+		  break;
+		}
+	    }
+	  /* If the next symbol is after three bytes, we need to
+	     print only part of the data, so that we can use either
+	     .byte or .short.  */
+	  if (size == 3)
+	    size = (pc & 1) ? 1 : 2;
+	}
     }
 
-#if 0
-  if (!is_thumb && info->symbols != NULL)
+  if (info->symbols != NULL)
     {
       if (bfd_asymbol_flavour (*info->symbols) == bfd_target_coff_flavour)
 	{
@@ -1576,8 +4016,11 @@
 		      || cs->native->u.syment.n_sclass == C_THUMBEXTFUNC
 		      || cs->native->u.syment.n_sclass == C_THUMBSTATFUNC);
 	}
-      else if (bfd_asymbol_flavour (*info->symbols) == bfd_target_elf_flavour)
+      else if (bfd_asymbol_flavour (*info->symbols) == bfd_target_elf_flavour
+	       && !found)
 	{
+	  /* If no mapping symbol has been found then fall back to the type
+	     of the function symbol.  */
 	  elf_symbol_type *  es;
 	  unsigned int       type;
 
@@ -1587,64 +4030,103 @@
 	  is_thumb = (type == STT_ARM_TFUNC) || (type == STT_ARM_16BIT);
 	}
     }
-#endif
+#else
+  int little;
 
   little = (info->endian == BFD_ENDIAN_LITTLE);
-  info->bytes_per_chunk = 4;
-  info->display_endian  = little ? BFD_ENDIAN_LITTLE : BFD_ENDIAN_BIG;
+  is_thumb |= (pc & 1);
+  pc &= ~(bfd_vma)1;
+#endif
 
-  if (little)
+  if (force_thumb)
+    is_thumb = TRUE;
+
+  info->bytes_per_line = 4;
+
+  if (is_data)
     {
-      status = info->read_memory_func (pc, (bfd_byte *) &b[0], 4, info);
-      if (status != 0 && is_thumb)
-	{
-	  info->bytes_per_chunk = 2;
+      int i;
 
-	  status = info->read_memory_func (pc, (bfd_byte *) b, 2, info);
-	  b[3] = b[2] = 0;
-	}
+      /* size was already set above.  */
+      info->bytes_per_chunk = size;
+      printer = print_insn_data;
 
-      if (status != 0)
-	{
-	  info->memory_error_func (status, pc, info);
-	  return -1;
-	}
+      status = info->read_memory_func (pc, (bfd_byte *)b, size, info);
+      given = 0;
+      if (little)
+	for (i = size - 1; i >= 0; i--)
+	  given = b[i] | (given << 8);
+      else
+	for (i = 0; i < (int) size; i++)
+	  given = b[i] | (given << 8);
+    }
+  else if (!is_thumb)
+    {
+      /* In ARM mode endianness is a straightforward issue: the instruction
+	 is four bytes long and is either ordered 0123 or 3210.  */
+      printer = print_insn_arm_internal;
+      info->bytes_per_chunk = 4;
+      size = 4;
 
-      given = (b[0]) | (b[1] << 8) | (b[2] << 16) | (b[3] << 24);
+      status = info->read_memory_func (pc, (bfd_byte *)b, 4, info);
+      if (little)
+	given = (b[0]) | (b[1] << 8) | (b[2] << 16) | (b[3] << 24);
+      else
+	given = (b[3]) | (b[2] << 8) | (b[1] << 16) | (b[0] << 24);
     }
   else
     {
-      status = info->read_memory_func
-	(pc & ~ 0x3, (bfd_byte *) &b[0], 4, info);
-      if (status != 0)
-	{
-	  info->memory_error_func (status, pc, info);
-	  return -1;
-	}
+      /* In Thumb mode we have the additional wrinkle of two
+	 instruction lengths.  Fortunately, the bits that determine
+	 the length of the current instruction are always to be found
+	 in the first two bytes.  */
+      printer = print_insn_thumb16;
+      info->bytes_per_chunk = 2;
+      size = 2;
 
-      if (is_thumb)
+      status = info->read_memory_func (pc, (bfd_byte *)b, 2, info);
+      if (little)
+	given = (b[0]) | (b[1] << 8);
+      else
+	given = (b[1]) | (b[0] << 8);
+
+      if (!status)
 	{
-	  if (pc & 0x2)
+	  /* These bit patterns signal a four-byte Thumb
+	     instruction.  */
+	  if ((given & 0xF800) == 0xF800
+	      || (given & 0xF800) == 0xF000
+	      || (given & 0xF800) == 0xE800)
 	    {
-	      given = (b[2] << 8) | b[3];
+	      status = info->read_memory_func (pc + 2, (bfd_byte *)b, 2, info);
+	      if (little)
+		given = (b[0]) | (b[1] << 8) | (given << 16);
+	      else
+		given = (b[1]) | (b[0] << 8) | (given << 16);
 
-	      status = info->read_memory_func
-		((pc + 4) & ~ 0x3, (bfd_byte *) b, 4, info);
-	      if (status != 0)
-		{
-		  info->memory_error_func (status, pc + 4, info);
-		  return -1;
-		}
+	      printer = print_insn_thumb32;
+	      size = 4;
+	    }
+	}
 
-	      given |= (b[0] << 24) | (b[1] << 16);
-	    }
+      if (ifthen_address != pc)
+	find_ifthen_state(pc, info, little);
+
+      if (ifthen_state)
+	{
+	  if ((ifthen_state & 0xf) == 0x8)
+	    ifthen_next_state = 0;
 	  else
-	    given = (b[0] << 8) | b[1] | (b[2] << 24) | (b[3] << 16);
+	    ifthen_next_state = (ifthen_state & 0xe0)
+				| ((ifthen_state & 0xf) << 1);
 	}
-      else
-	given = (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | (b[3]);
     }
 
+  if (status)
+    {
+      info->memory_error_func (status, pc, info);
+      return -1;
+    }
   if (info->flags & INSN_HAS_RELOC)
     /* If the instruction has a reloc associated with it, then
        the offset field in the instruction will actually be the
@@ -1652,16 +4134,19 @@
        In such cases, we can ignore the pc when computing
        addresses, since the addend is not currently pc-relative.  */
     pc = 0;
+
+  printer (pc, info, given);
+
   if (is_thumb)
-    status = print_insn_thumb (pc, info, given);
-  else
-    status = print_insn_arm1 (pc, info, given);
-
-  return status;
+    {
+      ifthen_state = ifthen_next_state;
+      ifthen_address += size;
+    }
+  return size;
 }
 
 void
-print_arm_disassembler_options (FILE * stream)
+print_arm_disassembler_options (FILE *stream)
 {
   int i;
 

Modified: trunk/src/host/qemu-neo1973/arm-semi.c
===================================================================
--- trunk/src/host/qemu-neo1973/arm-semi.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/arm-semi.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -184,9 +184,11 @@
     args = env->regs[1];
     switch (nr) {
     case SYS_OPEN:
-        s = lock_user_string(ARG(0));
+        if (!(s = lock_user_string(ARG(0))))
+            /* FIXME - should this error code be -TARGET_EFAULT ? */
+            return (uint32_t)-1;
         if (ARG(1) >= 12)
-          return (uint32_t)-1;
+            return (uint32_t)-1;
         if (strcmp(s, ":tt") == 0) {
             if (ARG(1) < 4)
                 return STDIN_FILENO;
@@ -221,7 +223,9 @@
           }
         }
     case SYS_WRITE0:
-        s = lock_user_string(args);
+        if (!(s = lock_user_string(args)))
+            /* FIXME - should this error code be -TARGET_EFAULT ? */
+            return (uint32_t)-1;
         len = strlen(s);
         if (use_gdb_syscalls()) {
             gdb_do_syscall(arm_semi_cb, "write,2,%x,%x\n", args, len);
@@ -238,7 +242,9 @@
             gdb_do_syscall(arm_semi_cb, "write,%x,%x,%x", ARG(0), ARG(1), len);
             return env->regs[0];
         } else {
-            s = lock_user(ARG(1), len, 1);
+            if (!(s = lock_user(VERIFY_READ, ARG(1), len, 1)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             ret = set_swi_errno(ts, write(ARG(0), s, len));
             unlock_user(s, ARG(1), 0);
             if (ret == (uint32_t)-1)
@@ -252,7 +258,9 @@
             gdb_do_syscall(arm_semi_cb, "read,%x,%x,%x", ARG(0), ARG(1), len);
             return env->regs[0];
         } else {
-            s = lock_user(ARG(1), len, 0);
+            if (!(s = lock_user(VERIFY_WRITE, ARG(1), len, 0)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             do
               ret = set_swi_errno(ts, read(ARG(0), s, len));
             while (ret == -1 && errno == EINTR);
@@ -301,7 +309,9 @@
             gdb_do_syscall(arm_semi_cb, "unlink,%s", ARG(0), (int)ARG(1)+1);
             ret = env->regs[0];
         } else {
-            s = lock_user_string(ARG(0));
+            if (!(s = lock_user_string(ARG(0))))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             ret =  set_swi_errno(ts, remove(s));
             unlock_user(s, ARG(0), 0);
         }
@@ -315,9 +325,15 @@
             char *s2;
             s = lock_user_string(ARG(0));
             s2 = lock_user_string(ARG(2));
-            ret = set_swi_errno(ts, rename(s, s2));
-            unlock_user(s2, ARG(2), 0);
-            unlock_user(s, ARG(0), 0);
+            if (!s || !s2)
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                ret = (uint32_t)-1;
+            else
+                ret = set_swi_errno(ts, rename(s, s2));
+            if (s2)
+                unlock_user(s2, ARG(2), 0);
+            if (s)
+                unlock_user(s, ARG(0), 0);
             return ret;
         }
     case SYS_CLOCK:
@@ -329,7 +345,9 @@
             gdb_do_syscall(arm_semi_cb, "system,%s", ARG(0), (int)ARG(1)+1);
             return env->regs[0];
         } else {
-            s = lock_user_string(ARG(0));
+            if (!(s = lock_user_string(ARG(0))))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             ret = set_swi_errno(ts, system(s));
             unlock_user(s, ARG(0), 0);
         }
@@ -346,8 +364,12 @@
             char **arg = ts->info->host_argv;
             int len = ARG(1);
             /* lock the buffer on the ARM side */
-            char *cmdline_buffer = (char*)lock_user(ARG(0), len, 0);
+            char *cmdline_buffer = (char*)lock_user(VERIFY_WRITE, ARG(0), len, 0);
 
+            if (!cmdline_buffer)
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
+
             s = cmdline_buffer;
             while (*arg && len > 2) {
                 int n = strlen(*arg);
@@ -402,7 +424,9 @@
                 ts->heap_limit = limit;
             }
 
-            ptr = lock_user(ARG(0), 16, 0);
+            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             ptr[0] = tswap32(ts->heap_base);
             ptr[1] = tswap32(ts->heap_limit);
             ptr[2] = tswap32(ts->stack_base);
@@ -410,7 +434,9 @@
             unlock_user(ptr, ARG(0), 16);
 #else
             limit = ram_size;
-            ptr = lock_user(ARG(0), 16, 0);
+            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
+                /* FIXME - should this error code be -TARGET_EFAULT ? */
+                return (uint32_t)-1;
             /* TODO: Make this use the limit of the loaded application.  */
             ptr[0] = tswap32(limit / 2);
             ptr[1] = tswap32(limit);

Modified: trunk/src/host/qemu-neo1973/block-bochs.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-bochs.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-bochs.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -22,7 +22,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 /**************************************************************/

Modified: trunk/src/host/qemu-neo1973/block-cloop.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-cloop.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-cloop.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <zlib.h>
 

Modified: trunk/src/host/qemu-neo1973/block-cow.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-cow.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-cow.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -22,7 +22,7 @@
  * THE SOFTWARE.
  */
 #ifndef _WIN32
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <sys/mman.h>
 

Modified: trunk/src/host/qemu-neo1973/block-dmg.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-dmg.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-dmg.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include "bswap.h"
 #include <zlib.h>

Modified: trunk/src/host/qemu-neo1973/block-parallels.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-parallels.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-parallels.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -23,7 +23,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 /**************************************************************/

Modified: trunk/src/host/qemu-neo1973/block-qcow.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-qcow.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-qcow.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <zlib.h>
 #include "aes.h"

Modified: trunk/src/host/qemu-neo1973/block-qcow2.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-qcow2.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-qcow2.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <zlib.h>
 #include "aes.h"

Modified: trunk/src/host/qemu-neo1973/block-raw.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-raw.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-raw.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -21,16 +21,17 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
+#ifdef QEMU_IMG
+#include "qemu-common.h"
+#else
 #include "vl.h"
+#include "exec-all.h"
+#endif
 #include "block_int.h"
 #include <assert.h>
 #ifndef _WIN32
 #include <aio.h>
 
-#ifndef QEMU_TOOL
-#include "exec-all.h"
-#endif
-
 #ifdef CONFIG_COCOA
 #include <paths.h>
 #include <sys/param.h>
@@ -59,8 +60,8 @@
 
 //#define DEBUG_FLOPPY
 
-#define DEBUG_BLOCK
-#if defined(DEBUG_BLOCK) && !defined(QEMU_TOOL)
+//#define DEBUG_BLOCK
+#if defined(DEBUG_BLOCK) && !defined(QEMU_IMG)
 #define DEBUG_BLOCK_PRINT(formatCstr, args...) do { if (loglevel != 0)	\
     { fprintf(logfile, formatCstr, ##args); fflush(logfile); } } while (0)
 #else
@@ -242,7 +243,7 @@
 
 static void aio_signal_handler(int signum)
 {
-#ifndef QEMU_TOOL
+#ifndef QEMU_IMG
     CPUState *env = cpu_single_env;
     if (env) {
         /* stop the currently executing cpu because a timer occured */
@@ -352,7 +353,7 @@
     sigset_t set;
     int nb_sigs;
 
-#ifndef QEMU_TOOL
+#ifndef QEMU_IMG
     if (qemu_bh_poll())
         return;
 #endif
@@ -693,7 +694,7 @@
     return 0;
 }
 
-#if defined(__linux__) && !defined(QEMU_TOOL)
+#if defined(__linux__) && !defined(QEMU_IMG)
 
 /* Note: we do not have a reliable method to detect if the floppy is
    present. The current method is to try to open the floppy at every
@@ -976,7 +977,7 @@
     } else {
         create_flags = OPEN_EXISTING;
     }
-#ifdef QEMU_TOOL
+#ifdef QEMU_IMG
     overlapped = FILE_ATTRIBUTE_NORMAL;
 #else
     overlapped = FILE_FLAG_OVERLAPPED;
@@ -1039,7 +1040,7 @@
 }
 
 #if 0
-#ifndef QEMU_TOOL
+#ifndef QEMU_IMG
 static void raw_aio_cb(void *opaque)
 {
     RawAIOCB *acb = opaque;
@@ -1078,7 +1079,7 @@
     acb->ov.OffsetHigh = offset >> 32;
     acb->ov.hEvent = acb->hEvent;
     acb->count = nb_sectors * 512;
-#ifndef QEMU_TOOL
+#ifndef QEMU_IMG
     qemu_add_wait_object(acb->ov.hEvent, raw_aio_cb, acb);
 #endif
     return acb;
@@ -1100,7 +1101,7 @@
         qemu_aio_release(acb);
         return NULL;
     }
-#ifdef QEMU_TOOL
+#ifdef QEMU_IMG
     qemu_aio_release(acb);
 #endif
     return (BlockDriverAIOCB *)acb;
@@ -1122,7 +1123,7 @@
         qemu_aio_release(acb);
         return NULL;
     }
-#ifdef QEMU_TOOL
+#ifdef QEMU_IMG
     qemu_aio_release(acb);
 #endif
     return (BlockDriverAIOCB *)acb;
@@ -1130,7 +1131,7 @@
 
 static void raw_aio_cancel(BlockDriverAIOCB *blockacb)
 {
-#ifndef QEMU_TOOL
+#ifndef QEMU_IMG
     RawAIOCB *acb = (RawAIOCB *)blockacb;
     BlockDriverState *bs = acb->common.bs;
     BDRVRawState *s = bs->opaque;
@@ -1238,7 +1239,7 @@
 
 void qemu_aio_wait(void)
 {
-#ifndef QEMU_TOOL
+#ifndef QEMU_IMG
     qemu_bh_poll();
 #endif
 }
@@ -1344,7 +1345,7 @@
     }
     create_flags = OPEN_EXISTING;
 
-#ifdef QEMU_TOOL
+#ifdef QEMU_IMG
     overlapped = FILE_ATTRIBUTE_NORMAL;
 #else
     overlapped = FILE_FLAG_OVERLAPPED;

Modified: trunk/src/host/qemu-neo1973/block-vmdk.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-vmdk.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-vmdk.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -23,7 +23,7 @@
  * THE SOFTWARE.
  */
 
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 #define VMDK3_MAGIC (('C' << 24) | ('O' << 16) | ('W' << 8) | 'D')

Modified: trunk/src/host/qemu-neo1973/block-vpc.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-vpc.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-vpc.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 /**************************************************************/

Modified: trunk/src/host/qemu-neo1973/block-vvfat.c
===================================================================
--- trunk/src/host/qemu-neo1973/block-vvfat.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block-vvfat.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -25,7 +25,7 @@
 #include <sys/stat.h>
 #include <dirent.h>
 #include <assert.h>
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 
 #ifndef S_IWGRP

Modified: trunk/src/host/qemu-neo1973/block.c
===================================================================
--- trunk/src/host/qemu-neo1973/block.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -21,7 +21,11 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
+#ifdef QEMU_IMG
+#include "qemu-common.h"
+#else
 #include "vl.h"
+#endif
 #include "block_int.h"
 
 #ifdef _BSD
@@ -53,7 +57,7 @@
 static int bdrv_write_em(BlockDriverState *bs, int64_t sector_num,
                          const uint8_t *buf, int nb_sectors);
 
-static BlockDriverState *bdrv_first;
+BlockDriverState *bdrv_first;
 static BlockDriver *first_drv;
 
 int path_is_absolute(const char *path)
@@ -859,6 +863,7 @@
         bdrv_flush(bs->backing_hd);
 }
 
+#ifndef QEMU_IMG
 void bdrv_info(void)
 {
     BlockDriverState *bs;
@@ -898,6 +903,7 @@
         term_printf("\n");
     }
 }
+#endif
 
 void bdrv_get_backing_filename(BlockDriverState *bs,
                                char *filename, int filename_size)
@@ -1102,7 +1108,7 @@
 /**************************************************************/
 /* async block device emulation */
 
-#ifdef QEMU_TOOL
+#ifdef QEMU_IMG
 static BlockDriverAIOCB *bdrv_aio_read_em(BlockDriverState *bs,
         int64_t sector_num, uint8_t *buf, int nb_sectors,
         BlockDriverCompletionFunc *cb, void *opaque)
@@ -1172,7 +1178,7 @@
     qemu_bh_cancel(acb->bh);
     qemu_aio_release(acb);
 }
-#endif /* !QEMU_TOOL */
+#endif /* !QEMU_IMG */
 
 /**************************************************************/
 /* sync block device emulation */

Added: trunk/src/host/qemu-neo1973/block.h
===================================================================
--- trunk/src/host/qemu-neo1973/block.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,157 @@
+#ifndef BLOCK_H
+#define BLOCK_H
+
+/* block.c */
+typedef struct BlockDriverState BlockDriverState;
+typedef struct BlockDriver BlockDriver;
+
+extern BlockDriver bdrv_raw;
+extern BlockDriver bdrv_host_device;
+extern BlockDriver bdrv_cow;
+extern BlockDriver bdrv_qcow;
+extern BlockDriver bdrv_vmdk;
+extern BlockDriver bdrv_cloop;
+extern BlockDriver bdrv_dmg;
+extern BlockDriver bdrv_bochs;
+extern BlockDriver bdrv_vpc;
+extern BlockDriver bdrv_vvfat;
+extern BlockDriver bdrv_qcow2;
+extern BlockDriver bdrv_parallels;
+
+typedef struct BlockDriverInfo {
+    /* in bytes, 0 if irrelevant */
+    int cluster_size;
+    /* offset at which the VM state can be saved (0 if not possible) */
+    int64_t vm_state_offset;
+} BlockDriverInfo;
+
+typedef struct QEMUSnapshotInfo {
+    char id_str[128]; /* unique snapshot id */
+    /* the following fields are informative. They are not needed for
+       the consistency of the snapshot */
+    char name[256]; /* user choosen name */
+    uint32_t vm_state_size; /* VM state info size */
+    uint32_t date_sec; /* UTC date of the snapshot */
+    uint32_t date_nsec;
+    uint64_t vm_clock_nsec; /* VM clock relative to boot */
+} QEMUSnapshotInfo;
+
+#define BDRV_O_RDONLY      0x0000
+#define BDRV_O_RDWR        0x0002
+#define BDRV_O_ACCESS      0x0003
+#define BDRV_O_CREAT       0x0004 /* create an empty file */
+#define BDRV_O_SNAPSHOT    0x0008 /* open the file read only and save writes in a snapshot */
+#define BDRV_O_FILE        0x0010 /* open as a raw file (do not try to
+                                     use a disk image format on top of
+                                     it (default for
+                                     bdrv_file_open()) */
+
+#ifndef QEMU_IMG
+void bdrv_info(void);
+#endif
+
+void bdrv_init(void);
+BlockDriver *bdrv_find_format(const char *format_name);
+int bdrv_create(BlockDriver *drv,
+                const char *filename, int64_t size_in_sectors,
+                const char *backing_file, int flags);
+BlockDriverState *bdrv_new(const char *device_name);
+void bdrv_delete(BlockDriverState *bs);
+int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags);
+int bdrv_open(BlockDriverState *bs, const char *filename, int flags);
+int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
+               BlockDriver *drv);
+void bdrv_close(BlockDriverState *bs);
+int bdrv_read(BlockDriverState *bs, int64_t sector_num,
+              uint8_t *buf, int nb_sectors);
+int bdrv_write(BlockDriverState *bs, int64_t sector_num,
+               const uint8_t *buf, int nb_sectors);
+int bdrv_pread(BlockDriverState *bs, int64_t offset,
+               void *buf, int count);
+int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
+                const void *buf, int count);
+int bdrv_truncate(BlockDriverState *bs, int64_t offset);
+int64_t bdrv_getlength(BlockDriverState *bs);
+void bdrv_get_geometry(BlockDriverState *bs, int64_t *nb_sectors_ptr);
+int bdrv_commit(BlockDriverState *bs);
+void bdrv_set_boot_sector(BlockDriverState *bs, const uint8_t *data, int size);
+/* async block I/O */
+typedef struct BlockDriverAIOCB BlockDriverAIOCB;
+typedef void BlockDriverCompletionFunc(void *opaque, int ret);
+
+BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num,
+                                uint8_t *buf, int nb_sectors,
+                                BlockDriverCompletionFunc *cb, void *opaque);
+BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,
+                                 const uint8_t *buf, int nb_sectors,
+                                 BlockDriverCompletionFunc *cb, void *opaque);
+void bdrv_aio_cancel(BlockDriverAIOCB *acb);
+
+void qemu_aio_init(void);
+void qemu_aio_poll(void);
+void qemu_aio_flush(void);
+void qemu_aio_wait_start(void);
+void qemu_aio_wait(void);
+void qemu_aio_wait_end(void);
+
+int qemu_key_check(BlockDriverState *bs, const char *name);
+
+/* Ensure contents are flushed to disk.  */
+void bdrv_flush(BlockDriverState *bs);
+
+#define BDRV_TYPE_HD     0
+#define BDRV_TYPE_CDROM  1
+#define BDRV_TYPE_FLOPPY 2
+#define BIOS_ATA_TRANSLATION_AUTO   0
+#define BIOS_ATA_TRANSLATION_NONE   1
+#define BIOS_ATA_TRANSLATION_LBA    2
+#define BIOS_ATA_TRANSLATION_LARGE  3
+#define BIOS_ATA_TRANSLATION_RECHS  4
+
+void bdrv_set_geometry_hint(BlockDriverState *bs,
+                            int cyls, int heads, int secs);
+void bdrv_set_type_hint(BlockDriverState *bs, int type);
+void bdrv_set_translation_hint(BlockDriverState *bs, int translation);
+void bdrv_get_geometry_hint(BlockDriverState *bs,
+                            int *pcyls, int *pheads, int *psecs);
+int bdrv_get_type_hint(BlockDriverState *bs);
+int bdrv_get_translation_hint(BlockDriverState *bs);
+int bdrv_is_removable(BlockDriverState *bs);
+int bdrv_is_read_only(BlockDriverState *bs);
+int bdrv_is_inserted(BlockDriverState *bs);
+int bdrv_media_changed(BlockDriverState *bs);
+int bdrv_is_locked(BlockDriverState *bs);
+void bdrv_set_locked(BlockDriverState *bs, int locked);
+void bdrv_eject(BlockDriverState *bs, int eject_flag);
+void bdrv_set_change_cb(BlockDriverState *bs,
+                        void (*change_cb)(void *opaque), void *opaque);
+void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
+BlockDriverState *bdrv_find(const char *name);
+void bdrv_iterate(void (*it)(void *opaque, const char *name), void *opaque);
+int bdrv_is_encrypted(BlockDriverState *bs);
+int bdrv_set_key(BlockDriverState *bs, const char *key);
+void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
+                         void *opaque);
+const char *bdrv_get_device_name(BlockDriverState *bs);
+int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
+                          const uint8_t *buf, int nb_sectors);
+int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi);
+
+void bdrv_get_backing_filename(BlockDriverState *bs,
+                               char *filename, int filename_size);
+int bdrv_snapshot_create(BlockDriverState *bs,
+                         QEMUSnapshotInfo *sn_info);
+int bdrv_snapshot_goto(BlockDriverState *bs,
+                       const char *snapshot_id);
+int bdrv_snapshot_delete(BlockDriverState *bs, const char *snapshot_id);
+int bdrv_snapshot_list(BlockDriverState *bs,
+                       QEMUSnapshotInfo **psn_info);
+char *bdrv_snapshot_dump(char *buf, int buf_size, QEMUSnapshotInfo *sn);
+
+char *get_human_readable_size(char *buf, int buf_size, int64_t size);
+int path_is_absolute(const char *path);
+void path_combine(char *dest, int dest_size,
+                  const char *base_path,
+                  const char *filename);
+
+#endif

Modified: trunk/src/host/qemu-neo1973/block_int.h
===================================================================
--- trunk/src/host/qemu-neo1973/block_int.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/block_int.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -24,6 +24,8 @@
 #ifndef BLOCK_INT_H
 #define BLOCK_INT_H
 
+#include "block.h"
+
 #define BLOCK_FLAG_ENCRYPT	1
 #define BLOCK_FLAG_COMPRESS	2
 #define BLOCK_FLAG_COMPAT6	4
@@ -133,4 +135,6 @@
                    void *opaque);
 void qemu_aio_release(void *p);
 
+BlockDriverState *bdrv_first;
+
 #endif /* BLOCK_INT_H */

Modified: trunk/src/host/qemu-neo1973/configure
===================================================================
--- trunk/src/host/qemu-neo1973/configure	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/configure	2007-11-13 16:27:39 UTC (rev 3406)
@@ -215,6 +215,12 @@
     source_path_used="yes"
 fi
 
+werror="no"
+# generate compile errors on warnings for development builds
+#if grep cvs $source_path/VERSION > /dev/null 2>&1 ; then
+#werror="yes";
+#fi
+
 for opt do
   optarg=`expr "x$opt" : 'x[^=]*=\(.*\)'`
   case "$opt" in
@@ -310,6 +316,10 @@
   ;;
   --enable-phonesim) phonesim="yes"
   ;;
+  --enable-werror) werror="yes"
+  ;;
+  --disable-werror) werror="no"
+  ;;
   esac
 done
 
@@ -323,6 +333,9 @@
 # default flags for all hosts
 CFLAGS="$CFLAGS -Wall -O2 -g -fno-strict-aliasing"
 LDFLAGS="$LDFLAGS -g"
+if test "$werror" = "yes" ; then
+CFLAGS="$CFLAGS -Werror"
+fi
 
 #
 # If cpu ~= sparc and  sparc_cpu hasn't been defined, plug in the right
@@ -382,6 +395,7 @@
 echo "  --make=MAKE              use specified make [$make]"
 echo "  --install=INSTALL        use specified install [$install]"
 echo "  --static                 enable static build [$static]"
+echo "  --disable-werror         disable compilation abort on warning"
 echo "  --disable-sdl            disable SDL"
 echo "  --enable-cocoa           enable COCOA (Mac OS X only)"
 echo "  --enable-mingw32         enable Win32 cross compilation with mingw32"
@@ -510,7 +524,7 @@
     fi
 # the following are Linux specific
     if [ "$linux_user" = "yes" ] ; then
-        target_list="i386-linux-user arm-linux-user armeb-linux-user sparc-linux-user sparc64-linux-user sparc32plus-linux-user mips-linux-user mipsel-linux-user m68k-linux-user alpha-linux-user sh4-linux-user ppc-linux-user ppcemb-linux-user ppc64-linux-user ppc64abi32-linux-user x86_64-linux-user cris-linux-user $target_list"
+        target_list="i386-linux-user arm-linux-user armeb-linux-user sparc-linux-user sparc64-linux-user sparc32plus-linux-user mips-linux-user mipsel-linux-user m68k-linux-user alpha-linux-user sh4-linux-user ppc-linux-user ppc64-linux-user ppc64abi32-linux-user x86_64-linux-user cris-linux-user $target_list"
     fi
 # the following are Darwin specific
     if [ "$darwin_user" = "yes" ] ; then
@@ -728,6 +742,7 @@
 echo "gprof enabled     $gprof"
 echo "profiler          $profiler"
 echo "static build      $static"
+echo "-Werror enabled   $werror"
 if test "$darwin" = "yes" ; then
     echo "Cocoa support     $cocoa"
 fi

Modified: trunk/src/host/qemu-neo1973/cpu-exec.c
===================================================================
--- trunk/src/host/qemu-neo1973/cpu-exec.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/cpu-exec.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -173,6 +173,7 @@
         flags |= (1 << 6);
     if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30))
         flags |= (1 << 7);
+    flags |= (env->condexec_bits << 8);
     cs_base = 0;
     pc = env->regs[15];
 #elif defined(TARGET_SPARC)
@@ -511,8 +512,18 @@
                         env->exception_index = EXCP_FIQ;
                         do_interrupt(env);
                     }
+                    /* ARMv7-M interrupt return works by loading a magic value
+                       into the PC.  On real hardware the load causes the
+                       return to occur.  The qemu implementation performs the
+                       jump normally, then does the exception return when the
+                       CPU tries to execute code at the magic address.
+                       This will cause the magic PC value to be pushed to
+                       the stack if an interrupt occured at the wrong time.
+                       We avoid this by disabling interrupts when
+                       pc contains a magic address.  */
                     if (interrupt_request & CPU_INTERRUPT_HARD
-                        && !(env->uncached_cpsr & CPSR_I)) {
+                        && ((IS_M(env) && env->regs[15] < 0xfffffff0)
+                            || !(env->uncached_cpsr & CPSR_I))) {
                         env->exception_index = EXCP_IRQ;
                         do_interrupt(env);
                     }
@@ -740,26 +751,26 @@
     env = saved_env;
 }
 
-void cpu_x86_fsave(CPUX86State *s, uint8_t *ptr, int data32)
+void cpu_x86_fsave(CPUX86State *s, target_ulong ptr, int data32)
 {
     CPUX86State *saved_env;
 
     saved_env = env;
     env = s;
 
-    helper_fsave((target_ulong)ptr, data32);
+    helper_fsave(ptr, data32);
 
     env = saved_env;
 }
 
-void cpu_x86_frstor(CPUX86State *s, uint8_t *ptr, int data32)
+void cpu_x86_frstor(CPUX86State *s, target_ulong ptr, int data32)
 {
     CPUX86State *saved_env;
 
     saved_env = env;
     env = s;
 
-    helper_frstor((target_ulong)ptr, data32);
+    helper_frstor(ptr, data32);
 
     env = saved_env;
 }

Modified: trunk/src/host/qemu-neo1973/cutils.c
===================================================================
--- trunk/src/host/qemu-neo1973/cutils.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/cutils.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 
 void pstrcpy(char *buf, int buf_size, const char *str)
 {
@@ -81,3 +81,17 @@
         *ptr = p;
     return 1;
 }
+
+time_t mktimegm(struct tm *tm)
+{
+    time_t t;
+    int y = tm->tm_year + 1900, m = tm->tm_mon + 1, d = tm->tm_mday;
+    if (m < 3) {
+        m += 12;
+        y--;
+    }
+    t = 86400 * (d + (153 * m - 457) / 5 + 365 * y + y / 4 - y / 100 + 
+                 y / 400 - 719469);
+    t += 3600 * tm->tm_hour + 60 * tm->tm_min + tm->tm_sec;
+    return t;
+}

Modified: trunk/src/host/qemu-neo1973/darwin-user/main.c
===================================================================
--- trunk/src/host/qemu-neo1973/darwin-user/main.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/darwin-user/main.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -357,7 +357,6 @@
         case POWERPC_EXCP_DEBUG:    /* Debug interrupt                       */
             gdb_handlesig (env, SIGTRAP);
             break;
-#if defined(TARGET_PPCEMB)
         case POWERPC_EXCP_SPEU:     /* SPE/embedded floating-point unavail.  */
             EXCP_DUMP(env, "No SPE/floating-point instruction allowed\n");
             info.si_signo = SIGILL;
@@ -383,7 +382,6 @@
             cpu_abort(env, "Doorbell critical interrupt while in user mode. "
                       "Aborting\n");
             break;
-#endif /* defined(TARGET_PPCEMB) */
         case POWERPC_EXCP_RESET:    /* System reset exception                */
             cpu_abort(env, "Reset interrupt while in user mode. "
                       "Aborting\n");
@@ -785,6 +783,7 @@
     int optind;
     short use_gdbstub = 0;
     const char *r;
+    const char *cpu_model;
 
     if (argc <= 1)
         usage();
@@ -855,7 +854,15 @@
 
     /* NOTE: we need to init the CPU at this stage to get
        qemu_host_page_size */
-    env = cpu_init();
+#if defined(TARGET_I386)
+    cpu_model = "qemu32";
+#elif defined(TARGET_PPC)
+    cpu_model = "750";
+#else
+#error unsupported CPU
+#endif
+    
+    env = cpu_init(cpu_model);
 
     printf("Starting %s with qemu\n----------------\n", filename);
 

Modified: trunk/src/host/qemu-neo1973/dis-asm.h
===================================================================
--- trunk/src/host/qemu-neo1973/dis-asm.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/dis-asm.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -183,12 +183,20 @@
   bfd_arch_alpha,      /* Dec Alpha */
 #define bfd_mach_alpha 1
   bfd_arch_arm,        /* Advanced Risc Machines ARM */
-#define bfd_mach_arm_2         1
-#define bfd_mach_arm_2a                2
-#define bfd_mach_arm_3         3
-#define bfd_mach_arm_3M        4
-#define bfd_mach_arm_4                 5
-#define bfd_mach_arm_4T        6
+#define bfd_mach_arm_unknown	0
+#define bfd_mach_arm_2		1
+#define bfd_mach_arm_2a		2
+#define bfd_mach_arm_3		3
+#define bfd_mach_arm_3M 	4
+#define bfd_mach_arm_4 		5
+#define bfd_mach_arm_4T 	6
+#define bfd_mach_arm_5 		7
+#define bfd_mach_arm_5T		8
+#define bfd_mach_arm_5TE	9
+#define bfd_mach_arm_XScale	10
+#define bfd_mach_arm_ep9312	11
+#define bfd_mach_arm_iWMMXt	12
+#define bfd_mach_arm_iWMMXt2	13
   bfd_arch_ns32k,      /* National Semiconductors ns32000 */
   bfd_arch_w65,        /* WDC 65816 */
   bfd_arch_tic30,      /* Texas Instruments TMS320C30 */

Modified: trunk/src/host/qemu-neo1973/exec.c
===================================================================
--- trunk/src/host/qemu-neo1973/exec.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/exec.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1314,6 +1314,8 @@
 
 CPUState *cpu_copy(CPUState *env)
 {
+#if 0
+    /* XXX: broken, must be handled by each CPU */
     CPUState *new_env = cpu_init();
     /* preserve chaining and index */
     CPUState *next_cpu = new_env->next_cpu;
@@ -1322,6 +1324,9 @@
     new_env->next_cpu = next_cpu;
     new_env->cpu_index = cpu_index;
     return new_env;
+#else
+    return NULL;
+#endif
 }
 
 #if !defined(CONFIG_USER_ONLY)
@@ -2505,13 +2510,19 @@
         if (is_write) {
             if (!(flags & PAGE_WRITE))
                 return;
-            p = lock_user(addr, len, 0);
+            /* XXX: this code should not depend on lock_user */
+            if (!(p = lock_user(VERIFY_WRITE, addr, len, 0)))
+                /* FIXME - should this return an error rather than just fail? */
+                return;
             memcpy(p, buf, len);
             unlock_user(p, addr, len);
         } else {
             if (!(flags & PAGE_READ))
                 return;
-            p = lock_user(addr, len, 1);
+            /* XXX: this code should not depend on lock_user */
+            if (!(p = lock_user(VERIFY_READ, addr, len, 1)))
+                /* FIXME - should this return an error rather than just fail? */
+                return;
             memcpy(buf, p, len);
             unlock_user(p, addr, 0);
         }

Modified: trunk/src/host/qemu-neo1973/fpu/softfloat-native.h
===================================================================
--- trunk/src/host/qemu-neo1973/fpu/softfloat-native.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/fpu/softfloat-native.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -224,6 +224,11 @@
     return -a;
 }
 
+INLINE float32 float32_scalbn(float32 a, int n)
+{
+    return scalbnf(a, n);
+}
+
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE double-precision conversion routines.
 *----------------------------------------------------------------------------*/
@@ -311,6 +316,11 @@
     return -a;
 }
 
+INLINE float64 float64_scalbn(float64 a, int n)
+{
+    return scalbn(a, n);
+}
+
 #ifdef FLOATX80
 
 /*----------------------------------------------------------------------------
@@ -391,4 +401,10 @@
 {
     return -a;
 }
+
+INLINE floatx80 floatx80_scalbn(floatx80 a, int n)
+{
+    return scalbnl(a, n);
+}
+
 #endif

Modified: trunk/src/host/qemu-neo1973/fpu/softfloat.c
===================================================================
--- trunk/src/host/qemu-neo1973/fpu/softfloat.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/fpu/softfloat.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -5377,3 +5377,78 @@
 
 COMPARE(32, 0xff)
 COMPARE(64, 0x7ff)
+
+/* Multiply A by 2 raised to the power N.  */
+float32 float32_scalbn( float32 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int16 aExp;
+    bits32 aSig;
+
+    aSig = extractFloat32Frac( a );
+    aExp = extractFloat32Exp( a );
+    aSign = extractFloat32Sign( a );
+
+    if ( aExp == 0xFF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloat32( aSign, aExp, aSig STATUS_VAR );
+}
+
+float64 float64_scalbn( float64 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int16 aExp;
+    bits64 aSig;
+
+    aSig = extractFloat64Frac( a );
+    aExp = extractFloat64Exp( a );
+    aSign = extractFloat64Sign( a );
+
+    if ( aExp == 0x7FF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloat64( aSign, aExp, aSig STATUS_VAR );
+}
+
+#ifdef FLOATX80
+floatx80 floatx80_scalbn( floatx80 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int16 aExp;
+    bits64 aSig;
+
+    aSig = extractFloatx80Frac( a );
+    aExp = extractFloatx80Exp( a );
+    aSign = extractFloatx80Sign( a );
+
+    if ( aExp == 0x7FF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloatx80( STATUS(floatx80_rounding_precision),
+                                 aSign, aExp, aSig, 0 STATUS_VAR );
+}
+#endif
+
+#ifdef FLOAT128
+float128 float128_scalbn( float128 a, int n STATUS_PARAM )
+{
+    flag aSign;
+    int32 aExp;
+    bits64 aSig0, aSig1;
+
+    aSig1 = extractFloat128Frac1( a );
+    aSig0 = extractFloat128Frac0( a );
+    aExp = extractFloat128Exp( a );
+    aSign = extractFloat128Sign( a );
+    if ( aExp == 0x7FFF ) {
+        return a;
+    }
+    aExp += n;
+    return roundAndPackFloat128( aSign, aExp, aSig0, aSig1, 0 STATUS_VAR );
+
+}
+#endif

Modified: trunk/src/host/qemu-neo1973/fpu/softfloat.h
===================================================================
--- trunk/src/host/qemu-neo1973/fpu/softfloat.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/fpu/softfloat.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -244,6 +244,7 @@
 int float32_compare_quiet( float32, float32 STATUS_PARAM );
 int float32_is_nan( float32 );
 int float32_is_signaling_nan( float32 );
+float32 float32_scalbn( float32, int STATUS_PARAM );
 
 INLINE float32 float32_abs(float32 a)
 {
@@ -295,6 +296,7 @@
 int float64_compare_quiet( float64, float64 STATUS_PARAM );
 int float64_is_nan( float64 a );
 int float64_is_signaling_nan( float64 );
+float64 float64_scalbn( float64, int STATUS_PARAM );
 
 INLINE float64 float64_abs(float64 a)
 {
@@ -339,6 +341,7 @@
 int floatx80_lt_quiet( floatx80, floatx80 STATUS_PARAM );
 int floatx80_is_nan( floatx80 );
 int floatx80_is_signaling_nan( floatx80 );
+floatx80 floatx80_scalbn( floatx80, int STATUS_PARAM );
 
 INLINE floatx80 floatx80_abs(floatx80 a)
 {
@@ -387,6 +390,7 @@
 int float128_lt_quiet( float128, float128 STATUS_PARAM );
 int float128_is_nan( float128 );
 int float128_is_signaling_nan( float128 );
+float128 float128_scalbn( float128, int STATUS_PARAM );
 
 INLINE float128 float128_abs(float128 a)
 {

Modified: trunk/src/host/qemu-neo1973/gdbstub.c
===================================================================
--- trunk/src/host/qemu-neo1973/gdbstub.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/gdbstub.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1052,7 +1052,8 @@
             TaskState *ts = env->opaque;
 
             sprintf(buf,
-                    "Text=" TARGET_FMT_lx ";Data=" TARGET_FMT_lx ";Bss=" TARGET_FMT_lx,
+                    "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
+                    ";Bss=" TARGET_ABI_FMT_lx,
                     ts->info->code_offset,
                     ts->info->data_offset,
                     ts->info->data_offset);

Modified: trunk/src/host/qemu-neo1973/hw/an5206.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/an5206.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/an5206.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -37,10 +37,10 @@
     uint64_t elf_entry;
     target_ulong entry;
 
-    env = cpu_init();
     if (!cpu_model)
         cpu_model = "m5206";
-    if (cpu_m68k_set_model(env, cpu_model)) {
+    env = cpu_init(cpu_model);
+    if (!env) {
         cpu_abort(env, "Unable to find m68k CPU definition\n");
     }
 

Modified: trunk/src/host/qemu-neo1973/hw/arm_boot.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/arm_boot.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/arm_boot.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1,7 +1,7 @@
 /*
  * ARM kernel loader.
  *
- * Copyright (c) 2006 CodeSourcery.
+ * Copyright (c) 2006-2007 CodeSourcery.
  * Written by Paul Brook
  *
  * This code is licenced under the GPL.
@@ -24,6 +24,22 @@
   0  /* Kernel entry point.  Set by integratorcp_init.  */
 };
 
+/* Entry point for secondary CPUs.  Enable interrupt controller and
+   Issue WFI until start address is written to system controller.  */
+static uint32_t smpboot[] = {
+  0xe3a00201, /* mov     r0, #0x10000000 */
+  0xe3800601, /* orr     r0, r0, #0x001000000 */
+  0xe3a01001, /* mov     r1, #1 */
+  0xe5801100, /* str     r1, [r0, #0x100] */
+  0xe3a00201, /* mov     r0, #0x10000000 */
+  0xe3800030, /* orr     r0, #0x30 */
+  0xe320f003, /* wfi */
+  0xe5901000, /* ldr     r1, [r0] */
+  0xe3110003, /* tst     r1, #3 */
+  0x1afffffb, /* bne     <wfi> */
+  0xe12fff11  /* bx      r1 */
+};
+
 static void main_cpu_reset(void *opaque)
 {
     CPUState *env = opaque;
@@ -33,6 +49,8 @@
         arm_load_kernel(env, env->ram_size, env->kernel_filename,
                         env->kernel_cmdline, env->initrd_filename,
                         env->board_id, env->loader_start);
+
+    /* TODO:  Reset secondary CPUs.  */
 }
 
 static void set_kernel_args(uint32_t ram_size, int initrd_size,
@@ -211,6 +229,8 @@
         bootloader[6] = entry;
         for (n = 0; n < sizeof(bootloader) / 4; n++)
             stl_raw(phys_ram_base + (n * 4), bootloader[n]);
+        for (n = 0; n < sizeof(smpboot) / 4; n++)
+            stl_raw(phys_ram_base + ram_size + (n * 4), smpboot[n]);
         if (old_param)
             set_kernel_args_old(ram_size, initrd_size,
                                 kernel_cmdline, loader_start);

Modified: trunk/src/host/qemu-neo1973/hw/arm_gic.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/arm_gic.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/arm_gic.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1,18 +1,16 @@
 /*
- * ARM AMBA Generic/Distributed Interrupt Controller
+ * ARM Generic/Distributed Interrupt Controller
  *
- * Copyright (c) 2006 CodeSourcery.
+ * Copyright (c) 2006-2007 CodeSourcery.
  * Written by Paul Brook
  *
  * This code is licenced under the GPL.
  */
 
-/* TODO: Some variants of this controller can handle multiple CPUs.
-   Currently only single CPU operation is implemented.  */
+/* This file contains implementation code for the RealView EB interrupt
+   controller, MPCore distributed interrupt controller and ARMv7-M
+   Nested Vectored Interrupt Controller.  */
 
-#include "vl.h"
-#include "arm_pic.h"
-
 //#define DEBUG_GIC
 
 #ifdef DEBUG_GIC
@@ -22,58 +20,84 @@
 #define DPRINTF(fmt, args...) do {} while(0)
 #endif
 
-/* Distributed interrupt controller.  */
-
+#ifdef NVIC
 static const uint8_t gic_id[] =
+{ 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 };
+#define GIC_DIST_OFFSET 0
+/* The NVIC has 16 internal vectors.  However these are not exposed
+   through the normal GIC interface.  */
+#define GIC_BASE_IRQ    32
+#else
+static const uint8_t gic_id[] =
 { 0x90, 0x13, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
+#define GIC_DIST_OFFSET 0x1000
+#define GIC_BASE_IRQ    0
+#endif
 
-#define GIC_NIRQ 96
-
 typedef struct gic_irq_state
 {
+    /* ??? The documentation seems to imply the enable bits are global, even
+       for per-cpu interrupts.  This seems strange.  */
     unsigned enabled:1;
-    unsigned pending:1;
-    unsigned active:1;
+    unsigned pending:NCPU;
+    unsigned active:NCPU;
     unsigned level:1;
-    unsigned model:1; /* 0 = 1:N, 1 = N:N */
+    unsigned model:1; /* 0 = N:N, 1 = 1:N */
     unsigned trigger:1; /* nonzero = edge triggered.  */
 } gic_irq_state;
 
+#define ALL_CPU_MASK ((1 << NCPU) - 1)
+
 #define GIC_SET_ENABLED(irq) s->irq_state[irq].enabled = 1
 #define GIC_CLEAR_ENABLED(irq) s->irq_state[irq].enabled = 0
 #define GIC_TEST_ENABLED(irq) s->irq_state[irq].enabled
-#define GIC_SET_PENDING(irq) s->irq_state[irq].pending = 1
-#define GIC_CLEAR_PENDING(irq) s->irq_state[irq].pending = 0
-#define GIC_TEST_PENDING(irq) s->irq_state[irq].pending
-#define GIC_SET_ACTIVE(irq) s->irq_state[irq].active = 1
-#define GIC_CLEAR_ACTIVE(irq) s->irq_state[irq].active = 0
-#define GIC_TEST_ACTIVE(irq) s->irq_state[irq].active
+#define GIC_SET_PENDING(irq, cm) s->irq_state[irq].pending |= (cm)
+#define GIC_CLEAR_PENDING(irq, cm) s->irq_state[irq].pending &= ~(cm)
+#define GIC_TEST_PENDING(irq, cm) ((s->irq_state[irq].pending & (cm)) != 0)
+#define GIC_SET_ACTIVE(irq, cm) s->irq_state[irq].active |= (cm)
+#define GIC_CLEAR_ACTIVE(irq, cm) s->irq_state[irq].active &= ~(cm)
+#define GIC_TEST_ACTIVE(irq, cm) ((s->irq_state[irq].active & (cm)) != 0)
 #define GIC_SET_MODEL(irq) s->irq_state[irq].model = 1
 #define GIC_CLEAR_MODEL(irq) s->irq_state[irq].model = 0
 #define GIC_TEST_MODEL(irq) s->irq_state[irq].model
-#define GIC_SET_LEVEL(irq) s->irq_state[irq].level = 1
-#define GIC_CLEAR_LEVEL(irq) s->irq_state[irq].level = 0
-#define GIC_TEST_LEVEL(irq) s->irq_state[irq].level
+#define GIC_SET_LEVEL(irq, cm) s->irq_state[irq].level = (cm)
+#define GIC_CLEAR_LEVEL(irq, cm) s->irq_state[irq].level &= ~(cm)
+#define GIC_TEST_LEVEL(irq, cm) (s->irq_state[irq].level & (cm)) != 0
 #define GIC_SET_TRIGGER(irq) s->irq_state[irq].trigger = 1
 #define GIC_CLEAR_TRIGGER(irq) s->irq_state[irq].trigger = 0
 #define GIC_TEST_TRIGGER(irq) s->irq_state[irq].trigger
+#define GIC_GET_PRIORITY(irq, cpu) \
+  (((irq) < 32) ? s->priority1[irq][cpu] : s->priority2[(irq) - 32])
+#ifdef NVIC
+#define GIC_TARGET(irq) 1
+#else
+#define GIC_TARGET(irq) s->irq_target[irq]
+#endif
 
 typedef struct gic_state
 {
     uint32_t base;
-    qemu_irq parent_irq;
+    qemu_irq parent_irq[NCPU];
     int enabled;
-    int cpu_enabled;
+    int cpu_enabled[NCPU];
 
     gic_irq_state irq_state[GIC_NIRQ];
+#ifndef NVIC
     int irq_target[GIC_NIRQ];
-    int priority[GIC_NIRQ];
-    int last_active[GIC_NIRQ];
+#endif
+    int priority1[32][NCPU];
+    int priority2[GIC_NIRQ - 32];
+    int last_active[GIC_NIRQ][NCPU];
 
-    int priority_mask;
-    int running_irq;
-    int running_priority;
-    int current_pending;
+    int priority_mask[NCPU];
+    int running_irq[NCPU];
+    int running_priority[NCPU];
+    int current_pending[NCPU];
+
+    qemu_irq *in;
+#ifdef NVIC
+    void *nvic;
+#endif
 } gic_state;
 
 /* TODO: Many places that call this routine could be optimized.  */
@@ -83,112 +107,136 @@
     int best_irq;
     int best_prio;
     int irq;
+    int level;
+    int cpu;
+    int cm;
 
-    s->current_pending = 1023;
-    if (!s->enabled || !s->cpu_enabled) {
-        qemu_irq_lower(s->parent_irq);
-        return;
-    }
-    best_prio = 0x100;
-    best_irq = 1023;
-    for (irq = 0; irq < 96; irq++) {
-        if (GIC_TEST_ENABLED(irq) && GIC_TEST_PENDING(irq)) {
-            if (s->priority[irq] < best_prio) {
-                best_prio = s->priority[irq];
-                best_irq = irq;
+    for (cpu = 0; cpu < NCPU; cpu++) {
+        cm = 1 << cpu;
+        s->current_pending[cpu] = 1023;
+        if (!s->enabled || !s->cpu_enabled[cpu]) {
+	    qemu_irq_lower(s->parent_irq[cpu]);
+            return;
+        }
+        best_prio = 0x100;
+        best_irq = 1023;
+        for (irq = 0; irq < GIC_NIRQ; irq++) {
+            if (GIC_TEST_ENABLED(irq) && GIC_TEST_PENDING(irq, cm)) {
+                if (GIC_GET_PRIORITY(irq, cpu) < best_prio) {
+                    best_prio = GIC_GET_PRIORITY(irq, cpu);
+                    best_irq = irq;
+                }
             }
         }
-    }
-    if (best_prio > s->priority_mask) {
-        qemu_irq_lower(s->parent_irq);
-    } else {
-        s->current_pending = best_irq;
-        if (best_prio < s->running_priority) {
-            DPRINTF("Raised pending IRQ %d\n", best_irq);
-            qemu_irq_raise(s->parent_irq);
+        level = 0;
+        if (best_prio <= s->priority_mask[cpu]) {
+            s->current_pending[cpu] = best_irq;
+            if (best_prio < s->running_priority[cpu]) {
+                DPRINTF("Raised pending IRQ %d\n", best_irq);
+                level = 1;
+            }
         }
+        qemu_set_irq(s->parent_irq[cpu], level);
     }
 }
 
+static void __attribute__((unused))
+gic_set_pending_private(gic_state *s, int cpu, int irq)
+{
+    int cm = 1 << cpu;
+
+    if (GIC_TEST_PENDING(irq, cm))
+        return;
+
+    DPRINTF("Set %d pending cpu %d\n", irq, cpu);
+    GIC_SET_PENDING(irq, cm);
+    gic_update(s);
+}
+
+/* Process a change in an external IRQ input.  */
 static void gic_set_irq(void *opaque, int irq, int level)
 {
     gic_state *s = (gic_state *)opaque;
     /* The first external input line is internal interrupt 32.  */
     irq += 32;
-    if (level == GIC_TEST_LEVEL(irq))
+    if (level == GIC_TEST_LEVEL(irq, ALL_CPU_MASK))
         return;
 
     if (level) {
-        GIC_SET_LEVEL(irq);
+        GIC_SET_LEVEL(irq, ALL_CPU_MASK);
         if (GIC_TEST_TRIGGER(irq) || GIC_TEST_ENABLED(irq)) {
-            DPRINTF("Set %d pending\n", irq);
-            GIC_SET_PENDING(irq);
+            DPRINTF("Set %d pending mask %x\n", irq, GIC_TARGET(irq));
+            GIC_SET_PENDING(irq, GIC_TARGET(irq));
         }
     } else {
-        GIC_CLEAR_LEVEL(irq);
+        GIC_CLEAR_LEVEL(irq, ALL_CPU_MASK);
     }
     gic_update(s);
 }
 
-static void gic_set_running_irq(gic_state *s, int irq)
+static void gic_set_running_irq(gic_state *s, int cpu, int irq)
 {
-    s->running_irq = irq;
-    if (irq == 1023)
-        s->running_priority = 0x100;
-    else
-        s->running_priority = s->priority[irq];
+    s->running_irq[cpu] = irq;
+    if (irq == 1023) {
+        s->running_priority[cpu] = 0x100;
+    } else {
+        s->running_priority[cpu] = GIC_GET_PRIORITY(irq, cpu);
+    }
     gic_update(s);
 }
 
-static uint32_t gic_acknowledge_irq(gic_state *s)
+static uint32_t gic_acknowledge_irq(gic_state *s, int cpu)
 {
     int new_irq;
-    new_irq = s->current_pending;
-    if (new_irq == 1023 || s->priority[new_irq] >= s->running_priority) {
+    int cm = 1 << cpu;
+    new_irq = s->current_pending[cpu];
+    if (new_irq == 1023
+            || GIC_GET_PRIORITY(new_irq, cpu) >= s->running_priority[cpu]) {
         DPRINTF("ACK no pending IRQ\n");
         return 1023;
     }
-    qemu_irq_lower(s->parent_irq);
-    s->last_active[new_irq] = s->running_irq;
-    /* For level triggered interrupts we clear the pending bit while
-       the interrupt is active.  */
-    GIC_CLEAR_PENDING(new_irq);
-    gic_set_running_irq(s, new_irq);
+    s->last_active[new_irq][cpu] = s->running_irq[cpu];
+    /* Clear pending flags for both level and edge triggered interrupts.
+       Level triggered IRQs will be reasserted once they become inactive.  */
+    GIC_CLEAR_PENDING(new_irq, GIC_TEST_MODEL(new_irq) ? ALL_CPU_MASK : cm);
+    gic_set_running_irq(s, cpu, new_irq);
     DPRINTF("ACK %d\n", new_irq);
     return new_irq;
 }
 
-static void gic_complete_irq(gic_state * s, int irq)
+static void gic_complete_irq(gic_state * s, int cpu, int irq)
 {
     int update = 0;
+    int cm = 1 << cpu;
     DPRINTF("EOI %d\n", irq);
-    if (s->running_irq == 1023)
+    if (s->running_irq[cpu] == 1023)
         return; /* No active IRQ.  */
     if (irq != 1023) {
         /* Mark level triggered interrupts as pending if they are still
            raised.  */
         if (!GIC_TEST_TRIGGER(irq) && GIC_TEST_ENABLED(irq)
-                && GIC_TEST_LEVEL(irq)) {
-            GIC_SET_PENDING(irq);
+                && GIC_TEST_LEVEL(irq, cm) && (GIC_TARGET(irq) & cm) != 0) {
+            DPRINTF("Set %d pending mask %x\n", irq, cm);
+            GIC_SET_PENDING(irq, cm);
             update = 1;
         }
     }
-    if (irq != s->running_irq) {
+    if (irq != s->running_irq[cpu]) {
         /* Complete an IRQ that is not currently running.  */
-        int tmp = s->running_irq;
-        while (s->last_active[tmp] != 1023) {
-            if (s->last_active[tmp] == irq) {
-                s->last_active[tmp] = s->last_active[irq];
+        int tmp = s->running_irq[cpu];
+        while (s->last_active[tmp][cpu] != 1023) {
+            if (s->last_active[tmp][cpu] == irq) {
+                s->last_active[tmp][cpu] = s->last_active[irq][cpu];
                 break;
             }
-            tmp = s->last_active[tmp];
+            tmp = s->last_active[tmp][cpu];
         }
         if (update) {
             gic_update(s);
         }
     } else {
         /* Complete the current running IRQ.  */
-        gic_set_running_irq(s, s->last_active[s->running_irq]);
+        gic_set_running_irq(s, cpu, s->last_active[s->running_irq[cpu]][cpu]);
     }
 }
 
@@ -198,15 +246,22 @@
     uint32_t res;
     int irq;
     int i;
+    int cpu;
+    int cm;
+    int mask;
 
-    offset -= s->base + 0x1000;
+    cpu = gic_get_current_cpu();
+    cm = 1 << cpu;
+    offset -= s->base + GIC_DIST_OFFSET;
     if (offset < 0x100) {
+#ifndef NVIC
         if (offset == 0)
             return s->enabled;
         if (offset == 4)
-            return (GIC_NIRQ / 32) - 1;
+            return ((GIC_NIRQ / 32) - 1) | ((NCPU - 1) << 5);
         if (offset < 0x08)
             return 0;
+#endif
         goto bad_reg;
     } else if (offset < 0x200) {
         /* Interrupt Set/Clear Enable.  */
@@ -214,6 +269,7 @@
             irq = (offset - 0x100) * 8;
         else
             irq = (offset - 0x180) * 8;
+        irq += GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
         res = 0;
@@ -228,40 +284,48 @@
             irq = (offset - 0x200) * 8;
         else
             irq = (offset - 0x280) * 8;
+        irq += GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
         res = 0;
+        mask = (irq < 32) ?  cm : ALL_CPU_MASK;
         for (i = 0; i < 8; i++) {
-            if (GIC_TEST_PENDING(irq + i)) {
+            if (GIC_TEST_PENDING(irq + i, mask)) {
                 res |= (1 << i);
             }
         }
     } else if (offset < 0x400) {
         /* Interrupt Active.  */
-        irq = (offset - 0x300) * 8;
+        irq = (offset - 0x300) * 8 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
         res = 0;
+        mask = (irq < 32) ?  cm : ALL_CPU_MASK;
         for (i = 0; i < 8; i++) {
-            if (GIC_TEST_ACTIVE(irq + i)) {
+            if (GIC_TEST_ACTIVE(irq + i, mask)) {
                 res |= (1 << i);
             }
         }
     } else if (offset < 0x800) {
         /* Interrupt Priority.  */
-        irq = offset - 0x400;
+        irq = (offset - 0x400) + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
-        res = s->priority[irq];
+        res = GIC_GET_PRIORITY(irq, cpu);
+#ifndef NVIC
     } else if (offset < 0xc00) {
         /* Interrupt CPU Target.  */
-        irq = offset - 0x800;
+        irq = (offset - 0x800) + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
-        res = s->irq_target[irq];
+        if (irq >= 29 && irq <= 31) {
+            res = cm;
+        } else {
+            res = GIC_TARGET(irq);
+        }
     } else if (offset < 0xf00) {
         /* Interrupt Configuration.  */
-        irq = (offset - 0xc00) * 2;
+        irq = (offset - 0xc00) * 2 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
         res = 0;
@@ -271,6 +335,7 @@
             if (GIC_TEST_TRIGGER(irq + i))
                 res |= (2 << (i * 2));
         }
+#endif
     } else if (offset < 0xfe0) {
         goto bad_reg;
     } else /* offset >= 0xfe0 */ {
@@ -282,7 +347,7 @@
     }
     return res;
 bad_reg:
-    cpu_abort (cpu_single_env, "gic_dist_readb: Bad offset %x\n", offset);
+    cpu_abort(cpu_single_env, "gic_dist_readb: Bad offset %x\n", (int)offset);
     return 0;
 }
 
@@ -297,6 +362,13 @@
 static uint32_t gic_dist_readl(void *opaque, target_phys_addr_t offset)
 {
     uint32_t val;
+#ifdef NVIC
+    gic_state *s = (gic_state *)opaque;
+    uint32_t addr;
+    addr = offset - s->base;
+    if (addr < 0x100 || addr > 0xd00)
+        return nvic_readl(s->nvic, addr);
+#endif
     val = gic_dist_readw(opaque, offset);
     val |= gic_dist_readw(opaque, offset + 2) << 16;
     return val;
@@ -308,9 +380,14 @@
     gic_state *s = (gic_state *)opaque;
     int irq;
     int i;
+    int cpu;
 
-    offset -= s->base + 0x1000;
+    cpu = gic_get_current_cpu();
+    offset -= s->base + GIC_DIST_OFFSET;
     if (offset < 0x100) {
+#ifdef NVIC
+        goto bad_reg;
+#else
         if (offset == 0) {
             s->enabled = (value & 1);
             DPRINTF("Distribution %sabled\n", s->enabled ? "En" : "Dis");
@@ -319,27 +396,36 @@
         } else {
             goto bad_reg;
         }
+#endif
     } else if (offset < 0x180) {
         /* Interrupt Set Enable.  */
-        irq = (offset - 0x100) * 8;
+        irq = (offset - 0x100) * 8 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
+        if (irq < 16)
+          value = 0xff;
         for (i = 0; i < 8; i++) {
             if (value & (1 << i)) {
+                int mask = (irq < 32) ? (1 << cpu) : GIC_TARGET(irq);
                 if (!GIC_TEST_ENABLED(irq + i))
                     DPRINTF("Enabled IRQ %d\n", irq + i);
                 GIC_SET_ENABLED(irq + i);
                 /* If a raised level triggered IRQ enabled then mark
                    is as pending.  */
-                if (GIC_TEST_LEVEL(irq + i) && !GIC_TEST_TRIGGER(irq + i))
-                    GIC_SET_PENDING(irq + i);
+                if (GIC_TEST_LEVEL(irq + i, mask)
+                        && !GIC_TEST_TRIGGER(irq + i)) {
+                    DPRINTF("Set %d pending mask %x\n", irq + i, mask);
+                    GIC_SET_PENDING(irq + i, mask);
+                }
             }
         }
     } else if (offset < 0x200) {
         /* Interrupt Clear Enable.  */
-        irq = (offset - 0x180) * 8;
+        irq = (offset - 0x180) * 8 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
+        if (irq < 16)
+          value = 0;
         for (i = 0; i < 8; i++) {
             if (value & (1 << i)) {
                 if (GIC_TEST_ENABLED(irq + i))
@@ -349,22 +435,28 @@
         }
     } else if (offset < 0x280) {
         /* Interrupt Set Pending.  */
-        irq = (offset - 0x200) * 8;
+        irq = (offset - 0x200) * 8 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
+        if (irq < 16)
+          irq = 0;
+
         for (i = 0; i < 8; i++) {
             if (value & (1 << i)) {
-                GIC_SET_PENDING(irq + i);
+                GIC_SET_PENDING(irq + i, GIC_TARGET(irq));
             }
         }
     } else if (offset < 0x300) {
         /* Interrupt Clear Pending.  */
-        irq = (offset - 0x280) * 8;
+        irq = (offset - 0x280) * 8 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
         for (i = 0; i < 8; i++) {
+            /* ??? This currently clears the pending bit for all CPUs, even
+               for per-CPU interrupts.  It's unclear whether this is the
+               corect behavior.  */
             if (value & (1 << i)) {
-                GIC_CLEAR_PENDING(irq + i);
+                GIC_CLEAR_PENDING(irq + i, ALL_CPU_MASK);
             }
         }
     } else if (offset < 0x400) {
@@ -372,21 +464,32 @@
         goto bad_reg;
     } else if (offset < 0x800) {
         /* Interrupt Priority.  */
-        irq = offset - 0x400;
+        irq = (offset - 0x400) + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
-        s->priority[irq] = value;
+        if (irq < 32) {
+            s->priority1[irq][cpu] = value;
+        } else {
+            s->priority2[irq - 32] = value;
+        }
+#ifndef NVIC
     } else if (offset < 0xc00) {
         /* Interrupt CPU Target.  */
-        irq = offset - 0x800;
+        irq = (offset - 0x800) + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
-        s->irq_target[irq] = value;
+        if (irq < 29)
+            value = 0;
+        else if (irq < 32)
+            value = ALL_CPU_MASK;
+        s->irq_target[irq] = value & ALL_CPU_MASK;
     } else if (offset < 0xf00) {
         /* Interrupt Configuration.  */
-        irq = (offset - 0xc00) * 4;
+        irq = (offset - 0xc00) * 4 + GIC_BASE_IRQ;
         if (irq >= GIC_NIRQ)
             goto bad_reg;
+        if (irq < 32)
+            value |= 0xaa;
         for (i = 0; i < 4; i++) {
             if (value & (1 << (i * 2))) {
                 GIC_SET_MODEL(irq + i);
@@ -399,25 +502,20 @@
                 GIC_CLEAR_TRIGGER(irq + i);
             }
         }
+#endif
     } else {
-        /* 0xf00 is only handled for word writes.  */
+        /* 0xf00 is only handled for 32-bit writes.  */
         goto bad_reg;
     }
     gic_update(s);
     return;
 bad_reg:
-    cpu_abort (cpu_single_env, "gic_dist_writeb: Bad offset %x\n", offset);
+    cpu_abort(cpu_single_env, "gic_dist_writeb: Bad offset %x\n", (int)offset);
 }
 
 static void gic_dist_writew(void *opaque, target_phys_addr_t offset,
                             uint32_t value)
 {
-    gic_state *s = (gic_state *)opaque;
-    if (offset - s->base == 0xf00) {
-        GIC_SET_PENDING(value & 0x3ff);
-        gic_update(s);
-        return;
-    }
     gic_dist_writeb(opaque, offset, value & 0xff);
     gic_dist_writeb(opaque, offset + 1, value >> 8);
 }
@@ -425,6 +523,41 @@
 static void gic_dist_writel(void *opaque, target_phys_addr_t offset,
                             uint32_t value)
 {
+    gic_state *s = (gic_state *)opaque;
+#ifdef NVIC
+    uint32_t addr;
+    addr = offset - s->base;
+    if (addr < 0x100 || (addr > 0xd00 && addr != 0xf00)) {
+        nvic_writel(s->nvic, addr, value);
+        return;
+    }
+#endif
+    if (offset - s->base == GIC_DIST_OFFSET + 0xf00) {
+        int cpu;
+        int irq;
+        int mask;
+
+        cpu = gic_get_current_cpu();
+        irq = value & 0x3ff;
+        switch ((value >> 24) & 3) {
+        case 0:
+            mask = (value >> 16) & ALL_CPU_MASK;
+            break;
+        case 1:
+            mask = 1 << cpu;
+            break;
+        case 2:
+            mask = ALL_CPU_MASK ^ (1 << cpu);
+            break;
+        default:
+            DPRINTF("Bad Soft Int target filter\n");
+            mask = ALL_CPU_MASK;
+            break;
+        }
+        GIC_SET_PENDING(irq, mask);
+        gic_update(s);
+        return;
+    }
     gic_dist_writew(opaque, offset, value & 0xffff);
     gic_dist_writew(opaque, offset + 2, value >> 16);
 }
@@ -441,105 +574,100 @@
    gic_dist_writel
 };
 
-static uint32_t gic_cpu_read(void *opaque, target_phys_addr_t offset)
+#ifndef NVIC
+static uint32_t gic_cpu_read(gic_state *s, int cpu, int offset)
 {
-    gic_state *s = (gic_state *)opaque;
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* Control */
-        return s->cpu_enabled;
+        return s->cpu_enabled[cpu];
     case 0x04: /* Priority mask */
-        return s->priority_mask;
+        return s->priority_mask[cpu];
     case 0x08: /* Binary Point */
         /* ??? Not implemented.  */
         return 0;
     case 0x0c: /* Acknowledge */
-        return gic_acknowledge_irq(s);
+        return gic_acknowledge_irq(s, cpu);
     case 0x14: /* Runing Priority */
-        return s->running_priority;
+        return s->running_priority[cpu];
     case 0x18: /* Highest Pending Interrupt */
-        return s->current_pending;
+        return s->current_pending[cpu];
     default:
-        cpu_abort (cpu_single_env, "gic_cpu_read: Bad offset %x\n", offset);
+        cpu_abort(cpu_single_env, "gic_cpu_read: Bad offset %x\n",
+                  (int)offset);
         return 0;
     }
 }
 
-static void gic_cpu_write(void *opaque, target_phys_addr_t offset,
-                          uint32_t value)
+static void gic_cpu_write(gic_state *s, int cpu, int offset, uint32_t value)
 {
-    gic_state *s = (gic_state *)opaque;
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* Control */
-        s->cpu_enabled = (value & 1);
+        s->cpu_enabled[cpu] = (value & 1);
         DPRINTF("CPU %sabled\n", s->cpu_enabled ? "En" : "Dis");
         break;
     case 0x04: /* Priority mask */
-        s->priority_mask = (value & 0x3ff);
+        s->priority_mask[cpu] = (value & 0xff);
         break;
     case 0x08: /* Binary Point */
         /* ??? Not implemented.  */
         break;
     case 0x10: /* End Of Interrupt */
-        return gic_complete_irq(s, value & 0x3ff);
+        return gic_complete_irq(s, cpu, value & 0x3ff);
     default:
-        cpu_abort (cpu_single_env, "gic_cpu_write: Bad offset %x\n", offset);
+        cpu_abort(cpu_single_env, "gic_cpu_write: Bad offset %x\n",
+                  (int)offset);
         return;
     }
     gic_update(s);
 }
+#endif
 
-static CPUReadMemoryFunc *gic_cpu_readfn[] = {
-   gic_cpu_read,
-   gic_cpu_read,
-   gic_cpu_read
-};
-
-static CPUWriteMemoryFunc *gic_cpu_writefn[] = {
-   gic_cpu_write,
-   gic_cpu_write,
-   gic_cpu_write
-};
-
 static void gic_reset(gic_state *s)
 {
     int i;
     memset(s->irq_state, 0, GIC_NIRQ * sizeof(gic_irq_state));
-    s->priority_mask = 0xf0;
-    s->current_pending = 1023;
-    s->running_irq = 1023;
-    s->running_priority = 0x100;
+    for (i = 0 ; i < NCPU; i++) {
+        s->priority_mask[i] = 0xf0;
+        s->current_pending[i] = 1023;
+        s->running_irq[i] = 1023;
+        s->running_priority[i] = 0x100;
+#ifdef NVIC
+        /* The NVIC doesn't have per-cpu interfaces, so enable by default.  */
+        s->cpu_enabled[i] = 1;
+#else
+        s->cpu_enabled[i] = 0;
+#endif
+    }
     for (i = 0; i < 15; i++) {
         GIC_SET_ENABLED(i);
         GIC_SET_TRIGGER(i);
     }
+#ifdef NVIC
+    /* The NVIC is always enabled.  */
+    s->enabled = 1;
+#else
     s->enabled = 0;
-    s->cpu_enabled = 0;
+#endif
 }
 
-qemu_irq *arm_gic_init(uint32_t base, qemu_irq parent_irq)
+static gic_state *gic_init(uint32_t base, qemu_irq *parent_irq)
 {
     gic_state *s;
-    qemu_irq *qi;
     int iomemtype;
+    int i;
 
     s = (gic_state *)qemu_mallocz(sizeof(gic_state));
     if (!s)
         return NULL;
-    qi = qemu_allocate_irqs(gic_set_irq, s, GIC_NIRQ);
-    s->parent_irq = parent_irq;
-    if (base != 0xffffffff) {
-        iomemtype = cpu_register_io_memory(0, gic_cpu_readfn,
-                                           gic_cpu_writefn, s);
-        cpu_register_physical_memory(base, 0x00001000, iomemtype);
-        iomemtype = cpu_register_io_memory(0, gic_dist_readfn,
-                                           gic_dist_writefn, s);
-        cpu_register_physical_memory(base + 0x1000, 0x00001000, iomemtype);
-        s->base = base;
-    } else {
-        s->base = 0;
+    s->in = qemu_allocate_irqs(gic_set_irq, s, GIC_NIRQ);
+    for (i = 0; i < NCPU; i++) {
+        s->parent_irq[i] = parent_irq[i];
     }
+    iomemtype = cpu_register_io_memory(0, gic_dist_readfn,
+                                       gic_dist_writefn, s);
+    cpu_register_physical_memory(base + GIC_DIST_OFFSET, 0x00001000,
+                                 iomemtype);
+    s->base = base;
     gic_reset(s);
-    return qi;
+    return s;
 }

Modified: trunk/src/host/qemu-neo1973/hw/arm_sysctl.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/arm_sysctl.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/arm_sysctl.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1,7 +1,7 @@
 /*
  * Status and system control registers for ARM RealView/Versatile boards.
  *
- * Copyright (c) 2006 CodeSourcery.
+ * Copyright (c) 2006-2007 CodeSourcery.
  * Written by Paul Brook
  *
  * This code is licenced under the GPL.
@@ -200,6 +200,9 @@
         return;
     s->base = base;
     s->sys_id = sys_id;
+    /* The MPcore bootloader uses these flags to start secondary CPUs.
+       We don't use a bootloader, so do this here.  */
+    s->flags = 3;
     iomemtype = cpu_register_io_memory(0, arm_sysctl_readfn,
                                        arm_sysctl_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);

Added: trunk/src/host/qemu-neo1973/hw/armv7m.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/armv7m.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/armv7m.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,204 @@
+/*
+ * ARMV7M System emulation.
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "vl.h"
+
+/* Bitbanded IO.  Each word corresponds to a single bit.  */
+
+/* Get the byte address of the real memory for a bitband acess.  */
+static inline uint32_t bitband_addr(uint32_t addr)
+{
+    uint32_t res;
+
+    res = addr & 0xe0000000;
+    res |= (addr & 0x1ffffff) >> 5;
+    return res;
+
+}
+
+static uint32_t bitband_readb(void *opaque, target_phys_addr_t offset)
+{
+    uint8_t v;
+    cpu_physical_memory_read(bitband_addr(offset), &v, 1);
+    return (v & (1 << ((offset >> 2) & 7))) != 0;
+}
+
+static void bitband_writeb(void *opaque, target_phys_addr_t offset,
+                           uint32_t value)
+{
+    uint32_t addr;
+    uint8_t mask;
+    uint8_t v;
+    addr = bitband_addr(offset);
+    mask = (1 << ((offset >> 2) & 7));
+    cpu_physical_memory_read(addr, &v, 1);
+    if (value & 1)
+        v |= mask;
+    else
+        v &= ~mask;
+    cpu_physical_memory_write(addr, &v, 1);
+}
+
+static uint32_t bitband_readw(void *opaque, target_phys_addr_t offset)
+{
+    uint32_t addr;
+    uint16_t mask;
+    uint16_t v;
+    addr = bitband_addr(offset) & ~1;
+    mask = (1 << ((offset >> 2) & 15));
+    mask = tswap16(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 2);
+    return (v & mask) != 0;
+}
+
+static void bitband_writew(void *opaque, target_phys_addr_t offset,
+                           uint32_t value)
+{
+    uint32_t addr;
+    uint16_t mask;
+    uint16_t v;
+    addr = bitband_addr(offset) & ~1;
+    mask = (1 << ((offset >> 2) & 15));
+    mask = tswap16(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 2);
+    if (value & 1)
+        v |= mask;
+    else
+        v &= ~mask;
+    cpu_physical_memory_write(addr, (uint8_t *)&v, 2);
+}
+
+static uint32_t bitband_readl(void *opaque, target_phys_addr_t offset)
+{
+    uint32_t addr;
+    uint32_t mask;
+    uint32_t v;
+    addr = bitband_addr(offset) & ~3;
+    mask = (1 << ((offset >> 2) & 31));
+    mask = tswap32(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 4);
+    return (v & mask) != 0;
+}
+
+static void bitband_writel(void *opaque, target_phys_addr_t offset,
+                           uint32_t value)
+{
+    uint32_t addr;
+    uint32_t mask;
+    uint32_t v;
+    addr = bitband_addr(offset) & ~3;
+    mask = (1 << ((offset >> 2) & 31));
+    mask = tswap32(mask);
+    cpu_physical_memory_read(addr, (uint8_t *)&v, 4);
+    if (value & 1)
+        v |= mask;
+    else
+        v &= ~mask;
+    cpu_physical_memory_write(addr, (uint8_t *)&v, 4);
+}
+
+static CPUReadMemoryFunc *bitband_readfn[] = {
+   bitband_readb,
+   bitband_readw,
+   bitband_readl
+};
+
+static CPUWriteMemoryFunc *bitband_writefn[] = {
+   bitband_writeb,
+   bitband_writew,
+   bitband_writel
+};
+
+static void armv7m_bitband_init(void)
+{
+    int iomemtype;
+
+    iomemtype = cpu_register_io_memory(0, bitband_readfn, bitband_writefn,
+                                       NULL);
+    cpu_register_physical_memory(0x22000000, 0x02000000, iomemtype);
+    cpu_register_physical_memory(0x42000000, 0x02000000, iomemtype);
+}
+
+/* Board init.  */
+/* Init CPU and memory for a v7-M based board.
+   flash_size and sram_size are in kb.
+   Returns the NVIC array.  */
+
+qemu_irq *armv7m_init(int flash_size, int sram_size,
+                      const char *kernel_filename, const char *cpu_model)
+{
+    CPUState *env;
+    qemu_irq *pic;
+    uint32_t pc;
+    int image_size;
+    uint64_t entry;
+    uint64_t lowaddr;
+
+    flash_size *= 1024;
+    sram_size *= 1024;
+
+    if (!cpu_model)
+	cpu_model = "cortex-m3";
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
+
+#if 0
+    /* > 32Mb SRAM gets complicated because it overlaps the bitband area.
+       We don't have proper commandline options, so allocate half of memory
+       as SRAM, up to a maximum of 32Mb, and the rest as code.  */
+    if (ram_size > (512 + 32) * 1024 * 1024)
+        ram_size = (512 + 32) * 1024 * 1024;
+    sram_size = (ram_size / 2) & TARGET_PAGE_MASK;
+    if (sram_size > 32 * 1024 * 1024)
+        sram_size = 32 * 1024 * 1024;
+    code_size = ram_size - sram_size;
+#endif
+
+    /* Flash programming is done via the SCU, so pretend it is ROM.  */
+    cpu_register_physical_memory(0, flash_size, IO_MEM_ROM);
+    cpu_register_physical_memory(0x20000000, sram_size,
+                                 flash_size + IO_MEM_RAM);
+    armv7m_bitband_init();
+
+    pic = armv7m_nvic_init(env);
+
+    image_size = load_elf(kernel_filename, 0, &entry, &lowaddr, NULL);
+    if (image_size < 0) {
+        image_size = load_image(kernel_filename, phys_ram_base);
+	lowaddr = 0;
+    }
+    if (image_size < 0) {
+        fprintf(stderr, "qemu: could not load kernel '%s'\n",
+                kernel_filename);
+        exit(1);
+    }
+
+    /* If the image was loaded at address zero then assume it is a
+       regular ROM image and perform the normal CPU reset sequence.
+       Otherwise jump directly to the entry point.  */
+    if (lowaddr == 0) {
+	env->regs[13] = tswap32(*(uint32_t *)phys_ram_base);
+	pc = tswap32(*(uint32_t *)(phys_ram_base + 4));
+    } else {
+	pc = entry;
+    }
+    env->thumb = pc & 1;
+    env->regs[15] = pc & ~1;
+
+    /* Hack to map an additional page of ram at the top of the address
+       space.  This stops qemu complaining about executing code outside RAM
+       when returning from an exception.  */
+    cpu_register_physical_memory(0xfffff000, 0x1000, IO_MEM_RAM + ram_size);
+
+    return pic;
+}
+

Added: trunk/src/host/qemu-neo1973/hw/armv7m_nvic.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/armv7m_nvic.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/armv7m_nvic.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,381 @@
+/*
+ * ARM Nested Vectored Interrupt Controller
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ *
+ * The ARMv7M System controller is fairly tightly tied in with the
+ * NVIC.  Much of that is also implemented here.
+ */
+
+#include "vl.h"
+#include "arm_pic.h"
+
+#define GIC_NIRQ 64
+#define NCPU 1
+#define NVIC 1
+
+/* Only a single "CPU" interface is present.  */
+static inline int
+gic_get_current_cpu(void)
+{
+    return 0;
+}
+
+static uint32_t nvic_readl(void *opaque, uint32_t offset);
+static void nvic_writel(void *opaque, uint32_t offset, uint32_t value);
+
+#include "arm_gic.c"
+
+typedef struct {
+    struct {
+        uint32_t control;
+        uint32_t reload;
+        int64_t tick;
+        QEMUTimer *timer;
+    } systick;
+    gic_state *gic;
+} nvic_state;
+
+/* qemu timers run at 1GHz.   We want something closer to 1MHz.  */
+#define SYSTICK_SCALE 1000ULL
+
+#define SYSTICK_ENABLE    (1 << 0)
+#define SYSTICK_TICKINT   (1 << 1)
+#define SYSTICK_CLKSOURCE (1 << 2)
+#define SYSTICK_COUNTFLAG (1 << 16)
+
+/* Conversion factor from qemu timer to SysTick frequencies.
+   QEMU uses a base of 1GHz, so these give 20MHz and 1MHz for core and
+   reference frequencies.  */
+
+static inline int64_t systick_scale(nvic_state *s)
+{
+    if (s->systick.control & SYSTICK_CLKSOURCE)
+        return 50;
+    else
+        return 1000;
+}
+
+static void systick_reload(nvic_state *s, int reset)
+{
+    if (reset)
+        s->systick.tick = qemu_get_clock(vm_clock);
+    s->systick.tick += (s->systick.reload + 1) * systick_scale(s);
+    qemu_mod_timer(s->systick.timer, s->systick.tick);
+}
+
+static void systick_timer_tick(void * opaque)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    s->systick.control |= SYSTICK_COUNTFLAG;
+    if (s->systick.control & SYSTICK_TICKINT) {
+        /* Trigger the interrupt.  */
+        armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK);
+    }
+    if (s->systick.reload == 0) {
+        s->systick.control &= ~SYSTICK_ENABLE;
+    } else {
+        systick_reload(s, 0);
+    }
+}
+
+/* The external routines use the hardware vector numbering, ie. the first
+   IRQ is #16.  The internal GIC routines use #32 as the first IRQ.  */
+void armv7m_nvic_set_pending(void *opaque, int irq)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    if (irq >= 16)
+        irq += 16;
+    gic_set_pending_private(s->gic, 0, irq);
+}
+
+/* Make pending IRQ active.  */
+int armv7m_nvic_acknowledge_irq(void *opaque)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    uint32_t irq;
+
+    irq = gic_acknowledge_irq(s->gic, 0);
+    if (irq == 1023)
+        cpu_abort(cpu_single_env, "Interrupt but no vector\n");
+    if (irq >= 32)
+        irq -= 16;
+    return irq;
+}
+
+void armv7m_nvic_complete_irq(void *opaque, int irq)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    if (irq >= 16)
+        irq += 16;
+    gic_complete_irq(s->gic, 0, irq);
+}
+
+static uint32_t nvic_readl(void *opaque, uint32_t offset)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    uint32_t val;
+    int irq;
+
+    switch (offset) {
+    case 4: /* Interrupt Control Type.  */
+        return (GIC_NIRQ / 32) - 1;
+    case 0x10: /* SysTick Control and Status.  */
+        val = s->systick.control;
+        s->systick.control &= ~SYSTICK_COUNTFLAG;
+        return val;
+    case 0x14: /* SysTick Reload Value.  */
+        return s->systick.reload;
+    case 0x18: /* SysTick Current Value.  */
+        {
+            int64_t t;
+            if ((s->systick.control & SYSTICK_ENABLE) == 0)
+                return 0;
+            t = qemu_get_clock(vm_clock);
+            if (t >= s->systick.tick)
+                return 0;
+            val = ((s->systick.tick - (t + 1)) / systick_scale(s)) + 1;
+            /* The interrupt in triggered when the timer reaches zero.
+               However the counter is not reloaded until the next clock
+               tick.  This is a hack to return zero during the first tick.  */
+            if (val > s->systick.reload)
+                val = 0;
+            return val;
+        }
+    case 0x1c: /* SysTick Calibration Value.  */
+        return 10000;
+    case 0xd00: /* CPUID Base.  */
+        return cpu_single_env->cp15.c0_cpuid;
+    case 0xd04: /* Interrypt Control State.  */
+        /* VECTACTIVE */
+        val = s->gic->running_irq[0];
+        if (val == 1023) {
+            val = 0;
+        } else if (val >= 32) {
+            val -= 16;
+        }
+        /* RETTOBASE */
+        if (s->gic->running_irq[0] == 1023
+                || s->gic->last_active[s->gic->running_irq[0]][0] == 1023) {
+            val |= (1 << 11);
+        }
+        /* VECTPENDING */
+        if (s->gic->current_pending[0] != 1023)
+            val |= (s->gic->current_pending[0] << 12);
+        /* ISRPENDING */
+        for (irq = 32; irq < GIC_NIRQ; irq++) {
+            if (s->gic->irq_state[irq].pending) {
+                val |= (1 << 22);
+                break;
+            }
+        }
+        /* PENDSTSET */
+        if (s->gic->irq_state[ARMV7M_EXCP_SYSTICK].pending)
+            val |= (1 << 26);
+        /* PENDSVSET */
+        if (s->gic->irq_state[ARMV7M_EXCP_PENDSV].pending)
+            val |= (1 << 28);
+        /* NMIPENDSET */
+        if (s->gic->irq_state[ARMV7M_EXCP_NMI].pending)
+            val |= (1 << 31);
+        return val;
+    case 0xd08: /* Vector Table Offset.  */
+        return cpu_single_env->v7m.vecbase;
+    case 0xd0c: /* Application Interrupt/Reset Control.  */
+        return 0xfa05000;
+    case 0xd10: /* System Control.  */
+        /* TODO: Implement SLEEPONEXIT.  */
+        return 0;
+    case 0xd14: /* Configuration Control.  */
+        /* TODO: Implement Configuration Control bits.  */
+        return 0;
+    case 0xd18: case 0xd1c: case 0xd20: /* System Handler Priority.  */
+        irq = offset - 0xd14;
+        val = 0;
+        val = s->gic->priority1[irq++][0];
+        val = s->gic->priority1[irq++][0] << 8;
+        val = s->gic->priority1[irq++][0] << 16;
+        val = s->gic->priority1[irq][0] << 24;
+        return val;
+    case 0xd24: /* System Handler Status.  */
+        val = 0;
+        if (s->gic->irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0);
+        if (s->gic->irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1);
+        if (s->gic->irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3);
+        if (s->gic->irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7);
+        if (s->gic->irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8);
+        if (s->gic->irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10);
+        if (s->gic->irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11);
+        if (s->gic->irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12);
+        if (s->gic->irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13);
+        if (s->gic->irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14);
+        if (s->gic->irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15);
+        if (s->gic->irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16);
+        if (s->gic->irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17);
+        if (s->gic->irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18);
+        return val;
+    case 0xd28: /* Configurable Fault Status.  */
+        /* TODO: Implement Fault Status.  */
+        cpu_abort(cpu_single_env,
+                  "Not implemented: Configurable Fault Status.");
+        return 0;
+    case 0xd2c: /* Hard Fault Status.  */
+    case 0xd30: /* Debug Fault Status.  */
+    case 0xd34: /* Mem Manage Address.  */
+    case 0xd38: /* Bus Fault Address.  */
+    case 0xd3c: /* Aux Fault Status.  */
+        /* TODO: Implement fault status registers.  */
+        goto bad_reg;
+    case 0xd40: /* PFR0.  */
+        return 0x00000030;
+    case 0xd44: /* PRF1.  */
+        return 0x00000200;
+    case 0xd48: /* DFR0.  */
+        return 0x00100000;
+    case 0xd4c: /* AFR0.  */
+        return 0x00000000;
+    case 0xd50: /* MMFR0.  */
+        return 0x00000030;
+    case 0xd54: /* MMFR1.  */
+        return 0x00000000;
+    case 0xd58: /* MMFR2.  */
+        return 0x00000000;
+    case 0xd5c: /* MMFR3.  */
+        return 0x00000000;
+    case 0xd60: /* ISAR0.  */
+        return 0x01141110;
+    case 0xd64: /* ISAR1.  */
+        return 0x02111000;
+    case 0xd68: /* ISAR2.  */
+        return 0x21112231;
+    case 0xd6c: /* ISAR3.  */
+        return 0x01111110;
+    case 0xd70: /* ISAR4.  */
+        return 0x01310102;
+    /* TODO: Implement debug registers.  */
+    default:
+    bad_reg:
+        cpu_abort(cpu_single_env, "NVIC: Bad read offset 0x%x\n", offset);
+    }
+}
+
+static void nvic_writel(void *opaque, uint32_t offset, uint32_t value)
+{
+    nvic_state *s = (nvic_state *)opaque;
+    uint32_t oldval;
+    switch (offset) {
+    case 0x10: /* SysTick Control and Status.  */
+        oldval = s->systick.control;
+        s->systick.control &= 0xfffffff8;
+        s->systick.control |= value & 7;
+        if ((oldval ^ value) & SYSTICK_ENABLE) {
+            int64_t now = qemu_get_clock(vm_clock);
+            if (value & SYSTICK_ENABLE) {
+                if (s->systick.tick) {
+                    s->systick.tick += now;
+                    qemu_mod_timer(s->systick.timer, s->systick.tick);
+                } else {
+                    systick_reload(s, 1);
+                }
+            } else {
+                qemu_del_timer(s->systick.timer);
+                s->systick.tick -= now;
+                if (s->systick.tick < 0)
+                  s->systick.tick = 0;
+            }
+        } else if ((oldval ^ value) & SYSTICK_CLKSOURCE) {
+            /* This is a hack. Force the timer to be reloaded
+               when the reference clock is changed.  */
+            systick_reload(s, 1);
+        }
+        break;
+    case 0x14: /* SysTick Reload Value.  */
+        s->systick.reload = value;
+        break;
+    case 0x18: /* SysTick Current Value.  Writes reload the timer.  */
+        systick_reload(s, 1);
+        s->systick.control &= ~SYSTICK_COUNTFLAG;
+        break;
+    case 0xd04: /* Interrupt Control State.  */
+        if (value & (1 << 31)) {
+            armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI);
+        }
+        if (value & (1 << 28)) {
+            armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV);
+        } else if (value & (1 << 27)) {
+            s->gic->irq_state[ARMV7M_EXCP_PENDSV].pending = 0;
+            gic_update(s->gic);
+        }
+        if (value & (1 << 26)) {
+            armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK);
+        } else if (value & (1 << 25)) {
+            s->gic->irq_state[ARMV7M_EXCP_SYSTICK].pending = 0;
+            gic_update(s->gic);
+        }
+        break;
+    case 0xd08: /* Vector Table Offset.  */
+        cpu_single_env->v7m.vecbase = value & 0xffffff80;
+        break;
+    case 0xd0c: /* Application Interrupt/Reset Control.  */
+        if ((value >> 16) == 0x05fa) {
+            if (value & 2) {
+                cpu_abort(cpu_single_env, "VECTCLRACTIVE not implemented");
+            }
+            if (value & 5) {
+                cpu_abort(cpu_single_env, "System reset");
+            }
+        }
+        break;
+    case 0xd10: /* System Control.  */
+    case 0xd14: /* Configuration Control.  */
+        /* TODO: Implement control registers.  */
+        goto bad_reg;
+    case 0xd18: case 0xd1c: case 0xd20: /* System Handler Priority.  */
+        {
+            int irq;
+            irq = offset - 0xd14;
+            s->gic->priority1[irq++][0] = value & 0xff;
+            s->gic->priority1[irq++][0] = (value >> 8) & 0xff;
+            s->gic->priority1[irq++][0] = (value >> 16) & 0xff;
+            s->gic->priority1[irq][0] = (value >> 24) & 0xff;
+            gic_update(s->gic);
+        }
+        break;
+    case 0xd24: /* System Handler Control.  */
+        /* TODO: Real hardware allows you to set/clear the active bits
+           under some circumstances.  We don't implement this.  */
+        s->gic->irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
+        s->gic->irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
+        s->gic->irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
+        break;
+    case 0xd28: /* Configurable Fault Status.  */
+    case 0xd2c: /* Hard Fault Status.  */
+    case 0xd30: /* Debug Fault Status.  */
+    case 0xd34: /* Mem Manage Address.  */
+    case 0xd38: /* Bus Fault Address.  */
+    case 0xd3c: /* Aux Fault Status.  */
+        goto bad_reg;
+    default:
+    bad_reg:
+        cpu_abort(cpu_single_env, "NVIC: Bad write offset 0x%x\n", offset);
+    }
+}
+
+qemu_irq *armv7m_nvic_init(CPUState *env)
+{
+    nvic_state *s;
+    qemu_irq *parent;
+
+    parent = arm_pic_init_cpu(env);
+    s = (nvic_state *)qemu_mallocz(sizeof(nvic_state));
+    s->gic = gic_init(0xe000e000, &parent[ARM_PIC_CPU_IRQ]);
+    s->gic->nvic = s;
+    s->systick.timer = qemu_new_timer(vm_clock, systick_timer_tick, s);
+    if (env->v7m.nvic)
+        cpu_abort(env, "CPU can only have one NVIC\n");
+    env->v7m.nvic = s;
+    return s->gic->in;
+}

Added: trunk/src/host/qemu-neo1973/hw/dummy_m68k.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/dummy_m68k.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/dummy_m68k.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,68 @@
+/*
+ * Dummy board with just RAM and CPU for use as an ISS.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ *
+ * This code is licenced under the GPL
+ */
+
+#include "vl.h"
+
+#define KERNEL_LOAD_ADDR 0x10000
+
+/* Board init.  */
+
+static void dummy_m68k_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
+                     const char **fd_filename, int snapshot,
+                     const char *kernel_filename, const char *kernel_cmdline,
+                     const char *initrd_filename, const char *cpu_model)
+{
+    CPUState *env;
+    int kernel_size;
+    uint64_t elf_entry;
+    target_ulong entry;
+
+    if (!cpu_model)
+        cpu_model = "cfv4e";
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find m68k CPU definition\n");
+        exit(1);
+    }
+
+    /* Initialize CPU registers.  */
+    env->vbr = 0;
+
+    /* RAM at address zero */
+    cpu_register_physical_memory(0, ram_size,
+        qemu_ram_alloc(ram_size) | IO_MEM_RAM);
+
+    /* Load kernel.  */
+    if (kernel_filename) {
+        kernel_size = load_elf(kernel_filename, 0, &elf_entry, NULL, NULL);
+        entry = elf_entry;
+        if (kernel_size < 0) {
+            kernel_size = load_uboot(kernel_filename, &entry, NULL);
+        }
+        if (kernel_size < 0) {
+            kernel_size = load_image(kernel_filename,
+                                     phys_ram_base + KERNEL_LOAD_ADDR);
+            entry = KERNEL_LOAD_ADDR;
+        }
+        if (kernel_size < 0) {
+            fprintf(stderr, "qemu: could not load kernel '%s'\n",
+                    kernel_filename);
+            exit(1);
+        }
+    } else {
+        entry = 0;
+    }
+    env->pc = entry;
+}
+
+QEMUMachine dummy_m68k_machine = {
+    "dummy",
+    "Dummy board",
+    dummy_m68k_init,
+};

Modified: trunk/src/host/qemu-neo1973/hw/etraxfs.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/etraxfs.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/etraxfs.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -121,7 +121,7 @@
     if (cpu_model == NULL) {
         cpu_model = "crisv32";
     }
-    env = cpu_init();
+    env = cpu_init(cpu_model);
 /*    register_savevm("cpu", 0, 3, cpu_save, cpu_load, env); */
     qemu_register_reset(main_cpu_reset, env);
     irqs = qemu_allocate_irqs(dummy_cpu_set_irq, env, 32);

Modified: trunk/src/host/qemu-neo1973/hw/gt64xxx.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/gt64xxx.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/gt64xxx.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1109,6 +1109,11 @@
     GT64120State *s;
     PCIDevice *d;
 
+    (void)&pci_host_data_writeb; /* avoid warning */
+    (void)&pci_host_data_writew; /* avoid warning */
+    (void)&pci_host_data_readb; /* avoid warning */
+    (void)&pci_host_data_readw; /* avoid warning */
+
     s = qemu_mallocz(sizeof(GT64120State));
     s->pci = qemu_mallocz(sizeof(GT64120PCIState));
 

Modified: trunk/src/host/qemu-neo1973/hw/integratorcp.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/integratorcp.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/integratorcp.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -99,7 +99,7 @@
         return 0;
     default:
         cpu_abort (cpu_single_env,
-            "integratorcm_read: Unimplemented offset 0x%x\n", offset);
+            "integratorcm_read: Unimplemented offset 0x%x\n", (int)offset);
         return 0;
     }
 }
@@ -207,7 +207,7 @@
         break;
     default:
         cpu_abort (cpu_single_env,
-            "integratorcm_write: Unimplemented offset 0x%x\n", offset);
+            "integratorcm_write: Unimplemented offset 0x%x\n", (int)offset);
         break;
     }
 }
@@ -414,7 +414,8 @@
     case 3: /* CP_DECODE */
         return 0x11;
     default:
-        cpu_abort (cpu_single_env, "icp_control_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "icp_control_read: Bad offset %x\n",
+                   (int)offset);
         return 0;
     }
 }
@@ -431,7 +432,8 @@
         /* Nothing interesting implemented yet.  */
         break;
     default:
-        cpu_abort (cpu_single_env, "icp_control_write: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "icp_control_write: Bad offset %x\n",
+                   (int)offset);
     }
 }
 static CPUReadMemoryFunc *icp_control_readfn[] = {
@@ -473,10 +475,13 @@
     qemu_irq *pic;
     qemu_irq *cpu_pic;
 
-    env = cpu_init();
     if (!cpu_model)
         cpu_model = "arm926";
-    cpu_arm_set_model(env, cpu_model);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     bios_offset = ram_size + vga_ram_size;
     /* ??? On a real system the first 1Mb is mapped as SSRAM or boot flash.  */
     /* ??? RAM shoud repeat to fill physical memory space.  */
@@ -492,8 +497,8 @@
     icp_pic_init(0xca000000, pic[26], NULL);
     icp_pit_init(0x13000000, pic, 5);
     pl031_init(0x15000000, pic[8]);
-    pl011_init(0x16000000, pic[1], serial_hds[0]);
-    pl011_init(0x17000000, pic[2], serial_hds[1]);
+    pl011_init(0x16000000, pic[1], serial_hds[0], PL011_ARM);
+    pl011_init(0x17000000, pic[2], serial_hds[1], PL011_ARM);
     icp_control_init(0xcb000000);
     pl050_init(0x18000000, pic[3], 0);
     pl050_init(0x19000000, pic[4], 1);

Modified: trunk/src/host/qemu-neo1973/hw/mcf5208.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/mcf5208.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/mcf5208.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -209,11 +209,12 @@
     target_ulong entry;
     qemu_irq *pic;
 
-    env = cpu_init();
     if (!cpu_model)
         cpu_model = "m5208";
-    if (cpu_m68k_set_model(env, cpu_model)) {
-        cpu_abort(env, "Unable to find m68k CPU definition\n");
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find m68k CPU definition\n");
+        exit(1);
     }
 
     /* Initialize CPU registers.  */

Modified: trunk/src/host/qemu-neo1973/hw/mips_malta.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/mips_malta.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/mips_malta.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -59,6 +59,13 @@
 
 static PITState *pit;
 
+static struct _loaderparams {
+    int ram_size;
+    const char *kernel_filename;
+    const char *kernel_cmdline;
+    const char *initrd_filename;
+} loaderparams;
+
 /* Malta FPGA */
 static void malta_fpga_update_display(void *opaque)
 {
@@ -534,8 +541,8 @@
     stl_raw(p++, 0x34a50000 | (ENVP_ADDR & 0xffff));               /* ori a1, a1, low(ENVP_ADDR) */
     stl_raw(p++, 0x3c060000 | (((ENVP_ADDR + 8) >> 16) & 0xffff)); /* lui a2, high(ENVP_ADDR + 8) */
     stl_raw(p++, 0x34c60000 | ((ENVP_ADDR + 8) & 0xffff));         /* ori a2, a2, low(ENVP_ADDR + 8) */
-    stl_raw(p++, 0x3c070000 | (env->ram_size >> 16));              /* lui a3, high(env->ram_size) */
-    stl_raw(p++, 0x34e70000 | (env->ram_size & 0xffff));           /* ori a3, a3, low(env->ram_size) */
+    stl_raw(p++, 0x3c070000 | (loaderparams.ram_size >> 16));     /* lui a3, high(ram_size) */
+    stl_raw(p++, 0x34e70000 | (loaderparams.ram_size & 0xffff));  /* ori a3, a3, low(ram_size) */
 
     /* Load BAR registers as done by YAMON */
     stl_raw(p++, 0x3c09b400);                                      /* lui t1, 0xb400 */
@@ -675,48 +682,48 @@
     long initrd_size;
     ram_addr_t initrd_offset;
 
-    if (load_elf(env->kernel_filename, VIRT_TO_PHYS_ADDEND,
+    if (load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,
                  &kernel_entry, &kernel_low, &kernel_high) < 0) {
         fprintf(stderr, "qemu: could not load kernel '%s'\n",
-                env->kernel_filename);
+                loaderparams.kernel_filename);
         exit(1);
     }
 
     /* load initrd */
     initrd_size = 0;
     initrd_offset = 0;
-    if (env->initrd_filename) {
-        initrd_size = get_image_size (env->initrd_filename);
+    if (loaderparams.initrd_filename) {
+        initrd_size = get_image_size (loaderparams.initrd_filename);
         if (initrd_size > 0) {
             initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
-            if (initrd_offset + initrd_size > env->ram_size) {
+            if (initrd_offset + initrd_size > ram_size) {
                 fprintf(stderr,
                         "qemu: memory too small for initial ram disk '%s'\n",
-                        env->initrd_filename);
+                        loaderparams.initrd_filename);
                 exit(1);
             }
-            initrd_size = load_image(env->initrd_filename,
+            initrd_size = load_image(loaderparams.initrd_filename,
                                      phys_ram_base + initrd_offset);
         }
         if (initrd_size == (target_ulong) -1) {
             fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
-                    env->initrd_filename);
+                    loaderparams.initrd_filename);
             exit(1);
         }
     }
 
     /* Store command line.  */
-    prom_set(index++, env->kernel_filename);
+    prom_set(index++, loaderparams.kernel_filename);
     if (initrd_size > 0)
         prom_set(index++, "rd_start=0x" TARGET_FMT_lx " rd_size=%li %s",
                  PHYS_TO_VIRT(initrd_offset), initrd_size,
-                 env->kernel_cmdline);
+                 loaderparams.kernel_cmdline);
     else
-        prom_set(index++, env->kernel_cmdline);
+        prom_set(index++, loaderparams.kernel_cmdline);
 
     /* Setup minimum environment variables */
     prom_set(index++, "memsize");
-    prom_set(index++, "%i", env->ram_size);
+    prom_set(index++, "%i", loaderparams.ram_size);
     prom_set(index++, "modetty0");
     prom_set(index++, "38400n8r");
     prom_set(index++, NULL);
@@ -728,12 +735,11 @@
 {
     CPUState *env = opaque;
     cpu_reset(env);
-    cpu_mips_register(env, NULL);
 
     /* The bootload does not need to be rewritten as it is located in a
        read only location. The kernel location and the arguments table
        location does not change. */
-    if (env->kernel_filename) {
+    if (loaderparams.kernel_filename) {
         env->CP0_Status &= ~((1 << CP0St_BEV) | (1 << CP0St_ERL));
         load_kernel (env);
     }
@@ -754,7 +760,6 @@
     /* fdctrl_t *floppy_controller; */
     MaltaFPGAState *malta_fpga;
     int ret;
-    mips_def_t *def;
     qemu_irq *i8259;
     int piix4_devfn;
     uint8_t *eeprom_buf;
@@ -769,10 +774,11 @@
         cpu_model = "24Kf";
 #endif
     }
-    if (mips_find_by_name(cpu_model, &def) != 0)
-        def = NULL;
-    env = cpu_init();
-    cpu_mips_register(env, def);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
     qemu_register_reset(main_cpu_reset, env);
 
@@ -818,10 +824,10 @@
     /* If a kernel image has been specified, write a small bootloader
        to the flash location. */
     if (kernel_filename) {
-        env->ram_size = ram_size;
-        env->kernel_filename = kernel_filename;
-        env->kernel_cmdline = kernel_cmdline;
-        env->initrd_filename = initrd_filename;
+        loaderparams.ram_size = ram_size;
+        loaderparams.kernel_filename = kernel_filename;
+        loaderparams.kernel_cmdline = kernel_cmdline;
+        loaderparams.initrd_filename = initrd_filename;
         kernel_entry = load_kernel(env);
         env->CP0_Status &= ~((1 << CP0St_BEV) | (1 << CP0St_ERL));
         write_bootloader(env, bios_offset, kernel_entry);

Modified: trunk/src/host/qemu-neo1973/hw/mips_mipssim.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/mips_mipssim.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/mips_mipssim.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -40,6 +40,13 @@
 
 #define VIRT_TO_PHYS_ADDEND (-((int64_t)(int32_t)0x80000000))
 
+static struct _loaderparams {
+    int ram_size;
+    const char *kernel_filename;
+    const char *kernel_cmdline;
+    const char *initrd_filename;
+} loaderparams;
+
 static void load_kernel (CPUState *env)
 {
     int64_t entry, kernel_low, kernel_high;
@@ -47,7 +54,7 @@
     long initrd_size;
     ram_addr_t initrd_offset;
 
-    kernel_size = load_elf(env->kernel_filename, VIRT_TO_PHYS_ADDEND,
+    kernel_size = load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,
                            &entry, &kernel_low, &kernel_high);
     if (kernel_size >= 0) {
         if ((entry & ~0x7fffffffULL) == 0x80000000)
@@ -55,29 +62,29 @@
         env->PC[env->current_tc] = entry;
     } else {
         fprintf(stderr, "qemu: could not load kernel '%s'\n",
-                env->kernel_filename);
+                loaderparams.kernel_filename);
         exit(1);
     }
 
     /* load initrd */
     initrd_size = 0;
     initrd_offset = 0;
-    if (env->initrd_filename) {
-        initrd_size = get_image_size (env->initrd_filename);
+    if (loaderparams.initrd_filename) {
+        initrd_size = get_image_size (loaderparams.initrd_filename);
         if (initrd_size > 0) {
             initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
-            if (initrd_offset + initrd_size > env->ram_size) {
+            if (initrd_offset + initrd_size > loaderparams.ram_size) {
                 fprintf(stderr,
                         "qemu: memory too small for initial ram disk '%s'\n",
-                        env->initrd_filename);
+                        loaderparams.initrd_filename);
                 exit(1);
             }
-            initrd_size = load_image(env->initrd_filename,
+            initrd_size = load_image(loaderparams.initrd_filename,
                                      phys_ram_base + initrd_offset);
         }
         if (initrd_size == (target_ulong) -1) {
             fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
-                    env->initrd_filename);
+                    loaderparams.initrd_filename);
             exit(1);
         }
     }
@@ -87,9 +94,8 @@
 {
     CPUState *env = opaque;
     cpu_reset(env);
-    cpu_mips_register(env, NULL);
 
-    if (env->kernel_filename)
+    if (loaderparams.kernel_filename)
         load_kernel (env);
 }
 
@@ -103,7 +109,6 @@
     unsigned long bios_offset;
     CPUState *env;
     int bios_size;
-    mips_def_t *def;
 
     /* Init CPUs. */
     if (cpu_model == NULL) {
@@ -113,10 +118,11 @@
         cpu_model = "24Kf";
 #endif
     }
-    if (mips_find_by_name(cpu_model, &def) != 0)
-        def = NULL;
-    env = cpu_init();
-    cpu_mips_register(env, def);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
     qemu_register_reset(main_cpu_reset, env);
 
@@ -144,10 +150,10 @@
     }
 
     if (kernel_filename) {
-        env->ram_size = ram_size;
-        env->kernel_filename = kernel_filename;
-        env->kernel_cmdline = kernel_cmdline;
-        env->initrd_filename = initrd_filename;
+        loaderparams.ram_size = ram_size;
+        loaderparams.kernel_filename = kernel_filename;
+        loaderparams.kernel_cmdline = kernel_cmdline;
+        loaderparams.initrd_filename = initrd_filename;
         load_kernel(env);
     }
 

Modified: trunk/src/host/qemu-neo1973/hw/mips_pica61.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/mips_pica61.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/mips_pica61.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -51,7 +51,6 @@
 {
     CPUState *env = opaque;
     cpu_reset(env);
-    cpu_mips_register(env, NULL);
 }
 
 static
@@ -65,7 +64,6 @@
     int bios_size;
     CPUState *env;
     int i;
-    mips_def_t *def;
     int available_ram;
     qemu_irq *i8259;
 
@@ -78,10 +76,11 @@
         cpu_model = "24Kf";
 #endif
     }
-    if (mips_find_by_name(cpu_model, &def) != 0)
-        def = NULL;
-    env = cpu_init();
-    cpu_mips_register(env, def);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
     qemu_register_reset(main_cpu_reset, env);
 

Modified: trunk/src/host/qemu-neo1973/hw/mips_r4k.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/mips_r4k.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/mips_r4k.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -15,11 +15,7 @@
 #define BIOS_FILENAME "mipsel_bios.bin"
 #endif
 
-#ifdef TARGET_MIPS64
-#define PHYS_TO_VIRT(x) ((x) | ~0x7fffffffULL)
-#else
-#define PHYS_TO_VIRT(x) ((x) | ~0x7fffffffU)
-#endif
+#define PHYS_TO_VIRT(x) ((x) | ~(target_ulong)0x7fffffff)
 
 #define VIRT_TO_PHYS_ADDEND (-((int64_t)(int32_t)0x80000000))
 
@@ -36,6 +32,13 @@
 
 /*i8254 PIT is attached to the IRQ0 at PIC i8259 */
 
+static struct _loaderparams {
+    int ram_size;
+    const char *kernel_filename;
+    const char *kernel_cmdline;
+    const char *initrd_filename;
+} loaderparams;
+
 static void mips_qemu_writel (void *opaque, target_phys_addr_t addr,
 			      uint32_t val)
 {
@@ -64,16 +67,13 @@
 
 static int mips_qemu_iomemtype = 0;
 
-static void load_kernel (CPUState *env, int ram_size,
-                         const char *kernel_filename,
-                         const char *kernel_cmdline,
-                         const char *initrd_filename)
+static void load_kernel (CPUState *env)
 {
     int64_t entry, kernel_low, kernel_high;
     long kernel_size, initrd_size;
     ram_addr_t initrd_offset;
 
-    kernel_size = load_elf(kernel_filename, VIRT_TO_PHYS_ADDEND,
+    kernel_size = load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,
                            &entry, &kernel_low, &kernel_high);
     if (kernel_size >= 0) {
         if ((entry & ~0x7fffffffULL) == 0x80000000)
@@ -81,29 +81,29 @@
         env->PC[env->current_tc] = entry;
     } else {
         fprintf(stderr, "qemu: could not load kernel '%s'\n",
-                kernel_filename);
+                loaderparams.kernel_filename);
         exit(1);
     }
 
     /* load initrd */
     initrd_size = 0;
     initrd_offset = 0;
-    if (initrd_filename) {
-        initrd_size = get_image_size (initrd_filename);
+    if (loaderparams.initrd_filename) {
+        initrd_size = get_image_size (loaderparams.initrd_filename);
         if (initrd_size > 0) {
             initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;
             if (initrd_offset + initrd_size > ram_size) {
                 fprintf(stderr,
                         "qemu: memory too small for initial ram disk '%s'\n",
-                        initrd_filename);
+                        loaderparams.initrd_filename);
                 exit(1);
             }
-            initrd_size = load_image(initrd_filename,
+            initrd_size = load_image(loaderparams.initrd_filename,
                                      phys_ram_base + initrd_offset);
         }
         if (initrd_size == (target_ulong) -1) {
             fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
-                    initrd_filename);
+                    loaderparams.initrd_filename);
             exit(1);
         }
     }
@@ -115,10 +115,12 @@
                       "rd_start=0x" TARGET_FMT_lx " rd_size=%li ",
                       PHYS_TO_VIRT((uint32_t)initrd_offset),
                       initrd_size);
-        strcpy (phys_ram_base + (16 << 20) - 256 + ret, kernel_cmdline);
+        strcpy (phys_ram_base + (16 << 20) - 256 + ret,
+                loaderparams.kernel_cmdline);
     }
     else {
-        strcpy (phys_ram_base + (16 << 20) - 256, kernel_cmdline);
+        strcpy (phys_ram_base + (16 << 20) - 256,
+                loaderparams.kernel_cmdline);
     }
 
     *(int32_t *)(phys_ram_base + (16 << 20) - 260) = tswap32 (0x12345678);
@@ -129,11 +131,9 @@
 {
     CPUState *env = opaque;
     cpu_reset(env);
-    cpu_mips_register(env, NULL);
 
-    if (env->kernel_filename)
-        load_kernel (env, env->ram_size, env->kernel_filename,
-                     env->kernel_cmdline, env->initrd_filename);
+    if (loaderparams.kernel_filename)
+        load_kernel (env);
 }
 
 static
@@ -148,7 +148,6 @@
     CPUState *env;
     RTCState *rtc_state;
     int i;
-    mips_def_t *def;
     qemu_irq *i8259;
 
     /* init CPUs */
@@ -159,10 +158,11 @@
         cpu_model = "24Kf";
 #endif
     }
-    if (mips_find_by_name(cpu_model, &def) != 0)
-        def = NULL;
-    env = cpu_init();
-    cpu_mips_register(env, def);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);
     qemu_register_reset(main_cpu_reset, env);
 
@@ -194,12 +194,11 @@
     }
 
     if (kernel_filename) {
-        load_kernel (env, ram_size, kernel_filename, kernel_cmdline,
-		     initrd_filename);
-	env->ram_size = ram_size;
-	env->kernel_filename = kernel_filename;
-	env->kernel_cmdline = kernel_cmdline;
-	env->initrd_filename = initrd_filename;
+        loaderparams.ram_size = ram_size;
+        loaderparams.kernel_filename = kernel_filename;
+        loaderparams.kernel_cmdline = kernel_cmdline;
+        loaderparams.initrd_filename = initrd_filename;
+        load_kernel (env);
     }
 
     /* Init CPU internal devices */

Added: trunk/src/host/qemu-neo1973/hw/mpcore.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/mpcore.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/mpcore.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,323 @@
+/*
+ * ARM MPCore internal peripheral emulation.
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "vl.h"
+
+#define MPCORE_PRIV_BASE  0x10100000
+#define NCPU 4
+/* ??? The MPCore TRM says the on-chip controller has 224 external IRQ lines
+   (+ 32 internal).  However my test chip only exposes/reports 32.
+   More importantly Linux falls over if more than 32 are present!  */
+#define GIC_NIRQ 64
+
+static inline int
+gic_get_current_cpu(void)
+{
+  return cpu_single_env->cpu_index;
+}
+
+#include "arm_gic.c"
+
+/* MPCore private memory region.  */
+
+typedef struct {
+    uint32_t count;
+    uint32_t load;
+    uint32_t control;
+    uint32_t status;
+    uint32_t old_status;
+    int64_t tick;
+    QEMUTimer *timer;
+    struct mpcore_priv_state *mpcore;
+    int id; /* Encodes both timer/watchdog and CPU.  */
+} mpcore_timer_state;
+
+typedef struct mpcore_priv_state {
+    gic_state *gic;
+    uint32_t scu_control;
+    mpcore_timer_state timer[8];
+} mpcore_priv_state;
+
+/* Per-CPU Timers.  */
+
+static inline void mpcore_timer_update_irq(mpcore_timer_state *s)
+{
+    if (s->status & ~s->old_status) {
+        gic_set_pending_private(s->mpcore->gic, s->id >> 1, 29 + (s->id & 1));
+    }
+    s->old_status = s->status;
+}
+
+/* Return conversion factor from mpcore timer ticks to qemu timer ticks.  */
+static inline uint32_t mpcore_timer_scale(mpcore_timer_state *s)
+{
+    return (((s->control >> 8) & 0xff) + 1) * 10;
+}
+
+static void mpcore_timer_reload(mpcore_timer_state *s, int restart)
+{
+    if (s->count == 0)
+        return;
+    if (restart)
+        s->tick = qemu_get_clock(vm_clock);
+    s->tick += (int64_t)s->count * mpcore_timer_scale(s);
+    qemu_mod_timer(s->timer, s->tick);
+}
+
+static void mpcore_timer_tick(void *opaque)
+{
+    mpcore_timer_state *s = (mpcore_timer_state *)opaque;
+    s->status = 1;
+    if (s->control & 2) {
+        s->count = s->load;
+        mpcore_timer_reload(s, 0);
+    } else {
+        s->count = 0;
+    }
+    mpcore_timer_update_irq(s);
+}
+
+static uint32_t mpcore_timer_read(mpcore_timer_state *s, int offset)
+{
+    int64_t val;
+    switch (offset) {
+    case 0: /* Load */
+        return s->load;
+        /* Fall through.  */
+    case 4: /* Counter.  */
+        if (((s->control & 1) == 0) || (s->count == 0))
+            return 0;
+        /* Slow and ugly, but hopefully won't happen too often.  */
+        val = s->tick - qemu_get_clock(vm_clock);
+        val /= mpcore_timer_scale(s);
+        if (val < 0)
+            val = 0;
+        return val;
+    case 8: /* Control.  */
+        return s->control;
+    case 12: /* Interrupt status.  */
+        return s->status;
+    }
+}
+
+static void mpcore_timer_write(mpcore_timer_state *s, int offset,
+                               uint32_t value)
+{
+    int64_t old;
+    switch (offset) {
+    case 0: /* Load */
+        s->load = value;
+        /* Fall through.  */
+    case 4: /* Counter.  */
+        if ((s->control & 1) && s->count) {
+            /* Cancel the previous timer.  */
+            qemu_del_timer(s->timer);
+        }
+        s->count = value;
+        if (s->control & 1) {
+            mpcore_timer_reload(s, 1);
+        }
+        break;
+    case 8: /* Control.  */
+        old = s->control;
+        s->control = value;
+        if (((old & 1) == 0) && (value & 1)) {
+            if (s->count == 0 && (s->control & 2))
+                s->count = s->load;
+            mpcore_timer_reload(s, 1);
+        }
+        break;
+    case 12: /* Interrupt status.  */
+        s->status &= ~value;
+        mpcore_timer_update_irq(s);
+        break;
+    }
+}
+
+static void mpcore_timer_init(mpcore_priv_state *mpcore,
+                              mpcore_timer_state *s, int id)
+{
+    s->id = id;
+    s->mpcore = mpcore;
+    s->timer = qemu_new_timer(vm_clock, mpcore_timer_tick, s);
+}
+
+
+/* Per-CPU private memory mapped IO.  */
+
+static uint32_t mpcore_priv_read(void *opaque, target_phys_addr_t offset)
+{
+    mpcore_priv_state *s = (mpcore_priv_state *)opaque;
+    int id;
+    offset &= 0xfff;
+    if (offset < 0x100) {
+        /* SCU */
+        switch (offset) {
+        case 0x00: /* Control.  */
+            return s->scu_control;
+        case 0x04: /* Configuration.  */
+            return 0xf3;
+        case 0x08: /* CPU status.  */
+            return 0;
+        case 0x0c: /* Invalidate all.  */
+            return 0;
+        default:
+            goto bad_reg;
+        }
+    } else if (offset < 0x600) {
+        /* Interrupt controller.  */
+        if (offset < 0x200) {
+            id = gic_get_current_cpu();
+        } else {
+            id = (offset - 0x200) >> 8;
+        }
+        return gic_cpu_read(s->gic, id, offset & 0xff);
+    } else if (offset < 0xb00) {
+        /* Timers.  */
+        if (offset < 0x700) {
+            id = gic_get_current_cpu();
+        } else {
+            id = (offset - 0x700) >> 8;
+        }
+        id <<= 1;
+        if (offset & 0x20)
+          id++;
+        return mpcore_timer_read(&s->timer[id], offset & 0xf);
+    }
+bad_reg:
+    cpu_abort(cpu_single_env, "mpcore_priv_read: Bad offset %x\n",
+              (int)offset);
+    return 0;
+}
+
+static void mpcore_priv_write(void *opaque, target_phys_addr_t offset,
+                          uint32_t value)
+{
+    mpcore_priv_state *s = (mpcore_priv_state *)opaque;
+    int id;
+    offset &= 0xfff;
+    if (offset < 0x100) {
+        /* SCU */
+        switch (offset) {
+        case 0: /* Control register.  */
+            s->scu_control = value & 1;
+            break;
+        case 0x0c: /* Invalidate all.  */
+            /* This is a no-op as cache is not emulated.  */
+            break;
+        default:
+            goto bad_reg;
+        }
+    } else if (offset < 0x600) {
+        /* Interrupt controller.  */
+        if (offset < 0x200) {
+            id = gic_get_current_cpu();
+        } else {
+            id = (offset - 0x200) >> 8;
+        }
+        gic_cpu_write(s->gic, id, offset & 0xff, value);
+    } else if (offset < 0xb00) {
+        /* Timers.  */
+        if (offset < 0x700) {
+            id = gic_get_current_cpu();
+        } else {
+            id = (offset - 0x700) >> 8;
+        }
+        id <<= 1;
+        if (offset & 0x20)
+          id++;
+        mpcore_timer_write(&s->timer[id], offset & 0xf, value);
+        return;
+    }
+    return;
+bad_reg:
+    cpu_abort(cpu_single_env, "mpcore_priv_read: Bad offset %x\n",
+              (int)offset);
+}
+
+static CPUReadMemoryFunc *mpcore_priv_readfn[] = {
+   mpcore_priv_read,
+   mpcore_priv_read,
+   mpcore_priv_read
+};
+
+static CPUWriteMemoryFunc *mpcore_priv_writefn[] = {
+   mpcore_priv_write,
+   mpcore_priv_write,
+   mpcore_priv_write
+};
+
+
+static qemu_irq *mpcore_priv_init(uint32_t base, qemu_irq *pic_irq)
+{
+    mpcore_priv_state *s;
+    int iomemtype;
+    int i;
+
+    s = (mpcore_priv_state *)qemu_mallocz(sizeof(mpcore_priv_state));
+    if (!s)
+        return NULL;
+    s->gic = gic_init(base, pic_irq);
+    if (!s->gic)
+        return NULL;
+    iomemtype = cpu_register_io_memory(0, mpcore_priv_readfn,
+                                       mpcore_priv_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    for (i = 0; i < 8; i++) {
+        mpcore_timer_init(s, &s->timer[i], i);
+    }
+    return s->gic->in;
+}
+
+/* Dummy PIC to route IRQ lines.  The baseboard has 4 independent IRQ
+   controllers.  The output of these, plus some of the raw input lines
+   are fed into a single SMP-aware interrupt controller on the CPU.  */
+typedef struct {
+    qemu_irq *cpuic;
+    qemu_irq *rvic[4];
+} mpcore_rirq_state;
+
+/* Map baseboard IRQs onto CPU IRQ lines.  */
+static const int mpcore_irq_map[32] = {
+    -1, -1, -1, -1,  1,  2, -1, -1,
+    -1, -1,  6, -1,  4,  5, -1, -1,
+    -1, 14, 15,  0,  7,  8, -1, -1,
+    -1, -1, -1, -1,  9,  3, -1, -1,
+};
+
+static void mpcore_rirq_set_irq(void *opaque, int irq, int level)
+{
+    mpcore_rirq_state *s = (mpcore_rirq_state *)opaque;
+    int i;
+
+    for (i = 0; i < 4; i++) {
+        qemu_set_irq(s->rvic[i][irq], level);
+    }
+    if (irq < 32) {
+        irq = mpcore_irq_map[irq];
+        if (irq >= 0) {
+            qemu_set_irq(s->cpuic[irq], level);
+        }
+    }
+}
+
+qemu_irq *mpcore_irq_init(qemu_irq *cpu_irq)
+{
+    mpcore_rirq_state *s;
+    int n;
+
+    /* ??? IRQ routing is hardcoded to "normal" mode.  */
+    s = qemu_mallocz(sizeof(mpcore_rirq_state));
+    s->cpuic = mpcore_priv_init(MPCORE_PRIV_BASE, cpu_irq);
+    for (n = 0; n < 4; n++) {
+        s->rvic[n] = realview_gic_init(0x10040000 + n * 0x10000,
+                                       s->cpuic[10 + n]);
+    }
+    return qemu_allocate_irqs(mpcore_rirq_set_irq, s, 64);
+}

Modified: trunk/src/host/qemu-neo1973/hw/omap.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/omap.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/omap.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -833,7 +833,7 @@
         return 1;
 
     default:
-        OMAP_BAD_REG((unsigned long) reg);
+        OMAP_BAD_REG((target_phys_addr_t) reg);
     }
     return 0;
 }
@@ -4620,15 +4620,20 @@
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *)
             qemu_mallocz(sizeof(struct omap_mpu_state_s));
     ram_addr_t imif_base, emiff_base;
+    
+    if (!core)
+        core = "ti925t";
 
     /* Core */
     s->mpu_model = omap310;
-    s->env = cpu_init();
+    s->env = cpu_init(core);
+    if (!s->env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     s->sdram_size = sdram_size;
     s->sram_size = OMAP15XX_SRAM_SIZE;
 
-    cpu_arm_set_model(s->env, core ?: "ti925t");
-
     s->wakeup = qemu_allocate_irqs(omap_mpu_wakeup, s, 1)[0];
 
     /* Clocks */

Modified: trunk/src/host/qemu-neo1973/hw/pc.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pc.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pc.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -173,6 +173,7 @@
 static void cmos_init(int ram_size, const char *boot_device, BlockDriverState **hd_table)
 {
     RTCState *s = rtc_state;
+    int nbds, bds[3] = { 0, };
     int val;
     int fd0, fd1, nb;
     int i;
@@ -202,11 +203,22 @@
     rtc_set_memory(s, 0x35, val >> 8);
 
     /* set boot devices, and disable floppy signature check if requested */
-    rtc_set_memory(s, 0x3d,
-            boot_device2nibble(boot_device[1]) << 4 |
-            boot_device2nibble(boot_device[0]) );
-    rtc_set_memory(s, 0x38,
-            boot_device2nibble(boot_device[2]) << 4 | (fd_bootchk ?  0x0 : 0x1));
+#define PC_MAX_BOOT_DEVICES 3
+    nbds = strlen(boot_device);
+    if (nbds > PC_MAX_BOOT_DEVICES) {
+        fprintf(stderr, "Too many boot devices for PC\n");
+        exit(1);
+    }
+    for (i = 0; i < nbds; i++) {
+        bds[i] = boot_device2nibble(boot_device[i]);
+        if (bds[i] == 0) {
+            fprintf(stderr, "Invalid boot device for PC: '%c'\n",
+                    boot_device[i]);
+            exit(1);
+        }
+    }
+    rtc_set_memory(s, 0x3d, (bds[1] << 4) | bds[0]);
+    rtc_set_memory(s, 0x38, (bds[2] << 4) | (fd_bootchk ?  0x0 : 0x1));
 
     /* floppy type */
 
@@ -700,12 +712,12 @@
 #endif
     }
     
-    if (x86_find_cpu_by_name(cpu_model)) {
-        fprintf(stderr, "Unable to find x86 CPU definition\n");
-        exit(1);
-    }
     for(i = 0; i < smp_cpus; i++) {
-        env = cpu_init();
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find x86 CPU definition\n");
+            exit(1);
+        }
         if (i != 0)
             env->hflags |= HF_HALTED_MASK;
         if (smp_cpus > 1) {

Modified: trunk/src/host/qemu-neo1973/hw/pl011.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pl011.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pl011.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -28,6 +28,7 @@
     int read_trigger;
     CharDriverState *chr;
     qemu_irq irq;
+    enum pl011_type type;
 } pl011_state;
 
 #define PL011_INT_TX 0x20
@@ -38,8 +39,10 @@
 #define PL011_FLAG_TXFF 0x20
 #define PL011_FLAG_RXFE 0x10
 
-static const unsigned char pl011_id[] =
-{ 0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
+static const unsigned char pl011_id[2][8] = {
+  { 0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1 }, /* PL011_ARM */
+  { 0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 }, /* PL011_LUMINARY */
+};
 
 static void pl011_update(pl011_state *s)
 {
@@ -56,7 +59,7 @@
 
     offset -= s->base;
     if (offset >= 0xfe0 && offset < 0x1000) {
-        return pl011_id[(offset - 0xfe0) >> 2];
+        return pl011_id[s->type][(offset - 0xfe0) >> 2];
     }
     switch (offset >> 2) {
     case 0: /* UARTDR */
@@ -99,7 +102,7 @@
     case 18: /* UARTDMACR */
         return s->dmacr;
     default:
-        cpu_abort (cpu_single_env, "pl011_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl011_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -137,6 +140,9 @@
     case 1: /* UARTCR */
         s->cr = value;
         break;
+    case 6: /* UARTFR */
+        /* Writes to Flag register are ignored.  */
+        break;
     case 8: /* UARTUARTILPR */
         s->ilpr = value;
         break;
@@ -172,7 +178,7 @@
             cpu_abort(cpu_single_env, "PL011: DMA not implemented\n");
         break;
     default:
-        cpu_abort (cpu_single_env, "pl011_write: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl011_write: Bad offset %x\n", (int)offset);
     }
 }
 
@@ -224,7 +230,7 @@
 };
 
 void pl011_init(uint32_t base, qemu_irq irq,
-                CharDriverState *chr)
+                CharDriverState *chr, enum pl011_type type)
 {
     int iomemtype;
     pl011_state *s;
@@ -235,6 +241,7 @@
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
     s->base = base;
     s->irq = irq;
+    s->type = type;
     s->chr = chr;
     s->read_trigger = 1;
     s->ifl = 0x12;

Added: trunk/src/host/qemu-neo1973/hw/pl022.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pl022.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pl022.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,264 @@
+/*
+ * Arm PrimeCell PL022 Synchronous Serial Port
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "vl.h"
+
+//#define DEBUG_PL022 1
+
+#ifdef DEBUG_PL022
+#define DPRINTF(fmt, args...) \
+do { printf("pl022: " fmt , ##args); } while (0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "pl022: error: " fmt , ##args); exit(1);} while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "pl022: error: " fmt , ##args);} while (0)
+#endif
+
+#define PL022_CR1_LBM 0x01
+#define PL022_CR1_SSE 0x02
+#define PL022_CR1_MS  0x04
+#define PL022_CR1_SDO 0x08
+
+#define PL022_SR_TFE  0x01
+#define PL022_SR_TNF  0x02
+#define PL022_SR_RNE  0x04
+#define PL022_SR_RFF  0x08
+#define PL022_SR_BSY  0x10
+
+#define PL022_INT_ROR 0x01
+#define PL022_INT_RT  0x04
+#define PL022_INT_RX  0x04
+#define PL022_INT_TX  0x08
+
+typedef struct {
+    uint32_t base;
+    uint32_t cr0;
+    uint32_t cr1;
+    uint32_t bitmask;
+    uint32_t sr;
+    uint32_t cpsr;
+    uint32_t is;
+    uint32_t im;
+    /* The FIFO head points to the next empty entry.  */
+    int tx_fifo_head;
+    int rx_fifo_head;
+    int tx_fifo_len;
+    int rx_fifo_len;
+    uint16_t tx_fifo[8];
+    uint16_t rx_fifo[8];
+    qemu_irq irq;
+    int (*xfer_cb)(void *, int);
+    void *opaque;
+} pl022_state;
+
+static const unsigned char pl022_id[8] =
+  { 0x22, 0x10, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
+
+static void pl022_update(pl022_state *s)
+{
+    s->sr = 0;
+    if (s->tx_fifo_len == 0)
+        s->sr |= PL022_SR_TFE;
+    if (s->tx_fifo_len != 8)
+        s->sr |= PL022_SR_TNF;
+    if (s->rx_fifo_len != 0)
+        s->sr |= PL022_SR_RNE;
+    if (s->rx_fifo_len == 8)
+        s->sr |= PL022_SR_RFF;
+    if (s->tx_fifo_len)
+        s->sr |= PL022_SR_BSY;
+    s->is = 0;
+    if (s->rx_fifo_len >= 4)
+        s->is |= PL022_INT_RX;
+    if (s->tx_fifo_len <= 4)
+        s->is |= PL022_INT_TX;
+
+    qemu_set_irq(s->irq, (s->is & s->im) != 0);
+}
+
+static void pl022_xfer(pl022_state *s)
+{
+    int i;
+    int o;
+    int val;
+
+    if ((s->cr1 & PL022_CR1_SSE) == 0) {
+        pl022_update(s);
+        DPRINTF("Disabled\n");
+        return;
+    }
+
+    DPRINTF("Maybe xfer %d/%d\n", s->tx_fifo_len, s->rx_fifo_len);
+    i = (s->tx_fifo_head - s->tx_fifo_len) & 7;
+    o = s->rx_fifo_head;
+    /* ??? We do not emulate the line speed.
+       This may break some applications.  The are two problematic cases:
+        (a) A driver feeds data into the TX FIFO until it is full,
+         and only then drains the RX FIFO.  On real hardware the CPU can
+         feed data fast enough that the RX fifo never gets chance to overflow.
+        (b) A driver transmits data, deliberately allowing the RX FIFO to
+         overflow because it ignores the RX data anyway.
+
+       We choose to support (a) by stalling the transmit engine if it would
+       cause the RX FIFO to overflow.  In practice much transmit-only code
+       falls into (a) because it flushes the RX FIFO to determine when
+       the transfer has completed.  */
+    while (s->tx_fifo_len && s->rx_fifo_len < 8) {
+        DPRINTF("xfer\n");
+        val = s->tx_fifo[i];
+        if (s->cr1 & PL022_CR1_LBM) {
+            /* Loopback mode.  */
+        } else if (s->xfer_cb) {
+            val = s->xfer_cb(s->opaque, val);
+        } else {
+            val = 0;
+        }
+        s->rx_fifo[o] = val & s->bitmask;
+        i = (i + 1) & 7;
+        o = (o + 1) & 7;
+        s->tx_fifo_len--;
+        s->rx_fifo_len++;
+    }
+    s->rx_fifo_head = o;
+    pl022_update(s);
+}
+
+static uint32_t pl022_read(void *opaque, target_phys_addr_t offset)
+{
+    pl022_state *s = (pl022_state *)opaque;
+    int val;
+
+    offset -= s->base;
+    if (offset >= 0xfe0 && offset < 0x1000) {
+        return pl022_id[(offset - 0xfe0) >> 2];
+    }
+    switch (offset) {
+    case 0x00: /* CR0 */
+      return s->cr0;
+    case 0x04: /* CR1 */
+      return s->cr1;
+    case 0x08: /* DR */
+        if (s->rx_fifo_len) {
+            val = s->rx_fifo[(s->rx_fifo_head - s->rx_fifo_len) & 7];
+            DPRINTF("RX %02x\n", val);
+            s->rx_fifo_len--;
+            pl022_xfer(s);
+        } else {
+            val = 0;
+        }
+        return val;
+    case 0x0c: /* SR */
+        return s->sr;
+    case 0x10: /* CPSR */
+        return s->cpsr;
+    case 0x14: /* IMSC */
+        return s->im;
+    case 0x18: /* RIS */
+        return s->is;
+    case 0x1c: /* MIS */
+        return s->im & s->is;
+    case 0x20: /* DMACR */
+        /* Not implemented.  */
+        return 0;
+    default:
+        cpu_abort (cpu_single_env, "pl022_read: Bad offset %x\n",
+                   (int)offset);
+        return 0;
+    }
+}
+
+static void pl022_write(void *opaque, target_phys_addr_t offset,
+                        uint32_t value)
+{
+    pl022_state *s = (pl022_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x00: /* CR0 */
+        s->cr0 = value;
+        /* Clock rate and format are ignored.  */
+        s->bitmask = (1 << ((value & 15) + 1)) - 1;
+        break;
+    case 0x04: /* CR1 */
+        s->cr1 = value;
+        if ((s->cr1 & (PL022_CR1_MS | PL022_CR1_SSE))
+                   == (PL022_CR1_MS | PL022_CR1_SSE)) {
+            BADF("SPI slave mode not implemented\n");
+        }
+        pl022_xfer(s);
+        break;
+    case 0x08: /* DR */
+        if (s->tx_fifo_len < 8) {
+            DPRINTF("TX %02x\n", value);
+            s->tx_fifo[s->tx_fifo_head] = value & s->bitmask;
+            s->tx_fifo_head = (s->tx_fifo_head + 1) & 7;
+            s->tx_fifo_len++;
+            pl022_xfer(s);
+        }
+        break;
+    case 0x10: /* CPSR */
+        /* Prescaler.  Ignored.  */
+        s->cpsr = value & 0xff;
+        break;
+    case 0x14: /* IMSC */
+        s->im = value;
+        pl022_update(s);
+        break;
+    case 0x20: /* DMACR */
+        if (value)
+            cpu_abort (cpu_single_env, "pl022: DMA not implemented\n");
+        break;
+    default:
+        cpu_abort (cpu_single_env, "pl022_write: Bad offset %x\n",
+                   (int)offset);
+    }
+}
+
+static void pl022_reset(pl022_state *s)
+{
+    s->rx_fifo_len = 0;
+    s->tx_fifo_len = 0;
+    s->im = 0;
+    s->is = PL022_INT_TX;
+    s->sr = PL022_SR_TFE | PL022_SR_TNF;
+}
+
+static CPUReadMemoryFunc *pl022_readfn[] = {
+   pl022_read,
+   pl022_read,
+   pl022_read
+};
+
+static CPUWriteMemoryFunc *pl022_writefn[] = {
+   pl022_write,
+   pl022_write,
+   pl022_write
+};
+
+void pl022_init(uint32_t base, qemu_irq irq, int (*xfer_cb)(void *, int),
+                void * opaque)
+{
+    int iomemtype;
+    pl022_state *s;
+
+    s = (pl022_state *)qemu_mallocz(sizeof(pl022_state));
+    iomemtype = cpu_register_io_memory(0, pl022_readfn,
+                                       pl022_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    s->base = base;
+    s->irq = irq;
+    s->xfer_cb = xfer_cb;
+    s->opaque = opaque;
+    pl022_reset(s);
+    /* ??? Save/restore.  */
+}
+
+

Modified: trunk/src/host/qemu-neo1973/hw/pl050.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pl050.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pl050.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -79,7 +79,7 @@
     case 4: /* KMIIR */
         return s->pending | 2;
     default:
-        cpu_abort (cpu_single_env, "pl050_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl050_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -108,7 +108,7 @@
         s->clk = value;
         return;
     default:
-        cpu_abort (cpu_single_env, "pl050_write: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl050_write: Bad offset %x\n", (int)offset);
     }
 }
 static CPUReadMemoryFunc *pl050_readfn[] = {

Added: trunk/src/host/qemu-neo1973/hw/pl061.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pl061.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pl061.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,256 @@
+/*
+ * Arm PrimeCell PL061 General Purpose IO with additional
+ * Luminary Micro Stellaris bits.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "vl.h"
+
+//#define DEBUG_PL061 1
+
+#ifdef DEBUG_PL061
+#define DPRINTF(fmt, args...) \
+do { printf("pl061: " fmt , ##args); } while (0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "pl061: error: " fmt , ##args); exit(1);} while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "pl061: error: " fmt , ##args);} while (0)
+#endif
+
+static const uint8_t pl061_id[12] =
+  { 0x00, 0x00, 0x00, 0x00, 0x61, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
+
+typedef struct {
+    uint32_t base;
+    int locked;
+    uint8_t data;
+    uint8_t old_data;
+    uint8_t dir;
+    uint8_t isense;
+    uint8_t ibe;
+    uint8_t iev;
+    uint8_t im;
+    uint8_t istate;
+    uint8_t afsel;
+    uint8_t dr2r;
+    uint8_t dr4r;
+    uint8_t dr8r;
+    uint8_t odr;
+    uint8_t pur;
+    uint8_t pdr;
+    uint8_t slr;
+    uint8_t den;
+    uint8_t cr;
+    qemu_irq irq;
+    qemu_irq out[8];
+} pl061_state;
+
+static void pl061_update(pl061_state *s)
+{
+    uint8_t changed;
+    uint8_t mask;
+    int i;
+
+    changed = s->old_data ^ s->data;
+    if (!changed)
+        return;
+
+    s->old_data = s->data;
+    for (i = 0; i < 8; i++) {
+        mask = 1 << i;
+        if ((changed & mask & s->dir) && s->out) {
+            DPRINTF("Set output %d = %d\n", i, (s->data & mask) != 0);
+            qemu_set_irq(s->out[i], (s->data & mask) != 0);
+        }
+    }
+
+    /* FIXME: Implement input interrupts.  */
+}
+
+static uint32_t pl061_read(void *opaque, target_phys_addr_t offset)
+{
+    pl061_state *s = (pl061_state *)opaque;
+
+    offset -= s->base;
+    if (offset >= 0xfd0 && offset < 0x1000) {
+        return pl061_id[(offset - 0xfd0) >> 2];
+    }
+    if (offset < 0x400) {
+        return s->data & (offset >> 2);
+    }
+    switch (offset) {
+    case 0x400: /* Direction */
+        return s->dir;
+    case 0x404: /* Interrupt sense */
+        return s->isense;
+    case 0x408: /* Interrupt both edges */
+        return s->ibe;
+    case 0x40c: /* Interupt event */
+        return s->iev;
+    case 0x410: /* Interrupt mask */
+        return s->im;
+    case 0x414: /* Raw interrupt status */
+        return s->istate;
+    case 0x418: /* Masked interrupt status */
+        return s->istate | s->im;
+    case 0x420: /* Alternate function select */
+        return s->afsel;
+    case 0x500: /* 2mA drive */
+        return s->dr2r;
+    case 0x504: /* 4mA drive */
+        return s->dr4r;
+    case 0x508: /* 8mA drive */
+        return s->dr8r;
+    case 0x50c: /* Open drain */
+        return s->odr;
+    case 0x510: /* Pull-up */
+        return s->pur;
+    case 0x514: /* Pull-down */
+        return s->pdr;
+    case 0x518: /* Slew rate control */
+        return s->slr;
+    case 0x51c: /* Digital enable */
+        return s->den;
+    case 0x520: /* Lock */
+        return s->locked;
+    case 0x524: /* Commit */
+        return s->cr;
+    default:
+        cpu_abort (cpu_single_env, "pl061_read: Bad offset %x\n",
+                   (int)offset);
+        return 0;
+    }
+}
+
+static void pl061_write(void *opaque, target_phys_addr_t offset,
+                        uint32_t value)
+{
+    pl061_state *s = (pl061_state *)opaque;
+    uint8_t mask;
+
+    offset -= s->base;
+    if (offset < 0x400) {
+        mask = (offset >> 2) & s->dir;
+        s->data = (s->data & ~mask) | (value & mask);
+        pl061_update(s);
+        return;
+    }
+    switch (offset) {
+    case 0x400: /* Direction */
+        s->dir = value;
+        break;
+    case 0x404: /* Interrupt sense */
+        s->isense = value;
+        break;
+    case 0x408: /* Interrupt both edges */
+        s->ibe = value;
+        break;
+    case 0x40c: /* Interupt event */
+        s->iev = value;
+        break;
+    case 0x410: /* Interrupt mask */
+        s->im = value;
+        break;
+    case 0x41c: /* Interrupt clear */
+        s->istate &= ~value;
+        break;
+    case 0x420: /* Alternate function select */
+        mask = s->cr;
+        s->afsel = (s->afsel & ~mask) | (value & mask);
+        break;
+    case 0x500: /* 2mA drive */
+        s->dr2r = value;
+        break;
+    case 0x504: /* 4mA drive */
+        s->dr4r = value;
+        break;
+    case 0x508: /* 8mA drive */
+        s->dr8r = value;
+        break;
+    case 0x50c: /* Open drain */
+        s->odr = value;
+        break;
+    case 0x510: /* Pull-up */
+        s->pur = value;
+        break;
+    case 0x514: /* Pull-down */
+        s->pdr = value;
+        break;
+    case 0x518: /* Slew rate control */
+        s->slr = value;
+        break;
+    case 0x51c: /* Digital enable */
+        s->den = value;
+        break;
+    case 0x520: /* Lock */
+        s->locked = (value != 0xacce551);
+        break;
+    case 0x524: /* Commit */
+        if (!s->locked)
+            s->cr = value;
+        break;
+    default:
+        cpu_abort (cpu_single_env, "pl061_write: Bad offset %x\n",
+                   (int)offset);
+    }
+    pl061_update(s);
+}
+
+static void pl061_reset(pl061_state *s)
+{
+  s->locked = 1;
+  s->cr = 0xff;
+}
+
+void pl061_set_irq(void * opaque, int irq, int level)
+{
+    pl061_state *s = (pl061_state *)opaque;
+    uint8_t mask;
+
+    mask = 1 << irq;
+    if ((s->dir & mask) == 0) {
+        s->data &= ~mask;
+        if (level)
+            s->data |= mask;
+        pl061_update(s);
+    }
+}
+
+static CPUReadMemoryFunc *pl061_readfn[] = {
+   pl061_read,
+   pl061_read,
+   pl061_read
+};
+
+static CPUWriteMemoryFunc *pl061_writefn[] = {
+   pl061_write,
+   pl061_write,
+   pl061_write
+};
+
+/* Returns an array of inputs.  */
+qemu_irq *pl061_init(uint32_t base, qemu_irq irq, qemu_irq **out)
+{
+    int iomemtype;
+    pl061_state *s;
+
+    s = (pl061_state *)qemu_mallocz(sizeof(pl061_state));
+    iomemtype = cpu_register_io_memory(0, pl061_readfn,
+                                       pl061_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    s->base = base;
+    s->irq = irq;
+    pl061_reset(s);
+    if (out)
+        *out = s->out;
+
+    /* ??? Save/restore.  */
+    return qemu_allocate_irqs(pl061_set_irq, s, 8);
+}
+

Modified: trunk/src/host/qemu-neo1973/hw/pl080.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pl080.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pl080.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -243,7 +243,7 @@
         return s->sync;
     default:
     bad_offset:
-        cpu_abort(cpu_single_env, "pl080_read: Bad offset %x\n", offset);
+        cpu_abort(cpu_single_env, "pl080_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -305,7 +305,7 @@
         break;
     default:
     bad_offset:
-        cpu_abort(cpu_single_env, "pl080_write: Bad offset %x\n", offset);
+        cpu_abort(cpu_single_env, "pl080_write: Bad offset %x\n", (int)offset);
     }
     pl080_update(s);
 }

Modified: trunk/src/host/qemu-neo1973/hw/pl110.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pl110.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pl110.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -326,7 +326,7 @@
     case 12: /* LCDLPCURR */
         return s->lpbase;
     default:
-        cpu_abort (cpu_single_env, "pl110_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl110_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -393,7 +393,7 @@
         pl110_update(s);
         break;
     default:
-        cpu_abort (cpu_single_env, "pl110_write: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl110_write: Bad offset %x\n", (int)offset);
     }
 }
 

Modified: trunk/src/host/qemu-neo1973/hw/pl181.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pl181.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pl181.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -333,7 +333,7 @@
             return value;
         }
     default:
-        cpu_abort (cpu_single_env, "pl181_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl181_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -405,7 +405,7 @@
         }
         break;
     default:
-        cpu_abort (cpu_single_env, "pl181_write: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl181_write: Bad offset %x\n", (int)offset);
     }
     pl181_update(s);
 }

Modified: trunk/src/host/qemu-neo1973/hw/pl190.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pl190.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pl190.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -139,7 +139,7 @@
     case 13: /* DEFVECTADDR */
         return s->vect_addr[16];
     default:
-        cpu_abort (cpu_single_env, "pl190_read: Bad offset %x\n", offset);
+        cpu_abort (cpu_single_env, "pl190_read: Bad offset %x\n", (int)offset);
         return 0;
     }
 }
@@ -197,7 +197,7 @@
             cpu_abort(cpu_single_env, "pl190: Test mode not implemented\n");
         break;
     default:
-        cpu_abort(cpu_single_env, "pl190_write: Bad offset %x\n", offset);
+        cpu_abort(cpu_single_env, "pl190_write: Bad offset %x\n", (int)offset);
         return;
     }
     pl190_update(s);

Modified: trunk/src/host/qemu-neo1973/hw/ppc4xx_devs.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/ppc4xx_devs.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/ppc4xx_devs.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -37,17 +37,14 @@
                        uint32_t sysclk)
 {
     CPUState *env;
-    ppc_def_t *def;
 
     /* init CPUs */
-    env = cpu_init();
-    ppc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
-        cpu_abort(env, "Unable to find PowerPC %s CPU definition\n",
-                  cpu_model);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find PowerPC %s CPU definition\n",
+                cpu_model);
+        exit(1);
     }
-    cpu_ppc_register(env, def);
-    cpu_ppc_reset(env);
     cpu_clk->cb = NULL; /* We don't care about CPU clock frequency changes */
     cpu_clk->opaque = env;
     /* Set time-base frequency to sysclk */

Modified: trunk/src/host/qemu-neo1973/hw/ppc_chrp.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/ppc_chrp.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/ppc_chrp.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -56,14 +56,13 @@
                              const char *initrd_filename,
                              const char *cpu_model)
 {
-    CPUState *env, *envs[MAX_CPUS];
+    CPUState *env = NULL, *envs[MAX_CPUS];
     char buf[1024];
     qemu_irq *pic, **openpic_irqs;
     int unin_memory;
     int linux_boot, i;
     unsigned long bios_offset, vga_bios_offset;
     uint32_t kernel_base, kernel_size, initrd_base, initrd_size;
-    ppc_def_t *def;
     PCIBus *pci_bus;
     nvram_t nvram;
 #if 0
@@ -75,21 +74,19 @@
     qemu_irq *dummy_irq;
     int pic_mem_index, dbdma_mem_index, cuda_mem_index;
     int ide_mem_index[2];
-    int ppc_boot_device = boot_device[0];
+    int ppc_boot_device;
 
     linux_boot = (kernel_filename != NULL);
 
     /* init CPUs */
-    env = cpu_init();
     if (cpu_model == NULL)
         cpu_model = "default";
-    ppc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
-        cpu_abort(env, "Unable to find PowerPC CPU definition\n");
-    }
     for (i = 0; i < smp_cpus; i++) {
-        cpu_ppc_register(env, def);
-        cpu_ppc_reset(env);
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find PowerPC CPU definition\n");
+            exit(1);
+        }
         /* Set time-base frequency to 100 Mhz */
         cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL);
 #if 0
@@ -178,6 +175,20 @@
         kernel_size = 0;
         initrd_base = 0;
         initrd_size = 0;
+        ppc_boot_device = '\0';
+        /* We consider that NewWorld PowerMac never have any floppy drive
+         * For now, OHW cannot boot from the network.
+         */
+        for (i = 0; boot_device[i] != '\0'; i++) {
+            if (boot_device[i] >= 'c' && boot_device[i] <= 'f') {
+                ppc_boot_device = boot_device[i];
+                break;
+            }
+        }
+        if (ppc_boot_device == '\0') {
+            fprintf(stderr, "No valid boot device for Mac99 machine\n");
+            exit(1);
+        }
     }
 
     isa_mem_base = 0x80000000;

Modified: trunk/src/host/qemu-neo1973/hw/ppc_oldworld.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/ppc_oldworld.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/ppc_oldworld.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -100,7 +100,7 @@
                                const char *initrd_filename,
                                const char *cpu_model)
 {
-    CPUState *env, *envs[MAX_CPUS];
+    CPUState *env = NULL, *envs[MAX_CPUS];
     char buf[1024];
     qemu_irq *pic, **heathrow_irqs;
     nvram_t nvram;
@@ -108,27 +108,25 @@
     int linux_boot, i;
     unsigned long bios_offset, vga_bios_offset;
     uint32_t kernel_base, kernel_size, initrd_base, initrd_size;
-    ppc_def_t *def;
     PCIBus *pci_bus;
     MacIONVRAMState *nvr;
     int vga_bios_size, bios_size;
     qemu_irq *dummy_irq;
     int pic_mem_index, nvram_mem_index, dbdma_mem_index, cuda_mem_index;
-    int ppc_boot_device = boot_device[0];
+    int ide_mem_index[2];
+    int ppc_boot_device;
 
     linux_boot = (kernel_filename != NULL);
 
     /* init CPUs */
-    env = cpu_init();
     if (cpu_model == NULL)
         cpu_model = "default";
-    ppc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
-        cpu_abort(env, "Unable to find PowerPC CPU definition\n");
-    }
     for (i = 0; i < smp_cpus; i++) {
-        cpu_ppc_register(env, def);
-        cpu_ppc_reset(env);
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find PowerPC CPU definition\n");
+            exit(1);
+        }
         /* Set time-base frequency to 100 Mhz */
         cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL);
         env->osi_call = vga_osi_call;
@@ -215,6 +213,28 @@
         kernel_size = 0;
         initrd_base = 0;
         initrd_size = 0;
+        ppc_boot_device = '\0';
+        for (i = 0; boot_device[i] != '\0'; i++) {
+            /* TOFIX: for now, the second IDE channel is not properly
+             *        used by OHW. The Mac floppy disk are not emulated.
+             *        For now, OHW cannot boot from the network.
+             */
+#if 0
+            if (boot_device[i] >= 'a' && boot_device[i] <= 'f') {
+                ppc_boot_device = boot_device[i];
+                break;
+            }
+#else
+            if (boot_device[i] >= 'c' && boot_device[i] <= 'd') {
+                ppc_boot_device = boot_device[i];
+                break;
+            }
+#endif
+        }
+        if (ppc_boot_device == '\0') {
+            fprintf(stderr, "No valid boot device for Mac99 machine\n");
+            exit(1);
+        }
     }
 
     isa_mem_base = 0x80000000;
@@ -262,8 +282,12 @@
             nd_table[i].model = "ne2k_pci";
         pci_nic_init(pci_bus, &nd_table[i], -1);
     }
-    
+
+    /* First IDE channel is a CMD646 on the PCI bus */
     pci_cmd646_ide_init(pci_bus, &bs_table[0], 0);
+    /* Second IDE channel is a MAC IDE on the MacIO bus */
+    ide_mem_index[0] = -1;
+    ide_mem_index[1] = pmac_ide_init(&bs_table[2], pic[0x0D]);
 
     /* cuda also initialize ADB */
     cuda_init(&cuda_mem_index, pic[0x12]);
@@ -275,9 +299,9 @@
     pmac_format_nvram_partition(nvr, 0x2000);
 
     dbdma_init(&dbdma_mem_index);
-    
+
     macio_init(pci_bus, 0x0017, 1, pic_mem_index, dbdma_mem_index,
-               cuda_mem_index, nvr, 0, NULL);
+               cuda_mem_index, nvr, 2, ide_mem_index);
 
     if (usb_enabled) {
         usb_ohci_init_pci(pci_bus, 3, -1);

Modified: trunk/src/host/qemu-neo1973/hw/ppc_prep.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/ppc_prep.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/ppc_prep.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -521,14 +521,15 @@
 #define NVRAM_SIZE        0x2000
 
 /* PowerPC PREP hardware initialisation */
-static void ppc_prep_init (int ram_size, int vga_ram_size, const char *boot_device,
+static void ppc_prep_init (int ram_size, int vga_ram_size,
+                           const char *boot_device,
                            DisplayState *ds, const char **fd_filename,
                            int snapshot, const char *kernel_filename,
                            const char *kernel_cmdline,
                            const char *initrd_filename,
                            const char *cpu_model)
 {
-    CPUState *env, *envs[MAX_CPUS];
+    CPUState *env = NULL, *envs[MAX_CPUS];
     char buf[1024];
     nvram_t nvram;
     m48t59_t *m48t59;
@@ -536,10 +537,9 @@
     int linux_boot, i, nb_nics1, bios_size;
     unsigned long bios_offset;
     uint32_t kernel_base, kernel_size, initrd_base, initrd_size;
-    ppc_def_t *def;
     PCIBus *pci_bus;
     qemu_irq *i8259;
-    int ppc_boot_device = boot_device[0];
+    int ppc_boot_device;
 
     sysctrl = qemu_mallocz(sizeof(sysctrl_t));
     if (sysctrl == NULL)
@@ -548,16 +548,14 @@
     linux_boot = (kernel_filename != NULL);
 
     /* init CPUs */
-    env = cpu_init();
     if (cpu_model == NULL)
         cpu_model = "default";
-    ppc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
-        cpu_abort(env, "Unable to find PowerPC CPU definition\n");
-    }
     for (i = 0; i < smp_cpus; i++) {
-        cpu_ppc_register(env, def);
-        cpu_ppc_reset(env);
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find PowerPC CPU definition\n");
+            exit(1);
+        }
         /* Set time-base frequency to 100 Mhz */
         cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL);
         qemu_register_reset(&cpu_ppc_reset, env);
@@ -614,6 +612,18 @@
         kernel_size = 0;
         initrd_base = 0;
         initrd_size = 0;
+        ppc_boot_device = '\0';
+        /* For now, OHW cannot boot from the network. */
+        for (i = 0; boot_device[i] != '\0'; i++) {
+            if (boot_device[i] >= 'a' && boot_device[i] <= 'f') {
+                ppc_boot_device = boot_device[i];
+                break;
+            }
+        }
+        if (ppc_boot_device == '\0') {
+            fprintf(stderr, "No valid boot device for Mac99 machine\n");
+            exit(1);
+        }
     }
 
     isa_mem_base = 0xc0000000;

Modified: trunk/src/host/qemu-neo1973/hw/pxa.h
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pxa.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pxa.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -203,7 +203,7 @@
 };
 
 # define PA_FMT			"0x%08lx"
-# define REG_FMT		"0x%lx"
+# define REG_FMT		"0x" TARGET_FMT_plx
 
 struct pxa2xx_state_s *pxa270_init(unsigned int sdram_size, DisplayState *ds,
                 const char *revision);

Modified: trunk/src/host/qemu-neo1973/hw/pxa2xx.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pxa2xx.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pxa2xx.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -25,22 +25,34 @@
     { 0, 0 }
 };
 
-static struct {
+typedef struct PXASSPDef {
     target_phys_addr_t io_base;
     int irqn;
-} pxa250_ssp[] = {
+} PXASSPDef;
+
+#if 0
+static PXASSPDef pxa250_ssp[] = {
     { 0x41000000, PXA2XX_PIC_SSP },
     { 0, 0 }
-}, pxa255_ssp[] = {
+};
+#endif
+
+static PXASSPDef pxa255_ssp[] = {
     { 0x41000000, PXA2XX_PIC_SSP },
     { 0x41400000, PXA25X_PIC_NSSP },
     { 0, 0 }
-}, pxa26x_ssp[] = {
+};
+
+#if 0
+static PXASSPDef pxa26x_ssp[] = {
     { 0x41000000, PXA2XX_PIC_SSP },
     { 0x41400000, PXA25X_PIC_NSSP },
     { 0x41500000, PXA26X_PIC_ASSP },
     { 0, 0 }
-}, pxa27x_ssp[] = {
+};
+#endif
+
+static PXASSPDef pxa27x_ssp[] = {
     { 0x41000000, PXA2XX_PIC_SSP },
     { 0x41700000, PXA27X_PIC_SSP2 },
     { 0x41900000, PXA2XX_PIC_SSP3 },
@@ -297,7 +309,7 @@
                     ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
             s->env->cp15.c1_sys = 0;
             s->env->cp15.c1_coproc = 0;
-            s->env->cp15.c2_base = 0;
+            s->env->cp15.c2_base0 = 0;
             s->env->cp15.c3 = 0;
             s->pm_regs[PSSR >> 2] |= 0x8;	/* Set STS */
             s->pm_regs[RCSR >> 2] |= 0x8;	/* Set GPR */
@@ -2023,11 +2035,17 @@
         fprintf(stderr, "Machine requires a PXA27x processor.\n");
         exit(1);
     }
+    if (!revision)
+        revision = "pxa270";
+    
+    s->env = cpu_init(revision);
+    if (!s->env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
+    register_savevm("cpu", 0, ARM_CPU_SAVE_VERSION, cpu_save, cpu_load,
+                    s->env);
 
-    s->env = cpu_init();
-    cpu_arm_set_model(s->env, revision ?: "pxa270");
-    register_savevm("cpu", 0, 0, cpu_save, cpu_load, s->env);
-
     /* SDRAM & Internal Memory Storage */
     cpu_register_physical_memory(PXA2XX_SDRAM_BASE,
                     sdram_size, qemu_ram_alloc(sdram_size) | IO_MEM_RAM);
@@ -2132,11 +2150,16 @@
     struct pxa2xx_state_s *s;
     struct pxa2xx_ssp_s *ssp;
     int iomemtype, i;
+
     s = (struct pxa2xx_state_s *) qemu_mallocz(sizeof(struct pxa2xx_state_s));
 
-    s->env = cpu_init();
-    cpu_arm_set_model(s->env, "pxa255");
-    register_savevm("cpu", 0, 0, cpu_save, cpu_load, s->env);
+    s->env = cpu_init("pxa255");
+    if (!s->env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
+    register_savevm("cpu", 0, ARM_CPU_SAVE_VERSION, cpu_save, cpu_load,
+                    s->env);
 
     /* SDRAM & Internal Memory Storage */
     cpu_register_physical_memory(PXA2XX_SDRAM_BASE, sdram_size,

Modified: trunk/src/host/qemu-neo1973/hw/pxa2xx_dma.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/pxa2xx_dma.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/pxa2xx_dma.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -303,7 +303,7 @@
     }
 
     cpu_abort(cpu_single_env,
-                    "%s: Bad offset 0x%04lx\n", __FUNCTION__, offset);
+                    "%s: Bad offset 0x" TARGET_FMT_plx "\n", __FUNCTION__, offset);
     return 7;
 }
 
@@ -401,7 +401,7 @@
             break;
         }
     fail:
-        cpu_abort(cpu_single_env, "%s: Bad offset 0x%04lx\n",
+        cpu_abort(cpu_single_env, "%s: Bad offset " TARGET_FMT_plx "\n",
                 __FUNCTION__, offset);
     }
 }

Modified: trunk/src/host/qemu-neo1973/hw/r2d.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/r2d.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/r2d.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -35,8 +35,15 @@
     CPUState *env;
     struct SH7750State *s;
 
-    env = cpu_init();
+    if (!cpu_model)
+        cpu_model = "any";
 
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
+
     /* Allocate memory space */
     cpu_register_physical_memory(SDRAM_BASE, SDRAM_SIZE, 0);
     /* Register peripherals */

Modified: trunk/src/host/qemu-neo1973/hw/realview.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/realview.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/realview.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -25,28 +25,56 @@
     NICInfo *nd;
     int n;
     int done_smc = 0;
+    qemu_irq cpu_irq[4];
+    int ncpu;
 
-    env = cpu_init();
     if (!cpu_model)
         cpu_model = "arm926";
-    cpu_arm_set_model(env, cpu_model);
+    /* FIXME: obey smp_cpus.  */
+    if (strcmp(cpu_model, "arm11mpcore") == 0) {
+        ncpu = 4;
+    } else {
+        ncpu = 1;
+    }
+
+    for (n = 0; n < ncpu; n++) {
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find CPU definition\n");
+            exit(1);
+        }
+        pic = arm_pic_init_cpu(env);
+        cpu_irq[n] = pic[ARM_PIC_CPU_IRQ];
+        if (n > 0) {
+            /* Set entry point for secondary CPUs.  This assumes we're using
+               the init code from arm_boot.c.  Real hardware resets all CPUs
+               the same.  */
+            env->regs[15] = 0x80000000;
+        }
+    }
+
     /* ??? RAM shoud repeat to fill physical memory space.  */
     /* SDRAM at address zero.  */
     cpu_register_physical_memory(0, ram_size, IO_MEM_RAM);
 
     arm_sysctl_init(0x10000000, 0xc1400400);
-    pic = arm_pic_init_cpu(env);
-    /* ??? The documentation says GIC1 is nFIQ and either GIC2 or GIC3
-       is nIRQ (there are inconsistencies).  However Linux 2.6.17 expects
-       GIC1 to be nIRQ and ignores all the others, so do that for now.  */
-    pic = arm_gic_init(0x10040000, pic[ARM_PIC_CPU_IRQ]);
+
+    if (ncpu == 1) {
+        /* ??? The documentation says GIC1 is nFIQ and either GIC2 or GIC3
+           is nIRQ (there are inconsistencies).  However Linux 2.6.17 expects
+           GIC1 to be nIRQ and ignores all the others, so do that for now.  */
+        pic = realview_gic_init(0x10040000, cpu_irq[0]);
+    } else {
+        pic = mpcore_irq_init(cpu_irq);
+    }
+
     pl050_init(0x10006000, pic[20], 0);
     pl050_init(0x10007000, pic[21], 1);
 
-    pl011_init(0x10009000, pic[12], serial_hds[0]);
-    pl011_init(0x1000a000, pic[13], serial_hds[1]);
-    pl011_init(0x1000b000, pic[14], serial_hds[2]);
-    pl011_init(0x1000c000, pic[15], serial_hds[3]);
+    pl011_init(0x10009000, pic[12], serial_hds[0], PL011_ARM);
+    pl011_init(0x1000a000, pic[13], serial_hds[1], PL011_ARM);
+    pl011_init(0x1000b000, pic[14], serial_hds[2], PL011_ARM);
+    pl011_init(0x1000c000, pic[15], serial_hds[3], PL011_ARM);
 
     /* DMA controller is optional, apparently.  */
     pl080_init(0x10030000, pic[24], 2);
@@ -110,10 +138,10 @@
     /*  0x10019000 PCI controller config.  */
     /*  0x10020000 CLCD.  */
     /* 0x10030000 DMA Controller.  */
-    /* 0x10040000 GIC1 (FIQ1).  */
-    /* 0x10050000 GIC2 (IRQ1).  */
-    /*  0x10060000 GIC3 (FIQ2).  */
-    /*  0x10070000 GIC4 (IRQ2).  */
+    /* 0x10040000 GIC1.  */
+    /* 0x10050000 GIC2.  */
+    /* 0x10060000 GIC3.  */
+    /* 0x10070000 GIC4.  */
     /*  0x10080000 SMC.  */
     /*  0x40000000 NOR flash.  */
     /*  0x44000000 DoC flash.  */
@@ -133,8 +161,14 @@
     /* 0x68000000 PCI mem 1.  */
     /* 0x6c000000 PCI mem 2.  */
 
-    arm_load_kernel(env, ram_size, kernel_filename, kernel_cmdline,
+    arm_load_kernel(first_cpu, ram_size, kernel_filename, kernel_cmdline,
                     initrd_filename, 0x33b, 0x0);
+
+    /* ??? Hack to map an additional page of ram for the secondary CPU
+       startup code.  I guess this works on real hardware because the
+       BootROM happens to be in ROM/flash or in memory that isn't clobbered
+       until after Linux boots the secondary CPUs.  */
+    cpu_register_physical_memory(0x80000000, 0x1000, IO_MEM_RAM + ram_size);
 }
 
 QEMUMachine realview_machine = {

Added: trunk/src/host/qemu-neo1973/hw/realview_gic.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/realview_gic.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/realview_gic.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,64 @@
+/*
+ * ARM RealView Emulation Baseboard Interrupt Controller
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "vl.h"
+#include "arm_pic.h"
+
+#define GIC_NIRQ 96
+#define NCPU 1
+
+/* Only a single "CPU" interface is present.  */
+static inline int
+gic_get_current_cpu(void)
+{
+  return 0;
+}
+
+#include "arm_gic.c"
+
+static uint32_t realview_gic_cpu_read(void *opaque, target_phys_addr_t offset)
+{
+    gic_state *s = (gic_state *)opaque;
+    offset -= s->base;
+    return gic_cpu_read(s, gic_get_current_cpu(), offset);
+}
+
+static void realview_gic_cpu_write(void *opaque, target_phys_addr_t offset,
+                          uint32_t value)
+{
+    gic_state *s = (gic_state *)opaque;
+    offset -= s->base;
+    gic_cpu_write(s, gic_get_current_cpu(), offset, value);
+}
+
+static CPUReadMemoryFunc *realview_gic_cpu_readfn[] = {
+   realview_gic_cpu_read,
+   realview_gic_cpu_read,
+   realview_gic_cpu_read
+};
+
+static CPUWriteMemoryFunc *realview_gic_cpu_writefn[] = {
+   realview_gic_cpu_write,
+   realview_gic_cpu_write,
+   realview_gic_cpu_write
+};
+
+qemu_irq *realview_gic_init(uint32_t base, qemu_irq parent_irq)
+{
+    gic_state *s;
+    int iomemtype;
+
+    s = gic_init(base, &parent_irq);
+    if (!s)
+        return NULL;
+    iomemtype = cpu_register_io_memory(0, realview_gic_cpu_readfn,
+                                       realview_gic_cpu_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    return s->in;
+}

Modified: trunk/src/host/qemu-neo1973/hw/rtl8139.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/rtl8139.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/rtl8139.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1464,7 +1464,7 @@
     DEBUG_PRINT(("RTL8139: BasicModeCtrl register write(w) val=0x%04x\n", val));
 
     /* mask unwriteable bits */
-    uint32 mask = 0x4cff;
+    uint32_t mask = 0x4cff;
 
     if (1 || !rtl8139_config_writeable(s))
     {

Modified: trunk/src/host/qemu-neo1973/hw/s3c2410.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/s3c2410.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/s3c2410.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -2830,9 +2830,9 @@
     int iomemtype, i;
     s = (struct s3c_state_s *) qemu_mallocz(sizeof(struct s3c_state_s));
 
-    s->env = cpu_init();
-    cpu_arm_set_model(s->env, "arm920t");
-    register_savevm("cpu", 0, 0, cpu_save, cpu_load, s->env);
+    s->env = cpu_init("arm920t");
+    register_savevm("cpu", 0, ARM_CPU_SAVE_VERSION,
+                    cpu_save, cpu_load, s->env);
 
     cpu_register_physical_memory(S3C_RAM_BASE, sdram_size,
                     qemu_ram_alloc(sdram_size) | IO_MEM_RAM);

Modified: trunk/src/host/qemu-neo1973/hw/sh7750.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/sh7750.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/sh7750.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -573,7 +573,7 @@
     if (cpu_model & (SH_CPU_SH7750R | SH_CPU_SH7751 | SH_CPU_SH7751R)) {
         sh_intc_register_sources(&s->intc, 
 				 _INTC_ARRAY(vectors_tmu34),
-				 _INTC_ARRAY(NULL));
+				 NULL, 0);
         tmu012_init(0x1e100000, 0, s->periph_freq);
     }
 
@@ -586,7 +586,7 @@
     if (cpu_model & (SH_CPU_SH7750S | SH_CPU_SH7750R | SH_CPU_SH7751_ALL)) {
         sh_intc_register_sources(&s->intc, 
 				 _INTC_ARRAY(vectors_irlm),
-				 _INTC_ARRAY(NULL));
+				 NULL, 0);
     }
 
     return s;

Modified: trunk/src/host/qemu-neo1973/hw/shix.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/shix.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/shix.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -70,9 +70,12 @@
     int ret;
     CPUState *env;
     struct SH7750State *s;
+    
+    if (!cpu_model)
+        cpu_model = "any";
 
     printf("Initializing CPU\n");
-    env = cpu_init();
+    env = cpu_init(cpu_model);
 
     /* Allocate memory space */
     printf("Allocating ROM\n");

Modified: trunk/src/host/qemu-neo1973/hw/slavio_misc.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/slavio_misc.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/slavio_misc.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -46,11 +46,14 @@
     uint8_t aux1, aux2;
     uint8_t diag, mctrl;
     uint32_t sysctrl;
+    uint16_t leds;
 } MiscState;
 
 #define MISC_SIZE 1
 #define SYSCTRL_MAXADDR 3
 #define SYSCTRL_SIZE (SYSCTRL_MAXADDR + 1)
+#define LED_MAXADDR 2
+#define LED_SIZE (LED_MAXADDR + 1)
 
 static void slavio_misc_update_irq(void *opaque)
 {
@@ -223,6 +226,54 @@
     slavio_sysctrl_mem_writel,
 };
 
+static uint32_t slavio_led_mem_reads(void *opaque, target_phys_addr_t addr)
+{
+    MiscState *s = opaque;
+    uint32_t ret = 0, saddr;
+
+    saddr = addr & LED_MAXADDR;
+    switch (saddr) {
+    case 0:
+        ret = s->leds;
+        break;
+    default:
+        break;
+    }
+    MISC_DPRINTF("Read diagnostic LED reg 0x" TARGET_FMT_plx " = %x\n", addr,
+                 ret);
+    return ret;
+}
+
+static void slavio_led_mem_writes(void *opaque, target_phys_addr_t addr,
+                                  uint32_t val)
+{
+    MiscState *s = opaque;
+    uint32_t saddr;
+
+    saddr = addr & LED_MAXADDR;
+    MISC_DPRINTF("Write diagnostic LED reg 0x" TARGET_FMT_plx " =  %x\n", addr,
+                 val);
+    switch (saddr) {
+    case 0:
+        s->sysctrl = val;
+        break;
+    default:
+        break;
+    }
+}
+
+static CPUReadMemoryFunc *slavio_led_mem_read[3] = {
+    slavio_led_mem_reads,
+    slavio_led_mem_reads,
+    slavio_led_mem_reads,
+};
+
+static CPUWriteMemoryFunc *slavio_led_mem_write[3] = {
+    slavio_led_mem_writes,
+    slavio_led_mem_writes,
+    slavio_led_mem_writes,
+};
+
 static void slavio_misc_save(QEMUFile *f, void *opaque)
 {
     MiscState *s = opaque;
@@ -291,6 +342,13 @@
     // Power management
     cpu_register_physical_memory(power_base, MISC_SIZE, slavio_misc_io_memory);
 
+    /* 16 bit registers */
+    slavio_misc_io_memory = cpu_register_io_memory(0, slavio_led_mem_read,
+                                                   slavio_led_mem_write, s);
+    /* ss600mp diag LEDs */
+    cpu_register_physical_memory(base + 0x1600000, MISC_SIZE,
+                                 slavio_misc_io_memory);
+
     /* 32 bit registers */
     slavio_misc_io_memory = cpu_register_io_memory(0, slavio_sysctrl_mem_read,
                                                    slavio_sysctrl_mem_write,

Modified: trunk/src/host/qemu-neo1973/hw/slavio_timer.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/slavio_timer.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/slavio_timer.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -125,7 +125,7 @@
         // of counter (user mode)
         slavio_timer_get_out(s);
         if (slavio_timer_is_user(s)) // read user timer LSW
-            ret = s->count & 0xffffffe00;
+            ret = s->count & 0xfffffe00;
         else // read limit
             ret = (s->count & 0x7ffffe00) | s->reached;
         break;

Modified: trunk/src/host/qemu-neo1973/hw/smc91c111.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/smc91c111.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/smc91c111.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -413,7 +413,7 @@
         break;
     }
     cpu_abort (cpu_single_env, "smc91c111_write: Bad reg %d:%x\n",
-               s->bank, offset);
+               s->bank, (int)offset);
 }
 
 static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
@@ -555,7 +555,7 @@
         break;
     }
     cpu_abort (cpu_single_env, "smc91c111_read: Bad reg %d:%x\n",
-               s->bank, offset);
+               s->bank, (int)offset);
     return 0;
 }
 

Modified: trunk/src/host/qemu-neo1973/hw/spitz.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/spitz.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/spitz.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -12,7 +12,11 @@
 #define spitz_printf(format, ...)	\
     fprintf(stderr, "%s: " format, __FUNCTION__, ##__VA_ARGS__)
 #undef REG_FMT
+#if TARGET_PHYS_ADDR_BITS == 32
+#define REG_FMT			"0x%02x"
+#else
 #define REG_FMT			"0x%02lx"
+#endif
 
 /* Spitz Flash */
 #define FLASH_BASE		0x0c000000

Added: trunk/src/host/qemu-neo1973/hw/ssd0303.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/ssd0303.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/ssd0303.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,273 @@
+/*
+ * SSD0303 OLED controller with OSRAM Pictiva 96x16 display.
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+/* The controller can support a variety of different displays, but we only
+   implement one.  Most of the commends relating to brightness and geometry
+   setup are ignored. */
+#include "vl.h"
+
+//#define DEBUG_SSD0303 1
+
+#ifdef DEBUG_SSD0303
+#define DPRINTF(fmt, args...) \
+do { printf("ssd0303: " fmt , ##args); } while (0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "ssd0303: error: " fmt , ##args); exit(1);} while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "ssd0303: error: " fmt , ##args);} while (0)
+#endif
+
+/* Scaling factor for pixels.  */
+#define MAGNIFY 4
+
+enum ssd0303_mode
+{
+    SSD0303_IDLE,
+    SSD0303_DATA,
+    SSD0303_CMD
+};
+
+enum ssd0303_cmd {
+    SSD0303_CMD_NONE,
+    SSD0303_CMD_SKIP1
+};
+
+typedef struct {
+    i2c_slave i2c;
+    DisplayState *ds;
+    int row;
+    int col;
+    int start_line;
+    int mirror;
+    int flash;
+    int enabled;
+    int inverse;
+    int redraw;
+    enum ssd0303_mode mode;
+    enum ssd0303_cmd cmd_state;
+    uint8_t framebuffer[132*8];
+} ssd0303_state;
+
+static int ssd0303_recv(i2c_slave *i2c)
+{
+    BADF("Reads not implemented\n");
+    return -1;
+}
+
+static int ssd0303_send(i2c_slave *i2c, uint8_t data)
+{
+    ssd0303_state *s = (ssd0303_state *)i2c;
+    enum ssd0303_cmd old_cmd_state;
+    switch (s->mode) {
+    case SSD0303_IDLE:
+        DPRINTF("byte 0x%02x\n", data);
+        if (data == 0x80)
+            s->mode = SSD0303_CMD;
+        else if (data == 0x40)
+            s->mode = SSD0303_DATA;
+        else
+            BADF("Unexpected byte 0x%x\n", data);
+        break;
+    case SSD0303_DATA:
+        DPRINTF("data 0x%02x\n", data);
+        if (s->col < 132) {
+            s->framebuffer[s->col + s->row * 132] = data;
+            s->col++;
+            s->redraw = 1;
+        }
+        break;
+    case SSD0303_CMD:
+        old_cmd_state = s->cmd_state;
+        s->cmd_state = SSD0303_CMD_NONE;
+        switch (old_cmd_state) {
+        case SSD0303_CMD_NONE:
+            DPRINTF("cmd 0x%02x\n", data);
+            s->mode = SSD0303_IDLE;
+            switch (data) {
+            case 0x00 ... 0x0f: /* Set lower colum address.  */
+                s->col = (s->col & 0xf0) | (data & 0xf);
+                break;
+            case 0x10 ... 0x20: /* Set higher column address.  */
+                s->col = (s->col & 0x0f) | ((data & 0xf) << 4);
+                break;
+            case 0x40 ... 0x7f: /* Set start line.  */
+                s->start_line = 0;
+                break;
+            case 0x81: /* Set contrast (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xa0: /* Mirror off.  */
+                s->mirror = 0;
+                break;
+            case 0xa1: /* Mirror off.  */
+                s->mirror = 1;
+                break;
+            case 0xa4: /* Entire display off.  */
+                s->flash = 0;
+                break;
+            case 0xa5: /* Entire display on.  */
+                s->flash = 1;
+                break;
+            case 0xa6: /* Inverse off.  */
+                s->inverse = 0;
+                break;
+            case 0xa7: /* Inverse on.  */
+                s->inverse = 1;
+                break;
+            case 0xa8: /* Set multipled ratio (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xad: /* DC-DC power control.  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xae: /* Display off.  */
+                s->enabled = 0;
+                break;
+            case 0xaf: /* Display on.  */
+                s->enabled = 1;
+                break;
+            case 0xb0 ... 0xbf: /* Set Page address.  */
+                s->row = data & 7;
+                break;
+            case 0xc0 ... 0xc8: /* Set COM output direction (Ignored).  */
+                break;
+            case 0xd3: /* Set display offset (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xd5: /* Set display clock (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xd8: /* Set color and power mode (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xd9: /* Set pre-charge period (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xda: /* Set COM pin configuration (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xdb: /* Set VCOM dselect level (Ignored).  */
+                s->cmd_state = SSD0303_CMD_SKIP1;
+                break;
+            case 0xe3: /* no-op.  */
+                break;
+            default:
+                BADF("Unknown command: 0x%x\n", data);
+            }
+            break;
+        case SSD0303_CMD_SKIP1:
+            DPRINTF("skip 0x%02x\n", data);
+            break;
+        }
+        break;
+    }
+    return 0;
+}
+
+static void ssd0303_event(i2c_slave *i2c, enum i2c_event event)
+{
+    ssd0303_state *s = (ssd0303_state *)i2c;
+    switch (event) {
+    case I2C_FINISH:
+        s->mode = SSD0303_IDLE;
+        break;
+    case I2C_START_RECV:
+    case I2C_START_SEND:
+    case I2C_NACK:
+        /* Nothing to do.  */
+        break;
+    }
+}
+
+static void ssd0303_update_display(void *opaque)
+{
+    ssd0303_state *s = (ssd0303_state *)opaque;
+    uint8_t *dest;
+    uint8_t *src;
+    int x;
+    int y;
+    int line;
+    char *colors[2];
+    char colortab[MAGNIFY * 8];
+    int dest_width;
+    uint8_t mask;
+
+    if (s->redraw) {
+        switch (s->ds->depth) {
+        case 0:
+            return;
+        case 15:
+            dest_width = 2;
+            break;
+        case 16:
+            dest_width = 2;
+            break;
+        case 24:
+            dest_width = 3;
+            break;
+        case 32:
+            dest_width = 4;
+            break;
+        default:
+            BADF("Bad color depth\n");
+            return;
+        }
+        dest_width *= MAGNIFY;
+        memset(colortab, 0xff, dest_width);
+        memset(colortab + dest_width, 0, dest_width);
+        if (s->flash) {
+            colors[0] = colortab;
+            colors[1] = colortab;
+        } else if (s->inverse) {
+            colors[0] = colortab;
+            colors[1] = colortab + dest_width;
+        } else {
+            colors[0] = colortab + dest_width;
+            colors[1] = colortab;
+        }
+        dest = s->ds->data;
+        for (y = 0; y < 16; y++) {
+            line = (y + s->start_line) & 63;
+            src = s->framebuffer + 132 * (line >> 3) + 36;
+            mask = 1 << (line & 7);
+            for (x = 0; x < 96; x++) {
+                memcpy(dest, colors[(*src & mask) != 0], dest_width);
+                dest += dest_width;
+                src++;
+            }
+            for (x = 1; x < MAGNIFY; x++) {
+                memcpy(dest, dest - dest_width * 96, dest_width * 96);
+                dest += dest_width * 96;
+            }
+        }
+    }
+    dpy_update(s->ds, 0, 0, 96 * MAGNIFY, 16 * MAGNIFY);
+}
+
+static void ssd0303_invalidate_display(void * opaque)
+{
+    ssd0303_state *s = (ssd0303_state *)opaque;
+    s->redraw = 1;
+}
+
+void ssd0303_init(DisplayState *ds, i2c_bus *bus, int address)
+{
+    ssd0303_state *s;
+
+    s = (ssd0303_state *)i2c_slave_init(bus, address, sizeof(ssd0303_state));
+    s->ds = ds;
+    s->i2c.event = ssd0303_event;
+    s->i2c.recv = ssd0303_recv;
+    s->i2c.send = ssd0303_send;
+    graphic_console_init(ds, ssd0303_update_display, ssd0303_invalidate_display,
+                         NULL, s);
+    dpy_resize(s->ds, 96 * MAGNIFY, 16 * MAGNIFY);
+}

Added: trunk/src/host/qemu-neo1973/hw/ssd0323.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/ssd0323.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/ssd0323.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,267 @@
+/*
+ * SSD0323 OLED controller with OSRAM Pictiva 128x64 display.
+ *
+ * Copyright (c) 2006-2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+/* The controller can support a variety of different displays, but we only
+   implement one.  Most of the commends relating to brightness and geometry
+   setup are ignored. */
+#include "vl.h"
+
+//#define DEBUG_SSD0323 1
+
+#ifdef DEBUG_SSD0323
+#define DPRINTF(fmt, args...) \
+do { printf("ssd0323: " fmt , ##args); } while (0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "ssd0323: error: " fmt , ##args); exit(1);} while (0)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#define BADF(fmt, args...) \
+do { fprintf(stderr, "ssd0323: error: " fmt , ##args);} while (0)
+#endif
+
+/* Scaling factor for pixels.  */
+#define MAGNIFY 4
+
+enum ssd0323_mode
+{
+    SSD0323_CMD,
+    SSD0323_DATA
+};
+
+typedef struct {
+    DisplayState *ds;
+
+    int cmd_len;
+    int cmd;
+    int cmd_data[8];
+    int row;
+    int row_start;
+    int row_end;
+    int col;
+    int col_start;
+    int col_end;
+    int redraw;
+    enum ssd0323_mode mode;
+    uint8_t framebuffer[128 * 80 / 2];
+} ssd0323_state;
+
+int ssd0323_xfer_ssi(void *opaque, int data)
+{
+    ssd0323_state *s = (ssd0323_state *)opaque;
+    switch (s->mode) {
+    case SSD0323_DATA:
+        DPRINTF("data 0x%02x\n", data);
+        s->framebuffer[s->col + s->row * 64] = data;
+        s->col++;
+        if (s->col > s->col_end) {
+            s->row++;
+            s->col = s->col_start;
+        }
+        if (s->row > s->row_end) {
+            s->row = s->row_start;
+        }
+        s->redraw = 1;
+        break;
+    case SSD0323_CMD:
+        DPRINTF("cmd 0x%02x\n", data);
+        if (s->cmd_len == 0) {
+            s->cmd = data;
+        } else {
+            s->cmd_data[s->cmd_len - 1] = data;
+        }
+        s->cmd_len++;
+        switch (s->cmd) {
+#define DATA(x) if (s->cmd_len <= (x)) return 0
+        case 0x15: /* Set column.  */
+            DATA(2);
+            s->col_start = s->cmd_data[0] % 64;
+            s->col_end = s->cmd_data[1] % 64;
+            break;
+        case 0x75: /* Set row.  */
+            DATA(2);
+            s->row_start = s->cmd_data[0] % 80;
+            s->row_end = s->cmd_data[1] % 80;
+            break;
+        case 0x81: /* Set contrast */
+            DATA(1);
+            break;
+        case 0x84: case 0x85: case 0x86: /* Max current.  */
+            DATA(0);
+            break;
+        case 0xa0: /* Set remapping.  */
+            /* FIXME: Implement this.  */
+            DATA(1);
+            break;
+        case 0xa1: /* Set display start line.  */
+        case 0xa2: /* Set display offset.  */
+            /* FIXME: Implement these.  */
+            DATA(1);
+            break;
+        case 0xa4: /* Normal mode.  */
+        case 0xa5: /* All on.  */
+        case 0xa6: /* All off.  */
+        case 0xa7: /* Inverse.  */
+            /* FIXME: Implement these.  */
+            DATA(0);
+            break;
+        case 0xa8: /* Set multiplex ratio.  */
+        case 0xad: /* Set DC-DC converter.  */
+            DATA(1);
+            /* Ignored.  Don't care.  */
+            break;
+        case 0xae: /* Display off.  */
+        case 0xaf: /* Display on.  */
+            DATA(0);
+            /* TODO: Implement power control.  */
+            break;
+        case 0xb1: /* Set phase length.  */
+        case 0xb2: /* Set row period.  */
+        case 0xb3: /* Set clock rate.  */
+        case 0xbc: /* Set precharge.  */
+        case 0xbe: /* Set VCOMH.  */
+        case 0xbf: /* Set segment low.  */
+            DATA(1);
+            /* Ignored.  Don't care.  */
+            break;
+        case 0xb8: /* Set grey scale table.  */
+            /* FIXME: Implement this.  */
+            DATA(8);
+            break;
+        case 0xe3: /* NOP.  */
+            DATA(0);
+            break;
+        default:
+            BADF("Unknown command: 0x%x\n", data);
+        }
+        s->cmd_len = 0;
+        return 0;
+    }
+    return 0;
+}
+
+static void ssd0323_update_display(void *opaque)
+{
+    ssd0323_state *s = (ssd0323_state *)opaque;
+    uint8_t *dest;
+    uint8_t *src;
+    int x;
+    int y;
+    int i;
+    int line;
+    char *colors[16];
+    char colortab[MAGNIFY * 64];
+    char *p;
+    int dest_width;
+
+    if (s->redraw) {
+        switch (s->ds->depth) {
+        case 0:
+            return;
+        case 15:
+            dest_width = 2;
+            break;
+        case 16:
+            dest_width = 2;
+            break;
+        case 24:
+            dest_width = 3;
+            break;
+        case 32:
+            dest_width = 4;
+            break;
+        default:
+            BADF("Bad color depth\n");
+            return;
+        }
+        p = colortab;
+        for (i = 0; i < 16; i++) {
+            int n;
+            colors[i] = p;
+            switch (s->ds->depth) {
+            case 15:
+                n = i * 2 + (i >> 3);
+                p[0] = n | (n << 5);
+                p[1] = (n << 2) | (n >> 3);
+                break;
+            case 16:
+                n = i * 2 + (i >> 3);
+                p[0] = n | (n << 6) | ((n << 1) & 0x20);
+                p[1] = (n << 3) | (n >> 2);
+                break;
+            case 24:
+            case 32:
+                n = (i << 4) | i;
+                p[0] = p[1] = p[2] = n;
+                break;
+            default:
+                BADF("Bad color depth\n");
+                return;
+            }
+            p += dest_width;
+        }
+        dest = s->ds->data;
+        for (y = 0; y < 64; y++) {
+            line = y;
+            src = s->framebuffer + 64 * line;
+            for (x = 0; x < 64; x++) {
+                int val;
+                val = *src >> 4;
+                for (i = 0; i < MAGNIFY; i++) {
+                    memcpy(dest, colors[val], dest_width);
+                    dest += dest_width;
+                }
+                val = *src & 0xf;
+                for (i = 0; i < MAGNIFY; i++) {
+                    memcpy(dest, colors[val], dest_width);
+                    dest += dest_width;
+                }
+                src++;
+            }
+            for (i = 1; i < MAGNIFY; i++) {
+                memcpy(dest, dest - dest_width * MAGNIFY * 128,
+                       dest_width * 128 * MAGNIFY);
+                dest += dest_width * 128 * MAGNIFY;
+            }
+        }
+    }
+    dpy_update(s->ds, 0, 0, 128 * MAGNIFY, 64 * MAGNIFY);
+}
+
+static void ssd0323_invalidate_display(void * opaque)
+{
+    ssd0323_state *s = (ssd0323_state *)opaque;
+    s->redraw = 1;
+}
+
+/* Command/data input.  */
+static void ssd0323_cd(void *opaque, int n, int level)
+{
+    ssd0323_state *s = (ssd0323_state *)opaque;
+    DPRINTF("%s mode\n", level ? "Data" : "Command");
+    s->mode = level ? SSD0323_DATA : SSD0323_CMD;
+}
+
+void *ssd0323_init(DisplayState *ds, qemu_irq *cmd_p)
+{
+    ssd0323_state *s;
+    qemu_irq *cmd;
+
+    s = (ssd0323_state *)qemu_mallocz(sizeof(ssd0323_state));
+    s->ds = ds;
+    graphic_console_init(ds, ssd0323_update_display, ssd0323_invalidate_display,
+                         NULL, s);
+    dpy_resize(s->ds, 128 * MAGNIFY, 64 * MAGNIFY);
+    s->col_end = 63;
+    s->row_end = 79;
+
+    cmd = qemu_allocate_irqs(ssd0323_cd, s, 1);
+    *cmd_p = *cmd;
+
+    return s;
+}

Added: trunk/src/host/qemu-neo1973/hw/stellaris.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/stellaris.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/stellaris.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,1101 @@
+/*
+ * Luminary Micro Stellaris preipherals
+ *
+ * Copyright (c) 2006 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "vl.h"
+#include "arm_pic.h"
+
+typedef const struct {
+    const char *name;
+    uint32_t did0;
+    uint32_t did1;
+    uint32_t dc0;
+    uint32_t dc1;
+    uint32_t dc2;
+    uint32_t dc3;
+    uint32_t dc4;
+    enum {OLED_I2C, OLED_SSI} oled;
+} stellaris_board_info;
+
+/* General purpose timer module.  */
+
+/* Multiplication factor to convert from GPTM timer ticks to qemu timer
+   ticks.  */
+static int stellaris_clock_scale;
+
+typedef struct gptm_state {
+    uint32_t config;
+    uint32_t mode[2];
+    uint32_t control;
+    uint32_t state;
+    uint32_t mask;
+    uint32_t load[2];
+    uint32_t match[2];
+    uint32_t prescale[2];
+    uint32_t match_prescale[2];
+    uint32_t rtc;
+    int64_t tick[2];
+    struct gptm_state *opaque[2];
+    uint32_t base;
+    QEMUTimer *timer[2];
+    /* The timers have an alternate output used to trigger the ADC.  */
+    qemu_irq trigger;
+    qemu_irq irq;
+} gptm_state;
+
+static void gptm_update_irq(gptm_state *s)
+{
+    int level;
+    level = (s->state & s->mask) != 0;
+    qemu_set_irq(s->irq, level);
+}
+
+static void gptm_stop(gptm_state *s, int n)
+{
+    qemu_del_timer(s->timer[n]);
+}
+
+static void gptm_reload(gptm_state *s, int n, int reset)
+{
+    int64_t tick;
+    if (reset)
+        tick = qemu_get_clock(vm_clock);
+    else
+        tick = s->tick[n];
+
+    if (s->config == 0) {
+        /* 32-bit CountDown.  */
+        uint32_t count;
+        count = s->load[0] | (s->load[1] << 16);
+        tick += (int64_t)count * stellaris_clock_scale;
+    } else if (s->config == 1) {
+        /* 32-bit RTC.  1Hz tick.  */
+        tick += ticks_per_sec;
+    } else if (s->mode[n] == 0xa) {
+        /* PWM mode.  Not implemented.  */
+    } else {
+        cpu_abort(cpu_single_env, "TODO: 16-bit timer mode 0x%x\n",
+                  s->mode[n]);
+    }
+    s->tick[n] = tick;
+    qemu_mod_timer(s->timer[n], tick);
+}
+
+static void gptm_tick(void *opaque)
+{
+    gptm_state **p = (gptm_state **)opaque;
+    gptm_state *s;
+    int n;
+
+    s = *p;
+    n = p - s->opaque;
+    if (s->config == 0) {
+        s->state |= 1;
+        if ((s->control & 0x20)) {
+            /* Output trigger.  */
+	    qemu_irq_raise(s->trigger);
+	    qemu_irq_lower(s->trigger);
+        }
+        if (s->mode[0] & 1) {
+            /* One-shot.  */
+            s->control &= ~1;
+        } else {
+            /* Periodic.  */
+            gptm_reload(s, 0, 0);
+        }
+    } else if (s->config == 1) {
+        /* RTC.  */
+        uint32_t match;
+        s->rtc++;
+        match = s->match[0] | (s->match[1] << 16);
+        if (s->rtc > match)
+            s->rtc = 0;
+        if (s->rtc == 0) {
+            s->state |= 8;
+        }
+        gptm_reload(s, 0, 0);
+    } else if (s->mode[n] == 0xa) {
+        /* PWM mode.  Not implemented.  */
+    } else {
+        cpu_abort(cpu_single_env, "TODO: 16-bit timer mode 0x%x\n",
+                  s->mode[n]);
+    }
+    gptm_update_irq(s);
+}
+
+static uint32_t gptm_read(void *opaque, target_phys_addr_t offset)
+{
+    gptm_state *s = (gptm_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x00: /* CFG */
+        return s->config;
+    case 0x04: /* TAMR */
+        return s->mode[0];
+    case 0x08: /* TBMR */
+        return s->mode[1];
+    case 0x0c: /* CTL */
+        return s->control;
+    case 0x18: /* IMR */
+        return s->mask;
+    case 0x1c: /* RIS */
+        return s->state;
+    case 0x20: /* MIS */
+        return s->state & s->mask;
+    case 0x24: /* CR */
+        return 0;
+    case 0x28: /* TAILR */
+        return s->load[0] | ((s->config < 4) ? (s->load[1] << 16) : 0);
+    case 0x2c: /* TBILR */
+        return s->load[1];
+    case 0x30: /* TAMARCHR */
+        return s->match[0] | ((s->config < 4) ? (s->match[1] << 16) : 0);
+    case 0x34: /* TBMATCHR */
+        return s->match[1];
+    case 0x38: /* TAPR */
+        return s->prescale[0];
+    case 0x3c: /* TBPR */
+        return s->prescale[1];
+    case 0x40: /* TAPMR */
+        return s->match_prescale[0];
+    case 0x44: /* TBPMR */
+        return s->match_prescale[1];
+    case 0x48: /* TAR */
+        if (s->control == 1)
+            return s->rtc;
+    case 0x4c: /* TBR */
+        cpu_abort(cpu_single_env, "TODO: Timer value read\n");
+    default:
+        cpu_abort(cpu_single_env, "gptm_read: Bad offset 0x%x\n", (int)offset);
+        return 0;
+    }
+}
+
+static void gptm_write(void *opaque, target_phys_addr_t offset, uint32_t value)
+{
+    gptm_state *s = (gptm_state *)opaque;
+    uint32_t oldval;
+
+    offset -= s->base;
+    /* The timers should be disabled before changing the configuration.
+       We take advantage of this and defer everything until the timer
+       is enabled.  */
+    switch (offset) {
+    case 0x00: /* CFG */
+        s->config = value;
+        break;
+    case 0x04: /* TAMR */
+        s->mode[0] = value;
+        break;
+    case 0x08: /* TBMR */
+        s->mode[1] = value;
+        break;
+    case 0x0c: /* CTL */
+        oldval = s->control;
+        s->control = value;
+        /* TODO: Implement pause.  */
+        if ((oldval ^ value) & 1) {
+            if (value & 1) {
+                gptm_reload(s, 0, 1);
+            } else {
+                gptm_stop(s, 0);
+            }
+        }
+        if (((oldval ^ value) & 0x100) && s->config >= 4) {
+            if (value & 0x100) {
+                gptm_reload(s, 1, 1);
+            } else {
+                gptm_stop(s, 1);
+            }
+        }
+        break;
+    case 0x18: /* IMR */
+        s->mask = value & 0x77;
+        gptm_update_irq(s);
+        break;
+    case 0x24: /* CR */
+        s->state &= ~value;
+        break;
+    case 0x28: /* TAILR */
+        s->load[0] = value & 0xffff;
+        if (s->config < 4) {
+            s->load[1] = value >> 16;
+        }
+        break;
+    case 0x2c: /* TBILR */
+        s->load[1] = value & 0xffff;
+        break;
+    case 0x30: /* TAMARCHR */
+        s->match[0] = value & 0xffff;
+        if (s->config < 4) {
+            s->match[1] = value >> 16;
+        }
+        break;
+    case 0x34: /* TBMATCHR */
+        s->match[1] = value >> 16;
+        break;
+    case 0x38: /* TAPR */
+        s->prescale[0] = value;
+        break;
+    case 0x3c: /* TBPR */
+        s->prescale[1] = value;
+        break;
+    case 0x40: /* TAPMR */
+        s->match_prescale[0] = value;
+        break;
+    case 0x44: /* TBPMR */
+        s->match_prescale[0] = value;
+        break;
+    default:
+        cpu_abort(cpu_single_env, "gptm_write: Bad offset 0x%x\n", (int)offset);
+    }
+    gptm_update_irq(s);
+}
+
+static CPUReadMemoryFunc *gptm_readfn[] = {
+   gptm_read,
+   gptm_read,
+   gptm_read
+};
+
+static CPUWriteMemoryFunc *gptm_writefn[] = {
+   gptm_write,
+   gptm_write,
+   gptm_write
+};
+
+static void stellaris_gptm_init(uint32_t base, qemu_irq irq, qemu_irq trigger)
+{
+    int iomemtype;
+    gptm_state *s;
+
+    s = (gptm_state *)qemu_mallocz(sizeof(gptm_state));
+    s->base = base;
+    s->irq = irq;
+    s->trigger = trigger;
+    s->opaque[0] = s->opaque[1] = s;
+
+    iomemtype = cpu_register_io_memory(0, gptm_readfn,
+                                       gptm_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    s->timer[0] = qemu_new_timer(vm_clock, gptm_tick, &s->opaque[0]);
+    s->timer[1] = qemu_new_timer(vm_clock, gptm_tick, &s->opaque[1]);
+    /* ??? Save/restore.  */
+}
+
+
+/* System controller.  */
+
+typedef struct {
+    uint32_t base;
+    uint32_t pborctl;
+    uint32_t ldopctl;
+    uint32_t int_status;
+    uint32_t int_mask;
+    uint32_t resc;
+    uint32_t rcc;
+    uint32_t rcgc[3];
+    uint32_t scgc[3];
+    uint32_t dcgc[3];
+    uint32_t clkvclr;
+    uint32_t ldoarst;
+    qemu_irq irq;
+    stellaris_board_info *board;
+} ssys_state;
+
+static void ssys_update(ssys_state *s)
+{
+  qemu_set_irq(s->irq, (s->int_status & s->int_mask) != 0);
+}
+
+static uint32_t pllcfg_sandstorm[16] = {
+    0x31c0, /* 1 Mhz */
+    0x1ae0, /* 1.8432 Mhz */
+    0x18c0, /* 2 Mhz */
+    0xd573, /* 2.4576 Mhz */
+    0x37a6, /* 3.57954 Mhz */
+    0x1ae2, /* 3.6864 Mhz */
+    0x0c40, /* 4 Mhz */
+    0x98bc, /* 4.906 Mhz */
+    0x935b, /* 4.9152 Mhz */
+    0x09c0, /* 5 Mhz */
+    0x4dee, /* 5.12 Mhz */
+    0x0c41, /* 6 Mhz */
+    0x75db, /* 6.144 Mhz */
+    0x1ae6, /* 7.3728 Mhz */
+    0x0600, /* 8 Mhz */
+    0x585b /* 8.192 Mhz */
+};
+
+static uint32_t pllcfg_fury[16] = {
+    0x3200, /* 1 Mhz */
+    0x1b20, /* 1.8432 Mhz */
+    0x1900, /* 2 Mhz */
+    0xf42b, /* 2.4576 Mhz */
+    0x37e3, /* 3.57954 Mhz */
+    0x1b21, /* 3.6864 Mhz */
+    0x0c80, /* 4 Mhz */
+    0x98ee, /* 4.906 Mhz */
+    0xd5b4, /* 4.9152 Mhz */
+    0x0a00, /* 5 Mhz */
+    0x4e27, /* 5.12 Mhz */
+    0x1902, /* 6 Mhz */
+    0xec1c, /* 6.144 Mhz */
+    0x1b23, /* 7.3728 Mhz */
+    0x0640, /* 8 Mhz */
+    0xb11c /* 8.192 Mhz */
+};
+
+static uint32_t ssys_read(void *opaque, target_phys_addr_t offset)
+{
+    ssys_state *s = (ssys_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x000: /* DID0 */
+        return s->board->did0;
+    case 0x004: /* DID1 */
+        return s->board->did1;
+    case 0x008: /* DC0 */
+        return s->board->dc0;
+    case 0x010: /* DC1 */
+        return s->board->dc1;
+    case 0x014: /* DC2 */
+        return s->board->dc2;
+    case 0x018: /* DC3 */
+        return s->board->dc3;
+    case 0x01c: /* DC4 */
+        return s->board->dc4;
+    case 0x030: /* PBORCTL */
+        return s->pborctl;
+    case 0x034: /* LDOPCTL */
+        return s->ldopctl;
+    case 0x040: /* SRCR0 */
+        return 0;
+    case 0x044: /* SRCR1 */
+        return 0;
+    case 0x048: /* SRCR2 */
+        return 0;
+    case 0x050: /* RIS */
+        return s->int_status;
+    case 0x054: /* IMC */
+        return s->int_mask;
+    case 0x058: /* MISC */
+        return s->int_status & s->int_mask;
+    case 0x05c: /* RESC */
+        return s->resc;
+    case 0x060: /* RCC */
+        return s->rcc;
+    case 0x064: /* PLLCFG */
+        {
+            int xtal;
+            xtal = (s->rcc >> 6) & 0xf;
+            if (s->board->did0 & (1 << 16)) {
+                return pllcfg_fury[xtal];
+            } else {
+                return pllcfg_sandstorm[xtal];
+            }
+        }
+    case 0x100: /* RCGC0 */
+        return s->rcgc[0];
+    case 0x104: /* RCGC1 */
+        return s->rcgc[1];
+    case 0x108: /* RCGC2 */
+        return s->rcgc[2];
+    case 0x110: /* SCGC0 */
+        return s->scgc[0];
+    case 0x114: /* SCGC1 */
+        return s->scgc[1];
+    case 0x118: /* SCGC2 */
+        return s->scgc[2];
+    case 0x120: /* DCGC0 */
+        return s->dcgc[0];
+    case 0x124: /* DCGC1 */
+        return s->dcgc[1];
+    case 0x128: /* DCGC2 */
+        return s->dcgc[2];
+    case 0x150: /* CLKVCLR */
+        return s->clkvclr;
+    case 0x160: /* LDOARST */
+        return s->ldoarst;
+    default:
+        cpu_abort(cpu_single_env, "gptm_read: Bad offset 0x%x\n", (int)offset);
+        return 0;
+    }
+}
+
+static void ssys_write(void *opaque, target_phys_addr_t offset, uint32_t value)
+{
+    ssys_state *s = (ssys_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x030: /* PBORCTL */
+        s->pborctl = value & 0xffff;
+        break;
+    case 0x034: /* LDOPCTL */
+        s->ldopctl = value & 0x1f;
+        break;
+    case 0x040: /* SRCR0 */
+    case 0x044: /* SRCR1 */
+    case 0x048: /* SRCR2 */
+        fprintf(stderr, "Peripheral reset not implemented\n");
+        break;
+    case 0x054: /* IMC */
+        s->int_mask = value & 0x7f;
+        break;
+    case 0x058: /* MISC */
+        s->int_status &= ~value;
+        break;
+    case 0x05c: /* RESC */
+        s->resc = value & 0x3f;
+        break;
+    case 0x060: /* RCC */
+        if ((s->rcc & (1 << 13)) != 0 && (value & (1 << 13)) == 0) {
+            /* PLL enable.  */
+            s->int_status |= (1 << 6);
+        }
+        s->rcc = value;
+        stellaris_clock_scale = 5 * (((s->rcc >> 23) & 0xf) + 1);
+        break;
+    case 0x100: /* RCGC0 */
+        s->rcgc[0] = value;
+        break;
+    case 0x104: /* RCGC1 */
+        s->rcgc[1] = value;
+        break;
+    case 0x108: /* RCGC2 */
+        s->rcgc[2] = value;
+        break;
+    case 0x110: /* SCGC0 */
+        s->scgc[0] = value;
+        break;
+    case 0x114: /* SCGC1 */
+        s->scgc[1] = value;
+        break;
+    case 0x118: /* SCGC2 */
+        s->scgc[2] = value;
+        break;
+    case 0x120: /* DCGC0 */
+        s->dcgc[0] = value;
+        break;
+    case 0x124: /* DCGC1 */
+        s->dcgc[1] = value;
+        break;
+    case 0x128: /* DCGC2 */
+        s->dcgc[2] = value;
+        break;
+    case 0x150: /* CLKVCLR */
+        s->clkvclr = value;
+        break;
+    case 0x160: /* LDOARST */
+        s->ldoarst = value;
+        break;
+    default:
+        cpu_abort(cpu_single_env, "gptm_write: Bad offset 0x%x\n", (int)offset);
+    }
+    ssys_update(s);
+}
+
+static CPUReadMemoryFunc *ssys_readfn[] = {
+   ssys_read,
+   ssys_read,
+   ssys_read
+};
+
+static CPUWriteMemoryFunc *ssys_writefn[] = {
+   ssys_write,
+   ssys_write,
+   ssys_write
+};
+
+void ssys_reset(void *opaque)
+{
+    ssys_state *s = (ssys_state *)opaque;
+
+    s->pborctl = 0x7ffd;
+    s->rcc = 0x078e3ac0;
+    s->rcgc[0] = 1;
+    s->scgc[0] = 1;
+    s->dcgc[0] = 1;
+}
+
+static void stellaris_sys_init(uint32_t base, qemu_irq irq,
+                               stellaris_board_info * board)
+{
+    int iomemtype;
+    ssys_state *s;
+
+    s = (ssys_state *)qemu_mallocz(sizeof(ssys_state));
+    s->base = base;
+    s->irq = irq;
+    s->board = board;
+
+    iomemtype = cpu_register_io_memory(0, ssys_readfn,
+                                       ssys_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    ssys_reset(s);
+    /* ??? Save/restore.  */
+}
+
+
+/* I2C controller.  */
+
+typedef struct {
+    i2c_bus *bus;
+    qemu_irq irq;
+    uint32_t base;
+    uint32_t msa;
+    uint32_t mcs;
+    uint32_t mdr;
+    uint32_t mtpr;
+    uint32_t mimr;
+    uint32_t mris;
+    uint32_t mcr;
+} stellaris_i2c_state;
+
+#define STELLARIS_I2C_MCS_BUSY    0x01
+#define STELLARIS_I2C_MCS_ERROR   0x02
+#define STELLARIS_I2C_MCS_ADRACK  0x04
+#define STELLARIS_I2C_MCS_DATACK  0x08
+#define STELLARIS_I2C_MCS_ARBLST  0x10
+#define STELLARIS_I2C_MCS_IDLE    0x20
+#define STELLARIS_I2C_MCS_BUSBSY  0x40
+
+static uint32_t stellaris_i2c_read(void *opaque, target_phys_addr_t offset)
+{
+    stellaris_i2c_state *s = (stellaris_i2c_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x00: /* MSA */
+        return s->msa;
+    case 0x04: /* MCS */
+        /* We don't emulate timing, so the controller is never busy.  */
+        return s->mcs | STELLARIS_I2C_MCS_IDLE;
+    case 0x08: /* MDR */
+        return s->mdr;
+    case 0x0c: /* MTPR */
+        return s->mtpr;
+    case 0x10: /* MIMR */
+        return s->mimr;
+    case 0x14: /* MRIS */
+        return s->mris;
+    case 0x18: /* MMIS */
+        return s->mris & s->mimr;
+    case 0x20: /* MCR */
+        return s->mcr;
+    default:
+        cpu_abort(cpu_single_env, "strllaris_i2c_read: Bad offset 0x%x\n",
+                  (int)offset);
+        return 0;
+    }
+}
+
+static void stellaris_i2c_update(stellaris_i2c_state *s)
+{
+    int level;
+
+    level = (s->mris & s->mimr) != 0;
+    qemu_set_irq(s->irq, level);
+}
+
+static void stellaris_i2c_write(void *opaque, target_phys_addr_t offset,
+                                uint32_t value)
+{
+    stellaris_i2c_state *s = (stellaris_i2c_state *)opaque;
+
+    offset -= s->base;
+    switch (offset) {
+    case 0x00: /* MSA */
+        s->msa = value & 0xff;
+        break;
+    case 0x04: /* MCS */
+        if ((s->mcr & 0x10) == 0) {
+            /* Disabled.  Do nothing.  */
+            break;
+        }
+        /* Grab the bus if this is starting a transfer.  */
+        if ((value & 2) && (s->mcs & STELLARIS_I2C_MCS_BUSBSY) == 0) {
+            if (i2c_start_transfer(s->bus, s->msa >> 1, s->msa & 1)) {
+                s->mcs |= STELLARIS_I2C_MCS_ARBLST;
+            } else {
+                s->mcs &= ~STELLARIS_I2C_MCS_ARBLST;
+                s->mcs |= STELLARIS_I2C_MCS_BUSBSY;
+            }
+        }
+        /* If we don't have the bus then indicate an error.  */
+        if (!i2c_bus_busy(s->bus)
+                || (s->mcs & STELLARIS_I2C_MCS_BUSBSY) == 0) {
+            s->mcs |= STELLARIS_I2C_MCS_ERROR;
+            break;
+        }
+        s->mcs &= ~STELLARIS_I2C_MCS_ERROR;
+        if (value & 1) {
+            /* Transfer a byte.  */
+            /* TODO: Handle errors.  */
+            if (s->msa & 1) {
+                /* Recv */
+                s->mdr = i2c_recv(s->bus) & 0xff;
+            } else {
+                /* Send */
+                i2c_send(s->bus, s->mdr);
+            }
+            /* Raise an interrupt.  */
+            s->mris |= 1;
+        }
+        if (value & 4) {
+            /* Finish transfer.  */
+            i2c_end_transfer(s->bus);
+            s->mcs &= ~STELLARIS_I2C_MCS_BUSBSY;
+        }
+        break;
+    case 0x08: /* MDR */
+        s->mdr = value & 0xff;
+        break;
+    case 0x0c: /* MTPR */
+        s->mtpr = value & 0xff;
+        break;
+    case 0x10: /* MIMR */
+        s->mimr = 1;
+        break;
+    case 0x1c: /* MICR */
+        s->mris &= ~value;
+        break;
+    case 0x20: /* MCR */
+        if (value & 1)
+            cpu_abort(cpu_single_env,
+                      "stellaris_i2c_write: Loopback not implemented\n");
+        if (value & 0x20)
+            cpu_abort(cpu_single_env,
+                      "stellaris_i2c_write: Slave mode not implemented\n");
+        s->mcr = value & 0x31;
+        break;
+    default:
+        cpu_abort(cpu_single_env, "stellaris_i2c_write: Bad offset 0x%x\n",
+                  (int)offset);
+    }
+    stellaris_i2c_update(s);
+}
+
+static void stellaris_i2c_reset(stellaris_i2c_state *s)
+{
+    if (s->mcs & STELLARIS_I2C_MCS_BUSBSY)
+        i2c_end_transfer(s->bus);
+
+    s->msa = 0;
+    s->mcs = 0;
+    s->mdr = 0;
+    s->mtpr = 1;
+    s->mimr = 0;
+    s->mris = 0;
+    s->mcr = 0;
+    stellaris_i2c_update(s);
+}
+
+static CPUReadMemoryFunc *stellaris_i2c_readfn[] = {
+   stellaris_i2c_read,
+   stellaris_i2c_read,
+   stellaris_i2c_read
+};
+
+static CPUWriteMemoryFunc *stellaris_i2c_writefn[] = {
+   stellaris_i2c_write,
+   stellaris_i2c_write,
+   stellaris_i2c_write
+};
+
+static void stellaris_i2c_init(uint32_t base, qemu_irq irq, i2c_bus *bus)
+{
+    stellaris_i2c_state *s;
+    int iomemtype;
+
+    s = (stellaris_i2c_state *)qemu_mallocz(sizeof(stellaris_i2c_state));
+    s->base = base;
+    s->irq = irq;
+    s->bus = bus;
+
+    iomemtype = cpu_register_io_memory(0, stellaris_i2c_readfn,
+                                       stellaris_i2c_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    /* ??? For now we only implement the master interface.  */
+    stellaris_i2c_reset(s);
+}
+
+/* Analogue to Digital Converter.  This is only partially implemented,
+   enough for applications that use a combined ADC and timer tick.  */
+
+#define STELLARIS_ADC_EM_CONTROLLER 0
+#define STELLARIS_ADC_EM_COMP       1
+#define STELLARIS_ADC_EM_EXTERNAL   4
+#define STELLARIS_ADC_EM_TIMER      5
+#define STELLARIS_ADC_EM_PWM0       6
+#define STELLARIS_ADC_EM_PWM1       7
+#define STELLARIS_ADC_EM_PWM2       8
+
+#define STELLARIS_ADC_FIFO_EMPTY    0x0100
+#define STELLARIS_ADC_FIFO_FULL     0x1000
+
+typedef struct
+{
+    uint32_t base;
+    uint32_t actss;
+    uint32_t ris;
+    uint32_t im;
+    uint32_t emux;
+    uint32_t ostat;
+    uint32_t ustat;
+    uint32_t sspri;
+    uint32_t sac;
+    struct {
+        uint32_t state;
+        uint32_t data[16];
+    } fifo[4];
+    uint32_t ssmux[4];
+    uint32_t ssctl[4];
+    qemu_irq irq;
+} stellaris_adc_state;
+
+static uint32_t stellaris_adc_fifo_read(stellaris_adc_state *s, int n)
+{
+    int tail;
+
+    tail = s->fifo[n].state & 0xf;
+    if (s->fifo[n].state & STELLARIS_ADC_FIFO_EMPTY) {
+        s->ustat |= 1 << n;
+    } else {
+        s->fifo[n].state = (s->fifo[n].state & ~0xf) | ((tail + 1) & 0xf);
+        s->fifo[n].state &= ~STELLARIS_ADC_FIFO_FULL;
+        if (tail + 1 == ((s->fifo[n].state >> 4) & 0xf))
+            s->fifo[n].state |= STELLARIS_ADC_FIFO_EMPTY;
+    }
+    return s->fifo[n].data[tail];
+}
+
+static void stellaris_adc_fifo_write(stellaris_adc_state *s, int n,
+                                     uint32_t value)
+{
+    int head;
+
+    head = (s->fifo[n].state >> 4) & 0xf;
+    if (s->fifo[n].state & STELLARIS_ADC_FIFO_FULL) {
+        s->ostat |= 1 << n;
+        return;
+    }
+    s->fifo[n].data[head] = value;
+    head = (head + 1) & 0xf;
+    s->fifo[n].state &= ~STELLARIS_ADC_FIFO_EMPTY;
+    s->fifo[n].state = (s->fifo[n].state & ~0xf0) | (head << 4);
+    if ((s->fifo[n].state & 0xf) == head)
+        s->fifo[n].state |= STELLARIS_ADC_FIFO_FULL;
+}
+
+static void stellaris_adc_update(stellaris_adc_state *s)
+{
+    int level;
+
+    level = (s->ris & s->im) != 0;
+    qemu_set_irq(s->irq, level);
+}
+
+static void stellaris_adc_trigger(void *opaque, int irq, int level)
+{
+    stellaris_adc_state *s = (stellaris_adc_state *)opaque;
+    /* Some applications use the ADC as a random number source, so introduce
+       some variation into the signal.  */
+    static uint32_t noise = 0;
+
+    if ((s->actss & 1) == 0) {
+        return;
+    }
+
+    noise = noise * 314159 + 1;
+    /* ??? actual inputs not implemented.  Return an arbitrary value.  */
+    stellaris_adc_fifo_write(s, 0, 0x200 + ((noise >> 16) & 7));
+    s->ris |= 1;
+    stellaris_adc_update(s);
+}
+
+static void stellaris_adc_reset(stellaris_adc_state *s)
+{
+    int n;
+
+    for (n = 0; n < 4; n++) {
+        s->ssmux[n] = 0;
+        s->ssctl[n] = 0;
+        s->fifo[n].state = STELLARIS_ADC_FIFO_EMPTY;
+    }
+}
+
+static uint32_t stellaris_adc_read(void *opaque, target_phys_addr_t offset)
+{
+    stellaris_adc_state *s = (stellaris_adc_state *)opaque;
+
+    /* TODO: Implement this.  */
+    offset -= s->base;
+    if (offset >= 0x40 && offset < 0xc0) {
+        int n;
+        n = (offset - 0x40) >> 5;
+        switch (offset & 0x1f) {
+        case 0x00: /* SSMUX */
+            return s->ssmux[n];
+        case 0x04: /* SSCTL */
+            return s->ssctl[n];
+        case 0x08: /* SSFIFO */
+            return stellaris_adc_fifo_read(s, n);
+        case 0x0c: /* SSFSTAT */
+            return s->fifo[n].state;
+        default:
+            break;
+        }
+    }
+    switch (offset) {
+    case 0x00: /* ACTSS */
+        return s->actss;
+    case 0x04: /* RIS */
+        return s->ris;
+    case 0x08: /* IM */
+        return s->im;
+    case 0x0c: /* ISC */
+        return s->ris & s->im;
+    case 0x10: /* OSTAT */
+        return s->ostat;
+    case 0x14: /* EMUX */
+        return s->emux;
+    case 0x18: /* USTAT */
+        return s->ustat;
+    case 0x20: /* SSPRI */
+        return s->sspri;
+    case 0x30: /* SAC */
+        return s->sac;
+    default:
+        cpu_abort(cpu_single_env, "strllaris_adc_read: Bad offset 0x%x\n",
+                  (int)offset);
+        return 0;
+    }
+}
+
+static void stellaris_adc_write(void *opaque, target_phys_addr_t offset,
+                                uint32_t value)
+{
+    stellaris_adc_state *s = (stellaris_adc_state *)opaque;
+
+    /* TODO: Implement this.  */
+    offset -= s->base;
+    if (offset >= 0x40 && offset < 0xc0) {
+        int n;
+        n = (offset - 0x40) >> 5;
+        switch (offset & 0x1f) {
+        case 0x00: /* SSMUX */
+            s->ssmux[n] = value & 0x33333333;
+            return;
+        case 0x04: /* SSCTL */
+            if (value != 6) {
+                cpu_abort(cpu_single_env, "ADC: Unimplemented sequence %x\n",
+                          value);
+            }
+            s->ssctl[n] = value;
+            return;
+        default:
+            break;
+        }
+    }
+    switch (offset) {
+    case 0x00: /* ACTSS */
+        s->actss = value & 0xf;
+        if (value & 0xe) {
+            cpu_abort(cpu_single_env,
+                      "Not implemented:  ADC sequencers 1-3\n");
+        }
+        break;
+    case 0x08: /* IM */
+        s->im = value;
+        break;
+    case 0x0c: /* ISC */
+        s->ris &= ~value;
+        break;
+    case 0x10: /* OSTAT */
+        s->ostat &= ~value;
+        break;
+    case 0x14: /* EMUX */
+        s->emux = value;
+        break;
+    case 0x18: /* USTAT */
+        s->ustat &= ~value;
+        break;
+    case 0x20: /* SSPRI */
+        s->sspri = value;
+        break;
+    case 0x28: /* PSSI */
+        cpu_abort(cpu_single_env, "Not implemented:  ADC sample initiate\n");
+        break;
+    case 0x30: /* SAC */
+        s->sac = value;
+        break;
+    default:
+        cpu_abort(cpu_single_env, "stellaris_adc_write: Bad offset 0x%x\n",
+                  (int)offset);
+    }
+    stellaris_adc_update(s);
+}
+
+static CPUReadMemoryFunc *stellaris_adc_readfn[] = {
+   stellaris_adc_read,
+   stellaris_adc_read,
+   stellaris_adc_read
+};
+
+static CPUWriteMemoryFunc *stellaris_adc_writefn[] = {
+   stellaris_adc_write,
+   stellaris_adc_write,
+   stellaris_adc_write
+};
+
+static qemu_irq stellaris_adc_init(uint32_t base, qemu_irq irq)
+{
+    stellaris_adc_state *s;
+    int iomemtype;
+    qemu_irq *qi;
+
+    s = (stellaris_adc_state *)qemu_mallocz(sizeof(stellaris_adc_state));
+    s->base = base;
+    s->irq = irq;
+
+    iomemtype = cpu_register_io_memory(0, stellaris_adc_readfn,
+                                       stellaris_adc_writefn, s);
+    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    stellaris_adc_reset(s);
+    qi = qemu_allocate_irqs(stellaris_adc_trigger, s, 1);
+    return qi[0];
+}
+
+/* Board init.  */
+static stellaris_board_info stellaris_boards[] = {
+  { "LM3S811EVB",
+    0,
+    0x0032000e,
+    0x001f001f, /* dc0 */
+    0x001132bf,
+    0x01071013,
+    0x3f0f01ff,
+    0x0000001f,
+    OLED_I2C
+  },
+  { "LM3S6965EVB",
+    0x10010002,
+    0x1073402e,
+    0x00ff007f, /* dc0 */
+    0x001133ff,
+    0x030f5317,
+    0x0f0f87ff,
+    0x5000007f,
+    OLED_SSI
+  }
+};
+
+static void stellaris_init(const char *kernel_filename, const char *cpu_model,
+                           DisplayState *ds, stellaris_board_info *board)
+{
+    static const int uart_irq[] = {5, 6, 33, 34};
+    static const int timer_irq[] = {19, 21, 23, 35};
+    static const uint32_t gpio_addr[7] =
+      { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
+        0x40024000, 0x40025000, 0x40026000};
+    static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
+
+    qemu_irq *pic;
+    qemu_irq *gpio_in[5];
+    qemu_irq *gpio_out[5];
+    qemu_irq adc;
+    int sram_size;
+    int flash_size;
+    i2c_bus *i2c;
+    int i;
+
+    flash_size = ((board->dc0 & 0xffff) + 1) << 1;
+    sram_size = (board->dc0 >> 18) + 1;
+    pic = armv7m_init(flash_size, sram_size, kernel_filename, cpu_model);
+
+    if (board->dc1 & (1 << 16)) {
+        adc = stellaris_adc_init(0x40038000, pic[14]);
+    } else {
+        adc = NULL;
+    }
+    for (i = 0; i < 4; i++) {
+        if (board->dc2 & (0x10000 << i)) {
+            stellaris_gptm_init(0x40030000 + i * 0x1000,
+                                pic[timer_irq[i]], adc);
+        }
+    }
+
+    stellaris_sys_init(0x400fe000, pic[28], board);
+
+    for (i = 0; i < 7; i++) {
+        if (board->dc4 & (1 << i)) {
+            gpio_in[i] = pl061_init(gpio_addr[i], pic[gpio_irq[i]],
+                                    &gpio_out[i]);
+        }
+    }
+
+    if (board->dc2 & (1 << 12)) {
+        i2c = i2c_init_bus();
+        stellaris_i2c_init(0x40020000, pic[8], i2c);
+        if (board->oled == OLED_I2C) {
+            ssd0303_init(ds, i2c, 0x3d);
+        }
+    }
+
+    for (i = 0; i < 4; i++) {
+        if (board->dc2 & (1 << i)) {
+            pl011_init(0x4000c000 + i * 0x1000, pic[uart_irq[i]],
+                       serial_hds[i], PL011_LUMINARY);
+        }
+    }
+    if (board->dc2 & (1 << 4)) {
+        if (board->oled == OLED_SSI) {
+            void * oled;
+            /* FIXME: Implement chip select for OLED/MMC.  */
+            oled = ssd0323_init(ds, &gpio_out[2][7]);
+            pl022_init(0x40008000, pic[7], ssd0323_xfer_ssi, oled);
+        } else {
+            pl022_init(0x40008000, pic[7], NULL, NULL);
+        }
+    }
+}
+
+/* FIXME: Figure out how to generate these from stellaris_boards.  */
+static void lm3s811evb_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
+                     const char **fd_filename, int snapshot,
+                     const char *kernel_filename, const char *kernel_cmdline,
+                     const char *initrd_filename, const char *cpu_model)
+{
+    stellaris_init(kernel_filename, cpu_model, ds, &stellaris_boards[0]);
+}
+
+static void lm3s6965evb_init(int ram_size, int vga_ram_size,
+                     const char *boot_device, DisplayState *ds,
+                     const char **fd_filename, int snapshot,
+                     const char *kernel_filename, const char *kernel_cmdline,
+                     const char *initrd_filename, const char *cpu_model)
+{
+    stellaris_init(kernel_filename, cpu_model, ds, &stellaris_boards[1]);
+}
+
+QEMUMachine lm3s811evb_machine = {
+    "lm3s811evb",
+    "Stellaris LM3S811EVB",
+    lm3s811evb_init,
+};
+
+QEMUMachine lm3s6965evb_machine = {
+    "lm3s6965evb",
+    "Stellaris LM3S6965EVB",
+    lm3s6965evb_init,
+};

Modified: trunk/src/host/qemu-neo1973/hw/sun4m.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/sun4m.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/sun4m.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -313,21 +313,19 @@
     CPUState *env, *envs[MAX_CPUS];
     unsigned int i;
     void *iommu, *espdma, *ledma, *main_esp, *nvram;
-    const sparc_def_t *def;
     qemu_irq *cpu_irqs[MAX_CPUS], *slavio_irq, *slavio_cpu_irq,
         *espdma_irq, *ledma_irq;
     qemu_irq *esp_reset, *le_reset;
 
     /* init CPUs */
-    sparc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
-        fprintf(stderr, "Unable to find Sparc CPU definition\n");
-        exit(1);
-    }
 
     for(i = 0; i < smp_cpus; i++) {
-        env = cpu_init();
-        cpu_sparc_register(env, def, i);
+        env = cpu_init(cpu_model);
+        if (!env) {
+            fprintf(stderr, "Unable to find Sparc CPU definition\n");
+            exit(1);
+        }
+        cpu_sparc_set_id(env, i);
         envs[i] = env;
         if (i == 0) {
             qemu_register_reset(main_cpu_reset, env);
@@ -390,7 +388,8 @@
     slavio_serial_init(hwdef->serial_base, slavio_irq[hwdef->ser_irq],
                        serial_hds[1], serial_hds[0]);
 
-    sun4m_fdctrl_init(slavio_irq[hwdef->fd_irq], hwdef->fd_base, fd_table);
+    if (hwdef->fd_base != (target_phys_addr_t)-1)
+        sun4m_fdctrl_init(slavio_irq[hwdef->fd_irq], hwdef->fd_base, fd_table);
 
     main_esp = esp_init(bs_table, hwdef->esp_base, espdma, *espdma_irq,
                         esp_reset);
@@ -548,6 +547,39 @@
             6, 0, 4, 10, 8, 0, 11, 0,   0, 0, 0, 0, 15, 0, 15, 0,
         },
     },
+    /* SS-600MP */
+    {
+        .iommu_base   = 0xfe0000000ULL,
+        .tcx_base     = 0xe20000000ULL,
+        .cs_base      = -1,
+        .slavio_base  = 0xff0000000ULL,
+        .ms_kb_base   = 0xff1000000ULL,
+        .serial_base  = 0xff1100000ULL,
+        .nvram_base   = 0xff1200000ULL,
+        .fd_base      = -1,
+        .counter_base = 0xff1300000ULL,
+        .intctl_base  = 0xff1400000ULL,
+        .dma_base     = 0xef0081000ULL,
+        .esp_base     = 0xef0080000ULL,
+        .le_base      = 0xef0060000ULL,
+        .power_base   = 0xefa000000ULL,
+        .vram_size    = 0x00100000,
+        .nvram_size   = 0x2000,
+        .esp_irq = 18,
+        .le_irq = 16,
+        .clock_irq = 7,
+        .clock1_irq = 19,
+        .ms_kb_irq = 14,
+        .ser_irq = 15,
+        .fd_irq = 22,
+        .me_irq = 30,
+        .cs_irq = -1,
+        .machine_id = 0x71,
+        .intbit_to_level = {
+            2, 3, 5, 7, 9, 11, 0, 14,   3, 5, 7, 9, 11, 13, 12, 12,
+            6, 0, 4, 10, 8, 0, 11, 0,   0, 0, 0, 0, 15, 0, 15, 0,
+        },
+    },
 };
 
 static void sun4m_common_init(int RAM_size, const char *boot_device, DisplayState *ds,
@@ -596,6 +628,19 @@
                       1, 0xffffffff); // XXX actually first 62GB ok
 }
 
+/* SPARCserver 600MP hardware initialisation */
+static void ss600mp_init(int RAM_size, int vga_ram_size, const char *boot_device,
+                         DisplayState *ds, const char **fd_filename, int snapshot,
+                         const char *kernel_filename, const char *kernel_cmdline,
+                         const char *initrd_filename, const char *cpu_model)
+{
+    if (cpu_model == NULL)
+        cpu_model = "TI SuperSparc II";
+    sun4m_common_init(RAM_size, boot_device, ds, kernel_filename,
+                      kernel_cmdline, initrd_filename, cpu_model,
+                      2, 0xffffffff); // XXX actually first 62GB ok
+}
+
 QEMUMachine ss5_machine = {
     "SS-5",
     "Sun4m platform, SPARCstation 5",
@@ -607,3 +652,9 @@
     "Sun4m platform, SPARCstation 10",
     ss10_init,
 };
+
+QEMUMachine ss600mp_machine = {
+    "SS-600MP",
+    "Sun4m platform, SPARCserver 600MP",
+    ss600mp_init,
+};

Modified: trunk/src/host/qemu-neo1973/hw/sun4u.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/sun4u.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/sun4u.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -67,23 +67,23 @@
 }
 
 /* NVRAM helpers */
-void NVRAM_set_byte (m48t59_t *nvram, uint32_t addr, uint8_t value)
+static void nvram_set_byte (m48t59_t *nvram, uint32_t addr, uint8_t value)
 {
     m48t59_write(nvram, addr, value);
 }
 
-uint8_t NVRAM_get_byte (m48t59_t *nvram, uint32_t addr)
+static uint8_t nvram_get_byte (m48t59_t *nvram, uint32_t addr)
 {
     return m48t59_read(nvram, addr);
 }
 
-void NVRAM_set_word (m48t59_t *nvram, uint32_t addr, uint16_t value)
+static void nvram_set_word (m48t59_t *nvram, uint32_t addr, uint16_t value)
 {
-    m48t59_write(nvram, addr, value >> 8);
-    m48t59_write(nvram, addr + 1, value & 0xFF);
+    m48t59_write(nvram, addr++, (value >> 8) & 0xff);
+    m48t59_write(nvram, addr++, value & 0xff);
 }
 
-uint16_t NVRAM_get_word (m48t59_t *nvram, uint32_t addr)
+static uint16_t nvram_get_word (m48t59_t *nvram, uint32_t addr)
 {
     uint16_t tmp;
 
@@ -93,30 +93,18 @@
     return tmp;
 }
 
-void NVRAM_set_lword (m48t59_t *nvram, uint32_t addr, uint32_t value)
+static void nvram_set_lword (m48t59_t *nvram, uint32_t addr, uint32_t value)
 {
-    m48t59_write(nvram, addr, value >> 24);
-    m48t59_write(nvram, addr + 1, (value >> 16) & 0xFF);
-    m48t59_write(nvram, addr + 2, (value >> 8) & 0xFF);
-    m48t59_write(nvram, addr + 3, value & 0xFF);
+    m48t59_write(nvram, addr++, value >> 24);
+    m48t59_write(nvram, addr++, (value >> 16) & 0xff);
+    m48t59_write(nvram, addr++, (value >> 8) & 0xff);
+    m48t59_write(nvram, addr++, value & 0xff);
 }
 
-uint32_t NVRAM_get_lword (m48t59_t *nvram, uint32_t addr)
-{
-    uint32_t tmp;
-
-    tmp = m48t59_read(nvram, addr) << 24;
-    tmp |= m48t59_read(nvram, addr + 1) << 16;
-    tmp |= m48t59_read(nvram, addr + 2) << 8;
-    tmp |= m48t59_read(nvram, addr + 3);
-
-    return tmp;
-}
-
-void NVRAM_set_string (m48t59_t *nvram, uint32_t addr,
+static void nvram_set_string (m48t59_t *nvram, uint32_t addr,
                        const unsigned char *str, uint32_t max)
 {
-    int i;
+    unsigned int i;
 
     for (i = 0; i < max && str[i] != '\0'; i++) {
         m48t59_write(nvram, addr + i, str[i]);
@@ -124,22 +112,8 @@
     m48t59_write(nvram, addr + max - 1, '\0');
 }
 
-int NVRAM_get_string (m48t59_t *nvram, uint8_t *dst, uint16_t addr, int max)
+static uint16_t nvram_crc_update (uint16_t prev, uint16_t value)
 {
-    int i;
-
-    memset(dst, 0, max);
-    for (i = 0; i < max; i++) {
-        dst[i] = NVRAM_get_byte(nvram, addr + i);
-        if (dst[i] == '\0')
-            break;
-    }
-
-    return i;
-}
-
-static uint16_t NVRAM_crc_update (uint16_t prev, uint16_t value)
-{
     uint16_t tmp;
     uint16_t pd, pd1, pd2;
 
@@ -153,7 +127,8 @@
     return tmp;
 }
 
-uint16_t NVRAM_compute_crc (m48t59_t *nvram, uint32_t start, uint32_t count)
+static uint16_t nvram_compute_crc (m48t59_t *nvram, uint32_t start,
+                                   uint32_t count)
 {
     uint32_t i;
     uint16_t crc = 0xFFFF;
@@ -162,10 +137,10 @@
     odd = count & 1;
     count &= ~1;
     for (i = 0; i != count; i++) {
-        crc = NVRAM_crc_update(crc, NVRAM_get_word(nvram, start + i));
+        crc = nvram_crc_update(crc, nvram_get_word(nvram, start + i));
     }
     if (odd) {
-        crc = NVRAM_crc_update(crc, NVRAM_get_byte(nvram, start + i) << 8);
+        crc = nvram_crc_update(crc, nvram_get_byte(nvram, start + i) << 8);
     }
 
     return crc;
@@ -177,7 +152,7 @@
     uint32_t len;
 
     len = strlen(str) + 1;
-    NVRAM_set_string(nvram, addr, str, len);
+    nvram_set_string(nvram, addr, str, len);
 
     return addr + len;
 }
@@ -215,39 +190,39 @@
     uint32_t start, end;
 
     /* Set parameters for Open Hack'Ware BIOS */
-    NVRAM_set_string(nvram, 0x00, "QEMU_BIOS", 16);
-    NVRAM_set_lword(nvram,  0x10, 0x00000002); /* structure v2 */
-    NVRAM_set_word(nvram,   0x14, NVRAM_size);
-    NVRAM_set_string(nvram, 0x20, arch, 16);
-    NVRAM_set_byte(nvram,   0x2f, nographic & 0xff);
-    NVRAM_set_lword(nvram,  0x30, RAM_size);
-    NVRAM_set_byte(nvram,   0x34, boot_device);
-    NVRAM_set_lword(nvram,  0x38, kernel_image);
-    NVRAM_set_lword(nvram,  0x3C, kernel_size);
+    nvram_set_string(nvram, 0x00, "QEMU_BIOS", 16);
+    nvram_set_lword(nvram,  0x10, 0x00000002); /* structure v2 */
+    nvram_set_word(nvram,   0x14, NVRAM_size);
+    nvram_set_string(nvram, 0x20, arch, 16);
+    nvram_set_byte(nvram,   0x2f, nographic & 0xff);
+    nvram_set_lword(nvram,  0x30, RAM_size);
+    nvram_set_byte(nvram,   0x34, boot_device);
+    nvram_set_lword(nvram,  0x38, kernel_image);
+    nvram_set_lword(nvram,  0x3C, kernel_size);
     if (cmdline) {
         /* XXX: put the cmdline in NVRAM too ? */
         strcpy(phys_ram_base + CMDLINE_ADDR, cmdline);
-        NVRAM_set_lword(nvram,  0x40, CMDLINE_ADDR);
-        NVRAM_set_lword(nvram,  0x44, strlen(cmdline));
+        nvram_set_lword(nvram,  0x40, CMDLINE_ADDR);
+        nvram_set_lword(nvram,  0x44, strlen(cmdline));
     } else {
-        NVRAM_set_lword(nvram,  0x40, 0);
-        NVRAM_set_lword(nvram,  0x44, 0);
+        nvram_set_lword(nvram,  0x40, 0);
+        nvram_set_lword(nvram,  0x44, 0);
     }
-    NVRAM_set_lword(nvram,  0x48, initrd_image);
-    NVRAM_set_lword(nvram,  0x4C, initrd_size);
-    NVRAM_set_lword(nvram,  0x50, NVRAM_image);
+    nvram_set_lword(nvram,  0x48, initrd_image);
+    nvram_set_lword(nvram,  0x4C, initrd_size);
+    nvram_set_lword(nvram,  0x50, NVRAM_image);
 
-    NVRAM_set_word(nvram,   0x54, width);
-    NVRAM_set_word(nvram,   0x56, height);
-    NVRAM_set_word(nvram,   0x58, depth);
-    crc = NVRAM_compute_crc(nvram, 0x00, 0xF8);
-    NVRAM_set_word(nvram,  0xFC, crc);
+    nvram_set_word(nvram,   0x54, width);
+    nvram_set_word(nvram,   0x56, height);
+    nvram_set_word(nvram,   0x58, depth);
+    crc = nvram_compute_crc(nvram, 0x00, 0xF8);
+    nvram_set_word(nvram,  0xFC, crc);
 
     // OpenBIOS nvram variables
     // Variable partition
     start = 256;
     m48t59_write(nvram, start, 0x70);
-    NVRAM_set_string(nvram, start + 4, "system", 12);
+    nvram_set_string(nvram, start + 4, "system", 12);
 
     end = start + 16;
     for (i = 0; i < nb_prom_envs; i++)
@@ -260,7 +235,7 @@
     // free partition
     start = end;
     m48t59_write(nvram, start, 0x7f);
-    NVRAM_set_string(nvram, start + 4, "free", 12);
+    nvram_set_string(nvram, start + 4, "free", 12);
 
     end = 0x1fd0;
     nvram_finish_partition(nvram, start, end);
@@ -343,7 +318,6 @@
     unsigned int i;
     long prom_offset, initrd_size, kernel_size;
     PCIBus *pci_bus;
-    const sparc_def_t *def;
     QEMUBH *bh;
     qemu_irq *irq;
 
@@ -352,13 +326,11 @@
     /* init CPUs */
     if (cpu_model == NULL)
         cpu_model = "TI UltraSparc II";
-    sparc_find_by_name(cpu_model, &def);
-    if (def == NULL) {
+    env = cpu_init(cpu_model);
+    if (!env) {
         fprintf(stderr, "Unable to find Sparc CPU definition\n");
         exit(1);
     }
-    env = cpu_init();
-    cpu_sparc_register(env, def, 0);
     bh = qemu_bh_new(tick_irq, env);
     env->tick = ptimer_init(bh);
     ptimer_set_period(env->tick, 1ULL);

Modified: trunk/src/host/qemu-neo1973/hw/usb-uhci.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/usb-uhci.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/usb-uhci.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -148,6 +148,7 @@
     }
 }
 
+#if 0
 static void uhci_save(QEMUFile *f, void *opaque)
 {
     UHCIState *s = opaque;
@@ -199,6 +200,7 @@
 
     return 0;
 }
+#endif
 
 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
 {

Modified: trunk/src/host/qemu-neo1973/hw/versatilepb.c
===================================================================
--- trunk/src/host/qemu-neo1973/hw/versatilepb.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/hw/versatilepb.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -167,10 +167,13 @@
     int n;
     int done_smc = 0;
 
-    env = cpu_init();
     if (!cpu_model)
         cpu_model = "arm926";
-    cpu_arm_set_model(env, cpu_model);
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     /* ??? RAM shoud repeat to fill physical memory space.  */
     /* SDRAM at address zero.  */
     cpu_register_physical_memory(0, ram_size, IO_MEM_RAM);
@@ -205,10 +208,10 @@
         }
     }
 
-    pl011_init(0x101f1000, pic[12], serial_hds[0]);
-    pl011_init(0x101f2000, pic[13], serial_hds[1]);
-    pl011_init(0x101f3000, pic[14], serial_hds[2]);
-    pl011_init(0x10009000, sic[6], serial_hds[3]);
+    pl011_init(0x101f1000, pic[12], serial_hds[0], PL011_ARM);
+    pl011_init(0x101f2000, pic[13], serial_hds[1], PL011_ARM);
+    pl011_init(0x101f3000, pic[14], serial_hds[2], PL011_ARM);
+    pl011_init(0x10009000, sic[6], serial_hds[3], PL011_ARM);
 
     pl080_init(0x10130000, pic[17], 8);
     sp804_init(0x101e2000, pic[4]);

Modified: trunk/src/host/qemu-neo1973/linux-user/elfload.c
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/elfload.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/elfload.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -677,7 +677,7 @@
     for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
 	if (bprm->page[i]) {
 	    info->rss++;
-
+            /* FIXME - check return value of memcpy_to_target() for failure */
 	    memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE);
 	    free(bprm->page[i]);
 	}
@@ -760,6 +760,7 @@
             size_t len = strlen(k_platform) + 1;
             sp -= (len + n - 1) & ~(n - 1);
             u_platform = sp;
+            /* FIXME - check return value of memcpy_to_target() for failure */
             memcpy_to_target(sp, k_platform, len);
         }
 	/*

Modified: trunk/src/host/qemu-neo1973/linux-user/flatload.c
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/flatload.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/flatload.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -108,7 +108,7 @@
     void *buf;
     int ret;
 
-    buf = lock_user(ptr, len, 0);
+    buf = lock_user(VERIFY_WRITE, ptr, len, 0);
     ret = pread(fd, buf, len, offset);
     unlock_user(buf, ptr, len);
     return ret;

Modified: trunk/src/host/qemu-neo1973/linux-user/linuxload.c
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/linuxload.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/linuxload.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -13,14 +13,17 @@
 #define NGROUPS 32
 
 /* ??? This should really be somewhere else.  */
-void memcpy_to_target(abi_ulong dest, const void *src,
-                      unsigned long len)
+abi_long memcpy_to_target(abi_ulong dest, const void *src,
+                          unsigned long len)
 {
     void *host_ptr;
 
-    host_ptr = lock_user(dest, len, 0);
+    host_ptr = lock_user(VERIFY_WRITE, dest, len, 0);
+    if (!host_ptr)
+        return -TARGET_EFAULT;
     memcpy(host_ptr, src, len);
     unlock_user(host_ptr, dest, 1);
+    return 0;
 }
 
 static int in_group_p(gid_t g)

Modified: trunk/src/host/qemu-neo1973/linux-user/m68k-sim.c
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/m68k-sim.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/m68k-sim.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -129,7 +129,7 @@
         {
             int32_t ret;
 
-            ret = do_brk((void *)ARG(0));
+            ret = do_brk((abi_ulong)ARG(0));
             if (ret == -ENOMEM)
                 ret = -1;
             check_err(env, ret);

Modified: trunk/src/host/qemu-neo1973/linux-user/main.c
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/main.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/main.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -641,6 +641,7 @@
                 queue_signal(info.si_signo, &info);
             }
             break;
+#ifndef TARGET_ABI32
         case 0x16e:
             flush_windows(env);
             sparc64_get_context(env);
@@ -650,6 +651,7 @@
             sparc64_set_context(env);
             break;
 #endif
+#endif
         case EXCP_INTERRUPT:
             /* just indicate that signals should be handled asap */
             break;
@@ -974,7 +976,6 @@
                   }
             }
             break;
-#if defined(TARGET_PPCEMB)
         case POWERPC_EXCP_SPEU:     /* SPE/embedded floating-point unavail.  */
             EXCP_DUMP(env, "No SPE/floating-point instruction allowed\n");
             info.si_signo = TARGET_SIGILL;
@@ -1004,7 +1005,6 @@
             cpu_abort(env, "Reset interrupt while in user mode. "
                       "Aborting\n");
             break;
-#endif /* defined(TARGET_PPCEMB) */
 #if defined(TARGET_PPC64) && !defined(TARGET_ABI32) /* PowerPC 64 */
         case POWERPC_EXCP_DSEG:     /* Data segment exception                */
             cpu_abort(env, "Data segment exception while in user mode. "
@@ -1856,7 +1856,8 @@
            "\n"
            "debug options:\n"
            "-d options   activate log (logfile=%s)\n"
-           "-p pagesize  set the host page size to 'pagesize'\n",
+           "-p pagesize  set the host page size to 'pagesize'\n"
+           "-strace      log system calls\n",
            TARGET_ARCH,
            interp_prefix,
            x86_stack_size,
@@ -1952,6 +1953,8 @@
             }
         } else if (!strcmp(r, "drop-ld-preload")) {
             drop_ld_preload = 1;
+        } else if (!strcmp(r, "strace")) {
+            do_strace = 1;
         } else
         {
             usage();
@@ -1970,30 +1973,46 @@
     /* Scan interp_prefix dir for replacement files. */
     init_paths(interp_prefix);
 
-#if defined(TARGET_I386)
-    /* must be done before cpu_init() for x86 XXX: suppress this hack
-       by adding a new parameter to cpu_init and by suppressing
-       cpu_xxx_register() */
     if (cpu_model == NULL) {
+#if defined(TARGET_I386)
 #ifdef TARGET_X86_64
         cpu_model = "qemu64";
 #else
         cpu_model = "qemu32";
 #endif
-    }
-    if (x86_find_cpu_by_name(cpu_model)) {
-        fprintf(stderr, "Unable to find x86 CPU definition\n");
-        exit(1);
-    }
+#elif defined(TARGET_ARM)
+        cpu_model = "arm926";
+#elif defined(TARGET_M68K)
+        cpu_model = "any";
+#elif defined(TARGET_SPARC)
+#ifdef TARGET_SPARC64
+        cpu_model = "TI UltraSparc II";
+#else
+        cpu_model = "Fujitsu MB86904";
 #endif
-
+#elif defined(TARGET_MIPS)
+#if defined(TARGET_ABI_MIPSN32) || defined(TARGET_ABI_MIPSN64)
+        cpu_model = "20Kc";
+#else
+        cpu_model = "24Kf";
+#endif
+#elif defined(TARGET_PPC)
+        cpu_model = "750";
+#else
+        cpu_model = "any";
+#endif
+    }
     /* NOTE: we need to init the CPU at this stage to get
        qemu_host_page_size */
-    env = cpu_init();
+    env = cpu_init(cpu_model);
+    if (!env) {
+        fprintf(stderr, "Unable to find CPU definition\n");
+        exit(1);
+    }
     global_env = env;
 
-    if(getenv("QEMU_STRACE") ){
-      do_strace=1;
+    if (getenv("QEMU_STRACE")) {
+        do_strace = 1;
     }
 
     wrk = environ;
@@ -2024,17 +2043,17 @@
     if (loglevel) {
         page_dump(logfile);
 
-        fprintf(logfile, "start_brk   0x" TARGET_FMT_lx "\n", info->start_brk);
-        fprintf(logfile, "end_code    0x" TARGET_FMT_lx "\n", info->end_code);
-        fprintf(logfile, "start_code  0x" TARGET_FMT_lx "\n",
+        fprintf(logfile, "start_brk   0x" TARGET_ABI_FMT_lx "\n", info->start_brk);
+        fprintf(logfile, "end_code    0x" TARGET_ABI_FMT_lx "\n", info->end_code);
+        fprintf(logfile, "start_code  0x" TARGET_ABI_FMT_lx "\n",
                 info->start_code);
-        fprintf(logfile, "start_data  0x" TARGET_FMT_lx "\n",
+        fprintf(logfile, "start_data  0x" TARGET_ABI_FMT_lx "\n",
                 info->start_data);
-        fprintf(logfile, "end_data    0x" TARGET_FMT_lx "\n", info->end_data);
-        fprintf(logfile, "start_stack 0x" TARGET_FMT_lx "\n",
+        fprintf(logfile, "end_data    0x" TARGET_ABI_FMT_lx "\n", info->end_data);
+        fprintf(logfile, "start_stack 0x" TARGET_ABI_FMT_lx "\n",
                 info->start_stack);
-        fprintf(logfile, "brk         0x" TARGET_FMT_lx "\n", info->brk);
-        fprintf(logfile, "entry       0x" TARGET_FMT_lx "\n", info->entry);
+        fprintf(logfile, "brk         0x" TARGET_ABI_FMT_lx "\n", info->brk);
+        fprintf(logfile, "entry       0x" TARGET_ABI_FMT_lx "\n", info->entry);
     }
 
     target_set_brk(info->brk);
@@ -2130,9 +2149,6 @@
 #elif defined(TARGET_ARM)
     {
         int i;
-        if (cpu_model == NULL)
-            cpu_model = "arm926";
-        cpu_arm_set_model(env, cpu_model);
         cpsr_write(env, regs->uregs[16], 0xffffffff);
         for(i = 0; i < 16; i++) {
             env->regs[i] = regs->uregs[i];
@@ -2141,20 +2157,6 @@
 #elif defined(TARGET_SPARC)
     {
         int i;
-        const sparc_def_t *def;
-#ifdef TARGET_SPARC64
-        if (cpu_model == NULL)
-            cpu_model = "TI UltraSparc II";
-#else
-        if (cpu_model == NULL)
-            cpu_model = "Fujitsu MB86904";
-#endif
-        sparc_find_by_name(cpu_model, &def);
-        if (def == NULL) {
-            fprintf(stderr, "Unable to find Sparc CPU definition\n");
-            exit(1);
-        }
-        cpu_sparc_register(env, def, 0);
 	env->pc = regs->pc;
 	env->npc = regs->npc;
         env->y = regs->y;
@@ -2165,19 +2167,8 @@
     }
 #elif defined(TARGET_PPC)
     {
-        ppc_def_t *def;
         int i;
 
-        /* Choose and initialise CPU */
-        if (cpu_model == NULL)
-            cpu_model = "750";
-        ppc_find_by_name(cpu_model, &def);
-        if (def == NULL) {
-            cpu_abort(env,
-                      "Unable to find PowerPC CPU definition\n");
-        }
-        cpu_ppc_register(env, def);
-        cpu_ppc_reset(env);
 #if defined(TARGET_PPC64)
 #if defined(TARGET_ABI32)
         env->msr &= ~((target_ulong)1 << MSR_SF);
@@ -2192,12 +2183,6 @@
     }
 #elif defined(TARGET_M68K)
     {
-        if (cpu_model == NULL)
-            cpu_model = "any";
-        if (cpu_m68k_set_model(env, cpu_model)) {
-            cpu_abort(cpu_single_env,
-                      "Unable to find m68k CPU definition\n");
-        }
         env->pc = regs->pc;
         env->dregs[0] = regs->d0;
         env->dregs[1] = regs->d1;
@@ -2220,21 +2205,8 @@
     }
 #elif defined(TARGET_MIPS)
     {
-        mips_def_t *def;
         int i;
 
-        /* Choose and initialise CPU */
-        if (cpu_model == NULL)
-#if defined(TARGET_ABI_MIPSN32) || defined(TARGET_ABI_MIPSN64)
-            cpu_model = "20Kc";
-#else
-            cpu_model = "24Kf";
-#endif
-        mips_find_by_name(cpu_model, &def);
-        if (def == NULL)
-            cpu_abort(env, "Unable to find MIPS CPU definition\n");
-        cpu_mips_register(env, def);
-
         for(i = 0; i < 32; i++) {
             env->gpr[i][env->current_tc] = regs->regs[i];
         }

Modified: trunk/src/host/qemu-neo1973/linux-user/qemu.h
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/qemu.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/qemu.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -146,8 +146,8 @@
                           struct image_info *info);
 #endif
 
-void memcpy_to_target(abi_ulong dest, const void *src,
-                      unsigned long len);
+abi_long memcpy_to_target(abi_ulong dest, const void *src,
+                          unsigned long len);
 void target_set_brk(abi_ulong new_brk);
 abi_long do_brk(abi_ulong new_brk);
 void syscall_init(void);
@@ -166,9 +166,9 @@
 
 /* strace.c */
 void print_syscall(int num,
-                   target_long arg1, target_long arg2, target_long arg3,
-                   target_long arg4, target_long arg5, target_long arg6);
-void print_syscall_ret(int num, target_long arg1);
+                   abi_long arg1, abi_long arg2, abi_long arg3,
+                   abi_long arg4, abi_long arg5, abi_long arg6);
+void print_syscall_ret(int num, abi_long arg1);
 extern int do_strace;
 
 /* signal.c */
@@ -179,9 +179,7 @@
 void target_to_host_siginfo(siginfo_t *info, const target_siginfo_t *tinfo);
 long do_sigreturn(CPUState *env);
 long do_rt_sigreturn(CPUState *env);
-int do_sigaltstack(const struct target_sigaltstack *uss,
-                   struct target_sigaltstack *uoss,
-                   abi_ulong sp);
+abi_long do_sigaltstack(abi_ulong uss_addr, abi_ulong uoss_addr, abi_ulong sp);
 
 #ifdef TARGET_I386
 /* vm86.c */
@@ -207,12 +205,15 @@
 /* user access */
 
 #define VERIFY_READ 0
-#define VERIFY_WRITE 1
+#define VERIFY_WRITE 1 /* implies read access */
 
 #define access_ok(type,addr,size) \
     (page_check_range((target_ulong)addr,size,(type==VERIFY_READ)?PAGE_READ:PAGE_WRITE)==0)
 
 /* NOTE __get_user and __put_user use host pointers and don't check access. */
+/* These are usually used to access struct data members once the
+ * struct has been locked - usually with lock_user_struct().
+ */
 #define __put_user(x, hptr)\
 ({\
     int size = sizeof(*hptr);\
@@ -257,26 +258,44 @@
     0;\
 })
 
-#define put_user(x,ptr)\
-({\
-    int __ret;\
-    if (access_ok(VERIFY_WRITE, ptr, sizeof(*ptr)))\
-        __ret = __put_user(x, ptr);\
-    else\
-        __ret = -EFAULT;\
-    __ret;\
+/* put_user()/get_user() take a guest address and check access */
+/* These are usually used to access an atomic data type, such as an int,
+ * that has been passed by address.  These internally perform locking
+ * and unlocking on the data type.
+ */
+#define put_user(x, gaddr, target_type)					\
+({									\
+    abi_ulong __gaddr = (gaddr);					\
+    target_type *__hptr;						\
+    abi_long __ret;							\
+    if ((__hptr = lock_user(VERIFY_WRITE, __gaddr, sizeof(target_type), 0))) { \
+        __ret = __put_user((x), __hptr);				\
+        unlock_user(__hptr, __gaddr, sizeof(target_type));		\
+    } else								\
+        __ret = -TARGET_EFAULT;						\
+    __ret;								\
 })
 
-#define get_user(x,ptr)\
-({\
-    int __ret;\
-    if (access_ok(VERIFY_READ, ptr, sizeof(*ptr)))\
-        __ret = __get_user(x, ptr);\
-    else\
-        __ret = -EFAULT;\
-    __ret;\
+#define get_user(x, gaddr, target_type)					\
+({									\
+    abi_ulong __gaddr = (gaddr);					\
+    target_type *__hptr;						\
+    abi_long __ret;							\
+    if ((__hptr = lock_user(VERIFY_READ, __gaddr, sizeof(target_type), 1))) { \
+        __ret = __get_user((x), __hptr);				\
+        unlock_user(__hptr, __gaddr, 0);				\
+    } else								\
+        __ret = -TARGET_EFAULT;						\
+    __ret;								\
 })
 
+/* copy_from_user() and copy_to_user() are usually used to copy data
+ * buffers between the target and host.  These internally perform
+ * locking/unlocking of the memory.
+ */
+abi_long copy_from_user(void *hptr, abi_ulong gaddr, size_t len);
+abi_long copy_to_user(abi_ulong gaddr, void *hptr, size_t len);
+
 /* Functions for accessing guest memory.  The tget and tput functions
    read/write single values, byteswapping as neccessary.  The lock_user
    gets a pointer to a contiguous area of guest memory, but does not perform
@@ -285,53 +304,61 @@
 
 /* Lock an area of guest memory into the host.  If copy is true then the
    host area will have the same contents as the guest.  */
-static inline void *lock_user(abi_ulong guest_addr, long len, int copy)
+static inline void *lock_user(int type, abi_ulong guest_addr, long len, int copy)
 {
+    if (!access_ok(type, guest_addr, len))
+        return NULL;
 #ifdef DEBUG_REMAP
-    void *addr;
-    addr = malloc(len);
-    if (copy)
-        memcpy(addr, g2h(guest_addr), len);
-    else
-        memset(addr, 0, len);
-    return addr;
+    {
+        void *addr;
+        addr = malloc(len);
+        if (copy)
+            memcpy(addr, g2h(guest_addr), len);
+        else
+            memset(addr, 0, len);
+        return addr;
+    }
 #else
     return g2h(guest_addr);
 #endif
 }
 
-/* Unlock an area of guest memory.  The first LEN bytes must be flushed back
-   to guest memory.  */
-static inline void unlock_user(void *host_addr, abi_ulong guest_addr,
+/* Unlock an area of guest memory.  The first LEN bytes must be
+   flushed back to guest memory. host_ptr = NULL is explicitely
+   allowed and does nothing. */
+static inline void unlock_user(void *host_ptr, abi_ulong guest_addr,
                                long len)
 {
+
 #ifdef DEBUG_REMAP
-    if (host_addr == g2h(guest_addr))
+    if (!host_ptr)
         return;
+    if (host_ptr == g2h(guest_addr))
+        return;
     if (len > 0)
-        memcpy(g2h(guest_addr), host_addr, len);
-    free(host_addr);
+        memcpy(g2h(guest_ptr), host_ptr, len);
+    free(host_ptr);
 #endif
 }
 
-/* Return the length of a string in target memory.  */
-static inline int target_strlen(abi_ulong ptr)
-{
-  return strlen(g2h(ptr));
-}
+/* Return the length of a string in target memory or -TARGET_EFAULT if
+   access error. */
+abi_long target_strlen(abi_ulong gaddr);
 
 /* Like lock_user but for null terminated strings.  */
 static inline void *lock_user_string(abi_ulong guest_addr)
 {
-    long len;
-    len = target_strlen(guest_addr) + 1;
-    return lock_user(guest_addr, len, 1);
+    abi_long len;
+    len = target_strlen(guest_addr);
+    if (len < 0)
+        return NULL;
+    return lock_user(VERIFY_READ, guest_addr, (long)(len + 1), 1);
 }
 
 /* Helper macros for locking/ulocking a target struct.  */
-#define lock_user_struct(host_ptr, guest_addr, copy) \
-    host_ptr = lock_user(guest_addr, sizeof(*host_ptr), copy)
-#define unlock_user_struct(host_ptr, guest_addr, copy) \
+#define lock_user_struct(type, host_ptr, guest_addr, copy)	\
+    (host_ptr = lock_user(type, guest_addr, sizeof(*host_ptr), copy))
+#define unlock_user_struct(host_ptr, guest_addr, copy)		\
     unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0)
 
 #define tget8(addr) ldub(addr)

Modified: trunk/src/host/qemu-neo1973/linux-user/signal.c
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/signal.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/signal.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -143,7 +143,7 @@
     d->sig[0] = target_sigmask;
     d->sig[1] = sigmask >> 32;
 #else
-#warning host_to_target_sigset
+    /* XXX: do it */
 #endif
 }
 
@@ -177,7 +177,7 @@
 #elif TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64 && TARGET_NSIG_WORDS == 2
     ((unsigned long *)d)[0] = sigmask | ((unsigned long)(s->sig[1]) << 32);
 #else
-#warning target_to_host_sigset
+    /* XXX: do it */
 #endif /* TARGET_ABI_BITS */
 }
 
@@ -233,7 +233,7 @@
         tinfo->_sifields._rt._uid = info->si_uid;
         /* XXX: potential problem if 64 bit */
         tinfo->_sifields._rt._sigval.sival_ptr =
-            (abi_ulong)info->si_value.sival_ptr;
+            (abi_ulong)(unsigned long)info->si_value.sival_ptr;
     }
 }
 
@@ -276,7 +276,7 @@
     info->si_pid = tswap32(tinfo->_sifields._rt._pid);
     info->si_uid = tswap32(tinfo->_sifields._rt._uid);
     info->si_value.sival_ptr =
-        (void *)tswapl(tinfo->_sifields._rt._sigval.sival_ptr);
+            (void *)(long)tswapl(tinfo->_sifields._rt._sigval.sival_ptr);
 }
 
 void signal_init(void)
@@ -435,31 +435,32 @@
 }
 
 /* do_sigaltstack() returns target values and errnos. */
-int do_sigaltstack(const struct target_sigaltstack *uss,
-                   struct target_sigaltstack *uoss,
-                   abi_ulong sp)
+/* compare linux/kernel/signal.c:do_sigaltstack() */
+abi_long do_sigaltstack(abi_ulong uss_addr, abi_ulong uoss_addr, abi_ulong sp)
 {
     int ret;
     struct target_sigaltstack oss;
 
     /* XXX: test errors */
-    if(uoss)
+    if(uoss_addr)
     {
         __put_user(target_sigaltstack_used.ss_sp, &oss.ss_sp);
         __put_user(target_sigaltstack_used.ss_size, &oss.ss_size);
         __put_user(sas_ss_flags(sp), &oss.ss_flags);
     }
 
-    if(uss)
+    if(uss_addr)
     {
-	struct target_sigaltstack ss;
+        struct target_sigaltstack *uss;
+        struct target_sigaltstack ss;
 
 	ret = -TARGET_EFAULT;
-	if (!access_ok(VERIFY_READ, uss, sizeof(*uss))
+        if (!lock_user_struct(VERIFY_READ, uss, uss_addr, 1)
 	    || __get_user(ss.ss_sp, &uss->ss_sp)
 	    || __get_user(ss.ss_size, &uss->ss_size)
 	    || __get_user(ss.ss_flags, &uss->ss_flags))
             goto out;
+        unlock_user_struct(uss, uss_addr, 0);
 
 	ret = -TARGET_EPERM;
 	if (on_sig_stack(sp))
@@ -484,11 +485,10 @@
         target_sigaltstack_used.ss_size = ss.ss_size;
     }
 
-    if (uoss) {
+    if (uoss_addr) {
         ret = -TARGET_EFAULT;
-        if (!access_ok(VERIFY_WRITE, uoss, sizeof(oss)))
+        if (copy_to_user(uoss_addr, &oss, sizeof(oss)))
             goto out;
-        memcpy(uoss, &oss, sizeof(oss));
     }
 
     ret = 0;
@@ -562,7 +562,7 @@
     return 0;
 }
 
-#ifdef TARGET_I386
+#if defined(TARGET_I386) && TARGET_ABI_BITS == 32
 
 /* from the Linux kernel */
 
@@ -667,10 +667,12 @@
 /* XXX: save x87 state */
 static int
 setup_sigcontext(struct target_sigcontext *sc, struct target_fpstate *fpstate,
-		 CPUX86State *env, unsigned long mask)
+		 CPUX86State *env, abi_ulong mask, abi_ulong fpstate_addr)
 {
 	int err = 0;
+        uint16_t magic;
 
+	/* already locked in setup_frame() */
 	err |= __put_user(env->segs[R_GS].selector, (unsigned int *)&sc->gs);
 	err |= __put_user(env->segs[R_FS].selector, (unsigned int *)&sc->fs);
 	err |= __put_user(env->segs[R_ES].selector, (unsigned int *)&sc->es);
@@ -691,10 +693,11 @@
 	err |= __put_user(env->regs[R_ESP], &sc->esp_at_signal);
 	err |= __put_user(env->segs[R_SS].selector, (unsigned int *)&sc->ss);
 
-        cpu_x86_fsave(env, (void *)fpstate, 1);
+        cpu_x86_fsave(env, fpstate_addr, 1);
         fpstate->status = fpstate->sw;
-        err |= __put_user(0xffff, &fpstate->magic);
-        err |= __put_user(fpstate, &sc->fpstate);
+        magic = 0xffff;
+        err |= __put_user(magic, &fpstate->magic);
+        err |= __put_user(fpstate_addr, &sc->fpstate);
 
 	/* non-iBCS2 extensions.. */
 	err |= __put_user(mask, &sc->oldmask);
@@ -706,7 +709,7 @@
  * Determine which stack to use..
  */
 
-static inline void *
+static inline abi_ulong
 get_sigframe(struct emulated_sigaction *ka, CPUX86State *env, size_t frame_size)
 {
 	unsigned long esp;
@@ -726,19 +729,22 @@
             ka->sa.sa_restorer) {
             esp = (unsigned long) ka->sa.sa_restorer;
 	}
-        return g2h((esp - frame_size) & -8ul);
+        return (esp - frame_size) & -8ul;
 }
 
+/* compare linux/arch/i386/kernel/signal.c:setup_frame() */
 static void setup_frame(int sig, struct emulated_sigaction *ka,
 			target_sigset_t *set, CPUX86State *env)
 {
+	abi_ulong frame_addr;
 	struct sigframe *frame;
 	int i, err = 0;
 
-	frame = get_sigframe(ka, env, sizeof(*frame));
+	frame_addr = get_sigframe(ka, env, sizeof(*frame));
 
-	if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
+	if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
 		goto give_sigsegv;
+
 	err |= __put_user((/*current->exec_domain
 		           && current->exec_domain->signal_invmap
 		           && sig < 32
@@ -748,7 +754,8 @@
 	if (err)
 		goto give_sigsegv;
 
-	setup_sigcontext(&frame->sc, &frame->fpstate, env, set->sig[0]);
+	setup_sigcontext(&frame->sc, &frame->fpstate, env, set->sig[0],
+                         frame_addr + offsetof(struct sigframe, fpstate));
 	if (err)
 		goto give_sigsegv;
 
@@ -762,23 +769,24 @@
 	if (ka->sa.sa_flags & TARGET_SA_RESTORER) {
 		err |= __put_user(ka->sa.sa_restorer, &frame->pretcode);
 	} else {
-		err |= __put_user(frame->retcode, &frame->pretcode);
+                uint16_t val16;
+                abi_ulong retcode_addr;
+                retcode_addr = frame_addr + offsetof(struct sigframe, retcode);
+		err |= __put_user(retcode_addr, &frame->pretcode);
 		/* This is popl %eax ; movl $,%eax ; int $0x80 */
-		err |= __put_user(0xb858, (short *)(frame->retcode+0));
-#if defined(TARGET_X86_64)
-#warning "Fix this !"
-#else
+                val16 = 0xb858;
+		err |= __put_user(val16, (uint16_t *)(frame->retcode+0));
 		err |= __put_user(TARGET_NR_sigreturn, (int *)(frame->retcode+2));
-#endif
-		err |= __put_user(0x80cd, (short *)(frame->retcode+6));
+                val16 = 0x80cd;
+		err |= __put_user(val16, (uint16_t *)(frame->retcode+6));
 	}
 
 	if (err)
 		goto give_sigsegv;
 
 	/* Set up registers for signal handler */
-	env->regs[R_ESP] = h2g(frame);
-	env->eip = (unsigned long) ka->sa._sa_handler;
+	env->regs[R_ESP] = frame_addr;
+	env->eip = ka->sa._sa_handler;
 
         cpu_x86_load_seg(env, R_DS, __USER_DS);
         cpu_x86_load_seg(env, R_ES, __USER_DS);
@@ -786,24 +794,29 @@
         cpu_x86_load_seg(env, R_CS, __USER_CS);
 	env->eflags &= ~TF_MASK;
 
+	unlock_user_struct(frame, frame_addr, 1);
+
 	return;
 
 give_sigsegv:
+	unlock_user_struct(frame, frame_addr, 1);
 	if (sig == TARGET_SIGSEGV)
 		ka->sa._sa_handler = TARGET_SIG_DFL;
 	force_sig(TARGET_SIGSEGV /* , current */);
 }
 
+/* compare linux/arch/i386/kernel/signal.c:setup_rt_frame() */
 static void setup_rt_frame(int sig, struct emulated_sigaction *ka,
                            target_siginfo_t *info,
 			   target_sigset_t *set, CPUX86State *env)
 {
+        abi_ulong frame_addr, addr;
 	struct rt_sigframe *frame;
 	int i, err = 0;
 
-	frame = get_sigframe(ka, env, sizeof(*frame));
+	frame_addr = get_sigframe(ka, env, sizeof(*frame));
 
-	if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
+	if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
 		goto give_sigsegv;
 
 	err |= __put_user((/*current->exec_domain
@@ -812,8 +825,10 @@
 		    	   ? current->exec_domain->signal_invmap[sig]
 			   : */sig),
 			  &frame->sig);
-	err |= __put_user((abi_ulong)&frame->info, &frame->pinfo);
-	err |= __put_user((abi_ulong)&frame->uc, &frame->puc);
+        addr = frame_addr + offsetof(struct rt_sigframe, info);
+	err |= __put_user(addr, &frame->pinfo);
+        addr = frame_addr + offsetof(struct rt_sigframe, uc);
+	err |= __put_user(addr, &frame->puc);
 	err |= copy_siginfo_to_user(&frame->info, info);
 	if (err)
 		goto give_sigsegv;
@@ -828,7 +843,8 @@
 	err |= __put_user(target_sigaltstack_used.ss_size,
 			  &frame->uc.tuc_stack.ss_size);
 	err |= setup_sigcontext(&frame->uc.tuc_mcontext, &frame->fpstate,
-			        env, set->sig[0]);
+			        env, set->sig[0], 
+                                frame_addr + offsetof(struct rt_sigframe, fpstate));
         for(i = 0; i < TARGET_NSIG_WORDS; i++) {
             if (__put_user(set->sig[i], &frame->uc.tuc_sigmask.sig[i]))
                 goto give_sigsegv;
@@ -839,19 +855,22 @@
 	if (ka->sa.sa_flags & TARGET_SA_RESTORER) {
 		err |= __put_user(ka->sa.sa_restorer, &frame->pretcode);
 	} else {
-		err |= __put_user(frame->retcode, &frame->pretcode);
+                uint16_t val16;
+                addr = frame_addr + offsetof(struct rt_sigframe, retcode);
+		err |= __put_user(addr, &frame->pretcode);
 		/* This is movl $,%eax ; int $0x80 */
-		err |= __put_user(0xb8, (char *)(frame->retcode+0));
+                err |= __put_user(0xb8, (char *)(frame->retcode+0));
 		err |= __put_user(TARGET_NR_rt_sigreturn, (int *)(frame->retcode+1));
-		err |= __put_user(0x80cd, (short *)(frame->retcode+5));
+                val16 = 0x80cd;
+                err |= __put_user(val16, (uint16_t *)(frame->retcode+5));
 	}
 
 	if (err)
 		goto give_sigsegv;
 
 	/* Set up registers for signal handler */
-	env->regs[R_ESP] = (unsigned long) frame;
-	env->eip = (unsigned long) ka->sa._sa_handler;
+	env->regs[R_ESP] = frame_addr;
+	env->eip = ka->sa._sa_handler;
 
         cpu_x86_load_seg(env, R_DS, __USER_DS);
         cpu_x86_load_seg(env, R_ES, __USER_DS);
@@ -859,9 +878,12 @@
         cpu_x86_load_seg(env, R_CS, __USER_CS);
 	env->eflags &= ~TF_MASK;
 
+	unlock_user_struct(frame, frame_addr, 1);
+
 	return;
 
 give_sigsegv:
+	unlock_user_struct(frame, frame_addr, 1);
 	if (sig == TARGET_SIGSEGV)
 		ka->sa._sa_handler = TARGET_SIG_DFL;
 	force_sig(TARGET_SIGSEGV /* , current */);
@@ -871,54 +893,48 @@
 restore_sigcontext(CPUX86State *env, struct target_sigcontext *sc, int *peax)
 {
 	unsigned int err = 0;
+        abi_ulong fpstate_addr;
+        unsigned int tmpflags;
 
-        cpu_x86_load_seg(env, R_GS, lduw(&sc->gs));
-        cpu_x86_load_seg(env, R_FS, lduw(&sc->fs));
-        cpu_x86_load_seg(env, R_ES, lduw(&sc->es));
-        cpu_x86_load_seg(env, R_DS, lduw(&sc->ds));
+        cpu_x86_load_seg(env, R_GS, tswap16(sc->gs));
+        cpu_x86_load_seg(env, R_FS, tswap16(sc->fs));
+        cpu_x86_load_seg(env, R_ES, tswap16(sc->es));
+        cpu_x86_load_seg(env, R_DS, tswap16(sc->ds));
 
-        env->regs[R_EDI] = ldl(&sc->edi);
-        env->regs[R_ESI] = ldl(&sc->esi);
-        env->regs[R_EBP] = ldl(&sc->ebp);
-        env->regs[R_ESP] = ldl(&sc->esp);
-        env->regs[R_EBX] = ldl(&sc->ebx);
-        env->regs[R_EDX] = ldl(&sc->edx);
-        env->regs[R_ECX] = ldl(&sc->ecx);
-        env->eip = ldl(&sc->eip);
+        env->regs[R_EDI] = tswapl(sc->edi);
+        env->regs[R_ESI] = tswapl(sc->esi);
+        env->regs[R_EBP] = tswapl(sc->ebp);
+        env->regs[R_ESP] = tswapl(sc->esp);
+        env->regs[R_EBX] = tswapl(sc->ebx);
+        env->regs[R_EDX] = tswapl(sc->edx);
+        env->regs[R_ECX] = tswapl(sc->ecx);
+        env->eip = tswapl(sc->eip);
 
         cpu_x86_load_seg(env, R_CS, lduw(&sc->cs) | 3);
         cpu_x86_load_seg(env, R_SS, lduw(&sc->ss) | 3);
 
-	{
-		unsigned int tmpflags;
-                tmpflags = ldl(&sc->eflags);
-		env->eflags = (env->eflags & ~0x40DD5) | (tmpflags & 0x40DD5);
-                //		regs->orig_eax = -1;		/* disable syscall checks */
-	}
+        tmpflags = tswapl(sc->eflags);
+        env->eflags = (env->eflags & ~0x40DD5) | (tmpflags & 0x40DD5);
+        //		regs->orig_eax = -1;		/* disable syscall checks */
 
-	{
-		struct _fpstate * buf;
-                buf = (void *)ldl(&sc->fpstate);
-		if (buf) {
-#if 0
-			if (verify_area(VERIFY_READ, buf, sizeof(*buf)))
-				goto badframe;
-#endif
-                        cpu_x86_frstor(env, (void *)buf, 1);
-		}
+        fpstate_addr = tswapl(sc->fpstate);
+	if (fpstate_addr != 0) {
+                if (!access_ok(VERIFY_READ, fpstate_addr, 
+                               sizeof(struct target_fpstate)))
+                        goto badframe;
+                cpu_x86_frstor(env, fpstate_addr, 1);
 	}
 
-        *peax = ldl(&sc->eax);
+        *peax = tswapl(sc->eax);
 	return err;
-#if 0
 badframe:
 	return 1;
-#endif
 }
 
 long do_sigreturn(CPUX86State *env)
 {
-    struct sigframe *frame = (struct sigframe *)g2h(env->regs[R_ESP] - 8);
+    struct sigframe *frame;
+    abi_ulong frame_addr = env->regs[R_ESP] - 8;
     target_sigset_t target_set;
     sigset_t set;
     int eax, i;
@@ -926,6 +942,8 @@
 #if defined(DEBUG_SIGNAL)
     fprintf(stderr, "do_sigreturn\n");
 #endif
+    if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
+        goto badframe;
     /* set blocked signals */
     if (__get_user(target_set.sig[0], &frame->sc.oldmask))
         goto badframe;
@@ -940,36 +958,41 @@
     /* restore registers */
     if (restore_sigcontext(env, &frame->sc, &eax))
         goto badframe;
+    unlock_user_struct(frame, frame_addr, 0);
     return eax;
 
 badframe:
+    unlock_user_struct(frame, frame_addr, 0);
     force_sig(TARGET_SIGSEGV);
     return 0;
 }
 
 long do_rt_sigreturn(CPUX86State *env)
 {
-	struct rt_sigframe *frame = (struct rt_sigframe *)g2h(env->regs[R_ESP] - 4);
+        abi_ulong frame_addr;
+	struct rt_sigframe *frame;
         sigset_t set;
 	int eax;
 
-#if 0
-	if (verify_area(VERIFY_READ, frame, sizeof(*frame)))
-		goto badframe;
-#endif
+        frame_addr = env->regs[R_ESP] - 4;
+        if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
+                goto badframe;
         target_to_host_sigset(&set, &frame->uc.tuc_sigmask);
         sigprocmask(SIG_SETMASK, &set, NULL);
 
 	if (restore_sigcontext(env, &frame->uc.tuc_mcontext, &eax))
 		goto badframe;
 
-	if (do_sigaltstack(&frame->uc.tuc_stack, NULL, get_sp_from_cpustate(env)) == -EFAULT)
+	if (do_sigaltstack(frame_addr + offsetof(struct rt_sigframe, uc.tuc_stack), 0, 
+                           get_sp_from_cpustate(env)) == -EFAULT)
 		goto badframe;
 
+        unlock_user_struct(frame, frame_addr, 0);
 	return eax;
 
 badframe:
-	force_sig(TARGET_SIGSEGV);
+        unlock_user_struct(frame, frame_addr, 0);
+        force_sig(TARGET_SIGSEGV);
 	return 0;
 }
 
@@ -1016,8 +1039,8 @@
 
 struct rt_sigframe
 {
-    struct target_siginfo *pinfo;
-    void *puc;
+    abi_ulong pinfo;
+    abi_ulong puc;
     struct target_siginfo info;
     struct target_ucontext uc;
     abi_ulong retcode;
@@ -1054,7 +1077,7 @@
 
 static int
 setup_sigcontext(struct target_sigcontext *sc, /*struct _fpstate *fpstate,*/
-		 CPUState *env, unsigned long mask)
+		 CPUState *env, abi_ulong mask)
 {
 	int err = 0;
 
@@ -1086,7 +1109,7 @@
 	return err;
 }
 
-static inline void *
+static inline abi_ulong
 get_sigframe(struct emulated_sigaction *ka, CPUState *regs, int framesize)
 {
 	unsigned long sp = regs->regs[13];
@@ -1099,14 +1122,14 @@
 	/*
 	 * ATPCS B01 mandates 8-byte alignment
 	 */
-	return g2h((sp - framesize) & ~7);
+	return (sp - framesize) & ~7;
 }
 
 static int
 setup_return(CPUState *env, struct emulated_sigaction *ka,
-	     abi_ulong *rc, void *frame, int usig)
+	     abi_ulong *rc, abi_ulong frame_addr, int usig, abi_ulong rc_addr)
 {
-	abi_ulong handler = (abi_ulong)ka->sa._sa_handler;
+	abi_ulong handler = ka->sa._sa_handler;
 	abi_ulong retcode;
 	int thumb = 0;
 #if defined(TARGET_CONFIG_CPU_32)
@@ -1137,7 +1160,7 @@
 #endif /* TARGET_CONFIG_CPU_32 */
 
 	if (ka->sa.sa_flags & TARGET_SA_RESTORER) {
-		retcode = (abi_ulong)ka->sa.sa_restorer;
+		retcode = ka->sa.sa_restorer;
 	} else {
 		unsigned int idx = thumb;
 
@@ -1150,11 +1173,11 @@
 		flush_icache_range((abi_ulong)rc,
 				   (abi_ulong)(rc + 1));
 #endif
-		retcode = ((abi_ulong)rc) + thumb;
+		retcode = rc_addr + thumb;
 	}
 
 	env->regs[0] = usig;
-	env->regs[13] = h2g(frame);
+	env->regs[13] = frame_addr;
 	env->regs[14] = retcode;
 	env->regs[15] = handler & (thumb ? ~1 : ~3);
 
@@ -1167,37 +1190,51 @@
 	return 0;
 }
 
+/* compare linux/arch/arm/kernel/signal.c:setup_frame() */
 static void setup_frame(int usig, struct emulated_sigaction *ka,
 			target_sigset_t *set, CPUState *regs)
 {
-	struct sigframe *frame = get_sigframe(ka, regs, sizeof(*frame));
+	struct sigframe *frame;
+	abi_ulong frame_addr = get_sigframe(ka, regs, sizeof(*frame));
 	int i, err = 0;
 
+	if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
+		return;
+
 	err |= setup_sigcontext(&frame->sc, /*&frame->fpstate,*/ regs, set->sig[0]);
 
         for(i = 1; i < TARGET_NSIG_WORDS; i++) {
             if (__put_user(set->sig[i], &frame->extramask[i - 1]))
-                return;
+                goto end;
 	}
 
 	if (err == 0)
-            err = setup_return(regs, ka, &frame->retcode, frame, usig);
+                err = setup_return(regs, ka, &frame->retcode, frame_addr, usig,
+                                   frame_addr + offsetof(struct sigframe, retcode));
+
+end:
+	unlock_user_struct(frame, frame_addr, 1);
         //	return err;
 }
 
+/* compare linux/arch/arm/kernel/signal.c:setup_rt_frame() */
 static void setup_rt_frame(int usig, struct emulated_sigaction *ka,
                            target_siginfo_t *info,
 			   target_sigset_t *set, CPUState *env)
 {
-	struct rt_sigframe *frame = get_sigframe(ka, env, sizeof(*frame));
+	struct rt_sigframe *frame;
+	abi_ulong frame_addr = get_sigframe(ka, env, sizeof(*frame));
 	struct target_sigaltstack stack;
 	int i, err = 0;
+        abi_ulong info_addr, uc_addr;
 
-	if (!access_ok(VERIFY_WRITE, frame, sizeof (*frame)))
+	if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
             return /* 1 */;
 
-	__put_user_error(&frame->info, (abi_ulong *)&frame->pinfo, err);
-	__put_user_error(&frame->uc, (abi_ulong *)&frame->puc, err);
+        info_addr = frame_addr + offsetof(struct rt_sigframe, info);
+	__put_user_error(info_addr, &frame->pinfo, err);
+        uc_addr = frame_addr + offsetof(struct rt_sigframe, uc);
+	__put_user_error(uc_addr, &frame->puc, err);
 	err |= copy_siginfo_to_user(&frame->info, info);
 
 	/* Clear all the bits of the ucontext we don't use.  */
@@ -1207,20 +1244,18 @@
         __put_user(target_sigaltstack_used.ss_sp, &stack.ss_sp);
         __put_user(target_sigaltstack_used.ss_size, &stack.ss_size);
         __put_user(sas_ss_flags(get_sp_from_cpustate(env)), &stack.ss_flags);
-        if (!access_ok(VERIFY_WRITE, &frame->uc.tuc_stack, sizeof(stack)))
-            err = 1;
-        else
-            memcpy(&frame->uc.tuc_stack, &stack, sizeof(stack));
+        memcpy(&frame->uc.tuc_stack, &stack, sizeof(stack));
 
 	err |= setup_sigcontext(&frame->uc.tuc_mcontext, /*&frame->fpstate,*/
 				env, set->sig[0]);
         for(i = 0; i < TARGET_NSIG_WORDS; i++) {
             if (__put_user(set->sig[i], &frame->uc.tuc_sigmask.sig[i]))
-                return;
+                goto end;
         }
 
 	if (err == 0)
-		err = setup_return(env, ka, &frame->retcode, frame, usig);
+		err = setup_return(env, ka, &frame->retcode, frame_addr, usig,
+                                   frame_addr + offsetof(struct rt_sigframe, retcode));
 
 	if (err == 0) {
 		/*
@@ -1228,10 +1263,13 @@
 		 * arguments for the signal handler.
 		 *   -- Peter Maydell <pmaydell at chiark.greenend.org.uk> 2000-12-06
 		 */
-            env->regs[1] = (abi_ulong)frame->pinfo;
-            env->regs[2] = (abi_ulong)frame->puc;
+            env->regs[1] = info_addr;
+            env->regs[2] = uc_addr;
 	}
 
+end:
+	unlock_user_struct(frame, frame_addr, 1);
+
         //	return err;
 }
 
@@ -1269,6 +1307,7 @@
 
 long do_sigreturn(CPUState *env)
 {
+        abi_ulong frame_addr;
 	struct sigframe *frame;
 	target_sigset_t set;
         sigset_t host_set;
@@ -1282,12 +1321,10 @@
 	if (env->regs[13] & 7)
 		goto badframe;
 
-	frame = (struct sigframe *)g2h(env->regs[13]);
+        frame_addr = env->regs[13];
+	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
+                goto badframe;
 
-#if 0
-	if (verify_area(VERIFY_READ, frame, sizeof (*frame)))
-		goto badframe;
-#endif
 	if (__get_user(set.sig[0], &frame->sc.oldmask))
             goto badframe;
         for(i = 1; i < TARGET_NSIG_WORDS; i++) {
@@ -1306,15 +1343,18 @@
 	if (ptrace_cancel_bpt(current))
 		send_sig(SIGTRAP, current, 1);
 #endif
-	return env->regs[0];
+	unlock_user_struct(frame, frame_addr, 0);
+        return env->regs[0];
 
 badframe:
+	unlock_user_struct(frame, frame_addr, 0);
         force_sig(SIGSEGV /* , current */);
 	return 0;
 }
 
 long do_rt_sigreturn(CPUState *env)
 {
+        abi_ulong frame_addr;
 	struct rt_sigframe *frame;
         sigset_t host_set;
 
@@ -1326,19 +1366,17 @@
 	if (env->regs[13] & 7)
 		goto badframe;
 
-	frame = (struct rt_sigframe *)env->regs[13];
+        frame_addr = env->regs[13];
+	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
+                goto badframe;
 
-#if 0
-	if (verify_area(VERIFY_READ, frame, sizeof (*frame)))
-		goto badframe;
-#endif
         target_to_host_sigset(&host_set, &frame->uc.tuc_sigmask);
         sigprocmask(SIG_SETMASK, &host_set, NULL);
 
 	if (restore_sigcontext(env, &frame->uc.tuc_mcontext))
 		goto badframe;
 
-	if (do_sigaltstack(&frame->uc.tuc_stack, NULL, get_sp_from_cpustate(env)) == -EFAULT)
+	if (do_sigaltstack(frame_addr + offsetof(struct rt_sigframe, uc.tuc_stack), 0, get_sp_from_cpustate(env)) == -EFAULT)
 		goto badframe;
 
 #if 0
@@ -1346,9 +1384,11 @@
 	if (ptrace_cancel_bpt(current))
 		send_sig(SIGTRAP, current, 1);
 #endif
+	unlock_user_struct(frame, frame_addr, 0);
 	return env->regs[0];
 
 badframe:
+	unlock_user_struct(frame, frame_addr, 0);
         force_sig(SIGSEGV /* , current */);
 	return 0;
 }
@@ -1419,7 +1459,7 @@
 struct target_signal_frame {
 	struct sparc_stackf	ss;
 	__siginfo_t		info;
-	qemu_siginfo_fpu_t 	*fpu_save;
+	abi_ulong               fpu_save;
 	abi_ulong		insns[2] __attribute__ ((aligned (8)));
 	abi_ulong		extramask[TARGET_NSIG_WORDS - 1];
 	abi_ulong		extra_size; /* Should be 0 */
@@ -1430,7 +1470,7 @@
 	siginfo_t		info;
 	abi_ulong		regs[20];
 	sigset_t		mask;
-	qemu_siginfo_fpu_t 	*fpu_save;
+	abi_ulong               fpu_save;
 	unsigned int		insns[2];
 	stack_t			stack;
 	unsigned int		extra_size; /* Should be 0 */
@@ -1451,9 +1491,10 @@
 #define UREG_FP        UREG_I6
 #define UREG_SP        UREG_O6
 
-static inline void *get_sigframe(struct emulated_sigaction *sa, CPUState *env, unsigned long framesize)
+static inline abi_ulong get_sigframe(struct emulated_sigaction *sa, 
+                                     CPUState *env, unsigned long framesize)
 {
-	unsigned long sp;
+	abi_ulong sp;
 
 	sp = env->regwptr[UREG_FP];
 
@@ -1463,7 +1504,7 @@
                 && !((target_sigaltstack_used.ss_sp + target_sigaltstack_used.ss_size) & 7))
                 sp = target_sigaltstack_used.ss_sp + target_sigaltstack_used.ss_size;
 	}
-	return g2h(sp - framesize);
+	return sp - framesize;
 }
 
 static int
@@ -1508,6 +1549,7 @@
 static void setup_frame(int sig, struct emulated_sigaction *ka,
 			target_sigset_t *set, CPUState *env)
 {
+        abi_ulong sf_addr;
 	struct target_signal_frame *sf;
 	int sigframe_size, err, i;
 
@@ -1515,10 +1557,13 @@
 	//synchronize_user_stack();
 
         sigframe_size = NF_ALIGNEDSZ;
+	sf_addr = get_sigframe(ka, env, sigframe_size);
 
-	sf = (struct target_signal_frame *)
-		get_sigframe(ka, env, sigframe_size);
-
+        sf = lock_user(VERIFY_WRITE, sf_addr, 
+                       sizeof(struct target_signal_frame), 0);
+        if (!sf)
+		goto sigsegv;
+                
 	//fprintf(stderr, "sf: %x pc %x fp %x sp %x\n", sf, env->pc, env->regwptr[UREG_FP], env->regwptr[UREG_SP]);
 #if 0
 	if (invalid_frame_pointer(sf, sigframe_size))
@@ -1546,25 +1591,32 @@
 		goto sigsegv;
 
 	/* 3. signal handler back-trampoline and parameters */
-	env->regwptr[UREG_FP] = h2g(sf);
+	env->regwptr[UREG_FP] = sf_addr;
 	env->regwptr[UREG_I0] = sig;
-	env->regwptr[UREG_I1] = h2g(&sf->info);
-	env->regwptr[UREG_I2] = h2g(&sf->info);
+	env->regwptr[UREG_I1] = sf_addr + 
+                offsetof(struct target_signal_frame, info);
+	env->regwptr[UREG_I2] = sf_addr + 
+                offsetof(struct target_signal_frame, info);
 
 	/* 4. signal handler */
-	env->pc = (unsigned long) ka->sa._sa_handler;
+	env->pc = ka->sa._sa_handler;
 	env->npc = (env->pc + 4);
 	/* 5. return to kernel instructions */
 	if (ka->sa.sa_restorer)
-		env->regwptr[UREG_I7] = (unsigned long)ka->sa.sa_restorer;
+		env->regwptr[UREG_I7] = ka->sa.sa_restorer;
 	else {
-		env->regwptr[UREG_I7] = h2g(&(sf->insns[0]) - 2);
+                uint32_t val32;
 
+		env->regwptr[UREG_I7] = sf_addr + 
+                        offsetof(struct target_signal_frame, insns) - 2 * 4;
+
 		/* mov __NR_sigreturn, %g1 */
-		err |= __put_user(0x821020d8, &sf->insns[0]);
+                val32 = 0x821020d8;
+		err |= __put_user(val32, &sf->insns[0]);
 
 		/* t 0x10 */
-		err |= __put_user(0x91d02010, &sf->insns[1]);
+                val32 = 0x91d02010;
+		err |= __put_user(val32, &sf->insns[1]);
 		if (err)
 			goto sigsegv;
 
@@ -1572,12 +1624,15 @@
 		//flush_sig_insns(current->mm, (unsigned long) &(sf->insns[0]));
                 //		tb_flush(env);
 	}
+        unlock_user(sf, sf_addr, sizeof(struct target_signal_frame));
 	return;
-
-        //sigill_and_return:
+#if 0
+sigill_and_return:
 	force_sig(TARGET_SIGILL);
+#endif
 sigsegv:
 	//fprintf(stderr, "force_sig\n");
+        unlock_user(sf, sf_addr, sizeof(struct target_signal_frame));
 	force_sig(TARGET_SIGSEGV);
 }
 static inline int
@@ -1629,14 +1684,17 @@
 
 long do_sigreturn(CPUState *env)
 {
+        abi_ulong sf_addr;
         struct target_signal_frame *sf;
         uint32_t up_psr, pc, npc;
         target_sigset_t set;
         sigset_t host_set;
-        abi_ulong fpu_save;
+        abi_ulong fpu_save_addr;
         int err, i;
 
-        sf = (struct target_signal_frame *)g2h(env->regwptr[UREG_FP]);
+        sf_addr = env->regwptr[UREG_FP];
+        if (!lock_user_struct(VERIFY_READ, sf, sf_addr, 1))
+                goto segv_and_exit;
 #if 0
 	fprintf(stderr, "sigreturn\n");
 	fprintf(stderr, "sf: %x pc %x fp %x sp %x\n", sf, env->pc, env->regwptr[UREG_FP], env->regwptr[UREG_SP]);
@@ -1644,12 +1702,8 @@
 	//cpu_dump_state(env, stderr, fprintf, 0);
 
         /* 1. Make sure we are not getting garbage from the user */
-#if 0
-        if (verify_area (VERIFY_READ, sf, sizeof (*sf)))
-                goto segv_and_exit;
-#endif
 
-        if (((uint) sf) & 3)
+        if (sf_addr & 3)
                 goto segv_and_exit;
 
         err = __get_user(pc,  &sf->info.si_regs.pc);
@@ -1675,7 +1729,7 @@
 		err |= __get_user(env->regwptr[i + UREG_I0], &sf->info.si_regs.u_regs[i+8]);
 	}
 
-        err |= __get_user(fpu_save, (abi_ulong *)&sf->fpu_save);
+        err |= __get_user(fpu_save_addr, &sf->fpu_save);
 
         //if (fpu_save)
         //        err |= restore_fpu_state(env, fpu_save);
@@ -1693,20 +1747,21 @@
 
         if (err)
                 goto segv_and_exit;
-
+        unlock_user_struct(sf, sf_addr, 0);
         return env->regwptr[0];
 
 segv_and_exit:
+        unlock_user_struct(sf, sf_addr, 0);
 	force_sig(TARGET_SIGSEGV);
 }
 
 long do_rt_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
-#ifdef TARGET_SPARC64
+#if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 #define MC_TSTATE 0
 #define MC_PC 1
 #define MC_NPC 2
@@ -1777,19 +1832,21 @@
 /* {set, get}context() needed for 64-bit SparcLinux userland. */
 void sparc64_set_context(CPUSPARCState *env)
 {
-    struct target_ucontext *ucp = (struct target_ucontext *)
-        env->regwptr[UREG_I0];
+    abi_ulong ucp_addr;
+    struct target_ucontext *ucp;
     target_mc_gregset_t *grp;
     abi_ulong pc, npc, tstate;
-    abi_ulong fp, i7;
+    abi_ulong fp, i7, w_addr;
     unsigned char fenab;
     int err;
     unsigned int i;
-    abi_ulong *src, *dst;
 
+    ucp_addr = env->regwptr[UREG_I0];
+    if (!lock_user_struct(VERIFY_READ, ucp, ucp_addr, 1))
+        goto do_sigsegv;
     grp  = &ucp->uc_mcontext.mc_gregs;
-    err  = get_user(pc, &((*grp)[MC_PC]));
-    err |= get_user(npc, &((*grp)[MC_NPC]));
+    err  = __get_user(pc, &((*grp)[MC_PC]));
+    err |= __get_user(npc, &((*grp)[MC_NPC]));
     if (err || ((pc | npc) & 3))
         goto do_sigsegv;
     if (env->regwptr[UREG_I1]) {
@@ -1797,14 +1854,15 @@
         sigset_t set;
 
         if (TARGET_NSIG_WORDS == 1) {
-            if (get_user(target_set.sig[0], &ucp->uc_sigmask.sig[0]))
+            if (__get_user(target_set.sig[0], &ucp->uc_sigmask.sig[0]))
                 goto do_sigsegv;
         } else {
-            src = &ucp->uc_sigmask;
-            dst = &target_set;
+            abi_ulong *src, *dst;
+            src = ucp->uc_sigmask.sig;
+            dst = target_set.sig;
             for (i = 0; i < sizeof(target_sigset_t) / sizeof(abi_ulong);
                  i++, dst++, src++)
-                err |= get_user(dst, src);
+                err |= __get_user(*dst, src);
             if (err)
                 goto do_sigsegv;
         }
@@ -1813,65 +1871,76 @@
     }
     env->pc = pc;
     env->npc = npc;
-    err |= get_user(env->y, &((*grp)[MC_Y]));
-    err |= get_user(tstate, &((*grp)[MC_TSTATE]));
+    err |= __get_user(env->y, &((*grp)[MC_Y]));
+    err |= __get_user(tstate, &((*grp)[MC_TSTATE]));
     env->asi = (tstate >> 24) & 0xff;
     PUT_CCR(env, tstate >> 32);
     PUT_CWP64(env, tstate & 0x1f);
-    err |= get_user(env->gregs[1], (&(*grp)[MC_G1]));
-    err |= get_user(env->gregs[2], (&(*grp)[MC_G2]));
-    err |= get_user(env->gregs[3], (&(*grp)[MC_G3]));
-    err |= get_user(env->gregs[4], (&(*grp)[MC_G4]));
-    err |= get_user(env->gregs[5], (&(*grp)[MC_G5]));
-    err |= get_user(env->gregs[6], (&(*grp)[MC_G6]));
-    err |= get_user(env->gregs[7], (&(*grp)[MC_G7]));
-    err |= get_user(env->regwptr[UREG_I0], (&(*grp)[MC_O0]));
-    err |= get_user(env->regwptr[UREG_I1], (&(*grp)[MC_O1]));
-    err |= get_user(env->regwptr[UREG_I2], (&(*grp)[MC_O2]));
-    err |= get_user(env->regwptr[UREG_I3], (&(*grp)[MC_O3]));
-    err |= get_user(env->regwptr[UREG_I4], (&(*grp)[MC_O4]));
-    err |= get_user(env->regwptr[UREG_I5], (&(*grp)[MC_O5]));
-    err |= get_user(env->regwptr[UREG_I6], (&(*grp)[MC_O6]));
-    err |= get_user(env->regwptr[UREG_I7], (&(*grp)[MC_O7]));
+    err |= __get_user(env->gregs[1], (&(*grp)[MC_G1]));
+    err |= __get_user(env->gregs[2], (&(*grp)[MC_G2]));
+    err |= __get_user(env->gregs[3], (&(*grp)[MC_G3]));
+    err |= __get_user(env->gregs[4], (&(*grp)[MC_G4]));
+    err |= __get_user(env->gregs[5], (&(*grp)[MC_G5]));
+    err |= __get_user(env->gregs[6], (&(*grp)[MC_G6]));
+    err |= __get_user(env->gregs[7], (&(*grp)[MC_G7]));
+    err |= __get_user(env->regwptr[UREG_I0], (&(*grp)[MC_O0]));
+    err |= __get_user(env->regwptr[UREG_I1], (&(*grp)[MC_O1]));
+    err |= __get_user(env->regwptr[UREG_I2], (&(*grp)[MC_O2]));
+    err |= __get_user(env->regwptr[UREG_I3], (&(*grp)[MC_O3]));
+    err |= __get_user(env->regwptr[UREG_I4], (&(*grp)[MC_O4]));
+    err |= __get_user(env->regwptr[UREG_I5], (&(*grp)[MC_O5]));
+    err |= __get_user(env->regwptr[UREG_I6], (&(*grp)[MC_O6]));
+    err |= __get_user(env->regwptr[UREG_I7], (&(*grp)[MC_O7]));
 
-    err |= get_user(fp, &(ucp->uc_mcontext.mc_fp));
-    err |= get_user(i7, &(ucp->uc_mcontext.mc_i7));
-    err |= put_user(fp,
-                    (&(((struct target_reg_window *)(TARGET_STACK_BIAS+env->regwptr[UREG_I6]))->ins[6])));
-    err |= put_user(i7,
-                    (&(((struct target_reg_window *)(TARGET_STACK_BIAS+env->regwptr[UREG_I6]))->ins[7])));
+    err |= __get_user(fp, &(ucp->uc_mcontext.mc_fp));
+    err |= __get_user(i7, &(ucp->uc_mcontext.mc_i7));
 
-    err |= get_user(fenab, &(ucp->uc_mcontext.mc_fpregs.mcfpu_enab));
-    err |= get_user(env->fprs, &(ucp->uc_mcontext.mc_fpregs.mcfpu_fprs));
-    src = &(ucp->uc_mcontext.mc_fpregs.mcfpu_fregs);
-    dst = &env->fpr;
-    for (i = 0; i < 64; i++, dst++, src++)
-        err |= get_user(dst, src);
-    err |= get_user(env->fsr,
-                    &(ucp->uc_mcontext.mc_fpregs.mcfpu_fsr));
-    err |= get_user(env->gsr,
-                    &(ucp->uc_mcontext.mc_fpregs.mcfpu_gsr));
+    w_addr = TARGET_STACK_BIAS+env->regwptr[UREG_I6];
+    if (put_user(fp, w_addr + offsetof(struct target_reg_window, ins[6]), 
+                 abi_ulong) != 0)
+        goto do_sigsegv;
+    if (put_user(i7, w_addr + offsetof(struct target_reg_window, ins[7]), 
+                 abi_ulong) != 0)
+        goto do_sigsegv;
+    err |= __get_user(fenab, &(ucp->uc_mcontext.mc_fpregs.mcfpu_enab));
+    err |= __get_user(env->fprs, &(ucp->uc_mcontext.mc_fpregs.mcfpu_fprs));
+    {
+        uint32_t *src, *dst;
+        src = ucp->uc_mcontext.mc_fpregs.mcfpu_fregs.sregs;
+        dst = env->fpr;
+        /* XXX: check that the CPU storage is the same as user context */
+        for (i = 0; i < 64; i++, dst++, src++)
+            err |= __get_user(*dst, src);
+    }
+    err |= __get_user(env->fsr,
+                      &(ucp->uc_mcontext.mc_fpregs.mcfpu_fsr));
+    err |= __get_user(env->gsr,
+                      &(ucp->uc_mcontext.mc_fpregs.mcfpu_gsr));
     if (err)
         goto do_sigsegv;
-
+    unlock_user_struct(ucp, ucp_addr, 0);
     return;
  do_sigsegv:
+    unlock_user_struct(ucp, ucp_addr, 0);
     force_sig(SIGSEGV);
 }
 
 void sparc64_get_context(CPUSPARCState *env)
 {
-    struct target_ucontext *ucp = (struct target_ucontext *)
-        env->regwptr[UREG_I0];
+    abi_ulong ucp_addr;
+    struct target_ucontext *ucp;
     target_mc_gregset_t *grp;
     target_mcontext_t *mcp;
-    abi_ulong fp, i7;
+    abi_ulong fp, i7, w_addr;
     int err;
     unsigned int i;
-    abi_ulong *src, *dst;
     target_sigset_t target_set;
     sigset_t set;
 
+    ucp_addr = env->regwptr[UREG_I0];
+    if (!lock_user_struct(VERIFY_WRITE, ucp, ucp_addr, 0))
+        goto do_sigsegv;
+    
     mcp = &ucp->uc_mcontext;
     grp = &mcp->mc_gregs;
 
@@ -1883,59 +1952,70 @@
 
     sigprocmask(0, NULL, &set);
     host_to_target_sigset_internal(&target_set, &set);
-    if (TARGET_NSIG_WORDS == 1)
-        err |= put_user(target_set.sig[0],
-                        (abi_ulong *)&ucp->uc_sigmask);
-    else {
-        src = &target_set;
-        dst = &ucp->uc_sigmask;
+    if (TARGET_NSIG_WORDS == 1) {
+        err |= __put_user(target_set.sig[0],
+                          (abi_ulong *)&ucp->uc_sigmask);
+    } else {
+        abi_ulong *src, *dst;
+        src = target_set.sig;
+        dst = ucp->uc_sigmask.sig;
         for (i = 0; i < sizeof(target_sigset_t) / sizeof(abi_ulong);
              i++, dst++, src++)
-            err |= put_user(src, dst);
+            err |= __put_user(*src, dst);
         if (err)
             goto do_sigsegv;
     }
 
-    err |= put_user(env->tstate, &((*grp)[MC_TSTATE]));
-    err |= put_user(env->pc, &((*grp)[MC_PC]));
-    err |= put_user(env->npc, &((*grp)[MC_NPC]));
-    err |= put_user(env->y, &((*grp)[MC_Y]));
-    err |= put_user(env->gregs[1], &((*grp)[MC_G1]));
-    err |= put_user(env->gregs[2], &((*grp)[MC_G2]));
-    err |= put_user(env->gregs[3], &((*grp)[MC_G3]));
-    err |= put_user(env->gregs[4], &((*grp)[MC_G4]));
-    err |= put_user(env->gregs[5], &((*grp)[MC_G5]));
-    err |= put_user(env->gregs[6], &((*grp)[MC_G6]));
-    err |= put_user(env->gregs[7], &((*grp)[MC_G7]));
-    err |= put_user(env->regwptr[UREG_I0], &((*grp)[MC_O0]));
-    err |= put_user(env->regwptr[UREG_I1], &((*grp)[MC_O1]));
-    err |= put_user(env->regwptr[UREG_I2], &((*grp)[MC_O2]));
-    err |= put_user(env->regwptr[UREG_I3], &((*grp)[MC_O3]));
-    err |= put_user(env->regwptr[UREG_I4], &((*grp)[MC_O4]));
-    err |= put_user(env->regwptr[UREG_I5], &((*grp)[MC_O5]));
-    err |= put_user(env->regwptr[UREG_I6], &((*grp)[MC_O6]));
-    err |= put_user(env->regwptr[UREG_I7], &((*grp)[MC_O7]));
+    /* XXX: tstate must be saved properly */
+    //    err |= __put_user(env->tstate, &((*grp)[MC_TSTATE]));
+    err |= __put_user(env->pc, &((*grp)[MC_PC]));
+    err |= __put_user(env->npc, &((*grp)[MC_NPC]));
+    err |= __put_user(env->y, &((*grp)[MC_Y]));
+    err |= __put_user(env->gregs[1], &((*grp)[MC_G1]));
+    err |= __put_user(env->gregs[2], &((*grp)[MC_G2]));
+    err |= __put_user(env->gregs[3], &((*grp)[MC_G3]));
+    err |= __put_user(env->gregs[4], &((*grp)[MC_G4]));
+    err |= __put_user(env->gregs[5], &((*grp)[MC_G5]));
+    err |= __put_user(env->gregs[6], &((*grp)[MC_G6]));
+    err |= __put_user(env->gregs[7], &((*grp)[MC_G7]));
+    err |= __put_user(env->regwptr[UREG_I0], &((*grp)[MC_O0]));
+    err |= __put_user(env->regwptr[UREG_I1], &((*grp)[MC_O1]));
+    err |= __put_user(env->regwptr[UREG_I2], &((*grp)[MC_O2]));
+    err |= __put_user(env->regwptr[UREG_I3], &((*grp)[MC_O3]));
+    err |= __put_user(env->regwptr[UREG_I4], &((*grp)[MC_O4]));
+    err |= __put_user(env->regwptr[UREG_I5], &((*grp)[MC_O5]));
+    err |= __put_user(env->regwptr[UREG_I6], &((*grp)[MC_O6]));
+    err |= __put_user(env->regwptr[UREG_I7], &((*grp)[MC_O7]));
 
-    err |= get_user(fp,
-                    (&(((struct target_reg_window *)(TARGET_STACK_BIAS+env->regwptr[UREG_I6]))->ins[6])));
-    err |= get_user(i7,
-                    (&(((struct target_reg_window *)(TARGET_STACK_BIAS+env->regwptr[UREG_I6]))->ins[7])));
-    err |= put_user(fp, &(mcp->mc_fp));
-    err |= put_user(i7, &(mcp->mc_i7));
+    w_addr = TARGET_STACK_BIAS+env->regwptr[UREG_I6];
+    fp = i7 = 0;
+    if (get_user(fp, w_addr + offsetof(struct target_reg_window, ins[6]), 
+                 abi_ulong) != 0)
+        goto do_sigsegv;
+    if (get_user(i7, w_addr + offsetof(struct target_reg_window, ins[7]), 
+                 abi_ulong) != 0)
+        goto do_sigsegv;
+    err |= __put_user(fp, &(mcp->mc_fp));
+    err |= __put_user(i7, &(mcp->mc_i7));
 
-    src = &env->fpr;
-    dst = &(ucp->uc_mcontext.mc_fpregs.mcfpu_fregs);
-    for (i = 0; i < 64; i++, dst++, src++)
-        err |= put_user(src, dst);
-    err |= put_user(env->fsr, &(mcp->mc_fpregs.mcfpu_fsr));
-    err |= put_user(env->gsr, &(mcp->mc_fpregs.mcfpu_gsr));
-    err |= put_user(env->fprs, &(mcp->mc_fpregs.mcfpu_fprs));
+    {
+        uint32_t *src, *dst;
+        src = env->fpr;
+        dst = ucp->uc_mcontext.mc_fpregs.mcfpu_fregs.sregs;
+        /* XXX: check that the CPU storage is the same as user context */
+        for (i = 0; i < 64; i++, dst++, src++)
+            err |= __put_user(*src, dst);
+    }
+    err |= __put_user(env->fsr, &(mcp->mc_fpregs.mcfpu_fsr));
+    err |= __put_user(env->gsr, &(mcp->mc_fpregs.mcfpu_gsr));
+    err |= __put_user(env->fprs, &(mcp->mc_fpregs.mcfpu_fprs));
 
     if (err)
         goto do_sigsegv;
-
+    unlock_user_struct(ucp, ucp_addr, 1);
     return;
  do_sigsegv:
+    unlock_user_struct(ucp, ucp_addr, 1);
     force_sig(SIGSEGV);
 }
 #endif
@@ -1959,13 +2039,13 @@
 long do_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 long do_rt_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 #elif defined(TARGET_ABI_MIPSN32)
@@ -1988,13 +2068,13 @@
 long do_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 long do_rt_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 #elif defined(TARGET_ABI_MIPSO32)
@@ -2191,7 +2271,7 @@
 /*
  * Determine which stack to use..
  */
-static inline void *
+static inline abi_ulong
 get_sigframe(struct emulated_sigaction *ka, CPUState *regs, size_t frame_size)
 {
     unsigned long sp;
@@ -2211,17 +2291,19 @@
         sp = target_sigaltstack_used.ss_sp + target_sigaltstack_used.ss_size;
     }
 
-    return g2h((sp - frame_size) & ~7);
+    return (sp - frame_size) & ~7;
 }
 
+/* compare linux/arch/mips/kernel/signal.c:setup_frame() */
 static void setup_frame(int sig, struct emulated_sigaction * ka,
-   		target_sigset_t *set, CPUState *regs)
+                        target_sigset_t *set, CPUState *regs)
 {
     struct sigframe *frame;
+    abi_ulong frame_addr;
     int i;
 
-    frame = get_sigframe(ka, regs, sizeof(*frame));
-    if (!access_ok(VERIFY_WRITE, frame, sizeof (*frame)))
+    frame_addr = get_sigframe(ka, regs, sizeof(*frame));
+    if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))
 	goto give_sigsegv;
 
     install_sigtramp(frame->sf_code, TARGET_NR_sigreturn);
@@ -2246,16 +2328,18 @@
     */
     regs->gpr[ 4][regs->current_tc] = sig;
     regs->gpr[ 5][regs->current_tc] = 0;
-    regs->gpr[ 6][regs->current_tc] = h2g(&frame->sf_sc);
-    regs->gpr[29][regs->current_tc] = h2g(frame);
-    regs->gpr[31][regs->current_tc] = h2g(frame->sf_code);
+    regs->gpr[ 6][regs->current_tc] = frame_addr + offsetof(struct sigframe, sf_sc);
+    regs->gpr[29][regs->current_tc] = frame_addr;
+    regs->gpr[31][regs->current_tc] = frame_addr + offsetof(struct sigframe, sf_code);
     /* The original kernel code sets CP0_EPC to the handler
     * since it returns to userland using eret
     * we cannot do this here, and we must set PC directly */
     regs->PC[regs->current_tc] = regs->gpr[25][regs->current_tc] = ka->sa._sa_handler;
+    unlock_user_struct(frame, frame_addr, 1);
     return;
 
 give_sigsegv:
+    unlock_user_struct(frame, frame_addr, 1);
     force_sig(TARGET_SIGSEGV/*, current*/);
     return;
 }
@@ -2263,6 +2347,7 @@
 long do_sigreturn(CPUState *regs)
 {
     struct sigframe *frame;
+    abi_ulong frame_addr;
     sigset_t blocked;
     target_sigset_t target_set;
     int i;
@@ -2270,8 +2355,8 @@
 #if defined(DEBUG_SIGNAL)
     fprintf(stderr, "do_sigreturn\n");
 #endif
-    frame = (struct sigframe *) regs->gpr[29][regs->current_tc];
-    if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
+    frame_addr = regs->gpr[29][regs->current_tc];
+    if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
    	goto badframe;
 
     for(i = 0; i < TARGET_NSIG_WORDS; i++) {
@@ -2318,7 +2403,7 @@
 long do_rt_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 #else
@@ -2339,13 +2424,13 @@
 long do_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 long do_rt_sigreturn(CPUState *env)
 {
     fprintf(stderr, "do_rt_sigreturn: not implemented\n");
-    return -ENOSYS;
+    return -TARGET_ENOSYS;
 }
 
 #endif

Modified: trunk/src/host/qemu-neo1973/linux-user/strace.c
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/strace.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/strace.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -16,9 +16,9 @@
     char *name;
     char *format;
     void (*call)(struct syscallname *,
-                 target_long, target_long, target_long,
-                 target_long, target_long, target_long);
-    void (*result)(struct syscallname *, target_long);
+                 abi_long, abi_long, abi_long,
+                 abi_long, abi_long, abi_long);
+    void (*result)(struct syscallname *, abi_long);
 };
 
 /*
@@ -74,21 +74,26 @@
     gemu_log("%d",cmd);
 }
 
+#ifdef TARGET_NR__newselect
 static void
-print_fdset(int n, target_ulong target_fds_addr)
+print_fdset(int n, abi_ulong target_fds_addr)
 {
     int i;
 
     gemu_log("[");
     if( target_fds_addr ) {
-        target_long *target_fds;
+        abi_long *target_fds;
 
-        if (!access_ok(VERIFY_READ, target_fds_addr, sizeof(*target_fds)*(n / TARGET_LONG_BITS + 1)))
+        target_fds = lock_user(VERIFY_READ,
+                               target_fds_addr,
+                               sizeof(*target_fds)*(n / TARGET_ABI_BITS + 1),
+                               1);
+
+        if (!target_fds)
             return;
 
-        target_fds = lock_user(target_fds_addr, sizeof(*target_fds)*(n / TARGET_LONG_BITS + 1), 1);
         for (i=n; i>=0; i--) {
-            if ((tswapl(target_fds[i / TARGET_LONG_BITS]) >> (i & (TARGET_LONG_BITS - 1))) & 1)
+            if ((tswapl(target_fds[i / TARGET_ABI_BITS]) >> (i & (TARGET_ABI_BITS - 1))) & 1)
                 gemu_log("%d,", i );
             }
         unlock_user(target_fds, target_fds_addr, 0);
@@ -97,27 +102,28 @@
 }
 
 static void
-print_timeval(target_ulong tv_addr)
+print_timeval(abi_ulong tv_addr)
 {
     if( tv_addr ) {
         struct target_timeval *tv;
 
-	if (!access_ok(VERIFY_READ, tv_addr, sizeof(*tv)))
+        tv = lock_user(VERIFY_READ, tv_addr, sizeof(*tv), 1);
+        if (!tv)
             return;
-
-	tv = lock_user(tv_addr, sizeof(*tv), 1);
         gemu_log("{" TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "}",
         	 tv->tv_sec, tv->tv_usec);
         unlock_user(tv, tv_addr, 0);
     } else
         gemu_log("NULL");
 }
+#endif
 
 /*
  * Sysycall specific output functions
  */
 
 /* select */
+#ifdef TARGET_NR__newselect
 static long newselect_arg1 = 0;
 static long newselect_arg2 = 0;
 static long newselect_arg3 = 0;
@@ -126,10 +132,10 @@
 
 static void
 print_newselect(struct syscallname *name,
-                target_long arg1, target_long arg2, target_long arg3,
-                target_long arg4, target_long arg5, target_long arg6)
+                abi_long arg1, abi_long arg2, abi_long arg3,
+                abi_long arg4, abi_long arg5, abi_long arg6)
 {
-    gemu_log("%s(" TARGET_FMT_ld ",", name->name, arg1);
+    gemu_log("%s(" TARGET_ABI_FMT_ld ",", name->name, arg1);
     print_fdset(arg1, arg2);
     gemu_log(",");
     print_fdset(arg1, arg3);
@@ -146,55 +152,55 @@
     newselect_arg4=arg4;
     newselect_arg5=arg5;
 }
+#endif
 
 static void
 print_semctl(struct syscallname *name,
-             target_long arg1, target_long arg2, target_long arg3,
-             target_long arg4, target_long arg5, target_long arg6)
+             abi_long arg1, abi_long arg2, abi_long arg3,
+             abi_long arg4, abi_long arg5, abi_long arg6)
 {
-    gemu_log("%s(" TARGET_FMT_ld "," TARGET_FMT_ld ",", name->name, arg1, arg2);
+    gemu_log("%s(" TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld ",", name->name, arg1, arg2);
     print_ipc_cmd(arg3);
-    gemu_log(",0x" TARGET_FMT_lx ")", arg4);
+    gemu_log(",0x" TARGET_ABI_FMT_lx ")", arg4);
 }
 
 static void
 print_execve(struct syscallname *name,
-             target_long arg1, target_long arg2, target_long arg3,
-             target_long arg4, target_long arg5, target_long arg6)
+             abi_long arg1, abi_long arg2, abi_long arg3,
+             abi_long arg4, abi_long arg5, abi_long arg6)
 {
-    target_ulong arg_ptr_addr;
+    abi_ulong arg_ptr_addr;
     char *s;
 
-    if (!access_ok(VERIFY_READ, arg1, 1))
+    if (!(s = lock_user_string(arg1)))
         return;
-
-    s = lock_user_string(arg1);
     gemu_log("%s(\"%s\",{", name->name, s);
     unlock_user(s, arg1, 0);
 
-    for (arg_ptr_addr = arg2; ; arg_ptr_addr += sizeof(target_ulong)) {
-        target_ulong *arg_ptr, arg_addr, s_addr;
+    for (arg_ptr_addr = arg2; ; arg_ptr_addr += sizeof(abi_ulong)) {
+        abi_ulong *arg_ptr, arg_addr, s_addr;
 
-        if (!access_ok(VERIFY_READ, arg_ptr_addr, sizeof(target_ulong)))
+	arg_ptr = lock_user(VERIFY_READ, arg_ptr_addr, sizeof(abi_ulong), 1);
+        if (!arg_ptr)
             return;
-
-	arg_ptr = lock_user(arg_ptr_addr, sizeof(target_ulong), 1);
 	arg_addr = tswapl(*arg_ptr);
 	unlock_user(arg_ptr, arg_ptr_addr, 0);
         if (!arg_addr)
             break;
-        s = lock_user_string(arg_addr);
-        gemu_log("\"%s\",", s);
-        unlock_user(s, s_addr, 0);
+        if ((s = lock_user_string(arg_addr))) {
+            gemu_log("\"%s\",", s);
+            unlock_user(s, s_addr, 0);
+        }
     }
 
     gemu_log("NULL})");
 }
 
+#ifdef TARGET_NR_ipc
 static void
 print_ipc(struct syscallname *name,
-          target_long arg1, target_long arg2, target_long arg3,
-          target_long arg4, target_long arg5, target_long arg6)
+          abi_long arg1, abi_long arg2, abi_long arg3,
+          abi_long arg4, abi_long arg5, abi_long arg6)
 {
     switch(arg1) {
     case IPCOP_semctl:
@@ -202,38 +208,39 @@
         print_semctl(name,arg2,arg3,arg4,arg5,arg6,0);
         break;
     default:
-        gemu_log("%s(" TARGET_FMT_ld "," TARGET_FMT_ld "," TARGET_FMT_ld "," TARGET_FMT_ld ")",
+        gemu_log("%s(" TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld ")",
                  name->name, arg1, arg2, arg3, arg4);
     }
 }
+#endif
 
 /*
  * Variants for the return value output function
  */
 
 static void
-print_syscall_ret_addr(struct syscallname *name, target_long ret)
+print_syscall_ret_addr(struct syscallname *name, abi_long ret)
 {
 if( ret == -1 ) {
         gemu_log(" = -1 errno=%d (%s)\n", errno, target_strerror(errno));
     } else {
-        gemu_log(" = " TARGET_FMT_lx "\n", ret);
+        gemu_log(" = 0x" TARGET_ABI_FMT_lx "\n", ret);
     }
 }
 
 #if 0 /* currently unused */
 static void
-print_syscall_ret_raw(struct syscallname *name, target_long ret)
+print_syscall_ret_raw(struct syscallname *name, abi_long ret)
 {
-        gemu_log(" = " TARGET_FMT_lx "\n", ret);
+        gemu_log(" = 0x" TARGET_ABI_FMT_lx "\n", ret);
 }
 #endif
 
 #ifdef TARGET_NR__newselect
 static void
-print_syscall_ret_newselect(struct syscallname *name, target_long ret)
+print_syscall_ret_newselect(struct syscallname *name, abi_long ret)
 {
-    gemu_log(" = " TARGET_FMT_lx " (", ret);
+    gemu_log(" = 0x" TARGET_ABI_FMT_lx " (", ret);
     print_fdset(newselect_arg1,newselect_arg2);
     gemu_log(",");
     print_fdset(newselect_arg1,newselect_arg3);
@@ -260,8 +267,8 @@
  */
 void
 print_syscall(int num,
-              target_long arg1, target_long arg2, target_long arg3,
-              target_long arg4, target_long arg5, target_long arg6)
+              abi_long arg1, abi_long arg2, abi_long arg3,
+              abi_long arg4, abi_long arg5, abi_long arg6)
 {
     int i;
     char *format="%s(%ld,%ld,%ld,%ld,%ld,%ld)";
@@ -283,7 +290,7 @@
 
 
 void
-print_syscall_ret(int num, target_long ret)
+print_syscall_ret(int num, abi_long ret)
 {
     int i;
 
@@ -293,9 +300,9 @@
                 scnames[i].result(&scnames[i],ret);
             } else {
                 if( ret < 0 ) {
-                    gemu_log(" = -1 errno=%d (%s)\n", -ret, target_strerror(-ret));
+                    gemu_log(" = -1 errno=" TARGET_ABI_FMT_ld " (%s)\n", -ret, target_strerror(-ret));
                 } else {
-                    gemu_log(" = %d\n", ret);
+                    gemu_log(" = " TARGET_ABI_FMT_ld "\n", ret);
                 }
             }
             break;

Modified: trunk/src/host/qemu-neo1973/linux-user/syscall.c
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/syscall.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/syscall.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -504,12 +504,13 @@
 #endif
 }
 
-static inline void host_to_target_rusage(abi_ulong target_addr,
-                                         const struct rusage *rusage)
+static inline abi_long host_to_target_rusage(abi_ulong target_addr,
+                                             const struct rusage *rusage)
 {
     struct target_rusage *target_rusage;
 
-    lock_user_struct(target_rusage, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_rusage, target_addr, 0))
+        return -TARGET_EFAULT;
     target_rusage->ru_utime.tv_sec = tswapl(rusage->ru_utime.tv_sec);
     target_rusage->ru_utime.tv_usec = tswapl(rusage->ru_utime.tv_usec);
     target_rusage->ru_stime.tv_sec = tswapl(rusage->ru_stime.tv_sec);
@@ -529,28 +530,36 @@
     target_rusage->ru_nvcsw = tswapl(rusage->ru_nvcsw);
     target_rusage->ru_nivcsw = tswapl(rusage->ru_nivcsw);
     unlock_user_struct(target_rusage, target_addr, 1);
+
+    return 0;
 }
 
-static inline void target_to_host_timeval(struct timeval *tv,
-                                          abi_ulong target_addr)
+static inline abi_long target_to_host_timeval(struct timeval *tv,
+                                              abi_ulong target_addr)
 {
     struct target_timeval *target_tv;
 
-    lock_user_struct(target_tv, target_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_tv, target_addr, 1))
+        return -TARGET_EFAULT;
     tv->tv_sec = tswapl(target_tv->tv_sec);
     tv->tv_usec = tswapl(target_tv->tv_usec);
     unlock_user_struct(target_tv, target_addr, 0);
+
+    return 0;
 }
 
-static inline void host_to_target_timeval(abi_ulong target_addr,
-                                          const struct timeval *tv)
+static inline abi_long host_to_target_timeval(abi_ulong target_addr,
+                                              const struct timeval *tv)
 {
     struct target_timeval *target_tv;
 
-    lock_user_struct(target_tv, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_tv, target_addr, 0))
+        return -TARGET_EFAULT;
     target_tv->tv_sec = tswapl(tv->tv_sec);
     target_tv->tv_usec = tswapl(tv->tv_usec);
     unlock_user_struct(target_tv, target_addr, 1);
+
+    return 0;
 }
 
 
@@ -567,21 +576,33 @@
     int ok;
 
     if (rfd_p) {
-        target_rfds = lock_user(rfd_p, sizeof(abi_long) * n, 1);
+        target_rfds = lock_user(VERIFY_WRITE, rfd_p, sizeof(abi_long) * n, 1);
+        if (!target_rfds) {
+            ret = -TARGET_EFAULT;
+            goto end;
+        }
         rfds_ptr = target_to_host_fds(&rfds, target_rfds, n);
     } else {
         target_rfds = NULL;
         rfds_ptr = NULL;
     }
     if (wfd_p) {
-        target_wfds = lock_user(wfd_p, sizeof(abi_long) * n, 1);
+        target_wfds = lock_user(VERIFY_WRITE, wfd_p, sizeof(abi_long) * n, 1);
+        if (!target_wfds) {
+            ret = -TARGET_EFAULT;
+            goto end;
+        }
         wfds_ptr = target_to_host_fds(&wfds, target_wfds, n);
     } else {
         target_wfds = NULL;
         wfds_ptr = NULL;
     }
     if (efd_p) {
-        target_efds = lock_user(efd_p, sizeof(abi_long) * n, 1);
+        target_efds = lock_user(VERIFY_WRITE, efd_p, sizeof(abi_long) * n, 1);
+        if (!target_efds) {
+            ret = -TARGET_EFAULT;
+            goto end;
+        }
         efds_ptr = target_to_host_fds(&efds, target_efds, n);
     } else {
         target_efds = NULL;
@@ -606,47 +627,64 @@
             host_to_target_timeval(target_tv, &tv);
         }
     }
-    if (target_rfds)
-        unlock_user(target_rfds, rfd_p, ok ? sizeof(abi_long) * n : 0);
-    if (target_wfds)
-        unlock_user(target_wfds, wfd_p, ok ? sizeof(abi_long) * n : 0);
-    if (target_efds)
-        unlock_user(target_efds, efd_p, ok ? sizeof(abi_long) * n : 0);
 
+end:
+    unlock_user(target_rfds, rfd_p, ok ? sizeof(abi_long) * n : 0);
+    unlock_user(target_wfds, wfd_p, ok ? sizeof(abi_long) * n : 0);
+    unlock_user(target_efds, efd_p, ok ? sizeof(abi_long) * n : 0);
+
     return ret;
 }
 
-static inline void target_to_host_sockaddr(struct sockaddr *addr,
-                                           abi_ulong target_addr,
-                                           socklen_t len)
+static inline abi_long target_to_host_sockaddr(struct sockaddr *addr,
+                                               abi_ulong target_addr,
+                                               socklen_t len)
 {
     struct target_sockaddr *target_saddr;
 
-    target_saddr = lock_user(target_addr, len, 1);
+    target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
+    if (!target_saddr)
+        return -TARGET_EFAULT;
     memcpy(addr, target_saddr, len);
     addr->sa_family = tswap16(target_saddr->sa_family);
     unlock_user(target_saddr, target_addr, 0);
+
+    return 0;
 }
 
-static inline void host_to_target_sockaddr(abi_ulong target_addr,
-                                           struct sockaddr *addr,
-                                           socklen_t len)
+static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,
+                                               struct sockaddr *addr,
+                                               socklen_t len)
 {
     struct target_sockaddr *target_saddr;
 
-    target_saddr = lock_user(target_addr, len, 0);
+    target_saddr = lock_user(VERIFY_WRITE, target_addr, len, 0);
+    if (!target_saddr)
+        return -TARGET_EFAULT;
     memcpy(target_saddr, addr, len);
     target_saddr->sa_family = tswap16(addr->sa_family);
     unlock_user(target_saddr, target_addr, len);
+
+    return 0;
 }
 
 /* ??? Should this also swap msgh->name?  */
-static inline void target_to_host_cmsg(struct msghdr *msgh,
-                                       struct target_msghdr *target_msgh)
+static inline abi_long target_to_host_cmsg(struct msghdr *msgh,
+                                           struct target_msghdr *target_msgh)
 {
     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
-    struct target_cmsghdr *target_cmsg = TARGET_CMSG_FIRSTHDR(target_msgh);
+    abi_long msg_controllen;
+    abi_ulong target_cmsg_addr;
+    struct target_cmsghdr *target_cmsg;
     socklen_t space = 0;
+    
+    msg_controllen = tswapl(target_msgh->msg_controllen);
+    if (msg_controllen < sizeof (struct target_cmsghdr)) 
+        goto the_end;
+    target_cmsg_addr = tswapl(target_msgh->msg_control);
+    target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);
+    if (!target_cmsg)
+        return -TARGET_EFAULT;
 
     while (cmsg && target_cmsg) {
         void *data = CMSG_DATA(cmsg);
@@ -681,18 +719,30 @@
         cmsg = CMSG_NXTHDR(msgh, cmsg);
         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg);
     }
-
+    unlock_user(target_cmsg, target_cmsg_addr, 0);
+ the_end:
     msgh->msg_controllen = space;
+    return 0;
 }
 
 /* ??? Should this also swap msgh->name?  */
-static inline void host_to_target_cmsg(struct target_msghdr *target_msgh,
-                                       struct msghdr *msgh)
+static inline abi_long host_to_target_cmsg(struct target_msghdr *target_msgh,
+                                           struct msghdr *msgh)
 {
     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
-    struct target_cmsghdr *target_cmsg = TARGET_CMSG_FIRSTHDR(target_msgh);
+    abi_long msg_controllen;
+    abi_ulong target_cmsg_addr;
+    struct target_cmsghdr *target_cmsg;
     socklen_t space = 0;
 
+    msg_controllen = tswapl(target_msgh->msg_controllen);
+    if (msg_controllen < sizeof (struct target_cmsghdr)) 
+        goto the_end;
+    target_cmsg_addr = tswapl(target_msgh->msg_control);
+    target_cmsg = lock_user(VERIFY_WRITE, target_cmsg_addr, msg_controllen, 0);
+    if (!target_cmsg)
+        return -TARGET_EFAULT;
+
     while (cmsg && target_cmsg) {
         void *data = CMSG_DATA(cmsg);
         void *target_data = TARGET_CMSG_DATA(target_cmsg);
@@ -700,7 +750,7 @@
         int len = cmsg->cmsg_len - CMSG_ALIGN(sizeof (struct cmsghdr));
 
         space += TARGET_CMSG_SPACE(len);
-        if (space > tswapl(target_msgh->msg_controllen)) {
+        if (space > msg_controllen) {
             space -= TARGET_CMSG_SPACE(len);
             gemu_log("Target cmsg overflow\n");
             break;
@@ -725,8 +775,10 @@
         cmsg = CMSG_NXTHDR(msgh, cmsg);
         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg);
     }
-
-    msgh->msg_controllen = tswapl(space);
+    unlock_user(target_cmsg, target_cmsg_addr, space);
+ the_end:
+    target_msgh->msg_controllen = tswapl(space);
+    return 0;
 }
 
 /* do_setsockopt() Must return target values and target errnos. */
@@ -941,35 +993,56 @@
     return ret;
 }
 
-static void lock_iovec(struct iovec *vec, abi_ulong target_addr,
-                       int count, int copy)
+/* FIXME
+ * lock_iovec()/unlock_iovec() have a return code of 0 for success where
+ * other lock functions have a return code of 0 for failure.
+ */
+static abi_long lock_iovec(int type, struct iovec *vec, abi_ulong target_addr,
+                           int count, int copy)
 {
     struct target_iovec *target_vec;
     abi_ulong base;
-    int i;
+    int i, j;
 
-    target_vec = lock_user(target_addr, count * sizeof(struct target_iovec), 1);
+    target_vec = lock_user(VERIFY_READ, target_addr, count * sizeof(struct target_iovec), 1);
+    if (!target_vec)
+        return -TARGET_EFAULT;
     for(i = 0;i < count; i++) {
         base = tswapl(target_vec[i].iov_base);
         vec[i].iov_len = tswapl(target_vec[i].iov_len);
-        vec[i].iov_base = lock_user(base, vec[i].iov_len, copy);
+        vec[i].iov_base = lock_user(type, base, vec[i].iov_len, copy);
+	if (!vec[i].iov_base) 
+            goto fail;
     }
     unlock_user (target_vec, target_addr, 0);
+    return 0;
+ fail:
+    /* failure - unwind locks */
+    for (j = 0; j < i; j++) {
+        base = tswapl(target_vec[j].iov_base);
+        unlock_user(vec[j].iov_base, base, 0);
+    }
+    unlock_user (target_vec, target_addr, 0);
+    return -TARGET_EFAULT;
 }
 
-static void unlock_iovec(struct iovec *vec, abi_ulong target_addr,
-                         int count, int copy)
+static abi_long unlock_iovec(struct iovec *vec, abi_ulong target_addr,
+                             int count, int copy)
 {
     struct target_iovec *target_vec;
     abi_ulong base;
     int i;
 
-    target_vec = lock_user(target_addr, count * sizeof(struct target_iovec), 1);
+    target_vec = lock_user(VERIFY_READ, target_addr, count * sizeof(struct target_iovec), 1);
+    if (!target_vec)
+        return -TARGET_EFAULT;
     for(i = 0;i < count; i++) {
         base = tswapl(target_vec[i].iov_base);
         unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);
     }
     unlock_user (target_vec, target_addr, 0);
+
+    return 0;
 }
 
 /* do_socket() Must return target values and target errnos. */
@@ -1033,7 +1106,12 @@
     struct iovec *vec;
     abi_ulong target_vec;
 
-    lock_user_struct(msgp, target_msg, 1);
+    /* FIXME */
+    if (!lock_user_struct(send ? VERIFY_READ : VERIFY_WRITE,
+                          msgp,
+                          target_msg,
+                          send ? 1 : 0))
+        return -TARGET_EFAULT;
     if (msgp->msg_name) {
         msg.msg_namelen = tswap32(msgp->msg_namelen);
         msg.msg_name = alloca(msg.msg_namelen);
@@ -1050,19 +1128,21 @@
     count = tswapl(msgp->msg_iovlen);
     vec = alloca(count * sizeof(struct iovec));
     target_vec = tswapl(msgp->msg_iov);
-    lock_iovec(vec, target_vec, count, send);
+    lock_iovec(send ? VERIFY_READ : VERIFY_WRITE, vec, target_vec, count, send);
     msg.msg_iovlen = count;
     msg.msg_iov = vec;
 
     if (send) {
-        target_to_host_cmsg(&msg, msgp);
-        ret = get_errno(sendmsg(fd, &msg, flags));
+        ret = target_to_host_cmsg(&msg, msgp);
+        if (ret == 0)
+            ret = get_errno(sendmsg(fd, &msg, flags));
     } else {
         ret = get_errno(recvmsg(fd, &msg, flags));
         if (!is_error(ret))
-            host_to_target_cmsg(msgp, &msg);
+            ret = host_to_target_cmsg(msgp, &msg);
     }
     unlock_iovec(vec, target_vec, count, !send);
+    unlock_user_struct(msgp, target_msg, send ? 0 : 1);
     return ret;
 }
 
@@ -1137,7 +1217,9 @@
     void *host_msg;
     abi_long ret;
 
-    host_msg = lock_user(msg, len, 1);
+    host_msg = lock_user(VERIFY_READ, msg, len, 1);
+    if (!host_msg)
+        return -TARGET_EFAULT;
     if (target_addr) {
         addr = alloca(addrlen);
         target_to_host_sockaddr(addr, target_addr, addrlen);
@@ -1159,7 +1241,9 @@
     void *host_msg;
     abi_long ret;
 
-    host_msg = lock_user(msg, len, 0);
+    host_msg = lock_user(VERIFY_WRITE, msg, len, 0);
+    if (!host_msg)
+        return -TARGET_EFAULT;
     if (target_addr) {
         addrlen = tget32(target_addrlen);
         addr = alloca(addrlen);
@@ -1350,8 +1434,8 @@
 #define N_SHM_REGIONS	32
 
 static struct shm_region {
-    uint32_t	start;
-    uint32_t	size;
+    abi_ulong	start;
+    abi_ulong	size;
 } shm_regions[N_SHM_REGIONS];
 
 struct target_ipc_perm
@@ -1381,13 +1465,14 @@
   abi_ulong __unused4;
 };
 
-static inline void target_to_host_ipc_perm(struct ipc_perm *host_ip,
-                                           abi_ulong target_addr)
+static inline abi_long target_to_host_ipc_perm(struct ipc_perm *host_ip,
+                                               abi_ulong target_addr)
 {
     struct target_ipc_perm *target_ip;
     struct target_semid_ds *target_sd;
 
-    lock_user_struct(target_sd, target_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
+        return -TARGET_EFAULT;
     target_ip=&(target_sd->sem_perm);
     host_ip->__key = tswapl(target_ip->__key);
     host_ip->uid = tswapl(target_ip->uid);
@@ -1396,15 +1481,17 @@
     host_ip->cgid = tswapl(target_ip->cgid);
     host_ip->mode = tswapl(target_ip->mode);
     unlock_user_struct(target_sd, target_addr, 0);
+    return 0;
 }
 
-static inline void host_to_target_ipc_perm(abi_ulong target_addr,
-                                           struct ipc_perm *host_ip)
+static inline abi_long host_to_target_ipc_perm(abi_ulong target_addr,
+                                               struct ipc_perm *host_ip)
 {
     struct target_ipc_perm *target_ip;
     struct target_semid_ds *target_sd;
 
-    lock_user_struct(target_sd, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
+        return -TARGET_EFAULT;
     target_ip = &(target_sd->sem_perm);
     target_ip->__key = tswapl(host_ip->__key);
     target_ip->uid = tswapl(host_ip->uid);
@@ -1413,32 +1500,37 @@
     target_ip->cgid = tswapl(host_ip->cgid);
     target_ip->mode = tswapl(host_ip->mode);
     unlock_user_struct(target_sd, target_addr, 1);
+    return 0;
 }
 
-static inline void target_to_host_semid_ds(struct semid_ds *host_sd,
-                                          abi_ulong target_addr)
+static inline abi_long target_to_host_semid_ds(struct semid_ds *host_sd,
+                                               abi_ulong target_addr)
 {
     struct target_semid_ds *target_sd;
 
-    lock_user_struct(target_sd, target_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
+        return -TARGET_EFAULT;
     target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr);
     host_sd->sem_nsems = tswapl(target_sd->sem_nsems);
     host_sd->sem_otime = tswapl(target_sd->sem_otime);
     host_sd->sem_ctime = tswapl(target_sd->sem_ctime);
     unlock_user_struct(target_sd, target_addr, 0);
+    return 0;
 }
 
-static inline void host_to_target_semid_ds(abi_ulong target_addr,
-                                           struct semid_ds *host_sd)
+static inline abi_long host_to_target_semid_ds(abi_ulong target_addr,
+                                               struct semid_ds *host_sd)
 {
     struct target_semid_ds *target_sd;
 
-    lock_user_struct(target_sd, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
+        return -TARGET_EFAULT;
     host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm));
     target_sd->sem_nsems = tswapl(host_sd->sem_nsems);
     target_sd->sem_otime = tswapl(host_sd->sem_otime);
     target_sd->sem_ctime = tswapl(host_sd->sem_ctime);
     unlock_user_struct(target_sd, target_addr, 1);
+    return 0;
 }
 
 union semun {
@@ -1453,67 +1545,75 @@
 	unsigned short int *array;
 };
 
-static inline void target_to_host_semun(int cmd,
-                                        union semun *host_su,
-                                        abi_ulong target_addr,
-                                        struct semid_ds *ds)
+static inline abi_long target_to_host_semun(int cmd,
+                                            union semun *host_su,
+                                            abi_ulong target_addr,
+                                            struct semid_ds *ds)
 {
     union target_semun *target_su;
 
     switch( cmd ) {
 	case IPC_STAT:
 	case IPC_SET:
-           lock_user_struct(target_su, target_addr, 1);
+           if (!lock_user_struct(VERIFY_READ, target_su, target_addr, 1))
+               return -TARGET_EFAULT;
 	   target_to_host_semid_ds(ds,target_su->buf);
 	   host_su->buf = ds;
            unlock_user_struct(target_su, target_addr, 0);
 	   break;
 	case GETVAL:
 	case SETVAL:
-           lock_user_struct(target_su, target_addr, 1);
+           if (!lock_user_struct(VERIFY_READ, target_su, target_addr, 1))
+               return -TARGET_EFAULT;
 	   host_su->val = tswapl(target_su->val);
            unlock_user_struct(target_su, target_addr, 0);
 	   break;
 	case GETALL:
 	case SETALL:
-           lock_user_struct(target_su, target_addr, 1);
+           if (!lock_user_struct(VERIFY_READ, target_su, target_addr, 1))
+               return -TARGET_EFAULT;
 	   *host_su->array = tswap16(*target_su->array);
            unlock_user_struct(target_su, target_addr, 0);
 	   break;
 	default:
            gemu_log("semun operation not fully supported: %d\n", (int)cmd);
     }
+    return 0;
 }
 
-static inline void host_to_target_semun(int cmd,
-                                        abi_ulong target_addr,
-                                        union semun *host_su,
-                                        struct semid_ds *ds)
+static inline abi_long host_to_target_semun(int cmd,
+                                            abi_ulong target_addr,
+                                            union semun *host_su,
+                                            struct semid_ds *ds)
 {
     union target_semun *target_su;
 
     switch( cmd ) {
 	case IPC_STAT:
 	case IPC_SET:
-           lock_user_struct(target_su, target_addr, 0);
+           if (lock_user_struct(VERIFY_WRITE, target_su, target_addr, 0))
+               return -TARGET_EFAULT;
 	   host_to_target_semid_ds(target_su->buf,ds);
            unlock_user_struct(target_su, target_addr, 1);
 	   break;
 	case GETVAL:
 	case SETVAL:
-           lock_user_struct(target_su, target_addr, 0);
+           if (lock_user_struct(VERIFY_WRITE, target_su, target_addr, 0))
+               return -TARGET_EFAULT;
 	   target_su->val = tswapl(host_su->val);
            unlock_user_struct(target_su, target_addr, 1);
 	   break;
 	case GETALL:
 	case SETALL:
-           lock_user_struct(target_su, target_addr, 0);
+           if (lock_user_struct(VERIFY_WRITE, target_su, target_addr, 0))
+               return -TARGET_EFAULT;
 	   *target_su->array = tswap16(*host_su->array);
            unlock_user_struct(target_su, target_addr, 1);
 	   break;
         default:
            gemu_log("semun operation not fully supported: %d\n", (int)cmd);
     }
+    return 0;
 }
 
 static inline abi_long do_semctl(int first, int second, int third,
@@ -1580,12 +1680,13 @@
   abi_ulong __unused5;
 };
 
-static inline void target_to_host_msqid_ds(struct msqid_ds *host_md,
-                                           abi_ulong target_addr)
+static inline abi_long target_to_host_msqid_ds(struct msqid_ds *host_md,
+                                               abi_ulong target_addr)
 {
     struct target_msqid_ds *target_md;
 
-    lock_user_struct(target_md, target_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_md, target_addr, 1))
+        return -TARGET_EFAULT;
     target_to_host_ipc_perm(&(host_md->msg_perm),target_addr);
     host_md->msg_stime = tswapl(target_md->msg_stime);
     host_md->msg_rtime = tswapl(target_md->msg_rtime);
@@ -1596,14 +1697,16 @@
     host_md->msg_lspid = tswapl(target_md->msg_lspid);
     host_md->msg_lrpid = tswapl(target_md->msg_lrpid);
     unlock_user_struct(target_md, target_addr, 0);
+    return 0;
 }
 
-static inline void host_to_target_msqid_ds(abi_ulong target_addr,
-                                           struct msqid_ds *host_md)
+static inline abi_long host_to_target_msqid_ds(abi_ulong target_addr,
+                                               struct msqid_ds *host_md)
 {
     struct target_msqid_ds *target_md;
 
-    lock_user_struct(target_md, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_md, target_addr, 0))
+        return -TARGET_EFAULT;
     host_to_target_ipc_perm(target_addr,&(host_md->msg_perm));
     target_md->msg_stime = tswapl(host_md->msg_stime);
     target_md->msg_rtime = tswapl(host_md->msg_rtime);
@@ -1614,6 +1717,7 @@
     target_md->msg_lspid = tswapl(host_md->msg_lspid);
     target_md->msg_lrpid = tswapl(host_md->msg_lrpid);
     unlock_user_struct(target_md, target_addr, 1);
+    return 0;
 }
 
 static inline abi_long do_msgctl(int first, int second, abi_long ptr)
@@ -1645,7 +1749,8 @@
     struct msgbuf *host_mb;
     abi_long ret = 0;
 
-    lock_user_struct(target_mb,msgp,0);
+    if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
+        return -TARGET_EFAULT;
     host_mb = malloc(msgsz+sizeof(long));
     host_mb->mtype = tswapl(target_mb->mtype);
     memcpy(host_mb->mtext,target_mb->mtext,msgsz);
@@ -1661,18 +1766,30 @@
                                  int msgflg)
 {
     struct target_msgbuf *target_mb;
+    char *target_mtext;
     struct msgbuf *host_mb;
     abi_long ret = 0;
 
-    lock_user_struct(target_mb, msgp, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
+        return -TARGET_EFAULT;
     host_mb = malloc(msgsz+sizeof(long));
     ret = get_errno(msgrcv(msqid, host_mb, msgsz, 1, msgflg));
-    if (ret > 0)
+    if (ret > 0) {
+        abi_ulong target_mtext_addr = msgp + sizeof(abi_ulong);
+        target_mtext = lock_user(VERIFY_WRITE, target_mtext_addr, ret, 0);
+        if (!target_mtext) {
+            ret = -TARGET_EFAULT;
+            goto end;
+        }
     	memcpy(target_mb->mtext, host_mb->mtext, ret);
+        unlock_user(target_mtext, target_mtext_addr, ret);
+    }
     target_mb->mtype = tswapl(host_mb->mtype);
     free(host_mb);
-    unlock_user_struct(target_mb, msgp, 0);
 
+end:
+    if (target_mb)
+        unlock_user_struct(target_mb, msgp, 1);
     return ret;
 }
 
@@ -1684,7 +1801,6 @@
 {
     int version;
     abi_long ret = 0;
-    unsigned long raddr;
     struct shmid_ds shm_info;
     int i;
 
@@ -1693,7 +1809,7 @@
 
     switch (call) {
     case IPCOP_semop:
-        ret = get_errno(semop(first,(struct sembuf *) ptr, second));
+        ret = get_errno(semop(first,(struct sembuf *)g2h(ptr), second));
         break;
 
     case IPCOP_semget:
@@ -1723,13 +1839,14 @@
 
 	case IPCOP_msgrcv:
                 {
+                      /* XXX: this code is not correct */
                       struct ipc_kludge
                       {
                               void *__unbounded msgp;
                               long int msgtyp;
                       };
 
-                      struct ipc_kludge *foo = (struct ipc_kludge *) ptr;
+                      struct ipc_kludge *foo = (struct ipc_kludge *)g2h(ptr);
                       struct msgbuf *msgp = (struct msgbuf *) foo->msgp;
 
                       ret = do_msgrcv(first, (long)msgp, second, 0, third);
@@ -1738,32 +1855,38 @@
 		break;
 
     case IPCOP_shmat:
-	/* SHM_* flags are the same on all linux platforms */
-	ret = get_errno((long) shmat(first, (void *) ptr, second));
-        if (is_error(ret))
-            break;
-        raddr = ret;
-	/* find out the length of the shared memory segment */
-
-        ret = get_errno(shmctl(first, IPC_STAT, &shm_info));
-        if (is_error(ret)) {
-            /* can't get length, bail out */
-            shmdt((void *) raddr);
-	    break;
-	}
-	page_set_flags(raddr, raddr + shm_info.shm_segsz,
-		       PAGE_VALID | PAGE_READ |
-		       ((second & SHM_RDONLY)? 0: PAGE_WRITE));
-	for (i = 0; i < N_SHM_REGIONS; ++i) {
-	    if (shm_regions[i].start == 0) {
-		shm_regions[i].start = raddr;
-		shm_regions[i].size = shm_info.shm_segsz;
+        {
+            abi_ulong raddr;
+            void *host_addr;
+            /* SHM_* flags are the same on all linux platforms */
+            host_addr = shmat(first, (void *)g2h(ptr), second);
+            if (host_addr == (void *)-1) {
+                ret = get_errno((long)host_addr);
                 break;
-	    }
-	}
-	if (put_user(raddr, (abi_ulong *)third))
-            return -TARGET_EFAULT;
-        ret = 0;
+            }
+            raddr = h2g((unsigned long)host_addr);
+            /* find out the length of the shared memory segment */
+            
+            ret = get_errno(shmctl(first, IPC_STAT, &shm_info));
+            if (is_error(ret)) {
+                /* can't get length, bail out */
+                shmdt(host_addr);
+                break;
+            }
+            page_set_flags(raddr, raddr + shm_info.shm_segsz,
+                           PAGE_VALID | PAGE_READ |
+                           ((second & SHM_RDONLY)? 0: PAGE_WRITE));
+            for (i = 0; i < N_SHM_REGIONS; ++i) {
+                if (shm_regions[i].start == 0) {
+                    shm_regions[i].start = raddr;
+                    shm_regions[i].size = shm_info.shm_segsz;
+                    break;
+                }
+            }
+            if (put_user(raddr, third, abi_ulong))
+                return -TARGET_EFAULT;
+            ret = 0;
+        }
 	break;
     case IPCOP_shmdt:
 	for (i = 0; i < N_SHM_REGIONS; ++i) {
@@ -1773,7 +1896,7 @@
 		break;
 	    }
 	}
-	ret = get_errno(shmdt((void *) ptr));
+	ret = get_errno(shmdt((void *)g2h(ptr)));
 	break;
 
     case IPCOP_shmget:
@@ -1883,25 +2006,33 @@
         case IOC_R:
             ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
             if (!is_error(ret)) {
-                argptr = lock_user(arg, target_size, 0);
+                argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
+                if (!argptr)
+                    return -TARGET_EFAULT;
                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
                 unlock_user(argptr, arg, target_size);
             }
             break;
         case IOC_W:
-            argptr = lock_user(arg, target_size, 1);
+            argptr = lock_user(VERIFY_READ, arg, target_size, 1);
+            if (!argptr)
+                return -TARGET_EFAULT;
             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
             unlock_user(argptr, arg, 0);
             ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
             break;
         default:
         case IOC_RW:
-            argptr = lock_user(arg, target_size, 1);
+            argptr = lock_user(VERIFY_READ, arg, target_size, 1);
+            if (!argptr)
+                return -TARGET_EFAULT;
             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
             unlock_user(argptr, arg, 0);
             ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
             if (!is_error(ret)) {
-                argptr = lock_user(arg, target_size, 0);
+                argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
+                if (!argptr)
+                    return -TARGET_EFAULT;
                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
                 unlock_user(argptr, arg, target_size);
             }
@@ -2128,7 +2259,7 @@
 /* NOTE: there is really one LDT for all the threads */
 uint8_t *ldt_table;
 
-static int read_ldt(abi_ulong ptr, unsigned long bytecount)
+static abi_long read_ldt(abi_ulong ptr, unsigned long bytecount)
 {
     int size;
     void *p;
@@ -2138,17 +2269,18 @@
     size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE;
     if (size > bytecount)
         size = bytecount;
-    p = lock_user(ptr, size, 0);
-    /* ??? Shoudl this by byteswapped?  */
+    p = lock_user(VERIFY_WRITE, ptr, size, 0);
+    if (!p)
+        return -TARGET_EFAULT;
+    /* ??? Should this by byteswapped?  */
     memcpy(p, ldt_table, size);
     unlock_user(p, ptr, size);
     return size;
 }
 
 /* XXX: add locking support */
-/* write_ldt() returns host errnos */
-static int write_ldt(CPUX86State *env,
-                     abi_ulong ptr, unsigned long bytecount, int oldmode)
+static abi_long write_ldt(CPUX86State *env,
+                          abi_ulong ptr, unsigned long bytecount, int oldmode)
 {
     struct target_modify_ldt_ldt_s ldt_info;
     struct target_modify_ldt_ldt_s *target_ldt_info;
@@ -2157,8 +2289,9 @@
     uint32_t *lp, entry_1, entry_2;
 
     if (bytecount != sizeof(ldt_info))
-        return -EINVAL;
-    lock_user_struct(target_ldt_info, ptr, 1);
+        return -TARGET_EINVAL;
+    if (!lock_user_struct(VERIFY_READ, target_ldt_info, ptr, 1))
+        return -TARGET_EFAULT;
     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
     ldt_info.base_addr = tswapl(target_ldt_info->base_addr);
     ldt_info.limit = tswap32(target_ldt_info->limit);
@@ -2166,7 +2299,7 @@
     unlock_user_struct(target_ldt_info, ptr, 0);
 
     if (ldt_info.entry_number >= TARGET_LDT_ENTRIES)
-        return -EINVAL;
+        return -TARGET_EINVAL;
     seg_32bit = ldt_info.flags & 1;
     contents = (ldt_info.flags >> 1) & 3;
     read_exec_only = (ldt_info.flags >> 3) & 1;
@@ -2176,17 +2309,17 @@
 
     if (contents == 3) {
         if (oldmode)
-            return -EINVAL;
+            return -TARGET_EINVAL;
         if (seg_not_present == 0)
-            return -EINVAL;
+            return -TARGET_EINVAL;
     }
     /* allocate the LDT */
     if (!ldt_table) {
         ldt_table = malloc(TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
         if (!ldt_table)
-            return -ENOMEM;
+            return -TARGET_ENOMEM;
         memset(ldt_table, 0, TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
-        env->ldt.base = h2g(ldt_table);
+        env->ldt.base = h2g((unsigned long)ldt_table);
         env->ldt.limit = 0xffff;
     }
 
@@ -2229,11 +2362,10 @@
 }
 
 /* specific and weird i386 syscalls */
-/* do_modify_ldt() returns host errnos (it is inconsistent with the
-   other do_*() functions which return target errnos). */
-int do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr, unsigned long bytecount)
+abi_long do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr, 
+                       unsigned long bytecount)
 {
-    int ret = -ENOSYS;
+    abi_long ret;
 
     switch (func) {
     case 0:
@@ -2245,6 +2377,9 @@
     case 0x11:
         ret = write_ldt(env, ptr, bytecount, 0);
         break;
+    default:
+        ret = -TARGET_ENOSYS;
+        break;
     }
     return ret;
 }
@@ -2365,16 +2500,18 @@
 
     switch(cmd) {
     case TARGET_F_GETLK:
-        lock_user_struct(target_fl, arg, 1);
+        if (!lock_user_struct(VERIFY_READ, target_fl, arg, 1))
+            return -TARGET_EFAULT;
         fl.l_type = tswap16(target_fl->l_type);
         fl.l_whence = tswap16(target_fl->l_whence);
         fl.l_start = tswapl(target_fl->l_start);
         fl.l_len = tswapl(target_fl->l_len);
         fl.l_pid = tswapl(target_fl->l_pid);
         unlock_user_struct(target_fl, arg, 0);
-        ret = fcntl(fd, cmd, &fl);
+        ret = get_errno(fcntl(fd, cmd, &fl));
         if (ret == 0) {
-            lock_user_struct(target_fl, arg, 0);
+            if (!lock_user_struct(VERIFY_WRITE, target_fl, arg, 0))
+                return -TARGET_EFAULT;
             target_fl->l_type = tswap16(fl.l_type);
             target_fl->l_whence = tswap16(fl.l_whence);
             target_fl->l_start = tswapl(fl.l_start);
@@ -2386,27 +2523,30 @@
 
     case TARGET_F_SETLK:
     case TARGET_F_SETLKW:
-        lock_user_struct(target_fl, arg, 1);
+        if (!lock_user_struct(VERIFY_READ, target_fl, arg, 1))
+            return -TARGET_EFAULT;
         fl.l_type = tswap16(target_fl->l_type);
         fl.l_whence = tswap16(target_fl->l_whence);
         fl.l_start = tswapl(target_fl->l_start);
         fl.l_len = tswapl(target_fl->l_len);
         fl.l_pid = tswapl(target_fl->l_pid);
         unlock_user_struct(target_fl, arg, 0);
-        ret = fcntl(fd, cmd, &fl);
+        ret = get_errno(fcntl(fd, cmd, &fl));
         break;
 
     case TARGET_F_GETLK64:
-        lock_user_struct(target_fl64, arg, 1);
+        if (!lock_user_struct(VERIFY_READ, target_fl64, arg, 1))
+            return -TARGET_EFAULT;
         fl64.l_type = tswap16(target_fl64->l_type) >> 1;
         fl64.l_whence = tswap16(target_fl64->l_whence);
         fl64.l_start = tswapl(target_fl64->l_start);
         fl64.l_len = tswapl(target_fl64->l_len);
         fl64.l_pid = tswap16(target_fl64->l_pid);
         unlock_user_struct(target_fl64, arg, 0);
-        ret = fcntl(fd, cmd >> 1, &fl64);
+        ret = get_errno(fcntl(fd, cmd >> 1, &fl64));
         if (ret == 0) {
-            lock_user_struct(target_fl64, arg, 0);
+            if (!lock_user_struct(VERIFY_WRITE, target_fl64, arg, 0))
+                return -TARGET_EFAULT;
             target_fl64->l_type = tswap16(fl64.l_type) >> 1;
             target_fl64->l_whence = tswap16(fl64.l_whence);
             target_fl64->l_start = tswapl(fl64.l_start);
@@ -2414,30 +2554,33 @@
             target_fl64->l_pid = tswapl(fl64.l_pid);
             unlock_user_struct(target_fl64, arg, 1);
         }
-		break;
+        break;
     case TARGET_F_SETLK64:
     case TARGET_F_SETLKW64:
-        lock_user_struct(target_fl64, arg, 1);
+        if (!lock_user_struct(VERIFY_READ, target_fl64, arg, 1))
+            return -TARGET_EFAULT;
         fl64.l_type = tswap16(target_fl64->l_type) >> 1;
         fl64.l_whence = tswap16(target_fl64->l_whence);
         fl64.l_start = tswapl(target_fl64->l_start);
         fl64.l_len = tswapl(target_fl64->l_len);
         fl64.l_pid = tswap16(target_fl64->l_pid);
         unlock_user_struct(target_fl64, arg, 0);
-		ret = fcntl(fd, cmd >> 1, &fl64);
+        ret = get_errno(fcntl(fd, cmd >> 1, &fl64));
         break;
 
     case F_GETFL:
-        ret = fcntl(fd, cmd, arg);
-        ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
+        ret = get_errno(fcntl(fd, cmd, arg));
+        if (ret >= 0) {
+            ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
+        }
         break;
 
     case F_SETFL:
-        ret = fcntl(fd, cmd, target_to_host_bitmask(arg, fcntl_flags_tbl));
+        ret = get_errno(fcntl(fd, cmd, target_to_host_bitmask(arg, fcntl_flags_tbl)));
         break;
 
     default:
-        ret = fcntl(fd, cmd, arg);
+        ret = get_errno(fcntl(fd, cmd, arg));
         break;
     }
     return ret;
@@ -2577,23 +2720,25 @@
 }
 #endif
 
-static inline void target_to_host_timespec(struct timespec *host_ts,
-                                           abi_ulong target_addr)
+static inline abi_long target_to_host_timespec(struct timespec *host_ts,
+                                               abi_ulong target_addr)
 {
     struct target_timespec *target_ts;
 
-    lock_user_struct(target_ts, target_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1))
+        return -TARGET_EFAULT;
     host_ts->tv_sec = tswapl(target_ts->tv_sec);
     host_ts->tv_nsec = tswapl(target_ts->tv_nsec);
     unlock_user_struct(target_ts, target_addr, 0);
 }
 
-static inline void host_to_target_timespec(abi_ulong target_addr,
-                                           struct timespec *host_ts)
+static inline abi_long host_to_target_timespec(abi_ulong target_addr,
+                                               struct timespec *host_ts)
 {
     struct target_timespec *target_ts;
 
-    lock_user_struct(target_ts, target_addr, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0))
+        return -TARGET_EFAULT;
     target_ts->tv_sec = tswapl(host_ts->tv_sec);
     target_ts->tv_nsec = tswapl(host_ts->tv_nsec);
     unlock_user_struct(target_ts, target_addr, 1);
@@ -2629,17 +2774,22 @@
         break;
     case TARGET_NR_read:
         page_unprotect_range(arg2, arg3);
-        p = lock_user(arg2, arg3, 0);
+        if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
+            goto efault;
         ret = get_errno(read(arg1, p, arg3));
         unlock_user(p, arg2, ret);
         break;
     case TARGET_NR_write:
-        p = lock_user(arg2, arg3, 1);
+        if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
+            goto efault;
         ret = get_errno(write(arg1, p, arg3));
         unlock_user(p, arg2, 0);
         break;
     case TARGET_NR_open:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1))) {
+            return -TARGET_EFAULT;
+            goto fail;
+        }
         ret = get_errno(open(path(p),
                              target_to_host_bitmask(arg2, fcntl_flags_tbl),
                              arg3));
@@ -2647,21 +2797,13 @@
         break;
 #if defined(TARGET_NR_openat) && defined(__NR_openat)
     case TARGET_NR_openat:
-        if (!arg2) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            /* Don't "goto fail" so that cleanup can happen. */
-            ret = -TARGET_EFAULT;
-        else
-            ret = get_errno(sys_openat(arg1,
-                                       path(p),
-                                       target_to_host_bitmask(arg3, fcntl_flags_tbl),
-                                       arg4));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_openat(arg1,
+                                   path(p),
+                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
+                                   arg4));
+        unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_close:
@@ -2685,7 +2827,8 @@
 #endif
 #ifdef TARGET_NR_creat /* not on alpha */
     case TARGET_NR_creat:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(creat(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -2695,54 +2838,43 @@
             void * p2;
             p = lock_user_string(arg1);
             p2 = lock_user_string(arg2);
-            ret = get_errno(link(p, p2));
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
+            else
+                ret = get_errno(link(p, p2));
             unlock_user(p2, arg2, 0);
             unlock_user(p, arg1, 0);
         }
         break;
 #if defined(TARGET_NR_linkat) && defined(__NR_linkat)
     case TARGET_NR_linkat:
-        if (!arg2 || !arg4) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
         {
             void * p2 = NULL;
+            if (!arg2 || !arg4)
+                goto efault;
             p  = lock_user_string(arg2);
             p2 = lock_user_string(arg4);
-            if (!access_ok(VERIFY_READ, p, 1)
-                || !access_ok(VERIFY_READ, p2, 1))
-                /* Don't "goto fail" so that cleanup can happen. */
+            if (!p || !p2)
                 ret = -TARGET_EFAULT;
             else
                 ret = get_errno(sys_linkat(arg1, p, arg3, p2, arg5));
-            if (p2)
-                unlock_user(p, arg2, 0);
-            if (p)
-                unlock_user(p2, arg4, 0);
+            unlock_user(p, arg2, 0);
+            unlock_user(p2, arg4, 0);
         }
         break;
 #endif
     case TARGET_NR_unlink:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(unlink(p));
         unlock_user(p, arg1, 0);
         break;
 #if defined(TARGET_NR_unlinkat) && defined(__NR_unlinkat)
     case TARGET_NR_unlinkat:
-        if (!arg2) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            /* Don't "goto fail" so that cleanup can happen. */
-            ret = -TARGET_EFAULT;
-        else
-            ret = get_errno(sys_unlinkat(arg1, p, arg3));
-        if (p)
-            unlock_user(p, arg2, 0);
-        break;
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_unlinkat(arg1, p, arg3));
+        unlock_user(p, arg2, 0);
 #endif
     case TARGET_NR_execve:
         {
@@ -2771,7 +2903,10 @@
                 addr = tgetl(gp);
                 if (!addr)
                     break;
-                *q = lock_user_string(addr);
+                if (!(*q = lock_user_string(addr))) {
+                    ret = -TARGET_EFAULT;
+                    goto execve_fail;
+                }
             }
             *q = NULL;
 
@@ -2780,14 +2915,21 @@
                 addr = tgetl(gp);
                 if (!addr)
                     break;
-                *q = lock_user_string(addr);
+                if (!(*q = lock_user_string(addr))) {
+                    ret = -TARGET_EFAULT;
+                    goto execve_fail;
+                }
             }
             *q = NULL;
 
-            p = lock_user_string(arg1);
+            if (!(p = lock_user_string(arg1))) {
+                ret = -TARGET_EFAULT;
+                goto execve_fail;
+            }
             ret = get_errno(execve(p, argp, envp));
             unlock_user(p, arg1, 0);
 
+        execve_fail:
             for (gp = guest_argp, q = argp; *q;
                   gp += sizeof(abi_ulong), q++) {
                 addr = tgetl(gp);
@@ -2801,7 +2943,8 @@
         }
         break;
     case TARGET_NR_chdir:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(chdir(p));
         unlock_user(p, arg1, 0);
         break;
@@ -2816,28 +2959,22 @@
         break;
 #endif
     case TARGET_NR_mknod:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(mknod(p, arg2, arg3));
         unlock_user(p, arg1, 0);
         break;
 #if defined(TARGET_NR_mknodat) && defined(__NR_mknodat)
     case TARGET_NR_mknodat:
-        if (!arg2) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            /* Don't "goto fail" so that cleanup can happen. */
-            ret = -TARGET_EFAULT;
-        else
-            ret = get_errno(sys_mknodat(arg1, p, arg3, arg4));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_mknodat(arg1, p, arg3, arg4));
+        unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_chmod:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(chmod(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -2866,15 +3003,23 @@
 			p = lock_user_string(arg1);
 			p2 = lock_user_string(arg2);
 			p3 = lock_user_string(arg3);
-			ret = get_errno(mount(p, p2, p3, (unsigned long)arg4, (const void *)arg5));
-			unlock_user(p, arg1, 0);
-			unlock_user(p2, arg2, 0);
-			unlock_user(p3, arg3, 0);
+                        if (!p || !p2 || !p3)
+                            ret = -TARGET_EFAULT;
+                        else
+                            /* FIXME - arg5 should be locked, but it isn't clear how to
+                             * do that since it's not guaranteed to be a NULL-terminated
+                             * string.
+                             */
+                            ret = get_errno(mount(p, p2, p3, (unsigned long)arg4, g2h(arg5)));
+                        unlock_user(p, arg1, 0);
+                        unlock_user(p2, arg2, 0);
+                        unlock_user(p3, arg3, 0);
 			break;
 		}
 #ifdef TARGET_NR_umount
     case TARGET_NR_umount:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(umount(p));
         unlock_user(p, arg1, 0);
         break;
@@ -2910,7 +3055,8 @@
             struct utimbuf tbuf, *host_tbuf;
             struct target_utimbuf *target_tbuf;
             if (arg2) {
-                lock_user_struct(target_tbuf, arg2, 1);
+                if (!lock_user_struct(VERIFY_READ, target_tbuf, arg2, 1))
+                    goto efault;
                 tbuf.actime = tswapl(target_tbuf->actime);
                 tbuf.modtime = tswapl(target_tbuf->modtime);
                 unlock_user_struct(target_tbuf, arg2, 0);
@@ -2918,7 +3064,8 @@
             } else {
                 host_tbuf = NULL;
             }
-            p = lock_user_string(arg1);
+            if (!(p = lock_user_string(arg1)))
+                goto efault;
             ret = get_errno(utime(p, host_tbuf));
             unlock_user(p, arg1, 0);
         }
@@ -2935,7 +3082,8 @@
             } else {
                 tvp = NULL;
             }
-            p = lock_user_string(arg1);
+            if (!(p = lock_user_string(arg1)))
+                goto efault;
             ret = get_errno(utimes(p, tvp));
             unlock_user(p, arg1, 0);
         }
@@ -2949,24 +3097,17 @@
         goto unimplemented;
 #endif
     case TARGET_NR_access:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(access(p, arg2));
         unlock_user(p, arg1, 0);
         break;
 #if defined(TARGET_NR_faccessat) && defined(__NR_faccessat)
     case TARGET_NR_faccessat:
-        if (!arg2) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            /* Don't "goto fail" so that cleanup can happen. */
-    	    ret = -TARGET_EFAULT;
-        else
-            ret = get_errno(sys_faccessat(arg1, p, arg3, arg4));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_faccessat(arg1, p, arg3, arg4));
+        unlock_user(p, arg2, 0);
         break;
 #endif
 #ifdef TARGET_NR_nice /* not on alpha */
@@ -2990,57 +3131,46 @@
             void *p2;
             p = lock_user_string(arg1);
             p2 = lock_user_string(arg2);
-            ret = get_errno(rename(p, p2));
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
+            else
+                ret = get_errno(rename(p, p2));
             unlock_user(p2, arg2, 0);
             unlock_user(p, arg1, 0);
         }
         break;
 #if defined(TARGET_NR_renameat) && defined(__NR_renameat)
     case TARGET_NR_renameat:
-        if (!arg2 || !arg4) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
         {
-            void *p2 = NULL;
+            void *p2;
             p  = lock_user_string(arg2);
             p2 = lock_user_string(arg4);
-            if (!access_ok(VERIFY_READ, p, 1)
-                || !access_ok(VERIFY_READ, p2, 1))
-                /* Don't "goto fail" so that cleanup can happen. */
+            if (!p || !p2)
                 ret = -TARGET_EFAULT;
             else
                 ret = get_errno(sys_renameat(arg1, p, arg3, p2));
-            if (p2)
-                unlock_user(p2, arg4, 0);
-            if (p)
-                unlock_user(p, arg2, 0);
+            unlock_user(p2, arg4, 0);
+            unlock_user(p, arg2, 0);
         }
         break;
 #endif
     case TARGET_NR_mkdir:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(mkdir(p, arg2));
         unlock_user(p, arg1, 0);
         break;
 #if defined(TARGET_NR_mkdirat) && defined(__NR_mkdirat)
     case TARGET_NR_mkdirat:
-        if (!arg2) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            /* Don't "goto fail" so that cleanup can happen. */
-            ret = -TARGET_EFAULT;
-        else
-            ret = get_errno(sys_mkdirat(arg1, p, arg3));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_mkdirat(arg1, p, arg3));
+        unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_rmdir:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(rmdir(p));
         unlock_user(p, arg1, 0);
         break;
@@ -3069,7 +3199,9 @@
             struct tms tms;
             ret = get_errno(times(&tms));
             if (arg1) {
-                tmsp = lock_user(arg1, sizeof(struct target_tms), 0);
+                tmsp = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_tms), 0);
+                if (!tmsp)
+                    goto efault;
                 tmsp->tms_utime = tswapl(host_to_target_clock_t(tms.tms_utime));
                 tmsp->tms_stime = tswapl(host_to_target_clock_t(tms.tms_stime));
                 tmsp->tms_cutime = tswapl(host_to_target_clock_t(tms.tms_cutime));
@@ -3088,13 +3220,15 @@
         goto unimplemented;
 #endif
     case TARGET_NR_acct:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(acct(path(p)));
         unlock_user(p, arg1, 0);
         break;
 #ifdef TARGET_NR_umount2 /* not on alpha */
     case TARGET_NR_umount2:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(umount2(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -3107,7 +3241,7 @@
         ret = do_ioctl(arg1, arg2, arg3);
         break;
     case TARGET_NR_fcntl:
-        ret = get_errno(do_fcntl(arg1, arg2, arg3));
+        ret = do_fcntl(arg1, arg2, arg3);
         break;
 #ifdef TARGET_NR_mpx
     case TARGET_NR_mpx:
@@ -3128,7 +3262,8 @@
         ret = get_errno(umask(arg1));
         break;
     case TARGET_NR_chroot:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(chroot(p));
         unlock_user(p, arg1, 0);
         break;
@@ -3155,7 +3290,8 @@
             struct target_old_sigaction *old_act;
             struct target_sigaction act, oact, *pact;
             if (arg2) {
-                lock_user_struct(old_act, arg2, 1);
+                if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
+                    goto efault;
                 act._sa_handler = old_act->_sa_handler;
                 target_siginitset(&act.sa_mask, old_act->sa_mask);
                 act.sa_flags = old_act->sa_flags;
@@ -3167,7 +3303,8 @@
             }
             ret = get_errno(do_sigaction(arg1, pact, &oact));
             if (!is_error(ret) && arg3) {
-                lock_user_struct(old_act, arg3, 0);
+                if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
+                    goto efault;
                 old_act->_sa_handler = oact._sa_handler;
                 old_act->sa_mask = oact.sa_mask.sig[0];
                 old_act->sa_flags = oact.sa_flags;
@@ -3178,7 +3315,8 @@
 	    struct target_sigaction act, oact, *pact, *old_act;
 
 	    if (arg2) {
-		lock_user_struct(old_act, arg2, 1);
+                if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
+                    goto efault;
 		act._sa_handler = old_act->_sa_handler;
 		target_siginitset(&act.sa_mask, old_act->sa_mask.sig[0]);
 		act.sa_flags = old_act->sa_flags;
@@ -3191,7 +3329,8 @@
 	    ret = get_errno(do_sigaction(arg1, pact, &oact));
 
 	    if (!is_error(ret) && arg3) {
-		lock_user_struct(old_act, arg3, 0);
+                if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
+                    goto efault;
 		old_act->_sa_handler = oact._sa_handler;
 		old_act->sa_flags = oact.sa_flags;
 		old_act->sa_mask.sig[0] = oact.sa_mask.sig[0];
@@ -3209,18 +3348,23 @@
             struct target_sigaction *act;
             struct target_sigaction *oact;
 
-            if (arg2)
-                lock_user_struct(act, arg2, 1);
-            else
+            if (arg2) {
+                if (!lock_user_struct(VERIFY_READ, act, arg2, 1))
+                    goto efault;
+            } else
                 act = NULL;
-            if (arg3)
-                lock_user_struct(oact, arg3, 0);
-            else
+            if (arg3) {
+                if (!lock_user_struct(VERIFY_WRITE, oact, arg3, 0)) {
+                    ret = -TARGET_EFAULT;
+                    goto rt_sigaction_fail;
+                }
+            } else
                 oact = NULL;
             ret = get_errno(do_sigaction(arg1, act, oact));
-            if (arg2)
+	rt_sigaction_fail:
+            if (act)
                 unlock_user_struct(act, arg2, 0);
-            if (arg3)
+            if (oact)
                 unlock_user_struct(oact, arg3, 1);
         }
         break;
@@ -3270,7 +3414,8 @@
                     ret = -TARGET_EINVAL;
                     goto fail;
                 }
-                p = lock_user(arg2, sizeof(target_sigset_t), 1);
+                if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
+                    goto efault;
                 target_to_host_old_sigset(&set, p);
                 unlock_user(p, arg2, 0);
                 set_ptr = &set;
@@ -3280,7 +3425,8 @@
             }
             ret = get_errno(sigprocmask(arg1, set_ptr, &oldset));
             if (!is_error(ret) && arg3) {
-                p = lock_user(arg3, sizeof(target_sigset_t), 0);
+                if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
+                    goto efault;
                 host_to_target_old_sigset(p, &oldset);
                 unlock_user(p, arg3, sizeof(target_sigset_t));
             }
@@ -3307,7 +3453,8 @@
                     ret = -TARGET_EINVAL;
                     goto fail;
                 }
-                p = lock_user(arg2, sizeof(target_sigset_t), 1);
+                if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
+                    goto efault;
                 target_to_host_sigset(&set, p);
                 unlock_user(p, arg2, 0);
                 set_ptr = &set;
@@ -3317,7 +3464,8 @@
             }
             ret = get_errno(sigprocmask(how, set_ptr, &oldset));
             if (!is_error(ret) && arg3) {
-                p = lock_user(arg3, sizeof(target_sigset_t), 0);
+                if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
+                    goto efault;
                 host_to_target_sigset(p, &oldset);
                 unlock_user(p, arg3, sizeof(target_sigset_t));
             }
@@ -3329,7 +3477,8 @@
             sigset_t set;
             ret = get_errno(sigpending(&set));
             if (!is_error(ret)) {
-                p = lock_user(arg1, sizeof(target_sigset_t), 0);
+                if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
+                    goto efault;
                 host_to_target_old_sigset(p, &set);
                 unlock_user(p, arg1, sizeof(target_sigset_t));
             }
@@ -3341,7 +3490,8 @@
             sigset_t set;
             ret = get_errno(sigpending(&set));
             if (!is_error(ret)) {
-                p = lock_user(arg1, sizeof(target_sigset_t), 0);
+                if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
+                    goto efault;
                 host_to_target_sigset(p, &set);
                 unlock_user(p, arg1, sizeof(target_sigset_t));
             }
@@ -3351,7 +3501,8 @@
     case TARGET_NR_sigsuspend:
         {
             sigset_t set;
-            p = lock_user(arg1, sizeof(target_sigset_t), 1);
+            if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
+                goto efault;
             target_to_host_old_sigset(&set, p);
             unlock_user(p, arg1, 0);
             ret = get_errno(sigsuspend(&set));
@@ -3361,7 +3512,8 @@
     case TARGET_NR_rt_sigsuspend:
         {
             sigset_t set;
-            p = lock_user(arg1, sizeof(target_sigset_t), 1);
+            if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
+                goto efault;
             target_to_host_sigset(&set, p);
             unlock_user(p, arg1, 0);
             ret = get_errno(sigsuspend(&set));
@@ -3373,7 +3525,8 @@
             struct timespec uts, *puts;
             siginfo_t uinfo;
 
-            p = lock_user(arg1, sizeof(target_sigset_t), 1);
+            if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
+                goto efault;
             target_to_host_sigset(&set, p);
             unlock_user(p, arg1, 0);
             if (arg3) {
@@ -3384,7 +3537,8 @@
             }
             ret = get_errno(sigtimedwait(&set, &uinfo, puts));
             if (!is_error(ret) && arg2) {
-                p = lock_user(arg2, sizeof(target_sigset_t), 0);
+                if (!(p = lock_user(VERIFY_WRITE, arg2, sizeof(target_sigset_t), 0)))
+                    goto efault;
                 host_to_target_siginfo(p, &uinfo);
                 unlock_user(p, arg2, sizeof(target_sigset_t));
             }
@@ -3393,7 +3547,8 @@
     case TARGET_NR_rt_sigqueueinfo:
         {
             siginfo_t uinfo;
-            p = lock_user(arg3, sizeof(target_sigset_t), 1);
+            if (!(p = lock_user(VERIFY_READ, arg3, sizeof(target_sigset_t), 1)))
+                goto efault;
             target_to_host_siginfo(&uinfo, p);
             unlock_user(p, arg1, 0);
             ret = get_errno(sys_rt_sigqueueinfo(arg1, arg2, &uinfo));
@@ -3410,7 +3565,8 @@
         ret = do_rt_sigreturn(cpu_env);
         break;
     case TARGET_NR_sethostname:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(sethostname(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -3420,7 +3576,8 @@
             int resource = arg1;
             struct target_rlimit *target_rlim;
             struct rlimit rlim;
-            lock_user_struct(target_rlim, arg2, 1);
+            if (!lock_user_struct(VERIFY_READ, target_rlim, arg2, 1))
+                goto efault;
             rlim.rlim_cur = tswapl(target_rlim->rlim_cur);
             rlim.rlim_max = tswapl(target_rlim->rlim_max);
             unlock_user_struct(target_rlim, arg2, 0);
@@ -3436,7 +3593,8 @@
 
             ret = get_errno(getrlimit(resource, &rlim));
             if (!is_error(ret)) {
-                lock_user_struct(target_rlim, arg2, 0);
+                if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
+                    goto efault;
                 rlim.rlim_cur = tswapl(target_rlim->rlim_cur);
                 rlim.rlim_max = tswapl(target_rlim->rlim_max);
                 unlock_user_struct(target_rlim, arg2, 1);
@@ -3475,7 +3633,8 @@
             abi_ulong inp, outp, exp, tvp;
             long nsel;
 
-            lock_user_struct(sel, arg1, 1);
+            if (!lock_user_struct(VERIFY_READ, sel, arg1, 1))
+                goto efault;
             nsel = tswapl(sel->n);
             inp = tswapl(sel->inp);
             outp = tswapl(sel->outp);
@@ -3491,31 +3650,26 @@
             void *p2;
             p = lock_user_string(arg1);
             p2 = lock_user_string(arg2);
-            ret = get_errno(symlink(p, p2));
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
+            else
+                ret = get_errno(symlink(p, p2));
             unlock_user(p2, arg2, 0);
             unlock_user(p, arg1, 0);
         }
         break;
 #if defined(TARGET_NR_symlinkat) && defined(__NR_symlinkat)
     case TARGET_NR_symlinkat:
-        if (!arg1 || !arg3) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
         {
-            void *p2 = NULL;
+            void *p2;
             p  = lock_user_string(arg1);
             p2 = lock_user_string(arg3);
-            if (!access_ok(VERIFY_READ, p, 1)
-                || !access_ok(VERIFY_READ, p2, 1))
-                /* Don't "goto fail" so that cleanup can happen. */
+            if (!p || !p2)
                 ret = -TARGET_EFAULT;
             else
                 ret = get_errno(sys_symlinkat(p, arg2, p2));
-            if (p2)
-                unlock_user(p2, arg3, 0);
-            if (p)
-                unlock_user(p, arg1, 0);
+            unlock_user(p2, arg3, 0);
+            unlock_user(p, arg1, 0);
         }
         break;
 #endif
@@ -3527,32 +3681,27 @@
         {
             void *p2;
             p = lock_user_string(arg1);
-            p2 = lock_user(arg2, arg3, 0);
-            ret = get_errno(readlink(path(p), p2, arg3));
+            p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
+            if (!p || !p2)
+                ret = -TARGET_EFAULT;
+            else
+                ret = get_errno(readlink(path(p), p2, arg3));
             unlock_user(p2, arg2, ret);
             unlock_user(p, arg1, 0);
         }
         break;
 #if defined(TARGET_NR_readlinkat) && defined(__NR_readlinkat)
     case TARGET_NR_readlinkat:
-        if (!arg2 || !arg3) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
         {
-            void *p2 = NULL;
+            void *p2;
             p  = lock_user_string(arg2);
-            p2 = lock_user(arg3, arg4, 0);
-            if (!access_ok(VERIFY_READ, p, 1)
-                || !access_ok(VERIFY_READ, p2, 1))
-                /* Don't "goto fail" so that cleanup can happen. */
+            p2 = lock_user(VERIFY_WRITE, arg3, arg4, 0);
+            if (!p || !p2)
         	ret = -TARGET_EFAULT;
             else
                 ret = get_errno(sys_readlinkat(arg1, path(p), p2, arg4));
-            if (p2)
-                unlock_user(p2, arg3, ret);
-            if (p)
-                unlock_user(p, arg2, 0);
+            unlock_user(p2, arg3, ret);
+            unlock_user(p, arg2, 0);
         }
         break;
 #endif
@@ -3562,7 +3711,8 @@
 #endif
 #ifdef TARGET_NR_swapon
     case TARGET_NR_swapon:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(swapon(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -3579,7 +3729,8 @@
         {
             abi_ulong *v;
             abi_ulong v1, v2, v3, v4, v5, v6;
-            v = lock_user(arg1, 6 * sizeof(abi_ulong), 1);
+            if (!(v = lock_user(VERIFY_READ, arg1, 6 * sizeof(abi_ulong), 1)))
+                goto efault;
             v1 = tswapl(v[0]);
             v2 = tswapl(v[1]);
             v3 = tswapl(v[2]);
@@ -3650,7 +3801,8 @@
         break;
 #endif
     case TARGET_NR_truncate:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(truncate(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -3662,18 +3814,10 @@
         break;
 #if defined(TARGET_NR_fchmodat) && defined(__NR_fchmodat)
     case TARGET_NR_fchmodat:
-        if (!arg2) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            /* Don't "goto fail" so that cleanup can happen. */
-            ret = -TARGET_EFAULT;
-        else
-            ret = get_errno(sys_fchmodat(arg1, p, arg3, arg4));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
+        ret = get_errno(sys_fchmodat(arg1, p, arg3, arg4));
+        unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_getpriority:
@@ -3690,25 +3834,26 @@
         goto unimplemented;
 #endif
     case TARGET_NR_statfs:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(statfs(path(p), &stfs));
         unlock_user(p, arg1, 0);
     convert_statfs:
         if (!is_error(ret)) {
             struct target_statfs *target_stfs;
 
-            lock_user_struct(target_stfs, arg2, 0);
-            /* ??? put_user is probably wrong.  */
-            put_user(stfs.f_type, &target_stfs->f_type);
-            put_user(stfs.f_bsize, &target_stfs->f_bsize);
-            put_user(stfs.f_blocks, &target_stfs->f_blocks);
-            put_user(stfs.f_bfree, &target_stfs->f_bfree);
-            put_user(stfs.f_bavail, &target_stfs->f_bavail);
-            put_user(stfs.f_files, &target_stfs->f_files);
-            put_user(stfs.f_ffree, &target_stfs->f_ffree);
-            put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
-            put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
-            put_user(stfs.f_namelen, &target_stfs->f_namelen);
+            if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg2, 0))
+                goto efault;
+            __put_user(stfs.f_type, &target_stfs->f_type);
+            __put_user(stfs.f_bsize, &target_stfs->f_bsize);
+            __put_user(stfs.f_blocks, &target_stfs->f_blocks);
+            __put_user(stfs.f_bfree, &target_stfs->f_bfree);
+            __put_user(stfs.f_bavail, &target_stfs->f_bavail);
+            __put_user(stfs.f_files, &target_stfs->f_files);
+            __put_user(stfs.f_ffree, &target_stfs->f_ffree);
+            __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
+            __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
+            __put_user(stfs.f_namelen, &target_stfs->f_namelen);
             unlock_user_struct(target_stfs, arg2, 1);
         }
         break;
@@ -3717,26 +3862,27 @@
         goto convert_statfs;
 #ifdef TARGET_NR_statfs64
     case TARGET_NR_statfs64:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(statfs(path(p), &stfs));
         unlock_user(p, arg1, 0);
     convert_statfs64:
         if (!is_error(ret)) {
             struct target_statfs64 *target_stfs;
 
-            lock_user_struct(target_stfs, arg3, 0);
-            /* ??? put_user is probably wrong.  */
-            put_user(stfs.f_type, &target_stfs->f_type);
-            put_user(stfs.f_bsize, &target_stfs->f_bsize);
-            put_user(stfs.f_blocks, &target_stfs->f_blocks);
-            put_user(stfs.f_bfree, &target_stfs->f_bfree);
-            put_user(stfs.f_bavail, &target_stfs->f_bavail);
-            put_user(stfs.f_files, &target_stfs->f_files);
-            put_user(stfs.f_ffree, &target_stfs->f_ffree);
-            put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
-            put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
-            put_user(stfs.f_namelen, &target_stfs->f_namelen);
-            unlock_user_struct(target_stfs, arg3, 0);
+            if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg3, 0))
+                goto efault;
+            __put_user(stfs.f_type, &target_stfs->f_type);
+            __put_user(stfs.f_bsize, &target_stfs->f_bsize);
+            __put_user(stfs.f_blocks, &target_stfs->f_blocks);
+            __put_user(stfs.f_bfree, &target_stfs->f_bfree);
+            __put_user(stfs.f_bavail, &target_stfs->f_bavail);
+            __put_user(stfs.f_files, &target_stfs->f_files);
+            __put_user(stfs.f_ffree, &target_stfs->f_ffree);
+            __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
+            __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
+            __put_user(stfs.f_namelen, &target_stfs->f_namelen);
+            unlock_user_struct(target_stfs, arg3, 1);
         }
         break;
     case TARGET_NR_fstatfs64:
@@ -3839,7 +3985,8 @@
 #endif
 
     case TARGET_NR_syslog:
-        p = lock_user_string(arg2);
+        if (!(p = lock_user_string(arg2)))
+            goto efault;
         ret = get_errno(sys_syslog((int)arg1, p, (int)arg3));
         unlock_user(p, arg2, 0);
         break;
@@ -3880,12 +4027,14 @@
         }
         break;
     case TARGET_NR_stat:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(stat(path(p), &st));
         unlock_user(p, arg1, 0);
         goto do_stat;
     case TARGET_NR_lstat:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(lstat(path(p), &st));
         unlock_user(p, arg1, 0);
         goto do_stat;
@@ -3896,7 +4045,8 @@
             if (!is_error(ret)) {
                 struct target_stat *target_st;
 
-                lock_user_struct(target_st, arg2, 0);
+                if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
+                    goto efault;
 #if defined(TARGET_MIPS) || (defined(TARGET_SPARC64) && !defined(TARGET_ABI32))
                 target_st->st_dev = tswap32(st.st_dev);
 #else
@@ -3979,7 +4129,8 @@
         break;
 #ifdef TARGET_NR_swapoff
     case TARGET_NR_swapoff:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(swapoff(p));
         unlock_user(p, arg1, 0);
         break;
@@ -3991,8 +4142,8 @@
             ret = get_errno(sysinfo(&value));
             if (!is_error(ret) && arg1)
             {
-                /* ??? __put_user is probably wrong.  */
-                lock_user_struct(target_value, arg1, 0);
+                if (!lock_user_struct(VERIFY_WRITE, target_value, arg1, 0))
+                    goto efault;
                 __put_user(value.uptime, &target_value->uptime);
                 __put_user(value.loads[0], &target_value->loads[0]);
                 __put_user(value.loads[1], &target_value->loads[1]);
@@ -4030,7 +4181,8 @@
         break;
 #endif
     case TARGET_NR_setdomainname:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(setdomainname(p, arg2));
         unlock_user(p, arg1, 0);
         break;
@@ -4039,7 +4191,8 @@
         {
             struct new_utsname * buf;
 
-            lock_user_struct(buf, arg1, 0);
+            if (!lock_user_struct(VERIFY_WRITE, buf, arg1, 0))
+                goto efault;
             ret = get_errno(sys_uname(buf));
             if (!is_error(ret)) {
                 /* Overrite the native machine name with whatever is being
@@ -4054,7 +4207,7 @@
         break;
 #ifdef TARGET_I386
     case TARGET_NR_modify_ldt:
-        ret = get_errno(do_modify_ldt(cpu_env, arg1, arg2, arg3));
+        ret = do_modify_ldt(cpu_env, arg1, arg2, arg3);
         break;
 #if !defined(TARGET_X86_64)
     case TARGET_NR_vm86old:
@@ -4115,7 +4268,6 @@
     case TARGET_NR_getdents:
 #if TARGET_ABI_BITS != 32
         goto unimplemented;
-#warning not supported
 #elif TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64
         {
             struct target_dirent *target_dirp;
@@ -4124,7 +4276,7 @@
 
 	    dirp = malloc(count);
 	    if (!dirp) {
-                ret = -TARGET_EFAULT;
+                ret = -TARGET_ENOMEM;
                 goto fail;
             }
 
@@ -4138,7 +4290,8 @@
 
 		count1 = 0;
                 de = dirp;
-                target_dirp = lock_user(arg2, count, 0);
+                if (!(target_dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
+                    goto efault;
 		tde = target_dirp;
                 while (len > 0) {
                     reclen = de->d_reclen;
@@ -4157,8 +4310,8 @@
 		    count1 += treclen;
                 }
 		ret = count1;
+                unlock_user(target_dirp, arg2, ret);
             }
-            unlock_user(target_dirp, arg2, ret);
 	    free(dirp);
         }
 #else
@@ -4166,7 +4319,8 @@
             struct dirent *dirp;
             abi_long count = arg3;
 
-            dirp = lock_user(arg2, count, 0);
+            if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
+                goto efault;
             ret = get_errno(sys_getdents(arg1, dirp, count));
             if (!is_error(ret)) {
                 struct dirent *de;
@@ -4193,7 +4347,8 @@
         {
             struct dirent64 *dirp;
             abi_long count = arg3;
-            dirp = lock_user(arg2, count, 0);
+            if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
+                goto efault;
             ret = get_errno(sys_getdents64(arg1, dirp, count));
             if (!is_error(ret)) {
                 struct dirent64 *de;
@@ -4205,8 +4360,8 @@
                     if (reclen > len)
                         break;
                     de->d_reclen = tswap16(reclen);
-                    tswap64s(&de->d_ino);
-                    tswap64s(&de->d_off);
+                    tswap64s((uint64_t *)&de->d_ino);
+                    tswap64s((uint64_t *)&de->d_off);
                     de = (struct dirent64 *)((char *)de + reclen);
                     len -= reclen;
                 }
@@ -4229,7 +4384,9 @@
             struct pollfd *pfd;
             unsigned int i;
 
-            target_pfd = lock_user(arg1, sizeof(struct target_pollfd) * nfds, 1);
+            target_pfd = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_pollfd) * nfds, 1);
+            if (!target_pfd)
+                goto efault;
             pfd = alloca(sizeof(struct pollfd) * nfds);
             for(i = 0; i < nfds; i++) {
                 pfd[i].fd = tswap32(target_pfd[i].fd);
@@ -4258,7 +4415,7 @@
             struct iovec *vec;
 
             vec = alloca(count * sizeof(struct iovec));
-            lock_iovec(vec, arg2, count, 0);
+            lock_iovec(VERIFY_WRITE, vec, arg2, count, 0);
             ret = get_errno(readv(arg1, vec, count));
             unlock_iovec(vec, arg2, count, 1);
         }
@@ -4269,7 +4426,7 @@
             struct iovec *vec;
 
             vec = alloca(count * sizeof(struct iovec));
-            lock_iovec(vec, arg2, count, 1);
+            lock_iovec(VERIFY_READ, vec, arg2, count, 1);
             ret = get_errno(writev(arg1, vec, count));
             unlock_iovec(vec, arg2, count, 0);
         }
@@ -4292,7 +4449,8 @@
             struct sched_param *target_schp;
             struct sched_param schp;
 
-            lock_user_struct(target_schp, arg2, 1);
+            if (!lock_user_struct(VERIFY_READ, target_schp, arg2, 1))
+                goto efault;
             schp.sched_priority = tswap32(target_schp->sched_priority);
             unlock_user_struct(target_schp, arg2, 0);
             ret = get_errno(sched_setparam(arg1, &schp));
@@ -4304,7 +4462,8 @@
             struct sched_param schp;
             ret = get_errno(sched_getparam(arg1, &schp));
             if (!is_error(ret)) {
-                lock_user_struct(target_schp, arg2, 0);
+                if (!lock_user_struct(VERIFY_WRITE, target_schp, arg2, 0))
+                    goto efault;
                 target_schp->sched_priority = tswap32(schp.sched_priority);
                 unlock_user_struct(target_schp, arg2, 1);
             }
@@ -4314,7 +4473,8 @@
         {
             struct sched_param *target_schp;
             struct sched_param schp;
-            lock_user_struct(target_schp, arg3, 1);
+            if (!lock_user_struct(VERIFY_READ, target_schp, arg3, 1))
+                goto efault;
             schp.sched_priority = tswap32(target_schp->sched_priority);
             unlock_user_struct(target_schp, arg3, 0);
             ret = get_errno(sched_setscheduler(arg1, arg2, &schp));
@@ -4378,18 +4538,21 @@
 #ifdef TARGET_NR_pread
     case TARGET_NR_pread:
         page_unprotect_range(arg2, arg3);
-        p = lock_user(arg2, arg3, 0);
+        if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
+            goto efault;
         ret = get_errno(pread(arg1, p, arg3, arg4));
         unlock_user(p, arg2, ret);
         break;
     case TARGET_NR_pwrite:
-        p = lock_user(arg2, arg3, 1);
+        if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
+            goto efault;
         ret = get_errno(pwrite(arg1, p, arg3, arg4));
         unlock_user(p, arg2, 0);
         break;
 #endif
     case TARGET_NR_getcwd:
-        p = lock_user(arg1, arg2, 0);
+        if (!(p = lock_user(VERIFY_WRITE, arg1, arg2, 0)))
+            goto efault;
         ret = get_errno(sys_getcwd1(p, arg2));
         unlock_user(p, arg1, ret);
         break;
@@ -4400,9 +4563,7 @@
     case TARGET_NR_sigaltstack:
 #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_MIPS) || \
     defined(TARGET_SPARC) || defined(TARGET_PPC) || defined(TARGET_ALPHA)
-        ret = do_sigaltstack((struct target_sigaltstack *)arg1,
-                             (struct target_sigaltstack *)arg2,
-                             get_sp_from_cpustate((CPUState *)cpu_env));
+        ret = do_sigaltstack(arg1, arg2, get_sp_from_cpustate((CPUState *)cpu_env));
         break;
 #else
         goto unimplemented;
@@ -4429,7 +4590,8 @@
 	ret = get_errno(getrlimit(arg1, &rlim));
 	if (!is_error(ret)) {
 	    struct target_rlimit *target_rlim;
-            lock_user_struct(target_rlim, arg2, 0);
+            if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
+                goto efault;
 	    target_rlim->rlim_cur = tswapl(rlim.rlim_cur);
 	    target_rlim->rlim_max = tswapl(rlim.rlim_max);
             unlock_user_struct(target_rlim, arg2, 1);
@@ -4439,7 +4601,8 @@
 #endif
 #ifdef TARGET_NR_truncate64
     case TARGET_NR_truncate64:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
 	ret = target_truncate64(cpu_env, p, arg2, arg3, arg4);
         unlock_user(p, arg1, 0);
 	break;
@@ -4451,14 +4614,16 @@
 #endif
 #ifdef TARGET_NR_stat64
     case TARGET_NR_stat64:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(stat(path(p), &st));
         unlock_user(p, arg1, 0);
         goto do_stat64;
 #endif
 #ifdef TARGET_NR_lstat64
     case TARGET_NR_lstat64:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(lstat(path(p), &st));
         unlock_user(p, arg1, 0);
         goto do_stat64;
@@ -4472,52 +4637,53 @@
 #ifdef TARGET_ARM
                 if (((CPUARMState *)cpu_env)->eabi) {
                     struct target_eabi_stat64 *target_st;
-                    lock_user_struct(target_st, arg2, 1);
+
+                    if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
+                        goto efault;
                     memset(target_st, 0, sizeof(struct target_eabi_stat64));
-                    /* put_user is probably wrong.  */
-                    put_user(st.st_dev, &target_st->st_dev);
-                    put_user(st.st_ino, &target_st->st_ino);
+                    __put_user(st.st_dev, &target_st->st_dev);
+                    __put_user(st.st_ino, &target_st->st_ino);
 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
-                    put_user(st.st_ino, &target_st->__st_ino);
+                    __put_user(st.st_ino, &target_st->__st_ino);
 #endif
-                    put_user(st.st_mode, &target_st->st_mode);
-                    put_user(st.st_nlink, &target_st->st_nlink);
-                    put_user(st.st_uid, &target_st->st_uid);
-                    put_user(st.st_gid, &target_st->st_gid);
-                    put_user(st.st_rdev, &target_st->st_rdev);
-                    /* XXX: better use of kernel struct */
-                    put_user(st.st_size, &target_st->st_size);
-                    put_user(st.st_blksize, &target_st->st_blksize);
-                    put_user(st.st_blocks, &target_st->st_blocks);
-                    put_user(st.st_atime, &target_st->target_st_atime);
-                    put_user(st.st_mtime, &target_st->target_st_mtime);
-                    put_user(st.st_ctime, &target_st->target_st_ctime);
-                    unlock_user_struct(target_st, arg2, 0);
+                    __put_user(st.st_mode, &target_st->st_mode);
+                    __put_user(st.st_nlink, &target_st->st_nlink);
+                    __put_user(st.st_uid, &target_st->st_uid);
+                    __put_user(st.st_gid, &target_st->st_gid);
+                    __put_user(st.st_rdev, &target_st->st_rdev);
+                    __put_user(st.st_size, &target_st->st_size);
+                    __put_user(st.st_blksize, &target_st->st_blksize);
+                    __put_user(st.st_blocks, &target_st->st_blocks);
+                    __put_user(st.st_atime, &target_st->target_st_atime);
+                    __put_user(st.st_mtime, &target_st->target_st_mtime);
+                    __put_user(st.st_ctime, &target_st->target_st_ctime);
+                    unlock_user_struct(target_st, arg2, 1);
                 } else
 #endif
                 {
                     struct target_stat64 *target_st;
-                    lock_user_struct(target_st, arg2, 1);
+
+                    if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
+                        goto efault;
                     memset(target_st, 0, sizeof(struct target_stat64));
-                    /* ??? put_user is probably wrong.  */
-                    put_user(st.st_dev, &target_st->st_dev);
-                    put_user(st.st_ino, &target_st->st_ino);
+                    __put_user(st.st_dev, &target_st->st_dev);
+                    __put_user(st.st_ino, &target_st->st_ino);
 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
-                    put_user(st.st_ino, &target_st->__st_ino);
+                    __put_user(st.st_ino, &target_st->__st_ino);
 #endif
-                    put_user(st.st_mode, &target_st->st_mode);
-                    put_user(st.st_nlink, &target_st->st_nlink);
-                    put_user(st.st_uid, &target_st->st_uid);
-                    put_user(st.st_gid, &target_st->st_gid);
-                    put_user(st.st_rdev, &target_st->st_rdev);
+                    __put_user(st.st_mode, &target_st->st_mode);
+                    __put_user(st.st_nlink, &target_st->st_nlink);
+                    __put_user(st.st_uid, &target_st->st_uid);
+                    __put_user(st.st_gid, &target_st->st_gid);
+                    __put_user(st.st_rdev, &target_st->st_rdev);
                     /* XXX: better use of kernel struct */
-                    put_user(st.st_size, &target_st->st_size);
-                    put_user(st.st_blksize, &target_st->st_blksize);
-                    put_user(st.st_blocks, &target_st->st_blocks);
-                    put_user(st.st_atime, &target_st->target_st_atime);
-                    put_user(st.st_mtime, &target_st->target_st_mtime);
-                    put_user(st.st_ctime, &target_st->target_st_ctime);
-                    unlock_user_struct(target_st, arg2, 0);
+                    __put_user(st.st_size, &target_st->st_size);
+                    __put_user(st.st_blksize, &target_st->st_blksize);
+                    __put_user(st.st_blocks, &target_st->st_blocks);
+                    __put_user(st.st_atime, &target_st->target_st_atime);
+                    __put_user(st.st_mtime, &target_st->target_st_mtime);
+                    __put_user(st.st_ctime, &target_st->target_st_ctime);
+                    unlock_user_struct(target_st, arg2, 1);
                 }
             }
         }
@@ -4525,7 +4691,8 @@
 #endif
 #ifdef USE_UID16
     case TARGET_NR_lchown:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3)));
         unlock_user(p, arg1, 0);
         break;
@@ -4557,7 +4724,9 @@
             grouplist = alloca(gidsetsize * sizeof(gid_t));
             ret = get_errno(getgroups(gidsetsize, grouplist));
             if (!is_error(ret)) {
-                target_grouplist = lock_user(arg2, gidsetsize * 2, 0);
+                target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 2, 0);
+                if (!target_grouplist)
+                    goto efault;
                 for(i = 0;i < gidsetsize; i++)
                     target_grouplist[i] = tswap16(grouplist[i]);
                 unlock_user(target_grouplist, arg2, gidsetsize * 2);
@@ -4572,7 +4741,11 @@
             int i;
 
             grouplist = alloca(gidsetsize * sizeof(gid_t));
-            target_grouplist = lock_user(arg2, gidsetsize * 2, 1);
+            target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 2, 1);
+            if (!target_grouplist) {
+                ret = -TARGET_EFAULT;
+                goto fail;
+            }
             for(i = 0;i < gidsetsize; i++)
                 grouplist[i] = tswap16(target_grouplist[i]);
             unlock_user(target_grouplist, arg2, 0);
@@ -4584,18 +4757,10 @@
         break;
 #if defined(TARGET_NR_fchownat) && defined(__NR_fchownat)
     case TARGET_NR_fchownat:
-        if (!arg2) {
-            ret = -TARGET_EFAULT;
-            goto fail;
-        }
-        p = lock_user_string(arg2);
-        if (!access_ok(VERIFY_READ, p, 1))
-            /* Don't "goto fail" so that cleanup can happen. */
-            ret = -TARGET_EFAULT;
-	else
-            ret = get_errno(sys_fchownat(arg1, p, low2highuid(arg3), low2highgid(arg4), arg5));
-        if (p)
-            unlock_user(p, arg2, 0);
+        if (!(p = lock_user_string(arg2))) 
+            goto efault;
+        ret = get_errno(sys_fchownat(arg1, p, low2highuid(arg3), low2highgid(arg4), arg5));
+        unlock_user(p, arg2, 0);
         break;
 #endif
 #ifdef TARGET_NR_setresuid
@@ -4639,7 +4804,8 @@
         break;
 #endif
     case TARGET_NR_chown:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3)));
         unlock_user(p, arg1, 0);
         break;
@@ -4659,7 +4825,8 @@
 
 #ifdef TARGET_NR_lchown32
     case TARGET_NR_lchown32:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(lchown(p, arg2, arg3));
         unlock_user(p, arg1, 0);
         break;
@@ -4705,7 +4872,11 @@
             grouplist = alloca(gidsetsize * sizeof(gid_t));
             ret = get_errno(getgroups(gidsetsize, grouplist));
             if (!is_error(ret)) {
-                target_grouplist = lock_user(arg2, gidsetsize * 4, 0);
+                target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 4, 0);
+                if (!target_grouplist) {
+                    ret = -TARGET_EFAULT;
+                    goto fail;
+                }
                 for(i = 0;i < gidsetsize; i++)
                     target_grouplist[i] = tswap32(grouplist[i]);
                 unlock_user(target_grouplist, arg2, gidsetsize * 4);
@@ -4722,7 +4893,11 @@
             int i;
 
             grouplist = alloca(gidsetsize * sizeof(gid_t));
-            target_grouplist = lock_user(arg2, gidsetsize * 4, 1);
+            target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 4, 1);
+            if (!target_grouplist) {
+                ret = -TARGET_EFAULT;
+                goto fail;
+            }
             for(i = 0;i < gidsetsize; i++)
                 grouplist[i] = tswap32(target_grouplist[i]);
             unlock_user(target_grouplist, arg2, 0);
@@ -4773,7 +4948,8 @@
 #endif
 #ifdef TARGET_NR_chown32
     case TARGET_NR_chown32:
-        p = lock_user_string(arg1);
+        if (!(p = lock_user_string(arg1)))
+            goto efault;
         ret = get_errno(chown(p, arg2, arg3));
         unlock_user(p, arg1, 0);
         break;
@@ -4843,7 +5019,8 @@
         case TARGET_F_GETLK64:
 #ifdef TARGET_ARM
             if (((CPUARMState *)cpu_env)->eabi) {
-                lock_user_struct(target_efl, arg3, 1);
+                if (!lock_user_struct(VERIFY_READ, target_efl, arg3, 1)) 
+                    goto efault;
                 fl.l_type = tswap16(target_efl->l_type);
                 fl.l_whence = tswap16(target_efl->l_whence);
                 fl.l_start = tswap64(target_efl->l_start);
@@ -4853,7 +5030,8 @@
             } else
 #endif
             {
-                lock_user_struct(target_fl, arg3, 1);
+                if (!lock_user_struct(VERIFY_READ, target_fl, arg3, 1)) 
+                    goto efault;
                 fl.l_type = tswap16(target_fl->l_type);
                 fl.l_whence = tswap16(target_fl->l_whence);
                 fl.l_start = tswap64(target_fl->l_start);
@@ -4865,7 +5043,8 @@
 	    if (ret == 0) {
 #ifdef TARGET_ARM
                 if (((CPUARMState *)cpu_env)->eabi) {
-                    lock_user_struct(target_efl, arg3, 0);
+                    if (!lock_user_struct(VERIFY_WRITE, target_efl, arg3, 0)) 
+                        goto efault;
                     target_efl->l_type = tswap16(fl.l_type);
                     target_efl->l_whence = tswap16(fl.l_whence);
                     target_efl->l_start = tswap64(fl.l_start);
@@ -4875,7 +5054,8 @@
                 } else
 #endif
                 {
-                    lock_user_struct(target_fl, arg3, 0);
+                    if (!lock_user_struct(VERIFY_WRITE, target_fl, arg3, 0)) 
+                        goto efault;
                     target_fl->l_type = tswap16(fl.l_type);
                     target_fl->l_whence = tswap16(fl.l_whence);
                     target_fl->l_start = tswap64(fl.l_start);
@@ -4890,7 +5070,8 @@
         case TARGET_F_SETLKW64:
 #ifdef TARGET_ARM
             if (((CPUARMState *)cpu_env)->eabi) {
-                lock_user_struct(target_efl, arg3, 1);
+                if (!lock_user_struct(VERIFY_READ, target_efl, arg3, 1)) 
+                    goto efault;
                 fl.l_type = tswap16(target_efl->l_type);
                 fl.l_whence = tswap16(target_efl->l_whence);
                 fl.l_start = tswap64(target_efl->l_start);
@@ -4900,7 +5081,8 @@
             } else
 #endif
             {
-                lock_user_struct(target_fl, arg3, 1);
+                if (!lock_user_struct(VERIFY_READ, target_fl, arg3, 1)) 
+                    goto efault;
                 fl.l_type = tswap16(target_fl->l_type);
                 fl.l_whence = tswap16(target_fl->l_whence);
                 fl.l_start = tswap64(target_fl->l_start);
@@ -4911,7 +5093,7 @@
             ret = get_errno(fcntl(arg1, cmd, &fl));
 	    break;
         default:
-            ret = get_errno(do_fcntl(arg1, cmd, arg3));
+            ret = do_fcntl(arg1, cmd, arg3);
             break;
         }
 	break;
@@ -4998,8 +5180,8 @@
 
 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
     case TARGET_NR_set_tid_address:
-      ret = get_errno(set_tid_address((int *) arg1));
-      break;
+        ret = get_errno(set_tid_address((int *)g2h(arg1)));
+        break;
 #endif
 
 #if defined(TARGET_NR_tkill) && defined(__NR_tkill)
@@ -5028,14 +5210,12 @@
             if (!arg2)
                 ret = get_errno(sys_utimensat(arg1, NULL, ts, arg4));
             else {
-                p = lock_user_string(arg2);
-                if (!access_ok(VERIFY_READ, p, 1))
-                    /* Don't "goto fail" so that cleanup can happen. */
+                if (!(p = lock_user_string(arg2))) {
                     ret = -TARGET_EFAULT;
-                else
-                    ret = get_errno(sys_utimensat(arg1, path(p), ts, arg4));
-                if (p)
-                    unlock_user(p, arg2, 0);
+                    goto fail;
+                }
+                ret = get_errno(sys_utimensat(arg1, path(p), ts, arg4));
+                unlock_user(p, arg2, 0);
             }
         }
 	break;
@@ -5050,11 +5230,14 @@
         ret = -TARGET_ENOSYS;
         break;
     }
- fail:
+fail:
 #ifdef DEBUG
     gemu_log(" = %ld\n", ret);
 #endif
     if(do_strace)
         print_syscall_ret(num, ret);
     return ret;
+efault:
+    ret = -TARGET_EFAULT;
+    goto fail;
 }

Modified: trunk/src/host/qemu-neo1973/linux-user/syscall_defs.h
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/syscall_defs.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/syscall_defs.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -164,9 +164,6 @@
 
 #define TARGET_CMSG_DATA(cmsg) ((unsigned char *) ((struct target_cmsghdr *) (cmsg) + 1))
 #define TARGET_CMSG_NXTHDR(mhdr, cmsg) __target_cmsg_nxthdr (mhdr, cmsg)
-#define TARGET_CMSG_FIRSTHDR(mhdr) \
-  ((size_t) tswapl((mhdr)->msg_controllen) >= sizeof (struct target_cmsghdr) \
-   ? (struct target_cmsghdr *) tswapl((mhdr)->msg_control) : (struct target_cmsghdr *) NULL)
 #define TARGET_CMSG_ALIGN(len) (((len) + sizeof (abi_long) - 1) \
                                & (size_t) ~(sizeof (abi_long) - 1))
 #define TARGET_CMSG_SPACE(len) (TARGET_CMSG_ALIGN (len) \

Added: trunk/src/host/qemu-neo1973/linux-user/uaccess.c
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/uaccess.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/uaccess.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,51 @@
+/* User memory access */
+#include <stdio.h>
+#include <string.h>
+
+#include "qemu.h"
+
+/* copy_from_user() and copy_to_user() are usually used to copy data
+ * buffers between the target and host.  These internally perform
+ * locking/unlocking of the memory.
+ */
+abi_long copy_from_user(void *hptr, abi_ulong gaddr, size_t len)
+{
+    abi_long ret = 0;
+    void *ghptr;
+
+    if ((ghptr = lock_user(VERIFY_READ, gaddr, len, 1))) {
+        memcpy(hptr, ghptr, len);
+        unlock_user(ghptr, gaddr, 0);
+    } else
+        ret = -TARGET_EFAULT;
+
+    return ret;
+}
+
+
+abi_long copy_to_user(abi_ulong gaddr, void *hptr, size_t len)
+{
+    abi_long ret = 0;
+    void *ghptr;
+
+    if ((ghptr = lock_user(VERIFY_WRITE, gaddr, len, 0))) {
+        memcpy(ghptr, hptr, len);
+	unlock_user(ghptr, gaddr, len);
+    } else
+        ret = -TARGET_EFAULT;
+
+    return ret;
+}
+
+
+/* Return the length of a string in target memory.  */
+/* FIXME - this doesn't check access_ok() - it's rather complicated to
+ * do it correctly because we need to check the bytes in a page and then
+ * skip to the next page and check the bytes there until we find the
+ * terminator.  There should be a general function to do this that
+ * can look for any byte terminator in a buffer - not strlen().
+ */
+abi_long target_strlen(abi_ulong gaddr)
+{
+    return strlen(g2h(gaddr));
+}

Modified: trunk/src/host/qemu-neo1973/linux-user/vm86.c
===================================================================
--- trunk/src/host/qemu-neo1973/linux-user/vm86.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/linux-user/vm86.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -39,22 +39,27 @@
     return (((uint8_t *)bitmap)[nr >> 3] >> (nr & 7)) & 1;
 }
 
-static inline void vm_putw(uint8_t *segptr, unsigned int reg16, unsigned int val)
+static inline void vm_putw(uint32_t segptr, unsigned int reg16, unsigned int val)
 {
     stw(segptr + (reg16 & 0xffff), val);
 }
 
-static inline void vm_putl(uint8_t *segptr, unsigned int reg16, unsigned int val)
+static inline void vm_putl(uint32_t segptr, unsigned int reg16, unsigned int val)
 {
     stl(segptr + (reg16 & 0xffff), val);
 }
 
-static inline unsigned int vm_getw(uint8_t *segptr, unsigned int reg16)
+static inline unsigned int vm_getb(uint32_t segptr, unsigned int reg16)
 {
+    return ldub(segptr + (reg16 & 0xffff));
+}
+
+static inline unsigned int vm_getw(uint32_t segptr, unsigned int reg16)
+{
     return lduw(segptr + (reg16 & 0xffff));
 }
 
-static inline unsigned int vm_getl(uint8_t *segptr, unsigned int reg16)
+static inline unsigned int vm_getl(uint32_t segptr, unsigned int reg16)
 {
     return ldl(segptr + (reg16 & 0xffff));
 }
@@ -64,7 +69,9 @@
     TaskState *ts = env->opaque;
     struct target_vm86plus_struct * target_v86;
 
-    lock_user_struct(target_v86, ts->target_v86, 0);
+    if (!lock_user_struct(VERIFY_WRITE, target_v86, ts->target_v86, 0))
+        /* FIXME - should return an error */
+        return;
     /* put the VM86 registers in the userspace register structure */
     target_v86->regs.eax = tswap32(env->regs[R_EAX]);
     target_v86->regs.ebx = tswap32(env->regs[R_EBX]);
@@ -194,8 +201,7 @@
 static void do_int(CPUX86State *env, int intno)
 {
     TaskState *ts = env->opaque;
-    uint32_t *int_ptr, segoffs;
-    uint8_t *ssp;
+    uint32_t int_addr, segoffs, ssp;
     unsigned int sp;
 
     if (env->segs[R_CS].selector == TARGET_BIOSSEG)
@@ -205,8 +211,8 @@
     if (intno == 0x21 && is_revectored((env->regs[R_EAX] >> 8) & 0xff,
                                        &ts->vm86plus.int21_revectored))
         goto cannot_handle;
-    int_ptr = (uint32_t *)(intno << 2);
-    segoffs = tswap32(*int_ptr);
+    int_addr = (intno << 2);
+    segoffs = ldl(int_addr);
     if ((segoffs >> 16) == TARGET_BIOSSEG)
         goto cannot_handle;
 #if defined(DEBUG_VM86)
@@ -214,7 +220,7 @@
             intno, segoffs >> 16, segoffs & 0xffff);
 #endif
     /* save old state */
-    ssp = (uint8_t *)(env->segs[R_SS].selector << 4);
+    ssp = env->segs[R_SS].selector << 4;
     sp = env->regs[R_ESP] & 0xffff;
     vm_putw(ssp, sp - 2, get_vflags(env));
     vm_putw(ssp, sp - 4, env->segs[R_CS].selector);
@@ -257,26 +263,25 @@
 void handle_vm86_fault(CPUX86State *env)
 {
     TaskState *ts = env->opaque;
-    uint8_t *csp, *pc, *ssp;
+    uint32_t csp, ssp;
     unsigned int ip, sp, newflags, newip, newcs, opcode, intno;
     int data32, pref_done;
 
-    csp = (uint8_t *)(env->segs[R_CS].selector << 4);
+    csp = env->segs[R_CS].selector << 4;
     ip = env->eip & 0xffff;
-    pc = csp + ip;
 
-    ssp = (uint8_t *)(env->segs[R_SS].selector << 4);
+    ssp = env->segs[R_SS].selector << 4;
     sp = env->regs[R_ESP] & 0xffff;
 
 #if defined(DEBUG_VM86)
-    fprintf(logfile, "VM86 exception %04x:%08x %02x %02x\n",
-            env->segs[R_CS].selector, env->eip, pc[0], pc[1]);
+    fprintf(logfile, "VM86 exception %04x:%08x\n",
+            env->segs[R_CS].selector, env->eip);
 #endif
 
     data32 = 0;
     pref_done = 0;
     do {
-        opcode = csp[ip];
+        opcode = vm_getb(csp, ip);
         ADD16(ip, 1);
         switch (opcode) {
         case 0x66:      /* 32-bit data */     data32=1; break;
@@ -326,7 +331,7 @@
         VM86_FAULT_RETURN;
 
     case 0xcd: /* int */
-        intno = csp[ip];
+        intno = vm_getb(csp, ip);
         ADD16(ip, 1);
         env->eip = ip;
         if (ts->vm86plus.vm86plus.flags & TARGET_vm86dbg_active) {
@@ -393,7 +398,7 @@
     case TARGET_VM86_GET_IRQ_BITS:
     case TARGET_VM86_GET_AND_RESET_IRQ:
         gemu_log("qemu: unsupported vm86 subfunction (%ld)\n", subfunction);
-        ret = -EINVAL;
+        ret = -TARGET_EINVAL;
         goto out;
     case TARGET_VM86_PLUS_INSTALL_CHECK:
         /* NOTE: on old vm86 stuff this will return the error
@@ -424,7 +429,8 @@
     ts->vm86_saved_regs.gs = env->segs[R_GS].selector;
 
     ts->target_v86 = vm86_addr;
-    lock_user_struct(target_v86, vm86_addr, 1);
+    if (!lock_user_struct(VERIFY_READ, target_v86, vm86_addr, 1))
+        return -TARGET_EFAULT;
     /* build vm86 CPU state */
     ts->v86flags = tswap32(target_v86->regs.eflags);
     env->eflags = (env->eflags & ~SAFE_MASK) |

Modified: trunk/src/host/qemu-neo1973/m68k-semi.c
===================================================================
--- trunk/src/host/qemu-neo1973/m68k-semi.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/m68k-semi.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -107,7 +107,9 @@
 {
     struct m68k_gdb_stat *p;
 
-    p = lock_user(addr, sizeof(struct m68k_gdb_stat), 0);
+    if (!(p = lock_user(VERIFY_WRITE, addr, sizeof(struct m68k_gdb_stat), 0)))
+        /* FIXME - should this return an error code? */
+        return;
     p->gdb_st_dev = cpu_to_be32(s->st_dev);
     p->gdb_st_ino = cpu_to_be32(s->st_ino);
     p->gdb_st_mode = cpu_to_be32(s->st_mode);
@@ -168,9 +170,13 @@
                            ARG(2), ARG(3));
             return;
         } else {
-            p = lock_user_string(ARG(0));
-            result = open(p, translate_openflags(ARG(2)), ARG(3));
-            unlock_user(p, ARG(0), 0);
+            if (!(p = lock_user_string(ARG(0)))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = open(p, translate_openflags(ARG(2)), ARG(3));
+                unlock_user(p, ARG(0), 0);
+            }
         }
         break;
     case HOSTED_CLOSE:
@@ -196,9 +202,13 @@
                            ARG(0), ARG(1), len);
             return;
         } else {
-            p = lock_user(ARG(1), len, 0);
-            result = read(ARG(0), p, len);
-            unlock_user(p, ARG(1), len);
+            if (!(p = lock_user(VERIFY_WRITE, ARG(1), len, 0))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = read(ARG(0), p, len);
+                unlock_user(p, ARG(1), len);
+            }
         }
         break;
     case HOSTED_WRITE:
@@ -208,9 +218,13 @@
                            ARG(0), ARG(1), len);
             return;
         } else {
-            p = lock_user(ARG(1), len, 1);
-            result = write(ARG(0), p, len);
-            unlock_user(p, ARG(0), 0);
+            if (!(p = lock_user(VERIFY_READ, ARG(1), len, 1))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = write(ARG(0), p, len);
+                unlock_user(p, ARG(0), 0);
+            }
         }
         break;
     case HOSTED_LSEEK:
@@ -237,7 +251,12 @@
         } else {
             p = lock_user_string(ARG(0));
             q = lock_user_string(ARG(2));
-            result = rename(p, q);
+            if (!p || !q) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = rename(p, q);
+            }
             unlock_user(p, ARG(0), 0);
             unlock_user(q, ARG(2), 0);
         }
@@ -248,9 +267,13 @@
                            ARG(0), (int)ARG(1));
             return;
         } else {
-            p = lock_user_string(ARG(0));
-            result = unlink(p);
-            unlock_user(p, ARG(0), 0);
+            if (!(p = lock_user_string(ARG(0)))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = unlink(p);
+                unlock_user(p, ARG(0), 0);
+            }
         }
         break;
     case HOSTED_STAT:
@@ -260,9 +283,13 @@
             return;
         } else {
             struct stat s;
-            p = lock_user_string(ARG(0));
-            result = stat(p, &s);
-            unlock_user(p, ARG(0), 0);
+            if (!(p = lock_user_string(ARG(0)))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = stat(p, &s);
+                unlock_user(p, ARG(0), 0);
+            }
             if (result == 0) {
                 translate_stat(env, ARG(2), &s);
             }
@@ -291,10 +318,15 @@
             struct gdb_timeval *p;
             result = qemu_gettimeofday(&tv);
             if (result != 0) {
-                p = lock_user(ARG(0), sizeof(struct gdb_timeval), 0);
-                p->tv_sec = cpu_to_be32(tv.tv_sec);
-                p->tv_usec = cpu_to_be64(tv.tv_usec);
-                unlock_user(p, ARG(0), sizeof(struct gdb_timeval));
+                if (!(p = lock_user(VERIFY_WRITE,
+                                    ARG(0), sizeof(struct gdb_timeval), 0))) {
+                    /* FIXME - check error code? */
+                    result = -1;
+                } else {
+                    p->tv_sec = cpu_to_be32(tv.tv_sec);
+                    p->tv_usec = cpu_to_be64(tv.tv_usec);
+                    unlock_user(p, ARG(0), sizeof(struct gdb_timeval));
+                }
             }
         }
         break;
@@ -312,9 +344,13 @@
                            ARG(0), (int)ARG(1));
             return;
         } else {
-            p = lock_user_string(ARG(0));
-            result = system(p);
-            unlock_user(p, ARG(0), 0);
+            if (!(p = lock_user_string(ARG(0)))) {
+                /* FIXME - check error code? */
+                result = -1;
+            } else {
+                result = system(p);
+                unlock_user(p, ARG(0), 0);
+            }
         }
         break;
     case HOSTED_INIT_SIM:

Added: trunk/src/host/qemu-neo1973/qemu-common.h
===================================================================
--- trunk/src/host/qemu-neo1973/qemu-common.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/qemu-common.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,83 @@
+/* Common header file that is included by all of qemu.  */
+#ifndef QEMU_COMMON_H
+#define QEMU_COMMON_H
+
+/* we put basic includes here to avoid repeating them in device drivers */
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <string.h>
+#include <inttypes.h>
+#include <limits.h>
+#include <time.h>
+#include <ctype.h>
+#include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+#ifndef O_LARGEFILE
+#define O_LARGEFILE 0
+#endif
+#ifndef O_BINARY
+#define O_BINARY 0
+#endif
+
+#ifndef ENOMEDIUM
+#define ENOMEDIUM ENODEV
+#endif
+
+#ifdef _WIN32
+#include <windows.h>
+#define fsync _commit
+#define lseek _lseeki64
+#define ENOTSUP 4096
+extern int qemu_ftruncate64(int, int64_t);
+#define ftruncate qemu_ftruncate64
+
+
+static inline char *realpath(const char *path, char *resolved_path)
+{
+    _fullpath(resolved_path, path, _MAX_PATH);
+    return resolved_path;
+}
+
+#define PRId64 "I64d"
+#define PRIx64 "I64x"
+#define PRIu64 "I64u"
+#define PRIo64 "I64o"
+#endif
+
+/* FIXME: Remove NEED_CPU_H.  */
+#ifndef NEED_CPU_H
+
+#include "config-host.h"
+#include <setjmp.h>
+#include "osdep.h"
+#include "bswap.h"
+
+#else
+
+#include "cpu.h"
+
+#endif /* !defined(NEED_CPU_H) */
+
+/* bottom halves */
+typedef struct QEMUBH QEMUBH;
+
+typedef void QEMUBHFunc(void *opaque);
+
+QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque);
+void qemu_bh_schedule(QEMUBH *bh);
+void qemu_bh_cancel(QEMUBH *bh);
+void qemu_bh_delete(QEMUBH *bh);
+int qemu_bh_poll(void);
+
+/* cutils.c */
+void pstrcpy(char *buf, int buf_size, const char *str);
+char *pstrcat(char *buf, int buf_size, const char *s);
+int strstart(const char *str, const char *val, const char **ptr);
+int stristart(const char *str, const char *val, const char **ptr);
+time_t mktimegm(struct tm *tm);
+
+#endif

Modified: trunk/src/host/qemu-neo1973/qemu-doc.texi
===================================================================
--- trunk/src/host/qemu-neo1973/qemu-doc.texi	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/qemu-doc.texi	2007-11-13 16:27:39 UTC (rev 3406)
@@ -77,10 +77,12 @@
 @item Sun4m (32-bit Sparc processor)
 @item Sun4u (64-bit Sparc processor, in progress)
 @item Malta board (32-bit MIPS processor)
- at item ARM Integrator/CP (ARM926E, 1026E or 946E processor)
- at item ARM Versatile baseboard (ARM926E)
- at item ARM RealView Emulation baseboard (ARM926EJ-S)
+ at item ARM Integrator/CP (ARM)
+ at item ARM Versatile baseboard (ARM)
+ at item ARM RealView Emulation baseboard (ARM)
 @item Spitz, Akita, Borzoi and Terrier PDAs (PXA270 processor)
+ at item Luminary Micro LM3S811EVB (ARM Cortex-M3)
+ at item Luminary Micro LM3S6965EVB (ARM Cortex-M3)
 @item Freescale MCF5208EVB (ColdFire V2).
 @item Arnewsh MCF5206 evaluation board (ColdFire V2).
 @item Palm Tungsten|E PDA (OMAP310 processor)
@@ -1947,10 +1949,10 @@
 @node Sparc32 System emulator
 @section Sparc32 System emulator
 
-Use the executable @file{qemu-system-sparc} to simulate a SparcStation 5
-or SparcStation 10 (sun4m architecture). The emulation is somewhat complete.
-SMP up to 16 CPUs is supported, but Linux limits the number of usable CPUs
-to 4.
+Use the executable @file{qemu-system-sparc} to simulate a SPARCstation
+5, SPARCstation 10, or SPARCserver 600MP (sun4m architecture). The
+emulation is somewhat complete.  SMP up to 16 CPUs is supported, but
+Linux limits the number of usable CPUs to 4.
 
 QEMU emulates the following sun4m peripherals:
 
@@ -1969,13 +1971,14 @@
 @item
 ESP SCSI controller with hard disk and CD-ROM support
 @item
-Floppy drive
+Floppy drive (not on SS-600MP)
 @item
 CS4231 sound device (only on SS-5, not working yet)
 @end itemize
 
-The number of peripherals is fixed in the architecture.  Maximum memory size
-depends on the machine type, for SS-5 it is 256MB and for SS-10 2047MB.
+The number of peripherals is fixed in the architecture.  Maximum
+memory size depends on the machine type, for SS-5 it is 256MB and for
+SS-10 and SS-600MP 2047MB.
 
 Since version 0.8.2, QEMU uses OpenBIOS
 @url{http://www.openbios.org/}. OpenBIOS is a free (GPL v2) portable
@@ -2117,7 +2120,7 @@
 
 @itemize @minus
 @item
-ARM926E, ARM1026E or ARM946E CPU
+ARM926E, ARM1026E, ARM946E, ARM1136 or Cortex-A8 CPU
 @item
 Two PL011 UARTs
 @item
@@ -2134,7 +2137,7 @@
 
 @itemize @minus
 @item
-ARM926E CPU
+ARM926E, ARM1136 or Cortex-A8 CPU
 @item
 PL190 Vectored Interrupt Controller
 @item
@@ -2163,7 +2166,7 @@
 
 @itemize @minus
 @item
-ARM926E CPU
+ARM926E, ARM1136, ARM11MPCORE(x4) or Cortex-A8 CPU
 @item
 ARM AMBA Generic/Distributed Interrupt Controller
 @item
@@ -2237,6 +2240,34 @@
 Three on-chip UARTs
 @end itemize
 
+The Luminary Micro Stellaris LM3S811EVB emulation includes the following
+devices:
+
+ at itemize @minus
+ at item
+Cortex-M3 CPU core.
+ at item
+64k Flash and 8k SRAM.
+ at item
+Timers, UARTs, ADC and I at math{^2}C interface.
+ at item
+OSRAM Pictiva 96x16 OLED with SSD0303 controller on I at math{^2}C bus.
+ at end itemize
+
+The Luminary Micro Stellaris LM3S6965EVB emulation includes the following
+devices:
+
+ at itemize @minus
+ at item
+Cortex-M3 CPU core.
+ at item
+256k Flash and 64k SRAM.
+ at item
+Timers, UARTs, ADC, I at math{^2}C and SSI interfaces.
+ at item
+OSRAM Pictiva 128x64 OLED with SSD0323 controller connected via SSI.
+ at end itemize
+
 A Linux 2.6 test image is available on the QEMU web site. More
 information is available in the QEMU mailing-list archive.
 

Modified: trunk/src/host/qemu-neo1973/qemu-img.c
===================================================================
--- trunk/src/host/qemu-neo1973/qemu-img.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/qemu-img.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "vl.h"
+#include "qemu-common.h"
 #include "block_int.h"
 #include <assert.h>
 
@@ -64,23 +64,10 @@
     return ptr;
 }
 
-void term_printf(const char *fmt, ...)
+static void __attribute__((noreturn)) error(const char *fmt, ...)
 {
     va_list ap;
     va_start(ap, fmt);
-    vprintf(fmt, ap);
-    va_end(ap);
-}
-
-void term_print_filename(const char *filename)
-{
-    term_printf(filename);
-}
-
-void __attribute__((noreturn)) error(const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
     fprintf(stderr, "qemu-img: ");
     vfprintf(stderr, fmt, ap);
     fprintf(stderr, "\n");
@@ -93,7 +80,7 @@
     printf(" %s", name);
 }
 
-void help(void)
+static void help(void)
 {
     printf("qemu-img version " QEMU_VERSION ", Copyright (c) 2004-2007 Fabrice Bellard\n"
            "usage: qemu-img command [command options]\n"
@@ -175,7 +162,7 @@
     atexit(term_exit);
 }
 
-int read_password(char *buf, int buf_size)
+static int read_password(char *buf, int buf_size)
 {
     uint8_t ch;
     int i, ret;

Modified: trunk/src/host/qemu-neo1973/slirp/misc.c
===================================================================
--- trunk/src/host/qemu-neo1973/slirp/misc.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/slirp/misc.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -327,6 +327,8 @@
 			lprint("Error: openpty failed: %s\n", strerror(errno));
 			return 0;
 		}
+#else
+                return 0;
 #endif
 	} else {
 		addr.sin_family = AF_INET;

Modified: trunk/src/host/qemu-neo1973/softmmu-semi.h
===================================================================
--- trunk/src/host/qemu-neo1973/softmmu-semi.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/softmmu-semi.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -41,7 +41,7 @@
         cpu_memory_rw_debug(env, addr, p, len, 0);
     return p;
 }
-#define lock_user(p, len, copy) softmmu_lock_user(env, p, len, copy)
+#define lock_user(type, p, len, copy) softmmu_lock_user(env, p, len, copy)
 static char *softmmu_lock_user_string(CPUState *env, uint32_t addr)
 {
     char *p;

Modified: trunk/src/host/qemu-neo1973/target-alpha/cpu.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-alpha/cpu.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-alpha/cpu.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -396,7 +396,7 @@
     IR_ZERO = 31,
 };
 
-CPUAlphaState * cpu_alpha_init (void);
+CPUAlphaState * cpu_alpha_init (const char *cpu_model);
 int cpu_alpha_exec(CPUAlphaState *s);
 /* you can call this signal handler from your SIGBUS and SIGSEGV
    signal handlers to inform the virtual CPU of exceptions. non zero

Modified: trunk/src/host/qemu-neo1973/target-alpha/op_helper.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-alpha/op_helper.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-alpha/op_helper.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1152,7 +1152,7 @@
 {
     TranslationBlock *tb;
     CPUState *saved_env;
-    target_phys_addr_t pc;
+    unsigned long pc;
     int ret;
 
     /* XXX: hack to restore env in all cases, even if not called from
@@ -1163,7 +1163,7 @@
     if (!likely(ret == 0)) {
         if (likely(retaddr)) {
             /* now we have a real cpu fault */
-            pc = (target_phys_addr_t)retaddr;
+            pc = (unsigned long)retaddr;
             tb = tb_find_pc(pc);
             if (likely(tb)) {
                 /* the PC is inside the translated code. It means that we have

Modified: trunk/src/host/qemu-neo1973/target-alpha/op_mem.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-alpha/op_mem.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-alpha/op_mem.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -18,7 +18,7 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
-#define DEBUG_MEM_ACCESSES
+//#define DEBUG_MEM_ACCESSES
 #if defined (DEBUG_MEM_ACCESSES)
 void helper_print_mem_EA (target_ulong EA);
 #define print_mem_EA(EA) do { helper_print_mem_EA(EA); } while (0)

Modified: trunk/src/host/qemu-neo1973/target-alpha/translate.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-alpha/translate.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-alpha/translate.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -2095,7 +2095,7 @@
     return gen_intermediate_code_internal(env, tb, 1);
 }
 
-CPUAlphaState * cpu_alpha_init (void)
+CPUAlphaState * cpu_alpha_init (const char *cpu_model)
 {
     CPUAlphaState *env;
     uint64_t hwpcb;
@@ -2133,3 +2133,4 @@
 
     return env;
 }
+

Modified: trunk/src/host/qemu-neo1973/target-arm/cpu.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-arm/cpu.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-arm/cpu.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -37,7 +37,19 @@
 #define EXCP_IRQ             5
 #define EXCP_FIQ             6
 #define EXCP_BKPT            7
+#define EXCP_EXCEPTION_EXIT  8   /* Return from v7M exception.  */
 
+#define ARMV7M_EXCP_RESET   1
+#define ARMV7M_EXCP_NMI     2
+#define ARMV7M_EXCP_HARD    3
+#define ARMV7M_EXCP_MEM     4
+#define ARMV7M_EXCP_BUS     5
+#define ARMV7M_EXCP_USAGE   6
+#define ARMV7M_EXCP_SVC     11
+#define ARMV7M_EXCP_DEBUG   12
+#define ARMV7M_EXCP_PENDSV  14
+#define ARMV7M_EXCP_SYSTICK 15
+
 typedef void ARMWriteCPFunc(void *opaque, int cp_info,
                             int srcreg, int operand, uint32_t value);
 typedef uint32_t ARMReadCPFunc(void *opaque, int cp_info,
@@ -76,17 +88,22 @@
     uint32_t VF; /* V is the bit 31. All other bits are undefined */
     uint32_t NZF; /* N is bit 31. Z is computed from NZF */
     uint32_t QF; /* 0 or 1 */
+    uint32_t GE; /* cpsr[19:16] */
+    int thumb; /* cprs[5]. 0 = arm mode, 1 = thumb mode. */
+    uint32_t condexec_bits; /* IT bits.  cpsr[15:10,26:25].  */
 
-    int thumb; /* 0 = arm mode, 1 = thumb mode */
-
     /* System control coprocessor (cp15) */
     struct {
         uint32_t c0_cpuid;
         uint32_t c0_cachetype;
+        uint32_t c0_c1[8]; /* Feature registers.  */
+        uint32_t c0_c2[8]; /* Instruction set registers.  */
         uint32_t c1_sys; /* System control register.  */
         uint32_t c1_coproc; /* Coprocessor access register.  */
         uint32_t c1_xscaleauxcr; /* XScale auxiliary control register.  */
-        uint32_t c2_base; /* MMU translation table base.  */
+        uint32_t c2_base0; /* MMU translation table base 0.  */
+        uint32_t c2_base1; /* MMU translation table base 1.  */
+        uint32_t c2_mask; /* MMU translation table base mask.  */
         uint32_t c2_data; /* MPU data cachable bits.  */
         uint32_t c2_insn; /* MPU instruction cachable bits.  */
         uint32_t c3; /* MMU domain access control register
@@ -100,6 +117,9 @@
         uint32_t c9_data;
         uint32_t c13_fcse; /* FCSE PID.  */
         uint32_t c13_context; /* Context ID.  */
+        uint32_t c13_tls1; /* User RW Thread register.  */
+        uint32_t c13_tls2; /* User RO Thread register.  */
+        uint32_t c13_tls3; /* Privileged Thread register.  */
         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
         uint32_t c15_i_max; /* Maximum D-cache dirty line index.  */
@@ -107,6 +127,17 @@
         uint32_t c15_threadid; /* TI debugger thread-ID.  */
     } cp15;
 
+    struct {
+        uint32_t other_sp;
+        uint32_t vecbase;
+        uint32_t basepri;
+        uint32_t control;
+        int current_sp;
+        int exception;
+        int pending_exception;
+        void *nvic;
+    } v7m;
+
     /* Coprocessor IO used by peripherals */
     struct {
         ARMReadCPFunc *cp_read;
@@ -117,6 +148,10 @@
     /* Internal CPU feature flags.  */
     uint32_t features;
 
+    /* Callback for vectored interrupt controller.  */
+    int (*get_irq_vector)(struct CPUARMState *);
+    void *irq_opaque;
+
     /* exception/interrupt handling */
     jmp_buf jmp_env;
     int exception_index;
@@ -126,7 +161,7 @@
 
     /* VFP coprocessor state.  */
     struct {
-        float64 regs[16];
+        float64 regs[32];
 
         uint32_t xregs[16];
         /* We store these fpcsr fields separately for convenience.  */
@@ -136,9 +171,16 @@
         /* Temporary variables if we don't have spare fp regs.  */
         float32 tmp0s, tmp1s;
         float64 tmp0d, tmp1d;
+        /* scratch space when Tn are not sufficient.  */
+        uint32_t scratch[8];
 
         float_status fp_status;
     } vfp;
+#if defined(CONFIG_USER_ONLY)
+    struct mmon_state *mmon_entry;
+#else
+    uint32_t mmon_addr;
+#endif
 
     /* iwMMXt coprocessor state.  */
     struct {
@@ -164,11 +206,12 @@
     target_phys_addr_t loader_start;
 } CPUARMState;
 
-CPUARMState *cpu_arm_init(void);
+CPUARMState *cpu_arm_init(const char *cpu_model);
 int cpu_arm_exec(CPUARMState *s);
 void cpu_arm_close(CPUARMState *s);
 void do_interrupt(CPUARMState *);
 void switch_mode(CPUARMState *, int);
+uint32_t do_arm_semihosting(CPUARMState *env);
 
 /* you can call this signal handler from your SIGBUS and SIGSEGV
    signal handlers to inform the virtual CPU of exceptions. non zero
@@ -176,6 +219,9 @@
 int cpu_arm_signal_handler(int host_signum, void *pinfo,
                            void *puc);
 
+void cpu_lock(void);
+void cpu_unlock(void);
+
 #define CPSR_M (0x1f)
 #define CPSR_T (1 << 5)
 #define CPSR_F (1 << 6)
@@ -183,25 +229,43 @@
 #define CPSR_A (1 << 8)
 #define CPSR_E (1 << 9)
 #define CPSR_IT_2_7 (0xfc00)
-/* Bits 20-23 reserved.  */
+#define CPSR_GE (0xf << 16)
+#define CPSR_RESERVED (0xf << 20)
 #define CPSR_J (1 << 24)
 #define CPSR_IT_0_1 (3 << 25)
 #define CPSR_Q (1 << 27)
-#define CPSR_NZCV (0xf << 28)
+#define CPSR_V (1 << 28)
+#define CPSR_C (1 << 29)
+#define CPSR_Z (1 << 30)
+#define CPSR_N (1 << 31)
+#define CPSR_NZCV (CPSR_N | CPSR_Z | CPSR_C | CPSR_V)
 
-#define CACHED_CPSR_BITS (CPSR_T | CPSR_Q | CPSR_NZCV)
+#define CPSR_IT (CPSR_IT_0_1 | CPSR_IT_2_7)
+#define CACHED_CPSR_BITS (CPSR_T | CPSR_GE | CPSR_IT | CPSR_Q | CPSR_NZCV)
+/* Bits writable in user mode.  */
+#define CPSR_USER (CPSR_NZCV | CPSR_Q | CPSR_GE)
+/* Execution state bits.  MRS read as zero, MSR writes ignored.  */
+#define CPSR_EXEC (CPSR_T | CPSR_IT | CPSR_J)
+
 /* Return the current CPSR value.  */
-static inline uint32_t cpsr_read(CPUARMState *env)
+uint32_t cpsr_read(CPUARMState *env);
+/* Set the CPSR.  Note that some bits of mask must be all-set or all-clear.  */
+void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask);
+
+/* Return the current xPSR value.  */
+static inline uint32_t xpsr_read(CPUARMState *env)
 {
     int ZF;
     ZF = (env->NZF == 0);
-    return env->uncached_cpsr | (env->NZF & 0x80000000) | (ZF << 30) |
-        (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
-        | (env->thumb << 5);
+    return (env->NZF & 0x80000000) | (ZF << 30)
+        | (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
+        | (env->thumb << 24) | ((env->condexec_bits & 3) << 25)
+        | ((env->condexec_bits & 0xfc) << 8)
+        | env->v7m.exception;
 }
 
-/* Set the CPSR.  Note that some bits of mask must be all-set or all-clear.  */
-static inline void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+/* Set the xPSR.  Note that some bits of mask must be all-set or all-clear.  */
+static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 {
     /* NOTE: N = 1 and Z = 1 cannot be stored currently */
     if (mask & CPSR_NZCV) {
@@ -211,14 +275,19 @@
     }
     if (mask & CPSR_Q)
         env->QF = ((val & CPSR_Q) != 0);
-    if (mask & CPSR_T)
-        env->thumb = ((val & CPSR_T) != 0);
-
-    if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
-        switch_mode(env, val & CPSR_M);
+    if (mask & (1 << 24))
+        env->thumb = ((val & (1 << 24)) != 0);
+    if (mask & CPSR_IT_0_1) {
+        env->condexec_bits &= ~3;
+        env->condexec_bits |= (val >> 25) & 3;
     }
-    mask &= ~CACHED_CPSR_BITS;
-    env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
+    if (mask & CPSR_IT_2_7) {
+        env->condexec_bits &= 3;
+        env->condexec_bits |= (val >> 8) & 0xfc;
+    }
+    if (mask & 0x1ff) {
+        env->v7m.exception = val & 0x1ff;
+    }
 }
 
 enum arm_cpu_mode {
@@ -234,6 +303,8 @@
 /* VFP system registers.  */
 #define ARM_VFP_FPSID   0
 #define ARM_VFP_FPSCR   1
+#define ARM_VFP_MVFR1   6
+#define ARM_VFP_MVFR0   7
 #define ARM_VFP_FPEXC   8
 #define ARM_VFP_FPINST  9
 #define ARM_VFP_FPINST2 10
@@ -254,7 +325,15 @@
     ARM_FEATURE_XSCALE, /* Intel XScale extensions.  */
     ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension.  */
     ARM_FEATURE_S3C,    /* S3C specific bits.  TODO: replace with id==ARM920 */
+    ARM_FEATURE_V6,
+    ARM_FEATURE_V6K,
+    ARM_FEATURE_V7,
+    ARM_FEATURE_THUMB2,
     ARM_FEATURE_MPU,    /* Only has Memory Protection Unit, not full MMU.  */
+    ARM_FEATURE_VFP3,
+    ARM_FEATURE_NEON,
+    ARM_FEATURE_DIV,
+    ARM_FEATURE_M, /* Microcontroller profile.  */
     ARM_FEATURE_OMAPCP  /* OMAP specific CP15 ops handling.  */
 };
 
@@ -264,31 +343,47 @@
 }
 
 void arm_cpu_list(FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...));
-void cpu_arm_set_model(CPUARMState *env, const char *name);
 
+/* Interface between CPU and Interrupt controller.  */
+void armv7m_nvic_set_pending(void *opaque, int irq);
+int armv7m_nvic_acknowledge_irq(void *opaque);
+void armv7m_nvic_complete_irq(void *opaque, int irq);
+
 void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
                        ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
                        void *opaque);
 
-#define ARM_CPUID_ARM1026   0x4106a262
-#define ARM_CPUID_ARM926    0x41069265
-#define ARM_CPUID_ARM946    0x41059461
-#define ARM_CPUID_ARM920T   0x41129200
-#define ARM_CPUID_TI915T    0x54029152
-#define ARM_CPUID_TI925T    0x54029252
-#define ARM_CPUID_PXA250    0x69052100
-#define ARM_CPUID_PXA255    0x69052d00
-#define ARM_CPUID_PXA260    0x69052903
-#define ARM_CPUID_PXA261    0x69052d05
-#define ARM_CPUID_PXA262    0x69052d06
-#define ARM_CPUID_PXA270    0x69054110
-#define ARM_CPUID_PXA270_A0 0x69054110
-#define ARM_CPUID_PXA270_A1 0x69054111
-#define ARM_CPUID_PXA270_B0 0x69054112
-#define ARM_CPUID_PXA270_B1 0x69054113
-#define ARM_CPUID_PXA270_C0 0x69054114
-#define ARM_CPUID_PXA270_C5 0x69054117
+/* Does the core conform to the the "MicroController" profile. e.g. Cortex-M3.
+   Note the M in older cores (eg. ARM7TDMI) stands for Multiply. These are
+   conventional cores (ie. Application or Realtime profile).  */
 
+#define IS_M(env) arm_feature(env, ARM_FEATURE_M)
+#define ARM_CPUID(env) (env->cp15.c0_cpuid)
+
+#define ARM_CPUID_ARM1026     0x4106a262
+#define ARM_CPUID_ARM926      0x41069265
+#define ARM_CPUID_ARM946      0x41059461
+#define ARM_CPUID_ARM920T     0x41129200
+#define ARM_CPUID_TI915T      0x54029152
+#define ARM_CPUID_TI925T      0x54029252
+#define ARM_CPUID_PXA250      0x69052100
+#define ARM_CPUID_PXA255      0x69052d00
+#define ARM_CPUID_PXA260      0x69052903
+#define ARM_CPUID_PXA261      0x69052d05
+#define ARM_CPUID_PXA262      0x69052d06
+#define ARM_CPUID_PXA270      0x69054110
+#define ARM_CPUID_PXA270_A0   0x69054110
+#define ARM_CPUID_PXA270_A1   0x69054111
+#define ARM_CPUID_PXA270_B0   0x69054112
+#define ARM_CPUID_PXA270_B1   0x69054113
+#define ARM_CPUID_PXA270_C0   0x69054114
+#define ARM_CPUID_PXA270_C5   0x69054117
+#define ARM_CPUID_ARM1136     0x4117b363
+#define ARM_CPUID_ARM11MPCORE 0x410fb022
+#define ARM_CPUID_CORTEXA8    0x410fc080
+#define ARM_CPUID_CORTEXM3    0x410fc231
+#define ARM_CPUID_ANY         0xffffffff
+
 #if defined(CONFIG_USER_ONLY)
 #define TARGET_PAGE_BITS 12
 #else
@@ -305,6 +400,8 @@
 #define cpu_signal_handler cpu_arm_signal_handler
 #define cpu_list arm_cpu_list
 
+#define ARM_CPU_SAVE_VERSION 1
+
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _kernel
 #define MMU_MODE1_SUFFIX _user

Modified: trunk/src/host/qemu-neo1973/target-arm/exec.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-arm/exec.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-arm/exec.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -68,13 +68,19 @@
 
 /* In op_helper.c */
 
-void cpu_lock(void);
-void cpu_unlock(void);
 void helper_set_cp(CPUState *, uint32_t, uint32_t);
 uint32_t helper_get_cp(CPUState *, uint32_t);
 void helper_set_cp15(CPUState *, uint32_t, uint32_t);
 uint32_t helper_get_cp15(CPUState *, uint32_t);
+void helper_set_r13_banked(CPUState *env, int mode, uint32_t val);
+uint32_t helper_get_r13_banked(CPUState *env, int mode);
+uint32_t helper_v7m_mrs(CPUState *env, int reg);
+void helper_v7m_msr(CPUState *env, int reg, uint32_t val);
 
+void helper_mark_exclusive(CPUARMState *, uint32_t addr);
+int helper_test_exclusive(CPUARMState *, uint32_t addr);
+void helper_clrex(CPUARMState *env);
+
 void cpu_loop_exit(void);
 
 void raise_exception(int);
@@ -91,4 +97,11 @@
 void do_vfp_cmped(void);
 void do_vfp_set_fpscr(void);
 void do_vfp_get_fpscr(void);
-
+float32 helper_recps_f32(float32, float32);
+float32 helper_rsqrts_f32(float32, float32);
+uint32_t helper_recpe_u32(uint32_t);
+uint32_t helper_rsqrte_u32(uint32_t);
+float32 helper_recpe_f32(float32);
+float32 helper_rsqrte_f32(float32);
+void helper_neon_tbl(int rn, int maxindex);
+uint32_t helper_neon_mul_p8(uint32_t op1, uint32_t op2);

Modified: trunk/src/host/qemu-neo1973/target-arm/helper.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-arm/helper.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-arm/helper.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -4,7 +4,28 @@
 
 #include "cpu.h"
 #include "exec-all.h"
+#include "gdbstub.h"
 
+static uint32_t cortexa8_cp15_c0_c1[8] =
+{ 0x1031, 0x11, 0x400, 0, 0x31100003, 0x20000000, 0x01202000, 0x11 };
+
+static uint32_t cortexa8_cp15_c0_c2[8] =
+{ 0x00101111, 0x12112111, 0x21232031, 0x11112131, 0x00111142, 0, 0, 0 };
+
+static uint32_t mpcore_cp15_c0_c1[8] =
+{ 0x111, 0x1, 0, 0x2, 0x01100103, 0x10020302, 0x01222000, 0 };
+
+static uint32_t mpcore_cp15_c0_c2[8] =
+{ 0x00100011, 0x12002111, 0x11221011, 0x01102131, 0x141, 0, 0, 0 };
+
+static uint32_t arm1136_cp15_c0_c1[8] =
+{ 0x111, 0x1, 0x2, 0x3, 0x01130003, 0x10030302, 0x01222110, 0 };
+
+static uint32_t arm1136_cp15_c0_c2[8] =
+{ 0x00140011, 0x12002111, 0x11231111, 0x01102131, 0x141, 0, 0, 0 };
+
+static uint32_t cpu_arm_find_by_name(const char *name);
+
 static inline void set_feature(CPUARMState *env, int feature)
 {
     env->features |= 1u << feature;
@@ -37,6 +58,62 @@
         env->cp15.c0_cachetype = 0x1dd20d2;
         env->cp15.c1_sys = 0x00090078;
         break;
+    case ARM_CPUID_ARM1136:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_AUXCR);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
+        memcpy(env->cp15.c0_c1, arm1136_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c1, arm1136_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        break;
+    case ARM_CPUID_ARM11MPCORE:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_V6K);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_AUXCR);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
+        memcpy(env->cp15.c0_c1, mpcore_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c1, mpcore_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        break;
+    case ARM_CPUID_CORTEXA8:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_V6K);
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_AUXCR);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_VFP3);
+        set_feature(env, ARM_FEATURE_NEON);
+        env->vfp.xregs[ARM_VFP_FPSID] = 0x410330c0;
+        env->vfp.xregs[ARM_VFP_MVFR0] = 0x11110222;
+        env->vfp.xregs[ARM_VFP_MVFR1] = 0x00011100;
+        memcpy(env->cp15.c0_c1, cortexa8_cp15_c0_c1, 8 * sizeof(uint32_t));
+        memcpy(env->cp15.c0_c1, cortexa8_cp15_c0_c2, 8 * sizeof(uint32_t));
+        env->cp15.c0_cachetype = 0x1dd20d2;
+        break;
+    case ARM_CPUID_CORTEXM3:
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_M);
+        set_feature(env, ARM_FEATURE_DIV);
+        break;
+    case ARM_CPUID_ANY: /* For userspace emulation.  */
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_V6K);
+        set_feature(env, ARM_FEATURE_V7);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        set_feature(env, ARM_FEATURE_VFP);
+        set_feature(env, ARM_FEATURE_VFP3);
+        set_feature(env, ARM_FEATURE_NEON);
+        set_feature(env, ARM_FEATURE_DIV);
+        break;
     case ARM_CPUID_TI915T:
     case ARM_CPUID_TI925T:
         set_feature(env, ARM_FEATURE_OMAPCP);
@@ -88,20 +165,29 @@
 #else
     /* SVC mode with interrupts disabled.  */
     env->uncached_cpsr = ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
+    /* On ARMv7-M the CPSR_I is the value of the PRIMASK register, and is
+       clear at reset.  */
+    if (IS_M(env))
+        env->uncached_cpsr &= ~CPSR_I;
     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 #endif
     env->regs[15] = 0;
     tlb_flush(env, 1);
 }
 
-CPUARMState *cpu_arm_init(void)
+CPUARMState *cpu_arm_init(const char *cpu_model)
 {
     CPUARMState *env;
+    uint32_t id;
 
+    id = cpu_arm_find_by_name(cpu_model);
+    if (id == 0)
+        return NULL;
     env = qemu_mallocz(sizeof(CPUARMState));
     if (!env)
         return NULL;
     cpu_exec_init(env);
+    env->cp15.c0_cpuid = id;
     cpu_reset(env);
     return env;
 }
@@ -116,6 +202,10 @@
     { ARM_CPUID_ARM926, "arm926"},
     { ARM_CPUID_ARM946, "arm946"},
     { ARM_CPUID_ARM1026, "arm1026"},
+    { ARM_CPUID_ARM1136, "arm1136"},
+    { ARM_CPUID_ARM11MPCORE, "arm11mpcore"},
+    { ARM_CPUID_CORTEXM3, "cortex-m3"},
+    { ARM_CPUID_CORTEXA8, "cortex-a8"},
     { ARM_CPUID_TI925T, "ti925t" },
     { ARM_CPUID_PXA250, "pxa250" },
     { ARM_CPUID_PXA255, "pxa255" },
@@ -129,6 +219,7 @@
     { ARM_CPUID_PXA270_B1, "pxa270-b1" },
     { ARM_CPUID_PXA270_C0, "pxa270-c0" },
     { ARM_CPUID_PXA270_C5, "pxa270-c5" },
+    { ARM_CPUID_ANY, "any"},
     { 0, NULL}
 };
 
@@ -142,24 +233,20 @@
     }
 }
 
-void cpu_arm_set_model(CPUARMState *env, const char *name)
+/* return 0 if not found */
+static uint32_t cpu_arm_find_by_name(const char *name)
 {
     int i;
     uint32_t id;
 
     id = 0;
-    i = 0;
     for (i = 0; arm_cpu_names[i].name; i++) {
         if (strcmp(name, arm_cpu_names[i].name) == 0) {
             id = arm_cpu_names[i].id;
             break;
         }
     }
-    if (!id) {
-        cpu_abort(env, "Unknown CPU '%s'", name);
-        return;
-    }
-    cpu_reset_model_id(env, id);
+    return id;
 }
 
 void cpu_arm_close(CPUARMState *env)
@@ -167,6 +254,72 @@
     free(env);
 }
 
+/* Polynomial multiplication is like integer multiplcation except the
+   partial products are XORed, not added.  */
+uint32_t helper_neon_mul_p8(uint32_t op1, uint32_t op2)
+{
+    uint32_t mask;
+    uint32_t result;
+    result = 0;
+    while (op1) {
+        mask = 0;
+        if (op1 & 1)
+            mask |= 0xff;
+        if (op1 & (1 << 8))
+            mask |= (0xff << 8);
+        if (op1 & (1 << 16))
+            mask |= (0xff << 16);
+        if (op1 & (1 << 24))
+            mask |= (0xff << 24);
+        result ^= op2 & mask;
+        op1 = (op1 >> 1) & 0x7f7f7f7f;
+        op2 = (op2 << 1) & 0xfefefefe;
+    }
+    return result;
+}
+
+uint32_t cpsr_read(CPUARMState *env)
+{
+    int ZF;
+    ZF = (env->NZF == 0);
+    return env->uncached_cpsr | (env->NZF & 0x80000000) | (ZF << 30) |
+        (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
+        | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
+        | ((env->condexec_bits & 0xfc) << 8)
+        | (env->GE << 16);
+}
+
+void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+{
+    /* NOTE: N = 1 and Z = 1 cannot be stored currently */
+    if (mask & CPSR_NZCV) {
+        env->NZF = (val & 0xc0000000) ^ 0x40000000;
+        env->CF = (val >> 29) & 1;
+        env->VF = (val << 3) & 0x80000000;
+    }
+    if (mask & CPSR_Q)
+        env->QF = ((val & CPSR_Q) != 0);
+    if (mask & CPSR_T)
+        env->thumb = ((val & CPSR_T) != 0);
+    if (mask & CPSR_IT_0_1) {
+        env->condexec_bits &= ~3;
+        env->condexec_bits |= (val >> 25) & 3;
+    }
+    if (mask & CPSR_IT_2_7) {
+        env->condexec_bits &= 3;
+        env->condexec_bits |= (val >> 8) & 0xfc;
+    }
+    if (mask & CPSR_GE) {
+        env->GE = (val >> 16) & 0xf;
+    }
+
+    if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
+        switch_mode(env, val & CPSR_M);
+    }
+    mask &= ~CACHED_CPSR_BITS;
+    env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
+}
+
 #if defined(CONFIG_USER_ONLY)
 
 void do_interrupt (CPUState *env)
@@ -174,6 +327,16 @@
     env->exception_index = -1;
 }
 
+/* Structure used to record exclusive memory locations.  */
+typedef struct mmon_state {
+    struct mmon_state *next;
+    CPUARMState *cpu_env;
+    uint32_t addr;
+} mmon_state;
+
+/* Chain of current locks.  */
+static mmon_state* mmon_head = NULL;
+
 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
                               int mmu_idx, int is_softmmu)
 {
@@ -187,6 +350,64 @@
     return 1;
 }
 
+static void allocate_mmon_state(CPUState *env)
+{
+    env->mmon_entry = malloc(sizeof (mmon_state));
+    if (!env->mmon_entry)
+        abort();
+    memset (env->mmon_entry, 0, sizeof (mmon_state));
+    env->mmon_entry->cpu_env = env;
+    mmon_head = env->mmon_entry;
+}
+
+/* Flush any monitor locks for the specified address.  */
+static void flush_mmon(uint32_t addr)
+{
+    mmon_state *mon;
+
+    for (mon = mmon_head; mon; mon = mon->next)
+      {
+        if (mon->addr != addr)
+          continue;
+
+        mon->addr = 0;
+        break;
+      }
+}
+
+/* Mark an address for exclusive access.  */
+void helper_mark_exclusive(CPUState *env, uint32_t addr)
+{
+    if (!env->mmon_entry)
+        allocate_mmon_state(env);
+    /* Clear any previous locks.  */
+    flush_mmon(addr);
+    env->mmon_entry->addr = addr;
+}
+
+/* Test if an exclusive address is still exclusive.  Returns zero
+   if the address is still exclusive.   */
+int helper_test_exclusive(CPUState *env, uint32_t addr)
+{
+    int res;
+
+    if (!env->mmon_entry)
+        return 1;
+    if (env->mmon_entry->addr == addr)
+        res = 0;
+    else
+        res = 1;
+    flush_mmon(addr);
+    return res;
+}
+
+void helper_clrex(CPUState *env)
+{
+    if (!(env->mmon_entry && env->mmon_entry->addr))
+        return;
+    flush_mmon(env->mmon_entry->addr);
+}
+
 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 {
     return addr;
@@ -218,12 +439,35 @@
     return 0;
 }
 
+/* These should probably raise undefined insn exceptions.  */
+void helper_v7m_msr(CPUState *env, int reg, uint32_t val)
+{
+    cpu_abort(env, "v7m_mrs %d\n", reg);
+}
+
+uint32_t helper_v7m_mrs(CPUState *env, int reg)
+{
+    cpu_abort(env, "v7m_mrs %d\n", reg);
+    return 0;
+}
+
 void switch_mode(CPUState *env, int mode)
 {
     if (mode != ARM_CPU_MODE_USR)
         cpu_abort(env, "Tried to switch out of user mode\n");
 }
 
+void helper_set_r13_banked(CPUState *env, int mode, uint32_t val)
+{
+    cpu_abort(env, "banked r13 write\n");
+}
+
+uint32_t helper_get_r13_banked(CPUState *env, int mode)
+{
+    cpu_abort(env, "banked r13 read\n");
+    return 0;
+}
+
 #else
 
 extern int semihosting_enabled;
@@ -278,6 +522,129 @@
     env->spsr = env->banked_spsr[i];
 }
 
+static void v7m_push(CPUARMState *env, uint32_t val)
+{
+    env->regs[13] -= 4;
+    stl_phys(env->regs[13], val);
+}
+
+static uint32_t v7m_pop(CPUARMState *env)
+{
+    uint32_t val;
+    val = ldl_phys(env->regs[13]);
+    env->regs[13] += 4;
+    return val;
+}
+
+/* Switch to V7M main or process stack pointer.  */
+static void switch_v7m_sp(CPUARMState *env, int process)
+{
+    uint32_t tmp;
+    if (env->v7m.current_sp != process) {
+        tmp = env->v7m.other_sp;
+        env->v7m.other_sp = env->regs[13];
+        env->regs[13] = tmp;
+        env->v7m.current_sp = process;
+    }
+}
+
+static void do_v7m_exception_exit(CPUARMState *env)
+{
+    uint32_t type;
+    uint32_t xpsr;
+
+    type = env->regs[15];
+    if (env->v7m.exception != 0)
+        armv7m_nvic_complete_irq(env->v7m.nvic, env->v7m.exception);
+
+    /* Switch to the target stack.  */
+    switch_v7m_sp(env, (type & 4) != 0);
+    /* Pop registers.  */
+    env->regs[0] = v7m_pop(env);
+    env->regs[1] = v7m_pop(env);
+    env->regs[2] = v7m_pop(env);
+    env->regs[3] = v7m_pop(env);
+    env->regs[12] = v7m_pop(env);
+    env->regs[14] = v7m_pop(env);
+    env->regs[15] = v7m_pop(env);
+    xpsr = v7m_pop(env);
+    xpsr_write(env, xpsr, 0xfffffdff);
+    /* Undo stack alignment.  */
+    if (xpsr & 0x200)
+        env->regs[13] |= 4;
+    /* ??? The exception return type specifies Thread/Handler mode.  However
+       this is also implied by the xPSR value. Not sure what to do
+       if there is a mismatch.  */
+    /* ??? Likewise for mismatches between the CONTROL register and the stack
+       pointer.  */
+}
+
+void do_interrupt_v7m(CPUARMState *env)
+{
+    uint32_t xpsr = xpsr_read(env);
+    uint32_t lr;
+    uint32_t addr;
+
+    lr = 0xfffffff1;
+    if (env->v7m.current_sp)
+        lr |= 4;
+    if (env->v7m.exception == 0)
+        lr |= 8;
+
+    /* For exceptions we just mark as pending on the NVIC, and let that
+       handle it.  */
+    /* TODO: Need to escalate if the current priority is higher than the
+       one we're raising.  */
+    switch (env->exception_index) {
+    case EXCP_UDEF:
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_USAGE);
+        return;
+    case EXCP_SWI:
+        env->regs[15] += 2;
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_SVC);
+        return;
+    case EXCP_PREFETCH_ABORT:
+    case EXCP_DATA_ABORT:
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_MEM);
+        return;
+    case EXCP_BKPT:
+        armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_DEBUG);
+        return;
+    case EXCP_IRQ:
+        env->v7m.exception = armv7m_nvic_acknowledge_irq(env->v7m.nvic);
+        break;
+    case EXCP_EXCEPTION_EXIT:
+        do_v7m_exception_exit(env);
+        return;
+    default:
+        cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
+        return; /* Never happens.  Keep compiler happy.  */
+    }
+
+    /* Align stack pointer.  */
+    /* ??? Should only do this if Configuration Control Register
+       STACKALIGN bit is set.  */
+    if (env->regs[13] & 4) {
+        env->regs[13] += 4;
+        xpsr |= 0x200;
+    }
+    /* Switch to the hander mode.  */
+    v7m_push(env, xpsr);
+    v7m_push(env, env->regs[15]);
+    v7m_push(env, env->regs[14]);
+    v7m_push(env, env->regs[12]);
+    v7m_push(env, env->regs[3]);
+    v7m_push(env, env->regs[2]);
+    v7m_push(env, env->regs[1]);
+    v7m_push(env, env->regs[0]);
+    switch_v7m_sp(env, 0);
+    env->uncached_cpsr &= ~CPSR_IT;
+    env->regs[14] = lr;
+    addr = ldl_phys(env->v7m.vecbase + env->v7m.exception * 4);
+    env->regs[15] = addr & 0xfffffffe;
+    env->thumb = addr & 1;
+}
+
 /* Handle a CPU exception.  */
 void do_interrupt(CPUARMState *env)
 {
@@ -286,6 +653,10 @@
     int new_mode;
     uint32_t offset;
 
+    if (IS_M(env)) {
+        do_interrupt_v7m(env);
+        return;
+    }
     /* TODO: Vectored interrupt controller.  */
     switch (env->exception_index) {
     case EXCP_UDEF:
@@ -320,8 +691,19 @@
         /* The PC already points to the next instructon.  */
         offset = 0;
         break;
+    case EXCP_BKPT:
+        /* See if this is a semihosting syscall.  */
+        if (env->thumb) {
+            mask = lduw_code(env->regs[15]) & 0xff;
+            if (mask == 0xab
+                  && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
+                env->regs[15] += 2;
+                env->regs[0] = do_arm_semihosting(env);
+                return;
+            }
+        }
+        /* Fall through to prefetch abort.  */
     case EXCP_PREFETCH_ABORT:
-    case EXCP_BKPT:
         new_mode = ARM_CPU_MODE_ABT;
         addr = 0x0c;
         mask = CPSR_A | CPSR_I;
@@ -357,6 +739,8 @@
     }
     switch_mode (env, new_mode);
     env->spsr = cpsr_read(env);
+    /* Clear IT bits.  */
+    env->condexec_bits = 0;
     /* Switch to the new mode, and switch to Arm mode.  */
     /* ??? Thumb interrupt handlers not implemented.  */
     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
@@ -373,9 +757,16 @@
 static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
                            int is_user)
 {
+  int prot_ro;
+
   if (domain == 3)
     return PAGE_READ | PAGE_WRITE;
 
+  if (access_type == 1)
+      prot_ro = 0;
+  else
+      prot_ro = PAGE_READ;
+
   switch (ap) {
   case 0:
       if (access_type == 1)
@@ -392,18 +783,24 @@
       return is_user ? 0 : PAGE_READ | PAGE_WRITE;
   case 2:
       if (is_user)
-          return (access_type == 1) ? 0 : PAGE_READ;
+          return prot_ro;
       else
           return PAGE_READ | PAGE_WRITE;
   case 3:
       return PAGE_READ | PAGE_WRITE;
+  case 4: case 7: /* Reserved.  */
+      return 0;
+  case 5:
+      return is_user ? 0 : prot_ro;
+  case 6:
+      return prot_ro;
   default:
       abort();
   }
 }
 
-static int get_phys_addr(CPUState *env, uint32_t address, int access_type,
-                         int is_user, uint32_t *phys_ptr, int *prot)
+static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
+			    int is_user, uint32_t *phys_ptr, int *prot)
 {
     int code;
     uint32_t table;
@@ -413,145 +810,259 @@
     int domain;
     uint32_t phys_addr;
 
-    /* Fast Context Switch Extension.  */
-    if (address < 0x02000000)
-        address += env->cp15.c13_fcse;
-
-    if ((env->cp15.c1_sys & 1) == 0) {
-        /* MMU/MPU disabled.  */
-        *phys_ptr = address;
-        *prot = PAGE_READ | PAGE_WRITE;
-    } else if (arm_feature(env, ARM_FEATURE_MPU)) {
-        int n;
-        uint32_t mask;
-        uint32_t base;
-
-        *phys_ptr = address;
-        for (n = 7; n >= 0; n--) {
-            base = env->cp15.c6_region[n];
-            if ((base & 1) == 0)
-                continue;
-            mask = 1 << ((base >> 1) & 0x1f);
-            /* Keep this shift separate from the above to avoid an
-               (undefined) << 32.  */
-            mask = (mask << 1) - 1;
-            if (((base ^ address) & ~mask) == 0)
-                break;
-        }
-        if (n < 0)
-            return 2;
-
-        if (access_type == 2) {
-            mask = env->cp15.c5_insn;
-        } else {
-            mask = env->cp15.c5_data;
-        }
-        mask = (mask >> (n * 4)) & 0xf;
-        switch (mask) {
-        case 0:
-            return 1;
-        case 1:
-            if (is_user)
-              return 1;
-            *prot = PAGE_READ | PAGE_WRITE;
+    /* Pagetable walk.  */
+    /* Lookup l1 descriptor.  */
+    if (address & env->cp15.c2_mask)
+        table = env->cp15.c2_base1;
+    else
+        table = env->cp15.c2_base0;
+    table = (table & 0xffffc000) | ((address >> 18) & 0x3ffc);
+    desc = ldl_phys(table);
+    type = (desc & 3);
+    domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
+    if (type == 0) {
+        /* Secton translation fault.  */
+        code = 5;
+        goto do_fault;
+    }
+    if (domain == 0 || domain == 2) {
+        if (type == 2)
+            code = 9; /* Section domain fault.  */
+        else
+            code = 11; /* Page domain fault.  */
+        goto do_fault;
+    }
+    if (type == 2) {
+        /* 1Mb section.  */
+        phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
+        ap = (desc >> 10) & 3;
+        code = 13;
+    } else {
+        /* Lookup l2 entry.  */
+	if (type == 1) {
+	    /* Coarse pagetable.  */
+	    table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
+	} else {
+	    /* Fine pagetable.  */
+	    table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
+	}
+        desc = ldl_phys(table);
+        switch (desc & 3) {
+        case 0: /* Page translation fault.  */
+            code = 7;
+            goto do_fault;
+        case 1: /* 64k page.  */
+            phys_addr = (desc & 0xffff0000) | (address & 0xffff);
+            ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
             break;
-        case 2:
-            *prot = PAGE_READ;
-            if (!is_user)
-                *prot |= PAGE_WRITE;
+        case 2: /* 4k page.  */
+            phys_addr = (desc & 0xfffff000) | (address & 0xfff);
+            ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
             break;
-        case 3:
-            *prot = PAGE_READ | PAGE_WRITE;
+        case 3: /* 1k page.  */
+	    if (type == 1) {
+		if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+		    phys_addr = (desc & 0xfffff000) | (address & 0xfff);
+		} else {
+		    /* Page translation fault.  */
+		    code = 7;
+		    goto do_fault;
+		}
+	    } else {
+		phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
+	    }
+            ap = (desc >> 4) & 3;
             break;
-        case 5:
-            if (is_user)
-                return 1;
-            *prot = PAGE_READ;
-            break;
-        case 6:
-            *prot = PAGE_READ;
-            break;
         default:
-            /* Bad permission.  */
-            return 1;
+            /* Never happens, but compiler isn't smart enough to tell.  */
+            abort();
         }
+        code = 15;
+    }
+    *prot = check_ap(env, ap, domain, access_type, is_user);
+    if (!*prot) {
+        /* Access permission fault.  */
+        goto do_fault;
+    }
+    *phys_ptr = phys_addr;
+    return 0;
+do_fault:
+    return code | (domain << 4);
+}
+
+static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
+			    int is_user, uint32_t *phys_ptr, int *prot)
+{
+    int code;
+    uint32_t table;
+    uint32_t desc;
+    uint32_t xn;
+    int type;
+    int ap;
+    int domain;
+    uint32_t phys_addr;
+
+    /* Pagetable walk.  */
+    /* Lookup l1 descriptor.  */
+    if (address & env->cp15.c2_mask)
+        table = env->cp15.c2_base1;
+    else
+        table = env->cp15.c2_base0;
+    table = (table & 0xffffc000) | ((address >> 18) & 0x3ffc);
+    desc = ldl_phys(table);
+    type = (desc & 3);
+    if (type == 0) {
+        /* Secton translation fault.  */
+        code = 5;
+        domain = 0;
+        goto do_fault;
+    } else if (type == 2 && (desc & (1 << 18))) {
+        /* Supersection.  */
+        domain = 0;
     } else {
-        /* Pagetable walk.  */
-        /* Lookup l1 descriptor.  */
-        table = (env->cp15.c2_base & 0xffffc000) | ((address >> 18) & 0x3ffc);
-        desc = ldl_phys(table);
-        type = (desc & 3);
-        domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
-        if (type == 0) {
-            /* Secton translation fault.  */
-            code = 5;
-            goto do_fault;
-        }
-        if (domain == 0 || domain == 2) {
-            if (type == 2)
-                code = 9; /* Section domain fault.  */
-            else
-                code = 11; /* Page domain fault.  */
-            goto do_fault;
-        }
-        if (type == 2) {
-            /* 1Mb section.  */
+        /* Section or page.  */
+        domain = (desc >> 4) & 0x1e;
+    }
+    domain = (env->cp15.c3 >> domain) & 3;
+    if (domain == 0 || domain == 2) {
+        if (type == 2)
+            code = 9; /* Section domain fault.  */
+        else
+            code = 11; /* Page domain fault.  */
+        goto do_fault;
+    }
+    if (type == 2) {
+        if (desc & (1 << 18)) {
+            /* Supersection.  */
+            phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
+        } else {
+            /* Section.  */
             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
-            ap = (desc >> 10) & 3;
-            code = 13;
-        } else {
-            /* Lookup l2 entry.  */
-            if (type == 1) {
-                /* Coarse pagetable.  */
-                table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
-            } else {
-                /* Fine pagetable.  */
-                table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
-            }
-            desc = ldl_phys(table);
-            switch (desc & 3) {
-            case 0: /* Page translation fault.  */
-                code = 7;
-                goto do_fault;
-            case 1: /* 64k page.  */
-                phys_addr = (desc & 0xffff0000) | (address & 0xffff);
-                ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
-                break;
-            case 2: /* 4k page.  */
-                phys_addr = (desc & 0xfffff000) | (address & 0xfff);
-                ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
-                break;
-            case 3: /* 1k page.  */
-                if (type == 1) {
-                    if (arm_feature(env, ARM_FEATURE_XSCALE))
-                        phys_addr = (desc & 0xfffff000) | (address & 0xfff);
-                    else {
-                        /* Page translation fault.  */
-                        code = 7;
-                        goto do_fault;
-                    }
-                } else
-                    phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
-                ap = (desc >> 4) & 3;
-                break;
-            default:
-                /* Never happens, but compiler isn't smart enough to tell.  */
-                abort();
-            }
-            code = 15;
         }
-        *prot = check_ap(env, ap, domain, access_type, is_user);
-        if (!*prot) {
-            /* Access permission fault.  */
+        ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
+        xn = desc & (1 << 4);
+        code = 13;
+    } else {
+        /* Lookup l2 entry.  */
+        table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
+        desc = ldl_phys(table);
+        ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
+        switch (desc & 3) {
+        case 0: /* Page translation fault.  */
+            code = 7;
             goto do_fault;
+        case 1: /* 64k page.  */
+            phys_addr = (desc & 0xffff0000) | (address & 0xffff);
+            xn = desc & (1 << 15);
+            break;
+        case 2: case 3: /* 4k page.  */
+            phys_addr = (desc & 0xfffff000) | (address & 0xfff);
+            xn = desc & 1;
+            break;
+        default:
+            /* Never happens, but compiler isn't smart enough to tell.  */
+            abort();
         }
-        *phys_ptr = phys_addr;
+        code = 15;
     }
+    if (xn && access_type == 2)
+        goto do_fault;
+
+    *prot = check_ap(env, ap, domain, access_type, is_user);
+    if (!*prot) {
+        /* Access permission fault.  */
+        goto do_fault;
+    }
+    *phys_ptr = phys_addr;
     return 0;
 do_fault:
     return code | (domain << 4);
 }
 
+static int get_phys_addr_mpu(CPUState *env, uint32_t address, int access_type,
+			     int is_user, uint32_t *phys_ptr, int *prot)
+{
+    int n;
+    uint32_t mask;
+    uint32_t base;
+
+    *phys_ptr = address;
+    for (n = 7; n >= 0; n--) {
+	base = env->cp15.c6_region[n];
+	if ((base & 1) == 0)
+	    continue;
+	mask = 1 << ((base >> 1) & 0x1f);
+	/* Keep this shift separate from the above to avoid an
+	   (undefined) << 32.  */
+	mask = (mask << 1) - 1;
+	if (((base ^ address) & ~mask) == 0)
+	    break;
+    }
+    if (n < 0)
+	return 2;
+
+    if (access_type == 2) {
+	mask = env->cp15.c5_insn;
+    } else {
+	mask = env->cp15.c5_data;
+    }
+    mask = (mask >> (n * 4)) & 0xf;
+    switch (mask) {
+    case 0:
+	return 1;
+    case 1:
+	if (is_user)
+	  return 1;
+	*prot = PAGE_READ | PAGE_WRITE;
+	break;
+    case 2:
+	*prot = PAGE_READ;
+	if (!is_user)
+	    *prot |= PAGE_WRITE;
+	break;
+    case 3:
+	*prot = PAGE_READ | PAGE_WRITE;
+	break;
+    case 5:
+	if (is_user)
+	    return 1;
+	*prot = PAGE_READ;
+	break;
+    case 6:
+	*prot = PAGE_READ;
+	break;
+    default:
+	/* Bad permission.  */
+	return 1;
+    }
+    return 0;
+}
+
+static inline int get_phys_addr(CPUState *env, uint32_t address,
+                                int access_type, int is_user,
+                                uint32_t *phys_ptr, int *prot)
+{
+    /* Fast Context Switch Extension.  */
+    if (address < 0x02000000)
+        address += env->cp15.c13_fcse;
+
+    if ((env->cp15.c1_sys & 1) == 0) {
+        /* MMU/MPU disabled.  */
+        *phys_ptr = address;
+        *prot = PAGE_READ | PAGE_WRITE;
+        return 0;
+    } else if (arm_feature(env, ARM_FEATURE_MPU)) {
+	return get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,
+				 prot);
+    } else if (env->cp15.c1_sys & (1 << 23)) {
+        return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,
+                                prot);
+    } else {
+        return get_phys_addr_v5(env, address, access_type, is_user, phys_ptr,
+                                prot);
+    }
+}
+
 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
                               int access_type, int mmu_idx, int is_softmmu)
 {
@@ -575,6 +1086,8 @@
         env->exception_index = EXCP_PREFETCH_ABORT;
     } else {
         env->cp15.c5_data = ret;
+        if (access_type == 1 && arm_feature(env, ARM_FEATURE_V6))
+            env->cp15.c5_data |= (1 << 11);
         env->cp15.c6_data = address;
         env->exception_index = EXCP_DATA_ABORT;
     }
@@ -595,6 +1108,24 @@
     return phys_addr;
 }
 
+/* Not really implemented.  Need to figure out a sane way of doing this.
+   Maybe add generic watchpoint support and use that.  */
+
+void helper_mark_exclusive(CPUState *env, uint32_t addr)
+{
+    env->mmon_addr = addr;
+}
+
+int helper_test_exclusive(CPUState *env, uint32_t addr)
+{
+    return (env->mmon_addr != addr);
+}
+
+void helper_clrex(CPUState *env)
+{
+    env->mmon_addr = -1;
+}
+
 void helper_set_cp(CPUState *env, uint32_t insn, uint32_t val)
 {
     int cp_num = (insn >> 8) & 0xf;
@@ -652,13 +1183,20 @@
 
 void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
 {
-    uint32_t op2;
-    uint32_t crm;
+    int op1;
+    int op2;
+    int crm;
 
+    op1 = (insn >> 21) & 7;
     op2 = (insn >> 5) & 7;
     crm = insn & 0xf;
     switch ((insn >> 16) & 0xf) {
-    case 0: /* ID codes.  */
+    case 0:
+        if (((insn >> 21) & 7) == 2) {
+            /* ??? Select cache level.  Ignore.  */
+            return;
+        }
+        /* ID codes.  */
         if (arm_feature(env, ARM_FEATURE_XSCALE))
             break;
         if (arm_feature(env, ARM_FEATURE_OMAPCP))
@@ -675,12 +1213,13 @@
             /* This may enable/disable the MMU, so do a TLB flush.  */
             tlb_flush(env, 1);
             break;
-        case 1:
+        case 1: /* Auxiliary cotrol register.  */
             if (arm_feature(env, ARM_FEATURE_XSCALE)) {
                 env->cp15.c1_xscaleauxcr = val;
                 break;
             }
-            goto bad_reg;
+            /* Not implemented.  */
+            break;
         case 2:
             if (arm_feature(env, ARM_FEATURE_XSCALE))
                 goto bad_reg;
@@ -705,7 +1244,19 @@
                 goto bad_reg;
             }
         } else {
-            env->cp15.c2_base = val;
+	    switch (op2) {
+	    case 0:
+		env->cp15.c2_base0 = val;
+		break;
+	    case 1:
+		env->cp15.c2_base1 = val;
+		break;
+	    case 2:
+		env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> val);
+		break;
+	    default:
+		goto bad_reg;
+	    }
         }
         break;
     case 3: /* MMU Domain access control / MPU write buffer control.  */
@@ -754,7 +1305,8 @@
             case 0:
                 env->cp15.c6_data = val;
                 break;
-            case 1:
+            case 1: /* ??? This is WFAR on armv6 */
+            case 2:
                 env->cp15.c6_insn = val;
                 break;
             default:
@@ -766,6 +1318,7 @@
         env->cp15.c15_i_max = 0x000;
         env->cp15.c15_i_min = 0xff0;
         /* No cache, so nothing to do.  */
+        /* ??? MPCore has VA to PA translation functions.  */
         break;
     case 8: /* MMU TLB control.  */
         switch (op2) {
@@ -786,6 +1339,13 @@
             tlb_flush(env, 1);
 #endif
             break;
+        case 2: /* Invalidate on ASID.  */
+            tlb_flush(env, val == 0);
+            break;
+        case 3: /* Invalidate single entry on MVA.  */
+            /* ??? This is like case 1, but ignores ASID.  */
+            tlb_flush(env, 1);
+            break;
         default:
             goto bad_reg;
         }
@@ -795,17 +1355,26 @@
             break;
         switch (crm) {
         case 0: /* Cache lockdown.  */
-            switch (op2) {
-            case 0:
-                env->cp15.c9_data = val;
-                break;
-            case 1:
-                env->cp15.c9_insn = val;
-                break;
-            default:
-                goto bad_reg;
-            }
-            break;
+	    switch (op1) {
+	    case 0: /* L1 cache.  */
+		switch (op2) {
+		case 0:
+		    env->cp15.c9_data = val;
+		    break;
+		case 1:
+		    env->cp15.c9_insn = val;
+		    break;
+		default:
+		    goto bad_reg;
+		}
+		break;
+	    case 1: /* L2 cache.  */
+		/* Ignore writes to L2 lockdown/auxiliary registers.  */
+		break;
+	    default:
+		goto bad_reg;
+	    }
+	    break;
         case 1: /* TCM memory region registers.  */
             /* Not implemented.  */
             goto bad_reg;
@@ -837,6 +1406,15 @@
               tlb_flush(env, 0);
             env->cp15.c13_context = val;
             break;
+        case 2:
+            env->cp15.c13_tls1 = val;
+            break;
+        case 3:
+            env->cp15.c13_tls2 = val;
+            break;
+        case 4:
+            env->cp15.c13_tls3 = val;
+            break;
         default:
             goto bad_reg;
         }
@@ -885,29 +1463,66 @@
     return;
 bad_reg:
     /* ??? For debugging only.  Should raise illegal instruction exception.  */
-    cpu_abort(env, "Unimplemented cp15 register write\n");
+    cpu_abort(env, "Unimplemented cp15 register write (c%d, c%d, {%d, %d})\n",
+              (insn >> 16) & 0xf, crm, op1, op2);
 }
 
 uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
 {
-    uint32_t op2;
-    uint32_t crm;
+    int op1;
+    int op2;
+    int crm;
 
+    op1 = (insn >> 21) & 7;
     op2 = (insn >> 5) & 7;
     crm = insn & 0xf;
     switch ((insn >> 16) & 0xf) {
     case 0: /* ID codes.  */
-        switch (op2) {
-        default: /* Device ID.  */
-            return env->cp15.c0_cpuid;
-        case 1: /* Cache Type.  */
-            return env->cp15.c0_cachetype;
-        case 2: /* TCM status.  */
-            if (arm_feature(env, ARM_FEATURE_S3C))
-                return env->cp15.c0_cpuid;
+        switch (op1) {
+        case 0:
+            switch (crm) {
+            case 0:
+                switch (op2) {
+                case 0: /* Device ID.  */
+                    return env->cp15.c0_cpuid;
+                case 1: /* Cache Type.  */
+		    return env->cp15.c0_cachetype;
+                case 2: /* TCM status.  */
+                    if (arm_feature(env, ARM_FEATURE_S3C))
+                        return env->cp15.c0_cpuid;
+                    return 0;
+                case 3: /* TLB type register.  */
+                    return 0; /* No lockable TLB entries.  */
+                case 5: /* CPU ID */
+                    return env->cpu_index;
+                default:
+                    goto bad_reg;
+                }
+            case 1:
+                if (!arm_feature(env, ARM_FEATURE_V6))
+                    goto bad_reg;
+                return env->cp15.c0_c1[op2];
+            case 2:
+                if (!arm_feature(env, ARM_FEATURE_V6))
+                    goto bad_reg;
+                return env->cp15.c0_c2[op2];
+            case 3: case 4: case 5: case 6: case 7:
+                return 0;
+            default:
+                goto bad_reg;
+            }
+        case 1:
+            /* These registers aren't documented on arm11 cores.  However
+               Linux looks at them anyway.  */
+            if (!arm_feature(env, ARM_FEATURE_V6))
+                goto bad_reg;
+            if (crm != 0)
+                goto bad_reg;
             if (arm_feature(env, ARM_FEATURE_XSCALE))
                 goto bad_reg;
             return 0;
+        default:
+            goto bad_reg;
         }
     case 1: /* System configuration.  */
         if (arm_feature(env, ARM_FEATURE_OMAPCP))
@@ -916,11 +1531,22 @@
         case 0: /* Control register.  */
             return env->cp15.c1_sys;
         case 1: /* Auxiliary control register.  */
-            if (arm_feature(env, ARM_FEATURE_AUXCR))
-                return 1;
             if (arm_feature(env, ARM_FEATURE_XSCALE))
                 return env->cp15.c1_xscaleauxcr;
-            goto bad_reg;
+            if (!arm_feature(env, ARM_FEATURE_AUXCR))
+                goto bad_reg;
+            switch (ARM_CPUID(env)) {
+            case ARM_CPUID_ARM1026:
+                return 1;
+            case ARM_CPUID_ARM1136:
+                return 7;
+            case ARM_CPUID_ARM11MPCORE:
+                return 1;
+            case ARM_CPUID_CORTEXA8:
+                return 0;
+            default:
+                goto bad_reg;
+            }
         case 2: /* Coprocessor access register.  */
             if (arm_feature(env, ARM_FEATURE_XSCALE))
                 goto bad_reg;
@@ -941,8 +1567,27 @@
                 goto bad_reg;
             }
         } else {
-            return env->cp15.c2_base;
-        }
+	    switch (op2) {
+	    case 0:
+		return env->cp15.c2_base0;
+	    case 1:
+		return env->cp15.c2_base1;
+	    case 2:
+		{
+		    int n;
+		    uint32_t mask;
+		    n = 0;
+		    mask = env->cp15.c2_mask;
+		    while (mask) {
+			n++;
+			mask <<= 1;
+		    }
+		    return n;
+		}
+	    default:
+		goto bad_reg;
+	    }
+	}
     case 3: /* MMU Domain access control / MPU write buffer control.  */
         return env->cp15.c3;
     case 4: /* Reserved.  */
@@ -970,26 +1615,37 @@
         default:
             goto bad_reg;
         }
-    case 6: /* MMU Fault address / MPU base/size.  */
+    case 6: /* MMU Fault address.  */
         if (arm_feature(env, ARM_FEATURE_MPU)) {
-            int n;
-            n = (insn & 0xf);
-            if (n >= 8)
+            if (crm >= 8)
                 goto bad_reg;
-            return env->cp15.c6_region[n];
+            return env->cp15.c6_region[crm];
         } else {
             if (arm_feature(env, ARM_FEATURE_OMAPCP))
                 op2 = 0;
-            switch (op2) {
-            case 0:
-                return env->cp15.c6_data;
-            case 1:
-                /* Arm9 doesn't have an IFAR, but implementing it anyway
-                   shouldn't do any harm.  */
-                return env->cp15.c6_insn;
-            default:
-                goto bad_reg;
-            }
+	    switch (op2) {
+	    case 0:
+		return env->cp15.c6_data;
+	    case 1:
+		if (arm_feature(env, ARM_FEATURE_V6)) {
+		    /* Watchpoint Fault Adrress.  */
+		    return 0; /* Not implemented.  */
+		} else {
+		    /* Instruction Fault Adrress.  */
+		    /* Arm9 doesn't have an IFAR, but implementing it anyway
+		       shouldn't do any harm.  */
+		    return env->cp15.c6_insn;
+		}
+	    case 2:
+		if (arm_feature(env, ARM_FEATURE_V6)) {
+		    /* Instruction Fault Adrress.  */
+		    return env->cp15.c6_insn;
+		} else {
+		    goto bad_reg;
+		}
+	    default:
+		goto bad_reg;
+	    }
         }
     case 7: /* Cache control.  */
         /* ??? This is for test, clean and invalidate operations that set the
@@ -1000,13 +1656,23 @@
     case 8: /* MMU TLB control.  */
         goto bad_reg;
     case 9: /* Cache lockdown.  */
-        if (arm_feature(env, ARM_FEATURE_OMAPCP))
+        switch (op1) {
+        case 0: /* L1 cache.  */
+	    if (arm_feature(env, ARM_FEATURE_OMAPCP))
+		return 0;
+            switch (op2) {
+            case 0:
+                return env->cp15.c9_data;
+            case 1:
+                return env->cp15.c9_insn;
+            default:
+                goto bad_reg;
+            }
+        case 1: /* L2 cache */
+            if (crm != 0)
+                goto bad_reg;
+            /* L2 Lockdown and Auxiliary control.  */
             return 0;
-        switch (op2) {
-        case 0:
-            return env->cp15.c9_data;
-        case 1:
-            return env->cp15.c9_insn;
         default:
             goto bad_reg;
         }
@@ -1024,6 +1690,12 @@
             return env->cp15.c13_fcse;
         case 1:
             return env->cp15.c13_context;
+        case 2:
+            return env->cp15.c13_tls1;
+        case 3:
+            return env->cp15.c13_tls2;
+        case 4:
+            return env->cp15.c13_tls3;
         default:
             goto bad_reg;
         }
@@ -1057,10 +1729,125 @@
     }
 bad_reg:
     /* ??? For debugging only.  Should raise illegal instruction exception.  */
-    cpu_abort(env, "Unimplemented cp15 register read\n");
+    cpu_abort(env, "Unimplemented cp15 register read (c%d, c%d, {%d, %d})\n",
+              (insn >> 16) & 0xf, crm, op1, op2);
     return 0;
 }
 
+void helper_set_r13_banked(CPUState *env, int mode, uint32_t val)
+{
+    env->banked_r13[bank_number(mode)] = val;
+}
+
+uint32_t helper_get_r13_banked(CPUState *env, int mode)
+{
+    return env->banked_r13[bank_number(mode)];
+}
+
+uint32_t helper_v7m_mrs(CPUState *env, int reg)
+{
+    switch (reg) {
+    case 0: /* APSR */
+        return xpsr_read(env) & 0xf8000000;
+    case 1: /* IAPSR */
+        return xpsr_read(env) & 0xf80001ff;
+    case 2: /* EAPSR */
+        return xpsr_read(env) & 0xff00fc00;
+    case 3: /* xPSR */
+        return xpsr_read(env) & 0xff00fdff;
+    case 5: /* IPSR */
+        return xpsr_read(env) & 0x000001ff;
+    case 6: /* EPSR */
+        return xpsr_read(env) & 0x0700fc00;
+    case 7: /* IEPSR */
+        return xpsr_read(env) & 0x0700edff;
+    case 8: /* MSP */
+        return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
+    case 9: /* PSP */
+        return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
+    case 16: /* PRIMASK */
+        return (env->uncached_cpsr & CPSR_I) != 0;
+    case 17: /* FAULTMASK */
+        return (env->uncached_cpsr & CPSR_F) != 0;
+    case 18: /* BASEPRI */
+    case 19: /* BASEPRI_MAX */
+        return env->v7m.basepri;
+    case 20: /* CONTROL */
+        return env->v7m.control;
+    default:
+        /* ??? For debugging only.  */
+        cpu_abort(env, "Unimplemented system register read (%d)\n", reg);
+        return 0;
+    }
+}
+
+void helper_v7m_msr(CPUState *env, int reg, uint32_t val)
+{
+    switch (reg) {
+    case 0: /* APSR */
+        xpsr_write(env, val, 0xf8000000);
+        break;
+    case 1: /* IAPSR */
+        xpsr_write(env, val, 0xf8000000);
+        break;
+    case 2: /* EAPSR */
+        xpsr_write(env, val, 0xfe00fc00);
+        break;
+    case 3: /* xPSR */
+        xpsr_write(env, val, 0xfe00fc00);
+        break;
+    case 5: /* IPSR */
+        /* IPSR bits are readonly.  */
+        break;
+    case 6: /* EPSR */
+        xpsr_write(env, val, 0x0600fc00);
+        break;
+    case 7: /* IEPSR */
+        xpsr_write(env, val, 0x0600fc00);
+        break;
+    case 8: /* MSP */
+        if (env->v7m.current_sp)
+            env->v7m.other_sp = val;
+        else
+            env->regs[13] = val;
+        break;
+    case 9: /* PSP */
+        if (env->v7m.current_sp)
+            env->regs[13] = val;
+        else
+            env->v7m.other_sp = val;
+        break;
+    case 16: /* PRIMASK */
+        if (val & 1)
+            env->uncached_cpsr |= CPSR_I;
+        else
+            env->uncached_cpsr &= ~CPSR_I;
+        break;
+    case 17: /* FAULTMASK */
+        if (val & 1)
+            env->uncached_cpsr |= CPSR_F;
+        else
+            env->uncached_cpsr &= ~CPSR_F;
+        break;
+    case 18: /* BASEPRI */
+        env->v7m.basepri = val & 0xff;
+        break;
+    case 19: /* BASEPRI_MAX */
+        val &= 0xff;
+        if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
+            env->v7m.basepri = val;
+        break;
+    case 20: /* CONTROL */
+        env->v7m.control = val & 3;
+        switch_v7m_sp(env, (val & 2) != 0);
+        break;
+    default:
+        /* ??? For debugging only.  */
+        cpu_abort(env, "Unimplemented system register write (%d)\n", reg);
+        return;
+    }
+}
+
 void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
                 ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
                 void *opaque)

Modified: trunk/src/host/qemu-neo1973/target-arm/op.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-arm/op.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-arm/op.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -2,7 +2,7 @@
  *  ARM micro operations
  *
  *  Copyright (c) 2003 Fabrice Bellard
- *  Copyright (c) 2005 CodeSourcery, LLC
+ *  Copyright (c) 2005-2007 CodeSourcery, LLC
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -101,11 +101,6 @@
     T0 = PARAM1;
 }
 
-void OPPROTO op_movl_T0_T1(void)
-{
-    T0 = T1;
-}
-
 void OPPROTO op_movl_T1_im(void)
 {
     T1 = PARAM1;
@@ -236,6 +231,11 @@
     T0 &= ~T1;
 }
 
+void OPPROTO op_notl_T0(void)
+{
+    T0 = ~T0;
+}
+
 void OPPROTO op_notl_T1(void)
 {
     T1 = ~T1;
@@ -351,6 +351,19 @@
     FORCE_RET();
 }
 
+void OPPROTO op_test_T0(void)
+{
+    if (T0)
+        GOTO_LABEL_PARAM(1);
+    FORCE_RET();
+}
+void OPPROTO op_testn_T0(void)
+{
+    if (!T0)
+        GOTO_LABEL_PARAM(1);
+    FORCE_RET();
+}
+
 void OPPROTO op_goto_tb0(void)
 {
     GOTO_TB(op_goto_tb0, PARAM1, 0);
@@ -368,7 +381,8 @@
 
 void OPPROTO op_movl_T0_cpsr(void)
 {
-    T0 = cpsr_read(env);
+    /* Execution state bits always read as zero.  */
+    T0 = cpsr_read(env) & ~CPSR_EXEC;
     FORCE_RET();
 }
 
@@ -438,6 +452,28 @@
     T0 = res;
 }
 
+/* Dual 16-bit accumulate.  */
+void OPPROTO op_addq_T0_T1_dual(void)
+{
+  uint64_t res;
+  res = ((uint64_t)(env->regs[PARAM2]) << 32) | (env->regs[PARAM1]);
+  res += (int32_t)T0;
+  res += (int32_t)T1;
+  env->regs[PARAM1] = (uint32_t)res;
+  env->regs[PARAM2] = res >> 32;
+}
+
+/* Dual 16-bit subtract accumulate.  */
+void OPPROTO op_subq_T0_T1_dual(void)
+{
+  uint64_t res;
+  res = ((uint64_t)(env->regs[PARAM2]) << 32) | (env->regs[PARAM1]);
+  res += (int32_t)T0;
+  res -= (int32_t)T1;
+  env->regs[PARAM1] = (uint32_t)res;
+  env->regs[PARAM2] = res >> 32;
+}
+
 void OPPROTO op_logicq_cc(void)
 {
     env->NZF = (T1 & 0x80000000) | ((T0 | T1) != 0);
@@ -455,8 +491,21 @@
 #include "op_mem.h"
 #endif
 
+void OPPROTO op_clrex(void)
+{
+    cpu_lock();
+    helper_clrex(env);
+    cpu_unlock();
+}
+
 /* shifts */
 
+/* Used by NEON.  */
+void OPPROTO op_shll_T0_im(void)
+{
+    T1 = T1 << PARAM1;
+}
+
 /* T1 based */
 
 void OPPROTO op_shll_T1_im(void)
@@ -813,9 +862,40 @@
   FORCE_RET();
 }
 
-/* thumb shift by immediate */
-void OPPROTO op_shll_T0_im_thumb(void)
+/* Unsigned saturating arithmetic for NEON.  */
+void OPPROTO op_addl_T0_T1_usaturate(void)
 {
+  uint32_t res;
+
+  res = T0 + T1;
+  if (res < T0) {
+      env->QF = 1;
+      T0 = 0xffffffff;
+  } else {
+      T0 = res;
+  }
+
+  FORCE_RET();
+}
+
+void OPPROTO op_subl_T0_T1_usaturate(void)
+{
+  uint32_t res;
+
+  res = T0 - T1;
+  if (res > T0) {
+      env->QF = 1;
+      T0 = 0;
+  } else {
+      T0 = res;
+  }
+
+  FORCE_RET();
+}
+
+/* Thumb shift by immediate */
+void OPPROTO op_shll_T0_im_thumb_cc(void)
+{
     int shift;
     shift = PARAM1;
     if (shift != 0) {
@@ -826,8 +906,14 @@
     FORCE_RET();
 }
 
-void OPPROTO op_shrl_T0_im_thumb(void)
+void OPPROTO op_shll_T0_im_thumb(void)
 {
+    T0 = T0 << PARAM1;
+    FORCE_RET();
+}
+
+void OPPROTO op_shrl_T0_im_thumb_cc(void)
+{
     int shift;
 
     shift = PARAM1;
@@ -842,12 +928,25 @@
     FORCE_RET();
 }
 
-void OPPROTO op_sarl_T0_im_thumb(void)
+void OPPROTO op_shrl_T0_im_thumb(void)
 {
     int shift;
 
     shift = PARAM1;
     if (shift == 0) {
+	T0 = 0;
+    } else {
+	T0 = T0 >> shift;
+    }
+    FORCE_RET();
+}
+
+void OPPROTO op_sarl_T0_im_thumb_cc(void)
+{
+    int shift;
+
+    shift = PARAM1;
+    if (shift == 0) {
 	T0 = ((int32_t)T0) >> 31;
 	env->CF = T0 & 1;
     } else {
@@ -858,6 +957,19 @@
     FORCE_RET();
 }
 
+void OPPROTO op_sarl_T0_im_thumb(void)
+{
+    int shift;
+
+    shift = PARAM1;
+    if (shift == 0) {
+	env->CF = T0 & 1;
+    } else {
+	T0 = ((int32_t)T0) >> shift;
+    }
+    FORCE_RET();
+}
+
 /* exceptions */
 
 void OPPROTO op_swi(void)
@@ -891,6 +1003,12 @@
     cpu_loop_exit();
 }
 
+void OPPROTO op_exception_exit(void)
+{
+    env->exception_index = EXCP_EXCEPTION_EXIT;
+    cpu_loop_exit();
+}
+
 /* VFP support.  We follow the convention used for VFP instrunctions:
    Single precition routines have a "s" suffix, double precision a
    "d" suffix.  */
@@ -982,6 +1100,28 @@
     return v.i;
 }
 
+static inline float64 vfp_itod(uint64_t i)
+{
+    union {
+        uint64_t i;
+        float64 d;
+    } v;
+
+    v.i = i;
+    return v.d;
+}
+
+static inline uint64_t vfp_dtoi(float64 d)
+{
+    union {
+        uint64_t i;
+        float64 d;
+    } v;
+
+    v.d = d;
+    return v.i;
+}
+
 /* Integer to float conversion.  */
 VFP_OP(uito, s)
 {
@@ -1056,6 +1196,32 @@
     FT0s = float64_to_float32(FT0d, &env->vfp.fp_status);
 }
 
+/* VFP3 fixed point conversion.  */
+#define VFP_CONV_FIX(name, p, ftype, itype, sign) \
+VFP_OP(name##to, p) \
+{ \
+    ftype tmp; \
+    tmp = sign##int32_to_##ftype ((itype)vfp_##p##toi(FT0##p), \
+                                  &env->vfp.fp_status); \
+    FT0##p = ftype##_scalbn(tmp, PARAM1, &env->vfp.fp_status); \
+} \
+VFP_OP(to##name, p) \
+{ \
+    ftype tmp; \
+    tmp = ftype##_scalbn(FT0##p, PARAM1, &env->vfp.fp_status); \
+    FT0##p = vfp_ito##p((itype)ftype##_to_##sign##int32_round_to_zero(tmp, \
+            &env->vfp.fp_status)); \
+}
+
+VFP_CONV_FIX(sh, d, float64, int16, )
+VFP_CONV_FIX(sl, d, float64, int32, )
+VFP_CONV_FIX(uh, d, float64, uint16, u)
+VFP_CONV_FIX(ul, d, float64, uint32, u)
+VFP_CONV_FIX(sh, s, float32, int16, )
+VFP_CONV_FIX(sl, s, float32, int32, )
+VFP_CONV_FIX(uh, s, float32, uint16, u)
+VFP_CONV_FIX(ul, s, float32, uint32, u)
+
 /* Get and Put values from registers.  */
 VFP_OP(getreg_F0, d)
 {
@@ -1142,6 +1308,20 @@
     FT0d = u.d;
 }
 
+/* Load immediate.  PARAM1 is the 32 most significant bits of the value.  */
+void OPPROTO op_vfp_fconstd(void)
+{
+    CPU_DoubleU u;
+    u.l.upper = PARAM1;
+    u.l.lower = 0;
+    FT0d = u.d;
+}
+
+void OPPROTO op_vfp_fconsts(void)
+{
+    FT0s = vfp_itos(PARAM1);
+}
+
 /* Copy the most significant bit of T0 to all bits of T1.  */
 void OPPROTO op_signbit_T1_T0(void)
 {
@@ -1204,9 +1384,9 @@
     FORCE_RET();
 }
 
-void OPPROTO op_movl_T2_T0(void)
+void OPPROTO op_movl_T0_T1(void)
 {
-    T2 = T0;
+    T0 = T1;
 }
 
 void OPPROTO op_movl_T0_T2(void)
@@ -1214,5 +1394,530 @@
     T0 = T2;
 }
 
+void OPPROTO op_movl_T1_T0(void)
+{
+    T1 = T0;
+}
+
+void OPPROTO op_movl_T1_T2(void)
+{
+    T1 = T2;
+}
+
+void OPPROTO op_movl_T2_T0(void)
+{
+    T2 = T0;
+}
+
+/* ARMv6 Media instructions.  */
+
+/* Note that signed overflow is undefined in C.  The following routines are
+   careful to use unsigned types where modulo arithmetic is required.
+   Failure to do so _will_ break on newer gcc.  */
+
+/* Signed saturating arithmetic.  */
+
+/* Perform 16-bit signed satruating addition.  */
+static inline uint16_t add16_sat(uint16_t a, uint16_t b)
+{
+    uint16_t res;
+
+    res = a + b;
+    if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
+        if (a & 0x8000)
+            res = 0x8000;
+        else
+            res = 0x7fff;
+    }
+    return res;
+}
+
+/* Perform 8-bit signed satruating addition.  */
+static inline uint8_t add8_sat(uint8_t a, uint8_t b)
+{
+    uint8_t res;
+
+    res = a + b;
+    if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
+        if (a & 0x80)
+            res = 0x80;
+        else
+            res = 0x7f;
+    }
+    return res;
+}
+
+/* Perform 16-bit signed satruating subtraction.  */
+static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
+{
+    uint16_t res;
+
+    res = a - b;
+    if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
+        if (a & 0x8000)
+            res = 0x8000;
+        else
+            res = 0x7fff;
+    }
+    return res;
+}
+
+/* Perform 8-bit signed satruating subtraction.  */
+static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
+{
+    uint8_t res;
+
+    res = a - b;
+    if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
+        if (a & 0x80)
+            res = 0x80;
+        else
+            res = 0x7f;
+    }
+    return res;
+}
+
+#define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
+#define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
+#define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
+#define SUB8(a, b, n)  RESULT(sub8_sat(a, b), n, 8);
+#define PFX q
+
+#include "op_addsub.h"
+
+/* Unsigned saturating arithmetic.  */
+static inline uint16_t add16_usat(uint16_t a, uint8_t b)
+{
+    uint16_t res;
+    res = a + b;
+    if (res < a)
+        res = 0xffff;
+    return res;
+}
+
+static inline uint16_t sub16_usat(uint16_t a, uint8_t b)
+{
+    if (a < b)
+        return a - b;
+    else
+        return 0;
+}
+
+static inline uint8_t add8_usat(uint8_t a, uint8_t b)
+{
+    uint8_t res;
+    res = a + b;
+    if (res < a)
+        res = 0xff;
+    return res;
+}
+
+static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
+{
+    if (a < b)
+        return a - b;
+    else
+        return 0;
+}
+
+#define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
+#define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
+#define ADD8(a, b, n)  RESULT(add8_usat(a, b), n, 8);
+#define SUB8(a, b, n)  RESULT(sub8_usat(a, b), n, 8);
+#define PFX uq
+
+#include "op_addsub.h"
+
+/* Signed modulo arithmetic.  */
+#define SARITH16(a, b, n, op) do { \
+    int32_t sum; \
+    sum = (int16_t)((uint16_t)(a) op (uint16_t)(b)); \
+    RESULT(sum, n, 16); \
+    if (sum >= 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define SARITH8(a, b, n, op) do { \
+    int32_t sum; \
+    sum = (int8_t)((uint8_t)(a) op (uint8_t)(b)); \
+    RESULT(sum, n, 8); \
+    if (sum >= 0) \
+        ge |= 1 << n; \
+    } while(0)
+
+
+#define ADD16(a, b, n) SARITH16(a, b, n, +)
+#define SUB16(a, b, n) SARITH16(a, b, n, -)
+#define ADD8(a, b, n)  SARITH8(a, b, n, +)
+#define SUB8(a, b, n)  SARITH8(a, b, n, -)
+#define PFX s
+#define ARITH_GE
+
+#include "op_addsub.h"
+
+/* Unsigned modulo arithmetic.  */
+#define ADD16(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
+    RESULT(sum, n, 16); \
+    if ((sum >> 16) == 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define ADD8(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
+    RESULT(sum, n, 8); \
+    if ((sum >> 8) == 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define SUB16(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
+    RESULT(sum, n, 16); \
+    if ((sum >> 16) == 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define SUB8(a, b, n) do { \
+    uint32_t sum; \
+    sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
+    RESULT(sum, n, 8); \
+    if ((sum >> 8) == 0) \
+        ge |= 3 << (n * 2); \
+    } while(0)
+
+#define PFX u
+#define ARITH_GE
+
+#include "op_addsub.h"
+
+/* Halved signed arithmetic.  */
+#define ADD16(a, b, n) \
+  RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
+#define SUB16(a, b, n) \
+  RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
+#define ADD8(a, b, n) \
+  RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
+#define SUB8(a, b, n) \
+  RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
+#define PFX sh
+
+#include "op_addsub.h"
+
+/* Halved unsigned arithmetic.  */
+#define ADD16(a, b, n) \
+  RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
+#define SUB16(a, b, n) \
+  RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
+#define ADD8(a, b, n) \
+  RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
+#define SUB8(a, b, n) \
+  RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
+#define PFX uh
+
+#include "op_addsub.h"
+
+void OPPROTO op_pkhtb_T0_T1(void)
+{
+    T0 = (T0 & 0xffff0000) | (T1 & 0xffff);
+}
+
+void OPPROTO op_pkhbt_T0_T1(void)
+{
+    T0 = (T0 & 0xffff) | (T1 & 0xffff0000);
+}
+void OPPROTO op_rev_T0(void)
+{
+    T0 =  ((T0 & 0xff000000) >> 24)
+        | ((T0 & 0x00ff0000) >> 8)
+        | ((T0 & 0x0000ff00) << 8)
+        | ((T0 & 0x000000ff) << 24);
+}
+
+void OPPROTO op_revh_T0(void)
+{
+    T0 = (T0 >> 16) | (T0 << 16);
+}
+
+void OPPROTO op_rev16_T0(void)
+{
+    T0 =  ((T0 & 0xff000000) >> 8)
+        | ((T0 & 0x00ff0000) << 8)
+        | ((T0 & 0x0000ff00) >> 8)
+        | ((T0 & 0x000000ff) << 8);
+}
+
+void OPPROTO op_revsh_T0(void)
+{
+    T0 = (int16_t)(  ((T0 & 0x0000ff00) >> 8)
+                   | ((T0 & 0x000000ff) << 8));
+}
+
+void OPPROTO op_rbit_T0(void)
+{
+    T0 =  ((T0 & 0xff000000) >> 24)
+        | ((T0 & 0x00ff0000) >> 8)
+        | ((T0 & 0x0000ff00) << 8)
+        | ((T0 & 0x000000ff) << 24);
+    T0 =  ((T0 & 0xf0f0f0f0) >> 4)
+        | ((T0 & 0x0f0f0f0f) << 4);
+    T0 =  ((T0 & 0x88888888) >> 3)
+        | ((T0 & 0x44444444) >> 1)
+        | ((T0 & 0x22222222) << 1)
+        | ((T0 & 0x11111111) << 3);
+}
+
+/* Swap low and high halfwords.  */
+void OPPROTO op_swap_half_T1(void)
+{
+    T1 = (T1 >> 16) | (T1 << 16);
+    FORCE_RET();
+}
+
+/* Dual 16-bit signed multiply.  */
+void OPPROTO op_mul_dual_T0_T1(void)
+{
+    int32_t low;
+    int32_t high;
+    low = (int32_t)(int16_t)T0 * (int32_t)(int16_t)T1;
+    high = (((int32_t)T0) >> 16) * (((int32_t)T1) >> 16);
+    T0 = low;
+    T1 = high;
+}
+
+void OPPROTO op_sel_T0_T1(void)
+{
+    uint32_t mask;
+    uint32_t flags;
+
+    flags = env->GE;
+    mask = 0;
+    if (flags & 1)
+        mask |= 0xff;
+    if (flags & 2)
+        mask |= 0xff00;
+    if (flags & 4)
+        mask |= 0xff0000;
+    if (flags & 8)
+        mask |= 0xff000000;
+    T0 = (T0 & mask) | (T1 & ~mask);
+    FORCE_RET();
+}
+
+void OPPROTO op_roundqd_T0_T1(void)
+{
+    T0 = T1 + ((uint32_t)T0 >> 31);
+}
+
+/* Signed saturation.  */
+static inline uint32_t do_ssat(int32_t val, int shift)
+{
+    int32_t top;
+    uint32_t mask;
+
+    shift = PARAM1;
+    top = val >> shift;
+    mask = (1u << shift) - 1;
+    if (top > 0) {
+        env->QF = 1;
+        return mask;
+    } else if (top < -1) {
+        env->QF = 1;
+        return ~mask;
+    }
+    return val;
+}
+
+/* Unsigned saturation.  */
+static inline uint32_t do_usat(int32_t val, int shift)
+{
+    uint32_t max;
+
+    shift = PARAM1;
+    max = (1u << shift) - 1;
+    if (val < 0) {
+        env->QF = 1;
+        return 0;
+    } else if (val > max) {
+        env->QF = 1;
+        return max;
+    }
+    return val;
+}
+
+/* Signed saturate.  */
+void OPPROTO op_ssat_T1(void)
+{
+    T0 = do_ssat(T0, PARAM1);
+    FORCE_RET();
+}
+
+/* Dual halfword signed saturate.  */
+void OPPROTO op_ssat16_T1(void)
+{
+    uint32_t res;
+
+    res = (uint16_t)do_ssat((int16_t)T0, PARAM1);
+    res |= do_ssat(((int32_t)T0) >> 16, PARAM1) << 16;
+    T0 = res;
+    FORCE_RET();
+}
+
+/* Unsigned saturate.  */
+void OPPROTO op_usat_T1(void)
+{
+    T0 = do_usat(T0, PARAM1);
+    FORCE_RET();
+}
+
+/* Dual halfword unsigned saturate.  */
+void OPPROTO op_usat16_T1(void)
+{
+    uint32_t res;
+
+    res = (uint16_t)do_usat((int16_t)T0, PARAM1);
+    res |= do_usat(((int32_t)T0) >> 16, PARAM1) << 16;
+    T0 = res;
+    FORCE_RET();
+}
+
+/* Dual 16-bit add.  */
+void OPPROTO op_add16_T1_T2(void)
+{
+    uint32_t mask;
+    mask = (T0 & T1) & 0x8000;
+    T0 ^= ~0x8000;
+    T1 ^= ~0x8000;
+    T0 = (T0 + T1) ^ mask;
+}
+
+static inline uint8_t do_usad(uint8_t a, uint8_t b)
+{
+    if (a > b)
+        return a - b;
+    else
+        return b - a;
+}
+
+/* Unsigned sum of absolute byte differences.  */
+void OPPROTO op_usad8_T0_T1(void)
+{
+    uint32_t sum;
+    sum = do_usad(T0, T1);
+    sum += do_usad(T0 >> 8, T1 >> 8);
+    sum += do_usad(T0 >> 16, T1 >>16);
+    sum += do_usad(T0 >> 24, T1 >> 24);
+    T0 = sum;
+}
+
+/* Thumb-2 instructions.  */
+
+/* Insert T1 into T0.  Result goes in T1.  */
+void OPPROTO op_bfi_T1_T0(void)
+{
+    int shift = PARAM1;
+    uint32_t mask = PARAM2;
+    uint32_t bits;
+
+    bits = (T1 << shift) & mask;
+    T1 = (T0 & ~mask) | bits;
+}
+
+/* Unsigned bitfield extract.  */
+void OPPROTO op_ubfx_T1(void)
+{
+    uint32_t shift = PARAM1;
+    uint32_t mask = PARAM2;
+
+    T1 >>= shift;
+    T1 &= mask;
+}
+
+/* Signed bitfield extract.  */
+void OPPROTO op_sbfx_T1(void)
+{
+    uint32_t shift = PARAM1;
+    uint32_t width = PARAM2;
+    int32_t val;
+
+    val = T1 << (32 - (shift + width));
+    T1 = val >> (32 - width);
+}
+
+void OPPROTO op_movtop_T0_im(void)
+{
+    T0 = (T0 & 0xffff) | PARAM1;
+}
+
+/* Used by table branch instructions.  */
+void OPPROTO op_jmp_T0_im(void)
+{
+    env->regs[15] = PARAM1 + (T0 << 1);
+}
+
+void OPPROTO op_set_condexec(void)
+{
+    env->condexec_bits = PARAM1;
+}
+
+void OPPROTO op_sdivl_T0_T1(void)
+{
+  int32_t num;
+  int32_t den;
+  num = T0;
+  den = T1;
+  if (den == 0)
+    T0 = 0;
+  else
+    T0 = num / den;
+  FORCE_RET();
+}
+
+void OPPROTO op_udivl_T0_T1(void)
+{
+  uint32_t num;
+  uint32_t den;
+  num = T0;
+  den = T1;
+  if (den == 0)
+    T0 = 0;
+  else
+    T0 = num / den;
+  FORCE_RET();
+}
+
+void OPPROTO op_movl_T1_r13_banked(void)
+{
+    T1 = helper_get_r13_banked(env, PARAM1);
+}
+
+void OPPROTO op_movl_r13_T1_banked(void)
+{
+    helper_set_r13_banked(env, PARAM1, T1);
+}
+
+void OPPROTO op_v7m_mrs_T0(void)
+{
+    T0 = helper_v7m_mrs(env, PARAM1);
+}
+
+void OPPROTO op_v7m_msr_T0(void)
+{
+    helper_v7m_msr(env, PARAM1, T0);
+}
+
+void OPPROTO op_movl_T0_sp(void)
+{
+    if (PARAM1 == env->v7m.current_sp)
+        T0 = env->regs[13];
+    else
+        T0 = env->v7m.other_sp;
+    FORCE_RET();
+}
+
+#include "op_neon.h"
+
 /* iwMMXt support */
 #include "op_iwmmxt.c"

Added: trunk/src/host/qemu-neo1973/target-arm/op_addsub.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-arm/op_addsub.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-arm/op_addsub.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,106 @@
+/*
+ * ARMv6 integer SIMD operations.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+
+#ifdef ARITH_GE
+#define DECLARE_GE uint32_t ge = 0
+#define SET_GE env->GE = ge
+#else
+#define DECLARE_GE do{}while(0)
+#define SET_GE do{}while(0)
+#endif
+
+#define RESULT(val, n, width) \
+    res |= ((uint32_t)(glue(glue(uint,width),_t))(val)) << (n * width)
+
+void OPPROTO glue(glue(op_,PFX),add16_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    ADD16(T0, T1, 0);
+    ADD16(T0 >> 16, T1 >> 16, 1);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+void OPPROTO glue(glue(op_,PFX),add8_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    ADD8(T0, T1, 0);
+    ADD8(T0 >> 8, T1 >> 8, 1);
+    ADD8(T0 >> 16, T1 >> 16, 2);
+    ADD8(T0 >> 24, T1 >> 24, 3);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+void OPPROTO glue(glue(op_,PFX),sub16_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    SUB16(T0, T1, 0);
+    SUB16(T0 >> 16, T1 >> 16, 1);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+void OPPROTO glue(glue(op_,PFX),sub8_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    SUB8(T0, T1, 0);
+    SUB8(T0 >> 8, T1 >> 8, 1);
+    SUB8(T0 >> 16, T1 >> 16, 2);
+    SUB8(T0 >> 24, T1 >> 24, 3);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+void OPPROTO glue(glue(op_,PFX),subaddx_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    ADD16(T0, T1, 0);
+    SUB16(T0 >> 16, T1 >> 16, 1);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+void OPPROTO glue(glue(op_,PFX),addsubx_T0_T1)(void)
+{
+    uint32_t res = 0;
+    DECLARE_GE;
+
+    SUB16(T0, T1, 0);
+    ADD16(T0 >> 16, T1 >> 16, 1);
+    SET_GE;
+    T0 = res;
+    FORCE_RET();
+}
+
+#undef DECLARE_GE
+#undef SET_GE
+#undef RESULT
+
+#undef ARITH_GE
+#undef PFX
+#undef ADD16
+#undef SUB16
+#undef ADD8
+#undef SUB8

Modified: trunk/src/host/qemu-neo1973/target-arm/op_helper.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-arm/op_helper.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-arm/op_helper.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1,7 +1,7 @@
 /*
  *  ARM helper routines
  *
- *  Copyright (c) 2005 CodeSourcery, LLC
+ *  Copyright (c) 2005-2007 CodeSourcery, LLC
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -175,6 +175,81 @@
     T0 |= vfp_exceptbits_from_host(i);
 }
 
+float32 helper_recps_f32(float32 a, float32 b)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 two = int32_to_float32(2, s);
+    return float32_sub(two, float32_mul(a, b, s), s);
+}
+
+float32 helper_rsqrts_f32(float32 a, float32 b)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 three = int32_to_float32(3, s);
+    return float32_sub(three, float32_mul(a, b, s), s);
+}
+
+/* TODO: The architecture specifies the value that the estimate functions
+   should return.  We return the exact reciprocal/root instead.  */
+float32 helper_recpe_f32(float32 a)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 one = int32_to_float32(1, s);
+    return float32_div(one, a, s);
+}
+
+float32 helper_rsqrte_f32(float32 a)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 one = int32_to_float32(1, s);
+    return float32_div(one, float32_sqrt(a, s), s);
+}
+
+uint32_t helper_recpe_u32(uint32_t a)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 tmp;
+    tmp = int32_to_float32(a, s);
+    tmp = float32_scalbn(tmp, -32, s);
+    tmp = helper_recpe_f32(tmp);
+    tmp = float32_scalbn(tmp, 31, s);
+    return float32_to_int32(tmp, s);
+}
+
+uint32_t helper_rsqrte_u32(uint32_t a)
+{
+    float_status *s = &env->vfp.fp_status;
+    float32 tmp;
+    tmp = int32_to_float32(a, s);
+    tmp = float32_scalbn(tmp, -32, s);
+    tmp = helper_rsqrte_f32(tmp);
+    tmp = float32_scalbn(tmp, 31, s);
+    return float32_to_int32(tmp, s);
+}
+
+void helper_neon_tbl(int rn, int maxindex)
+{
+    uint32_t val;
+    uint32_t mask;
+    uint32_t tmp;
+    int index;
+    int shift;
+    uint64_t *table;
+    table = (uint64_t *)&env->vfp.regs[rn];
+    val = 0;
+    mask = 0;
+    for (shift = 0; shift < 32; shift += 8) {
+        index = (T1 >> shift) & 0xff;
+        if (index <= maxindex) {
+            tmp = (table[index >> 3] >> (index & 7)) & 0xff;
+            val |= tmp << shift;
+        } else {
+            val |= T0 & (0xff << shift);
+        }
+    }
+    T0 = val;
+}
+
 #if !defined(CONFIG_USER_ONLY)
 
 #define MMUSUFFIX _mmu
@@ -204,7 +279,7 @@
 {
     TranslationBlock *tb;
     CPUState *saved_env;
-    target_phys_addr_t pc;
+    unsigned long pc;
     int ret;
 
     /* XXX: hack to restore env in all cases, even if not called from
@@ -215,7 +290,7 @@
     if (__builtin_expect(ret, 0)) {
         if (retaddr) {
             /* now we have a real cpu fault */
-            pc = (target_phys_addr_t)retaddr;
+            pc = (unsigned long)retaddr;
             tb = tb_find_pc(pc);
             if (tb) {
                 /* the PC is inside the translated code. It means that we have
@@ -227,5 +302,4 @@
     }
     env = saved_env;
 }
-
 #endif

Modified: trunk/src/host/qemu-neo1973/target-arm/op_mem.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-arm/op_mem.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-arm/op_mem.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -1,5 +1,6 @@
 /* ARM memory operations.  */
 
+void helper_ld(uint32_t);
 /* Load from address T1 into T0.  */
 #define MEM_LD_OP(name) \
 void OPPROTO glue(op_ld##name,MEMSUFFIX)(void) \
@@ -49,6 +50,64 @@
 
 #undef MEM_SWP_OP
 
+/* Load-locked, store exclusive.  */
+#define EXCLUSIVE_OP(suffix, ldsuffix) \
+void OPPROTO glue(op_ld##suffix##ex,MEMSUFFIX)(void) \
+{ \
+    cpu_lock(); \
+    helper_mark_exclusive(env, T1); \
+    T0 = glue(ld##ldsuffix,MEMSUFFIX)(T1); \
+    cpu_unlock(); \
+    FORCE_RET(); \
+} \
+ \
+void OPPROTO glue(op_st##suffix##ex,MEMSUFFIX)(void) \
+{ \
+    int failed; \
+    cpu_lock(); \
+    failed = helper_test_exclusive(env, T1); \
+    /* ??? Is it safe to hold the cpu lock over a store?  */ \
+    if (!failed) { \
+        glue(st##suffix,MEMSUFFIX)(T1, T0); \
+    } \
+    T0 = failed; \
+    cpu_unlock(); \
+    FORCE_RET(); \
+}
+
+EXCLUSIVE_OP(b, ub)
+EXCLUSIVE_OP(w, uw)
+EXCLUSIVE_OP(l, l)
+
+#undef EXCLUSIVE_OP
+
+/* Load exclusive T0:T1 from address T1.  */
+void OPPROTO glue(op_ldqex,MEMSUFFIX)(void)
+{
+    cpu_lock();
+    helper_mark_exclusive(env, T1);
+    T0 = glue(ldl,MEMSUFFIX)(T1);
+    T1 = glue(ldl,MEMSUFFIX)((T1 + 4));
+    cpu_unlock();
+    FORCE_RET();
+}
+
+/* Store exclusive T0:T2 to address T1.  */
+void OPPROTO glue(op_stqex,MEMSUFFIX)(void)
+{
+    int failed;
+    cpu_lock();
+    failed = helper_test_exclusive(env, T1);
+    /* ??? Is it safe to hold the cpu lock over a store?  */
+    if (!failed) {
+        glue(stl,MEMSUFFIX)(T1, T0);
+        glue(stl,MEMSUFFIX)((T1 + 4), T2);
+    }
+    T0 = failed;
+    cpu_unlock();
+    FORCE_RET();
+}
+
 /* Floating point load/store.  Address is in T1 */
 #define VFP_MEM_OP(p, w) \
 void OPPROTO glue(op_vfp_ld##p,MEMSUFFIX)(void) \

Added: trunk/src/host/qemu-neo1973/target-arm/op_neon.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-arm/op_neon.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-arm/op_neon.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -0,0 +1,1754 @@
+/*
+ * ARM NEON vector operations.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licenced under the GPL.
+ */
+/* Note that for NEON an "l" prefix means it is a wide operation, unlike
+   scalar arm ops where it means a word size operation.  */
+
+/* ??? NEON ops should probably have their own float status.  */
+#define NFS &env->vfp.fp_status
+#define NEON_OP(name) void OPPROTO op_neon_##name (void)
+
+NEON_OP(getreg_T0)
+{
+    T0 = *(uint32_t *)((char *) env + PARAM1);
+}
+
+NEON_OP(getreg_T1)
+{
+    T1 = *(uint32_t *)((char *) env + PARAM1);
+}
+
+NEON_OP(getreg_T2)
+{
+    T2 = *(uint32_t *)((char *) env + PARAM1);
+}
+
+NEON_OP(setreg_T0)
+{
+    *(uint32_t *)((char *) env + PARAM1) = T0;
+}
+
+NEON_OP(setreg_T1)
+{
+    *(uint32_t *)((char *) env + PARAM1) = T1;
+}
+
+NEON_OP(setreg_T2)
+{
+    *(uint32_t *)((char *) env + PARAM1) = T2;
+}
+
+#define NEON_TYPE1(name, type) \
+typedef struct \
+{ \
+    type v1; \
+} neon_##name;
+#ifdef WORDS_BIGENDIAN
+#define NEON_TYPE2(name, type) \
+typedef struct \
+{ \
+    type v2; \
+    type v1; \
+} neon_##name;
+#define NEON_TYPE4(name, type) \
+typedef struct \
+{ \
+    type v4; \
+    type v3; \
+    type v2; \
+    type v1; \
+} neon_##name;
+#else
+#define NEON_TYPE2(name, type) \
+typedef struct \
+{ \
+    type v1; \
+    type v2; \
+} neon_##name;
+#define NEON_TYPE4(name, type) \
+typedef struct \
+{ \
+    type v1; \
+    type v2; \
+    type v3; \
+    type v4; \
+} neon_##name;
+#endif
+
+NEON_TYPE4(s8, int8_t)
+NEON_TYPE4(u8, uint8_t)
+NEON_TYPE2(s16, int16_t)
+NEON_TYPE2(u16, uint16_t)
+NEON_TYPE1(s32, int32_t)
+NEON_TYPE1(u32, uint32_t)
+#undef NEON_TYPE4
+#undef NEON_TYPE2
+#undef NEON_TYPE1
+
+/* Copy from a uint32_t to a vector structure type.  */
+#define NEON_UNPACK(vtype, dest, val) do { \
+    union { \
+        vtype v; \
+        uint32_t i; \
+    } conv_u; \
+    conv_u.i = (val); \
+    dest = conv_u.v; \
+    } while(0)
+
+/* Copy from a vector structure type to a uint32_t.  */
+#define NEON_PACK(vtype, dest, val) do { \
+    union { \
+        vtype v; \
+        uint32_t i; \
+    } conv_u; \
+    conv_u.v = (val); \
+    dest = conv_u.i; \
+    } while(0)
+
+#define NEON_DO1 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc2.v1);
+#define NEON_DO2 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc2.v1); \
+    NEON_FN(vdest.v2, vsrc1.v2, vsrc2.v2);
+#define NEON_DO4 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc2.v1); \
+    NEON_FN(vdest.v2, vsrc1.v2, vsrc2.v2); \
+    NEON_FN(vdest.v3, vsrc1.v3, vsrc2.v3); \
+    NEON_FN(vdest.v4, vsrc1.v4, vsrc2.v4);
+
+#define NEON_VOP(name, vtype, n) \
+NEON_OP(name) \
+{ \
+    vtype vsrc1; \
+    vtype vsrc2; \
+    vtype vdest; \
+    NEON_UNPACK(vtype, vsrc1, T0); \
+    NEON_UNPACK(vtype, vsrc2, T1); \
+    NEON_DO##n; \
+    NEON_PACK(vtype, T0, vdest); \
+    FORCE_RET(); \
+}
+
+#define NEON_VOP1(name, vtype, n) \
+NEON_OP(name) \
+{ \
+    vtype vsrc1; \
+    vtype vdest; \
+    NEON_UNPACK(vtype, vsrc1, T0); \
+    NEON_DO##n; \
+    NEON_PACK(vtype, T0, vdest); \
+    FORCE_RET(); \
+}
+
+/* Pairwise operations.  */
+/* For 32-bit elements each segment only contains a single element, so
+   the elementwise and pairwise operations are the same.  */
+#define NEON_PDO2 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc1.v2); \
+    NEON_FN(vdest.v2, vsrc2.v1, vsrc2.v2);
+#define NEON_PDO4 \
+    NEON_FN(vdest.v1, vsrc1.v1, vsrc1.v2); \
+    NEON_FN(vdest.v2, vsrc1.v3, vsrc1.v4); \
+    NEON_FN(vdest.v3, vsrc2.v1, vsrc2.v2); \
+    NEON_FN(vdest.v4, vsrc2.v3, vsrc2.v4); \
+
+#define NEON_POP(name, vtype, n) \
+NEON_OP(name) \
+{ \
+    vtype vsrc1; \
+    vtype vsrc2; \
+    vtype vdest; \
+    NEON_UNPACK(vtype, vsrc1, T0); \
+    NEON_UNPACK(vtype, vsrc2, T1); \
+    NEON_PDO##n; \
+    NEON_PACK(vtype, T0, vdest); \
+    FORCE_RET(); \
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 + src2) >> 1
+NEON_VOP(hadd_s8, neon_s8, 4)
+NEON_VOP(hadd_u8, neon_u8, 4)
+NEON_VOP(hadd_s16, neon_s16, 2)
+NEON_VOP(hadd_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(hadd_s32)
+{
+    int32_t src1 = T0;
+    int32_t src2 = T1;
+    int32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if (src1 & src2 & 1)
+        dest++;
+    T0 = dest;
+    FORCE_RET();
+}
+
+NEON_OP(hadd_u32)
+{
+    uint32_t src1 = T0;
+    uint32_t src2 = T1;
+    uint32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if (src1 & src2 & 1)
+        dest++;
+    T0 = dest;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 + src2 + 1) >> 1
+NEON_VOP(rhadd_s8, neon_s8, 4)
+NEON_VOP(rhadd_u8, neon_u8, 4)
+NEON_VOP(rhadd_s16, neon_s16, 2)
+NEON_VOP(rhadd_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(rhadd_s32)
+{
+    int32_t src1 = T0;
+    int32_t src2 = T1;
+    int32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if ((src1 | src2) & 1)
+        dest++;
+    T0 = dest;
+    FORCE_RET();
+}
+
+NEON_OP(rhadd_u32)
+{
+    uint32_t src1 = T0;
+    uint32_t src2 = T1;
+    uint32_t dest;
+
+    dest = (src1 >> 1) + (src2 >> 1);
+    if ((src1 | src2) & 1)
+        dest++;
+    T0 = dest;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 - src2) >> 1
+NEON_VOP(hsub_s8, neon_s8, 4)
+NEON_VOP(hsub_u8, neon_u8, 4)
+NEON_VOP(hsub_s16, neon_s16, 2)
+NEON_VOP(hsub_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(hsub_s32)
+{
+    int32_t src1 = T0;
+    int32_t src2 = T1;
+    int32_t dest;
+
+    dest = (src1 >> 1) - (src2 >> 1);
+    if ((~src1) & src2 & 1)
+        dest--;
+    T0 = dest;
+    FORCE_RET();
+}
+
+NEON_OP(hsub_u32)
+{
+    uint32_t src1 = T0;
+    uint32_t src2 = T1;
+    uint32_t dest;
+
+    dest = (src1 >> 1) - (src2 >> 1);
+    if ((~src1) & src2 & 1)
+        dest--;
+    T0 = dest;
+    FORCE_RET();
+}
+
+/* ??? bsl, bif and bit are all the same op, just with the oparands in a
+   differnet order.  It's currently easier to have 3 differnt ops than
+   rearange the operands.  */
+
+/* Bitwise Select.  */
+NEON_OP(bsl)
+{
+    T0 = (T0 & T2) | (T1 & ~T2);
+}
+
+/* Bitwise Insert If True.  */
+NEON_OP(bit)
+{
+    T0 = (T0 & T1) | (T2 & ~T1);
+}
+
+/* Bitwise Insert If False.  */
+NEON_OP(bif)
+{
+    T0 = (T2 & T1) | (T0 & ~T1);
+}
+
+#define NEON_USAT(dest, src1, src2, type) do { \
+    uint32_t tmp = (uint32_t)src1 + (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        env->QF = 1; \
+        dest = ~0; \
+    } else { \
+        dest = tmp; \
+    }} while(0)
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint8_t)
+NEON_VOP(qadd_u8, neon_u8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint16_t)
+NEON_VOP(qadd_u16, neon_u16, 2)
+#undef NEON_FN
+#undef NEON_USAT
+
+#define NEON_SSAT(dest, src1, src2, type) do { \
+    int32_t tmp = (uint32_t)src1 + (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        env->QF = 1; \
+        if (src2 > 0) { \
+            tmp = (1 << (sizeof(type) * 8 - 1)) - 1; \
+        } else { \
+            tmp = 1 << (sizeof(type) * 8 - 1); \
+        } \
+    } \
+    dest = tmp; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int8_t)
+NEON_VOP(qadd_s8, neon_s8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int16_t)
+NEON_VOP(qadd_s16, neon_s16, 2)
+#undef NEON_FN
+#undef NEON_SSAT
+
+#define NEON_USAT(dest, src1, src2, type) do { \
+    uint32_t tmp = (uint32_t)src1 - (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        env->QF = 1; \
+        dest = 0; \
+    } else { \
+        dest = tmp; \
+    }} while(0)
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint8_t)
+NEON_VOP(qsub_u8, neon_u8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_USAT(dest, src1, src2, uint16_t)
+NEON_VOP(qsub_u16, neon_u16, 2)
+#undef NEON_FN
+#undef NEON_USAT
+
+#define NEON_SSAT(dest, src1, src2, type) do { \
+    int32_t tmp = (uint32_t)src1 - (uint32_t)src2; \
+    if (tmp != (type)tmp) { \
+        env->QF = 1; \
+        if (src2 < 0) { \
+            tmp = (1 << (sizeof(type) * 8 - 1)) - 1; \
+        } else { \
+            tmp = 1 << (sizeof(type) * 8 - 1); \
+        } \
+    } \
+    dest = tmp; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int8_t)
+NEON_VOP(qsub_s8, neon_s8, 4)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_SSAT(dest, src1, src2, int16_t)
+NEON_VOP(qsub_s16, neon_s16, 2)
+#undef NEON_FN
+#undef NEON_SSAT
+
+#define NEON_FN(dest, src1, src2) dest = (src1 > src2) ? ~0 : 0
+NEON_VOP(cgt_s8, neon_s8, 4)
+NEON_VOP(cgt_u8, neon_u8, 4)
+NEON_VOP(cgt_s16, neon_s16, 2)
+NEON_VOP(cgt_u16, neon_u16, 2)
+NEON_VOP(cgt_s32, neon_s32, 1)
+NEON_VOP(cgt_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = (src1 >= src2) ? ~0 : 0
+NEON_VOP(cge_s8, neon_s8, 4)
+NEON_VOP(cge_u8, neon_u8, 4)
+NEON_VOP(cge_s16, neon_s16, 2)
+NEON_VOP(cge_u16, neon_u16, 2)
+NEON_VOP(cge_s32, neon_s32, 1)
+NEON_VOP(cge_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src2; \
+    if (tmp < 0) { \
+        dest = src1 >> -tmp; \
+    } else { \
+        dest = src1 << tmp; \
+    }} while (0)
+NEON_VOP(shl_s8, neon_s8, 4)
+NEON_VOP(shl_u8, neon_u8, 4)
+NEON_VOP(shl_s16, neon_s16, 2)
+NEON_VOP(shl_u16, neon_u16, 2)
+NEON_VOP(shl_s32, neon_s32, 1)
+NEON_VOP(shl_u32, neon_u32, 1)
+#undef NEON_FN
+
+NEON_OP(shl_u64)
+{
+    int8_t shift = T2;
+    uint64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val >>= -shift;
+    } else {
+        val <<= shift;
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+NEON_OP(shl_s64)
+{
+    int8_t shift = T2;
+    int64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val >>= -shift;
+    } else {
+        val <<= shift;
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src1; \
+    if (tmp < 0) { \
+        dest = (src2 + (1 << (-1 - tmp))) >> -tmp; \
+    } else { \
+        dest = src2 << tmp; \
+    }} while (0)
+
+NEON_VOP(rshl_s8, neon_s8, 4)
+NEON_VOP(rshl_u8, neon_u8, 4)
+NEON_VOP(rshl_s16, neon_s16, 2)
+NEON_VOP(rshl_u16, neon_u16, 2)
+NEON_VOP(rshl_s32, neon_s32, 1)
+NEON_VOP(rshl_u32, neon_u32, 1)
+#undef NEON_FN
+
+NEON_OP(rshl_u64)
+{
+    int8_t shift = T2;
+    uint64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val = (val + ((uint64_t)1 << (-1 - shift))) >> -shift;
+        val >>= -shift;
+    } else {
+        val <<= shift;
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+NEON_OP(rshl_s64)
+{
+    int8_t shift = T2;
+    int64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val = (val + ((int64_t)1 << (-1 - shift))) >> -shift;
+    } else {
+        val <<= shift;
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src1; \
+    if (tmp < 0) { \
+        dest = src2 >> -tmp; \
+    } else { \
+        dest = src2 << tmp; \
+        if ((dest >> tmp) != src2) { \
+            env->QF = 1; \
+            dest = ~0; \
+        } \
+    }} while (0)
+NEON_VOP(qshl_s8, neon_s8, 4)
+NEON_VOP(qshl_s16, neon_s16, 2)
+NEON_VOP(qshl_s32, neon_s32, 1)
+#undef NEON_FN
+
+NEON_OP(qshl_s64)
+{
+    int8_t shift = T2;
+    int64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val >>= -shift;
+    } else {
+        int64_t tmp = val;
+        val <<= shift;
+        if ((val >> shift) != tmp) {
+            env->QF = 1;
+            val = (tmp >> 63) ^ 0x7fffffffffffffffULL;
+        }
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src1; \
+    if (tmp < 0) { \
+        dest = src2 >> -tmp; \
+    } else { \
+        dest = src2 << tmp; \
+        if ((dest >> tmp) != src2) { \
+            env->QF = 1; \
+            dest = src2 >> 31; \
+        } \
+    }} while (0)
+NEON_VOP(qshl_u8, neon_u8, 4)
+NEON_VOP(qshl_u16, neon_u16, 2)
+NEON_VOP(qshl_u32, neon_u32, 1)
+#undef NEON_FN
+
+NEON_OP(qshl_u64)
+{
+    int8_t shift = T2;
+    uint64_t val = T0 | ((uint64_t)T1 << 32);
+    if (shift < 0) {
+        val >>= -shift;
+    } else {
+        uint64_t tmp = val;
+        val <<= shift;
+        if ((val >> shift) != tmp) {
+            env->QF = 1;
+            val = ~(uint64_t)0;
+        }
+    }
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src1; \
+    if (tmp < 0) { \
+        dest = (src2 + (1 << (-1 - tmp))) >> -tmp; \
+    } else { \
+        dest = src2 << tmp; \
+        if ((dest >> tmp) != src2) { \
+            dest = ~0; \
+        } \
+    }} while (0)
+NEON_VOP(qrshl_s8, neon_s8, 4)
+NEON_VOP(qrshl_s16, neon_s16, 2)
+NEON_VOP(qrshl_s32, neon_s32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) do { \
+    int8_t tmp; \
+    tmp = (int8_t)src1; \
+    if (tmp < 0) { \
+        dest = (src2 + (1 << (-1 - tmp))) >> -tmp; \
+    } else { \
+        dest = src2 << tmp; \
+        if ((dest >> tmp) != src2) { \
+            env->QF = 1; \
+            dest = src2 >> 31; \
+        } \
+    }} while (0)
+NEON_VOP(qrshl_u8, neon_u8, 4)
+NEON_VOP(qrshl_u16, neon_u16, 2)
+NEON_VOP(qrshl_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = (src1 > src2) ? src1 : src2
+NEON_VOP(max_s8, neon_s8, 4)
+NEON_VOP(max_u8, neon_u8, 4)
+NEON_VOP(max_s16, neon_s16, 2)
+NEON_VOP(max_u16, neon_u16, 2)
+NEON_VOP(max_s32, neon_s32, 1)
+NEON_VOP(max_u32, neon_u32, 1)
+NEON_POP(pmax_s8, neon_s8, 4)
+NEON_POP(pmax_u8, neon_u8, 4)
+NEON_POP(pmax_s16, neon_s16, 2)
+NEON_POP(pmax_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(max_f32)
+{
+    float32 f0 = vfp_itos(T0);
+    float32 f1 = vfp_itos(T1);
+    T0 = (float32_compare_quiet(f0, f1, NFS) == 1) ? T0 : T1;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 < src2) ? src1 : src2
+NEON_VOP(min_s8, neon_s8, 4)
+NEON_VOP(min_u8, neon_u8, 4)
+NEON_VOP(min_s16, neon_s16, 2)
+NEON_VOP(min_u16, neon_u16, 2)
+NEON_VOP(min_s32, neon_s32, 1)
+NEON_VOP(min_u32, neon_u32, 1)
+NEON_POP(pmin_s8, neon_s8, 4)
+NEON_POP(pmin_u8, neon_u8, 4)
+NEON_POP(pmin_s16, neon_s16, 2)
+NEON_POP(pmin_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(min_f32)
+{
+    float32 f0 = vfp_itos(T0);
+    float32 f1 = vfp_itos(T1);
+    T0 = (float32_compare_quiet(f0, f1, NFS) == -1) ? T0 : T1;
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) \
+    dest = (src1 > src2) ? (src1 - src2) : (src2 - src1)
+NEON_VOP(abd_s8, neon_s8, 4)
+NEON_VOP(abd_u8, neon_u8, 4)
+NEON_VOP(abd_s16, neon_s16, 2)
+NEON_VOP(abd_u16, neon_u16, 2)
+NEON_VOP(abd_s32, neon_s32, 1)
+NEON_VOP(abd_u32, neon_u32, 1)
+#undef NEON_FN
+
+NEON_OP(abd_f32)
+{
+    float32 f0 = vfp_itos(T0);
+    float32 f1 = vfp_itos(T1);
+    T0 = vfp_stoi((float32_compare_quiet(f0, f1, NFS) == 1)
+                  ? float32_sub(f0, f1, NFS)
+                  : float32_sub(f1, f0, NFS));
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = src1 + src2
+NEON_VOP(add_u8, neon_u8, 4)
+NEON_VOP(add_u16, neon_u16, 2)
+NEON_POP(padd_u8, neon_u8, 4)
+NEON_POP(padd_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(add_f32)
+{
+    T0 = vfp_stoi(float32_add(vfp_itos(T0), vfp_itos(T1), NFS));
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = src1 - src2
+NEON_VOP(sub_u8, neon_u8, 4)
+NEON_VOP(sub_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(sub_f32)
+{
+    T0 = vfp_stoi(float32_sub(vfp_itos(T0), vfp_itos(T1), NFS));
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = src2 - src1
+NEON_VOP(rsb_u8, neon_u8, 4)
+NEON_VOP(rsb_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(rsb_f32)
+{
+    T0 = vfp_stoi(float32_sub(vfp_itos(T1), vfp_itos(T0), NFS));
+    FORCE_RET();
+}
+
+#define NEON_FN(dest, src1, src2) dest = src1 * src2
+NEON_VOP(mul_u8, neon_u8, 4)
+NEON_VOP(mul_u16, neon_u16, 2)
+#undef NEON_FN
+
+NEON_OP(mul_f32)
+{
+    T0 = vfp_stoi(float32_mul(vfp_itos(T0), vfp_itos(T1), NFS));
+    FORCE_RET();
+}
+
+NEON_OP(mul_p8)
+{
+    T0 = helper_neon_mul_p8(T0, T1);
+}
+
+#define NEON_FN(dest, src1, src2) dest = (src1 & src2) ? -1 : 0
+NEON_VOP(tst_u8, neon_u8, 4)
+NEON_VOP(tst_u16, neon_u16, 2)
+NEON_VOP(tst_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_FN(dest, src1, src2) dest = (src1 == src2) ? -1 : 0
+NEON_VOP(ceq_u8, neon_u8, 4)
+NEON_VOP(ceq_u16, neon_u16, 2)
+NEON_VOP(ceq_u32, neon_u32, 1)
+#undef NEON_FN
+
+#define NEON_QDMULH16(dest, src1, src2, round) do { \
+    uint32_t tmp = (int32_t)(int16_t) src1 * (int16_t) src2; \
+    if ((tmp ^ (tmp << 1)) & SIGNBIT) { \
+        env->QF = 1; \
+        tmp = (tmp >> 31) ^ ~SIGNBIT; \
+    } \
+    tmp <<= 1; \
+    if (round) { \
+        int32_t old = tmp; \
+        tmp += 1 << 15; \
+        if ((int32_t)tmp < old) { \
+            env->QF = 1; \
+            tmp = SIGNBIT - 1; \
+        } \
+    } \
+    dest = tmp >> 16; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_QDMULH16(dest, src1, src2, 0)
+NEON_VOP(qdmulh_s16, neon_s16, 2)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_QDMULH16(dest, src1, src2, 1)
+NEON_VOP(qrdmulh_s16, neon_s16, 2)
+#undef NEON_FN
+#undef NEON_QDMULH16
+
+#define SIGNBIT64 ((uint64_t)1 << 63)
+#define NEON_QDMULH32(dest, src1, src2, round) do { \
+    uint64_t tmp = (int64_t)(int32_t) src1 * (int32_t) src2; \
+    if ((tmp ^ (tmp << 1)) & SIGNBIT64) { \
+        env->QF = 1; \
+        tmp = (tmp >> 63) ^ ~SIGNBIT64; \
+    } else { \
+        tmp <<= 1; \
+    } \
+    if (round) { \
+        int64_t old = tmp; \
+        tmp += (int64_t)1 << 31; \
+        if ((int64_t)tmp < old) { \
+            env->QF = 1; \
+            tmp = SIGNBIT64 - 1; \
+        } \
+    } \
+    dest = tmp >> 32; \
+    } while(0)
+#define NEON_FN(dest, src1, src2) NEON_QDMULH32(dest, src1, src2, 0)
+NEON_VOP(qdmulh_s32, neon_s32, 1)
+#undef NEON_FN
+#define NEON_FN(dest, src1, src2) NEON_QDMULH32(dest, src1, src2, 1)
+NEON_VOP(qrdmulh_s32, neon_s32, 1)
+#undef NEON_FN
+#undef NEON_QDMULH32
+
+NEON_OP(recps_f32)
+{
+    T0 = vfp_stoi(helper_recps_f32(vfp_itos(T0), vfp_itos(T1)));
+    FORCE_RET();
+}
+
+NEON_OP(rsqrts_f32)
+{
+    T0 = vfp_stoi(helper_rsqrts_f32(vfp_itos(T0), vfp_itos(T1)));
+    FORCE_RET();
+}
+
+/* Floating point comparisons produce an integer result.  */
+#define NEON_VOP_FCMP(name, cmp) \
+NEON_OP(name) \
+{ \
+    if (float32_compare_quiet(vfp_itos(T0), vfp_itos(T1), NFS) cmp 0) \
+        T0 = -1; \
+    else \
+        T0 = 0; \
+    FORCE_RET(); \
+}
+
+NEON_VOP_FCMP(ceq_f32, ==)
+NEON_VOP_FCMP(cge_f32, >=)
+NEON_VOP_FCMP(cgt_f32, >)
+
+NEON_OP(acge_f32)
+{
+    float32 f0 = float32_abs(vfp_itos(T0));
+    float32 f1 = float32_abs(vfp_itos(T1));
+    T0 = (float32_compare_quiet(f0, f1,NFS) >= 0) ? -1 : 0;
+    FORCE_RET();
+}
+
+NEON_OP(acgt_f32)
+{
+    float32 f0 = float32_abs(vfp_itos(T0));
+    float32 f1 = float32_abs(vfp_itos(T1));
+    T0 = (float32_compare_quiet(f0, f1, NFS) > 0) ? -1 : 0;
+    FORCE_RET();
+}
+
+/* Narrowing instructions.  The named type is the destination type.  */
+NEON_OP(narrow_u8)
+{
+    T0 = (T0 & 0xff) | ((T0 >> 8) & 0xff00)
+         | ((T1 << 16) & 0xff0000) | (T1 << 24);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_sat_u8)
+{
+    neon_u16 src;
+    neon_u8 dest;
+#define SAT8(d, s) \
+    if (s > 0xff) { \
+        d = 0xff; \
+        env->QF = 1; \
+    } else  { \
+        d = s; \
+    }
+
+    NEON_UNPACK(neon_u16, src, T0);
+    SAT8(dest.v1, src.v1);
+    SAT8(dest.v2, src.v2);
+    NEON_UNPACK(neon_u16, src, T1);
+    SAT8(dest.v3, src.v1);
+    SAT8(dest.v4, src.v2);
+    NEON_PACK(neon_u8, T0, dest);
+    FORCE_RET();
+#undef SAT8
+}
+
+NEON_OP(narrow_sat_s8)
+{
+    neon_s16 src;
+    neon_s8 dest;
+#define SAT8(d, s) \
+    if (s != (uint8_t)s) { \
+        d = (s >> 15) ^ 0x7f; \
+        env->QF = 1; \
+    } else  { \
+        d = s; \
+    }
+
+    NEON_UNPACK(neon_s16, src, T0);
+    SAT8(dest.v1, src.v1);
+    SAT8(dest.v2, src.v2);
+    NEON_UNPACK(neon_s16, src, T1);
+    SAT8(dest.v3, src.v1);
+    SAT8(dest.v4, src.v2);
+    NEON_PACK(neon_s8, T0, dest);
+    FORCE_RET();
+#undef SAT8
+}
+
+NEON_OP(narrow_u16)
+{
+    T0 = (T0 & 0xffff) | (T1 << 16);
+}
+
+NEON_OP(narrow_sat_u16)
+{
+    if (T0 > 0xffff) {
+        T0 = 0xffff;
+        env->QF = 1;
+    }
+    if (T1 > 0xffff) {
+        T1 = 0xffff;
+        env->QF = 1;
+    }
+    T0 |= T1 << 16;
+    FORCE_RET();
+}
+
+NEON_OP(narrow_sat_s16)
+{
+    if ((int32_t)T0 != (int16_t)T0) {
+        T0 = ((int32_t)T0 >> 31) ^ 0x7fff;
+        env->QF = 1;
+    }
+    if ((int32_t)T1 != (int16_t) T1) {
+        T1 = ((int32_t)T1 >> 31) ^ 0x7fff;
+        env->QF = 1;
+    }
+    T0 = (uint16_t)T0 | (T1 << 16);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_sat_u32)
+{
+    if (T1) {
+        T0 = 0xffffffffu;
+        env->QF = 1;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(narrow_sat_s32)
+{
+    int32_t sign = (int32_t)T1 >> 31;
+
+    if ((int32_t)T1 != sign) {
+        T0 = sign ^ 0x7fffffff;
+        env->QF = 1;
+    }
+    FORCE_RET();
+}
+
+/* Narrowing instructions.  Named type is the narrow type.  */
+NEON_OP(narrow_high_u8)
+{
+    T0 = ((T0 >> 8) & 0xff) | ((T0 >> 16) & 0xff00)
+        | ((T1 << 8) & 0xff0000) | (T1 & 0xff000000);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_high_u16)
+{
+    T0 = (T0 >> 16) | (T1 & 0xffff0000);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_high_round_u8)
+{
+    T0 = (((T0 + 0x80) >> 8) & 0xff) | (((T0 + 0x800000) >> 16) & 0xff00)
+        | (((T1 + 0x80) << 8) & 0xff0000) | ((T1 + 0x800000) & 0xff000000);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_high_round_u16)
+{
+    T0 = ((T0 + 0x8000) >> 16) | ((T1 + 0x8000) & 0xffff0000);
+    FORCE_RET();
+}
+
+NEON_OP(narrow_high_round_u32)
+{
+    if (T0 >= 0x80000000u)
+        T0 = T1 + 1;
+    else
+        T0 = T1;
+    FORCE_RET();
+}
+
+/* Widening instructions.  Named type is source type.  */
+NEON_OP(widen_s8)
+{
+    uint32_t src;
+
+    src = T0;
+    T0 = (uint16_t)(int8_t)src | ((int8_t)(src >> 8) << 16);
+    T1 = (uint16_t)(int8_t)(src >> 16) | ((int8_t)(src >> 24) << 16);
+}
+
+NEON_OP(widen_u8)
+{
+    T1 = ((T0 >> 8) & 0xff0000) | ((T0 >> 16) & 0xff);
+    T0 = ((T0 << 8) & 0xff0000) | (T0 & 0xff);
+}
+
+NEON_OP(widen_s16)
+{
+    int32_t src;
+
+    src = T0;
+    T0 = (int16_t)src;
+    T1 = src >> 16;
+}
+
+NEON_OP(widen_u16)
+{
+    T1 = T0 >> 16;
+    T0 &= 0xffff;
+}
+
+NEON_OP(widen_s32)
+{
+    T1 = (int32_t)T0 >> 31;
+    FORCE_RET();
+}
+
+NEON_OP(widen_high_u8)
+{
+    T1 = (T0 & 0xff000000) | ((T0 >> 8) & 0xff00);
+    T0 = ((T0 << 16) & 0xff000000) | ((T0 << 8) & 0xff00);
+}
+
+NEON_OP(widen_high_u16)
+{
+    T1 = T0 & 0xffff0000;
+    T0 <<= 16;
+}
+
+/* Long operations.  The type is the wide type.  */
+NEON_OP(shll_u16)
+{
+    int shift = PARAM1;
+    uint32_t mask;
+
+    mask = 0xffff >> (16 - shift);
+    mask |= mask << 16;
+    mask = ~mask;
+
+    T0 = (T0 << shift) & mask;
+    T1 = (T1 << shift) & mask;
+    FORCE_RET();
+}
+
+NEON_OP(shll_u64)
+{
+    int shift = PARAM1;
+
+    T1 <<= shift;
+    T1 |= T0 >> (32 - shift);
+    T0 <<= shift;
+    FORCE_RET();
+}
+
+NEON_OP(addl_u16)
+{
+    uint32_t tmp;
+    uint32_t high;
+
+    tmp = env->vfp.scratch[0];
+    high = (T0 >> 16) + (tmp >> 16);
+    T0 = (uint16_t)(T0 + tmp);
+    T0 |= (high << 16);
+    tmp = env->vfp.scratch[1];
+    high = (T1 >> 16) + (tmp >> 16);
+    T1 = (uint16_t)(T1 + tmp);
+    T1 |= (high << 16);
+    FORCE_RET();
+}
+
+NEON_OP(addl_u32)
+{
+    T0 += env->vfp.scratch[0];
+    T1 += env->vfp.scratch[1];
+    FORCE_RET();
+}
+
+NEON_OP(addl_u64)
+{
+    uint64_t tmp;
+    tmp = T0 | ((uint64_t)T1 << 32);
+    tmp += env->vfp.scratch[0];
+    tmp += (uint64_t)env->vfp.scratch[1] << 32;
+    T0 = tmp;
+    T1 = tmp >> 32;
+    FORCE_RET();
+}
+
+NEON_OP(subl_u16)
+{
+    uint32_t tmp;
+    uint32_t high;
+
+    tmp = env->vfp.scratch[0];
+    high = (T0 >> 16) - (tmp >> 16);
+    T0 = (uint16_t)(T0 - tmp);
+    T0 |= (high << 16);
+    tmp = env->vfp.scratch[1];
+    high = (T1 >> 16) - (tmp >> 16);
+    T1 = (uint16_t)(T1 - tmp);
+    T1 |= (high << 16);
+    FORCE_RET();
+}
+
+NEON_OP(subl_u32)
+{
+    T0 -= env->vfp.scratch[0];
+    T1 -= env->vfp.scratch[1];
+    FORCE_RET();
+}
+
+NEON_OP(subl_u64)
+{
+    uint64_t tmp;
+    tmp = T0 | ((uint64_t)T1 << 32);
+    tmp -= env->vfp.scratch[0];
+    tmp -= (uint64_t)env->vfp.scratch[1] << 32;
+    T0 = tmp;
+    T1 = tmp >> 32;
+    FORCE_RET();
+}
+
+#define DO_ABD(dest, x, y, type) do { \
+    type tmp_x = x; \
+    type tmp_y = y; \
+    dest = ((tmp_x > tmp_y) ? tmp_x - tmp_y : tmp_y - tmp_x); \
+    } while(0)
+
+NEON_OP(abdl_u16)
+{
+    uint32_t tmp;
+    uint32_t low;
+    uint32_t high;
+
+    DO_ABD(low, T0, T1, uint8_t);
+    DO_ABD(tmp, T0 >> 8, T1 >> 8, uint8_t);
+    low |= tmp << 16;
+    DO_ABD(high, T0 >> 16, T1 >> 16, uint8_t);
+    DO_ABD(tmp, T0 >> 24, T1 >> 24, uint8_t);
+    high |= tmp << 16;
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(abdl_s16)
+{
+    uint32_t tmp;
+    uint32_t low;
+    uint32_t high;
+
+    DO_ABD(low, T0, T1, int8_t);
+    DO_ABD(tmp, T0 >> 8, T1 >> 8, int8_t);
+    low |= tmp << 16;
+    DO_ABD(high, T0 >> 16, T1 >> 16, int8_t);
+    DO_ABD(tmp, T0 >> 24, T1 >> 24, int8_t);
+    high |= tmp << 16;
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(abdl_u32)
+{
+    uint32_t low;
+    uint32_t high;
+
+    DO_ABD(low, T0, T1, uint16_t);
+    DO_ABD(high, T0 >> 16, T1 >> 16, uint16_t);
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(abdl_s32)
+{
+    uint32_t low;
+    uint32_t high;
+
+    DO_ABD(low, T0, T1, int16_t);
+    DO_ABD(high, T0 >> 16, T1 >> 16, int16_t);
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(abdl_u64)
+{
+    DO_ABD(T0, T0, T1, uint32_t);
+    T1 = 0;
+}
+
+NEON_OP(abdl_s64)
+{
+    DO_ABD(T0, T0, T1, int32_t);
+    T1 = 0;
+}
+#undef DO_ABD
+
+/* Widening multiple. Named type is the source type.  */
+#define DO_MULL(dest, x, y, type1, type2) do { \
+    type1 tmp_x = x; \
+    type1 tmp_y = y; \
+    dest = (type2)((type2)tmp_x * (type2)tmp_y); \
+    } while(0)
+
+NEON_OP(mull_u8)
+{
+    uint32_t tmp;
+    uint32_t low;
+    uint32_t high;
+
+    DO_MULL(low, T0, T1, uint8_t, uint16_t);
+    DO_MULL(tmp, T0 >> 8, T1 >> 8, uint8_t, uint16_t);
+    low |= tmp << 16;
+    DO_MULL(high, T0 >> 16, T1 >> 16, uint8_t, uint16_t);
+    DO_MULL(tmp, T0 >> 24, T1 >> 24, uint8_t, uint16_t);
+    high |= tmp << 16;
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(mull_s8)
+{
+    uint32_t tmp;
+    uint32_t low;
+    uint32_t high;
+
+    DO_MULL(low, T0, T1, int8_t, uint16_t);
+    DO_MULL(tmp, T0 >> 8, T1 >> 8, int8_t, uint16_t);
+    low |= tmp << 16;
+    DO_MULL(high, T0 >> 16, T1 >> 16, int8_t, uint16_t);
+    DO_MULL(tmp, T0 >> 24, T1 >> 24, int8_t, uint16_t);
+    high |= tmp << 16;
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(mull_u16)
+{
+    uint32_t low;
+    uint32_t high;
+
+    DO_MULL(low, T0, T1, uint16_t, uint32_t);
+    DO_MULL(high, T0 >> 16, T1 >> 16, uint16_t, uint32_t);
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(mull_s16)
+{
+    uint32_t low;
+    uint32_t high;
+
+    DO_MULL(low, T0, T1, int16_t, uint32_t);
+    DO_MULL(high, T0 >> 16, T1 >> 16, int16_t, uint32_t);
+    T0 = low;
+    T1 = high;
+    FORCE_RET();
+}
+
+NEON_OP(addl_saturate_s32)
+{
+    uint32_t tmp;
+    uint32_t res;
+
+    tmp = env->vfp.scratch[0];
+    res = T0 + tmp;
+    if (((res ^ T0) & SIGNBIT) && !((T0 ^ tmp) & SIGNBIT)) {
+        env->QF = 1;
+        T0 = (T0 >> 31) ^ 0x7fffffff;
+    } else {
+      T0 = res;
+    }
+    tmp = env->vfp.scratch[1];
+    res = T1 + tmp;
+    if (((res ^ T1) & SIGNBIT) && !((T1 ^ tmp) & SIGNBIT)) {
+        env->QF = 1;
+        T1 = (T1 >> 31) ^ 0x7fffffff;
+    } else {
+      T1 = res;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(addl_saturate_s64)
+{
+    uint64_t src1;
+    uint64_t src2;
+    uint64_t res;
+
+    src1 = T0 + ((uint64_t)T1 << 32);
+    src2 = env->vfp.scratch[0] + ((uint64_t)env->vfp.scratch[1] << 32);
+    res = src1 + src2;
+    if (((res ^ src1) & SIGNBIT64) && !((src1 ^ src2) & SIGNBIT64)) {
+        env->QF = 1;
+        T0 = ~(int64_t)src1 >> 63;
+        T1 = T0 ^ 0x80000000;
+    } else {
+      T0 = res;
+      T1 = res >> 32;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(addl_saturate_u64)
+{
+    uint64_t src1;
+    uint64_t src2;
+    uint64_t res;
+
+    src1 = T0 + ((uint64_t)T1 << 32);
+    src2 = env->vfp.scratch[0] + ((uint64_t)env->vfp.scratch[1] << 32);
+    res = src1 + src2;
+    if (res < src1) {
+        env->QF = 1;
+        T0 = 0xffffffff;
+        T1 = 0xffffffff;
+    } else {
+      T0 = res;
+      T1 = res >> 32;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(subl_saturate_s64)
+{
+    uint64_t src1;
+    uint64_t src2;
+    uint64_t res;
+
+    src1 = T0 + ((uint64_t)T1 << 32);
+    src2 = env->vfp.scratch[0] + ((uint64_t)env->vfp.scratch[1] << 32);
+    res = src1 - src2;
+    if (((res ^ src1) & SIGNBIT64) && ((src1 ^ src2) & SIGNBIT64)) {
+        env->QF = 1;
+        T0 = ~(int64_t)src1 >> 63;
+        T1 = T0 ^ 0x80000000;
+    } else {
+      T0 = res;
+      T1 = res >> 32;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(subl_saturate_u64)
+{
+    uint64_t src1;
+    uint64_t src2;
+    uint64_t res;
+
+    src1 = T0 + ((uint64_t)T1 << 32);
+    src2 = env->vfp.scratch[0] + ((uint64_t)env->vfp.scratch[1] << 32);
+    if (src1 < src2) {
+        env->QF = 1;
+        T0 = 0;
+        T1 = 0;
+    } else {
+      res = src1 - src2;
+      T0 = res;
+      T1 = res >> 32;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(negl_u16)
+{
+    uint32_t tmp;
+    tmp = T0 >> 16;
+    tmp = -tmp;
+    T0 = (-T0 & 0xffff) | (tmp << 16);
+    tmp = T1 >> 16;
+    tmp = -tmp;
+    T1 = (-T1 & 0xffff) | (tmp << 16);
+    FORCE_RET();
+}
+
+NEON_OP(negl_u32)
+{
+    T0 = -T0;
+    T1 = -T1;
+    FORCE_RET();
+}
+
+NEON_OP(negl_u64)
+{
+    uint64_t val;
+
+    val = T0 | ((uint64_t)T1 << 32);
+    val = -val;
+    T0 = val;
+    T1 = val >> 32;
+    FORCE_RET();
+}
+
+/* Scalar operations.  */
+NEON_OP(dup_low16)
+{
+    T0 = (T0 & 0xffff) | (T0 << 16);
+    FORCE_RET();
+}
+
+NEON_OP(dup_high16)
+{
+    T0 = (T0 >> 16) | (T0 & 0xffff0000);
+    FORCE_RET();
+}
+
+/* Helper for VEXT */
+NEON_OP(extract)
+{
+    int shift = PARAM1;
+    T0 = (T0 >> shift) | (T1 << (32 - shift));
+    FORCE_RET();
+}
+
+/* Pairwise add long.  Named type is source type.  */
+NEON_OP(paddl_s8)
+{
+    int8_t src1;
+    int8_t src2;
+    uint16_t result;
+    src1 = T0 >> 24;
+    src2 = T0 >> 16;
+    result = (uint16_t)src1 + src2;
+    src1 = T0 >> 8;
+    src2 = T0;
+    T0 = (uint16_t)((uint16_t)src1 + src2) | ((uint32_t)result << 16);
+    FORCE_RET();
+}
+
+NEON_OP(paddl_u8)
+{
+    uint8_t src1;
+    uint8_t src2;
+    uint16_t result;
+    src1 = T0 >> 24;
+    src2 = T0 >> 16;
+    result = (uint16_t)src1 + src2;
+    src1 = T0 >> 8;
+    src2 = T0;
+    T0 = (uint16_t)((uint16_t)src1 + src2) | ((uint32_t)result << 16);
+    FORCE_RET();
+}
+
+NEON_OP(paddl_s16)
+{
+    T0 = (uint32_t)(int16_t)T0 + (uint32_t)(int16_t)(T0 >> 16);
+    FORCE_RET();
+}
+
+NEON_OP(paddl_u16)
+{
+    T0 = (uint32_t)(uint16_t)T0 + (uint32_t)(uint16_t)(T0 >> 16);
+    FORCE_RET();
+}
+
+NEON_OP(paddl_s32)
+{
+    int64_t tmp;
+    tmp = (int64_t)(int32_t)T0 + (int64_t)(int32_t)T1;
+    T0 = tmp;
+    T1 = tmp >> 32;
+    FORCE_RET();
+}
+
+NEON_OP(paddl_u32)
+{
+    uint64_t tmp;
+    tmp = (uint64_t)T0 + (uint64_t)T1;
+    T0 = tmp;
+    T1 = tmp >> 32;
+    FORCE_RET();
+}
+
+/* Count Leading Sign/Zero Bits.  */
+static inline int do_clz8(uint8_t x)
+{
+    int n;
+    for (n = 8; x; n--)
+        x >>= 1;
+    return n;
+}
+
+static inline int do_clz16(uint16_t x)
+{
+    int n;
+    for (n = 16; x; n--)
+        x >>= 1;
+    return n;
+}
+
+NEON_OP(clz_u8)
+{
+    uint32_t result;
+    uint32_t tmp;
+
+    tmp = T0;
+    result = do_clz8(tmp);
+    result |= do_clz8(tmp >> 8) << 8;
+    result |= do_clz8(tmp >> 16) << 16;
+    result |= do_clz8(tmp >> 24) << 24;
+    T0 = result;
+    FORCE_RET();
+}
+
+NEON_OP(clz_u16)
+{
+    uint32_t result;
+    uint32_t tmp;
+    tmp = T0;
+    result = do_clz16(tmp);
+    result |= do_clz16(tmp >> 16) << 16;
+    T0 = result;
+    FORCE_RET();
+}
+
+NEON_OP(cls_s8)
+{
+    uint32_t result;
+    int8_t tmp;
+    tmp = T0;
+    result = do_clz8((tmp < 0) ? ~tmp : tmp) - 1;
+    tmp = T0 >> 8;
+    result |= (do_clz8((tmp < 0) ? ~tmp : tmp) - 1) << 8;
+    tmp = T0 >> 16;
+    result |= (do_clz8((tmp < 0) ? ~tmp : tmp) - 1) << 16;
+    tmp = T0 >> 24;
+    result |= (do_clz8((tmp < 0) ? ~tmp : tmp) - 1) << 24;
+    T0 = result;
+    FORCE_RET();
+}
+
+NEON_OP(cls_s16)
+{
+    uint32_t result;
+    int16_t tmp;
+    tmp = T0;
+    result = do_clz16((tmp < 0) ? ~tmp : tmp) - 1;
+    tmp = T0 >> 16;
+    result |= (do_clz16((tmp < 0) ? ~tmp : tmp) - 1) << 16;
+    T0 = result;
+    FORCE_RET();
+}
+
+NEON_OP(cls_s32)
+{
+    int count;
+    if ((int32_t)T0 < 0)
+        T0 = ~T0;
+    for (count = 32; T0 > 0; count--)
+        T0 = T0 >> 1;
+    T0 = count - 1;
+    FORCE_RET();
+}
+
+/* Bit count.  */
+NEON_OP(cnt_u8)
+{
+    T0 = (T0 & 0x55555555) + ((T0 >>  1) & 0x55555555);
+    T0 = (T0 & 0x33333333) + ((T0 >>  2) & 0x33333333);
+    T0 = (T0 & 0x0f0f0f0f) + ((T0 >>  4) & 0x0f0f0f0f);
+    FORCE_RET();
+}
+
+/* Saturnating negation.  */
+/* ??? Make these use NEON_VOP1 */
+#define DO_QABS8(x) do { \
+    if (x == (int8_t)0x80) { \
+        x = 0x7f; \
+        env->QF = 1; \
+    } else if (x < 0) { \
+        x = -x; \
+    }} while (0)
+NEON_OP(qabs_s8)
+{
+    neon_s8 vec;
+    NEON_UNPACK(neon_s8, vec, T0);
+    DO_QABS8(vec.v1);
+    DO_QABS8(vec.v2);
+    DO_QABS8(vec.v3);
+    DO_QABS8(vec.v4);
+    NEON_PACK(neon_s8, T0, vec);
+    FORCE_RET();
+}
+#undef DO_QABS8
+
+#define DO_QNEG8(x) do { \
+    if (x == (int8_t)0x80) { \
+        x = 0x7f; \
+        env->QF = 1; \
+    } else { \
+        x = -x; \
+    }} while (0)
+NEON_OP(qneg_s8)
+{
+    neon_s8 vec;
+    NEON_UNPACK(neon_s8, vec, T0);
+    DO_QNEG8(vec.v1);
+    DO_QNEG8(vec.v2);
+    DO_QNEG8(vec.v3);
+    DO_QNEG8(vec.v4);
+    NEON_PACK(neon_s8, T0, vec);
+    FORCE_RET();
+}
+#undef DO_QNEG8
+
+#define DO_QABS16(x) do { \
+    if (x == (int16_t)0x8000) { \
+        x = 0x7fff; \
+        env->QF = 1; \
+    } else if (x < 0) { \
+        x = -x; \
+    }} while (0)
+NEON_OP(qabs_s16)
+{
+    neon_s16 vec;
+    NEON_UNPACK(neon_s16, vec, T0);
+    DO_QABS16(vec.v1);
+    DO_QABS16(vec.v2);
+    NEON_PACK(neon_s16, T0, vec);
+    FORCE_RET();
+}
+#undef DO_QABS16
+
+#define DO_QNEG16(x) do { \
+    if (x == (int16_t)0x8000) { \
+        x = 0x7fff; \
+        env->QF = 1; \
+    } else { \
+        x = -x; \
+    }} while (0)
+NEON_OP(qneg_s16)
+{
+    neon_s16 vec;
+    NEON_UNPACK(neon_s16, vec, T0);
+    DO_QNEG16(vec.v1);
+    DO_QNEG16(vec.v2);
+    NEON_PACK(neon_s16, T0, vec);
+    FORCE_RET();
+}
+#undef DO_QNEG16
+
+NEON_OP(qabs_s32)
+{
+    if (T0 == 0x80000000) {
+        T0 = 0x7fffffff;
+        env->QF = 1;
+    } else if ((int32_t)T0 < 0) {
+        T0 = -T0;
+    }
+    FORCE_RET();
+}
+
+NEON_OP(qneg_s32)
+{
+    if (T0 == 0x80000000) {
+        T0 = 0x7fffffff;
+        env->QF = 1;
+    } else {
+        T0 = -T0;
+    }
+    FORCE_RET();
+}
+
+/* Unary opperations */
+#define NEON_FN(dest, src, dummy) dest = (src < 0) ? -src : src
+NEON_VOP1(abs_s8, neon_s8, 4)
+NEON_VOP1(abs_s16, neon_s16, 2)
+NEON_OP(abs_s32)
+{
+    if ((int32_t)T0 < 0)
+        T0 = -T0;
+    FORCE_RET();
+}
+#undef NEON_FN
+
+/* Transpose.  Argument order is rather strange to avoid special casing
+   the tranlation code.
+   On input T0 = rm, T1 = rd.  On output T0 = rd, T1 = rm  */
+NEON_OP(trn_u8)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = ((T0 & 0x00ff00ff) << 8) | (T1 & 0x00ff00ff);
+    rm = ((T1 & 0xff00ff00) >> 8) | (T0 & 0xff00ff00);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+NEON_OP(trn_u16)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = (T0 << 16) | (T1 & 0xffff);
+    rm = (T1 >> 16) | (T0 & 0xffff0000);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+/* Worker routines for zip and unzip.  */
+NEON_OP(unzip_u8)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = (T0 & 0xff) | ((T0 >> 8) & 0xff00)
+         | ((T1 << 16) & 0xff0000) | ((T1 << 8) & 0xff000000);
+    rm = ((T0 >> 8) & 0xff) | ((T0 >> 16) & 0xff00)
+         | ((T1 << 8) & 0xff0000) | (T1 & 0xff000000);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+NEON_OP(zip_u8)
+{
+    uint32_t rd;
+    uint32_t rm;
+    rd = (T0 & 0xff) | ((T1 << 8) & 0xff00)
+         | ((T0 << 16) & 0xff0000) | ((T1 << 24) & 0xff000000);
+    rm = ((T0 >> 16) & 0xff) | ((T1 >> 8) & 0xff00)
+         | ((T0 >> 8) & 0xff0000) | (T1 & 0xff000000);
+    T0 = rd;
+    T1 = rm;
+    FORCE_RET();
+}
+
+NEON_OP(zip_u16)
+{
+    uint32_t tmp;
+
+    tmp = (T0 & 0xffff) | (T1 << 16);
+    T1 = (T1 & 0xffff0000) | (T0 >> 16);
+    T0 = tmp;
+    FORCE_RET();
+}
+
+/* Reciprocal/root estimate.  */
+NEON_OP(recpe_u32)
+{
+    T0 = helper_recpe_u32(T0);
+}
+
+NEON_OP(rsqrte_u32)
+{
+    T0 = helper_rsqrte_u32(T0);
+}
+
+NEON_OP(recpe_f32)
+{
+    FT0s = helper_recpe_f32(FT0s);
+}
+
+NEON_OP(rsqrte_f32)
+{
+    FT0s = helper_rsqrte_f32(FT0s);
+}
+
+/* Table lookup.  This accessed the register file directly.  */
+NEON_OP(tbl)
+{
+    helper_neon_tbl(PARAM1, PARAM2);
+}
+
+NEON_OP(dup_u8)
+{
+    T0 = (T0 >> PARAM1) & 0xff;
+    T0 |= T0 << 8;
+    T0 |= T0 << 16;
+    FORCE_RET();
+}
+
+/* Helpers for element load/store.  */
+NEON_OP(insert_elt)
+{
+    int shift = PARAM1;
+    uint32_t mask = PARAM2;
+    T2 = (T2 & mask) | (T0 << shift);
+    FORCE_RET();
+}
+
+NEON_OP(extract_elt)
+{
+    int shift = PARAM1;
+    uint32_t mask = PARAM2;
+    T0 = (T2 & mask) >> shift;
+    FORCE_RET();
+}

Modified: trunk/src/host/qemu-neo1973/target-arm/translate.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-arm/translate.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-arm/translate.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -2,7 +2,7 @@
  *  ARM translation
  *
  *  Copyright (c) 2003 Fabrice Bellard
- *  Copyright (c) 2005 CodeSourcery, LLC
+ *  Copyright (c) 2005-2007 CodeSourcery
  *  Copyright (c) 2007 OpenedHand, Ltd.
  *
  * This library is free software; you can redistribute it and/or
@@ -29,9 +29,11 @@
 #include "exec-all.h"
 #include "disas.h"
 
-#define ENABLE_ARCH_5J  0
-#define ENABLE_ARCH_6   1
-#define ENABLE_ARCH_6T2 1
+#define ENABLE_ARCH_5J    0
+#define ENABLE_ARCH_6     arm_feature(env, ARM_FEATURE_V6)
+#define ENABLE_ARCH_6K   arm_feature(env, ARM_FEATURE_V6K)
+#define ENABLE_ARCH_6T2   arm_feature(env, ARM_FEATURE_THUMB2)
+#define ENABLE_ARCH_7     arm_feature(env, ARM_FEATURE_V7)
 
 #define ARCH(x) if (!ENABLE_ARCH_##x) goto illegal_op;
 
@@ -43,6 +45,9 @@
     int condjmp;
     /* The label that will be jumped to when the instruction is skipped.  */
     int condlabel;
+    /* Thumb-2 condtional execution bits.  */
+    int condexec_mask;
+    int condexec_cond;
     struct TranslationBlock *tb;
     int singlestep_enabled;
     int thumb;
@@ -58,7 +63,10 @@
 #define IS_USER(s) (s->user)
 #endif
 
-#define DISAS_JUMP_NEXT 4
+/* These instructions trap after executing, so defer them until after the
+   conditional executions state has been updated.  */
+#define DISAS_WFI 4
+#define DISAS_SWI 5
 
 #ifdef USE_DIRECT_JUMP
 #define TBPARAM(x)
@@ -81,6 +89,51 @@
 
 #include "gen-op.h"
 
+#define PAS_OP(pfx) {  \
+    gen_op_ ## pfx ## add16_T0_T1, \
+    gen_op_ ## pfx ## addsubx_T0_T1, \
+    gen_op_ ## pfx ## subaddx_T0_T1, \
+    gen_op_ ## pfx ## sub16_T0_T1, \
+    gen_op_ ## pfx ## add8_T0_T1, \
+    NULL, \
+    NULL, \
+    gen_op_ ## pfx ## sub8_T0_T1 }
+
+static GenOpFunc *gen_arm_parallel_addsub[8][8] = {
+    {},
+    PAS_OP(s),
+    PAS_OP(q),
+    PAS_OP(sh),
+    {},
+    PAS_OP(u),
+    PAS_OP(uq),
+    PAS_OP(uh),
+};
+#undef PAS_OP
+
+/* For unknown reasons Arm and Thumb-2 use arbitrarily diffenet encodings.  */
+#define PAS_OP(pfx) {  \
+    gen_op_ ## pfx ## add8_T0_T1, \
+    gen_op_ ## pfx ## add16_T0_T1, \
+    gen_op_ ## pfx ## addsubx_T0_T1, \
+    NULL, \
+    gen_op_ ## pfx ## sub8_T0_T1, \
+    gen_op_ ## pfx ## sub16_T0_T1, \
+    gen_op_ ## pfx ## subaddx_T0_T1, \
+    NULL }
+
+static GenOpFunc *gen_thumb2_parallel_addsub[8][8] = {
+    PAS_OP(s),
+    PAS_OP(q),
+    PAS_OP(sh),
+    {},
+    PAS_OP(u),
+    PAS_OP(uq),
+    PAS_OP(uh),
+    {}
+};
+#undef PAS_OP
+
 static GenOpFunc1 *gen_test_cc[14] = {
     gen_op_test_eq,
     gen_op_test_ne,
@@ -275,6 +328,12 @@
     gen_op_movl_T2_im,
 };
 
+static GenOpFunc1 *gen_shift_T0_im_thumb_cc[3] = {
+    gen_op_shll_T0_im_thumb_cc,
+    gen_op_shrl_T0_im_thumb_cc,
+    gen_op_sarl_T0_im_thumb_cc,
+};
+
 static GenOpFunc1 *gen_shift_T0_im_thumb[3] = {
     gen_op_shll_T0_im_thumb,
     gen_op_shrl_T0_im_thumb,
@@ -421,6 +480,15 @@
         gen_op_vfp_##name##s();           \
 }
 
+#define VFP_OP1(name)                               \
+static inline void gen_vfp_##name(int dp, int arg)  \
+{                                                   \
+    if (dp)                                         \
+        gen_op_vfp_##name##d(arg);                  \
+    else                                            \
+        gen_op_vfp_##name##s(arg);                  \
+}
+
 VFP_OP(add)
 VFP_OP(sub)
 VFP_OP(mul)
@@ -437,9 +505,25 @@
 VFP_OP(touiz)
 VFP_OP(tosi)
 VFP_OP(tosiz)
+VFP_OP1(tosh)
+VFP_OP1(tosl)
+VFP_OP1(touh)
+VFP_OP1(toul)
+VFP_OP1(shto)
+VFP_OP1(slto)
+VFP_OP1(uhto)
+VFP_OP1(ulto)
 
 #undef VFP_OP
 
+static inline void gen_vfp_fconst(int dp, uint32_t val)
+{
+    if (dp)
+        gen_op_vfp_fconstd(val);
+    else
+        gen_op_vfp_fconsts(val);
+}
+
 static inline void gen_vfp_ld(DisasContext *s, int dp)
 {
     if (dp)
@@ -469,6 +553,20 @@
           + offsetof(CPU_DoubleU, l.lower);
     }
 }
+
+/* Return the offset of a 32-bit piece of a NEON register.
+   zero is the least significant end of the register.  */
+static inline long
+neon_reg_offset (int reg, int n)
+{
+    int sreg;
+    sreg = reg * 2 + n;
+    return vfp_reg_offset(0, sreg);
+}
+
+#define NEON_GET_REG(T, reg, n) gen_op_neon_getreg_##T(neon_reg_offset(reg, n))
+#define NEON_SET_REG(T, reg, n) gen_op_neon_setreg_##T(neon_reg_offset(reg, n))
+
 static inline void gen_mov_F0_vreg(int dp, int reg)
 {
     if (dp)
@@ -1582,23 +1680,57 @@
     return 0;
 }
 
+static int cp15_user_ok(uint32_t insn)
+{
+    int cpn = (insn >> 16) & 0xf;
+    int cpm = insn & 0xf;
+    int op = ((insn >> 5) & 7) | ((insn >> 18) & 0x38);
+
+    if (cpn == 13 && cpm == 0) {
+        /* TLS register.  */
+        if (op == 2 || (op == 3 && (insn & ARM_CP_RW_BIT)))
+            return 1;
+    }
+    if (cpn == 7) {
+        /* ISB, DSB, DMB.  */
+        if ((cpm == 5 && op == 4)
+                || (cpm == 10 && (op == 4 || op == 5)))
+            return 1;
+    }
+    return 0;
+}
+
 /* Disassemble system coprocessor (cp15) instruction.  Return nonzero if
    instruction is not defined.  */
 static int disas_cp15_insn(CPUState *env, DisasContext *s, uint32_t insn)
 {
     uint32_t rd;
 
-    /* ??? Some cp15 registers are accessible from userspace.  */
-    if (IS_USER(s)) {
+    /* M profile cores use memory mapped registers instead of cp15.  */
+    if (arm_feature(env, ARM_FEATURE_M))
+	return 1;
+
+    if ((insn & (1 << 25)) == 0) {
+        if (insn & (1 << 20)) {
+            /* mrrc */
+            return 1;
+        }
+        /* mcrr.  Used for block cache operations, so implement as no-op.  */
+        return 0;
+    }
+    if ((insn & (1 << 4)) == 0) {
+        /* cdp */
         return 1;
     }
+    if (IS_USER(s) && !cp15_user_ok(insn)) {
+        return 1;
+    }
     if ((insn & 0x0fff0fff) == 0x0e070f90
         || (insn & 0x0fff0fff) == 0x0e070f58) {
         /* Wait for interrupt.  */
         gen_op_movl_T0_im((long)s->pc);
         gen_op_movl_reg_TN[0][15]();
-        gen_op_wfi();
-        s->is_jmp = DISAS_JUMP;
+        s->is_jmp = DISAS_WFI;
         return 0;
     }
     rd = (insn >> 12) & 0xf;
@@ -1620,6 +1752,32 @@
     return 0;
 }
 
+#define VFP_REG_SHR(x, n) (((n) > 0) ? (x) >> (n) : (x) << -(n))
+#define VFP_SREG(insn, bigbit, smallbit) \
+  ((VFP_REG_SHR(insn, bigbit - 1) & 0x1e) | (((insn) >> (smallbit)) & 1))
+#define VFP_DREG(reg, insn, bigbit, smallbit) do { \
+    if (arm_feature(env, ARM_FEATURE_VFP3)) { \
+        reg = (((insn) >> (bigbit)) & 0x0f) \
+              | (((insn) >> ((smallbit) - 4)) & 0x10); \
+    } else { \
+        if (insn & (1 << (smallbit))) \
+            return 1; \
+        reg = ((insn) >> (bigbit)) & 0x0f; \
+    }} while (0)
+
+#define VFP_SREG_D(insn) VFP_SREG(insn, 12, 22)
+#define VFP_DREG_D(reg, insn) VFP_DREG(reg, insn, 12, 22)
+#define VFP_SREG_N(insn) VFP_SREG(insn, 16,  7)
+#define VFP_DREG_N(reg, insn) VFP_DREG(reg, insn, 16,  7)
+#define VFP_SREG_M(insn) VFP_SREG(insn,  0,  5)
+#define VFP_DREG_M(reg, insn) VFP_DREG(reg, insn,  0,  5)
+
+static inline int
+vfp_enabled(CPUState * env)
+{
+    return ((env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) != 0);
+}
+
 /* Disassemble a VFP instruction.  Returns nonzero if an error occured
    (ie. an undefined instruction).  */
 static int disas_vfp_insn(CPUState * env, DisasContext *s, uint32_t insn)
@@ -1630,12 +1788,13 @@
     if (!arm_feature(env, ARM_FEATURE_VFP))
         return 1;
 
-    if ((env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) == 0) {
-        /* VFP disabled.  Only allow fmxr/fmrx to/from fpexc and fpsid.  */
+    if (!vfp_enabled(env)) {
+        /* VFP disabled.  Only allow fmxr/fmrx to/from some control regs.  */
         if ((insn & 0x0fe00fff) != 0x0ee00a10)
             return 1;
         rn = (insn >> 16) & 0xf;
-        if (rn != 0 && rn != 8)
+        if (rn != ARM_VFP_FPSID && rn != ARM_VFP_FPEXC
+            && rn != ARM_VFP_MVFR1 && rn != ARM_VFP_MVFR0)
             return 1;
     }
     dp = ((insn & 0xf00) == 0xb00);
@@ -1643,44 +1802,129 @@
     case 0xe:
         if (insn & (1 << 4)) {
             /* single register transfer */
-            if ((insn & 0x6f) != 0x00)
-                return 1;
             rd = (insn >> 12) & 0xf;
             if (dp) {
-                if (insn & 0x80)
+                int size;
+                int pass;
+
+                VFP_DREG_N(rn, insn);
+                if (insn & 0xf)
                     return 1;
-                rn = (insn >> 16) & 0xf;
-                /* Get the existing value even for arm->vfp moves because
-                   we only set half the register.  */
-                gen_mov_F0_vreg(1, rn);
-                gen_op_vfp_mrrd();
+                if (insn & 0x00c00060
+                    && !arm_feature(env, ARM_FEATURE_NEON))
+                    return 1;
+
+                pass = (insn >> 21) & 1;
+                if (insn & (1 << 22)) {
+                    size = 0;
+                    offset = ((insn >> 5) & 3) * 8;
+                } else if (insn & (1 << 5)) {
+                    size = 1;
+                    offset = (insn & (1 << 6)) ? 16 : 0;
+                } else {
+                    size = 2;
+                    offset = 0;
+                }
                 if (insn & ARM_CP_RW_BIT) {
                     /* vfp->arm */
-                    if (insn & (1 << 21))
-                        gen_movl_reg_T1(s, rd);
-                    else
-                        gen_movl_reg_T0(s, rd);
+                    switch (size) {
+                    case 0:
+                        NEON_GET_REG(T1, rn, pass);
+                        if (offset)
+                            gen_op_shrl_T1_im(offset);
+                        if (insn & (1 << 23))
+                            gen_op_uxtb_T1();
+                        else
+                            gen_op_sxtb_T1();
+                        break;
+                    case 1:
+                        NEON_GET_REG(T1, rn, pass);
+                        if (insn & (1 << 23)) {
+                            if (offset) {
+                                gen_op_shrl_T1_im(16);
+                            } else {
+                                gen_op_uxth_T1();
+                            }
+                        } else {
+                            if (offset) {
+                                gen_op_sarl_T1_im(16);
+                            } else {
+                                gen_op_sxth_T1();
+                            }
+                        }
+                        break;
+                    case 2:
+                        NEON_GET_REG(T1, rn, pass);
+                        break;
+                    }
+                    gen_movl_reg_T1(s, rd);
                 } else {
                     /* arm->vfp */
-                    if (insn & (1 << 21))
-                        gen_movl_T1_reg(s, rd);
-                    else
-                        gen_movl_T0_reg(s, rd);
-                    gen_op_vfp_mdrr();
-                    gen_mov_vreg_F0(dp, rn);
+                    gen_movl_T0_reg(s, rd);
+                    if (insn & (1 << 23)) {
+                        /* VDUP */
+                        if (size == 0) {
+                            gen_op_neon_dup_u8(0);
+                        } else if (size == 1) {
+                            gen_op_neon_dup_low16();
+                        }
+                        NEON_SET_REG(T0, rn, 0);
+                        NEON_SET_REG(T0, rn, 1);
+                    } else {
+                        /* VMOV */
+                        switch (size) {
+                        case 0:
+                            NEON_GET_REG(T2, rn, pass);
+                            gen_op_movl_T1_im(0xff);
+                            gen_op_andl_T0_T1();
+                            gen_op_neon_insert_elt(offset, ~(0xff << offset));
+                            NEON_SET_REG(T2, rn, pass);
+                            break;
+                        case 1:
+                            NEON_GET_REG(T2, rn, pass);
+                            gen_op_movl_T1_im(0xffff);
+                            gen_op_andl_T0_T1();
+                            bank_mask = offset ? 0xffff : 0xffff0000;
+                            gen_op_neon_insert_elt(offset, bank_mask);
+                            NEON_SET_REG(T2, rn, pass);
+                            break;
+                        case 2:
+                            NEON_SET_REG(T0, rn, pass);
+                            break;
+                        }
+                    }
                 }
-            } else {
-                rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
+            } else { /* !dp */
+                if ((insn & 0x6f) != 0x00)
+                    return 1;
+                rn = VFP_SREG_N(insn);
                 if (insn & ARM_CP_RW_BIT) {
                     /* vfp->arm */
                     if (insn & (1 << 21)) {
                         /* system register */
                         rn >>= 1;
+
                         switch (rn) {
                         case ARM_VFP_FPSID:
+                            /* VFP2 allows access for FSID from userspace.
+                               VFP3 restricts all id registers to privileged
+                               accesses.  */
+                            if (IS_USER(s)
+                                && arm_feature(env, ARM_FEATURE_VFP3))
+                                return 1;
+                            gen_op_vfp_movl_T0_xreg(rn);
+                            break;
                         case ARM_VFP_FPEXC:
+                            if (IS_USER(s))
+                                return 1;
+                            gen_op_vfp_movl_T0_xreg(rn);
+                            break;
                         case ARM_VFP_FPINST:
                         case ARM_VFP_FPINST2:
+                            /* Not present in VFP3.  */
+                            if (IS_USER(s)
+                                || arm_feature(env, ARM_FEATURE_VFP3))
+                                return 1;
                             gen_op_vfp_movl_T0_xreg(rn);
                             break;
                         case ARM_VFP_FPSCR:
@@ -1689,6 +1933,13 @@
 			    else
 				gen_op_vfp_movl_T0_fpscr();
                             break;
+                        case ARM_VFP_MVFR0:
+                        case ARM_VFP_MVFR1:
+                            if (IS_USER(s)
+                                || !arm_feature(env, ARM_FEATURE_VFP3))
+                                return 1;
+                            gen_op_vfp_movl_T0_xreg(rn);
+                            break;
                         default:
                             return 1;
                         }
@@ -1709,6 +1960,8 @@
                         /* system register */
                         switch (rn) {
                         case ARM_VFP_FPSID:
+                        case ARM_VFP_MVFR0:
+                        case ARM_VFP_MVFR1:
                             /* Writes are ignored.  */
                             break;
                         case ARM_VFP_FPSCR:
@@ -1716,6 +1969,8 @@
                             gen_lookup_tb(s);
                             break;
                         case ARM_VFP_FPEXC:
+                            if (IS_USER(s))
+                                return 1;
                             gen_op_vfp_movl_xreg_T0(rn);
                             gen_lookup_tb(s);
                             break;
@@ -1742,38 +1997,31 @@
                     rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
                 } else {
                     /* rn is register number */
-                    if (insn & (1 << 7))
-                        return 1;
-                    rn = (insn >> 16) & 0xf;
+                    VFP_DREG_N(rn, insn);
                 }
 
                 if (op == 15 && (rn == 15 || rn > 17)) {
                     /* Integer or single precision destination.  */
-                    rd = ((insn >> 11) & 0x1e) | ((insn >> 22) & 1);
+                    rd = VFP_SREG_D(insn);
                 } else {
-                    if (insn & (1 << 22))
-                        return 1;
-                    rd = (insn >> 12) & 0xf;
+                    VFP_DREG_D(rd, insn);
                 }
 
                 if (op == 15 && (rn == 16 || rn == 17)) {
                     /* Integer source.  */
                     rm = ((insn << 1) & 0x1e) | ((insn >> 5) & 1);
                 } else {
-                    if (insn & (1 << 5))
-                        return 1;
-                    rm = insn & 0xf;
+                    VFP_DREG_M(rm, insn);
                 }
             } else {
-                rn = ((insn >> 15) & 0x1e) | ((insn >> 7) & 1);
+                rn = VFP_SREG_N(insn);
                 if (op == 15 && rn == 15) {
                     /* Double precision destination.  */
-                    if (insn & (1 << 22))
-                        return 1;
-                    rd = (insn >> 12) & 0xf;
-                } else
-                    rd = ((insn >> 11) & 0x1e) | ((insn >> 22) & 1);
-                rm = ((insn << 1) & 0x1e) | ((insn >> 5) & 1);
+                    VFP_DREG_D(rd, insn);
+                } else {
+                    rd = VFP_SREG_D(insn);
+                }
+                rm = VFP_SREG_M(insn);
             }
 
             veclen = env->vfp.vec_len;
@@ -1831,9 +2079,17 @@
                     gen_mov_F0_vreg(dp, rd);
                     gen_vfp_F1_ld0(dp);
                     break;
+                case 20:
+                case 21:
+                case 22:
+                case 23:
+                    /* Source and destination the same.  */
+                    gen_mov_F0_vreg(dp, rd);
+                    break;
                 default:
                     /* One source operand.  */
                     gen_mov_F0_vreg(dp, rm);
+                    break;
                 }
             } else {
                 /* Two source operands.  */
@@ -1882,6 +2138,27 @@
                 case 8: /* div: fn / fm */
                     gen_vfp_div(dp);
                     break;
+                case 14: /* fconst */
+                    if (!arm_feature(env, ARM_FEATURE_VFP3))
+                      return 1;
+
+                    n = (insn << 12) & 0x80000000;
+                    i = ((insn >> 12) & 0x70) | (insn & 0xf);
+                    if (dp) {
+                        if (i & 0x40)
+                            i |= 0x3f80;
+                        else
+                            i |= 0x4000;
+                        n |= i << 16;
+                    } else {
+                        if (i & 0x40)
+                            i |= 0x780;
+                        else
+                            i |= 0x800;
+                        n |= i << 19;
+                    }
+                    gen_vfp_fconst(dp, n);
+                    break;
                 case 15: /* extension space */
                     switch (rn) {
                     case 0: /* cpy */
@@ -1921,6 +2198,26 @@
                     case 17: /* fsito */
                         gen_vfp_sito(dp);
                         break;
+                    case 20: /* fshto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_shto(dp, rm);
+                        break;
+                    case 21: /* fslto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_slto(dp, rm);
+                        break;
+                    case 22: /* fuhto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_uhto(dp, rm);
+                        break;
+                    case 23: /* fulto */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_ulto(dp, rm);
+                        break;
                     case 24: /* ftoui */
                         gen_vfp_toui(dp);
                         break;
@@ -1933,6 +2230,26 @@
                     case 27: /* ftosiz */
                         gen_vfp_tosiz(dp);
                         break;
+                    case 28: /* ftosh */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_tosh(dp, rm);
+                        break;
+                    case 29: /* ftosl */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_tosl(dp, rm);
+                        break;
+                    case 30: /* ftouh */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_touh(dp, rm);
+                        break;
+                    case 31: /* ftoul */
+                        if (!arm_feature(env, ARM_FEATURE_VFP3))
+                          return 1;
+                        gen_vfp_toul(dp, rm);
+                        break;
                     default: /* undefined */
                         printf ("rn:%d\n", rn);
                         return 1;
@@ -1994,16 +2311,15 @@
         break;
     case 0xc:
     case 0xd:
-        if (dp && (insn & (1 << 22))) {
+        if (dp && (insn & 0x03e00000) == 0x00400000) {
             /* two-register transfer */
             rn = (insn >> 16) & 0xf;
             rd = (insn >> 12) & 0xf;
             if (dp) {
-                if (insn & (1 << 5))
-                    return 1;
-                rm = insn & 0xf;
-            } else
-                rm = ((insn << 1) & 0x1e) | ((insn >> 5) & 1);
+                VFP_DREG_M(rm, insn);
+            } else {
+                rm = VFP_SREG_M(insn);
+            }
 
             if (insn & ARM_CP_RW_BIT) {
                 /* vfp->arm */
@@ -2040,10 +2356,14 @@
             /* Load/store */
             rn = (insn >> 16) & 0xf;
             if (dp)
-                rd = (insn >> 12) & 0xf;
+                VFP_DREG_D(rd, insn);
             else
-                rd = ((insn >> 11) & 0x1e) | ((insn >> 22) & 1);
-            gen_movl_T1_reg(s, rn);
+                rd = VFP_SREG_D(insn);
+            if (s->thumb && rn == 15) {
+                gen_op_movl_T1_im(s->pc & ~2);
+            } else {
+                gen_movl_T1_reg(s, rn);
+            }
             if ((insn & 0x01200000) == 0x01000000) {
                 /* Single load/store */
                 offset = (insn & 0xff) << 2;
@@ -2156,7 +2476,7 @@
 }
 
 /* Return the mask of PSR bits set by a MSR instruction.  */
-static uint32_t msr_mask(DisasContext *s, int flags, int spsr) {
+static uint32_t msr_mask(CPUState *env, DisasContext *s, int flags, int spsr) {
     uint32_t mask;
 
     mask = 0;
@@ -2168,14 +2488,19 @@
         mask |= 0xff0000;
     if (flags & (1 << 3))
         mask |= 0xff000000;
+
     /* Mask out undefined bits.  */
-    mask &= 0xf90f03ff;
-    /* Mask out state bits.  */
+    mask &= ~CPSR_RESERVED;
+    if (!arm_feature(env, ARM_FEATURE_V6))
+        mask &= ~(CPSR_E | CPSR_GE);
+    if (!arm_feature(env, ARM_FEATURE_THUMB2))
+        mask &= ~CPSR_IT;
+    /* Mask out execution state bits.  */
     if (!spsr)
-        mask &= ~0x01000020;
+        mask &= ~CPSR_EXEC;
     /* Mask out privileged bits.  */
     if (IS_USER(s))
-        mask &= 0xf80f0200;
+        mask &= CPSR_USER;
     return mask;
 }
 
@@ -2194,6 +2519,7 @@
     return 0;
 }
 
+/* Generate an old-style exception return.  */
 static void gen_exception_return(DisasContext *s)
 {
     gen_op_movl_reg_TN[0][15]();
@@ -2202,6 +2528,2122 @@
     s->is_jmp = DISAS_UPDATE;
 }
 
+/* Generate a v6 exception return.  */
+static void gen_rfe(DisasContext *s)
+{
+    gen_op_movl_cpsr_T0(0xffffffff);
+    gen_op_movl_T0_T2();
+    gen_op_movl_reg_TN[0][15]();
+    s->is_jmp = DISAS_UPDATE;
+}
+
+static inline void
+gen_set_condexec (DisasContext *s)
+{
+    if (s->condexec_mask) {
+        gen_op_set_condexec((s->condexec_cond << 4) | (s->condexec_mask >> 1));
+    }
+}
+
+static void gen_nop_hint(DisasContext *s, int val)
+{
+    switch (val) {
+    case 3: /* wfi */
+        gen_op_movl_T0_im((long)s->pc);
+        gen_op_movl_reg_TN[0][15]();
+        s->is_jmp = DISAS_WFI;
+        break;
+    case 2: /* wfe */
+    case 4: /* sev */
+        /* TODO: Implement SEV and WFE.  May help SMP performance.  */
+    default: /* nop */
+        break;
+    }
+}
+
+/* Neon shift by constant.  The actual ops are the same as used for variable
+   shifts.  [OP][U][SIZE]  */
+static GenOpFunc *gen_neon_shift_im[8][2][4] = {
+    { /* 0 */ /* VSHR */
+      {
+        gen_op_neon_shl_u8,
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64
+      }, {
+        gen_op_neon_shl_s8,
+        gen_op_neon_shl_s16,
+        gen_op_neon_shl_s32,
+        gen_op_neon_shl_s64
+      }
+    }, { /* 1 */ /* VSRA */
+      {
+        gen_op_neon_shl_u8,
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64
+      }, {
+        gen_op_neon_shl_s8,
+        gen_op_neon_shl_s16,
+        gen_op_neon_shl_s32,
+        gen_op_neon_shl_s64
+      }
+    }, { /* 2 */ /* VRSHR */
+      {
+        gen_op_neon_rshl_u8,
+        gen_op_neon_rshl_u16,
+        gen_op_neon_rshl_u32,
+        gen_op_neon_rshl_u64
+      }, {
+        gen_op_neon_rshl_s8,
+        gen_op_neon_rshl_s16,
+        gen_op_neon_rshl_s32,
+        gen_op_neon_rshl_s64
+      }
+    }, { /* 3 */ /* VRSRA */
+      {
+        gen_op_neon_rshl_u8,
+        gen_op_neon_rshl_u16,
+        gen_op_neon_rshl_u32,
+        gen_op_neon_rshl_u64
+      }, {
+        gen_op_neon_rshl_s8,
+        gen_op_neon_rshl_s16,
+        gen_op_neon_rshl_s32,
+        gen_op_neon_rshl_s64
+      }
+    }, { /* 4 */
+      {
+        NULL, NULL, NULL, NULL
+      }, { /* VSRI */
+        gen_op_neon_shl_u8,
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64,
+      }
+    }, { /* 5 */
+      { /* VSHL */
+        gen_op_neon_shl_u8,
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64,
+      }, { /* VSLI */
+        gen_op_neon_shl_u8,
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64,
+      }
+    }, { /* 6 */ /* VQSHL */
+      {
+        gen_op_neon_qshl_u8,
+        gen_op_neon_qshl_u16,
+        gen_op_neon_qshl_u32,
+        gen_op_neon_qshl_u64
+      }, {
+        gen_op_neon_qshl_s8,
+        gen_op_neon_qshl_s16,
+        gen_op_neon_qshl_s32,
+        gen_op_neon_qshl_s64
+      }
+    }, { /* 7 */ /* VQSHLU */
+      {
+        gen_op_neon_qshl_u8,
+        gen_op_neon_qshl_u16,
+        gen_op_neon_qshl_u32,
+        gen_op_neon_qshl_u64
+      }, {
+        gen_op_neon_qshl_u8,
+        gen_op_neon_qshl_u16,
+        gen_op_neon_qshl_u32,
+        gen_op_neon_qshl_u64
+      }
+    }
+};
+
+/* [R][U][size - 1] */
+static GenOpFunc *gen_neon_shift_im_narrow[2][2][3] = {
+    {
+      {
+        gen_op_neon_shl_u16,
+        gen_op_neon_shl_u32,
+        gen_op_neon_shl_u64
+      }, {
+        gen_op_neon_shl_s16,
+        gen_op_neon_shl_s32,
+        gen_op_neon_shl_s64
+      }
+    }, {
+      {
+        gen_op_neon_rshl_u16,
+        gen_op_neon_rshl_u32,
+        gen_op_neon_rshl_u64
+      }, {
+        gen_op_neon_rshl_s16,
+        gen_op_neon_rshl_s32,
+        gen_op_neon_rshl_s64
+      }
+    }
+};
+
+static inline void
+gen_op_neon_narrow_u32 ()
+{
+    /* No-op.  */
+}
+
+static GenOpFunc *gen_neon_narrow[3] = {
+    gen_op_neon_narrow_u8,
+    gen_op_neon_narrow_u16,
+    gen_op_neon_narrow_u32
+};
+
+static GenOpFunc *gen_neon_narrow_satu[3] = {
+    gen_op_neon_narrow_sat_u8,
+    gen_op_neon_narrow_sat_u16,
+    gen_op_neon_narrow_sat_u32
+};
+
+static GenOpFunc *gen_neon_narrow_sats[3] = {
+    gen_op_neon_narrow_sat_s8,
+    gen_op_neon_narrow_sat_s16,
+    gen_op_neon_narrow_sat_s32
+};
+
+static inline int gen_neon_add(int size)
+{
+    switch (size) {
+    case 0: gen_op_neon_add_u8(); break;
+    case 1: gen_op_neon_add_u16(); break;
+    case 2: gen_op_addl_T0_T1(); break;
+    default: return 1;
+    }
+    return 0;
+}
+
+/* 32-bit pairwise ops end up the same as the elementsise versions.  */
+#define gen_op_neon_pmax_s32  gen_op_neon_max_s32
+#define gen_op_neon_pmax_u32  gen_op_neon_max_u32
+#define gen_op_neon_pmin_s32  gen_op_neon_min_s32
+#define gen_op_neon_pmin_u32  gen_op_neon_min_u32
+
+#define GEN_NEON_INTEGER_OP(name) do { \
+    switch ((size << 1) | u) { \
+    case 0: gen_op_neon_##name##_s8(); break; \
+    case 1: gen_op_neon_##name##_u8(); break; \
+    case 2: gen_op_neon_##name##_s16(); break; \
+    case 3: gen_op_neon_##name##_u16(); break; \
+    case 4: gen_op_neon_##name##_s32(); break; \
+    case 5: gen_op_neon_##name##_u32(); break; \
+    default: return 1; \
+    }} while (0)
+
+static inline void
+gen_neon_movl_scratch_T0(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  gen_op_neon_setreg_T0(offset);
+}
+
+static inline void
+gen_neon_movl_scratch_T1(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  gen_op_neon_setreg_T1(offset);
+}
+
+static inline void
+gen_neon_movl_T0_scratch(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  gen_op_neon_getreg_T0(offset);
+}
+
+static inline void
+gen_neon_movl_T1_scratch(int scratch)
+{
+  uint32_t offset;
+
+  offset = offsetof(CPUARMState, vfp.scratch[scratch]);
+  gen_op_neon_getreg_T1(offset);
+}
+
+static inline void gen_op_neon_widen_u32(void)
+{
+    gen_op_movl_T1_im(0);
+}
+
+static inline void gen_neon_get_scalar(int size, int reg)
+{
+    if (size == 1) {
+        NEON_GET_REG(T0, reg >> 1, reg & 1);
+    } else {
+        NEON_GET_REG(T0, reg >> 2, (reg >> 1) & 1);
+        if (reg & 1)
+            gen_op_neon_dup_low16();
+        else
+            gen_op_neon_dup_high16();
+    }
+}
+
+static void gen_neon_unzip(int reg, int q, int tmp, int size)
+{
+    int n;
+
+    for (n = 0; n < q + 1; n += 2) {
+        NEON_GET_REG(T0, reg, n);
+        NEON_GET_REG(T0, reg, n + n);
+        switch (size) {
+        case 0: gen_op_neon_unzip_u8(); break;
+        case 1: gen_op_neon_zip_u16(); break; /* zip and unzip are the same.  */
+        case 2: /* no-op */; break;
+        default: abort();
+        }
+        gen_neon_movl_scratch_T0(tmp + n);
+        gen_neon_movl_scratch_T1(tmp + n + 1);
+    }
+}
+
+static struct {
+    int nregs;
+    int interleave;
+    int spacing;
+} neon_ls_element_type[11] = {
+    {4, 4, 1},
+    {4, 4, 2},
+    {4, 1, 1},
+    {4, 2, 1},
+    {3, 3, 1},
+    {3, 3, 2},
+    {3, 1, 1},
+    {1, 1, 1},
+    {2, 2, 1},
+    {2, 2, 2},
+    {2, 1, 1}
+};
+
+/* Translate a NEON load/store element instruction.  Return nonzero if the
+   instruction is invalid.  */
+static int disas_neon_ls_insn(CPUState * env, DisasContext *s, uint32_t insn)
+{
+    int rd, rn, rm;
+    int op;
+    int nregs;
+    int interleave;
+    int stride;
+    int size;
+    int reg;
+    int pass;
+    int load;
+    int shift;
+    uint32_t mask;
+    int n;
+
+    if (!vfp_enabled(env))
+      return 1;
+    VFP_DREG_D(rd, insn);
+    rn = (insn >> 16) & 0xf;
+    rm = insn & 0xf;
+    load = (insn & (1 << 21)) != 0;
+    if ((insn & (1 << 23)) == 0) {
+        /* Load store all elements.  */
+        op = (insn >> 8) & 0xf;
+        size = (insn >> 6) & 3;
+        if (op > 10 || size == 3)
+            return 1;
+        nregs = neon_ls_element_type[op].nregs;
+        interleave = neon_ls_element_type[op].interleave;
+        gen_movl_T1_reg(s, rn);
+        stride = (1 << size) * interleave;
+        for (reg = 0; reg < nregs; reg++) {
+            if (interleave > 2 || (interleave == 2 && nregs == 2)) {
+                gen_movl_T1_reg(s, rn);
+                gen_op_addl_T1_im((1 << size) * reg);
+            } else if (interleave == 2 && nregs == 4 && reg == 2) {
+                gen_movl_T1_reg(s, rn);
+                gen_op_addl_T1_im(1 << size);
+            }
+            for (pass = 0; pass < 2; pass++) {
+                if (size == 2) {
+                    if (load) {
+                        gen_ldst(ldl, s);
+                        NEON_SET_REG(T0, rd, pass);
+                    } else {
+                        NEON_GET_REG(T0, rd, pass);
+                        gen_ldst(stl, s);
+                    }
+                    gen_op_addl_T1_im(stride);
+                } else if (size == 1) {
+                    if (load) {
+                        gen_ldst(lduw, s);
+                        gen_op_addl_T1_im(stride);
+                        gen_op_movl_T2_T0();
+                        gen_ldst(lduw, s);
+                        gen_op_addl_T1_im(stride);
+                        gen_op_neon_insert_elt(16, 0xffff);
+                        NEON_SET_REG(T2, rd, pass);
+                    } else {
+                        NEON_GET_REG(T2, rd, pass);
+                        gen_op_movl_T0_T2();
+                        gen_ldst(stw, s);
+                        gen_op_addl_T1_im(stride);
+                        gen_op_neon_extract_elt(16, 0xffff0000);
+                        gen_ldst(stw, s);
+                        gen_op_addl_T1_im(stride);
+                    }
+                } else /* size == 0 */ {
+                    if (load) {
+                        mask = 0xff;
+                        for (n = 0; n < 4; n++) {
+                            gen_ldst(ldub, s);
+                            gen_op_addl_T1_im(stride);
+                            if (n == 0) {
+                                gen_op_movl_T2_T0();
+                            } else {
+                                gen_op_neon_insert_elt(n * 8, ~mask);
+                            }
+                            mask <<= 8;
+                        }
+                        NEON_SET_REG(T2, rd, pass);
+                    } else {
+                        NEON_GET_REG(T2, rd, pass);
+                        mask = 0xff;
+                        for (n = 0; n < 4; n++) {
+                            if (n == 0) {
+                                gen_op_movl_T0_T2();
+                            } else {
+                                gen_op_neon_extract_elt(n * 8, mask);
+                            }
+                            gen_ldst(stb, s);
+                            gen_op_addl_T1_im(stride);
+                            mask <<= 8;
+                        }
+                    }
+                }
+            }
+            rd += neon_ls_element_type[op].spacing;
+        }
+        stride = nregs * 8;
+    } else {
+        size = (insn >> 10) & 3;
+        if (size == 3) {
+            /* Load single element to all lanes.  */
+            if (!load)
+                return 1;
+            size = (insn >> 6) & 3;
+            nregs = ((insn >> 8) & 3) + 1;
+            stride = (insn & (1 << 5)) ? 2 : 1;
+            gen_movl_T1_reg(s, rn);
+            for (reg = 0; reg < nregs; reg++) {
+                switch (size) {
+                case 0:
+                    gen_ldst(ldub, s);
+                    gen_op_neon_dup_u8(0);
+                    break;
+                case 1:
+                    gen_ldst(lduw, s);
+                    gen_op_neon_dup_low16();
+                    break;
+                case 2:
+                    gen_ldst(ldl, s);
+                    break;
+                case 3:
+                    return 1;
+                }
+                gen_op_addl_T1_im(1 << size);
+                NEON_SET_REG(T0, rd, 0);
+                NEON_SET_REG(T0, rd, 1);
+                rd += stride;
+            }
+            stride = (1 << size) * nregs;
+        } else {
+            /* Single element.  */
+            pass = (insn >> 7) & 1;
+            switch (size) {
+            case 0:
+                shift = ((insn >> 5) & 3) * 8;
+                mask = 0xff << shift;
+                stride = 1;
+                break;
+            case 1:
+                shift = ((insn >> 6) & 1) * 16;
+                mask = shift ? 0xffff0000 : 0xffff;
+                stride = (insn & (1 << 5)) ? 2 : 1;
+                break;
+            case 2:
+                shift = 0;
+                mask = 0xffffffff;
+                stride = (insn & (1 << 6)) ? 2 : 1;
+                break;
+            default:
+                abort();
+            }
+            nregs = ((insn >> 8) & 3) + 1;
+            gen_movl_T1_reg(s, rn);
+            for (reg = 0; reg < nregs; reg++) {
+                if (load) {
+                    if (size != 2) {
+                        NEON_GET_REG(T2, rd, pass);
+                    }
+                    switch (size) {
+                    case 0:
+                        gen_ldst(ldub, s);
+                        break;
+                    case 1:
+                        gen_ldst(lduw, s);
+                        break;
+                    case 2:
+                        gen_ldst(ldl, s);
+                        NEON_SET_REG(T0, rd, pass);
+                        break;
+                    }
+                    if (size != 2) {
+                        gen_op_neon_insert_elt(shift, ~mask);
+                        NEON_SET_REG(T0, rd, pass);
+                    }
+                } else { /* Store */
+                    if (size == 2) {
+                        NEON_GET_REG(T0, rd, pass);
+                    } else {
+                        NEON_GET_REG(T2, rd, pass);
+                        gen_op_neon_extract_elt(shift, mask);
+                    }
+                    switch (size) {
+                    case 0:
+                        gen_ldst(stb, s);
+                        break;
+                    case 1:
+                        gen_ldst(stw, s);
+                        break;
+                    case 2:
+                        gen_ldst(stl, s);
+                        break;
+                    }
+                }
+                rd += stride;
+                gen_op_addl_T1_im(1 << size);
+            }
+            stride = nregs * (1 << size);
+        }
+    }
+    if (rm != 15) {
+        gen_movl_T1_reg(s, rn);
+        if (rm == 13) {
+            gen_op_addl_T1_im(stride);
+        } else {
+            gen_movl_T2_reg(s, rm);
+            gen_op_addl_T1_T2();
+        }
+        gen_movl_reg_T1(s, rn);
+    }
+    return 0;
+}
+
+/* Translate a NEON data processing instruction.  Return nonzero if the
+   instruction is invalid.
+   In general we process vectors in 32-bit chunks.  This means we can reuse
+   some of the scalar ops, and hopefully the code generated for 32-bit
+   hosts won't be too awful.  The downside is that the few 64-bit operations
+   (mainly shifts) get complicated.  */
+
+static int disas_neon_data_insn(CPUState * env, DisasContext *s, uint32_t insn)
+{
+    int op;
+    int q;
+    int rd, rn, rm;
+    int size;
+    int shift;
+    int pass;
+    int count;
+    int pairwise;
+    int u;
+    int n;
+    uint32_t imm;
+
+    if (!vfp_enabled(env))
+      return 1;
+    q = (insn & (1 << 6)) != 0;
+    u = (insn >> 24) & 1;
+    VFP_DREG_D(rd, insn);
+    VFP_DREG_N(rn, insn);
+    VFP_DREG_M(rm, insn);
+    size = (insn >> 20) & 3;
+    if ((insn & (1 << 23)) == 0) {
+        /* Three register same length.  */
+        op = ((insn >> 7) & 0x1e) | ((insn >> 4) & 1);
+        if (size == 3 && (op == 1 || op == 5 || op == 16)) {
+            for (pass = 0; pass < (q ? 2 : 1); pass++) {
+                NEON_GET_REG(T0, rm, pass * 2);
+                NEON_GET_REG(T1, rm, pass * 2 + 1);
+                gen_neon_movl_scratch_T0(0);
+                gen_neon_movl_scratch_T1(1);
+                NEON_GET_REG(T0, rn, pass * 2);
+                NEON_GET_REG(T1, rn, pass * 2 + 1);
+                switch (op) {
+                case 1: /* VQADD */
+                    if (u) {
+                        gen_op_neon_addl_saturate_u64();
+                    } else {
+                        gen_op_neon_addl_saturate_s64();
+                    }
+                    break;
+                case 5: /* VQSUB */
+                    if (u) {
+                        gen_op_neon_subl_saturate_u64();
+                    } else {
+                        gen_op_neon_subl_saturate_s64();
+                    }
+                    break;
+                case 16:
+                    if (u) {
+                        gen_op_neon_subl_u64();
+                    } else {
+                        gen_op_neon_addl_u64();
+                    }
+                    break;
+                default:
+                    abort();
+                }
+                NEON_SET_REG(T0, rd, pass * 2);
+                NEON_SET_REG(T1, rd, pass * 2 + 1);
+            }
+            return 0;
+        }
+        switch (op) {
+        case 8: /* VSHL */
+        case 9: /* VQSHL */
+        case 10: /* VRSHL */
+        case 11: /* VQSHL */
+            /* Shift operations have Rn and Rm reversed.  */
+            {
+                int tmp;
+                tmp = rn;
+                rn = rm;
+                rm = tmp;
+                pairwise = 0;
+            }
+            break;
+        case 20: /* VPMAX */
+        case 21: /* VPMIN */
+        case 23: /* VPADD */
+            pairwise = 1;
+            break;
+        case 26: /* VPADD (float) */
+            pairwise = (u && size < 2);
+            break;
+        case 30: /* VPMIN/VPMAX (float) */
+            pairwise = u;
+            break;
+        default:
+            pairwise = 0;
+            break;
+        }
+        for (pass = 0; pass < (q ? 4 : 2); pass++) {
+
+        if (pairwise) {
+            /* Pairwise.  */
+            if (q)
+                n = (pass & 1) * 2;
+            else
+                n = 0;
+            if (pass < q + 1) {
+                NEON_GET_REG(T0, rn, n);
+                NEON_GET_REG(T1, rn, n + 1);
+            } else {
+                NEON_GET_REG(T0, rm, n);
+                NEON_GET_REG(T1, rm, n + 1);
+            }
+        } else {
+            /* Elementwise.  */
+            NEON_GET_REG(T0, rn, pass);
+            NEON_GET_REG(T1, rm, pass);
+        }
+        switch (op) {
+        case 0: /* VHADD */
+            GEN_NEON_INTEGER_OP(hadd);
+            break;
+        case 1: /* VQADD */
+            switch (size << 1| u) {
+            case 0: gen_op_neon_qadd_s8(); break;
+            case 1: gen_op_neon_qadd_u8(); break;
+            case 2: gen_op_neon_qadd_s16(); break;
+            case 3: gen_op_neon_qadd_u16(); break;
+            case 4: gen_op_addl_T0_T1_saturate(); break;
+            case 5: gen_op_addl_T0_T1_usaturate(); break;
+            default: abort();
+            }
+            break;
+        case 2: /* VRHADD */
+            GEN_NEON_INTEGER_OP(rhadd);
+            break;
+        case 3: /* Logic ops.  */
+            switch ((u << 2) | size) {
+            case 0: /* VAND */
+                gen_op_andl_T0_T1();
+                break;
+            case 1: /* BIC */
+                gen_op_bicl_T0_T1();
+                break;
+            case 2: /* VORR */
+                gen_op_orl_T0_T1();
+                break;
+            case 3: /* VORN */
+                gen_op_notl_T1();
+                gen_op_orl_T0_T1();
+                break;
+            case 4: /* VEOR */
+                gen_op_xorl_T0_T1();
+                break;
+            case 5: /* VBSL */
+                NEON_GET_REG(T2, rd, pass);
+                gen_op_neon_bsl();
+                break;
+            case 6: /* VBIT */
+                NEON_GET_REG(T2, rd, pass);
+                gen_op_neon_bit();
+                break;
+            case 7: /* VBIF */
+                NEON_GET_REG(T2, rd, pass);
+                gen_op_neon_bif();
+                break;
+            }
+            break;
+        case 4: /* VHSUB */
+            GEN_NEON_INTEGER_OP(hsub);
+            break;
+        case 5: /* VQSUB */
+            switch ((size << 1) | u) {
+            case 0: gen_op_neon_qsub_s8(); break;
+            case 1: gen_op_neon_qsub_u8(); break;
+            case 2: gen_op_neon_qsub_s16(); break;
+            case 3: gen_op_neon_qsub_u16(); break;
+            case 4: gen_op_subl_T0_T1_saturate(); break;
+            case 5: gen_op_subl_T0_T1_usaturate(); break;
+            default: abort();
+            }
+            break;
+        case 6: /* VCGT */
+            GEN_NEON_INTEGER_OP(cgt);
+            break;
+        case 7: /* VCGE */
+            GEN_NEON_INTEGER_OP(cge);
+            break;
+        case 8: /* VSHL */
+            switch ((size << 1) | u) {
+            case 0: gen_op_neon_shl_s8(); break;
+            case 1: gen_op_neon_shl_u8(); break;
+            case 2: gen_op_neon_shl_s16(); break;
+            case 3: gen_op_neon_shl_u16(); break;
+            case 4: gen_op_neon_shl_s32(); break;
+            case 5: gen_op_neon_shl_u32(); break;
+#if 0
+            /* ??? Implementing these is tricky because the vector ops work
+               on 32-bit pieces.  */
+            case 6: gen_op_neon_shl_s64(); break;
+            case 7: gen_op_neon_shl_u64(); break;
+#else
+            case 6: case 7: cpu_abort(env, "VSHL.64 not implemented");
+#endif
+            }
+            break;
+        case 9: /* VQSHL */
+            switch ((size << 1) | u) {
+            case 0: gen_op_neon_qshl_s8(); break;
+            case 1: gen_op_neon_qshl_u8(); break;
+            case 2: gen_op_neon_qshl_s16(); break;
+            case 3: gen_op_neon_qshl_u16(); break;
+            case 4: gen_op_neon_qshl_s32(); break;
+            case 5: gen_op_neon_qshl_u32(); break;
+#if 0
+            /* ??? Implementing these is tricky because the vector ops work
+               on 32-bit pieces.  */
+            case 6: gen_op_neon_qshl_s64(); break;
+            case 7: gen_op_neon_qshl_u64(); break;
+#else
+            case 6: case 7: cpu_abort(env, "VQSHL.64 not implemented");
+#endif
+            }
+            break;
+        case 10: /* VRSHL */
+            switch ((size << 1) | u) {
+            case 0: gen_op_neon_rshl_s8(); break;
+            case 1: gen_op_neon_rshl_u8(); break;
+            case 2: gen_op_neon_rshl_s16(); break;
+            case 3: gen_op_neon_rshl_u16(); break;
+            case 4: gen_op_neon_rshl_s32(); break;
+            case 5: gen_op_neon_rshl_u32(); break;
+#if 0
+            /* ??? Implementing these is tricky because the vector ops work
+               on 32-bit pieces.  */
+            case 6: gen_op_neon_rshl_s64(); break;
+            case 7: gen_op_neon_rshl_u64(); break;
+#else
+            case 6: case 7: cpu_abort(env, "VRSHL.64 not implemented");
+#endif
+            }
+            break;
+        case 11: /* VQRSHL */
+            switch ((size << 1) | u) {
+            case 0: gen_op_neon_qrshl_s8(); break;
+            case 1: gen_op_neon_qrshl_u8(); break;
+            case 2: gen_op_neon_qrshl_s16(); break;
+            case 3: gen_op_neon_qrshl_u16(); break;
+            case 4: gen_op_neon_qrshl_s32(); break;
+            case 5: gen_op_neon_qrshl_u32(); break;
+#if 0
+            /* ??? Implementing these is tricky because the vector ops work
+               on 32-bit pieces.  */
+            case 6: gen_op_neon_qrshl_s64(); break;
+            case 7: gen_op_neon_qrshl_u64(); break;
+#else
+            case 6: case 7: cpu_abort(env, "VQRSHL.64 not implemented");
+#endif
+            }
+            break;
+        case 12: /* VMAX */
+            GEN_NEON_INTEGER_OP(max);
+            break;
+        case 13: /* VMIN */
+            GEN_NEON_INTEGER_OP(min);
+            break;
+        case 14: /* VABD */
+            GEN_NEON_INTEGER_OP(abd);
+            break;
+        case 15: /* VABA */
+            GEN_NEON_INTEGER_OP(abd);
+            NEON_GET_REG(T1, rd, pass);
+            gen_neon_add(size);
+            break;
+        case 16:
+            if (!u) { /* VADD */
+                if (gen_neon_add(size))
+                    return 1;
+            } else { /* VSUB */
+                switch (size) {
+                case 0: gen_op_neon_sub_u8(); break;
+                case 1: gen_op_neon_sub_u16(); break;
+                case 2: gen_op_subl_T0_T1(); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 17:
+            if (!u) { /* VTST */
+                switch (size) {
+                case 0: gen_op_neon_tst_u8(); break;
+                case 1: gen_op_neon_tst_u16(); break;
+                case 2: gen_op_neon_tst_u32(); break;
+                default: return 1;
+                }
+            } else { /* VCEQ */
+                switch (size) {
+                case 0: gen_op_neon_ceq_u8(); break;
+                case 1: gen_op_neon_ceq_u16(); break;
+                case 2: gen_op_neon_ceq_u32(); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 18: /* Multiply.  */
+            switch (size) {
+            case 0: gen_op_neon_mul_u8(); break;
+            case 1: gen_op_neon_mul_u16(); break;
+            case 2: gen_op_mul_T0_T1(); break;
+            default: return 1;
+            }
+            NEON_GET_REG(T1, rd, pass);
+            if (u) { /* VMLS */
+                switch (size) {
+                case 0: gen_op_neon_rsb_u8(); break;
+                case 1: gen_op_neon_rsb_u16(); break;
+                case 2: gen_op_rsbl_T0_T1(); break;
+                default: return 1;
+                }
+            } else { /* VMLA */
+                gen_neon_add(size);
+            }
+            break;
+        case 19: /* VMUL */
+            if (u) { /* polynomial */
+                gen_op_neon_mul_p8();
+            } else { /* Integer */
+                switch (size) {
+                case 0: gen_op_neon_mul_u8(); break;
+                case 1: gen_op_neon_mul_u16(); break;
+                case 2: gen_op_mul_T0_T1(); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 20: /* VPMAX */
+            GEN_NEON_INTEGER_OP(pmax);
+            break;
+        case 21: /* VPMIN */
+            GEN_NEON_INTEGER_OP(pmin);
+            break;
+        case 22: /* Hultiply high.  */
+            if (!u) { /* VQDMULH */
+                switch (size) {
+                case 1: gen_op_neon_qdmulh_s16(); break;
+                case 2: gen_op_neon_qdmulh_s32(); break;
+                default: return 1;
+                }
+            } else { /* VQRDHMUL */
+                switch (size) {
+                case 1: gen_op_neon_qrdmulh_s16(); break;
+                case 2: gen_op_neon_qrdmulh_s32(); break;
+                default: return 1;
+                }
+            }
+            break;
+        case 23: /* VPADD */
+            if (u)
+                return 1;
+            switch (size) {
+            case 0: gen_op_neon_padd_u8(); break;
+            case 1: gen_op_neon_padd_u16(); break;
+            case 2: gen_op_addl_T0_T1(); break;
+            default: return 1;
+            }
+            break;
+        case 26: /* Floating point arithnetic.  */
+            switch ((u << 2) | size) {
+            case 0: /* VADD */
+                gen_op_neon_add_f32();
+                break;
+            case 2: /* VSUB */
+                gen_op_neon_sub_f32();
+                break;
+            case 4: /* VPADD */
+                gen_op_neon_add_f32();
+                break;
+            case 6: /* VABD */
+                gen_op_neon_abd_f32();
+                break;
+            default:
+                return 1;
+            }
+            break;
+        case 27: /* Float multiply.  */
+            gen_op_neon_mul_f32();
+            if (!u) {
+                NEON_GET_REG(T1, rd, pass);
+                if (size == 0) {
+                    gen_op_neon_add_f32();
+                } else {
+                    gen_op_neon_rsb_f32();
+                }
+            }
+            break;
+        case 28: /* Float compare.  */
+            if (!u) {
+                gen_op_neon_ceq_f32();
+            } else {
+                if (size == 0)
+                    gen_op_neon_cge_f32();
+                else
+                    gen_op_neon_cgt_f32();
+            }
+            break;
+        case 29: /* Float compare absolute.  */
+            if (!u)
+                return 1;
+            if (size == 0)
+                gen_op_neon_acge_f32();
+            else
+                gen_op_neon_acgt_f32();
+            break;
+        case 30: /* Float min/max.  */
+            if (size == 0)
+                gen_op_neon_max_f32();
+            else
+                gen_op_neon_min_f32();
+            break;
+        case 31:
+            if (size == 0)
+                gen_op_neon_recps_f32();
+            else
+                gen_op_neon_rsqrts_f32();
+            break;
+        default:
+            abort();
+        }
+        /* Save the result.  For elementwise operations we can put it
+           straight into the destination register.  For pairwise operations
+           we have to be careful to avoid clobbering the source operands.  */
+        if (pairwise && rd == rm) {
+            gen_neon_movl_scratch_T0(pass);
+        } else {
+            NEON_SET_REG(T0, rd, pass);
+        }
+
+        } /* for pass */
+        if (pairwise && rd == rm) {
+            for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                gen_neon_movl_T0_scratch(pass);
+                NEON_SET_REG(T0, rd, pass);
+            }
+        }
+    } else if (insn & (1 << 4)) {
+        if ((insn & 0x00380080) != 0) {
+            /* Two registers and shift.  */
+            op = (insn >> 8) & 0xf;
+            if (insn & (1 << 7)) {
+                /* 64-bit shift.   */
+                size = 3;
+            } else {
+                size = 2;
+                while ((insn & (1 << (size + 19))) == 0)
+                    size--;
+            }
+            shift = (insn >> 16) & ((1 << (3 + size)) - 1);
+            /* To avoid excessive dumplication of ops we implement shift
+               by immediate using the variable shift operations.  */
+            if (op < 8) {
+                /* Shift by immediate:
+                   VSHR, VSRA, VRSHR, VRSRA, VSRI, VSHL, VQSHL, VQSHLU.  */
+                /* Right shifts are encoded as N - shift, where N is the
+                   element size in bits.  */
+                if (op <= 4)
+                    shift = shift - (1 << (size + 3));
+                else
+                    shift++;
+                if (size == 3) {
+                    count = q + 1;
+                } else {
+                    count = q ? 4: 2;
+                }
+                switch (size) {
+                case 0:
+                    imm = (uint8_t) shift;
+                    imm |= imm << 8;
+                    imm |= imm << 16;
+                    break;
+                case 1:
+                    imm = (uint16_t) shift;
+                    imm |= imm << 16;
+                    break;
+                case 2:
+                case 3:
+                    imm = shift;
+                    break;
+                default:
+                    abort();
+                }
+
+                for (pass = 0; pass < count; pass++) {
+                    if (size < 3) {
+                        /* Operands in T0 and T1.  */
+                        gen_op_movl_T1_im(imm);
+                        NEON_GET_REG(T0, rm, pass);
+                    } else {
+                        /* Operands in {T0, T1} and env->vfp.scratch.  */
+                        gen_op_movl_T0_im(imm);
+                        gen_neon_movl_scratch_T0(0);
+                        gen_op_movl_T0_im((int32_t)imm >> 31);
+                        gen_neon_movl_scratch_T0(1);
+                        NEON_GET_REG(T0, rm, pass * 2);
+                        NEON_GET_REG(T1, rm, pass * 2 + 1);
+                    }
+
+                    if (gen_neon_shift_im[op][u][size] == NULL)
+                        return 1;
+                    gen_neon_shift_im[op][u][size]();
+
+                    if (op == 1 || op == 3) {
+                        /* Accumulate.  */
+                        if (size == 3) {
+                            gen_neon_movl_scratch_T0(0);
+                            gen_neon_movl_scratch_T1(1);
+                            NEON_GET_REG(T0, rd, pass * 2);
+                            NEON_GET_REG(T1, rd, pass * 2 + 1);
+                            gen_op_neon_addl_u64();
+                        } else {
+                            NEON_GET_REG(T1, rd, pass);
+                            gen_neon_add(size);
+                        }
+                    } else if (op == 4 || (op == 5 && u)) {
+                        /* Insert */
+                        if (size == 3) {
+                            cpu_abort(env, "VS[LR]I.64 not implemented");
+                        }
+                        switch (size) {
+                        case 0:
+                            if (op == 4)
+                                imm = 0xff >> -shift;
+                            else
+                                imm = (uint8_t)(0xff << shift);
+                            imm |= imm << 8;
+                            imm |= imm << 16;
+                            break;
+                        case 1:
+                            if (op == 4)
+                                imm = 0xffff >> -shift;
+                            else
+                                imm = (uint16_t)(0xffff << shift);
+                            imm |= imm << 16;
+                            break;
+                        case 2:
+                            if (op == 4)
+                                imm = 0xffffffffu >> -shift;
+                            else
+                                imm = 0xffffffffu << shift;
+                            break;
+                        default:
+                            abort();
+                        }
+                        NEON_GET_REG(T1, rd, pass);
+                        gen_op_movl_T2_im(imm);
+                        gen_op_neon_bsl();
+                    }
+                    if (size == 3) {
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    } else {
+                        NEON_SET_REG(T0, rd, pass);
+                    }
+                } /* for pass */
+            } else if (op < 10) {
+                /* Shift by immedaiate and narrow:
+                   VSHRN, VRSHRN, VQSHRN, VQRSHRN.  */
+                shift = shift - (1 << (size + 3));
+                size++;
+                if (size == 3) {
+                    count = q + 1;
+                } else {
+                    count = q ? 4: 2;
+                }
+                switch (size) {
+                case 1:
+                    imm = (uint16_t) shift;
+                    imm |= imm << 16;
+                    break;
+                case 2:
+                case 3:
+                    imm = shift;
+                    break;
+                default:
+                    abort();
+                }
+
+                /* Processing MSB first means we need to do less shuffling at
+                   the end.  */
+                for (pass =  count - 1; pass >= 0; pass--) {
+                    /* Avoid clobbering the second operand before it has been
+                       written.  */
+                    n = pass;
+                    if (rd == rm)
+                        n ^= (count - 1);
+                    else
+                        n = pass;
+
+                    if (size < 3) {
+                        /* Operands in T0 and T1.  */
+                        gen_op_movl_T1_im(imm);
+                        NEON_GET_REG(T0, rm, n);
+                    } else {
+                        /* Operands in {T0, T1} and env->vfp.scratch.  */
+                        gen_op_movl_T0_im(imm);
+                        gen_neon_movl_scratch_T0(0);
+                        gen_op_movl_T0_im((int32_t)imm >> 31);
+                        gen_neon_movl_scratch_T0(1);
+                        NEON_GET_REG(T0, rm, n * 2);
+                        NEON_GET_REG(T0, rm, n * 2 + 1);
+                    }
+
+                    gen_neon_shift_im_narrow[q][u][size - 1]();
+
+                    if (size < 3 && (pass & 1) == 0) {
+                        gen_neon_movl_scratch_T0(0);
+                    } else {
+                        uint32_t offset;
+
+                        if (size < 3)
+                            gen_neon_movl_T1_scratch(0);
+
+                        if (op == 8 && !u) {
+                            gen_neon_narrow[size - 1]();
+                        } else {
+                            if (op == 8)
+                                gen_neon_narrow_sats[size - 2]();
+                            else
+                                gen_neon_narrow_satu[size - 1]();
+                        }
+                        if (size == 3)
+                            offset = neon_reg_offset(rd, n);
+                        else
+                            offset = neon_reg_offset(rd, n >> 1);
+                        gen_op_neon_setreg_T0(offset);
+                    }
+                } /* for pass */
+            } else if (op == 10) {
+                /* VSHLL */
+                if (q)
+                    return 1;
+                for (pass = 0; pass < 2; pass++) {
+                    /* Avoid clobbering the input operand.  */
+                    if (rd == rm)
+                        n = 1 - pass;
+                    else
+                        n = pass;
+
+                    NEON_GET_REG(T0, rm, n);
+                    GEN_NEON_INTEGER_OP(widen);
+                    if (shift != 0) {
+                        /* The shift is less than the width of the source
+                           type, so in some cases we can just
+                           shift the whole register.  */
+                        if (size == 1 || (size == 0 && u)) {
+                            gen_op_shll_T0_im(shift);
+                            gen_op_shll_T1_im(shift);
+                        } else {
+                            switch (size) {
+                            case 0: gen_op_neon_shll_u16(shift); break;
+                            case 2: gen_op_neon_shll_u64(shift); break;
+                            default: abort();
+                            }
+                        }
+                    }
+                    NEON_SET_REG(T0, rd, n * 2);
+                    NEON_SET_REG(T1, rd, n * 2 + 1);
+                }
+            } else if (op == 15 || op == 16) {
+                /* VCVT fixed-point.  */
+                for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                    gen_op_vfp_getreg_F0s(neon_reg_offset(rm, pass));
+                    if (op & 1) {
+                        if (u)
+                            gen_op_vfp_ultos(shift);
+                        else
+                            gen_op_vfp_sltos(shift);
+                    } else {
+                        if (u)
+                            gen_op_vfp_touls(shift);
+                        else
+                            gen_op_vfp_tosls(shift);
+                    }
+                    gen_op_vfp_setreg_F0s(neon_reg_offset(rd, pass));
+                }
+            } else {
+                return 1;
+            }
+        } else { /* (insn & 0x00380080) == 0 */
+            int invert;
+
+            op = (insn >> 8) & 0xf;
+            /* One register and immediate.  */
+            imm = (u << 7) | ((insn >> 12) & 0x70) | (insn & 0xf);
+            invert = (insn & (1 << 5)) != 0;
+            switch (op) {
+            case 0: case 1:
+                /* no-op */
+                break;
+            case 2: case 3:
+                imm <<= 8;
+                break;
+            case 4: case 5:
+                imm <<= 16;
+                break;
+            case 6: case 7:
+                imm <<= 24;
+                break;
+            case 8: case 9:
+                imm |= imm << 16;
+                break;
+            case 10: case 11:
+                imm = (imm << 8) | (imm << 24);
+                break;
+            case 12:
+                imm = (imm < 8) | 0xff;
+                break;
+            case 13:
+                imm = (imm << 16) | 0xffff;
+                break;
+            case 14:
+                imm |= (imm << 8) | (imm << 16) | (imm << 24);
+                if (invert)
+                    imm = ~imm;
+                break;
+            case 15:
+                imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
+                      | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
+                break;
+            }
+            if (invert)
+                imm = ~imm;
+
+            if (op != 14 || !invert)
+                gen_op_movl_T1_im(imm);
+
+            for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                if (op & 1 && op < 12) {
+                    NEON_GET_REG(T0, rd, pass);
+                    if (invert) {
+                        /* The immediate value has already been inverted, so
+                           BIC becomes AND.  */
+                        gen_op_andl_T0_T1();
+                    } else {
+                        gen_op_orl_T0_T1();
+                    }
+                    NEON_SET_REG(T0, rd, pass);
+                } else {
+                    if (op == 14 && invert) {
+                        uint32_t tmp;
+                        tmp = 0;
+                        for (n = 0; n < 4; n++) {
+                            if (imm & (1 << (n + (pass & 1) * 4)))
+                                tmp |= 0xff << (n * 8);
+                        }
+                        gen_op_movl_T1_im(tmp);
+                    }
+                    /* VMOV, VMVN.  */
+                    NEON_SET_REG(T1, rd, pass);
+                }
+            }
+        }
+    } else { /* (insn & 0x00800010 == 0x00800010) */
+        if (size != 3) {
+            op = (insn >> 8) & 0xf;
+            if ((insn & (1 << 6)) == 0) {
+                /* Three registers of different lengths.  */
+                int src1_wide;
+                int src2_wide;
+                int prewiden;
+                /* prewiden, src1_wide, src2_wide */
+                static const int neon_3reg_wide[16][3] = {
+                    {1, 0, 0}, /* VADDL */
+                    {1, 1, 0}, /* VADDW */
+                    {1, 0, 0}, /* VSUBL */
+                    {1, 1, 0}, /* VSUBW */
+                    {0, 1, 1}, /* VADDHN */
+                    {0, 0, 0}, /* VABAL */
+                    {0, 1, 1}, /* VSUBHN */
+                    {0, 0, 0}, /* VABDL */
+                    {0, 0, 0}, /* VMLAL */
+                    {0, 0, 0}, /* VQDMLAL */
+                    {0, 0, 0}, /* VMLSL */
+                    {0, 0, 0}, /* VQDMLSL */
+                    {0, 0, 0}, /* Integer VMULL */
+                    {0, 0, 0}, /* VQDMULL */
+                    {0, 0, 0}  /* Polynomial VMULL */
+                };
+
+                prewiden = neon_3reg_wide[op][0];
+                src1_wide = neon_3reg_wide[op][1];
+                src2_wide = neon_3reg_wide[op][2];
+
+                /* Avoid overlapping operands.  Wide source operands are
+                   always aligned so will never overlap with wide
+                   destinations in problematic ways.  */
+                if (rd == rm) {
+                    NEON_GET_REG(T2, rm, 1);
+                } else if (rd == rn) {
+                    NEON_GET_REG(T2, rn, 1);
+                }
+                for (pass = 0; pass < 2; pass++) {
+                    /* Load the second operand into env->vfp.scratch.
+                       Also widen narrow operands.  */
+                    if (pass == 1 && rd == rm) {
+                        if (prewiden) {
+                            gen_op_movl_T0_T2();
+                        } else {
+                            gen_op_movl_T1_T2();
+                        }
+                    } else {
+                        if (src2_wide) {
+                            NEON_GET_REG(T0, rm, pass * 2);
+                            NEON_GET_REG(T1, rm, pass * 2 + 1);
+                        } else {
+                            if (prewiden) {
+                                NEON_GET_REG(T0, rm, pass);
+                            } else {
+                                NEON_GET_REG(T1, rm, pass);
+                            }
+                        }
+                    }
+                    if (prewiden && !src2_wide) {
+                        GEN_NEON_INTEGER_OP(widen);
+                    }
+                    if (prewiden || src2_wide) {
+                        gen_neon_movl_scratch_T0(0);
+                        gen_neon_movl_scratch_T1(1);
+                    }
+
+                    /* Load the first operand.  */
+                    if (pass == 1 && rd == rn) {
+                        gen_op_movl_T0_T2();
+                    } else {
+                        if (src1_wide) {
+                            NEON_GET_REG(T0, rn, pass * 2);
+                            NEON_GET_REG(T1, rn, pass * 2 + 1);
+                        } else {
+                            NEON_GET_REG(T0, rn, pass);
+                        }
+                    }
+                    if (prewiden && !src1_wide) {
+                        GEN_NEON_INTEGER_OP(widen);
+                    }
+                    switch (op) {
+                    case 0: case 1: case 4: /* VADDL, VADDW, VADDHN, VRADDHN */
+                        switch (size) {
+                        case 0: gen_op_neon_addl_u16(); break;
+                        case 1: gen_op_neon_addl_u32(); break;
+                        case 2: gen_op_neon_addl_u64(); break;
+                        default: abort();
+                        }
+                        break;
+                    case 2: case 3: case 6: /* VSUBL, VSUBW, VSUBHL, VRSUBHL */
+                        switch (size) {
+                        case 0: gen_op_neon_subl_u16(); break;
+                        case 1: gen_op_neon_subl_u32(); break;
+                        case 2: gen_op_neon_subl_u64(); break;
+                        default: abort();
+                        }
+                        break;
+                    case 5: case 7: /* VABAL, VABDL */
+                        switch ((size << 1) | u) {
+                        case 0: gen_op_neon_abdl_s16(); break;
+                        case 1: gen_op_neon_abdl_u16(); break;
+                        case 2: gen_op_neon_abdl_s32(); break;
+                        case 3: gen_op_neon_abdl_u32(); break;
+                        case 4: gen_op_neon_abdl_s64(); break;
+                        case 5: gen_op_neon_abdl_u64(); break;
+                        default: abort();
+                        }
+                        break;
+                    case 8: case 9: case 10: case 11: case 12: case 13:
+                        /* VMLAL, VQDMLAL, VMLSL, VQDMLSL, VMULL, VQDMULL */
+                        switch ((size << 1) | u) {
+                        case 0: gen_op_neon_mull_s8(); break;
+                        case 1: gen_op_neon_mull_u8(); break;
+                        case 2: gen_op_neon_mull_s16(); break;
+                        case 3: gen_op_neon_mull_u16(); break;
+                        case 4: gen_op_imull_T0_T1(); break;
+                        case 5: gen_op_mull_T0_T1(); break;
+                        default: abort();
+                        }
+                        break;
+                    case 14: /* Polynomial VMULL */
+                        cpu_abort(env, "Polynomial VMULL not implemented");
+
+                    default: /* 15 is RESERVED.  */
+                        return 1;
+                    }
+                    if (op == 5 || op == 13 || (op >= 8 && op <= 11)) {
+                        /* Accumulate.  */
+                        if (op == 10 || op == 11) {
+                            switch (size) {
+                            case 0: gen_op_neon_negl_u16(); break;
+                            case 1: gen_op_neon_negl_u32(); break;
+                            case 2: gen_op_neon_negl_u64(); break;
+                            default: abort();
+                            }
+                        }
+
+                        gen_neon_movl_scratch_T0(0);
+                        gen_neon_movl_scratch_T1(1);
+
+                        if (op != 13) {
+                            NEON_GET_REG(T0, rd, pass * 2);
+                            NEON_GET_REG(T1, rd, pass * 2 + 1);
+                        }
+
+                        switch (op) {
+                        case 5: case 8: case 10: /* VABAL, VMLAL, VMLSL */
+                            switch (size) {
+                            case 0: gen_op_neon_addl_u16(); break;
+                            case 1: gen_op_neon_addl_u32(); break;
+                            case 2: gen_op_neon_addl_u64(); break;
+                            default: abort();
+                            }
+                            break;
+                        case 9: case 11: /* VQDMLAL, VQDMLSL */
+                            switch (size) {
+                            case 1: gen_op_neon_addl_saturate_s32(); break;
+                            case 2: gen_op_neon_addl_saturate_s64(); break;
+                            default: abort();
+                            }
+                            /* Fall through.  */
+                        case 13: /* VQDMULL */
+                            switch (size) {
+                            case 1: gen_op_neon_addl_saturate_s32(); break;
+                            case 2: gen_op_neon_addl_saturate_s64(); break;
+                            default: abort();
+                            }
+                            break;
+                        default:
+                            abort();
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    } else if (op == 4 || op == 6) {
+                        /* Narrowing operation.  */
+                        if (u) {
+                            switch (size) {
+                            case 0: gen_op_neon_narrow_high_u8(); break;
+                            case 1: gen_op_neon_narrow_high_u16(); break;
+                            case 2: gen_op_movl_T0_T1(); break;
+                            default: abort();
+                            }
+                        } else {
+                            switch (size) {
+                            case 0: gen_op_neon_narrow_high_round_u8(); break;
+                            case 1: gen_op_neon_narrow_high_round_u16(); break;
+                            case 2: gen_op_neon_narrow_high_round_u32(); break;
+                            default: abort();
+                            }
+                        }
+                        NEON_SET_REG(T0, rd, pass);
+                    } else {
+                        /* Write back the result.  */
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    }
+                }
+            } else {
+                /* Two registers and a scalar.  */
+                switch (op) {
+                case 0: /* Integer VMLA scalar */
+                case 1: /* Float VMLA scalar */
+                case 4: /* Integer VMLS scalar */
+                case 5: /* Floating point VMLS scalar */
+                case 8: /* Integer VMUL scalar */
+                case 9: /* Floating point VMUL scalar */
+                case 12: /* VQDMULH scalar */
+                case 13: /* VQRDMULH scalar */
+                    gen_neon_get_scalar(size, rm);
+                    gen_op_movl_T2_T0();
+                    for (pass = 0; pass < (u ? 4 : 2); pass++) {
+                        if (pass != 0)
+                            gen_op_movl_T0_T2();
+                        NEON_GET_REG(T1, rn, pass);
+                        if (op == 12) {
+                            if (size == 1) {
+                                gen_op_neon_qdmulh_s16();
+                            } else {
+                                gen_op_neon_qdmulh_s32();
+                            }
+                        } else if (op == 13) {
+                            if (size == 1) {
+                                gen_op_neon_qrdmulh_s16();
+                            } else {
+                                gen_op_neon_qrdmulh_s32();
+                            }
+                        } else if (op & 1) {
+                            gen_op_neon_mul_f32();
+                        } else {
+                            switch (size) {
+                            case 0: gen_op_neon_mul_u8(); break;
+                            case 1: gen_op_neon_mul_u16(); break;
+                            case 2: gen_op_mul_T0_T1(); break;
+                            default: return 1;
+                            }
+                        }
+                        if (op < 8) {
+                            /* Accumulate.  */
+                            NEON_GET_REG(T1, rd, pass);
+                            switch (op) {
+                            case 0:
+                                gen_neon_add(size);
+                                break;
+                            case 1:
+                                gen_op_neon_add_f32();
+                                break;
+                            case 4:
+                                switch (size) {
+                                case 0: gen_op_neon_rsb_u8(); break;
+                                case 1: gen_op_neon_rsb_u16(); break;
+                                case 2: gen_op_rsbl_T0_T1(); break;
+                                default: return 1;
+                                }
+                                break;
+                            case 5:
+                                gen_op_neon_rsb_f32();
+                                break;
+                            default:
+                                abort();
+                            }
+                        }
+                        NEON_SET_REG(T0, rd, pass);
+                    }
+                    break;
+                case 2: /* VMLAL sclar */
+                case 3: /* VQDMLAL scalar */
+                case 6: /* VMLSL scalar */
+                case 7: /* VQDMLSL scalar */
+                case 10: /* VMULL scalar */
+                case 11: /* VQDMULL scalar */
+                    if (rd == rn) {
+                        /* Save overlapping operands before they are
+                           clobbered.  */
+                        NEON_GET_REG(T0, rn, 1);
+                        gen_neon_movl_scratch_T0(2);
+                    }
+                    gen_neon_get_scalar(size, rm);
+                    gen_op_movl_T2_T0();
+                    for (pass = 0; pass < 2; pass++) {
+                        if (pass != 0) {
+                            gen_op_movl_T0_T2();
+                        }
+                        if (pass != 0 && rd == rn) {
+                            gen_neon_movl_T1_scratch(2);
+                        } else {
+                            NEON_GET_REG(T1, rn, pass);
+                        }
+                        switch ((size << 1) | u) {
+                        case 0: gen_op_neon_mull_s8(); break;
+                        case 1: gen_op_neon_mull_u8(); break;
+                        case 2: gen_op_neon_mull_s16(); break;
+                        case 3: gen_op_neon_mull_u16(); break;
+                        case 4: gen_op_imull_T0_T1(); break;
+                        case 5: gen_op_mull_T0_T1(); break;
+                        default: abort();
+                        }
+                        if (op == 6 || op == 7) {
+                            switch (size) {
+                            case 0: gen_op_neon_negl_u16(); break;
+                            case 1: gen_op_neon_negl_u32(); break;
+                            case 2: gen_op_neon_negl_u64(); break;
+                            default: abort();
+                            }
+                        }
+                        gen_neon_movl_scratch_T0(0);
+                        gen_neon_movl_scratch_T1(1);
+                        NEON_GET_REG(T0, rd, pass * 2);
+                        NEON_GET_REG(T1, rd, pass * 2 + 1);
+                        switch (op) {
+                        case 2: case 6:
+                            switch (size) {
+                            case 0: gen_op_neon_addl_u16(); break;
+                            case 1: gen_op_neon_addl_u32(); break;
+                            case 2: gen_op_neon_addl_u64(); break;
+                            default: abort();
+                            }
+                            break;
+                        case 3: case 7:
+                            switch (size) {
+                            case 1:
+                                gen_op_neon_addl_saturate_s32();
+                                gen_op_neon_addl_saturate_s32();
+                                break;
+                            case 2:
+                                gen_op_neon_addl_saturate_s64();
+                                gen_op_neon_addl_saturate_s64();
+                                break;
+                            default: abort();
+                            }
+                            break;
+                        case 10:
+                            /* no-op */
+                            break;
+                        case 11:
+                            switch (size) {
+                            case 1: gen_op_neon_addl_saturate_s32(); break;
+                            case 2: gen_op_neon_addl_saturate_s64(); break;
+                            default: abort();
+                            }
+                            break;
+                        default:
+                            abort();
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    }
+                    break;
+                default: /* 14 and 15 are RESERVED */
+                    return 1;
+                }
+            }
+        } else { /* size == 3 */
+            if (!u) {
+                /* Extract.  */
+                int reg;
+                imm = (insn >> 8) & 0xf;
+                reg = rn;
+                count = q ? 4 : 2;
+                n = imm >> 2;
+                NEON_GET_REG(T0, reg, n);
+                for (pass = 0; pass < count; pass++) {
+                    n++;
+                    if (n > count) {
+                        reg = rm;
+                        n -= count;
+                    }
+                    if (imm & 3) {
+                        NEON_GET_REG(T1, reg, n);
+                        gen_op_neon_extract((insn << 3) & 0x1f);
+                    }
+                    /* ??? This is broken if rd and rm overlap */
+                    NEON_SET_REG(T0, rd, pass);
+                    if (imm & 3) {
+                        gen_op_movl_T0_T1();
+                    } else {
+                        NEON_GET_REG(T0, reg, n);
+                    }
+                }
+            } else if ((insn & (1 << 11)) == 0) {
+                /* Two register misc.  */
+                op = ((insn >> 12) & 0x30) | ((insn >> 7) & 0xf);
+                size = (insn >> 18) & 3;
+                switch (op) {
+                case 0: /* VREV64 */
+                    if (size == 3)
+                        return 1;
+                    for (pass = 0; pass < (q ? 2 : 1); pass++) {
+                        NEON_GET_REG(T0, rm, pass * 2);
+                        NEON_GET_REG(T1, rm, pass * 2 + 1);
+                        switch (size) {
+                        case 0: gen_op_rev_T0(); break;
+                        case 1: gen_op_revh_T0(); break;
+                        case 2: /* no-op */ break;
+                        default: abort();
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2 + 1);
+                        if (size == 2) {
+                            NEON_SET_REG(T1, rd, pass * 2);
+                        } else {
+                            gen_op_movl_T0_T1();
+                            switch (size) {
+                            case 0: gen_op_rev_T0(); break;
+                            case 1: gen_op_revh_T0(); break;
+                            default: abort();
+                            }
+                            NEON_SET_REG(T0, rd, pass * 2);
+                        }
+                    }
+                    break;
+                case 4: case 5: /* VPADDL */
+                case 12: case 13: /* VPADAL */
+                    if (size < 2)
+                        goto elementwise;
+                    if (size == 3)
+                        return 1;
+                    for (pass = 0; pass < (q ? 2 : 1); pass++) {
+                        NEON_GET_REG(T0, rm, pass * 2);
+                        NEON_GET_REG(T1, rm, pass * 2 + 1);
+                        if (op & 1)
+                            gen_op_neon_paddl_u32();
+                        else
+                            gen_op_neon_paddl_s32();
+                        if (op >= 12) {
+                            /* Accumulate.  */
+                            gen_neon_movl_scratch_T0(0);
+                            gen_neon_movl_scratch_T1(1);
+
+                            NEON_GET_REG(T0, rd, pass * 2);
+                            NEON_GET_REG(T1, rd, pass * 2 + 1);
+                            gen_op_neon_addl_u64();
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    }
+                    break;
+                case 33: /* VTRN */
+                    if (size == 2) {
+                        for (n = 0; n < (q ? 4 : 2); n += 2) {
+                            NEON_GET_REG(T0, rm, n);
+                            NEON_GET_REG(T1, rd, n + 1);
+                            NEON_SET_REG(T1, rm, n);
+                            NEON_SET_REG(T0, rd, n + 1);
+                        }
+                    } else {
+                        goto elementwise;
+                    }
+                    break;
+                case 34: /* VUZP */
+                    /* Reg  Before       After
+                       Rd   A3 A2 A1 A0  B2 B0 A2 A0
+                       Rm   B3 B2 B1 B0  B3 B1 A3 A1
+                     */
+                    if (size == 3)
+                        return 1;
+                    gen_neon_unzip(rd, q, 0, size);
+                    gen_neon_unzip(rm, q, 4, size);
+                    if (q) {
+                        static int unzip_order_q[8] =
+                            {0, 2, 4, 6, 1, 3, 5, 7};
+                        for (n = 0; n < 8; n++) {
+                            int reg = (n < 4) ? rd : rm;
+                            gen_neon_movl_T0_scratch(unzip_order_q[n]);
+                            NEON_SET_REG(T0, reg, n % 4);
+                        }
+                    } else {
+                        static int unzip_order[4] =
+                            {0, 4, 1, 5};
+                        for (n = 0; n < 4; n++) {
+                            int reg = (n < 2) ? rd : rm;
+                            gen_neon_movl_T0_scratch(unzip_order[n]);
+                            NEON_SET_REG(T0, reg, n % 2);
+                        }
+                    }
+                    break;
+                case 35: /* VZIP */
+                    /* Reg  Before       After
+                       Rd   A3 A2 A1 A0  B1 A1 B0 A0
+                       Rm   B3 B2 B1 B0  B3 A3 B2 A2
+                     */
+                    if (size == 3)
+                        return 1;
+                    count = (q ? 4 : 2);
+                    for (n = 0; n < count; n++) {
+                        NEON_GET_REG(T0, rd, n);
+                        NEON_GET_REG(T1, rd, n);
+                        switch (size) {
+                        case 0: gen_op_neon_zip_u8(); break;
+                        case 1: gen_op_neon_zip_u16(); break;
+                        case 2: /* no-op */; break;
+                        default: abort();
+                        }
+                        gen_neon_movl_scratch_T0(n * 2);
+                        gen_neon_movl_scratch_T1(n * 2 + 1);
+                    }
+                    for (n = 0; n < count * 2; n++) {
+                        int reg = (n < count) ? rd : rm;
+                        gen_neon_movl_T0_scratch(n);
+                        NEON_SET_REG(T0, reg, n % count);
+                    }
+                    break;
+                case 36: case 37: /* VMOVN, VQMOVUN, VQMOVN */
+                    for (pass = 0; pass < 2; pass++) {
+                        if (rd == rm + 1) {
+                            n = 1 - pass;
+                        } else {
+                            n = pass;
+                        }
+                        NEON_GET_REG(T0, rm, n * 2);
+                        NEON_GET_REG(T1, rm, n * 2 + 1);
+                        if (op == 36 && q == 0) {
+                            switch (size) {
+                            case 0: gen_op_neon_narrow_u8(); break;
+                            case 1: gen_op_neon_narrow_u16(); break;
+                            case 2: /* no-op */ break;
+                            default: return 1;
+                            }
+                        } else if (q) {
+                            switch (size) {
+                            case 0: gen_op_neon_narrow_sat_u8(); break;
+                            case 1: gen_op_neon_narrow_sat_u16(); break;
+                            case 2: gen_op_neon_narrow_sat_u32(); break;
+                            default: return 1;
+                            }
+                        } else {
+                            switch (size) {
+                            case 0: gen_op_neon_narrow_sat_s8(); break;
+                            case 1: gen_op_neon_narrow_sat_s16(); break;
+                            case 2: gen_op_neon_narrow_sat_s32(); break;
+                            default: return 1;
+                            }
+                        }
+                        NEON_SET_REG(T0, rd, n);
+                    }
+                    break;
+                case 38: /* VSHLL */
+                    if (q)
+                        return 1;
+                    if (rm == rd) {
+                        NEON_GET_REG(T2, rm, 1);
+                    }
+                    for (pass = 0; pass < 2; pass++) {
+                        if (pass == 1 && rm == rd) {
+                            gen_op_movl_T0_T2();
+                        } else {
+                            NEON_GET_REG(T0, rm, pass);
+                        }
+                        switch (size) {
+                        case 0: gen_op_neon_widen_high_u8(); break;
+                        case 1: gen_op_neon_widen_high_u16(); break;
+                        case 2:
+                            gen_op_movl_T1_T0();
+                            gen_op_movl_T0_im(0);
+                            break;
+                        default: return 1;
+                        }
+                        NEON_SET_REG(T0, rd, pass * 2);
+                        NEON_SET_REG(T1, rd, pass * 2 + 1);
+                    }
+                    break;
+                default:
+                elementwise:
+                    for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                        if (op == 30 || op == 31 || op >= 58) {
+                            gen_op_vfp_getreg_F0s(neon_reg_offset(rm, pass));
+                        } else {
+                            NEON_GET_REG(T0, rm, pass);
+                        }
+                        switch (op) {
+                        case 1: /* VREV32 */
+                            switch (size) {
+                            case 0: gen_op_rev_T0(); break;
+                            case 1: gen_op_revh_T0(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 2: /* VREV16 */
+                            if (size != 0)
+                                return 1;
+                            gen_op_rev16_T0();
+                            break;
+                        case 4: case 5: /* VPADDL */
+                        case 12: case 13: /* VPADAL */
+                            switch ((size << 1) | (op & 1)) {
+                            case 0: gen_op_neon_paddl_s8(); break;
+                            case 1: gen_op_neon_paddl_u8(); break;
+                            case 2: gen_op_neon_paddl_s16(); break;
+                            case 3: gen_op_neon_paddl_u16(); break;
+                            default: abort();
+                            }
+                            if (op >= 12) {
+                                /* Accumulate */
+                                NEON_GET_REG(T1, rd, pass);
+                                switch (size) {
+                                case 0: gen_op_neon_add_u16(); break;
+                                case 1: gen_op_addl_T0_T1(); break;
+                                default: abort();
+                                }
+                            }
+                            break;
+                        case 8: /* CLS */
+                            switch (size) {
+                            case 0: gen_op_neon_cls_s8(); break;
+                            case 1: gen_op_neon_cls_s16(); break;
+                            case 2: gen_op_neon_cls_s32(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 9: /* CLZ */
+                            switch (size) {
+                            case 0: gen_op_neon_clz_u8(); break;
+                            case 1: gen_op_neon_clz_u16(); break;
+                            case 2: gen_op_clz_T0(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 10: /* CNT */
+                            if (size != 0)
+                                return 1;
+                            gen_op_neon_cnt_u8();
+                            break;
+                        case 11: /* VNOT */
+                            if (size != 0)
+                                return 1;
+                            gen_op_notl_T0();
+                            break;
+                        case 14: /* VQABS */
+                            switch (size) {
+                            case 0: gen_op_neon_qabs_s8(); break;
+                            case 1: gen_op_neon_qabs_s16(); break;
+                            case 2: gen_op_neon_qabs_s32(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 15: /* VQNEG */
+                            switch (size) {
+                            case 0: gen_op_neon_qneg_s8(); break;
+                            case 1: gen_op_neon_qneg_s16(); break;
+                            case 2: gen_op_neon_qneg_s32(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 16: case 19: /* VCGT #0, VCLE #0 */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_op_neon_cgt_s8(); break;
+                            case 1: gen_op_neon_cgt_s16(); break;
+                            case 2: gen_op_neon_cgt_s32(); break;
+                            default: return 1;
+                            }
+                            if (op == 19)
+                                gen_op_notl_T0();
+                            break;
+                        case 17: case 20: /* VCGE #0, VCLT #0 */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_op_neon_cge_s8(); break;
+                            case 1: gen_op_neon_cge_s16(); break;
+                            case 2: gen_op_neon_cge_s32(); break;
+                            default: return 1;
+                            }
+                            if (op == 20)
+                                gen_op_notl_T0();
+                            break;
+                        case 18: /* VCEQ #0 */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_op_neon_ceq_u8(); break;
+                            case 1: gen_op_neon_ceq_u16(); break;
+                            case 2: gen_op_neon_ceq_u32(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 22: /* VABS */
+                            switch(size) {
+                            case 0: gen_op_neon_abs_s8(); break;
+                            case 1: gen_op_neon_abs_s16(); break;
+                            case 2: gen_op_neon_abs_s32(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 23: /* VNEG */
+                            gen_op_movl_T1_im(0);
+                            switch(size) {
+                            case 0: gen_op_neon_rsb_u8(); break;
+                            case 1: gen_op_neon_rsb_u16(); break;
+                            case 2: gen_op_rsbl_T0_T1(); break;
+                            default: return 1;
+                            }
+                            break;
+                        case 24: case 27: /* Float VCGT #0, Float VCLE #0 */
+                            gen_op_movl_T1_im(0);
+                            gen_op_neon_cgt_f32();
+                            if (op == 27)
+                                gen_op_notl_T0();
+                            break;
+                        case 25: case 28: /* Float VCGE #0, Float VCLT #0 */
+                            gen_op_movl_T1_im(0);
+                            gen_op_neon_cge_f32();
+                            if (op == 28)
+                                gen_op_notl_T0();
+                            break;
+                        case 26: /* Float VCEQ #0 */
+                            gen_op_movl_T1_im(0);
+                            gen_op_neon_ceq_f32();
+                            break;
+                        case 30: /* Float VABS */
+                            gen_op_vfp_abss();
+                            break;
+                        case 31: /* Float VNEG */
+                            gen_op_vfp_negs();
+                            break;
+                        case 32: /* VSWP */
+                            NEON_GET_REG(T1, rd, pass);
+                            NEON_SET_REG(T1, rm, pass);
+                            break;
+                        case 33: /* VTRN */
+                            NEON_GET_REG(T1, rd, pass);
+                            switch (size) {
+                            case 0: gen_op_neon_trn_u8(); break;
+                            case 1: gen_op_neon_trn_u16(); break;
+                            case 2: abort();
+                            default: return 1;
+                            }
+                            NEON_SET_REG(T1, rm, pass);
+                            break;
+                        case 56: /* Integer VRECPE */
+                            gen_op_neon_recpe_u32();
+                            break;
+                        case 57: /* Integer VRSQRTE */
+                            gen_op_neon_rsqrte_u32();
+                            break;
+                        case 58: /* Float VRECPE */
+                            gen_op_neon_recpe_f32();
+                            break;
+                        case 59: /* Float VRSQRTE */
+                            gen_op_neon_rsqrte_f32();
+                            break;
+                        case 60: /* VCVT.F32.S32 */
+                            gen_op_vfp_tosizs();
+                            break;
+                        case 61: /* VCVT.F32.U32 */
+                            gen_op_vfp_touizs();
+                            break;
+                        case 62: /* VCVT.S32.F32 */
+                            gen_op_vfp_sitos();
+                            break;
+                        case 63: /* VCVT.U32.F32 */
+                            gen_op_vfp_uitos();
+                            break;
+                        default:
+                            /* Reserved: 21, 29, 39-56 */
+                            return 1;
+                        }
+                        if (op == 30 || op == 31 || op >= 58) {
+                            gen_op_vfp_setreg_F0s(neon_reg_offset(rm, pass));
+                        } else {
+                            NEON_SET_REG(T0, rd, pass);
+                        }
+                    }
+                    break;
+                }
+            } else if ((insn & (1 << 10)) == 0) {
+                /* VTBL, VTBX.  */
+                n = (insn >> 5) & 0x18;
+                NEON_GET_REG(T1, rm, 0);
+                if (insn & (1 << 6)) {
+                    NEON_GET_REG(T0, rd, 0);
+                } else {
+                    gen_op_movl_T0_im(0);
+                }
+                gen_op_neon_tbl(rn, n);
+                gen_op_movl_T2_T0();
+                NEON_GET_REG(T1, rm, 1);
+                if (insn & (1 << 6)) {
+                    NEON_GET_REG(T0, rd, 0);
+                } else {
+                    gen_op_movl_T0_im(0);
+                }
+                gen_op_neon_tbl(rn, n);
+                NEON_SET_REG(T2, rd, 0);
+                NEON_SET_REG(T0, rd, 1);
+            } else if ((insn & 0x380) == 0) {
+                /* VDUP */
+                if (insn & (1 << 19)) {
+                    NEON_SET_REG(T0, rm, 1);
+                } else {
+                    NEON_SET_REG(T0, rm, 0);
+                }
+                if (insn & (1 << 16)) {
+                    gen_op_neon_dup_u8(((insn >> 17) & 3) * 8);
+                } else if (insn & (1 << 17)) {
+                    if ((insn >> 18) & 1)
+                        gen_op_neon_dup_high16();
+                    else
+                        gen_op_neon_dup_low16();
+                }
+                for (pass = 0; pass < (q ? 4 : 2); pass++) {
+                    NEON_SET_REG(T0, rd, pass);
+                }
+            } else {
+                return 1;
+            }
+        }
+    }
+    return 0;
+}
+
+static int disas_coproc_insn(CPUState * env, DisasContext *s, uint32_t insn)
+{
+    int cpnum;
+
+    cpnum = (insn >> 8) & 0xf;
+    if (arm_feature(env, ARM_FEATURE_XSCALE)
+	    && ((env->cp15.c15_cpar ^ 0x3fff) & (1 << cpnum)))
+	return 1;
+
+    switch (cpnum) {
+      case 0:
+      case 1:
+	if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
+	    return disas_iwmmxt_insn(env, s, insn);
+	} else if (arm_feature(env, ARM_FEATURE_XSCALE)) {
+	    return disas_dsp_insn(env, s, insn);
+	}
+	return 1;
+    case 10:
+    case 11:
+	return disas_vfp_insn (env, s, insn);
+    case 15:
+	return disas_cp15_insn (env, s, insn);
+    default:
+	/* Unknown coprocessor.  See if the board has hooked it.  */
+	return disas_cp_insn (env, s, insn);
+    }
+}
+
 static void disas_arm_insn(CPUState * env, DisasContext *s)
 {
     unsigned int cond, insn, val, op1, i, shift, rm, rs, rn, rd, sh;
@@ -2209,12 +4651,137 @@
     insn = ldl_code(s->pc);
     s->pc += 4;
 
+    /* M variants do not implement ARM mode.  */
+    if (IS_M(env))
+        goto illegal_op;
     cond = insn >> 28;
     if (cond == 0xf){
         /* Unconditional instructions.  */
+        if (((insn >> 25) & 7) == 1) {
+            /* NEON Data processing.  */
+            if (!arm_feature(env, ARM_FEATURE_NEON))
+                goto illegal_op;
+
+            if (disas_neon_data_insn(env, s, insn))
+                goto illegal_op;
+            return;
+        }
+        if ((insn & 0x0f100000) == 0x04000000) {
+            /* NEON load/store.  */
+            if (!arm_feature(env, ARM_FEATURE_NEON))
+                goto illegal_op;
+
+            if (disas_neon_ls_insn(env, s, insn))
+                goto illegal_op;
+            return;
+        }
         if ((insn & 0x0d70f000) == 0x0550f000)
             return; /* PLD */
-        else if ((insn & 0x0e000000) == 0x0a000000) {
+        else if ((insn & 0x0ffffdff) == 0x01010000) {
+            ARCH(6);
+            /* setend */
+            if (insn & (1 << 9)) {
+                /* BE8 mode not implemented.  */
+                goto illegal_op;
+            }
+            return;
+        } else if ((insn & 0x0fffff00) == 0x057ff000) {
+            switch ((insn >> 4) & 0xf) {
+            case 1: /* clrex */
+                ARCH(6K);
+                gen_op_clrex();
+                return;
+            case 4: /* dsb */
+            case 5: /* dmb */
+            case 6: /* isb */
+                ARCH(7);
+                /* We don't emulate caches so these are a no-op.  */
+                return;
+            default:
+                goto illegal_op;
+            }
+        } else if ((insn & 0x0e5fffe0) == 0x084d0500) {
+            /* srs */
+            uint32_t offset;
+            if (IS_USER(s))
+                goto illegal_op;
+            ARCH(6);
+            op1 = (insn & 0x1f);
+            if (op1 == (env->uncached_cpsr & CPSR_M)) {
+                gen_movl_T1_reg(s, 13);
+            } else {
+                gen_op_movl_T1_r13_banked(op1);
+            }
+            i = (insn >> 23) & 3;
+            switch (i) {
+            case 0: offset = -4; break; /* DA */
+            case 1: offset = -8; break; /* DB */
+            case 2: offset = 0; break; /* IA */
+            case 3: offset = 4; break; /* IB */
+            default: abort();
+            }
+            if (offset)
+                gen_op_addl_T1_im(offset);
+            gen_movl_T0_reg(s, 14);
+            gen_ldst(stl, s);
+            gen_op_movl_T0_cpsr();
+            gen_op_addl_T1_im(4);
+            gen_ldst(stl, s);
+            if (insn & (1 << 21)) {
+                /* Base writeback.  */
+                switch (i) {
+                case 0: offset = -8; break;
+                case 1: offset = -4; break;
+                case 2: offset = 4; break;
+                case 3: offset = 0; break;
+                default: abort();
+                }
+                if (offset)
+                    gen_op_addl_T1_im(offset);
+                if (op1 == (env->uncached_cpsr & CPSR_M)) {
+                    gen_movl_reg_T1(s, 13);
+                } else {
+                    gen_op_movl_r13_T1_banked(op1);
+                }
+            }
+        } else if ((insn & 0x0e5fffe0) == 0x081d0a00) {
+            /* rfe */
+            uint32_t offset;
+            if (IS_USER(s))
+                goto illegal_op;
+            ARCH(6);
+            rn = (insn >> 16) & 0xf;
+            gen_movl_T1_reg(s, rn);
+            i = (insn >> 23) & 3;
+            switch (i) {
+            case 0: offset = 0; break; /* DA */
+            case 1: offset = -4; break; /* DB */
+            case 2: offset = 4; break; /* IA */
+            case 3: offset = 8; break; /* IB */
+            default: abort();
+            }
+            if (offset)
+                gen_op_addl_T1_im(offset);
+            /* Load CPSR into T2 and PC into T0.  */
+            gen_ldst(ldl, s);
+            gen_op_movl_T2_T0();
+            gen_op_addl_T1_im(-4);
+            gen_ldst(ldl, s);
+            if (insn & (1 << 21)) {
+                /* Base writeback.  */
+                switch (i) {
+                case 0: offset = -4; break;
+                case 1: offset = 0; break;
+                case 2: offset = 8; break;
+                case 3: offset = 4; break;
+                default: abort();
+                }
+                if (offset)
+                    gen_op_addl_T1_im(offset);
+                gen_movl_reg_T1(s, rn);
+            }
+            gen_rfe(s);
+        } else if ((insn & 0x0e000000) == 0x0a000000) {
             /* branch link and change to thumb (blx <offset>) */
             int32_t offset;
 
@@ -2242,13 +4809,30 @@
         } else if ((insn & 0x0f000010) == 0x0e000010) {
             /* Additional coprocessor register transfer.  */
         } else if ((insn & 0x0ff10010) == 0x01000000) {
+            uint32_t mask;
+            uint32_t val;
             /* cps (privileged) */
-        } else if ((insn & 0x0ffffdff) == 0x01010000) {
-            /* setend */
-            if (insn & (1 << 9)) {
-                /* BE8 mode not implemented.  */
-                goto illegal_op;
+            if (IS_USER(s))
+                return;
+            mask = val = 0;
+            if (insn & (1 << 19)) {
+                if (insn & (1 << 8))
+                    mask |= CPSR_A;
+                if (insn & (1 << 7))
+                    mask |= CPSR_I;
+                if (insn & (1 << 6))
+                    mask |= CPSR_F;
+                if (insn & (1 << 18))
+                    val |= mask;
             }
+            if (insn & (1 << 14)) {
+                mask |= CPSR_M;
+                val |= (insn & 0x1f);
+            }
+            if (mask) {
+                gen_op_movl_T0_im(val);
+                gen_set_psr_T0(s, mask, 0);
+            }
             return;
         }
         goto illegal_op;
@@ -2259,21 +4843,41 @@
         s->condlabel = gen_new_label();
         gen_test_cc[cond ^ 1](s->condlabel);
         s->condjmp = 1;
-        //gen_test_cc[cond ^ 1]((long)s->tb, (long)s->pc);
-        //s->is_jmp = DISAS_JUMP_NEXT;
     }
     if ((insn & 0x0f900000) == 0x03000000) {
-        if ((insn & 0x0fb0f000) != 0x0320f000)
-            goto illegal_op;
-        /* CPSR = immediate */
-        val = insn & 0xff;
-        shift = ((insn >> 8) & 0xf) * 2;
-        if (shift)
-            val = (val >> shift) | (val << (32 - shift));
-        gen_op_movl_T0_im(val);
-        i = ((insn & (1 << 22)) != 0);
-        if (gen_set_psr_T0(s, msr_mask(s, (insn >> 16) & 0xf, i), i))
-            goto illegal_op;
+        if ((insn & (1 << 21)) == 0) {
+            ARCH(6T2);
+            rd = (insn >> 12) & 0xf;
+            val = ((insn >> 4) & 0xf000) | (insn & 0xfff);
+            if ((insn & (1 << 22)) == 0) {
+                /* MOVW */
+                gen_op_movl_T0_im(val);
+            } else {
+                /* MOVT */
+                gen_movl_T0_reg(s, rd);
+                gen_op_movl_T1_im(0xffff);
+                gen_op_andl_T0_T1();
+                gen_op_movl_T1_im(val << 16);
+                gen_op_orl_T0_T1();
+            }
+            gen_movl_reg_T0(s, rd);
+        } else {
+            if (((insn >> 12) & 0xf) != 0xf)
+                goto illegal_op;
+            if (((insn >> 16) & 0xf) == 0) {
+                gen_nop_hint(s, insn & 0xff);
+            } else {
+                /* CPSR = immediate */
+                val = insn & 0xff;
+                shift = ((insn >> 8) & 0xf) * 2;
+                if (shift)
+                    val = (val >> shift) | (val << (32 - shift));
+                gen_op_movl_T0_im(val);
+                i = ((insn & (1 << 22)) != 0);
+                if (gen_set_psr_T0(s, msr_mask(env, s, (insn >> 16) & 0xf, i), i))
+                    goto illegal_op;
+            }
+        }
     } else if ((insn & 0x0f900000) == 0x01000000
                && (insn & 0x00000090) != 0x00000090) {
         /* miscellaneous instructions */
@@ -2286,7 +4890,7 @@
                 /* PSR = reg */
                 gen_movl_T0_reg(s, rm);
                 i = ((op1 & 2) != 0);
-                if (gen_set_psr_T0(s, msr_mask(s, (insn >> 16) & 0xf, i), i))
+                if (gen_set_psr_T0(s, msr_mask(env, s, (insn >> 16) & 0xf, i), i))
                     goto illegal_op;
             } else {
                 /* reg = PSR */
@@ -2351,6 +4955,7 @@
             gen_movl_reg_T0(s, rd);
             break;
         case 7: /* bkpt */
+            gen_set_condexec(s);
             gen_op_movl_T0_im((long)s->pc - 4);
             gen_op_movl_reg_TN[0][15]();
             gen_op_bkpt();
@@ -2585,19 +5190,28 @@
                     rn = (insn >> 12) & 0xf;
                     rs = (insn >> 8) & 0xf;
                     rm = (insn) & 0xf;
-                    if (((insn >> 22) & 3) == 0) {
+                    op1 = (insn >> 20) & 0xf;
+                    switch (op1) {
+                    case 0: case 1: case 2: case 3: case 6:
                         /* 32 bit mul */
                         gen_movl_T0_reg(s, rs);
                         gen_movl_T1_reg(s, rm);
                         gen_op_mul_T0_T1();
-                        if (insn & (1 << 21)) {
+                        if (insn & (1 << 22)) {
+                            /* Subtract (mls) */
+                            ARCH(6T2);
                             gen_movl_T1_reg(s, rn);
+                            gen_op_rsbl_T0_T1();
+                        } else if (insn & (1 << 21)) {
+                            /* Add */
+                            gen_movl_T1_reg(s, rn);
                             gen_op_addl_T0_T1();
                         }
                         if (insn & (1 << 20))
                             gen_op_logic_T0_cc();
                         gen_movl_reg_T0(s, rd);
-                    } else {
+                        break;
+                    default:
                         /* 64 bit mul */
                         gen_movl_T0_reg(s, rs);
                         gen_movl_T1_reg(s, rm);
@@ -2616,13 +5230,22 @@
                             gen_op_logicq_cc();
                         gen_movl_reg_T0(s, rn);
                         gen_movl_reg_T1(s, rd);
+                        break;
                     }
                 } else {
                     rn = (insn >> 16) & 0xf;
                     rd = (insn >> 12) & 0xf;
                     if (insn & (1 << 23)) {
                         /* load/store exclusive */
-                        goto illegal_op;
+                        gen_movl_T1_reg(s, rn);
+                        if (insn & (1 << 20)) {
+                            gen_ldst(ldlex, s);
+                        } else {
+                            rm = insn & 0xf;
+                            gen_movl_T0_reg(s, rm);
+                            gen_ldst(stlex, s);
+                        }
+                        gen_movl_reg_T0(s, rd);
                     } else {
                         /* SWP instruction */
                         rm = (insn) & 0xf;
@@ -2708,8 +5331,227 @@
             break;
         case 0x4:
         case 0x5:
+            goto do_ldst;
         case 0x6:
         case 0x7:
+            if (insn & (1 << 4)) {
+                ARCH(6);
+                /* Armv6 Media instructions.  */
+                rm = insn & 0xf;
+                rn = (insn >> 16) & 0xf;
+                rd = (insn >> 12) & 0xf;
+                rs = (insn >> 8) & 0xf;
+                switch ((insn >> 23) & 3) {
+                case 0: /* Parallel add/subtract.  */
+                    op1 = (insn >> 20) & 7;
+                    gen_movl_T0_reg(s, rn);
+                    gen_movl_T1_reg(s, rm);
+                    sh = (insn >> 5) & 7;
+                    if ((op1 & 3) == 0 || sh == 5 || sh == 6)
+                        goto illegal_op;
+                    gen_arm_parallel_addsub[op1][sh]();
+                    gen_movl_reg_T0(s, rd);
+                    break;
+                case 1:
+                    if ((insn & 0x00700020) == 0) {
+                        /* Hafword pack.  */
+                        gen_movl_T0_reg(s, rn);
+                        gen_movl_T1_reg(s, rm);
+                        shift = (insn >> 7) & 0x1f;
+                        if (shift)
+                            gen_op_shll_T1_im(shift);
+                        if (insn & (1 << 6))
+                            gen_op_pkhtb_T0_T1();
+                        else
+                            gen_op_pkhbt_T0_T1();
+                        gen_movl_reg_T0(s, rd);
+                    } else if ((insn & 0x00200020) == 0x00200000) {
+                        /* [us]sat */
+                        gen_movl_T1_reg(s, rm);
+                        shift = (insn >> 7) & 0x1f;
+                        if (insn & (1 << 6)) {
+                            if (shift == 0)
+                                shift = 31;
+                            gen_op_sarl_T1_im(shift);
+                        } else {
+                            gen_op_shll_T1_im(shift);
+                        }
+                        sh = (insn >> 16) & 0x1f;
+                        if (sh != 0) {
+                            if (insn & (1 << 22))
+                                gen_op_usat_T1(sh);
+                            else
+                                gen_op_ssat_T1(sh);
+                        }
+                        gen_movl_T1_reg(s, rd);
+                    } else if ((insn & 0x00300fe0) == 0x00200f20) {
+                        /* [us]sat16 */
+                        gen_movl_T1_reg(s, rm);
+                        sh = (insn >> 16) & 0x1f;
+                        if (sh != 0) {
+                            if (insn & (1 << 22))
+                                gen_op_usat16_T1(sh);
+                            else
+                                gen_op_ssat16_T1(sh);
+                        }
+                        gen_movl_T1_reg(s, rd);
+                    } else if ((insn & 0x00700fe0) == 0x00000fa0) {
+                        /* Select bytes.  */
+                        gen_movl_T0_reg(s, rn);
+                        gen_movl_T1_reg(s, rm);
+                        gen_op_sel_T0_T1();
+                        gen_movl_reg_T0(s, rd);
+                    } else if ((insn & 0x000003e0) == 0x00000060) {
+                        gen_movl_T1_reg(s, rm);
+                        shift = (insn >> 10) & 3;
+                        /* ??? In many cases it's not neccessary to do a
+                           rotate, a shift is sufficient.  */
+                        if (shift != 0)
+                            gen_op_rorl_T1_im(shift * 8);
+                        op1 = (insn >> 20) & 7;
+                        switch (op1) {
+                        case 0: gen_op_sxtb16_T1(); break;
+                        case 2: gen_op_sxtb_T1();   break;
+                        case 3: gen_op_sxth_T1();   break;
+                        case 4: gen_op_uxtb16_T1(); break;
+                        case 6: gen_op_uxtb_T1();   break;
+                        case 7: gen_op_uxth_T1();   break;
+                        default: goto illegal_op;
+                        }
+                        if (rn != 15) {
+                            gen_movl_T2_reg(s, rn);
+                            if ((op1 & 3) == 0) {
+                                gen_op_add16_T1_T2();
+                            } else {
+                                gen_op_addl_T1_T2();
+                            }
+                        }
+                        gen_movl_reg_T1(s, rd);
+                    } else if ((insn & 0x003f0f60) == 0x003f0f20) {
+                        /* rev */
+                        gen_movl_T0_reg(s, rm);
+                        if (insn & (1 << 22)) {
+                            if (insn & (1 << 7)) {
+                                gen_op_revsh_T0();
+                            } else {
+                                ARCH(6T2);
+                                gen_op_rbit_T0();
+                            }
+                        } else {
+                            if (insn & (1 << 7))
+                                gen_op_rev16_T0();
+                            else
+                                gen_op_rev_T0();
+                        }
+                        gen_movl_reg_T0(s, rd);
+                    } else {
+                        goto illegal_op;
+                    }
+                    break;
+                case 2: /* Multiplies (Type 3).  */
+                    gen_movl_T0_reg(s, rm);
+                    gen_movl_T1_reg(s, rs);
+                    if (insn & (1 << 20)) {
+                        /* Signed multiply most significant [accumulate].  */
+                        gen_op_imull_T0_T1();
+                        if (insn & (1 << 5))
+                            gen_op_roundqd_T0_T1();
+                        else
+                            gen_op_movl_T0_T1();
+                        if (rn != 15) {
+                            gen_movl_T1_reg(s, rn);
+                            if (insn & (1 << 6)) {
+                                gen_op_addl_T0_T1();
+                            } else {
+                                gen_op_rsbl_T0_T1();
+                            }
+                        }
+                        gen_movl_reg_T0(s, rd);
+                    } else {
+                        if (insn & (1 << 5))
+                            gen_op_swap_half_T1();
+                        gen_op_mul_dual_T0_T1();
+                        if (insn & (1 << 22)) {
+                            if (insn & (1 << 6)) {
+                                /* smlald */
+                                gen_op_addq_T0_T1_dual(rn, rd);
+                            } else {
+                                /* smlsld */
+                                gen_op_subq_T0_T1_dual(rn, rd);
+                            }
+                        } else {
+                            /* This addition cannot overflow.  */
+                            if (insn & (1 << 6)) {
+                                /* sm[ul]sd */
+                                gen_op_subl_T0_T1();
+                            } else {
+                                /* sm[ul]ad */
+                                gen_op_addl_T0_T1();
+                            }
+                            if (rn != 15)
+                              {
+                                gen_movl_T1_reg(s, rn);
+                                gen_op_addl_T0_T1_setq();
+                              }
+                            gen_movl_reg_T0(s, rd);
+                        }
+                    }
+                    break;
+                case 3:
+                    op1 = ((insn >> 17) & 0x38) | ((insn >> 5) & 7);
+                    switch (op1) {
+                    case 0: /* Unsigned sum of absolute differences.  */
+                            goto illegal_op;
+                        gen_movl_T0_reg(s, rm);
+                        gen_movl_T1_reg(s, rs);
+                        gen_op_usad8_T0_T1();
+                        if (rn != 15) {
+                            gen_movl_T1_reg(s, rn);
+                            gen_op_addl_T0_T1();
+                        }
+                        gen_movl_reg_T0(s, rd);
+                        break;
+                    case 0x20: case 0x24: case 0x28: case 0x2c:
+                        /* Bitfield insert/clear.  */
+                        ARCH(6T2);
+                        shift = (insn >> 7) & 0x1f;
+                        i = (insn >> 16) & 0x1f;
+                        i = i + 1 - shift;
+                        if (rm == 15) {
+                            gen_op_movl_T1_im(0);
+                        } else {
+                            gen_movl_T1_reg(s, rm);
+                        }
+                        if (i != 32) {
+                            gen_movl_T0_reg(s, rd);
+                            gen_op_bfi_T1_T0(shift, ((1u << i) - 1) << shift);
+                        }
+                        gen_movl_reg_T1(s, rd);
+                        break;
+                    case 0x12: case 0x16: case 0x1a: case 0x1e: /* sbfx */
+                    case 0x32: case 0x36: case 0x3a: case 0x3e: /* ubfx */
+                        gen_movl_T1_reg(s, rm);
+                        shift = (insn >> 7) & 0x1f;
+                        i = ((insn >> 16) & 0x1f) + 1;
+                        if (shift + i > 32)
+                            goto illegal_op;
+                        if (i < 32) {
+                            if (op1 & 0x20) {
+                                gen_op_ubfx_T1(shift, (1u << i) - 1);
+                            } else {
+                                gen_op_sbfx_T1(shift, i);
+                            }
+                        }
+                        gen_movl_reg_T1(s, rd);
+                        break;
+                    default:
+                        goto illegal_op;
+                    }
+                    break;
+                }
+                break;
+            }
+        do_ldst:
             /* Check for undefined extension instructions
              * per the ARM Bible IE:
              * xxxx 0111 1111 xxxx  xxxx xxxx 1111 xxxx
@@ -2913,49 +5755,18 @@
         case 0xd:
         case 0xe:
             /* Coprocessor.  */
-            op1 = (insn >> 8) & 0xf;
-            if (arm_feature(env, ARM_FEATURE_XSCALE) &&
-                    ((env->cp15.c15_cpar ^ 0x3fff) & (1 << op1)))
+            if (disas_coproc_insn(env, s, insn))
                 goto illegal_op;
-            switch (op1) {
-            case 0 ... 1:
-                if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-                    if (disas_iwmmxt_insn(env, s, insn))
-                        goto illegal_op;
-                } else if (arm_feature(env, ARM_FEATURE_XSCALE)) {
-                    if (disas_dsp_insn(env, s, insn))
-                        goto illegal_op;
-                } else
-                    goto illegal_op;
-                break;
-            case 2 ... 9:
-            case 12 ... 14:
-                if (disas_cp_insn (env, s, insn))
-                    goto illegal_op;
-                break;
-            case 10:
-            case 11:
-                if (disas_vfp_insn (env, s, insn))
-                    goto illegal_op;
-                break;
-            case 15:
-                if (disas_cp15_insn (env, s, insn))
-                    goto illegal_op;
-                break;
-            default:
-                /* unknown coprocessor.  */
-                goto illegal_op;
-            }
             break;
         case 0xf:
             /* swi */
             gen_op_movl_T0_im((long)s->pc);
             gen_op_movl_reg_TN[0][15]();
-            gen_op_swi();
-            s->is_jmp = DISAS_JUMP;
+            s->is_jmp = DISAS_SWI;
             break;
         default:
         illegal_op:
+            gen_set_condexec(s);
             gen_op_movl_T0_im((long)s->pc - 4);
             gen_op_movl_reg_TN[0][15]();
             gen_op_undef_insn();
@@ -2965,12 +5776,1061 @@
     }
 }
 
-static void disas_thumb_insn(DisasContext *s)
+/* Return true if this is a Thumb-2 logical op.  */
+static int
+thumb2_logic_op(int op)
 {
+    return (op < 8);
+}
+
+/* Generate code for a Thumb-2 data processing operation.  If CONDS is nonzero
+   then set condition code flags based on the result of the operation.
+   If SHIFTER_OUT is nonzero then set the carry flag for logical operations
+   to the high bit of T1.
+   Returns zero if the opcode is valid.  */
+
+static int
+gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out)
+{
+    int logic_cc;
+
+    logic_cc = 0;
+    switch (op) {
+    case 0: /* and */
+        gen_op_andl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 1: /* bic */
+        gen_op_bicl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 2: /* orr */
+        gen_op_orl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 3: /* orn */
+        gen_op_notl_T1();
+        gen_op_orl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 4: /* eor */
+        gen_op_xorl_T0_T1();
+        logic_cc = conds;
+        break;
+    case 8: /* add */
+        if (conds)
+            gen_op_addl_T0_T1_cc();
+        else
+            gen_op_addl_T0_T1();
+        break;
+    case 10: /* adc */
+        if (conds)
+            gen_op_adcl_T0_T1_cc();
+        else
+            gen_op_adcl_T0_T1();
+        break;
+    case 11: /* sbc */
+        if (conds)
+            gen_op_sbcl_T0_T1_cc();
+        else
+            gen_op_sbcl_T0_T1();
+        break;
+    case 13: /* sub */
+        if (conds)
+            gen_op_subl_T0_T1_cc();
+        else
+            gen_op_subl_T0_T1();
+        break;
+    case 14: /* rsb */
+        if (conds)
+            gen_op_rsbl_T0_T1_cc();
+        else
+            gen_op_rsbl_T0_T1();
+        break;
+    default: /* 5, 6, 7, 9, 12, 15. */
+        return 1;
+    }
+    if (logic_cc) {
+        gen_op_logic_T0_cc();
+        if (shifter_out)
+            gen_op_mov_CF_T1();
+    }
+    return 0;
+}
+
+/* Translate a 32-bit thumb instruction.  Returns nonzero if the instruction
+   is not legal.  */
+static int disas_thumb2_insn(CPUState *env, DisasContext *s, uint16_t insn_hw1)
+{
+    uint32_t insn, imm, shift, offset, addr;
+    uint32_t rd, rn, rm, rs;
+    int op;
+    int shiftop;
+    int conds;
+    int logic_cc;
+
+    if (!(arm_feature(env, ARM_FEATURE_THUMB2)
+          || arm_feature (env, ARM_FEATURE_M))) {
+        /* Thumb-1 cores may need to tread bl and blx as a pair of
+           16-bit instructions to get correct prefetch abort behavior.  */
+        insn = insn_hw1;
+        if ((insn & (1 << 12)) == 0) {
+            /* Second half of blx.  */
+            offset = ((insn & 0x7ff) << 1);
+            gen_movl_T0_reg(s, 14);
+            gen_op_movl_T1_im(offset);
+            gen_op_addl_T0_T1();
+            gen_op_movl_T1_im(0xfffffffc);
+            gen_op_andl_T0_T1();
+
+            addr = (uint32_t)s->pc;
+            gen_op_movl_T1_im(addr | 1);
+            gen_movl_reg_T1(s, 14);
+            gen_bx(s);
+            return 0;
+        }
+        if (insn & (1 << 11)) {
+            /* Second half of bl.  */
+            offset = ((insn & 0x7ff) << 1) | 1;
+            gen_movl_T0_reg(s, 14);
+            gen_op_movl_T1_im(offset);
+            gen_op_addl_T0_T1();
+
+            addr = (uint32_t)s->pc;
+            gen_op_movl_T1_im(addr | 1);
+            gen_movl_reg_T1(s, 14);
+            gen_bx(s);
+            return 0;
+        }
+        if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
+            /* Instruction spans a page boundary.  Implement it as two
+               16-bit instructions in case the second half causes an
+               prefetch abort.  */
+            offset = ((int32_t)insn << 21) >> 9;
+            addr = s->pc + 2 + offset;
+            gen_op_movl_T0_im(addr);
+            gen_movl_reg_T0(s, 14);
+            return 0;
+        }
+        /* Fall through to 32-bit decode.  */
+    }
+
+    insn = lduw_code(s->pc);
+    s->pc += 2;
+    insn |= (uint32_t)insn_hw1 << 16;
+
+    if ((insn & 0xf800e800) != 0xf000e800) {
+        ARCH(6T2);
+    }
+
+    rn = (insn >> 16) & 0xf;
+    rs = (insn >> 12) & 0xf;
+    rd = (insn >> 8) & 0xf;
+    rm = insn & 0xf;
+    switch ((insn >> 25) & 0xf) {
+    case 0: case 1: case 2: case 3:
+        /* 16-bit instructions.  Should never happen.  */
+        abort();
+    case 4:
+        if (insn & (1 << 22)) {
+            /* Other load/store, table branch.  */
+            if (insn & 0x01200000) {
+                /* Load/store doubleword.  */
+                if (rn == 15) {
+                    gen_op_movl_T1_im(s->pc & ~3);
+                } else {
+                    gen_movl_T1_reg(s, rn);
+                }
+                offset = (insn & 0xff) * 4;
+                if ((insn & (1 << 23)) == 0)
+                    offset = -offset;
+                if (insn & (1 << 24)) {
+                    gen_op_addl_T1_im(offset);
+                    offset = 0;
+                }
+                if (insn & (1 << 20)) {
+                    /* ldrd */
+                    gen_ldst(ldl, s);
+                    gen_movl_reg_T0(s, rs);
+                    gen_op_addl_T1_im(4);
+                    gen_ldst(ldl, s);
+                    gen_movl_reg_T0(s, rd);
+                } else {
+                    /* strd */
+                    gen_movl_T0_reg(s, rs);
+                    gen_ldst(stl, s);
+                    gen_op_addl_T1_im(4);
+                    gen_movl_T0_reg(s, rd);
+                    gen_ldst(stl, s);
+                }
+                if (insn & (1 << 21)) {
+                    /* Base writeback.  */
+                    if (rn == 15)
+                        goto illegal_op;
+                    gen_op_addl_T1_im(offset - 4);
+                    gen_movl_reg_T1(s, rn);
+                }
+            } else if ((insn & (1 << 23)) == 0) {
+                /* Load/store exclusive word.  */
+                gen_movl_T0_reg(s, rd);
+                gen_movl_T1_reg(s, rn);
+                if (insn & (1 << 20)) {
+                    gen_ldst(ldlex, s);
+                } else {
+                    gen_ldst(stlex, s);
+                }
+                gen_movl_reg_T0(s, rd);
+            } else if ((insn & (1 << 6)) == 0) {
+                /* Table Branch.  */
+                if (rn == 15) {
+                    gen_op_movl_T1_im(s->pc);
+                } else {
+                    gen_movl_T1_reg(s, rn);
+                }
+                gen_movl_T2_reg(s, rm);
+                gen_op_addl_T1_T2();
+                if (insn & (1 << 4)) {
+                    /* tbh */
+                    gen_op_addl_T1_T2();
+                    gen_ldst(lduw, s);
+                } else { /* tbb */
+                    gen_ldst(ldub, s);
+                }
+                gen_op_jmp_T0_im(s->pc);
+                s->is_jmp = DISAS_JUMP;
+            } else {
+                /* Load/store exclusive byte/halfword/doubleword.  */
+                op = (insn >> 4) & 0x3;
+                gen_movl_T1_reg(s, rn);
+                if (insn & (1 << 20)) {
+                    switch (op) {
+                    case 0:
+                        gen_ldst(ldbex, s);
+                        break;
+                    case 1:
+                        gen_ldst(ldwex, s);
+                        break;
+                    case 3:
+                        gen_ldst(ldqex, s);
+                        gen_movl_reg_T1(s, rd);
+                        break;
+                    default:
+                        goto illegal_op;
+                    }
+                    gen_movl_reg_T0(s, rs);
+                } else {
+                    gen_movl_T0_reg(s, rs);
+                    switch (op) {
+                    case 0:
+                        gen_ldst(stbex, s);
+                        break;
+                    case 1:
+                        gen_ldst(stwex, s);
+                        break;
+                    case 3:
+                        gen_movl_T2_reg(s, rd);
+                        gen_ldst(stqex, s);
+                        break;
+                    default:
+                        goto illegal_op;
+                    }
+                    gen_movl_reg_T0(s, rm);
+                }
+            }
+        } else {
+            /* Load/store multiple, RFE, SRS.  */
+            if (((insn >> 23) & 1) == ((insn >> 24) & 1)) {
+                /* Not available in user mode.  */
+                if (!IS_USER(s))
+                    goto illegal_op;
+                if (insn & (1 << 20)) {
+                    /* rfe */
+                    gen_movl_T1_reg(s, rn);
+                    if (insn & (1 << 24)) {
+                        gen_op_addl_T1_im(4);
+                    } else {
+                        gen_op_addl_T1_im(-4);
+                    }
+                    /* Load CPSR into T2 and PC into T0.  */
+                    gen_ldst(ldl, s);
+                    gen_op_movl_T2_T0();
+                    gen_op_addl_T1_im(-4);
+                    gen_ldst(ldl, s);
+                    if (insn & (1 << 21)) {
+                        /* Base writeback.  */
+                        if (insn & (1 << 24))
+                            gen_op_addl_T1_im(8);
+                        gen_movl_reg_T1(s, rn);
+                    }
+                    gen_rfe(s);
+                } else {
+                    /* srs */
+                    op = (insn & 0x1f);
+                    if (op == (env->uncached_cpsr & CPSR_M)) {
+                        gen_movl_T1_reg(s, 13);
+                    } else {
+                        gen_op_movl_T1_r13_banked(op);
+                    }
+                    if ((insn & (1 << 24)) == 0) {
+                        gen_op_addl_T1_im(-8);
+                    }
+                    gen_movl_T0_reg(s, 14);
+                    gen_ldst(stl, s);
+                    gen_op_movl_T0_cpsr();
+                    gen_op_addl_T1_im(4);
+                    gen_ldst(stl, s);
+                    if (insn & (1 << 21)) {
+                        if ((insn & (1 << 24)) == 0) {
+                            gen_op_addl_T1_im(-4);
+                        } else {
+                            gen_op_addl_T1_im(4);
+                        }
+                        if (op == (env->uncached_cpsr & CPSR_M)) {
+                            gen_movl_reg_T1(s, 13);
+                        } else {
+                            gen_op_movl_r13_T1_banked(op);
+                        }
+                    }
+                }
+            } else {
+                int i;
+                /* Load/store multiple.  */
+                gen_movl_T1_reg(s, rn);
+                offset = 0;
+                for (i = 0; i < 16; i++) {
+                    if (insn & (1 << i))
+                        offset += 4;
+                }
+                if (insn & (1 << 24)) {
+                    gen_op_addl_T1_im(-offset);
+                }
+
+                for (i = 0; i < 16; i++) {
+                    if ((insn & (1 << i)) == 0)
+                        continue;
+                    if (insn & (1 << 20)) {
+                        /* Load.  */
+                        gen_ldst(ldl, s);
+                        if (i == 15) {
+                            gen_bx(s);
+                        } else {
+                            gen_movl_reg_T0(s, i);
+                        }
+                    } else {
+                        /* Store.  */
+                        gen_movl_T0_reg(s, i);
+                        gen_ldst(stl, s);
+                    }
+                    gen_op_addl_T1_im(4);
+                }
+                if (insn & (1 << 21)) {
+                    /* Base register writeback.  */
+                    if (insn & (1 << 24)) {
+                        gen_op_addl_T1_im(-offset);
+                    }
+                    /* Fault if writeback register is in register list.  */
+                    if (insn & (1 << rn))
+                        goto illegal_op;
+                    gen_movl_reg_T1(s, rn);
+                }
+            }
+        }
+        break;
+    case 5: /* Data processing register constant shift.  */
+        if (rn == 15)
+            gen_op_movl_T0_im(0);
+        else
+            gen_movl_T0_reg(s, rn);
+        gen_movl_T1_reg(s, rm);
+        op = (insn >> 21) & 0xf;
+        shiftop = (insn >> 4) & 3;
+        shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
+        conds = (insn & (1 << 20)) != 0;
+        logic_cc = (conds && thumb2_logic_op(op));
+        if (shift != 0) {
+            if (logic_cc) {
+                gen_shift_T1_im_cc[shiftop](shift);
+            } else {
+                gen_shift_T1_im[shiftop](shift);
+            }
+        } else if (shiftop != 0) {
+            if (logic_cc) {
+                gen_shift_T1_0_cc[shiftop]();
+            } else {
+                gen_shift_T1_0[shiftop]();
+            }
+        }
+        if (gen_thumb2_data_op(s, op, conds, 0))
+            goto illegal_op;
+        if (rd != 15)
+            gen_movl_reg_T0(s, rd);
+        break;
+    case 13: /* Misc data processing.  */
+        op = ((insn >> 22) & 6) | ((insn >> 7) & 1);
+        if (op < 4 && (insn & 0xf000) != 0xf000)
+            goto illegal_op;
+        switch (op) {
+        case 0: /* Register controlled shift.  */
+            gen_movl_T0_reg(s, rm);
+            gen_movl_T1_reg(s, rn);
+            if ((insn & 0x70) != 0)
+                goto illegal_op;
+            op = (insn >> 21) & 3;
+            if (insn & (1 << 20)) {
+                gen_shift_T1_T0_cc[op]();
+                gen_op_logic_T1_cc();
+            } else {
+                gen_shift_T1_T0[op]();
+            }
+            gen_movl_reg_T1(s, rd);
+            break;
+        case 1: /* Sign/zero extend.  */
+            gen_movl_T1_reg(s, rm);
+            shift = (insn >> 4) & 3;
+            /* ??? In many cases it's not neccessary to do a
+               rotate, a shift is sufficient.  */
+            if (shift != 0)
+                gen_op_rorl_T1_im(shift * 8);
+            op = (insn >> 20) & 7;
+            switch (op) {
+            case 0: gen_op_sxth_T1();   break;
+            case 1: gen_op_uxth_T1();   break;
+            case 2: gen_op_sxtb16_T1(); break;
+            case 3: gen_op_uxtb16_T1(); break;
+            case 4: gen_op_sxtb_T1();   break;
+            case 5: gen_op_uxtb_T1();   break;
+            default: goto illegal_op;
+            }
+            if (rn != 15) {
+                gen_movl_T2_reg(s, rn);
+                if ((op >> 1) == 1) {
+                    gen_op_add16_T1_T2();
+                } else {
+                    gen_op_addl_T1_T2();
+                }
+            }
+            gen_movl_reg_T1(s, rd);
+            break;
+        case 2: /* SIMD add/subtract.  */
+            op = (insn >> 20) & 7;
+            shift = (insn >> 4) & 7;
+            if ((op & 3) == 3 || (shift & 3) == 3)
+                goto illegal_op;
+            gen_movl_T0_reg(s, rn);
+            gen_movl_T1_reg(s, rm);
+            gen_thumb2_parallel_addsub[op][shift]();
+            gen_movl_reg_T0(s, rd);
+            break;
+        case 3: /* Other data processing.  */
+            op = ((insn >> 17) & 0x38) | ((insn >> 4) & 7);
+            if (op < 4) {
+                /* Saturating add/subtract.  */
+                gen_movl_T0_reg(s, rm);
+                gen_movl_T1_reg(s, rn);
+                if (op & 2)
+                    gen_op_double_T1_saturate();
+                if (op & 1)
+                    gen_op_subl_T0_T1_saturate();
+                else
+                    gen_op_addl_T0_T1_saturate();
+            } else {
+                gen_movl_T0_reg(s, rn);
+                switch (op) {
+                case 0x0a: /* rbit */
+                    gen_op_rbit_T0();
+                    break;
+                case 0x08: /* rev */
+                    gen_op_rev_T0();
+                    break;
+                case 0x09: /* rev16 */
+                    gen_op_rev16_T0();
+                    break;
+                case 0x0b: /* revsh */
+                    gen_op_revsh_T0();
+                    break;
+                case 0x10: /* sel */
+                    gen_movl_T1_reg(s, rm);
+                    gen_op_sel_T0_T1();
+                    break;
+                case 0x18: /* clz */
+                    gen_op_clz_T0();
+                    break;
+                default:
+                    goto illegal_op;
+                }
+            }
+            gen_movl_reg_T0(s, rd);
+            break;
+        case 4: case 5: /* 32-bit multiply.  Sum of absolute differences.  */
+            op = (insn >> 4) & 0xf;
+            gen_movl_T0_reg(s, rn);
+            gen_movl_T1_reg(s, rm);
+            switch ((insn >> 20) & 7) {
+            case 0: /* 32 x 32 -> 32 */
+                gen_op_mul_T0_T1();
+                if (rs != 15) {
+                    gen_movl_T1_reg(s, rs);
+                    if (op)
+                        gen_op_rsbl_T0_T1();
+                    else
+                        gen_op_addl_T0_T1();
+                }
+                gen_movl_reg_T0(s, rd);
+                break;
+            case 1: /* 16 x 16 -> 32 */
+                gen_mulxy(op & 2, op & 1);
+                if (rs != 15) {
+                    gen_movl_T1_reg(s, rs);
+                    gen_op_addl_T0_T1_setq();
+                }
+                gen_movl_reg_T0(s, rd);
+                break;
+            case 2: /* Dual multiply add.  */
+            case 4: /* Dual multiply subtract.  */
+                if (op)
+                    gen_op_swap_half_T1();
+                gen_op_mul_dual_T0_T1();
+                /* This addition cannot overflow.  */
+                if (insn & (1 << 22)) {
+                    gen_op_subl_T0_T1();
+                } else {
+                    gen_op_addl_T0_T1();
+                }
+                if (rs != 15)
+                  {
+                    gen_movl_T1_reg(s, rs);
+                    gen_op_addl_T0_T1_setq();
+                  }
+                gen_movl_reg_T0(s, rd);
+                break;
+            case 3: /* 32 * 16 -> 32msb */
+                if (op)
+                    gen_op_sarl_T1_im(16);
+                else
+                    gen_op_sxth_T1();
+                gen_op_imulw_T0_T1();
+                if (rs != 15)
+                  {
+                    gen_movl_T1_reg(s, rs);
+                    gen_op_addl_T0_T1_setq();
+                  }
+                gen_movl_reg_T0(s, rd);
+                break;
+            case 5: case 6: /* 32 * 32 -> 32msb */
+                gen_op_imull_T0_T1();
+                if (insn & (1 << 5))
+                    gen_op_roundqd_T0_T1();
+                else
+                    gen_op_movl_T0_T1();
+                if (rs != 15) {
+                    gen_movl_T1_reg(s, rs);
+                    if (insn & (1 << 21)) {
+                        gen_op_addl_T0_T1();
+                    } else {
+                        gen_op_rsbl_T0_T1();
+                    }
+                }
+                gen_movl_reg_T0(s, rd);
+                break;
+            case 7: /* Unsigned sum of absolute differences.  */
+                gen_op_usad8_T0_T1();
+                if (rs != 15) {
+                    gen_movl_T1_reg(s, rs);
+                    gen_op_addl_T0_T1();
+                }
+                gen_movl_reg_T0(s, rd);
+                break;
+            }
+            break;
+        case 6: case 7: /* 64-bit multiply, Divide.  */
+            op = ((insn >> 4) & 0xf) | ((insn >> 16) & 0x70);
+            gen_movl_T0_reg(s, rn);
+            gen_movl_T1_reg(s, rm);
+            if ((op & 0x50) == 0x10) {
+                /* sdiv, udiv */
+                if (!arm_feature(env, ARM_FEATURE_DIV))
+                    goto illegal_op;
+                if (op & 0x20)
+                    gen_op_udivl_T0_T1();
+                else
+                    gen_op_sdivl_T0_T1();
+                gen_movl_reg_T0(s, rd);
+            } else if ((op & 0xe) == 0xc) {
+                /* Dual multiply accumulate long.  */
+                if (op & 1)
+                    gen_op_swap_half_T1();
+                gen_op_mul_dual_T0_T1();
+                if (op & 0x10) {
+                    gen_op_subl_T0_T1();
+                } else {
+                    gen_op_addl_T0_T1();
+                }
+                gen_op_signbit_T1_T0();
+                gen_op_addq_T0_T1(rs, rd);
+                gen_movl_reg_T0(s, rs);
+                gen_movl_reg_T1(s, rd);
+            } else {
+                if (op & 0x20) {
+                    /* Unsigned 64-bit multiply  */
+                    gen_op_mull_T0_T1();
+                } else {
+                    if (op & 8) {
+                        /* smlalxy */
+                        gen_mulxy(op & 2, op & 1);
+                        gen_op_signbit_T1_T0();
+                    } else {
+                        /* Signed 64-bit multiply  */
+                        gen_op_imull_T0_T1();
+                    }
+                }
+                if (op & 4) {
+                    /* umaal */
+                    gen_op_addq_lo_T0_T1(rs);
+                    gen_op_addq_lo_T0_T1(rd);
+                } else if (op & 0x40) {
+                    /* 64-bit accumulate.  */
+                    gen_op_addq_T0_T1(rs, rd);
+                }
+                gen_movl_reg_T0(s, rs);
+                gen_movl_reg_T1(s, rd);
+            }
+            break;
+        }
+        break;
+    case 6: case 7: case 14: case 15:
+        /* Coprocessor.  */
+        if (((insn >> 24) & 3) == 3) {
+            /* Translate into the equivalent ARM encoding.  */
+            insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4);
+            if (disas_neon_data_insn(env, s, insn))
+                goto illegal_op;
+        } else {
+            if (insn & (1 << 28))
+                goto illegal_op;
+            if (disas_coproc_insn (env, s, insn))
+                goto illegal_op;
+        }
+        break;
+    case 8: case 9: case 10: case 11:
+        if (insn & (1 << 15)) {
+            /* Branches, misc control.  */
+            if (insn & 0x5000) {
+                /* Unconditional branch.  */
+                /* signextend(hw1[10:0]) -> offset[:12].  */
+                offset = ((int32_t)insn << 5) >> 9 & ~(int32_t)0xfff;
+                /* hw1[10:0] -> offset[11:1].  */
+                offset |= (insn & 0x7ff) << 1;
+                /* (~hw2[13, 11] ^ offset[24]) -> offset[23,22]
+                   offset[24:22] already have the same value because of the
+                   sign extension above.  */
+                offset ^= ((~insn) & (1 << 13)) << 10;
+                offset ^= ((~insn) & (1 << 11)) << 11;
+
+                addr = s->pc;
+                if (insn & (1 << 14)) {
+                    /* Branch and link.  */
+                    gen_op_movl_T1_im(addr | 1);
+                    gen_movl_reg_T1(s, 14);
+                }
+
+                addr += offset;
+                if (insn & (1 << 12)) {
+                    /* b/bl */
+                    gen_jmp(s, addr);
+                } else {
+                    /* blx */
+                    addr &= ~(uint32_t)2;
+                    gen_op_movl_T0_im(addr);
+                    gen_bx(s);
+                }
+            } else if (((insn >> 23) & 7) == 7) {
+                /* Misc control */
+                if (insn & (1 << 13))
+                    goto illegal_op;
+
+                if (insn & (1 << 26)) {
+                    /* Secure monitor call (v6Z) */
+                    goto illegal_op; /* not implemented.  */
+                } else {
+                    op = (insn >> 20) & 7;
+                    switch (op) {
+                    case 0: /* msr cpsr.  */
+                        if (IS_M(env)) {
+                            gen_op_v7m_msr_T0(insn & 0xff);
+                            gen_movl_reg_T0(s, rn);
+                            gen_lookup_tb(s);
+                            break;
+                        }
+                        /* fall through */
+                    case 1: /* msr spsr.  */
+                        if (IS_M(env))
+                            goto illegal_op;
+                        gen_movl_T0_reg(s, rn);
+                        if (gen_set_psr_T0(s,
+                              msr_mask(env, s, (insn >> 8) & 0xf, op == 1),
+                              op == 1))
+                            goto illegal_op;
+                        break;
+                    case 2: /* cps, nop-hint.  */
+                        if (((insn >> 8) & 7) == 0) {
+                            gen_nop_hint(s, insn & 0xff);
+                        }
+                        /* Implemented as NOP in user mode.  */
+                        if (IS_USER(s))
+                            break;
+                        offset = 0;
+                        imm = 0;
+                        if (insn & (1 << 10)) {
+                            if (insn & (1 << 7))
+                                offset |= CPSR_A;
+                            if (insn & (1 << 6))
+                                offset |= CPSR_I;
+                            if (insn & (1 << 5))
+                                offset |= CPSR_F;
+                            if (insn & (1 << 9))
+                                imm = CPSR_A | CPSR_I | CPSR_F;
+                        }
+                        if (insn & (1 << 8)) {
+                            offset |= 0x1f;
+                            imm |= (insn & 0x1f);
+                        }
+                        if (offset) {
+                            gen_op_movl_T0_im(imm);
+                            gen_set_psr_T0(s, offset, 0);
+                        }
+                        break;
+                    case 3: /* Special control operations.  */
+                        op = (insn >> 4) & 0xf;
+                        switch (op) {
+                        case 2: /* clrex */
+                            gen_op_clrex();
+                            break;
+                        case 4: /* dsb */
+                        case 5: /* dmb */
+                        case 6: /* isb */
+                            /* These execute as NOPs.  */
+                            ARCH(7);
+                            break;
+                        default:
+                            goto illegal_op;
+                        }
+                        break;
+                    case 4: /* bxj */
+                        /* Trivial implementation equivalent to bx.  */
+                        gen_movl_T0_reg(s, rn);
+                        gen_bx(s);
+                        break;
+                    case 5: /* Exception return.  */
+                        /* Unpredictable in user mode.  */
+                        goto illegal_op;
+                    case 6: /* mrs cpsr.  */
+                        if (IS_M(env)) {
+                            gen_op_v7m_mrs_T0(insn & 0xff);
+                        } else {
+                            gen_op_movl_T0_cpsr();
+                        }
+                        gen_movl_reg_T0(s, rd);
+                        break;
+                    case 7: /* mrs spsr.  */
+                        /* Not accessible in user mode.  */
+                        if (IS_USER(s) || IS_M(env))
+                            goto illegal_op;
+                        gen_op_movl_T0_spsr();
+                        gen_movl_reg_T0(s, rd);
+                        break;
+                    }
+                }
+            } else {
+                /* Conditional branch.  */
+                op = (insn >> 22) & 0xf;
+                /* Generate a conditional jump to next instruction.  */
+                s->condlabel = gen_new_label();
+                gen_test_cc[op ^ 1](s->condlabel);
+                s->condjmp = 1;
+
+                /* offset[11:1] = insn[10:0] */
+                offset = (insn & 0x7ff) << 1;
+                /* offset[17:12] = insn[21:16].  */
+                offset |= (insn & 0x003f0000) >> 4;
+                /* offset[31:20] = insn[26].  */
+                offset |= ((int32_t)((insn << 5) & 0x80000000)) >> 11;
+                /* offset[18] = insn[13].  */
+                offset |= (insn & (1 << 13)) << 5;
+                /* offset[19] = insn[11].  */
+                offset |= (insn & (1 << 11)) << 8;
+
+                /* jump to the offset */
+                addr = s->pc + offset;
+                gen_jmp(s, addr);
+            }
+        } else {
+            /* Data processing immediate.  */
+            if (insn & (1 << 25)) {
+                if (insn & (1 << 24)) {
+                    if (insn & (1 << 20))
+                        goto illegal_op;
+                    /* Bitfield/Saturate.  */
+                    op = (insn >> 21) & 7;
+                    imm = insn & 0x1f;
+                    shift = ((insn >> 6) & 3) | ((insn >> 10) & 0x1c);
+                    if (rn == 15)
+                        gen_op_movl_T1_im(0);
+                    else
+                        gen_movl_T1_reg(s, rn);
+                    switch (op) {
+                    case 2: /* Signed bitfield extract.  */
+                        imm++;
+                        if (shift + imm > 32)
+                            goto illegal_op;
+                        if (imm < 32)
+                            gen_op_sbfx_T1(shift, imm);
+                        break;
+                    case 6: /* Unsigned bitfield extract.  */
+                        imm++;
+                        if (shift + imm > 32)
+                            goto illegal_op;
+                        if (imm < 32)
+                            gen_op_ubfx_T1(shift, (1u << imm) - 1);
+                        break;
+                    case 3: /* Bitfield insert/clear.  */
+                        if (imm < shift)
+                            goto illegal_op;
+                        imm = imm + 1 - shift;
+                        if (imm != 32) {
+                            gen_movl_T0_reg(s, rd);
+                            gen_op_bfi_T1_T0(shift, ((1u << imm) - 1) << shift);
+                        }
+                        break;
+                    case 7:
+                        goto illegal_op;
+                    default: /* Saturate.  */
+                        gen_movl_T1_reg(s, rn);
+                        if (shift) {
+                            if (op & 1)
+                                gen_op_sarl_T1_im(shift);
+                            else
+                                gen_op_shll_T1_im(shift);
+                        }
+                        if (op & 4) {
+                            /* Unsigned.  */
+                            gen_op_ssat_T1(imm);
+                            if ((op & 1) && shift == 0)
+                                gen_op_usat16_T1(imm);
+                            else
+                                gen_op_usat_T1(imm);
+                        } else {
+                            /* Signed.  */
+                            gen_op_ssat_T1(imm);
+                            if ((op & 1) && shift == 0)
+                                gen_op_ssat16_T1(imm);
+                            else
+                                gen_op_ssat_T1(imm);
+                        }
+                        break;
+                    }
+                    gen_movl_reg_T1(s, rd);
+                } else {
+                    imm = ((insn & 0x04000000) >> 15)
+                          | ((insn & 0x7000) >> 4) | (insn & 0xff);
+                    if (insn & (1 << 22)) {
+                        /* 16-bit immediate.  */
+                        imm |= (insn >> 4) & 0xf000;
+                        if (insn & (1 << 23)) {
+                            /* movt */
+                            gen_movl_T0_reg(s, rd);
+                            gen_op_movtop_T0_im(imm << 16);
+                        } else {
+                            /* movw */
+                            gen_op_movl_T0_im(imm);
+                        }
+                    } else {
+                        /* Add/sub 12-bit immediate.  */
+                        if (rn == 15) {
+                            addr = s->pc & ~(uint32_t)3;
+                            if (insn & (1 << 23))
+                                addr -= imm;
+                            else
+                                addr += imm;
+                            gen_op_movl_T0_im(addr);
+                        } else {
+                            gen_movl_T0_reg(s, rn);
+                            gen_op_movl_T1_im(imm);
+                            if (insn & (1 << 23))
+                                gen_op_subl_T0_T1();
+                            else
+                                gen_op_addl_T0_T1();
+                        }
+                    }
+                    gen_movl_reg_T0(s, rd);
+                }
+            } else {
+                int shifter_out = 0;
+                /* modified 12-bit immediate.  */
+                shift = ((insn & 0x04000000) >> 23) | ((insn & 0x7000) >> 12);
+                imm = (insn & 0xff);
+                switch (shift) {
+                case 0: /* XY */
+                    /* Nothing to do.  */
+                    break;
+                case 1: /* 00XY00XY */
+                    imm |= imm << 16;
+                    break;
+                case 2: /* XY00XY00 */
+                    imm |= imm << 16;
+                    imm <<= 8;
+                    break;
+                case 3: /* XYXYXYXY */
+                    imm |= imm << 16;
+                    imm |= imm << 8;
+                    break;
+                default: /* Rotated constant.  */
+                    shift = (shift << 1) | (imm >> 7);
+                    imm |= 0x80;
+                    imm = imm << (32 - shift);
+                    shifter_out = 1;
+                    break;
+                }
+                gen_op_movl_T1_im(imm);
+                rn = (insn >> 16) & 0xf;
+                if (rn == 15)
+                    gen_op_movl_T0_im(0);
+                else
+                    gen_movl_T0_reg(s, rn);
+                op = (insn >> 21) & 0xf;
+                if (gen_thumb2_data_op(s, op, (insn & (1 << 20)) != 0,
+                                       shifter_out))
+                    goto illegal_op;
+                rd = (insn >> 8) & 0xf;
+                if (rd != 15) {
+                    gen_movl_reg_T0(s, rd);
+                }
+            }
+        }
+        break;
+    case 12: /* Load/store single data item.  */
+        {
+        int postinc = 0;
+        int writeback = 0;
+        if ((insn & 0x01100000) == 0x01000000) {
+            if (disas_neon_ls_insn(env, s, insn))
+                goto illegal_op;
+            break;
+        }
+        if (rn == 15) {
+            /* PC relative.  */
+            /* s->pc has already been incremented by 4.  */
+            imm = s->pc & 0xfffffffc;
+            if (insn & (1 << 23))
+                imm += insn & 0xfff;
+            else
+                imm -= insn & 0xfff;
+            gen_op_movl_T1_im(imm);
+        } else {
+            gen_movl_T1_reg(s, rn);
+            if (insn & (1 << 23)) {
+                /* Positive offset.  */
+                imm = insn & 0xfff;
+                gen_op_addl_T1_im(imm);
+            } else {
+                op = (insn >> 8) & 7;
+                imm = insn & 0xff;
+                switch (op) {
+                case 0: case 8: /* Shifted Register.  */
+                    shift = (insn >> 4) & 0xf;
+                    if (shift > 3)
+                        goto illegal_op;
+                    gen_movl_T2_reg(s, rm);
+                    if (shift)
+                        gen_op_shll_T2_im(shift);
+                    gen_op_addl_T1_T2();
+                    break;
+                case 4: /* Negative offset.  */
+                    gen_op_addl_T1_im(-imm);
+                    break;
+                case 6: /* User privilege.  */
+                    gen_op_addl_T1_im(imm);
+                    break;
+                case 1: /* Post-decrement.  */
+                    imm = -imm;
+                    /* Fall through.  */
+                case 3: /* Post-increment.  */
+                    gen_op_movl_T2_im(imm);
+                    postinc = 1;
+                    writeback = 1;
+                    break;
+                case 5: /* Pre-decrement.  */
+                    imm = -imm;
+                    /* Fall through.  */
+                case 7: /* Pre-increment.  */
+                    gen_op_addl_T1_im(imm);
+                    writeback = 1;
+                    break;
+                default:
+                    goto illegal_op;
+                }
+            }
+        }
+        op = ((insn >> 21) & 3) | ((insn >> 22) & 4);
+        if (insn & (1 << 20)) {
+            /* Load.  */
+            if (rs == 15 && op != 2) {
+                if (op & 2)
+                    goto illegal_op;
+                /* Memory hint.  Implemented as NOP.  */
+            } else {
+                switch (op) {
+                case 0: gen_ldst(ldub, s); break;
+                case 4: gen_ldst(ldsb, s); break;
+                case 1: gen_ldst(lduw, s); break;
+                case 5: gen_ldst(ldsw, s); break;
+                case 2: gen_ldst(ldl, s); break;
+                default: goto illegal_op;
+                }
+                if (rs == 15) {
+                    gen_bx(s);
+                } else {
+                    gen_movl_reg_T0(s, rs);
+                }
+            }
+        } else {
+            /* Store.  */
+            if (rs == 15)
+                goto illegal_op;
+            gen_movl_T0_reg(s, rs);
+            switch (op) {
+            case 0: gen_ldst(stb, s); break;
+            case 1: gen_ldst(stw, s); break;
+            case 2: gen_ldst(stl, s); break;
+            default: goto illegal_op;
+            }
+        }
+        if (postinc)
+            gen_op_addl_T1_im(imm);
+        if (writeback)
+            gen_movl_reg_T1(s, rn);
+        }
+        break;
+    default:
+        goto illegal_op;
+    }
+    return 0;
+illegal_op:
+    return 1;
+}
+
+static void disas_thumb_insn(CPUState *env, DisasContext *s)
+{
     uint32_t val, insn, op, rm, rn, rd, shift, cond;
     int32_t offset;
     int i;
 
+    if (s->condexec_mask) {
+        cond = s->condexec_cond;
+        s->condlabel = gen_new_label();
+        gen_test_cc[cond ^ 1](s->condlabel);
+        s->condjmp = 1;
+    }
+
     insn = lduw_code(s->pc);
     s->pc += 2;
 
@@ -2990,17 +6850,27 @@
                 rm = (insn >> 6) & 7;
                 gen_movl_T1_reg(s, rm);
             }
-            if (insn & (1 << 9))
-                gen_op_subl_T0_T1_cc();
-            else
-                gen_op_addl_T0_T1_cc();
+            if (insn & (1 << 9)) {
+                if (s->condexec_mask)
+                    gen_op_subl_T0_T1();
+                else
+                    gen_op_subl_T0_T1_cc();
+            } else {
+                if (s->condexec_mask)
+                    gen_op_addl_T0_T1();
+                else
+                    gen_op_addl_T0_T1_cc();
+            }
             gen_movl_reg_T0(s, rd);
         } else {
             /* shift immediate */
             rm = (insn >> 3) & 7;
             shift = (insn >> 6) & 0x1f;
             gen_movl_T0_reg(s, rm);
-            gen_shift_T0_im_thumb[op](shift);
+            if (s->condexec_mask)
+                gen_shift_T0_im_thumb[op](shift);
+            else
+                gen_shift_T0_im_thumb_cc[op](shift);
             gen_movl_reg_T0(s, rd);
         }
         break;
@@ -3016,16 +6886,23 @@
         }
         switch (op) {
         case 0: /* mov */
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 1: /* cmp */
             gen_op_subl_T0_T1_cc();
             break;
         case 2: /* add */
-            gen_op_addl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_addl_T0_T1();
+            else
+                gen_op_addl_T0_T1_cc();
             break;
         case 3: /* sub */
-            gen_op_subl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_subl_T0_T1();
+            else
+                gen_op_subl_T0_T1_cc();
             break;
         }
         if (op != 1)
@@ -3099,33 +6976,57 @@
         switch (op) {
         case 0x0: /* and */
             gen_op_andl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0x1: /* eor */
             gen_op_xorl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0x2: /* lsl */
-            gen_op_shll_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_op_shll_T1_T0();
+            } else {
+                gen_op_shll_T1_T0_cc();
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x3: /* lsr */
-            gen_op_shrl_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_op_shrl_T1_T0();
+            } else {
+                gen_op_shrl_T1_T0_cc();
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x4: /* asr */
-            gen_op_sarl_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_op_sarl_T1_T0();
+            } else {
+                gen_op_sarl_T1_T0_cc();
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x5: /* adc */
-            gen_op_adcl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_adcl_T0_T1();
+            else
+                gen_op_adcl_T0_T1_cc();
             break;
         case 0x6: /* sbc */
-            gen_op_sbcl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_sbcl_T0_T1();
+            else
+                gen_op_sbcl_T0_T1_cc();
             break;
         case 0x7: /* ror */
-            gen_op_rorl_T1_T0_cc();
-            gen_op_logic_T1_cc();
+            if (s->condexec_mask) {
+                gen_op_rorl_T1_T0();
+            } else {
+                gen_op_rorl_T1_T0_cc();
+                gen_op_logic_T1_cc();
+            }
             break;
         case 0x8: /* tst */
             gen_op_andl_T0_T1();
@@ -3133,7 +7034,10 @@
             rd = 16;
             break;
         case 0x9: /* neg */
-            gen_op_subl_T0_T1_cc();
+            if (s->condexec_mask)
+                gen_op_subl_T0_T1();
+            else
+                gen_op_subl_T0_T1_cc();
             break;
         case 0xa: /* cmp */
             gen_op_subl_T0_T1_cc();
@@ -3145,19 +7049,23 @@
             break;
         case 0xc: /* orr */
             gen_op_orl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0xd: /* mul */
             gen_op_mull_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0xe: /* bic */
             gen_op_bicl_T0_T1();
-            gen_op_logic_T0_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T0_cc();
             break;
         case 0xf: /* mvn */
             gen_op_notl_T1();
-            gen_op_logic_T1_cc();
+            if (!s->condexec_mask)
+                gen_op_logic_T1_cc();
             val = 1;
             rm = rd;
             break;
@@ -3323,6 +7231,19 @@
             gen_movl_reg_T1(s, 13);
             break;
 
+        case 2: /* sign/zero extend.  */
+            ARCH(6);
+            rd = insn & 7;
+            rm = (insn >> 3) & 7;
+            gen_movl_T1_reg(s, rm);
+            switch ((insn >> 6) & 3) {
+            case 0: gen_op_sxth_T1(); break;
+            case 1: gen_op_sxtb_T1(); break;
+            case 2: gen_op_uxth_T1(); break;
+            case 3: gen_op_uxtb_T1(); break;
+            }
+            gen_movl_reg_T1(s, rd);
+            break;
         case 4: case 5: case 0xc: case 0xd:
             /* push/pop */
             gen_movl_T1_reg(s, 13);
@@ -3378,13 +7299,82 @@
                 gen_bx(s);
             break;
 
+        case 1: case 3: case 9: case 11: /* czb */
+            rm = insn & 7;
+            gen_movl_T0_reg(s, rm);
+            s->condlabel = gen_new_label();
+            s->condjmp = 1;
+            if (insn & (1 << 11))
+                gen_op_testn_T0(s->condlabel);
+            else
+                gen_op_test_T0(s->condlabel);
+
+            offset = ((insn & 0xf8) >> 2) | (insn & 0x200) >> 3;
+            val = (uint32_t)s->pc + 2;
+            val += offset;
+            gen_jmp(s, val);
+            break;
+
+        case 15: /* IT, nop-hint.  */
+            if ((insn & 0xf) == 0) {
+                gen_nop_hint(s, (insn >> 4) & 0xf);
+                break;
+            }
+            /* If Then.  */
+            s->condexec_cond = (insn >> 4) & 0xe;
+            s->condexec_mask = insn & 0x1f;
+            /* No actual code generated for this insn, just setup state.  */
+            break;
+
         case 0xe: /* bkpt */
+            gen_set_condexec(s);
             gen_op_movl_T0_im((long)s->pc - 2);
             gen_op_movl_reg_TN[0][15]();
             gen_op_bkpt();
             s->is_jmp = DISAS_JUMP;
             break;
 
+        case 0xa: /* rev */
+            ARCH(6);
+            rn = (insn >> 3) & 0x7;
+            rd = insn & 0x7;
+            gen_movl_T0_reg(s, rn);
+            switch ((insn >> 6) & 3) {
+            case 0: gen_op_rev_T0(); break;
+            case 1: gen_op_rev16_T0(); break;
+            case 3: gen_op_revsh_T0(); break;
+            default: goto illegal_op;
+            }
+            gen_movl_reg_T0(s, rd);
+            break;
+
+        case 6: /* cps */
+            ARCH(6);
+            if (IS_USER(s))
+                break;
+            if (IS_M(env)) {
+                val = (insn & (1 << 4)) != 0;
+                gen_op_movl_T0_im(val);
+                /* PRIMASK */
+                if (insn & 1)
+                    gen_op_v7m_msr_T0(16);
+                /* FAULTMASK */
+                if (insn & 2)
+                    gen_op_v7m_msr_T0(17);
+
+                gen_lookup_tb(s);
+            } else {
+                if (insn & (1 << 4))
+                    shift = CPSR_A | CPSR_I | CPSR_F;
+                else
+                    shift = 0;
+
+                val = ((insn & 7) << 6) & shift;
+                gen_op_movl_T0_im(val);
+                gen_set_psr_T0(s, shift, 0);
+            }
+            break;
+
         default:
             goto undef;
         }
@@ -3423,19 +7413,17 @@
 
         if (cond == 0xf) {
             /* swi */
+            gen_set_condexec(s);
             gen_op_movl_T0_im((long)s->pc | 1);
             /* Don't set r15.  */
             gen_op_movl_reg_TN[0][15]();
-            gen_op_swi();
-            s->is_jmp = DISAS_JUMP;
+            s->is_jmp = DISAS_SWI;
             break;
         }
         /* generate a conditional jump to next instruction */
         s->condlabel = gen_new_label();
         gen_test_cc[cond ^ 1](s->condlabel);
         s->condjmp = 1;
-        //gen_test_cc[cond ^ 1]((long)s->tb, (long)s->pc);
-        //s->is_jmp = DISAS_JUMP_NEXT;
         gen_movl_T1_reg(s, 15);
 
         /* jump to the offset */
@@ -3446,22 +7434,12 @@
         break;
 
     case 14:
-        /* unconditional branch */
         if (insn & (1 << 11)) {
-            /* Second half of blx.  */
-            offset = ((insn & 0x7ff) << 1);
-            gen_movl_T0_reg(s, 14);
-            gen_op_movl_T1_im(offset);
-            gen_op_addl_T0_T1();
-            gen_op_movl_T1_im(0xfffffffc);
-            gen_op_andl_T0_T1();
-
-            val = (uint32_t)s->pc;
-            gen_op_movl_T1_im(val | 1);
-            gen_movl_reg_T1(s, 14);
-            gen_bx(s);
+            if (disas_thumb2_insn(env, s, insn))
+              goto undef32;
             break;
         }
+        /* unconditional branch */
         val = (uint32_t)s->pc;
         offset = ((int32_t)insn << 21) >> 21;
         val += (offset << 1) + 2;
@@ -3469,51 +7447,21 @@
         break;
 
     case 15:
-        /* branch and link [and switch to arm] */
-        if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
-            /* Instruction spans a page boundary.  Implement it as two
-               16-bit instructions in case the second half causes an
-               prefetch abort.  */
-            offset = ((int32_t)insn << 21) >> 9;
-            val = s->pc + 2 + offset;
-            gen_op_movl_T0_im(val);
-            gen_movl_reg_T0(s, 14);
-            break;
-        }
-        if (insn & (1 << 11)) {
-            /* Second half of bl.  */
-            offset = ((insn & 0x7ff) << 1) | 1;
-            gen_movl_T0_reg(s, 14);
-            gen_op_movl_T1_im(offset);
-            gen_op_addl_T0_T1();
-
-            val = (uint32_t)s->pc;
-            gen_op_movl_T1_im(val | 1);
-            gen_movl_reg_T1(s, 14);
-            gen_bx(s);
-            break;
-        }
-        offset = ((int32_t)insn << 21) >> 10;
-        insn = lduw_code(s->pc);
-        offset |= insn & 0x7ff;
-
-        val = (uint32_t)s->pc + 2;
-        gen_op_movl_T1_im(val | 1);
-        gen_movl_reg_T1(s, 14);
-
-        val += offset << 1;
-        if (insn & (1 << 12)) {
-            /* bl */
-            gen_jmp(s, val);
-        } else {
-            /* blx */
-            val &= ~(uint32_t)2;
-            gen_op_movl_T0_im(val);
-            gen_bx(s);
-        }
+        if (disas_thumb2_insn(env, s, insn))
+          goto undef32;
+        break;
     }
     return;
+undef32:
+    gen_set_condexec(s);
+    gen_op_movl_T0_im((long)s->pc - 4);
+    gen_op_movl_reg_TN[0][15]();
+    gen_op_undef_insn();
+    s->is_jmp = DISAS_JUMP;
+    return;
+illegal_op:
 undef:
+    gen_set_condexec(s);
     gen_op_movl_T0_im((long)s->pc - 2);
     gen_op_movl_reg_TN[0][15]();
     gen_op_undef_insn();
@@ -3547,21 +7495,44 @@
     dc->singlestep_enabled = env->singlestep_enabled;
     dc->condjmp = 0;
     dc->thumb = env->thumb;
+    dc->condexec_mask = (env->condexec_bits & 0xf) << 1;
+    dc->condexec_cond = env->condexec_bits >> 4;
     dc->is_mem = 0;
 #if !defined(CONFIG_USER_ONLY)
-    dc->user = (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_USR;
+    if (IS_M(env)) {
+        dc->user = ((env->v7m.exception == 0) && (env->v7m.control & 1));
+    } else {
+        dc->user = (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_USR;
+    }
 #endif
     next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
     nb_gen_labels = 0;
     lj = -1;
+    /* Reset the conditional execution bits immediately. This avoids
+       complications trying to do it at the end of the block.  */
+    if (env->condexec_bits)
+      gen_op_set_condexec(0);
     do {
+#ifndef CONFIG_USER_ONLY
+        if (dc->pc >= 0xfffffff0 && IS_M(env)) {
+            /* We always get here via a jump, so know we are not in a
+               conditional execution block.  */
+            gen_op_exception_exit();
+        }
+#endif
+
         if (env->nb_breakpoints > 0) {
             for(j = 0; j < env->nb_breakpoints; j++) {
                 if (env->breakpoints[j] == dc->pc) {
+                    gen_set_condexec(dc);
                     gen_op_movl_T0_im((long)dc->pc);
                     gen_op_movl_reg_TN[0][15]();
                     gen_op_debug();
                     dc->is_jmp = DISAS_JUMP;
+                    /* Advance PC so that clearing the breakpoint will
+                       invalidate this TB.  */
+                    dc->pc += 2;
+                    goto done_generating;
                     break;
                 }
             }
@@ -3577,10 +7548,19 @@
             gen_opc_instr_start[lj] = 1;
         }
 
-        if (env->thumb)
-          disas_thumb_insn(dc);
-        else
-          disas_arm_insn(env, dc);
+        if (env->thumb) {
+            disas_thumb_insn(env, dc);
+            if (dc->condexec_mask) {
+                dc->condexec_cond = (dc->condexec_cond & 0xe)
+                                   | ((dc->condexec_mask >> 4) & 1);
+                dc->condexec_mask = (dc->condexec_mask << 1) & 0x1f;
+                if (dc->condexec_mask == 0) {
+                    dc->condexec_cond = 0;
+                }
+            }
+        } else {
+            disas_arm_insn(env, dc);
+        }
 
         if (dc->condjmp && !dc->is_jmp) {
             gen_set_label(dc->condlabel);
@@ -3599,13 +7579,19 @@
     } while (!dc->is_jmp && gen_opc_ptr < gen_opc_end &&
              !env->singlestep_enabled &&
              dc->pc < next_page_start);
+
     /* At this stage dc->condjmp will only be set when the skipped
-     * instruction was a conditional branch, and the PC has already been
-     * written.  */
+       instruction was a conditional branch or trap, and the PC has
+       already been written.  */
     if (__builtin_expect(env->singlestep_enabled, 0)) {
         /* Make sure the pc is updated, and raise a debug exception.  */
         if (dc->condjmp) {
-            gen_op_debug();
+            gen_set_condexec(dc);
+            if (dc->is_jmp == DISAS_SWI) {
+                gen_op_swi();
+            } else {
+                gen_op_debug();
+            }
             gen_set_label(dc->condlabel);
         }
         if (dc->condjmp || !dc->is_jmp) {
@@ -3613,8 +7599,24 @@
             gen_op_movl_reg_TN[0][15]();
             dc->condjmp = 0;
         }
-        gen_op_debug();
+        gen_set_condexec(dc);
+        if (dc->is_jmp == DISAS_SWI && !dc->condjmp) {
+            gen_op_swi();
+        } else {
+            /* FIXME: Single stepping a WFI insn will not halt
+               the CPU.  */
+            gen_op_debug();
+        }
     } else {
+        /* While branches must always occur at the end of an IT block,
+           there are a few other things that can cause us to terminate
+           the TB in the middel of an IT block:
+            - Exception generating instructions (bkpt, swi, undefined).
+            - Page boundaries.
+            - Hardware watchpoints.
+           Hardware breakpoints have already been handled and skip this code.
+         */
+        gen_set_condexec(dc);
         switch(dc->is_jmp) {
         case DISAS_NEXT:
             gen_goto_tb(dc, 1, dc->pc);
@@ -3629,13 +7631,21 @@
         case DISAS_TB_JUMP:
             /* nothing more to generate */
             break;
+        case DISAS_WFI:
+            gen_op_wfi();
+            break;
+        case DISAS_SWI:
+            gen_op_swi();
+            break;
         }
         if (dc->condjmp) {
             gen_set_label(dc->condlabel);
+            gen_set_condexec(dc);
             gen_goto_tb(dc, 1, dc->pc);
             dc->condjmp = 0;
         }
     }
+done_generating:
     *gen_opc_ptr = INDEX_op_end;
 
 #ifdef DEBUG_DISAS
@@ -3676,6 +7686,7 @@
   "usr", "fiq", "irq", "svc", "???", "???", "???", "abt",
   "???", "???", "???", "und", "???", "???", "???", "sys"
 };
+
 void cpu_dump_state(CPUState *env, FILE *f,
                     int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
                     int flags)

Modified: trunk/src/host/qemu-neo1973/target-cris/cpu.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-cris/cpu.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-cris/cpu.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -147,7 +147,7 @@
 	CPU_COMMON
 } CPUCRISState;
 
-CPUCRISState *cpu_cris_init(void);
+CPUCRISState *cpu_cris_init(const char *cpu_model);
 int cpu_cris_exec(CPUCRISState *s);
 void cpu_cris_close(CPUCRISState *s);
 void do_interrupt(CPUCRISState *env);
@@ -201,10 +201,6 @@
 #define CRIS_SSP    0
 #define CRIS_USP    1
 
-typedef struct cris_def_t cris_def_t;
-
-int cpu_cris_set_model(CPUCRISState *env, const char * name);
-
 void cris_set_irq_level(CPUCRISState *env, int level, uint8_t vector);
 void cris_set_macsr(CPUCRISState *env, uint32_t val);
 void cris_switch_sp(CPUCRISState *env);

Modified: trunk/src/host/qemu-neo1973/target-cris/op_helper.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-cris/op_helper.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-cris/op_helper.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -49,7 +49,7 @@
 {
     TranslationBlock *tb;
     CPUState *saved_env;
-    target_phys_addr_t pc;
+    unsigned long pc;
     int ret;
 
     /* XXX: hack to restore env in all cases, even if not called from
@@ -60,7 +60,7 @@
     if (__builtin_expect(ret, 0)) {
         if (retaddr) {
             /* now we have a real cpu fault */
-            pc = (target_phys_addr_t)retaddr;
+            pc = (unsigned long)retaddr;
             tb = tb_find_pc(pc);
             if (tb) {
                 /* the PC is inside the translated code. It means that we have

Modified: trunk/src/host/qemu-neo1973/target-cris/translate.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-cris/translate.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-cris/translate.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -2488,7 +2488,7 @@
 
 }
 
-CPUCRISState *cpu_cris_init (void)
+CPUCRISState *cpu_cris_init (const char *cpu_model)
 {
 	CPUCRISState *env;
 

Modified: trunk/src/host/qemu-neo1973/target-i386/cpu.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-i386/cpu.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-i386/cpu.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -585,10 +585,9 @@
     struct APICState *apic_state;
 } CPUX86State;
 
-CPUX86State *cpu_x86_init(void);
+CPUX86State *cpu_x86_init(const char *cpu_model);
 int cpu_x86_exec(CPUX86State *s);
 void cpu_x86_close(CPUX86State *s);
-int x86_find_cpu_by_name (const unsigned char *name);
 void x86_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt,
                                                  ...));
 int cpu_get_pic_interrupt(CPUX86State *s);
@@ -671,8 +670,8 @@
 /* the following helpers are only usable in user mode simulation as
    they can trigger unexpected exceptions */
 void cpu_x86_load_seg(CPUX86State *s, int seg_reg, int selector);
-void cpu_x86_fsave(CPUX86State *s, uint8_t *ptr, int data32);
-void cpu_x86_frstor(CPUX86State *s, uint8_t *ptr, int data32);
+void cpu_x86_fsave(CPUX86State *s, target_ulong ptr, int data32);
+void cpu_x86_frstor(CPUX86State *s, target_ulong ptr, int data32);
 
 /* you can call this signal handler from your SIGBUS and SIGSEGV
    signal handlers to inform the virtual CPU of exceptions. non zero

Modified: trunk/src/host/qemu-neo1973/target-i386/exec.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-i386/exec.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-i386/exec.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -419,12 +419,12 @@
 
 static inline CPU86_LDouble helper_fldt(target_ulong ptr)
 {
-    return *(CPU86_LDouble *)ptr;
+    return *(CPU86_LDouble *)(unsigned long)ptr;
 }
 
 static inline void helper_fstt(CPU86_LDouble f, target_ulong ptr)
 {
-    *(CPU86_LDouble *)ptr = f;
+    *(CPU86_LDouble *)(unsigned long)ptr = f;
 }
 
 #else

Modified: trunk/src/host/qemu-neo1973/target-i386/helper2.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-i386/helper2.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-i386/helper2.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -31,9 +31,7 @@
 
 //#define DEBUG_MMU
 
-static struct x86_def_t *x86_cpu_def;
-typedef struct x86_def_t x86_def_t;
-static int cpu_x86_register (CPUX86State *env, const x86_def_t *def);
+static int cpu_x86_register (CPUX86State *env, const char *cpu_model);
 
 static void add_flagname_to_bitmaps(char *flagname, uint32_t *features, 
                                     uint32_t *ext_features, 
@@ -92,7 +90,7 @@
     fprintf(stderr, "CPU feature %s not found\n", flagname);
 }
 
-CPUX86State *cpu_x86_init(void)
+CPUX86State *cpu_x86_init(const char *cpu_model)
 {
     CPUX86State *env;
     static int inited;
@@ -107,7 +105,10 @@
         inited = 1;
         optimize_flags_init();
     }
-    cpu_x86_register(env, x86_cpu_def);
+    if (cpu_x86_register(env, cpu_model) < 0) {
+        cpu_x86_close(env);
+        return NULL;
+    }
     cpu_reset(env);
 #ifdef USE_KQEMU
     kqemu_init(env);
@@ -115,7 +116,7 @@
     return env;
 }
 
-struct x86_def_t {
+typedef struct x86_def_t {
     const char *name;
     uint32_t vendor1, vendor2, vendor3;
     int family;
@@ -123,7 +124,7 @@
     int stepping;
     uint32_t features, ext_features, ext2_features, ext3_features;
     uint32_t xlevel;
-};
+} x86_def_t;
 
 #define PPRO_FEATURES (CPUID_FP87 | CPUID_DE | CPUID_PSE | CPUID_TSC | \
           CPUID_MSR | CPUID_MCE | CPUID_CX8 | CPUID_PGE | CPUID_CMOV | \
@@ -194,10 +195,10 @@
     },
 };
 
-int x86_find_cpu_by_name(const unsigned char *cpu_model)
+static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, const char *cpu_model)
 {
-    int ret;
     unsigned int i;
+    x86_def_t *def;
 
     char *s = strdup(cpu_model);
     char *featurestr, *name = strtok(s, ",");
@@ -205,17 +206,16 @@
     uint32_t minus_features = 0, minus_ext_features = 0, minus_ext2_features = 0, minus_ext3_features = 0;
     int family = -1, model = -1, stepping = -1;
 
-    ret = -1;
-    x86_cpu_def = NULL;
+    def = NULL;
     for (i = 0; i < sizeof(x86_defs) / sizeof(x86_def_t); i++) {
         if (strcmp(name, x86_defs[i].name) == 0) {
-            x86_cpu_def = &x86_defs[i];
-            ret = 0;
+            def = &x86_defs[i];
             break;
         }
     }
-    if (!x86_cpu_def)
+    if (!def)
         goto error;
+    memcpy(x86_cpu_def, def, sizeof(*def));
 
     featurestr = strtok(NULL, ",");
 
@@ -274,10 +274,12 @@
     x86_cpu_def->ext_features &= ~minus_ext_features;
     x86_cpu_def->ext2_features &= ~minus_ext2_features;
     x86_cpu_def->ext3_features &= ~minus_ext3_features;
+    free(s);
+    return 0;
 
 error:
     free(s);
-    return ret;
+    return -1;
 }
 
 void x86_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
@@ -288,8 +290,12 @@
         (*cpu_fprintf)(f, "x86 %16s\n", x86_defs[i].name);
 }
 
-int cpu_x86_register (CPUX86State *env, const x86_def_t *def)
+static int cpu_x86_register (CPUX86State *env, const char *cpu_model)
 {
+    x86_def_t def1, *def = &def1;
+
+    if (cpu_x86_find_by_name(def, cpu_model) < 0)
+        return -1;
     if (def->vendor1) {
         env->cpuid_vendor1 = def->vendor1;
         env->cpuid_vendor2 = def->vendor2;

Modified: trunk/src/host/qemu-neo1973/target-m68k/cpu.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-m68k/cpu.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-m68k/cpu.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -100,8 +100,6 @@
     uint32_t rambar0;
     uint32_t cacr;
 
-    uint32_t features;
-
     /* ??? remove this.  */
     uint32_t t1;
 
@@ -118,9 +116,11 @@
     uint32_t qregs[MAX_QREGS];
 
     CPU_COMMON
+
+    uint32_t features;
 } CPUM68KState;
 
-CPUM68KState *cpu_m68k_init(void);
+CPUM68KState *cpu_m68k_init(const char *cpu_model);
 int cpu_m68k_exec(CPUM68KState *s);
 void cpu_m68k_close(CPUM68KState *s);
 void do_interrupt(int is_hw);
@@ -174,10 +174,6 @@
 #define MACSR_V     0x002
 #define MACSR_EV    0x001
 
-typedef struct m68k_def_t m68k_def_t;
-
-int cpu_m68k_set_model(CPUM68KState *env, const char * name);
-
 void m68k_set_irq_level(CPUM68KState *env, int level, uint8_t vector);
 void m68k_set_macsr(CPUM68KState *env, uint32_t val);
 void m68k_switch_sp(CPUM68KState *env);

Modified: trunk/src/host/qemu-neo1973/target-m68k/helper.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-m68k/helper.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-m68k/helper.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -33,6 +33,8 @@
     M68K_CPUID_ANY,
 };
 
+typedef struct m68k_def_t m68k_def_t;
+
 struct m68k_def_t {
     const char * name;
     enum m68k_cpuid id;
@@ -51,7 +53,7 @@
     env->features |= (1u << feature);
 }
 
-int cpu_m68k_set_model(CPUM68KState *env, const char * name)
+static int cpu_m68k_set_model(CPUM68KState *env, const char *name)
 {
     m68k_def_t *def;
 
@@ -60,7 +62,7 @@
             break;
     }
     if (!def->name)
-        return 1;
+        return -1;
 
     switch (def->id) {
     case M68K_CPUID_M5206:
@@ -98,10 +100,46 @@
     }
 
     register_m68k_insns(env);
-
     return 0;
 }
 
+void cpu_reset(CPUM68KState *env)
+{
+    memset(env, 0, offsetof(CPUM68KState, breakpoints));
+#if !defined (CONFIG_USER_ONLY)
+    env->sr = 0x2700;
+#endif
+    m68k_switch_sp(env);
+    /* ??? FP regs should be initialized to NaN.  */
+    env->cc_op = CC_OP_FLAGS;
+    /* TODO: We should set PC from the interrupt vector.  */
+    env->pc = 0;
+    tlb_flush(env, 1);
+}
+
+CPUM68KState *cpu_m68k_init(const char *cpu_model)
+{
+    CPUM68KState *env;
+
+    env = malloc(sizeof(CPUM68KState));
+    if (!env)
+        return NULL;
+    cpu_exec_init(env);
+
+    if (cpu_m68k_set_model(env, cpu_model) < 0) {
+        cpu_m68k_close(env);
+        return NULL;
+    }
+        
+    cpu_reset(env);
+    return env;
+}
+
+void cpu_m68k_close(CPUM68KState *env)
+{
+    qemu_free(env);
+}
+
 void cpu_m68k_flush_flags(CPUM68KState *env, int cc_op)
 {
     int flags;

Modified: trunk/src/host/qemu-neo1973/target-m68k/op_helper.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-m68k/op_helper.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-m68k/op_helper.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -57,7 +57,7 @@
 {
     TranslationBlock *tb;
     CPUState *saved_env;
-    target_phys_addr_t pc;
+    unsigned long pc;
     int ret;
 
     /* XXX: hack to restore env in all cases, even if not called from
@@ -68,7 +68,7 @@
     if (__builtin_expect(ret, 0)) {
         if (retaddr) {
             /* now we have a real cpu fault */
-            pc = (target_phys_addr_t)retaddr;
+            pc = (unsigned long)retaddr;
             tb = tb_find_pc(pc);
             if (tb) {
                 /* the PC is inside the translated code. It means that we have

Modified: trunk/src/host/qemu-neo1973/target-m68k/translate.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-m68k/translate.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-m68k/translate.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -3279,38 +3279,6 @@
     return gen_intermediate_code_internal(env, tb, 1);
 }
 
-void cpu_reset(CPUM68KState *env)
-{
-    memset(env, 0, offsetof(CPUM68KState, breakpoints));
-#if !defined (CONFIG_USER_ONLY)
-    env->sr = 0x2700;
-#endif
-    m68k_switch_sp(env);
-    /* ??? FP regs should be initialized to NaN.  */
-    env->cc_op = CC_OP_FLAGS;
-    /* TODO: We should set PC from the interrupt vector.  */
-    env->pc = 0;
-    tlb_flush(env, 1);
-}
-
-CPUM68KState *cpu_m68k_init(void)
-{
-    CPUM68KState *env;
-
-    env = malloc(sizeof(CPUM68KState));
-    if (!env)
-        return NULL;
-    cpu_exec_init(env);
-
-    cpu_reset(env);
-    return env;
-}
-
-void cpu_m68k_close(CPUM68KState *env)
-{
-    free(env);
-}
-
 void cpu_dump_state(CPUState *env, FILE *f,
                     int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
                     int flags)
@@ -3323,13 +3291,13 @@
         u.d = env->fregs[i];
         cpu_fprintf (f, "D%d = %08x   A%d = %08x   F%d = %08x%08x (%12g)\n",
                      i, env->dregs[i], i, env->aregs[i],
-                     i, u.l.upper, u.l.lower, u.d);
+                     i, u.l.upper, u.l.lower, *(double *)&u.d);
       }
     cpu_fprintf (f, "PC = %08x   ", env->pc);
     sr = env->sr;
     cpu_fprintf (f, "SR = %04x %c%c%c%c%c ", sr, (sr & 0x10) ? 'X' : '-',
                  (sr & CCF_N) ? 'N' : '-', (sr & CCF_Z) ? 'Z' : '-',
                  (sr & CCF_V) ? 'V' : '-', (sr & CCF_C) ? 'C' : '-');
-    cpu_fprintf (f, "FPRESULT = %12g\n", env->fp_result);
+    cpu_fprintf (f, "FPRESULT = %12g\n", *(double *)&env->fp_result);
 }
 

Modified: trunk/src/host/qemu-neo1973/target-mips/cpu.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-mips/cpu.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-mips/cpu.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -456,12 +456,7 @@
 
     CPU_COMMON
 
-    int ram_size;
-    const char *kernel_filename;
-    const char *kernel_cmdline;
-    const char *initrd_filename;
-
-    mips_def_t *cpu_model;
+    const mips_def_t *cpu_model;
 #ifndef CONFIG_USER_ONLY
     void *irq[8];
 #endif
@@ -479,9 +474,7 @@
 void r4k_do_tlbwr (void);
 void r4k_do_tlbp (void);
 void r4k_do_tlbr (void);
-int mips_find_by_name (const unsigned char *name, mips_def_t **def);
 void mips_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...));
-int cpu_mips_register (CPUMIPSState *env, mips_def_t *def);
 
 void do_unassigned_access(target_phys_addr_t addr, int is_write, int is_exec,
                           int unused);
@@ -565,7 +558,7 @@
 };
 
 int cpu_mips_exec(CPUMIPSState *s);
-CPUMIPSState *cpu_mips_init(void);
+CPUMIPSState *cpu_mips_init(const char *cpu_model);
 uint32_t cpu_mips_get_clock (void);
 int cpu_mips_signal_handler(int host_signum, void *pinfo, void *puc);
 

Modified: trunk/src/host/qemu-neo1973/target-mips/exec.h
===================================================================
--- trunk/src/host/qemu-neo1973/target-mips/exec.h	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-mips/exec.h	2007-11-13 16:27:39 UTC (rev 3406)
@@ -43,12 +43,6 @@
 #define WTH2 (env->fpu->ft2.w[!FP_ENDIAN_IDX])
 #endif
 
-#if defined (DEBUG_OP)
-# define RETURN() __asm__ __volatile__("nop" : : : "memory");
-#else
-# define RETURN() __asm__ __volatile__("" : : : "memory");
-#endif
-
 #include "cpu.h"
 #include "exec-all.h"
 

Modified: trunk/src/host/qemu-neo1973/target-mips/fop_template.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-mips/fop_template.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-mips/fop_template.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -25,14 +25,14 @@
     void glue(glue(op_load_fpr_,tregname), FREG) (void)  \
     {                                                    \
         treg = env->fpu->fpr[FREG].fs[FP_ENDIAN_IDX];    \
-        RETURN();                                        \
+        FORCE_RET();                                     \
     }
 
 #define OP_WSTORE_FREG(treg, tregname, FREG)             \
     void glue(glue(op_store_fpr_,tregname), FREG) (void) \
     {                                                    \
         env->fpu->fpr[FREG].fs[FP_ENDIAN_IDX] = treg;    \
-        RETURN();                                        \
+        FORCE_RET();                                     \
     }
 
 /* WT0 = FREG.w: op_load_fpr_WT0_fprFREG */
@@ -54,7 +54,7 @@
         else                                             \
             treg = (uint64_t)(env->fpu->fpr[FREG | 1].fs[FP_ENDIAN_IDX]) << 32 | \
                    env->fpu->fpr[FREG & ~1].fs[FP_ENDIAN_IDX]; \
-        RETURN();                                        \
+        FORCE_RET();                                     \
     }
 
 #define OP_DSTORE_FREG(treg, tregname, FREG)             \
@@ -66,7 +66,7 @@
             env->fpu->fpr[FREG | 1].fs[FP_ENDIAN_IDX] = treg >> 32; \
             env->fpu->fpr[FREG & ~1].fs[FP_ENDIAN_IDX] = treg;      \
         }                                                \
-        RETURN();                                        \
+        FORCE_RET();                                     \
     }
 
 OP_DLOAD_FREG(DT0, DT0_fpr, FREG)
@@ -82,14 +82,14 @@
     void glue(glue(op_load_fpr_,tregname), FREG) (void)  \
     {                                                    \
         treg = env->fpu->fpr[FREG].fs[!FP_ENDIAN_IDX];   \
-        RETURN();                                        \
+        FORCE_RET();                                     \
     }
 
 #define OP_PSSTORE_FREG(treg, tregname, FREG)            \
     void glue(glue(op_store_fpr_,tregname), FREG) (void) \
     {                                                    \
         env->fpu->fpr[FREG].fs[!FP_ENDIAN_IDX] = treg;   \
-        RETURN();                                        \
+        FORCE_RET();                                     \
     }
 
 OP_PSLOAD_FREG(WTH0, WTH0_fpr, FREG)
@@ -109,12 +109,12 @@
     void glue(op_set, tregname)(void)    \
     {                                    \
         treg = PARAM1;                   \
-        RETURN();                        \
+        FORCE_RET();                     \
     }                                    \
     void glue(op_reset, tregname)(void)  \
     {                                    \
         treg = 0;                        \
-        RETURN();                        \
+        FORCE_RET();                     \
     }
 
 SET_RESET(WT0, _WT0)

Modified: trunk/src/host/qemu-neo1973/target-mips/op.c
===================================================================
--- trunk/src/host/qemu-neo1973/target-mips/op.c	2007-11-13 15:54:28 UTC (rev 3405)
+++ trunk/src/host/qemu-neo1973/target-mips/op.c	2007-11-13 16:27:39 UTC (rev 3406)
@@ -250,31 +250,31 @@
 void op_dup_T0 (void)
 {
     T2 = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_load_HI (void)
 {
     T0 = env->HI[PARAM1][env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_store_HI (void)
 {
     env->HI[PARAM1][env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_load_LO (void)
 {
     T0 = env->LO[PARAM1][env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_store_LO (void)
 {
     env->LO[PARAM1][env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 /* Load and store */
@@ -308,14 +308,14 @@
     else
 #endif
         T0 += T1;
-    RETURN();
+    FORCE_RET();
 }
 
 /* Arithmetic */
 void op_add (void)
 {
     T0 = (int32_t)((int32_t)T0 + (int32_t)T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_addo (void)
@@ -329,13 +329,13 @@
         CALL_FROM_TB1(do_raise_exception, EXCP_OVERFLOW);
     }
     T0 = (int32_t)T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_sub (void)
 {
     T0 = (int32_t)((int32_t)T0 - (int32_t)T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_subo (void)
@@ -349,20 +349,20 @@
         CALL_FROM_TB1(do_raise_exception, EXCP_OVERFLOW);
     }
     T0 = (int32_t)T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mul (void)
 {
     T0 = (int32_t)((int32_t)T0 * (int32_t)T1);
-    RETURN();
+    FORCE_RET();
 }
 
 #if HOST_LONG_BITS < 64
 void op_div (void)
 {
     CALL_FROM_TB0(do_div);
-    RETURN();
+    FORCE_RET();
 }
 #else
 void op_div (void)
@@ -371,7 +371,7 @@
         env->LO[0][env->current_tc] = (int32_t)((int64_t)(int32_t)T0 / (int32_t)T1);
         env->HI[0][env->current_tc] = (int32_t)((int64_t)(int32_t)T0 % (int32_t)T1);
     }
-    RETURN();
+    FORCE_RET();
 }
 #endif
 
@@ -381,7 +381,7 @@
         env->LO[0][env->current_tc] = (int32_t)((uint32_t)T0 / (uint32_t)T1);
         env->HI[0][env->current_tc] = (int32_t)((uint32_t)T0 % (uint32_t)T1);
     }
-    RETURN();
+    FORCE_RET();
 }
 
 #if defined(TARGET_MIPS64)
@@ -389,7 +389,7 @@
 void op_dadd (void)
 {
     T0 += T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_daddo (void)
@@ -402,13 +402,13 @@
         /* operands of same sign, result different sign */
         CALL_FROM_TB1(do_raise_exception, EXCP_OVERFLOW);
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsub (void)
 {
     T0 -= T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsubo (void)
@@ -421,27 +421,27 @@
         /* operands of different sign, first operand and result different sign */
         CALL_FROM_TB1(do_raise_exception, EXCP_OVERFLOW);
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmul (void)
 {
     T0 = (int64_t)T0 * (int64_t)T1;
-    RETURN();
+    FORCE_RET();
 }
 
 /* Those might call libgcc functions.  */
 void op_ddiv (void)
 {
     do_ddiv();
-    RETURN();
+    FORCE_RET();
 }
 
 #if TARGET_LONG_BITS > HOST_LONG_BITS
 void op_ddivu (void)
 {
     do_ddivu();
-    RETURN();
+    FORCE_RET();
 }
 #else
 void op_ddivu (void)
@@ -450,7 +450,7 @@
         env->LO[0][env->current_tc] = T0 / T1;
         env->HI[0][env->current_tc] = T0 % T1;
     }
-    RETURN();
+    FORCE_RET();
 }
 #endif
 #endif /* TARGET_MIPS64 */
@@ -459,43 +459,43 @@
 void op_and (void)
 {
     T0 &= T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_nor (void)
 {
     T0 = ~(T0 | T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_or (void)
 {
     T0 |= T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_xor (void)
 {
     T0 ^= T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_sll (void)
 {
     T0 = (int32_t)((uint32_t)T0 << T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_sra (void)
 {
     T0 = (int32_t)((int32_t)T0 >> T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_srl (void)
 {
     T0 = (int32_t)((uint32_t)T0 >> T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_rotr (void)
@@ -506,25 +506,25 @@
        tmp = (int32_t)((uint32_t)T0 << (0x20 - T1));
        T0 = (int32_t)((uint32_t)T0 >> T1) | tmp;
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_sllv (void)
 {
     T0 = (int32_t)((uint32_t)T1 << ((uint32_t)T0 & 0x1F));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_srav (void)
 {
     T0 = (int32_t)((int32_t)T1 >> (T0 & 0x1F));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_srlv (void)
 {
     T0 = (int32_t)((uint32_t)T1 >> (T0 & 0x1F));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_rotrv (void)
@@ -537,19 +537,19 @@
        T0 = (int32_t)((uint32_t)T1 >> T0) | tmp;
     } else
        T0 = T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_clo (void)
 {
     T0 = clo32(T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_clz (void)
 {
     T0 = clz32(T0);
-    RETURN();
+    FORCE_RET();
 }
 
 #if defined(TARGET_MIPS64)
@@ -559,85 +559,85 @@
 void op_dsll (void)
 {
     CALL_FROM_TB0(do_dsll);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsll32 (void)
 {
     CALL_FROM_TB0(do_dsll32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsra (void)
 {
     CALL_FROM_TB0(do_dsra);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsra32 (void)
 {
     CALL_FROM_TB0(do_dsra32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrl (void)
 {
     CALL_FROM_TB0(do_dsrl);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrl32 (void)
 {
     CALL_FROM_TB0(do_dsrl32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotr (void)
 {
     CALL_FROM_TB0(do_drotr);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotr32 (void)
 {
     CALL_FROM_TB0(do_drotr32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsllv (void)
 {
     CALL_FROM_TB0(do_dsllv);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrav (void)
 {
     CALL_FROM_TB0(do_dsrav);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrlv (void)
 {
     CALL_FROM_TB0(do_dsrlv);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotrv (void)
 {
     CALL_FROM_TB0(do_drotrv);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dclo (void)
 {
     CALL_FROM_TB0(do_dclo);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dclz (void)
 {
     CALL_FROM_TB0(do_dclz);
-    RETURN();
+    FORCE_RET();
 }
 
 #else /* TARGET_LONG_BITS > HOST_LONG_BITS */
@@ -645,37 +645,37 @@
 void op_dsll (void)
 {
     T0 = T0 << T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsll32 (void)
 {
     T0 = T0 << (T1 + 32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsra (void)
 {
     T0 = (int64_t)T0 >> T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsra32 (void)
 {
     T0 = (int64_t)T0 >> (T1 + 32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrl (void)
 {
     T0 = T0 >> T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrl32 (void)
 {
     T0 = T0 >> (T1 + 32);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotr (void)
@@ -686,7 +686,7 @@
        tmp = T0 << (0x40 - T1);
        T0 = (T0 >> T1) | tmp;
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotr32 (void)
@@ -697,25 +697,25 @@
        tmp = T0 << (0x40 - (32 + T1));
        T0 = (T0 >> (32 + T1)) | tmp;
     }
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsllv (void)
 {
     T0 = T1 << (T0 & 0x3F);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrav (void)
 {
     T0 = (int64_t)T1 >> (T0 & 0x3F);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dsrlv (void)
 {
     T0 = T1 >> (T0 & 0x3F);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_drotrv (void)
@@ -728,19 +728,19 @@
        T0 = (T1 >> T0) | tmp;
     } else
        T0 = T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dclo (void)
 {
     T0 = clo64(T0);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dclz (void)
 {
     T0 = clz64(T0);
-    RETURN();
+    FORCE_RET();
 }
 #endif /* TARGET_LONG_BITS > HOST_LONG_BITS */
 #endif /* TARGET_MIPS64 */
@@ -750,37 +750,37 @@
 void op_mult (void)
 {
     CALL_FROM_TB0(do_mult);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_multu (void)
 {
     CALL_FROM_TB0(do_multu);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_madd (void)
 {
     CALL_FROM_TB0(do_madd);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_maddu (void)
 {
     CALL_FROM_TB0(do_maddu);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_msub (void)
 {
     CALL_FROM_TB0(do_msub);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_msubu (void)
 {
     CALL_FROM_TB0(do_msubu);
-    RETURN();
+    FORCE_RET();
 }
 
 #else /* TARGET_LONG_BITS > HOST_LONG_BITS */
@@ -800,13 +800,13 @@
 void op_mult (void)
 {
     set_HILO((int64_t)(int32_t)T0 * (int64_t)(int32_t)T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_multu (void)
 {
     set_HILO((uint64_t)(uint32_t)T0 * (uint64_t)(uint32_t)T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_madd (void)
@@ -815,7 +815,7 @@
 
     tmp = ((int64_t)(int32_t)T0 * (int64_t)(int32_t)T1);
     set_HILO((int64_t)get_HILO() + tmp);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_maddu (void)
@@ -824,7 +824,7 @@
 
     tmp = ((uint64_t)(uint32_t)T0 * (uint64_t)(uint32_t)T1);
     set_HILO(get_HILO() + tmp);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_msub (void)
@@ -833,7 +833,7 @@
 
     tmp = ((int64_t)(int32_t)T0 * (int64_t)(int32_t)T1);
     set_HILO((int64_t)get_HILO() - tmp);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_msubu (void)
@@ -842,7 +842,7 @@
 
     tmp = ((uint64_t)(uint32_t)T0 * (uint64_t)(uint32_t)T1);
     set_HILO(get_HILO() - tmp);
-    RETURN();
+    FORCE_RET();
 }
 #endif /* TARGET_LONG_BITS > HOST_LONG_BITS */
 
@@ -850,13 +850,13 @@
 void op_dmult (void)
 {
     CALL_FROM_TB4(muls64, &(env->LO[0][env->current_tc]), &(env->HI[0][env->current_tc]), T0, T1);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_dmultu (void)
 {
     CALL_FROM_TB4(mulu64, &(env->LO[0][env->current_tc]), &(env->HI[0][env->current_tc]), T0, T1);
-    RETURN();
+    FORCE_RET();
 }
 #endif
 
@@ -865,28 +865,28 @@
 {
     if (T1 != 0)
         env->gpr[PARAM1][env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_movz (void)
 {
     if (T1 == 0)
         env->gpr[PARAM1][env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_movf (void)
 {
     if (!(env->fpu->fcr31 & PARAM1))
         T0 = T1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_movt (void)
 {
     if (env->fpu->fcr31 & PARAM1)
         T0 = T1;
-    RETURN();
+    FORCE_RET();
 }
 
 /* Tests */
@@ -898,7 +898,7 @@
     } else {                \
         T0 = 0;             \
     }                       \
-    RETURN();               \
+    FORCE_RET();            \
 }
 
 OP_COND(eq, T0 == T1);
@@ -916,45 +916,45 @@
 void OPPROTO op_goto_tb0(void)
 {
     GOTO_TB(op_goto_tb0, PARAM1, 0);
-    RETURN();
+    FORCE_RET();
 }
 
 void OPPROTO op_goto_tb1(void)
 {
     GOTO_TB(op_goto_tb1, PARAM1, 1);
-    RETURN();
+    FORCE_RET();
 }
 
 /* Branch to register */
 void op_save_breg_target (void)
 {
     env->btarget = T2;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_restore_breg_target (void)
 {
     T2 = env->btarget;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_breg (void)
 {
     env->PC[env->current_tc] = T2;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_save_btarget (void)
 {
     env->btarget = PARAM1;
-    RETURN();
+    FORCE_RET();
 }
 
 #if defined(TARGET_MIPS64)
 void op_save_btarget64 (void)
 {
     env->btarget = ((uint64_t)PARAM1 << 32) | (uint32_t)PARAM2;
-    RETURN();
+    FORCE_RET();
 }
 #endif
 
@@ -962,111 +962,111 @@
 void op_set_bcond (void)
 {
     T2 = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_save_bcond (void)
 {
     env->bcond = T2;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_restore_bcond (void)
 {
     T2 = env->bcond;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_jnz_T2 (void)
 {
     if (T2)
         GOTO_LABEL_PARAM(1);
-    RETURN();
+    FORCE_RET();
 }
 
 /* CP0 functions */
 void op_mfc0_index (void)
 {
     T0 = env->CP0_Index;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_mvpcontrol (void)
 {
     T0 = env->mvp->CP0_MVPControl;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_mvpconf0 (void)
 {
     T0 = env->mvp->CP0_MVPConf0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_mvpconf1 (void)
 {
     T0 = env->mvp->CP0_MVPConf1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_random (void)
 {
     CALL_FROM_TB0(do_mfc0_random);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpecontrol (void)
 {
     T0 = env->CP0_VPEControl;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpeconf0 (void)
 {
     T0 = env->CP0_VPEConf0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpeconf1 (void)
 {
     T0 = env->CP0_VPEConf1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_yqmask (void)
 {
     T0 = env->CP0_YQMask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpeschedule (void)
 {
     T0 = env->CP0_VPESchedule;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpeschefback (void)
 {
     T0 = env->CP0_VPEScheFBack;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_vpeopt (void)
 {
     T0 = env->CP0_VPEOpt;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_entrylo0 (void)
 {
     T0 = (int32_t)env->CP0_EntryLo0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tcstatus (void)
 {
     T0 = env->CP0_TCStatus[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tcstatus(void)
@@ -1074,13 +1074,13 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCStatus[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tcbind (void)
 {
     T0 = env->CP0_TCBind[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tcbind(void)
@@ -1088,13 +1088,13 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCBind[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tcrestart (void)
 {
     T0 = env->PC[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tcrestart(void)
@@ -1102,13 +1102,13 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->PC[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tchalt (void)
 {
     T0 = env->CP0_TCHalt[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tchalt(void)
@@ -1116,13 +1116,13 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCHalt[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tccontext (void)
 {
     T0 = env->CP0_TCContext[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tccontext(void)
@@ -1130,13 +1130,13 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCContext[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tcschedule (void)
 {
     T0 = env->CP0_TCSchedule[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tcschedule(void)
@@ -1144,13 +1144,13 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCSchedule[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_tcschefback (void)
 {
     T0 = env->CP0_TCScheFBack[env->current_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_tcschefback(void)
@@ -1158,91 +1158,91 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = env->CP0_TCScheFBack[other_tc];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_entrylo1 (void)
 {
     T0 = (int32_t)env->CP0_EntryLo1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_context (void)
 {
     T0 = (int32_t)env->CP0_Context;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_pagemask (void)
 {
     T0 = env->CP0_PageMask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_pagegrain (void)
 {
     T0 = env->CP0_PageGrain;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_wired (void)
 {
     T0 = env->CP0_Wired;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsconf0 (void)
 {
     T0 = env->CP0_SRSConf0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsconf1 (void)
 {
     T0 = env->CP0_SRSConf1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsconf2 (void)
 {
     T0 = env->CP0_SRSConf2;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsconf3 (void)
 {
     T0 = env->CP0_SRSConf3;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsconf4 (void)
 {
     T0 = env->CP0_SRSConf4;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_hwrena (void)
 {
     T0 = env->CP0_HWREna;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_badvaddr (void)
 {
     T0 = (int32_t)env->CP0_BadVAddr;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_count (void)
 {
     CALL_FROM_TB0(do_mfc0_count);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_entryhi (void)
 {
     T0 = (int32_t)env->CP0_EntryHi;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_entryhi(void)
@@ -1250,19 +1250,19 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     T0 = (env->CP0_EntryHi & ~0xff) | (env->CP0_TCStatus[other_tc] & 0xff);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_compare (void)
 {
     T0 = env->CP0_Compare;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_status (void)
 {
     T0 = env->CP0_Status;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_status(void)
@@ -1274,115 +1274,115 @@
     T0 |= tcstatus & (0xf << CP0TCSt_TCU0);
     T0 |= (tcstatus & (1 << CP0TCSt_TMX)) >> (CP0TCSt_TMX - CP0St_MX);
     T0 |= (tcstatus & (0x3 << CP0TCSt_TKSU)) >> (CP0TCSt_TKSU - CP0St_KSU);
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_intctl (void)
 {
     T0 = env->CP0_IntCtl;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsctl (void)
 {
     T0 = env->CP0_SRSCtl;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_srsmap (void)
 {
     T0 = env->CP0_SRSMap;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_cause (void)
 {
     T0 = env->CP0_Cause;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_epc (void)
 {
     T0 = (int32_t)env->CP0_EPC;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_prid (void)
 {
     T0 = env->CP0_PRid;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_ebase (void)
 {
     T0 = env->CP0_EBase;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config0 (void)
 {
     T0 = env->CP0_Config0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config1 (void)
 {
     T0 = env->CP0_Config1;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config2 (void)
 {
     T0 = env->CP0_Config2;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config3 (void)
 {
     T0 = env->CP0_Config3;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config6 (void)
 {
     T0 = env->CP0_Config6;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_config7 (void)
 {
     T0 = env->CP0_Config7;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_lladdr (void)
 {
     T0 = (int32_t)env->CP0_LLAddr >> 4;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_watchlo (void)
 {
     T0 = (int32_t)env->CP0_WatchLo[PARAM1];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_watchhi (void)
 {
     T0 = env->CP0_WatchHi[PARAM1];
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_xcontext (void)
 {
     T0 = (int32_t)env->CP0_XContext;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_framemask (void)
 {
     T0 = env->CP0_Framemask;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_debug (void)
@@ -1390,7 +1390,7 @@
     T0 = env->CP0_Debug;
     if (env->hflags & MIPS_HFLAG_DM)
         T0 |= 1 << CP0DB_DM;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mftc0_debug(void)
@@ -1401,55 +1401,55 @@
     T0 = (env->CP0_Debug & ~((1 << CP0DB_SSt) | (1 << CP0DB_Halt))) |
          (env->CP0_Debug_tcstatus[other_tc] &
           ((1 << CP0DB_SSt) | (1 << CP0DB_Halt)));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_depc (void)
 {
     T0 = (int32_t)env->CP0_DEPC;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_performance0 (void)
 {
     T0 = env->CP0_Performance0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_taglo (void)
 {
     T0 = env->CP0_TagLo;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_datalo (void)
 {
     T0 = env->CP0_DataLo;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_taghi (void)
 {
     T0 = env->CP0_TagHi;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_datahi (void)
 {
     T0 = env->CP0_DataHi;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_errorepc (void)
 {
     T0 = (int32_t)env->CP0_ErrorEPC;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mfc0_desave (void)
 {
     T0 = env->CP0_DESAVE;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_index (void)
@@ -1462,7 +1462,7 @@
         num <<= 1;
     } while (tmp);
     env->CP0_Index = (env->CP0_Index & 0x80000000) | (T0 & (num - 1));
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_mvpcontrol (void)
@@ -1480,7 +1480,7 @@
     // TODO: Enable/disable shared TLB, enable/disable VPEs.
 
     env->mvp->CP0_MVPControl = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpecontrol (void)
@@ -1498,7 +1498,7 @@
     // TODO: Enable/disable TCs.
 
     env->CP0_VPEControl = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpeconf0 (void)
@@ -1516,7 +1516,7 @@
     // TODO: TC exclusive handling due to ERL/EXL.
 
     env->CP0_VPEConf0 = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpeconf1 (void)
@@ -1535,32 +1535,32 @@
     // TODO: Handle FPU (CP1) binding.
 
     env->CP0_VPEConf1 = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_yqmask (void)
 {
     /* Yield qualifier inputs not implemented. */
     env->CP0_YQMask = 0x00000000;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpeschedule (void)
 {
     env->CP0_VPESchedule = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpeschefback (void)
 {
     env->CP0_VPEScheFBack = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_vpeopt (void)
 {
     env->CP0_VPEOpt = T0 & 0x0000ffff;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_entrylo0 (void)
@@ -1568,7 +1568,7 @@
     /* Large physaddr not implemented */
     /* 1k pages not implemented */
     env->CP0_EntryLo0 = T0 & 0x3FFFFFFF;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tcstatus (void)
@@ -1581,7 +1581,7 @@
     // TODO: Sync with CP0_Status.
 
     env->CP0_TCStatus[env->current_tc] = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tcstatus (void)
@@ -1591,7 +1591,7 @@
     // TODO: Sync with CP0_Status.
 
     env->CP0_TCStatus[other_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tcbind (void)
@@ -1603,7 +1603,7 @@
         mask |= (1 << CP0TCBd_CurVPE);
     newval = (env->CP0_TCBind[env->current_tc] & ~mask) | (T0 & mask);
     env->CP0_TCBind[env->current_tc] = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tcbind (void)
@@ -1616,7 +1616,7 @@
         mask |= (1 << CP0TCBd_CurVPE);
     newval = (env->CP0_TCBind[other_tc] & ~mask) | (T0 & mask);
     env->CP0_TCBind[other_tc] = newval;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tcrestart (void)
@@ -1625,7 +1625,7 @@
     env->CP0_TCStatus[env->current_tc] &= ~(1 << CP0TCSt_TDS);
     env->CP0_LLAddr = 0ULL;
     /* MIPS16 not implemented. */
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tcrestart (void)
@@ -1636,7 +1636,7 @@
     env->CP0_TCStatus[other_tc] &= ~(1 << CP0TCSt_TDS);
     env->CP0_LLAddr = 0ULL;
     /* MIPS16 not implemented. */
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tchalt (void)
@@ -1645,7 +1645,7 @@
 
     // TODO: Halt TC / Restart (if allocated+active) TC.
 
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tchalt (void)
@@ -1655,13 +1655,13 @@
     // TODO: Halt TC / Restart (if allocated+active) TC.
 
     env->CP0_TCHalt[other_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tccontext (void)
 {
     env->CP0_TCContext[env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tccontext (void)
@@ -1669,13 +1669,13 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     env->CP0_TCContext[other_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tcschedule (void)
 {
     env->CP0_TCSchedule[env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tcschedule (void)
@@ -1683,13 +1683,13 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     env->CP0_TCSchedule[other_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_tcschefback (void)
 {
     env->CP0_TCScheFBack[env->current_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mttc0_tcschefback (void)
@@ -1697,7 +1697,7 @@
     int other_tc = env->CP0_VPEControl & (0xff << CP0VPECo_TargTC);
 
     env->CP0_TCScheFBack[other_tc] = T0;
-    RETURN();
+    FORCE_RET();
 }
 
 void op_mtc0_entrylo1 (void)
@@ -1705,20 +1705,20 @@
     /* Large physaddr not im